[cut: only the first 33554432 bytes of this file were read]
<?xml version="1.0" encoding="utf-8"?>
<posts>
  <row Id="1" PostTypeId="1" AcceptedAnswerId="2" CreationDate="2013-05-07T20:41:34.453" Score="81" ViewCount="84227" Body="&lt;p&gt;I've been building IPsec VPNs for years but to be honest I've never fully grasped the technical difference between IKE and ISAKMP. I often see the two terms used interchangeably (probably incorrectly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the two basic phases of IPsec and that ISAKMP seems to deal primarily with phase one. For instance, the IOS command &quot;show crypto isakmp sa&quot; displays IPsec phase one information. But there's no equivalent command for IKE.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2020-08-07T13:15:21.870" Title="What's the difference between IKE and ISAKMP?" Tags="|ipsec|ike|vpn|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2" PostTypeId="2" ParentId="1" CreationDate="2013-05-07T20:46:36.213" Score="61" Body="&lt;p&gt;ISAKMP is part of IKE. (IKE has ISAKMP, SKEME and OAKLEY). IKE establishs the shared security policy and authenticated keys. ISAKMP is the protocol that specifies the mechanics of the key exchange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The confusion, (for me,) is that in the Cisco IOS ISAKMP/IKE are used to refer to the same thing. By which I mean, my understanding is that Cisco's IKE only implements/uses ISAKMP. So one configures IKE, and then conceptually inside that, one configures ISAKMP.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-07T20:46:36.213" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3" PostTypeId="1" AcceptedAnswerId="11" CreationDate="2013-05-07T20:49:11.133" Score="15" ViewCount="3452" Body="&lt;p&gt;How can one perform quality of service based on layer 7 traffic? How would you classify the traffic and actively monitor and respond (dynamically prioritizing traffic)? Are there any solutions which provide a kind of weather map?&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-12-24T20:47:30.883" Title="Quality of Service based on Layer 7 traffic" Tags="|qos|" AnswerCount="7" CommentCount="1" ClosedDate="2013-12-24T21:24:07.720" ContentLicense="CC BY-SA 3.0" />
  <row Id="4" PostTypeId="1" AcceptedAnswerId="23" CreationDate="2013-05-07T20:49:24.503" Score="21" ViewCount="22780" Body="&lt;p&gt;Our network experienced a short outage when one of our BGP routes went down for a short time yesterday. Thankfully our connections failed over to our secondary BGP route after a few minutes, and the primary route became operational after a shut/no shut on the ISP side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're running 2 stacked (backplane) Cisco 3750e switches running iOS 12.2 58.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my conversation with our ISP, they couldn't give any definitive answers to the cause. &lt;strong&gt;Is there anything that we can do to pinpoint the cause on our end to avoid this issue in the future?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Log at the time of error&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172258: May  6 14:43:06: %BGP-5-ADJCHANGE: neighbor xxx.xxx.12.34 Down BGP Notification sent&#xA;172259: May  6 14:43:06: %BGP-3-NOTIFICATION: sent to neighbor xxx.xxx.12.34 4/0 (hold time expired) 0 bytes&#xA;172260: May  6 14:43:06: %BGP_SESSION-5-ADJCHANGE: neighbor xxx.xxx.12.34 IPv4 Multicast topology base removed from session  BGP Notification sent&#xA;172261: May  6 14:43:06: %BGP_SESSION-5-ADJCHANGE: neighbor xxx.xxx.12.34 IPv4 Unicast topology base removed from session  BGP Notification sent&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Log when ISP did a shut/no shut to reset BGP on their side&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172542: May  6 15:04:15: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/0/49, changed state to down&#xA;172543: May  6 15:04:16: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/49, changed state to down&#xA;172544: May  6 15:04:16: %PIM-5-NBRCHG: neighbor xxx.xxx.12.34 DOWN on interface GigabitEthernet2/0/49 non DR&#xA;172545: May  6 15:04:16: %PIM-5-NBRCHG: neighbor xxx.xxx.12.34 UP on interface GigabitEthernet2/0/49 &#xA;172546: May  6 15:04:16: %PIM-5-DRCHG: DR change from neighbor 0.0.0.0 to xxx.xxx.12.35 on interface GigabitEthernet2/0/49&#xA;172547: May  6 15:04:18: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/49, changed state to up&#xA;172548: May  6 15:04:19: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/0/49, changed state to up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Log when the BGP connection finally went from idle to Up&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172828: May  6 15:27:33: %BGP-5-ADJCHANGE: neighbor xxx.xxx.12.34 Up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;BGP interface on our end (note: no CRC, drops, collisions reported...)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GigabitEthernet2/0/49 is up, line protocol is up (connected)&#xA;Hardware is Gigabit Ethernet, address is xxxx.xxxx&#xA;Internet address is xxx.xxx.12.35/31&#xA;MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,&#xA;reliability 255/255, txload 1/255, rxload 3/255&#xA;Encapsulation ARPA, loopback not set&#xA;Keepalive not set&#xA;Full-duplex, 1000Mb/s, link type is auto, media type is 1000BaseLX SFP&#xA;input flow-control is off, output flow-control is unsupported&#xA;ARP type: ARPA, ARP Timeout 04:00:00&#xA;Last input 00:00:09, output 00:00:12, output hang never&#xA;Last clearing of &quot;show interface&quot; counters never&#xA;Input queue: 0/75/52/0 (size/max/drops/flushes); Total output drops: 0&#xA;Queueing strategy: fifo&#xA;Output queue: 0/40 (size/max)&#xA;5 minute input rate 14536000 bits/sec, 1655 packets/sec&#xA;5 minute output rate 1010000 bits/sec, 640 packets/sec&#xA;413176726 packets input, 428902543141 bytes, 0 no buffer&#xA;Received 143495 broadcasts (0 IP multicasts)&#xA;0 runts, 0 giants, 0 throttles&#xA;0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;0 watchdog, 139275 multicast, 0 pause input&#xA;0 input packets with dribble condition detected&#xA;125748632 packets output, 42915625632 bytes, 0 underruns&#xA;0 output errors, 0 collisions, 0 interface resets&#xA;0 unknown protocol drops&#xA;0 babbles, 0 late collision, 0 deferred&#xA;0 lost carrier, 0 no carrier, 0 pause output&#xA;0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13" LastEditorUserId="49" LastEditDate="2013-05-17T19:23:49.930" LastActivityDate="2016-09-14T14:13:37.350" Title="Troubleshooting &quot;Down BGP&quot; connections" Tags="|cisco-catalyst|bgp|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5" PostTypeId="1" AcceptedAnswerId="10" CreationDate="2013-05-07T20:50:44.697" Score="15" ViewCount="2277" Body="&lt;p&gt;I know that to secure OSPF you should 1) use OSPF authentication, 2) use passive interface command on interfaces that do not have ospf neighbors.  If I only use the passive interface command and not ospf authentication, what vulnerabilities am I left open to?&lt;/p&gt;&#xA;" OwnerUserId="23" LastActivityDate="2013-11-29T00:16:37.123" Title="Securing OSPF with only passive interfaces" Tags="|ospf|security|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6" PostTypeId="1" CreationDate="2013-05-07T20:55:35.173" Score="8" ViewCount="898" Body="&lt;p&gt;Trying to figure out how to perform rate limits on Juniper EX for both inet and inet6 families.  Ideally I'd like a packet rate limiter to be applied before the ip type is ever looked at.  Basically, I don't care whether the traffic is V6, V4, or MPLS, I want to rate limit all packets incoming to the interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To note, the addresses for each family are applied directly to the interface.  I can't see a way to actually make this work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The work around I've found is to convert the interface to layer-2, stick it in a vlan, create an RVI and apply all the addressing to the that.  Then make the interface 'family ethernet-switching' and apply a policer there.  That seems like a lot of work around to get something which, to me, should be pretty straightforward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EX4550 running 12.3R2.5&lt;/p&gt;&#xA;" OwnerUserId="70" LastEditorUserId="165" LastEditDate="2013-05-08T00:56:48.370" LastActivityDate="2013-05-08T00:56:48.370" Title="Aggregate Family Rate Limits on Juniper EX" Tags="|juniper|policing|juniper-ex|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7" PostTypeId="2" ParentId="5" CreationDate="2013-05-07T20:55:45.647" Score="8" Body="&lt;p&gt;It depends on your network topology. If the non-passive links are isolated (point-to-point) and secured at lower layers of the stack (physical access control of the routers), then I would be hard pressed to identify a viable attack vector. Authentication is critical when it is possible for a rogue router to present arbitrary traffic on a given link.&lt;/p&gt;&#xA;" OwnerUserId="47" LastActivityDate="2013-05-07T20:55:45.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8" PostTypeId="1" AcceptedAnswerId="18" CreationDate="2013-05-07T20:56:03.490" Score="12" ViewCount="1307" Body="&lt;p&gt;What are best practices migrating ASA config to 8.3 and forward?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have manually created a new config file with the following changes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;new network objects&lt;/li&gt;&#xA;&lt;li&gt;new NAT statements&lt;/li&gt;&#xA;&lt;li&gt;new access-lists referencing network objects&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My next steps would be to upgrade from 8.2 to 8.3 keeping note of any errors. Instead of cleaning up the config would it be easier to re-do it line by line?&lt;/p&gt;&#xA;" OwnerUserId="63" LastEditorDisplayName="user36472" LastEditDate="2018-02-14T16:39:52.853" LastActivityDate="2018-02-14T16:39:52.853" Title="Migrating pre-8.3 ASA config to 8.3+" Tags="|cisco-asa|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9" PostTypeId="2" ParentId="5" CreationDate="2013-05-07T20:56:18.437" Score="6" Body="&lt;p&gt;If anyone were to gain access to the actual equipment and somehow insert another device to the far end of the link, that would give them access to your network, to inject routes into your routing table and other nasty stuff like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A scenario like this would be very theoretical in places such as backbone networks that are in secured locations, but should the link go to a customer or to another third party, some sort of authentication would probably be very wise.&lt;/p&gt;&#xA;" OwnerUserId="73" LastActivityDate="2013-05-07T20:56:18.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10" PostTypeId="2" ParentId="5" CreationDate="2013-05-07T20:58:29.533" Score="24" Body="&lt;p&gt;One issue is that authentication ensures that only trusted devices are capable of exchanging routes on the network.  Without authentication, you could introduce a non-trusted device and cause significant routing issues.  For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If area 0 is not authenticated, attach a router in area 0 with bogus routes to null0.  You could even create a default route and inject it into the topology leading to the bad router to black hole traffic.  Or the route could force traffic toward a bogus gateway designed to sniff connections and pull out insecure data before sending it on the right path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Authentication ensures that only routers you know about and trust are exchanging information.&lt;/p&gt;&#xA;" OwnerUserId="71" LastActivityDate="2013-05-07T20:58:29.533" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11" PostTypeId="2" ParentId="3" CreationDate="2013-05-07T21:02:33.150" Score="14" Body="&lt;p&gt;I think this depends heavily on the platform on which you want to accomplish this. For example, IOS uses NBAR to classify transit traffic, primarily for QoS and security mechanisms. But as far as I know, NBAR QoS configurations are entirely static.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For centralized monitoring, NetFlow is probably your best bet.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-07T21:02:33.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12" PostTypeId="2" ParentId="5" CreationDate="2013-05-07T21:03:38.387" Score="5" Body="&lt;p&gt;If we make an assumption that your layers 1-3 are secure than OSPF authentication doesn't make any sense. But because layer 1-3 are not necessarily secure OSPF employs it's own security method - authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Authentication in OSPF prevents an attacker who can sniff and inject packets to fool routers and modify OSPF topology. Results are for example: possible of MITM when attacker changes the topology in such way that certain/all traffic flows through machine controlled by him. Denial of service when the attacker discards traffic which flows through him. Another result could be meltdown of all routers when attacker announces new information very rapidly, although this could be partially solved by tuning SPF timers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Authentication also prevents replay attacks, for example it prevents attacker from advertising expired information from past. Also it prevents mayhem by plugging a router from another network with existing OSPF configuration which could inject overlapping routes for example (thanks to this, authentication is good even if you have your layer 1-3 secured).&lt;/p&gt;&#xA;" OwnerUserId="75" LastActivityDate="2013-05-07T21:03:38.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13" PostTypeId="1" AcceptedAnswerId="14" CreationDate="2013-05-07T21:03:58.800" Score="6" ViewCount="3373" Body="&lt;p&gt;We are running a wireless infrastructure using PEAPv1/EAP-GTC. Our Windows machines can't seem to connect to wireless access points, what is happening?&lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="33" LastEditDate="2013-05-25T17:57:40.210" LastActivityDate="2022-11-02T21:02:13.160" Title="Does Windows support PEAPv1/EAP-GTC?" Tags="|wireless|ieee-802.11|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14" PostTypeId="2" ParentId="13" CreationDate="2013-05-07T21:03:58.800" Score="6" Body="&lt;p&gt;Naitvely, Windows does not support PEAP-GTC, however there are supplicants available to support PEAP-GTC authentication on Windows.&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-05-07T21:03:58.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15" PostTypeId="1" AcceptedAnswerId="20" CreationDate="2013-05-07T21:05:25.760" Score="9" ViewCount="1521" Body="&lt;p&gt;I have bought two WS-2948G switches from cisco for a lab. I now need to buy two additional modules for them WS-G5484. I've never worked with fiber so I was wondering if there are differences in fiber cables and what type of fiber cable I should use on these?&lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="103" LastEditDate="2013-05-08T07:12:40.303" LastActivityDate="2014-05-28T08:00:04.953" Title="What type of fiber do I need for a WS-G5484" Tags="|fiber|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16" PostTypeId="1" AcceptedAnswerId="17" CreationDate="2013-05-07T21:10:21.340" Score="24" ViewCount="68959" Body="&lt;p&gt;I was doing some cisco exercises on configuring a vtp server and client, something I can't figure out is :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I setup a vtp server, added my VLAN's&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I then took another switch that was attached to this vtp server and&lt;br&gt;&#xA;set it to client&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Now my VTP client didn't get the vlans configured on the vtp server,&#xA;however when I added another vlan on my server, suddenly they were&#xA;all there&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is there a way to push the configs, like a force update command ?&lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="231" LastEditDate="2013-05-09T16:17:13.093" LastActivityDate="2019-10-01T21:08:40.637" Title="How can I force VTP clients to update their VLAN database from the VTP server, on Cisco devices?" Tags="|cisco|vtp|" AnswerCount="8" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17" PostTypeId="2" ParentId="16" CreationDate="2013-05-07T21:10:21.340" Score="23" Body="&lt;p&gt;You can't manually force updates because VTP configs are pushed based on the highest current VLAN database revision number. Normally, after every change to your VTP config the configuration revision number should be incremented. The only way to force update this is by actually doing a VTP database change.&lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="63" LastEditDate="2013-05-08T06:46:58.727" LastActivityDate="2013-05-08T06:46:58.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18" PostTypeId="2" ParentId="8" CreationDate="2013-05-07T21:10:30.673" Score="10" Body="&lt;p&gt;Give a short enough config set, reconfiguring by hand should be an acceptable option.  You could even take your existing config and try to implement it again via the ASDM to see what the new GUI returns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your config is multiple pages or has a large number of objects, it might be best to implement it on a test box to see what comes back as an error message before putting it into production.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike the PIX-to-ASA migration, Cisco never released a sanity check tool.&lt;/p&gt;&#xA;" OwnerUserId="71" LastActivityDate="2013-05-07T21:10:30.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19" PostTypeId="2" ParentId="4" CreationDate="2013-05-07T21:12:06.013" Score="4" Body="&lt;p&gt;If you're simply looking to 'root cause' this issue:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might want to ask your provider if there were any configuration changes being made on their end immediately before this occurred.  There are instances on Cisco routers (not 100% sure what code rev at the moment) where BGP sessions will flap when one side removes and re-adds a &quot;route-map&quot; with an &quot;mpls-ip&quot; and/or an &quot;mtu&quot; configuration in the BGP peering.  Although that kind of maintenance shouldn't cause problems with the peering session, I have heard tale of this happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I'm not certain they would have needed to go as far as to drop the interface and bring it back up to 'fix' the issue.  I think simply resetting the peering session would have sufficed, but if there was no traffic being passed at the time of the failure, one could argue that it doesn't matter that they dropped the interface to get things rolling again.&lt;/p&gt;&#xA;" OwnerUserId="51" LastActivityDate="2013-05-07T21:12:06.013" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20" PostTypeId="2" ParentId="15" CreationDate="2013-05-07T21:15:26.777" Score="20" Body="&lt;p&gt;The WS-G5484 is a multimode fiber connector.  If you're using standard multimode fiber (62.5 micron), you should be about to get around 300m distance out of them.  With 50 micron fiber, that number should go up to around 500m.&lt;/p&gt;&#xA;" OwnerUserId="71" LastActivityDate="2013-05-07T21:15:26.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21" PostTypeId="2" ParentId="4" CreationDate="2013-05-07T21:18:32.513" Score="0" Body="&lt;p&gt;Not from what I'm seeing.  Your ISP's router quit responding to the hello messages from your router, which is why you lost your BGP connection.  It's also possible that your router quit listening to the hello messages from the ISP, but I'm not seeing anything obvious in the messages that would help pinpoint the issue.  Maybe someone more focused on the ISP track can comment and shed some light?&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2013-05-07T21:18:32.513" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22" PostTypeId="2" ParentId="8" CreationDate="2013-05-07T21:19:33.363" Score="9" Body="&lt;p&gt;I would definitely recommend rebuilding the configuration to clean it up. Often rules get put in and either go stale or are never used. This is a perfect opportunity to start it over with a clean slate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last upgrade I did took about a week to re-write the rules, but they were much cleaner and labeled.&lt;/p&gt;&#xA;" OwnerUserId="55" LastActivityDate="2013-05-07T21:19:33.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23" PostTypeId="2" ParentId="4" CreationDate="2013-05-07T21:20:32.893" Score="19" Body="&lt;p&gt;172259: May  6 14:43:06: %BGP-3-NOTIFICATION: sent to neighbor xxx.xxx.12.34 4/0 (hold time expired) 0 bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That generally means the other side of the connection did not respond to any keepalives within the hold timer (default 180 seconds). There are a variety of issues that could have caused this. Usually its a layer3 reachability issue. If it happens again, you should rule out layer3 issue by testing to the peer via ping and telnet (telnet to port 179, see if it responds).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If its not a layer3 reachability issue, then there was a problem with one end of the neighborship (more likely the far side in this case).&lt;/p&gt;&#xA;" OwnerUserId="89" LastActivityDate="2013-05-07T21:20:32.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24" PostTypeId="1" AcceptedAnswerId="34" CreationDate="2013-05-07T21:21:26.587" Score="13" ViewCount="537" Body="&lt;p&gt;I need to perform monitoring of my network infrastructure but I'm wondering if using SNMPv2 is secure? What are the weaknesses of SNMPv2?&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-05-07T21:29:23.523" Title="I want to perform monitoring of my network infrastructure, can this safely be done with SNMPv2?" Tags="|security|snmp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25" PostTypeId="2" ParentId="24" CreationDate="2013-05-07T21:21:26.587" Score="14" Body="&lt;p&gt;SNMPv2 should not be used especially if SNMPv3 is available. There are some basic flaws in SNMPv2, predominantly the use of community strings which are sent over the network in an unencrypted form to query the network infrastructure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also it's based on a community string instead of a separate username/password combination,  SNMPv2 (and 1 for that matter) cannot provide any assurance of confidentiality, integrity nor authenticity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SNMPv3 is a lot better in regard to security,SNMPv3 includes three important services: authentication, privacy, and access control (Figure 1). To deliver these services in a flexible and efficient manner, SNMPv3 introduces the concept of a principal, which is the entity on whose behalf services are provided or processing takes place. Read more about it on the &lt;a href=&quot;http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_1-3/snmpv3.html&quot;&gt;cisco website&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-05-07T21:21:26.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27" PostTypeId="2" ParentId="6" CreationDate="2013-05-07T21:22:59.173" Score="8" Body="&lt;p&gt;You are looking for the &quot;Logical Interface (Aggregate) Policer&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos11.4/topics/concept/policer-logical-interface-aggregate-overview.html&quot;&gt;http://www.juniper.net/techpubs/en_US/junos11.4/topics/concept/policer-logical-interface-aggregate-overview.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately they are only available on EX9200 (which is a castrated MX) if the information on the EX feature page is correct:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/release-independent/junos/topics/concept/ex-series-software-features-overview.html#routing-policy-packet-filtering-features-by-platform-table&quot;&gt;http://www.juniper.net/techpubs/en_US/release-independent/junos/topics/concept/ex-series-software-features-overview.html#routing-policy-packet-filtering-features-by-platform-table&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-05-07T21:22:59.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28" PostTypeId="2" ParentId="24" CreationDate="2013-05-07T21:26:28.387" Score="9" Body="&lt;p&gt;Whereas SNMPv3 is significantly more secure than v2, you can at least mitigate some of the risk of implementing v2 by restricting access with an ACL.  I would also advise against creating a read/write v2 community.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2013-05-07T21:26:28.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29" PostTypeId="1" AcceptedAnswerId="30" CreationDate="2013-05-07T21:26:43.857" Score="12" ViewCount="560" Body="&lt;p&gt;I've got a lot of clients with mobile devices that want to connect to our corporate network which uses Cisco Anyconnect. How can my clients connect to our VPN using a mobile device?&lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="103" LastEditDate="2013-05-07T22:17:33.097" LastActivityDate="2013-05-18T22:03:14.273" Title="Can I use Cisco Anyconnect with mobile devices?" Tags="|mobile|byod|cisco-anyconnect|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30" PostTypeId="2" ParentId="29" CreationDate="2013-05-07T21:26:43.857" Score="12" Body="&lt;p&gt;Cisco provides a special &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect24/iphone-user/guide/iphone-anyconnect-ug-24.html&quot;&gt;application for iphone devices&lt;/a&gt; or for &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/vpn_client/anyconnect/anyconnect25/android-user/guide/android-acug.html&quot;&gt;android devices&lt;/a&gt;. Unfortunately Windows Phone isn't supported yet.&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-05-07T21:26:43.857" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="31" PostTypeId="1" AcceptedAnswerId="32" CreationDate="2013-05-07T21:27:18.443" Score="9" ViewCount="16519" Body="&lt;p&gt;Performing a packet capture I keep seeing strange &quot;DEC MOP Remote Console&quot; frames:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;No.     Time        Source                Destination           Protocol Info&#xA;    141 83.557841   Cisco_57:62:a0        DEC-MOP-Remote-Console 0x6002   DEC DNA Remote Console&#xA;&#xA;Ethernet II, Src: Cisco_57:62:a0 (00:0d:bc:57:62:a0), Dst: DEC-MOP-Remote-Console (ab:00:00:02:00:00)&#xA;    Destination: DEC-MOP-Remote-Console (ab:00:00:02:00:00)&#xA;        Address: DEC-MOP-Remote-Console (ab:00:00:02:00:00)&#xA;        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)&#xA;        .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)&#xA;    Source: Cisco_57:62:a0 (00:0d:bc:57:62:a0)&#xA;        Address: Cisco_57:62:a0 (00:0d:bc:57:62:a0)&#xA;        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)&#xA;        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)&#xA;    Type: DEC DNA Remote Console (0x6002)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The source mac address is one from a Cisco router. However Decnet is disabled on the router and transport input set to telnet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router# show decnet &#xA;% DECnet is not enabled&#xA;&#xA;router# show run | begin line vty&#xA;line vty 0 4&#xA;   transport input telnet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I prevent this router to send these remote console frames?&lt;/p&gt;&#xA;" OwnerUserId="52" LastActivityDate="2013-05-08T00:33:37.313" Title="What is Dec MOP and how to disable it?" Tags="|cisco|cisco-ios|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32" PostTypeId="2" ParentId="31" CreationDate="2013-05-07T21:27:18.443" Score="12" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/DECnet&quot;&gt;Decnet Maintenance Operation Protocol&lt;/a&gt; (MOP) is an ancient protocol that was used to administrate remote systems, and provided tools such as remote console or network bootstrap.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, &lt;a href=&quot;http://blogs.cisco.com/security/router_spring_cleaning_-_no_mop_required/&quot;&gt;as of now&lt;/a&gt; this is still enabled by default on all Cisco IOS Releases from 9.0 to recent 15.x. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To disable MOP on the router it has to be done on a per-interface basis:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router# conf t&#xA;router(configure)# interface fastethernet0/0&#xA;router(configure-if)# no mop enabled&#xA;&#xA;router# sh run int f0/0 | include mop&#xA; no mop enabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MOP will be disabled even though the router still shows MOP as protocol on the interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router# show int f0/0 count prot status &#xA;Protocols allocated:&#xA; FastEthernet0/0: Other, IP, DEC MOP, ARP, CDP, IPv6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="52" LastActivityDate="2013-05-07T21:27:18.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33" PostTypeId="2" ParentId="5" CreationDate="2013-05-07T21:28:15.930" Score="1" Body="&lt;p&gt;Once you have interfaces set to passive, you're not open to much.  Authentication does add two possible vectors for trouble: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CPU utilization - this isn't necessarily a huge issue, but shouldn't be forgotten when you're doing your calculations.  However, if you are running a network where convergence times take longer than you want, every little bit counts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Troubleshooting.  It's easy to miss something, and that can slow down bringing up a new connection, replacement router, etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're worried about getting OSPF sniffed and having a malicious intruder inject data, you should probably be running something stronger than authentication: start with running actual encryption rather than the weak MD5 you're going to get with OSPFv2, and BGP is better for untrusted links.&lt;/p&gt;&#xA;" OwnerUserId="99" LastActivityDate="2013-05-07T21:28:15.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34" PostTypeId="2" ParentId="24" CreationDate="2013-05-07T21:29:23.523" Score="21" Body="&lt;p&gt;If SNMPv3 is not an option you can do some things to help secure SNMPv2 better.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Don't enable the Read-Write string. There are very few reasons to enabled it.&lt;/li&gt;&#xA;&lt;li&gt;Choose community strings that are more complex and remove any that are 'private' or 'public'.&lt;/li&gt;&#xA;&lt;li&gt;Use an access-list on the community string to restrict what IP addresses can poll the device.&lt;/li&gt;&#xA;&lt;li&gt;Do not enable 'system-shutdown' option.&lt;/li&gt;&#xA;&lt;li&gt;Use a different community string for SNMP traps vs the polling SNMP string.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="55" LastActivityDate="2013-05-07T21:29:23.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36" PostTypeId="2" ParentId="4" CreationDate="2013-05-07T21:29:52.133" Score="4" Body="&lt;p&gt;It could be an MTU problem. Had this a while ago. Starts up fine but when an UPDATE with a lot of routes is received it gets lost due to MTU mismatch. Also if you have L2 devices (switch? media converter?) between your two routers it could be possible that the connection is interrupted without the interface going down.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-05-07T21:29:52.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37" PostTypeId="1" AcceptedAnswerId="45" CreationDate="2013-05-07T21:33:33.567" Score="19" ViewCount="2503" Body="&lt;p&gt;Device arrangement is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   BGP Peers&#xA;       +&#xA;       |&#xA;       |&#xA;+------+-------+&#xA;|              |&#xA;| Juniper MX5  |&#xA;|              |&#xA;+------+-------+&#xA;       |.254&#xA;  OSPF | 10.0.1.0/24&#xA;       |.1&#xA;+------+-------+&#xA;|              |&#xA;|  Cisco ASA   | ASA NAT&#xA;|              | 10.0.0.1 &amp;lt;&amp;gt; 134.0.15.1&#xA;+------+-------+&#xA;       |.254&#xA;       |10.0.0.0/24&#xA;       |.1&#xA;+------+-------+&#xA;|              |&#xA;|    HOST1     |&#xA;|              |&#xA;+--------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you have the ASA performing NAT to address space that is not statically routed to it, how do you get the NAT'd addresses announced in to the OSPF zone so the router at the top (Juniper MX5) knows how to reach it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(FYI this is a largely simplified slice out of a much larger network purely to demonstrate the components involved in this problem)&lt;/p&gt;&#xA;" OwnerUserId="103" LastEditorUserId="103" LastEditDate="2013-05-13T21:14:49.013" LastActivityDate="2018-05-25T07:18:08.253" Title="How do you get an ASA to announce NAT'd 'outside' addresses in to an OSPF zone?" Tags="|ospf|cisco-asa|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38" PostTypeId="5" CreationDate="2013-05-07T21:33:45.210" Score="0" Body="&lt;p&gt;For questions about Cisco, who is a major provider of networking equipment. Cisco devices often run IOS, NX-OS, or ASA operating systems. This is a generic tag to be used when no more specific tags are available. See the list of tags in Help Center &lt;a href=&quot;https://networkengineering.stackexchange.com/tags&quot;&gt;Tag page&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastEditorUserId="40371" LastEditDate="2018-11-01T14:30:54.577" LastActivityDate="2018-11-01T14:30:54.577" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="39" PostTypeId="4" CreationDate="2013-05-07T21:33:45.210" Score="0" Body="The major provider of networking equipment. This is a generic tag to be used when no more specific tags are available. See the list of tags in Help Center Tag page." OwnerUserId="52" LastEditorUserId="40371" LastEditDate="2018-11-01T14:30:59.323" LastActivityDate="2018-11-01T14:30:59.323" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40" PostTypeId="2" ParentId="16" CreationDate="2013-05-07T21:35:25.213" Score="13" Body="&lt;p&gt;If VTP is not updating the VLANs correctly, check to make sure the MD5 digest on all VTP domain switches is the same.  The MD5 digest is calculated using the revision number, domain name, and password to make sure the information in the VTP update can be trusted. I've seen issues where switches configured with the same domain and password, but the MD5 digest is not aligned until I update the VLAN database on the VTP server.  This is typically caused by the local revision number being different between the switches.  Making a VLAN change on the VTP server will send out a VTP update to all domain switches with the newest revision number so that the MD5 digests should align properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the VTP md5 digest with a &quot;show vtp status&quot; command on each switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1(config)#do sh vtp statu&#xA;VTP Version                     : 2&#xA;Configuration Revision          : 0&#xA;Maximum VLANs supported locally : 1005&#xA;Number of existing VLANs        : 17&#xA;VTP Operating Mode              : Server&#xA;VTP Domain Name                 : CISCO&#xA;VTP Pruning Mode                : Enabled&#xA;VTP V2 Mode                     : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;MD5 digest                      : 0x09 0xF0 0xD7 0x82 0xB7 0x08 0x82 0xAA &#xA;Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00&#xA;Local updater ID is 155.1.7.7 on interface Vl7 (lowest numbered VLAN interface found)&#xA;&#xA;&#xA;SW2(config)#do sh vtp statu&#xA;VTP Version                     : 2&#xA;Configuration Revision          : 0&#xA;Maximum VLANs supported locally : 1005&#xA;Number of existing VLANs        : 17&#xA;VTP Operating Mode              : Client&#xA;VTP Domain Name                 : CISCO&#xA;VTP Pruning Mode                : Enabled&#xA;VTP V2 Mode                     : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;MD5 digest                      : 0x09 0xF0 0xD7 0x82 0xB7 0x08 0x82 0xAA &#xA;Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="87" LastEditorUserId="87" LastEditDate="2013-05-08T14:14:46.767" LastActivityDate="2013-05-08T14:14:46.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41" PostTypeId="2" ParentId="15" CreationDate="2013-05-07T21:39:09.150" Score="16" Body="&lt;p&gt;Generally when you're working with fiber you have to be concerned about two things:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. Type of fiber&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Long-Haul: Single-Mode, used for long distances. &#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Example: Across a city&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Short-Haul: Multi-Mode, used for generally shorter distances. &#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Example: Internal to your campus/building&lt;/em&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;*Caveat: There are different types of Single-Mode and Multi-Mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Connector type&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both Long and Short haul fiber connects into your transceiver with a connector. Your WS-G5484 uses a SC connector type. More modern connectors use smaller LC type connectors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like Tom Says, since you have the fiber transceiver already (WS-G5484) this means you are going to need a &lt;strong&gt;Multi-Mode fiber patch cable&lt;/strong&gt; with &lt;strong&gt;SC connectors&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="110" LastEditorUserId="3191" LastEditDate="2014-05-27T08:51:06.060" LastActivityDate="2014-05-27T08:51:06.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42" PostTypeId="1" AcceptedAnswerId="49" CreationDate="2013-05-07T21:40:07.887" Score="11" ViewCount="6665" Body="&lt;p&gt;What tools are able to provide an almost real time weather map of usage and average traffic per timeframe going over the different links?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some ways or solutions to actively monitor my network and provide alerts on heavy network usage over a prolonged period? &lt;/p&gt;&#xA;&#xA;&#xA;" OwnerUserId="29" LastEditorUserId="237" LastEditDate="2013-05-08T15:34:33.683" LastActivityDate="2013-05-29T17:21:27.917" Title="Weather map and monitoring for network usage" Tags="|qos|snmp|monitoring|" AnswerCount="6" CommentCount="1" ClosedDate="2014-11-04T10:04:51.077" ContentLicense="CC BY-SA 3.0" />
  <row Id="44" PostTypeId="2" ParentId="16" CreationDate="2013-05-07T21:42:57.553" Score="9" Body="&lt;p&gt;Updates to VTP are only sent out when there is an increment to the VTP revision number. The only way to 'force' an update is to create an erroneous Vlan and then delete it. This will accomplish a 'force update' and send the change out to the rest of your clients.&lt;/p&gt;&#xA;" OwnerUserId="110" LastActivityDate="2013-05-07T21:42:57.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="45" PostTypeId="2" ParentId="37" CreationDate="2013-05-07T21:44:02.493" Score="16" Body="&lt;p&gt;Typically you would install a static route on the upstream device (the Juniper MX5 in this example) pointing to the NAT outside network, rather than trying to advertise the network from the ASA. At least, that's how I always go about it.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-07T21:44:02.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="46" PostTypeId="1" CreationDate="2013-05-07T21:44:46.107" Score="12" ViewCount="878" Body="&lt;p&gt;Since a VSS is a single system image, does it make sense to enable UDLD for links between the switch pair? We've seen some recovery problems that we feel might be due to UDLD mistakenly identifying an ISL link as unidirectional, especially in a configuration with ASA-SMs in an HA configuration.&lt;/p&gt;&#xA;" OwnerUserId="120" LastActivityDate="2022-02-12T19:39:28.073" Title="UDLD in VSS configurations" Tags="|vss|udld|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="47" PostTypeId="2" ParentId="42" CreationDate="2013-05-07T21:46:28.397" Score="4" Body="&lt;p&gt;You can use tools like Cacti or PRTG. These tools support weathermaps showing you actual bandwidth usage in the network. You can also set thresholds so that when more than 80% on a link is utilized send an e-mail or SNMP trap and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These tools are mostly SNMP based. You can also use Netflow to get more visibility into what is using how much bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-07T21:46:28.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="48" PostTypeId="2" ParentId="8" CreationDate="2013-05-07T21:48:03.980" Score="7" Body="&lt;p&gt;We just recently went through this and I rebuilt the config from scratch.  My config was only about 6 pages so it wasn't terrible.  This also allowed for some consolidation into object groups and auditing of rules that existed on the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your config is too large you could try setting up 8.2 in GNS3, applying your configuration then updating.  Never tried an ASA upgrade in GNS3, but have had 8.2, 8.3, and 8.4 working properly in GNS3.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option, if you have an Active/Standby pair, would be to break the pair during maintenance and upgrade the Standby.  Once everything validates, then make it the primary and bring the other unit back into the pair as standby after upgrading it.  If testing fails, downgrade the standby unit and bring it back into the old pair.  &lt;/p&gt;&#xA;" OwnerUserId="112" LastActivityDate="2013-05-07T21:48:03.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="49" PostTypeId="2" ParentId="42" CreationDate="2013-05-07T21:49:53.813" Score="15" Body="&lt;p&gt;There are a few examples that can do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cacti.net/&quot;&gt;Cacti&lt;/a&gt; is one. It has a weather-map plugin that can be leveraged to produce output such as the following&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://iccn.illinois.edu/status/weather-maps/&quot;&gt;GigaPop Illinois&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stats.net.wisc.edu/&quot;&gt;Wisconsin University&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are examples of what the weather map plugin can do. When configured correctly you can see minute, hourly, daily, weekly and monthly traffic stats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download Cacti from the website listed above, &lt;a href=&quot;http://www.network-weathermap.com/&quot;&gt;weather-map here&lt;/a&gt; or a nice script hosted by Brent Salisbury &lt;a href=&quot;http://networkstatic.net/cacti-network-management-installation-tutorial/&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is worth reading up on Cacti as there is a lot of features and devices that it can look after. Email alerts based on thresholds, events, lack of information and more can be delivered. This can be utilized via SNMP.&lt;/p&gt;&#xA;" OwnerUserId="4" LastActivityDate="2013-05-07T21:49:53.813" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="50" PostTypeId="2" ParentId="42" CreationDate="2013-05-07T22:00:06.297" Score="6" Body="&lt;p&gt;Cacti is a good open source solution.  You will need some Linux experience to get up and running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PRTG is a nice solution, can't be the price.  You can use SNMP to monitor interfaces and it now also includes Netflow.  Probably not the most robust reporting, but a good starting point for the price.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SolarWinds is another huge player.  Great features and reporting.  Only downside is you will pay a higher cost.  IMO, the benefits justify the cost, but every scenario is different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ManageEngine has some nice products, but I have always found their interface and navigation not as intuitive as other solutions on the market.  Either way the product does what is advertised.&lt;/p&gt;&#xA;" OwnerUserId="112" LastActivityDate="2013-05-07T22:00:06.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="51" PostTypeId="2" ParentId="42" CreationDate="2013-05-07T22:03:59.943" Score="7" Body="&lt;p&gt;Wow, this question could be an entire site of its own.  Regardless of what software package(s) you end up using, if snmp is how you're getting your numbers, it's time to embrace sFlow (aka: NetFlow depending on your hardware).  I love snmp.  It's perfect for getting a plethora of network (and other) statistics.  That said, if you want a deeper look into your traffic: into vlans and protocols, start looking at whether your gear supports sFlow/Netflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure there are many opinions about what software to use, but here are a few that I've used in the past to put together a fairly complete monitoring solution:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Cacti: For graphing of everything under the sun.  With additional modules, it will do some alerting on thresholds that you configure.  It also supports multiple users with individual rights ... so if you're a provider and want or need to give access to customers to their own traffic graphs, this is a great tool.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Nagios: For monitoring and alerting.  Nagios is very powerful.  It has a huge arsenal of scripts, and plugins, and add-ons.  It is also one of the most unintuitive platforms to configure and manage.  It is a beast.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Zabbix: For monitoring, alerting and graphing.  This is functionally cacti + nagios + quite a bit more.  It will do some auto-discovery for you as well as inventory of everything it is looking at.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Intermapper: This is commercial software.  It is monitoring and alerting.  I mention it because you mention wanting something of a weather map.  You can watch everything you are monitoring in real-time (or near real-time) with Intermapper. It is great software for a NOC environment.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are many many network monitoring packages out there.  These are just a few that I've had success with in the past.  Good luck!&lt;/p&gt;&#xA;" OwnerUserId="51" LastEditorUserId="237" LastEditDate="2013-05-08T15:34:27.963" LastActivityDate="2013-05-08T15:34:27.963" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="52" PostTypeId="1" AcceptedAnswerId="260" CreationDate="2013-05-07T22:06:30.033" Score="18" ViewCount="1149" Body="&lt;p&gt;I operate an MPLS/IP network that utilizes auto-bandwidth to measure bandwidth utilization and signal RSVP accordingly.&#xA;How can I maintain balance across my LSP paths such that one large [P router]-to-[P router] path/flow doesn't saturate any one link?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that by creating more equal-cost LSPs, traffic should be getting balanced at the cost of increased signaling overhead.&#xA;I'm also considering lowering the statistics measurement interval for closer-to-reality signaling bandwidths, but at the cost of increased measurement time and signaling overhead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the best way to find the optimal balance of full-mesh LSP count and statistics interval?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routing platform here is Juniper JunOS.&lt;/p&gt;&#xA;" OwnerUserId="131" LastEditorUserId="52" LastEditDate="2013-05-07T22:07:21.317" LastActivityDate="2013-05-10T12:34:24.327" Title="MPLS auto-bandwidth balancing" Tags="|juniper|mpls|rsvp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="53" PostTypeId="1" AcceptedAnswerId="71" CreationDate="2013-05-07T22:28:11.773" Score="30" ViewCount="30854" Body="&lt;p&gt;The terms CoS &amp;amp; QoS are often used interchangably, particularly in the SP space when providing &quot;Class of Service profiles&quot; etc as part of Product sets.  I'm looking to re-affirm my understanding that CoS is just one way in which traffic can be marked at layer 2, whilst QoS determines what you actually do to that traffic at layer 3?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone provide more real world implementation examples of distinguishing between the two terms or alternatively advise me of any overlap?&lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2014-02-07T07:51:59.413" Title="Are CoS and QoS ever interchangeable?" Tags="|qos|cos|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="54" PostTypeId="1" AcceptedAnswerId="59" CreationDate="2013-05-07T22:31:43.367" Score="27" ViewCount="7711" Body="&lt;p&gt;When I need to connect a number of branch sites to one another for a customer, I typically recommend an MPLS VPN through a trusted carrier. The CE at each site speaks BGP with its upstream PE and each site is numbered with its own private ASN. This is very convenient for us as BGP provides myriad traffic engineering tools and our adjacencies are limited to n+1 for n sites (the +1 being our colo environment).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lately, however, I've noticed increasing customer interest in Metro Ethernet solutions. Many of our customers have branch sites within a common metro area and MetroE quotes are coming in at several hundred dollars (USD) less than MPLS service for circuits of the same speeds. While this is appealing, I'm not sure how to best establish routing across a layer two backbone while avoiding turning a mesh topology into hub-and-spoke.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP would necessitate a full mesh of adjacencies among branch sites in order to maintain mesh connectivity, which obviously is undesirable from a scalability perspective. The other option is to deploy an IGP, namely OSPF, and have all sites form adjacencies across the WAN. I'd like to address each site as its own area, which seems like overkill but I want to preserve the ability to summarize routes advertised from each site and this can only be done on area borders.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this make sense? Are there any caveats to watch out for when deploying OSPF in this manner (for example, should I consider disabling LSA flooding)? Or is there another solution I've overlooked?&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-14T12:35:32.303" Title="Does it make sense to deploy OSPF across Metro Ethernet?" Tags="|ospf|metro-ethernet|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="55" PostTypeId="2" ParentId="53" CreationDate="2013-05-07T22:34:03.450" Score="17" Body="&lt;p&gt;Class of Service is a layer 2 identifier, usually in conjunction with an 802.1q tag (You shouldn't see CoS referenced on an access port, only a trunk port).  DiffServ would be the corresponding identifier on a layer 3 link.  Quality of Service is a superset of both controlling how both layer 2 and layer 3 links classify, police, and queue traffic on different types of links.&lt;/p&gt;&#xA;" OwnerUserId="141" LastActivityDate="2013-05-07T22:34:03.450" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="56" PostTypeId="2" ParentId="53" CreationDate="2013-05-07T22:37:00.290" Score="6" Body="&lt;p&gt;CoS operates on Layer 2, whereas QoS operates on Layer 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CoS is a means of adding a priority to the VLAN header that can later me interpreted by QoS mechanisms to handle the traffic accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A real world example might be a VoIP VLAN on a network, which would usually be marked with a CoS flag as CS7. Routers QoS engines can then interpret that and prioritise that traffic higher in policing or profiling situations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CoS can be used independently of QoS implementations to pass appropriately tagged traffic to other networks you have no control over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ucstrategies.com/unified-communications-strategies-views/cos-and-qos-managing-bandwidth-complexity-and-cost.aspx&quot;&gt;Here is a good white paper&lt;/a&gt; giving a detailed introduction to the topic.&lt;/p&gt;&#xA;" OwnerUserId="103" LastActivityDate="2013-05-07T22:37:00.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="57" PostTypeId="2" ParentId="54" CreationDate="2013-05-07T22:41:19.503" Score="3" Body="&lt;p&gt;What about a route-server configuration with 'spokes' beeing rs-clients of the hub/main routers? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though the bgp peerings would be like a hub&amp;amp;spoke topology, all the spokes should be able to send traffic directly to all others. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could even re-use the same private AS numbers as those used with the MPLS provider to facilitate migration from a service to another.&lt;/p&gt;&#xA;" OwnerUserId="52" LastActivityDate="2013-05-07T22:41:19.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="58" PostTypeId="1" AcceptedAnswerId="66" CreationDate="2013-05-07T22:47:22.570" Score="21" ViewCount="28260" Body="&lt;p&gt;We recently replaced international MPLS with new ASA 5510s and site-to-site VPNs.  However, when we deployed this we ran into a problem where each remote location has 2 ISPs for redundancy, but when enabling the VPN on both interfaces it flaps between the two and the tunnel is up and down as the tunnel gets torn down and moved between ISPs.  Cisco has been working on this for 8 months now and we still don't have stable tunnels with multiple ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remote Office:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list RWS_TUNNEL remark Interesting traffic for IND-RWS tunnel&#xA;access-list RWS_TUNNEL extended permit ip object-group BNG_tunnel_NETS object-group CORP_tunnel_NETS&#xA;crypto map RWS_TUNNEL 1 match address RWS_TUNNEL&#xA;crypto map RWS_TUNNEL 1 set peer 216.xxx.102.2 &#xA;crypto map RWS_TUNNEL 1 set transform-set IND-RWS&#xA;tunnel-group 216.xxx.102.2 type ipsec-l2l&#xA;tunnel-group 216.xxx.102.2 ipsec-attributes&#xA; pre-shared-key *****&#xA;&#xA;&#xA;route outside 0.0.0.0 0.0.0.0 216.xxx.206.1 1 track 2&#xA;route outside2 0.0.0.0 0.0.0.0 182.xxx.26.229 100&#xA;sla monitor 55&#xA; type echo protocol ipIcmpEcho 63.251.61.142 interface outside&#xA; num-packets 5&#xA; timeout 1000&#xA; frequency 10&#xA;sla monitor schedule 55 life forever start-time now&#xA;track 2 rtr 55 reachability&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Central office:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list BNG_TUNNEL remark Interesting traffic for IND-RWS tunnel&#xA;access-list BNG_TUNNEL extended permit ip object-group CORP_tunnel_NETS object-group BNG_tunnel_NETS &#xA;&#xA;route outside2 0.0.0.0 0.0.0.0 216.xxx.102.1&#xA;crypto map BNG_TUNNEL 1 match address BNG_TUNNEL&#xA;crypto map BNG_TUNNEL 1 set peer 182.xxx.26.230 216.xxx.206.4&#xA;crypto map BNG_TUNNEL 1 set transform-set L2L&#xA;&#xA;tunnel-group 182.xxx.26.230 type ipsec-l2l&#xA;tunnel-group 182.xxx.26.230 ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group 216.xxx.206.4 type ipsec-l2l&#xA;tunnel-group 216.xxx.206.4 ipsec-attributes&#xA; pre-shared-key *****&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So what I've found is that when ISAKMP is enabled on both outside interfaces (remote office) and both IPs are configured as peers (central office) the VPN comes up successfully on both interfaces, but at some point will begin flapping between IPs.  This is true with or without the SLA Monitoring, so even if the routes are all static, behaviour still occurs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any insight is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="142" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:39.193" LastActivityDate="2015-03-05T13:22:07.350" Title="Cisco ASA site-to-site VPN failover" Tags="|cisco|cisco-asa|vpn|failover|redundancy|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="59" PostTypeId="2" ParentId="54" CreationDate="2013-05-07T22:52:48.030" Score="15" Body="&lt;p&gt;This is kind of a complex question, as the two different products are very different.  A MPLS L3VPN circuit inherently is a full mesh between all locations that participate, while a MetroE connection is generally a point to point link between two specific sites.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience, a MetroE circuit is a directly provisioned path, with no protect services, unless contracted with a protect path.  This means that failure of an interface or router along the specific path would be traffic interrupting between the two sites that are directly linked by the MetroE service.  The MPLS L3VPN will heal around interface/routing failures to keep you with a full mesh between your sites.  This generally accounts for the price difference between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is nothing wrong with building your own services on top of a MetroE platform -- you just need to work with customer requirements to determine what type of routing is appropriate.  If you are working with a small office network, OSPF/IS-IS/EIGRP could be a wonderful way to exchange routing information between the directly connected sites that you have established.  If you're more of an NSP/ISP/*SP, separating infrastructure and customer routes between IGP and EGP becomes much more important as you scale.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an ISP engineer, we extensively use MetroE and EWAN links to build our backbone, and utilize our knowledge of the physical links to design our iBGP/eBGP environment.  In many cases, we use route reflectors, and dual route reflectors (route-reflector-client on both sides of the peering) to reduce our iBGP peer count.  However, unless you're dealing with 6+ routers in a POP, iBGP scales pretty well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short -- if it's for a single client, that is not offering network services to clients of their own -- stick with an IGP.  If external connectivity needs to be shared between sites, with failover/redundancy/etc, closely examine the physical paths you have, and design your eBGP/iBGP to reflect that.  No point in having a router in a remote location with only 1 link outside the site to iBGP peer with all other routers in the AS -- use a dual route reflector.&lt;/p&gt;&#xA;" OwnerUserId="141" LastActivityDate="2013-05-07T22:52:48.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="60" PostTypeId="2" ParentId="46" CreationDate="2013-05-07T23:13:13.333" Score="8" Body="&lt;p&gt;If you are referring the the VSL between the to VSS switches, I don't think it makes sense to enable UDLD because LMP will detect a unidirectional link.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;LMP is designed to run on each VSL member link to maintain multiple state machines with the same peer over different ports. In a case in which a unidirectional condition on a port is detected, LMP marks it as down and attempts to restart VSLP negotiation—instead of err-disabling the port.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For this and more LMP and VSS info: &lt;a href=&quot;http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/VSS30dg/VSS-dg_ch2.html#wp1055977&quot;&gt;http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/VSS30dg/VSS-dg_ch2.html#wp1055977&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="91" LastActivityDate="2013-05-07T23:13:13.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="61" PostTypeId="1" AcceptedAnswerId="68" CreationDate="2013-05-07T23:22:11.453" Score="8" ViewCount="2483" Body="&lt;p&gt;As many known the Nexus 2000 series is a switch which allows a distributed fabric in DC networks. Pinning Nexus 2000 is quite a breeze. I was looking to seek discussion and a general consensus on what others do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple N2K pin is as such.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fex 101&#xA;pinning max-links 1&#xA;description &quot;FEX0101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do many of you lock down what Nexus 2000 device can be assigned to a pin by providing &quot;verification&quot; of the pinned Nexus 2000.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fex 102&#xA;pinning max-links 1&#xA;description &quot;SVRSW-01-102&quot;&#xA;serial FOC240831BZ&#xA;type N2248TP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does the additional configuration fall into you best practice configuration or is it a must have in your environment and do you add it as a layer of pseudo-physical security?&lt;/p&gt;&#xA;" OwnerUserId="4" LastEditorUserId="4" LastEditDate="2013-05-08T00:22:17.110" LastActivityDate="2013-05-08T02:08:46.130" Title="Nexus 2000 pinning best practice" Tags="|cisco|cisco-nexus-2000|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="62" PostTypeId="2" ParentId="31" CreationDate="2013-05-07T23:28:07.473" Score="7" Body="&lt;p&gt;DECnet MOP for some reason is still enabled in Enterprise trains. I've seen it get silently enabled after an IOS upgrade because it included a switch from advipservices. Unfortunately it is hard to get Cisco to change a default, &lt;code&gt;no ip directed-broadcast&lt;/code&gt; has basically been the operator community's only success story (highest on my list to go is proxy arp).&lt;/p&gt;&#xA;" OwnerUserId="56" LastActivityDate="2013-05-07T23:28:07.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="63" PostTypeId="2" ParentId="58" CreationDate="2013-05-07T23:42:54.293" Score="9" Body="&lt;p&gt;I would recommend using a DMVPN solution to connect remote sites over L2L (Lan-to-Lan) IPSec tunnels between ASAs. The DMVPN solution is much easier, cleaner, and will allow spoke to spoke communication as well.&lt;/p&gt;&#xA;" OwnerUserId="55" LastActivityDate="2013-05-07T23:42:54.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="64" PostTypeId="2" ParentId="54" CreationDate="2013-05-07T23:46:10.180" Score="4" Body="&lt;p&gt;You could very well run OSPF (or other IGP) on a multi-point metro-Ethernet service, and it should work very nicely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There could be reasons to continue to run BGP, however...though they would be much the same arguments of why you might want to run BGP within your own network as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't necessarily have to put all of your BGP speakers in the same AS on a &quot;broadcast&quot; network like that.  Think of it as a sort of internal IXP run by the telecom where your private ASes can interconnect with each other via a layer 2 mesh.  You wouldn't even have to necessarily maintain a full mesh of BGP peerings as BGP updates can carry a next-hop in its update message that isn't the same as where the peer session is coming from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for example, if you have a layer 2 mesh with routers A, B, and C on it and you have BGP peers between A and B, and between B and C, when C gets updates for routes originated at A, it will have A as the next-hop, even though they were learned through the peering session with B.  Obviously you would want more route peering than just a single hub-and-spoke, so you're not dependent on the single hub, but you don't need a full mesh by any means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You still get all the routing-policy benefits of running BGP if you do it this way...and it also, as another respondent mentioned, can use the same private AS number space and could even interconnect with the existing L3VPN so your model and support mechanisms don't need to change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, I have a couple of metro-E links (point-to-point in my case) that I run OSPF and iBGP across and it works just fine.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-05-07T23:46:10.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="65" PostTypeId="2" ParentId="54" CreationDate="2013-05-08T00:06:24.357" Score="10" Body="&lt;p&gt;Switching from a managed L3VPN (what I assume you meant by &quot;MPLS VPN&quot;) to an L2VPN is a nice step up in that you can run non-IP protocols, and get total control of the routing protocols and routing platforms that define your routing topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that you place just one Ethernet MAC address on the CPE-side of each of your sites, it's much simpler for the provider's equipment to learn and forward 1 MAC addresses per site, than to learn and route potentially-many subnets per-site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Protocol-wise, this is a bit of a tricky question to answer without a lot more information, as the best choice depends on your traffic and growth plans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this just one big customer that needs internal and internet connectivity, or does it sell connectivity as well?&#xA;Assuming it's all internal, then you'll just be deploying an IGP and maybe running some eBGP for announcing paths out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have very many sites or internal prefixes, a link-state protocol like OSPF or IS-IS makes the most sense, as it will converge quickly and can build the FIB from the RIB quickly if there are just a few prefixes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you will have many sites or many prefixes, this will start to tax your routing platforms, as they each need to process each. This is something that starts to take n&lt;sup&gt;2&lt;/sup&gt; time.&#xA;If you have sites that are coming up and down often, this churn in link-state can also start to tax your router pool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are going to have many sites, many stubby sites (one path &quot;upstream&quot;, no other downstream routers), or lots of route churn, you're going to need to look into other protocols or topologies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a case like that, I'd recommend using BGP with some route reflectors. This way, you can provision 2+ heavy-duty route-reflectors that spokes announce into, and for which the other spokes can grab a routing table from.&#xA;This way, you can deploy lightweight CPEs at your many spoke sites that just connect up, announce their space and get an internal table or default route to a router that does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Approximately, I'd suggest some scales and gear (and assuming sub-Gigabit throughputs):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 - 20 spokes -- OSPFv3 between all sites. Juniper SRX240 or similar for all sites.&lt;/li&gt;&#xA;&lt;li&gt;20 - 100 spokes -- iBGP with route reflectors. Juniper SRX240 in the spokes, Juniper MX5/10/40/80 for route reflection (or Debian Linux/BIRD).&lt;/li&gt;&#xA;&lt;li&gt;100 - 500 spokes -- Start breaking them into different L2 networks, ASes, or areas&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="131" LastActivityDate="2013-05-08T00:06:24.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="66" PostTypeId="2" ParentId="58" CreationDate="2013-05-08T00:28:19.540" Score="14" Body="&lt;p&gt;I have been migrating sites away from policy-based VPNs for just this reason. Policy-based VPNs are too unpredictable when it comes to failover behavior. I much prefer route-based IPsec tunnels, either point-to-point or DMVPN. Unfortunately, to my knowledge the ASA platform still doesn't support route-based tunnels.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-08T00:28:19.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="68" PostTypeId="2" ParentId="61" CreationDate="2013-05-08T00:49:17.283" Score="10" Body="&lt;p&gt;I believe this is considered best practice. Frankly, there's no reason not to. Given that the 2K is essentially just a line card that can be moved around arbitrarily, this is the only way to ensure that it always shows up in the same &quot;slot&quot; of the parent switch.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-08T00:49:17.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="69" PostTypeId="1" AcceptedAnswerId="92" CreationDate="2013-05-08T01:13:07.073" Score="15" ViewCount="5271" Body="&lt;p&gt;Can spanning tree and UDLD be run together, and if so, is this a good idea?&lt;/p&gt;&#xA;" OwnerUserId="178" LastEditorUserId="178" LastEditDate="2013-05-08T11:16:12.360" LastActivityDate="2013-05-08T12:05:35.553" Title="Should i run UDLD with spanning tree?" Tags="|udld|spanning-tree|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="70" PostTypeId="2" ParentId="69" CreationDate="2013-05-08T01:14:23.343" Score="5" Body="&lt;p&gt;Absolutely.  There are many failure modes in spanning tree related to uni directional traffic that UDLD is able to detect and make sure the network continues operating correctly.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2013-05-08T01:14:23.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="71" PostTypeId="2" ParentId="53" CreationDate="2013-05-08T01:14:52.397" Score="19" Body="&lt;p&gt;QoS is an umbrella term which covers the use of features such as policing, shaping, traffic classification, and advanced queuing mechanisms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CoS is a form of QoS limited to layer-2 Ethernet and it uses 3-bits (8 values) of the 802.1Q tag to differentiate your traffic. Therefore no trunking, no CoS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DSCP is the most commonly acted upon value at layer-3 and it is found in 6-bits (64 values) of the IP header.  Typically only 14 of the values are used and are referred to using the notations of best effort, expedited forwarding (EF), and assured forwarding (AF).  AF values are in the form AFxy, where x is 1-4 and refers to the precedence and y is 1-3 and refers to the drop probability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Telco vendors (such as AT&amp;amp;T specifically) use the term CoS to define the bandwidth allocation classes that they support in their MPLS offerings.  Basically they turned CoS into a marketing term.  Typically a Telco uses DSCP to know which of their CoS classes your traffic is supposed to be a part of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another important point for configuring these features is that in a Cisco switch or router you &#xA;need to use a command such as 'mls qos trust dscp' or 'mls qos trust cos' or else the device will reset the QoS marking to zero.  There are some exceptions based on model, configuration, and IOS version but this has been true for everything within the last few years in my experience.  This configuration is required because the device needs to know which marking you want it to act upon since it cannot use both.  I like using DSCP. I haven't found a solid reason to use CoS over it but I'm sure someone has one.&lt;/p&gt;&#xA;" OwnerUserId="176" LastEditorUserId="2624" LastEditDate="2014-02-07T07:51:59.413" LastActivityDate="2014-02-07T07:51:59.413" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="72" PostTypeId="1" AcceptedAnswerId="98" CreationDate="2013-05-08T01:28:50.293" Score="6" ViewCount="457" Body="&lt;p&gt;I find a lot of people, as well as companies don't document their knowledge, or, do a poor job of it. I'd like to discuss what has been found to work well and not so well when it comes to doing this in the hope that we'll be able to assist one another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Wiki&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use &lt;strong&gt;Dokuwiki&lt;/strong&gt; hosted on my webserver. My job requires me to be across a large range of topics, so having my notes easily accessible and available regardless of which PC I am using is extremely useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have lost count of the number of times where I have documented something a few years ago which has come in handy later on down the track. The best thing is that as it is my own notes, I can write about certain &quot;gotchas&quot; which I encountered which I may forget some time in the future. On the other hand, Googling and bookmarks won't afford me this. Further to this, if I were to use bookmarks alone I run the risk of those websites not being around when I may need them in the years to come. There are the &quot;archiving&quot; websites, but I'd prefer not to have to rely on them if I didn't have to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said the above, I'm definitely not against bookmarking. I have found a wiki entry with my own notes as well as useful external links to websites contained inside the wiki entry to be a killer combination. This way the information is all in one spot. If I'm worried about a useful website not being around when I need it, I use a HTML to PDF converter and attach it to the wiki too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;File Syncing&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found File Syncing to be a huge benefit as well. There are multiple options out there, most of which are free. As I don't trust the cloud with my data, I use BoxCryptor to encrypt my filenames and files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the above two solutions I have all of my notes and all of my files with me everywhere I go, regardless of which PC(s) I use.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2013-05-18T22:23:26.703" Title="Documenting Knowledge" Tags="|documentation|knowledgebase|" AnswerCount="5" CommentCount="3" ClosedDate="2013-05-19T18:45:39.293" ContentLicense="CC BY-SA 3.0" />
  <row Id="73" PostTypeId="2" ParentId="53" CreationDate="2013-05-08T01:31:14.657" Score="6" Body="&lt;p&gt;In the Juniper world they are more interchangeable. As all QoS config is done under the class of service stanza of the config. An example of the config is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-of-service {&#xA;    forwarding-classes {&#xA;        queue 0 assured-forwarding;&#xA;        queue 1 best-effort;&#xA;        queue 2 expedited-forwarding;&#xA;    }&#xA;    interfaces {&#xA;        ge-0/0/3 {&#xA;            unit 0 {&#xA;                scheduler-map 1st;&#xA;                shaping-rate 100m;&#xA;            }&#xA;        }&#xA;    }&#xA;    scheduler-maps {&#xA;        1st {&#xA;            forwarding-class assured-forwarding scheduler test1;&#xA;            forwarding-class best-effort scheduler test2;&#xA;            forwarding-class expedited-forwarding scheduler test3;&#xA;        }&#xA;    }&#xA;    schedulers {&#xA;        test1 {&#xA;            transmit-rate 45m;&#xA;            buffer-size percent 45;&#xA;            priority low;&#xA;        }&#xA;        test2 {&#xA;            transmit-rate 45m;&#xA;            buffer-size percent 45;&#xA;            priority low;&#xA;        }&#xA;        test3 {&#xA;            transmit-rate 10m;&#xA;            buffer-size percent 10;&#xA;            priority low;&#xA;        }&#xA;    }               &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="183" LastEditorUserId="103" LastEditDate="2013-05-08T15:33:49.350" LastActivityDate="2013-05-08T15:33:49.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="74" PostTypeId="2" ParentId="3" CreationDate="2013-05-08T01:35:40.633" Score="2" Body="&lt;p&gt;NBAR is the Cisco feature that is capable of classifying traffic at layer-7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This feature allows the use of the 'match protocol ...' command within your class-map so that you can then take action, such as marking the DSCP value or policing, the matching traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NBAR uses something called a PDLM (Protocol Description Language Module) which is basically the logic for determining is traffic is a match.  For custom applications you need to write your own PDLM.  I have never done this so I cannot comment on how easy or hard this is.  I have personally found the IP addresses and/or ports have worked well for classifying my traffic into my supported traffic categories.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as monitoring goes I would agree with Jeremy that NetFlow is the best feature to use.  There are various free and paid tools that can collect and report this data (the router pushes this data to your management station).  Cacti (free) may have support for the &quot;Weather Map&quot; report that you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also for monitoring you may want to look into a reporting tool that uses SNMP to gather the usage and drops from your traffic classes.  It would be advisable that you configure your device with 'snmp mib persist cbqos' if you go that route (this keeps your ifIndex values static across reboots).  Again there are many tool options and Cacti is a good place to start.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-08T01:35:40.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="75" PostTypeId="2" ParentId="69" CreationDate="2013-05-08T01:38:55.050" Score="2" Body="&lt;p&gt;Agreed, UDLD is very important, especially on fiber links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend both sides of the link be configured using 'udld aggressive' mode if your devices support it.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-08T01:38:55.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="76" PostTypeId="1" AcceptedAnswerId="78" CreationDate="2013-05-08T01:54:05.750" Score="33" ViewCount="2844" Body="&lt;p&gt;I would like to get some opinions regarding ways in which I can improve a BGP dual-provider, dual-router design. Each provider supplies a /24 public subnet. I will refer to the routers, circuits, subnets, HSRP groups and providers as A and B, respectively. The bandwidth on each circuit is adequate for the entire load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Current Design&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current design attempts to achieve per-provider symmetry. In a steady state, the intended routing logic is that traffic to/from subnet A transits only circuit A and traffic to/from subnet B transits only circuit B. The circuits would back each other up in a failed state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The providers only advertise the default route. Outbound routing entails a mix of PBR and HSRP. The routers have no routing between them: No iBGP, no OSPF, no static routing. Instead, there are two HSRP groups tracking the default route. Router A is primary for HSRP group A and router B is primary for HSRP group B. Downstream devices have a default route pointing to HSRP group A and PBR which directs traffic sourced from subnet B to HSRP group B. Inbound routing is influenced with prepending and communities. Subnet A is prepended and communitied on circuit B and subnet B is prepended and communitied on circuit A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see much room for improvement in this design. The lack of Internet topology awareness combined with circuit affinity completely eliminates best path selection. There are concerns about the tier designation of the providers and the design has been rationalized as providing ‘acceptable performance’ and simpler to troubleshoot. Indeed, the design couldn’t possibly get any simpler. I have demonstrated that transiting an extra AS adds 6 hops and 63ms (+421%) to the RTT. I would prefer not to settle for acceptable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Better Design&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The better design provides the routers with as much Internet topology awareness as possible. The best path algorithm is left to determine the inbound and outbound routing logic. The circuits would back each other up in a failed state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The providers advertise the full view. The routers run iBGP and OSPF. HSRP is eliminated. The outbound routing would be purely destination-based best path and the inbound routing would be left to the best path algorithm and transit provider whims.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that I type it out, it does seem simpler. At the very least, it took fewer words to explain. There are concerns about asymmetry, but I have seen plenty of asymmetry in the current design. I would think they are probably equally prone to asymmetry and it really doesn’t worry me. We have never seen problems as a result. Presently it is relegated to the realm of ifs, “What ‘if’ we had to troubleshoot something?”&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I way off base here or did I hit the nail on the head? How have others solved this problem? What would Google do?&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2014-02-19T19:18:59.507" Title="Better Enterprise Multihoming" Tags="|bgp|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="77" PostTypeId="2" ParentId="61" CreationDate="2013-05-08T02:08:46.130" Score="8" Body="&lt;p&gt;You absolutely should use the serial command. I'm less worried about what is pinned where, than what happens if a FEX is connected to the wrong port. We were moving some equipment around and two SFPs were swapped. These FEXen were connected to a pair of Nexus 5000 via vPCs and both FEX lost all their configuration. It was a fairly unpleasant experience, and I recommend against it, myself.&lt;/p&gt;&#xA;" OwnerUserId="91" LastActivityDate="2013-05-08T02:08:46.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="78" PostTypeId="2" ParentId="76" CreationDate="2013-05-08T02:17:39.110" Score="16" Body="&lt;p&gt;Yes, you did hit the nail on the head.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will get asymmetry in the improved design, but asymmetry is a fact of life on the Internet, and there's really no good reason to expect symmetric routing of traffic to/from.  Shoot, the whole concept of packet routing is that separate packets are routed independently of each other and may take different paths, even packets going in the same direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I loath PBR.  Its one of those technologies that when I decide that its the best solution to the problem, I stop and take a step back to see if I really understand the real nature of the problem, even back to figuring out what the business problem to be solved is.  When I do so, I almost always find that there is a way to solve the problem without using a technology like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having full Internet routes in your routers will take some getting used to, but once you get used to it, it is indeed very easy to understand and troubleshoot.  Certainly there are fewer &quot;moving parts&quot; of different protocols to worry about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't want to have full Internet routes in your OSPF database, so you'll want to advertise a default via OSPF into the interior of your network (or perhaps static default...personally I prefer default in OSPF).  That will move traffic towards the BGP speaking Internet routers which can make the more fully informed decision of having the full Internet routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That will give you close to &quot;destination based best path&quot;.  There will still be cases where the traffic will do things you don't quite expect, so you'll want to get familiar with the BGP route selection process.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-05-08T02:17:39.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="79" PostTypeId="1" AcceptedAnswerId="85" CreationDate="2013-05-08T02:21:14.637" Score="9" ViewCount="1681" Body="&lt;p&gt;I am in the process of designing a virtual private network setup for a cloud hosting environment.  Given our requirements I don't really see this as different from a dedicated server environment.  The idea is that we want to allow customers to be able to require that their users connect to specific virtual machines or dedicated servers using a VPN which could provide auxiliary encryption (for example for print jobs submitted back to customer networks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are looking at supporting host to host IPSec (ESP and AH), and of course SSH tunnels, but neither of these really offer an ability to use VPN adapters.  We are considering consequently adding at least some of the following, but since space is at a premium we want to standardize on no more than one or two of these (one would be better):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;IPSec tunnel support on the virtual or dedicated host&lt;/li&gt;&#xA;&lt;li&gt;tinc&lt;/li&gt;&#xA;&lt;li&gt;PPTP&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Because our servers taking backups etc may be in different data centers, we'd prefer to be able to re-use our VPN approach here. This would seem to rule out PPTP.   My current thinking is that IPSec is likely to be better because we can use standard VPN adaptors, but setting up routing (based on customer requirements) is likely to be significantly more difficult, which is why we are also looking at tinc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which of these two is preferable?  Is my fear that routing management is likely to be a severe headache with IPSec unjustified?  Is there an easy way around this?  Are there other gotchas regarding tinc that I am missing (i.e. other than requiring a separate client)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update in response to @Wintermute's answer&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, this question is from a server perspective.  The reason is that these are effectively disconnected servers from client's networks.  Yes our target market is the SME network.  Yes, we are expecting to use public IP's for each client server unless they need something different (and then we can talk).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution we are leaning towards is one where clients define IP tunnels and the network ranges accessible by those tunnels and where we string these together with our own management tools (which are under development), which connect customer requests to configuration changes.  The problem is that since we aren't likely to run routing software on the vms and servers, the routing table needs to be statically managed so customers who make mistakes in configuration will find that the VPN's don't work right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is also likely that we will be using ESP over the network for our own internal operations (for things like backups).  The whole setup is rather complex and has many different perspectives, from server-centric (our client vpn to hosted instance) to network-centric (internal stuff), to database-centric (our tools).  So I wouldn't say the question is representative of our whole approach (and questions are getting asked on a bunch of SE sites).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of this really affects the question as a whole though.  It is perhaps useful context though.&lt;/p&gt;&#xA;" OwnerUserId="174" LastEditorUserId="174" LastEditDate="2013-05-08T04:47:13.153" LastActivityDate="2013-05-09T03:59:44.070" Title="VPN's in cloud hosting/dedicated server environments, IPSec tunnels vs tinc" Tags="|vpn|ipsec|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="80" PostTypeId="2" ParentId="72" CreationDate="2013-05-08T02:34:33.203" Score="8" Body="&lt;p&gt;Rather than focus on a couple tools that you use I would focus on what type of data is worth documenting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find that the most overlooked document is the &quot;why&quot; document that should be a companion to a standards document.  This &quot;why&quot; document would describe the design options that were reviewed and the reasoning behind the choice that was made.  Months or years later you can then look back and see if the reasoning is still sound and make changes as necessary.  It also can prevent rehashing of old arguments by summarizing the arguments against the alternate designs.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-08T02:34:33.203" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="81" PostTypeId="1" AcceptedAnswerId="82" CreationDate="2013-05-08T02:50:33.230" Score="14" ViewCount="952" Body="&lt;p&gt;What attack vectors does the BGP TTL security knob protect against?&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2017-06-17T09:08:59.907" Title="What is the purpose of BGP TTL security?" Tags="|bgp|security|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="82" PostTypeId="2" ParentId="81" CreationDate="2013-05-08T02:50:59.703" Score="13" Body="&lt;p&gt;BGP TTL security makes your router only accept packets that have a very high TTL number, typically 254. Since TTL is decremented every time a packet is routed, configuring this feature on both neighbors ensures that only a directly connected neighbor router could have sent you this packet.&lt;/p&gt;&#xA;" OwnerUserId="178" LastEditorUserId="271" LastEditDate="2013-05-08T15:35:56.223" LastActivityDate="2013-05-08T15:35:56.223" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="83" PostTypeId="1" AcceptedAnswerId="84" CreationDate="2013-05-08T02:57:08.803" Score="20" ViewCount="58000" Body="&lt;p&gt;If an engineer configures some changes in a JunOS box and then set them to go live later, that effectively locks the config database with a configure exclusive.  How can I see the changes that he or she has committed?&lt;/p&gt;&#xA;" OwnerUserId="194" LastActivityDate="2016-09-12T06:51:44.937" Title="Can I see the pending (commit at) changes on a JunOS box?" Tags="|juniper|juniper-junos|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="84" PostTypeId="2" ParentId="83" CreationDate="2013-05-08T03:02:01.400" Score="32" Body="&lt;p&gt;I think, you can use &lt;code&gt;show | compare&lt;/code&gt; from configuration mode.&lt;/p&gt;&#xA;" OwnerUserId="195" LastEditorUserId="69" LastEditDate="2013-05-08T15:34:40.730" LastActivityDate="2013-05-08T15:34:40.730" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="85" PostTypeId="2" ParentId="79" CreationDate="2013-05-08T03:49:25.753" Score="6" Body="&lt;p&gt;Not sure about tinc but IPSEC is almost mandatory. No serious business would trust PPTP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure how IPSEC affects routing. A tunnel is a tunnel is a tunnel regardless of the encryption. You'll be running into the same issues re: split tunnel or not, getting customers to understand the concept / oh look a particular customer's LAN IP clashes with the VPN pool you've picked, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sounds like you're aiming at SME market (individual servers, direct login etc.) so that rules out more sophisticated solutions, but I'll list two possible approaches anyway&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;some kind of VPN concentrator that allows profiles. All customers login to VPN concentrator then depending on their profile/group/whatever vendor teminology, get permissions to use protocol X to IP Y (ie their own server). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Cisco ASR1000V virtual routers - each customer gets one, you can then run direct IPSEC tunnels (with VTIs so makes routing appear easy)  or even direct MPLS back to the customers so the router appears as just another branch in their topology, then allocate your VNICs VLANs etc. on the inside so they get a nice virtual 'branch'. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;a smaller scale version of the above, we've used monowall to great effect for this purpose (i.e. each customer gets a layer 3 virtual device that acts as a router/firewall, they VPN into this device and get access to their VLANs only), however then each router/firewall needs their own public IP address. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Re: your current approach, you do realise then each server needs a public IP or you have a complicated and convoluted system of NATs where each customer's VPN path gets allocated a single port or similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd recommend getting a full time networker in to look over any design / proposal you have, it sounds like you're coming at it from a server background.&lt;/p&gt;&#xA;" OwnerUserId="203" LastActivityDate="2013-05-08T03:49:25.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="86" PostTypeId="1" AcceptedAnswerId="216" CreationDate="2013-05-08T03:50:06.097" Score="14" ViewCount="799" Body="&lt;p&gt;I'm working with a couple Cisco WLCs and I know that they use information about client signal strength in determining device locations but I was reading up on &quot;probe requests&quot; and found that, by default, access points will forward probe requests they see only for SSIDs that they serve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that I can disable the &quot;filter&quot; of probe requests so that APs will report all probe requests they see even if destined for unsupported SSIDs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to Cisco documentation they say that disabling &quot;probe request filtering&quot; will improve location accuracy but I can't tell if there are any caveats to doing so&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any experience with this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The documentation I am going off of is here: &lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/controller/7.4/configuration/guides/consolidated/b_cg74_CONSOLIDATED_chapter_01111010.html&quot;&gt;http://www.cisco.com/en/US/docs/wireless/controller/7.4/configuration/guides/consolidated/b_cg74_CONSOLIDATED_chapter_01111010.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="149" LastActivityDate="2013-05-20T21:25:41.743" Title="Wireless Probe Request Forwarding Best Practices?" Tags="|cisco|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="87" PostTypeId="2" ParentId="76" CreationDate="2013-05-08T04:13:53.327" Score="1" Body="&lt;p&gt;So what I understand from the write up is that you don't really have a need to make decisions based on AS paths to reach external subnets and the only purpose of dual homing to two ISP's is to buy redundancy to reach the internet. If thats the case, then you don't really need to run BGP. You can just accept the same default routes that you are already receiving from both your service provider. Now for the local side of the network, run a single ospf area on the routers that connect to the ISP on the interface facing your LAN (Do not include the ISP interface under the process) and depending on how simple the design needs to be to you can add routers in different areas and summarize the subnets at network boundaries, but for two subnets I think size of the OSPF database or the number of LSA flooding is not a huge concern, so you can put all the nodes in a single OSPF area and divide it into different areas as you grow. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On each OSPF router that connects to the ISP, redistribute the learned default routes into OSPF by using a &quot;default-information originate&quot; statement.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Couple of advantages: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;With this design, when you grow the network you can enable BGP with the service providers and just accept the default route without touching anything downstream devices. Until you verify that you are receiving a default route from BGP you are good. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Whenever you need to route traffic off of a ISP for maintenance, just remove the &quot;default-information originate&quot; from underneath the OSPF process on that router and proceed with the maintenance. Nothing else is needed. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And I agree with the previous answer in that symmetric routing is over-rated, I rather go for scalability and ease of maintenance. &lt;/p&gt;&#xA;" OwnerUserId="187" LastActivityDate="2013-05-08T04:13:53.327" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="88" PostTypeId="2" ParentId="54" CreationDate="2013-05-08T04:52:33.697" Score="1" Body="&lt;p&gt;I would highly recommend reading up on and making a decision regarding alternative OSPF topologies such as starting out as NBMA instead of standard. You will soon realise there is no way for OSPF to correctly select between two paths going to the same router/site within the same metro ethernet, due to the way cost is calculated via outbound interface, both the main and backup WAN links will appear same cost in standard OSPF. However if you choose to use NBMA for example then you can manually define neighbor costs - but now you have to manually define the mesh/adjacencies. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whatever you do, ROUTE OVER IT DO NOT I REPEAT DO NOT JOIN AT LAYER 2, you're just asking for trouble later on, if you need layer 2 interconnectivity, use OTV or other layer 2 over layer 3 feature. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll quickly find you'll learn a lot more about OSPF (and need to know a lot more) than compared to a simple provider MPLS-VPN where the WAN core is hidden from you. &lt;/p&gt;&#xA;" OwnerUserId="203" LastActivityDate="2013-05-08T04:52:33.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="89" PostTypeId="2" ParentId="69" CreationDate="2013-05-08T04:53:54.803" Score="9" Body="&lt;p&gt;Yes, it's a good idea to run both as they protect you from different failures. If UDLD is not supported on both sides you can use LACP as a poor man's UDLD (between Cisco and Juniper for example) or you could even use Ethernet OAM LFM.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-05-08T04:53:54.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="90" PostTypeId="2" ParentId="58" CreationDate="2013-05-08T05:33:22.823" Score="2" Body="&lt;p&gt;I agree with above statements. Go simple VTI based IPSEC or alternatively DMVPN. Just remember to run different routing procotol instances within and without the tunnels. Yeah you'll have to replace the ASAs with ISRs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are both ISPs going back to a single head office ASA or two? If two I find it hard to see (with the config available at least) how this behaviour could occur, but if its the same ASA (or same pair) it could be related. &lt;/p&gt;&#xA;" OwnerUserId="203" LastActivityDate="2013-05-08T05:33:22.823" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="91" PostTypeId="1" CreationDate="2013-05-08T06:02:35.910" Score="13" ViewCount="37607" Body="&lt;p&gt;We are running an Aerohove wireless network (controller-less).. I occasionally get mac-flaps within the VLAN tied to a SSID. I know this is coming from a roaming client.. The problem is that the company I work for has end to end vlans (no money to put L3 devices on access-layer) and I believe that these mac-flaps cause the mac-table to get flushed throughout the L2 domain for that VLAN... which in turn causes more broadcasts and so on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know terminating the L2 domain at the access layer would be the best solution, but there is no money on the short term... Any thoughts on how to deal with this issue?&lt;/p&gt;&#xA;" OwnerUserId="209" LastEditorUserId="630" LastEditDate="2013-05-26T10:55:56.157" LastActivityDate="2016-03-10T04:15:48.887" Title="Mac-flap due to roaming clients on wireless" Tags="|cisco|wireless|vlan|ieee-802.11|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="92" PostTypeId="2" ParentId="69" CreationDate="2013-05-08T06:31:29.383" Score="18" Body="&lt;p&gt;UDLD is generally run on fibre media, it is not required on UTP due to the use of Fast Link Pulse which is already monitoring link status.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ericleahy.com/index.php/bpdu-guard-bpdu-filter-root-guard-loop-guard-udld/&quot;&gt;This page has a very good explanation of the various L2 protections available&lt;/a&gt;. Here is an excerpt specifically regarding UDLD:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;UDLD is used to detect if a link is only available in one direction,&#xA;  for example half the fibre is disconnected. UDLD performs this check&#xA;  faster than STP will bring the port in to a fowarding state. That&#xA;  means if you have UDLD and STP enabled then UDLD will prevent STP from&#xA;  bringing a port in to a state where it will forward traffic to&#xA;  nowhere.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A unidirectional link occurs when traffic is transmitted between&#xA;  neighbors in one direction only. Unidirectional Link Detection is a&#xA;  Layer 2 protocol. UDLD performs tasks that Layer 1  mechanisms, such&#xA;  as auto negotiation, cannot perform. When UDLD and auto-negotiation&#xA;  are enabled, both Layer 1 and Layer 2 detections work together to&#xA;  prevent physical and logical unidirectional connections and the&#xA;  malfunctioning of other protocols. Unidirectional links can cause &#xA;  spanning-tree topology loops. UDLD enables devices to detect when a&#xA;  unidirectional link exists and also to shut down the affected&#xA;  interface. UDLD is useful on a fiber ports to prevent  network issues&#xA;  resulting in miswiring at the patch panel causing the link to be in&#xA;  up/up status but the BPDUs are lost.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With UDLD enabled, the switch periodically sends UDLD protocol packets&#xA;  to its neighbor and expects the packets to be echoed back before a&#xA;  predetermined timer expires. If the timer  expires, the switch&#xA;  determines the link to be unidirectional and shuts down the port. If&#xA;  messages are not received within the timeout interval (45 seconds),&#xA;  the port is disabled. The messages are sent out every default&#xA;  interval, which is 15 seconds.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The 45 seconds it takes to detect a unidirectional link and errdisable&#xA;  the port is less than the 50 seconds it would take for STP to&#xA;  transition the port to a Forwarding state, which is based on 20&#xA;  seconds for Max Age + 30 seconds for Listening and Learning. This&#xA;  prevents a loop that would otherwise be caused if STP transitioned the&#xA;  port into the Forwarding state because of a lack of received BPDUs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So in summary, yes they can be run together and on fibre links they &lt;em&gt;should&lt;/em&gt; be run together.&lt;/p&gt;&#xA;" OwnerUserId="103" LastActivityDate="2013-05-08T06:31:29.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="93" PostTypeId="2" ParentId="53" CreationDate="2013-05-08T06:43:15.283" Score="4" Body="&lt;p&gt;QoS (Quality of Service) is a set of measures intended to provide guarantees not previously provided on packet switched networks.  These are used for traffic shaping and to try to get quality guarantees hopefully in some cases approximating circuit-switched protocols over packet switched networks.  It is significantly more complex than this in implementation but that's the basic purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CoS stands for Class of Service and is intended to designate certain ethernet traffic for QoS purposes.  For example in a switched network, this might be used to differentiate TDMoE which is very latency sensitive from ordinary packet switched traffic (TDMoE would likely be carrying telephone voice data between phone switches/gateways).  This could then be used to ensure QoS guarantees could be met.  This gives you an idea of how the concepts interrelate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I look at it is that QoS is really aimed at trying to offer the sorts of very robust guarantees that are typical of connection-switched networks (like the PSTN).  Over ethernet this allows you to take a trunk in a switched network, and then utilize the portion of the bandwidth &lt;em&gt;unused by TDMoE&lt;/em&gt; for example, and use that for packet-switched communications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the way I would describe it is that QoS is the set of techniques and approaches to solving a specific set of problems, while class of service is a designation to data transmissions (particularly on the ethernet protocol level) in order to manage it according to QoS.&lt;/p&gt;&#xA;" OwnerUserId="174" LastActivityDate="2013-05-08T06:43:15.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="94" PostTypeId="5" CreationDate="2013-05-08T06:43:45.550" Score="0" Body="&lt;p&gt;Juniper Networks, Inc. is an American manufacturer of networking equipment founded in 1996. It is headquartered in Sunnyvale, California, USA. The company designs and sells high-performance Internet Protocol network products and services. Juniper's main products include T-series, M-series, E-series, MX-series, and J-series families of routers, EX-series Ethernet switches and SRX-series security products. Junos, Juniper's own network operating system, runs on most Juniper products.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Company Profile:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Type  Public&lt;/li&gt;&#xA;&lt;li&gt;Traded as NYSE: JNPR&lt;/li&gt;&#xA;&lt;li&gt;S&amp;amp;P 500 Component&lt;/li&gt;&#xA;&lt;li&gt;Industry  Networking equipment&lt;/li&gt;&#xA;&lt;li&gt;Founded   6 February 1996&#xA;(Incorporated 25 June 1999)&lt;/li&gt;&#xA;&lt;li&gt;Founder(s)    Pradeep Sindhu&lt;/li&gt;&#xA;&lt;li&gt;Headquarters  Sunnyvale, California, USA&lt;/li&gt;&#xA;&lt;li&gt;Key people    Kevin Johnson, CEO&lt;/li&gt;&#xA;&lt;li&gt;Products  Routers, switches, Firewalls, Intrusion detection systems, VPN hardware&lt;/li&gt;&#xA;&lt;li&gt;Revenue    US$ 4.36 billion (2012)[1]&lt;/li&gt;&#xA;&lt;li&gt;Net income     US$ 186 million (2012)&lt;/li&gt;&#xA;&lt;li&gt;Employees 9,129 (2012)&lt;/li&gt;&#xA;&lt;li&gt;Website   www.juniper.net&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="103" LastEditorUserId="1092" LastEditDate="2013-07-05T15:54:06.257" LastActivityDate="2013-07-05T15:54:06.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="95" PostTypeId="4" CreationDate="2013-05-08T06:43:45.550" Score="0" Body="A tag for questions involving Juniper Networks hardware or software." OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-05-23T16:32:42.517" LastActivityDate="2013-05-23T16:32:42.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="96" PostTypeId="5" CreationDate="2013-05-08T06:44:52.773" Score="0" Body="&lt;p&gt;Open Shortest Path First (OSPF) is a link-state routing protocol for Internet Protocol (IP) networks. It uses a link state routing algorithm and falls into the group of interior routing protocols, operating within a single autonomous system (AS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF is perhaps the most widely used interior gateway protocol (IGP) in large enterprise networks. IS-IS, another link-state dynamic routing protocol, is more common in large service provider networks. The most widely used exterior gateway protocol is the Border Gateway Protocol (BGP), the principal routing protocol between autonomous systems on the Internet.&lt;/p&gt;&#xA;" OwnerUserId="103" LastEditorUserId="103" LastEditDate="2013-05-08T15:35:41.987" LastActivityDate="2013-05-08T15:35:41.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="97" PostTypeId="4" CreationDate="2013-05-08T06:44:52.773" Score="0" Body="For questions about OSPF.  Open Shortest Path First (OSPF) is a link-state routing protocol for Internet Protocol (IP) networks." OwnerUserId="103" LastEditorUserId="8499" LastEditDate="2016-11-29T20:38:46.893" LastActivityDate="2016-11-29T20:38:46.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="98" PostTypeId="2" ParentId="72" CreationDate="2013-05-08T06:53:08.050" Score="9" Body="&lt;p&gt;We use the following tools for different types of documentation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://racktables.org/&quot;&gt;RackTables&lt;/a&gt; - Holds physical rack layouts, cabling, asset tracking, IPAM (IP address management), and change logs.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.shrubbery.net/rancid/&quot;&gt;Rancid&lt;/a&gt; - Automatically backs up all configuration changes in to SVN from all of our switches, routers and firewalls. This provides automatic documentation and tracking on changes.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.mediawiki.org/wiki/MediaWiki&quot;&gt;MediaWiki&lt;/a&gt; - All code snippets, procedures, and detailed customer information is logged in wiki form as it's easy to edit for all while providing good version history.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://github.com/&quot;&gt;GitHub&lt;/a&gt; - All large configuration sets (eg for &lt;a href=&quot;http://www.nagios.org/&quot;&gt;Nagios&lt;/a&gt; or &lt;a href=&quot;http://www.bacula.org/en/&quot;&gt;Bacula&lt;/a&gt;) are stored in private repositories in GitHub. We moved to Git from SVN around a year ago as it provides far superior tracking and delegated maintainership.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="103" LastActivityDate="2013-05-08T06:53:08.050" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="99" PostTypeId="1" AcceptedAnswerId="101" CreationDate="2013-05-08T06:55:11.447" Score="86" ViewCount="78866" Body="&lt;p&gt;These days both fibre and twisted pair are supporting 1000BASE-T and 10GBASE-T, but when do you choose one over the other? The obvious one is maximum cable length, but what are other factors which might come to mind when making this choice. &lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="2369" LastEditDate="2013-08-27T10:53:17.850" LastActivityDate="2020-07-12T15:29:55.503" Title="When to choose fiber instead of twisted pair (copper)" Tags="|ethernet|fiber|cabling|" AnswerCount="21" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="100" PostTypeId="2" ParentId="3" CreationDate="2013-05-08T07:00:35.560" Score="7" Body="&lt;p&gt;There are various tools dependant on platform. For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cisco - &lt;a href=&quot;http://www.cisco.com/en/US/products/ps6616/products_ios_protocol_group_home.html&quot;&gt;NBAR&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;SonicWALL - &lt;a href=&quot;http://www.sonicwall.com/us/en/products/Application_Intelligence_Control_Visualization.html&quot;&gt;AppFlow&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Juniper - No specific option in JunOS, though can &lt;a href=&quot;http://forums.juniper.net/t5/Junos-and-Junosphere/Cisco-nBAR-equivalent-in-JUNOS/m-p/13919#M1102&quot;&gt;roughly be achieved using class maps&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For monitoring of traffic Netflow &amp;amp; &lt;a href=&quot;http://nfsen.sourceforge.net/&quot;&gt;NFSEN&lt;/a&gt; is your friend. The bundle simplifies deployment of the NFDUMP capture, dump and analysis tools and gives you a nice frontend to view it all in and make graphs for management.&lt;/p&gt;&#xA;" OwnerUserId="103" LastActivityDate="2013-05-08T07:00:35.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="101" PostTypeId="2" ParentId="99" CreationDate="2013-05-08T07:15:17.963" Score="69" Body="&lt;p&gt;There are a fairly large number of factors to consider and it is also important to accept that not all fiber is the same just like not all twisted pair is the same.  Here are a few things that occur to me.  Of course these may vary depending on environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Fiber:&lt;/strong&gt;  Much longer max distances, depending on specification and throughput.  No electromagnetic interference. Note however that fiber comes in a large number of grades and planning for the future may be somewhat more complex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Copper:&lt;/strong&gt; Shorter max distances per link.  Susceptible to electromagnetic interference.  Fewer number of grades/variations (but still mind these!) meaning fewer accidents when the rollout team grabs the wrong spool (see below for a funny story).  Supports power over ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Funny story:  A particular county in a Western state runs a fiber network that began as a control system for their hydroelectric dams.  As time went on they found they didn't need nearly as much fiber as was laid for this and so they separated out many of the strands and used it to build a county-wide network linking homes and businesses to ISP's and telco's.  Of course single mode fiber was used for longer transmissions and multi-mode for short runs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when they were running the longer runs to connect towns and cities with this new network, the team that ran the fiber grabbed the wrong spool, and ran multi-mode fiber on all these long distance links.  The team was quite unhappy when they found out they would have to re-run all the fiber again!  Moral of the story:  be very careful about ensuring that everyone knows which grades of fiber go where....&lt;/p&gt;&#xA;" OwnerUserId="174" LastActivityDate="2013-05-08T07:15:17.963" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="102" PostTypeId="1" CreationDate="2013-05-08T07:28:37.243" Score="11" ViewCount="4329" Body="&lt;p&gt;I'm trying to help a friend with some Nexus issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The topology is like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cat 3750 stack -&gt; vPC -&gt; 2x N7k -&gt; LACP -&gt; Fortigate firewall cluster&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 3750 stack is running OSPF to both the Nexuses. The adjacencies are up. From what I have read this is not a supported design. Loop prevention would prevent packets that come in on one Nexus but that is destined for another and then goes across the peer link. If this traffic exits another vPC it will be blocked due to the loop prevention mechanism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case though the firewalls (cluster) are not connected via vPC. Will loop prevention still kick in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I'm surprised that OSPF adjacencies are up and seem to be working. All routes are present but there are still reachability issues. Some OSPF packets would probably come in over the peer link. I can see how this could be an issue for the unicast packets that need to cross peer link and then exit vPC back to the stack which not be allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How will the multicast be treated. I guess that should be received correctly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I guess they should maybe turn up new interfaces that are routed instead. Or would it be possible to run SVI which is point-to-point between each Nexus and the stack?&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="8499" LastEditDate="2018-03-19T16:22:47.083" LastActivityDate="2018-03-19T16:22:47.083" Title="OSPF over vPC on Nexus7k" Tags="|ospf|multicast|ieee-802.1ax|vpc|loop|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="103" PostTypeId="2" ParentId="72" CreationDate="2013-05-08T07:32:20.347" Score="2" Body="&lt;p&gt;&lt;strong&gt;Tools&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are currently using a private SVN server for knowledge documentation.  Our team is small and savvy (and includes people mostly familiar with SVN including someone who commits code to the Apache Subversion project).  We also track knowledge in other areas as well.  Keep in mind our operation is small (just a few individuals) and so the emphasis is on coordination and making sure we don't forget stuff we shouldn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are in the process (which may take some time) of fully integrating the CMS/FAQ/etc, tracking with our ERP (which is where we store detailed customer info) but this may take quite some time.  One of our goals is a very highly integrated system where changes made in the ERP get rolled out automatically to the network (both at the network and host level), and where knowledge and information is tightly bound to that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Use&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding network engineering there are two critical aspects for us, namely periodic review (documenting is great, but it is useless if you don't periodically do something with it).  This is particularly important when it comes to security knowledge.  What is our current threat profile we are worried about?  What are we doing about this?  Are either of these things can can be improved on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, documented knowledge should be both reviewable and periodically reviewed.&lt;/p&gt;&#xA;" OwnerUserId="174" LastActivityDate="2013-05-08T07:32:20.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="104" PostTypeId="2" ParentId="91" CreationDate="2013-05-08T07:55:13.410" Score="16" Body="&lt;p&gt;If your APs are just bridging clients from the wireless right onto your wired network, then you're going to see this from time to time. Clients will appear from different ports as they re-associate to other APs/cells in the ESSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm presuming you're talking about Cisco IOS here, based on the term &quot;MACFLAP&quot;, which appears in their log messages when this happens.&#xA;For example: &quot;%SW_MATM-4-MACFLAP_NOTIF: Host 0011.2233.4455 in vlan 123 is flapping between port Gi1/1 and port Gi1/2&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What this means is that the switch is having to &quot;re-learn&quot; an Ethernet MAC address out of a different port than what is cached in the hardware forwarding table. This takes a little CPU time for each event, and having it happen more than couple times in a row will cause that MACFLAP message to get logged as more and more CPU time is consumed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this &lt;em&gt;should not&lt;/em&gt; cause the entire table to be flushed or cleared. Just the entries for the flapping source MAC address should be getting affected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, in your case, if this is an infrequent message and it's just wireless clients moving from place to place, I wouldn't worry about this too much.&#xA;To prevent this, some centralized wireless client termination would be needed. This way, frames would pop out onto the wired VLAN in a consistent place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if this is happening frequently for many MAC addresses, it could be indicative of a Layer 2 loop which will definitely need some investigation. :p&lt;/p&gt;&#xA;" OwnerUserId="131" LastActivityDate="2013-05-08T07:55:13.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="105" PostTypeId="2" ParentId="99" CreationDate="2013-05-08T07:55:32.007" Score="18" Body="&lt;p&gt;If you ever feel that you are going to run FCoE over the medium then it is better to run fibre than copper as the BER for copper is significantly higher and most of the time will be outside of the tolerance for the 'lossless' nature of FCoe.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-08T07:55:32.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="106" PostTypeId="2" ParentId="102" CreationDate="2013-05-08T07:59:48.880" Score="8" Body="&lt;p&gt;As the firewalls aren't part of a vPC they won't be part of the normal vPC loop prevention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The loop prevention only states that a packet cannot ingress on the peer link if it is destined to go out another vPC enabled port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not too sure on the multicast front as we don't use it in our environment and I haven't really looked into its behaviour on the 7K's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually if you are running a routing protocol down on the switch stack the recommended design would be to not have it as a member of a vPC and just use OSPF to give you the same advantages that vPC gives you at L2.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-08T07:59:48.880" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="107" PostTypeId="2" ParentId="99" CreationDate="2013-05-08T08:16:56.143" Score="8" Body="&lt;p&gt;There are technologies like wavelength division multiplexing (WDM), that you can't use with copper. I would say that two best reasons to use fiber over copper is max cable length and WDM.&lt;/p&gt;&#xA;" OwnerUserId="235" LastActivityDate="2013-05-08T08:16:56.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="108" PostTypeId="2" ParentId="72" CreationDate="2013-05-08T08:36:12.287" Score="2" Body="&lt;p&gt;I think that the documentation is fundamental and all the answers (especially &lt;a href=&quot;https://networkengineering.stackexchange.com/users/176/mike-marotta&quot;&gt;Mike&lt;/a&gt;'s one IMHO) pointed out very good reasons to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would like to add is that, I think the choice of the tool should be done on the base of the &quot;audience&quot;. That is: if one needs to document a developed simulator for him and some colleagues, perhaps &lt;a href=&quot;https://github.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GitHub&lt;/a&gt; is sufficient. But, consider the case in which the same simulator should be used in an academic course: then, probably, it is worth to provide to students &lt;em&gt;also&lt;/em&gt; a rough illustration guide to explain the basic functionalities.&lt;/p&gt;&#xA;" OwnerUserId="223" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-05-08T08:36:12.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="109" PostTypeId="2" ParentId="3" CreationDate="2013-05-08T08:52:01.200" Score="2" Body="&lt;p&gt;This is way too broad, but here is an effort to answer what I think you are asking.  What follows is more information concerning Jeremy's answer above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you are asking about prioritizing traffic based on specific aspects of the application layer control protocols (btw, I use TCP/IP terminology rather than OSI ones when discussing TCP/IP because IMO the OSI model does not map to TCP/IP as well as one might think --- for example try to understand how H.323 fits on the model, both as originally designed and when over TCP/IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a simple example, maybe you want to prioritize TFTP requests for PXE booting over other TFTP requests, or perhaps you want to prioritize H.323 signalling of some types over others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do this you need either routers or the like which can understand the protocols you wish to shape traffic based on.  These routers then need to be able to inspect the packets deeply at least when required, and then shape the traffic based on what they find.  Needless to say different application protocols will have different requirements and possibilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this reason, it depends on the platform, the protocol, and what you want to accomplish.  As others have noted various vendors have &lt;em&gt;toolkits&lt;/em&gt; for this, but to really answer what is involved, we need a lot more information about what traffic you have, what problem you are solving, and what tools you have available to you already.&lt;/p&gt;&#xA;" OwnerUserId="174" LastActivityDate="2013-05-08T08:52:01.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="110" PostTypeId="2" ParentId="3" CreationDate="2013-05-08T08:57:52.363" Score="5" Body="&lt;p&gt;You need a proper application aware appliance. Exinda, riverbed, etc.&#xA;Cisco and Juniper et al (yes I include WAAS) is a crowbar solution. NBAR is nowhere as accurate esp. with the trickier protcols that use random/dynamic ports. For enterprise use NBAR is fine as you can control the environment but when dealing with the internet you are going to be dealing with a lot of clever tricky protocols and varied situations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example the app aware stuff can be tied into dynamic white/blacklists and offer far more granular behaviour e.g. for http, allow burst for first 100M, if the rate is above X (set it above HD youtube lol) then start rate limiting after the first 100M if priority traffic is getting contended. This kind of behaviour gives your users excellent experience and appears transparent to them whilst hitting people downloading large files via http/https like filelockers for example. And critically they deal with a lot more protocols, try getting nbar to spot chinese p2p video streaming like pplive or pps for example. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For basic enterprise use yes you'd rely on nbar/static port definitions then use qos classifications to queue appropriately. Works fine in that scenario. &lt;/p&gt;&#xA;" OwnerUserId="203" LastEditorUserId="203" LastEditDate="2013-05-09T12:49:11.713" LastActivityDate="2013-05-09T12:49:11.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="111" PostTypeId="2" ParentId="99" CreationDate="2013-05-08T10:10:26.117" Score="23" Body="&lt;p&gt;If cost is a factor for you, I would look at it like this;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenario 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are making a short run, say 50M, I would go for copper, simply because of cost (This 50M run is between two comms cabs in an office building for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Copper is cheaper and using switches would save on the cost of SFPs or GBICs and so on. We obviously aren't talking thousands here but some people are on strict budgets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenario 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are making a short run between two cabs in a DC between core routers, it would be fibre for me hands down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In scenario 1, you could in fact drop in two or three 50M lengths of copper for almost the same price as one run. This would cover any likely future expansion. In scenario 2, fibre would better cover future expansion and give a greater ROI because of technologies like WDM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As others have mentioned, fibre will go futher. If you want greater than 100M, you have one option - fibre. If you need a shorter run, it simply becomes a cost trade off.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2015-07-14T11:02:17.753" LastActivityDate="2015-07-14T11:02:17.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="112" PostTypeId="2" ParentId="15" CreationDate="2013-05-08T10:14:53.173" Score="5" Body="&lt;p&gt;In addition to the exact answer about MMF and SC-SC connectors, the PDF presentation linked here from Richard Steenbergen @ NANOG57 is the best introduction to fibre you'll ever find.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.nanog.org/meetings/nanog57/presentations/Monday/mon.tutorial.Steenbergen.Optical.39.pdf&quot;&gt;Everything You Always Wanted to Know About Optical Networking – But Were Afraid to Ask &lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7" LastActivityDate="2013-05-08T10:14:53.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="113" PostTypeId="2" ParentId="3" CreationDate="2013-05-08T10:57:13.080" Score="3" Body="&lt;p&gt;If you run linux you could try &lt;a href=&quot;http://l7-filter.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;l7-filter&lt;/a&gt;, which is a iptables/netfilter-module. You can then use the usual &lt;a href=&quot;http://l7-filter.sourceforge.net/HOWTO-kernel#qos&quot; rel=&quot;nofollow&quot;&gt;iptables-magic&lt;/a&gt; to do some QOS.&#xA;Weathermaps could be created with &lt;a href=&quot;https://collectd.org/wiki/index.php/Plugin%3aIPTables&quot; rel=&quot;nofollow&quot;&gt;collectd&lt;/a&gt; (writing to RRDs) and then reading from these with &lt;a href=&quot;http://www.network-weathermap.com&quot; rel=&quot;nofollow&quot;&gt;http://www.network-weathermap.com&lt;/a&gt; or &lt;a href=&quot;http://weathermap4rrd.tropicalex.net/&quot; rel=&quot;nofollow&quot;&gt;http://weathermap4rrd.tropicalex.net/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no tool ready that allows monitoring and dynamic prioritisation&amp;nbsp;— you might have to invest in some soft of tailored linux-distribution or a &lt;em&gt;hardware&lt;/em&gt;-firewall of some sort.&lt;/p&gt;&#xA;" OwnerUserId="69" LastEditorUserId="3662" LastEditDate="2013-12-24T20:47:30.883" LastActivityDate="2013-12-24T20:47:30.883" CommentCount="0" CommunityOwnedDate="2013-05-08T10:57:13.080" ContentLicense="CC BY-SA 3.0" />
  <row Id="114" PostTypeId="1" AcceptedAnswerId="116" CreationDate="2013-05-08T11:07:04.530" Score="16" ViewCount="67461" Body="&lt;p&gt;How does STP/RSTP determine which bridge is the root bridge, and how are paths to the root bridge selected?&lt;/p&gt;&#xA;" OwnerUserId="228" LastEditorUserId="3075" LastEditDate="2017-10-04T02:48:25.867" LastActivityDate="2017-10-04T02:48:25.867" Title="How is the root bridge elected in STP?" Tags="|ethernet|spanning-tree|layer2|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="115" PostTypeId="2" ParentId="114" CreationDate="2013-05-08T11:37:17.987" Score="13" Body="&lt;p&gt;You're asking about STP theory:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Spanning_Tree_Protocol&quot;&gt;https://en.wikipedia.org/wiki/Spanning_Tree_Protocol&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the basic idea is that each switch has a Bridge ID which is a combination of its priority and its MAC address. By default, all switches use 32768 as their priority so by default the switch with the lowest MAC will act as the Root Bridge. You can manipulate this by adjusting the priorities, since the default Root Bridge is likely not the one you want to act as Root. You would decide which switch to use as root based on your layer 2 designs and where you anticipate layer 2 traffic to travel most.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cost of the path to root is the sum of the link costs between the port in question and the relevant port on the root bridge. The faster the link, the lower the cost. So ten hops to root over 1GBPS links would give a port cost of 40 (4+4+4+4+4+4+4+4+4+4), while a single 10MBPS link would be 100. So the root port would be the one that connects to the 1GBPS links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also manipulate the STP paths and roots per vlan. The link above will get you started. It can be as complex as you want it to be.&lt;/p&gt;&#xA;" OwnerUserId="106" LastActivityDate="2013-05-08T11:37:17.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="116" PostTypeId="2" ParentId="114" CreationDate="2013-05-08T11:43:43.793" Score="26" Body="&lt;p&gt;Not sure how much you know about switching and spanning tree but basically when starting out all switches claim that they are the root. All switches send BPDUs (Bridge Protocol Data Unit) which contain a priority and the BID (Bridge ID). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The BID is 8 bytes long. 6 bytes is used for the MAC address of the bridge. 12 bits is used to indicate the VLAN, this is called extended system ID. 4 bits are used to set the priority. Lower priority means it is preferred compared to a higher. The priority is set in multiples of 4096.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is a tie in priority then the lowest MAC address will determine which bridge becomes the root.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To select the path to the root the cost to the root is calculated. As the BPDU travels from the root downstream the cost is increased INBOUND. 802.1D-1998 (legacy STP) had a cost of 19 for a FastEthernet interface. The newer standard 802.1D-2004 defines a cost of 200000 for FastEthernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is a tie in cost then choose the BPDU that came from the switch with lowest BID. If that is a tie as well (multiple links to same switch) port ID comes into play. The port ID is from the upstream switch as well and consists of a port priority and port ID which identifies the interface. The default port priority is 128.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a lot to spanning tree but these are the basic steps.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-08T11:43:43.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="117" PostTypeId="2" ParentId="81" CreationDate="2013-05-08T11:48:24.157" Score="3" Body="&lt;p&gt;When you configure for example a value of 5 in the tt-security feature, the router deduct 5 from 255, so it accepts only an IP TTL greater than or equal to 255 minus the value configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, it doesn't really means it only accept a router directly connected.  It avoids attacks from host manipulating the TTL in the TCP session.&lt;/p&gt;&#xA;" OwnerUserId="263" LastEditorDisplayName="user10222" LastEditDate="2017-06-17T09:08:59.907" LastActivityDate="2017-06-17T09:08:59.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="118" PostTypeId="2" ParentId="83" CreationDate="2013-05-08T11:56:09.780" Score="8" Body="&lt;p&gt;In cases where common configure mode is unavailable, like when the chassis are clustered, you can use the following method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After executing a &lt;code&gt;commit at&lt;/code&gt;, JunOS checks the config and creates the file &lt;code&gt;/config/juniper.conf+.gz&lt;/code&gt;. The running config database &lt;em&gt;is&lt;/em&gt; locked until the commit at time, so other users won't be able to commit interim changes.  Other users can delete pending changes with the &lt;code&gt;clear system commit&lt;/code&gt; command.  This will unlock the running config database and allow for other commits; however, the original user may be a bit upset at his or her changes not going in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see what the differences between the pending config file and the current running config, perform the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure private&#xA;load replace /config/juniper.conf+.gz&#xA;show | compare&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;JunOS will output the patch-style text of the changes in the pending commit. After doing whatever work you need to complete during the pending commit, you can paste that back in with a &lt;code&gt;load patch terminal&lt;/code&gt; (or pipe to another file), and the original &lt;code&gt;commit at&lt;/code&gt; user will be much happier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;If you seem to be forced into a private edit mode, as might be the case in a chassis cluster:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@SRX3600&amp;gt; configure &#xA;warning: Clustering enabled; using private edit&#xA;warning: uncommitted changes will be discarded on exit&#xA;Entering configuration mode&#xA;&#xA;{primary:node1}[edit]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can use &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure shared&#xA;show | compare&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That seems to work just fine and skirts that nasty issue of being forced into private config mode.  &lt;code&gt;configure shared&lt;/code&gt; is a hidden commmand&lt;/p&gt;&#xA;" OwnerUserId="194" LastEditorUserId="194" LastEditDate="2013-12-05T18:34:18.783" LastActivityDate="2013-12-05T18:34:18.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="119" PostTypeId="1" AcceptedAnswerId="121" CreationDate="2013-05-08T11:58:14.957" Score="95" ViewCount="33609" Body="&lt;p&gt;I'm comfortable with IPv4 address space allocations. By which I mean: Given services to plan for, or an organization to network, I have a good grasp of how to plan IP address space usage. (or at least, I &lt;em&gt;think&lt;/em&gt; I do. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any best practices guidance, or case studies, for IPv6 address space layout?&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2022-05-26T18:22:03.590" Title="IPv6 address space layout best practices" Tags="|ipv6|best-practices|" AnswerCount="12" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="120" PostTypeId="2" ParentId="69" CreationDate="2013-05-08T12:05:35.553" Score="1" Body="&lt;p&gt;I only use it on copper ports where there is another L1 media between endpoints, the usual culprit of this is a fibre media converter.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-08T12:05:35.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="121" PostTypeId="2" ParentId="119" CreationDate="2013-05-08T12:32:38.163" Score="79" Body="&lt;p&gt;The layout that we are using for our rollout is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;/48 per customer&lt;/li&gt;&#xA;&lt;li&gt;/56 per customer site (as a subnet of the other /48)&lt;/li&gt;&#xA;&lt;li&gt;/126 for all point-to-point links in the core, these are all subnets of a /48 used for all core links&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These sizes are mostly taken from the RIPE advisory &lt;a href=&quot;http://www.ripe.net/internet-coordination/press-centre/understanding-ip-addressing&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-08T12:32:38.163" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="122" PostTypeId="2" ParentId="99" CreationDate="2013-05-08T12:40:24.440" Score="16" Body="&lt;p&gt;I will add another factor that hasn't been mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can quickly and easily make copper cables, measured and cut to the exact length I need for a run...resulting in neater cable plants.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While you can cut to length and put ends on fiber optic cable, I find it considerably more difficult and time consuming...and my experience doing this is with multi-mode fiber, I can only imagine that single-mode is that much worse.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-05-08T12:40:24.440" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="123" PostTypeId="1" AcceptedAnswerId="126" CreationDate="2013-05-08T12:48:41.247" Score="38" ViewCount="39618" Body="&lt;p&gt;Depending on what type of traffic is going over the network, it's often not feasible that an employee brings a wireless router and sets it up into your network. This is because often, they are not or poorly secured and present a backdoor into the network. What can you do to prevent rogue wireless access points being introduced into your network? &lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="39589" LastEditDate="2017-09-07T16:49:53.860" LastActivityDate="2020-06-06T13:52:29.113" Title="How do you prevent rogue wireless access points on a network?" Tags="|security|wireless|rogue|" AnswerCount="11" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="124" PostTypeId="2" ParentId="123" CreationDate="2013-05-08T12:48:41.247" Score="14" Body="&lt;p&gt;First of all you need to build a policy prohibiting introducing network equipment into the network which is not owned by or approved by the company IT department. Next enforce port security so that unknown mac addresses cannot connect to your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third set up a separate wireless network under your control (if you give them what they want they are less likely to introduce rogue AP) (if possible and feasible) for accessing the internet with their (mobile) devices. These access points should be secured with PEAP or similar and preferably run on a separate network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last you can also do regular security scans using tools like netstumbler to detect and track rogue access points in your network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also the option to perform IPsec over your network so that in case someone does set up a rogue AP, the exposed &quot;waves&quot; will not be plain readable in case of someone sniffing the wireless network. &lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-05-08T12:48:41.247" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="125" PostTypeId="2" ParentId="119" CreationDate="2013-05-08T12:48:46.530" Score="29" Body="&lt;p&gt;The old recommendation was to use /64 everywhere even on P2P links and assign a /48 per site.&lt;/p&gt;&#xA;&lt;p&gt;Using large, empty subnets on point-to-point links can lead to a number of potential security issues, (see &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6164&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6164&lt;/a&gt;,) so it's now best practice to use a /127 for P2P links and /128 for loopbacks.&lt;/p&gt;&#xA;&lt;p&gt;It's not necessary to give a small customer a /48 although you would have plenty addresses to go around if you choose to do so.&lt;/p&gt;&#xA;&lt;p&gt;Interfaces that are facing customers should be /64 if you want to use SLAAC. If you don't intend to use it you can use another mask.&lt;/p&gt;&#xA;&lt;p&gt;Here are some good links to go through:&lt;/p&gt;&#xA;&lt;p&gt;BRKRST-2301 from ciscolive365.com (create free account)&#xA;&lt;a href=&quot;http://www.cisco.com/web/strategy/docs/gov/IPv6_WP.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/web/strategy/docs/gov/IPv6_WP.pdf&lt;/a&gt;&lt;br /&gt;&#xA;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5375.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc5375.html&lt;/a&gt;&lt;br /&gt;&#xA;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6177&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc6177&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Some people take their current v4 assignments and convert second and third octet into hex and use that for v6. There are lots of different ways of doing it so you have to choose what feels best.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-05-21T10:32:20.923" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="126" PostTypeId="2" ParentId="123" CreationDate="2013-05-08T13:02:42.530" Score="28" Body="&lt;p&gt;Lucas's answer above is a bit of a starting point.    There are however two or three other things that must be considered.  These end up being somewhat outside the scope of &lt;em&gt;network&lt;/em&gt; engineering, but certainly have impacts for network engineering and security so here they go.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You probably want some way of preventing wireless cards in company laptops from being switched into ad hoc mode.  Assuming the laptops are running Windows, you probably want to use a GPO to set to infrastructure mode only.  For Linux, it is harder to fully restrict, but there are ways to do this too.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Enforcing IPSec is also a good idea, particularly with good key management and trusted enforcement.  For example if you can go to X509 certs for key management this can keep unauthorized devices from communicating with the rest of your network directly.  Consider key management as a core part of the infrastructure here.  If you use a proxy server you may even be able to block unauthorized devices from accessing the internet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Note the limitations of your efforts.  None of these prevents a person from setting up an unsecured wireless access point connected to a USB NIC, for sole purposes of communicating with their computer, especially if the SSID is hidden (i.e. not broadcast).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Not sure how to further contain problems or if further paranoia is well past the point of insufficient returns.....&lt;/p&gt;&#xA;" OwnerUserId="174" LastActivityDate="2013-05-08T13:02:42.530" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="127" PostTypeId="2" ParentId="119" CreationDate="2013-05-08T13:28:52.087" Score="25" Body="&lt;p&gt;With IPv6 you no longer have to worry about allocating space for a given number of hosts.  All subnets (other than P2P links) should be assigned as a /64 which gives you a ridiculous number of host addresses.  This frees you to focus on other topics such as good network layout &amp;amp; design.  (A /48 would give you 65,536 /64 networks)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are (of course) several schools of thought on this.  If you are already pretty happy with your IPv4 design, then doing a IPv6 overlay that mirrors things is probably a good option and eases the transition for everyone.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2001:0DB8:1:1:: /64  --&gt;  10.1.1.0 /24 &lt;/li&gt;&#xA;&lt;li&gt;2001:0DB8:1:2:: /64  --&gt;  10.1.2.0 /24 &lt;/li&gt;&#xA;&lt;li&gt;... &lt;/li&gt;&#xA;&lt;li&gt;2001:0DB8:1:254:: /64 --&gt; 10.1.254.0 /24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Play around with some of the IPv6 calculators to help you get your head around all of this.  Here is an example one:  &lt;a href=&quot;http://www.gestioip.net/cgi-bin/subnet_calculator.cgi&quot;&gt;GestioIP Online IPv4/v6 Calculator&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was the hardest thing for me to get over - don't worry about allocating space for hosts!  Plan your network -- focus on locations of layer-3 boundaries, services offered, physical location of devices, etc.  It is probably going to be years before you have a pure IPv6 network, but you will begin laying the groundwork of good network design now.&lt;/p&gt;&#xA;" OwnerUserId="266" LastEditorUserId="266" LastEditDate="2013-05-08T14:14:19.893" LastActivityDate="2013-05-08T14:14:19.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="128" PostTypeId="2" ParentId="123" CreationDate="2013-05-08T13:41:47.907" Score="6" Body="&lt;p&gt;From a monitoring standpoint, you could run a tool like &lt;a href=&quot;http://www.netdisco.org/&quot;&gt;NetDisco&lt;/a&gt; to find switchports with more MAC addresses connected than you would expect. It wouldn't automatically prevent a rogue WAP from being introduced to the network, but it would let you find one after the fact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the equipment connected to your switchports can be expected to remain static, MAC address limiting (with violations configured to administratively down the switchport) could prevent any rogue device (not just WAPs) from being connected.&lt;/p&gt;&#xA;" OwnerUserId="271" LastActivityDate="2013-05-08T13:41:47.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="129" PostTypeId="2" ParentId="91" CreationDate="2013-05-08T14:09:38.570" Score="5" Body="&lt;p&gt;Unless you're receiving lots of the macflap notifications, I wouldn't be concerned. It sounds like the roaming client is temporarily communicating with two APs (which are connected to the same switch) as it is being handed off from one to the other. The macflaps are occurring because the switch sees traffic from the same MAC on two interfaces at the same time. I would expect the macflaps to stop as the handoff is complete. The usual concern with macflaps is when they don't stop - the thrashing from constantly updating the MAC table multiple times a second can seriously damage a switch's hardware ($WORK once literally melted a 6500 supervisor card that way). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see why the MAC table would flush through the L2 domain - its context is local to the switch. If you attach one of the APs to a different switch, you should stop seeing the macflap notifications.&lt;/p&gt;&#xA;" OwnerUserId="271" LastActivityDate="2013-05-08T14:09:38.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="130" PostTypeId="1" AcceptedAnswerId="134" CreationDate="2013-05-08T14:21:19.650" Score="44" ViewCount="52641" Body="&lt;p&gt;I understand that IPv6 reserves the fe80::/10 prefix for link local addresses, and that hosts select an address with a /64 prefix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is the reserved space so much larger than what is actually used for link local?&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="69" LastEditDate="2013-05-08T14:36:08.307" LastActivityDate="2018-04-30T07:25:32.320" Title="Why is fe80::/10 reserved for link local addresses when fe80::/64 is actually used?" Tags="|ipv6|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="131" PostTypeId="1" AcceptedAnswerId="154" CreationDate="2013-05-08T14:26:04.530" Score="7" ViewCount="6065" Body="&lt;p&gt;For light amplification for longer-haul fiber lines, as far as I can tell, the two major options are EDFA's and Raman amplifiers.  What is the tradeoff between one type and the other?  Are there areas where Raman amplifiers are clearly better?  Is it just a matter of EDFA's being cheaper and Raman Amplifiers having greater gain ranges, or is there something more major that I am missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(For the uninitiated, EDFA = erbium doped fiber amplifier.  It acts basically as a sort of a lasing chamber without the mirrors, so it amplifies laser signals as they go through the (usually single mode) fiber.  This boosts the maximum distance of a fiber run.)&lt;/p&gt;&#xA;" OwnerUserId="174" LastEditorUserId="178" LastEditDate="2013-05-08T18:14:49.563" LastActivityDate="2016-11-14T19:51:37.373" Title="Raman amplifier vs EDFA, what is the tradeoff?" Tags="|fiber|optical|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="132" PostTypeId="2" ParentId="130" CreationDate="2013-05-08T14:35:27.960" Score="10" Body="&lt;p&gt;You know, I've never considered this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would presume that fe80::/64 is used because systems then run stateless address autoconfiguration (SLAAC) in that /64.  Leaving the rest of the /10 available for statically assigned link-local addresses and netblocks.  I'm having a tough time coming up with significant use cases for static link-local assignments, but I suppose there are reasons that people might end up wanting to do so.&lt;/p&gt;&#xA;" OwnerUserId="97" LastEditorUserId="49" LastEditDate="2013-05-08T14:56:59.253" LastActivityDate="2013-05-08T14:56:59.253" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="133" PostTypeId="2" ParentId="119" CreationDate="2013-05-08T14:36:51.697" Score="14" Body="&lt;p&gt;In use the following layout myself (datacenter pov)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Colocation customers: one /48.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dedicated servers: one /64 per server by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P2P links (bgp linknets, and so on): /126&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the IPv4 -&gt; IPv6 transition to a dual stack environment for hosted vlans I match the ipv4 subnet to an ipv6 subnet which is large enough, to contain a /64 for every single ipv4 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan containing one /24 ipv4 (256 ip's), I match that with a /56 Ipv6 (256 unique /64 subnets)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan containing one /23 ipv4 (512 ip's), I match that with a /55 ipv6 (512 unique /64 subnets)&lt;/p&gt;&#xA;" OwnerUserId="276" LastActivityDate="2013-05-08T14:36:51.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="134" PostTypeId="2" ParentId="130" CreationDate="2013-05-08T14:41:09.280" Score="31" Body="&lt;p&gt;I think the link-local scope was set to /10 simply to &amp;quot;fit in&amp;quot; better with the other scopes, e.g. site-local (before it was replaced with unique local).&lt;/p&gt;&#xA;&lt;p&gt;Initially I had thought maybe it was to allow the use of many link-local networks on the same link, but &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#section-2.5.6&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291 explicitly states&lt;/a&gt; that only fe80::/64 may be used.&lt;/p&gt;&#xA;" OwnerUserId="5" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-05-08T14:41:09.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="135" PostTypeId="1" AcceptedAnswerId="136" CreationDate="2013-05-08T15:08:44.473" Score="24" ViewCount="9325" Body="&lt;p&gt;I need to set up a modest iSCSI SAN with a few ESX hosts and one storage array. Can I get by using a Catalyst 2960-S or do I need to upgrade? Are there any special tweaks I need to make to the switch in order to handle iSCSI? The switch will be dedicated to the SAN; no other traffic except management will be present.&lt;/p&gt;&#xA;" OwnerUserId="5" LastEditorUserId="5" LastEditDate="2013-05-09T18:35:52.447" LastActivityDate="2014-08-05T20:29:54.517" Title="Can I use a Catalyst 2960-S for iSCSI?" Tags="|cisco-catalyst|iscsi|san|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="136" PostTypeId="2" ParentId="135" CreationDate="2013-05-08T15:18:31.407" Score="28" Body="&lt;p&gt;Given that the Cat2960-S is a desktop/access switch, with very, very small buffers, you would likely experience a lot of output drops.  A datacenter switch, such as a 4948E, would be a better choice for an iSCSI application.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand the reasoning behind this, you have to remember that an ethernet switch is either transmitting, or not transmitting on a specific port.  If traffic arrives on port 1 for port 2, and port 3 is already sending traffic to port 2, the traffic from port 1 has to be buffered until there's a gap in the traffic from 3 to 2.  If the buffer fills, additional traffic will be dropped.  The term &quot;microburst&quot; is used to reference traffic that, over time, is well below the limit for the interface, but occasionally bursts to cause output drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not as familiar with the 2960-S platform, but enabling QoS (without extensive tuning, see comments below) on it would probably be a bad idea; that would actually increase the number of output drops.  Enabling QoS splits your very small buffers into 4 even smaller buffers, and most traffic will hit only one of them.&lt;/p&gt;&#xA;" OwnerUserId="141" LastEditorUserId="141" LastEditDate="2013-05-08T19:32:42.403" LastActivityDate="2013-05-08T19:32:42.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="137" PostTypeId="2" ParentId="135" CreationDate="2013-05-08T15:24:32.287" Score="7" Body="&lt;p&gt;I've had experience where customers have chosen to use the lower end switches (3750, 2960) for iSCSI and they are pretty terrible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue gets even worse when you have your storage connected at a higher speed (like 10gbit for the SAN and 1gbit for the end servers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would look towards more of the DC class switches, if you want to stick with Catalyst then there is the 4900 series, alternatively you could venture in to the Nexus product line but it really depends on your price constraints.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-08T15:24:32.287" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="138" PostTypeId="1" AcceptedAnswerId="139" CreationDate="2013-05-08T15:55:50.777" Score="19" ViewCount="3980" Body="&lt;p&gt;On one of my routers, I see the following switching modes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show fabric switching-mode &#xA;Global switching mode is Truncated&#xA;dCEF mode is not enforced for system to operate&#xA;Fabric module is not  required for system to operate&#xA;Modules are allowed to operate in bus mode&#xA;Truncated mode is allowed, due to presence of DFC, CEF720, Standby supervisor module&#xA;&#xA;Module Slot     Switching Mode&#xA;1                      Bus&#xA;2                 Crossbar&#xA;3                     dCEF&#xA;4                      Bus&#xA;5                      Bus&#xA;6                 Crossbar&#xA;7                      Bus&#xA;8                      Bus&#xA;9                 Crossbar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the difference between Crossbar, Bus, and dCEF switching modes?&lt;/p&gt;&#xA;" OwnerUserId="178" LastEditorUserId="49" LastEditDate="2013-05-09T02:55:51.867" LastActivityDate="2013-05-09T02:55:51.867" Title="What is the difference between all the switching modes on 6500/7600?" Tags="|switching-modes|cisco-catalyst|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="139" PostTypeId="2" ParentId="138" CreationDate="2013-05-08T16:12:44.573" Score="19" Body="&lt;p&gt;&quot;Bus&quot; is connection to 16Gbit/s bus that is common to legacy 6500 architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Crossbar and dCEF mean the connection from the LC (line card) is using switch fabric (separate SFM module for Sup2, integrated switch fabric chip on Sup720 and Sup2T).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Crossbar means the connection is from the line card that doesn't have distributed processing capabilities (no DFC on it, CFC is installed), while dCEF means there's distributed CEF mode running on line card using DFC.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-05-08T16:12:44.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="140" PostTypeId="2" ParentId="138" CreationDate="2013-05-08T16:13:40.383" Score="3" Body="&lt;p&gt;Check out this page for the info you require, plus a list of references from the Cisco site;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://null.53bits.co.uk/index.php?page=6500-7600-chassis-architecture&quot; rel=&quot;nofollow&quot;&gt;http://null.53bits.co.uk/index.php?page=6500-7600-chassis-architecture&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-08T16:13:40.383" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="142" PostTypeId="5" CreationDate="2013-05-08T16:59:36.083" Score="0" Body="&lt;p&gt;A Virtual Private Network is created by encrypting network packets and encapsulating them in a tunnel.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T22:23:18.533" LastActivityDate="2016-11-29T22:23:18.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="143" PostTypeId="4" CreationDate="2013-05-08T16:59:36.083" Score="0" Body="For questions about Virtual Private Networks (VPNs)." OwnerUserId="49" LastEditorUserId="8499" LastEditDate="2016-11-29T22:23:18.533" LastActivityDate="2016-11-29T22:23:18.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="144" PostTypeId="2" ParentId="131" CreationDate="2013-05-08T17:20:26.533" Score="4" Body="&lt;p&gt;It looks like the two technologies have different strengths; Pending someone else having a first-person answer, this is the best I could find:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.sciencedirect.com/science/article/pii/S0030402611006802&quot; rel=&quot;nofollow&quot;&gt;Performance evaluation of EDFA, RAMAN and SOA optical amplifier for WDM systems&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Abstract&lt;/strong&gt;&lt;br&gt;&#xA;  In this paper 10 Gbps WDM systems at 16, 32 and 64 channels&#xA;  have been investigated with EDFA, RAMAN and SOA amplifiers&#xA;  individually and the performance has been compared on the basis of&#xA;  transmission distance and dispersion with and without nonlinearities.&#xA;  It is demonstrated that when the dispersion is 2 ps/nm/km and the&#xA;  number of channels are less, then SOA provide better results because&#xA;  as we increases the number of channels, the gain saturation problem&#xA;  arises due to cross gain modulation, the cross phase modulation and&#xA;  four wave mixing. When dispersion is increased from 2 to 10 ps/nm/km,&#xA;  EDFA provides better results than SOA in the term of BER and output&#xA;  power, but it shows non-uniform gain spectrum. We also observed that&#xA;  RAMAN amplifier provides better results for L band amplification and&#xA;  gain flatting issue because it can substantially reduce the impact of&#xA;  fiber nonlinearity.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2013-05-08T17:30:30.650" LastActivityDate="2013-05-08T17:30:30.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="145" PostTypeId="5" CreationDate="2013-05-08T18:18:56.053" Score="0" Body="&lt;p&gt;BGP, or Border Gateway Protocol is used primarily on the Internet today in two flavors which have many similarities.  eBGP, or External BGP, is used to communicate routing information between different ASs (Autonomous Systems).  iBGP, or Internal BGP is used to communicate routing information inside a particular AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP is defined by RFCs, in particular RFC4271.&lt;/p&gt;&#xA;" OwnerUserId="178" LastEditorUserId="178" LastEditDate="2013-05-08T18:50:50.610" LastActivityDate="2013-05-08T18:50:50.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="146" PostTypeId="4" CreationDate="2013-05-08T18:18:56.053" Score="0" Body="BGP is Border Gateway Protocol, used on the internet both inside of and in between networks." OwnerUserId="178" LastEditorUserId="178" LastEditDate="2013-05-08T18:50:57.533" LastActivityDate="2013-05-08T18:50:57.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="147" PostTypeId="1" AcceptedAnswerId="148" CreationDate="2013-05-08T18:44:04.570" Score="23" ViewCount="62100" Body="&lt;p&gt;EIGRP and OSPF are both IGP protocols, the former is a mostly Cisco protocol and the latter is a well established open standard. What are the benefits of one over the other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put another way, when deploying a network, why choose one over the other? If you have mixed devices the choice would obviously be OSPF, but what if you are running a Cisco only shop? Are there any features where EIGRP excels compared to OSPF that would make it feasible to only deploy EIGRP?&lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="619" LastEditDate="2014-01-06T08:13:30.817" LastActivityDate="2014-01-06T08:13:30.817" Title="Protocols: EIGRP vs OSPF" Tags="|cisco|ospf|eigrp|" AnswerCount="3" CommentCount="5" ClosedDate="2014-01-06T11:57:26.640" ContentLicense="CC BY-SA 3.0" />
  <row Id="148" PostTypeId="2" ParentId="147" CreationDate="2013-05-08T19:01:48.880" Score="25" Body="&lt;p&gt;EIGRP is now an IETF draft so it's no longer proprietary. See &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-savage-eigrp-01&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://datatracker.ietf.org/doc/html/draft-savage-eigrp-01&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If we look at EIGRP with default settings and OSPF with default settings and there are multiple loop free paths to a destination then EIGRP will converge much faster because it keeps what are called feasible successors in it's topology database. These are basically loop free alternatives to the best path. EIGRP also has summarization at any point in the network. It also has stub feature which is useful when you don't want to use a router for transit. Commonly deployed in DMVPNS. EIGRP is also less confusing than OSPF because it does not have different network types and EIGRP is easier to deploy in hub and spoke scenarios.&lt;/p&gt;&#xA;&lt;p&gt;EIGRP uses a flat network without areas, this can both be an advantage and disadvantage.&lt;/p&gt;&#xA;&lt;p&gt;OSPF is obviously an open standard so it's the logical choice if you have multiple vendors. It can perform well but it requires that you tweak SPF timers because by default in IOS there is a 5 second wait before running the SPF algorithm. OSPF uses areas which means you can segment the network more logically. OSPF can only summarize between areas. OSPF is link state so it has a better view of the entire network than EIGRP before it runs the SPF algorithm. Network administrators will usually be more comfortable with OSPF because it's more commonly deployed.&lt;/p&gt;&#xA;&lt;p&gt;Both protocols have advantages and disadvantages. But the common answer that EIGRP should be discarded because being proprietary is not entirely true any longer.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-12-30T01:32:55.397" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="150" PostTypeId="2" ParentId="138" CreationDate="2013-05-08T19:08:03.567" Score="8" Body="&lt;p&gt;Quick rule of thumb:&#xA;dCEF &gt; Crossbar &gt; Bus&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a line card operating in bus mode, then your active supervisor will operate in bus mode as well.  This can impact the performance of your 6500/7600.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to look into the modules running in bus mode.  Many of these modules have been EoL for some time and should probably be replaced.  We recently also discovered that the Sup2T will also have issues with modules that use CEF256 which will cause them to run in bus mode (per Cisco internal document referenced when we opened a TAC case) even though they will run in crossbar mode with a Sup720.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-08T19:08:03.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="151" PostTypeId="1" CreationDate="2013-05-08T19:18:15.430" Score="16" ViewCount="5378" Body="&lt;p&gt;A Brocade router running NetIron 5.2, and a Dynamips emulation running IOS 12.4 both fail to dependably use equal cost paths in what seems to be a very simple configuration. I say &quot;dependably&quot; because I did observe very briefly the expected behavior from the Brocade, but it was after a longish period of inactivity and vanished as soon as I perturbed the system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case it is relevant, I am setting up an anycast destination for a stateless network service. This will be a site-specific configuration, with little or no network path length diversity, so the purpose of the anycast capability is mainly for fail-over redundancy and partly for load sharing. My question concerns the load sharing function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My prototype network looks like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1 &amp;lt;--N1--&amp;gt; Rcore &amp;lt;--N2--&amp;gt; R2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1&lt;/code&gt; and &lt;code&gt;R2&lt;/code&gt; advertise the anycast destination via OSPF. If &lt;code&gt;Rcore&lt;/code&gt; has identical cost to on its &lt;code&gt;N1&lt;/code&gt; and &lt;code&gt;N2&lt;/code&gt; interfaces, and the anycast destination has identical cost at each of the other routers, I would expect to find two equal cost paths in the &lt;code&gt;Rcore&lt;/code&gt; routing table. I don't, at least not always, and not even predictably. Why not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Among other, potentially relevant details are the following.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;Rcore&lt;/code&gt; is an ABR connecting &lt;code&gt;N1&lt;/code&gt; and &lt;code&gt;N2&lt;/code&gt;, which are in separate NSSA areas, to the backbone (not shown).&lt;/li&gt;&#xA;&lt;li&gt;Inspection of the &lt;code&gt;Rcore&lt;/code&gt; LSDB confirms that the expected LSAs from &lt;code&gt;R1&lt;/code&gt; and &lt;code&gt;R2&lt;/code&gt; are correctly installed, and contain the anycast destination with the correct metric.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have considered three possible explanations.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I don't understand how to configure and operate ECMP on these platforms. This is likely, and I hope to find enlightenment here that I could not find in the vendor docs.&lt;/li&gt;&#xA;&lt;li&gt;I don't understand the interaction among OSPF Areas, ECMP, anycast, etc. I don't think this is very likely, but I am prepared to learn something anyway.&lt;/li&gt;&#xA;&lt;li&gt;These two vendors implementations suffer from the same bug, or mis-feature, or something. I suppose it could happen.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt; Added example config and output for Dynamips/Dynagen implementation.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Configs&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;Router &lt;code&gt;R1&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 12.4&#xA;!&#xA;hostname R1&#xA;!&#xA;interface Loopback0&#xA; ip address 1.1.1.1 255.255.255.255&#xA; ip ospf cost 1&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.1.0.2 255.255.255.252&#xA; ip ospf cost 2&#xA;!&#xA;router ospf 1&#xA; router-id 10.1.0.2&#xA; log-adjacency-changes&#xA; area 0.0.0.1 nssa no-summary&#xA; passive-interface Loopback0&#xA; network 1.1.1.1 0.0.0.0 area 0.0.0.1&#xA; network 10.1.0.0 0.0.0.3 area 0.0.0.1&#xA;!&#xA;line console 0&#xA; exec-timeout 0 0&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Router &lt;code&gt;R2&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 12.4&#xA;!&#xA;hostname R2&#xA;!&#xA;interface Loopback0&#xA; ip address 1.1.1.1 255.255.255.255&#xA; ip ospf cost 1&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.2.0.2 255.255.255.252&#xA; ip ospf cost 2&#xA;!&#xA;router ospf 1&#xA; router-id 10.2.0.2&#xA; log-adjacency-changes&#xA; area 0.0.0.2 nssa no-summary&#xA; passive-interface Loopback0&#xA; network 1.1.1.1 0.0.0.0 area 0.0.0.2&#xA; network 10.2.0.0 0.0.0.3 area 0.0.0.2&#xA;!&#xA;line console 0&#xA; exec-timeout 0 0&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Router &lt;code&gt;Rcore&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 12.4&#xA;!&#xA;hostname Rcore&#xA;!&#xA;interface Loopback0&#xA; ip address 10.0.0.1 255.255.255.255&#xA; ip ospf cost 4&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.1.0.1 255.255.255.252&#xA; ip ospf cost 2&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 10.2.0.1 255.255.255.252&#xA; ip ospf cost 2&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; area 0.0.0.1 nssa no-summary&#xA; area 0.0.0.2 nssa no-summary&#xA; passive-interface Loopback0&#xA; network 10.0.0.1 0.0.0.0 area 0.0.0.0&#xA; network 10.1.0.0 0.0.0.3 area 0.0.0.1&#xA; network 10.2.0.0 0.0.0.3 area 0.0.0.2&#xA;!&#xA;line console 0&#xA; exec-timeout 0 0&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Output&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;Router &lt;code&gt;Rcore&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;h3&gt;Router LSA from &lt;code&gt;R1&lt;/code&gt;&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Rcore#sh ip ospf database router 10.1.0.2&#xA;&#xA;            OSPF Router with ID (10.0.0.1) (Process ID 1)&#xA;&#xA;        Router Link States (Area 0.0.0.1)&#xA;&#xA;  LS age: 1618&#xA;  Options: (No TOS-capability, DC)&#xA;  LS Type: Router Links&#xA;  Link State ID: 10.1.0.2&#xA;  Advertising Router: 10.1.0.2&#xA;  LS Seq Number: 80000002&#xA;  Checksum: 0x726F&#xA;  Length: 48&#xA;  Number of Links: 2&#xA;&#xA;    Link connected to: a Stub Network&#xA;     (Link ID) Network/subnet number: 1.1.1.1&#xA;     (Link Data) Network Mask: 255.255.255.255&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 1&#xA;&#xA;    Link connected to: a Transit Network&#xA;     (Link ID) Designated Router address: 10.1.0.2&#xA;     (Link Data) Router Interface address: 10.1.0.2&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Router LSA from &lt;code&gt;R2&lt;/code&gt;&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Rcore#sh ip ospf database router 10.2.0.2&#xA;&#xA;            OSPF Router with ID (10.0.0.1) (Process ID 1)&#xA;&#xA;        Router Link States (Area 0.0.0.2)&#xA;&#xA;  LS age: 1766&#xA;  Options: (No TOS-capability, DC)&#xA;  LS Type: Router Links&#xA;  Link State ID: 10.2.0.2&#xA;  Advertising Router: 10.2.0.2&#xA;  LS Seq Number: 80000002&#xA;  Checksum: 0x8A53&#xA;  Length: 48&#xA;  Number of Links: 2&#xA;&#xA;    Link connected to: a Stub Network&#xA;     (Link ID) Network/subnet number: 1.1.1.1&#xA;     (Link Data) Network Mask: 255.255.255.255&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 1&#xA;&#xA;    Link connected to: a Transit Network&#xA;     (Link ID) Designated Router address: 10.2.0.2&#xA;     (Link Data) Router Interface address: 10.2.0.2&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Routing table excerpt&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Rcore#sh ip route 1.1.1.1&#xA;Routing entry for 1.1.1.1/32&#xA;  Known via &quot;ospf 1&quot;, distance 110, metric 3, type intra area&#xA;  Last update from 10.1.0.2 on FastEthernet0/0, 00:30:54 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 10.1.0.2, from 10.1.0.2, 00:30:54 ago, via FastEthernet0/0&#xA;      Route metric is 3, traffic share count is 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="47" LastEditorUserId="8499" LastEditDate="2018-02-15T05:21:43.110" LastActivityDate="2018-02-15T05:21:43.110" Title="Why does this router fail to use multiple, equal-cost routes from OSPF?" Tags="|cisco|ospf|brocade|ecmp|anycast|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="152" PostTypeId="2" ParentId="147" CreationDate="2013-05-08T19:39:15.493" Score="14" Body="&lt;p&gt;You can read about the finer workings of these protocols for yourself, they are thoroughly documented on the Internet and it's a doddle to find information on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a practicle perspective I would say that in the case of EIGRP vs OSPF, OSPF always wins for the following reasons:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Convergence Speed&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everyone always mentioned that EIGRP is faster than OSPF using default settings. If you deploy either protocol without reading about them and use their default settings, then you clearly don't know what you are doing in my opinion. Why would you deploy default settings without knowing what they are, and when you do realise what they are you realise that OSPF supports BFD and becomes lightening quick (as does ISIS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Traffic Engineering&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because OSPF like ISIS is based on TLV values, it has been extended quite a lot. It has support for extensions like MPLS-TE and GMPLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Continual Expansion&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I mentioned above, OSPF and ISIS have been extended quite a lot and extension drafts are being written fairly regularly and will continue to be. EIGRP doesn't have many of the advanced options these two do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scalability&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF scales better than EIGRP with its use of areas however, I don't think this really matters either (like the convergence time aregument, due to BFD). Not many people are running 10k routes in one area in OSPF. Typically I would use an IGP for fast routing within a given part of a network, but ultimately iBGP carries all the internal routes. Every single router doesn't need every internal route in its RIB sourced via OSPF if you have hundreds or thousands or routers, some of them are so far away (topologically speaking) it's worthless knowing about them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Interoperability&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly there is the obviously reason that EIGRP is/was a Cisco proprietary technology. Although this has recently been submitted into a draft for other software vendors to start incorporating, it's too late (I believe). No currently running network is going to waste huge sums of money switching from some other IGP to EIGRP, and I don't know why a new network would consider it (if you are going to be mixing Cisco equipment with non-Cisco). Simply because non-Cisco equipment that supports OSPF has been doing so for years. The code is tried and test, many bugs fixed, oodles of information on line etc. It will take years for EIGRP to catch up (if it isn't too late already!).&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="3662" LastEditDate="2013-12-29T19:37:03.813" LastActivityDate="2013-12-29T19:37:03.813" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="153" PostTypeId="2" ParentId="151" CreationDate="2013-05-08T19:57:20.177" Score="5" Body="&lt;p&gt;I can't reproduce this in my lab, using 12.4(24).  Same topology, RCore area 0 loopback, R1 with lo0 and interface in area 1, R2 with lo0 and interface in area 2 (both NSSA), redistributed route gets picked up for ECMP on Rcore:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Routing entry for 10.20.0.0/16&#xA;  Known via &quot;ospf 1&quot;, distance 110, metric 20, type NSSA extern 2, forward metric 6477&#xA;  Last update from 2.2.2.6 on Serial1/1, 00:02:23 ago&#xA;  Routing Descriptor Blocks:&#xA;    2.2.2.6, from 2.2.2.21, 00:02:23 ago, via Serial1/1&#xA;      Route metric is 20, traffic share count is 1&#xA;  * 1.1.2.1, from 1.1.1.1, 00:06:31 ago, via Serial1/0&#xA;      Route metric is 20, traffic share count is 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Possibilities I can think of:&#xA;Depending on how the route is making it into OSPF, and what OSPF route-type is used, cost to ASBR router may/may not be factored into the route selection process (for ECMP to work, both route cost, and cost to ASBR have to match).  Seeing the metric on the actual LSA for both may help.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to reproduce this on IOS by mimic'ing your configuration -- placing the anycast on an interface, and placing the interface into an area.  If you do need ECMP, consider redistributing the route into OSPF, as that does appear to work.&lt;/p&gt;&#xA;" OwnerUserId="141" LastEditorUserId="141" LastEditDate="2013-05-14T19:39:17.040" LastActivityDate="2013-05-14T19:39:17.040" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="154" PostTypeId="2" ParentId="131" CreationDate="2013-05-08T20:03:07.360" Score="4" Body="&lt;p&gt;I think another reason someone might use one over the other is just cost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDFA is usually cheaper from what I've seen, in comparison to RAMAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From MRV website: &quot;They [RAMAN] also have a better optical signal-to-noise ratio than EDFA amplifiers.&quot; &lt;a href=&quot;http://www.mrv.com/product/MRV-FD-OARM/&quot; rel=&quot;nofollow&quot;&gt;http://www.mrv.com/product/MRV-FD-OARM/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="294" LastActivityDate="2013-05-08T20:03:07.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="155" PostTypeId="5" CreationDate="2013-05-08T20:03:11.460" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-08T20:03:11.460" LastActivityDate="2013-05-08T20:03:11.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="156" PostTypeId="4" CreationDate="2013-05-08T20:03:11.460" Score="0" Body="Simple Network Management Protocol (SNMP) is used for managing devices on IP networks. It is most often used to query statistics for network equipment." OwnerUserId="178" LastEditorUserId="49" LastEditDate="2013-05-09T16:22:59.263" LastActivityDate="2013-05-09T16:22:59.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="157" PostTypeId="1" AcceptedAnswerId="488" CreationDate="2013-05-08T21:03:09.040" Score="8" ViewCount="695" Body="&lt;p&gt;I'm pricing out a decent size 10gb network (6-8 ToR switchs) and the uplink costs are a major factor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I figure each ToR switch needs 4x40gb uplinks and you have a cost for the uplink optics that is approximately the cost of the ToR switch itself, not to mention the server cabling. That is with 1st part optics (Juniper in my case).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anybody have any practical experience with either: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Cheaper 3rd party 40gb optics, or &lt;/li&gt;&#xA;&lt;li&gt;Using the copper ones? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm interested in experience with 3rd party optics. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is the longevity and quality? How much pushback do you get from your switch vendors? Anything to look for or avoid?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We use copper sfp+ cables wherever practical to save costs, I presume the qsfp+ ones would be similar. Anything else I'd need to be aware of?&lt;/p&gt;&#xA;" OwnerUserId="299" LastEditorUserId="453" LastEditDate="2013-05-16T15:56:10.723" LastActivityDate="2013-05-16T17:22:50.020" Title="cheaper 40gb optics/uplinks?" Tags="|optics|uplinks|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="158" PostTypeId="2" ParentId="76" CreationDate="2013-05-08T21:05:10.317" Score="6" Body="&lt;p&gt;To offer a different approach to the others given already, which may or may not be better than the existing ideas, but primarily to through some extra ideas out there;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say two easy steps you can take to improve on your current situation are as follows;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 1&lt;/strong&gt;;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get full BGP tables from both providers - Now, you will have more optimal outbound routing because you will be routing via the transit provider with the smallest AS path to your destination. As you said, you can remove HSRP and simple advertise a default route in OSPF and run iBGP between your two edge routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 2&lt;/strong&gt;;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set up AS prepends and communities etc on your two edge routers to control outbound traffic granularly as you require. So ISP B may have a better route to some subnet but you may buy more transit from ISP A and rather it when via them, and so on.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Assuming the two /24's you mentioned as having are PI independent address space so you are announcing them via both providers, or both providers have agree to announce the same IP address space for you, you can now announce both prefixes to both ISPs from both routers without prepends or communities and get better inbound routing as well (of course, unless you have some CDRs you need to adhear to or similar, in which case you can tune as required).&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-08T21:05:10.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="159" PostTypeId="2" ParentId="76" CreationDate="2013-05-08T21:10:31.617" Score="1" Body="&lt;p&gt;If the full BGP table is too much for you I think you could consider just receiving a portion. Perhaps provider A and B each advertise a default route and their local AS routes. You would need to run iBGP internally. That way you would have the shortest route for anything directly connected to the providers and would take either for downstream AS routes.&lt;/p&gt;&#xA;" OwnerUserId="299" LastActivityDate="2013-05-08T21:10:31.617" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="160" PostTypeId="2" ParentId="157" CreationDate="2013-05-08T21:14:49.770" Score="10" Body="&lt;p&gt;If the distances are short enough I would look at the twinax receivers, at the end of the day this is what they were designed for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if 40gbit and the larger 100gbit have been around long enough yet for their to be a 'grey' market of QSFP/CFP's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful with copper (non-twinax) though if you are running anything like FCoE over the links as the BER is usually too high for the lossless network required by FCoE.&lt;/p&gt;&#xA;" OwnerUserId="240" LastEditorUserId="240" LastEditDate="2013-05-08T21:21:01.857" LastActivityDate="2013-05-08T21:21:01.857" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="164" PostTypeId="2" ParentId="151" CreationDate="2013-05-08T22:12:55.440" Score="7" Body="&lt;p&gt;My first thought would be that OSPF is thinking it's the same LSA instead of simply the same prefix. I don't know much about brocade, but with the LSA outputs from the Cisco box I could probably tell you more. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, for Cisco, if the routes are equal in the protocol they will both be presented to the routing table. The routing table, will, by default, install both paths and do ECMP. If the metrics or protocols differ, they will not ECMP. This would also apply to different LSAs for the same prefix.&lt;/p&gt;&#xA;" OwnerUserId="123" LastActivityDate="2013-05-08T22:12:55.440" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="165" PostTypeId="2" ParentId="151" CreationDate="2013-05-08T22:32:27.723" Score="3" Body="&lt;p&gt;Depending on what Brocade hardware you're using (MLX? CER? XMR?), you might want to update the software.  There were several bugs fixed through the 5.3 (and 5.4 depending on your hardware) software trees who's symptoms were related to OSPF route costs not being updated properly.  I don't know all the criteria for seeing the bugs, but a couple of them were:  If the cost was changed on a 1gig port or a loopback interface on a router running OSPF, the change was not processed and the cost was not updated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize you're seeing this on two manufacturers' platforms, so this is more likely to be a configuration issue.  I also realize that the old tech-support-punt &quot;update your software&quot; can often be worth nothing more than an eye roll.  That said, it might be something to keep in mind.&lt;/p&gt;&#xA;" OwnerUserId="51" LastActivityDate="2013-05-08T22:32:27.723" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="166" PostTypeId="1" AcceptedAnswerId="168" CreationDate="2013-05-08T22:54:33.590" Score="13" ViewCount="2791" Body="&lt;p&gt;A site I support uses 3 T1s setup with multilink PPP.  They are trying to use &lt;a href=&quot;http://www.getjive.com/&quot;&gt;Jive&lt;/a&gt; which is a hosted VoIP provider, with horrible results.  &lt;strong&gt;I want to know how packets are distributed between the individual T1s since I think this may help explain what is going on.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SNMP monitoring of the multilink interface shows that they have available capacity, but their VoIP test calls are horrible.  It acts as if there is a huge amount of jitter and dropped packets.  Though simple tests with PING/Iperf to not show jitter/latency that is as bad as you might expect given the call quality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How are packets distributed between the multiple T1s.  I assume that it isn't the same as Ethernet bonding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the multi-link PPP is an issue what can I look at on the routers that will show this? Can it be corrected?  The routers are Cisco, I believe they are 2800s, but I would have to double check.&lt;/p&gt;&#xA;" OwnerUserId="302" LastEditorUserId="267" LastEditDate="2013-05-08T23:51:11.783" LastActivityDate="2013-05-21T04:54:03.063" Title="How is the payload distributed across Multilink PPP connections" Tags="|ppp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="167" PostTypeId="1" CreationDate="2013-05-08T23:19:58.903" Score="13" ViewCount="22955" Body="&lt;p&gt;Good afternoon,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got a shiny new 4500E running 15.0(1r)SG7 that is set to replace an ailing 3750E.&#xA;It is running ipbase for now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the 3750 I was able to check out the incoming DSCP/CoS values on interfaces using the &lt;code&gt;sh mls qos int gigX/X/X statistics&lt;/code&gt;.&#xA;I can't seem to find any releveant commands to show the same info on this platform.&#xA;Looking at the config documents here: &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1/XE_330SG/configuration/guide/qos_mrg.html&quot;&gt;Configuring Quality of Service&lt;/a&gt; there seems to be much less visibility into the individual interface markings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would think it should have been displayed with a &lt;code&gt;sh qos int tenX/X/X&lt;/code&gt; but all that gives me is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SR-CORE-C4500X-32#sh qos int ten1/1/31&#xA;Operational Port Trust State: Trusted&#xA;Trust device: none&#xA;Default DSCP: 0 Default CoS: 0&#xA;Appliance trust: none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="164" LastEditorUserId="178" LastEditDate="2013-05-09T17:54:43.413" LastActivityDate="2013-05-10T06:55:53.000" Title="How can I verify QoS DSCP marking on a Cisco Catalyst 4500E?" Tags="|qos|cisco-catalyst|cisco-ios-15|cisco-4500|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="168" PostTypeId="2" ParentId="166" CreationDate="2013-05-08T23:45:59.680" Score="11" Body="&lt;p&gt;Oi...lemme dredge up those long-unused neurons to remember how Multilink PPP works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the LCP phase when the first link is brought up during a non-multilink PPP session, the two sides negotiate the MRU (Maximum Receive Unit) for each direction of the link...basically each side tells the other how big of a packet it can handle being sent to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With Multilink PPP, they negotiate that, but they also negotiate, when the first link is brought up, an MRRU, or Maximum Reconstructed Receive Unit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because Multilink PPP added extra frame header space, the creators were concerned about Path MTU problems, so they decided that Multilink would be able to fragment and reassemble packets on either end of the Multilink PPP session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, yes, unlike Ethernet bonding, its not just a matter of balancing frames across the multiple links...the frames can actually be fragmented and reassembled.  This can cause a jump in latency and jitter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On T-1's you should be able to configure each side with a significantly larger MRU and MRRU than any packets that would likely need to cross the link, and if the MRU is as large as, or larger than the MRRU, then you shouldn't see any fragmentation and reassembly occuring.  Hopefully this will get the latency and jitter under control and help out your VoIP behavior.  You will likely need to adjust this configuration on both sides of the links, though, as each direction is negotiated independently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, I wouldn't expect VoIP packets to need to be fragmented, though...they tend to not be big enough to need that.  Worth a shot to check your MRU and MRRU sizes on the links and the Multilink session, maybe they're way out of whack and causing problems.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-05-08T23:45:59.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="169" PostTypeId="2" ParentId="91" CreationDate="2013-05-09T01:16:34.990" Score="9" Body="&lt;p&gt;Flapping events don't require ingress traffic alternating between ports -- a simple change from ingress of a MAC address on port A to port B on a switch quickly enough will cause a flapping event to be logged; for instance, a live migration of a virtual machine from one host to another will often cause a MAC flapping notification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the other answers have covered, it's nothing to be worried about whatsoever until the events are &lt;strong&gt;&lt;em&gt;much&lt;/em&gt;&lt;/strong&gt; more frequent than what you're seeing.  Your concerns about spanning tree re-convergence and flushing of MAC tables are unfounded; it's not a topology change for spanning tree and the table is just getting updated for the MAC address that flapped - other entries on the same switch, same vlan, or same port are unaffected.&lt;/p&gt;&#xA;" OwnerUserId="221" LastActivityDate="2013-05-09T01:16:34.990" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="170" PostTypeId="1" AcceptedAnswerId="173" CreationDate="2013-05-09T01:22:55.420" Score="11" ViewCount="3566" Body="&lt;p&gt;I understand that only the best path is advertised to eBGP neighbors, but is this true of iBGP? If I peer with two providers, I was under the impression that anyone else peering with both of my providers would have two paths to me. After inspecting a number of looking glasses, it appears this isn't so.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-17T09:18:01.073" Title="Only One Path in the Looking Glass" Tags="|bgp|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="172" PostTypeId="2" ParentId="167" CreationDate="2013-05-09T01:32:58.417" Score="13" Body="&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show platform hardware interface ten1/1/31 statistics&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That should show you input bytes by CoS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 4500 is a very different beast than the 3560/3750 for qos config and monitoring.  Some other useful verification commands are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show platform hardware qos interface foo X/Y&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;shows queue lengths and flow counts&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show interface foo X/Y counter detail&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;shows interface egress packets by queue, queue drops and DBL drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show policy-map interface foo X/Y&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mostly useful if you are doing custom policy maps &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show interface foo X/Y capabilities&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know what the number and type of queues are available on a particular interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show qos maps&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To show the DSCP-CoS mappings&lt;/p&gt;&#xA;" OwnerUserId="241" LastEditorUserId="241" LastEditDate="2013-05-10T06:06:50.963" LastActivityDate="2013-05-10T06:06:50.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="173" PostTypeId="2" ParentId="170" CreationDate="2013-05-09T01:35:50.823" Score="12" Body="&lt;p&gt;BGP always only advertises the best path onward to its peers.  This is true for eBGP, iBGP, route reflection (which is merely a special case of iBGP), and any other way you might use BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, yes, you are correct, if you are sending advertisements to providers A and B, and I have connections and BGP sessions also with providers A and B, then I should see both paths in my BGP tables.  I may not see multiple routes created in my routing tables...that's a question of the configuration of my devices and whether I allow multiple routes of equal AS Path lengths to be inserted into the routing table...typically BGP will only install a single route.  The BGP tables, though, should show advertisements from both providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually...even if I'm peering with providers B and C, or even C and D, I should still see multiple paths in my BGP tables as long as you are reachable through B, C, and D.  All other things being equal, my devices should pick B because that should be the shortest AS PATH, but I would still see the paths with the longer AS PATHs from C and D.  Now, perhaps C and D have both decided that the path through A is better than the path through B, then the paths that I would see would have AS PATHs of &quot;A C&quot; and &quot;A D&quot;, so it would appear as if you weren't connected to B at all, but if the path through A went away, then the path through B would get propagated onward through C and D.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can give some specifics...maybe even your blocks that you're advertising if you're willing to share that....others can take a look at what we're seeing and perhaps give some more specific guidance.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-05-09T01:35:50.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="174" PostTypeId="2" ParentId="170" CreationDate="2013-05-09T01:44:37.883" Score="-1" Body="&lt;p&gt;The answer is not a simple &quot;yes&quot; or &quot;no&quot;, but I think essentially your observation is indeed true that &quot;this isn't so.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more detail, see &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094431.shtml#bestpath&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the sake of curation, SE prefers against answers that are purely links to other pages, however, so I'll reproduce some of that here in case the source someday disappears or changes.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;How the Best Path Algorithm Works&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;BGP assigns the first valid path as the current best path. BGP then&#xA;  compares the best path with the next path in the list, until BGP&#xA;  reaches the end of the list of valid paths. This list provides the&#xA;  rules that are used to determine the best path:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;1) Prefer the path with the highest WEIGHT.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note:  WEIGHT is a Cisco-specific parameter. It is local to the router&#xA;  on which it is configured.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2) Prefer the path with the highest LOCAL_PREF.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: A path without LOCAL_PREF is considered to have had the value&#xA;  set with the bgp default local-preference command, or to have a value&#xA;  of 100 by default.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3) Prefer the path that was locally originated via a network or&#xA;  aggregate BGP subcommand or through redistribution from an IGP.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Local paths that are sourced by the network or redistribute commands&#xA;  are preferred over local aggregates that are sourced by the&#xA;  aggregate-address command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;4) Prefer the path with the shortest AS_PATH.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: Be aware of these items:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This step is skipped if you have configured the bgp bestpath as-path&#xA;  ignore command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;An AS_SET counts as 1, no matter how many ASs are in the set.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The AS_CONFED_SEQUENCE and AS_CONFED_SET are not included in the&#xA;  AS_PATH length.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;5) Prefer the path with the lowest origin type.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: IGP is lower than Exterior Gateway Protocol (EGP), and EGP is&#xA;  lower than INCOMPLETE.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;6) Prefer the path with the lowest multi-exit discriminator (MED).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: Be aware of these items:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This comparison only occurs if the first (the neighboring) AS is the&#xA;  same in the two paths. Any confederation sub-ASs are ignored.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In other words, MEDs are compared only if the first AS in the&#xA;  AS_SEQUENCE is the same for multiple paths. Any preceding&#xA;  AS_CONFED_SEQUENCE is ignored.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If bgp always-compare-med is enabled, MEDs are compared for all paths.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You must disable this option over the entire AS. Otherwise, routing&#xA;  loops can occur.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If bgp bestpath med-confed is enabled, MEDs are compared for all paths&#xA;  that consist only of AS_CONFED_SEQUENCE.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;These paths originated within the local confederation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;THE MED of paths that are received from a neighbor with a MED of&#xA;  4,294,967,295 is changed before insertion into the BGP table. The MED&#xA;  changes to to 4,294,967,294.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Paths received with no MED are assigned a MED of 0, unless you have&#xA;  enabled bgp bestpath med missing-as-worst .&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If you have enabled bgp bestpath med missing-as-worst , the paths are&#xA;  assigned a MED of 4,294,967,294.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The bgp deterministic-med command can also influence this step.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Refer to How BGP Routers Use the Multi-Exit Discriminator for Best&#xA;  Path Selection for a demonstration.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;7) Prefer eBGP over iBGP paths.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If bestpath is selected, go to Step 9 (multipath).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: Paths that contain AS_CONFED_SEQUENCE and AS_CONFED_SET are&#xA;  local to the confederation. Therefore, these paths are treated as&#xA;  internal paths. There is no distinction between Confederation External&#xA;  and Confederation Internal.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;8) Prefer the path with the lowest IGP metric to the BGP next hop.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Continue, even if bestpath is already selected.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;9) Determine if multiple paths require installation in the routing&#xA;  table for BGP Multipath.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Continue, if bestpath is not yet selected.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;10) When both paths are external, prefer the path that was received&#xA;  first (the oldest one).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This step minimizes route-flap because a newer path does not displace&#xA;  an older one, even if the newer path would be the preferred route&#xA;  based on the next decision criteria (Steps 11, 12, and 13).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Skip this step if any of these items is true:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You have enabled the bgp best path compare-routerid command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: Cisco IOS Software Releases 12.0.11S, 12.0.11SC, 12.0.11S3,&#xA;  12.1.3, 12.1.3AA, 12.1.3.T, and 12.1.3.E introduced this command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The router ID is the same for multiple paths because the routes were&#xA;  received from the same router.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;There is no current best path.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The current best path can be lost when, for example, the neighbor that&#xA;  offers the path goes down.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;11) Prefer the route that comes from the BGP router with the lowest&#xA;  router ID.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The router ID is the highest IP address on the router, with preference&#xA;  given to loopback addresses. Also, you can use the bgp router-id&#xA;  command to manually set the router ID.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: If a path contains route reflector (RR) attributes, the&#xA;  originator ID is substituted for the router ID in the path selection&#xA;  process.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;12) If the originator or router ID is the same for multiple paths,&#xA;  prefer the path with the minimum cluster list length.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This is only present in BGP RR environments. It allows clients to peer&#xA;  with RRs or clients in other clusters. In this scenario, the client&#xA;  must be aware of the RR-specific BGP attribute.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;13) Prefer the path that comes from the lowest neighbor address.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This address is the IP address that is used in the BGP neighbor&#xA;  configuration. The address corresponds to the remote peer that is used&#xA;  in the TCP connection with the local router.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That said, however, I could be wrong. I'm rather a novice in this field.&lt;/p&gt;&#xA;" OwnerUserId="270" LastEditorUserId="270" LastEditDate="2013-05-09T03:58:59.823" LastActivityDate="2013-05-09T03:58:59.823" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="175" PostTypeId="2" ParentId="123" CreationDate="2013-05-09T02:07:34.860" Score="8" Body="&lt;p&gt;All of my experience so far has been with Cisco products so that is all I can really speak to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The WCS controlled APs (lightweight and normal) have the ability to detect and report when non-trusted SSIDs pop up and how many clients are connected to it.&#xA;If you have heatmaps set up and a decent number of access points  you stand a pretty good chance of being able to figure out where the access point is in proximity to your APs.  The only down side to this is that if you are in close proximity to any bars/coffee shops/college dorms/neighborhoods expect to see pages worth of &quot;rogue&quot; SSIDs that change as frequently as people move.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The WCS also has the ability to do some switchport tracing and alert you if rogues are plugged into your network. I have yet to have much luck getting this to work.  I honestly haven't had a whole lot of time to play with it.  By default, at least on my network, there seem to be quite a few false-positives with the way the trace works.  Without looking for sure, I believe it only looks at OUI of the MAC and if it matches then you get an alert about a rogue on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, the WCS also has the ability to contain rouge APs/SSIDs.  It does with by using deauth and disassociate messages to any clients that are connected to that AP.&lt;/p&gt;&#xA;" OwnerUserId="164" LastActivityDate="2013-05-09T02:07:34.860" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="176" PostTypeId="5" CreationDate="2013-05-09T02:51:00.717" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-09T02:51:00.717" LastActivityDate="2013-05-09T02:51:00.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="177" PostTypeId="4" CreationDate="2013-05-09T02:51:00.717" Score="0" Body="Major release 15 of Cisco's IOS software" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2013-05-09T13:59:16.337" LastActivityDate="2013-05-09T13:59:16.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="178" PostTypeId="2" ParentId="170" CreationDate="2013-05-09T03:31:45.563" Score="0" Body="&lt;p&gt;Trying to look for your own routes in looking glasses does not always work the way you expect, particularly if you buy from someone who purchases a lot of transit. For example, Internap buys transit from many other large ISPs. If you buy from Internap and then someone else, there is a good chance that your route on the other provider would be hidden by virtue of not being best. Most ISPs prefer their own customer routes. Seeing or not seeing your own routes in a looking glass has very little to do with if your route is propagating correctly or not.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2013-05-09T03:31:45.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="179" PostTypeId="2" ParentId="79" CreationDate="2013-05-09T03:59:44.070" Score="1" Body="&lt;p&gt;Yes you're right. Looks like you'll have to deal with having separate IPs unless aggregating via a VPN concentrator. TBH the concentrator is probably the best bet, you'll just need 1 extra IP for all VPN connections, but its outside interface will need to reside in a different subnet/VLAN from the public IP hosts. I would go with that otherwise you're configuring IPSEC VPN directly on each individual server, what a nightmare&lt;/p&gt;&#xA;" OwnerUserId="203" LastActivityDate="2013-05-09T03:59:44.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="180" PostTypeId="2" ParentId="135" CreationDate="2013-05-09T04:24:39.160" Score="15" Body="&lt;p&gt;&lt;a href=&quot;http://packetlife.net/blog/2012/jan/16/catalyst-2960s-iscsi-optimization/&quot;&gt;http://packetlife.net/blog/2012/jan/16/catalyst-2960s-iscsi-optimization/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I followed Jeremy Stretch's post here a while back, moving our iSCSI SAN off a production switch onto a dedicated 3750G (stack of 2).  While I can't speak specifically to the 2960S, the tweaks offered in that post seem to be doing well on the 3750G's.  I've got a handful of OutDiscards (less than 100) but for 38 weeks of uptime, that seems pretty good for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is running 4 ESXi hosts connected to 4 JetStor 1Gbps SANs and all links are aggregated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll happily forward a &quot;sh int counters&quot; if you are interested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Ha! Just noticed it was Jeremy who asked this...sorry for linking your own blog post!)&lt;/p&gt;&#xA;" OwnerUserId="309" LastEditorUserId="309" LastEditDate="2013-05-09T14:42:20.680" LastActivityDate="2013-05-09T14:42:20.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="181" PostTypeId="1" AcceptedAnswerId="214" CreationDate="2013-05-09T04:29:35.990" Score="6" ViewCount="6218" Body="&lt;p&gt;Do Procurve switches remark cos/dscp values between switches (trust boundaries) as Cisco switches do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering if there is an equivalent to &quot;mls qos trust (cos/dscp)&quot; in the HP realm.&lt;/p&gt;&#xA;" OwnerUserId="309" LastEditorUserId="49" LastEditDate="2013-05-09T12:22:02.137" LastActivityDate="2013-05-13T20:57:43.667" Title="QoS on HP Procurve 2520 and 3800 switches" Tags="|qos|cos|hp|dscp|hp-procurve|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="182" PostTypeId="1" AcceptedAnswerId="188" CreationDate="2013-05-09T05:45:21.210" Score="9" ViewCount="237" Body="&lt;p&gt;We are currently looking at connecting two Asterisk servers across a Metro Ethernet.  This leads to a couple of questions I haven't been able to find answers to elsewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first involves bit error rates and cabling.  I would expect that TDMoE, by virtue of being timing sensitive would also be very sensitive to bit error rates (i.e. I don't see how missing data could be retransmitted).  Is this a correct assumption?  Data seems pretty sparse.  Should I be basing cabling considerations around BER for the links between the two servers?  Should I be asking BER-related questions to the Metro Ethernet provider?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is the protocol capable of handling reasonable loss?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have a lot of experience with TDMoE but thinking through this, my concern is that lost ethernet frames would lead to lost PRI frames which might lead to dropped calls and PRI's going into alarm states.&lt;/p&gt;&#xA;" OwnerUserId="174" LastEditorUserId="49" LastEditDate="2013-05-09T14:59:34.850" LastActivityDate="2013-05-09T14:59:34.850" Title="How sensitive is TDMoE to BER?" Tags="|ethernet|tdmoe|ber|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="183" PostTypeId="1" AcceptedAnswerId="184" CreationDate="2013-05-09T06:00:01.193" Score="8" ViewCount="145" Body="&lt;p&gt;As mentioned in the previous question I am looking at sending voice communications over a Metro Ethernet connection shared also by data connections.  In addition to the previous question I have this one involving QoS guarantees and TDMoE.  Voice communications are expected to use a little over 25-30% of MAN link capacity (basically running a PRI over TDMoE, which is 15% plus significant encapsulation overhead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current plan is just to ensure that the TDMoE is properly classed re: CoS and use QoS management on the switches to ensure that it is transmitted first.  This seems simple, straight-forward, and hopefully ensures reliable voice transmission rates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this good enough?  Is there anything QoS-wise that I am missing that I need to be doing?  &lt;/p&gt;&#xA;" OwnerUserId="174" LastEditorUserId="174" LastEditDate="2013-05-09T08:23:39.273" LastActivityDate="2013-05-21T05:40:49.553" Title="TDMoE and QoS considerations" Tags="|qos|cos|ethernet|tdmoe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="184" PostTypeId="2" ParentId="183" CreationDate="2013-05-09T06:28:28.107" Score="7" Body="&lt;p&gt;Can you provide some more information on the equipment used and how much bandwidth you have?&#xA;Will your voice equipment mark packets itself or do you need to take care of it? Usually CoS 5 and/or DSCP EF is used to carry voice payload. Voice should be sent in some form of LLQ (Low Latency Queue).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you give us some more specifics we could help with providing a policy for you.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-09T06:28:28.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="185" PostTypeId="1" AcceptedAnswerId="251" CreationDate="2013-05-09T06:57:52.040" Score="14" ViewCount="728" Body="&lt;p&gt;For example preventing it from sending arp, stp, etc and to reveal as little as possible about the rest of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example use case would be connecting to a peering exchange.&lt;/p&gt;&#xA;" OwnerUserId="103" LastEditorUserId="69" LastEditDate="2013-05-10T07:44:21.813" LastActivityDate="2013-05-21T18:01:25.147" Title="In a multi-tenant environment what should be done to make your switchports silent on Cisco and Juniper switches?" Tags="|cisco|juniper|switch|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="186" PostTypeId="1" AcceptedAnswerId="207" CreationDate="2013-05-09T07:12:26.743" Score="5" ViewCount="1876" Body="&lt;p&gt;I'd like to see a worked example of recreating a regular common VLAN based topology using MPLS on Juniper hardware. In particular we will be using EX3xxx and EX4xxx for swicthing, though I don't think that's relevant. The router in question could be a Juniper MX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume you have an existing network topology as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;               +--------------------+     Trunk     +---------+&#xA;               |      Switch 5      +---------------+ Router1 |&#xA;               |                    |               +---------+&#xA;               +--+-----------------+               &#xA;                  |&#xA;                  |Trunk&#xA;                  |&#xA;               +--+-----------------+     VLAN2     +---------+&#xA;               |      Switch 1      +---------------+  Host5  |&#xA;               |                    |               +---------+&#xA;               +--+--------------+--+              &#xA;                  |              |                &#xA;                  |Trunk         |Trunk             &#xA;                  |              |                  &#xA; +----------------+---+      +---+----------------+&#xA; |      Switch 2      |      |      Switch 3      |&#xA; |                    |      |                    |&#xA; +---+------------+---+      +---+------------+---+&#xA;     |            |              |            |&#xA;     |VLAN2       |VLAN2         |VLAN3       |VLAN4&#xA;     |            |              |            |&#xA;+----+----+  +----+----+    +----+----+  +----+----+&#xA;|  Host1  |  |  Host2  |    |  Host3  |  |  Host4  |&#xA;+---------+  +---------+    +---------+  +---------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All Trunk links allow all VLANs, and the router has sub interfaces in each VLAN.&lt;/p&gt;&#xA;" OwnerUserId="103" LastActivityDate="2013-08-06T11:32:17.583" Title="Migrating from VLANs to MPLS on JunOS" Tags="|mpls|juniper-ex|juniper-junos|vlan|" AnswerCount="2" CommentCount="3" ClosedDate="2013-08-09T16:49:50.780" ContentLicense="CC BY-SA 3.0" />
  <row Id="187" PostTypeId="2" ParentId="185" CreationDate="2013-05-09T07:15:48.927" Score="5" Body="&lt;p&gt;You can search cisco-nsp@ for different propositions as to what to enable/disable on the ports. For example start here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.gossamer-threads.com/lists/nanog/users/124659?do=post_view_threaded&quot; rel=&quot;noreferrer&quot;&gt;http://www.gossamer-threads.com/lists/nanog/users/124659?do=post_view_threaded&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your particular Cisco switch - Catalyst or Nexus, you may also search cisco.com for specific design practices. For example, for Catalyst 6500:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00801b49a4.shtml&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00801b49a4.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-05-09T07:15:48.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="188" PostTypeId="2" ParentId="182" CreationDate="2013-05-09T07:25:38.900" Score="9" Body="&lt;p&gt;Take a look at &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4553&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc4553&lt;/a&gt;, generally speaking while the transport should provide error information, you'll loose information, there's no way to retransmit something that was sent. The transport itself (CEoIP in Cisco speak, or more generally - L2VPN with TDM transport over it) will be fine as long signalization will work between end nodes, your application however, running it's data over the TDM may encounter errors.&lt;/p&gt;&#xA;&lt;p&gt;That's why it's critical for the nodes to be able to properly time the transport. If you'll be providing the transport yourself this is also different discussion that if you're asking for transport - for typical ME service, you'll get typical Ethernet BER assurance.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-05-09T07:25:38.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="189" PostTypeId="2" ParentId="170" CreationDate="2013-05-09T07:28:08.110" Score="0" Body="&lt;p&gt;Your question touches not BGP itself, but ISP policies. Not always - either by policy or by mistake - your providers will announce your space to upstreams. Are you using PI or PA by the way?&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-05-09T07:28:08.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="190" PostTypeId="1" AcceptedAnswerId="193" CreationDate="2013-05-09T07:29:24.927" Score="8" ViewCount="709" Body="&lt;p&gt;I was recently advised I should not be using VLAN interfaces for connections to upstream peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a Juniper MX what, if any, are the cons of using VLANs on an aggregated interface rather than dedicated physical interfaces?&lt;/p&gt;&#xA;" OwnerUserId="103" LastActivityDate="2013-05-09T11:49:24.333" Title="Sub-interfaces vs. Interfaces" Tags="|juniper-mx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="191" PostTypeId="1" AcceptedAnswerId="201" CreationDate="2013-05-09T07:41:51.940" Score="6" ViewCount="641" Body="&lt;p&gt;When your core network is MPLS based, how do you connect virtual servers behind vSwitches in to this? For example VMWare vDS or Cisco Nexus 1000v.&lt;/p&gt;&#xA;" OwnerUserId="103" LastActivityDate="2013-05-09T13:15:45.780" Title="Extending MPLS in to vSwitches" Tags="|mpls|cisco-nexus-1000v|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="192" PostTypeId="2" ParentId="185" CreationDate="2013-05-09T07:56:10.593" Score="8" Body="&lt;p&gt;This is where switches such as the Metro-E series from Cisco come in, by default all the downstream ports run in UNI mode which means that they dont send out CDP, STP or any frames at all from other UNI ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing you could look at is private VLAN's and then disabling things like CDP.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-09T07:56:10.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="193" PostTypeId="2" ParentId="190" CreationDate="2013-05-09T11:49:24.333" Score="12" Body="&lt;p&gt;If you mean using a switch to break out your 10g router port into individual VLANs and then using subinterfaces to route each port individually, I don't see how that is really wrong. Yes you'll lose the immediate failover when the physical port goes down, but as they say that's the &quot;cost of doing business&quot;. Router ports are expensive compared to switch ports so I assume that is a business decision.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2013-05-09T11:49:24.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="195" PostTypeId="1" AcceptedAnswerId="262" CreationDate="2013-05-09T12:25:10.817" Score="13" ViewCount="3781" Body="&lt;p&gt;In a lot of locations, we have only one Cisco ASA 5505 each and one or more WiFi APs, besides the provider router. No servers or PCs, just WiFi service for occasional visitors. I want to remotely check if the provider gives us the contracted bandwidth. I could see used bandwidth on the ASA monitoring, and test one direction by sending traffic to the ASA using Iperf on my side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to let the ASA generate substantial traffic?&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="231" LastEditDate="2013-05-09T15:12:41.473" LastActivityDate="2013-05-25T16:25:45.773" Title="How can I generate traffic on a Cisco ASA?" Tags="|cisco-asa|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="198" PostTypeId="2" ParentId="195" CreationDate="2013-05-09T12:42:24.740" Score="7" Body="&lt;p&gt;The first thing that comes to mind would be uploading the ASA and ASDM images.&lt;/p&gt;&#xA;" OwnerUserId="135" LastActivityDate="2013-05-09T12:42:24.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="199" PostTypeId="1" AcceptedAnswerId="217" CreationDate="2013-05-09T12:43:00.430" Score="16" ViewCount="86198" Body="&lt;p&gt;I have an HP c7000 blade chassis which contains Cisco 3120X and Cisco 3120G switches running ios 12.2(58)SE1.  The blades themselves are very lightly loaded yet many interfaces on different blade switches in the chassis show a fairly high number of output drops.  If I check the number of output drops repeatedly I not only see the counter increasing but sometimes it decreases.  The numbers don't correlate with the packets/s recorded on the interface.  QoS settings are default for the platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following samples were all taken within a 30 second period:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 2255550&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 2255550&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 2255550&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 2255550&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 2255550&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 2255550&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 451110&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 451110&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 902220&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 1353330&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 1804440&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 1804440&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 1804440&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output drops&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 451490&#xA;&#xA;bc1019-3120-stack&gt;sh int gi2/0/7 | i output rate&#xA;  5 minute output rate 301000 bits/sec, 119 packets/sec&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;p&gt;&#xA;1) Is there anything else that can cause output drops besides the server nic not receiving the frames quickly enough?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) What is the maximum number of output drops the interface counter can record?  Does it rollover when it reaches the max?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) What would be considered a healthy rate of output drops?&lt;/p&gt;&#xA;" OwnerUserId="86" LastEditorUserId="49" LastEditDate="2013-05-09T14:47:15.957" LastActivityDate="2014-02-13T22:37:47.703" Title="What causes total output drops on a cisco switch interface?" Tags="|cisco|cisco-catalyst|switch|cisco-ios-12|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="200" PostTypeId="2" ParentId="195" CreationDate="2013-05-09T12:46:23.630" Score="8" Body="&lt;p&gt;Downstream you might be able to download something to null: on the ASA but upstream you would be limited of how much the flash disk can transfer which is usually not that much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your best bet would be to connect a PC and run the tests but that requires someone to be on site of course.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-09T12:46:23.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="201" PostTypeId="2" ParentId="191" CreationDate="2013-05-09T12:48:14.403" Score="8" Body="&lt;p&gt;At this moment you cannot terminate MPLS VPNs on vSwith/Nexus1000V, so the best options are vlans. Somewhere on PE you must have interfaces in separated VRFs. VRFs will be mapped to VLANs on PE. Use trunks to connect to N1k.&#xA;With VPLS idea is the same, but you can move virtual machines between PEs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is one great article about implementation of MPLS VPN in enterprise (practice) done by Himawan Narugho (without vSwithes, but the idea is the same). &lt;a href=&quot;http://www.himawan.nu/2006/06/enterprise-mpls-vpn-howto.html&quot;&gt;http://www.himawan.nu/2006/06/enterprise-mpls-vpn-howto.html&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerDisplayName="user17" LastActivityDate="2013-05-09T12:48:14.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="202" PostTypeId="1" AcceptedAnswerId="206" CreationDate="2013-05-09T13:02:41.317" Score="10" ViewCount="1216" Body="&lt;p&gt;We have two geographically separate data centers.  We are preparing to implement a new WAN connection (dark cloud) that would be used only for backup traffic.  The servers will have two NIC cards (production &amp;amp; backup) but what is the best way to ensure that the production and backup traffic doesn't mix?  At the moment we are just using static routes to get to the WAN, but looking to implement BGP between our SP and ourselves.  Internal RP is a mix of EIGRP and OSPF.  Cores are Cisco 6500s and WAN routers will soon be upgraded to ASRs.&lt;/p&gt;&#xA;&lt;p&gt;Suggestions on solutions? Policy-based routing (PBR)? VRFs?&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y8KFV.jpg&quot; alt=&quot;Network Diagram&quot; /&gt;&lt;/p&gt;&#xA;" OwnerUserId="266" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-05-16T02:56:28.057" Title="Routing with seperate WAN link for backups" Tags="|cisco|routing|backups|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="203" PostTypeId="2" ParentId="54" CreationDate="2013-05-09T13:06:15.230" Score="7" Body="&lt;p&gt;Just to add two commonly-overlooked bits to the BGP discussion:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you run iBGP, the you usually need another routing protocol to establish connectivity between BGP next hops. From the design perspective, iBGP is more a scalability tool than a routing protocol;&lt;/li&gt;&#xA;&lt;li&gt;If you run eBGP, you don't need a full mesh of BGP sessions for optimal end-to-end traffic flows; BGP next hop processing nicely solves those issues. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://blog.ioshints.info/2011/08/bgp-next-hop-processing.html&quot;&gt;http://blog.ioshints.info/2011/08/bgp-next-hop-processing.html&lt;/a&gt; for more details&lt;/p&gt;&#xA;" OwnerUserId="317" LastActivityDate="2013-05-09T13:06:15.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="204" PostTypeId="1" AcceptedAnswerId="210" CreationDate="2013-05-09T13:11:17.917" Score="24" ViewCount="2341" Body="&lt;p&gt;Maybe I am missing something rather basic, but I don't know so I figured I would ask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of testing, how sensitive various TDMoE are to BER and packet delay, I am looking into how to simulate delay and random packet dropping at the ethernet level.  For these tests, I will probably just run iptables as documented in a similar StackOverflow question.  However, although that will work here, I am not sure it will work in a more general case (perhaps testing BER tolerance between Windows servers and the like).  So this has got me thinking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any inexpensive network testing devices that allow one to artificially delay or drop packets in order to stress test protocols and evaluate sensitivity to latency and packet loss?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My requirements are to be able to do this on the ethernet level. I am not looking so much for specific devices, brands, etc. so much as &quot;are their things that do this?&quot; and if so, maybe some general ideas of what they are like. I am mostly looking at building a simple bridge running Linux and iptables to do this. Just wondering if this is the right way to go.&lt;/p&gt;&#xA;" OwnerUserId="174" LastEditorUserId="42290" LastEditDate="2017-12-13T12:15:30.557" LastActivityDate="2017-12-13T12:15:30.557" Title="Emulate Ethernet frame loss for testing purposes" Tags="|ethernet|ber|packet-loss|testing|" AnswerCount="2" CommentCount="2" ClosedDate="2019-01-24T00:11:52.210" ContentLicense="CC BY-SA 3.0" />
  <row Id="205" PostTypeId="2" ParentId="191" CreationDate="2013-05-09T13:15:45.780" Score="7" Body="&lt;p&gt;If you really want to terminate MPLS in vSwitches (I wouldn't do it for numerous reasons, some of them here &lt;a href=&quot;http://blog.ioshints.info/2012/03/mplsvpn-in-data-center-maybe-not-in.html&quot;&gt;http://blog.ioshints.info/2012/03/mplsvpn-in-data-center-maybe-not-in.html&lt;/a&gt; and here &lt;a href=&quot;http://blog.ioshints.info/2012/07/could-mpls-over-ip-replace-vxlan-or.html&quot;&gt;http://blog.ioshints.info/2012/07/could-mpls-over-ip-replace-vxlan-or.html&lt;/a&gt;), look @ Juniper's Contrail acquisition, they actually do that with BGP between controller and external routers and XMPP between hypervisor and controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the description of Contrail solution from NFD: &lt;a href=&quot;http://vimeo.com/61490396&quot;&gt;http://vimeo.com/61490396&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="317" LastActivityDate="2013-05-09T13:15:45.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="206" PostTypeId="2" ParentId="202" CreationDate="2013-05-09T13:17:58.773" Score="9" Body="&lt;p&gt;Assuming the two NICs on the servers are used to separate production and backup traffic, use VRFs. That's the best traffic separation technique there is. For more scalability (not sure you need it based on the diagram), throw full-blown MPLS/VPN in the mix, it runs on both Cat 6500 and ASRs.&lt;/p&gt;&#xA;" OwnerUserId="317" LastActivityDate="2013-05-09T13:17:58.773" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="207" PostTypeId="2" ParentId="186" CreationDate="2013-05-09T13:17:58.627" Score="7" Body="&lt;p&gt;This looks like a simple layer two domain. MPLS is typically used only as backbone or distribution transit, that is, among routers. To implement MPLS, you would need to push the VLAN interfaces down to the access switches (and thus split Host5 into a new network or move it to switch 2) and run MPLS among the multilayer switches. Although, this wouldn't bring much benefit to the topology shown.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-09T13:17:58.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="208" PostTypeId="1" AcceptedAnswerId="215" CreationDate="2013-05-09T13:19:39.450" Score="11" ViewCount="7243" Body="&lt;p&gt;We want to find a &quot;safe&quot; way to stretch layer 2 network across 2 data-centers, and since we don't have any equipment running NX-OS on either data-centers we can't use OTV.&#xA;So what are the alternatives for us who have the following equipment at hand:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data-center 1: 2x 6509-E in VSS (SUP720, IP Services)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data-center 2: 2x 4500-X in VSS (IP Base at the moment)&lt;/p&gt;&#xA;" OwnerUserId="318" LastEditorUserId="318" LastEditDate="2013-05-10T09:04:12.783" LastActivityDate="2018-06-05T18:29:12.767" Title="What are the alternatives to OTV for stretching a layer 2 network across 2 datacenters?" Tags="|cisco|cisco-catalyst|vss|cisco-nx-os|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="209" PostTypeId="2" ParentId="208" CreationDate="2013-05-09T13:25:41.350" Score="23" Body="&lt;p&gt;Dark fiber and LAG across the two links. VPLS won't work on 4500.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disable STP on the DCI link (and make sure nobody ever reconnects the cables the wrong way) or use MST with each DC as a region (you don't want STP events in one DC to spill over into the other).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory you could use Metro Ethernet services, but if they don't pass LACP and STP transparently, you're in a total mess (read: don't even try).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;#Rant On&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, please note that there is &lt;strong&gt;no safe way to stretch layer-2 networks&lt;/strong&gt;. Layer-2 network is a single failure domain - you get a loop somewhere, everything gets affected. You can limit the damage by using storm control, but then you're killing the good packets with the bad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, think about routing and connectivity implications if the link between the two data centers fails completely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;#Rant off&lt;/p&gt;&#xA;" OwnerUserId="317" LastActivityDate="2013-05-09T13:25:41.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="210" PostTypeId="2" ParentId="204" CreationDate="2013-05-09T13:30:27.353" Score="26" Body="&lt;p&gt;There are tools like &lt;a href=&quot;http://wanem.sourceforge.net/&quot;&gt;WANem&lt;/a&gt; which allow you to simulate WAN links by artificially causing arbitrary delay and loss rates on a link. WANem works at a relatively high-level; you won't see physical errors on the link but packets will be dropped. It can be deployed on commodity hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there are a few other tools which serve similar purposes but I can't recall the names of any at the moment.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-09T13:30:27.353" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="214" PostTypeId="2" ParentId="181" CreationDate="2013-05-09T14:16:29.947" Score="6" Body="&lt;p&gt;If my memory serves, the older Procurve switches used to accept and forward any CoS/DSCP markings they received.  You couldn't modify them unless you were on a 5400xl or better switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like the 2520 and the 3800 allow you to modify whether or not you're using CoS or DiffServ TOS for classification.  The top level command you want is &lt;em&gt;qos type-of-service&lt;/em&gt;.  The rest of the commands should be contained under that.  If they aren't available, you may not be able to modify the QoS settings on that specific platform.&lt;/p&gt;&#xA;" OwnerUserId="71" LastActivityDate="2013-05-09T14:16:29.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="215" PostTypeId="2" ParentId="208" CreationDate="2013-05-09T14:25:53.923" Score="8" Body="&lt;p&gt;VPLS, AToM, and L2TP are also additional ways to glue ports together that land on distant routers.  Some of them require MPLS on all the in-between routers, but L2TP(v3 in particular) does not require anything besides ip routing on the intermediary routers.  Basically, they glue together two remote router ports, and can usually pass spanning tree, etc, since they're not acting as switches in this regard.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2013-05-09T14:25:53.923" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="216" PostTypeId="2" ParentId="86" CreationDate="2013-05-09T14:48:28.573" Score="10" Body="&lt;p&gt;From my own experience, there are no caveats in disabling the filters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be honest, if there were an alarming amount of probe data coming from unknown/unassociated SSIDs, I'd be more concerned about the rogue SSIDs popping up in the vicinity of your WLAN, and the interference they would cause, as a posed to the increase in probe data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will definitely increase accuracy on location, but don't expect it to magically turn a low density location deployment into a &amp;lt;5 meter accurate one. (although, I don't know the physics behind this yet, or the actual gains from doing this) If you're particularly worried, just keep an eye on the bandwidth of the tunnels going back to the controller. (unless you have a 3850 already)&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastActivityDate="2013-05-09T14:48:28.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="217" PostTypeId="2" ParentId="199" CreationDate="2013-05-09T14:50:36.677" Score="14" Body="&lt;p&gt;Unless someone is clearing counters you should never see any odometer-type counters (those that increment based on a packet action) decrease, they should always increase.  That part sounds like a bug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as what causes output drops in particular, there are so many different causes that it's very difficult to pinpoint it exactly.  Sometimes there is congestion inside the switch's backplane and those might show up as output drops on the outgoing interface.  In rare circumstances you can also get microbursts that don't show up when polled at 1 minute intervals that quickly overload the interface, but then drop back down very quickly.  I would suggest grabbing the SNMP OID for output drops and then graphing that and see how it corresponds to the CLI counter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, you don't want any output drops as they indicate a packet that did not make it to its destination.  But, if you're running your links hot (which you say you're not) they're unavoidable to an extent, mostly due to interior switch buffering, etc.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2013-05-09T14:50:36.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="219" PostTypeId="5" CreationDate="2013-05-09T15:12:17.493" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-09T15:12:17.493" LastActivityDate="2013-05-09T15:12:17.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="220" PostTypeId="4" CreationDate="2013-05-09T15:12:17.493" Score="0" Body="Major release 12 of Cisco's IOS software" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2013-05-09T15:29:03.757" LastActivityDate="2013-05-09T15:29:03.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="221" PostTypeId="1" CreationDate="2013-05-09T15:18:14.210" Score="11" ViewCount="5729" Body="&lt;p&gt;I'd be happy to post the config or logs for reference but I am having trouble getting my remote access VPN working on the same interface as my site to site IPSEC VPN. I am using a dynamic crypto map for the remote access vpn but it looks like it is failing trying to do phase one. Would anyone be able to give me a simple example config to work off of?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a debug dump from it failing after implementing ISAKMP profiles per suggestion below. I am prompted for username and password but then it times out. It looks like the isakmp authorization is failing. Currently isakmp authorization is just set to the local user list. Does that appear to be the problem to you guys?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jul  3 16:40:44.297: ISAKMP/aaa: unique id = 29277&#xA;Jul  3 16:40:44.297: ISAKMP:(0):Proposed key length does not match policy&#xA;Jul  3 16:40:44.297: ISAKMP:(0):atts are not acceptable. Next payload is 3&#xA;Jul  3 16:40:44.313: ISAKMP:(0):ISAKMP/tunnel: setting up tunnel REMOTEACCESS pw request&#xA;Jul  3 16:40:44.313: ISAKMP:(0):ISAKMP/tunnel: Tunnel REMOTEACCESS PW Request successfully sent to AAA&#xA;Jul  3 16:40:44.317: ISAKMP:(0):ISAKMP/tunnel: received callback from AAA&#xA;AAA/AUTHOR/IKE: Processing AV tunnel-password&#xA;AAA/AUTHOR/IKE: Processing AV addr-pool&#xA;AAA/AUTHOR/IKE: Processing AV inacl&#xA;AAA/AUTHOR/IKE: Processing AV dns-servers&#xA;AAA/AUTHOR/IKE: Processing AV wins-servers&#xA;AAA/AUTHOR/IKE: Processing AV route-metric&#xA;Jul  3 16:40:44.317: ISAKMP/tunnel: received tunnel atts&#xA;Jul  3 16:40:44.341: ISAKMP AAA: Deleting old aaa_uid = 29277&#xA;Jul  3 16:40:44.341: ISAKMP AAA: NAS Port Id is already set to 174.98.136.27&#xA;Jul  3 16:40:44.341: ISAKMP:(0):AAA: Nas Port ID set to 174.98.136.27.&#xA;Jul  3 16:40:44.341: ISAKMP AAA: Allocated new aaa_uid = 29278&#xA;Jul  3 16:40:44.341: ISAKMP AAA: Accounting is not enabled&#xA;Jul  3 16:40:48.337: ISAKMP AAA: NAS Port Id is already set to 174.98.136.27&#xA;Jul  3 16:40:48.337: ISAKMP/Authen: unique id = 29278&#xA;Jul  3 16:40:48.337: ISAKMP:(2110):AAA Authen: setting up authen_request&#xA;Jul  3 16:40:48.337: ISAKMP:(2110):AAA Authen: Successfully sent authen info to AAA&#xA;&#xA;Jul  3 16:40:48.337: ISAKMP:(2110):AAA Authen: Local Authentication or no RADIUS atts recvd&#xA;Jul  3 16:40:48.349: ISAKMP:(2110):ISAKMP/author: setting up the authorization request for REMOTEACCESS&#xA;Jul  3 16:40:48.349: ISAKMP:(0):ISAKMP/author: received callback from AAA&#xA;AAA/AUTHOR/IKE: Processing AV tunnel-password&#xA;AAA/AUTHOR/IKE: Processing AV addr-pool&#xA;AAA/AUTHOR/IKE: Processing AV inacl&#xA;AAA/AUTHOR/IKE: Processing AV dns-servers&#xA;Jul  3 16:40:48.349: &#xA;AAA/AUTHOR/IKE: no DNS addresses&#xA;AAA/AUTHOR/IKE: Processing AV wins-servers&#xA;Jul  3 16:40:48.349: &#xA;AAA/AUTHOR/IKE: no WINS addresses&#xA;AAA/AUTHOR/IKE: Processing AV route-metric&#xA;Jul  3 16:40:48.349: ISAKMP:(2110):ISAKMP/author: No Class attributes&#xA;Jul  3 16:40:48.349: ISAKMP:FSM error - Message from AAA grp/user.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also see these errors when I do debug isakmp and ipsec errors and pull the logs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jul  3 16:32:33.949: insert of map into mapdb AVL failed, map + ace pair already exists on the mapdb&#xA;Jul  3 16:32:57.557: ISAKMP:(0):Proposed key length does not match policy&#xA;Jul  3 16:32:57.557: ISAKMP:(0):atts are not acceptable. Next payload is 3&#xA;Jul  3 16:33:00.637: ISAKMP:FSM error - Message from AAA grp/user.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="322" LastEditorUserId="322" LastEditDate="2013-07-03T17:38:35.573" LastActivityDate="2020-04-12T07:07:08.097" Title="What is the proper way to config a Site to Site IPSEC VPN and a Remote Access VLAN on the same external interface? Cisco 891 ISR" Tags="|cisco|vpn|cisco-ios-15|cisco-isr|ipsec|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="222" PostTypeId="5" CreationDate="2013-05-09T15:34:50.127" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-09T15:34:50.127" LastActivityDate="2013-05-09T15:34:50.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="223" PostTypeId="4" CreationDate="2013-05-09T15:34:50.127" Score="0" Body="Cisco's Adaptive Security Appliance (ASA) which combines functionality from the PIX, VPN 3000 series and Intrusion Prevention Systems (IPS) product lines" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2013-05-09T16:23:39.173" LastActivityDate="2013-05-09T16:23:39.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="224" PostTypeId="5" CreationDate="2013-05-09T15:36:08.007" Score="0" Body="&lt;p&gt;Catalyst is the brand name for a line of network switches sold by Cisco Systems. These are generally Ethernet switches but other interface types are available. Like many Cisco products the switch line initially began at companies that Cisco acquired, rebranding their products as various versions of the Catalyst product line. Many Catalyst switches also have layer-3 routing capabilities.&lt;/p&gt;&#xA;" OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-05-13T19:33:56.010" LastActivityDate="2013-05-13T19:33:56.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="225" PostTypeId="4" CreationDate="2013-05-09T15:36:08.007" Score="0" Body="A tag for questions related to Cisco's Catalyst line of switches. " OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-05-13T19:34:00.903" LastActivityDate="2013-05-13T19:34:00.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="226" PostTypeId="5" CreationDate="2013-05-09T15:37:34.917" Score="0" Body="&lt;p&gt;Ethernet is a family of computer networking technologies for local area networks (LANs). Ethernet was commercially introduced in 1980 and standardized in 1985 as IEEE 802.3. Ethernet has largely replaced competing wired LAN technologies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ethernet standards comprise several wiring and signaling variants of the OSI physical layer in use with Ethernet. The original 10BASE5 Ethernet used coaxial cable as a shared medium. Later the coaxial cables were replaced by twisted pair and fiber optic links in conjunction with hubs or switches. Data rates were periodically increased from the original 10 megabits per second to 100 gigabits per second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Systems communicating over Ethernet divide a stream of data into shorter pieces called frames. Each frame contains source and destination addresses and error-checking data so that damaged data can be detected and re-transmitted. As per the OSI model Ethernet provides services up to and including the data link layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since its commercial release, Ethernet has retained a good degree of compatibility. Features such as the 48-bit MAC address and Ethernet frame format have influenced other networking protocols.&lt;/p&gt;&#xA;" OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-05-21T14:42:44.723" LastActivityDate="2013-05-21T14:42:44.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="227" PostTypeId="4" CreationDate="2013-05-09T15:37:34.917" Score="0" Body="For questions relating to Ethernet networking, as defined by the IEEE 802.3 standards." OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-25T22:08:15.890" LastActivityDate="2013-05-25T22:08:15.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="228" PostTypeId="5" CreationDate="2013-05-09T15:38:48.250" Score="0" Body="&lt;p&gt;Internet Protocol version 6 (IPv6) is the current version of the Internet Protocol, designed as the successor to the old Internet Protocol version 4 (IPv4).  The&#xA;changes from IPv4 to IPv6 fall primarily into the following categories:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Expanded Addressing Capabilities&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 increases the IP address size from 32 bits to 128 bits, to&#xA;    support more levels of addressing hierarchy, a much greater&#xA;    number of addressable nodes, and simpler auto-configuration of&#xA;    addresses.  The scalability of multicast routing is improved by&#xA;    adding a &quot;scope&quot; field to multicast addresses.  And a new type&#xA;    of address called an &quot;anycast address&quot; is defined, used to send&#xA;    a packet to any one of a group of nodes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Header Format Simplification&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some IPv4 header fields have been dropped or made optional, to&#xA;    reduce the common-case processing cost of packet handling and&#xA;    to limit the bandwidth cost of the IPv6 header.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Improved Support for Extensions and Options&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changes in the way IP header options are encoded allows for&#xA;    more efficient forwarding, less stringent limits on the length&#xA;    of options, and greater flexibility for introducing new options&#xA;    in the future.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Flow Labeling Capability&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A new capability is added to enable the labeling of packets&#xA;    belonging to particular traffic &quot;flows&quot; for which the sender&#xA;    requests special handling, such as non-default quality of&#xA;    service or &quot;real-time&quot; service.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Authentication and Privacy Capabilities&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extensions to support authentication, data integrity, and&#xA;   (optional) data confidentiality are specified for IPv6.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1420" LastEditorUserId="1420" LastEditDate="2020-01-26T23:33:11.630" LastActivityDate="2020-01-26T23:33:11.630" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="229" PostTypeId="4" CreationDate="2013-05-09T15:38:48.250" Score="0" Body="For questions about Internet Protocol version 6 (IPv6); as specified in RFC 8200." OwnerUserId="348" LastEditorUserId="1420" LastEditDate="2020-01-26T23:33:23.207" LastActivityDate="2020-01-26T23:33:23.207" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="230" PostTypeId="5" CreationDate="2013-05-09T16:18:49.623" Score="0" Body="&lt;p&gt;VLAN Trunking Protocol (VTP) is a Cisco proprietary protocol that propagates the definition of Virtual Local Area Networks (VLANs) on the whole LAN. To do this, VTP carries VLAN information to all the switches in a VTP domain. VTP advertisements can be sent over 802.1Q, and ISL trunks. VTP is available on most of the Cisco Catalyst Family products. Using VTP, each Catalyst Family Switch advertises the following on its trunk ports:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Management domain&lt;/li&gt;&#xA;&lt;li&gt;Configuration revision number&lt;/li&gt;&#xA;&lt;li&gt;Known VLANs and their specific parameters&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are three versions of VTP, namely version 1, version 2, version 3.&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="8499" LastEditDate="2016-11-29T22:28:57.540" LastActivityDate="2016-11-29T22:28:57.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="231" PostTypeId="4" CreationDate="2013-05-09T16:18:49.623" Score="0" Body="For questions about the VLAN Trunking Protocol" OwnerUserId="231" LastEditorUserId="8499" LastEditDate="2016-11-29T22:28:57.540" LastActivityDate="2016-11-29T22:28:57.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="233" PostTypeId="1" CreationDate="2013-05-09T17:28:41.573" Score="6" ViewCount="2715" Body="&lt;p&gt;I am really having trouble to get our SRXes to log sessions that are not in the state table and get dropped because of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you reboot the firewall and some old NFS implementation keeps sending traffic through the same session, once the SRX comes back it drops those packets because it didn't see a three-way-handshake. However, it doesn't log those drops. Yes, logging on the cleanup rule is enabled.&lt;/p&gt;&#xA;" OwnerUserId="328" LastEditorUserId="453" LastEditDate="2013-05-16T09:31:34.423" LastActivityDate="2013-05-29T20:27:25.527" Title="How to log out of state sessions on Juniper SRX platform?" Tags="|juniper|juniper-srx|srx|logging|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="235" PostTypeId="2" ParentId="195" CreationDate="2013-05-09T17:59:39.293" Score="6" Body="&lt;p&gt;Perhaps passive monitoring is a better approach. There are plenty of systems out there that will track interface state/errors/discards/bandwidth. Does a bandwidth graph fit your needs?&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-09T17:59:39.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="237" PostTypeId="1" AcceptedAnswerId="242" CreationDate="2013-05-09T18:44:24.937" Score="11" ViewCount="1596" Body="&lt;p&gt;Add another reason to hate NAT to the list. I'm bringing up two Internet egress points in our corporate network. The edge devices will be ASA 5525-X firewalls. Traditionally you would put these into some sort of cluster, but this requires L2 connectivity. Since these devices will be in separate parts of my network, L2 connectivity is not an easy option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current running solution is to bring them both up as independent firewalls and advertise a default route from each. Any ECMP &lt;strong&gt;should&lt;/strong&gt; have the same hash for each flow and push it towards the &quot;correct&quot; egress firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there a way to cluster two ASAs without needing a L2 link?&lt;/li&gt;&#xA;&lt;li&gt;I want a second/third/hundred pair of eyes on my current solution assuming &quot;No&quot; is the answer to #1.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="287" LastEditorUserId="49" LastEditDate="2013-05-09T19:04:20.690" LastActivityDate="2013-05-09T21:10:06.000" Title="Two Cisco ASA 5525-X as Internet Gateways without Layer 2" Tags="|cisco-asa|ecmp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="239" PostTypeId="1" AcceptedAnswerId="241" CreationDate="2013-05-09T19:15:39.517" Score="10" ViewCount="5556" Body="&lt;p&gt;With IPv4, TCP MSS &quot;clamping&quot; (a network device editing the MSS value in a TCP header) can help when path maximum transmission unit discovery is not working. (e.g., when ICMP is being blocked somewhere in the path.) Since there's no fragmentation in IPv6, we still have ICMPv6's 'packet too big' to signal the originating end point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any guidance about clamping TCP MSS over IPv6 specifically?&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="8499" LastEditDate="2018-10-27T02:17:13.097" LastActivityDate="2018-10-27T02:17:13.097" Title="Is TCP maximum segment size (MSS) &quot;clamping&quot; compatible with IPv6?" Tags="|tcp|ipv6|layer4|transport-protocol|icmpv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="240" PostTypeId="2" ParentId="221" CreationDate="2013-05-09T19:26:07.853" Score="6" Body="&lt;p&gt;Taking a shot in the dark here because there are a lot of variables you didn't mention.  Please update the question to include the specific technologies you are using, your currnet config, and the error you are getting.  But if you are using for instance, DMVPN + EZVPN, you will probably have to use keyrings and multiple ISAKMP profiles.  Since you point to phase 1 issues I would check that.  The following links give reference configs for &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00801eafcb.shtml&quot;&gt;DMVPN and EZVPN&lt;/a&gt; and &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008032cd24.shtml#diag&quot;&gt;L2L+EZVPN&lt;/a&gt;. You should be able to modify to suit your needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6635/prod_white_paper0900aecd8034bd59.html&quot;&gt;ISAKMP Profile reference&lt;/a&gt; for some lunchtime reading.&lt;/p&gt;&#xA;" OwnerUserId="241" LastActivityDate="2013-05-09T19:26:07.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="241" PostTypeId="2" ParentId="239" CreationDate="2013-05-09T19:35:47.990" Score="15" Body="&lt;p&gt;Well technically fragmentation can happen in IPv6; &lt;a href=&quot;http://en.wikipedia.org/wiki/IPv6_packet#Fragmentation&quot;&gt;This&lt;/a&gt; is the wikipedia article on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/software/erx/junose93/swconfig-ip-ipv6-igp/ipv6-tcp-configuration.html&quot;&gt;This&lt;/a&gt; Juniper page is a bit old but it shows that you can clamp an MSS for TCP over IPv6 on Junos the same as you would in IPv4 using the same command, &lt;code&gt;tcp mss&lt;/code&gt;. The same is shown in &lt;a href=&quot;http://blog.ioshints.info/2013/01/mtu-issues-and-tcp-mss-clamping-in.html&quot;&gt;this&lt;/a&gt; article for Cisco IOS 15, using the traditional ip tcp &lt;code&gt;adjust-mss&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you can configure MSS clamping if PMTUD isn't working as it should be in a part of your network, otherwise, you should be ensuring that you are aiding the smoothing running of PTMUD across your networking so that MSS clamping isn't required (I understand this isn't always under your control).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junose10.0/information-products/topic-collections/swconfig-ip-ipv6/setting-mss-for-tcp-connections_1.html&quot;&gt;Here&lt;/a&gt; is a link to a newer Junos article for Junos 10x rather than 9, I can't find one for 11 and I'm not in front of 11 right now, but I expect it will be the same.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-09T19:35:47.990" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="242" PostTypeId="2" ParentId="237" CreationDate="2013-05-09T20:23:21.413" Score="11" Body="&lt;p&gt;I think you have two options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Designate one Internet circuit as the primary and the other as failover&lt;/li&gt;&#xA;&lt;li&gt;Implement &quot;NAT outside&quot; (public space) routing between the sites with the firewalls&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The first option ensures traffic is always going through either one firewall or the other so that NAT doesn't break.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second option allows you to load balance across both circuits: One equal-cost default route from each circuit, with your local public prefix(es) advertised out both circuits. (This option ignores how connectivity between the sites is accomplished.)&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-09T20:23:21.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="243" PostTypeId="1" AcceptedAnswerId="250" CreationDate="2013-05-09T20:26:01.570" Score="7" ViewCount="803" Body="&lt;p&gt;I have 2 spare older Cisco Catalyst (not Nexus) 5500 switches.  Would I need any additional hardware in order to run Fibre Channel over Ethernet (FCoE) over them?  Do I need some kind of management device and/or software or can I do that internally?  I'd like to re-purpose the old switches for a lab, but I'm unsure of the FCoE requirements and compatibility.&lt;/p&gt;&#xA;" OwnerUserId="291" LastEditorUserId="291" LastEditDate="2013-05-09T21:17:09.417" LastActivityDate="2013-05-15T06:06:15.623" Title="Can I run FCoE over Cisco Catalyst 5500?" Tags="|cisco|cisco-catalyst|cisco-c5500|fcoe|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="244" PostTypeId="2" ParentId="237" CreationDate="2013-05-09T20:45:08.777" Score="7" Body="&lt;p&gt;Don't have much experience with ASA's, so I can't really answer question #1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful with your assumptions about ECMP, however.  Different equipment handles ECMP differently.  I've seen ECMP implementations from the granularity of &quot;per-destination-prefix&quot; load-balancing (which almost isn't ECMP at all), to &quot;per-packet&quot; load-balancing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're going to have to get a bit more sophisticated with your routing handling to make this work.  Look for the DCI interconnect information that ioshints has published, that should help you figure out how you might design your network to handle this.  Sorry I don't have a URL close to hand on this.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-05-09T20:45:08.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="246" PostTypeId="2" ParentId="199" CreationDate="2013-05-09T21:02:03.303" Score="8" Body="&lt;p&gt;My first thought is unicast flooding, especially if the counters increment in unison across a number of ports in the same vlan. I agree with Aaron that the counter decrementing sounds like a bug. The counter will probably roll over at 2^64, but that won't happen within seconds. I would consider a healthy rate of output drops to be zero, but this is not realistic--even in the datacenter. Are you doing 10G uplinks?&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-09T21:02:03.303" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="247" PostTypeId="2" ParentId="237" CreationDate="2013-05-09T21:10:06.000" Score="5" Body="&lt;p&gt;Personally, I wouldn't even consider long distance clustering. I believe Cisco's recommendation is direct cable connect. ECMP may be workable, but it is vital to do per-destination (the Cisco default AFAIK) and not per-packet. Consider the impact on a passive ftp transfer that requires dual outbound connections.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-09T21:10:06.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="248" PostTypeId="5" CreationDate="2013-05-09T21:23:27.343" Score="0" Body="&lt;p&gt;Catalyst 5500 series switches have been declared end-of-life by Cisco, are no longer sold, and will be unsupported beyond September, 2014.&#xA;Switch models: &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps686/index.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/products/hw/switches/ps686/index.html&lt;/a&gt;&#xA;End-of-life milestones and dates: &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps686/prod_end-of-life_notice0900aecd805eaa6b.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps686/prod_end-of-life_notice0900aecd805eaa6b.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="291" LastEditorUserId="291" LastEditDate="2013-05-10T01:18:29.950" LastActivityDate="2013-05-10T01:18:29.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="249" PostTypeId="4" CreationDate="2013-05-09T21:23:27.343" Score="0" Body="Information related to the Cisco Catalyst 5500 series of multilayer switches." OwnerUserId="291" LastEditorUserId="291" LastEditDate="2013-05-10T01:18:22.153" LastActivityDate="2013-05-10T01:18:22.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="250" PostTypeId="2" ParentId="243" CreationDate="2013-05-09T21:27:29.427" Score="11" Body="&lt;p&gt;My knee jerk reaction to this would be to say &quot;don't do it.&quot; Mainly because these switches would not support &lt;a href=&quot;http://en.wikipedia.org/wiki/Data_center_bridging&quot;&gt;data center bridging&lt;/a&gt;. FCoE is not like iSCSI. FC is a bus and assumes it is lossless. Ethernet, as you know, is lossy. DCB allows Ethernet to act lossless and transport FCoE frames.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-09T21:27:29.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="251" PostTypeId="2" ParentId="185" CreationDate="2013-05-10T00:39:59.463" Score="16" Body="&lt;p&gt;You can check the Amsterdam Internet Exchange's &lt;a href=&quot;http://www.ams-ix.net/config-guide/&quot;&gt;Config Guide&lt;/a&gt; for hints on how to silence switches from a variety of vendors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience there are vendors whose software is so bad that their equipment is never silent, for example they ARP out every interface when they boot, or send out some upon a link up event on a port. Juniper, Cisco, Brocade can be muffled with varying degrees of persuasion, Extreme loops everything during EAPS transitions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some things to disable/consider:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Discovery protocols (LLDP, CDP, FDP, 'dynamic-vlan-discovery')&lt;/li&gt;&#xA;&lt;li&gt;VTP, DTP&lt;/li&gt;&#xA;&lt;li&gt;STP (disable for the VLAN a port is in)&lt;/li&gt;&#xA;&lt;li&gt;Ethernet keepalives or loop frames (useless on full-duplex media)&lt;/li&gt;&#xA;&lt;li&gt;Weird stuff like DECnet MOP (topic of another question a few days ago)&lt;/li&gt;&#xA;&lt;li&gt;Have a separate management VLAN for the switch's own IP address&lt;/li&gt;&#xA;&lt;li&gt;You'll want to disable PIM snooping on a Cisco as this breaks IPv6.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="56" LastActivityDate="2013-05-10T00:39:59.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="252" PostTypeId="1" AcceptedAnswerId="258" CreationDate="2013-05-10T00:48:31.507" Score="7" ViewCount="141" Body="&lt;p&gt;What is the concensus on the use case for RPKI? Is it useful for a stub AS to perform route validation or is this better left to the providers?&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-10T06:58:05.553" Title="RPKI in the Enterprise" Tags="|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="253" PostTypeId="2" ParentId="252" CreationDate="2013-05-10T01:25:08.493" Score="6" Body="&lt;p&gt;This is really an opinion question; however, I'd say you'd rather have it and not need it than need it and not have it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't trust anything outside of my AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That sounded funny.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But really, you can't assume your upstream is doing their job correctly.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-10T01:25:08.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="254" PostTypeId="2" ParentId="151" CreationDate="2013-05-10T02:59:40.503" Score="6" Body="&lt;p&gt;I am considering whether ECMP makes sense for anycast. Routing should direct anycast to the logically-nearest destination in which one host would be favored over the other. Even in the case where the anycast hosts are equidistant, I would still expect this to remain true. As for ECMP load-sharing, I would think per-destination is impossible with a /32. Perhaps there are load-sharing algorithms that consider the source. Per-packet seems risky, even for DNS. I believe most out-of-the-box anycast solutions run ospf on the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Took a bit of searching, but the following excerpt from &lt;a href=&quot;http://www.ietf.org/rfc/rfc2178.txt&quot; rel=&quot;nofollow&quot;&gt;rfc2178&lt;/a&gt; confirms the cause.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;16.8.  Equal-cost multipath&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OSPF protocol maintains multiple equal-cost routes to all&#xA;   destinations.  This can be seen in the steps used above to calculate&#xA;   the routing table, and in the definition of the routing table&#xA;   structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each one of the multiple routes will be of the same type (intra-area,&#xA;   inter-area, type 1 external or type 2 external), cost, and &lt;strong&gt;will have&#xA;   the same associated area&lt;/strong&gt;.  However, each route specifies a separate&#xA;   next hop and Advertising router.&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2013-05-14T01:21:32.920" LastActivityDate="2013-05-14T01:21:32.920" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="255" PostTypeId="2" ParentId="130" CreationDate="2013-05-10T04:39:39.040" Score="0" Body="&lt;p&gt;I think that it comes down to 2 things.  First, a link-local cannot be routed, so no subnet ID is needed.  It is assumed that since it cannot be routed that anything following the prefix up until the last 64-bits will be zero's.  Second, like other similar IPv6 prefixes, the prefix is everything up until the last '1' bit.  This keeps consistency.&lt;/p&gt;&#xA;" OwnerUserId="196" LastActivityDate="2013-05-10T04:39:39.040" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="257" PostTypeId="2" ParentId="167" CreationDate="2013-05-10T06:55:53.000" Score="2" Body="&lt;p&gt;Sup6E/Sup7E based Catalysts have way different architecture than the access Catalysts and the previous Supervisors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, the new architecture is based on different hardware architecture. The good news is that it supports MQC and behaves more like router QoS, so the easiest solution for your problem would be to define a class-map with match-any criteria, then make it match different DSCP values that are of interest to you, and then apply that service-policy to input of the interfaces you'd like to monitor.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-05-10T06:55:53.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="258" PostTypeId="2" ParentId="252" CreationDate="2013-05-10T06:58:05.553" Score="5" Body="&lt;p&gt;RPKI is two-way action. First of all, it would be nice if you could sign your own prefixes, so nobody will be able to hijack them somewhere in the other part of the internet (if his upstreams support and validate prefix advertisements using RPKI). The more end-sites will use RPKI, the better value will have using RPKI to various SPs and more SPs will do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the SP side, it would be beneficial to push your upstreams to implement RPKI at the same time. &lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-05-10T06:58:05.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="259" PostTypeId="1" AcceptedAnswerId="261" CreationDate="2013-05-10T10:11:43.073" Score="11" ViewCount="1489" Body="&lt;p&gt;As everyone is aware we are out of IPv4 addresses and soon (if not already) we shall be moving on to IPv6. What are some good strategies and practices to migrate a complete IPv4 network onto IPv6? &lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="23971" LastEditDate="2016-03-25T23:14:18.833" LastActivityDate="2016-03-26T14:31:41.007" Title="Migration from IPv4 to IPv6 strategies" Tags="|ipv4|ipv6|ipv6-transition|" AnswerCount="4" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="260" PostTypeId="2" ParentId="52" CreationDate="2013-05-10T12:34:24.327" Score="2" Body="&lt;p&gt;You certainly want to ECMP LSP's, how many to use depends on traffic levels relative to link bandwidths (critically you want to avoid LSP's being unsignalable due to being larger then a choke point).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For auto-bandwidth intervals it depends on what your aiming for, a few times an hour isn't a bad number, but less frequent may be better if you have fewer flows.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-10T12:34:24.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="261" PostTypeId="2" ParentId="259" CreationDate="2013-05-10T13:02:09.507" Score="23" Body="&lt;p&gt;I don't have a full strategy, but here's the rough way I did it at $JOB[-1]:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Get an IPv6 block, either from your existing carrier, or an RIR&lt;/li&gt;&#xA;&lt;li&gt;You might also want to mark a fc00::/7 (Unique local) block for fully internal subnets if you have an ISP block and may ever need to renumber&lt;/li&gt;&#xA;&lt;li&gt;Decide on your v6 IGP, IS-IS is still a safer option than OSPFv3, but much kit won't do IS-IS&lt;/li&gt;&#xA;&lt;li&gt;Bring up v6 on your core kit, from internet edge through to DC core switches&lt;/li&gt;&#xA;&lt;li&gt;Bring up v6 transit, if you have to a BGP tunnel from he.net can work while waiting for ISP's stuck in the last decade (remember to enable v6 on your iBGP mesh if you have one)&lt;/li&gt;&#xA;&lt;li&gt;Create v6 infrastructure services, mostly DNS, v4 accessible is fine here&lt;/li&gt;&#xA;&lt;li&gt;Enable v6 on a single server net (you'd probably have a default deny firewall here)&lt;/li&gt;&#xA;&lt;li&gt;Test the v6 connectivity to the world, will it break things?&lt;/li&gt;&#xA;&lt;li&gt;Turn up v6 on a second server net for redundency&lt;/li&gt;&#xA;&lt;li&gt;Bring up a DHCPv6 server if you want to use it&lt;/li&gt;&#xA;&lt;li&gt;Bring up v6 on a single access network (IT staff is a good choice here)&lt;/li&gt;&#xA;&lt;li&gt;Test. Ensure nothing breaks&lt;/li&gt;&#xA;&lt;li&gt;Bring up v6 on remaining server networks&lt;/li&gt;&#xA;&lt;li&gt;Add a v6 namesever for your domains, and a v6 DNS entry for an MX (one, or all but one are good choices for what to dual-stack)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, when bringing up new services or upgrading them you can test if they work on v6, and add the appropriate DNS records (almost all web services will &quot;just work&quot;), eventually you might start looking for services remaining on v4 and fix them, but there's no hurry for that.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-10T13:02:09.507" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="262" PostTypeId="2" ParentId="195" CreationDate="2013-05-10T13:18:21.213" Score="8" Body="&lt;p&gt;(Just noticed your comment about Raspberrys, and I want to follow up)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a large MPLS network where we need to measure bandwith and jitter across sites to make sure that our most sensitive applications isn't hurting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One great way of doing this is, like you mentioned, deploying Raspberrys. They are small enough, so you can install them nearly anywhere. One great toolf for testing bandwith/jitter is &lt;a href=&quot;https://code.google.com/p/iperf/&quot;&gt;iperf&lt;/a&gt;, which you then can set up to run as a (filtered!) daemon on each PI. Then just initiate tests from a central management station.&lt;/p&gt;&#xA;" OwnerUserId="122" LastActivityDate="2013-05-10T13:18:21.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="263" PostTypeId="2" ParentId="199" CreationDate="2013-05-10T14:02:27.973" Score="4" Body="&lt;p&gt;If you are experiencing unicast flooding, running wireshark on one of the hosts or spanning one of the ports should show that pretty quickly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you have redundant cores in a square topology?  If so, try adding this command to your vlan interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arp timeout 300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;CAM tables hold entries for 5 minutes while ARP tables are kept for four hours (defaults).  Setting the ARP to match the CAM may eliminate the unicast flooding at the expense of a slight increase to the CPU.  &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00807347ab.shtml&quot; rel=&quot;nofollow&quot;&gt;Catalyst 6500/6000 Switches ARP or CAM Table Issues Troubleshooting&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2013-05-10T14:02:27.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="264" PostTypeId="1" AcceptedAnswerId="267" CreationDate="2013-05-10T15:00:46.087" Score="7" ViewCount="611" Body="&lt;p&gt;When configuring ZBFW on IOS, the &quot;class-default&quot; class doesn't allow the inspect action (only pass and drop). What is the recommended way to match all traffic for stateful inspection? Matching TCP, UDP, and ICMP seems to work fine, but this doesn't seem ideal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map type inspect match-any All_Protocols&#xA; match protocol tcp&#xA; match protocol udp&#xA; match protocol icmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-10T15:27:25.693" Title="How do you define an IOS zone-based firewall policy to inspect &quot;any&quot;?" Tags="|security|cisco-ios-15|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="265" PostTypeId="1" AcceptedAnswerId="270" CreationDate="2013-05-10T15:06:33.963" Score="10" ViewCount="340" Body="&lt;p&gt;In a Cisco environment (ISR-G2), how do I prevent, or mitigate, incorrect RA announcements?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see Cisco has &quot;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2s/ip6-ra-guard.html&quot;&gt;IPv6 RA Guard&lt;/a&gt;&quot;... But does that just run on the router and &quot;fight back&quot; with correct RAs? Wouldn't it make more sense to have switches filtering bogus RAs out of the network? (Or am I being overly-paranoid about bogus RAs?)&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-11T21:47:22.540" Title="Mitigating bad/malicious IPv6 RA announcements" Tags="|cisco|ipv6|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="267" PostTypeId="2" ParentId="264" CreationDate="2013-05-10T15:27:25.693" Score="13" Body="&lt;p&gt;That should work. Either that or use something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#ip access-list extended MATCH-ALL&#xA;R1(config-ext-nacl)#permit ip any any&#xA;R1(config-ext-nacl)#class-map type inspect match-any CM_MATCH-ALL&#xA;R1(config-cmap)#match access-group name MATCH-ALL&#xA;R1(config-cmap)#policy-map type inspect PM_IN-&amp;gt;OUT&#xA;R1(config-pmap)#class CM_MATCH-ALL&#xA;R1(config-pmap-c)#inspect &#xA;%No specific protocol configured in class CM_MATCH-ALL for inspection. All protocols will    be inspected&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If no specific protocol is matched in the class-map then it will match all protocols.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-10T15:27:25.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="268" PostTypeId="5" CreationDate="2013-05-10T15:33:59.097" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-10T15:33:59.097" LastActivityDate="2013-05-10T15:33:59.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="269" PostTypeId="4" CreationDate="2013-05-10T15:33:59.097" Score="0" Body="Information related to Fibre Channel over Ethernet, an encapsulation of Fibre Channel frames over Ethernet networks." OwnerUserId="291" LastEditorUserId="291" LastEditDate="2013-05-10T17:01:21.060" LastActivityDate="2013-05-10T17:01:21.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="270" PostTypeId="2" ParentId="265" CreationDate="2013-05-10T15:42:30.830" Score="11" Body="&lt;p&gt;This is from the configuration guide for IOS 15.2T. The feature is called RA guard. Basically you create a policy and define if the port that this will applied to leads to a host or to a router. Then you can be more specific and match on hop limit, managed-config-flag and match on an ACL with a range where the trusted sources should come from. You can also make the port trusted and not do any further checks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some ways this is very similar to DHCP snooping. The basic steps are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 nd raguard policy RA-PROTECT&#xA;device-role host&#xA;interface x/x&#xA;ipv6 nd raguard attach-policy RA-PROTECT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you can use this command to verify:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ipv6 nd raguard policy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If your switches supports the feature then it makes sense to catch the RAs as early as possible. I don't think it's being to paranoid. The same could be said for DHCP. Sometimes it's not even malicious users, it's just a case of people not knowing better or connecting crappy devices to the network.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-10T15:42:30.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="271" PostTypeId="2" ParentId="265" CreationDate="2013-05-10T15:49:48.223" Score="9" Body="&lt;p&gt;From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6105.txt&quot; rel=&quot;noreferrer&quot; title=&quot;RFC 6105: IPv6 RA-Guard&quot;&gt;RFC 6105&lt;/a&gt;: &quot;RA-Guard applies to an environment where all messages between IPv6 end-devices traverse the controlled L2 networking devices.&quot; That is, it does what you say it should do; filter out rogue RAs at switchport ingress. It operates on the principle of blocking vs. accepting, not just shouting louder than the other guy.&lt;/p&gt;&#xA;" OwnerUserId="47" LastEditorUserId="360" LastEditDate="2013-05-11T21:47:22.540" LastActivityDate="2013-05-11T21:47:22.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="272" PostTypeId="1" AcceptedAnswerId="274" CreationDate="2013-05-10T15:58:32.150" Score="10" ViewCount="4102" Body="&lt;p&gt;We started with fec0::/10 for site-local addresses -- but that is now deprecated. Instead, we now have fc00::/7 reserved, with fd00::/8 dedicated to /48 nets for Unique Local Addresses.&lt;/p&gt;&#xA;&lt;p&gt;What's the best practice for picking the least-sig 40 bits to give you an org-level /48?&lt;/p&gt;&#xA;&lt;p&gt;...is everyone using the &lt;a href=&quot;http://www.sixxs.net/tools/grh/ula/&quot; rel=&quot;nofollow noreferrer&quot;&gt;SIXXS&lt;/a&gt; voluntary registry? (seems dubious to me)&lt;br /&gt;&#xA;...just use &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4193&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4193&lt;/a&gt;'s guidance for picking (via it's algo)?&lt;br /&gt;&#xA;...anyone have an online implementation of that algo?&lt;/p&gt;&#xA;&lt;p&gt;Picking our 40 bits doesn't seem hard; I'm just trying to pick them the &amp;quot;right&amp;quot; way, if I can.&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-05-26T20:03:17.957" Title="Selecting IPv6 Unique Local Addresses (ie, choosing least-sig 40 bits)" Tags="|ipv6|best-practices|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="273" PostTypeId="2" ParentId="272" CreationDate="2013-05-10T16:39:41.143" Score="2" Body="&lt;p&gt;The odds of someone picking the same range and then merging or making business with you should be very slim. As you mentioned SIXXS has a registration, not sure how much it is used and since it's really no authority there's no guarantee that someone wouldn't have picked the same range. I guess it's better than nothing though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the tools I could find:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.sixxs.net/tools/grh/ula/&quot; rel=&quot;nofollow&quot;&gt;http://www.sixxs.net/tools/grh/ula/&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;https://www.ultratools.com/tools/rangeGenerator&quot; rel=&quot;nofollow&quot;&gt;https://www.ultratools.com/tools/rangeGenerator&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="49" LastEditDate="2013-05-10T16:59:16.570" LastActivityDate="2013-05-10T16:59:16.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="274" PostTypeId="2" ParentId="272" CreationDate="2013-05-10T17:48:11.117" Score="10" Body="&lt;p&gt;Its always best to stick to the relevant RFC when possible. In this case, your two options aren't mutually exclusive. SIXXS' generator should actually generate you a prefix based on RFC4193's algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you would just generate your prefix using SIXXS' tool (or another one you find), and if you feel like it, register it with SIXXS.&lt;/p&gt;&#xA;" OwnerUserId="89" LastActivityDate="2013-05-10T17:48:11.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="275" PostTypeId="1" AcceptedAnswerId="276" CreationDate="2013-05-10T19:09:32.037" Score="18" ViewCount="1211" Body="&lt;p&gt;I need to build a simple point-to-point tunnel to connect an office through an area of the network we trust but directly don't control. Does the tunnel need to be GRE-encapsulated or can I use direct IP-in-IP? (We won't be using IPsec for this particular implementation.)&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-13T08:50:30.077" Title="Is GRE necessary for an IP-only tunnel?" Tags="|tunnel|gre|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="276" PostTypeId="2" ParentId="275" CreationDate="2013-05-10T19:26:46.553" Score="20" Body="&lt;p&gt;Either method will work. I personally prefer GRE, but there should be no practical difference between the two for your use case. (GRE can transport other layer3 protocols than just IP, though.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing to really keep in mind is that GRE incurs a tiny bit of extra overhead as opposed to IPinIP.&lt;/p&gt;&#xA;" OwnerUserId="89" LastActivityDate="2013-05-10T19:26:46.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="277" PostTypeId="1" AcceptedAnswerId="287" CreationDate="2013-05-10T19:36:53.983" Score="6" ViewCount="1166" Body="&lt;p&gt;I would like to redesign a network that has workstations, servers, mgmt interfaces--lots of stuff-- in a single vlan. And, as noted, this single vlan spans an L2 DCI. But if I break all this stuff out into seperate vlans, then inter-vlan routing will be necessary. So, I would like to route between vlans without transiting the DCI. I recall hearing about a method for doing this that involved mac filtering to cause dual-active hsrp. Does anyone know the details of this method? Is there any downside?&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-11T21:47:12.227" Title="Prevent Trombone Routing with L2 DCI" Tags="|dci|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="278" PostTypeId="2" ParentId="275" CreationDate="2013-05-10T19:57:11.357" Score="13" Body="&lt;p&gt;It is also worth considering how tunneling impacts the path MTU. It would be ideal for the infrastructure between tunnel endpoints to support a larger MTU. This will avoid issues with fragmentation and broken pmtud.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-10T19:57:11.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="279" PostTypeId="2" ParentId="277" CreationDate="2013-05-10T21:12:19.733" Score="1" Body="&lt;p&gt;I am pretty sure there is not a way to do this without it being a huge kludge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My suggestion would be that since you're already renumbering things, bite the bullet and renumber at each side of the L2 link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other questions will come up when renumbering, but it's worth it.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-10T21:12:19.733" CommentCount="0" CommunityOwnedDate="2013-05-10T21:12:19.733" ContentLicense="CC BY-SA 3.0" />
  <row Id="280" PostTypeId="1" CreationDate="2013-05-10T22:03:46.790" Score="10" ViewCount="1251" Body="&lt;p&gt;What kind of processes and/or tools do you use to design OSPF cost on links in your environments?&lt;/p&gt;&#xA;" OwnerUserId="352" LastActivityDate="2013-05-13T16:28:12.440" Title="OSPF link cost design" Tags="|ospf|architecture|design|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="281" PostTypeId="2" ParentId="280" CreationDate="2013-05-10T22:42:37.903" Score="10" Body="&lt;p&gt;Not sure this is a question that can get a really good answer but it's important to know the preference order of OSPF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;intra area routes&#xA;inter area routes&#xA;external type 1&#xA;external type 2&#xA;NSSA type 1&#xA;NSSA type 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in some cases adjusting the metric has no effect on traffic engineering. It's important to change the auto-cost reference-bandwidth on Cisco devices so that there is a difference in cost between higher speed interfaces. By default this might be set to 100 Mbit. This would mean that 100 Mbit, gig and 10 gig interfaces would have the same cost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For faster convergence it's good to have equal cost routes (ECMP) so if you are peering iBGP to a loopback you two paths and if one goes down the impact should not be that big.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used to work for a large ISP and they set all the costs manually on the transit interfaces. The basic design was to choose the path that had the fewest core hops. The network was designed with access, distribution and core levels with dual links between each level. If there are multiple paths with same number of core hops then choose the path with the lowest delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So based on this they designed the paths and set costs on the interfaces. This might require a lot of planning. The bad thing about link state protocols is that they only use the bandwidth of the interface to calculate the metric. So you could have a case where the metric is the same but the distance is significantly longer via one of the paths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are talking quite large networks before this would have an impact though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I would design it based on bandwidth, number of devices to go through, physical distance (delay) and of course money could be a factor if one path is more expensive than the other.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-10T22:42:37.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="282" PostTypeId="2" ParentId="280" CreationDate="2013-05-11T03:51:38.327" Score="5" Body="&lt;p&gt;Costing is often used to merge traffic flows together and achieve better utilization of available bandwidth, but costing can also be used to divide traffic and promote symmetry. Consider this campus design in which each building has two distribution switches and two fiber uplinks. A combination of spanning tree root, hsrp and ospf cost provides perfect separation and symmetry across the uplinks. The key to achieving inbound separation lies in costing of the SVIs on the voice and data vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VT8YA.png&quot; alt=&quot;Voice/Data Separation with OSPF&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2013-05-11T04:01:52.563" LastActivityDate="2013-05-11T04:01:52.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="283" PostTypeId="1" AcceptedAnswerId="368" CreationDate="2013-05-11T05:00:26.800" Score="6" ViewCount="3567" Body="&lt;p&gt;My main production environment is in a Dell M1000e blade chassis with M6220 switches in Fabrics B and C.  Fabric B is dedicated to vMotion traffic, and Fabric C is dedicated to iSCSi traffic and connected directly to our SAN.  None of the switches in either Fabric are connected to the rest of the network, so I am unable to monitor them, and I can only manage the configs through the Dell Chassis Management Controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When our consultants set this up two years ago, they configured stacking as follows:&#xA;C1=C2&#xA;B1=B2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to change the stacking configuration so it is looped in the following way:&#xA;B1=C1=C2=B2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I make this change and merge the two stacks, will it change the configs on the switches?  &lt;/p&gt;&#xA;" OwnerUserId="341" LastActivityDate="2013-05-16T15:54:25.747" Title="Changing the Stacking Configuration on four Dell M6220 blade switches" Tags="|dell|powerconnect|stacking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="284" PostTypeId="1" AcceptedAnswerId="289" CreationDate="2013-05-11T08:08:30.230" Score="4" ViewCount="846" Body="&lt;p&gt;I have searched through wireless books and the web which consistently define &lt;em&gt;what&lt;/em&gt; IBSS (ad-hoc, peer-to-peer)  is, but have found no examples on &lt;em&gt;how&lt;/em&gt; to actually implement one. I'd guess that the steps to set up the IBSS depends on both the OS and NIC, but a guide for any concrete IBSS setup, from any vendor, would still be useful. Can anyone explain what must be done to set up a IBSS, or at least point to resources that explain a full implementation of one?&lt;/p&gt;&#xA;" OwnerUserId="366" LastEditorUserId="33" LastEditDate="2013-05-25T17:47:53.900" LastActivityDate="2013-05-25T17:47:53.900" Title="configuring IBSS WLANs" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="285" PostTypeId="2" ParentId="275" CreationDate="2013-05-11T10:24:24.190" Score="8" Body="&lt;p&gt;Running a tunnel over GRE has the added benefit of being pretty much protocol-agnostic, so you can of course use it for IPv6 later on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that said however, there's equally nothing stopping you running 6in4 or ip6ip6 alongside ipip, so the question really comes down to whether there's any tangible gain for you by choosing GRE and using it for multiprotocol.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-05-11T10:24:24.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="286" PostTypeId="2" ParentId="265" CreationDate="2013-05-11T10:31:07.343" Score="7" Body="&lt;p&gt;Cisco offers RA-guard as a means to protect against unprivileged ports sending out rogue RAs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, enabling this alone isn't guaranteed to protect you as there are several attack tools in existence (THC springs to mind) which will split the Router Advertisement into fragments, thereby defeating RA guard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best protection against this is to drop fragmented ICMPv6 packets since, generally speaking, the odds of legitimately needing to fragment an ICMPv6 datagram (aside from a very large ping) are slim to none.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-05-11T10:31:07.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="287" PostTypeId="2" ParentId="277" CreationDate="2013-05-11T11:15:25.423" Score="6" Body="&lt;p&gt;You are correct there is something called FHRP isolation, where you block the messages of your FHRP between the Datacenter and in turn create a Dual active gateway's, one in each DC. The nodes in each DC can egress L3 in it's own DC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my point of view and experience, I recommend everyone doing this to try to minimize the tromboning of traffic between sites. Makes sense that traffic f.ex between vlan in one DC don´t need to traverse to another DC to egress it's L3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now in Cisco world you see this FHRP isolation accompanied with OTV (basically a way to send L2 across L3 without expanding the broadcast domain). I have seen some documentation on doing this with Port ACL's, mac acl on other platforms but can´t find it any more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/DCI/whitepaper/DCI_1.html#wp1186074&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/DCI/whitepaper/DCI_1.html#wp1186074&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/DCI/4.0/EMC/EMC_2.html#wp1261581&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/DCI/4.0/EMC/EMC_2.html#wp1261581&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="381" LastEditorUserId="348" LastEditDate="2013-05-11T21:47:12.227" LastActivityDate="2013-05-11T21:47:12.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="288" PostTypeId="2" ParentId="102" CreationDate="2013-05-11T11:25:12.757" Score="1" Body="&lt;p&gt;Have a look at this : &lt;a href=&quot;http://bradhedlund.com/2010/12/16/routing-over-nexus-7000-vpc-peer-link-yes-and-no/&quot; rel=&quot;nofollow&quot;&gt;http://bradhedlund.com/2010/12/16/routing-over-nexus-7000-vpc-peer-link-yes-and-no/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Might help you :)&lt;/p&gt;&#xA;" OwnerUserId="381" LastActivityDate="2013-05-11T11:25:12.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="289" PostTypeId="2" ParentId="284" CreationDate="2013-05-11T12:27:54.650" Score="5" Body="&lt;p&gt;On Linux for all cards that support it (used to be all, many these days don't) you simply run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iwconfig wlan0 mode Ad-Hoc&#xA;iwconfig wlan0 essid Foo&#xA;iwconfig wlan0 channel 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can do WEP, and apparently even TKIP-based WPA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once configured you can treat it like a classic ethernet bus (Think Coax or 10baseT hubs), with one big caveat, the &quot;hidden node problem&quot;, in ad-hoc there's no repeaters so if two nodes can't make direct radio contact with each other they can't talk (at that layer, you can of course bridge or route at a higher level).&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-11T12:27:54.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="290" PostTypeId="2" ParentId="170" CreationDate="2013-05-11T12:39:25.273" Score="2" Body="&lt;p&gt;One aspect not yet covered by these answers is BGP &quot;add-path&quot; which lets a BGP peer send not only their best route, but some or all of their alternates as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is most useful (as well as likely to work) on iBGP, and gives better ECMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For EBGP if you have multiple sessions to the same peer on a single router you should be using BGP &quot;multipath&quot; to allow ECMP. Depending on how and where route reflection is done in an SP network this can result in using all sessions quite evenly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a presentation from Dave Ward (then at Juniper, now at Cisco) about add-path:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.nanog.org/meetings/nanog48/presentations/Tuesday/Ward_AddPath_N48.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.nanog.org/meetings/nanog48/presentations/Tuesday/Ward_AddPath_N48.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-11T12:39:25.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="291" PostTypeId="2" ParentId="157" CreationDate="2013-05-11T12:51:04.620" Score="4" Body="&lt;p&gt;As long as you buy from the OEM's (probably via a reseller) you're getting the same optics the vendors ship, usually for a small fraction of the price. This lets you spare saving much of the hassle of a support contract &amp;amp; RMA's, which for 1g &amp;amp; 10g optics would probably cost you more in time than just buying a new module. This usually makes third party optics cheaper than first party copper cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finisar &amp;amp; JDSU are the big names, but there are a bunch of others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vendors may claim that their optics are tested for compatability and third party optics may have problems. I've even seen these problems, but sadly for the vendor they rebadged the same optics and we demonstrated the problem with them as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To give you a pricing idea; Digikey, hardly the cheapest option out there have Finisar multimode QSFP modules for US$390 for quantity one (10g SFP+ at $114 and 1g SFP at $42)&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-11T12:51:04.620" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="292" PostTypeId="2" ParentId="202" CreationDate="2013-05-11T12:56:48.910" Score="0" Body="&lt;p&gt;Another option that could give more flexibility is to use QoS and simply PbR based on the queues, if you design it right you even get automatic failover from the primary to the backup, but not the other way round.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That way you can choose to share, or not share, any link or router with a policy change.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-11T12:56:48.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="293" PostTypeId="5" CreationDate="2013-05-11T13:04:35.710" Score="0" Body="&lt;p&gt;Multi-protocol Label Switching (MPLS) is a type of data-carrying technique for high-performance telecommunications networks that directs data from one network node to the next based on short path labels rather than long network addresses, avoiding complex lookups in a routing table. The labels identify virtual links (paths) between distant nodes rather than endpoints. MPLS can encapsulate packets of various network protocols, hence its name &quot;multi-protocol&quot;. MPLS supports a range of access technologies, including T1/E1, ATM, Frame Relay, and DSL.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T18:59:27.927" LastActivityDate="2016-11-29T18:59:27.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="294" PostTypeId="4" CreationDate="2013-05-11T13:04:35.710" Score="0" Body="For questions about Multi-Protocol Label Switching (MPLS), the layer 2.5 protocol used as a transport layer for Traffic Engineering, some Layer 2 &amp; 3 VPN's, and VPLS." OwnerUserId="348" LastEditorUserId="8499" LastEditDate="2016-11-29T18:59:27.927" LastActivityDate="2016-11-29T18:59:27.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="295" PostTypeId="5" CreationDate="2013-05-11T13:10:45.360" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-11T13:10:45.360" LastActivityDate="2013-05-11T13:10:45.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="296" PostTypeId="4" CreationDate="2013-05-11T13:10:45.360" Score="0" Body="For questions about Quality Of Service (QoS); all aspects of providing differential service to packets based on TOS, DSCP, or other information." OwnerUserId="348" LastEditorUserId="8499" LastEditDate="2016-11-29T20:58:55.577" LastActivityDate="2016-11-29T20:58:55.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="297" PostTypeId="1" AcceptedAnswerId="312" CreationDate="2013-05-11T14:38:55.550" Score="8" ViewCount="424" Body="&lt;p&gt;In a interconnection of two datacenters, Is TRILL a long-term solution ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the TRILL implementation of Cisco (FabricPath) interoperable with other manufacturer ?&lt;/p&gt;&#xA;" OwnerUserId="250" LastActivityDate="2013-05-12T11:45:01.423" Title="Questions about datacenter switching and TRILL" Tags="|dci|trill|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="298" PostTypeId="1" AcceptedAnswerId="299" CreationDate="2013-05-11T14:49:17.537" Score="10" ViewCount="20596" Body="&lt;p&gt;Is it okay to use a Cisco 2948 for CCNA students, after all it's cheaper to get these switches and they have more features? Wouldn't this be better than a 2950 switch?&lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="165" LastEditDate="2013-05-13T17:22:01.803" LastActivityDate="2018-05-01T15:55:16.803" Title="I'm setting up a Cisco CCNA lab, what equipment would you recommend?" Tags="|cisco|lab|" AnswerCount="8" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="299" PostTypeId="2" ParentId="298" CreationDate="2013-05-11T14:49:17.537" Score="14" Body="&lt;p&gt;CCNA requires the student to be familiar with the IOS operating system, this makes the Cisco 2948 unusable for a CCNA lab as it runs Catalyst OS (CatOS) and there is &lt;strong&gt;no way&lt;/strong&gt; to upgrade the operating system from CatOS to IOS.  So while it may have  more features, for a pure CCNA lab it's not really usable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I would also recommend the following equipment (if you are not opting for GNS3):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;2 x Cisco 2610XM Advanced  Fast Ethernet 128Mb Dram / 32mb flash IOS 12.4&#xA;Adv Security&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Cisco 1760 Fast Ethernet 64Mb Dram / 32mb flash IOS 12.4 Adv Security&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;3 x WIC-1T for the two 2600 routers&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;2 x Cisco ws2950&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29" LastEditorUserId="29" LastEditDate="2013-05-12T09:33:58.050" LastActivityDate="2013-05-12T09:33:58.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="300" PostTypeId="2" ParentId="297" CreationDate="2013-05-11T17:05:06.220" Score="5" Body="&lt;p&gt;Based on the question I assume you're talking about a L2 DCI...which is pretty widely accepted as a &quot;bad policy&quot; for a multitude of reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BUT assuming you don't care about any of those reasons a good place to start is by saying that FabricPath != Trill. Just like STP != PVSTP and MST/RSTP != RPVST. It's Cisco's proprietary version of what TRILL might deliver, but it is not TRILL. Thus making it inoperable with other vendors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone had a gun to my head and told me to implement a L2 DCI I would use several geographically diverse links and bond them where I can. You might could get away with TRILL if you have devices that actually support the standard.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-11T17:05:06.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="301" PostTypeId="2" ParentId="298" CreationDate="2013-05-11T21:23:07.753" Score="5" Body="&lt;p&gt;For basic familiarity with Catalyst IOS switching, I've often had folks check out the 3550 switch.  It isn't capable of certain features (QoS, Private VLANs, etc); however those don't come into play at the CCNA level.   3550's can be had for pretty cheap on eBay, last I checked, under $100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Also worth noting: if you have a POE 3550, you have to manually configure access ports as trunk ports for separation of voice/data VLANs)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want more functionality and a more recent IOS version, the 3560 can be found for $100-300.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3550's do have QOS capabilities as pointed out in the comments below, see &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk389/tk813/technologies_tech_note09186a00801558cb.shtml&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; document on 3550 QOS setup.  I was meaning that it isn't capable of doing &lt;a href=&quot;http://www.cisco.com/en/US/technologies/tk543/tk545/technologies_white_paper09186a0080123415_ps6558_Products_White_Paper.html&quot; rel=&quot;noreferrer&quot;&gt;MQC&lt;/a&gt; style QOS.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-05-11T23:21:44.240" LastActivityDate="2013-05-11T23:21:44.240" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="302" PostTypeId="2" ParentId="298" CreationDate="2013-05-11T21:24:55.967" Score="8" Body="&lt;p&gt;&lt;a href=&quot;http://www.certskills.com/LabGear/CCNA/BuildLists.aspx&quot;&gt;Wendell Odom's website&lt;/a&gt; has a lot of great info, including lab equipment recommendations for CCNA and CCNP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also started a &lt;a href=&quot;http://forums.whirlpool.net.au/forum-replies.cfm?t=1453284&quot;&gt;Whirlpool thread&lt;/a&gt; a few years ago for those studying for the CCNA and CCNP certs. There is a lot of great info in there. We also turned it in to a &lt;a href=&quot;http://whirlpool.net.au/wiki/cisco_certification_links&quot;&gt;wiki&lt;/a&gt; as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're wanting to save a bit of money, you can use GNS3 for the routers and then just buy some switches. I have written &lt;a href=&quot;http://myciscolabs.blogspot.com.au/2013/05/new-website-launch-ultimate-cisco-lab.html&quot;&gt;a few blog posts&lt;/a&gt; about how you can connect virtual equipment to physical equipment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I prefer the virtual router + physical switch approach over the full physical lab as it saves money, energy and power points :) It's also good because you can take your virtual router topologies with you everywhere you go.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2013-05-11T21:24:55.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="303" PostTypeId="1" AcceptedAnswerId="377" CreationDate="2013-05-11T21:56:33.867" Score="8" ViewCount="6282" Body="&lt;p&gt;I am in the process of re-ip addressing a large number of remote locations, all of which are using a Cisco GET VPN/GDOI configuration for encryption of the traffic.  In the process, I also wanted to review the configuration to ensure we were following best-practices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been over the Cisco &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_getvpn/configuration/15-2mt/sec-get-vpn.html&quot; rel=&quot;nofollow&quot;&gt;GET VPN config guide&lt;/a&gt; and &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6635/ps7180/deployment_guide_c07_554713.html&quot; rel=&quot;nofollow&quot;&gt;Deployment Guide&lt;/a&gt;, but haven't found a good answer to this question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is it best practice to use a loopback or physical interface as the terminating interface of the encrypted traffic?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently the configuration uses the physical Gig0/0 interface to terminate the encrypted traffic.  However to simplify some of the other changes involved, I would like to utilize the Loopback0 interface for that purpose.  Down the road, some of these sites would be getting redundant uplinks, and my understanding is that I could use the Loopback interface to terminate both encrypted connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are two samples, the existing configuration and how I understand I would have to set the router up to use the Loopback.  I believe I would only have to add the following command to the GM: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;crypto map %MAPNAME local-address Loopback0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The GM address would then also have to be changed on the Key Server; to my knowledge, that is the only change on the KS.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;A sample of the existing confiuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;crypto isakmp policy 10&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key %KEY address 10.100.1.1&#xA;crypto isakmp key %KEY address 10.100.2.1&#xA;!&#xA;crypto ipsec df-bit clear&#xA;crypto gdoi group GDOI-MPLS-GROUP-10&#xA; identity number 10&#xA; server address ipv4 10.100.1.1&#xA; server address ipv4 10.100.2.1&#xA;!&#xA;crypto map CM-STATIC-MAP 10 gdoi &#xA; set group GDOI-MPLS-GROUP-10&#xA;!&#xA;interface Loopback0&#xA; ip address 10.129.110.125 255.255.255.252&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description MPLS-Connection&#xA; ip address 10.101.44.2 255.255.255.248&#xA; ip virtual-reassembly&#xA; ip tcp adjust-mss 1300&#xA; duplex full&#xA; speed 100&#xA; no cdp enable&#xA; crypto map CM-STATIC-MAP&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;A sample using the loopback as the terminating interface: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;crypto isakmp policy 10&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key %KEY address 10.100.1.1&#xA;crypto isakmp key %KEY address 10.100.2.1&#xA;!&#xA;crypto ipsec df-bit clear&#xA;crypto gdoi group GDOI-MPLS-GROUP-10&#xA; identity number 10&#xA; server address ipv4 10.100.1.1&#xA; server address ipv4 10.100.2.1&#xA;!&#xA;crypto map CM-STATIC-MAP local-address Loopback0&#xA;crypto map CM-STATIC-MAP 10 gdoi &#xA; set group GDOI-MPLS-GROUP-10&#xA;!&#xA;interface Loopback0&#xA; ip address 10.129.110.101 255.255.255.252&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description MPLS-Connection&#xA; ip address 10.101.24.2 255.255.255.248&#xA; ip tcp adjust-mss 1300&#xA; duplex full&#xA; speed 100&#xA; no cdp enable&#xA; crypto map CM-STATIC-MAP&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;" OwnerUserId="44" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:10.190" LastActivityDate="2013-08-16T13:30:35.477" Title="Cisco GET VPN Configuration - Best Practices/Can the loopback be used?" Tags="|cisco|vpn|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="304" PostTypeId="2" ParentId="259" CreationDate="2013-05-11T23:16:04.587" Score="7" Body="&lt;p&gt;I think it's important to separate two different goals here:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Dealing with IPv6 enablement. The main issues with this goal usually has to do with equipment in your network not supporting IPv6, and you have to use some kind of tunneling/transport solution to bypass those elements. 6rd and 6PE are very popular.&lt;/li&gt;&#xA;&lt;li&gt;On the other side there are strategies to face IPv4 address depletion. The only way to solve this issue is implementing some kind of NAT (carrier grade NAT, DSLite, NAT64...)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Some technologies solve the first issue, some solve the second one, and some solve both of them.&lt;/p&gt;&#xA;&lt;p&gt;Everything is evolving very quickly and you have to watch out for new solutions arising. For example. One solution that is taking a lot of attention lately is MAP-E and MAP-T, which are currently in draft status (MAP-E is close to becoming RFC) and allow you to implement IPv6 and solve IPv4 address exhaustion in a very smart way. You can get more information at &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-softwire-map-06&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://datatracker.ietf.org/doc/html/draft-ietf-softwire-map-06&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;To get more detailed information, I'd need to know the context and the requirements. I mean, solutions depend on the kind of network (a Service Provider is very different to a content provider or a small business network) and the goal you're trying to achieve.&lt;/p&gt;&#xA;&lt;p&gt;Kind regards,&lt;/p&gt;&#xA;&lt;p&gt;Diego Nuevo&lt;/p&gt;&#xA;" OwnerUserId="390" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-05-11T23:16:04.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="305" PostTypeId="2" ParentId="233" CreationDate="2013-05-12T00:01:14.113" Score="3" Body="&lt;p&gt;Packets should be classified regardless of the TCP handshake being watched or not. If there isn't a session defined for that flow (fast path) a new one should be created (first path).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any screen configured?? Maybe it's the screen that's dropping the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More details on &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB16110&quot; rel=&quot;nofollow&quot;&gt;Troubleshooting Traffic Flows and Session Establishment&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe you can configure a log file with traceoptions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;security {&#xA;  flow {&#xA;        traceoptions {&#xA;            file trace_file;&#xA;            flag basic-datapath;&#xA;            packet-filter Match {&#xA;                protocol tcp;&#xA;                source-prefix &amp;lt;source-ip&amp;gt;;&#xA;                destination-prefix &amp;lt;dest-ip&amp;gt;;&#xA;                destination-port &amp;lt;tcp-port&amp;gt;;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Beware of these traces, since it can cause high CPU load on the SRX if it's carrying a lot of traffic. Limit the filter as much as possible and run it during a maintenance window.&lt;/p&gt;&#xA;" OwnerUserId="390" LastEditorUserId="775" LastEditDate="2013-05-29T20:27:25.527" LastActivityDate="2013-05-29T20:27:25.527" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="306" PostTypeId="1" AcceptedAnswerId="311" CreationDate="2013-05-12T01:13:33.420" Score="6" ViewCount="345" Body="&lt;p&gt;Is it possible to configure Cisco NCS/Prime Infrastructure to send reports via email without encapsulating them in a zip?&lt;/p&gt;&#xA;" OwnerUserId="91" LastActivityDate="2013-05-12T07:38:32.790" Title="Sending Cisco NCS/Prime Infrastructure reports without encapsulating them in a zip" Tags="|cisco|wireless|management|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="307" PostTypeId="2" ParentId="306" CreationDate="2013-05-12T01:16:17.383" Score="4" Body="&lt;p&gt;As of Cisco Prime Infrastructure 1.3 (which is the latest version of WCS/NCS), this is not possible. I have heard that many people have asked Cisco about this, but reports sent via email still must be encapsulated in a zip file.&lt;/p&gt;&#xA;" OwnerUserId="91" LastActivityDate="2013-05-12T01:16:17.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="308" PostTypeId="2" ParentId="298" CreationDate="2013-05-12T03:55:54.143" Score="7" Body="&lt;p&gt;One of the best ways to get a lab for the CCNA is to get your hands on a copy of the Packet Tracer utility used in the Cisco Networking Academy courses.  It contains the full spectrum of &quot;equipment&quot; and commands you will need.  However, I don't know if there's another legit way to get it other than enrolling in the course itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One other thing to note as well, if you are on a tight budget, don't worry about an expensive switch that can do QOS and Layer 3 because the CCNA focuses on nothing above layer 2 and nothing really fancy (no QinQ, etc).  VTP and (Rapid) Spanning Tree will be about the most &quot;complicated&quot; switching topics you'll have.  Given this, a 2950 will serve you well and you can get those for less than $50 a pop on ebay.&lt;/p&gt;&#xA;" OwnerUserId="393" LastEditorUserId="348" LastEditDate="2013-05-13T02:46:07.560" LastActivityDate="2013-05-13T02:46:07.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="309" PostTypeId="2" ParentId="298" CreationDate="2013-05-12T04:38:32.853" Score="9" Body="&lt;p&gt;One thing to bear in mind with the CCNA is that the vast majority of the things you need to play with are trivially done in Cisco Packet Tracer and GNS3 (especially since you can now get a switchport card working in GNS3 now). However, with that said, depending on how you learn, you might prefer to work with a physical setup, and if that's within your budget, go for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, I'd definitely recommend &lt;em&gt;against&lt;/em&gt; foregoing any sort of usage of PT/GNS3, not least because something like GNS3 can actually be used to augment your lab setup - hook it up to your physical gear and run wild.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-05-12T04:38:32.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="310" PostTypeId="1" AcceptedAnswerId="326" CreationDate="2013-05-12T07:25:18.223" Score="10" ViewCount="14999" Body="&lt;p&gt;In all the detail on DSSS and OFDM, I have missed which characterics of DSSS and OFDM make these distinct technologies. Nothing I've read appears to contrast the two. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand it, both DSSS and OFDM are intended to send many bits in parallel. DSSS spreads data across a channel for redundancy, and the books say that bits are sent in parallel. OFDM divides a channel into &quot;subcarriers&quot; and likewise sends bits in parallel. This might suggest the main difference between the two, that DSSS somehow sends data in parallel on a single carrier, whereas OFDM accomplishes this with multiple carriers. Either way, both take up more bandwidth than 1 signal, so I don't get how they're much different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should a network engineer know, about how DSSS and OFDM are fundamentally different from each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: According to the current CWNA book, OFDM is not a spread spectrum technology.&lt;/p&gt;&#xA;" OwnerUserId="366" LastEditorUserId="366" LastEditDate="2013-05-13T05:10:30.083" LastActivityDate="2021-05-30T13:30:43.080" Title="what to know about DSSS vs OFDM" Tags="|wireless|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="311" PostTypeId="2" ParentId="306" CreationDate="2013-05-12T07:38:32.790" Score="5" Body="&lt;p&gt;I have requested the same thing, and been told that they must be zipped. No real explanation why this must be the case, but there weren't any hints that things were going to change any time soon!&lt;/p&gt;&#xA;" OwnerUserId="152" LastActivityDate="2013-05-12T07:38:32.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="312" PostTypeId="2" ParentId="297" CreationDate="2013-05-12T07:46:34.130" Score="13" Body="&lt;p&gt;There are three TRILL-ish implementations out there that I'm aware of:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;FabricPath from Cisco - correct routing protocol (IS-IS), wrong encap format;&lt;/li&gt;&#xA;&lt;li&gt;VCS Fabric from Brocade - correct encap format, wrong routing protocol (FSPF);&lt;/li&gt;&#xA;&lt;li&gt;TRILL from HP - seems to be OK&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So there is at the moment ZERO inter-vendor interoperability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And as others said - if someone held a gun to my head and told me to do L2 DCI, I would try to use OTV first (it's also available on ASR 1K), failing that, TRILL would be second least horrible option.&lt;/p&gt;&#xA;" OwnerUserId="317" LastActivityDate="2013-05-12T07:46:34.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="313" PostTypeId="2" ParentId="298" CreationDate="2013-05-12T08:34:21.280" Score="6" Body="&lt;p&gt;I just got my CCNA not more than 2 wks ago, and the only hardware I purchased was a C2950 for $30. Everything else was virtual. Both GNS3 and Packet Tracer are helpful overall, but neither is without its bugs. I preferred GNS3, simply because it's easier to connect a virtual GNS3 network to real hardware (like my C2950), or arbitrary virtual hosts (like Qemu or VMWare guests). But I will say this: doubt instead of trust in the correctness of the simulation software can really slow down your learning.The actual C2950 hardware either worked as expected, or somewhere I made a mistake. But with GNS3 for example, you have to ask yourself whether you made a mistake or the software did.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For maximum reliability, buy the real hardware if your budget allows. Expect to spend a fair amount of time figuring out how to get GNS3 to work, and handling exceptions. But even with the faults of the emulators, it's a good idea to consider GNS3 because it's possible to create all kinds of near-realistic scenarious quickly and cheaply.&lt;/p&gt;&#xA;" OwnerUserId="366" LastActivityDate="2013-05-12T08:34:21.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="314" PostTypeId="2" ParentId="297" CreationDate="2013-05-12T10:44:57.563" Score="-2" Body="&lt;p&gt;TRILL strikes me as something that is barking up the wrong tree; it's costly in terms of both system resources and the complexity of hardware required to support it since it requires a total do-over of a switch architecture from the usual 802.1 standards to the new &quot;RBridge&quot; which totally redefines the behaviour one would be accustomed to from Ethernet frames: for example, your L2 forwarding hardware now has to care about a hop count, making L2 behave more like L3, this is quite costly in terms of hardware since a plain old switching ASIC won't cut it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better solution (in my opinion, I should add) is 802.1aq AKA SPB or Shortest Path Bridging - developed by the IEEE rather than the IETF, the primary benefit of SPB is that, unlike TRILL, it doesn't require Layer 3-like hardware forwarding capabilities in order to operate. In this respect, FabricPath is more akin to SPB than TRILL since it is still sitting on top of plain old Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, My bet is that SPB is the protocol that's more likely to be picked up by vendors and have a better shot at being widely interoperable in the way that MST is today.&lt;/p&gt;&#xA;" OwnerUserId="378" LastEditorUserId="378" LastEditDate="2013-05-12T11:45:01.423" LastActivityDate="2013-05-12T11:45:01.423" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="315" PostTypeId="2" ParentId="297" CreationDate="2013-05-12T11:18:58.690" Score="1" Body="&lt;p&gt;With regard to whether TRILL is a viable DCI technology, I'm not sure.&#xA;When I last checked the TRILL WG wasn't chartered to work on cross data center TRILL solutions although the following draft shows what such a solution &amp;quot;could&amp;quot; look like &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-aldrin-trill-data-center-interconnect-00&quot; rel=&quot;nofollow noreferrer&quot;&gt;draft-aldrin-trill-data-center-interconnect-00&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Increasing the size of the TRILL domain has some scalability issues (nickname exhaustion to name one) and also increases the size of the failure domain. For DCI I would look at some of the more tried/tested models (VPLS for example) and I'd be tempted to leave each DC in it's own TRILL domain.&lt;/p&gt;&#xA;" OwnerUserId="396" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-05-12T11:18:58.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="316" PostTypeId="5" CreationDate="2013-05-12T11:40:46.967" Score="0" Body="&lt;p&gt;This tag should be used for anything directly related to Data Center Interconnect from general design and best practice questions to detailed configuration questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some example technologies used in DCI are Dark Fibre, Coarse Wavelength-Division Multiplexing (CWDM), Dense Wavelength-Division Multiplexing (DWDM), Virtual Private LAN Service (VPLS) and Multi-Protocol Label Switching Virtual Private Networks (MPLS VPNs).&lt;/p&gt;&#xA;" OwnerUserId="396" LastEditorUserId="396" LastEditDate="2013-05-13T02:46:27.513" LastActivityDate="2013-05-13T02:46:27.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="317" PostTypeId="4" CreationDate="2013-05-12T11:40:46.967" Score="0" Body="Data Center Interconnect. The act of interconnecting two or more data centers." OwnerUserId="396" LastEditorUserId="396" LastEditDate="2013-05-13T02:46:21.903" LastActivityDate="2013-05-13T02:46:21.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="318" PostTypeId="5" CreationDate="2013-05-12T11:46:13.677" Score="0" Body="&lt;p&gt;This tag is a catch all for questions related to HP's products.&#xA;Questions should use a more specific tag if available, such as &lt;a href=&quot;/questions/tagged/hp-procurve&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;hp-procurve&amp;#39;&quot; rel=&quot;tag&quot;&gt;hp-procurve&lt;/a&gt;, &lt;a href=&quot;/questions/tagged/hp-comware&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;hp-comware&amp;#39;&quot; rel=&quot;tag&quot;&gt;hp-comware&lt;/a&gt;, &lt;a href=&quot;/questions/tagged/hp-virtualconnect&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;hp-virtualconnect&amp;#39;&quot; rel=&quot;tag&quot;&gt;hp-virtualconnect&lt;/a&gt;, &lt;a href=&quot;/questions/tagged/hp-servers&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;hp-servers&amp;#39;&quot; rel=&quot;tag&quot;&gt;hp-servers&lt;/a&gt;, &lt;a href=&quot;/questions/tagged/hp-blades&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;hp-blades&amp;#39;&quot; rel=&quot;tag&quot;&gt;hp-blades&lt;/a&gt; etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information on HP's networking portfolio, head over to &lt;a href=&quot;http://www.hp.com/networking&quot; rel=&quot;nofollow noreferrer&quot;&gt;hp.com&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="396" LastEditorUserId="31801" LastEditDate="2018-11-06T21:15:25.127" LastActivityDate="2018-11-06T21:15:25.127" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="319" PostTypeId="4" CreationDate="2013-05-12T11:46:13.677" Score="0" Body="Hewlett Packard Enterprise is a manufacturer of network devices including the former ProCurve series (ProVision) and former 3Com products (Comware). Please consider using a more specific tag; see the tag wiki for some options." OwnerUserId="36720" LastEditorUserId="31801" LastEditDate="2018-11-06T21:15:30.633" LastActivityDate="2018-11-06T21:15:30.633" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="320" PostTypeId="2" ParentId="298" CreationDate="2013-05-12T12:17:21.370" Score="4" Body="&lt;p&gt;Packet Tracer and GNS3 are highly recommended based on the fact that you can get them at no cost. When using Packet Tracer it is also quite useful in familiarising yourself with what the exams sims are like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if you can afford it there's nothing like getting your hands on real kit and getting used to the different physical cables, especially if you don't currently work as an engineer.  As the CCNA requires you to know stuff about the kit like how it boots, flash, moving config &amp;amp; IOS files around from tftp etc, then if you have some real kit you can take a look inside and have a go at upgrading the flash for example, which really helps the theory click into place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2500 series &amp;amp; 2950 Cat switches are probably the cheapest option that will do it but if you are serious about certification and want to go beyong CCNA level then you'll want to consider building your lab for the future.  So if you can afford it i'd recommend some 1841's for your routers as they are really reasonably priced nowadays on eBay and then (again if you can afford it) get some 3350 switches which you can then load IOS capable of L3 switching and routing protocols. &lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2013-05-12T12:17:21.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="321" PostTypeId="2" ParentId="170" CreationDate="2013-05-12T12:18:45.890" Score="2" Body="&lt;p&gt;Typically, BGP peers can only send a single path to eachother, with any updates for that path replacing the existing one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there is an extension to BGP, typically known as &lt;code&gt;additional-paths&lt;/code&gt; which puts an identifier on each route sent to a peer and thus enables BGP peers to exchange multiple routes to a path, thereby giving you not only a greater scope for traffic engineering, but also a reduced convergence time in the event of path withdrawal since the non-bestpath prefix(es) can be installed in the FIB as a backup route(s) that will be used the moment the bestpath gets withdrawn - this is particularly significant if you're running full internet tables as the BGP scanner on a Cisco router will run every 30 seconds at best and walking over 300,000 routes takes its toll.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that BGP additional-paths has nothing to do with ECMP since obviously, we're talking about receiving multiple prefixes with the same next-hop - with the only exception being cases where you're running iBGP and &lt;strong&gt;not&lt;/strong&gt; using &lt;code&gt;next-hop-self&lt;/code&gt; (or doing dirty things with eBGP where the nexthop is preserved)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since it is an extension, both routers must support it and negotiate the feature at connection time (or alternatively, have negotiated dynamic capability). It is usable with both eBGP and iBGP.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-05-12T12:18:45.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="322" PostTypeId="1" AcceptedAnswerId="323" CreationDate="2013-05-12T14:49:39.987" Score="8" ViewCount="2034" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/CeDXN.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;br&gt;&#xA;A customer was recently adamant to perform redistribution of their RIPv2 routes into BGP.  This is over a standard MPLS VPN solution whereby the CE routers are fully managed.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This approach feels cumbersome and sub-optimal.  I would prefer to opt for BGP network statements on the CE routers to advertise routes to the various subnets on the Customers LAN but can anyone provide pros &amp;amp; cons regarding this scenario?&lt;/p&gt;&#xA;" OwnerUserId="109" LastEditorUserId="109" LastEditDate="2013-05-12T15:52:51.533" LastActivityDate="2013-05-12T15:52:51.533" Title="Does RIP to BGP redistribution for an MPLS VPN make sense?" Tags="|bgp|redistribution|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="323" PostTypeId="2" ParentId="322" CreationDate="2013-05-12T15:04:45.103" Score="11" Body="&lt;p&gt;I don't guess there's any real reason it can't work just fine.  You, of course, have the normal loss of information anytime you redistribute from one protocol into another, but there's an argument to be made that you get that when you use network statements as well, so that's kind of a wash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main benefit that I see in this is that redistribution would give the setup the ability to react more dynamically to what happens in their network than the more static network statements.  The downside would be that that dynamicism (is that a word?) would be harder to keep in control and might end up doing things that you don't want it to do.  Of course you can put filters and route-maps and the like to constrain the redistribution...but then that's kinda like putting the network statements in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not that I would advocate being deceptive in what you're delivering to a customer, but if its fully managed CEs...would they even know the difference?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming you're only talking about a handful of /24's like your diagram would suggest, I just don't think it makes all that much difference one way or the other.  If you set up the redistribution to only allow the /24s, or set up network statements to advertise /24s...ultimately it ends up pretty much the say, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What may be the even bigger question that I would have (tongue-in-cheek), is...who uses RIPv2 in this day and age?!&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-05-12T15:04:45.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="324" PostTypeId="1" CreationDate="2013-05-12T15:31:14.587" Score="8" ViewCount="832" Body="&lt;p&gt;Traditional data center architectures centralize the routing. All inter-vlan traffic must transit the core, even when hosts share a network access point. It would be more efficient to perform inter-vlan routing at the network edge. One could route at the edge, but there is a requirement to retain a single L2 domain across the core. Are there any data center architectures that deliver distributed L3 forwarding in a single L2 domain?&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-13T05:42:59.987" Title="Distributed L3 Switching" Tags="|architecture|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="325" PostTypeId="2" ParentId="243" CreationDate="2013-05-12T19:41:02.500" Score="2" Body="&lt;p&gt;I think that any switch you run FCoE on has to support 802.1Qbb - priority based flow control, which allows Ethernet to act lossless much like FC.&lt;/p&gt;&#xA;" OwnerUserId="322" LastActivityDate="2013-05-12T19:41:02.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="326" PostTypeId="2" ParentId="310" CreationDate="2013-05-12T22:40:13.230" Score="10" Body="&lt;p&gt;From what I've gathered, the primary differentiation between DSSS and OFDM comes in a congested or constrained RF environment.  Because DSSS is transmitting as many bits as possible all at once, it runs the risk of having some of the transmission disrupted in transit should the RF become less than ideal.  In contrast, OFDM sacrifices a bit of performance to transmit the data in those multiple carrier &quot;packets&quot; that allow for reassembly or retransmission in the event of a failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I use an extra-large semi truck to haul freight, it works well so long as the highway doesn't have any obstructions (like narrow lanes or short overpasses).  If I break my freight up into a greater number of smaller trucks, I can ensure that some of the freight arrives even if conditions (like a traffic jam) prevent the entire shipment from arriving.&lt;/p&gt;&#xA;" OwnerUserId="71" LastActivityDate="2013-05-12T22:40:13.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="327" PostTypeId="1" AcceptedAnswerId="331" CreationDate="2013-05-12T23:50:33.770" Score="10" ViewCount="3635" Body="&lt;p&gt;This &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/prod_white_paper0900aecd806a1a3e.html&quot;&gt;article&lt;/a&gt; on Cisco's website is the clearest explantion of omnidirectional antennas I've found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What isn't so clear to me is...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Why is the dipole antenna the most common design for omnidirectional antennas?&lt;br&gt;&#xA;2) For example, why not have an antenna that has a power source on one end, and then emits current to the other end?&lt;br&gt;&#xA;3) Also, why does the radiation pattern (given on the linked page) take an odd spherical-like shape, instead of say, a cylinder?  &lt;/p&gt;&#xA;" OwnerUserId="366" LastEditorUserId="49" LastEditDate="2013-05-13T14:36:26.647" LastActivityDate="2013-05-13T15:02:03.747" Title="omnidirectional antennas and the dipole antenna" Tags="|wireless|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="328" PostTypeId="1" AcceptedAnswerId="329" CreationDate="2013-05-13T00:16:22.427" Score="14" ViewCount="15139" Body="&lt;p&gt;It is said that wireless is a half-duplex medium. &quot;Dual-band&quot; stations are now common, with one antenna in the 2.4 GHz band, and the other in the 5GHz band. Suppose now we have stations with both antennas in, say, the 5GHz band, but on different channels, would full-duplex communication be possible?&lt;/p&gt;&#xA;" OwnerUserId="366" LastActivityDate="2019-12-02T09:21:19.940" Title="Full-duplex with two antennas" Tags="|wireless|" AnswerCount="7" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="329" PostTypeId="2" ParentId="328" CreationDate="2013-05-13T00:54:44.557" Score="13" Body="&lt;p&gt;A while back I read several articles about researchers using signal inversion cancellation to achieve full-duplex wireless. With a quick google search I found the below links to similar articles to the ones I read back when.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TLDR;&#xA;It's for sure possible...though I think they're using signal inversion cancellation instead of two channels (I.E. two different frequencies). People are working on it. Only a matter of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://sing.stanford.edu/fullduplex/&quot;&gt;http://sing.stanford.edu/fullduplex/&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.computerworld.com/s/article/9219752/Rice_demonstrates_full_duplex_wireless_technology&quot;&gt;http://www.computerworld.com/s/article/9219752/Rice_demonstrates_full_duplex_wireless_technology&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd love to get a true RF engineers thoughts on this though. I'm by no means an RF guy.&lt;/p&gt;&#xA;" OwnerUserId="287" LastEditorUserId="287" LastEditDate="2013-05-13T00:59:59.843" LastActivityDate="2013-05-13T00:59:59.843" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="330" PostTypeId="2" ParentId="324" CreationDate="2013-05-13T01:22:21.993" Score="7" Body="&lt;p&gt;More than likely you'd have to go with one of the newer overlay networks or using Plexxi's switches. I'm sure you could find some way of doing this through traditional means, but I'm not sure how stable it would be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L3 at TOR is for sure not uncommon. Most larger DCs (Google's, Facebook's) run L3 to the TOR, but they also have phenomenally written applications that don't require VMotion/L2 to recover from failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds though that your requirements are more SMB and similar pain points for most virtualized DCs. If it's a greenfield deployment I would strongly suggest looking at Plexxi's offering. If not then an overlay might be the right thing for you.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-13T01:22:21.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="331" PostTypeId="2" ParentId="327" CreationDate="2013-05-13T02:58:24.597" Score="9" Body="&lt;p&gt;The dipole antenna is the most common because it is inherently simple and very inexpensive to produce.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your example, doesn't make much sense, beause that is exactly what is done with all antennas.  You have a power source (the transmitter) on one end.  The signal is radiated based on the shape of the antenna and any characteristics of the antenna to focus the signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to why a dipole emits an &quot;odd spherical-like shape&quot; (often referenced as a toroid or doughnut), that is a relatively simple concept.  A dipole antenna is often just a straight piece of wire.  The amount of surface area available directly relates to how much signal is transmitted in any direction.  You have a much larger surface area around the lenght of the wire than you do at the tip or base, allowing much more signal to be radiated from the sides.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-13T02:58:24.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="333" PostTypeId="2" ParentId="324" CreationDate="2013-05-13T04:43:24.223" Score="5" Body="&lt;p&gt;HP's IRF has some resemblance to what you're talking about, although possibly not in the way you're suggesting.  It presents a single system image, but the switching and routing is distributed amongst its nodes.  So if routing is enabled and the switch knows from ARP &amp;amp; MAC tables that the destination is on the same switch, it doesn't traverse the IRF stack's backbone.  But that's more like having a distributed core than having a two- or three-layer architecture.&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-05-13T04:43:24.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="334" PostTypeId="2" ParentId="259" CreationDate="2013-05-13T05:16:04.763" Score="7" Body="&lt;p&gt;IPv6 migration at a high level?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Enable IPv6 throughout the network, until IPv6 capabilities and connectivity are on par with IPv4.&lt;/li&gt;&#xA;&lt;li&gt;Wait for the day to come when IPv4 is no longer relevant.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now for the low-level:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get a prefix (ideally from an RIR) and get it announced, I'd recommend OSPFv3 for your IGP unless you happen to be running a large flat network that you feel IS-IS is better suited to. If you have legacy equipment that is IPv4 only, consider getting around that by doing 6in4 or GRE tunnels across the equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a plan for address management, IPv6 space is &lt;strong&gt;not&lt;/strong&gt; precious, if you have a /32 and you think customers will be wanting something larger than a /64, route sufficient space up to your equipment; if a single router or router pair serves 100 customers and each one gets a /56, your IGP should &lt;strong&gt;not&lt;/strong&gt; contain each /56 - allocate a /48 for that router (pair) and you're done. The IPv6 space is so huge that subnet fragmentation should never be necessary if you're doing it right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure that all of the services you run are dual-stacked, be that DNS, e-mail, whatever - in the majority of cases it's as simple as ensuring the service is configured to listen on v6 and your DNS has an AAAA record. If you provide hosting services, servers etc, be &lt;em&gt;proactive&lt;/em&gt; about informing people they can dual-stack their offerings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start getting familiar with technologies that will prevent disaster when you have no IPv4 space and cannot get any more of it either - keep a finger on the pulse of things like NAT64 and 464XLAT so that when the time comes, you can determine the viability of having IPv6 only hosts vs. using RFC6598 space and NAT44(4). Setup a lab, experiment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then? &lt;s&gt;Wait for&lt;/s&gt; Encourage the IPv4 wind-down.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-05-13T05:16:04.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="335" PostTypeId="2" ParentId="324" CreationDate="2013-05-13T05:42:59.987" Score="11" Body="&lt;p&gt;A lot of the content in this question is very Cisco-ish, let's dial that back and dispel some mythical assumptions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;1. I need to do Layer 2 at the core&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not unless that's all your hardware is capable of; you could quite freely have point-to-point (links/portchannels) between everything in your core and bring up OSPF/ISIS adjacencies, this is arguably superior to a large L2 domain at the core since you're now precluded from inflicting L2 loop prevention upon yourself; topology changes are now going to be handled by your IGP. If you need to multipath, ECMP takes the place of things like GLBP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;2. Traditional DC architecture centralizes routing&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depends what you mean by &quot;Tradition&quot; - IPv4 is &lt;em&gt;&quot;traditionally&quot;&lt;/em&gt; classful, modern IPv4 is not. In the same vein, a modern datacenter architecture will make the vast majority of non-access links between equipment pass traffic over L3, because from a security and performance standpoint, you want to mimimize the size of your broadcast domains and avoid reliance on L2 loop prevention which tends to impact traffic flow for significantly longer periods than an L3 protocol when a topology change happens (recent development such as SPB and TRILL not withstanding)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;3. Traffic between broadcast/multipoint domains must happen at the Core&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, this is down to the hardware you have; if your distribution layer is capable of L3 forwarding on par with your core and also happens to be the termination point for the particular domains you wish to route traffic between, there's no logical reason to send that traffic up to the core only to have it sent back down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, with all this in mind, why do large, flat L2 networks remain so pervasive? Because it's &quot;simple&quot; and doesn't require too much thought. Setting up multi-area OSPF and ensuring optimum paths throughout the network by configuring link costs appropriately makes for an excellent architecture, but it requires you to think. spinning up a few VLANs, using something like GLBP and letting spanning tree just &quot;do its thing&quot; does not. The real WTF however is that a decent L2 setup should have a well-thought out STP configuration just as OSPF should.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-05-13T05:42:59.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="336" PostTypeId="2" ParentId="275" CreationDate="2013-05-13T08:50:30.077" Score="0" Body="&lt;p&gt;If you're planning to load the link to its full capacity - go with IPinIP. Otherwise - GRE.&lt;/p&gt;&#xA;" OwnerUserId="398" LastActivityDate="2013-05-13T08:50:30.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="337" PostTypeId="2" ParentId="195" CreationDate="2013-05-13T10:45:44.720" Score="5" Body="&lt;p&gt;I had a similar requirement &lt;em&gt;many&lt;/em&gt; moons ago with a remote router running IOS. Ended up using tcp-small-servers chargen service on router - runs on tcp/19. It will generate a stream of random characters etc. and can be scaled out using multiple telnet sessions from the remote router to other routers running chargen. Nowhere near the rich control/functionality of host based iperf tests. Also as we know ASA does not support telnet locally so this won't work here...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA does have that packet tracer utility since 7.0 to generate interesting traffic for tunnel configs but doesn't allow rate tuning. Such functionality would also be an interesting attack vector if exploited remotely and at scale... Any such native functionality on ASA would likely peg the control plane and any variety of inherent control plane policing would need to restrict the generated traffic rate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I agree with above that Raspberry Pi is a good solution here. We just dropped some in to drive NOC style screens. They're awesome.&lt;/p&gt;&#xA;" OwnerUserId="401" LastActivityDate="2013-05-13T10:45:44.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="338" PostTypeId="2" ParentId="328" CreationDate="2013-05-13T14:35:25.813" Score="6" Body="&lt;p&gt;If you're using two different channels then that would be two half-duplex connections, not a full-duplex connection.  This is what MIMO does, multiple frequencies on multiple antennas operating simultaneously to increase throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/MIMO&quot;&gt;http://en.wikipedia.org/wiki/MIMO&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@bigmstone has the answer for wireless full-duplex, sending and receiving simultaneously on the same frequency, it's being researched but nothing is in production yet.&lt;/p&gt;&#xA;" OwnerUserId="165" LastActivityDate="2013-05-13T14:35:25.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="339" PostTypeId="2" ParentId="327" CreationDate="2013-05-13T14:44:10.537" Score="5" Body="&lt;p&gt;Q1: A simple dipole antenna emits radiation most strongly perpendicular to the axis of the antenna. It emits very little out the ends. The antenna has no power variation in the circular direction around it's &quot;waist.&quot; (This is simply the nature of electro-magnetism.) This radiation pattern matches the most common usage pattern -- the various other receivers/transmitters are situated at about the same height when the antenna is oriented vertically. When you factor in that dipoles are easy to construct (they are physically simple structures and electrical systems), they become an obvious choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2: What you suggest is exactly a dipole antenna. Note that a textbook dipole antenna is TWO wires, in a straight line, with the transmitter/receiver connected to the near ends of the wires. If you just have one wire, with a trans/rec connected to one end, you still have (in term of the E&amp;amp;M theory) a dipole antenna -- it's less efficient, but even easier to construct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note that I'm really glossing over the E&amp;amp;M theory here. In reality, a trans/rec has two connections by definition. Whatever is in the trans/rec has two electrical sides. For best efficiency, you connect them to the two sides of a dipole antenna. You &lt;strong&gt;can&lt;/strong&gt; leave one side disconnected -- but that's just a really small second side for the E&amp;amp;M purposes, giving you an &lt;em&gt;unbalanced&lt;/em&gt; antenna. An example of a really cheap dipole setup was the older car antennas: Straight wire sticking up, with the radio receiver connected to the wire and the other side to the car's ground. So the whole metal car was the other side of the antenna.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3: That cisco page has information on different types of antennas. An &lt;em&gt;omni&lt;/em&gt; directional antenna would be as you described: The distance from the antenna for a given intensity would be a circle. (The pattern is called a Toroid.) The diagram you're asking about shows a varying distance from the antenna for a given intensity -- that pattern is often said to have &lt;em&gt;lobes&lt;/em&gt;. &lt;strong&gt;The advantage of that antenna is that it is better in particular directions&lt;/strong&gt;; Notably, it's primary lobe is significantly better than it's other lobes, making it work much better in one direction, thus is is more or less &lt;em&gt;unidirectional&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2013-05-13T15:02:03.747" LastActivityDate="2013-05-13T15:02:03.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="340" PostTypeId="2" ParentId="102" CreationDate="2013-05-13T15:26:50.543" Score="1" Body="&lt;p&gt;What model of line cards are you using in your N7K chassis? M series or F series? There may be some hair-pinning happening within the interconnect architecture on the N7K if you are using F series cards that is being detrimental to routed traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, make sure you have a port-channel between N7K for non-vpc vlans. Vlans to your firewall cluster should not cross the VPC peer-link. If you do not have a second port-channel between N7K's, then this could be your problem.&lt;/p&gt;&#xA;" OwnerUserId="406" LastActivityDate="2013-05-13T15:26:50.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="341" PostTypeId="2" ParentId="280" CreationDate="2013-05-13T16:28:12.440" Score="2" Body="&lt;p&gt;In our network, we use the line latency to determine the cost.  We measure the latency in microseconds and apply that as the cost of the line.  It doesn't matter if you use one way or round trip latency, of course.  You just need to be consistent.  This works for us because our WAN links are almost always 10G, so we don't need take capacity issues into consideration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This then, builds the lowest latency forwarding topology and if there is a failure of the primary path, then we know we'll get forwarded on the next fastest path available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Latency is obviously the most important aspect to consider for our network, that's why this works for us.  Other networks might prefer cheaper or higher capacity lines over low latency lines.  Whatever the business requires is where you should start.&lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2013-05-13T16:28:12.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="342" PostTypeId="1" AcceptedAnswerId="378" CreationDate="2013-05-13T16:38:58.127" Score="8" ViewCount="1087" Body="&lt;p&gt;I have an issue where a Netscreen 25 is being flooded with IKE packets from an unrelated source, which at times is overloading the firewall's processing capacity. I see thousands of log entries indicating that the IKE messages are being rejected:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Rejected an IKE packet on ethernet1 from x.x.x.x:500 to y.y.y.y:500 with cookies c423bfd6ca96608b and 0000000000000000 because an initial Phase 1 packet arrived from an unrecognized peer gateway.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is there a way to filter the control plane of the firewall so that these packets are dropped at the interface edge rather than processed and rejected? This would be done with a simple interface ACL on a Cisco router or ASA, but I'm not sure how to go about this on ScreenOS.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-15T23:55:34.937" Title="Is it possible to block IKE from reaching a Netscreen's control plane?" Tags="|screenos|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="344" PostTypeId="2" ParentId="328" CreationDate="2013-05-13T17:36:34.703" Score="3" Body="&lt;p&gt;I just looked at an installation of this equipment (&lt;a href=&quot;http://www.ubnt.com/airfiber&quot; rel=&quot;nofollow&quot;&gt;http://www.ubnt.com/airfiber&lt;/a&gt;).  They're running two antennas in the 24GHz range, each with a 750M throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is basically a 750M Full Duplex wireless solution, since even for ethernet you're really just two independent unidirectional 100M (or whatever) media.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though it's not a true Full Duplex solution because this device still needs a mechanism to detect collisions and then back off a random amount of time, else it becomes useless if you install more than one in an area.  And because of the shared medium (the radio spectrum) it can never be &quot;Full Duplex&quot; due to the necessity of detecting collisions.&lt;/p&gt;&#xA;" OwnerUserId="142" LastActivityDate="2013-05-13T17:36:34.703" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="345" PostTypeId="2" ParentId="328" CreationDate="2013-05-13T17:37:53.693" Score="4" Body="&lt;p&gt;MIMO is as close to full duplex as you'll get, at least with current technology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, a single channel space is split into multiple &quot;streams&quot; which allow for the increased throughput via OFDM (&lt;a href=&quot;http://en.wikipedia.org/wiki/Orthogonal_frequency-division_multiplexing&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Orthogonal_frequency-division_multiplexing&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, on a single channel (assuming no overlap), only one device can be transmitting. I don't think there will be a way around this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's not a great deal of non-overlapping channels even on 5gHz (you want to avoid the DFS channels). Couple that with possibly getting interference on some but not all channels if you could use multiple channels at once, and it starts to become quite messy and adds a lot of overhead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But look into 802.11ac or 802.11ad, those use very very wide channels to achieve silly throughput (up to about 7Gbps estimated). More speed is on the way.&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastEditorUserId="3662" LastEditDate="2013-12-29T19:33:57.547" LastActivityDate="2013-12-29T19:33:57.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="346" PostTypeId="2" ParentId="328" CreationDate="2013-05-13T17:51:08.697" Score="1" Body="&lt;p&gt;I'm not a wireless spectrum expert, but one thing to remember in this idea is that full duplex is not just the ability to simultaneously send and receive, but also to do so without a danger of collisions. In a wired environment, if you install a hub you have to fall back to half-duplex because of the possibility of a collision. In wireless, even if you used a separate non-overlapping channel (it wouldn't even have to be 2.4/5) you still have the possibility for collisions on 1 of those channels (the one the hosts are using to transmit). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now wireless uses CSMA/CA (instead of CSMA/CD in a Ethernet network), which is suppose to *&lt;em&gt;A&lt;/em&gt;*void collisions not just *&lt;em&gt;D&lt;/em&gt;*etect them. Maybe CSMA/CD would solve that issue, just wanted to point it out as a consideration in full-duplex.&lt;/p&gt;&#xA;" OwnerUserId="349" LastActivityDate="2013-05-13T17:51:08.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="348" PostTypeId="2" ParentId="310" CreationDate="2013-05-13T18:32:03.857" Score="6" Body="&lt;p&gt;Taken from &lt;a href=&quot;http://wiki.answers.com/Q/Difference_between_ofdm_dsss_fhss&quot; rel=&quot;noreferrer&quot;&gt;http://wiki.answers.com/Q/Difference_between_ofdm_dsss_fhss&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Orthogonal Frequency Division Multiplexing (OFDM) is a&#xA;  multiple-carrier (MC) modulation technique which creates frequency&#xA;  diversity. A high-speed data stream is converted into multiple&#xA;  low-speed data streams via Serial-to-Parallel (S/P) conversion. Each&#xA;  data stream is modulated by a subcarrier. &#xA;  That way, instead of having a frequency-selective fading wireless&#xA;  channel, where each frequency component of the signal is attenuated&#xA;  and phase-shifted in different amount, we have multiple flat-fading&#xA;  subchannels.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Spread Spectrum (SS) techniques convert a low-speed data stream into a&#xA;  high-speed data stream. That way, the bandwidth of the modulated&#xA;  carrier becomes much larger than the minimum required transmission&#xA;  bandwidth. This is like Frequency Modulation (FM): we trade&#xA;  transmission bandwidth with Signal-to-Noise (S/N) ratio, meaning that&#xA;  we can have error-free communication transmiting lower-power signals.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The fact is, OFDM is used for 802.11n and upwards, so it seems to be the better of the two. I've been a wireless consultant for a couple of years now, and I've never really been asked any questions regarding modulation of the different specifications. Its good to be aware of the differences, but not much more than that.&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastEditorDisplayName="user275" LastEditDate="2013-05-14T10:17:04.317" LastActivityDate="2013-05-14T10:17:04.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="349" PostTypeId="2" ParentId="181" CreationDate="2013-05-13T19:07:55.217" Score="5" Body="&lt;p&gt;The HP ProCurve switches can have 802.1p CoS Priorities or DSCP Policies set, honored, changed or honored with new priority.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;By default, Quality of Service is ENABLED and operates based on&#xA;802.1p settings in the packet.  &lt;/li&gt;&#xA;&lt;li&gt;Classification is configured primarily on a global basis; but can be configured by VLAN and port. &lt;/li&gt;&#xA;&lt;li&gt;Marking is configured primarily on a global basis. &lt;/li&gt;&#xA;&lt;li&gt;Some configuration options can be set globally and some also set by VLAN or port.  &lt;/li&gt;&#xA;&lt;li&gt;Queue Scheduling is configured per port.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the ProCurve range, its always worth looking through one particular manual which is the &quot;&lt;a href=&quot;http://bizsupport2.austin.hp.com/bc/docs/support/SupportManual/c03018186/c03018186.pdf&quot; rel=&quot;nofollow&quot;&gt;Advanced Traffic Management Guide&lt;/a&gt;&quot; For the 3800 Series (which by the way, shares the same firmware as the 3500/5400/6200/6600/8200 series) it has 80-odd pages on configuring or setting up Quality of Service. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, its always worth looking through &quot;&lt;a href=&quot;http://h17007.www1.hp.com/docs/interoperability/Cisco/HP-Networking-and-Cisco-CLI-Reference-Guide_June_10_WW_Eng_ltr.pdf&quot; rel=&quot;nofollow&quot;&gt;HP Networking and Cisco CLI reference Guide&lt;/a&gt;&quot;; this takes common Cisco configuration examples, and provides a HP ProCurve or HP Comware equivalant&lt;/p&gt;&#xA;" OwnerUserId="409" LastEditorUserId="266" LastEditDate="2013-05-13T20:57:43.667" LastActivityDate="2013-05-13T20:57:43.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="350" PostTypeId="2" ParentId="135" CreationDate="2013-05-13T19:24:22.717" Score="5" Body="&lt;p&gt;The Best Practice Guide for HP Lefthand iSCSI Storage stated, &quot;For optimal switch performance, its recommended that the switch have &lt;strong&gt;at least 512 KB of buffer cache per port&lt;/strong&gt;. Consult your switch manufacturer specifications for the total buffer cache. For example, if the switch has 48x 1 Gb ports, the recommendation is to have at least 24 MB of buffer cache dedicated to those ports. If the switch aggregates cache among a group of ports (for example, 1 MB of cache per 8 ports), space your storage modules and servers appropriately to avoid cache oversubscription.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't tell you what buffer cache the 2960S has per port, as it doesn't seem to be stated on the datasheet. &lt;/p&gt;&#xA;" OwnerUserId="409" LastActivityDate="2013-05-13T19:24:22.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="351" PostTypeId="5" CreationDate="2013-05-13T19:53:48.963" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-13T19:53:48.963" LastActivityDate="2013-05-13T19:53:48.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="352" PostTypeId="4" CreationDate="2013-05-13T19:53:48.963" Score="0" Body="Used for discussions of TDMoE (Time-Division Multiplexing over Ethernet), a protocol that allows voice links to be run on less expensive Ethernet hardware." OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-05-13T22:15:52.337" LastActivityDate="2013-05-13T22:15:52.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="353" PostTypeId="5" CreationDate="2013-05-13T19:58:37.667" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-13T19:58:37.667" LastActivityDate="2013-05-13T19:58:37.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="354" PostTypeId="4" CreationDate="2013-05-13T19:58:37.667" Score="0" Body="A general purpose tag to mark discussions of general security topics including firewalls, ACLs, AAA and numerous others related to keeping the network safe from unauthorized access." OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-05-13T22:16:02.370" LastActivityDate="2013-05-13T22:16:02.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="355" PostTypeId="1" AcceptedAnswerId="357" CreationDate="2013-05-13T20:26:49.070" Score="7" ViewCount="9896" Body="&lt;p&gt;If you have a router which does not support OSPF, but your routing topology makes use of OSPF as all other devices do support it, what is the best way to get this routers networks in to the OSPF area?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial thought was to put a static route on every other router, but if there are multiple networks behind this router this could become very cumbersome very quickly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This problem arises from the answer on another question:&#xA;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/37/how-do-you-get-an-asa-to-announce-natd-outside-addresses-in-to-an-ospf-zone&quot;&gt;How do you get an ASA to announce NAT&amp;#39;d &amp;#39;outside&amp;#39; addresses in to an OSPF zone?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="103" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-05-16T06:20:13.377" Title="Distributing static routes across an OSPF area" Tags="|ospf|routing|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="356" PostTypeId="1" AcceptedAnswerId="358" CreationDate="2013-05-13T20:35:17.293" Score="13" ViewCount="5433" Body="&lt;p&gt;Seems clear to me that the Link Local, and Unique Local, addresses should at least be filtered.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there anything other than LLA/ULA that should be filtered?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For LLA, is it standard practice to blanket filter the full fe80::/10, or just filter the fe80::/64?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="49" LastEditorUserId="453" LastEditDate="2013-05-16T00:29:13.060" LastActivityDate="2015-09-09T09:46:07.263" Title="What IPv6 prefixes should never be routed?" Tags="|ipv6|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="357" PostTypeId="2" ParentId="355" CreationDate="2013-05-13T20:50:15.920" Score="12" Body="&lt;p&gt;What does the topology look like? How are you doing routing today towards these networks? Or is the router being deployed now? Do you have an OSPF capable router connected to this router that is not running OSPF?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do then I suggest you redistribute static on this router. Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list static-routes permit 10.0.0.0/24&#xA;ip prefix-list static-routes permit 10.0.10.0/24&#xA;ip prefix-list static-routes permit 10.0.20.0/24&#xA;route-map static-allowed permit 10&#xA;match ip address prefix-list static-routes&#xA;route-map static-allowed deny 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The explicit deny at the end is not really needed as there is an implicit deny but it makes the logic a bit more clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then under the OSPF process:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf x&#xA;redistribute static subnets route-map static-allowed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="105" LastEditorUserId="105" LastEditDate="2013-05-14T05:28:52.063" LastActivityDate="2013-05-14T05:28:52.063" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="358" PostTypeId="2" ParentId="356" CreationDate="2013-05-13T21:02:49.947" Score="12" Body="&lt;p&gt;RFC 6890 section 2.2.3 describe special purpose prefixes for IPv6. Link is here:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6890#page-14&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc6890#page-14&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Prefixes to include are:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;               +----------------------+------------------+&#xA;               | Attribute            | Value            |&#xA;               +----------------------+------------------+&#xA;               | Address Block        | ::1/128          |&#xA;               | Name                 | Loopback Address |&#xA;               | RFC                  | [RFC4291]        |&#xA;               | Allocation Date      | February 2006    |&#xA;               | Termination Date     | N/A              |&#xA;               | Source               | False            |&#xA;               | Destination          | False            |&#xA;               | Forwardable          | False            |&#xA;               | Global               | False            |&#xA;               | Reserved-by-Protocol | True             |&#xA;               +----------------------+------------------+&#xA;&#xA;                    Table 17: Loopback Address&#xA;&#xA;             +----------------------+---------------------+&#xA;             | Attribute            | Value               |&#xA;             +----------------------+---------------------+&#xA;             | Address Block        | ::/128              |&#xA;             | Name                 | Unspecified Address |&#xA;             | RFC                  | [RFC4291]           |&#xA;             | Allocation Date      | February 2006       |&#xA;             | Termination Date     | N/A                 |&#xA;             | Source               | True                |&#xA;             | Destination          | False               |&#xA;             | Forwardable          | False               |&#xA;             | Global               | False               |&#xA;             | Reserved-by-Protocol | True                |&#xA;             +----------------------+---------------------+&#xA;&#xA;                   Table 18: Unspecified Address&#xA;&#xA;            +----------------------+---------------------+&#xA;            | Attribute            | Value               |&#xA;            +----------------------+---------------------+&#xA;            | Address Block        | 64:ff9b::/96        |&#xA;            | Name                 | IPv4-IPv6 Translat. |&#xA;            | RFC                  | [RFC6052]           |&#xA;            | Allocation Date      | October 2010        |&#xA;            | Termination Date     | N/A                 |&#xA;            | Source               | True                |&#xA;            | Destination          | True                |&#xA;            | Forwardable          | True                |&#xA;            | Global               | True                |&#xA;            | Reserved-by-Protocol | False               |&#xA;            +----------------------+---------------------+&#xA;&#xA;              Table 19: IPv4-IPv6 Translation Address&#xA;&#xA;             +----------------------+---------------------+&#xA;             | Attribute            | Value               |&#xA;             +----------------------+---------------------+&#xA;             | Address Block        | ::ffff:0:0/96       |&#xA;             | Name                 | IPv4-mapped Address |&#xA;             | RFC                  | [RFC4291]           |&#xA;             | Allocation Date      | February 2006       |&#xA;             | Termination Date     | N/A                 |&#xA;             | Source               | False               |&#xA;             | Destination          | False               |&#xA;             | Forwardable          | False               |&#xA;             | Global               | False               |&#xA;             | Reserved-by-Protocol | True                |&#xA;             +----------------------+---------------------+&#xA;&#xA;                   Table 20: IPv4-Mapped Address&#xA;&#xA;          +----------------------+----------------------------+&#xA;          | Attribute            | Value                      |&#xA;          +----------------------+----------------------------+&#xA;          | Address Block        | 100::/64                   |&#xA;          | Name                 | Discard-Only Address Block |&#xA;          | RFC                  | [RFC6666]                  |&#xA;          | Allocation Date      | June 2012                  |&#xA;          | Termination Date     | N/A                        |&#xA;          | Source               | True                       |&#xA;          | Destination          | True                       |&#xA;          | Forwardable          | True                       |&#xA;          | Global               | False                      |&#xA;          | Reserved-by-Protocol | False                      |&#xA;          +----------------------+----------------------------+&#xA;&#xA;                   Table 21: Discard-Only Prefix&#xA;&#xA;          +----------------------+---------------------------+&#xA;          | Attribute            | Value                     |&#xA;          +----------------------+---------------------------+&#xA;          | Address Block        | 2001::/23                 |&#xA;          | Name                 | IETF Protocol Assignments |&#xA;          | RFC                  | [RFC2928]                 |&#xA;          | Allocation Date      | September 2000            |&#xA;          | Termination Date     | N/A                       |&#xA;          | Source               | False[1]                  |&#xA;          | Destination          | False[1]                  |&#xA;          | Forwardable          | False[1]                  |&#xA;          | Global               | False[1]                  |&#xA;          | Reserved-by-Protocol | False                     |&#xA;          +----------------------+---------------------------+&#xA;&#xA;         [1] Unless allowed by a more specific allocation.&#xA;&#xA;                +----------------------+----------------+&#xA;                | Attribute            | Value          |&#xA;                +----------------------+----------------+&#xA;                | Address Block        | 2001::/32      |&#xA;                | Name                 | TEREDO         |&#xA;                | RFC                  | [RFC4380]      |&#xA;                | Allocation Date      | January 2006   |&#xA;                | Termination Date     | N/A            |&#xA;                | Source               | True           |&#xA;                | Destination          | True           |&#xA;                | Forwardable          | True           |&#xA;                | Global               | False          |&#xA;                | Reserved-by-Protocol | False          |&#xA;                +----------------------+----------------+&#xA;&#xA;                         Table 23: TEREDO&#xA;&#xA;                +----------------------+----------------+&#xA;                | Attribute            | Value          |&#xA;                +----------------------+----------------+&#xA;                | Address Block        | 2001:2::/48    |&#xA;                | Name                 | Benchmarking   |&#xA;                | RFC                  | [RFC5180]      |&#xA;                | Allocation Date      | April 2008     |&#xA;                | Termination Date     | N/A            |&#xA;                | Source               | True           |&#xA;                | Destination          | True           |&#xA;                | Forwardable          | True           |&#xA;                | Global               | False          |&#xA;                | Reserved-by-Protocol | False          |&#xA;                +----------------------+----------------+&#xA;&#xA;                      Table 24: Benchmarking&#xA;&#xA;                +----------------------+---------------+&#xA;                | Attribute            | Value         |&#xA;                +----------------------+---------------+&#xA;                | Address Block        | 2001:db8::/32 |&#xA;                | Name                 | Documentation |&#xA;                | RFC                  | [RFC3849]     |&#xA;                | Allocation Date      | July 2004     |&#xA;                | Termination Date     | N/A           |&#xA;                | Source               | False         |&#xA;                | Destination          | False         |&#xA;                | Forwardable          | False         |&#xA;                | Global               | False         |&#xA;                | Reserved-by-Protocol | False         |&#xA;                +----------------------+---------------+&#xA;&#xA;                      Table 25: Documentation&#xA;&#xA;                 +----------------------+--------------+&#xA;                 | Attribute            | Value        |&#xA;                 +----------------------+--------------+&#xA;                 | Address Block        | 2001:10::/28 |&#xA;                 | Name                 | ORCHID       |&#xA;                 | RFC                  | [RFC4843]    |&#xA;                 | Allocation Date      | March 2007   |&#xA;                 | Termination Date     | March 2014   |&#xA;                 | Source               | False        |&#xA;                 | Destination          | False        |&#xA;                 | Forwardable          | False        |&#xA;                 | Global               | False        |&#xA;                 | Reserved-by-Protocol | False        |&#xA;                 +----------------------+--------------+&#xA;&#xA;                         Table 26: ORCHID&#xA;&#xA;                +----------------------+---------------+&#xA;                | Attribute            | Value         |&#xA;                +----------------------+---------------+&#xA;                | Address Block        | 2002::/16 [2] |&#xA;                | Name                 | 6to4          |&#xA;                | RFC                  | [RFC3056]     |&#xA;                | Allocation Date      | February 2001 |&#xA;                | Termination Date     | N/A           |&#xA;                | Source               | True          |&#xA;                | Destination          | True          |&#xA;                | Forwardable          | True          |&#xA;                | Global               | N/A [2]       |&#xA;                | Reserved-by-Protocol | False         |&#xA;                +----------------------+---------------+&#xA;&#xA;                  [2] See [RFC3056] for details.&#xA;&#xA;                          Table 27: 6to4&#xA;&#xA;                 +----------------------+--------------+&#xA;                 | Attribute            | Value        |&#xA;                 +----------------------+--------------+&#xA;                 | Address Block        | fc00::/7     |&#xA;                 | Name                 | Unique-Local |&#xA;                 | RFC                  | [RFC4193]    |&#xA;                 | Allocation Date      | October 2005 |&#xA;                 | Termination Date     | N/A          |&#xA;                 | Source               | True         |&#xA;                 | Destination          | True         |&#xA;                 | Forwardable          | True         |&#xA;                 | Global               | False        |&#xA;                 | Reserved-by-Protocol | False        |&#xA;                 +----------------------+--------------+&#xA;&#xA;                      Table 28: Unique-Local&#xA;&#xA;            +----------------------+-----------------------+&#xA;            | Attribute            | Value                 |&#xA;            +----------------------+-----------------------+&#xA;            | Address Block        | fe80::/10             |&#xA;            | Name                 | Linked-Scoped Unicast |&#xA;            | RFC                  | [RFC4291]             |&#xA;            | Allocation Date      | February 2006         |&#xA;            | Termination Date     | N/A                   |&#xA;            | Source               | True                  |&#xA;            | Destination          | True                  |&#xA;            | Forwardable          | False                 |&#xA;            | Global               | False                 |&#xA;            | Reserved-by-Protocol | True                  |&#xA;            +----------------------+-----------------------+&#xA;&#xA;                      Table 29: Linked-Scoped Unicast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This should be enough. There is also the option of filtering bogons but that feels a bit overkill unless you setup peering to Team Cymru or such.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2015-09-08T00:55:56.170" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="359" PostTypeId="1" AcceptedAnswerId="361" CreationDate="2013-05-13T21:03:16.080" Score="8" ViewCount="1692" Body="&lt;p&gt;It was decided recently to migrate a large campus network from the short mode STP costs (16-bit) to the long mode STP costs (32-bit).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have clearly found it documented that this needs to be a &quot;universal&quot; configuration in that all switches need to support it and it needs to configured on all switches, however I have found very few discussions on how to migrate from short mode to long mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most spanning tree costs in the campus network are dynamic, but there are some places where the costs were set manually.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;When configuring long mode, would it be better to move from the root of spanning tree outwards to the edge or from the edge in towards the root?&lt;/li&gt;&#xA;&lt;li&gt;How will the current manual costs be affected and should these be adjusted before hand in some fashion?&lt;/li&gt;&#xA;&lt;li&gt;What issues should we be aware of before making this change?&lt;/li&gt;&#xA;&lt;li&gt;If there were a few switches that did not support long mode and were left in short mode, would this still work?  If so, should we be aware of?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-13T21:27:55.897" Title="Migrating from STP short mode to long mode?" Tags="|spanning-tree|best-practices|switch|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="360" PostTypeId="2" ParentId="355" CreationDate="2013-05-13T21:22:49.750" Score="9" Body="&lt;p&gt;At the point where the non-OSPF domain touches the OSPF domain I would setup static routes and then redistribute those static routes into OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This ofcourse is a very static (no pun intended) setup, there is always the other option of running another (supported) protocol down to the non-OSPF device and then redistribute between the two protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you got a use case where you would want to be doing this?&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-13T21:22:49.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="361" PostTypeId="2" ParentId="359" CreationDate="2013-05-13T21:27:55.897" Score="7" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I would run the change from root outwards but I don't think there are any use cases for doing it each way (someone correct me if I'm wrong).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Manual costs will stay exactly the same so you should at some point convert these to fall in line with your new costs once you have changed over.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Be aware of the fact that during topology changes or before you change over the manual metrics you may be running a sub-optimal L2 path between nodes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It is recommended that all your switches run the same cost type and reference bandwidth, although I can't see any fatal flaws in not having them all the same it again could give you an inconsistent / sub-optimal L2 path.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-13T21:27:55.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="362" PostTypeId="1" AcceptedAnswerId="381" CreationDate="2013-05-13T21:37:13.547" Score="20" ViewCount="4960" Body="&lt;p&gt;How do people handle the need to add VLANs to all switches on their network (or even a subset of devices)? We are adding around 6 new VLANs per week at the moment and as the network grows this is becoming a very cumbersome and risky task.&lt;/p&gt;&#xA;" OwnerUserId="103" LastActivityDate="2014-05-24T18:24:56.173" Title="Easily deploying new VLANs in a large environment" Tags="|vlan|management|" AnswerCount="10" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="363" PostTypeId="1" AcceptedAnswerId="384" CreationDate="2013-05-13T21:42:35.953" Score="15" ViewCount="2133" Body="&lt;p&gt;When connected to an Internet peering exchange(IXP), what is a good way to make sure that people don't send you prefixes that they shouldn't be announcing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With regards to bogons I'm aware of the &lt;a href=&quot;http://www.team-cymru.org/Services/Bogons/&quot;&gt;Team Cymru Bogon Reference&lt;/a&gt; project but when it comes to filtering anything else from peers I have no idea where to begin. My understanding is this is what RPKI and similar are for?&lt;/p&gt;&#xA;" OwnerUserId="103" LastEditorUserId="453" LastEditDate="2013-05-16T06:26:06.027" LastActivityDate="2013-05-16T07:27:05.717" Title="How to filter non-bogon prefixes received via BGP from an Internet Exchange(IXP)?" Tags="|bgp|peering|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="364" PostTypeId="5" CreationDate="2013-05-13T21:43:29.537" Score="0" Body="&lt;p&gt;In computer networking, peering is a voluntary interconnection of administratively separate Internet networks for the purpose of exchanging traffic between the customers of each network. The pure definition of peering is settlement-free or &quot;sender keeps all,&quot; meaning that neither party pays the other for the exchanged traffic; instead, each derives revenue from its own customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Peering requires physical interconnection of the networks, an exchange of routing information through the Border Gateway Protocol (BGP) routing protocol and is often accompanied by peering agreements of varying formality, from &quot;handshake&quot; to thick contracts.&lt;/p&gt;&#xA;" OwnerUserId="103" LastEditorUserId="103" LastEditDate="2013-05-13T22:15:46.557" LastActivityDate="2013-05-13T22:15:46.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="365" PostTypeId="4" CreationDate="2013-05-13T21:43:29.537" Score="0" Body="Peering is a voluntary interconnection of administratively separate Internet networks for the purpose of exchanging traffic between the customers of each network." OwnerUserId="103" LastEditorUserId="103" LastEditDate="2013-05-13T22:16:11.777" LastActivityDate="2013-05-13T22:16:11.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="366" PostTypeId="2" ParentId="362" CreationDate="2013-05-13T22:07:36.117" Score="12" Body="&lt;p&gt;I would say you have a couple of options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Manually. Takes most time. Safest? Depends on the one doing the config.&lt;/li&gt;&#xA;&lt;li&gt;Use some tool like Kiwi Cattools or Rancid etc. Much easier but you would need some kind of logic to check if VLAN is already existing or you could mess up the naming structure. Maybe not a huge deal?&lt;/li&gt;&#xA;&lt;li&gt;Script it! Use Perl, Python, Ruby or whatever language you have experience with. Takes some time to build it but once it done you could reuse script for other configuration tasks. It would be customizable but it depends on if you are comfortable coding.&lt;/li&gt;&#xA;&lt;li&gt;Use SNMP. Never tried this. Would require RW on the devices and I don't really like running RW on my network devices.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-13T22:07:36.117" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="367" PostTypeId="2" ParentId="356" CreationDate="2013-05-13T22:11:52.777" Score="4" Body="&lt;p&gt;See the IPv6 Fullbogons list at &lt;a href=&quot;http://www.team-cymru.org/Services/Bogons/http.html&quot; rel=&quot;nofollow&quot;&gt;http://www.team-cymru.org/Services/Bogons/http.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is available through &lt;a href=&quot;http://www.team-cymru.org/Services/Bogons/dns.html&quot; rel=&quot;nofollow&quot;&gt;DNS&lt;/a&gt;, &lt;a href=&quot;http://www.team-cymru.org/Services/Bogons/rr.html&quot; rel=&quot;nofollow&quot;&gt;RADB&lt;/a&gt;, &lt;a href=&quot;https://apps.db.ripe.net/search/query.html?searchtext=MAINT-BOGON-FILTERS&amp;amp;form_type=simple#resultsAnchor&quot; rel=&quot;nofollow&quot;&gt;RIPE&lt;/a&gt; or &lt;a href=&quot;http://www.team-cymru.org/Services/Bogons/bgp.html&quot; rel=&quot;nofollow&quot;&gt;BGP&lt;/a&gt; as well if you want to perform automatic filtering. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example of filtering automatically on Cisco:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp &amp;lt;your asn&amp;gt;&#xA; ! Session 1&#xA; neighbor A.B.C.D remote-as 65332&#xA; neighbor A.B.C.D description &amp;lt;your description&amp;gt;&#xA; neighbor A.B.C.D ebgp-multihop 255&#xA; neighbor A.B.C.D password &amp;lt;your password&amp;gt;&#xA; ! Session 2&#xA; neighbor E.F.G.H remote-as 65332&#xA; neighbor E.F.G.H description &amp;lt;your description&amp;gt;&#xA; neighbor E.F.G.H ebgp-multihop 255&#xA; neighbor E.F.G.H password &amp;lt;your password&amp;gt;&#xA;!&#xA; address-family ipv4&#xA;  ! Session 1&#xA;  neighbor A.B.C.D activate&#xA;  neighbor A.B.C.D soft-reconfiguration inbound&#xA;  neighbor A.B.C.D prefix-list cymru-out-v4 out&#xA;  neighbor A.B.C.D route-map CYMRUBOGONS-V4 in&#xA;  ! Session 2&#xA;  neighbor E.F.G.H activate&#xA;  neighbor E.F.G.H soft-reconfiguration inbound&#xA;  neighbor E.F.G.H prefix-list cymru-out-v4 out&#xA;  neighbor E.F.G.H route-map CYMRUBOGONS-V4 in&#xA;!&#xA; address-family ipv6&#xA;  ! Session 1&#xA;  neighbor A.B.C.D activate&#xA;  neighbor A.B.C.D soft-reconfiguration inbound&#xA;  neighbor A.B.C.D prefix-list cymru-out-v6 out&#xA;  neighbor A.B.C.D route-map CYMRUBOGONS-V6 in&#xA;  ! Session 2&#xA;  neighbor E.F.G.H activate&#xA;  neighbor E.F.G.H soft-reconfiguration inbound&#xA;  neighbor E.F.G.H prefix-list cymru-out-v6 out&#xA;  neighbor E.F.G.H route-map CYMRUBOGONS-V6 in&#xA;!&#xA;! Depending on IOS version, you may need to configure your router&#xA;! for new-style community syntax.&#xA;ip bgp-community new-format&#xA;!&#xA;ip community-list 100 permit 65332:888&#xA;!&#xA;ip route 192.0.2.1 255.255.255.255 Null0&#xA;!&#xA;ip prefix-list cymru-out-v4 seq 5 deny 0.0.0.0/0 le 32&#xA;!&#xA;ipv6 route 2001:DB8:0:DEAD:BEEF::1/128 Null0&#xA;!&#xA;ipv6 prefix-list cymru-out-v6 seq 5 deny ::/0 le 128&#xA;!&#xA;route-map CYMRUBOGONS-V6 permit 10&#xA;description IPv6 Filter bogons learned from cymru.com bogon route-servers&#xA;match community 100&#xA;set ipv6 next-hop 2001:DB8:0:DEAD:BEEF::1&#xA;!&#xA;route-map CYMRUBOGONS-V4 permit 10&#xA;description IPv4 Filter bogons learned from cymru.com bogon route-servers&#xA;match community 100&#xA;set ip next-hop 192.0.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here's one for JunOS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA;* Define BGP peer group&#xA;*/&#xA;delete protocols bgp group cymru-bogons&#xA;set protocols bgp group cymru-bogons type external&#xA;set protocols bgp group cymru-bogons description &quot;cymru fullbogon bgp feed (ipv4 + 6)&quot;&#xA;set protocols bgp group cymru-bogons multihop ttl 255&#xA;set protocols bgp group cymru-bogons import cymru-bogons-in&#xA;/*&#xA;* Define MD5 password in quotes&#xA;*/&#xA;set protocols bgp group cymru-bogons authentication-key &quot;&amp;lt;YOUR PASSWORD&amp;gt;&quot;&#xA;set protocols bgp group cymru-bogons export deny-all&#xA;set protocols bgp group cymru-bogons peer-as 65332&#xA;/*&#xA;* Replace values below as appropriate&#xA;*/&#xA;set protocols bgp group cymru-bogons neighbor A.B.C.D local-address &amp;lt;YOUR IP&amp;gt;&#xA;set protocols bgp group cymru-bogons neighbor A.B.C.D family inet unicast&#xA;set protocols bgp group cymru-bogons neighbor A.B.C.D family inet6 unicast&#xA;set protocols bgp group cymru-bogons neighbor E.F.G.H local-address &amp;lt;YOUR IP&amp;gt;&#xA;set protocols bgp group cymru-bogons neighbor E.F.G.H family inet unicast&#xA;set protocols bgp group cymru-bogons neighbor E.F.G.H family inet6 unicast&#xA;/*&#xA;* Define CYMRU import policy&#xA;*/&#xA;delete policy-options policy-statement cymru-bogons-in&#xA;set policy-options policy-statement cymru-bogons-in term 1 from family inet&#xA;set policy-options policy-statement cymru-bogons-in term 1 from community comm-cymru-bogon&#xA;set policy-options policy-statement cymru-bogons-in term 1 then community add no-export&#xA;set policy-options policy-statement cymru-bogons-in term 1 then next-hop discard&#xA;set policy-options policy-statement cymru-bogons-in term 1 then accept&#xA;set policy-options policy-statement cymru-bogons-in term 2 from family inet6&#xA;set policy-options policy-statement cymru-bogons-in term 2 from community comm-cymru-bogon&#xA;set policy-options policy-statement cymru-bogons-in term 2 then community add no-export&#xA;set policy-options policy-statement cymru-bogons-in term 2 then next-hop discard&#xA;set policy-options policy-statement cymru-bogons-in term 2 then accept&#xA;set policy-options policy-statement cymru-bogons-in then reject&#xA;/*&#xA;* Define deny-all export policy&#xA;*/&#xA;delete policy-options policy-statement deny-all&#xA;set policy-options policy-statement deny-all then reject&#xA;/*&#xA;* Define CYMRU Bogon community&#xA;*/&#xA;delete policy-options community comm-cymru-bogon&#xA;set policy-options community comm-cymru-bogon members no-export&#xA;set policy-options community comm-cymru-bogon members 65332:888&#xA;/*&#xA;* Define internal no-export community&#xA;*/&#xA;delete policy-options community comm-no-export&#xA;set policy-options community comm-no-export members no-export&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="103" LastActivityDate="2013-05-13T22:11:52.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="368" PostTypeId="2" ParentId="283" CreationDate="2013-05-13T22:22:19.013" Score="4" Body="&lt;p&gt;This can be done, see the page 15 of the Dell white paper on the subject here:&#xA;&lt;a href=&quot;http://www.dell.com/downloads/global/products/pwcnt/en/pwcnt_stacking_switches.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.dell.com/downloads/global/products/pwcnt/en/pwcnt_stacking_switches.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically it says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Merging Two Operational Stacks&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The recommended procedure for merging two operational stacks is as&#xA;  follows:&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Always power off all units in one stack before connecting to another stack.&lt;/li&gt;&#xA;  &lt;li&gt;Add the units as a group by unplugging one stacking cable in the operational stack and physically connecting all unpowered units.&lt;/li&gt;&#xA;  &lt;li&gt;Completely cable the stacking connections, making sure the redundant link is also in place.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;Two operational stacks can also be merged by reconnecting stack cables&#xA;  without powering down units in either stack. Connecting a powered up&#xA;  standalone unit to an existing stack leads to same behavior as when&#xA;  merging two operational stacks. In such cases, Manager reelection is&#xA;  done and the Manager with the higher MAC address wins the election.&#xA;  The losing stack manager resets itself and all its member units. After&#xA;  the reset, all the losing stack members join the winning stack to form&#xA;  a single stack. The winning stack remains functional through the merge&#xA;  process. If the stack merge is performed in this way, then it is&#xA;  strongly recommended that the user set the admin management preference&#xA;  of the desired winner stack manager to a higher value than the stack&#xA;  manager that should lose the election.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also, in your above proposed cabling you are not completing a loop with your stacking cables. You should always aim to do this, even though it is not a requirement. See page 7 of the Dell m6220 stacking use case:&#xA;&lt;a href=&quot;http://i.dell.com/sites/content/business/solutions/whitepapers/zh/Documents/powerconnect-m6220-switch_cn.pdf&quot; rel=&quot;nofollow&quot;&gt;http://i.dell.com/sites/content/business/solutions/whitepapers/zh/Documents/powerconnect-m6220-switch_cn.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cabling: &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;M6220 switches should be stacked together by connecting a&#xA;  stacking cable from stack port xg2 of one switch to stack port xg1 of&#xA;  the next sw itch. The stacking cable is included with the stacking&#xA;  module. Stack port xg2 of the fi nal switch in the stack should be&#xA;  connected to stack port xg1 of the first switch, completing the stack&#xA;  loop. A loop topology is not strictly required for a stack but it is&#xA;  recommended, as it is the most robust stacking topology and has seen&#xA;  the most time in production use.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="103" LastActivityDate="2013-05-13T22:22:19.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="369" PostTypeId="2" ParentId="363" CreationDate="2013-05-13T22:22:47.190" Score="5" Body="&lt;p&gt;You've basically answered your own question. Your assumption that using RPKI is the way to go is absolutely correct. More specifically Route Origination Authorizations are used to validate a prefix to an AS. Obviously bogons will not be valid because they're not assigned to anyone, so that problem will take care of itself. A lot of this information is available on the &lt;a href=&quot;http://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure&quot;&gt;RPKI Wikipedia page&lt;/a&gt;. Another good resource is &lt;a href=&quot;https://www.arin.net/resources/rpki/index.html&quot;&gt;ARIN's RPKI page&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need configuration help I suggest you create another question asking for specific configuration help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also worth noting that RPKI won't work for everything, because not everyone is using it. At some point you just have to trust the routes you're receiving.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-13T22:22:47.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="370" PostTypeId="2" ParentId="363" CreationDate="2013-05-13T22:56:32.110" Score="11" Body="&lt;p&gt;At the moment (until RPKI is more widespread), we generally just filter common bogons and apply a max-prefix filter to exchange peers. We also filter certain ASNs, ones we are certain will never show up in most peering sessions, such as Level3 or Cogent, or should not be transited over an exchange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We usually find that most of the common route leaks are not in the 1-2 digit range. That's very hard to catch anyway, unless you filter all your peers by building a prefix/ASN list or filter by radb, etc. Most leaks end up being closer to 10k-100k+, which is easily caught by a fairly low (100-500) max-prefix filter. You can then adjust that per-session as needed.&lt;/p&gt;&#xA;" OwnerUserId="89" LastActivityDate="2013-05-13T22:56:32.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="371" PostTypeId="2" ParentId="362" CreationDate="2013-05-13T23:02:33.347" Score="7" Body="&lt;p&gt;It could be that VTP is your answer.  Like any &quot;automated&quot; tool, it has it's risks, but you can mitigate them with proper planning.  You should also do some reading to make sure you understand how it works or you can inadvertently create your own problems (again, just like any automated tool).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend VTP version 3, as this can help protect from some of the potential problems and provides additional benefits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can easily find hundreds of documents by searching &quot;vtp version 3 configuration&quot; in your search engine of choice.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-13T23:02:33.347" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="372" PostTypeId="2" ParentId="362" CreationDate="2013-05-14T00:28:16.633" Score="11" Body="&lt;p&gt;Configuration management software might be worth looking into -- &lt;a href=&quot;https://puppetlabs.com/blog/puppet-network-device-management/&quot;&gt;Puppet's network device management&lt;/a&gt; can add vlans easily to numerous Cisco devices (if you're using Cisco).&lt;/p&gt;&#xA;" OwnerUserId="221" LastActivityDate="2013-05-14T00:28:16.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="373" PostTypeId="2" ParentId="362" CreationDate="2013-05-14T00:44:02.800" Score="7" Body="&lt;p&gt;&lt;a href=&quot;http://www.solarwinds.com/&quot; rel=&quot;noreferrer&quot;&gt;Solarwind&lt;/a&gt;'s Network Configuration Manager can run scripts in IOS devices and some others. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also does things like nightly config backups, change reports and config audits. Their pricing isn't horrible but they're merging NCM with their Orion Network Performance Monitor and I'm not certain you can run NCM separately any more.&lt;/p&gt;&#xA;" OwnerUserId="165" LastEditorUserId="266" LastEditDate="2013-05-15T13:57:12.850" LastActivityDate="2013-05-15T13:57:12.850" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="374" PostTypeId="2" ParentId="355" CreationDate="2013-05-14T03:43:46.077" Score="3" Body="&lt;p&gt;The best way to do this would be through redistribution. If the non-OSPF devices do support RIP or EIGRP you could create a neighborship with the OSPF device and non-OSPF device and redistribute the routes into OSPF - and the rest of your network. This is relatively safe if the non-OSPF device is single-homed. If dual-homed then you'll need to beware of the possibility of routing loops due to lost metric when redistributing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If running a different IGP on the non-OSPF device is not an option then I'm afraid you'll have to use static routes - be it manually put in or automated with some sort of script.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-14T03:43:46.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="375" PostTypeId="2" ParentId="37" CreationDate="2013-05-14T03:48:32.640" Score="1" Body="&lt;p&gt;I originally wan't going to post on here because this question is answered, but after seeing your other post about moving the static routes into your OSPF session I thought this might circumvent that problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the ASA you can create a static route for your public address space (Let's say 134.0.15.0/30) and redistribute that route into OSPF. Assuming you have the proper config to establish an OSPF session on the &quot;Outside&quot; interface then it will advertise the static route north.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: This will also advertise the route to any peers on the &quot;Inside&quot; interface as well. This shouldn't be an issue other than you'll see it in the device's routing tables.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-14T03:48:32.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="376" PostTypeId="2" ParentId="363" CreationDate="2013-05-14T08:19:27.773" Score="7" Body="&lt;p&gt;Depending on how you're using the peering exchange, you've got a few different options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly I'll cover RPKI and say that whilst it's something you should definitely go ahead and deploy, both for your own routes and validating others, it's unfortunately in such low use that you cannot at this point expect it to do all that much. The real solution here is WHOIS - Merit's RaDB is arguably the best since it'll allow you to return results for all RIRs at once. But, if you prefer to query each RIR directly, go for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you're on the exchange and you're just getting a pile of prefixes from the IXP's route server, depending on the tools you've got available to you and the capabilities of your router, you have two possibilities:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;1. Filter by origin AS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, this consists of validating the origin AS of a prefix against the one in WHOIS - if the origin AS isn't matching the one in WHOIS, you drop the prefix and any more-specifics that might also be announced. This is generally a good protection against unintentional hijacks. The vast majority of prefixes should have this data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;2. Filter by transit AS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This takes it a step further and filters routes with any AS in the path that isn't authorised within WHOIS - you can't do this for every prefix however, since not everybody will have created objects specifying who their authorised transit AS providers are.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On the other hand, if you're using the peering exchange to directly peer with others, then your life gets a whole lot simpler; you can lookup what prefixes they have in WHOIS and permit those. Good practice in my opinion is to permit peers to announce more-specifics up to a max length of /24 whilst also setting a sensible maximum-prefix value (i.e. proportional to the number of subnets they have) on your peering so that they can't flood you with routes but &lt;strong&gt;can&lt;/strong&gt; respond to a prefix hijack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're looking for tools, check out &lt;a href=&quot;https://www.isc.org/software/irrtoolset/downloads/all?sw=297&quot; rel=&quot;nofollow&quot;&gt;IRRToolSet&lt;/a&gt; and &lt;a href=&quot;http://sourceforge.net/projects/irrpt/?source=navbar&quot; rel=&quot;nofollow&quot;&gt;IRR PowerTools&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="378" LastEditorUserId="378" LastEditDate="2013-05-14T18:30:32.013" LastActivityDate="2013-05-14T18:30:32.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="377" PostTypeId="2" ParentId="303" CreationDate="2013-05-14T10:41:06.607" Score="4" Body="&lt;p&gt;If you are planning to implement multiple links in the same GDOI group on the GMs, best practice would be to use a loopback interface as the crypto source.  The reason being that otherwise the key servers will see each interface as a separate entry and the router will receive multiple rekeys.  Your second sample config looks good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See section 4.1.2.1.3 of the GETVPN DIG:  &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6525/ps9370/ps7180/GETVPN_DIG_version_1_0_External.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6525/ps9370/ps7180/GETVPN_DIG_version_1_0_External.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="241" LastActivityDate="2013-05-14T10:41:06.607" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="378" PostTypeId="2" ParentId="342" CreationDate="2013-05-14T10:57:54.677" Score="5" Body="&lt;p&gt;That should be caught by the default dos-protection-group. No? Do you have, perhaps, 'unset ike dos-protection' ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does 'show suspicious-control-flow-detection ike' show?&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-14T10:57:54.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="379" PostTypeId="2" ParentId="342" CreationDate="2013-05-14T12:28:41.333" Score="6" Body="&lt;p&gt;You could try terminating the VPN tunnels on the IP address of a loopback interface, and creating a policy rule to specify what sources are (not) allowed to contact this VPN endpoint. If the loopback interface is in the same zone as the interface receiving the traffic, enable &quot;block intra-zone traffic&quot; for this zone and specify a rule to permit your VPNs.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-05-14T12:28:41.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="380" PostTypeId="2" ParentId="54" CreationDate="2013-05-14T12:35:32.303" Score="1" Body="&lt;p&gt;OSPF over metroE works fine but you will need to make sure it fits your needs and you architect accordingly. One caveat I haven't seen mentioned is to make sure you know what MTU your provider supports. I have seen an MTU drop on a metroE link during a provider maintenance cause the OSPF neighbor to not come up. Probably only a problem because they don't really support jumbo frames but they did just for us:) Being nice sometimes doesn't pay off.&lt;/p&gt;&#xA;" OwnerUserId="308" LastActivityDate="2013-05-14T12:35:32.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="381" PostTypeId="2" ParentId="362" CreationDate="2013-05-14T12:48:01.523" Score="17" Body="&lt;p&gt;Here is a really basic script template in Perl for telneting into a list of devices (one on each line in a file called devicelist.txt) and configuring some commands.  Depending on exactly what you are doing it should provide a good start.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  use Net::Telnet::Cisco;&#xA;&#xA;    # read in a list of devices&#xA;    my @devicelist;&#xA;    open(DATA, &quot;&amp;lt;devicelist.txt&quot;) || die &quot;Can't open file!&quot;;&#xA;    while (&amp;lt;DATA&amp;gt;) {&#xA;            chomp;&#xA;            push( @devicelist, $_);&#xA;    }&#xA;&#xA;    # loop through the devices&#xA;    foreach $hostname (@devicelist)&#xA;    {&#xA;            # telnet to device&#xA;            my $cs = Net::Telnet::Cisco-&amp;gt;new(Host =&amp;gt; $hostname);&#xA;&#xA;            # login, go enable, disable paging, go into config mode&#xA;            $cs-&amp;gt;login( &quot;username&quot;, &quot;password&quot; );&#xA;            $cs-&amp;gt;enable( &quot;enable_password&quot; );&#xA;            $cs-&amp;gt;cmd( 'terminal length 0' );&#xA;            $cs-&amp;gt;cmd( 'config t' );&#xA;&#xA;            # configure the device&#xA;            $cs-&amp;gt;cmd( 'vlan 100, 200, 300' );&#xA;            $cs-&amp;gt;cmd( 'interface Ethernet0' );&#xA;            $cs-&amp;gt;cmd( ' switchport access vlan 100' );&#xA;&#xA;            # exit config mode and write the config&#xA;            $cs-&amp;gt;cmd( 'end' );&#xA;            $cs-&amp;gt;cmd( 'wr mem' );&#xA;&#xA;            # close the connection&#xA;            $cs-&amp;gt;close;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://nettelnetcisco.sourceforge.net/docs.html&quot;&gt;Here&lt;/a&gt; are some more details on Net::Telnet::Cisco as well.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-14T12:48:01.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="382" PostTypeId="1" AcceptedAnswerId="10086" CreationDate="2013-05-14T14:07:51.160" Score="9" ViewCount="1809" Body="&lt;p&gt;At the RIPE conference the was a talk about how MAC addresses starting with a 4or 6 may suffer from decreased performance because MPLS routers misinterpret the Ethernet packets as an IPv4/6 packet when load balancing over multiple links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://ripe66.ripe.net/presentations/141-RIPE66_Understanding_MPLS_Hashing-Snijders.pdf&quot;&gt;Presentation is here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One workaround would be to insert additional fields to prevent misinterpretation of the packets. Control words do the trick. Now, I know that control words are enabled on l2vpn connections on juniper by default, but I can't find any information regarding VPLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know if control words are sent when using VPLS on juniper by default or if we can enable them?&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-07-24T15:31:39.010" Title="Does Juniper set a control word on VPLS pseudowires" Tags="|juniper|mpls|juniper-mx|vpls|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="383" PostTypeId="2" ParentId="362" CreationDate="2013-05-14T14:13:58.260" Score="11" Body="&lt;p&gt;The challenge you now face is that you are going into a mixed environment.  You mention you are moving towards Juniper from I assume Cisco?  In a pure Cisco environment &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/solution_guide_c78_508010.html&quot;&gt;VTP v3&lt;/a&gt; with passwords would be the way to go and supports over 4k vlans.  In the Juniper world the equivalent would be &lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junos9.5/topics/example/bridging-ex-series-automatic-vlan-administration-GVRP.html&quot;&gt;GVRP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be able to use some form of centralized management such as Puppet as was mentioned by Shane Madden, &lt;a href=&quot;http://www.solarwinds.com/&quot;&gt;SolarWinds&lt;/a&gt;, HP OpenView and such but you will still have two scripts to manage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would try to keep things as simple as possible (&lt;a href=&quot;https://en.wikipedia.org/wiki/KISS_principle&quot;&gt;KISS&lt;/a&gt;) for now as you transition from one vendor to another.  Using VTP and GVRP on the appropriate hardware is probably the way to go and doesn't add the potential cost for other solutions or complexity of managing another new thing.&lt;/p&gt;&#xA;" OwnerUserId="266" LastEditorUserId="266" LastEditDate="2013-05-14T15:03:11.627" LastActivityDate="2013-05-14T15:03:11.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="384" PostTypeId="2" ParentId="363" CreationDate="2013-05-14T14:50:52.303" Score="14" Body="&lt;p&gt;As the others stated, RPKI would be the way to go, but it's not there yet. At exchange points we generally put a max-prefix limit on every session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally we use the following rules:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;No default route&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;No bogons, more exactly this list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-filter 0.0.0.0/8 orlonger reject;&#xA;route-filter 127.0.0.0/8 orlonger reject;&#xA;route-filter 10.0.0.0/8 orlonger reject;&#xA;route-filter 172.16.0.0/12 orlonger reject;&#xA;route-filter 192.168.0.0/16 orlonger reject;&#xA;route-filter 224.0.0.0/4 orlonger reject;&#xA;route-filter 240.0.0.0/4 orlonger reject;&#xA;route-filter 169.254.0.0/16 orlonger reject;&#xA;route-filter 192.0.2.0/24 orlonger reject;&#xA;route-filter 198.51.100.0/24 orlonger reject;&#xA;route-filter 203.0.113.0/24 orlonger reject;&#xA;route-filter 100.64.0.0/10 orlonger reject;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;No prefixes longer than /24&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;No private AS numbers in the path&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;None of our own prefixes&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For IPv6 we do the same, only the bogons are different. I pasted our filter below this. Please be aware that the syntax might be a bit odd but that is due to the Juniper way of matching prefixes. For Cisco syntax you can go here: &lt;a href=&quot;http://www.space.net/~gert/RIPE/ipv6-filters.html&quot;&gt;IPv6 BGP filter recommendations&lt;/a&gt; (The Juniper example on the page is buggy, please use the one below if you want.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;term ebgp-relaxed {&#xA;    from {&#xA;        family inet6;&#xA;        route-filter 3ffe::/16 orlonger;&#xA;        route-filter 0000::/8 orlonger;&#xA;        route-filter 2001:db8::/32 orlonger;&#xA;        route-filter 2001::/32 exact next policy;&#xA;        route-filter 2001::/32 longer;&#xA;        route-filter 2002::/16 exact next policy;&#xA;        route-filter 2002::/16 longer;&#xA;        route-filter fe00::/9 orlonger;&#xA;        route-filter ff00::/8 orlonger;&#xA;        route-filter 2000::/3 prefix-length-range /49-/128;&#xA;        route-filter 0::/0 orlonger;&#xA;    }&#xA;    then reject;&#xA;}&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="59" LastEditorUserId="453" LastEditDate="2013-05-16T07:27:05.717" LastActivityDate="2013-05-16T07:27:05.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="385" PostTypeId="1" AcceptedAnswerId="387" CreationDate="2013-05-14T15:06:15.243" Score="14" ViewCount="1569" Body="&lt;p&gt;I have read many &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps9441/ps9402/data_sheet_c78-720322.html&quot;&gt;data&lt;/a&gt; &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps9441/ps9402/ps9512/Data_Sheet_C78-437762.html&quot;&gt;sheets&lt;/a&gt; on the Nexus 7000 series and it's cards purporting to be capable of OIR (Online Insertion and Removal).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I have never needed to replace/reseat/add any Nexus line cards since I walked into this Nexus deployment two years ago.  (Several power supplies and a fan tray, but no line cards.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is replacing (or adding) a line card truly impact-free on the other line cards/traffic that is currently in production?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To test, I have scheduled a downtime for testing to involve replacing one of the line cards and one of the supervisors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I was wondering if any of you could give me a heads up on what to expect.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:02.550" LastActivityDate="2013-07-05T10:43:50.557" Title="Is Nexus 7000 series line card &quot;OIR&quot; impact-free?" Tags="|cisco|switch|cisco-nexus-7k|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="386" PostTypeId="1" CreationDate="2013-05-14T15:43:21.070" Score="11" ViewCount="477" Body="&lt;p&gt;I have been evaluating converged storage/data networking for some time. It seems that the design pitched by vendors is a bridging of the Fiber Channel (FC) and Ethernet domains. I always come away questioning if this is just some interim step towards a pure FCoE storage networking environment. Some vendors are pushing towards end-to-end FCoE, but it seems that there may be scalability concerns. I find it difficult to take any step toward FCoE while there is an existing investment in FC. It probably makes more sense for a greenfield deployment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is end-to-end FCoE still in its infancy? If so, does it make sense to wait for it to mature and jump straight to a pure FCoE storage environment?&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="49" LastEditDate="2013-05-14T16:18:40.080" LastActivityDate="2013-07-15T14:24:37.197" Title="End-to-End FCoE" Tags="|fcoe|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="387" PostTypeId="2" ParentId="385" CreationDate="2013-05-14T16:05:43.377" Score="13" Body="&lt;p&gt;&quot;Yes, it's completely impact-free.*&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*Your experience may vary.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's the impression I get from Cisco and the Nexus platform in general. As a general rule, I &lt;em&gt;always&lt;/em&gt; try to secure a maintenance window for work on critical infrastructure as a CYA measure. Even if it works flawlessly 99% of the time, there's still that 1% that it won't, and &quot;But Cisco told us it would be fine&quot; does little to placate angry customers.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-14T16:05:43.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="388" PostTypeId="5" CreationDate="2013-05-14T17:32:01.143" Score="0" Body="&lt;p&gt;For questions about wireless networking (802.11), including any licensed or unlicensed RF medium used to provide point-to-point or point-to-multipoint network links.&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2018-03-01T17:15:57.757" LastActivityDate="2018-03-01T17:15:57.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="389" PostTypeId="4" CreationDate="2013-05-14T17:32:01.143" Score="0" Body="For questions about wireless networking (802.11), including any licensed or unlicensed RF medium used to provide point-to-point or point-to-multipoint network links." OwnerUserId="165" LastEditorDisplayName="user36472" LastEditDate="2018-03-01T17:16:00.987" LastActivityDate="2018-03-01T17:16:00.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="390" PostTypeId="1" CreationDate="2013-05-15T00:09:27.500" Score="9" ViewCount="706" Body="&lt;p&gt;I'm attempting to set up client / server sockets in Cisco EEM 3.0 TCL with IOS version 12.4(24)T8 (this was recently upgraded to determine whether the problem was EEM ver).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following two example Tcl scripts (ref: &lt;a href=&quot;http://wiki.tcl.tk/15315&quot;&gt;http://wiki.tcl.tk/15315&lt;/a&gt; )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Server.tcl:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;::cisco::eem::event_register_none maxrun 120&#xA;&#xA;namespace import ::cisco::eem::*&#xA;namespace import ::cisco::lib::*&#xA;&#xA;proc accept {chan addr port} {&#xA;    puts &quot;$addr:$port says [gets $chan]&quot;&#xA;    puts $chan goodbye&#xA;    close $chan&#xA;}&#xA;socket -server accept 12345&#xA;vwait forever&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Client.tcl:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;::cisco::eem::event_register_none maxrun 20&#xA;&#xA;namespace import ::cisco::eem::*&#xA;namespace import ::cisco::lib::*&#xA;&#xA;set chan [socket 10.0.0.2 12345]&#xA;puts $chan hello&#xA;flush $chan&#xA;puts &quot;10.0.0.2:12345 says [gets $chan]&quot;&#xA;close $chan&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;10.0.0.2 is assigned to a loopback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I show the listening ports via the &quot;show control-plane host open-ports&quot; command, the server port of 12345 is listening, but the client script does not produce any output. A telnet to the router (via a physical interface) to port 12345 results in a connection refused. No ACLs are enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These scripts work from a Windows XP computer running ActiveTCL 8.5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a bug or security feature within EEM 3.0? Are any additional commands or settings required to enable TCP sockets within EEM 3.0?&lt;/p&gt;&#xA;" OwnerUserId="186" LastEditorUserId="49" LastEditDate="2013-05-15T01:39:13.657" LastActivityDate="2013-05-15T16:32:05.393" Title="TCP Client / Server in Cisco EEM 3.0" Tags="|cisco|cisco-ios-12|cisco-eem|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="391" PostTypeId="2" ParentId="386" CreationDate="2013-05-15T01:03:02.023" Score="9" Body="&lt;p&gt;I think it's mature enough for production use. However, it's not an all-or-nothing thing. Right now the only major FCoE (multi-hop) vendor is Cisco. They're pitching a Fibre Channel fabric where it doesn't matter if the ports are FC or FCoE. Some ports might be 8 Gbit FC, others might be 10 Gbit Ethernet running FCoE. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can have an FC-connected storage array, connected to a Nexus 5K, using a Nexus 7K as your core (or MDS with FCoE cards), aggregating down to another 5K, to a UCS B-Series connected via FCoE. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Brocade is a native FC shop, and they've been pushing 16 Gbit FC for I think 2 years. Cisco just announced a 16 Gbit FC switch, so they're a little later to the 16 Gbit game, though they've been pushing 10 Gbit Ethernet FCoE for about as long. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, 10 Gbit Ethernet is about 1250 MBytes of raw throughput, where 16 Gbit FC is 1600 Mbyte/s of raw throughput, because of the way FC was designed. &lt;/p&gt;&#xA;" OwnerUserId="429" LastEditorUserId="165" LastEditDate="2013-05-15T19:47:55.067" LastActivityDate="2013-05-15T19:47:55.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="392" PostTypeId="2" ParentId="3" CreationDate="2013-05-15T05:22:25.527" Score="2" Body="&lt;p&gt;If you have a Cisco device use a combination of NBAR and QoS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NBAR will help classify traffic based on your custom requirements. You can create custom NBAR PDLMs for the protocol/application you need to track. The command is:&#xA;ip nbar custom name [offset [format value]] [variable field-name field-length] [source | destination] [tcp | udp ] [range start end | port-number ]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once this is done create a QoS class for the custom NBAR app and then apply your policies.&lt;/p&gt;&#xA;" OwnerUserId="342" LastActivityDate="2013-05-15T05:22:25.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="393" PostTypeId="2" ParentId="243" CreationDate="2013-05-15T06:06:15.623" Score="2" Body="&lt;p&gt;Unfortunately, no, you can't. Specifically because FCoE requires lossless Ethernet, which can't be done on a Catalyst 5500. PFC works on physical ports, but the switch itself needs to have internal VOQs in order to not lose frames from port to port internally. You can do old-timey flow control on a 5500 which will keep physical ports from overflowing each others buffers, but it won't guarantee losslessness on internal ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the switch wouldn't support FIP, which is the control plane for FCoE. &lt;/p&gt;&#xA;" OwnerUserId="429" LastActivityDate="2013-05-15T06:06:15.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="395" PostTypeId="1" CreationDate="2013-05-15T10:19:22.387" Score="43" ViewCount="83281" Body="&lt;p&gt;Given that spanning tree has failed (or you don't have any spanning tree) and get an ethernet loop, what's the best way to diagnose where the problem is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which switch?, which cable? and so on.&lt;/p&gt;&#xA;" OwnerUserId="228" LastEditorUserId="1532" LastEditDate="2014-07-21T13:33:17.517" LastActivityDate="2014-07-21T13:33:17.517" Title="How can I diagnose a bridging (ethernet) loop?" Tags="|ethernet|switch|" AnswerCount="15" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="396" PostTypeId="2" ParentId="395" CreationDate="2013-05-15T10:58:58.543" Score="7" Body="&lt;p&gt;Ouch. But ok, I can think of two ways I'd go at this...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eyeball it: If the switches have port indicators, you should be able to eyeball which ports are the most active. Those are the ones to start looking at first. Hopefully the cables are labeled so you can search for the low hanging fruit of finding two busy ports, on two switches with the same cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SNMP monitoring: If you've got SNMP (or similar) usage stats, look for the busiest switch and the busiest ports. Then go looking at cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...if you have unlabeled cables, start tracing and labeling as part of your checking out the busiest ports.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-15T10:58:58.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="397" PostTypeId="2" ParentId="395" CreationDate="2013-05-15T11:06:42.497" Score="0" Body="&lt;p&gt;In my experience it's always been the cable that I just plugged in, or no shut, or added to the port-channel.  Tougher is when someone else did it and doesn't immediately fess up.&lt;/p&gt;&#xA;" OwnerUserId="165" LastActivityDate="2013-05-15T11:06:42.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="398" PostTypeId="2" ParentId="395" CreationDate="2013-05-15T11:07:11.460" Score="3" Body="&lt;p&gt;To be honest, if you remotely connected (or via console cable) onto the device, you'd notice its very sluggish, there will be a delay from when you type to the letters coming up on the CLI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If its a Cisco switch, 2 easy ones are to look at the interface statistics, it'll be on 100% (or 255/255) usage, constantly. In my years of dealing with switches, I've yet to see a port legitimatly hit 100% usage. Other than that, check the CPU usage (usually &quot;show process cpu history&quot;), looped interfaces will usually hit your CPU pretty hard unless you're running a high end switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP should really be enabled though!&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastActivityDate="2013-05-15T11:07:11.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="399" PostTypeId="2" ParentId="395" CreationDate="2013-05-15T11:29:51.447" Score="31" Body="&lt;p&gt;OK, so assume you have a topology like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          SW1&#xA;         /   \&#xA;        /     \&#xA;       /       \&#xA;PC A--SW2-----SW3--PC B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For some reason there is a bridging loop, STP is disabled or someone applied a filter in the wrong place or such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC A wants to communicate with PC B. It first ARPs for the MAC of PC B, the destination is a broadcast with MAC ffff.ffff.ffff. So the frame goes to both SW1 and SW3. The SRC MAC is PC A. SW1 then floods the frame towards SW3 and SW3 will flood the frame coming from SW2 to SW1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW1 and SW3 learned the MAC of PC A when the first frame came in. When the second one comes in from the opposite direction it has to relearn it. Because these events occur so fast and repeatedly you will see log messages complaining about MAC flapping. Something like &quot;MAC FLAP 0000.0000.0001 is flapping between Gi0/24 and Gi0/23&quot;. This is a good sign that you have a loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you could do then is to try to trace this MAC. Try looking in the ARP cache of a device in the same subnet and see what IP this device has. So with the MAC you could try to trace it with sh mac-address-table or with the IP maybe you have a list with all IPs and where they are connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the host gets a IP address from a DHCP server you could also try there to find where the host is coming from. If you have option 82 enabled that would be a great help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other signs are that the CLI will be very sluggish. CPU load will be very high. Switches do almost everything in ASICs so if a switch has a CPU load over 50% it's probably not good. You should implement SNMP monitoring and watch for high CPU load. Also look for the MAC flap messages. If the switches have a loop the LEDs will probably be blinking like crazy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Things you could do to protect against loops:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Enable STP! (duh)&lt;/li&gt;&#xA;&lt;li&gt;SNMP monitoring of CPU load&lt;/li&gt;&#xA;&lt;li&gt;Enable SNMP traps for certain events like STP topology changes&lt;/li&gt;&#xA;&lt;li&gt;Enable storm control on the ports to limit broadcast&lt;/li&gt;&#xA;&lt;li&gt;Don't span your VLANs too much in your L2 topology&lt;/li&gt;&#xA;&lt;li&gt;Enable port security and limit number of MAC addresses per port&lt;/li&gt;&#xA;&lt;li&gt;Enable Option82 if you run DHCP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-15T11:29:51.447" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="400" PostTypeId="1" CreationDate="2013-05-15T11:45:34.147" Score="11" ViewCount="4935" Body="&lt;p&gt;I've encountered a problem on a cisco ws-c3750x-48ts-s where jumbo-frames won't cross a trunk-connection between a vwmare esx-host and the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The access ports in the same vlan don't experience any problems.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect that the problem lies with the mtu for the SVI for that vlan since it's derived from the &lt;em&gt;system mtu&lt;/em&gt; value and not the &lt;em&gt;system-mtu jumbo&lt;/em&gt; command :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*&amp;lt;hostname&amp;gt;*#show vlan mtu&#xA;&#xA;VLAN    SVI_MTU    MinMTU(port)      MaxMTU(port)     MTU_Mismatch&#xA;---- ------------- ----------------  ---------------  ------------&#xA;1    1500          9198              9198              No&#xA;10   1500          9198              9198              No&#xA;20   1500          9198              9198              No&#xA;30   1500          9198              9198              No&#xA;31   1500          9198              9198              No&#xA;150  1500          9198              9198              No&#xA;151  1500          9198              9198              No&#xA;200  1500          9198              9198              No&#xA;250  1500          9198              9198              No&#xA;255  1500          9198              9198              No&#xA;444  1500          9198              9198              No&#xA;&#xA;*&amp;lt;hostname&amp;gt;*#show interfaces vlan 150&#xA;Vlan150 is up, line protocol is up&#xA;  Hardware is EtherSVI, address is c89c.1d49.b245 (bia c89c.1d49.b245)&#xA;  Description: iSCSI&#xA;  Internet address is 10.150.7.254/21&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to increase the SVI MTU to 9198, since &lt;em&gt;system mtu&lt;/em&gt; has a max-value of 1998?&lt;/p&gt;&#xA;" OwnerUserId="376" LastEditorUserId="376" LastEditDate="2013-05-24T10:39:30.200" LastActivityDate="2013-05-24T10:39:30.200" Title="catalyst 3750x - jumbo frames on svi" Tags="|cisco|cisco-catalyst|cisco-ios-15|mtu|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="401" PostTypeId="2" ParentId="395" CreationDate="2013-05-15T11:53:38.063" Score="9" Body="&lt;p&gt;for IOS:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will probably have MAC addresses flapping between ports.. look for &lt;code&gt;MAC_MOVE_NOTIFICATION&lt;/code&gt; (or similar) errors in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh logg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now to find the port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh int g0/1 controller&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;look for out of ordinary &lt;code&gt;Multicast&lt;/code&gt; and &lt;code&gt;Broadcast&lt;/code&gt; numbers. Any collisions are a bad sign.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last but not least, you can't log in, because the CPU is pwned :)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh proc cpu&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How is the switch doing here? If it's an L2 switch only, you don't want anything above ~10%&lt;/p&gt;&#xA;" OwnerUserId="7" LastActivityDate="2013-05-15T11:53:38.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="402" PostTypeId="2" ParentId="395" CreationDate="2013-05-15T12:03:37.513" Score="22" Body="&lt;p&gt;One of my users recently borrowed a desktop switch from someone's desk. Upon returning the switch, they plugged in all of the loose ethernet ends that were nearby. One of those cables went to the network and another was two ends of the same cable. The desktop switch was plugged into the network and also plugged into itself. The switch had no STP, so broadcasts that came in from the network would loop on the other cable in both directions. Of course, each time a broadcast was received on the looped ports it gets replicated back into the network. It drove HSRP absolutely mad and--due to poor design--it also resulted in OSPF adjacency failures across the campus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first indication of the problem was a macflap forwarded to my email. This immediately led us to the correct wiring closet. From there, it was a process of elimination based on port LEDs, interface pps and logs. Needless to say, I have since rearchitected the entire campus. The best preventative measure is probably bpduguard. I have since deployed the feature and it was quite simple. Getting that errdisable syslog in my email is nothing short of bliss.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-15T12:03:37.513" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="403" PostTypeId="2" ParentId="400" CreationDate="2013-05-15T12:06:33.027" Score="14" Body="&lt;p&gt;From the configuration guide:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Frames sizes that can be received by the switch CPU are limited to 1998 bytes, no matter what value was entered with the system mtu or system mtu jumbo commands. Although frames that are forwarded or routed are typically not received by the CPU, in some cases packets are sent to the CPU, such as traffic sent to control traffic, SNMP, Telnet, or routing protocols.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But if it's received over a trunk it shouldn't be routed in the first place and even if it was the jumbo MTU should still apply.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Routed packets are subjected to MTU checks on the output ports. The MTU value used for routed ports is derived from the applied system mtu value (not the system mtu jumbo value). That is, the routed MTU is never greater than the system MTU for any VLAN. The routing protocols use the system MTU value when negotiating adjacencies and the MTU of the link. For example, the Open Shortest Path First (OSPF) protocol uses this MTU value before setting up an adjacency with a peer router. To view the MTU value for routed packets for a specific VLAN, use the show platform port-asic mvid privileged EXEC command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Can you try this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show platform port-asic mvid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it seems 1998 is max on SVI.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-15T12:06:33.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="404" PostTypeId="2" ParentId="395" CreationDate="2013-05-15T12:11:02.543" Score="11" Body="&lt;p&gt;With most equipment, the CPU shoots to 100% and the only thing you can do is break the redundant physical connections.  Once the CPU calms down you can plug the links back in one by one and see which one re-causes the loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For big chassis (like a 6500) I've had to pull out all of the blades and plug them back in one at a time.  Once I figured out which blade, then I had to pull all of the individual links (16 GBICs) and put them back in one at a time as well.  Never fun.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some more modern equipment has a protected CPU which should make this easier to deal with - you can still interact with the box.  At that point looking at traffic counters and such to determine the malfunctioning link becomes possible.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2013-05-15T12:11:02.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="405" PostTypeId="2" ParentId="382" CreationDate="2013-05-15T12:19:52.620" Score="6" Body="&lt;p&gt;I don't know for sure, but&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set routing-instances red instance-type vpls protocols vpls control-word&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;commits for me on &lt;em&gt;12.3R2.5&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and this is mentioned &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.2/information-products/topic-collections/release-notes/12.2/index.html?topic-66803.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On MX Series routers with the Channelized OC3/STM1 (Multi-Rate)&#xA;  Circuit Emulation MIC with SFP, Junos OS substantially supports RFC&#xA;  4385, Pseudowire Emulation Edge-to-Edge (PWE3) Control Word for Use&#xA;  over an MPLS PSN&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="7" LastEditorUserId="49" LastEditDate="2013-05-15T14:02:05.557" LastActivityDate="2013-05-15T14:02:05.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="407" PostTypeId="2" ParentId="395" CreationDate="2013-05-15T16:00:06.870" Score="11" Body="&lt;p&gt;I recently started at a company where they use broadcast limits on each port.  If a port passes &gt;5% of it's capacity as broadcasts the switch puts it into ERRDISABLE.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; storm-control broadcast level 5.00  &#xA; storm-control action shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This has been a life saver when one group tends to plug in devices that bridge the wireless networks onto the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though for your actual question, I've always found it to be manual.&lt;/p&gt;&#xA;" OwnerUserId="142" LastActivityDate="2013-05-15T16:00:06.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="408" PostTypeId="2" ParentId="390" CreationDate="2013-05-15T16:32:05.393" Score="3" Body="&lt;p&gt;I would start with debugging commands. I'd start with&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;debug event manager tcl cli&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's more information in the EEM best practices document over at &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-12757&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/docs/DOC-12757&lt;/a&gt; about debugging and troubleshooting.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-15T16:32:05.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="409" PostTypeId="2" ParentId="395" CreationDate="2013-05-15T17:07:20.943" Score="0" Body="&lt;p&gt;Determining a loop really depends on the brand of switch that you have. For example, on an Extreme switch, I can run elrp-client on a VLAN and the switch will basically send out a broadcast frame on all ports for that VLAN and see if it returns by any of them, if so, it tells me which port(s) the frame was received back on, thereby revealing the loop candidates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a Cisco, you can enable storm control, which is a bit more of a blunt instrument since it will basically block the port for a period of time until the status clears (or you clear the errdisable state) - generally speaking however, this sort of thing is only relevant when you're using Cisco switches in a mixed topology of devices that do not do spanning tree nor forward BPDUs.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-05-15T17:07:20.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="410" PostTypeId="1" AcceptedAnswerId="513" CreationDate="2013-05-15T17:30:07.647" Score="8" ViewCount="3402" Body="&lt;p&gt;I have a 1260 AP that I upgraded this morning.  Prior to the upgrade, the system permitted ssh and would respond to pings on the network, however now it does not respond.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hooked up a serial cable and surfing around the config I can't seem to find anything amiss, and turning on ssh debugging is not producing any output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried regenerating the RSA key in the off chance that was causing ssh to not come online, however it has not affected the inability to contact the unit over the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried turning on &quot;ip routing&quot; and &quot;ip cef&quot; thinking they might be the issue, but no effect.  I also added a static default route out to our management gateway in hopes that perhaps it was a default route issue but it also did not help&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the current version of IOS on the unit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco IOS Software, C1260 Software (AP3G1-K9W7-M), Version 15.2(2)JB, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2012 by Cisco Systems, Inc.&#xA;Compiled Mon 10-Dec-12 23:42 by prod_rel_team&#xA;&#xA;ROM: Bootstrap program is C1260 boot loader&#xA;BOOTLDR: C1260 Boot Loader (AP3G1-BOOT-M), Version 12.4 [mpleso-ap_jmr3_esc_0514 125]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the current running config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DEN-AP01#sh run full&#xA;Building configuration...&#xA;&#xA;Current configuration : 3535 bytes&#xA;!&#xA;! Last configuration change at 00:22:30 UTC Mon Mar 1 1993 by gbeech&#xA;version 15.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname DEN-AP01&#xA;!&#xA;!&#xA;logging rate-limit console 9&#xA;logging console warnings&#xA;enable secret 5 redacted&#xA;!&#xA;no aaa new-model&#xA;ip cef&#xA;ip domain name ds.stackexchange.com&#xA;!&#xA;!&#xA;!&#xA;dot11 syslog&#xA;dot11 vlan-name DEN-CLIENTS vlan 20&#xA;dot11 vlan-name DEN-MGMT vlan 10&#xA;dot11 vlan-name DEN-WIRELESS vlan 50&#xA;!&#xA;dot11 ssid StackGuest&#xA;   vlan 50&#xA;   authentication open&#xA;   authentication key-management wpa version 2&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 redacted&#xA;!&#xA;!&#xA;dot11 network-map&#xA;crypto pki token default removal timeout 0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption mode ciphers tkip&#xA; !&#xA; encryption vlan 50 mode ciphers aes-ccm tkip&#xA; !&#xA; ssid StackGuest&#xA; !&#xA; antenna gain 0&#xA; mbssid&#xA; speed  basic-1.0 basic-2.0 basic-5.5 basic-11.0 basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0&#xA; channel 2427&#xA; station-role root&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.50&#xA; encapsulation dot1Q 50&#xA; no ip route-cache&#xA; bridge-group 50&#xA; bridge-group 50 subscriber-loop-control&#xA; bridge-group 50 spanning-disabled&#xA; bridge-group 50 block-unknown-source&#xA; no bridge-group 50 source-learning&#xA; no bridge-group 50 unicast-flooding&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption vlan 50 mode ciphers tkip&#xA; !&#xA; encryption mode ciphers tkip&#xA; !&#xA; ssid StackGuest&#xA; !&#xA; antenna gain 0&#xA; dfs band 3 block&#xA; mbssid&#xA; channel dfs&#xA; station-role root&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1.50&#xA; encapsulation dot1Q 50&#xA; no ip route-cache&#xA; bridge-group 50&#xA; bridge-group 50 subscriber-loop-control&#xA; bridge-group 50 spanning-disabled&#xA; bridge-group 50 block-unknown-source&#xA; no bridge-group 50 source-learning&#xA; no bridge-group 50 unicast-flooding&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; no ip route-cache&#xA; duplex auto&#xA; speed auto&#xA; no keepalive&#xA; bridge-group 20&#xA; bridge-group 20 spanning-disabled&#xA; no bridge-group 20 source-learning&#xA;!&#xA;interface GigabitEthernet0.10&#xA; encapsulation dot1Q 10&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; no bridge-group 1 source-learning&#xA;!&#xA;interface GigabitEthernet0.50&#xA; encapsulation dot1Q 50&#xA; no ip route-cache&#xA; bridge-group 50&#xA; bridge-group 50 spanning-disabled&#xA; no bridge-group 50 source-learning&#xA;!&#xA;interface BVI1&#xA; ip address 10.15.0.6 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;interface BVI50&#xA; no ip address&#xA; no ip route-cache&#xA;!&#xA;ip default-gateway 10.15.0.1&#xA;ip forward-protocol nd&#xA;ip http server&#xA;no ip http secure-server&#xA;ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag&#xA;ip route 0.0.0.0 0.0.0.0 10.15.0.1&#xA;!&#xA;access-list 111 permit tcp any any neq telnet&#xA;bridge 1 route ip&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; access-class 111 in&#xA;line vty 0 4&#xA; login local&#xA; transport input ssh&#xA;line vty 5 15&#xA; login local&#xA; transport input ssh&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any suggestions would be appreciated, I'm pretty stumped as to why this would suddenly go wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: Here's the recreating of crypto keys output.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DEN-AP01(config)#crypto key generate rsa modulus 1024&#xA;% You already have RSA keys defined named DEN-AP01.ds.stackexchange.com.&#xA;% They will be replaced.&#xA;&#xA;% The key modulus size is 1024 bits&#xA;% Generating 1024 bit RSA keys, keys will be non-exportable...&#xA;[OK] (elapsed time was 1 seconds)&#xA;&#xA;DEN-AP01(config)#&#xA;*Mar  1 01:02:01.411: %SSH-5-DISABLED: SSH 1.99 has been disabled&#xA;*Mar  1 01:02:02.515: %SSH-5-ENABLED: SSH 1.99 has been enabled&#xA;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="154" LastEditorUserId="33" LastEditDate="2013-05-25T17:47:20.947" LastActivityDate="2018-03-10T13:13:59.993" Title="Cisco 1260 AP no longer responds to ping, ssh after upgrade to latest 15.x firmware" Tags="|cisco|wireless|cisco-ios-15|ieee-802.11|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="411" PostTypeId="2" ParentId="410" CreationDate="2013-05-15T17:45:29.150" Score="1" Body="&lt;p&gt;Your configuration above doesn't show a crypto key configuration. There should be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto pki certificate chain TP-self-signed-1306837737  &#xA;  certificate self-signed 01  &#xA;  3082022B 30820194  &#xA;  ((snip snip :))  &#xA;  quit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would try re-running the &lt;code&gt;crypto key generate rsa&lt;/code&gt; command.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-15T17:45:29.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="412" PostTypeId="1" AcceptedAnswerId="413" CreationDate="2013-05-15T20:29:01.537" Score="37" ViewCount="2627" Body="&lt;p&gt;I've been looking at a hardware network tap &lt;a href=&quot;http://www.netoptics.com/products/10100/10100baset-teeny-tap&quot;&gt;like this one&lt;/a&gt; to replace a pseudo-permanent SPAN that's been running on a Catalyst switch. All the taps I find have four interfaces: A, B, and two output ports (one for each direction). Ideally I would prefer to funnel the traffic from both directions into one cable so I only have to capture from one interface. Why do taps always seem to have two output ports?&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-16T20:46:59.043" Title="Why do network taps have four ports?" Tags="|tap|packet-analysis|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="413" PostTypeId="2" ParentId="412" CreationDate="2013-05-15T20:33:11.380" Score="35" Body="&lt;p&gt;Hardware network taps provide one output port in each direction to ensure that traffic can be replicated at line rate. For example, a 100 Mbps Ethernet connection provides a theoretical maximum of 200 Mbps of total bandwidth; 100 Mbps in each way. If you tried to capture traffic from a line which was carrying 75 Mbps in each direction, you would need at least 150 Mbps of one-way bandwidth: more than a single 100 Mbps connection can carry. Hence, taps include two output ports operating at the same speed as the line being monitored.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-15T20:33:11.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="415" PostTypeId="1" AcceptedAnswerId="516" CreationDate="2013-05-15T21:08:10.863" Score="8" ViewCount="26791" Body="&lt;p&gt;I have an scenario where a Fortigate firewall is used to separate internal networks from the Internet (FortiOS Version 4.0 MR3 patch 11). Right now there is a single Internet connection attached to the firewall and a default static route is used to get all Internet traffic through it. I would like to attach a second Internet connection to the firewall and then route only certain traffic through it, for example web browsing traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this setup, I keep the current static default route through the first link and then configure policy routing options in order to route traffic with destination port TCP/80 and TCP/443 through the second Internet link. As expected, policy routing is evaluated before routing table and all traffic destined to TCP/80 and TCP/443 is sent through to second link, including traffic between subnets directly connected to the Fortigate, what breaks communication between them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a Cisco environment I would adjust the ACL used to match traffic for policy routing, denying traffic between internal networks at the beginning of the ACL and adding a &quot;permit any&quot; statement at the end. However, I can not find the way to instruct the Fortigate to work in a similar manner. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know how to make this scenario working with Fortigate? &lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-05-21T06:24:08.780" LastActivityDate="2020-07-25T14:04:21.600" Title="Policy routing configuration in Fortigate" Tags="|routing|pbr|fortinet|fortigate|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="416" PostTypeId="1" AcceptedAnswerId="440" CreationDate="2013-05-15T21:45:47.623" Score="8" ViewCount="14463" Body="&lt;p&gt;I will be performing NAT on the outside interface of an ASA to a web server within a DMZ. I would like to disable proxy-arp on all the interfaces that I can. I know that outside interface will need to have proxy-arp enabled because of the NAT statement. Do I need to have proxy-arp enabled on the DMZ interface as well?  &lt;/p&gt;&#xA;" OwnerUserId="446" LastEditorUserId="231" LastEditDate="2013-05-23T11:42:37.193" LastActivityDate="2013-05-23T11:42:37.193" Title="ASA use of proxy ARP for NAT" Tags="|cisco-asa|nat|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="417" PostTypeId="2" ParentId="416" CreationDate="2013-05-15T22:29:15.117" Score="4" Body="&lt;p&gt;You don't need proxy arp on the DMZ LAN. The web system will answer ARP for itself on that LAN. &lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-15T22:29:15.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="418" PostTypeId="2" ParentId="412" CreationDate="2013-05-15T23:53:24.430" Score="8" Body="&lt;p&gt;Like Jeremy said, you're only able to tap at line speed in one direction because normal connections are full duplex; you're only receiving. An added benefit/side effect/reason for doing so is to &lt;em&gt;ensure&lt;/em&gt; that you don't put any packets back out on the wire (for passive taps).&lt;/p&gt;&#xA;" OwnerUserId="455" LastActivityDate="2013-05-15T23:53:24.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="419" PostTypeId="2" ParentId="342" CreationDate="2013-05-15T23:55:34.937" Score="3" Body="&lt;p&gt;Short answer, no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer, no and..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically the netscreens will listen for any IKE packets coming to the device and attempt to process them. While it's a vector for attacks I haven't seen juniper change this behavior. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Short of filling up your event log it shouldn't do much assuming it's a single source attempting to stand up a VPN tunnel to you. If you think it's impacting your performance you can check 'get cpu perf all detail&quot; and see the task/flow CPU usage. &lt;/p&gt;&#xA;" OwnerUserId="90" LastActivityDate="2013-05-15T23:55:34.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="420" PostTypeId="2" ParentId="233" CreationDate="2013-05-16T00:00:00.647" Score="0" Body="&lt;p&gt;As a temp work around you could always disable tcp-syn-checking with will allow the traffic to return if it matches security policy but does not have a proper 3 way set up already complete. Basically it will allow a data packet to create a session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is less secure and not ideal, but in the short term til you get your stuff fixed it maybe a viable work around. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional info:&#xA;&lt;a href=&quot;http://www.juniper.net/techpubs/software/junos-security/junos-security10.2/junos-security-swconfig-security/topic-44055.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/software/junos-security/junos-security10.2/junos-security-swconfig-security/topic-44055.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB21266&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB21266&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="90" LastActivityDate="2013-05-16T00:00:00.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="422" PostTypeId="2" ParentId="363" CreationDate="2013-05-16T01:04:38.160" Score="0" Body="&lt;p&gt;Ask your peers what AS macro they will be announcing and build filters for them using IRRToolSet or rpsltool or irrpt.  Encourage them to have correct information published in an IRRdb.  Don't forget to update your own &lt;code&gt;aut-num&lt;/code&gt; object in your nearest friendly IRRdb to reflect the adjacency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RPKI is not the way forward as it does not protect against route leaks.&lt;/p&gt;&#xA;" OwnerUserId="56" LastActivityDate="2013-05-16T01:04:38.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="423" PostTypeId="5" CreationDate="2013-05-16T01:18:10.460" Score="0" Body="&lt;p&gt;Virtual LANs (VLANs) are used to divide what otherwise would be a single OSI layer-2 broadcast domain into multiple, logical OSI layer-2 broadcast domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs are like any OSI layer-2 broadcast domain:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLANs are not necessarily tied to a single physical device.&lt;/li&gt;&#xA;&lt;li&gt;VLANs are bounded by OSI layer-3.&lt;/li&gt;&#xA;&lt;li&gt;Traffic from one VLAN to another VLAN must be routed at OSI layer-3 (for example by an IP router).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;VLANs are most commonly used with Ethernet, where they are a variation on the frame format.&lt;/p&gt;&#xA;" OwnerUserId="336" LastEditorUserId="947" LastEditDate="2017-02-26T02:32:59.580" LastActivityDate="2017-02-26T02:32:59.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="424" PostTypeId="4" CreationDate="2013-05-16T01:18:10.460" Score="0" Body="For questions about Virtual LANs (VLANs) which are used to divide what otherwise would be a single OSI layer-2 broadcast domain into multiple, logical OSI layer-2 broadcast domains." OwnerUserId="336" LastEditorUserId="8499" LastEditDate="2015-11-10T20:07:03.397" LastActivityDate="2015-11-10T20:07:03.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="425" PostTypeId="2" ParentId="400" CreationDate="2013-05-16T01:20:56.930" Score="0" Body="&lt;p&gt;Try &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_55_se/configuration/guide/swint.html#wp1154596&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;system mtu routing&lt;/code&gt;&lt;/a&gt;. See the link for caveats that may apply to your situation.&lt;/p&gt;&#xA;" OwnerUserId="56" LastActivityDate="2013-05-16T01:20:56.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="426" PostTypeId="5" CreationDate="2013-05-16T01:56:35.533" Score="0" Body="&lt;p&gt;The bit error rate or bit error ratio (BER) is the number of bit errors divided by the total number of transferred bits during a studied time interval. BER is a unitless performance measure, often expressed as a percentage. BERT or bit error rate test is a testing method for digital communication circuits that uses predetermined stress patterns consisting of a sequence of logical ones and zeros generated by a test pattern generator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A BERT typically consists of a test pattern generator and a receiver that can be set to the same pattern. They can be used in pairs, with one at either end of a transmission link, or singularly at one end with a loopback at the remote end.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2014-06-24T13:21:21.693" LastActivityDate="2014-06-24T13:21:21.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="427" PostTypeId="4" CreationDate="2013-05-16T01:56:35.533" Score="0" Body="For questions about the bit error rate (BER), where it is the number of bit errors per unit time." OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2018-02-17T19:28:06.277" LastActivityDate="2018-02-17T19:28:06.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="428" PostTypeId="5" CreationDate="2013-05-16T01:57:38.570" Score="0" Body="&lt;p&gt;CoS can be used to differentiate frame priorities for QoS functions (queuing, shaping, policing, etc.) at layer-2.&lt;/p&gt;&#xA;" OwnerUserId="7495" LastEditorUserId="8499" LastEditDate="2016-11-29T17:29:20.583" LastActivityDate="2016-11-29T17:29:20.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="429" PostTypeId="4" CreationDate="2013-05-16T01:57:38.570" Score="0" Body="For questions about Class of Service, a layer-2 QoS mechanism used with VLAN tags." OwnerUserId="7495" LastEditorUserId="8499" LastEditDate="2016-11-29T17:33:20.890" LastActivityDate="2016-11-29T17:33:20.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="430" PostTypeId="1" CreationDate="2013-05-16T02:17:00.993" Score="11" ViewCount="3508" Body="&lt;p&gt;Let's do some path MTU discovery between two Debian hosts separated by a Debian router that runs Shorewall-generated iptables rules. Each of the two hosts uses a single Ethernet link while the router uses tagged VLANs over two aggregated Ethernet links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;a href=&quot;http://www.caida.org/tools/measurement/scamper/&quot;&gt;scamper&lt;/a&gt; :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kitandara:/home/jm# scamper -I &quot;trace -M 10.64.0.2&quot;&#xA;traceroute from 10.1.0.5 to 10.64.0.2&#xA; 1  10.1.0.1  0.180 ms [mtu: 6128]&#xA; 2  10.64.0.2  0.243 ms [mtu: 6128]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Good: 6128 bytes is the expected result (cheap Realtek Ethernet adapters can't handle jumbo frames of a decent size).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let &lt;a href=&quot;http://iperf.fr/&quot;&gt;iperf&lt;/a&gt; perform a throughput test and tell us about the MTU by the way :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kitandara:/home/jm# iperf -c 10.64.0.2 -N -m&#xA;------------------------------------------------------------&#xA;Client connecting to 10.64.0.2, TCP port 5001&#xA;TCP window size: 66.2 KByte (default)&#xA;------------------------------------------------------------&#xA;[  3] local 10.1.0.5 port 59828 connected with 10.64.0.2 port 5001&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  3]  0.0-10.0 sec  1011 MBytes   848 Mbits/sec&#xA;[  3] MSS size 6076 bytes (MTU 6116 bytes, unknown interface)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;6116 bytes ? Why ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now for something completely different, let's see what this session's traffic actually contained :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kitandara:/home/jm# tshark -i eth0 -R &quot;(ip.dst == 10.64.0.2) || (ip.src == 10.64.0.2)&quot; | head&#xA;Capturing on eth0&#xA;  1.308557     10.1.0.5 -&amp;gt; 10.64.0.2    TCP 74 60310 &amp;gt; 5001 [SYN] Seq=0 Win=5340 Len=0 MSS=534 SACK_PERM=1 TSval=101928961 TSecr=0 WS=16&#xA;  1.308801    10.64.0.2 -&amp;gt; 10.1.0.5     TCP 74 5001 &amp;gt; 60310 [SYN, ACK] Seq=0 Ack=1 Win=18328 Len=0 MSS=6088 SACK_PERM=1 TSval=3764064056 TSecr=101928961 WS=64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;6088 bytes MSS, which means a 6128 MTU... Good. But then why does iperf announce a 6116 bytes MTU ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At that point thoroughness calls for a closer look at what happens during the scamper trace session :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@kitandara:/home/jm# tshark -i eth0 -R &quot;(ip.dst == 10.64.0.2) || (ip.src == 10.64.0.2)&quot;&#xA;Capturing on eth0&#xA;  0.000000     10.1.0.5 -&amp;gt; 10.64.0.2    UDP 58 Source port: 43870  Destination port: 33435&#xA;  0.000175     10.1.0.1 -&amp;gt; 10.1.0.5     ICMP 86 Time-to-live exceeded (Time to live exceeded in transit)&#xA;  0.050358     10.1.0.5 -&amp;gt; 10.64.0.2    UDP 58 Source port: 43870  Destination port: 33436&#xA;  0.050592    10.64.0.2 -&amp;gt; 10.1.0.5     ICMP 86 Destination unreachable (Port unreachable)&#xA;  0.099790     10.1.0.5 -&amp;gt; 10.64.0.2    UDP 6142 Source port: 43870  Destination port: 33437&#xA;  0.100912    10.64.0.2 -&amp;gt; 10.1.0.5     ICMP 590 Destination unreachable (Port unreachable)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All those packets have a udp.length of 24 except the two last which have a udp.length of 6108... But then how does scamper tell us that the path MTU is 6128 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6108, 6116, 6128... So many MTU to choose from !&lt;/p&gt;&#xA;" OwnerUserId="484" LastEditorUserId="484" LastEditDate="2013-05-16T06:32:56.310" LastActivityDate="2013-05-29T15:30:55.897" Title="Why don't iperf, scamper and path MTU discovery packet captures agree on the path's MTU?" Tags="|routing|ipv4|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="431" PostTypeId="2" ParentId="202" CreationDate="2013-05-16T02:56:28.057" Score="1" Body="&lt;p&gt;For the IGPs, cant you just use the regular metric tuning? EIGRP - just manipulate the delay and for OSPF the cost. Once it hits the BGP core, cant you use BGP meds.  For my company (financial intuition) i know thats what we do. We have an A feed and B feed. A feed will have better internal metrics than B. Once it hits our BGP core then its pretty much what I listed above.&lt;/p&gt;&#xA;" OwnerUserId="495" LastActivityDate="2013-05-16T02:56:28.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="432" PostTypeId="5" CreationDate="2013-05-16T03:34:58.623" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-16T03:34:58.623" LastActivityDate="2013-05-16T03:34:58.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="433" PostTypeId="4" CreationDate="2013-05-16T03:34:58.623" Score="0" Body="A tag for questions involving Brocade Communications Systems hardware or software." OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2013-11-27T17:50:21.350" LastActivityDate="2013-11-27T17:50:21.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="435" PostTypeId="2" ParentId="415" CreationDate="2013-05-16T03:46:14.360" Score="7" Body="&lt;p&gt;From &lt;a href=&quot;http://www.networklabs.info/2012/07/policy-based-routing.html&quot; rel=&quot;noreferrer&quot;&gt;Network Labs&lt;/a&gt; blog:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;In case of a Fortinet firewall, its Policy Route:&lt;br&gt;  CLI version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config router policy&#xA;    edit 1&#xA;        set input-device &quot;port4&quot;&#xA;        set src 172.18.0.0 255.255.0.0&#xA;        set dst 192.168.3.0 255.255.255.0&#xA;        set protocol 6&#xA;        set start-port 443&#xA;        set end-port 443&#xA;        set gateway 1.1.1.1&#xA;        set output-device &quot;port3&quot;&#xA;    next&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For the GUI version, check the blog above. Can't post images until I get 10 rep points. :-/&lt;/p&gt;&#xA;" OwnerUserId="496" LastEditorUserId="76" LastEditDate="2013-05-16T20:27:02.057" LastActivityDate="2013-05-16T20:27:02.057" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="436" PostTypeId="2" ParentId="395" CreationDate="2013-05-16T03:57:37.853" Score="2" Body="&lt;p&gt;I had this issue occur on a network on the other end of the US and had to remotely help some level one analysts via the phone and my wan link to their site. The issue was complicated further by the fact that they had several brands of switches which they had slowly added to the network over the years. When they moved the office, they marked where each port went then re-attached everything the exact same way at the new office and started everything up. Needless to say that the handful of switches that did have working spanning tree didn't converge the same way and they had all kinds of loops and issues. By the time I was done fixing everything no less than three unmanaged switches were discovered to have been connected in loops with the rest of the infrastructure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I was able to track down each of the unmanaged switches was by using a tool called nedi (on the switches which were able to be managed I enabled lldp/cdp). I first generated maps with nedi. Then in areas where the map showed connections from one switch to another then back around to the same switch again I had the network technician on site trace the line manually. I either manually shutdown the interfaces involved with the loop or had the onsite person unplug cables. In the end I was able to get the network working as it should, despite all the crazy off brand switches.&lt;/p&gt;&#xA;" OwnerUserId="499" LastActivityDate="2013-05-16T03:57:37.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="437" PostTypeId="2" ParentId="430" CreationDate="2013-05-16T05:41:58.843" Score="4" Body="&lt;p&gt;Very interesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MSS (maximum segment size) = MTU - IP header = 6076.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6076 + 40 = 6116. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be Debian is using the IP options fields in the IP header? That might be the extra 12 bytes...&lt;/p&gt;&#xA;" OwnerUserId="503" LastActivityDate="2013-05-16T05:41:58.843" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="438" PostTypeId="2" ParentId="355" CreationDate="2013-05-16T06:20:13.377" Score="0" Body="&lt;p&gt;As other people have already pointed out, the only semi-sane design is to configure static routes pointing to (or across) the non-OSPF device at the edge OSPF device and redistribute them into OSPF. Configuring static routes on other OSPF devices would be a nightmare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, assuming the non-OSPF device is totally IGP-clueless (it cannot run RIP or EIGRP, for example), there are two ways to make the routing at least a bit more dynamic (to detect failures in the IGP-clueless device, for example):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Use IP SLA to ping an IP address across that device and tie the static route to the results of IP SLA. If the IGP-clueless device fails, the ping fails, and the static route is gone. More @ &lt;a href=&quot;http://blog.ioshints.info/search?q=sla+track&quot; rel=&quot;nofollow&quot;&gt;http://blog.ioshints.info/search?q=sla+track&lt;/a&gt; and &lt;a href=&quot;http://stack.nil.com/ipcorner/SmallSiteMultiHoming/&quot; rel=&quot;nofollow&quot;&gt;http://stack.nil.com/ipcorner/SmallSiteMultiHoming/&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Run BGP across the IGP-clueless device.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="317" LastActivityDate="2013-05-16T06:20:13.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="439" PostTypeId="1" AcceptedAnswerId="443" CreationDate="2013-05-16T07:32:46.673" Score="13" ViewCount="12800" Body="&lt;p&gt;I am looking to read optical transmit and recieve power of XFPs in our ASR9k. The MIB used should be &quot;CISCO-ENTITY-SENSOR-MIB&quot; which is &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.91&quot;&gt;1.3.6.1.4.1.9.9.91&lt;/a&gt; and occording the ASR9000 documentation, this is available on ASR9k's:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/asr9000/mib/guide/asr9kmib3.html#wp2293135&quot;&gt;http://www.cisco.com/en/US/docs/routers/asr9000/mib/guide/asr9kmib3.html#wp2293135&lt;/a&gt;&#xA;If you scroll up, you will see that the MIB is in the supported list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question: am I missing something and should this information be available to SNMP, or is the Cisco documentation wrong here?&#xA;And if it is available, how can I get to this information?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However show snmp mib object-name | i 1.3.6.1.4.1.9.9.91 gives me nothing&#xA;neither does show snmp mib object-name | i Sensor&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;RP/0/RSP0/CPU0:router#show snmp mib object-name | i 1.3.6.1.4.1.9.9.91&#xA;  Thu May 16 09:08:01.679 CET &#xA;  RP/0/RSP0/CPU0:router#show snmp mib&#xA;  object-name | i [sS]ensor Thu May 16 09:08:19.017 CET&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The version:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;RP/0/RSP0/CPU0:router#show version Thu May 16 09:07:14.437 CET&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Cisco IOS XR Software, Version 4.2.3[Default] Copyright (c) 2012 by&#xA;  Cisco Systems, Inc.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ROM: System Bootstrap, Version 1.06(20120210:003513) [ASR9K ROMMON],&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;cn-asd-kl-cr15 uptime is 23 weeks, 3 days, 1 hour, 12 minutes System&#xA;  image file is&#xA;  &quot;bootflash:disk0/asr9k-os-mbi-4.2.3/0x100000/mbiasr9k-rp.vm&quot;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;cisco ASR9K Series (MPC8641D) processor with 4194304K bytes of memory.&#xA;  MPC8641D processor at 1333MHz, Revision 2.2 ASR 9006 AC Chassis with&#xA;  PEM Version 2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And the XFP I am trying to read:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;RP/0/RSP0/CPU0:router#show inventory NAME: &quot;module 0/0/CPU0&quot;, DESCR:&#xA;  &quot;8-Port 10GE Low Queue Line Card, Requires XFPs&quot; PID: A9K-8T-L, VID:&#xA;  V04, SN: FOC1641N6EH&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;NAME: &quot;module mau TenGigE0/0/CPU0/0&quot;, DESCR: &quot;Multirate 10GBASE-LR and&#xA;  OC-192/STM-64 SR-1 XFP, SMF&quot; PID: XFP-10GLR-OC192SR  , VID: V04 , SN:&#xA;  SPC1623090S&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To compare, this is the output from our 7606:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;7606#show ver Cisco IOS Software, c7600s72033_rp Software&#xA;  (c7600s72033_rp-ADVIPSERVICESK9-M), Version 15.1(3)S4, RELEASE&#xA;  SOFTWARE (fc2)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;7606#show snmp mib | i Sensor entPhySensorType entPhySensorScale&#xA;  entPhySensorPrecision entPhySensorValue entPhySensorOperStatus&#xA;  entPhySensorUnitsDisplay entPhySensorValueTimeStamp&#xA;  entPhySensorValueUpdateRate entSensorType entSensorScale&#xA;  entSensorPrecision entSensorValue entSensorStatus&#xA;  entSensorValueTimeStamp entSensorValueUpdateRate&#xA;  entSensorMeasuredEntity entSensorThresholdSeverity&#xA;  entSensorThresholdRelation entSensorThresholdValue&#xA;  entSensorThresholdEvaluation entSensorThresholdNotificationEnable&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="220" LastEditorUserId="220" LastEditDate="2013-05-17T08:28:18.180" LastActivityDate="2016-08-17T13:48:29.240" Title="How do I read optical transmit power via SNMP on Cisco ASR9k?" Tags="|cisco|snmp|cisco-ios-xr|cisco-asr|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="440" PostTypeId="2" ParentId="416" CreationDate="2013-05-16T07:42:12.193" Score="2" Body="&lt;p&gt;The web server will only need to ARP the ASA to get the MAC address for its (default) gateway.&#xA;So, the ASA won't need to reply an ARP for any other IP addresses then its own. You can safely turn off proxy-arp on the DMZ interface. You are correct in your assumption that you need it for the outside interface.&lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2013-05-16T07:42:12.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="441" PostTypeId="2" ParentId="356" CreationDate="2013-05-16T08:00:08.327" Score="6" Body="&lt;p&gt;There are three options you can go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first one, and most accurate one, is to setup peering with Team Cymru, as SimonJGreen explains. You have the advantage of having the most accurate list, the disadvantage of maintaining the peering, the policy-statements/route-maps etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second route, would be to deny the prefixes that &quot;you should never see in the wild&quot;, such as the link-local prefix, the old 6Bone 3FFE::/16 prefix etc and combine that with the prefixes you should see. See below for an example. The advantage is that this is the easiest config, the disadvantage is that it isn't as accurate as the first option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third route, which you should &lt;strong&gt;never&lt;/strong&gt; implement, is to take the current ipv6 bogon list, as published by Team Cymru, and paste that as static filters in your config. This is what a lot of people did with ipv4 a few years ago, and leads to a lot of suffering today... Do not this this option. Ever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, here is a decent list of ipv6 prefixes to allow and prefixes to deny:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 prefix-list in-filter-v6 seq 5 deny 3ffe::/16 le 128 &#xA;ipv6 prefix-list in-filter-v6 seq 10 deny 2001:db8::/32 le 128 &#xA;ipv6 prefix-list in-filter-v6 seq 15 permit 2001::/32 &#xA;ipv6 prefix-list in-filter-v6 seq 20 deny 2001::/32 le 128 &#xA;ipv6 prefix-list in-filter-v6 seq 25 permit 2002::/16 &#xA;ipv6 prefix-list in-filter-v6 seq 30 deny 2002::/16 le 128 &#xA;ipv6 prefix-list in-filter-v6 seq 35 deny ::/8 le 128 &#xA;ipv6 prefix-list in-filter-v6 seq 40 deny fe00::/9 le 128 &#xA;ipv6 prefix-list in-filter-v6 seq 45 deny ff00::/8 le 128 &#xA;ipv6 prefix-list in-filter-v6 seq 50 permit 2000::/3 le 48 &#xA;ipv6 prefix-list in-filter-v6 seq 55 deny ::/0 le 128 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="515" LastActivityDate="2013-05-16T08:00:08.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="443" PostTypeId="2" ParentId="439" CreationDate="2013-05-16T09:12:17.653" Score="10" Body="&lt;p&gt;Have you tried walking the MIB/OIDs in question from a management station?  After having spent a lot of time w/firmware QA, I've noticed things like show commands are likely to not display correct info, even when the OIDs are poll-able.  I recommend using and knowing Net-SNMP tools and utils as debug before trying to poll the information in cacti, observium, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. &lt;code&gt;snmpwalk -v2c -c &amp;lt;community&amp;gt; &amp;lt;routername&amp;gt; 1.3.6.1.4.1.9.9.91&lt;/code&gt; will say &quot;No Such Object available on this agent at this OID&quot; if it's not there&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Walking 1.3.6.1.4.1.9 on my IOS-XE box gives a lot (I just need to add the MIBs for description). Then I have something to work with (including other gems that might benefit me for monitoring) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;snmpwalk -v2c -c &amp;lt;community&amp;gt; &amp;lt;routername&amp;gt; 1.3.6.1.4.1.9&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out the MIBs available for 4.2.x on the ASR 9000 @:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;ftp://ftp.cisco.com/pub/mibs/supportlists/asr9000/asr9000-supportlist.html#Supported_and_Verified_MIBs_XE_4_2_X&quot; rel=&quot;noreferrer&quot;&gt;ftp://ftp.cisco.com/pub/mibs/supportlists/asr9000/asr9000-supportlist.html#Supported_and_Verified_MIBs_XE_4_2_X&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That link says that the CISCO-ENTITY-SENSOR-MIB is available, and hasn't been updated since 2007.  Edit: it appears that the &lt;strong&gt;&lt;em&gt;asr9k-mgbl-p.pie&lt;/em&gt;&lt;/strong&gt; package was not available on the router, as mapped in the ASR9000 MIB list above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Supplemental info:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco's MIB Locator tool is IOS-only, so check out the directories above above the asr9000 on the FTP link for more info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tool: &lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/MainServlet&quot; rel=&quot;noreferrer&quot;&gt;http://tools.cisco.com/ITDIT/MIBS/MainServlet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SNMP ftp dir: &lt;a href=&quot;ftp://ftp.cisco.com/pub/mibs/supportlists/&quot; rel=&quot;noreferrer&quot;&gt;ftp://ftp.cisco.com/pub/mibs/supportlists/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information on loading MIBs: &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a00800b4cee.shtml&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a00800b4cee.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A really good Cisco SNMP links page:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/tk605/tsd_technology_support_sub-protocol_home.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/tech/tk648/tk362/tk605/tsd_technology_support_sub-protocol_home.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="526" LastEditorUserId="526" LastEditDate="2013-05-16T11:01:33.227" LastActivityDate="2013-05-16T11:01:33.227" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="445" PostTypeId="2" ParentId="185" CreationDate="2013-05-16T09:29:32.343" Score="2" Body="&lt;p&gt;also worth ensuring you nail down .1q/tagging negotiation&#xA;&lt;a href=&quot;http://www.curtis-lamasters.com/cisco-switching-switchport-nonegotiate/&quot; rel=&quot;nofollow&quot;&gt;http://www.curtis-lamasters.com/cisco-switching-switchport-nonegotiate/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="533" LastActivityDate="2013-05-16T09:29:32.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="448" PostTypeId="2" ParentId="395" CreationDate="2013-05-16T09:50:05.377" Score="9" Body="&lt;p&gt;In the case you have unmanaged, or the equivalence of unmanaged (lacking login details, or knowledge of the switch operating system, etc), switches and a bridge loop, I describe how I'd go about finding the loop manually.&#xA;This also addresses the fundamental bottom of the original question, &quot;you don't have STP&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic algorithm for fault-locating this loop is similar to STP except you don't readily have access to sending out BPDU's with port ID's in them.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First, connect a packet dumping/sniffing-capable device to a port in &#xA;one of the switches.  This device has now become your tree's root device.&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you have to fault-locate in multiple locations, e.g. over a &quot;campus&quot; or similar, you stand to gain by being able to remotely login with a portable ssh client to the packet dumping machine.&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I'd personally use my Linux laptop with an Internet connection with tcpdump in a screen and ssh into it from for example ipad or phone.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;If you are unable to login yourself remotely, use a friend to visually monitor the tcpdump, which is probably flooding at link speed making it easy to notice a difference whenever the path towards the loop source device is disconnected.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Next, you're going to have to essentially recreate a tree, starting from your root switch.&#xA;&lt;ol&gt;&#xA;&lt;li&gt;And because you can have the scenario where you have multiple looping links feeding into your root device, you must start by removing all connected ports simultaneously at once. &lt;/li&gt;&#xA;&lt;li&gt;Reconnect the ports one by one and if at any time the packet burst re-appears, follow this port to the connected switch in the other end.&lt;/li&gt;&#xA;&lt;li&gt;Repeat step 1, until you find the looped port(s) and can't iterate further down in your manual tree.&lt;/li&gt;&#xA;&lt;li&gt;Having resolved the loop situation in this switch, return to the switch above in the tree and resume step 2.  This recursion continues all the way back until the final cable has been re-connected in your root switch.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is a completely exhaustive manual search for looped ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically there will just be one pair of ports that are looped, meaning the exhaustive and safe search with first removing all connected (link) ports and then reconnecting them one by one is unnecessary. If just one port pair down the 'tree' is looped, you can find it by simply disconnecting one port at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, the general, &quot;foul-proof&quot;, method, or algorithm, becomes what I described above.&lt;/p&gt;&#xA;" OwnerUserId="525" LastActivityDate="2013-05-16T09:50:05.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="449" PostTypeId="1" AcceptedAnswerId="455" CreationDate="2013-05-16T09:55:04.317" Score="8" ViewCount="6552" Body="&lt;p&gt;We're using VPLS and L2VPN on Juniper MX for L2 connections. Signaling is done via BGP and label distribution via LDP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we want one L2VPN to use a specific path trough the network and not follow the IGP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As we currently only use LDP we would have to introduce RSVP alongside LDP. Are there any caveats while doing that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for practical examples how this is done on the Juniper boxes.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2013-05-16T12:25:23.557" LastActivityDate="2013-07-01T14:06:06.410" Title="How to force VPLS/L2VPN to use a specific path" Tags="|juniper|mpls|juniper-mx|ldp|l2vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="453" PostTypeId="1" AcceptedAnswerId="454" CreationDate="2013-05-16T11:11:11.263" Score="7" ViewCount="1965" Body="&lt;p&gt;I have two SRX240's clustered together. The clustering is configured with 2 redundancy groups and then 3 RETH's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;reth1 is connected to our internet connection via ge-0/0/5 and ge-5/0/5. Our internet connection is a 100mbps each way leased line. We have to make sure they we specify disable the auto negotiate settings and manually set the speed and full duplex mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config showing those interfaces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cluster {&#xA;    reth-count 3;&#xA;    redundancy-group 0 {&#xA;        node 0 priority 100;&#xA;        node 1 priority 99;&#xA;    }&#xA;    redundancy-group 1 {&#xA;        node 0 priority 100;&#xA;        node 1 priority 99;&#xA;        preempt;&#xA;        interface-monitor {&#xA;            ge-0/0/5 weight 255;&#xA;            ge-5/0/5 weight 255;&#xA;        }&#xA;     }&#xA;}&#xA;&#xA;interfaces {&#xA;    ge-0/0/5 {&#xA;        speed 100m;&#xA;        link-mode full-duplex;&#xA;        gigether-options {&#xA;            no-auto-negotiation;&#xA;            redundant-parent reth1;&#xA;        }&#xA;    }&#xA;    ge-5/0/5 {&#xA;        speed 100m;&#xA;        gigether-options {&#xA;            no-auto-negotiation;&#xA;            redundant-parent reth1;&#xA;        }&#xA;    }&#xA;    reth1 {&#xA;        redundant-ether-options {&#xA;            redundancy-group 1;&#xA;        }&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 1.1.1.25/30;&#xA;            }&#xA;        }&#xA;    } &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The upstream NTE sits on IP address 1.1.1.26/30 (IP's changed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My connection works fine, I get close to maximum download speeds for the line speed. I have low latency and everything else that you would expect. However every now and then I suddenly can't ping the upstream NTE. The connectivity just stops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I check the interface status it shows as being up.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{primary:node0}&#xA;gareth@FW01&amp;gt; show interfaces ge-0/0/5&#xA;Physical interface: ge-0/0/5, Enabled, Physical link is Up&#xA;  Interface index: 139, SNMP ifIndex: 527&#xA;  Link-level type: Ethernet, MTU: 1514, Link-mode: Full-duplex, Speed: 100mbps,&#xA;  BPDU Error: None, MAC-REWRITE Error: None, Loopback: Disabled,&#xA;  Source filtering: Disabled, Flow control: Enabled, Auto-negotiation: Enabled,&#xA;  Remote fault: Online&#xA;  Device flags   : Present Running&#xA;  Interface flags: SNMP-Traps Internal: 0x0&#xA;  Link flags     : None&#xA;  CoS queues     : 8 supported, 8 maximum usable queues&#xA;  Current address: 00:10:de:ff:20:01, Hardware address: 08:81:f4:cd:a1:05&#xA;  Last flapped   : 2013-05-16 01:35:08 UTC (03:39:01 ago)&#xA;  Input rate     : 7144 bps (10 pps)&#xA;  Output rate    : 34488 bps (58 pps)&#xA;  Active alarms  : None&#xA;  Active defects : None&#xA;  Interface transmit statistics: Disabled&#xA;&#xA;  Logical interface ge-0/0/5.0 (Index 74) (SNMP ifIndex 528)&#xA;    Flags: SNMP-Traps 0x0 Encapsulation: ENET2&#xA;    Input packets : 20966964&#xA;    Output packets: 13453431&#xA;    Security: Zone: Null&#xA;    Protocol aenet, AE bundle: reth1.0   Link Index: 0&#xA;&#xA;{primary:node0}&#xA;gareth@FW01&amp;gt; show interfaces reth1.0&#xA;  Logical interface reth1.0 (Index 68) (SNMP ifIndex 578)&#xA;    Flags: SNMP-Traps 0x0 Encapsulation: ENET2&#xA;    Statistics        Packets        pps         Bytes          bps&#xA;    Bundle:&#xA;        Input :      20967161         12   19068965037         9320&#xA;        Output:      13454302         44    3387733487        29088&#xA;    Security: Zone: untrust-internet&#xA;    Allowed host-inbound traffic : ping&#xA;    Protocol inet, MTU: 1500&#xA;      Flags: Sendbcast-pkt-to-re&#xA;      Addresses, Flags: Is-Preferred Is-Primary&#xA;        Destination: 1.1.1.24/30, Local: 1.1.1.25,&#xA;        Broadcast: 1.1.1.27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason for the last flap was because I changed the network cable to rule that out. Unplugging the cable and connecting a new one causes the connection to come back. I am a little reluctant to trust it at the moment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any other things I can look at if it happens again?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did find the following post &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB16672&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB16672&lt;/a&gt; which says it should work on supported versions.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The releases, specifically for High End SRX devices, are 11.2R1, 11.1R1, 10.3R3, 10.4R2, 10.2R4 or later. For Branch SRX devices, this is supported only from Junos 11.1R4, 11.2R2, and 11.4R1 onwards.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I am running version 11.2R4.3&lt;/p&gt;&#xA;" OwnerUserId="139" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:05.177" LastActivityDate="2013-05-27T18:45:05.177" Title="Juniper SRX240H loses connectivity to upstream router" Tags="|juniper-srx|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="454" PostTypeId="2" ParentId="453" CreationDate="2013-05-16T11:29:58.937" Score="4" Body="&lt;p&gt;Here's some version info that should help.  I think that the other thing that immediately strikes me is autonegotiation being disabled, which shouldn't be necessary.  Is this something that your provider is asking for, or based on learned behaviors?  I recommend reading what's out there, since autonegotiation has been recommended for over 10 years.  Anything you're connecting to should work fine with it as well (the last time I had issues was on a 3500XL - we're talking ooooold). Check out:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://etherealmind.com/ethernet-autonegotiation-works-why-how-standard-should-be-set/&quot; rel=&quot;nofollow&quot;&gt;http://etherealmind.com/ethernet-autonegotiation-works-why-how-standard-should-be-set/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off, Junos 11.4R7.5 is the supported release recommended for SRX240, as of 8 April 2013, per JTAC (since you mentioned versions).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB21476&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB21476&lt;/a&gt; (need login)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, JTAC recommends EEOL releases on SRX or J Series for IPsec features (may or may not apply, but FYI).  (For me, the only releases available for SRX240H on juniper.net are 10.4, 11.4, and 12.1 - that may help set your expectations on what to run.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2013-01-822&amp;amp;actionBtn=Search&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/alerts/viewalert.jsp?txtAlertNumber=PSN-2013-01-822&amp;amp;actionBtn=Search&lt;/a&gt; (need login)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are also running a version that was released before the malformed TCP vulnerability came out.  I shudder to think that a live exploit exists, but you definitely need to be on versions that were published around January or February 2013, or later.  The versions you need for 11.2 are 11.2R5.5 or 11.2R7.5 (or higher)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://osvdb.org/89751&quot; rel=&quot;nofollow&quot;&gt;http://osvdb.org/89751&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mentioned versions because the SRX is a 'rapidly evolving' platform as well, and anecdotal evidence and hearsay suggests that you'll want to upgrade more frequently.&lt;/p&gt;&#xA;" OwnerUserId="526" LastEditorUserId="526" LastEditDate="2013-05-16T11:50:57.343" LastActivityDate="2013-05-16T11:50:57.343" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="455" PostTypeId="2" ParentId="449" CreationDate="2013-05-16T12:07:46.767" Score="8" Body="&lt;p&gt;Short answer, just use Resource ReSerVation Protocol (RSVP).&lt;/p&gt;&#xA;&lt;p&gt;Long answer, you could use multi-topology-routing and have multiple metrics in each interface and force some packets to different topology than another packets. But I would not really venture there.&lt;/p&gt;&#xA;&lt;p&gt;You might want to talk to your account team that you want segment routing implemented: &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-previdi-filsfils-isis-segment-routing-02&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://datatracker.ietf.org/doc/html/draft-previdi-filsfils-isis-segment-routing-02&lt;/a&gt; (customer pressure will help resource development)&lt;/p&gt;&#xA;&lt;p&gt;Segment routing would make it trivial to solve your problem while removing both LDP and RSVP from your network, relying only on IGP.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;As my suggestion in comments did not actually work, I'll explain why not, and how to fix.&lt;br /&gt;&#xA;Problem is we need to have LSP installed in HW to be able to use it. And by my suggestion the RSVP LSP is not actually installed until LDP LSP goes away. So we cannot conditionally inject traffic there.&lt;/p&gt;&#xA;&lt;p&gt;I couldn't find any way to force RSVP+LDP in ECMP, with equal preference LDP wins. But we still can achieve what is desired at least in two separate ways.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Dual next-hops&lt;/strong&gt;&lt;br /&gt;&#xA;Add second next-hop in the l2circuit PEs. This next-hop will not be used by iBGP, so it draws no traffic at all.&lt;br /&gt;&#xA;Now configure RSVP tunnel for this second loopback and use it as neighbor address for l2circuit.&lt;br /&gt;&#xA;Net effect is, all traffic is using LDP except this l2circuit which is using RSVP&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;RSVP only&lt;/strong&gt;&lt;br /&gt;&#xA;Create two RSVP tunnels, one using IGP path (i.e. will use same as LDP) another using your explicit path. These can be set to ECMP, i.e. all traffic will use both tunnels.&lt;br /&gt;&#xA;Now as we've accomplished ECMP requirement, we can use 'routing-options forwarding-table' export policy to put some traffic on LSP_NORMAL and some traffic on LSP_EVPN. Essentially our export policy would be:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;term EVPN {&#xA;    from community EVPN;&#xA;    then {&#xA;        install-nexthop lsp LSP_EVPN;&#xA;        accept;&#xA;    }&#xA;}&#xA;term NORMAL {&#xA;    from next-hop 1.2.3.4;&#xA;    then {&#xA;        install-nexthop lsp LSP_NORMAL;&#xA;        accept;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now none of the traffic would actually use the ECMP as all of the traffic would be forced to one or the other RSVP LSP.&lt;br /&gt;&#xA;I would prefer the 1st option.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-07-01T14:06:06.410" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="456" PostTypeId="1" AcceptedAnswerId="458" CreationDate="2013-05-16T12:35:18.120" Score="14" ViewCount="3285" Body="&lt;p&gt;Is there such a thing as a network bridge or is it always meant as a switch implementing a bridging function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whilst bridges are described as devices that create separate collision domains in network specifications and tutorials, I have never been able to find any concrete product denominated 'bridge'.&lt;/p&gt;&#xA;" OwnerUserId="562" LastEditorUserId="49" LastEditDate="2013-05-17T19:26:41.137" LastActivityDate="2013-05-17T19:26:41.137" Title="Is there such thing as a network bridge?" Tags="|switch|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="458" PostTypeId="2" ParentId="456" CreationDate="2013-05-16T12:41:59.570" Score="31" Body="&lt;p&gt;Bridges as a product no longer exist due to how the market evolved.  Typically the products specifically called bridges were used in hubbed environments to separate the collision domain or to bridge two network media types together (for example, Ethernet and token ring).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bridges as a function are definitely still around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply speaking, as a function of separating the collision domain, a switch is a bridge with lots of ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For an example of bridging two network media types, access points are bridges that bridge 802.11 traffic to Ethernet.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="606" LastEditDate="2013-05-16T19:45:54.790" LastActivityDate="2013-05-16T19:45:54.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="459" PostTypeId="2" ParentId="456" CreationDate="2013-05-16T12:48:52.687" Score="19" Body="&lt;p&gt;Yes, a network bridge was originally what we would think of today as a 2-port ethernet switch.  They were used to provide separate collision domains without otherwise changing the routing on the network.  I always thought the use case was a bit limited, but ethernet switching was the newfangled fanciness as I was coming of age in networking, so the network bridge was already looking a bit long in the tooth as a concept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The term &quot;switch&quot; is really the term that is nebulous.  Early ethernet switches were frequently referred to as multi-port bridges to help define what it was that they were.  Later, when the development of routing traffic in hardware some marketing geniuses (tongue-firmly-in-cheek using &quot;genius&quot; there) decided to create the term Layer 3 switching to differentiate hardware based routing from the traditional software based routing processes.  This served to further muddle the definition of the term switch, and now we have marketing geniuses (Ibid) referring to &quot;Layer 7 switches&quot; and other such inanities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As YLearn's answer alludes to, bridges could also bridge between dissimilar media types with greater or lesser amounts of lossage depending on how compatible the media types were...ethernet &amp;lt;-&gt; FDDI was easy, ethernet &amp;lt;-&gt; Token Ring was a bit more challenging to get right.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-05-16T12:48:52.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="460" PostTypeId="2" ParentId="439" CreationDate="2013-05-16T13:00:43.803" Score="5" Body="&lt;p&gt;The mib 1.3.6.1.4.1.9.9.91 works on ASR1001s at least.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running the following from my monitoring box:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpwalk -v2c -c &amp;lt;community-string&amp;gt; &amp;lt;asr1001-name&amp;gt; 1.3.6.1.4.1.9.9.91&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Gives an output of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CISCO-ENTITY-SENSOR-MIB::entSensorType.4 = INTEGER: amperes(5)&#xA;CISCO-ENTITY-SENSOR-MIB::entSensorType.5 = INTEGER: voltsAC(3)&#xA;CISCO-ENTITY-SENSOR-MIB::entSensorType.6 = INTEGER: voltsAC(3)&#xA;CISCO-ENTITY-SENSOR-MIB::entSensorType.7 = INTEGER: celsius(8)&#xA;CISCO-ENTITY-SENSOR-MIB::entSensorType.8 = INTEGER: celsius(8)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And so on.  You'll just have to index it and find the particular sensor you wish to monitor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(As a note, to get readable output, I had to install the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.91&quot; rel=&quot;noreferrer&quot;&gt;CISCO-ENTITY-SENSOR-MIB&lt;/a&gt; on my server that was originating the snmpwalk.)&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-05-16T13:00:43.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="461" PostTypeId="2" ParentId="283" CreationDate="2013-05-16T13:18:10.807" Score="4" Body="&lt;p&gt;The main part about this is the switch IDs for the devices. If you have two switch stacks which BOTH have units 1 and 2 your interfaces are named 1/g1, 1/g2, 2/g1 etc. When they are combined into one stack the configuration of at least two will change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Do backups of the configuration&lt;/li&gt;&#xA;&lt;li&gt;Get a service window :-)&lt;/li&gt;&#xA;&lt;li&gt;Shutdown two units, and join them to the stack&lt;/li&gt;&#xA;&lt;li&gt;Paste the configuration for the &quot;new units&quot; 3/g1-24, and 4/g1-24 etc.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;TL;DR interface numbers follow switch id and switches cannot automatically merge two stack configs&lt;/p&gt;&#xA;" OwnerUserId="569" LastEditorUserId="49" LastEditDate="2013-05-16T15:54:25.747" LastActivityDate="2013-05-16T15:54:25.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="462" PostTypeId="1" AcceptedAnswerId="463" CreationDate="2013-05-16T13:33:39.893" Score="9" ViewCount="5266" Body="&lt;p&gt;I would like to have syntax highlighting while perusing my configs - does anybody know of a good Cisco IOS syntax highlighting bundle for TextMate or Sublime Text?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edited (2015-09-21) to add:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GitHub Atom Editor has a Cisco IOS syntax highlighter in their built in &quot;packages&quot; repo and it is easy to install. I think that Sublime Text is a better editor, but if you are not already invested in ST, I recommend giving Atom a look.&lt;/p&gt;&#xA;" OwnerUserId="399" LastEditorUserId="399" LastEditDate="2015-09-21T09:22:50.643" LastActivityDate="2017-06-07T14:54:52.057" Title="Cisco-configuration syntax highlighting for TextMate/Sublime Text" Tags="|cisco|cisco-ios-15|cisco-ios-12|" AnswerCount="4" CommentCount="1" ClosedDate="2017-06-07T14:56:12.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="463" PostTypeId="2" ParentId="462" CreationDate="2013-05-16T13:33:39.893" Score="1" Body="&lt;p&gt;Though a &lt;a href=&quot;http://polydistortion.net/monkey/archives/2006/06/24/003722.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;.tmBundle&lt;/code&gt;&lt;/a&gt; exists for syntax highlighting in Cisco IOS, it is very limited in scope. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you made or do you know of a better bundle?&lt;/p&gt;&#xA;" OwnerUserId="399" LastActivityDate="2013-05-16T13:33:39.893" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="464" PostTypeId="2" ParentId="462" CreationDate="2013-05-16T13:42:11.943" Score="7" Body="&lt;p&gt;I haven't tried it yet but there is a &lt;a href=&quot;https://github.com/illotum/IOS-Syntax&quot;&gt;GitHub repo&lt;/a&gt; someone made for Cisco IOS Syntax Highlighting for Sublime Text 2.  &lt;/p&gt;&#xA;" OwnerUserId="9" LastActivityDate="2013-05-16T13:42:11.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="465" PostTypeId="1" AcceptedAnswerId="479" CreationDate="2013-05-16T13:53:04.427" Score="7" ViewCount="1791" Body="&lt;p&gt;I've been placed in charge of replacing an older Avaya TDM PBX with a new VoIP system that will integrate with Exchange (at least in the capability to transcribe voicemail messages and deliver them to the email inbox).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently acquired the CCNA Voice cert, and while I have a decent idea of what I need, perhaps the most confusing part is the licensing. I really thought Cisco should have done a better job of explaining it for the CCNA Voice curriculum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, the network design will involve a SIP trunk from the ISP. I was looking at a Cisco Business Edition 3000 system, but I found out it requires a CUBE. So, that being the case, I am looking to buy either a 3825 router, or something from the 2900-series instead of the BE3000 system. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I know CUCME is part of the IOS image, but does it have to be licensed to be unlocked?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I know I'll need either an AIM-CUE or NM-CUE for voicemail, how does licensing for that work?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If I buy Cisco IP phones from eBay, I assume they're unlicensed. How do I acquire a license, or will they simply work with CUCME (provided CUCME supports the phone model to begin with)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is the CUBE functionality built into IOS, similar to how CUCME is, or is it an addon, and how does licensing for that work?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What hardware would you recommend for a small company of 30 employees with a 10-number SIP trunk? Or does a 3825/2900-series sound ok?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How does a small company with no Cisco contracts go about purchasing the necessary licenses?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have been researching this for about three weeks, but I keep running into incomplete and sometimes conflicting information. This will be the first voice system I've set up.&lt;/p&gt;&#xA;" OwnerUserId="572" LastEditorUserId="775" LastEditDate="2013-06-02T14:28:25.757" LastActivityDate="2016-01-07T00:07:11.740" Title="What are the components and licensing of a full Cisco CUCME PBX?" Tags="|cisco|voice|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="466" PostTypeId="1" CreationDate="2013-05-16T14:03:19.493" Score="9" ViewCount="4618" Body="&lt;p&gt;I use Cisco access points AIR-CAP1552E to connect buildings via WiFi, 802.11a/n (5 GHz). Normally, they are mounted upright, with three three omni directional antennas at the bottom. Now I consider a single AP on the roof of a very small building, connecting to a much higher one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be beneficial to turn the AP up some degrees, such as in the photo I made, or would it degrade the WiFi quality if the angle of the antennas doesn't match the other AP which is upright?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5wfMH.jpg&quot; alt=&quot;WiFi access point on roof&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="49" LastEditDate="2013-05-16T14:24:14.723" LastActivityDate="2017-05-18T02:01:04.617" Title="Does varying the angle of omni directional antennas affect connection quality between WiFi APs?" Tags="|cisco|ieee-802.11|aironet|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="467" PostTypeId="2" ParentId="465" CreationDate="2013-05-16T14:05:54.347" Score="-2" Body="&lt;p&gt;If you are not tied to CallManager, Asterisk is an open-source solution to provide SIP telephony, and can automatically email voicemails to users.&lt;/p&gt;&#xA;" OwnerUserId="141" LastActivityDate="2013-05-16T14:05:54.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="468" PostTypeId="2" ParentId="466" CreationDate="2013-05-16T14:15:35.913" Score="3" Body="&lt;p&gt;This will theoretically help.  Your question seems to break down to:  &quot;Does it make sense to aim omnidirectional antennas?&quot;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since 'omnidirectional' dipoles are actually directional with a toroidal radiation pattern, the radiation from your angled antennas will be strongest along the plane perpendicular to the antenna.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that the other antenna is perpendicular to the ground would not cause any issues, but if you wanted to optimize for this particular building to building link you could angle that one 'down'.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether or not this will help in any meaningful way in your particular situation is less clear:  The only way to know would be to try it both ways and see if there is any difference in RSSI.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My hunch is that unless you're talking about extremely long distances or sharp angles, it won't matter much.  If you are then you should probably be looking at more directional antennas.&lt;/p&gt;&#xA;" OwnerUserId="241" LastEditorUserId="241" LastEditDate="2013-05-16T15:07:15.330" LastActivityDate="2013-05-16T15:07:15.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="469" PostTypeId="2" ParentId="466" CreationDate="2013-05-16T14:21:32.400" Score="8" Body="&lt;p&gt;It definitely matters:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;'Omni' refers to the symmetry in the plane perpendicular to the axis of the antenna; That is, the torus around the antenna axis. But 'omni' antennas are VERY sensitive to variation from the vertical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're aiming down into an open area (to the left, as suggested by the photo,) then ok, tip them as is shown. But generally, you should have the antenna at about the same height at the other trans/receivers you're trying to cover.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that photo is your actual installation: Be aware that a metal roof -- especially if it's grounded, which it almost surely is -- will be an RF reflector. So you will have an RF shadow from the roof below the visual line of sight. (If you can't see the antenna, the RF signal won't go through the roof either.)&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-16T14:21:32.400" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="470" PostTypeId="2" ParentId="466" CreationDate="2013-05-16T14:25:52.037" Score="5" Body="&lt;p&gt;Yes, it would be beneficial if you are angling the AP correctly (second AP would be up and to the right), even with the antennas on the other AP being vertical.  If you angle this the wrong way (second AP is up and to the left), then you will be making things worse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This type of antenna produces a signal pattern in a toroid or doughnut shape (with the antenna forming an &quot;axel&quot; through this pattern).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Angling the one would increase the energy that arrives at the higher AP and will allow for slightly better reception by the lower AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this may only be true if all you are concerned about was the signal between the two APs.  If you are providing service to other devices from the lower AP, this could negatively impact the service to those other devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is only signal between the two APs, then I would question why you are using omnidirectional antennas over directional?  Even if the higher AP is serving multiple lower APs, if the lower AP only connects to the higher one, it would be better served using directional antennas.  If all the APs are lower than the higher one, then I would look for antennas with &quot;down tilt&quot; for the higher AP if possible or else something like a patch/panel pointed downward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With any wireless, you should make sure to understand the signal patterns of the antennas you choose.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-16T14:45:03.720" LastActivityDate="2013-05-16T14:45:03.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="471" PostTypeId="5" CreationDate="2013-05-16T14:26:47.320" Score="0" Body="&lt;p&gt;The Spanning Tree Protocol (STP) is a network protocol that builds a logical loop-free topology for bridged OSI layer-2 networks. The basic function of STP is to prevent bridge loops, broadcast radiation and SAT instabilities that result from them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spanning tree also allows a network design to include spare (redundant) links to provide automatic backup paths if an active link fails. This is done without the danger of bridge loops, or the need for manual enabling or disabling of these backup links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Originally defined by (now obsolete) IEEE 802.1D-1990, the functionality was significally improved by the Rapid Spanning Tree Protocol (RSTP) in IEEE 802.1w-2001 and the VLAN-aware and instance-capable Multiple Spanning Tree Protocol (MSTP) in IEEE 802.1s-2002, now all part of IEEE 802.1Q.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="36720" LastEditDate="2020-04-11T13:44:35.923" LastActivityDate="2020-04-11T13:44:35.923" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="472" PostTypeId="4" CreationDate="2013-05-16T14:26:47.320" Score="0" Body="For questions about Spanning Tree Protocol (STP), a common protocol to prevent bridge loops at OSI layer-2. " OwnerUserId="220" LastEditorUserId="36720" LastEditDate="2020-04-11T13:44:35.923" LastActivityDate="2020-04-11T13:44:35.923" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="473" PostTypeId="5" CreationDate="2013-05-16T14:28:57.127" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-16T14:28:57.127" LastActivityDate="2013-05-16T14:28:57.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="474" PostTypeId="4" CreationDate="2013-05-16T14:28:57.127" Score="0" Body="IOS, or Internetwork Operating System, is the operating system employed by most Cisco devices. It is also used to refer to the command line shell that is used to configure Cisco devices." OwnerUserId="220" LastEditorUserId="220" LastEditDate="2013-05-16T15:55:54.143" LastActivityDate="2013-05-16T15:55:54.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="475" PostTypeId="1" AcceptedAnswerId="476" CreationDate="2013-05-16T14:33:03.737" Score="6" ViewCount="10847" Body="&lt;p&gt;When implementing Cisco Nexus 5k switches (5596UP), I connected a server to a dual homed 2000 FEX (2232T), the port belonging to a virtual port channel. However, the port changed the status from &lt;em&gt;notconnected&lt;/em&gt; to &lt;em&gt;inactive&lt;/em&gt; and remained so.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I verified that speed and duplex match, i.e. auto/auto, tested also 1000/full.&lt;/li&gt;&#xA;&lt;li&gt;I verified that the corresponding VLAN exists and is the access VLAN on this port.&lt;/li&gt;&#xA;&lt;li&gt;Default port settings, except this access VLAN.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What may be wrong, and how can I correct it?&lt;/p&gt;&#xA;" OwnerUserId="231" LastActivityDate="2013-05-16T19:43:27.290" Title="A FEX port remains inactive - how can I bring it up?" Tags="|cisco|cisco-nexus-2000|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="476" PostTypeId="2" ParentId="475" CreationDate="2013-05-16T14:33:03.737" Score="7" Body="&lt;p&gt;It turned out, that the configuration of this port did not match on both Nexus 5k, as I configured just one switch at first.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I configured the port on the second Nexus switch in the same way.&lt;/li&gt;&#xA;&lt;li&gt;I plan to implement the config sync feature so that issue should not happen again.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once the configuration of the ports of the virtual port channel matched, the link came up.&lt;/p&gt;&#xA;" OwnerUserId="231" LastActivityDate="2013-05-16T14:33:03.737" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="477" PostTypeId="2" ParentId="465" CreationDate="2013-05-16T14:42:22.263" Score="2" Body="&lt;p&gt;A question of this type sounds like something your local Cisco VAR or Partner could answer for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find your local Cisco partners &lt;a href=&quot;http://tools.cisco.com/WWChannels/LOCATR/openBasicSearch.do&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.  You can specifically search for a Partner with Voice experience/folks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found that Cisco's voice licensing is obtuse bordering on arcane sometimes, and it is best to ask the folks who are paid to understand it and deal in it every day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that said, if you contact a Cisco Partner, you will also have to sort marketing info from what would really solve your problems.  But then again, that's what WE as the engineers are paid for right?&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-05-16T14:42:22.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="479" PostTypeId="2" ParentId="465" CreationDate="2013-05-16T15:10:01.640" Score="11" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;On a 2900/3900 platform, the UC license is required to use the CUCME/SRST functionality.  It is in addition to the base OS.  Once unlocked the commands will be available (no upgrade needed).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As of Unity express 7.0.2, the CUE modules are licensed separately for a given number of mailboxes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Spare phones (with an = in the part number) are technically unlicensed.  You can use them with the system, as the CUCME router platform is licensed to a specific number of phones per hardware platform.  While you don't need the licenses to operate the phones, you should probably purchase them to stay on Cisco's good side.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;CUBE should be unlocked with the UC licenses on the 2900/3900 platform.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For 30 phones, you probably want a 2911 or 2921.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Brett is right in that you probably need to contact a Cisco VAR/Partner to sort out the licensing issues.  They have people on staff that can take care of that for you and probably get you discount off list pricing.&lt;/p&gt;&#xA;" OwnerUserId="71" LastActivityDate="2013-05-16T15:10:01.640" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="480" PostTypeId="1" AcceptedAnswerId="1463" CreationDate="2013-05-16T15:14:21.313" Score="15" ViewCount="32392" Body="&lt;p&gt;I want to factory reset IOS-XR. The router used is ASR9000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm used to do that easily in IOS doing &lt;code&gt;config-register 0x2102&lt;/code&gt;, &lt;code&gt;write erase&lt;/code&gt; followed by a reload.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I search on &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r3.4/system_management/command/reference/yr34book.pdf&quot; rel=&quot;noreferrer&quot;&gt;documentation&lt;/a&gt;, but found no explicit information. What is the correct method for doing a factory reset on the ASR9k running IOS-XR?&lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="3191" LastEditDate="2015-07-19T16:46:10.300" LastActivityDate="2024-03-25T10:54:24.313" Title="How to factory reset IOS-XR?" Tags="|cisco|cisco-ios-xr|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="483" PostTypeId="1" AcceptedAnswerId="487" CreationDate="2013-05-16T15:32:04.177" Score="9" ViewCount="5304" Body="&lt;p&gt;I am redistributing a static route into EIGRP on a 6500. I had read &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_white_paper09186a0080094cb7.shtml#statictointerface&quot;&gt;here&lt;/a&gt; if you enter a network statement matching a static route that it would be redistributed as an internal route by EIGRP. However, after entering the configuration, neighbors indicate the route as external.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the redistribute static preempt and cause the route to be marked as external?    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router eigrp 10 &#xA;network 10.0.0.0&#xA;network 10.1.13.0 0.0.1.255&#xA;redistribute static&#xA;&#xA;ip route 10.1.13.0 255.255.254.0 10.1.29.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="446" LastEditorUserId="49" LastEditDate="2013-05-16T15:55:30.283" LastActivityDate="2015-04-26T21:59:40.030" Title="Static redistribution into EIGRP as internal failure" Tags="|cisco|eigrp|redistribution|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="484" PostTypeId="2" ParentId="456" CreationDate="2013-05-16T15:32:51.937" Score="4" Body="&lt;p&gt;Today you can make a network bridge in software. Get a Linux box and compile the ethernet bridging support into the kernel. Then you get network devices like &lt;code&gt;br0&lt;/code&gt; which can be connected to interfaces like &lt;code&gt;eth0&lt;/code&gt; and &lt;code&gt;eth1&lt;/code&gt; and will propagate raw, low level packets from one to the other. There is even filter support similar to iptables, as well as a user space tool called &lt;code&gt;ebtables&lt;/code&gt; (Ethernet bridging tables) using which you can define rules to filter packets by MACs and other fields or bytes, so your bridge does not have to forward everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet was not switched once upon a time. The original Ethernet consisted of a long cable shared among the stations. Each station tapped into the cable.  This is why we still talk abut a &quot;network segment&quot;. Today a &quot;network segment&quot; is a logical segment only, but actually looks like a star (or bunch of stars) centered around switches, but once upon a time, it really was like a straight line with stations hanging off it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to connect two such networks, there were two choices: a repeater, or a bridge. A repeater is an analog amplifier device which listens on one wire, buffers the signal electronically and drives the same signal on the other wire (and in the case of networking, vice versa: bidirectionally).   A bridge is a computer or embedded system which receives the actual packets, and then sends them to the other side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike a repeater, a bridge can be smart in that as it passes traffic, it builds a table of known addresses in memory. It knows which station is on which side of the bridge, so it can avoid bridging whenever a station on one side of the bridge addresses a station that lives on the same side. Only broadcast packets have to be bridged, and packets which address across the bridge.&lt;/p&gt;&#xA;" OwnerUserId="591" LastActivityDate="2013-05-16T15:32:51.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="485" PostTypeId="2" ParentId="480" CreationDate="2013-05-16T15:34:08.687" Score="9" Body="&lt;p&gt;You must commit replace with an empty config file. This will wipe the config out completely. Also keep in mind the admin context. You'll need to go into the admin context and commit replace that config as well if you want to reset the settings inside the admin context.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-16T15:34:08.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="486" PostTypeId="2" ParentId="480" CreationDate="2013-05-16T15:47:44.887" Score="13" Body="&lt;p&gt;commit replace does the trick of nuking the config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the commit history still shows the previous commits in a list, but you cant see the contents of them. &lt;/p&gt;&#xA;" OwnerUserId="596" LastActivityDate="2013-05-16T15:47:44.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="487" PostTypeId="2" ParentId="483" CreationDate="2013-05-16T16:12:10.333" Score="12" Body="&lt;p&gt;You can inject static routes into EIGRP two ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The 'network' command&lt;/li&gt;&#xA;&lt;li&gt;'redistribute static'&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You only need one or the other; here you've used both. It seems that the redistribution command takes precedence over the network command so the route is appearing as static routes. Remove 'redistribute static' and the route should appear as internal.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-16T16:12:10.333" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="488" PostTypeId="2" ParentId="157" CreationDate="2013-05-16T17:22:50.020" Score="2" Body="&lt;p&gt;FluxLight also has a fairly wide selection of SFP, SFP+ and QSFP optical transceivers. We have used them for about 5 years now and have only encountered one bad module. We contacted FluxLight and they cross-shipped a new module for free. I highly recommend them. Their modules also identify properly in various vendor chassis, so HP and Cisco equipment should see the module without it complaining or shutting down the interface.&lt;/p&gt;&#xA;" OwnerUserId="434" LastActivityDate="2013-05-16T17:22:50.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="489" PostTypeId="1" AcceptedAnswerId="491" CreationDate="2013-05-16T18:06:34.183" Score="10" ViewCount="11897" Body="&lt;p&gt;I was wondering if anyone has some favorite modules for doing things like SNMP, CLI screen scraping, netconf, etc...&lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2020-05-30T15:20:23.973" Title="Which Python modules are you using for network management and automation?" Tags="|management|" AnswerCount="6" CommentCount="4" ClosedDate="2013-05-17T13:43:03.087" ContentLicense="CC BY-SA 3.0" />
  <row Id="490" PostTypeId="2" ParentId="489" CreationDate="2013-05-16T18:06:34.183" Score="6" Body="&lt;p&gt;We've been using:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pysnmp - pretty obvious&lt;br&gt;&#xA;Exscript - offers an enhanced &quot;expect&quot; type of experience.  Very nice.&lt;br&gt;&#xA;MySQLdb - also self explanatory&lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2013-05-16T18:06:34.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="491" PostTypeId="2" ParentId="489" CreationDate="2013-05-16T18:15:11.857" Score="10" Body="&lt;p&gt;I just started playing with &lt;a href=&quot;https://readthedocs.org/projects/trigger/&quot;&gt;Trigger&lt;/a&gt; and I have to say I've really enjoyed it.  It's quite a powerful network engineer toolkit and their documentation is awesome.  While we primarily have Cisco it does support other vendors such as Juniper and Brocade, they have a list of vendors in their &lt;a href=&quot;https://trigger.readthedocs.org/en/latest/&quot;&gt;docs&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="9" LastEditorUserId="9" LastEditDate="2013-05-16T18:24:08.220" LastActivityDate="2013-05-16T18:24:08.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="492" PostTypeId="2" ParentId="99" CreationDate="2013-05-16T18:33:25.233" Score="10" Body="&lt;p&gt;Lots of people have answered already; and I agree: Fiber beats copper as soon as distance becomes a factor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But beware of multimode fiber; it also has serious distance issues. You can only go 550 metres on GE (1000BASE-SX), and some of the 10GE modes manage 330 metres on really good multimode fiber (OM3 or OM4). In a larger colo or CO or in a campus setting, this is severely limiting. IMNSHO multimode is a &quot;rack row&quot; technique only for 10G. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Combining this with the many available grades of multimode and you've got a recipe for confusion and investment one-way alleys. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Singlemode, OTOH, is simpler, and the price delta down to multimode keeps getting smaller. I am not recommending anything except singlemode for new structural installs, limiting multimode new installs to backwards compatibility (ie. new computer room needs to interconnect with old FC infrastructure on 50µm or to closet switches on 1000BASE-SX). &lt;/p&gt;&#xA;" OwnerUserId="603" LastActivityDate="2013-05-16T18:33:25.233" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="493" PostTypeId="1" AcceptedAnswerId="497" CreationDate="2013-05-16T19:17:44.253" Score="57" ViewCount="196551" Body="&lt;p&gt;When cabling a network using fibre, what is the difference between single-mode and multi-mode fibre? When should I be using one or the other? Are there compatibility and/or speed concerns with either?&lt;/p&gt;&#xA;" OwnerUserId="607" LastEditorUserId="775" LastEditDate="2015-04-29T04:02:59.397" LastActivityDate="2017-11-02T20:49:20.827" Title="Multi-Mode and Single-Mode Fiber Differences" Tags="|fiber|cabling|" AnswerCount="14" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="495" PostTypeId="2" ParentId="493" CreationDate="2013-05-16T19:53:30.387" Score="8" Body="&lt;p&gt;Singlemode fiber has a smaller core (9 micron), resulting in less light diffraction over distance than multimode fiber (50, 62.5) micron. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fragility and increased cost to produce singlemode fiber makes it more expensive to use, which is why multimode is typically used when you don't need the distance of singlemode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multimode generally has a reach upto ~550 meters, where as singlemode has the potential to reach 10,000 meters (40,000 meters with ER)&lt;/p&gt;&#xA;" OwnerUserId="87" LastActivityDate="2013-05-16T19:53:30.387" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="496" PostTypeId="2" ParentId="493" CreationDate="2013-05-16T19:55:47.563" Score="32" Body="&lt;p&gt;Multi-mode fiber (MMF) uses a much bigger core and usually uses a longer wavelength of light.  Because of this, the optics used in MMF have a higher capability to gather light from the laser.  In practical terms, this means the optics are cheaper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Single-mode fiber (SMF) has much tighter tolerances for optics used.  The core is smaller and the laser wavelength is narrower.  This means that SMF has the capability for higher bandwidth and much longer distances in transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With 10GB just around the corner for many of my customers, I've started recommending they use SMF everywhere for connections.  When installed as part of a project, the extra cost of SMF is negligible compared to MMF.  That also means you won't need to rip out your MMF fiber plant to upgrade speeds in a few years.&lt;/p&gt;&#xA;" OwnerUserId="71" LastEditorUserId="253" LastEditDate="2013-05-20T13:43:11.510" LastActivityDate="2013-05-20T13:43:11.510" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="497" PostTypeId="2" ParentId="493" CreationDate="2013-05-16T20:05:48.273" Score="45" Body="&lt;p&gt;Main difference:&#xA;Singlemode fiber has a lower power loss characteristic than multimode fiber, which means light can travel longer distances through it than it can through multimode fiber. Not surprising, the optics required to drive singlemode fiber are way more expensive, especially considering any varying circumstances. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When to use each:&#xA;Both singlemode and modern multimode fiber can handle 10G speeds.  The most important thing to consider is the distance requirement.  Within a data center, it's typical to use multimode which can get you 300-400 meters.  If you have very long runs or are connecting over longer distance, single mode can get you 10km, 40km, 80km, and even farther - you just need to use the appropriate optic for the distance required, and again, the prices go up accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compatibility issues:&#xA;They are not compatible.  You cannot mix multimode and singlemode fiber between two endpoints.  The optics are not compatible either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a lot more to say about fiber, in general, but I hope this answers your immediate question.&lt;/p&gt;&#xA;" OwnerUserId="407" LastEditorUserId="619" LastEditDate="2015-01-05T22:45:08.853" LastActivityDate="2015-01-05T22:45:08.853" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="498" PostTypeId="2" ParentId="99" CreationDate="2013-05-16T20:15:46.697" Score="3" Body="&lt;p&gt;I have the feeling copper is a bit more robust then fiber. In a datacenter this is not an issue because the cables stay where they are once the links are up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in harsher conditions (temporary setups in open air, equipment hauled around the country and networks rebuilt often, ...) sturdiness is a factor. I haven't kept score, but I think fibers fail me a bit more often than copper, cables getting damaged or connectors getting dirty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;YMMV of course, and as Lucas may remember, those little clip thingies on RJ45 connectors aren't the most student-proof invention either...&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2013-05-16T20:26:15.823" LastActivityDate="2013-05-16T20:26:15.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="499" PostTypeId="2" ParentId="412" CreationDate="2013-05-16T20:46:59.043" Score="10" Body="&lt;p&gt;Not all taps are &quot;passive&quot;.  Look a few tabs down for &lt;a href=&quot;http://www.netoptics.com/products/aggregation&quot;&gt;&quot;aggregation&quot; taps&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, the most common quoted reason is to allow linerate monitoring, but the truth is far simpler... it takes pratically no logic to &lt;em&gt;individually&lt;/em&gt; mirror the electrical signaling in each direction. (at least for 10/100, gig uses all four pairs) [I have various 10/100 passive taps.  Most of them have maybe $5 worth of logic in them. The good aggregation taps are tiny highspeed computers.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-16T20:46:59.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="500" PostTypeId="2" ParentId="489" CreationDate="2013-05-16T20:48:58.367" Score="4" Body="&lt;p&gt;Don't forget about:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://pypi.python.org/pypi/ciscoconfparse/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ciscoconfparse&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://code.google.com/p/cisco-ios-cli-automation/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco CLI Automation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;argparse (best module for parsing arguments)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29" LastEditorUserId="775" LastEditDate="2020-05-30T15:20:23.973" LastActivityDate="2020-05-30T15:20:23.973" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="501" PostTypeId="2" ParentId="385" CreationDate="2013-05-16T21:02:32.053" Score="4" Body="&lt;p&gt;&lt;em&gt;On paper&lt;/em&gt;, yes.  In reality, don't bet on it.  As Mr. Stretch brings up... are you willing to bet your job on it not interrupting the CEO's video conference?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(In my experience, Cisco OIR is always an incalculable gamble.  Sometimes it works perfectly.  Others is creates noise on the bus that crashes the entire router. Or my fav... corrupts &lt;em&gt;one&lt;/em&gt; of the buses and half the linecards disappear/reboot.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-16T21:02:32.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="502" PostTypeId="2" ParentId="99" CreationDate="2013-05-16T21:27:58.453" Score="9" Body="&lt;p&gt;Fiber over Copper...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;High electrical noise environment.&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The first place I used fiber was on the production floor of a textile mill. twisted pair was a nightmare there.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Long spans -- in excess of 100m.&lt;/li&gt;&#xA;&lt;li&gt;Anywhere future in-place upgrades are desirable&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I know of a few places where SM fiber from the 80's is still being used today for 10Gbe.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Anywhere that maximum speed is desired.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Yes, there are many different grades/qualities of fiber, but unless we're talking 10km+ spans, the differences aren't that major for 1/10/40/100Gbe.  Higher speeds reduce overall distance, but that's an unavoidable reality.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-16T21:27:58.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="503" PostTypeId="2" ParentId="99" CreationDate="2013-05-16T21:35:24.900" Score="14" Body="&lt;p&gt;Some things that I haven't seen mentioned:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) 10GBASE-T uses a lot of power compared to fiber to DAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) 10GBASE-T transceivers have much higher latency than other options.  This could be important in a compute cluster or other low latency environment like automated financial trading.&lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2013-05-16T21:35:24.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="504" PostTypeId="1" CreationDate="2013-05-16T21:35:35.130" Score="9" ViewCount="3462" Body="&lt;p&gt;Is there a way to overcome Cisco's 2 monitor session limitation on a VSS 6500 without the use of a network tap?&lt;/p&gt;&#xA;" OwnerUserId="446" LastEditorUserId="44" LastEditDate="2013-05-20T16:15:47.193" LastActivityDate="2013-05-20T16:15:47.193" Title="Overcome 2 monitor session limitation in Cisco VSS" Tags="|cisco-catalyst|cisco-6500|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="505" PostTypeId="1" AcceptedAnswerId="522" CreationDate="2013-05-16T21:38:37.470" Score="8" ViewCount="1484" Body="&lt;p&gt;When describing 802.11b/g and the &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.11b#Channels_and_Frequencies&quot; rel=&quot;nofollow&quot;&gt;2.4 GHz channel&lt;/a&gt;s, or 802.11a/n with &lt;a href=&quot;http://www.ni.com/white-paper/3740/en&quot; rel=&quot;nofollow&quot;&gt;5 GHz channels&lt;/a&gt;,  textbooks (&lt;a href=&quot;https://play.google.com/store/books/details/David_D_Coleman_CWNA_Certified_Wireless_Network_Ad?id=T4bXd18QlEYC&amp;amp;feature=nav_result#&quot; rel=&quot;nofollow&quot;&gt;CWNA Official Study Guide&lt;/a&gt;) often show some figure with channels spaced such that certain channels cannot overlap and therefore &lt;a href=&quot;http://en.wikipedia.org/wiki/Intersymbol_interference&quot; rel=&quot;nofollow&quot;&gt;ISI&lt;/a&gt; is avoided. The explanation is that &lt;a href=&quot;http://en.wikipedia.org/wiki/Intersymbol_interference&quot; rel=&quot;nofollow&quot;&gt;ISI&lt;/a&gt; occurs in cases of multipath, where the signals of the same frequency interfere. This does make sense to me, i.e.  that signals of the same frequency can interfere, and so non-overlapping channels would avoid ISI. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is that the 802.11 design assigns 1 signal per constant width of &quot;frequency space&quot; in a channel, for example&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 signal per 2 MHz in a DSSS channel&lt;/li&gt;&#xA;&lt;li&gt;1 signal per subcarrier in OFDM channel&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If we look at the figures in the URLs, the spacing of the channels and frequencies show a sequential order by Hz. What's not clear to me, is whether the same exact sequence must also hold for the &lt;em&gt;timing&lt;/em&gt; of each signal's arrival. For example, consider 2.4 GHz channel 1: does the 2.410 GHz signal always arrive at the receiver before the 2.414 GHz signal? After the first 1 cycle, I would guess that the signals within a single channel arrive in order of lowest to highest Hz. But does this precise order hold after &lt;em&gt;any&lt;/em&gt; length of time? What would prevent signals at different Hz from arriving at exactly the same instant? Or if simultaneous arrival of different-frequency signals is already expected to occur, then how does the radio discern which is the correct signal to receive? &lt;/p&gt;&#xA;" OwnerUserId="366" LastEditorUserId="366" LastEditDate="2013-05-17T21:45:35.337" LastActivityDate="2013-05-17T21:45:35.337" Title="intersymbol interference (ISI), channels, and frequencies" Tags="|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="506" PostTypeId="2" ParentId="504" CreationDate="2013-05-16T21:41:42.080" Score="8" Body="&lt;p&gt;If it's like most of the hardware switches, no.  Only one &quot;monitor session&quot; can be active at a time, 'tho the configuration can store two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using vlans and external filtering hardware (gigamon?) you could have one session dumping all the traffic you want to see, but that's still one session. (and a network tap would be cheaper)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-05-16T21:47:38.277" LastActivityDate="2013-05-16T21:47:38.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="507" PostTypeId="1" AcceptedAnswerId="508" CreationDate="2013-05-16T21:44:28.357" Score="5" ViewCount="1224" Body="&lt;p&gt;How many contexts can be created on a Cisco ASA Active/Standby pair with base license? &lt;/p&gt;&#xA;" OwnerUserId="446" LastActivityDate="2013-05-16T21:44:28.357" Title="How many contexts can be created on a Cisco ASA Active/Standby Pair?" Tags="|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="508" PostTypeId="2" ParentId="507" CreationDate="2013-05-16T21:44:28.357" Score="5" Body="&lt;p&gt;Each physical firewall is licensed for two contexts with the base license. For example: an operational and an admin context. If you create an active/standby failover pair up to four contexts can be created as the licensing is shared between the physical devices. For Example: Operational 1, Operational 2, Operational 3, and an admin context. &lt;/p&gt;&#xA;" OwnerUserId="446" LastActivityDate="2013-05-16T21:44:28.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="509" PostTypeId="2" ParentId="489" CreationDate="2013-05-16T21:47:25.577" Score="5" Body="&lt;p&gt;&lt;a href=&quot;http://ncclient.grnet.gr/&quot;&gt;ncclient&lt;/a&gt; is a python library for communicating via netconf. I've just started working with it.&lt;/p&gt;&#xA;" OwnerUserId="15" LastActivityDate="2013-05-16T21:47:25.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="510" PostTypeId="1" AcceptedAnswerId="19208" CreationDate="2013-05-16T21:59:06.513" Score="17" ViewCount="3469" Body="&lt;p&gt;Usually, when using BGP, you can choose (or your device chooses four you) a router ID from one of your assigned public IP addresses.&lt;/p&gt;&#xA;&lt;p&gt;Now, let's admit you &lt;strong&gt;only&lt;/strong&gt; run IPv6. As the router ID is still a 32 bits number, it can not be copied from a loopback's address.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-dupont-durand-idr-ipv6-bgp-routerid-01&quot; rel=&quot;nofollow noreferrer&quot;&gt;draft-dupont-durand-idr-ipv6-bgp-routerid-01&lt;/a&gt; brings a start of an answer, suggesting to use your AS number suffixed with a locally allocated part. But that works only for 16 bits AS numbers.&lt;/p&gt;&#xA;&lt;p&gt;So, how to choose a RID for your devices ? Randomly ? If so, how would devices react in case of collision (both ends of a BGP session use the same RID) ?&lt;/p&gt;&#xA;&lt;p&gt;PS : the issue also concerns OSPF, but then you only have to design a coherent RID allocation scheme. Which you can not do when using BGP to peer with other ASes.&lt;/p&gt;&#xA;" OwnerUserId="564" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2015-11-29T07:46:28.017" Title="How to choose a BGP router ID when using IPv6 only?" Tags="|ipv6|bgp|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="511" PostTypeId="2" ParentId="510" CreationDate="2013-05-16T22:02:52.957" Score="1" Body="&lt;p&gt;IPv4 loopback interface?  I know Cisco IOS will use the highest address (32bit number) as the router ID.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-16T22:02:52.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="512" PostTypeId="2" ParentId="510" CreationDate="2013-05-16T22:15:48.383" Score="10" Body="&lt;p&gt;Color me unsure on this answer...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;router-ids only really need to be unique within the OSPF space, as you mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within BGP, my understanding is that they are only used to detect a new peering session being created when one already exists...to which I guess the solution is to tear down the old one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the peering sessions come in on different transport addresses, then even if the router-ids presented are the same, they will be seen as different sessions because they're coming from different transport addresses (IPv6 addresses in your scenario).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So...I guess the answer would be to pick your router-ids for OSPF (v3 presumably) and its probably not the end of the world if your router-id ends up duplicating the router-id that another (third party) peer uses with an external AS peer&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-05-16T22:15:48.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="513" PostTypeId="2" ParentId="410" CreationDate="2013-05-16T22:17:43.267" Score="1" Body="&lt;p&gt;After restoring the unit to factory defaults and reprogramming it, the AP began functioning properly once more.  I'm chalking it up to &quot;attempted upgrade gone awry.&quot;&lt;/p&gt;&#xA;" OwnerUserId="154" LastActivityDate="2013-05-16T22:17:43.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="514" PostTypeId="2" ParentId="504" CreationDate="2013-05-16T22:25:45.727" Score="2" Body="&lt;p&gt;If its vlan traffic look into setting up VACL captures.&lt;/p&gt;&#xA;" OwnerUserId="621" LastActivityDate="2013-05-16T22:25:45.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="515" PostTypeId="2" ParentId="489" CreationDate="2013-05-16T22:27:04.077" Score="5" Body="&lt;p&gt;I use &lt;a href=&quot;https://code.google.com/p/capirca/&quot; rel=&quot;nofollow&quot;&gt;Google Capirca&lt;/a&gt; for firewall / acl management.&#xA;It is simply a good rule generator, and the rule definition and generation are separated so you can even extend it to support any device you want. It does i.e. Linux iptables, Juniper SRX or Cisco ACLs out of the box.&#xA;The ACLs you write can be kept independent of the device type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(the little geek brother of FW-1 rule compiler ;)&lt;/p&gt;&#xA;" OwnerUserId="620" LastEditorUserId="15" LastEditDate="2013-05-17T15:07:04.533" LastActivityDate="2013-05-17T15:07:04.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="516" PostTypeId="2" ParentId="415" CreationDate="2013-05-16T22:32:05.733" Score="5" Body="&lt;p&gt;Since policy routes are evaluated top-down, you can work around this limit by placing a more specific entry matching traffic from internal subnet A to internal subnet B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this should be less than comfortable if you have many different networks attached to your internal interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, I would recommend you a trick I once used: &#xA;since Fortigate devices ignore QoS marks, you should sign your &quot;internet&quot; packets on the firewall-facing port of your Cisco switch with a specific TOS and then use that mark in your policy-route.&lt;/p&gt;&#xA;" OwnerUserId="530" LastEditorUserId="16668" LastEditDate="2015-07-18T07:29:53.697" LastActivityDate="2015-07-18T07:29:53.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="517" PostTypeId="1" AcceptedAnswerId="521" CreationDate="2013-05-16T22:43:30.597" Score="10" ViewCount="5085" Body="&lt;p&gt;There are several references to backpressure as regards to the internal bandwidth and switching fabrics of routers and switches.  What exactly does backpressure mean, and what are the real world ramifications?&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2013-05-17T15:01:56.777" Title="What is backpressure in the context of routers?" Tags="|architecture|router|hardware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="518" PostTypeId="2" ParentId="493" CreationDate="2013-05-16T22:51:38.750" Score="11" Body="&lt;p&gt;[MMF] &lt;em&gt;longer&lt;/em&gt; wavelength (850nm), much wider beam vs. [SMF] short wavelength (1310nm-15??nm), narrow beam.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key difference that no one has touched is &lt;a href=&quot;http://en.wikipedia.org/wiki/Modal_dispersion&quot; rel=&quot;noreferrer&quot;&gt;&quot;modal dispersion&quot;&lt;/a&gt;, which is a fancy term to describe how the light moves through the fiber. &lt;a href=&quot;http://www.photonics.com/Article.aspx?AID=25153&quot; rel=&quot;noreferrer&quot;&gt;This page&lt;/a&gt; goes into far more detail. The first picture sums it up... MM is bouncing off the edge of the fiber resulting in a dispersion of light at the far end because the photons that went down the center traveled less distance than those that bounced a lot; a 1ns pulse entering one end does not exit as a clean 1ns pulse at the other end. The effect is greatly diminished in SMF due to the much smaller diameter fiber, and &lt;em&gt;precise&lt;/em&gt; injection (&quot;launch&quot;) of the laser at the center of the fiber.  Dispersion gets worse as distance increases.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-05-07T00:55:42.050" LastActivityDate="2014-05-07T00:55:42.050" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="519" PostTypeId="1" AcceptedAnswerId="520" CreationDate="2013-05-16T23:42:23.223" Score="15" ViewCount="1416" Body="&lt;p&gt;I am thinking of upgrading our networking situation and am considering a migration of IPv4 to IPv6.  Is it too soon to be considering this move as it looks like much of the networking gear and OSen are ready for it?  Where do I lose out in such a situation?&lt;/p&gt;&#xA;" OwnerUserId="607" LastActivityDate="2015-09-28T16:50:40.880" Title="Time to switch to IPv6?" Tags="|ipv6|" AnswerCount="6" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="520" PostTypeId="2" ParentId="519" CreationDate="2013-05-17T00:00:00.617" Score="19" Body="&lt;p&gt;TL;DR: If you're a consumer/SOHO nothing needs doing. If you're providing services, start planning now while there's no rush and no deadline.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, everything is dual stack these days, meaning it supports IPv4 and IPv6 out of the box. The Internet in general is still operating fully supporting IPv4 as much as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point, if you're providing services to the Internet -- running DNS, web, email, etc. services. You should be planning to provide those services as both IPv4 and IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're consuming services from the Internet -- small office/home office, larger offices, residential, etc. then there is currently no urgency to convert yourself to IPv6. I suspect as the bigger cable companies start deploying IPv6 the &quot;last mile.&quot; Then we'll see more IPv6 traffic in general.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, there are a lot of really big things -- Amazon, some of the content delivery networks -- which are only IPv4. So the focus, as I see it, is for the providers to continue working to provide evertyhing in IPv4 and IPv6 simultaneously. The first problem the Internet is going to face is fracturing/islands appearing as the newest areas, where IPv4 addresses are already exhausted, come online as IPv6-only. Those newest areas will need the existing services and service providers to offer stuff over IPv6.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-17T00:00:00.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="521" PostTypeId="2" ParentId="517" CreationDate="2013-05-17T00:05:36.357" Score="11" Body="&lt;p&gt;Backpressure refers to what is essentially concentration of traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. I can have 10 x 1Gbit links internally that are all feeding into a 1Gbit link that provides me with Internet transit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;at saturation point, the router can store packets in its buffer and/or drop them - with no particular configuration, a router will generally fill its buffers and then tail drop, this gives rise to two problems: buffer-bloat and tcp global synchronisation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first refers to a case where the buffer is constantly filled due to constantly saturated link utilisation. The second refers to the issue of hosts re-transmitting dropped packets all at the same time, thereby causing a burst of traffic and thus, more drops, more retransmits, ad nauseum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RED was conceived a long time ago as a means to deal with this issue; namely by randomly selecting packets to drop during times of congestion. This however required careful tuning according to the properties and expected behaviour of the link. Fortunately things have moved on and AQM (Active Queue Management) is now the cutting-edge of the industry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A top-notch example of AQM is CoDeL - this is an algorithm that focuses purely upon the sojorn of a packet through the system and aims to ensure packets are passed within a specific time rather than caring about whether or not a certain amount of bandwidth/buffer is being utilised.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-05-17T00:05:36.357" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="522" PostTypeId="2" ParentId="505" CreationDate="2013-05-17T00:08:33.877" Score="7" Body="&lt;p&gt;These types of radio frequency transmissions are &quot;frequency division multiplexed&quot; (FDM). The different channels (ie, frequencies) transmit and receive at the same time. It's like a cocktail party where each conversation chooses a different pitch range -- the tenors have no problem hearing each other right through the basses at the next table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In FDM, the receivers are tuned so that they only pickup transmissions in the channel (the frequency range) to which they are supposed to listen. So over a wider range (eg, the 2.4Ghz wifi) there are smaller divisions of frequency ranges into channels. The transmissions move at nearly the speed of light, so any transmitters on the same frequency -- the same channel in a give frequency band, eg 2.4Ghz's channel 11 -- will instantly be talking on top of each other. So any two 2.4Ghz channel 11 devices within range of each other will collide instantly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps the part that isn't obvious is that electro-magnetic theory shows that superposition of E&amp;amp;M waves is not a problem. It's like waves in the open, ocean; You can have short spaced three foot waves (a highish frequency), moving over the surface at the same time you have long ocean swells (a lowish frequency). At the E&amp;amp;M receiver, you &quot;simply&quot; tune to the right frequency and you can pick the signals you want out of the noise. (And the E&amp;amp;M spectrums is very very noisy.)&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2013-05-17T00:14:22.343" LastActivityDate="2013-05-17T00:14:22.343" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="523" PostTypeId="2" ParentId="519" CreationDate="2013-05-17T01:26:25.323" Score="7" Body="&lt;p&gt;In general, yes.  If your systems (routers, workstations, servers, etc) support IPv6 &lt;em&gt;and your ISP provides IPv6&lt;/em&gt;, then there's very little reason not to move forward, 'tho you'll want IPv4 to remain your &lt;em&gt;default&lt;/em&gt; protocol.  And we're talking &quot;dual stack&quot; (v4 and v6), not &quot;turn off IPv4&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are parts of the world today that simply have no more IPv4 addresses; IPv6 is their only means of connectivity.  In order to communicate with them, you'll have to be on the IPv6 internet -- or they need an IPv4-IPv6 proxy, as the protocols &lt;em&gt;are not&lt;/em&gt; compatible. (or they're stuck behind massive carrier-grade-nat (CGN) systems.) Unless you're doing a lot of business with Asia, I doubt you've noticed. (or need to)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only current drawback that I'm aware of is that the IPv6 internet is somewhat less stable and slower.  Because many providers aren't focusing as much effort on IPv6, they have fewer IPv6 peering connections over slower alternate links, or worse, tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[My IPv6 is over a HE.net tunnel.  Stock android devices prefer IPv6, and they're HORRIBLY slow to various google properties (play store, youtube) over that tunnel.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-05-17T07:13:37.140" LastActivityDate="2013-05-17T07:13:37.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="524" PostTypeId="2" ParentId="505" CreationDate="2013-05-17T02:02:32.957" Score="6" Body="&lt;p&gt;All this RF stuff sometimes makes my head spin, but I believe you are mixing up some concepts in your question.  The separation of channels has absolutely nothing at all to do with ISI.  ISI is an effect that occurs on the same frequency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISI typically results from multipath when more than one copy of a symbol arrives at the receiver at slightly different times and those copies start to overlap with the next transmitted symbol.  This has a &quot;blurring&quot; effect, confusing the receiver and making it hard to understand the symbol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The guard interval is what helps prevent ISI, by allowing the RF medium to &quot;quiet down&quot; before the next symbol is sent.  A longer guard interval helps give the RF medium more time to become quiet, but reduces performance by reducing the amount of time that data is actually transmitted.  A shorter guard interval increase performance but risks more chance of ISI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VERY loose analogy, think of someone talking into a microphone and that sound coming out of two speakers.  If you introduce a delay in the transmission of sound from one speaker so that words start to overlap, this can make it difficult for people to understand what is being said.  If that person were to give a full speech non-stop so the words are continually overlapping, it can be very hard to understand.  However if they were to pause for a full second between each word, it would be easier to understand, but it would take longer to get through the speech.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-17T02:02:32.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="525" PostTypeId="2" ParentId="493" CreationDate="2013-05-17T02:19:39.840" Score="1" Body="&lt;p&gt;You can reference cable spec for each module. This one is from Cisco SFP+ 10G spec and its support cabling. &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/modules/ps5455/data_sheet_c78-455693.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/modules/ps5455/data_sheet_c78-455693.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="368" LastActivityDate="2013-05-17T02:19:39.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="526" PostTypeId="1" AcceptedAnswerId="1131" CreationDate="2013-05-17T03:04:41.000" Score="12" ViewCount="4309" Body="&lt;p&gt;I've been trying to figure out how to setup a GRE tunnel between an ALU 7750SR and a 3rd party vendor.  I think it's balking at the VC-ID in the SDP but i'm hoping someone has experience getting a GRE tunnel to come up in a multi-vendor environment with ALU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the requested syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sdp 9999 create&#xA;far-end 1.1.1.1 &#xA;path-mtu 1500 &#xA;keep-alive &#xA;exit&#xA;&#xA;ies 9998 customer 1 create &#xA; interface &quot;PACKET_DESIGN&quot; create &#xA; address 10.128.105.6/30 &#xA; spoke-sdp 9999:1 create &#xA; no shutdown &#xA; exit &#xA;no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="625" LastEditorUserId="44" LastEditDate="2013-05-19T03:53:40.627" LastActivityDate="2014-02-21T16:06:19.160" Title="ALU interop GRE tunnel" Tags="|gre|alcatel-lucent-7750|" AnswerCount="3" CommentCount="7" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="527" PostTypeId="2" ParentId="519" CreationDate="2013-05-17T06:40:34.020" Score="8" Body="&lt;p&gt;Usually you don't switch from IPv4 to IPv6, you go from IPv4-only to dual stacked networking: IPv4 and IPv6 combined. The IPV6-only internet is very, very limited at this moment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It certainly isn't too soon to start implementing IPv6: we're rapidly running out of available IPv4 space.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-05-17T06:40:34.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="528" PostTypeId="1" AcceptedAnswerId="529" CreationDate="2013-05-17T07:53:28.913" Score="7" ViewCount="3413" Body="&lt;p&gt;Is there a way to monitor a user's input on a cisco device? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clarification: the commands a user have entered as in configuration mode AND normal mode. (especialy normal mode. Configuration mode can be done with &quot;show history&quot;).&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-05-18T06:26:58.693" Title="Cisco: monitoring users input" Tags="|cisco|monitoring|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="529" PostTypeId="2" ParentId="528" CreationDate="2013-05-17T08:07:25.320" Score="8" Body="&lt;p&gt;Have a look at this IOSHints post: &lt;a href=&quot;http://blog.ioshints.info/2006/11/cli-command-logging-without-tacacs.html&quot;&gt;CLI command logging without TACACS+&lt;/a&gt;. And the title seems to imply it can also be done with TACACS+.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-05-17T08:07:25.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="530" PostTypeId="2" ParentId="528" CreationDate="2013-05-17T08:27:54.523" Score="5" Body="&lt;p&gt;&lt;strong&gt;TACACS+ is the &lt;em&gt;preferred&lt;/em&gt; method&lt;/strong&gt; to log CLI commands at any enable level.  See the &lt;strong&gt;AAA&lt;/strong&gt; and TACACS commands for configuration.  There's open source software if you don't have or can't afford Cisco ACS or similar products.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But for a really cool and rarely used feature, you could &lt;strong&gt;have the switch &lt;em&gt;itself&lt;/em&gt; run a config diff&lt;/strong&gt;(erence) on the running-config and startup-config and email the changes or deltas to you!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here's how I have 4510R switches configured to email config changes.  This uses the &lt;strong&gt;event manager&lt;/strong&gt; to do the work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, some common settings for the mail server, from, and to addresses.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    event manager environment _email_server a.b.c.d.&#xA;    event manager environment _email_from netops@example.com&#xA;    event manager environment _email_to netops@example.com&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, the actual applet to do the diff.  This is fairly self-explanatory.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    event manager applet config_diff_email authorization bypass&#xA;    event syslog pattern &quot;.*%SYS-5-CONFIG.*&quot;&#xA;    action 1.0 info type routername&#xA;    action 1.1 cli command &quot;enable&quot;&#xA;    action 1.2 cli command &quot;show archive config diff nvram:/startup-config system:/running-config&quot;&#xA;    action 1.3 mail server &quot;$_email_server&quot; to &quot;$_email_to&quot; from &quot;$_email_from&quot; subject &quot;Config Change Alert ($_info_routername)&quot; body &quot;$_cli_result&quot;&#xA;    action 1.4 syslog msg &quot;Config Change Alert emailed&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that even going into config and not making changes still triggers the diff email.  And one downside with this is CPU spike that happens for about 10 seconds while it runs.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-05-18T06:26:58.693" LastActivityDate="2013-05-18T06:26:58.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="531" PostTypeId="2" ParentId="462" CreationDate="2013-05-17T08:37:07.507" Score="1" Body="&lt;p&gt;Grab &lt;strong&gt;Notepad++&lt;/strong&gt; which has many different language (formatting=parsing) options.  Though I don't have a specific one for Cisco, I'm sure someone's created one or you can define your own.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-17T08:37:07.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="532" PostTypeId="2" ParentId="170" CreationDate="2013-05-17T09:18:01.073" Score="0" Body="&lt;p&gt;There's so much filtering between you and the LG (looking glass) that can get your prefix removed from on path or another.  What's the length of your advertised prefix?  Do you have PI or PA space?  Since the bestpath is advertised to peers, you two paths can be competing with one another upstream and only one is making it to the LG.  If you shutdown one of your paths, does it then show up in the LG after convergence?  That will tell you you're losing one to bestpath.  Try LG's with your providers to confirm your prefix is there first, then try to work your way up to the next SP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your iBGP bestpath question, default is to only advertise one.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-17T09:18:01.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="533" PostTypeId="2" ParentId="528" CreationDate="2013-05-17T09:51:57.820" Score="5" Body="&lt;p&gt;Since your question is not restricted to IOS: on Cisco ASA devices you can see executed commands in the syslog. They look this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;May 17 11:45:12 192.168.0.1 %ASA-5-514008: User 'stefan' executed the 'write memory' command.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you could filter for such messages, for example using &lt;code&gt;grep&lt;/code&gt; and a cron job. Of course you need to have the required severity level set, here 5 for &lt;em&gt;notification&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used &lt;em&gt;splunk&lt;/em&gt; for directly receiving and storing firewall syslog messages, programmed a daily running alert which sends me all ASA syslog lines containing &quot;executed&quot; as a summary email. I did this because I already had splunk in place for monitoring and reporting.&lt;/p&gt;&#xA;" OwnerUserId="231" LastActivityDate="2013-05-17T09:51:57.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="534" PostTypeId="2" ParentId="493" CreationDate="2013-05-17T10:19:13.223" Score="9" Body="&lt;p&gt;The key difference between SMF and MMF? &lt;strong&gt;distance and cost&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Single Mode Fibre has a greater distance potential, and can support runs between 2 meters and 10,000 meters. However, the optics are twice the cost of MMF optics. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to consider with Multimode fiber is the grade of Fiber that is in place. I have spoken to many customers who laid OM1 fiber in the Mid-90's, and now want 10GbE runs over same fiber, and very frustrated to learn that this fiber will only support 10GbE out to 26m. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Gigabit SX-LC Mini-GBIC&lt;/strong&gt; provides a full-duplex Gigabit solution up to 550 meters over multimode fiber.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2-220 m (62.5 µm core diameter / 160 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;li&gt;2-275 m (62.5 µm core diameter / 200 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;li&gt;2-500 m (50 µm core diameter / 400 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;li&gt;2-550 m (50 µm core diameter / 500 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Gigabit LX-LC Mini-GBIC&lt;/strong&gt; provides a full-duplex Gigabit solution up to 10 km over singlemode fiber, or up to 550 meters over multimode fiber.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2-550 m (multimode 62.5 µm core diameter / 500 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;li&gt;2-550 m (multimode 50 µm core diameter / 400 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;li&gt;2-550 m (multimode 50 µm core diameter / 500 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;li&gt;2-10,000 m (singlemode fiber)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;10-GbE SFP+ Short Range&lt;/strong&gt; supports the 10-Gb SR standard, providing 10-Gb connectivity up to 300 meters over multimode fiber.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2-26 meters (62.5 µm core diameter / 160 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;li&gt;2-33 meters (62.5 µm core diameter / 200 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;li&gt;2-66 meters (50 µm core diameter / 400 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;li&gt;2-82 meters (50 µm core diameter / 500 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;li&gt;2-300 meters (50 µm core diameter / 2000 MHz*km bandwidth)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;10-GbE SFP+ Long Range&lt;/strong&gt; supports the 10-Gb LR standard, providing 10-Gb connectivity up to 10 km over singlemode fiber.&lt;/p&gt;&#xA;" OwnerUserId="409" LastEditorUserId="409" LastEditDate="2013-05-17T13:12:44.300" LastActivityDate="2013-05-17T13:12:44.300" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="535" PostTypeId="2" ParentId="489" CreationDate="2013-05-17T10:19:35.023" Score="3" Body="&lt;p&gt;I use &lt;a href=&quot;https://github.com/knipknap/exscript&quot; rel=&quot;nofollow&quot;&gt;Exscript&lt;/a&gt; for CLI screen scraping. It is a Python library and has also a minimalistic scripting language itself. The latter one is sufficient for most small tasks and doesn't require a lot of programming knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find some of my exscripts here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/verbosemode/exscripts&quot; rel=&quot;nofollow&quot;&gt;https://github.com/verbosemode/exscripts&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also written a grep-like tool based on ciscoconfparse and a templating tool (based on Jinja2) for text based configurations, which you can find on my github account (sorry, for the shameless self-promotion).&lt;/p&gt;&#xA;" OwnerUserId="79" LastActivityDate="2013-05-17T10:19:35.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="536" PostTypeId="2" ParentId="493" CreationDate="2013-05-17T11:57:38.427" Score="10" Body="&lt;p&gt;Please read &lt;a href=&quot;http://www.nanog.org/meetings/nanog57/presentations/Monday/mon.tutorial.Steenbergen.Optical.39.pdf&quot;&gt;Everything You Always Wanted to Know About Optical Networking – But Were Afraid to Ask &lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;:)&lt;/p&gt;&#xA;" OwnerUserId="7" LastActivityDate="2013-05-17T11:57:38.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="537" PostTypeId="2" ParentId="528" CreationDate="2013-05-17T12:45:36.637" Score="8" Body="&lt;p&gt;Assuming you are using TACACS+ you can configure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tacacs-server host x.x.x.x key xxxxx&#xA;&#xA;aaa accounting commands 0 default start-stop group tacacs+&#xA;aaa accounting commands 15 default start-stop group tacacs+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also include a line for any other enable levels that you may use.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-17T12:45:36.637" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="539" PostTypeId="2" ParentId="504" CreationDate="2013-05-17T13:35:51.220" Score="6" Body="&lt;p&gt;Unfortunately no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.anuesystems.com/&quot; rel=&quot;noreferrer&quot;&gt;Anue Systems&lt;/a&gt; makes a very slick solution which allows you to pass in all your span or tap traffic and then &quot;switch&quot; that traffic based on your rules to your various tools that would typically utilize a span port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure there are other vendors that provide a similar solution but I was impressed by this particular one.&lt;/p&gt;&#xA;" OwnerUserId="176" LastEditorUserId="165" LastEditDate="2013-05-17T15:07:38.990" LastActivityDate="2013-05-17T15:07:38.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="540" PostTypeId="2" ParentId="493" CreationDate="2013-05-17T13:58:17.787" Score="10" Body="&lt;p&gt;Here's a few things not yet covered.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using only single mode lets you use one fibre type for everything (fewer optics, cable types to spare)&lt;/li&gt;&#xA;&lt;li&gt;No likelihood of obsolescence (eg, OM3 seemed like it was current for ~3 years)&lt;/li&gt;&#xA;&lt;li&gt;Offers single-pair options for 40 &amp;amp; 100g&lt;/li&gt;&#xA;&lt;li&gt;Offers single-fibre options at 1 &amp;amp; 10g&lt;/li&gt;&#xA;&lt;li&gt;Although the optics are more expensive they're &amp;lt; 2x while offering much longer reach (remember to buy OEM optics, not rebadged)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Of course on the long haul side there are DWDM systems now sending 16Tb through a single, single mode, fibre (in practice as we're always bi-directional that's a 16Tb pair), and by the time you need multiple links beyond a &quot;campus&quot; distance DWDM systems (for &amp;lt; 40kM fibre length CWDM might) make financial sense, with optical amps and dispersion management there are many multi-terabit submarine cable systems running purely optically regenerated for over 10,000kM.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-17T13:58:17.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="541" PostTypeId="2" ParentId="519" CreationDate="2013-05-17T14:10:26.113" Score="4" Body="&lt;p&gt;I think you should first opt to run a dual stack, meaning to run IPv4 and IPv6 next to each other. In that way you can steadily progress to an all IPv6 environment once IPv4 is getting faced out. Some countries do not speak IPv4 anymore (like China) and others haven't opted in for IPv6 or only partially.&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-05-17T14:10:26.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="542" PostTypeId="1" AcceptedAnswerId="43126" CreationDate="2013-05-17T14:47:26.730" Score="10" ViewCount="5660" Body="&lt;p&gt;We have a SonicWALL 2400. Is there any way to assign multiple interfaces to the same LAN subnet? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, we would like to have X1 for the WAN and X0, X2, X3 and X4 connected to 4 devices that would form a LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to limited space, we are unable to add a switch to do this.&lt;/p&gt;&#xA;" OwnerUserId="641" LastEditorUserId="441" LastEditDate="2013-05-17T19:19:10.853" LastActivityDate="2017-08-09T19:17:52.423" Title="Multiple LAN interfaces on SonicWALL" Tags="|dell|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="543" PostTypeId="2" ParentId="517" CreationDate="2013-05-17T15:01:56.777" Score="4" Body="&lt;p&gt;Another important point on backpressure is that any configured queuing mechanisms don't kick in until there is backpressure. If you have a sub-rate interface (say a 3meg circuit connected to a 100mb interface) there will never be backpressure until you are sending 10mbps. By configuring something like a shaper on the interface you artificially create that backpressure. This causes any traffic greater than the shaper rate (3mb in this example) to be stored in a buffer. Now that we have things in buffers we can apply queuing tools on those packets, like low-latency queuing to let the voice traffic go out first.&lt;/p&gt;&#xA;" OwnerUserId="123" LastActivityDate="2013-05-17T15:01:56.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="544" PostTypeId="2" ParentId="483" CreationDate="2013-05-17T15:40:13.610" Score="1" Body="&lt;p&gt;Are you looking at two different routes? Maybe a /24 and a /23? In general a protocol can only redistribute what is already in the routing table. If you make a static route that matches the prefix of a connected interface the connected interface will be in the routing table and not the static. That would force the static to not placed into EIGRP (since it isn't in the routing table).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if you use &quot;redistribute connected&quot; that could change things, but I would still assume the connected interface would take precedence. &lt;/p&gt;&#xA;" OwnerUserId="123" LastActivityDate="2013-05-17T15:40:13.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="545" PostTypeId="1" AcceptedAnswerId="552" CreationDate="2013-05-17T15:42:08.680" Score="8" ViewCount="4656" Body="&lt;p&gt;I wasn't sure where to ask this but it seems to be something on the switch side so I thought I would start here first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am working on a little project to automate updates to config files in bulk using &lt;a href=&quot;http://docs.fabfile.org/en/1.6/&quot; rel=&quot;nofollow&quot;&gt;Fabric&lt;/a&gt;.  I have everything installed and seemingly working correctly in Python and have gotten to the point where I am ready to start building some tests.  However, all of the commands that I feed through Fabric come back with the following error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Line has invalid autocommand &quot;/bin/bash -l -c &quot;&lt;strong&gt;X&lt;/strong&gt;&quot;&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Where &lt;strong&gt;X&lt;/strong&gt; is the command I am trying to run on the switch.  I am having trouble understanding why this is failing, maybe somebody can offer an explaination?  Is this something that needs to be configured on the Cisco side?  I am testing this on a 3750 switch running 12.2, not sure what other details to provide.&lt;/p&gt;&#xA;" OwnerUserId="303" LastEditorUserId="564" LastEditDate="2013-05-20T13:43:15.760" LastActivityDate="2013-05-20T13:43:15.760" Title="Using Fabric on a Cisco device : &quot;Line has invalid autocommand&quot;" Tags="|cisco-catalyst|cisco-ios-12|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="546" PostTypeId="2" ParentId="545" CreationDate="2013-05-17T15:47:09.800" Score="5" Body="&lt;p&gt;I'm not familiar with Fabric, but from the error, it's clear it's attempting to run a shell (bash) to run your selected command.  IOS devices don't have a &quot;shell&quot;; simply give the CLI the command to run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(In other words, Fabric doesn't appear to be designed to talk to anything that's not a UNIX(tm) system.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-17T15:47:09.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="547" PostTypeId="2" ParentId="528" CreationDate="2013-05-17T16:17:56.657" Score="1" Body="&lt;p&gt;I use the following configuration and it logs config commands, as well as a few others like 'enable':&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;archive&#xA; log config&#xA;  logging enable&#xA;  notify syslog&#xA;  hidekeys&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-17T16:17:56.657" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="548" PostTypeId="2" ParentId="545" CreationDate="2013-05-17T16:28:20.040" Score="7" Body="&lt;p&gt;Fabric is designed with a certain &lt;a href=&quot;http://docs.fabfile.org/en/1.6/usage/execution.html&quot;&gt;execution model&lt;/a&gt;; It assumes something, Bash by default, will run on the remote to execute your command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can change what the remote command is though. You might try changing the remote command into a single space for when you're sending commands to something like a CLI (eg, Cisco IOS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://docs.fabfile.org/en/1.6/usage/env.html#shell&quot;&gt;Fabric's Environment Dictionary about the 'shell' setting&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-17T16:28:20.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="549" PostTypeId="1" AcceptedAnswerId="550" CreationDate="2013-05-17T18:54:40.160" Score="5" ViewCount="1228" Body="&lt;p&gt;I've been given a task of creating several filters to block outside traffic by geolocation. In the list of the places that need to be blocked there are several countries (e.g. China and India) and 5 states (Texas, Louisiana, Arkansas, Oklahoma and New Mexico). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding IP prefixes by country wasn't a problem (&lt;a href=&quot;http://www.ipdeny.com/ipblocks/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, for example), but I couldn't locate a similar list by state. &lt;a href=&quot;http://www.my-ip-address-is.com/state/Texas&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; was the closest I could find, but it's not exactly feasible to go through thousands of links and collect this information manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there such a list anywhere on the Internet or should I start polishing my scripting abilities?&lt;/p&gt;&#xA;" OwnerUserId="398" LastEditorUserId="441" LastEditDate="2013-05-17T19:41:11.747" LastActivityDate="2013-05-21T01:21:36.410" Title="IP prefixes by state (geolocation)" Tags="|ipv4|" AnswerCount="4" CommentCount="0" ClosedDate="2018-04-10T00:52:22.403" ContentLicense="CC BY-SA 3.0" />
  <row Id="550" PostTypeId="2" ParentId="549" CreationDate="2013-05-17T19:07:57.050" Score="8" Body="&lt;p&gt;You're looking for a &quot;Geo Location&quot; database. (One example I've used is &lt;a href=&quot;http://www.maxmind.com/&quot;&gt;Max Mind&lt;/a&gt;'s products.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devil is in the implementation details. The db products are meant to be used programmatically. For example, given a list of IP addresses, we want to know the state, or lat/longitude, country, etc. You could certainly write something (e.g. some Perl code. But the products come with sample libraries for many laguages) that would spit out all the IP addresses, networks, whatever for a given state or zip code. You would have to look through the db products to see which one(s) are organized in a way you can use. Then you have to do something with that list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could do something dynamic. Hook into your web server, or server firewall, etc so that packets are looked up on the fly against the Geo Location database (the dbs are local data files you update periodically [eg monthly]) then make a decision, or insert a firewall rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of that is easy, but it's definitely do-able.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-17T19:07:57.050" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="551" PostTypeId="2" ParentId="549" CreationDate="2013-05-17T19:11:05.347" Score="6" Body="&lt;p&gt;The short answer is that doing this correctly is practically impossible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The long answer is that you will most likely need to talk to a GeoIP company (such as MaxMind). The good ones have nice APIs you can work with that will allow you to query by various regional levels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The biggest problem with GeoIP is accuracy. A lot of these GeoIP databases have blatantly incorrect information in them. It is rather difficult to exactly pinpoint where a specific prefix is being used without inside knowledge of the network. There's no sure way to know if, for example, a certain prefix was delegated to a customer, and that customer is hauling it back across three states to a branch office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end, its generally a simple task to query a big GeoIP database and build firewall rules and whatnot from that. Its just that you can never be sure of accuracy.&lt;/p&gt;&#xA;" OwnerUserId="89" LastActivityDate="2013-05-17T19:11:05.347" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="552" PostTypeId="2" ParentId="545" CreationDate="2013-05-17T19:20:49.087" Score="7" Body="&lt;p&gt;So it turns out that there is an argument that is implied when you invoke a command from Fabric called shell=True.  To get things to work correctly I had to specify an argument &lt;strong&gt;shell=False&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for example, here is a command that I was running that was failing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def config_t():&#xA;  run(&quot;config t&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which was producing the &lt;em&gt;Line has invalid autocommand &quot;/bin/bash -l -c &quot;config t&quot;&quot;&lt;/em&gt; error.  Change your command to include the shell=False&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def config_t():&#xA;    run(&quot;config t&quot;, shell=False)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything ran smoothly for me after I made this change.  For more information there is a section in the documentation describing this. &lt;a href=&quot;https://fabric.readthedocs.org/en/1.6/api/core/operations.html?highlight=run#fabric.operations.run&quot;&gt;Fabric docs&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="303" LastActivityDate="2013-05-17T19:20:49.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="553" PostTypeId="1" AcceptedAnswerId="554" CreationDate="2013-05-17T22:09:44.053" Score="7" ViewCount="1713" Body="&lt;p&gt;PROBLEM:&#xA;The servers in two clusters keep losing heartbeat connectivity with each other thus causing database outages.  Outages are brief but disruptive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SETUP:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There are two clusters of three servers each.&lt;/li&gt;&#xA;&lt;li&gt;Each server has one NIC connected to a single Layer 2 switch (Catalyst 2950) with the switch ports hard-coded at 100Mb/full-duplex.&lt;/li&gt;&#xA;&lt;li&gt;The DBAs confirm that each heartbeat NIC is hard-coded to 100Mb/full-duplex.&lt;/li&gt;&#xA;&lt;li&gt;There are two clusters configured in VLAN 100 and in the same subnet (10.40.60.0/24).&lt;/li&gt;&#xA;&lt;li&gt;The management IP address is on a separate subnet (10.40.1.0/24) and it's switch port is in VLAN 1.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;SYMPTOMS:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;ul&gt;&#xA;&lt;li&gt;I see an ever-increasing error count on the switch ports.  For the three servers in one cluster the input errors (all CRC) are about 3% of total input packets.  There are no output errors.  The other cluster is at about 6% of total input packets.&lt;/li&gt;&#xA;&lt;li&gt;Transmit and receive load on the switch ports is light, under 20/255 on txload and rxload.&lt;/li&gt;&#xA;&lt;li&gt;The switch log shows the switch ports bouncing:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;May  16 11:15:31 PDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13, changed state to down&lt;br&gt;&#xA;  May  16 11:15:32 PDT: %LINK-3-UPDOWN: Interface FastEthernet0/13, changed state to down&lt;br&gt;&#xA;  May  16 11:15:34 PDT: %LINK-3-UPDOWN: Interface FastEthernet0/13, changed state to up&lt;br&gt;&#xA;  May  16 11:15:35 PDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/13, changed state to up&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  TROUBLESHOOTING STEPS PERFORMED:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I replaced the old Cat5 cabling between the server heartbeat NIC and the switch with new Cat6 -- no effect.&lt;/li&gt;&#xA;&lt;li&gt;I created a new VLAN 200 in a new subnet (10.40.61.0/24) and had the DBAs re-IP their heartbeat NICs on one cluster -- no effect.&lt;/li&gt;&#xA;&lt;li&gt;We tried every combination of speed and duplex on the switch port and the NIC -- no effect, went back to 100Mb/full-duplex on both.&lt;/li&gt;&#xA;&lt;li&gt;The DBAs upgraded the Broadcom drivers on both clusters to the latest -- drop in error percentage on the 6% cluster down to 4%, the other cluster is still at 3%.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;MY PROPOSED NEXT STEPS:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There are Intel NICs on the servers. Try moving the cluster heartbeat to an Intel NIC. Maybe it's a Broadcom issue?&lt;/li&gt;&#xA;&lt;li&gt;Change out the switch to a gig capable switch.  There is a Catalayst 3560x available, but taking it will delay a project.  Maybe gig on the switch port and NIC will play nicer?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;THOUGHTS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something I can configure on the existing 2950 switch to mitigate the errors?  What additional troubleshooting steps should I take?&lt;/p&gt;&#xA;" OwnerUserId="291" LastActivityDate="2013-05-26T21:10:13.580" Title="Cisco Catalyst cluster heartbeat switch issue - increasing input errors" Tags="|cisco|cisco-catalyst|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="554" PostTypeId="2" ParentId="553" CreationDate="2013-05-17T22:45:03.227" Score="9" Body="&lt;p&gt;CRC errors are often cabling problems. Here are the things I would check next before swapping out hardware:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are the servers connected directly to the switch or do they connect through some sort of infrastructure cabling?  If so, get the infrastructure cables re-certified.&lt;/li&gt;&#xA;&lt;li&gt;If you have a real cable tester (not a simple continuity tester), I would test the cables.&lt;/li&gt;&#xA;&lt;li&gt;If the cables are hand made, I would replace with factory made cables.  Often run into these types of issues with hand made cables.&lt;/li&gt;&#xA;&lt;li&gt;Check to see if there is any source of EM near where the cables run.  Re-path the cables if you can even temporarily to make sure they are kept separate from power or other sources of EM.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Beyond that, I would start at the NICs as you already indicated.  Could be you got some from a bad run.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-17T22:45:03.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="555" PostTypeId="1" AcceptedAnswerId="702" CreationDate="2013-05-17T22:45:12.370" Score="5" ViewCount="1711" Body="&lt;p&gt;PROBLEM: I'm unable to connect via VPN to our production network while connected to my home wireless network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SETUP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet&lt;br&gt;&#xA;  |&lt;br&gt;&#xA;ISP router at home&lt;br&gt;&#xA;  |&lt;br&gt;&#xA;Cisco ASA 5505 firewall&lt;br&gt;&#xA;  |&lt;br&gt;&#xA;Buffalo wireless router/firewall&lt;br&gt;&#xA;  |&lt;br&gt;&#xA;Wirelessly connected devices (iPhone and laptop)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Guest wireless on ASA 5505.&lt;/li&gt;&#xA;&lt;li&gt;Guest wireless network on ASA 5505 is 172.16.1.0/24.&lt;/li&gt;&#xA;&lt;li&gt;LAN network on ASA 5505 is 172.16.2.0/24.&lt;/li&gt;&#xA;&lt;li&gt;Home wireless on Buffalo router.&lt;/li&gt;&#xA;&lt;li&gt;Home wireless network on Buffalo is 172.16.3.0/24.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;SYMPTOMS:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;My PC connected to a switch port on the ASA 5505 can connect via VPN to our production network.&lt;/li&gt;&#xA;&lt;li&gt;Devices connecting to the guest wireless on the ASA 5505 can connect via VPN.&lt;/li&gt;&#xA;&lt;li&gt;Devices connecting to the home wireless on the Buffalo router can't connect via VPN.&lt;/li&gt;&#xA;&lt;li&gt;All devices can connect to various Internet sites, i.e. Yahoo, Google, etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;THOUGHTS?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can you connect to a remote VPN endpoint with several NATs in between?&lt;/li&gt;&#xA;&lt;li&gt;Is this a NAT issue of some kind? How would I validate that?&lt;/li&gt;&#xA;&lt;li&gt;Am I violating a design best practice?&lt;/li&gt;&#xA;&lt;li&gt;What should be my next steps to troubleshoot/resolve this?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;CLARIFICATION:&lt;br&gt;&#xA;- IPSec connectivity works throughout the network.&lt;br&gt;&#xA;- PPTP connectivity works through all but the Buffalo wireless.&lt;/p&gt;&#xA;" OwnerUserId="291" LastEditorUserId="291" LastEditDate="2013-05-21T02:39:37.617" LastActivityDate="2019-06-19T14:00:29.107" Title="Unable to connect via VPN to remote network" Tags="|cisco|cisco-asa|vpn|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="556" PostTypeId="2" ParentId="555" CreationDate="2013-05-17T22:53:04.803" Score="3" Body="&lt;p&gt;If both the Buffalo and the 5505 are doing NAT then yes you are bypassing best practices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you need the further level of security I would look to disable the routing abilities of the Buffalo and use it just as a wireless AP (as that is why I'm guessing you have it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may be as simple as turning off the DHCP server on the Buffalo and plugging the ASA into a LAN port on the Buffalo rather than the WAN port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of why your VPN doesn't work behind the Buffalo I am guessing it is blocking the VPN traffic, make sure that the Buffalo has something like 'VPN passthrough' enabled.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-17T22:53:04.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="557" PostTypeId="2" ParentId="542" CreationDate="2013-05-17T22:58:58.050" Score="4" Body="&lt;p&gt;Yes, The SonicWALL does this by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go through the Setup Wizard and you can select the radio-button for the setup where X1 is WAN and all other ports are set to the LAN Zone.  You can also do two WAN interfaces and the rest to the LAN.  These are the options available in the Setup Wizard, but if you want to change more granuarly you can simply go to each interface and assign it to the appropriate Zone.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set your other three ports to LAN zone and the SonicWALL will switch all ports in that zone.&lt;/p&gt;&#xA;" OwnerUserId="142" LastActivityDate="2013-05-17T22:58:58.050" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="558" PostTypeId="1" AcceptedAnswerId="567" CreationDate="2013-05-17T23:18:52.290" Score="7" ViewCount="1586" Body="&lt;p&gt;For testing and research purposes, I know it is possible to emulate Cisco devices (with dynamips) and Juniper ones (via an &quot;Olive&quot;, a FreeBSD based system running on qemu) in a GNS3 environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to emulate other vendor devices (like Brocade ones) in GNS3 or else ? &lt;/p&gt;&#xA;" OwnerUserId="564" LastActivityDate="2013-05-18T08:10:19.460" Title="Is it possible to emulate device other than Cisco and Juniper in GNS3 or any other environment?" Tags="|lab|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="559" PostTypeId="1" AcceptedAnswerId="562" CreationDate="2013-05-17T23:21:33.390" Score="7" ViewCount="5583" Body="&lt;p&gt;I'm not considering Etherchannel or LACP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given 2 Ethernet switches A and B, where both switches have port 0 configured as a tagged trunk for VLAN 100 and 101 and port 1 configured as a tagged trunk for VLAN 200 and 201. Can I connect port 0 on switch A to port 0 on switch B and port 1 on switch A to port 1 on switch B without having spanning tree shut down one of the ports or otherwise cause other problems ?&lt;/p&gt;&#xA;" OwnerUserId="228" LastEditorUserId="33" LastEditDate="2013-05-18T00:13:56.490" LastActivityDate="2013-05-18T00:19:55.177" Title="Are multiple links with different VLANs between two switches possible?" Tags="|switch|ethernet|vlan|spanning-tree|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="560" PostTypeId="2" ParentId="559" CreationDate="2013-05-17T23:25:36.537" Score="2" Body="&lt;p&gt;Depends on which version of spanning tree you are using, you should be able to have this work with either MST or PVST+ (Cisco proprietary).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With CST or RST, you will run into issues.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-17T23:25:36.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="561" PostTypeId="2" ParentId="558" CreationDate="2013-05-17T23:25:51.270" Score="3" Body="&lt;p&gt;It's like the site says:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Dynamips, the well known Cisco IOS emulator. &lt;/li&gt;&#xA;&lt;li&gt;VirtualBox, runs desktop and server operating systems as well as Juniper JunOS. &lt;/li&gt;&#xA;&lt;li&gt;Qemu, a generic open source machine emulator, it runs Cisco ASA, PIX and IPS.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.gns3.net/&quot; rel=&quot;nofollow&quot;&gt;http://www.gns3.net/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can use these to setup a lab-network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can emulate the following hardware :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.gns3.net/hardware-emulated&quot; rel=&quot;nofollow&quot;&gt;http://www.gns3.net/hardware-emulated&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="623" LastEditDate="2013-05-18T08:10:19.460" LastActivityDate="2013-05-18T08:10:19.460" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="562" PostTypeId="2" ParentId="559" CreationDate="2013-05-17T23:39:24.823" Score="20" Body="&lt;p&gt;It depends. With IEEE 802.1Q specified STP, where you have one instance per trunk, STP will block ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With Cisco's PVST+ (Per-VLAN STP), every VLAN has a corresponding instance of STP. This means that if there are no loops within the VLANs, STP will not block ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MST, defined in IEEE 802.1s, works a bit differently. Instead of providing a one-to-one VLAN-STP mapping, VLANs can be grouped together into a few instances of STP. This way, if you do STP odd-even load balancing (odd VLANs over link A, even over link B) you only need two instances of STP, instead of one instance for every single VLAN. If you use MST correctly, your proposed configuration should work without any blocked links, just like PVST+, but with VLANs grouped into instances instead of working with each VLAN independently.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-17T23:39:24.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="563" PostTypeId="2" ParentId="559" CreationDate="2013-05-17T23:55:29.673" Score="-1" Body="&lt;p&gt;Note: you'll also have to ensure any native, untagged vlan on each port is different or a loop will be created.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-17T23:55:29.673" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="564" PostTypeId="2" ParentId="559" CreationDate="2013-05-18T00:19:55.177" Score="3" Body="&lt;p&gt;As others have mentioned, a per-vlan protocol will accomplish your goal. Also, you could trunk all four vlans across both links and use per-vlan costing to achieve load sharing with fault tolerance.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-18T00:19:55.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="565" PostTypeId="1" CreationDate="2013-05-18T01:53:14.660" Score="7" ViewCount="993" Body="&lt;p&gt;Has anyone upgraded their cisco routers from 12.2 to 15.1?  I'm curious to know what kind of changes were made to netflow.  Most specifically, I'd like to know how (if at all) the CPU utilization changed.  The router in question is a 6506-E with a Sup720-3BXL&lt;/p&gt;&#xA;" OwnerUserId="393" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:49.850" LastActivityDate="2013-05-27T18:45:49.850" Title="Netflow differences between IOS 12.2 and 15.1" Tags="|cisco-catalyst|cisco-ios-12|cisco-ios-15|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="566" PostTypeId="2" ParentId="504" CreationDate="2013-05-18T02:29:36.277" Score="4" Body="&lt;p&gt;On the Cisco 6500/7600 Platform, you have two additional mirroring options that can be used along with, or to replace SPAN. The advantage of these two alternate methods is that the mirroring is performed in hardware (ASIC) so it does not impact the CPU like SPAN does.  The downside to these mirroring techniques is they can only mirror inbound on the interfaces. With the smart planning of multiple source interfaces, or an entire VLAN, you can still get bidirectional traffic if necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For L2 interfaces (switchports or VLANs where routing is not occuring on the switch) use &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808122ac.shtml&quot; rel=&quot;nofollow&quot;&gt;VACL Capture&lt;/a&gt; Note that this does require a rule in the Vlan map to allow all traffic, be careful to not block traffic other than the traffic you are mirroring!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For L3 interfaces (L3 ports, SVIs, subints) use &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk389/tk814/technologies_configuration_example09186a00808122ac.shtml&quot; rel=&quot;nofollow&quot;&gt;MLS IP IDS&lt;/a&gt;. This does not require the CBAC or firewall modules, it works on a base 6500.&lt;/p&gt;&#xA;" OwnerUserId="87" LastEditorUserId="87" LastEditDate="2013-05-20T15:33:40.813" LastActivityDate="2013-05-20T15:33:40.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="567" PostTypeId="2" ParentId="558" CreationDate="2013-05-18T07:06:11.600" Score="3" Body="&lt;p&gt;What I recommend is to setup a virtualized environment. Either through Vmware workstation or preferably ESXi with vSphere if you have a server to spare. That gives you a very flexible solution.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Add a VM for Dynamips&#xA;Add Olives if you like&#xA;Add ASA either via Dynamips or separately&#xA;Add the Cisco CSR1000v VM&#xA;Add a VM for Arista&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That makes it easy to run inter vendor labs and you can connect them through the VM network which makes it simple to setup. I have a lab like this now and it's hosted by a friend so a VPN in to a box he setup (virtual) which is my GW. Then I can configure vSphere and anything I like and run it on the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a powerful laptop which 8GB RAM or more you can run a lot of stuff directly on your laptop. Most of these things are RAM heavy but not that heavy for the CPU.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-18T07:06:11.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="569" PostTypeId="2" ParentId="114" CreationDate="2013-05-18T08:49:22.643" Score="3" Body="&lt;p&gt;So as to not repeat the answers here and to present an alternative view toward a best practice, the question should be &quot;How do I &lt;em&gt;predetermine&lt;/em&gt; the root bridge so there's a &lt;strong&gt;deterministic&lt;/strong&gt; view of the network ahead of troubleshooting?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Set your aggregation or distribution switches as root by splitting your vlans between a primary and secondary switch.&lt;/strong&gt;  Usually odd number vlans get set on one switch as root and even numbered vlans as secondary, then the opposite on the other switch.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sw1:&#xA;spanning-tree vlan 1,3,5,7 root primary&#xA;spanning-tree vlan 2,4,6,8 root secondary&#xA;&#xA;Sw2:&#xA;spanning-tree vlan 1,3,5,7 root secondary&#xA;spanning-tree vlan 2,4,6,8 root primary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-18T08:49:22.643" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="570" PostTypeId="2" ParentId="76" CreationDate="2013-05-18T09:21:44.260" Score="3" Body="&lt;p&gt;Start simple, then add complexity only when needed.  I would question if there's even a need to run OSPF on your Internet edge routers.  Boot PBR to the curb and only use on your interior network.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Take full Internet routes if your router's have the memory, but do filtering!  Toss anything gt a /24.&lt;/li&gt;&#xA;&lt;li&gt;Take a default route from A and B.&lt;/li&gt;&#xA;&lt;li&gt;Must run iBGP to let your routers make the bestpath decisions considering all prefixes received from A and B.&lt;/li&gt;&#xA;&lt;li&gt;If you plan to use both A and B's /24s with both providers, then you can better influence inbound traffic by prepend A's /24 on B's network and vice versa.  Both /24s must be advertised!  Check with your ISP for their communities in setting the prepends for you.&lt;/li&gt;&#xA;&lt;li&gt;Use two different HSRP groups for your outbound traffic from your firewall; you could set up ECLB to load-share to your two routers.  &lt;a href=&quot;http://generalnetworkerror.com/blog/cisco-asapix-equal-cost-load-balancing-eclb-routing.html&quot; rel=&quot;nofollow&quot;&gt;Equal Cost Load Balancing&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All of this can be simplified if you're just using a single /24 advertised to both A and B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later, look into more complexity for better traffic engineering and protection:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Become familiar with A and B's communities as you may prefer to use peer route-maps to set localpref to determine which routes use A vs. B.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set a floating static default route on both routers as an emergency backup to everything else in case your BGP blows up. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 a.b.c.d 254&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Look into more complex ways of advertising to control your inbound policy such as half your IP space going through A and the other half through B.  For a given /24, you could advertise the /24 to both A and B, but split that into two /25's and advertise the lower /25 to A and the upper /25 to B.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use soft-reconfiguration so you can tweak your policies and do a soft reset on the BGP session so you don't cause dampening of your prefixes on the other side if you completely reset (or clear) the session.  Changes in policy require a reset.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-18T09:21:44.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="571" PostTypeId="1" AcceptedAnswerId="572" CreationDate="2013-05-18T10:41:14.403" Score="13" ViewCount="2767" Body="&lt;p&gt;In v4, most of the operators filter BGP updates for prefixes longer than a /24, to preserve the size of the full view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about IPv6 ? Is there such &quot;convention&quot; that stands out ?&lt;/p&gt;&#xA;" OwnerUserId="564" LastActivityDate="2013-05-20T01:06:39.973" Title="What is the maximum prefix size routed in the IPv6 Internet?" Tags="|ipv6|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="572" PostTypeId="2" ParentId="571" CreationDate="2013-05-18T10:55:37.557" Score="19" Body="&lt;p&gt;These days it's usually at /48, and it's very unlikely to ever be longer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are still AS' filtering longer than /32 though, but they should all have a default at this point (Verizon were a hold-out, but I believe they've given up).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also AS' filtering on allocation lengths, so if you got a /32 they might require you advertise it as such (based on the various RIR's documented allocation policies).&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-18T10:55:37.557" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="573" PostTypeId="2" ParentId="510" CreationDate="2013-05-18T11:03:55.310" Score="4" Body="&lt;p&gt;Assuming you really aren't running v4 at all, not even a loopback then the method I'd suggest would be to simply allocate a sequential number per router and use that, no need to segment it at all, and you might have an existing inventory number that might work (although consider how that might work in the context of an RMA).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most notably this makes IS-IS much nicer to use than hand-padding an IPv4 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you (for some odd reason) had a network where only some devices were IPv6 only you might want to offset the manual numbers so they won't be confused with real IPv4 addresses. Using 240/8 is one idea (I'd suggest against 255/8 or even 254/8 to help avoid a tired ops brain paged at 3am from wondering why a router id is set to a broadcast address).&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-18T11:03:55.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="574" PostTypeId="2" ParentId="119" CreationDate="2013-05-18T11:12:46.770" Score="21" Body="&lt;p&gt;A little precision to earlier responses, based on the RIPE IPv6 training session I had a year ago. Basically their recommendation is to focus on &lt;strong&gt;aggregation&lt;/strong&gt; rather than &lt;strong&gt;address space preservation&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is : don't worry to reserve a large amount of IPs for a Point of Presence even if you only have small amount of subnets here (for now). But you should aggregate every subnet &quot;living&quot; in a POP under the same bigger prefix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Their main concern, now that we have a very large amount of IP at our disposal, is that if everyone announces small prefixes with a fine granularity, the size of the DFZ routing table might explode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the &lt;a href=&quot;http://www.ripe.net/lir-services/training/material/ripe-ncc-training-material/#IPV6&quot;&gt;training material&lt;/a&gt; used in the presentation. Especially the first &quot;Training exercise&quot; PDF gives some example of an addressing plan.&lt;/p&gt;&#xA;" OwnerUserId="564" LastActivityDate="2013-05-18T11:12:46.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="575" PostTypeId="2" ParentId="119" CreationDate="2013-05-18T11:37:29.543" Score="13" Body="&lt;p&gt;SURFnet wrote a nice &lt;a href=&quot;https://www.ipv6forum.com/dl/presentations/IPv6-addressing-plan-howto.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPv6 network plan manual&lt;/a&gt; that might be useful&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2021-10-26T20:37:21.987" LastActivityDate="2021-10-26T20:37:21.987" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="576" PostTypeId="1" AcceptedAnswerId="580" CreationDate="2013-05-18T15:14:36.067" Score="10" ViewCount="1390" Body="&lt;p&gt;While working on a set of switches I noticed that the spanning tree path costs aren't set up to match on opposite sides of the same physical link. For some reason that doesn't look right to me. Shouldn't the same link be set with the same path cost? Why or why not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More specifically we have a loop configured as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco 1/1/1 -&amp;gt; HP 7 A4 &#xA;Cisco 2/1/1 -&amp;gt; HP 8 B1 &#xA;HP 7 A2 -&amp;gt; HP 8 A1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HP 8 is set up with A1 path-cost 2000000 HP 7 is set up with A2 path-cost 20000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco is set up with spanning-tree mst priority 0.&lt;/p&gt;&#xA;" OwnerUserId="657" LastActivityDate="2013-05-19T23:14:41.407" Title="Should spanning tree path costs match on a physical link?" Tags="|spanning-tree|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="577" PostTypeId="1" AcceptedAnswerId="593" CreationDate="2013-05-18T15:26:50.737" Score="7" ViewCount="742" Body="&lt;p&gt;I don't have access to devices to run TRILL for testing and learning purposes, so is there a way to set-up a virtualized lab to try it ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the virtualisation system, the vendor, the software, the version...&lt;/p&gt;&#xA;" OwnerUserId="564" LastActivityDate="2013-05-22T14:37:28.957" Title="Is there a way to test TRILL in a virtual lab?" Tags="|lab|trill|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="578" PostTypeId="1" AcceptedAnswerId="582" CreationDate="2013-05-18T17:12:24.920" Score="10" ViewCount="2282" Body="&lt;p&gt;I have a problem on my Cisco 6509, each entry in my BGP table occupies two entries in the TCAM.&#xA;If I show capacity forwarding, I see MPLS entries in L3 forwarding resources.&#xA;But, I do not use MPLS on my chassis !&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show run | i mpls&#xA;mls cef maximum-routes mpls 508&#xA;no mpls ldp advertise-labels&#xA;no mpls ip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And my L3 Forwading :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L3 Forwarding Resources&#xA;             FIB TCAM usage:                     Total        Used       %Used&#xA;                  72 bits (IPv4, MPLS, EoM)     1032192      899612         87%&#xA;                 144 bits (IP mcast, IPv6)        8192           7          1%&#xA;&#xA;                     detail:      Protocol                    Used       %Used&#xA;                                  IPv4                      450051         44%&#xA;                                  MPLS                      449560         44%&#xA;                                  EoM                            1          1%&#xA;&#xA;                                  IPv6                           1          1%&#xA;                                  IPv4 mcast                     3          1%&#xA;                                  IPv6 mcast                     3          1%&#xA;&#xA;            Adjacency usage:                     Total        Used       %Used&#xA;                                               1048576      448758         43%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea? Could it be that the routes are in a VRF?&lt;/p&gt;&#xA;" OwnerUserId="658" LastEditorUserId="564" LastEditDate="2013-05-18T17:28:37.473" LastActivityDate="2013-05-18T21:11:58.480" Title="Why does my Cisco 6509 BGP table use two entries in my TCAM?" Tags="|cisco|bgp|mpls|cisco-ios-12|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="579" PostTypeId="2" ParentId="576" CreationDate="2013-05-18T18:40:59.613" Score="4" Body="&lt;p&gt;Root cost is the sum of all root port costs along the path. It is only necessary to adjust port cost on the switch where one would like to influence the root port selection. Since designated ports are not a component of the root cost, mismatched port costs on the same link makes sense.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-18T18:40:59.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="580" PostTypeId="2" ParentId="576" CreationDate="2013-05-18T18:56:37.480" Score="5" Body="&lt;p&gt;According to the details you explain about your network topology, my understanding is: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cisco switch is root of the spanning-tree.&lt;/li&gt;&#xA;&lt;li&gt;Port A4 in switch HP 7 is root port and therefore it is in forwarding&#xA;state&lt;/li&gt;&#xA;&lt;li&gt;Port B1 in switch HP 8 is root port and therefore it is also in&#xA;forwarding state&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now let´s focus in the other link closing the loop, the one between both HP switches. You can have only a designated port and because the cost to root advertised by both HP switches into the link is the same, switches would have to check the lowest sender bridge ID and lowest sender port ID in order to choose the designated port and the blocking port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, setting a different costs for ports in the link between HP switches will have  no effect in choosing the designated port for this link.&lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-05-19T19:04:57.487" LastActivityDate="2013-05-19T19:04:57.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="581" PostTypeId="2" ParentId="99" CreationDate="2013-05-18T19:02:15.380" Score="8" Body="&lt;p&gt;When running data cabling between different electrical bonding zones (eg buildings with different electrical earths). If this is done with copper cable, different ground potentials might try to equalise over the cable. Fun to watch, not so funny for the owner of the equipment. Better done with fibre.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-05-18T19:02:15.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="582" PostTypeId="2" ParentId="578" CreationDate="2013-05-18T19:04:03.073" Score="10" Body="&lt;p&gt;It seems that the 6500 generates MPLS labels for every route if BGP is run in VRF. The fact that your IPv4 and MPLS TCAM usage is almost identical seems to indicate this as well. Can you try this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show bgp vpnv4 uni all labels&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There seems to be a hidden command that makes IOS allocate labels per VRF instead of per prefix.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mpls label mode all-vrfs protocol bgp-vpnv4 per-vrf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a hidden command so IOS won't show it.&#xA;Also before running that can you try to run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip vrf detail&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-18T19:04:03.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="583" PostTypeId="1" AcceptedAnswerId="595" CreationDate="2013-05-18T19:18:58.473" Score="13" ViewCount="6461" Body="&lt;p&gt;I predominantly work in a Cisco environment and contemplating buying a network tap device for use with Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone provide the pros and cons from their experience between using network taps OR setting up port mirroring given considerations like ease of use, cost of kit and are there limitations between the 2 approaches respectively?&lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2013-05-20T04:15:42.523" Title="Hardware tap vs port mirroring - Any limitations?" Tags="|monitoring|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="584" PostTypeId="2" ParentId="583" CreationDate="2013-05-18T19:59:40.003" Score="7" Body="&lt;p&gt;In my experience physical network taps give you much more flexibility.  Many Cisco platforms have restrictions on the number of SPAN ports/monitoring sessions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By using physical network taps you're able to directly monitor several different ports without using CPU overhead on the Cisco device itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also worth considering is the cost for physical taps. Physical taps incur an additional capital expense, while there is no additional outlay to use the built-in span functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently I had to spec out the install of some call-recording software for our Cisco VoIP implementation.  In several locations, it made sense to use physical taps to span the voice traffic to the recording server as the number of sessions needed would have exceeded the switch's capability.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-05-18T20:11:11.920" LastActivityDate="2013-05-18T20:11:11.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="585" PostTypeId="2" ParentId="549" CreationDate="2013-05-18T20:05:02.710" Score="0" Body="&lt;p&gt;If it's difficult to get an accurate mapping between location and IP address, wouldn't an alternative solution perhaps be to rely on client location information from GPS hardware in mobile phones via APIs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, Twitter's API seems to allow for this possibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize that this would probably require quite a bit more time to implement than you seem to have (&quot;The catch is it has to be ready by tomorrow...&quot;), but since there seems to be general agreement here that a geolocation database will be highly error-prone, I thought that an alternative location source might be more accurate (though I realize also absent from many client requests and perhaps even spoof-able).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, just my $0.02.&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-05-18T20:05:02.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="587" PostTypeId="2" ParentId="510" CreationDate="2013-05-18T20:33:45.247" Score="3" Body="&lt;p&gt;My suggestion would be to adapt your AS number by treating it as a 32 bit AS (if it isn't already) - zero the upper 8 bits and &lt;code&gt;OR&lt;/code&gt; with &lt;code&gt;0xE0000000&lt;/code&gt; (makes it look like multicast space). For simplicity of explanation, I'll use hexadecimal (no really, that makes it easier to see the boundaries)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. if your AS number is 717232 (0x000AF1B0) you get initially 0xE00AF1B0 and you can increment the upper-most octet for each BGP speaker in your AS 0xE00AF1B0, 0xE10AF1B0 etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Converting to decimal? easy, split the hex up and break out your favourite prograamer's calculator: E0.A.F1.B0 -&gt; 224.10.241.176, E1.A.F1.B0 -&gt; 225.10.241.176, etcetera.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, there's an infinite number of methods you could devise to handle this situation, the key point is just to be proactive about avoiding duplicates. Within BGP, you &lt;em&gt;must&lt;/em&gt; ensure that neighbours do not have the same router ID, however, you can peer two separate routers with the same ID to a third one, just bear in mind that routerid is used as a tie breaker for bestpath selection.&lt;/p&gt;&#xA;" OwnerUserId="378" LastEditorUserId="378" LastEditDate="2013-05-18T21:25:28.870" LastActivityDate="2013-05-18T21:25:28.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="588" PostTypeId="2" ParentId="578" CreationDate="2013-05-18T20:42:46.443" Score="7" Body="&lt;p&gt;Oh the 6500. I run a small service provider network and run the 6500 as a PE router. Worst decision of my life. (That was an embellished statement, but you get my point.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I run full BGP routes in a VRF and have experienced a lot of problem surrounding this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're example is not very surprising. As Daniel said in his post there is an LFIB entry for each VRF prefix as well as a VPNv4 entry. This can be changed by adding the command &lt;code&gt;mpls label mode vrf Internet protocol all-afs per-vrf&lt;/code&gt; as was stated; however, this does not get you out of the woods. If you change to per VRF prefixes it does remove the LFIB entry (yay!) but adds an entry for every single prefix into the Adjacency table (wait, what?!). Since the 6500 forwarding hardware is shared between L2 and L3 forwarding this doesn't change your hardware memory usage at all. If anything it makes the problem harder to find.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at your usage once you've changed to per VRF usage (using &lt;code&gt;show platform hardware cef resource-level&lt;/code&gt;) it looks as though you've fixed the issue. However if you use the command &lt;code&gt;show platform hardware cef adjacencies resource-level&lt;/code&gt; it reveals the problem has just moved to a different location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are the outputs from one of my 6500's resource-level and adjacency usage. Outlining what I'm talking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resource-Level&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Global watermarks: apply to Fib shared area only.&#xA;Protocol watermarks: apply to protocols with non-default max-routes&#xA;&#xA;Fib-size: 1024k (1048576), shared-size: 1016k (1040384), shared-usage: 458k(469769)&#xA;&#xA;Global watermarks:&#xA;            Red_WM: 95%,   Greem_WM: 80%,   Current usage: 45%&#xA;&#xA;Protocol watermarks:&#xA;&#xA; Protocol           Red_WM(%)      Green_WM(%)     Current(%)&#xA; --------           ---------      ----------      ----------&#xA; IPV4                --             --              42% (of shared)&#xA; IPV4-MCAST          --             --              0 % (of shared)&#xA; IPV6                --             --              2 % (of shared)&#xA; IPV6-MCAST          --             --              0 % (of shared)&#xA; MPLS                --             --              0 % (of shared)&#xA; EoMPLS              --             --              0 % (of shared)&#xA; VPLS-IPV4-MCAST     --             --              0 % (of shared)&#xA; VPLS-IPV6-MCAST     --             --              0 % (of shared)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Adjacency Usage&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Watermarks apply to regions available for allocation and not pre-reserved&#xA;Stats region size for alloc:        444160&#xA;Non-stats region size for alloc:    376832&#xA;&#xA;Adjacency Mgr watermarks:&#xA;&#xA; Type             Red_WM(%)      Green_WM(%)     Current usage(%)&#xA; ----             ---------      ----------      ----------------&#xA; Stats_WM         95%            80%             97%&#xA; Non-Stats_WM     95%            80%             14%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ioshints.info/2013/02/internet-in-vrf-and-lfib-explosion.html&quot;&gt;Ivan's post&lt;/a&gt; on this was base on my findings here. I am currently working with Cisco to attempt to fix this issue, but unfortunately right now there is no way to fix this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your milage may vary since you've got no MPLS adjacencies. Would be interested to see your adjacency usage now that you've made the change.&lt;/p&gt;&#xA;" OwnerUserId="287" LastEditorUserId="287" LastEditDate="2013-05-18T21:11:58.480" LastActivityDate="2013-05-18T21:11:58.480" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="589" PostTypeId="2" ParentId="577" CreationDate="2013-05-18T21:23:37.153" Score="-2" Body="&lt;p&gt;Although I'm uncertain, I suspect you could at least begin such an endeavor using &lt;a href=&quot;http://en.wikipedia.org/wiki/Dynamips&quot; rel=&quot;nofollow&quot;&gt;Dynamips&lt;/a&gt; as a central component.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Dynamips is an emulator program that was written to emulate Cisco&#xA;  routers. Dynamips runs on Linux, Mac OS X or Windows and can emulate&#xA;  the hardware of the Cisco series routing platforms by directly booting&#xA;  an actual Cisco IOS software image into the emulator.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Dynamips is a Cisco router emulator written by Christophe Fillot. It&#xA;  emulates 1700, 2600, 3600, 3700, and 7200 hardware platforms, and runs&#xA;  standard IOS images. In Chris’ own words:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This kind of emulator would be useful to:&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Be used as a training platform, with software used in real world. It would allow people to become more familiar with Cisco devices, Cisco being the world leader in networking technologies.&lt;/li&gt;&#xA;  &lt;li&gt;Test and experiment features of Cisco IOS.&lt;/li&gt;&#xA;  &lt;li&gt;Check quickly configurations to be deployed later on real routers...&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-05-18T21:23:37.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="590" PostTypeId="2" ParentId="565" CreationDate="2013-05-18T21:32:53.107" Score="0" Body="&lt;p&gt;I'm not sure, but does &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-15602&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; give you any useful insights? Though doubtless a professional Network Engineer would have no need to guess, I'm guessing that your references to 12.2 and 15.1 are Cisco IOS version numbers which I don't see mentioned in the reference, but I thought I'd offer it just in case it was useful anyway?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...One reason you may see high CPU on the DFC is due to Netflow Data&#xA;  Export.   Typically CPU from NDE is expected, but in rare instances it&#xA;  can become high enough to disrupt other processes...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-05-18T21:32:53.107" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="592" PostTypeId="2" ParentId="29" CreationDate="2013-05-18T22:03:14.273" Score="1" Body="&lt;p&gt;This is just a guess, but wouldn't a non-proprietary solution (perhaps the mobile version of something like &lt;a href=&quot;http://en.wikipedia.org/wiki/OpenVPN#Platforms&quot; rel=&quot;nofollow&quot;&gt;OpenVPN&lt;/a&gt;) be a possible solution?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;While some mobile phone OSes (Palm OS, etc.) do not support OpenVPN,&#xA;  it is available for Maemo,[11] Windows Mobile 6.5 and below,[12] iOS&#xA;  3GS+ devices,[13] jailbroken iOS 3.1.2+ devices,[14] Android 4.0+&#xA;  devices, and Android devices that have had the Cyanogenmod aftermarket&#xA;  firmware flashed[15] or have the correct kernel module installed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Perhaps some training would be required for your clients, but as an amateur, it seems to me like it might technically be a feasible solution.&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-05-18T22:03:14.273" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="593" PostTypeId="2" ParentId="577" CreationDate="2013-05-18T22:08:51.177" Score="6" Body="&lt;p&gt;There are few devices that support standards based TRILL in the real world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traditional Cisco IOS is probably the most /supported/ network OS for running in a hypervisor; however, in Cisco land the NXOS platform is the only platform that supports Fabric Path (Cisco's TRILL), and that won't work in Dynamips or IOU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore TRILL is a L2 technology. Switches are hard to virtualize because of the special forwarding hardware (TCAM) used in them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short I'm afraid you're out of luck on using virtual switches to test TRILL.&lt;/p&gt;&#xA;" OwnerUserId="287" LastEditorUserId="220" LastEditDate="2013-05-22T14:23:30.653" LastActivityDate="2013-05-22T14:23:30.653" CommentCount="0" CommunityOwnedDate="2013-05-18T22:08:51.177" ContentLicense="CC BY-SA 3.0" />
  <row Id="594" PostTypeId="2" ParentId="72" CreationDate="2013-05-18T22:23:26.703" Score="0" Body="&lt;p&gt;I think this is a great discussion, and although I read @Jody's comment, I haven't seen an answer proposing Google Docs as a collaborative documentation solution. Although I've seen reports of unavailability of that particular Google service from time to time, I know many large institutions use it because of its familiarity to its employees and its convenience. For example, Harvard University uses Google Docs for many of its internal documentation that requires collaboration.&lt;/p&gt;&#xA;" OwnerUserId="270" LastActivityDate="2013-05-18T22:23:26.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="595" PostTypeId="2" ParentId="583" CreationDate="2013-05-18T23:29:30.103" Score="19" Body="&lt;p&gt;(having worked with this for a decade now)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hands down, the biggest functional difference between a tap and a span... a passive tap will never, &lt;em&gt;ever&lt;/em&gt; drop a frame, under any circumstances -- it electrically duplicates the frame, errors and all.  Active taps (regenerative, or aggregate) &lt;em&gt;can&lt;/em&gt; drop frames, eg. if the bidirectional traffic exceeds the link speed of the monitor port. (a 1G link cannot carry TX+RX 1G (2G) of traffic)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch SPAN ports &lt;em&gt;will&lt;/em&gt; drop traffic.  The SPAN is the lowest priority to the switch -- it will sacrifice the SPAN traffic in favor of maintaining live traffic. A slightly loaded switch may never show this, but I've had dozens of customer calls from all over the world complaining that &lt;em&gt;we&lt;/em&gt; dropped traffic, when it was in fact their switch SPAN that didn't send it to us.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, SPANs are cheap and plentiful. Almost every managed switch supports setting up a monitor session.  And they are usually trivial to setup and/or reconfigure.  Taps, on the other hand, are exceedingly expensive and rare.  Taps require unplugging network cables, which has a lot of resistance from just about everyone. And they cause a hit when they lose power. (momentary, not &quot;unplugged == broken link&quot;.  even dirt simple ones will maintain link when off.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-18T23:29:30.103" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="596" PostTypeId="1" AcceptedAnswerId="597" CreationDate="2013-05-19T00:21:55.607" Score="25" ViewCount="331653" Body="&lt;p&gt;On a Cisco Catalyst switch, I need to find what port an end device is connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the IP address/host name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I quickly find the port?&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2019-03-25T17:37:57.160" Title="How to find the port a device is connected to, based on IP, on a Cisco Catalyst switch" Tags="|cisco|cisco-catalyst|cisco-ios-12|cisco-3750|troubleshooting|" AnswerCount="10" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="597" PostTypeId="2" ParentId="596" CreationDate="2013-05-19T00:21:55.607" Score="36" Body="&lt;p&gt;The answer depends on whether the switch is a &lt;a href=&quot;http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_1-2/switch_evolution.html&quot;&gt;Layer 2 or a Layer 3&lt;/a&gt; switch.  That is to say, is the switch only switching and relaying traffic on to a different device for routing, or, is it doing the routing decisions itself via SVIs (switched virtual interfaces).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a layer 3 switch, the port can be found by using a few simple commands on the device.  However on a layer 2 switch, you have to log into both the switch and whatever device is doing the routing to locate the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In either case, the commands are the same, just run on two different boxes for the layer 2 switch.  &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;On a Layer 3 switch:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Log into the switch and issue the following command (where &lt;em&gt;ipaddress&lt;/em&gt; is the ip address of the host you are trying to locate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip arp *ipaddress*&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The output should look similar to below, and give you the mac-address of the device (I've highlighted the mac-address below in bold).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LYKINS-1861#show ip arp 172.20.1.100&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  172.20.1.100            0   **28cf.da1d.1b05**  ARPA   Vlan10&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now issue one of the following commands (where &lt;em&gt;mac-address&lt;/em&gt; is the hardware address from previous step).  Depending on the Cisco platform, sometimes the command is listed in either form.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show mac address-table address *mac-address*&#xA;show mac-address-table address *mac-address*&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The output should look similar to  below, the port you are looking for should be listed as the Destination Port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LYKINS-1861#show mac-address-table address 28cf.da1d.1b05&#xA;Destination Address  Address Type  VLAN  Destination Port&#xA;-------------------  ------------  ----  --------------------&#xA;28cf.da1d.1b05          Dynamic      10     **FastEthernet0/1/1**&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;On a Layer 2 switch:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Find out what device is doing the routing for this switch (you may have to look at the network documentation). Sometimes it is a &quot;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk389/tk815/technologies_configuration_example09186a00800949fd.shtml&quot;&gt;Router on a Stick&lt;/a&gt;&quot;, where the Layer 2 VLANs are being trunked up to the router for the Layer 3 decisions.&lt;/li&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Log into the routing device, and issue the following command (where &lt;em&gt;ipaddress&lt;/em&gt; is the ip address of the host you are trying to locate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip arp *ipaddress*&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The output should look similar to below, and give you the mac-address of the device (listed below in bold).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LYKINS-1861#show ip arp 172.20.1.100&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  172.20.1.100            0   **28cf.da1d.1b05**  ARPA   Vlan10&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now log into the Layer 2 switch&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On that device issue one of the following commands (where &lt;em&gt;mac-address&lt;/em&gt; is the hardware address from previous step).  Depending on the Cisco platform, sometimes the command is listed in either form.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show mac address-table address *mac-address*&#xA;show mac-address-table address *mac-address*&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The output should look similar to  below, the port you are looking for should be listed as the Destination Port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LYKINS-1861#show mac-address-table address 28cf.da1d.1b05&#xA;Destination Address  Address Type  VLAN  Destination Port&#xA;-------------------  ------------  ----  --------------------&#xA;28cf.da1d.1b05          Dynamic      10     **FastEthernet0/1/1**&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="44" LastEditorUserId="3191" LastEditDate="2014-07-09T07:48:28.597" LastActivityDate="2014-07-09T07:48:28.597" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="598" PostTypeId="2" ParentId="596" CreationDate="2013-05-19T00:39:18.413" Score="13" Body="&lt;p&gt;Firstly, you need to get the MAC address, so get into a machine on the same VLAN and look at its neighbour table - Windows is &lt;code&gt;netsh int ipv4 show neigh&lt;/code&gt;, Linux: &lt;code&gt;ip nei&lt;/code&gt; Cisco: &lt;code&gt;show ip arp x.x.x.x&lt;/code&gt;. Once you have that...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is a discovery job on a layer 2 switch, do &lt;code&gt;show mac address-table | i 0011.2233.4455&lt;/code&gt; - replacing the mac address bytes as appropriate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If on the other hand it's a router, use &lt;code&gt;show ip arp | i 0011.2233.4455&lt;/code&gt; - again replacing the MAC as appropriate. Obviously when you were getting the MAC, if it turned out to be directly connected to that router, you're already done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long-term however, I heartily recommend that you setup LLDP (failing that, CDP) to your hosts so that you can identify them from either side. &lt;a href=&quot;http://vincentbernat.github.io/lldpd/&quot;&gt;&lt;strong&gt;lldpd&lt;/strong&gt;&lt;/a&gt; is an absolutely excellent LLDP daemon for Linux that also supports CDP, EDP, SONMP and FDP. If you're currently able to reach the host and it does happen to run linux/BSD, I'd recommend skipping the above and just turn on LLDP.&lt;/p&gt;&#xA;" OwnerUserId="378" LastEditorUserId="378" LastEditDate="2013-05-19T00:45:46.050" LastActivityDate="2013-05-19T00:45:46.050" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="599" PostTypeId="5" CreationDate="2013-05-19T02:57:27.160" Score="0" Body="&lt;p&gt;The Cisco Catalyst 3750 is a line 1-RU switches by Cisco Systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has stacking capability, and is commonly used in wiring closets and top-of-rack deployments.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-05-20T13:42:58.397" LastActivityDate="2013-05-20T13:42:58.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="600" PostTypeId="4" CreationDate="2013-05-19T02:57:27.160" Score="0" Body="The Cisco Catalyst 3750 is a line of 1-RU switches by Cisco Systems." OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-05-20T13:43:30.103" LastActivityDate="2013-05-20T13:43:30.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="601" PostTypeId="1" AcceptedAnswerId="778" CreationDate="2013-05-19T03:04:32.290" Score="10" ViewCount="3671" Body="&lt;p&gt;On &lt;strong&gt;Cisco 5508&lt;/strong&gt; v7.2.103.0, I have a couple of WLANs configured.  Call them ABC and XYZ for the sake of this question.  ABC uses 802.1X and gets a splash page redirect URL pushed down.&#xA;XYZ uses PSK and uses the WebAuth external config to push a login page redirect URL.&#xA;Both the splash and login pages are served under the same base (external web server) URL such as &lt;a href=&quot;http://webauth.example.com/splash.html&quot; rel=&quot;nofollow&quot;&gt;http://webauth.example.com/splash.html&lt;/a&gt; and /login.html.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WLAN ABC - Splash-Page-Web-Redirect[WPA + WPA2][Auth(802.1X + CCKM)]&#xA;WLAN XYZ - Web-Passthrough[WPA2][Auth(PSK)]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I see what appears to be inconsistent behavior on when the redirect&#xA;  URLs show on devices, the webauth/NAC RUN state, and the ability to&#xA;  actually get Internet access (or not get it when I should).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I understand the login page requires acceptance (no username required) before allowing traffic to pass and the WLC merely has to think the splash page was seen by the device (acceptance not necessary) for traffic to flow here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen &lt;em&gt;virtually all conditions possible&lt;/em&gt;, but the cases where traffic flows don't always make sense.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Splash or Login page redirect occurs when browsing to a non-secure, plain-text URL; webauth shows Authenticated with NAC state RUN, traffic flows.  This is what's expected to happen, but doesn't happen often.&lt;/li&gt;&#xA;&lt;li&gt;Splash or Login page redirect does not occur when browsing to a non-secure, plain-text URL; webauth shows Authenticated with NAC state RUN, traffic flows (but shouldn't after removing client from WLC to force webauth redirect which didn't show).&lt;/li&gt;&#xA;&lt;li&gt;Splash or Login page redirect doesn't occur when browsing to a non-secure, plain-text URL; webauth not authenticated with NAC state WEBAUTH, traffic flows (but shouldn't).&lt;/li&gt;&#xA;&lt;li&gt;Splash or Login page redirect occurs when browsing to a non-secure, plain-text URL; webauth shows Unauthenticated with NAC state WEBAUTH, traffic doesn't flow (but should if WEBAUTH was shown as passed).&lt;/li&gt;&#xA;&lt;li&gt;Splash or Login page redirect doesn't occur when browsing to a non-secure, plain-text URL; webauth not authenticated with NAC state WEBAUTH, traffic doesn't flow (as expected).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In all cases, the client detail shows the redirect URL was set.&lt;br&gt;&#xA;In the two cases where everything worked as expected with the redirect, webauth/run state, and traffic flow (being either allowed or denied), I don't think the ACLs are the issue.  Nothing else is being pushed down from ACS other than the redirect URL.  The two WLANs are hardcoded to different VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could this be random behavior or are my eyes just playing a trick on me?  I seen slightly different behavior with different devices -- some more random, some less.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the best approach to narrow this problem down?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: DNS is not the issue.  General IP reachability randomly works in browser.  Regardless of the webauth state (RUN vs WEBAUTH-REQD), sometimes the browser gets through and sometimes does not.  (Initial requests are always plain-text HTTP.)  I've even seen regular traffic get through for non-web apps such as SMTP, so I'm really thinking Webauth is mucking with this, but I don't see anything obviously wrong.  I have a &lt;em&gt;preauth&lt;/em&gt; ACL that's fairly liberal and a &lt;em&gt;guests&lt;/em&gt; ACL.  I've even added permit any/any to both ACLs that didn't make a difference.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-05T03:29:25.297" LastActivityDate="2013-06-05T03:29:25.297" Title="Cisco WLC External WebAuth Apparent Random Behavior" Tags="|cisco|wireless|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="602" PostTypeId="2" ParentId="596" CreationDate="2013-05-19T03:30:49.127" Score="7" Body="&lt;p&gt;Regardless of whether your switch is performing frame forwarding (layer 2) or packet routing (layer 3), the following should work if the switch has a management IP address in the same subnet as the host you want to find:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;At the switch, ping the IP address you want to find. If the address is on the same subnet as the switch's management address, an ARP request will be sent looking for the MAC address of the host.&lt;/li&gt;&#xA;&lt;li&gt;Now you can look at the ARP cache and find the MAC address of the host you are looking for (&lt;code&gt;show ip arp&lt;/code&gt;) and its corresponding interface.&lt;/li&gt;&#xA;&lt;li&gt;You can also look for its MAC address table entry by issuing: &lt;code&gt;show mac-address table address [the address]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-19T03:30:49.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="603" PostTypeId="2" ParentId="583" CreationDate="2013-05-19T09:42:23.870" Score="11" Body="&lt;p&gt;Even though SPAN can (will) drop frames when TAP would not, Cisco switches (and maybe others) have a cool feature called &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.1_13_ea1/configuration/guide/swspan.html#wp1036704&quot; rel=&quot;noreferrer&quot;&gt;RSPAN&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It allows to set up a remote SPAN, to transport captured frames over the network to the monitoring station:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/899TL.jpg&quot; alt=&quot;cisco_rspan&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="52" LastActivityDate="2013-05-19T09:42:23.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="604" PostTypeId="2" ParentId="204" CreationDate="2013-05-19T09:58:10.480" Score="5" Body="&lt;p&gt;WANem is great, like Jeremy said. Other interesting tools are &lt;a href=&quot;http://www.linuxfoundation.org/collaborate/workgroups/networking/netem&quot; rel=&quot;nofollow noreferrer&quot;&gt;netem&lt;/a&gt; or &lt;a href=&quot;http://info.iet.unipi.it/~luigi/dummynet/&quot; rel=&quot;nofollow noreferrer&quot;&gt;dummynet&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the following examples with netem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# tc qdisc change dev eth0 root netem loss 0.1%&#xA;# tc qdisc change dev eth0 root netem delay 100ms 10ms 25%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can grab more informations on the &lt;a href=&quot;http://www.linuxfoundation.org/collaborate/workgroups/networking/netem&quot; rel=&quot;nofollow noreferrer&quot;&gt;netem page&lt;/a&gt; or on &lt;a href=&quot;https://stackoverflow.com/a/615757/383297&quot;&gt;this excellent SO answer&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="52" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2013-05-19T09:58:10.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="605" PostTypeId="2" ParentId="555" CreationDate="2013-05-19T10:44:20.333" Score="2" Body="&lt;p&gt;This isn't really the answer to your question directly, but may point you in the right direction;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Do you have any PMTUD issues when connected to the Buffalo device, between a Buffalo wireless client and the VPN end point at your production network?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can you verify the end to end MTU and ensure that isn't impacting the tunnel coming up?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do you have VPN pass-through configured (or a similar technology) on your Buffalo AP?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do you have any detailed logs to go on from your VPN client to tell you what is &lt;strong&gt;exactly&lt;/strong&gt; wrong?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can you perform a packet capture on the client when attached to the Buffalo whilst trying to establish the VPN, and then again when it is attached to the ASA wireless to compare the difference?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can you also perform a packet capture on the ASA it's self, when the client is attached wirelessly to the ASA and wirelessly to the Buffalo making VPN connections to again, see the difference?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As already mentioned, double NAT is a bad idea. Turning you Buffalo wireless device in a AP only (bride mode or similar) may or may not be an option for you, but that is what I would recommend, rather than a routed mode.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-19T10:44:20.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="606" PostTypeId="2" ParentId="199" CreationDate="2013-05-19T12:58:50.670" Score="1" Body="&lt;p&gt;Output drops are rather common on smaller switches with small buffers as any burst will deplete the buffer. I'm not really familiar with the 3120 so I can't speak for the size of it's buffer, but at least that's a common reason till why one could get output drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specifics reasons are head of line blocking (HOLB), where multiple source ports are sending to one destination and so we get congestion. Another common reason is when going from a higher port speed to a lower one, ie 10G to 1G or 40G to 10G.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend you run show controllers ethernet-controller X where X is your port. You should get some information regarding output drops, like if something is trying to output to large frames, which could happen if you don't have consistent MTU across your network.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2013-05-19T12:58:50.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="607" PostTypeId="1" AcceptedAnswerId="610" CreationDate="2013-05-19T19:32:22.587" Score="39" ViewCount="33339" Body="&lt;p&gt;I'm studying networking and one of the most basic things I've been told countless times is that computers can't communicate outside of their own subnet.&lt;/p&gt;&#xA;&lt;p&gt;On the other hand, by looking at some ADSL setups, I've seen that in case where a fixed IP address is assigned to the user's WAN interface, a /32 subnet mask is used for the WAN interface and the default gateway is of course outside of the subnet.&lt;/p&gt;&#xA;&lt;p&gt;So how would the host with /32 subnet communicate with outside network?&lt;/p&gt;&#xA;&lt;p&gt;Here's a sort of a diagram of what I have:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hO9fd.png&quot; alt=&quot;Network Diagram&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;The DSL modem is set up to act as a bridge so Router0 does authentication and sets up connection via PPPoE to the ISP. The Router0 gets  an IP address on its WAN interface  (Fa0/0 on the diagram) which is from a /32 subnet using IPCP. It only receives a single IP address on the WAN interface and IP aliasing isn't being used here.&lt;/p&gt;&#xA;&lt;p&gt;I understand what goes on from the Router0 to the LAN. What I don't understand is how does the Router0 communicate with ISP.&lt;/p&gt;&#xA;" OwnerUserId="677" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-07-01T14:09:12.740" Title="How would a router with /32 WAN subnet mask communicate with the rest of the Internet?" Tags="|routing|ipv4|" AnswerCount="8" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="609" PostTypeId="2" ParentId="576" CreationDate="2013-05-19T20:01:39.813" Score="4" Body="&lt;p&gt;It's perfectly acceptable to augment the cost of a link if you want to be 100% sure of the topology that the L2 domain creates.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-19T20:01:39.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="610" PostTypeId="2" ParentId="607" CreationDate="2013-05-19T20:05:33.557" Score="32" Body="&lt;p&gt;DSL tends to use PPPoE, which means the link is point-to-point.  A /32 is perfectly valid here. In fact, no address at all is still valid -- one would need routable addresses beyond the PPP link, 'tho.  In this case, it works because there's only one possible destination on the link.  Every packet put on that link will be processed by the other end, and v.v.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;blue-gw#show int di1&#xA; Dialer1 is up, line protocol is up (spoofing)&#xA; Description: Bellsouth.net DSL&#xA; Internet address is 74.167.x.x/32&#xA;&#xA;Routing:&#xA; Gateway of last resort is 72.157.24.5 to network 0.0.0.0&#xA; ...&#xA;      72.0.0.0/32 is subnetted, 1 subnets&#xA; C       72.157.24.5 is directly connected, Dialer1&#xA;      74.0.0.0/32 is subnetted, 1 subnets&#xA; C       74.167.x.x is directly connected, Dialer1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-05-19T20:21:32.873" LastActivityDate="2013-05-19T20:21:32.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="611" PostTypeId="2" ParentId="607" CreationDate="2013-05-19T20:07:02.127" Score="4" Body="&lt;p&gt;Sounds like your router has a PPPoE WAN connection. With PPPoE, the &quot;normal&quot; IP rules don't apply as the connection between &lt;a href=&quot;https://en.wikipedia.org/wiki/Broadband_Remote_Access_Server&quot; rel=&quot;nofollow&quot;&gt;BRAS&lt;/a&gt; and client is tunneled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, with many tunneling protocols, the local end-point can assume the remote end-point's IP address or have none at all. Any packet not destined for the local network would be pushed into the tunnel, for the remote end to deal with.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorUserId="6336" LastEditDate="2014-07-01T08:20:38.680" LastActivityDate="2014-07-01T08:20:38.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="612" PostTypeId="2" ParentId="607" CreationDate="2013-05-19T20:41:16.107" Score="9" Body="&lt;p&gt;&lt;em&gt;This is just an additional note as the questions has already been answered by Ricky;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ricky has already pointed out, with a PPP Link, there are only two devices on the link. A local device and remote device, so there can only be two addressed on the link also (local and remote). So the local and remote addressed can be in different subnets because there is no where else for traffic placed on the link to go to, apart from the device at the other end of the lihnk. That is a simple enough concept, which you have said you understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further to that though, remember that routing entries can be via interfaces as well as next hop IP address. People are often taught that routing entries are something like &quot;0.0.0.0/0 via 5.5.5.5&quot; where 5.5.5.5 is the ISP router and 0.0.0.0/0 is a default route. Routes can also be &quot;0.0.0.0/0 via Fa1/0&quot;. If Fa0/1 is a point-to-point link, just specifying the interface is fine. As we have said, there is nowhere for the traffic to go, other than the device on the other end (which is the ISP router).&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-19T20:41:16.107" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="613" PostTypeId="1" AcceptedAnswerId="617" CreationDate="2013-05-19T21:10:05.987" Score="15" ViewCount="10636" Body="&lt;p&gt;I have a network consisting of three servers in a data center, all of which are connected to each other via a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to this I need this network to access 4 additional networks, most of which are provided via cross connects to other data centers, as well as the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically the networks are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;LocalNetwork (192.168.0.1)&lt;/li&gt;&#xA;&lt;li&gt;Equinex (10.4.131.1)&lt;/li&gt;&#xA;&lt;li&gt;Atrium (204.10.83.1)&lt;/li&gt;&#xA;&lt;li&gt;Internet (...)&lt;/li&gt;&#xA;&lt;li&gt;HongKong (10.10.101.1)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have hired a network professional to give advice but his solution involved 3 routers which individually cost 1200 dollars a piece and a switch and it's still having issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not a network professional myself, only a developer, but I believe as though this should only require one single switch to connect the three server computers together to form LocalNetwork, and one single router to connect the 5 networks together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is that every router I've seen seems to just be a switch with one WAN port to connect to the Internet. Is there not an example of a basic router that has say 5 or more ports in it that allow me to connect 5 networks together? Can I not just solve this problem with a single switch and a single router?&lt;/p&gt;&#xA;" OwnerUserId="680" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:33.553" LastActivityDate="2020-08-01T00:36:13.507" Title="How to connect 5 different networks together?" Tags="|cisco|switch|router|" AnswerCount="8" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="614" PostTypeId="2" ParentId="613" CreationDate="2013-05-19T21:25:16.320" Score="8" Body="&lt;p&gt;Technically one router and one switch should be sufficient, ideally you should have two switches and two routers (as redundancy). Also it should not be an issue to install several network cards into the router, however 1.200 isn't considered a lot of money for a decent professional router, so it might be that these routers do not support expanding the network sites. What you might consider doing is purchasing one or several layer 3 switches instead (switches which function at layer 2 and 3, so also allowing basic routing)&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-05-19T21:25:16.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="615" PostTypeId="2" ParentId="607" CreationDate="2013-05-19T21:30:58.363" Score="2" Body="&lt;p&gt;In a SP environment then the use of IPCP to dynamically assign the ip address to the dsl router it's /32 IP address is used (lan addresses are often advertised outbound via radius as framed routes).   A static route is used via a dialer interface to send traffic from the lan outbound to the internet - so static routing only is used and a default route is advertised to the CE router via IPCP.  Therefore Only a /32 is needed to communicate with other networks in certain design scenarios. &lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2013-05-19T21:30:58.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="616" PostTypeId="2" ParentId="613" CreationDate="2013-05-19T21:31:56.383" Score="9" Body="&lt;p&gt;If all of these networks are already being brought to a central location via different circuits/cross connects, you could certainly connect them via one router with 5 different ethernet interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specific model of router would greatly depend on the throughput needs.  That is to say, if there is to be a large amount of traffic between these networks, you would require a higher end router to handle the traffic volume effectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something in Cisco's &lt;a href=&quot;http://www.cisco.com/en/US/products/ps9343/index.html&quot;&gt;ASR1000&lt;/a&gt; or &lt;a href=&quot;http://www.cisco.com/en/US/products/ps10536/index.html&quot;&gt;3900&lt;/a&gt; product lines might be appropriate here, again depending on your throughput needs.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;However, several of those networks you reference aren't publicly routable addresses.  You will need to do some form of NAT to reach the internet at least, and possibly your &quot;Atrium (204.10.83.1)&quot; network as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would also most likely want a firewall providing NATing/security between your internal networks and the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short, it could be done with one switch and one router, but there is probably a need for more devices to create the optimal solution.  Without specifics about your business case, throughput needs, etc. it is hard to give a more detailed answer.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-05-19T21:31:56.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="617" PostTypeId="2" ParentId="613" CreationDate="2013-05-19T21:33:11.587" Score="10" Body="&lt;p&gt;3 routers sounds like overkill to me but it would be interesting to see the topology and hear him explain the reason behind it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your requirements for redundancy and/or loadbalancing a 1921/1941 could be fine for your needs. That would be only one device because it has both routing and switching if you stick a HWIC Etherswitch card in it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The high availability design would be to have two routers and two switches but then the servers should be dually connected as well.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-19T21:33:11.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="618" PostTypeId="1" CreationDate="2013-05-19T21:33:25.873" Score="7" ViewCount="1763" Body="&lt;p&gt;The JNCIP / JNCIE-SEC latest courses use 12.1X44-D10.4 as the recommended Junos version.  I setup a 30-day evaluation on my home SRX device to study JIPS, based on 12.1.  At this point, I'm guessing that my problem is that trial licenses for 12.1X44-D10.4 might be equivalent to 12.2, 12.3, or entirely not supported.  Here's what I'm trying now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;netops&amp;gt; request security idp security-package download full-update    &#xA;Will be processed in async mode. Check the status using the status checking CLI&#xA;&#xA;root&amp;gt; request security idp security-package download status         &#xA;In progress:SignatureUpdate_tmp.xml.gz                          100 % 2034681 Bytes/ 2034681 Bytes&#xA;&#xA;root&amp;gt; request security idp security-package download status    &#xA;Done;File applications.xml.gz is corrupt - MD5 hash match failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the license installed properly (but not the IDP signatures), I was also going to manually request a download with the proper URL parameters (mentioned in &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB19502&quot; rel=&quot;noreferrer&quot;&gt;KB19502&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've had no luck on Juniper.net, but here are my planned next steps:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Sniff the traffic / figure out which version it's trying to download&lt;/li&gt;&#xA;&lt;li&gt;Manually request a download, eg. &lt;code&gt;https://services.netscreen.com/cgi-bin/index.cgi?device=jsrx650&amp;amp;feature=idp&amp;amp;os=10.3&amp;amp;detector=10.4.160100823&amp;amp;from=1817&amp;amp;to=1805&amp;amp;type=update&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Talk to my Juniper rep this week (and yes, I'm adding support on this device).  Edit: opened a Customer Care ticket with Juniper, as it's a new device.  Will follow up with resolution.&lt;/li&gt;&#xA;&lt;li&gt;I'm reading through the techpubs/documentation to see if there are any additional steps that could be causing this to fail, but I've tried the usual suspects like name resolution, system time/NTP, etc. etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Edit: downgrading to 12.1R5.5 did not fix the issue, and I'm still getting corrupt/md5 hash match failed.  This does not appear to be due to lack of storage, which could cause weird errors like this.&lt;/p&gt;&#xA;" OwnerUserId="526" LastEditorUserId="526" LastEditDate="2013-05-19T23:32:03.893" LastActivityDate="2013-05-20T05:24:06.440" Title="What are some workarounds / fixes for UTM/IDP on Junos 12.1X44-D10.4 for SRX Series branch devices?" Tags="|juniper|juniper-srx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="619" PostTypeId="1" AcceptedAnswerId="620" CreationDate="2013-05-19T22:18:26.657" Score="10" ViewCount="4724" Body="&lt;p&gt;How do you configure HSRP on a Nexus 7000 series switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know in IOS the commands are in the interface configuration, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch-a#config t&#xA;switch-a(config)#interface g1/0/1&#xA;switch-a(config-if)#ip address 10.1.1.2 255.255.255.0&#xA;switch-a(config-if)#standby 10 ip 10.1.1.1&#xA;switch-a(config-if)#standby 10 priority 110&#xA;switch-a(config-if)#standby 10 preempt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I am configuring an interface in Nexus OS, the standby command isn't there.  My output of &quot;?-ing&quot; around in the interface config mode doesn't give anything that looks likely...  What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-06-13T18:05:11.620" Title="Configuring HSRP on Nexus OS" Tags="|cisco-ios-12|cisco-nx-os|cisco-nexus-7k|hsrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="620" PostTypeId="2" ParentId="619" CreationDate="2013-05-19T22:18:26.657" Score="10" Body="&lt;p&gt;On a Cisco Nexus switch, the syntax for HSRP is actually &quot;HSRP&quot; instead of &quot;Standby&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience, it makes it easier to troubleshoot as you know immediately which redundancy protocol you're dealing with (HSRP, GLBP, or VRRP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/en/US/products/ps9402/products_configuration_example09186a0080b7e104.shtml&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; Cisco doc for more information on HSRP on the Nexus 7000 platform.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;First, be sure that you have enabled HSRP on the device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch-b(config)#feature hsrp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then go into the interface and issue the command &quot;hsrp &lt;em&gt;groupnumber&lt;/em&gt;&quot;.   You will then be able to enter your configuration similarly to in IOS.  This actually takes you into a sub-configuration mode as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch-b(config)#interface Eth1/1 &#xA;switch-b(config-if)#ip address 10.1.1.3/24&#xA;switch-b(config-if)#hsrp 10&#xA;switch-b(config-if-hsrp)#preempt&#xA;switch-b(config-if-hsrp)#priority 90&#xA;switch-b(config-if-hsrp)#ip 10.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Don't forget to &quot;no shut&quot; the interface, but then that should do it!&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Also, I just realized that Cisco has a great writeup on these differences &lt;a href=&quot;http://docwiki.cisco.com/wiki/Cisco_NX-OS/IOS_HSRP_Comparison&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; on their DocWiki.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-06-13T18:05:11.620" LastActivityDate="2013-06-13T18:05:11.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="621" PostTypeId="2" ParentId="607" CreationDate="2013-05-19T22:34:00.923" Score="14" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm studying networking and one of the most basic things I've been told countless times is that computers can't communicate outside of their own subnet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Stated without qualification like this, it is misleading and false. Of course, the Internet is divided between subnets, and yet anything can talk to anything else (most of them in an indirect way).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you must have learned is that hosts cannot communicate directly over data link protocols like ethernet outside of their subnet, because a subnet represents some physical network segment. To communicate with hosts outside of the subnet, it is necessary to send a packet to a gateway which is on the subnet. This is what &lt;em&gt;routing&lt;/em&gt; is all about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Really, the question you should be asking is: how can an interface have an address such that all of the bits of the address are subnet, and there are no host bits?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer is that this is a point-to-point link. Point to point links are not full blown networks. The two interfaces on either end of a link know that they are talking to each other without the need for any datalink level addressing, and so at the network level, they can share the same IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, a datalink can be regarded as its own network segment, and so it can have its own subnet, and that subnet only needs to contain one address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If one end of the endpoint needs to talk specifically to the other, it can just use that address. If the router uses any other address and sends it over the modem, that packet is then not addressed for the peer; it is addressed to something else beyond that peer. The peer will receive the packet and route it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically the ISP equipment is just configured this way: it has hundreds of incoming subscriber lines, and it gives each one a 32 subnet.  If you have a point-to-point segment with one address, the netmask is basically moot, but you still need one: something has to be filled in for the netmask field on the interfaces and in the routing tables of the hosts.&lt;/p&gt;&#xA;" OwnerUserId="591" LastEditorUserId="6336" LastEditDate="2014-07-01T14:09:12.740" LastActivityDate="2014-07-01T14:09:12.740" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="622" PostTypeId="2" ParentId="607" CreationDate="2013-05-19T22:47:58.760" Score="4" Body="&lt;p&gt;To demonstrate what others have explained, you can connect two Cisco routers via serial;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Debug ppp negotiate (or debug ppp packet for more verbose output).&lt;/li&gt;&#xA;&lt;li&gt;Under the serial interfaces configure IP addresses on different&#xA;subnets. &lt;/li&gt;&#xA;&lt;li&gt;Set 'encapsulation ppp' &lt;/li&gt;&#xA;&lt;li&gt;no shut&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Notice &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Protocol_Control_Protocol&quot; rel=&quot;nofollow&quot;&gt;IPCP&lt;/a&gt; do its thing and the far end subnet seen as directly connected in the routing table.&lt;/p&gt;&#xA;" OwnerUserId="478" LastEditorUserId="6336" LastEditDate="2014-07-01T08:20:24.503" LastActivityDate="2014-07-01T08:20:24.503" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="623" PostTypeId="2" ParentId="576" CreationDate="2013-05-19T23:14:41.407" Score="2" Body="&lt;p&gt;The Spanning Tree Protocol specifies a switch should add the path cost of its interface receiving a BPDU to the Root Path Cost in that BPDU to learn its own Root Path Cost. It will then send out BPDUs containing this sum, ignoring the path cost of its sending interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to answer your question, I think symmetrical costs on a link are allowed by the protocol. I can't seem to come up with a scenario in which asymmetrical costs would break Spanning Tree, or a scenario in which they would be useful for that matter.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-05-19T23:14:41.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="624" PostTypeId="2" ParentId="607" CreationDate="2013-05-19T23:20:15.183" Score="3" Body="&lt;p&gt;Your router only needs a &lt;code&gt;/32&lt;/code&gt; route to talk to the ISP router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, your router will have the ISP router listed as &lt;strong&gt;default gateway&lt;/strong&gt; or &quot;gateway of last resort&quot;.  When your router wants to deliver a packet to a host it doesn't know, it will send it to the ISP router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP router is only the first step onto the wider internet.  It follows the same pattern as above: the router itself knows only a few hosts to talk to, but it can reach all other routers in the world because it can determine the &lt;strong&gt;next stop&lt;/strong&gt; for any IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every router on the path from client to server knows one step ahead (&quot;the next router&quot;) and one step back (&quot;the previous router&quot;.)  None of the routers needs to know the entire path.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Life is simple for your work router.  It has an entry for the local LAN, it knows how to reach one ISP router, and it has a default route to the ISP router.  Backend internet routers are more complex, but the idea is the same.&lt;/p&gt;&#xA;" OwnerUserId="682" LastActivityDate="2013-05-19T23:20:15.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="625" PostTypeId="2" ParentId="613" CreationDate="2013-05-19T23:32:25.073" Score="4" Body="&lt;p&gt;To get to the heart of your question, &lt;strong&gt;a single L3 (layer 3) switch could do what you want and be divided into logical networks via VLANs and the switch will handle the routing between the networks though this is far from an optimal solution.&lt;/strong&gt;  Each VLAN interface will have an IP address configured which becomes the default gateway for all devices it serves.  &lt;strong&gt;Although not recommended for several reasons with security at the top&lt;/strong&gt;, your Internet connection could even technically connect on the same switch and work, but that's asking for trouble; I'm sure this is why your consultant recommended at least 1 switch and and 1 router so the two are separated.  You really should have a firewall between the two or at least firewalling functionality on your router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, you would hare pairs routers, firewalls, and switches for redundancy and separation of functions to provide security boundaries.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-19T23:32:25.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="626" PostTypeId="1" AcceptedAnswerId="627" CreationDate="2013-05-20T00:03:57.970" Score="12" ViewCount="16632" Body="&lt;p&gt;I have been having complaints of a &quot;slow connection&quot; from several new remote sites.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sites are connected via an MPLS L3VPN service into Cisco 2921's, and we are using Cisco GET-VPN to encrypt the traffic between our locations.  All locations have either 100Mbps or 1Gbps circuits, so speed should not be an issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, upon conducting iperf tests from one location to a known working location, I found that my bandwidth tops out around 85Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further investigation on the 2921's gives many occurrences of the following error message in the logs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;006555: Jan  3 08:19:09.573 EST: %CERM-4-TX_BW_LIMIT: Maximum Tx Bandwidth limit of 85000 Kbps reached for Crypto functionality with securityk9 technology package license.&#xA;006556: Jan  3 11:21:37.069 EST: %CERM-4-RX_BW_LIMIT: Maximum Rx Bandwidth limit of 85000 Kbps reached for Crypto functionality with securityk9 technology package license.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have verified that our older locations using 2821's do not have this issue... is this something to do with IOS 15, the ISR Gen2's or both?&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2016-05-23T01:32:02.803" Title="Cisco ISR G2 encrypted bandwidth restriction?" Tags="|cisco|cisco-ios-15|ipsec|cisco-isr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="627" PostTypeId="2" ParentId="626" CreationDate="2013-05-20T00:03:57.970" Score="11" Body="&lt;p&gt;You are running into one of the fun, new, restrictions of the ISR Generation 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you have the basic &quot;security&quot; licensing package installed as noted by this part of the message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;securityk9 technology package license&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However the securityk9 package is Cisco's &quot;unrestricted export&quot; version of that license, and will artificially limit you.  You need the hseck9 package.  See &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps10616/white_paper_c11_556985.html#wp9001377&quot;&gt;this&lt;/a&gt; white paper for more information.  It says in part:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The HSEC-K9 license removes the curtailment enforced by the U.S. government export restrictions on the encrypted tunnel count and encrypted throughput. HSEC-K9 is available only on the Cisco 2921, Cisco 2951, Cisco 3925, Cisco 3945, Cisco 3925E, and Cisco 3945E. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With the HSEC-K9 license, the ISR G2 router can go over the curtailment limit of 225 tunnels maximum for IP Security (IPsec) and encrypted throughput of 85-Mbps unidirectional traffic in or out of the ISR G2 router, with a bidirectional total of 170 Mbps.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Cisco 1941, 2901, and 2911 already have maximum encryption capacities within export limits. The HSEC license requires the universalk9 image and the SEC license pre-installed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;A quick way to check which license you have, is to issue the following command on your router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show license feature&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will show you which licenses you have purchased from Cisco and installed on this router.  You need to make sure that the &lt;strong&gt;hseck9&lt;/strong&gt; license is enabled.  Otherwise you will be limited to that 85Mbps limit for encrypted traffic.  Which on circuits below 100Mbps, might not be an issue, and you could safely ignore this problem.  Either way, see &lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/access/sw_activation/SA_on_ISR.html#wp1145483&quot;&gt;this&lt;/a&gt; page for more information on installing the new license once you purchase it.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Another handy command for troubleshooting this is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show platform cerm-information&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will either spit out a list of information about the limits in place, including the failed encrypt/decrypt packet counts, or it will give you the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router-1#show platform cerm-information &#xA;Crypto Export Restrictions Manager(CERM) Information:&#xA; CERM functionality: DISABLED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More information on this command &lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/access/sw_activation/SA_on_ISR.html#wp1139605&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-05-20T00:03:57.970" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="628" PostTypeId="2" ParentId="618" CreationDate="2013-05-20T00:10:31.060" Score="4" Body="&lt;p&gt;It appeared this was an easy fix (I also tried 12.1R6.5 and 12.1X44-D11.5, to no avail).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I looked at the version of the signature DB that it's trying to download (2263):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; netops&amp;gt; request security idp security-package download check-server    &#xA; Successfully retrieved from(https://services.netscreen.com/cgi-bin/index.cgi).&#xA; Version info:2263(Detector=12.6.160130325, Templates=2263)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I decided that this is possibly an actual bad md5 checksum (per what Junos expects), and I downloaded the previous version, 2262:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; netops&amp;gt; request security idp security-package download version full-update 2262    &#xA; Will be processed in async mode. Check the status using the status checking CLI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It worked!  I've had to do something similar on Netscreen, but it's been a while.  I turned off automated updates, and I can get back to studying.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; netops&amp;gt; request security idp security-package download status    &#xA; Done;Successfully downloaded from(https://services.netscreen.com/cgi-bin/index.cgi).&#xA; Version info:2262(Tue May 14 16:27:00 2013 UTC, Detector=12.6.160130325)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now that the download is finished, everything is installing properly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; netops&amp;gt; request security idp security-package install          &#xA; Will be processed in async mode. Check the status using the status checking CLI&#xA;&#xA; netops&amp;gt; request security idp security-package install status &#xA; In progress:performing DB update...&#xA;&#xA; netops&amp;gt; request security idp security-package install status    &#xA; In progress:performing DB update for an xml (groups.xml)&#xA;&#xA; netops&amp;gt; request security idp security-package install status&#xA; In progress:performing DB update for an xml (applications.xml)&#xA;&#xA; etc.&#xA;&#xA; netops&amp;gt; request security idp security-package install status    &#xA; Done;Attack DB update : successful - [UpdateNumber=2262,ExportDate=Tue May 14 16:27:00   2013 UTC,Detector=12.6.160130325]&#xA; Updating control-plane with new detector : successful&#xA; Updating data-plane with new attack or detector : not performed&#xA;  due to no active policy configured.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm thinking that this is either a bug in SRX110H-VA, a combination of hardware/software release, or bad signature updates on services.netscreen.com.  I'm pretty sure that I could just look through the XML, and figure out where the bad md5sum is (and fix it by hand), but I'll follow up once I hear back from Juniper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Newest edit: I also had to manually download the policy template from Juniper, extract it with &lt;code&gt;gzip -d templates.xml.gz&lt;/code&gt;, and place it in &lt;code&gt;/var/db/idpd/sec-download/sub-download/&lt;/code&gt;.  Once that was done, I was able to install it.  The issue here is that the &lt;code&gt;request security idp security-package install policy-templates&lt;/code&gt; command does not take a 'version', like the other idp commands.  This will always be an issue when the head IDP policy has md5 errors, although I would hope that this isn't a frequent occurrence at Juniper.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; netops&amp;gt; request security idp security-package install policy-templates &#xA; Will be processed in async mode. Check the status using the status checking CLI&#xA;&#xA; netops&amp;gt; request security idp security-package install status              &#xA; Done;policy-templates has been successfully updated into internal repository&#xA; (=&amp;gt;/var/db/scripts/commit/templates.xsl)! &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="526" LastEditorUserId="526" LastEditDate="2013-05-20T05:24:06.440" LastActivityDate="2013-05-20T05:24:06.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="630" PostTypeId="1" AcceptedAnswerId="697" CreationDate="2013-05-20T02:43:56.947" Score="12" ViewCount="2519" Body="&lt;p&gt;I see a lot of conflicting information about whether or not a Cisco ASA (5505 in this case) can use IPv6 over a PPPoE connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see official &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-15973&quot; rel=&quot;noreferrer&quot;&gt;Cisco documentation making it look easy&lt;/a&gt;, but I see &lt;a href=&quot;https://supportforums.cisco.com/thread/2090344&quot; rel=&quot;noreferrer&quot;&gt;plenty of forum posts&lt;/a&gt; stating that it doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP requires that we use an autoconfigured address for the PPPoE link, as they assign a dynamic IPv6 address to the link itself, and give us a static &lt;code&gt;/56&lt;/code&gt; for prefix delegation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Our provider is &lt;a href=&quot;http://www.internode.on.net&quot; rel=&quot;noreferrer&quot;&gt;Internode&lt;/a&gt;; and they &lt;a href=&quot;http://www.internode.on.net/support/guides/internet_access/ipv6/cisco_routers/&quot; rel=&quot;noreferrer&quot;&gt;provide this guide&lt;/a&gt; for enabling on an 800-series router. The beginning of the &lt;code&gt;sh ver&lt;/code&gt; of our ASA is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco Adaptive Security Appliance Software Version 9.1(1)&#xA;Device Manager Version 7.1(2)102&#xA;&#xA;Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz,&#xA;Internal ATA Compact Flash, 128MB&#xA;BIOS Flash M50FW016 @ 0xfff00000, 2048KB&#xA;&#xA;Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)&#xA;                             Boot microcode        : CN1000-MC-BOOT-2.00&#xA;                             SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2.03&#xA;                             IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.08&#xA;                             Number of accelerators: 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Onto what I've tried: I've tried enabling autoconfiguration for the connection, I've added the PD into the ASA, but because the actual PPPoE link requires a dynamic IP I can't set a static. I tried anyway (by using &lt;code&gt;[delegation]FF::1/128&lt;/code&gt; which random forum trolling seems to be a common configuration for Internode) but from memory the ASA wouldn't let me assign a route to an interface only, it wanted a next-hop, which I didn't have.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;edge(config-if)# show running-config interface vlan2&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; pppoe client vpdn group Internode&#xA; ip address pppoe setroute&#xA; ipv6 address autoconfig&#xA; ipv6 enable&#xA; ipv6 nd prefix 2001:44b8:310c:9f00::/56 infinite infinite&#xA; ipv6 nd managed-config-flag&#xA; ipv6 nd other-config-flag&#xA;&#xA;vpn(config-if)# show ip&#xA;System IP Addresses:&#xA;Interface                Name                   IP address      Subnet mask     Method&#xA;Vlan1                    inside                 192.168.161.17  255.255.255.0   CONFIG&#xA;Vlan2                    outside                59.167.172.177  255.255.255.255 manual&#xA;Vlan3                    dmz                    unassigned      unassigned      DHCP&#xA;Vlan5                    Guest                  192.168.64.17   255.255.255.0   manual&#xA;Current IP Addresses:&#xA;Interface                Name                   IP address      Subnet mask     Method&#xA;Vlan1                    inside                 192.168.161.17  255.255.255.0   CONFIG&#xA;Vlan2                    outside                59.167.172.177  255.255.255.255 manual&#xA;Vlan3                    dmz                    unassigned      unassigned      DHCP&#xA;Vlan5                    Guest                  192.168.64.17   255.255.255.0   manual&#xA;&#xA;&#xA;vpn(config-if)# show ipv6 interface outside&#xA;outside is up, line protocol is up&#xA;  IPv6 is enabled, link-local address is fe80::462b:3ff:fe7a:d5&#xA;  No global unicast address is configured&#xA;  Joined group address(es):&#xA;    ff02::1:ff00:1&#xA;    ff02::1:ff7a:d5&#xA;    ff02::2&#xA;    ff02::1&#xA;  ICMP error messages limited to one every 100 milliseconds&#xA;  ICMP redirects are enabled&#xA;  ND DAD is enabled, number of DAD attempts: 1&#xA;  ND reachable time is 30000 milliseconds&#xA;  ND advertised reachable time is 0 milliseconds&#xA;  ND advertised retransmit interval is 1000 milliseconds&#xA;  ND router advertisements are sent every 200 seconds&#xA;  ND router advertisements live for 1800 seconds&#xA;  Hosts use DHCP to obtain routable addresses.&#xA;  Hosts use DHCP to obtain other configuration.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="687" LastEditorUserId="687" LastEditDate="2013-05-20T10:51:39.853" LastActivityDate="2013-05-21T00:58:14.223" Title="ASA5505 and IPv6 over a PPPoE Link" Tags="|ipv6|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="631" PostTypeId="2" ParentId="583" CreationDate="2013-05-20T04:15:42.523" Score="3" Body="&lt;p&gt;In addition:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taps: will not suffer from buffering/timing changes induced by a SPAN session under loaded conditions - could be important in low latency environments where nanoseconds are significant, and hardware timestamps are in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SPAN: you can select two ports as destination ports, one for the TX side and one for the RX side, but this depends on the platform. This solves the 2 to 1 oversubscription problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, what it comes down to is that SPAN can introduce additional artificial variation in the timing and potentially the ordering of the packets which can be a problem for some types of analysis. &lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2013-05-20T04:15:42.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="634" PostTypeId="1" CreationDate="2013-05-20T07:23:11.443" Score="6" ViewCount="4070" Body="&lt;p&gt;I have two Juniper SRX240's in a cluster.  After re-ordering some security policies on the primary device and committing them ok I now can not make any other changes without the warning&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;error: Policy is out of sync between RE and PFE cluster1.node1. Please resync before commit.&lt;/p&gt;&#xA;&lt;p&gt;error: configuration check-out failed&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I have found this KB article &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB25143&amp;amp;smlogin=true&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB25143&amp;amp;smlogin=true&lt;/a&gt; and I have rebooted both of the nodes (multiple times now) and they are still out of sync.&lt;/p&gt;&#xA;&lt;p&gt;I found out about a command &amp;quot;commit synchronize force&amp;quot; but that won't work on a SRX 240.&lt;/p&gt;&#xA;&lt;p&gt;Does anyone know how I can force a resync of these two devices? They are currently live so I can't keep rebooting them in the middle of the day.&lt;/p&gt;&#xA;&lt;p&gt;I am running version: JUNOS 12.1R6.5&lt;/p&gt;&#xA;" OwnerUserId="139" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-05-27T18:44:58.033" Title="Juniper SRX240 Clustering - Policy out of sync" Tags="|juniper-srx|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="635" PostTypeId="2" ParentId="634" CreationDate="2013-05-20T07:33:16.720" Score="1" Body="&lt;p&gt;I found out how to sort this out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a reboot of both nodes you must connect back to the node that was the original master and has the latest set of changes BEFORE the configs went out of sync.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem was I assumed node 1 had the latest set of changes but after rebooting both nodes and then manually making node 0 the primary node I found I could commit changes which then sync'ed back to node 1.&lt;/p&gt;&#xA;" OwnerUserId="139" LastActivityDate="2013-05-20T07:33:16.720" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="636" PostTypeId="1" AcceptedAnswerId="637" CreationDate="2013-05-20T08:14:03.607" Score="18" ViewCount="9163" Body="&lt;p&gt;In looking to implement Bidirectional Forwarding Detection (BFD) it seems to be very flexible in terms of timer tuning, light weight regarding any overhead and it's flexibility in terms of overall application appears very impressive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if for example it can be applied to detect link failure over Ethernet, MPLS over multiple hops, at the network edge, for IGP convergence, for tunnels etc etc - why would it &lt;strong&gt;not&lt;/strong&gt; be used in certain scenarios perhaps and are there other emerging alternatives to be aware of?&lt;/p&gt;&#xA;" OwnerUserId="109" LastEditorUserId="109" LastEditDate="2013-05-20T11:18:30.587" LastActivityDate="2015-02-24T07:43:42.950" Title="Are there any reasons to not use BFD?" Tags="|cisco|juniper|mpls|ethernet|design|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="637" PostTypeId="2" ParentId="636" CreationDate="2013-05-20T08:36:11.010" Score="18" Body="&lt;p&gt;I am only directly aware of one issue with BFD, which is CPU demand. I am currently investigating an issues with a Cisco 7301 which when pushing more traffic during our peak hours, compared to the rest of the day, BFD is sometimes timing out and routing trips over to the next link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that under high traffic volumes the router CPU usage is rising (which isn't unusual) but at about 40-50% CPU BFD packets aren't receiving enough resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I have found the following information which suggests additional issues with BFD (From &lt;a href=&quot;http://www.nanog.org/meetings/nanog45/presentations/Monday/Scholl_BFD_N45.pdf&quot;&gt;this&lt;/a&gt; NANOG presentation, there is more in the presentation, it's a good one, give it a read!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What are the caveats?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Two main ones:&#xA;&lt;ol&gt;&#xA;&lt;li&gt;BFD can have high resource demands depending on your&#xA;scale.&lt;/li&gt;&#xA;&lt;li&gt;BFD is not visible to Layer 2 bundling protocols. (Ethernet&#xA;LAGs or POS bundles)&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BFD Resource Demands&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The number of BFD sessions on each linecard or router can&#xA;impact how well BFD scales for you.&#xA;-Each unique platform has its own limits.&lt;/li&gt;&#xA;&lt;li&gt;Bundled interfaces supporting min tx/rx of 250ms or 2 seconds have&#xA;been seen.&lt;/li&gt;&#xA;&lt;li&gt;In some cases, BFD instances on a router may need to be operated on&#xA;the route-processor depending on the implementation (non-adjacency&#xA;based BFD sessions).&lt;/li&gt;&#xA;&lt;li&gt;Test your platform first before deploying BFD. Attempt to put&#xA;load on the RP or LC CPU with your configured settings. This&#xA;can be done by:&lt;/li&gt;&#xA;&lt;li&gt;Executing CPU-heavy commands&lt;/li&gt;&#xA;&lt;li&gt;Flooding packets to TTL expire on the destination&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BFD Resource Demands (cont’d)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What values are safe to try?&lt;/li&gt;&#xA;&lt;li&gt;Based upon speaking to several operators, 300ms with a&#xA;multiplier of 3 (900ms detection) appears to be a safe value&#xA;that works on most equipment fairly well.&lt;/li&gt;&#xA;&lt;li&gt;This is a significant improvement over some of the&#xA;alternatives.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BFD and L2 link-bundling&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;BFD is unaware of underlying L2 link bundle members.&lt;/li&gt;&#xA;&lt;li&gt;A 4x10GigE L2 bundle (802.3ad) would appear as a single L3&#xA;adjacency. BFD packets would be transmitted on a single&#xA;member link, rather than out all 4 links.&lt;/li&gt;&#xA;&lt;li&gt;A failure of the link with BFD on it would result in the entire L3&#xA;adjacency failing.&lt;/li&gt;&#xA;&lt;li&gt;However, in some scenarios the failed member link may result in only a&#xA;single BFD packet being dropped. Subsequent packets may route over&#xA;working member links.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-20T08:36:11.010" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="638" PostTypeId="1" AcceptedAnswerId="639" CreationDate="2013-05-20T09:34:31.947" Score="13" ViewCount="14678" Body="&lt;p&gt;I have heard people stating that their network &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;operates a 5 level (or layer) QoS model&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Sometimes they also mention a 7 level QoS model. Can anyone provide me with a Cisco IOS config example of what is meant here. So by this I mean a config example showing how to implement this (assuming there is such a thing!). I am more familiar with IOS 12.whatever rather than 15.whatever but either would be great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume that these people are referencing a 5 class set up matching traffic that is one of the 5 standard classes below and processing the traffic appropriately;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DF Default&lt;/li&gt;&#xA;&lt;li&gt;EF Expedited Forwarding&lt;/li&gt;&#xA;&lt;li&gt;VA Voice Admit&lt;/li&gt;&#xA;&lt;li&gt;AF Assured Forwarding&lt;/li&gt;&#xA;&lt;li&gt;CS Class Selector (for backward compatibility)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm looking for an IOS config example that matches 5 (or 7!) classes of traffic, and then applies an appropriate policy (&lt;em&gt;I understand this is a big vague, different network operators may want the traffic handled differently, but this is purely educational. I want to see 5 different class of traffic being matches and treated differently&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Side note&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd be really interested to see for example how one would configure such a policy for say a 100Mbps link so that using simple arithmetic I could scale it up to 1Gbps or down to 10Mbps. I'm guessing that for this to be effective, this whole QoS schema would need to reserve buffer space or allocate bucket space, rather than using policing to limit bandwidth for example? I assume this is because you don't know how much bandwidth at any one time will be voice, or video, data, or P2P/Torrents etc&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-20T10:24:11.113" Title="What is the 5 level QoS model (through config example)?" Tags="|cisco|qos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="639" PostTypeId="2" ParentId="638" CreationDate="2013-05-20T10:24:11.113" Score="17" Body="&lt;p&gt;Cisco has something they call Cisco Validated Designs (CVD). These are network designs from different perspectives like QoS, high availability, WAN etc that Cisco recommends and have tested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For QoS they have 3 different designs with 4, 8 or 12 classes which can be seen in the picture below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wlET3.jpg&quot; alt=&quot;Cisco QoS classes&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Starting with the 4 class model:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! This section defines the 4-Class class-maps &#xA;! (three are explicitly defined and one is default)&#xA;Router(config)# class-map match-any REALTIME&#xA;Router(config-cmap)# match dscp ef&#xA; ! Matches VoIP&#xA;Router(config-cmap)# match dscp cs5&#xA; ! Matches Broadcast Video&#xA;Router(config-cmap)# match dscp cs4&#xA; ! Matches Realtime-Interactive&#xA;&#xA;Router(config)# class-map match-any CONTROL&#xA;Router(config-cmap)# match dscp cs6&#xA; ! Matches Network-Control&#xA;Router(config-cmap)# match dscp cs3&#xA; ! Matches Signaling (control-plane traffic for voice/video infrastructure)&#xA;Router(config-cmap)# match dscp cs2&#xA; ! Matches Network Management&#xA;&#xA;Router(config)# class-map match-any CRITICAL-DATA&#xA;Router(config-cmap)# match dscp af41 af42 af43&#xA; ! Matches Multimedia Conferencing on AF4 &#xA;Router(config-cmap)# match dscp af31 af32 af33&#xA; ! Matches Multimedia Streaming on AF3&#xA;Router(config-cmap)# match dscp af21 af22 af23&#xA; ! Matches Transactional Data on AF2&#xA;Router(config-cmap)# match dscp af11 af12 af13&#xA; ! Matches Bulk Data on AF1&#xA;&#xA;&#xA;! This section defines the 4-Class Policy-Map&#xA;Router(config)# policy-map WAN-EDGE-4-CLASS&#xA;Router(config-pmap)# class REALTIME&#xA;Router(config-pmap-c)# priority percent 33&#xA; ! Provisions 33% LLQ for REALTIME class&#xA;Router(config-pmap-c)# class CONTROL&#xA;Router(config-pmap-c)#  bandwidth percent 7&#xA; ! Provisions 7% CBWFQ for CONTROL class&#xA;Router(config-pmap-c)# class CRITICAL-DATA&#xA;Router(config-pmap-c)#  bandwidth percent 35&#xA; ! Provisions 35% CBWFQ for CRITICAL-DATA class&#xA;Router(config-pmap-c)#  fair-queue&#xA; ! Enables fair-queuing pre-sorter on CRITICAL-DATA class&#xA;Router(config-pmap-c)#   random-detect dscp-based&#xA; ! Enables DSCP-based WRED on CRITICAL-DATA class&#xA;Router(config-pmap-c)#   random-detect dscp af11 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF11/10 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af12 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF12/12 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af13 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF13/14 to 40 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af21 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF21/18 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af22 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF22/20 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af23 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF23/22 to 40 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af31 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF31/26 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af32 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF32/28 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af33 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF33/30 to 40 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af41 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF41/34 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af42 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF42/36 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af43 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF43/38 to 40 and 64 packets&#xA;Router(config-pmap-c)# class class-default&#xA;Router(config-pmap-c)#  bandwidth percent 25&#xA; ! Provisions 25% CBWFQ for default (Best-Effort) class&#xA;Router(config-pmap-c)#  fair-queue&#xA; ! Enables fair-queuing pre-sorter on default (Best-Effort) class&#xA;Router(config-pmap-c)#  queue-limit 128 packets&#xA; ! Expands queue-limit to 128 packets&#xA;Router(config-pmap-c)#   random-detect dscp-based&#xA; ! Enables DSCP-based WRED on default (Best-Effort) class&#xA;Router(config-pmap-c)#   random-detect dscp default 100 128&#xA; ! Tunes WRED min and max drop-thresholds for DF/0 to 100 and 128 packets&#xA;Router(config-pmap-c)#   random-detect dscp cs1 60 100&#xA; ! Tunes WRED min and max drop-thresholds for CS1/8 to 60 and 100 packets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see it matches on different DSCP values. DSCP EF is generally used for VoIP. This means that your packets should already have been marked as early as possible in your network. The bandwidth values are entered in percent which means that the policy can applied on different speed interfaces and still provide good values compared to entering them in kbit/s. On very high speed interfaces like 10 Gbit it could be a lot to use 7% for control traffic though since that would be 700 Mbit/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both the data and the class-default uses fair-queue which is a way of queueing packets based on DSCP and packet size to provide fair queueing even for small packet flows. To be able to use this you need an image supporting Hierarchical Queing Framework (HQF) which is &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6558/white_paper_c11-481499.html&quot; rel=&quot;noreferrer&quot;&gt;12.4(20)T&lt;/a&gt; or newer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Weighted Random Early Detection (WRED) is also applied to take care of issues like TCP synchronization where TCP flows will speed up and back off at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you have the 8 class model.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! This section defines the 8-Class class-maps &#xA;! (seven are explicitly defined and one is default)&#xA;Router(config)# class-map match-all VOICE&#xA;Router(config-cmap)# match dscp ef&#xA; ! Matches VoIP&#xA;&#xA;Router(config)# class-map match-any INTERACTIVE-VIDEO&#xA;Router(config-cmap)# match dscp cs5&#xA; ! Matches Broadcast Video&#xA;Router(config-cmap)# match dscp cs4&#xA; ! Matches Realtime-Interactive&#xA;Router(config)# class-map match-any NETWORK-CONTROL&#xA;Router(config-cmap)# match dscp cs6&#xA; ! Matches Network Control&#xA;Router(config-cmap)# match dscp cs2&#xA; ! Matches Network Management&#xA;&#xA;Router(config)# class-map match-all SIGNALING&#xA;Router(config-cmap)# match dscp cs3&#xA; ! Matches Signaling&#xA;&#xA;Router(config)# class-map match-all MULTIMEDIA-STREAMING&#xA;Router(config-cmap)# match dscp af31 af32 af33&#xA; ! Matches Multimedia-Streaming on AF3&#xA;&#xA;Router(config)# class-map match-any CRITICAL-DATA&#xA;Router(config-cmap)# match dscp af41 af42 af43&#xA; ! Matches Multimedia-Conferencing on AF4&#xA;Router(config-cmap)# match dscp af21 af22 af23&#xA; ! Matches Transactional-Data on AF2&#xA;Router(config-cmap)# match dscp af11 af12 af13&#xA; ! Matches Bulk-Data on AF1&#xA;&#xA;Router(config)# class-map match-all SCAVENGER&#xA;Router(config-cmap)# match dscp cs1&#xA; ! Matches Scavenger&#xA;&#xA;&#xA;! This section configures the 8-class policy-map&#xA;Router(config)# policy-map WAN-EDGE-8-CLASS&#xA;Router(config-pmap)# class VOICE&#xA;Router(config-pmap-c)#  priority percent 10&#xA; ! Provisions 10% LLQ for VOICE class (dual LLQ-policy)&#xA;Router(config-pmap-c)# class INTERACTIVE-VIDEO&#xA;Router(config-pmap-c)#  priority percent 23&#xA; ! Provisions 23% LLQ for INTERACTIVE-VIDEO class (dual-LLQ policy)&#xA;Router(config-pmap-c)# class NETWORK-CONTROL&#xA;Router(config-pmap-c)#  bandwidth percent 5&#xA; ! Provisions 5% CBWFQ for NETWORK-CONTROL class&#xA;Router(config-pmap-c)# class SIGNALING&#xA;Router(config-pmap-c)#  bandwidth percent 2&#xA; ! Provisions 2% CBWFQ for SIGNALING class&#xA;Router(config-pmap-c)# class MULTIMEDIA-STREAMING&#xA;Router(config-pmap-c)#  bandwidth percent 10&#xA; ! Provisions 10% CBWFQ for MULTIMEDIA-STREAMING class&#xA;Router(config-pmap-c)#  fair-queue&#xA; ! Enables fair-queuing pre-sorter on MULTIMEDIA-STREAMING class&#xA;Router(config-pmap-c)#   random-detect dscp-based&#xA; ! Enables DSCP-based WRED on MULTIMEDIA-STREAMING class&#xA;Router(config-pmap-c)#   random-detect dscp af31 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF31/26 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af32 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF32/28 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af33 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF33/30 to 40 and 64 packets&#xA;Router(config-pmap-c)# class CRITICAL-DATA&#xA;Router(config-pmap-c)#  bandwidth percent 24&#xA; ! Provisions 24% CBWFQ for CRITICAL-DATA class&#xA;Router(config-pmap-c)#  fair-queue&#xA; ! Enables fair-queuing pre-sorter on CRITICAL-DATA class&#xA;Router(config-pmap-c)#   random-detect dscp-based&#xA; ! Enables DSCP-based WRED on CRITICAL-DATA class&#xA;&#xA;&#xA;Router(config-pmap-c)#   random-detect dscp af11 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF11/10 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af12 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF12/12 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af13 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF13/14 to 40 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af21 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF21/18 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af22 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF22/20 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af23 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF23/22 to 40 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af41 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF41/34 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af42 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF42/36 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af43 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF43/38 to 40 and 64 packets&#xA;Router(config-pmap-c)# class SCAVENGER&#xA;Router(config-pmap-c)#  bandwidth percent 1&#xA; ! Constrains Scavenger class to 1% CBWFQ&#xA;Router(config-pmap-c)# class class-default&#xA;Router(config-pmap-c)#  bandwidth percent 25&#xA; ! Provisions 25% CBWFQ for default (Best-Effort) class&#xA;Router(config-pmap-c)#  fair-queue&#xA; ! Enables fair-queuing pre-sorter on default (Best-Effort) class&#xA;Router(config-pmap-c)#  queue-limit 128 packets&#xA; ! Expands queue-limit to 128 packets&#xA;Router(config-pmap-c)#   random-detect dscp-based&#xA; ! Enables DSCP-based WRED on default (Best-Effort) class&#xA;Router(config-pmap-c)#   random-detect dscp default 100 128&#xA; ! Tunes WRED min and max drop-thresholds for DF/0 to 100 and 128 packets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This policy is more granular for the realtime applications like video, streaming and signaling for these protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally this is the 12 class model.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! This section configures the class-maps&#xA;! (eleven class maps are explicitly defined and one is default)&#xA;Router(config)# class-map match-all VOICE&#xA;Router(config-cmap)# match dscp ef&#xA; ! Matches VoIP&#xA;&#xA;Router(config)# class-map match-all BROADCAST-VIDEO&#xA;Router(config-cmap)# match dscp cs5&#xA; ! Matches Broadcast Video&#xA;&#xA;Router(config)# class-map match-all REALTIME-INTERACTIVE&#xA;Router(config-cmap)#  match dscp cs4&#xA; ! Matches Realtime-Interactive&#xA;&#xA;Router(config)# class-map match-all NETWORK-CONTROL&#xA;Router(config-cmap)# match dscp cs6&#xA; ! Matches Network Control&#xA;&#xA;Router(config)# class-map match-all SIGNALING&#xA;Router(config-cmap)# match dscp cs3&#xA; ! Matches Signaling&#xA;&#xA;Router(config)# class-map match-all NETWORK-MANAGEMENT&#xA;Router(config-cmap)# match dscp cs2&#xA; ! Matches Network Management&#xA;&#xA;Router(config)# class-map match-any MULTIMEDIA-CONFERENCING&#xA;Router(config-cmap)# match dscp af41&#xA;Router(config-cmap)# match dscp af42&#xA;Router(config-cmap)# match dscp af43&#xA; ! Matches Multimedia-Conferencing&#xA; ! One match statement per Drop Precedence increases visibility&#xA;&#xA;Router(config)# class-map match-any MULTIMEDIA-STREAMING&#xA;Router(config-cmap)# match dscp af31&#xA;Router(config-cmap)# match dscp af32&#xA;Router(config-cmap)# match dscp af33&#xA; ! Matches Multimedia-Streaming&#xA; ! One match statement per Drop Precedence increases visibility&#xA;&#xA;Router(config)# class-map match-any TRANSACTIONAL-DATA&#xA;Router(config-cmap)# match dscp af21&#xA;Router(config-cmap)# match dscp af22&#xA;Router(config-cmap)# match dscp af23&#xA; ! Matches Transactional-Data&#xA; ! One match statement per Drop Precedence increases visibility&#xA;&#xA;Router(config)# class-map match-any BULK-DATA&#xA;Router(config-cmap)# match dscp af11&#xA;Router(config-cmap)# match dscp af12&#xA;Router(config-cmap)# match dscp af13&#xA; ! Matches Bulk-Data&#xA; ! One match statement per Drop Precedence increases visibility&#xA;&#xA;Router(config)# class-map match-all SCAVENGER&#xA;Router(config-cmap)# match dscp cs1&#xA; ! Matches Scavenger&#xA;&#xA;&#xA;! This section configures the 12-Class policy-map&#xA;Router(config)# policy-map WAN-EDGE-12-CLASS&#xA;Router(config-pmap)# class VOICE&#xA;Router(config-pmap-c)#  priority percent 10&#xA; ! Provisions 10% LLQ to VOICE class (multi-LLQ policy)&#xA;Router(config-pmap-c)# class BROADCAST-VIDEO&#xA;Router(config-pmap-c)#  priority percent 10&#xA; ! Provisions 10% LLQ to BROADCAST-VIDEO class (multi-LLQ policy)&#xA;Router(config-pmap-c)# class REALTIME-INTERACTIVE&#xA;Router(config-pmap-c)#  priority percent 13&#xA;! Provisions 13% LLQ to REALTIME-INTERACTIVE class (multi-LLQ policy)&#xA;Router(config-pmap-c)# class NETWORK-CONTROL&#xA;Router(config-pmap-c)#  bandwidth percent 2&#xA; ! Provisions 2% CBWFQ to NETWORK-CONTROL class&#xA;Router(config-pmap-c)# class SIGNALING&#xA;Router(config-pmap-c)#  bandwidth percent 2&#xA; ! Provisions 2% CBWFQ to SIGNALING class&#xA;Router(config-pmap-c)# class NETWORK-MANAGEMENT&#xA;Router(config-pmap-c)#  bandwidth percent 3&#xA; ! Provisions 3% CBWFQ to NETWORK-MANAGEMENT class&#xA;Router(config-pmap-c)# class MULTIMEDIA-CONFERENCING&#xA;Router(config-pmap-c)#  bandwidth percent 10&#xA; ! Provisions 10% CBWFQ to MULTIMEDIA-CONFERENCING class&#xA;Router(config-pmap-c)#  fair-queue&#xA; ! Enables fair-queuing pre-sorter on MULTIMEDIA-CONFERENCING class&#xA;Router(config-pmap-c)#   random-detect dscp-based&#xA; ! Enables DSCP-based WRED on MULTIMEDIA-CONFERENCING class&#xA;Router(config-pmap-c)#   random-detect dscp af41 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF41/34 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af42 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF42/36 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af43 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF43/38 to 40 and 64 packets&#xA;Router(config-pmap-c)# class MULTIMEDIA-STREAMING&#xA;Router(config-pmap-c)#  bandwidth percent 10&#xA; ! Provisions 10% CBWFQ to MULTIMEDIA-STREAMING class&#xA;Router(config-pmap-c)#  fair-queue&#xA; ! Enables fair-queuing pre-sorter on MULTIMEDIA-STREAMING class&#xA;Router(config-pmap-c)#   random-detect dscp-based&#xA; ! Enables DSCP-based WRED on MULTIMEDIA-STREAMING class&#xA;Router(config-pmap-c)#   random-detect dscp af31 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF31/26 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af32 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF32/28 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af33 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF33/30 to 40 and 64 packets&#xA;Router(config-pmap-c)# class TRANSACTIONAL-DATA&#xA;Router(config-pmap-c)#  bandwidth percent 10&#xA; ! Provisions 10% CBWFQ to TRANSACTIONAL-DATA class&#xA;Router(config-pmap-c)#  fair-queue&#xA; ! Enables fair-queuing pre-sorter on TRANSACTIONAL-DATA class&#xA;Router(config-pmap-c)#   random-detect dscp-based&#xA; ! Enables DSCP-based WRED on TRANSACTIONAL-DATA class&#xA;Router(config-pmap-c)#   random-detect dscp af21 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF21/18 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af22 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF22/20 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af23 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF23/22 to 40 and 64 packets&#xA;Router(config-pmap-c)# class BULK-DATA&#xA;Router(config-pmap-c)#  bandwidth percent 4&#xA; ! Provisions 4% CBWFQ to BULK-DATA class&#xA;Router(config-pmap-c)#  fair-queue&#xA; ! Enables fair-queuing pre-sorter on BULK-DATA class&#xA;Router(config-pmap-c)#   random-detect dscp-based&#xA;! Enables DSCP-based WRED on BULK-DATA class&#xA;Router(config-pmap-c)#   random-detect dscp af11 50 64&#xA; ! Tunes WRED min and max drop-thresholds for AF11/10 to 50 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af12 45 64&#xA; ! Tunes WRED min and max drop-thresholds for AF12/12 to 45 and 64 packets&#xA;Router(config-pmap-c)#   random-detect dscp af13 40 64&#xA; ! Tunes WRED min and max drop-thresholds for AF13/14 to 40 and 64 packets&#xA;Router(config-pmap-c)# class SCAVENGER&#xA;Router(config-pmap-c)#  bandwidth percent 1&#xA; ! Constrains Scavenger to 1% CBWFQ&#xA;Router(config-pmap-c)# class class-default&#xA;Router(config-pmap-c)#  bandwidth percent 25&#xA; ! Provisions 25% CBWFQ for default (Best-Effort) class&#xA;Router(config-pmap-c)#  fair-queue&#xA; ! Enables fair-queuing pre-sorter on default (Best-Effort) class&#xA;Router(config-pmap-c)#  queue-limit 128 packets&#xA; ! Expands queue-limit to 128 packets&#xA;Router(config-pmap-c)#   random-detect dscp-based&#xA; ! Enables DSCP-based WRED on default (Best-Effort) class&#xA;Router(config-pmap-c)#   random-detect dscp default 100 128&#xA; ! Tunes WRED min and max drop-thresholds for DF/0 to 100 and 128 packets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This policy has even more classes for interactive traffic and also more classes for different types of data and a management class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally you have to apply the policy to an interface like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;int gix/x&#xA;service-policy output WAN-EDGE-12-CLASS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a link to &lt;a href=&quot;http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND_40/QoSWAN_40.html&quot; rel=&quot;noreferrer&quot;&gt;WAN QoS CVD.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-20T10:24:11.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="640" PostTypeId="1" AcceptedAnswerId="641" CreationDate="2013-05-20T10:55:26.073" Score="27" ViewCount="114830" Body="&lt;p&gt;For investigating a problem in client to server communication, I need to capture packets for analysis. However it's not allowed to install a packet analyzer, such as Wireshark or tcpdump, on client or server. They client is connected to a Catalyst 3560 and the server to a Catalyst 3750 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I plugin my laptop to a switchport for capturing traffic with my laptop's packet analyzer, and how?&lt;/p&gt;&#xA;" OwnerUserId="231" LastActivityDate="2016-05-18T14:03:55.333" Title="How can I capture traffic on Cisco IOS switches?" Tags="|cisco|monitoring|cisco-ios|wireshark|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="641" PostTypeId="2" ParentId="640" CreationDate="2013-05-20T10:55:26.073" Score="37" Body="&lt;p&gt;The client switchport or the server switchport can be monitored. A third switchport can be configured as a &lt;em&gt;mirror port&lt;/em&gt;. This means that this mirror port will receive copies of all packets on the corresponding original port, while the original traffic won't be affected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, on the Catalyst 3560:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Enter configuration mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Define the source and set the session number:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;monitor session 1 source interface fa 0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, the session number can be from 1 to 66, you could also specify a VLAN or an ethernet channel. Also, interface ranges such as &lt;code&gt;fa 0/25 - 26&lt;/code&gt; are possible, and interface list, such as &lt;code&gt;fa 0/24,fa 0/26&lt;/code&gt;, if you would like to monitor several clients at the same time. Also by repeating the command you can add ports, or remove using &lt;code&gt;no&lt;/code&gt;. Mixing ports and VLANs is not possible in the same session, another restriction is that you cannot use a destination port as a source port. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Define the destination port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;monitor session 1 destination interface gi 0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use a normal port, but not a VLAN. Similarly to above, a destination port cannot be a source port: a port used here can either be a source or a destination port, and only of one session. Again, you can specify multiple ports like above.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You may want to &lt;code&gt;exit&lt;/code&gt; configiration mode and save the config.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You may have a look at your defined session - here multiple ports, tried like above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show monitor session 1&#xA;Session 1&#xA;---------&#xA;Type                   : Local Session&#xA;Source Ports           :&#xA;    Both               : Fa0/24,Fa0/25-26&#xA;Destination Ports      : Fa0/48,Gi0/1&#xA;    Encapsulation      : Native&#xA;          Ingress      : Disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see an encapsulation here - optionally you can set it to &lt;code&gt;replicate&lt;/code&gt; for replicating the source interface encapsulation method, such as by adding &lt;code&gt;encapsulation replicate&lt;/code&gt; after the source interface. Furthermore, you can specify a direction (&lt;code&gt;tx&lt;/code&gt;, &lt;code&gt;rx&lt;/code&gt;, &lt;code&gt;both&lt;/code&gt;), filter VLANs and more. The &lt;code&gt;Ingress: Disabled&lt;/code&gt; line means that the switch will not accept any frames presented to it by your capture device on a destination port. For such finer details and for further restrictions and default settings have a look at the command reference of the IOS version of your switch. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Once you configured source and destination port, you can capture the traffic using your laptop connected to the destination port, for example with Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number of source sessions can be limited, for example the 3560 supports a maximum of 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the capturing, don't forget to remove this session configuration.&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="47" LastEditDate="2013-05-20T14:26:46.747" LastActivityDate="2013-05-20T14:26:46.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="642" PostTypeId="2" ParentId="636" CreationDate="2013-05-20T11:58:08.943" Score="3" Body="&lt;p&gt;A few things to round out javano's answer:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Remember that 40g and 100g ethernet can be considered bundles, albeit not the same as LACP, but 4x10, 4x25 &amp;amp; 10x10&lt;/li&gt;&#xA;&lt;li&gt;On some hardware (Some of the higher end Juniper's for example) BFD is handled on the line card which can be a benefit (no loss under high RE load) or a deficit (no immediate loss if the RE dies)&lt;/li&gt;&#xA;&lt;li&gt;Running BFD over a link/path that's already a SPOF (eg, single fibre bundle) can be worse than just upping carrier-delay&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-20T11:58:08.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="643" PostTypeId="1" AcceptedAnswerId="650" CreationDate="2013-05-20T12:12:25.007" Score="13" ViewCount="2699" Body="&lt;p&gt;I have difficulty in deriving a mathematical model/equation to estimate the round trip latency between two nodes communicating using TCP/IP. The nodes are exchanging data based on HTTP protocol. In this model, the most important factors to study are physical distance between two nodes in the network, number of intermediate hops, bandwidth, processing delay at each hop. I searched the web but could not find anything in this sense, rather found something about circuit switching networks and UDP protocol. Can I customize them to fit in TCP?&lt;/p&gt;&#xA;" OwnerUserId="695" LastEditorUserId="8499" LastEditDate="2018-10-27T02:14:03.210" LastActivityDate="2018-10-27T02:14:03.210" Title="How can I formulate the communication latency in TCP/IP?" Tags="|ipv4|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="644" PostTypeId="1" AcceptedAnswerId="645" CreationDate="2013-05-20T12:14:16.593" Score="16" ViewCount="239294" Body="&lt;p&gt;On a site-to-site VPN using a ASA 5520 and 5540, respectively, I noticed that from time to time traffic doesn't pass any more, sometimes just there's even missing traffic just for one specific traffic selection / ACL while other traffic over the same VPN is running. It happens even though there's a constant ping running. The reason might be that it runs over a satellite link which isn't perfectly stable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I reset the VPN to the working state, instead of reloading one of the ASAs?&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="623" LastEditDate="2013-05-30T11:48:31.477" LastActivityDate="2020-01-21T08:13:00.313" Title="How can I reset a VPN tunnel on a Cisco ASA?" Tags="|cisco|cisco-asa|vpn|cisco-commands|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="645" PostTypeId="2" ParentId="644" CreationDate="2013-05-20T12:14:16.593" Score="29" Body="&lt;p&gt;The VPN can be reset by entering&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clear crypto ipsec sa peer &amp;lt;remote-peer-IP&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on one side. The following traffic will cause the IPSEC tunnel to be reestablished.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do it on your side, entering the remote IP. Or login to the remote site, but possibly you have to do it outside the VPN, so using a different interface, for example using the public IP instead of the IP to which you connect through the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will be a short VPN outage while reestablishing the tunnel. After entering that command, ensure that the tunnel is up again, such as doing a ping through it.&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="64578" LastEditDate="2020-01-21T08:13:00.313" LastActivityDate="2020-01-21T08:13:00.313" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="646" PostTypeId="2" ParentId="643" CreationDate="2013-05-20T12:22:07.887" Score="4" Body="&lt;p&gt;You can estimate the round trip latency by taking a packet capture on either side, then measure the delay between requests going out from the monitored machine and responses coming back. For example, if you mark the time a SYN went out to the remote machine, then marked the time the SYN+ACK response came in, the difference would give you a pretty good ballpark of the round trip TCP latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that this will be greater than the true network latency, and how much greater depends on how heavily loaded either machine is.&lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2013-05-20T12:22:07.887" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="647" PostTypeId="2" ParentId="643" CreationDate="2013-05-20T12:37:10.800" Score="4" Body="&lt;p&gt;The delay between two hosts will be dependent on several factors:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Propagation delay&lt;/li&gt;&#xA;&lt;li&gt;Serialization delay&lt;/li&gt;&#xA;&lt;li&gt;Queueing/buffering delay&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Propagation delay&lt;/strong&gt; is how long time it takes physically for the packets to travel between two locations. Speed of light in fibre is around 200000 km/s. Sweden where I live is around 1570 km so that would be 7.85 ms but in reality it's more because that is the distance via birds view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Serialization delay&lt;/strong&gt; is how much time it takes to seralize the packet through the physical medium, that is the interfaces on the networking device. If you have a 2 Mbit connection and you are sending a 1500 byte packet that would be 6 ms to serialize the packet(12000/2000000).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Queueing/buffering delay&lt;/strong&gt; is how much time the packet has to stay in a queue/buffer before being sent out on the interface. Depending on the speed on the interface and how large buffers are used this could be next no nothing or a significant delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there would be some delay on the hosts to generate the packets and for the application to handle them. There are applications to measure HTTP delay. People don't accept much delay on web sites before giving up on them so it's an important factor.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-20T12:37:10.800" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="648" PostTypeId="2" ParentId="636" CreationDate="2013-05-20T12:47:59.540" Score="5" Body="&lt;p&gt;I have seen two reasons why BFD hasn't been implemented:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Ignorance of it (I was guilty of this for some time).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Cost, if you're a Cisco shop.  Although possibly negligible depending on the size of your organization, there is now an associated licensing cost to implement BFD.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As of the ISR G2/ASR timeframe, BFD is no longer in the &quot;IP Base&quot; licensing package.  You have to upgrade to at least the &quot;Data&quot; licensing level to unlock BFD.  See this &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps10616/white_paper_c11_556985_ps10537_Products_White_Paper.html#wp9000807&quot; rel=&quot;noreferrer&quot;&gt;white paper&lt;/a&gt; from Cisco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This licensing requirement may not be an issue, as you may already be purchasing a higher licensing level for other features, but it is something to be aware of.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-05-20T12:47:59.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="649" PostTypeId="2" ParentId="199" CreationDate="2013-05-20T13:05:22.270" Score="5" Body="&lt;p&gt;Seems like you are hitting bug CSCtq86186. This bug has been found on 3750s, 2960s, but it may be affecting the blade switches as well.&lt;/p&gt;&#xA;" OwnerUserId="613" LastActivityDate="2013-05-20T13:05:22.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="650" PostTypeId="2" ParentId="643" CreationDate="2013-05-20T13:08:12.397" Score="9" Body="&lt;p&gt;This is a very complicated process, so to formulate an equation that could be useful for accurately predicting RTTs is extremely difficult. At best, I would say you could create a model that using a bunch of averages for each stage, that you could tweak if you happen to &quot;know better&quot; for a particular situation is about as close as you can get. This is something I am presently studying so I can tell you what I know so far (from the ground up, starting at the physical layer):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;See my questions on the Electronics SE; &lt;a href=&quot;https://electronics.stackexchange.com/questions/49206/encoding-delay-of-ethernet-and-the-relation-to-cable-frequency-rating&quot;&gt;Encoding delay of Ethernet and the relation to cable frequency rating&lt;/a&gt; and &lt;a href=&quot;https://electronics.stackexchange.com/questions/45492/speed-of-electricity-signal-propagation-through-copper-for-communications-del&quot;&gt;Speed of electricity (signal propagation?) through copper for communications delay&lt;/a&gt;. Since you would be using standardised speeds (100Mbps, 1Gbps, 10Gbps etc), don't treat fibre or copper differently. The &quot;delay&quot; down the two is near as damn it the same, but copper can't carry a signal as far obviously. I have &lt;a href=&quot;https://physics.stackexchange.com/questions/44869/light-group-velocities&quot;&gt;this question&lt;/a&gt; on the Physics SE site, which I do know the answer to now. I just need to find the time to right it up, so keep an eye on that if you are interested (I will be posting some more telecoms-use-of-fibre related questions to which I now know the answer when I get a chance).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Much more delay is going to be added in by the devices at the end of a link. There is no standard way of saying &quot;oh 2 switches along a path is Xms delay, 4 switches is 2*Xms, 2 routers is Yms...etc&quot;. Assuming you are using say 1Gpbs for example and the devices in the path forward at line rate, we know that is 1000000000bps, so the physical interface is running at a fixed encoding rate (ranging from 1 nanosecond per bit up to whatever the max of the symbol encoding scheme in use is, such as &lt;a href=&quot;http://en.wikipedia.org/wiki/8b/10b_encoding&quot; rel=&quot;nofollow noreferrer&quot;&gt;10b&lt;/a&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There are three main kinds of delay (at the physical layer) you need to be aware of and factor in; Serialisation delay, encoding delay, propagation delay (and processing delay, queueing delay, encode and decoding delay, but these are above the physical layer but need mentioning!). These are reasonably well documented on the Internet, &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=606583&quot; rel=&quot;nofollow noreferrer&quot;&gt;VoIP: An In-Depth Analysis&lt;/a&gt;, Slide 13 &lt;a href=&quot;http://www.swinog.ch/meetings/swinog5/8-Designing%20and%20deploying%20a%20VoIP%20network.ppt&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, loads on &lt;a href=&quot;http://scholar.google.com/scholar?q=serialisation%20delay%20propagation%20delay&amp;amp;hl=en&amp;amp;as_sdt=0&amp;amp;as_vis=1&amp;amp;oi=scholart&amp;amp;sa=X&amp;amp;ei=WRyaUZztG_Cd0wWduYCYAg&amp;amp;ved=0CCsQgQMwAA&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google Scholar&lt;/a&gt;, and many more.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As we move up the protocol stack, I would work on the assumption that the destination MAC is in each switches cam table, and at the IP layer, the destination MAC in ARP tables. The extra delay induced by these discovery processes only occurs for the first packet in a flow so they can be circumvented by raising time-outs and sending gratuitous ARPs etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As you get to the application layer this is going to get really difficult because this depends on the server (for example) processing the request, which will be subject to interrupt delay. The number of interrupts required to process the request and context switches due to load is unpredictable.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would very much like to help you with your question, sadly this is all I have time for right now. I will update this answer maybe later tonight or tomorrow, I wanted to post what I have so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the mean time, most people tend to work with the figure for the delay at a physical copper/fibre layer of around 0.6*c (C = speed of light). Also, you need to think about TCP's exchange of ACKs every X packets, which differs if you are using SACK for example, and if you're using jumbo frames and/or larger MSS size (now MTU needs to be factored in also!), if you're sending more in-between ACKs (if volume of data transferred is of interest to you). You also need to factor in the infamous &lt;a href=&quot;http://en.wikipedia.org/wiki/Bandwidth-delay_product&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bandwidth Delay Product&lt;/a&gt; and don't make the stupid misinterpretation that &lt;a href=&quot;https://serverfault.com/questions/404818/bandwidth-delay-product&quot;&gt;I did&lt;/a&gt; of that page. I started making various simple (and very ugly) data calculators &lt;a href=&quot;http://null.53bits.co.uk/uploads/programming/javascript/data-calcs.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. Again a work in progress I will try and update them soon. I plan to add a calculator similar to what you are trying to do. I have also made some light and fibre calculators if you are interested, but again, no time!, I haven't gotten round to uploading them yet. I will try ASAP to update this answer some more, in the coming days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;P.S. I forgot to mention QoS! If QoS is in play anywhere in the path, it's going to get really tough to caluclate the RTT!&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="-1" LastEditDate="2017-04-13T12:40:14.187" LastActivityDate="2013-05-20T13:08:12.397" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="651" PostTypeId="2" ParentId="643" CreationDate="2013-05-20T13:12:42.083" Score="6" Body="&lt;p&gt;(I want to point out that others have posted &lt;em&gt;excellent&lt;/em&gt; answers about how the delays et al work and what causes them. But the OP asked about modeling; A basic model is simple and you just plug in example numbers. If you want to know &lt;em&gt;why&lt;/em&gt; the delays are what they are, then see everyone else's answers :^)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network latency is simply the &lt;strong&gt;transit time from one end point across to the other end point, spanning N hops between&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you have N segments (hops) with N-1 intermediate nodes. Each node has a delay (the cumulative effect of several things on that node, like queue delay, processing delays, etc), and each segment has a transit delay. Overall that's &lt;strong&gt;2N - 1 independent variables. So it's seg1 +node1 +seg2 ... +node(N-1) +segN&lt;/strong&gt;  One hop, is just =seg1 , two hopes is seg1 +node1 +seg2, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next you have to define what all those pieces are. So you might construct a model network with a CATV network, a satellite link, a fiber optic link, an ethernet, etc. For each of those technologies you have to look up example information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The transit delays would be approximately the data size divided by the transmission speed of the segment. If you need a more accurate model, you have add the flight time lag -- approximately the length of the segment, divided by the speed of data flow (approximate the speed of light.) This DOES matter if you have a satellite link involved; The up-and-down to the the geosynchronous satellite is significant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The delays on each node you will have to estimate based on what equipment you are placing into your model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want the application latency, (for example the delay until the start of an FTP transfer's data flow,) then you build up by counting how many times your network latency comes into play. For example, a 3-way TCP handshake adds triple-the network latency, and so on building up to what the application sees.&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2013-05-20T13:17:52.430" LastActivityDate="2013-05-20T13:17:52.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="652" PostTypeId="2" ParentId="640" CreationDate="2013-05-20T13:21:50.920" Score="17" Body="&lt;p&gt;If your traffic happened to be passing through a router running Cisco IOS 12.4(20)T&#xA;or greater, another possibility is to use the Embedded Packet Capture feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This feature is NOT available on switch platforms like the 3560 or 3750.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What this feature does is capture and save a small PCAP file on the router that you can download and analyze with Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;a href=&quot;http://routerjockey.com/2011/02/14/ios-embedded-packet-capture/&quot;&gt;few&lt;/a&gt; &lt;a href=&quot;https://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_packet_capture.pdf&quot;&gt;links&lt;/a&gt; with &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps10777/ppt_EASy_Packet_Capture_c78-577851.pdf&quot;&gt;details&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-20T13:21:50.920" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="653" PostTypeId="1" AcceptedAnswerId="654" CreationDate="2013-05-20T13:30:08.600" Score="48" ViewCount="103386" Body="&lt;p&gt;On a large Cisco Catalyst switch stack, almost all switchports are patched. I need to identify the ports, which are not in use, for connecting further devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following switchports, cabling, patch fields and sockets to possible end devices is laborious and even then there could be temporarily used sockets. Looking at the activity of port LEDs is not reliable, since a user device can be shut off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the easiest way to detect all unused switchports via IOS commands?&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="623" LastEditDate="2013-05-30T11:47:51.253" LastActivityDate="2017-01-25T22:01:37.370" Title="How can I see which switchports are not in use?" Tags="|cisco|cisco-catalyst|cisco-commands|cisco-ios|" AnswerCount="24" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="654" PostTypeId="2" ParentId="653" CreationDate="2013-05-20T13:30:08.600" Score="42" Body="&lt;p&gt;I frequently use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh int | i (FastEthernet|0 packets input)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or the same with GigabitEthernet, whatever kind of interfaces I want to check.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;sh int&lt;/code&gt; (which is &lt;code&gt;show interfaces&lt;/code&gt;) gives a huge list of ste status of all interfaces&lt;/li&gt;&#xA;&lt;li&gt;The pipe symbol &lt;code&gt;|&lt;/code&gt; can be used for filtering, but also in search expressions &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;| i&lt;/code&gt; (for &lt;code&gt;include&lt;/code&gt;) filters the output which matches the following search expressions&lt;/li&gt;&#xA;&lt;li&gt;I use &lt;code&gt;(...|...)&lt;/code&gt; to match two conditions: the interface name and a status I like to see, we can use regular expressions here, like this &quot;or&quot; expression&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The output can look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;FastEthernet1/0/31 is up, line protocol is up (connected)&#xA;     95445640 packets input, 18990165053 bytes, 0 no buffer&#xA;FastEthernet1/0/32 is up, line protocol is up (connected)&#xA;FastEthernet1/0/33 is up, line protocol is up (connected)&#xA;FastEthernet1/0/34 is down, line protocol is down (notconnect)&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;FastEthernet1/0/35 is down, line protocol is down (notconnect)&#xA;FastEthernet1/0/36 is up, line protocol is up (connected)&#xA;FastEthernet1/0/37 is down, line protocol is down (notconnect)&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I can see my candidates, with actually 0 packets input over time, even if my expression matches numbers just ending with 0. I could make it more perfect, but being easy to remember is also a benefit. The interface names right before each 0 packets input lines are my candidates.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Check each chosen interface if it's really unused by &lt;code&gt;sh int &amp;lt;name&amp;gt;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;From time to time, it's good to clear the counters: &lt;code&gt;clear counters [type number]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It can be good practice, to leave unused switchports shutdown. So it's easy to identify them using &lt;code&gt;sh ip int bri&lt;/code&gt; or the like. And you don't run into problems if you use a switchport which was definitly shut off before.&lt;/p&gt;&#xA;" OwnerUserId="231" LastActivityDate="2013-05-20T13:30:08.600" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="655" PostTypeId="5" CreationDate="2013-05-20T13:56:09.707" Score="0" Body="&lt;p&gt;Wireshark is a free and open-source packet analyzer for use in network troubleshooting, analysis, protocol development, and education. It was originally named Ethereal, but was renamed Wireshark in May 2006 due to trademark issues.&lt;/p&gt;&#xA;" OwnerUserId="165" LastEditorUserId="8499" LastEditDate="2016-11-29T22:41:05.237" LastActivityDate="2016-11-29T22:41:05.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="656" PostTypeId="4" CreationDate="2013-05-20T13:56:09.707" Score="0" Body="For questions about Wireshark, a packet analyzer" OwnerUserId="947" LastEditorUserId="947" LastEditDate="2017-02-26T02:33:06.770" LastActivityDate="2017-02-26T02:33:06.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="657" PostTypeId="2" ParentId="653" CreationDate="2013-05-20T14:31:45.667" Score="12" Body="&lt;p&gt;I also like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh int | inc line protocol is|Last input&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which outputs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/29 is down, line protocol is down (notconnect)&#xA;  Last input never, output never, output hang never&#xA;FastEthernet0/30 is up, line protocol is up (connected)&#xA;  Last input never, output 00:00:07, output hang never&#xA;FastEthernet0/46 is down, line protocol is down (notconnect)&#xA;  Last input never, output 6d23h, output hang never&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output parameter tells you when the port last saw traffic which is useful for identifying those ports that are only occasionally used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Also worth noting (for reasons beyond the scope of this question) is that &quot;Last input&quot; is almost always &quot;never&quot;&lt;/p&gt;&#xA;" OwnerUserId="176" LastEditorUserId="176" LastEditDate="2013-05-20T16:04:39.733" LastActivityDate="2013-05-20T16:04:39.733" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="658" PostTypeId="2" ParentId="653" CreationDate="2013-05-20T14:52:57.407" Score="5" Body="&lt;p&gt;I always use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interfaces status&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It sums it al up nice and dandy.&lt;/p&gt;&#xA;" OwnerUserId="209" LastEditorUserId="49" LastEditDate="2013-05-20T15:18:19.263" LastActivityDate="2013-05-20T15:18:19.263" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="659" PostTypeId="2" ParentId="653" CreationDate="2013-05-20T15:16:18.933" Score="11" Body="&lt;p&gt;I like @Stefan's answer but with this command line &quot;sh int | i (Ethernet| 0 packets input)&quot; which now grabs all Ethernet interface types and filters out non-zero numbers that happen to end in zero.  He mentioned that some fine tuning might be possible so this is just one example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  sh int counters | i (Port|_0             0             0             0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yes, the whitespace is needed. The easiest way to get the spaces right is do &quot;sh int counters&quot; and copy a line with all zeros. One gotcha here is that half-way down the list changes from Input, which we want, to Output, which we don't care about for finding unused ports.  It has the advantage of showing ONLY the ports with no input so you don't have to weed out the in-use ports like you do with Stefan's method.&lt;/p&gt;&#xA;" OwnerUserId="165" LastEditorUserId="775" LastEditDate="2013-05-22T15:48:13.117" LastActivityDate="2013-05-22T15:48:13.117" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="660" PostTypeId="2" ParentId="613" CreationDate="2013-05-20T15:26:24.117" Score="0" Body="&lt;p&gt;Did your initial requirements include a cost limit? The device count might seem high, however $1200 is very cheap with regards to network equipment. You could use one device to solve the problem but you will need a device that supports different modules, higher port count, different licenses, etc. The more flexible the network device, the higher the cost. What model/brand of router is used in your solution?  &lt;/p&gt;&#xA;" OwnerUserId="446" LastActivityDate="2013-05-20T15:26:24.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="661" PostTypeId="2" ParentId="653" CreationDate="2013-05-20T15:33:55.247" Score="11" Body="&lt;p&gt;I would scrape the output (or grab it with SNMP, even better) and use standard UNIX tools to parse it.  Here's an easy example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, I saved a partial output from 'show int counters' (just for demo purposes) to a file called &quot;counters&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mkantows@ochofu049]$ cat counters&#xA;Port            InOctets    InUcastPkts    InMcastPkts    InBcastPkts&#xA;Gi1/0/1                0              0              0              0&#xA;Gi1/0/2      94949242720      556137619         571828          57745&#xA;Gi1/0/3       1522191492        8663327        1105299          55269&#xA;Gi1/0/4       3743856345       18565173        1275617          53658&#xA;Gi1/0/5                0              0              0              0&#xA;Gi1/0/6                0              0              0              0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, just use awk to produce a report of all ports that have all four counter fields at zero:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mkantows@ochofu049]$ cat counters | awk '{if ($2 == 0 &amp;amp;&amp;amp; $3 == 0 &amp;amp;&amp;amp; $4 == 0 &amp;amp;&amp;amp; $5 == 0) print $1}'&#xA;Gi1/0/1&#xA;Gi1/0/5&#xA;Gi1/0/6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The main idea here is to get whatever data you are using off of the device so you can do more intelligent/complex/simpler/whatever parsing and reporting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE&lt;/strong&gt; For multiple devices, using a Linux utility like &quot;screen&quot; to log output from a tty connection can make it really efficient for quickly finding unused ports on multiple cisco devices.  (in one log file)&#xA;run a command like the following...    where &quot;HOSTNAME&quot; is a universal part of your Cisco device hostname scheme&#xA;cat counters | awk '{if ($1 == &lt;em&gt;HOSTNAME&lt;/em&gt;) || ($2 == 0 &amp;amp;&amp;amp; $3 == 0 &amp;amp;&amp;amp; $4 == 0 &amp;amp;&amp;amp; $5 == 0) print $1}'&lt;/p&gt;&#xA;" OwnerUserId="407" LastEditorUserId="33839" LastEditDate="2017-01-25T22:01:37.370" LastActivityDate="2017-01-25T22:01:37.370" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="662" PostTypeId="5" CreationDate="2013-05-20T16:10:51.753" Score="0" Body="&lt;p&gt;TRILL is short for Transparent Interconnection of Lots of Links.  It is an IETF standard way to provide redundancy at Layer 2, while using Layer 3 routing techniques.  See the following for more information:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.ietf.org/html/rfc5556&quot; rel=&quot;nofollow&quot;&gt;RFC 556&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;http://datatracker.ietf.org/wg/trill/charter/&quot; rel=&quot;nofollow&quot;&gt;TRILL Working Group&lt;/a&gt; page on the IETF website.&lt;/li&gt;&#xA;&lt;li&gt;The Internet Protocol Journal, Volume 14, Number 3: &lt;a href=&quot;http://www.cisco.com/web/about/ac123/ac147/archived_issues/ipj_14-3/143_trill.html&quot; rel=&quot;nofollow&quot;&gt;Introduction to Trill&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-05-21T14:41:50.920" LastActivityDate="2013-05-21T14:41:50.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="663" PostTypeId="4" CreationDate="2013-05-20T16:10:51.753" Score="0" Body="TRILL is short for Transparent Interconnection of Lots of Links.  It is an IETF standard way to provide redundancy at Layer 2, while using Layer 3 routing techniques." OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-05-21T14:42:37.627" LastActivityDate="2013-05-21T14:42:37.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="664" PostTypeId="1" AcceptedAnswerId="666" CreationDate="2013-05-20T16:33:17.520" Score="14" ViewCount="16478" Body="&lt;p&gt;Why is it that when I perform a &lt;code&gt;show interface&lt;/code&gt; command I see that &lt;code&gt;Last input&lt;/code&gt; always shows &lt;code&gt;never&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet1/31 is up, line protocol is up (connected)&#xA;  Hardware is C6k 100Mb 802.3, address is 000d.bd5a.e94e (bia 000d.bd5a.e94e)&#xA;  Description: Server&#xA;  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Full-duplex, 100Mb/s&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  **Last input never**, output 00:03:19, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 1y3w&#xA;  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 2000 bits/sec, 4 packets/sec&#xA;  5 minute output rate 13000 bits/sec, 20 packets/sec&#xA;     148174387 packets input, 16331478383 bytes, 0 no buffer&#xA;     Received 465 broadcasts (0 multicast)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     798328682 packets output, 102549789248 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, when I run the command a couple minutes later the other counters have incremented.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet1/31 is up, line protocol is up (connected)&#xA;  Last input never, output 00:01:39, output hang never&#xA;  5 minute input rate 2000 bits/sec, 4 packets/sec&#xA;  5 minute output rate 14000 bits/sec, 20 packets/sec&#xA;     148176042 packets input, 16331609502 bytes, 0 no buffer&#xA;     798337129 packets output, 102550523914 bytes, 0 underruns&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="176" LastEditorUserId="178" LastEditDate="2013-05-20T16:36:50.640" LastActivityDate="2013-05-20T17:27:34.577" Title="Why does &quot;show interface&quot; show &quot;Last input never&quot; when packets input is incrementing?" Tags="|switch|cisco-6500|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="665" PostTypeId="2" ParentId="644" CreationDate="2013-05-20T16:35:24.340" Score="15" Body="&lt;p&gt;You can reset the tunnel via the ASDM software as well as in the command line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the ASDM (Version 6.3): &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Go to Monitoring, then select VPN from the list of Interfaces&lt;/li&gt;&#xA;&lt;li&gt;Then expand VPN statistics and click on Sessions.&lt;/li&gt;&#xA;&lt;li&gt;Choose the type of tunnel you're looking for from the drop-down at the right (IPSEC Site-To-Site for example.)&lt;/li&gt;&#xA;&lt;li&gt;Click on the tunnel you wish to reset and then click Logout in order to reset the tunnel.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This will cause a temporary outage of the VPN connection, but in most cases I've seen, you're only doing this because the tunnel is already down.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All things considered though, it is easier to log into the CLI and reset the tunnel, but I know some folks who are addicted to the ASDM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/products/ps6121/products_tech_note09186a0080aaeff5.shtml#prblm10&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-05-20T16:41:29.370" LastActivityDate="2013-05-20T16:41:29.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="666" PostTypeId="2" ParentId="664" CreationDate="2013-05-20T16:36:22.280" Score="8" Body="&lt;p&gt;There are several interface counters that don't work as well as they used to.  Sometimes this is because the chassis/router has a 'fast' switching mode (CEF, or something else), and that particular 'bucket' never gets hit.  Another reason might be that that particular counter only works in L3 mode instead of L2 mode.  This kind of stuff is quite common, unfortunately on cisco products, particularly on the 6500 which has an enormous amount of legacy code/architecture weighing it down.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2013-05-20T16:36:22.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="667" PostTypeId="1" AcceptedAnswerId="677" CreationDate="2013-05-20T16:41:18.770" Score="8" ViewCount="993" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/o76RN.jpg&quot; alt=&quot;https://i.stack.imgur.com/InaQQ.jpg&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help enlighten me, do these connectors have a formal name/standard? These are found in a street side ISP broadband cabinet for residential customers in the UK. Would I be correct in thinking that each of these cables goes direct to a customers home?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it not be quite trivial then to initiate a physical Man-in-the-middle attack against a specific target? What is the purpose of all the 'messy' wiring to the right of the pic?&lt;/p&gt;&#xA;" OwnerUserId="703" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:47.147" LastActivityDate="2015-06-19T17:26:19.560" Title="What is the name of these broadband street cabinet connectors, and are they secure?" Tags="|security|architecture|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="668" PostTypeId="2" ParentId="667" CreationDate="2013-05-20T17:00:27.833" Score="6" Body="&lt;p&gt;It looks like they are regular &lt;a href=&quot;http://en.wikipedia.org/wiki/F_connector&quot; rel=&quot;noreferrer&quot;&gt;F connectors&lt;/a&gt;. The unused connectors appear to have a protective cover on them.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-20T17:00:27.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="669" PostTypeId="2" ParentId="653" CreationDate="2013-05-20T17:06:37.040" Score="29" Body="&lt;p&gt;Ultimately... DOCUMENTATION.  You need to know where every patch cable goes to be 100% certain you aren't disconnecting something someone may expect to work at some point.  Just because a port is currently &quot;down&quot; doesn't mean someone has not been using it.  Also just because the counters are currently zero doesn't mean it's never been used or not going to be used again in the (near) future -- counters can be cleared, and counters reset to zero at boot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've worked at ISPs and large enterprises, and documentation is the key to knowing what's what.  Without it, random guessing will lead to numerous bad days... customers get rather pissed when you run their DSL line to someone else, duplicate an address assignment, shutdown the wrong interface, etc.  Enterprise wiring closets can be a real mess; without documentation, tracing dozens of cables among thousands can be a pain (and something as simple as port descriptions count.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-05-01T04:10:39.783" LastActivityDate="2014-05-01T04:10:39.783" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="670" PostTypeId="2" ParentId="664" CreationDate="2013-05-20T17:27:34.577" Score="4" Body="&lt;p&gt;Most switch traffic is now processed entirely in hardware (i.e. the ASICs) as this is the fastest/best way to do so.  The last input and output fields are only updated when there is traffic that is software or process switched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On some platforms there are features that you can enable that will cause traffic to be processed in software, which will decrease switch performance.  These fields are nice to still have around so you can see when traffic is not being hardware switched. &lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-20T17:27:34.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="671" PostTypeId="2" ParentId="565" CreationDate="2013-05-20T17:33:31.480" Score="2" Body="&lt;p&gt;There should not be obvious difference if you don't have any cfg changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you want to use Netflow v9 or IPFIX in new template format in new IOS versions.&lt;/p&gt;&#xA;" OwnerUserId="716" LastActivityDate="2013-05-20T17:33:31.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="672" PostTypeId="1" AcceptedAnswerId="673" CreationDate="2013-05-20T17:44:43.627" Score="8" ViewCount="18410" Body="&lt;p&gt;How can I perform a packet analysis on traffic flowing through a Brocade XMR, MLX, CER or CES without having to install a specific software on any of the remote endpoints ?&lt;/p&gt;&#xA;" OwnerUserId="564" LastActivityDate="2013-05-21T00:30:43.470" Title="How can I capture traffic on a Brocade XMR, MLX, CER or CES?" Tags="|monitoring|brocade|wireshark|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="673" PostTypeId="2" ParentId="672" CreationDate="2013-05-20T17:44:43.627" Score="8" Body="&lt;p&gt;The best solution is to plug a computer running a packet analysis software like &lt;a href=&quot;http://www.wireshark.org&quot;&gt;Wireshark&lt;/a&gt; to an unused port and duplicate the traffic to this port. This is called &lt;strong&gt;mirroring&lt;/strong&gt; and &lt;strong&gt;monitoring&lt;/strong&gt;. Here is how to do this on a Brocade &lt;a href=&quot;http://www.brocade.com/products/all/routers/product-details/netiron-mlx-series/index.page&quot;&gt;MLX&lt;/a&gt;, &lt;a href=&quot;http://www.brocade.com/products/all/routers/product-details/netiron-xmr-series/index.page&quot;&gt;XMR&lt;/a&gt;, &lt;a href=&quot;http://www.brocade.com/products/all/routers/product-details/netiron-cer-2000-series/index.page&quot;&gt;CER&lt;/a&gt; or &lt;a href=&quot;http://www.brocade.com/products/all/switches/product-details/netiron-ces-2000-series/index.page&quot;&gt;CES&lt;/a&gt; :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First configure the &lt;em&gt;mirroring&lt;/em&gt; port. This is the port you will plug you packet analyzer, &lt;code&gt;ethe 3/1&lt;/code&gt; here.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Brocade(config)# mirror-port ethernet 3/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, go to a port where the traffic you want to see is flowing (here, &lt;code&gt;ethe 4/1&lt;/code&gt;), and specify this is a monitored port, and where you want the traffic to be sent :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Brocade(config)# interface ethernet 4/1&#xA;Brocade(config-if-4/1)# monitor ethernet 3/1 both&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note : &lt;code&gt;both&lt;/code&gt; can be replaced by either &lt;code&gt;input&lt;/code&gt; or &lt;code&gt;output&lt;/code&gt; if you only want to analyze input or output traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information, see the &lt;a href=&quot;http://www.brocade.com/downloads/documents/html_product_manuals/NI_05400a_CFG/wwhelp/wwhimpl/js/html/wwhelp.htm#href=Port_Params.06.15.html#1086983&quot;&gt;documentation&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are looking for the documentation for VDX products, see &lt;a href=&quot;http://www.brocade.com/downloads/documents/html_product_manuals/NOS_AG_301/wwhelp/wwhimpl/js/html/wwhelp.htm#href=CH_Configuring_SPAN.35.1.html#1103819&quot;&gt;here&lt;/a&gt;. For ICX devices, see &lt;a href=&quot;http://www.brocade.com/downloads/documents/html_product_manuals/FI_07400a_CFG/wwhelp/wwhimpl/js/html/wwhelp.htm#href=FI_Mirroring.27.1.html#1081553&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="564" LastActivityDate="2013-05-20T17:44:43.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="674" PostTypeId="1" AcceptedAnswerId="43185" CreationDate="2013-05-20T17:46:11.263" Score="10" ViewCount="437" Body="&lt;p&gt;As part of a new project, we have a requirement to terminate about 3000 IPsec connections on a Cisco ASA 5540 firewall. According to the specs, the maximum IPsec Peers this platform supports is 5000 so there shouldn't be a problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is what happens if if &lt;strong&gt;ALL&lt;/strong&gt; 3000 remote sites try to establish the IPsec connection at once ? For example if the upstream switch(es) die. It might not be all at once but depending on timers, it could be within a very small window , maybe 10 seconds or so. Will the ASA cope with all the incoming connections, resource wise ? What's the worst that can happen ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that thresholds for threat detection might have to be adjusted. The ASA won't do much besides terminating the IPsec connections. There will be no NAT, no inspection. It will participate in OSPF on the LAN side, all remote site networks will be summarized though. &lt;/p&gt;&#xA;" OwnerUserId="714" LastActivityDate="2017-08-12T08:32:25.407" Title="Will ASA 5540 support 3000 simultaneous IPsec connections?" Tags="|cisco-asa|vpn|ipsec|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="675" PostTypeId="2" ParentId="195" CreationDate="2013-05-20T17:59:17.707" Score="0" Body="&lt;p&gt;If you have Solar Winds Engineering Tool Kit, you can use &quot;WAN Killer&quot; between the two locations. Make sure your ACL's allow both ends to talk to each other this way, and flood with the appropriate level of echo's or discard's from Point A to B and visa versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We use this to test the networks ability to handle traffic across VPN and MPLS connections, whether it's measuring the raw throughput from A to B and the PPS from A to B.&lt;/p&gt;&#xA;" OwnerUserId="719" LastActivityDate="2013-05-20T17:59:17.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="676" PostTypeId="2" ParentId="674" CreationDate="2013-05-20T18:02:54.453" Score="7" Body="&lt;p&gt;In our HQ's DC, we have a dual 100 Mbps Internet Gateway Router (that's our bottle neck for the WAN). We've had 500-700 sites connect back after an outage at once with no issue - easily sustaining 2800 locations full time. The spec's say it can support 5000 total, just make sure you order the right Memory + CPU specs as well, more memory than anything else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your bottle neck will be your WAN connection from my experience.&lt;/p&gt;&#xA;" OwnerUserId="719" LastActivityDate="2013-05-20T18:02:54.453" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="677" PostTypeId="2" ParentId="667" CreationDate="2013-05-20T18:37:59.560" Score="10" Body="&lt;p&gt;&quot;Connectors&quot;??? The blue distribution block? (possibly a distribution amp) The little &quot;caps&quot; -- actually terminators? Or the RG-59 compression crimps on the cables?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's as secure as the cabinet. (which is often not that secure) Almost everything on a cable network these days is encrypted, so a physical tap wouldn't do as much good as you might think.  And it's all a shared medium anyway, anyone on that block can see everyone else's traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mess on the right appears to be analog POTS lines, but could be anything.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-20T18:37:59.560" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="678" PostTypeId="2" ParentId="553" CreationDate="2013-05-20T20:19:12.893" Score="3" Body="&lt;p&gt;I would recommend testing by moving to the Intel NIC as you have proposed. I have run into similar issues where a small percentage of the traffic was input errors. We trouble shot the problem by placing a dumb hub between server (in my case it was cameras) and the switch. If the switch no longer sees any input errors then the problem is the server NIC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried many of the same steps that you have proposed. In my case it turned out to be a bad manufacturing run. The only thing that corrected the issue was replacing the NIC (cameras). &lt;/p&gt;&#xA;" OwnerUserId="446" LastActivityDate="2013-05-20T20:19:12.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="679" PostTypeId="1" AcceptedAnswerId="700" CreationDate="2013-05-20T20:30:17.843" Score="6" ViewCount="1601" Body="&lt;p&gt;I'm working with a Solar Winds NPM/NTA/IPAM golden-trio. I'd like to customize our reports to the point where I can received daily, weekly or monthly emails for various things - 95th percentile errors, bandwidth utilization on ingress / egress (not netflow, from SNMP), up and downtime's, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless I am completely missing it, where would I &quot;click in&quot; to create and then modify these functions?&lt;/p&gt;&#xA;" OwnerUserId="719" LastEditorUserId="348" LastEditDate="2013-05-21T14:41:45.233" LastActivityDate="2013-05-21T14:41:45.233" Title="Daily, Weekly and Monthly Reports from Solarwinds?" Tags="|monitoring|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="680" PostTypeId="1" AcceptedAnswerId="727" CreationDate="2013-05-20T20:56:30.250" Score="5" ViewCount="2449" Body="&lt;p&gt;In the configuration for CIFS optimization, Steelhead offers an option to enable print optimization. From documentation I understood that when this option is checked the Steelhead will optimize the print traffic between print clients and a remote print server. Is this right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming my understanding is right, a different scenario comes to my mind. Let's say the print client and the print server are in the same site, but the printer is in a remote site. In this scenario, is the Steelhead able to perform optimization for print traffic between the print server and the remote printer?&lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-05-21T13:23:48.553" LastActivityDate="2013-05-21T13:28:22.947" Title="Is Riverbed Steelhead able to optimize print traffic between print server and a remote printer?" Tags="|riverbed|wan-optimizer|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="681" PostTypeId="2" ParentId="680" CreationDate="2013-05-20T21:01:26.170" Score="2" Body="&lt;p&gt;I'm so glad you asked this! We have IBM 4230-5I3's and 4247's that communicate back to a UVX platform or a Windows Print Server platform. Our Steel heads have printer optimization and it works well for both the WAN (over MPLS) or LAN (within the building on a different subnet/VLAN), but we've noticed the biggest benefit is always out to and from the WAN.&lt;/p&gt;&#xA;" OwnerUserId="719" LastActivityDate="2013-05-20T21:01:26.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="682" PostTypeId="2" ParentId="86" CreationDate="2013-05-20T21:25:41.743" Score="3" Body="&lt;p&gt;There is a trade off here.  Yes, it will increase the accuracy of your location services.  However it will increase the amount of &quot;useless&quot; data you gather as well (clients that are not part of your network), so you may need to consider the impact this has on your MSEs (i.e. if you are close to the MSE limitations already, you may have to look at adding additional MSEs or increasing the resources allocated to the VM).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each environment is different, so it may be the increased accuracy is worth it no matter how much useless data you gather.  It may be that so much useless information is gathered that the increased accuracy isn't a suitable trade-off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are in an environment where there are a fair number of other wireless networks in operation or a fairly large wireless network with lots of clients, you will likely end up with significantly more &quot;useless&quot; data.  A couple of examples where you might end up with a large amount of useless data would be if you are located in the middle of a number of high rise apartment buildings or right next to a university sports stadium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the increased accuracy is really only achieved by capturing data from devices you are concerned with when they are NOT connected to your network.  While Artanix brings up a great concern about rogue networks, I would be more concerned if devices I care about are connecting to other networks besides my own where my wireless network was operating.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-20T21:25:41.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="683" PostTypeId="2" ParentId="653" CreationDate="2013-05-20T21:33:41.800" Score="1" Body="&lt;p&gt;It's a little bit cheating, but if everything is only attached to one end device, you can turn on port security with sticky mac addresses.  Check back in a while (however long you expect is a reasonable amount of time to assume that someone would have used the computer or it doesn't exist) and the running config will show you if anything has used that port.  I'm pretty sure you can use sticky mac addresses with a max of more than 1 per interface just in case you're using VoIP phones and computers on the same port, but I'm not certain.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2013-05-20T21:33:41.800" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="684" PostTypeId="2" ParentId="653" CreationDate="2013-05-20T21:36:34.863" Score="3" Body="&lt;pre&gt;&lt;code&gt;sh int | i ( 0 packets input)|proto|Desc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The leading space with the 0 will exclude larger numbers that end in zero.&lt;/em&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's better to have ports shutdown (disabled) until they get used.  It's risky to change &lt;em&gt;switchport access vlan&lt;/em&gt;, for example, on a port that's already up unless you can be certain it's not in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output might look like below, telling us that the switchport on g8/18 is disabled with 0 packets since last counter clear while g8/19 is in use (from the absence of the &quot;0 packets input&quot;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GigabitEthernet8/18 is administratively down, line protocol is down (disabled)&#xA;  Description: 3a30&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;GigabitEthernet8/19 is up, line protocol is up (connected)&#xA;  Description: 4a25.vmhost112 (vmnic5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As for knowing which patch panel jack is involved, use the Description&#xA;  field to help you document.  Patch panels should be connected to&#xA;  switchports in a consistent manner, so it's easy to document as the patch panel jack to switchport is predictable.  I use&#xA;  the format &lt;em&gt;Rack-Row-Jack&lt;/em&gt; in the description + the hostname to track,&#xA;  but in a condensed way.  4b27 would be row rack 4, row b, jack 27&#xA;  followed by hostxyz or whatever the hostname.  So my descripton reads&#xA;  4b27.hostxyz.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-20T21:36:34.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="685" PostTypeId="1" AcceptedAnswerId="742" CreationDate="2013-05-20T22:00:42.870" Score="5" ViewCount="2153" Body="&lt;p&gt;&lt;strong&gt;PROBLEM:&lt;/strong&gt;&lt;br&gt;&#xA;Both FWSM in our core switches went active/active and protected subnets have partial accessibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SETUP:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;We have 2 x Cisco Catalyst 6509 switches running IOS version 12.2(18).  &lt;/li&gt;&#xA;&lt;li&gt;Each switch has a FWSM internal firewall module.  &lt;/li&gt;&#xA;&lt;li&gt;Both are multi-context split into 2 groups.  &lt;/li&gt;&#xA;&lt;li&gt;One FWSM should be active for both groups while the other FWSM should be standby.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DETAILS:&lt;/strong&gt;&lt;br&gt;&#xA;We upgraded our 6509s to IOS version 12.2(33).  This bounced each switch.  After the upgrade we noticed that both FWSM were active (not a good thing).  We ended up reverting the IOS on both 6509s, but both FWSM remained active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before the upgrade our busiest context was at 97% memory utilization measured by the message received after modifiying the rule set on the command line.  Now the rules won't compile fully and we're left with a partial config. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show memory&lt;/code&gt; shows 67% free memory out of 1gig of RAM.&lt;br&gt;&#xA;&lt;code&gt;show resource acl&lt;/code&gt; shows 12 partitions and the 97% memory utilized context has only 6,053 out of a max of 14,173 rules in use.&lt;br&gt;&#xA;&lt;code&gt;show failover&lt;/code&gt; shows each FWSM thinks it is the secondary and its mate is unknown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have one of the FWSMs powered off and are trying to get the other one up and stable with a good config, but it still refuses to compile the rule set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;THOUGHTS?&lt;/strong&gt;&lt;br&gt;&#xA;Can somebody explain what the 97% memory utilization really represents?  If this is a resource issue it doesn't appear to be rule related based on the &lt;code&gt;show resource acl&lt;/code&gt; output, but the 97% memory utilized messages make me wonder.  What next steps should I take at this point?&lt;/p&gt;&#xA;" OwnerUserId="291" LastEditorUserId="375" LastEditDate="2013-05-21T14:41:31.780" LastActivityDate="2013-05-21T19:09:43.277" Title="Cisco active/standby FWSM pair went active/active after switch upgrade" Tags="|cisco|cisco-catalyst|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="686" PostTypeId="1" AcceptedAnswerId="688" CreationDate="2013-05-20T23:09:32.893" Score="13" ViewCount="2249" Body="&lt;p&gt;I've got an ASA 5550 that is performing loads and loads of operations (AnyConnect, NAT, ACL, RADIUS, etc, etc). It isn't particularly overloaded in terms of CPU &amp;amp; Memory, but it has an uptime of over 3.5 years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lately I have been attempting to deploy another IPSEC tunnel (via cryptomap) along with a NAT Exempt rule, but the ASA is exhibiting very strange behaviour. Sometimes when I add ACE's a mass of text pops up from nowhere in the description field. No matter what I do, my tests with the on-box PacketTracer tool do not yield the results I expect (for example - I see the packet hitting the Any/Any rule at the bottom of the ACL, even though there is a specifically configured ACE at the top of said ACL).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, the question is this: Has anyone ever actually solved anything by rebooting an ASA? It isn't my favourite option, but with the very strange behaviours I am seeing troubleshooting is becoming fruitless.&lt;/p&gt;&#xA;" OwnerUserId="756" LastEditorUserId="775" LastEditDate="2013-05-22T15:48:33.527" LastActivityDate="2013-05-22T15:48:33.527" Title="ASA 5550 - Reboot Worthwhile?" Tags="|cisco-asa|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="687" PostTypeId="2" ParentId="680" CreationDate="2013-05-20T23:19:59.530" Score="3" Body="&lt;p&gt;If there is a Riverbed device at both ends of your link, you will gain some optimisation regardless of the traffic that is being sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, it may not be optimised to it's fullest extent (aka, the Print Optimisation &lt;em&gt;feature&lt;/em&gt;), but none the less the technology deployed by Riverbed (bit level blocks of data) will in fact decrease the amount of data sent over the WAN. Furthermore, if the user is operating at the site where the printer exists, and the file that is to be printed exists where the print server is, then you can expect a very good level of optimisation as the RB will have already cached the data at a bit level. That is of course, unless you are in a Citrix / TS type environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure this is exactly the information you were looking for, but hopefully it helps a bit.&lt;/p&gt;&#xA;" OwnerUserId="756" LastActivityDate="2013-05-20T23:19:59.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="688" PostTypeId="2" ParentId="686" CreationDate="2013-05-20T23:37:27.257" Score="18" Body="&lt;p&gt;Short answer: Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Longer answer: :-) There are bugs in every piece of software.  The longer it runs, the more likely one is going to setup shop in your network.  But more to the point, the longer it's gone without a reboot, the more little bits of &quot;old&quot; configuration and/or status will be left lingering.  In IOS, &lt;code&gt;no interface foo&lt;/code&gt; will emit a warning that it's not completely destroyed and configuration elements may reappear if you recreate the interface -- shouldn't happen in an ASA but in rare cases, it does.  I've also seen phantom NAT entries after deleting them from the config. (that one actually is a bug)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When dealing with IPSec/crypto, I've found a whole lot of crazy can be cleared up by a &lt;code&gt;reload&lt;/code&gt;.  In one case (pix 6.3.5) it wouldn't re-establish a VPN tunnel until I did.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[edit] A word on reboots in general: I tend to reboot things just to &lt;em&gt;make sure they will&lt;/em&gt;.  All too often I've had various systems (routers, firewalls, servers) running for extended periods -- constantly being modified, and when something ends up restarting them (usually a power outage, but &quot;oops, wrong machine&quot; happens too) they rarely come back up exactly as they were before... someone forgot to make X start at boot, or some odd interaction of parts makes something not startup as expected.  I admit, it's less of a concern for more static parts of one's infrastructure.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-05-20T23:47:35.463" LastActivityDate="2013-05-20T23:47:35.463" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="689" PostTypeId="2" ParentId="686" CreationDate="2013-05-20T23:41:40.247" Score="7" Body="&lt;p&gt;Generally, I don't recommend a reboot as a resolution to a problem unless you know you are dealing with a bug that introduces something like a memory leak or a cache overflow condition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With an ASA running an image at least 3.5 years old, have you checked the Cisco bug toolkit?  Odds are that any bugs in the platform will be documented and you can see if any look to apply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also recommend opening a TAC case if you have support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reboots in my mind gloss over other problems and can make it very difficult (if not impossible) to find root cause.  Ultimately without understanding the root cause, you don't know that you fixed anything and I find that very dangerous, especially on a &quot;security&quot; platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, maybe you have a security vulnerability in the code that is being exploited by an outside source.  While the reboot may cut off their connection and alleviate the symptoms, it does nothing to address the problem. &lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-20T23:57:53.207" LastActivityDate="2013-05-20T23:57:53.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="690" PostTypeId="2" ParentId="686" CreationDate="2013-05-20T23:46:48.837" Score="2" Body="&lt;p&gt;I have recently encountered similar problems from an ASA running 8.2(2)16 with ~2.5 years uptime, whereby object-groups specified in crypto map ACLs were not being matched. Adding an ACL statement that the object-group already encompassed caused interesting traffic to be matched. Very frustrating. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A colleague advised they had seen this behaviour previously and that a reload resolved it in that instance. &lt;/p&gt;&#xA;" OwnerUserId="478" LastActivityDate="2013-05-20T23:46:48.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="691" PostTypeId="1" AcceptedAnswerId="760" CreationDate="2013-05-21T00:03:03.997" Score="8" ViewCount="1915" Body="&lt;p&gt;Is it possible to make my existing 6509 switch function as a 7600 router? Even if it means purchasing a new sup or other inline card. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need certain router features, such as q-in-q tag termination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We need to terminate q-in-q tags from wholesale fiber customers. We have a handover at one site, which I am thinking that I will q-in-q trunk over our own dark fiber using 3750E switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will need to authenticate DHCP option 82;&#xA;A nice to have would be VPDN, and replace our existing LNS;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;GRE&lt;/li&gt;&#xA;&lt;li&gt;MPLS VPN&lt;/li&gt;&#xA;&lt;li&gt;OSPF&lt;/li&gt;&#xA;&lt;li&gt;BGP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Existing 6500:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco WS-C6506-E (R7000) processor (revision 1.0) with 983008K/65536K bytes of memory.&#xA;&#xA;culv-c6506-1#show module all&#xA;Mod Ports Card Type                              Model              Serial No.&#xA;--- ----- -------------------------------------- ------------------ -----------&#xA;  3   48  CEF720 48 port 10/100/1000mb Ethernet  WS-X6748-GE-TX     SAL1105FPGM&#xA;  5    2  Supervisor Engine 720 (Active)         WS-SUP720-3B       SAD100202AY&#xA;&#xA;Mod MAC addresses                       Hw    Fw           Sw           Status&#xA;--- ---------------------------------- ------ ------------ ------------ -------&#xA;  3  001a.a257.d990 to 001a.a257.d9bf   2.5   12.2(14r)S5  12.2(33)SXJ3 Ok&#xA;  5  0013.c3a7.ced8 to 0013.c3a7.cedb   4.5   8.5(4)       12.2(33)SXJ3 Ok&#xA;&#xA;Mod  Sub-Module                  Model              Serial       Hw     Status &#xA;---- --------------------------- ------------------ ----------- ------- -------&#xA;  3  Distributed Forwarding Card WS-F6700-DFC3B     SAD08320E44  2.0    Ok&#xA;  5  Policy Feature Card 3       WS-F6K-PFC3B       SAD100202P5  2.2    Ok&#xA;  5  MSFC3 Daughterboard         WS-SUP720          SAD100201BM  2.4    Ok&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="760" LastEditorUserId="441" LastEditDate="2013-05-27T23:22:18.187" LastActivityDate="2013-05-27T23:22:18.187" Title="Cisco 7600 q-in-q functionality on a Cisco 6500" Tags="|cisco-6500|qinq|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="692" PostTypeId="2" ParentId="691" CreationDate="2013-05-21T00:10:02.003" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;such as q-in-q tag termination.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is going to depend on the line cards you have.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I need certain router features&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you have other that you need, elaborating on which would be good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has specific builds of the 7600 software that runs on 6500 chassis, but they are only generally available to customers who have been burned by the 6500/7600 BU split and after much griping to your SE.&lt;/p&gt;&#xA;" OwnerUserId="707" LastActivityDate="2013-05-21T00:10:02.003" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="693" PostTypeId="2" ParentId="685" CreationDate="2013-05-21T00:10:11.650" Score="2" Body="&lt;p&gt;&lt;code&gt;show proc mem&lt;/code&gt;?  &lt;code&gt;show res usage detail&lt;/code&gt;? See if you can locate where all the memory went.  Your situation may have triggered a memory leak.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Note: I've seen 7500's get into the same messy mode... the only solution we ever found was &lt;em&gt;power off&lt;/em&gt;, remove an RSP, power up completely, then reinsert the secondary RSP. Over an hour long process for us. So, be prepared for a &quot;&lt;em&gt;complete restart&lt;/em&gt;&quot;.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-21T00:10:11.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="694" PostTypeId="2" ParentId="672" CreationDate="2013-05-21T00:19:04.447" Score="3" Body="&lt;p&gt;Mirror sessions are great, depending on your needs (you mention 'packet analysis') sFlow might also be a great fit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;check the &lt;a href=&quot;http://www.brocade.com/downloads/documents/html_product_manuals/NI_05400a_CFG/wwhelp/wwhimpl/js/html/wwhelp.htm&quot; rel=&quot;nofollow&quot;&gt;brocade config guide&lt;/a&gt; (click sflow on the left -- can't figure out how to link to the specific page w/o removing navigation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's more or less as simple as configuring:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sflow enable&#xA;sflow destination &amp;lt;host&amp;gt; &amp;lt;port&amp;gt;&#xA;int x/y&#xA;sflow forwarding&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You don't get all the traffic (sampling) and you don't get the full packet (its truncated), but depending on your needs and what/how much you want to analyze its a pretty good fit for a lot of things.&#xA;Tons of tools exist for capturing and analyzing sFlow data, that's probably a topic for another question.&lt;/p&gt;&#xA;" OwnerUserId="707" LastActivityDate="2013-05-21T00:19:04.447" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="695" PostTypeId="1" AcceptedAnswerId="699" CreationDate="2013-05-21T00:28:24.263" Score="1" ViewCount="471" Body="&lt;p&gt;I'm fairly new to the purchasing and licensing of new Cisco equipment. In the past, I have used eBay for all of my Cisco shopping needs. I know that I can purchase new equipment and licenses from partners/resellers, but how does one become a reseller themselves? Or more to the point: what steps must be taken so that I can purchase directly from Cisco the same way a reseller does? In other words, if I wanted to buy a new specific router, or obtain access to a specific IOS download, etc, is there any way to do this without going through a reseller?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: I should clarify that I am aware that Cisco has an application process available on their site, but I have gone through it and found it thoroughly confusing. As someone who is new to this, I was hoping someone could clarify things and shed some light on the subject.&lt;/p&gt;&#xA;" OwnerUserId="572" LastEditorUserId="775" LastEditDate="2013-06-02T14:27:33.643" LastActivityDate="2013-06-02T14:27:33.643" Title="How do I obtain access to buy from Cisco directly?" Tags="|cisco|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ClosedDate="2013-05-21T09:23:38.303" ContentLicense="CC BY-SA 3.0" />
  <row Id="697" PostTypeId="2" ParentId="630" CreationDate="2013-05-21T00:58:14.223" Score="7" Body="&lt;p&gt;As per the advice from &lt;a href=&quot;https://networkengineering.stackexchange.com/users/619/ricky-beam&quot;&gt;Ricky Beam&lt;/a&gt; I opened a Cisco TAC case for this issue, just to see what the official word is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Hi Mark,&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;thanks.  At this time, &lt;strong&gt;the ASA does not have native IPv6 PPPOE&#xA;  support&lt;/strong&gt;.  I have not seen it on any future roadmap.  You may want to&#xA;  contact your local cisco team to see if they can submit a request by&#xA;  putting in a business case for you.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(emphasis mine). So no, there is no way to do IPv6 on an ASA using a PPPoE connection, and it doesn't look like it is coming any time soon. I guess they expect you to put a proper router infront of the ASA instead.&lt;/p&gt;&#xA;" OwnerUserId="687" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-05-21T00:58:14.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="698" PostTypeId="2" ParentId="549" CreationDate="2013-05-21T01:21:36.410" Score="0" Body="&lt;p&gt;Unless you want to get into the GEO-IP mapping business, leave this for the professionals.  It will never be 100% and accuracy is probably closer to 70-80% at best.  Proxies in front of the clients may mask their actual locations since the proxy IPs would be different.  If you're app is HTTP, some Content Delivery Networks (CDNs) if you use one have the ability to embed Geo information in the HTTP request header for your web app to make a block decision on.  Again, some CDNs proxy the entire site so the IP connecting to you is never the same as the real client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://en.wikipedia.org/wiki/Geolocation_software&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Geolocation_software&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-21T01:21:36.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="699" PostTypeId="2" ParentId="695" CreationDate="2013-05-21T01:29:24.310" Score="5" Body="&lt;p&gt;(while not &lt;em&gt;network engineering&lt;/em&gt; per-se, it's a good question)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you plan on buying millions in equipment and/or software annually, Cisco will not want to deal with you directly.  This is &lt;em&gt;especially&lt;/em&gt; true if you're only interested in individual purchases -- that's why they have resellers and channel partners.  If you &lt;em&gt;are&lt;/em&gt;, then Cisco will assign you a sales person and sales engineer to meet your needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Becoming a partner/reseller is an involved process, well beyond the scope of stackexchange. (that's a &quot;&lt;em&gt;how do I start a business&lt;/em&gt;&quot; question.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-21T01:29:24.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="700" PostTypeId="2" ParentId="679" CreationDate="2013-05-21T01:31:19.820" Score="6" Body="&lt;p&gt;They keep moving things into the web interface but the reports are in a separate app called &quot;Report Writer&quot; on the server desktop so you'll have to RDP or physically connect to the server to get to it. There's also a &quot;Report Scheduler&quot; where you'll need add the reports once you've created them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've never found their reporting very useful but you may have better luck depending on what you want. In the past I know they've recommended using Crystal Reports against their database to pull detailed reports.&lt;/p&gt;&#xA;" OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-05-21T12:52:19.880" LastActivityDate="2013-05-21T12:52:19.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="702" PostTypeId="2" ParentId="555" CreationDate="2013-05-21T02:50:06.450" Score="2" Body="&lt;p&gt;I did two things to make the PPTP wireless client work:&lt;br&gt;&#xA;1. Added a static NAT on the Buffalo for a wireless device.&lt;br&gt;&#xA;2. Added the following to the ASA:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map global_policy&#xA;class inspection_default&#xA;inspect pptp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After adding the static NAT but before modifying the ASA I saw the following error in the ASA log:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;May 20 2013 06:42:05: %ASA-3-305006: regular translation creation failed for protocol 47 src inside:192.168.1.50 dst outside:(vpn-at-work-IP-address)&amp;lt;br&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I had to allow PPTP inspection.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am able to connect via IPSec and PPTP through 2 NATs, although evidently that's not a best practice, so I'll be reading up more on that.&lt;/p&gt;&#xA;" OwnerUserId="291" LastEditorUserId="52517" LastEditDate="2019-06-19T14:00:29.107" LastActivityDate="2019-06-19T14:00:29.107" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="703" PostTypeId="2" ParentId="166" CreationDate="2013-05-21T03:20:12.650" Score="3" Body="&lt;p&gt;(haven't used MLPPP since the days before VoIP. in fact I'm looking at an archived config from 2003)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I can add:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Multilink X&#xA;  no ppp multilink fragmentation&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each member interface has &lt;code&gt;tx-queue-limit 26&lt;/code&gt;; I'm sure I did that for a reason.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can it be corrected?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you can get both &lt;em&gt;Cisco&lt;/em&gt; ends to do it... try per-packet load balancing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial0/0/4:0&#xA; ip address 198.xx.xx.210 255.255.255.252&#xA; ip load-sharing per-packet&#xA; no fair-queue&#xA;!&#xA;interface Serial1/0/5:0&#xA; ip address 198.xx.xx.22 255.255.255.252&#xA; ip load-sharing per-packet&#xA; no fair-queue&#xA;!&#xA;ip route xxx.xxx.201.0 255.255.255.0 198.xx.xx.21&#xA;ip route xxx.xxx.201.0 255.255.255.0 198.xx.xx.209&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That works even better (at least between Cisco's.)  In this case, we were forced to do it this way because they were on different linecards. (7500's cannot [read: &lt;em&gt;don't&lt;/em&gt;, they get punted to the RSPs] do MLPPP across VIPs)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-05-21T04:54:03.063" LastActivityDate="2013-05-21T04:54:03.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="704" PostTypeId="1" CreationDate="2013-05-21T04:35:38.880" Score="10" ViewCount="5786" Body="&lt;p&gt;What is oversubscription?When selecting a 16 port 10 gig blade for cisco 6500 , it says oversubscription as 4:1. What will happen if I populate all 16 ports, will some ports be blocking or dropping packet?&lt;/p&gt;&#xA;" OwnerUserId="777" LastEditorUserId="775" LastEditDate="2013-05-22T07:24:50.497" LastActivityDate="2013-05-22T07:24:50.497" Title="Oversubscription in cisco 6500" Tags="|cisco|cisco-6500|oversubscription|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="705" PostTypeId="2" ParentId="704" CreationDate="2013-05-21T04:43:20.597" Score="12" Body="&lt;p&gt;It sounds like you're talking about the WS-X6716-10GE.  Over-subscription in this context means you have a 16 x 10GE ports on the front of the LC and no more than 4x10GE at the fabric connection to the rest of the chassis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Over-subscription will not matter if you locally switch traffic within the same linecard; however, you will only be able to send up to your fabric connection (i.e. 40Gbps) to &lt;em&gt;other&lt;/em&gt; linecards in the same chassis.  So it's possible to get blocking or drops if your links congest the fabric connections.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-05-21T04:43:20.597" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="706" PostTypeId="2" ParentId="704" CreationDate="2013-05-21T04:53:30.030" Score="3" Body="&lt;p&gt;In addition to @Mike's answer, the following Cisco webpages provide some context into the Cat65k fabric architecture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-18210&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/docs/DOC-18210&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/prod_white_paper0900aecd80673385.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/prod_white_paper0900aecd80673385.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-05-21T04:53:30.030" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="707" PostTypeId="2" ParentId="183" CreationDate="2013-05-21T05:29:54.150" Score="2" Body="&lt;p&gt;You're going to want a CIR that matches closely with what the bit rate of your &quot;TDM circuit&quot; will be, and a very small CBS (if any at all). A substantial CBS has the potential to introduce FDV because there's some overhead/ability to burst - you want to avoid this. You normally don't have bursts with TDM traffic, but you do with Ethernet, and you don't want that option to be there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're up to it, check out the MEF 8 technical spec/implementation agreement for emulating PDH circuits over metro (now &quot;Carrier&quot;) Ethernet. Direct link here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://metroethernetforum.org/PDF_Documents/technical-specifications/MEF8.pdf&quot; rel=&quot;nofollow&quot;&gt;http://metroethernetforum.org/PDF_Documents/technical-specifications/MEF8.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The good bits on CoS start on page 26. &lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-21T05:40:49.553" LastActivityDate="2013-05-21T05:40:49.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="708" PostTypeId="5" CreationDate="2013-05-21T06:28:32.030" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-21T06:28:32.030" LastActivityDate="2013-05-21T06:28:32.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="709" PostTypeId="4" CreationDate="2013-05-21T06:28:32.030" Score="0" Body="For questions related to Policy Based Routing, whatever the product or manufacturer is. " OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-05-21T14:42:54.363" LastActivityDate="2013-05-21T14:42:54.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="710" PostTypeId="5" CreationDate="2013-05-21T06:30:39.617" Score="0" Body="&lt;p&gt;Fortinet's Network Security solution consists of FortiGate physical and virtual appliance products that provide a broad array of security and networking functions, including firewall, VPN, antivirus, intrusion prevention, Web filtering, antispam, and WAN acceleration.&lt;/p&gt;&#xA;" OwnerUserId="15735" LastEditorUserId="15735" LastEditDate="2015-06-04T17:27:02.963" LastActivityDate="2015-06-04T17:27:02.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="711" PostTypeId="4" CreationDate="2013-05-21T06:30:39.617" Score="0" Body="Fortinet is a worldwide provider of network security appliances and a market leader in Network Security (FW/NGFW/UTM). " OwnerUserId="15735" LastEditorUserId="15735" LastEditDate="2015-06-04T17:26:35.530" LastActivityDate="2015-06-04T17:26:35.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="712" PostTypeId="5" CreationDate="2013-05-21T06:34:02.177" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-21T06:34:02.177" LastActivityDate="2013-05-21T06:34:02.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="713" PostTypeId="4" CreationDate="2013-05-21T06:34:02.177" Score="0" Body="For questions about Fortigate, the UTM product line from Fortinet " OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-05-21T14:41:59.593" LastActivityDate="2013-05-21T14:41:59.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="714" PostTypeId="2" ParentId="395" CreationDate="2013-05-21T07:07:00.390" Score="3" Body="&lt;p&gt;I am going to answer this question based on the understanding that there is a full outage for the layer 2 domain in question, and that you have no management access because the CPU's are all pegged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way to troubleshoot a bridging loop is to start unplugging uplinks until it goes away. Say you have a standard switched access layer with all the access switches connecting into a pair of distribution switches. Go to the first access switch, and unplug the uplinks, if the LED's for the switchports stop going mental, it’s not that switch, plug it back in and go to the next one. Repeat until you get to a switch where you have unplugged the uplinks and the LED's are continuing to blink rapidly, this is your switch with the loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now start the unplugging process on the end user ports until the LED's calm down, when they do, the last on you unplugged was the problem port, trace the cable and chastise the user appropriately.&lt;/p&gt;&#xA;" OwnerUserId="791" LastActivityDate="2013-05-21T07:07:00.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="715" PostTypeId="2" ParentId="640" CreationDate="2013-05-21T07:42:12.047" Score="1" Body="&lt;p&gt;I have asked some similar questions on serverfault, and the answers may be of use here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://serverfault.com/questions/499971/cisco-ios-debug-commands-and-packet-monitoring&quot;&gt;Cisco IOS debug commands and packet monitoring&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://serverfault.com/questions/498962/troubleshoot-ethernet-layer-2-without-layer-3&quot;&gt;troubleshoot Ethernet (layer 2) without layer 3&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="366" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2013-05-21T07:42:12.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="716" PostTypeId="2" ParentId="395" CreationDate="2013-05-21T08:18:22.713" Score="0" Body="&lt;p&gt;Without a doubt the fastest approach I have found is by monitoring the packet/sec rates of interfaces.  A quick show interfaces with appropriate CLI filter will list each interface and the packet/sec rate.  To find the source of the loop look for the only interface with a crazy high packet/sec INPUT rate.  Within a typical enterprise environment, with typical utilisation profiles, it works everytime without fail. On a 6500 with many interfaces it doesn't take very long to spot the source...   &lt;/p&gt;&#xA;" OwnerUserId="798" LastActivityDate="2013-05-21T08:18:22.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="718" PostTypeId="2" ParentId="16" CreationDate="2013-05-21T10:27:16.873" Score="0" Body="&lt;p&gt;A vtp advertisement is sent only when their is a change in the revision number. How we can change the revision number? Pretty easy.. create and delete a dummy vlan. We cant force a client to pull the update from the server.&lt;/p&gt;&#xA;" OwnerUserId="777" LastActivityDate="2013-05-21T10:27:16.873" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="719" PostTypeId="1" AcceptedAnswerId="752" CreationDate="2013-05-21T10:31:48.277" Score="8" ViewCount="6386" Body="&lt;p&gt;A 100BASE-TX PC interface sends out its frames on pins 1,2 and receives frames on pins 3,6. If we connect this PC's NIC with that of another PC we cannot use a straightout cable, because the frames sent by the first PC would arrive on pins 1,2 of the second PC, which can only trasmit, not receive. In this case we clearly need a crossover cable or auto-mdix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if we have a PC with a 1000BASE-T NIC, frames can be sent out and received on any of four cable pairs. If we connect this PC to another 1000BASE-T PC and the first one sends a message out of pins 1,2 then the second PC may use its 1,2 pair to receive the message. The way I see it, no crossover is necessary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where am I going wrong?&lt;/p&gt;&#xA;" OwnerUserId="562" LastEditorUserId="562" LastEditDate="2013-05-21T11:45:33.507" LastActivityDate="2013-05-21T17:26:09.830" Title="Why does 1000BASE-T need Auto-MDIX?" Tags="|ethernet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="720" PostTypeId="2" ParentId="719" CreationDate="2013-05-21T10:38:30.490" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;When is a crossover cable or Auto-MDIX necessary?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For switch to switch connections, traditionally these required an ethernet cross-over cable but Auto-MDIX in the 1000Base-T standard solves the problem without need for a cross-over cable (straight through is fine).  If your laptop NIC supports Auto-MDIX, it also allows laptop to laptop connections with a straight through cable.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-05-21T11:08:49.983" LastActivityDate="2013-05-21T11:08:49.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="722" PostTypeId="1" AcceptedAnswerId="71852" CreationDate="2013-05-21T11:27:35.957" Score="7" ViewCount="631" Body="&lt;p&gt;Is it possible for Cisco ACS 5.4 (or any other version) to work in a multi-tenancy environment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have two ACS servers, one primary, one secondary, with completely different routing (but obviously keep access to each other for replication).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would allow me to have centralised management of ACS, but I need ACS to accept client devices request coming from potentially overlapping IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try on ACS5.4, it simply complains the second client device's IP clashes with the first.&lt;/p&gt;&#xA;" OwnerUserId="802" LastEditorUserId="165" LastEditDate="2013-05-21T14:42:41.223" LastActivityDate="2021-01-04T09:28:19.610" Title="Multi-tenancy TACACS server" Tags="|cisco|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="723" PostTypeId="2" ParentId="722" CreationDate="2013-05-21T12:40:25.177" Score="4" Body="&lt;p&gt;I can't speak for ACS as I've only use the open source TACACS daemon but we utilise a SQL backend which allows for different boxes to have completely different routing / policies but still maintain a consistent user DB.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-21T12:40:25.177" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="724" PostTypeId="5" CreationDate="2013-05-21T13:12:09.343" Score="0" Body="&lt;p&gt;For questions about or involving network devices produced by Riverbed. &lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2018-02-16T17:59:58.040" LastActivityDate="2018-02-16T17:59:58.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="725" PostTypeId="4" CreationDate="2013-05-21T13:12:09.343" Score="0" Body="For questions about or involving network devices produced by Riverbed. " OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2018-02-16T17:59:45.997" LastActivityDate="2018-02-16T17:59:45.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="726" PostTypeId="2" ParentId="362" CreationDate="2013-05-21T13:13:02.290" Score="6" Body="&lt;p&gt;It sounds like you have a collapsed core. Is that correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way of dealing with too many changes based on adding new VLANs' is to move your L3 boundary closer to the access. It requires some work up-front, but if your design is well planned, and thought out, it should make adding new VLAN's a one to three device task (depending on whether L3 stops at Distribution or Access layers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a bunch of other benefits you get from that as well, including faster convergence in the event of a lost link. &lt;/p&gt;&#xA;" OwnerUserId="487" LastEditorUserId="775" LastEditDate="2013-06-02T22:03:10.937" LastActivityDate="2013-06-02T22:03:10.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="727" PostTypeId="2" ParentId="680" CreationDate="2013-05-21T13:28:22.947" Score="2" Body="&lt;p&gt;I can confirm that the Steelheads will reduce printer traffic volume.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen a consistent 90+% reduction in traffic volume for JetDirect (TCP/9100) and LDP (TCP/515) protocols on my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These protocols are highly used on my network and I am unaware of any issues that have occurred in about 18 months since we deployed the Steelheads.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-21T13:28:22.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="728" PostTypeId="5" CreationDate="2013-05-21T13:29:29.760" Score="0" Body="&lt;p&gt;A network switch is a computer networking device that links network segments or network devices. The term commonly refers to a multi-port network bridge that processes and routes data at the data link layer (layer 2) of the OSI model. Switches that additionally process data at the network layer (layer 3) and above are often called layer-3 switches or multilayer switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches exist for various types of networks including Fibre Channel, Asynchronous Transfer Mode, InfiniBand, Ethernet and others. The first Ethernet switch was introduced by Kalpana in 1990.&lt;/p&gt;&#xA;" OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-05-21T14:41:36.640" LastActivityDate="2013-05-21T14:41:36.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="729" PostTypeId="4" CreationDate="2013-05-21T13:29:29.760" Score="0" Body="For questions about network switches, the term commonly refers to a multi-port network bridge that processes and routes data at the data link layer (layer 2) of the OSI model." OwnerUserId="165" LastEditorDisplayName="user36472" LastEditDate="2018-03-01T17:15:54.407" LastActivityDate="2018-03-01T17:15:54.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="730" PostTypeId="1" CreationDate="2013-05-21T13:37:16.143" Score="11" ViewCount="2960" Body="&lt;p&gt;I've been working across many sites around the world with ADSL. The first output below is the one I've used many many times &amp;amp; I'm therefore most familiar with. It's from a site in the UK.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface ATM0&#xA; no ip address&#xA; no atm ilmi-keepalive&#xA; pvc 0/38 &#xA;  encapsulation aal5mux ppp dialer&#xA;  dialer pool-member 1&#xA;!&#xA;interface Dialer1&#xA; ip address negotiated&#xA; encapsulation ppp&#xA; dialer pool 1&#xA; dialer-group 1&#xA; ppp chap hostname xxxxxx&#xA; ppp chap password xxxxxx&#xA; ppp authentication chap callin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand how this works. Now the stuff I don't understand. This config below has been taken from a site in Turin in Italy. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface ATM0/1/0&#xA; no ip address&#xA; ip mtu 1492&#xA; atm bandwidth dynamic&#xA; no atm ilmi-keepalive&#xA;!&#xA;interface ATM0/1/0.1 point-to-point&#xA; ip address xxxxx xxxxxx&#xA; ip mtu 1492&#xA; pvc 8/35 &#xA;  vbr-nrt 896 896 1&#xA;  encapsulation aal5snap&#xA;  max-reserved-bandwidth 97&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the only stuff in the config to get it working. There is no dialer, no ppp username or password. This is literally all the config (except obviously a default route) required to get it working. So please may someone explain to me how this works?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I've been taught is that you get your sync (basically a physically good network to the ISP, i.e. layer 1 connectivity). Next you get a session, which is where you create your PPP session to the ISP, who authenticates you (this is layer2). Finally, at layer 3 you can then get to the internet (i.e. beyond the ISP's network). So how does this aal5snap work, and how does this config work to get them to the internet?&lt;/p&gt;&#xA;" OwnerUserId="817" LastEditorUserId="49" LastEditDate="2013-05-21T13:49:40.717" LastActivityDate="2013-05-22T20:59:46.577" Title="Please help me understand this ADSL configuration" Tags="|ppp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="731" PostTypeId="2" ParentId="653" CreationDate="2013-05-21T13:43:27.620" Score="1" Body="&lt;pre&gt;&lt;code&gt;test cable diagnostics tdr interface *intname here*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should show you whether or not the cable attached to the switchport is actually connected to anything. Regardless of its status.&#xA;Replace &lt;code&gt;test&lt;/code&gt; with &lt;code&gt;show&lt;/code&gt; to get the status.&lt;/p&gt;&#xA;" OwnerUserId="820" LastEditorUserId="775" LastEditDate="2013-06-17T20:11:14.450" LastActivityDate="2013-06-17T20:11:14.450" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="732" PostTypeId="1" AcceptedAnswerId="758" CreationDate="2013-05-21T13:47:18.223" Score="21" ViewCount="32441" Body="&lt;p&gt;What's the basic use case(s) for VLANs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the basic design principles?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for something like a two paragraph executive summary style answer so I can determine if I need to learn about VLANs to implement them.&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="775" LastEditDate="2013-05-22T06:18:18.067" LastActivityDate="2013-05-22T06:18:18.067" Title="Introductory level explanation of VLANs" Tags="|ethernet|vlan|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="733" PostTypeId="1" CreationDate="2013-05-21T13:56:39.760" Score="10" ViewCount="17214" Body="&lt;p&gt;How do mismatches occur; what is the impact of a mismatch on network connectivity; is resolution of mismatches really worth the effort; what are some ways to detect mismatches on a large scale?&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2013-05-21T14:05:29.823" LastActivityDate="2013-05-22T14:07:14.990" Title="speed/duplex mismatch" Tags="|ethernet|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="734" PostTypeId="2" ParentId="733" CreationDate="2013-05-21T13:56:39.760" Score="2" Body="&lt;p&gt;Mismatches most often occur when one side of a link is explicitly configured and the other side is set to auto-negotiate. When devices are under separate management, the parties may fail to communicate and verify the settings. The impact to network connectivity ranges from unnoticed on light usage links to severe on heavily loaded links. It is generally worth the effort to resolve mismatches wherever possible. On Cisco switches, an interface reliability indicator of less than 255 is a good way to spot mismatches. This value can be polled with SNMP to detect mismatches on a large scale.&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2013-05-21T14:06:02.247" LastActivityDate="2013-05-21T14:06:02.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="735" PostTypeId="2" ParentId="730" CreationDate="2013-05-21T14:05:02.237" Score="16" Body="&lt;p&gt;You are familiar with IP over PPP over ATM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The config you don't understand is IP over ATM, that is the ATM frames are directly transporting IP frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ATM was designed to carry many different protocols using many different encoding methods. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One reason some operators (mostly central Europe) choose to add PPP in to the mix is because it allows them to offer access to other operators relatively easily, i.e. the PPP sessions would actually terminate with another operator not where your physical connection is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3rd common way to do this is IP over Ethernet over ATM, which is yet another config.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="49" LastEditDate="2013-05-21T14:22:27.107" LastActivityDate="2013-05-21T14:22:27.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="736" PostTypeId="2" ParentId="730" CreationDate="2013-05-21T14:14:28.470" Score="8" Body="&lt;p&gt;Take a look at &lt;a href=&quot;http://www.faqs.org/rfcs/rfc1483.html&quot;&gt;RFC1483&lt;/a&gt;. Basically, this is IP over ATM. You can either don't do authentication and assume that anyone connected to your BRAS is a valid user, or use something like DHCP for assigning IP's based on specific client attributes.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2013-05-21T14:25:17.417" LastActivityDate="2013-05-21T14:25:17.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="737" PostTypeId="2" ParentId="732" CreationDate="2013-05-21T14:14:41.883" Score="8" Body="&lt;p&gt;As networks grow larger and larger, scalability becomes an issue. In order to communicate, every device needs to send broadcasts, which are sent to all devices in a broadcast domain. As more devices are added to the broadcast domain, more broadcasts start to saturate the network. At this point, multiple issues creep in, including bandwidth saturation with broadcast traffic, increased processing on each device (CPU usage), and even security issues. Splitting this large broadcast domain into smaller broadcast domains becomes increasingly necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enter VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VLAN, or Virtual LAN, creates separate broadcast domains virtually, eliminating the need to create completely separate hardware LANs to overcome the large-broadcast-domain issue. Instead, a switch can contain many VLANs, each one acting as a separate, autonomous broadcast domain. In fact, two VLANs, can not communicate with each other without the intervention of a layer 3 device such as a router, which is what layer 3 switching is all about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, VLANs, at the most basic level, segment large broadcast domains into smaller, more manageable broadcast domains to increase scalability in your ever-expanding network.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-21T14:14:41.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="738" PostTypeId="2" ParentId="733" CreationDate="2013-05-21T14:38:29.210" Score="6" Body="&lt;p&gt;These days the most common causes are links where one system (either network or end device) is manually configured, and the other automatic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the early days of auto-negotiation (full duplex 10Mb and Fast Ethernet) it was not uncommon for devices to fail to negotiate correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to this (and other inertia related reasons) many large corporate and SP networks required manual configuration of some or all links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days there is &lt;em&gt;no&lt;/em&gt; justification for doing this, and in fact on Gigabit Ethernet (copper at least) auto-negotiation is required, and well behaved devices will not allow it to be disabled. In some cases this may not be clear, for example on some Cisco kit &quot;disabling&quot; auto-negotiation on gig links simply restricts the values acceptable in the auto-negotiation process (which can be valuable if you don't alarm on unexpected interface speed &amp;amp; duplex).&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-21T14:38:29.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="739" PostTypeId="2" ParentId="732" CreationDate="2013-05-21T14:41:47.300" Score="3" Body="&lt;p&gt;In terms of design principles, the most common implementation is to align your VLANs with your organizational structure, ie Engineering folks in one VLAN, Marketing in another, IP phones in another, etc. Other designs include utilizing VLAN's as &quot;transport&quot; of separate network functions across one (or more) cores. Layer 3 termination of VLANs ('SVI' in Cisco parlance, 'VE' in Brocade, etc) is also possible on some devices, which eliminates the need of a separate piece of hardware to do inter-VLAN communication when applicable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs become cumbersome to manage and maintain at scale, as you've probably seen cases of already on NESE. In the service provider realm, there's PB (Provider Bridging - commonly known as &quot;QinQ&quot;, double tagging, stacked tag, etc), PBB (Provider Backbone Bridging - &quot;MAC-in-MAC&quot;) and PBB-TE, which have been designed to try to mitigate the limitation of the number of VLAN ID's that were available. PBB-TE more aims to eliminate the need for dynamic learning, flooding, and spanning tree. There's only 12 bits available for use as a VLAN ID in a C-TAG/S-TAG (0x000 and 0xFFF are reserved) which is where the 4,094 limitation comes from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPLS or PBB can be used to eliminate the traditional scaling ceilings involved with PB.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-21T15:03:24.517" LastActivityDate="2013-05-21T15:03:24.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="740" PostTypeId="2" ParentId="733" CreationDate="2013-05-21T14:53:23.990" Score="12" Body="&lt;p&gt;To address your questions in order:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Mismatches occur when auto-negotiation or manual configurations fails. This may be caused by physical layer issues or because manual configurations do not agree. Physical issues could be something like an inline hub or physical cable (missing/broken pairs) issues.&lt;/li&gt;&#xA;&lt;li&gt;Duplex mismatches can cause a significant impact to your network performance. Collisions, particularly late ones, can take a long time (relatively speaking) for the TCP stack to recover from. Collisions with UDP means the data may never get there or require an application layer recovery mechanism.&lt;/li&gt;&#xA;&lt;li&gt;Resolving mismatches is absolutely worth your time resolving. It may also hint at other issues since duplex/speed should be an assumed thing these days.&lt;/li&gt;&#xA;&lt;li&gt;Some of the centralized management tools (&lt;a href=&quot;http://www.solarwinds.com&quot; rel=&quot;nofollow&quot;&gt;Solarwinds&lt;/a&gt;, &lt;a href=&quot;http://www.spiceworks.com&quot; rel=&quot;nofollow&quot;&gt;Spiceworks&lt;/a&gt;, HP OpenView &amp;amp; others) probably have reports for interface errors which should include these types of issues.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="266" LastEditorUserId="623" LastEditDate="2013-05-22T14:07:14.990" LastActivityDate="2013-05-22T14:07:14.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="741" PostTypeId="2" ParentId="653" CreationDate="2013-05-21T15:04:10.433" Score="5" Body="&lt;p&gt;I typically use &lt;code&gt;sh int des | ex up&lt;/code&gt;, which will list all the ports that are in a down state&lt;/p&gt;&#xA;" OwnerUserId="826" LastEditorUserId="441" LastEditDate="2013-05-24T16:10:06.070" LastActivityDate="2013-05-24T16:10:06.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="742" PostTypeId="2" ParentId="685" CreationDate="2013-05-21T15:53:12.583" Score="4" Body="&lt;p&gt;&lt;strong&gt;THE PROBLEM:&lt;/strong&gt;&lt;br&gt;&#xA;It turns out we ran into a node limit on the FWSM.  Evidently you can be within your rule limit but hit the node ceiling.  This doc &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-8786&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/docs/DOC-8786&lt;/a&gt; details the compilation memory exhaustion issue that hit us.  Quoting:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This command &lt;code&gt;show np 3 acl stats&lt;/code&gt; in the context in question will show&#xA;  if the total nodes is reached. This limit may be reached even before&#xA;  the ACL limit is reached. Each ACE may take a minimum of 2 nodes to a&#xA;  maximum up to to 5 nodes depending on where the ACL is being called.&#xA;  The ACL that is tied to MPF (modular policy framework) may take up&#xA;  more nodes than the ACL that is tied to a NAT or to the access-group.&#xA;  There is no way to calculate the number of nodes. The best way to&#xA;  monitor this is to regularly look at the above output to make sure the&#xA;  node count is not exceeded.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;RESOLUTION:&lt;/strong&gt;&lt;br&gt;&#xA;1. Power down the secondary FWSM and power on the primary.&lt;br&gt;&#xA;2. Revise our configuration by examining which rules could be removed (stale rules and recent changes allowing certain Development environments access to Production) in order to bring down the rule and therefore node count.&lt;br&gt;&#xA;3. Ensure the new config compiles then reset the primary FWSM.&lt;br&gt;&#xA;4. Verify the FWSM comes up clean with no errors.&lt;br&gt;&#xA;5. Power down the primary FWSM and power up the secondary FWSM.&lt;br&gt;&#xA;6. Repeat steps 3 and 4 with the secondary FWSM then power it down.&lt;br&gt;&#xA;7. Power on the primary, ensure it's clean, power on the secondary.&lt;br&gt;&#xA;8. Ensure the primary's config is copied to the secondary and that the primary is Active and sees the secondary as Standby.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MITIGATION:&lt;/strong&gt;&lt;br&gt;&#xA;1. We upgraded our development environment (2 x 6509 with Active/Standby FWSM) to FWSM version 4.1(13) from 3.2(23).  The upgrade to the 4.x train increased the maximum node count for us from 28,356 to 38,439.  More information: &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/modules/ps2706/product_bulletin_c25-478751.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/modules/ps2706/product_bulletin_c25-478751.html&lt;/a&gt;.&lt;br&gt;&#xA;2. We will upgrade our Production FWSM during the next change window.&lt;br&gt;&#xA;3. We implemented a Kiwi CatTools job to run the &lt;code&gt;show np 3 acl stats&lt;/code&gt; command in our contexts and e-mail us a daily report.  Whenever we make a rule change we also run this command to ensure we're within node and rule limits.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's interesting behavior that the FWSM would allow us to continue adding rules.  It only failed when it was power cycled and tried to compile the rule set.  Lessons learned!&lt;/p&gt;&#xA;" OwnerUserId="291" LastEditorUserId="291" LastEditDate="2013-05-21T19:09:43.277" LastActivityDate="2013-05-21T19:09:43.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="743" PostTypeId="1" AcceptedAnswerId="749" CreationDate="2013-05-21T16:14:00.997" Score="18" ViewCount="11159" Body="&lt;p&gt;Something I've always wondered about is MAC address exhaustion. Do hardware vendors keep track of MAC address allocation to their platforms, and then subsequently &quot;reclaim&quot; MAC addresses when a product goes EOL, and then re-use them on a new platform?&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="775" LastEditDate="2013-05-22T06:06:06.597" LastActivityDate="2015-03-30T04:17:37.177" Title="MAC address recycling?" Tags="|ethernet|hardware|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="744" PostTypeId="1" CreationDate="2013-05-21T16:15:57.507" Score="3" ViewCount="853" Body="&lt;p&gt;This may seem like a rudimentary question, but I wasn't sure where else to ask it. I've set up some QoS rules on my router that give the highest priority to all traffic incoming and outgoing to my computer's network address, and it has so far done an excellent job of preventing lag and communication issues while someone else on my network decides to watch netflix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An unfortunate coincidence - which I now believe to be a side effect - is that my HP 6980 printer refuses to communicate with my computer to print. No one else on the network has the same issues. I have attempted to reinstall the printer multiple times without success. In the settings, the printer shows the correct information and even the ink remaining, but will not communicate when trying to print something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could my QoS settings (set up with very minimal knowledge) have removed my ability to print wirelessly? If so, how might I go about fixing it?&lt;/p&gt;&#xA;" OwnerUserId="828" LastEditorUserId="775" LastEditDate="2013-06-30T10:42:51.397" LastActivityDate="2016-01-11T04:00:46.980" Title="Can QoS settings interfere with wireless printing?" Tags="|wireless|qos|" AnswerCount="6" CommentCount="3" ClosedDate="2019-03-30T03:32:56.663" ContentLicense="CC BY-SA 3.0" />
  <row Id="745" PostTypeId="2" ParentId="744" CreationDate="2013-05-21T16:23:25.870" Score="6" Body="&lt;p&gt;Could it? Yes. Without knowing exactly what your network looks like and what &lt;em&gt;QoS&lt;/em&gt; rules/settings were used, it's hard to say for sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps I would try:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Remove QoS and see what happens&lt;/li&gt;&#xA;&lt;li&gt;Post more details on your network and configuration&lt;/li&gt;&#xA;&lt;li&gt;Check for any bugs with the printer firmware that may cause issues.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="176" LastEditorUserId="21930" LastEditDate="2016-01-11T04:00:46.980" LastActivityDate="2016-01-11T04:00:46.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="746" PostTypeId="2" ParentId="743" CreationDate="2013-05-21T16:24:21.493" Score="2" Body="&lt;p&gt;I have wondered the same thing. I'm not sure if they do recycle the addresses, but unlike IP addresses, MAC addresses are only locally-significant to the broadcast domain they reside in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just as an example, the MAC address &lt;code&gt;0000.0c07.acXX&lt;/code&gt; is an HSRP group address where 'xx' is the HSRP group number. If you use the same group number on two different VLANs, the HSRP MAC address will be the same for both.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-21T16:24:21.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="747" PostTypeId="2" ParentId="744" CreationDate="2013-05-21T16:33:05.670" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;could qos settings have removed my ability to print wirelessly?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is very unlikely since it is limited to your computer... the more probable cause is a software firewall on your pc or some other issue... steps to isolate....&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First, be sure you can still ping the printer and also that you can telnet to the printer's port (ours use TCP 515)... if you can't, them you need to solve these issues first.&lt;/li&gt;&#xA;&lt;li&gt;Next reinstall printer drivers... does this help?&lt;/li&gt;&#xA;&lt;li&gt;If all that fails, try removing the qos settings.... does that help?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-05-21T18:42:17.013" LastActivityDate="2013-05-21T18:42:17.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="748" PostTypeId="1" AcceptedAnswerId="762" CreationDate="2013-05-21T16:33:29.963" Score="8" ViewCount="3287" Body="&lt;p&gt;I'm examining options for a future expansion of our infrastructure. We rent space at a colo so we don't have a dedicated datacenter of our own. This means that our next major expansion will likely involve two discrete cages not immediately adjacent. I'm looking at ways of bringing my network into a new cage. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our current topology has a pair of HP A5820's in an IRF pair, and all of our distribution switches linked to both routers through a 10Gb BAG/Trunk port. That's all well and good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question I have comes when we add another full cage. The way I see it, I have two major options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Continue as I am, and connect the distribution switches back to the pair I already have. &lt;/li&gt;&#xA;&lt;li&gt;Pick up another pair of A5820's and connect the new cage's distribution switches to that, and link that pair to the pair I already have somehow.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It's the second option that I'm getting some confusion with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4FuZX.png&quot; alt=&quot;IRF - linear topo&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a pretty standard topology, in that I link the new switches back to the other pair in a linear topology. Anything in Cage 2 needing to go to the other switch will have to transit the full stack, though. I know this will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question here is, can I short-circuit that with a ring topology? Does IRF allow that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/oOoFj.png&quot; alt=&quot;IRF - ring topo&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would allow a shorter transit of packets. That said, I don't know if IRF allows this kind of setup. If it doesn't...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qAQnF.png&quot; alt=&quot;Paired IRF with trunks&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or I could create a second IRF device in the new cage, and link the two together with aggregation ports and not bother with IRF at all between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering each cage would have all of my distribution switches connected to both pairs, the IRF links may not actually get that much traffic across them. If so, I'm over-thinking this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I over thinking it? And if not, does IRF allow a ring topology?&lt;/p&gt;&#xA;" OwnerUserId="829" LastEditorUserId="829" LastEditDate="2013-05-21T20:26:44.957" LastActivityDate="2023-10-03T23:45:12.250" Title="Expanding an HP IRF topology" Tags="|redundancy|hp-procurve|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="749" PostTypeId="2" ParentId="743" CreationDate="2013-05-21T16:54:29.263" Score="16" Body="&lt;p&gt;MAC-48 has a maximum of 2^48 possible addresses which is somewhere in the neighborhood of 281 trillion different addresses(Compared to IPv4 which has around 4.2 billion). That said I've seen some studies and estimates saying that we won't have to worry about exhaustion until around 2100. The IEEE is one organization that supports this estimate. By that time we may not even being using MAC addresses anymore. Additionally there is another standard called EUI-64 which provides 2^64 possible addresses(24 being the OUI and 40 being the individual card number). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your question about recycling, I don't imagine vendors do it nor that IEEE supports vendors doing it. When assigning local MAC addresses a network admin could do it but I can't imagine why you would want to.&lt;/p&gt;&#xA;" OwnerUserId="736" LastActivityDate="2013-05-21T16:54:29.263" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="750" PostTypeId="2" ParentId="733" CreationDate="2013-05-21T17:01:55.747" Score="8" Body="&lt;p&gt;To fully understand why duplex mismatches occur, you need to understand how the technology evolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Originally, all Ethernet was half-duplex.  When full-duplex entered the picture, someone wisely decided that devices (especially half-duplex and full-duplex devices) should be able to agree between themselves on how they would communicate and auto-negotiation entered as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, none of those older half-duplex devices were designed to auto-negotiate, so when the standard was written, it is to be assumed by the auto-negotiating device that if the other side did not participate in negotiation, it was to run in half-duplex mode because the device on the other side must be capable of only half-duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As others have pointed out, auto-negotiation didn't always work well early on, so many devices were configured with static speed and duplex settings (often 100/full), and when a negotiating device is connected to such a device, a duplex mismatch occurs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to the problem, a duplex mismatch can be much worse than running in half-duplex mode.  This is because one side (full-duplex) thinks it can transmit at any time even if it is current receiving.  The half-duplex side will see this as a collision and back off, while the full-duplex side will keep transmitting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the full-duplex side tends to transmit a lot of data, this can &quot;starve&quot; the half-duplex side as it is waiting for the medium to clear before transmitting, causing frames to be queued and eventually dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, a bad situation to be in and one  you should fix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to detecting mismatches, you can look for errors.  On the full-duplex side, you will generally see many runts and often CRC errors (vendors may use different terms at times).  On the half-duplex side, you will often see collisions and buffer failures.  Any decent management system should be able to provide you a list of interfaces that are generating a higher than expected number of errors.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-21T20:19:11.250" LastActivityDate="2013-05-21T20:19:11.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="751" PostTypeId="1" AcceptedAnswerId="754" CreationDate="2013-05-21T17:04:27.337" Score="6" ViewCount="2548" Body="&lt;p&gt;&lt;em&gt;Does a Cisco 2148T FEX not support 100 Mb interface speed?&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When trying to manually configure a host port to run at 100/full on a 2148 FEX I receive an error that states: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ERROR:  Configuration does not match the port capability&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="830" LastActivityDate="2013-05-21T17:21:19.733" Title="Cisco 2148T FEX Port Capabilities Error" Tags="|cisco-nexus-2000|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="752" PostTypeId="2" ParentId="719" CreationDate="2013-05-21T17:05:47.700" Score="8" Body="&lt;p&gt;1000Base-T strictly speaking does not need auto-MIDX.  However, when the standard was written, inter-operation with older technologies was taken into account.  So to keep things simple, when communicating with a 100base or 10base device, auto-MIDX is there so crossover cables are no longer necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I forgot to mention, while auto-MIDX is in the standard, it is an optional feature, so it may not be present in all hardware.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-21T17:26:09.830" LastActivityDate="2013-05-21T17:26:09.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="753" PostTypeId="2" ParentId="634" CreationDate="2013-05-21T17:20:55.190" Score="3" Body="&lt;p&gt;You description is implying the issue is between the primary and secondary nodes, but the article is referencing an out of sync between the Control Plane and Data Plane ( or Routing Engine and Packet Forwarding Engine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is indeed the PFE out of Sync you might also try the hidden command 'commit full'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I had an issue where my 2 routing engines were out of sync. I don't recall if it was on a cluster SRX or something like a VC switch or dual RE router. In my case it was because I had issued a 'commit confirmed' and let the timer expire. The backup RE was out of sync. I had to log into the backup RE and manually do a 'rollback 1' to get them back in sync.&lt;/p&gt;&#xA;" OwnerUserId="299" LastActivityDate="2013-05-21T17:20:55.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="754" PostTypeId="2" ParentId="751" CreationDate="2013-05-21T17:21:19.733" Score="6" Body="&lt;p&gt;No, it does not.  The 2148 FEX has 48 1000Base-T host interfaces.  You can confirm this by checking the interface capabilities with the following command (this taken from a 2248 which does support 100Base-TX):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nexus# show interface ethernet 102/1/3 capabilities&#xA;Ethernet102/1/3&#xA;  Model:                 N2K-C2248TP-1GE&#xA;  Type (Non SFP):        --&#xA;  Speed:                 100,1000,auto&#xA;  Duplex:                full&#xA;  Trunk encap. type:     802.1Q&#xA;  Channel:               no&#xA;  Broadcast suppression: no&#xA;  Flowcontrol:           rx-(off/on),tx-(off/on)&#xA;  Rate mode:             none&#xA;  QOS scheduling:        rx-(6q1t),tx-(1p6q0t)&#xA;  CoS rewrite:           no&#xA;  ToS rewrite:           no&#xA;  SPAN:                  yes&#xA;  UDLD:                  no&#xA;  Link Debounce:         yes&#xA;  Link Debounce Time:    yes&#xA;  MDIX:                  no&#xA;  Pvlan Trunk capable:   yes&#xA;  TDR capable:           no&#xA;  FabricPath capable:    no&#xA;  Port mode:             Switched&#xA;  FEX Fabric:            no&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-21T17:21:19.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="755" PostTypeId="2" ParentId="744" CreationDate="2013-05-21T17:48:55.183" Score="4" Body="&lt;p&gt;Typically the QoS found in the SOHO routers (I assume that's what you have since you don't mention the router type) will just prioritize some traffic at the expense of other traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More advanced QoS done with on a Cisco router (for example) will allow you to do more than that, up to actually dropping specific traffic exceeding certain thresholds but I tend to believe that's not the case here. All this assuming that the QoS you configured does what you think it does. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But above all this, if this is a typical SOHO installation, then then printer will be on the local network and the traffic between your PC and the printer won't go through the firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As mentioned before, you should temporarily remove whatever QoS rules you created and see if printing works. The fact that you can see ink levels means the driver can communicate with the printer (some sort of polling usually) so I don't think it's a firewall issue on your PC. Those firewalls usually allow outbound connections. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark is also an excellent troubleshooting tool, you can try and see what kind of traffic flows between your PC and your printer, if any. &lt;/p&gt;&#xA;" OwnerUserId="714" LastActivityDate="2013-05-21T17:48:55.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="756" PostTypeId="2" ParentId="732" CreationDate="2013-05-21T17:49:48.100" Score="5" Body="&lt;p&gt;VLANs are logical networks created within the physical network.  Their primary use is to provide isolation, often as a means to decrease the size of the broadcast domain within a network, but they can be used for a number of other purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are a tool that any network engineer should be familiar with and like any tool, they can be used incorrectly and/or at the wrong times.  No single tool is the correct one in all networks and all situations, so the more tools you can use, the better you are able to work in more environments.  Knowing more about VLANs allows you to use them when you need them and to use them correctly when you do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One example of how they can be used, I currently work in an environments where SCADA (supervisory control and data acquisition) devices are used widely.  SCADA devices typically are fairly simple and have a long history of less than stellar software development, often providing major security vulnerabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have set the SCADA devices in their in a separate VLAN with no L3 gateway.  The only access into their logical network is through the server they communicate with (which has two interfaces, one in the SCADA VLAN) which can be secured with it's own host based security, something not possible on the SCADA devices.  The SCADA devices are isolated from the rest of the network, even while connected to the same physical devices, so any vulnerability is mitigated.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-21T17:49:48.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="757" PostTypeId="2" ParentId="185" CreationDate="2013-05-21T18:01:25.147" Score="0" Body="&lt;p&gt;cisco have the option 'switchport protected' that can provide basic L2 protection between ports. No traffic can be exchanged between protected ports. Yet, they can send and receive traffic to/from unprotected ports.&lt;/p&gt;&#xA;" OwnerUserId="833" LastActivityDate="2013-05-21T18:01:25.147" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="758" PostTypeId="2" ParentId="732" CreationDate="2013-05-21T18:06:11.613" Score="24" Body="&lt;p&gt;A VLAN (Virtual LAN) is a way of creating multiple virtual switches inside one physical switch. So for instance ports configured to use VLAN 10 act as if they're connected to the exact same switch. Ports in VLAN 20 can not directly talk to ports in VLAN 10. They must be routed between the two (or have a link that bridges the two VLANs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a lot of reasons to implement VLANs. Typically the least of these reasons is the size of the network. I'll bullet list a few reasons and then break each one open.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Security&lt;/li&gt;&#xA;&lt;li&gt;Link Utilization&lt;/li&gt;&#xA;&lt;li&gt;Service Separation&lt;/li&gt;&#xA;&lt;li&gt;Service Isolation&lt;/li&gt;&#xA;&lt;li&gt;Subnet Size&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Security:&lt;/strong&gt;&#xA;Security isn't itself achieved by creating a VLAN; however, how you connect that VLAN to other subnets could allow you to filter/block access to that subnet. For instance if you have an office building that has 50 computers and 5 servers you could create a VLAN for the server and a VLAN for the computers. For computers to communicate with the servers you could use a firewall to route and filter that traffic. This would then allow you to apply IPS/IDS,ACLs,Etc. to the connection between the servers and computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Link Utilization:&lt;/strong&gt;&#xA;(Edit)I can't believe I left this out the first time. Brain fart I guess. Link utilization is another big reason to use VLANs. Spanning tree by function builds a single path through your layer 2 network to prevent loops (Oh, my!). If you have multiple redundant links to your aggregating devices then some of these links will go unused. To get around this you can build multiple STP topology with different VLANs. This is accomplished with Cisco Proprietary PVST, RPVST, or standards based MST. This allows you to have multiple STP typologies you can play with to utilize your previously unused links. In example if I had 50 desktops I could place 25 of them in VLAN 10, and 25 of them in VLAN 20. I could then have VLAN 10 take the &quot;left&quot; side of the network and the remaining 25 in VLAN 20 would take the &quot;right&quot; side of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Service Separation:&lt;/strong&gt;&#xA;This one is pretty straight forward. If you have IP security cameras, IP Phones, and Desktops all connecting into the same switch it might be easier to separate these services out into their own subnet. This would also allow you to apply QOS markings to these services based on VLAN instead of some higher layer service (Ex: NBAR). You can also apply ACLs on the device performing L3 routing to prevent communication between VLANs that might not be desired. For instance I can prevent the desktops from accessing the phones/security cameras directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Service Isolation:&lt;/strong&gt;&#xA;If you have a pair of TOR switches in a single rack that has a few VMWare hosts and a SAN you could create a iSCSI VLAN that remains unrouted. This would allow you to have an entirely isolated iSCSI network so that no other device could attempt to access the SAN or disrupt communication between the hosts and the SAN. This is simply one example of service isolation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Subnet Size:&lt;/strong&gt;&#xA;As stated before if a single site becomes too large you can break that site down into different VLANs which will reduce the number of hosts that see need to process each broadcast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are certainly more ways VLANs are useful (I can think of several that I use specifically as an Internet Service Provider), but I feel these are the most common and should give you a good idea on how/why we use them. There are also Private VLANs that have specific use cases and are worth mentioning here.&lt;/p&gt;&#xA;" OwnerUserId="287" LastEditorUserId="287" LastEditDate="2013-05-21T19:11:45.777" LastActivityDate="2013-05-21T19:11:45.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="759" PostTypeId="2" ParentId="732" CreationDate="2013-05-21T18:09:30.853" Score="1" Body="&lt;p&gt;If I may offer one more piece of information, which might help. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand VLAN's, you must also understand two key concepts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Subnetting - Assuming you want the various devices to be able to talk to one another (servers and clients, for example) each VLAN must be assigned an IP subnet. This is the SVI mentioned above. That enables you to begin routing between the vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Routing - Once you have each VLAN created, a subnet assigned to the clients on each VLAN, and an SVI created for each VLAN, you will need to enable routing. Routing can be a very simple setup, with a static default route to the internet, and EIGRP or OSPF network statements for each of the subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you see how it all comes together, it is actually quite elegant.&lt;/p&gt;&#xA;" OwnerUserId="487" LastActivityDate="2013-05-21T18:09:30.853" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="760" PostTypeId="2" ParentId="691" CreationDate="2013-05-21T18:09:35.090" Score="5" Body="&lt;p&gt;6500 is generally MPLS ready in terms of label support, LDP support and things like VRFs for MPLS VPNs. Some features may be missing because of specific choice of software and hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in your configuration, you'll have very small FIB for services - you have only PFC3B which can hold 256k IPv4 prefixes, or 128k IPv6 prefixes, or half of that for MPLS VPN services (MPLS label takes two entries basically).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second problem you may hit is the fact that while the 6748 LC you have has MPLS tagging support, it will only do 802.1q tunneling - if you need 802.1q swapping and elastic modifications/etc there is a a whole set of different restrictions (port groups) which you can start to deep dive into here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/dot1qtnl.html#wp1006495&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/dot1qtnl.html#wp1006495&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, for 6500 to function as fully fledged metro ethernet edge you'll either need SIP linecards (SIP-200 and SIP-400) or ES/ES+ linecards, which are by itself feature-rich for services like tag swapping, services termination, QoS/HQoS etc. The &quot;LAN cards&quot; as they're called (WS-X6[1357]xx series) are limited in QoS and L2 manipulation flexibility. &lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-05-21T18:09:35.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="761" PostTypeId="2" ParentId="732" CreationDate="2013-05-21T18:21:43.917" Score="3" Body="&lt;p&gt;&lt;em&gt;The&lt;/em&gt; basic use case for VLANs is almost exactly the same as the basic use case for segmentation of the network into multiple data link broadcast domains. The key difference is that with a &lt;em&gt;physical&lt;/em&gt; LAN, you need at least one device (typically a switch) for each broadcast domain, whereas with a &lt;em&gt;virtual&lt;/em&gt; LAN broadcast domain membership is determined on a port-by-port basis and is reconfigurable without adding or replacing hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For basic applications, apply the same design principles to VLANs as you would for PLANs. The three concepts you need to know to do this are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Trunking&lt;/strong&gt; - Any link that carries frames belonging to more than one VLAN is a &lt;em&gt;trunk&lt;/em&gt; link. Typically switch-to-switch and switch-to-router links are configured to be &lt;em&gt;trunk&lt;/em&gt; links.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Tagging&lt;/strong&gt; - When transmitting to a trunk link, the device must &lt;em&gt;tag&lt;/em&gt; each frame with the numeric VLAN ID to which it belongs so that the receiving device can properly confine it to the correct broadcast domain. In general, host-facing ports are &lt;em&gt;untagged&lt;/em&gt;, while switch-facing and router-facing ports are &lt;em&gt;tagged&lt;/em&gt;. The &lt;em&gt;tag&lt;/em&gt; is an additional part of the data link encapsulation.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Virtual Interfaces&lt;/strong&gt; - On a device with one or more trunk link interfaces, it is often necessary to attach, in the logical sense, the device as a link terminal to one or more of the individual VLANs that are present within the trunk. This is particularly true of routers. This logical link attachment is modeled as a &lt;em&gt;virtual interface&lt;/em&gt; that acts as a port that is connected to the single broadcast domain associated with the designated VLAN.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="47" LastActivityDate="2013-05-21T18:21:43.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="762" PostTypeId="2" ParentId="748" CreationDate="2013-05-21T18:22:53.703" Score="10" Body="&lt;p&gt;I'm not HP savvy but I did some quick Googling (hp irf ring topology) and found a couple of docs that indicate it does support a ring topology.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c02648772/c02648772.pdf&quot;&gt;c02648772.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Quote from page 5: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IRF topologies&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Create an IRF virtual device in daisy chain topology,&#xA;  or more reliably, ring topology, as shown in Figure 2. In ring chain&#xA;  topology, the failure of one IRF link does not cause the IRF virtual&#xA;  device to split as in daisy chain topology. Rather, the IRF virtual&#xA;  device changes to a daisy chain topology without affecting network&#xA;  services.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?lang=en&amp;amp;cc=us&amp;amp;taskId=120&amp;amp;prodSeriesId=5195279&amp;amp;prodTypeId=12883&amp;amp;objectID=c03239130&quot;&gt;This page&lt;/a&gt; has the same quote so at least that seems like a possibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HP seems to be recommending the ring but beyond that I can't speak to HP gear.&lt;/p&gt;&#xA;" OwnerUserId="165" LastActivityDate="2013-05-21T18:22:53.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="763" PostTypeId="2" ParentId="42" CreationDate="2013-05-21T18:24:31.500" Score="1" Body="&lt;p&gt;NfSen/nfdump (&lt;a href=&quot;http://nfsen.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;http://nfsen.sourceforge.net/&lt;/a&gt;) are really good for netflow. Stores your data in RRD format, and has a lot of options for displaying and processing.&lt;/p&gt;&#xA;" OwnerUserId="834" LastActivityDate="2013-05-21T18:24:31.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="764" PostTypeId="2" ParentId="704" CreationDate="2013-05-21T20:09:01.983" Score="2" Body="&lt;p&gt;Oversubscription happens when your network does not have the capacity to handle the traffic if all devices start sending at maximum speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In many cases this is not a problem, and it is very common in networking and many other areas. When running virtual machines, the host does not have all CPU, RAM and disk storage promised to its guests. Airlines and hotel owners are also well known to overbook.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you oversubscribe, you save money, but take the risk of having capacity problems when there is a usage peak. You should consider how much and where to oversubscribe in your network design. And always keep an eye on the meters to spot trends that require adding extra capacity to prevent structural performance issues.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-05-21T20:09:01.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="765" PostTypeId="1" AcceptedAnswerId="938" CreationDate="2013-05-21T20:14:39.260" Score="5" ViewCount="2623" Body="&lt;p&gt;I'm trying to configure the dedicated XML agent on IOS XR 4.2.3 (ASR9K) .  The &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r4.1/xml/programming/guide/xl41apidoc.html&quot; rel=&quot;nofollow&quot;&gt;API guide&lt;/a&gt;&#xA; says to do the&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xml agent&#xA;aaa authorization exec default local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which I did, and I can connect to the router on port 38751, but then I get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;telnet 10.1.1.1 38751&#xA;&#xA;Escape character is '^]'.&#xA;&#xA;&#xA;User Access Verification&#xA;&#xA;Username: aaronw&#xA;Password: blah&#xA;&#xA;&#xA;User Access Verification&#xA;&#xA;Username: aaronw&#xA;Password: realpassword&#xA;Session start failed :'AAA API' detected the 'fatal' condition&#xA;'No method could process the authorisation request'Connection closed by foreign host.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if I put in a fake password, it knows that it's the wrong one, and doesn't go any further, but when I put in my real password it looks like I'm missing some kind of link-up between the authorization engine and the XML engine.  If I take out the aaa authorizaion exec default local, I get a slightly different error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Session start failed :'AAA API' detected the 'fatal' condition &#xA;'Requested function is     not configured'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know the API guide linked is the 4.1 version, but I can't find the 4.2 version of the same document.  Also, the XML tty agent (i.e., typing 'XML' at the # prompt) does work as expected.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:ios#xml echo format &#xA;Tue May 21 20:32:01.802 UTC&#xA;XML&amp;gt; exit&#xA;RP/0/RSP0/CPU0:ios#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="178" LastEditorUserId="178" LastEditDate="2013-05-21T20:33:02.633" LastActivityDate="2019-06-24T13:06:06.703" Title="Running XML agent on IOS XR" Tags="|management|cisco-ios-xr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="766" PostTypeId="2" ParentId="748" CreationDate="2013-05-21T20:42:38.607" Score="4" Body="&lt;p&gt;IRF definitely supports a ring topology, and as long as that setup makes sense for your environment, then it's definitely the preferable way to expand.&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-05-21T20:42:38.607" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="767" PostTypeId="1" CreationDate="2013-05-21T20:50:40.193" Score="5" ViewCount="691" Body="&lt;p&gt;Is anyone aware of an IOS version for the C3560G that supports configuring a neighbor to exchange IPv6 routes? Apparently 12.2(37)SE Advanced IP Services can't do it - as soon as you try to activate the address-family it throws &lt;code&gt;% BGP context not been initialized properly&lt;/code&gt; (great Engrish there Cisco).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the record, I &lt;em&gt;have&lt;/em&gt; enabled dual ipv4 &amp;amp; ipv6, it does OSPFv3 just fine.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2019-03-19T13:06:19.083" Title="address-family ipv6 on Cisco 3560G" Tags="|ipv6|bgp|bgp-ipv6|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="768" PostTypeId="1" AcceptedAnswerId="769" CreationDate="2013-05-21T21:05:28.553" Score="6" ViewCount="608" Body="&lt;p&gt;We use Cisco WAAS appliances for WAN optimization. With increasing traffic, we noticed that the connection limit was frequently reached. In case of our WAVE-574-K9 with 3 GB RAM, there was a limit of 750 connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So we decided to upgrade the RAM, since it's said that this will raise the supported number of connections. No problem to get 3rd party memory, since it's an OEM version of a Hewlett-Packard Proliant server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After I installed 2x2 GB RAM modules, removing one 1 GB module. However, the connection limit stays the same, as I can see in the WAAS central manager monitoring. How can I get more connections?&lt;/p&gt;&#xA;" OwnerUserId="231" LastActivityDate="2013-05-25T10:48:36.407" Title="After a memory upgrade of my Cisco WAAS, why is the connection limit still the same, how can I raise it?" Tags="|cisco|waas|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="769" PostTypeId="2" ParentId="768" CreationDate="2013-05-21T21:05:28.553" Score="7" Body="&lt;p&gt;At first, ensure that the memory modules work and are recognized:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show memory&#xA;Total memory             :    5986852 KB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After adding RAM, it's necessary to repartition the disks for resetting the space allocation for the data redundancy elimination:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;disk delete-data-partitions&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A &lt;code&gt;reload&lt;/code&gt; forces rebuilding of the partitions. You can watch the progress using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show disks details&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If this is finished, check your connections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show tfo detail&#xA;&#xA;   Policy Engine Config Item            Value&#xA;   -------------------------            -----&#xA;   State                                Registered&#xA;   Default Action                       Use Policy&#xA;   Connection Limit                     1300&#xA;   Effective Limit                      1290&#xA;   Keepalive timeout                    3.0 seconds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I could see, the connection limit has been doubled now after doubling the memory.&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="231" LastEditDate="2013-05-25T10:48:36.407" LastActivityDate="2013-05-25T10:48:36.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="770" PostTypeId="2" ParentId="767" CreationDate="2013-05-21T21:05:36.680" Score="2" Body="&lt;p&gt;I think this would require an 'Advanced Enterprise Services' package. &lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-05-21T21:05:36.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="771" PostTypeId="1" AcceptedAnswerId="777" CreationDate="2013-05-21T21:10:35.713" Score="13" ViewCount="9606" Body="&lt;p&gt;I've always wondered what the use of wild card masks was. When I learned about them in college  I wondered what the use was, we saw that you could separate subnets by for instance even and uneven IPs. What is the practical use of wild card masks vs normal subnet masks?&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2016-04-15T18:48:33.040" Title="What is the use of wild card masks vs normal masks" Tags="|ipv4|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="772" PostTypeId="2" ParentId="771" CreationDate="2013-05-21T21:13:59.977" Score="12" Body="&lt;p&gt;There are some odd corner cases you can do with wild card masks that are difficult to do with subnet masks - for example, you could do 1.2.*.4 easily in a wild card mask that would be hard to do in a subnet mask.  How practical this is is left up to the operator in question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically a wild card mask splits up each bit into a 'match' or 'don't care' setting.  if you have 255.255.255.33. for example, that would translate to '11111111.11111111.11111111.00100001'.  If the original IP was 1.1.1.200, this translates to 00000001.00000001.00000001.10001000.  Using the example given, which is starting to make my brain hurt from doing binary math, only the 3 and 8th bit of the last octet would have to match the original IP in order to be a pass (along with the other 3 octets).&lt;/p&gt;&#xA;" OwnerUserId="178" LastEditorUserId="178" LastEditDate="2013-05-21T22:54:47.683" LastActivityDate="2013-05-21T22:54:47.683" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="773" PostTypeId="2" ParentId="767" CreationDate="2013-05-21T21:25:31.007" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/go/fn&quot; rel=&quot;nofollow&quot;&gt;Feature Navigator&lt;/a&gt;, that would be a big'ol negative. 'tho the 3560C appears to support it.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-21T21:25:31.007" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="774" PostTypeId="2" ParentId="771" CreationDate="2013-05-21T21:52:11.593" Score="5" Body="&lt;p&gt;Wildcard masks are also used to specify source/destination subnets (or specific addresses) in access control lists. They're also used to specify protocol interfaces that OSPF will use in more &quot;traditional&quot; versions of IOS (NX-OS and probably IOS-XR notwithstanding).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: A subnet mask's job is to separate host bits from network bits. The number of 1's in the subnet mask &lt;strong&gt;has to be contiguous&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111.11111111.00000000.00000000 &amp;lt;-- valid subnet mask (/16)&#xA;11111111.11111111.11111000.00000000 &amp;lt;-- valid subnet mask (/21)&#xA;11111111.11111111.00111000.00000000 &amp;lt;-- whoops, invalid subnet mask&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Wildcard masks are not bound by this rule (hence the term &quot;wildcard&quot;), therefore you can do things like Aaron had mentioned, ie:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 1 permit 192.168.200.0 0.6.0.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will permit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.200.0&#xA;192.172.200.0&#xA;192.168.200.8&#xA;192.172.200.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-21T23:07:02.040" LastActivityDate="2013-05-21T23:07:02.040" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="775" PostTypeId="2" ParentId="771" CreationDate="2013-05-21T22:05:11.707" Score="2" Body="&lt;p&gt;They are somewhat a hold out from when bits were precious and processing data in certain ways (binary AND or binary OR) was less taxing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, they are still useful in other cases, as Aaron has already mentioned.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-21T22:05:11.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="776" PostTypeId="2" ParentId="732" CreationDate="2013-05-21T22:49:36.333" Score="2" Body="&lt;p&gt;The original use of a vlan was to restrict the broadcast area in a network. Broadcasts are limited to their own vlan. Later additional funtionality was added. However, keep in mind that vlan's are layer 2 in for example cisco switches. You can add layer 2 by assigning an IP address to the port on the switch but this is not mandatory. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;additional functionality:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;trunking: use multiple vlan's through one physical connection (ex: connecting 2 switches, one physical link is good enough to have a connection for all vlan's, seperating the vlan's is done by tagging, see: dot1Q for cisco)&lt;/li&gt;&#xA;&lt;li&gt;security&lt;/li&gt;&#xA;&lt;li&gt;easier to manage (ex: shutdown on a vlan doesn't impact the other vlan's connectivity...)&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-05-21T22:49:36.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="777" PostTypeId="2" ParentId="771" CreationDate="2013-05-22T01:03:22.997" Score="7" Body="&lt;p&gt;As I understand it, the question is what is the reason for the two different masks, not what are the differences between the masks. The two questions overlap somewhat, but it comes down to binary math (as YLearn hits on).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, a netmask:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP:   1100 0000 . 1010 1000 . 1111 1000 . 0110 0100 = 192.168.248.100&#xA;Mask: 1111 1111 . 1111 1111 . 1111 1111 . 1111 1000 = 255.255.255.248&#xA;AND:  1100 0000 . 1010 1000 . 1111 1000 . 0110 0000 = 192.168.248.96&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;AND&lt;/strong&gt; operation on the IP address with the netmask results in the network &lt;code&gt;192.168.248.96/29&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, a wildcard:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NET:  1100 0000 . 1010 1000 . 1111 1000 . 0110 0000 = 192.168.248.96&#xA;WC:   0000 0000 . 0000 0000 . 0000 0000 . 0000 0111 = 0.0.0.7&#xA;OR:   1100 0000 . 1010 1000 . 1111 1000 . 0110 0111 = 192.168.248.103&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;performing an OR operation on the network results in the range of IPs (192.168.248.96-103) that may be permitted or blocked in an ACL or OSPF network statement (remember that OSPF only looks for interfaces that fall within the specified ranges -- i.e. it doesn't match IP &lt;em&gt;and&lt;/em&gt; netmask, just the IP). It's very easy to check whether an IP is in range with:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IP &lt;strong&gt;OR&lt;/strong&gt; WC == NET &lt;strong&gt;OR&lt;/strong&gt; WC&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is useful to the router because the netmask does not easily give you this information (without additional operations).&lt;/p&gt;&#xA;" OwnerUserId="186" LastActivityDate="2013-05-22T01:03:22.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="778" PostTypeId="2" ParentId="601" CreationDate="2013-05-22T01:46:23.230" Score="3" Body="&lt;p&gt;I've seen similar issues twice in the past. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first time, it had to do with DNS resolution. I performed a DNS lookup on a client that was having issues, and realized that the client wasn't capable of resolving the URL that I was passing for the login page. This was because I was passing an external DNS server. Check that first. I resolved that by passing the IP in the URL, although you could create a cname that resolves to 1.1.1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second time, it was a certificate issue. Some default browsers won't show the splash screen if the user must accept a self-signed certificate. I would test that by manually browsing to the splash screen or login page from a client that does not automatically show it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope one of those helps you out. I know that I was ready to pull my hair out when I saw this the first time. &lt;/p&gt;&#xA;" OwnerUserId="487" LastActivityDate="2013-05-22T01:46:23.230" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="779" PostTypeId="2" ParentId="744" CreationDate="2013-05-22T02:00:34.677" Score="1" Body="&lt;p&gt;If you are installing the driver, and connecting to local printer directly, but other users are connecting to a print cue located on a server, it is possible that the QOS is causing you issues. When you print to directly to a printer, the amount of data is quite large. With most drivers, a print job gets passed as a TIFF image. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, assuming the wireless network is a different subnet/vlan as the one containing the printer...and that the printer and server/print cue are on the same vlan/subnet...and also that you are connected directly to the printer (safe assumption, since you can see printer stats), your large print job (tiff image) may be captured by QOS, while everyone else's job is passing from the server to the printer without ever crossing an L3 boundary, and being subjected to the QOS policy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that makes sense.&lt;/p&gt;&#xA;" OwnerUserId="487" LastActivityDate="2013-05-22T02:00:34.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="780" PostTypeId="1" CreationDate="2013-05-22T02:31:52.347" Score="16" ViewCount="36255" Body="&lt;p&gt;I have a network that has been experiencing slow internet speeds. After a great deal of troubleshooting, I have determined that any streaming content/downloads will cause the latency of WAN traffic to explode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, under no load, I ping 8.8.8.8 at about 30ms. If I start streaming YouTube on the same computer, latency jumps up to around 500ms, with a variance of around 400ms. If I turn off the video, the latency returns to 30ms. But, if I have a user on the same LAN start streaming pandora, the problem returns. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network is ran off a single 10/100 switch. The switch is connected directly to the DSL router. I typically have a 6Mb connection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In troubleshooting, I have completed the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Scanned with wireshark from several workstations looking for erroneous packets. (I would include but scans have confidential info). Nothing even remotely out of the ordinary.&lt;/li&gt;&#xA;&lt;li&gt;Replaced router with an upgraded model, then upgraded firmware. &lt;/li&gt;&#xA;&lt;li&gt;Had ISP increase speed which measured correctly on speedtest.net (10 down, 1.5 up). Problem was exactly the same. &lt;/li&gt;&#xA;&lt;li&gt;Had the ISP swap out cards on their end, just in case they had bad hardware/port.&lt;/li&gt;&#xA;&lt;li&gt;Tested at another office with exact same ISP/package. Had multiple computers streaming YouTube @ 1080p and pandora without impacting latency. &lt;/li&gt;&#xA;&lt;li&gt;Shut down every computer but one and ran at night when no users where there.&lt;/li&gt;&#xA;&lt;li&gt;Monitored LAN traffic, which never experiences a latency problem. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am aware that, if I am reaching a bandwith limit or the speed is bottlenecking at some hardware, it will cause this problem. However, it doesn't seem that way at all. Almost any traffic over the WAN will shoot up latency. The problem was the same even when I almost doubled connection speed. When I get two users on pandora and a couple surfing, internet goes to nothing (dropped packets, pages won't load). I have half the connection at home and our simultaneous netflix/youtube/pandora streaming doesn't even touch my 5 Mb. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: What would cause high latency anytime traffic is going over the WAN?&lt;/p&gt;&#xA;" OwnerUserId="845" LastEditorUserId="441" LastEditDate="2013-05-24T16:10:08.477" LastActivityDate="2019-03-05T14:50:16.650" Title="What would cause high latency anytime there is traffic on WAN?" Tags="|latency|congestion|wan|" AnswerCount="12" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="781" PostTypeId="2" ParentId="780" CreationDate="2013-05-22T02:52:36.997" Score="5" Body="&lt;p&gt;Check the DSL line statistics. (interleaved vs. fastpath, error counters, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The test at a different location tested a &lt;em&gt;different line&lt;/em&gt;, maybe on a different DSLAM.  This suggests the ISP infrastructure isn't to blame. It strongly suggests your DSL line is at fault. Possibly the DSLAM itself is congested, but it's highly unlikely for you to be the one to be pushing it over the line predictably and repeatedly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If ATM cells are being corrupted (the transport for most DSL), you'd see significant slow downs like this as the entire frame has to be resent.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-22T02:52:36.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="782" PostTypeId="2" ParentId="780" CreationDate="2013-05-22T03:14:24.480" Score="9" Body="&lt;p&gt;I would verify where the latency is occurring.  Use a tool such as &lt;a href=&quot;https://en.wikipedia.org/wiki/MTR_%28software%29&quot;&gt;MTR&lt;/a&gt; which checks the latency at each hop.  MTR combines ping statistics for each hop with a trace route, and can greatly help narrow down this type of problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a linux box the command would be &lt;code&gt;mtr 8.8.8.8&lt;/code&gt;, there is also a &lt;a href=&quot;http://winmtr.net/&quot;&gt;windows version&lt;/a&gt; of this tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output will show you where the latency starts.  If it is on the ISP network, you could forward the output to the ISP and help them use it to troubleshoot their network problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the latency starts inside your network, you'll be able to narrow down the problem yourself as well.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-05-22T03:14:24.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="783" PostTypeId="2" ParentId="780" CreationDate="2013-05-22T03:21:50.957" Score="10" Body="&lt;p&gt;This sounds like some form of &quot;&lt;a href=&quot;http://en.wikipedia.org/wiki/Bufferbloat&quot;&gt;bufferbloat&lt;/a&gt;&quot;, probably on the part of the DSLAM/LNS that's performing the 6Mb rate limiting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be your CPE box, but that's a little less likely.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-22T03:21:50.957" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="784" PostTypeId="1" AcceptedAnswerId="786" CreationDate="2013-05-22T03:31:41.317" Score="10" ViewCount="4703" Body="&lt;p&gt;&lt;strong&gt;Context&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We use Cisco 891 routers as CPE for several client sites. They are all running IOS 15.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco IOS Software, C890 Software (C890-UNIVERSALK9-M), Version 15.0(1)M8, RELEASE SOFTWARE (fc1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The majority of these sites terminate against an external ADSL2 modem which we put into bridge mode (I can't recall the exact bridge mode, but basically the modem just passes everything through).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We rely on our Cisco 891 devices for PPP session termination, NAT, etc... And I've come up with the below config, we've been successfully for some time with our main ISP, its been working fine:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0&#xA; description WAN PPPoE ADSL2+&#xA; bandwidth 1024&#xA; bandwidth receive 20480&#xA; no ip address&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA; pppoe-client dial-pool-number 1&#xA;&#xA;interface Dialer0&#xA; description ADSL2+ Dialer Interface&#xA; bandwidth 1024&#xA; bandwidth receive 20480&#xA; ip address negotiated&#xA; no ip redirects&#xA; no ip proxy-arp&#xA; ip mtu 1492&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; encapsulation ppp&#xA; ip tcp adjust-mss 1452&#xA; dialer pool 1&#xA; dialer-group 1&#xA; ppp authentication chap pap callin&#xA; ppp chap hostname XXX@isp.com&#xA; ppp chap password 0 XXX&#xA; ppp pap sent-username XXX@isp.com password 0 XXX&#xA; no cdp enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, in the last few days our ISP has made some changes which has affected a few customer sites, and they've said we need to ensure that all CPE are using &lt;strong&gt;&quot;PPPoA and VC Mux encapsulation&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been looking at some existing Cisco CPE and cannot figure out a way to ensure we are using PPPoA, or a way to force that if not. It looks like, right now, that we're using PPPoE:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PPPoE vaccess, cloned from Dialer0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All config examples I've found are using ATM interface which allows specification of PVC, encapsulation settings etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can understand that things like PVC settings are modem-related and so would not be in the router config as our routers do not contain the modem functionality. But, can I assume that once the traffic has passed the modem to the WAN interface on the router, the ATM cells have been converted to Ethernet packets, and is this why there is no way (that I can see) to configure PPPoA instead of PPPoE?&lt;/p&gt;&#xA;" OwnerUserId="846" LastEditorUserId="1664" LastEditDate="2013-10-06T17:10:48.033" LastActivityDate="2013-10-06T17:10:48.033" Title="PPPoA ADSL Configuration with external modem on Cisco 891" Tags="|cisco|cisco-commands|cisco-ios-15|ppp|adsl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="785" PostTypeId="1" AcceptedAnswerId="787" CreationDate="2013-05-22T03:45:08.197" Score="8" ViewCount="6378" Body="&lt;p&gt;My understanding of the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clear ip bgp * soft out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is that the router on which the command is issued will re-advertise everything it knows about BGP to it's neighbors. As I see it, it's as if the two routers are creating a brand new adjacency, without severing the adjacency first (which would adversely affect the BGP reliability metrics).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;My question is this: How can I verify that the command has been successful? When I issue&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip bgp nei&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the &quot;Route Refresh&quot; column still displays 0 sent and 0 received. I don't have access to the provider device (my BGP Neighbor), but I need to verify that my changes have been received by the provider. Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="756" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:36.367" LastActivityDate="2020-08-10T22:17:24.990" Title="BGP - Soft Reset Outbound &amp; Verification" Tags="|bgp|routing|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="786" PostTypeId="2" ParentId="784" CreationDate="2013-05-22T03:51:34.977" Score="9" Body="&lt;p&gt;Technically, you're doing PPPoEoA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VC Mux part will have to be set on the modem, as that's the only thing that has access to the ATM layer.  If you had a dsl interface in the router, you'd do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;blue-gw#show run int atm0.1&#xA;Building configuration...&#xA;&#xA;Current configuration : 131 bytes&#xA;!&#xA;interface ATM0.1 point-to-point&#xA; bandwidth 6000&#xA; pvc dsl 8/35 &#xA;  encapsulation aal5mux ppp dialer&#xA;  dialer pool-member 1&#xA; !&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other devices will vary.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-22T03:51:34.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="787" PostTypeId="2" ParentId="785" CreationDate="2013-05-22T03:51:49.440" Score="10" Body="&lt;p&gt;Soft reconfig (inbound) is only used if route refresh isn't supported (you also have to explicitly configure this); They're two different things. Does &quot;show ip bgp neighbor x.x.x.x&quot; output show route refresh in its advertised capabilities - &quot;advertised &amp;amp; received&quot;? To answer your question, the only way that you can verify that the &quot;soft reconfig out&quot; took effect (because this basically tells your router to refresh your outbound policy and send the updates to the neighbor) is to verify this with your provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: To clarify, I suppose it depends on what policy you're trying to set. You can always do &quot;show ip bgp neigh x.x.x.x advertised-routes&quot; but AFAIK you can't get &lt;strong&gt;all&lt;/strong&gt; the bits of info, i.e. communities (disclaimer: this was how it worked with Cisco kit I've worked on, not sure if Juniper/whomever else is better here or not).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One last edit (to clear up any possible confusion):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Soft reconfig inbound is used really to refresh your inbound policy in accordance to what someone is sending you. It basically stores a copy of the Adj-RIB(s)-In and when &quot;clear ip bgp neigh x.x.x.x soft in&quot; is run, it refreshes your inbound policy by applying it to the [copy] Adj-RIB-In prefixes before inserting them into the Loc-RIB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the route refresh capability, it eliminates the need to store a copy of the Adj-RIB-In and (assuming the neighbor supports it) will allow you to request a route refresh from the neighbor via just doing &quot;clear ip bgp neigh x.x.x.x in&quot; - no &quot;soft&quot; needed. In addition, even if your neighbor is capable of route refresh, and you've configured that neighbor with soft-reconfig, the soft-reconfig will take precedence over route refresh (not ideal due to the increased memory footprint with running soft-reconfig).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Soft reconfig outbound (you don't need anything to turn this on, you get it for free) will re-run your Loc-RIB (Adj-RIB-Out is just a pointer back to the Loc-RIB) through your outbound policies and send those updates to the peer.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="253" LastEditDate="2013-05-22T20:45:14.770" LastActivityDate="2013-05-22T20:45:14.770" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="788" PostTypeId="2" ParentId="780" CreationDate="2013-05-22T04:07:05.783" Score="2" Body="&lt;p&gt;Another thing to look at would be the connection between your switch and the DSL modem.  The symptoms you are describing almost sound like there is a duplex mismatch between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to rule out the switch is to remove the switch entirely and test the connection with one machine attached directly to the DSL modem.&lt;/p&gt;&#xA;" OwnerUserId="204" LastActivityDate="2013-05-22T04:07:05.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="789" PostTypeId="1" AcceptedAnswerId="831" CreationDate="2013-05-22T04:26:29.117" Score="23" ViewCount="40751" Body="&lt;p&gt;Can someone explain with an example whats the difference between an access list and prefix list.  &lt;/p&gt;&#xA;" OwnerUserId="777" LastEditorUserId="775" LastEditDate="2013-05-22T06:17:54.770" LastActivityDate="2016-04-11T14:02:41.117" Title="Difference between access list and prefix list?" Tags="|cisco|routing|acl|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="790" PostTypeId="2" ParentId="789" CreationDate="2013-05-22T04:53:23.213" Score="10" Body="&lt;p&gt;Not a whole lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They both provide means to filter on network addresses, but there are a couple key differences:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Extended ACL's can filter based on &quot;higher layer&quot; information, ie TCP/UDP port. Prefix lists cannot.&lt;/li&gt;&#xA;&lt;li&gt;Extended/Standard ACL's can use wildcard masks which allow for the specification of arbitrary addresses or ranges of addresses. Prefix lists can't do this.&lt;/li&gt;&#xA;&lt;li&gt;Prefix lists can match on &lt;strong&gt;prefix lengths&lt;/strong&gt; - either minimum or maximum lengths with the &quot;ge&quot; and &quot;le&quot; keywords, respectively.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For routing policy, folks will tend to prefer to use prefix lists because some feel that they're more &quot;expressive&quot; but there is not much to limit you to using one or the other - it will be what the situation/requirements call for.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-05-22T04:53:23.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="791" PostTypeId="2" ParentId="780" CreationDate="2013-05-22T05:04:28.383" Score="0" Body="&lt;p&gt;Could this be a bottleneck upstream? Not sure where you are in the world, but perhaps the ISP has terrible international bandwidth. Speedtest.net would default to the closest server. &lt;/p&gt;&#xA;" OwnerUserId="760" LastActivityDate="2013-05-22T05:04:28.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="792" PostTypeId="1" AcceptedAnswerId="795" CreationDate="2013-05-22T05:30:52.423" Score="16" ViewCount="110777" Body="&lt;p&gt;Are there any significant differences between VRRP and HSRP? &lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="3191" LastEditDate="2014-05-09T08:04:05.787" LastActivityDate="2020-04-01T00:38:06.140" Title="What are the differences between VRRP and HSRP?" Tags="|routing|backups|hsrp|fhrp|vrrp|" AnswerCount="7" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="793" PostTypeId="2" ParentId="792" CreationDate="2013-05-22T05:32:24.283" Score="3" Body="&lt;p&gt;HSRP is Cisco-proprietary. VRRP is not (RFC 5798). There are probably other nitty gritty technical differences, but that is the major one. And IIRC VRRP doesn't have the ability to do interface tracking, while HSRP does - might be wrong on this though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: RFC 5798 gives v6 support to VRRP. The original RFC was 2338.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-05-22T05:32:24.283" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="794" PostTypeId="1" AcceptedAnswerId="806" CreationDate="2013-05-22T05:35:26.680" Score="5" ViewCount="6121" Body="&lt;p&gt;I recently tried the command &quot;no autostate&quot; on a GigabitEthernet interface (on a newer router) and this didn't work anymore, does anyone know why this is occuring? This use to work on FastEthernet interfaces. Any alternative suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Working configuration: (Cisco router 881)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface vlan 2&#xA;no autostate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not working: (Cisco router 1921)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface vlan 2&#xA;no autostate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="623" LastEditorUserId="623" LastEditDate="2013-05-30T11:46:27.203" LastActivityDate="2013-05-30T11:46:27.203" Title="Cisco: No autostate on GigabitEthernet interfaces, any alternative? (not working)" Tags="|cisco|cisco-commands|testing|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="795" PostTypeId="2" ParentId="792" CreationDate="2013-05-22T05:48:38.357" Score="24" Body="&lt;p&gt;Besides VRRP not being proprietary, there are a few minor differences between the protocols as well:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;With HSRP, each interface must have an IP address that is separate from the HSRP group address. VRRP lets you share the Master's interface IP address.&lt;/li&gt;&#xA;&lt;li&gt;On Cisco devices, VRRP is configured to preempt by default, whereas HSRP is not configured to preempt by default.&lt;/li&gt;&#xA;&lt;li&gt;On Cisco devices, HSRP sends hellos every 3 seconds and has a dead timer of 10 seconds. VRRP sends advertisements every 1 second and has a dead timer of roughly three times the advertisement interval.&lt;/li&gt;&#xA;&lt;li&gt;VRRP can be configured to learn the timer configuration from the Master.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-22T05:48:38.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="796" PostTypeId="5" CreationDate="2013-05-22T06:15:29.667" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-22T06:15:29.667" LastActivityDate="2013-05-22T06:15:29.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="797" PostTypeId="4" CreationDate="2013-05-22T06:15:29.667" Score="0" Body="For questions about First Hop Redundancy Protocols (FHRP) such as VRRP, HSRP, GLBP ..." OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-05-22T15:48:30.213" LastActivityDate="2013-05-22T15:48:30.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="800" PostTypeId="2" ParentId="794" CreationDate="2013-05-22T06:31:35.823" Score="4" Body="&lt;p&gt;Because &lt;code&gt;autostate&lt;/code&gt; is a feature of switch virtual interfaces (read: vlans.) From the horse's mouth: &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a0080160b14.shtml&quot; rel=&quot;nofollow&quot;&gt;[click here]&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps you want &lt;code&gt;no keepalive&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[edit] Oddly, &lt;a href=&quot;http://www.cisco.com/go/fn&quot; rel=&quot;nofollow&quot;&gt;Feature Navigator&lt;/a&gt; only shows &lt;code&gt;autostate exclude&lt;/code&gt; as available on cats.  However, my 1720 (WIC-4ESW) allows it. (12.4(23) IP/ADSL)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[edit 2] I just looked through the 1921 15.1(4)M1 universal image, and &lt;code&gt;autostate&lt;/code&gt; is in there:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% strings -a C1900-UN.BIN | grep -i autostate&#xA;no autostate&#xA;autostate&#xA;Enable autostate determination for VLAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-05-22T23:41:03.717" LastActivityDate="2013-05-22T23:41:03.717" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="804" PostTypeId="2" ParentId="780" CreationDate="2013-05-22T07:25:14.127" Score="3" Body="&lt;p&gt;Anytime I have cases where a customer is experiencing network latency, the first thing to do is check each individual connection in the network.  Usually there is one device where a bottleneck is occurring.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If its a low use network, I would completely disable QoS on everything except the internet connected device(as QoS will slow down traffic in a switching environment).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your packet captures i would do I/O analysis and see if you are getting plateaus anywhere.  This can indicate bursty traffic which would cause queuing which will delay the delivery of packets or entirely get rid of the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also check the CPU of each device when you have the issue.  If you see the CPU jumping up then that is probably your problem device.  Check the logs as well to see if there are any errors.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I would be sure all connections are negotiating at full speed (speed 100 full duplex). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also try disabling any firewall or security services.&lt;/p&gt;&#xA;" OwnerUserId="853" LastActivityDate="2013-05-22T07:25:14.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="805" PostTypeId="2" ParentId="744" CreationDate="2013-05-22T07:28:08.747" Score="2" Body="&lt;p&gt;QoS will either speed up or slow down traffic on your network.  Most likely it wouldn't disallow printing but if the printer software is very time sensitive it could cause the errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most likely though I think it is an issue with the software install on your computer.  Especially considering it is localized to your machine. &lt;/p&gt;&#xA;" OwnerUserId="853" LastActivityDate="2013-05-22T07:28:08.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="806" PostTypeId="2" ParentId="794" CreationDate="2013-05-22T08:11:12.967" Score="5" Body="&lt;p&gt;After some research and questioning with cisco specialists, we can conclude that in newer versions of IOS and newer routers, autostate is applied by default and unchangeable. (so the &quot;no autostate&quot; will not work anymore on vlan's).&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-05-22T08:11:12.967" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="807" PostTypeId="2" ParentId="686" CreationDate="2013-05-22T08:13:26.743" Score="3" Body="&lt;p&gt;As mentioned, risk management and vulnerability management should be your concerns.  I'd say there are at least 10-20 &lt;strong&gt;known&lt;/strong&gt; vulnerabilities for your ASA software version, assuming you had the latest firmware installed at the time represented by uptime.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/security/center/publicationListing.x?method=getPsirtSearchData&amp;amp;searchDocType=CiscoSecurityAdvisory&amp;amp;sortOrder=d&amp;amp;sortType=lastPub&amp;amp;searchType=Basic&amp;amp;keyWord=ASA&amp;amp;selectedCriteria=E&amp;amp;dateRange=Past+year&amp;amp;pageStart=1&amp;amp;pageEnd=8&amp;amp;currentPage=0&amp;amp;pageSize=20&amp;amp;pageNo=1&amp;amp;randomNo=0.6937289051711559#~CiscoSecurityAdvisory#~CiscoSecurityAdvisory&quot; rel=&quot;nofollow&quot;&gt;Tools.cisco.com link, with vulns for the past year (some aren't relevant, but this should give you a good idea)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some other tools that may help you:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/web/services/portfolio/product-technical-support/intellishield/index.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Security IntelliShield Alert Manager&lt;/a&gt; - determine if network, hardware, and software assets are vulnerable to new and existing threats&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/security/center/selectIOSVersion.x&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS Software Checker&lt;/a&gt;.  I don't know if there's something similar for the ASA, but perhaps someone could chime in?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Router Configuration Auditing: &lt;a href=&quot;http://www.redsealnetworks.com/products/platform/&quot; rel=&quot;nofollow&quot;&gt;RedSeal&lt;/a&gt; may include version checks (it's been several years since I've used worked with it), as well as plenty of other security tools for networks&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Vulnerability Management: &lt;a href=&quot;http://www.tenable.com/products/nessus&quot; rel=&quot;nofollow&quot;&gt;Nessus&lt;/a&gt; has community and commercial versions, and there is plenty of other software like this out there&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="526" LastActivityDate="2013-05-22T08:13:26.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="808" PostTypeId="1" AcceptedAnswerId="833" CreationDate="2013-05-22T08:45:09.107" Score="17" ViewCount="18359" Body="&lt;p&gt;When creating VLANs for just L2 on a switch -- routing will be handled by a device within that VLAN such as a load-balancer -- &lt;strong&gt;it isn't necessary to create the vlan interface&lt;/strong&gt;.  As a matter of habit, I always create the interface anyway-- no IP address - so I get all the interface bits and packet stats in &quot;sh interface&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Are there any negatives to what I think is a best practice to just create the L2 interface?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;When do you create or &lt;em&gt;not&lt;/em&gt; create the interface for a L2 VLAN?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I am looking for answers that discuss only L2 VLANs, not the merits and use cases for L3 VLAN SVIs.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco reports a L2 interface as EtherSVI on my 6500 -- no IP address.  Is it correct or incorrect to still think of a L2 interface as an SVI though the we all know the usual use-case is to have an IP address for routing?  The question is only about whether or not I should have this L2 interface in the first place.  You can see only the L2 counters are incremented, but still giving &lt;em&gt;some&lt;/em&gt; value.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s-oc4-n2-agg1#sh int vl281&#xA;Vlan281 is up, line protocol is up&#xA;  Hardware is EtherSVI, address is 0019.a925.2000 (bia 0019.a925.2000)&#xA;  Description: svi.SLB-FE-Web-Servers&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not supported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:02, output 00:00:10, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 1d12h&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;  L2 Switched: ucast: 1138722618 pkt, 1070173012274 bytes - mcast: 76471 pkt, 8482399 bytes&#xA;  L3 in Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes mcast&#xA;  L3 out Switched: ucast: 0 pkt, 0 bytes mcast: 0 pkt, 0 bytes&#xA;     74604 packets input, 8350307 bytes, 0 no buffer&#xA;     Received 74604 broadcasts (0 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     218 packets output, 17658 bytes, 0 underruns&#xA;     0 output errors, 0 interface resets&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastEditorUserId="775" LastEditDate="2013-06-30T10:42:14.910" LastActivityDate="2013-06-30T18:20:54.763" Title="When *not* to create a SVI for a L2 VLAN?" Tags="|cisco|switch|vlan|" AnswerCount="8" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="809" PostTypeId="1" AcceptedAnswerId="909" CreationDate="2013-05-22T08:59:13.567" Score="6" ViewCount="982" Body="&lt;p&gt;I have a SAN environment built on FC (Fibre Channel), which is a standalone network from the rest of the DC Ethernet network, and have only Cisco 6509s with Sup720s available for this project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most SAN traffic would be from VMWare with web server VMs connecting to their back-end DB. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;iSCSI traffic would be kept within a given module as the SAN (HP 3Par and HP EVA) best practice is to have isolated &quot;switches&quot; for the redundant paths, so I don't need to worry about traffic hitting the SUP (at least not yet)-- so I guess DFC is needed -- or traffic needing to flow off the switch and over any uplinks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Which modules (1 or 10Gb) are preferred to handle iSCSI if we migrate away from FC?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Are Jumbo Frames an unquestionable requirement?&lt;/strong&gt;  &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Is it better for these modules to sit in the aggregation layer or access layer in case there's a future need to tie them together (as we have an L2 access layer not directly tied to one another with L2 adjacencies between pairs of access switches that traverse the agg switches).&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Is iSCSI the better choice over FCoE?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The most important question is the first: Which modules are preferred? Please give specific Cisco modules or model numbers in answers. &lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-05-30T16:12:29.287" LastActivityDate="2013-05-30T16:12:29.287" Title="What are the best Cisco 6500 Ethernet modules for iSCSI?" Tags="|cisco|iscsi|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="810" PostTypeId="2" ParentId="808" CreationDate="2013-05-22T08:59:26.100" Score="8" Body="&lt;p&gt;I wouldn't say that it is best practice to create a SVI. However I don't think there will be much of an issue if you do create it. For example Catalyst 3750 supports 1000 SVIs which you will not be likely to hit.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q. How many SVIs can be created on the Cisco Catalyst 3750 Series Switches?&#xA;  A. Up to 1000 SVIs can be created. However, the maximum number of SVIs is dependent on the number of routes and multicast entries. For example, the switch can support 64 SVIs with 8000 routes and 250 multicast entries.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From my experience the counters on SVIs can't really be trusted.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="105" LastEditDate="2013-05-22T09:06:52.017" LastActivityDate="2013-05-22T09:06:52.017" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="811" PostTypeId="2" ParentId="808" CreationDate="2013-05-22T09:07:05.097" Score="6" Body="&lt;p&gt;I never create a SVI when there is no special requirement for it. I see no downside, but without adding useless lines you keep your device configuration clean. This can help during troubleshooting sessions.&lt;/p&gt;&#xA;" OwnerUserId="251" LastEditorUserId="775" LastEditDate="2013-06-30T10:41:20.890" LastActivityDate="2013-06-30T10:41:20.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="812" PostTypeId="2" ParentId="789" CreationDate="2013-05-22T09:15:06.330" Score="2" Body="&lt;p&gt;In addition to what John Jensen said, I would add that ACLs are also used for security purposes (e.g. limiting remote access) while prefix-list cannot have this function by their own. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Prefix-lists stick to L3, while ACL may go one layer up, bringing additional functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a visual comparison, see this link: &lt;a href=&quot;http://mellowd.co.uk/ccie/?p=447&quot; rel=&quot;nofollow&quot;&gt;http://mellowd.co.uk/ccie/?p=447&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="251" LastEditorUserId="3662" LastEditDate="2013-12-29T19:33:29.970" LastActivityDate="2013-12-29T19:33:29.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="813" PostTypeId="1" CreationDate="2013-05-22T09:36:21.363" Score="2" ViewCount="1679" Body="&lt;p&gt;Bought a Cisco 1921 router without any additional modules. This is the first time I'm using a non-home router. What security features should I enable so that users are relatively safe when using the internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Relatively safe&quot; meaning the same level of default protection you get from a home router such as a Linksys.&lt;/p&gt;&#xA;" OwnerUserId="851" LastActivityDate="2013-05-22T18:41:45.763" Title="Cisco 1921 security features in the default bundle" Tags="|cisco|security|cisco-isr|router|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="814" PostTypeId="2" ParentId="813" CreationDate="2013-05-22T09:56:39.230" Score="2" Body="&lt;p&gt;Security in normal routers is minimal:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;no NAT&lt;/li&gt;&#xA;&lt;li&gt;flood protection (not all routers)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You could implement ACL's to determine the allowed ports but this isn't the holy grail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;doesn't cover: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;intrusion prevention systems (ips)&lt;/li&gt;&#xA;&lt;li&gt;intrusion detection systems (ids)&lt;/li&gt;&#xA;&lt;li&gt;DDOS protection&lt;/li&gt;&#xA;&lt;li&gt;proxy &lt;/li&gt;&#xA;&lt;li&gt;... &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and many more.&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-05-22T09:56:39.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="815" PostTypeId="2" ParentId="808" CreationDate="2013-05-22T10:03:23.753" Score="5" Body="&lt;p&gt;An SVI is useful when you must provide a Layer3 service to &lt;em&gt;connected&lt;/em&gt; ethernet switchports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SVIs provide an efficient way to attach IP routing services to an ethernet Vlan that already exists on a switch.  It effectively saves you from buying an external router just to offer HSRP, or dynamic routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When do you not create the SVI for a L2 VLAN?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you don't want users to have exposure to those features, or you don't want to complicate the configuration.  This is just a matter of taste... I never define an SVI, unless I need IP routing services on a Vlan... but I prefer minimal configurations where possible.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-05-22T10:03:23.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="816" PostTypeId="2" ParentId="686" CreationDate="2013-05-22T10:21:24.390" Score="0" Body="&lt;p&gt;When you say a load of 'random' text is appearing when adding ACE's, are you manually typing these ACE's in or are you pasting them from some other source (like notepad).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen issues before where if you are pasting a lot of lines into a device it can get overloaded and some corruption occurs, pasting less lines usually fixes it or using a function on your terminal program to 'paste slow' to allow for a small time gap between each line.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-22T10:21:24.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="818" PostTypeId="2" ParentId="809" CreationDate="2013-05-22T10:27:58.130" Score="5" Body="&lt;p&gt;In order to run FCoE you will need something that supports it in order for it to run in a truly (or as close to as possible) lossless environment (which is required from FC/FCoE).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of iSCSI requirements its a lot less demanding but you will want a line card with the deepest buffers you can depending on your oversubscription between hosts and NAS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If for instance your SAN is connected at 10gbit and your hosts at 1gbit you will need buffers big enough to cope with the mismatch.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-22T10:27:58.130" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="820" PostTypeId="2" ParentId="808" CreationDate="2013-05-22T10:40:37.920" Score="2" Body="&lt;p&gt;Adding reachable IP for VLAN is potentially dangerous from security point of view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also an threat from stability point of view, as traffic towards the IP (including ARP, IPv6 ND and so on) hits the to-CPU queue. If you have simple VLAN with L2 only, there's nothing apart from L2 protocols (haha) that can influence the situation of the switch and it's control plane. If you add L3 reachability information, suddenly you're dealing with what's L3 has to offer, including routing protocols, blackholing, limited FIB entries, potentially also different QoS models possible when dealing with L2 vs L3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any way, you're adding complexity to the network. Complexity is bad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As KISS rule says, you DON'T &quot;automatically&quot; add SVI to L2 VLAN. If it's for L2 operation only, I'd even add it to the 'description' of the interface.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-05-22T10:40:37.920" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="821" PostTypeId="1" CreationDate="2013-05-22T10:44:58.613" Score="4" ViewCount="6762" Body="&lt;p&gt;There are many metals used in different types of network cables, such as aluminum and copper. Some are expensive and some are cheap. What scenarios constitute the use of these types of different wire materials?&lt;/p&gt;&#xA;" OwnerUserId="851" LastEditorUserId="8499" LastEditDate="2016-03-30T03:03:33.687" LastActivityDate="2016-03-30T03:03:33.687" Title="How do the different types of materials used in Ethernet cables affect reliability?" Tags="|ethernet|cable|layer1|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="822" PostTypeId="2" ParentId="821" CreationDate="2013-05-22T10:58:58.757" Score="0" Body="&lt;p&gt;The reliability of copper Ethernet cables is defined by Category -- such as Cat3, Cat5, Cat5e, Cat6, etc. The higher the category, the higher the reliability (and therefore the higher allowed speed standard). Higher categories represent more twists in the cables per foot, which alleviates crosstalk and EMI interference. For example, Cat5e cable has more twists per foot than Cat3, which is what allows gigabit Ethernet to work with Cat5e but not Cat3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be noted that Ethernet does not always mean copper Unshielded Twist Pair cables. Ethernet is an OSI Layer-2 concept with different acceptable Layer-1 standards (such as fiber optic cables).&lt;/p&gt;&#xA;" OwnerUserId="572" LastActivityDate="2013-05-22T10:58:58.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="823" PostTypeId="1" CreationDate="2013-05-22T11:00:44.897" Score="7" ViewCount="760" Body="&lt;p&gt;We currently have 1 10GB Multi-Chassis etherchannel Between 2x 6509 (VSS) and 2x 3750-E (Stack).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the 6509 the etherchannel interface members currently run on the supervisor module VS-S720-10G.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We want to migrate that etherchannel over to a WS-X6704-10GE module, and was considering doing it in the following procedure:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Shut down interface Te1/5/5 (member of etherchannel)&lt;/li&gt;&#xA;&lt;li&gt;Remove interface from etherchannel (no channel-group)&lt;/li&gt;&#xA;&lt;li&gt;Add interface from WS-X6704-10GE into etherchannel (Te1/3/4)&lt;/li&gt;&#xA;&lt;li&gt;Move fiber cable&lt;/li&gt;&#xA;&lt;li&gt;Redo same procedure for Te2/5/5 and Te2/3/4&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When doing this we will for a short while have a etherchannel with members from different type of modules.&#xA;Is this supported by Cisco, or will this work at all?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Feel free to suggest other approaches to this migration...&lt;/p&gt;&#xA;" OwnerUserId="318" LastActivityDate="2013-05-22T15:46:42.720" Title="Etherchannel on 6509 (VSS) with interfaces from different type of modules supported?" Tags="|cisco|cisco-6500|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="824" PostTypeId="2" ParentId="789" CreationDate="2013-05-22T11:04:45.213" Score="6" Body="&lt;p&gt;Prefix-list is used for route-filtering and route redistribution because it matches on prefixes either sent,received or present in the routing table or BGP table.&#xA;They match on bits in the prefix but also on the prefix-length.&#xA;ACLs  can be used for a lot more features like: traffic filtering, matching traffic for QoS,matching traffic for NAT, VPN,Policy Based Routing, etc..&#xA;They can also be used for route filters and redistribution but their syntaxes is then different than when they are used for other purposes.&lt;/p&gt;&#xA;" OwnerUserId="856" LastActivityDate="2013-05-22T11:04:45.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="826" PostTypeId="2" ParentId="821" CreationDate="2013-05-22T11:33:38.017" Score="5" Body="&lt;p&gt;&lt;strong&gt;metal&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aluminum is less expensive, but will develop cracks if it is flexed too many times. Copper is more expensive, but is more ductile; So it is much more forgiving of being repeatedly flexed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;specifications&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cat-&lt;em&gt;N&lt;/em&gt; specifications determine various limits; Parameters such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;how much a signal may be attenuated per unit of distance&lt;/li&gt;&#xA;&lt;li&gt;how much cross-talk (signal leaking from one pair to another) is allowed between the pairs&lt;/li&gt;&#xA;&lt;li&gt;how much radiation (&quot;leakage&quot; of the signals) is allowed from the cable&lt;/li&gt;&#xA;&lt;li&gt;the range of frequencies which the cable's pairs are designed to carry&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(and much, much more...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;use cases&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are differences in the insulation which jackets the conductors and the entire cable. For example, &quot;plenum&quot; cable -- meaning it is designed to be used in a plenum, a space within a building which is part of the air handling path for climate control -- is designed to limit how much, and at what temperature, it will emit toxic fumes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are options such as full length shielding (grounding) which prevents interference from other sources. (This is not common with Ethernet cables.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The overall physical diameter of the cable may be a use case limiting factor. If you are install a very large number of cables, that might matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some cables contain a &quot;strain relief&quot; feature; A small nylon string (looks like dental floss) can be added within the cable to help prevent stretching the conductors when cables are pulled into place.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-22T11:33:38.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="827" PostTypeId="2" ParentId="813" CreationDate="2013-05-22T11:40:40.817" Score="1" Body="&lt;p&gt;this is still a good guideline for securing Cisco equipment &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/security/configuration/guide/12_4/sec_12_4_book.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/ios/security/configuration/guide/12_4/sec_12_4_book.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="857" LastActivityDate="2013-05-22T11:40:40.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="828" PostTypeId="2" ParentId="821" CreationDate="2013-05-22T12:43:32.690" Score="3" Body="&lt;p&gt;This is more of a physics question than a networking question actually. Different kinds of metals have different physical characteristics, such as durability (can it rust/degrade?), conductivity (how much does the signal degrade per meter?), flexibility (does the inner cable easily crack?) and sensitivity to interference/crosstalk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network cables all carry a Category specification, which roughly groups them in how fast they can reliably connect two endpoints over a maximum distance. Cat5e for example is specified to be able to carry a 1000BASE-T (Gigabit) signal up to 100 metres per segment, with tighter crosstalk specifications than its predecessor Cat5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While different metals might change a cable's category, the category only specifies rough minimum characteristics, such as impedance, resistance, propagation speed and even operating temperature range. Within a category you could still have notable differences in cable pricing for improvements on specific characteristics that do not make it fall in another category yet.&lt;/p&gt;&#xA;" OwnerUserId="859" LastActivityDate="2013-05-22T12:43:32.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="829" PostTypeId="2" ParentId="813" CreationDate="2013-05-22T12:54:58.777" Score="2" Body="&lt;p&gt;You don't state if you have public or private addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically 'same level of protection' as typical home user is NAPT, i.e. inbound connections are not possible unless equivalent outbound exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have private addresses you've already configured NAPT if the connection works, and you have equivalent security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have public addresses you'd need to configure stateful firewall to get same level of security&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip inspect name DEFAULT udp&#xA;ip inspect name DEFAULT tcp&#xA;ip inspect name DEFAULT icmp&#xA;int WAN&#xA;  ip access-group DEFAULT in&#xA;  ip inspect DEFAULT out&#xA;!&#xA;ip access-list extended DEFAULT&#xA;  deny ip any any&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could work as a starting point. If you need to open up something inbound, add it to DEFAULT ACL, e.g. if you want to allow ssh in from world to given PC at home&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended DEFAULT&#xA;  permit tcp any host MY_SERVER eq 22&#xA;  deny ip any any &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-22T12:54:58.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="830" PostTypeId="2" ParentId="821" CreationDate="2013-05-22T13:00:50.057" Score="1" Body="&lt;p&gt;Excluding plenum-rating &amp;amp; speed, if any of this matters you probably should already be using fibre.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For EMI, grounding, etc. fibre is cheap insurance even when it's not strictly necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For distance, if it's even possible you're running up to distance limits you should switch to fibre (obviously this doesn't really work with access runs). For access I'd try and stay on the conservative side of distance limits and verify runs with a certification tester. As long as you're on cat-5e or better you're fine for speed, although the better ratings do increase the distance limits on gig, but again you should be running cable certification tests if you're likely coming up on those limits.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-22T13:00:50.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="831" PostTypeId="2" ParentId="789" CreationDate="2013-05-22T13:33:50.247" Score="25" Body="&lt;p&gt;Here's the history of how they came into being (and why they are the way they are):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In the very early days of the Internet, people started asking for packet filters (aka access lists). &lt;/li&gt;&#xA;&lt;li&gt;Cisco implemented simple access lists first (filtering on destination host addresses, augmented by wildcard masks), but of course they weren't good enough to block (for example) SMTP, so they created extended access lists, which can match on source and destination IP addresses (with wildcards bits on both - these bits allow you to match whole prefixes), protocols, port numbers ...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So: access list = packet filter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later (but still decades ago) people started running multiple routing protocols on the same box and wanted to redistribute information between them. Not a problem, but you wouldn't want ALL the information you have propagated into the other routing protocol - you need ROUTE FILTERS. As is usually the case, everything looks like a nail if you happen to have a hammer, and thus Cisco's engineers implemented route filters with the object they already had - access lists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point: access list = packet filter (and sometimes route filter)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the advent of classless routing (yeah, it's that long ago - does anyone still remember the days of Class A, Class B and Class C addresses), people wanted to redistribute prefixes of certain size between routing protocols. For example: advertise all /24s from OSPF into BGP, but not the /32s. Impossible to do with access lists. Time for a new kludge: let's use extended access list and let's pretend the source IP address in the packet filter represents network address (actually prefix address) and the destination IP address in the same line of the packet filter represents subnet mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This far: access lists = packet filters. Simple access lists also serve as route filters (matching only on network addresses) and extended access lists serve as route filters matching addresses and subnet masks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately someone retained a shred of reason at that time and started wondering what exactly the brilliant minds that decided reusing extended ACLs for route filters makes sense were smoking when they got that brilliant idea. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;End result: Cisco IOS got prefix lists, which are (almost) identical in functionality to extended access lists acting as route filters, but displayed in a format that a regular human being has a chance of understanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today: use access lists for packet filters and prefix lists for route filters. You can still use access lists as route filters but &lt;em&gt;don't do it&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Makes sense?&lt;/p&gt;&#xA;" OwnerUserId="317" LastActivityDate="2013-05-22T13:33:50.247" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="832" PostTypeId="2" ParentId="416" CreationDate="2013-05-22T13:48:21.683" Score="0" Body="&lt;p&gt;ASA will use proxy-arp to reply for the incoming request to the NAT-ed IP address, so you will only need to enable it on the outside interface. &lt;/p&gt;&#xA;" OwnerUserId="858" LastActivityDate="2013-05-22T13:48:21.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="833" PostTypeId="2" ParentId="808" CreationDate="2013-05-22T13:53:01.793" Score="11" Body="&lt;p&gt;You might not want to make a L2 SVI if you use VTP pruning. If pruning is on, an unused VLAN will be pruned from the trunk, resulting in less unnecessary broadcast/flooding traffic. However, creating an SVI, creates an &quot;active&quot; interface on your switch. A quick check in GNS3 gives the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show vlan-switch&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                          active    Fa1/1, Fa1/2, Fa1/3, Fa1/4&#xA;                                                Fa1/5, Fa1/6, Fa1/7, Fa1/8&#xA;                                                Fa1/9, Fa1/10, Fa1/11, Fa1/12&#xA;                                                Fa1/13, Fa1/14, Fa1/15&#xA;3    VLAN0003                         active&#xA;4    VLAN0004                         active&#xA;[output omitted]&#xA;&#xA;R1#show interfaces trunk&#xA;&#xA;Port      Mode         Encapsulation  Status        Native vlan&#xA;Fa1/0     on           802.1q         trunking      1&#xA;&#xA;Port      Vlans allowed on trunk&#xA;Fa1/0     1-4094&#xA;&#xA;Port      Vlans allowed and active in management domain&#xA;Fa1/0     1,3-4&#xA;&#xA;Port      Vlans in spanning tree forwarding state and not pruned&#xA;Fa1/0     1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, if I go to R2, connected to Fa1/0 and type &lt;code&gt;R2(config)#int vlan 3&lt;/code&gt;, we will see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show run interface vlan 3&#xA;Building configuration...&#xA;&#xA;Current configuration : 38 bytes&#xA;!&#xA;interface Vlan3&#xA; no ip address&#xA;end&#xA;R2#show run | include vlan 3&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, no interfaces in VLAN 3, except the SVI. And back on R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show interfaces trunk&#xA;&#xA;Port      Mode         Encapsulation  Status        Native vlan&#xA;Fa1/0     on           802.1q         trunking      1&#xA;&#xA;Port      Vlans allowed on trunk&#xA;Fa1/0     1-4094&#xA;&#xA;Port      Vlans allowed and active in management domain&#xA;Fa1/0     1,3-4&#xA;&#xA;Port      Vlans in spanning tree forwarding state and not pruned&#xA;Fa1/0     1,3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, &lt;strong&gt;VLAN 3 just came up on the trunk&lt;/strong&gt;, adding to the traffic levels on your trunks. &lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2013-05-22T13:53:01.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="834" PostTypeId="2" ParentId="808" CreationDate="2013-05-22T13:55:11.247" Score="4" Body="&lt;p&gt;I wouldn't consider this a best practice, as if you don't want the switch to provide L3 functionality, it isn't needed or useful.  Now, I want to preface the rest of this by saying that I never do this unless I want L3 functionality, so I may be wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You mention the counters, but counters shouldn't be incrementing unless traffic is going &quot;in&quot; or &quot;out&quot; of the interface.  I suspect that if you span an SVI used as you mention, you won't see the traffic you expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also have concerns about what the switch would do with certain features, and wouldn't feel comfortable myself with testing them.  For example, if you haven't also disabled proxy-arp on the SVI, will it still respond with the SVI MAC address for hosts in other VLANs?  I suspect it can and if it does, will it route that traffic to another VLAN?&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-22T14:29:09.907" LastActivityDate="2013-05-22T14:29:09.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="836" PostTypeId="2" ParentId="780" CreationDate="2013-05-22T14:13:29.093" Score="0" Body="&lt;p&gt;simple method I used was the traceroute function looking for the high response times in the traces and checking that system for failing hardware, DOS attacks, QoS improper classifications and such. of course you need access to all the equipment in the path. Was easy for me during those times since I worked for a telecom.&lt;/p&gt;&#xA;" OwnerUserId="327" LastActivityDate="2013-05-22T14:13:29.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="837" PostTypeId="2" ParentId="780" CreationDate="2013-05-22T14:23:01.273" Score="0" Body="&lt;p&gt;What is the operating system you're testing this on? If it's Windows, by default there's &quot;QoS Packet Scheduler&quot; service installed and binded to the networking interface. It will kick in depending on the underlying settings of the network stack and proactively delay any traffic that is not classified as &quot;multimedia&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try to delete it from the interface and recheck your results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or better yet, reconfigure it properly: &lt;a href=&quot;http://www.dslreports.com/faq/3688&quot; rel=&quot;nofollow&quot;&gt;http://www.dslreports.com/faq/3688&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="286" LastEditDate="2013-05-22T14:51:05.790" LastActivityDate="2013-05-22T14:51:05.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="838" PostTypeId="2" ParentId="577" CreationDate="2013-05-22T14:37:28.957" Score="2" Body="&lt;p&gt;As mentioned, virtualizing switch platforms is generally impossible to do because much of what takes place in a switch is done in hardware and not software (and the software often expects the hardware to be present).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your best bet for this would be one of the companies that rent lab rack space.  I know there are several that currently offer racks that include the Nexus hardware platform.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-22T14:37:28.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="839" PostTypeId="1" CreationDate="2013-05-22T14:58:51.780" Score="11" ViewCount="812" Body="&lt;p&gt;I'm having a weird issue.  Here is the setup.  We have 2 Foundry SX's. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SX01 ---&amp;gt;  ISPA&#xA;|&#xA;|&#xA;SX02 ---&amp;gt;  ISPB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a /24 from ISPA and another /24 from ISPB.  Both /24's are able to be announced to each of the providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iBGP runs between the two SX's and eBGP is being used from each of the SX's to the respective ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I have the following on the SX's:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 1.1.1.0/24 null0&#xA;ip route 2.2.2.0/24 null0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also have prefix-lists configured for each of the /24's and configured the bgp neighbors to make use of the prefix-lists. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that whenever I add the above null routes to both routers at the same time, I get connectivity issues and complete packetloss.  I've tried changing the administrative distance on these static routes but with no luck.  If I only add these null routes to one of the SX's and remove them from the other, then the prefixes get announced fine to the respective ISP and things work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how to fix?  On cisco devices, it's as simple as adding the above commands to both edge routers so not sure why this isn't working at the moment.&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="165" LastEditDate="2013-05-22T16:51:42.743" LastActivityDate="2013-05-22T16:51:42.743" Title="BGP Prefix Announcement Issue" Tags="|bgp|foundry|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="840" PostTypeId="1" AcceptedAnswerId="844" CreationDate="2013-05-22T15:19:45.603" Score="9" ViewCount="975" Body="&lt;p&gt;Cisco ASAs support a version of netflow called NetFlow Secure Event Logging (NSEL). Is special support for the protocol required on the collectors to view the flows? Is the protocol compatible with traditional netflow collectors? In my implementation I am planning on only sending the successful flows to the collector. &lt;/p&gt;&#xA;" OwnerUserId="446" LastActivityDate="2013-05-22T17:17:08.037" Title="ASA Netflow support" Tags="|cisco|cisco-asa|netflow|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="841" PostTypeId="2" ParentId="839" CreationDate="2013-05-22T15:20:34.110" Score="8" Body="&lt;p&gt;Check that you actually have valid internal routes for these networks to override the routes to null0. If there are no more-specific or more-preferable routes for these networks, the routers will of course discard traffic destined for them.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-05-22T15:20:34.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="842" PostTypeId="2" ParentId="840" CreationDate="2013-05-22T15:25:12.390" Score="1" Body="&lt;p&gt;I've used netflow on ASAs before, and it only requires v9 compatability on your collector.&lt;/p&gt;&#xA;" OwnerUserId="733" LastActivityDate="2013-05-22T15:25:12.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="843" PostTypeId="2" ParentId="823" CreationDate="2013-05-22T15:28:19.627" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk389/tk213/technologies_tech_note09186a0080094714.shtml&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; documentation is a few years old but it does seem that only catch is that the links must be all set to the same speed. &lt;/p&gt;&#xA;" OwnerUserId="446" LastActivityDate="2013-05-22T15:28:19.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="844" PostTypeId="2" ParentId="840" CreationDate="2013-05-22T15:42:04.113" Score="11" Body="&lt;p&gt;Our ASAs (version 8.2(x)) send to a SolarWinds Orion collector using Netflow version 9.  We didn't have to do anything special to get it to work.  SolarWinds has a doc with a good explanation of the differences between &quot;normal&quot; and &quot;ASA&quot; Netflow here: &lt;a href=&quot;http://www.solarwinds.com/documentation/Netflow/docs/understandingciscoasanetflow.pdf&quot;&gt;http://www.solarwinds.com/documentation/Netflow/docs/understandingciscoasanetflow.pdf&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it helps here is a sample configuration:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list flow_export_acl extended permit ip any any&#xA;flow-export destination inside collector_IP_address 2055&#xA;flow-export template timeout-rate 1&#xA;flow-export delay flow-create 15&#xA;class-map flow_export_class&#xA; match access-list flow_export_acl&#xA; description Netflow&#xA; class flow_export_class&#xA;  flow-export event-type all destination collector_IP-address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="291" LastEditorUserId="291" LastEditDate="2013-05-22T17:17:08.037" LastActivityDate="2013-05-22T17:17:08.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="845" PostTypeId="2" ParentId="840" CreationDate="2013-05-22T15:44:39.447" Score="9" Body="&lt;p&gt;NSEL records are only sent during flow creation, teardown, or ACL deny events and utilizes NetFlow v9 fields and templates.  Here is a &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-6113&quot;&gt;Doc&lt;/a&gt; that Cisco has about Netflow on the ASA and at the end it talks about collector interoperability.  I personally have used Scrutinizer and everything worked perfectly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Also Plixer did a &lt;a href=&quot;http://www.plixer.com/blog/netflow/what-is-nsel-a-deeper-look-part-1/&quot;&gt;&quot;deep dive&quot;&lt;/a&gt; on What NSEL is.&lt;/p&gt;&#xA;" OwnerUserId="9" LastActivityDate="2013-05-22T15:44:39.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="846" PostTypeId="2" ParentId="823" CreationDate="2013-05-22T15:46:42.720" Score="1" Body="&lt;p&gt;It works great on a 4500 and should work fine on a 6500.  The first answer was correct, though - the speed has to match and all links have to be full duplex.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2013-05-22T15:46:42.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="847" PostTypeId="2" ParentId="416" CreationDate="2013-05-22T15:53:02.117" Score="1" Body="&lt;p&gt;Proxy ARP is used on the ASA's to respond to hosts that are used in STATIC NAT's on the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get around this I would recommend routing any addresses used as STATIC's down to the FW address which will get rid of the need for Proxy ARP on the ASA and anything else.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-22T15:53:02.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="848" PostTypeId="2" ParentId="839" CreationDate="2013-05-22T16:15:44.673" Score="4" Body="&lt;p&gt;Your anchor routes are correct, but to override those routes you'll need more-specifics in your IGP. How you go about that is really dependent on your network layout, but for an example....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say you have a couple of different router ports with a /28 assigned to each. One router will now have more specifics and will not blackhole traffic destined to those /28s, but the other router won't know about them unless you advertise them in your IGP (OSPF, IS-IS, etc). The routers will still send traffic for unused subnets to null0 until you have a valid more-specific route to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want to keep those anchor routes so BGP will be able to advertise the /24s. If you have the /24s assigned to a single port(s) and aren't subnetting them at all, then you don't need the anchor routes. Basically your routing table needs to have a valid route to the /24s (whether to a live port or the null0 static) before BGP will advertise those routes. You just need to make sure you are redistributing more specifics in your IGP so the routers know where to send valid traffic.&lt;/p&gt;&#xA;" OwnerUserId="89" LastActivityDate="2013-05-22T16:15:44.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="849" PostTypeId="1" CreationDate="2013-05-22T16:18:11.820" Score="7" ViewCount="1516" Body="&lt;p&gt;For a long time, a fiber cable worked on both allowable wavelengths, and now it does not.&#xA;Is this a defect of manufacturing? Maybe it's due to weather, other external factors, mechanical damage, or aging? Is it possible to fix?&lt;/p&gt;&#xA;" OwnerUserId="854" LastEditorUserId="89" LastEditDate="2013-05-22T18:51:26.947" LastActivityDate="2014-05-26T13:05:34.220" Title="Why has a fiber optic cable stopped functioning on one of the allowable wavelength?" Tags="|fiber|" AnswerCount="4" CommentCount="2" ClosedDate="2017-08-08T20:51:27.810" ContentLicense="CC BY-SA 3.0" />
  <row Id="850" PostTypeId="2" ParentId="785" CreationDate="2013-05-22T16:22:40.857" Score="0" Body="&lt;p&gt;If your BGP neighbor of your provider is &amp;quot;Established&amp;quot;, and you're still seeing 0 routes in the &amp;quot;Prefixes Current&amp;quot; line of &amp;quot;show ip bgp neighbor x.x.x.x&amp;quot;, and &amp;quot;show ip bgp&amp;quot; isn't showing your paths, then I suspect either:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you don't have any routes to send or receive&lt;/li&gt;&#xA;&lt;li&gt;your filtering prefixes by policy, like with a route-map&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;If there is any policy attached to the neighbor or group, perhaps try applying a test route-map that sets the local-preference value very low for all the incoming prefixes. Send nothing outbound.&#xA;This will still potentially install routes in your table, but shouldn't take precedence over other normal routes. If you're really paranoid, you can rewrite the next-hop to Null0 for testing, but beware that this'll blackhole any destinations that are more specific routes through the provider-under-test, or any unique routes out that provider.&lt;/p&gt;&#xA;" OwnerUserId="131" LastEditorUserId="131" LastEditDate="2020-08-10T22:17:24.990" LastActivityDate="2020-08-10T22:17:24.990" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="851" PostTypeId="1" AcceptedAnswerId="864" CreationDate="2013-05-22T16:24:57.033" Score="19" ViewCount="6503" Body="&lt;p&gt;I have two sites, A and B, in BGP AS 65000, and a third site, C, in AS 65001. All three sites have connectivity via carrier MPLS and there is internal connectivity between sites A and B. I am trying to influence BGP so that traffic from site A to site C will be routed via site A's MPLS link, and traffic from site B to site C will route via site B's MPLS link. The topology is similar to what is described in &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00800945bf.shtml#conf3&quot; rel=&quot;noreferrer&quot;&gt;this example&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UYQsa.png&quot; alt=&quot;AS 65000 and 65001&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The edge routers at sites A and B will both see their own MPLS link as the best path, because EBGP routes are preferred over IBGP routes. However, routers further inside AS 65000 will all prefer either one link or the other. My goal is to force all the routers at either site to prefer the closest link. (Unfortunately, I'm not able to split the two sites into separate ASes at this time.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a sane way to accomplish this while still allowing failover connectivity to site C between the site A and B links?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I should have noted that there is no IGP in use here. In fact, the networks at each site exist within a VRF as part of a much, much larger network. As such, any solution needs to be rely entirely on BGP.&lt;/p&gt;&#xA;" OwnerUserId="5" LastEditorUserId="5" LastEditDate="2013-05-22T17:38:50.047" LastActivityDate="2015-12-21T21:27:06.620" Title="Routing traffic out different links from the same BGP AS" Tags="|bgp|" AnswerCount="4" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="852" PostTypeId="2" ParentId="849" CreationDate="2013-05-22T16:32:33.160" Score="8" Body="&lt;p&gt;The short answer is that fiber cabling is cheap enough that it is not worth your time or effort to fix a damaged cable in many instances. If you have doubts about a cable, you should just replace it if possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some cases, the fiber is not able to be easily replaced (eg, undersea cables). If, say, you have a long run between buildings, then you might be better off using a OTDR to locate a possible break, and fixing/splicing the cable at that point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, you have to decide if the effort to fix the cable (if its possible) will be less than running an entire new cable. Most of the time, such as in DC or enterprise environments, it will probably be much cheaper/easier to run a new cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for why the cable no longer works properly....there could be many reasons. Fiber cabling is much less robust than copper cabling. If the cladding or PVC jacket has been worn away, light may be leaking at that point, which may be interfering with the missing wavelength.&lt;/p&gt;&#xA;" OwnerUserId="89" LastActivityDate="2013-05-22T16:32:33.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="853" PostTypeId="2" ParentId="851" CreationDate="2013-05-22T16:50:09.350" Score="2" Body="&lt;p&gt;If you have control over the IGP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we've done is to only have eBGP routers in the iBGP mesh.  The rest of our internal routers are OSPF routers.  We redistribute from BGP to OSPF within each AS.  Our setup is a little different from yours, but this should allow OSPF's cost metric to influence which path traffic takes by directing it to the nearest eBGP router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do not have control over the IGP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps you can apply an import policy to the internal routers to make them statically prefer the route announcements of the desired exit eBGP router.  So for example, if iBGP contains two announcements for a given prefix (one from the site A router and one from the site B router, but only one is installed into the RIB) then you could local-pref up the desired announcement as it comes in.  I would have to lab it up, but I don't see why it wouldn't work.&lt;/p&gt;&#xA;" OwnerUserId="407" LastEditorUserId="407" LastEditDate="2013-05-22T18:47:20.830" LastActivityDate="2013-05-22T18:47:20.830" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="854" PostTypeId="2" ParentId="851" CreationDate="2013-05-22T16:56:10.963" Score="6" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dsHzl.jpg&quot; alt=&quot;enter image description here&quot;&gt;When I did something similar I did not use eBGP between the routers. I had the BGP speaking router only send the default route down to the Site A and Site B routers via OSPF and then redistribute the OSPF routes into BGP.  On the link between the two sites I applied an OSPF cost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This allows Site A to have routes to its networks, Site B networks, and a default route to get out of Site A (the OSPF cost keeps the default route from Site B as a secondary option should you lose the Site A link).  Site A will talk directly to site B, not using MPLS unless there is a link failure between the sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As well, the OSPF costs translate into the BGP MED during redistribution which causes the carrier MPLS network to prefer sending Site A traffic directly to Site A but also use Site B to get to Site A if need be.&lt;/p&gt;&#xA;" OwnerUserId="176" LastEditorUserId="176" LastEditDate="2013-05-22T17:03:55.473" LastActivityDate="2013-05-22T17:03:55.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="855" PostTypeId="2" ParentId="851" CreationDate="2013-05-22T17:08:01.360" Score="3" Body="&lt;p&gt;I feel some information is missing. Why are edge routers not preferring best path already?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have full-mesh iBGP in 65000? Or are you using route-reflection? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have full-mesh iBGP, then each edge router learns route from both [AB] and will resort to comparing IGP cost to next-hop, which should translate to closest edge box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is route-reflection in place, it'll only reflect best route from its own POV, which may remove best-path-forwarding. This is fixable also by adding another RR which will choose the other route as best, then edge boxes once again can choose the best route.&#xA;If fixing RR is not possible like this. You could add same IPV4 address in both border routes loopbacks, and when border routers advertise prefix to RR, they'd set next-hop to this anycast address. Then even after reflection, you'll follow IGP to closest border.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-22T17:08:01.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="856" PostTypeId="2" ParentId="849" CreationDate="2013-05-22T17:40:48.863" Score="2" Body="&lt;p&gt;It would be helpful to know more about the fiber... type, location, environment, any recent changes, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking a quality cable should last decades if left alone.  Patch cables tend to fail due to movement, numerous plug/unplug cycles, and excessive bends.  Infrastructure cables (in walls, plenums, underground, or aerial) should last a good long time unless there were material defects in construction or deployment, but age does degrade them, &lt;em&gt;slowly&lt;/em&gt;. I'd blamed temperature changes, but I'm not a materials scientist. (something about glass re-crystallization making it brittle and subtly changing it's characteristics.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Justin said, if it's an infrastructure cable (read: hard/expensive to replace) find an OTDR to see where and what the problem really is.  For all we know, there could be a dirty patch connection somewhere.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-22T17:40:48.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="859" PostTypeId="2" ParentId="744" CreationDate="2013-05-22T18:19:11.450" Score="2" Body="&lt;p&gt;I'm going to go out on a limb and say no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless your SOHO router specifically supports QoS for WLANs, then I would say the settings you have only affect the LAN. That said, once your printer traffic is off the wireless and into the LAN, it will probably be marked with best effort (or whatever your lower QoS priority is).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WLAN QoS is normally a completely different setting from LAN QoS, the only way to know for sure is to disable the QoS. If that does resolve the issue, I would say that its a bug with the QoS or the printer drivers, as QoS really shouldn't affect something like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe double check the ports the printer uses, it might be that windows allows information through its firewall pertaining to operational state and ink status, but the printer may use a less well known port for the actual printing, and might be the cause of the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR - Unless you're using 100% bandwidth constantly (highly unlikely), QoS &lt;em&gt;should&lt;/em&gt; only cause devices to slow down. Not to stop working completely.&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastActivityDate="2013-05-22T18:19:11.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="860" PostTypeId="2" ParentId="780" CreationDate="2013-05-22T18:29:59.157" Score="2" Body="&lt;p&gt;High latency/bad throughput when traffic is high is sometimes indicative of a L1 problem (duplex mismatch / bad cable / dirty fibre). Did you check that this is not the case?&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-05-22T18:29:59.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="861" PostTypeId="1" AcceptedAnswerId="862" CreationDate="2013-05-22T18:30:55.800" Score="4" ViewCount="428" Body="&lt;p&gt;I have 2 routers running OSPF. Each router has a vlan configured with an ip from a /29.  The routers are directly connected.  I also have a loopback configured on each router with a /30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1 vlan ip: 1.1.1.13/29 / Loopback: 1.1.1.1/30&#xA;&#xA;Router2 vlan ip: 1.1.1.10/29 / Loopback: 1.1.1.2/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I enabled ospf on both interfaces but for some reason, only Router2 is seeing the /29 route and the /30. Router 1 only sees the /30. Here is the ospf route output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1:&#xA;#sho ip ospf routes&#xA;OSPF routes entries: 1 used, 264191 available&#xA;OSPF Regular Routes:&#xA;&#xA;Destination     Mask            Path_Cost       Type2_Cost Path_Type&#xA;1.1.1.0    255.255.255.252 0               0          Intra&#xA;Adv_Router      Link_State      Dest_Type       State      Tag        Flags&#xA;1.1.1.1    1.1.1.1    Network         Valid      0           0400&#xA;Paths           Out_Port        Next_Hop        Type       Arp_Index  State&#xA;1               lb1             0.0.0.0         OSPF       1          92 00&#xA;&#xA;Router2:&#xA;#sh ip ospf routes&#xA;OSPF Regular Routes:&#xA;&#xA;  Destination     Mask            Path_Cost Type2_Cost Path_Type&#xA;  1.1.1.0    255.255.255.252 0         0          Intra&#xA;  Adv_Router      Link_State      Dest_Type State      Tag       Flags&#xA;  1.1.1.2    1.1.1.2    Network   Valid      0          0600&#xA;  Paths Out_Port  Next_Hop        Type      Arp_Index  State&#xA;  1     lb1       0.0.0.0         OSPF      1          92 00&#xA;&#xA;  Destination     Mask            Path_Cost Type2_Cost Path_Type&#xA;  1.1.1.8    255.255.255.248 1         0          Intra&#xA;  Adv_Router      Link_State      Dest_Type State      Tag       Flags&#xA;  1.1.1.2    1.1.1.2    Network   Valid      0          0600&#xA;  Paths Out_Port  Next_Hop        Type      Arp_Index  State&#xA;  1     v1        0.0.0.0         OSPF      1          92 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any reason why ospf wouldn't be picking up the /29 on Router1?&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="762" LastEditDate="2013-05-23T14:48:19.150" LastActivityDate="2013-05-23T14:48:19.150" Title="Subnet not being seen by OSPF" Tags="|ospf|foundry|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="862" PostTypeId="2" ParentId="861" CreationDate="2013-05-22T18:38:14.297" Score="1" Body="&lt;p&gt;I would guess from the output that the devices aren't adjacent, my reasoning behind this is that they are only showing their own locally generated LSA's (next hop of 0.0.0.0).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you sure that the /29 is up on both devices and that you have enabled OSPF on the correct links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, what platform is this from?&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-22T18:38:14.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="863" PostTypeId="2" ParentId="813" CreationDate="2013-05-22T18:41:45.763" Score="3" Body="&lt;p&gt;The most basic license (read: cheapest) has only basic IP level functions.  It'll do NAT and you can setup ACLs (filters), but there's no &quot;firewall&quot; or &quot;IPS/IDS&quot; (intrusion detection.)  It this regard, it's the same as a $50 Linksys: you are &quot;protected&quot; by NAT. (which &lt;em&gt;isn't&lt;/em&gt; real security)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-22T18:41:45.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="864" PostTypeId="2" ParentId="851" CreationDate="2013-05-22T18:42:42.047" Score="12" Body="&lt;p&gt;Is there a clear definition between site A and site B?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so then I would look to define a policy on the edge routers to inject a community when receiving routes from the carrier MPLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once this community has been put on the prefixes (say 100:1 for site A and 100:2 for site B) you could then add a policy to each of site A's routers to increase the LP for any routes with community 100:1 and likewise for site B with community 100:2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This solution would match the requirement of only using BGP and also would be flexible enough to still allow B to use A's uplink if it lost its own uplink to the carrier.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-22T18:42:42.047" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="865" PostTypeId="2" ParentId="849" CreationDate="2013-05-22T18:44:49.430" Score="4" Body="&lt;p&gt;I will edit this if you provide more details and I can give a better answer.  I am also going to go out on a limb and guess you have lost the lower wavelength and the upper wavelength is still working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The upper wavelength has less attenuation as it travels through the fiber, so it will arrive at the receiving end with more power.  Starting from a point where both wavelengths are functional, if you introduce something into the environment which increases the attenuation, you can reduce the power on the lower wavelength so it is no longer functional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have already mentioned some of the causes that can increase attenuation, but I would look first at the fiber patch cords, dirty fiber, or fiber bends as causes.  Fiber patch cords are easily damaged and easily replaced.  You can easily take the opportunity to clean the fiber properly at this time (get a good non-alcohol based cleaning kit and a fiber scope).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A visual fault indicator (i.e. a bright light source) can also help identify problems quickly in fiber depending on the situation.  Anywhere you see the light bleed out would indicate a loss of signal strength and the brighter the light the more loss you are experiencing.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-22T18:44:49.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="866" PostTypeId="2" ParentId="861" CreationDate="2013-05-22T19:11:06.410" Score="5" Body="&lt;p&gt;I am not sure what your topology looks like, or what exactly your requirements are, but I noticed that there are IP addressing overlaps.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The loopbacks are overlapping. 1.1.1.1/30 and 1.1.1.2/30 are in the same subnet.&lt;/li&gt;&#xA;&lt;li&gt;1.1.1.10/29 and 1.1.1.13/29 are in the same subnet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Again, without knowing what your topology looks like, I can't say for certain what the issue is, but IP overlaps can cause problems like missing routes (they are missing because of the way the protocol operates, not necessarily because of an error).&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-22T19:11:06.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="868" PostTypeId="1" AcceptedAnswerId="960" CreationDate="2013-05-22T19:28:20.150" Score="6" ViewCount="7794" Body="&lt;p&gt;In the context of protecting a campus network, which is the Preferred location of an IPS within a network?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Within an ISR router&lt;/li&gt;&#xA;&lt;li&gt;IPS as a separate device&lt;/li&gt;&#xA;&lt;li&gt;Within ASA&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="777" LastEditorUserId="49" LastEditDate="2013-05-23T16:56:11.600" LastActivityDate="2013-05-24T11:23:49.277" Title="Which is the Preferred location of an IPS within a network?" Tags="|cisco|security|design|" AnswerCount="4" CommentCount="0" ClosedDate="2019-04-07T02:14:47.647" ContentLicense="CC BY-SA 3.0" />
  <row Id="869" PostTypeId="2" ParentId="861" CreationDate="2013-05-22T19:32:37.357" Score="2" Body="&lt;p&gt;The routers are only showing the routes connected to their local interfaces as your two subnets have overlapping addresses. Router 1 is missing on of the subnets though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is likely a config mistake;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Check you have the correct masks on the interfaces them selves&lt;/li&gt;&#xA;&lt;li&gt;Check that OSPF is definably enabled on the missing /29 interface&lt;/li&gt;&#xA;&lt;li&gt;If you are including specific subnet/network statements in your OSPF config, check you had definitely added this subnet and the mask is correct&lt;/li&gt;&#xA;&lt;li&gt;Finally, Post your config!&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-22T19:32:37.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="870" PostTypeId="2" ParentId="808" CreationDate="2013-05-22T19:43:17.867" Score="0" Body="&lt;p&gt;There are some platforms like my &quot;favorite&quot; 6500 which can have strong negative reactions to some types or amounts of traffic that is just fine being completely switched through the router becomes a different story once you create a SVI. typically this would be non-ip traffic, but its very hard to predict.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2013-05-22T19:43:17.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="871" PostTypeId="2" ParentId="868" CreationDate="2013-05-22T20:01:52.730" Score="11" Body="&lt;p&gt;This really depends on the network topology and size, budget, and of course, your security policies! My answer below isn't really a direct answer to your question. If you post a topology map or give further information, a more precise answer can be given. Instead I have given some guidelines on IPSs in general, that apply to various situations including the scenario I am drawing from your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Topology &amp;amp; size&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a large network, common places to deploy an IPS would be inside of your edge/border/transit routers on the outer border of your DMZ or border of your inner private network. You could then couple this with IDS boxes directly behind your edge/border/transit routers picking up on traffic patterns and signatures as traffic comes and, feeding info back to the IPS box(es) deeper in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Border routers are good at their jobs (managing many WAN connections, or BGP peerings, uRPF, VPNs, and so on), IPS aren't good at those jobs. &lt;strong&gt;Don't put an IPS right at the edge&lt;/strong&gt; because you will be inspecting all ingress/egress traffic, even when it isn't destined for your network, or only destined for the outskirts of your network!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on design, some people would say in front of the DMZ for any sized network. If you have a DMZ and then a private internal network behind that, it would be good to have one in front of the DMZ and then one at the border between the DMZ and private network. This is a simple, good idea for even the smallest of networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that the IPS is supposed to be protecting from unwanted traffic. An IDS is identifying it, logging and reporting this, and often controlling an IPS further down the line. Some IPS's do both. &lt;strong&gt;Integrated devices such as IPS on an ASA or ISR need to be a bit beefier&lt;/strong&gt;, in proportion for the point in your topology it/they are deployed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Budget&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are talking about a single IPS box, or running integrated IPS services on an ASA or Cisco ISR G2 router, &lt;strong&gt;I would place this as close as possible to your pubic facing services&lt;/strong&gt; as you can. A simple rule of thumb for cost is that the further away from your DMZ (for example) the IPS box is, the more traffic will be passing through it, as other non-DMZ-destined traffic could be passing through it, meaning you need a beefier box to process that additional unrelated traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If budget is no problem and you run a large or small network, don't go crazy! IPS boxes are often a source of great headache (&quot;&lt;em&gt;Why isn't this connection from A to B on Port XYZ working?...3 hours later...Oh the 3rd IPS box in the chain is flagging and dropping it!&lt;/em&gt;&quot;, &lt;strong&gt;they are a sink hole for man hours!&lt;/strong&gt;). Additionally as IPS's get overloaded they can introduce significant latency and jitter to traffic. Oh and in my experience, when using a pair in HA for example, failure never happens as smoothly as you plan :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Security Policy&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Arguably) the most important point to consider here is (if you want to keep your job), &lt;strong&gt;you need to do whatever fulfills any security policies you must comply with&lt;/strong&gt;. This could be your own companies internal policies, or if you take credit card details for example for on-line payment, you need to comply with PCI/DSS regulations which could require more than one IPS box in multiple places, or somewhere other than where you company policy would normally have you pace it. So be aware!&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="441" LastEditDate="2013-05-23T16:32:35.593" LastActivityDate="2013-05-23T16:32:35.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="872" PostTypeId="2" ParentId="868" CreationDate="2013-05-22T20:31:51.050" Score="2" Body="&lt;p&gt;Speaking as broadly as the question (and assuming an unlimited budget), I would &quot;prefer&quot; to have it in all three (and as many more as I could get) with some sort of SIEM solution tying all the data together into a more comprehensive picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, depending on what you are trying to protect, any of the three will work.  Without more information, I couldn't give a better answer than has already been provided.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-22T20:31:51.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="873" PostTypeId="2" ParentId="730" CreationDate="2013-05-22T20:53:36.260" Score="4" Body="&lt;p&gt;This is IP over ATM (no PPP). You don't need authentication (and PPP) there. The &quot;user&quot; is specified by the pvc (8/35) in the config. Every line has their own PVC which consists of the ATM VPI/VCI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information there is a &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk39/tk48/technologies_q_and_a_item09186a008011a901.shtml#qa1&quot; rel=&quot;nofollow&quot;&gt;FAQ from Cisco for ATM PVC&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PVC has to be the same on both ends and is provided by the ATM provider.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2013-05-22T20:59:46.577" LastActivityDate="2013-05-22T20:59:46.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="874" PostTypeId="1" AcceptedAnswerId="1703" CreationDate="2013-05-22T21:05:29.737" Score="10" ViewCount="2909" Body="&lt;p&gt;I am trying to bootstrap the config on some Juniper SRX100s and am having some DHCP issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, I am connecting the 0/0 port (fe-0/0/0 in the software) to my existing network, where DHCP has worked quite reliably for just about every other device I've used.  The SRX100s are not getting DHCP addresses.  The SRX100 is out-of-the-box default config when I'm attempting this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I brought one of the devices to my house and plugged it into my home network and it got an IP address on my home network via DHCP with no problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My office network has a Procurve 1400 (layer 2 only) switch on my desktop, uplinked to a Polycom IP670 IP phone (acts as a simple layer 2 switch), uplinked to a Procurve 3500yl switch acting as a router for the network with &quot;ip helper-address 1.1.1.1&quot; on the vlan interface pointing to the DHCP server for DHCP relay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any experience with getting an SRX DHCP client getting an IP address via a Procurve (running K.15.09.0012 software...though the problem has existed across multiple firmware versions on the Procurve).  The SRX100s seem to have 11.2 on them when they come out the box, though I think the problem continues to exist when upgraded to 12.1X44-D10.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any suggestions for troubleshooting this?  The Procurve 3500yl doesn't seem to admit to having seen the DHCP client request coming in from the SRX100, but troubleshooting info on the Procurves in this area seems limited.  The DHCP server definitely does not see any DHCPDISCOVER packets arrive relating to the SRX100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My workaround has been to statically configure an IP address on the SRX100s to get them on the network and do the rest of my config, but the project I am working on involves sending the SRX100s out to remote locations that are not under my control and, thus, depends on them reliably getting DHCP addresses for connectivity so I would really like to troubleshoot this and run down a specific cause so I know what to potentially look for if this happens at remote sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;  I have (to double-check) factory-defaulted the SRX100, and plugged it directly into a port on a Procurve 3500yl and am still seeing the problem, so that removes the 1400 and the IP670 phone from the discussion.  I've included the tcpdump output from the SRX100 below...as you can see, its sending out about the simplest possible DHCP packet possible, when tends to suggest that the problem is with the dhcp-relay function on the 3500yl.  I can't find any way to get any debug output from the 3500yl showing packets hitting the dhcp-relay function (successfully or otherwise).  Suggestions on how to debug this function on the 3500yl would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -n -s 0 -c 1 -vvv -r juniper.dhcp.pcap &#xA;reading from file juniper.dhcp.pcap, link-type JUNIPER_ETHER (Juniper Ethernet)&#xA;17:49:11.538670 &#xA;Juniper PCAP Flags [Ext], PCAP Extension(s) total length 16&#xA;  Device Media Type Extension TLV #3, length 1, value Ethernet (1)&#xA;  Logical Interface Encapsulation Extension TLV #6, length 1, value Ethernet (14)&#xA;  Device Interface Index Extension TLV #1, length 2, value 34304&#xA;  Logical Interface Index Extension TLV #4, length 4, value 70&#xA;-----original packet-----&#xA;IP (tos 0x0, ttl 1, id 13874, offset 0, flags [none], proto UDP (17), length 328)&#xA;0.0.0.0.68 &amp;gt; 255.255.255.255.67: [udp sum ok] BOOTP/DHCP, Request from a8:d0:e5:1c:68:80, length 300, xid 0x643c9869, Flags [Broadcast] (0x8000)&#xA;  Client-Ethernet-Address a8:d0:e5:1c:68:80&#xA;  Vendor-rfc1048 Extensions&#xA;    Magic Cookie 0x63825363&#xA;    DHCP-Message Option 53, length 1: Discover&#xA;    END Option 255, length 0&#xA;    PAD Option 0, length 0, occurs 56&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="97" LastEditorUserId="97" LastEditDate="2013-05-23T15:01:49.120" LastActivityDate="2013-08-27T13:49:34.940" Title="SRX DHCP client compatibility with HP Procurve DHCP Relay" Tags="|juniper|juniper-srx|juniper-junos|hp-procurve|dhcp|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="875" PostTypeId="2" ParentId="874" CreationDate="2013-05-22T23:03:26.527" Score="2" Body="&lt;p&gt;It can be tough to troubleshoot when you don't know where the problem lies and you have three devices from three vendors before you seem to have any visibility (the SRX100, the 1400, and the IP670).  I can't speak to the specific devices, but you can never go wrong by tracing the packets.  Since the ProCurve 1400 is an unmanaged device, you would need to use a network tap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would want to capture the traffic in the following locations (based on your statement that the 3500yl is not receiving the discover packet):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Between the SRX100 and the 1400.&lt;/li&gt;&#xA;&lt;li&gt;Between the 1400 and the IP670&lt;/li&gt;&#xA;&lt;li&gt;Between the IP670 and the 3500yl&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can do all these from your desk, and while a tap is disruptive while you are connecting/disconnecting it, it should only affect you and your devices.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would start at the top of this list, because it should allow you to capture the DHCP discover packet at least once and then any subsequent captures of the DHCP discover packet can be compared against this one to see if there is any modification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also want to capture DHCP discover packets from devices that are working as well to see if there are any differences from the discover packet the SRX100 sends out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you know where the packet goes wrong, you can look into specifically troubleshooting why it goes wrong at that point.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-23T00:34:55.583" LastActivityDate="2013-05-23T00:34:55.583" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="876" PostTypeId="1" AcceptedAnswerId="1003" CreationDate="2013-05-23T00:23:37.207" Score="2" ViewCount="174" Body="&lt;p&gt;I am studying for the CWSP and want to get an exact cost to an attacker attempting a brute-force attack on a WPA2-Personal WLAN. The textbook goes as far to say  that WPA2-Personal is &quot;vulnerable to an offline brute-force dictionary attack.&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It wasn't clear to me exactly what resources are required for an attacker to mount such an attack, so I read over this &lt;a href=&quot;http://beta.ivc.no/wiki/index.php/WPA_Attack&quot; rel=&quot;nofollow&quot;&gt;page&lt;/a&gt;. It's good but there's nothing  to verify the page's info against. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is simply: &lt;strong&gt;Where is a copy of the 802.11i specification&lt;/strong&gt; &#xA;I didn't see it on the IEEE website. &lt;/p&gt;&#xA;" OwnerUserId="366" LastEditorUserId="33" LastEditDate="2013-05-25T17:46:37.550" LastActivityDate="2013-05-25T17:46:37.550" Title="where to find the complete 802.11i spec" Tags="|wireless|ieee-802.11|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="877" PostTypeId="1" AcceptedAnswerId="878" CreationDate="2013-05-23T01:16:06.023" Score="2" ViewCount="356" Body="&lt;p&gt;I have a client who had ADSL (1500/256), and in an attempt to get her a faster connection, she tried to churn to a different provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short, the other provider will not supply adsl because the line quality is too poor (or) she is too far from the exchange. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When she tried to reinstate the connection with the previous provider (it had to be cancelled and codes removed for the new provider to try), they are now saying the same thing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So apparently there is no ADSL codes on the line, but when I was onsite the other evening I noticed that the modem still had line sync.&#xA;How is this possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does that mean she probably could get ADSL back if &quot;a&quot; provider would activate an account for the modem to authenticate to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ESyej.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/ESyej.png&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="876" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:42.163" LastActivityDate="2013-05-27T18:45:42.163" Title="Line Sync when there is supposed to be no ADSL codes on the line?" Tags="|ppp|hardware|" AnswerCount="2" CommentCount="1" ClosedDate="2013-05-28T14:21:40.753" ContentLicense="CC BY-SA 3.0" />
  <row Id="878" PostTypeId="2" ParentId="877" CreationDate="2013-05-23T02:34:39.653" Score="5" Body="&lt;p&gt;Gonna take a guess here that your in Australia.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cutoff for getting a new ADSL connection from Telstra or any Telstra reseller is 56dB of attenuation at 300khz based on the calculated loss from the cabling records.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your modem is reporting 63dB attenuation so chances are the calculated loss is higher than 56dB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you got ADSL in the first place the loss check must have been bypassed somehow or your cabling records were wrong and calculated at less than 56dB of loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whatever the reason your cabling records now say you cant get ADSL and you have no existing ADSL service on the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its not a technical limitation is a procedural/policy limitation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will probably need to go through a manger/escaltion/shouting match with management of your original provider to get the ADSL reinstated.&lt;/p&gt;&#xA;" OwnerUserId="877" LastActivityDate="2013-05-23T02:34:39.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="879" PostTypeId="2" ParentId="877" CreationDate="2013-05-23T02:38:20.340" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So apparently there is no ADSL codes on the line, but when I was&#xA;  onsite the other evening I noticed that the modem still had line sync.&#xA;  How is this possible?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&quot;Codes&quot; is the term used for whether a DSL wholesale providers/ISP's provisioning database acknowledges there is an active service on the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Line sync only relies on the customers telephone line being jumpered (cabled) to the DSLAM within the exchange/central office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often if port availability is not an issue, the jumpering will be left in tact, when the service is cancelled (&quot;codes&quot; are removed).&lt;/p&gt;&#xA;" OwnerUserId="478" LastActivityDate="2013-05-23T02:38:20.340" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="880" PostTypeId="1" CreationDate="2013-05-23T02:48:08.083" Score="7" ViewCount="2232" Body="&lt;p&gt;I currently have a WLC 4404 running 7.0.240.0.  Management Interface IP is 10.128.55.10.  AP-management interface is 10.128.55.15.  Remote facility (facility A) has a VLAN created for wireless (455) and a VLAN 455 interface created with IP 10.133.55.2. Ports on the remote switch (switch B) have been added to VLAN 455 and AP's have been patched into these ports. The AP's are receiving IP addresses via a DHCP scope created specifically for this VLAN (10.133.55.0 /24) which is physically located at the local facility (facility B). The AP's are successfully receiving IP's from this DHCP scope. This switch is trunked to switch A in the same building. Switch A has a VLAN 455 interface configured with IP 10.133.55.1.  VLAN 455 is permitted on this trunk port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the remote switches (both A and B), I am able to successfully source ping the AP-management interface (10.128.55.15) from the VLAN 455 interface (10.133.55.1, and 10.133.55.2).  However, I am unable to successfully source ping the management interface (10.128.55.10) from the same VLAN 455 interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After working with Cisco TAC for 6.5 hours today, they say my wireless controller is possessed. I am not yet ready to accept a supernatural phenomenon as a reasonable explanation and was hoping someone out there can help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&#xA;Took a known good AP down to the remote facility and it comes up on the correct VLAN, receives the correct IP and joins the controller. Brought back one of the non functioning AP's and plugged it in here. The AP joined the controller after downgrading its IOS from 15.2(2)JB to 12.4(23c)JA7.  Should the AP's at the remote location be able to connect to the controller here and install the correct version of IOS?  Or am I going to have to bring them all here for initial config prior to installing at the remote location?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&#xA;We have found a workaround to get the AP's to communicate.  Cisco is saying it's a Microsoft issue with not pushing out option 43 properly.  They also say there is no MTU issue while traversing the MPLS to the remote site.  What we have done is disable the DHCP scope for the remote AP's and configured the remote switch (ios) as a DHCP server with option 43 pointing to the controller using hex not decimal.  Once I did a shut/no shut on the interfaces connected to the AP's, they obtained an IP from the switch and joined the controller.  Once joined, I removed DHCP from the switch and re-enabled the scope on our DHCP server.  Bounced the AP's again and they pulled an address and joined the controller.  Not a solution, but at least they're up and running.&lt;/p&gt;&#xA;" OwnerUserId="701" LastEditorUserId="701" LastEditDate="2013-05-31T16:21:52.943" LastActivityDate="2013-05-31T16:21:52.943" Title="AP's at remote faciltiy will not join local controller" Tags="|cisco|wireless|ieee-802.11|aironet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="881" PostTypeId="1" CreationDate="2013-05-23T04:35:44.443" Score="7" ViewCount="3595" Body="&lt;p&gt;I use Mikrotik RouterOS as the NAT router. Some hosts behind the router also have a direct connection to the Internet and these hosts have a default route to the ISP's gateway instead of RouterOS.&#xA;I set up a OpenVPN server in tun mode on one of these hosts with public ip. The problem is that VPN clients cannot communicate with hosts that have a public IP because they have a default route to the ISP. I can put a static route on RouterOS but I have no control over my ISP's router. So packets sent to the VPN client are sent to WAN link instead of the VPN server. &#xA;What options do I have?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;private DHCP pool 172.16.10.0/24, gateway 172.16.10.1 (RouterOS)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OpenVPN pool 172.16.11.0/24&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;tap mode, a lot of overhead&lt;/li&gt;&#xA;&lt;li&gt;tun mode, VPN pool inside DHCP pool and OpenVPN server proxy-ARP for the VPN pool in the LAN&lt;/li&gt;&#xA;&lt;li&gt;tun mode, add a static route for OpenVPN pool on every host with a public IP. This does not scale well, too much work in a mixed environment&lt;/li&gt;&#xA;&lt;li&gt;IPv6. The problem is that a lot of Windows applications (for example VMware products) have poor support for IPv6. All hosts do have IPv6 connectivity but VPN clients might have a hard time getting IPv6.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I know I probably should put everything behind the firewall. I will do that after I get a Juniper SRX. I don't have enough public IPs for every host. And RouterOS/pfSense is not well suited for an environment with mixed public/private IPs. I have to admit this is a poor design to begin with, any migration path without breaking the bank? It's not production, just a bit complicated home network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate your input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit1 (Response to JelmerS's answer):&#xA;This is doable but does not scale really well as I mentioned in OP. In the environment I have different flavors of BSD, Linux, Windows and standalone appliances without shell (e.g. printer, network monitoring devices, phone). I will try DHCP option 33 and option 121, not sure how well they are supported on different devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit2 (Response to Joseph Drane's answer):&#xA;1. Currently hosts with a public IP have a link to RouterOS LAN and another link to the ISP (bypass RouterOS)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there any justification for doing static NAT? It seems unnecessary (heavy performance penalty)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The firewall I am looking for can work well in transparent mode. DHCP/NAT can totally be done by another box. But most firewalls I have used don't support/work well in transparent mode and are difficult to troubleshoot (lack of visibility)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Edit3:&#xA;RouterOS runs inside ESXi. There are some other guest OSes. The environment is mixed with physical/virtual hosts. I do have enough NIC interfaces on ESXi box. I want the flexibility to allow hosts to easily switch between public/private address.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2013-05-23T06:51:53.767" LastActivityDate="2013-05-23T07:06:22.457" Title="VPN routing for hosts with multiple ip addresses" Tags="|vpn|routing|" AnswerCount="2" CommentCount="0" ClosedDate="2019-04-07T01:56:11.100" ContentLicense="CC BY-SA 3.0" />
  <row Id="882" PostTypeId="2" ParentId="881" CreationDate="2013-05-23T05:26:47.127" Score="3" Body="&lt;p&gt;Routes are always chosen in order of specificity. Say a host has a route to 10.0.0.0/8 via router A and 10.0.1.0/24 via router B. As soon as it wants to send a packet to 10.0.1.1, it will prefer router B over router A. A default route is the least specific route you can have. Any other route you add will be preferred over a default route. So the answer is simple: add a specific route to the VPN DHCP pool via the Mikrotik router.&#xA;Don't forget to make the routes persistent, so they will survive a reboot. Asuming your DHCP pool is &lt;code&gt;10.0.1.0/24&lt;/code&gt; and your Mikrotik has IP &lt;code&gt;1.1.1.1&lt;/code&gt; and is connected on &lt;code&gt;eth0&lt;/code&gt;, Here is the command for Windows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route add -p 10.0.1.0 MASK 255.255.255.0 1.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For Linux, a persistant route is added by editing the &lt;code&gt;/etc/sysconfig/network-scripts/route-eth0&lt;/code&gt; file to define static routes for &lt;code&gt;eth0&lt;/code&gt; interface. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GATEWAY0=1.1.1.1&#xA;NETMASK0=255.255.255.0 &#xA;ADDRESS0=10.0.1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="220" LastEditorUserId="33" LastEditDate="2013-05-23T07:06:22.457" LastActivityDate="2013-05-23T07:06:22.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="883" PostTypeId="1" CreationDate="2013-05-23T05:40:15.547" Score="18" ViewCount="27738" Body="&lt;p&gt;I have just read &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/135/can-i-use-a-catalyst-2960-s-for-iscsi&quot;&gt;Jeremy's question about 2960-S and iSCSI traffic handling&lt;/a&gt;, which  drove me to ask this question:  We all have lots of switches deployed in distinct infrastructures, how can you know that the traffic is treated well? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I usually check CPU, RAM and system logs but didn't think about buffers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used &lt;em&gt;show buffers failures&lt;/em&gt; and here is an example of the data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show buffers failures &#xA;Caller       Pool          Size      When&#xA;0x1279AE0   Middle           445    3d19h&#xA;0x1279AE0   Middle           446    3d19h&#xA;0x1279AE0   Middle           444    3d19h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I know on which interface this occurred?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there other performance metrics that should be reviewed?&lt;/p&gt;&#xA;" OwnerUserId="794" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2013-05-23T16:20:37.020" Title="How do you know if a Cisco switch is handling traffic well?" Tags="|cisco|switch|monitoring|iscsi|performance|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="884" PostTypeId="2" ParentId="880" CreationDate="2013-05-23T05:53:10.970" Score="3" Body="&lt;p&gt;I cannot tell you exactly what is happening without looking at the configs of the Switches and the WLC you have as I can think of a number of possibilities. For me, it'd be helpful to have that information but more so, the things that you've done. Basically, what are the items you've tried thus far?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW-A: 10.133.55.1 &amp;lt;---TRUNK---&gt; SW-B: 10.133.55.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WLC-4404 10.128.55.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First thoughts though are as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) Who is able to ping the WLC?&#xA;    a.) no one = check the interface on the switch and the WLC interface config, any firewalls&#xA;    b.) same subnet, 10.128.55.0/24, but no other subnets = check routing&#xA;    c.) all subnets on one switch but not from another switch = check trunk on SW-A &amp;amp; SW-B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) AP and WLC are able to ping each other but AP not showing up in WLC&#xA;    a.) check DHCP has the proper option 43 (Vendor Specific Info) set which tells the AP what IP the WLC is.&#xA;    b.) check any firewalls inbetween&#xA;    c.) create new interface on WLC with the same VLAN subnet as the AP and test&#xA;    d.) enable ssh on the AP and do a show log to see if anything peculiar sticks out&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.) You've checked all possibilities and as the config stands everything should work&#xA;    a.) reload the switches, AP's, WLC&#xA;    b.) pull out the configuration and put the configuration back in specific to the issue&#xA;    c.) try a different interface on the switch for the WLC&#xA;    d.) try a different interface on the WLC (maybe create a new one)&#xA;    e.) get on Cisco.com and use the bugtoolkit to see what bugs are out there for your particular WLC version. &#xA;    f.) upgrade the WLC version a revision up and test.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize that some of my ideas are not really applicable, but I'm just throwing some ideas out there to maybe help give a new perspective on the problem. I've found just taking a break to think about something else and then coming back helps me.&lt;/p&gt;&#xA;" OwnerUserId="881" LastEditorUserId="630" LastEditDate="2013-05-24T20:04:50.440" LastActivityDate="2013-05-24T20:04:50.440" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="885" PostTypeId="2" ParentId="881" CreationDate="2013-05-23T06:06:52.290" Score="2" Body="&lt;p&gt;So, like you know already, hosts with public IP addresses assigned is not good. I'm referencing your comment about putting a firewall in front.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would use your router, add another interface for a DMZ network. This DMZ network would use private ip addresses not public.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, inside your router, just NAT the public to that private IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So current config:&#xA;[internet]----&gt;RouterOS-----&gt;Host w/ public IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;New config/setup:&#xA;[Internet]---&gt;RouterOS&amp;lt;---&gt;NAT public IP 60.70.80.90 &amp;lt;--to--&gt; 192.168.100.90----&gt;Host w/ Private IP 192.168.100.90&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now you can just put in a route to the 192.168.100.90 subnet/network which will be the DMZ subnet/network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do some cool stuff with IP Tables in regards to having a &quot;make-shift&quot; firewall but I am not the guy to help with that. I'm a Cisco guy.&lt;/p&gt;&#xA;" OwnerUserId="881" LastActivityDate="2013-05-23T06:06:52.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="886" PostTypeId="2" ParentId="883" CreationDate="2013-05-23T06:15:25.760" Score="11" Body="&lt;p&gt;If you are getting buffer failures, I would use a command like the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;show interface | i (line protocol|no buffer)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to manually sort through the output a bit, but you are looking for lines were you have more than 0 no buffer errors like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FasttEthernet0/24 is up, line protocol is up (connected)&#xA;     1557332164 packets input, 3733280910 bytes, 6718 no buffer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-23T06:21:07.830" LastActivityDate="2013-05-23T06:21:07.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="887" PostTypeId="1" AcceptedAnswerId="888" CreationDate="2013-05-23T06:24:09.890" Score="9" ViewCount="10397" Body="&lt;p&gt;Is it possible to monitor a specific traffic type going through a cisco router? (like monitoring via wireshark) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex: I want to monitor http traffic specifically that is passing through a router. (or DNS, FTP, ...)&lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="33" LastEditDate="2013-05-23T16:25:20.400" LastActivityDate="2013-05-23T16:25:20.400" Title="Monitor specific traffic type on a Cisco router" Tags="|cisco|monitoring|troubleshooting|cisco-commands|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="888" PostTypeId="2" ParentId="887" CreationDate="2013-05-23T06:31:16.947" Score="13" Body="&lt;p&gt;You could monitor the traffic&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;on the router, Cisco IOS 12.4(20)T and later, there is a &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-5799&quot; rel=&quot;nofollow noreferrer&quot;&gt;packet capture feature&lt;/a&gt;, with filtering on interface name and direction and ACL.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;set up an access list for matching the traffic&lt;/li&gt;&#xA;&lt;li&gt;create a capture buffer &lt;code&gt;monitor capture buffer holdpackets filter access-list &amp;lt;number&amp;gt;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;define a capture point &lt;code&gt;monitor capture point ...&lt;/code&gt; possibly with interface name, direction, and more - use the inline help to see possibilities&lt;/li&gt;&#xA;&lt;li&gt;let the traffic pass&lt;/li&gt;&#xA;&lt;li&gt;look at the capture buffer: &lt;code&gt;show monitor capture buffer holdpackets dump&lt;/code&gt;, use &lt;code&gt;export&lt;/code&gt; instead of &lt;code&gt;dump&lt;/code&gt; to get a PCAP file for Wireshark analysis&lt;/li&gt;&#xA;&lt;li&gt;don't forget to stop capturing, remove the capture point and delete the capture buffer afterwards&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For details and examples, follow the link or look at a &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_troubleshooting.html#wp1055858&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco troubleshooting manual&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;on the switchport, where the router is connected to, for this you could &lt;a href=&quot;https://networkengineering.stackexchange.com/q/640/231&quot;&gt;set up a mirror port on the switch&lt;/a&gt; and monitor this via Wireshark&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;on the firewall, where the traffic passes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco ASAs are capable of remotely doing packet capturing and giving you the output as a PCAP file which you can open locally with Wireshark. The ASDM provides an assistant for this. Step by step, you can specify source and destionation interface, ACLs or src/dest networks/host, and the protocol you like to watch. That's why I like having ASAs in place everywhere - with a router CLI may seem a bit complicated.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/3hT0q.png&quot; alt=&quot;Screenshot of the packet capture wizard&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2013-05-23T06:53:28.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="889" PostTypeId="2" ParentId="883" CreationDate="2013-05-23T06:38:41.337" Score="14" Body="&lt;p&gt;That depends on the switch model you have and it's not that easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Smaller Catalyst switches in general use at least two forms of buffer - there's usually a interface-lavel buffer, on the smaller &lt;strong&gt;Catalyst (2k/3k)&lt;/strong&gt; visible in 'show buffers' under the section named 'Interface buffer pools:':&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface buffer pools:&#xA;Syslog ED Pool buffers, 600 bytes (total 132, permanent 132):&#xA;   100 in free list (132 min, 132 max allowed)&#xA;   11151 hits, 0 misses&#xA;RxQ1 buffers, 2040 bytes (total 128, permanent 128):&#xA;   4 in free list (0 min, 128 max allowed)&#xA;   244594209 hits, 4559839 fallbacks&#xA;RxQ2 buffers, 2040 bytes (total 128, permanent 128):&#xA;   1 in free list (0 min, 128 max allowed)&#xA;   202559241 hits, 1582494 fallbacks, 0 trims, 0 created&#xA;   1582494 failures (0 no memory)&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...and there's &quot;public&quot; area, where CPU is using the buffers as they're punted towards it and need servicing. The &quot;Rx&quot;-level buffers are part of the shared buffer to service all interfaces (on either old, legacy switches like 2950 or newest &lt;strong&gt;2960S/3560X/etc&lt;/strong&gt;) or a subset of interfaces, belonging to specific port ASIC (like &lt;strong&gt;2960&lt;/strong&gt; or &lt;strong&gt;3560/3750/3560E/3750E&lt;/strong&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the &lt;strong&gt;4500 and 6500&lt;/strong&gt; in particular it gets messy, as there is a number of pools that packet can go through - input interface (ASIC) buffer, the pool at linecard level (on the 6500 at DFC), at the switch-fabric level and at the end the buffer at Supervisor level. They don't have to be physically separate memory pools, but are often mapped in different commands to different names to ease the troubleshooting process (at which step of the packet walk-through was the packet dropped for example).&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-05-23T06:38:41.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="890" PostTypeId="2" ParentId="887" CreationDate="2013-05-23T06:44:08.270" Score="5" Body="&lt;p&gt;On the ISR G1/G2 routers you can use packet capture feature, where you use ACL to match the traffic and store it into memory during capture, then dump to .pcap compatible format if you need it offline:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-5799&quot; rel=&quot;noreferrer&quot;&gt;https://supportforums.cisco.com/docs/DOC-5799&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Catalyst 4500 with newer Supervisors you can actually run wireshark.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-05-23T06:44:08.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="891" PostTypeId="2" ParentId="883" CreationDate="2013-05-23T07:06:18.190" Score="14" Body="&lt;p&gt;You've got great replies so far. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like Lukasz says the buffer setup is a bit complex on the Catalyst switches. There is a pool that you assign buffers from for the 4 egress queues. You can choose to reserve a certain amount of buffers and let the rest sit in a pool and use it as needed. The buffers that are reserved can't be touched by other queues/thresholds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/uoSw8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see drops on different queues/thresholds use this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show platform port-asic stats drop gix/x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qmuFE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-23T07:06:18.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="892" PostTypeId="1" AcceptedAnswerId="895" CreationDate="2013-05-23T07:42:01.780" Score="10" ViewCount="14868" Body="&lt;p&gt;Setup: Cisco router with multiple VLAN's configured on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can you prevent 2 VLAN's communicating with eachother? Normally I would do this with ACL's like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 102 deny ip 1.1.1.0 0.0.0.255 2.2.2.0 0.0.0.255&#xA;access-list 102 deny ip 2.2.2.0 0.0.0.255 1.1.1.0 0.0.0.255&#xA;&#xA;int vlan 1&#xA;ip address 1.1.1.1 255.255.255.0&#xA;access-group 102 in&#xA;&#xA;int vlan 2&#xA;ip address 2.2.2.2 255.255.255.0&#xA;access-group 102 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This however is not handy when dealing with lot's of VLAN's configured on a router. Any suggestions of tweaking this or using an alternative to improve scalability?&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-05-23T09:58:33.500" Title="Cisco: prevent vlan's of communicating with eachother on cisco router (ACL alternative)" Tags="|cisco|routing|security|acl|cisco-commands|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="893" PostTypeId="2" ParentId="892" CreationDate="2013-05-23T08:08:09.203" Score="9" Body="&lt;p&gt;While ACLs are a simple and safe way, it doesn't scale well indeed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your router provides VRF or at least the the VRF Lite feature you could group VLANs into VRFs. A &lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_Routing_and_Forwarding&quot;&gt;VRF&lt;/a&gt; can be seen like a virtual router, VRF instances cannot talk to each other unless you explicitely define routing between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a complex network, I group VLANs into several security domains done with VRFs, such as a VRF for office clients and server, a VRF for tech devices (door access control, lifts, cctv, ...), a VRF for guests and visitors.&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="231" LastEditDate="2013-05-23T08:26:14.390" LastActivityDate="2013-05-23T08:26:14.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="894" PostTypeId="2" ParentId="868" CreationDate="2013-05-23T08:23:00.317" Score="3" Body="&lt;p&gt;I'm going to come at this from a different viewpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are you even bothering with an IPS? Who is going to monitor the logs, ensure they're not left in bypass mode for months, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm of the view that if you are careful with firewall rules and end system  maintenance they're likely useless as the only &quot;intrusions&quot; they're likely to detect have already been patched or are irrelevant (Windows attacks against *nix hosts etc.), and if you're not good with patching etc. then you're probably not good at managing incidents when they do happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may well be required to install them for regulatory reasons and that's fine, if that's the case then you should put them where your auditor says, as the cost of arguing with them is probably more than the cost of acquiescing, even if (you believe) they're wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I was required to put one in I'd certainly put it on the inside of the firewall, as there's no sense in getting notified about &quot;attacks&quot; I was going to block anyway. Having an additional probe that uses the pre-firewall traffic for extra data (X got through, same source also tried Y &amp;amp; Z which firewall blocked) might be valuable.&lt;/p&gt;&#xA;" OwnerUserId="348" LastEditorUserId="348" LastEditDate="2013-05-23T08:53:31.310" LastActivityDate="2013-05-23T08:53:31.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="895" PostTypeId="2" ParentId="892" CreationDate="2013-05-23T08:28:15.567" Score="14" Body="&lt;p&gt;Fully agreed with Stefan. VRF is the way to go here. Quick example how to incorporate it to suggested config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf VLAN1&#xA;  rd 42:1&#xA;ip vrf VLAN2&#xA;  rd 42:2&#xA;!&#xA;int vlan1&#xA;  ip vrf forwarding VLAN1&#xA;  ip address 1.1.1.1 255.255.255.0&#xA;int vlan2&#xA;  ip vrf forwading VLAN2&#xA;  ip address 2.2.2.2 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now vlan1 and vlan2 routing is separated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To inspect routing tables, ping, traceroute you need to specify the vrf. e.g.:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ip route vrf VLAN1&lt;/li&gt;&#xA;&lt;li&gt;traceroute vrf VLAN2 192.0.2.1&lt;/li&gt;&#xA;&lt;li&gt;ping vrf VLAN2 192.0.2.1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Or same in new AFI aware, IPv6 supporting config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vrf definition VLAN1&#xA;  rd 42:1&#xA;  address-family ipv4&#xA;vrf definition VLAN2&#xA;  rd 42:2&#xA;  address-family ipv4&#xA;!&#xA;int vlan1&#xA;  vrf definition VLAN1&#xA;  ip address 1.1.1.1 255.255.255.0&#xA;int vlan2&#xA;  vrf definition VLAN2&#xA;  ip address 2.2.2.2 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-05-23T08:46:56.507" LastActivityDate="2013-05-23T08:46:56.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="896" PostTypeId="2" ParentId="874" CreationDate="2013-05-23T08:44:32.523" Score="1" Body="&lt;p&gt;Although you've tested the SRX elsewhere:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does the SRX get an address with &lt;em&gt;the exact same config&lt;/em&gt; at home?&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This should mean the following are not issues:&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;set security zones security-zone  host-inbound-traffic system-services dhcp&lt;/code&gt; has been done&lt;/li&gt;&#xA;&lt;li&gt;Basic interface config done (either raw interface, vlan tags, interface in correct vlan, that vlan in &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Does the interface actually come up cleanly on the Juniper side?&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;show interfaces fe-0/0/0 extensive&lt;/code&gt; is your friend&lt;/li&gt;&#xA;&lt;li&gt;(I know it's not appropriate for this, but still...) For optical interfaces also check power levels: &lt;code&gt;show interfaces diagnostics optics ge-0/0/0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Add a trace to the DHCP client:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;pre&gt;&#xA;configure&#xA;set system services dhcp traceoptions file dhcp_client.log world-readable&#xA;set system services dhcp traceoptions flag client&#xA;set system services dhcp traceoptions level all&#xA;commit and-quit&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then monitor the log as you bring up the interface with &lt;code&gt;monitor start dhcp_client.log&lt;/code&gt;. (Remember to delete the traceoption once you're done)&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-23T08:44:32.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="897" PostTypeId="2" ParentId="892" CreationDate="2013-05-23T09:58:33.500" Score="2" Body="&lt;p&gt;If you want to disable routing between any VLAN, just use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Switch(config)# no ip routing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will need another L3 device(router, multi-layer switch) to route between some VLANs.&lt;/p&gt;&#xA;" OwnerUserId="575" LastActivityDate="2013-05-23T09:58:33.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="898" PostTypeId="1" CreationDate="2013-05-23T10:19:56.153" Score="6" ViewCount="3558" Body="&lt;p&gt;Is there an openly accessible Looking Glass for Telefonica ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of the &quot;official&quot; URL's listed hereunder point to a functional Looking Glass server &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.telefonica-wholesale.com/es/herraIP.html&quot; rel=&quot;nofollow&quot;&gt;http://www.telefonica-wholesale.com/es/herraIP.html&lt;/a&gt;  (from peeringdb.com)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://lg.ri.telefonica-data.net/cgi-bin/lg.pl&quot; rel=&quot;nofollow&quot;&gt;http://lg.ri.telefonica-data.net/cgi-bin/lg.pl&lt;/a&gt;  (from bgp4.as/looking-glasses)&lt;/p&gt;&#xA;" OwnerUserId="887" LastEditorUserId="887" LastEditDate="2013-05-23T11:50:52.303" LastActivityDate="2013-05-24T15:16:13.220" Title="Telefonica Looking Glass?" Tags="|bgp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="899" PostTypeId="2" ParentId="887" CreationDate="2013-05-23T11:30:29.343" Score="0" Body="&lt;p&gt;If Embedded Packet Capture is not available on your router you could try RITE:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_rawip.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/ht_rawip.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="856" LastActivityDate="2013-05-23T11:30:29.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="900" PostTypeId="1" AcceptedAnswerId="901" CreationDate="2013-05-23T12:10:51.790" Score="10" ViewCount="381" Body="&lt;p&gt;I was wondering if there is a single command to clear a single network port's configuration? (wipe switchport, portsecurity,...)&lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="623" LastEditDate="2013-05-30T11:44:28.307" LastActivityDate="2019-04-13T19:03:21.937" Title="Deconfigure an interface in IOS with one command" Tags="|cisco|cisco-commands|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="901" PostTypeId="2" ParentId="900" CreationDate="2013-05-23T12:13:28.810" Score="21" Body="&lt;p&gt;In global configuration mode, typing &lt;code&gt;default interface [the interface]&lt;/code&gt; will clear the interface's configuration in the running-config.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-23T12:13:28.810" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="902" PostTypeId="2" ParentId="653" CreationDate="2013-05-23T12:16:40.323" Score="7" Body="&lt;p&gt;I'm new so I can't vote up @netdad's and @mike pennington's answers - but I like them.  To take @Mike Pennington's answer a little further, assuming you've cleared the counters recently, you could run this command also:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#sh int count | i 0 +0 + 0 +0&#xA;Gi1/3                       0             0             0             0&#xA;Gi1/11                      0             0             0             0&#xA;Gi1/19                      0             0             0             0&#xA;Gi1/21                      0             0             0             0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The regex here is saying a &quot;0&quot; followed by 1 or more spaces followed by a &quot;0&quot; followed by 1 or more spaces followed by a &quot;0&quot; followed by 1 or more spaces followed by a final &quot;0&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="892" LastActivityDate="2013-05-23T12:16:40.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="903" PostTypeId="1" AcceptedAnswerId="906" CreationDate="2013-05-23T12:25:06.137" Score="6" ViewCount="773" Body="&lt;p&gt;I'd like to match the 0's in this output, specifically using &quot;Pattern Recall&quot; feature mentioned in Cisco documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The pattern is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gi4/3                       0             0             0             0&#xA;Gi4/4                       0             0             0             0&#xA;Gi4/5                       0             0             0             0&#xA;Gi4/6                       0             0             0             0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm trying to get this to work, but it gives no output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#show int count | i (0 +)\\1\\2\\3\\4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/crs/software/crs_r4.2/getting_started/configuration/guide/gs42aexp.html&quot; rel=&quot;nofollow&quot;&gt;this Cisco Doc&lt;/a&gt; it should work, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To create a regular expression that recalls a previous pattern, use parentheses to indicate memory of a specific pattern and a double backslash (\) followed by a digit to reuse the remembered pattern. The digit specifies the occurrence of a parenthesis in the regular expression pattern. When there is more than one remembered pattern in the regular expression, \1 indicates the first remembered pattern, \2 indicates the second remembered pattern, and so on.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="892" LastEditorUserId="-1" LastEditDate="2013-05-23T23:01:15.220" LastActivityDate="2013-05-23T23:01:15.220" Title="How to use &quot;Pattern Recall&quot; pattern matching in Regex" Tags="|cisco|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="904" PostTypeId="2" ParentId="903" CreationDate="2013-05-23T12:36:20.247" Score="6" Body="&lt;p&gt;The problems with your pattern matching are as follows;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You don't need to escape the '\'.&lt;/li&gt;&#xA;&lt;li&gt;You are capturing only 1 group, yet referring to 4 captured groups.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You probably want something like this;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show int count | i (0 +)\1\10$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is the same as;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0 +0 +0 +0$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I cannot use the &lt;code&gt;(0 +)&lt;/code&gt; 3 times as &lt;code&gt;\1\1\1&lt;/code&gt;, as we don't have any more empty space after the last &lt;code&gt;$&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="441" LastEditDate="2013-05-23T20:06:15.210" LastActivityDate="2013-05-23T20:06:15.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="905" PostTypeId="2" ParentId="887" CreationDate="2013-05-23T12:39:21.333" Score="3" Body="&lt;p&gt;The best methods (in my opinion) have already been mentioned, so simply incase you are on a device without those cool features, a fall back option is &lt;code&gt;debug ip packet&lt;/code&gt; with an access list.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-23T12:39:21.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="906" PostTypeId="2" ParentId="903" CreationDate="2013-05-23T12:40:19.197" Score="11" Body="&lt;p&gt;There are a few things that make this fail:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;This is trying to match the &lt;code&gt;0&lt;/code&gt; five times. The first time you write the expression it matches, then it tries to match four more times,&lt;/li&gt;&#xA;&lt;li&gt;This is matching &lt;code&gt;0&lt;/code&gt; (with a trailing space) The last 0 won't have a trailing space,&lt;/li&gt;&#xA;&lt;li&gt;This expression is incrementing the remembered pattern recall number, even though you only have one pattern,&lt;/li&gt;&#xA;&lt;li&gt;The pattern recall only needs one backslash. &lt;code&gt;\\1&lt;/code&gt; would match the text &quot;\1&quot;. The firstbackslash is the escape character, the character after that is the escaped character. &lt;/li&gt;&#xA;&lt;li&gt;Technically, with the trailing spaces, this would also match &lt;code&gt;10  0  0  0&lt;/code&gt; but there is little chance of that being an output. There will never be a number beginning in 0 though.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, to get the pattern you want, this will work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show interfaces stats  | i ( +0)\1\1\1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this expression, you match any amount of spaces ending with a 0, repeated 3 additional times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a nice example of how pattern recall works. &lt;code&gt;(+ 0)(+ 0)\1\2&lt;/code&gt; works too. To make this more clear &lt;code&gt;( +0)( +1)\1\2\2&lt;/code&gt; would match &lt;code&gt;0 1 0 1 1&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="220" LastEditorUserId="220" LastEditDate="2013-05-23T16:25:32.483" LastActivityDate="2013-05-23T16:25:32.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="907" PostTypeId="1" AcceptedAnswerId="910" CreationDate="2013-05-23T13:10:55.837" Score="7" ViewCount="2883" Body="&lt;p&gt;I have the following questions on Catalyst 4500E hot-swappable hardware components;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it possible to insert/pull out line cards to or from powered on chassis?&lt;/li&gt;&#xA;&lt;li&gt;Is it possible to insert redundant supervisor to powered on chassis?&lt;/li&gt;&#xA;&lt;li&gt;Is it possible to pull out one supervisor if two inserted?&lt;/li&gt;&#xA;&lt;li&gt;Can I cause any damage to chassis or line cards? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="904" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:20.287" LastActivityDate="2013-05-27T18:45:20.287" Title="Cisco Catalyst 4500E - modules installation" Tags="|cisco-catalyst|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="909" PostTypeId="2" ParentId="809" CreationDate="2013-05-23T13:29:31.143" Score="5" Body="&lt;p&gt;Answering some of the generic questions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;Are Jumbo Frames an unquestionable requirement?&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For FCoE it's somewhat irrelevant, as the FCoE frames are handled differently, their own default MTU is 2148 (frame size). You can do larger, but as with jumbo frames in general there's minimal benefit. An FCoE capable switch will just handle this.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;Is it better for these modules to sit in the aggregation layer or access layer in case there's a future need to tie them together (as we have an L2 access layer not directly tied to one another with L2 adjacencies between pairs of access switches that traverse the agg switches).&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Access really is the main place to use FCoE, replacing HBA's and edge FC switches with CNA's and 10g &quot;converged ethernet&quot; switches. Replacing distribution and core with FCoE can make sense when bandwidth needs justify it (or new build that has to run FC).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is probably your sticking point actually, if you're not doing 10g to the machine you're almost certainly going to be very underwhelmed with the performance you'll get.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;(Extra credit) Is FCoE the better choice over iSCSI?&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Depends on what you're doing, almost certainly not, and there may be better options than either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At a previous job we had a nice design using NFS (storage was NetApp's) where OS volumes were stored on a shared volume between the VM hosts (as normal), but data was individual NFS volumes, shared or separate as appropriate for the host, worked well in our environment as it was one group of admins managing ops from the app down to the hardware (well, its config, rack-n-stack, swaps, etc. was smarthands). Combined with NetApp's snapshots &amp;amp; snapmirror this made backup and restores trivial.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-23T13:29:31.143" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="910" PostTypeId="2" ParentId="907" CreationDate="2013-05-23T13:38:29.830" Score="11" Body="&lt;p&gt;4500 line cards are hot swapable, so the answer to the first three questions is yes (assuming a 45xxR chassis).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of caveats, for question 2, the supervisor has to meet the requirements for redundany.  For instance, you would not be able to insert a Sup7 in a chassis with a SupIV.  Additional configuration may be required as well to enable the redundancy properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For question 3, you shouldn't remove an active supervisor (while you can, this isn't best practice).  If the supervisor you wish to remove is currently active, failover to the standby supervisor first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer to the last question is yes, you can cause damage to the chassis and/or line card if you insert them incorretly (i.e. this has nothing to do with the chassis being running, but a purely mechanical problem).  The levers should be open when inserted, the card should glide in easily until the levers start to close by themselves, and the final insertion should be done with the levers.  If you have to use A LOT of force, it may not be aligned properly and you could result in damage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the 4500s, you also need to make sure you are using the proper slots.  Do not try to install a supervisor module in a linecard slot or vice versa.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-23T13:53:55.233" LastActivityDate="2013-05-23T13:53:55.233" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="911" PostTypeId="2" ParentId="907" CreationDate="2013-05-23T13:41:16.567" Score="4" Body="&lt;p&gt;In the same order you have asked;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1  Yes - &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps4324/products_white_paper09186a0080103dd4.shtml&quot; rel=&quot;nofollow&quot;&gt;Catalyst 4500 Series Overview for Service Providers&lt;/a&gt; - From Table 1: Cisco Catalyst 4500 Series Features, Functions, and Benefits &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Hot-swappable power supplies and switching modules&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Enables hot insertion and extraction for changes and maintenance any time without bringing down your system&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2 &amp;amp; 3 Yes &amp;amp; Yes - &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/hardware/configuration/notes/OL_23144.html&quot; rel=&quot;nofollow&quot;&gt;Installation and Configuration Note for the Catalyst 4500 E-Series Supervisor Engine 7-E&lt;/a&gt;, &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/hardware/configuration/notes/OL_19334.html&quot; rel=&quot;nofollow&quot;&gt;Installation and Configuration Note for the Cisco Catalyst 4500 E-Series Supervisor Engine 6L-E&lt;/a&gt;, &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps4324/product_data_sheet09186a00801fcaba.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Catalyst 4500 Series Supervisor Engine V&lt;/a&gt;. You should read the manual for your specific SUP of course!&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;hot swapping of supervisors is supported without disrupting system operation&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is obviously advised to pull out the backup one, as you runs these in a &quot;master/backup&quot; scenario, with the &quot;master&quot; syncing CEF adjacencies, RIB updates, TCAM entries etc, to the &quot;backup&quot;. So removing the &quot;backup&quot; SUP typically has no effect. Removing the &quot;master&quot; SUP should have no effect if you have things like Nonstop Forwarding and Stateful Switchover configured, if not, your results will vary depending on your set up.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;4 No - These products are designed to be hot swappable (having said that, very very rarely they may malfunction. For example, pulling out a supervisor engine when you have two installed, could cause an outage, even though supervisor redundancy has been enabled with not stop forwarding etc. Sh*t happens, software does crash, so my recommendation would be to perform these supposedly &quot;non service effecting&quot; procedures during an announced maintenance period, just in case.).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-05-23T23:46:27.257" LastActivityDate="2013-05-23T23:46:27.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="913" PostTypeId="2" ParentId="907" CreationDate="2013-05-23T13:46:05.160" Score="7" Body="&lt;p&gt;YLearn and javano covered the question nicely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd just like to add that most common reason of failing hot-swap is actually operator using too little force causing long bus stall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The insertion can last quite finite time and by inserting too slowly/lightly you can trigger long bus stall which will affect other linecards as well&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-23T13:46:05.160" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="914" PostTypeId="1" AcceptedAnswerId="915" CreationDate="2013-05-23T14:18:16.000" Score="15" ViewCount="45093" Body="&lt;p&gt;I've discovered a subnet with two &quot;ip helper-address&quot; statements.  This is &lt;em&gt;not&lt;/em&gt; our normal configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan300&#xA; ip address 10.1.3.2 255.255.255.0&#xA; ip helper-address 10.2.1.10&#xA; ip helper-address 10.3.1.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking at our DHCP servers, it seems that there are leases coming from both of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize this is not recommended, and the two DHCP servers might not be aware of each other's lease assignments (I'm pretty sure they don't). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, how is this handled by the Cisco switch (4510 Sup7 12.2)?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is it the first DHCP server to respond?  &lt;/li&gt;&#xA;&lt;li&gt;Is it the first one, then the second one if the first one times out?  &lt;/li&gt;&#xA;&lt;li&gt;Is it round robin?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="892" LastEditorUserId="266" LastEditDate="2013-05-23T17:37:02.337" LastActivityDate="2013-05-23T22:21:16.347" Title="How are two &quot;ip helper-address&quot; statements handled?" Tags="|cisco|dhcp|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="915" PostTypeId="2" ParentId="914" CreationDate="2013-05-23T14:21:31.077" Score="12" Body="&lt;p&gt;The &lt;code&gt;ip helper-address&lt;/code&gt; command designates an address which broadcasts are forwarded to; it will send the original packet to each of those listed addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If both reply, both replies are forwarded back to LAN.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="441" LastEditDate="2013-05-23T15:20:33.557" LastActivityDate="2013-05-23T15:20:33.557" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="916" PostTypeId="2" ParentId="914" CreationDate="2013-05-23T14:22:45.113" Score="2" Body="&lt;p&gt;IIRC, it sends to both configured helpers and the fastest one wins.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-05-23T14:22:45.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="917" PostTypeId="2" ParentId="907" CreationDate="2013-05-23T14:33:07.157" Score="1" Body="&lt;p&gt;In addition to what ytti said, the 4500 cards need quite &quot;firm&quot; pressure to seat properly. The extraction levers must rest all the way against the card when inserted. Make sure the cards are sliding into the &quot;rails&quot; properly, a twisted card can damage the card or the backplane connector&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-05-23T14:33:07.157" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="918" PostTypeId="2" ParentId="898" CreationDate="2013-05-23T14:59:29.893" Score="1" Body="&lt;p&gt;It's not appearing that way. You may want to redirect your query (either regarding the looking glass itself or the issues you're having that are prompting you to search for a looking glass) to the Telefonica NOC.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-23T20:24:04.473" LastActivityDate="2013-05-23T20:24:04.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="919" PostTypeId="2" ParentId="898" CreationDate="2013-05-23T15:05:10.660" Score="6" Body="&lt;p&gt;Some ammunition for contacting their NOC:&#xA;&lt;a href=&quot;http://www.internationalservices.telefonica.com/en/peerings.html&quot;&gt;http://www.internationalservices.telefonica.com/en/peerings.html&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Both parties shall provide access to a route server, looking glass, or&#xA;  similar service for the purposes of routing audits, diagnostics, and&#xA;  troubleshooting.  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So seems reasonable to dedand access to one, considering they are demanding it.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-23T15:05:10.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="920" PostTypeId="2" ParentId="887" CreationDate="2013-05-23T15:25:28.757" Score="2" Body="&lt;p&gt;Netflow is another alternate method of monitoring traffic flows. It is better if you only want to know details at layers 3 and 4. The information can also be viewed locally on the router without the need for Wireshark.  &lt;/p&gt;&#xA;" OwnerUserId="446" LastActivityDate="2013-05-23T15:25:28.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="921" PostTypeId="1" AcceptedAnswerId="996" CreationDate="2013-05-23T15:59:57.677" Score="8" ViewCount="3612" Body="&lt;p&gt;We have the following setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5T60X.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two MX routers connect to the same L2 site. Loop protection / redundancy is done via &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos11.4/topics/concept/vpn-vpls-multihoming.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;VPLS multihoming&lt;/a&gt;. On the other end are two switches (EX4200 for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the blue link fails the two switches and the rest of the L2 infrastructure have to know that traffic must now go through the yellow link (and consequently trough the EX switch on the right).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, the yellow mac-table only gets filled when there is traffic arriving from the VPLS through the yellow link. If no traffic is received from a certain MAC address, traffic for that address will still be sent over the blue link and noone knows that that link is now broken (except perhaps the EX switch on the left &lt;strong&gt;if&lt;/strong&gt; the link fails physically).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find a good solution to fix this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few approaches:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You can somewhat lessen the impact by &lt;strong&gt;not&lt;/strong&gt; making the blue/yellow link portfast so that spanning-tree can send a topology change when the interface goes down/up. When the interface does not go down physically you're out of luck. On the other hand the spanning-tree solution will bite you when the port comes up again. VPLS will take the site online but the port needs to go trough the STP learning stages before it forwards traffic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You could stack the two switches. This will fix the problem for the rest of the L2 infrastructure as they always send to the same switch (stack). Still the stack needs to know when to switch to the other uplink interface with the active VPLS instance.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When doing planned maintenance (and if you have a stack), you can deactivate the primary link manually to switch over to the secondary link. Then you can lower the site-preference for the deactivated link on the router so that the now active site becomes the new primary. Same thing when switching back. Not ideal and does not work for unforeseen outages. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any input on how to solve this is appreciated. (Waiting for EVPN/TRILL does not count. ;))&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-05-25T04:29:23.913" Title="How to signal a VPLS multihoming change to a L2 CE device" Tags="|juniper|mpls|vpls|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="922" PostTypeId="1" CreationDate="2013-05-23T16:08:19.617" Score="7" ViewCount="231" Body="&lt;p&gt;With SNMP pollers, is it better to locate them closer to the DB to ensure the poller to DB traffic has a better chance of making it. Or put the poller closer to monitored device, so that traffic is more accurate in terms of  latency and making it to the device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. I have 3 regions, and 3 pollers, and 1 DB. Do I put all four devices in one location, or distribute the pollers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have some opinions but wanted to get other side of the story. &lt;/p&gt;&#xA;" OwnerUserId="919" LastEditorUserId="775" LastEditDate="2013-05-24T08:50:52.420" LastActivityDate="2013-05-24T08:50:52.420" Title="Should I locate SNMP poller near DB or monitored devices?" Tags="|snmp|nms|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="923" PostTypeId="2" ParentId="922" CreationDate="2013-05-23T16:12:06.633" Score="5" Body="&lt;p&gt;This seems like useless micro-optimization in any case, which you shouldn't worry about until actual practical issue arises, which is likely never.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However purely academically you should put snmp poller near device it is polling as it is request/response protocol which is RTT bound.&#xA;The poller can aggregate the polled data and use TCP with windows to send large amount of data fast to DB.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-23T16:12:06.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="924" PostTypeId="2" ParentId="914" CreationDate="2013-05-23T17:56:53.183" Score="1" Body="&lt;p&gt;with regard to your concern about the DHCP not being aware of the others leases, before a DHCPOFFER is sent to the host, the DHCP Server sends an ICMP message to the IP address, if the DHCP server receives a ICMP Echo Reply message, the DHCP server chooses a different IP address, and sends another ICMP message to that IP address until a ICMP Echo Reply message is not received, then the DHCP server sends the IP address in the DHCPOFFER to the host.&lt;/p&gt;&#xA;" OwnerUserId="863" LastActivityDate="2013-05-23T17:56:53.183" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="926" PostTypeId="2" ParentId="922" CreationDate="2013-05-23T18:35:54.860" Score="3" Body="&lt;p&gt;FWIW this is a great question and I can't disagree with @ytti in that this has a lot of potential to go down a theory/academia rabbithole.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a practical perspective, placing the pollers close to the objects being polled is what you want to do. I'm not a distributed systems expert/SDE, but I'd imagine that any NMS that's designed to be distributed should already have functions in it to separate out db insertion timestamps from actual polled SNMP data and its own timestamps. It's still not an easy problem to solve, but as ytti has already said (and I agree with), doing the db inserts shouldn't take priority over data gathered from polling. Those have the luxury of being wrapped up in TCP for better data integrity protection. With actual SNMP polls and traps, you have &quot;best effort&quot; times two to contend with - number one being UDP obviously, and number 2 being process management/&quot;data integrity&quot; (ie counters being accurate etc) on the box that you're polling. Sometimes a box just starts to choke and returning numbers via SNMP takes a backseat to other things.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-05-23T18:35:54.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="927" PostTypeId="1" AcceptedAnswerId="932" CreationDate="2013-05-23T18:44:26.380" Score="4" ViewCount="1017" Body="&lt;p&gt;My simple understanding is that one of the advantages of going to fibre (light) is that you transfer things at a lot higher rate than a standard cable using the light frequency.  Adjusting the light frequency, theoretically will allow more data to transfer (i.e. UV -vs- IR) per unit time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thinking over the frequency spectrum, I seem to recall that light is at a relatively low Hz rate as compared to the higher radio frequencies.  Would it be theoretically possible to use something like radio wave frequency (say GHz RF) transmitted over copper wire to increase bandwidth between two points?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On my audio/visual receiver, I notice that I have wired RF input as well as optical input.  I understand here that RF input is higher bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="607" LastEditorUserId="607" LastEditDate="2013-05-24T20:19:54.017" LastActivityDate="2013-05-24T21:05:07.743" Title="Media Transfer rates......is using laser over fiber the fastest?" Tags="|bandwidth|cabling|throughput|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="928" PostTypeId="2" ParentId="927" CreationDate="2013-05-23T19:12:00.383" Score="0" Body="&lt;p&gt;My non-EE-background stab at an answer is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't believe fiber was initially looked at as a transmission medium purely for bandwidth  reasons, but more for the fact that it [light] can travel much longer distances without amplification/regeneration, and the fact that it's immune to factors that electrical transmission mediums are not immune to, like noise for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The higher bandwidth rates are a product of engineering done at the PHY level - I'm not sure if you're familiar with WDM technology, but basically it multiplexes light at various wavelengths to increase the total &lt;strong&gt;capacity&lt;/strong&gt; of a single fiber pair - this gives you a higher aggregated bandwidth, but each wavelength still has a max of 10G (disclaimer: I'm not up on optical engineering news so it's possible that you can get higher rates per wavelength).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are certainly specs for (and maybe even small deployments of) 10G over copper, typically over what's called &quot;direct attach&quot; cables - they're twinax copper cables with SFP's on either side. There are also QSFP's which are 40G capable, but these will typically have one QSFP on one end and break out into 4 10G cables on the other end.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-23T19:17:21.373" LastActivityDate="2013-05-23T19:17:21.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="929" PostTypeId="2" ParentId="927" CreationDate="2013-05-23T19:19:25.417" Score="4" Body="&lt;p&gt;TL;DR: No, RF is slower than laser transmission.&lt;/p&gt;&#xA;&lt;h2&gt;Frequency&lt;/h2&gt;&#xA;&lt;p&gt;Frequency is, as you've described, a fundamental aspect of the carrier signal. Within the electromagnetic spectrum, lasers generally operate in or near visible wavelengths, (although there are infrared and ultraviolet lasers too,) and &amp;quot;radio&amp;quot; frequencies (RF) are much LOWER, (ie, well below the infrared.)&lt;/p&gt;&#xA;&lt;h2&gt;Bandwidth&lt;/h2&gt;&#xA;&lt;p&gt;Theoretical bandwidth is determined by the frequency at which one can vary the carrier signal. The variation must be very small; If it varied greatly, it wouldn't appear to be a &lt;em&gt;variation&lt;/em&gt; at the receiver. The &lt;em&gt;rate&lt;/em&gt; at which you can vary the frequency is dependent on the frequency. So for a given percentage of variation, you get a higher frequency of variation when you use a higher carrier frequency. That is to say: a 1% variation of a red laser frequency is a much higher frequency than a 1% variation of a radio frequency.&lt;/p&gt;&#xA;&lt;p&gt;The actual usable bandwidth -- the number of &amp;quot;bits&amp;quot; one can pour through a communication channel -- is significantly less. But the theoretical bandwidth gives you a hard ceiling which is a good first approximation of the usable bandwidth.&lt;/p&gt;&#xA;&lt;p&gt;So no, RF is significantly slower than laser transmission.&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-05-23T22:19:26.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="930" PostTypeId="1" AcceptedAnswerId="933" CreationDate="2013-05-23T19:38:32.047" Score="10" ViewCount="19587" Body="&lt;p&gt;&lt;em&gt;I find my self in a situation I was in not too long ago, but I can't&#xA;remember how I resolved it :)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Scenario&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Cisco IOS router with a LAN interface (fa0/0) and a WAN&#xA;interface (fa0/1), and 2nd WAN interface (fa0/2).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There are two LAN sub-interfaces fa0/0.10 and fa0/0.20 lets say.&lt;/li&gt;&#xA;&lt;li&gt;There is a default route via fa0/1. However, there is a static route&#xA;to a specific subnet, lets say 1.2.3.4/24 via fa0/2 (fa0/2 is closer&#xA;to this subnet, but a more expensive $$$ WAN link)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All my fa0/0.10 users are accessing 1.2.3.4/24 and so the static route&#xA;sends them out of fa0/2 (WAN2). For all other destinations fa0/0.10 users go&#xA;via the DHCP default route I receive on the WAN1 interface fa0/1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The problem definition;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Users in the fa0/0.20 subnet just access the Internet. No user in my fa0/0.20 subnet every really has the need to access the remote 1.2.3.4/24 subnet. Rarely they do though, in which case the static route sends them via fa0/2. I don't want this though, I want them to access 1.2.3.4/24 via fa0/1, the default WAN interface. I believe I can achieve this via PBR, but I can't seem to get it to work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the config I am trying at present;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0.10&#xA; description LAN1&#xA; encapsulation dot1Q 10&#xA; ip address 192.168.10.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;&#xA;interface FastEthernet0/0.20&#xA; description LAN2&#xA; encapsulation dot1Q 20&#xA; ip address 192.168.20.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; ip policy route-map FORCE-LAN2-VIA-WAN1&#xA;&#xA;interface FastEthernet0/1&#xA; description WAN1&#xA; ip address dhcp&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA;&#xA;interface FastEthernet0/2&#xA; description WAN2 - Used for 1.2.3.4/24&#xA; ip address 5.5.5.5 255.255.255.0&#xA;&#xA;! Static route to route to a remote subnet via 2nd WAN link&#xA;ip route 1.2.3.4 0.0.0.255 5.5.5.6&#xA;! A default route is received on fa0/1 (WAN1) via DHCP from ISP&#xA;! for all other traffic&#xA;!&#xA;! NAT fa0/0.10 users when accessing the Internet via WAN1&#xA;ip nat inside source route-map ROUTE-WAN1 interface FastEthernet0/1 overload&#xA;!&#xA;! NAT fa0/0.20 users out via WAN1&#xA;ip nat inside source route-map FORCE-LAN2-VIA-WAN1 interface FastEthernet0/1 overload&#xA;&#xA;route-map ROUTE-WAN1 permit 10&#xA; match interface FastEthernet0/1&#xA;&#xA;route-map FORCE-LAN2-VIA-WAN1 permit 10&#xA; match interface FastEthernet0/0.20&#xA; set default interface FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to apply policy based routing directly to the fa0/0.20 sub interface to force all traffic via WAN1, fa0/1. My understanding is, that because there is a more specific route than the default route received by DHCP on fa0/1 in the FIB, it overrides the PBR and traffic from fa0/0.20 to 1.2.3.4/24 is still using WAN2, fa0/2. Or at least, I believe this to be the case when using &quot;set default interface...&quot;. If I were to use &quot;set ip next-hop&quot; for example, this would force the PBR to take precedence, but WAN1, fa0/1, receives an IP by DHCP and is thusly changing :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note; There are actually many static routes via WAN2, so I don't want to reverse the situation and policy route fa0/0.10 via WAN2 for specific subnets. The config there is more complex than I have let on, long and short of it is though, it is not viable to change that. Additionally, if there is a better way to tackle this problem other than PBR, I'm all ears. I am fighting with this method because it is the best solution I am aware of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt; Added a spectacularly drawn topology diagram&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MNB5e.png&quot; alt=&quot;Topology&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="623" LastEditDate="2013-05-30T11:42:12.547" LastActivityDate="2013-05-30T11:42:12.547" Title="Cisco config example for Policy Based Routing" Tags="|cisco|cisco-commands|pbr|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="931" PostTypeId="1" CreationDate="2013-05-23T19:52:08.350" Score="6" ViewCount="383" Body="&lt;p&gt;I have &lt;strong&gt;two&lt;/strong&gt; 3750 Cisco switches that have two fiber cables/sfp  modules hooked up on each. The second fiber is just for redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have installed two new 3750X switches on the rack for the upgrade, and I would like to use these existing fibers that have been pulled to link up these new switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What command can I run on the 3750 switches to determine which fiber is safe to pull, so I can then use it to connect the new switches - I don't want to take down an entire floor (even temporarily!)&lt;/p&gt;&#xA;" OwnerUserId="944" LastEditorUserId="49" LastEditDate="2013-05-23T20:03:44.233" LastActivityDate="2014-05-30T07:37:02.093" Title="Cisco SFP module: Determing Priority?" Tags="|cisco|switch|cisco-3750|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="932" PostTypeId="2" ParentId="927" CreationDate="2013-05-23T19:57:48.970" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Adjusting the light frequency, theoretically will allow more data to transfer (i.e. UV -vs- IR) per unit time&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No this is not true. Please see &lt;a href=&quot;https://electronics.stackexchange.com/questions/49206/encoding-delay-of-ethernet-and-the-relation-to-cable-frequency-rating&quot;&gt;this question's&lt;/a&gt; answer on the Electronics Stack Exchange site. The frequency of the light travelling down the fibre is not relational to the speed of data transmitted as you may think. I know that question I linked is about copper but it might give you some insight. Single Mode fibre for example can run at 100Mbps, 1Gbps and 10Gbps; all at a wavelength of 1310nm. You need to look into &lt;a href=&quot;http://en.wikipedia.org/wiki/Symbol_rate&quot; rel=&quot;nofollow noreferrer&quot;&gt;symbol rate&lt;/a&gt; and encoding methods such as &lt;a href=&quot;http://en.wikipedia.org/wiki/Manchester_code&quot; rel=&quot;nofollow noreferrer&quot;&gt;Manchester Encoding&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/8B/10B_encoding&quot; rel=&quot;nofollow noreferrer&quot;&gt;8b/10b encoding&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/64b/66b_encoding&quot; rel=&quot;nofollow noreferrer&quot;&gt;64b/66b encoding&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would it be theoretically possible to use something like radio wave frequency (say GHz RF) transmitted over copper wire to increase bandwidth between two points?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, this is not true. The speed at which data travels down a copper cable is nearly as fast as a fibre (circa 0.6*c). The electromagnetic wave is propagating around the edge of the copper cable at a rate called the &lt;strong&gt;dielectric constant&lt;/strong&gt;, which is based upon the relationship between the transmission medium (the copper) and the air and plastic coating around it. See the answer to &lt;a href=&quot;https://electronics.stackexchange.com/questions/45492/speed-of-electricity-signal-propagation-through-copper-for-communications-del&quot;&gt;this different question&lt;/a&gt; on the Electronics Stack Exchange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you delve deeper into the physics of electronics and light, they behave completely counter intuitively.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:08.917" LastActivityDate="2013-05-23T19:57:48.970" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="933" PostTypeId="2" ParentId="930" CreationDate="2013-05-23T20:00:02.220" Score="9" Body="&lt;p&gt;I would recommend using a route-map for only one purpose (one for nat, another to pbr); mixed use can make for a mess.  For NAT, the &lt;code&gt;match interface&lt;/code&gt; will apply post-routing -- handy to make conditional nat entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The route-map for PBR should use an ACL to match the traffic coming from LAN2 and then set the next-hop to the desired interface with &lt;code&gt;set interface&lt;/code&gt; not &lt;code&gt;set default&lt;/code&gt; -- or &lt;code&gt;set ip next-hop dynamic dhcp&lt;/code&gt; as you won't know the actual gw address.  This bypasses / overrides any routing logic that would otherwise send then traffic to your expensive WAN.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-23T20:00:02.220" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="934" PostTypeId="2" ParentId="931" CreationDate="2013-05-23T20:17:11.740" Score="4" Body="&lt;p&gt;If you made an ether channel / port channel, don't worry, the traffic will go over the remaining fiber. Otherwise you could consider to make a channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be on the safe side, run &lt;code&gt;show interface &amp;lt;name&amp;gt;&lt;/code&gt; several times for interfaces to both fibers on one switch and watch the counters. The one which doesn't change at all, while the other one does, should be safer to pull.&lt;/p&gt;&#xA;" OwnerUserId="231" LastActivityDate="2013-05-23T20:17:11.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="935" PostTypeId="2" ParentId="931" CreationDate="2013-05-23T20:21:53.030" Score="4" Body="&lt;p&gt;You'll have to look at the configuration of the switches to see how those ports are being used -- etherchannel/bonded, spanning-tree redundancy, etc.  You'll need to look at the config of &lt;em&gt;both&lt;/em&gt; ends to see if it's safe to use the &quot;backup&quot; fibers at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's just simple STP, then the blocked port will have an orange status led.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-23T20:21:53.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="936" PostTypeId="2" ParentId="931" CreationDate="2013-05-23T20:41:40.140" Score="5" Body="&lt;p&gt;As already suggested by Stefan and Ricky, if your fiber ports are aggregated in an etherchannel, then you can safely remove any of the fibers and all the traffic will use the remaining fiber. In order to check if they are aggregated you can run &lt;code&gt;show etherchannel summary&lt;/code&gt; and check the output lookinf or any PortChannel interface made of both fiber ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, if both fiber ports are not aggregated and STP or RSTP is in use, then you need make sure you are pulling off the fiber connected to the blocking port. Run &lt;code&gt;show spanning-tree &amp;lt;interface_name&amp;gt;&lt;/code&gt; for both fiber ports in both switches and look for the ports in status blocking. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just be careful if running PVST, RPVST or MST. Port costs could have been tuned in such way that one port is forwarding some VLANs and the other port is forwarding some other VLANs. In this case, whatever the fiber you pull off you will generate impact on your network. &lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2013-05-23T20:41:40.140" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="937" PostTypeId="2" ParentId="653" CreationDate="2013-05-23T20:50:29.530" Score="1" Body="&lt;p&gt;Oh the days when it was easy just to type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch 1#show ver | in uptime&#xA;switch 1 uptime is 28 weeks, 6 days, 20 hours, 19 minutes&#xA;&#xA;switch 1#show inter link | in 28 weeks&#xA;Fa3/1                      28 weeks, 6 days, 20 hours, 19 minutes 16 secs&#xA;Fa3/2                      28 weeks, 6 days, 20 hours, 19 minutes 16 secs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(that's on a 4500 running version 12.2(20))&lt;/p&gt;&#xA;" OwnerUserId="946" LastEditorUserId="441" LastEditDate="2013-05-24T16:10:17.040" LastActivityDate="2013-05-24T16:10:17.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="938" PostTypeId="2" ParentId="765" CreationDate="2013-05-23T21:22:25.590" Score="5" Body="&lt;p&gt;In IOS-XR, there are different concepts of authorization than in classic IOS.  In classic IOS, there's only command authorization, which allows or denies specific commands, typically sent to a tacacs+ or radius server.  In IOS-XR, there is command authorization (aaa authorization commands) (but you're better off doing this via task-groups) and exec authorization(aaa authorization exec) , which controls who can actually start an exec session.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that using the normal access method (ssh/telnet to the vtys) that if you're authenticated, no other authorization is necessary, but if you start the XML agent on its own dedicated port, then that use &lt;em&gt;must&lt;/em&gt; be authorized.  In my particular case, we are using a TACACS server for authentication, and I was specifying to use local authorization.  The username does not exist on the router, so using the local method 'aaa authorization exec default local' caused authorization to fail.  Changing it to 'aaa authorization exec group tacacs+ local' caused it to get the 'authorization OK' from the TACACS servers, and all is well.&lt;/p&gt;&#xA;" OwnerUserId="178" LastEditorUserId="178" LastEditDate="2013-05-23T21:57:01.127" LastActivityDate="2013-05-23T21:57:01.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="939" PostTypeId="2" ParentId="644" CreationDate="2013-05-23T21:22:55.803" Score="9" Body="&lt;p&gt;By doing &lt;code&gt;clear ipsec sa peer &amp;lt;peer IP&amp;gt;&lt;/code&gt; will only reset the IPSec portion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There isn't a way to clear just one isakmp tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore the best way that I know is to remove the peer from the crypto map and reapply it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no crypto map mymap 40 set peer 12.1.1.1 &#xA;crypto map mymap 40 set peer 12.1.1.1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way you can take the peer out, wait for the tunnel to come down and time out, then reapply it. This method gives you more control over the tunnels behavior.&lt;/p&gt;&#xA;" OwnerUserId="949" LastActivityDate="2013-05-23T21:22:55.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="940" PostTypeId="2" ParentId="927" CreationDate="2013-05-23T21:42:15.527" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Looking over the frequency spectrum, I notice that light is at a relatively low Hz rate as compared to high frequency.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What spectrum chart were you looking at, because this is not correct. Here's a spectrum chart from Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rwlyp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice higher frequencies are to the &lt;em&gt;left&lt;/em&gt;, and longer wavelengths are to the right.&#xA;In fact these are related by the formula&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;f = c / lambda&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where c is the speed of light.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;High frequency (HF) is nominally 3 to 30 MHz. The highest practical rf (actually microwave) frequency is around 100-300 GHz. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An 1550 nm optical signal is about 190 terahertz and 850 nm about 350 THz, or 1000 times higher than microwave frequencies.&lt;/p&gt;&#xA;" OwnerUserId="654" LastActivityDate="2013-05-23T21:42:15.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="941" PostTypeId="2" ParentId="914" CreationDate="2013-05-23T22:15:26.310" Score="6" Body="&lt;p&gt;&lt;strong&gt;Your ip-helper is the correct way to do this for redundancy and &lt;em&gt;is&lt;/em&gt; the recommended method.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DHCPDiscovery (broadcast) gets picked up by the &lt;strong&gt;ip-helper&lt;/strong&gt; and then unicasts to each DHCP server with the relay-agent (the router) in the request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Usually the first DHCP server to respond wins.&lt;/strong&gt;  Both DHCP servers can (and should) make DCHPOffers to the client.  It's the client that decides which one to keep and then sends a DHCPRequest (unicast) to the server that offered it for the IP it wants to use.  The server needs to DHCPAck that request to complete the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;For redundancy, but to not violate the DHCP rule of not having overlapping scopes defined for your IP pools, you need two ip-helpers.  Since the DHCP servers are not aware of one another, the IP pools must be unique.  &lt;strong&gt;A common method for DHCP redundancy is to take your typical /24 subnet and divide it into two /25s for your scopes (one per server).&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: 192.0.2.0/24 is your actual network, so you divide it into 192.0.2.0/25 and 192.0.2.128/25.  So the roughly 256 addresses are cut into two pools of 128 addresses and assigned to each DHCP scope.  Now you have no overlapping addresses + redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since cutting your scope pool in half, make sure the servers can support your entire network if one DHCP server were to fail.  Consider the lease-time to be the duration that clients can retain their addresses where you won't exhaust your pool if you have many rotating clients, yet be able to give you enough time to detect and fixed a failed DHCP server.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-05-23T22:21:16.347" LastActivityDate="2013-05-23T22:21:16.347" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="942" PostTypeId="2" ParentId="922" CreationDate="2013-05-23T23:33:03.793" Score="1" Body="&lt;p&gt;The number of pollers used should be based on the number of nodes that is being polled and the frequency of polls. In addition, some vendors do not support the poller being distant from the DB. Solarwinds has this restriction.  &lt;/p&gt;&#xA;" OwnerUserId="446" LastActivityDate="2013-05-23T23:33:03.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="943" PostTypeId="2" ParentId="99" CreationDate="2013-05-24T00:22:33.360" Score="9" Body="&lt;p&gt;One &lt;strong&gt;non-techncial reason&lt;/strong&gt; to install fiber over copper for switch uplinks and the like, ignoring costs, etc:  People are more afraid to touch a fiber cable compared to copper, so you'll get less of the &quot;Oops, I didn't realize that was the uplink&quot;.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-24T00:22:33.360" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="944" PostTypeId="2" ParentId="927" CreationDate="2013-05-24T01:32:20.710" Score="1" Body="&lt;p&gt;Here's my non-EE viewpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reasonable distances, neither speed of light (vs electrical impulse) nor frequency are large considerations.  If you were to talk with someone on the phone via an old (non-optical) undersea cable, you wouldn't notice a delay over the phone the way you do when we communicate by bouncing light off satellites in geostationary orbit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your major limiting factors are signal fidelity (for lack of a better term), and how quickly you can sense changes in voltage, light levels, etc.  Both of these depend on cabling, distance, etc both for copper and fiber.  The fact is we can't encode data on the quantum/photon level and even if we could, we couldn't get it there reliably.  Even single-model fiberoptic cable isn't really single mode so there is still a minimum signal time due to the optical properties of the cable (at distance it is a &lt;em&gt;lot&lt;/em&gt; less over single-mode than multi-mode cable though).  Similar considerations occur regarding copper and a major part of cat 5 vs cat 5e vs cat 6 specifications have to do with these issues, namely minimizing the minimum reliable signal timeslice so that more signals can be sent down the cable in a given time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The one area here where laser over fiber makes a big difference though is in wavelength division multiplexing.  Unlike copper, several lasers of different frequencies can send signals down the same fiberoptic path and these can be divided and decoded on the other end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the other poster noted, RF is slower than cable or fiber.  The big issue is that transmitting a signal over a frequency carrier wave is not as simple as on/off like it is over a physical cable.  These are complicated approaches (see &lt;a href=&quot;https://superuser.com/questions/298568/how-does-wi-fi-modulate-the-electro-magnetic-wave&quot;&gt;https://superuser.com/questions/298568/how-does-wi-fi-modulate-the-electro-magnetic-wave&lt;/a&gt;), but the answer is even more there, you can't just send individual bits as single waves.&lt;/p&gt;&#xA;" OwnerUserId="174" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2013-05-24T01:32:20.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="946" PostTypeId="1" AcceptedAnswerId="947" CreationDate="2013-05-24T03:19:32.403" Score="9" ViewCount="21774" Body="&lt;p&gt;When looking at the downloads available on the Cisco site, they have a regular version of the file and a NO PAYLOAD ENCRYPTION version. What is the difference? And why would one choose one over the other?&lt;/p&gt;&#xA;" OwnerUserId="851" LastEditorUserId="851" LastEditDate="2013-05-24T03:24:35.537" LastActivityDate="2013-05-24T03:27:05.107" Title="What is the NO PAYLOAD ENCRYPTION version of the IOS software?" Tags="|cisco|cisco-ios-15|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="947" PostTypeId="2" ParentId="946" CreationDate="2013-05-24T03:27:05.107" Score="6" Body="&lt;p&gt;From the &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps5460/product_bulletin_c25-566278_ps10537_Products_Bulletin.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco website&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Universal images with the universalk9_npe&quot; designation in the image name: The strong enforcement of encryption capabilities provided by Cisco Software Activation satisfies requirements for the export of encryption capabilities. However, some countries have import requirements that require that the platform does not support any strong crypto functionality such as payload cryptography. To satisfy the import requirements of those countries, the `npe' universal image does not support any strong payload encryption. This image supports security features like Zone-Based Firewall, Intrusion Prevention through SECNPE-K9 license.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So you would use this image if you were in a country that has import restrictions on strong crypto.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-24T03:27:05.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="950" PostTypeId="2" ParentId="922" CreationDate="2013-05-24T05:53:55.610" Score="1" Body="&lt;p&gt;Being closer to the polled devices also means you can have a higher polling frequency due to lower latency. I found that when I was trying to poll a device over our transatlantic circuits at say 5 or 10 second intervals it was taking too long to walk the tables.&lt;/p&gt;&#xA;" OwnerUserId="362" LastEditorUserId="362" LastEditDate="2013-05-24T06:26:28.890" LastActivityDate="2013-05-24T06:26:28.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="951" PostTypeId="2" ParentId="921" CreationDate="2013-05-24T06:08:56.753" Score="3" Body="&lt;p&gt;What kind of convergence budget are you looking for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'd ditch the idea of using VPLS loop-prevention and run unique siteID, you could go back to STP.&#xA;You'd experience loss of link via BPDU even in absence of hardware liveliness failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you could tune your convergence budget by TCN/forward-time (MAC timeout, after TCN has been seen) or by bigger hammer 'mac aging-time'.&lt;br&gt;&#xA;Flip side is, you'll have more unknown unicast in the network, which you can workaround by making sure ARP timeout is less or equal to TCN/forward-time&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know probably not the answer you're looking for, but if there is some silver bullet here, I'm missing it.&#xA;I don't think trill or EVPN draft would help you either in this scenario, if your VPLS or EVPN would be end-to-end right to the host port, then it would fix this right up. But just replacing VPLS to EVPN at the core and keeping disconnected LAN in either side, would provide same problem.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-24T06:08:56.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="952" PostTypeId="2" ParentId="927" CreationDate="2013-05-24T06:20:08.243" Score="0" Body="&lt;p&gt;High frequency traders are looking more and more for microwave routes for lower latency. Main advantage is that microwaves are direct paths between two points and can go past lakes and other obsticles easier than fibre which is often routed along roads and facilities like gas lines and sewers etc... &lt;/p&gt;&#xA;" OwnerUserId="362" LastActivityDate="2013-05-24T06:20:08.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="953" PostTypeId="1" CreationDate="2013-05-24T08:25:14.237" Score="13" ViewCount="5471" Body="&lt;p&gt;We are going to deploy a campus network with approximately 50 switches (Core, Agg, Access). Some of them will be L2 (20), and others will be L3 (30). We are thinking about how to manage these devices:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A big VLAN across all switches. Easy to deploy, easy addressing, &lt;strong&gt;but&lt;/strong&gt; big L2 broadcast domain.&lt;/li&gt;&#xA;&lt;li&gt;Management VLAN for L2 switches. To access core and aggregation switches use routed (or SVI) interfaces. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What would you prefer to use in your network?&lt;/p&gt;&#xA;" OwnerUserId="904" LastEditorUserId="49" LastEditDate="2013-05-24T10:22:42.970" LastActivityDate="2013-05-24T17:13:17.950" Title="Management network. Best practises: big VLAN or routed interfaces" Tags="|cisco|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="954" PostTypeId="2" ParentId="953" CreationDate="2013-05-24T08:36:13.010" Score="5" Body="&lt;p&gt;As you said, it matters on how many devices we're talking about, but aside from that, what you should avoid &lt;strong&gt;if at all possible&lt;/strong&gt; is only having &quot;in-band&quot; management of your devices. You don't want to have your management traffic riding the same network as your production traffic. If not all of your switches have a separate Ethernet interface for management, that's fine, but nearly every single piece of equipment out there has some form of serial console. &lt;strong&gt;&lt;em&gt;USE IT.&lt;/em&gt;&lt;/strong&gt; Especially as a backup for in-band management. &lt;em&gt;This will save your ass if a device falls off of the planet.&lt;/em&gt; I'm also suggesting using a &lt;em&gt;completely separate&lt;/em&gt; physical infrastructure for management connectivity to your equipment. This applies doubly for serial console access. If you're using one of your interfaces on your switches (that's not a dedicated management interface), that's also not as big of a deal, as long as you've got a separate network to connect it to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;50 devices isn't too unreasonable of a footprint to use a single VLAN (again, assuming you are &lt;strong&gt;not&lt;/strong&gt; doing in-band management) and have one broadcast domain for - you may be trying to optimize too early at this stage. If your core switches are modular boxes then they should most definitely have Ethernet management interfaces - I would advise you to use those rather than an SVI or a physical routed interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: my personal preferences basically outline what I've advised above: always serial consoles. Use dedicated Ethernet management interfaces where applicable. If dedicated Ethernet management interfaces are not available, then burn a physical port on the box, but always always always a separate network, for serial consoles at the absolute minimum.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-24T08:55:05.740" LastActivityDate="2013-05-24T08:55:05.740" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="955" PostTypeId="2" ParentId="953" CreationDate="2013-05-24T09:49:17.013" Score="1" Body="&lt;p&gt;I would use a separate management VLAN as our colleagues already stated, then traffic vlans as many as required.&#xA;Furthermore I would be more careful how are you going to interconnect all these switches, what  software version run on each device (you have to be sure you run a stable version and most of all do know any reported bug), then plan other things: how do you configure trunks, etherchannels and of course &quot;STP&quot;.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-05-24T09:49:17.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="956" PostTypeId="1" AcceptedAnswerId="957" CreationDate="2013-05-24T10:24:23.477" Score="14" ViewCount="4000" Body="&lt;p&gt;I am looking at a 7609-S with a RSP720-3CXL running 12.2(33)SRE3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been asked to help with rate limiting some servers attached to a couple of ports running as L2 ports (&lt;code&gt;switchport mode access&lt;/code&gt;), so this requires me to apply a policy-map to the L3 SVI that is the default gateway in this VLAN. When enabling the service policy under the SVI interface configuration I received the following error;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-if)#service-policy input PM-LIMIT-100M&#xA;Warning (QoS): MLS QoS is disabled, marking/policing will be done after &#xA;enabling MLS QoS globally&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a looked through the config and sure enough, there is no &quot;mls qos&quot; in the global configuration. &lt;strong&gt;What potential issues can happen from enabling this global config command on this production device?&lt;/strong&gt; I can obviously perform this during scheduled maintenance period for safety, but should it even be attempted at all?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it makes any difference, there were no class maps or policy maps defined on this router until I logged in, to make one to rate limit the previously mentioned server ports (all ports are Gig, I have been tasked with limiting this SVI to 100Mps for a short period). I trying to use the following configuration;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any CM-LIMIT-100M&#xA;  match access-group name ACL-SERVERS&#xA;!&#xA;policy-map PM-LIMIT-100M&#xA;  class CM-LIMIT-100M&#xA;    police 100000000 18750000 31250000 conform-action transmit exceed-action drop violate-action drop&#xA;!&#xA;int vlan 123&#xA;service-policy input PM-LIMIT-100M&#xA;service-policy output PM-LIMIT-100M&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to think there is no potential issues that will occur if I enable this, but you never know so I'm all ears!&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="176" LastEditDate="2013-05-24T17:30:57.700" LastActivityDate="2013-11-18T11:24:30.897" Title="Enabling MLS QoS on a production 7600" Tags="|cisco|qos|policing|cisco-7600|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="957" PostTypeId="2" ParentId="956" CreationDate="2013-05-24T10:48:10.510" Score="13" Body="&lt;p&gt;You definitely should enable MLS QoS. It is also prerequisite for CoPP, which you should add in your TODO list to implement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enabling 'mls qos' without other config is extremely bad idea in low-end cats, like 3560/3750, due to unexpected default scheduling and due to heavily reduced buffers causing more microbursting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On 7600/6500 it's comparatively safe to enable, but of course you can crash your router with 'show run'. I would feel comfortable enough to enable it during production hours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should monitor 'show queueing interface X' after enabling to see that you're not dropping anything. Long term, you should design QoS policy and implement it, I recommend using as few queues as possible (and assign 100% of buffer to those few queues).&#xA;Example of possible QoS policy in WS-X6704-10GE:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface TenGigabitEthernet4/1&#xA; wrr-queue bandwidth percent 30 40 30 0 0 0 0  ## allocate 3 queues (+implied strictpriority) share buffer 30% 40% 30% on thos three queues&#xA; wrr-queue cos-map 1 1 0 7 # map cos values to queues&#xA; wrr-queue cos-map 2 2 3 &#xA; wrr-queue cos-map 3 1 4 &#xA; wrr-queue cos-map 3 2 6 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For advanced config, you may want to supplement that with 'wrr-queue random-detect' with RED curve per queue+threshold.&#xA;Be sure to mark your traffic correctly when it enters your network.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-24T10:48:10.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="958" PostTypeId="2" ParentId="956" CreationDate="2013-05-24T10:56:23.987" Score="8" Body="&lt;p&gt;7600 QoS is not straightforward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you enable mls qos on its own you will change the way buffers are allocated on all ports, you may find this gives you unexpected results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Different line cards will have different queueing capabilities, research the following commands to modify the buffer and queueing config. Some line cards are per port and some are grouped around the asic&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; wrr-queue bandwidth &#xA; wrr-queue queue-limit&#xA; wrr-queue cos-map&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also note that if you have DFC enabled cards any policers will apply per ingress DFC so you may not get the results you want.&lt;/p&gt;&#xA;" OwnerUserId="596" LastActivityDate="2013-05-24T10:56:23.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="959" PostTypeId="1" AcceptedAnswerId="976" CreationDate="2013-05-24T11:21:29.330" Score="7" ViewCount="4779" Body="&lt;p&gt;Assuming a Cisco 3825 router, if the Cisco SCCP phones on the network are using G.711 µ-law and are traversing a CUCME system connected to a SIP trunk that supports G.711 µ-law, is a PVDM2 DSP card required since the codecs are the same? Does having a Unity Express module installed on the system require a DSP card?&lt;/p&gt;&#xA;" OwnerUserId="572" LastActivityDate="2017-03-04T18:43:04.110" Title="Is a DSP required with a SIP trunk?" Tags="|cisco|voice|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="960" PostTypeId="2" ParentId="868" CreationDate="2013-05-24T11:23:49.277" Score="-2" Body="&lt;p&gt;Use google to check/translate the following blog post (in portuguese, from the author of the book Cisco Firewalls):&#xA;&lt;a href=&quot;http://alexandremspmoraes.wordpress.com/2012/07/03/multiplas-camadas-de-defesa-a-complementaridade-do-firewall-e-do-ips&quot; rel=&quot;nofollow&quot;&gt;http://alexandremspmoraes.wordpress.com/2012/07/03/multiplas-camadas-de-defesa-a-complementaridade-do-firewall-e-do-ips&lt;/a&gt;&#xA;For me this is the best explanation I've seen on where to place IDS and IPS (and their complementarity).&lt;/p&gt;&#xA;" OwnerUserId="962" LastActivityDate="2013-05-24T11:23:49.277" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="961" PostTypeId="2" ParentId="931" CreationDate="2013-05-24T11:40:10.570" Score="1" Body="&lt;p&gt;Along with all my colleagues already told, I would recommend you to have a look at *show interfaces * then check input and output rate.&#xA;Also you could reset counters using &lt;em&gt;clear counters GigabitEthernet ..&lt;/em&gt; then have a look what interface is used.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-05-24T11:40:10.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="963" PostTypeId="2" ParentId="780" CreationDate="2013-05-24T12:20:47.347" Score="0" Body="&lt;p&gt;I would add from my experience that some ISP treat ICMP packet with lowest priority. It happened once, everytime I start youtube to even have &quot;requests timed out&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Post &lt;strong&gt;winmtr&lt;/strong&gt; before starting the video, and while video is playing. &#xA;Start a 2nd streaming, and let's see how will this impact both ICMP packets and 1st video.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-05-24T12:20:47.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="964" PostTypeId="2" ParentId="653" CreationDate="2013-05-24T12:38:57.617" Score="5" Body="&lt;p&gt;If you need to do this regularly, nothing beats Perl and Net::Telnet::Cisco.  You can log into X number of routers, grab all of the information on the interfaces you want, parse the output, and print it to a file or e-mail it with Net::SMTP or print it to standard output.  I can provide examples if you want, but it's pretty straightforward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, if you are dead set on doing this within IOS, the following TCL script will give you the output you want in a nice, clean format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set show_counters [exec show interfaces counters | i 0 +0 +0 +0]&#xA;set line [split $show_counters &quot;\n&quot;]&#xA;foreach record $line {&#xA;    set fields [join $record &quot; &quot;]&#xA;    foreach field $fields {&#xA;        if { $field != 0 } {&#xA;            puts $field&#xA;        }&#xA;    }&#xA;}&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I offer this because TCL and how to do this is a little less accessible [IMHO] than Perl&lt;/p&gt;&#xA;" OwnerUserId="966" LastActivityDate="2013-05-24T12:38:57.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="965" PostTypeId="1" AcceptedAnswerId="968" CreationDate="2013-05-24T13:29:11.587" Score="8" ViewCount="2340" Body="&lt;p&gt;A VLAN I need to use is allocated for internal usage (as per &lt;code&gt;vlan internal allocation policy ascending&lt;/code&gt;). I can't (easily) move the traffic over to another VLAN for various practical reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was therefore wondering if there's a trivial way to re-allocate the internally reserved VLAN, without rebooting a PE node?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;router(config)#int Te1/2.1070&#xA;router(config-subif)#encapsulation dot1q 1070&#xA;Command rejected: VLAN 1070 not available&#xA;(..)&#xA;router#show vlan internal usage | i ^1070&#xA;1070 vrf_50_vlan&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(This is on a 7604 with &lt;code&gt;ADVIPSERVICESK9-M v 12.2(33)SRE2&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="399" LastEditorUserId="441" LastEditDate="2013-05-24T16:10:21.697" LastActivityDate="2013-05-24T16:10:21.697" Title="Moving internally allocated VLANs" Tags="|cisco-ios-12|cisco-7600|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="966" PostTypeId="1" CreationDate="2013-05-24T13:42:23.443" Score="5" ViewCount="418" Body="&lt;p&gt;I have heard that all 10G switches must be grounded. We have two Cisco Nexus 5000 running for years without any grounding, but I am worried about possible outages caused by ESD. Nexus 5000 has system ground connector (&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/hw/installation/guide/install5500.html#wp1257696&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/hw/installation/guide/install5500.html#wp1257696&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is your experience with it? Is it really something I should worry about or is it something which is good to have, but can live without it?&lt;/p&gt;&#xA;" OwnerUserId="971" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:30.693" LastActivityDate="2013-05-27T18:45:30.693" Title="Cisco Nexus 5000 grounding" Tags="|cisco|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="967" PostTypeId="2" ParentId="965" CreationDate="2013-05-24T13:44:27.340" Score="1" Body="&lt;p&gt;Only way I know of is to &quot;shutdown&quot; the port using the VLANID, create your vlan and then &quot;no shutdown&quot; the port. What is &quot;vrf_50_vlan&quot; assigned to?&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorDisplayName="user661" LastEditDate="2013-05-24T13:51:15.513" LastActivityDate="2013-05-24T13:51:15.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="968" PostTypeId="2" ParentId="965" CreationDate="2013-05-24T13:47:39.770" Score="13" Body="&lt;p&gt;You can remove the VRF temporarily:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;sh ip vrf detail | i Id&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Only reason this VLAN is even created is because either your VPN-CAM is turned off or you have more than 512 VRFs. If you don't have 512 VRFs, you can free up this internal VLAN without removing VRF by making sure VPN-CAM is activated. This may not be the simplest task as there are various reasons which mean VPN-CAM is disabled, most common reasons are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You use 'class-default' in QoS, match 'any any' ACL instead&lt;/li&gt;&#xA;&lt;li&gt;You use egress ACL in VRF, remove them&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once there are no reason to disable VPN-CAM, it gets renabled, and those VRF VLANs will disappear. This will also double your VRF performance, as you won't need to recirculate the packet in the PFC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without VPN-CAM your first PFC lookup will resolve VRF, second will resolve egress rewrite. With VPN-CAM before packet even hits PFC, VPN-CAM has already told you which table to look against, so PFC will directly return egress rewrite on single lookup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To confirm if VPN-CAM is used or not, you can issue this command:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;remote command switch sh mls vpn-cam 0 511&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Long term, maybe change the allocation order, to order from 4k downwards, instead of 1k upwards.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-24T13:47:39.770" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="969" PostTypeId="2" ParentId="956" CreationDate="2013-05-24T13:50:45.140" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;7600 QoS is not straightforward.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is an understatement...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@ytti and @Steve have great answers, just also be very aware that the 7600 has &lt;code&gt;rcv-queue&lt;/code&gt; interface commands as well.  Like the &lt;code&gt;wrr-queue&lt;/code&gt;, you will want to make sure that your mutations are correct or you can see drops.  Been burned by that one, just make sure you generate enough test traffic to validate that everything is working properly since issues with QoS and hardware queues don't really appear until there is load.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-24T13:50:45.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="970" PostTypeId="2" ParentId="966" CreationDate="2013-05-24T13:58:50.777" Score="6" Body="&lt;p&gt;If you ask any responsible electrician all devices must be grounded so that if there is short-circuit they don't become dangerous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice I very very rarely see devices grounded, only incumbents with long history of spending lot of money and manpower have the professionalism to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For legal reasons, I cannot recommend not grounding them, but I would expect exactly 0 problems, and you certainly wouldn't be alone running your boxes without ground.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are running AC PSU and you have Schuko plugs the system probably is already grounded.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-05-24T14:04:51.130" LastActivityDate="2013-05-24T14:04:51.130" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="972" PostTypeId="1" AcceptedAnswerId="973" CreationDate="2013-05-24T14:45:19.820" Score="19" ViewCount="18549" Body="&lt;p&gt;I understand the basics of how spanning tree works and why you would want to use portfast on user access ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When dealing with a topology with a large number of dumb switches under desks and other undocumented locations do you really want to enable this on all &quot;supposedly&quot; access switches? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from trying to track down these unmanaged switches what is best practice? Why? &lt;/p&gt;&#xA;" OwnerUserId="657" LastEditorUserId="775" LastEditDate="2013-06-30T10:40:51.420" LastActivityDate="2013-06-30T10:40:51.420" Title="Should portfast be used on a port potentially connecting to an unmanaged switch?" Tags="|cisco|switch|spanning-tree|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="973" PostTypeId="2" ParentId="972" CreationDate="2013-05-24T14:51:14.997" Score="16" Body="&lt;p&gt;You should run 'port-fast' (in standard terms edge port) in every port not part of your switch core. Even if it is switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should NOT have L2 loop through customer switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should run BPDUGuard and BUM policers all interfaces, customer facing interfaces should be 1/5th or less of core facing limits. Unfortunately limiting unknown unicast often is not supported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why running 'port-fast' or edge is crucial is performance of RSTP (and by extension MST) rely on it. How RSTP works is it asks downstream if it can go to forwarding mode, and downstream asks its downstreams until there are no more ports to ask frmo, then the permission propagates back up.&#xA;Port-fast or edge port is implicit permission from RSTP point-of-view, if you remove this implicit permission, explicit permission must be gotten otherwise it'll fall back to classic STP timers. Which means even one non-portfast port will kill your subsecond RSTP converge.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-24T14:51:14.997" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="974" PostTypeId="2" ParentId="972" CreationDate="2013-05-24T14:55:30.103" Score="0" Body="&lt;p&gt;I know most people say don't do it -- hard rule, for hard people. :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they're dumb switches (eg. don't run any STP), then it doesn't make much difference.  Speaking from Cisco experience, it'll catch the loop almost immediately in any event.  In the world of VMs, even an &quot;edge port&quot; can be a loop. (Our developers have learned that the hard way.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-24T14:55:30.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="975" PostTypeId="2" ParentId="966" CreationDate="2013-05-24T15:03:09.107" Score="6" Body="&lt;p&gt;I pretty much agree with ytti about this, but in some more detail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, none of this makes an iota of difference if the kit is operating on voice, a single DS0 or terabits, you ground for other reasons. If you have such a high EMI that grounding might help with errors the actual problem is with whatever is spewing the crap, and likely as not wiring the device to a giant antenna of a ground wire (never loop) will only make things worse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a DC powered device you &lt;em&gt;REALLY SHOULD&lt;/em&gt; ground separately. There are valid safety reasons for this and the cost of doing to handle the safety level is trivial (wire to the rack, rack to a building ground wire which should already exist). DC systems are almost never &quot;grounded&quot; on one or other of the supply lines, and most DC hardware does not connect the case to ground so this is critical. The screws and friction holding the device to a rack is not acceptable, you need a separate wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, for AC devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those that are optionally DC, or dual supply may or may not have the case grounded to AC ground, so should be grounded for the same safety reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that (personnel) safety is out of the picture the answer shifts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the device directly takes a copper / coax from outside the room I'd strongly suggest grounding to help prevent any surge / lightning damage continuing down a path (also an argument for demark racks containing isolation &amp;amp; protection devices).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if none of those apply you certainly don't need to ground and will be unlikely to get a benefit from doing so; although you may reduce occurrences of some oddball problems, I usually see a few cases a year where bad grounding may well have contributed to a problem, usually these are cases that take weeks to diagnose and repair, and even if the hardware is replaced under support the time lost may make it worthwhile to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the above, plus having a safer &quot;standard practice&quot; is largely why most telco's will have pretty stringent grounding policies (at least at their own facilities).&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-24T15:03:09.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="976" PostTypeId="2" ParentId="959" CreationDate="2013-05-24T15:05:19.683" Score="7" Body="&lt;p&gt;You should be good without DSPs.  The major use of DSPs on a router is when you have to convert from a TDM trunk (FXO or T1/PRI) to an IP resource.  Since SIP is all IP-based, you shouldn't have to do any conversion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do be aware that any conference calling features will consume DSPs unless you have a hardware conference bridge.&lt;/p&gt;&#xA;" OwnerUserId="71" LastActivityDate="2013-05-24T15:05:19.683" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="977" PostTypeId="2" ParentId="972" CreationDate="2013-05-24T15:45:24.000" Score="13" Body="&lt;p&gt;In addition to &lt;code&gt;spanning-tree portfast&lt;/code&gt;, you should also use &lt;code&gt;spanning-tree bpduguard enable&lt;/code&gt; so that if someone creates a loop by plugging in things where they should not then the switch port will go into error disabled mode when it sees a BPDU rather than creating a loop and potentially bringing down the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As well, if your goal is to track down the unmanaged switches you should enable &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switchport port-security maximum 1  ! or whatever number is appropriate&#xA; switchport port-security violation shutdown&#xA; switchport port-security&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will put any port into error disable that sees more than 1 mac address connected.  Either via traps or waiting until they call for help will allow you to identify where those unmanaged devices are connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/port_sec.pdf&quot;&gt;More info on port security&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-24T15:45:24.000" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="978" PostTypeId="1" AcceptedAnswerId="994" CreationDate="2013-05-24T16:01:17.367" Score="9" ViewCount="3012" Body="&lt;p&gt;I have seen both of the following methods of switch interface configuration for supporting IP Phones.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switchport access vlan &amp;lt;data-vlan&amp;gt;&#xA; switchport voice vlan &amp;lt;voice-vlan&amp;gt;&#xA; switchport mode access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switchport trunk native vlan &amp;lt;data-vlan&amp;gt;&#xA; switchport trunk allowed vlan &amp;lt;data-vlan&amp;gt;,&amp;lt;voice-vlan&amp;gt;&#xA; switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone provide a good pro or con of standardizing on either method or does it just come down to a matter of personal preference which one you should choose to implement?&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-25T01:14:10.253" Title="Switch interface config for IP Phones" Tags="|cisco-catalyst|voice|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="979" PostTypeId="2" ParentId="978" CreationDate="2013-05-24T16:10:44.290" Score="5" Body="&lt;p&gt;I prefer the latter, as it allows easy addition of new VLAN and does not introduce new concepts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the former is needed, if you want to use CDP to communicate the voice VLAN to the phone.&#xA;Otherwise normal behavior is that phone will first boot in data VLAN, then get instruction from DHCP to change VLAN, and then it'll boot again in voice VLAN.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-24T16:10:44.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="981" PostTypeId="2" ParentId="953" CreationDate="2013-05-24T17:13:17.950" Score="3" Body="&lt;p&gt;This really depends on the network, but I would lean towards the L2 VLAN.  While some have expressed concerns about a loop on the VLAN, but in 12 years on big networks, I haven't EVER seen a loop created on a network management VLAN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not to say it couldn't happen, but generally people who know enough to set up a management VLAN generally know enough not to be causing loops on the network.  Most loops I have come across are on user VLANs where an end user connected/configured something incorrectly or when a server admin misconfigures link aggregation/redundancy on their server or misconfigures a VM environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moving to a L3 approach does avoid that particular problem, but it is also easy to screw up a routed network as well.  Yes, you can take precautions, but I stick with KISS when I can and routing is more complex than switching.  Shall we start listing the major incidents that have occurred due to routing problems being introduced to the internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, as John Jensen has pointed out, you should definitely have an OOB management system as well, however I would generally refer to this as a backup to in-band management.  Generally speaking I don't recommend changing speed settings on a console port (when it comes to recovery situations, having to figure out if a console port is default, changed or changed incorrectly can be a pain), and even at 115k baud, console ports can be too slow (and many vendors default to 9600 baud).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-24T17:13:17.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="982" PostTypeId="2" ParentId="921" CreationDate="2013-05-24T17:49:00.950" Score="1" Body="&lt;p&gt;Sticking to the options you provide, I personally would follow #1 on your list, but I would not use common ST.  I would rather use RST (or MST if you need to load balance VLANs across links) as it allows for must fast/smoother transition when a link comes up or goes down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This addresses both the concerns you have for this approach:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&quot;Interface doesn't go down physically&quot; - each device running RST&#xA;generates BPDUs (rather than just relaying) and they are used as&#xA;keep alives.  Failure to receive BPDUs will result in aging out the&#xA;information.&lt;/li&gt;&#xA;&lt;li&gt;&quot;Need to go through STP learning stages before&#xA;forwarding traffic&quot; - RST is able to actively confirm that a port&#xA;can safely transition to forwarding state without waiting for&#xA;timers.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would also consider doing #2 in addition as this just simplifies the management of the devices.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-24T17:49:00.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="983" PostTypeId="2" ParentId="972" CreationDate="2013-05-24T18:12:33.230" Score="4" Body="&lt;p&gt;Applying port specific commands in your configuration will reduce port initialization time in the event that the switch or the connected device power cycle, reboot or reload. They may also prevent misapplied configuration settings in the event the port does not properly negotiate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the default for Cisco switches is switchport mode dynamic desirable (Cisco Stackwise capable switches are the exception) every port attempts to negotiate its intended purpose. This negotiation process has four major phases and may take a full minute to complete.&#xA; - Spanning Tree Protocol (STP) initialization – the port goes through&#xA;   the five phases of STP: blocking, listening, learning, forwarding,&#xA;   and disabled.&#xA; - Testing for Ether Channel configuration – port uses the Port&#xA;   Aggregation Protocol (PAgP), bonding together of switch ports to&#xA;   create larger aggregate Ethernet connections. &#xA; - Testing for trunk configuration – ports uses Dynamic Trunk Protocol&#xA;   (DTP) to   negotiate/validate a trunk link.&#xA; - Switch port speed and duplex – port uses Fast Link Pulses (FLP) to&#xA;   set speed and duplex. Failure to negotiate duplex Cisco switches use&#xA;   a default duplex setting of half duplex (HDX) (for 10-Mbps and&#xA;   100-Mbps interfaces) or full duplex (FDX) (for 1000-Mbps interfaces).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring &lt;em&gt;switchport mode access&lt;/em&gt; will prevent the port from going through trunk negotiation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring &lt;em&gt;spanning-tree portfast&lt;/em&gt; will prevent the port from going through STP negotiation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring &lt;em&gt;switchport host&lt;/em&gt; will configure both access and portfast..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course the caveat from Cisco - Caution:  Never use the PortFast feature on switch ports that connect to other switches, hubs, or routers. These connections can cause physical loops, and spanning tree must go through the full initialization procedure in these situations. A spanning tree loop can bring your network down. If you turn on PortFast for a port that is part of a physical loop, there can be a window of time when packets are continuously forwarded (and can even multiply) in such a way that the network cannot recover. &lt;/p&gt;&#xA;" OwnerUserId="975" LastActivityDate="2013-05-24T18:12:33.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="986" PostTypeId="2" ParentId="978" CreationDate="2013-05-24T19:23:06.570" Score="1" Body="&lt;p&gt;I prefer the first method when using Cisco phones on Cisco switches.  This naturally allows the use of CDP for QoS (auto-qos).&lt;/p&gt;&#xA;" OwnerUserId="309" LastActivityDate="2013-05-24T19:23:06.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="987" PostTypeId="2" ParentId="978" CreationDate="2013-05-24T19:45:19.693" Score="4" Body="&lt;p&gt;The first is the Cisco Way&amp;trade; -- only works with cisco switches and cisco phones, and &lt;em&gt;requires&lt;/em&gt; CDP (as that's how the phone gets the voice-vlan information.)  The second will work with any VoIP phone configured to process (and strip) the VLAN -- &lt;em&gt;how&lt;/em&gt; it gets configured depends on the phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[They're functionally identical at the ethernet level.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-24T19:45:19.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="988" PostTypeId="2" ParentId="956" CreationDate="2013-05-24T20:45:25.833" Score="2" Body="&lt;p&gt;One thing to be aware of is that due to the way that the 6500/7600 switches in a distributed fashion if you have more than one port int the Vlan you are wanting to limit spread across different line cards you will have a hard time limiting them to 100mbit as the limit will be applied on each line card.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-24T20:45:25.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="989" PostTypeId="2" ParentId="927" CreationDate="2013-05-24T21:05:07.743" Score="2" Body="&lt;p&gt;Understanding what you're trying to accomplish is critical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For data network purposes (traditional L2/L3 switching/routing), 10G is typically the fastest current deployments are at without LAGs (port bonding/channeling for some vendors).  There are some 40G deployments and possibly some 100G deployments out there, but these are expected to run over copper as well as fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what we begin to discuss is distance.  Fibre can send light farther than copper can send electricity (without regeneration).  This means you can send the same speeds the same distances (ultimately) but will need regeneration to do so with copper mediums.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we need to examine latency.  Latency differences over distances that do not require regeneration for electrical mediums (copper) will be negligible at best if you can even see a difference.  Nodes that regenerate electrical signals will increase latency.  Therefore, over long distances, copper has higher latency than fiber.  The speed at which a signal is sent over a medium is independent of the bandwidth utilized.  Put another way, the speed of light is a constant and does not change because you increase the bandwidth being sent over the fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what is &quot;faster&quot;?  Is it bandwidth or is it latency or is it both?  If it is strictly bandwidth (the amount of bits which can be transmitted and/or received within a given interval), then for L2/L3 switching/routing fiber and copper are nearly identical or will soon be identical.  If it is latency or bandwidth + latency, then fiber is &quot;faster&quot; but only once your distance exceeds the distance limitations of a single run of copper (which then requires regeneration which adds latency).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can also add another factor to this: is &quot;faster&quot; any or both of the afore-mentioned (typical) measurements plus the ability to multiplex multiple bandwidth channels over a single physical medium?  If this is the case, then fiber is the clear winner.  It can multiplex 160x10Gbps signals over a single fiber.  This means a single fiber can operate at 1.6Tbps.  These must be MUX'd and DMUX'd, so this is only applicable in backhaul transport of the data and not in end-user/device implementations.&lt;/p&gt;&#xA;" OwnerUserId="966" LastActivityDate="2013-05-24T21:05:07.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="990" PostTypeId="2" ParentId="972" CreationDate="2013-05-24T23:57:51.417" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;When dealing with a topology with a large number of dumb switches under desks and other undocumented locations do you really want to enable this [portfast] on all &quot;supposedly&quot; access switches?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The official and pedantic answer is &quot;no, do not enable portfast on switch to switch link&quot;... There is a &lt;a href=&quot;https://supportforums.cisco.com/thread/2096860&quot;&gt;relevant discussion about this on Cisco's support forum&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The author of that thread makes a fair point though, the network police will not arrest you for enabling portfast facing a downstream switch... It is &lt;em&gt;possible&lt;/em&gt; to hack around the risks of temporary broadcast storms that you take when you enable portfast on a link to another switch.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;WORKAROUNDS&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you enable portfast on a link to a smart or dumb switch, be sure to enable &lt;em&gt;bpduguard&lt;/em&gt; (control-plane protection), and &lt;em&gt;broadcast storm-control&lt;/em&gt; (data plane protection) on that port...  these two features give you some leverage in case unexpected things happen: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;someone filters the BPDUs that would normally cause bpduguard to disable the port, resulting in a broadcast storm.  Storm-control limits the damage from a broadcast storm&lt;/li&gt;&#xA;&lt;li&gt;bpduguard has obvious advantages mentioned in the other answers.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-05-24T23:57:51.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="991" PostTypeId="1" AcceptedAnswerId="997" CreationDate="2013-05-25T00:13:28.277" Score="9" ViewCount="329" Body="&lt;p&gt;A third party provider supplies connectivity my remote satellite campus over metro ethernet. Due to red tape the provider is required to supply a routed point-to-point connection (R2 and R3) to the satellite campus; ideally the provider would bridge my private WAN to the satellite campus (R1 and R4) but this is not an option for the aforementioned reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to incorporate the satellite campus into my AS with little or no assistance from the provider. Currently when I create a new network that must be routed through the provider, I must call and ask the provider to install the new route, which they then distribute between R2 and R3 using EIGRP. This process is often difficult and prone to human error. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do no trust the provider to be an ABR since I cannot filter the incoming routes. I have considered using an IPIP tunnel between R1 and R4, but I am unsure how the policing performed by the provider will affect the traffic. This would enable me to run OSPF in the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My primary limitation is the provider and the added fact that OSPF is the only dynamic protocol I have available on the existing hardware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/t7wwL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="985" LastEditorUserId="49" LastEditDate="2013-05-25T09:14:53.097" LastActivityDate="2013-05-25T09:14:53.097" Title="Remote Campus Routing Design" Tags="|ospf|routing|design|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="992" PostTypeId="2" ParentId="921" CreationDate="2013-05-25T00:56:59.053" Score="0" Body="&lt;p&gt;Perhaps an event script could be made on the &quot;failing&quot; MX to take the link down?&#xA;If there is some kind of lit transport, then that may not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most applications I've worked on like this, we've had bi-directional traffic, such that the remove MACs that should move eventually come in via the backup port, and the old FIB entry is evicted, and the new port installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your L2 site served by those EXes only ever sends traffic, then the only thing I could think to do would be to decrease the mac-table-aging-time to an acceptable amount.&lt;/p&gt;&#xA;" OwnerUserId="131" LastActivityDate="2013-05-25T00:56:59.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="994" PostTypeId="2" ParentId="978" CreationDate="2013-05-25T01:14:10.253" Score="2" Body="&lt;p&gt;The first method also works for Avaya phones - only they must have the proper DHCP option strings on the data vlan to know which voice vlan it should try and tag its traffic to afterwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I usually add #sw host&#xA;(which adds spanning-tree portfast and sw mode access automatically when configuring ports)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Portfast allows the port to go directly into forwarding state when the interface is up - otherwise you're going to be waiting 45 seconds per port!&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-05-25T01:14:10.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="995" PostTypeId="2" ParentId="876" CreationDate="2013-05-25T01:56:03.970" Score="6" Body="&lt;p&gt;802.11i was an amendment to the 1999 802.11 standard, rather than a separate standard. &lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.11-2007.pdf&quot;&gt;802.11-2007&lt;/a&gt; was created to roll up that and 7 other amendments (a, b, d, e, g, h, i, j).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Here's the &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.11i-2004&quot;&gt;wikipedia page&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-05-25T01:56:03.970" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="996" PostTypeId="2" ParentId="921" CreationDate="2013-05-25T04:12:56.947" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;Disable Portfast on the PE facing ports (On CE)&lt;/li&gt;&#xA;&lt;li&gt;Enable RSTP across the CE network&lt;/li&gt;&#xA;&lt;li&gt;Favor &quot;Blue link&quot; w/ interface cost&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Working this out in my head I believe it should react as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When blue link dies the CE will stop sending/receiving BPDUs from the blue interface. Default RSTP hello timer is 2 seconds. It waits for three missed hellos before calling that link &quot;dead&quot;. Once three hellos (6 seconds) have been missed it will then re-establish the STP tree and age the MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is basically option 1 you've stated above except the way I've read the comments and your original post it sounds like you want the PE to participate in STP. I'm suggesting allowing the customer to build its own tree between all CEs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your network should fail over smoothly, and the client network would follow suit a few seconds later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This feels too simple to be the answer...but that's what I can see based on your write up.&lt;/p&gt;&#xA;" OwnerUserId="287" LastEditorUserId="287" LastEditDate="2013-05-25T04:29:23.913" LastActivityDate="2013-05-25T04:29:23.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="997" PostTypeId="2" ParentId="991" CreationDate="2013-05-25T04:27:49.653" Score="8" Body="&lt;p&gt;A tunnel is your only way out here, unfortunately. Without using a tunnel a packet would enter the service providers network and if that destination isn't already known it will get thrown down the black hole.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would hope and assume that the provider isn't doing any special policing on tunneled traffic, but you'll have to test that out for yourself. If you're worried about moving DSCP values between the original packet and the tunnel packet that is easy enough to accomplish. So voice traffic can still pass through the SP network with EF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In all honestly some sort of common peering here would be the best. Even if you peer with RIP, redistribution is easy enough and would accomplish your goals. I'm not sure why you can't apply filtering to incoming routes except perhaps company policy?&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-25T04:27:49.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="998" PostTypeId="1" CreationDate="2013-05-25T10:52:49.307" Score="6" ViewCount="3402" Body="&lt;p&gt;I need to forward an UDP port range to a specific private IP address in my LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to forward one port to an internal IP I do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list &amp;lt;acc_list_number&amp;gt; permit &amp;lt;port_type&amp;gt; any any eq &amp;lt;port_number&amp;gt;&#xA;ip nat inside source static &amp;lt;port_type&amp;gt; &amp;lt;internal_IP&amp;gt; &amp;lt;port_number&amp;gt; interface &amp;lt;outside_interface&amp;gt; &amp;lt;port_number&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I run into problems when I need to forward a range of ports, such as UDP 40000-42000 to a single internal IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat pool voice 192.168.0.50 192.168.0.50 netmask 255.255.255.0 type rotary&#xA;access-list 102 permit udp any any range 40000 42000&#xA;ip nat inside destination list 102 pool voice&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it seems to only work with TCP ports and not UDP ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the best way to forward an UDP port range?&lt;/p&gt;&#xA;" OwnerUserId="219" LastEditorUserId="623" LastEditDate="2013-05-30T11:40:33.043" LastActivityDate="2013-07-05T22:11:59.380" Title="Cisco 867 forward UDP port range" Tags="|cisco|cisco-commands|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="999" PostTypeId="2" ParentId="998" CreationDate="2013-05-25T11:10:32.487" Score="3" Body="&lt;p&gt;Try&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static &amp;lt;internal_IP&amp;gt; &amp;lt;external_IP&amp;gt; route-map MOO&#xA;!&#xA;route-map MOO permit 100&#xA;  match ip address 102&#xA;route-map MOO deny 200&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I feel your own example probably should work, at least I couldn't immediately think of why not, so might be bug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Review &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/ipaddr_nat/configuration/12-4t/iadnat-addr-consv.html#GUID-560A9963-F9EC-4545-9678-BFD0215B3C07&quot; rel=&quot;nofollow&quot;&gt;CCO Document&lt;/a&gt; for the command, namely:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Only IP hosts that are part of the route-map configuration will allow&#xA;  outside sessions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-05-25T11:15:38.690" LastActivityDate="2013-05-25T11:15:38.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1000" PostTypeId="1" CreationDate="2013-05-25T14:16:27.737" Score="-2" ViewCount="2212" Body="&lt;p&gt;For some reason I am seeing OSPF routes being removed from its routing table every 3-4 hours, yet they are still in the database. When this happens, there is still a neighbor relationship between the 2 routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the possible reason for this and how can it be fixed/prevented?  If you need some output from anything, let me know.&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="441" LastEditDate="2013-05-25T16:25:34.350" LastActivityDate="2013-12-23T04:56:50.663" Title="Routes disappearing from OSPF routing table" Tags="|ospf|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1001" PostTypeId="2" ParentId="1000" CreationDate="2013-05-25T14:24:27.050" Score="6" Body="&lt;p&gt;For cisco routers, there's a KB article about it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365technologies_tech_note09186a008009481a.shtml&quot;&gt;http://www.cisco.com/en/US/tech/tk365technologies_tech_note09186a008009481a.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the article:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A common problem when using Open Shortest Path First (OSPF) is routes in the &#xA;  database don't appear in the routing table. In most cases OSPF finds a &#xA;  discrepancy in the database so it doesn't install the route in the routing&#xA;  table. Often, you can see the Adv Router is not-reachable message (which means&#xA;  that the router advertising the LSA is not reachable through OSPF) on top of&#xA;  the link-state advertisement (LSA) in the database when this problem occurs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I guess that the issue has to do with the advertising router becoming unreachable periodically, but the question has too little info to make a guess about the root cause...&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorDisplayName="user661" LastEditDate="2013-05-25T14:39:27.333" LastActivityDate="2013-05-25T14:39:27.333" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1002" PostTypeId="2" ParentId="195" CreationDate="2013-05-25T14:40:06.517" Score="1" Body="&lt;p&gt;I actually was stuck with a similar request last week (of course the remote site was on the other side of the country).  What I ended up doing was using &lt;a href=&quot;http://cs.itd.nrl.navy.mil/work/mgen/index.php&quot; rel=&quot;nofollow&quot;&gt;mgen&lt;/a&gt; to send unidirectional udp and just verifying the counters on the remote side device.  If you aren't comfortable with &lt;a href=&quot;http://cs.itd.nrl.navy.mil/work/mgen/index.php&quot; rel=&quot;nofollow&quot;&gt;mgen&lt;/a&gt;, you could do the same with &lt;a href=&quot;http://nmap.org/nping/&quot; rel=&quot;nofollow&quot;&gt;nping&lt;/a&gt; or one of the &lt;a href=&quot;http://nmap.org/&quot; rel=&quot;nofollow&quot;&gt;nmap&lt;/a&gt; tools.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you pointed out, the issue with &lt;a href=&quot;http://iperf.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;iperf&lt;/a&gt;, &lt;a href=&quot;http://www.ixchariot.com/products/datasheets/ixchariot.html&quot; rel=&quot;nofollow&quot;&gt;IxChariot&lt;/a&gt;, and so many other tools is that they require a remote responder.  &lt;a href=&quot;http://cs.itd.nrl.navy.mil/work/mgen/index.php&quot; rel=&quot;nofollow&quot;&gt;mgen&lt;/a&gt;, &lt;a href=&quot;http://nmap.org/nping/&quot; rel=&quot;nofollow&quot;&gt;nping&lt;/a&gt;, and a few others do not.&lt;/p&gt;&#xA;" OwnerUserId="994" LastEditorUserId="266" LastEditDate="2013-05-25T16:25:45.773" LastActivityDate="2013-05-25T16:25:45.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1003" PostTypeId="2" ParentId="876" CreationDate="2013-05-25T14:51:19.113" Score="3" Body="&lt;p&gt;As John already answered, 802.11i no longer exists as it has been superseded by a more recent standard, namely the &lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.11-2007.pdf&quot; rel=&quot;nofollow&quot;&gt;802.11-2007 standard&lt;/a&gt;.  For the 802.11 working group, you can always find the status of standards &lt;a href=&quot;http://www.ieee802.org/11/Reports/802.11_Timelines.htm&quot; rel=&quot;nofollow&quot;&gt;by looking here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really need to review the document and parts of 802.11i may be in several places.  From a very brief look at the table of contents, you may want to start with sections 5.4, 5.8 and 8.  You will need to key in on sections relating to PSK and CCMP specifically, as WPA2, Personal, and Enterprise are terminology coined by the Wifi Alliance, not the IEEE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even without reviewing the document, it is a fairly easy concept to understand the vulnerability.  Equate this to a file that is AES encrypted with a static password.  If someone were to get a copy of the file, all they needed to do to decrypt it would be to brute force decrypting the file until they found a password that produces meaningful output.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone captures the connection handshake on a PSK network, this is exactly the same process.  This may not be quick and take &lt;em&gt;lots&lt;/em&gt; of processing resources, it can be done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to what resources are necessary to perform such an attack, you may want to look into the BackTrack distribution.  This is a distribution targeted at security/penetration testing and there are several books and many documents describing how to use the tools within for all kinds of security applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I should have mentioned, while 802.11-2007 rolled up802.11i, the current standard is &lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.11-2012.pdf&quot; rel=&quot;nofollow&quot;&gt;802.11-2012&lt;/a&gt; and this is a roll up of 802.11-2007 and and the amendments between.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-25T16:16:11.357" LastActivityDate="2013-05-25T16:16:11.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1004" PostTypeId="1" AcceptedAnswerId="1005" CreationDate="2013-05-25T15:26:01.463" Score="10" ViewCount="2766" Body="&lt;p&gt;I know we can use auto-completion (tab key) and abbreviated commands (such as &lt;code&gt;sh ip int bri&lt;/code&gt;) to speed up typing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'm still not satisfied with typing crypting chains such as &lt;code&gt;sh ip dh sn bi | i 20.12&lt;/code&gt; for &lt;code&gt;show ip dhcp snooping binding | include 20.12&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I define shortcuts for often used command sequences, and how?&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="623" LastEditDate="2013-05-30T11:39:42.633" LastActivityDate="2013-05-30T11:39:42.633" Title="How can I speed up CLI typing in Cisco IOS using shortcuts?" Tags="|cisco|cisco-ios|cisco-commands|cli|" AnswerCount="5" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1005" PostTypeId="2" ParentId="1004" CreationDate="2013-05-25T15:26:01.463" Score="17" Body="&lt;p&gt;We can use the &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_a1.html#wp1013037&quot;&gt;&lt;code&gt;alias&lt;/code&gt;&lt;/a&gt;  command in global conf mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alias &amp;lt;mode&amp;gt; &amp;lt;command-alias&amp;gt; &amp;lt;original-command&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;lt;mode&amp;gt;&lt;/code&gt; is one of the many &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/configfun/configuration/guide/fcf019.html&quot;&gt;IOS command modes&lt;/a&gt;. If you need it in different modes, you have to call it for each one - type &lt;code&gt;alias ?&lt;/code&gt; to get a long list of modes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example for checking for a dhcp snooped IP, type in global conf mode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alias exec snoop show ip dhcp snooping binding | include&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you can simply type &lt;code&gt;snoop 172.16.20.12&lt;/code&gt; to check for this IP or &lt;code&gt;snoop 801&lt;/code&gt; for checking all IPs in VLAN 801, for example. Do similarly for &lt;code&gt;show mac-address-table | include&lt;/code&gt; and you're faster in searching and troubleshooting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further tipps:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;document your aliases for you and for your collegues&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;sh aliases&lt;/code&gt; shows your aliases plus the predefined ones&lt;/li&gt;&#xA;&lt;li&gt;while &lt;code&gt;no alias &amp;lt;mode&amp;gt; &amp;lt;command&amp;gt;&lt;/code&gt; can be guessed for removing an alias, &lt;code&gt;no alias &amp;lt;mode&amp;gt;&lt;/code&gt; deletes the aliases for a complete mode - so you can clear several at once, &lt;code&gt;default alias &amp;lt;mode&amp;gt;&lt;/code&gt; works similarly, as expected&lt;/li&gt;&#xA;&lt;li&gt;if you decide to use aliases, deploy them once everywhere you may need them&lt;/li&gt;&#xA;&lt;li&gt;tools like Cisco Prime can help in deploying&lt;/li&gt;&#xA;&lt;li&gt;don't forget the original commands ;-)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="231" LastActivityDate="2013-05-25T15:26:01.463" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1006" PostTypeId="2" ParentId="1004" CreationDate="2013-05-25T15:40:29.697" Score="0" Body="&lt;p&gt;Depending on what you do a better option may be to write shell, expect, or other scripts to do your common tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For basic troubleshooting it's even nicer to have my alerting system already perform the info-gathering part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Combining tools like &lt;a href=&quot;http://code.google.com/p/notch/&quot; rel=&quot;nofollow&quot;&gt;notch&lt;/a&gt;, with related tools like its &quot;Mr CLI&quot; can let you create some really powerful tools very easily, giving you a hand today, and an easy route to further improve things tomorrow, if not by fully automating you might be able to shift the tasks onto a helpdesk who can be given a trivial web-app which does the basic steps and helps fix user problems faster.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-25T15:40:29.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1007" PostTypeId="2" ParentId="13" CreationDate="2013-05-25T18:04:25.350" Score="3" Body="&lt;p&gt;Windows only supports EAP-TLS and EAP-PEAP/MS-CHAPv2 natively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to add other EAP types, you would have to include a third party supplicant such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cisco Secure Services Client&lt;/li&gt;&#xA;&lt;li&gt;Juniper Odyssey Access Client&lt;/li&gt;&#xA;&lt;li&gt;Secure W2 Client&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are many more, some based on specific hardware, but they can support a wide number of different open and proprietary EAP types including EAP-TTLS, EAP-FAST, EAP-LEAP, etc.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-25T18:04:25.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1008" PostTypeId="5" CreationDate="2013-05-25T18:07:39.490" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-25T18:07:39.490" LastActivityDate="2013-05-25T18:07:39.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1009" PostTypeId="4" CreationDate="2013-05-25T18:07:39.490" Score="0" Body="For questions about wireless networking, specifically networks covered under the IEEE 802.11 standards.  Also commonly referred to as WLANs." OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-25T22:07:49.977" LastActivityDate="2013-05-25T22:07:49.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1010" PostTypeId="2" ParentId="1004" CreationDate="2013-05-25T18:27:52.450" Score="6" Body="&lt;p&gt;For complicated tasks, I suggest looking at TCL.  You can use TCL to create scripts that can be stored and run on your IOS/Nexus devices providing an amazing amount of flexibility in collecting and displaying data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it isn't necessarily faster for simple tasks, you can collect and correlate information from multiple commands and reformat it as you like.  It can also pull information from SNMP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you haven't looked into it, you can find one such document &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/ios_tcl/configuration/12-4t/nm-script-tcl.html#GUID-6B16B49C-92CE-4C84-80DD-FB43746B9D9A&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I didn't add this, but probably should have.  Once you have your TCL script in place, you can use the alias command from Stefan's great answer to create a faster access to the script.  For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alias exec mac-lookup tclsh flash:mac-lookup.tcl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-25T18:51:38.490" LastActivityDate="2013-05-25T18:51:38.490" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1011" PostTypeId="1" CreationDate="2013-05-25T20:07:36.790" Score="6" ViewCount="8279" Body="&lt;p&gt;I hear the terms leased line and dedicated line and want to know what the difference is. For example, is DSL considered a lease line? or is T1 considered a lease line? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hear all these terms being thrown around and I'm not sure I understand what constitutes a leased line?&lt;/p&gt;&#xA;" OwnerUserId="997" LastEditorUserId="762" LastEditDate="2013-05-27T10:00:35.793" LastActivityDate="2017-04-01T11:29:40.300" Title="What are leased lines, serial lines and dedicated lines?" Tags="|wan|cabling|terminology|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1012" PostTypeId="2" ParentId="1011" CreationDate="2013-05-25T20:17:27.173" Score="4" Body="&lt;p&gt;They are not in my view strict well defined terms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally people mean T/E, SDH/SONET as leased line, but DSL not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When customers in RFQ request leased line from us, I interpret it as they feel DSL quality is inferior to 'legacy' solutions, and specifically want us to avoid using it. While technically there is no difference in the physical copper we order from incumbent, in both cases it's copper between customer site and our pop, we &lt;strong&gt;lease&lt;/strong&gt; from the incumbent, it is just connected to different active device in our network.  &lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-05-25T20:58:18.067" LastActivityDate="2013-05-25T20:58:18.067" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1013" PostTypeId="2" ParentId="1011" CreationDate="2013-05-25T20:19:28.013" Score="2" Body="&lt;p&gt;A leased line typically refers to a point-to-point style link. A T1 /can/ be a leased line but isn't always.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dedicated lines are a bit harder because that could mean anything. A point-to-point can be dedicated...an Internet connection can be advertised as being dedicated, but that's kind of a farse.Typically a dedicated line just means less oversubscription than a shared or non-dedicated line. Something like 10 or 20 to 1 instead of 100 or 200 to 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In all honesty these terms do not have a &quot;standard&quot; meaning. So they can be used in a lot of different contexts.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-25T20:19:28.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1014" PostTypeId="1" AcceptedAnswerId="1015" CreationDate="2013-05-25T20:25:41.087" Score="13" ViewCount="1605" Body="&lt;p&gt;We are constructing a new building, and our CIO is pushing for a solution where he doesn't have to spend the money on copper runs to all the user stations and wants to use wireless only for this purpose, especially since wireless will already be part of the deployment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Servers, the data center, services deemed as critical, and other non-wireless devices (copier/scanner/printers for instance) would still get a copper connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly installing copper cabling and the switches to support all the cabling can be expensive, but this seems like a major change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How viable is it to provide only wireless to user stations?&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-29T00:29:54.867" Title="Is a wireless only network (for end users) a viable option?" Tags="|wireless|ieee-802.11|best-practices|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1015" PostTypeId="2" ParentId="1014" CreationDate="2013-05-25T20:25:41.087" Score="17" Body="&lt;p&gt;With the arrival of 802.11n and with 802.11ac almost here, this can be a viable option.  However the expectation of cost savings may not be accurate as you may have additional initial costs (for instance hiring a wireless consultant to make sure things go right) or even in ongoing costs (do you need new staff?).  You will carefully have to consider your path forward and how this impacts your users and IT staff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, there are a number of things to keep in mind when considering not deploying a traditional 802.3 Ethernet network (the larger the wireless network and number of client devices, the more these are true):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;802.11 is somewhat still in the same place where 802.3 was in it's infancy.  There are device inter-operability issues that exist based on the way that some vendors implement the standards. Your IT staff may need to spend additional time testing new hardware or software.&lt;/li&gt;&#xA;&lt;li&gt;802.11 is newer, more complicated, and changing much faster than 802.3, so the development and quality assurance processes by wireless vendors (infrastructure and client devices) is not always what it should be.&lt;/li&gt;&#xA;&lt;li&gt;You will want to make sure that you properly plan the wireless deployment considering a number of factors including at least both coverage and capacity planning.&lt;/li&gt;&#xA;&lt;li&gt;802.11 can be more difficult to configure, optimize, and maintain properly than a traditional 802.3 network.  Having someone on staff or hiring a consultant who are well versed in 802.11 and RF will be very helpful.&lt;/li&gt;&#xA;&lt;li&gt;Wireless is not as reliable as wired since it is more easily subject to outside sources of interference.&lt;/li&gt;&#xA;&lt;li&gt;If you haven't already, you would want to invest in some tools to help your IT staf maintain and troubleshoot the wireless network, including at least a basic 2.4GHz/5GHz spectrum analyser and a wireless capture device (without special hardware/drivers, Windows cannot capture wireless traffic properly; Linux can with the right hardware).&lt;/li&gt;&#xA;&lt;li&gt;Problems in 802.11 can be more difficult to troubleshoot, so problem resolution can take longer at times.&lt;/li&gt;&#xA;&lt;li&gt;There may be additional security concerns and costs with an 802.11 network.  At the very least you will want to consider running WPA2-Enterprise security if you don't have it already.  VPN for wireless clients is also an option (with or without WPA2).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I can probably go on, but I hope I have illustrated that while this is a viable option, you need to make sure you understand what this change entails if you wish to do it successfully.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-25T20:25:41.087" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1016" PostTypeId="2" ParentId="1011" CreationDate="2013-05-25T20:30:57.690" Score="7" Body="&lt;p&gt;The terms do get thrown about quite a bit and the definition is a bit of a murky issue as they can be used in several ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say that generally a leased line is a line you are paying someone else for use.  For instance, you can string your own copper and establish your own T1/T3 service between buildings.  However, you could also pay someone to provide and maintain that line.  Often leased lines have a SLA associated with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A dedicated line would be a line that is dedicated to you/your company.  For instance, in an office building, you may not have a dedicated line.  You may have a PRI that comes into the building and provides service to multiple organizations.  Often this is cheaper because the telecommunications company doesn't need as many lines going into the building and has fewer to maintain.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-25T20:30:57.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1017" PostTypeId="2" ParentId="1014" CreationDate="2013-05-25T20:52:03.930" Score="3" Body="&lt;p&gt;What about voice for each station? Whilst it is acceptable these days to perhaps use wireless for all your data needs for desktops it is still the case IMHO that you should be using wired for voice and if you are going to run copper for the voice then why not just use copper for the desktops as well...&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-25T20:52:03.930" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1019" PostTypeId="2" ParentId="1014" CreationDate="2013-05-25T22:05:33.437" Score="2" Body="&lt;p&gt;In order to get a good answer it would help to know how large an organization you are planning for, both in terms of area, isolation from other organizations, the number of users to support and intensity of those users' computer usage).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been at a few companies that went all-wireless for computer access; it worked because they were relatively small, and there were free wifi channels.  Larger installations are more likely to suffer from congestion at peak usage times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there is always the issue of a neighboring company setting up stations &quot;on your channels&quot;, resulting in much lower throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is the issue of which bands you are going to use: 802.11b/g or 802.11a.  There are only three clean channels in 802.11b/g, there are many more in 802.11a, as well as supporting higher native throughput and smaller cell sizes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I usually recommend against a wireless only installation; given how critical internet access is for most of today's workers it doesn't take very many wireless outages to justify the extra $300/station capital costs for hard-wiring a station.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, have you done a site survey to see how much competing wireless usage there already is in your location?&lt;/p&gt;&#xA;" OwnerUserId="999" LastActivityDate="2013-05-25T22:05:33.437" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1020" PostTypeId="1" CreationDate="2013-05-25T23:45:58.383" Score="2" ViewCount="425" Body="&lt;p&gt;I have a scenario whereby we will have over 15 remote IPSEC sites concentrated back to HO where a bluecoat proxy lives; the proxy is in transparent mode. The remote sites will have SRP527W's with an ASA5510 at HO. All remote sites have a DSL connection. I'm wondering if we can send across all web traffic from the sites through the bluecoat proxy to enforce content management. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've had a quick look at the &lt;code&gt;route inside 0.0.0.0 0.0.0.0 &amp;lt;proxyIP&amp;gt; tunneled&lt;/code&gt; command, but I haven't tested it yet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just wondering if anybody has other suggestions? &lt;/p&gt;&#xA;" OwnerUserId="1001" LastEditorUserId="775" LastEditDate="2013-05-26T21:01:50.490" LastActivityDate="2013-05-26T21:01:50.490" Title="ASA5510 Site-to-site VPN with Bluecoat SSG proxy" Tags="|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1021" PostTypeId="1" AcceptedAnswerId="1022" CreationDate="2013-05-25T23:49:18.107" Score="6" ViewCount="6168" Body="&lt;p&gt;Four of our 6500 chassis have a constant high CPU usage from the SNMP ENGINE process. Three of the chassis run around 20-30% constantly and the fourth is running around 50% constantly. We have about thirty more 6500s that are showing no issues at all. To the best of my knowledge we are monitoring the same exact OIDs on all 6500 chassis. Is there a show command that will display what OID being polled is causing so much CPU to be used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I implemented the &quot;snmp-server view cutdown&quot; from &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a00800948e6.shtml#large_route&quot;&gt;here&lt;/a&gt; and it dropped the CPU down a bit but really need to find a solution other than this.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-05-26T03:21:19.473" Title="SNMP ENGINE process has high CPU usage on a few 6500 chassis" Tags="|cisco-ios-12|cisco-6500|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1022" PostTypeId="2" ParentId="1021" CreationDate="2013-05-26T00:35:40.173" Score="7" Body="&lt;p&gt;I would take a look at &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-15956&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; support document from Cisco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In part it recommends to run the following command to see which OID's were recently polled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show snmp stats oid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This gives a readout for which OID's you are polling.  It will allow you to see, by judging the time stamps, which OID is taking a long time to poll.  This is usually where your problem lies.  See the below sample output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asr1001-1#show snmp stats oid&#xA;&#xA;time-stamp               #of times requested             OID&#xA;20:31:33 EDT May 25 2013         1142                    ifOutDiscards&#xA;20:31:33 EDT May 25 2013         1142                    ifOutErrors&#xA;20:31:33 EDT May 25 2013         1142                    ifInDiscards&#xA;20:31:33 EDT May 25 2013         1142                    ifInErrors&#xA;20:31:33 EDT May 25 2013         1142                    ifHCOutOctets&#xA;20:31:33 EDT May 25 2013         1902                    ifHCInOctets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However do note that it was only added in IOS release 12.4(20)T and 12.0(22)S, so may not be available to you.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In the linked document there are some other methods such as:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Sniffing the packets on the port to see what OID's are being polled heavily&lt;/li&gt;&#xA;&lt;li&gt;Using &lt;code&gt;debug snmp packets&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;They aren't as nice and neat as the &lt;code&gt;show snmp stats oid&lt;/code&gt; but they can help you out if that command isn't available.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-05-26T03:21:19.473" LastActivityDate="2013-05-26T03:21:19.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1023" PostTypeId="2" ParentId="1011" CreationDate="2013-05-26T03:05:29.263" Score="4" Body="&lt;p&gt;&lt;strong&gt;Dedicated&lt;/strong&gt; means not a shared medium. &lt;a href=&quot;http://en.wikipedia.org/wiki/Dedicated_line&quot; rel=&quot;nofollow&quot;&gt;Dedicated Line @ Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Leased&lt;/strong&gt; means just that... you're leasing the line which could be using a shared services such as a MPLS VPN (or Frame Relay in the old days).  &lt;a href=&quot;http://en.wikipedia.org/wiki/Leased_line&quot; rel=&quot;nofollow&quot;&gt;Leased Line @ Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;serial&lt;/strong&gt; line is a type of interface using running HDLC or PPP.  I wouldn't put this in the same category as dedicated or leased lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dedicated Internet Access&lt;/strong&gt; (DIA) is a common term used by ISPs and can be provided over leased or serial lines.  You can't really have dedicated without leasing (i.e., a contract), unless you own the cable plant, but you could use something other than serial like Ethernet.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-26T03:05:29.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1024" PostTypeId="1" AcceptedAnswerId="1230" CreationDate="2013-05-26T03:50:17.523" Score="6" ViewCount="2330" Body="&lt;p&gt;There's a limitation (stated below in Cisco's documentation) that FlexConnect ACLs in Cisco WLC cannot be combined in the same WLAN with local mode ACLs.  The GUI allows the entry of a local mode ACL in the Interface tied to the WLAN and also a separate FlexConnect ACL in those APs that are in FlexConnect mode under the VLAN-Mappings section.  This seems contrary to the restriction.  &lt;strong&gt;Does the FlexConnect AP ignore the local mode ACL on the WLAN and just use its FlexConnect ACL or is the behavior something else to back up the statement below?&lt;/strong&gt;  I really don't want to have to create separate WLAN's just to handled the FlexConnect ACLs.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;FlexConnect ACLs cannot be combined with Local mode ACLs on the same WLAN. If ACLs are needed for both FlexConnect and Local mode APs, you can apply two different WLANs to support the use of ACLs in both operating modes (one WLAN for FlexConnect APs and the other WLAN for Local mode APs). &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/controller/7.2/configuration/guide/cg_flexconnect.html#wp1229980&quot; rel=&quot;noreferrer&quot;&gt;Configuring FlexConnect in Cisco Wireless LAN Controller Configuration Guide, Release 7.2&#xA;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-28T16:49:31.320" Title="Can FlexConnect ACLs be combined with Local mode ACLs on the same Cisco WLC WLAN?" Tags="|cisco|wlc|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1025" PostTypeId="1" CreationDate="2013-05-26T04:57:25.703" Score="9" ViewCount="3402" Body="&lt;p&gt;We have put some 3750Gs in a stack for our DC access switches. We are concerned that these won't be able to handler higher data loads as traffic increases due to their limited buffers. What statistic/s and/or specific SNMP OID's should we be monitoring to find out how these buffers are handling the load?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI We are using PRTG as our tool of choice.&lt;/p&gt;&#xA;" OwnerUserId="991" LastEditorUserId="762" LastEditDate="2013-05-26T18:09:20.047" LastActivityDate="2013-05-26T18:09:20.047" Title="3750G Switch Buffer Monitoring" Tags="|cisco-catalyst|switch|cisco-ios-15|snmp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1026" PostTypeId="2" ParentId="1025" CreationDate="2013-05-26T05:36:20.530" Score="1" Body="&lt;p&gt;Assuming you're wanting to monitor this data via SNMP (I'm not familiar with PRTG), your best bet is to monitor for:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;input queue drops&lt;/li&gt;&#xA;&lt;li&gt;output queue drops&lt;/li&gt;&#xA;&lt;li&gt;inDiscards&lt;/li&gt;&#xA;&lt;li&gt;outDiscards&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that if you're monitoring input queue drops, you'll see these happen across multiple subsets of ports, because (IIRC - someone correct me if I'm wrong) these map to the port ASIC's and the buffers are shared across port groupings (ASICs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a link to a Cisco doc that has some other good info:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_q_and_a_item09186a00800b69ac.shtml&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_q_and_a_item09186a00800b69ac.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-05-26T05:36:20.530" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1027" PostTypeId="2" ParentId="1020" CreationDate="2013-05-26T07:05:50.847" Score="2" Body="&lt;p&gt;You will have to redesign a bit of your network to solve this.&#xA;Here's the network as I see it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN-BlueCoat-ASA --&gt; VPN --&gt; SRP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can transport all traffic from spokes to the ASA, then to Internet, but your proxy is behind ASA so I don't see how the traffic can reach it.&#xA;One desperate solution, would be to move the proxy in front of the ASA, but for many reasons I don't recommend it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This being said, I can think of two ways of doing it:&#xA; - use an explicit proxy to all the remote sites (the bluecoat IP), so everyone will send any WEB request through the tunnel straight to the appliance&#xA; - replace ASA with a VPN&amp;amp;UTM equipment like Fortinet, SRX, UTM-1...&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-05-26T07:05:50.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1028" PostTypeId="2" ParentId="1025" CreationDate="2013-05-26T07:23:28.433" Score="9" Body="&lt;p&gt;As far as I know data you want is not available on SNMP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3750#sh mls qos interface FastEthernet0/1 statistics &#xA;...&#xA;  output queues dropped: &#xA;queue: threshold1 threshold2 threshold3&#xA;-----------------------------------------&#xA; queue 0:            0            0            0 &#xA; queue 1:       100989            0            0 &#xA; queue 2:            0            0            0 &#xA; queue 3:            0            0            0 &#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What you'd like to know is ifIndex, queue, threshold and drop counter. I'm not aware of populated MIB/OID where these values can be polled from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like John Jensen explained, outDiscard is only thing you can get, but it aggregates all of this, so you won't know if it's BE, AF, EF, NC or what, which is dropping. You probably wouldn't care about BE drops, but you'd care about EF drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two OIDs where these aggregate egress drops are stored, if your ifIndex is 10001, you'd find them here (symbolic and numeric presentation):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IF-MIB::ifOutDiscards.10001&#xA;.1.3.6.1.2.1.2.2.1.19.10001&#xA;EtherLike-MIB::dot3StatsDeferredTransmissions.10001&#xA;.1.3.6.1.2.1.10.7.2.1.7.10001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3750/3560 are not very good switches for application which can microburst, i.e. if your egress is 1GE and ingresses are 1GE too, two very low average rate ingress ports can easily congest the egress port, causing drops. To maximize the available buffers (and minimize microburst drops) follow &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-8093&quot;&gt;this&lt;/a&gt; document.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-05-26T07:38:55.627" LastActivityDate="2013-05-26T07:38:55.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1029" PostTypeId="1" AcceptedAnswerId="1030" CreationDate="2013-05-26T09:50:31.643" Score="42" ViewCount="70203" Body="&lt;p&gt;You often hear the terms &lt;strong&gt;Subnet&lt;/strong&gt; and &lt;strong&gt;VLAN&lt;/strong&gt; used interchangeably.  With the ubiquitous nature of IP these days, &lt;strong&gt;when are the two not considered roughly the same from a high-level, understanding that VLANs are L2 and Subnets are L3.&lt;/strong&gt;   In other words, are there any cases for having a VLAN without a Subnet, and still have IP (L3) communication?  [Also ignoring that all networks are not subnets when considering classful networks which all are really just CIDR prefixes these days.]&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="3146" LastEditDate="2013-11-05T17:47:17.227" LastActivityDate="2022-10-13T20:33:28.647" Title="Difference between Subnet and VLAN?" Tags="|ipv4|vlan|subnet|" AnswerCount="13" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1030" PostTypeId="2" ParentId="1029" CreationDate="2013-05-26T10:03:13.563" Score="50" Body="&lt;p&gt;If they are used interchangeably then they are used incorrectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnet refers to particular IP network, such as &lt;code&gt;192.0.2.0/28&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN refers to &lt;a href=&quot;http://www.ieee802.org/1/pages/802.1Q-2014.html&quot; rel=&quot;noreferrer&quot;&gt;802.1Q standard&lt;/a&gt;, in which you can essentially give each port unique MAC address table, effectively separating them from each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN may transport one or more subnet (but does not have to, it may be transporting something else than IP entirely). &#xA;Subnet may be configured for VLAN, but does not have to be, it could be without 802.1Q or over some completely different L2 technology than ethernet.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="54410" LastEditDate="2019-07-16T00:12:48.900" LastActivityDate="2019-07-16T00:12:48.900" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="1031" PostTypeId="2" ParentId="1029" CreationDate="2013-05-26T10:13:57.437" Score="5" Body="&lt;p&gt;They are only used interchangeably from a perspective of each unique vlan at layer 2 should have its own subnet for addressing at layer 3 giving you separation and ability to manage broadcast traffic etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of scenarios where you would have a vlan without a subnet then only perhaps if using an 'ip unumbered' setup but there are not too many reasons to want to have to do this.  If you review some best practice models like Cisco's composite network model then in terms of keeping individual subnets and your vlans 'local' to switch blocks then you would generally have a separate subnet assigned per vlan.&lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2013-05-26T10:13:57.437" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1032" PostTypeId="2" ParentId="1029" CreationDate="2013-05-26T10:15:02.537" Score="14" Body="&lt;p&gt;Subnets (L3) and VLANs (L2) are on different layers. The terms &lt;strong&gt;should not&lt;/strong&gt; be used interchangeably. A VLAN can contain one &lt;strong&gt;or more&lt;/strong&gt; L3 prefixes (&quot;Subnets&quot;). For a layman this could cause confusion. Often people don't understand that these two are connected but not the same. People might say &lt;em&gt;The host located in our server subnet&lt;/em&gt; or &lt;em&gt;The server located in the DMZ VLAN&lt;/em&gt; and mean the same thing.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-05-26T10:15:02.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1033" PostTypeId="1" AcceptedAnswerId="1036" CreationDate="2013-05-26T10:17:40.410" Score="3" ViewCount="1065" Body="&lt;p&gt;In a colo/DC environment, if you had a customer wanting to do their own VLANs &amp;amp; subnetting, would you configure the port going to their L3 switch as a trunk port or an access port?&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="105" LastEditDate="2013-05-26T20:32:15.403" LastActivityDate="2013-05-27T00:52:12.620" Title="Trunk port or access port?" Tags="|vlan|" AnswerCount="8" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1034" PostTypeId="2" ParentId="1033" CreationDate="2013-05-26T10:25:42.167" Score="1" Body="&lt;p&gt;It depends of what are you providing the customer with. Most of the time access port is used for transporting the service to the customer, then it's up to him what he will do with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I choose access-port as it is more secure than a trunk-configured-port.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-05-26T10:25:42.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1035" PostTypeId="2" ParentId="1033" CreationDate="2013-05-26T10:40:20.900" Score="5" Body="&lt;p&gt;If they only need &quot;Internet&quot; or some other kind of L3 connectivity from you, go for access port. Only configure a trunk if your customer has multiple VLANs that are used to interact with your infrastructure (or other customers located in your network). If the customer wants to connect his own switches/sites over your network and wants to use VLANs, try to do Q-in-Q (VLAN/dot1q tunneling) if your equipment supports it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, if you only need to provide L3 connectivity &lt;strong&gt;and&lt;/strong&gt; you're connecting your customer directly to a router, configure the port as a &quot;routed&quot; port (&lt;code&gt;no switchport&lt;/code&gt; on Cisco) so you don't have to do mac learning and have no interaction with the customers STP, etc.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2013-05-26T10:47:21.973" LastActivityDate="2013-05-26T10:47:21.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1036" PostTypeId="2" ParentId="1033" CreationDate="2013-05-26T10:42:46.717" Score="8" Body="&lt;p&gt;The best solution here would be a routed port. Turn DTP off and leave the port as routed so that VTP updates don't travel into your network and all their layer 2 protocols/information remain on their side.&lt;/p&gt;&#xA;" OwnerUserId="889" LastActivityDate="2013-05-26T10:42:46.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1037" PostTypeId="1" AcceptedAnswerId="1043" CreationDate="2013-05-26T10:48:27.667" Score="13" ViewCount="2043" Body="&lt;p&gt;Many have pointed out that a VLAN can hold one or more subnets. If your default gateway for this subnet is on a router or a L3 switch then how could there be more than one default gateway in a VLAN configuration? On a router you map each subinterface to a VLAN and give it an IP and you can't have two subinterfaces with the same VLAN. On a L3 switch you give the VLAN interface an IP and that acts as the default gateway; you can't give it two IPs. So, how would one go about including two subnets in one VLAN?&lt;/p&gt;&#xA;" OwnerUserId="889" LastActivityDate="2013-05-26T11:04:16.010" Title="VLAN and subnet relationship" Tags="|vlan|ipv4|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1038" PostTypeId="1" CreationDate="2013-05-26T10:49:55.390" Score="5" ViewCount="7242" Body="&lt;p&gt;I have a Fortigate 110C on my central site. I have a remote site office too. The users at the remote site need to access the central site via a VPN. Can I run SSL client software on one of the PC's or any device on the remote site, and redirect all the VPN traffic via it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose is to avoid both:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Placing a new VPN concentrator or firewall on the remote site&lt;/li&gt;&#xA;&lt;li&gt;We don't want each user to install an SSL client on their PC at the remote office and to dial separately.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="777" LastEditorUserId="441" LastEditDate="2013-05-26T17:12:52.843" LastActivityDate="2013-06-21T01:11:58.877" Title="How can I use SSL remote access VPN for connecting two sites?" Tags="|vpn|security|fortigate|" AnswerCount="8" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1039" PostTypeId="2" ParentId="1037" CreationDate="2013-05-26T10:51:08.307" Score="11" Body="&lt;p&gt;IOS example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan42&#xA;  ip address 192.0.2.1 255.255.255.0&#xA;  ip address 198.51.100.1 255.255.255.0 secondary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now this Vlan42 can have two subnets&lt;/p&gt;&#xA;&#xA;&lt;p&gt;JunOS example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan {&#xA;    unit 42 {&#xA;        family inet {&#xA;            address 192.0.2.1/24;&#xA;            address 198.51.100.1/24;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-05-26T11:04:16.010" LastActivityDate="2013-05-26T11:04:16.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1040" PostTypeId="2" ParentId="1038" CreationDate="2013-05-26T10:52:32.537" Score="0" Body="&lt;p&gt;The general idea of an SSL VPN is to allow individual remote teleworkers access to central resources. Your best bet in this case is to deploy a small VPN device at the remote site and tunnel all the traffic back to the central site.&lt;/p&gt;&#xA;" OwnerUserId="991" LastActivityDate="2013-05-26T10:52:32.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1041" PostTypeId="2" ParentId="1037" CreationDate="2013-05-26T10:55:50.640" Score="-3" Body="&lt;p&gt;The only down side to this is that it's not scalable as Cisco only allows one secondary IP address on the interface. You are much better sticking to the one subnet per VLAN idiom.&lt;/p&gt;&#xA;" OwnerUserId="991" LastActivityDate="2013-05-26T10:55:50.640" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1042" PostTypeId="2" ParentId="1038" CreationDate="2013-05-26T10:58:26.167" Score="0" Body="&lt;p&gt;As Tim has said, the idea of the SSL VPN is for it to be used by individual users, not to create a site-to-site VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any reasoning that you don't want to put a VPN capable device at the remote site, if its only a small site there are small/cheap consumer grade devices that could do it or even one of the low end firewalls like the Cisco ASA 5505.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-26T10:58:26.167" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1043" PostTypeId="2" ParentId="1037" CreationDate="2013-05-26T11:03:21.057" Score="11" Body="&lt;p&gt;You can use secondary addressing to add another subnet onto a SVI, this is not recommended but can be used if you really need it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 190 bytes&#xA;!&#xA;interface Vlan45&#xA; ip address 2.3.4.5 255.255.255.0 secondary&#xA; ip address 3.4.5.6 255.255.255.0 secondary&#xA; ip address 4.5.6.7 255.255.255.0 secondary&#xA; ip address 1.2.3.4 255.255.255.0&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-26T11:03:21.057" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1044" PostTypeId="2" ParentId="1038" CreationDate="2013-05-26T11:31:39.080" Score="5" Body="&lt;p&gt;You can do this in theory, but you will need a good client machine to do that and by good, I mean a good Windows installation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is because the operating system on the machine you want to use SSL VPN client will have to deal with all the traffic, and that machine will have to somehow prove router&amp;amp;firewall capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 1&lt;/strong&gt;: you connect that machine (from remote office) to the headquarter. You will receive an IP address from the SSL_VPN_pool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 2&lt;/strong&gt;: you will add a static (persistent route) on all stations (from the remote office), that for the HQ destination would have to reach through the machine connected at Step 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 3&lt;/strong&gt;: you will have to enable Routing&amp;amp;Remote Service on the machine you use SSL VPN client (I assume you will use a Windows platform, although Linux will work better for this), so that traffic from that location will be routed from lan interface to the VPN_interface. Here is a catch: you will either NAT this traffic with a source of your SSL_IP_pool or you can let it this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Step 4&lt;/strong&gt;: if you don't NAT you have to add on Fortigate static routes for the remote office network and also firewall rule on the ssl.root interface--&gt;to--&gt;HQ_internal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do this, but that extra_vpn_equipment_money you don't want to spend would be NAT-ed into some workstation_configuration_sweat.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-05-26T11:31:39.080" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1046" PostTypeId="2" ParentId="1004" CreationDate="2013-05-26T12:57:10.520" Score="1" Body="&lt;p&gt;If you use securecrt (and if you dont want to get into too much shell scripting) for your telnet/ssh/console access you can always &quot;record&quot; your commands, it has an option and then you can simply select your recorded script in tools I believe it is&lt;/p&gt;&#xA;" OwnerUserId="1014" LastActivityDate="2013-05-26T12:57:10.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1047" PostTypeId="2" ParentId="526" CreationDate="2013-05-26T13:06:17.060" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;Often you have to set the MTU to 1440 or less from memory to allow the GRE header through to the other site&gt; very useful and easy to understand (not a 100 page whitepaper either)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/872-cisco-router-gre-ipsec-tunnel-transport.html&quot; rel=&quot;nofollow&quot;&gt;Calculating GRE IPSec Tunnel Mode Overhead&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/868-cisco-router-gre-ipsec.html&quot; rel=&quot;nofollow&quot;&gt;Point to Point GRE IPSEC&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say refer to this article to get more information: I set one up the other day with 2 ciscos - just remove the IPSec stuff from your config, but as I said &gt; lower the MTU on both sides to match (and you should really implement IPSEC)&lt;/p&gt;&#xA;" OwnerUserId="1014" LastActivityDate="2013-05-26T13:06:17.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1048" PostTypeId="1" CreationDate="2013-05-26T13:17:37.350" Score="1" ViewCount="28315" Body="&lt;p&gt;To connect two Catalyst switch stacks, I use EtherChannel, i.e. I aggregate several ports on each switch to get more bandwidth and higher availability than with just a single port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the link doesn't work yet. What could cause the problem?&lt;/p&gt;&#xA;" OwnerUserId="231" LastActivityDate="2018-02-07T05:50:37.307" Title="Why doesn't my port-channel interface come up, between Cisco Catalyst switches?" Tags="|cisco|cisco-catalyst|etherchannel|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1049" PostTypeId="2" ParentId="1048" CreationDate="2013-05-26T13:17:37.350" Score="6" Body="&lt;p&gt;Improperly configured EtherChannel (port-channel) interfaces would be disabled automatically, to prevent problems such as loops. First of all, having the same configuration on each side would be the safest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a checklist:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Both switches must see the ports as an EtherChannel bundle. If one switch would consider ports as separate connections, it's inconsistent and would fail.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;All ports in the bundle needs to have the same EtherChannel protocol, i.e. don't mix PAgP and LACP. Also manual configuration mixed with one protocol is not recommended.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;All channel ports must use at the same speed and the same duplex mode. And LACP doesn't support half-duplex.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;No one of the ports can be SPAN (switched port analyzer) destination port.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the channel is layer 3, give the address to the port-channel interface, not to single ports.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For layer 2 channels:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All ports have to be either trunks or in the same VLAN.&lt;/li&gt;&#xA;&lt;li&gt;If trunking is used, the mode has to be the same on all ports.&lt;/li&gt;&#xA;&lt;li&gt;If you use a trunk with an allowed VLAN range, that range must be the same on all ports.&lt;/li&gt;&#xA;&lt;li&gt;If you would have different STP costs in a channel, at least ports have to be compatible to each other. STP considers an EtherChannel as a single port.&lt;/li&gt;&#xA;&lt;li&gt;Protocol filtering has to be the same on all ports.&lt;/li&gt;&#xA;&lt;li&gt;Also here, (static MAC) addresses must be on the port-channel interface, not on single ports.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Further reading:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SXF/native/configuration/guide/channel.html&quot;&gt;Layer 3 and Layer 2 EtherChannel&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk389/tk213/technologies_tech_note09186a008009448d.shtml&quot;&gt;Understanding EtherChannel Inconsistency Detection&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="231" LastActivityDate="2013-05-26T13:17:37.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1050" PostTypeId="1" AcceptedAnswerId="1092" CreationDate="2013-05-26T13:50:28.943" Score="6" ViewCount="1901" Body="&lt;p&gt;How can you monitor(SPAN) traffic on a only the primary port or a secondary port of a LACP trunk on a Brocade Fastiron? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can put the monitor command on the primary port e15 and it will allow me to monitor the traffic of the whole LAG. There seems to be no way to monitor a single link in the bundle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAG config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface ethernet 15&#xA; spanning-tree 802-1w admin-edge-port&#xA; no flow-control&#xA; link-aggregate active&#xA;!&#xA;interface ethernet 17&#xA; link-aggregate active&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Error message when I try to configure secondary port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;telnet@s1(config)#int e 17&#xA;Error - cannot configure secondary ports of a trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-05-27T10:01:08.077" Title="How to monitor(SPAN) traffic on only a single port of a LACP trunk in Brocade Fastiron" Tags="|monitoring|brocade|etherchannel|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1051" PostTypeId="2" ParentId="1038" CreationDate="2013-05-26T14:05:50.707" Score="5" Body="&lt;p&gt;This is a bit of an out of the box answer, but depending on your wireless vendor, several of them offer a &quot;remote AP&quot; configuration that allows an AP to create a VPN tunnel back to the controller when it boots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your remote (and temporary) users would then connect to the AP and back to the controller over VPN.  You would have to come up with other solutions for things like printing (wireless printer?), but it would be possible especially for a 2 month deployment. &lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-26T14:05:50.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1052" PostTypeId="1" CreationDate="2013-05-26T14:56:35.670" Score="1" ViewCount="726" Body="&lt;p&gt;I have a Cisco Communication Manager Business Edition 6000 specifications. Can you explain some facts about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://docs.google.com/file/d/0ByHsfq2aAojlMTBIWGpyQzFJdUk/edit?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;Link to specification&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to this, we have &lt;b&gt;BE6K-ST-BDL-K9 (#1)&lt;/b&gt; and it contans:&lt;br&gt;&#xA;1.UPM - Unified Provision Manager (for control and management)&lt;br&gt;&#xA;2. VCS - Video Control Server (with 5 traversal calls and 10 non-traversal)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also bundle has #3 CCX (Contact center express) Promo bundle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything seems to be OK, but then we can find &lt;b&gt;R-CBE6K-K9 (#35)&lt;/b&gt; and &lt;b&gt;BE6K-9X-PAK (#36)&lt;/b&gt;.&#xA;BE6K-9X-PAK contains:&#xA;1. UCM - Unified communication manager (for calls)&lt;br&gt;&#xA;2. Unity Connection (Voice mail)&lt;br&gt;&#xA;3. CUP - CISCO unified Presence (presence visibility and instand messaging).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;br&gt;&#xA;As I know we can use up to 5 application on BE 6000, but we have six: Provision manager, UCM, Unity, CUP, VCS and CCX. &lt;b&gt;Where is mistake and what application we will have?&lt;/b&gt;&#xA;&lt;br&gt;&lt;br&gt;&#xA;Other questions are about user licenses. &lt;br&gt;&#xA;1. We have 50 Enhanced user licenses. If I am right it meens 50 account entries (numbers), but not 50 end devices? &lt;br&gt;2.Enhanced user license allow to work simultaneously only one device, it meens that I can connect with Jabber via my PC, and after work disconnect and connect from home from my iPad?&#xA;&lt;br&gt;3. What is JABBER-IM-ADDON #51?&lt;/p&gt;&#xA;" OwnerUserId="904" LastEditorUserId="775" LastEditDate="2013-05-26T20:50:52.657" LastActivityDate="2013-05-26T20:50:52.657" Title="Communication Manager Business Edition 6000 - understanding bundle equipment" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1054" PostTypeId="2" ParentId="1052" CreationDate="2013-05-26T16:41:27.297" Score="2" Body="&lt;p&gt;CCX comes as complimentary like it does with CUCM purchases. You will have rest of the utilities installed but CCX would likely come in a DVD which you can install on one of your own machines.&lt;/p&gt;&#xA;" OwnerUserId="1018" LastActivityDate="2013-05-26T16:41:27.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1055" PostTypeId="2" ParentId="1038" CreationDate="2013-05-26T18:13:58.327" Score="1" Body="&lt;p&gt;OpenVPN is an SSL VPN, that you could deploy on commodity hardware,&#xA;it can do SSL based Site-to-Site VPN, or Remot access VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;contrary to popular belief, SSL VPN can do Site-to-Site VPN just as well or better than IPSEC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if specific recommendations are allowed but.&#xA;I would suggest get an old desktop PC, install 1 additional NIC, and install pfsense firewall.&#xA;which supports IPSEC as well as OpenVPN (SSL/TLS based) (which gets around firwall and NAT issues)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this solution costs nothing and very small learning curve, it even handles Dynamic DNS if you do not have a public IP&lt;/p&gt;&#xA;" OwnerUserId="1019" LastEditorUserId="1019" LastEditDate="2013-05-26T19:16:21.467" LastActivityDate="2013-05-26T19:16:21.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1056" PostTypeId="1" AcceptedAnswerId="1057" CreationDate="2013-05-26T18:15:54.397" Score="29" ViewCount="11059" Body="&lt;p&gt;I've heard the term &quot;route server&quot; and &quot;looking glass&quot; thrown around here. What are they, and why should I care?&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2022-08-24T11:30:11.747" Title="Route servers and looking glasses - what are they?" Tags="|bgp|peering|route-server|terminology|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1057" PostTypeId="2" ParentId="1056" CreationDate="2013-05-26T18:15:54.397" Score="38" Body="&lt;p&gt;(Note that these two terms are often used interchangeably, which can lead to some confusion.)&lt;/p&gt;&#xA;&lt;h1&gt;Looking Glasses&lt;/h1&gt;&#xA;&lt;p&gt;A looking glass is usually a website (most often CGI) that interfaces with routers that are owned and operated by a single ISP or other network operator. Most of the time these are publicly accessible, but there may be instances where they're not. The looking glass provides a view (in website form) into a BGP table of a particular router in an operator's network. Often, looking glass implementations will also include other utilities, such as the ability to run a traceroute to a destination as if it were run from the network operator's router itself. Looking glasses are useful because they provide a perspective into an upstream's BGP table. &lt;a href=&quot;http://lookingglass.level3.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Level3, a well-known tier one carrier in the U.S. has a looking glass available here.&lt;/a&gt; These are widely used troubleshooting tools.&lt;/p&gt;&#xA;&lt;h1&gt;Route Servers&lt;/h1&gt;&#xA;&lt;p&gt;The term &amp;quot;route server&amp;quot; has evolved to mean two different things, both of which will be explained. I'm defining two route server &amp;quot;subtypes&amp;quot; here that should make the distinction more clear. These definitions are my own and are only used to try to dispel any possible confusion. In reality, the &lt;strong&gt;public route server&lt;/strong&gt; is also commonly referred to as a &amp;quot;route collector&amp;quot; or a &amp;quot;route-views server&amp;quot; (the latter originating from the &lt;a href=&quot;http://www.routeviews.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;University of Oregon Route Views Project&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;h2&gt;Public Route Server&lt;/h2&gt;&#xA;&lt;p&gt;These are systems (usually routers, but some exist that run open source routing daemons) that are publicly accessible, often via Telnet, and one is able to also run pings, traceroutes, and &amp;quot;show ip bgp&amp;quot; (there are also a couple Juniper route servers out there, don't worry!) commands. The difference between a public route server and a looking glass (aside from an LG having a nifty CGI) is that a wide variety of networks (including some tier one carriers) peer with a route server, so there's an &amp;quot;overall&amp;quot; bigger picture of which prefixes are coming from which ASN's. Command authorization policy will vary from route server to route server. &lt;a href=&quot;http://www.bgp4.net/wiki/doku.php?id=tools:ipv4_route_servers&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here's a list of IPv4 route servers&lt;/a&gt;. They have a separate page with IPv6 route servers as well. When it comes to differentiating &lt;strong&gt;looking glass&lt;/strong&gt; from &lt;strong&gt;route server&lt;/strong&gt;, one can think of the looking glass as a frontend to a route server, whether the route server itself be publicly or privately accessible.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Can't you run a looking glass on a public route server?&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can, but typically the people that run looking glasses are the ones that can afford to operate and maintain the servers that the looking glasses run on. With a public route server, all you need is a router (or a server running an open source routing daemon), a good AAA policy, and some folks that are willing to give you BGP feeds. It's also relevant to note that some network operators also host publicly accessible route servers, and you might even come across some operators that run a route server in addition to a looking glass.&lt;/p&gt;&#xA;&lt;h2&gt;IXP Route Server&lt;/h2&gt;&#xA;&lt;p&gt;This version of the route server is a little bit different. On shared peering fabrics at IXP's, the barrier of entry for an organization to begin peering is lower. You have a single port (that the IXP sells to you) connected to the IXP peering LAN, and you're given an IP address by the IXP. Now you can peer with anyone else on the fabric; contrast this with a PNI, which involves a separate dedicated physical connection between you and another entity. With a connection to an IXP's peering LAN, aside from your single port being the bottleneck, you have to manually configure eBGP sessions with whomever you wish to peer with. This is called &lt;strong&gt;bilateral interconnection&lt;/strong&gt; - there is one session between you and the peer, and only you and the peer exchange announcements. If the IXP has many members, this can become cumbersome. In this case, a route server is typically deployed at the IXP in order to be the &amp;quot;one stop shop&amp;quot; for an organization to set up an eBGP session with in order to receive prefixes from whomever else is peered with the route server. This is called &lt;strong&gt;multilateral interconnection&lt;/strong&gt;. One BGP session between you and the route server, and you get everyone else's announcements that also peers with the route server.&lt;/p&gt;&#xA;&lt;p&gt;Some organizations will rely on the route server eBGP session(s), while others will use it as a backup to their existing eBGP peerings on the IXP fabric. Most IXP's will have redundant route servers and suggest that organizations peer with both if they peer with the route servers at all.&lt;/p&gt;&#xA;&lt;h3&gt;What about BGP?&lt;/h3&gt;&#xA;&lt;p&gt;Multilateral peering using route servers brings interesting challenges in regards to BGP. A route server itself is an eBGP speaker, however there have to be specific considerations for a route server and multilateral BGP peering. Some of these rules will be reminisce of iBGP route reflection, and there are indeed many similarities. There has been &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-idr-ix-bgp-route-server-02&quot; rel=&quot;nofollow noreferrer&quot;&gt;recent work&lt;/a&gt; to standardize behaviors of a route server when it comes to these specific features. The following caveats are worth noting here:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;NEXT_HOP Attribute&lt;/strong&gt; - This attribute &lt;strong&gt;must be passed on unmodified&lt;/strong&gt; between the route server and its clients. While the route server implementation itself will not modify this attribute, it's still best practice to set &amp;quot;next-hop-self&amp;quot; on eBGP sessions from your router to a route server.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;AS_PATH Attribute&lt;/strong&gt; - Again, because the route server is intended to be transparent and not participate in any routing decisions, and modification of this attribute may affect the route server clients' best path decision making process, the route server implementation must not modify this attribute. In addition, the route server will not send their own ASN in BGP updates to its clients, therefore it's required to set &amp;quot;no bgp enforce-first-as&amp;quot; (Cisco-specific) on the client router in order to allow the eBGP session to form between the client and the route server.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;MULTI_EXIT_DISC Attribute&lt;/strong&gt; - MED is another attribute that should be propagated to route server clients without modification by the route server, since it can also used to influence the best path selection process.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Communities Attributes&lt;/strong&gt; - These should not be modified by the route server, unless the community (or communities) is intended for processing by the route server itself. Typically communities are used by IXP route server implementations to allow the peers of the route server to manipulate routing updates to other route server peers.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;It is important to remember two distinctions in regards to IXP route server implementation:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The route server &lt;strong&gt;does not&lt;/strong&gt; participate in any routing or forwarding. It is supposed to be as transparent as possible.&lt;/li&gt;&#xA;&lt;li&gt;Route server clients depend on the route server to perform their outbound filtering for them.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;IXP Route Server Implementation Options&lt;/h3&gt;&#xA;&lt;p&gt;Typically IXP operators will deploy open source routing daemons as route servers. There are three popular options:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.nongnu.org/quagga/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Quagga, specifically bgpd&lt;/a&gt;. Runs on Linux and BSD. It's been around the longest and probably has the most information available. There have been multiple forks of Quagga over the years, &lt;a href=&quot;https://github.com/GMCH/quagga.euro-ix&quot; rel=&quot;nofollow noreferrer&quot;&gt;including a train with sponsored development by EuroIX&lt;/a&gt;, a train developed by the &lt;a href=&quot;http://opensourcerouting.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Open Source Routing group&lt;/a&gt; (which more aims to improve IGP functionality with OSPF and ISIS), and the Quagga-RE (Release Engineering) train which has experimental features. &lt;a href=&quot;https://code.google.com/p/google-quagga/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google&lt;/a&gt; has also created their own fork of Quagga. Quagga bgpd supports both IPv6 and IPv4, however most IXP operators (and even some Quagga maintainers) will advise against using the &amp;quot;mainline&amp;quot; Quagga train for operating a route server at an IXP.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://bird.network.cz/&quot; rel=&quot;nofollow noreferrer&quot;&gt;BIRD&lt;/a&gt;. Runs on Linux and BSD. BIRD has gained quite a bit of popularity due to its stability and powerful filtering language and capabilities, in addition to its very good scheduling system. There have been a couple of published comparisons and scale tests between Quagga and BIRD. Overall, BIRD tends to be more stable and isn't as susceptible to CPU and memory churn as Quagga is. Both BIRD and Quagga are single-threaded however, but this is intentional. In addition, although BIRD supports both IPv4 and IPv6, it requires two different processes (compiled binaries) for IPv4 and IPv6.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.openbgpd.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenBGPD&lt;/a&gt;. Runs on Linux and BSD. OpenBGPD is the only multi-threaded open source BGP daemon available. It's known to be fairly stable under load however TCP MD5 support is somewhat poor.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;In addition to open source daemons, &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/ios_xe/iproute_bgp/configuration/guide/irg_route_server_xe.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco also offers a route server implementation for IOS-XE&lt;/a&gt;, which runs on the ASR platform. At the time of this writing, Juniper doesn't offer a route server implementation on their hardware or operating system, but this may change in the future.&lt;/p&gt;&#xA;&lt;p&gt;In terms of evaluating an open source routing daemon, in regards to memory handling and architecture, one can safely assume that BIRD &amp;gt; OpenBGPD &amp;gt; Quagga, however the ASR platform and IOS-XE is also reportedly much more capable at scale when compared to the open source daemon options available.&lt;/p&gt;&#xA;&lt;p&gt;I hope this sheds some light on route servers/looking glasses in general.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="631" LastEditDate="2022-08-24T11:30:11.747" LastActivityDate="2022-08-24T11:30:11.747" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="1058" PostTypeId="2" ParentId="99" CreationDate="2013-05-26T18:24:35.973" Score="2" Body="&lt;p&gt;Things to keep in mind regarding Fiber vs Copper:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Potential for unidirectional link failure (Which is not a problem with copper)&lt;/li&gt;&#xA;&lt;li&gt;A lot depends on the Transceiver e.g 1000 Base LX/LH is only capable of ~ 5KM&#xA;so for longer distances plan for higher end SFP.&lt;/li&gt;&#xA;&lt;li&gt;More expensive to install fiber (Splicing, pulling etc.)&lt;/li&gt;&#xA;&lt;li&gt;Fiber is not as rugged (patch cables) as Copper (Watch those bends)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A bit off-topic: if you are planning to go with fiber, in my experience Cisco branded SFP are ten times the cost of other not as well known brands, e.g. startech. This was a few years ago but it was something like $650 vs. $70. I had both types installed and working without a hitch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you report to a manager who really believes &quot;No one was ever fired for buying Cisco&quot;-&lt;/p&gt;&#xA;" OwnerUserId="1019" LastEditorUserId="3662" LastEditDate="2013-12-29T19:34:03.333" LastActivityDate="2013-12-29T19:34:03.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1059" PostTypeId="2" ParentId="653" CreationDate="2013-05-26T18:26:36.227" Score="0" Body="&lt;p&gt;On Cisco devices, you can use;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh int status&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whilst on HP devices, the command is;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh int brief&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1026" LastEditorUserId="441" LastEditDate="2013-05-26T20:11:14.643" LastActivityDate="2013-05-26T20:11:14.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1060" PostTypeId="2" ParentId="1033" CreationDate="2013-05-26T18:28:35.493" Score="0" Body="&lt;p&gt;Like most things the answer is it depends,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done it before with a Layer-2 Port, the problem you will run into is:&#xA;- ensure different customer VLAN # do not overlap. i.e &#xA;use 802.1q tunneling &#xA;in that case you are like an ISP&lt;/p&gt;&#xA;" OwnerUserId="1019" LastActivityDate="2013-05-26T18:28:35.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1061" PostTypeId="1" AcceptedAnswerId="1062" CreationDate="2013-05-26T18:42:49.990" Score="3" ViewCount="361" Body="&lt;p&gt;I recently implemented Cisco NBAR at a remote sites, edge router.&#xA;to filter and drop P2P traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see the dropped traffic by typing &quot;show policy-map interface XXX&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how can i find the source of the torrent traffic ? specifically i'm looking for a way to log the source IP address.&lt;/p&gt;&#xA;" OwnerUserId="1019" LastEditorUserId="775" LastEditDate="2013-05-26T20:44:31.083" LastActivityDate="2013-05-26T20:44:31.083" Title="Source of Cisco NBAR dropped traffic" Tags="|cisco|security|logging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1062" PostTypeId="2" ParentId="1061" CreationDate="2013-05-26T18:50:08.023" Score="3" Body="&lt;p&gt;Depending on which platform your using you can use NetFlow data to see this. Most Cisco routing platforms support this and even newer switching platforms support this as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also simply logging the ACL (Adding log to the end of the ACL statement) will generate a log message that states the source of the packets that were denied.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-26T18:50:08.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1063" PostTypeId="2" ParentId="99" CreationDate="2013-05-26T19:14:17.497" Score="34" Body="&lt;p&gt;While most other answers have talked about Length limits, Interference issues and are all correct. One important factor while choosing the cable is the speed of the network and the devices you plan to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general specifications for currently available ethernet network speeds are as follows&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Twisted Pair Copper Cable&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Category 5e&lt;/strong&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10/100/1000BASE-T Networks (i.e Upto Gigabit speeds) can be run on cables up to 100M in length&lt;/li&gt;&#xA;&lt;li&gt;10GBASE-T Networks cannot be run on these cables.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Category 6&lt;/strong&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10/100/1000BASE-T Networks can be run on cables up to 100M in length&lt;/li&gt;&#xA;&lt;li&gt;10GBASE-T Networks can be run on cables up to 37M to 50M. (This limit value is a range because it depends upon the alien-crosstalk environment)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Category 6A&lt;/strong&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10/100/1000BASE-T Networks and 10GBase-T Networks can be run on cables up to 100M in length&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Optic Fiber Cable&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The distance and speed limits of optical fiber cable are heavily depend on the kind of transceivers used on the ends of the cable. I'll summarize some of the &quot;ideal&quot; combinations here, you can take a look at all possible link specifications &lt;a href=&quot;http://www.thefoa.org/tech/Linkspec.htm&quot;&gt;here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Single Mode Fiber (SMF)&lt;/strong&gt; Optic Cable&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Gigabit upto 5Km with 1000Base-LX transceivers&lt;/li&gt;&#xA;&lt;li&gt;10G is supported up to 40Km with 10GBASE-E transceivers&lt;/li&gt;&#xA;&lt;li&gt;40G is supproted upto 10Km with 40GBASE-LR4 transceivers&lt;/li&gt;&#xA;&lt;li&gt;100G is supproted upto 10Km with 100GBASE-LR4 transceivers&lt;/li&gt;&#xA;&lt;li&gt;SMF is widely used for the long-haul where installed fiber is typically reused for more than 25 years. It is one of the most future-proof standards available.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Multi Mode Fiber Cables&lt;/strong&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;OM1 &amp;amp; OM2&lt;/strong&gt; Grade cables&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Gigabit upto 550m with 1000Base-LX modules.&lt;/li&gt;&#xA;&lt;li&gt;10G is supported up to 300m with 10GBASE-LX4 modules.&lt;/li&gt;&#xA;&lt;li&gt;40G &amp;amp; 100G is not supported.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;OM3&lt;/strong&gt; Grade cables&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Gigabit upto 550m with 1000Base-LX modules.&lt;/li&gt;&#xA;&lt;li&gt;10G is supported up to 300m with 10GBASE-LX4 modules.&lt;/li&gt;&#xA;&lt;li&gt;40G is supported up to 100m with 40GBASE-SR4 modules.&lt;/li&gt;&#xA;&lt;li&gt;100G is supported up to 100m with 100GBASE-SR10 modules.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;OM4&lt;/strong&gt; Grade cables&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Gigabit upto 550m with 1000Base-LX modules.&lt;/li&gt;&#xA;&lt;li&gt;10G is supported up to 300m with 10GBASE-LX4 modules.&lt;/li&gt;&#xA;&lt;li&gt;40G is supported up to 125m with 40GBASE-SR4 modules.&lt;/li&gt;&#xA;&lt;li&gt;100G is supported up to 125m with 100GBASE-SR10 modules.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now keeping these specifications in mind, I'd pick a cable that will support the current network requirement, while having sufficient scope for expansion. It is important to choose a medium that will support enough growth because usually replacing switches or modules on both ends of a link is just a one/two man job, while running new cabling for an upgrade is highly labor intensive and might cost a lot of money in comparison.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me also list down some of the scenarios where I'd pick each cable.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Category 6&lt;/strong&gt; would be my choice for last mile connectivity to the desk/wall outlet for any organization that either has&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A very low bandwidth requirement, like small cafes, retail stores etc&lt;/li&gt;&#xA;&lt;li&gt;Or where the expected life of the interior fitout and office space is less than 5 years&lt;/li&gt;&#xA;&lt;li&gt;It might be worth noting that Category 5e might seem cheaper, but its only by a small margin. So I'd just skip that for the better performance.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Category 6A&lt;/strong&gt; will be my choice for both last mile connectivity for the following reasons&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ability to run at 10G speeds later on&lt;/li&gt;&#xA;&lt;li&gt;Less susceptible to noise, interference and cross talk compared to Cat 6. (Since allmost all Cat6A cables are shielded)&lt;/li&gt;&#xA;&lt;li&gt;I'd also run some Cat6A within Racks in the same Aisle or Zone of a Datacenter.&lt;/li&gt;&#xA;&lt;li&gt;Cat6A would be my choice for the last mile haul in any industrial or factory environment if they cannot use fiber all the way to their equipment.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Single Mode Fiber&lt;/strong&gt; would be my cable of choice for any kind of backbone cabling where the long haul is needed. It has stood the test of time and I dont think it'll get obsolete any time soon. I'd pick the OS1 grade for indoor applications and OS2 grade for outdoor applications.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Multi Mode Fiber&lt;/strong&gt; is by far my most favorite of the lot. I'd use it in between my telecom rooms, between racks in the data center. I'd pick OM3/OM4 depending on the budget available.&lt;/li&gt;&#xA;&lt;li&gt;If possible to convince decision-makers I'd use a combination of SMF and MMF across the entire network, even to the desk or wall outlet. Going for a completely fiber only networks saves up a lot of space and energy costs and provides a lot of management flexibility by drastically reducing the number of telecommunication rooms in large facility. Also such a network will have a large capacity of bandwidth and provided you've run enough number of cores, it will be future proof to a large extent. (Even the costs of ducting and pathways needed for an all-fiber network will be cheaper than an equivalent copper based solution). Read more about this &lt;a href=&quot;http://www.thefoa.org/tech/allfiber.htm&quot;&gt;here&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The only technology that fiber cant support today is analog telephones, at least not without a converter on both ends. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I know this has been a long answer, but there is no such thing as the perfect cable for everything. In the end you need to balance out between cost, capabilities and provision for growth based on the requirements of your particular application and business.&lt;/p&gt;&#xA;" OwnerUserId="1000" LastActivityDate="2013-05-26T19:14:17.497" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1064" PostTypeId="2" ParentId="99" CreationDate="2013-05-26T19:31:27.153" Score="1" Body="&lt;p&gt;I use a mix of both in central offices (usually multi-mode), and the primary reason I choose fiber over copper is that fiber patches are pre-built and it's much harder for a technician to make mistakes on the install. When you have techs building cables, you are adding a lot of potential for human error. Minimizing install mistakes is a huge priority when you are on a time budget.&lt;/p&gt;&#xA;" OwnerUserId="1051" LastActivityDate="2013-05-26T19:31:27.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1065" PostTypeId="2" ParentId="1033" CreationDate="2013-05-26T19:38:37.733" Score="0" Body="&lt;p&gt;If you are providing the customer private line transport, you are likely going to offer the customer a tunneling service between sites with a technology such as MPLS L2VPN (VPLS, or Pseudowire), or QinQ. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is not the case, a classic access port will not do the trick since the customer wishes to pass VLANs, and a Trunk port would only work IF you are willing to provision the customer's VLANs through your network instead of transparently tunneling them.&lt;/p&gt;&#xA;" OwnerUserId="1051" LastActivityDate="2013-05-26T19:38:37.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1066" PostTypeId="2" ParentId="1033" CreationDate="2013-05-26T19:39:50.400" Score="1" Body="&lt;p&gt;I would give them a VLL (L2VPN) or a dot1q tunnel port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But really it depends on what service they are buying&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-26T19:39:50.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1067" PostTypeId="1" AcceptedAnswerId="1080" CreationDate="2013-05-26T19:42:50.340" Score="31" ViewCount="35015" Body="&lt;p&gt;I have been seeing so many people always wrestling with IPSec, and many other secure VPN technologies.&#xA;I, for one, have always simply used OpenVPN, with beautiful and simple and versatile results. I've used it on DD-WRT routers, big servers and android phones, to name a few.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone please explain to me what I am missing out on? Are there any downsides to OpenVPN that I am not aware of? Does IPSec and friends offer some awesome feature that I didn't know about? Why isn't everyone using OpenVPN?&lt;/p&gt;&#xA;" OwnerUserId="1056" LastEditorUserId="775" LastEditDate="2013-05-26T20:31:32.120" LastActivityDate="2016-08-30T09:16:25.500" Title="What are the downsides of OpenVPN?" Tags="|vpn|ipsec|" AnswerCount="8" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1068" PostTypeId="2" ParentId="1067" CreationDate="2013-05-26T19:50:40.947" Score="5" Body="&lt;p&gt;One of the downsides is that in a corporate environment some managers don't like to rely on open source software. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I personally see nothing wrong with OpenVPN for a user VPN solution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPSEC can be implemented in hardware (or rather the encryption element of IPSEC) and so is useful when you want to push a lot of data over a VPN and don't want to sacrifice CPU power on the end user stations. &lt;/p&gt;&#xA;" OwnerUserId="240" LastEditorUserId="240" LastEditDate="2013-05-26T20:10:59.937" LastActivityDate="2013-05-26T20:10:59.937" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1069" PostTypeId="2" ParentId="1067" CreationDate="2013-05-26T19:54:28.950" Score="1" Body="&lt;p&gt;&lt;s&gt;The only technical downside to OpenVPN I see is that in comparison with it's competitors the system introduces a lot of latency in the VPN links&lt;/s&gt;. Update: I've found that this was a fault not with OpenVPN generally, but with my tests only. When OpenVPN is run on the TCP protocol, the TCP overheads makes OpenVPN slightly slower. L2TP uses fixed ports and protocols for interoperability and hence there is no feature to run it on TCP. Openvpn on UDP seems to be faster for many other users. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only other advantage while using PPTP/L2TP/Ipsec is that I've found it easier to be setup on a Windows machine or an iPhone without installing any additional client side software. YMMV.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might want to read &lt;a href=&quot;http://www.ivpn.net/pptp-vs-l2tp-vs-openvpn&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; page&lt;/p&gt;&#xA;" OwnerUserId="1000" LastEditorUserId="1000" LastEditDate="2013-05-26T21:33:27.100" LastActivityDate="2013-05-26T21:33:27.100" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1070" PostTypeId="2" ParentId="272" CreationDate="2013-05-26T20:03:17.957" Score="1" Body="&lt;p&gt;If you do what the RFC says, the chance of an actual collision is very low (even though the birthday paradox applies), and since ULA addresses are only used internally on your own site, a collision doesn't matter in practice &lt;em&gt;unless&lt;/em&gt; you merge your network with another one that, amazingly, is using the same ULA prefix. &lt;/p&gt;&#xA;" OwnerUserId="1064" LastActivityDate="2013-05-26T20:03:17.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1071" PostTypeId="2" ParentId="1038" CreationDate="2013-05-26T20:03:47.017" Score="0" Body="&lt;p&gt;The best solution would be to add a VPN Router/Firewall in the remote office. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But since you dont want that, I'd go with running Linux on a physical or virtual machine in the remote office, and use this Linux box to establish a VPN link to your Fortigate VPN concentrator at the Central Office. You'll also have to configure the routers at both offices to route traffic over the VPN link as per your policy (Selective traffic, or all internet traffic etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can probably do the same thing with a Windows machine, but I've found Linux or FreeBSD works the best for such computing tasks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please make sure that the physical/virtual machine has enough computing power to handle the encryption and decryption without slowing down the traffic. &lt;/p&gt;&#xA;" OwnerUserId="1000" LastActivityDate="2013-05-26T20:03:47.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1072" PostTypeId="2" ParentId="1067" CreationDate="2013-05-26T20:06:37.733" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;OpenVPN has a more secure implementation (Userspace vs Kernel).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It works better with Firewalls and NAT (no need to ensure NAT-T) and is difficult to filter.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It is a lot less complicated then IPsec&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1019" LastActivityDate="2013-05-26T20:06:37.733" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1074" PostTypeId="2" ParentId="722" CreationDate="2013-05-26T20:20:34.323" Score="0" Body="&lt;p&gt;As far as I see it: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Use policy NAT for the overlapping IP addresses. Include pre-NAT and post-NAT addresses when adding device. I don't know about the licensing here, but from my experience doing this will cost you the same as adding two different devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Use common a shared secret for overlapping IP's. Bad idea, since it will break policy rules. &lt;/p&gt;&#xA;" OwnerUserId="1049" LastActivityDate="2013-05-26T20:20:34.323" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1077" PostTypeId="2" ParentId="239" CreationDate="2013-05-26T20:32:05.917" Score="3" Body="&lt;p&gt;There are definitely cases - usually involving IPv6-in-IPv4 tunnels at some point along the path - where even if PMTUD works correctly, MSS negotiation fails. In this case a TCP session may start correctly (since the SYN/ACK packets are small) but no data packets arrive (since those packets are too big for the tunnel). In this case MSS clamping at the far end would help, but is not under control of the &quot;victim&quot; waiting for the packets. The fail-safe solution is for both ends to set the IPv6 MTU to 1280, which should get through any tunnel.&lt;/p&gt;&#xA;" OwnerUserId="1064" LastActivityDate="2013-05-26T20:32:05.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1078" PostTypeId="2" ParentId="1004" CreationDate="2013-05-26T20:34:25.587" Score="2" Body="&lt;p&gt;Personally I think alias' are a bad idea. You never know when you're going to be logging onto a device that doesn't have your favourite alias defined. Then you need to remember what you type form the start again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best thing to do? Just keep typing it out. Eventually your typing speed will improve.&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-26T20:34:25.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1079" PostTypeId="1" CreationDate="2013-05-26T20:39:50.810" Score="-1" ViewCount="187" Body="&lt;p&gt;I have an ADSL2+ (Annex B) line, which uses Rate-Adaptive-Mode. It synced fine with 6000/600 kBit/s down/up for 2 years, which resulted in around 6/0.6 MBit download/upload-speed in my LAN. Now, since about a week or so, client download-speed dropped to 2MBit/s while upload remains stable. The router shows a 6000/600 kBit/s down/up sync speed. Nothing changed in cabling to the router and even if you connect it directly onto the phone-line the same symptoms appear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does DSL-RAM work?  Can sync with high bandwidth (which is shown in Router/DSLAM, which ISP told me) but software dynamically throttles if the cable is too bad?  Or is the bandwidth shown physically possible at the moment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or might this be a hardware-fault?&lt;/p&gt;&#xA;" OwnerUserId="1084" LastEditorUserId="33" LastEditDate="2013-05-28T17:10:18.050" LastActivityDate="2013-05-28T17:10:18.050" Title="DSL-RAM - Bandwidth Problems" Tags="|troubleshooting|terminology|" AnswerCount="1" CommentCount="5" ClosedDate="2019-04-09T00:04:34.690" ContentLicense="CC BY-SA 3.0" />
  <row Id="1080" PostTypeId="2" ParentId="1067" CreationDate="2013-05-26T20:49:08.710" Score="20" Body="&lt;p&gt;IMHO, the biggest disadvantage to OpenVPN is that it's not interoperable with the vast majority of products from &quot;big name&quot; network vendors out there.  Cisco &amp;amp; Juniper's security and router products don't support it - they only support IPsec and proprietary SSL VPNs.  Palo Alto, Fortinet, Check Point, etc. don't support it, either.  So, if your organization / enterprise wants to setup a site-to-site extranet VPN to another company and you've only got an OpenVPN appliance, you're probably going to be out of luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, some network hardware &amp;amp; software companies are starting to embrace OpenVPN.  MikroTik is one of them.  It's been supported since RouterOS 3.x:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/OpenVPN&quot;&gt;http://wiki.mikrotik.com/wiki/OpenVPN&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, for the longest time the only way to run an OpenVPN client on Apple's iOS required jailbreaking.  This is not so, anymore:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://itunes.apple.com/us/app/openvpn-connect/id590379981?mt=8&quot;&gt;https://itunes.apple.com/us/app/openvpn-connect/id590379981?mt=8&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overall, the situation is improving.  However, without vendors like Cisco &amp;amp; Juniper implementing it in their products, I can't see large enterprises adopting it without facing interoperability problems.&lt;/p&gt;&#xA;" OwnerUserId="1079" LastActivityDate="2013-05-26T20:49:08.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1081" PostTypeId="1" CreationDate="2013-05-26T20:54:57.760" Score="12" ViewCount="4167" Body="&lt;p&gt;I am subscribed to two ISPs, a fast expensive one and a cheap but slower one.  They use different technologies, cable and ADSL, so there isn't much of a single point of failure, and all my comms equipment is powered from a UPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISPs in the UK go down in a fairly random pattern.  Over many years I've yet to encounter a moment when both my ISPs have gone down simultaneously, so clearly the two-ISP strategy is helpful if you want uninterrupted net access here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem however is how to organize your site's networking to take advantage of this improved availability.  Many ISPs don't allow you to run your own AS and routing protocols, so you're mostly stuck with splitting your static routing across your two egress pipes by destination.  This is less than brilliant, and requires manual intervention when one ISP drops off the face of the planet.  With the help of numerous scripts I handle ISP outages with reasonable success and not much effort, and it's become business as usual.  It's not great though.  It feels like some technology is missing.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there a better way, generally?&lt;/li&gt;&#xA;&lt;li&gt;Is there a better way for IPv6 only (I have dual stack on one ISP, and could tunnel on the other)?  That would be a clear boon for IPv6.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1088" LastEditorUserId="33" LastEditDate="2013-05-27T02:07:42.810" LastActivityDate="2013-05-27T12:27:00.360" Title="Best practice for dual-homing site with two ISPs?" Tags="|ipv6|routing|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1082" PostTypeId="1" AcceptedAnswerId="1104" CreationDate="2013-05-26T20:58:29.083" Score="7" ViewCount="6394" Body="&lt;p&gt;Aside from the obvious cabling mess you avoid (which I know for us as network engineers is great, but hard to use as an excuse when reasoning with someone who sees no point in it), what do you gain versus copper straight through to a larger core?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Context:&#xA;- Price is of no concern&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Company had already decided on a dual Nexus core.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Option 1: Nexus 7004's, which would be nearly fully populated with 10G SFP+ and aggregate connections to several FEXs at the top of each rack in the DC, as well as aggregate SAN and various server connections&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Option 2: Nexus 7009 cores that will be approx. 1/3 filled up with various modules to accommodate the aggregation of all fiber connections from all devices.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This is a colocated data center&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Standard call center/enterprise domain related services hosted on the network&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;QoS is a very important bulletpoint to emphasize given that this company is a call center&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Problem:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I am unable to justify going with Cisco's &quot;top of rack&quot; setup despite my wanting less of a cabling mess and a more modular design.  I'm unable to do so because you are inserting a point of failure into the network.  Doing this increases the latency (even if it's only by a small amount), etc.  Not only that, but now that I think about it, since all FEXs rely on the Nexus to operate, you not only increase the chance of a hardware failure bringing down a block of devices, but now a software process that could wig out and cause the FEX to malfunction in some way.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, before I put the top of rack design in the idea graveyard for this project, can anyone else see a reason not to go with a larger core and no FEXs given the lack of budget limitation?&lt;/p&gt;&#xA;" OwnerUserId="1090" LastEditorUserId="33" LastEditDate="2013-05-27T03:08:04.740" LastActivityDate="2013-05-27T04:38:38.603" Title="What is the benefit of a Cisco &quot;top of rack&quot; design?" Tags="|cisco|best-practices|cisco-nexus-7k|" AnswerCount="6" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1083" PostTypeId="2" ParentId="1067" CreationDate="2013-05-26T21:00:59.827" Score="6" Body="&lt;p&gt;IPSEC is standard. Almost every networking vendor supports it. You can't achieve the same level of interoperability between routers with OpenVPN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As David said, nothing is wrong with OpenVPN for a client VPN solution. For site to site VPN's or infrastructure solutions I'd pick IPSEC VPN.&lt;/p&gt;&#xA;" OwnerUserId="1049" LastActivityDate="2013-05-26T21:00:59.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1084" PostTypeId="2" ParentId="1067" CreationDate="2013-05-26T21:08:10.533" Score="1" Body="&lt;p&gt;I prefer IPSec almost every time because I'm familiar with it and it just always works.  Being standards based, its supported by nearly everything, from phones and tablets to Windows and Linux machines and it has useful features like NAT support and dead peer detection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI I use primarily Openswan on Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the major security reasons we prefer IPSec is rotating session keys.  OpenVPN may have implemented this (but I don't see it).  This means that an attacker who passively captures data long-term can't brute-force the entire communication log at once, but only each individual session key's worth.&lt;/p&gt;&#xA;" OwnerUserId="1091" LastEditorUserId="1091" LastEditDate="2013-05-29T20:57:47.620" LastActivityDate="2013-05-29T20:57:47.620" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1085" PostTypeId="2" ParentId="1081" CreationDate="2013-05-26T21:10:10.660" Score="11" Body="&lt;p&gt;What kind of equipment do you have connecting to the providers? If it is a Cisco device you could use IP SLA to ping a destination like 8.8.8.8 over the primary ISP. As soon as you don't get a reply failover to the other static route. Example config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! ISP1&#xA;ip route 0.0.0.0 0.0.0.0 x.x.x.x track 1&#xA;! ISP2&#xA;ip route 0.0.0.0 0.0.0.0 y.y.y.y 250&#xA;ip sla 1&#xA;icmp-echo 8.8.8.8 source-interface &amp;lt;ISP1_interface&amp;gt;&#xA;frequency 3&#xA;timeout 1000&#xA;ip sla schedule 1 life forever start-time now&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may have to put a static route for 8.8.8.8 over ISP1 to make it always exit out that path. Obviously if you really use 8.8.8.8 choose another IP because otherwise you won't have reachability to it if ISP1 goes down.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!x.x.x.x is next-hop to ISP1&#xA;ip route 8.8.8.8 255.255.255.255 x.x.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-26T21:10:10.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1087" PostTypeId="2" ParentId="1081" CreationDate="2013-05-26T21:11:38.003" Score="2" Body="&lt;p&gt;Q1. You can install a router/firewall that supports multihoming. In terms of free software, pfSense fits the bill. &lt;a href=&quot;http://www.pfsense.org/&quot; rel=&quot;nofollow&quot;&gt;http://www.pfsense.org/&lt;/a&gt;. The pfSense docs refer to this as Multi-WAN. &lt;a href=&quot;http://doc.pfsense.org/index.php/Multi-WAN_2.0&quot; rel=&quot;nofollow&quot;&gt;http://doc.pfsense.org/index.php/Multi-WAN_2.0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Helpfully, pfSense has automatic failover and load balancing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have found is that a small number of web apps do not work when you are multihomed. The web apps are usually financial sites, like banks. For some reason, web app programmers sometimes think it is OK to test security on the basis of IP address. For users who need this access, you can reserve an IP address for their computer, and create a &quot;LAN rule&quot; in pfSense to always use a certain gateway and not the other for that IP address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find that this works quite well for the combination of cable modem and ADSL modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2. There is no reason why multihoming wouldn't work in IPv6 as well as IPv4. That said, pfSense does not have a fully-supported release that properly handles IPv6. The current version of pfSense is 2.0x. Once 2.1 is released, pfSense will have good IPv6 support and will include multihoming.&lt;/p&gt;&#xA;" OwnerUserId="1093" LastActivityDate="2013-05-26T21:11:38.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1088" PostTypeId="2" ParentId="1067" CreationDate="2013-05-26T21:14:11.923" Score="1" Body="&lt;p&gt;OpenVPN does not have certain regulatory certifications, like FIPS 140-2 support.&lt;/p&gt;&#xA;" OwnerUserId="1093" LastActivityDate="2013-05-26T21:14:11.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1089" PostTypeId="2" ParentId="1082" CreationDate="2013-05-26T21:17:50.757" Score="13" Body="&lt;p&gt;As for benefits, first cables get sloppy and when you have sloppy, problems will occur. I have seen infrastructure cabling go bad for a number of reason in a data center. Need more cables? Then someone is messing with the cable plant and something could get damaged.  Dealing with nearly 400 cables plugged into a device leads to more accidental disconnects than 48.  It's just far easier to manage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, this helps to future proof.  While there is 10Gbps copper, the distance limitations can be problematic depending on the situation.  Additionally, 10G copper tends to draw additional power the longer you go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third, FEXes can be more easily replaced.  Want to switch from 1Gbps copper to 10Gbps SFP+, just change the FEX.  Your core stays the same and the configuration stays largely in place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see the negatives you provide, and only see benefits for doing so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your data center setup, I would go with either two fabric extenders at the top of the rack or one (if servers can shared with neighboring racks).  Servers should be connected to two separate extenders.  Each fabric extender can be connected with FET's to both Nexus 7k (which should also be connected).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should reduce your chance of failure.  FEXes are an extension of the chassis (read designed for data center w/high MTBF) and more similar to a module in a 1U &quot;body&quot; as opposed to a secondary distribution or access device.  They boot they boot the software off the core, so there is no software difference.  You can lose a 7k or an extender without loss of service anywhere.  Potentially a 7k and a number of extenders without losing service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also then manage this as a single logical unit, allowing things like servers can actually do link aggregation even while connected to two different extenders, both increasing performance and reducing chance of failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't see how this would increase the latency in any way and it may actually improve it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you start using the more advanced features of Nexus, I can only see more benefits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, you need to make the choice for your own needs.  But I will say this, if you research how the top internet companies run their data centers, you will find that most of the have some sort of top of rack deployment.  They don't choose this because it increases their downtime or decreases performance.  They do this because it reduces downtime, increases performance, and greatly increases manageability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Consolidating from my comments so I can delete.  The comment train is too long at present on this answer to be useful.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-27T02:51:17.543" LastActivityDate="2013-05-27T02:51:17.543" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="1090" PostTypeId="2" ParentId="123" CreationDate="2013-05-26T21:19:49.373" Score="3" Body="&lt;p&gt;Personally, if the network is for the most part an all Cisco shop, meaning at least your access layer is setup with Cisco switches; I would look at port security and DHCP Snooping as a way to guard against this type of issue.  Setting a max of 1 MAC address on all Access ports would be extreme but would ensure that only 1 device could show up on a switchport at a time.  I would also set the port to shutdown if more than 1 MAC shows up.  If you decide to allow more than 1 MAC, DHCP snooping would help as most consumer grade Wireless Routers introduce DHCP in the local subnet when the end user plugs the device into the switchport.  At that point port security would shut the switchport down once DHCP snooping detects that the Access Point is offering DHCP.&lt;/p&gt;&#xA;" OwnerUserId="1096" LastActivityDate="2013-05-26T21:19:49.373" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1091" PostTypeId="1" CreationDate="2013-05-26T21:25:15.977" Score="0" ViewCount="5519" Body="&lt;p&gt;Given the advantages to be gained by creating a BGP session with a remote AS over a VPN connection (such as traffic ingress and egress control) why are there no providers offering this type of service?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HE.net has a IPv6 tunnel service that almost like this for IPv6 Tunneling, but why isn't anyone offering VPN based BGP sessions?&lt;/p&gt;&#xA;" OwnerUserId="1100" LastEditorUserId="33" LastEditDate="2013-05-26T21:51:05.633" LastActivityDate="2013-05-27T03:48:24.627" Title="Advantages to BGP peering over VPN" Tags="|bgp|vpn|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1092" PostTypeId="2" ParentId="1050" CreationDate="2013-05-26T21:25:53.810" Score="8" Body="&lt;p&gt;According to the FastIron config guide:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  If the primary interface of a trunk is enabled for monitoring, the entire trunk will be monitored. &#xA;You can also enable an individual trunk port for monitoring using the config-trunk-ind command&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Trunk in this sense being the FastIron term for an aggregated interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this didn't work you could use a TAP, or push a link through another switch, tunnel LACP through that switch, then mirror the switch port&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-05-26T22:27:32.950" LastActivityDate="2013-05-26T22:27:32.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1094" PostTypeId="2" ParentId="1081" CreationDate="2013-05-26T21:35:19.630" Score="8" Body="&lt;p&gt;You might want to investigate if there is a &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6830&quot; rel=&quot;nofollow noreferrer&quot;&gt;LISP&lt;/a&gt; provider available. LISP is a protocol that can make a site independent from the upstream ISPs it connects to. You get one or more IP addresses from the LISP ISP and they route them to wherever you are connected. It is a tunnelling technique, but with a lot of cool features. You can control both inbound and outbound load balancing over the links, you can do IPv6 multihoming without having to resort to hacks like NPT66 (prefix translation). You could even move to the other side of the planet without changing IP addresses ;-)&lt;/p&gt;&#xA;&lt;p&gt;I use LISP myself and my office network has a block of /26 IPv4 and a /48 block of IPv6 addresses that are independent of the upstreams (a UPC cable connection with one dynamic IPv4 address and a Solcon DSL connection with both a static IPv4 address and a static block of IPv6 addresses). A Cisco 1841 runs LISP in the office and uses whatever link is available to connect to the rest of the Internet. As long as one link works my office is connected using its own addresses.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Full disclosure&lt;/em&gt;: I run my own LISP based ISP in The Netherlands, so I am biased. LISP is still a cool protocol though :-)&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-05-26T21:35:19.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1095" PostTypeId="2" ParentId="123" CreationDate="2013-05-26T21:37:27.587" Score="4" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Only if the AP is in bridging mode, can you catch it with port security.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Limiting the number of MAC addresses will not help, in the event the rogue AP is also configured as a &quot;Wireless Router&quot;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DHCP snooping is helpful, in that it will catch the Wireless AP, connected in backward, i.e., if the LAN port of the rogue devices that has DHCP enabled is connected to your network, DHCP snooping will drop the traffic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;With minimal budget, DHCP snooping is my only option, I just wait until a user is dumb enough to plug their AP in backwards ... then I go hunting :)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1019" LastEditorUserId="56030" LastEditDate="2020-06-06T13:52:29.113" LastActivityDate="2020-06-06T13:52:29.113" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1096" PostTypeId="1" AcceptedAnswerId="1102" CreationDate="2013-05-26T21:41:45.800" Score="6" ViewCount="915" Body="&lt;p&gt;One of my colleagues and I have gotten into a debate about netflow. He's an old Cisco hand and I've recently joined the cisco ops team after working on Juniper for a few years. The debate is whether netflow can be left on all the time or should only be used for temporary diagnostic purposes. I've reviewed the Cisco documentation and it says nothing about if being a short term only monitoring solution (or that leaving it on is in anyway problematic). Any pointers one or the other would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="1106" LastActivityDate="2013-05-27T04:14:45.367" Title="Can netflow be left on all the time?" Tags="|cisco|netflow|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1097" PostTypeId="2" ParentId="1096" CreationDate="2013-05-26T21:43:02.513" Score="4" Body="&lt;p&gt;We've got netflow running on loads of Cisco boxes 24/7 - Netflow is not a debug or traceoptions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've not seen any problems&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-26T21:43:02.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1098" PostTypeId="2" ParentId="1079" CreationDate="2013-05-26T21:45:14.693" Score="1" Body="&lt;p&gt;Try another router/cable/filter and see if the problem remains. If so, probably ISP fault&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-26T21:45:14.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1099" PostTypeId="2" ParentId="1096" CreationDate="2013-05-26T21:45:16.313" Score="2" Body="&lt;p&gt;in an all Cisco shop I've got neflow running 24/7 for a few years now. no issues at all&lt;/p&gt;&#xA;" OwnerUserId="1019" LastActivityDate="2013-05-26T21:45:16.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1100" PostTypeId="2" ParentId="123" CreationDate="2013-05-26T21:45:28.800" Score="0" Body="&lt;p&gt;Nessus has a plugin for detecting rogue APs - you could script a scan to look periodically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.tenable.com/blog/using-nessus-to-discover-rogue-access-points&quot; rel=&quot;nofollow&quot;&gt;http://www.tenable.com/blog/using-nessus-to-discover-rogue-access-points&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1103" LastActivityDate="2013-05-26T21:45:28.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1101" PostTypeId="2" ParentId="1096" CreationDate="2013-05-26T21:49:09.953" Score="4" Body="&lt;p&gt;Absolutely, providing that you design correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that it may increase CPU (especially under abnormal circumstances) and that it adds traffic on the path to your collector.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you CPU is rather idle and you don't have to worry about saturating your links, then there should be no issue.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-26T21:49:09.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1102" PostTypeId="2" ParentId="1096" CreationDate="2013-05-26T21:50:29.313" Score="10" Body="&lt;p&gt;The new Cisco product line does netflow in hardware (and I believe the previous generation as well), but when I approach this question here are the things I typically ask myself:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1: Can I afford the bandwidth (i'm sure this won't be a problem most of the time)&lt;/li&gt;&#xA;&lt;li&gt;2: Is netflow done in hardware on this device?&lt;/li&gt;&#xA;&lt;li&gt;3: Can I afford the CPU cycles (if applicable)&lt;/li&gt;&#xA;&lt;li&gt;4: how long you want to store said data on the device&lt;/li&gt;&#xA;&lt;li&gt;5: how long should the data be stored on the aggregation point&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have only found benefits when leaving it on all the time, but I also keep an eye on how it's affecting the performance of my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To each his own!&lt;/p&gt;&#xA;" OwnerUserId="1090" LastActivityDate="2013-05-26T21:50:29.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1103" PostTypeId="2" ParentId="1091" CreationDate="2013-05-26T21:53:44.013" Score="3" Body="&lt;p&gt;Even if you peer with another AS that is down/upstream from you, unless you are directly connected there is no real way to engineer the path traffic will take. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why it can be handy in examples such as HE is that your upstream might not support IPv6 yet but you want to start running it within your AS and so need a tunnel out to them. &lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-26T21:53:44.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1104" PostTypeId="2" ParentId="1082" CreationDate="2013-05-26T21:56:09.377" Score="7" Body="&lt;p&gt;Keep in mind that a FEX inherently is a method by which to extend the fabric, thus the name. The ability to manage centrally while still having &quot;line cards&quot; distributed throughout the DC is the real reason to use a FEX. Drastically reducing cabling is valuable to anyone, technical or not, and the argument of being able to manage the entire infrastructure at fewer points is time savings, pure and simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of your big doubts is that you're worried about single points of failure. All devices have the ability to be dual-homed, and in certain configurations, you can even establish virtual port channels with the Nexus 2K FEXs themselves. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/nexus2000/sw/configuration/guide/rel_4_1/Cisco_Nexus_2000_Series_Fabric_Extender_Software_Configuration_Guide_chapter2.html#concept_090B6DECCB594BC7AE8368433FFB3B3B&quot; rel=&quot;noreferrer&quot;&gt;Cisco's documentation&lt;/a&gt;. You'll find that you can design a topology that is just as redundant as the &quot;direct-cable&quot; option you're considering, with less fuss.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastEditorUserId="441" LastEditDate="2013-05-27T01:00:55.217" LastActivityDate="2013-05-27T01:00:55.217" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1105" PostTypeId="2" ParentId="1029" CreationDate="2013-05-26T22:09:16.960" Score="14" Body="&lt;p&gt;This is a very informal way of looking at the difference between VLANs and subnets, but it's not inaccurate (just incomplete).  It may help networking newcomers get a little bit closer to the right mental picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two different VLANs on a single switch or host are like two physically separate switches.  They partition the MAC address space, in that communications between two parties on a single VLAN or on a single physical switch don't involve any other parties on the MAC-level (layer 2) network.  The VLAN or physical switch limits the extent of MAC-level message propagation, keeping it as local as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast, IP subnets exist at layer 3 and partition the IP address space, not the MAC address space, but with a similar purpose:  to limit the extent of message propagation.  Any partitioning at the MAC-level layer 2 network below is entirely transparent to layer 3, which means that VLANs and/or separate physical switches can be treated as one single continuous layer 2 medium from the point of view of IP-level networking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conversely, switches and VLANs don't even see IP addresses nor IP subnetting (with some minor provisos which can complicate the picture).  Everything at layer 3 and higher is just payload to them at the layer 2 MAC level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary:  VLANs and subnets partition different layers of the network model.  There is no circumstance in which they are interchangeable terms.&lt;/p&gt;&#xA;" OwnerUserId="1088" LastEditorUserId="1088" LastEditDate="2013-05-26T22:16:36.233" LastActivityDate="2013-05-26T22:16:36.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1106" PostTypeId="2" ParentId="1029" CreationDate="2013-05-26T22:12:24.970" Score="1" Body="&lt;p&gt;In my experience, these days, they are considered the same until you use a protocol other than IP directly on top of Ethernet.&lt;/p&gt;&#xA;" OwnerUserId="1090" LastActivityDate="2013-05-26T22:12:24.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1107" PostTypeId="2" ParentId="1029" CreationDate="2013-05-26T22:19:29.010" Score="3" Body="&lt;p&gt;They are very much different. However a lot of terms (megabit, megabyte, memory, hard drive, etc) get miscommunicated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often we have customers asking us to move a vlan from one site to another, when really what they want is to move a subnet over. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You get used to it, even though I try and correct them (politely)&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-26T22:19:29.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1108" PostTypeId="2" ParentId="1082" CreationDate="2013-05-26T22:23:42.357" Score="3" Body="&lt;p&gt;There isn't much difference (apart from the cost) between running cables directly to the core, or using fabric extenders in between.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If you cable your servers directly to the cores, you'll connect each server with two links, one to each core switch. This way even if one core switch fails, the other keeps the service up. &lt;/li&gt;&#xA;&lt;li&gt;If you fabric extenders on top of each rack, Your servers are connected by two links to two different fabric extenders which are both connected to two core switches. The link between the FEX and Core Switch is a L1 link and the entire setup of fabric extenders behave as a single logical switch. The setup will not introduce additional STP nodes, hence there shouldn't be any more latency than the first option. For loss of connectivity, either both Core switches or both FEXs or their corresponding links should fail. The failure of a single FEX or Core Switch wouldnt affect the service. While the Fabric extenders are a relatively newer idea, the way the work is actually better than option 1. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Since you mentioned that you mentioned that budgets aren't an issue, you might want to size your Nexus 7Ks (and fiber connectivity) to have sufficient capacity to support a future upgrade to 40G or 100G. The FEXs can be installed to suit current requirements. Later on, in case you want to upgrade to 100G you'll just have to replace the FEXs without having to change your Nexus 7ks or the cabling. &lt;/p&gt;&#xA;" OwnerUserId="1000" LastActivityDate="2013-05-26T22:23:42.357" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1109" PostTypeId="2" ParentId="99" CreationDate="2013-05-26T22:25:51.943" Score="3" Body="&lt;p&gt;Fiber is also useful to protect the equipment when the placement of the cable has the risk of getting hit by lightnings. A stretch of fiber at both ends of a copper link can also serve this same purpose.&lt;/p&gt;&#xA;" OwnerUserId="1112" LastActivityDate="2013-05-26T22:25:51.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1110" PostTypeId="2" ParentId="1082" CreationDate="2013-05-26T22:34:23.623" Score="1" Body="&lt;p&gt;Ultimately, without a budget limitation, it doesn't make sense not to simply go with the 7009 design since there are less devices affected by the failure of a single line of fiber than of an entire fabric extender.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, the fabric extender is both an extra hardware and software point of failure within an environment that doesn't have a need for the extra port density beyond what the core device provides.&lt;/p&gt;&#xA;" OwnerUserId="1090" LastActivityDate="2013-05-26T22:34:23.623" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1111" PostTypeId="2" ParentId="1081" CreationDate="2013-05-26T22:35:38.153" Score="1" Body="&lt;p&gt;You could setup a remote server/VPS in a reliable data center and then you could setup VPN tunnels from your router to the remote server over each ISP. Now your router at home could route packets over these tunnels based on a bandwidth ratio, and then the remote server can route the traffic between the rest of the internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The disadvantage is that you'll incur additional cpu, storage and bandwidth costs for the remote server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage is that you can use the entire bandwidth provided by both the providers while still having a fail over option for reliability. &lt;/p&gt;&#xA;" OwnerUserId="1000" LastActivityDate="2013-05-26T22:35:38.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1112" PostTypeId="2" ParentId="1033" CreationDate="2013-05-27T00:23:52.690" Score="0" Body="&lt;p&gt;As others have mentioned, Access Ports are the way to go, but in a Colo senario I would look at Private VLAN's as a way to isolate every customer from each other by using Isolated ports thus saving on addressing space in your DC.&lt;/p&gt;&#xA;" OwnerUserId="1096" LastActivityDate="2013-05-27T00:23:52.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1113" PostTypeId="1" AcceptedAnswerId="1199" CreationDate="2013-05-27T00:36:43.177" Score="2" ViewCount="439" Body="&lt;p&gt;I just started on an upgrade project, 3G-&gt; 4G, with network flow documentation in PNG, BMP and Visio files (500+ flows). The HLD and LLD documents have been written however it appears from reading them that a lot of the drawings were not very accurate (out of date)/some look like they were made up and now we need to verify everything again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What approach can I adopt to improving the network flow documentation so that our time is not spent just updating Visio and Word documents? From where it stands we may have to document from scratch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like that the work I now do is reusable, updatable and well documented ensuring that the next Engineers who work on this can understand the history and the changes implemented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Caution: This is NOT an open-ended question, please, I have a specific problem that I need to solve and I want a straight forward answer from those who have experienced this and solved it or have seen it being solved successfully - &lt;em&gt;I do not need theories or opinions I need what works&lt;/em&gt;!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: 2017/08/08&#xA;Seems I have to accept my own research as it did actually help me, but I was hoping someone would have shown something mind blowing too. &lt;/p&gt;&#xA;" OwnerUserId="504" LastEditorUserId="504" LastEditDate="2017-08-08T13:02:48.943" LastActivityDate="2017-08-08T13:02:48.943" Title="Improving Network Flow Documentation in 3G-&gt;4G upgrade project" Tags="|design|hardware|documentation|knowledgebase|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1114" PostTypeId="2" ParentId="1033" CreationDate="2013-05-27T00:52:12.620" Score="0" Body="&lt;p&gt;trunk port with allowed vlan (theirs) and native vlan encapsulate. &#xA;mimics an access port but lets you throw multiple vlans at a later stage if you want.&#xA;Though it depends again on what they've bought from you as described above.&lt;/p&gt;&#xA;" OwnerUserId="203" LastActivityDate="2013-05-27T00:52:12.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1117" PostTypeId="2" ParentId="493" CreationDate="2013-05-27T02:06:57.113" Score="1" Body="&lt;p&gt;I've successfully used MMF cable on a 1000Base LX/LH SFP, you need a mode conditioning patch cord. This was an ugly temp fix, once we got the correct SFP everything was back to normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/modules/ps5455/product_bulletin_c25-530836.html&quot; rel=&quot;nofollow&quot;&gt;Mode conditioning patch cord&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1019" LastActivityDate="2013-05-27T02:06:57.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1119" PostTypeId="2" ParentId="1091" CreationDate="2013-05-27T03:48:24.627" Score="5" Body="&lt;p&gt;This kind of trick was used by certain ISP's abusing peering relationships - provider A peers at two points (let's say east and west coast of the US).  Provider A builds a tunnel between his peering nodes across B's network and B is suddenly unwillingly providing free cross-country bandwidth.  Needless to say, this kind of behavior was (and is) highly frowned upon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now - as to the use of BGP over VPN tunnels for transit/end users there are a couple of problems:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.)  The routing of the underlying tunnels is completely opaque.  Assuming you have two tunnels to two different providers it is possible (...if not likely in the case of consumer grade service) that these tunnels could traverse some of the same intermediate points, which kind of defeats the purpose if HA is the goal in mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) Supply and demand - Sure, ISP's &lt;em&gt;could&lt;/em&gt; offer these kinds of services but realistically who is buying them?  If you're at a point where you've secured an ASN and have either gotten PI space (unlikely) or negotiated appropriate route leaking, chances are that you're spending a fair amount on transit service (at a minimum).  In contrast, consumers spending $59 USD a month for Internet service aren't likely to provide the revenue to (profitably) offset not only the cost of the hardware to land tons of BGP sessions but also the operational overhead of maintaining and supporting said sessions.  There's also a hidden cost in terms of the backhaul of traffic that's even less likely for ISP's to want to pay for.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-05-27T03:48:24.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1120" PostTypeId="2" ParentId="1082" CreationDate="2013-05-27T04:03:30.857" Score="4" Body="&lt;p&gt;1.) Odds are good that if you're in colo space that you'd want to look at the 7010 with front-to-back airflow rather than the 7009 with side-to-side.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) One of the obvious points in the ToR vs centralized switching discussion is usually scalability.  If your colo footprint is pretty much fixed then it's not much of a concern.  If it's slated to grow in any appreciable manner then having the ability to expand the network in a rational manner should be a consideration.  That said, I probably would be reluctant to use a 7004 as the concentration point for the FEX units if growth were a concern.  The 7K can run to 48 extenders at the moment, and is likely to go higher in the future.  If you're going to be at 6 cabinets for the duration, however, it doesn't much matter either way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.) The unknown here (at least based on the initial question) is the density of servers in the racks.  If it's 6-8 4U's then the FEX is overkill.  If it's many dozens of GE links from 1U's or blade pass-throughs then the cabling argument takes on a more serious cast.   I've seen certain (dysfunctional) setups with 384+ cables to a single rack.  It's not something I want to see again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All-in-all the main difference between a small 7K hosting a bunch of FEX units and a larger 7K home-running those same connections isn't going to be tremendous at small scale.  As has been mentioned above, the FEX just shows up as another line card on the chassis.  With a very few exceptions features and functions of FEX ports are going to be equivalent to native ports and will be managed as such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also - Contrary to popular suspicion the performance penalty of using a FEX isn't significant if correctly designed.  Arguments about latency are measured in microseconds (and the whole design is better addressed with a different platform altogether if this -is- an issue). &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-05-27T04:03:30.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1121" PostTypeId="2" ParentId="1096" CreationDate="2013-05-27T04:14:45.367" Score="3" Body="&lt;p&gt;Which models?  Sampling enabled?  Flow aggregation?  Expected traffic mix?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of these need to be asked- and answered- to determine the use of Netflow.  In &lt;em&gt;general&lt;/em&gt; the following observations tend to be true-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) The amount of actual traffic generated by NDE is very rarely an issue for enterprise networks.  Thousands of flows per minute can translate to a few kilobits of actual exported data.  If a given device is large enough to export a substantial volume of data, chances are excellent that this device has ample bandwidth available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) CPU overhead can be a factor on some platforms, but typically only if CPU utilization is already on the high side, and moreso on older software-based platforms.  If CPU is low and the box handles it in hardware, I wouldn't generally worry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.) On newer boxes you have the ability to define what sorts of traffic you want to observe, methods to aggregate updates and - most importantly - facilities for taking a sampling of traffic - so analyzing one in one thousand vs all packets on the box.  This makes a huge difference - and, indeed, makes it even -possible- in higher volume environments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.) As I alluded to above, the &lt;em&gt;type&lt;/em&gt; of traffic you're monitoring can make a tremendous difference.  Hundreds of gigabits in a few long-lived flows consumes few resources while a few megabits of DoS attack from random addresses/ports can be a lot more stressful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, however, if you've turned on Netflow for diagnostic purposes and the CPU isn't getting hit too hard then it's more than likely fine to leave on for the duration.  I'll also mention that NF was intended to be used on on ongoing basis - and that most shops who use it run it that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB: Your colleague may have been using RE-based flow generation on Juniper boxes.  This requires explicitly redirecting traffic to the processor on the box and is generally recommended against unless fairly heavily sampled.  On newer geart (both Juniper and Cisco) most of the heavy lifting is dealt with in hardware and thus isn't as potentially service effecting.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-05-27T04:14:45.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1122" PostTypeId="2" ParentId="966" CreationDate="2013-05-27T04:28:37.500" Score="3" Body="&lt;p&gt;I have to disagree with much of the above.  I've dealt with literally hundreds of flaky line cards and bad power supplies at a time whose basic issue came back to incorrect installation where it was (incorrectly) assumed that a correctly grounded power cable was all that was required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lug on the chassis exists for a reason and its non-use can- and sometimes will- result in problems with Smartnet entitlement.  Do folks get away without it?  Sure.  If there's a problem it's likely to manifest as a flaky stability issue at an indeterminate point in the future.  The lugs are cheap.  There's no reason to skip this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're in a colo/DC environment then the equipment cabinets/racks should have been tied together already to provide shared grounding (..in addition to being bolted together metal-to-metal).  Consider why this would be if basically all modern equipment has three- or four- wire power? &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-05-27T04:28:37.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1123" PostTypeId="2" ParentId="1082" CreationDate="2013-05-27T04:38:38.603" Score="3" Body="&lt;p&gt;Price is usually one of the big drivers for a &quot;top of rack&quot; design, and you've said cost is no object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've used it for two other reasons though that I hadn't seen listed yet: modularity or ease of deployment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a standard &quot;rack&quot; design you can build and test an entire rack (or group of racks) together as one module, or buy them ready-built.  Then you just have to connect a few cables at the top, instead of re-connecting all the machines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other case with top of rack can make a lot of sense (or top of a few racks, depending on your application) is if you have a standard build configuration to deploy a &quot;cell&quot; of your infrastructure.  Sometimes communication within a &quot;cell&quot; is high (for example: web server, app server, db server, image server etc).  Not everyone has this sort of configuration, but it can be handy so you can performance characterize a cell, and scaling out means adding more cells instead of growing all your infrastructure (which can cause more performance suprises).&lt;/p&gt;&#xA;" OwnerUserId="999" LastActivityDate="2013-05-27T04:38:38.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1124" PostTypeId="2" ParentId="1038" CreationDate="2013-05-27T04:59:42.987" Score="0" Body="&lt;p&gt;I would have to second the answer from hyussuf, as I was just about to respond the same.  If you absolutely cannot purchase any additional (new) hardware, running openvpn is probably the right answer for you.  I haven't used pfsense personally, but I have used LEAF as a dedicated firewall instance (running shorewall).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not specifically familiar with the Fortigate appliance, but, if I'm not mistaken, the appliance you reference supports IPSec VPN tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.fortinet.com/products/fortigate/111C.html&quot; rel=&quot;nofollow&quot;&gt;http://www.fortinet.com/products/fortigate/111C.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, do you have a specific reason you want/need to use the SSL VPN in place of the ipsec vpn? &lt;/p&gt;&#xA;" OwnerUserId="1181" LastActivityDate="2013-05-27T04:59:42.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1125" PostTypeId="1" CreationDate="2013-05-27T05:28:52.777" Score="-2" ViewCount="228" Body="&lt;p&gt;I have a set of 30 Linux machines each connected to a Cisco 1 GB switch. I am seeing the following issues:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ping time between machines are different.&lt;/li&gt;&#xA;&lt;li&gt;File transfer rate is different between these machines.&lt;/li&gt;&#xA;&lt;li&gt;Number of UDP packets received by these machines are different.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Checked switch and each port is functioning at 1 GB.&lt;/li&gt;&#xA;&lt;li&gt;Made sure that the correct Ethernet modules are installed and compiled again.&lt;/li&gt;&#xA;&lt;li&gt;Most (25) machines are identical in hardware/make and model.&lt;/li&gt;&#xA;&lt;li&gt;Changes switch not much of the difference.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What are the steps/ideas to get to the bottom of this issue? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is installing some monitoring software on all machines may not be possible but at most another machine can be added and that can be used to monitor the network, but what kind of things to start looking at?&lt;/p&gt;&#xA;" OwnerUserId="1186" LastEditorUserId="441" LastEditDate="2013-05-27T11:41:43.190" LastActivityDate="2013-05-28T16:13:23.863" Title="Network debugging" Tags="|monitoring|" AnswerCount="2" CommentCount="8" ClosedDate="2019-04-09T00:03:17.563" ContentLicense="CC BY-SA 3.0" />
  <row Id="1126" PostTypeId="1" AcceptedAnswerId="1128" CreationDate="2013-05-27T05:54:08.580" Score="6" ViewCount="2515" Body="&lt;p&gt;When monitoring interface errors, what percentage of traffic should you set your 'critical' threshold to according to best practices and does it depend on the interface type (T1, Ethernet etc)? It would be a huge bonus if you can explain the justification for the particular percentage. I've found a few thread comments on various sites that mention 1%, but with no real justification.&lt;/p&gt;&#xA;" OwnerUserId="1189" LastEditorUserId="775" LastEditDate="2013-05-27T18:45:16.067" LastActivityDate="2013-05-27T18:45:16.067" Title="Monitoring best practice for thresholding errors on an interface?" Tags="|ethernet|monitoring|best-practices|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1128" PostTypeId="2" ParentId="1126" CreationDate="2013-05-27T06:43:59.287" Score="4" Body="&lt;p&gt;Ethernet standard officially allows 10^-12 bit-error-rate, while in practice the hardware meet much better BER than which standard demands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should also be able to bing for 'SQA' (Service Quality Assurance) or 'SLA' (Service Level Agreement), some companies publish them, you could use them to check what your competitors are offering and offer something to that level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our SQA states to customers that 0.02% is minor fault (we will fix if ticket is opened), which I think is quite large packet loss for fibre connection, but same SQA covers also DSL so we didn't want to be too aggressive with it. So far this has been sufficient to customers, but we are prepared to reduce the number if it is hurting sales.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several bingable tools online, where you can check how much packet loss hurts TCP, which can be useful information when deciding what is acceptable loss for your application/product:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://wand.net.nz/~perry/max_download.php&quot; rel=&quot;nofollow&quot;&gt;http://wand.net.nz/~perry/max_download.php&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.switch.ch/network/tools/tcp_throughput/index.html&quot; rel=&quot;nofollow&quot;&gt;http://www.switch.ch/network/tools/tcp_throughput/index.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-27T06:43:59.287" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1129" PostTypeId="2" ParentId="1126" CreationDate="2013-05-27T06:44:12.873" Score="2" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;How long to generate traffic?&lt;/p&gt;&#xA;&lt;p&gt;Ethernet/SONET networks are often deployed with GBICs,SFPs,or XFPs.Depending on the quality of the GBICs,SFPs,and XFPs, the network may havea guaranteed error rate of 10-12 to 10-15. For a standard GigE network at an error rate of 10-12, the user will experience a few errors a day. At an error rate of 10-15, the user will experience about one error a week. A 15-minute error-free test should be run to confirm that the network is properly provisioned and that the circuit is capable of handling the traffic. Longer tests offer more statistical information into the quality of the circuit and shorter tests offer less information.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.jdsu.com/ProductLiterature/fundethernet_wp_cpo_tm_ae.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source:&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;For 10-Gigabit Ethernet there is a BER recommendation of 10^-13 to acheive the same number of errors per day as for Gigabit Ethernet.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://grouper.ieee.org/groups/802/3/10G_study/public/july99/chang_2_0799.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source:&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Some other &lt;a href=&quot;https://www.iol.unh.edu/services/testing/10gec/knowledgebase/Bnoseworthy_10Gig.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;sources&lt;/a&gt; say 10^-12 for 10GE. If you set it to both 10^-12 for both GE and 10GE that would probably be a good number.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-05-27T06:44:12.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1130" PostTypeId="2" ParentId="1126" CreationDate="2013-05-27T06:49:56.763" Score="0" Body="&lt;p&gt;1% loss on a 10g link can be a huge problem these days for many network devices.  If you're looking at inside a rack / datacenter, you should really be trying to minimize the instances of packet loss / errors within your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Errors can also be things like switches turning into hubs by accident (Dell 55xx switches have a bug in them in some firmware versions that disables their mac learning after 49.5 days)&#xA;- One reason we caught it was because we had been tracking the links over a long time and got flooded with traffic for MAC's we didn't have on our switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also for those with AC or other lines installed in a tray, you might see some increased error rates, which might help prove to management that you should really re-locate some of the cable in the plenum or upgrade to fiber lines for these runs.&lt;/p&gt;&#xA;" OwnerUserId="1196" LastActivityDate="2013-05-27T06:49:56.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1131" PostTypeId="2" ParentId="526" CreationDate="2013-05-27T07:09:25.920" Score="3" Body="&lt;p&gt;AFAIK GRE support is limited to VPN services or as an access-pseudowire. At least according to ALU there is no way to use GRE as a logical tunnel on the 'network' side. This would require a service blade. However, I haven't tested this but it seems to be the official story.&lt;/p&gt;&#xA;" OwnerUserId="1197" LastActivityDate="2013-05-27T07:09:25.920" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1132" PostTypeId="2" ParentId="1125" CreationDate="2013-05-27T07:20:33.747" Score="1" Body="&lt;p&gt;Because ping times are distinct, the problem should be between layer 1 and layer3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the first step is to see if it is a layer1 issue. I would check the errors on the switch interfaces. If errors are appearing on the interfaces, I will try to change the cables or the interfaces on the switch to see if the problem is persistent for the same Linux devices.&#xA;If still persists, Linux servers should have the problem.&lt;/p&gt;&#xA;" OwnerUserId="1201" LastActivityDate="2013-05-27T07:20:33.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1133" PostTypeId="2" ParentId="653" CreationDate="2013-05-27T07:41:12.140" Score="3" Body="&lt;p&gt;What about using the MAC table?  It lists the MAC addresses with the interfaces and it ages them out. You would have to take the list out of IOS to do a filtered list of unique addresses.&lt;/p&gt;&#xA;" OwnerUserId="1203" LastEditorUserId="105" LastEditDate="2013-05-27T09:15:23.670" LastActivityDate="2013-05-27T09:15:23.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1134" PostTypeId="1" CreationDate="2013-05-27T07:45:06.090" Score="15" ViewCount="3305" Body="&lt;p&gt;Can anyone answer why does BGP RR only reflect the best path?&lt;/p&gt;&#xA;" OwnerUserId="18" LastEditorUserId="105" LastEditDate="2013-05-27T09:12:45.393" LastActivityDate="2013-05-28T17:14:34.743" Title="Why does BGP RR only reflect the best path?" Tags="|bgp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1135" PostTypeId="2" ParentId="1134" CreationDate="2013-05-27T07:46:16.740" Score="18" Body="&lt;p&gt;To conserve memory at destination, it was not important to micro-optimize forwarding path in the past. This is quote from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4456&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4456&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;One of the key component of the route reflection approach in&lt;br /&gt;&#xA;addressing the scaling issue is that the RR summarizes routing&lt;br /&gt;&#xA;information and only reflects its best path.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;While scaling is always important, clearly there are today scenarios where we'll rather spend RIB memory than choose suboptimal path.&lt;/p&gt;&#xA;&lt;p&gt;To address this issue there is &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-walton-bgp-add-paths-06&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP AddPath&lt;/a&gt; and &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-idr-bgp-optimal-route-reflection-04&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP optimal reflection&lt;/a&gt;. AddPath is available from both Cisco and Juniper, while optimal reflection currently is not implemented by major vendors.&lt;/p&gt;&#xA;&lt;p&gt;AddPath allows BGP to send more than single best path. Optimal reflection will use SPF (ISIS, OSPF) to reflect best route from POV of receiver, not from route reflectors own point of view.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-05-27T07:54:41.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1136" PostTypeId="1" AcceptedAnswerId="1140" CreationDate="2013-05-27T08:50:41.323" Score="3" ViewCount="324" Body="&lt;p&gt;Can anyone explain what the impact is of enabling “preserve source address” inside the Network Load Balancer? Our customer’s NLB vendors are;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;F5&lt;/li&gt;&#xA;&lt;li&gt;Netscaler&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I've been asked this by one of my customers. Though I've googled about it I've got no idea how it really impacts.&lt;/p&gt;&#xA;" OwnerUserId="1212" LastEditorUserId="49" LastEditDate="2013-05-27T10:57:58.407" LastActivityDate="2013-05-28T16:26:33.680" Title="Broader Impact of enabling “preserve source address” inside NLB" Tags="|monitoring|throughput|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1137" PostTypeId="1" AcceptedAnswerId="1148" CreationDate="2013-05-27T08:55:16.563" Score="9" ViewCount="714" Body="&lt;p&gt;&lt;strong&gt;Why does the &quot;show adjacency&quot; command take so long to run (in the order of minutes)&lt;/strong&gt; on &lt;em&gt;Cisco IOS Software, 7200 Software (C7200P-SPSERVICESK9-M), Version 12.4(4)XD5, RELEASE SOFTWARE (fc1)?&lt;/em&gt;  The router is an Internet edge router running BGP?  What do the &quot;(5)&quot;, &quot;(10003)&quot;, or &quot;(75845)&quot; mean after the addresses?  It seems to enumerating mostly addresses on a directly connected /23 network.  CPU is &amp;lt; 2% and memory don't seem to be cause for this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r-x-y-edge1#sh adjacency&#xA;Protocol Interface                 Address&#xA;IP       GigabitEthernet0/2        x.67.155.9(5)&#xA;IP       GigabitEthernet0/2        x.67.155.8(5)&#xA;IP       GigabitEthernet0/2        x.67.155.11(5)&#xA;IP       GigabitEthernet0/2        x.67.155.10(5)&#xA;IP       GigabitEthernet0/2        x.67.155.13(5)&#xA;IP       GigabitEthernet0/2        x.67.155.12(5)&#xA;IP       GigabitEthernet0/2        x.67.155.15(5)&#xA;IP       GigabitEthernet0/3        172.31.4.130(10003)&#xA;IP       Serial1/0                 point2point(75845)&#xA;...&#xA;&amp;lt;truncated&amp;gt;&#xA;&#xA;CPU utilization for five seconds: 2%/1%; one minute: 3%; five minutes: 3%&#xA;&#xA;Processor Pool Total:  864815572 Used:  547631528 Free:  317184044&#xA;      I/O Pool Total:   67108864 Used:    4520592 Free:   62588272&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Is there a way to interrupt the execution of this command short of closing the session as Ctrl-^x doesn't have any effect?&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="623" LastEditDate="2013-05-30T11:38:34.317" LastActivityDate="2013-05-30T11:38:34.317" Title="Why does &quot;show adjacency&quot; take so long to run?" Tags="|cisco|cisco-ios|cisco-commands|cef|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="1139" PostTypeId="2" ParentId="1137" CreationDate="2013-05-27T09:15:39.277" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What do the &quot;(5)&quot;, &quot;(10003)&quot;, or &quot;(75845)&quot; mean after the addresses?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The value in parentheses refers to the number of times a FIB entry points to an adjacency entry. Mentioned &lt;a href=&quot;http://searchitchannel.techtarget.com/feature/Verify-the-adjacency-table&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-05-27T09:15:39.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1140" PostTypeId="2" ParentId="1136" CreationDate="2013-05-27T09:32:00.303" Score="3" Body="&lt;p&gt;I'm not familiar with Netscaler, so take this with grain of salt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I presume you are using NAT to translate source address of request today, so actual server is not seeing today real request address but some single NAT address translated by Netscaler.&#xA;I also presume that his toggle would remove that source address NAT, allowing your servers to see real request address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some scenarios where one would want to NAT the request address, such as if for redundancy purposes you want to connect your server to two or more SLB devices simultaneously (who would ECMP the VIP, i.e. both SLB are hot:hot, but not connected to each other in anyway). Then when your server replies to a request, it needs to reply via same interface where the original query came in from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Linux machines you can fix this easily, without relying on natting the source at SLB.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Windows server, you wouldn't really have any way to return the request back to the SLB which sent it, unless you NAT each request. If SLB1 NATs source to 192.0.2.1 and SLB2 NATs source to 192.0.2.2, then it's just matter of setting static route in windows, 192.0.2.1/32 pointing to SLB1 and 192.0.2.2/32 pointing to SLB2. This way you are always returning packet back to the SLB which sent the request.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-27T09:32:00.303" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1141" PostTypeId="2" ParentId="1137" CreationDate="2013-05-27T09:33:51.327" Score="2" Body="&lt;p&gt;Is the router taking full tables? If it is, I guess I wouldn't be surprised that it's taking a long time, seeing as how it has to resolve however many networks that represents a full table to an exit interface (RIB-&gt;FIB). Also remember that the 7200 is still a software based forwarding platform. You still have 3 more layers of CEF above you in terms of which ones are faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a large number of those adjacencies are punt adjacencies (an entry that would have to be punted to the next-level switching method) or glean adjacencies, this may also explain why it's taking a long time - and I'd imagine that a large number of them would be - again, still assuming it's a full table here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number in parentheses is called the refcount, and represents the number of times that adjacency is pointed to by FIB entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: regarding canceling the command, try Ctrl+C (repeatedly) - sometimes this works for me for killing long-running commands. OTOH if I know the command will produce a lot of output, I'll set &quot;terminal length&quot; to something like &quot;50&quot;, that way I have the option of killing the command by way of output pagination.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-27T12:11:59.220" LastActivityDate="2013-05-27T12:11:59.220" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1142" PostTypeId="2" ParentId="1081" CreationDate="2013-05-27T09:59:25.570" Score="5" Body="&lt;p&gt;In IPv6 multi-homing with provider aggregated addresses, each host in the network will get one address prefix from each of the providers. The host stack/application's source address selection (RFC6724) and choice of SA/DA pair (RFC6555) determines which exit is used.&lt;/p&gt;&#xA;&lt;p&gt;I.e the host/application's choice of source address picks which exit link is used. Various implementations do this in various ways, and none do it very well at the moment.&lt;/p&gt;&#xA;&lt;p&gt;The network uses source address dependent routing to forward the traffic on to the correct exit. (Otherwise BCP38 (ingress filtering) would have dropped a packet sent with ISP B's source address to ISP A). See &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-troan-homenet-sadr-01&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://datatracker.ietf.org/doc/html/draft-troan-homenet-sadr-01&lt;/a&gt;&#xA;We have an implementation in OpenWRT. But it can also be implemented reasonably well on any router supporting policy based routing.&lt;/p&gt;&#xA;&lt;p&gt;An application should be smart enough to change connection (pick another SA/DA pair) when the current connection fails. It isn't. In the mean time our recommendation is to set the lifetime of the failing link's address prefix to 0, meaning that new connections will not use that address.&lt;/p&gt;&#xA;" OwnerUserId="1219" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-05-27T09:59:25.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1143" PostTypeId="2" ParentId="1050" CreationDate="2013-05-27T10:01:08.077" Score="2" Body="&lt;p&gt;To add completeness to mellowd answer, the commands below allowed for capture of packets on individual links in a LAG bunldle.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config)#mirror-port e 9 &#xA;switch(config)#trunk e 15 e 17 &#xA;switch(config-trunk-15,17)#config-trunk-ind&#xA;!Monitor only primary port&#xA;switch(config-trunk-15,17)#monitor e 15 e 9 both&#xA;!Monitor only secondary port&#xA;switch(config-trunk-15,17)#monitor e 17 e 9 both&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-05-27T10:01:08.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1146" PostTypeId="1" CreationDate="2013-05-27T10:38:09.007" Score="4" ViewCount="38237" Body="&lt;p&gt;I am trying to make a few changes on a firewall by connecting remotely to a desktop at work. I need to do a change that I think may reset and change the LAN interface.... I am worried about being kicked out and having to travel to work to reset it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The wan interface doesn't need any change, so, I want to try to enable remote management from my IP, but, I am not having any luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;Network &amp;gt; Interfaces&lt;/code&gt;, the HTTP and HTTPS box is checked for WAN...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7xKTh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...and also when I go to &lt;code&gt;Firewall &amp;gt; Access Rules &amp;gt; Wan/Wan&lt;/code&gt; I see an automatically created rulle for &lt;code&gt;HTTP&lt;/code&gt; (and) &lt;code&gt;HTTPS Management&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XBDSN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, to diagnose, I had a constant running ping... When I either disabled ping under interfaces, or, changed the source away from any under firewall, the ping stopped.... so I am sure that this is where I need to make the change... However, I just can't seem to connect via SSH/HTTP/HTTPS...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I can think of is that the WAN port is not a trusted interface, but, surely by enabling management, I overwrite that setting? ... Is there something hidden somewhere I need to do to enable remote management?&lt;/p&gt;&#xA;" OwnerUserId="1222" LastEditorUserId="267" LastEditDate="2013-05-27T11:47:14.363" LastActivityDate="2014-07-08T23:06:24.293" Title="What do I need to do in order to enable remote HTTPS management of a SonicWall NSA3500" Tags="|management|sonicwall|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1147" PostTypeId="2" ParentId="1146" CreationDate="2013-05-27T11:49:48.233" Score="2" Body="&lt;p&gt;William,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have enabled HTTPS on the interface and still have the default allow any firewall rule for the HTTPS management service then remote management should be configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have enabled the SSLVPN you will probably have changed the management port to something else... generally 8443 but you can check this in the System -&gt; Administration menu. you should see the port setting in the HTTPS administration port setting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If its not working then check that you are trying to connect to the correct IP address. you need to connect to the interface IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also check the logs of the firewall after trying to login. If its being denied it should tell you and hopefully give a useful reason why. if you still have problems please port the logs and I will have a look.&lt;/p&gt;&#xA;" OwnerUserId="80" LastActivityDate="2013-05-27T11:49:48.233" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="1148" PostTypeId="2" ParentId="1137" CreationDate="2013-05-27T11:50:37.453" Score="8" Body="&lt;p&gt;Have you checked to see if you have domain lookup disabled? (&lt;code&gt;no ip domain lookup&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could be that your command is taking so long to come back as it is trying to resolve all of the IP's to hostnames.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-27T11:50:37.453" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1149" PostTypeId="5" CreationDate="2013-05-27T12:02:03.740" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-27T12:02:03.740" LastActivityDate="2013-05-27T12:02:03.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1150" PostTypeId="4" CreationDate="2013-05-27T12:02:03.740" Score="0" Body="This tag is for questions regarding VPLS, the Virtual Private LAN Service, which allows ethernet-based point-to-multipoint Layer 2 VPNs to be implemented as a MPLS service." OwnerUserId="59" LastEditorUserId="59" LastEditDate="2013-05-27T15:22:31.690" LastActivityDate="2013-05-27T15:22:31.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1151" PostTypeId="1" CreationDate="2013-05-27T12:14:29.400" Score="6" ViewCount="399" Body="&lt;p&gt;I have a question about QoS design in branch. The main place to deploy qos in branch - edge between edge router and ISP. At this edge we have voice traffic to SIP provider, copr. external email and other users traffic (web, torrent). &lt;br&gt;&#xA;&lt;br&gt;&#xA;We can implement effective qos for outgoing traffic, priority queue for voice and rest for other traffic (general description, I understand that real implementation seems to be more complex). &lt;b&gt;But what to do with incoming traffic?&lt;/b&gt; For example, I have SIP incoming traffic and torrent to my users, and I think that this p2p traffic will make big latency or even packet loss for my voice traffic.&lt;/p&gt;&#xA;" OwnerUserId="904" LastEditorUserId="176" LastEditDate="2013-05-28T14:09:43.107" LastActivityDate="2013-05-28T14:32:43.773" Title="QoS at the edge of branch" Tags="|cisco|qos|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1152" PostTypeId="2" ParentId="1151" CreationDate="2013-05-27T12:22:00.710" Score="9" Body="&lt;p&gt;There is no way for receiver to affect scheduling of sender. You should just work on getting QoS configured at sender.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Theoretically if the frames are correctly classified and your receiver and sender supports 802.1Qbb (essentially CoS aware pause frame) then you could request pausing of BE traffic without causing pausing of EF traffic.  &lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-27T12:22:00.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1153" PostTypeId="2" ParentId="1151" CreationDate="2013-05-27T12:23:18.790" Score="5" Body="&lt;p&gt;Your provider will need to set up QoS on the PE-CE link. You'll more than likely need to pay for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you noted already, you can only control the CE-PE link which you are already doing. &lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-27T12:23:18.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1154" PostTypeId="2" ParentId="1081" CreationDate="2013-05-27T12:27:00.360" Score="1" Body="&lt;p&gt;I've used OpenWRT with Multiwan (&lt;a href=&quot;http://wiki.openwrt.org/doc/uci/multiwan&quot; rel=&quot;nofollow&quot;&gt;http://wiki.openwrt.org/doc/uci/multiwan&lt;/a&gt;) for some time at home to multihome between my DSL and Cable ISP. It worked quite nicely. I wouldn't advice it as a corporate solution, but it's ok for SOHO and home setups.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-05-27T12:27:00.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1160" PostTypeId="1" AcceptedAnswerId="1335" CreationDate="2013-05-27T14:25:03.293" Score="24" ViewCount="68065" Body="&lt;p&gt;How is sFlow different from netFlow, and how is each supported by different vendors ?&lt;/p&gt;&#xA;" OwnerUserId="564" LastActivityDate="2013-05-29T16:57:09.840" Title="What is the difference between netFlow and sFlow?" Tags="|monitoring|netflow|sflow|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1163" PostTypeId="2" ParentId="1160" CreationDate="2013-05-27T15:13:42.177" Score="0" Body="&lt;p&gt;Netflow is a Cisco proprietary protocol and as such is not supported by anything other than Cisco devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sFlow is an IETF standard for doing pretty much the same thing but in a standard that isn't owned by one particular manufacturer.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-27T15:13:42.177" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1165" PostTypeId="2" ParentId="1160" CreationDate="2013-05-27T15:25:30.350" Score="7" Body="&lt;p&gt;The sole difference being &quot;NetFlow is Cisco proprietary, sFlow is not&quot; isn't exactly correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NetFlow originally started out as Cisco proprietary, but kind of went the same way as GRE or EIGRP. Since NetFlow v5 it has been implemented and supported on other vendors' hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main difference between NetFlow and sFlow is that NetFlow is restricted to IP only, whereas sFlow has the ability sample everything (network layer independent).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: The above appears to be no longer correct (at least as of the IPFIX standard). I've found &lt;a href=&quot;http://blog.sflow.com/2012/09/snowflakes-ipfix-netflow-and-sflow.html&quot; rel=&quot;nofollow&quot;&gt;the following blog post&lt;/a&gt; (warning: seems to be an &quot;sflow&quot; specific URL, so take it with a grain of salt if you wish) does a pretty good job of outlining the differences between the IPFIX spec and sFlow&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-27T15:55:48.000" LastActivityDate="2013-05-27T15:55:48.000" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1167" PostTypeId="1" AcceptedAnswerId="1168" CreationDate="2013-05-27T19:22:03.370" Score="10" ViewCount="4348" Body="&lt;p&gt;How would I disable SIP on an Cisco router running IOS 12.x?&lt;/p&gt;&#xA;" OwnerUserId="1278" LastEditorUserId="623" LastEditDate="2013-05-30T11:36:24.513" LastActivityDate="2013-05-30T11:36:24.513" Title="How can I disable SIP on IOS 12.x" Tags="|cisco|cisco-ios-12|cisco-commands|voip|sip|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1168" PostTypeId="2" ParentId="1167" CreationDate="2013-05-27T19:32:57.453" Score="11" Body="&lt;p&gt;Depending on which version of 12.x you're on, you should be able to do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#sip-ua&#xA;router(config-sip-ua)#no transport tcp&#xA;router(config-sip-ua)#no transport udp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This stops the router from listening on port 5060.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-05-27T19:32:57.453" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1169" PostTypeId="2" ParentId="1167" CreationDate="2013-05-27T19:36:21.907" Score="8" Body="&lt;p&gt;If you mean how to disable the SIP ALG you can configure the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip nat service sip udp port 5060&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-27T19:36:21.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1170" PostTypeId="2" ParentId="667" CreationDate="2013-05-27T19:37:18.007" Score="2" Body="&lt;p&gt;A cable technician (in the USA) told me that they use regular F connectors.  He also said that in places where service theft is common (at least of the unencrypted basic cable), they put a special pass-through connector over the connector on the distribution board which requires a special wrench to remove.  That way, if someone plugs in their own cable to the board, they will have to plug it in through the extra connector, which will be immediately apparent to the next technician who inspects the box.  However, the connectors in this box look like simple protective caps.&lt;/p&gt;&#xA;" OwnerUserId="679" LastActivityDate="2013-05-27T19:37:18.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1171" PostTypeId="2" ParentId="607" CreationDate="2013-05-27T20:10:39.923" Score="1" Body="&lt;p&gt;In your question it seemms you want to understand the mechanics of the R0 to ISP connection. As mentioned, xDSL is usually implemented via PPPoE or some form of bridging. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, what is happening here is &quot;Ethernet bridging&quot;. Bridging is a OSI layer 2 function that doesn't require or make us of IP. The 32-bit IP address is merely a PPP endpoint identifier for the ISP. The modem encapsulates and de-encapsulates IP traffic into and out of Ethernet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the network equipment at the ISP head-end, where the PPP circuit is terminated, the ip address becomes useful as the ISP and the Internet can route ip traffic to/fro the R0 publicly ip addressed interface that serves the LAN behind it. The only &quot;routing&quot; that is happening is on either end of the ppp circuit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that's somewhat helpful in understanding the mechanics of the RO to ISP connection.&lt;/p&gt;&#xA;" OwnerUserId="1279" LastEditorUserId="1279" LastEditDate="2013-05-27T20:27:31.203" LastActivityDate="2013-05-27T20:27:31.203" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1172" PostTypeId="1" AcceptedAnswerId="1184" CreationDate="2013-05-27T20:22:36.540" Score="12" ViewCount="6169" Body="&lt;p&gt;3560/3750s have small buffers and make good wiring closet switches. However I very often see these switches sitting in DCs. Lots of folks tend to use them as they are generally 1Gb and L3 capable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to prove just how bad they are in DC deployments? I quite often hear people saying they removed their 3750s as soon as they could, but I've yet to hear an actual failure scenario that could be used to let management know to get them out.&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2017-01-14T22:57:44.127" Title="How do you convince management that 3560/3750s are a bad idea in your DC?" Tags="|cisco-catalyst|" AnswerCount="8" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1173" PostTypeId="2" ParentId="1172" CreationDate="2013-05-27T20:33:20.950" Score="10" Body="&lt;p&gt;It really depends on your deployment scenario. 3560/3750s are great switches, have decent buffers, and they usually work fine for most applications. If your data center sees traffic flows that require larger buffers, you should be able to pull statistics from the switches, like buffer usage and packet drops. Convincing management to drop the switches that are dropping their packets shouldn't be too much of a challenge. I think.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-27T20:33:20.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1174" PostTypeId="5" CreationDate="2013-05-27T21:35:06.593" Score="0" Body="&lt;p&gt;Point-to-Point Protocol (PPP) is a data link (layer 2) protocol used to establish a direct connection between two nodes. It can provide connection authentication, transmission encryption (using ECP, RFC 1968), and compression.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T20:51:06.813" LastActivityDate="2016-11-29T20:51:06.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1175" PostTypeId="4" CreationDate="2013-05-27T21:35:06.593" Score="0" Body="For questions about Point-to-Point Protocol (PPP), a data link protocol typically used in establishing a direct connection between two nodes." OwnerUserId="1085" LastEditorUserId="8499" LastEditDate="2016-11-29T20:47:05.413" LastActivityDate="2016-11-29T20:47:05.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1176" PostTypeId="2" ParentId="1172" CreationDate="2013-05-27T21:58:41.117" Score="8" Body="&lt;p&gt;In the early days of the 3750, especially the stacking technology that was released right before 2010 or so, there were a lot of problems with switch failures causing the stack to fail in a not-so-graceful fashion. Combine that with the fact that upgrading a stack was not the most intuitive process (it's improved since then), the 3750 really got a bad reputation that has stuck ever since.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In small data centers, the 3750 stack represents a relatively low-cost option to get the port density without the cost of a chassis-based switch. I myself just installed for a smaller customer a data center solution involving a few Cisco UCS C220 M3 servers with a Netapp FAS2240, and I used a stack of 3750s to provide multi-chassis etherchannel redundancy to each new device as well as all their old servers during the transition. It worked really, really well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - does the 3750 have it's issues? Probably the same as any other switch that's been around for this long. The 6500 had it's problems early on in it's lifecycle, and now that it's been out for years and years it's not so bad. I recommend looking at what you're going to be throwing at it, and if the performance metrics hold up, then make sure you monitor their performance with vigilance.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-05-27T21:58:41.117" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1177" PostTypeId="2" ParentId="1172" CreationDate="2013-05-27T21:58:45.707" Score="6" Body="&lt;p&gt;Honestly, the most common way that I've seen the 3750's hit the curb, was when the core switches were upgraded to Nexus 7k's.  Usually (but not always) part of that refresh is to move TOR to Nexus 2000 FEXs or Nexus 5000s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though the 3750's don't have the largest buffers, in most people's minds, they work &quot;well enough&quot; in most enterprise DC environments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you can put a dollar value on the problems caused by having 3560's/3750's in a DC, I doubt you'd be able to convince management to replace them outside of a regular product refresh cycle.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-05-27T21:58:45.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1178" PostTypeId="2" ParentId="410" CreationDate="2013-05-27T22:49:28.343" Score="4" Body="&lt;p&gt;They only support BVI1. This wasn't enforced either by bug or whatever in 12.X but in 15.X any extra BVI breaks management access. Worked with TAC on this issue over a week period. Can reproduce the issue on any of the APs with 15.X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So a simple &lt;code&gt;no int BVI50&lt;/code&gt; should fix the original config. Plus a reload after making the change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Made a couple edits now that I'm not on my iPad. Anyways, I had this issue on 2 1262s that I updated at my local office and 1 1252 at a remote plant (20min away thankfully). Once the issue was resolved by removing the extra BVIs I had on all the APs (before upgrading anymore), I was able to update 25 remotely across the globe without a hitch.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-05-28T00:28:29.853" LastActivityDate="2013-05-28T00:28:29.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1179" PostTypeId="2" ParentId="119" CreationDate="2013-05-27T23:39:36.397" Score="6" Body="&lt;p&gt;It's a bit intimidating when you see the huge address space available, but in practice, it's not hard to deal with.&lt;/p&gt;&#xA;&lt;p&gt;Let's say you are allocated a /48.  That gives you 65K /64s to play with, each capable of holding rather a lot of addresses. Also the rounding error in 65K gives you a slack handful of other /&amp;lt;64 for other uses.&lt;/p&gt;&#xA;&lt;p&gt;Personally speaking I call off /64 subnets from the /48 per VLAN.  I set the router address as &amp;lt;/64&amp;gt;::1 for each VLAN.  I use &amp;lt;/64&amp;gt;::xxxx for DNS (where xxxx is a repeated digit) and similar for a few other services.  It's easier to remember.&lt;/p&gt;&#xA;&lt;p&gt;Each box gets a SLAAC allocated address and all hosts are encouraged to also set a temporary address.  This way we can find a system using the SLAAC address but the system retains a little privacy on the internet - or it would but we generally use a web proxy - ahh but that has a temporary address as well!  Still, the ubiquity of IPv4 makes all this moot.&lt;/p&gt;&#xA;&lt;p&gt;If you have multiple sites then break up the /48 into smaller bits but larger than /64 - enough to cover all eventualities.  This will allow you to aggregate routing tables somewhat.&lt;/p&gt;&#xA;&lt;p&gt;Frankly, assuming you DO have a /48 (I have one for my home, so I don't doubt it) then you should have enough space to cover most eventualities and schemes.&lt;/p&gt;&#xA;&lt;p&gt;Now, if your setup is bigger - say multi-national and multi site then I suggest you investigate PI and then break that up by country/site/VLAN or country/locality/site/building/VLAN or whatever.  You still get plenty of addresses in a /48 for all but the largest set up.&lt;/p&gt;&#xA;" OwnerUserId="1296" LastEditorUserId="31801" LastEditDate="2022-05-26T18:22:03.590" LastActivityDate="2022-05-26T18:22:03.590" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1180" PostTypeId="2" ParentId="667" CreationDate="2013-05-28T00:06:39.047" Score="2" Body="&lt;p&gt;The green cabinets appearing across the UK are BT Openreach FTTC cabs (I'm not directly in the industry and I've already (ab)used a redundant acronym!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They basically put some fibre connections from the nearest exchange in your locality.  The wires on the right are almost certainly the copper connections to individual houses/businesses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cabs seem pretty secure and fairly solid but I have heard tales of people chaining a van to one and dragging it off to expose and steal the reasonably valuable copper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the IT security front, I suggest that these are not much of a weak link.  Your banking should be SSL encrypted and access to other things should use VPNs of one form or another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I were you I'd be more worried by the modem that you get at your termination.  It's a black (OK white) box that was manufactured in China by Huawei.  You don't get the login details for it and have to open it up and use the remains of the RS232 connection on the motherboard to get at it.  I doubt it's really a security problem but who knows what else is in that box or in the firmware on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&#xA;Jon&lt;/p&gt;&#xA;" OwnerUserId="1296" LastActivityDate="2013-05-28T00:06:39.047" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1181" PostTypeId="2" ParentId="613" CreationDate="2013-05-28T00:55:42.540" Score="0" Body="&lt;p&gt;My solution would be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two cheapish switches - ie ones that support LAG and STP.  Say a pair of 8 port Netgears GS110s.  They are around £65 each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 router/firewall - that will be a PC class system with a quad port NIC in it to augment the built in NIC.  However if you don't need individual GB connectivity to the remote sites then a single NIC can be used with multiple VLANs (the cheapy switches will support this).  The PC will be running pfSense (free - Open Source - &#xA;&lt;a href=&quot;http://www.pfsense.org/&quot; rel=&quot;nofollow&quot;&gt;http://www.pfsense.org/&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pfSense supports clustering, so run two of them.  For rack mounting - get a cheap pizza box 1U thing from Dell or whoever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Total cost:  2 x £65 + 2 x £339 (Dell R210 11) + VAT etc.  OK that's around USD1K&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That gives a hefty amount of thoughput, functionality and redundancy.  Halve the price and hardware and still get the job done but without the redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pfSense can happily shuffle packets at GB speeds on that class of system and have enough power to do say IPSEC without breaking a sweat.  There are loads of add on packages for it as well but frankly the built in functionality is more than enough for most people.  &lt;em&gt;No&lt;/em&gt; license fees.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The web interface is pretty easy to get around and is no harder than a home router but there is rather more in the box!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&#xA;Jon&lt;/p&gt;&#xA;" OwnerUserId="1296" LastActivityDate="2013-05-28T00:55:42.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1182" PostTypeId="2" ParentId="362" CreationDate="2013-05-28T00:57:03.760" Score="3" Body="&lt;p&gt;I use ruby with the net-scp and net-ssh gems to automate tasks with our network equipment. It's a pretty short script to execute commands (excerpt, not a finished product):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;begin&#xA;    Net::SSH.start(fqdn, username, :password =&amp;gt; loginPassword) do |session|&#xA;        output = &quot;&quot;&#xA;&#xA;        channel = session.open_channel do |ch|&#xA;            ch.send_channel_request &quot;shell&quot;&#xA;            ch.on_data do |ch, data|&#xA;                output += data&#xA;            end&#xA;&#xA;            ch.send_data &quot;conf t\n\r&quot;&#xA;            #Some tasks here&#xA;            ch.send_data &quot;exit\n\r&quot; #Exit config mode&#xA;            ch.send_data &quot;exit\n\r&quot; #Exit device&#xA;&#xA;        end&#xA;&#xA;        # Wait for everything to complete&#xA;        channel.wait&#xA;    end&#xA;rescue Exception=&amp;gt;e&#xA;    errorOutput = fqdn + &quot;: &quot; + e.to_s&#xA;    puts errorOutput&#xA;    puts output&#xA;    return device&#xA;end&#xA;return output&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that you should have a blank loginPassword variable. If blank, it will use your RSA public key for login (supported on HP ProCurve and Cisco 15.X platforms).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using something like git and a few short scripts, you can organize all your equipment configurations with diffs of changes and who made the changes (assuming your engineers pull configs and commit them after work is completed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also it should go without saying, but just in case, always test scripted work in a lab before running on production equipment. Especially when executing commands and changing configurations. Test, test, test.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-05-28T01:05:10.730" LastActivityDate="2013-05-28T01:05:10.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1183" PostTypeId="2" ParentId="1172" CreationDate="2013-05-28T01:25:57.090" Score="6" Body="&lt;p&gt;Performance is certainly an important issue and is well-addressed above but there's also a lot of differentiation based on features and feature sets:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The need for external RPS units is a huge problem in many installations – a 1U switch becomes more expensive in terms of initial costs, lost space and ongoing management.  Redundant power should be considered an absolute must in all but the smallest data center environments.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Lots and lots of unnecessary code for end user connectivity is running – more opportunity for defects, security issues and downtime.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DC features (ISSU, DCB, storage, certain on-box scripting elements) aren't – and won't be – on the campus-focused devices.  Mechanisms to manage and scale L2 extension in a sane way also (i.e. FabricPath/TRILL, OTV, VXLAN, etc) also tend to be missing from both the present state and roadmaps outside of DC products.  The list here is only going to grow – virtualization on-box, support of HW-assist mechanisms, etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Scalability – How do you grow the infrastructure?  Lots and lots of switches (expensive to manage)?  Stacking (operationally difficult, major cabling issues) is a mess.  Additionally the flexibility of interface types (fiber vs copper, for example) at density can be challenging.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In general the differences between DC and closet switching are growing.  In the Cisco world there are distinct operating systems (NXOS vs IOS) for very good reasons – vastly different requirements yield divergent solutions.  The feature velocity for user authentication mechanisms (802.1x) or fancy AV integration aren't needed in the data center while the ability to terminate tons of 10GE isn't needed in the wiring closet.  Different tools for different jobs.  A Nexus box connecting desktops would also be a less than ideal plan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd also point you to the various design guides (CVD's, etc) that lay out rationale for the types of switches used at various points in the network.  There's something to be said for solutions that generally resemble best common practice in the industry, and the switches you're mentioning generally have no place in the DC – apart from management networks or certain special case local connectivity situations.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastEditorUserId="27647" LastEditDate="2017-01-14T22:57:44.127" LastActivityDate="2017-01-14T22:57:44.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1184" PostTypeId="2" ParentId="1172" CreationDate="2013-05-28T01:39:47.220" Score="13" Body="&lt;p&gt;FWIW I've had experience with 3750's (3750G, and then later 3750E/3560E) at scale in a TOR setup; initially with L2 port-channels/GLBP (variants of 2x1G and 2x2G and the rare 2x4G for db racks) and then with L3 to the TOR (went with this for 3750E/3560E and 10G to the core). I'm talking thousands of them. We only saw issues with buffers for the &lt;strong&gt;most&lt;/strong&gt; bandwidth intensive services, and at that point we were looking at 10G to the host anyway (and dense pizza boxes with 24-48 SFP+'s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether or not you're going to be able to prove anything to management is really going to depend on the application and you doing your homework on what the requirements of your design and the application are, and knowing &lt;em&gt;exactly&lt;/em&gt; what the specifications are of the application, as well as the expected growth velocity of it. Set up a design review with your management chain as well as the primary owners/customers of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Management wants to see &lt;strong&gt;data&lt;/strong&gt;, and if you don't have the resources to fully test the box (come up with a test plan, connect it up to some traffic generation hardware, fully scope it out and stress test it to the design spec, etc) this is going to be hard to do. They're not going to be impressed with anecdotal evidence, and finding this kind of hard data may prove difficult, since I'm sure that folks publishing this kind of thing would violate all kinds of NDA's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everyone else that's posted an answer to this has outlined the 3750 platform's &quot;problem areas&quot; pretty nicely: stacking and weird failure modes inherent to it, buffer sizes, etc. There's also &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1025/3750g-switch-buffer-monitoring&quot;&gt;this question&lt;/a&gt; that outlines the issues with gathering SNMP statistics on output queue drops - the buffers are shared across the ASICs, so any stats you get with this via SNMP are going to be the same for specific port ranges (this could be one sticking point you could bring up with your management chain).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To summarize, I'd say that the 3750/3560 would be &quot;fine&quot; for most deployments, even at somewhat large scales. Avoid stacking them if you can, but I'd say that it's not &lt;strong&gt;too&lt;/strong&gt; horrible to do this in very small and manageable quantities.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-05-28T18:50:23.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1185" PostTypeId="2" ParentId="1134" CreationDate="2013-05-28T02:04:42.773" Score="3" Body="&lt;p&gt;Bear in mind that the idea with iBGP and route reflection has been to distribute &lt;em&gt;path&lt;/em&gt; information with the idea that specific routing/forwarding decisions would be accommodated by the underlying IGP (particularly including multipathing, internal failover, etc).  As such, a pointer to what ought to be fairly static next-hops can be kept in table while avoiding the churn associated with localized network information.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scalability and stability were (and arguably should be) the primary objectives of BGP - even at the price of suboptimal path choice and fast convergence.  The traditional implementation of the RR epitomizes this.  Ideally the information on RR's should be as static as possible and timers should be kept on the long side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW - There &lt;em&gt;are&lt;/em&gt; circumstances in which an RR might send multiple paths to the same v4/v6 destination - both the AddPath feature mentioned above as well as in the MPLS VPN case where a given prefix is associated with the RD's of multiple PE's.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-05-28T02:04:42.773" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1186" PostTypeId="2" ParentId="123" CreationDate="2013-05-28T02:06:55.910" Score="1" Body="&lt;p&gt;As noted, first and foremost, policies matter.  This may seem like an odd starting point, but, from a corporate and legal standpoint, unless you define and distribute the policy, if someone breaks it, there's little you can do.  No point in securing the door if, when someone breaks in, you can't do anything to stop them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about 802.11X.   You don't really care about what the access point is, legal or not, so long as no one gets access to the resources below it.  If you can get the access point or the user beyond it, to support 802.11X, without approval, they get access, but they can't do anything.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We actually find this useful as we assign different VLANs based on it.  If you are approved, you get access to the corporate VLAN, otherwise, it's the in-build ad network.  Want to watch our promo videos all day, we're OK with that.&lt;/p&gt;&#xA;" OwnerUserId="1304" LastActivityDate="2013-05-28T02:06:55.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1187" PostTypeId="2" ParentId="1029" CreationDate="2013-05-28T02:13:03.660" Score="0" Body="&lt;p&gt;Put another way, subnets are, technically, a division of the address space at the L2 level -- it's more of a routing decision than anything else.  VLANs are tunneled LAN frames within the payload of other LAN frames.  Ignoring the various standards for a moment, if you put a packet analyzer on the cable, you'd see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a subnetted LAN, you'd see the same traffic.   THere's no easy way to look at a subnetted LAN and tell it is, in fact, subnetted.   For VLANs, you'd actually see ethernet frames carrying a VLAN tag, which then carry another ethernet frame inside of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnet frames are easily handled by equipment -- you can choose to ignore the subnet at a given moment if you want to, for example, have a transparent proxy watch some trafic.  VLANs are tunnels.&lt;/p&gt;&#xA;" OwnerUserId="1304" LastActivityDate="2013-05-28T02:13:03.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1188" PostTypeId="2" ParentId="1011" CreationDate="2013-05-28T02:25:31.627" Score="2" Body="&lt;p&gt;At least from the point of view of a telecommunications carrier, when we say &quot;leased line&quot;, we mean a physical, point-to-point connection billed per air mile.  If you order a leased line from San Francisco to New York, we will obtain a leased circuit from the local telco to a long-distance inter-exchange carrier, and then another local loop as we call it, from the IXC to the New York telco destination.   You pay for all it, at so many dollars per airmile.   Note that the line by not always be a wire -- we may transform your &quot;circuit&quot; into a digital link along the way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Serial lines are lower-speed leased lines, typically less than the standard 1.544Mb/2Mb/s lines.   We don't use those much any more as few people want 128Kb/sec circuits.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A dedicated line is a leased line where your &quot;line&quot; may be virtualized along the way.   You have a dedicated virtual pipe at a given capacity.  Typically, you'd buy for example, a dedicated 10Mb and we'd create a local link to you, perhaps metro ethernet, turn that ethernet into a long-haul shared ethernet circuit (2-10Gb), and then back into ethernet at your end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It comes down to this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If you need low-speed connectivity point-to-point, that's a serial&#xA;line, but I'd recommend going straight to T-1 dedicated.&lt;/li&gt;&#xA;&lt;li&gt;If you need higher-speed dedicated links without any possibility of&#xA;sharing the pipe along the way (perhaps for compliance reasons),&#xA;that's a leased circuit.&lt;/li&gt;&#xA;&lt;li&gt;If you need high-bandwidth point-to-point, but you can tolerate&#xA;&quot;commingling the pipe&quot;, that's a dedicated connection.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1304" LastActivityDate="2013-05-28T02:25:31.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1189" PostTypeId="2" ParentId="653" CreationDate="2013-05-28T04:24:22.703" Score="4" Body="&lt;p&gt;Here's one I've been using recently to remove cables from ports that haven't seen any activity for at least six weeks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show int | i proto.*notconnect|proto.*administratively down|Last in.* [6-9]w|Last in.*&#xA;[0-9][0-9]w|[0-9]y|disabled|Last input never, output never, output hang never&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1309" LastEditorUserId="49" LastEditDate="2013-10-02T15:09:26.223" LastActivityDate="2013-10-02T15:09:26.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1190" PostTypeId="1" AcceptedAnswerId="1191" CreationDate="2013-05-28T05:28:43.470" Score="25" ViewCount="29494" Body="&lt;p&gt;I am adding a new VLAN to an existing trunk port between two Cisco Catalyst switches (3750's).  In the process of adding the new VLAN, it appears that I've removed the existing allowed VLANs on the trunk...  How is this possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Existing trunk port configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-LAB-1#show run int g1/0/49&#xA;Building configuration...&#xA;&#xA;Current configuration : 255 bytes&#xA;!&#xA;interface GigabitEthernet1/0/49&#xA; description SW-LAB-2 G1/0/48&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 10&#xA; switchport trunk allowed vlan 10,20&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; ip dhcp snooping trust&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used the following syntax to also allow VLAN 30:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-LAB-1#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;SW-LAB-1(config)#interface g1/0/49&#xA;SW-LAB-1(config-if)#switchport trunk allow vlan 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However now, my running config on g1/0/49 is missing VLANs 10 and 20!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;SNIP&amp;gt;&#xA;switchport trunk allowed vlan 30&#xA;&amp;lt;/SNIP&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="623" LastEditDate="2013-05-30T11:37:44.640" LastActivityDate="2018-08-01T21:59:58.000" Title="Accidentally Removed Allowed VLANs from Cisco Switch Dot1Q Trunk" Tags="|cisco|cisco-catalyst|vlan|cisco-commands|dot1q|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1191" PostTypeId="2" ParentId="1190" CreationDate="2013-05-28T05:29:36.550" Score="39" Body="&lt;p&gt;You need to use the following command to add your VLAN 30 to an existing Dot1Q trunk on a Cisco Catalyst switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk allowed vlan add 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Otherwise IOS just thinks you're trying to overwrite the existing configuration and you are left with an accidentally deleted set of allowed VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could similarly use &quot;remove&quot; in place of &quot;add&quot; to remove only one VLAN.  See the entire syntax below.  (It is actually the same syntax in Cisco Nexus OS or IOS, FYI.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-FOO(config-if)#switchport trunk allowed vlan ?&#xA;  WORD    VLAN IDs of the allowed VLANs when this port is in trunking mode&#xA;  add     add VLANs to the current list&#xA;  all     all VLANs&#xA;  except  all VLANs except the following&#xA;  none    no VLANs&#xA;  remove  remove VLANs from the current list&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Another option is to put all of your allowed VLANs into the command, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk allowed vlan 10,20,30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This option is more time consuming but also works.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="-1" LastEditDate="2016-07-03T03:22:36.653" LastActivityDate="2016-07-03T03:22:36.653" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1192" PostTypeId="2" ParentId="653" CreationDate="2013-05-28T06:04:41.860" Score="1" Body="&lt;p&gt;I think that in Cisco environment the best way is to a &lt;strong&gt;show version&lt;/strong&gt; to know the uptime of the switch and after&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show interfaces accounting&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface Vlan1 is disabled&#xA;Vlan810 &#xA;            Protocol    Pkts In   Chars In   Pkts Out  Chars Out&#xA;                  IP     709229   73055034     232297   33127143&#xA;                 ARP        738      44280         70       4200&#xA;FastEthernet0/1 &#xA;            Protocol    Pkts In   Chars In   Pkts Out  Chars Out&#xA;No traffic sent or received on this interface.&#xA;&#xA;FastEthernet0/2 &#xA;            Protocol    Pkts In   Chars In   Pkts Out  Chars Out&#xA;               Other          0          0         19       6669&#xA;       Spanning Tree          0          0      18588    1115280&#xA;                 CDP          0          0        658     309918&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1312" LastActivityDate="2013-05-28T06:04:41.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1193" PostTypeId="1" AcceptedAnswerId="1214" CreationDate="2013-05-28T06:43:45.773" Score="4" ViewCount="3399" Body="&lt;p&gt;Does anyone have any experience running GNS3 locally (on Windows or Mac) vs the VM Workbench? I tend to have larger and larger topologies and my 4GB of RAM get pretty loaded...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, can workbench calculate and utilize the idle PC value efficiently, and is there a significant performance decrease when using the VM in comparison to a local install?&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="762" LastEditDate="2013-05-28T16:11:52.097" LastActivityDate="2013-05-28T16:11:52.097" Title="GNS3: Local install vs Workbench" Tags="|gns3|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1194" PostTypeId="2" ParentId="1172" CreationDate="2013-05-28T07:22:05.237" Score="6" Body="&lt;p&gt;@mellowd is certainly right, these switches are not very usable DC switches, due to very limited buffers they will microburst and drop traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider you have 2 * 1GE ingress and 1 * 1GE egress. Worst case scenario is, that egress port starts dropping after the ingress ports have sent at the same time for 2ms.&#xA;Best case scenario is, that you can handle 8ms burst.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have 2MB of egress buffer per 4 ports, so 2MB/(1Gbps/8) = 16ms maximum and 16/4 = 4ms minimum.&#xA;Divide that number by amount of ingress ports wanting to send, and you get the number of how long you can handle it.&#xA;That is, the more ingress ports (servers) you add, the less microbursting you can handle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you must live with 3750/3560, you should read &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-8093&quot;&gt;this&lt;/a&gt; document to maximize buffer use. And if you're still dropping use LACP on egress, even though your graphs show that average egress demand is very low.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To prove to your managers that the buffers are insufficient monitor/tap/span your current networks switches all downlinks, then you'll have timestamps and packet-sizes going to egress and you can calculate how much over 1Gbps your instantaneous demand is and how much buffer you'll need to handle it.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-28T07:22:05.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1195" PostTypeId="2" ParentId="1193" CreationDate="2013-05-28T07:26:36.620" Score="3" Body="&lt;p&gt;I've had a ton of success running either dynagen/gns3 on my local laptop, while dynamips sits on a remote linux server. My server has only 4Gb RAM and an AMD quad core, yet it handles 32+ router topologies with ease. Your .net file simply connects to a remote box. i.e. this part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[localhost:7200]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;becomes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[remote.ip:7200]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The latest betas of GNS3 now also supports idlemax and various other settings to tune youe environment even more. In the past you would've needed to edit the .net file outside of gns3&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-05-28T07:40:17.607" LastActivityDate="2013-05-28T07:40:17.607" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1196" PostTypeId="1" AcceptedAnswerId="1197" CreationDate="2013-05-28T08:25:55.010" Score="8" ViewCount="18586" Body="&lt;p&gt;I'm testing a new FTTH CPE in our lab. A Cisco ME3400 switch. So far I'm having issues in provisioning them. I have activated DHCP debugging to see the DHCP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder how can I test to know if there is layer 2 connectivity between the CPE and ME3400?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some output : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ME3400#sh int fa0/1&#xA;  FastEthernet0/1 is up, line protocol is up (connected) &#xA;   Hardware is Fast Ethernet, address is 0023.05ab.c883 (bia 0023.05ab.c883)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ME3400#sh mac address-table &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Vlan    Mac Address       Type        Ports&lt;br&gt;&#xA;  ----    -----------       --------    -----&lt;br&gt;&#xA;  All    0100.0ccc.cccc    STATIC      CPU&lt;br&gt;&#xA;  ...&lt;br&gt;&#xA;    1    XXXX.XX29.c942    DYNAMIC     Gi0/1&lt;br&gt;&#xA;    1    XXXX.XXe4.0bdd    DYNAMIC     Gi0/1&lt;br&gt;&#xA;    1    XXXX.XX70.113e    DYNAMIC     Gi0/1&lt;br&gt;&#xA;   10    XXXX.XXa1.4ca0    DYNAMIC     Fa0/1  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="206" LastEditorUserId="253" LastEditDate="2013-05-28T09:19:40.323" LastActivityDate="2016-09-13T12:23:50.543" Title="How to test layer 2 connectivity on Cisco Switch?" Tags="|cisco|switch|" AnswerCount="5" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1197" PostTypeId="2" ParentId="1196" CreationDate="2013-05-28T08:29:43.857" Score="11" Body="&lt;p&gt;If you see MAC address is 'mac address-table' you have L2 connectivity. So nothing wrong in your test methodology.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-28T08:29:43.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1198" PostTypeId="2" ParentId="1196" CreationDate="2013-05-28T08:35:24.460" Score="2" Body="&lt;p&gt;you may want to try a &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/l2trace.html&quot; rel=&quot;nofollow&quot;&gt;Layer2Traceroute&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# traceroute mac [interface type interface_number] source_mac_address [interface type interface_number] destination_mac_address [vlan vlan_id] [detail]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once you have confirmed L2 connectivity, can you explain the problem with the provisioning in more detail please?&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="775" LastEditDate="2013-05-28T19:58:17.227" LastActivityDate="2013-05-28T19:58:17.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1199" PostTypeId="2" ParentId="1113" CreationDate="2013-05-28T10:48:20.753" Score="2" Body="&lt;p&gt;I have been doing some research and prototyping on this now and &lt;a href=&quot;http://blog.stackoverflow.com/2011/07/its-ok-to-ask-and-answer-your-own-questions/&quot;&gt;found out here&lt;/a&gt; that this is something that I can share with you all as a reference if you also ever find this problem at your door step. I still welcome any advice or approaches that worked for you!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of in order to &lt;strong&gt;maintain a reusable set of devices&lt;/strong&gt; that are used over and over in the flows I got the immediate realisation that I did not want to copy and paste the Visio stencil object over and over and over again. Besides, I found another problem - I could not find the number of documents (configurations/deployments) that this device was used in without resulting to some sickening VB for Applications inside Visio or having a companion Excel/Access list of connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really do not know if this is ever an issue for others but for an upgrade project it seems you can never underestimate where your device may be included in a flow. These changes have to strictly documented for all to see, not hidden in the ITSM (ITIL) Change Management tool! Especially as we do not have a front-end to this database to make meaningful investigations!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being of UML decent, I have chosen to use a model repository to achieve this quest of sanity with our infrastructure and network documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I have created a set of classes that represent every equipment involved in the documentation of our High Level Design (HLD) and Low Level Design(LLD). To me, this means that all engineers in the company have now a template of every asset we have on our network! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All changes documented with this model-driven approach enables us to can carry out the impact analysis, instantly!&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The single Model, has&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;93 main devices&lt;/strong&gt;, includes &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;WEB application servers, &lt;/li&gt;&#xA;&lt;li&gt;GPRS and Mobile Internet Service appliances&lt;/li&gt;&#xA;&lt;li&gt;DNS/Mail Relay servers&lt;/li&gt;&#xA;&lt;li&gt;Routers&lt;/li&gt;&#xA;&lt;li&gt;MPLS Routers&lt;/li&gt;&#xA;&lt;li&gt;Proxies&lt;/li&gt;&#xA;&lt;li&gt;Check Point Firewalls&lt;/li&gt;&#xA;&lt;li&gt;Juniper Netscreen Firewalls&lt;/li&gt;&#xA;&lt;li&gt;Intelligent Networks (IN) appliances&lt;/li&gt;&#xA;&lt;li&gt;AAA/LDAP&lt;/li&gt;&#xA;&lt;li&gt;Billing and Mediation appliance&lt;/li&gt;&#xA;&lt;li&gt;Charging Gateway appliance&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/p2VRE.png&quot; alt=&quot;Devices with Operations&quot;&gt; &#xA;&lt;img src=&quot;https://i.stack.imgur.com/86nYs.png&quot; alt=&quot;Device Class List 2&quot;&gt; &lt;img src=&quot;https://i.stack.imgur.com/7GseO.png&quot; alt=&quot;Device Class List 1&quot;&gt; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The above were (re)used across the first set of &lt;strong&gt;432 3G flows-paths&lt;/strong&gt; (&lt;em&gt;Stored in separate operation-specific model repository&lt;/em&gt;) where the devices are instantiated &lt;strong&gt;168 times&lt;/strong&gt; saving me all the Copy-Pasting and bringing me &lt;strong&gt;automatic dependency and usage analysis&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/E2Mil.png&quot; alt=&quot;Sample Flow Documented the UML Way&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/9K5q5.png&quot; alt=&quot;Impact Analysis&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;358+ VLANs/VRFS&lt;/strong&gt; have been documented and can be easily applied to any network infra in the model&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;All this in 14 days working 12 hour shifts!&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;May be in future we should be able to integrate this model repository to asset databases like the Configuration Management Database. If anyone has ideas of something already done I would like to know. If you also managed to solve it differently and can reveal a glimpse please do. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Since the 93 devices are nothing secret, I am going to put them on GitHub and allow those with a UML tool to extend this base so that we could possibly have all the device groups that exist in the IT eco-system; &lt;em&gt;pipe dream :]&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems documentation is that most underdeveloped area in NE - my thesis is that if we had sufficient and valid documentation we could simulate a lot of the work we what to do without having to make the actual mistake, then ask how to fix it!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;TODO: Add link to the GitHub repo...&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="504" LastEditorUserId="504" LastEditDate="2013-05-28T18:56:50.607" LastActivityDate="2013-05-28T18:56:50.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1200" PostTypeId="2" ParentId="1193" CreationDate="2013-05-28T12:10:27.357" Score="2" Body="&lt;p&gt;If you have a restriction on CPU/RAM then running GNS3/Dynamips/Dynagen natively rather than in a VM container is always going to use less resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 'GNS3 Workbench' is only really useful when you are someone that perhaps can't install GNS3 on their machine or don't have the required skill (little) to get GNS3 setup yourself.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-28T12:10:27.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1201" PostTypeId="2" ParentId="1029" CreationDate="2013-05-28T12:26:02.927" Score="4" Body="&lt;p&gt;A lot of the responders said the terms should NOT be used interchangeably.&#xA;Actually I think it is perfectly acceptable and common practice amongst people who DO know the difference to use the terms interchangeably when talking about IP on ethernet networks. In fact they pretty much should be synonymous in most circumstances (there's always exceptions) since both define a broadcast domain and your L2 and L3 broadcast domains should normally be identical.&lt;/p&gt;&#xA;" OwnerUserId="1333" LastActivityDate="2013-05-28T12:26:02.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1202" PostTypeId="2" ParentId="1196" CreationDate="2013-05-28T12:31:06.390" Score="2" Body="&lt;p&gt;You can check the mac address table, but there won't be an entry unless there's been traffic. &#xA;A quick method I often use is to ping the device (assuming it has an IP). Even if it doesn't respond to ping it should respond to ARP, and there will be an entry in the ARP table for that IP. &lt;/p&gt;&#xA;" OwnerUserId="1333" LastActivityDate="2013-05-28T12:31:06.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1203" PostTypeId="2" ParentId="123" CreationDate="2013-05-28T12:42:52.280" Score="0" Body="&lt;p&gt;Prevention is hard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could replace wired Ethernet ports by using WiFi for all devices - eliminating need for people to setup their own APs. 802.1X to authenticate and IPsec to secure connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Detection may be only reliable way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireless links have high packet loss and probably significant delay variation. By monitoring packet loss and delay you can detect connections over rouge access points.&lt;/p&gt;&#xA;" OwnerUserId="1236" LastActivityDate="2013-05-28T12:42:52.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1204" PostTypeId="1" CreationDate="2013-05-28T12:50:15.390" Score="8" ViewCount="5015" Body="&lt;p&gt;There are a couple of questions on design solution.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;CAPWAP tunnel is created between the controller and the access points. The ends of the tunnel are the controller's &quot;ap-management&quot; interface and management interface of access point. I've discovered that having the AP and Controller in different L2 domains is best practice, but in theory this seems like a better solution. Which is correct?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;One of the wireless networks will be the guest WI-FI. A secretary will create access attributes. Is it require to create an additional interface (in corporate network) on the controller and give credentials to &quot;Lobby Admin&quot; to implement such a scheme?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="904" LastEditorUserId="775" LastEditDate="2013-05-30T06:28:35.460" LastActivityDate="2013-08-16T19:04:34.827" Title="CISCO Wireless Lan Controller and AP's design question" Tags="|cisco|wireless|wlc|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1205" PostTypeId="1" AcceptedAnswerId="34355" CreationDate="2013-05-28T12:58:01.807" Score="7" ViewCount="15251" Body="&lt;p&gt;Juniper EX switches automatically categorize a port as an spanning-tree &quot;&lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junos11.4/topics/concept/layer-2-services-stp-guidelines-statement-interface-edge-port.html&quot;&gt;edge&lt;/a&gt;&quot; (there should only be one device behind the port) or &quot;non-edge&quot; (another switch) port. You can force this mode for a port by configuring&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols &amp;lt;stp-protocol&amp;gt; interface &amp;lt;interface&amp;gt; edge&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Normally an edge port transitions to a non-edge port when it receives a BPDU. As a security feature we also have &lt;code&gt;bpdu-block-on-edge&lt;/code&gt; enabled, which will shut down an edge port that receives BPDUs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is fine unless you want another switch to take over as root bridge. In that case you have port(s) that suddenly start receiving BPDUs (when the new root bridge is activated) and consequently these ports are shut down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Is there a way to configure a port explicitly as a &quot;non-edge&quot; port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The workaround right now is to disable the &lt;code&gt;bpdu-block-on-edge&lt;/code&gt; feature while the STP converges around the new root bridge.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2016-08-25T10:46:56.317" Title="How do I configure a port as STP &quot;non-edge&quot; on Juniper EX switches?" Tags="|juniper|spanning-tree|juniper-ex|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1206" PostTypeId="2" ParentId="1029" CreationDate="2013-05-28T13:05:06.747" Score="2" Body="&lt;p&gt;The difference between the two is one of significance.  VLANs are generally only locally unique while subnets are usually unique across an organization.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Folks 'in the know' understand that vlan 100 in campus 1 is different than the one at campus 2 if the subnet of one is &lt;code&gt;192.168.1.0&lt;/code&gt; and the other is &lt;code&gt;192.168.2.0&lt;/code&gt; But you could have vlan 100 repeated in every building across a campus if you separate them by layer-3 boundaries and use different subnets.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then there there are the exceptions to the rules or the bad designs that get worked around with duct tape and NAT pools...&lt;/p&gt;&#xA;" OwnerUserId="266" LastEditorUserId="54410" LastEditDate="2019-07-16T00:12:44.477" LastActivityDate="2019-07-16T00:12:44.477" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1207" PostTypeId="2" ParentId="1205" CreationDate="2013-05-28T13:16:18.703" Score="2" Body="&lt;pre&gt;&lt;code&gt;set protocols rstp interface [interface] mode point-to-point&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos10.3/topics/concept/layer-2-services-stp-guidelines-statement-interface-mode.html&quot; rel=&quot;nofollow&quot;&gt;JunOS STP interface mode docs&lt;/a&gt; and this example about &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos9.3/topics/example/spanning-trees-ex-series-rstp-configuring.html&quot; rel=&quot;nofollow&quot;&gt;Configuring Faster Convergence and Improving Network Stability with RSTP on EX-series Switches&lt;/a&gt; would seem to be of interest.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="775" LastEditDate="2013-05-29T20:27:27.737" LastActivityDate="2013-05-29T20:27:27.737" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1208" PostTypeId="2" ParentId="1204" CreationDate="2013-05-28T13:16:49.437" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Putting the APs and the controller in the same L2 domain is the simplest solution as you don't have to do anything else for them to find one another.  If you put the APs on a different subnet then you have to either configure DHCP option 43 on the APs subnet or put in a DNS entry for cisco-capwap-controller.DOMAIN-APs-GET-FROM.DHC. Formerly this was cisco-lwapp-controller.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You'll need to give the secretary either admin or lobby admin access to the WLC so that they can create the logins.  It doesn't need an additional interface for guest wifi but you can use one and plug it into the DMZ for better isolation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Edit: Corrected DHCP option number as @generalnetworkerror pointed out my faulty memory. &lt;/p&gt;&#xA;" OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-05-29T13:04:15.737" LastActivityDate="2013-05-29T13:04:15.737" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1209" PostTypeId="2" ParentId="1204" CreationDate="2013-05-28T13:18:33.343" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;You could attempt to keep the APs and the controller's management interface in the same L2 domain but it would not gain you anything but a headache. The architectural is designed to allow you to plug-and-play APs throughout your network even across L3 boundaries. The APs will discover the controllers through a handful of different ways. We use the DNS discovery. (Add an A record for &quot;CISCO-CAPWAP-CONTROLLER.yourdomain.com&quot;. I believe there is another A record to add, but it escapes me at the moment)&lt;/li&gt;&#xA;&lt;li&gt;I'm not sure that I 100% understand this portion of the question. It sounds like a secretary will set the PSK for the guests. In this case I would for sure recommend you have a different interface that does not allow access to RFC 1918 address space. Use an external DNS server. Then all that is left is to give the secretary access into the WLC to change the SSID's PSK.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-28T13:18:33.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1210" PostTypeId="2" ParentId="1029" CreationDate="2013-05-28T13:30:56.403" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In other words, are there any cases for having a VLAN without a Subnet, and still have IP (L3) communication? [Also ignoring that all networks are not subnets when considering classful networks which all are really just CIDR prefixes these days.]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;some routing protocols can be in the same L2 domain and support the likes of apple talk or other non IP L3/4 protocols. These would need to be in the same L2 domain but not be in the same IP subnet, since IP is not required. In such a case it may be practical to use VLANS without considering IP/Subnetting of any kind.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2013-05-28T13:30:56.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1211" PostTypeId="2" ParentId="1136" CreationDate="2013-05-28T13:30:57.217" Score="2" Body="&lt;p&gt;The impact from this depends on where your servers are located in relation to the LB and the client.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the client is in front of the LB and the server behind such that return traffic (server-to-client) has pass through the LB then there shouldn't be any impact.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the client and server are both in &quot;front&quot; of the LB then you have to NAT the source address to an IP on the LB so that the return traffic comes to the LB. In this case if the application needs to see the clients IP you can have the LB insert it into an HTTP header (assuming HTTP of course) such as HTTP_FORWARDED_FOR.  If it's not HTTP then I'm not aware of a way to make it work without NAT.&lt;/p&gt;&#xA;" OwnerUserId="165" LastActivityDate="2013-05-28T13:30:57.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1212" PostTypeId="2" ParentId="1151" CreationDate="2013-05-28T14:32:43.773" Score="1" Body="&lt;p&gt;Some shaping devices such as the Riverbed Steelhead line and the Exinda portfolio offer inbound shaping. These essentially throttle outbound TCP requests as to limit the inbound traffic. In my experience these solutions work decently over low-latency links but give poor results over high latency (satellite) connections.&lt;/p&gt;&#xA;" OwnerUserId="1341" LastActivityDate="2013-05-28T14:32:43.773" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1213" PostTypeId="1" AcceptedAnswerId="1222" CreationDate="2013-05-28T14:52:50.700" Score="2" ViewCount="96" Body="&lt;p&gt;I am currently working in networking research. I want to establish an environment with a wireless sensor network, where the sensor nodes have the following properties:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Sensor nodes must be directional and have sectors&lt;/li&gt;&#xA;&lt;li&gt;Receiving nodes will be omni-directional&lt;/li&gt;&#xA;&lt;li&gt;Receiving or transmitting will be directional&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My question is primarily about properties 2 &amp;amp; 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to establish environment of the sensor nodes with both omni-directional receiving and directional transmitting?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some links,examples or any solution will help me a lot.&lt;/p&gt;&#xA;" OwnerUserId="1346" LastEditorUserId="49" LastEditDate="2013-05-28T15:47:07.280" LastActivityDate="2013-05-28T16:16:17.523" Title="Directional Sending and Omnidirectional recieving" Tags="|wireless|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1214" PostTypeId="2" ParentId="1193" CreationDate="2013-05-28T14:56:28.620" Score="2" Body="&lt;p&gt;I'll go ahead and provide some more &quot;in-depth&quot; instructions on telling GNS3 to use a &quot;remote hypervisor&quot; (a dynamips instance listening on another machine).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can even use this setup with Amazon EC2 (or another utility computing provider). A setup with a utility computing provider would also be extremely useful for testing out topologies with a &lt;strong&gt;very large&lt;/strong&gt; number of routers, to see how OSPF may behave at scale, etc. I've documented how to do this at my last job (but this was before GNS3 was so popular) and we used it successfully for numerous scale tests. This would also be ideal for folks that don't want to spend the money on a high-end server but can afford to spend a few dollars for a few hours of &quot;server time&quot; for GNS3 labs, without chewing up CPU cycles on their home machines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following instructions assume your remote hypervisor is running Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step One: Set up your Linux box.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;jjensen@jjensen-dev:~$ mkdir dynamips&#xA;jjensen@jjensen-dev:~$ cd dynamips&#xA;jjensen@jjensen-dev:~/dynamips$ mkdir tmp&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Step Two: Set up GNS3. Edit -&gt; IOS images and hypervisors. Click the &quot;External Hypervisors&quot; tab. Add in the IP address info for your remote hypervisor (Most of the time you can leave all the fields besides IP address as the default). Once you've filled in the IP of your remote hypervisor, click &quot;Save&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ISt6G.png&quot; alt=&quot;add remote hypervisor&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have your remote hypervisor added, go back to the &quot;IOS images&quot; tab and add in IOS images. There are two important bits to remember:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the &quot;Linux format&quot; directory notation (see screenshot), and make sure that the &quot;use the hypervisor manager&quot; checkbox is &lt;strong&gt;unchecked&lt;/strong&gt; so that you can select the remote hypervisor that you just added. When adding the IOS image with the remote hypervisor, make sure that your remote hypervisor is selected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/f9syE.png&quot; alt=&quot;add IOS image&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have your IOS image added, start up Dynamips on your remote machine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;jjensen@jjensen-dev:~/network_eng/dynamips$ sudo ./dynamips-0.2.8-RC3-community-x86_64.bin -H 7200 &amp;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should now be able to add devices to GNS3 topologies on your Windows machine, and GNS3 will communicate with the remote hypervisor on another machine. You also get the console access via PuTTy and such for free as well. Note that there isn't really a &quot;configuration limit&quot; on how you want to add your IOS images and hypervisors. You could even have it so that you have a separate remote hypervisor per IOS image if you wanted. Pretty powerful stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone could add additional answers on how to make this work with JunOS/&quot;virtual&quot; Olive, I think that would also be pretty useful. :-)&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-28T15:10:52.433" LastActivityDate="2013-05-28T15:10:52.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1215" PostTypeId="2" ParentId="613" CreationDate="2013-05-28T15:08:06.607" Score="1" Body="&lt;p&gt;Maybe this can work--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices required:&#xA;2 switches (A,B)&#xA;1 router   (R)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch A is where we connect the servers-- &#xA;connect switch A to the router-R on interface-1.&#xA;On the router-R, interface-2 we have to create subinterfaces for other 4 networks. Put them in seperate vlans. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Equinex (10.4.131.1) -- VLAN 20&lt;/li&gt;&#xA;&lt;li&gt;Atrium (204.10.83.1) -- VLAN 30&lt;/li&gt;&#xA;&lt;li&gt;Internet (...)       -- VLAN 40&lt;/li&gt;&#xA;&lt;li&gt;HongKong (10.10.101.1) -- VLAN 50&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Connect router-R interface-2 to the switch-B. And then connect the Handoffs from All 4 networks to the Switch-B and configure them in specified vlan above. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above should work with a single switch and a single router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However-- where is the firewall in the network? this really needs one. &#xA;What kind of handoffs are the other 4 networks. If there is a T1 you will need a T1 card for the router. &lt;/p&gt;&#xA;" OwnerUserId="1342" LastEditorUserId="49" LastEditDate="2013-05-28T15:43:22.123" LastActivityDate="2013-05-28T15:43:22.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1216" PostTypeId="2" ParentId="1213" CreationDate="2013-05-28T15:13:49.690" Score="3" Body="&lt;p&gt;To my knowledge (which is not advanced) directionality is generally a function of the antenna so I suppose that you could use separate transmit and receive antennas such that one could be directional and the other omnidirectional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another alternative would be &lt;a href=&quot;http://en.wikipedia.org/wiki/Beamforming&quot; rel=&quot;nofollow&quot;&gt;beamforming&lt;/a&gt;, which is a signal-processing technique that seems to be simulating directionality in software.&lt;/p&gt;&#xA;" OwnerUserId="165" LastActivityDate="2013-05-28T15:13:49.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1217" PostTypeId="1" AcceptedAnswerId="1218" CreationDate="2013-05-28T15:38:55.850" Score="23" ViewCount="27110" Body="&lt;p&gt;I'd like to start exploring QoS, and lower level optimizations for things like broadcasts/multicasts within my home lab.  I've looked around for ways to generate traffic to and from a box, but haven't found anything to really max out what a given port can handle to really see the effects of QoS etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd love to be able to watch in real time via PRTG or some other monitoring tool - a maxed out line or a busy line(s) before implementing QoS and then be able to see the change in real time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What tools are availableto assist with these tasks?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2013-05-28T19:30:08.957" LastActivityDate="2019-04-21T19:52:22.653" Title="How to generate traffic for lab scenarios" Tags="|qos|testing|" AnswerCount="10" CommentCount="1" ClosedDate="2017-08-19T19:19:28.943" ContentLicense="CC BY-SA 3.0" />
  <row Id="1218" PostTypeId="2" ParentId="1217" CreationDate="2013-05-28T15:42:51.477" Score="27" Body="&lt;p&gt;You can use &lt;a href=&quot;http://sourceforge.net/projects/iperf/&quot;&gt;iperf2&lt;/a&gt; or &lt;a href=&quot;http://code.google.com/p/iperf/&quot;&gt;iperf3&lt;/a&gt; to help generate some traffic. There are quite a few options included that will allow you to accomplish some nice traffic classification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also check out &lt;a href=&quot;http://www.secdev.org/projects/scapy/&quot;&gt;scapy&lt;/a&gt; - specifically a packet former utility. Allows you to define values on each field to get really granular with how traffic is being formed and sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my lab, I have two virtual machines at opposite ends of a physical network. I use both tools I mentioned to send traffic between the virtual machines, but that traffic goes through my lab topology of Cisco routers/switches/firewalls. This way I can have a reliable flow of traffic that I define ahead of time per the lab scenario.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastEditorUserId="775" LastEditDate="2013-05-28T19:14:43.673" LastActivityDate="2013-05-28T19:14:43.673" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1219" PostTypeId="2" ParentId="1217" CreationDate="2013-05-28T15:50:34.510" Score="2" Body="&lt;p&gt;We use Ixia IxChariot for this use.  It's a widely used commercial product and can definitely do what you're looking for.&lt;/p&gt;&#xA;" OwnerUserId="26" LastActivityDate="2013-05-28T15:50:34.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1220" PostTypeId="2" ParentId="1217" CreationDate="2013-05-28T15:54:12.283" Score="8" Body="&lt;p&gt;I have also used &lt;a href=&quot;http://www.netperf.org/&quot;&gt;&lt;code&gt;netperf&lt;/code&gt;&lt;/a&gt; in some situations. It seems to perform better with UDP-tests.&lt;/p&gt;&#xA;" OwnerUserId="1197" LastEditorUserId="775" LastEditDate="2013-05-28T19:20:22.787" LastActivityDate="2013-05-28T19:20:22.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1221" PostTypeId="1" AcceptedAnswerId="1226" CreationDate="2013-05-28T15:54:19.753" Score="6" ViewCount="4602" Body="&lt;p&gt;We need a dual gigabit connection to one of our customers and for the time being one of the lines has been brought online. The connection is between our DC and the customer's HQ, it's a L2 connection. The cities are roughly 420km apart. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The initial tests showed a RTT of 26ms. Since this seemed a bit high so we complained to the carrier (T-Systems in Germany). They did some tests and &quot;optimizations&quot; and suddenly the RTT went down to 15ms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know they can't break the speed of light, I also know that the speed of light in fiber is quite a bit lower than in a vacuum but still, 15 ms seems a bit high for 420km. I also assume there must be several hops along the way but nevertheless, is this what we can reasonably expect ? Should we insist that they do some more &quot;optimizations&quot; ?&lt;/p&gt;&#xA;" OwnerUserId="714" LastActivityDate="2016-08-03T19:52:25.177" Title="What is a reasonable latency for a L2 1G leased line between 2 sites, about 420km apart?" Tags="|fiber|latency|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1222" PostTypeId="2" ParentId="1213" CreationDate="2013-05-28T15:56:02.390" Score="1" Body="&lt;p&gt;I think building this network has two separate problems: Building the desired directional properties from available antennas, and splitting the transmit and receive functionalities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Directional antennas should be straightforward (but not necessarily easy.) Select one (or more) standard antenna designs which fit the &quot;sector&quot; properties you want. Cisco has some &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/wireless/ps7183/ps469/prod_white_paper0900aecd806a1a3e.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;great information&lt;/a&gt;, and there is some directional antenna &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/327/omnidirectional-antennas-and-the-dipole-antenna/339#339&quot;&gt;discussion here on NE.&lt;/a&gt; Since you are in a research environment, you could further tune your antenna properties with specially crafted and positioned grounded metal plates (etc) to tune your antennas. I would expect you'll need an accurate way to measure the signal strengths from your antennas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also information on &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/wireless/ps5678/ps11983/white_paper_c11-722622.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;beam forming solutions from Cisco&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-05-28T15:56:02.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1223" PostTypeId="2" ParentId="1221" CreationDate="2013-05-28T16:01:55.520" Score="0" Body="&lt;p&gt;Ultimately it will depend on the carrier, as well as the region. In my experience 15ms for that distance may be a little high, but not really that much. I would expect around 10-15ms, all told.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I were in your shoes, I'd be interested in hearing about these optimizations - I would ask the carrier what was done to &quot;optimize&quot; this.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-05-28T16:01:55.520" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1224" PostTypeId="2" ParentId="1221" CreationDate="2013-05-28T16:02:12.780" Score="8" Body="&lt;p&gt;Light travels down fiber at roughly 2/3 the speed of light.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore 420km should result in about 4-5 ms round trip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, keep in mind that 420km of aerial distance between two points does not necessarily mean that the fiber distance is 420km, it could be quite different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on how many hand-offs/hops are on the line I would say that 15 ms round trip is pretty good.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-28T16:02:12.780" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1225" PostTypeId="2" ParentId="1125" CreationDate="2013-05-28T16:13:23.863" Score="0" Body="&lt;p&gt;Did you issue a show controllers ethernet-controller gigabitEthernet 0/1 ?  If so, what did you notice on each interface that your are having trouble with?  I agree with irina, check L1 first, then further check your switch for controller errors if there are any.  If you can rule that out, the most likely culprit is the machine or configuration of the machine.&lt;/p&gt;&#xA;" OwnerUserId="1096" LastActivityDate="2013-05-28T16:13:23.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1226" PostTypeId="2" ParentId="1221" CreationDate="2013-05-28T16:14:30.830" Score="4" Body="&lt;p&gt;Each piece of equipment you run through will add latency through it. If you leased dark fiber between the two locations you should see something just under 3ms one way. Just under 6ms RTT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How much latency a device will add can vary wildly depending on how efficient it is at processing the packet, how efficient it is at converting to/from light, if any buffering must be done due to over subscription, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know how your service is delivered but more than likely you're looking at something like this:&#xA;&lt;br&gt;&#xA;CE -&gt; CPE -&gt; PE -&gt; P -&gt; P -&gt; PE -&gt; CPE -&gt;CE&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CE = Client Edge&lt;/li&gt;&#xA;&lt;li&gt;CPE = Customer Premesis Device&lt;/li&gt;&#xA;&lt;li&gt;PE = Provider Edge&lt;/li&gt;&#xA;&lt;li&gt;P = Provider Router (Similar to a Core device)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If each device adds 1ms of latency you've gone from 6ms RTT on dark fiber to 22ms. Each device will probably handle the packet for &amp;lt;1ms but you can see how this adds up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More than likely the &quot;optimizations&quot; your SP did was to use MPLS-TE to use a more efficient route. I can't confirm this but there's no special voodoo you can throw at a box to make it all of a sudden decrease latency...at least none that I've found yet...still looking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum up, I don't think 15ms is too outrageous. If you need better numbers from a latency perspective then you might want to consider other options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; These times do not include any optical devices these lines might (more than likely) be going through. Things like multiplexers and amplifiers will add small amounts of latency as well. Over long distances the likelihood of going through a multiplexer increases greatly.&lt;/p&gt;&#xA;" OwnerUserId="287" LastEditorUserId="762" LastEditDate="2013-05-28T17:59:15.983" LastActivityDate="2013-05-28T17:59:15.983" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1227" PostTypeId="2" ParentId="1213" CreationDate="2013-05-28T16:16:17.523" Score="3" Body="&lt;p&gt;You could look into a technology similar to either Xirrus (access point arrays) or Ruckus (antenna arrays).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both provide a means to listen in a &quot;omnidirectional&quot; sense, but transmit in a more directional means.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-28T16:16:17.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1228" PostTypeId="2" ParentId="1136" CreationDate="2013-05-28T16:26:33.680" Score="2" Body="&lt;p&gt;This is really a design decision and you have already gotten some good answers.  There are many reasons to do both, but here are a couple for doing it either way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have multiple load balancers in some sort of active/active state, you would want to leave this disabled so that the servers behind the load balancer respond to the correct load balancer.  If they were to send traffic back to the wrong load balancer, this could create problems (again based on design).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if your servers are doing logging or need to use the actual source address in any responses, then turning this on will be required.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-28T16:26:33.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1229" PostTypeId="1" AcceptedAnswerId="1233" CreationDate="2013-05-28T16:39:18.477" Score="4" ViewCount="5926" Body="&lt;p&gt;Do Brocade switches(FastIron, NetIron, ICX, etc) support using a per vlan spanning tree or do they only support a single spanning tree instance for all VLANs? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they support per vlan:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is it enabled by default?  &lt;/li&gt;&#xA;&lt;li&gt;What command(s) are used to disable/enable per vlan spanning tree for STP and RSTP?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We are not going to use MST so disregard that as a semi-answer.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-05-28T17:33:05.957" Title="Brocade switches per vlan STP support" Tags="|switch|spanning-tree|brocade|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1230" PostTypeId="2" ParentId="1024" CreationDate="2013-05-28T16:49:31.320" Score="2" Body="&lt;p&gt;I don't have anything on 7.2 still so I can't give you a definitive answer on your question. However, what I can say is that if you take the letter of the documentation as law and presume that you cannot combine FlexConnect and Local ACLs on a single WLAN, and you really don't want to create multiple WLANs, what I know you &lt;em&gt;can&lt;/em&gt; do is use central switching on FlexConnect APs to apply local ACLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We actually do this for our Web Authenticated guest network. Yes, traffic on this network must transit back to the location of the WLC, but it was the best solution for us at the time of implementation.&lt;/p&gt;&#xA;" OwnerUserId="1286" LastActivityDate="2013-05-28T16:49:31.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1231" PostTypeId="2" ParentId="1229" CreationDate="2013-05-28T16:55:55.407" Score="2" Body="&lt;p&gt;According to the documentation I have here (specifically pertaining to the ICX series), enabling PVST should be as simple as configuring spanning-tree within each VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not enabled by default.  Commands for configuring PVST are rather self explanatory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-vlan-10)#spanning-tree rstp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Enables RSTP for VLAN 10 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other pertinent tab-complete commands are available under the &lt;strong&gt;spanning-tree&lt;/strong&gt; command&lt;/p&gt;&#xA;" OwnerUserId="1060" LastEditorUserId="49" LastEditDate="2013-05-28T17:26:18.267" LastActivityDate="2013-05-28T17:26:18.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1232" PostTypeId="1" AcceptedAnswerId="1235" CreationDate="2013-05-28T16:59:19.447" Score="5" ViewCount="3202" Body="&lt;p&gt;Are the commands to configure things like LAG bundles, STP, VLANs, OSPF, MPLS, etc the same between all the platforms or is it different for each? It appears that Brocade uses different OS for each product line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put this in comparison to Cisco where most of the configuration for anything on a Catalyst switch and ISRs using classic IOS is the same.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-06-01T12:26:25.980" Title="Are Brocade configuration commands the same across most or all their products?" Tags="|brocade|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1233" PostTypeId="2" ParentId="1229" CreationDate="2013-05-28T16:59:54.450" Score="7" Body="&lt;p&gt;It's important to note that PVST/PVST+ is Cisco proprietary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They do support one instance of STP per VLAN, and it is enabled by default. You can enable/disable STP on the following levels (taken from the NetIron config docs):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Globally&lt;/strong&gt; - Affects all VLANs&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Individual VLAN&lt;/strong&gt; - Affects all ports within the specified VLAN. When you enable or disable STP within a VLAN, the setting overrides the global setting. Thus, you can enable STP for the ports within a VLAN even when STP is globally disabled, or disable the ports within a port-based VLAN when STP is globally enabled.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Individual Port&lt;/strong&gt; - Affects only the individual port. However, if you change the STP state of the primary port in a LAG group, the change affects all ports in the LAG group.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Depending on your code rev, you can enter config mode for the VLAN and either do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[no] spanning-tree&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[no] rstp&#xA;[no] spanning-tree 802-1w (used on older versions of code)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that newer NetIron gear has PVST/PVST+ compatibility modes which you can turn on at the interface level with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pvst-mode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this also implies that you're going to be running MST, which you said you're not going to do.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-28T17:33:05.957" LastActivityDate="2013-05-28T17:33:05.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1234" PostTypeId="2" ParentId="1217" CreationDate="2013-05-28T17:01:36.083" Score="0" Body="&lt;p&gt;Netperf and scapy are good options if you looking for a simple open-source solution. If you need more complete you would consider agilent N2x and Spirent.&lt;/p&gt;&#xA;" OwnerUserId="1360" LastActivityDate="2013-05-28T17:01:36.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1235" PostTypeId="2" ParentId="1232" CreationDate="2013-05-28T17:04:16.180" Score="3" Body="&lt;p&gt;Brocade's products come from multiple backgrounds, which is the cause of fragmentation in their command set - ie: their *Iron gear is from their acquisition of Foundry, whereas their fibrechannel products are their core product.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco actually suffers the same problem when you branch out of the core routing/switching arena. Their WAAS products ape IOS, but that's really just a shell on top of the underlying product. The WLCs are off in their own little command structure land. Even the NX-OS gear looks an awful lot like IOS, but it's not definitively identical.&lt;/p&gt;&#xA;" OwnerUserId="1286" LastActivityDate="2013-05-28T17:04:16.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1236" PostTypeId="2" ParentId="1232" CreationDate="2013-05-28T17:06:40.690" Score="2" Body="&lt;p&gt;For all of the Foundry-legacy products, Brocade's IOS (yes, they call it IOS as well...its not derived from Cisco's IOS, but it does bear some similarities) is very similar...more similar, in my experience, than even Cisco's IOS is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its only once you start dealing with the Fiber Channel gear that stuff radically changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some subtle differences between Brocade/Foundry platforms, but they are really quite minor.  I find it much easier to move between the various Brocade/Foundry platforms very, very easy.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-05-28T17:06:40.690" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1237" PostTypeId="2" ParentId="1232" CreationDate="2013-05-28T17:06:40.957" Score="3" Body="&lt;p&gt;Brocade has actually been moving to a &quot;unified&quot; type OS for their NetIron products, which should work across both the MLX and CES/CER platforms (the replacements for the BigIron/FastIron boxes), so you'll get some of that Cisco behavior, like you're used to. Like Mark said, the NetIron kit is coming from their acquisition of Foundry years ago, but Brocade is still a hardware vendor that doesn't specialize in just networking equipment, so it's unlikely that there will ever be &quot;one OS to rule them all&quot;.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-28T17:19:05.157" LastActivityDate="2013-05-28T17:19:05.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1238" PostTypeId="2" ParentId="1134" CreationDate="2013-05-28T17:14:34.743" Score="1" Body="&lt;p&gt;To add to the previous answers, you have a new feature called BGP path diverse to allow the RR to advertise a diverse path. For more detail, please check RFC6774 or Cisco implementation at &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/ios_xe/iproute_bgp/configuration/guide/irg_diverse_path_xe.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/ios/ios_xe/iproute_bgp/configuration/guide/irg_diverse_path_xe.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1360" LastActivityDate="2013-05-28T17:14:34.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1239" PostTypeId="1" AcceptedAnswerId="1242" CreationDate="2013-05-28T18:06:05.907" Score="5" ViewCount="1165" Body="&lt;p&gt;For a university project we are designing a network across 3 buildings for a small business. I've decided to implement a microwave point-to-point to connect each building.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of microwave point-to-points I've been viewing online come with a layer 2 switch. However, I was wondering if I could just plug it into the router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If each Microwave dish was connected just from a switch, wouldn't broadcasts from one machine go to all the buildings?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;More Information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it was going to be a fully meshed in terms of the Microwave links (2 on each building to point at the other 2 buildings), for the network inside each building, has a router connected to DHCP server which has fibreoptics to switch, then the switch distributes cat6 to aprox 20 machines plus 3 wireless access points and a printer&lt;/p&gt;&#xA;" OwnerUserId="1363" LastEditorUserId="1363" LastEditDate="2013-05-28T18:50:43.877" LastActivityDate="2013-05-28T19:08:44.730" Title="Is it necessary to use layer 2 switches with microwave point-to-point links?" Tags="|wireless|switch|router|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1240" PostTypeId="2" ParentId="1160" CreationDate="2013-05-28T18:07:01.513" Score="2" Body="&lt;p&gt;Cisco devices try to aggregate flows (you can think of them as conversations) and then export information about them to a collector. This requires memory to cache these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sFlow has two major components: one where it will periodically export statistics like interface counters and CPU usage to a collector, and one where it will randomly capture 1 in N (configurable, usually 512 up to 32768) frames that pass through a router, and export the first 256 bytes. You can then perform statistical analysis on traffic flowing through your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sFlow packet samples are enhanced with information from the routing table such as AS paths. It is also v4 and v6 agnostic, unlike NetFlow, which forces you into an uncomfortable compromise depending on what type of data you want to receive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NetFlow suffers from dating back to an era where flow-based routing was not yet considered a joke; sFlow suffers from not being a TLV format so implementing vendor extensions in a portable way is close to impossible.&lt;/p&gt;&#xA;" OwnerUserId="56" LastActivityDate="2013-05-28T18:07:01.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1241" PostTypeId="2" ParentId="1146" CreationDate="2013-05-28T18:08:54.243" Score="2" Body="&lt;p&gt;Finally sorted - Changed the WAN IP/subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Detailed answer for the people who are interested or want to know...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem lies in the fact that my ISP uses a /31 subnet. When we first set up the Sonicwall, it did not allow us to apply this ip as a static ip as it came up with a configuration error. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I brought this to the attention of SonicWall/Dell and after fighting with them for so long that I was not trying to apply a broadcast IP/network IP to the interface and showed them RFC 3021, they finally gave in that the firewall does not support it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, that was almost (if not longer than) a year ago and we managed to do a workaround in that it applied the /31 fine via DHCP... and, everything worked great - until I wanted to do remote management!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GerryEgan was very helpful, but, after he finished trying to help, I noticed that my computer was transmitting to the SonicWall but not recieving anything back - however the statistics on the Sonicwall for TX on the HTTPS rule were going up and RX remained still.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just had an idea that maybe this /31 subnet goes much deeper in the firewall and after changing the subnet from /31 to /30, I confirmed everything worked fine - so confirmed that the issue is due to SonicWall not supporting /31 subnets - even if it successfully applies via DHCP.&lt;/p&gt;&#xA;" OwnerUserId="1222" LastActivityDate="2013-05-28T18:08:54.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1242" PostTypeId="2" ParentId="1239" CreationDate="2013-05-28T18:14:55.447" Score="7" Body="&lt;p&gt;I'd say &quot;probably&quot; ... depending on the size of the radio, the switch may be doing power injection, which will be something you need to consider before going straight to a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're primarily concerned about broadcasts rather than additional equipment, another answer is using VLANs to limit broadcast domains, allowing you to use the provided switch for more than just the radio when combined with the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end of the day a sure answer to this question is going to depend on the radio hardware itself.&lt;/p&gt;&#xA;" OwnerUserId="1286" LastActivityDate="2013-05-28T18:14:55.447" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1243" PostTypeId="2" ParentId="1217" CreationDate="2013-05-28T18:17:16.173" Score="7" Body="&lt;p&gt;If you are looking to max out line rate traffic such as a GigE port, look at &lt;a href=&quot;http://netsniff-ng.org/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;netsniff-ng&lt;/code&gt;&lt;/a&gt; toolkit or the Linux kernel module &lt;a href=&quot;http://people.kth.se/~danieltt/pktgen/&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;pktgen&lt;/code&gt;&lt;/a&gt;.  I personally used &lt;code&gt;pktgen&lt;/code&gt; on a mid range commodity server and was able to push GigE speeds with ease.&lt;/p&gt;&#xA;" OwnerUserId="1366" LastEditorUserId="775" LastEditDate="2013-05-28T19:20:40.163" LastActivityDate="2013-05-28T19:20:40.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1244" PostTypeId="2" ParentId="1239" CreationDate="2013-05-28T18:46:13.460" Score="3" Body="&lt;p&gt;I think you would have all the machines in one building on a LAN, with the LAN connected to an interface of the building's router. (If your buildings, work groups, machine count, etc are high, then you need more network design within the building.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each needs to know about the other networks beyond the other routers. (Either statically configured routers, or some sort of routing protocol -- here again, you need to do more network design.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the broadcast domain containing all the microwave links, the routers' interfaces would be exchanging broadcasts and traffic (eg for routing protocols) across microwave. But the LAN-side broadcasts, etc would not be routed to the microwave links (this is exactly what routers are all about.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably also need to do more network design regarding how many microwave links and how you're hooking them to router WAN interfaces. Are you making a fully meshed (every router has a microwave link to every other router) topology? ...or a star-design. (Which is very simple in a 3-node WAN, where the center node just has two links.)&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-28T18:46:13.460" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1245" PostTypeId="2" ParentId="1217" CreationDate="2013-05-28T18:59:54.423" Score="4" Body="&lt;p&gt;Short and sweet: use tcpdump to record and make sure you have enough space to store the PCAP.  Then, use tcpreplay (&lt;a href=&quot;http://tcpreplay.synfin.net/&quot;&gt;http://tcpreplay.synfin.net/&lt;/a&gt;) to play it back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get a PCAP with real traffic, you could ask your colleagues politely to allow you to record all of their traffic one day for just an hour (or until the pcap is X-GB in size).  If you're at work, hopefully there won't be a huge objection to it since it should be work-related stuff and your company owns the network, etc.  Offer to destroy all DHCP leases, spoof mac-addresses, and change hostnames if anybody is unsure about what you might see so you can't track it down later.  Whatever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If nothing else, get real traffic from your home network using tcpdump.&lt;/p&gt;&#xA;" OwnerUserId="1370" LastActivityDate="2013-05-28T18:59:54.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1246" PostTypeId="2" ParentId="1239" CreationDate="2013-05-28T19:08:44.730" Score="1" Body="&lt;p&gt;You can plug Ceragon radios directly into a router. We are doing exactly that in a few places. Whether a router is more useful than a switch depends on the topology of your network, of course.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-05-28T19:08:44.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1247" PostTypeId="1" AcceptedAnswerId="1251" CreationDate="2013-05-28T19:09:29.293" Score="1" ViewCount="221" Body="&lt;p&gt;If the switching hub is in the floor above the server, I've heard its best to use fibre-optic cabling to avoid interference from unrelated electrical cabling in the ceiling for lights etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it common for a rack-mount server to have fiber-optic input and output from router and to the switch?  Is there some kind of mediation device that converts it from cat5 to fiber-optics?&lt;/p&gt;&#xA;" OwnerUserId="1363" LastEditorUserId="8499" LastEditDate="2018-03-20T23:37:52.100" LastActivityDate="2018-03-20T23:37:52.100" Title="Is it common for rackmountable servers to have fibroptic input and output? or is it cat 5 and you have to convert after?" Tags="|fiber|layer1|cabling|cable|utp|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1248" PostTypeId="2" ParentId="1247" CreationDate="2013-05-28T19:13:12.887" Score="4" Body="&lt;p&gt;The question of using fiber vs copper for an uplink is commonly answered by distance (or as you pointed out - environmental) requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's hard to say whether or not a server &quot;usually&quot; provides copper or fiber connectivity - this all depends on the NIC installed. Usually, servers are connected to a Top of Rack switching solution, which usually means copper (Cat6) cabling is perfectly fine. Those switches can then be connected to some kind of distribution layer or core via fiber, but again, depending on requirements, this can be Cat6 as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you feel that there are environmental or distance concerns where copper may not yield the best results, then use fiber. However, for short distance, copper connectivity is usually just fine.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-05-28T19:13:12.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1249" PostTypeId="2" ParentId="1247" CreationDate="2013-05-28T19:13:31.113" Score="1" Body="&lt;p&gt;Servers still predominantly come with 1000Base-T interfaces but SFP cages are starting to appear with very new kit. You can also buy SFP NICs for your servers if they don't have them already. Otherwise, use a top-of-rack switch to convert from fibre to copper. Stay away from media converters, they are either no cheaper than a switch or very limited in functionality (jumbo frames!)&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-05-28T19:13:31.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1250" PostTypeId="2" ParentId="1247" CreationDate="2013-05-28T19:15:14.847" Score="1" Body="&lt;p&gt;It's more common in larger servers or in blade chassis setups. That said, there's not much stopping you from going out and buying a fiber nic to install in the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, take a step back and look at your justification/reasoning for doing this. If you're going to have a stack of servers a floor away from your switching area, running an individual cable for each of those servers is going to open up the opportunity for all kinds of problems in the future. The &quot;standard&quot; option here is to put a switch at the top of the rack containing your servers, which will also solve your copper vs fiber issue, and run a single/pair of connections back to the switching area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're doing a one-off server, why is it being installed a floor away from the switching equipment?&lt;/p&gt;&#xA;" OwnerUserId="1286" LastActivityDate="2013-05-28T19:15:14.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1251" PostTypeId="2" ParentId="1247" CreationDate="2013-05-28T19:15:28.097" Score="3" Body="&lt;p&gt;SFP style input is really only common for 10Gig and beyond applications. You can get 1G SFP PCI cards for your servers but I think this would become very expensive when compared to a top of rack switch solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This sounds like a small business setup. From that perspective I would say that as long as the servers are &amp;lt; 100M from the switch and the cable doesn't directly go over florescent lights or something else that could create interference then you should be fine. If that's not the case and your servers are aggregated at 1Gb then I would recommend running fiber to a top of rack switch and using standard Ethernet to aggregate the servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a final note I rarely see actual fiber optics going into a server. It's typically TWINAX if it's SFP based or CAT-5e or CAT-6.&lt;/p&gt;&#xA;" OwnerUserId="287" LastEditorUserId="287" LastEditDate="2013-05-29T15:15:40.167" LastActivityDate="2013-05-29T15:15:40.167" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1252" PostTypeId="1" AcceptedAnswerId="1254" CreationDate="2013-05-28T19:18:07.157" Score="12" ViewCount="16353" Body="&lt;p&gt;A secondary network was configured on an interface of a Cisco 2621 router and the &lt;code&gt;ip helper-address&lt;/code&gt; commands put in place but no clients of that secondary network could pull DHCP addresses. We swapped the primary network and the secondary network and everything started working just fine. Swapped it back and same problem as before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain why this is so? Is there a way to make the forwarding of DHCP requests work for a interfaces secondary network or can it only work on the primary network?&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2016-08-29T16:05:21.667" Title="DHCP relay problem on interfaces secondary network" Tags="|cisco|cisco-ios-12|router|dhcp|" AnswerCount="7" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1253" PostTypeId="2" ParentId="1252" CreationDate="2013-05-28T19:20:35.470" Score="2" Body="&lt;p&gt;I'm fairly certain that when the router forwards the DHCP request it includes only the primary network configured on the interface.  I don't believe there's any way to have it use the secondary network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:  I did some Googling and determined what others have already pointed out, there's a feature called smart-relay that can use the secondary network, but only after the primary times out three times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant quote from &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a00800f0804.shtml#secd&quot; rel=&quot;nofollow&quot;&gt;Understanding and Troubleshooting DHCP in Catalyst Switch or Enterprise Networks - Cisco Systems&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How to make DHCP Work on Secondary IP Segments&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;By default, DHCP has a limitation in that the reply packets are sent&#xA;  only if the request is received from the interface configured with the&#xA;  primary IP address. DHCP traffic uses the broadcast address. When the&#xA;  DHCP request is received by the router interface, it forwards it to&#xA;  the DHCP server (when IP helper-address is configured) with a source&#xA;  address of the primary IP configured on the interface to let the DHCP&#xA;  server know which IP pool it must use (for the client) in the DHCP&#xA;  reply packet.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;There is no way for the router to know if the DHCP broadcast request&#xA;  comes from a device that is on the secondary IP network configured on&#xA;  the interface. As a workaround, sub-interface configuration (provided&#xA;  that the device connected to the router supports dot1q tagging) to&#xA;  separate the two subnets can be configured, so both of them get their&#xA;  correspondent IP addresses properly.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If the secondary address is the preferred way, there is another&#xA;  workaround, which is to enable the global configuration command ip&#xA;  dhcp smart-relay . This has a limitation in that it only uses the&#xA;  secondary IP to relay the DHCP request if there is no response from&#xA;  the DHCP server after three consecutive requests for the primary&#xA;  address pool.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-05-28T19:28:45.437" LastActivityDate="2013-05-28T19:28:45.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1254" PostTypeId="2" ParentId="1252" CreationDate="2013-05-28T19:22:35.267" Score="13" Body="&lt;p&gt;Cisco routers will use the primary subnet configured on the interface for identifying forwarded DHCP requests. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only other option is the &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/ip/configuration/guide/1cfdhcp.html#wp1010291&quot;&gt;DHCP smart relay&lt;/a&gt; feature, which allows a router to use the secondary subnet, but only after multiple DHCP offers for the primary subnet are not seen.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-05-28T19:22:35.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1255" PostTypeId="2" ParentId="1252" CreationDate="2013-05-28T19:23:47.653" Score="9" Body="&lt;p&gt;You have two options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option One: Configure DHCP smart relay (see more on this in the answers from Dave and Mierdin): &lt;pre&gt;ip dhcp smart-relay&lt;/pre&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option Two: Set up a shared-network statement in your dhcpcd.conf (assuming you're running a Linux-based DHCP server - see Peter's answer below if you aren't)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shared-network &quot;testing&quot; { &#xA;&#xA;subnet 192.168.2.0 netmask 255.255.255.0 { &#xA;option routers 192.168.2.1; &#xA;} &#xA;&#xA;subnet 192.168.1.0 netmask 255.255.255.0 { &#xA;option routers 192.168.1.1; &#xA;option domain-name-servers a.b.c.d; &#xA;pool { &#xA;&#xA;} &#xA;} &#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-28T20:09:23.140" LastActivityDate="2013-05-28T20:09:23.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1256" PostTypeId="1" AcceptedAnswerId="1258" CreationDate="2013-05-28T19:56:16.443" Score="9" ViewCount="409" Body="&lt;p&gt;This might be a very basic troubleshooting question, but it's worth asking to make sure I'm testing things the correct way and interpreting results effectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a controlled start point (a server cluster under my control) and an uncontrolled endpoint (a data center I do not have physical or remote access to). As part of normal troubleshooting, I often need to establish latency numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, I've been using &lt;a href=&quot;http://www.pingplotter.com/&quot;&gt;ping plotter&lt;/a&gt; or just a good old fashioned continuous &lt;code&gt;ping&lt;/code&gt; or &lt;code&gt;tracert&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm trying to establish more realistic end to end numbers (the software I'm working with is database software) I'll sometimes use &lt;a href=&quot;http://fiddler2.com/%20%27Fiddler%202%27&quot;&gt;Fiddler 2&lt;/a&gt; to capture web traffic and compare some of the timers there (things like &lt;code&gt;ClientDoneRequest&lt;/code&gt; -&gt; &lt;code&gt;ServerBeginResponse&lt;/code&gt;) to get a full end to end time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do you guys look at when determining numbers for straight network latency?&lt;/p&gt;&#xA;" OwnerUserId="1371" LastActivityDate="2013-05-28T20:15:36.650" Title="Recording latency between a controlled startpoint and uncontrolled endpoint" Tags="|troubleshooting|latency|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1257" PostTypeId="1" CreationDate="2013-05-28T19:58:43.853" Score="5" ViewCount="1738" Body="&lt;p&gt;I need to create a 6 port static Etherchannel link between a stack of 3 Cisco 3850's and a Nortel 8310.  Can someone provided a basic config for the Nortel side.  I have little experience with the platform and online documentation has been frustratingly sparse.&lt;/p&gt;&#xA;" OwnerUserId="1373" LastEditorUserId="49" LastEditDate="2013-05-28T20:02:44.090" LastActivityDate="2013-05-28T20:14:32.443" Title="Etherchannel connections between Cisco and Nortel switches" Tags="|cisco|etherchannel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1258" PostTypeId="2" ParentId="1256" CreationDate="2013-05-28T20:03:20.270" Score="7" Body="&lt;p&gt;The latter half of your question seems to indicate you're looking for latency figures that take into account the process of forming application-layer data, in which case &quot;ping&quot; will not help much considering there's not much data to be formed in a ping packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network folks usually rely on ping because it's a relatively light and reliable way to produce a certain amount of random data to test reachability and latency for a given path. An application which uses HTTP calls, for instance, will behave differently because HTTP is not the same as ICMP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're concerned with general network latency figures, outside of any application-specific context (which is the best way to test), ping works just fine. &lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-05-28T20:03:20.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1259" PostTypeId="2" ParentId="1256" CreationDate="2013-05-28T20:08:17.883" Score="4" Body="&lt;p&gt;I just want to mention a couple of things. Latency can greatly depend on your host. Make sure its the server you are testing from and not your laptop. Depending on the operating system (Windows or Linux) your ping latency times may be different. I have had experience where Windows systems were showing slower latency than Linux systems across the same network paths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping as a reasonable test. However, if you can do a TCP session from your server to your endpoint in that datacenter, you will get more accurate numbers without having control of the endpoint. I would run a packet capture while your TCP session is established. Then follow the TCP stream and look at your delta times. What is the time difference between your initial TCP packet and the next sequence? That is about in realtime what sort of latency you are seeing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you trying to discover if the network is performing good or if the servers are performing their jobs?&lt;/p&gt;&#xA;" OwnerUserId="1368" LastActivityDate="2013-05-28T20:08:17.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1260" PostTypeId="2" ParentId="1252" CreationDate="2013-05-28T20:08:26.413" Score="2" Body="&lt;p&gt;With Microsoft DHCP servers (and perhaps others) you can use superscopes to have it hand out from the secondary addresses.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://support.microsoft.com/kb/169140&quot; rel=&quot;nofollow noreferrer&quot;&gt;Using DHCP to Assign IP Addresses to Secondary Networks&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Some routers can be configured with primary and secondary addresses that allows one port on a router to listen to multiple (logical) subnets.&lt;/p&gt;&#xA;&lt;p&gt;Windows NT 4.0 Service Pack 2 and later introduced Superscoping support for DHCP. This allows a DHCP server with one network interface card to assign leases for multiple logical subnets.&lt;/p&gt;&#xA;&lt;p&gt;To setup Superscopes in DHCP Manager, perform the following steps:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create a new scope in DHCP Manager that corresponds with the primary&#xA;subnet on the router.&lt;/li&gt;&#xA;&lt;li&gt;Create the Superscopes that will be a part of&#xA;the secondary address(es) configured on the router.&lt;/li&gt;&#xA;&lt;li&gt;Use the DHCP Manager to define the Superscope to include all the subnets.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;For complete steps on how to setup DHCP Superscoping, please refer to the following article in the Microsoft Knowledge Base:&#xA;161571 Using DHCP Superscopes to Serve Multiple Logical Subnets&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="266" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-05-28T20:08:26.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1261" PostTypeId="2" ParentId="1256" CreationDate="2013-05-28T20:10:33.077" Score="5" Body="&lt;p&gt;Do you have the option of using IP SLA between two routers at each point? I'm not sure about your topology at the remote end so not sure if you have a server on the other side or if that server connects to a router which could in theory run IP SLA&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-28T20:10:33.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1262" PostTypeId="2" ParentId="1257" CreationDate="2013-05-28T20:14:32.443" Score="4" Body="&lt;p&gt;Look at this link and scroll about half way down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forums.networkinfrastructure.info/nortel-ethernet-switching/ers-8300-and-lacp-with-hp-blade-servers/&quot; rel=&quot;nofollow&quot;&gt;http://forums.networkinfrastructure.info/nortel-ethernet-switching/ers-8300-and-lacp-with-hp-blade-servers/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: Fixed - Here's how you get LACP to work with the 8300.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration is simple, for a base line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure your ports and vlans as you would normally (for multiple vlans enable tagging on the port level)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config ethernet 1/1-1/2,2/1-2/2 perform-tagging enable&#xA;config ethernet 1/1-1/2,2/1-2/2 lacp key 10&#xA;config ethernet 1/1-1/2,2/1-2/2 lacp aggregate true&#xA;config ehternet 1/1-1/2,2/1-2/2 lacp enable&#xA;&#xA;config vlan 2 create byport 1&#xA;config vlan 2 ports add 1/1-1/2,2/1-2/2 member portmember&#xA;&#xA;Configure your mlt group&#xA;&#xA;config mlt 5 create&#xA;config mlt 5 lacp key 10&#xA;config mlt 5 lacp enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1368" LastActivityDate="2013-05-28T20:14:32.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1263" PostTypeId="2" ParentId="1256" CreationDate="2013-05-28T20:15:36.650" Score="4" Body="&lt;p&gt;Latency can be a funny thing to measure - especially accurately. Ping does a good enough job for a general idea on how your network's latency stands, but when it comes to very low numbers it can become the wrong tool for the job. It also does nothing for higher level testing (like website response times). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For measuring strictly network performance (latency/bandwidth/loss/etc.) I like &lt;a href=&quot;http://www.exfo.com/products/field-network-testing/ftb-ecosystem/platforms&quot; rel=&quot;nofollow&quot;&gt;Exfo's testing gear&lt;/a&gt;. This is simply a preference and honestly it's the first device I used so I'm sure competing devices would work just as well. JDSU is also a major supplier of this kind of equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also &lt;a href=&quot;http://www.kitchenlab.org/www/bmah/Software/pchar/&quot; rel=&quot;nofollow&quot;&gt;PCHAR&lt;/a&gt; which is an open-source tool for measuring latency more accurately than ping. I have not directly used it but I know people who have and like it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://iwl.com/white-papers/75-limitations-of-icmp-echo-for-network-measurement&quot; rel=&quot;nofollow&quot;&gt;This article&lt;/a&gt; gives you a good overview of some of the things ICMP Echo can/can't do well.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-28T20:15:36.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1264" PostTypeId="1" AcceptedAnswerId="1265" CreationDate="2013-05-28T20:23:31.380" Score="4" ViewCount="221" Body="&lt;p&gt;I'm designing a network and have 2 cabinets on each floor, and I'm thinking of using FCoE switches in both cabinets so that I can connect them with fibreoptic cable. I think I can easily find switches to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches I'm interest in use B-Series SFP+ transcievers. What type of fibre optic cable do I need to connect these 2 switches? A 4-Gbps throughput should be fine for this network design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;More information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main reason for connecting using fibreoptics was to avoid interference from electrics in the ceilling and also for the high speed. Maybe FCoE was not the best soloution? i just need to connect to cabinet switches fibreoptically &lt;/p&gt;&#xA;" OwnerUserId="1363" LastEditorUserId="8499" LastEditDate="2018-03-21T00:38:07.430" LastActivityDate="2018-03-21T00:38:07.430" Title="Connecting 2 FCoE Switches together with optical cable" Tags="|layer1|fiber|cable|cabling|fcoe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1265" PostTypeId="2" ParentId="1264" CreationDate="2013-05-28T20:27:55.117" Score="5" Body="&lt;p&gt;Don't confuse FCoE with a &quot;standard&quot; fibre ethernet connection. FCoE, as the name implies, delivers fibrechannel over ethernet rather than over traditional fibrechannel connections, allowing for &quot;converged&quot; networking. Fibrechannel is typically used in storage networks, not general computing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all you're wanting to do is link to cabinets with fibre, you do not need FCoE. You just need two switches with multimode transcievers and then standard multimode cable with appropriate connectors for the transcievers. Typical new gear these days are SFP form factor transcievers and LC ends on cables.&lt;/p&gt;&#xA;" OwnerUserId="1286" LastActivityDate="2013-05-28T20:27:55.117" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1266" PostTypeId="2" ParentId="1264" CreationDate="2013-05-28T20:31:08.410" Score="5" Body="&lt;p&gt;If you're utilizing the HP B-Series SFP+ transceiver, then you will be using native Fibre Channel, not FCoE. Just to clarify. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to use FCoE, you should use a compatible 10GbE ethernet transceiver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have run both just fine over laser-optimized 50 micron, but this will depend on distance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A little more detail in your question would have been better.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-05-28T20:31:08.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1269" PostTypeId="1" CreationDate="2013-05-28T20:53:27.890" Score="7" ViewCount="1141" Body="&lt;p&gt;I have performed some analysis and noticed that traffic coming in from the Internet contains a myriad of DSCP values. This traffic competes for voice and video resources on the internal network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I establish a trust boundary where all incoming DSCP is rewritten to zero on Cisco and Juniper routers?&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="441" LastEditDate="2013-05-28T21:21:13.837" LastActivityDate="2013-05-29T15:08:47.103" Title="DSCP trust boundary" Tags="|cisco|juniper|qos|dscp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1270" PostTypeId="2" ParentId="1232" CreationDate="2013-05-28T20:54:30.450" Score="1" Body="&lt;p&gt;According to my Foundry training instructor from pre-buyout by Brocade, Ironware and IOS both come from the same original university source tree from long ago. Whether or not that's true, I don't know, just what the instructor told us. I do know from personal experience that the FastIron Edge switches command set was near on identical to the BigIron RX series switches (with the exception of protocol vlans, I think). It's been too long since I've touched a NetIron to remember what those are like, but I would expect them to be almost identical as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To this day I continually catch myself using the Foundry version of commands on Cisco gear and having to look up the proper syntax.&lt;/p&gt;&#xA;" OwnerUserId="1332" LastActivityDate="2013-05-28T20:54:30.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1271" PostTypeId="2" ParentId="1269" CreationDate="2013-05-28T21:00:47.717" Score="5" Body="&lt;p&gt;The following policy-map would work. Just apply this to the inbound of the WAN interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map MARKDOWN&#xA;  class class-default&#xA;    set dscp default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interface Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gig 0/1&#xA;  service-policy input MARKDOWN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just saw the bit about juniper. The following I believe will work for JunOS.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;  so-1/2/3 {&#xA;    unit 0 {&#xA;      rewrite-rules {&#xA;        dscp default;&#xA;      }&#xA;    }&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="287" LastEditorUserId="287" LastEditDate="2013-05-28T21:20:20.270" LastActivityDate="2013-05-28T21:20:20.270" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1272" PostTypeId="1" AcceptedAnswerId="1299" CreationDate="2013-05-28T21:29:56.493" Score="4" ViewCount="1671" Body="&lt;p&gt;Say you have used the &lt;code&gt;management-vrf &amp;lt;vrf-name&amp;gt;&lt;/code&gt; configuration command on your Brocade device and setup a loopback in that VRF with a IP address from your management network for that remote site. Junior tech comes along and consoles into the device and for some reason disables the loopback interface that is in the managment network. Junior tech then proceeds about his business and then leaves that remote site. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you completely lost all ability for remote access to this device? If yes, what would be some recommended backup access methods to said device?&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-05-29T07:01:29.123" Title="Brocade 'management-vrf' feature" Tags="|brocade|management|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1273" PostTypeId="2" ParentId="1272" CreationDate="2013-05-28T21:35:24.967" Score="2" Body="&lt;p&gt;More than likely, if all you had was inband management access via the management VRF. To combat this, your options are a separate network for Ethernet management connectivity, or investing in serial console terminal servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My suggestion is to have remote serial console access (preferably on a separate network, but it's understandable that this may not be feasible due to various reasons) as a backup to inband management at the very minimum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I suppose you could try to get access to the box if it has a routed interface or VE on it, but I'm not sure what your ACL's are on interfaces of that nature. In general, best practices would dictate to deny management/control plane access via data plane ports (unless you don't have dedicated Ethernet management interfaces).&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-05-28T21:35:24.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1274" PostTypeId="2" ParentId="1252" CreationDate="2013-05-28T21:44:25.810" Score="3" Body="&lt;p&gt;Only the interface's primary address is sent in the DHCPDiscover packet as the gateway IP address (giaddr) field of the DHCP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could look into using subinterfaces that allow separate DHCP relay agents (ip helper-address).&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-05-28T21:44:25.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1275" PostTypeId="1" AcceptedAnswerId="1286" CreationDate="2013-05-28T22:18:24.737" Score="5" ViewCount="611" Body="&lt;p&gt;In our corporate headquarters we are looking at replacing a 20+ year old phone system and making the switch to VoIP.  This is a high rise where we have some limits around options for cabling.  Currently we have some 'opportunities' for improvement, where about 95% of our data cabling is out of spec for Cat5e.  We may be moving out of the building in 5 years so management is pushing back on rewiring at this time.  We do have some minor issues with the data cabling, but not enough to force managements hand.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One the VoIP vendors recommended using Long Reach Ethernet.  I have just started researching this and I am rather skeptical.  Does anyone have any experience with any solutions/implementations of Long Reach Ethernet?&lt;/p&gt;&#xA;" OwnerUserId="112" LastEditorUserId="762" LastEditDate="2013-05-28T22:39:46.380" LastActivityDate="2013-05-29T02:22:49.213" Title="Long Reach Ethernet" Tags="|ethernet|cabling|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1276" PostTypeId="1" AcceptedAnswerId="1277" CreationDate="2013-05-28T22:51:58.810" Score="10" ViewCount="11377" Body="&lt;p&gt;What is a tunnel interface used for on a cisco router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the difference between setting up a VPN connection and a tunnel interface; or does this serve the same purpose? &lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="44" LastEditDate="2013-05-29T01:07:07.013" LastActivityDate="2020-04-09T23:38:27.343" Title="What is the use of a tunnel interface on a cisco router?" Tags="|cisco|vpn|router|tunnel|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1277" PostTypeId="2" ParentId="1276" CreationDate="2013-05-28T22:58:15.723" Score="11" Body="&lt;p&gt;Tunnel interfaces have many uses, including participating in a larger VPN configuration. A VPN setup usually has many parts, including encryption, authentication, routing, and finally, the tunneling. Tunneling is also used for IPv4/IPv6 coexistence setups, such as encapsulating IPv6 packets in IPv4 packets payloads, creating GRE tunnels, and multicast tunneling. The point is that while tunnels may be part of a VPN setup, they do not necessarily represent the entire VPN configuration, but only the traffic encapsulation between endpoints.&lt;/p&gt;&#xA;" OwnerUserId="213" LastEditorUserId="67375" LastEditDate="2020-04-09T23:38:27.343" LastActivityDate="2020-04-09T23:38:27.343" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="1278" PostTypeId="1" AcceptedAnswerId="1279" CreationDate="2013-05-28T22:58:51.523" Score="3" ViewCount="8393" Body="&lt;p&gt;What is the difference between a 10Gb LR optic that can only go 10km compared to a ZR optic that can go a lot further at 70km?&lt;/p&gt;&#xA;" OwnerUserId="267" LastEditorUserId="762" LastEditDate="2013-05-28T23:08:49.557" LastActivityDate="2013-08-08T12:41:47.723" Title="Difference between LR and ZR 10Gb Optics" Tags="|fiber|cabling|optics|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1279" PostTypeId="2" ParentId="1278" CreationDate="2013-05-28T23:15:02.267" Score="5" Body="&lt;p&gt;ZR optics are spec'ed to 80km but they're not part of the 10GE standard; they're rather a &quot;Cisco special.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of what actually allows them to transmit light over this distance may be &quot;protected&quot; information from Cisco (both the ZR and ER operate on 1550nm SMF), but they've published some of the optical parameters for the ZR XENPAK &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/modules/ps2797/ps5138/product_data_sheet09186a008007cd00_ps5251_Products_Data_Sheet.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: While I thought that 10GBASE-ZR was Cisco-specific, it's not actually. &lt;a href=&quot;https://en.wikipedia.org/wiki/10-gigabit_Ethernet#10GBASE-ZR&quot; rel=&quot;nofollow&quot;&gt;The wikipedia page for the 10Gig standard&lt;/a&gt; states &quot;multiple manufacturers&quot; have introduced &quot;ZR&quot; optics which are based on the 80km PHY described in the OC192 SONET specs.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-29T01:59:48.653" LastActivityDate="2013-05-29T01:59:48.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1280" PostTypeId="1" AcceptedAnswerId="1283" CreationDate="2013-05-28T23:26:25.133" Score="8" ViewCount="15075" Body="&lt;p&gt;What is the difference between LLDP and LLDP-MED? Is LLDP-MED an add-on to LLDP or something completely different?&lt;/p&gt;&#xA;" OwnerUserId="267" LastEditorUserId="775" LastEditDate="2013-05-29T10:50:06.203" LastActivityDate="2013-05-29T10:50:06.203" Title="Difference between LLDP and LLDP-MED" Tags="|ethernet|voip|lldp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1282" PostTypeId="2" ParentId="1278" CreationDate="2013-05-28T23:57:41.200" Score="1" Body="&lt;p&gt;You pretty much said the difference - it's the maximum distance the optics are rated for.&#xA;With that comes greater expense and power consumption so always use the minimum optic for the cable run you are working with - there's no other advantage.&lt;/p&gt;&#xA;" OwnerUserId="1333" LastActivityDate="2013-05-28T23:57:41.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1283" PostTypeId="2" ParentId="1280" CreationDate="2013-05-28T23:59:44.853" Score="15" Body="&lt;p&gt;Media Endpoint Discovery is an enhancement of LLDP, known as LLDP-MED, that provides the following facilities:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Auto-discovery of LAN policies (such as VLAN, Layer 2 Priority and Differentiated services (Diffserv) settings) enabling plug and play networking.&lt;/li&gt;&#xA;&lt;li&gt;Device location discovery to allow creation of location databases and, in the case of Voice over Internet Protocol (VoIP), Enhanced 911 services.&lt;/li&gt;&#xA;&lt;li&gt;Extended and automated power management of Power over Ethernet (PoE) end points.&lt;/li&gt;&#xA;&lt;li&gt;Inventory management, allowing network administrators to track their network devices, and determine their characteristics (manufacturer, software and hardware versions, serial or asset number).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The LLDP-MED protocol extension was formally approved and published as the standard ANSI/TIA-1057 by the Telecommunications Industry Association (TIA) in April 2006.&lt;/p&gt;&#xA;" OwnerUserId="1333" LastActivityDate="2013-05-28T23:59:44.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1284" PostTypeId="2" ParentId="1278" CreationDate="2013-05-29T00:03:01.333" Score="1" Body="&lt;p&gt;I don't necessarily agree with the previous answers. It is true that these longer range optics aren't part of the standard.  But Cisco special? Maybe they first introduced them, I don't know.  But these are quite commonplace. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The major difference is not the transmit power, but rather the sensitivity of the receiving side. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are a lot more expensive, maybe that's the main difference!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you aren't running DWDM/optical amplifiers, and have a one off long distance run or two, these could be a good fit for you.  I am running some and they work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-mike&lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2013-05-29T00:03:01.333" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1285" PostTypeId="2" ParentId="1014" CreationDate="2013-05-29T00:29:54.867" Score="3" Body="&lt;p&gt;Going &quot;All Wireless&quot; can be very viable in the right environment and with proper planning. One of the key concepts that I see engineers who have not spent a good bit of time working on WiFi networks make is to forget that wireless networks that uses FCC unlicensed spectrum, such as 802.11n or 802.11ac operate on a shared, uncontrolled physical medium. A successful deployment will keep in mind the physical environment as well as the expected network utilization, both factors in managing external (outside your building or floor) and internal, self induced interference.&#xA;I have seen companies with minimal network traffic requirements go all wireless in even noisy open environments while others with high performance requirements required a great deal of expensive time and effort to tweak and tune the AP (Access Point) density, configuration and placement.&#xA;I have seen companies with a lot of media heavy users in tight quarters above the ground floor of an all glass walled office building in down town San Francisco that eventually went all wireless, it is just took a lot of work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ask yourself a few questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What kind and how much traffic should I expect on the WiFi network?&lt;/li&gt;&#xA;&lt;li&gt;How dense will the client environment be? (# of users per AP can have a significant difference on performance in noisy environments)&lt;/li&gt;&#xA;&lt;li&gt;What are the walls of the building made of? A Drywall wall might only cause 3dB of signal loss, while poured cement walls might be over 20dB of loss.&lt;/li&gt;&#xA;&lt;li&gt;What are your neighbors doing? There are plenty of simple, free tools that you can use to see what the wireless environment outside the building/office is like.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A typical CAT6 cable run will cost between $150-$300 based on your location, do the math and it is easy to see that a well engineered WiFi network can save you money and, if you plan carefully, keep your users happy.&lt;/p&gt;&#xA;" OwnerUserId="1384" LastActivityDate="2013-05-29T00:29:54.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1286" PostTypeId="2" ParentId="1275" CreationDate="2013-05-29T02:22:49.213" Score="7" Body="&lt;p&gt;Wow I had to dust off the cobwebs there, it has been a long time since someone mentioned Long Reach Ethernet.  I'm not aware off-hand of any vendors currently selling/supporting LRE equipment for use in the enterprise...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find the Cisco page on Long Reach Ethernet, I had to dig into the &quot;Wayback Machine&quot;.  (Looks like Cisco long ago took their page down.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://web.archive.org/web/20071010021124/http://www.cisco.com/warp/public/779/servpro/solutions/long_ethernet/&quot;&gt;Cisco LRE Archived Page&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is Cisco Long-Reach Ethernet Networking?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Cisco Long-Reach Ethernet (LRE) broadband networking solution is the industry's first end-to-end product line for delivering 5-15&#xA;  Mbps performance over existing Category 1/2/3 wiring.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With Ethernet-like performance that reaches up to 5,000 feet, LRE enables&#xA;  simultaneous voice, video and data applications, such as high-speed&#xA;  Internet access, video streaming and IP telephony.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It &lt;em&gt;could&lt;/em&gt; help in your situation, but the 2900's and Workstation bridges that you would need have to be nearly impossible to find anymore.  The last date for support was &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5721/ps293/prod_end-of-life_notice0900aecd804242a4.html&quot;&gt;August 20, 2011.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think at this point Cisco makes the assumption that everyone just has to suck it up and roll out the Cat5/6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd love to know if I'm wrong though and someone is still making this type of equipment!  I've got a few remote offices that are in a similar situation.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-05-29T02:22:49.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1287" PostTypeId="1" AcceptedAnswerId="1288" CreationDate="2013-05-29T03:02:47.150" Score="5" ViewCount="6541" Body="&lt;p&gt;Most wireless vendors recommend that unless there is a need to support them, 802.11b should be disabled on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should I go about disabling 802.11b on my network?&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-29T03:02:47.150" Title="How to disable 802.11b wireless clients on my WLAN?" Tags="|ieee-802.11|best-practices|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1288" PostTypeId="2" ParentId="1287" CreationDate="2013-05-29T03:02:47.150" Score="11" Body="&lt;p&gt;I have come across three different ways you may be able to go about disabling 802.11b, depending on your situation and wireless vendor.  I will start with what should generally be the most preferential choice, but any of them will work.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Your wireless vendor may provide a setting to &quot;disable 802.11b clients&quot; or similar.  Generally this will implement the next method automatically for you and may tweak some other settings as well.&lt;/li&gt;&#xA;&lt;li&gt;Remove the following data rates (these are the 802.11b data rates); this is generally a WLAN or ESS based setting:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 Mbps&lt;/li&gt;&#xA;&lt;li&gt;2 Mbps&lt;/li&gt;&#xA;&lt;li&gt;5.5 Mbps&lt;/li&gt;&#xA;&lt;li&gt;11 Mbps&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Adjust your base or required (terminology varies by vendor) data rates to remove the above data rates and select one or more of the following (or any other 802.11g data rate):&#xA;&lt;ul&gt;&#xA;&lt;li&gt;6 Mbps&lt;/li&gt;&#xA;&lt;li&gt;9 Mbps&lt;/li&gt;&#xA;&lt;li&gt;12 Mbps&lt;/li&gt;&#xA;&lt;li&gt;18 Mbps&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The third method allows you to keep the 1/2/5.5/11 Mbps data rates enabled in case you have non-802.11b devices that require them.  This may not be common, but I know that most Nintendo Wii gaming consoles require 1 and/or 2 Mbps to be supported to connect (although after they connect, they will operate at 802.11g speeds).  I have heard third hand that there is also a smartphone that has the same problem, but I do not know make/model or experienced it myself.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-29T03:02:47.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1290" PostTypeId="1" CreationDate="2013-05-29T04:26:34.297" Score="8" ViewCount="1031" Body="&lt;p&gt;If we purchase a single strand of dark fiber which spans 120km, is it possible to light it at 10Gig?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will be using a 6509 switch at one end and a 4948-10GigE at the other end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have not purchased the optics yet, nor the line card for the 6509. We are looking at the &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/data_sheet_c78-643759.html&quot;&gt;ES/ES+ linecards&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="760" LastEditorUserId="775" LastEditDate="2013-05-29T11:46:15.000" LastActivityDate="2013-05-29T11:46:15.000" Title="10GigE fiber over a distance of 120km?" Tags="|fiber|cisco-6500|transceiver|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1292" PostTypeId="2" ParentId="1276" CreationDate="2013-05-29T04:53:11.020" Score="3" Body="&lt;p&gt;A VPN tunnel uses IPSEC which encrypts the packets, usually between two LANs connected via the Internet. IPSEC tunnels have no multicast support which means that you can't run dynamic routing protocols like EIGRP, OSPF and ISIS over the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also various forms of VPNs like DMVPN, SSL VPN and GET VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A GRE tunnel can be used for many things, to support multicast, IPv6 or even CLNS which is used for ISIS. A GRE tunnel has no encryption which the VPN tunnel has.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get support for both routing and encrypting the packets it is common to deploy IPSEC and GRE together so that it's supported to run dynamic routing protocols over it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also other tunneling modes like IP in IP, 6to4, ISATAP and so on.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-29T04:53:11.020" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1293" PostTypeId="2" ParentId="1290" CreationDate="2013-05-29T05:02:01.620" Score="4" Body="&lt;p&gt;Not with a 4948-10GE I'm afraid. X2 transceivers can only go up to 10GB-ZR which will get you ~80km.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: dfex is right on the money as well - you'll need to get the path loss from your provider before you can make an informed decision on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2nd edit/suggestion - if the path loss still prohibits you from off-the-shelf optics, maybe ask your provider if they can give you a wavelength instead, at least until you decide if *WDM is a more viable option for your needs.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-29T05:39:17.807" LastActivityDate="2013-05-29T05:39:17.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1294" PostTypeId="2" ParentId="1290" CreationDate="2013-05-29T05:12:28.543" Score="15" Body="&lt;p&gt;The distance of the fibre isn't a good indication of whether you'll be able to run a specific optic/speed across it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need the path loss (measured in dB), which can vary greatly between links of the same distance (due to number of splices, fibre quality etc.)  Also, the distance of the fibre in the ground is usually about 25-30% longer than the path it travels to allow slack for re-splicing, so you'll really need this info up front.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure that that sort of distance will be possible at 10G with any off-the-shelf optics regardless, without some amplification.  There are however 1GE SFPs that should be able do this (-28dBm RX sensitivity)&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2013-05-29T05:12:28.543" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1295" PostTypeId="2" ParentId="1290" CreationDate="2013-05-29T05:27:19.770" Score="6" Body="&lt;p&gt;as @dfex said you really need to measure the true attenuation before proceeding. There are special transceivers that have FEC and claim to achieve extended reach (for example from Menara Networks). However I would probably go with traditional amplification and with some small DWDM system.&lt;/p&gt;&#xA;" OwnerUserId="1197" LastActivityDate="2013-05-29T05:27:19.770" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1296" PostTypeId="1" AcceptedAnswerId="1297" CreationDate="2013-05-29T06:37:59.110" Score="2" ViewCount="143" Body="&lt;p&gt;What command (debug) can I use to see authentication errors on a cisco 3G router specifically for the 3G connection?&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-05-29T06:53:06.680" Title="How can I log authentication errors in 3G routers?" Tags="|cisco|router|cisco-commands|mobile|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1297" PostTypeId="2" ParentId="1296" CreationDate="2013-05-29T06:53:06.680" Score="5" Body="&lt;p&gt;Most 3G authentication will be done via PPP using either CHAP or PAP, so I'd start with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debug ppp negotiation&#xA;debug ppp authentication&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and see what you get back.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2013-05-29T06:53:06.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1298" PostTypeId="2" ParentId="356" CreationDate="2013-05-29T06:53:18.923" Score="2" Body="&lt;p&gt;This IPv6 filtering recommendation is a bit dated, but still has the fundamentals right I think: &lt;a href=&quot;http://www.space.net/~gert/RIPE/ipv6-filters.html&quot; rel=&quot;nofollow&quot;&gt;http://www.space.net/~gert/RIPE/ipv6-filters.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1085" LastActivityDate="2013-05-29T06:53:18.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1299" PostTypeId="2" ParentId="1272" CreationDate="2013-05-29T07:01:29.123" Score="7" Body="&lt;p&gt;Always have at least two different ways to get into a core box remotely. Generally this means in-band and out-of-band. The inband would simply allow your management range to SSH into the box via any available port, while the out-of-band would be a different link via console or ethernet into the management card/fxp port/ etc&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-29T07:01:29.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1300" PostTypeId="2" ParentId="1276" CreationDate="2013-05-29T07:33:23.443" Score="3" Body="&lt;p&gt;A tunnel give you a route-based VPN option. This allows you to run routing protocols over your tunnels which allows for better failover capabilities. You can also set up a single tunnel, then route many different prefixes over that same single tunnel. If the other side adds a new prefix, just add another static route to the existing tunnel.&#xA;I also find it easier to do network-wide NAT for overlapping VPN subnets as the tunnel interface is just another layer3 point-to-point interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tunnels are also handy for times when you need to run two different VRFs over an interface that doesn't support many subinterfaces. A DSL link is an example. In this case you can run a tunnel over the normal link, and have that tunnel in a different VRF&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-29T07:33:23.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1301" PostTypeId="1" AcceptedAnswerId="1308" CreationDate="2013-05-29T07:39:56.090" Score="5" ViewCount="1759" Body="&lt;p&gt;My current solution for dedicate internet link for specific applications (eg. skype) is to use PBR with static destination of Skype servers IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But unfortunately IP address may change/add, and we have to manually configure them in PBR. So I want to think for another way to do this solution. One I can think of is to use some DPI marking DSCP and have routers to do PBR by DSCP marked. But I am still not sure if it will accurate enough.&lt;/p&gt;&#xA;" OwnerUserId="368" LastActivityDate="2013-05-30T10:07:51.470" Title="Better way to dedicate internet link for Skype other than PBR" Tags="|wan|pbr|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1302" PostTypeId="1" AcceptedAnswerId="1312" CreationDate="2013-05-29T07:46:14.623" Score="4" ViewCount="10566" Body="&lt;p&gt;&lt;strong&gt;What are the best practices for running an &lt;a href=&quot;/tags/igp&quot; title=&quot;Interior Gateway Protocol&quot;&gt;IGP&lt;/a&gt; to learn networks at HQ from branch offices when those offices connect via IPSec LAN-to-LAN VPN tunnels over the Internet?&lt;/strong&gt;  The branch offices terminate on Cisco VPN Concentrators that are being replaced with Cisco ASA-X's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it better to let a dynamic routing protocol (IGP) -- in this case &lt;a href=&quot;/tags/ospf&quot; title=&quot;Open Shortest Path First&quot;&gt;OSPF&lt;/a&gt; -- run directly through or to the firewalls (and across the tunnels) or is OSPF over &lt;a href=&quot;/tags/gre&quot; title=&quot;Generic Routing Encapsulation&quot;&gt;GRE&lt;/a&gt; (through the firewalls, but not to the firewalls) the way to go or some other option?  We have too many static routes in place that need to be eliminated.  The IPSec VPN branch offices are small and don't currently run an IGP other than statics, so consider it a clean slate on what to do with branch office routing.  Routers exist beyond the firewalls and can be used for tunneling if needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*Answers should focus on Cisco ASA-X's in the mix with L3 switches behind them to run any GRE tunnels if necessary.  &lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="49" LastEditDate="2013-06-05T13:06:44.607" LastActivityDate="2013-06-05T13:06:44.607" Title="Dynamic Routing Protocol (IGP) over IPSec VPN tunnels to branch offices?" Tags="|routing|ospf|cisco-asa|gre|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1303" PostTypeId="2" ParentId="1302" CreationDate="2013-05-29T08:02:56.170" Score="1" Body="&lt;p&gt;Anytime possible I would use EIGRP (faster convergence and failover) over the tunnels then next in preference would be OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GRE is not supported by ASA as far as I know.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-05-29T08:02:56.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1304" PostTypeId="2" ParentId="1302" CreationDate="2013-05-29T08:10:30.213" Score="4" Body="&lt;p&gt;Dynamic protocols only really make sense if your sites have more than one exit point, or you have many routes per site that can't be nicely aggregated into a single static route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would stick with OSPF, simply to be able to use other vendors. I know EIGRP has been 'released' but its going to be years until you see other vendors using it and you dont want to be locked into a single vendor&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-05-30T07:03:49.663" LastActivityDate="2013-05-30T07:03:49.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1305" PostTypeId="2" ParentId="1302" CreationDate="2013-05-29T08:29:48.920" Score="1" Body="&lt;p&gt;You can't terminate the GRE on the ASA, if you want to terminate it you will need a router behind the ASA because the GRE traffic can pass through the ASA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case because you are using two ASAs, it is better to use OSPF over existing IPSEC or VPN tunnel. Terminate the VPN on the first ASA then add OSPF on both ASAs for learning the networks. This way you don't need GRE anymore.&lt;/p&gt;&#xA;" OwnerUserId="1397" LastActivityDate="2013-05-29T08:29:48.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1306" PostTypeId="1" CreationDate="2013-05-29T08:45:24.630" Score="7" ViewCount="4232" Body="&lt;p&gt;We are going to deploy 4500R+E chassis with two redundant supervisors Sup7L-E. &#xA;All ports in chassis - switchport with trunks. L3 interfaces - SVI. Chassis wll terminate L3 domain (route between zone), no dynamic routing protocols, only static routing.&#xA;&lt;br&gt;&lt;br&gt;&#xA;What is the best redundancy mechanism for such deployment: RPR or SSO? &lt;/p&gt;&#xA;" OwnerUserId="904" LastEditorUserId="105" LastEditDate="2013-05-29T09:04:32.800" LastActivityDate="2013-05-29T09:13:36.853" Title="CISCO 4500R+E, Sup7L-E redundancy: RPR or SSO?" Tags="|cisco-catalyst|redundancy|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1307" PostTypeId="2" ParentId="1302" CreationDate="2013-05-29T08:48:43.690" Score="2" Body="&lt;p&gt;It is possible to run OSPF over an IPsec VPN  between two ASAs, without the use of GRE (which as mentioned before, is not supported on the ASA). You just need to use static neighbors since multicast won't go through, and define the OSPF interface as point-to-point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of running &lt;a href=&quot;http://packetsneverlie.blogspot.de/2013/03/route-based-ipsec-vpn-with-ospf.html&quot; rel=&quot;nofollow&quot;&gt;OSPF over IPSec&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="714" LastEditorUserId="775" LastEditDate="2013-05-29T09:50:48.403" LastActivityDate="2013-05-29T09:50:48.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1308" PostTypeId="2" ParentId="1301" CreationDate="2013-05-29T09:06:08.793" Score="5" Body="&lt;p&gt;In Windows you could use &lt;a href=&quot;http://technet.microsoft.com/en-us/library/cc771283%28v=ws.10%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;Policy Based QoS to set DSCP matching on the application name&lt;/a&gt; (applied through group policy)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: document refers to Server 2008 but the feature seems to available on Windows 7 Desktop as well&lt;/p&gt;&#xA;" OwnerUserId="1197" LastEditorUserId="105" LastEditDate="2013-05-29T10:00:32.913" LastActivityDate="2013-05-29T10:00:32.913" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1309" PostTypeId="2" ParentId="1306" CreationDate="2013-05-29T09:13:36.853" Score="13" Body="&lt;p&gt;SSO is preferred due to shorter switchover if supervisor fails. From Cisco:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;With supervisor engine redundancy enabled, if the active supervisor engine fails or if a manual switchover is performed, the standby supervisor engine becomes the &amp;quot;new&amp;quot; active supervisor engine. The standby supervisor engine has been automatically initialized with the startup configuration of the active supervisor engine, shortening the switchover time (30 seconds or longer in RPR mode, depending on the configuration; subsecond in SSO mode).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Operation of RPR:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;RPR is supported in Cisco IOS-XE Release 3.1.0SG and later releases. When a standby supervisor engine runs in RPR mode, it starts up in a partially-initialized state and is synchronized with the persistent configuration of the active supervisor engine.&lt;/p&gt;&#xA;&lt;p&gt;In a supervisor engine switchover, traffic is disrupted because in the RPR mode all of the physical ports restart since there is no state maintained between supervisor engines relating to module types and statuses. Upon switchover, when the standby supervisor engine completes its initialization, it will read hardware information directly from the module and become the active supervisor engine.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So the redundant supervisor is only partially initialized. This means there will be a disruption when the supervisor fails over.&lt;/p&gt;&#xA;&lt;p&gt;SSO on the other hand is fully initialized.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;SSO is supported in Cisco IOS-XE Release 3.1.0SG and later releases. When a standby supervisor engine runs in SSO mode, the standby supervisor engine starts up in a fully-initialized state and synchronizes with the persistent configuration and the running configuration of the active supervisor engine. It subsequently maintains the state on the protocols listed below, and all changes in hardware and software states for features that support stateful switchover are kept in synchronization. Consequently, it offers zero interruption to Layer 2 sessions in a redundant supervisor engine configuration.&lt;/p&gt;&#xA;&lt;p&gt;Because the standby supervisor engine recognizes the hardware link status of every link, ports that were active before the switchover will remain active, including the uplink ports. However, because uplink ports are physically on the supervisor engine, they will be disconnected if the supervisor engine is removed.&lt;/p&gt;&#xA;&lt;p&gt;If the active supervisor engine fails, the standby supervisor engine become active. This newly active supervisor engine uses existing Layer 2 switching information to continue forwarding traffic. Layer 3 forwarding will be delayed until the routing tables have been repopulated in the newly active supervisor engine.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It is therefore recommended to run SSO. For full information go to &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1.2/XE_340/configuration/guide/RPR_XE.html#wp1114102&quot; rel=&quot;noreferrer&quot;&gt;Configuring Supervisor Engine Redundancy Using RPR and SSO on Supervisor Engine 7-E and Supervisor Engine 7L-E&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-05-29T09:13:36.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1310" PostTypeId="2" ParentId="1301" CreationDate="2013-05-29T09:18:08.950" Score="5" Body="&lt;p&gt;Starting with IOS 12.4(4)T NBAR can be used to classify skype traffic. You could use a class map to mark skype traffic, something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class−map match−any skype_traffic&#xA; match protocol skype&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then use that class-map with PBR instead of the ACL matching the skype servers IP Addresses. &lt;/p&gt;&#xA;" OwnerUserId="714" LastActivityDate="2013-05-29T09:18:08.950" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1311" PostTypeId="2" ParentId="1280" CreationDate="2013-05-29T10:30:38.760" Score="7" Body="&lt;p&gt;Link Layer Discovery (IEEE-802.1AB-2005) provides the base capabilities for discovery, but was seen as insufficent for IP Telephony and Real Time Video. So the LLDP-MED initiative was formed by HP, Mitel and Avaya in 2004. &lt;em&gt;What does LLDP-MED provide?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Interoperability&lt;/strong&gt; &gt; provide vendor independent management capabilities, enabling different convergence endpoints to interoperate on one network.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Automatic deployment of convergence network policies&lt;/strong&gt; &gt; voice VLAN, Layer 2 and DSCP QoS policies.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Location Services, including Emergency Call Services&lt;/strong&gt; &gt; enablement of E-911, 999, 112for IP Telephony through physical location.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Detailed Inventory Management Capabilities&lt;/strong&gt; &gt; location information and accurate topology is made available. Switch acts as proxy to collect inventory, as few endpoints support SNMP.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Advanced PoE&lt;/strong&gt; &gt; Fine grain power management to support more phones per switch. Backup power conservation to extend UPS battery life during disasters.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;IP Telephony network troubleshooting&lt;/strong&gt; &gt; detect incorrect voice VLAN, QoS and duplex mismatch.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Further, LLDP-MED provides a &lt;em&gt;fast start&lt;/em&gt; behaviour which is very important for IP telephony, this means at Startup the endpoints will initially advertise at a faster rate for a limited time. &lt;/p&gt;&#xA;" OwnerUserId="409" LastActivityDate="2013-05-29T10:30:38.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1312" PostTypeId="2" ParentId="1302" CreationDate="2013-05-29T10:59:08.970" Score="2" Body="&lt;p&gt;Since you are using all ASA-X firewalls, I suggest you go with EIGRP and drop the GRE part - configure IPSEC VPN on ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had about 80+ branch offices connecting to main site with IPSEC VPN (Although tunnels were on routers not on firewalls) EIGRP played really well. EIGRP is much lighter with computations and has better performance than OSPF. Plus EIGRP is lot easier to troubleshoot and configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for GRE you don't have that option (because you have ASA firewalls not routers) and if you ask me GRE is not the way to go with IPSEC VPN anyway.&lt;/p&gt;&#xA;" OwnerUserId="1401" LastActivityDate="2013-05-29T10:59:08.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1313" PostTypeId="1" AcceptedAnswerId="1314" CreationDate="2013-05-29T11:11:48.060" Score="13" ViewCount="2228" Body="&lt;p&gt;I've heard about VRF's and GRF's, but was is the difference between those 2? (cisco)&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-06-01T17:39:17.123" Title="What is the difference between a VRF and GRF? (cisco)" Tags="|cisco|routing|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1314" PostTypeId="2" ParentId="1313" CreationDate="2013-05-29T11:32:10.993" Score="23" Body="&lt;p&gt;GRF is the global routing and forwarding table. Also known as the default VRF in other vendors. It's simply the regular RIB used when no VRFs are used, or the original VRF when other VRFs are used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VRF is a virtual routing and forwarding table which allows a physical router to run a 'virutal' router with it's own RIB and FIB and routing protocols. &lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-06-01T17:39:17.123" LastActivityDate="2013-06-01T17:39:17.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1315" PostTypeId="5" CreationDate="2013-05-29T12:16:50.120" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-05-29T12:16:50.120" LastActivityDate="2013-05-29T12:16:50.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1316" PostTypeId="4" CreationDate="2013-05-29T12:16:50.120" Score="0" Body="Link-Layer Discovery Protocol (LLDP) is used by network devices to advertise and discover other pieces of equipment across the network. It is defined in IEEE 802.1AB and extended as LLDP-MED in ANSI/TIA-1057." OwnerUserId="736" LastEditorUserId="736" LastEditDate="2013-05-29T12:37:02.510" LastActivityDate="2013-05-29T12:37:02.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1317" PostTypeId="2" ParentId="1247" CreationDate="2013-05-29T12:17:25.077" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there some kind of mediation device that converts it from cat5 to fiber-optics?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you want to convert between fibre and copper you can use a media converter such as these;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.tp-link.com/en/products/?categoryid=225&quot; rel=&quot;nofollow&quot;&gt;http://www.tp-link.com/en/products/?categoryid=225&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://global.level1.com/Media-Converter/Unmanaged/2-16-73.htm#2&quot; rel=&quot;nofollow&quot;&gt;http://global.level1.com/Media-Converter/Unmanaged/2-16-73.htm#2&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-29T12:17:25.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1318" PostTypeId="1" AcceptedAnswerId="1322" CreationDate="2013-05-29T12:46:46.337" Score="4" ViewCount="1797" Body="&lt;p&gt;We are getting the below two error messages randomly on a 2600 series router. Syslog shows the router has been fine up until a few days ago. Would a reboot most likely cure the issue or is it most likely faulty memory in this ancient beast?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-Process= &quot;SNMP ConfCopyProc&quot;, ipl= 0, pid= 81&#xA;-Traceback= 80476224 80478348 8047224C 803E39A0 803E114C 803E0DA0 80450AEC 80450B34 803E5DA4 8045575C 803E1444 803BDA5C 803BDF20 804B345C 804AEA50 804AEB58&#xA;May 28 10:06:02.286: %SYS-2-MALLOCFAIL: Memory allocation of 32768 bytes failed from 0x80472248, alignment 0&#xA;Pool: Processor  Free: 24472  Cause: Not enough free memory&#xA;Alternate Pool: None  Free: 0  Cause: No Alternate pool&#xA;&#xA;&#xA;-Process= &quot;Virtual Exec&quot;, ipl= 0, pid= 67&#xA;-Traceback= 80476224 80478348 8047224C 803E39A0 803E114C 803E0DA0 80450AEC 80450B34 803E5DA4 8045575C 803E1444 803BDA5C 803BDF20 803F1FDC 803F20FC 803E368C&#xA;May 28 10:06:38.739: %SYS-2-MALLOCFAIL: Memory allocation of 32768 bytes failed from 0x80472248, alignment 0&#xA;Pool: Processor  Free: 23512  Cause: Not enough free memory&#xA;Alternate Pool: None  Free: 0  Cause: No Alternate pool&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running 12.3(26) version of IOS. Device uptime is two months.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-05-29T13:26:45.597" Title="Cisco 2600 series router logging a lot of &quot;Memory allocation failed&quot; errors" Tags="|cisco-ios-12|router|memory|errors|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1319" PostTypeId="2" ParentId="1318" CreationDate="2013-05-29T12:54:14.233" Score="0" Body="&lt;p&gt;A reboot will surely alleviate the problem for the moment, but as time passes and router memory loads you will probably hit the same log error. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can either remove some roles you have for this router, or a more uncommon method, would be to schedule an automatic reload at every 1 week or later.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-05-29T12:54:14.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1320" PostTypeId="2" ParentId="1318" CreationDate="2013-05-29T12:54:50.793" Score="0" Body="&lt;p&gt;I do not believe it is faulty memory.  The errors listed are memory allocation failures.  A reload will cure it temporarily, but will not fix the root cause.  More information is needed to determine the source.  See if you can find out what process is using up the memory.  sh proc memory&lt;/p&gt;&#xA;" OwnerUserId="1366" LastActivityDate="2013-05-29T12:54:50.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1321" PostTypeId="2" ParentId="1318" CreationDate="2013-05-29T12:56:01.193" Score="3" Body="&lt;p&gt;If you are getting memory allocation errors, a reload should be in order to clear up whatever is going on, at least temporarily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like you are running out of memory (Cause: Not enough free memory). I would look at perhaps upgrading the memory, which is the cheapest option, or if this router is important enough, even upgrading to a new platform that can more readily support your needs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, try upgrading the IOS. It may be a minor memory leak.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-05-29T12:56:01.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1322" PostTypeId="2" ParentId="1318" CreationDate="2013-05-29T13:26:45.597" Score="7" Body="&lt;p&gt;Do a 'show proc mem sorted' and check for biggest memory users. If that's something that is not related to configuration, it may be bug in the code. If that's something that's related to configuration, you may consider re/deconfigure unnecessary services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As IOS can't defragment memory and you can't reclaim it unless some big allocating process frees memory, I'm afraid that to return to normal operation you need to reboot it. Then I'd start to monitor closely memory allocation in total and for the main processes that are using it. If it grows and router is not doing anything additionally, it's propably bug in the &quot;growing&quot; process. 12.3(26) has some memory oriented bugs, but you'll need to audit the config to check if you're affected.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-05-29T13:26:45.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1323" PostTypeId="1" AcceptedAnswerId="1324" CreationDate="2013-05-29T13:45:48.040" Score="3" ViewCount="273" Body="&lt;p&gt;I'm working on compiling some information about network latency and designing tests to help our support folks troubleshoot problems. In order to do this, I need some basic information that I don't really have access to (and can't find via a Google search). I'm looking for the following specific numbers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is the maximum throughput across dark fiber that is leased?&lt;/li&gt;&#xA;&lt;li&gt;What is the most common throughput across modern implementation of copper lines?&lt;/li&gt;&#xA;&lt;li&gt;What technology do modern transoceanic lines use and are there any specific considerations to including them as part of a latency test?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Feel free to ask for clarification, I'm looking for hard numbers (specifically the mode or median) in order to better understand what to expect when looking at various client site numbers.&lt;/p&gt;&#xA;" OwnerUserId="1371" LastEditorUserId="8499" LastEditDate="2018-08-09T16:01:55.703" LastActivityDate="2018-08-09T16:01:55.703" Title="How fast can information travel through various media?" Tags="|layer1|fiber|latency|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1324" PostTypeId="2" ParentId="1323" CreationDate="2013-05-29T13:55:31.917" Score="11" Body="&lt;p&gt;Signal travels roughly same speed in copper and fibre, copper being slightly faster. Fibre is determined by &lt;a href=&quot;http://en.wikipedia.org/wiki/Refractive_index&quot; rel=&quot;nofollow&quot;&gt;refractive index&lt;/a&gt;, typically speed being about 0.65c, i.e 200km per 1ms (single direction, not RTT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maximum theoretical throughput is hard to determine, maybedivide wavelengths to Planck length difference and light each up, so absurd amount. But in practice about 128 waves by 100G each in optical fibre.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For copper we're now doing 40G commercially, 100G will happen and is 400G the table. Obviously distances are very short.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-05-29T20:49:47.323" LastActivityDate="2013-05-29T20:49:47.323" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1325" PostTypeId="2" ParentId="1323" CreationDate="2013-05-29T13:57:18.830" Score="4" Body="&lt;p&gt;In terms of maximum throughput through fibre there isn't really a limit you can put on it as it changes year by year.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use a DWDM device on the end of a piece of fibre you will get multitudes more throughput down a single strand compared to a single wavelength.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-29T13:57:18.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1326" PostTypeId="2" ParentId="1252" CreationDate="2013-05-29T14:10:48.840" Score="1" Body="&lt;p&gt;When a DHCP request is sent out its broadcasted from the primary address. So when its sent to whatever helper ip address that is specified, that server will see it coming from the primary ip address.   On like a microsoft server, you need to set up the primary and secondary subnet into a superscope.  It will draw from the secondary pool only after the first pool has exhausted the available ip addresses in the primary pool.   I have heard of the smart-relay, but haven't played around with it yet. &lt;/p&gt;&#xA;" OwnerUserId="1409" LastActivityDate="2013-05-29T14:10:48.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1327" PostTypeId="2" ParentId="1269" CreationDate="2013-05-29T14:25:34.950" Score="0" Body="&lt;p&gt;I think I have this figured out on junos. I created a custom rewrite rule for every fc/plp combo in the implicit classifier map and applied it to the lan interfaces.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show class-of-service&#xA;interfaces {&#xA;    ge-1/1/0 {&#xA;        unit 4 {&#xA;            rewrite-rules {&#xA;                dscp internet;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-1/1/1 {&#xA;        unit 4 {&#xA;            rewrite-rules {&#xA;                dscp internet;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;rewrite-rules {&#xA;    dscp internet {&#xA;        forwarding-class best-effort {&#xA;            loss-priority low code-point be;&#xA;            loss-priority high code-point be;&#xA;        }&#xA;        forwarding-class network-control {&#xA;            loss-priority high code-point be;&#xA;            loss-priority low code-point be;&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;[edit]&#xA;#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit: I came up with another method which only rewrites non-zero dscp. It requires applying a custom classifier to the wan interfaces and a custom rewrite rule to the lan interfaces.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show&#xA;classifiers {&#xA;    dscp internet {&#xA;        forwarding-class best-effort {&#xA;            loss-priority low code-points 000000;&#xA;            loss-priority high code-points [ 000001 000010 000011 000100 000101 000110 000111 001000 001001 001010 001011 001100 001101 001110 001111 010000 010001 010010 010011 010100 010101 010110 010111 011000 011001 011010 011011 011100 011101 011110 011111 100000 100001 100010 100011 100100 100101 100110 100111 101000 101001 101010 101011 101100 101101 101110 101111 110000 110001 110010 110011 110100 110101 110110 110111 111000 111001 111010 111011 111100 111101 111110 111111 ];&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-1/1/0 {&#xA;        unit 0 {&#xA;            classifiers {&#xA;                dscp internet;&#xA;            }&#xA;        }&#xA;        unit 1 {&#xA;            classifiers {&#xA;                dscp internet;&#xA;            }&#xA;        }&#xA;        unit 3 {&#xA;            classifiers {&#xA;                dscp internet;&#xA;            }&#xA;        }&#xA;        unit 4 {&#xA;            rewrite-rules {&#xA;                dscp internet;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-1/1/1 {&#xA;        unit 3 {&#xA;            classifiers {&#xA;                dscp internet;&#xA;            }&#xA;        }&#xA;        unit 4 {&#xA;            rewrite-rules {&#xA;                dscp internet;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;rewrite-rules {&#xA;    dscp internet {&#xA;        forwarding-class best-effort {&#xA;            loss-priority high code-point be;&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;[edit class-of-service]&#xA;#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2013-05-29T15:08:47.103" LastActivityDate="2013-05-29T15:08:47.103" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1328" PostTypeId="1" CreationDate="2013-05-29T14:46:01.090" Score="21" ViewCount="7144" Body="&lt;p&gt;I'm planning the network for my company's new office space.  I'm not an expert so I'd like to present my plan and ask y'all nice folk to tell me if and where I'm making mistakes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assumptions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Office is 300 sq meters on a single floor with mostly drywall walls.&lt;/li&gt;&#xA;&lt;li&gt;We currently have 18 workers.&lt;/li&gt;&#xA;&lt;li&gt;Due to expected growth, the office should support 50 workstations people comfortably.&lt;/li&gt;&#xA;&lt;li&gt;We are a mobile app company so between our dev team and our testers we need wireless support for 200+ devices mostly smart phones.&lt;/li&gt;&#xA;&lt;li&gt;Most of our traffic is to and from the internet rather than internal&lt;/li&gt;&#xA;&lt;li&gt;Need multiple wireless networks (internal &amp;amp; guest at minimum)&lt;/li&gt;&#xA;&lt;li&gt;No on site servers (other than developers running some locally for dev &amp;amp; testing).&lt;/li&gt;&#xA;&lt;li&gt;All code, documentation, production servers, etc is cloud. (We use Dropbox for backup, Atlassian for JIRA &amp;amp; confluence, BitBucket for repos, S3 for servers, etc)&lt;/li&gt;&#xA;&lt;li&gt;The ISP can provide 30MBps d/l and either 2 or 4 u/l&lt;/li&gt;&#xA;&lt;li&gt;workstations are all Apple (network cards all 10/100/1000)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My current plan:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;2 LAN drops per workstation, CAT5e wiring to a patch panel, should be around 100 terminations.&lt;/li&gt;&#xA;&lt;li&gt;Modem - Cisco 887. This is included in the ISP's package.&lt;/li&gt;&#xA;&lt;li&gt;Router / Firewall - Soekris 6501 running pfSense (&lt;a href=&quot;http://soekris.com/products/net6501.html&quot;&gt;http://soekris.com/products/net6501.html&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Switch (wired) -  HP 2510-48G, L2 fully managed, Gigabit. I'll start with one and only hook up the workstations in use. If I need more, I can add more.&lt;/li&gt;&#xA;&lt;li&gt;Wireless controller with a few wireless access points.&lt;/li&gt;&#xA;&lt;li&gt;Set up all LANs on the router.&lt;/li&gt;&#xA;&lt;li&gt;Trunk the wired switch to the router and use the wired switch as a dumb switch&lt;/li&gt;&#xA;&lt;li&gt;Connect the wireless controller to the router so it is physically separate from the main LAN.&lt;/li&gt;&#xA;&lt;li&gt;Set up 2 wireless networks with wireless authentication with WPA2 &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For the Soekris, there are a bunch of options (RAM, CPU). Can I go&#xA;with the basic or do I need to get the high end options?&lt;/li&gt;&#xA;&lt;li&gt;For the wireless setup, I don't fully understand the differences between and when to use a wireless controller and a wireless access point. Do I need both, one, none?  I've spent a lot of hours reading and talking to folks and I still don't know what to get.&lt;/li&gt;&#xA;&lt;li&gt;My best guess for the above question is to get either the either the Cisco CT-2504-5 wireless controller or Netgear ProSafe 16-AP Wireless Management System along with either the Cisco or Netgear access points. Both controllers are around $1000 and seem to do the same stuff. Are there important diferences?&lt;/li&gt;&#xA;&lt;li&gt;As to the Access points, I'm also confused.  Netgear has WNDAP350 and WNDAP360. Again, I can't understand the difference here.&lt;/li&gt;&#xA;&lt;li&gt;Do I really gain by trunking the switch to the router?&lt;/li&gt;&#xA;&lt;li&gt;Am I going overboard here? Did I plan a backhoe when all I need is a spade?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1331" LastActivityDate="2016-04-28T12:38:09.710" Title="Building new network and need 200+ wireless devices" Tags="|wireless|switch|router|best-practices|" AnswerCount="7" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1329" PostTypeId="2" ParentId="1328" CreationDate="2013-05-29T15:16:47.713" Score="1" Body="&lt;p&gt;Wireless controllers are intended to coordinate the rf of access points and enable client roaming between the access points. You can check out the Cisco design zone to help with your design. &lt;/p&gt;&#xA;" OwnerUserId="446" LastActivityDate="2013-05-29T15:16:47.713" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1330" PostTypeId="2" ParentId="1328" CreationDate="2013-05-29T15:27:05.987" Score="6" Body="&lt;ol&gt;&#xA;&lt;li&gt;I've run similar devices to the Soekris with PFSense and M0n0wall. I can push quite a bit of traffic through them with fairly low specs. (On the order of 100Mbps)&lt;/li&gt;&#xA;&lt;li&gt;Wireless controllers gain you two big things. The first is centralized management. You can manage all your APs from one single interface. Need to add an SSID? Easy. Add it to the controller and it gets pushed to the APs. The second thing is centralized ACL enforcement. Typically (though not always) Wireless controllers tunnel the traffic back to itself and have a single egress point into the corporate network. This allows you to apply things like security zones at a single location instead of every place your AP is plugged in. It also allows you to have a single subnet for wireless clients across a larger network.&lt;/li&gt;&#xA;&lt;li&gt;Because of the size of your network I would recommend you look into &lt;a href=&quot;http://ubnt.com&quot;&gt;Ubquiti Networks&lt;/a&gt;. They offer you the same gains of having a controller based network but without a controller and at a much lower price point. I've used them successfully in various single building deployments. If you're dead set on using one of your two options here you've selected the correct ones for your size.&lt;/li&gt;&#xA;&lt;li&gt;As far as specs these look almost identical from a brief scan of the tech specs. Perhaps one is to be ceiling mounted the other is a desktop version?&lt;/li&gt;&#xA;&lt;li&gt;The main thing you gain is being able to create different egress points from different VLANs. You can use the router to set up different sub interfaces per VLAN. So for your guest wireless network you could put them on VLAN 50 while the rest of your internal clients are on VLAN 10. You could then apply security policies about what traffic is allowed between the two VLANs.&lt;/li&gt;&#xA;&lt;li&gt;Nope. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;From a wireless perspective if you have all 200 devices trying to access resources at the same time you might find yourself in a bit of a jam if you've only got a handful of APs handling the traffic. I would recommend you keep a close eye on your usage when you finish your deployment and see if you need to add more density to your wireless infrastructure. Now only having 18 employees and mobile devices it would be hard to have them all push enough traffic to matter, but as you grow I would keep an eye on it so you don't run into any problems. Only one client can talk at a time on a wireless network (per AP/Frequency). So ensuring you've got enough available bandwidth is of the utmost importance.&lt;/p&gt;&#xA;" OwnerUserId="287" LastEditorUserId="287" LastEditDate="2013-05-29T15:38:51.960" LastActivityDate="2013-05-29T15:38:51.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1331" PostTypeId="2" ParentId="430" CreationDate="2013-05-29T15:30:55.897" Score="3" Body="&lt;p&gt;tshark is reporting the ethernet frame size: 6142 - 14 (ethernet header) = 6128 IP bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;scamper does a traceroute with small packets before probing with large packets for MTU discovery (that is why you see small packets followed by a large one).  this is useful to distinguish between all packets being discarded / unresponsive and just the big ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.usenix.org/conference/imc-05/inferring-and-debugging-path-mtu-discovery-failures&quot; rel=&quot;nofollow&quot;&gt;https://www.usenix.org/conference/imc-05/inferring-and-debugging-path-mtu-discovery-failures&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1413" LastActivityDate="2013-05-29T15:30:55.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1334" PostTypeId="2" ParentId="1328" CreationDate="2013-05-29T16:29:02.013" Score="0" Body="&lt;p&gt;Personally I would not go with simple WPA2 but with EAP, also make sure you disallow communication between clients.&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-05-29T16:29:02.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1335" PostTypeId="2" ParentId="1160" CreationDate="2013-05-29T16:47:04.973" Score="22" Body="&lt;p&gt;&lt;strong&gt;NetFlow&lt;/strong&gt; is a protocol for exporting aggregated IP flow totals. As such it is well suited to IP traffic accounting on Internet routers. With Netflow V9 (AKA IPFIX it can look into Layer 2 traffic as well)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sFlow&lt;/strong&gt; is a general purpose network traffic measurement system technology. sFlow is designed to be embedded in any network device and to provide continuous statistics on any  protocol (L2, L3, L4, and up to L7), so that all traffic throughout a network can be accurately characterized and monitored. These statistics are essential for congestion control, troubleshooting, security surveillance, network planning etc. They can also be used for IP accounting purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Netflow&lt;/strong&gt; mirrors all traffic, and places a load on the CPU when utilised.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SFlow&lt;/strong&gt; is a packet sampling technology where the switch captures every 100th packet (configurable) per interface and sends it off to the collector. sFlow is built into the ASIC, and places minimal load on the CPU. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Netflow&lt;/strong&gt; supported by Cisco, Juniper, Alcatel Lucent, Huawei, Enterasys, Nortel, VMWare&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sFlow&lt;/strong&gt; supported by Alaxala, Alcatel Lucent, Allied Telesis, Arista Networks, Brocade, Cisco, Dell, D-Link, Enterasys, Extreme, Fortinet, Hewlett-Packard, Hitachi, Huawei, IBM, Juniper, LG-Ericsson, Mellanox, MRV, NEC, Netgear, Proxim Wireless, Quanta Computer, Vyatta, ZTE and ZyXEL (&lt;a href=&quot;http://www.sflow.org/products/network.php&quot;&gt;see sFlow link&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="409" LastEditorUserId="409" LastEditDate="2013-05-29T16:57:09.840" LastActivityDate="2013-05-29T16:57:09.840" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1336" PostTypeId="1" CreationDate="2013-05-29T16:52:52.293" Score="8" ViewCount="198" Body="&lt;p&gt;Senario:&#xA;I have the backup configuration file. But I don't any USB drive or compact flash card. After replacing the Routing Engine, I tried to copy/paste the configs (around 12k lines) from the console terminal, however, it seems pasting the configs broke the buffer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: what's the best way to apply the configs to the router?&lt;/p&gt;&#xA;" OwnerUserId="18" LastActivityDate="2013-05-29T18:15:54.380" Title="How to apply configuration after replacing Routing Engine(RE) for CISCO7609-S?" Tags="|cisco|routing|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1337" PostTypeId="2" ParentId="1336" CreationDate="2013-05-29T16:59:21.793" Score="7" Body="&lt;p&gt;Your options are pretty limited, but I see two possible solutions.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Increase the baud rate for your serial connection. This will allow higher throughput on your serial link.&lt;/li&gt;&#xA;&lt;li&gt;Temporarily set up a /30 link between your laptop and the Cat7600 and use a local tftp server to move the file into the startup config. If the RSP has a MGMT interface on the front you can use this. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-29T16:59:21.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1338" PostTypeId="2" ParentId="1336" CreationDate="2013-05-29T17:01:08.330" Score="0" Body="&lt;p&gt;If buffer size is an issue, and you have physical access to the Router (which I know I am assuming that you do), set up a TFTP session between the 7609 and your laptop.  Then you can dump the config file that way to the router.&lt;/p&gt;&#xA;" OwnerUserId="1096" LastActivityDate="2013-05-29T17:01:08.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1339" PostTypeId="2" ParentId="42" CreationDate="2013-05-29T17:21:27.917" Score="0" Body="&lt;p&gt;I have used &lt;a href=&quot;http://actionpacked.com/products/overview&quot; rel=&quot;nofollow&quot;&gt;Liveaction&lt;/a&gt; and it does a great job of showing a nearly real time weather map of our network.  This can generate a lot of netflow and/or SNMP traffic from the end devices to the server but the information that it provides has enabled us to resolve congestion issues rather quickly.&lt;/p&gt;&#xA;" OwnerUserId="352" LastActivityDate="2013-05-29T17:21:27.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1341" PostTypeId="2" ParentId="1328" CreationDate="2013-05-29T17:46:20.560" Score="8" Body="&lt;p&gt;A couple of thoughts. I can go into more detail on any of these if you need me to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-When it comes to wireless, there are two ways to plan. One is for coverage, the other is for capacity. Based on the number of devices(capacity) and space(coverage) that you describe, I believe that capacity is going to the be the bigger deciding factor. Remember that wireless is like using an old-school hub. Everyone hears everything. That also means that only one client can talk to one AP at a time. This isn't a limitation of a device (Cisco vs. Netgear) this is a limitation of the physical medium (airspace). Since you are programming for mobile devices, which will only support a single stream, you should plan on 1 dual band AP per 50 devices. If you choose to only support 2.4 or 5Ghz (airspace issues with neighbor offices for instance), then plan on 1 AP per 30 devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-The Cisco 887 only has a 100Mb connection. If you keep with your current plan, and do all of your L3 routing on the 887, it will become a bottleneck for anything that routes between your internal networks. Examples include: Local replication for Dropbox, Wireless synching between i-devices and itunes, Copying files from machine A to B, Time machine backups, etc. etc. This bottleneck occurs because anytime data must flow from one network to another (wlan to lan) it will need to be routed, and must go out, and then back in, from the same 100Mb interface. This might not be a big deal, but I wanted to mention it, just-in-case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-The Wireless controllers are a good idea. The initial setup takes a little while longer, but from that point on, it becomes super easy to deploy more AP's or WLAN's. I don't know anything about them from personal experience, but I have heard good things about the Meraki AP's. It is an cloud-based controller solution, which Cisco recently bought. EDIT for clarity: I don't know anything about the Meraki solution. I know A LOT about the Cisco Wireless Controllers :-).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-How are you powering your AP's? Do you plan on using VOIP in the future? Consider both of these when considering whether or not to order a switch with PoE. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Also, just noticed, you are planning on putting a firewall in-line after the router. That further complicates your plan to route between subnets there. I would plan on purchasing an L3 switch. That would simplify the deployment considerably. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps. Good luck.&lt;/p&gt;&#xA;" OwnerUserId="487" LastActivityDate="2013-05-29T17:46:20.560" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1342" PostTypeId="2" ParentId="1328" CreationDate="2013-05-29T18:07:03.597" Score="4" Body="&lt;p&gt;Disclaimer: Answer appears to come from an HP PreSales Solution Architect. (Discuss this &lt;a href=&quot;https://networkengineering.meta.stackexchange.com/q/182/33&quot;&gt;on meta&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK. I spotted one issue straight away. you want to use a 2510-48G Switch, and you want WLAN AP's. How are you going to power those AP's? I guess you could use power adaptors and plug them into the wall sockets, but you really want to be looking at a PoE switch to power them up. Secondly, HP announced the 2530 series in December and with that the EOL of the 2510 series. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, as an HPN PreSales Solution Architect here is my recomendation:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You could use your Cisco 877 as your local router as well. Its only got 4x100Mb connectivity to the LAN. If your ISP offers a wires only service, then investigate other routers as well. The &lt;a href=&quot;http://www.cisco.com/en/US/products/ps6202/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco 877&lt;/a&gt; is now EOL, and no longer being sold. HP has the &lt;a href=&quot;http://h17007.www1.hp.com/us/en/networking/products/routers/HP_MSR93x_Series/index.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSR930&lt;/a&gt; series with 4x GbE uplinks, and an embedded firewall. &lt;/li&gt;&#xA;&lt;li&gt;Wireless. Consider coverage versus capacity first. You require 200x devices to connect, but only 18x users today. So assuming that not every device is on the network at any one time, you could probably get away with clustered AP's. This allows a single AP to control other AP's as well. From HP you could look at the &lt;a href=&quot;http://h17007.www1.hp.com/us/en/networking/products/wireless/HP_M220_802_11n_Access_Point_Series/index.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;M220 Access Point&lt;/a&gt; where up to 10x AP's could be controlled as one. &lt;/li&gt;&#xA;&lt;li&gt;If you want a managed WLAN solution, have you considered the &lt;a href=&quot;http://h17007.www1.hp.com/us/en/networking/products/wireless/HP_MSM_Controller_Series/index.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSM720 WLAN controller&lt;/a&gt; ? Lifetime warranty and support for up to 40x AP's (10 out of the box), then use the MSM430 Access Points&lt;/li&gt;&#xA;&lt;li&gt;Looking at the Netgear page for the &lt;a href=&quot;http://www.netgear.co.uk/business/products/access-points-wireless-controllers/access-points/WNDAP360.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;WNDAP360&lt;/a&gt; it seems that the only difference is, &quot;Easy ceiling mounting/wall mounting&quot;. It makes no mention of Dual Spatial Stream, so I assume that the maximum support per radio is 150Mbps. &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Trunking#Computer_networks&quot; rel=&quot;nofollow noreferrer&quot;&gt;Define Trunking?&lt;/a&gt; Assuming you mean Link Aggregation, and not the Cisco term with regard to multiple VLANs on same link? Link aggregation offers more performance and greater resilience should one of the links fail.&lt;/li&gt;&#xA;&lt;li&gt;Nope. Remember, at the end of the day, whatever you provide has to weigh up the will it make me money? Will it save me money? Will it reduce our risk? You have to weigh them up against each other. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="409" LastEditorUserId="-1" LastEditDate="2017-03-16T15:51:49.960" LastActivityDate="2013-05-29T20:49:30.917" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1343" PostTypeId="2" ParentId="1336" CreationDate="2013-05-29T18:15:54.380" Score="2" Body="&lt;p&gt;When you tried pasting that many rows of config it was sent faster than the router could handle. You need to use a terminal client that supports using a line send delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use a line delay of maybe 10 ms then the router should be able to handle it fine. You can also put a character delay if that is needed.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-29T18:15:54.380" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1344" PostTypeId="1" AcceptedAnswerId="1350" CreationDate="2013-05-29T19:01:09.323" Score="8" ViewCount="3488" Body="&lt;p&gt;I don't have a lab ASA to confirm this and reading through the Cisco docs left me less then %100 sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I really want to know is if I pull an attribute from a group-policy will it then be replaced by what is already setup in the DfltGrpPolicy?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a good example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;group-policy DfltGrpPolicy attributes&#xA; dns-server value 1.1.1.1&#xA;&#xA;group-policy BLAH-VPN attributes&#xA; dns-server value 5.5.5.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if I then remove the dns-server statment from BLAH-VPN will that group then use the value set in DfltGrpPolicy?&lt;/p&gt;&#xA;" OwnerUserId="108" LastEditorUserId="775" LastEditDate="2013-06-30T10:40:07.667" LastActivityDate="2013-06-30T10:40:07.667" Title="How does group-policy inheritance work for a Cisco ASA?" Tags="|cisco|security|cisco-asa|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1345" PostTypeId="1" AcceptedAnswerId="1370" CreationDate="2013-05-29T19:18:57.477" Score="12" ViewCount="3773" Body="&lt;p&gt;I have a requirement to provide an accurate means to demonstrate line performance over a flat layer2 1Gb point-to-point Ethernet circuit, approx 100 miles apart that seemingly goes through a number of hops over the distance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The business requirement will need to demonstrate performance with an accuracy of min 8ms latency. The link will carry voice and data traffic whereby the service SLA should guarantee 1000Mb bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the known accurate methods of measuring performance given these requirements?&lt;br&gt;&#xA;I am aware of a number of metrics available that might possible form a test strategy but having Googled a bunch of info it can get overwhelming and i'm unclear of whether software like iPerth should be used, what's the benchmark for this scenario etc?&lt;/p&gt;&#xA;" OwnerUserId="109" LastEditorUserId="109" LastEditDate="2013-05-29T20:47:05.847" LastActivityDate="2015-07-11T18:14:41.690" Title="Accurate strategy for measuring point-to-point link performance?" Tags="|ethernet|testing|latency|throughput|speed|" AnswerCount="7" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1346" PostTypeId="2" ParentId="1345" CreationDate="2013-05-29T19:23:15.287" Score="6" Body="&lt;p&gt;iperf can do that job. Just ensure you test your devices back to back first so you know the capabilities of the devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course there are more professional tools as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a good RFC to read up proper methology: &lt;a href=&quot;http://www.ietf.org/rfc/rfc2544.txt&quot;&gt;http://www.ietf.org/rfc/rfc2544.txt&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-05-29T19:29:01.370" LastActivityDate="2013-05-29T19:29:01.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1347" PostTypeId="1" CreationDate="2013-05-29T19:27:04.177" Score="10" ViewCount="3935" Body="&lt;p&gt;What are the differences between the CRS-1 and CRS-3 platforms? I know the CRS-3 is the upgrade to CRS-1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need a new chassis to upgrade to CRS-3? Or is a CRS-1 chassis upgradable to a CRS-3 just upgrading the RP, MSC and Fabric cards?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is upgraded to get from CRS-1 to CRS-3? All of the below or just a few pieces?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Chassis&lt;/li&gt;&#xA;&lt;li&gt;RP&lt;/li&gt;&#xA;&lt;li&gt;Fabric Card&lt;/li&gt;&#xA;&lt;li&gt;MSC&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1426" LastEditorUserId="762" LastEditDate="2013-05-29T19:32:25.840" LastActivityDate="2013-05-29T20:24:31.033" Title="What's the difference between CRS-1 and CRS-3" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1348" PostTypeId="2" ParentId="1345" CreationDate="2013-05-29T19:28:44.823" Score="1" Body="&lt;p&gt;In order to get a full &quot;health profile&quot; of a link you'll need to consider several different metrics.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Latency&lt;/li&gt;&#xA;&lt;li&gt;Jitter&lt;/li&gt;&#xA;&lt;li&gt;Throughput&lt;/li&gt;&#xA;&lt;li&gt;Loss&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The best way to measure these metrics accurately is with a device dedicated for testing. Exfo, JDSU, and Fluke are several large companies that manufacture devices like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A PC /can/ test these metrics but you have to make sure there is nothing on the computer skewing the numbers and that the application you're using is accurate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iperf will measure bandwidth throughput but won't measure much else. Ping will measure moment in time latency, but not jitter. Also ICMP echo is only really accurate to 1ms. If you are trying to get an actual latency measurement then you'll need to decide if 1ms of granularity is enough for you/your applications.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-29T19:28:44.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1349" PostTypeId="2" ParentId="1345" CreationDate="2013-05-29T19:33:57.147" Score="6" Body="&lt;p&gt;If you have PCs at both ends then you could run &lt;a href=&quot;https://code.google.com/p/xjperf/&quot;&gt;xjperf&lt;/a&gt;, &lt;a href=&quot;http://www.ixchariot.com/products/datasheets/qcheck.html&quot;&gt;Qcheck from Ixia&lt;/a&gt; or other tools. You might get different results depending on if you use UDP or TCP and the number of sessions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a distance over 100 miles you are looking at a minimum RTT of 1.6 ms at the speed of light in fibre/copper. So your RTT should be very low, maybe only a couple of ms. Say that you have a RTT of 6 ms. With default window size options on Windows you might only get around 85 Mbps of throughput. You would need a window size of at least 768 kbyte to send a gig worth of traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;a href=&quot;http://www.switch.ch/network/tools/tcp_throughput/&quot;&gt;Throughput Calculator TCP&lt;/a&gt; to do your own calculations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ixia has more highend tools but they cost money which the above tools do not.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-29T19:33:57.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1350" PostTypeId="2" ParentId="1344" CreationDate="2013-05-29T19:36:00.230" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;if I then remove the dns-server statment from BLAH-VPN will that group then use the value set in DfltGrpPolicy?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, the &lt;code&gt;dns-server&lt;/code&gt; value it inherits from &lt;code&gt;DfltGrpPolicy&lt;/code&gt; takes over as long as &lt;code&gt;BLAH-VPN&lt;/code&gt; is still defined&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-05-29T19:36:00.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1353" PostTypeId="5" CreationDate="2013-05-29T19:55:56.767" Score="0" Body="&lt;p&gt;The Internet Protocol version 4 is designed for use in interconnected systems of&#xA;packet-switched computer communication networks.  The internet protocol provides for transmitting blocks of data called datagrams from sources to&#xA;destinations, where sources and destinations are hosts identified by&#xA;fixed length (32-bit) addresses.  The internet protocol also provides for&#xA;fragmentation and reassembly of long datagrams, if necessary, for&#xA;transmission through &quot;small packet&quot; networks.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T18:24:05.590" LastActivityDate="2016-11-29T18:24:05.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1354" PostTypeId="4" CreationDate="2013-05-29T19:55:56.767" Score="0" Body="For questions about Internet Protocol version 4 (IPv4); as specified in RFC791." OwnerUserId="1085" LastEditorUserId="8499" LastEditDate="2016-11-29T18:21:43.683" LastActivityDate="2016-11-29T18:21:43.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1355" PostTypeId="1" AcceptedAnswerId="1357" CreationDate="2013-05-29T20:01:35.203" Score="7" ViewCount="21031" Body="&lt;p&gt;I've recently switched my Mikrotik Router's DHCP server to authoritative mode. It fixed several problems with some clients remembering bad IP addresses. But what would happen if I connected a device with static IP to the network? Will the DHCP server protest, or is it ok?&lt;/p&gt;&#xA;" OwnerUserId="1429" LastEditorUserId="8499" LastEditDate="2018-02-14T16:26:47.857" LastActivityDate="2018-02-14T16:26:47.857" Title="Does authoritative DHCP server mean no static IP setting?" Tags="|dhcp|" AnswerCount="3" CommentCount="0" ClosedDate="2017-08-10T00:00:19.773" ContentLicense="CC BY-SA 3.0" />
  <row Id="1356" PostTypeId="2" ParentId="233" CreationDate="2013-05-29T20:09:02.357" Score="0" Body="&lt;p&gt;I'd be curious to test this or see it documented somewhere. I've seen logs that appeared to be out of state sessions, or that is at least what I interpreted them as so it would surprise me to find that out.&lt;/p&gt;&#xA;" OwnerUserId="299" LastActivityDate="2013-05-29T20:09:02.357" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1357" PostTypeId="2" ParentId="1355" CreationDate="2013-05-29T20:10:30.127" Score="11" Body="&lt;p&gt;This only deals with how the DHCP server responds to a client DHCP REQUEST for a certain IP address that is not provided by the DHCP server configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it isn't part of the DHCP scope on the Mikrotik and the setting is yes, then it responds with a DHCP NACK message, which should prompt the client to do a DHCP DISCOVER.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If set to no, then it will just ignore those packets (assuming that there may be another DHCP server to handle the request).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should have no effect on a statically assigned IP address since they do not make a DHCP REQUEST.  However, I always prefer to still do my static IP addresses through static reservations on the DHCP server when possible.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-29T20:59:34.680" LastActivityDate="2013-05-29T20:59:34.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1358" PostTypeId="2" ParentId="1205" CreationDate="2013-05-29T20:11:21.490" Score="0" Body="&lt;p&gt;As I understand it all ports are non-edge be default unless you classify them as edge ports, or am I missing something. If you don't want something to be edge just leave it as default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: and now that I read your question a second time I'm a bit more confused. All switches send out BPDUs regardless of which is root, so a new root switch won't change which ports start receiving BPDUs.&lt;/p&gt;&#xA;" OwnerUserId="299" LastEditorUserId="299" LastEditDate="2013-05-29T20:35:07.830" LastActivityDate="2013-05-29T20:35:07.830" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1359" PostTypeId="2" ParentId="1355" CreationDate="2013-05-29T20:11:32.963" Score="1" Body="&lt;p&gt;You will want to either&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;set the DHCP scope as a subset of the subnet and issue static addresses out of there, or&lt;/li&gt;&#xA;&lt;li&gt;create an exclusion within the DHCP scope for the addresses that you assigned as static&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you do not do this then the DHCP server could issue that address and you will have a duplicate.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-29T20:11:32.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1360" PostTypeId="2" ParentId="1347" CreationDate="2013-05-29T20:24:31.033" Score="6" Body="&lt;p&gt;In March 2010, Cisco announced the introduction of the CRS-3 family. The switching capacity of this new product-line is increased more than three times as each switch-fabric line card can process 140 Gbit/s instead of 40 Gbit/s as in the old system. According to Cisco, the current users can upgrade to the CRS-3 system step by step and without serious outage as the chassis, interface-cards, management-systems etc. are the same. The main changes are in the switching-fabric and the option to use new interface modules supporting these higher speeds (14 or 20 × 10 Gb interfaces and 1 × 100 Gb ethernet interface).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For information about migrating from a Cisco CRS-1 to a Cisco CRS-3 chassis, refer to the Cisco CRS-1 Carrier Routing System to Cisco CRS-3 Carrier Routing System Migration Guide at the URL &lt;a href=&quot;http://www.cisco.com/en/US/products/ps5763/prod_installation_guides_list.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/products/ps5763/prod_installation_guides_list.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="975" LastActivityDate="2013-05-29T20:24:31.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1361" PostTypeId="1" AcceptedAnswerId="1366" CreationDate="2013-05-29T20:39:13.337" Score="6" ViewCount="1627" Body="&lt;p&gt;Here's a network design question: I've just been reading &quot;IPv6 for Enterprise Networks&quot; by McFarland et. al. and it (among other Cisco documents) separates out Internet routing from remote access VPN.  What are the advantages and disadvantages of using separate routers for remote access VPNs vs. general Internet traffic, assuming they go through the same uplink?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And as a secondary issue, what are the advantages or disadvantages in splitting out site-to-site and road warrior VPN between different routers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The VPN in my specific case is OpenVPN running on Vyatta, but from my perspective this is more about the design than the technology choice.)&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-05-30T10:30:29.333" Title="What are the reasons for choosing separate or combined VPN and Internet routers?" Tags="|routing|vpn|design|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1362" PostTypeId="2" ParentId="1355" CreationDate="2013-05-29T20:39:29.893" Score="2" Body="&lt;p&gt;You should reserve a seperate pool of IP addresses which will not be distributed by the DHCP server. This will allow you to have spare IPs which you can use to assign static addresses. An example from the &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual%3aIP/Pools&quot; rel=&quot;nofollow&quot;&gt;Mikrotik website&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To define a pool named ip-pool with the 10.0.0.1-10.0.0.125 address&#xA;  range excluding gateway's address 10.0.0.1 and server's address&#xA;  10.0.0.100, and the other pool dhcp-pool, with the 10.0.0.200-10.0.0.250 address range:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[admin@MikroTik] ip pool&amp;gt; add name=ip-pool ranges=10.0.0.2-10.0.0.99,10.0.0.101&#xA;10.0.0.126&#xA;[admin@MikroTik] ip pool&amp;gt; add name=dhcp-pool ranges=10.0.0.200-10.0.0.250&#xA;[admin@MikroTik] ip pool&amp;gt; print&#xA;  # NAME                                        RANGES&#xA;  0 ip-pool                                     10.0.0.2-10.0.0.99&#xA;                                                10.0.0.101-10.0.0.126&#xA;  1 dhcp-pool                                   10.0.0.200-10.0.0.250&#xA;&#xA;[admin@MikroTik] ip pool&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-05-29T20:39:29.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1363" PostTypeId="2" ParentId="1361" CreationDate="2013-05-29T20:42:26.937" Score="2" Body="&lt;p&gt;While they may be on the same network, it is still easier to seperate them as you can restrict and control inbound traffic a lot better (because you seperate them in groups) based on the purpose. It might be that you do not want people connecting through the VPN to have access to all machines in the network. &lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-05-29T20:42:26.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1364" PostTypeId="1" AcceptedAnswerId="1365" CreationDate="2013-05-29T20:44:19.100" Score="3" ViewCount="3170" Body="&lt;p&gt;I'm learning some tcp/ip basics, and am having trouble understanding the Message Length field in UDP. In my book, it says that the Message Length represents the UDP header and data in octets, and since the UDP header is 8 octets, the minimum Message Length value is 8. I have a scenario where the UDP header is 8 octets, and the data is a 13 character string(13 octets). However, the example I'm looking at says the message length is 20 + 13, and then explains that it's 20 octets for the header and 13 octets for the data. I thought that UDP headers were 8 octets, not 20, so why is this 20?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect that it might have to do with the pseudo header, which is 12 octets, so 12 from the pseudo and 8 from the actual header = 20 total header octets. Is this the case? It's really not making any sense to me. Also doesn't the 13 octet data need to be rounded to a multiple of 4? The way it is presented in my book makes it look like the data needs to be padded to 32 bits(4 octets).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for this confusion, just trying to understand the layout here. If you guys need any additional information just ask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/YX8nN.png&quot; alt=&quot;Here is the example&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1432" LastEditorUserId="775" LastEditDate="2013-06-02T14:37:22.330" LastActivityDate="2013-06-02T14:37:22.330" Title="UDP Message Length Field and Pseudo Header" Tags="|ethernet|ipv4|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1365" PostTypeId="2" ParentId="1364" CreationDate="2013-05-29T21:17:56.783" Score="4" Body="&lt;p&gt;You're right UDP header is 8 bytes. So I can't really explain your 12+8 scenario. Pseudoheader refers to the header which is considered when calculating checksum, is is combination of IP + UDP + payload, but not all of if, hence pseudo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;20B is normal size for IPV4 (and TCP). So maybe confusion lies there?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can put your example online, it might help understanding what the author tries to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt; the packet you entered is 20+8+13 bytes. If your document claims 20+13, it is missing the UDP header.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-05-29T21:27:15.777" LastActivityDate="2013-05-29T21:27:15.777" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1366" PostTypeId="2" ParentId="1361" CreationDate="2013-05-29T21:35:07.783" Score="5" Body="&lt;p&gt;There's a bunch of stuff to consider here, although a lot of it depends on your environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, device flexibility. If there's an emergency update that needs a reboot of the device to take effect, are you ready to take down the combined services to deal with that update? This can become a rabbit's hole of &quot;what if?&quot; scenarios but it's something to think about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, performance. Will a single device handle the encryption traffic and the routing? Will it do so for the lifetime of the product? Are you going to end up buying a &quot;big&quot; single replacement box because one of the functions needed more horsepower, where a &quot;medium&quot; and &quot;small&quot; box would do if they were separate?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Redundancy - this ties in to the flexibility point, do you require redundancy on any of these devices? Is it easier to maintain a single HA pair rather than multiples? Perhaps HA is only required for specific functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing - this can be fun if you've got separate devices bringing traffic in to the environment. Are they all aware of each other? Are they all aware of the (possibly) multiple paths available to each other? Simplifying down to less devices can be beneficial here, but if your environment isn't this involved you may never have to worry about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional services - are you running firewalling, traffic inspection, or threat prevention on these remote links? Are you going to need an additional &quot;protection&quot; box for every service you break out from the main device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those are some of the primary things we consider. In my opinion there isn't a simple &quot;always do it this way&quot; answer for this one.&lt;/p&gt;&#xA;" OwnerUserId="1286" LastActivityDate="2013-05-29T21:35:07.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1367" PostTypeId="2" ParentId="1361" CreationDate="2013-05-29T21:35:59.690" Score="4" Body="&lt;p&gt;Pending the way your ISP may deliver MPLS VPN and Internet traffic may dictate your design choices for you. By separating the functions you may choose to utilize different ISP’s for partial redundancy (last mile issue) while also separating the router load and administrative/management functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPN remote access clients do not support routing protocols. The preferred method for directing packets to a remote network is to create a default route on the remote access client that directs all packets to the remote network. This is the default configuration for VPN remote access clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPN connections between facilities use either Point-to-Point Tunneling Protocol (PPTP) or Layer Two Tunneling Protocol/Internet Protocol security (L2TP/IPSec) over an intermediate network, such as the Internet. By using the Internet as a connection medium, VPN saves the cost of long-distance phone service and hardware costs associated with using dial-up or leased line connections. A VPN solution includes advanced security technologies such as data encryption, authentication, and authorization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet egress could be as simple as aggregating all traffic destined for the Internet behind a NAT/PAT firewall/Internet Gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;URLS for review:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/products/ps6604/products_white_paper09186a00801281f1.shtml#wp39765&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/products/ps6604/products_white_paper09186a00801281f1.shtml#wp39765&lt;/a&gt;&#xA;&lt;a href=&quot;http://technet.microsoft.com/en-us/library/cc739294(v=ws.10).aspx&quot; rel=&quot;nofollow&quot;&gt;http://technet.microsoft.com/en-us/library/cc739294(v=ws.10).aspx&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="975" LastActivityDate="2013-05-29T21:35:59.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1368" PostTypeId="5" CreationDate="2013-05-29T21:40:59.950" Score="0" Body="&lt;p&gt;TCP operates at the &lt;a href=&quot;http://en.wikipedia.org/wiki/Transport_layer&quot; rel=&quot;nofollow&quot;&gt;transport layer&lt;/a&gt; of the &lt;a href=&quot;http://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow&quot;&gt;ISO OSI model&lt;/a&gt;. It provides a connection orientated, reliable, error free, ordered delivery of data packets between two communicating devices. This reliable nature often &lt;a href=&quot;http://en.wikipedia.org/wiki/Bandwidth-delay_product&quot; rel=&quot;nofollow&quot;&gt;causes problems&lt;/a&gt; though for efficient communication. Originally defined in &lt;a href=&quot;http://tools.ietf.org/html/rfc675&quot; rel=&quot;nofollow&quot;&gt;RFC675&lt;/a&gt; it has been revised and modified many times over the years with improvements such as &lt;a href=&quot;http://tools.ietf.org/html/rfc1122&quot; rel=&quot;nofollow&quot;&gt;fast retransmit and fast recovery&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/TCP_congestion_avoidance_algorithm&quot; rel=&quot;nofollow&quot;&gt;Tahoe, Reno, New Reno, Vegas etc&lt;/a&gt;. As the most widely used protocol on the Internet, it faces continual scrutiny and improvement.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-06-19T13:39:51.133" LastActivityDate="2013-06-19T13:39:51.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1369" PostTypeId="4" CreationDate="2013-05-29T21:40:59.950" Score="0" Body=" For questions about Transmission Control Protocol (TCP), a transport protocol used to encapsulate data across a network for reliable communication." OwnerUserId="253" LastEditorUserId="8499" LastEditDate="2016-11-29T21:41:35.917" LastActivityDate="2016-11-29T21:41:35.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1370" PostTypeId="2" ParentId="1345" CreationDate="2013-05-29T22:04:02.447" Score="8" Body="&lt;p&gt;If you're trying to test 1xGE No Drop Rate and measure circuit delay within 8ms, I would use &lt;a href=&quot;http://www.lcp.nrl.navy.mil/nuttcp/&quot;&gt;nuttcp&lt;/a&gt; to test bandwidth and &lt;a href=&quot;http://sourceforge.net/projects/iperf/&quot;&gt;iperf2&lt;/a&gt; / &lt;a href=&quot;http://www.bitwizard.nl/mtr/&quot;&gt;mtr&lt;/a&gt; to test delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would do the following...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find two &lt;em&gt;linux&lt;/em&gt; desktop PCs, if possible (laptops are sometimes acceptable, but you might run into issues with chipset or bus performance at 1GE speeds).  You can boot into a &lt;a href=&quot;http://psps.perfsonar.net/toolkit/&quot;&gt;Performance Sonar toolkit CD&lt;/a&gt;, if you don't want a permanent linux install on these boxes&lt;/li&gt;&#xA;&lt;li&gt;Select packet sizes for your test.  Since you need voice support on the circuit, you should test streams with smaller frames, such as 128-byte ethernet frames.  If I was running the test, I would choose 128, 256, 768 and 1514 byte ethernet frames.&lt;/li&gt;&#xA;&lt;li&gt;Test &lt;a href=&quot;http://www.lcp.nrl.navy.mil/nuttcp/&quot;&gt;nuttcp&lt;/a&gt; UDP bandwidth performance of your linux PCs connected back to back before shipping one of them 100 miles away.  You want to ensure that you can measure 1000 Mbps at various packet sizes.  Be sure to account for the &lt;a href=&quot;http://en.wikipedia.org/wiki/Interframe_gap&quot;&gt;Inter-Frame Gap&lt;/a&gt; when you calculate expected throughput rates... for instance the best possible throughput you can expect on an untagged gige circuit at a 128-byte average ethernet frame size is 864.9 Mbps.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;http://sourceforge.net/projects/iperf/&quot;&gt;iperf2&lt;/a&gt; or &lt;a href=&quot;http://www.bitwizard.nl/mtr/&quot;&gt;mtr&lt;/a&gt; to test circuit delay...&lt;/li&gt;&#xA;&lt;li&gt;Pick a test window.  I think it's best to test circuits continuously for at least a day... two days to a week are preferable if you need to get a sense for potential oversubscription within your carrier's network.&lt;/li&gt;&#xA;&lt;li&gt;Ship one of the PCs off to the remote site, preconfigured for the IP addressing you need on the link.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Misc thoughts&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other answers have suggested using &lt;a href=&quot;http://sourceforge.net/projects/iperf/&quot;&gt;iperf2&lt;/a&gt; alone; however, it doesn't have CLI options to adjust the UDP packet size.  It also tends to demonstrate flaky performance at high speeds under MS Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;http://metroethernetforum.org/PDF_Documents/OAM/Understanding%20Carrier%20Ethernet%20Throughput%20-%20v14.pdf&quot;&gt;Metro Ethernet Forum paper on testing carrier ethernet circuits&lt;/a&gt; will help provide a general understanding some of the tradeoffs you take when testing circuits.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-05-29T22:12:40.240" LastActivityDate="2013-05-29T22:12:40.240" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1371" PostTypeId="2" ParentId="1361" CreationDate="2013-05-29T22:07:07.420" Score="4" Body="&lt;p&gt;I might have missed someone already providing this answer, but just-in-case. The biggest reason that I would separate them is: SECURITY. If you have one router that serves all of those purposes, then you have only a single device that needs to be compromised before an attacker has full access to your network, and every device on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By separating the devices, you can create multiple trust zones, which better define access. That way, if someone gains access to your VPN router, they only have access based on the specific rules that are defined in your internet router, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps. &lt;/p&gt;&#xA;" OwnerUserId="487" LastActivityDate="2013-05-29T22:07:07.420" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1372" PostTypeId="2" ParentId="1345" CreationDate="2013-05-29T22:13:53.797" Score="2" Body="&lt;p&gt;Here is an article that explains why iperf2 alone cannot answer the question for you: &lt;a href=&quot;http://bradhedlund.com/2008/12/19/how-to-calculate-tcp-throughput-for-long-distance-links/&quot; rel=&quot;nofollow&quot;&gt;http://bradhedlund.com/2008/12/19/how-to-calculate-tcp-throughput-for-long-distance-links/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I never truly understood this concept until I read that article. Hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="487" LastActivityDate="2013-05-29T22:13:53.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1373" PostTypeId="1" AcceptedAnswerId="1375" CreationDate="2013-05-29T22:28:14.810" Score="4" ViewCount="1594" Body="&lt;p&gt;Is Super Aggregated VLANs Brocades version of Q-in-Q? If any, what are some of the major differences between SAV and Q-in-Q?&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-05-30T00:56:21.493" Title="Super Aggregated VLAN vs. Q-in-Q" Tags="|vlan|brocade|qinq|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1374" PostTypeId="2" ParentId="1373" CreationDate="2013-05-29T22:37:25.783" Score="4" Body="&lt;p&gt;Its not so much Brocades 'version' of Q-in-Q as it still uses the standard, think of it more as a difference in vocabulary, it is still compatible with other vendors such as a Cisco device running a normal qinq tunnel interface.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-29T22:37:25.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1375" PostTypeId="2" ParentId="1373" CreationDate="2013-05-30T00:56:21.493" Score="4" Body="&lt;p&gt;Same thing, different (older) branding. Normally for 802.1ad there's a C-TAG and an S-TAG. The C-TAG (customer tag) will have almost always have a value of 8100 set in its TPID (tag protocol identifier) field. The S-TAG (service tag - the tag on top) will have a separate set of fields (same as the C-TAG: PCP/DEI/TPID/VID bits) and its TPID should be 0x88a8 by the standard. A lot of vendors will let you set the value for the S-TAG TPID to something arbitrary (Brocade likes to recommend 9100 a lot - probably for compatibility reasons). Some vendors (Brocade also being one of them) will let you also set the C-TAG TPID but I can't think of any useful reason why someone would want to deviate from the norm of 8100. It's more common to want/need to change the S-TAG TPID value.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-05-30T00:56:21.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1376" PostTypeId="1" AcceptedAnswerId="1380" CreationDate="2013-05-30T01:15:40.280" Score="4" ViewCount="1481" Body="&lt;p&gt;If VRF is implemented for routing table separation such as having an overlay network for a guest network that doesn't mix with regular LAN routing, is migrating to it easily done on Cisco switches (4500 and 6500)?  Please enumerate the high-level steps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Must all commands such as &quot;show ip route&quot; include the VRF name or does that same command work and just shows the default VRF?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to rollback VRF easily?  What concerns are there rolling forward or back -- any downtime expected?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IGP is OSPF if this makes a difference.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-05-30T02:31:23.450" LastActivityDate="2013-05-30T03:39:23.353" Title="Is migrating to VRF or rolling-back an easy proposition?" Tags="|cisco|routing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1377" PostTypeId="1" CreationDate="2013-05-30T01:31:06.797" Score="19" ViewCount="5269" Body="&lt;p&gt;What are some general guidelines for the successful deployment of jumbo frames in a routed environment?&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-06-01T12:22:58.233" Title="Jumbo Ethernet Frame Deployment" Tags="|ethernet|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1378" PostTypeId="2" ParentId="1377" CreationDate="2013-05-30T01:31:06.797" Score="19" Body="&lt;p&gt;&lt;strong&gt;Terms&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Physical interface -- a layer-2 port or switchport. Refers to switch uplinks and downlinks in the context of this document. May or may not be performing 802.1q tagging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logical interface -- a layer-3 port or routed port. Refers to server interfaces, router interfaces, switch virtual interfaces and subinterfaces. Anything with an IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Standard domain -- a set of layer-3-adjacent VLANs which operate at the standard Ethernet payload of 1500 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jumbo domain -- a set of layer-3-adjacent VLANs which operate at an Ethernet payload MTU greater than 1500 bytes, usually 9000 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network Topology&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jumbo frames are not a mix-and-match technology. Jumbo frames are deployed to a clearly delineated segment of the network which is bounded by a router. This layer-3 boundary is essential to support interoperability with the standard domain. The router provides fragmentation and ICMP responses for Path MTU Discovery that are not provided at the lower levels of the networking stack. All communication within the jumbo domain will enjoy support for larger payload, while all communication between standard and jumbo domains will occur at the standard payload size. Communication between discontiguous jumbo domains also occurs at the standard payload size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Jumbo VLANs&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jumbo frames are not a mix-and-match technology. This point is worth repeating. A given VLAN belongs to the standard domain or the jumbo domain, never both. This means that all physical interfaces that carry a jumbo VLAN must permit jumbo frames. If a jumbo frame encounters a physical interface that does not permit jumbo frames it will be dropped. Likewise, all logical interfaces on a jumbo VLAN must be configured with the exact same MTU value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Physical Interfaces&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Physical interfaces can carry any number of standard and jumbo VLANs as long as jumbo frames are permitted on the interface. Also, both types of VLANs may be trunked to a host or router. It is only important that the logical interfaces on the host or router be configured with the proper MTU value for each respective VLAN. In this sense, there exists a disconnect between physical interfaces and logical interfaces. A physical interface must meet or exceed the jumbo MTU, it does not need to be an exact match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Logical Interfaces&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jumbo frames are not a mix-and-match technology. There it is again. For all intents and purposes every physical interface in the network can permit jumbo frames whether it carries a standard VLAN, a jumbo VLAN or both. The logical interfaces is where the exact MTU match really matters. This is also where it can get a bit confusing. For instance, configuring a Cisco 6500 SVI for MTU 9000 permits an Ethernet payload of 9000 bytes while configuring an HP NIC team for MTU 9014 permits an Ethernet payload of 9000 bytes. This is because the Cisco value only specifies the payload and the HP value specifies the payload plus Ethernet header. It is important to be aware of these details to get the MTU match exactly right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Validation&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is useful to be aware of methods for validating that a jumbo VLAN has been properly deployed. Ping tests are sufficient, but one must take care to set the DF bit. Both Cisco and Windows ping utilities offer a method to do this, but once again the method for counting the bytes differs. The length parameter on Cisco includes the ICMP payload, ICMP header and IP header. The length parameter on Windows only specifies the ICMP payload. A length of 9000 on Cisco and a length of 8972 on Windows both produce an Ethernet frame of length 9018 with a payload of 9000 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully someone out there will find this diatribe useful. In networking, I think we all know the importance of doing it right the first time. Please feel free to leave comments regarding the accuracy of information, potential improvements and additional references.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;References&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Jumbo_frame&quot;&gt;http://en.wikipedia.org/wiki/Jumbo_frame&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-05-30T01:31:06.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1379" PostTypeId="2" ParentId="1376" CreationDate="2013-05-30T01:59:18.417" Score="3" Body="&lt;p&gt;Creating a VRF is easy enough as is assigning interfaces to a VRF.  Assigning an interface to a VRF though will remove all L3 addressing on that interface so there will be downtime if that interface is currently passing traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also need to configure VRF aware IGP instances (assuming you are currently running an IGP in your topology now) to route traffic where it needs to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, commands that show vrf specific info must include the vrf name.  commands that don't include the vrf name will show you info from the default (global) VRF.&lt;/p&gt;&#xA;" OwnerUserId="190" LastActivityDate="2013-05-30T01:59:18.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1380" PostTypeId="2" ParentId="1376" CreationDate="2013-05-30T03:39:23.353" Score="5" Body="&lt;p&gt;Using VRFs is easy but depending on the size of your topology can get messy if you only deploy VRF lite. VRF lite is the use of VRFs without using MPLS. If you don't have MPLS you need to run your IGP (OSPF) in vrf aware mode. So for every switch that you have you need to create an interface in the VRF that is used for peering OSPF with the other switches. So say that you have a topology like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;               +--------+         +--------+&#xA;               |        |         |        |&#xA;    +---------+|  SW2   +--------+|  SW3   +----------------+&#xA;    |          +--------+         +--------+                |&#xA;    |                                                       |&#xA;    |                                                       |&#xA;+---+---+                                              +----+---+&#xA;|       |                                              |        |&#xA;| SW1   |                                              |  SW4   |&#xA;+-------+                                              +--------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So now the basic steps to move over to a VRF is to first create the VRF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf Guest&#xA;rd 1:1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you need to have a L3 interface between the switches. Are you running L2 links today with SVI or do you have &quot;real&quot; L3 interaces? If you are using SVI it would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int vlan 12&#xA;ip vrf forwarding Guest&#xA;ip add 12.12.12.1 255.255.255.0&#xA;!&#xA;int vlan 23&#xA;ip vrf forwarding Guest &#xA;ip add 23.23.23.2 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you are moving these IP addresses from the global table then there will be a disruption because when you move it to a VRF all your routing state will be cleared because at that point the VRF is empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you need to configure your IGP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1 vrf Guest&#xA;net 12.12.12.0 0.0.0.255 area 0&#xA;net 23.23.23.0 0.0.0.255 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OSPF does not support having multiple VRFs under the same process number so you would need to run a new process number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All show commands will use vrf to check the status like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip route vrf Guest&#xA;show ip cef vrf Guest&#xA;ping vrf Guest x.x.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-30T03:39:23.353" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1382" PostTypeId="1" CreationDate="2013-05-30T03:50:13.197" Score="6" ViewCount="4421" Body="&lt;p&gt;We're in an office environment of about 50 people. A few departments send emails with large attachments extensively and doing so clogs up the WAN connection (10Mbps).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm upgrading the networking equipment so that it now uses Cisco 1921/K9 router along with a Cisco SG300 managed switch and a few Cisco SF200E switches (no extra modules/bundles were purchased for these equipments). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've set up VLANs that will group certain departments together and set up bandwidth limits for each, but if one person decides to send out a huge email it will still affect other people. How do I throttle one specific node--preferably automatically--with my current equipment?&lt;/p&gt;&#xA;" OwnerUserId="851" LastEditorUserId="714" LastEditDate="2013-05-31T08:50:25.647" LastActivityDate="2013-05-31T08:50:25.647" Title="How to throttle speed for a particular computer with high activity?" Tags="|cisco|qos|vlan|cisco-isr|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1384" PostTypeId="2" ParentId="1302" CreationDate="2013-05-30T04:10:30.763" Score="1" Body="&lt;p&gt;GRE isn't supported on the ASA from my knowledge. Would you ever required multicast? How many tunnels would you need to support?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although this is going off-topic of the ASA, DMVPN could solve your issue with any dynamic routing protocol. It is fairly easy to deploy and scale and supports multicast routing and spoke 2 spoke communications (including behind a NAT) [big plus for remote-home users]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EasyVPN on the ASA + routers (endpoints) maybe a solution but I only messed with static routes on that. I believe you can only add-in static routes towards the endpoints. The ASA of course can participate in EIGRP/OSPF/RIP to redistribute those routes towards the rest of your network&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="343" LastEditDate="2013-05-30T05:12:01.323" LastActivityDate="2013-05-30T05:12:01.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1386" PostTypeId="2" ParentId="1382" CreationDate="2013-05-30T04:25:15.677" Score="0" Body="&lt;p&gt;This sounds more like a policy issue to me. Why do they need to send such large attachments? The options you have as I see it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Throtte all e-mail traffic&lt;/li&gt;&#xA;&lt;li&gt;Enforce policy to not allow large attachments&lt;/li&gt;&#xA;&lt;li&gt;Educate users to use FTP or some collaboration software like MS Sharepoint&lt;/li&gt;&#xA;&lt;li&gt;Throttle the above application if needed&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Higher end devices supports something called microflow policing but it's not available on the ISR G2 as far as I know.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-30T04:25:15.677" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1387" PostTypeId="2" ParentId="1204" CreationDate="2013-05-30T04:34:05.410" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;APs and the controller being on the same subnet is rather unlikely. You'd probably have a centralized controller somewhere in your organization and the APs would be plugged into ports in different IDF closets which span multiple subnets. When the APs boot up, they take the domain-name assigned via DHCP and try and resolve CISCO-CAPWAP-CONTROLLER.domainname.com or CISCO-LWAP-CONTROLLER.domainname.com and tunnel back their CAPWAP or LWAP tunnels there.&#xA;Having the same L2 VLAN spanned around your multiple switches and trunks is dangerous from a STP pov. So I would say having APs and Controllers on the same L2 domain is bad practice.&lt;/li&gt;&#xA;&lt;li&gt;Unless you want to give your secretary access to the controller - look at using Cisco Guest Access server. &lt;a href=&quot;http://www.cisco.com/en/US/products/ps10160/index.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/products/ps10160/index.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This allows the secretary to generate usernames and passwords for guests as well as email them the information (they can read it on their smartphones and login) and specify the length of time in which the account will stay logged in for.&#xA;That way no one knows the PSK or generic login using web-authentication.&#xA;It is also best practice to event encrypt the open/guest wifi-network with a simple password to provide user security.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-05-30T04:34:05.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1390" PostTypeId="1" AcceptedAnswerId="1391" CreationDate="2013-05-30T05:33:59.587" Score="11" ViewCount="18934" Body="&lt;p&gt;What is the best practice when configuring etherchannel on Cisco switches to prevent a STP loop/broadcast storm when etherchannel is mis-configured?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had an instance where 2 ports on a switch were configured with via trunk ports properly however the opposing switch was only had one port switch as a trunk, the 2nd as a regular access port. Upon a power-cycle, a broadcast storm took down the network and originated from these two switches.&#xA;&lt;code&gt;channel-group 1 mode on&lt;/code&gt; was configured on all ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my research&#xA;L2 etherchannel links should be configured with only&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;channel-group 1 mode desirable&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L3 links can be configured w/ channel-group 1 mode on as STP isn't running over them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately in this scenario PVST+ was configured and bdpuguard was missing on all edge ports :(&#xA;Lastly, all switches here are Cisco - not a multi-vendor environment&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="343" LastEditDate="2013-05-30T13:41:13.903" LastActivityDate="2013-05-30T13:48:08.313" Title="Preventing STP loops in etherchannels configurations" Tags="|spanning-tree|best-practices|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1391" PostTypeId="2" ParentId="1390" CreationDate="2013-05-30T05:49:47.150" Score="14" Body="&lt;p&gt;You should not be using &quot;on&quot; for link aggregation as it can lead to problems.  On the side with aggregation statically on, it will use the interfaces in the etherchannel, no matter what the configuration is on the other side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While storm control (from comments) can be very helpful with some of the problems that result, it does not resolve all of them.  For instance if one of the remote side links is an access port on a different VLAN, all traffic that goes down that port will likely never reach its destination.  Depending on how constant the traffic and the load balancing across the etherchannel, this may result in a complete &quot;outage&quot; for some hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I always recommend the use of LACP over PAgP, so instead of desirable/auto or on, use either active on both sides or active on one and passive on the other.  The reason for this is that LACP is standards based while PAgP is Cisco proprietary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course this is in part dependent on the hardware platform, so check the appropriate documentation for your platform.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-30T13:48:08.313" LastActivityDate="2013-05-30T13:48:08.313" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1392" PostTypeId="1" AcceptedAnswerId="1393" CreationDate="2013-05-30T06:14:28.790" Score="12" ViewCount="11395" Body="&lt;p&gt;My knowledge of inter-VRF routing isn't the best.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have one public IP. The public Internet and its quad 0 is on the default VRF....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I have a Guest_VRF and a corporate_VRF which would both need to access the Internet and point to the default gateway on the default VRF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see this being done with multiple Cisco routers however I can't figure out a way that I could do this all-in-one device. I keep envisioning multiple NAT/PATs here which is just messy or using loopbacks and tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm focusing mainly on an ISR G1/G2 router here. Does anyone have any advice?&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="105" LastEditDate="2013-05-30T06:47:14.410" LastActivityDate="2015-04-19T16:44:46.857" Title="1 router, 1 internet connection/IP - multiple VRFs using the same ISP gateway" Tags="|cisco|cisco-ios-12|cisco-ios-15|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1393" PostTypeId="2" ParentId="1392" CreationDate="2013-05-30T06:48:44.693" Score="13" Body="&lt;p&gt;Using a VRF is like using a seperate router. If you have the same WAN IP for both VRF's, then you have to configure it twice in both WAN interfaces. If you however only use one WAN interface, you'll have to divide this interface by trunking (using VLAN's) or subinterfaces. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ex:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0.5&#xA;encapsulation dot1Q 5&#xA;ip address 1.1.1.1 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice we do not use ip vrf forwarding, we are using the default vrf here&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0.10&#xA;ip vrf forwarding wanconnection:1&#xA;encapsulation dot1Q 10&#xA;ip address 1.1.1.1 255.255.255.252 (&amp;lt;== this can be another IP if you prefer to divide it with 2 different IP's)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The connection then goes as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;your router (normal vrf) =&gt; wan connection =&gt; vpn used for dot1Q tag 5&lt;/li&gt;&#xA;&lt;li&gt;your router (wanconnection:1 vrf) =&gt; wan connection =&gt; vpn used for dot1Q tag 10&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;if you want to do this without tagging and just have 2 physical interfaces, it's the same implementation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0&#xA;ip address 1.1.1.1 255.255.255.252&#xA;&#xA;interface FastEthernet1&#xA;ip vrf forwarding wanconnection:1&#xA;ip address 1.1.1.1 255.255.255.252 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Every other interface needed in the specific vrf &quot;wanconnection:1&quot; needs to be added in the same way: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf forwarding wanconnection:1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ex:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet4&#xA; ip vrf forwarding wanconnection:1&#xA; ip address 10.0.0.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;making a vrf: &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/15.02SG/configuration/guide/vrf.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/15.02SG/configuration/guide/vrf.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf wanconnection:1&#xA; rd 65000:1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the rd 100:1 command explained:&#xA;Creates a VRF table by specifying a route distinguisher. Enter either an AS number and an arbitrary number (xxx:y) or an IP address and arbitrary number (A.B.C.D:y).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for the routing part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 1.1.1.2&#xA;ip route vrf wanconnection:1 0.0.0.0 0.0.0.0 1.1.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you &lt;strong&gt;only have one WAN connection&lt;/strong&gt; without tagging enabled, you could use inter Vrf routing: &lt;a href=&quot;http://packetlife.net/blog/2010/mar/29/inter-vrf-routing-vrf-lite/&quot; rel=&quot;noreferrer&quot;&gt;http://packetlife.net/blog/2010/mar/29/inter-vrf-routing-vrf-lite/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ex:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf wanconnection:1&#xA; rd 65000:1&#xA; route-target export 65000:2&#xA; route-target import 65000:99&#xA;&#xA;ip vrf wanconnection:2&#xA; rd 65000:2&#xA; route-target export 65000:1&#xA; route-target import 65000:99&#xA;&#xA;ip vrf shared:1&#xA; rd 65000:99&#xA; route-target export 65000:99&#xA; route-target import 65000:1&#xA; route-target import 65000:2&#xA;&#xA;interface FastEthernet0&#xA;ip vrf forwarding shared:1&#xA;ip address 1.1.1.1 255.255.255.252 &#xA;&#xA;interface loopback1&#xA;ip vrf forwarding shared:1&#xA;ip address 2.2.2.2 255.255.255.255&#xA;&#xA;&#xA;ip route vrf shared:1 0.0.0.0 0.0.0.0 1.1.1.2&#xA;ip route vrf wanconnection:1 0.0.0.0 0.0.0.0 2.2.2.2&#xA;ip route vrf wanconnection:2 0.0.0.0 0.0.0.0 2.2.2.2&#xA;&#xA;interface FastEthernet1&#xA;ip vrf forwarding wanconnection:1 &#xA;ip address 10.0.0.1 255.255.255.0&#xA;description &quot;LAN interface vrf 1&quot;&#xA;&#xA;interface FastEthernet2&#xA;ip vrf forwarding wanconnection:2&#xA;ip address 10.0.2.1 255.255.255.0&#xA;description &quot;LAN interface vrf 2&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here FastEthernet1 will use the default route for vrf wanconnection:1 and FastEthernet2 will use the default route for vrf wanconnection:2 (provided by the &quot;ip route&quot; commands).&lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="623" LastEditDate="2013-05-31T22:47:42.400" LastActivityDate="2013-05-31T22:47:42.400" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1394" PostTypeId="2" ParentId="1392" CreationDate="2013-05-30T07:09:30.343" Score="4" Body="&lt;p&gt;If you use VRF's then it is possible to make a hub &amp;amp; spoke VRF using just one router without the need for MPLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to use BGP but this doesnt need to peer with anyone, it is used simply to route between the VRF's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you would do it something like...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf GUEST&#xA; rd 100:1&#xA; route-target export 100:100&#xA; route-target import 100:200&#xA;&#xA;ip vrf CORP&#xA; rd 100:2&#xA; route-target export 100:100&#xA; route-target import 100:200&#xA;&#xA;ip vrf WAN&#xA; rd 100:100&#xA; route-target import 100:100&#xA; route-target export 100:200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would then export routes (like the default route) from the WAN VRF into the two VRF's but not export the other subnets to each other.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-05-30T07:09:30.343" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1396" PostTypeId="1" AcceptedAnswerId="1397" CreationDate="2013-05-30T08:11:08.777" Score="19" ViewCount="8732" Body="&lt;p&gt;&lt;strong&gt;In order of preference/priority, what factors do you consider in driving an upgrade (or downgrade) with Cisco IOS?&lt;/strong&gt;  If no compelling factors exist, how long would you allow a particular version of IOS to stay running?  &lt;em&gt;I've seen some switches with uptimes &gt; 5 years.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;And when upgrading, how is the specific IOS release identified as the upgrade target?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-05-30T22:43:04.487" LastActivityDate="2014-12-30T01:55:37.340" Title="What factors drive a Cisco IOS upgrade?" Tags="|cisco|cisco-ios|best-practices|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1397" PostTypeId="2" ParentId="1396" CreationDate="2013-05-30T08:11:08.777" Score="26" Body="&lt;p&gt;In order of preference/priority, our company tends to upgrade based on these factors:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Vulnerabilities, vulnerabilities, vulnerabilities!&lt;/strong&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Bugs&lt;/strong&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Attaining new features&lt;/strong&gt; not currently available-- new cards/modules have a &quot;first supported in&quot; IOS version which could be higher than what you have running&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Migrating away from retired release trains&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Matching versions&lt;/strong&gt; on more recently deployed and similar hardware&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A device that is very critical to the infrastructure may not be as aggressively upgraded as one that is less critical.  Consideration is given to the role of the device, the redundancy surrounding it, and the impact of the upgrade itself by the downtime incurred or by the possibility of having config feature behavior changes or different defaults when going between major versions.  This is the &lt;strong&gt;necessity&lt;/strong&gt; question that also touches on soft costs such as the time and resources to accomplish the upgrades measured against the weight given to each of the factors such as vulnerabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Be sure to subscribe to multiple vulnerability announcement sites such as &lt;a href=&quot;http://www.cisco.com/go/psirt&quot; rel=&quot;nofollow&quot;&gt;Cisco PSIRT&lt;/a&gt; (Product Security Incident Response Team) and the &lt;a href=&quot;https://www.us-cert.gov&quot; rel=&quot;nofollow&quot;&gt;US Cert&lt;/a&gt; (Computer Emergency Readiness Team).&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A downgrade might be in order if:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Organization has a policy to only run tested/QA'd versions and new equipment came with a more recent release.  &lt;/li&gt;&#xA;&lt;li&gt;Org has a policy against running anything other than GD.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use Cisco's Output Interpreter of &quot;show version&quot; to look for obvious &#xA;issues/vulnerabities/bugs.    &lt;/li&gt;&#xA;&lt;li&gt;Look for GD (General Deployment) releases and avoid DF (Deferred).   &lt;/li&gt;&#xA;&lt;li&gt;Use ED (Early Deployment) only when it contains must-have features not available elsewhere.   &lt;/li&gt;&#xA;&lt;li&gt;Avoid LD (Limited Deployment) when possible and use GD instead.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are certainly arguments for going to an ED or LD version, but the desire, of course, is to get to the most stable version that meets requirements.  Use Cisco's &lt;a href=&quot;http://tools.cisco.com/ITDIT/CFN/&quot; rel=&quot;nofollow&quot;&gt;Feature Navigator&lt;/a&gt; to help identify potentially different feature-sets (assuming you're licensed to use them).&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2014-12-30T01:55:37.340" LastActivityDate="2014-12-30T01:55:37.340" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1398" PostTypeId="2" ParentId="1301" CreationDate="2013-05-30T10:07:51.470" Score="0" Body="&lt;p&gt;if the destination IP addresses stay the same - why not simply using static routes pointing to the dedicated link you mentioned? this way you take away the need for the router to look at each match criteria you have set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. 'skype' server ip address = 10.1.1.1 and 2nd link is 192.168.1.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip route host 10.1.1.1 192.168.1.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a similar situation where broadcasting services are handled via a 2nd link. no pbr needed for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used PBR before - but that was in order to have specific sources using specific gateways on the same network.&lt;/p&gt;&#xA;" OwnerUserId="1440" LastActivityDate="2013-05-30T10:07:51.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1399" PostTypeId="2" ParentId="1361" CreationDate="2013-05-30T10:12:12.660" Score="0" Body="&lt;p&gt;one more thought on this - if you use Cisco ASA as your internet termination device:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can't use the context feature if you are using VPN services on the same boxes (assuming you have/want an active/active setup)&lt;/p&gt;&#xA;" OwnerUserId="1440" LastActivityDate="2013-05-30T10:12:12.660" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1400" PostTypeId="2" ParentId="1361" CreationDate="2013-05-30T10:30:29.333" Score="5" Body="&lt;p&gt;If you have proper security policies in place, there is no need to separate these two devices out. If you have a properly spec'd firewall, then performance is not a reason to separate them out either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's good of the vendor to tell you to split these two out as they end up selling you two firewalls instead of a single device.&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-30T10:30:29.333" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1401" PostTypeId="2" ParentId="1392" CreationDate="2013-05-30T10:30:47.520" Score="3" Body="&lt;p&gt;It can be done using PBR. Push the traffic for the default gw from vrf into the global routing table. &#xA;Please check the following link: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2sr/12_2srb/feature/guide/srb2mvrf.html#wp1060956&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/ios/12_2sr/12_2srb/feature/guide/srb2mvrf.html#wp1060956&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1049" LastActivityDate="2013-05-30T10:30:47.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1402" PostTypeId="2" ParentId="1382" CreationDate="2013-05-30T10:50:47.087" Score="3" Body="&lt;p&gt;Based on the information you have given;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could use a configuration like the below sample to limit traffic to a specific remote IP (I assume you need to limit traffic to your remote email server, which isn't on site, otherwise you simply could rate limit traffic to/from the email server and your WAN connection);&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any CM-Match-Email-Server&#xA;  description Shape connections to email server&#xA; match access-group 133&#xA;!&#xA;policy-map PM-Limit-Emails&#xA; class CM-Match-Email-Server&#xA;   police cir 175000 pir 175000&#xA;     conform-action transmit &#xA; class class-default&#xA;  fair-queue&#xA;!&#xA;interface Fa0/1&#xA; description YOUR-WAN-CONNECTION&#xA; service-policy output PM-Limit-Backups&#xA;!&#xA;access-list 133 remark ACL-Offsite-Email-QoS &#xA;access-list 133 permit ip 192.168.0.0 0.0.0.255 1.2.3.4 0.0.0.127 ! Remote email server subnet&#xA;access-list 133 permit ip 192.168.0.0 0.0.0.255 host 3.4.5.6 ! Or specific email server IP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously you would need to change the police rate to match your requirements.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-30T10:50:47.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1403" PostTypeId="2" ParentId="1396" CreationDate="2013-05-30T10:57:31.767" Score="8" Body="&lt;p&gt;You missed out, &lt;strong&gt;necessity&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch in a dusty old broom closet probably doesn't need it's IOS upgraded to the latest IOS for security fixes and new features, if it only has a 10 year old ink jet printer attached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should comment on &lt;strong&gt;when not to upgrade&lt;/strong&gt; also, as it can be a waste of time, human resources, and cause downtime when jumping between major versions that might cause features to no longer work or the config syntax has changed, and so on.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="762" LastEditDate="2013-05-30T15:09:05.363" LastActivityDate="2013-05-30T15:09:05.363" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1404" PostTypeId="2" ParentId="1390" CreationDate="2013-05-30T11:47:14.500" Score="5" Body="&lt;p&gt;Irrelivant of when to use active/on/desireable etc; It sounds to me like you didn't have STP configured at all/correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BPDU packets coming into the access port on the 2nd switch should have caused the port to err-disable. Configure correct STP protection schemes (which I am not going to explain here, as they are all over the Internet) and I don't believe this problem should have happened in the first place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Also if your switches support it, broadcast storm controll as Ricky mentioned!).&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-05-30T11:47:14.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1405" PostTypeId="2" ParentId="653" CreationDate="2013-05-30T12:50:12.973" Score="1" Body="&lt;p&gt;only using IOS commands is a bit tricky - you will miss out the odd one.&#xA;I'd suggest like others to use snmp (solarwinds has a number of free tools you might want to look at) and to monitor the device for a number of days (weeks if necessary)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the laborious part you mentioned with tracing cables etc. &#xA;What I did to minimize the work with mapping switch ports to patch ports etc. was clearing the counters and then a few days later using snmp traps and then unplugging on the patchpanel for 1-2 seconds and once I got an entry on the snmp trap monitor/receiver (port x on module y went down), I just did the same thing again to verify (not that someone just incidentially turned off a device on one of the ports).&#xA;It takes maybe 5 minutes for a 24 port panel - so this is rather quick. For the dead ones - just go back another time. If they are still dead, and no change on the counters then it is safe to assume the port is actually not in use.&lt;/p&gt;&#xA;" OwnerUserId="1440" LastActivityDate="2013-05-30T12:50:12.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1406" PostTypeId="1" AcceptedAnswerId="1424" CreationDate="2013-05-30T13:14:24.377" Score="4" ViewCount="1376" Body="&lt;p&gt;I am wondering if it's possible to set up a way to remove the need for a bypass switch when using an IPS device.  To summarize, I would have an IPS device acting as a virtual wire on a connection I'm monitoring.  I also have a bypass switch to do this so that if the IPS fails, the network connection will bypass the IPS device and maintain the connection (I am aware of the security concerns with failing open).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By VLAN bridge, I mean 2 access ports in 2 different vlans that are physically connected.  So, my thought was to have the IPS device act as that physical wire between the 2 access ports.  In addition, if I had another loop between 2 different access ports with a higher STP cost, I should effectively have a bypass (if IPS went down, STP would take care of the bypass by switching to the other loop).  The idea in general works when my loops are between 2 different switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I had some trouble getting this to work on a single switch.  I was testing this with 2 computers in the 2 different vlans pinging each other.  So, it's possible I'm just having some ARP problems, and this would work if I can get around that, but I'm not sure yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this too crazy of an idea to ever work, or am I just missing something?  &lt;/p&gt;&#xA;" OwnerUserId="167" LastActivityDate="2013-05-30T16:53:56.683" Title="Can a VLAN bridge be used to replace a bypass switch with an IPS device?" Tags="|switch|vlan|security|spanning-tree|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1407" PostTypeId="2" ParentId="1406" CreationDate="2013-05-30T13:22:42.140" Score="1" Body="&lt;p&gt;It will probably work, but I wouldn't use that kind of solution for production bypassing.&#xA;The proper to do this (even if not the best practice), is to have &lt;strong&gt;bypass&lt;/strong&gt; built-in your IPS device. Meaning that if device fails it will act as a cable even if there is no power. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ofcourse you want to have some kind of monitoring on your device to detect outages and respond accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="1049" LastActivityDate="2013-05-30T13:22:42.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1408" PostTypeId="2" ParentId="1382" CreationDate="2013-05-30T13:48:06.223" Score="6" Body="&lt;p&gt;Expanding upon @javano's answer...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would change one thing, instead of policing the email traffic (which will drop traffic exceeding that rate) I would recommend just setting aside a small amount of bandwidth for that traffic.  Therefore, if nobody else is using the link the email can utilize the unused bandwidth&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map PM-Limit-Emails&#xA; class CM-Match-Critical-Apps&#xA;  bandwidth percent 50&#xA; class CM-Match-Scavenger&#xA;  bandwidth percent 1&#xA; class class-default&#xA;  bandwidth percent 20&#xA;  fair-queue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I didn't get a sense of if the issue was the sending (outbound) or receiving (inbound) of large attachments so, since you are just connected to the internet, there will be the potential that this issue will continue as the ISP is not throttling the traffic (inbound) based on your classifications.  If you have a business class internet service there may be the possibility for them to install a similar policy on their end of your link but you will need to talk with your ISP to determine what, if anything, they will support.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-30T13:48:06.223" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1409" PostTypeId="2" ParentId="1406" CreationDate="2013-05-30T13:52:30.403" Score="2" Body="&lt;p&gt;Is there a need for two &lt;em&gt;different&lt;/em&gt; VLANs?  Depending on the variant of STP you're running, this may actually make things harder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other thing to consider with what you're proposing is that you can't guarantee that the IPS failure will drop both the interfaces.  If the software crashes for example, but interfaces stay up, spanning-tree may not re-converge correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real test will be - does your IPS absorb BPDUs, or pass them transparently&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2013-05-30T13:52:30.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1410" PostTypeId="2" ParentId="1377" CreationDate="2013-05-30T14:02:03.167" Score="11" Body="&lt;p&gt;Or to summarise:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Keep it consistent across your environment - check what the maximum MTU value that your infrastructure will support, accounting for the various ways each vendor calculates it (with or without L2 Headers)&lt;/li&gt;&#xA;&lt;li&gt;Account for physical interfaces, SVIs and L3 interfaces&lt;/li&gt;&#xA;&lt;li&gt;Be aware of protocols like OSPF that &lt;em&gt;enforce&lt;/em&gt; MTU matching between devices before they will form an adjacency&lt;/li&gt;&#xA;&lt;li&gt;Get the network right before touching any servers.  Servers without Jumbos configured will work just fine across a jumbo-enabled network, but the opposite is a disaster.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2013-05-30T14:02:03.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1411" PostTypeId="1" AcceptedAnswerId="1423" CreationDate="2013-05-30T14:31:58.190" Score="9" ViewCount="21213" Body="&lt;p&gt;So aggravating - i can't find good documentation on how to use the Nexus regex command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if my interfaces look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan224&#xA;  description MANAGEMENT&#xA;  no shutdown&#xA;  ip flow monitor netflow-monitor input  &#xA;  no ip redirects&#xA;  ip address 10.214.224.2/24&#xA;  ip ospf passive-interface&#xA;  ip router ospf 1 area 0.0.0.3&#xA;  ip pim sparse-mode&#xA;  hsrp version 2&#xA;  hsrp 224 &#xA;  preempt &#xA;  priority 120&#xA;  ip 10.214.224.1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to run something similar to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show run | inc (interface Vlan)|(ip address)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the output to look similar to (if this were on IOS):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan10&#xA;ip address 10.1.10.1 255.255.255.0&#xA;interface Vlan 11&#xA;ip address 10.1.11.1 255.255.255.0&#xA;etc.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="892" LastEditorUserId="775" LastEditDate="2014-03-06T21:07:18.993" LastActivityDate="2014-03-06T22:40:07.463" Title="How to - use regex in Nexus to search for this | or that?" Tags="|cisco|cisco-nx-os|cisco-nexus-7k|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1412" PostTypeId="2" ParentId="1411" CreationDate="2013-05-30T14:42:30.457" Score="3" Body="&lt;p&gt;The &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_1/nx-os/fundamentals/configuration/guide/Cisco_Nexus_7000_Series_NX-OS_Fundamentals_Configuration_Guide__Release_4.1_chapter4.html#con_1225277&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt; I have seen says this should work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show run | inc interface_Vlan|ip_address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although it does not seem to for me on a 4k blade switch.  I had success with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh run | inc interface.Vlan|ip.address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="176" LastEditorUserId="176" LastEditDate="2013-05-30T15:14:27.053" LastActivityDate="2013-05-30T15:14:27.053" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1413" PostTypeId="1" AcceptedAnswerId="1415" CreationDate="2013-05-30T15:09:18.277" Score="9" ViewCount="5467" Body="&lt;p&gt;Is VRRP-E a completely separate standard than VRRP or does it just add on features to the VRRP standard? What are some major differences between VRRP and VRRP-E?&lt;/p&gt;&#xA;" OwnerUserId="267" LastEditorUserId="762" LastEditDate="2013-05-30T15:22:59.600" LastActivityDate="2013-05-30T17:53:14.417" Title="VRRP and VRRP-Extended" Tags="|brocade|vrrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1414" PostTypeId="2" ParentId="1411" CreationDate="2013-05-30T15:13:09.593" Score="5" Body="&lt;p&gt;If you are just looking for the IP addresses of the Vlan interfaces, a better way may be: &lt;code&gt;show ip int br | grep -i vlan&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: &lt;code&gt;show ip int br&lt;/code&gt; in NXOS only shows layer 3 interfaces. To see status of all interfaces use &lt;code&gt;show int br&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for NXOS 4.0(2) and earlier:&#xA;&lt;code&gt;show run | grep -i face\ vlan|ip\ address&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.0(3) and up:&#xA;&lt;code&gt;show run | grep ignore-case face\ vlan|ip\ address&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also the &lt;code&gt;\&lt;/code&gt; is how to escape the space with regex. Link for the NXOS regex: &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_0/nx-os/fundamentals/configuration/guide2/fun_3about_cli.html#wp1237003&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/docs/switches/datacenter/sw/4_0/nx-os/fundamentals/configuration/guide2/fun_3about_cli.html#wp1237003&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="769" LastEditorUserId="769" LastEditDate="2013-05-30T17:31:05.640" LastActivityDate="2013-05-30T17:31:05.640" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1415" PostTypeId="2" ParentId="1413" CreationDate="2013-05-30T15:22:42.973" Score="7" Body="&lt;p&gt;VRRP-E is Brocade only. From Brocade documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;VRRP-E is a Brocade protocol that provides the benefits of VRRP&#xA;  without the limitations. VRRP-E is unlike VRRP in the following ways:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;There is no “Owner” router. You do not need to use an IP address configured on one of the Layer 3 Switches as the virtual router ID&#xA;  (VRID), which is the address you are backing up for redundancy. The&#xA;  VRID is independent of the IP interfaces configured in the Layer 3&#xA;  Switches. As a result, the protocol does not have an “Owner” as VRRP&#xA;  does.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;There is no restriction on which router can be the default master router. In VRRP, the “Owner” (the Layer 3 Switch on which the IP&#xA;  interface that is used for the VRID is configured) must be the default&#xA;  Master.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Brocade Layer 3 Switches configured for VRRP-E can interoperate only&#xA;  with other Brocade Layer 3 Switches.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="762" LastEditorUserId="76" LastEditDate="2013-05-30T17:53:14.417" LastActivityDate="2013-05-30T17:53:14.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1416" PostTypeId="2" ParentId="1232" CreationDate="2013-05-30T15:23:34.503" Score="1" Body="&lt;p&gt;The configuration and command structure between Brocade XMR/Ironware platform and the 6910 &#xA;Ethernet Access Switch is VERY different.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IronWare Style&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;&#xA;vlan 555 name Test&#xA; tagged ethe 2/3 ethe 2/10&#xA; router-interface ve 555&#xA;&#xA;interface ethernet 2/3&#xA; port-name Core: 24.r1.test via fiber&#xA; enable&#xA;&#xA;interface ve 555&#xA; port-name TestVE&#xA; ip address 192.168.15.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;EAS 6910 Style&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf&#xA;&#xA;vlan database&#xA;vlan 555 name Test media ethernet&#xA;exit&#xA;&#xA;interface vlan 555&#xA;ip address 192.168.15.1 255.255.255.0&#xA;&#xA;interface ethernet 1/1&#xA;description Core: 24.r1.test via fiber&#xA;switchport ingress-filtering&#xA;switchport mode hybrid&#xA;switchport allowed vlan add 555 tagged&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="412" LastEditorUserId="412" LastEditDate="2013-05-30T15:38:05.167" LastActivityDate="2013-05-30T15:38:05.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1417" PostTypeId="2" ParentId="1413" CreationDate="2013-05-30T15:25:43.217" Score="6" Body="&lt;p&gt;The main current issue with the Brocade line is that you can only enable one at a time, per chassis. i.e. If you want to run VRRP-E, you'll never be able to run VRRP with another vendor on another port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are not compatible in any way. VRRP-E is proprietary. &lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-30T15:25:43.217" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1418" PostTypeId="2" ParentId="99" CreationDate="2013-05-30T15:38:38.590" Score="1" Body="&lt;p&gt;Cost factor i think is everything when trying to choose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If speed and long distance coverage is essential in your network design and implementation  Optical Fiber cable is your best suite &lt;/p&gt;&#xA;" OwnerUserId="1449" LastActivityDate="2013-05-30T15:38:38.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1420" PostTypeId="1" CreationDate="2013-05-30T15:25:43.167" Score="4" ViewCount="1051" Body="&lt;p&gt;Does it make more sense to modify the 1800 second refresh rate, pacing timers, or all of the above in terms of network stability/best practices/etc to achieve quicker LSA maintenance? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am dealing with a specific situation wherein modifying the default values is desired. What are some of the typical adjustments made away from the defaults in a conservative (not too agressive) way? &lt;/p&gt;&#xA;" OwnerUserId="1453" OwnerDisplayName="THE DOCTOR" LastEditorUserId="1453" LastEditDate="2013-05-30T17:16:11.687" LastActivityDate="2013-05-30T22:11:11.910" Title="OSPF LSA Performance Tuning" Tags="|cisco|best-practices|ospf|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1421" PostTypeId="2" ParentId="1420" CreationDate="2013-05-30T15:46:25.620" Score="0" Body="&lt;p&gt;90% of the time it makes sense to leave the defaults as-is. But in a high availability environment or large ISP it does make sense to adjust the timers to exactly what you need&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-30T15:46:25.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1422" PostTypeId="2" ParentId="1420" CreationDate="2013-05-30T15:49:28.583" Score="2" Body="&lt;p&gt;Honestly if you're concerned with best practices and keeping your LSDBs nice and neat, ready for fast convergence, I would recommend ensuring that your OSPF areas are constructed well. Keep LSAs that don't need to be in an area summarized, and don't let a single area grow too large.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-05-30T15:49:28.583" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1423" PostTypeId="2" ParentId="1411" CreationDate="2013-05-30T16:08:58.527" Score="8" Body="&lt;p&gt;You can do a &lt;code&gt;show run | egrep interface.Vlan|ip.address&lt;/code&gt;. It does grab a bit more info, but should provide similar output to what you see in IOS. I think grep might work as well, but I used egrep and got the correct output. &lt;/p&gt;&#xA;" OwnerUserId="1169" LastEditorUserId="3191" LastEditDate="2014-03-06T21:17:40.007" LastActivityDate="2014-03-06T21:17:40.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1424" PostTypeId="2" ParentId="1406" CreationDate="2013-05-30T16:20:16.807" Score="2" Body="&lt;p&gt;I don't believe this will be possible on one single switch. The reason being is that you are relying on STP to catch a link failure, but to go back to back on a single switch, you would have to suspend normal STP operation by either BPDU filtering or something similar. &lt;/p&gt;&#xA;" OwnerUserId="1169" LastActivityDate="2013-05-30T16:20:16.807" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1425" PostTypeId="2" ParentId="1406" CreationDate="2013-05-30T16:53:56.683" Score="0" Body="&lt;p&gt;If the IPS is fully transparent (relaying BPDUs, not doing any sort of VLAN mappings by itself), you can use VLAN mapping/translation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, you define two VLANs, external and internal. The external switchport carries the external VLAN (probably a trunk port), the internal switchport the internal VLAN. At the internal switchport, you configure VLAN mapping/translation. c6500s will take care of translating BPDU information, so you dont get any mismatch errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This even works with redundant switches/IPSes, the second installation will have its internal block blocked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done this with 6500 Sup720 and 67xx linecards (which have the limitation of applying the VLAN mapping per port ASIC), cant say if this works with other gear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another drawback is that you have to deal with different VLAN IDs for external (upstream) and internal (downstream) devices, which could impact planning and troubleshooting.&lt;/p&gt;&#xA;" OwnerUserId="1452" LastActivityDate="2013-05-30T16:53:56.683" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1426" PostTypeId="2" ParentId="99" CreationDate="2013-05-30T17:06:57.057" Score="5" Body="&lt;p&gt;One thing that none of the other answers have mentioned yet is size. Fiber is physically smaller and you can fit more runs of fiber in a given space than copper, especially cat6. Depending on your environment, this can be a consideration.&lt;/p&gt;&#xA;" OwnerUserId="91" LastActivityDate="2013-05-30T17:06:57.057" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1427" PostTypeId="2" ParentId="1420" CreationDate="2013-05-30T17:27:27.463" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What are some of the typical adjustments made away from the defaults&#xA;  in a conservative (not too agressive) way?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is recommended that the OSPF hello and dead timers be reduced to 250 msec and 1 second, respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/routed-ex.html#wp998943&quot; rel=&quot;nofollow&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-05-30T17:27:27.463" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1428" PostTypeId="1" AcceptedAnswerId="1434" CreationDate="2013-05-30T18:21:50.283" Score="10" ViewCount="8008" Body="&lt;p&gt;When designing an access layer, best practices today seem to indicate going toward a L3 design.  I know the answers may be different depending on whether or not we're talking about a DC design or Enterprise Campus design.  &lt;strong&gt;Please describe when you would choose L2 over L3 in the access layer and the differences in design with DC vs. campus.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I know L2 adjacency requirements between servers such as clusters (Windows, VMWare, etc) would push for L2 in the DC access.  Are there other factors too?  And if L2 is required, is it best practice to carry that L2 traffic up to the Aggregation layer and back down or just carry that L2 across directly connected trunks between access switches (i.e., build in looped squares instead of triangles).  Do you keep L2 adjacencies limited to just a pair of access switches so as to not increase the broadcast/collision/STP domains?&lt;/p&gt;&#xA;&lt;p&gt;In the Enterprise campus, assuming no L2 adjacency requirements, are there any cases that would indicate a design other than L3 in the access layer?&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="77040" LastEditDate="2021-07-20T06:20:54.223" LastActivityDate="2021-07-20T08:22:57.803" Title="What factors drive L2 vs L3 in the access layer?" Tags="|cisco|routing|best-practices|design|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1429" PostTypeId="1" AcceptedAnswerId="1432" CreationDate="2013-05-30T18:24:13.143" Score="10" ViewCount="11817" Body="&lt;p&gt;When would you choose to use the &lt;code&gt;ip default-network&lt;/code&gt; command instead of the &lt;code&gt;ip default-gateway&lt;/code&gt; command?&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-05-30T18:45:09.100" Title="Default-network and default-gateway" Tags="|cisco|routing|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1430" PostTypeId="2" ParentId="1429" CreationDate="2013-05-30T18:27:36.580" Score="1" Body="&lt;p&gt;When IP routing is enabled, the commands ip default-network and &quot;ip route 0.0.0.0&quot; etc. work the same. These commands would be used on a router or Layer 3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;ip default-gateway&quot; would be used when ip routing is not enabled - for instance, on a Layer 2 switch that has an SVI for management but cannot route on that SVI.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-05-30T18:27:36.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1431" PostTypeId="2" ParentId="1429" CreationDate="2013-05-30T18:29:18.590" Score="2" Body="&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094374.shtml&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically &lt;code&gt;ip default-gateway&lt;/code&gt; is for layer-2 devices and &lt;code&gt;ip default-network&lt;/code&gt; is for layer-3 devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip default-network&lt;/code&gt; is basically a default route&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-05-30T18:29:18.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1432" PostTypeId="2" ParentId="1429" CreationDate="2013-05-30T18:45:09.100" Score="12" Body="&lt;p&gt;&lt;code&gt;ip default-gateway&lt;/code&gt; is to be used in L2 devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip default-network&lt;/code&gt; would be used in L3 devices, but works slightly different from the usual static default route configured with &lt;code&gt;ip route 0.0.0.0 0.0.0.0 &amp;lt;next_hop&amp;gt;&lt;/code&gt;. Let's say you configure &lt;code&gt;ip default-network 172.31.0.0&lt;/code&gt;. Then, if the device already knows a route for 172.31.0.0, this route will be flagged as a default route candidate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to take into account that &lt;code&gt;ip default-network&lt;/code&gt; command is classful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further details and clarifications are available &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094374.shtml#ipnetwork&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2013-05-30T18:45:09.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1433" PostTypeId="1" AcceptedAnswerId="1436" CreationDate="2013-05-30T19:12:33.123" Score="5" ViewCount="3367" Body="&lt;p&gt;Why do Brocade MLX ACL changes require the extra configuration step as described below? Compared to Cisco ACLs this seems inconvenient.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If you make an ACL configuration change, you must reapply the ACLs to&#xA;their interfaces to place the change into effect.&lt;/p&gt;&#xA;&lt;p&gt;An ACL configuration change includes any of the following:&lt;/p&gt;&#xA;&lt;p&gt;• Adding,changing, or removing an ACL or an entry in an ACL&lt;/p&gt;&#xA;&lt;p&gt;• Changing ToS-based QoS mappings&lt;/p&gt;&#xA;&lt;p&gt;To reapply ACLs following an ACL configuration change, enter the&#xA;following command at the global CONFIG level of the CLI.&lt;/p&gt;&#xA;&lt;p&gt;Brocade(config)# ip rebind-acl all&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="267" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-05-30T22:06:07.083" Title="Brocade MLX reapplying modified ACL" Tags="|brocade|acl|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1434" PostTypeId="2" ParentId="1428" CreationDate="2013-05-30T19:14:21.237" Score="6" Body="&lt;p&gt;L2 Access is often needed when autonomous wireless access points are deployed across multiple switches, thus allowing users to roam from AP to AP without having to get new addresses.  Current controller based wireless solutions tunnel the user traffic to a central drop-off point, so wireless APs can be connected in any subnet so long as they can communicate with the controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L3 in the access layer works well when there's no need for devices connected to multiple switches to access the same subnet/broadcast domain.  It eliminates the need for loop prevention (STP) and VLAN trunking configuration (such as Cisco VTP or manual VLAN configuration).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L3 access layers do add their own requirements for protocols and configuration.  Unless you want to do static routing you have to take on configuration of a dynamic routing protocol such as such as OSPF (standard) or EIGRP (Cisco).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In L3 access networks with dynamic routing it is also a good idea to summarize or tune advertised routes between layers of the network.  For example, you can advertise only a default route from the Aggregation layer to the Access layer to limit the number of routes a simple access switch must learn and maintain.  Turning off auto summarization on the Access switches can also help prevent a misconfiguration from causing one switch to advertise routes it should not. Auto summarization is disabled by default on many current software revisions, but is worth verifying for your switch and software version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, access layer diameter is a factor in choosing L2 or L3.  If you want to daisy-chain one access switch off another (where one switch does not connect directly to aggregation) you may need expanded features to run dynamic routing.  In Cisco switches you need a more advanced IOS license to run EIGRP in non-Stub mode, allowing it to advertise routes it learned from another switch to the rest of the network.&lt;/p&gt;&#xA;" OwnerUserId="1345" LastActivityDate="2013-05-30T19:14:21.237" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1435" PostTypeId="2" ParentId="1377" CreationDate="2013-05-30T19:21:16.250" Score="3" Body="&lt;p&gt;Depending on your network layout, you should make sure and start from the inside out. Start with links in your core and work out from there through your distribution and access layers (if applicable). Make sure your network completely supports jumbo frames before you start enabling it on your access ports. Most 100/1000 end devices these days don't support jumbo frames, and will (obviously) default to standard mtu if they do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best advice I can offer if you are thinking about deploying jumbo frames across your network is make sure you aren't blocking PMTUD (v4 or v6) anywhere within your network. As long as you leave your upstream ports until last, you shouldn't have any problems within your network.&lt;/p&gt;&#xA;" OwnerUserId="89" LastActivityDate="2013-05-30T19:21:16.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1436" PostTypeId="2" ParentId="1433" CreationDate="2013-05-30T19:22:51.313" Score="3" Body="&lt;p&gt;It likely has to do with how the TCAM is programmed (see edit below - Brocade refers to it as CAM). I'd definitely be interested to hear why adding a completely separate ACL (vs just an entry in an ACL) would require you to &amp;quot;reapply the ACLs&amp;quot;. Do you have a source for that quote? If you don't have an SE assigned to your account, I do have contacts that I can ask and get clarification on this.&lt;/p&gt;&#xA;&lt;p&gt;While not Brocade, I have had experience with vendor hardware where modifying an ACL &amp;quot;in place&amp;quot; would cause certain rules &amp;quot;further up&amp;quot; in the ACL to be completely ignored/stop functioning. Until the bug was actually fixed, the only workaround was to delete the ACL itself, and then recreate it with all of the rules before applying it to any interface.&lt;/p&gt;&#xA;&lt;p&gt;Edit: Turns out my original thought was correct - from NetIron documentation:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;h1&gt;How the Brocade device processes ACLs&lt;/h1&gt;&#xA;&lt;p&gt;The Brocade device processes traffic that ACLs filter in hardware. The Brocade device creates an entry for each ACL in the Content Addressable Memory (CAM) at startup or when the ACL is created. The Brocade device uses these CAM entries to permit or deny packets in the hardware, without sending the packets to the CPU for processing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;And then further down on the next page:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you change the content of an ACL (add, change, or delete entries), you must remove and then reapply the ACL to all the ports that use it. Otherwise, the older version of the ACL remains in the CAM and continues to be used. You can easily re-apply ACLs using the &lt;pre&gt;ip rebind-acl num | name | all&lt;/pre&gt; command. Refer to “Applying ACLs to interfaces” on page 1018.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="762" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-05-30T22:06:07.083" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1437" PostTypeId="2" ParentId="1433" CreationDate="2013-05-30T20:04:57.793" Score="0" Body="&lt;p&gt;I don't have a lot of experience with Brocade, but I do know on the FC side that it's not uncommon (i.e. Cisco Nexus, MDS) for Fibre Channel switches to require a re-activation of the active zoneset when zoning changes are made. A &lt;code&gt;show run&lt;/code&gt; will show a new zone, for instance, but &lt;code&gt;show zoneset active&lt;/code&gt; will not until the zoneset being referenced is actually activated. It's one of the only cases I'm aware of (at least on Cisco gear) where the &lt;code&gt;show run&lt;/code&gt; output isn't actually live and running on the system yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though I wouldn't know of any technical reason for one or the other (pertaining to TCAM or switch logic) I do know that this provides for a little better handle on the changes that are being made. It &lt;em&gt;is&lt;/em&gt; an extra step but it allows you to make the changes, show the changes, but not apply them until you've reviewed and verified that they're good. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Zoning from the SAN world being a rough analogy to ACLs in the IP world.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-05-30T20:04:57.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1438" PostTypeId="1" CreationDate="2013-05-30T21:06:27.407" Score="5" ViewCount="8568" Body="&lt;p&gt;I set up a Cisco ASA 5505 8.4(3), and&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;specified &lt;code&gt;ssh version 2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;enabled ssh access to the WAN interface via &lt;code&gt;ssh &amp;lt;my network&amp;gt; &amp;lt;mask&amp;gt; &amp;lt;WAN interface&amp;gt;&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;allowed ssh from my network via an ACL&lt;/li&gt;&#xA;&lt;li&gt;my user account has privilege 15 with full access, including ssh&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I did similarly for ASDM and it worked. However, when connection via ssh, I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh: connect to host &amp;lt;name&amp;gt; port 22: Connection timed out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I checked the log via the ASDM, which confirmed that there's a connection, but ending with an error message:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;SSH session from  on interface  for user &quot;&quot;&#xA;  disconnected by SSH server, reason: &quot;Internal error&quot; (0x00)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How can it be fixed?&lt;/p&gt;&#xA;" OwnerUserId="231" LastActivityDate="2020-10-08T19:36:41.123" Title="Why do I get a timeout when I connect via ssh to a Cisco ASA, even though management and ACLs are configured?" Tags="|cisco|cisco-asa|ssh|" AnswerCount="2" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="1439" PostTypeId="2" ParentId="1438" CreationDate="2013-05-30T21:06:27.407" Score="12" Body="&lt;p&gt;Unfortunately the ASA doesn't show a good explanation in the error message. It's required to create an RSA key on the ASA, either via console or command line in the ASDM, executing the command &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/c5.html#wp2270912&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;crypto key generate rsa&lt;/code&gt;&lt;/a&gt;, for example with highest possible modulus size:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto key generate rsa modulus 2048&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in global configuration mode. The default modulus would be 1024.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the ASDM it can also be done in the configuration menu, device management, identity certificates, add, new:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/EkvsR.png&quot; alt=&quot;ASDM key generation&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the other requirements were already met, the connection should be successful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I cannot add images to comments to the question above, here a screenshot about mass bumping comment spam starting with one to this question and answer. That's a screenshot of moderator activity, no action by me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IoC0S.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IoC0S.png&quot; alt=&quot;comment spam&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="231" LastEditDate="2017-08-09T16:40:28.583" LastActivityDate="2017-08-09T16:40:28.583" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1440" PostTypeId="1" CreationDate="2013-05-30T21:36:35.967" Score="15" ViewCount="16272" Body="&lt;p&gt;What viable companies, products or options are out there today for TCP Acceleration over satellite or high latency IP networks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The average satellite RTT is upwards from 600ms (depends on the location)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP doesn't work too well as the window sizes are kept small due to the delay in receiving ACKs. An accelerator is required to spoof the ACKs to trick the device to start sending the next set of data while the original packet is still in transit.&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="343" LastEditDate="2013-05-30T21:49:31.127" LastActivityDate="2017-07-18T03:26:22.947" Title="TCP acceleration over satellite or high latency networks" Tags="|tcp|wan-optimizer|" AnswerCount="7" CommentCount="4" ClosedDate="2017-07-18T13:06:32.263" ContentLicense="CC BY-SA 3.0" />
  <row Id="1441" PostTypeId="2" ParentId="1440" CreationDate="2013-05-30T22:09:51.043" Score="3" Body="&lt;p&gt;For one year now, I have been using Riverbed Steelhead to perform traffic optimization over regular WAN connections. So far I am satisfied with the results. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Despite I have no experience with satellite links, Riverbed's website looks like they have optimization solutions for satellite links too:  &lt;a href=&quot;http://www.riverbed.com/products-solutions/solutions/satellite/&quot; rel=&quot;nofollow&quot;&gt;http://www.riverbed.com/products-solutions/solutions/satellite/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2013-05-30T22:09:51.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1442" PostTypeId="2" ParentId="1420" CreationDate="2013-05-30T22:11:11.910" Score="1" Body="&lt;p&gt;My opinion is that you leave the timers as default and use features like BFD to trigger and thus shorten re-convergence times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you give some more detail around what issue you are trying to solve modifying the &lt;em&gt;refresh&lt;/em&gt; timers?  Hello and Dead timers are what you'd tweak if you're looking for faster convergence time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco recommendation above about 250msec and 1 second above is only valid if you have point-to-point ethernet links everywhere, and can guarantee that your area will &lt;em&gt;always&lt;/em&gt; be this way.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an OSPF broadcast network, the last thing I'd want is an RSTP/MSTP/RPVST+ re-convergence (1-2 seconds) to trigger an OSPF re-calculation (750msec-1 second)&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2013-05-30T22:11:11.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1443" PostTypeId="2" ParentId="1440" CreationDate="2013-05-30T22:14:27.457" Score="6" Body="&lt;p&gt;I am by no means authoritative on this subject, however, in our environment we use Riverbeds for WAN optimization, and although we're not over satellite, we see a 68% improvement in speed for TCP communication as a minimum, and the Steelheads we have report an almost 3x bandwidth increase based on data it serves from its datastore vs. actually transferring things over the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did a look online for you as well and came up with some that looked angled in your direction, hope this helps or that others could give some real life feedback on them!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ViaSat company looked like it had government grade solutions, and comtech ef data has a pretty good testimonial from an ISP utilizing their service that may be of use to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.viasat.com/AcceleNet&quot;&gt;http://www.viasat.com/AcceleNet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.viasat.com/government-communications/network-acceleration-and-optimization&quot;&gt;http://www.viasat.com/government-communications/network-acceleration-and-optimization&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.networkinv.com/blog/faster-satellite-internet-with-filtering-optimization-packet-shaping-solutions/&quot;&gt;http://www.networkinv.com/blog/faster-satellite-internet-with-filtering-optimization-packet-shaping-solutions/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.idirect.net/Products/Hardware/Optimization-Solutions/Network-Accelerators.aspx&quot;&gt;http://www.idirect.net/Products/Hardware/Optimization-Solutions/Network-Accelerators.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.comtechefdata.com/&quot;&gt;http://www.comtechefdata.com/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.comtechefdata.com/files/articles_papers/Horizon-Satellite-Services-Testimonial.pdf&quot;&gt;http://www.comtechefdata.com/files/articles_papers/Horizon-Satellite-Services-Testimonial.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2013-05-30T22:14:27.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1444" PostTypeId="2" ParentId="1440" CreationDate="2013-05-30T22:48:27.613" Score="7" Body="&lt;p&gt;I can recommend &lt;a href=&quot;http://www.cisco.com/en/US/products/ps5680/Products_Sub_Category_Home.html&quot;&gt;Cisco WAAS&lt;/a&gt; (Wide Area Application Services), specificall &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/contnetw/ps5680/ps6474/data_sheet_c78-495801.html&quot;&gt;WAVE&lt;/a&gt; (Wide Area Virtualization Engine).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We use it for&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;TCP acceleration&lt;/li&gt;&#xA;&lt;li&gt;Compression&lt;/li&gt;&#xA;&lt;li&gt;Caching&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;over satellite connections (VSAT) for cruise ships, with latency between 600 ms and 800 ms, depending on satellite and earth station (possible additional transatlantic latency). One central manager and a policy manage a network of a dozen appliances. RDP is much more responsive thanks to TCP optimizing, furthermore web applications and file replication save much bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a virtual version &lt;a href=&quot;http://www.cisco.com/en/US/products/ps11231/index.html&quot;&gt;vWAAS&lt;/a&gt;, which we plan to install soon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know iDirect satellite modems provide a very good TCP optimization, if you would be able to use them.&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="231" LastEditDate="2013-05-30T22:53:55.233" LastActivityDate="2013-05-30T22:53:55.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1445" PostTypeId="2" ParentId="644" CreationDate="2013-05-30T23:33:31.760" Score="8" Body="&lt;p&gt;On 8.4 you can reset a single ISAKMP connection via:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clear cry ikev1 sa &amp;lt;ip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or if using ikev2, then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clear cry ikev2 sa &amp;lt;ip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On older versions, I believe the command is simply:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clear cry isa sa &amp;lt;ip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also in regard to Stefan's answer, if you do a clear on a remote device over the VPN you're resetting, typically it will re-establish the VPN and your SSH session will continue per normal instantaneously or at most within seconds. I do it quite often on ISR G1 and G2 routers all the time when modifying their tunnels.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-05-30T23:33:31.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1448" PostTypeId="1" CreationDate="2013-05-31T00:15:09.263" Score="7" ViewCount="2557" Body="&lt;p&gt;Other terms are stacked vlans, provider bridges, s-vlan&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we purchased EX series switches, could they be configured with RVIs to terminate the double tagged frame?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, will we require an MX series router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We get wholesale customers presented as double-tags.&lt;/p&gt;&#xA;" OwnerUserId="760" LastActivityDate="2016-02-01T20:16:54.840" Title="Can Juniper EX series switches terminate a q-in-q interface?" Tags="|juniper-ex|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1449" PostTypeId="1" AcceptedAnswerId="1452" CreationDate="2013-05-31T00:26:45.783" Score="10" ViewCount="5347" Body="&lt;p&gt;I need to set up a PC to listen in on a multicast (PIM-SM) data feed. The multicast sources and (anycast) Rendezvous point are behind a &quot;HSRP/VRRP address&quot; on the other side of a WAN link. (The instructions actually say &quot;HSRP/VRRP&quot;) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the received documentation, I have set up a router with a static route to the HSRP/VRRP address, and the other side has added a route to my network. Unicast traffic works fine, but I am not receiving any multicast traffic. Wireshark shows no PIM joins are sent by my router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be wrong?&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-05-31T04:13:23.250" Title="PIM-SM multicast and HSRP/VRRP" Tags="|hsrp|vrrp|multicast|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1450" PostTypeId="2" ParentId="1449" CreationDate="2013-05-31T00:26:45.783" Score="2" Body="&lt;p&gt;The problem is that the remote routers are announcing themselves with PIM Hello messages from their own IP addresses and my router registers these addresses as PIM neighbours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The gateway in the routing table however contains the HSRP virtual address. When the router wants to join the multicast group, it looks for the route to the Rendezvous Point which has the HSRP virtual address as the next hop. Because this next-hop HSRP address is not one of the known PIM neighbours, the PIM-SM RFC specifies no Join should be sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changing the static route to use an actual IP address of one of the HSRP routers makes the multicast work, but of course this makes the HSRP useless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not tested VRRP because the other side did not want to change the network. VRRP would probably not have this problem since it does not use a virtual router IP, but uses the real IP address of the master router.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-05-31T00:26:45.783" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1451" PostTypeId="2" ParentId="1449" CreationDate="2013-05-31T00:37:27.933" Score="2" Body="&lt;p&gt;Perhaps using a static mroute that points to the 'real' interface IP address, then a normal static route pointing to HSRP. then at least you get HSRP for unicast. OR point either the mroute or static route to the interface rather than an IP address.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-05-31T00:37:27.933" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1452" PostTypeId="2" ParentId="1449" CreationDate="2013-05-31T01:32:38.643" Score="7" Body="&lt;p&gt;PIM messages are not sourced from HSRP VIP's so the RPF check fails since the HSRP VIP is your RPF neighbor.  There are two ways around this though.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Set up a dynamic routing protocol between your router and the other sides routers so HSRP is not needed.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure static mroutes to the other sides actual interface IP's such as:&lt;/p&gt;&#xA;&lt;p&gt;ip mroute 0.0.0.0 0.0.0.0 1.1.1.1&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="190" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-05-31T01:32:38.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1453" PostTypeId="2" ParentId="99" CreationDate="2013-05-31T01:45:04.743" Score="1" Body="&lt;p&gt;Direct point-to-point fibre provides fast failure detection&#xA;The default debounce timer on GigE and 10GigE fibre linecards is 10 msec&#xA;The minimum debounce for copper is 300 msec&lt;/p&gt;&#xA;" OwnerUserId="1463" LastActivityDate="2013-05-31T01:45:04.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1454" PostTypeId="1" AcceptedAnswerId="1456" CreationDate="2013-05-31T03:04:14.437" Score="10" ViewCount="1778" Body="&lt;p&gt;I have very little knowledge about CISCO and its switches, but now I have to configure it myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to allot IP address based on MAC address on CISCO CE 500 (Cisco Catalyst Express 500-24TT Switch [&lt;strong&gt;WS-CE500-24TT&lt;/strong&gt;] )switches ?&lt;/p&gt;&#xA;" OwnerUserId="1464" LastEditorUserId="775" LastEditDate="2013-06-18T16:17:57.883" LastActivityDate="2013-06-18T16:17:57.883" Title="DHCP assign IP address based on MAC address with Cisco CE 500 platform?" Tags="|cisco|switch|cisco-catalyst|dhcp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1455" PostTypeId="1" AcceptedAnswerId="1460" CreationDate="2013-05-31T03:28:51.243" Score="11" ViewCount="856" Body="&lt;p&gt;This one is a difficult to describe, it's hypothetical because I'm learning about routing and right now I'm focused on BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say my ASN is &lt;code&gt;65000&lt;/code&gt;, and I announce &lt;code&gt;192.0.2.0/24&lt;/code&gt;. My peer, AS &lt;code&gt;65001&lt;/code&gt; updates its routing table with its routes to the network I am announcing, but my ISP(s) routers are not my peers. If AS &lt;code&gt;65001&lt;/code&gt; (who is receiving my route updates) is peered with my ISP(s), meaning my ISP(s) receive routes from &lt;code&gt;65001&lt;/code&gt;, does this mean that my ISP(s) will now be able to route traffic to &lt;code&gt;192.0.2.0/24&lt;/code&gt;, and I have avoided the need to peer directly with my ISP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am horribly wrong on anything, please correct me (or tell me where I can find good documentation).&lt;/p&gt;&#xA;" OwnerUserId="1465" LastEditorUserId="253" LastEditDate="2013-07-30T16:22:45.453" LastActivityDate="2013-07-30T16:22:45.453" Title="Circular BGP propagation" Tags="|routing|bgp|ipv4|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1456" PostTypeId="2" ParentId="1454" CreationDate="2013-05-31T03:58:19.963" Score="16" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to allot IP address based on MAC address on CISCO CE 500&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No you need a real Cisco IOS switch for &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/ip/configuration/guide/1cfdhcp.html#wp1001108&quot;&gt;DHCP server functionality with Maunal Bindings&lt;/a&gt;; the Catalyst Express series switches do not run IOS&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-05-31T03:58:19.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1457" PostTypeId="2" ParentId="1455" CreationDate="2013-05-31T03:58:49.210" Score="6" Body="&lt;p&gt;If AS 6501 is willing be a transit AS then they would be able to route to your /8' however it may also depend on whether you obtained your /8 from the said ISP or not.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of good literature then would always highly recommend 'Routing TCP/IP Vol2' by Jeff Doyle &amp;amp; 'Internet Routing Architectures' by Sam Halabi.&lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2013-05-31T03:58:49.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1458" PostTypeId="2" ParentId="1454" CreationDate="2013-05-31T04:01:07.080" Score="7" Body="&lt;p&gt;If all you want to do is permanently assign IPs to certain MAC addresses, this is simple. It's called a &lt;strong&gt;permanent DHCP lease&lt;/strong&gt;. You need do this on the network's DHCP server. While the Cisco Catalyst Express 500 series switches can serve up DHCP, I don't know about advanced DHCP options; and if this is any kind of real network you wouldn't want a switch as your DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the &lt;a href=&quot;http://www.cisco.com/en/US/products/ps6545/products_configuration_example09186a00806da6c9.shtml&quot;&gt;official documentation on configuring CE 500s here&lt;/a&gt;. If the switch doesn't support permanent DHCP leases, then you can always assign the computer's addresses statically from its internal network configuration (&lt;code&gt;/etc/network/interfaces&lt;/code&gt; on Debian based Linux distros). Hopefully that documentation helps you get to where you're going.&lt;/p&gt;&#xA;" OwnerUserId="1465" LastActivityDate="2013-05-31T04:01:07.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1459" PostTypeId="2" ParentId="1454" CreationDate="2013-05-31T04:02:37.150" Score="5" Body="&lt;p&gt;I know this isn't specifically on topic - however I believe its worth mentioning that IPv6 actually has the ability to assign an IP address based on the MAC address by using eui-64 notation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This also does not require a DHCPv6 server as it is stateless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please see the following links for more information (1st 2 google results, how original)&#xA;&lt;a href=&quot;http://packetlife.net/blog/2008/aug/4/eui-64-ipv6/&quot; rel=&quot;nofollow&quot;&gt;http://packetlife.net/blog/2008/aug/4/eui-64-ipv6/&lt;/a&gt;&#xA;&lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-24485&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/docs/DOC-24485&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="343" LastEditDate="2013-06-01T02:41:24.027" LastActivityDate="2013-06-01T02:41:24.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1460" PostTypeId="2" ParentId="1455" CreationDate="2013-05-31T04:04:53.427" Score="16" Body="&lt;p&gt;You're kind of thinking about it the wrong way, but I'll try to explain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you purchase bandwidth from an ISP, this is called &lt;strong&gt;transit&lt;/strong&gt; (colloquially in the industry). Assuming you've got yourself some PI space (1.0.0.0/8, for example), you're paying your ISP to get your bits from your network to other networks. So say your AS is 6500, and your ISP is 3356. Bits from any other ASN will also need to &lt;strong&gt;transit&lt;/strong&gt; AS3356 to get to you. Let's say that there's another ASN (6501) that buys transit from a different ASN (7224). AS3356 and AS7224 are peers. Now, in order for bits to get from AS6501 to AS6500, the path goes like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AS6501 -&amp;gt; AS7224 -&amp;gt; AS3356 -&amp;gt; AS6500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if you set up &lt;strong&gt;peering&lt;/strong&gt; (also a colloquial industry term**) with AS6501, this eliminates the need to get bits from you to AS6501 via transit and vice versa, thus reducing your cost, AS6501's operator's cost, and also usually results in reduced loss/latency between your networks. Everybody wins! Now the path looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AS6501 -&amp;gt; AS6500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your original scenario wouldn't work in the real world, because the assumption for AS6501 would be for it to incur a cost to get your bits across it to you from the ISP(s). AS6501 wouldn't be getting benefit by hauling your bits across it to your ISP so you don't have to pay your ISP. What's more likely is AS6501 would charge you to do this, at which point, you might as well just pay your ISP(s) anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;** The term &lt;strong&gt;peering&lt;/strong&gt; is overloaded. It can be both used to describe a BGP session (e or i variety), as well as the colloquial/political sense, which means you and another network connect to one another and directly exchange traffic (via BGP) for mutual benefit - think &lt;strong&gt;&lt;em&gt;opposite of transit&lt;/em&gt;&lt;/strong&gt;. If you're running BGP with your ISP (transit), you're still technically &lt;strong&gt;peering&lt;/strong&gt; with your ISP, because it's an &lt;strong&gt;eBGP peering&lt;/strong&gt;. To help avoid confusion, it's better to use &lt;strong&gt;peering&lt;/strong&gt; to refer to the act of exchanging traffic with another network &lt;strong&gt;at no cost&lt;/strong&gt; (note that this isn't always the case) and &lt;strong&gt;BGP session&lt;/strong&gt; to refer to the actual technical term for exchanging prefixes via BGP (iBGP or eBGP) with another router, whether a cost is involved or not.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-31T06:17:43.943" LastActivityDate="2013-05-31T06:17:43.943" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1461" PostTypeId="2" ParentId="1449" CreationDate="2013-05-31T04:13:23.250" Score="2" Body="&lt;p&gt;Assuming you're in a Cisco environment....have you enabled&#xA;&lt;code&gt;ip pim sparse-mode&lt;/code&gt;&#xA;on all the interfaces between that device and the RP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also don't forget to have &lt;code&gt;ip pim autorp listener&lt;/code&gt; so it finds the RP automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also - if you have redundant links between you and the RP...PIM routing (or branches) do not follow the same path as the regular routing table. They WILL check for the RPF (reverse path forwarding) to make sure the source of the multicast stream is coming from the right direction. But it is possible to have the standby HSRP link be the DR (designated router) on the PIM side of the house.&#xA;You can change this behaviour by setting the DR priority.&#xA;&lt;code&gt;ip pim dr-priority x&lt;/code&gt; the higher the X the higher in value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also check to see whether the router see's the multicast joins by issuing&#xA;&lt;code&gt;show ip mroute&lt;/code&gt; it should also list the RP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show ip pim neigh&lt;/code&gt; will also tell you if it see's the upstream multicast neighbour&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe VRRP follows the same concept however I am not 100% sure since I infrequently use multi-vendor default gateways.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-05-31T04:13:23.250" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1462" PostTypeId="2" ParentId="99" CreationDate="2013-05-31T04:49:04.907" Score="3" Body="&lt;p&gt;No one seems to have mentioned that with Fibre - you have the future option for DWDM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I guess if you're debating between fibre &amp;amp; copper on a run - DWDM would probably be your last thought as if you really needed additional bandwidth you'd just run another cable (since the run would be short enough)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But over LONG runs &amp;amp; links - DWDM allows you to future-proof your fibre investment if you have the correct hardware.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-05-31T04:49:04.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1463" PostTypeId="2" ParentId="480" CreationDate="2013-05-31T04:57:48.707" Score="7" Body="&lt;p&gt;To factory reset the ASR, I found the way &lt;a href=&quot;https://supportforums.cisco.com/thread/2074051&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;&lt;br&gt;&#xA;We only need to apply this command &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;commit replace best-effort&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As we don't have any configuration file target, actual configuration will be substitute with an empty file&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios_xr_sw/iosxr_r3.5/system_management/command/reference/yr35conf.html#wp1463440&quot; rel=&quot;noreferrer&quot;&gt;Documentation&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="206" LastActivityDate="2013-05-31T04:57:48.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1464" PostTypeId="2" ParentId="1455" CreationDate="2013-05-31T06:53:17.897" Score="5" Body="&lt;p&gt;I would just like to add, any Good Actors filter the &lt;em&gt;unholy crap&lt;/em&gt; out of what they announce to, and accept from peers.  AS6500 would announce only routes to prefixes they own (or that of their customers, who may themselves be an AS.) AS6501 would only allow routes with an origin of 6500 (i.e. &lt;code&gt;^6500$&lt;/code&gt;) and v.v., and most likely filter on the prefixes themselves &lt;em&gt;as well&lt;/em&gt;.  A &lt;strong&gt;great deal&lt;/strong&gt; of damage can be done by bad actors using ISPs that don't validate what their customers are sending them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all gets very complicated rather quickly.  There are various routing registries (IRR's) to help automate the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Note: I've been the &quot;bgp guy&quot; before.  And I've been on the receiving end of someone appropriating our address space -- it was in the 90's so it might've been an actual typo on their part.  Today, it happens on purpose.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="762" LastEditDate="2013-05-31T07:13:48.273" LastActivityDate="2013-05-31T07:13:48.273" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1465" PostTypeId="2" ParentId="1448" CreationDate="2013-05-31T07:05:35.080" Score="7" Body="&lt;p&gt;Unfortunately EX switches cannot terminate double-tagged vlans. You would need a bigger box like the MX or M series with IQ/IQ2 module if sticking with Juniper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best you could do with the EX is strip off the outer-tag and push those inner frames to another EX. &lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-31T07:05:35.080" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1466" PostTypeId="2" ParentId="1448" CreationDate="2013-05-31T07:06:48.100" Score="0" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos/topics/reference/general/ex-series-l3-protocols-not-supported.html&quot; rel=&quot;nofollow&quot;&gt;this document&lt;/a&gt; RVI's aren't supported on EX switches. Is your goal to transport the wholesale customers' stacked VLANs across your network? If so, I'm not sure that using RVI's would be what you'd want to do, since transport is usually the inherent goal in PB, rather than doing Layer3 termination for an S-TAG. You're probably going to want to go with PBB or MPLS/VPLS in order to transport the customer's S-TAG's - the latter two options would still need an MX (I'll defer to the more Juniper-proficient for other options - I believe mellowd has also recommended the M series). Again this is assuming that your goal is transporting your customers' QinQ traffic.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-05-31T07:24:24.073" LastActivityDate="2013-05-31T07:24:24.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1467" PostTypeId="1" AcceptedAnswerId="1469" CreationDate="2013-05-31T08:53:09.813" Score="29" ViewCount="56935" Body="&lt;p&gt;If the CRC counter of an interface is high, normally it's a bad sign, but why?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the count is high, what does this mean technically? &lt;/li&gt;&#xA;&lt;li&gt;What can cause this counter to go up? &lt;/li&gt;&#xA;&lt;li&gt;On which layer in the OSI model will this counter react?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="623" LastActivityDate="2016-04-06T08:41:31.433" Title="What is the meaning of the CRC counter on a cisco device?" Tags="|cisco|troubleshooting|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1468" PostTypeId="2" ParentId="1190" CreationDate="2013-05-31T08:58:47.287" Score="9" Body="&lt;p&gt;To add VLANs to a trunk you have to use the following syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk allowed vlan add 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To remove a VLAN from the trunk you need to use the &lt;code&gt;remove&lt;/code&gt; syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk allowed vlan remove 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you don't use add/remove you're telling the port to &lt;strong&gt;only&lt;/strong&gt; configure the new VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a common error. If your platform supports it you can use the &lt;a href=&quot;http://www.cisco.com/en/US/products/ps6815/products_ios_protocol_group_home.html&quot;&gt;Cisco Embedded Event Manager&lt;/a&gt; to forbid this harmful syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;event manager applet forbid-vlan-trunk&#xA; event cli pattern &quot;switchport trunk allowed vlan\s+[0-9]&quot; skip yes sync no&#xA; action 1.0 syslog msg &quot;switchport trunk allowed vlan MUST be configured via add/remove&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-05-31T08:58:47.287" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1469" PostTypeId="2" ParentId="1467" CreationDate="2013-05-31T09:02:42.660" Score="36" Body="&lt;p&gt;The counter is increasing because your frames are being corrupted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Cyclic_redundancy_check&quot;&gt;CRC&lt;/a&gt; is a polynomial function on the frame which returns a 4B number in Ethernet. It will catch &lt;em&gt;all&lt;/em&gt; single bit errors and a good percentage of double bit errors. It is thus meant to ensure that the frame was not corrupted in transit. If your CRC error counter is increasing it means that when your hardware ran the polynomial function on the frame, the result was a 4B number which differed from the 4B number found on the frame itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet frame CRC (FCS) is usually understood to be on OSI layer 2, many people claim it is layer 1 on Ethernet, but that is incorrect (only preamble, SFD and IFG are layer 1 on Ethernet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend a book called &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B004VF6216&quot;&gt;Computer Networks - A systems approach&lt;/a&gt; on this and many other subjects. It discusses CRC in-depth around page 92 through 102.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Daniel pointed out, frames can get corrupted due to several reasons such as: duplex mismatch, faulty cabling and broken hardware. However, some level of CRC errors should be expected and the standard allows up-to 10&lt;sup&gt;-12&lt;/sup&gt; bit-error-rate on Ethernet (1 bit out of 10&lt;sup&gt;12&lt;/sup&gt; can flip) and it's acceptable according to the standard. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In copper the signal travels by transferring state between electrons (electrons themselves are not traveling very much) and in fiber the signal travels by the photons reflecting off the walls of the fiber. There is a non-zero chance that the photon will simply change due to heat on the walls or the state of the electrons will flip itself.  So even in perfect situations some errors will always happen.  It should be known that a bit is not a single photon or single state change of an electron; today you need many photons or electron state changes to express a single bit, so a single incorrect 'state' will not yield an error as a bit is the average state of many of these.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="266" LastEditDate="2013-05-31T17:06:14.793" LastActivityDate="2013-05-31T17:06:14.793" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1470" PostTypeId="1" AcceptedAnswerId="1485" CreationDate="2013-05-31T12:18:06.913" Score="12" ViewCount="21218" Body="&lt;p&gt;I see that Cisco now has a 60 watt POE option. What was the limitation that caused POE to have to be developed in stages of 15, 30, and then 60 watts? Why could they not just do 60 watts from the inception of POE?&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2014-03-28T21:23:11.183" Title="POE, POE+, UPOE" Tags="|cisco|power-over-ethernet|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1471" PostTypeId="2" ParentId="1448" CreationDate="2013-05-31T12:19:33.130" Score="1" Body="&lt;p&gt;If you want to stay in the Juniper realm their MX series are the official answer for this, and the lower end versions of the MX80 are similar in cost to Cisco's metro switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They used to offer &quot;switch&quot; (-X) versions of the MX cards that had a lower route count and were significantly cheaper, not sure if they still sell them though.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-05-31T12:19:33.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1472" PostTypeId="1" AcceptedAnswerId="1476" CreationDate="2013-05-31T12:26:08.017" Score="18" ViewCount="6807" Body="&lt;p&gt;Is it possible to write an arbitrary line of text to the log of a Cisco IOS 12.x device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should like to be able to put in markers when fetching configs via TFTP and I would like to be able to have log lines á la&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; May 30 14:14:00.000: %CONFIG-REMARK: Halfway through the script! Now on to SomethingThatMightFail!&#xA; May 30 14:14:05.000: %CONFIG-REMARK: SomethingThatMightFail didn't fail! Woo! Continuing!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="399" LastActivityDate="2021-11-16T13:53:34.510" Title="Writing text to the log" Tags="|cisco|cisco-ios-12|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1473" PostTypeId="2" ParentId="1472" CreationDate="2013-05-31T13:15:04.590" Score="2" Body="&lt;p&gt;Assuming you're using TCL EEM you can use &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_eem_policy_tcl.html#wp1208703&quot; rel=&quot;nofollow&quot;&gt;action_syslog&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-05-31T13:15:04.590" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1474" PostTypeId="2" ParentId="1470" CreationDate="2013-05-31T13:42:01.563" Score="4" Body="&lt;p&gt;There's a good overview of UPoE in this video:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://vimeo.com/52203711&quot; rel=&quot;nofollow&quot;&gt;https://vimeo.com/52203711&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I remember of the conversation, the quality of the UTP cable makes a huge difference in the capability of power transmission.  Now that we have Cat6 (or better) it is capable of carrying higher wattages of power to the 100m max distance.&lt;/p&gt;&#xA;" OwnerUserId="71" LastActivityDate="2013-05-31T13:42:01.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1476" PostTypeId="2" ParentId="1472" CreationDate="2013-05-31T14:30:01.113" Score="22" Body="&lt;p&gt;You can use the &lt;code&gt;send log&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#send log Halfway through the script!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;gives my on a Catalyst 3750 with IOS 12.2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;May 31 16:36:18: %SYS-2-LOGMSG: Message from 1(name): Halfway through the script!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and with IOS 15.0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;May 31 16:38:08: %SYS-7-USERLOG_DEBUG: Message from tty1(user id: name): Halfway through the script!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="231" LastEditorUserId="231" LastEditDate="2013-05-31T14:39:12.647" LastActivityDate="2013-05-31T14:39:12.647" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1479" PostTypeId="1" CreationDate="2013-05-31T16:31:49.420" Score="8" ViewCount="536" Body="&lt;p&gt;Have a background in computer software, but do not have any formal training in networking and hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We got a quote from a local IT company that is more than we are able to pay.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;They want $900 each for two of these: &lt;a href=&quot;http://www.infinity-micro.com/cisco-aironet-2602i-ieee-802-11n-450-mbps-wireless-access-point-4334.html&quot;&gt;Aironet 2600&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Then another $1000 for installation&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The total would be $2,915&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are about 30 people who normally work in the office, plus more people come in for conferences sometimes and need wifi. The advantage of these enterprise access points is that they are supposed to work together in such a way that people can move around the office and their connection will seamlessly jump from one to the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Was wondering if it would be feasible for us to order the equipment ourselves and then for me to come in and install it?&lt;/p&gt;&#xA;" OwnerUserId="1472" LastActivityDate="2013-06-02T03:07:23.617" Title="Is it feasible to install two enterprise WIFI access points without training?" Tags="|ieee-802.11|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1480" PostTypeId="2" ParentId="1479" CreationDate="2013-05-31T16:44:40.763" Score="8" Body="&lt;p&gt;Yes, it is feasible to install them yourself. I would not consider it reasonable to pay someone else $1000 to install two wireless access points. There is a learning curve but with a little time and effort you can learn enough to install these yourself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a read:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/access_point/2600/quick/guide/ap2600getstart.html&quot; rel=&quot;nofollow&quot;&gt;Aironet 2600 Getting Started Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/technology/apdeploy/2600_2600_3600_DG.pdf&quot; rel=&quot;nofollow&quot;&gt;Aironet 2600 Deployment Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a0080c0b93c.shtml&quot; rel=&quot;nofollow&quot;&gt;Configuration Example&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="267" LastEditorUserId="49" LastEditDate="2013-05-31T20:44:55.653" LastActivityDate="2013-05-31T20:44:55.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1481" PostTypeId="2" ParentId="1479" CreationDate="2013-05-31T17:15:20.817" Score="5" Body="&lt;p&gt;It is feasible to install your own access points.  Keep in mind that installing/configuring most enterprise wireless solutions is not as easy as installing a consumer device at home.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consumer devices are meant to be installed by people with very little knowledge, whereas enterprise gear is meant to be installed by someone knowledgeable, and the options/configuration can be a bit overwhelming.  If you do make mistakes, it can be more costly to bring someone in to fix it after the fact (I know, as I am often one of those people - and I don't know everything about wireless).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you don't detail what is involved in the $1k installation.  If this includes cabling, configuration, and a site survey to validate deployment, then take it and run as $1k can be very inexpensive (and you have someone to blame if there are troubles).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might consider other options as well, especially since it doesn't sound like you have a network/wireless person on staff.  For instance, I think Meraki (recently purchased by Cisco) could be a good fit as it provides a relatively simple wireless deployment which is also designed to be easy to administer, although it has it's drawbacks as well.  You could also look into Aruba, Aerohive, Ruckus, and Ubiquiti Networks...each has various strengths and weaknesses.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-31T17:20:43.590" LastActivityDate="2013-05-31T17:20:43.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1482" PostTypeId="2" ParentId="1479" CreationDate="2013-05-31T17:15:39.643" Score="7" Body="&lt;p&gt;&lt;strong&gt;Is it feasible?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is it a good idea?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR: No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That depends on the exact details of the installation (configuring the devices, physically installing, power, cabling, etc) and the unique wireless aspects (transmission, interference, coverage, etc) of the installation. You should be able to figure out everything as you go along. On the other hand, if you run into something tricky, you'll be looking at significant time to figure it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of cost, they should be able to do the installation in fewer hours than you. (Simply because you have to figure it out and then do it.) So unless your hourly &quot;value&quot; is much lower, their $1,000 will actually cost your company less. That may not be an issue if your company considers this something that is part of your job -- but then, as you say, you're not qualified (in the traditional, &quot;experienced in it&quot; meaning,) to do this work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the real question is to balance the hard cost against the risk/gain. A $1,000 cost in support of 30-or-so people is trivial. Unless there's a reason (in your company's opinion) for you to learn the material, I don't see any direct benefit to your doing the work.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-05-31T17:15:39.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1483" PostTypeId="1" AcceptedAnswerId="1531" CreationDate="2013-05-31T17:23:49.203" Score="4" ViewCount="2945" Body="&lt;p&gt;Is there a Cisco command that would allow one to modify the default value of 1800 seconds (30 min) for the OSPF LSA refresh rate?&lt;/p&gt;&#xA;" OwnerUserId="1453" LastActivityDate="2013-06-03T22:13:17.170" Title="OSPF LSA Refresh Time" Tags="|cisco|ospf|router|cisco-commands|performance|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1484" PostTypeId="2" ParentId="1483" CreationDate="2013-05-31T17:42:04.417" Score="1" Body="&lt;pre&gt;&lt;code&gt;timers lsa-group-pacing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/iproute/command/reference/1rfospf.html#wp1020235&quot; rel=&quot;nofollow&quot;&gt;OSPF commands&lt;/a&gt;, (IOS 12 is linked)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm suspicious that the default (in that doc) is 240 though, maybe this isn't the right knob... :/&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Doesn't seem you can change individually, from the &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/ip/configuration/guide/1cfbook.pdf&quot; rel=&quot;nofollow&quot;&gt;CF Guide&lt;/a&gt;...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This problem is solved by configuring each LSA to have its own timer.&#xA;  To again use the example of refreshing, each LSA gets refreshed when&#xA;  it is 30 minutes old, independent of other LSAs. So the CPU is used&#xA;  only when necessary. However, LSAs being refreshed at frequent, random&#xA;  intervals would require many packets for the few refreshed LSAs the&#xA;  router must send out, which would be inefficient use of bandwidth.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Therefore, the router delays the LSA refresh function for an interval&#xA;  of time instead of performing it when the individual timers are&#xA;  reached. The accumulated LSAs constitute a group, which is then&#xA;  refreshed and sent out in one packet or more. Thus, the refresh&#xA;  packets are paced, as are the checksumming and aging. The pacing&#xA;  interval is configurable; it defaults to 4 minutes, which is&#xA;  randomized to further avoid synchronization.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2013-05-31T17:57:11.553" LastActivityDate="2013-05-31T17:57:11.553" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1485" PostTypeId="2" ParentId="1470" CreationDate="2013-05-31T18:05:50.203" Score="12" Body="&lt;p&gt;Like many standards, the initial standard is never sufficient to the developing technology.  Once people have the &quot;ability&quot; to do something, they will often find new (and previously unexpected) ways of using that ability.  802.11 wireless is a prime example as no one originally expected it to develop into a &quot;wired replacement&quot; that we are heading towards today in many cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.3af was largely implemented to power VoIP phones and early access points.  The list of devices that started using it grew quickly, and as it grew and the technology changed,  it was found that 802.3af didn't deliver enough power for everything people wanted.  For instance, it could power a video camera, but maybe not a PTZ video camera.  Or it could power that single radio access point, but not a 802.11n (more complex and power hungry) dual radio access point.  Basic VoIP phones were fine, but high definition screen with video capability VoIP phones didn't have the power needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It was also found to be somewhat inefficient in it's power delivery.  Short of vendor proprietary extensions, a PoE port always delivered 15.4W of power to the device, even if the device didn't need that much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, another standard was developed to meet these needs, 802.3at.  This provides up to 30W of power and allows devices to negotiate their power needs.  If you only need 3W of power, it can do so and doesn't need to deliver 30W.  Interoperation with 802.3af devices is accomplished by delivering 15.4W to any device that doesn't negotiate for more or less.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco came up with the 60W for exactly the reason I gave to start out (they were also one of the first to deliver inline power, and higher than 15.4W of power through proprietary protocols).  If the &quot;ability&quot; is there,  then people will come up with ways to use it.  Their thought process is &quot;why limit what we can do within the power budget?  Let's just provide more power.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is both good and bad.  Good because we will see new abilities by PoE devices or entirely new PoE devices that were not previously realized.  Bad because there are other concerns to keep in mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, most people don't consider heat in their cable plant when thinking about PoE (for instance look &lt;a href=&quot;http://www.siemon.com/us/white_papers/08-06-09-poe-and-operating-efficiency.asp&quot;&gt;here&lt;/a&gt; or &lt;a href=&quot;http://ict.root-technologies.net/up/root_147582941_2009-3-16.pdf&quot;&gt;here&lt;/a&gt; for examples).  The more power you run through a cable, the more heat that it generates and needs to be dissipated.  This may reduce how far you can run cables depending on the category of your cables.  Others have raised concerns because data cabling is often &quot;bundled&quot; with up to hundreds of data cables being tightly bound together and this can result in higher temperatures in the center of the bundles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco claims that UPoE is better than 802.3at at heat dissipation, but I have yet to find a non-Cisco document (or non-Cisco sponsored) that bears this out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another concern is that the more power you need to deliver to end devices through PoE, the more power the switch needs to draw.  How big would the power supplies on a Cisco 4500 have to be to provide up to 60W on its potential 384 UPoE ports (in addition to the power needs of the switch itself)?  UPSes to provide reliable power to these pieces of network equipment would then have to be upsized as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it shapes up that the industry find use for 60W, then the IEEE will draft another ammendment/standard.  &lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-31T18:05:50.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1486" PostTypeId="2" ParentId="1440" CreationDate="2013-05-31T18:54:04.347" Score="4" Body="&lt;p&gt;I would also recommend Cisco WAAS. It does perform well. My company did a decision paper and evaluated a few products. The WAAS came out on top. It was better able to handle variable speeds associated with different weather conditions. Form factor can be a problem also. WAAS can be accomplished using WAAS Express, modules, or full appliance. If power and space are a consideration like in an aircraft or other mobile plateform then not needing a full appliance can be very helpful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also many accelerators require that you enter an expected bandwidth. If your link varies too much (as can happen with satellite links) then you will get poor performance from the accelerator. The WAAS has no such requirement and will use all available bandwidth. &lt;/p&gt;&#xA;" OwnerUserId="446" LastEditorUserId="446" LastEditDate="2013-06-03T15:43:12.400" LastActivityDate="2013-06-03T15:43:12.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1487" PostTypeId="1" CreationDate="2013-05-31T20:56:45.903" Score="5" ViewCount="322" Body="&lt;p&gt;I would like to know best practices for failing over onto a secondary MPLS or Internet circuit. I understand the concepts behind BGP and influencing in and outbound routes, however what I am looking for are ways to &quot;track&quot; a circuit failure so that I truly know it is down, before I failover. Or is it best to leave the primary down until it can be verified of its health? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today I could have a &quot;switching/bounding&quot; effect, if the primary circuit is flapping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this topic is very broad and covers a number of situations, but what are most companies doing? &lt;/p&gt;&#xA;" OwnerUserId="1477" LastEditorUserId="762" LastEditDate="2013-05-31T21:49:13.433" LastActivityDate="2013-05-31T21:49:13.433" Title="Dual Circuit Health" Tags="|redundancy|failover|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1488" PostTypeId="2" ParentId="1487" CreationDate="2013-05-31T21:05:19.483" Score="3" Body="&lt;p&gt;Generally you'll want to be using BFD to ensure your forwarding plane is working. If not, you can run IP SLA, to at least two external IPs and fail over if you can't get to both&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-05-31T21:05:19.483" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1489" PostTypeId="2" ParentId="1487" CreationDate="2013-05-31T21:05:45.013" Score="2" Body="&lt;p&gt;If you are strictly talking about circuit failover, on Cisco devices you can use ip sla to track an object and modify your routing table based on the availability of said object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other vendors have their own capabilities - Palo Alto has object tracking built in to their policy based routing engine. Those are the vendors I'm most familiar with, I'd be surprised if you couldn't do similar things with Juniper and others.&lt;/p&gt;&#xA;" OwnerUserId="1286" LastActivityDate="2013-05-31T21:05:45.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1490" PostTypeId="2" ParentId="1487" CreationDate="2013-05-31T21:18:12.367" Score="3" Body="&lt;p&gt;I'm not sure what you're doing, if you're manually 'failing over'. It should happen automatically either when you experience change in linkstate or BFD/IGP/BGP liveness timers expire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To avoid routing protocol instability caused by rapid flapping you can use 'dampening' in IOS config or 'hold-time' in JunOS config, both will allow you to create artificial delay on interface going 'up', so rapidly flapping interface would not be seen up at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IOS config is much better, as it's exponential back-off (the more you flap, the longer you delay), JunOS config is static delay. &lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-05-31T21:18:12.367" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1491" PostTypeId="1" AcceptedAnswerId="1492" CreationDate="2013-05-31T22:43:18.377" Score="9" ViewCount="2437" Body="&lt;p&gt;Is there a way to derive the IP of a device from their MAC address on a Cisco device?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume you are not on a local segment where ping sweeping / arp are possible, instead you are remote and there are many routers between you and the endpoint.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally the arp table on the Cisco device in question does not already include this MAC address.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2013-05-31T22:53:10.950" LastActivityDate="2013-05-31T23:51:53.397" Title="Finding the IP of a MAC Address" Tags="|ipv4|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1492" PostTypeId="2" ParentId="1491" CreationDate="2013-05-31T22:46:14.760" Score="7" Body="&lt;p&gt;There are a couple of options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are doing DHCP snooping, you should be able to find the IP address in the binding database with the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip dhcp snooping binding 00:00:00:00:00:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you don't have DHCP snooping, the Cisco device is on the same subnet (or supports multip SVIs so you can add an interface on the subnet), you are on a newer IOS (12.2ish or better) with access to TCL, and the device will respond to a ping, then you can use a TCL script.  You can find many examples on the internet, one of which can &lt;a href=&quot;http://www.ciscozine.com/2008/12/13/ios-scripting-with-tcl/&quot;&gt;be found here&lt;/a&gt;.  Once it is able to ping the device (on the same subnet), it should be in the ARP table of the Cisco device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, it would be quicker/easier to check on the L3 device for the ARP entry or the DHCP server then the second option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Old answer (prior to question change):&lt;/strong&gt;&#xA;Strictly answering your question, no there is no way to derive an IP address of a device from the MAC address table entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MAC address table is strictly speaking a L2 set of information, tying devices to an interface.  At L2, there is no awareness of an IP address (as the L3 and above information is irrelevant to L2 and could just as easily be another protocol).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would need access to the L3 device for the remote network segment where you could look up the entry in the ARP table.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-05-31T23:26:12.660" LastActivityDate="2013-05-31T23:26:12.660" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1493" PostTypeId="1" AcceptedAnswerId="1495" CreationDate="2013-05-31T23:03:05.067" Score="9" ViewCount="2380" Body="&lt;p&gt;I know Brocade will gladly accept CDP from Cisco devices and display it in a &lt;code&gt;show fdp neighbor&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you enable CDP on a Brocade chassis will it send CDP packets out as well as FDP?&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-06-01T05:28:09.870" Title="Brocade chassis and CDP" Tags="|brocade|cdp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1494" PostTypeId="1" AcceptedAnswerId="1496" CreationDate="2013-05-31T23:05:10.700" Score="9" ViewCount="761" Body="&lt;p&gt;We have a ME3400 that we want to enable CDP on but there is no cdp option. Why is it not available?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config)#int gi0/1&#xA;switch(config-if)#cdp ?&#xA;% Unrecognized command&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;CDP is enabled globally.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#show cdp&#xA;Global CDP information:&#xA;        Sending CDP packets every 60 seconds&#xA;        Sending a holdtime value of 180 seconds&#xA;        Sending CDPv2 advertisements is enabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the running config of that interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; switchport trunk allowed vlan 101-108,110,112-115,119,170,192,211,254-262,268&#xA; switchport trunk allowed vlan add 269,271,508-512,701,888&#xA; switchport mode trunk&#xA; load-interval 30&#xA; udld port&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-06-01T01:30:35.633" Title="CDP not available to be enabled on ME3400 port" Tags="|cisco|switch|cdp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1495" PostTypeId="2" ParentId="1493" CreationDate="2013-05-31T23:13:06.443" Score="10" Body="&lt;p&gt;As far as I know, you can only tell Brocade to intercept (i.e. be able to understand) CDP or not (i.e. forward them along).  If you have CDP off, then they will be forwarded on and won't show up in a &lt;em&gt;show fdp neighbor&lt;/em&gt; output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are mixing vendors, I would recommend that you look at having them all run LLDP if possible.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-05-31T23:13:06.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1496" PostTypeId="2" ParentId="1494" CreationDate="2013-05-31T23:14:17.807" Score="11" Body="&lt;p&gt;CDP is not allowed on ports running in UNI mode. If you use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show port-type&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should see which mode the port is running in. You need to use ENI or NNI to support CDP on the interface.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-05-31T23:14:17.807" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1498" PostTypeId="2" ParentId="1491" CreationDate="2013-05-31T23:51:53.397" Score="3" Body="&lt;p&gt;TL;DR -- You'll have to find the MAC in &lt;em&gt;someone's&lt;/em&gt; ARP table -- eg. the gateway router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As YLearn originally said, you're looking for a L3 address given only a L2 address.  You'll have to find something within an appropriate L3 domain to find it.  If the switch doesn't have a L3 interface in the same network, then it's arp table won't show anything.  If the device isn't using DHCP (and/or dhcp snooping isn't running on the switch), it won't show up in the snooping table.  I would presume there's a router somewhere that's the gateway for the target device; it's arp table should show the ip-mac link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Worst case, the mac would pin the device down to the port. You'll have to watch the traffic on that port to find any IP address(es).&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-05-31T23:51:53.397" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1499" PostTypeId="2" ParentId="1190" CreationDate="2013-06-01T00:05:54.773" Score="0" Body="&lt;p&gt;Short answer: There are two modes for specifying vlans:  one explicitly sets (overwrites) the list [this is the one you used], the other adds or removes the specified vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Every vendor does this differently, so tread lightly.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-01T00:05:54.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1502" PostTypeId="2" ParentId="1494" CreationDate="2013-06-01T01:30:35.633" Score="6" Body="&lt;p&gt;I remember dealing with this exact same issue a long while ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why by default the ME3400 or any of the ME series don't have CDP enabled is due to the fact they're supposed to be deployed at the PE/CE. A service provider would not want to leak its CDP information to the customer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;interface GigabitEthernet0/3&#xA; port-type nni&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the interface - the default port-type is UNI (which is most of the interfaces)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look here for further description and information&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/metro/me3400/software/release/12.2_25_seg_seg1/configuration/guide/swint.html#wp1026705&quot;&gt;http://www.cisco.com/en/US/docs/switches/metro/me3400/software/release/12.2_25_seg_seg1/configuration/guide/swint.html#wp1026705&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-01T01:30:35.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1504" PostTypeId="2" ParentId="1493" CreationDate="2013-06-01T05:28:09.870" Score="10" Body="&lt;p&gt;Unfortunately, Brocade gear will not send out CDP packets for Cisco gear to understand. Brocade gear only transmits FDP, but it will be able to understand (most of) the information in CDP packets if configured to intercept them. Enabling CDP on a chassis only configures the device to intercept CDP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your best bet (if all equipment is under your control) is to configure LLDP between all devices in a mixed-vendor environment.&lt;/p&gt;&#xA;" OwnerUserId="89" LastActivityDate="2013-06-01T05:28:09.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1505" PostTypeId="1" AcceptedAnswerId="1506" CreationDate="2013-06-01T05:40:27.673" Score="12" ViewCount="2071" Body="&lt;p&gt;This is another one of those hypothetical questions. I've been trying to figure out whether or not having a faster 'segment' of a network in between host A and host B will translate into a faster flow rate or lower latency between them. Let me show you the physical links in the network between computer A and computer B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;host A (1000Base-T NIC) -&amp;gt; copper 1000Base-T link -&amp;gt; 1G copper switch -&amp;gt; &#xA;[SFP module] -&amp;gt; a short 10G/40G/100G fibre run -&amp;gt; [SFP module] -&amp;gt;&#xA;1G copper switch -&amp;gt; copper 1000Base-T link -&amp;gt; host B (1000Base-T NIC)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In short, there is a 1G link from host A to the first switch, which has an SFP module in it connected to a short 10G/40G/100G (doesn't really matter, just faster than 1G) fibre run, which connects to another SFP module in another 1G copper switch, which is connected via 1G copper to host B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does traffic flow faster between the two hosts because of the fibre run in the middle? Or would the flow rate and latency be the same if the section between the two switches was the same speed as the rest of the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would make sense for latency to be lower between host A and host B, but the ingress and egress rate of the NICs would limit the flow rate, correct? If this is so, does it make sense to connect 'core' switches and routers together with faster links?&lt;/p&gt;&#xA;" OwnerUserId="1465" LastActivityDate="2016-05-19T13:24:14.973" Title="Do faster segments of a network mean faster flow rate or lower latency?" Tags="|ethernet|switch|fiber|latency|speed|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1506" PostTypeId="2" ParentId="1505" CreationDate="2013-06-01T05:49:03.707" Score="13" Body="&lt;p&gt;Neither, really. Replacing a copper link with a fiber link &lt;em&gt;might&lt;/em&gt; lower latency a tiny bit (assuming an uncongested link), but what you really get when you replace a &quot;core&quot; link with a higher bandwidth link is less possible congestion. In your example scenerio, it doesn't matter, because there is only one device on each end. In a live network, though, moving from 1g to 10g core links will ease congestion problems within the core of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, as a side affect, you may get lower latency and better traffic flow, but that is purely due to easing congestion so the routers/switches aren't overloaded and dropping/queueing traffic.&lt;/p&gt;&#xA;" OwnerUserId="89" LastEditorUserId="89" LastEditDate="2013-06-02T01:34:17.777" LastActivityDate="2013-06-02T01:34:17.777" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1507" PostTypeId="2" ParentId="1505" CreationDate="2013-06-01T05:56:31.903" Score="6" Body="&lt;p&gt;The speed of the flow of data makes no difference in the physics of the medium.  By this I mean that it takes the same time for an electric signal to flow from one side of a 100 meter copper run to the other, no matter if that signal is part of a 10Mbps or a 1Gbps link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you change from copper to fiber, then you may notice a small improvement, but it really should be only a marginal difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, there are other factors that may come into play, for instance the equipment that can do 10Gbps is generally more capable of processing the frames/packets than equipment that is designed to do 10Mbps, so the latency added by the equipment may be reduced as well.  But this is &lt;em&gt;entirely&lt;/em&gt; dependent on the capabilities of the equipment and not on the speed of the link.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-06-01T06:02:06.447" LastActivityDate="2013-06-01T06:02:06.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1508" PostTypeId="1" AcceptedAnswerId="1509" CreationDate="2013-06-01T08:39:12.100" Score="16" ViewCount="4099" Body="&lt;p&gt;On Internet edge routers speaking eBGP to multiple carriers and iBGP to one another, all interfaces on the LAN and WAN side are GE except for one Serial full-DS3 (~45Mbps) on each router.  Although I think I'm hardly sending much traffic outbound on the serial interfaces -- in the 3-10Mbps range -- I see constant output queue drops (OQD).  &lt;strong&gt;Is the likely explanation that there really is bursty traffic&lt;/strong&gt; I'm not seeing as the load-interval is at the 30 second minimum and SNMP polling is averaging traffic over 5 minutes, so those won't illuminate the burstiness?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The platform is a Cisco 7204VXR NPE-G2.  Serial queuing is &lt;em&gt;fifo&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Serial1/0 is up, line protocol is up&#xA;  Hardware is M2T-T3+ pa&#xA;  Description: -removed-&#xA;  Internet address is a.b.c.d/30&#xA;  MTU 4470 bytes, BW 44210 Kbit, DLY 200 usec,&#xA;     reliability 255/255, txload 5/255, rxload 1/255&#xA;  Encapsulation HDLC, crc 16, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Restart-Delay is 0 secs&#xA;  Last input 00:00:02, output 00:00:00, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 00:35:19&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 36&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  30 second input rate 260000 bits/sec, 208 packets/sec&#xA;  30 second output rate 939000 bits/sec, 288 packets/sec&#xA;     410638 packets input, 52410388 bytes, 0 no buffer&#xA;     Received 212 broadcasts, 0 runts, 0 giants, 0 throttles&#xA;              0 parity&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;     515752 packets output, 139195019 bytes, 0 underruns&#xA;     0 output errors, 0 applique, 0 interface resets&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;     0 carrier transitions&#xA;   rxLOS inactive, rxLOF inactive, rxAIS inactive&#xA;   txAIS inactive, rxRAI inactive, txRAI inactive&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;24 hours later will show thousands of OQD. We do push out more traffic around 3am each day, so maybe there is some bursty traffic here I'm not giving enough weight towards.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Last clearing of &quot;show interface&quot; counters 1d01h&#xA;Input queue: 0/75/0/158 (size/max/drops/flushes); Total output drops: 12049&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd like to push more outbound traffic on the DS3, but not with my concern on the OQD.  The tier 2 ISP behind the DS3 has POPs that double as peering-points with 6+ tier 1's, so the idea is to get that traffic on-net with the client asap as opposed to our primary ISP on the GE who is a tier 1, but must work their way towards their peering exchanges. Inbound traffic is not a concern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there a better queueing strategy than fifo in this situation?&lt;/strong&gt;  Looking at the Cisco docs on input &amp;amp; output queue drops, incrementing outbound queue size is not recommended as the packets are already on the router and it would be better to drop at input so TCP can throttle the app back. There's plenty of bandwidth on our GE links, so there's no really need to throttle the input.  &lt;em&gt;There are no policy-maps on these routers.  90% of outbound traffic comes from our HTTP responses; most of the rest from FTP and SMTP.  The GE links push 50-200+Mbps.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Would you recommend any adjustments to the output queue size buffer?&lt;/strong&gt; These serial interfaces are our backup links that I'd rather utilize more for the reason given earlier (if valid), but tempered with my BGP policies that attempt not to overload that serial interface (which appears very underloaded most of the time).&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-03T03:26:22.930" LastActivityDate="2013-06-03T03:26:22.930" Title="Output Drops on Serial interface: Better queueing or Output queue size?" Tags="|cisco|router|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1509" PostTypeId="2" ParentId="1508" CreationDate="2013-06-01T09:06:23.390" Score="13" Body="&lt;p&gt;You're right, you wouldn't really see the burstiness easily on SNMP. 1GE can send 1.48Mpps, so it takes very very little time to congest the the 45Mbps, which can handle less than 75kpps.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your ingress is 1GE and egress is 45Mbps, then obviously the congestion point of 45Mbps will need to drop packets. This is normal and expected. If you increase buffers you'll introduce more delay.&lt;br&gt;&#xA;1GE takes 0.45ms to send 40 1500B IP frames, which is right now the amount of burst you can handle. However dequeueing them on the 45Mbps already takes 10ms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have any acute problem, I would probably not do anything about it. But if some traffic is more eligible for dropping than other, then you should replace FIFO with class-based queueing. Say maybe you want to prioritize so that more ftp is dropped and less voip.&lt;br&gt;&#xA;Then it'll also make more sense to add more buffering on the ftp traffic, as it's not really sensitive to delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to try your luck with deeper buffers, something like this should suffice:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map WAN-OUT&#xA; class class-default&#xA;    fair-queue&#xA;    queue-limit 200 packets&#xA;!&#xA;interface Serial1/0&#xA;  service-policy output WAN-OUT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would cause 50ms buffers on the Serial1 and would allow you to handle up-to 2.25ms burst from single Gige interface.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-06-01T09:51:26.533" LastActivityDate="2013-06-01T09:51:26.533" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1510" PostTypeId="2" ParentId="1508" CreationDate="2013-06-01T09:07:48.547" Score="8" Body="&lt;p&gt;The OQD's are usually caused by one of two things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You are over utilising the link; with either constant high usage or bursty traffic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You have a policy map applied to the interface which is configured to do something like policing or shaping some or all of the traffic&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There is some kind of error on the interface, take a look at the error counters (&lt;code&gt;show interface Serial1/0 counters errors&lt;/code&gt;) and check that its not dropping the packets due to an error.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You could look into (if you havent already got one) putting a policy map in place to do things like give your mission critical traffic its own queue, enable congestion avoidance on regular traffic (WRED) or even just enable fair queueing on the traffic so that the bandwidth is shared between the flows transitting the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you have mentioned, another option would be increase the output queue size on the interface but if you were to use a policy map then there would be no need for this anyway as the policy would create other sub-queues.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-06-01T09:07:48.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1513" PostTypeId="2" ParentId="1479" CreationDate="2013-06-01T11:58:25.877" Score="3" Body="&lt;p&gt;To do a quick install that will almost certainly work fine for 30 people? Definitely yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do a fully proper install, site survey, etc? Probably not. However for 30 people in a small office with two Autonomous APs, this is more likely overkill.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-06-01T11:58:25.877" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="1514" PostTypeId="2" ParentId="1470" CreationDate="2013-06-01T12:05:55.533" Score="5" Body="&lt;p&gt;Ylearn's answer is good, but I don't think it's the full answer for this part:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why could they not just do 60 watts from the inception of POE?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cisco's UPOE gets 60 watts mainly by doing 30W on two pair-of-pairs, something that 802.3af couldn't do as it was planned to support 10/100Mb Ethernet which both only use two pairs, and it was a design requirement to support both cable plants that only connect the two needed pairs, as well as &quot;passive midspan&quot; power injectors without the magnetics (transformers) needed to inject power on the data lines (which any gigabit capable injectors must have)&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-06-01T12:05:55.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1515" PostTypeId="2" ParentId="1377" CreationDate="2013-06-01T12:22:58.233" Score="3" Body="&lt;p&gt;One aspect not covered here is the why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jumbo frames can be of great benefit to some applications, but it's worth actually benchmarking your applications to see if you really will get a benefit that covers the costs. These days even for the applications that benefit most it's rare to even get a 10% improvement in throughput, which may not cover the increased operational costs. Inside a backbone using tunneling (MPLS, L2TP, etc.) it can be required, and for little cost as a single backbone is usually a single group of administrators, however once you start extending jumbos to the access layer it quickly gets more complex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing to consider is that all your documentation and procedures will need to be updated to ensure any new devices added (or RMA replacements) don't become silent black-holes for traffic.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-06-01T12:22:58.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1516" PostTypeId="2" ParentId="1232" CreationDate="2013-06-01T12:26:25.980" Score="0" Body="&lt;p&gt;I'd say &quot;kinda&quot;, much like many parts of Cisco's product lines these days the OS' look similar on the outside, but are actually quite different to use and configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some notable inconsistencies in IronWare:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Aggregate (bundle / etherchannel) configuration, MLX is different to other platforms&lt;/li&gt;&#xA;&lt;li&gt;Backspace, no I'm not kidding, until mid last year IronWare did not support the normal backspace character when connecting from a *NIX machine. In fact even today it still doesn't work properly.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-06-01T12:26:25.980" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1517" PostTypeId="2" ParentId="1505" CreationDate="2013-06-01T17:16:33.310" Score="0" Body="&lt;p&gt;Since throughput is = to windows size / RTT anything that shortens RTT would increase throughput, it is a different question as to if it is worth it. The larger the window size the more impact decreasing RTT has. &lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-06-01T17:16:33.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1518" PostTypeId="1" CreationDate="2013-06-01T17:57:47.197" Score="17" ViewCount="910" Body="&lt;p&gt;A colleague is attempting to implement active/passive internet multihoming. The design entails sending communities (listed below) to the passive provider to lower the local preference at remote ASes for the advertised routes. The &lt;a href=&quot;http://www.onesc.net/communities/&quot;&gt;documentation&lt;/a&gt; states repeatedly that the communities are for customer use and we are not a customer of these providers. I would think that giving the internet-at-large the ability to alter local preference is a huge security risk. Would this have a snowball's chance in hell of actually working?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1273:70     cable and wireless plc local pref 70&#xA;2828:1507   xo local pref 70&#xA;3356:70     level3 local pref 70&#xA;3549:100    global crossing local pref 100&#xA;4323:80     twtelecom local pref 80&#xA;1299:50     teliasonera local pref 50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="161" LastEditorUserId="630" LastEditDate="2013-06-02T08:03:18.657" LastActivityDate="2013-06-02T08:03:18.657" Title="Is it possible to remotely influence BGP localpref?" Tags="|bgp|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1519" PostTypeId="2" ParentId="1518" CreationDate="2013-06-01T18:02:58.390" Score="6" Body="&lt;p&gt;The provider should have a filter inbound to ensure these communities are only accepted from customers. If not, then that's the providers issue.&lt;/p&gt;&#xA;&lt;p&gt;Some Tier1 providers do accept these sorts of communities from anywhere though. This is based on RFC 1998: &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1998.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc1998.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-06-01T18:02:58.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1520" PostTypeId="2" ParentId="1518" CreationDate="2013-06-01T19:10:47.133" Score="15" Body="&lt;p&gt;It is unlikely (but not impossible) for the communities you tag on your routes to propagate past your upstream. Most providers will strip the communities out before readvertising routes up/downstream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to influence multiple remote ASes in this manner, you would need to use AS_PATH prepending. Prepend 2-3 times to your backup/passive provider, and then most/all traffic will flow down your active path until it fails. Then traffic should shift to your passive path once the failed route gets withdrawn.&lt;/p&gt;&#xA;" OwnerUserId="89" LastEditorUserId="89" LastEditDate="2013-06-01T19:22:39.203" LastActivityDate="2013-06-01T19:22:39.203" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1521" PostTypeId="2" ParentId="1505" CreationDate="2013-06-01T23:28:04.270" Score="5" Body="&lt;p&gt;In this case, moving from 1G end-to-end, to a 10G core shouldn't significantly change anything.  Only a marginal increase in throughput would come from the faster signalling (decreased bit-time) on the 10G+ link. But in the absence of any congestion (read: other hosts), they should've been able to saturate the link to begin with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The time it takes hosts A &amp;amp; B to signal (in and out) a packet doesn't change.  The time it takes the packet to hop from switch to switch is, in theory, proportionally faster.  However, at these speeds, the difference isn't noticeable to a human. (~10&amp;mu;s for 1500 mtu packet)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-01T23:28:04.270" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1522" PostTypeId="2" ParentId="1479" CreationDate="2013-06-02T03:07:23.617" Score="1" Body="&lt;p&gt;I've done large scale wireless deployments and while that figure that you were provided is completely not out of the ballpark for 2 AP's and labor, you (and your superiors) need to ask if you have the time (which often equates to MONEY) to spend learning how to setup and install these AP's.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remember back when I first learning how to deploy wireless networks, design considerations were much different than traditional ethernet network and I myself had several stumbling blocks along the way.  I would suggest showing these comments/responses from everyone here and then discuss the pros/cons of such a deployment by yourself or by an outside vendor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the pros of doing it yourself:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: Less money up front (as you don't have to pay a consultant)&#xA;2: You gain some knowledge that you didn't already have!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the cons of doing it yourself:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: Longer deployment (which does equal money as you have to spend time away from other tasks)&#xA;2: Security issues with the final deployment could potentially cause Layer 2 breaches out in the parking lot of your building if your not careful&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the pros of hiring a consultant:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: You get to spend your time on your projects&#xA;2: The wireless project will most likely get done in a day or less given the amount of AP's to be installed&#xA;3: The wireless network (should be) will be as secure as your wired network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the cons of hiring a consultant:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: Cost!&#xA;2: They often setup and run with very little knowledge transfer (not all do this I know...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often you will find that it is easier to bring someone in to install these systems in less time than yourself, but I would make sure that in the contract that they provide some form of knowledge transfer on how to not only access the wireless network but how to administer it on a basic level.&lt;/p&gt;&#xA;" OwnerUserId="1096" LastActivityDate="2013-06-02T03:07:23.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1523" PostTypeId="2" ParentId="1518" CreationDate="2013-06-02T05:46:36.220" Score="5" Body="&lt;p&gt;&lt;strong&gt;The best you can usually do is look for communities with &lt;em&gt;your&lt;/em&gt; provider that allow you to indicate &lt;em&gt;prepends per peer&lt;/em&gt; of your provider.&lt;/strong&gt;  This assumes your provider has such communities and has the peering relationships for this to work.  Prepending your own announcements to your peer would have no variation upstream from your provider.  Though this method does not alter &lt;em&gt;localpref&lt;/em&gt; one AS removed from your provider, it has similar impact in making that path back to you less desirable.  There is an exception to influencing localpref upstream that I'll describe at the bottom, though it's probably an edge case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Some providers&lt;/em&gt; such as XO [AS2828] allow you to advertise your prefixes in such a way that your provider announces your routes with with specific prepends for certain peers of theirs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, XO accepts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;2828:1108&lt;/code&gt; prepends once for AT&amp;amp;T&lt;br&gt;&#xA;&lt;code&gt;2828:1207&lt;/code&gt; prepends twice for Level3&lt;br&gt;&#xA;&lt;code&gt;2828:1303&lt;/code&gt; preprends thrice for Sprint&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Savvis, the community is &lt;code&gt;3561:30151&lt;/code&gt; which prepends once for AT&amp;amp;T.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These providers usually have communities to indicate the well-known communities of NO_EXPORT or NO_ADVERTISE to specific peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One Tier 2 provider I know, InterNAP, is able to influence &lt;em&gt;localpref&lt;/em&gt; upstream because they buy transit, so they are a customer of the Tier 1's.  They have communities that you could use where they &lt;em&gt;attempt&lt;/em&gt; to translate those into specific Tier 1 communities for your upstream advertisements which set &lt;em&gt;localpref&lt;/em&gt; to peer-, mid-, or high-level values.  See &lt;a href=&quot;http://www.onesc.net/communities/as6993/Internap-Customer-Guide-1.3.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://www.onesc.net/communities/as6993/Internap-Customer-Guide-1.3.pdf&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Example References:&lt;br&gt;&#xA;&lt;a href=&quot;http://www.onesc.net/communities/as2828/&quot; rel=&quot;noreferrer&quot;&gt;XO Communities that Change Customer Announcements to Certain Peers at AS2828 Border&lt;/a&gt;&lt;/em&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.onesc.net/communities/as3561/community_receive.htm&quot; rel=&quot;noreferrer&quot;&gt;Savvis Prepend Community Attributes&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I have no affiliation with the providers used in the examples other than direct experience as a customer.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-02T06:26:53.293" LastActivityDate="2013-06-02T06:26:53.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1524" PostTypeId="1" AcceptedAnswerId="1526" CreationDate="2013-06-02T08:22:00.050" Score="15" ViewCount="7680" Body="&lt;p&gt;A recent question from Craig Constantine pertained to IPv6, but many people are not on the leading edge with IPv6 yet and are still responsible for new or improved IPv4 deployments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I would like to validate my own enterprise IPv4 address space planning against any public documents or guidance given directly here.&lt;/strong&gt;  Addressing has some unique needs between the DC and Campus that would ideally be considered.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I'm specifically looking to see what best practices exist for planning out &lt;em&gt;private&lt;/em&gt; (RFC1918) IP space assignments for regions, cities, campus, buildings, floors, uplinks, WAN links, loopbacks, etc.&lt;/strong&gt;  Wired vs wireless.  Internal networks vs. guest networks.  *I know this on its own can be a bit of an open-ended question, so I'm looking for specific references or examples to proven and well-thought out plans in a similar way as to the IPv6 answers.  Suggested CIDR blocks would be helpful as the space gets allocated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aggregation for routing, of course, is desired, and so is the ability to have simplified ACLs.  There's a trade-off in ACLs on with the desire to aggregate all employee subnets, for example, whether wired or wireless vs aggregating all wireless users regardless if they are employees, contractors, or guests.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="220" LastEditDate="2013-06-03T09:08:25.847" LastActivityDate="2013-06-03T09:08:25.847" Title="IPv4 Address Space Planning Best Practices" Tags="|ipv4|best-practices|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1525" PostTypeId="2" ParentId="1524" CreationDate="2013-06-02T10:19:34.983" Score="9" Body="&lt;p&gt;Given that IPv4 has been around for so long there are million different ways that people choose to allocate their IPv4 space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For us (an ISP) we use the smallest subnet size possible on pure transit links (/30 usually) and then in terms of customers it depends on what their needs are, due to how short everyone is on IPv4 means that instead of using a blanket rule you have to take every customer as their own entity and gather their requirements accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is all ofcourse if you were referring to PUBLIC IPv4 space, in terms of the internal RFC1918 stuff then plan your allocations so that you build in room for expansion (e.g. a building only has 50 people in it, dont give them a /26 just because its the next sized subnet but perhaps give them a /24 to allow for expansion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another good practice is to allocate to aggregate, that is if you have a building with 10 floors allocate a /20 (or larger) to the building and then allocate the subnets for each floor/department out of that /20, that way you can advertise only the /20 to the rest of your network rather than all the individual subnets for each floor.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-06-02T10:19:34.983" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1526" PostTypeId="2" ParentId="1524" CreationDate="2013-06-02T11:43:18.663" Score="10" Body="&lt;p&gt;Being in a semi-small company, we broke down our private network somewhat liberally as so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/24 per Vlan&#xA;/16 per location&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlans are spread out, skipping 10 /24s per. Vlan number matches the third octet. Locations are sequential, starting 10 /16s in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;10.10.1.0/24 - Location A, Management Vlan 1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;10.10.11.0/24 - Location A, Wireless Vlan 11&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;10.11.11.0/24 - Location B, Wireless Vlan 11&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;10.11.81.0/24 - Location B, SAN Vlan 81&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;10.11.101.0/24 - Location B, Wired Office Vlan 101&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Vlan examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;1 - management&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;2 - management for wireless&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;11 - wireless access&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;21 - guests&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;31 - mobile devices&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;41 - factory equipment&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;51 - SAN&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;61 - VoIP&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;71 - Wired access&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The benefits we saw with this are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Easy to refer to an entire location via /16. We use this quite often for VPN ACLs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Easy to group device types together for web filtering.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Any Vlan within the next 10 /24s belongs to the same type as the previous root. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;So for example, factory equipment... Vlan 31, for certain vendors who have 24/7 remote access, we gave them their own Vlan, 32 or 33 or 34, up to 40. Their VPN access limits them to the equipment that they support without getting granular on IPs/ACEs. If the manufacturing team needs to drop more equipment in, we don't have to update the VPN ACLs. This also includes access ACLs/ACEs between Vlans.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another example: SAN Vlans, we use two of them at minimum for redundancy. So they are always 81 and 82.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Last example: Wireless management is broken out to its own Vlan, 2. We do this because we have enough APs to need a WLAN controller but no budget for controllers. This Vlan uses tftp and dhcp options to auto configure and boot the APs from a central config repo and we don't want other equipment that can auto boot to pull the wireless configs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This setup gives us an easy way to look at an IP and know the location and type of equipment it belongs to. This means less ACLs/ACEs in configuration files for us, especially on limited VPN users. We also have breathing room for expansion in the event we run out of IPs in a Vlan or because we need to further segregate traffic. And since we're a small company, we haven't broken into three digit location numbering yet. Plenty of growth room.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-06-02T12:58:42.940" LastActivityDate="2013-06-02T12:58:42.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1527" PostTypeId="1" AcceptedAnswerId="1530" CreationDate="2013-06-02T13:59:04.840" Score="21" ViewCount="3701" Body="&lt;p&gt;I understand that L3 switches use CEF for faster packet forwarding. However, CEF will not work for packets that need to undergo NAT. Does this mean CEF isn't used by edge routers and edge L3 switches? Is CEF's usefulness limited to the LAN?&lt;/p&gt;&#xA;" OwnerUserId="889" LastEditorUserId="775" LastEditDate="2013-06-30T10:38:55.630" LastActivityDate="2015-03-17T03:43:12.047" Title="CEF operations on L3 switch vs router" Tags="|cisco|routing|nat|switching-modes|cef|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1528" PostTypeId="2" ParentId="1527" CreationDate="2013-06-02T14:07:30.867" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does this mean CEF isn't used by edge routers and edge L3 switches? Is CEF's usefulness limited to the LAN?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;CEF is useful because it permits a router to quickly rewrite the Layer2 information during Layer3 forwarding operations.  WAN routers must rewrite Layer2 header information just like LAN switches do... CEF is extremely useful to both types of router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At a high-level CEF performs two functions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Contains a shadow-copy of the routing table, which maps the routed prefix to a next-hop&lt;/li&gt;&#xA;&lt;li&gt;Contains a reference to a Layer2 adjacency table, which provides cached information about Layer2 headers required to rewrite the IP packet through the egress next-hop mentioned in the first bullet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider this router that has a WAN HDLC link on Serial1/0, and a LAN connection via FastEthernet0/0...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show adjacency internal&#xA;Protocol Interface                 Address&#xA;IP       Serial1/0                 point2point(5)&#xA;                                   0 packets, 0 bytes&#xA;                                   0F000800             &amp;lt;--------- HDLC Header rewrite info&#xA;                                   CEF   expires: 00:02:17&#xA;                                         refresh: 00:00:17&#xA;                                   Epoch: 0&#xA;                                   Fast adjacency disabled&#xA;                                   IP redirect enabled&#xA;                                   IP mtu 1500 (0x0)&#xA;                                   Fixup disabled&#xA;                                   Adjacency pointer 0x6663D3E0, refCount 5&#xA;                                   Connection Id 0x000000&#xA;                                   Bucket 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Suppose an IPv4 packet going to 192.0.2.1 enters the router from FastEthernet0/0 on the LAN, and must exit Serial1/0 on the WAN (the fact that it's exiting Serial1/0 is found in the CEF table... and the CEF table references the adjacency table).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the router receives the IPv4 packet from FastEthernet0/0, the router has to strip off the ethernet header and prepend the &lt;a href=&quot;http://en.wikipedia.org/wiki/Cisco_HDLC#cHDLC_frame_structure&quot; rel=&quot;nofollow&quot;&gt;HDLC header&lt;/a&gt;, which is &lt;code&gt;0F000800&lt;/code&gt; since it's an IPv4 destination (&lt;code&gt;0x0800&lt;/code&gt; is there as an HDLC &quot;type&quot; value to say the next header is IPv4).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If CEF has not cached the (trivial) header rewrite information for Serial1/0, it must be look up the information manually at the process-switch level (which is very slow).  These adjacency table values won't change as long as the encapsulation on Serial1/0 doesn't change; therefore, Cisco IOS caches the adjacency rewrite information in the adjacency table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rewrite information gets more involved when you look at frame-relay or ATM PVCs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk827/tk831/technologies_tech_note09186a0080094303.shtml&quot; rel=&quot;nofollow&quot;&gt;This document on CCO (Document ID: 17812)&lt;/a&gt; may explain things better than I could by rehashing a lot of CCO content&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-03-17T03:43:12.047" LastActivityDate="2015-03-17T03:43:12.047" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1529" PostTypeId="2" ParentId="1527" CreationDate="2013-06-02T14:13:26.403" Score="18" Body="&lt;p&gt;CEF is Cisco's word for their FIB. When in L3 switch you do 'sh ip cef', none of this information is actually used to push the packets at all, this is just software &lt;a href=&quot;http://en.wikipedia.org/wiki/Trie&quot;&gt;trie&lt;/a&gt; which is used to populate the hardware ASIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CEF is just term Cisco uses to describe their optimize data storage/retrieval code, it is not specific technology with specific function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most HW platforms you cannot simply run the box without CEF, as CEF data structure is needed to compile the HW specific information.&lt;br&gt;&#xA;Some features like MPLS also have dependency on CEF data structure and thus won't work without it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN (L2) switching is not abstracted via CEF, so it does not depend on CEF at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1587052369&quot;&gt;this&lt;/a&gt; book for quite up-to-date information about CEF (it's written after major CEF rewrite around 12.2S)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you constrain CEF definition of IP Trie FIB, then obviously that cannot be used for NAPT, because you cannot pre-determine what is natted and where. But as explained, CEF is not specific technology, it's broader concept, and thus it's debatable if CEF is NAT feature or not, I would err to the side of it being CEF feature:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bu.ip.fi#sh cef features global  | b Local&#xA;  Global Local features not attached to a specific interface:&#xA;     NAT&#xA;bu.ip.fi#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would never run anything without CEF and it is probably only because of legacy reasons choice of disabling it even exists. Consider Juniper, they don't have specific term they use to describe same concept, as they do not need to differentiate it from some alternative method, as such inferior alternative does not exist.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-06-02T15:34:24.563" LastActivityDate="2013-06-02T15:34:24.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1530" PostTypeId="2" ParentId="1527" CreationDate="2013-06-02T15:15:58.553" Score="8" Body="&lt;p&gt;NAT can of course use CEF. This is from Cisco's own guide over here: &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_q_and_a_item09186a00800e523b.shtml&quot;&gt;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_q_and_a_item09186a00800e523b.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Q. What kind of routing performance can be expected when using Cisco IOS NAT?&#xA;&#xA;    A. Cisco IOS NAT supports Cisco Express Forwarding switching, fast switching, and process switching. For 12.4T release and later, fast-switching path is no longer supported. For Cat6k platform, the switching order is Netflow (HW switching path), CEF, process path.&#xA;&#xA;    Performance depends on several factors:&#xA;&#xA;        The type of application and its type of traffic&#xA;&#xA;        Whether IP addresses are embedded&#xA;&#xA;        Exchange and inspection of multiple messages&#xA;&#xA;        Source port required&#xA;&#xA;        The number of translations&#xA;&#xA;        Other applications running at the time&#xA;&#xA;        The type of hardware and processor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Bigger platforms running IOS-XR, where the FIB gets ditributed to the line cards, also support carrier grade NAT, so it's usefulness is not limited to the LAN alone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also a lot of Cisco's L3 switches simply do not do NAT at all&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-06-02T15:31:04.763" LastActivityDate="2013-06-02T15:31:04.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1531" PostTypeId="2" ParentId="1483" CreationDate="2013-06-02T16:18:54.607" Score="9" Body="&lt;p&gt;You cannot change the LSRefreshTime because it's hard-coded as an &amp;quot;architectural constant&amp;quot; in the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#page-217&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSPF RFC&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="317" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-06-03T14:21:46.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1532" PostTypeId="1" AcceptedAnswerId="1538" CreationDate="2013-06-02T18:20:59.643" Score="11" ViewCount="2435" Body="&lt;p&gt;There are 2 routers connected something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Network1 ----- (172.16.1.1/24) Router 1 (172.16.3.1/30) ------ (172.16.3.2/30) Router 2 ------ (172.16.2.1/24) Network 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I try to add addresses for dynamic routing using the RIP protocol, for Router 1 adding 172.16.1.0 and 172.16.3.0 and for Router 2 172.16.3.0 and 172.16.2.0 but they are assigned by default to 172.16.0.0 in both cases, and it does not work. Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="1502" LastEditorUserId="775" LastEditDate="2013-06-06T17:06:29.973" LastActivityDate="2013-06-06T17:06:29.973" Title="RIP routing is broken between two routers" Tags="|cisco|routing|router|rip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1534" PostTypeId="5" CreationDate="2013-06-02T19:14:37.040" Score="0" Body="&lt;p&gt;Routing Information Protocol is a distance vector routing protocol that uses hop count as a routing metric. There are currently three versions of RIP: v1, v2, and RIPng. RIPv1 was the first version, first defined in 1988. RIPv2 was added support to carry subnet information in route updates, it was developed in 1993 and made a standard in 1998. RIPng extends RIPv2 by adding support for IPv6.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T21:10:03.363" LastActivityDate="2016-11-29T21:10:03.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1535" PostTypeId="4" CreationDate="2013-06-02T19:14:37.040" Score="0" Body="For questions about Routing Information Protocol (RIP)." OwnerUserId="736" LastEditorUserId="8499" LastEditDate="2016-11-29T21:10:03.363" LastActivityDate="2016-11-29T21:10:03.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1536" PostTypeId="2" ParentId="1172" CreationDate="2013-06-02T19:19:30.567" Score="3" Body="&lt;p&gt;The power supplies / fans within 3560 / 3750 are not hot swappable / once the switch is mounted and the inevitable failure of these devices occurs all servers must be unplugged from the 3560/3750 while it is unmounted and replaced with the RMA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the fan direction on the 3560s / 3750s become a problem with hot aisle / cold aisle and other cooling setups. Mounting the switches where the switch ports face the back of the servers creates a situation where the switch fans blow in the wrong direction. This overheats the switch which makes it more likely to fail / need replacement. &lt;/p&gt;&#xA;" OwnerUserId="1503" LastActivityDate="2013-06-02T19:19:30.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1537" PostTypeId="2" ParentId="1532" CreationDate="2013-06-02T19:32:45.830" Score="10" Body="&lt;p&gt;This is not a case of auto summary. Auto summary only works across major network boundaries. So you would need to have 172.16.x.x and 172.17.x.x or such to have a network summarized. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are seeing is that RIP only supports classful networks under the routing process. So even if you enter 172.16.3.0 it will convert it to 172.16.0.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use classless routing with RIP version 2. It will look classful under the routing process config but it will advertise the routes properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please use &lt;code&gt;sh ip protocols&lt;/code&gt; to check what version you are running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's not working then I suspect you are running version 1.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-06-02T19:32:45.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1538" PostTypeId="2" ParentId="1532" CreationDate="2013-06-02T19:32:56.910" Score="18" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;they are assigned by default to 172.16.0.0 in both cases, and it does not work&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I modified your ascii art a litte to reduce scrolling... It sounds like you're saying that you can't reach reach N1 from N2...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Broken RIPv1 topology&#xA;=====================&#xA;&#xA;N1 ---- (172.16.1.1/24) R1 (172.16.3.1/30) ----- (172.16.3.2/30) R2 ----- (172.16.2.1/24) N2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Classful routing protocol overview&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RIPv1 is a classful routing protocol... as such, it doesn't associate netmasks with routes when they are advertised.  Classful routing protocols do a couple non-intuitive things...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;They only advertise routes out interfaces where the masks match (this is your problem)&lt;/li&gt;&#xA;&lt;li&gt;They automatically summarize at &lt;em&gt;major network boundaries&lt;/em&gt; (see bonus material, below)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Interface netmasks&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make your topology work, your masks will have to match on all RIPv1 interfaces, unless you use a classless routing protocol (such as RIPv2, EIGRP, OSPF, or ISIS).  If you need to use RIPv1, then reconfigure your topology such that all interfaces have matching masks, like this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Functional RIPv1 topology&#xA;=========================&#xA;&#xA;N1 ---- (172.16.1.1/24) R1 (172.16.3.1/24) ----- (172.16.3.2/24) R2 ----- (172.16.2.1/24) N2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bonus material: RIPv1 Auto-summarization Example&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this also tends to trip people up, I am including an example of RIPv1 auto-summarization dynamics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I mention major network boundaries below, I'm talking about the classic definitions for &lt;a href=&quot;https://en.wikipedia.org/wiki/Classful_network#Introduction_of_address_classes&quot;&gt;Class A, Class B, and Class C IPv4 networks&lt;/a&gt;...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class A (8-bit netmasks): 1.0.0.0/8 - 127.0.0.0/8&lt;/li&gt;&#xA;&lt;li&gt;Class B (16-bit netmasks): 128.0.0.0/16 - 191.255.0.0/16&lt;/li&gt;&#xA;&lt;li&gt;Class C (24-bit netmasks): 192.168.0.0/24 - 223.255.255.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Moving on to the RIPv1 auto-summarization example...  I will use matching /24 interface netmasks for simplicity.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Lo0:&#xA;192.168.1.0/24&#xA;Lo1:&#xA;1.1.2.0/24&#xA;+----+                  +----+                     +----+&#xA;| R1 +------------------+ R2 +---------------------+ R3 |&#xA;+----+                  +----+                     +----+&#xA;          1.1.1.0/24              172.16.1.0/24&#xA;&#xA;router rip               router rip                 router rip&#xA; version 1                version 1                  version 1&#xA; network 192.168.1.0      network 1.0.0.0            network 172.16.0.0&#xA; network 1.0.0.0          network 172.16.0.0&#xA;&#xA;The routing table on R3 contains:&#xA;C     172.16.1.0/24&#xA;R     1.0.0.0/8        &amp;lt;--- 1.1.1.0/24 and 1.1.2.0/24 are &quot;hidden&quot; by the &#xA;                            classful summary at R2&#xA;&#xA;R     192.168.1.0/24   &amp;lt;--- 192.168.1.0/24 passes transparently through R2&#xA;                            since it's a Class C network itself and is not &#xA;                            summarized at R2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 and R2 are connected by subnets of the 1.0.0.0/8 major network, so 1.1.1.0/24 and 1.1.2.0/24 are advertised between R1 and R2; however, the link between R2 and R3 is &lt;em&gt;not&lt;/em&gt; in 1.0.0.0/8, therefore R2 performs automatic summarization of subnets of 1.0.0.0/8 and subnets of 172.16.0.0/16.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When subnets of a major network are summarized, they get hidden by the summarized route...  This happens at R2 when 1.1.1.0/24 and 1.1.2.0/24 are summarized to 1.0.0.0/8.  Cisco routers cannot disable auto-summarization under RIP version 1 (but they can for RIPv2).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-05T01:57:49.087" LastActivityDate="2013-06-05T01:57:49.087" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1539" PostTypeId="2" ParentId="1172" CreationDate="2013-06-02T20:43:20.887" Score="4" Body="&lt;p&gt;I've got a customer that has deployed them as a SAN switch stack (using 3750X's) with the SAN connected at 10Gbit and then their ESX hosts connected at Gbit (or multiple Gbit's using LAG) and the amount of output drops is astronomical no matter how you try and tune the buffers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same customer has two other 3750 stacks in the same DC for other networks and these are all clean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR:&lt;/strong&gt; It really depends on the type of traffic you are going to be putting through the stack and where your bottlenecks are.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-06-02T20:43:20.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1540" PostTypeId="1" AcceptedAnswerId="1541" CreationDate="2013-06-02T21:17:30.393" Score="10" ViewCount="2777" Body="&lt;p&gt;I've been looking for a new 'core' router to put in our new rack which is colo'd at a nearby datacentre. What I've come across is the usual Cisco/Juniper/Brocade lineup, with the usual unattractive price points; and I wondered what would happen if I used a software router (like pfSense or a proprietary/commercial option) on a decent 2U box and put a few NICs in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My requirements for the router are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Run BGP (obviously) and be able to store at least one &lt;strong&gt;full&lt;/strong&gt; Internet routing table (~460,000 routes), &lt;strong&gt;preferably two&lt;/strong&gt; full Internet routing tables if I decide to multihome&lt;/li&gt;&#xA;&lt;li&gt;Have throughput of at least 1Gbps (more for scalability, but not important right now)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These requirements could easily be handled by a decent software router on a decent box with good NICs and &gt;2GB of memory, couldn't they? If so, (other than the brand name), what is it that makes Cisco/Juniper/Brocade systems so expensive?&lt;/p&gt;&#xA;" OwnerUserId="1465" LastEditorUserId="1465" LastEditDate="2013-06-03T14:40:20.327" LastActivityDate="2013-06-03T15:37:13.247" Title="Embedded routers vs. software routers in the datacentre" Tags="|cisco|bgp|router|juniper|brocade|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1541" PostTypeId="2" ParentId="1540" CreationDate="2013-06-02T21:31:36.367" Score="8" Body="&lt;p&gt;To name a few things: development, maintenance testing and support of software and hardware and of course: marketing and profit. Also, these vendors use dedicated ASICs so packet forwarding (amongst other things) are done in hardware instead of software. Basically, you buy a box which is optimized for one task: routing, which means all code and hardware has been tested for that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Software routers are often ok, especially if you don't have a large budget or just need to build a lab setup. However, if you run into problems there's a chance you're either on your own figuring out if it's the routing software, your hardware, the kernel or something else. I'm not saying this is a bad thing (some of these projects have many active users), it's just something to consider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A full BGP feed is almost 450K IPv4 prefixes by now by the way, and nearly 13K IPv6. If I'd be building a software router, I'd do some research on which NICs to use and how to optimize them and put a lot more than 2G of RAM in the box.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-06-02T21:31:36.367" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1542" PostTypeId="2" ParentId="1540" CreationDate="2013-06-02T22:02:12.033" Score="10" Body="&lt;p&gt;One advantage of a software router is that RIB/FIB size is only limited by the RAM in the hardware, which is cheap and easily upgradable. ASIC routers often have other limitations, like TCAM size/allocation.&#xA;Routing performance of software routers in the GigE ballpark is comparable to ASIC-based routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One major disadvantage is that software routers are not capable of withstanding DDoS attacks in any meaningful sense - lots of small packets mean lots of context switches and the router will quickly die of CPU exhaustion. &lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorDisplayName="user661" LastEditDate="2013-06-03T15:37:13.247" LastActivityDate="2013-06-03T15:37:13.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1543" PostTypeId="2" ParentId="1540" CreationDate="2013-06-02T22:02:38.697" Score="3" Body="&lt;p&gt;If you really want to use a software based solution, I would go with the Vyatta platform.  It can run BGP for you as well as run various other protocols if needed.  Check out &lt;a href=&quot;http://www.vyatta.com/product/vyatta-network-os/open-source-vs-enterprise&quot; rel=&quot;nofollow&quot;&gt;Vyatta free vs paid&lt;/a&gt; which compares the free version to the paid version.&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="775" LastEditDate="2013-06-03T01:44:54.427" LastActivityDate="2013-06-03T01:44:54.427" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1544" PostTypeId="2" ParentId="1540" CreationDate="2013-06-03T02:50:54.540" Score="1" Body="&lt;p&gt;FYI most of the open source routing daemons perform well at the control plane but how much throughput you're going to get is going to be largely dependent on how well you tune your OS and which NIC's you decide to put in the box. I would agree with the recommendation to look at Vyatta. BIRD and Quagga are also options, if you also need the box to participate in an IGP in addition to BGP. Quagga/BIRD both may do OSPF decently but AFAIK if you need ISIS many of the open source routing daemons are still working on that.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-03T04:44:04.467" LastActivityDate="2013-06-03T04:44:04.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1545" PostTypeId="1" AcceptedAnswerId="1546" CreationDate="2013-06-03T03:14:40.810" Score="9" ViewCount="26391" Body="&lt;p&gt;Whenever logging into a network device using AAA/TACACS+, if I fat-finger the password prompt after the username prompt, the second password prompt &lt;em&gt;always&lt;/em&gt; fails even when the password is correct.  I have to wait for the username prompt again, and must get the password correct on the first password prompt immediately following that.  In other words, any time I see the second password prompt, it will not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the sanitized interaction and config below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;User Access Verification&#xA;Username: user-name&#xA;Password:&#xA;&#xA;Password:    (always fails here)&#xA;% Access denied&#xA;&#xA;User Access Verification&#xA;Username: user-name&#xA;Password:&#xA;&#xA;Connected to s-site-rack-agg2.example.net on line 1 (site-name).&#xA;s-site-rack-agg2#&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What could be different with that second password prompt to account for this behavior?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The typical AAA and related config I have is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;aaa new-model&#xA;aaa authentication login default group tacacs+ local line&#xA;aaa authentication login CONSOLE none&#xA;aaa authentication enable default group tacacs+ enable&#xA;aaa authorization exec default group tacacs+ local if-authenticated&#xA;aaa authorization commands 1 default group tacacs+ local if-authenticated&#xA;aaa authorization commands 7 default group tacacs+ local if-authenticated&#xA;aaa authorization commands 15 default group tacacs+ local if-authenticated&#xA;aaa accounting exec default start-stop group tacacs+&#xA;aaa accounting commands 0 default start-stop group tacacs+&#xA;aaa accounting commands 1 default start-stop group tacacs+&#xA;aaa accounting commands 7 default start-stop group tacacs+&#xA;aaa accounting commands 15 default start-stop group tacacs+&#xA;aaa accounting system default start-stop group tacacs+&#xA;!&#xA;ip tacacs source-interface Loopback0&#xA;tacacs-server host -prmiaryipremoved- single-connection&#xA;tacacs-server host -secondaryipremoved- single-connection&#xA;tacacs-server timeout 10&#xA;tacacs-server directed-request&#xA;tacacs-server key 7 -removed-&#xA;!&#xA;line con 0&#xA; login authentication CONSOLE&#xA;line vty 0 4&#xA; location -removed-&#xA; exec-timeout 60 0&#xA; password 7 -removed-&#xA; transport input telnet ssh&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-03T07:50:06.647" LastActivityDate="2016-09-06T13:12:12.613" Title="AAA/TACACS+ password on Cisco switch always fails at second password prompt" Tags="|cisco|cisco-ios|aaa|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1546" PostTypeId="2" ParentId="1545" CreationDate="2013-06-03T04:30:56.650" Score="4" Body="&lt;p&gt;I would do a debug on your TACACS+ server while you are trying this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll assume that you only want to use TACACS authentication and only fall-back to local logins if it can't access the server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try using this:&lt;br&gt;&#xA;&lt;code&gt;aaa authentication login default group tacacs+ line&lt;br&gt;&#xA; aaa authentication enable default group tacacs+ enable&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also see this site: It has some good examples and explanations&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://my.safaribooksonline.com/book/networking/cisco-ios/0596527225/tacacsplus/i13896__heada__4_2#X2ludGVybmFsX0h0bWxWaWV3P3htbGlkPTA1OTY1MjcyMjUlMkZpNDk5MzNfX2hlYWRhX180XzMmcXVlcnk9&quot; rel=&quot;nofollow&quot;&gt;http://my.safaribooksonline.com/book/networking/cisco-ios/0596527225/tacacsplus/i13896_&lt;em&gt;heada&lt;/em&gt;_4_2#X2ludGVybmFsX0h0bWxWaWV3P3htbGlkPTA1OTY1MjcyMjUlMkZpNTAzNjNfX2hlYWRhX180XzEmcXVlcnk9&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that since you have the &quot;local&quot; keyword in:&lt;br&gt;&#xA;&lt;code&gt;aaa authentication login default group tacacs+ local line&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TACACS+ authentication returns a fail, so the router tries doing local authentication. I guess you should provide us with the &lt;code&gt;line vty&lt;/code&gt; sanitized configuration.&#xA;If you have&lt;br&gt;&#xA;&lt;code&gt;line vty 0 15&lt;br&gt;&#xA;  login local&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it would do a username/password authentication otherwise its doing password&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="343" LastEditDate="2013-06-03T04:37:21.330" LastActivityDate="2013-06-03T04:37:21.330" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1547" PostTypeId="1" AcceptedAnswerId="1548" CreationDate="2013-06-03T04:48:25.687" Score="15" ViewCount="5412" Body="&lt;p&gt;&lt;strong&gt;When is it appropriate to use a /31 network in production&lt;/strong&gt;, and is using them considered good practice?  On a point-to-point link, broadcasts shouldn't be required, so is there any compelling case for just using /31 over /30 as it seems /30s are still widely deployed and prevalent.&#xA;This has been defined by &lt;a href=&quot;http://www.faqs.org/rfcs/rfc3021.html&quot;&gt;RFC 3021&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any use-cases for using a /31 other than to conserve address space?  Does the introduction of /31s bring a new set of concerns that are not found in /30s?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are /31s generally only seen in public space, particularly for ISPs, or are they commonly used in private space too for both ISPs and Enterprises?&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="8499" LastEditDate="2018-12-27T01:03:38.603" LastActivityDate="2018-12-27T01:03:38.603" Title="/31 Point-to-point bitmasks" Tags="|ipv4|subnet|rfc|best-practices|point-to-point|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1548" PostTypeId="2" ParentId="1547" CreationDate="2013-06-03T04:57:11.670" Score="6" Body="&lt;p&gt;I've been using them internally in labs running EIGRP for a bit and haven't find any problem so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I see it if a /24 is allocated for a P2P range.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;/30 bitmask = 64 P2P links&lt;/li&gt;&#xA;&lt;li&gt;/31 bitmask = 128 P2P links&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;/23 allocation&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;/30 bitmask = 128 P2P links&lt;/li&gt;&#xA;&lt;li&gt;/31 bitmask = 256 P2P links&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Alright, I'm not going to bore people w/ subnet math and powers of two. But since we're in the IPv4 exhaustion mode, it allows us to better utilize our given subnet assignments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, in a P2P I see no reason why we need a broadcast address. There are only two hosts in this network. Therefore, any packets destined for broadcast are going to be heard by the other host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, Cisco routers have supported this feature since IOS 12.2(2)T&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-03T04:57:11.670" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1549" PostTypeId="1" AcceptedAnswerId="1552" CreationDate="2013-06-03T05:09:08.697" Score="7" ViewCount="3328" Body="&lt;p&gt;On a Cisco ISR router - would you say there are any benefits from purchasing an HWIC or EHWIC to connect to the next set of switches within the branch network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance. Lets say Gig0/0 and Gig0/1 are routed ports that come on a 2901. Is there really any difference from using Gig0/1 along with sub-interfaces to uplink to the switch versus using Gig1/0/1, from an EHWIC and defining VLAN interfaces then assigning them to the interface as a trunkport.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-03T12:33:39.863" Title="ISR routers - difference between routed and switched ports" Tags="|cisco|cisco-catalyst|router|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1550" PostTypeId="1" AcceptedAnswerId="1551" CreationDate="2013-06-03T05:25:36.570" Score="10" ViewCount="35274" Body="&lt;p&gt;Has anyone ever gotten this message in the middle of converting a &lt;a href=&quot;/tags/capwap&quot; title=&quot;Control And Provisioning of Wireless Access Points&quot;&gt;CAPWAP&lt;/a&gt; access point from CAPWAP to autonomous?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar  1 00:47:59.399: %CAPWAP-3-STATIC_TO_DHCP_IP: Could not discover WLC using static IP. Forcing AP to use DHCP.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This has popped up on both 3600s and 1142s in the middle of the TFTP transfer of the new AP-IOS image halting the conversion process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I followed &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-18268&quot;&gt;these instructions&lt;/a&gt; from Cisco (minus the DHCP section because I had POE injectors plugging directly into a computer for TFTP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a workaround to get the AP converted without a DHCP server?&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="49" LastEditDate="2013-06-03T13:33:58.307" LastActivityDate="2017-10-26T23:11:27.107" Title="converting AP from CAPWAP to autonomous - BVI1 interface gets reverted back to DHCP" Tags="|cisco|wireless|capwap|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1551" PostTypeId="2" ParentId="1550" CreationDate="2013-06-03T05:37:18.190" Score="8" Body="&lt;p&gt;By putting the AP into manual boot mode. You can upload a new image to the AP similar a regular router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debug capwap con cli  &#xA;conf t  &#xA;boot manual  &#xA;reload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should see the &lt;code&gt;ap:&lt;/code&gt; prompt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you issue a &lt;code&gt;set&lt;/code&gt; command you'll see a few variables that you can change.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set IP_ADDR 192.168.0.2  &#xA;set NETMASK 255.255.255.0  &#xA;set DEFAULT_ROUTER 192.168.0.1  &#xA;tftp_init  &#xA;ether_init  &#xA;flash_init  &#xA;tar -xtract tftp://&amp;lt;TFTP_svr&amp;gt;/&amp;lt;Path_to_tar&amp;gt; flash:  &#xA;set BOOT flash:/&amp;lt;image_directory&amp;gt;/&amp;lt;image_name&amp;gt;  &#xA;set MANUAL_BOOT no  &#xA;set  &#xA;boot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="343" LastEditorUserId="-1" LastEditDate="2016-09-28T13:31:06.507" LastActivityDate="2016-09-28T13:31:06.507" CommentCount="3" CommunityOwnedDate="2013-06-03T05:37:18.190" ContentLicense="CC BY-SA 3.0" />
  <row Id="1552" PostTypeId="2" ParentId="1549" CreationDate="2013-06-03T06:53:19.483" Score="6" Body="&lt;p&gt;I would use ESW card in router if I had small office that needs to have 5 users connected. Then I would have router and switch in same device instead of buying a separate 2960 or such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only benefit I see with using EHWIC card would be if you need to use LAN features like port security, private VLAN, DHCP snooping etc. However in the first case you mentioned you would use the router as pure router and leave switching features for a real switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it boils down to if you want to have routing/switching in one device or multiple. The only real use case I see for it is small office that doesn't need 24-p switch. You would only need to manage one device as well.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-06-03T06:53:19.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1553" PostTypeId="2" ParentId="1545" CreationDate="2013-06-03T07:17:31.663" Score="4" Body="&lt;p&gt;I think your configuration is quite dangerous and you seem indecisive if you are using 'enable/line' or 'local' as fallback, correct answer is local, never use 'enable' and especially never 'line' for anything (line is two-way 'encrypted' not one-way hashed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend this configuration instead:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;! uses tacacs, fallsback to local user if tacacs not working&#xA;aaa authentication login default group tacacs+ local&#xA;! user gets enabled by tacacs or by enable password&#xA;aaa authentication enable default group tacacs+ enable&#xA;! console user is authorized as well (gets enabled, if such permission)&#xA;aaa authorization console&#xA;! configuration commands are authorized as well as exec commands (Good to prevent dangerous commands)&#xA;aaa authorization config-commands&#xA;! user privilege level is recovered from tacacs or from local account&#xA;aaa authorization exec default group tacacs+ local&#xA;! level 15 commands are authorized (you really only need this) &#xA;aaa authorization commands 15 default group tacacs+ if-authenticated &#xA;! level 1, 15 commands are logged (you really only need these two)&#xA;aaa accounting commands 1 default start-stop group tacacs+&#xA;aaa accounting commands 15 default start-stop group tacacs+&#xA;!&#xA;! fallback user consulted only when tacacs is broken&#xA;username sikrit privilege 15 secret &amp;lt;password&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;'sikrit' user is to be used when tacacs is not working (it cannot be used if TACACS answers) there is no need for 'line' password under VTY, as it's never consulted. There is no need for 'enable' password, as it is never consulted. If you want non-enabled backup user just create another with 'privilege 1'.&lt;br&gt;&#xA;However I did add support for 'enable' if you want to use it for some reason after all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using OOB, and OOB access is already secured/authenticated, you might want to allow OOB user &lt;em&gt;always&lt;/em&gt; to use local authentication, just in case TACACS is broken but IOS mistakenly thinks it is not, then you'd add something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication login CONSOLE local&#xA;!&#xA;line con 0&#xA; login authentication CONSOLE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-03T07:17:31.663" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1554" PostTypeId="2" ParentId="1549" CreationDate="2013-06-03T07:33:51.653" Score="4" Body="&lt;p&gt;You can apply better QoS to the routed ports on the ISRs. QoS on a 'routed aka svi' vlan port on an HWIC-4ESW etc is not as simple&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-06-03T07:33:51.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1555" PostTypeId="2" ParentId="1547" CreationDate="2013-06-03T07:41:00.380" Score="13" Body="&lt;p&gt;We have used /31s in our core (Brocade, Juniper, Cisco) for over three years with no issues whatsoever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a production ISP network, and hence its appropriate to use them in a production environment as long as your kit supports it, and you've tested it&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-06-03T11:17:30.797" LastActivityDate="2013-06-03T11:17:30.797" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1556" PostTypeId="2" ParentId="1550" CreationDate="2013-06-03T08:23:00.990" Score="0" Body="&lt;p&gt;I know you are asking for workaround without DHCP but just my 2c. You can set up your 3600 as DHCP server providing IP to that AP. Or you can also issue &lt;strong&gt;debug capwap client no-reload&lt;/strong&gt; command to avoid the AP to reload during transfer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But typically I use above commands mentioned by you to convert LAP to AP.&lt;/p&gt;&#xA;" OwnerUserId="1397" LastActivityDate="2013-06-03T08:23:00.990" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1557" PostTypeId="1" AcceptedAnswerId="1670" CreationDate="2013-06-03T11:36:21.223" Score="8" ViewCount="1542" Body="&lt;p&gt;I've been having problems with Cisco Prime 1.3 (and other versions) re-sizing maps once you've put them into the map view. This happens for buildings and floors alike. On the cisco documentation it says this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Step 1    Save the map in .PNG, .JPG, .JPEG, or .GIF format. Note The map&#xA;  can be of any size because Prime Infrastructure automatically resizes&#xA;  the map to fit its working areas.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From my experience, these maps are re-sized based on the width of the work area (i'd say around 800 pixels). The problem I'm having is that some maps are very thin; one is 200 x 800 pixels, which means Prime is re-sizing this map to be 800 x 3200! It only has a few APs on this map, so scrolling the map is just plain annoying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know a way to stop Prime from re-sizing maps in this way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I cannot rotate the building, because the maps are based off a campus map, which requires the buildings to be facing the right direction.&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastActivityDate="2013-06-06T22:53:04.123" Title="Stopping Cisco Prime/NCS from resizing maps" Tags="|cisco|wireless|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1559" PostTypeId="1" CreationDate="2013-06-02T15:16:28.563" Score="6" ViewCount="38968" Body="&lt;p&gt;I have a question regarding tcpdump (capturing all interfaces) and a strange capture I see. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Environment: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 Linux devices connected and configured with VLAN TAG (802.1q). I am pinging between the 2 device vlan interfaces, network wise everything works well. When using tcpdump to capture all interfaces &lt;code&gt;tcpdump –i any –n –e&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am seeing this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first 3 packets looks fine&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Received on the main interface (tagged):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;-6:-45:-40.2216  In 00:11:22:33:44:56 ethertype 802.1Q (0x8100), length 104: vlan 10, p 0, ethertype IPv4, 10.0.0.10 &gt; 10.0.0.1: ICMP&#xA;  echo request, id 2452, seq 487, length 64&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Received on the vlan interface (untagged):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;-6:-45:-40.2217  In 00:11:22:33:44:56 ethertype IPv4 (0x0800), length 100: 10.0.0.10 &gt; 10.0.0.1: ICMP echo request, id 2452, seq 487, length&#xA;  64&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Sent from the vlan interface (untagged):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;-6:-45:-40.2221 Out 00:11:22:33:44:55 ethertype IPv4 (0x0800), length 100: 10.0.0.1 &gt; 10.0.0.10: ICMP echo reply, id 2452, seq 487, length&#xA;  64&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But the fourth sent from the main interface looks erroneous:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;-6:-45:-40.2223 Out 00:11:22:33:44:55 ethertype 802.1Q (0x8100), length 100: vlan 1280, p 2, ethertype Unknown, LLC, dsap SNA (0x04)&#xA;  Group, ssap Unknown (0x3e) Response, ctrl 0x0000: Information, send&#xA;  seq 0, rcv seq 0, Flags [Response], length 80&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When defining the specific interface (eth0 or eth0.10) to tcpdump it looks well:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;tcpdump -i usb0 -n -e&quot;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;em&gt;-6:-13:00.40042 00:11:22:33:44:56 &gt; 00:11:22:33:44:55, ethertype 802.1Q (0x8100), length 102: vlan 10, p 0, ethertype IPv4, 10.0.0.10 &gt; 10.0.0.1: ICMP echo request, id 2452, seq 2442, length 64&#xA;  -6:-13:00.40100 00:11:22:33:44:55 &gt; 00:11:22:33:44:56, ethertype 802.1Q (0x8100), length 102: vlan 10, p 0, ethertype IPv4, 10.0.0.1 &gt; 10.0.0.10: ICMP echo reply, id 2452, seq 2442, length 64&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&quot;tcpdump -i usb0.10 -n –e&quot;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;em&gt;-6:-52:-14.5791 00:11:22:33:44:56 &gt; 00:11:22:33:44:55, ethertype IPv4 (0x0800), length 98: 10.0.0.10 &gt; 10.0.0.1: ICMP echo request, id 2452,&#xA;  seq 94, length 64&#xA;  -6:-52:-14.5795 00:11:22:33:44:55 &gt; 00:11:22:33:44:56, ethertype IPv4 (0x0800), length 98: 10.0.0.1 &gt; 10.0.0.10: ICMP echo reply, id 2452,&#xA;  seq 94, length 64&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Currently, I work with an usb network interface but the same goes for Ethernet (eth0 / eth0.10).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The extra 2 bytes when using &lt;code&gt;–i any&lt;/code&gt; are because Linux adds its Linux cooked 2 bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea, why does tcpdump shows this line when using &lt;code&gt;–i any&lt;/code&gt; ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since traffic is working well, I guess it is just a parsing issue with tcpdump ???&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;&lt;strong&gt;-6:-45:-40.2223 Out 00:11:22:33:44:55 ethertype 802.1Q (0x8100), length 100: vlan 1280, p 2, ethertype Unknown, LLC, dsap SNA (0x04)&#xA;  Group, ssap Unknown (0x3e) Response, ctrl 0x0000: Information, send&#xA;  seq 0, rcv seq 0, Flags [Response], length 80&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1513" OwnerDisplayName="Kimel" LastEditorUserId="762" LastEditDate="2013-06-03T13:10:36.420" LastActivityDate="2018-07-12T10:20:58.837" Title="tcpdump (-i any) with vlan" Tags="|vlan|tcpdump|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1560" PostTypeId="2" ParentId="1549" CreationDate="2013-06-03T12:33:39.863" Score="2" Body="&lt;p&gt;Pros&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Minimize cost and space if you're using only 4-16 devices connected to a G2 router (I believe 4-18 in a G1)&lt;/li&gt;&#xA;&lt;li&gt;Cheaply add routed interfaces (SVIs) to an existing router&lt;/li&gt;&#xA;&lt;li&gt;Cheaply add PoE to a network for a limited port set (though a compact PoE switch like the 3560C or 2960C is probably more cost effective)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Negatives&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Slower routed throughput than the native routed ports&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I'm sure there are more that others can fill in I just don't know what the other negatives are&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We only use them in our colo setup. Was cheaper to have an integrated switch in the G2 router that we supplied than to pay for another RU and a 1U switch.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-06-03T12:33:39.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1561" PostTypeId="2" ParentId="1547" CreationDate="2013-06-03T12:40:12.013" Score="3" Body="&lt;p&gt;Given the prudence and importance of address conservation, the general approach to using a /31 should be &lt;em&gt;&quot;if it works, use it&quot;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, you could take this a step further and start using private space for your point-to-point links, but this obviously can be problematic if you're going to run traceroutes from across the internet rather than within your own network, although even that can be mitigated somewhat by configuring your router to issue ICMP errors with a specific source IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, do whatever you can to waste as few addresses as possible (within the limits of best-practice and feasibility, don't start throwing NAT concentrators up everywhere)&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-03T12:40:12.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1562" PostTypeId="2" ParentId="1559" CreationDate="2013-06-03T12:42:25.713" Score="3" Body="&lt;p&gt;I think tshark can cope with &lt;a href=&quot;http://wiki.wireshark.org/SLL&quot; rel=&quot;nofollow&quot;&gt;cooked capture&lt;/a&gt; today, I rarely if ever use tcpdump anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back when tshark couldn't cope with this (when I was capturing ERSPAN) I wrote &lt;a href=&quot;http://ytti.fi/pcapop&quot; rel=&quot;nofollow&quot;&gt;script&lt;/a&gt; which can pop N bytes out of each frame, quite useful also if you're tunneling over something which is not recognized.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-03T12:42:25.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1563" PostTypeId="2" ParentId="1547" CreationDate="2013-06-03T13:26:42.587" Score="8" Body="&lt;p&gt;As has been said elsewhere, using /31 bit masks can work and is a good way to conserve your available address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is perhaps more import is under what circumstances can't you use /31s?  What protocols or applications could misbehave or break as a result of not having a &lt;a href=&quot;https://en.wikipedia.org/wiki/Broadcast_address&quot;&gt;broadcast address&lt;/a&gt;?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Bootstrap_Protocol&quot;&gt;BootP&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol&quot;&gt;DHCP&lt;/a&gt; are at the top of the list according the the previous article, but we aren't concerned with those on router point-to-point links.  &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_Resolution_Protocol&quot;&gt;ARP&lt;/a&gt; uses a broadcast MAC address - not IP - so shouldn't be any issues there...  &lt;a href=&quot;https://en.wikipedia.org/wiki/Open_Shortest_Path_First&quot;&gt;OSPF&lt;/a&gt; &amp;amp; &lt;a href=&quot;https://en.wikipedia.org/wiki/Enhanced_Interior_Gateway_Routing_Protocol&quot;&gt;EIGRP&lt;/a&gt; both use multicast addresses, &lt;a href=&quot;https://en.wikipedia.org/wiki/Routing_Information_Protocol&quot;&gt;RIP v1&lt;/a&gt; looks like it could be an issue though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What else is dependent on the broadcast or network address?&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2013-06-03T13:26:42.587" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1564" PostTypeId="5" CreationDate="2013-06-03T15:43:45.560" Score="0" Body="&lt;p&gt;Routing is a process performed by a router to transfer packets from a network to another one. It consists in determining the correct destination network based on known routes and sending out the packet on the corresponding interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nowadays the term routing almost always relates to IP routing - i.e. routing IP packets, but it could refers to other -generally deprecated-  protocols like Novell IPX/SPX.&lt;/p&gt;&#xA;" OwnerUserId="165" LastEditorUserId="16930" LastEditDate="2018-03-01T21:28:01.290" LastActivityDate="2018-03-01T21:28:01.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1565" PostTypeId="4" CreationDate="2013-06-03T15:43:45.560" Score="0" Body="For questions about routing, the process of selecting to which network path traffic is sent. Consider using a more specific tag if your question is about a routing protocol like BGP or OSPF." OwnerUserId="165" LastEditorUserId="16930" LastEditDate="2018-03-01T21:27:49.250" LastActivityDate="2018-03-01T21:27:49.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1566" PostTypeId="5" CreationDate="2013-06-03T15:52:33.027" Score="0" Body="&lt;p&gt;A router is a device that forwards data packets between computer networks, creating an overlay internetwork. A router is connected to two or more data lines from different networks. When a data packet comes in one of the lines, the router reads the address information in the packet to determine its ultimate destination. Then, using information in its routing table or routing policy, it directs the packet to the next network on its journey. Routers perform the &quot;traffic directing&quot; functions on the Internet. A data packet is typically forwarded from one router to another through the networks that constitute the internetwork until it reaches its destination node.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most familiar type of routers are home and small office routers that simply pass data, such as web pages, email, IM, and videos between the home computers and the Internet. An example of a router would be the owner's cable or DSL modem, which connects to the Internet through an ISP. More sophisticated routers, such as enterprise routers, connect large business or ISP networks up to the powerful core routers that forward data at high speed along the optical fiber lines of the Internet backbone. Though routers are typically dedicated hardware devices, use of software-based routers has grown increasingly common.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Router_%28computing%29&quot; rel=&quot;nofollow&quot;&gt;Router (computing) - Wikipedia&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="165" LastEditorUserId="165" LastEditDate="2013-06-03T16:43:11.997" LastActivityDate="2013-06-03T16:43:11.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1567" PostTypeId="4" CreationDate="2013-06-03T15:52:33.027" Score="0" Body="For questions about network routers, devices that forward data packets between computer networks, commonly at the network layer (layer 3) of the OSI model." OwnerUserId="165" LastEditorUserId="8499" LastEditDate="2016-11-29T21:10:56.053" LastActivityDate="2016-11-29T21:10:56.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1568" PostTypeId="2" ParentId="1440" CreationDate="2013-06-03T16:13:21.730" Score="2" Body="&lt;p&gt;Two satellite vendors that I worked with (10 years ago) were.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hughes.com/&quot; rel=&quot;nofollow&quot;&gt;Hughes Networks&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.gilat.com/&quot; rel=&quot;nofollow&quot;&gt;Gilat Satellite Networks&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both have &lt;a href=&quot;http://en.wikipedia.org/wiki/Very-small-aperture_terminal&quot; rel=&quot;nofollow&quot; title=&quot;Very Small Aperture Terminal&quot;&gt;VSAT&lt;/a&gt; options that involve a lot of &quot;spoofing&quot; similar to what Riverbed does on the WAN.  They'll terminate the TCP connection at the earth-terminal on each end to make the client think things are faster than they are.&lt;/p&gt;&#xA;" OwnerUserId="165" LastActivityDate="2013-06-03T16:13:21.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1570" PostTypeId="2" ParentId="1545" CreationDate="2013-06-03T18:51:50.173" Score="4" Body="&lt;p&gt;I'm not sure your local device config would be to blame for this, but rather your TACACS server itself. TACACS proxies the username/password prompt from the TACACS server (and possibly an external identity store) to the device, so if you're using ACS (for example) and have it set up to talk to AD to do user authentication, you need to think of the username/password prompt as coming from a domain controller rather than the device itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently ran into an issue exactly like this that was fixed by a patch to ACS - again, I'm assuming that you're using ACS and have it pulling from AD for user auth/group verification etc. The Cisco bug ID was CSCtz03211 and basically ACS 5.3 was sending multiple authen attempts to AD per one single &quot;username/password&quot; authen attempt to the device. This would result in the behavior where if a user fat-fingered the password on the first attempt, multiple instances of the erroneous username/password combo were sent to AD and the user's account was actually locked out, thus resulting in subsequent failed login attempts to the device even if a user typed their username/password correctly on the second try (this behavior of course varies with the lockout thresholds you have set on user accounts within AD). The device itself would of course just give unhelpful &quot;login failed&quot; messages, but the giveaway lied in the ACS TACACS authentication logs where we saw that the account was locked out, so I'd advise looking there for any clues as to what might be causing your problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just something to consider (without knowledge of your TACACS server implementation).&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-03T20:41:20.653" LastActivityDate="2013-06-03T20:41:20.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1571" PostTypeId="1" AcceptedAnswerId="1572" CreationDate="2013-06-03T19:39:34.960" Score="14" ViewCount="1986" Body="&lt;p&gt;I noticed in the running config I don't see the &lt;code&gt;no synchronization&lt;/code&gt; command under the BGP section. Is this a default command so I won't see it unless I change it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware / software&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Cisco 1921&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;c1900-universalk9-mz.SPA.151-4.M5&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="108" LastEditorUserId="762" LastEditDate="2013-06-03T21:28:26.723" LastActivityDate="2013-06-03T22:47:19.780" Title="BGP &quot;no synchronization&quot; command not showing up in running-config" Tags="|cisco|cisco-commands|cisco-ios-15|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1572" PostTypeId="2" ParentId="1571" CreationDate="2013-06-03T19:41:32.293" Score="18" Body="&lt;p&gt;In most modern versions of IOS (since 12.2(8)T - thanks @ytti) BGP synchronization is disabled by default (and shown in the running config as such, ie &lt;code&gt;no synchronization&lt;/code&gt; shows up in &lt;code&gt;show run&lt;/code&gt; when you turn on BGP). As to which IOS version they decided to make it a &quot;hidden default&quot;, I'm not entirely too sure, but you should be able to do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show running-config all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show running-config full&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To get the router to show the entirety of the running config, including the defaults which are normally hidden. Look for &lt;code&gt;no synchronization&lt;/code&gt; in there.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-03T22:47:19.780" LastActivityDate="2013-06-03T22:47:19.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1573" PostTypeId="2" ParentId="1440" CreationDate="2013-06-03T21:00:04.313" Score="10" Body="&lt;p&gt;I used to deploy WAN acceleration devices for a hardware vendor about 6 years ago. Not much has really changed since then except I won't make hardware recommendations because of consolidation and changing product lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of these devices use some combination of compression and caching to reduce the overall traffic to be transmitted, TCP pre ack'ing to reduce the effects of &lt;a href=&quot;https://en.wikipedia.org/wiki/Bandwidth-delay_product&quot;&gt;bandwidth delay product&lt;/a&gt; (this is the TCP window effect that you alluded to above) and ganging of undersized packets to insure that packets traversing the links are as full as possible reducing the effect of overhead. The various vendors will throw in their own patented technologies as well, but they mostly boil down to different flavors of these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While caching is a major help, just the pre-ack'ing of packets over a satellite link will go a long way to making them usable, so that even if your data isn't cacheable for whatever reason (encrypted, compressed, zipped, always changing drastically, etc) if you have a slow enough RTT the pre-ack'ing will partially eliminate the bandwidth delay product and help you get closer to your nominal bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the whole goal is to drive up network efficiency and allow higher utilization of your bandwidth, it's very important that underlying network problems that may pop up with high utilization are fixed before deploying a solution. If you have duplex mismatches or are running on half-duplex connections you'll often find that performance is worse than before you deployed wan optimization devices. Often I would find that customers didn't realize that they had some links that had auto-negotiated down to the lowest common denominator of 10 Mbps half duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many of these devices also offer Forward Error Correction (which your modems probably offer as well) which you can use to overcome some of the effect of packet loss on your links. This is important since the packet stuffing means that more than one LAN packet could be lost for each WAN packet that gets lost and because of the pre-ack'ing those packets have already been acknowledged to the servers. Make sure that you know which devices in your path are performing FEC so that you don't create more overhead than necessary since this will of course reduce your effective throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speaking from experience, I saw customers without significant caching able to do 'acceptable' (mostly one way) video conferencing over a double satellite hope whose latency ranged from 900 ms to 2 seconds and might have 15-25% packet loss for extended periods. I wouldn't choose to use the resulting flow, but if that's what you have it'l work.&lt;/p&gt;&#xA;" OwnerUserId="15" LastActivityDate="2013-06-03T21:00:04.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1577" PostTypeId="1" AcceptedAnswerId="1585" CreationDate="2013-06-04T02:26:48.450" Score="5" ViewCount="6782" Body="&lt;p&gt;I understand the risks of using third party ram but paying for the Cisco branded memory modules and CF cards on an old ASA which is no longer covered but Smartnet is ludicrous. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are plenty of third parties who claim they sell compatible RAM. Does anyone have any experience as to what memory the ASA 5520 or any of the 55x0 series is compatible with?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;speed (PC-xxxx or DDR-xxxx)&lt;/li&gt;&#xA;&lt;li&gt;type (regular, ECC, buffered..etc)&lt;/li&gt;&#xA;&lt;li&gt;sizes: (512, 1Gb, 2Gb DIMMS)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="343" LastEditorDisplayName="user36472" LastEditDate="2018-02-14T16:39:43.320" LastActivityDate="2018-02-14T16:39:43.320" Title="upgrade RAM on a Cisco ASA 5520" Tags="|cisco|cisco-asa|memory|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1581" PostTypeId="1" CreationDate="2013-06-04T06:37:36.000" Score="14" ViewCount="2846" Body="&lt;p&gt;We were on redundancy test of Etherchannel and Routing on our network. During this intervention we made some measurement. Our monitoring tool is Cacti for graph. &#xA;The equipment monitored is a 4500-X on VSS. Each link is on a different physical chassis.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Schema :   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fBBef.png&quot; alt=&quot;etherchannel 1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test chronology :&lt;br&gt;&#xA;[t0] Link on te1/1/14 port was physically removed. The Te2/1/14 is active. Po1 is operational.&lt;br&gt;&#xA;[t0+15] Link on Te1/1/14 port returned to service and checked that the port back in etherchannel Po1&lt;br&gt;&#xA;[t0+20] Link on te1/1/14 port was physically removed. The Te2/1/14 is active. Po1 is operational.&lt;br&gt;&#xA;[t0+35] Link on Te1/1/14 port returned to service and checked that the port back in etherchannel Po1  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In our tests, we monitored traffic etherchannel Po1 through Cacti (graph below) and noticed a significant change in the value of the flow when we disabled the te1/1/14 link (link te2/1/14 assets) rather stable during the reverse. We checked too the counters on  int Po1 and these were maintained fairly stable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5IlBc.png&quot; alt=&quot;Graph&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two interface of 10G are bundled on Etherchannels with LACP configured. Inside the etherchannel their is 2 vlans. One for Multicast traffic and another for Internet/All Traffic.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know a possible cause of this behavior ?&lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2013-06-04T07:22:26.653" LastActivityDate="2013-06-04T16:54:34.477" Title="Why we get high fluctuation on bandwidth measurement Cacti graph?" Tags="|cisco|switch|monitoring|vss|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1583" PostTypeId="2" ParentId="1581" CreationDate="2013-06-04T08:56:45.020" Score="11" Body="&lt;p&gt;To extend ytti's comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your poll interval seems really small, every 10 seconds if I'm reading right. There's a few reasons you could get that result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Equipment side:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Bad choice of counters, if you're using 32-bit counters they could be rolling over every ~3.4 seconds if you're running a 10g interface at line rate&lt;/li&gt;&#xA;&lt;li&gt;Counter updating, many larger devices only update counters two or three times a minute, and they can never be relied on to be in sync. Every 30 seconds is as low as I'd bother polling, and even then I'd always want at least two points before triggering any alert or taking action&lt;/li&gt;&#xA;&lt;li&gt;There can be a gotcha as packets sent for CPU processing (netflow perhaps) may be counted straight away vs those not going to RE being batched (have seen this on Juniper MX)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Poller side:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is the poller polling accurately at the interval, and if not is it injecting its result with the actual polling time (eg, x bits in y.z seconds) so a sensible rate can be calculated&lt;/li&gt;&#xA;&lt;li&gt;What happens when counters reset, or SNMP GET's aren't responded to, different tools respond to these in different ways&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-06-04T08:56:45.020" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1585" PostTypeId="2" ParentId="1577" CreationDate="2013-06-04T09:16:50.777" Score="6" Body="&lt;p&gt;Assuming it's a real 5520 and not a fake that's actually a converted 5510 (yep, a bunch of those were floating around - you'll know it by the fact it's only got a single RAM slot) you'll want PC3200 with CAS latency (CL) of 3 running at 400MT/s, unbuffered, ECC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure if the ASAs are also picky about the chip arrangement too, so if you want to play it super safe, make sure the RAM you buy has the memory spread across 8 chips.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-04T09:16:50.777" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1586" PostTypeId="1" AcceptedAnswerId="1587" CreationDate="2013-06-04T09:25:44.260" Score="37" ViewCount="8199" Body="&lt;p&gt;So, I'm reading for a networking exam, and I'm just wondering if I have missed something basic. Is there a need for more ip addresses than MAC addresses, and how would a node with one network adapter be assigned many ip addresses in that case?&lt;/p&gt;&#xA;" OwnerUserId="1530" LastEditorUserId="267" LastEditDate="2013-06-04T11:25:04.907" LastActivityDate="2018-05-24T15:41:47.833" Title="Why does ipv6 specify 128 bit address, when there are only 48 bits in MAC addresses?" Tags="|ipv6|mac-address|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1587" PostTypeId="2" ParentId="1586" CreationDate="2013-06-04T09:46:27.430" Score="39" Body="&lt;p&gt;MAC addresses only need to be unique in a local broadcast domain, not globally, so re-use of MAC addresses in different networks usually isn't a problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internet isn't one global broadcast domain and thus needs to be divided into many blocks of addresses assigned to different ISP's and each ISP divides his blocks into smaller blocks for different customers/services. To allow each of these smaller blocks to contain many MAC addresses you need to have the IP-space much bigger than the MAC address space.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-06-04T09:46:27.430" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1588" PostTypeId="2" ParentId="1581" CreationDate="2013-06-04T10:13:53.180" Score="6" Body="&lt;p&gt;Your problem is as such, that your router sampling and your own polling are not hitting the same moment. That is, even though polling interval is static, polling intervals contain different amount of samples, which your math does not take into account.&lt;br&gt;&#xA;Consider you've polled t1,t2,t3 but router didn't sample anything at t1,t2 interval, so all of the traffic between t1,t3 ended up at t2,t3 polled value. Causing your rate to be 0 at t1,t2 and over linerate at t2,t3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm going to suggest one solution, but please verify this with someone who has cursory understanding of math.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First figure out interface you're interested in (if ge-1/1/1):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;snmpbulkwalk SWITCH ifDescr|grep ge-1/1/1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Then you'll see its ifIndex number, let's assume it is '42'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then do something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;while true; do&#xA;  snmpbulkwalk SWITCH ifHCInOctets.42 &amp;gt;&amp;gt; DATA&#xA;  date &amp;gt;&amp;gt; DATA&#xA;  sleep 1&#xA;done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now analyze results to determine how often on average the counters are actually being updated. (I can produce script for the analysis if needed)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then comes the part where we'd need math, but I'll suggest one naive solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your update interval is 10s, poll box every 5s, i.e. twice as often as it is updated. Then your samples would be &lt;/p&gt;&#xA;&#xA;&lt;p&gt;t0, t5, t10, t15, t20, t25, t30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now this would be your raw data, which you wouldn't use, but you'd rather recover actual samples from it like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s1 = (t0+t5+t10)/3&#xA;s2 = (t10+t15+t20)/3&#xA;s3 = (t20+t25+t30)/3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Rationale here is, that we want to leak over the borders to reduce the effect of inaccurate polling intervals at your switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'd then plot the s1, s2, s3 and you should have much more smooth/accurate result than what you are seeing now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I'm sure this is not novel problem and I'm sure there is formal solution how to recover optimal accuracy, unfortunately producing that solution is out of my skill set. Something math.stackexchange people would be better equipped to tackle.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-06-04T10:28:35.310" LastActivityDate="2013-06-04T10:28:35.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1589" PostTypeId="2" ParentId="1586" CreationDate="2013-06-04T10:46:38.250" Score="16" Body="&lt;p&gt;Not all types of network interfaces use MAC addresses. MAC addresses are mostly associated with Ethernet, though quite a few other networking standards do use it. However, an IPv6 address can still be assigned to a network interface that doesn't use MAC addresses for Layer 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also of note, a MAC address can be converted to an IPv6 host portion through EUI-64 conversion (mostly used for stateless autoconfiguration), by inserting the hexadecimal values FFFE between the leftmost and rightmost 24-bits of the 48-bit MAC address, and the seventh bit gets inverted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for example, 0c:3a:bb:2a:cd:23 can be converted to the host portion of a stateless autoconfiguration IPv6 address. 0c in the above MAC addresses, represented as 0000 1100 in binary, would become 0000 1110 in binary or 0e in hexadecimal. Therefore the final EUI-64 host portion of the IPv6 address, converted from the MAC address, would be 0e:3a:bb:ff:fe:2a:cd:23.&lt;/p&gt;&#xA;" OwnerUserId="572" LastEditorUserId="561" LastEditDate="2013-06-04T19:45:39.977" LastActivityDate="2013-06-04T19:45:39.977" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1590" PostTypeId="2" ParentId="1586" CreationDate="2013-06-04T13:23:43.150" Score="6" Body="&lt;p&gt;Also, there's some layer 2 protocols with more than 48 bits in their MAC, for example Fibre Channel has 64-bit (or 128-bit apparently according to Wikipedia) as does FireWire (well, kinda), so they can fit in a /64 without the potential of overlap.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-06-04T13:23:43.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1591" PostTypeId="2" ParentId="1581" CreationDate="2013-06-04T14:21:04.183" Score="3" Body="&lt;p&gt;Since you are polling at the same rate as the counters are updated you are likely out of sync.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By configuring&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server hc poll &amp;lt;&amp;lt;hundredths of a second&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can reduce the interval in which the SNMP counters are updated to something like 1 second.  This should result in a more accurate value for the throughput when you are polling every 10 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI, this is a hidden command.&lt;/p&gt;&#xA;" OwnerUserId="176" LastEditorUserId="176" LastEditDate="2013-06-04T16:54:34.477" LastActivityDate="2013-06-04T16:54:34.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1592" PostTypeId="1" AcceptedAnswerId="1594" CreationDate="2013-06-04T15:16:26.127" Score="16" ViewCount="5482" Body="&lt;p&gt;Consider the following scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 PC's (PC1 and PC2) that wants to transmit at the same time to PC3 in a full duplex ethernet switch. Let's consider that all ports are in the same VLAN, so what happens internally in the switch? Who transmits first to PC3?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read before that &lt;a href=&quot;/tags/csma-cd&quot; title=&quot;Carrier Sense Multiple Access with Collision Detection&quot;&gt;CSMA/CD&lt;/a&gt; was used, but only it was used in earlier Ethernet versions that operated in half-duplex, and each port of the switch was a collision domain and if 2 machines attempted to transmit at the same time, an algorithm was executed to give a random time to each computer to transmit and solve the collisions problem. However, in a full duplex switch I read that the possibility of a collision is eliminated so, if 2 PCs attempt to transmit at the same time, what happens internally in the switch? Does the switch execute an algorithm to choose who transmit first?&lt;/p&gt;&#xA;" OwnerUserId="1535" LastEditorUserId="762" LastEditDate="2013-06-04T16:49:55.470" LastActivityDate="2015-07-08T09:10:56.310" Title="What happens when 2 computers transmits at the same time to a 3rd one in a full duplex switch?" Tags="|cisco|cisco-catalyst|switch|ethernet|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1593" PostTypeId="2" ParentId="1592" CreationDate="2013-06-04T15:19:21.613" Score="3" Body="&lt;p&gt;There will always be SOME difference in when the two computers send to the third, unless you are doing anything special on the switch it will be transmitted on a FIFO basis so whichever frame arrives first will be transmitted first.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-06-04T15:19:21.613" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1594" PostTypeId="2" ParentId="1592" CreationDate="2013-06-04T15:26:48.260" Score="14" Body="&lt;p&gt;The switch will fully load the incoming frames of data, from the two sending systems, into its buffer(s). I'm not sure how it determines which frame would be first in the queue for subsequent forwarding; but it's probably based on initial receive time of the beginning of the frame. Then the switch works through the transmit buffer queue sending the frames out one-by-one onto the destination port/segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's no issue with frames &quot;running into each other.&quot; The real issue is can the ultimate port/segment accept the frames fast enough. (And, of course, can the switch process its buffer/queues fast enough.)&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-06-04T15:26:48.260" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="1595" PostTypeId="2" ParentId="1592" CreationDate="2013-06-04T16:12:58.233" Score="6" Body="&lt;p&gt;Very interesting question which unfortunately does not have any single correct answer, as the exact solution varies from hardware to hardware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However this problem is explicitly discussed in &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1558605142&quot; rel=&quot;noreferrer&quot;&gt;Computer Networks - a Systems Apparoch&lt;/a&gt; at page 231-232. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The gist of the solution for design called 'Sunshine Switch' is that you have diagram input--batcher--trap--selector==banyan===outputs and there is delay box which connects selector to batcher. And I quote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When more than l (ed. size of banyan) packets are are destined for a&#xA;  single output in the same cycle, they are recirculated through the&#xA;  delay box and resubmitted to the switch in the next cycle.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And further:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The trap network identifies those packets that will be able to exit&#xA;  the switch through the banyans (up to l of them per output port) and&#xA;  marks the rest for recirculation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-04T16:12:58.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1596" PostTypeId="1" AcceptedAnswerId="1597" CreationDate="2013-06-04T17:36:31.933" Score="11" ViewCount="5826" Body="&lt;p&gt;You issue the command &lt;code&gt;ssh 192.168.97.97&lt;/code&gt; from a IOS device and the destination IOS router/switch SSH server is accepting both SSH versions. Being that you did not specify a version to use on the SSH client, which version of SSH will be used to connect to the IOS SSH server?&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-06-04T18:48:03.633" Title="Cisco IOS built-in SSH client default version" Tags="|switch|router|cisco-ios|ssh|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1597" PostTypeId="2" ParentId="1596" CreationDate="2013-06-04T17:42:41.080" Score="12" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk583/tk617/technologies_tech_note09186a00800949e2.shtml&quot;&gt;ssh version 2&lt;/a&gt; for IOS 12.1(19)E and later&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SSH from one switch to another... for reasons I can't explain, Cisco calls SSHv2 SSH-1.99...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SRV1#debug ip ssh client&#xA;SSH Client debugging is on&#xA;SRV1#ssh 10.19.1.2&#xA;&#xA;Password:&#xA;Jun  4 13:45:28.747 CDT: SSH1: sent protocol version id SSH-1.99-Cisco-1.25   &amp;lt;-----&#xA;Jun  4 13:45:28.787 CDT: SSH CLIENT0: protocol version id is - SSH-1.99-Cisco-1.25&#xA;Jun  4 13:45:28.787 CDT: SSH CLIENT0: sent protocol version id SSH-1.99-Cisco-1.25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also from linux when connecting to IOS...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@something ~]$ ssh -v dst1&#xA;OpenSSH_5.3p1, OpenSSL 1.0.0-fips 29 Mar 2010&#xA;debug1: Reading configuration data /etc/ssh/ssh_config&#xA;debug1: Applying options for *&#xA;debug1: Connecting to dst1 [10.19.1.1] port 22.&#xA;debug1: Connection established.&#xA;debug1: identity file /home/mpenning/.ssh/identity type -1&#xA;debug1: identity file /home/mpenning/.ssh/id_rsa type 1&#xA;debug1: identity file /home/mpenning/.ssh/id_dsa type -1&#xA;debug1: Remote protocol version 1.99, remote software version Cisco-1.25     &amp;lt;-------&#xA;debug1: no match: Cisco-1.25&#xA;debug1: Enabling compatibility mode for protocol 2.0                         &amp;lt;--------&#xA;debug1: Local version string SSH-2.0-OpenSSH_5.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-04T18:48:03.633" LastActivityDate="2013-06-04T18:48:03.633" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1598" PostTypeId="5" CreationDate="2013-06-04T17:53:46.637" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-06-04T17:53:46.637" LastActivityDate="2013-06-04T17:53:46.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1599" PostTypeId="4" CreationDate="2013-06-04T17:53:46.637" Score="0" Body="Secure Shell or SSH is a network protocol that allows secure communication. For most it is a preferred alternative to Telnet when available. SSH can use automatically or manually generated keys for authentication." OwnerUserId="736" LastEditorUserId="736" LastEditDate="2013-06-04T18:29:24.250" LastActivityDate="2013-06-04T18:29:24.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1600" PostTypeId="2" ParentId="1577" CreationDate="2013-06-04T19:01:12.940" Score="5" Body="&lt;p&gt;The ASA's aren't commodity PCs.  As such, they aren't as robust or forgiving, and are &lt;em&gt;insanely&lt;/em&gt; picky about memory.  Even if you think you have all the variables correct, you can still miss one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen 3rd party memory work in one device, but not another, memory that appears to work until the ASA is software rebooted, etc. It's very telling that Crucial, who makes modules for just about everybody and everything, doesn't list any ASAs.  Memoryx lists &quot;certified&quot; (they promise they'll work) modules, but wisely doesn't tell you the exact specs.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-04T19:01:12.940" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1601" PostTypeId="2" ParentId="123" CreationDate="2013-06-04T19:02:05.533" Score="2" Body="&lt;p&gt;Don't forget that you can also run 802.1x on wired ports.  802.1x can prevent unauthorized devices and port-security helps prevent someone from hooking up a switch and tailgating the port.  Remember that even with the best network controls in place, you must take measures at the PC level or users will simply be able to run NAT on their PC and bypass your network security measures.&lt;/p&gt;&#xA;" OwnerUserId="1546" LastActivityDate="2013-06-04T19:02:05.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1602" PostTypeId="1" AcceptedAnswerId="1604" CreationDate="2013-06-04T19:05:03.410" Score="11" ViewCount="838" Body="&lt;p&gt;I have a BGP session with a transit provider in two different cities.  We are both using the same AS at both locations.  I am expecting them to be sending me &lt;a href=&quot;/tags/med&quot; title=&quot;Multi-Exit Discriminator&quot;&gt;MED's&lt;/a&gt; for me to use for routing decisions of outbound traffic.  (ie. so I can send traffic to the router that is nearest my destination, other customers in the same city)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How can I verify that I am really receiving those MED's?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have Brocade XMR's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I do a &lt;code&gt;show ip bgp routes&lt;/code&gt;, I see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Total number of BGP Routes: 445744&#xA;Status A:AGGREGATE B:BEST b:NOT-INSTALLED-BEST C:CONFED_EBGP D:DAMPED&#xA;       E:EBGP H:HISTORY I:IBGP L:LOCAL M:MULTIPATH m:NOT-INSTALLED-MULTIPATH&#xA;       S:SUPPRESSED F:FILTERED s:STALE&#xA;       Prefix             Next Hop        MED        LocPrf     Weight Status&#xA;2      1.0.0.0/24         4.53.x.x     0          100        0      BE&#xA;         AS_PATH: 3356 15169&#xA;3      1.0.4.0/22         4.53.x.x     0          100        0      BE&#xA;         AS_PATH: 3356 3549 6939 6939 7545 56203&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Browsing through several pages of the output, the MED always shows 0.  I don't want to manually check all 1/2 million routes.&lt;/p&gt;&#xA;" OwnerUserId="412" LastEditorUserId="49" LastEditDate="2013-06-05T15:54:05.470" LastActivityDate="2013-06-05T15:54:05.470" Title="How can I check to see if I am receiving MED's?" Tags="|bgp|brocade|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1603" PostTypeId="2" ParentId="1586" CreationDate="2013-06-04T19:29:15.807" Score="4" Body="&lt;p&gt;IPv6 SLAAC can only generate one address per prefix as it's using the MAC to generate a &lt;em&gt;reasonably&lt;/em&gt; unique address.  Privacy extensions can generate one or more pseudo-random addresses which are then checked for any overlaps on the local segment.  Of course, local administrators can assign as many static addresses as they wish -- it's their job to ensure no overlaps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[By &lt;em&gt;reasonably unique&lt;/em&gt; I mean the likelihood of a collision is nil.  And if it does, you'll have a layer-2 problem first! (two machines on the same segment with the same MAC)]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-04T19:29:15.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1604" PostTypeId="2" ParentId="1602" CreationDate="2013-06-04T19:31:56.837" Score="7" Body="&lt;p&gt;Removing previous answer as I misunderstood the question, and my previous answer was actually incorrect - MED is exchanged between peer ASN's but is not propagated beyond that (meaning it won't transit an AS to propagate to another AS). However it's still an optional attribute, so it's not required of an implementation to pass on the MED between eBGP/iBGP speakers. MED is typically only evaluated in the best path selection process if there are multiple paths coming from the same AS (relevant in your scenario).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you've got the same provider at both locations it's likely that they'd set a MED on all of the prefixes rather than a subset, and if you don't see that in your output, it's likely that they're not sending you MED's. However it's also a possibility that they're only setting MEDs on aggregates that the provider actually owns rather than peer/customer prefixes. This doesn't mean that you can't set the MED yourself as part of your inbound policy for your iBGP routers to pay attention to however. Also consider &lt;strong&gt;sending&lt;/strong&gt; MEDs to your provider to force them to do cold-potato routing towards you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: to also include @MikePennington's good and relevant info and depending on your design, your IGP will also solve this problem for you without the need to worry about setting MEDs or LP values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your question, you could create a route-map with a match clause that matches a given MED value, and then do &lt;code&gt;show ip bgp routes route-map [route-map-name]&lt;/code&gt;. For this I'd recommend something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map ONLY-MED deny 10&#xA;    match metric 0&#xA;route-map ONLY-MED permit 20&#xA;&#xA;# show ip bgp routes route-map ONLY-MED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This &lt;em&gt;should&lt;/em&gt; show you all the prefixes that don't have a MED of 0 set.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-04T21:22:03.190" LastActivityDate="2013-06-04T21:22:03.190" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1606" PostTypeId="1" CreationDate="2013-06-04T22:23:05.443" Score="10" ViewCount="1086" Body="&lt;p&gt;If I have two datacenter sites that are considered redundant to each other. Is it possible to sync firewall configuration from the primary to the backup? What is the best way to keep both firewalls updated at the same time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, what is required?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Equipment used:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Main DC&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Two Cisco ASA's running 8.2.5&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Remote DC&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Two Cisco ASA's running 8.6&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The link between the two DC's is a a L2 link connecting both DC cores. The ASA's connects to each core. &lt;/p&gt;&#xA;" OwnerUserId="1477" LastEditorUserId="762" LastEditDate="2013-06-05T06:23:55.180" LastActivityDate="2016-03-15T09:11:45.310" Title="Firewall Replication" Tags="|cisco-asa|redundancy|failover|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1608" PostTypeId="1" AcceptedAnswerId="1609" CreationDate="2013-06-05T00:23:25.870" Score="15" ViewCount="5718" Body="&lt;p&gt;I am in the process of designing the network for a new office space. To give a little bit of background...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will only be one network closet to start with potential for an IDF in the future. This closet will have approximately 600 termination points. My question comes down to design. Is this too much for one rack? Should I split this into two racks? My only thought with why this should happen is strictly ease of cable management.&lt;/p&gt;&#xA;" OwnerUserId="1551" LastEditorUserId="775" LastEditDate="2013-06-05T01:24:49.840" LastActivityDate="2013-12-29T19:36:50.063" Title="Ethernet termination density per rack and space planning" Tags="|idf|patch-panel|rack-layout|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1609" PostTypeId="2" ParentId="1608" CreationDate="2013-06-05T00:43:09.480" Score="21" Body="&lt;p&gt;I would consider this too much for one rack.  You always want to leave yourself at least some space for the future.  I have seldom been in situations where less space is used in a rack over time, rather quite often the opposite (you end up needing more).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Figure it this way: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Typical 48 port switch = 1U&lt;/li&gt;&#xA;&lt;li&gt;Typical 48 port patch panel = 2U&lt;/li&gt;&#xA;&lt;li&gt;Typical full rack = 42U&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For 600 terminations, you will need about 39U worth of switches and patch panels, which doesn't leave much room, especially for things like UPSes or any other equipment.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you decide you want any horizontal cable management, there isn't room unless integrated into the patch panels and then depending on brand/model, these may be 3U.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you go with a chassis based switch solution (now or the future), this also wouldn't work as usually these are not as space efficient (while line cards take up only 1U, their power supplies will take up additional space).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to add more cabling in the future, again you wouldn't have space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go for the second rack and give yourself some space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Adding this to comment on some of the other answers.  I left the actual rack layouts out of my answer originally as they are an issue for much discussion as there is no &quot;correct&quot; way to do it.  While several good ideas are proposed, a rack design/layout has to address the concerns of your environment and what will provide your organization a reliable and manageable solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While there are some things that should be done for any proper installation (racks should be properly grounded, if you use two post racks a ladder rack or other means of securing/stabilizing the top should be installed, etc), many of them come down to personal preference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, some cabling companies will tell you that you should not put patch panels on the lower 1/3-1/2 of the rack, as it is harder to terminate and prone to more errors.  Some will say you shouldn't do any sort of patch panel/switch/patch panel layout as getting access to the back of the patch panels (for additional cabling or repairs) can be restricted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In earthquake prone areas, some people will tell you that you should mount your equipment in the bottom half of the rack (with heaviest items - UPSes - at the bottom) as this provides a more stable rack.  The more weight at the top of the rack, the more the rack has a tendency to sway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, you should put thought into any rack design.  Think through the tasks that you will be doing most often, the tasks that are prone to mistakes/errors or can affect other connections, the amount of space you have, your budget and any other considerations the job/site may have.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-06-05T15:24:09.677" LastActivityDate="2013-06-05T15:24:09.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1610" PostTypeId="2" ParentId="1608" CreationDate="2013-06-05T00:48:59.643" Score="7" Body="&lt;p&gt;I usually trade off space for neatness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My typical layout is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1U 24P Patch Panel&lt;/li&gt;&#xA;&lt;li&gt;2U Cable Organizer&lt;/li&gt;&#xA;&lt;li&gt;1U 48P Switch&lt;/li&gt;&#xA;&lt;li&gt;2U Cable Organizer&lt;/li&gt;&#xA;&lt;li&gt;1U 24P Patch Panel&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;1' patch cables from top patch panel to the top row of ports on the switch. 1' cables from the bottom patch panel to the bottom row of ports on the switch. These all go under the covers from the cable organizers hiding all cabling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeat from top to bottom in the rack, 5 sets will fit in a 42U with the bottom 6U used for:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1U PDU #2 plugs into UPS #2&lt;/li&gt;&#xA;&lt;li&gt;1U PDU #1 plugs into UPS #1&lt;/li&gt;&#xA;&lt;li&gt;2U UPS #2&lt;/li&gt;&#xA;&lt;li&gt;2U UPS #1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then power supply 1 from the switches go into PDU 1. And power supply 2 from switches goes into PDU 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Very neat but uses more space than a lot of people would prefer. Easy to keep track of patch panel ports connecting to switch ports (top row is odd, bottom is even... depending on switch model). Limits you to 240 ports in a 42U rack.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-06-05T00:48:59.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1611" PostTypeId="2" ParentId="1608" CreationDate="2013-06-05T01:21:36.000" Score="9" Body="&lt;p&gt;600 ports would be 25U of 24port panels, &lt;em&gt;just for the RJ45s&lt;/em&gt;!  Once switches, cable management, and power are added in, that's going to be a very full rack.  And it's going to have poor air flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be done in one rack frame, but you lose some on cable management and future expandability. As this sounds like an &quot;infrastructure wiring&quot; situation, once those patches are terminated, you should never try to move them -- even with slack planned-in, there's a mess of &lt;strong&gt;&lt;em&gt;600&lt;/em&gt;&lt;/strong&gt; cables in the back of that rack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend two racks, minimum.  All the termination on one rack, with horizontal &quot;feed-thru&quot; cable managers -- the ones with fingers or a tray out the back to limit how much tangling can occur.  And an equipment rack next to it for the switches, power, ups, etc.  In this configuration, the cabling is left to be nearly static, while the switch and power infrastructure parts can be changed as necessary as needs and technologies change. (eg. you may only need 120 ports lit at the moment that could be done with 3-4 48port 1U individual or stacked switches, and then move to a larger chassis switch later.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-05T01:21:36.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1612" PostTypeId="2" ParentId="1302" CreationDate="2013-06-05T03:47:37.893" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd8029d629.html&quot; rel=&quot;nofollow&quot;&gt;IPSec VTI&lt;/a&gt; is another option. I don't believe it is supported on ASA, but it is something to be aware of.&lt;/p&gt;&#xA;" OwnerUserId="161" LastActivityDate="2013-06-05T03:47:37.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1616" PostTypeId="2" ParentId="1608" CreationDate="2013-06-05T07:24:42.880" Score="0" Body="&lt;p&gt;&lt;strong&gt;Without physical limitation, I would say 3 racks are ideal, but 2 racks are a minimum.&lt;/strong&gt;  The middle rack is for patch panels of all cable terminations.  You don't want any equipment there.  The other racks for equipment.  600 terminations with cable management would take up nearly a 42U rack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With redundant equipment, I prefer to rack like devices in opposite racks.  This avoids the issue of a single power pole affecting all of your redundancy -- imagine worse case even with dual power supplies going to different PDUs in the same rack with your amp draw on a single PDU &gt; half of it's capacity.  Now imagine one of the PDU fails, so all the equipment then pulls double the amps from the remaining PDUs, and since your over budget on your draw, you just tripped the breaker on your redundant PDU and all equipment in that rack goes offline.  Having like equipment -- redundant routers, firewalls, agg switches, access switches, wireless LAN controllers, etc -- in different racks would mean a single rack can take it all out.  You also avoid someone falling off a ladder or tripping and ripping cables out of your equipment and having a bigger impact than you would like.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-06T02:29:21.630" LastActivityDate="2013-06-06T02:29:21.630" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1617" PostTypeId="2" ParentId="1606" CreationDate="2013-06-05T07:51:55.123" Score="4" Body="&lt;p&gt;We have a similar setup but with two sets of 8.2(5) and we have used an in-house script to detect config changes to the primary pair, change the necessary details to make it connectable in the second DC and push the config to the second firewall pair and finally reboot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This only works for us because the second FW pair is completely passive whilst a failover isn't active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the script basically does is pull the active config, run a regex to replace the management details with those of the second pair, a regex to replace the SNMP, hostname etc. Once done it TFTP's the config to the second pair and initiates a reboot.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-06-05T07:51:55.123" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1618" PostTypeId="2" ParentId="1608" CreationDate="2013-06-05T08:17:48.200" Score="0" Body="&lt;p&gt;I would consider spliting them into two racks. That way it will allow for future expansion of the network. At the moment you may feel that you won't need to expand any further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trust me, it makes life a lot easier if you allow some room for future expansion now, rather than try to expand further down the line.&lt;/p&gt;&#xA;" OwnerUserId="1541" LastEditorUserId="3662" LastEditDate="2013-12-29T19:36:50.063" LastActivityDate="2013-12-29T19:36:50.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1619" PostTypeId="5" CreationDate="2013-06-05T08:39:32.077" Score="0" Body="&lt;p&gt;An IDF is an Intermediate Distribution Frame; it is a secured area where cabling is terminated and (often) communications equipment is racked.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-05T11:20:10.830" LastActivityDate="2013-06-05T11:20:10.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1620" PostTypeId="4" CreationDate="2013-06-05T08:39:32.077" Score="0" Body="An IDF is an Intermediate Distribution Frame; it is a secured area where cabling is terminated and (often) communications equipment is racked." OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-05T11:20:02.377" LastActivityDate="2013-06-05T11:20:02.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1625" PostTypeId="1" AcceptedAnswerId="1627" CreationDate="2013-06-05T13:32:14.557" Score="7" ViewCount="1239" Body="&lt;p&gt;Our office network uses the 1921/K9 router along with SG300 L3 switch (and a few other L2 switches) all with base modules. If we wanted to block employees from visiting certain websites, what would be the best way to do it with the current equipment? &lt;/p&gt;&#xA;" OwnerUserId="851" LastActivityDate="2013-06-05T15:23:06.997" Title="Website filtering via IOS" Tags="|cisco|security|cisco-isr|" AnswerCount="4" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1626" PostTypeId="2" ParentId="1625" CreationDate="2013-06-05T13:49:15.527" Score="2" Body="&lt;p&gt;In my experience what I've done is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Setup a SPAN session on the L3 Switch and send the traffic to a destination port that will do the monitoring.&#xA;2) Configure Websense to monitor website traffic by setting up policies for what is and is not allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that is probably not exactly what you are looking for, but that is the basics in a nutshell.  Just having a Router and L3 switch doesn't allow you to monitor/block website traffic.  There are other products out there besides Websense such as Dansguardian that will do the trick but Websense is probably by far the easiest to set up but also one of the most expensive in terms of licensing and hardware requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you also have to take into consideration when monitoring website traffic is the size of your network.  If you are monitoring 200+ clients, I would not recommend anything less than a Quad Core Xeon box with Dual Gigabit Link and 8GB of RAM at the very minimum.  Sizing is very important when deciding to monitor traffic as the box that monitors could potentially choke outbound traffic enough to where higher-ups decide to yank the box out of the network for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's been my experience with monitoring website traffic, what are your thoughts?&lt;/p&gt;&#xA;" OwnerUserId="1096" LastActivityDate="2013-06-05T13:49:15.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1627" PostTypeId="2" ParentId="1625" CreationDate="2013-06-05T14:28:10.943" Score="7" Body="&lt;p&gt;A poor man's filter can be implemented by using NBAR to match the URL you want to block and then drop the traffic that matches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance if you wanted to block google you could use the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any BlockGoogle&#xA;    match protocol http url *.google.*&#xA;&#xA;policy-map BlockGoogle&#xA;   class BlockGoogle&#xA;       drop&#xA;&#xA;interface gig 0/1&#xA;    description WAN Interface&#xA;    ip address 4.2.2.1 255.255.255.252&#xA;    service-policy output BlockGoogle&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because this is a match-any class map you can just add more URLs to match in the class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Matching based on URL will need to be done in the 1921, not the L2/3 switch.&lt;/p&gt;&#xA;" OwnerUserId="287" LastEditorUserId="287" LastEditDate="2013-06-05T14:33:37.950" LastActivityDate="2013-06-05T14:33:37.950" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1628" PostTypeId="2" ParentId="1625" CreationDate="2013-06-05T14:33:09.503" Score="5" Body="&lt;p&gt;Work with your Cisco Partner or Cisco SE on the use for ScanSafe solution integrated in IOS:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6525/ps6538/ps6540/data_sheet_c78-655324.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6525/ps6538/ps6540/data_sheet_c78-655324.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2013-06-05T14:33:09.503" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1630" PostTypeId="2" ParentId="1625" CreationDate="2013-06-05T14:40:06.513" Score="1" Body="&lt;p&gt;Another alternative is to block the URLs, similar in concept to the HOSTS file, at the DNS server (assuming you're running your own DNS server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if IOS is running the DNS server, you can add:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router(config)# ip host facebook.com 127.0.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you could replace 127.0.0.1 with the IP of perhaps a simple web server with a static page listing which sites are forbidden and why.&lt;/p&gt;&#xA;" OwnerUserId="572" LastActivityDate="2013-06-05T14:40:06.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1632" PostTypeId="1" AcceptedAnswerId="1635" CreationDate="2013-06-05T16:09:13.710" Score="7" ViewCount="2016" Body="&lt;p&gt;I need to map TCP/IP protocols to the OSI model for some university test revision I am doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if it is generally acceptable to assume any OSI Level 7, 6 and 5 protocol will be transferred directly into TCP/IP's Layer 4 (Application Layer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously with TCP/IP to OSI mapping, you have to use more common sense, such as MMS from TCP/IP Application would go to Presenation Layer.&lt;/p&gt;&#xA;" OwnerUserId="1560" LastActivityDate="2013-06-05T23:06:20.577" Title="How do the Application, Presentation and Session layers of the OSI model map to TCP/IP's Application Layer and vice versa?" Tags="|ipv4|tcp|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1633" PostTypeId="2" ParentId="1557" CreationDate="2013-06-05T16:15:16.180" Score="1" Body="&lt;p&gt;CAVEAT: &lt;em&gt;I have never used Cisco Prime&lt;/em&gt;. However, here is a different idea:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Take the 200x 800 map out of Cisco Prime. &lt;/li&gt;&#xA;&lt;li&gt;Add some white space around the outside in MS Paint. &lt;/li&gt;&#xA;&lt;li&gt;Make the new map 800x 800. &lt;/li&gt;&#xA;&lt;li&gt;Place it back in Cisco Prime. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Could that be an option? &lt;/p&gt;&#xA;" OwnerUserId="409" LastActivityDate="2013-06-05T16:15:16.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1634" PostTypeId="2" ParentId="1632" CreationDate="2013-06-05T16:27:22.070" Score="6" Body="&lt;p&gt;The OSI and TCP/IP are different models and everything doesn't always line up perfectly in practice.  In going from OSI to TCP/IP, everything above TCP (OSI Layers 5-7) is considered the Application layer (TCP/IP Layer 4).  From TCP/IP to OSI there can be a lot of disagreement over what falls into each of layers 5-7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To add to the complication there are protocols which span multiple layers, for example, Ethernet is both layer 1 AND 2 in the OSI model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://learningnetwork.cisco.com/servlet/JiveServlet/showImage/2-139432-37582/OSI+Keith+3-8-2011.png&quot; rel=&quot;noreferrer&quot;&gt;Here is a nice visual&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-06-05T16:27:22.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1635" PostTypeId="2" ParentId="1632" CreationDate="2013-06-05T16:55:03.290" Score="3" Body="&lt;p&gt;Yes. Both of the OSI and TCP/IP models are pretty old at this stage, and the TCP/IP model was created more specifically to &quot;operate&quot; with the IP protocol suite (the TCP/IP model slightly predates the OSI model). The OSI model was created by the ISO (International organization) and TCP/IP model was created by the U.S. and is maintained by the IETF. Even if TCP/IP didn't turn out to be the predominant protocol suite used on the Internet as we know it, with things like Moore's law and increasingly complex applications/protocols that can span multiple layers, the OSI model is becoming somewhat obsolete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why layers 7, 6 and 5 are all crammed into the Application layer in the TCP/IP model is that the folks that created the TCP/IP model believed that those responsibilities should be handled by the application itself, rather than within neatly laid out abstraction layers (thus helping to ease potential confusion that your question calls out).&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-05T23:06:20.577" LastActivityDate="2013-06-05T23:06:20.577" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1637" PostTypeId="2" ParentId="1608" CreationDate="2013-06-05T17:18:40.813" Score="2" Body="&lt;p&gt;600 Ports per rack would be possible provided you choose the right racks, cable management accessories and patching style.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd recommend a 2 Post rack with a pair of high density cable managers. I've personally used Panduit's WMPVHC45E cable managers for similar densities. Now If you use angled patch panels to terminate your copper cables, you can eliminate most of the horizontal cable mangers and save valuable rack space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Patching can be done such that they are sequential within the left/right halves of the rack. For example for the left side,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Panel 1 Ports 1-12 to be patched to Switch 1 Ports 1-12&lt;/li&gt;&#xA;&lt;li&gt;Panel 2 Ports 1-12 to be patched to Switch 1 Ports 13-24&lt;/li&gt;&#xA;&lt;li&gt;Panel 3 Ports 1-12 to be patched to Switch 2 Ports 1-12&lt;/li&gt;&#xA;&lt;li&gt;Panel 4 Ports 1-12 to be patched to Switch 2 Ports 13-24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And so on for every panel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way you'll keep your patch cables short, and within one side of the rack while still being manageable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However remember such high densities aren't suitable for environments where patch cords are often removed and/or re-patched to a different port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And remember you'll anyway have to plan for additional space, power and cooling in the network closet if you anticipate expansion in this closet as they aren't easy to add later on. &lt;/p&gt;&#xA;" OwnerUserId="1000" LastActivityDate="2013-06-05T17:18:40.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1638" PostTypeId="1" CreationDate="2013-06-05T17:21:45.537" Score="9" ViewCount="1262" Body="&lt;p&gt;How do I go about blocking IPv6 RA advertisements on access ports on a Juniper EX series switch? I know that Cisco offers ra-guard as an option much like bpdu-guard on spanning tree, I am just not sure how to accomplish the same thing in Junos.&lt;/p&gt;&#xA;" OwnerUserId="1482" LastActivityDate="2013-06-05T18:28:24.900" Title="Blocking IPv6 RA advertisements on Juniper EX series switch" Tags="|juniper|ipv6|security|juniper-junos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1639" PostTypeId="2" ParentId="1638" CreationDate="2013-06-05T18:28:24.900" Score="4" Body="&lt;p&gt;The support for this feature looks a bit spotty depending on which version of Junos you're running.  You could try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;term block-ra {&#xA;    from {&#xA;        icmp-type router-advertisement;&#xA;    }&#xA;    then {&#xA;        discard;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="71" LastActivityDate="2013-06-05T18:28:24.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1640" PostTypeId="5" CreationDate="2013-06-05T19:09:05.853" Score="0" Body="&lt;p&gt;A wireless LAN (WLAN) controller is used in combination with the Lightweight Access Point Protocol (LWAPP) to manage light-weight access points in large quantities by the network administrator or network operations center. The wireless LAN controller is part of the Data Plane within the Cisco Wireless Model. The WLAN controller automatically handles the configuration of wireless access-points.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T22:31:03.050" LastActivityDate="2016-11-29T22:31:03.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1641" PostTypeId="4" CreationDate="2013-06-05T19:09:05.853" Score="0" Body="For questions about Wireless LAN Controllers (WLCs), whatever the manufacturer." OwnerUserId="76" LastEditorUserId="8499" LastEditDate="2016-11-29T22:31:03.050" LastActivityDate="2016-11-29T22:31:03.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1642" PostTypeId="1" AcceptedAnswerId="1643" CreationDate="2013-06-05T19:32:53.893" Score="5" ViewCount="240" Body="&lt;p&gt;Looking for various documents and the IEEE standards, I can see that &lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.3bd-2011.pdf&quot; rel=&quot;noreferrer&quot;&gt;802.3bd-2011&lt;/a&gt; adds a MAC control frame for priority-based flow control. How does priority-based flow control differ from &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1p&quot; rel=&quot;noreferrer&quot;&gt;IEEE 802.1P/802.1D-2004&lt;/a&gt; (which is now in IEEE 802.1Q-2005).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IEEE 802.1Q we have PCP values for QoS at layer 2;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is priority based flow control something different then, to PCP values?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;According to &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.3&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia&lt;/a&gt;, 802.3bd was: &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An amendment by the IEEE 802.1 Data Center Bridging Task Group (802.1Qbb) to develop an amendment to IEEE Std 802.3 to add a MAC Control Frame to support IEEE 802.1Qbb Priority based Flow Control.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What was the need for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please provide a/some references for your answer so I can read them.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="762" LastEditDate="2013-06-05T19:37:35.707" LastActivityDate="2013-06-05T19:42:24.357" Title="What functionality does 802.3bd-2011 actually add to 802.3 Ethernet?" Tags="|ethernet|standardisation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1643" PostTypeId="2" ParentId="1642" CreationDate="2013-06-05T19:37:21.520" Score="6" Body="&lt;p&gt;This is used to support FCoE as FC cannot handle dropped packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/UF_FCoE_final.html#wp1159118&quot; rel=&quot;noreferrer&quot;&gt;Reference&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="176" LastEditorUserId="176" LastEditDate="2013-06-05T19:42:24.357" LastActivityDate="2013-06-05T19:42:24.357" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1644" PostTypeId="1" AcceptedAnswerId="1658" CreationDate="2013-06-05T19:50:11.130" Score="8" ViewCount="8172" Body="&lt;p&gt;I am finding some contradictions in Cisco documentation about the LAG support in 2504 WLC. On one hand, the &lt;a href=&quot;http://www.cisco.com/en/US/products/ps11630/products_tech_note09186a0080b8450c.shtml&quot;&gt;Cisco 2500 Series Wireless Controller Deployment Guide&lt;/a&gt; clearly states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note: Link Aggregation (LAG) is not supported on the Cisco 2500 Series&#xA;  Wireless Controller.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;On the other hand, the brochure &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/modules/ps2706/at_a_glance_c45-652653.pdf&quot;&gt;Cisco Wireless LAN Controllers at a glance&lt;/a&gt; states 2504  does support LAG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some search, I have found the bulletin for &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps10315/product_bulletin_c25-722724.html&quot;&gt;Cisco Unified Wireless Network Software Release 7.4&lt;/a&gt; stating:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Wireless Controllers 8500, 2500, and Flex 7500 now support Link&#xA;  Aggregation Group (LAG).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What makes me think the LAG support in the 2504 would be depending on the software version loaded on the device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the only 2504 I can work on is having 7.2 software version and is in a production environment (not easy to upgrade and test on it), I still wonder:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does the 2504 WLC really support LAG? &lt;/li&gt;&#xA;&lt;li&gt;Does it require a minimum software version or any additional hardware for it?&lt;/li&gt;&#xA;&lt;li&gt;Is it having any limitation or is the same LAG functionality as in 5500 WLC series? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="76" LastActivityDate="2013-06-06T18:18:31.347" Title="Does 2504 WLC support LAG?" Tags="|cisco|wlc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1645" PostTypeId="1" AcceptedAnswerId="1646" CreationDate="2013-06-05T20:27:10.090" Score="8" ViewCount="855" Body="&lt;p&gt;I have 4 routers in my lab. FR1 is the frame relay switch (2621), R1(2621), R2(2651) &amp;amp; R3(2651) are all connected in a mesh using sub interfaces - R1 has pvc to R2&amp;amp;R3 and so on. Without OSPF I can ping all points successfully. With OSPF I can also ping all the loopbacks built onto the routers. OSPF seems to work but when I do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show ip ospf neighbor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the neighbours show as FULL but with 0 priority - and checking the detail each router has 0.0.0.0 as their DR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm about to try changing the priorities, but given the fact I did a write erase before building the lab this evening, what could cause the priorities to move from the default of 1 to 0?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="106" LastEditorUserId="106" LastEditDate="2013-06-05T20:33:16.497" LastActivityDate="2013-06-05T20:33:28.403" Title="Why have all my lab routers set their OSPF priority to 0?" Tags="|cisco|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1646" PostTypeId="2" ParentId="1645" CreationDate="2013-06-05T20:33:28.403" Score="12" Body="&lt;p&gt;On frame-relay point-to-point interfaces, your OSPF priority is set to zero automatically. Also you have no DR election on a p2p links&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-06-05T20:33:28.403" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1647" PostTypeId="2" ParentId="1644" CreationDate="2013-06-05T20:50:42.207" Score="8" Body="&lt;p&gt;If you check in the 7.2 release notes it has the following limitations:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Features Not Supported on Cisco 2500 Series Controllers&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Wired guest access&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Cisco 2500 Series Controller cannot be configured as an auto anchor&#xA;  controller. However, you can configure it as a foreign controller.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Bandwidth contract&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Access points in direct connect mode&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Service port&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Apple Talk Bridging&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•LAG&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The 7.4 release notes has LAG as supported:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What's New in This Release? This section provides a brief description&#xA;  of what is new in this release. For more information about&#xA;  instructions on how to configure these features, see the controller&#xA;  configuration guides published in the 7.4 Release category at&#xA;  &lt;a href=&quot;http://www.cisco.com/en/US/products/ps10315/products_installation_and_configuration_guides_list.html&quot;&gt;http://www.cisco.com/en/US/products/ps10315/products_installation_and_configuration_guides_list.html&lt;/a&gt;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•The Cisco Aironet 1600 Series Access Points are supported. For more&#xA;  information, see&#xA;  &lt;a href=&quot;http://www.cisco.com/en/US/products/ps12555/index.html&quot;&gt;http://www.cisco.com/en/US/products/ps12555/index.html&lt;/a&gt;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Introduced support for the 802.11w standard as defined by the&#xA;  Management Frame Protection (MFP) service. Disassociation,&#xA;  Deauthentication, and Robust Action frames increase Wi-Fi network&#xA;  security by protecting the management frames from being spoofed.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Increased scale for Cisco 2500 Series Controllers to support 75&#xA;  access points and 1000 clients. Cisco 2500 Series Wireless LAN Controllers can now act as guest&#xA;  anchors and up to 15 EoIP tunnels are supported. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Extended support for&#xA;  link aggregation (LAG) on the Cisco Wireless LAN 2500, Flex 7500, and&#xA;  8500 Series Controllers. With this feature, you can aggregate multiple&#xA;  links to protect against link failures.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what limitation you are referring to? It seems it only supports mode on but that seems to be consistent for 5508 as well.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-06-05T20:50:42.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1648" PostTypeId="1" AcceptedAnswerId="1702" CreationDate="2013-06-05T23:14:33.303" Score="11" ViewCount="3797" Body="&lt;p&gt;What is the best method of locating a particular workstation on a VLAN ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I sometimes need to do this, if a workstation IP address, shows up on an ACL Deny &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;torrent use&lt;/li&gt;&#xA;&lt;li&gt;High bandwidth usage (Top Talkers)&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Snort alert&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I do it now,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Logon to a core switch in the same VLAN&lt;/li&gt;&#xA;&lt;li&gt;Ping the IP address, &lt;/li&gt;&#xA;&lt;li&gt;Retrieve the MAC from the ARP table&lt;/li&gt;&#xA;&lt;li&gt;Mac address lookup to see which switch it was learned from&lt;/li&gt;&#xA;&lt;li&gt;logon to that switch rinse and repeat until I locate the workstation&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;sometimes this can take logging in to ~7 switches, there are specific challenges to this network that I can do nothing about at the moment. Huge VLANs (/16) with a few hundred users on each VLAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in an all Cisco shop, with minimal budget using Cisco switches, there must be a more efficient way to track down host machines ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: To add further details&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically I'm looking for the switch-port the user is connected to ? also some history would be great .. because my approach only works while the user is still connected, and no value when i review the logs in the morning, but the device is no longer connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no central DNS or Active Directory it is like a Guest Network, where only internet access is provided. I try to provide some management and a bit of security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried &quot;show ip dhcp binding | inc &quot; it gives me a strange MAC (with 2 extra characters) that is not the associated device MAC, I have not looked into this yet, but ARP is accurate and I'm more concerned with finding the switch port the offending machine is connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hope this provides some clarification&lt;/p&gt;&#xA;" OwnerUserId="1019" LastEditorUserId="775" LastEditDate="2013-06-30T10:35:40.553" LastActivityDate="2013-07-02T11:26:21.213" Title="Locate a host on Network" Tags="|cisco|switch|vlan|cisco-commands|management|" AnswerCount="11" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1649" PostTypeId="2" ParentId="1648" CreationDate="2013-06-05T23:22:26.633" Score="2" Body="&lt;p&gt;You're doing it the same way I would do it manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is software out there that will take the manual steps out of it for you. A tool included in SolarWinds Engineering Toolkit will, although unfortunately it's not cheap. I'm sure there are other alternatives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're down for an in-between solution or some scripting work, take a look at the SNMP commands issued in this answer for an idea of how you could &lt;a href=&quot;https://stackoverflow.com/questions/12217708/how-to-get-mac-or-ip-addresses-of-devices-connected-to-a-switch-using-snmp&quot;&gt;script it from a system with a CLI SNMP client&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edited to add: I presume that your &quot;rinse and repeat&quot; is not re-including the ping and whatnot along the way. Once you've determined the mac address you should be able to just do sh mac addr | in #### (whoops angle brackets disappear)&lt;/p&gt;&#xA;" OwnerUserId="1286" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2013-06-07T09:37:14.753" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1650" PostTypeId="2" ParentId="1648" CreationDate="2013-06-05T23:23:59.160" Score="2" Body="&lt;p&gt;Why not simplify things and do an nslookup on the IP, grab the hostname from DNS and use the hostname to find the computer via an asset list or management database? Or if you don't have reverse DNS setup you could log into the DHCP server to pull the host name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it isn't a Cisco/CLI method, but it should work if your users are assigned to computers 1-1. If you are many to 1, you can use Windows/Linux tools to find out the current user of the computer.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-06-05T23:23:59.160" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1651" PostTypeId="2" ParentId="1648" CreationDate="2013-06-05T23:27:11.543" Score="6" Body="&lt;p&gt;I like to have a script that grabs &lt;code&gt;show arp&lt;/code&gt; and &lt;code&gt;show cam dyn&lt;/code&gt; output every 15 minutes, I timestamp it with &lt;code&gt;term exec prompt timestamp&lt;/code&gt; so we have a rough correlation for times.  Then I append all switch output to a file... one file per switch, per day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All these logs are kept in the same directory for easy grepping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding hosts becomes a fairly simple grep exercise if you know the topology... Stuck in windows without grep?  Use cygwin...&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-07T09:59:59.317" LastActivityDate="2013-06-07T09:59:59.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1652" PostTypeId="2" ParentId="1648" CreationDate="2013-06-05T23:35:00.350" Score="7" Body="&lt;p&gt;There are a couple of ways to do this on the cheap (the exercise of research and/or implementation I'll leave up to you).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Have a script that logs in to each one of your edge devices and grabs the MAC address tables off of them. You'll want to exclude trunk interfaces for this, but it would be trivial to create a hash (or dict for you python people) with the keys being the edge switches and the values being another hash that's basically &quot;mac.addr -&gt; interface&quot;. This will eliminate the need for you to chase down MACs on your edge switches, which is most of the legwork it seems. I can recommend using Perl's &lt;code&gt;Net::Appliance::Session&lt;/code&gt; or Python's &lt;code&gt;exscript&lt;/code&gt; to make this happen (this assumes you have access to a *NIX box).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use SNMP to query this data, which will eliminate the need for a script to actually log in to switches and run commands. You're on your own to look up MIBs for the MAC address tables, but &lt;a href=&quot;https://www.google.com/search?q=SNMP+mac+address+table&amp;amp;oq=SNMP+mac+address+table&amp;amp;aqs=chrome.0.57j0l3j62l2.4307j0&amp;amp;sourceid=chrome&amp;amp;ie=UTF-8&quot;&gt;here's a Google search to get you started&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you're on Windows only, you can use SecureCRT or TeraTerm to set up macro's to &quot;half-automate&quot; this for you, but my experience with either of those is very limited, so YMMV.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope that gives you some ideas.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-06T00:52:03.273" LastActivityDate="2013-06-06T00:52:03.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1653" PostTypeId="2" ParentId="1648" CreationDate="2013-06-05T23:40:28.010" Score="9" Body="&lt;p&gt;We use the &lt;a href=&quot;http://docs.cacti.net/plugin:mactrack&quot; rel=&quot;nofollow noreferrer&quot;&gt;mactrack&lt;/a&gt; plugin on Cacti to do such things. Works quite well, historical data is also available.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as the ARP and MAC address tables are available via SNMP then it works. The only small problem we had is where the layer 3 instance for a site is an ASA. We just worked around this by pulling the ARP table via scripts and generating an &lt;a href=&quot;http://en.wikipedia.org/wiki/Arpwatch&quot; rel=&quot;nofollow noreferrer&quot;&gt;arpwatch&lt;/a&gt; file, since mactrack supports that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example screenshot from our setup:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/f26HG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imgurl link: &lt;a href=&quot;https://i.stack.imgur.com/mZjS2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/mZjS2.png&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="714" LastEditorUserId="714" LastEditDate="2013-06-07T06:01:35.317" LastActivityDate="2013-06-07T06:01:35.317" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1654" PostTypeId="1" CreationDate="2013-06-06T02:49:02.490" Score="6" ViewCount="2435" Body="&lt;p&gt;Hi I've got a problem in the network with a duplicate OSPF router-id. We tipically use the loopback ip address as the router-id, but I'm afraid that someone in the network don't care about that.&#xA;I wanted to know if there is a simple way to get this information. By now I'm writting a perl script to get the information via snmp to list all the router-id in the network.&lt;/p&gt;&#xA;" OwnerUserId="1568" LastActivityDate="2013-06-06T03:43:44.437" Title="How to find a duplicate router-id ospf in the network?" Tags="|ospf|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1655" PostTypeId="2" ParentId="1654" CreationDate="2013-06-06T02:58:25.090" Score="6" Body="&lt;p&gt;If you have access to config repositories, the best way to do this is to search through them all to find duplicate entries. Assuming you're on a *NIX host, you could do something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ cat * | grep 'router-id' | awk {'print $2'} | sort | uniq -c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You want to look for anything that has a '2' in the first column. You can then find the offender and grep for the IP to find the routers that it's configured on. This would likely be the simplest way. You're already on the right track with a Perl script to poll the devices via SNMP to get at the &lt;code&gt;router-id&lt;/code&gt; IP addresses, but I will say that SNMP code can be a little &quot;hairier&quot; than just simply using &lt;code&gt;Net::SSH::Expect&lt;/code&gt; or &lt;code&gt;Net::Appliance::Session&lt;/code&gt; to just log into the devices and dump the running configs to filehandles (at which point you can use the technique above).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming you're running Cisco, there's also a &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080117102.shtml&quot;&gt;fairly comprehensive troubleshooting guide&lt;/a&gt; that covers this topic if you're interested.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-06T03:43:44.437" LastActivityDate="2013-06-06T03:43:44.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1656" PostTypeId="2" ParentId="1345" CreationDate="2013-06-06T03:00:29.053" Score="1" Body="&lt;p&gt;Iperf and mtr to do specific test. And smokeping to have a simple history of the link performance using fping probe.&lt;/p&gt;&#xA;" OwnerUserId="1568" LastActivityDate="2013-06-06T03:00:29.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1657" PostTypeId="1" CreationDate="2013-06-06T03:05:10.317" Score="10" ViewCount="24583" Body="&lt;p&gt;We're using the Cisco 1921/K9 with a SG300 L3 switch. Does one set up DHCP server on the router or on the SG300? If both is capable, what is the reason to choose one over the other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I have 4 VLANS set up on the SG300 L3 switch&lt;/p&gt;&#xA;" OwnerUserId="851" LastEditorUserId="851" LastEditDate="2013-06-06T04:16:20.310" LastActivityDate="2015-07-08T07:36:17.350" Title="Setting up DHCP server on the router or on the switch?" Tags="|cisco|switch|router|cisco-isr|dhcp|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1658" PostTypeId="2" ParentId="1644" CreationDate="2013-06-06T03:39:38.607" Score="4" Body="&lt;p&gt;&lt;strong&gt;Yes, the 2504 supports LAG in v7.4.&lt;/strong&gt;  Your first guide refers to v7.0.116.0 and the second guide written in 5/2013 implies v7.4.  Enabling LAG requires a reboot of the WLC and has limitations similar to the 5500.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When LAG is enabled on a WLC, the WLC forwards data frames on the same port on which they were received. The WLC relies on the neighbor switch to load-balance traffic across the EtherChannel. The WLC does not perform any EtherChannel load-balancing on its own.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Limitations/Restrictions, same as 5500 but note 5508 doesn't have ap-manager inf's:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;LAG requires the EtherChannel to be configured for 'mode on' on both&#xA;  the controller and the Catalyst switch. &lt;/li&gt;&#xA;  &lt;li&gt;The load-balancing method configured on the Catalyst switch must be a&#xA;  load-balancing method that terminates all IP datagram fragments on a&#xA;  single controller port. Not following this recommendation may result&#xA;  in problems with access point association. &lt;/li&gt;&#xA;  &lt;li&gt;The recommended load-balancing method for Catalyst switches is src-dst-ip (enter the&#xA;  port-channel load-balance src-dst-ip command). &lt;/li&gt;&#xA;  &lt;li&gt;With LAG, all of the controller ports need to connect to the same neighbor switch. &lt;strong&gt;If the neighbor switch goes down, the controller&#xA;  loses connectivity.&lt;/strong&gt;  With multiple AP-manager interfaces, you can&#xA;  connect your ports to different neighbor devices. If one of the&#xA;  neighbor switches goes down, the controller still has connectivity.&#xA;  However, using multiple AP-manager interfaces presents certain&#xA;  challenges when port redundancy is a concern. &lt;/li&gt;&#xA;  &lt;li&gt;Port mirroring is not supported when link aggregation (LAG) is enabled on the controller.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-06T18:18:31.347" LastActivityDate="2013-06-06T18:18:31.347" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1659" PostTypeId="2" ParentId="1657" CreationDate="2013-06-06T03:53:44.297" Score="6" Body="&lt;p&gt;&lt;strong&gt;Since DHCP Discovery broadcasts initially and to avoid the need for ip-helper addresses, the L3 switch where your users or servers connect is generally the better spot for DHCP.&lt;/strong&gt;  You didn't mention multiple VLANs, and with the size equipment you have, I assumed just one, so you just need DHCP configured for that VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could put the DHCP scope on your router if it's L2 adjacent to the users.  If it isn't, then you need ip-helper config in your L3 switch VLAN to get the DHCP broadcasts sent unicast to the router (DHCP server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: With your update on topology and VLANs, I would still lean toward the L3 switch for the location of your DHCP scopes.  With the router failing, no DHCP discovery or renewal could take place which could impact your internal-only traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, you have multiple switches or DHCP servers so you can have distinct scopes on them -- not overlapping, each serving half of the addresses.  On a 172.16.1.0/24 subnet, and skipping the first 4 addresses, one server could scope 172.16.1.4-127/24 and the other server 172.16.1.128-254/24.  [172.16.1.1 reserved for your gateway addr with .2 and .3 reserved if you were running HSRP]&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-06T04:35:45.977" LastActivityDate="2013-06-06T04:35:45.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1660" PostTypeId="2" ParentId="1657" CreationDate="2013-06-06T04:00:21.450" Score="4" Body="&lt;p&gt;Given the topology you gave in your comment. The L3 switch is probably the best place to put the DHCP server.&#xA;This also sets you up in event you add an additional WAN router and have two circuits or connections coming into the office there. This would eliminate the single-point-of failure if the DHCP server were to reside on one of the routers which &quot;went away&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise you would need to utilize the ip helper-address on the VLAN interface.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-06T04:00:21.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1661" PostTypeId="1" AcceptedAnswerId="1664" CreationDate="2013-06-06T04:07:43.373" Score="6" ViewCount="1319" Body="&lt;p&gt;What is the best practice for putting 802.3x flowcontrol on a userport and does this inhibit performance if the application/system isn't designed for it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg)&lt;br&gt;&#xA;&lt;code&gt;interface gig0/1&lt;/code&gt;&lt;br&gt;&#xA; &lt;code&gt;flowcontrol receive [desired | on | off]&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="343" LastEditDate="2013-06-06T04:22:29.360" LastActivityDate="2013-06-06T05:21:26.007" Title="802.3x ethernet flow-control on user ports?" Tags="|ethernet|switching|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1662" PostTypeId="2" ParentId="1657" CreationDate="2013-06-06T04:09:55.883" Score="2" Body="&lt;p&gt;It's a matter of  one's preference really.  In a flat network (one lan segment), it doesn't matter if the DHCP server is on the router, the switch, or a server.  They will all see the same broadcast queries.  I would recommend using the most stable (&quot;available&quot;) platform that has an acceptable means of configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I run DHCP on my cisco router at home -- single LAN. It's a central point to configure everything. And I'm fine with the cli to manage everything. (not that there's much to manage in my home network.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At work, there's a DHCP server (windows 2000) on the main office LAN (where 99% of the workstations live) that answers for all 36 LAN segments via a dhcp-relay agent on the inside router. In this case, this is the optimal location for it as that's where almost all DHCP traffic exists. It's on a windows server because people like pointy-clicky interfaces. (read: easier for people who aren't me to deal with)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-06T04:09:55.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1664" PostTypeId="2" ParentId="1661" CreationDate="2013-06-06T04:36:03.433" Score="10" Body="&lt;p&gt;Most often Cisco devices can only receive PAUSE frames. They can't send them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are running storage over your network I can understand why you would be looking at implementing it and some server/storage vendors even recommend you to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note however that PAUSE frames is a very blunt tool as it can pause all traffic meaning you can't differentiate between packets. That means your high priority packets will be treated the same as low priority packets. If you run a separate storage network then it's no issue and you can safely enable it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a standard &lt;a href=&quot;http://blog.ioshints.info/2010/09/introduction-to-8021qbb-priority-flow.html&quot;&gt;802.1Qbb&lt;/a&gt; that enables to send PAUSE frames per class so not all the traffic gets paused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ine.com/2008/07/08/802-3x-flow-control/&quot;&gt;This article&lt;/a&gt; describes how 802.3x works and the implications of running it like adding delay to RTT for TCP packets and such.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-06-06T04:36:03.433" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1665" PostTypeId="1" AcceptedAnswerId="5809" CreationDate="2013-06-06T04:54:17.873" Score="9" ViewCount="4821" Body="&lt;p&gt;What are the necessary steps to configure IOS 12.4(25f) to support IPv6?  Comcast is the ISP, and I'll be using a Server 2012 box for internal DHCPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll need to grab a DHCPv6 address from Comcast for the external interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, on my external interface, I have:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 address autoconfig default&#xA;ipv6 enable&#xA;ipv6 traffic-filter al in&#xA;ipv6 verify unicast reverse-path&#xA;ipv6 dhcp client pd comcast-ipv6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the 'al' access-list, I have:&lt;br&gt;&#xA;&lt;code&gt;permit udp any any eq 546&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user1569" LastEditorDisplayName="user1569" LastEditDate="2014-01-11T21:07:52.533" LastActivityDate="2014-01-13T20:30:54.777" Title="Configure External Interface for DHCPv6 client on Cisco IOS" Tags="|cisco|ipv6|cisco-ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1666" PostTypeId="2" ParentId="1648" CreationDate="2013-06-06T05:14:44.537" Score="1" Body="&lt;p&gt;Just a suggestion... if you have some sort of active syslog inspection that can trigger on specific events, you could write a script to SNMP lookup the IP on every switch so know where it was roughly around the time the event happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(sorry, I cannot find the exact OIDs)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a00801c9199.shtml&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt; &quot;&lt;em&gt;Using SNMP to Find a Port Number from a MAC Address on a Catalyst Switch&lt;/em&gt;&quot; I forgot about the &lt;em&gt;comm@vlan&lt;/em&gt; trick. There are a lot of tables to ping to find all the information needed for a human. :-(&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-06-06T05:58:10.207" LastActivityDate="2013-06-06T05:58:10.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1667" PostTypeId="2" ParentId="1661" CreationDate="2013-06-06T05:21:26.007" Score="4" Body="&lt;p&gt;It's a negotiated feature, so if a device doesn't support it, it won't be negotiated and thus won't be active.  As Dib points out, it is a bit of a hammer, but given the way most systems use it (&quot;oh, sh*t, my buffers are full&quot;), it's still useful as the alternative is a lost frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, there have been bugs where an interface would act on a pause frame and then never process the unpause.  But that should be rare today.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-06T05:21:26.007" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1668" PostTypeId="2" ParentId="1648" CreationDate="2013-06-06T05:25:15.067" Score="1" Body="&lt;p&gt;You are asking two things.&lt;br&gt;&#xA;1.Locate a MAC on your network - I advise to create a script (php) and use SNMP to query all MAC address-table to give you the switch/port where is located the IP/MAC address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.Monitor Usage of your (torrent use,High bandwidth usage (Top Talkers),Snort alert) - Use a solution as &lt;a href=&quot;http://www.ntop.org/&quot; rel=&quot;nofollow&quot; title=&quot;ntop&quot;&gt;ntop&lt;/a&gt; to monitor the flows on your network. I'd used this a long ago and was great. &lt;/p&gt;&#xA;" OwnerUserId="206" LastActivityDate="2013-06-06T05:25:15.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1669" PostTypeId="2" ParentId="1665" CreationDate="2013-06-06T05:25:51.847" Score="8" Body="&lt;p&gt;Well firstly you need to globally enable on your router  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 unicast-routing&#xA;ipv6 cef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe you should also have the following on your WAN interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 address dhcp&#xA;ipv6 enable&#xA;ipv6 nd autoconfig default-route&#xA;ipv6 dhcp client pd comcast-ipv6-prefix&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you're starting out, stay clear of any access-lists or traffic-filters (ipv6 CBAC) until you get your connection working. Otherwise you'll just end up shooting yourself in the foot. Unless, of course, you've done this a million times and you know exactly what works every time.&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="500" LastEditDate="2014-01-13T20:30:54.777" LastActivityDate="2014-01-13T20:30:54.777" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1670" PostTypeId="2" ParentId="1557" CreationDate="2013-06-06T05:41:23.143" Score="4" Body="&lt;p&gt;You could try disabling the &lt;em&gt;Next Generation Maps&lt;/em&gt; in &lt;code&gt;Monitor &amp;gt; Site Maps&lt;/code&gt; &lt;code&gt;Properties&lt;/code&gt; to see if this makes a difference.  &lt;em&gt;It did on my map test.&lt;/em&gt;  There are performance reasons for not doing this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OjRcw.png&quot; alt=&quot;Site Maps Prop&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also be able to manually resize the image.  Go into &lt;code&gt;Edit Floor&lt;/code&gt;, then on the bottom-left, you'll see your 200x800 map.  Use the &lt;code&gt;CTRL-click&lt;/code&gt; to drag the blue edges to your desired size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wWux1.png&quot; alt=&quot;Prime map floor editor&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-06T22:53:04.123" LastActivityDate="2013-06-06T22:53:04.123" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1671" PostTypeId="1" CreationDate="2013-06-06T05:48:31.493" Score="5" ViewCount="6938" Body="&lt;p&gt;I need to verify that the following regex will match against my criteria, which is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Deny any prefixes beginning with &lt;code&gt;0:&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Deny any prefixes beginning with &lt;code&gt;65000:&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Deny any prefixes beginning with &lt;code&gt;0:65000&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Deny any prefixes beginning with &lt;code&gt;65000:65000&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Permit any prefixes with any communities tagged&lt;/li&gt;&#xA;&lt;li&gt;Permit any prefixes with no communities tagged&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The platform is Quagga.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my expanded community-list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip community-list expanded ANY-COMMUNITIES deny ^(0:.*)_(.*)_+$&#xA;ip community-list expanded ANY-COMMUNITIES deny ^(65000:.*)_(.*)_+$&#xA;ip community-list expanded ANY-COMMUNITIES deny ^(0:65000)_(.*)_+$&#xA;ip community-list expanded ANY-COMMUNITIES deny ^(65000:65000)_(.*)_+$&#xA;ip community-list expanded ANY-COMMUNITIES permit ^(.*)_+$&#xA;ip community-list expanded ANY-COMMUNITIES permit ^$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Will this cover what I'm after? Is there a better way?&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-06T07:31:35.493" LastActivityDate="2013-06-06T22:49:44.597" Title="BGP expanded community-list regex" Tags="|bgp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1672" PostTypeId="2" ParentId="1648" CreationDate="2013-06-06T06:33:05.253" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://sourceforge.net/projects/switchmap/&quot; rel=&quot;nofollow&quot;&gt;switchmap&lt;/a&gt; is another tool which can be used to keep track of which mac address is behind which switchport (amongst other things).&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="775" LastEditDate="2013-06-07T09:39:05.430" LastActivityDate="2013-06-07T09:39:05.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1673" PostTypeId="1" AcceptedAnswerId="1675" CreationDate="2013-06-06T06:59:55.160" Score="14" ViewCount="65881" Body="&lt;p&gt;When using mobile 3G routers, you see in the output of the &quot;show cellullar 0 all&quot; command.  What is the significance of this value? Is this interpretation the same when talking about 2G or 3G? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2G connection, RSSI -75&lt;/li&gt;&#xA;&lt;li&gt;3G connection, RSSI -75&lt;/li&gt;&#xA;&lt;li&gt;2G connection, RSSI -100&lt;/li&gt;&#xA;&lt;li&gt;3G connection, RSSI -100&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="623" LastActivityDate="2021-06-11T12:14:02.480" Title="What is the meaning of RSSI?" Tags="|cisco|troubleshooting|mobile|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1675" PostTypeId="2" ParentId="1673" CreationDate="2013-06-06T07:09:37.657" Score="17" Body="&lt;p&gt;RSSI is a Radio-Frequency (RF) term and stands for &lt;em&gt;Received Signal Strength Indicator&lt;/em&gt;. It is a measure of the power level that a RF device, such as WiFi or 3G client, is  receiving from the radio infrastructure at a given location and time. For instance, the power level a laptop is detecting from a nearby AP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, the higher the RSSI the better the quality and speed of the communication through the radio segment. &lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2013-06-06T07:09:37.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1676" PostTypeId="2" ParentId="1673" CreationDate="2013-06-06T07:47:17.470" Score="14" Body="&lt;p&gt;The closer the figure is to zero, the better. So in the figures you've given above, -75 is better than -100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience -75 provide a reasonable service. -85 provides an OK service. -100 provides a barely usable service. -110 provides no service at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This figure represents your signal strength to the cellular tower. The closer you are to a tower, the closer to zero the number will be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that although I mentioned above that -75 provides a reasonable service, keep in mind that if the tower you're connected to is heavily congested the service won't be all that great. It is similar to the way in which ADSL works - even if you sync at 24mb/1mb, if the DSLAM is heavily congested, you'll get poor throughput.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is this interpretation the same when talking about 2G or 3G?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, if you're using 3G and Telstra is your ISP, take a look at &lt;a href=&quot;http://whirlpool.net.au/wiki/3g_for_network_engineers&quot;&gt;this page.&lt;/a&gt; You can force the modem to connect to the 850mhz frequency which performs much better than the 2100mhz frequency. &lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2013-06-06T07:47:17.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1677" PostTypeId="2" ParentId="1673" CreationDate="2013-06-06T08:32:37.270" Score="4" Body="&lt;p&gt;AFAIK RSSI is arbitrary (and of questionable use) unit, but at least my 3G cisco actually outputs dBm:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;bu.ip.fi#show cellular 0 radio &#xA;Radio power mode = ON&#xA;Current Band = WCDMA 2100, Channel Number = 10737&#xA;Current RSSI = -64 dBm&#xA;Band Selected = Auto&#xA;Number of nearby cells = 1&#xA;Cell 1&#xA;    Primary Scrambling Code = 0x14A&#xA;    RSCP = -64 dBm, ECIO = -4 dBm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;dBm is the relative change to 1mW of power, i.e. 0dBm is 1mW by definition. And 3dBm change is about half or double of the original signal strength (10^(-3/10) is 0.5mW and 10^(3/10) is 2mW).&lt;/p&gt;&#xA;&lt;p&gt;So in the example above, my -64 dBm is 10^(-64/10)mW or 0.4nW (yes nanowatt, it's cray cray how these things work)  .&lt;/p&gt;&#xA;&lt;p&gt;If we want to translate arbitrary mW to dBm we use log10, i.e. 2mW is 10*Math.log10(2), which is 3.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="22792" LastEditDate="2021-06-11T12:14:02.480" LastActivityDate="2021-06-11T12:14:02.480" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="1679" PostTypeId="2" ParentId="1671" CreationDate="2013-06-06T09:07:24.487" Score="3" Body="&lt;p&gt;You don't need to do it so complex way as there is no implied $, so this should suffice:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip community-list expanded ANY-COMMUNITIES deny ^0:.*_&#xA;ip community-list expanded ANY-COMMUNITIES deny ^65000:.*_&#xA;ip community-list expanded ANY-COMMUNITIES permit .*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this probably is not even doing what you want to do, are you really interested in the order? I don't think BGP enforces any particular ordering in communities, RFC1997 just allows manipulation without specifying order. And Cisco seems to order communities in numerical order in presentation (neighbor sends me community 1:42 3:42, I add 2:42 and communities shown are '1:42 2:42 3:42' instead of what you maybe expect '1:42 3:42 2:42'.&lt;br&gt;&#xA;That is, your denying of community 65000 in the beginning probably does not work. If you explain your application, maybe better solution can be found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to communities in different platform, what @Teun implied is that they are quite different. Juniper had brilliant idea to use ASN as atom in their as-path regexp, normally atom is character (or byte, if you don't support UTF8). Juniper solution is clearly superior solution, if you think about character classes, say you want to match private ASN in JunOS, simple as [64512-65534]. If atom is normal character, like in IOS and Quagga, it's much more awkward.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-06-06T22:49:44.597" LastActivityDate="2013-06-06T22:49:44.597" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1680" PostTypeId="1" AcceptedAnswerId="1683" CreationDate="2013-06-06T09:24:24.290" Score="6" ViewCount="647" Body="&lt;p&gt;In a project to replace the last Cisco PIXes and VPN 3000 Concentrators we have [finally],   I've already spec'd out the new &lt;strong&gt;ASA 5515-X and 5545-X's&lt;/strong&gt;.  I have no experience with the &lt;em&gt;X&lt;/em&gt; models; only exp with the older ASAs.  These are replacing enterprise firewalls for our employees, L2L tunnels (HQ/branch), and RA VPN.  Every pair of PIXes (primary/failover) and pair of VPN 3000 (clustered) will move to a single pair of ASA-X's.    I am considering the CX Application &amp;amp; Visibility Control and Web Security Essentials option to handle all desktop/laptops and BYOD devices.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Are the AnyConnect Essentials VPN and AnyConnect Mobile licenses all that are needed to be able to do ACLs that consider device type (from some basic posture assessment of the AnyConnect client) -- no ISE in environment -- along with CX to be able to do something like block iPADs/iPhones from *.facebook.com but allow Android devices?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides the filtering above, the BYOD devices with AnyConnect would need to do RA VPN over IPSec if a particular device type (determined by ASA) and group membership (determined by ACS) are allowed -- SSL VPN not needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;And are there any client-side licenses as it seems not, since the costs of those AnyConnects ASA licenses are so dirt cheap that it almost doesn't make sense for Cisco to even charge for them -- $150 ea. MSRP for the 5515 -- and have no client-side license requirements?&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;And, yes, I'm familiar with the EOL dates for both -- VPN 3000 past and PIX in July.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-06T09:41:42.193" LastActivityDate="2013-06-07T15:54:29.323" Title="Migrating from PIX/VPN 3000 to ASA" Tags="|cisco|cisco-asa|byod|cisco-anyconnect|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1682" PostTypeId="1" AcceptedAnswerId="1687" CreationDate="2013-06-06T13:04:28.643" Score="4" ViewCount="944" Body="&lt;p&gt;I have a question about routed traffic across a site to site VPN between 2 Cisco ASA 5510's. We have our office side and our DR side and the question is could I have an IP conflict of gateway IP address' if I make changes on my DR side's ASA. Below is a description of our set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We rent a cabinet offsite for DR purposes. We have a Cisco ASA 5510 at this DR site, 5510 at the main site too, and a site to site VPN set up between them. The subnet at the DR site is the same as our server subnet (to make life easy if we need to bring up servers for an emergency) but the gateway address is different at DR than the main site. When sending any traffic between sites, we have to reach over certain subnets created in the site to site VPN and they are routable between.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So from the office to get to DR site's 10 subnet (server subnet), the site to site VPN translates: 192.168.10.0/24 to 192.168.53.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From DR to the office, it translates 192.168.10.0/24 to 192.168.52.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you're at DR and you need to see something back at the office, you reach out to 192.168.52.1 for a server for example. From the office to get to one of our VM hosts' that are storing shut down servers at DR, 192.168.53.25. This all routes fine and it's working for us.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'd like to do, and I believe I should be ok to change it since all traffic between sites has to translate to those other subnets is change that 192.168.10.8 gateway address at DR (inside interface IP on my DR ASA) to 192.168.10.10 like the gateway address I have at the office. Several reasons I'd want to do so but since I'm already a pretty wordy typer, I won't bore with more details. Let's just say it will make it a heck of a lot easier in case of an emergency but I don't want to shut one site down or the other if making this change is a bad thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does someone have experience with this and would I be ok?&lt;/p&gt;&#xA;" OwnerUserId="1575" LastEditorUserId="1575" LastEditDate="2013-06-06T14:05:25.013" LastActivityDate="2013-06-06T14:45:39.787" Title="Setting the same gateway address at a DR site as our main site" Tags="|cisco|routing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1683" PostTypeId="2" ParentId="1680" CreationDate="2013-06-06T14:13:38.320" Score="3" Body="&lt;p&gt;&lt;strong&gt;Regarding question 1 on mobile device licensing&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per your comment below, I did a couple tests on our ASA5525-X which has Essentials/Mobile licenses. I was indeed able to limit access using Dynamic Access Policies. I setup a test policy allowing only iOS devices on iPad2,7 models to connect in a new policy. Then I setup the default policy to terminate sessions. This worked and allowed my Verizon iPad Mini to connect but not my iPhone. Here is the license breakdown:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Session Type: AnyConnect&#xA;&#xA;Username     : &amp;lt;user&amp;gt;                 Index        : 40&#xA;Assigned IP  : 10.10.121.1            Public IP    : 70.194.2.165&#xA;Protocol     : AnyConnect-Parent SSL-Tunnel DTLS-Tunnel&#xA;License      : AnyConnect Essentials, AnyConnect for Mobile&#xA;Encryption   : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)RC4  DTLS-Tunnel: (1)AES128&#xA;Hashing      : AnyConnect-Parent: (1)none  SSL-Tunnel: (1)SHA1  DTLS-Tunnel: (1)SHA1&#xA;Bytes Tx     : 3200                   Bytes Rx     : 940&#xA;Group Policy : anyconnect-split-policy&#xA;Tunnel Group : anyconnect-split-group&#xA;Login Time   : 11:46:24 EDT Fri Jun 7 2013&#xA;Duration     : 0h:01m:52s&#xA;Inactivity   : 0h:00m:00s&#xA;NAC Result   : Unknown&#xA;VLAN Mapping : N/A                    VLAN         : none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: When configuring these settings, if you don't have the &quot;Apply&quot; button highlight afterwards, you will need to do something in ASDM that will activate the button and allow you to click it. None of the DAP settings for AnyConnect specifics would apply automatically nor trigger the Apply button so I could apply the settings. I had to go modify another setting, click apply, modify the setting back, click apply. This was using ASDM 7.1 on a 9.1.2 ASA5525-X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Regarding question 2 on the licensing:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are no client-side licensing options that I am aware of. The only license not necessarily tied to the ASA directly is the AnyConnect Premium which may be pulled off of a &quot;server&quot; ASA with a pool of session licenses for multiple &quot;client&quot; ASAs. In the end, they're applied to an ASA still.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source:&lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa91/license/license_management/license.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/security/asa/asa91/license/license_management/license.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-06-07T15:54:29.323" LastActivityDate="2013-06-07T15:54:29.323" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1684" PostTypeId="1" AcceptedAnswerId="1688" CreationDate="2013-06-06T14:26:25.210" Score="12" ViewCount="2126" Body="&lt;p&gt;I am working on an application that would be able to take advantage of the multi-streaming features of &lt;a href=&quot;/tags/sctp&quot; title=&quot;Stream Control Transmission Protocol&quot;&gt;SCTP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does SCTP work across the Internet? Is it supported by ISP's routers and consumer routers such as in homes and small businesses? I worry some devices may arbitrarily discard SCTP packets because they have an unusual IP protocol number.&lt;/p&gt;&#xA;" OwnerUserId="579" LastEditorUserId="49" LastEditDate="2013-06-06T15:05:37.733" LastActivityDate="2014-07-01T21:15:57.937" Title="Does SCTP work over the Internet?" Tags="|ipv4|sctp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1685" PostTypeId="1" CreationDate="2013-06-06T14:36:48.617" Score="3" ViewCount="800" Body="&lt;p&gt;What's the difference between&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;MSC-A&lt;/li&gt;&#xA;&lt;li&gt;MSC-B&lt;/li&gt;&#xA;&lt;li&gt;FP-40&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;on a CRS-1 8-S?&lt;/p&gt;&#xA;" OwnerUserId="1426" LastEditorUserId="49" LastEditDate="2013-06-06T15:14:36.183" LastActivityDate="2013-06-06T19:06:01.417" Title="Difference between MSC-A, MSC-B and FP-40" Tags="|cisco|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1686" PostTypeId="2" ParentId="1682" CreationDate="2013-06-06T14:39:27.690" Score="0" Body="&lt;p&gt;I think it makes a lot of sense to make the change so that everything at both locations is the same. Because both sites are hiding behind NAT there shouldn't be a conflict. Are you using static routing between the two locations?&lt;/p&gt;&#xA;" OwnerUserId="1562" LastActivityDate="2013-06-06T14:39:27.690" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1687" PostTypeId="2" ParentId="1682" CreationDate="2013-06-06T14:45:39.787" Score="1" Body="&lt;p&gt;from the sounds of it, you should be able to do it without much of an issue. This is simply because of the NATing that you have going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit of a warning, if the servers are all have static IPs and default gateways, changing the IP of the firewall (current gateway), may make it harder to reach the servers, as they won't know how to get to 192.168.53.0/24 without the default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to mitigate this, is to create a static route on one server that points to 192.168.10.10 for traffic going to 192.168.53.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way would be to create a new NAT rule on the ASA for an individual host on the main site. Then on the ASA at the DR site, NAT this again to be on the same subnet as the servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say, host 192.168.10.50 is NAT'd to 192.168.54.254, then pushed over the VPN. The DR ASA then NATs this again to change the source to 192.168.10.254. When the servers at the DR see this source IP, they'll know how to respond since it's in the same subnet.&lt;/p&gt;&#xA;" OwnerUserId="769" LastActivityDate="2013-06-06T14:45:39.787" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1688" PostTypeId="2" ParentId="1684" CreationDate="2013-06-06T14:52:22.733" Score="11" Body="&lt;p&gt;SCTP generally works and no special support is needed, as you implied it is just payload to IP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Certainly someone is blocking specific IP protocols (considering how many FW guys think ICMP should be blocked), but that would be exception rather than rule, generally speaking all IP protocols work just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quick test on &lt;a href=&quot;https://ring.nlnog.net/&quot; rel=&quot;noreferrer&quot;&gt;nlnog ring&lt;/a&gt; with &lt;code&gt;hping3 -c 1 -n  194.100.40.53 -0 --ipproto 132&lt;/code&gt; from about 210 boxes resulted 59 packets delivered, so only 59/210 worked in real-life test.&lt;br&gt;&#xA;I've never heard of actual transit provider filtering IP protocols, so it's the enterprise FW protecting the LAN which usually is the culprit. As long as you control the ends of the Internet connection you should be fine.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="3191" LastEditDate="2014-07-01T21:15:57.937" LastActivityDate="2014-07-01T21:15:57.937" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1689" PostTypeId="1" CreationDate="2013-06-06T15:06:54.327" Score="9" ViewCount="877" Body="&lt;p&gt;In an office environment, if I wanted to block youtube using a Cisco ISR router, I would set up the following with &lt;a href=&quot;/tags/nbar&quot; title=&quot;Network Based Application Recognition&quot;&gt;NBAR&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all YOUTUBE&#xA; match protocol http host &quot;*youtube.com*&quot;&#xA;!&#xA;policy-map DROP_YOUTUBE&#xA; class YOUTUBE&#xA;   drop&#xA;!&#xA;interface FastEthernet0/0&#xA; description TO INTERNET&#xA; service-policy output DROP_YOUTUBE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a global configuration, but how does one tweak it so that it only applies to certain workstations (via IP or MAC addresses)?&lt;/p&gt;&#xA;" OwnerUserId="851" LastEditorUserId="49" LastEditDate="2013-06-06T15:11:06.240" LastActivityDate="2018-06-08T04:18:25.193" Title="How does one specify certain IPs or MAC addresses for NBAR policy enforcement?" Tags="|cisco|router|qos|cisco-isr|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1690" PostTypeId="2" ParentId="1689" CreationDate="2013-06-06T15:09:17.180" Score="9" Body="&lt;p&gt;You could create a second match condition in the class-map matching all source IP networks you want to block (with an ACL). Any requests to youtube.com from a source IP not matched by this ACL will not be dropped.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-06-06T15:09:17.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1691" PostTypeId="1" AcceptedAnswerId="1692" CreationDate="2013-06-06T15:17:59.837" Score="10" ViewCount="5558" Body="&lt;p&gt;I have up-links to two separate ISPs on one router and receive a default route from each via BGP. Both links are the same speed and BGP is used only to advertise our prefixes out. Whats the best way to load balance across the two links? It was suggested that the easiest would be to add static default routes to the router.&lt;/p&gt;&#xA;" OwnerUserId="1576" LastActivityDate="2016-05-04T17:26:38.140" Title="load balance between two ISP bgp links" Tags="|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1692" PostTypeId="2" ParentId="1691" CreationDate="2013-06-06T15:29:48.277" Score="11" Body="&lt;p&gt;You didn't mention vendor, but if Cisco IOS, you can use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 43792&#xA;  bgp bestpath as-path multipath-relax&#xA;  address-family ipv4&#xA;    maximum-paths 2&#xA;  !&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;multipath-relax is needed as normally you'll only multipath with same as-path routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm personally strongly against carrying default routes via dynamic routing-protocols, there simply isn't any need, as long as you operate platform which supports recursive static routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider your operator router gets disconnect from their core, then you still receive the default route and your traffic is blackholed until you manually intervene. However if they'd send you some candidate route, perhaps their own PA block or maybe few PA blocks crucial to you, you could add static default routes towards these networks, if edge box is disconnected from core, the aggregate network is gone, and you can converge without manual intervention.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-06T15:29:48.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1693" PostTypeId="2" ParentId="1691" CreationDate="2013-06-06T15:32:42.090" Score="4" Body="&lt;p&gt;As @ytti mentioned, you could configure eBGP multipath, or you could also configure 2x static defaults, each one with a next-hop of your upstream. Since they're both on the same router and all you're receiving from them is a default from each provider, it's fairly simple to set up. You also want to make sure you have CEF per-packet load balancing turned off if you're running Cisco (the default setting is disabled anyway).&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-06-06T15:32:42.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1694" PostTypeId="2" ParentId="1685" CreationDate="2013-06-06T16:43:36.420" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps5763/ps5862/data_sheet_C78-457165.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSC-B&lt;/a&gt; draws a little more power than &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps5763/ps5862/product_data_sheet09186a008022d5ee.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;MSC-A&lt;/a&gt;, but they are similar in functionality.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps5763/data_sheet_c78-553673.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;FP40&lt;/a&gt; doesn't have as much buffering as the MSC cards, and it doesn't have the top-end PPS switching speed that the MSC cards do.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-06-06T16:43:36.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1697" PostTypeId="2" ParentId="1685" CreationDate="2013-06-06T19:06:01.417" Score="2" Body="&lt;p&gt;MSC has less bootflash space compared to MSC-B, and MSC-B has more surface mounted components, and as earlier said, uses slightly less power. MSC is going end-of-support earlier than MSC-B, probably partly due to the constrained bootflash space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FP-40 has one less forwarding &quot;ASIC&quot; compared to MSC/MSC-B.&lt;/p&gt;&#xA;" OwnerUserId="1580" LastActivityDate="2013-06-06T19:06:01.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1698" PostTypeId="2" ParentId="1689" CreationDate="2013-06-06T19:16:37.290" Score="9" Body="&lt;p&gt;The key is the 'match-all' or 'match-any' part of the class-map.  You may configure the class-map either way.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map {match-any | match-all} *class-map name*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you do a &quot;match-all&quot; class-map, all of the match conditions must be true in order for the traffic to match.  As Jeremy mentioned, creating an ACL matching the particular users and matching that will do what you want.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended acl-block-users&#xA;permit ip 10.25.25.0 0.0.0.255 any&#xA;!&#xA;class-map match-all YOUTUBE&#xA; match protocol http host &quot;*youtube.com*&quot;&#xA; match access-group name acl-block-users&#xA;!&#xA;policy-map DROP_YOUTUBE&#xA; class YOUTUBE&#xA;   drop&#xA;!&#xA;interface FastEthernet0/0&#xA; description TO INTERNET&#xA; service-policy output DROP_YOUTUBE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="155" LastActivityDate="2013-06-06T19:16:37.290" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1699" PostTypeId="1" AcceptedAnswerId="1700" CreationDate="2013-06-06T20:08:48.970" Score="4" ViewCount="2648" Body="&lt;p&gt;In a network that's being designed to provide wireless and wired access in a library, where there will be more or less 50 users at the same time...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where would be better to handle the DHCP requests? Would it be better to handle all those requests at a unique point, or should I handle requests from the wired and from the wireless connections in separate ways ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit&lt;/em&gt;: don't have the equipments yet, only a budget limit (will be $1,500 for network, including cables)&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="145" LastEditDate="2013-06-07T16:06:32.463" LastActivityDate="2013-06-07T16:06:32.463" Title="Where to properly put the DHCP server?" Tags="|wireless|dhcp|" AnswerCount="3" CommentCount="1" ClosedDate="2018-03-07T00:29:40.050" ContentLicense="CC BY-SA 3.0" />
  <row Id="1700" PostTypeId="2" ParentId="1699" CreationDate="2013-06-06T20:18:39.217" Score="11" Body="&lt;p&gt;We handle them on the same server. If the server is not in the same VLAN/Network as the clients, you can use dhcp relay on the layer3 device (normally the gateway) of said network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you have wireless going to vlan 10, wired vlan 15, and your server is on vlan 20; you'll configure the dhcp relay agent on vlans 10 and 15 interfaces to point to the server's IP address on vlan 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In cisco terms, the dhcp relay agent is enabled by the &lt;code&gt;ip helper-address $serverIP&lt;/code&gt; address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: &lt;code&gt;ip helper-address&lt;/code&gt; is more than a dhcp relay agent. It can be used for other protocols as well. Info here: &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=330807&amp;amp;seqNum=9&quot;&gt;http://www.ciscopress.com/articles/article.asp?p=330807&amp;amp;seqNum=9&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="769" LastActivityDate="2013-06-06T20:18:39.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1701" PostTypeId="2" ParentId="1689" CreationDate="2013-06-06T20:34:00.583" Score="-1" Body="&lt;p&gt;I don't believe you can block youtube.com with your router anymore. YouTube.com runs over HTTPS now which would disallow the router from inspecting the packets. Your best bet is to probably block the DNS requests for youtube.com so they can't reach the actual youtube servers.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-06T20:34:00.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1702" PostTypeId="2" ParentId="1648" CreationDate="2013-06-06T20:53:08.033" Score="13" Body="&lt;p&gt;Take a look at &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/l2trace.html&quot; rel=&quot;noreferrer&quot;&gt;Layer2 traceroute&lt;/a&gt; (for cisco).. Cdp should be running btw...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# traceroute mac 0000.0201.0601 0000.0201.0201&#xA;Source 0000.0201.0601 found on con6[WS-C2950G-24-EI] (2.2.6.6)&#xA;con6 (2.2.6.6) :Fa0/1 =&amp;gt; Fa0/3&#xA;con5                 (2.2.5.5        )  :    Fa0/3 =&amp;gt; Gi0/1&#xA;con1                 (2.2.1.1        )  :    Gi0/1 =&amp;gt; Gi0/2&#xA;con2                 (2.2.2.2        )  :    Gi0/2 =&amp;gt; Fa0/1&#xA;Destination 0000.0201.0201 found on con2[WS-C3550-24] (2.2.2.2)&#xA;Layer 2 trace completed&#xA;Router# &#xA;Router# traceroute mac 0001.0000.0204 0001.0000.0304 detail &#xA;Source 0001.0000.0204 found on VAYU[WS-C6509] (2.1.1.10)&#xA;1 VAYU / WS-C6509 / 2.1.1.10 :&#xA;                Gi6/1 [full, 1000M] =&amp;gt; Po100 [auto, auto]&#xA;2 PANI / WS-C6509 / 2.1.1.12 :&#xA;                Po100 [auto, auto] =&amp;gt; Po110 [auto, auto]&#xA;3 BUMI / WS-C6509 / 2.1.1.13 :&#xA;                Po110 [auto, auto] =&amp;gt; Po120 [auto, auto]&#xA;4 AGNI / WS-C6509 / 2.1.1.11 :&#xA;                Po120 [auto, auto] =&amp;gt; Gi8/12 [full, 1000M] Destination 0001.0000.0304 &#xA;found on AGNI[WS-C6509] (2.1.1.11) Layer 2 trace completed.&#xA;Router# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="209" LastEditorUserId="775" LastEditDate="2013-07-02T11:26:21.213" LastActivityDate="2013-07-02T11:26:21.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1703" PostTypeId="2" ParentId="874" CreationDate="2013-06-06T20:56:08.980" Score="9" Body="&lt;p&gt;I opened a case with HP concerning this issue.  After escalating past the useless Level 1 tech, the Level 2 tech very alertly spotted something that I had not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SRX is sending its DHCPDISCOVER packet with a TTL of 1.  The Procurve's apparently will decrement the TTL and use the resulting TTL in the relay'ed packet to the DHCP server.  In this case, the decrement leaves the TTL at 0 meaning the packet gets dropped on the floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is actually in spec for DHCP/BOOTP relay, though clearly it causes reduced interoperability.  I have asked HPNetworking to treat this as a bug/RFE and change the behavior.  No immediate response to that request in the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SRX sending the DHCPDISCOVER with a TTL of 1 is also probably within spec, but, again, a choice of reduced interoperability, so I plan to open a case with JTAC on the same basis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll add more info on the response of Juniper and HP as it becomes available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Incidentally, I have tested the relay behavior of a Cisco 4506 (firmware version not immediately available), and a Brocade/Foundry FastIron Edge X (7.2 or 7.3 firmware, I believe, don't have immediate access to confirm) and they both handle relaying the request with TTL 1 without issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&#xA;There is a way to change the TTL value that the SRX uses on its DHCP requests, but its not from within the JunOS cli...its done from the underlying Unix OS.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@% sysctl -w net.inet.ip.mcast_ttl=64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have opened an RFE with HP to make their relaying function more resilient, but not response from them yet on if/when that will be worked on.&lt;/p&gt;&#xA;" OwnerUserId="97" LastEditorUserId="97" LastEditDate="2013-08-27T13:49:34.940" LastActivityDate="2013-08-27T13:49:34.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1704" PostTypeId="1" AcceptedAnswerId="1705" CreationDate="2013-06-06T20:59:13.953" Score="5" ViewCount="3381" Body="&lt;p&gt;I am thinking especially of VLANs, which represent separate subnets that may need only one switch.&lt;/p&gt;&#xA;" OwnerUserId="562" LastActivityDate="2013-06-06T22:11:34.847" Title="Is a router always necessary to link two subnets?" Tags="|switch|router|vlan|subnet|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1705" PostTypeId="2" ParentId="1704" CreationDate="2013-06-06T21:02:35.600" Score="14" Body="&lt;p&gt;You need a Layer-3 capable device to route between VLANs. This can be a L3-capable switch though, it doesn't have to be a &lt;em&gt;separate&lt;/em&gt; router.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-06-06T21:02:35.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1706" PostTypeId="2" ParentId="1704" CreationDate="2013-06-06T21:14:38.323" Score="6" Body="&lt;p&gt;Before things like &quot;virtual interfaces&quot; came around, you would need a separate router to terminate layer 3 connectivity for VLANs. The term originally used was &quot;router on a stick&quot; because there was a single VLAN trunk connecting to the router, and subinterfaces of the router's interface which connected to the switch were used to create the layer 3 entities that were representative of each VLAN's subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @Aziraphale has said, With modern switches, this is no longer necessary. Assuming your switch is running the right version of code, it's usually just as simple as defining interfaces for your L2 Vlans. For a Cisco switch running IOS, something along the lines of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;vlan 100  &amp;lt;--- this creates the L2 VLAN. What shows up in &quot;show vlan id&quot;&#xA;name Marketing&#xA;exit&#xA;interface vlan 100  &amp;lt;--- This creates the L3 endpoint for your VLAN, called an &quot;SVI&quot;&#xA;ip address 192.168.1.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the switch is running L3 capable code, this creates a directly connected network in the switch's routing table. If you repeated this with 2 different VLANs with different subnets, you can now route between those three VLANs in one box.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-06T21:20:55.957" LastActivityDate="2013-06-06T21:20:55.957" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1707" PostTypeId="1" CreationDate="2013-06-06T21:53:01.990" Score="4" ViewCount="3586" Body="&lt;p&gt;Out of the box, it seems that the Juniper management routing is part of the default route table. Can I use logical systems to isolate the service plane from management routing? Are there any drawbacks?&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="775" LastEditDate="2013-06-07T09:33:28.033" LastActivityDate="2013-06-07T09:33:28.033" Title="Isolating Juniper Management Plane" Tags="|routing|juniper-junos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1708" PostTypeId="2" ParentId="1707" CreationDate="2013-06-06T22:07:17.950" Score="8" Body="&lt;p&gt;This can easily turn into a debate, sure you could do management in different logical-system, but what are the perceived gains? You're still going to need to protect the main instance just the same.&lt;br&gt;&#xA;In my opinion you gain nothing but you add complexity, which means added risk of downtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be different matter on SUP2T or Nexus7k with CMP, where you truly have separate out-of-band interface available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My recommendation would be to optimize for least complexity, do on-band ssh management via normal main instance and have RS232 (alas, necessary evil) as back-up out-of-band.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you go through this route, it'll work, there will be some inconveniences like copying software, but you can cope with it, with 'set cli logical-system MGMT'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need two solution, one for normal day-to-day work, and another for OOB, when system or network is broken. OOB is easy, you need RS232, as RS232 is only solution you can use, to try to reboot box when junos is not running or unresponsive (set system debugger-on-break).&lt;br&gt;&#xA;For your main day-to-day work, it's more debatable, you have three options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;use on-band (same routes as production INET)&lt;/li&gt;&#xA;&lt;li&gt;use routing-instance (you'll get routing separation, but use same copy of RPD, but I guess you're using FXP0, which is not supported here)&lt;/li&gt;&#xA;&lt;li&gt;use logical-system, another copy of RPD is ran just for MGMT&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You mentioned need to have symmetric route. I assume from this, that you want to use FXP0 for MGMT and you have another competing route for return traffic,  which you need, as NMS server network is used for something else than just NMS, which is bit worrying.&lt;br&gt;&#xA;In my opinion FXP0 is simply not needed, as it's not OOB (like CMP is) you cannot even protect FXP0 port via FW filter, as it's not HW interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if we assume that you want to keep using FXP0 then you indeed pretty-much MUST put it in logical-system, even if you didn't have competing route for NMS, you'd still need to put FXP0 in logical-system, otherwise you expose your NMS network to attacks from the on-band, which you cannot protect, as you cannot put HW FW filter in the FXP0 interface.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-06-07T06:57:31.507" LastActivityDate="2013-06-07T06:57:31.507" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1709" PostTypeId="2" ParentId="1704" CreationDate="2013-06-06T22:11:34.847" Score="4" Body="&lt;p&gt;To add to everyone else, VLANs represent separate broadcast domains, and require a Layer-3 capable device to route packets between them. &lt;/p&gt;&#xA;" OwnerUserId="572" LastActivityDate="2013-06-06T22:11:34.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1710" PostTypeId="2" ParentId="1699" CreationDate="2013-06-06T22:58:11.700" Score="4" Body="&lt;p&gt;In general the use of multiple production DHCP servers within an organization tends to be a function of scale and availability.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scale is going to be driven by the number of clients, the churn of said clients and, of course, the duration between reservation requests.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Availability is just a question of how much impact the loss of a server would create vs the cost to maintain (and synchronize) a redundant pair.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's hard to make a definitive recommendation without knowing a bit more about the environment but at ~50 concurrent users it's incredibly unlikely that you'd be taxing just about any platform in common use today. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to availability - losing DHCP can render the network virtually unusable.  My usual tendency is to run redundant pairs if at all possible, but without knowing design/platform/budget constraints I can't really say if it would make sense in your environment.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-06-06T22:58:11.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1711" PostTypeId="2" ParentId="1699" CreationDate="2013-06-07T00:39:50.270" Score="4" Body="&lt;p&gt;&lt;strong&gt;A pair of DHCP servers could easily handle many different subnets and provides redundancy.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Separate VLANs for wired and wireless in this small network requires a little more setup, but I'd say it is still the way to go to give flexibility in security policies that might be different between the two connections types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantages to sharing DHCP servers for wired and wireless are easier administration and troubleshooting, and you'll be able to create server-level options that can be shared across all scope options.  For example, if you push the same DNS servers (Option 6) and DNS Domain Name (option 15) down to all of your DHCP clients, you can create these as server options, and only the default gateway/router (Option 3) needs to be different for each scope.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please see all the answers on &lt;a href=&quot;https://networkengineering.stackexchange.com/a/1659/630&quot;&gt;Setting up DHCP server on the router or on the switch&lt;/a&gt;  for more DHCP info.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-06-07T00:44:56.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1712" PostTypeId="1" CreationDate="2013-06-07T05:35:17.583" Score="8" ViewCount="4416" Body="&lt;p&gt;I know traffic policing isn't something that you normally find in a LAN environment, and I wish I wouldn't be finding it in mine. That being said... I have no choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device is a 3750X. The requirement is to POLICE (not shape) all traffic coming to/from the 10.0.0.0 and 10.0.1.0 networks to a MAXIMUM of ~48Mbps. Below is the configuration I've come up with. Whatd'ya reckon? Also, I know I should probably have this configured on the inbound interface, but that's a whole 'nother story...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended acl-police&#xA; permit ip 10.0.0.0 0.0.0.255 10.0.1.0 0.0.0.255&#xA; permit ip 10.0.1.0 0.0.0.255 10.0.0.0 0.0.0.255&#xA;!&#xA;class-map police-san&#xA; match access-group name acl-police&#xA;!&#xA;policy-map police-san-replication&#xA; class police-san&#xA;  police 47000000 10000 20000 conform-action transmit exceed-action drop&#xA;&#xA;interface &amp;lt;outbound&amp;gt;&#xA;service-policy output police-san-replication&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One other thing... Can anyone explain to me the &lt;em&gt;&quot;burst-normal&quot;&lt;/em&gt; &amp;amp; &lt;em&gt;&quot;burst-max&quot;&lt;/em&gt;? Is this allowing it to burst above the police limit (bps) that I defined? What are the timer thresholds for that? Should I configure these burst numbers smaller? Larger?&lt;/p&gt;&#xA;" OwnerUserId="756" LastEditorUserId="775" LastEditDate="2013-06-07T09:26:06.487" LastActivityDate="2013-06-08T09:37:52.730" Title="Traffic Policing" Tags="|cisco|cisco-catalyst|qos|policing|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1713" PostTypeId="1" AcceptedAnswerId="10677" CreationDate="2013-06-07T05:54:07.383" Score="9" ViewCount="8813" Body="&lt;p&gt;&lt;strong&gt;Context&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I currently have :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 pfSense 2.0.2 router (on a Firebox X-Peak X5000)&lt;/li&gt;&#xA;&lt;li&gt;2 WAN&lt;/li&gt;&#xA;&lt;li&gt;1 LAN&lt;/li&gt;&#xA;&lt;li&gt;3 Servers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My interfaces&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;WAN1 68.XX.XXX.98 to 69.XX.XXX.102&lt;/li&gt;&#xA;&lt;li&gt;WAN2 65.XXX.XXX.58 to 66.XXX.XXX.62&lt;/li&gt;&#xA;&lt;li&gt;LAN 192.168.1.XXX&lt;/li&gt;&#xA;&lt;li&gt;DMZ&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My router is configured like this :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Load balancing with a Gateway group based on this &lt;a href=&quot;http://doc.pfsense.org/index.php/Multi-WAN_2.0&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;NAT&lt;/li&gt;&#xA;&lt;li&gt;Rules to LAN servers&lt;/li&gt;&#xA;&lt;li&gt;Bridge between WAN2 and DMZ (with external IPs on one DMZ server) - but can't communicate between this server and other servers on LAN passing by external IP address. With a custom route configuration I've been able to handle requests from LAN to server on DMZ, but I don't like doing it like this.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My servers are using local IP addresses &lt;code&gt;192.168.1.XXX&lt;/code&gt;, so the same for my computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Expecting&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to do two things :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1 Bridge the two WANs with a DMZ and LAN behind NAT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the possibility to attribute external IP addresses to servers, and possibility to mix IPs to same server from both WANs. I would also like to be able to communicate with servers from the LAN example :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.100 &amp;lt;--&amp;gt; http://68.XX.XXX.99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also being able to communicate from server to another server example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;65.XXX.XXX.59 &amp;lt;--&amp;gt; http://68.XX.XXX.99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Will I need to dedicate one external IP address for computers on LAN behind NAT?&lt;/li&gt;&#xA;&lt;li&gt;Will I be able to keep the load-balacing working for the NAT?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note : I would like to avoid one-to-one NAT, having local IP addresses on server complicate virtual hosting configuration so I prefer having external addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2 Router hardware redondancy (CARP)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have one more Firebox X-Peak X5000 identical, and would like to put it as a backup, if the first one fail, the second could take over without (or almost) loosing network (i.e., requests from outside to server must work, also from LAN and servers to Internet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read this &lt;a href=&quot;http://doc.pfsense.org/index.php/Configuring_pfSense_Hardware_Redundancy_%28CARP%29&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt;, but I have no idea if it could work with my configuration (Bridge + NAT + Load balancing)&lt;/p&gt;&#xA;" OwnerUserId="1496" LastEditorUserId="1496" LastEditDate="2013-06-07T19:22:20.933" LastActivityDate="2014-08-28T17:48:28.750" Title="pfSense multi-wan Bridge, NAT, Load balancing and CARP" Tags="|nat|failover|pfsense|pfsense-2|bridge|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1714" PostTypeId="2" ParentId="1712" CreationDate="2013-06-07T07:12:15.220" Score="7" Body="&lt;p&gt;Your burst values look a bit small. Choosing burst values is not easy and testing might be required to get it right. Also if I remember correctly 3750 does not support policing on egress. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bc works a bit different in policing than it does in shaping. With shaping you buffer packets and you have a token bucket where ever Tc (time interval) you have Bc (Commited Burst) bytes added to the bucket. The formula is Tc = Bc / CIR. On some platforms Tc is fixed as well so you don't have the option of configuring it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you use policing you don't use fixed time intervals. Instead when packet arrives policer calculates how many bytes have accumulated. So say that you are policing at 10 Mbit/s. You have configured a Bc of 10000 bytes. A burst packet arrives at t0 that make up 5000 bytes of traffic. So 5000 bytes are deducted. Then at t1 5 ms later another batch of 5000 bytes of packets arrive. The policer is set 10 Mbit/s, which is 1250000 bytes per second. That means that 1250000 * 0,005 = 6250 bytes have been added to the 5000 that were left from the first run at t0. So the packets are allowed through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From this example you can see that at t1 it could have been allowed to send 5000 + 6250 = 11250 bytes but because Bc was set to 10000 bytes the policer would drop anything above that. What if 6000 bytes of packets had arrived? Then some packets would have to be dropped. This is where Be comes into play. Be will allow to accumulate some extra credit from idle intervals. So if Be had been configured to be 20000 bytes then the 6000 bytes could have been passed through the policer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be adds a bit of fairness to the policer but it also allows bigger bursts of traffic to go through. Remember that in the end the CIR is still enforced so on average it's not possible to send more than CIR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos/topics/concept/policer-mx-m120-m320-burstsize-determining.html&quot;&gt;article&lt;/a&gt; from Juniper recommends setting burst to 5ms worth of traffic which in your case would be 6250000 bytes. &lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="105" LastEditDate="2013-06-07T07:52:02.217" LastActivityDate="2013-06-07T07:52:02.217" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1715" PostTypeId="2" ParentId="1712" CreationDate="2013-06-07T08:07:22.070" Score="10" Body="&lt;p&gt;I would use vlan-based policing which works better on these switches. This is an example matching a speed value of 48Mb&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mls qos&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; switchport access vlan 500&#xA; switchport mode access&#xA; mls qos vlan-based&#xA;!&#xA;class-map match-all CUSTOMER_1&#xA; match input-interface  GigabitEthernet1/0/2&#xA;!&#xA;policy-map VLAN500_POLICE&#xA; class CUSTOMER_1&#xA;  police 48000000 18000000 exceed-action drop&#xA;!&#xA;policy-map VLAN500_PARENT&#xA; class class-default&#xA;  set dscp default&#xA;  service-policy VLAN500_POLICE&#xA;!&#xA;interface Vlan500&#xA; service-policy input VLAN500_PARENT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Under the parent policy you have to 'set' something in order for it to work. This could be anything so in this example I'm simply setting the dscp to 0&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-06-07T08:07:22.070" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1717" PostTypeId="2" ParentId="1712" CreationDate="2013-06-07T08:48:21.453" Score="7" Body="&lt;p&gt;I don't think egress policing works on this platform, but you'd need to use SRR, and frankly shaping is always preferable when possible.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enabling 'mls qos' willy-nilly on 3750 can be recipe for disaster, the defaults are horrible, e.g. EF gets policed at 4%. So you should at least read:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-8093&quot; rel=&quot;nofollow&quot;&gt;How to maximize available buffers&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps5023/products_tech_note09186a0080883f9e.shtml&quot; rel=&quot;nofollow&quot;&gt;Cisco Catalyst 3750 QoS Configuration Examples&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/15.0_2_ez/configuration/guide/3750x_cg.html&quot; rel=&quot;nofollow&quot;&gt;Configuration Guide&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For ingress your suggested config should work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to offer some additional thoughts on dimensioning your CIR buffer, I know that traditional Cisco CCO lore talks about RTT, but RTT actually has nothing to do with policer, as your router/switch does not care how long packet has been in-flight when it arrives. What is of key importance is rate of ingress interface, as ingress interface physical rate determines how fast your 'bucket' is being filled and policer rate determines how fast it is emptied.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;JNPR formula (burst_time * interface_rate) is quite useful rule-of-thumb, so if you have 10G ingress interface and you have 1Mbps egress policer on interface A and 100Mbps egress policer on interface B, both [AB] policers should have same CIR buffer, say 10G * 5ms to handle 5ms burst, just tune the time to fit the burstiness of your traffic profile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using 'CIR Buffer' liberally, as technically policing adds no buffering outside from your normal interface buffers. It just means how many bytes will be send out, without applying policer. This is needed, as otherwise each single packet would exceed policer rate and observable rate would be 0.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-06-08T09:37:52.730" LastActivityDate="2013-06-08T09:37:52.730" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1718" PostTypeId="1" AcceptedAnswerId="1719" CreationDate="2013-06-07T09:13:00.747" Score="6" ViewCount="3166" Body="&lt;p&gt;I have a VPN set up between several offices. All but one work fine. With one office, I can ping the printer 192.168.45.30 but not a server 192.168.45.242. Well, I say I can't but when the server was first powered up, I could ping it for about 30 seconds and then it disappeared. I can still ping it from the remote router (local to the server) but not from my desktop across the VPN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This problem has been going on for some time so I replaced the router at the remote office with a similar (not identical) router and had the same problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had Draytek support look at the routers and they seem fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set up the original router at my home and created a VPN connection to there, set up a duplicate server and everything worked as expected. I sent the duplicate server to the remote office... I can ping it a little as it starts up then it dissappears.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Head Office 192.168.42.0 (Firewall / VPN concentrator Draytek Vigor 2955 through a Cisco 1841 router&lt;br/&gt;&#xA;My PC 192.168.42.249&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remote office 192.168.45.0 (Draytek Vigor 2830 ADSL router&lt;br/&gt;&#xA;Remote printer 192.168.45.30 (can ping)&lt;br/&gt;&#xA;Remote server 192.168.45.242 (can't ping)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Home office (using old Draytek Vigor 2820 router from remote office) 192.168.5.0&lt;br/&gt;&#xA;Duplicate server 192.168.5.237 (could ping etc but now at remote office)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I can see the routers are working correctly and so is the server so where is my connection being blocked?&lt;br/&gt;Can another device on the network block the connection to the server? At present the server is plugged directly into the router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately it is difficult for me to get to the remote office and I obviously have restricted connectivity, but any ideas of things I could check or try would be much appreciated.  &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Ah ha! I just asked somebody at the remote office to unplug everything from the router except the server and I can get a stable connection to it. So it must be another device on the network. Any suggestions where to look? &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Edit after fixing the problem by changing IP address of server to 192.168.45.29&lt;br/&gt;&#xA;I can't ping 192.168.45.242 from my workstation, but I can still do so from the remote router, so there is obviously something there, but it must be set to only respond to local pings.&lt;/p&gt;&#xA;" OwnerUserId="1585" LastEditorUserId="1585" LastEditDate="2013-06-07T12:45:48.010" LastActivityDate="2013-06-07T12:45:48.010" Title="VPN Connection: Can ping printer but not server what is blocking things?" Tags="|vpn|troubleshooting|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1719" PostTypeId="2" ParentId="1718" CreationDate="2013-06-07T09:27:27.430" Score="10" Body="&lt;p&gt;Since you are temporarily able to ping the server, VPN and ACLs should be fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend to verify:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;A local firewall on the server could block the ICMP requests. The fact that it responds at startup, but stops later, leads to this assumption.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There may be an IP conflict, i.e. another device in the network with the same IP. That cause is possible since it works if you unplug all other devices.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="231" LastActivityDate="2013-06-07T09:27:27.430" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1720" PostTypeId="1" AcceptedAnswerId="9656" CreationDate="2013-06-07T11:08:25.017" Score="9" ViewCount="1573" Body="&lt;p&gt;I recently replaced wireless at a site from the internal AP on an 877-WM with a (standalone) 1262 running 15.2(2)JB. I've configured the AP pretty much the same as I always do for Cisco AP's for single SSID operation (single bridge domain, BVI1 also management), and things seem to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However on my laptop I have VMware running, and a guest with NIC set to bridged mode is unable to DHCP, however IPv6 works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When searching for this problem I see a reference to a &quot;ip-mac-binding disable&quot; command on WLC setups, but can't find if that maps to a setting on a single AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant part of the AP's configuration is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dot11 ssid # Removed&#xA;   authentication open &#xA;   authentication key-management wpa&#xA;   guest-mode&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii # Removed&#xA;!&#xA;bridge irb&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; !&#xA; encryption mode ciphers aes-ccm &#xA; !&#xA; ssid # Removed&#xA; !&#xA; station-role root&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1&#xA; # Pretty much the same as radio 0&#xA;&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; no keepalive&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; no bridge-group 1 source-learning&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="348" LastActivityDate="2014-06-27T20:36:07.940" Title="VM on a client connected to a Cisco 1262 unable to DHCP (but IPv6 works fine)" Tags="|cisco|wireless|" AnswerCount="3" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="1721" PostTypeId="1" AcceptedAnswerId="1740" CreationDate="2013-06-07T14:31:01.953" Score="7" ViewCount="669" Body="&lt;p&gt;This &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.3/topics/concept/logical-systems-supported-features.html&quot;&gt;reference&lt;/a&gt; states that class of service is supported in a logical system, but another &lt;a href=&quot;http://www.juniper.net/techpubs/software/junos/junos94/swconfig-policy/unsupported-configuration-statements-actions-and-action-modifiers.html&quot;&gt;reference&lt;/a&gt; disagrees. This may be a disparity between versions, but I have notoiced there is no class of service stanza in a logical system on 12.3. Does the global CoS config apply to logical systems; will the following work as imagined?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set logical-systems prod interfaces ge-1/1/1 unit 0&#xA;set class-of-service interfaces ge-1/1/1 unit 0 rewrite-rules dscp default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="161" LastEditorUserId="59" LastEditDate="2013-06-10T11:58:39.007" LastActivityDate="2013-06-10T11:58:39.007" Title="Is CoS supported in a logical system?" Tags="|juniper|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1722" PostTypeId="1" CreationDate="2013-06-07T15:22:54.953" Score="14" ViewCount="4888" Body="&lt;p&gt;I am having an issue getting a &lt;a href=&quot;/tags/vpls&quot; title=&quot;Virtual Private LAN Service&quot;&gt;VPLS&lt;/a&gt; up using an ME3600x with 15.3(2) and BGP signalling.&#xA;@yelfathi and @packettalk have pointed me down the correct route but not sure how to resolve it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 ME3600 switches using &lt;a href=&quot;/tags/rsvp&quot; title=&quot;Resource Reservation Protocol&quot;&gt;RSVP&lt;/a&gt; as PE and 2 MX80 routers as P.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The P routers show the LSP's as transit LSP correctly and my TE tunnels are up.  On both switches I get the following:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1.THN-LON#show mpls L2transport vc 501 detail&#xA;Local interface: VFI FLVPLS001 vfi up&#xA;Interworking type is Ethernet&#xA;Destination address: 46.226.0.10, VC ID: 501, VC status: down&#xA;Last error: MPLS dataplane reported a fault to the nexthop&#xA;Output interface: none, imposed label stack {}&#xA;Preferred path: not configured&#xA;Default path: no route&#xA;No adjacency&#xA;Create time: 00:19:42, last status change time: 00:19:42&#xA;Last label FSM state change time: 00:19:42&#xA;Signaling protocol: BGP&#xA;Status TLV support (local/remote)   : Not Applicable&#xA;  LDP route watch                   : Not Applicable&#xA;  Label/status state machine        : activating, LruRruD&#xA;  Last local dataplane   status rcvd: DOWN(pw-tx-fault)&#xA;  Last BFD dataplane     status rcvd: Not Applicable&#xA;  Last BFD peer monitor  status rcvd: Not Applicable&#xA;  Last local AC  circuit status rcvd: No fault&#xA;  Last local AC  circuit status sent: DOWN(pw-rx-fault)&#xA;  Last local PW i/f circ status rcvd: No fault&#xA;  Last local LDP TLV     status sent: Not Applicable&#xA;  Last remote LDP TLV    status rcvd: Not Applicable&#xA;  Last remote LDP ADJ    status rcvd: Not Applicable&#xA;MPLS VC labels: local 27, remote 16&#xA;Group ID: local 0, remote 0&#xA;MTU: local 1500, remote 1500&#xA;Control Word: Off&#xA;Dataplane:&#xA;SSM segment/switch IDs: 0/10075 (used), PWID: 12&#xA;VC statistics:&#xA;transit packet totals: receive 0, send 0&#xA;transit byte totals:   receive 0, send 0&#xA;transit packet drops:  receive 0, seq error 0, send 0&#xA;&#xA;&#xA;SW1.THN-LON#show mpls for 46.226.0.10 detail&#xA;Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop  &#xA;Label      Label      or Tunnel Id     Switched      interface            &#xA;None       304720     46.226.0.10/32   0             Tu0        point2point&#xA;MAC/Encaps=14/18, MRU=9000, Label Stack{304720}, via Te0/2&#xA;A8D0E55DEB3D88F077938CDB8847 4A650000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The pseudo wires are up but still the VC is down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When doing the following command it comms back saying no FEC mapping.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1.THN-LON#ping mpls ipv4 46.226.0.10/32 &#xA;Sending 5, 100-byte MPLS Echos to Target FEC Stack TLV descriptor, &#xA; timeout is 2 seconds, send interval is 0 msec:&#xA;&#xA;Codes: '!' - success, 'Q' - request not sent, '.' - timeout,&#xA;'L' - labeled output interface, 'B' - unlabeled output interface, &#xA;'D' - DS Map mismatch, 'F' - no FEC mapping, 'f' - FEC mismatch,&#xA;'M' - malformed request, 'm' - unsupported tlvs, 'N' - no label entry, &#xA;'P' - no rx intf label prot, 'p' - premature termination of LSP, &#xA;'R' - transit router, 'I' - unknown upstream index,&#xA;'l' - Label switched with FEC change, 'd' - see DDMAP for return code,&#xA;'X' - unknown return code, 'x' - return code 0&#xA;&#xA;Type escape sequence to abort.&#xA;FFFFF&#xA;Success rate is 0 percent (0/5)&#xA;Total Time Elapsed 48 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Config for the switch re relevant parts as follows:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel0&#xA; description sw1.thn-lon-to-sw1.sco-edi&#xA; ip unnumbered Loopback0&#xA; tunnel mode mpls traffic-eng&#xA; tunnel destination 46.226.0.10&#xA; tunnel mpls traffic-eng autoroute announce&#xA; tunnel mpls traffic-eng priority 1 1&#xA; tunnel mpls traffic-eng path-option 1 dynamic&#xA;&#xA;mpls traffic-eng tunnels&#xA;l2vpn vfi context FLVPLS001 &#xA; vpn id 501&#xA; autodiscovery bgp signaling bgp &#xA;  ve id 1&#xA;  rd 56595:501&#xA;  route-target export 56595:501&#xA;  route-target import 56595:501&#xA;&#xA;bridge-domain 501 &#xA; member GigabitEthernet0/1 service-instance 2&#xA;&#xA;&#xA;interface GigabitEthernet0/1&#xA; description customer xxx&#xA; switchport trunk allowed vlan none&#xA; switchport mode trunk&#xA; mtu 1600&#xA; speed 100&#xA; duplex full&#xA; service instance 1 ethernet&#xA;  description Cust: xxx&#xA;  encapsulation dot1q 400&#xA;  rewrite ingress tag pop 1 symmetric&#xA; !        &#xA; service instance 2 ethernet&#xA;  description Oil and Gas VPLS&#xA;  encapsulation dot1q 501&#xA;  rewrite ingress tag pop 1 symmetric&#xA;&#xA;interface Vlan501&#xA; no ip address&#xA; member vfi FLVPLS001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help/commands etc greatly appreciated&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 56595  &#xA; bgp log-neighbor-changes  &#xA; bgp graceful-restart restart-time 120  &#xA; bgp graceful-restart stalepath-time 360  &#xA; bgp graceful-restart  &#xA; neighbor 46.226.0.10 remote-as 56595  &#xA; neighbor 46.226.0.10 update-source Loopback0  &#xA; !  &#xA; address-family l2vpn vpls  &#xA;  neighbor 46.226.0.10 activate  &#xA;  neighbor 46.226.0.10 send-community extended  &#xA;  neighbor 46.226.0.10 suppress-signaling-protocol ldp  &#xA; exit-address-family  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have added ospf config for completeness.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA; redistribute connected subnets&#xA; redistribute static subnets&#xA; network 46.226.6.80 0.0.0.3 area 0.0.0.0&#xA; mpls traffic-eng router-id Loopback0&#xA; mpls traffic-eng area 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;some events from debug atom events&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: Evt dataplane reactivateS, in activating&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: . Activate dataplane&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: . Need to setup the dataplane&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: . Setup dataplane, PWID 21&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: .. Provision SSM with PWID 21, VC ID 501, Block ID 3&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: .. Set imp flags: ra&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: ..              : nsf&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: .. No signal context found, defaulting to single segment PW&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: .. Provision SSM with 7540/20332 (sw/seg)&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: Receive SSM dataplane unavailable notification&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: Evt dataplane downS, in activating&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: . Dataplane unavailable&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: . Set last error: MPLS dataplane reported a fault to the nexthop&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: . Notify dataplane down&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: Deactivating data plane&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: Notify dataplane down&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: Unprovision and deallocate SSM segment&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: Added vc to 60 sec retry queue&#xA;*Jun  8 05:31:57.748: AToM[46.226.0.12, 501]: Event provision retry already in retry queue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output of bgp &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1.THN-LON#show bgp l2vpn vpls all&#xA;BGP table version is 17, local router ID is 46.226.0.12&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal, &#xA;          r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, &#xA;          x best-external, a additional-path, c RIB-compressed, &#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;RPKI validation codes: V valid, I invalid, N Not found&#xA;&#xA; Network          Next Hop            Metric LocPrf Weight Path&#xA;Route Distinguisher: 56595:501&#xA; *&amp;gt;  56595:501:VEID-1:Blk-1/136&#xA;                   0.0.0.0                            32768 ?&#xA; *&amp;gt;i 56595:501:VEID-2:Blk-1/136&#xA;                   46.226.0.10              0    100      0 ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;after some help from @ytti we have narrowed it to a bug within the me3600 regarding BGP signalling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We changed signalling to be LDP and it worked fine.  Will post an update once resolved with Cisco.&lt;/p&gt;&#xA;" OwnerUserId="1591" LastEditorUserId="33" LastEditDate="2013-07-30T23:56:21.490" LastActivityDate="2013-07-30T23:56:21.490" Title="BGP signalled MPLS issues" Tags="|cisco-ios|mpls|vpls|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1723" PostTypeId="5" CreationDate="2013-06-07T16:27:17.040" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-06-07T16:27:17.040" LastActivityDate="2013-06-07T16:27:17.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1724" PostTypeId="4" CreationDate="2013-06-07T16:27:17.040" Score="0" Body="pfSense is a free, open source customized distribution of FreeBSD tailored for use as a firewall and router. In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution." OwnerUserId="1496" LastEditorUserId="1496" LastEditDate="2013-06-07T17:03:08.430" LastActivityDate="2013-06-07T17:03:08.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1725" PostTypeId="5" CreationDate="2013-06-07T16:28:32.530" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-06-07T16:28:32.530" LastActivityDate="2013-06-07T16:28:32.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1726" PostTypeId="4" CreationDate="2013-06-07T16:28:32.530" Score="0" Body="pfSense is a free, open source customized distribution of FreeBSD tailored for use as a firewall and router. In addition to being a powerful, flexible firewalling and routing platform, it includes a long list of related features and a package system allowing further expandability without adding bloat and potential security vulnerabilities to the base distribution." OwnerUserId="1496" LastEditorUserId="1496" LastEditDate="2013-06-07T17:02:47.430" LastActivityDate="2013-06-07T17:02:47.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1727" PostTypeId="5" CreationDate="2013-06-07T16:29:17.890" Score="0" Body="&lt;p&gt;Network bridging describes the action taken by network equipment to allow two or more communication networks, or two or more network segments, to create an aggregate network. Bridging is distinct from routing which allows the networks to communicate independently as separate networks. A network bridge is a network device that connects more than one network segment. In the OSI model bridging acts in the first two layers, below the network layer.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="775" LastEditDate="2023-11-17T11:24:59.480" LastActivityDate="2023-11-17T11:24:59.480" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="1728" PostTypeId="4" CreationDate="2013-06-07T16:29:17.890" Score="0" Body="Network bridging describes the action taken by network equipment to allow two or more communication networks, or two or more network segments, to create an aggregate network. Bridging is distinct from routing which allows the networks to communicate independently as separate networks. A network bridge is a network device that connects more than one network segment. In the OSI model bridging acts in the first two layers, below the network layer." OwnerUserId="1496" LastEditorUserId="1496" LastEditDate="2013-06-07T17:02:09.333" LastActivityDate="2013-06-07T17:02:09.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1729" PostTypeId="2" ParentId="1722" CreationDate="2013-06-07T17:55:28.387" Score="0" Body="&lt;p&gt;Seems a forwarding-plane problem somewhere on the way down to the egress switch.&#xA;What's the ouput of: ping mpls ipv4 46.226.0.10/32 verbose?&lt;/p&gt;&#xA;" OwnerUserId="530" LastActivityDate="2013-06-07T17:55:28.387" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1730" PostTypeId="2" ParentId="1713" CreationDate="2013-06-07T19:04:13.070" Score="2" Body="&lt;p&gt;This could be cleared up quite nicely by using a one-to-one (or static) NAT. Your interfaces would be set up the same as they currently are, only difference is you wouldn't bridge the WAN/DMZ interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing this will not accomplish is allowing you to speak from the LAN address space to your external address space. I assume the issue there is perhaps a DNS request is returning the external address? If that's the case then you could change your BIND config to include two different views - an internal and external - to provide different returns based on the source of the DNS request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the only other solution - to get everything that you're asking for here - is to have both ISPs assign you another block of addresses that you'd use on your DMZ interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the hardware failure bit, this should work fine as long as your interfaces are connected in the same L2 area as the fist firewall. It sounds like it's active/passive so this should be fine.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-06-07T19:04:13.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1731" PostTypeId="2" ParentId="1722" CreationDate="2013-06-07T19:12:54.040" Score="0" Body="&lt;p&gt;Found a post on c-nsp that suggests that an MTU mismatch (either global or on the interface) could be responsible:&#xA;&lt;a href=&quot;http://www.gossamer-threads.com/lists/cisco/nsp/98769#98769&quot; rel=&quot;nofollow&quot;&gt;http://www.gossamer-threads.com/lists/cisco/nsp/98769#98769&lt;/a&gt;&#xA;Another thing worth checking is that both PE routers have each other's loopback addresses in their routing tables (as /32).&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorDisplayName="user661" LastEditDate="2013-06-07T19:53:49.067" LastActivityDate="2013-06-07T19:53:49.067" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1732" PostTypeId="1" AcceptedAnswerId="1738" CreationDate="2013-06-07T19:37:36.453" Score="9" ViewCount="466" Body="&lt;p&gt;I have a Cisco 2901 at a remote branch office connected via ge0/1 to an Adtran that is managed by TW Telecom with 8 T1s bundled together for an MPLS circuit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have access to the Adtran gear, it belongs and is serviced by TW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At times we've had a T1 go down in the bundle and TW will open a proactive ticket for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, is there any way for me to (from the 2901):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;know that a T1 is having issues or is down in the bundle? (obviously if they all go down I'll know it, since I won't be passing traffic.)&lt;/li&gt;&#xA;&lt;li&gt;Determine actual bandwidth available from the 2901 or some other way to tell if the entire bundle is up or not.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Short of having someone in the remote site go to the smart jack and say &quot;yes they are all showing green&quot; I'd like some way to monitor in addition to relying on TW if possible.&lt;/p&gt;&#xA;" OwnerUserId="943" LastEditorUserId="943" LastEditDate="2013-06-10T13:04:18.273" LastActivityDate="2013-06-10T13:04:18.273" Title="Cisco 2901 - Determine if bundled T1s are up based on bandwidth?" Tags="|cisco|mpls|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1733" PostTypeId="2" ParentId="1732" CreationDate="2013-06-07T19:40:52.773" Score="8" Body="&lt;p&gt;You could ask TW to give you SNMP read-ony access to the box if possible&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-06-07T21:34:01.600" LastActivityDate="2013-06-07T21:34:01.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1734" PostTypeId="1" CreationDate="2013-06-07T19:48:50.550" Score="10" ViewCount="5846" Body="&lt;p&gt;In the past, I was using a NetGear GS724T between my router and my servers. Unfortunatly the switch suddenly died.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I've changed it for a GS748T and also bought one more and I am wondering how I could achieve a redundancy using these two switches.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How do I need to configure the router to communicate with the two switches : two ports in bridge mode?&lt;/li&gt;&#xA;&lt;li&gt;How to synchronize switches, do I need to configure STP and LAG ?&lt;/li&gt;&#xA;&lt;li&gt;What I need to do on the servers (HP DL380 G5 with two ethernet ports, Linux), can I plug one ethernet on each switch so the cable will be redundant too?&lt;/li&gt;&#xA;&lt;li&gt;If I plug the two ethernet ports from servers, will I be able to have same IP addresses on both interfaces? (context in my other &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1713/pfsense-multi-wan-bridge-nat-load-balancing-and-carp&quot;&gt;question&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I know this is not a one answer question, but I still don't know where to start, more looking for pointers and/or guides.&lt;/p&gt;&#xA;" OwnerUserId="1496" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-05-01T08:55:08.547" Title="Redundancy between router and servers" Tags="|switch|router|redundancy|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1735" PostTypeId="2" ParentId="1722" CreationDate="2013-06-07T20:55:33.150" Score="2" Body="&lt;p&gt;Revising answer/consolidating comments and taking another stab (disclaimer: my MPLS/VPLS experience is not on the Cisco platform). Trying to infer how your topology looks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ME3600&amp;lt;---&amp;gt;MX80&amp;lt;---&amp;gt;MX80&amp;lt;---&amp;gt;ME3600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You said you were running OSPF between all of these. &lt;strong&gt;Have you double checked that you have a full mesh of LSP's between your devices?&lt;/strong&gt; (this is a requirement for vanilla VPLS). Have you configured &lt;code&gt;mpls traffic-eng area x&lt;/code&gt; and &lt;code&gt;mpls traffic-eng router-id Loopback0&lt;/code&gt; within &lt;code&gt;router ospf&lt;/code&gt; on the ME3600's?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming that &lt;code&gt;Tunnel0&lt;/code&gt; is actually representative of an LSP (I know the term &quot;Pseudowire&quot; has been thrown around in this question, but to me Pseudowire = L2VPN/EoMPLS/VLL). LSP's are only unidirectional, so it's possible that because of a lack of a full mesh of LSP's, the ME3600's can see the other's loopbacks in the routing table, the P routers may be interfering with the RSVP signaling/dropping things on the floor.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-07T23:27:52.723" LastActivityDate="2013-06-07T23:27:52.723" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1736" PostTypeId="1" AcceptedAnswerId="1737" CreationDate="2013-06-07T21:26:04.880" Score="12" ViewCount="4222" Body="&lt;p&gt;I'm bringing up a new pair of Nexus 5500s running NX-OS 5.2 and I'd like to make use of the new vPC Peer Switch feature:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The Virtual Port Channel (vPC) peer switch feature addresses performance concerns around STP convergence. This feature allows a pair of Cisco Nexus 5000 Series devices to appear as a single STP root in the Layer 2 topology. This feature eliminates the need to pin the STP root to the vPC primary switch and improves vPC convergence if the vPC primary switch fails.&lt;/p&gt;&#xA;&lt;p&gt;To avoid loops, the vPC peer link is excluded from the STP computation. In vPC peer switch mode, STP BPDUs are sent from both vPC peer devices to avoid issues related to STP BPDU timeout on the downstream switches, which can cause traffic disruption.&lt;/p&gt;&#xA;&lt;p&gt;This feature can be used with the pure peer switch topology in which the devices all belong to the vPC.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The current topology is a pair Nexus 5500s with a peer-link between them and one connected to each side of a 6500 VSS. All connections are LACP port channels.&lt;/p&gt;&#xA;&lt;p&gt;The VSS should represent a single logical device, but the 5500s don't seem to agree. When I try to bring up both connections to the VSS the 5500s give me this error:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;%VPC-3-INTF_CONSISTENCY_FAILED: In domain 2, VPC 1 configuration (interface port-channel1) is not consistent (vpc port channel mis-config due to vpc links in the 2 switches connected to different partners)&lt;/p&gt;&#xA;&lt;p&gt;%VPC-3-VPC_BRINGUP_FAILED: vPC 1 (interface port-channel1) bringup failed (Type-1 inconsistency exists)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The 6500 VSS does not log any errors.&lt;/p&gt;&#xA;&lt;p&gt;Why is the vPC viewing each side of the VSS as a different partner? Am I mistaken in thinking this should be work?&lt;/p&gt;&#xA;" OwnerUserId="91" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-07-21T02:51:42.830" Title="NX-OS peer-switch issues with 6500 VSS" Tags="|vss|cisco-nx-os|vpc|cisco-nexus-5k|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1737" PostTypeId="2" ParentId="1736" CreationDate="2013-06-07T21:42:33.407" Score="17" Body="&lt;p&gt;Of course, there's nothing like asking something publicly for you to realize your own mistake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The links to the VSS are a vPC, yet on the VSS side I had configured them as separate Etherchannels for each Nexus switch. It was now two logically different connections, which created the errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moving the links all into the same Etherchannel on the VSS resolved the problem.&lt;/p&gt;&#xA;" OwnerUserId="91" LastEditorUserId="91" LastEditDate="2013-06-08T01:09:31.937" LastActivityDate="2013-06-08T01:09:31.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1738" PostTypeId="2" ParentId="1732" CreationDate="2013-06-07T22:30:34.367" Score="7" Body="&lt;p&gt;The short answer is &quot;no&quot;.  Without visibility into the status of the T1s, you have no way of knowing if one is down (in alarm) vs. just not passing traffic (unbundled).  TW will have to give you access to the system (telnet, snmp, etc.), or setup a means of notifying you of status changes (syslog, snmp trap, etc.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-07T22:30:34.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1739" PostTypeId="2" ParentId="1734" CreationDate="2013-06-07T23:53:45.800" Score="3" Body="&lt;p&gt;For the server side of things, if you run centos or similar, you would simply create a &lt;a href=&quot;http://www.how2centos.com/centos-6-channel-bonding/&quot; rel=&quot;nofollow&quot;&gt;bond between the nics&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On windows, I believe you can do the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then on the switch side, all of the cables going from the server to the switch would be part of the same vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing you can do if your switches support it, is configure VRRP so that your server uses a redundant gateway address.&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="775" LastEditDate="2013-06-08T03:00:09.957" LastActivityDate="2013-06-08T03:00:09.957" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1740" PostTypeId="2" ParentId="1721" CreationDate="2013-06-08T07:56:18.740" Score="7" Body="&lt;p&gt;The reference guide does state that configuring class of service on the main router will work for logical systems:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Port mirroring, source class usage, destination class usage, unicast reverse-path forwarding, &#xA;class of service, firewall filters, class-based forwarding, and policy-based accounting work &#xA;with logical systems when you configure these features on the main router.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So yes this will work as you expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is similar to ipsec where you can only ipsec on the main router, but that still works within a logical system as I noted here: &lt;a href=&quot;http://mellowd.co.uk/ccie/?p=3333&quot;&gt;http://mellowd.co.uk/ccie/?p=3333&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-06-08T07:56:18.740" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1741" PostTypeId="2" ParentId="1734" CreationDate="2013-06-08T09:06:26.573" Score="8" Body="&lt;p&gt;I agree with @network_ninja but will extend it a bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How I'd solve this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1--L3--Router2&#xA;|              |&#xA;|              |&#xA;Switch1--L2--Switch2&#xA;|    |         |&#xA;|    |         |&#xA;PC1 PC2--------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router1 and Router2 are running &lt;a href=&quot;http://www.ietf.org/rfc/rfc3768.txt&quot;&gt;VRRP&lt;/a&gt;, &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/tk321/tsd_technology_support_sub-protocol_home.html&quot;&gt;HSRP&lt;/a&gt;, &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6550/prod_presentation0900aecd801790a3_ps6600_Products_Presentation.html&quot;&gt;GLBP&lt;/a&gt; or &lt;a href=&quot;http://www.openbsd.org/cgi-bin/man.cgi?query=carp&amp;amp;sektion=4&quot;&gt;CARP&lt;/a&gt; to produce virtual default-GW IP address to the LAN.&lt;br&gt;&#xA;This protocol will converse over the Switch core to agree which of the routers is owning the default-GW IP address at any given time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC2 is redundant linux server, which is using '&lt;a href=&quot;https://www.kernel.org/doc/Documentation/networking/bonding.txt&quot;&gt;bonding&lt;/a&gt;' to redundantly connect to the Switches, it should be configured so that if the the virtual default-gw IP address stops responding to ARP WHO HAS, it'll switch to backup connection. IP address itself is not on the physical interfaces, but on the virtual bonding interface.&lt;br&gt;&#xA;Equivalent solution is available to other OS, but often not included in base OS package.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC1 is non-redundant server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches are not running anything special, no spanning tree (as there is no L2 loop) and no LACP. They can be from different vendors and can be taken down for maintenance separately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers are not running any switching, IP addresses are configured directly in the L3 interfaces facing the switches.&lt;br&gt;&#xA;If you choose VRRP as your first-hop-redundancy-protocols, routers can be from different vendor. Each router can be taken down for maintenance separately, by gracefully switching VRRP priority before work on the primary.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-08T09:06:26.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1742" PostTypeId="2" ParentId="1732" CreationDate="2013-06-08T09:17:28.987" Score="4" Body="&lt;p&gt;Fully agreed with @ricky no way today, there isn't any signalling protocol which allows transferring information of L2 protocolX signalling to L2 protocolY, maybe there should be. But even if such protocol would be specified, I don't really expect T1 people would invests on new gear to get it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I don't understand why connections are build like this. Some business people claim that customer damand RJ45 ethernet interface, so for some customer even when fibre gige connection is delivered, there is optical converter (Another SPOF which customer cannot monitor!).&lt;br&gt;&#xA;I would throw the adtran out of the window and buy T1 interface to the 2901. This has several benefits&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;One less SPOF&lt;/li&gt;&#xA;&lt;li&gt;Link-state is reliably exchanged, so you can converge &lt;/li&gt;&#xA;&lt;li&gt;You get all signalling data for much more rapid troubleshooting&lt;/li&gt;&#xA;&lt;li&gt;Your QoS actually works, as shaper knows true rate and overhead&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-08T09:17:28.987" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1744" PostTypeId="2" ParentId="1734" CreationDate="2013-06-08T18:28:00.333" Score="5" Body="&lt;p&gt;I'll toss out for consideration what most will consider a bit more unorthodox solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider solving this with Layer 3 instead of Layer 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put both switches into place, and &lt;em&gt;DON'T&lt;/em&gt; interconnect them.  Connect the router(s) to both switches.  Connect your HP servers to both switches.  Use two different IP blocks internally for the servers to talk to the router(s)...one block on each switch (and therefore interface on the router(s) and servers).  Put the IP addresses that you actually use to communicate with the servers on a loopback interface.  Put quagga on the servers and run OSPF (at your scale, just throw everything in area 0, no biggie)...make sure the loopback addresses/interfaces are included in the OSPF config.  Put OSPF on the router(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Voila', the router(s) learn about the addresses that you're actually using to talk to the servers via OSPF as host routes...if a switch dies, the relevant adjancies go away and traffic gets rerouted over to the other switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a bonus, if you use different IP address for the various services that you run on your Linux servers, you can move the services and their associated IP addresses around seamlessly and the network adapts cleanly and easily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No danger in this setup of having bad behavior from a split-brain situation if the link between the two switches fail...no danger of bad behavior from a FHRP like VRRP, HSRP and the like...no danger of the switches falling back to inefficiently flooding traffic if you run into an asymmetric situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use this solution in a much larger sort of environment and its works &lt;em&gt;EXTREMELY&lt;/em&gt; well, is amazingly robust and resilient to both equipment failure and human configuration mistakes.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-06-08T18:28:00.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1745" PostTypeId="1" AcceptedAnswerId="1755" CreationDate="2013-06-09T03:14:21.270" Score="10" ViewCount="4278" Body="&lt;p&gt;I have two BGP routers for DIA with an issue with one provider in that the two links to this provider land on the &lt;em&gt;same&lt;/em&gt; SP router.  My ethernet handoffs via two separate MetroE links from another provider on behalf on my main provider as the one provider already had fiber to the bldg.  &lt;em&gt;If someone could also clear up the ISP terminology when one provider transports services for another, I'd appreciate it.&lt;/em&gt;  The two circuits terminate L3 with the same SP router, so my two routers each peer with the same provider router.  I'm assigned PA space from this SP.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no issues with outbound load-balancing (or load-sharing as I guess would be more technically accurate).  Outbound, I do ECLB at the firewall which picks one of the two edge routers based on a &lt;em&gt;srcip/dstip&lt;/em&gt; hash.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This particular carrier -- forget about the carrier just providing transport -- is not load-balancing inbound traffic from their one router across the two links to my two routers, and this is the direction where we could use the combined 5x50Mb BW that we have contracted.  &lt;strong&gt;The SP sees equal paths to us for the same advertised network and essentially just the first path they learn is what becomes the bestpath.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I've listed what I'm considering as my options below to get traffic over both circuits, and would like to know what the experts here think is best particularly if you're familiar with typical SP SOPs&lt;/strong&gt;.  &lt;em&gt;Since I have a contract, changing the contract at this time is not an option to have this rebuilt some other way.&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Allowing &lt;code&gt;maximum-paths 2&lt;/code&gt; in the SP network fixes this, but this applies to all their BGP customers on the same router that I don't think they will allow.  At least one option that will work involves static routes, but that’s not what I would prefer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Below are the options I have considered in my order of preference.&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Allow BGP &lt;code&gt;maximum-paths 2&lt;/code&gt;&lt;/strong&gt; on SP router (affects all BGP customers homed there) so /24 is used when advertised on both circuits&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Split my /24 in half and advertise separate /25s&lt;/strong&gt; over each link along with the /24.  The SP has recently stated that a non-documented community could be used for them to accept &gt; /24 prefixes. This requires manipulating NAT on my firewall to use global addresses in both /25’s as most traffic now is destined back to us on just a few addresses in the lower /25.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;SP static routes to /24&lt;/strong&gt; to force load-balancing w/BGP /24 (floating route).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;SP static routes to /25s&lt;/strong&gt; to force ECLB w/BGP /24 prefix (in RIB, but not used unless failure of /25s).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I think advertising the /25s in BGP is the best option&lt;/strong&gt; which I only found out recently is possible with the SP undocumented community, but are there other options I haven't considered or concerns about out-of-order packets with some of these choices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;This is sort of the reverse load-balancing problem most people ask with BGP.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-09T08:53:09.380" LastActivityDate="2015-02-07T12:26:14.957" Title="Inbound BGP load-balancing from same ISP router" Tags="|cisco|routing|bgp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1746" PostTypeId="1" CreationDate="2013-06-09T03:35:06.507" Score="8" ViewCount="525" Body="&lt;p&gt;We're currently using the Cisco 1921/K9 router along with SG300 L3 switch and other L2 switches in the office environment. We're hooked up to a 10M fiber line for internet but not sure if we need that much bandwidth yet. What's a good way to test out if our current usage actually needs that much bandwidth?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial thoughts were to see how many times during the day we hit peak bandwidth usage. Is it possible to track that via the current equipment? Is this even a good method for testing bandwidth needs?&lt;/p&gt;&#xA;" OwnerUserId="851" LastActivityDate="2013-06-09T03:52:32.483" Title="Determining optimal bandwidth needs for the office" Tags="|cisco|router|monitoring|bandwidth|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1747" PostTypeId="2" ParentId="1746" CreationDate="2013-06-09T03:51:27.117" Score="7" Body="&lt;p&gt;Generally speaking you can install MRTG or any network graphing and historical data software which can pull interface statistics via SNMP.&#xA;A nice and easy free software for this is &lt;a href=&quot;http://cactiez.cactiusers.org/&quot;&gt;CactiEZ&lt;/a&gt;. It can be easily run out of the box on an old server or mounted and installed easily on a VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since you're using a Cisco router, you can enable NetFlow on your interfaces and export that information to a Netflow collector/software such as &lt;a href=&quot;http://www.solarwinds.com/netflow-traffic-analyzer.aspx&quot;&gt;Solarwinds Traffic Analyzer&lt;/a&gt;. This allows you to use the router to classify the types of traffic traversing that interface and report that back to the collector. You can then get better statistical information on what kind of traffic is being utilized and where its coming and going to as well.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-09T03:51:27.117" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1748" PostTypeId="2" ParentId="1746" CreationDate="2013-06-09T03:52:32.483" Score="4" Body="&lt;p&gt;SNMP is very handy for this type of monitoring. For just one router, you can download the free version of &lt;a href=&quot;http://www.paessler.com/prtg&quot; rel=&quot;nofollow&quot;&gt;PRTG&lt;/a&gt; and set it up to monitor the interface's bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On your router you are going to need to enable SNMP access. To do so, enter &lt;code&gt;snmp-server community [name of your choice] RO&lt;/code&gt; in global-configuration mode. Setting up PRTG is quite simple as well, and there is plenty of documentation on their website regarding the specifics.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-06-09T03:52:32.483" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1749" PostTypeId="2" ParentId="1577" CreationDate="2013-06-09T04:05:13.697" Score="2" Body="&lt;p&gt;Just wanted to note about the 2x ASA 5520's that I have. The original sticks inside the 5520s were OEM RAM.&lt;br&gt;&#xA;One set had the model/part-no cis00-21077-508mg on it. (PC2700 ECC)&lt;br&gt;&#xA;The other was OEM Micron memory mt8vddt6464ay-40bf4 (PC3200 ECC CL3)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As these firewalls are more for testing and lab use now so we chose to take the risk with non ECC memory in order to save money. We found some old server RAM in the warehouse and upgraded each firewall with 4x 512Mb PC2700 non-ECC sticks. Both firewalls booted up fine and have been upgraded to the latest 8.4(6) ASA code. So far they have ran without problems.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-09T04:05:13.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1750" PostTypeId="2" ParentId="1745" CreationDate="2013-06-09T05:20:56.127" Score="6" Body="&lt;p&gt;Talking about terminology you've really already said &lt;em&gt;transport&lt;/em&gt; which I think is what that type of service is most commonly referred to as. Sometimes folks will also refer to it as a &quot;tether&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have another option of moving the interface on your side to the same router and then setting up eBGP multihop*** between you and your provider. Yes, you lose redundancy on your side, but on the opposite side it's going to the same router anyway, so that's kind of a moot point. This also eliminates the need for the provider to do eBGP multipath, in case they're not willing to do that with you (but I've found that in general most providers are fine with turning this on, if it's not turned on already).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that doesn't seem plausible then announcing two /25's is likely your best bet, unless of course your provider is willing to turn on &lt;code&gt;maximum-paths&lt;/code&gt; (again, assuming they haven't done so already).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;***Doing load balancing with eBGP multihop in your scenario will involve the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Move the second ISP connection to one router on your side.&lt;/li&gt;&#xA;&lt;li&gt;Both you and the provider configure &lt;code&gt;update-source Loopback0&lt;/code&gt; on each of your sessions - you don't have to use Lo0 if you don't want to, as long as you guys agree on which address to static-route to.&lt;/li&gt;&#xA;&lt;li&gt;Configure 2x /32 static  routes to each others' loopbacks via the connected interfaces (or next-hop IP's) - this is how the load balancing works, as it's really just ECMP.&lt;/li&gt;&#xA;&lt;li&gt;Configure &lt;code&gt;ebgp-multihop 2&lt;/code&gt; on each others' sessions (You want to keep this number as small as possible to avoid TCP session hijacking).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Voila, load balancing. This also scales per interface, as adding a new port will involve adding another interface and a static route.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-09T17:31:54.460" LastActivityDate="2013-06-09T17:31:54.460" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="1751" PostTypeId="1" CreationDate="2013-06-09T07:11:25.523" Score="7" ViewCount="1462" Body="&lt;p&gt;I have been struggling on getting reliable connectivity to China (AS4837 China Unicom Backbone, AS4134 China Telecom Backbone, AS4538 China Education and Research Network Center)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On most links I have used I see 300ms+ RTT with high jitter and 50% packet loss is not rare at all. Some links even has RTT over 1000ms during busy hours. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chinese ISPs tend to send non-premium traffic to oversubscribed links. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to work around it by having multiple servers in US and China, and hope each US server have acceptable connectivity to at least one server in China (e.g. AS6939 Hurricane Electric with AS4134 China Telecom Backbone). For a US customer that wants to access resources in China, they connect to my servers in US and my servers make the &quot;routing decision&quot; which server in China to connect to. I am running the transport in some sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this feasible? At this point I cant buy premium links in China due to monetary and licencing constraints (even CDNs find it hard to get reasonable priced bandwidth, not to mention the difficulty to obtain an telecom operator licence in China).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What kind of routing options do I have to make routing decisions in my transport network? How can it scale if I mesh site-to-site VPNs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any encryption I can use? AFAIK OpenVPN does not work on AS4837 China Unicom Backbone because TLS handshakes are getting dropped by China's GFW. Double encapsulation with things like stunnel works for now but it really hurts performance (traffic encapsulated with tcp within tcp).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP peer with upstreams with good connectivity to China and some BGP traffic engineering sounds like the right approach but that's far over my budget for now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goals is to optimize residential users' experience accessing content far away. Am I looking in the right direction to solve the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9784A.png&quot; alt=&quot;This is the challenge...RTT between US and China residential connections&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not the content, I just want to provide transport. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit1:AS4538 China Education and Research Network Center is IPv6 enabled and IPv6 performance there is usually bettbetter than IPv4. &#xA;Connectivity between those 3 Chinese ISPs can be very poor sometimes(300ms+ RTT with high packet loss to another ISP in the same city, slower than China ISP1-US-China ISP2). And my users can be on any of these 3 ISPs.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2013-06-09T07:21:13.617" LastActivityDate="2013-06-09T14:10:41.423" Title="Reliable connectivity to China" Tags="|routing|vpn|" AnswerCount="1" CommentCount="3" ClosedDate="2021-01-04T01:17:31.100" ContentLicense="CC BY-SA 3.0" />
  <row Id="1753" PostTypeId="2" ParentId="1751" CreationDate="2013-06-09T08:07:20.550" Score="6" Body="&lt;p&gt;Seems potentially wide topic. But I interpret it as two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How to use jitter/packet loss/delay as best path selectors&lt;/li&gt;&#xA;&lt;li&gt;Practical solutions to encrypt this traffic&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For first question, there are external commercial solutions which monitor links and optimize your BGP, benefit of them is that they are mostly vendor neutral, as long as you do BGP, they should work. I cannot recommend any, as I've not used such solution personally.&lt;br&gt;&#xA;I hope someone else will give rundown of what is available in the market and which is recommendable product.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there is Cisco's &lt;a href=&quot;http://www.cisco.com/en/US/products/ps8787/products_ios_protocol_option_home.html&quot;&gt;PfR&lt;/a&gt; (was colled OER before), which will use link which most closely satisfies your performance requirements. It is quite nice, while completely proprietary and not available throughout their routing portfolio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For encryption question, I'm not really sure what to tell, I think IPSEC links we have there to connect some remote factories to customer's L3 MPLS VPN just work, without GFW interfering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be useful to include in your post rough pps/bps limit what need to be supported, what equipment you are today using and how much CAPEX you have to spend on the new solution.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-09T08:07:20.550" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1755" PostTypeId="2" ParentId="1745" CreationDate="2013-06-09T08:33:35.800" Score="8" Body="&lt;p&gt;I would ask for 'maximum-paths' (it's usually called ECMP in standards and documents, not ECLB). And if ECMP is non-starter, then fallback to your /25 plan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other acronyms that I couldn't immediately figure out were DIA (dedicated internet access?) and SOP (standard operating procedure?). I'm not sure if these are really so universal acronyms that they should be used in stackexchange without at least hovertext to resolve them.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-09T08:33:35.800" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1756" PostTypeId="1" AcceptedAnswerId="1758" CreationDate="2013-06-09T09:46:49.410" Score="9" ViewCount="525" Body="&lt;p&gt;&lt;strong&gt;What are some possible ways to detect packet loss deep in a provider's network that is several hops away?&lt;/strong&gt;  With multiple providers peered over BGP on our Internet edge routers, &lt;strong&gt;I need to be able to automatically detect packet loss&lt;/strong&gt; (primarily) and latency (secondarily), and do an interface track or something similar and shut them down so all traffic uses our other providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen two problems with using IP SLAs.  First, what needs to be measured are at least several hops away (way past their BGP peer), so monitoring anything deep in the provider's network is not a static proposition such as monitoring our links with them (which have been stable); if that provider's links are shutdown, SLAs would still have reachability over another provider's path.  Second, doing an ICMP-type monitor doesn't detect the level of packet loss that is usually seen with much larger packets and latency doesn't seem to change significantly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6554/ps6599/ps8787/product_data_sheet0900aecd806c4ee4.html&quot; rel=&quot;nofollow&quot;&gt;Performance Routing (PfR)&lt;/a&gt; the best option here and influencing BGP's localpref?&lt;/strong&gt;  Seems that the Master Controller is a SPoF (Single Point of Failure), so if PfR is the way to go, how can the border routers not be dependent on a single Master Controller?  What are two or three other viable options?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The majority and most critical of our traffic is from our outbound HTTP responses.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-10T06:21:50.893" LastActivityDate="2013-06-10T06:21:50.893" Title="How to handle performance degradation deep in your provider's network?" Tags="|cisco|bgp|performance|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1757" PostTypeId="2" ParentId="1756" CreationDate="2013-06-09T09:52:31.053" Score="7" Body="&lt;p&gt;If using Cisco at the edge, then PfR would indeed be the best option here for the reasons you specified. You can set up master controller redundancy and Cisco shows how on this link: &#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/Transport_diversity/PfR_Master_Controller_Redundancy.html&quot;&gt;http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/Transport_diversity/PfR_Master_Controller_Redundancy.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-06-09T09:59:55.197" LastActivityDate="2013-06-09T09:59:55.197" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1758" PostTypeId="2" ParentId="1756" CreationDate="2013-06-09T10:25:21.860" Score="6" Body="&lt;p&gt;PfR is indeed one option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option which I don't personally have experience in, but I know people using them are BGP optimizers, which are vendor independent as they just look at BGP, measure network, and inject routes to change routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Couple options&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.noction.com/intelligent_routing_platform&quot;&gt;http://www.noction.com/intelligent_routing_platform&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.internap.com/business-internet-connectivity-services/route-optimization-flow-control/&quot;&gt;http://www.internap.com/business-internet-connectivity-services/route-optimization-flow-control/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-09T10:25:21.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1762" PostTypeId="2" ParentId="1745" CreationDate="2013-06-09T14:01:06.287" Score="3" Body="&lt;p&gt;The optimum solution here is BGP ECMP via &lt;code&gt;maximum-paths 2&lt;/code&gt; - however, I will say that &quot;accepting routes &gt; /24&quot; requiring a community tag sounds like epic stupidity - assuming you're a customer of theirs, they should accept whatever you give them up to a maximum number of prefixes and simply filter outbound according to whatever agreements they have with their other peers. one of the upstreams I have puts me in a similar boat with regard to not doing ECMP, I always expect to be allowed to announce any prefix size I desire to a transit provider and have them use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, given that they don't sound terribly competent, to balance traffic, &lt;strong&gt;do not&lt;/strong&gt; withdraw your /24 prefix - instead, leave it be &lt;em&gt;and&lt;/em&gt; ensure that your /25 routes are tagged with NO_EXPORT in addition to whatever it is that your provider allegedly requires so that your /25s won't accidentally leak out of their AS (not that it's likely to get very far if it does).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One last note - make sure that this &quot;undocumented community&quot; isn't in fact a blackhole community, because that'd be... y'know, &lt;strong&gt;&lt;em&gt;bad&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-09T14:01:06.287" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1763" PostTypeId="2" ParentId="1734" CreationDate="2013-06-09T17:28:15.523" Score="1" Body="&lt;p&gt;As others have stated, the redundant server connections will be specific to the platform. Some operating systems have integrated nic redundancy mechanism and some require additional software, but most should be able to achieve active/passive dual nic redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router has an integrated switch (such as a Cisco switch wic) and support for stp (rapid preferred) then you can do what I call a single-attached U. You would connect an L2 port on the router to each switch and make the router the stp root. Connect the switches together (L2) and you have eliminated all single points of failure below the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another solution would require L3 switches. You could connect an L3 port from the router to an L3 port on each switch. Then connect the switches together with an L2 port and an L3 port. Run FHRP between the switches and this will eliminate all single points of failure below the router without the need for a router-integrated switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given two routers, there are some additional possibilities which can eliminate the router as a single point of failure.&lt;/p&gt;&#xA;" OwnerUserId="161" LastEditorUserId="161" LastEditDate="2013-06-09T22:44:44.253" LastActivityDate="2013-06-09T22:44:44.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1764" PostTypeId="1" AcceptedAnswerId="1765" CreationDate="2013-06-09T18:01:53.857" Score="3" ViewCount="3621" Body="&lt;p&gt;My current setup is the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ATT ISP ---- ATT wireless router ---- cisco 890 wireless router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My cisco 890 is for internet and remote VPN access from home to my company, however, I don't have access/priv to modify or look at the running config of the router. I could however, connect to some of the ethernet port of the 890 for non-corporate traffic, which I'm allowed 1 or 2 ports for this access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I use the cisco router for corporate access mostly, but use the ATT wireless router for regular home use (for my wife actually).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm in the process of acquiring 4 cisco 3560 switches and setting up a server with GNS3 for CCIE R/S studying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to set up a secure remote connection from the internet to my home server with GNS3, but not sure where to set up or terminate the connection, that is on the ATT or Cisco router or even on the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've heard it can be done via port forwarding, but not recommended. Instead use SSH or VPN. I'm sure my IP from the ISP is via DHCP, so somehow I need to get it static or find other way to still work even if via dhcp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it better to use SSH and terminate at the server?&#xA;If so, how would I handle this via the att/cisco routers as intermediary devices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is it better to use VPN?&#xA;I guess I would need to terminate the VPN at the cisco router, but this assumes my company allows me to modify the config.&#xA;If so, how could I handle this from the ATT router as an intermediary device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;appreciate the help!&lt;/p&gt;&#xA;" OwnerUserId="1609" LastActivityDate="2013-06-09T19:11:33.097" Title="How do I set up secure remote access to my home lab network?" Tags="|cisco|vpn|lab|ssh|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1765" PostTypeId="2" ParentId="1764" CreationDate="2013-06-09T18:28:56.930" Score="4" Body="&lt;p&gt;I would pick up a cheap Cisco router/ASA/pix device and set it up with port forwarding/DMZ on the ATT router so all packets going to your public IP that aren't receiving traffic for connections like your wife, go to the router/ASA/pix. Then I would configure it as a remote VPN termination point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An ASA5505 will probably set you back $200. But you might be able to find an 1800/2800 series router to work with for less. If you get an ISR like those, make sure it has the security IOS or you have a way to get the security or better IOS on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you most likely have a dynamic public address, I would use something like no-ip.com or another dynamic DNS service to have a domain that points to your public IP and updates when it changes. This might be configurable on the ATT router or you may need to run software on a computer in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would allow secure access to your private network. Once on the VPN, you could connect to your lab equipment via SSH/HTTP/Console depending on how you setup the internal side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: If you're already doing port forwarding/DMZ to your company router, then you would need to ask them to allow you to have a VPN termination point on it for your private network.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-06-09T18:36:01.863" LastActivityDate="2013-06-09T18:36:01.863" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1766" PostTypeId="1" CreationDate="2013-06-09T18:33:53.530" Score="11" ViewCount="4031" Body="&lt;p&gt;In a network where the majority of the switches are running MST but a select few are still running PVST+, how can the PVST+ switch be configured to be the root of the spanning tree? Topology below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+--------+             +---------+&#xA;|        +-------------+         |&#xA;|  SW1   |             |  SW2    |&#xA;+---+----+             +--+--+---+&#xA;    |                     |  |&#xA;    |       MST           |  |&#xA;    |                     |  |&#xA;    |                     |  |&#xA;    |     +----------+    |  |&#xA;    +-----+          +----+  |&#xA;          |   SW3    |       |&#xA;          +--+-------+       |&#xA;             |               |&#xA;             |               |&#xA;             |      PVST     |&#xA;             |               |&#xA;             |      +--------+-+&#xA;             +------+          |&#xA;                    |   SW4    |&#xA;                    +----------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The PVST+ switch has the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree vlan 1-4094 priority 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However the MST switch logs a message that PVSTSIM is failing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%SPANTREE-2-PVSTSIM_FAIL: Blocking root port&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is it behaving like this and what needs to be done to make the PVST+ side root?&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-06-09T18:45:10.157" Title="How can I make a PVST+ switch root towards MST network?" Tags="|cisco|ieee-802.1s|spanning-tree|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1767" PostTypeId="2" ParentId="1766" CreationDate="2013-06-09T18:45:10.157" Score="10" Body="&lt;p&gt;The way it works when connecting MST and PVST domain is that the MST switch at the edge of the domain will simulate PVST+ by sending same BPDU for all VLANs configured on the trunk towards the PVST+ switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CIST replicates BPDU for every VLAN. Because there is not one instance per VLAN for MST the sys ID is set to 0 on these BPDUs. When connecting MST and PVST+ domain VLAN 1 is used to connect the domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the PVST+ side sends a BPDU with priority 0 for VLAN 1 it is actually 1 because of extended system ID. If VLAN 2 is also configured then PVST+ side sends BPDU with ID of 2 because of the extended system ID. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way PVST simulation works on MST switch is that the port can only have one role because there is not one instance running per VLAN. The CIST is now sending BPDU that it knows a root which has a priority of 1. This means that MST switch should be root forwarding but then it sees a BPDU with a priority of 2. Because the MST switch has better root information it should become designated forwarding on the port but the port can only have one role so the PVST simulation fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make this work the PVST+ side must have worse priority on VLAN 1 than all the other VLANs on the trunk. The following configuration will work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree vlan 1 priority 4096&#xA;spanning-tree vlan 2-4094 priority 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way the PVST simulation will work and the following log message should be seen:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%SPANTREE-2-PVSTSIM_OK: PVST Simulation inconsistency cleared&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More information can be found in the following &lt;a href=&quot;https://supportforums.cisco.com/thread/163062&quot;&gt;link.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-06-09T18:45:10.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1768" PostTypeId="2" ParentId="1764" CreationDate="2013-06-09T19:11:33.097" Score="5" Body="&lt;p&gt;You can use an application called &lt;code&gt;ser2net&lt;/code&gt; to make use of USB to serial cables. There is a &lt;a href=&quot;http://www.amazon.co.uk/NEWLink-Serial-Quad-Cable-Adaptor/dp/B003DA5TG4&quot; rel=&quot;noreferrer&quot;&gt;4x serial -&gt; one USB&lt;/a&gt; available which would cover 4x switches. That way you get virtual USB ports like ttyUSB0, ttyUSB1, ttyUSB2, ttyUSB3. You can then map these USB ports to TCP ports like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2001:telnet:600:/dev/ttyUSB0:9600 8DATABITS NONE 1STOPBIT banner&#xA;2002:telnet:600:/dev/ttyUSB1:9600 8DATABITS NONE 1STOPBIT banner&#xA;2003:telnet:600:/dev/ttyUSB2:9600 8DATABITS NONE 1STOPBIT banner&#xA;2004:telnet:600:/dev/ttyUSB3:9600 8DATABITS NONE 1STOPBIT banner&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you would telnet to ports 2001-2004 to connect to the switches. If you want to support this remotely then you could port forward on the ATT router for these ports or simply forward SSH only to your server and then connect to switches from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to be more secure there's always the possibility of doing some sort of VPN to the server as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also the option of getting a 2500 and using it as an access server.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-06-09T19:11:33.097" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1770" PostTypeId="1" AcceptedAnswerId="1774" CreationDate="2013-06-09T20:32:59.767" Score="14" ViewCount="17619" Body="&lt;p&gt;if someone were to set up an ssh tunnel to/from work or home, is there a way to prevent future SSH tunneling traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that websense can block traffic, but users who use ssh tunneling can bypass websense or other similar products because it can't decrypt or look further in the packet to tell the difference between legitimate or illegitimate traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;from some reading and research, I found that some things you can do are the following:&#xA;- turn off SSH altogether; not allowed at all&#xA;- restrict ssh access to only users who need them for access and deny everyone else ssh access&#xA;- create a custom protocol to blacklist or whitelist ssh traffic by destination (assuming the lists are mangeable)&#xA;- review logs for ssh traffic, review the destination IPs and check if they resolve to legitimate or allowable devices or not, or check whether there's more regular internet traffic than tunneling traffic and you can deny/blacklist that IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I was wondering, besides these options, would it be possible to circumvent the above options through a man-in-the-middle attack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is there another option to block ssh tunneling traffic or even some network device that can filter/block this traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks for the help.&lt;/p&gt;&#xA;" OwnerUserId="1609" LastActivityDate="2017-10-16T20:39:48.437" Title="how to block ssh tunneling traffic?" Tags="|ssh|tunnel|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1772" PostTypeId="2" ParentId="1770" CreationDate="2013-06-09T20:47:32.110" Score="6" Body="&lt;p&gt;If you control the SSH server and the firewall then you can control access by blocking access to whatever port the SSH server is using (22 by default). Unless the port has previously been opened, then inbound connections are likely to be blocked anyway, although you'll probably found that outbound connections will be allowed. With the right design and planning, you can control access in as fine or rough grained a way as you like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't control the SSH server then you can't guarantee the port it's using so it will be far harder to filter based on port alone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to allow everyone access to an SSH server while they are in your network, but only a select few when outside of it, port knocking is a neat read.&lt;/p&gt;&#xA;" OwnerUserId="106" LastActivityDate="2013-06-09T20:47:32.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1774" PostTypeId="2" ParentId="1770" CreationDate="2013-06-10T06:07:26.953" Score="13" Body="&lt;p&gt;Preventing outbound ssh connections, and thus any tunnels, would require a &lt;em&gt;complete&lt;/em&gt; blockade of outbound connections via deep packet inspection.  Looking at ports will be 100% useless.  You have to look at the actual packet payload to know it's SSH. (this is what websense is doing.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only other option is setting up a &quot;proxy&quot; host.  Lock down the configuration so the ssh client &lt;em&gt;and&lt;/em&gt; server will not allow tunneling, then allow only that machine to make outbound ssh connections -- of course, this includes securing the system as well, otherwise people can run whatever ssh software they want.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2017-10-16T20:39:48.437" LastActivityDate="2017-10-16T20:39:48.437" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1775" PostTypeId="1" AcceptedAnswerId="1777" CreationDate="2013-06-10T07:45:01.997" Score="3" ViewCount="5879" Body="&lt;p&gt;I've an embedded system running on QNX 6.2.1.  (I'll call it QNX box.) The QNX box has two network adaptors. I've configured the driver, so they appear as en0 and en1. Here are their IP settings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;en0: IP address 10.0.0.2, subnetmask 255.255.240.0 &#xA;en1: IP address 10.1.0.3, subnetmask 255.255.240.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The en0 and en1 are connected to different PCs with IP address 10.0.0.1 and 10.1.0.4 respectively. I can ping en0 and en1 from the connected PCs. No problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to ping one PC from the other PC, so the traffic must pass through the QNX box. The QNX box must have a routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone suggest how I should do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route add 10.0.0.1 -interface 10.0.0.2&#xA;route add 10.1.0.4 -interface 10.1.0.4 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... doesn't seem to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've added&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sysctl -w net.inet.ip.forwarding=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the output is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;net.inet.ip.forwarding: 0 -&amp;gt; 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output for &lt;code&gt;netstat -r&lt;/code&gt; is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Routing tables&#xA;&#xA;Internet:&#xA;Destination        Gateway            Flags     Refs     Use    Mtu  Interface&#xA;default            link#2             UCS         0        0   1500  en0&#xA;10/20              link#2             UC          1        0   1500  en0&#xA;10.0.0.1           00:17:3f:cf:03:95  UHL         7      130   1500  en0&#xA;10.1/20            link#3             UC          1        0   1500  en1&#xA;10.1.0.4           2c:27:d7:26:fd:91  UHL         0        4   1500  en1&#xA;127.0.0.1          127.0.0.1          UH          0        0  33212  lo0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1619" LastEditorUserId="1619" LastEditDate="2013-06-10T08:45:04.573" LastActivityDate="2013-06-10T08:45:04.573" Title="Routing table in QNX" Tags="|routing|" AnswerCount="1" CommentCount="5" ClosedDate="2018-06-03T01:23:51.863" ContentLicense="CC BY-SA 3.0" />
  <row Id="1777" PostTypeId="2" ParentId="1775" CreationDate="2013-06-10T08:25:35.817" Score="4" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.qnx.com/developers/docs/6.4.1/neutrino/utilities/s/sysctl.html&quot; rel=&quot;nofollow&quot;&gt;documents&lt;/a&gt; you need explicitly enable IP forwarding:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;net.inet.ip.forwarding&lt;br&gt;&#xA;  Disable (0) or enable (1) IP forwarding. If this is enabled, the host acts as a router.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That would be 'sysctl -w net.inet.ip.forwarding=1'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have QNX to test, but I don't think you need to add any routes, as the connected interfaces already have network, i.e. route already exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But confirm with 'netstat -r'&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-10T08:25:35.817" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1780" PostTypeId="1" CreationDate="2013-06-10T12:12:38.733" Score="4" ViewCount="1097" Body="&lt;p&gt;I am getting more than 60% of this traffic in my network. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source Ethernet Address (6 bytes)                 00:00:00:00:00:00 (XEROX CORPORATION)&#xA;Destination Ethernet Address (6 bytes)            00:00:00:00:00:00 (XEROX CORPORATION)&#xA;&#xA;Data (43 bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What can I do to determine where this traffic is coming from?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get rid of this traffic once the source is found?&lt;/p&gt;&#xA;" OwnerUserId="1623" LastEditorUserId="375" LastEditDate="2013-06-10T13:28:25.707" LastActivityDate="2013-06-11T01:19:44.280" Title="What can I do about network traffic with uknown source and destination?" Tags="|ipv4|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1781" PostTypeId="2" ParentId="1770" CreationDate="2013-06-10T12:53:54.990" Score="9" Body="&lt;p&gt;There is another method, if you're merely looking at stopping people from using SSH as a proxy workaround why not rate limit it to say 20kB/sec or so, that ends up painful enough for web, but imperceptible for console use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to allow file transfers at normal speed this wouldn't be an option though.&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2013-06-10T12:53:54.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1782" PostTypeId="1" AcceptedAnswerId="1803" CreationDate="2013-06-10T13:31:58.723" Score="10" ViewCount="3818" Body="&lt;p&gt;I am trying to implement Network Coding over a meshed network. Therefore I need to send packets to several destinations, this is way I am using Broadcast packets. But I can not understand why this is capped at ~990KBs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some configuration to do ?&lt;/p&gt;&#xA;" OwnerUserId="1621" LastEditorUserId="36720" LastEditDate="2020-12-12T09:33:46.453" LastActivityDate="2020-12-12T09:33:46.453" Title="Why is my UDP broadcast wireless communication capped at 1 MB/s?" Tags="|wireless|ieee-802.11|bandwidth|throughput|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="1783" PostTypeId="2" ParentId="1782" CreationDate="2013-06-10T13:44:23.113" Score="12" Body="&lt;p&gt;In 802.11 wireless (which I assume is your case), typically broadcast/multicast frames (as well as many management frames) are transmitted at the lowest base/basic/required (term varies by vendor) data rate.  This is separate from the supported data rates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, for best range and maximum compatibility, this defaults to the 1Mbps data rate, although in the past several years, some vendors have been increasing this default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some vendors also now include a multicast-to-unicast conversion keeping track of multicast clients with some form of multicast snooping, however I know of no similar means for broadcast (a wireless device can't know all the clients out there that it may need to reach).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are talking about an ad-hoc mesh network, then often you do not have control over this in the driver settings.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-06-10T13:44:23.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1784" PostTypeId="2" ParentId="1780" CreationDate="2013-06-10T13:59:29.333" Score="6" Body="&lt;p&gt;This could be a misconfigured VM or multiple misonfigured VMs.  That is where I saw the all zeroes originating before myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting rid of the traffic is easy.  In an enterprise class switch, you should be able to add a static &lt;em&gt;DROP&lt;/em&gt; entry to the MAC address table.  This would cause the switch to drop this traffic at L2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for identifying the source, I wouldn't worry about that as they VMs probably are not functioning properly in any case.  Blocking them should be sufficient, and the loss of all connectivity should point out the source (or create a support call) if it is legitimate.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-06-10T13:59:29.333" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1788" PostTypeId="1" CreationDate="2013-06-10T19:54:03.483" Score="5" ViewCount="134" Body="&lt;p&gt;Any idea what this error means?  I can't find much on googling.  Device is a Brocade SX.  Output is from:  &lt;code&gt;show ip ospf error&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**** Warning! ip-fwd-entry allocation fail 3629337 times&#xA;--- The following are for debug. They may not mean error or warning. ---&#xA;no ospf route: age, #: 29836, last id = 0.0.0.0&#xA;no ospf route: ASBR itself, #: 3222536, last id = 0.0.0.0&#xA;no ospf route: adv-rtr not ASBR, #: 80, last id = 0.0.0.0&#xA;LSA discard, &amp;lt; min-ls-arrival, #: 4, last id = 10.1.1.2, last src = 10.1.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="864" LastEditorUserId="267" LastEditDate="2013-06-10T22:45:48.777" LastActivityDate="2013-06-13T06:50:33.543" Title="ip-fwd-entry allocation fail OSPF" Tags="|router|ospf|brocade|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1789" PostTypeId="1" CreationDate="2013-06-10T19:55:01.837" Score="10" ViewCount="4422" Body="&lt;p&gt;I have a lab setup where I'm trying to use SCP via SNMP to a cisco router.I found some online documentation such as: &lt;a href=&quot;http://ccie20728.wordpress.com/2008/05/20/get-the-cisco-configuration-over-snmp/&quot;&gt;http://ccie20728.wordpress.com/2008/05/20/get-the-cisco-configuration-over-snmp/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my high level setup. On router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)# username cisco password cisco&#xA;R1(config)# ip domain-name somedomain.com&#xA;R1(config)# crypto key generate rsa general-keys modulus 1024&#xA;R1(config)# aaa new-model&#xA;R1(config)# aaa authentication login cisco local&#xA;R1(config)# aaa authorization exec cisco local&#xA;R1(config)# ip scp server enable&#xA;R1(config)# line vty 0&#xA;R1(config)# login authentication cisco&#xA;R1(config)# snmp-server community cisco RW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to get the router to act as the SCP server, need to enable with above cmd. On a ubuntu server, I have openSSH installed/running and doing this cmds:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpset -c cisco -v 2c &amp;lt;router ip addr&amp;gt; 1.3.6.1.4.1.9.9.96.1.1.1.1.2.111 i 4&#xA;snmpset -c cisco -v 2c &amp;lt;router ip addr&amp;gt; 1.3.6.1.4.1.9.9.96.1.1.1.1.3.111 i 4&#xA;snmpset -c cisco -v 2c &amp;lt;router ip addr&amp;gt; 1.3.6.1.4.1.9.9.96.1.1.1.1.4.111 i 1&#xA;snmpset -c cisco -v 2c &amp;lt;router ip addr&amp;gt; 1.3.6.1.4.1.9.9.96.1.1.1.1.5.111 a &amp;lt;svr ip addr&amp;gt;&#xA;snmpset -c cisco -v 2c &amp;lt;router ip addr&amp;gt; 1.3.6.1.4.1.9.9.96.1.1.1.1.6.111 s cisco.txt&#xA;snmpset -c cisco -v 2c &amp;lt;router ip addr&amp;gt; 1.3.6.1.4.1.9.9.96.1.1.1.1.7.111 s cisco&#xA;snmpset -c cisco -v 2c &amp;lt;router ip addr&amp;gt; 1.3.6.1.4.1.9.9.96.1.1.1.1.8.111 s cisco&#xA;snmpset -c cisco -v 2c &amp;lt;router ip addr&amp;gt; 1.3.6.1.4.1.9.9.96.1.1.1.1.14.111 i 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then to check what the status is, I do a snmpget and/or snmpwalk via:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpwalk -c cisco -v 2c &amp;lt;router ip addr&amp;gt; 1.3.6.1.4.1.9.9.96.1.1.1.1.10.111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when I run this, I get the integer (2), which means it's running, then it goes to integer (4), which means it failed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I check the reason for failure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpwalk -c cisco -v 2c &amp;lt;router ip addr&amp;gt; 1.3.6.1.4.1.9.9.96.1.1.1.1.13.111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and I get the integer (2), which means &quot;badfilename&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I've tried different permutations of a filename for &quot;.6.111 string&quot; above, including different file extensions, with and without hypens, same file name as running config cmds, even specified absolute path file name but none seem to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried debugging the &lt;code&gt;sshd&lt;/code&gt; with various logging levels and getting no output from the saved/stored syslog file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone been able to get this to work?&lt;/p&gt;&#xA;" OwnerUserId="1609" LastEditorUserId="76" LastEditDate="2013-06-10T20:10:22.020" LastActivityDate="2016-01-05T16:01:24.140" Title="how to get scp via snmp to work with cisco routers?" Tags="|cisco|router|snmp|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1790" PostTypeId="1" AcceptedAnswerId="1792" CreationDate="2013-06-10T19:59:48.953" Score="9" ViewCount="1833" Body="&lt;p&gt;I am looking at an upgrade from Nexus 7000 Supervisor 1's to Supervisor 2E's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the differences that I am seeing is a lack of the CMP (Connectivity Managment Processor) and the CMP port.  Even on the config guide for CMP, &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/hw/nexus7000/cmp/configuration/guide/n7cmp_overview.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, it says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note: The CMP is available only on the Supervisor 1 modules, not on&#xA;  the Supervisor 2 nor Supervisor 2E modules.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Currently we're utilizing those ports for OOB management, but will lose that functionality in the Sup-2E's.  It isn't the end of the world, but I will need to document/work-around this in the implementation plan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming this was an intentional choice on Cisco's part, so does any one know why, or have any documentation with the reasoning behind this choice?&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="561" LastEditDate="2013-06-10T21:07:30.493" LastActivityDate="2014-01-24T01:49:11.360" Title="Cisco Nexus 7000 Sup-2 and 2E, why no CMP?" Tags="|cisco-nexus-7k|oob|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1791" PostTypeId="2" ParentId="1782" CreationDate="2013-06-10T20:04:18.407" Score="7" Body="&lt;p&gt;Multicast rate has to be the lowest common denominator so that all devices can receive it successfully. Multicast frames cannot be acknowledged[1], so if a peer fails to receive it, the sender will not know, and will not retransmit the frame. Having loss rates of more than 1% per receiver is common. Much higher loss rates can be expected if there is heavy unicast traffic going on on the same channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you increase the basic multicast rate, you will also increase the loss rate. But since you are to combine native packets and introduce redundancy to compensate for the sheer loss rate, your network should be able to survive that. Keep in mind that multicast 802.11 management frames (including beacons) are not designed to support high loss rates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Linux, most mac802.11 drivers should support setting the multicast rate. Not so recent kernels requires this to be done at join time for both IBSS and mesh. &lt;code&gt;iw&lt;/code&gt; has a &lt;code&gt;mcast-rate&lt;/code&gt; option for the &lt;code&gt;ibss join&lt;/code&gt; and &lt;code&gt;mesh join&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you happen to be running a fairly recent kernel and &lt;code&gt;iw&lt;/code&gt; that both support &lt;code&gt;NL80211_CMD_SET_MCAST_RATE&lt;/code&gt;, then you can change it at any time, and it is as simple as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iw dev wlanX set mcast_rate 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to set a 6Mbps multicast rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[1] Maybe they can, now. There was a proposed modification to the 802.11 standard to acknowledge multicast frames: All stations, after receiving a multicast frame successfully, would pick a random backoff and send an ack to the transmitter. Acks could collide of course, so the transmitter would retransmit it and allow larger backoffs until all receivers have acknowledged the frame successfully.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2013-06-10T20:04:18.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1792" PostTypeId="2" ParentId="1790" CreationDate="2013-06-10T20:04:46.937" Score="10" Body="&lt;p&gt;Friend of mine asked this question in Vegas in Cisco Live and Cisco cited lack of customer demand and thermal as main reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CMP is absolutely the right solution and we need it in every vendor switch and router, only proper OOB. Server guys have had this for over decade.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So please start adding this as scoring item in your RFQ, so vendors know there is demand.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Because of the thermal comment I emailed Freescale (most routers and switches use their SOC in control-plane) and asked if they are planning to support anything like Intel vPro, which helps implement OOB functionality...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;From our marketing team updates I heard something similar will be&#xA;  implemented in the next generation of our multicore processors, but&#xA;  this is under discussion yet, so I do not have any details. Ok, I will&#xA;  pass your suggestion to our core design team, hope they will take it&#xA;  into account.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no guarantee whatsoever that Cisco would implement OOB on Nexus 7k in future supervisors, but I thought it is interesting that Freescale is considering adding a feature like this to their silicon.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="775" LastEditDate="2013-06-11T09:32:13.200" LastActivityDate="2013-06-11T09:32:13.200" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1793" PostTypeId="2" ParentId="1789" CreationDate="2013-06-10T20:18:53.700" Score="4" Body="&lt;p&gt;According to Cisco SNMP Object Navigator, value 4 is not supported for 1.3.6.1.4.1.9.9.96.1.1.1.1.3. Instead, value 2 means the running-config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Object  ccCopySourceFileType&#xA;OID     1.3.6.1.4.1.9.9.96.1.1.1.1.3&#xA;Type    ConfigFileType&#xA;1:startupConfig&#xA;2:runningConfig&#xA;Permission  read-create&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Probably that's why you are getting the badFileName error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually seems there is contradiction between SNMP Object Navigator and the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;mibName=CISCO-CONFIG-COPY-MIB&quot; rel=&quot;nofollow&quot;&gt;MIB Definition&lt;/a&gt;, as type for &lt;code&gt;ccCopySourceFileType&lt;/code&gt; and &lt;code&gt;ccCopyDestFileType&lt;/code&gt; is &lt;code&gt;ConfigFileType&lt;/code&gt; and according to MIB definition:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ConfigFileType ::= TEXTUAL-CONVENTION&#xA;&#xA;SYNTAX          INTEGER  {&#xA;                        networkFile(1),&#xA;                        iosFile(2),&#xA;                        startupConfig(3),&#xA;                        runningConfig(4),&#xA;                        terminal(5),&#xA;                        fabricStartupConfig(6) }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this seems backed up by ytti's answer&lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-06-10T21:16:43.760" LastActivityDate="2013-06-10T21:16:43.760" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1794" PostTypeId="2" ParentId="1789" CreationDate="2013-06-10T20:50:55.390" Score="6" Body="&lt;p&gt;I just tried this on my CPE:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ytti@lintukoto ~]% cat moi2.sh &#xA;#!/bin/sh&#xA;&#xA;snmp=&quot;snmpset -v2c -cfoo bu.ip.fi&quot;&#xA;&#xA;$snmp 1.3.6.1.4.1.9.9.96.1.1.1.1.2.9 i 4 \&#xA;      1.3.6.1.4.1.9.9.96.1.1.1.1.3.9 i 4 \&#xA;      1.3.6.1.4.1.9.9.96.1.1.1.1.4.9 i 1 \&#xA;      1.3.6.1.4.1.9.9.96.1.1.1.1.5.9 a 91.198.120.2 \&#xA;      1.3.6.1.4.1.9.9.96.1.1.1.1.6.9 s filename \&#xA;      1.3.6.1.4.1.9.9.96.1.1.1.1.7.9 s username \&#xA;      1.3.6.1.4.1.9.9.96.1.1.1.1.8.9 s password \&#xA;      1.3.6.1.4.1.9.9.96.1.1.1.1.14.9 i 4&#xA;sleep 10&#xA;$snmp 1.3.6.1.4.1.9.9.96.1.1.1.1.14.9 i 6&#xA;[ytti@lintukoto ~]% &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which copies running config (4) to network (1), by swapping these you can change the direction (from network to running).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running above script my home directory will have 'filename' file, which contains my CPE running-config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ytti@lintukoto ~]% ls -la filename&#xA;ls: cannot access filename: No such file or directory&#xA;[2 ytti@lintukoto ~]% ./moi2.sh      &#xA;iso.3.6.1.4.1.9.9.96.1.1.1.1.2.9 = INTEGER: 4&#xA;iso.3.6.1.4.1.9.9.96.1.1.1.1.3.9 = INTEGER: 4&#xA;iso.3.6.1.4.1.9.9.96.1.1.1.1.4.9 = INTEGER: 1&#xA;iso.3.6.1.4.1.9.9.96.1.1.1.1.5.9 = IpAddress: 91.198.120.2&#xA;iso.3.6.1.4.1.9.9.96.1.1.1.1.6.9 = STRING: &quot;filename&quot;&#xA;iso.3.6.1.4.1.9.9.96.1.1.1.1.7.9 = STRING: &quot;username&quot;&#xA;iso.3.6.1.4.1.9.9.96.1.1.1.1.8.9 = STRING: &quot;password&quot;&#xA;iso.3.6.1.4.1.9.9.96.1.1.1.1.14.9 = INTEGER: 4&#xA;iso.3.6.1.4.1.9.9.96.1.1.1.1.14.9 = INTEGER: 6&#xA;[ytti@lintukoto ~]% ls -la filename&#xA;-rw-r--r-- 1 ytti ytti 16172 Jun 11 00:35 filename&#xA;[ytti@lintukoto ~]% &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On top of what @daniel mentions also your '14' or 'rowstatus' is wrong, you use 1 'active', while you should use 4 'createAndGo'.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-06-10T21:37:09.410" LastActivityDate="2013-06-10T21:37:09.410" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1795" PostTypeId="1" AcceptedAnswerId="1796" CreationDate="2013-06-10T21:57:02.547" Score="10" ViewCount="4985" Body="&lt;p&gt;In addition to reading new material, I enjoy reading older networking books in attempt to see where we've come from and possibly where we're going. Currently, I'm reading a book called Cisco LAN switching, which was published in 1999 as part of the CCIE Professional Development series. The book talks quite a bit about using ATM in network backbones, and it occurred to me that I rarely see anything about ATM anymore in today's network engineering. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is ATM used anymore or has it mostly been replaced with other technologies at this point in time?&lt;/p&gt;&#xA;" OwnerUserId="572" LastEditorUserId="8499" LastEditDate="2017-07-09T03:04:40.963" LastActivityDate="2017-07-09T03:04:40.963" Title="Is ATM still used as a transport protocol?" Tags="|cisco|transport-protocol|layer4|atm|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1796" PostTypeId="2" ParentId="1795" CreationDate="2013-06-10T22:12:54.397" Score="10" Body="&lt;p&gt;It is still used a bit, but most providers are phasing it out.&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-06-10T22:12:54.397" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1797" PostTypeId="2" ParentId="1789" CreationDate="2013-06-10T22:30:25.660" Score="3" Body="&lt;p&gt;I've post this before: &lt;a href=&quot;http://checkforbees.com/router-backup/&quot; rel=&quot;nofollow&quot;&gt;http://checkforbees.com/router-backup/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think your issue is with the multiple snmpset's. You have to start by creating the entry to do this. [14.xxx = 5 (createAndWait)]  Then you can setup the entry as necessary before setting the rowStatus to &quot;1&quot; (active).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Note: My scripts are decades old, so they're tuned for tftp.]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root:pts/6{8}]debian1:/tmp/[01:32 AM]:./test.sh&#xA;CISCO-CONFIG-COPY-MIB::ccCopyProtocol.111 = INTEGER: scp(4)&#xA;CISCO-CONFIG-COPY-MIB::ccCopySourceFileType.111 = INTEGER: runningConfig(4)&#xA;CISCO-CONFIG-COPY-MIB::ccCopyDestFileType.111 = INTEGER: networkFile(1)&#xA;CISCO-CONFIG-COPY-MIB::ccCopyServerAddress.111 = IpAddress: 192.168.55.25&#xA;CISCO-CONFIG-COPY-MIB::ccCopyFileName.111 = STRING: cisco.txt&#xA;CISCO-CONFIG-COPY-MIB::ccCopyUserName.111 = STRING: cisco&#xA;CISCO-CONFIG-COPY-MIB::ccCopyUserPassword.111 = STRING: cisco&#xA;CISCO-CONFIG-COPY-MIB::ccCopyEntryRowStatus.111 = INTEGER: active(1)&#xA;..&#xA;Status: successful []&#xA;CISCO-CONFIG-COPY-MIB::ccCopyEntryRowStatus.111 = INTEGER: destroy(6)&#xA;[root:pts/6{8}]debian1:/tmp/[01:32 AM]:ls -l cisco.txt&#xA;-rw-r--r-- 1 root root 15790 Jun 12 01:32 cisco.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm looping over ...10.111 (state) while it's &quot;running&quot;.  I suspect you've never deleted your &quot;111&quot; entry.  Those are otherwise your exact sequence of &lt;code&gt;snmpset&lt;/code&gt;s against a 2960S with the ssh server of a linux box. (as my prompt suggests, a debian box.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-06-12T05:46:25.997" LastActivityDate="2013-06-12T05:46:25.997" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1798" PostTypeId="1" CreationDate="2013-06-10T22:40:51.870" Score="0" ViewCount="530" Body="&lt;p&gt;2) How do you go about selecting the best IOS version to be on after you determine you need to update?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) If you want to upgrade to a particular version, how do you check whether it's OK to move up to the version you have in mind?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Finally - is there a systematic approach to this process, or is it different for each type of hardware / version of IOS you're coming from?  There are numerous Cisco doc's on this, all of them lead down different paths, and none of them have helped me answer these questions plainly. (Or get many any closer to feeling confident about upgrading)&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2013-06-18T15:47:15.677" LastActivityDate="2013-06-18T15:47:15.677" Title="How to select an IOS update (cisco)?" Tags="|cisco|" AnswerCount="1" CommentCount="5" ClosedDate="2013-06-11T04:20:22.077" ContentLicense="CC BY-SA 3.0" />
  <row Id="1799" PostTypeId="2" ParentId="1798" CreationDate="2013-06-10T22:50:26.443" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/ITDIT/CFN/&quot; rel=&quot;nofollow&quot;&gt;Cisco Feature Navigator&lt;/a&gt; is where you would research when you desire to upgrade your IOS. Generally you upgrade due to bugs or security threats. We read the release notes to see if there are unfixed bugs that will effect our environment and if the code is stable for our environment then we will use it.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-06-10T22:50:26.443" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1800" PostTypeId="2" ParentId="1780" CreationDate="2013-06-11T01:19:44.280" Score="2" Body="&lt;p&gt;If this traffic is indeed 60% of traffic, then I would start with looking at the interfaces for higher volume of input. I would then have a list of suspects. At that point I would mac acl a port at a time looking for when the traffic disappears. Then I know the source port of the traffic and then debug that 'thing'. &lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-06-11T01:19:44.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1802" PostTypeId="1" AcceptedAnswerId="1807" CreationDate="2013-06-11T05:25:50.133" Score="5" ViewCount="1416" Body="&lt;p&gt;I have two /28 subnets A &amp;amp; B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main vpn peer ip is in subnet A, it is also my outside interface address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have free IP's in subnets A and B and id like to use one of them to host lan to lan my vpn connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I configure one of my free IP's as the vpn peer? I cannot find any options using ASDM or the CLI and I've been googling for hours!&lt;/p&gt;&#xA;" OwnerUserId="1637" LastActivityDate="2013-06-11T19:05:14.827" Title="How do you configure a Lan to Lan VPN without using your outside interface IP address?" Tags="|cisco|vpn|cisco-asa|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1803" PostTypeId="2" ParentId="1782" CreationDate="2013-06-11T06:19:17.767" Score="1" Body="&lt;p&gt;It is actually possible to modify the bit rate by forcing the rate on the wireless card. On Linux, the command is :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;sudo iwconfig wlan0 rate 11M&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1621" LastEditorUserId="775" LastEditDate="2013-06-11T09:06:16.087" LastActivityDate="2013-06-11T09:06:16.087" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1804" PostTypeId="2" ParentId="1802" CreationDate="2013-06-11T12:10:47.397" Score="3" Body="&lt;p&gt;Either you configure your asa as the vpn peer itself ( and therefore use the ip address already assigned to the ASA) or you configure a static nat and therefore map 1 &quot;external&quot; ip to 1 &quot;internal&quot; Ip permanently. You are then able to terminate the vpn tunnel on the device &quot;behind&quot; the firewall ( given that you have adapted the access-lists accordingly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you probaly want a) but it all really depends on your setup , so i'll highly opt for  your configuration  and diagram  of your setup too :-) &lt;/p&gt;&#xA;" OwnerUserId="1641" LastActivityDate="2013-06-11T12:10:47.397" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1805" PostTypeId="2" ParentId="1396" CreationDate="2013-06-11T13:28:48.583" Score="1" Body="&lt;p&gt;All very good comments. I've also seen network standardization and IOS test results that can help drive ios upgrade. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would agree that vulnerabilities is high in the list, but it also depends on type of network and traffic type. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For ex, a financial institution would be more concerned with security and vulnerabilities than another type of network that could be concerned more with bugs once they get hit with one thus driving change. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides this, it's also best to disable services not needed in the network or on the devices. &lt;/p&gt;&#xA;" OwnerUserId="1609" LastActivityDate="2013-06-11T13:28:48.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1807" PostTypeId="2" ParentId="1802" CreationDate="2013-06-11T19:05:14.827" Score="4" Body="&lt;p&gt;As Inga alluded, you cannot setup the ASA do this.  It does not support &quot;ip aliases&quot;; it has one, and only one address.  There are no options to configure isakmp / ikev(1|2) on it's own address. (it's either enabled on an interface or not.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(And if you get the bright idea to put a free address on a second interface, it won't allow subnets to overlap.  However, you could assign &quot;B&quot; to it's own interface, but you'd still be terminating traffic to the ASA's interface address.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-11T19:05:14.827" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1808" PostTypeId="1" CreationDate="2013-06-11T19:32:13.007" Score="8" ViewCount="1385" Body="&lt;p&gt;We have recently setup 802.1x wireless at our London location.  A user is reporting that an ssh copy between the wireless subnet and our server subnet results in consistently-slowing and eventually stalled transfers.  The same transfer across two wired segments (utilizing the same gateway -- an ASA) is speedy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the config from the unit.  I have seen this problem before in Cisco environments but I've never been on the team in charge of fixing the issue before, so I have no idea what might be causing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone share some ideas on how to fix this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H2&gt;ROM Version&lt;/H2&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;LON-AP01# sh ver&#xA;Cisco IOS Software, C3600 Software (AP3G2-K9W7-M), Version 15.2(2)JB, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2012 by Cisco Systems, Inc.&#xA;Compiled Tue 11-Dec-12 00:15 by prod_rel_team&#xA;&#xA;ROM: Bootstrap program is C3600 boot loader&#xA;BOOTLDR: C3600 Boot Loader (AP3G2-BOOT-M) LoaderVersion 12.4(25e)JA1, RELEASE SOFTWARE (fc1)&#xA;&#xA;LON-AP01 uptime is 1 day, 22 hours, 53 minutes&#xA;System returned to ROM by power-on&#xA;System image file is &quot;flash:/ap3g2-k9w7-mx.152-2.JB/ap3g2-k9w7-xx.152-2.JB&quot;&#xA;Last reload reason:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;H2&gt;Device Model&lt;/H2&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;LON-AP01#sh inv&#xA;NAME: &quot;AP2600&quot;, DESCR: &quot;Cisco Aironet 2600 Series (IEEE 802.11n) Access Point&quot;&#xA;PID: AIR-SAP2602E-E-K9 , VID: V01, SN: REDACTED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;H2&gt; Running Config &lt;/H2&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;LON-AP01#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 4168 bytes&#xA;!&#xA;! Last configuration change at 00:01:07 UTC Mon Mar 1 1993&#xA;version 15.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname LON-AP01&#xA;!&#xA;!&#xA;logging rate-limit console 9&#xA;enable secret 5 redacted&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa group server radius rad_mac&#xA;!&#xA;aaa group server radius rad_acct&#xA;!&#xA;aaa group server radius rad_admin&#xA;!&#xA;aaa group server tacacs+ tac_admin&#xA;!&#xA;aaa group server radius rad_pmip&#xA;!&#xA;aaa group server radius rad_eap&#xA; server 10.99.2.11&#xA; server 10.99.2.12&#xA;!&#xA;aaa group server radius dummy&#xA; server 10.99.2.11&#xA; server 10.99.2.12&#xA;!&#xA;aaa authentication login eap_methods group rad_eap&#xA;aaa authentication login mac_methods local&#xA;aaa authentication dot1x default group radius&#xA;aaa authorization exec default local&#xA;aaa authorization network default group radius&#xA;aaa accounting network acct_methods start-stop group rad_acct&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;no ip routing&#xA;no ip cef&#xA;ip domain name ds.stackexchange.com&#xA;ip name-server 10.99.2.11&#xA;ip name-server 10.99.2.12&#xA;!&#xA;!&#xA;!&#xA;dot11 syslog&#xA;dot11 vlan-name LON-CLIENTS vlan 20&#xA;dot11 vlan-name LON-MGMT vlan 10&#xA;dot11 vlan-name LON-WIRELESS vlan 50&#xA;!&#xA;dot11 ssid InformationHighwayOnRamp&#xA;   vlan 50&#xA;   authentication open eap eap_methods&#xA;   authentication shared eap eap_methods&#xA;   authentication key-management wpa&#xA;   mbssid guest-mode&#xA;!&#xA;!&#xA;dot11 network-map&#xA;eap profile stack-eap&#xA; method fast&#xA;!&#xA;crypto pki token default removal timeout 0&#xA;!&#xA;!&#xA;dot1x system-auth-control&#xA;username admin privilege 15 secret 5 redacted&#xA;!&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption mode ciphers aes-ccm tkip&#xA; !&#xA; encryption vlan 50 mode ciphers aes-ccm tkip&#xA; !&#xA; ssid InformationHighwayOnRamp&#xA; !&#xA; antenna gain 0&#xA; stbc&#xA; mbssid&#xA; station-role root&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.50&#xA; encapsulation dot1Q 50&#xA; no ip route-cache&#xA; bridge-group 50&#xA; bridge-group 50 subscriber-loop-control&#xA; bridge-group 50 spanning-disabled&#xA; bridge-group 50 block-unknown-source&#xA; no bridge-group 50 source-learning&#xA; no bridge-group 50 unicast-flooding&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption vlan 50 mode ciphers aes-ccm tkip&#xA; !&#xA; encryption mode ciphers aes-ccm tkip&#xA; !&#xA; ssid InformationHighwayOnRamp&#xA; !&#xA; antenna gain 0&#xA; no dfs band block&#xA; stbc&#xA; mbssid&#xA; channel dfs&#xA; station-role root&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1.50&#xA; encapsulation dot1Q 50&#xA; no ip route-cache&#xA; bridge-group 50&#xA; bridge-group 50 subscriber-loop-control&#xA; bridge-group 50 spanning-disabled&#xA; bridge-group 50 block-unknown-source&#xA; no bridge-group 50 source-learning&#xA; no bridge-group 50 unicast-flooding&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; no ip route-cache&#xA; duplex auto&#xA; speed auto&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; no bridge-group 1 source-learning&#xA;!&#xA;interface GigabitEthernet0.50&#xA; encapsulation dot1Q 50&#xA; no ip route-cache&#xA; bridge-group 50&#xA; bridge-group 50 spanning-disabled&#xA; no bridge-group 50 source-learning&#xA;!&#xA;interface BVI1&#xA; ip address 10.99.0.6 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;ip default-gateway 10.99.0.1&#xA;ip forward-protocol nd&#xA;ip http server&#xA;no ip http secure-server&#xA;ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag&#xA;ip radius source-interface BVI1&#xA;!&#xA;radius-server attribute 32 include-in-access-req format %h&#xA;radius-server host 10.99.2.11 key 7 redacted&#xA;radius-server host 10.99.2.12 key 7 redacted&#xA;radius-server vsa send accounting&#xA;!&#xA;bridge 1 route ip&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; transport input ssh&#xA;!&#xA;end&#xA;&#xA;LON-AP01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="154" LastActivityDate="2013-06-12T13:03:55.020" Title="A user on 802.1x-protected wireless reports slow or stalled ssh connections" Tags="|wireless|cisco-ios-15|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1809" PostTypeId="1" AcceptedAnswerId="1814" CreationDate="2013-06-11T19:46:37.277" Score="6" ViewCount="503" Body="&lt;p&gt;I am about to connect three remote sites to the main office by means of an metro ethernet provided by a service provider. The sites are connected by means of l3 and running OSPF on the connecting routers (it is a layer 2 cloud but terminating at l3 seems wise in my case). I assume that the service provider runs VPLS but not sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering about a couple of things:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main site has a 300Mbit and the remote sites have 100Mbit (no over subscription). The routers have 1 Gbit interfaces connecting to a cpe at that same speed. Every remote site has several vlans so on the remote site routers there are subinterfaces.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is wise to shape traffic at 100Mbit on the wan interface of the remote sites, or no need for this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be implementing QoS later on. Where do I put the bandwidth command? On the sub interface, on the wan interface or on both? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Care to collaborate..? &lt;/p&gt;&#xA;" OwnerUserId="209" LastEditorUserId="80" LastEditDate="2013-06-11T20:36:48.777" LastActivityDate="2013-06-12T01:30:12.450" Title="Metro Ethernet settings on Customer devices" Tags="|ospf|qos|cisco-ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1810" PostTypeId="2" ParentId="1809" CreationDate="2013-06-11T19:54:09.950" Score="7" Body="&lt;p&gt;Question seems to be about QoS not VPLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are thinking correctly, always when your interfaces actual rate is less than physical rate, you need to configure shaper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without this sub-rate shaper, QoS configuration cannot work, as you cannot know when to start dropping packets, as the router will think you have 1GE available capacity and will not realize you're congested at 300Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you'd configure parent shaper of 300Mbps and under this shaper you'd configure your QoS policy. This config should be in physical interface.&lt;br&gt;&#xA;If you have multiple VLANs, you need another hierarchy level, that is you'll first give physical interface 300Mbps, then distribute this as burstable percentages to different vlans, then apply to each of these vlans their own QoS policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would start simple and work up. I.e. 300Mbps shaper in physical and QoS policy in the physical only, treating all VLANs as equal. If you'll specify platform, I can give example of HQoS config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IOS example could be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any EF&#xA; match  precedence 5&#xA; match  precedence 6 &#xA; match  precedence 7 &#xA;class-map match-any AF&#xA; match  precedence 1 &#xA; match  precedence 2 &#xA; match  precedence 3 &#xA; match  precedence 4&#xA; match packet length max 200&#xA;!&#xA;policy-map Parent&#xA; class class-default&#xA;    shape average 300000000&#xA;   service-policy Child&#xA;policy-map Child&#xA; class EF&#xA;    priority percent 20&#xA; class AF&#xA;    bandwidth percent 50&#xA; class class-default&#xA;    bandwidth percent 30&#xA;!&#xA;interface X&#xA;  service-policy output Parent&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is purely random example, you should decide how many classes you need (I recommend as few as possible, and only add classes when you absolutely you know you must, start with 2) and you should decide how to distribute the guaranteed share of them. 'bandwidth percent X' is burstable, 'priority percent X' usually is not (should be accompanied with policer).&lt;br&gt;&#xA;Good staring point would be two classes, both burstable (bandwidth percent X), some high priority traffic class and rest (class-default). Then you'd only need to decide what traffic to put in high priority class, and what their guaranteed share of the 300Mbps would be.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-06-11T20:07:48.850" LastActivityDate="2013-06-11T20:07:48.850" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1813" PostTypeId="1" AcceptedAnswerId="1819" CreationDate="2013-06-11T22:34:41.547" Score="7" ViewCount="746" Body="&lt;p&gt;I've recently been using the Cisco Feature Navigator to assess whether or not to upgrade IOS images (and compare them), but it doesn't support ASA software.  Is there an easy way to compare images for ASA's like with CFN?  If not, how do you do this without manually combing release notes?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2013-06-12T01:58:43.297" Title="Cisco Feature Navigator equivalent for ASA's?" Tags="|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1814" PostTypeId="2" ParentId="1809" CreationDate="2013-06-11T23:17:27.423" Score="2" Body="&lt;p&gt;The provider could be using one of a handful of technologies to provide multipoint-to-multipoint connectivity for you, VPLS being one of them. It's also not clear from your question if you're actually getting a &lt;em&gt;true&lt;/em&gt; multipoint-to-multipoint service, or if your provider is giving you just a bunch of point-to-point services, or a rooted multi-point service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MetroE providers (at least MEF-compliant ones) will typically advise you to shape into the UNI/EVC(s) for the best performance, but it's certainly not mandatory for you to do so because they'll likely be shaping on their ingress coming from you anyway. Depending on what services you've purchased from your provider, your typical bandwidth profile options are (it would be useful to get this information from your SLS/SLA):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Bandwidth Profile per UNI&lt;/li&gt;&#xA;&lt;li&gt;Bandwidth Profile per EVC&lt;/li&gt;&#xA;&lt;li&gt;Bandwidth Profile per CoS ID&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The last of the three being the most granular level of hierarchy. CoS ID can represent:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The EVC&lt;/li&gt;&#xA;&lt;li&gt;PCP bits&lt;/li&gt;&#xA;&lt;li&gt;DSCP bits&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can use any of these for a CoS ID, but using the PCP bits keeps you from having to look into the L3 header for DSCP values, and you can have 8 individual CoS ID's if you want (one for each PCP bit). No matter what though, (if you do choose to go with using the PCP bits) &lt;strong&gt;you have to use all of them, and there can't be any overlap&lt;/strong&gt;. It's also a possibility that your hardware doesn't have the ability to do QoS based on PCP bits, in which case doing it via the DSCP values in the IP header will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately in order for anyone to give you a useful answer of what kind of QoS policy to mock up, it would be beneficial to get the service-level specs from your metroE provider, because they should have told you what sort of bandwidth profile you'd be getting with your service... and if they haven't, then you should definitely ask. :-)&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-12T01:30:12.450" LastActivityDate="2013-06-12T01:30:12.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1815" PostTypeId="2" ParentId="1808" CreationDate="2013-06-11T23:34:54.263" Score="1" Body="&lt;p&gt;Firstly, performance on a wired connection will usually ALWAYS be better than a wireless connection. A wireless network is using a shared medium (air) to transfer data. Wireless communication has always been and is still half duplex. As much as MIMO allows multiple data channels to be formed, only one device can still occupy the given channel-space at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, back to your issue. You're using a 2602 which contains a 3x4 MIMO. Its configured in autonomous mode. I'm going to assume you have a few APs configured with the exact same SSID/password in order to extend the coverage area or device density.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should check a few things....&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Do a concurrent ping to or from the computer while you reproduce the issues.&lt;/li&gt;&#xA;&lt;li&gt;Find out what frequency you're connected on. (2.4 or 5 Ghz)&lt;/li&gt;&#xA;&lt;li&gt;Find out if the device is doing a layer-2 roam by issuing a &lt;code&gt;term mon&lt;/code&gt; (to watch it in realtime) or &lt;code&gt;show logg&lt;/code&gt; to check the history.&lt;/li&gt;&#xA;&lt;li&gt;Ensure you have the proper &lt;a href=&quot;https://en.wikipedia.org/wiki/Inter-Access_Point_Protocol&quot; rel=&quot;nofollow&quot;&gt;IAPP&lt;/a&gt; config on the APs by issuing &lt;code&gt;wlccp wds priority &amp;lt;value&amp;gt; interface BVI1&lt;/code&gt; You can see more information about &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_configuration_example09186a00801c951f.shtml&quot; rel=&quot;nofollow&quot;&gt;WLCCP here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It sounds to me that the 802.1x credentials are taking too long to process and re-authenticate to the roamed AP. This would stop the data flow and have packets destined to the wrong AP until the credentials are processed. Once the credentials are processed, the new ARP entry is sent out via AP and the switch then learns where to send the data for that MAC/IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're hoping to get better roaming results. I strongly recommend buying a controller. Perhaps you decided to forgo that cost since it can be expensive, especially if you only have 2 or 3 APs in the area. But a WLC 2504 is fairly cheap it offers similar features to the larger 5508s and etc. Some features include centralized management, RRM, Cisco Clean Air (whether you believe this really helps or not), and Layer 2 or Layer 3 roaming capabilities. The newer 7.4 code also includes &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.11r-2008&quot; rel=&quot;nofollow&quot;&gt;802.11r&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.11k-2008&quot; rel=&quot;nofollow&quot;&gt;802.11k&lt;/a&gt; extensions for faster and more controlled device-AP roaming. &lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-11T23:34:54.263" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1817" PostTypeId="2" ParentId="1808" CreationDate="2013-06-12T01:49:51.277" Score="3" Body="&lt;p&gt;Been awhile since I worked Cisco APs on the command line however if I am reading the configuration right, there are a couple of changes I would make that may help performance.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it stands, if any client does connect using TKIP, then the AP will automatically disable the MCS rates (i.e. 802.11n rates), leaving you with only legacy rates (up to 54Mbps).  This can have a serious performance impact as it affects all clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, in your configuration, I would set the wireless to specifically use WPA2.  While not necessary for performance once you disable TKIP (with TKIP enabled, some clients that choose to use WPA rather than WPA2 will also use TKIP by default) this does simplify troubleshooting as you don't have to figure out which key management method is in use by clients.  You can do this by changing to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dot11 ssid InformationHighwayOnRamp&#xA; authentication key-management wpa version 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second, you have TKIP enabled as an option in your configuration and again, if any one client connects to the wireless using TKIP, then the AP will disabled all 802.11n MCS data rates.  I would only allow AES-CCMP by changing these lines (appears multiple times in the config):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;encryption vlan 50 mode ciphers aes-ccm tkip&#xA;encryption mode ciphers aes-ccm tkip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;encryption vlan 50 mode ciphers aes-ccm&#xA;encryption mode ciphers aes-ccm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Keep in mind your question is still very broad and this is only a starting point.  If we get further information, I can edit my answer later.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-06-12T13:03:55.020" LastActivityDate="2013-06-12T13:03:55.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1819" PostTypeId="2" ParentId="1813" CreationDate="2013-06-12T01:58:43.297" Score="7" Body="&lt;p&gt;The feature set of the ASA changes so very rarely, it's not something Cisco has ever put any effort into creating.  The few changes that have occurred are between major revisions, eg.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;8.2 to 8.3 -&gt; major nat configuration change&lt;/li&gt;&#xA;&lt;li&gt;somewhere in the v7 era &quot;hair-pinning&quot; became possible&lt;/li&gt;&#xA;&lt;li&gt;SSLVPN (webvpn) [v7+]&lt;/li&gt;&#xA;&lt;li&gt;IPv6 support (the joke that it is)&lt;/li&gt;&#xA;&lt;li&gt;transparent mode&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(I'm sure there's more, but that all I can think of!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command reference generally tells in which versions it's valid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only reason I've updated any over the last ~5 years is security bug fixes.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-12T01:58:43.297" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1821" PostTypeId="1" AcceptedAnswerId="1822" CreationDate="2013-06-12T07:37:36.387" Score="7" ViewCount="3208" Body="&lt;p&gt;I am trying to implement a wireless multicast ad-hoc network, but I don't know how it works. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I have to send my packets to a specific 224.0.0.* address, but I don't which one choose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network is 192.168.1.0 and the packets are using the UDP protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To which address should I send the packets ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to configure something before ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which IP address my computers should have ? Do I need to change of network ?&lt;/p&gt;&#xA;" OwnerUserId="1621" LastEditorUserId="1621" LastEditDate="2013-06-12T11:17:13.250" LastActivityDate="2013-06-12T11:17:13.250" Title="Which address should I choose to send a multicast message on an wireles ad-hoc meshed network?" Tags="|wireless|multicast|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1822" PostTypeId="2" ParentId="1821" CreationDate="2013-06-12T07:49:45.513" Score="11" Body="&lt;p&gt;You don't configure multicast address anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some box sends traffic out with multicast destination, this will automatically get L2 multicast address on the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This L2 multicast address is normally broadcasted in L2, unless there are some specific features enabled, like IGMP snooping to stop the flooding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If IGMP snooping is enabled, then the L2 switch will learn which ports want to receive the multicast (they do IGMP join to the multicast group) and will not flood traffic to other than interested ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If L3 is involved, then you'll learn via PIM which ports are interested in receiving the multicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can recommend &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0201746123&quot;&gt;this&lt;/a&gt; book for multicast basics, it's not JNPR specific.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't know which addresses to use, if you have 2byte ASN, you should use &#xA;233.0.0.0/8 GLOP block (with your ASN in it) if you don't have 2byte ASN your best bet is 239.0.0.0/8 which can be thought has RFC1918 (e.g. 10.0.0.0/8) for multicast.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-12T07:49:45.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1823" PostTypeId="2" ParentId="1821" CreationDate="2013-06-12T09:07:21.327" Score="4" Body="&lt;p&gt;Stay out out 224.0.0.x  Those are all assigned for various specific purposes.  As @ytti said, 239/8 is set aside for unspecified user purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's really nothing to configure.  Multicast is a special case of broadcast traffic.  Your ad-hoc wireless network is unlikely to know the difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One word of caution... most wireless chipsets are horrible at multicast.  In an ad-hoc network, it's likely to be even worse as there's no AP to coordinate who can talk.  There's was another recent NE question about slow multicast in wireless networks -- bottom line, broadcast (and thus multicast) traffic uses a common (to all radios) base channel which usually defaults to 1Mbps (yes one.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-12T09:07:21.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1824" PostTypeId="1" CreationDate="2013-06-12T09:12:01.470" Score="10" ViewCount="2541" Body="&lt;p&gt;I would like to &lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/access_point/12.4.25d.JA/Configuration/guide/scg12.4.25d.JA-chap7-mbssid.html#wp1059210&quot; rel=&quot;nofollow&quot;&gt;use my RADIUS server to restrict access to configured SSID on a per user basis&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the documentation linked above i add the following attribute to a test user:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;ospite-5vh Cisco-AVPair += &quot;ssid=Interactive_Ospiti&quot;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, enabling &lt;strong&gt;debug radius authentication&lt;/strong&gt;, i see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Jun 12 08:30:08.266: RADIUS(00001A96): Send Access-Request to 212.183.164.38:1812 id 1645/128, len 177&#xA;Jun 12 08:30:08.266: RADIUS:  authenticator CC C9 63 16 B0 62 74 52 - A7 95 DF 1D 93 F3 08 37&#xA;Jun 12 08:30:08.267: RADIUS:  User-Name           [1]   12  &quot;ospite-5vh&quot;&#xA;Jun 12 08:30:08.267: RADIUS:  Framed-MTU          [12]  6   1400                      &#xA;Jun 12 08:30:08.267: RADIUS:  Called-Station-Id   [30]  16  &quot;8478.acf0.9002&quot;&#xA;Jun 12 08:30:08.267: RADIUS:  Calling-Station-Id  [31]  16  &quot;2064.3267.44ca&quot;&#xA;Jun 12 08:30:08.267: RADIUS:  Vendor, Cisco       [26]  29  &#xA;Jun 12 08:30:08.267: RADIUS:   Cisco AVpair       [1]   23 &quot;ssid=Interactive_Test&quot;&#xA;Jun 12 08:30:08.267: RADIUS:  Service-Type        [6]   6   Login                     [1]&#xA;Jun 12 08:30:08.267: RADIUS:  Message-Authenticato[80]  18  &#xA;Jun 12 08:30:08.267: RADIUS:   7D 95 ED 39 3D 12 82 9F 30 8D 1F F4 84 04 43 C9  [}??9=???0?????C?]&#xA;Jun 12 08:30:08.267: RADIUS:  EAP-Message         [79]  17  &#xA;Jun 12 08:30:08.267: RADIUS:   02 01 00 0F 01 6F 73 70 69 74 65 2D 35 76 68     [?????ospite-5vh]&#xA;Jun 12 08:30:08.267: RADIUS:  NAS-Port-Type       [61]  6   802.11 wireless           [19]&#xA;Jun 12 08:30:08.267: RADIUS:  NAS-Port            [5]   6   7037                      &#xA;Jun 12 08:30:08.268: RADIUS:  NAS-Port-Id         [87]  6   &quot;7037&quot;&#xA;Jun 12 08:30:08.268: RADIUS:  NAS-IP-Address      [4]   6   10.132.0.253              &#xA;Jun 12 08:30:08.268: RADIUS:  Nas-Identifier      [32]  13  &quot;UFFICIO-AP1&quot;&#xA;Jun 12 08:30:08.325: RADIUS: Received from id 1645/128 212.183.164.38:1812, Access-Challenge, len 95&#xA;Jun 12 08:30:08.325: RADIUS:  authenticator 8A C9 30 9B 1B 13 20 91 - 4C D6 FE B3 2A 1E F7 85&#xA;Jun 12 08:30:08.325: RADIUS:  Vendor, Cisco       [26]  31  &#xA;Jun 12 08:30:08.325: RADIUS:   Cisco AVpair       [1]   25  &quot;ssid=Interactive_Ospiti&quot;&#xA;Jun 12 08:30:08.325: RADIUS:  EAP-Message         [79]  8   &#xA;Jun 12 08:30:08.325: RADIUS:   01 02 00 06 19 20                                [????? ]&#xA;Jun 12 08:30:08.325: RADIUS:  Message-Authenticato[80]  18  &#xA;Jun 12 08:30:08.325: RADIUS:   31 7D 79 7B C3 67 7E 71 5A FA 53 D4 76 2E 9D A4  [1}y{?g~qZ?S?v.??]&#xA;Jun 12 08:30:08.326: RADIUS:  State               [24]  18  &#xA;Jun 12 08:30:08.326: RADIUS:   9E B6 71 EA 9E B4 68 7A 8E 86 18 54 AF BD AF 55  [??q???hz???T???U]&#xA;Jun 12 08:30:08.326: RADIUS(00001A96): Received from id 1645/128&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So i would expect the request to be refused since the &quot;association SSID&quot; does not match the RADIUS one, instead it is acknowledged and the user gets connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant configurations follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;aaa authentication login default group radius&#xA;aaa authentication login eap_methods group radius&#xA;aaa authorization network default if-authenticated &#xA;aaa accounting nested&#xA;aaa accounting update periodic 5&#xA;aaa accounting network eap_methods start-stop group radius&#xA;!&#xA;dot11 ssid Interactive&#xA;   vlan 1&#xA;   authentication open &#xA;   authentication key-management wpa&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 01120101551F035F7324DB1194F0ABEE1C0B03175B5C51&#xA;!&#xA;dot11 ssid Interactive_Ospiti&#xA;   vlan 4&#xA;   authentication open &#xA;   authentication key-management wpa&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 15475E1D0725242D262D265D12730301204&#xA;!&#xA;dot11 ssid Interactive_Test&#xA;   vlan 5&#xA;   authentication open eap eap_methods &#xA;   authentication network-eap eap_methods &#xA;   authentication key-management wpa version 2&#xA;   accounting eap_methods&#xA;   mbssid guest-mode&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; no ip route-cache&#xA; encryption vlan 4 mode ciphers aes-ccm tkip &#xA; encryption vlan 1 mode ciphers aes-ccm tkip &#xA; encryption vlan 5 mode ciphers aes-ccm tkip &#xA; ssid Interactive&#xA; ssid Interactive_Ospiti&#xA; ssid Interactive_Test&#xA; antenna gain 0&#xA; mbssid&#xA; no short-slot-time&#xA; speed  basic-1.0 basic-2.0 basic-5.5 basic-11.0&#xA; channel 2457&#xA; station-role root&#xA;!&#xA;interface Dot11Radio0.1&#xA; description LAN Interactive&#xA; encapsulation dot1Q 1 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA; bridge-group 1 spanning-disabled&#xA;!&#xA;interface Dot11Radio0.4&#xA; description LAN Ospiti&#xA; encapsulation dot1Q 4&#xA; no ip route-cache&#xA; bridge-group 4&#xA; bridge-group 4 subscriber-loop-control&#xA; bridge-group 4 block-unknown-source&#xA; no bridge-group 4 source-learning&#xA; no bridge-group 4 unicast-flooding&#xA; bridge-group 4 spanning-disabled&#xA;!&#xA;interface Dot11Radio0.5&#xA; description LAN Test&#xA; encapsulation dot1Q 5&#xA; no ip route-cache&#xA; bridge-group 5&#xA; bridge-group 5 subscriber-loop-control&#xA; bridge-group 5 block-unknown-source&#xA; no bridge-group 5 source-learning&#xA; no bridge-group 5 unicast-flooding&#xA; bridge-group 5 spanning-disabled&#xA;!&#xA;radius-server attribute 32 include-in-access-req format %h&#xA;radius-server attribute 4 10.132.0.253&#xA;radius-server host 10.132.0.99 auth-port 1812 acct-port 1813 non-standard key 7 131312061E3811242A142A7C79&#xA;radius-server vsa send accounting&#xA;radius-server vsa send authentication&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here's the output of # show versione&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Cisco IOS Software, C1040 Software (C1140-K9W7-M), Version 12.4(25d)JA1, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2011 by Cisco Systems, Inc.&#xA;Compiled Thu 11-Aug-11 02:58 by prod_rel_team&#xA;&#xA;ROM: Bootstrap program is C1040 boot loader&#xA;BOOTLDR: C1040 Boot Loader (C1140-BOOT-M) Version 12.4(23c)JA3, RELEASE SOFTWARE (fc1)&#xA;&#xA;UFFICIO-AP1 uptime is 8 weeks, 2 days, 8 hours, 27 minutes&#xA;System returned to ROM by power-on&#xA;System restarted at 22:39:10 UTC Tue Apr 16 2013&#xA;System image file is &quot;flash:/c1140-k9w7-mx.124-25d.JA1/c1140-k9w7-mx.124-25d.JA1&quot;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone help?&lt;/p&gt;&#xA;" OwnerUserId="530" LastEditorUserId="530" LastEditDate="2013-06-14T07:09:11.223" LastActivityDate="2013-06-14T07:09:11.223" Title="Using RADIUS to restrict SSID on Cisco Aironet" Tags="|cisco|wireless|aironet|radius|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="1825" PostTypeId="1" AcceptedAnswerId="1826" CreationDate="2013-06-12T09:15:46.130" Score="9" ViewCount="11669" Body="&lt;p&gt;I'm trying to find the most elegant way to implement a &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5635&quot; rel=&quot;nofollow noreferrer&quot;&gt;RTBH&lt;/a&gt; filter for routes received from a customer.&lt;/p&gt;&#xA;&lt;p&gt;The filter should:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Only accept the customers own prefixes from a prefix-list&lt;/li&gt;&#xA;&lt;li&gt;Only accept /32 prefixes&lt;/li&gt;&#xA;&lt;li&gt;Only prefixes with the blackhole community&lt;/li&gt;&#xA;&lt;li&gt;Set the next-hop to the RTBH next-hop (192.0.2.1)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;To begin I looked at the &amp;quot;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos11.4/topics/usage-guidelines/policy-configuring-match-conditions-in-routing-policy-terms.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Match Conditions in Routing Policy Terms&lt;/a&gt;&amp;quot; document from Juniper.&lt;/p&gt;&#xA;&lt;p&gt;First I thought about combining a &lt;code&gt;prefix-list-filter&lt;/code&gt; to only match routes from the customers prefix-list and a &lt;code&gt;route-filter&lt;/code&gt; to limit  the accepted prefixes to /32, like so:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;from {&#xA;    as-path customer;&#xA;    community blackhole;&#xA;    prefix-list-filter customer-prefixes orlonger;&#xA;    route-filter 0.0.0.0/0 prefix-length-range /32-/32;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But then I stumbled about this information in the document:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If you configure a policy that includes some combination of route filters, prefix lists, and source address filters, they are evaluated according to a logical OR operation or a longest-route match lookup.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As I understand this (and I find it a bit unclear), if I use &lt;code&gt;prefix-list-filter&lt;/code&gt;, &lt;code&gt;route-filter&lt;/code&gt; and/or &lt;code&gt;source-address-filter&lt;/code&gt; in the same term it would be evaluated with a longest-match OR between all of them, which makes this approach &lt;strong&gt;unusable&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;What I came up with is this the following filter. The &lt;code&gt;hostroutes-only&lt;/code&gt; term diverts all prefixes shorter than /32 to the next policy. After that the &lt;code&gt;prefixes&lt;/code&gt; term matches if the /32 is in the range of the customer, matches his as-path and has the blackhole community set:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;term hostroutes-only {&#xA;    from {&#xA;        route-filter 0.0.0.0/0 prefix-length-range /0-/31;&#xA;    }&#xA;    then next policy;&#xA;}&#xA;term prefixes {&#xA;    from {&#xA;        as-path customer;&#xA;        community blackhole;&#xA;        prefix-list-filter customer-prefixes orlonger;&#xA;    }&#xA;    then {&#xA;        next-hop 192.0.2.1;&#xA;        accept;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So, is this the most elegant way to handle this? Any other solutions?&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2020-11-25T02:12:01.707" Title="BGP remote-triggered blackhole (RTBH) filter for Juniper" Tags="|routing|bgp|juniper|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1826" PostTypeId="2" ParentId="1825" CreationDate="2013-06-12T09:25:43.647" Score="8" Body="&lt;p&gt;There is no reason to limit customer to blackhole only /32, allow them to blackhole anything from them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-statement AS42-IN {&#xA;    term blackhole {&#xA;        from {&#xA;            community BLACKHOLE;&#xA;            prefix-list-filter AS42 orlonger;&#xA;        }&#xA;        then {&#xA;            community add NO-EXPORT;&#xA;            next-hop 192.0.2.1;&#xA;            accept;&#xA;        }&#xA;    }&#xA;    term advertise {&#xA;        from {&#xA;            prefix-list AS42;&#xA;        }&#xA;        then {&#xA;            community add ADVERTISE;&#xA;            next-hop peer-address;&#xA;            accept;&#xA;        }&#xA;    }&#xA;    term reject {&#xA;        then reject;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remember to set 'accept-remote-nexthop' under BGP settings, so that the next-hop can be changed to something else than link address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also strongly support that providers start to support different blackhole communities than just 'full blackhole'. Especially if you operate in more than one country usually attack is from transit and often customer actually mostly wants to access domestic peerings, so it's useful to implement several levels of blackhhole:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Full&lt;/li&gt;&#xA;&lt;li&gt;Outside local country (local IXP, whole own AS + customers seen)&lt;/li&gt;&#xA;&lt;li&gt;Outside local area (if applicable, like for me it could be 'Nordics')&lt;/li&gt;&#xA;&lt;li&gt;Include/Exclude specific peering router in blackhole&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm happy to give example how to implement something like this with JNPR DCU/SCU, provided your peering routers are JNPR, but it's possible with just communities, just bit more awkward.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you absolutely want to limit your customer's options you can add this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-statement /32 {&#xA;    term /32 {&#xA;        from {&#xA;            route-filter 0.0.0.0/0 prefix-length-range /32-/32;&#xA;        }&#xA;        then accept;&#xA;    }&#xA;    term reject {&#xA;        then reject;&#xA;    }&#xA;}&#xA;&#xA;policy-statement AS42-IN {&#xA;    term blackhole {&#xA;        from {&#xA;            community BLACKHOLE;&#xA;            policy /32;&#xA;            prefix-list-filter AS42 orlonger;&#xA;        }&#xA;..&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way it should be logical AND. But I really don't see the value in creating complexity to reduce expressiveness of configuration.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-06-13T13:42:18.920" LastActivityDate="2013-06-13T13:42:18.920" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="1827" PostTypeId="1" AcceptedAnswerId="1829" CreationDate="2013-06-12T12:17:56.593" Score="8" ViewCount="1117" Body="&lt;p&gt;On computer 1 (192.168.1.3):&lt;br/&gt;&#xA;I made a route to be sure that my communication pass through my wireless card&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;sudo route add -net 239.0.0.0 netmask 255.255.255.0 dev wlan2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I launch iperf with the following command :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;iperf -c 239.0.0.1 -u -l 1316&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;On computer 2 (192.168.1.6):&lt;br/&gt;&#xA;I acknowledge the fact that I am receiveing the traffic on the wireless card with tcpdump.&lt;br /&gt;&#xA;I launch iperf with the following command:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;iperf -s -u -l 1316 -B 239.0.0.1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But nothing comes out from computer 2, do I have to bind it on another address ?&lt;/p&gt;&#xA;" OwnerUserId="1621" LastActivityDate="2016-07-15T18:22:13.240" Title="Which address should I use to receive a UDP wireless multicast with iperf?" Tags="|wireless|multicast|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="1829" PostTypeId="2" ParentId="1827" CreationDate="2013-06-12T13:23:24.510" Score="8" Body="&lt;p&gt;I had this problem using multicast with iperf myself - in my case it was due to the fact that iperf does not let you bind to a multicast source on a specific interface and instead just hardcodes itself to the first interface of the system, meaning that, if the response isn't being received on what is typically eth0, it's useless. From what you say, it sounds like you have this problem too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I wrote a patch that allows you to specify the interface to bind to - you can grab the source from my &lt;a href=&quot;https://github.com/Olipro/iperf&quot;&gt;&lt;strong&gt;github repo&lt;/strong&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To use it, enter either &lt;code&gt;-O eth123&lt;/code&gt; or &lt;code&gt;--interface eth123&lt;/code&gt; where &lt;code&gt;eth123&lt;/code&gt; is your actual interface name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did submit my patch to the project, but, given the inactivity, I suspect the author has either abandoned iperf or is just too busy.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-12T13:23:24.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1832" PostTypeId="1" AcceptedAnswerId="1835" CreationDate="2013-06-12T19:00:49.687" Score="9" ViewCount="6979" Body="&lt;p&gt;We have a LAN with 20 machines on it.  They are connected to a switch which also connects to our primary Westell DSL modem for internet access.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modem does the NATing and is the DHCP server, (so that our internal addresses are 192.168.1.*). We have a backup modem and phone line which is just like the primary except, of course, its IP address to the outside world is different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The plan is that if the primary line fails, we just move the cable that connects the modem and switch from the primary to the backup modem.  It's crude and not exactly real-time but sufficient for our needs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, when the switch-over is made, what happens to the DHCP assigned addresses?  The machines already have addresses, but the backup modem doesn't know about them.  So what happens?  Will confusion reign on the LAN?&lt;/p&gt;&#xA;" OwnerUserId="1652" LastEditorUserId="44" LastEditDate="2013-06-12T23:04:41.917" LastActivityDate="2015-10-13T04:03:52.427" Title="Changing the DHCP server" Tags="|dhcp|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1833" PostTypeId="2" ParentId="1832" CreationDate="2013-06-12T19:05:29.557" Score="3" Body="&lt;p&gt;Your setup would benefit greatly from a dual-wan router. I would recommend a Cisco RV042. The router acts as the DHCP server for the LAN, and will automatically failover between the two DSL connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DSL modems will need to either be placed into bridged mode, or they will need to provide a different subnet IP than the default. For example, you could program one modem to use 10.10.10.x and the other 10.10.20.x on their LAN ports.&lt;/p&gt;&#xA;" OwnerUserId="572" LastActivityDate="2013-06-12T19:05:29.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1834" PostTypeId="2" ParentId="1832" CreationDate="2013-06-12T21:19:25.413" Score="10" Body="&lt;p&gt;Assuming the replacement router uses the same internal IP and assigns from the same IP range, this won't be much of a problem. Clients will keep the IP assigned via DHCP and will request a renewal of the DHCP lease after some time. The new router will either honor the renewal or if the IP is assigned to another device refuse it, after which the client will do a discover for a new address.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-06-12T21:19:25.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1835" PostTypeId="2" ParentId="1832" CreationDate="2013-06-12T21:23:07.140" Score="8" Body="&lt;p&gt;&lt;strong&gt;Will confusion reign on the LAN?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, no.  The machines that have addresses will still have them, until their lease expires.  I'm not sure how smart the Westel DHCPd is, but most will verify an address is not in use before assigning it.  You can avoid any possible collisions by setting each router to use a different range of addresses: router 1 -- 192.168.1.100-149, router 2 -- 192.168.1.150-199.  When new machines come online or old leases expire, they'll get an address from the currently active router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Just remember to not set any host to 100-199.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-06-13T01:04:21.260" LastActivityDate="2013-06-13T01:04:21.260" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1837" PostTypeId="2" ParentId="1788" CreationDate="2013-06-13T06:29:02.117" Score="2" Body="&lt;p&gt;What are your default values?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show default values&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like you're hitting TCAM limits&lt;/p&gt;&#xA;" OwnerUserId="1658" LastEditorUserId="775" LastEditDate="2013-06-13T06:50:33.543" LastActivityDate="2013-06-13T06:50:33.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1842" PostTypeId="1" AcceptedAnswerId="1843" CreationDate="2013-06-13T09:58:55.620" Score="6" ViewCount="292" Body="&lt;p&gt;In QoS there is a variety of Queuing methods and one of them is &lt;a href=&quot;/tags/wfq&quot; title=&quot;Weighted Fair Queuing&quot;&gt;WFQ&lt;/a&gt;, which organizes the flows in different queues where each queue has a weight that determines which flow will go first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for calculating the weight the formula used is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Weight = 4096 / (IP-precedence+1). Where 4096 is the maximum number of queues, so why the maximum number is 4096? It is a pre-established number or it is based on some criteria?&lt;/p&gt;&#xA;" OwnerUserId="1535" LastEditorUserId="49" LastEditDate="2013-06-13T15:04:07.753" LastActivityDate="2013-06-13T15:04:07.753" Title="Why there is a maximum of 4096 queues in WFQ?" Tags="|cisco|routing|qos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1843" PostTypeId="2" ParentId="1842" CreationDate="2013-06-13T10:16:38.183" Score="8" Body="&lt;p&gt;This platform specific limit, so it's just arbitrary limit Cisco came up with at one point in time, probably driven by memory restrictions of device of that era.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;W=K/(precedence +1)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;K= 4096 with Cisco IOS 12.0(4)T and earlier releases, and 32384 with&#xA;  12.0(5)T and later releases.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From: &#xA;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk543/tk545/technologies_q_and_a_item09186a00800cdfab.shtml#class&quot;&gt;http://www.cisco.com/en/US/tech/tk543/tk545/technologies_q_and_a_item09186a00800cdfab.shtml#class&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-13T10:16:38.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1844" PostTypeId="1" CreationDate="2013-06-13T10:55:34.747" Score="6" ViewCount="2592" Body="&lt;p&gt;I'm trying to create a csr for a cisco prime server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I managed to create a csr and put it in the &quot;defaultRepo&quot;, which is local on the disk. After what I've read I need to create a certificate repo and upload the csr to that location. Now to the real question, where am I supposed to upload the csr?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to generate the csr with: &lt;code&gt;admin# ncs key genkey -newdn -csr csrfile.cert repository certificates&lt;/code&gt; &lt;br&gt;&lt;br&gt;I get the following error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Writing certificate signing request to /opt/CSCOlumos/migrate/restore/csrfile.cert&#xA;INFO: no staging url defined, using local space.        rval:2&#xA;ERROR: Upload of csrfile.cert failed.   rval:-200&#xA;ERROR: ncs key genkey command failed.   rval:-200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My thoughts is that i can't use that repo since it does not exist in the running config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follow-up question. After i have created mye certificate in a new repo, and signed it afterwards. How can i make the web-server use it (to remove URL-warnings) ?&lt;/p&gt;&#xA;" OwnerUserId="345" LastEditorUserId="8499" LastEditDate="2018-02-16T04:27:20.387" LastActivityDate="2018-02-16T04:27:20.387" Title="How do I create an SSL CSR via CLI for Cisco Prime?" Tags="|cisco|wireless|troubleshooting|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1845" PostTypeId="2" ParentId="1844" CreationDate="2013-06-13T11:23:08.800" Score="6" Body="&lt;p&gt;Make sure that you have created the repository using the following commands from the &lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/prime_infrastructure/1.2/command/reference/cli12_appendix_011.html#wp3225104169&quot; rel=&quot;nofollow&quot;&gt;Command Guide&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Remote sftp repository for example below, but you could use tftp, ftp, etc):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ncs/admin# configure terminal&#xA;ncs/admin(config)# repository myrepository&#xA;ncs/admin(config-Repository)# url sftp://example.test.com/repository/system1&#xA;ncs/admin(config-Repository)# user luke password plain example&#xA;ncs/admin(config-Repository)# exit&#xA;ncs/admin(config)# exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then it looks like you have the right syntax for generating the CSR according to &lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/ncs/1.1/configuration/guide/csr.html#wp1046465&quot; rel=&quot;nofollow&quot;&gt;this document&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ncs key genkey -newdn -csr csrfilename repository repositoryname&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It just seems that NCS is missing the required repository configuration, so that NCS knows where to put the CSR once it creates it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have generated the certificate, upload it to NCS using the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ncs key importcacert aliasname ca-cert-filename repository repositoryname&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then just issue &lt;code&gt;ncs stop&lt;/code&gt; and &lt;code&gt;ncs start&lt;/code&gt; from the CLI to begin using the certificates.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="282" LastEditDate="2013-06-14T11:11:40.317" LastActivityDate="2013-06-14T11:11:40.317" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1846" PostTypeId="2" ParentId="653" CreationDate="2013-06-13T11:49:17.203" Score="1" Body="&lt;p&gt;We had this problem at our firm. We used correlation from the output of &quot;show arp&quot; and &quot;show mac address-table&quot; commands to correlate the MAC Addresses of all the computers/devices in our premisses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First you will need to make a list of the IPs and MACs of the devices in your network, and correlate them with the corresponding interfaces using the above commands...&lt;/p&gt;&#xA;" OwnerUserId="1663" LastEditorUserId="775" LastEditDate="2013-06-17T20:11:54.813" LastActivityDate="2013-06-17T20:11:54.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1848" PostTypeId="1" AcceptedAnswerId="1849" CreationDate="2013-06-13T13:36:23.463" Score="6" ViewCount="14618" Body="&lt;p&gt;I have several hundred Cisco 7900 series IP phones, (7911, 7942, and 7962 models) that have been sitting on the shelf as replacement stock for several years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now as we deploy them, we are experiencing some odd firmware issues.   When they are booting up, the phones attempt to upgrade via TFTP to the current firmware specified in &lt;a href=&quot;/tags/cucm&quot; title=&quot;Cisco Unified Communications Manager&quot;&gt;CUCM&lt;/a&gt;, but they fail and display &quot;Auth Fail&quot; on their screen.  Then the phones reboot and come up on the previous factory firmware load on the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I running into a firmware bug of some kind?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CUCM 7.1.3&lt;/li&gt;&#xA;&lt;li&gt;SCCP Firmware on phones 8.3(2)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="44" LastEditorUserId="49" LastEditDate="2013-06-13T15:06:20.683" LastActivityDate="2015-09-17T11:51:23.437" Title="Cisco IP Phone 7900 Series - Auth Fail on boot" Tags="|cisco|cisco-voip|cisco-7900-ip-phones|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1849" PostTypeId="2" ParentId="1848" CreationDate="2013-06-13T13:36:23.463" Score="7" Body="&lt;p&gt;Most likely this is caused by a phone running on a firmware older than 8.5(2) being upgraded to something newer.  This is a known issue, documented in the release notes for SCCP firmware release &lt;a href=&quot;http://www.cisco.com/en/US/customer/docs/voice_ip_comm/cuipph/firmware/8_5_2/english/release/notes/7900_852SR1.html#wp57602&quot; rel=&quot;nofollow&quot;&gt;8.5.(2)SR1&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For all SCCP firmware upgrades from firmware release versions earlier&#xA;  than 8.3(3) to version 8.5(2)SR1 or greater, you must first upgrade&#xA;  your firmware to version 8.5(2). Once you have upgraded to version&#xA;  8.5(2), you can upgrade your IP Phone to version 8.5(2)SR1 or later.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, assuming you're using CUCM, you can approach this several ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend uploading the 8.5(2) firmware files to your TFTP server.  Once you have the 8.5(2) firmware on your TFTP server, you can do the following (Cisco has a more in depth &quot;How-To&quot; located on their &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-11587&quot; rel=&quot;nofollow&quot;&gt;Support Forums&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Open device in CUCM, find the field &quot;Phone Load Name&quot; under Device Information.&lt;/li&gt;&#xA;&lt;li&gt;Manually assign the phone to use 8.5(2) firmware by entering &quot;SCCPXX.8-5-2S&quot; where XX is the model of the phone. (11 for 7911, 42 for 7942, etc. but note that 7962 and 7965 models still use the &quot;42&quot; or &quot;45&quot; firmware respectively.)&lt;/li&gt;&#xA;&lt;li&gt;Apply configuration and allow phone to upgrade to 8.5(2).&lt;/li&gt;&#xA;&lt;li&gt;Remove manual Phone Load entry, apply configuration again and phone will upgrade to current release specified globally in CUCM.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This will allow you to resolve the issue on a phone-by-phone basis.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-11-14T12:35:42.987" LastActivityDate="2013-11-14T12:35:42.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1851" PostTypeId="1" AcceptedAnswerId="1854" CreationDate="2013-06-13T14:07:09.263" Score="7" ViewCount="385" Body="&lt;p&gt;I'm trying to learn more about how a network (both LAN and Internet) handles traffic, and one part of this is the question of parallelism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the documentation for Speedtest.net, in describing how exactly the test works, it mentions that &quot;up to 4 threads&quot; can be used, without describing what those threads actually consist of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, what determines the degree of parallelism that can occur across a network? I know once a signal reaches the destination server, it's all up to that server's resources and the receiving program. But how does parallelism work across the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, does the network interface card take the request and split it up for quicker transfer across cable? Or does it just package up everything into larger chunks and let a router/switch do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, I'm trying to understand this from a business &gt; business network sense, so I'm not worried about things like a local cable modem or local DSL adapter.&lt;/p&gt;&#xA;" OwnerUserId="1371" LastEditorUserId="1371" LastEditDate="2013-06-13T14:18:58.750" LastActivityDate="2013-06-13T14:47:48.683" Title="What determines the degree of parallelism that can occur over a network?" Tags="|bandwidth|terminology|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1852" PostTypeId="2" ParentId="1851" CreationDate="2013-06-13T14:30:30.853" Score="5" Body="&lt;p&gt;I'm assuming you're speaking mainly about 10/100/1000 Ethernet.  The key thing to understand is that as far as Ethernet is concerned, there can only be one frame sent at a time (one sent and one received if it is operating in Full Duplex).  There is no &quot;parallelism&quot; in the sense of more than one frame leaving the NIC at any given time.  This is where a discussion of buffers and queuing comes into play, which I won't get into here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The system using the network card is capable of sustaining many different flows of traffic, destined for many different locations (or all to the same location).  However they don't leave the NIC at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend reading the &lt;a href=&quot;http://en.wikipedia.org/wiki/Ethernet&quot; rel=&quot;nofollow&quot;&gt;Wikipedia article on Ethernet&lt;/a&gt; or checking out the O'Reilly book &lt;a href=&quot;http://shop.oreilly.com/product/9781565926608.do&quot; rel=&quot;nofollow&quot;&gt;Ethernet: The Definitive Guide&lt;/a&gt; for more information.  Both link you out to many relevant sources.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As ytti pointed out in the comments above, this can also vary greatly based upon the datalink/network technologies we're discussing.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-06-13T14:40:19.403" LastActivityDate="2013-06-13T14:40:19.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1854" PostTypeId="2" ParentId="1851" CreationDate="2013-06-13T14:47:48.683" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;what determines the degree of parallelism that can occur across a network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Let's baseline some stuff...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speedtest.net sets up 4 parallel TCP sockets in javascript between the web browser and their bandwidth server.  Speedtest.net transfers bulk-data over these sockets and then time the results to get throughput measurements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4 Parallel TCP streams helps overcome latency and packet-loss in the path between the speedtest... parallel TCP streams are much better at overcoming these challenges than a single TCP socket... See &lt;a href=&quot;https://superuser.com/a/305236/77053&quot;&gt;this superuser answer&lt;/a&gt; for an example of how you can do this from the linux command-line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't really matter if the streams are parallel between the same hosts or different hosts, Ethernet can handle thousands of simultaneous parallel streams... it doesn't even know the exact number of parallel sockets that exist beyond the bandwidth they consume.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2013-06-13T14:47:48.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1859" PostTypeId="1" AcceptedAnswerId="1888" CreationDate="2013-06-13T18:19:39.713" Score="9" ViewCount="2046" Body="&lt;p&gt;I have two routers, A (Cat6500 w/SUP720-3BXL, IOS 12.2(33)SXH4) and B (Nexus 7K w/SUP1, NX-OS 5.2(4)), separated by several hops across an MPLS core, each with VRF ABC. Router A has two directly connected routes and four static routes within this VRF.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterA# show ip bgp vpnv4 vrf ABC labels&#xA;   Network          Next Hop      In label/Out label&#xA;Route Distinguisher: 65000:123 (ABC)&#xA;   10.30.10.0/24    10.30.200.1     154/nolabel&#xA;   10.30.20.0/24    10.30.200.1     88/nolabel&#xA;   10.30.30.0/24    10.30.200.1     38/nolabel&#xA;   10.30.40.0/24    10.30.200.1     147/nolabel&#xA;   10.30.200.0/24   0.0.0.0         IPv4 VRF Aggr:95/nolabel(ABC)&#xA;   10.90.90.0/24    0.0.0.0         IPv4 VRF Aggr:95/nolabel(ABC)&#xA;   10.133.242.0/25  192.168.255.3   nolabel/17&#xA;   10.133.242.128/26&#xA;                    192.168.255.3   nolabel/18&#xA;   10.255.255.224/29&#xA;                    192.168.255.3   nolabel/492474&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Per-prefix labeling is used for this VRF on both routers. Notice that the two directly connected routes receive a shared aggregate label (95) whereas the four static routes each receive a unique label.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router B agrees on the VPN labels to use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterB# show bgp vpnv4 unicast labels vrf ABC&#xA;BGP routing table information for VRF default, address family VPNv4 Unicast&#xA;BGP table version is 17042469, local router ID is 192.168.255.3&#xA;Status: s-suppressed, x-deleted, S-stale, d-dampened, h-history, *-valid, &amp;gt;-best&#xA;Path type: i-internal, e-external, c-confed, l-local, a-aggregate, r-redist&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete, | - multipath&#xA;&#xA;   Network            Next Hop            In label/Out label&#xA;Route Distinguisher: 65000:123     (VRF ABC)&#xA;*&amp;gt;i10.30.10.0/24      172.26.64.1         nolabel/154&#xA;*&amp;gt;i10.30.20.0/24      172.26.64.1         nolabel/88&#xA;*&amp;gt;i10.30.30.0/24      172.26.64.1         nolabel/38&#xA;*&amp;gt;i10.30.40.0/24      172.26.64.1         nolabel/147&#xA;*&amp;gt;i10.30.200.0/24     172.26.64.1         nolabel/95&#xA;*&amp;gt;i10.90.90.0/24      172.26.64.1         nolabel/95&#xA;*&amp;gt;l10.255.255.224/29  0.0.0.0             492474/nolabel (ABC)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From router B, I can traceroute to both of the directly connected networks on router A with no problem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterB# traceroute 10.30.200.10 vrf ABC&#xA;traceroute to 10.30.200.10 (10.30.200.10), 30 hops max, 40 byte packets&#xA; 1  192.168.254.97 (192.168.254.97) (AS 65000)  19.226 ms  19.369 ms  19.079 ms&#xA;      [Label=63 E=0 TTL=1 S=0, Label=95 E=0 TTL=1 S=1]&#xA; 2  192.0.2.151 (192.0.2.151) (AS 65000)  23.309 ms  28.027 ms  18.977 ms&#xA;      [Label=39 E=0 TTL=1 S=0, Label=95 E=0 TTL=2 S=1]&#xA; 3  192.168.251.62 (192.168.251.62) (AS 65000)  21.576 ms  24.265 ms  21.503 ms&#xA;      [Label=59 E=0 TTL=1 S=0, Label=95 E=0 TTL=1 S=1]&#xA; 4  10.30.200.10 (10.30.200.10) (AS 65000)  19.155 ms *  19.414 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, traceroutes to all of the statically-learned routes timeout across the MPLS path and pick back up only at their last hops:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterB# traceroute 10.30.10.10 vrf ABC&#xA;traceroute to 10.30.10.10 (10.30.10.10), 30 hops max, 40 byte packets&#xA; 1  * * *&#xA; 2  * * *&#xA; 3  * * *&#xA; 4  10.30.200.10 (10.30.200.10) (AS 65000)  19.065 ms  19.281 ms  18.68 ms&#xA;      [Label=154 E=0 TTL=1 S=1]&#xA; 5  10.30.10.10 (10.30.10.10) (AS 65000)  19.420 ms  19.377 ms  19.73 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both traceroutes above should be following the exact same path, and there are no filtering mechanisms in place along it. The same thing happens in the reverse direction as well. What am I missing? What's the difference between BGP routes learned by direct connection versus static configuration with regard to MPLS/label forwarding?&lt;/p&gt;&#xA;" OwnerUserId="5" LastEditorUserId="5" LastEditDate="2013-06-13T18:46:58.870" LastActivityDate="2013-06-16T21:21:38.163" Title="Prefixes with aggregate labels not fully tracerouting across MPLS core" Tags="|mpls|troubleshooting|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="1862" PostTypeId="2" ParentId="1848" CreationDate="2013-06-13T18:50:51.517" Score="0" Body="&lt;p&gt;Look at the release notes for the version you're trying to load.  There will be a section about requirements to perform an upgrade.  Sometimes you'll need to load an intermediate version to get to the latest.  Others need a differently packaged bundle. (signed vs. unsigned, etc.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-13T18:50:51.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1864" PostTypeId="1" CreationDate="2013-06-13T20:31:36.437" Score="5" ViewCount="10712" Body="&lt;p&gt;Had my first experience with HP switches (2x ProCurve 2810G) and I realized that STP is not enabled by default. I discovered this only after having already configured an Etherchannel with 3x1Gig-Links which carries just one single VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my questions are: should I enable STP, knowing that this setup will not expand beyond the two existing switches? I know that in Cisco switches STP &quot;sees&quot; an Etherchannel as a single port: is this the same thing for HP switches?&lt;/p&gt;&#xA;" OwnerUserId="1657" LastEditorUserId="267" LastEditDate="2013-06-13T21:19:55.580" LastActivityDate="2013-06-14T00:56:04.507" Title="Spanning Tree between only 2 HP switches connected via Etherchannel?" Tags="|etherchannel|spanning-tree|hp|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1865" PostTypeId="2" ParentId="1864" CreationDate="2013-06-13T20:47:26.643" Score="2" Body="&lt;p&gt;I wouldn't see any point in enabling STP in this situation. STP prevents loops between switches with multiple links. In this case you're using a trunk (in the HP parlance) which will be treated as a single link so STP would not be needed.&lt;/p&gt;&#xA;" OwnerUserId="309" LastActivityDate="2013-06-13T20:47:26.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1866" PostTypeId="2" ParentId="1864" CreationDate="2013-06-13T20:51:28.067" Score="13" Body="&lt;p&gt;Yes, configure it, just because your port channel is good doesn't mean your entire topology necessarily is - just connect another cable between the two switches on an active VLAN and watch the badness happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend MST (Multiple Spanning Tree) providing the switch supports it - interoperable, backwards compatible and of course, has the obvious benefit of being able to partition vlans into separate domains.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-13T20:51:28.067" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1867" PostTypeId="1" AcceptedAnswerId="1887" CreationDate="2013-06-13T20:56:58.990" Score="4" ViewCount="1071" Body="&lt;p&gt;I have an application that requires multicast across our MPLS WAN, and had been using GRE tunnels to facilitate this until recently when I replaced some aging edge routers with HP L3 switches. To my dismay it appears that these switches (Procurve E3800-24G-2SFP+) do not offer GRE in any way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I didn't source them, Layer 8 got a 2-for-1 deal from a fast talking reseller!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any alternatives for tunneling multicast across MPLS? Our WAN provider isn't likely to add support for mBGP just for me. :)&lt;/p&gt;&#xA;" OwnerUserId="309" LastEditorUserId="309" LastEditDate="2013-06-14T14:57:19.000" LastActivityDate="2013-06-16T08:16:55.730" Title="Alternatives to GRE for multicast over MPLS?" Tags="|mpls|multicast|gre|hp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1868" PostTypeId="2" ParentId="1848" CreationDate="2013-06-13T21:03:20.533" Score="3" Body="&lt;p&gt;Ensure that you have provisioned the phone in CUCM for the correct model of phone. I've accidentally cloned a 7940 config when I actually had a 7942 phone and get the &quot;Auth Fail&quot; message because it's trying to pull the wrong firmware.&lt;/p&gt;&#xA;" OwnerUserId="309" LastActivityDate="2013-06-13T21:03:20.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1869" PostTypeId="2" ParentId="1864" CreationDate="2013-06-13T21:09:16.120" Score="4" Body="&lt;p&gt;Indeed, enable spanning-tree. The 2810 is standard MST by default. Depending on how you have your trunks configured (Trunk vs. LACP), the individual ports &lt;em&gt;could&lt;/em&gt; still create a loop.  Call it insurance... you may never need it, but the one time you do and it's not there, you'll regret it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Other networking mistakes could also create a loop.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-13T21:09:16.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1870" PostTypeId="1" AcceptedAnswerId="1874" CreationDate="2013-06-13T22:02:21.873" Score="6" ViewCount="1628" Body="&lt;p&gt;I am considering running route reflectors in our current network topology of 20 od MX80's however all current devices are active traffic forwarders. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;from a scaling perspective RR makes logical sense however , I have always been warned that RR should be configured on the High end P devices or be dedicated standalone RR's &lt;/p&gt;&#xA;&#xA;&lt;p&gt;can someone kindly provide some insight into how / what decision need to be make in deploying forwarding / non forwarding RR's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks &#xA;Ian&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="205" LastEditDate="2013-06-13T23:18:10.320" LastActivityDate="2013-06-13T23:18:10.320" Title="forwarding / non forwarding Route Reflector?" Tags="|router|bgp|juniper-mx|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1871" PostTypeId="1" AcceptedAnswerId="1875" CreationDate="2013-06-13T22:03:49.023" Score="5" ViewCount="4260" Body="&lt;p&gt;In a new customer's network I have found the following scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gBvyd.png&quot; alt=&quot;Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Fortigate 1 and 2 form and HA cluster in active-passive mode. The HA link is just a cable connecting them directly. &lt;/li&gt;&#xA;&lt;li&gt;Racks A and B are a several meters apart and  cables between them run through the ceiling. It is not possible to follow them and they are not identified: no pannels, no labels, ... &lt;/li&gt;&#xA;&lt;li&gt;Port 1 of each Fortigate is connected to a switch but customer doesn't know the switch ports. &lt;/li&gt;&#xA;&lt;li&gt;All switch ports are access ports in the default VLAN. Fortigate port 1 is default gateway for the subnet associated to this VLAN&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In order to locate the switch ports, I considered  connecting my PC in one switch, setting up an address of the subnet and ping the default gateway. Then check ARP looking for the  MAC address of the default gateway and finally search for this MAC address in the CAM of both switches. However, I realized this will make me  discover only the switch port connected to the active Fortigate unit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to track down the switch port connected to the passive Fortigate unit, without disconnecting the cable on firewall side, neither forcing a transition of the cluster active unit?&lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2016-07-02T11:46:51.700" Title="Fortigate HA: how to locate switch port connected to passive unit?" Tags="|switch|fortigate|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1873" PostTypeId="2" ParentId="1870" CreationDate="2013-06-13T22:20:31.850" Score="4" Body="&lt;p&gt;If RR isn't close by in the forwarding path then it might reflect sub-optimal route to your PE. In future this problem will be fixed by &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-raszuk-bgp-optimal-route-reflection-01&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP-ORR&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If you are running MPLS network, then you should also consider if your core should be BGP free or not. Benefit of BGP free core is that it won't crash next time there is parser bug for BGP UPDATE message. Problem with BGP free core is that either your PE boxes need to have full-table or you'll have sub-optimal default-route.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-06-13T22:20:31.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1874" PostTypeId="2" ParentId="1870" CreationDate="2013-06-13T22:59:09.623" Score="5" Body="&lt;p&gt;There are technical and operational considerations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The technical consideration is anticipating or determining how much load the RR platform will be subjected to. Are you going to be carrying 100&gt;1000&gt;??? of routes? Will there be lots of churn? Generally, RRs obtain a complete copy of the BGP RIB. So if you have a churn event, it propagates to all of your route reflectors. If they are also in the forwarding path, you can wind up with problems in your data path. Specific to the MX80, the RE isn't the best for RR services with lots of routes. I wouldn't combine them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Operationally, are you OK with fate sharing your RR and your data plane? Consider: maintenance, change policy. If you don't have a change policy, are you hiring? Kidding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can tell you that in the past I have combined my P node and RR. I did so on a larger platform but I also lsys'd the box so that the RR portion of the router could lift right out when I decided to go to discrete RRs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I had a greenfield to build now, I would either get stub 240s with dual x64 REs or run it on a server running something like Vyatta. In some topologies, I'm not even sure I would put the RR in the IGP. One less thing to go wrong.&lt;/p&gt;&#xA;" OwnerUserId="205" LastActivityDate="2013-06-13T22:59:09.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1875" PostTypeId="2" ParentId="1871" CreationDate="2013-06-13T23:38:14.873" Score="6" Body="&lt;p&gt;What you can do is SSH to the Active unit, then run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;execute ha manage &amp;lt;x&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where x is the ID of the other unit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then run&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config system interface&#xA;edit &quot;port1&quot;&#xA;set status down&#xA;next &#xA;edit &quot;port1&quot;&#xA;set status up&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can then log on to the switch (assuming it is logging interface UP/DOWNS) and see which interface went down.&lt;/p&gt;&#xA;" OwnerUserId="1682" LastActivityDate="2013-06-13T23:38:14.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1878" PostTypeId="2" ParentId="1864" CreationDate="2013-06-14T00:41:50.913" Score="0" Body="&lt;p&gt;Yes, LACP and static trunks are viewed as a single link by ProCurves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't forget to set the switch's priority so that you have a predetermined root of the tree.  That is the most common STP mistake we see in the ProCurve forums.&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-06-14T00:41:50.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1879" PostTypeId="2" ParentId="1864" CreationDate="2013-06-14T00:56:04.507" Score="3" Body="&lt;p&gt;Whether Cisco, HP or another provider, with any form of link aggregation,  multiple physical ports are treated as a single logical port, after all that is the whole point of link aggregation.  Just be careful of terminology used by OSes such as bonding or teaming since they may or may not be doing link aggregation depending on the configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to running STP, as Ricky and Olipro have said, by all means you should run it.  Which flavor depends on your need, however generally keep to a &quot;standards&quot; based protocol. With only two switches (and probably not that many VLANs), I would think you would be fine with RST.  On any larger networks, I would recommend MST, but that may be a bit of overkill in this situation and without understanding it properly you may end up creating problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While you may not be concerned about more than the two switches, who knows what the future will hold.  Also, it helps prevent a number of problems that can be created by users.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, I have run across several instances where users on a network bring in their own dumb switch to connect additional devices in their office/cubicle and decide that if one connection to the wall is good, then two must be better.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-06-14T00:56:04.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1880" PostTypeId="1" AcceptedAnswerId="1882" CreationDate="2013-06-14T01:37:11.200" Score="13" ViewCount="24200" Body="&lt;p&gt;I have a router connected to a modem. My intention is to connect to this router from an office that's about 200 feet away and through 2 walls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router signal is not strong enough to get to the remote location, so I have put a range extender in between.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing that's extremely confusing is that when my computer (or any client) connects to the extender while sitting right next to it, it works perfectly (ping times of about 30ms).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I move to the remote location, even though the wifi signal strength is either 3/4 or 4/4 bars, the packet loss is massive, and the latency varies wildly where for a stretch it will report pings of about 50ms, but then will drop to 800+ and about 10% are just timed out packets altogether.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my question is... if the signal strength is good, why would this distance create such horrible packet loss? And what could cause such interference? I'm in a residential neighborhood, but there is absolutely nothing, line-of-sight between the laptop and the signal repeater other than 2 walls (with whatever electrical wiring is in them).&lt;/p&gt;&#xA;" OwnerUserId="1684" LastEditorUserId="762" LastEditDate="2013-06-14T12:25:49.250" LastActivityDate="2013-06-14T22:38:46.307" Title="What would cause really sporadic packet loss, when signal strength is fine" Tags="|wireless|packet-loss|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1881" PostTypeId="2" ParentId="1880" CreationDate="2013-06-14T02:13:09.723" Score="12" Body="&lt;p&gt;Wireless video cameras cause about the worse interference.   You don't need other 802.11 devices or access points to cause trouble as microwave ovens, some DECT phones, bluetooth, etc. can all run into the 2.4GHz band.  Line-of-sight isn't the only way you can &quot;see&quot; other devices competing for your channel.  Wireless is a shared-medium, so even with other 802.11 devices that play by the rules -- microwave ovens do not -- that medium can get congested.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Signal-strength (RSSI) is not an indication of channel congestion.  Only when you try to push something over it do you really find this out.  Try using another channel.  Grab the &quot;Wifi Analyzer&quot; for Android or equivalent for your device so you can see some (not all) of what's taking place in your environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Look at &lt;a href=&quot;http://www.ekahau.com/products/heatmapper/overview.html&quot; rel=&quot;nofollow&quot;&gt;Ekahau HeatMapper&lt;/a&gt; for a &lt;em&gt;you-get-more-than-you-paid-for&lt;/em&gt; poor-man's site survey tool; it's free!&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-14T22:38:46.307" LastActivityDate="2013-06-14T22:38:46.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1882" PostTypeId="2" ParentId="1880" CreationDate="2013-06-14T02:55:09.753" Score="15" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;However, when I move to the remote location, even though the wifi signal strength is either 3/4 or 4/4 bars, the packet loss is massive, and the latency varies wildly where for a stretch it will report pings of about 50ms, but then will drop to 800+ and about 10% are just timed out packets altogether.&lt;/p&gt;&#xA;&lt;p&gt;if the signal strength is good, why would this distance create such horrible packet loss?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Signal strength is only one metric... also consider signal to noise ratio, which is often the problem for scenarios like this.&lt;/p&gt;&#xA;&lt;p&gt;Wifi latency and packet loss are cousins of each other.  802.11 frames contain a sequence number that is ACK'd... if the sequence number isn't ACK'd (due to loss or a bit error in the original frame), then the sender attempts to retransmit the frame a certain number of times.  These 802.11 retransmissions show up as increased latency or outright packet loss if the interference is bad enough.&lt;/p&gt;&#xA;&lt;p&gt;I have literally seen 802.11g latency that is over 40 seconds (yes... seconds) when I'm only 50 feet from the LWAP.  That particular environment had a lot of tools that also operated in the 2.4GHz bands, so obviously the potential for errors was quite high.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;what could cause such interference? I'm in a residential neighborhood, but there is absolutely nothing, line-of-sight between the laptop and the signal repeater other than 2 walls (with whatever electrical wiring is in them).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Wifi operates in (mostly) open spectrum bands from the FCC... bluetooth, microwave ovens, phones, toy cars, we can only speculate about the source of the interference.&lt;/p&gt;&#xA;&lt;p&gt;You could try using a directed antenna with a focused beam (i.e. a &lt;a href=&quot;https://www.google.com/search?hl=en&amp;amp;q=yagi+wifi&quot; rel=&quot;noreferrer&quot;&gt;yagi&lt;/a&gt;, or a &lt;a href=&quot;http://en.wikipedia.org/wiki/Cantenna&quot; rel=&quot;noreferrer&quot;&gt;cantenna&lt;/a&gt;) on your stations... those might help if the interference is not in the direct path to your wifi source.&lt;/p&gt;&#xA;&lt;p&gt;Finally, if you have a wireless sniffer or access to a linux system (suggestion: &lt;a href=&quot;http://www.backtrack-linux.org/&quot; rel=&quot;noreferrer&quot;&gt;Backtrack Linux LiveCD&lt;/a&gt;) then you can &lt;a href=&quot;http://www.wi-fiplanet.com/tutorials/article.php/3791421/How-to-Sniff-Wireless-Packets-with-WireShark.htm&quot; rel=&quot;noreferrer&quot;&gt;diagnose your wifi problems with Wireshark / tshark&lt;/a&gt;.  Cisco also has a good reference for &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-13664&quot; rel=&quot;noreferrer&quot;&gt;Wireshark 802.11 display filters&lt;/a&gt;, which help filter out noise so you can focus on the problems at hand.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-06-14T11:41:51.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1883" PostTypeId="2" ParentId="1880" CreationDate="2013-06-14T03:10:36.677" Score="8" Body="&lt;p&gt;There are many causes for this type of behavior, and one of them is what is called the &lt;a href=&quot;https://en.wikipedia.org/wiki/Hidden_node_problem&quot;&gt;hidden node problem&lt;/a&gt;.  This is a very common problem that is often overlooked (in my experience).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The use of a range extender can often create a situation where this problem occurs and can reduce the effectiveness of some of the solutions to the hidden node problem.  In your case, the AP/router (or even other stations) may be able to still &quot;hear&quot; the station when it is close to the extender, but not when it is moved further away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Range extenders are not generally a good solution in almost any situation.  The main positive point they have going for them is that they are inexpensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would look at other solutions, while it may cost more, it will be far more reliable. Here are a couple ideas to start (not knowing enough about your needs or the site to make any real recommendation):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A second AP with higher gain directional antenna(s) pointed at your target location.&lt;/li&gt;&#xA;&lt;li&gt;A point to point wireless bridge solution.  No matter which company you choose, I would not recommend a 2.4GHz solution.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit to add means to test:&lt;/strong&gt;  Gave this a bit more thought and how I would go about testing this is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;After hours or during a maintenance window, &quot;disconnect&quot; all other stations.  You could do this by using a MAC allow list (allow only the extender and testing station) or changing the SSID and/or security.  Make sure there isn't another SSID that they will connect to automatically.&lt;/li&gt;&#xA;&lt;li&gt;If you changed the SSID and/or seurity, reconfigure the extender.&lt;/li&gt;&#xA;&lt;li&gt;Run the tests close to the extender and further away as was done previously.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If this improves your perfornamce, then it is most likely a hidden node problem. Hidden node problems are most pronounced in a wireless environement with multiple stations connected, espeially when all of them are transmitting/receiving data.  By removing the other stations from being an active part of the network, this should reduce the number of collisions that occur.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this doesn't improve performance, then you will need to look at other sources of interference as has been mentioned in other answers.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-06-14T15:22:59.643" LastActivityDate="2013-06-14T15:22:59.643" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1885" PostTypeId="2" ParentId="1824" CreationDate="2013-06-14T05:23:32.537" Score="1" Body="&lt;p&gt;Try changing the operator in the freeradius config to &quot;=~&quot; :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ospite-5vh Cisco-AVPair =~ &quot;ssid=Interactive_Ospiti&quot;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="460" LastActivityDate="2013-06-14T05:23:32.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1887" PostTypeId="2" ParentId="1867" CreationDate="2013-06-14T06:57:02.067" Score="6" Body="&lt;p&gt;You need a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HP 2520G is a Layer 2 managed switch, and has no Layer 3 capabilities.&#xA;This is highlighted in the &lt;a href=&quot;http://h17007.www1.hp.com/us/en/networking/products/switches/HP_2520_Switch_Series/index.aspx#tab=TAB2&quot; rel=&quot;nofollow&quot;&gt;features tab&lt;/a&gt; on hp.com and in the &lt;a href=&quot;http://bizsupport2.austin.hp.com/bc/docs/support/SupportManual/c03460274/c03460274.pdf&quot; rel=&quot;nofollow&quot;&gt;2520G feature support matrix&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not able to get funding for a router, maybe you could power up a Vyatta VM at the ProCurve site?&lt;/p&gt;&#xA;" OwnerUserId="1658" LastEditorUserId="-1" LastEditDate="2013-06-14T14:53:26.503" LastActivityDate="2013-06-14T14:53:26.503" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1888" PostTypeId="2" ParentId="1859" CreationDate="2013-06-14T07:25:22.407" Score="9" Body="&lt;p&gt;The difference between aggregate labels and normal labels is such that normal labels directly point to L2 rewrite details (an interface and L2 address). This means a normal label will be label switched by the egress PE node directly out, without doing an IP lookup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adversely, aggregate labels can potentially represent many different egress options, so L2 rewrite information is not associated with the label itself. This means that an egress PE node must perform an IP lookup for the packet, to determine appropriate L2 rewrite information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typical reasons why you might have an aggregate label instead of normal label are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Need to perform neighbor discovery (IPv4 ARP, IPv6 ND)&lt;/li&gt;&#xA;&lt;li&gt;Need to perform ACL lookup (egress ACL in customer interface)&lt;/li&gt;&#xA;&lt;li&gt;Running whole VRF under single label (table-label)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Some of these restrictions (particularly 2) are not valid to all platforms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How traceroute is affected in MPLS VPN environment is by the transit P, when generating the TTL exceeded message, will not know how to return it (it does not have routing table entry to the sender). So a transit P node will send the TTL exceeded message with original label stack all the way to the egress PE node, in hope that the egress PE note has an idea of how to return the TTL exceeded message to the sender.&lt;br&gt;&#xA;This feature is automatically on in Cisco IOS but needs 'icmp-tunneling' configured in Juniper JunOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on this, I would suspect that perhaps your CE devices are not accepting packets when source address is a P node link network, and as they are not accepting the ICMP message, they are not able to return it to the sender.&lt;br&gt;&#xA;A Possible way test to this theory would be to enable per-vrf label:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IOS: mpls label mode all-vrfs protocol bgp-vpnv4 per-vrf&lt;/li&gt;&#xA;&lt;li&gt;JunOS: set routing-instances FOO vrf-table-label&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Generally speaking I do not recommend propagating TTL, especially on VPN environment, at least in our case customers get confused and anxious about it. They worry why their VPN has foreign addresses showing.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing which confuses people causing them to open a support ticket, is when they are running a traceroute from say the UK to the US, because they see &gt;100ms latency between two core routers in UK, not realizing that the whole path has same latency all the way to the west coast of the US, because all the packets take a detour from there.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This issue is mostly unfixable by design, however in IOS you can determine how many labels at most to pop (mpls ip ttl-expiration pop N) when you are generating TTL exceeded. This gives you a somewhat decent approximation if INET == 1 label, VPN == &gt;1 label, so you can configure it so that VPN traffic is tunnelled and INET traffic gets directly returned without egress PE node detour. But as I said, this is just an approximation of desired functionality, as features like in-transit repairs may cause your label stack not to be always same size for the same service.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="253" LastEditDate="2013-06-16T21:21:38.163" LastActivityDate="2013-06-16T21:21:38.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1889" PostTypeId="1" CreationDate="2013-06-14T10:55:26.157" Score="9" ViewCount="1863" Body="&lt;p&gt;We are testing currently dot1x auth against FreeRADIUS/AD in the network. The vlans are dynamically assigned by FreeRADIUS on AD-group base. This works, but now the problem comes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We wanted to add our ip-telephones which doesn't speak dot1x to the network so we created a voice-vlan on the interfaces. This still didn't solve our problems because our ip-telephone came in the guest-vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the interface configuration is the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;... &#xA;!&#xA;interface ethernet 1/g7&#xA; spanning-tree portfast&#xA; switchport mode general&#xA; switchport general allowed vlan add 22 tagged&#xA; dot1x guest-vlan 55&#xA; voice vlan 22&#xA; voice vlan auth disable&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;dot1x mac-auth-bypass also doesn't work because we have a guest vlan configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is the following: How do I configure it on a Dell powerconnect 6248p so that my ip telephones will be on the correct vlan and still have my dot1x auth for users and still having a working guest vlan?&lt;/p&gt;&#xA;" OwnerUserId="1690" LastEditorUserId="762" LastEditDate="2013-06-14T11:13:35.043" LastActivityDate="2014-05-12T01:50:04.707" Title="Dell powerconnect 6248 voice vlan next to dot1x" Tags="|dell|powerconnect|dot1q|ieee-802.1x|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1890" PostTypeId="2" ParentId="653" CreationDate="2013-06-14T13:16:23.287" Score="1" Body="&lt;p&gt;I usually use &quot;show interface status&quot; and variations on it but I also use a neat piece of open-source software called &quot;Switchmap&quot; to provide a simple graphical view of the interfaces. One great benefit of this is that if a port is up/down it will tell you how long ago it last had traffic on it and you can make a call from there as whether you should reuse it or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://sourceforge.net/projects/switchmap/&quot; rel=&quot;nofollow&quot;&gt;http://sourceforge.net/projects/switchmap/&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This saves some typing :-)&lt;/p&gt;&#xA;" OwnerUserId="1692" LastActivityDate="2013-06-14T13:16:23.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1892" PostTypeId="1" AcceptedAnswerId="1895" CreationDate="2013-06-14T14:06:13.947" Score="17" ViewCount="10883" Body="&lt;p&gt;We have some Cisco 2821, 2921 and 1921 routers in our shop.  I can back up and restore the configurations by copying out or in the startup-config file, but what about the keys for ssh?  I don't want them to change in case I have to swap in a new router.  It's a long story, but basically I have some admin scripts that ssh into the router on an automated basis, and they will get mighty confused if they unexpectedly get that &quot;man-in-the-middle&quot; warning.  So, in short, in need a way to configure a new router with &lt;i&gt;exactly&lt;/i&gt; the same configuration as the one it is replacing, including ssh keys and passwords.&lt;/p&gt;&#xA;" OwnerUserId="1652" LastEditorUserId="775" LastEditDate="2013-06-15T18:12:06.870" LastActivityDate="2013-06-17T17:15:11.720" Title="Backing up Cisco router configuration - including ssh keys" Tags="|cisco|router|cisco-ios-12|cisco-ios-15|ssh|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1893" PostTypeId="2" ParentId="1892" CreationDate="2013-06-14T14:24:10.823" Score="11" Body="&lt;p&gt;Backing up the host keys to replace them is more trouble than it's worth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't want your scripts to barf on key changes (in *nix), run &lt;code&gt;ssh&lt;/code&gt; like this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no username@hostname&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This tells the &lt;code&gt;ssh&lt;/code&gt; client to use an empty Known Hosts file and do not force strict key checks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As mentioned in the comments, you are removing protections associated with SSH key-checking by disabling host-key checking.  You can mitigate this risk by running an IDS in the environment, or by using very strict Layer2 security features on that Vlan:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://linux.die.net/man/8/arpwatch&quot;&gt;&lt;code&gt;arpwatch&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Dynamic ARP Inspection, or host-level static ARP practices&lt;/li&gt;&#xA;&lt;li&gt;DHCP Snooping&lt;/li&gt;&#xA;&lt;li&gt;Ethernet port-security&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-14T16:10:54.253" LastActivityDate="2013-06-14T16:10:54.253" CommentCount="19" ContentLicense="CC BY-SA 3.0" />
  <row Id="1895" PostTypeId="2" ParentId="1892" CreationDate="2013-06-15T11:43:47.460" Score="13" Body="&lt;p&gt;(Examples performed on ISR 1921 G2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before we get into the details, I would suggest that instead of backing up your key, you just pull the new key from the new router and update your scripts. You will need to get onto the router without SSH to load the config/enable SSH anyways. This can be done with a script and console cable... you can even pull the new SSH public key out and update your scripts automatically (router#sh ip ssh). I think this is a more secure option. However to answer the question of backing up SSH keys:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to generate exportable keys for use with SSH and then export them to a PEM file with a password. Unfortunately the only two options for encrypting them are des and 3des.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Generate the key:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;home-1921(config)#crypto key generate rsa general-keys exportable label example modulus 4096&#xA;The name for the keys will be: example                                          &#xA;&#xA;% The key modulus size is 4096 bits                                             &#xA;% Generating 4096 bit RSA keys, keys will be exportable...                      &#xA;[OK] (elapsed time was 658 seconds)                                             &#xA;&#xA;Jun 15 11:10:05.158: %SSH-5-ENABLED: SSH 1.99 has been enabled                  &#xA;home-1921(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Assign to SSH if not already assigned:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;home-1921(config)#ip ssh rsa keypair-name example                               &#xA;home-1921(config)#                                                              &#xA;Jun 15 11:11:22.467: %SSH-5-DISABLED: SSH 1.99 has been disabled                &#xA;Jun 15 11:11:22.467: %SSH-5-ENABLED: SSH 1.99 has been enabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Export the key:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will export the key to the terminal which can be saved to a file via script or manually.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;home-1921(config)#$export rsa example pem terminal 3des somepassword            &#xA;% Key name: example                                                             &#xA;   Usage: General Purpose Key                                                   &#xA;   Key data:                                                                    &#xA;-----BEGIN PUBLIC KEY-----                                                      &#xA;MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsWwtMdoyj/LKPzXRf53z                &#xA;8yhIkRAbODN6DXne8JH53PAwtgQ2FrPARvnjWsqWn2EgkHEMkZl5y5tZ0iLITCPf                &#xA;bK8pXC/9kiLC2VDGQLbHD57AN/+6+0CoXxGW4FtV1dW4tVzo0YafL3L0rrNY8Snk                &#xA;nPXUu89RxYu0rnJCJGv3VQ5DS/LMx7RcKdB0oKh5NxrzMGR5AXCtK0d5giHIu5o7                &#xA;UAO8Q0JHYjHVHTtk8tnK5jhSMT68e4GxtsNSAaf5iA2qXY0E4KSZ+NCQJzM7RKa/                &#xA;/Sj8wmSHRhGYwEzfVdh+Cp3SRjiNSF4nVcECSEsEo5XzhM+yMHUJWeXw18pVFfED                &#xA;koen7IRw9Sj+uw0pegIwS4D/eniv/SMfPgjVd6RIm2k35GiH59Y73Bufu23+TOoB                &#xA;siYsZcbQ3QFohe5ix08pTeyvNXl6d6WlZWsyUfl7B9qIf5dICOfxu22xsFkdd3UX                &#xA;URyQum/oQPBLEGAaX01vto+oRW/DYXnIz4GXchTVnZMPxk5NGA3Li6advTWT3Vb8                &#xA;rH0aDSdtybrg0wVyOhEPW9Kx5Kx8ycxisZ7dM9iryvxjNtmmhxn9FS2uSI6mnOmR                &#xA;aQOG44Jyn/ihzaYuAsfbxHvDnKQKIJtQoJtrbrgjAh93GT/HIyHRLz1iRwGwNwlj                &#xA;3GUBV1NsL+HVZN68GPOyHfkCAwEAAQ==                                                &#xA;-----END PUBLIC KEY-----                                                        &#xA;-----BEGIN RSA PRIVATE KEY-----                                                 &#xA;Proc-Type: 4,ENCRYPTED                                                          &#xA;DEK-Info: DES-EDE3-CBC,0243F61FBCFF9FFD                                         &#xA;&#xA;i4lMwdfFZpC48ZFF3RnEOpLZzmv+vSgrHH6DGI/Gm1hB4KK+MC/a1TrrNbNzKPzY                &#xA;HFs74jLpGvYGb0jL5PbqrCL435F92h+N9SAkp4Tz8x78y4hUnM/2I9X9MhcGXJqE                &#xA;5U2r47KSYjUO+L41gWRDwwq7uZPXdJMEOr3JhJ6wv1UJx8BkxatmoZyeKMHIAcfQ                &#xA;JcwHnFnVZP3bNRYSwaMGemrfhg8HiT/JT3gUFj5d8r2pAouY8Vs9j4fM7EIn+CHz                &#xA;zGdZf9j3wIYOLjOhGLs7zABRmu4Ik7yv7iNqIOpZLMVegC9iQc6RMav8M3ivt+wU                &#xA;eNBR7+VLOYAz1J7bKEx1ZMk9XR4zdNTJlw+4UuYtXDDlW3OOsBFq/05mKPvaQWCE                &#xA;/NUrxSSEpgqaLJNJS5V4rgPKhSbg51GeIhkig+NkFIS7EtF/VCMXqaWd0lp7kYig                &#xA;3arRF0BdZXLsMDhZKmi1JA+rcmCSQIYVaBDc29SMs/Wou99vVazQIs2e1Dkl06Ia                &#xA;U7VeIwhEJykIl0MhBw+kwD3pNsiPth1xIg3DsDU+bq3gMNhcsl6Pj8FUP+PXdqaa                &#xA;HSGOy2tnYB60xxFv4vfRiW7JaFse9+uaesRiPDOC5YUx47yP65xEhiCmKMXD+9xU                &#xA;K/ZFYe9AvbJ4A65JjO/QQm5mg82cw5q4x/YQ1EC9T1w5kdjKJg9MkYoZmhHfttUZ                &#xA;2zuGBFm9FUiW5SnRRp4Pil0aTAMgj8uZaxUdq1nGfyJo2p7TTNXKsE8YMkSwu93p                &#xA;L914L64/bI2RLVQCciLZtVnVwAMffNpwtOJQzDDeUDI3i1ZItzehcsXXAWCN5xcQ                &#xA;+0lF6Q3KlrDNGZCtO8vrbDioaFT25ikdAlF0B+pnadetQkXlLs8xdBxxF9lUZjgw                &#xA;NqkbrYoY/c7Jf7dsWfC7fRqo3EjBxEFPwrdJJpvTtzgp4/Zk+dcHg0j4K2pFVMeT                &#xA;sZZzDaWlCaRoKw+OSh2KyzWjGKSzh/mm+cdp/4T+bbhUseRF6eGb0Qk0lMyQv3ja                &#xA;EE0GnyOYSlcavvIrqpx9v1iLEJLGWi58UiOASnzBlRh33nRqF+uoE5p6k/jgoUWC                &#xA;CccW2SfyEfXJDOg6fqGyKw3XjAJQ0/t1qWbiIXxtNjH8haO9OgWUn3pKI6PjZwQk                &#xA;6Eb5ow8WABZXb/pXJ/xjmLKjsmlxeqD31I2CaArV6hRCJoTKXkS2TWHCoHGRAPfL                &#xA;jrDBiFJ1+KVnCtuGN1kxRG6fyIMMyFBG7qEzNnHmNnLGP19XHvgSJe0QYNdrkFpZ                &#xA;iG+Kqz5bHcdEsucB0Efn/N7huu++R5XnSRYJnf6iPOTme6qwul3H1YQoaNNAbuch                &#xA;u98JaciIiSGLesBU4P28FEC4kesslKWcM8Z4GfvX//9zqkB6T1E5/jUs+x6YtPhp                &#xA;kMg9ZR195mP11E4MbgP9czk7HnK4Xgrns/DmXRdT1/d0dPtfng02jWjvOgNUQ1EJ                &#xA;ZvFd9ZN67nV4ZiDtcVi3756m7UEI2p/2431ecpigy2OUA+d8YKYEbAreMDE7W4Iq                &#xA;AlUalEiRmjwoerVIgQeB3oa2GElg2IN6llEa1UndI79ma13SJmgpLM+YUW+nS7k6                &#xA;COiuKllSbLBSF9s4+ErEXciAAJCGFi7kfFDB59whv1IbmDEGNAamB6oibCewbF0T                &#xA;xusyjhb2wA0KDq5C3ThlM5KU0g0ACSEuOl/A4AuubwxD7vvC6jiVFw/bCQrRJLJ6                &#xA;UuEcBTp0vEecdF12NtQWPpg/+K2PYBi7Yzzc8DZcF97afFmZAtnF3EFLJltywjjK                &#xA;qcGGCNyDj9MSBEnJigK7m0nYKjsOw5myt5LOhwWMr81OC7s6vgMBdf7qFCHiOUUB                &#xA;5MwpAzjGgaR85uYqCpCOmW5pjRpRptEocJPxeW6Uy+aFPAEQu92HvFjHk/tvefGX                &#xA;ttSsOPU5BC1J5xGZIoUfGPRFPYkjLauwQ34hGdQrbhJ3DrEe1pDAwd8/yIhzNp0o                &#xA;N8uZDWKegLPrRg1B6CvmY3+Axiz0ZJZ86LOLa67ZsEkbWpQoy4F8D+z131JFrRcK                &#xA;v0glY5b2GESUXtVxO668LqbmcO/eoDgBIhNvbrJT1QVgM/rr3poeeARGgff9OQ0i                &#xA;FpsA4yk4uOqS/TS4OfpG6ymneGao1tJfktXmiR37cpGfkKjHPvI5kE8/KTOZSdSk                &#xA;5RYjuCaWW363ysn7XA21Y9NiMYZesKCw8XdxVfVDZB6IphawYZ/a4cyvkYfD5HKw                &#xA;QeLE7Rv7fGhlUPPWr1WQZOBgnnmAZoxNxkPhC4S62WvdiJNmiIeLrmD50n22zukH                &#xA;aCj5S6sqXRuHdLB8FiZdi24s9tISBt0kAzK4bg3bvPoaqj3nSL8eirr1qWED/O+5                &#xA;xxjJrR7fgY0BdzbqU5gXK22o6PLGzlOIpgFep12dnoYUVL2igRJfTAGSHyMPeJpv                &#xA;e5mmAqxCz8FGgztZVP+v8MEkz/fDd/bIA0zkeA+0ugedbI/IkDkS25RdZkpvUpXH                &#xA;2+SNL1RJyoYT/uoShAuVv6y9uyvoojX9XNDVmLX10ip8tSsTVbJx97MPzNSaTABe                &#xA;Zbc5rgU4FJnUIIjb4igmccUrdW7ZknKk2cV9xRv7BHFYAl4hsitcsdKe8IPdX+2E                &#xA;WOXl2i2+ndUkzoqGlr4q8nOgAcr53Msjnn1ljasWHXDpeXRW+kraX+88UUmv9zEf                &#xA;T4gyl7shs/J24IlgHhJbqD5g10thG9esp8KvaxgeHyuBVpPniWWrecwajKFjfVKp                &#xA;J9EcxDXRUZH3c4jDIWxpKsGQFFsx9e7p286tcUXwGDBFkYOao9NOcyllltRq+ECH                &#xA;93Sc6hLp/Fd7hIAdZFbnjaemp2llA81cNKIVRUpJ4OyoVSOwhMp+j3m5SOmJdAxu                &#xA;SWcMKENRU6RSjqZOt15acOktCRRrMbLSxZY+fW+1g5IvA1j6mFiK57F569ouYZeP                &#xA;zvMgPgkDN/ATMd/RkHAWq5/EjeNmhey52XnHSqyAPmP4mX9qoaYtRYgBTGrKEFNo                &#xA;05V14xLunvGz+FEsqZ/IwSZYbYkGCpfczQWlRLnLkb8X7gbL/esfKfb3tSsbOluZ                &#xA;F/bAHniMg51uU2MmpspuWR+SzyWuabWiCkEq7lvXLTwdJGBYduaRH9u14bBCWUuA                &#xA;-----END RSA PRIVATE KEY-----                                                   &#xA;&#xA;home-1921(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Login test:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;demo-mac:~ demo$ ssh demo@&amp;lt;cleared&amp;gt;.205&#xA;The authenticity of host '&amp;lt;cleared&amp;gt;.205 (&amp;lt;cleared&amp;gt;.205)' can't be established.&#xA;RSA key fingerprint is af:6e:a0:fa:c3:45:ab:2d:a9:60:84:fe:0b:96:de:cc.&#xA;Are you sure you want to continue connecting (yes/no)? yes&#xA;Warning: Permanently added '&amp;lt;cleared&amp;gt;.205' (RSA) to the list of known hosts.&#xA;Password: &#xA;&#xA;home-1921#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Ok so we know it works... time to erase the NVRAM and restart.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;home-1921#erase nvram:                                                          &#xA;Erasing the nvram filesystem will remove all configuration files! Continue? [co]&#xA;[OK]                                                                            &#xA;Erase of nvram: complete                                                        &#xA;home-1921#                                                                      &#xA;Jun 15 11:16:19.268: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram    &#xA;home-1921#reload                                                                &#xA;&#xA;System configuration has been modified. Save? [yes/no]: no                      &#xA;Proceed with reload? [confirm]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now we reconfigure the test router to allow SSH again:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I am only generating a brand new key to demo that my terminal rejects the new key but then accepts the restored key. This step is unnecessary unless you're verifying that it works.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router&amp;gt;en                                                                       &#xA;router#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;router(config)#int G0/0&#xA;router(config-if)#ip add &amp;lt;cleared&amp;gt;.205 255.255.255.0&#xA;router(config-if)#no shutdown &#xA;router(config-if)#exit&#xA;router(config)#ip domain-name example.com&#xA;router(config)#aaa new-model&#xA;router(config)#aaa authen log def loc                                           &#xA;router(config)#aaa author exe def loc                                           &#xA;router(config)#username demo priv 15 sec demo                                   &#xA;router(config)#cry key gen rsa mod 4096                                         &#xA;The name for the keys will be: router.example.com                               &#xA;&#xA;% The key modulus size is 4096 bits                                             &#xA;% Generating 4096 bit RSA keys, keys will be non-exportable...                  &#xA;[OK] (elapsed time was 117 seconds)                                             &#xA;&#xA;Jun 15 11:17:55.247: %SSH-5-ENABLED: SSH 1.99 has been enabled                  &#xA;router(config)# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now the rejection of the key:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;demo-mac:~ demo$ ssh demo@&amp;lt;cleared&amp;gt;.205&#xA;@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@&#xA;@    WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!     @&#xA;@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@&#xA;IT IS POSSIBLE THAT SOMEONE IS DOING SOMETHING NASTY!&#xA;Someone could be eavesdropping on you right now (man-in-the-middle attack)!&#xA;It is also possible that a host key has just been changed.&#xA;The fingerprint for the RSA key sent by the remote host is&#xA;8c:62:d4:75:0f:4c:59:a8:81:d2:01:1b:68:9d:08:cb.&#xA;Please contact your system administrator.&#xA;Add correct host key in /Users/demo/.ssh/known_hosts to get rid of this message.&#xA;Offending RSA key in /Users/demo/.ssh/known_hosts:90&#xA;RSA host key for &amp;lt;cleared&amp;gt;.205 has changed and you have requested strict checking.&#xA;Host key verification failed.&#xA;demo-mac:~ demo$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Ok so lets restore the key and see what happens:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#$crypto key import rsa example-restored pem terminal somepassword           &#xA;% Enter PEM-formatted public General Purpose key or certificate.                &#xA;% End with a blank line or &quot;quit&quot; on a line by itself.                          &#xA;-----BEGIN PUBLIC KEY-----                                                      &#xA;MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAsWwtMdoyj/LKPzXRf53z                &#xA;8yhIkRAbODN6DXne8JH53PAwtgQ2FrPARvnjWsqWn2EgkHEMkZl5y5tZ0iLITCPf                &#xA;bK8pXC/9kiLC2VDGQLbHD57AN/+6+0CoXxGW4FtV1dW4tVzo0YafL3L0rrNY8Snk                &#xA;nPXUu89RxYu0rnJCJGv3VQ5DS/LMx7RcKdB0oKh5NxrzMGR5AXCtK0d5giHIu5o7                &#xA;UAO8Q0JHYjHVHTtk8tnK5jhSMT68e4GxtsNSAaf5iA2qXY0E4KSZ+NCQJzM7RKa/                &#xA;/Sj8wmSHRhGYwEzfVdh+Cp3SRjiNSF4nVcECSEsEo5XzhM+yMHUJWeXw18pVFfED                &#xA;koen7IRw9Sj+uw0pegIwS4D/eniv/SMfPgjVd6RIm2k35GiH59Y73Bufu23+TOoB                &#xA;siYsZcbQ3QFohe5ix08pTeyvNXl6d6WlZWsyUfl7B9qIf5dICOfxu22xsFkdd3UX                &#xA;URyQum/oQPBLEGAaX01vto+oRW/DYXnIz4GXchTVnZMPxk5NGA3Li6advTWT3Vb8                &#xA;rH0aDSdtybrg0wVyOhEPW9Kx5Kx8ycxisZ7dM9iryvxjNtmmhxn9FS2uSI6mnOmR                &#xA;aQOG44Jyn/ihzaYuAsfbxHvDnKQKIJtQoJtrbrgjAh93GT/HIyHRLz1iRwGwNwlj                &#xA;3GUBV1NsL+HVZN68GPOyHfkCAwEAAQ==                                                &#xA;-----END PUBLIC KEY-----                                                        &#xA;&#xA;% Enter PEM-formatted encrypted private General Purpose key.                    &#xA;% End with &quot;quit&quot; on a line by itself.                                          &#xA;-----BEGIN RSA PRIVATE KEY-----                                                 &#xA;Proc-Type: 4,ENCRYPTED                                                          &#xA;DEK-Info: DES-EDE3-CBC,0243F61FBCFF9FFD                                         &#xA;&#xA;i4lMwdfFZpC48ZFF3RnEOpLZzmv+vSgrHH6DGI/Gm1hB4KK+MC/a1TrrNbNzKPzY                &#xA;HFs74jLpGvYGb0jL5PbqrCL435F92h+N9SAkp4Tz8x78y4hUnM/2I9X9MhcGXJqE                &#xA;5U2r47KSYjUO+L41gWRDwwq7uZPXdJMEOr3JhJ6wv1UJx8BkxatmoZyeKMHIAcfQ                &#xA;JcwHnFnVZP3bNRYSwaMGemrfhg8HiT/JT3gUFj5d8r2pAouY8Vs9j4fM7EIn+CHz                &#xA;zGdZf9j3wIYOLjOhGLs7zABRmu4Ik7yv7iNqIOpZLMVegC9iQc6RMav8M3ivt+wU                &#xA;eNBR7+VLOYAz1J7bKEx1ZMk9XR4zdNTJlw+4UuYtXDDlW3OOsBFq/05mKPvaQWCE                &#xA;/NUrxSSEpgqaLJNJS5V4rgPKhSbg51GeIhkig+NkFIS7EtF/VCMXqaWd0lp7kYig                &#xA;3arRF0BdZXLsMDhZKmi1JA+rcmCSQIYVaBDc29SMs/Wou99vVazQIs2e1Dkl06Ia                &#xA;U7VeIwhEJykIl0MhBw+kwD3pNsiPth1xIg3DsDU+bq3gMNhcsl6Pj8FUP+PXdqaa                &#xA;HSGOy2tnYB60xxFv4vfRiW7JaFse9+uaesRiPDOC5YUx47yP65xEhiCmKMXD+9xU                &#xA;K/ZFYe9AvbJ4A65JjO/QQm5mg82cw5q4x/YQ1EC9T1w5kdjKJg9MkYoZmhHfttUZ                &#xA;2zuGBFm9FUiW5SnRRp4Pil0aTAMgj8uZaxUdq1nGfyJo2p7TTNXKsE8YMkSwu93p                &#xA;L914L64/bI2RLVQCciLZtVnVwAMffNpwtOJQzDDeUDI3i1ZItzehcsXXAWCN5xcQ                &#xA;+0lF6Q3KlrDNGZCtO8vrbDioaFT25ikdAlF0B+pnadetQkXlLs8xdBxxF9lUZjgw                &#xA;NqkbrYoY/c7Jf7dsWfC7fRqo3EjBxEFPwrdJJpvTtzgp4/Zk+dcHg0j4K2pFVMeT                &#xA;sZZzDaWlCaRoKw+OSh2KyzWjGKSzh/mm+cdp/4T+bbhUseRF6eGb0Qk0lMyQv3ja                &#xA;EE0GnyOYSlcavvIrqpx9v1iLEJLGWi58UiOASnzBlRh33nRqF+uoE5p6k/jgoUWC                &#xA;CccW2SfyEfXJDOg6fqGyKw3XjAJQ0/t1qWbiIXxtNjH8haO9OgWUn3pKI6PjZwQk                &#xA;6Eb5ow8WABZXb/pXJ/xjmLKjsmlxeqD31I2CaArV6hRCJoTKXkS2TWHCoHGRAPfL                &#xA;jrDBiFJ1+KVnCtuGN1kxRG6fyIMMyFBG7qEzNnHmNnLGP19XHvgSJe0QYNdrkFpZ                &#xA;iG+Kqz5bHcdEsucB0Efn/N7huu++R5XnSRYJnf6iPOTme6qwul3H1YQoaNNAbuch                &#xA;u98JaciIiSGLesBU4P28FEC4kesslKWcM8Z4GfvX//9zqkB6T1E5/jUs+x6YtPhp                &#xA;kMg9ZR195mP11E4MbgP9czk7HnK4Xgrns/DmXRdT1/d0dPtfng02jWjvOgNUQ1EJ                &#xA;ZvFd9ZN67nV4ZiDtcVi3756m7UEI2p/2431ecpigy2OUA+d8YKYEbAreMDE7W4Iq                &#xA;AlUalEiRmjwoerVIgQeB3oa2GElg2IN6llEa1UndI79ma13SJmgpLM+YUW+nS7k6                &#xA;COiuKllSbLBSF9s4+ErEXciAAJCGFi7kfFDB59whv1IbmDEGNAamB6oibCewbF0T                &#xA;xusyjhb2wA0KDq5C3ThlM5KU0g0ACSEuOl/A4AuubwxD7vvC6jiVFw/bCQrRJLJ6                &#xA;UuEcBTp0vEecdF12NtQWPpg/+K2PYBi7Yzzc8DZcF97afFmZAtnF3EFLJltywjjK                &#xA;qcGGCNyDj9MSBEnJigK7m0nYKjsOw5myt5LOhwWMr81OC7s6vgMBdf7qFCHiOUUB                &#xA;5MwpAzjGgaR85uYqCpCOmW5pjRpRptEocJPxeW6Uy+aFPAEQu92HvFjHk/tvefGX                &#xA;ttSsOPU5BC1J5xGZIoUfGPRFPYkjLauwQ34hGdQrbhJ3DrEe1pDAwd8/yIhzNp0o                &#xA;N8uZDWKegLPrRg1B6CvmY3+Axiz0ZJZ86LOLa67ZsEkbWpQoy4F8D+z131JFrRcK                &#xA;v0glY5b2GESUXtVxO668LqbmcO/eoDgBIhNvbrJT1QVgM/rr3poeeARGgff9OQ0i                &#xA;FpsA4yk4uOqS/TS4OfpG6ymneGao1tJfktXmiR37cpGfkKjHPvI5kE8/KTOZSdSk                &#xA;5RYjuCaWW363ysn7XA21Y9NiMYZesKCw8XdxVfVDZB6IphawYZ/a4cyvkYfD5HKw                &#xA;QeLE7Rv7fGhlUPPWr1WQZOBgnnmAZoxNxkPhC4S62WvdiJNmiIeLrmD50n22zukH                &#xA;aCj5S6sqXRuHdLB8FiZdi24s9tISBt0kAzK4bg3bvPoaqj3nSL8eirr1qWED/O+5                &#xA;xxjJrR7fgY0BdzbqU5gXK22o6PLGzlOIpgFep12dnoYUVL2igRJfTAGSHyMPeJpv                &#xA;e5mmAqxCz8FGgztZVP+v8MEkz/fDd/bIA0zkeA+0ugedbI/IkDkS25RdZkpvUpXH                &#xA;2+SNL1RJyoYT/uoShAuVv6y9uyvoojX9XNDVmLX10ip8tSsTVbJx97MPzNSaTABe                &#xA;Zbc5rgU4FJnUIIjb4igmccUrdW7ZknKk2cV9xRv7BHFYAl4hsitcsdKe8IPdX+2E                &#xA;WOXl2i2+ndUkzoqGlr4q8nOgAcr53Msjnn1ljasWHXDpeXRW+kraX+88UUmv9zEf                &#xA;T4gyl7shs/J24IlgHhJbqD5g10thG9esp8KvaxgeHyuBVpPniWWrecwajKFjfVKp                &#xA;J9EcxDXRUZH3c4jDIWxpKsGQFFsx9e7p286tcUXwGDBFkYOao9NOcyllltRq+ECH                &#xA;93Sc6hLp/Fd7hIAdZFbnjaemp2llA81cNKIVRUpJ4OyoVSOwhMp+j3m5SOmJdAxu                &#xA;SWcMKENRU6RSjqZOt15acOktCRRrMbLSxZY+fW+1g5IvA1j6mFiK57F569ouYZeP                &#xA;zvMgPgkDN/ATMd/RkHAWq5/EjeNmhey52XnHSqyAPmP4mX9qoaYtRYgBTGrKEFNo                &#xA;05V14xLunvGz+FEsqZ/IwSZYbYkGCpfczQWlRLnLkb8X7gbL/esfKfb3tSsbOluZ                &#xA;F/bAHniMg51uU2MmpspuWR+SzyWuabWiCkEq7lvXLTwdJGBYduaRH9u14bBCWUuA                &#xA;-----END RSA PRIVATE KEY-----                                                   &#xA;quit                                                                            &#xA;% Key pair import succeeded.                                                    &#xA;&#xA;router(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now assign it to SSH again:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#ip ssh rsa keypair-name example-restored                         &#xA;router(config)#                                                                 &#xA;Jun 15 11:25:36.619: %SSH-5-DISABLED: SSH 1.99 has been disabled                &#xA;Jun 15 11:25:36.623: %SSH-5-ENABLED: SSH 1.99 has been enabled                  &#xA;router(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;And try logging in again:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;demo-mac:~ demo$ ssh demo@&amp;lt;cleared&amp;gt;.205&#xA;Password: &#xA;&#xA;router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;All set!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;Note: When importing the key, make sure there are no extra spaces around the key info. If you copy and paste from a console, this may put trailing spaces on every line and you need to remove those before importing.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-06-15T11:43:47.460" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1897" PostTypeId="1" AcceptedAnswerId="1898" CreationDate="2013-06-15T19:42:56.403" Score="2" ViewCount="122" Body="&lt;p&gt;Is there a way to exchange messages between two hosts in the same VLAN referring only to the respective MAC addresses? I am thinking of a sort of equivalent to the Phone utility in a VMS network.&lt;/p&gt;&#xA;" OwnerUserId="562" LastEditorUserId="562" LastEditDate="2013-06-20T14:18:56.390" LastActivityDate="2013-06-20T14:18:56.390" Title="Data Link Messaging Protocol" Tags="|ethernet|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1898" PostTypeId="2" ParentId="1897" CreationDate="2013-06-15T19:48:22.087" Score="4" Body="&lt;p&gt;I'm not familiar with VMS 'Phone' but I'm very skeptical about it using L2, maybe DRP or NSP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But to answer your question, yes that is possible, you probably need superuser privileges to inject as 'raw socket'.&lt;br&gt;&#xA;If you're familiar with some programming language shouldn't be more than one hour exercise to send/receive messages via L2 header + arbitrary payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess one software that could be used is 'hping3', I'm sure there are others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why you would want to do so, other than curiosity and 'because I can' escapes me. As there is linklocal IPv4 addressing and service discovery protocols which you can use to automatically discover and use services in LAN over IP.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-15T19:48:22.087" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1899" PostTypeId="1" AcceptedAnswerId="1901" CreationDate="2013-06-15T20:42:44.903" Score="7" ViewCount="753" Body="&lt;p&gt;I'm looking at enabling 802.11k on my Cisco WLC. I see that it is a per-WLAN feature and that leads me to wonder if there might be any reason to not enable it? Specifically, does anyone know if there are security issues with providing clients the 802.11k neighbor list? if so, should i consider omitting 802.11k from my guest SSID?&lt;/p&gt;&#xA;" OwnerUserId="149" LastActivityDate="2013-06-16T04:47:08.140" Title="Is 802.11k a security risk?" Tags="|cisco|wireless|wlc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1900" PostTypeId="2" ParentId="1889" CreationDate="2013-06-15T21:10:10.247" Score="1" Body="&lt;p&gt;The first thing I'd verify is that the phone is actually tagging frames with that VLAN ID, perhaps with a network tap or port mirror (which might not quite work right on this switch)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you manually had configured the phone to do that and you know it's working, this is probably a bug in the software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, manually set it on the phone or configure LLDP-MED (Link Level Discovery Protocol)  on the interface to do this automatically. Depending on the type of phone (this includes most Polycom, Avaya, and Cisco), it should listen for LLDP packets and learn what the voice VLAN tag is and start sending on that tag. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;my-dell-switch(config-if-1/g1)#lldp med&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1701" LastActivityDate="2013-06-15T21:10:10.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1901" PostTypeId="2" ParentId="1899" CreationDate="2013-06-15T21:12:27.893" Score="7" Body="&lt;p&gt;I see no reason not to enable it if your WLC/AP's support it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end of the day the neighbour list is only populated with neighbours that are under the same administrative control as the original AP and so it doesn't really open you up any more than a usual WiFi connection would.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-06-15T21:12:27.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1902" PostTypeId="1" AcceptedAnswerId="1903" CreationDate="2013-06-15T21:13:00.743" Score="6" ViewCount="2243" Body="&lt;p&gt;The EOL announcement for the Cisco WS-X4516 on a 4510R (non-E series chassis) states that the WS-X45-SUP6-E is a replacement though this SUP is for the E-series chassis.  Incidentially, the SUP6 is also EOL and replaced with the WS-X45-SUP7-E.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can these E-series SUPs be used to replace 4516 non-E series SUPs?  My VAR says &quot;no&quot; after checking with Cisco. Is the VAR or these EOL announcements correct (or am I misreading them)?&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;With the 4500 non-E series EOL, I'm looking for any upgrade options on the SUPs short of having to replace the entire chassis and modules if possible.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps4324/eol_c51_574542.html&quot;&gt;End-of-Sale and End-of-Life Announcement for the Select Cisco Catalyst 4500 Non-E-Series Supervisor Engines&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps4324/eol__C51-726869.html&quot;&gt;End-of-Sale and End-of-Life Announcement for the Cisco Catalyst 4500 Supervisor Engine 6-E&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-06-16T02:55:21.693" Title="WS-X45-SUP6-E / WS-X45-SUP7-E compatibility w/4510R (non-E)" Tags="|cisco|switch|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1903" PostTypeId="2" ParentId="1902" CreationDate="2013-06-16T02:55:21.693" Score="11" Body="&lt;p&gt;Sup6E is supported in non-E chassis and it supports legacy modules.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Cisco Catalyst 4500 Supervisor Engine 6-E is compatible with classic Cisco Catalyst 4500 line cards, chassis, and power supplies, providing full investment protection. (Source: &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/modules/ps2797/ps9294/product_data_sheet0900aecd806df543_ps4324_Products_Data_Sheet.html&quot;&gt;Sup6E Data sheet&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Sup7E requires an E chassis&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cisco Catalyst Supervisor Engine 7-E is supported in Cisco Catalyst 4500 E-Series chassis only. (Source: &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps4324/data_sheet_c78-612364_ps2797_Products_Data_Sheet.html&quot;&gt;Sup7E Data sheet&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-06-16T02:55:21.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1904" PostTypeId="2" ParentId="1899" CreationDate="2013-06-16T04:47:08.140" Score="5" Body="&lt;p&gt;802.11k is no greater security risk than a normal wireless network without 802.11k.  Since the clients can already probe for your access points, this information is already available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can actually be a bit more secure as the information provided to the client will not include any rogue APs, so they will be less likely to be chosen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only reason I can think of for not enabling it is that there have been cases where client devices with older drivers (or where driver devs haven't taken into account 802.11k) may not handle 802.11k well which can lead to problems (disconnects mainly).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-06-16T04:47:08.140" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1905" PostTypeId="1" CreationDate="2013-06-16T05:26:50.323" Score="4" ViewCount="4864" Body="&lt;p&gt;Servers with majority of its traffic in UDP (new connections are expected), what can be used to effectively mitigate UDP flood? For example forged source IPs with variable sized UDP payload (typically 0-40 bytes) sent to UDP service port and the application will have problems if it sees UDP flood.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Are there any side effects to drop all incoming UDP with payload smaller less than a certain size? I know it does not solve the problem but it somehow increases the cost of the attack.&lt;/li&gt;&#xA;&lt;li&gt;Anything I can effectively do with a SRX240 or PA-2000? &lt;/li&gt;&#xA;&lt;li&gt;Or any other suggestions?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34" LastEditorUserId="76" LastEditDate="2013-06-16T13:39:20.130" LastActivityDate="2013-06-28T17:34:13.017" Title="How to mitigate UDP Flood?" Tags="|security|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1908" PostTypeId="2" ParentId="1867" CreationDate="2013-06-16T08:16:55.730" Score="0" Body="&lt;p&gt;For GRE support , HP has the exH3C based A5800 switches (take a look at the release notes: &lt;a href=&quot;https://h10145.www1.hp.com/downloads/SoftwareReleases.aspx?ProductNumber=JC103A&quot; rel=&quot;nofollow&quot;&gt;https://h10145.www1.hp.com/downloads/SoftwareReleases.aspx?ProductNumber=JC103A&lt;/a&gt;). The E3800 is based upon HP´s &quot;old&quot; Procurve design. You can get the A5800 series pretty cheap as refurbished &quot;HP Renew&quot; with HP warranty left.&lt;/p&gt;&#xA;" OwnerUserId="1704" LastActivityDate="2013-06-16T08:16:55.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1910" PostTypeId="2" ParentId="1905" CreationDate="2013-06-16T12:08:22.170" Score="8" Body="&lt;p&gt;UDP attacks generally fit two profiles:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Small packets aimed at hammering the application of the server.&lt;/li&gt;&#xA;&lt;li&gt;Large packets aimed at exhausting available bandwidth.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There is of course also the possibility of using large packets if the attacker knows that a well-crafted packet can cause additional processing time on the server in excess of the additional bandwidth cost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply dropping UDP packets below a certain size is far too blunt of an instrument to really be commendable, not least because this may well just result in your attacker changing strategy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if the focus was to hammer your servers, the attacker could switch to an DNS amplification attack that aims to exhaust your available bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So what can you do to mitigate these issues or respond? It generally comes down to observing an attack and then profiling it. There are a few basic things you can do such as implementing uRPF at your edge to filter spoofed IPs that do not actually exist on the public internet and using rate-limiting heuristics that will block an IP if it repeatedly sends what you consider &quot;bad&quot; traffic (e.g. rapidly transmitting small UDP datagrams).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to an active attack, analysis is the key:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you observe a common source port, IP (address/range) or payload data within the attack traffic, if so, you have criteria to define a block rule with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, if you're falling victim to a DNS amplification attack or anything that relies on exhausting your available inbound bandwidth - the only real counter-measure if it is killing your throughput is to blackhole the target addresses at your upstream provided. Basically, you sacrifice the reachability of the target for the good of the rest of your network. If it doesn't saturate your links, any decent stateful firewall should block unsolicited DNS response packets.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-16T12:08:22.170" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1912" PostTypeId="1" AcceptedAnswerId="1917" CreationDate="2013-06-17T11:49:56.867" Score="8" ViewCount="6323" Body="&lt;p&gt;I have an ASA5525-X with 9.1.2. On it are several interfaces, but primarily I'm looking at:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(fake subnets)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;inside 10.0.0.0/24, security level 100&lt;/li&gt;&#xA;&lt;li&gt;outside 10.0.200.0/24, security level 0&lt;/li&gt;&#xA;&lt;li&gt;DMZ 10.0.100.0/24, security level 50&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have a DNS server in DMZ, 10.0.100.1 which I can access from inside without issue. However, I want it to show up as 10.0.200.95 (not a real IP for this example) to people on the internet. I have what I thought was needed for this to work, but when I test it out, the packets are being dropped by the default acl.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pertinent config pieces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 10.0.200.194 255.255.255.192 &#xA;interface GigabitEthernet0/6&#xA; nameif DMZ&#xA; security-level 50&#xA; ip address 10.0.100.254 255.255.255.0 &#xA;interface GigabitEthernet0/7&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.0.0.254 255.255.255.0 &#xA;&#xA;object network DMZ-DNS-Server-1&#xA; host 10.0.100.1&#xA;&#xA;nat (inside,outside-backup) source static Company-MPLS-Network-Group Company-MPLS-Network-Group destination static VPN VPN no-proxy-arp route-lookup&#xA;nat (inside,outside) source static Company-MPLS-Network-Group Company-MPLS-Network-Group destination static VPN VPN no-proxy-arp route-lookup&#xA;nat (inside,outside) source static Company-MPLS-Network-Group Company-MPLS-Network-Group destination static Site-Site-VPN Site-Site-VPN no-proxy-arp route-lookup&#xA;nat (inside,outside-backup) source static Company-MPLS-Network-Group Company-MPLS-Network-Group destination static Site-Site-VPN Site-Site-VPN no-proxy-arp route-lookup&#xA;nat (inside,DMZ) source static Company-MPLS-Network-Group Company-MPLS-Network-Group destination static DMZ DMZ no-proxy-arp route-lookup&#xA;nat (DMZ,outside) source static DMZ DMZ destination static Site-Site-VPN Site-Site-VPN no-proxy-arp route-lookup&#xA;nat (DMZ,outside-backup) source static DMZ DMZ destination static Site-Site-VPN Site-Site-VPN no-proxy-arp route-lookup&#xA;&#xA;object network DMZ-DNS-Server-1&#xA; nat (DMZ,outside) static 10.0.200.195 net-to-net&#xA;&#xA;nat (inside,outside-backup) after-auto source dynamic any interface&#xA;nat (inside,outside) after-auto source dynamic any interface&#xA;nat (DMZ,outside) after-auto source dynamic any interface&#xA;nat (DMZ,outside-backup) after-auto source dynamic any interface&#xA;&#xA;&#xA;access-list traffic-in-outside extended permit tcp any host 10.0.200.195 eq domain &#xA;access-list traffic-in-outside extended permit udp any host 10.0.200.195 eq domain &#xA;access-group traffic-in-outside in interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-06-17T12:38:36.960" LastActivityDate="2013-06-17T15:54:11.957" Title="How to host server in DMZ zone of an ASA" Tags="|cisco|cisco-asa|nat|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1913" PostTypeId="1" AcceptedAnswerId="1915" CreationDate="2013-06-17T12:27:28.293" Score="10" ViewCount="4704" Body="&lt;p&gt;I have a firewall counter on a Juniper MX router (&lt;code&gt;set firewall filter myfilter term myterm then count mycounter&lt;/code&gt;) and want to poll its packet/byte count via SNMP. I searched for an OID but I'm unable to find one. Is it possible at all to poll firewall filter counters via SNMP and if so which MIB/OID do I use?&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-06-17T13:56:36.317" Title="Can I poll firewall counters on Juniper routers via SNMP" Tags="|juniper|snmp|juniper-mx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1914" PostTypeId="2" ParentId="1912" CreationDate="2013-06-17T12:31:49.443" Score="1" Body="&lt;p&gt;You will need to setup a static NAT to do this, since 8.3+ this has changed slightly, in 9 you will want to do it like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network STATIC_NAT&#xA; host 10.0.100.1&#xA; nat (DMZ,outside) static 10.0.200.95 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-06-17T12:31:49.443" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1915" PostTypeId="2" ParentId="1913" CreationDate="2013-06-17T12:58:38.590" Score="12" Body="&lt;p&gt;Yes, this data is populated in the Firewall MIB&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;.1.3.6.1.4.1.2636.3.5.2.1.5 contains your counters&lt;/li&gt;&#xA;&lt;li&gt;.1.3.6.1.4.1.2636.3.5.2.1.6 contains your filter names&lt;/li&gt;&#xA;&lt;li&gt;.1.3.6.1.4.1.2636.3.5.2.1.7 contains your counter names&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;show firewall filter RE-FILTER | match mgmt_ntp&lt;br&gt;&#xA;mgmt_ntp           &lt;strong&gt;199728&lt;/strong&gt;                 2628&lt;/p&gt;&#xA;&#xA;&lt;p&gt;% snmpbulkwalk jnpr .1.3.6.1.4.1.2636.3.5.2.1.7|grep mgmt_ntp&lt;br&gt;&#xA;.1.3.6.1.4.1.2636.3.5.2.1.7.&lt;strong&gt;9.82.69.45.70.73.76.84.69.82.8.109.103.109.116.95.110.116.112.2&lt;/strong&gt; = STRING: &quot;mgmt_ntp&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;% snmpbulkwalk jnpr .1.3.6.1.4.1.2636.3.5.2.1.5.&lt;strong&gt;9.82.69.45.70.73.76.84.69.82.8.109.103.109.116.95.110.116.112.2&lt;/strong&gt;&lt;br&gt;&#xA;.1.3.6.1.4.1.2636.3.5.2.1.5.9.82.69.45.70.73.76.84.69.82.8.109.103.109.116.95.110.116.112.2 = Counter64: &lt;strong&gt;199728&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information on &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos/topics/concept/mib-firewall-junos-overview.html&quot;&gt;juniper.net&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-06-17T13:56:36.317" LastActivityDate="2013-06-17T13:56:36.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1917" PostTypeId="2" ParentId="1912" CreationDate="2013-06-17T15:54:11.957" Score="8" Body="&lt;p&gt;Change your ACL to reference the real address of the server (10.0.100.1) instead of the translated address (10.0.200.195). This is another change in 8.3+.  ACLs match on real addresses.&lt;/p&gt;&#xA;" OwnerUserId="460" LastActivityDate="2013-06-17T15:54:11.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1918" PostTypeId="1" CreationDate="2013-06-17T16:00:32.277" Score="9" ViewCount="18823" Body="&lt;p&gt;I'm looking at deploying a pair of ASR1001 units at the WAN edge to support 2x IP Transit and 1x Peering services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to do IPV4 and IPV6 eBGP and iBGP to advertise the peering routes into the core as the peering service will only be on one of the two units.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having real trouble finding a succinct summary of the differences in available features between each feature license. Would anyone be able to either point me to an appropriate link or summarize what features are available from which feature set?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have described the above scenario to a sales rep who has advised I need the Adv. Ent. Services feature set to unlock all functionality of BGP; but I'm somewhat suspicious of that recommendation...&lt;/p&gt;&#xA;" OwnerUserId="1694" LastEditorUserId="775" LastEditDate="2013-06-17T16:09:09.960" LastActivityDate="2018-11-07T10:32:26.317" Title="ASR1K feature licensing navigation" Tags="|cisco|bgp|bgp-ipv6|cisco-asr|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1919" PostTypeId="2" ParentId="1918" CreationDate="2013-06-17T16:19:25.620" Score="7" Body="&lt;p&gt;For the ASR 1K, Advanced Enterprise Services is needed to support &quot;legacy protocols&quot; (IBM, IPX, etc.), but for IP protocols, including IPv6 and BGP, Advanced IP Services should be adequate. See the following links for more information.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/products/sw/iosswrel/ps5460/products_qanda_item09186a00801af2c6.shtml&quot; rel=&quot;noreferrer&quot;&gt;Cisco IOS Packaging Customer Q&amp;amp;A&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps9343/product_bulletin_c07-448862.html#wp9002584&quot; rel=&quot;noreferrer&quot;&gt;Ordering ASR 1000 Software&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps9343/qa_c67-452124.html&quot; rel=&quot;noreferrer&quot;&gt;ASR 1000 router Q&amp;amp;A&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="460" LastEditorUserId="775" LastEditDate="2013-06-17T16:24:47.910" LastActivityDate="2013-06-17T16:24:47.910" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1920" PostTypeId="1" AcceptedAnswerId="1927" CreationDate="2013-06-17T16:21:17.353" Score="6" ViewCount="2099" Body="&lt;p&gt;I am receiving the following syslog messages on a 7609-S.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jun 17 11:52:27.560 BST: %CONST_DIAG-SP-4-ERROR_COUNTER_DATA: ID:47 IN:4 PO:255 RE:169 RM:255 DV:5 EG:2 CF:10 TF:472&#xA;Jun 17 11:52:27.560 BST: %CONST_DIAG-SP-4-ERROR_COUNTER_WARNING: Module 6 Error counter exceeds threshold, system operation continue.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The card in slot 6 is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router1#show module 6 &#xA;Mod Ports Card Type                              Model              Serial No.&#xA;--- ----- -------------------------------------- ------------------ -----------&#xA;  6   48  SFM-capable 48 port 10/100/1000mb RJ45 WS-X6548-GE-TX     XXXXXXXX&#xA;&#xA;Mod MAC addresses                       Hw    Fw           Sw           Status&#xA;--- ---------------------------------- ------ ------------ ------------ -------&#xA;  6  000e.d771.8550 to 000e.d771.857f  10.1   7.2(1)       8.7(0.22)FW2 Ok&#xA;&#xA;Mod  Online Diag Status &#xA;---- -------------------&#xA;  6  Pass&#xA;&#xA;router1#show ver&#xA;Cisco IOS Software, c7600rsp72043_rp Software (c7600rsp72043_rp-ADVENTERPRISEK9-M), Version 12.2(33)SRE3, RELEASE SOFTWARE (fc1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2013-06-02 : I received this message, once, for the first time&lt;/li&gt;&#xA;&lt;li&gt;2013-06-06 : I received the message again, only once&lt;/li&gt;&#xA;&lt;li&gt;2013-06-11 : I received the message again, only once&lt;/li&gt;&#xA;&lt;li&gt;2013-06-17 : I have received this message three times today, in a 2 hour period&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Searching on the Internet I see other people reporting this issue and it seems to be an indication of hardware failure on the horizon. Has anyone experienced this error before? It simply means (to the best of my knowledge) that that line card is receiving a high volume of errors, above a certain threshold which causes the system to log a syslog message. Should I be worried about this line card?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I do have some graphs I will post here when I get some time over the next day or two showing interface error counters and traffic etc, although I'm not finding much correlation at this point!&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="775" LastEditDate="2013-06-30T10:32:01.850" LastActivityDate="2013-06-30T10:32:01.850" Title="Cisco 7609-S Line card error counter is regularly exceeding threshold" Tags="|cisco|switch|cisco-7600|errors|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1921" PostTypeId="2" ParentId="640" CreationDate="2013-06-17T16:24:30.467" Score="5" Body="&lt;p&gt;I'd like to add ELAM in the mix. ELAM is supported on PFC3 (6500, 7600).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to have 'service internal' enabled, but it's quite safe feature to run, I've ran it good deal in production networks and not yet once experienced negative impact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially what ELAM does is it shows you what was send for lookup processing to PFC via DBUS (Data BUS) and what did the PFC give as lookup result in RBUS (Result BUS).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;show plat cap elam asic superman slot DFC/PFC_SLOT_YOU_WANT_TO_LOOK&lt;/li&gt;&#xA;&lt;li&gt;show plat cap elam trigger dbus ipv4 if ip_sa=192.0.2.1&lt;/li&gt;&#xA;&lt;li&gt;show plat cap elam start&lt;/li&gt;&#xA;&lt;li&gt;show plat cap elam data &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For the triggers there is online help, IP_SA == IP Source Address, IP_DA == IP Destination Address, lot of others are available. IF what you want to check isn't available you can do data + mask match for arbitrary data on the first 64B.&lt;br&gt;&#xA;The arbitrary trigger is bit awkward but can be lifesafer, you'll use it like this: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;show platform capture elam trigger dbus others if data = DATA1 DATA2 DATAn [MASK1 MASK2 MASKn ]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Data starts from DMAC. So say we want to catch incoming MPLS stack of [0 1951], but we don't care about MAC addresses, we could do this:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;show platform capture elam trigger dbus others if data = 0 0 0                               0x88470000 0x00000079 0xF0000000 [ 0 0 0 0xffffffff 0xf000ffff                   0xf0000000 ]                                                         &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Example output might be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7600#show platform capture elam data&#xA;DBUS data:&#xA;SEQ_NUM                          [5] = 0x1D&#xA;QOS                              [3] = 1&#xA;QOS_TYPE                         [1] = 0&#xA;TYPE                             [4] = 0 [ETHERNET]&#xA;STATUS_BPDU                      [1] = 0&#xA;IPO                              [1] = 1&#xA;NO_ESTBLS                        [1] = 0&#xA;RBH                              [3] = b000   ! port-channel hash&#xA;CR                               [1] = 1      ! recirculated&#xA;TRUSTED                          [1] = 1&#xA;NOTIFY_IL                        [1] = 0&#xA;NOTIFY_NL                        [1] = 0&#xA;DISABLE_NL                       [1] = 0&#xA;DISABLE_IL                       [1] = 0&#xA;DONT_FWD                         [1] = 0&#xA;INDEX_DIRECT                     [1] = 0&#xA;DONT_LEARN                       [1] = 0&#xA;COND_LEARN                       [1] = 0&#xA;BUNDLE_BYPASS                    [1] = 0&#xA;QOS_TIC                          [1] = 1&#xA;INBAND                           [1] = 0&#xA;IGNORE_QOSO                      [1] = 0&#xA;IGNORE_QOSI                      [1] = 0&#xA;IGNORE_ACLO                      [1] = 0&#xA;IGNORE_ACLI                      [1] = 0&#xA;PORT_QOS                         [1] = 0&#xA;CACHE_CNTRL                      [2] = 0 [NORMAL]&#xA;VLAN                             [12] = 4086&#xA;SRC_FLOOD                        [1] = 0&#xA;SRC_INDEX                        [19] = 0xC0          ! divmod64(0xc0) = 3,0, add 1 to each, 4/1 == our physical port&#xA;LEN                              [16] = 102&#xA;FORMAT                           [2] = 0 [IP]&#xA;MPLS_EXP                         [3] = 0x0&#xA;REC                              [1] = 0&#xA;NO_STATS                         [1] = 0&#xA;VPN_INDEX                        [10] = 0x7F&#xA;PACKET_TYPE                      [3] = 0 [ETHERNET]&#xA;L3_PROTOCOL                      [4] = 0 [IPV4]&#xA;L3_PT                            [8] = 1 [ICMP]&#xA;MPLS_TTL                         [8] = 0&#xA;SRC_XTAG                         [4] = 0xF&#xA;DEST_XTAG                        [4] = 0xA&#xA;FF                               [1] = 0&#xA;MN                               [1] = 0&#xA;RF                               [1] = 1&#xA;SC                               [1] = 0&#xA;CARD_TYPE                        [4] = 0x0&#xA;DMAC                             = 8843.e1de.22c0&#xA;SMAC                             = 0000.0000.0000&#xA;IPVER                            [1] = 0 [IPV4]&#xA;IP_DF                            [1] = 1&#xA;IP_MF                            [1] = 0&#xA;IP_HDR_LEN                       [4] = 5&#xA;IP_TOS                           [8] = 0x0&#xA;IP_LEN                           [16] = 84&#xA;IP_HDR_VALID                     [1] = 1&#xA;IP_CHKSUM_VALID                  [1] = 1&#xA;IP_L4HDR_VALID                   [1] = 1&#xA;IP_OFFSET                        [13] = 0&#xA;IP_TTL                           [8] = 63&#xA;IP_CHKSUM                        [16] = 0xBCF1&#xA;IP_SA                            = x.x.x       ! to protect the guilty&#xA;IP_DA                            = y.y.y.y     ! to protect the guilty&#xA;ICMP_TYPE                        [8] = 0x8&#xA;ICMP_CODE                        [8] = 0x0&#xA;ICMP_DATA [104]&#xA;0000:  A0 8B 18 A5 00 39 46 35 BF 51 00 6F 3C            &quot;.....9F5.Q.o&amp;lt;&quot;&#xA;CRC                              [16] = 0x71B3&#xA;&#xA;RBUS data:&#xA;SEQ_NUM                          [5] = 0x1D&#xA;CCC                              [3] = b100 [L3_RW]  ! normal L3_RW, we know it was not dropped, L2/mls policed etc&#xA;CAP1                             [1] = 0&#xA;CAP2                             [1] = 0&#xA;QOS                              [3] = 0&#xA;EGRESS                           [1] = 0&#xA;DT                               [1] = 0 [IP]&#xA;TL                               [1] = 0 [B32]&#xA;FLOOD                            [1] = 1&#xA;DEST_INDEX                       [19] = 0x3E8    ! same as VLAN, but not always    &#xA;VLAN                             [12] = 1000     ! you may need to check internal vlan     &#xA;RBH                              [3] = b111      ! again, port-channel hash&#xA;RDT                              [1] = 0&#xA;GENERIC                          [1] = 0&#xA;EXTRA_CICLE                      [1] = 0&#xA;FABRIC_PRIO                      [1] = 0&#xA;L2                               [1] = 0&#xA;FCS1                             [8] = 0x1&#xA;IP_TOS_VALID                     [1] = 1&#xA;IP_TOS_OFS                       [7] = 15&#xA;IP_TOS                           [8] = 0x0&#xA;IP_TTL_VALID                     [1] = 1&#xA;IP_TTL_OFS                       [7] = 22&#xA;IP_TTL                           [8] = 62&#xA;IP_CSUM_VALID                    [1] = 1&#xA;IP_CSUM_OFS                      [7] = 24&#xA;IP_CSUM                          [16] = 0xBDF1&#xA;DELTA_LEN                        [8] = 0&#xA;REWRITE_INFO&#xA; i0  - replace bytes from ofs 0 to ofs 11 with seq 'D0 D0 FD 09 34 2D 88 43 E1 DE 22 C0'.   ! this is the actual L2 rewrite data, so you should obviously see DMAC and SMAC here &#xA;FCS2                             [8] = 0x0&#xA;7600#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Pretty much all bigger platforms have this type of low-level captures for transit packets, which are exceptionally useful when you need to verify HW is doing what configuration says, sometimes there are software defects and it does something else than expected.&lt;br&gt;&#xA;I know that in GSR you can see transit in memory, in Juniper Trio there is quite nice tool for it as well. Brocade can do it. It's quite baffling they are not documented in vendor pages.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-17T16:24:30.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1922" PostTypeId="2" ParentId="1918" CreationDate="2013-06-17T16:26:56.307" Score="3" Body="&lt;p&gt;Check out the &lt;a href=&quot;http://tools.cisco.com/ITDIT/CFN/jsp/by-feature-technology.jsp&quot; rel=&quot;nofollow&quot;&gt;Feature Navigator&lt;/a&gt; on Cisco's site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found this to be the only way sometimes to compare which feature is available in each image/license level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Choose the feature(s) you're looking for from the list at the left, then click continue.   After that you'll be able to drill down into the IOS-XE platform -&gt; ASR1001.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to tell if you need Advanced Enterprise or Advanced IP there.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-06-17T16:26:56.307" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1923" PostTypeId="2" ParentId="1920" CreationDate="2013-06-17T16:29:27.273" Score="5" Body="&lt;p&gt;You need to open a case with Cisco TAC... obligatory &lt;a href=&quot;https://supportforums.cisco.com/thread/165310&quot; rel=&quot;noreferrer&quot;&gt;Cisco Support Forums reference to a similar problem&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without TAC support perhaps the best you can do is&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;reseat the LC...&lt;/li&gt;&#xA;&lt;li&gt;replace the LC... &lt;/li&gt;&#xA;&lt;li&gt;Upgrade IOS and pray it was a bug...&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Be sure the screws on the LC are snugged on tight when you do maintenance... loose screws can cause more problems than you might imagine (think repetitive heating / cooling cycles wiggling the LC loose)&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-17T16:34:57.777" LastActivityDate="2013-06-17T16:34:57.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1924" PostTypeId="1" AcceptedAnswerId="1984" CreationDate="2013-06-17T16:59:43.750" Score="7" ViewCount="13833" Body="&lt;p&gt;I have configured a remote site with two IP addresses for data centre VPN peers - one primary (1.1.1.1), one backup (2.2.2.2).  When the primary peer fails, the remote site detects the failure using DPD (after about 15 seconds).  It tears down the SAs, then proceeds to try to connect again to the primary peer! After about 30 seconds  of no response, it finally tries the backup peer and connects immediately.  Has anyone else seen this, and is there any way to avoid this needless 30 second wait?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Code version is 8.2(5), configs below)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;REMOTE SITE FIREWALL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec transform-set L2L-VPN-TRANSFORM esp-3des esp-sha-hmac &#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;!&#xA;tunnel-group 1.1.1.1 type ipsec-l2l&#xA;tunnel-group 1.1.1.1 general-attributes&#xA; default-group-policy L2L-VPN-POLICY&#xA;tunnel-group 1.1.1.1 ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group 2.2.2.2 type ipsec-l2l&#xA;tunnel-group 2.2.2.2 general-attributes&#xA; default-group-policy L2L-VPN-POLICY&#xA;tunnel-group 2.2.2.2 ipsec-attributes&#xA; pre-shared-key *****&#xA;!&#xA;crypto map OUTSIDE-MAP 1 match address ATOS-DC-ENCRYPTION-DOMAIN&#xA;crypto map OUTSIDE-MAP 1 set pfs &#xA;crypto map OUTSIDE-MAP 1 set peer 1.1.1.1 2.2.2.2 &#xA;crypto map OUTSIDE-MAP 1 set transform-set L2L-VPN-TRANSFORM&#xA;crypto map OUTSIDE-MAP 1 set security-association lifetime seconds 3600&#xA;crypto map OUTSIDE-MAP 1 set security-association lifetime kilobytes 4608000&#xA;crypto map OUTSIDE-MAP interface OUTSIDE&#xA;crypto isakmp enable OUTSIDE&#xA;crypto isakmp policy 1&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;DC FIREWALLS (BOTH THE SAME):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec transform-set L2L-VPN-TRANSFORM esp-3des esp-sha-hmac &#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;!&#xA;tunnel-group DefaultL2LGroup general-attributes&#xA; default-group-policy L2L-VPN-POLICY&#xA;tunnel-group DefaultL2LGroup ipsec-attributes&#xA; pre-shared-key *****&#xA;!&#xA;crypto dynamic-map REMOTE-DYNMAP 1 set pfs &#xA;crypto dynamic-map REMOTE-DYNMAP 1 set transform-set L2L-VPN-TRANSFORM&#xA;crypto dynamic-map REMOTE-DYNMAP 1 set security-association lifetime seconds 3600&#xA;crypto dynamic-map REMOTE-DYNMAP 1 set security-association lifetime kilobytes 4608000&#xA;crypto dynamic-map REMOTE-DYNMAP 1 set reverse-route&#xA;crypto map OUTSIDE-MAP 1 ipsec-isakmp dynamic REMOTE-DYNMAP&#xA;crypto map OUTSIDE-MAP interface OUTSIDE&#xA;crypto isakmp enable OUTSIDE&#xA;crypto isakmp policy 1&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Logs showing the failure and the delay:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jun 18 2013 00:52:46: %ASA-5-111008: User 'enable_15' executed the 'clear logging buffer' command.&#xA;Jun 18 2013 00:54:37: %ASA-3-713123: Group = 1.1.1.1, IP = 1.1.1.1, IKE lost contact with remote peer, deleting connection (keepalive type: DPD)&#xA;Jun 18 2013 00:54:37: %ASA-5-713259: Group = 1.1.1.1, IP = 1.1.1.1, Session is being torn down. Reason: Lost Service&#xA;Jun 18 2013 00:54:37: %ASA-4-113019: Group = 1.1.1.1, Username = 1.1.1.1, IP = 1.1.1.1, Session disconnected. Session Type: IPsec, Duration: 0h:03m:00s, Bytes xmt: 480192, Bytes rcv: 478992, Reason: Lost Service&#xA;Jun 18 2013 00:54:37: %ASA-5-713041: IP = 1.1.1.1, IKE Initiator: New Phase 1, Intf OUTSIDE, IKE Peer 1.1.1.1  local Proxy Address 10.233.224.4, remote Proxy Address 1.1.1.1,  Crypto map (OUTSIDE-MAP)&#xA;Jun 18 2013 00:54:39: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:41: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:43: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:45: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:47: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:48: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:49: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:51: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:53: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:55: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:57: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:54:59: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:55:01: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:55:03: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:55:05: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:55:07: %ASA-3-713042: IKE Initiator unable to find policy: Intf INSIDE-TRANSIT, Src: 10.60.1.1, Dst: 10.250.1.1&#xA;Jun 18 2013 00:55:09: %ASA-5-713041: IP = 2.2.2.2, IKE Initiator: New Phase 1, Intf OUTSIDE, IKE Peer 2.2.2.2  local Proxy Address 10.233.224.4, remote Proxy Address 2.2.2.2,  Crypto map (OUTSIDE-MAP)&#xA;Jun 18 2013 00:55:09: %ASA-5-713119: Group = 2.2.2.2, IP = 2.2.2.2, PHASE 1 COMPLETED&#xA;Jun 18 2013 00:55:09: %ASA-5-713049: Group = 2.2.2.2, IP = 2.2.2.2, Security negotiation complete for LAN-to-LAN Group (2.2.2.2)  Initiator, Inbound SPI = 0xd21ad657, Outbound SPI = 0xd7d9c25a&#xA;Jun 18 2013 00:55:09: %ASA-5-713120: Group = 2.2.2.2, IP = 2.2.2.2, PHASE 2 COMPLETED (msgid=1949f878)&#xA;Jun 18 2013 00:55:09: %ASA-5-713041: Group = 2.2.2.2, IP = 2.2.2.2, IKE Initiator: New Phase 2, Intf INSIDE-TRANSIT, IKE Peer 2.2.2.2  local Proxy Address 10.60.0.0, remote Proxy Address 10.0.0.0,  Crypto map (OUTSIDE-MAP)&#xA;Jun 18 2013 00:55:09: %ASA-5-713049: Group = 2.2.2.2, IP = 2.2.2.2, Security negotiation complete for LAN-to-LAN Group (2.2.2.2)  Initiator, Inbound SPI = 0xd4218cd3, Outbound SPI = 0xf9a8108b&#xA;Jun 18 2013 00:55:09: %ASA-5-713120: Group = 2.2.2.2, IP = 2.2.2.2, PHASE 2 COMPLETED (msgid=c0a82858)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1717" LastEditorUserId="1717" LastEditDate="2013-06-18T09:21:43.913" LastActivityDate="2013-06-20T15:36:59.893" Title="Timeouts for ASA VPN peers" Tags="|vpn|ipsec|failover|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1925" PostTypeId="1" AcceptedAnswerId="1928" CreationDate="2013-06-17T17:07:39.380" Score="7" ViewCount="322" Body="&lt;p&gt;I am currently studying for my Computer Networks exam.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot wrap my head around the following.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the current Average Queue Length is in between a min_threshold and a max_threshold, the Random Early Detection algorithm marks every packet it receives with a probability (for dropping or Explicit Congestion Notification) .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand every packet is marked when the AQL is greater than max_threshold (i.e. p is 1), but I cannot undestand in the former case how is the calculated probability is used to decide whether a packet will be marked or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, if p_b is calculated to be 0.7 for a packet, does it mean that the packet will not be marked at all?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, here is the RED algorithm in pseudocode, as first proposed at &lt;a href=&quot;http://www.cs.princeton.edu/courses/archive/fall06/cos561/papers/red.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cs.princeton.edu/courses/archive/fall06/cos561/papers/red.pdf&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Initialization:&#xA;avg ← 0&#xA;count ← −1&#xA;&#xA;for each packet arrival calculate the new average queue size avg: &#xA;    if the queue is nonempty&#xA;        avg ← (1 − w_q)*avg + w_q*q     &#xA;    else&#xA;        m← f(time−q time) &#xA;        avg←(1−w )^m*avg￼q &#xA;&#xA;    if min_th ≤ avg &amp;lt; max_th&#xA;        increment count&#xA;&#xA;        calculate probability pa:&#xA;            pb ← maxp(avg − minth)/(maxth − minth) pa ←pb/(1−count·pb)&#xA;        with probability pa:&#xA;            mark the arriving packet count ← 0&#xA;&#xA;    else if maxth ≤ avg&#xA;        mark the arriving packet count ← 0&#xA;    else count ← −1&#xA;&#xA;when queue becomes empty&#xA;q_time ← time&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1718" LastEditorUserId="561" LastEditDate="2013-06-18T06:56:34.843" LastActivityDate="2013-06-18T06:56:34.843" Title="How is probabilistic marking performed with Random Early Detection?" Tags="|qos|congestion|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1926" PostTypeId="2" ParentId="1892" CreationDate="2013-06-17T17:15:11.720" Score="3" Body="&lt;p&gt;Simple answer... it's not possible to get at the keys directly.  They're stored in the nvram private-config which is not user accessible.  If the key was generated in the default fashion, then it wasn't set as exportable, and thus &lt;em&gt;cannot be retrieved&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@legioxi has already provided the &quot;long answer&quot; (make they keys exportable and export/import them)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One other option is the use of a &quot;secure usb token&quot; (&lt;code&gt;usbtoken#&lt;/code&gt;) for key storage. The token can be moved when replacing a router.  However, that token is still a single copy. So the more involved export method may be needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the plus side, the keys only need to be backed up once. (the whole point being the key never changes -- even when the hardware is replaced.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_c4.html#wp1048266&quot; rel=&quot;nofollow&quot;&gt;See also&lt;/a&gt;]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-17T17:15:11.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1927" PostTypeId="2" ParentId="1920" CreationDate="2013-06-17T17:26:15.650" Score="3" Body="&lt;p&gt;Worst case scenario, your HW has gone bad&lt;br&gt;&#xA;Best case scenario, it's cosmetic failure due to software defect, luckily you are in SRE which will be supported until 2015, so maybe upgrade it to latest rebuild.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two bugID which will cause this error in very benign way.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CSCsk03373, due to large packets, fixed in SXH&lt;/li&gt;&#xA;&lt;li&gt;CSCsw32280, due to CRC errors, fixed in SXH&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You should probably check 'show diag events', it should correlate with these messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GOLD gives us description for 'TestErrorCounterMonitor', which gives us some data on understanding the message&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ID -- Asic Identification&#xA;IN -- Asic Instance&#xA;PO -- Asic Port Number&#xA;RE -- Register Identification&#xA;RM -- Register Identification More&#xA;EG -- Error Group&#xA;DV -- Delta Value&#xA;CF -- Consecutive Failure&#xA;TF -- Total Failure&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't unfortunately have CEF256 cards, so I can't check which ASIC it was, but you should be able to do it with:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;remote command switch show platform hardware asic-versions | i 47&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IN will which of the ASIC it is, I'm guessing as there is at least 4 of them, it is 'pinnacle' ASIC, which is port-asic in CEF256, as I don't think CEF256 has 4 of any other ASIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is pinnacle, you should be able to use 'sh int capabilities module X' and 'sh int X capabilities' to determine which ports are sharing the 4th port ASIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However as the 'Asic Port Number' is 255, it seems to contradict it being 'pinnacle' as no physical port would have this number.&lt;br&gt;&#xA;There are some special ports in the card like EOBC, RBUS, DBUS and fabric. Unfortunately I don't know what 255 means, it might mean some of these special ports, it might be just place-holder value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If 'Total Failure' or TF correlates with interface CRC errors, it might be CSCsw32280, otoh CSCsw32280 should show sensible PO number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If everything else fails, buy smartnet for the card for a year. I'd be curious if you'd answer your own question when you solve this as to what was the root cause. And especially if you can find out what is port 255.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-17T17:26:15.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1928" PostTypeId="2" ParentId="1925" CreationDate="2013-06-17T17:50:32.997" Score="6" Body="&lt;p&gt;Think of RED as an arbitrary curve in a coordinate system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Y is probability of drop&#xA;X is how congested you are (for example how full egress buffers are)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Operator could add 5 points there&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;X=40%, Y=0%&lt;/li&gt;&#xA;&lt;li&gt;X=50%, Y=5%&lt;/li&gt;&#xA;&lt;li&gt;X=60%, Y=20%&lt;/li&gt;&#xA;&lt;li&gt;X=70%, Y=40%&lt;/li&gt;&#xA;&lt;li&gt;X=90%, Y=100%&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Then you'd draw lines to the points to form the curve, to get exact Y (drop probability) for every X (demand/congestion).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exact implementation how to produce random number to the percentage is not very interesting, it could be that you do random number from 1-100 and if Y==5, then for random numbers 1-5 you drop, for 6-100 you don't drop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WRED is exactly the same, there is just different curves for different QoS classes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may not be as academic answer as you'd hope, and I can't recommend very academic book for QoS either. QoS is very very implementation specific. TM (Traffic Manager) are single most complex pieces of modern router.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-17T17:50:32.997" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1929" PostTypeId="1" AcceptedAnswerId="2581" CreationDate="2013-06-17T20:56:03.240" Score="9" ViewCount="2158" Body="&lt;p&gt;I am trying to copy a show tech from an ASA to a remote server via FTP. &#xA;My issue is that the password I am providing has a '@' and it is being interpreted incorrectly by the CLI. I have tried putting a  '\@' but the command still fails. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any luck with this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;  show tech-support file ftp://username:password@xxx.xxx.xxx.xxx/ASA-SHOW-TECH&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This Does not work &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;  show tech-support file ftp://username:p@ssword@xxx.xxx.xxx.xxx/ASA-SHOW-TECH&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="1352" LastActivityDate="2017-08-04T07:19:12.647" Title="ASA FTP Special Character in password issue" Tags="|cisco|cisco-asa|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1930" PostTypeId="2" ParentId="1929" CreationDate="2013-06-17T21:26:11.177" Score="6" Body="&lt;p&gt;The problem here is that the device is interpreting the first &lt;code&gt;@&lt;/code&gt; as the delimiter between the credentials and the FTP server address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps configuring the username and password in global-configuration mode and then redirecting the &lt;code&gt;show tech&lt;/code&gt; without specifying the credentials would do the trick. Otherwise, and I know this is a wimpy solution, changing the password to not include that one character may be the easiest and perhaps most secure way of working around this issue.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-06-17T21:26:11.177" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1931" PostTypeId="1" AcceptedAnswerId="1934" CreationDate="2013-06-17T22:15:43.293" Score="4" ViewCount="3625" Body="&lt;p&gt;In a small office with 5-10 WAPs, do you create distinct SSIDs for each WAP, or do you name each one the same? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently I have been deploying multiple WAPs configured with the same SSID and password, and leaving it to the client computer to decide which WAP provides the best coverage, and have had good luck with this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I deploy multiple APs in the same office without a centralized WLC?&lt;/p&gt;&#xA;" OwnerUserId="1352" LastEditorUserId="775" LastEditDate="2013-06-17T22:32:56.423" LastActivityDate="2013-06-18T18:34:01.597" Title="How can I deploy multiple APs in the same office without a centralized WLC?" Tags="|wireless|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1932" PostTypeId="2" ParentId="1931" CreationDate="2013-06-17T22:23:46.340" Score="8" Body="&lt;p&gt;My company won't put up the money for WLCs. So we run all autonomous APs. Haven't had any issues. We use 1-10 APs per site, same SSIDs (4-6 per site, all APs run all the SSIDs for the site). Users haven't had any issues roaming between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure there are reasons for using a WLC (rogue AP detection, frequency selection, better mesh/roaming), but as long as things work for us, management won't give me the budget to implement them. The only bullet point I could use was managing so many APs globally used to be a pain but I resolved that with autobooting them off a TFTP config that I update. Single config for all APs.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-06-17T22:23:46.340" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1934" PostTypeId="2" ParentId="1931" CreationDate="2013-06-18T00:34:34.980" Score="5" Body="&lt;p&gt;You certainly can do without a controller.  A number of vendors either provide management software with the purchase of the AP or have products that are designed to run without one.  You can choose from Cisco, Aruba, Aerohive, Meraki (now Cisco), Ubiquiti and quite a few others (supposedly Meru has a solution soon to launch as well) for solutions that work without a controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for single SSID or multiple, that is really up to a design choice, but generally speaking you would want to only provide one for roaming if you do mobile computing.  Wireless clients have been getting better about making good choices when presented with multiple wireless access points, with some notable exceptions (Apple devices seem to still have some issues periodically).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If mobility isn't a concern and you are largely dealing with nomadic (i.e. they may move, but are used almost entirely in one position)or stationary clients, then you can balance your clients in several ways with unique SSIDs.  However managing the clients and educating users can be troublesome if you don't put some thought into it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Controllers largely help with the management, reporting and coordination (and sometimes troubleshooting) of the wireless network.  While they are nice to have, they are by no means essential for general wireless.  If you are looking to do something more complex or that requires a higher class of service (such as wireless-VoIP), then you should look into a controller based solution.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-06-18T00:34:34.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1936" PostTypeId="2" ParentId="1929" CreationDate="2013-06-18T11:02:01.957" Score="0" Body="&lt;p&gt;On IOS you can enter control-v to escape the next character. This lets you enter a question mark without pulling up help. Don't if that works on ASA but might be worth a try.&lt;/p&gt;&#xA;" OwnerUserId="165" LastActivityDate="2013-06-18T11:02:01.957" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1937" PostTypeId="5" CreationDate="2013-06-18T11:15:16.183" Score="0" Body="&lt;p&gt;GRE, defined in RFC1701 &amp;amp; RFC1702, allows the encapsulation of a network layer protocol, such as IPv6 inside another network layer protocol, such as IPv4. The encapsulated protocol is often carried unaware of the outer tunnel it transits in.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-06-18T13:24:18.693" LastActivityDate="2013-06-18T13:24:18.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1938" PostTypeId="4" CreationDate="2013-06-18T11:15:16.183" Score="0" Body="Generic Routing Encapsulation is a tunnelling protocol, used to carry network layer protocols through encapsulation inside others." OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-06-18T13:24:29.850" LastActivityDate="2013-06-18T13:24:29.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1943" PostTypeId="1" AcceptedAnswerId="1951" CreationDate="2013-06-18T14:29:42.413" Score="7" ViewCount="816" Body="&lt;p&gt;Is there a way to create a static LSP (i.e. manually specifying in and out labels/interfaces, without LDP or RSVP) on a recent Brocade device running Netiron ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I can find is an &lt;a href=&quot;http://www.foundrynet.com/services/documentation/srcli/current/MPLS-static-lsp_cmds.html&quot; rel=&quot;nofollow&quot;&gt;old Foundry static MPLS configuration doc&lt;/a&gt;; however, the &lt;code&gt;(config-mpls)# static-lsp&lt;/code&gt; command does not exist on my 5.4.0 Ironware. Did they remove the functionality?&lt;/p&gt;&#xA;" OwnerUserId="564" LastEditorUserId="775" LastEditDate="2013-06-18T17:43:51.737" LastActivityDate="2013-06-18T21:58:28.327" Title="Is there a way to create static LSP on a Brocade device?" Tags="|brocade|mpls|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1945" PostTypeId="2" ParentId="1943" CreationDate="2013-06-18T15:34:54.053" Score="-1" Body="&lt;p&gt;Try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;!&#xA;router mpls&#xA; lsp lsp_name&#xA;   ....&#xA;!&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="534" LastEditorUserId="530" LastEditDate="2013-06-18T16:07:42.730" LastActivityDate="2013-06-18T16:07:42.730" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1946" PostTypeId="1" AcceptedAnswerId="1947" CreationDate="2013-06-18T18:05:42.813" Score="4" ViewCount="5383" Body="&lt;p&gt;I have a SIP Server that does not put a &lt;a href=&quot;/tags/dscp&quot; title=&quot;Differentiated Services Code Point&quot;&gt;DSCP&lt;/a&gt; code on it's traffic.  This server is behind an ASA, and I want to prioritize its traffic passing through an ASA from the private to public network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using the ASA shape feature, and have it set to prioritize  &quot;EF AF31&quot; DSCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming I would use and ACL to match the traffic, but then would I use a class map / policy map to mark the traffic on the inside, before it passes &#xA;through the shaper?&lt;/p&gt;&#xA;" OwnerUserId="1352" LastEditorUserId="775" LastEditDate="2013-06-18T21:11:10.400" LastActivityDate="2013-06-18T23:32:01.103" Title="How do I tag traffic with a DSCP value on an ASA?" Tags="|cisco|qos|cisco-asa|voip|dscp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1947" PostTypeId="2" ParentId="1946" CreationDate="2013-06-18T18:06:52.317" Score="3" Body="&lt;p&gt;To my knowledge, the ASA platform is only able to classify based on existing DSCP markings, not apply or change them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does preserve existing markings, though.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-06-18T18:06:52.317" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1948" PostTypeId="2" ParentId="1931" CreationDate="2013-06-18T18:34:01.597" Score="3" Body="&lt;p&gt;In this case I'd suggest to use the same SSID - easier to provision, simplier for users.&#xA;Just pay attention to frequencies you configure. Ideally try to use non-overlapping. &#xA;You can try to use &lt;em&gt;vistumbler&lt;/em&gt; to check for wireless signals and channels best suitable for situation.&#xA;Most devices nowadays can handle roaming pretty well without need for controller.&#xA;But you can also take a look at &lt;em&gt;Cisco AP541n&lt;/em&gt; APs, which can form cluster up to 10 APs with single configuration and frequency management.  &lt;/p&gt;&#xA;" OwnerUserId="16" LastActivityDate="2013-06-18T18:34:01.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1949" PostTypeId="1" AcceptedAnswerId="1952" CreationDate="2013-06-18T18:45:16.807" Score="11" ViewCount="13373" Body="&lt;p&gt;In this scenario, we have a VPC '17', consisting of two single port port-channels 'po17'.  There are 2 x N5K's (5548s) - so po17 from both sides combine to create the VPC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The downstream devices are blade switches (Cisco 3020s).  We want to add a new VLAN to one side, then the other without loss of connectivity for the VMs behind the 3020s.  Downstream can handle this because if one side fails, the other side picks back up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know if one of the Port-Channels in the VPC goes down we still stay up, but since we're adding a new VLAN to one of the VPC member Port-Channel, the VPC will loose consistency and I didn't know if that would cause a problem.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2013-06-22T11:32:54.140" LastActivityDate="2013-06-22T11:32:54.140" Title="Can adding VLANs to a VPC be done hot?" Tags="|cisco|vpc|ieee-802.1ax|cisco-nexus-5k|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1950" PostTypeId="2" ParentId="748" CreationDate="2013-06-18T18:50:23.747" Score="3" Body="&lt;p&gt;IRF is nice technology. I have experience with them. &#xA;Yes, you can expand the stack pretty well. Go with a ring topology by adding new switches like you show in the second picture.&#xA;However you have to keep in mind several considerations:&#xA;stack is nice, but it can fell apart with, so in this case two IRFs with MAD (Multi Active Detection) will work better, but provide more overhead (you'll have to provision two stacks instead of one, may be you'll need to reconsider your failover scenario etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I work with IRFs for 3 years now and I have seen several split brain cases, but those all stacks were configured without MAD. In all cases networks were pretty dead :)&#xA;So MAD is really a must, when you configure stacks :)&lt;/p&gt;&#xA;" OwnerUserId="16" LastActivityDate="2013-06-18T18:50:23.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1951" PostTypeId="2" ParentId="1943" CreationDate="2013-06-18T18:54:47.377" Score="7" Body="&lt;p&gt;EDIT: Just checked the literature - doesn't look like static LSP's are supported on MLX/XMR/CES/CER IronWare at least as of 5.2.0. :-/ My Brocade account rep also confirmed that LSP's signaled with RSVP or LDP are the only options and they have no plans to add support back in for static LSP's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from the above, what you &lt;em&gt;can&lt;/em&gt; do with RSVP is define a manual ERO for the signaled LSP to traverse, with a combination of &lt;code&gt;strict&lt;/code&gt; or &lt;code&gt;loose&lt;/code&gt; attributes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;router mpls&#xA;path test-path-1&#xA;  strict 192.168.1.1&#xA;  strict 192.168.3.1&#xA;path test-path-2&#xA;  strict 192.168.1.1&#xA;  loose 10.2.1.1    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;strict&lt;/code&gt; means that traversal of that hop is mandatory. &lt;code&gt;loose&lt;/code&gt; means that you let CSPF/MPLS TED (populated by OSPF or ISIS) handle how to get to the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then when you create your LSP, you can tell it to use that specific path as primary/standby etc, ie:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lsp test-lsp&#xA;  to 10.0.0.1&#xA;  primary test-path-1&#xA;    adaptive&#xA;  secondary test-path-2&#xA;    standby&#xA;    adaptive&#xA;enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know this doesn't fit your requirement of not using a signaling protocol, but to be honest I'm not sure if any requirement of not using one really makes much sense. Maybe you could elaborate on why you don't want to use RSVP/LDP for signalling?&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-06-18T21:58:28.327" LastActivityDate="2013-06-18T21:58:28.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1952" PostTypeId="2" ParentId="1949" CreationDate="2013-06-18T19:17:46.540" Score="11" Body="&lt;p&gt;While it is certainly a good idea that a VPC has the same allowed VLAN list on all sides, it is not a requirement. Take a look at the output of &quot;show vpc consistency-parameters global&quot;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch# show vpc consistency-parameters global &#xA;Legend:&#xA;        Type 1 : vPC will be suspended in case of mismatch&#xA;Name                        Type  Local Value            Peer Value             &#xA;-------------               ----  ---------------------- -----------------------&#xA;QoS                         2     ([], [3], [], [], [],  ([], [3], [], [], [], &#xA;                                  [])                    [])                   &#xA;Network QoS (MTU)           2     (1538, 2240, 0, 0, 0,  (1538, 2240, 0, 0, 0, &#xA;                                  0)                     0)                    &#xA;Network Qos (Pause)         2     (T, F, F, F, F, F)     (T, F, F, F, F, F)    &#xA;Input Queuing (Bandwidth)   2     (50, 50, 0, 0, 0, 0)   (50, 50, 0, 0, 0, 0)  &#xA;Input Queuing (Absolute     2     (F, F, F, F, F, F)     (F, F, F, F, F, F)    &#xA;Priority)                                                                      &#xA;Output Queuing (Bandwidth)  2     (50, 50, 0, 0, 0, 0)   (50, 50, 0, 0, 0, 0)  &#xA;Output Queuing (Absolute    2     (F, F, F, F, F, F)     (F, F, F, F, F, F)    &#xA;Priority)                                                                      &#xA;STP Mode                    1     MST                    MST                   &#xA;STP Disabled                1     None                   None                  &#xA;STP MST Region Name         1     &quot;&quot;                     &quot;&quot;                    &#xA;STP MST Region Revision     1     0                      0                     &#xA;STP MST Region Instance to  1                                                  &#xA; VLAN Mapping                                                                  &#xA;STP Loopguard               1     Disabled               Disabled              &#xA;STP Bridge Assurance        1     Enabled                Enabled               &#xA;STP Port Type, Edge         1     Normal, Enabled,       Normal, Enabled,      &#xA;BPDUFilter, Edge BPDUGuard        Disabled               Disabled              &#xA;STP MST Simulate PVST       1     Enabled                Enabled               &#xA;Allowed VLANs               -     1,10,100-101,200-201   1,10,100-101,200-201,2&#xA;                                                         000                   &#xA;Local suspended VLANs       -     -                      -     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Type 1 parameters absolutely MUST match, else the vPC will be suspended. &quot;Allowed VLANs&quot; is neither a Type 1 or Type 2 parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to modify the allowed VLAN list without problems, but obviously try to keep things consistent regardless, otherwise you'll still have issues, even though the vPC doesn't get suspended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: You probably already know this but just to be sure - include the peer-link in your VLAN changes, as the VLAN (not the entire vPC) will show up as &quot;suspended&quot; on all vPCs until you do. &lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-06-18T19:17:46.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1953" PostTypeId="1" AcceptedAnswerId="1955" CreationDate="2013-06-18T20:30:26.993" Score="4" ViewCount="212" Body="&lt;p&gt;I'm in the process of building out a small datacenter ( about 10 racks ) and it feels like the fiber connections for storage and 10G ethernet are really piling up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any products they've been happy with for managing fiber rack to rack, or providing a central distribution point? I'm looking at a few products, but it'd be nice to hear some real world experiences.&lt;/p&gt;&#xA;" OwnerUserId="1735" LastEditorUserId="775" LastEditDate="2013-06-19T12:59:10.543" LastActivityDate="2013-06-19T12:59:10.543" Title="Small datacenter fiber management" Tags="|fiber|patch-panel|rack-layout|" AnswerCount="2" CommentCount="5" ClosedDate="2019-04-13T00:39:19.650" ContentLicense="CC BY-SA 3.0" />
  <row Id="1954" PostTypeId="2" ParentId="1953" CreationDate="2013-06-18T21:21:54.097" Score="6" Body="&lt;p&gt;Just two remarks which might be useful:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We started using MTP recently (&lt;a href=&quot;http://mtpfibersolutions.com/faqs-about-mtp-connectors/&quot; rel=&quot;noreferrer&quot;&gt;http://mtpfibersolutions.com/faqs-about-mtp-connectors/&lt;/a&gt; for example, we got it from a local reseller), main consideration was that we needed more fibers in ducts which were pretty full already. Thanks to the thin fiber bundles we were able to add more fibers within limited space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We always use main distribution points to avoid having to connect every rack with every other rack, which is usually costly (often only a few pairs of every bundle are used) and it easily becomes a mess due to the large number of bundles.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-06-18T21:21:54.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1955" PostTypeId="2" ParentId="1953" CreationDate="2013-06-18T23:17:01.253" Score="6" Body="&lt;p&gt;There are a number of companies that provide pre-terminated modular fiber solutions.  I have used the CommScope/Systimax &lt;a href=&quot;http://www.commscope.com/systimax/eng/product/cabling_solutions/preterm/1223767_18984.html&quot; rel=&quot;noreferrer&quot;&gt;InstaPatch&lt;/a&gt; products in these types of situations before and had good luck with them.  My personal preference is to pay a bit extra and go with a bigger or more established company when I am dealing with a data center.  In any event, make sure it is at least a respectable company that you feel will be around in 5-10 years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Distribution points are key but the actual design is entirely based on your need.  I personally like a distribution point in each row (middle or end is design choice - I prefer end, but middle means average run length is a bit shorter), which also houses all the fiber runs between rows and/or to the main distribution frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However with only 10 racks, you could easily go with just a single distribution point.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-06-18T23:17:01.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1956" PostTypeId="2" ParentId="1946" CreationDate="2013-06-18T23:32:01.103" Score="5" Body="&lt;p&gt;ASA's can preserve DSCP and match traffic based on the DSCP markings, but it does not have the ability to mark/change DSCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your best bet would be to place a switch (or other device) that can mark DSCP before the ASA to mark your traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I do want to note that if the &quot;public&quot; network on the ASA is to a service provider (as is often the case) that unless your contract specifies that they will honor QoS/DSCP, they will often mark all ingress packets from your network with their own default, negating your own DSCP markings (and the same can be true of their upstream providers or peers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you want them to be used for other than matching traffic on the ASA, you would need to check that your provider (and theirs) will honor them (as well as which values they will honor).  Usually this is the hardest part of dealing QoS on public networks.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-06-18T23:32:01.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1959" PostTypeId="1" AcceptedAnswerId="1961" CreationDate="2013-06-19T14:42:15.780" Score="7" ViewCount="332" Body="&lt;p&gt;So yes, I'm pretty new to networking and I hope this isn't a stupid question. I couldn't find an answer on google nor could I find something here (but I'm also sure about the terminology), so I thought I give it a shot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say there is a large local network that spans multiple buildings. I can connect to that network via WLAN or via cable and from multiple spots of course. Is there a way to tell on what spot I am currently located?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or in other words: Is there something that identifies a certain connection point (router, hotspot) and that I can access from a client computer to recognize that I've been here before?&lt;/p&gt;&#xA;" OwnerUserId="1743" LastEditorUserId="775" LastEditDate="2013-06-19T15:09:47.400" LastActivityDate="2013-06-19T17:25:06.697" Title="Is there a way to recognize the location where a client connects to the network?" Tags="|wireless|router|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1960" PostTypeId="2" ParentId="1959" CreationDate="2013-06-19T15:01:53.267" Score="6" Body="&lt;p&gt;The exact way to check depends a bit on the OS and/or drivers of the client, but for wifi you should be able to look up the BSSID (Broadcast Service Set Identifier) which is the MAC address of the access point. On OSX you can check this by alt-clicking on the wifi icon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check the forwarding tables of your switches and access points to find out which one originates the MAC address of your device if you want to check looking from the network perspective.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-06-19T15:01:53.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1961" PostTypeId="2" ParentId="1959" CreationDate="2013-06-19T15:04:15.387" Score="9" Body="&lt;p&gt;That's going to depend on how the network is designed/implemented and how exactly you are connected. Please note  that I'm not implying everything I'm suggesting would be &quot;polite&quot; or free of side effects. You seem to be asking about, basically, how to reverse engineer the network design and topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireless APs will identify themselves, so you can look at your wireless interface and note the name/BSSID, then build up a map of where you are physically and what APs you see. There are applications which will show you signal strength of multiple APs that are in range, so you can get a feel for what is nearby; Doing that from a a few different places lets you roughly work out what AP are where. And, you may be able to simply find the APs visually for more hints to the layout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For physical cabling (and this is all true for Wireless APs too,) you can note the IP network you find yourself within. You could also look at the default gateway you are given by DHCP. You can ping scan the IP network or even service sweep to note &quot;stationary&quot; things like printers, which you can then physically find, to provide you with more physical clues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More difficult is teasing out any virtualization that is designed in. On the wireless APs, you have their names so you can physically separate them; while your IP networking might be the same on every AP if you're on the same VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have administrative access to the physical networking gear, then it's just a matter of looking for your computer's MAC address in the networking gear.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-06-19T15:04:15.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1962" PostTypeId="1" AcceptedAnswerId="1965" CreationDate="2013-06-19T16:15:35.847" Score="9" ViewCount="5709" Body="&lt;p&gt;Studying for CCNP-ROUTE - everything I read says it's preferable to use delay and offset-lists for metric tuning vs. say bandwidth in EIGRP.  In practice what is more commonly used out of those two options (delay/Offset-lists)?  How common is low level metric tuning for EIGRP?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2013-06-19T16:23:37.143" LastActivityDate="2017-04-19T11:50:31.133" Title="Delay or Offset-List for EIGRP tuning?" Tags="|cisco|eigrp|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1963" PostTypeId="1" CreationDate="2013-06-19T16:46:04.710" Score="9" ViewCount="635" Body="&lt;p&gt;I have the following type of links at the edge of my ISP cloud:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                                                    +-----------------------+&#xA;                                                                    |    Customer 1         |&#xA;                                                                    |-----------------------|&#xA;  +-----------------------+                             +-----------&amp;gt;                       |&#xA;  |        XMR            |                             |           |                       |&#xA;  |-----------------------|                             |           +-----------------------+&#xA;  |                       |         +-------------------+--+&#xA;  |                       |         |      BT Cloud        |&#xA;  |                       |         |----------------------|&#xA;  |                       |         |                      |&#xA;  |                       +---------&amp;gt;                      |        +-----------------------+&#xA;  |                       |         |                      |        |    Customer 2         |&#xA;  +-----------------------+         +-------------------+--+        |-----------------------|&#xA;                                                        |           |                       |&#xA;                                                        +-----------&amp;gt;                       |&#xA;                                                                    +-----------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the left is a Brocade XMR. This is connected via a single gig link to many carriers, in this example BT. BT provide us with many point to point links over this single link at the A end. The B end then segregate and go to each geographically disperse site. On the A end, the XMR port, we specify which site the traffic goes to via a pre agreed upon vlan ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all works perfectly fine and we have many of these links to BT and a load of other carriers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue mainly is QoS outbound from the XMR. While there is a gig link between my XMR and the carriers, those inner circuits could be anything from 2Mb up to a gig. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume that Customer 1 has a 10Mb link. They want 25% of this link to be reserved for EF marked traffic. This is easy to do outbound on the CPE level as I can shape the interface to 10Mb and then give priority percent 25 to EF marked packets.&#xA;On the A end however, the XMR considers this entire link to be 1Gb. It doesn't know that vlan 2000 off to Customer site 1 is only 10Mb (BT is policing it to 10Mb within their own network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;H-QoS would be ideal as I could shape vlan 2000 to 10Mb, and then within that shaped value give 25% to EF. The issue is that H-QoS on the XMR is only supported on the 8X10Gb module. None of the carriers we use are giving native 10Gb yet straight to us (Just plenty of 1Gb links)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My plan is to stick another device between the XMR and the carrier that simply does H-QoS. I've been looking at the Cisco ME3600X which supposedly can do H-QoS based on the vlan ID. Does anyone have experience with this particular feature on the ME3600X or perhaps give me a better idea of doing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially I would like to have a config that looks sort of like this if it makes more sense:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map out-policy-parent&#xA;class vlan2000&#xA; shape average 10000000&#xA; service-policy out-policy&#xA;class vlan2001&#xA; shape average 20000000&#xA; service-policy out-policy&#xA;&#xA;policy-map out-policy&#xA; class EF&#xA; priority percent 25&#xA; class AF21&#xA; bandwidth percent 50&#xA;&#xA;interface gigabitethernet0/1&#xA;service-policy output out-policy-parent&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-06-19T17:26:16.107" LastActivityDate="2013-06-19T21:52:39.803" Title="Ethernet switch capable of H-QoS at the 802.1q level" Tags="|qos|brocade|h-qos|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="1964" PostTypeId="2" ParentId="1962" CreationDate="2013-06-19T17:01:06.253" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In practice what is more commonly used out of those two options (delay/Offset-lists)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Use whatever suits your requirements.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;delay&lt;/code&gt; is an interface-level command and gives you control over the delay on a specific interface&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;offset-list&lt;/code&gt; is a protocol-level command that could change metrics for the whole EIGRP process.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thus, if it's me and I want to change metrics for an individual link, I use an interface delay... it's easy to understand what is happening when you look at the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I want to affect all metrics for the whole EIGRP process, I would use a &lt;code&gt;offset-list&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the most part, it's personal preference how you do it... whatever you do, be consistent throughout the network.  In all probability, five years from now, you will be at another company and the &quot;next guy&quot; will have to understand what you do (maybe at 3am in the morning)... consistency is valuable.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How common is low level metric tuning for EIGRP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Depends on the company... I have seen it used for stuff like firewall bypass links (i.e. if they have to take the firewall out of service, they bypass the FW with a higher delay links &quot;just in case&quot;).  It's most commonly used for a dedicated backup path.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-06-19T17:01:06.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1965" PostTypeId="2" ParentId="1962" CreationDate="2013-06-19T17:03:26.583" Score="7" Body="&lt;p&gt;Any metric manipulation I've ever seen has been via offset-lists.  This allows very fine-grained control over the metric, and removes the need to calculate metric differences based on different interface delays.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that offset-lists have the added benefit of being applied (optionally) per-interface.  So you can essentially do everything that a delay change does with an offset-list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the 'wild', the only thing my org uses offset-lists for is to force traffic to take a particular backup WAN link when the primary is having issues that don't actually take it down.  That is -- I've seen very little EIGRP metric manipulation in production networks.  I'm sure someone else will almost immediately disagree. =)&lt;/p&gt;&#xA;" OwnerUserId="155" LastEditorUserId="155" LastEditDate="2013-06-19T17:14:44.453" LastActivityDate="2013-06-19T17:14:44.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1967" PostTypeId="2" ParentId="1959" CreationDate="2013-06-19T17:25:06.697" Score="8" Body="&lt;p&gt;For the wired connections, if there is a discovery protocol running, then you can typically find out to which switch you are connected, which port in the switch, which VLAN, and other information.  Don't be surprised if this isn't running on a port to which you connect, as it is generally a best practice to have this turned off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are multiple discovery protocols, standards based or proprietary, but it is most common to find one of two.  The first is CDP or Cisco Discovery Protocol, which as the name implies is something run by Cisco devices.  The second is LLDP or Link Layer Discovery Protocol, which is a IEEE standard for exchanging this information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use tcpdump in any *nix based OS (you may need to install, but generally it already will be) to view this information with the following commands (substituting the appropriate interface).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For CDP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether[20:2] == 0x2000'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For LLDP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -nn -v -i eth0 -s 1500 -c 1 'ether proto 0x88cc'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also use Wireshark or any other packet capture tool if you prefer (display filters in Wireshark are just &quot;cdp&quot; or &quot;lldp&quot;).  Additionally, there are software packages that are written to listen for this information, but I am not familiar with them myself (I generally stick to captures).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-06-19T17:25:06.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1968" PostTypeId="5" CreationDate="2013-06-19T21:29:06.857" Score="0" Body="&lt;p&gt;VRRP specifies an election protocol that dynamically&#xA;assigns responsibility for a virtual router to one of the VRRP&#xA;routers on a LAN.  The VRRP router controlling the IPv4 or IPv6&#xA;address(es) associated with a virtual router is called the Master,&#xA;and it forwards packets sent to these IPv4 or IPv6 addresses.  VRRP&#xA;Master routers are configured with virtual IPv4 or IPv6 addresses,&#xA;and VRRP Backup routers infer the address family of the virtual&#xA;addresses being carried based on the transport protocol.  Within a&#xA;VRRP router, the virtual routers in each of the IPv4 and IPv6 address&#xA;families are a domain unto themselves and do not overlap.  The&#xA;election process provides dynamic failover in the forwarding&#xA;responsibility should the Master become unavailable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VRRP provides a function similar to the proprietary protocols &quot;Hot&#xA;Standby Router Protocol (HSRP)&quot; and &quot;IP Standby Protocol&quot;.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T22:39:13.053" LastActivityDate="2016-11-29T22:39:13.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1969" PostTypeId="4" CreationDate="2013-06-19T21:29:06.857" Score="0" Body="For questions about Virtual Router Redundancy Protocol (VRRP), a standards based First Hop Redundancy Protocol (FHRP) defined in RFC 2338." OwnerUserId="76" LastEditorUserId="8499" LastEditDate="2016-11-29T22:39:13.053" LastActivityDate="2016-11-29T22:39:13.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1970" PostTypeId="2" ParentId="1963" CreationDate="2013-06-19T21:52:39.803" Score="2" Body="&lt;p&gt;While I don't think it's as &quot;robust&quot; as H-QoS/giving percentages based on DSCP values and would probably require more configuration overhead, you could rate-limit outbound against L2 ACL's that reference a VLAN. Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map 10Mbps&#xA;  cir 9992688 cbs 32768 eir 0 ebs 1250 excess-priority 0&#xA;&#xA;!numbered access lists in the range of 400-599 are for L2 MAC access lists&#xA;access-list 400 permit any any 2000 etype any&#xA;!2000 will represent the VLAN ID&#xA;&#xA;interface ethernet 1/1&#xA;  qos pcp encode-policy off     ! preserve outer VLAN CoS if applicable&#xA;  rate-limit strict-acl         ! drop traffic that's denied by a rate-limiting ACL&#xA;  rate-limit output access-group 400 policy-map 10Mbps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the docs, you can bind multiple rate limiting policies to a single port, however once a matching ACL clause is found for a packet, the device doesn't evaluate subsequent clauses in the rate limiting ACL and subsequent rate limiting ACLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to setting EF, instead of doing that you may be able to commit to 25% of the 10Mbps and the rest can go to an EIR/EBS value.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-06-19T21:52:39.803" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1976" PostTypeId="1" AcceptedAnswerId="1986" CreationDate="2013-06-20T14:14:40.490" Score="61" ViewCount="100672" Body="&lt;p&gt;Why isn't it sensible to dedicate more than one TCP/IP port to http? Although admittedly naive, isn't it  intuitive to think that server performance could somehow be increased?&lt;/p&gt;&#xA;" OwnerUserId="562" LastEditorUserId="562" LastEditDate="2021-02-05T14:55:42.127" LastActivityDate="2021-02-05T14:55:42.127" Title="Why only port 80 for web services?" Tags="|tcp|" AnswerCount="10" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="1977" PostTypeId="2" ParentId="1976" CreationDate="2013-06-20T14:50:26.860" Score="9" Body="&lt;p&gt;Each TCP/IP connection has a sourceIP:sourcePort and a destinationIP:destinationPort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you initiate a connection, you would always use 80 as the destination port (which makes sense since the Server needs to only listen on port 80 for HTTP and not on several ports). The trick is that the sourcePort is dynamic for each connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;user1: 1.1.1.1:29999 to 2.2.2.2:80&lt;/p&gt;&#xA;&#xA;&lt;p&gt;user2: 1.1.1.2:45333 to 2.2.2.2:80&lt;/p&gt;&#xA;" OwnerUserId="1558" LastEditorUserId="775" LastEditDate="2013-06-20T17:16:38.260" LastActivityDate="2013-06-20T17:16:38.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1978" PostTypeId="1" AcceptedAnswerId="2002" CreationDate="2013-06-20T13:59:13.233" Score="5" ViewCount="760" Body="&lt;p&gt;My company's security policy with respect to wireless routers is to not use them at all -- everyone's wired in. Devices for personal use, such as laptops or cell phones, have to use their phone's data plan, and in special circumstances, employees can use a company-provided wireless hotspot. Unfortunately, many of the employees get bad reception in the office, but we still make them use their data plan when we could be connecting over WiFi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to do a risk assessment of an arrangement like this, where the secured devices are given access to the LAN, and the unsecured devices are given access only to the internet via an additional router, a wireless one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;{internet} &amp;lt;-&amp;gt; [router] &amp;lt;-&amp;gt; [secured devices]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;{internet} &amp;lt;-&amp;gt; [router] &amp;lt;-&amp;gt; [wireless router] &amp;lt;-&amp;gt; [unsecured devices]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thought is that since the unsecured devices will be on their own subnet, they wouldn't pose a significant threat to the secured devices. This subnet would be for personal use only, and I'm thinking the unsecured devices would not be able to access the secured devices outside their subnet. I'm mostly speculating though, since I haven't been able to find a lot of resources on the subject. &lt;a href=&quot;https://security.stackexchange.com/questions/18437&quot;&gt;This answer&lt;/a&gt; points to some BYOD resources, but not a separate personal-use-only network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm guessing a better option is to replace the &lt;code&gt;{internet} &amp;lt;-&amp;gt; [router]&lt;/code&gt; with &lt;code&gt;{internet} &amp;lt;-&amp;gt; [switch]&lt;/code&gt; to which both independent routers are connected. However, this option is a lot less feasible, so I really only want to make that kind of recommendation if the other option is too risky.&lt;/p&gt;&#xA;" OwnerUserId="1763" OwnerDisplayName="David Englund" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.953" LastActivityDate="2018-04-20T17:21:15.610" Title="How risky is a personal-use-only wireless subnet inside the corporate subnet?" Tags="|wireless|routing|security|ieee-802.11|firewall|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="1979" PostTypeId="2" ParentId="1976" CreationDate="2013-06-20T14:53:03.113" Score="9" Body="&lt;p&gt;If you used random ports, the user would have to add the correct port numbers each time they went to your site. i.e. www.example.com:80; www.example.com:81; www.example.com:82 etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would not increase performance to use more ports. The source ports for each connection an ephemeral ports and so different anyway&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-06-20T14:53:03.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1981" PostTypeId="2" ParentId="1978" CreationDate="2013-06-20T15:18:00.847" Score="3" Body="&lt;p&gt;it is almost impossible to write a good answer on this question as there are so many things that would need to be taken into consideration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short: If the security device which is securing internal users is configured properly and is blocking all unwanted communication (for example communication from from the Wifi network to the internal network) you should be ok when it comes to securing the internal devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would need to find answers for the following problems though:&#xA;- How to prevent wireless users from using up all bandwith on the internet access which could prevent internal users from working?&#xA;- How to identify wifi users? You don´t want an hotspot were a user could access illegal stuff anonymously. How do you log and track the connections from Wifi?&lt;/p&gt;&#xA;" OwnerUserId="1558" LastEditorUserId="775" LastEditDate="2013-06-21T09:16:35.247" LastActivityDate="2013-06-21T09:16:35.247" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="1982" PostTypeId="2" ParentId="1976" CreationDate="2013-06-20T15:24:01.320" Score="15" Body="&lt;p&gt;Port 80 &amp;amp; 443 are the &quot;default&quot; ports for HTTP/HTTPS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that you do not have to specify the port (&lt;a href=&quot;http://www.example.com:80&quot;&gt;http://www.example.com:80&lt;/a&gt;, &lt;a href=&quot;https://www.example.com:443&quot;&gt;https://www.example.com:443&lt;/a&gt;) when using a web browser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to have a webserver listening on any other ports, the users have to manually add the port to the URL, or it has to be encoded in any link to that particular port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, most Proxies and Firewalls will not let connections to those ports unless specifically configured to do so (Without configuration, Outgoing proxies won't be listening to non-default ports, hence will not forward the request to the webservers, while Firewalls would simply block non-TCP80/443 connections attempts)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of this limits what can be done at the TCP/IP level&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way of boosting performance would be by having a load balancing device/service listening to TCP80/443 which would then redirect the request to servers on different ports and/or ip (Local Balancing) or even different remote sites (Global Balancing).  But this is another topic altogether&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2013-06-20T15:24:01.320" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1983" PostTypeId="2" ParentId="1976" CreationDate="2013-06-20T15:24:16.040" Score="30" Body="&lt;p&gt;The server doesn't waste resources by handling connections in one or more ports. Server resources are allocated to handle connections, and the port number is just a way to connect a specific program to a specific connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: the HTTP server knows that he'll listen to connections that come in the port 80. And the server knows that anytime he receives some request on port 80, he'll handle it to the http server. After that, the http server will handle the communication and then will consume resources.&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-06-20T15:24:16.040" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1984" PostTypeId="2" ParentId="1924" CreationDate="2013-06-20T15:36:59.893" Score="5" Body="&lt;p&gt;The ASA does not have a mechanism to mark peers as up or down. When DPD detects a peer is no longer available, any SA with that peer is torn down. When &quot;interesting traffic&quot; requires a new SA, the ASA goes through its normal phase 1 process, which means starting with the first peer in your crypto map and if a connection cannot be established, trying the second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 30 seconds of delay is a timing issue while the ASA &quot;sorts things out&quot; so to speak. You have traffic triggering a new SA, while DPD is tearing down the existing SA to the same peer, which creates a bit of a race condition that eventually sorts out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If faster failover is desired, it usually entails maintaining both tunnels simultaneously and using GRE and dynamic routing to move traffic when a tunnel fails. However, that would require using routers instead of ASAs, since ASAs do not support GRE, and have some shortcomings with dynamic routing. &lt;/p&gt;&#xA;" OwnerUserId="460" LastActivityDate="2013-06-20T15:36:59.893" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1985" PostTypeId="2" ParentId="1976" CreationDate="2013-06-20T16:10:02.833" Score="3" Body="&lt;p&gt;As Remi mentioned, Port 80 &amp;amp; 443 are the &quot;default&quot; ports for HTTP/HTTPS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most networks and firewalls don't block traffic going through this ports. So using this ports is easier as most of the time you may not need to worry about firewalls blocking your service else you may have to go through reconfiguring firewall rules and getting approvals from compliance/security for same.&lt;/p&gt;&#xA;" OwnerUserId="1766" LastActivityDate="2013-06-20T16:10:02.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1986" PostTypeId="2" ParentId="1976" CreationDate="2013-06-20T16:41:51.903" Score="74" Body="&lt;p&gt;Port 80 is a &lt;em&gt;well-known&lt;/em&gt; port, which means it is well-known as the location you'll normally find HTTP servers. You can find it documented in the &lt;a href=&quot;http://www.rfc-editor.org/rfc/rfc2616.txt&quot;&gt;HTTP/1.1 RFC&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having a default is useful precisely because you don't have to type it into your web browser with the URI.&#xA;If you run an HTTP server (or in fact any service) on a non-standard port, you force the client to remember which arbitrary 16-bit number you chose and type it in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to this unfriendliness, there is no performance benefit: a port is just one part of the &lt;code&gt;(dst ip:port, src ip:port)&lt;/code&gt; 4-tuple which uniquely identifies a TCP connection. If two connections share a &lt;code&gt;dst ip:port&lt;/code&gt;, that doesn't mean they share some system resource - they can reside in different threads, or different processes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you have logically different services which both &lt;em&gt;happen&lt;/em&gt; to use HTTP, there is no &lt;em&gt;problem&lt;/em&gt; with running them on different ports. It just makes the URI a little uglier.&lt;/p&gt;&#xA;" OwnerUserId="1767" LastActivityDate="2013-06-20T16:41:51.903" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1988" PostTypeId="1" AcceptedAnswerId="1990" CreationDate="2013-06-20T17:40:21.497" Score="3" ViewCount="3697" Body="&lt;p&gt;I was tasked to put up a network for a new department with about 7 users using wired and wireless connection.  Our Main network has DHCP and PROXY Server using Windows Server 2003.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my simple diagram setup for the new department:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Main network     --&amp;gt; switch          --&amp;gt; wireless access point&#xA;(dhcp/proxy svr)     (wired systems)     (wireless systems)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Access Point Configuration:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DHCP is Disabled  &lt;/li&gt;&#xA;&lt;li&gt;local IP: acquired from DHCP&lt;/li&gt;&#xA;&lt;li&gt;WPA security disabled  &lt;/li&gt;&#xA;&lt;li&gt;No other configuration applied to avoid complication.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Results:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;wired users can connect to the internet  &lt;/li&gt;&#xA;&lt;li&gt;wireless users cannot connect to the internet  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I compared the &lt;code&gt;ipconfig&lt;/code&gt; of both wired and wireless clients and they have the same configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are the wireless users unable to connect to internet?&lt;/p&gt;&#xA;" OwnerUserId="1635" LastEditorUserId="76" LastEditDate="2013-06-20T20:38:34.400" LastActivityDate="2017-11-16T06:21:54.727" Title="Wireless Access Point and Proxy Server Setup" Tags="|wireless|dhcp|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="1989" PostTypeId="2" ParentId="1988" CreationDate="2013-06-20T17:57:38.133" Score="0" Body="&lt;p&gt;Are the WLAN interface and the Wired interface of the AP on the same Layer 2 network/VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If no, you need some kind of DHCP forwarders&#xA;If yes, there is something that seems to block your client's DHCP Discover broadcasts or the DHCP Offer from the server, most probably on the AP itself.&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2013-06-20T17:57:38.133" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="1990" PostTypeId="2" ParentId="1988" CreationDate="2013-06-20T18:19:34.343" Score="3" Body="&lt;p&gt;Since you've clarified (comments above) that IP net/mask/gw are the same for wired/wireless clients, then your AP is bridging (as opposed to routing or NAT'ing the wireless clients.)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Verify the wireless systems are getting DNS servers via DHCP. If &quot;cannot access Internet&quot; means &quot;web sites do not load&quot;, this may be all that is wrong.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Verify your Internet edge router, (and/or firewall,) isn't blocking the traffic. You&#xA;might have everything configured correctly from the network and IP&#xA;point of view, and then not realize that the edge router has special&#xA;rules to only permit certain of your internal LAN IP addresses out.&#xA;(For example, your DHCP server could be configured to give specific&#xA;IPs to certain DHCP clients (the boss's desktop), while servicing&#xA;the rest of the clients (eg, printers) from a pool of numbers which aren't generally permitted out to the Internet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-06-20T18:19:34.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1991" PostTypeId="2" ParentId="1976" CreationDate="2013-06-20T18:43:15.227" Score="12" Body="&lt;p&gt;Adding extra ports does not add extra bandwidth or anything like that, a port is &lt;strong&gt;more of a label than a pipe&lt;/strong&gt;, it can &quot;grow&quot; as wide as you need it to without getting any slower due to the pipe being full. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a server receives too many requests, the server will of course slow down, however this is not the type of issue that can be fixed by adding another port number.&lt;/p&gt;&#xA;" OwnerUserId="640" LastEditorUserId="640" LastEditDate="2013-07-19T16:10:31.813" LastActivityDate="2013-07-19T16:10:31.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1993" PostTypeId="1" AcceptedAnswerId="1994" CreationDate="2013-06-20T19:03:23.710" Score="19" ViewCount="74419" Body="&lt;p&gt;I'm not too clear on subnetting rules and experienced an error when I tried to assign 148.26.1.176/28 to an interface on my Cisco router. Can someone please explain why it was not allowing me to assign this address to the interface? I receive an error saying:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bad mask /28 for address 148.26.1.176&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it outside the permissible range?&lt;/p&gt;&#xA;" OwnerUserId="1453" LastEditorUserId="76" LastEditDate="2013-06-20T19:26:41.613" LastActivityDate="2018-07-10T20:51:57.523" Title="Bad Mask for IP Address Error" Tags="|cisco|router|ipv4|subnet|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1994" PostTypeId="2" ParentId="1993" CreationDate="2013-06-20T19:09:42.130" Score="30" Body="&lt;p&gt;If you are using /28 network mask then 148.26.1.176 is the network address and therefore is not an assignable IP address for this subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For subnet 148.26.1.176/28 the range of assignable IP address is 148.26.1.177 to 148.26.1.190, as 148.26.1.176 is the network address and 148.26.1.191 is the broadcast address&lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2013-06-20T19:09:42.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1996" PostTypeId="2" ParentId="1976" CreationDate="2013-06-20T21:23:34.067" Score="28" Body="&lt;p&gt;You seem to think of ports as something real; its just a 16-bit unsigned number (0-65535) that's a label in the header of an IP packet.  This helps with application-level multiplexing.  When an incoming packet arrives at a network card, the OS gets a notification.  It checks what port the incoming packet was directed to, and then forwards the packet to only the right application.  If you are running your webserver (nginx) to listen on port 80, only nginx gets packets sent to port 80.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a client (IP: 100.200.100.200) makes an HTTP request to server (55.55.55.55), they make that request to destination port 80 on the server (55.55.55.55:80), but the source port is randomly chosen by the OS for the web browser (something like 45490).  The HTTP response from the web server then comes from (55.55.55.55:80), but sent to the destination (your IP) (100.200.100.200:45490).  Your computer's OS knows that incoming packets on port 45490 (from 55.55.55.55:80) need to be given to the web browser that made the request.  As each unique connection to a web site from the client gets a unique random port, so you can have multiple web browsers connecting to the same web site and when a page is reloaded in one browser the other windows aren't affected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each IP packet has both the source and destination IP addresses and port available to it in the header.  The OS and application (web browser or web server) can use both to figure out the appropriate action on how to process the packet.&lt;/p&gt;&#xA;" OwnerUserId="1784" LastEditorUserId="1784" LastEditDate="2013-06-22T05:05:36.690" LastActivityDate="2013-06-22T05:05:36.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="1997" PostTypeId="2" ParentId="1038" CreationDate="2013-06-21T01:11:58.877" Score="1" Body="&lt;p&gt;You can probably pick up a used Fortigate-60 on ebay for less than $50 ...I just saw some there.&#xA;Stick that in the remote office and create an IPSEC tunnel back to the central office. That's what I do. You don't need any subscriptions on it. &lt;/p&gt;&#xA;" OwnerUserId="1772" LastActivityDate="2013-06-21T01:11:58.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="1999" PostTypeId="2" ParentId="1978" CreationDate="2013-06-21T02:58:39.327" Score="6" Body="&lt;p&gt;The simple answer is yes, you &lt;em&gt;can&lt;/em&gt; do this and keep the secure network entirely protected from the unsecured network.  However, the devil is in the details and there are a number of details missing to provide any real answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, you mention a router and a wireless router, but not the types or the capabilities.  If you are talking about consumer class devices, then no you probably can't do what you want.  To the router, the wireless router and the clients behind it will all appear as one more client on the secure network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are talking about enterprise class equipment, then this would be relatively easy.  This would allow the use of VLANs, ACLs and/or routing as tools to create the separation you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SOHO class devices can fall into either of the two above solutions.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-06-21T02:58:39.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2000" PostTypeId="1" AcceptedAnswerId="2004" CreationDate="2013-06-21T07:16:09.600" Score="6" ViewCount="4044" Body="&lt;p&gt;I'm running a Ironport WSA in transparent mode.&lt;br&gt;&#xA;In advanced proxy config - DNS Options I find the following:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Find web server by:&#xA;Specify how the appliance should find the location of the requested web server.&#xA;0 = use DNS answers in order&#xA;1 = use client supplied address then DNS&#xA;2 = use ONLY client supplied address&#xA;3 = use client supplied address for next hop connection and Web Reputation (Warning: Destination IP based policies will still use DNS).&#xA;Default Value: 1  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain why it makes sense to use 1 as the default?&lt;br&gt;&#xA;With 1. a user can edit his hostfile and point www.google.com to 123.45.67.89. The request goes to the proxy, which does a dns lookup for www.google.com, but will still forward the request to 123.45.67.89.&lt;br&gt;&#xA;Why is the proxy doing a dns lookup, if it doesn't use the answer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone see a good reason not to use 0?&lt;br&gt;&#xA;It makes sense to me, since the proxy does a DNS request anyway, and this will make the proxy logs more trustworthy.&lt;/p&gt;&#xA;" OwnerUserId="282" LastEditorUserId="775" LastEditDate="2013-06-21T09:05:10.683" LastActivityDate="2013-06-21T10:27:25.467" Title="DNS options Ironport Web security appliance" Tags="|cisco|security|dns|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2002" PostTypeId="2" ParentId="1978" CreationDate="2013-06-21T09:35:56.330" Score="13" Body="&lt;p&gt;Merely putting personal-use internet on a different subnet is normally not sufficient unless that subnet is firewalled from the rest of the company; there are all kinds of internet vulnerabilities that hijack a users' PC and pose a threat to your company unless you are smart about protecting yourself.  This is one example of a &lt;a href=&quot;http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-1949&quot; rel=&quot;nofollow noreferrer&quot;&gt;innocent-looking Wordpress compromise (CVE-2013-1949) that would be a threat to an unprotected internal network&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personal-use Internet for BYOD is not a security risk if done correctly...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;All personal-use wifi access should be performed with &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1X&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.1x&lt;/a&gt; (usually &lt;a href=&quot;http://www.youtube.com/watch?v=pPfwemHBblk&quot; rel=&quot;nofollow noreferrer&quot;&gt;PEAP&lt;/a&gt;) so you can revoke wifi access credentials on a per-user basis.  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Avoid shared credentials like WEP or WPA PSK&lt;/em&gt; (i.e. you're not giving internet access to the general public, so there is no need to use well-known wifi credentials)&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/wireless/adaptive-wireless-ips-software/data_sheet_c78-501388.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Wireless Intrusion Prevention System&quot;&gt;wIPS&lt;/a&gt; to keep an eye out for rogue APs which spoof your SSID because PEAP clients are vulnerable to &lt;a href=&quot;https://depthsecurity.com/blog/when-802-1x-peap-eap-ttls-is-worse-than-no-wireless-security&quot; rel=&quot;nofollow noreferrer&quot;&gt;AP impersonation attacks&lt;/a&gt; under some circumstances&lt;/li&gt;&#xA;&lt;li&gt;Disable client to client traffic (Cisco calls it &quot;peer to peer traffic&quot;) to avoid problems with clients attacking other clients over your wifi (&lt;a href=&quot;https://en.wikipedia.org/wiki/ARP_spoofing&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARP spoofing attacks&lt;/a&gt; are just one example)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Your company is still &lt;em&gt;responsible for the behavior of these users&lt;/em&gt; if they abuse your internet connection&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Build a good security policy for acceptable-use of the personal-use internet connection; require users to sign and accept the policy before connecting (your corporate HR / legal departments may want to be involved here as well).&lt;/li&gt;&#xA;&lt;li&gt;Proxy and log all internet access from this subnet&lt;/li&gt;&#xA;&lt;li&gt;Use an IDS / IPS if-possible for the personal-use Internet DMZ&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;If the personal-use wifi AP is in autonomous mode, some possible network design options to isolate personal-use internet traffic from your corporate network:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The vlan for the wifi AP could be in an internet-only VRF&lt;/li&gt;&#xA;&lt;li&gt;The vlan for the wifi AP could be directly attached to your internet FW (in a DMZ)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;If the personal-use wifi AP is managed from a Wireless LAN Controller, some possible network design options to isolate personal-use internet traffic from your corporate network:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The WLC could direct all personal-use internet traffic to an internet-only VRF&lt;/li&gt;&#xA;&lt;li&gt;The WLC could have a VLAN that is attached to your internet FW (in a DMZ)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2018-04-20T17:21:15.610" LastActivityDate="2018-04-20T17:21:15.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2004" PostTypeId="2" ParentId="2000" CreationDate="2013-06-21T10:27:25.467" Score="1" Body="&lt;p&gt;This could first of all be necessary if for some reason, the client has access to more or different name resolution data than the proxy. You gave one simple example yourself: an entry in the client's host file that is not present on the proxy. Or the client could be talking to a different DNS server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could also be an efficiency thing, since with option 0 all DNS requests will be performed twice, once by the client and then again by the proxy. In option 1, the proxy will only perform a DNS lookup as a fallback if the client supplied address doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that when a domain uses round robin DNS, the client and proxy might get a different answer to their queries. This would result in a connection to a different server, not the one the client expected to be connected to. This could cause issues with protocols which somehow depend on being connected to the instance returned by DNS. Such a protocol would work with option 1, but not always with option 0.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-06-21T10:27:25.467" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2007" PostTypeId="1" AcceptedAnswerId="2008" CreationDate="2013-06-21T14:50:54.033" Score="9" ViewCount="1873" Body="&lt;p&gt;I suspect some issues with faulty QoS settings on a 3750 stack running in a 24x7 environment. The 3750 mainly routes between vlans on a lan segment. Since it is a lan device (not terminating any wan links) i want to globally disable QoS (&lt;code&gt;no mls qos&lt;/code&gt;), I prefer to run QoS only on wan links. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be doing this on a off-peak moment but want to find out what impact on the trunks and access links this will cause? Will it cause a disruption? And does it clear any custom QoS settings or does these remain but ignored? Cant seem to find a conclusive answer..  &lt;/p&gt;&#xA;" OwnerUserId="209" LastEditorUserId="775" LastEditDate="2013-06-21T15:04:49.563" LastActivityDate="2013-06-21T20:20:54.703" Title="Globally disable QoS on Cisco 3750 in production" Tags="|cisco|qos|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2008" PostTypeId="2" ParentId="2007" CreationDate="2013-06-21T14:52:08.697" Score="8" Body="&lt;p&gt;It will cause zero disruption. I've done it in the middle of the day before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any policies will remain, but ignored&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-06-21T14:52:08.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2009" PostTypeId="1" CreationDate="2013-06-21T15:59:14.330" Score="11" ViewCount="1929" Body="&lt;p&gt;I'm having difficulty wrapping my head around how to set this up and the MPLS vendor is being no help so I figured I would ask here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a 2 node MPLS each site having internet access on the same circuit the MPLS rides in on.  These circuits replace dedicated internet access at each site with an IPSEC tunnel between the sites.  We want to leave our existing firewalls in place as they provide content filtering and VPN services. I am trying to configure a layer 3 switch (a cisco SG300-10P) at each site to set up this scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant info (ip addresses changed to protect my idiocy)&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Site A&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Local Lan: 172.18.0.0/16&lt;/li&gt;&#xA;&lt;li&gt;Existing Firewall (internal): 172.18.0.254&lt;/li&gt;&#xA;&lt;li&gt;MPLS Gateway to Site B: 172.18.0.1&lt;/li&gt;&#xA;&lt;li&gt;Internet IP Range 192.77.1.144/28&lt;/li&gt;&#xA;&lt;li&gt;Carrier Gateway to internet 192.77.1.145&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Items 3 and 5 are on a single peice of copper coming from an adtran netvana (Carrier equip I have no access)&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Site B&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Local Lan: 192.168.2.0/23&lt;/li&gt;&#xA;&lt;li&gt;Existing Firewall (internal): 192.168.2.1&lt;/li&gt;&#xA;&lt;li&gt;MPLS Gateway to Site A: 192.168.2.2&lt;/li&gt;&#xA;&lt;li&gt;Internet IP Range 216.60.1.16/28&lt;/li&gt;&#xA;&lt;li&gt;Carrier Gateway to internet 216.60.1.16&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Items 3 and 5 are on a single peice of copper coming from an adtran 908e (Carrier equip I have no access)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So given the above what I want to do at each site is set up these cisco switches so that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port 1 = Carrier Connection&#xA;Port 2 = Interal Lan&#xA;Port 3 = Firewall&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where the local lan is not exposed to the Internet IP range (ie if some yahoo sets their machine up on a provided internet ip with the carriers gateway it doesn't work)  Or put differently from port 1 all traffic in the internet subnet can only exit on port 3 and from port 1 all traffic on the local lan subnet can only exit port 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every attempt I have made so far results in no access between the ports at all or basic dumb swith behavior (any host on any port can get across all of the IP ranges).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First question here so please be kind. :)  If you need more information I would be happy to provide it.&lt;/p&gt;&#xA;" OwnerUserId="1816" LastActivityDate="2013-06-22T06:14:54.067" Title="Handling VLAN based MPLS circuits with site specific internet access" Tags="|vlan|mpls|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2010" PostTypeId="2" ParentId="1976" CreationDate="2013-06-21T16:54:56.933" Score="4" Body="&lt;p&gt;Don't mistake a different port for a different physical connection or a higher network bandwidth or server processing performance. What the server gets are TCP or UDP packets, which happen to have a port number as part of the address. They still come over the same wires, go through the same network interface hardware and driver, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were to send two packets to a server, in terms of resources the server expends to process these two packets it doesn't matter if one of the two have different port numbers or the same port numbers associated with them, the internal handling will be close to identical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, this is not a method to increase performance in any way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only possible exception to this is if you were to associate two different demons (or two copies of the same) running at the same time to the two different port numbers, and if each of these demons would scale up extremely badly with load. Which is typically not the case.&lt;/p&gt;&#xA;" OwnerUserId="1819" LastActivityDate="2013-06-21T16:54:56.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2012" PostTypeId="1" CreationDate="2013-06-21T19:56:44.860" Score="55" ViewCount="370271" Body="&lt;p&gt;Looking in Wireshark, I often see TCP Streams end with a RST, ACK packet instead of a RST packet. Anyone know why this is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of what I see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SYN&#xA;SYN, ACK&#xA;...data...&#xA;RST, ACK&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark is not picking up a RST packet prior to the RST, ACK packet.&lt;/p&gt;&#xA;" OwnerUserId="1821" LastActivityDate="2018-09-10T00:07:06.097" Title="Why do I see a RST, ACK packet instead of a RST packet?" Tags="|wireshark|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2017" PostTypeId="2" ParentId="2012" CreationDate="2013-06-21T21:44:32.283" Score="68" Body="&lt;p&gt;A RST/ACK is not an acknowledgement of a RST, same as a SYN/ACK is not exactly an acknowledgment of a SYN. TCP establishment actually is a four-way process: Initiating host sends a SYN to the receiving host, which sends an ACK for that SYN. Receiving host sends a SYN to the initiating host, which sends an ACK back. This establishes stateful communication.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SYN --&amp;gt; &#xA;    &amp;lt;-- ACK&#xA;    &amp;lt;-- SYN&#xA;ACK --&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To make this more efficient, the receiving host can ACK the SYN, and send its own SYN in the same packet, creating the three-way process we are used to seeing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SYN --&amp;gt;&#xA;    &amp;lt;-- SYN/ACK&#xA;ACK --&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the case of a RST/ACK, The device is acknowledging whatever data was sent in the previous packet(s) in the sequence with an ACK and then notifying the sender that the connection has closed with the RST. The device is simply combining the two packets into one, just like a SYN/ACK. A RST/ACK is usually not a normal response in closing a TCP session, but it's not necessarily indicative of a problem either.&lt;/p&gt;&#xA;" OwnerUserId="460" LastActivityDate="2013-06-21T21:44:32.283" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2018" PostTypeId="2" ParentId="2009" CreationDate="2013-06-22T00:30:37.447" Score="2" Body="&lt;p&gt;Depending on how the service is delivered by the SP will dictate how you can separate the services on your end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typical methods are either a port per service or a VLAN tag per service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the SP is tagging the traffic you can just set up your switch to trunk to the SP and then separate the traffic into two access ports (one to FW and one to LAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's a port per service then just create two VLANs with the services in different VLANs for isolation.&lt;/p&gt;&#xA;" OwnerUserId="287" LastActivityDate="2013-06-22T00:30:37.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2019" PostTypeId="2" ParentId="2009" CreationDate="2013-06-22T06:14:54.067" Score="2" Body="&lt;p&gt;Assuming the Adtran is not using VLAN, I would establish a transport network between the Adtran Router and the Firewall (maybe using the one that is already existing on the Adtran interface).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having done that, you only need to add routes on the Firewall to cover all your communication needs (default gateway pointing to the Adtran).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Afterwards you can connect everything else behind your firwall so that it is protecting your networks.&lt;/p&gt;&#xA;" OwnerUserId="1558" LastActivityDate="2013-06-22T06:14:54.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2020" PostTypeId="1" CreationDate="2013-06-22T06:17:21.657" Score="5" ViewCount="1821" Body="&lt;p&gt;We have 3 sites over an MPLS. Each site has 2 x Cisco 2911's running HSRP. Each site has a tunnel interface from it's local site to the remote site over the MPLS. The tunnel interfaces are mirrored on each of the 2911 pairs where source IP is the local virtual IP and destination IP is the remote virtual IP. We are running OSPF across the network and all seems to be fine; the primary router has the tunnel interface up, the secondary router has the tunnel interface down (not admin down) and hence, neighbor relationships are correctly established. One of the sites has a 2911 and a 3725 in HSRP. From this site, we are having difficulty with OSPF whereby the neighbor site will build a relationship with the primary router, then go down, then build a relationship with the secondary router, then go down and etc; as a result, our logs are filled with neighbour adjacency alerts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should point out that the 3725 has FE ports and the 2911 has Gib ports; i've tried manually setting the tunnel interfaces with priorities but am still unable to make this work. I'm beginning to think we will need another 2911?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are looking to have the capability whereby if the primary router goes down, the standby router kicks into gear, OSPF routes learned and business as usual.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="1001" LastEditorUserId="775" LastEditDate="2013-06-22T11:25:59.487" LastActivityDate="2013-06-23T13:55:39.303" Title="HSRP + OSPF over tunnel interface" Tags="|cisco|ospf|redundancy|tunnel|hsrp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2021" PostTypeId="2" ParentId="2020" CreationDate="2013-06-22T11:28:16.467" Score="10" Body="&lt;p&gt;I would HIGHLY recommend getting rid of HSRP and using routing over the tunnels (both up all the time), whether OSPF or EIGRP. Set an inferior metric on one of the tunnels at both ends. Problem solved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HSRP is BAD NEWS over WAN. I am struggling to see what use the HSRP is. As you're now seeing it also causes a lot of issues when overlaid on top of routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a reason they're called First Hop Redundancy Protocols in the textbook, their place is to provide redundancy for LAN client's default gateways i.e. the first hop. &lt;/p&gt;&#xA;" OwnerUserId="203" LastActivityDate="2013-06-22T11:28:16.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2022" PostTypeId="2" ParentId="1978" CreationDate="2013-06-22T11:35:02.127" Score="0" Body="&lt;p&gt;It depends. I would view the issue in two aspects.&#xA;- risk of wireless being compromised&#xA;- what access the wireless network has if it is compromised or a compromised host runs on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The former aspect has already been talked about extensively, so I haven't a lot to add, other than if it is a guest network then a lot of the more secure options e.g. dot1x is out of the question. If you are paranoid you could use a guest controller that offers one time passwords e.g. via a ticket printer (hotels etc. use these). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The latter aspect is relatively straightforwards from a design POV: just make sure whatever VLAN or network segment it goes on has no access to your corporate network whatsoever. All of below would work, in decreasing order of security&#xA;- Completely separate network including physically separate equipment/internet links&#xA;- Virtually separate network via VRF that only has internet egress (combine with firewall or not)&#xA;- Firewalled or ACLed VLAN that only has permission to egress to internet (but runs in same VRF or routing context as normal) - this is the easiest solution and is probably good enough unless you are military/banking etc.&lt;/p&gt;&#xA;" OwnerUserId="203" LastActivityDate="2013-06-22T11:35:02.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2024" PostTypeId="1" AcceptedAnswerId="2026" CreationDate="2013-06-22T21:50:43.333" Score="16" ViewCount="93414" Body="&lt;p&gt;I am new to network Engineering. I find it is hard to distinguish and understand different switchport settings. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why can I have a switchport set to access, auto, or dynamic?  What are they used for? Are those functions only used for a host to switch connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is &quot;switchport nonnegotiate&quot; used for?&lt;/p&gt;&#xA;" OwnerUserId="1268" LastEditorUserId="59" LastEditDate="2013-06-24T07:50:32.973" LastActivityDate="2016-04-15T09:21:09.950" Title="About the switchport mode" Tags="|cisco|switching-modes|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2025" PostTypeId="2" ParentId="2024" CreationDate="2013-06-22T23:03:22.637" Score="7" Body="&lt;ul&gt;&#xA;&lt;li&gt;Access - Basically is for end devices, and hard set. If you put a trunk on this, it wouldn't work.&lt;/li&gt;&#xA;&lt;li&gt;dynamic - Makes the interface actively attempt to convert the link to a trunking link. The interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or auto mode.&lt;/li&gt;&#xA;&lt;li&gt;auto - same as dynamic, but doesn't actively attempt to convert to a trunk.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The switchport nonegotiate command is used to stop the port from sending DTP messages&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastActivityDate="2013-06-22T23:03:22.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2026" PostTypeId="2" ParentId="2024" CreationDate="2013-06-22T23:04:45.300" Score="26" Body="&lt;p&gt;Welcome to the field of network engineering!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DTP stands for &lt;a href=&quot;https://en.wikipedia.org/wiki/Dynamic_Trunking_Protocol&quot;&gt;Dynamic Trunking Protocol&lt;/a&gt; and is crucial to the commands below. It is also Cisco proprietary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;switchport mode access&lt;/strong&gt; - Always forces that port to be an access port with no VLAN tagging allowed EXCEPT for the voice vlan. DTP is not used and a trunk will never be formed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;switchport nonegotiate&lt;/strong&gt; - turns off DTP and forces the interface into a trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;switchport mode dynamic desirable&lt;/strong&gt; - pro-active DTP negotiation will begin and if the other-side is set to &lt;strong&gt;&lt;em&gt;trunk&lt;/em&gt;&lt;/strong&gt;, &lt;strong&gt;&lt;em&gt;desirable&lt;/em&gt;&lt;/strong&gt;, or &lt;strong&gt;&lt;em&gt;auto&lt;/em&gt;&lt;/strong&gt;. The interface will become a trunk. Otherwise the port will become an access port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;switchport mode dynamic auto&lt;/strong&gt; - allows the port to negotiate DTP if the other side is set to &lt;strong&gt;&lt;em&gt;trunk&lt;/em&gt;&lt;/strong&gt; or &lt;strong&gt;&lt;em&gt;desirable&lt;/em&gt;&lt;/strong&gt;. Otherwise it will become an access port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;switchport mode trunk&lt;/strong&gt; - This interface will always be a trunk no matter what happens on the other side. It will also use DTP to negotiate a neighbouring interface that is set to &lt;strong&gt;&lt;em&gt;dynamic desirable&lt;/em&gt;&lt;/strong&gt; or &lt;strong&gt;&lt;em&gt;dynamic auto&lt;/em&gt;&lt;/strong&gt; into a trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the real world - I have never seen &lt;strong&gt;*dynamic auto&lt;/strong&gt;*or &lt;strong&gt;&lt;em&gt;dynamic desirable&lt;/em&gt;&lt;/strong&gt; as generally network engineers try and make layer 2 related items (such as switchport settings) stable and static. There are also security risks associated with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An access role port is usually used for an single host or device.&#xA;You must also specify which VLAN you would like it to be associated with, otherwise it will default to VLAN 1 in the Cisco world.&#xA;eg)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;interface gig0/1&lt;br&gt;&#xA;   switchport mode access&lt;br&gt;&#xA;   switchport access vlan 10&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also, if you have a VLAN for voip traffic. You can also set the voice vlan as required by adding&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;switchport voice vlan 20&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A trunk port is generally only used when you want to interconnect two switches together in order to pass multiple VLANs between the two switches.&#xA;In this example, the switches will use Dot1Q tagging and allow vlans 10, 20 &amp;amp; 30 to be passed between the two switches. Vlan 10 however, will be passed without tagging since it is set as the native vlan.&#xA;eg) &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Switch1# interface gig0/1&lt;br&gt;&#xA;     switchport encapsulation dot1q&lt;br&gt;&#xA;     switchport mode trunk&lt;br&gt;&#xA;     switchport trunk native vlan 10&lt;br&gt;&#xA;     switchport trunk allowed vlan 10,20,30  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Switch2# interface gig0/1&lt;br&gt;&#xA;     switchport encapsulation dot1q&lt;br&gt;&#xA;     switchport mode trunk&lt;br&gt;&#xA;     switchport trunk native vlan 10&lt;br&gt;&#xA;     switchport trunk allowed vlan 10,20,30  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Take a look at &lt;a href=&quot;http://ericleahy.com/index.php/implement-trunk-and-trunk-protocols/&quot;&gt;Implement trunk and trunk protocols&lt;/a&gt; for more examples and to learn more about ISL or dot1q tagging along with some more command and debug information.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-22T23:04:45.300" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2027" PostTypeId="1" CreationDate="2013-06-23T10:55:34.453" Score="8" ViewCount="3499" Body="&lt;p&gt;How practical is ICMP spoofing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;scenario 1:&#xA;in a NAT environment, how does NAT keep track of ICMP sessions (not technically sessions since it's not connection-oriented?)&#xA;For ECHO/ECHO response Windows use the same identifier (0x1) and sequence number with 256 increment for each packet. If two hosts are pinging the same outside server, how does NAT distinguish incoming ICMP packets? If the internal network does not filter source address, how difficult is it to forge an ECHO response?&#xA;use case: icmp ping used for monitoring, a load balancer may take incorrect/unnecessary actions upon receiving forged ICMP responses (destination unreachable, high latency etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;scenario 2:&#xA;Some IPS device, say the GFW, inspecting packets on the transit path. How practical is it to forge ICMP error messages kill a connection with stealth. Instead of sending TCP RST, it sends out destination port unreachable/packet too large (this might get interesting :)) with forged source ip (the legitimate IP on the other side or some hops further down the path). Keep tracking of the original IP header and first 64 bytes can be expensive but with the computing power available today, is it doable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically either from either inside or outside NAT, how likely is it for forged ICMP to cause damages/confusions? I am not talking about ICMP flood.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW can NAT handle anything IP protocols other than TCP/UDP? I am actually not exactly sure how it handles different ICMP types.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2013-06-23T11:06:05.937" LastActivityDate="2013-06-24T12:15:42.963" Title="Is ICMP spoofing practical?" Tags="|security|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2028" PostTypeId="2" ParentId="2024" CreationDate="2013-06-23T11:23:58.830" Score="3" Body="&lt;p&gt;Switchport puts a port into layer2 mode (ip routing disabled for the port). You cannot assign an IP address to a L2 port, only to the VLAN the L2 port belongs to. The options after switchport is used to set port operation mode for VLAN trunking.&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst2950/software/release/12.1_6_ea2c/command/reference/cli_cmds.html#wp1631612&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS command reference&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;no switchport&quot; enabled L3 features on the port, you can give it an IP address, perform ip routing etc, which is usually seen on a Layer 3 switch, aka a Router with (almost) all Ethernet ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I first came to network engineering, I kept forgetting to set &quot;no switchport&quot; and &quot;ip routing&quot; where I needed layer 3 features.&lt;/p&gt;&#xA;" OwnerUserId="34" LastActivityDate="2013-06-23T11:23:58.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2029" PostTypeId="2" ParentId="2012" CreationDate="2013-06-23T11:45:31.143" Score="1" Body="&lt;p&gt;Once the connection is established, all packets need to have ACK set and match the sequence number of the received packets for reliable transport/security. RST without ACK will not be accepted. When one side sends RST, the socket is closed immediately and the receiving side also closes the socket immediately after receiving valid RST. It does not need to be and can't be acknowledged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;after TCP handshake&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A ---&gt;B Syn=x,   Ack=y,    len=z, ACK Flag&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B ---&gt;A Syn=y,   Ack=x+z,  len=o, ACK Flag&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A ---&gt;B Syn=x+z, Ack=y+o,  len=p, ACK Flag&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B ---&gt;A Syn=y+o, ACK=x+z+p,len=q, RST, ACK Flag&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B closes the socket after it sends the last packet and A closes the socket after it receives it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(not considering TCP window here, or there might be more packets from one end before the acknoledgement)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ACK Flag, acknowledgement number and the procedure of acknowledgement are related but not the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ietf.org/rfc/rfc793.txt&quot; rel=&quot;nofollow&quot;&gt;Per RFC793&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;RFC793&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Acknowledgment Number:  32 bits&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;If the ACK control bit is set this field contains the value of the&#xA;next sequence number the sender of the segment is expecting to&#xA;receive.  Once a connection is established this is always sent.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reset Processing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In all states except SYN-SENT, all reset (RST) segments are validated&#xA;  by checking their SEQ-fields.  A reset is valid if its sequence number&#xA;  is in the window.  In the SYN-SENT state (a RST received in response&#xA;  to an initial SYN), the RST is acceptable if the ACK field&#xA;  acknowledges the SYN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The receiver of a RST first validates it, then changes state.  If the&#xA;  receiver was in the LISTEN state, it ignores it.  If the receiver was&#xA;  in SYN-RECEIVED state and had previously been in the LISTEN state,&#xA;  then the receiver returns to the LISTEN state, otherwise the receiver&#xA;  aborts the connection and goes to the CLOSED state.  If the receiver&#xA;  was in any other state, it aborts the connection and advises the user&#xA;  and goes to the CLOSED state.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2013-06-23T12:09:58.270" LastActivityDate="2013-06-23T12:09:58.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2030" PostTypeId="2" ParentId="2020" CreationDate="2013-06-23T13:55:39.303" Score="3" Body="&lt;p&gt;Are you sure you are not injecting the subnet with HSRP into OSPF (recursive routing). I use HSRP for SSLVPN and it works fine. that things work until you have an OSPF routing table is what suggests the recursive routing scenario to me. Another question is are you seeing in your logs HSRP primary moving around, which would suggest a problem at the head end.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-06-23T13:55:39.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2031" PostTypeId="1" AcceptedAnswerId="2032" CreationDate="2013-06-23T17:09:03.920" Score="9" ViewCount="1673" Body="&lt;p&gt;Best practice is to use a  manual /127 address for point to point addressing described here &lt;a href=&quot;http://www.faqs.org/rfcs/rfc2373.html&quot;&gt;RFC2373&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for EUI-64 ERFC 2373 dictates the conversion process, which has two steps. The first is to convert the 48-bit MAC address to a 64-bit value. To do this, we break the MAC address into its two 24-bit halves: the Organizationally Unique Identifier (OUI) and the NIC specific part. The 16-bit hex value 0xFFFE is then inserted between these two halves to form a 64-bit address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand perfectly where you would use the /127 manual address assignment , but I cant really see the benefits in using the EUI-64. unless i am totally missing the actual purpose of this address function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;can someone kindly shed some light on the EUI-64 use cases specifically in a ISP WAN topology if possible. or point me in the direction of some reading material please.&lt;/p&gt;&#xA;" OwnerUserId="1092" LastActivityDate="2013-06-25T06:04:09.623" Title="ipv6 addressing /127 vs eui-64" Tags="|ipv6|mac-address|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2032" PostTypeId="2" ParentId="2031" CreationDate="2013-06-23T17:28:24.980" Score="9" Body="&lt;p&gt;This is the subject of a large debate that's been going on for a while.&lt;/p&gt;&#xA;&lt;p&gt;When it comes down to it, using a /127 on a point-to-point link isn't really a terrible idea.&#xA;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6164&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6164&lt;/a&gt; illustrates that it actually may be a good idea to use a /127 - it identifies some of the big issues for moving to a /127 on a P2P link, and talks about the steps that have been taken to mitigate, if any. The fear of ping-pong attacks was mitigated in the most recent version of ICMP, and neighbor cache exhaustion attacks are actually eliminated on P2P links by using a /127 prefix.&lt;/p&gt;&#xA;&lt;p&gt;EUI-64 is generally preferable on user subnets, since SLAAC generally breaks if /64 subnets are not used. On P2P links where SLAAC is not used, it's not that big of a deal.&lt;/p&gt;&#xA;&lt;p&gt;In conclusion, I believe the general consensus is that using a /127 is not a big deal - in fact you may want to allocate a single /64 for all your P2P links. Your routing table may take a small hit since all of the P2P prefixes won't be easy to summarize, but it's unlikely to be a significant problem. Just keep the RFC I mentioned in mind, and make sure you follow the guidelines it provides.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-06-23T17:28:24.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2033" PostTypeId="2" ParentId="2031" CreationDate="2013-06-23T17:29:33.030" Score="6" Body="&lt;p&gt;Using a /127 is convenient when manually configuring point-to-point links. I usually reserve a /64 in my addressing plan (for clarity and consistency with other non-/127 networks) and then configure &lt;code&gt;xxxx:xxxx:xxxx:xxxx::a/127&lt;/code&gt; on one side and &lt;code&gt;xxx:xxxx:xxxx:xxxx::b/127&lt;/code&gt; on the other side of the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EUI-64 addresses are used a lot when auto-configuring interfaces. Link-local (fe80::/10 addresses) often use them, and if the system receives a router advertisement with prefix information it will take the /64 prefix as the first 64 bits of its address and the EUI-64 as the last 64 bits of the address, to form a full 128 bit IPv6 address. All without the need for manual configuration or a DHCP server.&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="632" LastEditDate="2013-06-25T06:04:09.623" LastActivityDate="2013-06-25T06:04:09.623" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2034" PostTypeId="2" ParentId="2027" CreationDate="2013-06-23T21:15:55.177" Score="7" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5508&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5508&lt;/a&gt; &amp;quot;NAT Behavioral Requirements for ICMP&amp;quot; says (section 3.1):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ICMP Query mapping by NAT devices is necessary for current&#xA;ICMP-Query-based    applications to work.  This entails a NAT device&#xA;to transparently forward ICMP Query packets initiated from the nodes&#xA;behind NAT, and the responses to these Query packets in the opposite&#xA;direction.  As specified in [NAT-TRAD], this requires translating the&#xA;IP header.  A NAPT device further translates the ICMP Query Id and the&#xA;associated checksum in the ICMP header prior to forwarding.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So a NAT device can indeed put a unique value in the Identifier field when forwarding a request to the outside. Two machines on the inside using the same identifier is no problem, the NAT device will use two different values and remember the combination of the original ID and the internal IP address.&lt;/p&gt;&#xA;&lt;p&gt;Some (old) Cisco specific information can be found here: &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=25273&amp;amp;seqNum=3&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ciscopress.com/articles/article.asp?p=25273&amp;amp;seqNum=3&lt;/a&gt;. This page also includes a list of supported protocols/applications for NAT.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;If an ICMP message is sent to notify of an error caused by a TCP connection, the ICMP message must include the header and part of the payload of the TCP segment that triggered the error. This is necessary to allow the receiving host to identify the TCP connection.&lt;/p&gt;&#xA;&lt;p&gt;A NAT device can do exactly the same thing to figure out where to send ICMP errors it receives. If it has a mapping corresponding to the TCP header in the ICMP payload, it knows where to send the ICMP message.&lt;/p&gt;&#xA;&lt;p&gt;An attacker wanting to spoof an ICMP error would need to know the source and destination IP addresses and ports to create his message. Because the ICMP message payload will also contain a TCP sequence number, the TCP endpoint could also verify if this sequence number is valid (i.e. sent and not yet acked).&#xA;This will make spoofing much harder, but this validation might not be implemented in all systems.&lt;/p&gt;&#xA;&lt;p&gt;You should probably have a good look at &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5927&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5927&lt;/a&gt; &amp;quot;ICMP Attacks against TCP&amp;quot;.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-06-24T12:15:42.963" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2035" PostTypeId="1" AcceptedAnswerId="2047" CreationDate="2013-06-24T03:29:50.157" Score="5" ViewCount="5364" Body="&lt;p&gt;&lt;strong&gt;For your average enterprise network, what are the pros and cons for using a /31 mask on point-to-point links with private addressing over the generally accepted practice of using /30?&lt;/strong&gt;  There's really no need for a broadcast address on a P2P, so what does a /31 offer to an enterprise, if anything, if burning a couple more addresses for the network or broadcast addresses is not a concern?  I do understand in public IPv4 space with providers how the /31s are attractive for conservation though I haven't run into one yet that required them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I overlooking making anything more difficult with /31s for administration or in the way any typical protocols work over a P2P?  With OSPF, it identifies /30 links as P2P, so I don't see how using /31 makes any difference.  OSPF is my largest concern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;There's a similar question on &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1547/31-point-to-point-bitmasks&quot;&gt;/31s&lt;/a&gt;, but the answers about impact to routing protocols like OSPF were mostly speculation, and I would like to have a definitive answer.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-07-03T09:07:42.430" Title="When is /31 recommended over /30 in P2P links?" Tags="|ipv4|subnet|point-to-point|" AnswerCount="3" CommentCount="1" ClosedDate="2013-06-24T19:57:42.670" ContentLicense="CC BY-SA 3.0" />
  <row Id="2037" PostTypeId="1" AcceptedAnswerId="2042" CreationDate="2013-06-24T07:09:07.857" Score="5" ViewCount="3096" Body="&lt;p&gt;I have 2 Riverbed WAN optimizers and a WAN simulator. I connected 2 WAN ports of the 2 Riverbeds to the WAN simulator, connected 2 LAN ports along with 2 servers on a switch, and configured 2 subnets for the server and Riverbed –– But the Riverbed does not receive traffic from my servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why? Is there something special I need to do for the Riverbed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The topology is like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hOrp2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hOrp2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1838" LastEditorUserId="21048" LastEditDate="2017-10-20T12:26:07.363" LastActivityDate="2017-10-20T12:26:07.363" Title="riverbed wan optimizer does not receive traffic" Tags="|switch|wan-optimizer|linux|riverbed|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2038" PostTypeId="1" CreationDate="2013-06-24T07:12:29.050" Score="4" ViewCount="1598" Body="&lt;p&gt;I am new here and very interested in computer networks. From a book, I have some questions, for which I need help. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;question1&lt;/strong&gt;: Can there be only one working DHCP server in one VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;question2&lt;/strong&gt;: Can there be only one subnet in one VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that a VLAN can have ports which belongs to several different subnets. So, why can't a VLAN have more than one DHCP server and more than one subnet?&lt;/p&gt;&#xA;" OwnerUserId="1837" LastEditorUserId="49" LastEditDate="2013-06-24T12:48:45.510" LastActivityDate="2013-06-24T12:48:45.510" Title="Some question about the relationship between VLAN , DHCP and subnet" Tags="|vlan|dhcp|subnet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2040" PostTypeId="2" ParentId="2038" CreationDate="2013-06-24T07:29:33.427" Score="4" Body="&lt;p&gt;You can have multiple DHCP servers serving a VLAN. The client will use OFFER that comes in first if receiving multiple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISC has support for DHCP redundancy while Microsoft was a bit lacking in this department. They have recommended split scopes in the past but it's not really a good solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can have multiple subnets per VLAN. On a Cisco device you would use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address x.x.x.x y.y.y.y secondary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-06-24T07:29:33.427" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2041" PostTypeId="2" ParentId="2038" CreationDate="2013-06-24T07:43:45.450" Score="4" Body="&lt;h2&gt;Question1:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multiple DHCP servers in one VLAN is possible. There can be operational issues if they are not under the same administrative control. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually there are more than one DHCP servers per VLAN for redundancy. Considerations need to be made to avoid DHCP conflicts. If DHCP servers share the same DHCP pool, something needs to be implemented to make sure the DHCP server does not offer an ip address that's already in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One approach is to use DNS forwarder on the access VLAN, the forwarder forward DHCP packets between hosts and DHCP server cluster. The DHCP server cluster are stateful (knowing which ip addresses have already been assigned).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another approach is to use DHCP options to distinguish clients. For example, one DHCP server works for IP phones and they only offer IP addresses when certain DHCP options are set in the client's DHCP discover. This DHCP server uses a dedicated pool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The short answer is, yes (as long as they are properly configured)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;question2:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN is a layer 2 concept. A VLAN separates layer 2 broadcast domain.&#xA;You can think of a non-managed switch as a switch with all ports in one VLAN. (no VLAN support is effectively every port in one VLAN).&#xA;You can have two hosts in 192.168.0.0/24 and 2 hosts in 172.16.0.1/24 connected to the switch. Hosts in the same subnet can directly communicate with each other through the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with this approach is that everything is in the same broadcast domain. Packets destinated 255.255.255.255 will be sent to every port in the VLAN, which may be a security issue, a waste of bandwidth, processing power etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you assign each port into their own VLAN, multiple subnets can still exist on one port (multiple IP addresses on one NIC, secondary IP addresses etc.).&lt;/p&gt;&#xA;" OwnerUserId="34" LastActivityDate="2013-06-24T07:43:45.450" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2042" PostTypeId="2" ParentId="2037" CreationDate="2013-06-24T08:09:47.567" Score="4" Body="&lt;p&gt;Assuming the servers can ping each other:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You need to check that the Optimization Service is enabled globally and for your inpath interface otherwise the Riverbed will not interact with network traffic at all. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As soon as Optimization is enabled you can check under &quot;Reports / Connected Appliances&quot; if the Riverbeds can see each other.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1558" LastActivityDate="2013-06-24T08:09:47.567" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2044" PostTypeId="2" ParentId="2027" CreationDate="2013-06-24T09:19:46.227" Score="4" Body="&lt;p&gt;In any modern stateful NAT implementation, connection tracking is generally a fundamental part of facilitating it. There's not really any limitations on what IP protocols can be handled by NAT - Linux Netfilter can happily NAT any ip protocol, but obviously, with the limitation that if there is no special handling for that protocol (i.e. additional discriminators) only one inside host is going to be able to communicate with a particular outside host at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of ICMP &lt;code&gt;echo request&lt;/code&gt;, the identifier and timestamp field are highly unlikely to match that of another host pinging the same remote endpoint - thus, providing the NAT/connection tracking implementation is capable of utilising this data, it can differentiate between the two. For &lt;code&gt;destination unreachable&lt;/code&gt; the NAT device would have to track payload data (namely the first 8 bytes) in order to assure the validity of the ICMP error message - but even so, the host endpoint should most definitely be validating such a message itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, assuming an RFC compliant network stack, forged ICMP messages should not be an issue due to the fact that several fields are unique... Unless the attacker is a direct man in the middle, at which point they can interfere pretty freely - of course, this is why things like IPsec, TCP-MD5 and TCP-AO exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;nb: whilst a number of RFCs do exist regarding NAT, it should &lt;strong&gt;not&lt;/strong&gt; be considered an agreed standard in the manner that things like routing protocols are.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-24T09:19:46.227" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2047" PostTypeId="2" ParentId="2035" CreationDate="2013-06-24T09:56:10.217" Score="7" Body="&lt;p&gt;Generally it comes down to interoperability - if you can guarantee that using a /31 is fine for both hosts on the link, and you are 100% sure that if one of the hosts fail, you will &lt;strong&gt;not&lt;/strong&gt; be replacing it with something that can't handle a /31, you should absolutely just use a /31.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In reality, the prime candidate for issues is going to be a routing protocol like OSPF, but as usual, this is implementation dependent - the vast majority of routers out there will behave properly when using a /31 - the adage &lt;em&gt;&quot;test your equipment&quot;&lt;/em&gt; holds true.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-24T09:56:10.217" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2048" PostTypeId="2" ParentId="2031" CreationDate="2013-06-24T10:10:17.733" Score="4" Body="&lt;p&gt;Using a /127 isn't terrible, but letting it go into your backbone as a /127 is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for this is that, essentially, most modern router TCAMs can typically only handle up to 64 bits of address width at a time - this means that if you're in a situation where all routes are /64 or shorter, lookups can occur in a single cycle. Anything longer and it has to perform another lookup operation. Even on a TCAM that only has 32 or 48 bit width, going beyond /64 is obviously still significant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my personal recommendation is to allocate a /64 for every P2P link even if you only use a /127 on the wire - that way, when you bring up your routing protocol, you can then aggregate the /127 to a /64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My personal favourite, however is to allocate a reasonable chunk of your IPv6 space purely for facilitating P2P links (in my case, I reserved a /48) - this /48 is then blocked on all network edge interfaces at ingress as a destination. In this way, you're free to just go ahead and use a /64 on your P2P links and still have traceroutes, ICMP errors et. al work, but you are not vulnerable to NDP attacks from outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously not everyone is going to care about this and if the additional cost of using longer prefixes is acceptable to you (or you have super-duper 128 bit TCAMs) then you can of course ignore everything above. &lt;em&gt;How scalable do you want your network to be?&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-24T10:10:17.733" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2049" PostTypeId="2" ParentId="2035" CreationDate="2013-06-24T10:53:40.747" Score="0" Body="&lt;p&gt;I would recommend the use of /31 only when short on IPv4 addresses and have many P2P links to deploy.&#xA;So, how many links are we talking about?&lt;/p&gt;&#xA;" OwnerUserId="530" LastEditorUserId="530" LastEditDate="2013-06-24T11:02:45.207" LastActivityDate="2013-06-24T11:02:45.207" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2050" PostTypeId="2" ParentId="2035" CreationDate="2013-06-24T11:08:53.700" Score="2" Body="&lt;p&gt;/31 addressing preserves IP addresses, otoh if you find yourself replacing a device on /31 links, make sure the replacement also supports /31 addressing or you'll have to re-number. BTDT.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-06-24T11:08:53.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2054" PostTypeId="2" ParentId="2037" CreationDate="2013-06-24T16:57:07.867" Score="0" Body="&lt;p&gt;I know in my environment the use of crossover cables is necessary for optimization between router and simulator in this case.  &lt;/p&gt;&#xA;" OwnerUserId="413" LastActivityDate="2013-06-24T16:57:07.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2055" PostTypeId="1" CreationDate="2013-06-24T17:41:31.160" Score="10" ViewCount="55255" Body="&lt;p&gt;I am trying to get a list of the devices that are connected to my Cisco (Catalyst 2960) switch. Preferably through SNMP. Here is what I've already done:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to retrieve the ARP table from the switch (through SNMP walking OID &lt;code&gt;1.3.6.1.2.1.4.22.1.2&lt;/code&gt; on the switch). However this does not reflect the 'live' set of IP's since ARP does not update when devices go offline. In other words, when I restart a device and it acquires a new IP address (dynamic) I end up with the old IP address also listed in my ARP table, even though that IP is not currently on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way for me to find that 'live' list through the switch, preferably avoiding the ARP table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I cannot continuously ping the devices to determine their status, I'm working under very low bandwidth conditions.&lt;/p&gt;&#xA;" OwnerUserId="1845" LastEditorUserId="775" LastEditDate="2013-06-24T17:49:25.017" LastActivityDate="2013-06-28T09:29:01.880" Title="How to find a list of devices connected to my network (IP's and MACs)" Tags="|cisco|cisco-catalyst|ipv4|snmp|mac-address|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2056" PostTypeId="2" ParentId="2055" CreationDate="2013-06-24T18:00:32.563" Score="7" Body="&lt;p&gt;Is a broadcast ping to the subnet from the SVI on the switch (which is low-bandwidth), and using &lt;code&gt;show mac address-table dynamic&lt;/code&gt; out of the question?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;some-switch#show mac address-table dynamic&#xA;          Mac Address Table&#xA;-------------------------------------------&#xA;&#xA;Vlan    Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA;   1    000f.257b.ba3b    DYNAMIC     Gi1/0/49&#xA;   1    0011.254f.a5be    DYNAMIC     Gi1/0/49&#xA;  56    0000.0c57.aa00    DYNAMIC     Gi1/0/49&#xA;  56    0004.0ff4.8cf4    DYNAMIC     Gi1/0/49&#xA;  56    0004.0af4.c8fb    DYNAMIC     Gi1/0/5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this point, use your ARP table to map from mac-address to IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing this with SNMP is possible, but somewhat painful if you need to know what port each mac-address is on... use &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=dot1dTpFdbAddress&quot;&gt;dot1dTpFdbAddress&lt;/a&gt; to grab the mac-addresses, &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1dBasePortIfIndex&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;dot1dBasePortIfIndex&lt;/a&gt; to map to interface &lt;code&gt;ifIndex&lt;/code&gt; and then &lt;code&gt;ifName&lt;/code&gt; to map from &lt;code&gt;ifIndex&lt;/code&gt; to a name you'll recognize.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-06-24T18:00:32.563" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2057" PostTypeId="1" AcceptedAnswerId="2067" CreationDate="2013-06-24T18:07:44.143" Score="2" ViewCount="460" Body="&lt;p&gt;I have two NET APP Controllers in two different Data Centers. The Data Centers are connected with a 1 Gig Layer 2 connection. Both NET App controllers are IPed within the same broadcast domain. The communication traffic over this 1 Gig connection is mostly sync traffic between the two NET App's. During busy periods the sync traffic can take up 95+% of the link. Is it possible to rate limit or shape this communication traffic to 80% of the 1 gig link?&lt;/p&gt;&#xA;" OwnerUserId="1477" LastActivityDate="2013-06-28T08:03:02.510" Title="QOS Layer 2 Link" Tags="|qos|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2058" PostTypeId="1" AcceptedAnswerId="2061" CreationDate="2013-06-24T18:13:55.263" Score="12" ViewCount="338" Body="&lt;p&gt;For example, let's compare IP Base vs. Advanced Enterprise Services. Let's say you have advent installed, but you're only actually using the features relevant to ipbase. Other than flash memory space, would running advent when you only need ipbase decrease the router's performance in any way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or to put it another way, would the router's performance be enhanced (however slight) by running only the IOS feature set that you need instead of the full advent image?&lt;/p&gt;&#xA;" OwnerUserId="572" LastActivityDate="2013-06-24T19:10:16.180" Title="Do unused Cisco IOS features take up RAM/CPU resources?" Tags="|cisco|cisco-ios|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2060" PostTypeId="2" ParentId="2055" CreationDate="2013-06-24T18:48:44.367" Score="2" Body="&lt;p&gt;If IPs are dynamic, then you should have dhcp logs to get mac-ip pairs.&#xA;then with SNMP you can try to understand what kind of devices you have.&#xA;but keep in mind, that you have to have snmp configured and allowed from your station.&#xA;If you are talking about windows machines, then it is easier to use powershell to grab information about workstations.&#xA;You can also try to use nmap to scan the whole subnet and to get more information about its inhabitants.&lt;/p&gt;&#xA;" OwnerUserId="16" LastActivityDate="2013-06-24T18:48:44.367" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2061" PostTypeId="2" ParentId="2058" CreationDate="2013-06-24T19:03:27.570" Score="13" Body="&lt;p&gt;Strictly speaking, yes, the unused features do cost you some performance.  However, &quot;measurable&quot; loss is questionable.  Most features are initialized even if they aren't used, so that will eat into memory, and any periodic &quot;house keeping&quot; tasks will still get CPU time. The major features (ipv6, telephony service, routing protocols, ids/ips, etc.) have to be explicitly enabled and configured; and yes, they're very much measurable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is advent 10% slower than ipbase at doing &quot;ipbase&quot;... No.  It'll take a lot longer to boot, but day-to-day operations will see very little difference. (assuming you have the memory to run advent in the first place)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-24T19:03:27.570" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2062" PostTypeId="2" ParentId="2058" CreationDate="2013-06-24T19:10:16.180" Score="7" Body="&lt;p&gt;Larger images will consume more RAM - it does not impact the CPU once loaded although it will also incur a longer boot time since it of course has to be decompressed into memory and that takes time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On more modern platforms with speedy Intel Xeons, the decompression difference isn't very significant. On older MIPS or PowerPC processors, it is.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-24T19:10:16.180" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2066" PostTypeId="1" CreationDate="2013-06-24T22:59:16.480" Score="7" ViewCount="953" Body="&lt;p&gt;I'm having a problem getting a Cisco 1841 connected to an ADVA WAN box provided by TWTelecom. They've given me instructions to force the fasteternet0/0 100 full duplex on interface 0/0, which I have done. When I boot the cisco, there is link and activity during boot, then the Cisco port lights black out while it resets the ports, and once they come back on, the link doesn't remake.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I connect a laptop to the ADVA, the link makes and it can communicate. Laptop NIC properties show a 100mb connection. If I connect a laptop to the fastethernet0/0, the link makes and it can communicate. Lights on 0/0 show 100 mb and full duplex connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The config file for that interface is very basic. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface FastEthernet0/0&#xA; ip address 10.0.2.2 255.255.255.0&#xA; speed 100&#xA; full-duplex&#xA; service-policy output EGRESS&#xA;!&#xA;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What would keep the ADVA and Cisco from making a successful link once the Cisco completes its boot?&lt;/p&gt;&#xA;" OwnerUserId="1848" LastEditorUserId="267" LastEditDate="2013-06-25T01:33:16.117" LastActivityDate="2013-06-25T21:50:39.370" Title="Cisco 1800 drops link to ADVA" Tags="|cisco|wan|" AnswerCount="3" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2067" PostTypeId="2" ParentId="2057" CreationDate="2013-06-24T23:09:54.343" Score="1" Body="&lt;p&gt;If I remember correctly, you can throttle the Netapp's snapmirror/snapvault traffic from Netapp's System Manager.&lt;/p&gt;&#xA;" OwnerUserId="1799" LastActivityDate="2013-06-24T23:09:54.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2068" PostTypeId="1" AcceptedAnswerId="2069" CreationDate="2013-06-24T23:15:56.980" Score="8" ViewCount="11208" Body="&lt;p&gt;I want to test 802.1x on a test SSID.  Wasn't sure if making a test SSID associated to a VLAN that already has another SSID associated with it would cause a problem with the customer facing SSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex.&#xA;SSID 1 = VLAN 1&#xA;SSID 2 = VLAN 1 - has 802.1x specific configurations&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2013-12-06T23:11:08.507" Title="Two SSID's for same VLAN - problems?" Tags="|cisco|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2069" PostTypeId="2" ParentId="2068" CreationDate="2013-06-24T23:38:54.990" Score="8" Body="&lt;p&gt;Cisco won't allow more than one SSID per VLAN per Interface using Autonomous APs. Can't answer for WLCs, but I would assume the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a single radio AP, I recommend having a test VLAN to go with the test SSID and then have your router route between the VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AP Message When Attempting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;(config)#dot11 ssid Example&#xA;(config-ssid)#vlan 21&#xA;Warning: Vlan 21 already mapped to SSID Guest. SSIDs with same vlan association cannot be attached to the same interface.&#xA;&#xA;(config-ssid)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Originally I took this as one to one but when I tried it on a dual radio AP I was able to replace the Guest SSID on the 5Ghz radio:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-ssid)#int D1&#xA;(config-if)#no ssid Guest&#xA;(config-if)#ssid Example&#xA;(config-if)#exit&#xA;(config)#exit&#xA;&#xA;#sh dot11 bssid&#xA;Interface      BSSID         Guest  SSID&#xA;Dot11Radio0   0026.0bXX.XXXX  Yes  Guest&#xA;Dot11Radio1   0007.7dXX.XXXX  No   Example&#xA;&#xA;#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT: Corrected myself, it does work on a dual radio AP, but not single radio&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-06-24T23:48:51.483" LastActivityDate="2013-06-24T23:48:51.483" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2070" PostTypeId="2" ParentId="2066" CreationDate="2013-06-25T01:50:46.257" Score="2" Body="&lt;p&gt;I don't know what &quot;ADVA&quot; is, but I'm guessing it's metro-ethernet hardware.  Most metro-e setups don't do auto-negotiation at all. &lt;code&gt;speed 100&lt;/code&gt; and &lt;code&gt;duplex full&lt;/code&gt; should be disabling autoneg, but who knows what Cisco's doing.  The &lt;code&gt;keepalive&lt;/code&gt; checks could also be killing the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &quot;auto&quot; works for speed and duplex, then go with it. :-) (that's what your laptop is doing.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-25T01:50:46.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2071" PostTypeId="2" ParentId="2066" CreationDate="2013-06-25T01:50:57.820" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;They've given me instructions to force the fasteternet0/0 100 full duplex on interface 0/0, which I have done. When I boot the cisco, there is link and activity during boot, then the Cisco port lights black out while it resets the ports, and once they come back on, the link doesn't remake.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Based on this description, I'm going out on a limb and suggesting that your static &lt;code&gt;speed&lt;/code&gt; and/or &lt;code&gt;duplex&lt;/code&gt; settings are causing the issue... please remove both of them from &lt;code&gt;FastEthernet0/0&lt;/code&gt;.  If that doesn't work, try different ethernet cables (both crossover and straight) to the Adva.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-06-25T01:50:57.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2072" PostTypeId="2" ParentId="2068" CreationDate="2013-06-25T02:04:09.753" Score="3" Body="&lt;p&gt;Not sure if it's a best practice, but we have many SSID's on a single VLAN... Some use the same DHCP pool, others use a separate one. (We use multiple SSIDs to implement policy differences and auth settings.) This is on a WLC 5500-series.&lt;/p&gt;&#xA;" OwnerUserId="85" LastActivityDate="2013-06-25T02:04:09.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2074" PostTypeId="2" ParentId="1029" CreationDate="2013-06-25T02:42:39.097" Score="4" Body="&lt;p&gt;In many implementations an IPv4 subnet and a VLAN are closely correlated on a 1:1 basis.  A subnet, strictly speaking is a portion of IPv4 address space from which one may assign addresses to hosts.  This is differentiated from a &quot;prefix&quot; a term used in the common parlance or a supernet, which may be a some larger portion of IP address space that is comprised of many subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for the correlation is that a single VLAN and a single subnet both represent a single broadcast domain.  As such, these two tend to be overlaid in most implementations.  As described in earlier answers, a VLAN is a layer 2 entity.  All hosts on a given VLAN can communicate with each other, but no hosts on one VLAN can communicate to hosts on another without some form of routing or in rare cases, bridging.  &lt;/p&gt;&#xA;" OwnerUserId="1850" LastActivityDate="2013-06-25T02:42:39.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2075" PostTypeId="2" ParentId="1217" CreationDate="2013-06-25T02:46:05.610" Score="1" Body="&lt;p&gt;I've used Ixia IxChariot in the past and found that the only benefits were that it ran on Windows and produced slick looking reports that were effectively meaningless, but made management types happy to see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I'd rather conserve my budget and use iperf.&lt;/p&gt;&#xA;" OwnerUserId="1850" LastActivityDate="2013-06-25T02:46:05.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2076" PostTypeId="2" ParentId="1648" CreationDate="2013-06-25T02:51:03.503" Score="1" Body="&lt;p&gt;I've used netdisco to collect this information.  It will allow one to query the data base with a hostname, IP address, MAC address, etc. and return the switch and switchport.  It will do some other useful things as well.&lt;/p&gt;&#xA;" OwnerUserId="1850" LastActivityDate="2013-06-25T02:51:03.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2077" PostTypeId="2" ParentId="2055" CreationDate="2013-06-25T06:11:42.533" Score="5" Body="&lt;p&gt;&lt;strong&gt;DHCP Snooping&lt;/strong&gt; for both the L3 IP and L2 MAC addresses if you seek to just identify your clients using dynamic addresses.  This is used for security to block rogue DHCP servers and only allow packets to be received on switchports with valid DHCP addresses that were offered and requested (i.e., actually in use).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enable dhcp snooping globally for your VLANs you want to watch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;ip dhcp snooping vlan 10,20,30,40,50&#xA;no ip dhcp snooping information option&#xA;no ip dhcp snooping verify mac-address&#xA;ip dhcp snooping&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Be sure to identify your trusted interfaces that have your DHCP servers behind them using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface xy/z&#xA; ip dhcp snooping trust&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sample bindings table of IP-MAC addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;s-oc2-3h-s1#sh ip dhcp snooping binding&#xA;MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface&#xA;------------------  ---------------  ----------  -------------  ----  --------------------&#xA;B4:B5:2F:DB:85:C6   172.17.3.29      254427      dhcp-snooping   30    FastEthernet1/0/30&#xA;3C:07:54:3F:91:CB   172.17.3.26      224542      dhcp-snooping   30    FastEthernet2/0/42&#xA;6C:62:6D:77:95:1A   172.17.3.37      256986      dhcp-snooping   30    FastEthernet1/0/17&#xA;B4:B5:2F:2D:27:37   172.17.3.22      149352      dhcp-snooping   30    FastEthernet2/0/30&#xA;B4:B5:2F:DB:85:C2   172.17.3.18      207629      dhcp-snooping   30    FastEthernet1/0/16&#xA;...&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.380&quot; rel=&quot;noreferrer&quot;&gt;ciscoDhcpSnoopingMIB&lt;/a&gt; for SNMP access to these objects.  OID    1.3.6.1.4.1.9.9.380&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-06-25T06:11:42.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2078" PostTypeId="1" CreationDate="2013-06-25T11:30:51.570" Score="16" ViewCount="17730" Body="&lt;p&gt;I'm looking for specifications for Gigabit Ethernet in connection with PoE. I saw somewhere that 1000BASE-T uses all 8 lines of the twisted pair cable. If that is the case, how does it work with PoE?&lt;/p&gt;&#xA;" OwnerUserId="1854" LastEditorUserId="3050" LastEditDate="2022-10-23T21:11:43.770" LastActivityDate="2022-10-23T21:11:43.770" Title="Is PoE compatible with Gigabit Ethernet?" Tags="|power-over-ethernet|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="2079" PostTypeId="2" ParentId="2078" CreationDate="2013-06-25T11:39:36.963" Score="20" Body="&lt;p&gt;The wikipedia article (&lt;a href=&quot;https://en.wikipedia.org/wiki/Power_over_Ethernet&quot;&gt;https://en.wikipedia.org/wiki/Power_over_Ethernet&lt;/a&gt;) explains it quite nicely:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Standards-based power over Ethernet is implemented following the&#xA;  specifications in IEEE 802.3af-2003 (which was later incorporated as&#xA;  clause 33 into IEEE 802.3-2005) or the 2009 update, IEEE 802.3at. A&#xA;  phantom power technique is used to allow the powered pairs to also&#xA;  carry data. This permits its use not only with 10BASE-T and&#xA;  100BASE-TX, which use only two of the four pairs in the cable, but&#xA;  also with 1000BASE-T (gigabit Ethernet), which uses all four pairs for&#xA;  data transmission. This is possible because all versions of Ethernet&#xA;  over twisted pair cable specify differential data transmission over&#xA;  each pair with transformer coupling; the DC supply and load&#xA;  connections can be made to the transformer center-taps at each end.&#xA;  Each pair thus operates in common mode as one side of the DC supply,&#xA;  so two pairs are required to complete the circuit. The polarity of the&#xA;  DC supply may be inverted by crossover cables; the powered device must&#xA;  operate with either pair: spare pairs 4–5 and 7–8 or data pairs 1–2&#xA;  and 3–6. Polarity is required on data pairs, and ambiguously&#xA;  implemented for spare pairs, with the use of a diode bridge.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-06-25T11:39:36.963" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2080" PostTypeId="1" AcceptedAnswerId="2081" CreationDate="2013-06-25T11:39:53.270" Score="2" ViewCount="13890" Body="&lt;p&gt;I wrote a test a few days ago and wasn't able to solve one task in there:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Create 7 Subnets in the 192.168.10.0/24 Net &lt;br/&gt;&#xA;  The subnets should be equally large.&lt;br/&gt;&#xA;  The address range must be completely used.&lt;br/&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So at first I tried to create one Subnet with /26 mask, so I get 64 hosts and the remaining address range gets filled with six /27 masked subnets (32 hosts). &lt;br/&gt;&#xA;Then I noticed that the second requirement has not been fulfilled. &lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I create only /27 masked subnets, the third (or first) requirement is not fulfilled.&lt;br/&gt;&#xA;In the end I gave up and created eight /27 masked subnets, where the last subnet is not used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is whether I didn't understand something in subnetting or the teacher made a mistake.&lt;br/&gt;&#xA;I still hope that the task was not possible, so I can talk to the teacher.&lt;/p&gt;&#xA;" OwnerDisplayName="user217" LastEditorDisplayName="user217" LastEditDate="2013-06-25T14:18:10.853" LastActivityDate="2017-11-06T16:52:31.747" Title="Subnetting a IPv4 /24 into 7 equally large subnets" Tags="|ipv4|subnet|" AnswerCount="7" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2081" PostTypeId="2" ParentId="2080" CreationDate="2013-06-25T11:50:08.607" Score="16" Body="&lt;p&gt;There's no solution which satisfies all requirements, your answer of making 8 /27's is probably the most logical one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can easily verify this by trying to divide 256 by 7, you can't do this without a remainder. Also, all subnets need to have a size which is a power of 2, and 7 * 32 (a /27) = 252, 8 * 16 (a /26) = 512, so there's no way to do this without unused space.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-06-25T11:50:08.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2082" PostTypeId="2" ParentId="2080" CreationDate="2013-06-25T12:01:54.037" Score="2" Body="&lt;p&gt;By definition a subnet size is a power of 2 so a group of equal size address spaces that is subnetted must also be a power of 2. so a /24 can be broken up in to equal size address spaces 2, 4, 8, 16, 32, 64, 128 (probably not as zero (subnet) and 1 (broadcast)).&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-06-25T12:01:54.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2083" PostTypeId="2" ParentId="2080" CreationDate="2013-06-25T13:31:04.997" Score="3" Body="&lt;p&gt;This is basic subnetting/binary logic. There's 2 /25s in a /24, 2 /26s in a /25 (ergo 4 /26s in a /24) and so forth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;closest match&lt;/em&gt; to the requirements is to use &lt;code&gt;/27&lt;/code&gt; which will leave you with one spare subnet. You cannot by definition have an odd number of subnets exist from &lt;em&gt;any&lt;/em&gt; given subnet size. Either your teacher actually intended this and the 7 was a red herring, or somebody failed hard at math.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-25T13:31:04.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2084" PostTypeId="2" ParentId="2080" CreationDate="2013-06-25T14:50:47.467" Score="1" Body="&lt;p&gt;What we used to get on our tests was:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Create 7 Subnets in the 192.168.10.0/24 Net&lt;/p&gt;&#xA;&lt;p&gt;The subnets should be equally large.&lt;/p&gt;&#xA;&lt;p&gt;The address range must be used as optimal as possible.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;If you say as optimal as possible you there is some flexibility, but it also makes the student think. A classic example we used to get was:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Give the smallest subnet mask possible to fit in 1023 hosts.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The answer was to have a 255.255.248.0 subnetmask (which can hold 2046).&lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-06-25T14:50:47.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2086" PostTypeId="2" ParentId="1217" CreationDate="2013-06-25T16:17:38.277" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://sourceforge.net/projects/hyenae/&quot; rel=&quot;nofollow&quot;&gt;Hyenae&lt;/a&gt; is a highly flexible platform independent network packet generator. It allows you to reproduce several MITM, DoS and DDoS attack scenarios, comes with a clusterable remote daemon and an interactive attack assistant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some options you can play with, send delay range, TCP window size etc. IPv6 supported. It can generate 100K+ pps.&lt;/p&gt;&#xA;" OwnerUserId="34" LastActivityDate="2013-06-25T16:17:38.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2087" PostTypeId="2" ParentId="1962" CreationDate="2013-06-25T16:18:04.893" Score="3" Body="&lt;p&gt;Slightly different tools that work best in different places.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The offset-list allows adjustment to routes as they propagate into a given part of the network without altering the metrics of the originating network.  In the case of two networks interconnecting at multiple points via EIGRP this allows a given path to be biased upward or downward without playing with a metric that might cause different (likely undesirable) behavior in the existing topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Delay is generally the preferred method for tweaking path selection on a universal basis.  Bandwidth can work, of course, but &lt;em&gt;always&lt;/em&gt; remember that EIGRP considers the &lt;em&gt;lowest&lt;/em&gt; bandwidth link in a given path - which means dropping your 1G link to 900M doesn't mean much if it ultimately goes through a 100M connection.  Delay, in contrast, is directly additive on a per-hop basis and, as such, has a much greater effect on the route ultimately calculated.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other K values (reliability, utilization, MTU, etc) should basically -never- be touched.  These function are either better accomplished through other mechanisms, will create rolling oscillation issued in your network or just shouldn't realistically be a point of consideration in the first place.  The largest EIGRP deployments in the world do fine without touching the other K values.  If it is suggested that these values be set I would take a harder look at the requirements and tools available.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-06-25T16:18:04.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2088" PostTypeId="1" CreationDate="2013-06-25T19:50:35.380" Score="5" ViewCount="801" Body="&lt;p&gt;I would like to replace a simple five port unmanaged desktop switch with a VLAN on our HP 5406 zl. I need to distribute our Internet connection to two firewalls and figured I could do with one less piece of hardware running on the rack and use a VLAN instead of the aforementioned desktop switch. I set up the VLAN and it works, but it times out every 10 packets or so when I ping an external site. If I plug the Internet line into a physical five port switch and bypass the 5406 altogether, everything works fine. So, it seems to have something to do with the VLAN. Tracert follows the correct (and the same) route when I'm using the VLAN and when I'm using the desktop switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not want other VLANs on the switch to be able to route to/from this VLAN, so I didn't give it an IP address. I just want it to blindly pass traffic to/from our firewalls, which do all the packet filtering and provide Internet access to the rest of our network. This is what the VLAN config looks like when I view it on the 5406's configuration report:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 4 &#xA;name &quot;wan1&quot; &#xA;untagged C20,C22,C24 &#xA;no ip address &#xA;exit &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One thing the report doesn't show is that the VLAN has the default gateway set to the IP that is the default route for the switch. However, I don't think it should matter because tracert shows that it doesn't send traffic to that IP anyway, which it shouldn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something else I tried and might be worth mentioning:  If I plug the Internet line into an unmanaged switch and then connect the unmanaged switch to the vlan on the 5406, I can hook my laptop up to that vlan and the connection works perfectly.  If I take the unmanaged switch out of the picture and plug the Internet line right into the vlan, it starts timing out again.  So, to sum it up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Works: Internet -&amp;gt; unmanaged switch -&amp;gt; vlan (5406) -&amp;gt; ping from laptop&#xA;Works: Internet -&amp;gt; unmanaged switch -&amp;gt; ping from laptop&#xA;Doesn't work (times out frequently): Internet -&amp;gt; vlan (4506) -&amp;gt; ping from laptop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any suggestions would be much appreciated!&lt;/p&gt;&#xA;" OwnerUserId="1858" LastEditorUserId="1858" LastEditDate="2013-07-01T15:47:32.710" LastActivityDate="2013-08-24T00:41:02.387" Title="VLAN that mimics unmanaged desktop switch" Tags="|vlan|hp-procurve|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2089" PostTypeId="1" CreationDate="2013-06-25T20:26:13.367" Score="10" ViewCount="10807" Body="&lt;p&gt;It happens that I run across customers who have what I define as an &quot;asymetric routing&quot; in their networks. Simply said, they have &lt;strong&gt;two gateways&lt;/strong&gt; on the same IP subnet. The clients are configured to point at one gateway (i.e. 172.16.1.1) but there is another device (i.e. 172.16.1.2) which connects and routes to somewhere. Mostly I've seen this kind of setup when there are 2 different types of WAN connections: 1 internet connection and 1 corporate MPLS connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm personally not attracted by the above kind of network design: each subnet has to have one and only one gateway. From my point of view, the above scenario may create some issues for clients, because they send a packet to their default gateway (172.16.1.1) and those packets are then forwarded out the other router (172.16.1.2) and when they get replied to, they reach the client simply passing through 172.16.1.2. The clients would or should expect the reply packets come from 172.16.1.1, or am I wrong here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd be happy to have your opinions and technical views of this issue.&lt;/p&gt;&#xA;" OwnerUserId="1657" LastEditorUserId="630" LastEditDate="2013-06-25T23:40:14.333" LastActivityDate="2018-05-08T16:52:01.367" Title="Asymetric routing - causes and effects?" Tags="|routing|ipv4|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2090" PostTypeId="2" ParentId="2089" CreationDate="2013-06-25T20:35:02.670" Score="11" Body="&lt;p&gt;I would recommend that you look into First Hop Redundancy Protocols like HSRP or VRRP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, having two gateways can be a very good network design, because if a router were to fail, the other router can take over somewhat seamlessly. However, as you're aware, it's not easy to make this transition if you have to make a manual reconfiguration of each client on a subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Protocols like HSRP (or VRRP if you have non-Cisco gear) allow you to have two (or more) routers (or L3 switches) on a subnet share a single IP address. You'll have your first router with an address of .2, the seond with an address of .3, and a &quot;virtual IP address&quot; of .1 that both routers are aware of through configuration. When the primary router fails, the secondary is able to detect this and take over the virtual IP address, meaning that your clients just need to have .1 configured as their gateway and you're good to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of routing design, that would largely depend on the current setup. It's possible that both gateways lead to the same internet edge, in which case you may not have a problem. Asymmetric routing can be bad, mainly because you risk packets being delivered in the wrong order, but again, depends greatly on the topology you're talking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lots of design principles implied in what I just said. I suggest you research both protocols, and determine what's best for your environment. If you're using Cisco gear, HSRP is a widely used and well understood method of solving this problem.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-06-25T20:35:02.670" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2091" PostTypeId="2" ParentId="2089" CreationDate="2013-06-25T20:35:43.320" Score="9" Body="&lt;p&gt;The entire internet is built on asymmetric routing, so it's very common. Clients are interested in the interface they receive the packet on and the source of the packet, not which router passed it to them on that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Asymmetric routing can get problematic however when devices keeping track of state (especially firewalls) and NAT are involved, but as far as I can tell this isn't the case in your example.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-06-25T20:35:43.320" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2092" PostTypeId="2" ParentId="2089" CreationDate="2013-06-25T20:58:50.103" Score="4" Body="&lt;p&gt;Network clients identify traffic flows based on the combination of 4 values:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source Address&lt;/li&gt;&#xA;&lt;li&gt;Source Port&lt;/li&gt;&#xA;&lt;li&gt;Destination Address&lt;/li&gt;&#xA;&lt;li&gt;Destination Port&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For every different connection the 4 values above form a different combination wich is used to match the reply packets to the right flow. As you can see, the gateway or next-hop address is not included in the list and therefore the  client will not care if a packet comes back through the same gateway it used to send its packets. So, network clients do not care about assymmetric routing as soon as they can receive the traffic from the remote end. Actually, TCP/IP was designed originally to support assymmetric routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if we focus on network intermediate devices, assymmetric routing is not tolerated as soon as you are using any device/technology that needs seeing all packets in a connection to provide a given functionality. For instance: NAT, stateful firewalls or some WAN optimizators. Assymmetric routing in such scenario would cause either the intended functionality not being provided  or, even worst, packets being drop making communication impossible.&lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-06-25T23:00:42.840" LastActivityDate="2013-06-25T23:00:42.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2093" PostTypeId="2" ParentId="2088" CreationDate="2013-06-25T21:04:24.313" Score="3" Body="&lt;p&gt;Your VLAN configuration shouldn't be causing any issues. I'd check for a duplex mismatch on one of the involved ports.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-06-25T21:04:24.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2094" PostTypeId="2" ParentId="2066" CreationDate="2013-06-25T21:50:39.370" Score="1" Body="&lt;p&gt;The ADVA device is used by the provider as a point of demarcation and to ultimately terminate the WAN link.   If it is a multi port ADVA then you might want to ensure you are plugged into the correct port, usually 1-4 for 100Mb and port 5 used as the Gig port, therefore double check with the provider which port has been provisioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Mike Pennington suggested then try removing speed &amp;amp; duplex config on the cisco router or alternatively try to auto negotiate if that doesn't prove succesful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, the ADVA does has some intelligence in that it can carry vlans so you might want to check with the provider if anything in this respect has been configured as standard across the wan link. I've seen instances of needing to configure a sub-interface on the router that corresponds with the vlan id set on the wan link, albeit this can likely depend upon the service type and Provider Edge routers being used.&lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2013-06-25T21:50:39.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2095" PostTypeId="1" CreationDate="2013-06-26T02:26:36.690" Score="7" ViewCount="11681" Body="&lt;p&gt;I've been asked to assist in the design of a &quot;OOB&quot; management network, but I have a limited number of resources available. I have the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;1 Cisco 3750-X stack pair w/ a C3KX-NM-1G network module in each.&lt;/li&gt;&#xA;&lt;li&gt;8 Cisco 2960-24TC-L &quot;aggregate&quot; switches.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;We run a Layer 2 Collapsed Core network topology with a Cisco 6509-E VSS core. We have 128 access switches connected to our core via 1Gps Port-Channels. It's a mix of copper and fiber uplinks. Fiber to the second floor and copper in our datacenter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current thinking by our consultant is to configure the management SVI on each of our access switches with their own VLAN uplinked to our 2690 &quot;aggregate&quot; switches. The aggregate switches will in turn be uplinked to the 3750-X stack via a 802.1q trunk and configured with IP Unnumbered to emulate a Layer 3 link bypassing, in essence, L2 communication between the production access switches. The 3750-X stack will have a Loopback configured for each individual VLAN that the production access switches will use as a Default Gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea/concern is that we do not want our management network to pass STP traffic through to the other access switches or risk any sort of network convergence between the two separate networks. Kind of a &quot;Poor Man's&quot; Private VLAN setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering if this is the best or most efficient way to set this up or if there is a better way to go about it.&lt;/p&gt;&#xA;" OwnerUserId="1859" LastActivityDate="2013-06-26T05:41:04.783" Title="Is there a better way to design a Out-of-Band Management Network?" Tags="|design|management|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2096" PostTypeId="1" AcceptedAnswerId="2098" CreationDate="2013-06-26T04:10:31.100" Score="8" ViewCount="2590" Body="&lt;p&gt;My company will upgrade two Cisco 3560G switches (an HSRP Active &amp;amp; Standby pair) to two Cisco 3750X switches in a stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to make a switch replacement procedure starting from removal of the Cisco 3560s switches until the Cisco 3750x switches are put online.  I have googled it, searched the Cisco website, and searched various forums, but I couldnt find something to suit my needs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My approach will be...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Backup the standby 3560 config (traffic will flow through the active 3560).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Remove the plug of 3560 and put in one 3750x. Configure 3750x to accept traffic and to be the  stack master. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Backup the config on the remaining 3560 and remove it. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Plug in the second 3750x &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure it as stack member. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Please review this procedure and give advice.  If you can point me to any vendor documentation that shows a step by step procedure for a switch upgrade like this, I would appreciate it.&lt;/p&gt;&#xA;" OwnerUserId="1860" LastEditorUserId="775" LastEditDate="2013-06-26T20:04:33.113" LastActivityDate="2013-06-26T20:04:33.113" Title="Switch replacement procedure 3560G to 3750X" Tags="|cisco|switch|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2097" PostTypeId="2" ParentId="2095" CreationDate="2013-06-26T05:41:04.783" Score="7" Body="&lt;p&gt;I know the 3750X's have a management interface on the back which is a 10/100 Fast ethernet port. Its right next to the RJ-45 console port. I also believe that the 2960 switch that you listed there also has a management port on the front of it, above the SFP ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming your switches aren't too far away, you could use the management interfaces to manage your devices remotely if you will. Of course you would require additional cabling back to another &quot;management switch&quot; which would likely contain the VLAN required just to manage these devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, you could also run a terminal server server such as an OpenGear or something of that nature and have the console connections linked back to this device in order to remotely control them if your entire network is having issues or what not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These management interfaces do operate on their own VRF and will also not participate in STP as they're not running on the active VLAN that is being trunked down to them. However, I have seen it where some organizations like to have the management VLAN on the same subnet as the hosts on the switch. This allows them to ping and check the arp table/mac address table and pinpoint where devices are a bit easier than if it was just a simple L2 network. There are of course pro's and con's to each method, however, given that you wanted to go about a out-of-band method. I would say the management interface is probably is your best direction.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-26T05:41:04.783" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2098" PostTypeId="2" ParentId="2096" CreationDate="2013-06-26T06:05:31.447" Score="10" Body="&lt;p&gt;I don't think you're going to see any website with direct step-by-step instructions on how to do this. There maybe a few blogs which speak to a blogger's personal experience....however, this is how I would approach it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm going to assume that your current 3560Gs have L3 links to the core and an L2 link (or portchannel) between the two switches. I will also assume that you're using interface tracking to help swap HSRP states and pre-emption and etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While you are adding the 3750X to the original 3560G switches. All you would require is to extend the L2 link to the 3750X stack. You can pre-provision the 2nd 3750X and even have it running and connected when you do this entire process.&lt;br&gt;&#xA;Then move the L3 uplinks from the standby 3560G to the first 3750X and ensure that HSRP is configured in order to facilitate the failover.&lt;br&gt;&#xA;Once that is done...begin migrating your cabling/device cable to the 3750X stack.&lt;br&gt;&#xA;Then move the final 3560G L3 link to the 2nd 3750X switch. You should now also be able to remove the L2 link between the 3750'ss and 2560's and power them off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you're using HSRP - the 3750X's should become active under your control (via a priority change)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, after you are left with just the 3750X in a stack-formation. You will no longer require HSRP to run between the two switches since the 3750X will really be seen as one switch all together. &#xA;Ultimately, the end solution should have 2x L3 uplinks to your core or router, and the VLAN interface existing solely on the 3750X stack. I would also have the each of the L3 links attached to the separate 3750X switches as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This final solution should give you a more robust design from preventing spanning tree and HSRP timers from delaying your network re-convergence and allowing the routing protocol to do the upstream path selection instead of HSRP.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-06-26T06:05:31.447" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2100" PostTypeId="2" ParentId="2089" CreationDate="2013-06-26T11:27:10.997" Score="3" Body="&lt;p&gt;I agree with the answers before me, but I have to add something : if there any filtering on any of the gateways, or on any hop that are passed via only 1 of the 2 gateways, issues are likely to arise!  (hops that get passed via both gateways, such as the source machine, the destination machine, and any &quot;common to both gateway paths&quot; hops, are not concerned with the following scenarios)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if A send packets to B through gateway1, and packets returns via gateway2, then it's highly likely that reply packet will be dropped if gateway2 is doing filtering (because that gateway didn't see the initiating connection packet, so it doesn't expecta reply, thus if the dest/port of the reply packet is usually filtered, it will be filtered.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(There are, of course, many similar scenarios)&lt;/p&gt;&#xA;" OwnerUserId="1221" LastEditorUserId="1221" LastEditDate="2013-06-26T11:32:19.827" LastActivityDate="2013-06-26T11:32:19.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2101" PostTypeId="1" AcceptedAnswerId="2102" CreationDate="2013-06-26T11:41:38.380" Score="6" ViewCount="672" Body="&lt;p&gt;I'm studying CCNA and i've just learnt about Reflexive ACL's. Just wondering how secure or insecure it would be to use an ACL in place of a firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was a LAB router that I would like to set up as my home internet gateway.&lt;/p&gt;&#xA;" OwnerUserId="1834" LastEditorUserId="775" LastEditDate="2013-06-26T12:03:09.057" LastActivityDate="2013-06-27T09:40:40.210" Title="Can I use a reflexive ACL in place of a Firewall?" Tags="|cisco|acl|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2102" PostTypeId="2" ParentId="2101" CreationDate="2013-06-26T12:02:35.430" Score="7" Body="&lt;p&gt;Yes, you can use a reflexive ACL but it couldn't possibly be as secure as a stateful inspection firewall.  Since you are studying for the CCNA, you should build the lab network like real customers do. IOS has a &lt;a href=&quot;http://www.cisco.com/en/US/products/sw/secursw/ps1018/index.html&quot; rel=&quot;nofollow&quot;&gt;real stateful inspection fw&lt;/a&gt;; I would use that.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-27T09:40:40.210" LastActivityDate="2013-06-27T09:40:40.210" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2103" PostTypeId="1" AcceptedAnswerId="2104" CreationDate="2013-06-26T13:24:44.963" Score="25" ViewCount="947" Body="&lt;p&gt;Searching around I haven't been able to determine the best practice for ICMP on a firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example on a Cisco ASA would it be safe and recommended to allow ICMP from any if ICMP inspection is enabled. This would then allow for things like type 3 unreachables to make it back to the clients.&lt;/p&gt;&#xA;" OwnerUserId="192" LastEditorUserId="192" LastEditDate="2013-06-26T15:46:14.190" LastActivityDate="2013-06-26T15:46:14.190" Title="Should IPv4 ICMP from untrusted interfaces be blocked?" Tags="|ipv4|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2104" PostTypeId="2" ParentId="2103" CreationDate="2013-06-26T13:27:32.860" Score="32" Body="&lt;p&gt;No, ICMP should not be blocked. It's vital signalling protocol. Internet does not function without it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PMTUD is broken if you drop ICMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 does not even begin to work without ICMP, as L3 to L2 address resolution (ARP in IPV4) is riding on top of ICMP in IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also troubleshooting will take longer if ICMP echos are dropped. Alas often FW people train of thought appears to be 'when in doubt, drop'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You use FW because your inside network has services not requiring auth or unmanaged hosts running vulnerable software. ICMP really is not a practical attack vector.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-06-26T13:27:32.860" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2107" PostTypeId="2" ParentId="1648" CreationDate="2013-06-26T21:38:18.217" Score="-3" Body="&lt;p&gt;You might find this link helpful&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://arunrkaushik.blogspot.com/2007/10/traceroute-mac-ip.html&quot; rel=&quot;nofollow&quot;&gt;http://arunrkaushik.blogspot.com/2007/10/traceroute-mac-ip.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="127" LastActivityDate="2013-06-26T21:38:18.217" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2108" PostTypeId="1" AcceptedAnswerId="2110" CreationDate="2013-06-27T01:16:50.763" Score="13" ViewCount="12978" Body="&lt;p&gt;I have referenced an old external Cisco article on how to block Bit torrent traffic referenced on-line &lt;a href=&quot;http://www.dslreports.com/forum/r21007872-How-to-lim&quot;&gt;Here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This procedure I have found only works 50% of the time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find blocking bit torrent specific ports, and doing the regex do work, it just does not catch all the traffic. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group service bit-torrent-services tcp-udp&#xA;port-object eq 6969&#xA;port-object range 6881 6999&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;regex bit-torrent-tracker &quot;.*[Ii][Nn][Ff][Oo]_[Hh][Aa][Ss][Hh]=.*&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have more up to date regex for finding bit torrent traffic?&#xA;Or does is this the limits of the ASA at this time?&lt;/p&gt;&#xA;" OwnerUserId="1352" LastActivityDate="2020-11-02T09:50:38.423" Title="How do you block bit torrent traffic with a Cisco ASA?" Tags="|cisco|cisco-asa|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2109" PostTypeId="1" AcceptedAnswerId="2146" CreationDate="2013-06-27T01:23:27.153" Score="9" ViewCount="11693" Body="&lt;p&gt;It appears that Dropbox uses Amazon AWS for it's storage, so I am not able to just block or trottle traffic to dropbox.com &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since there are a lot of web services that rely on AmazonAWS, I cannot just block that domain. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any suggestions on how to handle dropbox traffic? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am working from a cisco ASA, but I suspect this applies to all firewall managers&lt;/p&gt;&#xA;" OwnerUserId="1352" LastEditorUserId="775" LastEditDate="2013-06-27T10:28:54.900" LastActivityDate="2013-06-28T14:38:00.223" Title="How do you throttle Dropbox Traffic?" Tags="|cisco|qos|security|cisco-asa|firewall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2110" PostTypeId="2" ParentId="2108" CreationDate="2013-06-27T02:03:21.097" Score="14" Body="&lt;p&gt;&amp;lt;joke&gt;Unplug it&amp;lt;/joke&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bittorrent clients can (and do) use random ports.  Blocking the common ports will only encourage users to move to different ports.  Also, the inter-client traffic has supported encryption for some years now -- originally as a means to limit ISP interference -- making the actual p-t-p traffic unrecognizable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking for &quot;info_hash&quot; in the client-tracker communication, while somewhat effective, is also easily defeated. (tor, ssl, vpn, etc.) It also does nothing to stop tracker-less swarms (DHT), peer-exchange (PEX), UDP tracker protocol...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you've managed to kill 50%, count yourself lucky.  This is a game of whack-a-mole you cannot win.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-27T02:03:21.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2111" PostTypeId="1" AcceptedAnswerId="2112" CreationDate="2013-06-27T02:27:56.200" Score="4" ViewCount="1446" Body="&lt;p&gt;Is there a way to get a listing of DNS records worldwide that contain a CNAME to a given domain, similar to how some sites provide a listing of domains related to a given IP address?&lt;/p&gt;&#xA;" OwnerUserId="1874" LastActivityDate="2013-06-27T06:46:55.817" Title="Is it possible to get a listing of all DNS records that have a given CNAME?" Tags="|dns|" AnswerCount="2" CommentCount="0" ClosedDate="2018-04-14T03:01:56.623" ContentLicense="CC BY-SA 3.0" />
  <row Id="2112" PostTypeId="2" ParentId="2111" CreationDate="2013-06-27T02:42:15.107" Score="6" Body="&lt;p&gt;&lt;strong&gt;Short answer:  No.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any site purporting to have a list of domains mapped to IP addresses won't be 100% accurate and it's based on what was seen, not what exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you have access to the name servers that may have CNAME records aliases to your domain that you could query or dump the zone files, the best you could do is capture the other hosts names that land on your domain, assuming this is web traffic.  For web, you're looking for the host header in the HTTP request.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-27T06:46:55.817" LastActivityDate="2013-06-27T06:46:55.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2113" PostTypeId="2" ParentId="2111" CreationDate="2013-06-27T02:45:28.697" Score="6" Body="&lt;p&gt;&lt;em&gt;worldwide&lt;/em&gt;? Not on your life.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those domain info sites know what IP is what because they're doing DNS lookups of &lt;em&gt;a lot&lt;/em&gt; of hosts, and they keep detailed records of the answer(s).  They can tell you want domains are (or have been) using an IP based on the domains they've queried.  They cannot tell you about something they aren't tracking!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same is true of CNAMEs.  You can only know what you've seen.  If I add a record to my zone file, no one will know about it until they've queried &lt;em&gt;my&lt;/em&gt; record.  The RHS knows nothing about my DNS record, as there's no &quot;referer&quot; in DNS. (RHS = Right Hand Side) If I create a CNAME &lt;code&gt;bar CNAME foo.example.com.&lt;/code&gt; The admins at example.com will have no idea I've create &lt;code&gt;bar.&amp;lt;my domain&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-06-27T02:45:28.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2115" PostTypeId="2" ParentId="2108" CreationDate="2013-06-27T05:48:35.853" Score="8" Body="&lt;p&gt;Configure it in transparent proxy mode for all supported application protocols and allow only proxified connections. Any unknown protocol would fail including BitTorrent. SSL tunneling for BitTorrent is unfeasible so HTTPS isn't too big of a hole. Letting through any routed connection which hasn't been L7 approved will let BitTorrent slip through.&lt;/p&gt;&#xA;" OwnerUserId="1807" LastEditorUserId="1807" LastEditDate="2020-11-02T08:49:03.317" LastActivityDate="2020-11-02T08:49:03.317" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="2116" PostTypeId="1" CreationDate="2013-06-27T09:00:02.107" Score="2" ViewCount="378" Body="&lt;p&gt;Was just wondering if anyone has any insight into this. I have an issue with IPADs roaming when connected to a specific SSID in a large campus network design. The APs are managed via a WLC from HP. I know when you lock the screen and reconnect at a diff AP you have the issue of the IOS trying to reconnect to the mac of the last AP - however the problem exists without the screen locking. It takes the Ipad several seconds (&amp;lt;10) to find the new AP and use it. I have deactivated band steering (this would try and force the AP to use 5GHz and takes ages..) for the specific SSID and have mapped it to all AP.&#xA;Perhaps someone has other ideas?&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="775" LastEditDate="2013-06-27T09:36:50.537" LastActivityDate="2013-06-27T09:38:05.603" Title="IPAD Roaming on HP APs" Tags="|wireless|ieee-802.11|wlc|hp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2117" PostTypeId="2" ParentId="2116" CreationDate="2013-06-27T09:38:05.603" Score="3" Body="&lt;p&gt;There's quite a few issues that can cause things like this to happen. I've had a quick look around and apparently there's a common issue with iPhone/iPads roaming where your authentication is WPA+WPA2. You want to set &lt;strong&gt;either&lt;/strong&gt; WPA2/AES or WPA/TKIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can get on the controller, I would run debug (I don't know with HP WLCs) to try and ascertain whether the iPad is disconnecting from the WLAN entirely, or if the connection is dropping, but it remains associated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than that, run through the basics, make sure its not the iPad acting up by testing it somewhere else, preferably on a different WLAN (probably not possible), make sure no other devices are suffering from the same problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry I can't be more specific, but I've not used any of the HP WLCs before.&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastActivityDate="2013-06-27T09:38:05.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2118" PostTypeId="2" ParentId="2109" CreationDate="2013-06-27T10:17:25.147" Score="12" Body="&lt;p&gt;Even though dropbox uses AWS, they can be blocked...&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Blocking Dropbox&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I use an address-based approach for stuff like this, just lookup the address blocks that said company owns and filter it...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;a href=&quot;http://as.robtex.com/as19679.html&quot;&gt;Robtex information for AS19679 (Dropbox)&lt;/a&gt; to block dropbox...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network DROPBOX_AS19679&#xA; network-object 108.160.160.0 255.255.240.0&#xA; network-object 199.47.216.0 255.255.252.0&#xA;!&#xA;! I assume you don't care whether you also block web / email traffic to dropbox.com...&#xA;! The following ACL should be applied inbound on your Inside interface&#xA;access-list &amp;lt;your-acl-name&amp;gt; extended deny ip any object-group DROPBOX_AS19679 log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;FYI, &lt;a href=&quot;https://www.dropbox.com/help/21/en&quot;&gt;Dropbox supports connecting via http proxy&lt;/a&gt; so if your proxy is not in the path of the ACL above, be sure you block dropbox on your proxy too.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Throttling Dropbox&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I did some research after I got home from work... when I tested, Dropbox uses a combination of their own native address space and AWS address space for connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dropbox used SSL so it was hard to tell exactly what they were doing, but if I look at sequencing it looks like when you move a file in or out of your local &lt;code&gt;Dropbox/&lt;/code&gt; folder, first they talk to their own address blocks, then they use AWS for a bulk transfer as-required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since they used AWS for most of the bytes I saw, I'm not confident you can easily throttle them using address blocks alone; however, at least today they can be blocked with ACLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is a summary, see below for all &lt;em&gt;Supporting Syslog Information&lt;/em&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Time       Action               Connection No.   Destination    ASA Bytes&#xA;--------   -------------------  --------------   ------------   ---------&#xA;22:26:51   Delete-dropbox-file  591637           Dropbox            6965&#xA;22:26:51   &quot;                    591638           Dropbox           11590&#xA;22:28:46   Paste-into-dropbox   591738           Dropbox            7317&#xA;22:28:46   &quot;                    591741           AWS             2422218&#xA;22:28:46   &quot;                    591788           Dropbox            7674&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since Dropbox dynamically uses AWS address space, they can't be effectively throttled, but I will give an example of what you would do for &lt;em&gt;other non-AWS sites / applications&lt;/em&gt;, using Dropbox's address space as an example... you would also need to define an &lt;code&gt;object-group&lt;/code&gt; for your &quot;Inside&quot; address blocks (FYI, I'm using ASA 8.2)...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list ACL_Dropbox extended permit ip object-group Inside object-group DROPBOX_AS19679&#xA;access-list ACL_Dropbox extended permit ip object-group DROPBOX_AS19679 object-group Inside&#xA;!&#xA;class-map Class_Dropbox&#xA; match access-list ACL_Dropbox&#xA;!&#xA;policy-map Policy_Police&#xA; class Class_Dropbox&#xA;  police input 384000&#xA;  police output 384000&#xA; class class-default&#xA;!&#xA;service-policy Policy_Police interface INSIDE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I use this technique to throttle bandwidth to a number of social networking sites (such as Facebook), and it's quite effective.  I automated periodic checks for address block changes and add anything else the targets start announcing... automation, of course, is not required.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Supporting Syslog Information&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jun 27 22:26:51 10.100.1.1 %ASA-6-302013: Built outbound TCP connection 591637 for OUTSIDE:108.160.160.177/443 (108.160.160.177/443) to INSIDE:mpenning_Vista/56957 (11.40.219.148/28663)&#xA;Jun 27 22:26:51 10.100.1.1 %ASA-6-302013: Built outbound TCP connection 591638 for OUTSIDE:108.160.160.177/443 (108.160.160.177/443) to INSIDE:mpenning_Vista/56958 (11.40.219.148/54828)&#xA;Jun 27 22:28:12 10.100.1.1 %ASA-6-302014: Teardown TCP connection 591637 for OUTSIDE:108.160.160.177/443 to INSIDE:mpenning_Vista/56957 duration 0:01:21 bytes 6965 TCP FINs&#xA;Jun 27 22:28:12 10.100.1.1 %ASA-6-302014: Teardown TCP connection 591638 for OUTSIDE:108.160.160.177/443 to INSIDE:mpenning_Vista/56958 duration 0:01:20 bytes 11590 TCP FINs&#xA;Jun 27 22:28:46 10.100.1.1 %ASA-6-302013: Built outbound TCP connection 591738 for OUTSIDE:108.160.160.177/443 (108.160.160.177/443) to INSIDE:mpenning_Vista/56959 (11.40.219.148/17163)&#xA;Jun 27 22:28:46 10.100.1.1 %ASA-6-302013: Built outbound TCP connection 591741 for OUTSIDE:174.129.221.92/443 (174.129.221.92/443) to INSIDE:mpenning_Vista/56960 (11.40.219.148/15739)&#xA;Jun 27 22:29:05 10.100.1.1 %ASA-6-302013: Built outbound TCP connection 591788 for OUTSIDE:108.160.160.177/443 (108.160.160.177/443) to INSIDE:mpenning_Vista/56961 (11.40.219.148/36777)&#xA;Jun 27 22:29:05 10.100.1.1 %ASA-6-302014: Teardown TCP connection 591738 for OUTSIDE:108.160.160.177/443 to INSIDE:mpenning_Vista/56959 duration 0:00:19 bytes 7317 TCP FINs&#xA;Jun 27 22:30:12 10.100.1.1 %ASA-6-302014: Teardown TCP connection 591741 for OUTSIDE:174.129.221.92/443 to INSIDE:mpenning_Vista/56960 duration 0:01:25 bytes 2422218 TCP FINs&#xA;Jun 27 22:30:12 10.100.1.1 %ASA-6-302014: Teardown TCP connection 591788 for OUTSIDE:108.160.160.177/443 to INSIDE:mpenning_Vista/56961 duration 0:01:07 bytes 7674 TCP FINs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-28T04:09:05.990" LastActivityDate="2013-06-28T04:09:05.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2119" PostTypeId="1" CreationDate="2013-06-27T12:31:41.270" Score="8" ViewCount="652" Body="&lt;p&gt;I am having a hard time understanding certain terminology and setup when it comes to packet capturing. Example. At my company we use NetScout and the various services such as PFS(Packet forwading switch) and TAPs and Infinistream. My problem is what is the difference between a PFS and a TAP? Seems like they do the exact same thing. &#xA;Also if you look at packet captures and the absolute time, is that the time the data hit the wire of the time that the TAP so the data. Sorry If my question is not all that clear.&lt;/p&gt;&#xA;" OwnerUserId="495" LastActivityDate="2013-06-27T18:58:16.537" Title="packet capturing" Tags="|cisco|tap|packet-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2120" PostTypeId="2" ParentId="2119" CreationDate="2013-06-27T13:14:46.160" Score="9" Body="&lt;p&gt;Not sure if you meant general packet analysis , but most people use some form of Wireshark and therefore I cannot recommend Jeremy's Cheat cheat &lt;a href=&quot;http://packetlife.net/blog/2008/oct/18/cheat-sheets-tcpdump-and-wireshark/&quot; rel=&quot;noreferrer&quot;&gt;Wireshark Cheat sheet&lt;/a&gt; enough.&lt;/p&gt;&#xA;&lt;p&gt;additionally the Wireshark doc page has a wealth of fantastic information including the &lt;a href=&quot;https://www.wireshark.org/download/docs/user-guide-a4.pdf&quot; rel=&quot;noreferrer&quot;&gt;Wireshark Users Guide&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;not sure if this answers your question but hopefully is will lead you in the right direction&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The nGenius packet flow switches enable the IT organization to better capture monitored traffic with high-density packet aggregation and intelligent filtering capabilities to enable a more flexible and comprehensive approach to capturing, collecting and leveraging important packet flows. Complementary to the widely deployed nGenius InfiniStream appliance, the nGenius packet flow switches are a cost-effective way to further strengthen a pervasive visibility strategy by providing the granular control of packet flows needed for performance management, security monitoring, compliance monitoring, management, UC monitoring, and other similar types of applications.&lt;/p&gt;&#xA;&lt;p&gt;The NetScout TAP family provides the nGenius InfiniStream appliances and nGenius packet flow switches with full access to network traffic while remaining transparent to the networking infrastructure, and hence causing no disruption to data flows or protocol transactions. The family includes multiple options for link types and speeds to support versatile packet flow capturing at a wide variety of locations in the network hierarchy.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Summary:&lt;/strong&gt;&#xA;The  Packet flow switches are highly resilient data centre 10g – 40g chassis switches that essentially provides real-time packet flow data to several monitoring applications at the same time&#xA;&lt;img src=&quot;https://i.stack.imgur.com/22kUk.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;The TAP appliance is deployed transparently inline and then offloads the streams to a single monitoring platform.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2C3kS.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-06-27T18:58:16.537" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2122" PostTypeId="1" AcceptedAnswerId="2140" CreationDate="2013-06-27T15:41:28.563" Score="18" ViewCount="25320" Body="&lt;p&gt;&lt;strong&gt;Background&lt;/strong&gt;&lt;br&gt;&#xA;I am trying to redeploy Cisco 1242 LWAPs on new Cat4507R+E switches, which means the IP address of the WLC is changing for that LWAP.  For some reason, I have to configure &lt;code&gt;ip helper-addresses&lt;/code&gt; on my AP vlan to jumpstart communication between my Cisco AP1242 APs and the WLC; I have DHCP (with Option 43) on the AP Vlan, but I don't know why the AP is ignoring the DHCP Option.&lt;/p&gt;&#xA;&lt;p&gt;DHCP runs on Cisco 4507R+E switches...  The switches are configured with DHCP Option 43 (Single WLC address: 10.19.3.209 / hex: 0a13.03d1) and Option 60...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool lwap_v99&#xA; network 10.1.1.0 255.255.255.0&#xA; default-router 10.1.1.254&#xA; dns-server 10.19.26.225&#xA; option 43 hex f104.0a13.03d1&#xA; option 60 ascii &amp;quot;Cisco AP c1240&amp;quot;&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The AP is getting a DHCP address...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;WL-DST2#sh ip dhcp bind&#xA;Bindings from all pools not associated with VRF:&#xA;IP address          Client-ID/              Lease expiration        Type&#xA;                    Hardware address/&#xA;                    User name&#xA;10.1.1.17           0158.8d09.03ec.de       Jun 28 2013 03:07 AM    Automatic&#xA;WL-DST2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-26920&quot; rel=&quot;nofollow noreferrer&quot;&gt;Using wireshark on Supervisor 7&lt;/a&gt;, I can see that the APs are ignoring Option 43; instead, the APs (for example, 10.1.1.17) are broadcasting CAPWAP packets and never send a unicast request...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;WL-DST2#sh monitor capture file bootflash:mycap.pcap | i CAPWAP&#xA;681 597.979997    10.1.1.17 -&amp;gt; 10.19.26.225 DNS Standard query A CISCO-CAPWAP-CONTROLLER&#xA;684 600.977998    10.1.1.17 -&amp;gt; 10.19.26.225 DNS Standard query A CISCO-CAPWAP-CONTROLLER&#xA;689 603.977998    10.1.1.17 -&amp;gt; 10.19.26.225 DNS Standard query A CISCO-CAPWAP-CONTROLLER&#xA;705 615.975999    10.1.1.17 -&amp;gt; 255.255.255.255 CAPWAP CAPWAP-Control - Discovery Request&#xA;715 625.974001    10.1.1.17 -&amp;gt; 255.255.255.255 CAPWAP CAPWAP-Control - Discovery Request&#xA;728 635.970995    10.1.1.17 -&amp;gt; 255.255.255.255 CAPWAP CAPWAP-Control - Discovery Request&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I validated that DHCP is offering Option 43 in the DHCP Offer message...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Option: (t=43,l=13) Vendor-Specific Information&#xA;    Option: (43) Vendor-Specific Information&#xA;    Length: 13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I tried setting both &lt;code&gt;option 43 ascii &amp;quot;10.19.3.209&amp;quot;&lt;/code&gt; and &lt;code&gt;option 43 hex f104.0a13.03d1&lt;/code&gt;... both of these are ignored by the AP.  I also tried [hard-resetting the AP with the mode button].&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Workaround for non-functional DHCP Option 43 &amp;amp; 60&lt;/strong&gt;&lt;br&gt;&#xA;At this point, the only thing that makes the AP talk to the WLC is a helper-address (for udp/5246 &amp;amp; udp/5247) on the Vlan...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface Vlan99&#xA; ip address 10.1.1.252 255.255.255.0&#xA; ip helper-address 10.19.3.209      &amp;lt;------&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; standby 99 ip 10.1.1.254&#xA;!&#xA;ip forward-protocol udp 5246        &amp;lt;------&#xA;ip forward-protocol udp 5247        &amp;lt;------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;How do I use DHCP to make these APs use unicast packets to initiate CAPWAP with the WLC? FWIW, I don't want to use DNS to direct the APs to the WLC.&lt;/p&gt;&#xA;&lt;p&gt;Version information for the AP / WLC system...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(Cisco Controller) &amp;gt;show ap config general AP588d.0903.ecde&#xA;...&#xA;S/W  Version .................................... 7.3.101.0&#xA;Boot  Version ................................... 12.4.13.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The 4507R+E switches are running IOS-XE 3.4.0SG&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2020-10-09T15:14:40.583" LastActivityDate="2020-10-09T15:14:40.583" Title="Cisco APs ignore DHCP Option 43 and use CAPWAP UDP broadcasts" Tags="|cisco|wireless|ieee-802.11|dhcp|wlc|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2123" PostTypeId="1" CreationDate="2013-06-27T16:16:41.367" Score="8" ViewCount="1399" Body="&lt;p&gt;When turning up a new port on a 2248 FEX, when the &quot;private-vlan host association &lt;em&gt;primary secondary&lt;/em&gt;&quot; command is put on an interface BEFORE the server is cabled up, the interface goes into an &quot;inactive&quot; state and will not come up by bouncing the port. However, when the pvlan host association command is removed and re-added, the interface then comes up right away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't found any Cisco documentation describing the issue. Does anyone know if this is a bug? Has anyone else seen this issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand why the port must be cabled up before adding pvlan configuration.&lt;/p&gt;&#xA;" OwnerUserId="1821" LastActivityDate="2013-09-12T17:25:19.367" Title="FEX 2248 private-vlan host association causes int to show &quot;inactive&quot;" Tags="|cisco-nexus-2000|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2124" PostTypeId="1" AcceptedAnswerId="2126" CreationDate="2013-06-27T16:54:58.123" Score="6" ViewCount="149" Body="&lt;p&gt;Is there a way to allow access to SSLVPN services based on groups in AD without configuring DAP?  I know with DAP you can easily do this - however - the company that manages the firewall would have to create a 'service exception' for this type of config - which takes a long time and the asking party would like to move ahead with a solution rapidly, so I'm looking for alternatives.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2013-06-27T17:22:57.043" Title="Authentication by group in LDAP for VPN without DAP?" Tags="|sslvpn|authentication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2125" PostTypeId="2" ParentId="2122" CreationDate="2013-06-27T17:10:08.933" Score="2" Body="&lt;p&gt;I can't speak to Option 43 being ignored but can you put in a DNS entry for CISCO-CAPWAP-CONTROLLER.domain-given-by-dhcp and point it at 10.19.3.209?  That should let them unicast to the controller.&lt;/p&gt;&#xA;" OwnerUserId="165" LastActivityDate="2013-06-27T17:10:08.933" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2126" PostTypeId="2" ParentId="2124" CreationDate="2013-06-27T17:22:57.043" Score="6" Body="&lt;p&gt;Would using Radius be an option? You can differentiate AD groups using radius attribute 25 (class). Full walk through from Jeff Boyer on the Cisco forums may be found at:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-15074&quot;&gt;https://supportforums.cisco.com/docs/DOC-15074&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-06-27T17:22:57.043" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2127" PostTypeId="2" ParentId="2123" CreationDate="2013-06-27T17:47:52.003" Score="6" Body="&lt;p&gt;Whenever you're configuring a FEX switchport, you must ensure that the configuration is consistent across both parent switches (i.e. Nexus 5K). You can do this manually or use the config-sync feature to simplify your configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;N5K-A(config)# interface e100/1/40&#xA;N5K-A(config-int)# switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HOWEVER - you must repeat this configuration on the same port on the other control plane (other Nexus parent switch) because the configurations are not sync'd automatically by default.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;N5K-B(config)# interface e100/1/40&#xA;N5K-B(config-int)# switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the configuration for a FEX switchport doesn't match on both parent switches, it will place it into &quot;inactive&quot; state as you describe.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastEditorUserId="1007" LastEditDate="2013-06-27T19:04:42.013" LastActivityDate="2013-06-27T19:04:42.013" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2128" PostTypeId="5" CreationDate="2013-06-27T21:16:00.393" Score="0" Body="&lt;p&gt;(Packet-analysis) aka  Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network  Provides the details of network activities and their communication pattern in a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network traffic analysis&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Network monitoring&lt;/li&gt;&#xA;&lt;li&gt;Network planning&lt;/li&gt;&#xA;&lt;li&gt;Performance analysis and improvement&lt;/li&gt;&#xA;&lt;li&gt;prioritize important trafc with guaranteed bandwidth&lt;/li&gt;&#xA;&lt;li&gt;Security analysis&lt;/li&gt;&#xA;&lt;li&gt;Detect and deny anomalous traffic to make our network safer&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="1092" LastEditDate="2013-06-28T01:47:09.020" LastActivityDate="2013-06-28T01:47:09.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2129" PostTypeId="4" CreationDate="2013-06-27T21:16:00.393" Score="0" Body="(Packet-analysis) aka  Network Traffic analysis is the process of capturing network traffic and inspecting it closely to determine what is happening on the network  Providesthe details of network activities and their communication pattern in a network" OwnerUserId="1092" LastEditorUserId="1092" LastEditDate="2013-06-28T01:47:14.443" LastActivityDate="2013-06-28T01:47:14.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2130" PostTypeId="1" CreationDate="2013-06-27T21:16:03.047" Score="13" ViewCount="60977" Body="&lt;p&gt;I've got monitoring setup on several devices in our office.  The ping response time to small access switches is commonly 1-4ms... As of 3AM this morning, this has sky-rocketed to 300ms on average.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where does one start looking in a situation like this?&#xA;What things can I observe in the switch to find the source of latency?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: It's not load related.. all the links bandwidth usage is normal and unaffected, most links are very under utilized.  Also - monitoring is local to the devices reporting the latency so there is no WAN factor here.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2017-12-01T00:02:25.507" Title="How to find the source of increased latency?" Tags="|latency|" AnswerCount="4" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="2131" PostTypeId="2" ParentId="2130" CreationDate="2013-06-27T21:19:04.273" Score="6" Body="&lt;p&gt;First, latency isn't directly tied to bandwidth. There are many reasons why a device would delay a packet other than a congested link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you attempted a traceroute? This will show you the latency between hops, if you're looking for a L3 boundary as a suspect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also check to see if any of the devices in the path have a significant usage of CPU/RAM.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-06-27T21:19:04.273" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2132" PostTypeId="2" ParentId="2130" CreationDate="2013-06-27T22:57:24.923" Score="2" Body="&lt;p&gt;I use cacti to monitor bandwidth, and openNMS to monitor latency. If you are monitoring all the devices linked to this switch you may see a corollary between usage and the latency. (i know you said it is not a bandwidth issue, but you never now) I have seen lower-end switches sag under heavy usage, which causes a lot of latency. Do you have any &quot;dumb&quot; devices feeding this switch that may be the source of the sag even though this switch is not passing much traffic.  Also with cacti you may be able to poll the CPU usage, and you may see a spike at the time of the latency. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As mentioned above, MTR or neotrace are also useful to keep an eye on the situation and you may see where the latency starts, which may not be this switch itself. &lt;/p&gt;&#xA;" OwnerUserId="1352" LastActivityDate="2013-06-27T22:57:24.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2133" PostTypeId="2" ParentId="2055" CreationDate="2013-06-28T06:55:36.313" Score="1" Body="&lt;p&gt;This will probably bust your requirements concerning bandwidth, but you could use a snmp discovery sw like &quot;the dude&quot;. You would need to set community and private vlans appropriately in order for the snmp traffic to get back to the server. &#xA;If you are interested in this solution I could give you more details as to vlans and sw setting required.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="775" LastEditDate="2013-06-28T09:29:01.880" LastActivityDate="2013-06-28T09:29:01.880" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2134" PostTypeId="1" AcceptedAnswerId="2135" CreationDate="2013-06-28T07:33:31.577" Score="19" ViewCount="32479" Body="&lt;p&gt;Recently the routing engine CPU utilization on two of our Juniper peering routers increased from ~10-20% average load to 80+%. I'm trying to figure out what's causing this (and how to get this high load back down).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some info on the routers: both run the same JunOS version, both are connected to the same two peering IXP LANs and have a large number (several hundreds) of (almost identical) IPv4 and IPv6 sessions. Both routers have a connection to a different IP transit provider and are connected in the same way to the rest of our network. The routing engines' CPU load isn't flatline on 80+%, there are drops back to normal levels for minutes to hours, but these drops are not that often.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Things I've checked:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;no configuration changes have been made at the moment the increase started&lt;/li&gt;&#xA;&lt;li&gt;there's no increase in non-unicast traffic directed at the control plane&lt;/li&gt;&#xA;&lt;li&gt;there's no (substantial) change in the amount of traffic being forwarded (though even a increase shouldn't matter)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;show system processes summary&lt;/code&gt; indicates the &lt;code&gt;rpd&lt;/code&gt; process is causing the high CPU load&lt;/li&gt;&#xA;&lt;li&gt;there are no rapidly flapping BGP peers causing a large amount of BGP changes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;One possible explanation I can come up with is a peer (or more than one) on one of the IXP's both routers are connected to sending a large number of BGP updates. Currently I only have statistics on the number of BGP messages for my transit sessions (showing no abnormal activity) and with several hundreds of BGP sessions on the peering LANs it's not that easy to spot the problematic session(s) if I should create graphs for all sessions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;are there any other things I should check to find the cause of this&#xA;increase in CPU load on the routing engines?&lt;/li&gt;&#xA;&lt;li&gt;how can I easily find out which sessions are causing these problems&#xA;(if my assumption is right)? Enabling BGP traceoptions generates huge&#xA;amounts of data, but I'm not sure if it gives me any real insights.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="509" LastEditorUserId="3191" LastEditDate="2014-02-23T15:36:59.080" LastActivityDate="2019-03-28T04:30:19.527" Title="Cause of high CPU load on Juniper peering router's routing engine" Tags="|router|juniper|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2135" PostTypeId="2" ParentId="2134" CreationDate="2013-06-28T07:45:00.047" Score="17" Body="&lt;p&gt;There might be some helpful information for you at the &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB26261#rpd&quot;&gt;Juniper Knowledge Center&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If RPD is consuming high CPU, then perform the following checks and verify the following parameters:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Check the interfaces: Check if any interfaces are flapping on the router. This can be verified by looking at the output of the show log messages and show interfaces ge-x/y/z extensive commands. Troubleshoot why they are flapping; if possible you can consider enabling the hold-time for link up and link down.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check if there are syslog error messages related to interfaces or any FPC/PIC, by looking at the output of show log messages.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check the routes:  Verify the total number of routes that are learned by the router by looking at the output of show route summary. Check if it has reached the maximum limit.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check the RPD tasks: Identify what is keeping the process busy. This can be checked by first enabling set task accounting on.  Important:  This itself might increase the load on CPU and its utilization; so do not forget to turn it off when you are done with the required output collection.  Then run show task accounting and look for the thread with the high CPU time:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@router&amp;gt; show task accounting&#xA;Task                       Started    User Time  System Time  Longest Run&#xA;Scheduler                   146051        1.085        0.090        0.000&#xA;Memory                           1        0.000            0        0.000  &amp;lt;omit&amp;gt;&#xA;BGP.128.0.0.4+179              268       13.975        0.087        0.328&#xA;BGP.0.0.0.0+179      18375163 1w5d 23:16:57.823    48:52.877        0.142&#xA;BGP RT Background              134        8.826        0.023        0.099&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Find out why a thread, which is related to a particular prefix or a protocol, is taking high CPU.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You can also verify if routes are oscillating (or route churns) by looking at the output of the shell command: &lt;code&gt;%rtsockmon –t&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check RPD Memory. Some times High memory utilization might indirectly lead to high CPU.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerDisplayName="user275" LastEditorUserId="3191" LastEditDate="2014-02-23T13:50:47.377" LastActivityDate="2014-02-23T13:50:47.377" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2137" PostTypeId="2" ParentId="2130" CreationDate="2013-06-28T07:58:25.210" Score="3" Body="&lt;p&gt;if this is just based on the LAN, there's a few things you can do to start off to try and find out what is causing this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Show process cpu history&lt;/strong&gt; command: if the CPU usage is very high, then you need to see which process is causing this and perhaps hit google with the offending process.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;show debug&lt;/strong&gt; command: a common cause I've found is people leaving debug commands running on the switch. A common favourite was IP accounting being left on devices that were already over-utilized. Use &quot;undebug all&quot; to get rid of the debugs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Give it a reboot&lt;/strong&gt;: probably not possibly during the day, but use the &quot;reload in&quot; command to time it at night or over the weekend. You'd be surprised how many issues a quick reboot can fix.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;shut trunk ports&lt;/strong&gt; - If its a L3 switch, another common issue I've seen is too much traffic using this device for routing between VLANs. If possible, temporarily shut some of the trunk ports to see if this reduces the latency.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Its good to be aware that your pings are low priority, in regards to latency and also when being processed by the CPU. Might also be a good idea to double check your QoS settings and make sure there's no silly mistakes causing this, as much as that is unlikely.&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastActivityDate="2013-06-28T07:58:25.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2138" PostTypeId="2" ParentId="2057" CreationDate="2013-06-28T08:03:02.510" Score="2" Body="&lt;p&gt;Simplest solution is to attach a policer to the access ports:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;!&#xA;policy-map ingress-limit&#xA; class class-default&#xA;  police 800M 1000000 exceed-action drop&#xA; !&#xA;!&#xA;interface gigabitEthernet0/1&#xA; description port connected to NetApp&#xA; service-policy input ingress-limit&#xA;!&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or, else, you should deploy something more sophisticated and QoS mark your packet at the ingress on access ports and shape them with WRR at the egress on uplink ones.&#xA;In that way you would throttle NetApp's up to 80% only when congestion occurs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;!&#xA;mls qos&#xA;!&#xA;class-map match-any bulk-data&#xA; match input-interface gigabitEthernet0/1&#xA;!&#xA;!&#xA;policy-map classifier&#xA; class bulk-data&#xA;  set dscp AF11&#xA; class class-default&#xA;  set dscp AF31&#xA;!&#xA;interface range gigabitEthernet 0/1 - 22&#xA; service-policy input classifier&#xA; srr-queue bandwidth shape  0  0  0  0&#xA;!&#xA;interface range gigabitEthernet 0/23 - 24&#xA; description uplink ports&#xA; srr-queue bandwidth shape  0  0  0  0&#xA; srr-queue bandwidth share  1 80 20 1&#xA;!&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="530" LastActivityDate="2013-06-28T08:03:02.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2140" PostTypeId="2" ParentId="2122" CreationDate="2013-06-28T09:06:38.383" Score="12" Body="&lt;p&gt;Cisco LWAPs will do this process in order to try and find a controller:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;CAPWAP broadcast on the local subnet&lt;/li&gt;&#xA;&lt;li&gt;Check NVRAM for previous controllers/mobility groups and try those.&lt;/li&gt;&#xA;&lt;li&gt;OTAP (remove now though)&lt;/li&gt;&#xA;&lt;li&gt;DHCP Option 43/60&lt;/li&gt;&#xA;&lt;li&gt;DNS Lookup for &quot;CISCO-CAPWAP-CONTROLLER.localdomain&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If the controllers are on the local subnet, then it will find those via broadcast, if you have an IP helper pointing to the controller as well as ip forward-protocol on 5246/12223 it will find it that way too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The APs also keep previously joined controllers in NVRAM, and will connect to those before option 43.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that these will happen in this order! I had an issue installing a new WLAN whilst a legacy WLAN was in use, and the IT guy had plugged in some of the APs, so they were going to the WLCs in their NVRAM instead of using option 43 like I had wanted. I factory reset on the APs solved this however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference is here (quite old):&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a00806c9e51.shtml&quot;&gt;http://www.cisco.com/en/US/tech/tk722/tk809/technologies_tech_note09186a00806c9e51.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastActivityDate="2013-06-28T09:06:38.383" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="2141" PostTypeId="1" AcceptedAnswerId="3205" CreationDate="2013-06-28T10:13:30.393" Score="14" ViewCount="49918" Body="&lt;p&gt;We have migrated to a new ISP who provide us several services (Internet+VoIP+VoD) and have divided each service in one vlan 100,101,102 respectively. &#xA;Now I'm looking for a solution to monitor each service and measure the bandwidth on each vlan. I know we don't have counters on L3 SVI interface.&#xA;I though the port-channel sub-interface have counters operational but don't. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We receive on 4500-X the 3 vlans/services and trunk them to vlan 604 to CMTS. The vlan 260 is for IPTV Multicast. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, I use cacti to monitor bandwidth on interface and I need a similar way to do it on vlans. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe Netflow can solve the problem but before invest on it I would like yours considerations to found a simpler solution as Cacti. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the &lt;a href=&quot;https://www.dropbox.com/s/v79dyqrmkmk909d/network_pictures.jpg&quot; rel=&quot;noreferrer&quot;&gt;topology&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;============4500-X==================&#xA;!----------ingress - From ISP-----------------&#xA;sw-4500-X#sh run int te1/1/15 &#xA;Building configuration...&#xA;&#xA;Current configuration : 171 bytes&#xA;!&#xA;interface TenGigabitEthernet1/1/15&#xA; description Po from ISP &#xA; switchport trunk allowed vlan 100-102&#xA; switchport mode trunk&#xA; channel-group 5 mode active&#xA;end&#xA;&#xA;sw-4500-X#sh run int te2/1/15&#xA;Building configuration...&#xA;&#xA;Current configuration : 171 bytes&#xA;!&#xA;interface TenGigabitEthernet2/1/15&#xA; description Po from ISP &#xA; switchport trunk allowed vlan 100-102&#xA; switchport mode trunk&#xA; channel-group 5 mode active&#xA;end&#xA;&#xA;!----------egress port to CMTS------------------&#xA;sw-4500-X#sh run int te1/1/1&#xA;Building configuration...&#xA;&#xA;Current configuration : 192 bytes&#xA;!&#xA;interface TenGigabitEthernet1/1/1&#xA; description link Po1 -&amp;gt; CMTS (te2/0/0)&#xA; switchport trunk allowed vlan 260,706&#xA; switchport mode trunk&#xA; load-interval 30&#xA; channel-group 1 mode on&#xA;end&#xA;&#xA;sw-4500-X#sh run int te2/1/1&#xA;Building configuration...&#xA;&#xA;Current configuration : 192 bytes&#xA;!&#xA;interface TenGigabitEthernet2/1/1&#xA; description link Po1 -&amp;gt; CMTS (te1/0/0)&#xA; switchport trunk allowed vlan 260,706&#xA; switchport mode trunk&#xA; load-interval 30&#xA; channel-group 1 mode on&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the output of snmpwalk   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root@unix ~]# snmpwalk -v 2c -c rw_community &amp;lt;IP-4500-x&amp;gt; IF-MIB::ifName&#xA;....&#xA;IF-MIB::ifName.168 = STRING: VLAN-100  &#xA;IF-MIB::ifName.169 = STRING: VLAN-101   &#xA;IF-MIB::ifName.170 = STRING: Vl100  &#xA;IF-MIB::ifName.171 = STRING: VLAN-102  &#xA;IF-MIB::ifName.172 = STRING: Vl101  &#xA;IF-MIB::ifName.173 = STRING: Vl102  &#xA;...&#xA;&#xA;[root@unix ~]# snmpwalk -v 2c -c rw_community &amp;lt;IP-4500-x&amp;gt; IF-MIB::ifName.168&#xA;IF-MIB::    IFName.168 = STRING: VLAN-100&#xA;[root@unix ~]# snmpwalk -v 2c -c rw_community &amp;lt;IP-4500-x&amp;gt;     IF-MIB::    IFHCInUcastPkts.168&#xA;IF-MIB::    IFHCInUcastPkts.168 = No Such Instance currently exists at this OID&#xA;[root@unix ~]# snmpwalk -v 2c -c rw_community &amp;lt;IP-4500-x&amp;gt;     IF-MIB::    IFHCOutUcastPkts.168&#xA;IF-MIB::    IFHCOutUcastPkts.168 = No Such Instance currently exists at this OID&#xA;[root@unix ~]# snmpwalk -v 2c -c rw_community &amp;lt;IP-4500-x&amp;gt;     IF-MIB::    IFHCInOctets.168&#xA;IF-MIB::    IFHCInOctets.168 = No Such Instance currently exists at this OID&#xA;[root@unix ~]# snmpwalk -v 2c -c rw_community &amp;lt;IP-4500-x&amp;gt;     IF-MIB::    IFHCOutOctets.168&#xA;IF-MIB::    IFHCOutOctets.168 = No Such Instance currently exists at this OID&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if I try with .170 I get &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root@unix ~]# snmpwalk -v 2c -c rw_community &amp;lt;IP-4500-x&amp;gt; IF-MIB:ifHCInUcastPkts.170&#xA;IF-MIB::ifHCInUcastPkts.170 = Counter64: 0&#xA;[root@unix ~]# snmpwalk -v 2c -c rw_community &amp;lt;IP-4500-x&amp;gt; IF-MIB:ifHCOutOctets.170&#xA;IF-MIB::ifHCOutOctets.170 = Counter64: 325414481&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This get me another question : &#xA;Why this difference in the same interface (VLAN-100 and Vl100) ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main question is still unanswered because the OID I get are for the packets and bytes counters on interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to get is the Bandwidth measurement on some vlan. So far I only see Netflow as a probable solution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to add on Cacti and I'm having some issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Graph showed when I add interface vlan100: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hHXIj.png&quot; alt=&quot;cacti&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to add such interface and made calculation to show right traffic graph ?? as suggested by Mike Pennington   &lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2015-02-10T08:04:01.050" LastActivityDate="2020-11-03T16:35:35.973" Title="How to Monitor Vlan Traffic?" Tags="|cisco|switch|vlan|snmp|nms|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2143" PostTypeId="2" ParentId="2141" CreationDate="2013-06-28T10:26:26.890" Score="16" Body="&lt;p&gt;Poll &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.31.1.1.1.7#oidContent&quot;&gt;ifHCInUcastPkts&lt;/a&gt;, &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.31.1.1.1.11#oidContent&quot;&gt;ifHCOutUcastPkts&lt;/a&gt;, &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=ifHCInOctets&quot;&gt;ifHCInOctets&lt;/a&gt; and &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ifHCOutOctets&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;ifHCOutOctets&lt;/a&gt; on Vlan100, Vlan101, and Vlan102.  You can find the &lt;code&gt;ifIndex&lt;/code&gt; of these SVIs by walking &lt;code&gt;ifName&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This get me another question : Why this difference in the same interface (VLAN-100 and Vl100) ??&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;VLAN-100&lt;/code&gt; is a virtual interface for the actual layer2 vlan; there is no IP address associated with it, and thus it can't have the counters you're trying to poll&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Vlan100&lt;/code&gt; is the SVI, which is why you can get IP counters for it&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My main question is still unanswered because the OID I get are for the packets and bytes counters on interface.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's all SNMP will give you with respect to bandwidth; every SNMP monitoring station on the planet (such as &lt;a href=&quot;http://www.cacti.net/&quot;&gt;cacti&lt;/a&gt;, &lt;a href=&quot;http://www.observium.org/&quot;&gt;Observium&lt;/a&gt;, or &lt;a href=&quot;http://graphite.wikidot.com/&quot;&gt;Graphite&lt;/a&gt;) derives interface bandwidth graphs from these same byte-counters (i.e. &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=ifHCInOctets&quot;&gt;ifHCInOctets&lt;/a&gt; / &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ifHCOutOctets&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;ifHCOutOctets&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What I want to get is the Bandwidth measurement on some vlan. So far I only see Netflow as a probable solution. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're welcome to use any tool you like.  However, I'm not sure how simply switching to Netflow helps... NMS systems (regardless of whether they speak SNMP or Netflow) are complicated beasts...&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-03T23:22:36.760" LastActivityDate="2013-07-03T23:22:36.760" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2144" PostTypeId="1" AcceptedAnswerId="2145" CreationDate="2013-06-28T13:37:36.667" Score="8" ViewCount="442" Body="&lt;p&gt;I have encountered a very strange problem when configuring remote target engineId on a Catalyst 3750 switch. The switch changes the engineId, it puts a zero between the two last digits. As shown below it changes ...e166 to ...e1606. I have tried with removing the user, rebooting the switch and re-adding the user but the switch changes the engineId every time. I have configured tens of switches in the exact same way and has never come across this problem before. Does anybody know what the problem might be?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw21(config)#snmp-server engineID remote 10.1.9.6 udp-port 162 b7a9d3ca99325e6b5fb2894a500e166&#xA;&#xA;sw21#show snmp user&#xA;User name: trap&#xA;Engine ID: B7A9D3CA99325E6B5FB2894A500E1606&#xA;storage-type: nonvolatile        active&#xA;Authentication Protocol: SHA&#xA;Privacy Protocol: None&#xA;Group-name: sys&#xA;&#xA;sw21#show version&#xA;....&#xA;Switch Ports Model              SW Version            SW Image&#xA;------ ----- -----              ----------            ----------&#xA;*    1 30    WS-C3750X-24       12.2(55)SE5           C3750E-UNIVERSALK9-M&#xA;     2 30    WS-C3750X-24       12.2(55)SE5           C3750E-UNIVERSALK9-M&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1889" LastEditorUserId="775" LastEditDate="2013-06-28T13:57:22.137" LastActivityDate="2013-06-28T14:00:20.557" Title="IOS changes the SNMPv3 engineId" Tags="|cisco|cisco-catalyst|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2145" PostTypeId="2" ParentId="2144" CreationDate="2013-06-28T14:00:20.557" Score="7" Body="&lt;p&gt;Cisco IOS padded the last 8-bits because you apparently left a digit off to make it a legitimate value... 31 characters isn't a valid hex number&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@some_machine ~]$ python&#xA;Python 2.6.6 (r266:84292, Feb 22 2013, 00:00:18)&#xA;[GCC 4.4.7 20120313 (Red Hat 4.4.7-3)] on linux2&#xA;Type &quot;help&quot;, &quot;copyright&quot;, &quot;credits&quot; or &quot;license&quot; for more information.&#xA;&amp;gt;&amp;gt;&amp;gt; this_str = &quot;b7a9d3ca99325e6b5fb2894a500e166&quot;&#xA;&amp;gt;&amp;gt;&amp;gt; len(this_str)&#xA;31&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-06-28T14:00:20.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2146" PostTypeId="2" ParentId="2109" CreationDate="2013-06-28T14:38:00.223" Score="4" Body="&lt;p&gt;Update your firewall to one that knows applications (commonly called &quot;Next Generation Firewalls&quot; these days). Palo Alto Networks is a good example. Instead of opening your firewall to IP-based destinations, you allow the application &quot;Dropbox&quot; and don't care about the destination. You are also able to put some QoS on top of Dropbox. For example, you could create a QoS policy that gives Dropbox a maximum of 5 mbps bandwidth. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of other Firewall vendors have come up with similar solutions to the one of Palo Alto Networks. I know that Juniper SRX and Checkpoint do it now, not sure about Cisco though. The important thing is that your firewall understands applications (on layer 7) versus just layer3/4.&lt;/p&gt;&#xA;" OwnerUserId="328" LastActivityDate="2013-06-28T14:38:00.223" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2147" PostTypeId="1" CreationDate="2013-06-28T16:01:32.430" Score="9" ViewCount="1531" Body="&lt;p&gt;Can one configure several static EIGRP Neighbors on one interface and are there any considerations apart from disabling split-horizon that one should consider?&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="775" LastEditDate="2013-06-28T22:42:57.253" LastActivityDate="2013-07-02T19:00:55.577" Title="Can one configure several static EIGRP Neighbors on one interface?" Tags="|cisco|routing|eigrp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2148" PostTypeId="2" ParentId="2080" CreationDate="2013-06-28T16:34:07.743" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In the end I gave up and created eight /27 masked subnets, where the last subnet is not used.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think this is (almost) the solution meant by the author of the questions.&#xA;It's common for such questions to be written from time to time, and to be passed on and on through ages without adapting to actual technology. In this particular case, the author, I think, suggests that you cannot use a 'subnet-zero' i.e. subnet with all subnet bits set to zero resulting in 192.168.10.0/27. It was the case back in the days so you had to specifically permit usage of such addresses ('ip subnet-zero' in cisco ios). However, if you configure &quot;no ip subnet-zero&quot; you cannot use first subnet, thus giving only 7 usable /27 in a /24. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;tl;dr: you're right, but the first (zero-th) subnet is not used due to an old currently irrelevant restriction&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back in the days of old, it was not encouraged to use all-zeros and all-ones subnets (RFC 950, p.6, &quot;the values of all zeros and all ones in the subnet field should not be assigned to actual (physical) subnets&quot;). So, borrowing 3 bits for subnetting, we end up with only 6 usable subnets. However, vendors started to support using all-ones and all-zeros subnets on interfaces. In cisco world, the all-ones subnet was supported without any configuration, and all-zeros support was activated by appropriate cli command, more info here: &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080093f18.shtml&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080093f18.shtml&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I've done a little experiment in GNS3 (cisco ios 12.4), so the results are: &#xA;1) you can use 8 subnets with 'ip subnet-zero' command (default) &#xA;2) you can use only 7 subnet with 'no ip subnet-zero' command.&#xA;3) classful or classless routing doesn't affect 1) or 2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1893" LastEditorUserId="1893" LastEditDate="2013-06-30T09:03:00.547" LastActivityDate="2013-06-30T09:03:00.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2149" PostTypeId="2" ParentId="1905" CreationDate="2013-06-28T17:34:13.017" Score="2" Body="&lt;p&gt;First of all, you should understand, what resource is affected by an attack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is bandwidth (you can find it out by analyzing your bandwidth graphs), you should consider using rtbh as previous speaker supposed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is your application/network stack affected by an attack (analyze your server cpu and interrupts usage) then you have to filter malicious traffic somehow. The point of UDP is a minimal datagram service, with implementation of security, reliability and other functions passed to you. So if your protocol doesn't support security functions (which I think it doesn't), there's not much you can do. Any signature-based packet filtering techniques, I think, are merely palliatives. You filter out one signature, attackers will come up with another. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the possible solutions to your problem is to introduce some kind of primitive authentication. Make your users log in into a tournament web-page before the game, for example, and add their IP address to a whitelist, blocking the others. Another way is to user port-knocking. You can produce a specific wrapper or launcher for a game binary that does send some 'magic' packets pinning a hole in your firewall. This approach sometimes is used protecting games like Lineage. &lt;/p&gt;&#xA;" OwnerUserId="1893" LastActivityDate="2013-06-28T17:34:13.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2150" PostTypeId="2" ParentId="2147" CreationDate="2013-06-28T17:41:35.750" Score="9" Body="&lt;p&gt;Yes, that works fine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh run | s eigrp&#xA;router eigrp 100&#xA;network 123.123.123.0 0.0.0.255&#xA;no auto-summary&#xA;neighbor 123.123.123.3 FastEthernet0/0&#xA;neighbor 123.123.123.2 FastEthernet0/0&#xA;&#xA;&#xA;R1#sh ip eigrp nei&#xA;IP-EIGRP neighbors for process 100&#xA;H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq&#xA;                                            (sec)         (ms)       Cnt Num&#xA;1   123.123.123.3           Fa0/0             10 00:01:04   47   282  0  6&#xA;0   123.123.123.2           Fa0/0             10 00:01:21   49   294  0  6&#xA;&#xA;R1#sh ip eigrp nei detail &#xA;IP-EIGRP neighbors for process 100&#xA;H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq&#xA;                                            (sec)         (ms)       Cnt Num&#xA;1   123.123.123.3           Fa0/0             14 00:01:41   47   282  0  6&#xA;   Static neighbor&#xA;   Restart time 00:01:13&#xA;   Version 12.4/1.2, Retrans: 1, Retries: 0&#xA;0   123.123.123.2           Fa0/0             10 00:01:57   49   294  0  6&#xA;   Static neighbor&#xA;   Restart time 00:01:13&#xA;   Version 12.4/1.2, Retrans: 0, Retries: 0&#xA;&#xA;R1#debug eigrp packets hello&#xA;EIGRP Packets debugging is on&#xA;    (HELLO)&#xA;R1#&#xA;EIGRP: Received HELLO on FastEthernet0/0 nbr 123.123.123.3&#xA;AS 100, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0 peerQ un/rely 0/0&#xA;EIGRP: Sending HELLO on FastEthernet0/0 nbr 123.123.123.3&#xA;AS 100, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0&#xA;EIGRP: Sending HELLO on FastEthernet0/0 nbr 123.123.123.2&#xA;AS 100, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0&#xA;R1#&#xA;EIGRP: Received HELLO on FastEthernet0/0 nbr 123.123.123.2&#xA;AS 100, Flags 0x0, Seq 0/0 idbQ 0/0 iidbQ un/rely 0/0 peerQ un/rely 0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-06-28T17:41:35.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2151" PostTypeId="1" CreationDate="2013-06-28T22:05:53.677" Score="11" ViewCount="23745" Body="&lt;p&gt;Is there any way I can disable the 2.4Ghz and just leave 5.0Ghz channel enabled on a per WLAN (SSID) basis? Or the only way is to disable the AP's radio and leave 5Ghz enabled?&lt;/p&gt;&#xA;" OwnerUserId="1426" LastEditorUserId="775" LastEditDate="2013-06-28T22:07:20.950" LastActivityDate="2013-06-29T02:52:47.457" Title="WLC - How to disable 2.4Ghz" Tags="|cisco|wireless|ieee-802.11|wlc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2152" PostTypeId="2" ParentId="2151" CreationDate="2013-06-28T22:09:14.723" Score="8" Body="&lt;p&gt;Assuming a Cisco WLC... Go to &quot;WLAN &gt; Select the WLAN Profile &gt; General Tab &gt; Radio Policy&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Updating my answer to clarify a few things...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;802.11a operates at a maximum of 54Mbps, only in the 5GHz bands&lt;/li&gt;&#xA;&lt;li&gt;802.11b operates at a maximum of 11Mbps, only in the 2.4GHz bands&lt;/li&gt;&#xA;&lt;li&gt;802.11g operates at a maximum of 54Mbps, only in the 2.4GHz bands&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that wireless operates in unlicensed frequency spectrum, so it is a bit like the wild west... Many corporate networks choose to marginalize support for 802.11b/g where possible, due to the rampant use of the 2.4GHz frequency spectrum by consumer devices... today, 5GHz (and thus, 802.11a) tends to have much lower background noise levels, so it is more suitable for business voice and data services... however it also doesn't propagate as well due to the smaller wavelength in 5GHz signals.  Use care when you disable 802.11b/g... it might be worth checking for coverage holes, if most of the traffic formerly used 2.4G...&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-29T02:52:47.457" LastActivityDate="2013-06-29T02:52:47.457" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="2153" PostTypeId="1" AcceptedAnswerId="2156" CreationDate="2013-06-29T23:38:45.903" Score="2" ViewCount="443" Body="&lt;p&gt;I've just cabled my house (Yay!). When using iperf I notice that I don't ever get a speed over about 500 Mbits/s. I know that lots of older consumer grade gigabit ethernet cards won't actually do full gigabit ethernet, I'd just like to check that this drop in speed couldn't be caused by a wiring fault. Could it?&lt;/p&gt;&#xA;" OwnerUserId="1899" LastEditorUserId="775" LastEditDate="2013-07-09T00:45:10.417" LastActivityDate="2013-07-09T00:45:10.417" Title="How much would a wiring fault cause bandwidth over cat 6 to drop by?" Tags="|ethernet|" AnswerCount="2" CommentCount="12" ClosedDate="2018-03-20T23:36:04.497" ContentLicense="CC BY-SA 3.0" />
  <row Id="2154" PostTypeId="1" AcceptedAnswerId="2158" CreationDate="2013-06-30T02:05:53.473" Score="2" ViewCount="1124" Body="&lt;p&gt;I want to have multiple servers behind a single firewall and access each with a different subdomain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, I am having to have each server tied to a different port (which my firewall forwards to the correct server), but it would be very nice to be able to type in a subdomain because it is easier to remember and is cleaner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are my vague ideas of how this could work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) some functionality in my firewall/switch that I am unaware of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) some type of load balancing software which would serve a different internal IP/port depending on which subdomain was requested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) some type of webserver that acted as the central hub that decided which traffic to return based on the subdomain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) I don't know much about them, but SRV records seem to offer promise - would they relate to this situation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5) it seems as though there must be some solution to this - I would really like to avoid having to get a separate external IP address for each one of the servers that I want to access externally!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea of which of these things might work?&lt;/p&gt;&#xA;" OwnerUserId="1900" LastActivityDate="2013-06-30T18:05:17.700" Title="Portforwarding by Subdomain" Tags="|routing|ipv4|transport-protocol|" AnswerCount="1" CommentCount="1" ClosedDate="2018-04-11T04:28:01.037" ContentLicense="CC BY-SA 3.0" />
  <row Id="2155" PostTypeId="1" AcceptedAnswerId="2287" CreationDate="2013-06-30T03:59:42.753" Score="12" ViewCount="15787" Body="&lt;p&gt;I have a site-to-site VPN that seems to be dropping traffic from a particular subnet when a lot of data is being pushed through the tunnel. I have to run &lt;code&gt;clear ipsec sa&lt;/code&gt; to get it going again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I notice the following when running &lt;code&gt;show crypto ipsec sa&lt;/code&gt;. The SA timing remaining key lifetime reaches 0 for kB. When this happens the tunnel doesn't pass traffic. I don't understand why it doesn't rekey.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inbound esp sas:&#xA;      spi: 0x51BB8CAE (1371245742)&#xA;         transform: esp-3des esp-sha-hmac no compression&#xA;         in use settings ={L2L, Tunnel, }&#xA;         slot: 0, conn_id: 65753088, crypto-map: OutsideCrypto_map&#xA;         sa timing: remaining key lifetime (kB/sec): (3796789/14690)&#xA;         IV size: 8 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap:&#xA;          0xFFFFFFFF 0xFFFFFFFF&#xA;    outbound esp sas:&#xA;      spi: 0x91CA1D71 (2445942129)&#xA;         transform: esp-3des esp-sha-hmac no compression&#xA;         in use settings ={L2L, Tunnel, }&#xA;         slot: 0, conn_id: 65753088, crypto-map: OutsideCrypto_map&#xA;         **sa timing: remaining key lifetime (kB/sec): (0/14678)**&#xA;         IV size: 8 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap:&#xA;          0x00000000 0x00000001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;UPDATE 7/1/2013&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I am running ASA 8.6.1. Researching Cisco's site I was able to find &lt;a href=&quot;http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&amp;amp;bugId=CSCtq57752&amp;amp;Submit=Search&quot;&gt;Bug CSCtq57752&lt;/a&gt;. The details are&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ASA: IPSec outbound SA data lifetime rekey fails Symptom:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;IPSec outbound SA fails to rekey when data lifetime reaches zero kB.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Conditions:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ASA has an IPSec tunnel with a remote peer. The data lifetime on the&#xA;  ASA reaches 0 kB, the lifetime in seconds has not yet expired. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Workaround:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Increase the data lifetime to a very high value (or even the maximum&#xA;  value), or decrease the lifetime in seconds. The lifetime in seconds&#xA;  should ideally expire before the data limit in kB reaches zero. In&#xA;  this manner the rekey will be triggered based on seconds, and the data&#xA;  lifetime issue can be bypassed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The solution is to update to version 8.6.1(5). I'm going to try and schedule a maintenance window tonight and see if the problem is resolved.&lt;/p&gt;&#xA;" OwnerUserId="63" LastEditorUserId="63" LastEditDate="2013-07-01T15:01:16.350" LastActivityDate="2013-07-10T17:30:54.100" Title="Site-to-Site VPN Tunnel Up Not Passing Traffic" Tags="|vpn|cisco-asa|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2156" PostTypeId="2" ParentId="2153" CreationDate="2013-06-30T04:20:47.433" Score="4" Body="&lt;p&gt;The way to determine this is to examine interface statistics for FEC failures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, 1000GBASE-T is relatively tolerant of wiring that's a little noisy, but you will see CRC32 errors - if you're getting these, especially when transferring at however close to full-whack you can get, then yes, it's likely the wiring. Otherwise, nope.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-06-30T04:20:47.433" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2158" PostTypeId="2" ParentId="2154" CreationDate="2013-06-30T07:44:45.963" Score="7" Body="&lt;p&gt;Without knowing much of your environment, you might want to look at &lt;strong&gt;&lt;a href=&quot;http://www.squid-cache.org/&quot;&gt;Squid&lt;/a&gt;&lt;/strong&gt; as a &lt;strong&gt;reverse proxy&lt;/strong&gt; which can easily do what you seek.  A reverse proxy is basically a load-balancer.  No need to do anything on your firewall; in fact, this simplifies your firewall configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All subdomains would resolve to the same VIP (virtual IP) that lands on Squid configured to do &lt;a href=&quot;http://wiki.squid-cache.org/ConfigExamples/Reverse/BasicAccelerator&quot;&gt;web acceleration&lt;/a&gt;.  You can easily configure to send incoming requests to different origin-servers based on the &lt;code&gt;host&lt;/code&gt; header seen in the http request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side benefit, you can do caching on Squid and serve static content directly from it without taxing your web servers.  And the best part of this solution is that it's free.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-06-30T07:49:57.283" LastActivityDate="2013-06-30T07:49:57.283" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2160" PostTypeId="1" CreationDate="2013-06-30T08:40:10.487" Score="9" ViewCount="3250" Body="&lt;p&gt;I'm in the middle of setting up a lab with a &lt;a href=&quot;/tags/vrrp&quot; title=&quot;Virtual Router Redundancy Protocol&quot;&gt;VRRP&lt;/a&gt; configuration, and I'm trying to search for any possible issues we might run into in production. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One issue I am aware of with VRRP is that it seems that &lt;a href=&quot;/tags/stp&quot; title=&quot;Spanning Tree Protocol&quot;&gt;STP&lt;/a&gt; convergence time (of about 45 seconds I believe) can sometimes cause the VRRP nodes to flap. &lt;strike&gt;According to my diagram, I can't see any loops (ignoring the multi-homed servers at the bottom), so I suppose I can just disable STP and forget about it. But I'd like to see what happens with STP enabled, all the same.&lt;/strike&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Vyatta Core 6.5 for both ISPA and ISPB's routers. I am running the VMs on VMWare workstation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason my lab includes switches between ISPA and ISPB is that in production we are using these to terminate the fibre uplinks to our provider. So I've tried to make my lab as close to production as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My configuration is like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sNJID.jpg&quot; alt=&quot;VRRP Lab Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is that, right now, the switches don't actually exist in my lab. I am simply using LAN Segments in VMWare workstation to allow the Vyatta VMs to talk to one another. My issue is that because all the connections between VMs is done inside the Hyervisor, it seems there is no possibility to test things like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is:&lt;/strong&gt; Can someone think of a way of connecting these VMs together in such a way that it would simulate physical Vyatta machines connected via Cisco (or otherwise) switches, so that I can test STP (and anything else I can think of)?&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;What I've tried&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;Using GNS3 to inter-connect VMs&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;One thing I have tried doing is getting the VMs to communicate via GNS3 using VMNet Host-Only adapters to integrate with GNS3, then using a Cisco 3745 with a FastEthernet switching module added. There's a few issues here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In my lab I am using a single subnet to talk between ISPA and ISPB (10.11.246.0/29).&lt;/li&gt;&#xA;&lt;li&gt;VMWare expects that a single VMNet adapter uses a single subnet, so I cannot use multiple separate VMNet adapters with the one 10.11.246.0/29 subnet.&lt;/li&gt;&#xA;&lt;li&gt;In any instance where two VMs use the same VMNet adapter, packets are sent directly to each other, and so without separate VMNet adapters, I can't see a way forcing the VMs to communicate via a GNS3 router.&lt;/li&gt;&#xA;&lt;li&gt;My understanding is that with VRRP, using a subnet smaller than what could accomodate all nodes + virtual IPs would be considered a hack and not advisable. So for example, using /30s and multiple VMNet adapters is not a good idea.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Other Notes&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I am open to using other Virtual Machine platforms such as virtual box.&lt;/li&gt;&#xA;&lt;li&gt;I have a physical Cisco Catalyst 2950 at my desk, and the host machine has two physical NICs available.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="846" LastEditorUserId="49" LastEditDate="2013-07-01T13:45:35.130" LastActivityDate="2013-08-23T05:01:34.940" Title="Trying to test a virtual lab VRRP configuration for STP issues" Tags="|cisco|switch|spanning-tree|lab|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2162" PostTypeId="1" CreationDate="2013-06-30T10:47:05.757" Score="7" ViewCount="3207" Body="&lt;p&gt;I wanted to post my network layout, but I dont have the required reputation. So I have made up a network diagram below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       ISP&#xA;       / \&#xA;      /   \&#xA;     /     \&#xA;    HQ------Branch&#xA;    |         |&#xA;  HQ-PC      B-PC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I am trying to do is to use the WAN Link between HQ and Branch as the back-up link and it must not carry any data unless the link between HQ to ISP or Branch to ISP is down. Meaning it must strictly be only used as a back-up link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have done is using floating static to configure the redundancy. However, it is not quite working out as what I have expected it to be.&#xA;What I have done are:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1) a default route at the HQ and Branch to the ISP (0.0.0.0 0.0.0.0&#xA;  NEXT-HOP-IP)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2) static route at ISP to HQ and Branch (HQ/BRANCH-NETWORK-ADDRESS&#xA;  SUBNET-MASK NEXT-HOP-IP)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3) a static(prefered) route at HQ (BRANCH-NETWORK-ADDRESS SUBNET-MASK&#xA;  NEXT-HOP-IP-TO-ISP)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;4) a static(prefered) route at Branch (HQ-NETWORK-ADDRESS SUBNET-MASK&#xA;  NEXT-HOP-IP-TO-ISP)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;5) a floating static(back-up) route at HQ (BRANCH-NETWORK-ADDRESS&#xA;  SUBNET-MASK NEXT-HOP-IP-TO-HQ-THROUGH-BACKUP-LINK)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;6) a floating static(back-up) route at Branch (HQ-NETWORK-ADDRESS&#xA;  SUBNET-MASK NEXT-HOP-IP-TO-BRANCH-THROUGH-BACKUP-LINK)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, there is a problem. For example, if the link between ISP and HQ is down, when I want to ping from HQ-PC to B-PC, the packet will be successfully sent from HQ-PC to B-PC, but the returning packet from B-PC will be sent to the ISP and not through the back-up link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So sorry for such a lengthy post, but is there anyone who can help me?&#xA;If my explanation is unclear, please feel free to query. &#xA;Thanks in advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Sorry for the confusion, there should not be any routing protocols running with the ISP&lt;/p&gt;&#xA;" OwnerUserId="1902" LastEditorUserId="1902" LastEditDate="2013-06-30T11:09:44.280" LastActivityDate="2013-07-01T06:26:08.447" Title="Configuring redundancy using floating static" Tags="|cisco|cisco-commands|redundancy|" AnswerCount="2" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2163" PostTypeId="2" ParentId="2162" CreationDate="2013-06-30T11:07:16.180" Score="5" Body="&lt;p&gt;(Original all-BGP answer changed, as-per OP's request of no dynamic routing to ISP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @Mike suggested, tunnel+dynamic routing, especially in the INET facing is solid solution. But if for some reason you don't want tunnel (no HW support, don't want to lose MTU, dynamic routing not acceptable even internally) your other option is 'IP SLA' tracked routes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll explain how it helps in the exact problem you describe, where branch continues to return traffic to INET, while it should use the direct link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In branch you'd have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route HQNet HQMask InetIF InetNH track 1 50&#xA;ip route HQNet HQMask DirectIF DirectNH 100&#xA;ip route HQStableTestIP 255.255.255.255 InetIF InetNH&#xA;!&#xA;track 1 ip sla 1&#xA;!&#xA;ip sla 1&#xA; icmp-echo &amp;lt;HQStableTestIP&amp;gt; source-interface InetIF&#xA;ip sla schedule 1 start-time now&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if HQ is not reachable via INET, tracking should fail, and INET more-specific route should be invalidated and you should fallback to next best route pointing to the direct link.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-07-01T06:26:08.447" LastActivityDate="2013-07-01T06:26:08.447" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2164" PostTypeId="2" ParentId="2162" CreationDate="2013-06-30T11:26:23.583" Score="9" Body="&lt;p&gt;As you mentioned, your static routes break, because there is no existing way to force failover to the WAN link at both sites when one site looses the uplink to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best solution to this problem is to set up some form of routed tunnel (sourced from the ISP-link addresses on R1 and R2 in the diagram) through the internet, run a dynamic routing protocol (OSPF / EIGRP) through your tunnel and backup WAN, and set the routing metrics for the WAN link to be much higher.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dZGaj.png&quot; alt=&quot;HQ-Backup tunnel&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you source the tunnel from the internet links on both sides, if either side looses internet connectivity the tunnel breaks (and the IGP recoverges to your WAN link). If you do this, be sure that PMTUD works through the tunnel so the tunnel overhead is accounted for.  This kind of inter-office encrypted VPN is quite common, so it's a familiar topology for anyone who has to support this network in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue you face with your existing design is that all your inter-office traffic traffic seems to be &lt;em&gt;unencrypted&lt;/em&gt; (at least if I read your question at face-value).  If you are not already doing so, I would strongly recommend that you &lt;em&gt;encrypt all traffic between your corporate sites, if it's going through the internet&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-06-30T11:48:36.413" LastActivityDate="2013-06-30T11:48:36.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2166" PostTypeId="2" ParentId="808" CreationDate="2013-06-30T18:20:54.763" Score="0" Body="&lt;p&gt;If the VLAN in question is 'private' that is not L3 routed anywhere (say a cluster heartbeat) an SVI on the layer 2 switch will enable your NOC to ping interfaces, and get ARP tables which is a great help in troubleshooting. If you the VLAN in question is routed, there is no great benefit except as a temporary measure to prove that a VLAN is trunked down to that switch (some server guys need proof) by pinging the default gateway for that VLAN from the switch&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-06-30T18:20:54.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2170" PostTypeId="2" ParentId="2088" CreationDate="2013-07-01T12:57:07.363" Score="1" Body="&lt;p&gt;Had something (possibly) similar with a cluster of old checkpoint firewalls and a Cisco switch - both firewalls would present the same MAC address, so the switch would see one MAC in two places. This would work fine on an unmanaged hub/switch, but managed switches would object. The solution was, if I remember correctly, to add static mac entries for the firewalls in the switch config. &lt;/p&gt;&#xA;" OwnerUserId="1907" LastActivityDate="2013-07-01T12:57:07.363" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2171" PostTypeId="2" ParentId="2080" CreationDate="2013-07-01T16:40:52.677" Score="1" Body="&lt;p&gt;Good answers have already been provided by the others with regards to answering the test question. I just wanted to offer a simpler way to look at the subnetting itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your goal is to subnet and create X number of subnets, then you simply use powers of two until you get one big enough to hold X. So if the goal is 7 subnets, start counting up powers of two:  2, 4, 8. At the third power, you reach 8. So that means that you will need to use 3 bits of subnetting in order to create that many subnets. /24 + 3 = /27. You move the network portion of the address three bits to the right to create your new subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were for example asked to create 10 subnets within that same /24 network, you would have to add another bit to your subnetting in order to do so: 2, 4, 8, 16. Since 16 is the first one that is bigger than 10, you would use that. /24 + 4 = /28&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that as you take bits away from the host area, you have fewer possible hosts within that subnet. So a /27 has only 30 possible hosts, and a /28 has only 14 possible hosts per subnet! &lt;/p&gt;&#xA;" OwnerUserId="1909" LastActivityDate="2013-07-01T16:40:52.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2172" PostTypeId="2" ParentId="1993" CreationDate="2013-07-01T16:53:36.463" Score="3" Body="&lt;p&gt;Just to expand Daniel's answer above:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network address in IPv4 is the address where the host bits are all 0.&#xA;The broadcast is the address where all host bits are 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To create the address 148.26.1.176, the last octet in binary is 1011 0000. &#xA;The network mask of /28 would take up the first 4 bits of that number, leaving only zeroes after the mask:  [1011] 0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's why it's not a valid address. It's a network address.&lt;/p&gt;&#xA;" OwnerUserId="1909" LastEditorUserId="1909" LastEditDate="2013-07-01T17:19:15.683" LastActivityDate="2013-07-01T17:19:15.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2173" PostTypeId="1" CreationDate="2013-07-01T20:00:53.537" Score="3" ViewCount="60234" Body="&lt;p&gt;Since several services can be offered by the Fortigate itself (SSH and web access for admin tasks, SSL VPN, IPSec VPN...) I would like to check at a glance all ports where any service is being offered by a given unit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to get a list of all listening ports in a Fortigate firewall, either via CLI or Web Interface? Im looking for something similar to the output of &lt;code&gt;netstat -l&lt;/code&gt; in Unix/Linux. &lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2016-09-26T22:33:09.890" Title="How to get a list of ports listening in a Fortigate firewall?" Tags="|fortigate|fortinet|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2175" PostTypeId="2" ParentId="2173" CreationDate="2013-07-02T04:06:18.150" Score="0" Body="&lt;p&gt;download nmap on a linux or windows machine and &lt;code&gt;nmap $fortigateIP&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That will scan the $fortigateIP for common ports (ftp, ssh, telnet, smtp, http, pop3, imap, https, etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://nmap.org/book/nmap-services.html&quot; rel=&quot;nofollow&quot;&gt;Explanation of nmap-services (aka nmap common ports)&lt;/a&gt;&lt;br /&gt;&#xA;&lt;a href=&quot;http://nmap.org/nmap_doc.html&quot; rel=&quot;nofollow&quot;&gt;nmap usage doc&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="769" LastActivityDate="2013-07-02T04:06:18.150" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2176" PostTypeId="2" ParentId="2173" CreationDate="2013-07-02T06:49:19.990" Score="6" Body="&lt;p&gt;Try with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;diagnose sys tcpsock | grep 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="530" LastActivityDate="2013-07-02T06:49:19.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2178" PostTypeId="1" CreationDate="2013-07-02T14:59:03.240" Score="7" ViewCount="1023" Body="&lt;p&gt;I am looking for technical clarity on why someone should / shouldn’t use ISIS p2p  topologies on Ethernet media.&lt;/p&gt;&#xA;&lt;p&gt;Ethernet is a broadcast medium , however if it’s  configured as a p2p link with /31’s the broadcast domain is minimised , therefore as I understand  it the advantages are the reduction in the amount of information routing protocols must carry and manage and DR/DIS election can be omitted.   ( ref here &lt;a href=&quot;https://www.google.co.uk/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;ved=0CDgQFjAA&amp;amp;url=https://datatracker.ietf.org/doc/html/draft-ietf-isis-igp-p2p-over-lan&amp;amp;ei=XuPSUZ6FNoGs0QW29IGQBw&amp;amp;usg=AFQjCNEj1fHzJjDnoB2FJxgBiSl0d9i_KQ&amp;amp;sig2=8No9NQwstsRdkf_ERBXtVA&quot; rel=&quot;nofollow noreferrer&quot;&gt;draft-ietf-isis-igp-p2p-over-lan&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I am able to find little evidence to support this theory in practice therefore I am looking for sound technical reasoning to justify the above and  ideally some information on how this affects convergence.&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-09-08T12:22:37.497" Title="ISIS p2p on Ethernet media" Tags="|routing|ethernet|point-to-point|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2179" PostTypeId="2" ParentId="2178" CreationDate="2013-07-02T15:05:56.197" Score="3" Body="&lt;p&gt;I think best technical rationale for P2P is that you get reliable LSP delivery, in LAN it is unreliable thus it's done periodically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also pseudonode is additional resource use and during DR failure convergence is hurt.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-07-02T15:05:56.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2180" PostTypeId="2" ParentId="1993" CreationDate="2013-07-02T15:51:03.097" Score="4" Body="&lt;p&gt;IPCALC is a handy tool on most linux boxes, or on the web here &lt;a href=&quot;http://jodies.de/ipcalc&quot; rel=&quot;nofollow&quot;&gt;ipcalc&lt;/a&gt;&#xA;You type in the IP and the mask and it will output the range, detailing the network, broadcast and the usable range. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address:   148.26.1.176          10010100.00011010.00000001.1011 0000&#xA;Netmask:   255.255.255.240 = 28  11111111.11111111.11111111.1111 0000&#xA;Wildcard:  0.0.0.15              00000000.00000000.00000000.0000 1111&#xA;=&amp;gt;&#xA;Network:   148.26.1.176/28       10010100.00011010.00000001.1011 0000     (Class B)&#xA;Broadcast: 148.26.1.191          10010100.00011010.00000001.1011 1111&#xA;HostMin:   148.26.1.177          10010100.00011010.00000001.1011 0001&#xA;HostMax:   148.26.1.190          10010100.00011010.00000001.1011 1110&#xA;Hosts/Net: 14  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1352" LastActivityDate="2013-07-02T15:51:03.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2181" PostTypeId="1" AcceptedAnswerId="2182" CreationDate="2013-07-02T16:42:26.887" Score="13" ViewCount="1627" Body="&lt;p&gt;I'd like to set up a poor wifi network in my office for developers to test on. What is the best way to simulate real world crappy wifi?  High latency? Dropped packets? low bandwidth?&lt;/p&gt;&#xA;" OwnerUserId="1331" LastActivityDate="2014-12-14T14:18:56.037" Title="Simulating a poor network" Tags="|ieee-802.11|testing|" AnswerCount="2" CommentCount="3" ClosedDate="2019-06-01T00:43:32.970" ContentLicense="CC BY-SA 3.0" />
  <row Id="2182" PostTypeId="2" ParentId="2181" CreationDate="2013-07-02T17:04:53.693" Score="14" Body="&lt;p&gt;your best bet will probably be to put a wan emulator in-between the wlan network and rest of the network. Even better if you are using multiple SSIDs, each going to its own VLAN (you'd then place the WAN emulator between the SSID's VLAN you want to break and the rest of the network.&lt;p&gt;&lt;/p&gt; You could then configure the emulator to create the crappy network (ie: jitter, latency, packet loss, max bandwidth, etc)&lt;p&gt;&lt;/p&gt;&#xA;A wan emulator that i've had pretty good success with is WANem &lt;a href=&quot;http://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;ved=0CC8QFjAA&amp;amp;url=http://wanem.sourceforge.net/&amp;amp;ei=IwfTUYKnM4Xp8AHK3YGYBg&amp;amp;usg=AFQjCNG91L1Rc7aKOo7UAsaGfIIZuiNpSQ&amp;amp;sig2=k_U7404KEMLINe-XmEpJlw&quot;&gt;link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="769" LastActivityDate="2013-07-02T17:04:53.693" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2183" PostTypeId="2" ParentId="2147" CreationDate="2013-07-02T19:00:55.577" Score="1" Body="&lt;p&gt;you may also want to consider adding 'no ip next-hop-self eigrp X' to the interface pointing to those static neighbors. This will enable &quot;Third Party Next-Hop&quot;, which will allow the spoke routers to send traffic directly to each other instead of via hub.&#xA;Assuming R1&amp;lt;-&gt;R2 and R1&amp;lt;-&gt;R3 (loop0 - 3.3.3.3)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt; Before:&#xA;R2#sh ip eigrp topology 3.3.3.3 255.255.255.255&#xA;IP-EIGRP (AS 1): Topology entry for 3.3.3.3/32&#xA;  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 2560051456&#xA;  Routing Descriptor Blocks:&#xA;  &lt;B&gt;10.0.0.1&lt;/B&gt; (FastEthernet0/0), from 10.0.0.1, Send flag is 0x0&#xA;      Composite metric is (2560051456/2560025856), Route is External&#xA;      Vector metric:&#xA;        Minimum bandwidth is 1 Kbit&#xA;        Total delay is 2010 microseconds&#xA;        Reliability is 1/255&#xA;        Load is 1/255&#xA;        Minimum MTU is 1&#xA;        Hop count is 2&#xA;      External data:&#xA;        Originating router is 3.3.3.3  &#xA;        AS number of route is 0&#xA;        External protocol is Connected, external metric is 0&#xA;        Administrator tag is 0 (0x00000000)&#xA;R2#sh ip route 3.3.3.3&#xA;Routing entry for 3.3.3.3/32&#xA;  Known via &quot;eigrp 1&quot;, distance 170, metric 2560051456, type external&#xA;  Redistributing via eigrp 1&#xA;  Last update from 10.0.0.1 on FastEthernet0/0, 00:04:04 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 10.0.0.1, from 10.0.0.1, 00:04:04 ago, via FastEthernet0/0&#xA;      Route metric is 2560051456, traffic share count is 1&#xA;      Total delay is 2010 microseconds, minimum bandwidth is 1 Kbit&#xA;      Reliability 1/255, minimum MTU 1 bytes&#xA;      Loading 1/255, Hops 2&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After:&lt;pre&gt;&#xA;R2#sh ip route 3.3.3.3&#xA;Routing entry for 3.3.3.3/32&#xA;  Known via &quot;eigrp 1&quot;, distance 170, metric 2560051456, type external&#xA;  Redistributing via eigrp 1&#xA;  Last update from 10.0.0.3 on FastEthernet0/0, 00:00:14 ago&#xA;  Routing Descriptor Blocks:&#xA;  * &lt;B&gt;10.0.0.3&lt;/B&gt;, from 10.0.0.1, 00:00:14 ago, via FastEthernet0/0&#xA;      Route metric is 2560051456, traffic share count is 1&#xA;      Total delay is 2010 microseconds, minimum bandwidth is 1 Kbit&#xA;      Reliability 1/255, minimum MTU 1 bytes&#xA;      Loading 1/255, Hops 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2#sh ip eigrp topology 3.3.3.3 255.255.255.255&#xA;IP-EIGRP (AS 1): Topology entry for 3.3.3.3/32&#xA;  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 2560051456&#xA;  Routing Descriptor Blocks:&#xA;  10.0.0.3 (FastEthernet0/0), from 10.0.0.1, Send flag is 0x0&#xA;      Composite metric is (2560051456/2560025856), Route is External&#xA;      Vector metric:&#xA;        Minimum bandwidth is 1 Kbit&#xA;        Total delay is 2010 microseconds&#xA;        Reliability is 1/255&#xA;        Load is 1/255&#xA;        Minimum MTU is 1&#xA;        Hop count is 2&#xA;      External data:&#xA;        Originating router is 3.3.3.3&lt;br&gt;&#xA;        AS number of route is 0&#xA;        External protocol is Connected, external metric is 0&#xA;        Administrator tag is 0 (0x00000000)&#xA;&lt;/pre&gt;&lt;/p&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-02T19:00:55.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2184" PostTypeId="2" ParentId="2181" CreationDate="2013-07-02T19:50:18.613" Score="2" Body="&lt;p&gt;Without knowing more about the service that is being used on top of this &quot;crappy&quot; wifi, it is more difficult to give suggestions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are pushing HTTP traffic, then you can use a proxy software called &lt;a href=&quot;http://fiddler2.com/&quot; rel=&quot;nofollow&quot; title=&quot;Fiddler2&quot;&gt;Fiddler&lt;/a&gt; to simulate slow speeds or even intercept traffic to pause or modify it.&lt;/p&gt;&#xA;" OwnerUserId="1203" LastActivityDate="2013-07-02T19:50:18.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2185" PostTypeId="2" ParentId="2153" CreationDate="2013-07-02T20:02:06.487" Score="0" Body="&lt;p&gt;Check that the link is auto negotiated to the right speeds (gbit and full), and at both ends.  I had a vender install cables recently and they Fluke validated all of the runs.  I am not sure what happened, but one of the links auto negotiated at 10mbit full.  Asked the vender to check it out, and he was surprised that it had any link at all.  Not sure how that slipped by the Fluke, but he punched it down again and it has been fine since.&lt;/p&gt;&#xA;" OwnerUserId="1203" LastActivityDate="2013-07-02T20:02:06.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2187" PostTypeId="2" ParentId="2160" CreationDate="2013-07-03T00:32:52.020" Score="0" Body="&lt;p&gt;I don't understand your worry about VRRP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the topology none of the switches are attached to each other. Unless you are doing something crazy like enabling bridging on the servers dont see how you create a loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More interestingly if ISP-BDR-01 is attached to LAN 2 and ISP-BDR-01 is attached to LAN 1 they don't see each other at layer 2, Cisco routers do not allow same subnet on multiple interfaces so I would suggest your topology as documented does not work. Now adding a link between the switches fixes that, connecting the switches together does not create a loop either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most routers support adjustmets in timers so that you can if you wish set VRRP failover to be larger than STP convergence, but given the simple topology, you are worried about the wrong thing&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-07-03T00:32:52.020" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2188" PostTypeId="1" AcceptedAnswerId="2189" CreationDate="2013-07-03T05:41:29.040" Score="4" ViewCount="2035" Body="&lt;p&gt;I have network topology:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      (room 3)&#xA;      D-Link DES-1024D&#xA;            |                &#xA;            |&#xA;      (room 2 MAIN)                              (room 4)&#xA;      Baseline 3COM  Switch 2948-SFP Plus ------ D-Link DES-1024D&#xA;            |&#xA;            |&#xA;      (room 1)         &#xA;      D-Link DES DES-1016D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Problem is in &lt;code&gt;room 3&lt;/code&gt; D-link switch. There are about 15 computers connected to that switch, all works fine but suddenly and unpredictably link goes down. It may happen once in a month or every 15 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Room 3&lt;/code&gt; totaly goes offline. Сomputers can not even see each other. The rest of the network works fine. Cable reconnect only can bring room back online.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3COM's switch has a monitoring system. It showed many &lt;code&gt;CRC &amp;amp; Align Errors&lt;/code&gt; and &lt;code&gt;Fragments&lt;/code&gt; on the port which is &lt;code&gt;room 3&lt;/code&gt; connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to connect &lt;code&gt;room 3&lt;/code&gt; to &lt;code&gt;room 4&lt;/code&gt;. Now all traffic from the &lt;code&gt;room 3&lt;/code&gt; goes through the &lt;code&gt;room 4&lt;/code&gt; switch which is not critical but gave me the opportunity to see now all &lt;code&gt;CRC &amp;amp; Align Errors&lt;/code&gt; and &lt;code&gt;Fragments&lt;/code&gt; (all of which is bad packets, i guess) goes through &lt;code&gt;room 4&lt;/code&gt; port on &lt;code&gt;3COM&lt;/code&gt; switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I determine where these bad packets was generated? Can it be ethernet card? Or just buy new switch?&lt;/p&gt;&#xA;" OwnerUserId="1919" LastActivityDate="2013-07-03T05:55:41.687" Title="CRC &amp; Align Errors on D-Link switch, network down" Tags="|switch|troubleshooting|errors|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2189" PostTypeId="2" ParentId="2188" CreationDate="2013-07-03T05:55:41.687" Score="6" Body="&lt;p&gt;It can't be PC ethernet card, as DES-1024D is not 'cut-through', that means, if PC sent broken frame, DES-1024D dropped it and did not forward it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You've already done good debugging by moving the wire to another switch, this allows us in high degree of confidence to exclude 3COM as culprit for the errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Options that are left is room 3 D-Link or wiring from it. First thing I'd verify is duplex setting, if negotiation is on (as it should be, only disable if you must, as negotiation has important function to signal remote fault) verify that both of the devices are in 'full duplex', if auto negotiation is on but links still disagree on duplex force them to full duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this does not help, you have three options&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Change port on the  room 3D-Link. Fault may affect one, many or all ports in the device, depending on which exact component is broken and how many ports share this component&lt;/li&gt;&#xA;&lt;li&gt;Rewire (if room 2 and room 4 to room 3 are not sharing any wire, you can skip this)&lt;/li&gt;&#xA;&lt;li&gt;Change room 3 D-link&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-07-03T05:55:41.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2190" PostTypeId="5" CreationDate="2013-07-03T07:47:28.627" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Point-to-point_%28network_topology%29#Point-to-point&quot; rel=&quot;nofollow&quot;&gt;Point-to-point&lt;/a&gt; is a type of (non-multipoint) networking link that only connects two devices; if it contains an IP subnet, the subnet must &lt;em&gt;only&lt;/em&gt; span two devices.   Point-to-point links stand in contrast to other topologies, such as bus or star.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-03T15:15:42.167" LastActivityDate="2013-07-03T15:15:42.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2191" PostTypeId="4" CreationDate="2013-07-03T07:47:28.627" Score="0" Body="For questions about Point-to-point network links, where the term point-to-point means a wireless data link between two fixed points or in a switching world, where all ports are a series of point-to-point circuits, via micro segmentation. The tag can also be used in relation to a point to point tunnel (PPTP) or VPN connection etc." OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2018-02-09T14:52:04.990" LastActivityDate="2018-02-09T14:52:04.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2192" PostTypeId="1" AcceptedAnswerId="2193" CreationDate="2013-07-03T10:58:28.137" Score="18" ViewCount="12692" Body="&lt;p&gt;The combination of &lt;a href=&quot;http://en.wikipedia.org/wiki/Equal-cost_multi-path_routing&quot; rel=&quot;noreferrer&quot;&gt;ECMP&lt;/a&gt; (or other causes of asymmetric paths) and &lt;a href=&quot;http://en.wikipedia.org/wiki/Hot_Standby_Router_Protocol&quot; rel=&quot;noreferrer&quot;&gt;HSRP&lt;/a&gt; is broken by default in Cisco IOS; the default behaviour with this design floods unicast traffic excessively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best-practice for using HSRP with ECMP to prevent unknown unicast flooding?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Details / Background&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;We have a HSRP topology similar to the first diagram below for many of our facilities.  Our Cisco WAN routers have equal-cost routes to all other sites; thus we can see asymmetric routing effects all the time.  Normally we assign R1 to be the HSRP primary, but ECMP allow return traffic through either R1 or R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is that when PC1 mounts a remote iSCSI drive across the WAN, the traffic leaves the site via R1, but could return via R2.  As long as the iSCSI traffic returns via R1, there are no issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/atYXl.png&quot; alt=&quot;HSRP_Broken_00&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem occurs when PC1's traffic returns via R2.  Assume the iSCSI session starts at 8:00:00, and both routers and both switches learn PC1's mac simultaneously.  Between 8:00:00 and 8:00:05, there are no flooding problems because both switches still have PC1's mac-address in their CAM table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/3aN0Z.png&quot; alt=&quot;HSRP_Broken_01&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Five minutes after the iSCSI session starts, S2's CAM entry for PC1's mac expires out of the CAM table and S2 floods PC1's traffic out all ports (in this case to Po1, Gi0/3 and Gi0/4).  If PC1's iSCSI session consumes a lot of bandwidth, this unknown unicast flooding can suck non-trivial capacity from the links to PC3 and PC4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco IOS switches have a default CAM timer of 300 seconds...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S2# show mac address-table aging-time&#xA;Vlan Aging Time&#xA;---- ----------&#xA;1    300&#xA;17   300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, Cisco IOS' default interface ARP timer is 4 hours...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2# show interface gi0/0&#xA;GigabitEthernet0/0 is up, line protocol is up &#xA;  Hardware is AmdP2, address is 000a.dead.beef (bia 000a.dead.beef)&#xA;  Internet address is 172.17.1.252/24&#xA;  MTU 1500 bytes, BW 10000 Kbit, DLY 1000 usec, &#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  ARP type: ARPA, ARP Timeout 04:00:00       &amp;lt;--------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Therefore, S2 starts flooding PC1's iSCSI traffic after five minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wtOO3.png&quot; alt=&quot;HSRP_Broken_02&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-08-18T11:46:58.280" LastActivityDate="2019-12-16T19:16:19.447" Title="Best practice for the combination of HSRP and ECMP" Tags="|cisco|best-practices|hsrp|ecmp|arp|" AnswerCount="7" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2193" PostTypeId="2" ParentId="2192" CreationDate="2013-07-03T10:58:28.137" Score="13" Body="&lt;p&gt;The simple answer is to make the CAM timer &lt;em&gt;equal or slightly longer than the corresponding interface ARP timer&lt;/em&gt;, but there are at least three different options to select from...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Option 1: Lower all interface ARP Timers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This option works best if you have a decent-sized layer2 switched network, a reasonable number of ARP entries and few routed interfaces.  This method also is preferable if you like to see PC mac entries age out of the topology quickly.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;On all IOS ethernet interfaces facing an ethernet switch: &lt;code&gt;arp timeout 240&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;On all IOS ethernet interfaces facing an ethernet switch: &lt;code&gt;hold-queue 200 in&lt;/code&gt; and &lt;code&gt;hold-queue 200 out&lt;/code&gt; to avoid dropping ARP packets during periodic ARP-refreshes (these limits could be higher, or lower depending on how many ARP refreshes you think that you'll need to handle at once).  If you are adjusting &lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/spd.html&quot;&gt;Selective Packet Discard&lt;/a&gt; values, then you should follow the guidelines in the paper I linked.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This forces Cisco IOS to refresh the ARP table within four minutes, if it hasn't happened otherwise for a given ARP entry.  The obvious disadvantage is that this doesn't scale well if you have lots of ARP entries... the limits vary by platform.  I have used this with a few hundred ARPs per router on Catalyst 4500 / 6500 (the Layer3 SVIs) without any issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Option 2: Increase the switch CAM Timers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This option works best if you have a large number of ARP entries (i.e. thousands, such as an intense VMWare environment could see).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;On all IOS switches: &lt;code&gt;mac address-table aging-time 14400&lt;/code&gt;, or &lt;code&gt;mac address-table aging-time 14400 vlan &amp;lt;vlan-id&amp;gt;&lt;/code&gt; for any Vlan that is of concern.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This change adjusts timers that most people assume are fixed at 300 seconds (on Cisco IOS), so be sure to include this in continuity docs.  The side-effect of this is that CAM table entries linger for 4 hours after the PC is removed (which can be either good or bad, depending on your PoV).  If 4 hours is too long, see the next option...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Option 3: Change both the interface ARP timers, and the switch CAM Timers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This option avoids hideously-long CAM timers in Option 2 at the expense of more configuration.  You can choose whether you need 900 seconds, 1800 seconds, or whatever...  just make sure your CAM and ARP timers match; thus, you will need to configure both Option 1 and Option 2 in your topologies.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-03T12:37:54.443" LastActivityDate="2013-07-03T12:37:54.443" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2195" PostTypeId="2" ParentId="2192" CreationDate="2013-07-03T16:04:53.933" Score="1" Body="&lt;p&gt;To me, ECMP is the real issue here - so in addition to the above steps to limit unknown unicast flooding,  you can also tune the route metrics toward the WAN so that R1 is preferred over R2 for the return traffic. One way to achieve this is via distribute list on R2 as follows:&#xA;(EIGRP used for example only, the same can be achieved with OSPF or BGP with other commands)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;!&#xA;ip prefix-list R1-PREFER seq 5 permit 172.17.1.0/24&#xA;!&#xA;route-map R1-PREFER-MAP permit 10&#xA; match ip address prefix-list R1-PREFER&#xA; set metric 1 1 1 1 1&#xA;... (allow all other routes)&#xA;!&#xA;router eigrp 1&#xA; ....&#xA; distribute-list route-map R1-PREFER-MAP out Ser1/0&#xA; ....&#xA;!&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will result in the WAN forwarding all traffic for 172.17.1.0 to R1.  If R1 Se1/0 fails, the route will be installed toward R2. You can further tune these metrics so the backup route to R2 is actually a feasible successor for faster failover.  HSRP and tracking will take care of the egress traffic.&lt;/p&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-03T16:04:53.933" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2198" PostTypeId="2" ParentId="385" CreationDate="2013-07-03T17:10:59.217" Score="2" Body="&lt;p&gt;In my experience the 7K OIR function is 'hitless' with respect to the other linecards. However, keep in mind that in a configuration where M1 and F1 cards are mixed, the M1's handle all of the L3 functions, so removing the M1 will impact traffic on the others, hence the recommendation to have two in the system in such a config.  Also, if the system is carved into VDCs, you will want to understand any dependencies each VDC has on the card.&lt;/p&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-03T17:10:59.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2200" PostTypeId="2" ParentId="221" CreationDate="2013-07-03T20:22:08.570" Score="1" Body="&lt;p&gt;Without seeing what your setup is this example isn't going to be entirely accurate. However here is how I would configure Site A. Site B would be similar, minus the remote VPN pieces and reversing Site A and Site B pieces. Anything in brackets needs to be filled in with your own information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, for this particular example, the remote VPN would be through the Cisco VPN Client and not the AnyConnect Client. ShrewSoft VPN Client also works.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip local pool pool-remote-access 10.250.0.1 10.250.0.254&#xA;&#xA;crypto logging ezvpn&#xA;!&#xA;crypto isakmp policy 1&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA;&#xA;crypto isakmp key &amp;lt;pre-shared-site-to-site-key-here&amp;gt; address &amp;lt;site-b-ip&amp;gt;   no-xauth&#xA;&#xA;!&#xA;crypto isakmp client configuration group Remote-Users-Group&#xA; key &amp;lt;pre-shared-key-for-vpn-users&amp;gt;&#xA; dns &amp;lt;internal-domain-dns-ip&amp;gt;&#xA; domain &amp;lt;internal-domain-fqdn&amp;gt;&#xA; pool pool-remote-access&#xA; acl acl-remote-access&#xA; split-dns &amp;lt;internal-domain-fqdn&amp;gt;&#xA;crypto isakmp profile Remote-Users-Profile&#xA;   description Remote VPN Clients&#xA;   match identity group Remote-Users-Group&#xA;   client authentication list &amp;lt;inset-aaa-group-for-remote-user-authentication&amp;gt;&#xA;   isakmp authorization list &amp;lt;inset-aaa-group-for-remote-user-authorization&amp;gt;&#xA;   client configuration address respond&#xA;!&#xA;!&#xA;crypto ipsec transform-set esp-aes-sha esp-aes esp-sha-hmac&#xA;crypto ipsec df-bit clear&#xA;!&#xA;!&#xA;!&#xA;crypto dynamic-map dynamic-vpn-map 1&#xA; set transform-set esp-aes-sha &#xA; set isakmp-profile Remote-Users-Profile&#xA; reverse-route&#xA; qos pre-classify&#xA;!&#xA;!&#xA;crypto map vpn-map-all 1 ipsec-isakmp &#xA; description VPN to Site-B&#xA; set peer &amp;lt;site-b-IP&amp;gt;&#xA; set transform-set esp-aes-sha &#xA; match address acl-vpn-site-b&#xA;crypto map vpn-map-all 65535 ipsec-isakmp dynamic dynamic-vpn-map &#xA;&#xA;ip access-list extended acl-remote-access&#xA; permit ip &amp;lt;site-a-subnet&amp;gt; 0.0.0.255 10.250.0.0 0.0.0.255&#xA;&#xA;ip access-list extended acl-vpn-site-b&#xA; permit ip &amp;lt;site-a-subnet&amp;gt; 0.0.0.255 &amp;lt;site-b-subnet&amp;gt; 0.0.0.255&#xA;&#xA;&#xA;interface &amp;lt;outside-interface&amp;gt;&#xA; crypto map vpn-map-all&#xA;&#xA;! These ports need to be open on the outside interface &#xA;! permit udp any host &amp;lt;public-ip-of-outside-interface&amp;gt; eq non500-isakmp&#xA;! permit udp any host &amp;lt;public-ip-of-outside-interface&amp;gt; eq isakmp&#xA;! permit esp any host &amp;lt;public-ip-of-outside-interface&amp;gt;&#xA;! permit ahp any host &amp;lt;public-ip-of-outside-interface&amp;gt;&#xA;&#xA;!&#xA;!If doing NAT... need to block VPN-VPN connections from being NAT'd&#xA;!The following is an example setup - not definitive&#xA;!&#xA;&#xA;&#xA;&#xA;ip access-list extended acl-block-vpn&#xA; deny   ip &amp;lt;site-a-subnet&amp;gt; 0.0.0.255 &amp;lt;site-b-subnet&amp;gt; 0.0.0.255  !Site-B&#xA; deny   ip &amp;lt;site-a-subnet&amp;gt; 0.0.0.255 10.250.0.0 0.0.0.255       !Remote users &#xA; permit ip &amp;lt;site-a-subnet&amp;gt; 0.0.0.255 any&#xA;&#xA;route-map rm-block-vpn-on-nat permit 1&#xA; match ip address acl-block-vpn&#xA;&#xA;ip nat inside source route-map rm-block-vpn-on-nat interface &amp;lt;overloaded-interface&amp;gt; overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-07-03T20:22:08.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2201" PostTypeId="1" AcceptedAnswerId="2204" CreationDate="2013-07-03T20:26:09.943" Score="7" ViewCount="17388" Body="&lt;p&gt;Going through a JSEC book I noticed the following slide explains that there are 6 ike phase 1 messages that take place for a tunnel to establish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/RZeKQ.jpg&quot; alt=&quot;ike messages&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking in the &lt;code&gt;kmd&lt;/code&gt; log and &lt;code&gt;traceoptions&lt;/code&gt; data but I do not see any information relating to the IKE messages pictured in those logs. Perhaps I am looking at it wrong? If my SRX is hanging up on one of those messages where would I look to determine that?&lt;/p&gt;&#xA;" OwnerUserId="949" LastActivityDate="2013-07-03T22:17:11.970" Title="Juniper SRX: Where do I look to see IKE debug messages?" Tags="|vpn|juniper|juniper-srx|ike|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2204" PostTypeId="2" ParentId="2201" CreationDate="2013-07-03T22:01:23.727" Score="7" Body="&lt;p&gt;Juniper KB explaining how to locate / interpret information in the  Kmd log : &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB10097&amp;amp;smlogin=true&quot; rel=&quot;noreferrer&quot;&gt;How do I Find the VPN Entry in the Kmd Log on a J-Series or SRX-Series device?&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;although for releases prior to 12 the following kmd log issues below are also relevant for the higher end firewalls.&#xA;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB25297&quot; rel=&quot;noreferrer&quot;&gt;[SRX High End] request security ike debug-enable does not print any useful kmd debug output&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;its quite key which SRX and what software version you're using really.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;for reference only really , I use this method to troubleshoot a singe vpn tunnel without having to actually make any changes / commits&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;user@srx&amp;gt;request security ike debug-enable local  remote  level &lt;/p&gt;&#xA;&lt;p&gt;user@srx&amp;gt;show log /var/log/kmd&lt;/p&gt;&#xA;&lt;p&gt;user@srx&amp;gt;request security ike debug-disable&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Explained in detail here:&#xA;KB &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB19943&quot; rel=&quot;noreferrer&quot;&gt;[SRX] How can I enable IKE traceoptions for only specific security associations&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-07-03T22:17:11.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2212" PostTypeId="1" AcceptedAnswerId="2214" CreationDate="2013-07-04T21:52:32.873" Score="18" ViewCount="37308" Body="&lt;p&gt;In Junos  when you use a &lt;code&gt;show route&lt;/code&gt; it displays the routing tables , starting with inet.0 ( global routing table) and then listing each VRF in alphabetic order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am after a similar command , for the following reason , new WAN deployment: remote engineer to verify VRF connectivity without plugging in the LAN, therefore I want to list the mandatory routes that are mandatory in each VRF ( e.g. 0/0 ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can achieve this with &lt;code&gt;show ip bgp vpnv4 all&lt;/code&gt; but this does not display the global routing table , and that is currently used for management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in Junos I would run &lt;code&gt;show route 0/0&lt;/code&gt; which would display all occurrences of the specified route in every VRF across the device including inet.0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iank@r1&amp;gt; show route 0/0 exact terse &#xA;&#xA;vrf1.inet.0: 99 destinations, 105 routes (99 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;A Destination        P Prf   Metric 1   Metric 2  Next hop        AS path&#xA;* 0.0.0.0/0          B 170        100          0 &amp;gt;172.31.30.2     64512 I&#xA;&#xA;vrf2.inet.0: 362 destinations, 408 routes (362 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;A Destination        P Prf   Metric 1   Metric 2  Next hop        AS path&#xA;* 0.0.0.0/0          B 170        100            &amp;gt;172.31.7.2      64999 I&#xA;&#xA;vrf3.inet.0: 658 destinations, 711 routes (658 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;A Destination        P Prf   Metric 1   Metric 2  Next hop        AS path&#xA;* 0.0.0.0/0          B 170        100            &amp;gt;172.31.12.2     64999 I&#xA;&#xA;vrf4.inet.0: 377 destinations, 423 routes (377 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;A Destination        P Prf   Metric 1   Metric 2  Next hop        AS path&#xA;* 0.0.0.0/0          B 170        100            &amp;gt;172.31.3.2      64999 I&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;am I missing a really obvious way of achieving this ? &lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="1092" LastEditDate="2013-07-05T11:48:49.510" LastActivityDate="2013-07-05T11:48:49.510" Title="Cisco - display ALL routes using a single command" Tags="|cisco-commands|cisco-ios-12|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2213" PostTypeId="2" ParentId="2212" CreationDate="2013-07-04T22:15:58.057" Score="3" Body="&lt;p&gt;&lt;code&gt;show ip route&lt;/code&gt; for the IPv4 FIB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show ipv6 route&lt;/code&gt; for the IPv6 FIB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VRF routes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show &amp;lt;ip/ipv6&amp;gt; route vrf &amp;lt;*/vrfName&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;of course, * shows all VRFs.&lt;/p&gt;&#xA;" OwnerUserId="378" LastEditorUserId="378" LastEditDate="2013-07-04T22:54:33.667" LastActivityDate="2013-07-04T22:54:33.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2214" PostTypeId="2" ParentId="2212" CreationDate="2013-07-04T22:27:17.580" Score="17" Body="&lt;p&gt;&lt;strong&gt;&lt;code&gt;show ip route vrf *&lt;/code&gt;&lt;/strong&gt; displays the global routing table plus all the VRF instances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;sh ip route vrf * 0.0.0.0&lt;/code&gt;&lt;/strong&gt; displays the default route for each VRF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This shows the default route for each VRF, including the default VRF.  As this IOS 12.4 doesn't show the VRF name when displaying a matching route, a route tag was added on the static routes to help identify their VRF.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;r1#show ip route vrf * 0.0.0.0&#xA;&#xA;Routing entry for 0.0.0.0/0, supernet&#xA;  Known via &quot;static&quot;, distance 1, metric 0, candidate default path&#xA;  Tag 100&#xA;  Routing Descriptor Blocks:&#xA;  * 192.0.2.2&#xA;      Route metric is 0, traffic share count is 1&#xA;      Route tag 100&#xA;&#xA;Routing entry for 0.0.0.0/0, supernet&#xA;  Known via &quot;static&quot;, distance 1, metric 0, candidate default path&#xA;  Tag 200&#xA;  Routing Descriptor Blocks:&#xA;  * 192.0.2.2&#xA;      Route metric is 0, traffic share count is 1&#xA;      Route tag 200&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Showing longer-prefixes on your matching route will show the VRF names.&#xA;&lt;strong&gt;`sh ip route vrf * 192.0.2.0 longer-prefixes'.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-07-04T23:08:24.580" LastActivityDate="2013-07-04T23:08:24.580" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2215" PostTypeId="1" AcceptedAnswerId="2216" CreationDate="2013-07-05T04:46:31.267" Score="8" ViewCount="1463" Body="&lt;p&gt;We are testing a new Provisioning Server in DOCSIS/CMTS environment and we need to setup a lab with 5 models of CPE. &#xA;I'm wondering if we can configure on Cisco Routers the dhcp relay (ip helper) accord with the MAC address of CPE. &#xA;The goal of this would be to redirect by default all dhcp discover to the actual Provisioning Server and the 5 CPE of lab would be redirect to the new Provisioning Server. &#xA;A guess how to reach that ?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Info :&lt;br&gt;&#xA;The router is a CMTS Cisco UBR7225 with NPE-G2 card.&lt;br&gt;&#xA;The type of DHCP server is irrelevant, you can consider as ISC DHCPd service running on both.  &lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="775" LastEditDate="2013-07-05T11:46:58.960" LastActivityDate="2013-08-16T07:56:32.833" Title="DHCP Relay by MAC Address of CPE" Tags="|cisco|router|dhcp|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2216" PostTypeId="2" ParentId="2215" CreationDate="2013-07-05T08:12:32.927" Score="4" Body="&lt;p&gt;I don't think it's possible to do what you want to do. If it would be possible, it would be something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool MAC1&#xA;  relay source 10.10.0.0/24&#xA;  relay destination 192.0.2.NEW&#xA;  client-identifier 0122.2222.2222.01&#xA;...&#xA;ip dhcp pool REST&#xA;  relay source 10.10.0.0/24&#xA;  relay destination 192.0.2.OLD&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it was not accepted in my lab box:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;lab(dhcp-config)#client-identifier 0122.2222.2222.01&lt;br&gt;&#xA;  % This command may not be used with network, origin, vrf or relay pools.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can however configure two helper-addresses and filter the requests at the DHCP server, so that 'old' excludes replying to those 5 MAC addresses and 'new' only replies to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But maybe you simply need more isolated lab environment, at least separate logical interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also create interim DHCP server, which forwards requests further based on the MAC addresses, it wouldn't be very hard exercise, probably 2-3h including research for me. But would you want your production to rely on this new script, I certainly would not want it to.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-07-05T08:12:32.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2217" PostTypeId="2" ParentId="385" CreationDate="2013-07-05T10:43:50.557" Score="0" Body="&lt;p&gt;Also, on shutdown or online of a card the N7k has to rewrite some or all other forwarding engines if this card contained part of a channel. this may cause a short traffic interruption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but if the card is blank you should be fine. i would shutdown the card via cli before i do the OIR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there are no such issues like bus-stall we had with the cat6k and we never had any problems.&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-07-05T10:43:50.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2218" PostTypeId="2" ParentId="2215" CreationDate="2013-07-05T11:46:46.553" Score="4" Body="&lt;p&gt;Multiple &lt;code&gt;ip helper-address&lt;/code&gt; statements are supported in Cisco IOS... so, let's assume you're using ISC dhcpd (as you mentioned in your question)... &lt;a href=&quot;https://learningnetwork.cisco.com/thread/29891#148285&quot; rel=&quot;nofollow&quot;&gt;multiple helper addresses forwards DHCP Discover messages to both servers at the same time&lt;/a&gt;; therefore, you need:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;a way to stop lab machines from receiving a production address; I recommend that you &lt;a href=&quot;https://lists.isc.org/pipermail/dhcp-users/2010-July/012029.html&quot; rel=&quot;nofollow&quot;&gt;black hole the lab mac-addresses on the production ISC DHCPd system&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;a way to stop production machines from receiving a lab address; I recommend that you use 100% static DHCP reservations for this subnet on your lab ISC DHCPd system...&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-07-05T11:46:46.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2219" PostTypeId="1" AcceptedAnswerId="2220" CreationDate="2013-07-05T12:02:03.650" Score="11" ViewCount="3875" Body="&lt;p&gt;I already asked this question on SF, but figured it might be a better fit here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it at all possible to extend MACSec encryption over a provider bridge? Will the typical 802.1ad implementation be able to forward the encrypted frame, or will forwarding break frame integrity?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do realize MACSec is intended for hop-by-hop security. Are there any reasons not to use MACSec for point-to-point encryption over a carrier, or other special considerations that should be taken into account?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I ask is that MACSec hardware offers wirespeed encryption at a fraction of the typical cost associated with layer 2 encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have the rep to add new tags, but feel free to add relevant tags for MACSec, PBN, 802.1ad and 802.1ae etc&lt;/p&gt;&#xA;" OwnerUserId="1947" LastEditorUserId="775" LastEditDate="2013-08-01T12:31:44.267" LastActivityDate="2014-06-17T01:09:10.917" Title="Extend MACSec encryption over provider bridge" Tags="|ethernet|security|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2220" PostTypeId="2" ParentId="2219" CreationDate="2013-07-05T12:09:21.040" Score="4" Body="&lt;p&gt;MacSec (i.e. 802.1ae-2006) is a hop-by-hop encyption technology... Therefore provider-bridged MacSec isn't possible today; however, there is &lt;a href=&quot;http://www.ieee802.org/1/files/public/docs2013/ae-seaman-macsec-hops-0213-v02.pdf&quot; rel=&quot;nofollow&quot;&gt;a talk of relaxing per-hop MacSec encryption&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-07-05T12:09:21.040" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2221" PostTypeId="1" AcceptedAnswerId="2222" CreationDate="2013-07-05T13:35:27.840" Score="10" ViewCount="8510" Body="&lt;p&gt;I'm pinging yahoo.com and am I'm puzzled by the result.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\jon&amp;gt;ping -t yahoo.com&#xA;&#xA;Pinging yahoo.com [98.138.253.109] with 32 bytes of data:&#xA;Reply from 98.138.253.109: bytes=32 time=195ms TTL=46&#xA;Reply from 98.138.253.109: bytes=32 time=230ms TTL=44&#xA;Reply from 98.138.253.109: bytes=32 time=175ms TTL=45&#xA;Reply from 98.138.253.109: bytes=32 time=208ms TTL=44&#xA;Reply from 98.138.253.109: bytes=32 time=180ms TTL=46&#xA;Reply from 98.138.253.109: bytes=32 time=206ms TTL=44&#xA;Reply from 98.138.253.109: bytes=32 time=209ms TTL=44&#xA;Reply from 98.138.253.109: bytes=32 time=173ms TTL=46&#xA;Reply from 98.138.253.109: bytes=32 time=170ms TTL=46&#xA;Reply from 98.138.253.109: bytes=32 time=224ms TTL=45&#xA;Reply from 98.138.253.109: bytes=32 time=200ms TTL=45&#xA;Reply from 98.138.253.109: bytes=32 time=172ms TTL=46&#xA;Reply from 98.138.253.109: bytes=32 time=258ms TTL=44&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I vaguely understand the TTL value as the number of hops that the packet traverses to reach its destination, but I don't understand how TTL can have such a dramatic +/- 1 variance in such a short amount of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, it seems Yahoo has some kind of rate-limiting implemented as a persistent ping will start timing out after about 20 packets. Is this normal? bing.com doesn't even reply to me!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When pinging google.com the TTLs are consistent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When pinging Twitter.com sometimes I get TTL=249, but usually TTL-58.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's going on? Are my ISP up to no good or is there a less sinister explanation?&lt;/p&gt;&#xA;" OwnerUserId="1948" LastActivityDate="2013-07-05T19:13:24.133" Title="interpreting ping results" Tags="|routing|nat|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2222" PostTypeId="2" ParentId="2221" CreationDate="2013-07-05T13:50:28.533" Score="14" Body="&lt;p&gt;Most likely this is caused by load balancing across multiple networks. Each ping will take a different path and accordingly will have a difference TTL value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also read about search engine providers doing strange things with TTL, but its just going through a different route either way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TTL values are different when sourced from different operating systems:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows: 128&lt;/li&gt;&#xA;&lt;li&gt;Linux: 64&lt;/li&gt;&#xA;&lt;li&gt;Cisco: 255&lt;/li&gt;&#xA;&lt;li&gt;Solaris: 255&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And yes, some sites will stop responding to ICMP after a certain amount of time, or when a rate limit is hit. I believe Google's DNS on 8.8.8.8 eventually stops after a while.&lt;/p&gt;&#xA;" OwnerDisplayName="user275" LastActivityDate="2013-07-05T13:50:28.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2224" PostTypeId="2" ParentId="2221" CreationDate="2013-07-05T15:37:40.897" Score="2" Body="&lt;p&gt;The variance of TTL on these packets could be explained by a router(s) that are taking a long time to process the packets. TTL is decremented by one after each hop if the time through the router is less than one second. If the time taken through the router is greater that one second TTL will be decremented by two rather than one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.ietf.org/rfc/rfc791.txt&quot; rel=&quot;nofollow&quot;&gt;RFC791&lt;/a&gt; page 29:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Time to Live&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The time to live is set by the sender to the maximum time the&#xA;datagram is allowed to be in the internet system.  If the datagram&#xA;is in the internet system longer than the time to live, then the&#xA;datagram must be destroyed.&#xA;&#xA;This field must be decreased at each point that the internet header&#xA;is processed to reflect the time spent processing the datagram.&#xA;Even if no local information is available on the time actually&#xA;spent, the field must be decremented by 1.  The time is measured in&#xA;units of seconds (i.e. the value 1 means one second).  Thus, the&#xA;maximum time to live is 255 seconds or 4.25 minutes.  Since every&#xA;module that processes a datagram must decrease the TTL by at least&#xA;one even if it process the datagram in less than a second, the TTL&#xA;must be thought of only as an upper bound on the time a datagram may&#xA;exist.  The intention is to cause undeliverable datagrams to be&#xA;discarded, and to bound the maximum datagram lifetime.&#xA;&#xA;Some higher level reliable connection protocols are based on&#xA;assumptions that old duplicate datagrams will not arrive after a&#xA;certain time elapses.  The TTL is a way for such protocols to have&#xA;an assurance that their assumption is met.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="80" LastActivityDate="2013-07-05T15:37:40.897" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2225" PostTypeId="2" ParentId="2221" CreationDate="2013-07-05T19:13:24.133" Score="5" Body="&lt;p&gt;Others have mentioned the multipath scenario to explain the variation in delay time. With ECMP (Equal Cost Multi Path) links you can have a scenario as per the output you provided in the ping to Yahoo, where the delay changes between results but reasonably consistently. So it looks like your traffic is being hashed over the same two or three paths, with varying lengths (delays) (although that is only speculation, I no one can say for certain with the information given).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, it seems Yahoo has some kind of rate-limiting implemented as a&#xA;  persistent ping will start timing out after about 20 packets. Is this&#xA;  normal? bing.com doesn't even reply to me!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Some networks do filter ICMP traffic which I find hugely annoying! So that could explain the &quot;no pings at all&quot; scenario. For scenarios where you have some replies, or limited replies, the network could be implementing a technology like &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/copp.html&quot;&gt;Cisco's Control Plan Policing&lt;/a&gt; (or their vendor equivalent).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When pinging Twitter.com sometimes I get TTL=249, but usually TTL-58.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you are having less stable result variation, un-Equal Cost Multi Path routes could be present, or a change in traffic engineer due to a link issue some where in the path. Again, can't say with the information given.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-07-05T19:13:24.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2227" PostTypeId="1" AcceptedAnswerId="2233" CreationDate="2013-07-05T22:20:15.573" Score="10" ViewCount="679" Body="&lt;p&gt;I am implementing a system where one device on a network queries at a very high frequency (hundreds or thousands of queries per second) through sending a small UDP packet with 8 or so bytes of data. This is received by another application, perhaps on another device, which does some very simple processing and sends off the few-byte-large result wrapped in another UDP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know what sort of round trip times are feasible with typical hardware, where the communicating systems are perhaps connected via wired Ethernet a few meters apart, taking into account propagation and transmission delays, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other thoughts and suggestions are also welcome.&lt;/p&gt;&#xA;" OwnerUserId="1958" LastEditorUserId="775" LastEditDate="2013-07-06T04:52:38.037" LastActivityDate="2013-08-29T16:28:26.670" Title="Ultra-Fast Querying Using UDP Packets" Tags="|ethernet|latency|speed|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2231" PostTypeId="1" AcceptedAnswerId="2232" CreationDate="2013-07-06T05:16:04.510" Score="6" ViewCount="24758" Body="&lt;p&gt;I'm a CCNA student and during a LAB I found that for some rules on an incoming extended ACL using a rule like &lt;code&gt;permit tcp any any eq (protocol)&lt;/code&gt; would work fine while on other rules I needed to use the format &lt;code&gt;permit tcp any eq (protocol) any&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just wondering what the difference is?&lt;/p&gt;&#xA;" OwnerUserId="1834" LastEditorUserId="775" LastEditDate="2013-07-06T05:21:57.493" LastActivityDate="2013-07-06T05:27:27.267" Title="What is the difference between &quot;permit tcp any any eq telnet&quot; and &quot;permit tcp any eq telnet any&quot;?" Tags="|cisco|cisco-ios|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2232" PostTypeId="2" ParentId="2231" CreationDate="2013-07-06T05:21:33.817" Score="12" Body="&lt;pre&gt;&lt;code&gt;permit tcp any any eq &amp;lt;protocol-port&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Allows any traffic with a &lt;em&gt;destination&lt;/em&gt; TCP port == protocol-port&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit tcp any eq &amp;lt;protocol-port&amp;gt; any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Allows any traffic with a &lt;em&gt;source&lt;/em&gt; TCP port == protocol-port&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;ACLs tend to use fixed ports for the server-side of a client-server connection.  Typically, the client connects to a well-known port on a server; when you posted to Stack Exchange, your web-browser (client) connected to the Stack Exchange server on TCP port 80.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            POS1/0        Gi0/0&#xA;              +-----------+&#xA;Internet -----|   Router  |----- Webserver (listening on TCP/80)&#xA;              +-----------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So pretend Stack Exchange was applying these ACLs to the router above, they could use this inbound on their POS1/0 interface; because traffic &lt;em&gt;to&lt;/em&gt; the Stack Exhange webserver would be going to TCP/80&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended WEB_in&#xA; permit tcp any any eq 80&#xA; deny ip any any log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They could apply this outbound on POS1/0, because traffic &lt;em&gt;leaving&lt;/em&gt; the Stack Exhange webserver would be sourced from TCP/80&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended WEB_out&#xA; permit tcp any eq 80 any&#xA; deny ip any any log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this example, keep in mind that applying an ACL to &quot;any eq 80&quot; isn't terribly useful; normally you would limit it to specific IP addresses that you want to expose TCP 80 to the internet.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-06T05:27:27.267" LastActivityDate="2013-07-06T05:27:27.267" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2233" PostTypeId="2" ParentId="2227" CreationDate="2013-07-06T07:28:54.827" Score="11" Body="&lt;p&gt;An an example Juniper MX80 has ingress-&gt;egress delay of about 8us, on low-latency cut-through switch it can be &amp;lt;1us (maybe 0.7us). (Remember that cut-through switch can't do cut-through 100% of time, only when egress port happens to be idle!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1km in fibre is about 5us latency (again, single direction).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Serialization delay @10G for minimum sized payload (46B) is about 67ns (0.067us), by increasing link-speed, you decrease serialization delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP header is 20B, UDP header is 8B, you data is 8B, so you have just 36B of data, which means your ethernet payload will include 10B of trash you &lt;em&gt;MUST&lt;/em&gt; send, i.e. if you have something to add to your payload add it, it has 0 latency cost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope you can extrapolate RTT from these, by multiplying the device delay by device count and adding 5us for every kilometer of fibre and then multiply that by 2.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I can't resist adding some thoughts aboutg HFT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://www.advancedtrading.com/algorithms/have-we-hit-peak-hft/240156447&quot;&gt;this&lt;/a&gt; HFT volume halved between 2009 and 2012. Suggesting that the easy wins are gone. I'd love to see some scientific paper or just real data about HFT latency and its affect on profit. I suspect latency which affects trade profits are on another magnitude than latency we're talking about right now. Friend of mine who builds network for one of the largest exchange seems to think it's just customer who do 'lower == better' without understanding the scales.&lt;br&gt;&#xA;I can completely understand how HFT was useful when few people were doing it, when you could observe marketA not seeing change marketB does see and capitalize on it. Some are talking about using regulation to stop HFT by taxing each trade making it expensive for everyone, I don't think it'll be needed, I think the window of opportunity is already closing.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-07-06T07:28:54.827" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2238" PostTypeId="1" CreationDate="2013-07-06T14:49:50.270" Score="13" ViewCount="30379" Body="&lt;pre&gt;&lt;code&gt;ip nat inside source static 192.168.1.10 10.10.10.9 route-map RANGE&#xA;!&#xA;route-map RANGE permit 100&#xA;  match ip address 102&#xA;!&#xA;access-list 102 permit tcp host 192.168.1.10 range 3000 3389 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The configuration does not seem to work.. just creates a one to one static NAT...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does any one know how to open range of ports?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have multiple external IPs and would like to open same ports for multiple hosts using multiple external ip's and because of that the rotary method does not work.&lt;/p&gt;&#xA;" OwnerUserId="1955" LastEditorUserId="775" LastEditDate="2013-07-06T14:56:43.073" LastActivityDate="2013-07-13T04:38:48.070" Title="Open a range of TCP ports in Cisco IOS NAT" Tags="|cisco|tcp|nat|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2239" PostTypeId="2" ParentId="2238" CreationDate="2013-07-06T15:45:47.723" Score="9" Body="&lt;p&gt;(EDIT)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that inside-&gt;outside works as expected, as seen in the answer below, but outside-&gt;inside actually does not, it allows everything, as OP suggested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding 'reversible' in the NAT line it starts to honor the route-map for outside-&gt;inside, unfortunately it does not seem to work with ports:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;permit ip any host 194.100.7.226 &lt;strong&gt;works&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;permit tcp any any &lt;strong&gt;works&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;permit tcp any any eq 80 &lt;strong&gt;no match, does not work&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;permit tcp any eq 80 any &lt;strong&gt;match, does not work&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;permit tcp any eq 80 host 194.100.7.226 &lt;strong&gt;match, does not work&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;permit tcp any eq 0 host 194.100.7.226 &lt;strong&gt;works&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;At '194.100.7.226' I'm doing 'telnet 91.198.120.222 80', that is my source is 194.100.7.226:ephemeral destination is 91.198.120.222:80. As the example &lt;strong&gt;#1&lt;/strong&gt; works, we can conclude that &lt;em&gt;reversible&lt;/em&gt; actually 'reverses' the ACL, so that it works in same manner both directions, which makes sense.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the the connection match but does not work, in 'deny any any log-input line I get this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;.Jul  7 07:58:59.118 UTC: %SEC-6-IPACCESSLOGP: list MOO denied tcp&#xA;  91.198.120.2(0) (Tunnel101 ) -&gt; 194.100.7.226(0), 1 packet&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it really seems like L4 protocol type is carried, but ports are not carried during the NAT reversal. So outside-&gt;inside ranges do not work.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As suggested in question &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/998/cisco-867-forward-udp-port-range&quot;&gt;Cisco 867 forward UDP port range&lt;/a&gt; this works for outside-&gt;inside&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat pool MOO 91.198.120.2 91.198.120.2 prefix-length 30 type rotary&#xA;ip nat inside destination list MOO pool MOO&#xA;ip access-list extended MOO&#xA; permit tcp any any range 22 100&#xA; deny   ip any any log-input&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's bit ghetto I feel, as you don't have good control on the outside IP. Pool is the inside IP, outside IP is router outside IP.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Original answer of inside-&gt;outside working with ports:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static 91.198.120.2 91.198.120.222 route-map MOO&#xA;!&#xA;ip access-list extended MOO&#xA; permit icmp any any&#xA; permit tcp any any range 22 telnet&#xA;!&#xA;route-map MOO permit 100&#xA; match ip address MOO&#xA;!&#xA;route-map MOO deny 200&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;@91.198.120.2 I'm doing:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;telnet testhost 22&lt;/li&gt;&#xA;&lt;li&gt;telnet testhost 23&lt;/li&gt;&#xA;&lt;li&gt;telnet testhost 24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;At testhost I can observe:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1   0.000000 91.198.120.222 -&amp;gt; 194.100.7.226 TCP 74 50925 &amp;gt; ssh [SYN] Seq=0 Win=14600 Len=0 MSS=1350 SACK_PERM=1 TSval=7995067 TSecr=0 WS=128&#xA;&#xA;2   9.838471 91.198.120.222 -&amp;gt; 194.100.7.226 TCP 74 41586 &amp;gt; telnet [SYN] Seq=0 Win=14600 Len=0 MSS=1350 SACK_PERM=1 TSval=7997586 TSecr=0 WS=128&#xA;&#xA;5  16.773181 91.198.120.2 -&amp;gt; 194.100.7.226 TCP 74 53307 &amp;gt; 24 [SYN] Seq=0 Win=14600 Len=0 MSS=1350 SACK_PERM=1 TSval=7999327 TSecr=0 WS=128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tested on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bu.ip.fi#sh ver | i ^Cisco&#xA;Cisco IOS Software, C880 Software (C880DATA-UNIVERSALK9-M), Version 15.1(2)T5, RELEASE SOFTWARE (fc1)&#xA;Cisco 881G (MPC8300) processor (revision 1.0) with 236544K/25600K bytes of memory.&#xA;bu.ip.fi#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="561" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2013-07-07T10:11:11.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2240" PostTypeId="1" CreationDate="2013-07-08T00:16:32.773" Score="6" ViewCount="1857" Body="&lt;p&gt;I currently make use of a NETGEAR FVS338 firewall and a NETGEAR 24 port switch. Is there a way to graphically or in some way monitor their traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Switch Model FS726T&lt;/p&gt;&#xA;" OwnerUserId="1963" LastEditorUserId="775" LastEditDate="2013-08-07T15:40:01.183" LastActivityDate="2015-01-29T22:29:39.803" Title="Monitoring Network Traffic" Tags="|switch|monitoring|firewall|environmental-monitoring|" AnswerCount="6" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2241" PostTypeId="2" ParentId="2240" CreationDate="2013-07-08T00:50:10.643" Score="8" Body="&lt;p&gt;The FVS338 firewall has SNMP v1 and v2c support according to the &lt;a href=&quot;http://www.netgear.com/business/products/security/wired-VPN-firewalls/FVS338.aspx#two&quot; rel=&quot;noreferrer&quot;&gt;Netgear documentation&lt;/a&gt; on it (listed under Management Features).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FS726T switch also supports SNMP v1 according to &lt;a href=&quot;http://www.netgear.com/business/products/switches/smart-switches/smart-switches/FS726T.aspx#two&quot; rel=&quot;noreferrer&quot;&gt;it's documentation&lt;/a&gt; (listed under Administrative Switch Management).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, any number of free or paid NMS systems could give you the graphical information you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a small setup like this, I'd recommend something along the lines of &lt;a href=&quot;http://cactiez.cactiusers.org/&quot; rel=&quot;noreferrer&quot;&gt;CactiEZ&lt;/a&gt; for graphing your data gathered via SNMP.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now as a note, SNMP v1 is not a secure way to monitor/maintain your network equipment.  Where possible, (it is not in this case) I recommend using SNMP v3.  There are several authentication and encryption enhancements in v3 that are well worth implementing to secure your network management setup.  You don't have that ability to do so on this gear, because sometimes the lack of newer/more secure features is what you trade off for lower price. &lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-07-08T18:12:36.833" LastActivityDate="2013-07-08T18:12:36.833" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2242" PostTypeId="1" CreationDate="2013-07-08T07:47:48.943" Score="7" ViewCount="1350" Body="&lt;p&gt;I've got a Cisco 1900 router which connects to the Internet using a primary and a secondary  WAN connection.&#xA;When the primary connection is up, all traffic use this link. When the primary connection is down, I use the secondary connection to connect to the router to troubleshoot why the primary link is down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes I would also like the two connection to be up and running at the same time. I would then  like to be able to access the router using SSH on either one of its public IP-addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any (easy) way of having both these interfaces accessible at the same time?&lt;/p&gt;&#xA;" OwnerUserId="1966" LastActivityDate="2013-07-30T19:56:16.387" Title="Multiple WANs/Out-of-band (Cisco 1900)" Tags="|cisco|cisco-ios|failover|wan|oob|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2243" PostTypeId="2" ParentId="2240" CreationDate="2013-07-08T09:32:51.377" Score="2" Body="&lt;p&gt;Have a look at  &lt;a href=&quot;http://www.ntop.org/&quot; rel=&quot;nofollow&quot;&gt;NTOP&lt;/a&gt;  I used this in smaller enterprise deployments to find and identify possible flow anomalies. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ntopng&#xA;  ntopng, the next generation version of the original ntop, a network traffic probe that shows the network usage, similar to what the popular top Unix command does. ntopng is based on libpcap and it has been written in a portable way in order to virtually run on every Unix platform, MacOSX and on Win32 as well.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What ntopng can do for me?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Sort network traffic according to many protocols&lt;/li&gt;&#xA;&lt;li&gt;Show network traffic and IPv4/v6 active hosts&lt;/li&gt;&#xA;&lt;li&gt;Store on disk persistent traffic statistics in RRD format&lt;/li&gt;&#xA;&lt;li&gt;Geolocate hosts&lt;/li&gt;&#xA;&lt;li&gt;Discover application protocols by leveraging on nDPI, ntop’s DPI framework.&lt;/li&gt;&#xA;&lt;li&gt;Characterise HTTP traffic by leveraging on characterisation services provided by block.si. ntopng comes with a demo characterisation key, but if you need a permanent one, please mail info@block.si.&lt;/li&gt;&#xA;&lt;li&gt;Show IP traffic distribution among the various protocols&lt;/li&gt;&#xA;&lt;li&gt;Analyse IP traffic and sort it according to the source/destination&lt;/li&gt;&#xA;&lt;li&gt;Display IP Traffic Subnet matrix (who’s talking to who?)&lt;/li&gt;&#xA;&lt;li&gt;Report IP protocol usage sorted by protocol type&lt;/li&gt;&#xA;&lt;li&gt;Act as a NetFlow/sFlow collector for flows generated by routers (e.g. Cisco and Juniper) or switches (e.g. Foundry Networks) when used together with nProbe.&lt;/li&gt;&#xA;&lt;li&gt;Produce HTML5/AJAX network traffic statistics&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1092" LastActivityDate="2013-07-08T09:32:51.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2245" PostTypeId="2" ParentId="2240" CreationDate="2013-07-08T10:45:36.733" Score="0" Body="&lt;p&gt;to setup SNMPd on the firewall, have a look at page 154 and further of this manual&#xA;&lt;a href=&quot;http://www.downloads.netgear.com/files/FVS338_RM_28Jan2010.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.downloads.netgear.com/files/FVS338_RM_28Jan2010.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1325" LastActivityDate="2013-07-08T10:45:36.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2247" PostTypeId="1" AcceptedAnswerId="2249" CreationDate="2013-07-08T12:32:14.410" Score="8" ViewCount="11026" Body="&lt;p&gt;I have used the Cisco interface range commands on many occasions to disable  a large number of switching ports when the device is originally deployed as a once off and am looking for something similar in Junos.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I &lt;strong&gt;don't&lt;/strong&gt; want to use &lt;strong&gt;apply-groups&lt;/strong&gt; or the juniper &lt;strong&gt;interface-range&lt;/strong&gt; command set as there changes are permanent and to be honest  it would confuse the Tier-1 / Tier 2 staff , aka inherited config is hidden by default and therefore will likely get missed when troubleshooting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am just looking for verification that there is no way to do this natively before I look at using slax to create a custom command.&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="561" LastEditDate="2013-07-08T13:32:59.477" LastActivityDate="2013-07-09T13:57:32.513" Title="Juniper EX - disable multiple interfaces at the same time as a once off" Tags="|juniper-junos|juniper-ex|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2248" PostTypeId="2" ParentId="2242" CreationDate="2013-07-08T13:11:27.853" Score="6" Body="&lt;p&gt;As long as both interfaces have public IP addresses, which it sounds like, you have two options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) IP SLA: outbound traffic will only use one interface at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, you configure a static default route out the primary interface, which is tracked and a static default route out the secondary interface. If the tracking finds an issue, the tracked route is removed, making the default route out the secondary interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/813-cisco-router-ipsla-basic.html&quot;&gt;IP SLA link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)# ip sla 1&#xA;R1(config)# icmp-echo $primaryNextHop source-interface $primaryInterface&#xA;R1(config)# timeout 1000&#xA;R1(config)# threshold 2&#xA;R1(config)# frequency 3&#xA;R1(config)# ip sla schedule 1 life forever start-time now&#xA;R1(config)# track 1 ip sla 1 reachability&#xA;R1(config)# ip route 0.0.0.0 0.0.0.0 $primaryNextHop track 1&#xA;R1(config)# ip route 0.0.0.0 0.0.0.0 $secondaryNextHop 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) BGP peer with ISPs: this can be configured to allow traffic outbound on both interfaces at the same time. You can also set this up to allow ISP1 to receive traffic for the secondary interface and vice versa (&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00800945bf.shtml&quot;&gt;BGP Multihoming&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="769" LastActivityDate="2013-07-08T13:11:27.853" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2249" PostTypeId="2" ParentId="2247" CreationDate="2013-07-08T13:31:39.003" Score="4" Body="&lt;p&gt;I don't think it's supported natively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately you don't need to create the SLAX script yourself, as such &lt;a href=&quot;https://code.google.com/p/junoscriptorium/source/browse/trunk/library/juniper/commit/interfaces/expand-interface-ranges/expand-interface-ranges.slax&quot; rel=&quot;nofollow&quot;&gt;script&lt;/a&gt; already exists. Essentially you configure normal interface-range, but upon commit its content is expanded to the real interfaces and the interface-range config is removed, creating approximation of the IOS behavior.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-07-08T13:55:22.250" LastActivityDate="2013-07-08T13:55:22.250" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2250" PostTypeId="2" ParentId="2240" CreationDate="2013-07-08T18:49:14.420" Score="0" Body="&lt;p&gt;Once you get snmp up and running, you can use Cacti to graphically plot your interfaces.  It works real well...been using it for years. Oh, and it's free!&lt;/p&gt;&#xA;" OwnerUserId="864" LastActivityDate="2013-07-08T18:49:14.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2252" PostTypeId="2" ParentId="1720" CreationDate="2013-07-08T20:48:43.933" Score="2" Body="&lt;p&gt;If you check the &quot;sh ip dhcp bindings&quot; table on the switch is a lease shown for the VMs MAC address? If so, the DHCP Discover is reaching the switch, and the broadcast Offer is being sent back, but dropped by the AP.  Although it seems unrelated, this behavior can be caused when the the AP and client don't support the the same WMM QOS parameters. Try adding &quot;[no] dot11 qos mode wmm&quot; to the AP config.&lt;/p&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-08T20:48:43.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2255" PostTypeId="2" ParentId="2238" CreationDate="2013-07-09T00:50:26.493" Score="1" Body="&lt;p&gt;so to fix my issue what i did was &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static 91.198.120.2 91.198.120.222 route-map MOO&#xA;!&#xA;ip access-list extended MOO&#xA; permit icmp any any&#xA; permit tcp any any range 22 telnet&#xA;!&#xA;route-map MOO permit 100&#xA; match ip address MOO&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and i also included an access list 199 on my external interface &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 199 permit tcp any host external_host eq 3389&#xA;access-list 199 deny   ip any host external_host&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this access list takes care of the allowing all port issue. &lt;/p&gt;&#xA;" OwnerUserId="1978" LastEditorUserId="33" LastEditDate="2013-07-09T03:32:39.133" LastActivityDate="2013-07-09T03:32:39.133" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2256" PostTypeId="2" ParentId="2242" CreationDate="2013-07-09T03:32:37.463" Score="1" Body="&lt;p&gt;After doing some reading, it seems like VRF (lite) might be the solution to my problem. &#xA;That way I can maintain two separate routing tables for each WAN connection and I should have access to the router using either VRF.&lt;/p&gt;&#xA;" OwnerUserId="1966" LastActivityDate="2013-07-09T03:32:37.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2257" PostTypeId="1" AcceptedAnswerId="2258" CreationDate="2013-07-09T04:01:10.643" Score="15" ViewCount="6897" Body="&lt;p&gt;I am in the middle of a project to migrate some existing switched ethernet dot1q trunks behind an ASA firewall... these trunks have five vlans each (numbered 51 - 55).  This is a simple drawing of the original layer2 service...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q3wqI.png&quot; alt=&quot;VLAN_Translation_00&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the requirements is to have an ASA firewall context per Vlan in the original dot1q trunk.  This means I wind up using a BVI to bridge the new INSIDE interface to the DMZ interface in each FW context.  Due to other constraints, I wind up with a FW config like this (I am summarizing out all the context stuff to simplify the question)...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;firewall transparent&#xA;!&#xA;interface GigabitEthernet0/1.51&#xA; vlan 51&#xA; nameif INSIDE&#xA; security-level 100&#xA; bridge-group 1&#xA;!&#xA;interface GigabitEthernet0/2.951&#xA; vlan 951&#xA; nameif DMZ&#xA; security-level 50&#xA; bridge-group 1&#xA;!&#xA;interface BVI1&#xA; ip address 10.10.51.240 255.255.255.0 standby 10.10.51.241&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco ASAs in transparent mode wind up using two different vlan IDs to connect a single layer2 vlan service.  Connect the two vlans through &lt;code&gt;interface BVI1&lt;/code&gt;; the &lt;code&gt;bridge-group 1&lt;/code&gt; configuration on each physical interface makes the connection between Vlan51 and Vlan951 in the config above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume ASA:Gi0/2 connects to 4507:Gi1/2... Notice what happens to the DMZ interface... the ASA DMZ Vlan is 951, and this connects via a dot1q trunk to the DMZ switch (the Cat4507).   I need to connect D1 to switchport 4507:Gi1/1, but I must deliver the Vlan951-955 services to D1 as dot1q Vlan51-55 on 4507:Gi1/1.  In other words, the Vlan BVI wrangling I had to do on the ASA messes up the Vlan numbering in my original service definition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9kX35.png&quot; alt=&quot;VLAN_translation_01&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly, I cannot easily renumber the Vlans on D1. The perfect solution would be to somehow translate Vlan951 on 4507:Gi1/2 to Vlan51 on 4507:Gi1/1.  Cisco has a feature called &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1/XE_330SG/configuration/guide/tunnel.html&quot; rel=&quot;noreferrer&quot;&gt;vlan mapping&lt;/a&gt;, but it seems to require QinQ... all my services are simple dot1q... the 4500 &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1/XE_330SG/configuration/guide/tunnel.html&quot; rel=&quot;noreferrer&quot;&gt;vlan mapping&lt;/a&gt; docs are not clear about how they handle simple dot1q encapsulation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can translate the vlans in the 4500 via loopback cable, but this burns two extra ports per Vlan... a total of ten extra ports for all the Vlans in the service (v51 - v55).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Refer to the diagram below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9kX35.png&quot; alt=&quot;VLAN_translation_01&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I translate all Vlans numbered 95x on the 4507:Gi1/2 dot1q trunk to be numbered Vlan5x on 4507:Gi1/1 dot1q?  I need to use the fewest number of ports consumed for &quot;translation overhead&quot;.  Please include configs for all ports that your answer requires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am open to &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1/XE_330SG/configuration/guide/tunnel.html&quot; rel=&quot;noreferrer&quot;&gt;vlan mapping&lt;/a&gt;, if someone can explain how it would work in this topology...&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Equipment&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;4507R+E, Sup7L-E with IOS XE 3.4.0&lt;/li&gt;&#xA;&lt;li&gt;ASA5555X with 9.0(2)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-02-27T15:36:25.457" LastActivityDate="2016-05-30T15:52:45.297" Title="Configure Cisco ASA in Transparent mode: Layer2 DMZ w/ Vlan translation" Tags="|cisco|ethernet|cisco-catalyst|vlan|firewall|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2258" PostTypeId="2" ParentId="2257" CreationDate="2013-07-09T06:31:46.290" Score="13" Body="&lt;p&gt;I don't have SUP7 to test, but it works on SUP6 and SUP32, I would presume SUP7 retains this functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tested between JNPR M320 &amp;lt;-&gt; SUP32, and '&lt;strong&gt;vlan mapping JNPR SUP32&lt;/strong&gt;' works just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no need for QinQ, what the QinQ option does is it adds top tag to one particularly tag. So &lt;code&gt;switchport vlan mapping 1042 dot1q-tunnel 42&lt;/code&gt; would map incoming [1042] stack to [42 1042] stack.&#xA;As opposed to &lt;code&gt;switchport vlan mapping 1042 42&lt;/code&gt; which maps incoming dot1q Vlan [1042] to dot1q Vlan [42]. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;JNPR M320 config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{master}[edit interfaces ge-0/1/0 unit 1042]&#xA;user@m320# show &#xA;vlan-id 1042;&#xA;family inet {&#xA;    address 10.42.42.1/24;&#xA;}&#xA;{master}[edit interfaces ge-0/1/0 unit 1042]&#xA;user@m320# run show interfaces ge-0/1/0               &#xA;Physical interface: ge-0/1/0, Enabled, Physical link is Up&#xA;  Interface index: 135, SNMP ifIndex: 506&#xA;  Description: B: SUP32 ge5/1&#xA;  Link-level type: Flexible-Ethernet, MTU: 9192, Speed: 1000mbps, BPDU Error: None,&#xA;  MAC-REWRITE Error: None, Loopback: Disabled, Source filtering: Disabled, Flow control: Disabled,&#xA;  Auto-negotiation: Enabled, Remote fault: Online&#xA;  Device flags   : Present Running&#xA;  Interface flags: SNMP-Traps Internal: 0x4000&#xA;  CoS queues     : 8 supported, 8 maximum usable queues&#xA;  Current address: 00:12:1e:d5:90:7f, Hardware address: 00:12:1e:d5:90:7f&#xA;  Last flapped   : 2013-02-19 09:14:29 UTC (19w6d 21:12 ago)&#xA;  Input rate     : 4560 bps (5 pps)&#xA;  Output rate    : 6968 bps (4 pps)&#xA;  Active alarms  : None&#xA;  Active defects : None&#xA;  Interface transmit statistics: Disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SUP32 config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SUP32#show run int giga5/1&#xA;Building configuration...&#xA;&#xA;Current configuration : 365 bytes&#xA;!&#xA;interface GigabitEthernet5/1&#xA; description F: M320 ge-0/1/0&#xA; switchport&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; switchport vlan mapping enable&#xA; switchport vlan mapping 1042 42&#xA; mtu 9216&#xA; bandwidth 1000000&#xA; speed nonegotiate&#xA; no cdp enable&#xA; spanning-tree portfast edge trunk&#xA; spanning-tree bpdufilter enable&#xA;end&#xA;&#xA;SUP32#show ru int vlan42&#xA;Building configuration...&#xA;&#xA;Current configuration : 61 bytes&#xA;!&#xA;interface Vlan42&#xA; ip address 10.42.42.2 255.255.255.0&#xA;end&#xA;&#xA;SUP32#sh int GigabitEthernet5/1 vlan mapping  &#xA;State: enabled&#xA;Original VLAN Translated VLAN&#xA;------------- ---------------&#xA;  1042           42  &#xA;&#xA;SUP32#sh int vlan42                           &#xA;Vlan42 is up, line protocol is up &#xA;  Hardware is EtherSVI, address is 0005.ddee.6000 (bia 0005.ddee.6000)&#xA;  Internet address is 10.42.42.2/24&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, &#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not supported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:09, output 00:01:27, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;  L2 Switched: ucast: 17 pkt, 1920 bytes - mcast: 0 pkt, 0 bytes&#xA;  L3 in Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes mcast&#xA;  L3 out Switched: ucast: 0 pkt, 0 bytes mcast: 0 pkt, 0 bytes&#xA;     38 packets input, 3432 bytes, 0 no buffer&#xA;     Received 21 broadcasts (0 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles &#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     26 packets output, 2420 bytes, 0 underruns&#xA;     0 output errors, 0 interface resets&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SUP32#ping 10.42.42.1&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.42.42.1, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms&#xA;SUP32#sh arp | i 10.42.42.1&#xA;Internet  10.42.42.1             12   0012.1ed5.907f  ARPA   Vlan42&#xA;SUP32#show mac address-table dynamic address 0012.1ed5.907f&#xA;Legend: * - primary entry&#xA;        age - seconds since last seen&#xA;        n/a - not available&#xA;&#xA;  vlan   mac address     type    learn     age              ports&#xA;------+----------------+--------+-----+----------+--------------------------&#xA;Active Supervisor:&#xA;*  450  0012.1ed5.907f   dynamic  Yes          0   Gi5/1&#xA;*   50  0012.1ed5.907f   dynamic  Yes          0   Gi5/1&#xA;*   40  0012.1ed5.907f   dynamic  Yes          0   Gi5/1&#xA;*   42  0012.1ed5.907f   dynamic  Yes          5   Gi5/1&#xA;&#xA;&#xA;user@m320# run ping 10.42.42.2 count 2 &#xA;PING 10.42.42.2 (10.42.42.2): 56 data bytes&#xA;64 bytes from 10.42.42.2: icmp_seq=0 ttl=255 time=0.495 ms&#xA;64 bytes from 10.42.42.2: icmp_seq=1 ttl=255 time=0.651 ms&#xA;&#xA;--- 10.42.42.2 ping statistics ---&#xA;2 packets transmitted, 2 packets received, 0% packet loss&#xA;round-trip min/avg/max/stddev = 0.495/0.573/0.651/0.078 ms&#xA;&#xA;{master}[edit interfaces ge-0/1/0 unit 1042]&#xA;user@m320# run show arp no-resolve |match 10.42.42.2 &#xA;00:05:dd:ee:60:00 10.42.42.2      ge-0/1/0.1042        none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="561" LastEditorUserId="775" LastEditDate="2013-07-09T11:55:12.353" LastActivityDate="2013-07-09T11:55:12.353" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2259" PostTypeId="2" ParentId="2257" CreationDate="2013-07-09T07:02:10.720" Score="3" Body="&lt;p&gt;I too do not have that SUP available, but can easily do this on a Brocade Netiron.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply put two ports in a VPLS and tag them with different vlans. Like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router mpls&#xA;&#xA;    vpls translate test 100&#xA;     vlan 200&#xA;     tagged ethe 1/1&#xA;     vlan 300&#xA;     tagged eth1/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nice thing about the Brocade is that you can convert any tag to another tag, double-tag to another double-tag, double-tag to single-tag, and single-tag to double-tag&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-07-09T07:02:10.720" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2261" PostTypeId="1" AcceptedAnswerId="2759" CreationDate="2013-07-09T09:36:14.397" Score="19" ViewCount="7164" Body="&lt;p&gt;I am monitoring the 802.11 traffic in my network, and especially the active probing from my smartphone. I am sending Probe Requests for certain hidden SSIDs, but also an Undirected Probe Request, supposed to reveal networks matching the capabilities announced by my device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am in Europe, so we get to use more channels than in the US I think (right?) and thus they overlap. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As expected, the scanning takes place on different channels in turn, but what surprises me is this behaviour: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An undirected probe request sent on channel 5 is answered by an AP on channel 6.&#xA;Is this completely normal behaviour i.e. defined anywhere in the official specs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Here is the content of both probe request and response, I am basing my assumption on the DS Parameter Set: Current Channel. &#xA;&lt;img src=&quot;https://i.stack.imgur.com/UjCNV.png&quot; alt=&quot;Picture on i.imgur&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The time difference between the two frames is 4ms, and I did not observe any other activity on the waves during this time period. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Here is the command I run with airodump-ng 1.0 &#xA;airodump-ng -c 6 mon0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the capture tool shows beacons coming from APs on channel 2 to 9. To me it means that airodump accepts all packets visible on a frequecy range, without dismissing them according to the Current Channel Parameter, makes sense for performance reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router has the same behaviour for answering probe requests... this may be why. (Starting to question the selectivity of the frequency filters used in our beloved routers.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this behaviour 1) repeatable, could someone with a working device please try to observe this ?&#xA;2) specified somewhere in the 802.11 references ? Could not find it my self.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to everyone so far who tried repeating this setup. Here is my last attempt at getting an explanation to this. I need to move on :P Here is the exact order in which I did things.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@mymachine:~# iwconfig :: no mon interface, wlan0 is managed, not associated, and on channel 6: 2.437GHz&#xA;root@mymachine:~# airmon-ng start wlan0 6 :: mon0 created, set on channel 6: 2.437GHz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is confirmed later by another &lt;code&gt;iwconfig&lt;/code&gt;. (on a sidenote, I can change the channel of wlan0, and mon0 stays independent.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@mymachine:~# airodump-ng mon0 --channel 6 -w out --output-format pcap :: start a capture on channel 6, write to a file. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Observation: airodump-ng doesn't display any change in channel, the top left corner is fixed on number 6. However, beacons observed on channels 2 to 11... &#xA;-&gt; Apparently no selectivity and passing the arguments to both airmon-ng and airodump-ng seem pointless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Observed with:&lt;br&gt;&#xA;CHIPSET Intel 4965       driver iwlwifi&lt;br&gt;&#xA;CHIPSET Atheros AR 9271  driver ath9k  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Screenshot:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/TRL2H.png&quot; alt=&quot;screenshot&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1983" LastEditorUserId="33726" LastEditDate="2019-03-24T01:30:16.223" LastActivityDate="2019-03-24T01:30:16.223" Title="Can a probe request be answered on a different channel?" Tags="|wireless|ieee-802.11|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="2262" PostTypeId="1" CreationDate="2013-07-09T12:41:51.640" Score="5" ViewCount="1428" Body="&lt;p&gt;I have a client with 5 sites, each using their own private LAN subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are currently using a service provider to link their branches and for Internet breakout centrally. I need to break them out to the Internet temporarily at another branch, over the existing WAN. I cannot configure the current WAN. My plan is to drop SRX devices at the 5 sites and give them a local LAN IPs, then create a VPN tunnel to the main SRX's local LAN IP. Then route traffic to the main site and breakout to the Internet at the main site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since they can ping and route to each over over the existing WAN, this should work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I terminate the VPN on the local LAN IP? I will have to create static routes on the site SRXs to use the existing site gateways to get to the main SRX to initialise the tunnel, and then route all other traffic over the tunnel?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I get some pointers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have played around with some success, some tunnels did connect but data not flowing etc.. I need to get my head around this first..&lt;/p&gt;&#xA;" OwnerUserId="1985" LastActivityDate="2014-07-27T17:47:16.323" Title="Juniper SRX to SRX site-to-site VPN over existing WAN in trust zone" Tags="|vpn|ipsec|juniper-srx|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2263" PostTypeId="2" ParentId="2247" CreationDate="2013-07-09T12:51:39.943" Score="6" Body="&lt;p&gt;Starting with JunOS 12.1 there is wildcard range set in edit mode. You can use it with various range formats, as a starting point &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB23789&quot; rel=&quot;noreferrer&quot;&gt;&quot;Wildcard range commands for EX switches&quot;&lt;/a&gt; is a good read.&lt;/p&gt;&#xA;" OwnerUserId="550" LastEditorUserId="49" LastEditDate="2013-07-09T13:57:32.513" LastActivityDate="2013-07-09T13:57:32.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2266" PostTypeId="1" AcceptedAnswerId="2269" CreationDate="2013-07-09T15:31:26.707" Score="8" ViewCount="1740" Body="&lt;p&gt;I have a Catalyst switch that doesn't support PVLAN trunks (Sup4, 4500, 12.2(54)S).  I have multiple other Catalyst switches, 3750 metro, that do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct in assuming that because the C4500 does not support PVLAN trunks with that Supervisor, that a normal trunk port would not work for the 3750s to share a private VLAN with the 4500?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The desired scenario is that the 4500 hosts primary VLAN 500 and isolated vlans 501,502 with 501,502 residing on other 3750s in the network.  I assume that in order to achieve the desired config, I have to have the 3750 promiscuous ports connected to access ports on the 4500.  Is this correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7Q7oL.png&quot; alt=&quot;Example image&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="43" LastEditorUserId="49" LastEditDate="2013-07-09T15:55:51.240" LastActivityDate="2013-07-09T20:05:09.073" Title="Private VLANs on a switch that doesn't support Private VLAN trunks" Tags="|cisco|cisco-catalyst|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2267" PostTypeId="2" ParentId="2257" CreationDate="2013-07-09T17:03:51.473" Score="7" Body="&lt;p&gt;some support for @ytti 's answer above, hope it helps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;orange#sh ver&#xA;Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e-UNIVERSALK9-M), Version 03.04.00.SG RELEASE SOFTWARE (fc3)&#xA;…&#xA;orange#sh mod&#xA;Chassis Type : WS-C4507R+E&#xA;&#xA;Mod Ports Card Type                              Model              Serial No.&#xA;---+-----+--------------------------------------+------------------+-----------&#xA; 4     4  Sup 7-E 10GE (SFP+), 1000BaseX (SFP)   WS-X45-SUP7-E      CAT1xxxxxxx &#xA;…&#xA;orange#sh run int ten4/1&#xA;Building configuration...&#xA;&#xA;Current configuration : 112 bytes&#xA;!&#xA;interface TenGigabitEthernet4/1&#xA; switchport mode trunk&#xA; switchport vlan mapping 100 10&#xA; load-interval 30&#xA;end&#xA;&#xA;orange#sh run int ten4/2&#xA;!&#xA;interface TenGigabitEthernet4/2&#xA; switchport mode trunk&#xA; switchport vlan mapping 10 100&#xA; load-interval 30&#xA;…&#xA;orange#sh vlan mapping &#xA;Interface Te4/1:&#xA;VLANs on wire                    Translated VLAN     Operation&#xA;------------------------------   ---------------     --------------&#xA;100                                   10             1-to-1&#xA;Interface Te4/2:&#xA;VLANs on wire                    Translated VLAN     Operation&#xA;------------------------------   ---------------     --------------&#xA;10                                    100            1-to-1&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-09T17:03:51.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2269" PostTypeId="2" ParentId="2266" CreationDate="2013-07-09T20:05:09.073" Score="2" Body="&lt;p&gt;A &lt;strong&gt;promiscuous trunk&lt;/strong&gt; on the 3750 toward the 4500 is what you need to go across a non-PVLAN-aware switch and keep security intact.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/54sg/configuration/guide/pvlans.html#wp1181949&quot; rel=&quot;nofollow&quot;&gt;Promiscuous PVLAN Trunk Ports&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-07-09T20:05:09.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2270" PostTypeId="1" AcceptedAnswerId="2278" CreationDate="2013-07-09T20:30:39.233" Score="8" ViewCount="1041" Body="&lt;p&gt;Considering a transition of specific public Internet site via a new location.  At the current location, I've got a static route configured in my Cisco router pointed to my internal firewall.  The new location is located over an MPLS connection (eBGP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two local subnets in use at the existing location and would like to test only one of the subnets over the MPLS network to the new locations Internet access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible with policy routing to have 1 local subnet utilize the static route to the firewall, and the 2nd subnet utilize the MPLS advertisement and route through the other site to the Internet for only this Internet site?  If so, how?&lt;/p&gt;&#xA;" OwnerUserId="1989" LastEditorUserId="775" LastEditDate="2013-07-10T10:38:51.607" LastActivityDate="2013-07-10T10:38:51.607" Title="traffic engineering - policies for BGP vs static routes" Tags="|cisco|routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2271" PostTypeId="1" CreationDate="2013-07-09T22:47:25.773" Score="4" ViewCount="1965" Body="&lt;p&gt;We have 2 network rooms in our building and each are connected via a fiber link. One room is very tiny and is where our Comcast Internet comes into the building. I want to place our Cisco ISA570 into the other network room which is much larger and easier to work in so I must get the Comcast Internet over to the large network room and into the ISA570.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my plan in the small network room:&#xA;- configure my switch so port 1 is VLAN 1.&#xA;- plug in the Comcast cable modem to port 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my plan for the large network room.&#xA;- configure my switch so port 1 is VLAN 1.&#xA;- plug the Cisco ISA570 into port 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since both of the switches are connected over the fiber link, I assume VLAN 1 traffic would egress the small room switch and arrive at the large room switch still tagged as VLAN 1 and would egress port 1 on that large room switch into the ISA570. And the reverse is also true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this make sense? Am I doing the right thing here?&lt;/p&gt;&#xA;" OwnerUserId="1990" LastActivityDate="2013-08-09T01:03:40.133" Title="Layer 2 switch send VLAN frames over fiber connection to another Layer 2 switch?" Tags="|cisco|fiber|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2273" PostTypeId="2" ParentId="2271" CreationDate="2013-07-09T23:40:31.363" Score="1" Body="&lt;p&gt;Assuming that you manage the fiber yourself (dark fibre, your own runs...etc), then yes - this should be possible as long as you have the proper configuration on both sides of the Cisco ISA570.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-07-09T23:40:31.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2274" PostTypeId="2" ParentId="2271" CreationDate="2013-07-10T00:29:08.633" Score="0" Body="&lt;p&gt;This will work as you've outlined, however if there are any other devices on Vlan 1 on either switch they will be &quot;outside&quot; of the ISA570.  It will be better to create a new VLAN (999 for example) and place port 1 of each switch in that VLAN. You'll also need to ensure that each switch is configured to carry the new new VLAN between the two.  This will logically connect the cable modem to the Internet/WAN port of the ISA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CableModem --- Port1|Switch1|PortX &amp;lt;--fiber--&gt; PortX|Switch2|Port1 &amp;lt;----&gt; Internet Port|ISA&lt;/p&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-10T00:29:08.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2275" PostTypeId="2" ParentId="2271" CreationDate="2013-07-10T00:30:56.713" Score="2" Body="&lt;p&gt;If you are using cisco gear configure the interswitch ports as trunks (never know when you may want to pass other things between the rooms). Using VLAN 1 in cisco land is considered bad form, so create say vlan 10 in both cisco boxes, in the switch in the small room the Comcast box is connected to an access port with vlan 10, then trunk vlan 10 between the cisco devices. Then anything on configured on vlan 10 in the large room goes directly to Comcast, you can use other vlans for things you don't want internet access to.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-07-10T00:30:56.713" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2278" PostTypeId="2" ParentId="2270" CreationDate="2013-07-10T06:46:32.637" Score="8" Body="&lt;p&gt;Policy-based routing works great for this. I recently did this to slowly cut over a hospital to a new internet edge one internal subnet at a time in exactly this way. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended PBR_SUBNETS&#xA; permit ip 172.16.1.0 0.0.0.255 any&#xA;!&#xA;route-map POLICY_ROUTE permit 10&#xA; match ip address PBR_SUBNETS&#xA; set ip next-hop 192.168.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above will redirect all packets from 172.16.1.0/24 to the IP address specified in the route-map. Change both as needed to fit your situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apply this policy to the router interface that's facing your internal subnets.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; ip policy route-map POLICY_ROUTE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This route-map will set the next hop for all permitted traffic, regardless of the routing table.&lt;/strong&gt; (Use of the &quot;default&quot; keyword can get around this but doesn't sound like you need to) This means that your static route is probably not needed for this purpose, but you can leave it in there as a fallback in case BGP fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI - the way I did this was to enter the entire configuration, live, during the day, but with no entries in the access list. Since nothing matches, obviously, all traffic behaves normally, following the routing table. This provides for a very easy, testable, reversible framework for switching internal subnets over, since all it takes from this point is just to add them to the ACL. &lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-07-10T06:46:32.637" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2279" PostTypeId="1" AcceptedAnswerId="2280" CreationDate="2013-07-10T07:21:35.393" Score="12" ViewCount="7502" Body="&lt;p&gt;We have about 20 vlans on a L2 network running Rapid PVST+ where the root bridge is a stack of Cisco's 3750 switches. I am a bit puzzled by the number of TCN notifications I receive on the switch.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 3750 stack is the root for all VLANs and it receives TCN notifications on a daily basis (sometimes  more, sometimes a little less). It receives the TCNs at the same time and on the same port for all VLANs. When I trace back where these TCNs come from with &lt;code&gt;show spanning-tree detail | inc ieee|occurr|from|is exec&lt;/code&gt;, I end up on a switch (switch-b) with only 5 trunks configured and no access ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot match an event like a link on this switch going up or down on the same time the TCNs are received. When I issue the above command on this switch the results tells me that the last topology change was much longer ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My conclusions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TCN sent must be trigged by an event on a trunk link or an entire switch because all VLANs received the topology change notification. It must be something local on switch-b.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can be the reason for originating these TCNs? The 5 trunk links didn't change their state. It cannot come further downstream because the last topology change on switch-b doesn't match the last topology change on the core. The last topology change on switch-b is much longer ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts?&lt;/p&gt;&#xA;" OwnerUserId="209" LastEditorUserId="3191" LastEditDate="2014-02-15T13:00:22.367" LastActivityDate="2014-02-15T13:00:22.367" Title="Tracing TCN Messages in STP" Tags="|cisco|ethernet|vlan|spanning-tree|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2280" PostTypeId="2" ParentId="2279" CreationDate="2013-07-10T07:43:51.940" Score="12" Body="&lt;p&gt;You should be able to simply debug the TCNs. In my case I recently debugged them using&#xA;&lt;code&gt;debug spann mstp tc&lt;/code&gt; (as I run MSTP), but also using &lt;code&gt;debug spanning-tree events&lt;/code&gt;&#xA;you will see them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jul 10 07:42:18 UTC: STP: VLAN0228 Topology Change rcvd on Gi1/0/9       &amp;lt;&amp;lt;&amp;lt; received&#xA;Jul 10 07:42:18 UTC: STP: VLAN0228 sent Topology Change Notice on Po10   &amp;lt;&amp;lt;&amp;lt; forwarded&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1996" LastEditorUserId="775" LastEditDate="2013-07-10T10:37:10.460" LastActivityDate="2013-07-10T10:37:10.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2283" PostTypeId="1" AcceptedAnswerId="2284" CreationDate="2013-07-10T10:40:49.143" Score="40" ViewCount="26142" Body="&lt;p&gt;Consider a list of IP addresses as provided by &lt;a href=&quot;http://en.wikipedia.org/wiki/X-Forwarded-For&quot;&gt;the X-Forwarded-For HTTP header&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;10.0.0.142 , 192.168.0.10 , 212.43.234.12 , 54.23.66.43&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would like to know which is the first publicly-accessible address in that list. I can look over them easily enough, but how can I tell which are publicly-accessible? It seems to me (my untrained eye) that &lt;code&gt;10.0.0.142&lt;/code&gt; is a workstation, &lt;code&gt;192.168.0.10&lt;/code&gt; is an internal proxy, and &lt;code&gt;212.43.234.12&lt;/code&gt; is a publicly-accessible address being forwarded through the proxy at &lt;code&gt;54.23.66.43&lt;/code&gt;. Is there any way to calculate this in code?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first intuition is that addresses that start with &lt;code&gt;10.&lt;/code&gt; or &lt;code&gt;192.&lt;/code&gt; are not publicly accessible, but &lt;a href=&quot;http://simplesniff.com&quot;&gt;http://simplesniff.com&lt;/a&gt; reveals my home IP address to be &lt;code&gt;192.117.111.61&lt;/code&gt;. Is there a formula for determining which addresses are public and which are reserved private? Note that even trying to ping the server in question might not help as some servers won't respond to ping, and also there might be an address on my local network which also matched the internal address.&lt;/p&gt;&#xA;" OwnerUserId="1997" LastEditorUserId="8499" LastEditDate="2018-02-16T03:49:42.470" LastActivityDate="2018-02-16T03:49:42.470" Title="How to check for a valid public IP address?" Tags="|ipv4|ip|ip-address|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2284" PostTypeId="2" ParentId="2283" CreationDate="2013-07-10T10:44:53.207" Score="25" Body="&lt;p&gt;RFC 1918 defines private IP address ranges. Have a look &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;here.&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;From that document:&lt;/p&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Private Address Space&lt;/p&gt;&#xA;&lt;p&gt;The Internet Assigned Numbers Authority (IANA) has reserved the&#xA;following three blocks of the IP address space for private internets:&lt;/p&gt;&#xA;&lt;p&gt;10.0.0.0        -   10.255.255.255  (10/8 prefix)&lt;/p&gt;&#xA;&lt;p&gt;172.16.0.0      -   172.31.255.255  (172.16/12 prefix)&lt;/p&gt;&#xA;&lt;p&gt;192.168.0.0     -   192.168.255.255 (192.168/16 prefix)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="80" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-07-10T10:44:53.207" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2285" PostTypeId="2" ParentId="2283" CreationDate="2013-07-10T10:57:31.073" Score="38" Body="&lt;p&gt;Besides the original RFC 1918 space (which is now updated to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6890&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6890&lt;/a&gt;), there are several other blocks such as 192.0.2.0 that are not announced publicly.  Furthermore, it's possible that someone has valid IPv4 space that just isn't announced in the public internet.&lt;/p&gt;&#xA;&lt;p&gt;The simplest thing to do is &lt;code&gt;telnet route-views.oregon-ix.net&lt;/code&gt;, login as &lt;code&gt;rviews&lt;/code&gt; and look for yourself... for instance, this is some &amp;quot;192&amp;quot; space that's announced by AS7018 (AT&amp;amp;T)...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;route-views&amp;gt;sh ip route 192.199.1.0&#xA;Routing entry for 192.199.1.0/24&#xA;  Known via &amp;quot;bgp 6447&amp;quot;, distance 20, metric 0&#xA;  Tag 7018, type external&#xA;  Last update from 12.0.1.63 3w1d ago&#xA;  Routing Descriptor Blocks:&#xA;  * 12.0.1.63, from 12.0.1.63, 3w1d ago&#xA;      Route metric is 0, traffic share count is 1&#xA;      AS Hops 2&#xA;      Route tag 7018&#xA;&#xA;route-views&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;On the other hand, you'll see that 192.0.2.0/24 (ref &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6890&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6890&lt;/a&gt;) is nowhere to be found...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;route-views&amp;gt;sh ip route 192.0.2.0 255.255.255.0&#xA;% Subnet not in table&#xA;route-views&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Nor is 169.254.0.0/16 (or longer)...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;route-views&amp;gt;sh ip route 169.254.0.0 255.255.0.0 longer&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 128.223.51.1 to network 0.0.0.0&#xA;&#xA;route-views&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-07-10T10:57:31.073" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2286" PostTypeId="2" ParentId="2283" CreationDate="2013-07-10T12:58:40.680" Score="14" Body="&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://www.team-cymru.org/Services/Bogons/&quot;&gt;Team Cymru&lt;/a&gt;&lt;/strong&gt; provides a bogon reference for both IPv4 and IPv6 that you can use to filter out unassigned/reserved/private IP addresses - it's offered both as a simple list for well-known prefixes and also in a much larger list that includes space that is as-yet unassigned by RIRs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They also run a BGP bogon server that you can request a free peering to - invaluable if you're unable to run a default-free zone to the internet.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-07-10T12:58:40.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2287" PostTypeId="2" ParentId="2155" CreationDate="2013-07-10T17:30:54.100" Score="7" Body="&lt;p&gt;The resolution to my problem is to upgrade my ASA image to 8.6.1(5).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This resolves bug &lt;a href=&quot;http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&amp;amp;bugId=CSCtq57752&amp;amp;Submit=Search&quot;&gt;CSCtq57752&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The workaround to the bug is to lower the crypto map's timed lifetime and increase the crypto map's traffic volume threshold:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto map *YOUR-CRYPTO-MAP ID* set security-association lifetime seconds 3600&#xA;crypto map *YOUR-CRYPTO-MAP ID* set security-association lifetime kilobytes 2147483647&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above crypto map lowers the lifetime to 3600 seconds and increases the kilobytes threshold to the highest value. In my case, I just have to ensure the seconds lifetime is depleted before the kilobytes threshold.&lt;/p&gt;&#xA;" OwnerUserId="63" LastActivityDate="2013-07-10T17:30:54.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2291" PostTypeId="1" AcceptedAnswerId="2783" CreationDate="2013-07-10T22:30:35.897" Score="22" ViewCount="1725" Body="&lt;p&gt;In order to provide WiFi coverage for a small office area, a Cisco autonomous single-band 1041 (AIR-AP1041N-E-K9) is used, running software version 12.4.25d-JA1. The access point is having a basic configuration for a single SSID with WPA/TKIP + PSK. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the wireless clients are laptops and smartphones. There is also a print server and a handheld computer. All of them can connect to the wireless network without issues and are getting proper service. However, every now and then all wireless clients get unreachable simultaneously for several minutes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have checked the RF environment and results were good:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RSSI is greater than -60 dBm throughout the whole office area &lt;/li&gt;&#xA;&lt;li&gt;RSSI from surrounding wireless networks is at least 30 dB lower than RSSI from the office SSID&lt;/li&gt;&#xA;&lt;li&gt;Spectrum analysis confirms there are no interferences&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We observed the following facts when the issue is happening: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All WiFi clients lose connectivity at the same time, while wired devices have no issue&lt;/li&gt;&#xA;&lt;li&gt;The AP is reachable on its management IP address and reports the WiFi clients are still associated&lt;/li&gt;&#xA;&lt;li&gt;All wireless clients recover connectivity as soon as you connect a new client to the wireless network. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The radio interface is getting reset sometimes, but it does not happen when the issue is observed. Last time we found the issue we saw logs for the radio interface getting reset more than one hour ago before the issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought it could be a bug and have reviewed the list of bugs for this software version but couldn't find anything similar to this issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did you ever face a similar problem? Could you find the root cause for it? What else could I check to narrow down the cause of the issue?&lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-07-15T20:11:19.833" LastActivityDate="2014-06-18T15:09:31.453" Title="All WiFi clients losing connectivity at the same time" Tags="|cisco|wireless|" AnswerCount="1" CommentCount="10" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2293" PostTypeId="2" ParentId="2261" CreationDate="2013-07-11T03:20:01.827" Score="6" Body="&lt;p&gt;Wireless captures are not the same as a wired capture.  In a wired capture, you simply pick your interface and start capturing frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a wireless capture, you select your adapter, but then you also need to choose if you are going to monitor one channel or scan across multiple (or all) channels.  There are advantages to both and one needs to understand when to use each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, since you are capturing on two different channels, either you are using two different capture devices or you are capturing while scanning channels, but I presume you are scanning.  What this means is that it stops on one channel for some period of time, captures traffic and then moves onto the next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is how I see this most likely playing out:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Capture device starts monitoring on channel 5.&lt;/li&gt;&#xA;&lt;li&gt;Client device send probe request on channel 5.&lt;/li&gt;&#xA;&lt;li&gt;Client device moves to channel 6 and sends probe request.&lt;/li&gt;&#xA;&lt;li&gt;Capture device moves to channel 6 and starts monitoring.&lt;/li&gt;&#xA;&lt;li&gt;AP sends probe response on channel 6.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the end, your capture picks up the probe request on channel 5, but then the probe response on channel 6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every wireless capture tool I have used will allow you to select a single channel to monitor.  I suspect if you set this to channel 5, you will get the probe requests with no responses.  If you set this to channel 6, you will see both the probe requests and the responses.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-07-11T03:20:01.827" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2295" PostTypeId="1" CreationDate="2013-07-11T05:41:19.560" Score="25" ViewCount="11936" Body="&lt;p&gt;I just had an argument with a colleague of mine and thought I'd just reach out to the experts on this. Here's the scenario. We were using a website that measures your connection's speed. We tested using a server that is far from us (We are in Malaysia and the server was in US). It was around 2 Mbps. Then we tried with a server in Singapore and it was much faster (around 15 Mbps). My colleague believed it's because of the physical distance while I don't think it matters. My understanding is once you have done the initial handshake and the data flow has started, it doesn't matter where the server is located and the result should be almost the same. Am I missing something here? How does it really work?&lt;/p&gt;&#xA;" OwnerUserId="2012" LastEditorUserId="2013" LastEditDate="2013-07-11T06:19:16.063" LastActivityDate="2023-07-17T15:10:06.877" Title="Does physical distance affect download speed?" Tags="|tcp|latency|bandwidth|" AnswerCount="4" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="2297" PostTypeId="2" ParentId="2295" CreationDate="2013-07-11T09:21:35.653" Score="28" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;My colleague believed it's because of the physical distance while I don't think it matters. My understanding is once you have done the initial handshake and the data flow has started, it doesn't matter where the server is located and the result should be almost the same. Am I missing something here? How does it really work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Both of you were right at some point in history, but your understanding is mostly correct... today :).  There are a few factors that changed between the older answer your friend gave, and the capabilities we have today.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;TCP Window Scaling&lt;/li&gt;&#xA;&lt;li&gt;Host buffer tuning&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The difference in the results you saw could have been affected by:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Packet loss&lt;/li&gt;&#xA;&lt;li&gt;Parallel TCP transfers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;TCP Window Scaling: The bandwidth-delay effect&lt;/h2&gt;&#xA;&lt;p&gt;As your friend mentioned, older implementations of TCP suffered from the limits imposed by the original 16-bit receive window size in the TCP header (ref &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793#section-3.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 793: Section 3.1&lt;/a&gt;); RWIN controls how much unacknowledged data can be waiting in a single TCP socket.  16-bit RWIN values limited internet paths with high bandwidth-delay products (and many of today's high bandwidth internet connections would be limited by a 16-bit value).&lt;/p&gt;&#xA;&lt;p&gt;For high RTT values, it's helpful to have a very large RWIN.  For example, if your path RTT from Malaysia to the US is about 200ms, the original TCP RWIN would limit you to 2.6Mbps.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;Throughput&lt;sub&gt;max&lt;/sub&gt; = Rcv_Win / RTT&lt;/em&gt;&lt;br&gt;&#xA;&lt;em&gt;Throughput&lt;sub&gt;max&lt;/sub&gt; = 65535&lt;/em&gt;8   / 0.200*&lt;br&gt;&#xA;&lt;em&gt;Throughput&lt;sub&gt;max&lt;/sub&gt; = 2.6Mbps&lt;/em&gt;&lt;br&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1323&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1323&lt;/a&gt; defined several very useful TCP additions which helped overcome these limitations; one of those &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1323&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1323&lt;/a&gt; TCP Options is &amp;quot;window scaling&amp;quot;. It introduces a scale factor, which multiplies the original RWIN value, in order to get the full receive window value; using window scaling options allow a maximum RWIN of 1073725440 bytes.  Applying the same calculations:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;Throughput&lt;sub&gt;max&lt;/sub&gt; = Rcv_Win    /    RTT&lt;/em&gt; &lt;br&gt;&#xA;&lt;em&gt;Throughput&lt;sub&gt;max&lt;/sub&gt; = 1073725440&lt;/em&gt;8 /    0.200*&lt;br&gt;&#xA;&lt;em&gt;Throughput&lt;sub&gt;max&lt;/sub&gt; = 42.96Gbps&lt;/em&gt;&lt;br&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Keep in mind that TCP increases RWIN gradually over the duration of a transfer, as long as &lt;em&gt;packet loss&lt;/em&gt; isn't a problem.  To see really large transfer rates over a high-delay connection, you have to transfer a large file (so TCP has time to increase the window) and packet loss can't be a problem for the connection.&lt;/p&gt;&#xA;&lt;h2&gt;Packet Loss&lt;/h2&gt;&#xA;&lt;p&gt;Several years ago, internet circuits across the Pacific Ocean got pretty congested at times.  I used to run video chats overseas during some of these high congestion / packet loss conditions... Even modest packet loss (such as 0.5% loss) can slow a high-bandwidth connection down.&lt;/p&gt;&#xA;&lt;p&gt;It's also worth saying that not all TCP packet drops are bad...  several TCP implementations intentionally drop packets as an endpoint-to-endpoint feedback signal.  I mentioned above that TCP gradually opens the RWIN over time (as long as packet loss is not a problem).  When a congested circuit drops a packet, TCP responds to the drops by slowing the connection down (and spread across enough TCP sockets, TCP's response helps mitigate circuit congestion).  However, this kind of bulk congestion &lt;a href=&quot;https://en.wikipedia.org/wiki/Tail_drop&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP tail drop&lt;/a&gt; behavior has some drawbacks... TCP sockets in this condition can significantly throttle back throughput (via &lt;a href=&quot;https://en.wikipedia.org/wiki/TCP_congestion_control&quot; rel=&quot;nofollow noreferrer&quot;&gt;CWND&lt;/a&gt; - congestion window) when faced with TCP tail drop (from circuit congestion).&lt;/p&gt;&#xA;&lt;p&gt;Also related to the subject of intentional packet drops is &lt;a href=&quot;https://datatracker.ietf.org/doc/html/rfc2309#section-3&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;RFC2309, Section 3&quot;&gt;Random Early Detection (RED)&lt;/a&gt;.  This is a great feature to enable in your TCP traffic queues when you enable QoS / HQoS on your packet queues.  It works by looking at the interface queue and randomly dropping a packet.  The packet drops (on TCP connections) will slow sockets down; and it's widely considered to be a much better alternative than tail-dropping TCP.  It's also worth noting that this feature only works on TCP... as you may be aware, many (non-multimedia) UDP protocols do not slow down in the face of packet loss.&lt;/p&gt;&#xA;&lt;h2&gt;Parallel TCP streams&lt;/h2&gt;&#xA;&lt;p&gt;FYI, some speed test websites use &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1851/what-determines-the-degree-of-parallelism-that-can-occur-over-a-network/1854#1854&quot;&gt;parallel TCP streams to increase throughput&lt;/a&gt;; this may be affecting the results you see, because parallel TCP streams dramatically increase throughput in case you have some packet-loss in the path.  I have seen four parallel TCP streams completely saturate a 5Mbps cable modem that suffered from 1% constant packet loss.  Normally 1% loss would lower the throughput of a single TCP stream.&lt;/p&gt;&#xA;&lt;h2&gt;Bonus Material: Host Buffer tuning&lt;/h2&gt;&#xA;&lt;p&gt;Many older OS implementations had sockets with limited buffers; with older OS (like Windows 2000), it didn't matter whether TCP allowed large amounts of data to be in-flight... their socket buffers were not tuned to take advantage of the large RWIN.  There was a lot of research done to &lt;a href=&quot;http://www.psc.edu/index.php/networking/641-tcp-tune&quot; rel=&quot;nofollow noreferrer&quot;&gt;enable high performance on TCP transfers&lt;/a&gt;.  Modern operating systems (for this answer, we can call Windows Vista and later &amp;quot;modern&amp;quot;) include better buffer allocation mechanisms in their socket buffer implementations.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2023-07-17T15:10:06.877" LastActivityDate="2023-07-17T15:10:06.877" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="2298" PostTypeId="1" AcceptedAnswerId="2299" CreationDate="2013-07-11T10:28:19.487" Score="12" ViewCount="6819" Body="&lt;p&gt;We have about 50 Cisco 1242 access-points and we're managing them with a Cisco 4404 Wireless Lan controller.  The guy who installed the APs did not assign a location to the access points in the controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are seeing some malicious behavior from one of the APs called &quot;AP27&quot;, and we want to find the physical location of this AP.  I have tracked down the mac address of the AP and know where the cable is on our PoE switch, but this still leaves about seven possible APs, given the radius of the coverage for that IDF.  Unfortunately the same guy who didn't put a location on the APs also did not label the cabling to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to find exactly where the AP is, other than tracing cables?&lt;/p&gt;&#xA;" OwnerUserId="2015" LastEditorUserId="2015" LastEditDate="2013-07-11T10:41:28.743" LastActivityDate="2017-06-28T09:15:58.353" Title="Identifying a Cisco access point post-install" Tags="|cisco|wireless|ieee-802.11|wlc|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2299" PostTypeId="2" ParentId="2298" CreationDate="2013-07-11T10:35:10.860" Score="14" Body="&lt;p&gt;Depending on the version of WLC code that you're running, you can either manually disable the status LED on the AP or flash it by logging into the WLC and issuing a command... Then just walk around with your laptop and turn off / flash LEDs until you find the right AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To disable the status LED, use this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config ap led-state disable AP27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To flash the status LED on two second intervals, you can use this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config ap led-state flash 2 AP27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Be sure to revert the AP LED back to the original state, otherwise it could cause confusion down the road.  You can see the LED configuration of your APs with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ap led-state&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-07-11T10:35:10.860" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2301" PostTypeId="1" CreationDate="2013-07-11T17:26:29.647" Score="4" ViewCount="207" Body="&lt;p&gt;If I am looking at traffic from my network and I see (e.g., using SmartWhois) that a lot of user traffic is going to certain CDNs. e.g., in one network 87% of my traffic goes to Amazon. Is there a way to dis-aggregate this, even a little, to get a sense of what all of this traffic means? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see that certain popular Web sites are located on certain CDNs (e.g., click the CDN names on the legend of this chart: &lt;a href=&quot;http://www.datanyze.com/market-share/CDN/?goback=%2Egde_38181_member_223489435&quot; rel=&quot;nofollow&quot;&gt;CDN Market Share&lt;/a&gt;) but matching things up this way feels like I am simply guessing, particularly with Amazon -- the CDN market leader. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if certain CDN clients might be assigned certain IP addresses within the CDN block -- I thought that someone else might have come up with a lookup table or a database for sale, but I can't find anything like that by googling, so maybe that is not a viable approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I currently only have easy access to the IP address that flows are going to. With that data, is dis-aggregating this CDN traffic further impossible?  If I know it is not possible I will stop looking.&lt;/p&gt;&#xA;" OwnerUserId="2018" LastEditorDisplayName="user36472" LastEditDate="2018-02-16T16:50:45.453" LastActivityDate="2018-02-16T16:50:45.453" Title="Is it possible to disaggregate traffic to CDNs to find out what users are doing?" Tags="|logging|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2302" PostTypeId="1" CreationDate="2013-07-11T18:15:08.047" Score="7" ViewCount="14585" Body="&lt;p&gt;We deploy two 3750-X switches in stack and connect Dell Storage to 10G-T ports. Dell recommends to use flow control on this ports, but some people have a lot of problems with this feature (packet loss, traffic blocking).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is it best practise to use flow control on 10G ports?&lt;/p&gt;&#xA;" OwnerUserId="904" LastEditorUserId="561" LastEditDate="2013-07-12T08:08:11.013" LastActivityDate="2013-07-12T08:08:11.013" Title="Flow Control: to be or not to be?" Tags="|cisco|switch|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2303" PostTypeId="1" CreationDate="2013-07-11T18:18:29.307" Score="4" ViewCount="1189" Body="&lt;p&gt;For a corporate network, is there a way to possibly encrypt all network traffic on the local network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to ensure that there is nothing left for chance to be packet sniffed. Not even e-mails or machine to machine communications with chat devices. &lt;/p&gt;&#xA;" OwnerUserId="1963" LastActivityDate="2013-07-12T03:19:21.593" Title="Encrypting All Network Traffic" Tags="|security|vpn|tunnel|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2304" PostTypeId="2" ParentId="2302" CreationDate="2013-07-11T18:28:15.950" Score="3" Body="&lt;p&gt;FCoE storage relies on the assumption of what they call lossless Ethernet... FCoE storage is also notoriously quirky about interoperability.  The official answer is &quot;yes&quot;; enable flow control on all FCoE storage ports, but test thoroughly before putting the system into production.  All that said, a 3750X doesn't support all the FCoE extensions required to do it properly, so I can only hope you're talking about IP-based storage...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is any other IP-based storage technology, I would keep flow control turned off and let the upper layer protocols deal with drops... they are used to it.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-11T19:14:13.203" LastActivityDate="2013-07-11T19:14:13.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2305" PostTypeId="1" CreationDate="2013-07-11T18:39:03.863" Score="8" ViewCount="8329" Body="&lt;p&gt;First of all, I am a total noob. The extent of my VLAN experience is setting up a guest network on a wireless router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have recently gotten a request to set up a public network requiring filtering and throttling (via Untangle). Meanwhile, there is a workstation in the same building which should have unrestricted access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, what do I do on the ESXi switches and/or the Netgear GS108E switch to logically separate the networks? As of now, everything is flowing through the &quot;red&quot; path of no/all/default LAN. I need the workstation [w] to flow through the &quot;blue&quot; path, while keeping everything else on the &quot;red&quot; path. I have read dozens of VLAN articles, but nothing is making the default/tagging/untagged/native VLAN concepts click.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/FAztz.png&quot; alt=&quot;diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2020" LastEditorUserId="561" LastEditDate="2013-07-12T06:01:28.143" LastActivityDate="2018-04-25T22:47:39.223" Title="How do I set up a VLAN between an ESXi VM and Physical Hardware?" Tags="|ethernet|vlan|switching|layer2|" AnswerCount="4" CommentCount="0" ClosedDate="2020-01-27T20:19:21.233" ContentLicense="CC BY-SA 3.0" />
  <row Id="2306" PostTypeId="2" ParentId="2301" CreationDate="2013-07-11T18:41:49.957" Score="5" Body="&lt;p&gt;What problem are you trying to solve?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most CDN's work off of Anycast/GeoIP to serve the requested content as close to the source of the request as possible. I'm also not sure what you mean or what you're trying to accomplish by &quot;finding out what users are doing&quot; - CDN's are designed to be transparent to users to provide a better user experience when browsing the web (the biggest use case for a CDN - there are obviously others). I'm having a tough time thinking of what an average user would use a CDN for for reasons that would warrant monitoring of this nature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you did want to build a lookup table or a database, it shouldn't be that difficult, since you could query whois or an IRR to get IP/routing information (assuming the CDN operator does the Right Thing and puts their info in the IRR - most of the big ones do). I'd start with figuring out which CDN's own which blocks and then cross-referencing which IP belongs to which block, and then you could make a distinction on who owns the CDN IP that your users were hitting. It's possible, but it will get hairy very quickly and may very well be an exercise in futility (thinking if CDN's resell services to other smaller companies and solutions like CloudFront).&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-07-11T18:57:39.430" LastActivityDate="2013-07-11T18:57:39.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2307" PostTypeId="2" ParentId="2305" CreationDate="2013-07-11T19:11:42.207" Score="7" Body="&lt;p&gt;802.1q is the technical standard for VLAN tagging (&lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1Q&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/IEEE_802.1Q&lt;/a&gt;). This standard includes the placement of a &quot;VLAN Tag&quot; inside the header of Ethernet frames. This tag allows a link to carry multiple VLANs, as long as both devices recognize 802.1q tagging, because the tag contains the VLAN ID that the traffic belongs to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such a link is commonly referred to as a &quot;trunk link&quot; or &quot;802.1q trunk&quot;, etc. In such an environment, there is typically a single VLAN that's assigned the role of &quot;native VLAN&quot;. The term may also be &quot;untagged VLAN&quot;, because that's what a native VLAN is - a particular VLAN that crosses a trunk link with no VLAN tag. Since there's no way to identify which VLAN a packet belongs to without this tag, only one VLAN can be designated the &quot;native VLAN&quot;, and it's a good idea to make sure this value matches on both sides of a trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In ESXi, you can define port groups with a VLAN ID. If you leave this field blank (or specify 0) then that port group's traffic egresses the host with no VLAN tag. This is okay if you have only one port group on the host and that vSwitch only plugs into one link, because you can simply make that port an access port, no trunk necessary. However, you need multiple VLANs to be passed on the same link (or link bundle), so I would make sure trunking is configured on the switchports that your host connects to, then all you'll need to do is enter the appropriate VLAN ID per vSwitch port group. ESXi will tag frames entering that port group as they exit the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's important to configure your switchports in &quot;VLAN Trunk&quot; or &quot;VLAN Tagging&quot; mode because non trunk ports do not accept tagged frames (they get dropped). Trunk ports accept tagged frames, and you will be sending tagged frames from your ESXi host with the above configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I can tell, the switch you show in the diagram should support all of this but it might not be the most intuitive or use the same terms. I'd recommend sticking with the documentation and see if you can get it working.&#xA;&lt;a href=&quot;http://www.netgear.com/business/products/switches/prosafe-plus-switches/GS108E.aspx&quot; rel=&quot;nofollow&quot;&gt;http://www.netgear.com/business/products/switches/prosafe-plus-switches/GS108E.aspx&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1007" LastEditorUserId="2050" LastEditDate="2013-07-14T20:13:49.723" LastActivityDate="2013-07-14T20:13:49.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2308" PostTypeId="2" ParentId="2298" CreationDate="2013-07-11T19:38:05.643" Score="1" Body="&lt;p&gt;Other options...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Wireless site survey using a laptop / cell phone / tablet. Walk around and record the BSSID (ap mac) and signal strengths. (eg. netstumbler)&lt;/li&gt;&#xA;&lt;li&gt;Attach to the console of each AP to get it's name, mac, etc.&lt;/li&gt;&#xA;&lt;li&gt;Unplug each AP in sequence and note which one powers off&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-07-11T19:38:05.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2309" PostTypeId="2" ParentId="2303" CreationDate="2013-07-11T19:47:27.603" Score="-1" Body="&lt;p&gt;According to Cisco at CLUS13, this can be done with OnePK.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'd offload all traffic to an encryption device (of your own design or some 3rd party), and then have your encryption device send everything back to your device and process traffic as normal.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There wasn't much elaboration on this, but it's probably happening only with L3 traffic and is probably a lot more trouble than it's worth unless you've got some very obscure security requirements.&lt;/p&gt;&#xA;" OwnerUserId="2021" LastActivityDate="2013-07-11T19:47:27.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2310" PostTypeId="2" ParentId="2295" CreationDate="2013-07-11T19:48:01.120" Score="5" Body="&lt;p&gt;Short answer: Yes, distance has an effect on single stream bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internet has evolved means of limiting that effect... delayed ACK, window scaling, other protocols :-) But physics still wins in the end.  In this case, it's much more likely to be general network congestion over so many hops -- it only takes a single dropped packet to kill a TCP stream.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-07-11T19:48:01.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2311" PostTypeId="2" ParentId="2303" CreationDate="2013-07-11T20:21:37.017" Score="6" Body="&lt;p&gt;Some vendors support &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1AE&quot; rel=&quot;noreferrer&quot;&gt;IEEE 802.1ae/MACsec&lt;/a&gt; for encryption layer two between the access switch and its endpoints. I'm afraid I can't be any more help as I have no experience with it (and frankly it sounds like a nightmare to administer).&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-07-11T20:21:37.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2312" PostTypeId="2" ParentId="2303" CreationDate="2013-07-11T21:57:59.453" Score="0" Body="&lt;p&gt;If you are a full on windows shop you can run IPSEC between almost all the computers, this is done in group policy, but the planning is complex because you cant encrypt util you have logged on (DHCP cannot be encrypted). Not for the faint of heart and no one really is all Microsoft.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-07-11T21:57:59.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2314" PostTypeId="2" ParentId="2302" CreationDate="2013-07-12T03:02:49.600" Score="3" Body="&lt;p&gt;There is a traditional standard for flow control (802.3x) that is a mac-layer frame that causes &lt;em&gt;all&lt;/em&gt; traffic on the wire to pause while the signaling switch transmits its buffers.  This is exactly wrong for FCoE (which responds badly to dropped frames) and is distinct from priority flow control (PFC) which is a component of Data Center Bridging (DCB).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast to 802.3x, PFC allows the traffic to be paused on a per-CoS basis.  This is a key element in providing lossless forwarding, as non-protected classes of traffic can be slowed down such that there is always bandwidth available for critical traffic.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 3750X doesn't support DCB (..or PFC) and isn't intended as a platform for lossless Ethernet.  It does support the older style of flow control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm going to assume that the storage in question is IP-based (i.e. Equallogic), in which case you should follow the storage vendor's recommendations and enable flow control end-to-end.  Some have found anomalous issues with this setup and have gotten better results with flow control disabled, but I wouldn't try this unless dictated during troubleshooting.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-07-12T03:02:49.600" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2315" PostTypeId="2" ParentId="2303" CreationDate="2013-07-12T03:19:21.593" Score="3" Body="&lt;p&gt;There's definitely not a single way to provide end-to-end encryption as you've asked, but packet sniffing as you wish to protect against can really only performed at few places in a typical corporate environment. 1 - physical network taps between devices 2 - span/monitor ports on devices 3 - attacks that force traffic to go where it is not intended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For #1 - as @Jeremy Stretch mentioned IEEE 802.1ae/MACsec can be used hop-by-hop between devices, so a tap will only see encrypted data.  While the data is &quot;clear&quot; within the switches (See #2), this is often needed to apply the desired QoS, security and other controls before forwarding to the next hop. However, it's fairly new and requires compatible endpoints and switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For #2 - Your physical and network security policy should limit access to the network devices to prevent an attacker from gaining access. Using a VPN client on each desktop and concentrators near the servers can provide another level of protection from third parties in the middle. Port-forwarding/tunneling over SSH between endpoints is another option, as well as IPSec everywhere like @fredpbaker mentioned gets you a bit closer but it's tough to implement. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For #3 - most enterprise network devices have tools to mitigate MITM/ARP attacks, rouge DHCP servers, spanning tree attacks and others meant to redirect traffic to where an attacker can listen in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end you can use one, or all of these techniques to better protect data in-flight. Only a combination of these and a robust security policy to protect data-at-rest, the endpoints, physical security, and lots of time and money can really meet the goal you outlined!&lt;/p&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-12T03:19:21.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2316" PostTypeId="2" ParentId="2302" CreationDate="2013-07-12T06:31:28.423" Score="4" Body="&lt;p&gt;I think it's also relevant to understand directionality of pause frames and what that means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially what sending pause frame means is 'I am congested, and I prefer that you buffer frame in your TX, rather than I buffer in my RX'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3750-X cannot send pause frames, it can only receive them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means if 3750-X buffers are in danger of being depleted (which is very easy, 3750-X has tiny buffer and is badly suited for applications where egress capacity isn't significantly more than ingress), there is nothing pause frames can do, 3750-X cannot do the desirable action and ask sender to slow down (causing Dell to buffer them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if the Dell is receiving data so fast that it is in danger of being congested it can send pause frame to 3750-X and ask 3750-X to stop sending (effectively it asks 3750-X to buffer frames FOR it, so it does not have to buffer them). This, in my opinion does not make sense, I expect every storage device to have more buffers than 3750-X (&amp;lt;1ms per port on average), I'd expect you only increase packet loss by asking 3750-X to do your buffering, as it'll drop them sooner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I see it, you can only enable pause frames to the direction where it does not even make sense for this application. &lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-07-12T06:31:28.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2317" PostTypeId="2" ParentId="2301" CreationDate="2013-07-12T07:10:16.887" Score="0" Body="&lt;p&gt;If you are attempting to monitor web traffic you will probably want some type of web logging device to cross reference your flow information against.  Time and source IP address would then be analyzed against your web logging appliance or web filter to see what URL that particular user accessed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A solution like &lt;a href=&quot;http://www.websense.com/content/web-filter-features.aspx&quot; rel=&quot;nofollow&quot;&gt;websense web filter&lt;/a&gt; would work for this.&lt;/p&gt;&#xA;" OwnerUserId="352" LastActivityDate="2013-07-12T07:10:16.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2318" PostTypeId="1" CreationDate="2013-07-12T09:32:04.047" Score="6" ViewCount="724" Body="&lt;p&gt;We would like to pass traffic tagged (in the same vlan) from Router_1 to Router_2 throught a Traffic Management device (in transparent mode). Now, we are using two switches (running and aimed config Link below) but we would like to remove one of our old switches and use only our Cisco 6509 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/txqX5.png&quot; alt=&quot;scheme&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are thinking about using Bridge Groups (BVI) but we are not 100% sure if it would work. Any idea or suggestion before we start bridge group configuration on the Cisco 6509 Switch.&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="561" LastEditDate="2013-07-12T10:31:52.527" LastActivityDate="2013-07-12T10:52:20.093" Title="Passing Traffic through Traffic Management Device in transparent mode" Tags="|cisco|switch|vlan|cisco-6500|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2319" PostTypeId="2" ParentId="2318" CreationDate="2013-07-12T09:55:29.590" Score="7" Body="&lt;p&gt;If all traffic needs to go from gi0/4 to gi0/3 and from gi0/2 to gi0/1 you could use &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/wan_lserv/configuration/15-mt/wan-l2-lcl-swng.html#GUID-D4C7CDB5-8819-44FE-9642-F150157E2037&quot;&gt;layer 2 local switching&lt;/a&gt;. Configuration would be about:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;connect Router1-TM GigabitEthernet0/4 GigabitEthernet0/3 &#xA;connect Router2-TM GigabitEthernet0/1 GigabitEthernet0/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If your linecards do not support layer 2 local connect, then consider bridge-groups:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bridge irb&#xA;interface range GigabitEthernet0/4 , GigabitEthernet0/3&#xA; bridge-group 1&#xA;interface range GigabitEthernet0/1 - 2&#xA; bridge-group 2&#xA;!&#xA;bridge 1 protocol ieee&#xA;bridge 1 priority 128&#xA;bridge 2 protocol ieee&#xA;bridge 2 priority 128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However I'm dubious if bridge is actually in PFC, not at least up-to PFC3, I'm not sure about PFC4 (SUP2T). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally you have option to use QinQ:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface range GigabitEthernet0/4 , GigabitEthernet0/3&#xA; switchport&#xA; switchport access vlan 42&#xA; switchport mode dot1q-tunnel&#xA; switchport nonegotiate&#xA;!&#xA;interface range GigabitEthernet0/1 - 2&#xA; switchport&#xA; switchport access vlan 43&#xA; switchport mode dot1q-tunnel&#xA; switchport nonegotiate&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this option VLAN 123 that comes from Router1, gets VLAN 42 on top of it [ 42 123 ], MAC addresses from &lt;em&gt;ALL&lt;/em&gt; Router1 VLANs are populated in VLAN 42 mac-address-table. So then MAC lookup is done against VLAN 42 where we only have traffic-manager, once we send the frame out to traffic-manager, we pop VLAN 42 out.&lt;br&gt;&#xA;Now after traffic manager send it OUT, again in VLAN 123, it gets VLAN 43 on top of it [ 43 123 ], and as previously MAC lookup is done for table 43, where we only have Router2, frame is sent out towards Router2 and VLAN 43 is popped out.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;By default STP is not tunneled like rest of the traffic, but STP BPDU is directly visible to the switch, and switch will react to it normally, this is often undesirable. If STP BPDU needs to be tunneled as well you need feature called 'Layer 2 Protocol Tunnel' or &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/l2pt.html&quot;&gt;L2PT&lt;/a&gt;.&lt;br&gt;&#xA;L2PT is fancy word for DMAC address rewrite, when incoming frame has DMAC identifying the frame as special BPDU, such as STP, you rewrite the DMAC to some non-special address, for STP BPDU DMAC is written ingress to 01-00-0c-cd-cd-d0 then in egress the 01-00-0c-cd-cd-d0 DMAC id again rewritten back to STP DMAC.&lt;br&gt;&#xA;Configuration is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; l2protocol-tunnel cdp&#xA; l2protocol-tunnel lldp&#xA; l2protocol-tunnel stp&#xA; l2protocol-tunnel vtp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use 'show l2protocol-tunnel interface giga0/1' to see counters for both directions of the MAC rewrite 'encap' means real DMAC was written to 01-00-0c-cd-cd-d0  and 'decap' means 01-00-0c-cd-cd-d0 was written back to real DMAC.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#show l2protocol-tunnel  interface giga1/0/6&#xA;COS for Encapsulated Packets: 5&#xA;&#xA;Port       Protocol Shutdown  Drop      Encapsulation Decapsulation Drop&#xA;                    Threshold Threshold Counter       Counter       Counter&#xA;---------- -------- --------- --------- ------------- ------------- -------------&#xA;Gi1/0/6    cdp           ----      ----       2674827        263832            0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-07-12T10:52:20.093" LastActivityDate="2013-07-12T10:52:20.093" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2321" PostTypeId="1" CreationDate="2013-07-12T18:19:24.110" Score="6" ViewCount="2148" Body="&lt;p&gt;I have 2 switches in the same rack AC room etc.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WS-C3750V2-48TS&#xA;TEMPERATURE is OK&#xA;Temperature Value: 41 Degree Celsius&#xA;Temperature State: GREEN&#xA;Yellow Threshold : 66 Degree Celsius&#xA;Red Threshold    : 76 Degree Celsius&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VS&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WS-C3750X-48P&#xA;SYSTEM TEMPERATURE is OK&#xA;System Temperature Value: 27 Degree Celsius&#xA;System Temperature State: GREEN&#xA;Yellow Threshold : 46 Degree Celsius&#xA;Red Threshold    : 60 Degree Celsius&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How is this possible?  Anyone seen something like this before, Does a 3750V2 just run hot?&lt;/p&gt;&#xA;" OwnerUserId="1592" LastActivityDate="2013-07-12T20:20:09.093" Title="3750 Temperatures for same rack" Tags="|cisco|environmental-monitoring|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2324" PostTypeId="2" ParentId="2321" CreationDate="2013-07-12T18:45:31.607" Score="2" Body="&lt;p&gt;The difference might simply be attributable to differing processing hardware or even temperature sensor locations.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-07-12T18:45:31.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2325" PostTypeId="2" ParentId="2321" CreationDate="2013-07-12T18:56:04.717" Score="0" Body="&lt;p&gt;The 3750X also has extra air inlets above the ethernet ports. And it is a different platform, so quite possibly just has the sensor in a cooler location.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-07-12T18:56:04.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2326" PostTypeId="2" ParentId="2321" CreationDate="2013-07-12T20:20:09.093" Score="3" Body="&lt;p&gt;If you look at the warning/critical thresholds for these devices, this looks to be expected behavior as the 3750v2 has significantly higher settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without delving into it in great detail, I would guess that the 3750X has the temp sensors at the airflow inlet and the 3750v2 has them at the outlet, possibly because IIRC the 3750X also has removable fan units and they didn't want to put the sensors in the fan units.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-07-12T20:20:09.093" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2327" PostTypeId="1" CreationDate="2013-07-12T20:51:12.353" Score="14" ViewCount="27468" Body="&lt;p&gt;In at least one implementation there is a hard limit on the capacity of the ARP table. What happens when the ARP cache is full and a packet is offered with a destination (or next-hop) that isn't cached? What happens under the hood, and what is the effect on the service quality?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, Brocade NetIron XMR and Brocade MLX routers have a &lt;a href=&quot;http://www.brocade.com/downloads/documents/html_product_manuals/NI_05400a_CFG/wwhelp/wwhimpl/js/html/wwhelp.htm#href=System_params.05.22.html#1105863&quot; rel=&quot;noreferrer&quot;&gt;configurable &lt;code&gt;ip-arp&lt;/code&gt; system maximum&lt;/a&gt;. The default value in that case is 8192; the size of a /19 subnet. It is not clear from the documentation whether this is per interface or for the whole router, but for the purpose of this question, we can assume it is per interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Few networkers would configure a /19 subnet on an interface on purpose, but that isn't what happened. We were migrating a core router from a Cisco model to a Brocade. One of the many differences between Cisco and Brocade is that Cisco accepts static routes that are defined with both an outbound interface and a next-hop address, but Brocade insists on one or the other. We dropped the next-hop address and kept the interface. Later, we learned the error of our ways, and changed from interface to next-hop address, but everything seemed to be working initially.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----+ iface0    +----+&#xA;| R1 |-----------| R2 |---&amp;gt; (10.1.0.0/16 this way)&#xA;+----+.1       .2+----+&#xA;      10.0.0.0/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before the migration, R1 was a Cisco, and had the following route.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.1.0.0 255.255.0.0 iface0 10.0.0.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After the migration, R1 was a Brocade, and had the following route.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.1.0.0 255.255.0.0 iface0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2 is a Cisco router, and Cisco routers perform &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094adb.shtml&quot; rel=&quot;noreferrer&quot;&gt;proxy ARP&lt;/a&gt; by default. This is the (mis-)configuration in production that set the stage for what turned out to be an ARP cache overflow.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;R1 receives a packet destined for the 10.1.0.0/16 network.&lt;/li&gt;&#xA;&lt;li&gt;On the basis of the static interface route, R1 ARPs for the destination on &lt;code&gt;iface0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;R2 recognizes that it can reach the destination, and responds to the ARP with its own MAC.&lt;/li&gt;&#xA;&lt;li&gt;R1 caches the ARP result that combines an IP in a remote network with the MAC of R2.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This happens for every distinct destination in 10.1.0.0/16. Consequently, even though the /16 is properly sub-netted beyond R2, and there are only two nodes on the link adjoining R1 and R2, R1 suffers ARP cache overload because it induces R2 to behave as if all 65k addresses are directly connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I'm asking this question is because I hope it will help me make sense of the network service trouble reports (days later) that led us, eventually, to the overflowing ARP cache. In the spirit of the StackExchange model, I tried to distill that to what I believe is a crisp, specific question that can be answered objectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 1&lt;/strong&gt; To be clear, I am asking about part of the glue layer between data link (layer 2) and network (layer 3), not the MAC forwarding table within the data link layer. A host or router builds the former to map IP addresses to MAC addresses, while a switch builds the latter to map MAC addresses to ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2&lt;/strong&gt; While I appreciate the effort to which responders have gone to explain why some implementations are not subject to ARP cache overflow, I feel that it is important for this question to address those that are. The question is &quot;what happens when&quot;, not &quot;is vendor &lt;em&gt;X&lt;/em&gt; susceptible to&quot;. I've done my part now by describing a concrete example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 3&lt;/strong&gt; Another question this is not is &quot;how do I prevent the ARP cache from overflowing?&quot;&lt;/p&gt;&#xA;" OwnerUserId="47" LastEditorUserId="47" LastEditDate="2013-07-17T15:50:27.213" LastActivityDate="2013-07-17T15:50:27.213" Title="What happens when the ARP cache overflows?" Tags="|router|routing|brocade|arp|" AnswerCount="6" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2328" PostTypeId="2" ParentId="2327" CreationDate="2013-07-12T21:25:57.290" Score="1" Body="&lt;p&gt;It would arp for the IP address store it in the table and depending on implementation should delete the oldest entry. Impact to performance depends, if this is a uncommon occurance not much impact, but this is an attack vector so someone can send a lot of arps impacting processor utilization&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-07-12T21:25:57.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2329" PostTypeId="2" ParentId="2327" CreationDate="2013-07-12T21:39:41.227" Score="2" Body="&lt;p&gt;Only actual experience I had with this happening was on C3550 switches (2-8k MAC limit, depending on sdm template) and there it dropped the oldest entry from the table.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-07-12T21:39:41.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2330" PostTypeId="1" AcceptedAnswerId="2336" CreationDate="2013-07-12T23:33:55.653" Score="5" ViewCount="898" Body="&lt;p&gt;I am connecting to a 100Mbit WAN circuit, that is Burstable to 500Mbit. &#xA;If I am going to use ASA traffic shaping on this, would I set the shape average to 100Mbit or 500Mbit? My main concern is protecting VOIP, while allowing file transfers access to the burst. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I have so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is to match the Voice Traffic&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map voice_traffic&#xA;match dscp EF AF31&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is to priorities the voice&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map qos_class_policy&#xA;class voice_traffic&#xA;priority&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is the shaping policy that will be applied to the outside interface. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map qos_outside_policy&#xA;class class-default&#xA;shape average 100000000&#xA;service-policy qos_class_policy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here it is applied to the external interface 'outside'&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;service-policy qos_outside_policy interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are the options on the ASA to set the shape, and then set the burst commit. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mpf-policy-map-class mode commands/options:&#xA;  &amp;lt;64000-154400000&amp;gt;  Target Bit Rate (bits per second), the value needs to be&#xA;                     multiple of 8000&#xA;ASA(config-pmap-c)# shape average 10000000 ?&#xA;&#xA;mpf-policy-map-class mode commands/options:&#xA;  &amp;lt;2048-154400000&amp;gt;  bits per interval, sustained. Needs to be multiple of 128. &#xA;                    Recommend not to configure it, the algorithm will find out&#xA;                    the best value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1352" LastEditorUserId="2880" LastEditDate="2013-10-08T02:13:44.810" LastActivityDate="2013-10-08T02:13:44.810" Title="ASA Traffic Shapping on a burstable circuit" Tags="|cisco-asa|qos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2331" PostTypeId="1" CreationDate="2013-07-13T03:48:25.960" Score="4" ViewCount="4786" Body="&lt;p&gt;I am just wondering if it's possible to stack Cisco 3750 switches using their ethernet interfaces? I don't have the proprietary stacking cables.&lt;/p&gt;&#xA;" OwnerUserId="2041" LastEditorUserId="775" LastEditDate="2013-07-13T09:04:42.540" LastActivityDate="2013-07-13T09:04:42.540" Title="Can you stack Cisco 3750 using ethernet cables?" Tags="|cisco|cisco-3750|stacking|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2332" PostTypeId="2" ParentId="2331" CreationDate="2013-07-13T04:27:55.910" Score="7" Body="&lt;p&gt;Unfortunately, you'll need the StackWise cables to stack 3750's.  (And the StackWise modules as well depending on your switches.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps5023/prod_white_paper09186a00801b096a.html&quot;&gt;this Cisco white paper&lt;/a&gt; on Cisco StackWise for more information.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-07-13T04:32:57.227" LastActivityDate="2013-07-13T04:32:57.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2335" PostTypeId="2" ParentId="2327" CreationDate="2013-07-13T07:16:37.770" Score="2" Body="&lt;p&gt;For IOS and JunOS and other commercial stacks you just have to test, it's not very hard luckily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But for &lt;a href=&quot;http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/tree/net/core/neighbour.c&quot; rel=&quot;nofollow&quot;&gt;linux&lt;/a&gt;, freebsd, netbsd, openbsd, uIP, lwIP and probably many other implementations you can just check their source code for the behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Linux you need to check 'net/core/neighbour.c' (start with line 'if (entries &gt;= tbl-&gt;gc_thresh3' ||')  and 'net/ipv4/arp.c'.&lt;br&gt;&#xA;In Linux you seem to have three full levels&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;gc_thresh1 - nothing is done until this is hit&lt;/li&gt;&#xA;&lt;li&gt;gc_thresh2 - this can be hit momentarily&lt;/li&gt;&#xA;&lt;li&gt;gc_thresh3 - this size cannot be exceeded&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When gc_thresh3 tries to exceed, it tries to force garbage collection run, unless it has been already ran recently. Garbage collect appears to delete entries which are not referred to anymore, so does not mean oldest or newest, however gc_staletime exceeding seems to be one way of dereferencing entry, which again translates to oldest entry.&lt;br&gt;&#xA;If garbage collect cannot be ran, new entry is simply not added. All these gc_threshN and periodic garbage collect intervals can be tuned.&lt;br&gt;&#xA;The code is address family (ipv4, ipv6) agnostic, so IPv6 ND and IPv4 ARP tables are handled by exact same code-path, not duplicate path.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-07-13T07:36:35.153" LastActivityDate="2013-07-13T07:36:35.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2336" PostTypeId="2" ParentId="2330" CreationDate="2013-07-13T07:32:15.777" Score="3" Body="&lt;p&gt;What you want to have is the VoIP traffic is always inside the 'first' 100M, and data can go outside it. So that when far-end policer/shaper needs to drop, they'll just drop the traffic after the 'first' 100M. This is not possible at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the provider policer/shaper starts dropping due to you exceeding 100M for long time, if they don't share your view of QoS policy, they'll drop indiscriminately your voice and data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So config you have right now, is best you can do.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-07-13T07:32:15.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2337" PostTypeId="2" ParentId="2331" CreationDate="2013-07-13T07:46:36.890" Score="4" Body="&lt;p&gt;Like @Brett said, StackWise is not possible without the use of stack ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there is also really really old Cisco switch feature called &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/15.0_2_se/configuration/guide/swclus.html&quot; rel=&quot;nofollow&quot;&gt;cluster&lt;/a&gt; which uses just ethernet ports.&lt;br&gt;&#xA;I personally would never run this cluster feature and would steer away StackWise as well unless I have extremely good justification for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually higher software complexity means lower MTBF and that is my experience running tens of 3750 stacks and hundreds of individual 3750 switches.&lt;br&gt;&#xA;The newly introduced 3850 stack architecture seems much more appealing, as it's more closely designed to look like chassis based switch, you have two RPs and bunch of dumb linecards. But of course experience is thin on such a new solution.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-07-13T07:46:36.890" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2338" PostTypeId="2" ParentId="2331" CreationDate="2013-07-13T07:46:45.410" Score="3" Body="&lt;p&gt;As @Brett said, &lt;strong&gt;StackWise cables are required.&lt;/strong&gt;  Depending on what your goal is for the stack, you may be fine just creating an port-channel (Etherchannel) using up to 8x100Mb (800Mb) or 8x1Gb (8Gb) between 3750 switches.  If you have certain 3750 models with 10/100Mb ports and 1000Mb uplinks, you could channelize up to 4 ports to get 4Gb.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-07-13T07:46:45.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2339" PostTypeId="1" AcceptedAnswerId="2366" CreationDate="2013-07-13T08:03:04.243" Score="11" ViewCount="1045" Body="&lt;p&gt;I understand the benefits of the Cisco 6500 VSS with the obvious selling points of single management, single routing instance, STP elimination, port-channels across chassis, etc.  With two standalone Cisco 6500s that may have L3 and L2 port-channels between them, they at least have no operational dependency on one another through the control-plane. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a VSS world -- and I have no direct experience with this -- we now have software and other protocols that control both switches.  In my designs that expect control-plane software to have bugs, &lt;strong&gt;does the VSS lower the MTBF as I suspect and is a trade-off with the capababilities gained or am I missing how MTBF is improved?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-10-03T19:39:44.203" Title="Does Cisco 6500 VSS improve or hurt MTBF?" Tags="|cisco|vss|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2340" PostTypeId="2" ParentId="2327" CreationDate="2013-07-13T08:32:38.650" Score="1" Body="&lt;p&gt;The switch is going to ARP for that destination IP to get it's MAC address (which would also populate the CAM table with the response).  The ARP request is broadcast to all ports.  This requires the CPU and involves the &lt;code&gt;ARP Input&lt;/code&gt; process.  If the ARP requests are for the same IP, due to the ARP table overflowing frequently, the switch should rate-limit the ARP to once every two seconds.  If the requests are to random IPs frequently enough, CPU may spike as that CPU is involved in both the ARP requests and responses.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-07-13T08:32:38.650" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2343" PostTypeId="1" CreationDate="2013-07-13T14:28:06.590" Score="4" ViewCount="125" Body="&lt;p&gt;Could someone explain what is NBMA neighbor-ship process in OSPF?&lt;br&gt;&#xA;I have gone through several books but did't get satisfactory explanation. &lt;/p&gt;&#xA;" OwnerUserId="2047" LastActivityDate="2013-07-13T20:11:53.343" Title="NBMA neighbor-ship process" Tags="|ospf|network-core|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2344" PostTypeId="2" ParentId="2339" CreationDate="2013-07-13T20:09:47.040" Score="1" Body="&lt;p&gt;I my experience VSS lengthens MTBF through reduced operational complexity, (i.e. no HSRP/VRRP,  less STP tuning, simpler routing, etc.) especially for shops with less-experienced engineers. Reconvergance after link failures is generally faster as the rest of network sees the pair as one device from a L2 and L3 perspective.  My guess would be there are fewer outages related to VSS software bugs, than outages attributed to the interactions and failure modes of the various protocols typically run at that layer.&lt;/p&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-13T20:09:47.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2345" PostTypeId="2" ParentId="2343" CreationDate="2013-07-13T20:11:53.343" Score="3" Body="&lt;p&gt;NBMA networks require a special OSPF network type on the connected routers' interface. This setting affects quite a few things, including the need for a Designated Router, and the timers like hello timers and dead timers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend researching OSPF network types, as the question as you've stated is way too broad to be answered on this site. You should read the &lt;a href=&quot;http://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow&quot;&gt;OSPF RFC&lt;/a&gt;, or even vendor-specific books. On this topic, Cisco Press has a few resources, namely Routing TCP/IP Volume 1. &lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-07-13T20:11:53.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2346" PostTypeId="2" ParentId="2339" CreationDate="2013-07-13T23:46:47.243" Score="2" Body="&lt;p&gt;From a functional point of view VSS basically takes two chassis and runs them on a single control plane.  If you want to create an 18-slot 6500 then it is the ideal technology.  If the goal is greater availability then it's a lot harder to justify.  They key point is that in establishing a VSS pair you've created a &lt;b&gt;single&lt;/b&gt; functional chassis.  Any failure mode on the control plane - from software defect to configuration error - has an immediate effect upon the entire complex.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what it's worth I haven't really seen many new deployments of VSS over the past five years but I have seen a fair number where the feature has been removed in favor of running independent 6K pairs.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-07-13T23:46:47.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2347" PostTypeId="1" CreationDate="2013-07-14T05:36:47.353" Score="4" ViewCount="6867" Body="&lt;p&gt;Actually, I would like to allow users to use either the 64-bit Cisco VPN client or the Windows 7 built in client. Is this possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Additional information:&lt;/strong&gt; The IOS host is the 881w-A-K9 ISR running version 15.1(4)M4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no current VPN configuration.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 2015-02-06&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I asked this question a year and a half ago, but I still do not have enough information to complete this task. I want to use the built-in L2TP/IPsec Windows client to dial-in to my router. The accepted answer to that question doesn't actually cover dial-in scenarios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My immediate question is if this is even possible.  It's hard for me to believe that it isn't, but &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/vpdn/configuration/15-mt/vpdn-15-mt-book/vpd-cfg-client-init-dialin-tunnels.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; pages says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Client-initiated tunnels using the L2TP or L2TPv3 protocol must be&#xA;  initiated by a router configured as the local peer. The L2TP and&#xA;  L2TPv3 protocols are not supported for client-initiated tunnels from a&#xA;  client PC.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342vpn4.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; page, which is older, doesn't make any such warning. What is the authoritative answer to this question?&lt;/p&gt;&#xA;" OwnerUserId="1942" LastEditorUserId="775" LastEditDate="2015-02-07T03:31:40.050" LastActivityDate="2015-08-30T15:19:45.057" Title="How does one configure Cisco router for IPSec VPN for use with Windows 7 built in VPN client?" Tags="|cisco|vpn|ipsec|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2348" PostTypeId="2" ParentId="2347" CreationDate="2013-07-14T20:38:42.267" Score="-2" Body="&lt;p&gt;The built in Windows client is a PPTP client, while the Cisco client is an IPSEC client (PPTP is old and insecure), maybe you should forget both and set up an SSL VPN on your ASA.&lt;/p&gt;&#xA;" OwnerUserId="2051" LastActivityDate="2013-07-14T20:38:42.267" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2351" PostTypeId="1" CreationDate="2013-07-15T06:45:50.687" Score="4" ViewCount="477" Body="&lt;p&gt;Does anyone knows a way to export the CheckPoint SmartDashboard Report (mht file) to one or multiple csv file(s)?&lt;/p&gt;&#xA;" OwnerUserId="2053" LastEditorUserId="76" LastEditDate="2013-07-15T18:55:51.247" LastActivityDate="2014-04-29T12:31:49.260" Title="CheckPoint SmartDashboard report file (mht) to csv file" Tags="|checkpoint|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2352" PostTypeId="2" ParentId="2347" CreationDate="2013-07-15T10:21:21.707" Score="4" Body="&lt;p&gt;To configure IPSec with the native Windows7 client, you need &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t2/pt_wnlns.html&quot; rel=&quot;nofollow&quot;&gt;L2TP + IPSec on IOS&lt;/a&gt; and &lt;a href=&quot;http://www.hideipvpn.com/2010/03/howto-windows-7-ipsecl2tp-vpn-setup-tutorial/&quot; rel=&quot;nofollow&quot;&gt;Windows 7 L2TP + IPSec&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-07-15T10:21:21.707" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2353" PostTypeId="1" AcceptedAnswerId="2356" CreationDate="2013-07-15T10:32:35.387" Score="10" ViewCount="561" Body="&lt;p&gt;We have some existing ASA-5555X in multiple context mode, and we are using one context per-vlan as a transparent layer2 firewall.  Over time, we have been adding to this solution, and we're about to exceed our original license of 5 security contexts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We purchased L-ASA-SC-10=, but it is unclear whether applying this activation key will require us to reboot the ASAs.  I do know it will require us to break the active-standby pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does applying L-ASA-SC-10= to our running ASAs require a reboot?  We have version 9.0(2) if that matters.&lt;/p&gt;&#xA;" OwnerUserId="2046" LastEditorUserId="2046" LastEditDate="2013-07-15T10:34:46.913" LastActivityDate="2013-07-15T13:20:49.693" Title="Does L-ASA-SC-10= require a reboot?" Tags="|cisco|security|vlan|cisco-asa|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2354" PostTypeId="2" ParentId="2327" CreationDate="2013-07-15T11:07:28.233" Score="4" Body="&lt;p&gt;&lt;strong&gt;Edit 2&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you mentioned...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.1.0.0 255.255.0.0 iface0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Forces the Brocade to proxy-arp for every destination in 10.1.0.0/16 as if it was directly connected to &lt;code&gt;iface0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't respond about Brocade's ARP cache implementation, but I would simply point out the easy solution to your problem... configure your route differently:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.1.0.0 255.255.0.0 CiscoNextHopIP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By doing this, you prevent the Brocade from ARP-ing for all of 10.1.0.0/16 (note, you might need to renumber the link between R1 and R2 to be outside 10.1.0.0/16, depending on Brocade's implementation of things).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original answer&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I expect that in most, or even all, implementations, there is a hard limit on the capacity of the ARP table.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cisco IOS CPU routers are only limited by the amount of DRAM in the router, but that is typically not going to be a limiting factor.  Some switches (like Catalyst 6500) have a hard limitation on the adjacency table (which is correlated to the ARP table); &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/white_paper_c11-676346.html&quot; rel=&quot;nofollow&quot;&gt;Sup2T has 1 Million adjacencies&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So, what happens when the ARP cache is full and a packet is offered with a destination (or next-hop) that isn't cached?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cisco IOS CPU routers don't run out of space in the ARP table, because those ARPs are stored in DRAM.  Let's assume you're talking about Sup2T.  Think of it like this, suppose you had a Cat6500 + Sup2T and you configured all Vlans possible, technically that is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4094 total Vlans - Vlan1002 - Vlan1003 - Vlan1004 - Vlan1005 = 4090 Vlans&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assume you make each Vlan a /24 (so that's 252 possible ARPs), and you pack every Vlan full... that is 1 Million ARP entries.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4094 * 252 = 1,030,680 ARP Entries&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Every one of those ARPs would consume a certain amount of memory in the ARP table itself, plus the IOS adjacency table.  I dont know what it is, but let's say the total ARP overhead is 10 Bytes...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means you have now consumed 10MB for ARP overhead; it still isn't very much space... if you were that low on memory, you would see something like &lt;code&gt;%SYS-2-MALLOCFAIL&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that many ARPs and a four hour ARP timeout, you would have to service almost 70 ARPs per second on average; it's more likely that the maintenance on 1 million ARP entries would drain the CPU of the router (potentially CPUHOG messages).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point, you could start bouncing routing protocol adjacencies and have IPs that are just unreachable because the router CPU was too busy to ARP for the IP.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-17T01:40:35.327" LastActivityDate="2013-07-17T01:40:35.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2355" PostTypeId="2" ParentId="2327" CreationDate="2013-07-15T12:36:47.210" Score="1" Body="&lt;p&gt;From the attacks I learned on Cisco 3550, 3560 etc. switches you can turn them into giant hub once you overload the MAC address limit. The switches have a set limit of MAC address (around 6000) that can be stored, and once that limit is reached it will flood all data out its interfaces. Can't remember if that goes for 802.1q packets because I have not had to do it in a long time. May have to fire up my network lab at home to find out. &lt;/p&gt;&#xA;" OwnerUserId="2016" LastActivityDate="2013-07-15T12:36:47.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2356" PostTypeId="2" ParentId="2353" CreationDate="2013-07-15T13:20:49.693" Score="10" Body="&lt;p&gt;A reload is only required when changing encryption features or downgrading a permanent license. You shouldn't have to break your failover pair either. For a failover pair running &gt;8.3(1), you only need a context license on the primary, and the secondary will inherit. Context licenses applied to both units in a failover pair will combine. &lt;/p&gt;&#xA;" OwnerUserId="460" LastActivityDate="2013-07-15T13:20:49.693" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2357" PostTypeId="2" ParentId="386" CreationDate="2013-07-15T14:24:37.197" Score="1" Body="&lt;p&gt;FCoE is a very viable and reliable solution for converged infrastructure and cutting costs and management of hardware. I have personally helped architect FCoE solutions for many companies. FCoE end-to-end currently is not a viable solution and many storage providers do not provide support for this. In any case, FCoE with a backend SAN infrastructure already in place is going to be the most common use case. Also, with a converged network switch it is also possible to go to ToR with FCoE and have the converged switch connect directly to storage. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that said Dell, Cisco, Brocade and Juniper all provide converged switches. I work at Dell Networking so will leave it up to you to do the research. I have written several posts on Dell Networking with regards to FCoE on my &lt;a href=&quot;http://humairahmed.com/blog/&quot; rel=&quot;nofollow&quot;&gt;blog&lt;/a&gt;. In short, some viable solutions can be: Dell S5000, Cisco Nexus 5548UP or 5596UP, Brocade VDX 6720 or 6730, and Juniper QFX3500.&lt;/p&gt;&#xA;" OwnerUserId="2052" LastActivityDate="2013-07-15T14:24:37.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2364" PostTypeId="1" CreationDate="2013-07-16T07:58:26.787" Score="7" ViewCount="12345" Body="&lt;p&gt;We have management network (192.168.25.0/24) where we have management ip of ASA 5525-X IPS Bundle (.250) and IPS (.37). The IPS has a default gateway of our Layer 3 (.1) switch that is behind the ASA (according to &lt;a href=&quot;http://www.cisco.com/en/US/products/sw/secursw/ps2113/products_tech_note09186a0080bd5d00.shtml&quot;&gt;Cisco's docs&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To pass traffic back to the IPS, I created a route for 192.168.25.0/24 that points to the L3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I type &lt;code&gt;#sh route&lt;/code&gt; on the ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C    192.168.30.0 255.255.255.0 is directly connected, inside&#xA;C    192.168.25.0 255.255.255.0 is directly connected, management&#xA;C    192.168.35.0 255.255.255.0 is directly connected, outside&#xA;S*   0.0.0.0 0.0.0.0 [1/0] via 192.168.35.1, outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;at the same time &lt;code&gt;#sh running-config route&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route outside 0.0.0.0 0.0.0.0 192.168.35.1 1&#xA;route inside 192.168.25.0 255.255.255.0 192.168.30.2 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in the routing table I have information that subnet is directly connected and is it management interface traffic will not pass to IPS. But the IPS can access Internet and traffic goes through L3 switch (I checked counter). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain how routing for the IPS function should work?&lt;/p&gt;&#xA;" OwnerUserId="904" LastEditorUserId="775" LastEditDate="2013-07-16T10:18:25.123" LastActivityDate="2022-08-25T16:07:11.447" Title="ASA IPS issue: routing and management interface" Tags="|cisco|security|cisco-asa|firewall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2365" PostTypeId="1" CreationDate="2013-07-16T08:12:48.103" Score="8" ViewCount="2420" Body="&lt;p&gt;We have Catalyst 4500R+E with Sup7L-E (IOS XE 3.4SG). It was bundle with LAN Base License Installed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show license summary&#xA;Index 0   Feature: entservices&#xA;          Period left: 8 weeks 4 days&#xA;          License Type: Evaluation&#xA;          License State: Active, Not in Use, EULA not accepted&#xA;          License Count: Non-Counted&#xA;          License Priority: None&#xA;Index 1   Feature: ipbase&#xA;          Period left: 0 seconds&#xA;Index 2   Feature: lanbase&#xA;          Period left: Life time&#xA;          License Type: Permanent&#xA;          License State: Active, In Use&#xA;          License Count: Non-Counted&#xA;          License Priority: Medium&#xA;Index 3   Feature: internal_service&#xA;          Period left: 0 seconds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also I read &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps4324/white_paper_c11-685524.html&quot;&gt;Licensing Deployment Guide&lt;/a&gt; and there was very interesting infoirmation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;User will be notified of the impending license expiry before it expires. After the evaluation license expires, the system continues to run at that license level. However, syslog messages indicating the expired license are continuously displayed on the console, at an interval of one every five minutes.&lt;br&gt;&#xA;  If for any reason the system reloads and the &quot;license boot level ipbase | entservices&quot; IOS CLI is saved as part of startup-configuration, the system overrides the base license, and continues to boot in the license level specified in the IOS CLI, even though it is expired. This behavior might be changed in future when licenses will be enforced.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Does it mean that if I save this line to configuration &lt;code&gt;license boot level ipbase | entservices&lt;/code&gt;, I will have working perpetual Enterprise License but with some warnings in syslog?&lt;/p&gt;&#xA;" OwnerUserId="904" LastEditorUserId="775" LastEditDate="2013-07-16T10:23:06.503" LastActivityDate="2013-10-17T15:03:23.823" Title="Catalyst 4500R+E, Sup7L-E Strange License Management" Tags="|cisco|cisco-catalyst|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2366" PostTypeId="2" ParentId="2339" CreationDate="2013-07-16T08:40:14.627" Score="7" Body="&lt;p&gt;Short version of the answer: a little bit of both, but it's not meant to be a technology to directly improve availability&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long version of the answer:  As others have pointed out, manufacturer's traditional definitions of MTBF and availability focus on hardware failures.  Other factors -- human error, buggy software, planned maintenance, etc. -- are considerations in developing an architecture but are made at the individual user level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a hardware-only perspective, VSS doesn't impact availability.  It's the same hardware being used, so the same MTBF/MTTR numbers are utilized and the end availability equations are the same.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a more holistic perspective, it's really a toss-up and will depend largely on your individual wants and needs.  On one hand, you could consider it less reliable since it's a complex piece of technology and a single &quot;virtual point of failure&quot; (i.e., the VSS control plane) will impact both pieces of redundant gear.  On the other hand, it can be viewed to increase availability since a single virtual device renders the network much simpler, making it less likely for other things to go wrong (fewer devices to manage, no HSRP/VRRP, non-looped STP domain, simpler L3 topology, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The market has pretty much shown that most network engineers view VSS and similar technologies as an improvement over a traditional L2 distro/access topology, but there are other technologies you could go with.  For example, a routed L3 access layer could achieve most of the benefits of VSS, but VLANs would be unable to span multiple access layer devices, making the solution potentially useless in some scenarios (e.g., virtualized data centers).&lt;/p&gt;&#xA;" OwnerUserId="2065" LastEditorUserId="775" LastEditDate="2013-10-03T19:39:44.203" LastActivityDate="2013-10-03T19:39:44.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2367" PostTypeId="1" AcceptedAnswerId="2368" CreationDate="2013-07-16T10:51:08.057" Score="11" ViewCount="1369" Body="&lt;p&gt;I know people can modify the IP headers and change source IP address, but it should be simple for network devices to detect those messages. If they don't, why is it so hard?  Does it add too much overhead?&lt;/p&gt;&#xA;" OwnerUserId="2068" LastEditorUserId="775" LastEditDate="2013-07-18T09:57:16.080" LastActivityDate="2013-07-18T09:57:16.080" Title="Do today's routers prevent fake IP headers?" Tags="|routing|router|ipv4|best-practices|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2368" PostTypeId="2" ParentId="2367" CreationDate="2013-07-16T10:57:39.260" Score="17" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;I know people can modify the IP headers and change source IP address, but it should be simple for network devices to detect those messages.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Fake IP source addresses in headers can be detected and blocked in commercial network gear; other fake IPv4 headers can be a bit harder to identify.  Most people refer to the function to detect fake source IP addresses as &amp;quot;Unicast Reverse Path Forwarding&amp;quot;, which is abbreviated &lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/unicast-rpf.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;uRPF&lt;/a&gt;; &lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/unicast-rpf.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;uRPF&lt;/a&gt; is defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3704&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3704&lt;/a&gt; and is considered an internet &lt;a href=&quot;http://tools.ietf.org/html/bcp38&quot; rel=&quot;nofollow noreferrer&quot;&gt;Best Current Practice&lt;/a&gt;.  &lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/unicast-rpf.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;uRPF&lt;/a&gt; should be applied at the first router from the customer premise equipment, or at the edge router in a corporate network.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If they don't, why is it so hard? Does it add too much overhead?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As long as the router isn't a CPU-based router there isn't a performance penalty.  Many of the routers / switches used by ISPs have this feature built into an ASIC in hardware; normally there is not a huge performance penalty for turning it on.  Sometimes there are feature conflicts, but again this is not a huge deal in most cases.&lt;/p&gt;&#xA;&lt;p&gt;The policies and competency of the ISP engineering/operational personnel varies, and many ISPs (particularly in smaller countries) are so busy with making things &amp;quot;work&amp;quot; that they don't have cycles to make things &amp;quot;work well&amp;quot;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-07-16T10:57:39.260" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2369" PostTypeId="2" ParentId="2367" CreationDate="2013-07-16T11:02:59.063" Score="10" Body="&lt;p&gt;Preventing change of source IP address requires either access lists (ACL) or unicast reverse path filtering (uRPF).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither come for free. uRPF typically requires additional lookup or more complex single lookup, so it could even halve your lookup performance in some platforms. ACL will slow down lookup and use memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;uRPF is maintenance free, you just configure it once and forget it. ACL needs system which knows which addresses are behind interface and makes sure the ACL stays up-to-date.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ACL more widely supported than uRPF, uRPF is comparatively rare feature in L3 switch level devices. In 'real' routers usually both features are available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if both features are available, configuring uRPF in wrong place of the network can break the network, not understanding platform specific ACL limitations can cause outages.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually you yourself don't benefit in preventing source address spoofing, it's mostly the Internet at large who benefits. You carry non-zero risk trying to do it, as you may end-up breaking stuff. And your customers won't gain any benefit, no one will pay you more to implement them. So reward is low doing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Responsible service provider do it, because it's the right thing to do, but it's unrealistic to expect that we'll get antispoofing in relevantly large portion of access devices deployed. Much more realistic goal is, if we do ACL in IP transit connections, as there are only about 6000 or so stubby AS numbers there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why this is even issue is because of UDP reflection attacks, which can be fixed by protocols such as QUIC and MinimaLT which ensure that reflection has no gains, as incoming query is guarantee to be larger than outgoing answer, so spoofing loses its benefit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's again recently become quite popular to use UDP reflection as DDoS attack. There are lot of wide open DNS servers in consumer CPE devices which the consumers are not aware, so those consumers suffer as their home connection is congested as it's used to reflect attack. And it's also easy way to gain significant amplification small query of tens of bytes can yield large answer of over thousand bytes. There have been reflection DDoS attacks which are several hundred gigabits per second, and smaller are daily, just sunday night we transported 43Gbps attack to one of our customer.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-07-16T11:02:59.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2370" PostTypeId="2" ParentId="2367" CreationDate="2013-07-16T13:08:13.210" Score="5" Body="&lt;p&gt;Source address filtering is nontrivial in the real world, because Internet routing is asymmetric, so in principle we need an educated guess whether a packet from this source is likely to appear on this incoming interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no easy formula for that, because for every rule that works for almost all cases, there is also a use case that makes business sense that would break then.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reverse path filtering works great on edge routers, where there is a clear definition of &quot;inside&quot; and &quot;outside&quot; -- you do not allow outsiders to use &quot;inside&quot; addresses and vice versa. It gets more complicated as soon as I start using multiple edge routers for redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For backbone routers, the only way reverse path filtering could be implemented is to allow incoming packets when the peer announces a working route (regardless of whether it would be our preference). That would be a prohibitively long lookup, easily circumvented and breaks the use case where I deliberately buy transit but do not announce my prefix down that link.&lt;/p&gt;&#xA;" OwnerUserId="2069" LastActivityDate="2013-07-16T13:08:13.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2371" PostTypeId="2" ParentId="2365" CreationDate="2013-07-16T13:19:33.503" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does it mean that if I save this line to configuration &lt;code&gt;license boot level ipbase | entservices&lt;/code&gt;, I will have working perpetual Enterprise License but with some warnings in syslog?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You will get the entservices features for free &quot;today&quot;, as long as you're willing to ignore the syslog messages.  At some IOS in the future, they might start enforcing licensing levels, so just don't depend on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially you're taking a calculated risk by not planning to buy the licenses today.  Perhaps just a scare tactic by Cisco to increase their revenue, but I am seeing a general trend by Cisco to enforce more restrictions around what you can use / download from CCO without a valid license.  If it was me, I'd just ask your boss to get the licenses you need...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI... &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps4324/white_paper_c11-685524.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;License State: Active, Not in Use, EULA not accepted&lt;/code&gt;&lt;/a&gt; means you aren't really using the entservices features anyway because you haven't accepted the entservices EULA.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-10-17T15:03:23.823" LastActivityDate="2013-10-17T15:03:23.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2373" PostTypeId="1" AcceptedAnswerId="2375" CreationDate="2013-07-16T17:38:41.133" Score="8" ViewCount="2292" Body="&lt;p&gt;Within Wireshark, how would one write a display filter for the IP address of the Link State ID within an OSPF Database Description packet? The Link State ID addresses are found within the LSA Header of the DB Description packet. &lt;/p&gt;&#xA;" OwnerUserId="1453" LastEditorUserId="1453" LastEditDate="2013-07-16T19:35:08.070" LastActivityDate="2013-07-17T02:47:09.563" Title="Wireshark Filter - OSPF Database Description Link State ID" Tags="|ipv4|ospf|wireshark|packet-analysis|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2374" PostTypeId="2" ParentId="2364" CreationDate="2013-07-16T18:55:47.303" Score="2" Body="&lt;p&gt;I've run into this problem before and there's a couple things happening in this scenario.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, The Management interface does not play by the same rules as other interfaces on the FW.  By default it will not pass or receive traffic from any other interface on the device due to the &quot;Management-Only&quot; setting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, the way that Cisco implements the Management interface causes a routing loop with the ASA.  You would like to route all traffic to the management network through the L3 switch on the Inside, but the ASA sees the Management network as directly connected via the Management interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would like the traffic to take the following path:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPS &gt; L3 Switch &gt; ASA Inside &gt; Internet &gt; ASA Outside &gt; L3 Switch &gt; IPS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the path it is actually taking looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPS &gt; L3 Switch &gt; ASA Inside &gt; Internet &gt; ASA Outside &gt; Bit Bucket&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any packet sent from the IPS to the internet is returned to the ASA Outside interface, at which point the routing table is checked and it sees that the management network is directly connected via the Management interface.  Since the Management interface will not receive traffic from another interface by default, the bits hit the floor.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the best way to resolve this issue is to abandon using the Management interface to manage the firewall and instead use the Inside interface.  If you remove the IP address of the Management interface (but still keep the port enabled for the IPS module), that will remove the Management network from the ASA routing table.  This will allow the traffic to take the correct path back to the L3 switch on the Inside when it returns from the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps&lt;/p&gt;&#xA;" OwnerUserId="2071" LastActivityDate="2013-07-16T18:55:47.303" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2375" PostTypeId="2" ParentId="2373" CreationDate="2013-07-16T19:08:26.103" Score="7" Body="&lt;p&gt;&lt;strong&gt;Display Filter by advertising Router-ID&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;This display filter will get you close as I can come up with...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ospf.msg.dbdesc == 1 and ospf contains &amp;lt;adv-router-id-as-hex&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For instance, if your advertising router is 1.1.1.1...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ospf.msg.dbdesc == 1 and ospf contains 01.01.01.01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However, the problem is that &lt;code&gt;contains 01.01.01.01&lt;/code&gt; matches any string contents with 01.01.01.01, so both 01.01.01.01 or 01.01.01.01.ff could match... furthermore, it's possible that some other packet in the DBD also contains a reference to that router-id.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Display Filter by advertising Link-State ID&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;This is a little easier, because there is a better chance to find a unique string; as long as you know the type of LSA you're looking for.  The &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#appendix-A.4.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSPF RFC&lt;/a&gt; requires the packet to get sent with &lt;code&gt;&amp;lt;lsa-type-4bits&amp;gt;.&amp;lt;link-id-4bytes&amp;gt;&lt;/code&gt;, so the display filter is:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ospf.msg.dbdesc == 1 and ospf contains &amp;lt;lsa-type&amp;gt;.&amp;lt;link-id&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For example, the display filter to find a Network Summary LSA (LSA Type 3) with the ID of 10.4.27.0 (hex 0a.04.1b.00):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ospf.msg.dbdesc == 1 and ospf contains 03.0a.04.1b.00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Another example, the display filter to find an External LSA (LSA Type 5) with the ID of 10.4.27.0 (hex 0a.04.1b.00):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ospf.msg.dbdesc == 1 and ospf contains 05.0a.04.1b.00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;FYI, these are the &lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_advertisement#Types&quot; rel=&quot;nofollow noreferrer&quot;&gt;numbers corresponding to the LSA types&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-07-17T02:47:09.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2376" PostTypeId="1" CreationDate="2013-07-16T22:18:13.177" Score="6" ViewCount="317" Body="&lt;p&gt;a client currently has a /23 PI space where the route-object is currently managed by ISP-A &#xA; we want to split the PI space into two /24's but not certain on how best to go about this.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ISP-A will use the 1st /24 for legacy internet services&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ISP-B will break the currently unused /24 out of the parent /23 route object to provide new more cost effective internet services.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;how is this done ? does the client make a request to ISP-A (the current route maintainer mtn-by)  , which in turn then makes the request to the Registrar&#xA;which then either creates two new /24 route objects or just delegates ISP-B mnt-lower access to enable them to advertise the prefix.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What do the below field mean in relevance to my question &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;aut-num:  &lt;/li&gt;&#xA;  &lt;li&gt;mnt-lower:   &lt;/li&gt;&#xA;  &lt;li&gt;mnt-routes:  &lt;/li&gt;&#xA;  &lt;li&gt;mnt-by&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="1092" LastEditDate="2013-07-18T11:46:35.680" LastActivityDate="2013-07-18T11:46:35.680" Title="/23 PI space - breakup" Tags="|routing|ipv4|subnet|routing-registry|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2377" PostTypeId="2" ParentId="1720" CreationDate="2013-07-16T22:49:52.467" Score="0" Body="&lt;p&gt;I had a similar issue at work and my solution was to configure the VM to use NAT instead of bridged mode. The host machine will receive the actual IP address and then when the VM is spun up it tries to request a separate IP but the source MAC is the same. Switching the VM to NAT solved our problems.&lt;/p&gt;&#xA;" OwnerUserId="2073" LastActivityDate="2013-07-16T22:49:52.467" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2378" PostTypeId="2" ParentId="2376" CreationDate="2013-07-17T00:41:22.637" Score="2" Body="&lt;p&gt;I use 2 ISPs and my agreement with them is they will not take less than a /24 so I can divide my address space any way I want as long as my prefixes are long than /24, so I don't think you need (or want to change the registration) just advertise 1 /24 to ISP A and the other to ISP B. Now the ISPs may be filtering only on the prefix you expect to send so you need to check with the ISPs on their route policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this assumes that you really own the /23 space directly form the registry not from a ISP.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-07-17T00:41:22.637" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2379" PostTypeId="1" AcceptedAnswerId="2384" CreationDate="2013-07-17T05:54:15.973" Score="11" ViewCount="23367" Body="&lt;p&gt;My ISP says that it can provide an optic fiber connection with a pool of 4 static IP addresses (subnet &lt;code&gt;255.255.255.248&lt;/code&gt; i think).&lt;br/&gt;&#xA;My question is that if I get that connection,&lt;br/&gt;&#xA;1 ip will be used for network&lt;br/&gt;&#xA;1 for default gateway&lt;br/&gt;&#xA;1 for broadcast.&lt;br/&gt;&#xA;So I will get only 1 usable ip address, while other internet plan have only 1 static ip address and cost less. So what is the benefit of pool of 4 ip?&lt;br/&gt;&#xA;&lt;br/&gt;&#xA;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;netmask would be &lt;code&gt;255.255.255.252&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="2074" LastEditorUserId="8499" LastEditDate="2018-03-19T19:07:24.800" LastActivityDate="2020-07-12T15:53:26.740" Title="Using IP addresses from IP pool given by ISP" Tags="|router|ipv4|nat|subnet|ip-address|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2380" PostTypeId="1" AcceptedAnswerId="2382" CreationDate="2013-07-17T06:18:34.970" Score="11" ViewCount="9416" Body="&lt;p&gt;This is more of a cosmetic issue however it does bug me....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I removed the sub-interfaces off a 3845 router by issuing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no int fast1/0.10&#xA;no int fast1/0.15&#xA;default int fast1/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I do a &lt;code&gt;show run&lt;/code&gt;....the subinterfaces are no longer there. However, a &lt;code&gt;show ip int br&lt;/code&gt; has them listed as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#sh ip int br&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;FastEthernet1/0            unassigned      YES manual down                  down &#xA;FastEthernet1/0.13         unassigned      YES NVRAM  deleted               down&#xA;FastEthernet1/0.30         unassigned      YES NVRAM  deleted               down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I remove them from NVRAM without a reboot?&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-07-17T06:43:54.190" Title="How do you get rid of deleted sub-interfaces from NVRAM?" Tags="|cisco|cisco-ios-12|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2381" PostTypeId="2" ParentId="2379" CreationDate="2013-07-17T06:27:17.907" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;subnet 255.255.255.248&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;which gives you 8 addresses, 1 for network, 1 for broadcast, 1 for default gateway =&gt; you can use up to 5 addresses. Sometimes (mostly in datacenter environment) more addresses are reserved for FHRP.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;example:&#xA;8.8.8.0/29,&#xA;8.8.8.0 is network address, &#xA;8.8.8.7 is broadcast address&#xA;8.8.8.6 is default gateway address&#xA;you can use 8.8.8.[1-5] as host ip addresses. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If, however, your ISP gives you a subnet with 4 addresses at all, which is /30 (netmask 255.255.255.252), you can still use one address as host address (the rest are broadcast, network, and default gateway addresses). This option gives you no advantage over &quot;other internet plan&quot; speaking in terms of address count.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR: subnet 255.255.255.248 gives you up to 5 usable ip addresses, subnet 255.255.255.252 gives you one.&lt;/p&gt;&#xA;" OwnerUserId="1893" LastActivityDate="2013-07-17T06:27:17.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2382" PostTypeId="2" ParentId="2380" CreationDate="2013-07-17T06:43:54.190" Score="14" Body="&lt;p&gt;&lt;code&gt;reload&lt;/code&gt; is the only way to purge them.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-07-17T06:43:54.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2383" PostTypeId="2" ParentId="2379" CreationDate="2013-07-17T06:45:34.293" Score="2" Body="&lt;p&gt;Normally a /30 is used for 2 addresses. That is correct. However on firewalls this is often again divided in /32's so you can use them seperately. It's like an ISP gets a range from it's provider (ex: RIPE) and then divides these adresses via subnetting to their customers. The same principle can be applied to this /30 by yourself.&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-07-17T06:45:34.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2384" PostTypeId="2" ParentId="2379" CreationDate="2013-07-17T06:59:35.910" Score="12" Body="&lt;p&gt;This depends on exactly how the ISP provides them to you.  You may have &quot;4 DHCP addresses&quot;, a  &quot;routed&quot; /30, or a &quot;connected&quot; /29.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, Time Warner Cable (business class) allows 4 devices to use DHCP to get an address. (similar to residential service that's limited to one)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;routed&quot; is what you'd see where you have a WAN side and LAN side. This is the traditional &quot;lease line&quot; model where the T1/DS3/etc. ISP side has an independent address to which the static address block is routed; from there they can be assigned as a LAN or NAT'd individually (the firewall situation Bulki mentions.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;connected&quot; would be where the ISP provides your LAN (i.e. a data center, or the &quot;routed&quot; example where you don't control the router)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-07-17T06:59:35.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2385" PostTypeId="2" ParentId="2376" CreationDate="2013-07-17T08:28:00.013" Score="2" Body="&lt;p&gt;Which RIR is the PI space from?  In RIPE-land, a PI resource can currently only be used by the organisation it is assigned to, for their own purposes. &quot;Sub-assignments&quot; are not allowed. For other registries, the policies may differ somewhat.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-07-17T08:28:00.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2386" PostTypeId="1" CreationDate="2013-07-17T09:45:26.767" Score="6" ViewCount="1269" Body="&lt;p&gt;There is threat-detection mechanism is CISCO ASA. We can configure different rate limits and actions. Also our ASA 5525-X has enabled integrated IPS module. We can setup protection rules on IPS. What is the best practise of security implementation: threat-detection or IPS, or both?&lt;/p&gt;&#xA;" OwnerUserId="904" LastActivityDate="2013-07-18T06:39:01.733" Title="CISCO ASA: threat-detection vs. IPS module" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2387" PostTypeId="1" CreationDate="2013-07-17T10:46:07.483" Score="12" ViewCount="1533" Body="&lt;p&gt;I have been searching for this for a while and haven't found one yet.  I need a Cisco IOS command to send a syslog message or snmp trap whenever an interface that has a CDP neighbor goes down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some people have told me just rely on routing protocol neighbor drops, but that isn't really good enough.  I have routers that are connected via static, switches, and wireless controllers. All of those devices don't run a routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a command to enable CDP syslog?  I have searched for this for a while and it seems like such a basic need that Cisco would have already built something for it.&lt;/p&gt;&#xA;" OwnerUserId="2077" LastActivityDate="2013-07-17T11:06:58.750" Title="Syslog message for CDP interface down" Tags="|cisco|cdp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2389" PostTypeId="2" ParentId="2387" CreationDate="2013-07-17T11:05:22.030" Score="4" Body="&lt;p&gt;You ask about interface going down, this is easily satisfied by SNMP trap:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server enable traps snmp linkdown&#xA;snmp-server host 192.0.2.1 version 2c foo &#xA;interface NoCDP&#xA; no snmp trap link-status&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you'd get trap from all other interfaces going down, except for 'NoCDP' interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I think you actually don't care about interfaces going up/down, you care about CDP neighbors disappearing, for that you'd need to use EEM. EEM can match CDP event and can do plethora of actions based on event, such as syslog.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a starting point, you could use this &lt;a href=&quot;http://wang-it.blogspot.fi/2012/05/eem-cdp-to-monitor-connected-devices-up.html&quot; rel=&quot;nofollow&quot;&gt;script&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-07-17T11:05:22.030" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2390" PostTypeId="2" ParentId="2387" CreationDate="2013-07-17T11:06:58.750" Score="6" Body="&lt;p&gt;The &quot;event neighbor discovery&quot; command will generate syslog messages based on CDP events.  It has to be used in conjunction with EEM, but it's pretty simple to set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/netmgmt/command/reference/nm_06.html#wp1181238&quot;&gt;http://www.cisco.com/en/US/docs/ios/netmgmt/command/reference/nm_06.html#wp1181238&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I don't think that these events occur as quickly as you are hoping they will.  CDP is not a protocol designed for keepalives, it's for neighbor discovery.  You'd probably be better off logging against link status changes (up/down) or setting up IP SLA probes to monitor the presence of a device.&lt;/p&gt;&#xA;" OwnerUserId="2065" LastActivityDate="2013-07-17T11:06:58.750" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2391" PostTypeId="1" CreationDate="2013-07-17T11:26:14.430" Score="16" ViewCount="11184" Body="&lt;p&gt;on Cisco (this command is hidden for some reason)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#bgp bestpath as-path multipath-relax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The default BGP behavior only installs only routes with exact the same AS_PATH into RIB. With multipath-relax, the AS_PATH only needs to be of the same length. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What problems can it potentially cause? Why isn't is used more often?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a transit provider, does this feature complicate troubleshooting (I am thinking about end-user complaints about network performance)? Does it make it more difficult to know the path specific traffic took at a given time? Is there something else to that can assist troubleshooting. I am not sure about scalability and cost for NetFlow in SP network.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2013-07-19T05:04:57.023" LastActivityDate="2013-07-22T06:11:26.190" Title="BGP multipath with different ASNs feasible for production networks?" Tags="|cisco|routing|router|bgp|ecmp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2392" PostTypeId="2" ParentId="2391" CreationDate="2013-07-17T11:32:40.597" Score="16" Body="&lt;p&gt;&lt;code&gt;bgp bestpath as-path multipath-relax&lt;/code&gt; was introduced by CSCea19918.  Normally eBGP load-balancing requires the candidate routes to be equal-cost paths; i.e. identical BGP attributes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;same Weight&lt;/li&gt;&#xA;&lt;li&gt;same Local-Pref&lt;/li&gt;&#xA;&lt;li&gt;same AS-Path (both the AS numbers, and the AS path length)&lt;/li&gt;&#xA;&lt;li&gt;same Origin&lt;/li&gt;&#xA;&lt;li&gt;same MED&lt;/li&gt;&#xA;&lt;li&gt;different next-hop&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you mentioned, this command relaxes the same AS-Path requirement so any candidate eBGP AS-Path with the same AS-path length could be used for eBGP load-balancing (this will not load-balance between eBGP and iBGP paths).  If you run BGP between multiple ISPs and you are looking for better egress load-balancing between your upstream connections this may help you out.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What problems can it potentially cause?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There isn't much danger as long as you're an enterprise customer that doesn't give transit service to another ASN; &lt;strike&gt;for a transit provider it might be perfectly safe, but I can't be sure there aren't routing loops if a transit ASN uses this feature&lt;/strike&gt;.  At first, I thought there would easily be a loop in transit ASN cases, on more reflection I can't find a real problem.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why will it is rarely used?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Good question, it's been around since at least 2005.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-18T08:47:13.810" LastActivityDate="2013-07-18T08:47:13.810" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2393" PostTypeId="1" CreationDate="2013-07-17T12:28:20.463" Score="6" ViewCount="747" Body="&lt;p&gt;What I have got set up are my Cisco switches send SNMP traps to my intermapper server. I did that so I could see who is logging in or trying to log in. That part is working. What I need to do is create a probe, then I can set up notifications and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SNMP trap looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SNMPv2-SMI::enterprises.9.9.41.2 (1) { &quot;SEC_LOGIN&quot;, &quot;5&quot;, &quot;LOGIN_FAILED&quot;, &quot;Login failed [user: admin] [Source: 10.1.1.45] [localport: 22] [Reason: Login Authentication Failed] at 22:39:45 MDT Tue Jul 16 2013&quot;, &quot;902084201&quot; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I am trying to accomplish is the availability to notify me when someone logs into the switches. Since I am the only one who logs into them it would be nice to see if someone try to log in or actually logs in.&lt;/p&gt;&#xA;" OwnerUserId="2080" LastEditorUserId="2080" LastEditDate="2013-07-17T12:50:14.353" LastActivityDate="2013-09-03T08:16:21.753" Title="Intermapper SNMP trap probe" Tags="|cisco|snmp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2394" PostTypeId="2" ParentId="2376" CreationDate="2013-07-17T12:48:27.057" Score="1" Body="&lt;p&gt;Pragmatically speaking, nothing needs to be done at the RIR, you just announce the /24 from whereeveand you're done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good practice, on the other hand dictates that you should create a new &lt;code&gt;route&lt;/code&gt; object for this /24 at the RIR that specifies the origin AS etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the ISP is the maintainer of the object, it's their responsibility to do that.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-07-17T12:48:27.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2395" PostTypeId="2" ParentId="2305" CreationDate="2013-07-17T14:35:23.897" Score="1" Body="&lt;p&gt;Port 1 should have VLAN 14 tagged. Port 4 should belong to the VLAN 14 group but have VLAN 14 untagged as the workstation does not have a concept of VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Netgear switch configuration select 802.11Q, not port based. It is a little more complex, but you need it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can have as many VLANs as you need on each port, but only one (called the PVID) can be untagged. Set port 1's PVID as 1, but have it joined to both VLANs 1 and 14. Set port 4's PVID as 14, and only join it to VLAN 14. All other ports are VLAN 1 PVID 1&lt;/p&gt;&#xA;" OwnerUserId="1772" LastActivityDate="2013-07-17T14:35:23.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2396" PostTypeId="1" CreationDate="2013-06-21T13:39:51.693" Score="4" ViewCount="542" Body="&lt;p&gt;simple question. I am trying to allow traffic from NetworkA to NetworkB through and old PIX firewall. The firewall has a leg into each NetworkA+B.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nameif ethernet1 inside security 100&#xA;nameif ethernet2 dmz security 20&#xA;&#xA;ip address inside 192.168.1.1 255.255.255.0&#xA;ip address dmz 192.168.254.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to allow an IP &lt;strong&gt;192.168.254.50 to connect to 192.168.1.10 over port 14333&lt;/strong&gt;. After researching, I was told that I need to make a static statement for each direction and use conduit command as well...Correct me if I am wrong..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static (dmz,inside) 192.168.1.0 192.168.254.0 netmask 255.255.255.0 0 0 &#xA;conduit permit tcp host 192.168.254.50 host 192.168.1.10 eq 1433&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have only done Cisco Firewall rules via access-lists and access-groups. However I am limited to this method due to the version of our PIX.&lt;/p&gt;&#xA;" OwnerUserId="3528" OwnerDisplayName="Jim" LastActivityDate="2013-07-17T21:26:11.580" Title="Allow Network to Network traffic for specific port, Cisco PIX v6.2" Tags="|firewall|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2397" PostTypeId="2" ParentId="2301" CreationDate="2013-07-17T20:19:39.173" Score="0" Body="&lt;p&gt;CDN activity is an interesting question and one I see coming up more and more. I was delivering a training course earlier in a London (UK) university on network monitoring techniques and one of the biggest consumers of bandwidth on their 1Gb Internet connection was CDN services. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently published a blog post on the subject which you can access from &lt;a href=&quot;http://packetpushers.net/cdn-activity-and-what-it-means-for-network-monitoring/&quot; rel=&quot;nofollow&quot;&gt;this link.&lt;/a&gt; For me the only way to work out what is happening is by focusing on HTTP headers and DNS traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some info from the blog post&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Network monitoring tools will run into problems if they start reporting on this activity based on the ownership of IP addresses alone. Most of the bandwidth consumption will be associated with the CDN sites and not the sites which the users are visiting to access the content. This becomes problematic for network administrators who may need to implement changes to manage this bandwidth consumption. If they block or throttle the CDN sites then they will restrict access to thousands of other services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution to the problem is to look beyond layer 3 analysis and monitor HTTP headers and DNS queries. This data is normally sourced via packet capture with an application which can do deep packet inspection&quot;&lt;/p&gt;&#xA;" OwnerUserId="2085" LastEditorUserId="2085" LastEditDate="2015-05-28T07:01:51.470" LastActivityDate="2015-05-28T07:01:51.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2398" PostTypeId="2" ParentId="2396" CreationDate="2013-07-17T21:26:11.580" Score="3" Body="&lt;p&gt;I can't say for certain with 6.2 as I'm only familiar with 6.3+ but this is how you would usually do it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list dmz-in permit tcp host 192.168.254.50 host 192.168.1.10 eq 1433&#xA;access-group dmz-in in interface dmz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will basically put an access-list on the DMZ interface and allow the traffic that you have mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be aware that if you don't already have one applied that when you put an access-group on an interface it changes the traffic behaviours of existing traffic and you will need to add these to the same ACL.&lt;/p&gt;&#xA;" OwnerUserId="240" LastActivityDate="2013-07-17T21:26:11.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2399" PostTypeId="2" ParentId="2386" CreationDate="2013-07-18T05:19:02.850" Score="0" Body="&lt;p&gt;Threat-detection is just gathering statistics (with possibility to shun attacker's ip).&lt;/p&gt;&#xA;" OwnerUserId="2090" LastActivityDate="2013-07-18T05:19:02.850" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2400" PostTypeId="2" ParentId="2386" CreationDate="2013-07-18T06:39:01.733" Score="1" Body="&lt;p&gt;Whenever possible I would go for IPS module, it s one of the best security products available on the market. As long as you have the license just fine tune it and use it accordingly to your needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For any other scenarios when IPS not available, threat-statistics will prove helpful.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-07-18T06:39:01.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2401" PostTypeId="2" ParentId="2393" CreationDate="2013-07-18T07:02:52.457" Score="5" Body="&lt;p&gt;If all you need is login notification and if you don't care about SNMP vs Syslog, you can use IOS built-in syslog for authentication failures and success.  It also can block IP addresses with failed logins.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;login block-for 300 attempts 5 within 60&#xA;login on-failure log&#xA;login on-success log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the message for success&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jul 18 06:55:26.408: %SEC_LOGIN-5-LOGIN_SUCCESS: Login Success [user: cisco]&#xA; [Source: 10.10.1.5] [localport: 23] at 06:55:26 UTC Thu Jul 18 2013&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the message for a telnet failure&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jul 18 06:56:16.963: %SEC_LOGIN-4-LOGIN_FAILED: Login failed [user: ] &#xA; [Source: 10.10.1.5] [localport: 23] [Reason: Login Authentication Failed] at 06:56:16 UTC &#xA; Thu Jul 18 2013&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2092" LastActivityDate="2013-07-18T07:02:52.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2402" PostTypeId="1" AcceptedAnswerId="2407" CreationDate="2013-07-18T09:31:07.573" Score="7" ViewCount="862" Body="&lt;p&gt;I'm wondering if is possible to configure a Cisco Router 881 from a file on a tftp instruct on a DHCP option. I know is possible to configure the wan port through DHCP by configuring &quot;ip address dhcp&quot; but what I search is there is a way to act as an Cable Modem CPE, dowload the configuration file from the DHCP and load it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;on the DHCP I've configure the following option as it will be for a CPE  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;filename &quot;tftp://172.16.0.1/conf&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;warning&lt;/strong&gt; I'm not asking how to configure DHCP server on Cisco Router. &lt;/p&gt;&#xA;" OwnerUserId="206" LastActivityDate="2018-04-26T16:03:42.900" Title="Is possible to configure a Cisco 881 by DHCP?" Tags="|cisco|dhcp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2403" PostTypeId="1" AcceptedAnswerId="2406" CreationDate="2013-07-18T09:35:57.690" Score="5" ViewCount="657" Body="&lt;p&gt;I am testing a new 5GHz 6db patch antenna with an 80 degree spread in the horizontal direction and a 30 degree spread in the vertical direction.  The antenna has a marking with 'top' on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My company has some very long rooms (40 meters long and 10 meters wide) that are full of tall machinery.  I want to mount the antenna over the door that faces the long dimension and point the antenna down to shine over the machinery.  I am thinking about rotating the antenna so the 80 degree spread covers the 40 meter span, but that means I'm rotating the antenna on the side by 90 degrees.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some people &lt;a href=&quot;http://www.unwiredadventures.com/unwire/2006/11/rf_interference.html&quot; rel=&quot;nofollow&quot;&gt;endorse rotating antennas&lt;/a&gt;.  However, I also see &lt;a href=&quot;http://www.theruckusroom.net/2011/06/a-polarizing-problem.html&quot; rel=&quot;nofollow&quot;&gt;talk that rotating the antenna like this is very inefficient&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;in a linearly polarized system, a misalignment of polarization of 45 degrees can degrade the signal up to 3dB and if misaligned and 90 degrees the attenuation can be more than 20dB.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I want the 80 degree cone aligned with the room's long dimension.  Is it a bad idea to mount the 'top' of the antenna on it's side? &lt;/p&gt;&#xA;" OwnerUserId="2096" LastEditorUserId="775" LastEditDate="2013-07-18T11:15:05.273" LastActivityDate="2013-07-18T11:15:05.273" Title="Wireless antenna polarization" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2406" PostTypeId="2" ParentId="2403" CreationDate="2013-07-18T11:13:50.173" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I want the 80 degree cone aligned with the room's long dimension. Is it a bad idea to mount the 'top' of the antenna on it's side?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Misaligned antenna polarization will affect the received signal strength.  You need to consider how your clients' antennas are aligned and shoot for matching that as closely as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Antenna alignment gets kindof complicated because mobile clients like hand-held barcode scanners don't always keep their antennas aligned the same way; people often rotate the scanner to get a good barcode scan, and in the process change the scan gun's antenna plane.  Tablets / iPads have similar problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should also to check the manufacturer's specs for how the antenna is polarized.  We are using a &lt;a href=&quot;http://www.terra-wave.com/shop/80211n-245-ghz-1011-dbi-mimo-panel-antenna-with-nstyle-jack-connector-p-2575.html&quot; rel=&quot;nofollow&quot;&gt;dual polarized antenna&lt;/a&gt; that is both vertically and horizontally polarized, so you can mount it either way; however, that same manufacturer makes a &lt;a href=&quot;http://www.terra-wave.com/shop/files/products/antennasb/multiband-antennas/245-ghz-antennas/245-ghz-patch--panel-antennas/2.4_5%20GHz%206%20dBi%20MIMO%20Quad%20Patch%20Antenna_M6060060MP1D43602.pdf&quot; rel=&quot;nofollow&quot;&gt;single polarized antenna&lt;/a&gt; that would suffer if you rotated it.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-07-18T11:13:50.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2407" PostTypeId="2" ParentId="2402" CreationDate="2013-07-18T11:33:23.837" Score="5" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;is there is a way to act as an Cable Modem CPE, download the configuration file from the DHCP [Option 67] and load it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You are asking about &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/configfun/configuration/guide/fcf002.html&quot; rel=&quot;noreferrer&quot;&gt;Autoinstall&lt;/a&gt; in Cisco IOS:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router (with blank NVRAM) pulls an address from DHCP&lt;/li&gt;&#xA;&lt;li&gt;Router uses DHCP Options 3, 6, 66, 67, and 150 to reconfigure itself via TFTP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I also found a pretty good &lt;a href=&quot;http://enotepad.wordpress.com/2008/08/06/auto-install-over-frame-relay/&quot; rel=&quot;noreferrer&quot;&gt;blog post on autoinstall&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If you're looking for a tool to perform Autoinstall, check out &lt;a href=&quot;https://github.com/PackeTsar/freeztp&quot; rel=&quot;noreferrer&quot;&gt;freeztp&lt;/a&gt;; it's written in Python and uses a series of commands to set up configurable templates for IOS routers and switches.&lt;/p&gt;&#xA;&lt;p&gt;Thank you for asking about this feature, I completely forgot it existed.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-04-26T16:03:42.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2408" PostTypeId="1" AcceptedAnswerId="2412" CreationDate="2013-07-18T12:03:46.920" Score="5" ViewCount="7836" Body="&lt;p&gt;I have the following lab topology and I am using the below configuration on the 1841. What I want to achieve here is reserve 1000Kbps of bandwidth for traffic between the voice VLAN and the remote VoIP provider across the Internet (lets pretend; 10 users, each needs 100Kbps of up and down bandwidth for RTP, and they all always use the phone at the same time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bvTKg.png&quot; alt=&quot;QoS topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The pfSense device is just to limit the wan connection of the 1841 as this will go on the end of a 20Mbps Internet connection presented as Ethernet eventually. It plays no further role in this scenario (no NAT, or Firewalling, just plain L3 routing between LAN and WAN interfaces, limiting the traffic).&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any CM-VOICE-TRAFFIC&#xA; match access-group 145&#xA;&#xA;policy-map PM-PRIORITISE-VOICE&#xA; class CM-VOICE-TRAFFIC&#xA;   bandwidth 1000&#xA; class class-default&#xA;   fair-queue&#xA;&#xA;interface FastEthernet0/1&#xA; service-policy output PM-PRIORITISE-VOICE&#xA;&#xA;access-list 145 permit ip any 10.0.59.0 0.0.0.255&#xA;access-list 145 permit ip 10.0.59.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The configuration I have given is only applied outbound on the WAN interface (so I have guaranteed 1000Kbps of traffic to the voice VLAN for their upstream path towards the VoIP provider). What can I do to guarantee the downstream bandwidth of the voice VLAN on this 1841 only?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to create an inbound policy on fa0/1 (WAN) that prioritises packets that match access-list 145, as they pass through the router, so that other packets inbound on WAN don't affect the downstream speed of the voice VLAN (peraps queuing packets that don't match ACL-145)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is it possible to create a policy on the physical fa0/0 interface, even though it is split into two sub interfaces, that will guarantee 1000Kbps of the traffic out of it, towards the voice VLAN, when it needs it?&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-07-18T16:31:34.730" Title="QoS voice traffic on WAN of Cisco 1841" Tags="|cisco|qos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2409" PostTypeId="1" AcceptedAnswerId="2426" CreationDate="2013-07-18T12:25:09.897" Score="8" ViewCount="5119" Body="&lt;p&gt;I have an ASA running 9.0(1) with four security contexts.  When we modify a context, our standard procedure is to do a &quot;write mem&quot; inside that context.  But sometimes we have to modify all the contexts in the same change window.  Can we just do a &quot;write mem&quot; from the system context and save all the context configs at once?&lt;/p&gt;&#xA;" OwnerUserId="2068" LastActivityDate="2013-07-19T17:12:16.163" Title="ASA in multiple context: save config" Tags="|cisco|cisco-asa|firewall|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2410" PostTypeId="2" ParentId="2409" CreationDate="2013-07-18T13:34:15.437" Score="3" Body="&lt;p&gt;According to the &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/ha_contexts.html&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt; from Cisco it says &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The running configuration that you edit in a configuration mode, or that is used in the &lt;strong&gt;copy&lt;/strong&gt; or &lt;strong&gt;write&lt;/strong&gt; commands, depends on your location. When you are in the system execution space, the running configuration consists only of the system configuration; when you are in a context, the running configuration consists only of that context. For example, you cannot view all running configurations (system plus all contexts) by entering the &lt;strong&gt;show running-config&lt;/strong&gt; command. Only the current configuration displays.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It appears that you need to be in the context to write the changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; The &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/intro_start.html#wp1334476&quot; rel=&quot;nofollow&quot;&gt;getting started&lt;/a&gt; documentation does tell you how to save multiple contexts at the same time by using &lt;strong&gt;write memory all&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="9" LastEditorUserId="9" LastEditDate="2013-07-19T17:12:16.163" LastActivityDate="2013-07-19T17:12:16.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2412" PostTypeId="2" ParentId="2408" CreationDate="2013-07-18T15:32:51.930" Score="5" Body="&lt;p&gt;The short answer is no.  Your queuing policy needs to be&#xA;applied outbound at the point of bottleneck.  In this case, the bottleneck is&#xA;the WAN connection (20 Mbps) between the pfSense and the 1841.  Thus, the&#xA;proper location of your queuing policies are outbound on the LAN interface (a bit of a misnomer) of the pfSense and outbound on &lt;code&gt;Fa0/01&lt;/code&gt; of the 1841, which you have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All that being said, your policy on the 1841 is flawed.  In your example, you've reserved 1 Mbps of bandwidth for VoIP and applied the policy to a 100 Mbps interface.  What happens when the PCs start pushing 70Mbps of traffic while trying to make a VoIP call?  From a queuing standpoint on the 1841, the answer is nothing.  There is only 70 Mbps of data flowing out Fa0/1.  Therefore, there is always 1 Mbps available for VoIP.  However, once&#xA;this traffic reaches the pfSense,  at least 50 Mbps of data and VoIP will be dropped.  Your calls would be terrible at best.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without getting into all of the details, and using your&#xA;prior example, the policy should be something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any CM-VOICE-TRAFFIC&#xA; match access-group 145&#xA;!&#xA;policy-map PM-PRIORITISE-VOICE-child&#xA; class CM-VOICE-TRAFFIC&#xA;   set ip dscp ef&#xA;   priority 1000&#xA; class class-default&#xA;   fair-queue&#xA;!&#xA;policy-map Shape-20Mb-parent&#xA; class class-default&#xA;  shape average 20000000&#xA;  service-policy PM-PRIORITISE-VOICE-child&#xA;!&#xA;interface FastEthernet0/1&#xA; service-policy output Shape-20Mb-parent&#xA;!&#xA;access-list 145 permit ip 10.0.59.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This policy creates an artificial bandwidth limit on all traffic leaving the Fa0/1 on the 1841.  Thus, the pfSense will never have the opportunity to drop traffic indiscriminately.  Also, instead of the bandwidth command, the priority command should be used to limit latency and jitter.  The tagging and the ACL change should be self-explanatory.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastEditorUserId="775" LastEditDate="2013-07-18T16:31:34.730" LastActivityDate="2013-07-18T16:31:34.730" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2415" PostTypeId="1" AcceptedAnswerId="2463" CreationDate="2013-07-18T17:32:54.470" Score="3" ViewCount="1690" Body="&lt;p&gt;I am making a paper about the different congestion avoidance protocols of TCP and one of them is the TCP Vegas. I have searched a lot on internet about how it's work but I have some questions. If I am not wrong, the algorithm should be like follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Modified slow-start&#xA;When ???? change to congestion avoidance phase&#xA;if there are no duplicated ACKS&#xA;   if it is the first or second one after retransmission then check the timeout and retransmit&#xA;   if Diff &amp;lt; alpha then congestion window size++&#xA;   if Diff &amp;gt; beta then congestion window size--&#xA;if duplicated ACK is received&#xA;   if time-out for this segment&#xA;      retransmit&#xA;      // any reduction of the window???&#xA;if ACK time-out&#xA;   retransmit&#xA;   congestion window size = 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have 3 questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The change of the modified slow-start is that the window is increased every &lt;strong&gt;other&lt;/strong&gt; RTT (like I found in a lot of papers), but what is the meaning of &lt;strong&gt;other&lt;/strong&gt; RTT?&lt;/li&gt;&#xA;&lt;li&gt;When the algorithm change to the lineal growth phase (or congestion avoidance phase)?&lt;/li&gt;&#xA;&lt;li&gt;And, there is any reduction of the window when a duplicated ACK is received?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1991" LastEditorUserId="1991" LastEditDate="2013-07-19T11:25:52.880" LastActivityDate="2015-02-06T11:21:06.470" Title="TCP Vegas algorithm description" Tags="|tcp|congestion|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2416" PostTypeId="1" AcceptedAnswerId="2418" CreationDate="2013-07-18T17:42:59.130" Score="2" ViewCount="7340" Body="&lt;p&gt;I have received the Cisco Prime OVA file and which we placed onto an Oracle virtual environment. We turn the VM on and the CLI boots, When we try to start the NCS service we get errors.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HOSTNAME/USER# ncs start&#xA;&#xA;Starting Network Control System...&#xA;&#xA;Exception in thread &quot;main&quot; java.lang.NullPointerException&#xA;        at com.cisco.wnbu.udi.impl.UDIManager.isPhysicalAppliance(UDIManager.java:184)&#xA;        at com.cisco.packaging.WCSAdmin.start(WCSAdmin.java:335)&#xA;        at com.cisco.packaging.WCSAdmin.runMain(WCSAdmin.java:281)&#xA;        at com.cisco.packaging.WCSAdmin.main(WCSAdmin.java:901)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Logs &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HOSTNAME/USER# show logging   &#xA;    07/18/13 10:25:38.878 INFO  [system] [main] Setting management interface address to 192.168.0.10&#xA;    07/18/13 10:25:38.884 INFO  [system] [main] Setting peer server interface address to 192.168.0.10&#xA;    07/18/13 10:25:38.884 INFO  [system] [main] Setting client interface address to 192.168.0.10&#xA;    07/18/13 10:25:38.884 INFO  [system] [main] Setting local host name to HOSTNAME&#xA;    07/18/13 10:25:40.341 ERROR [system] [main] THROW&#xA;    java.sql.SQLRecoverableException: IO Error: The Network Adapter could not establish the connection&#xA;            at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:419)&#xA;            at oracle.jdbc.driver.PhysicalConnection.&amp;lt;init&amp;gt;(PhysicalConnection.java:536)&#xA;            at oracle.jdbc.driver.T4CConnection.&amp;lt;init&amp;gt;(T4CConnection.java:228)&#xA;            at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:32)&#xA;            at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:521)&#xA;            at java.sql.DriverManager.getConnection(Unknown Source)&#xA;            at java.sql.DriverManager.getConnection(Unknown Source)&#xA;            at com.cisco.server.persistence.util.OracleSchemaUtil.openConnection(OracleSchemaUtil.java:277)&#xA;            at com.cisco.server.persistence.util.OracleSchemaUtil.dbServerUp(OracleSchemaUtil.java:836)&#xA;            at com.cisco.packaging.DBAdmin.dbServerUp(DBAdmin.java:1429)&#xA;            at com.cisco.packaging.WCSAdmin.status(WCSAdmin.java:833)&#xA;            at com.cisco.packaging.WCSAdmin.status(WCSAdmin.java:757)&#xA;            at com.cisco.packaging.WCSAdmin.wcsServerUp(WCSAdmin.java:637)&#xA;            at com.cisco.packaging.WCSAdmin.start(WCSAdmin.java:294)&#xA;            at com.cisco.packaging.WCSAdmin.runMain(WCSAdmin.java:281)&#xA;            at com.cisco.packaging.WCSAdmin.main(WCSAdmin.java:901)&#xA;    Caused by: oracle.net.ns.NetException: The Network Adapter could not establish the connection&#xA;            at oracle.net.nt.ConnStrategy.execute(ConnStrategy.java:375)&#xA;            at oracle.net.resolver.AddrResolution.resolveAndExecute(AddrResolution.java:422)&#xA;            at oracle.net.ns.NSProtocol.establishConnection(NSProtocol.java:678)&#xA;            at oracle.net.ns.NSProtocol.connect(NSProtocol.java:238)&#xA;            at oracle.jdbc.driver.T4CConnection.connect(T4CConnection.java:1054)&#xA;            at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:308)&#xA;            ... 15 more&#xA;    Caused by: java.net.ConnectException: Connection refused&#xA;            at java.net.PlainSocketImpl.socketConnect(Native Method)&#xA;            at java.net.PlainSocketImpl.doConnect(Unknown Source)&#xA;            at java.net.PlainSocketImpl.connectToAddress(Unknown Source)&#xA;            at java.net.PlainSocketImpl.connect(Unknown Source)&#xA;            at java.net.SocksSocketImpl.connect(Unknown Source)&#xA;            at java.net.Socket.connect(Unknown Source)&#xA;            at oracle.net.nt.TcpNTAdapter.connect(TcpNTAdapter.java:209)&#xA;            at oracle.net.nt.ConnOption.connect(ConnOption.java:123)&#xA;            at oracle.net.nt.ConnStrategy.execute(ConnStrategy.java:353)&#xA;            ... 20 more&#xA;    07/18/13 10:25:40.347 INFO  [admin] [main]&#xA;    07/18/13 10:25:40.347 INFO  [admin] [main] Starting Network Control System...&#xA;    07/18/13 10:25:40.347 INFO  [admin] [main]&#xA;    07/18/13 10:25:40.394 ERROR [admin] [main] Problem using CARS API:&#xA;    com.cisco.cars.fnd.CARSException: CARS_FAILURE : -999 : Failed to get UDI configuration. : Failure occurred during request&#xA;            at com.cisco.cars.fnd.CARSException.analyzeReturnCode(CARSException.java:118)&#xA;            at com.cisco.cars.serviceEngine.impl.EngineAdminServiceImpl.getUDI(EngineAdminServiceImpl.java:66)&#xA;            at com.cisco.wnbu.udi.impl.UDIManager.generateUDI(UDIManager.java:69)&#xA;            at com.cisco.wnbu.udi.impl.UDIManager.setPersistenceDirectory(UDIManager.java:139)&#xA;            at com.cisco.packaging.WCSAdmin.start(WCSAdmin.java:332)&#xA;            at com.cisco.packaging.WCSAdmin.runMain(WCSAdmin.java:281)&#xA;            at com.cisco.packaging.WCSAdmin.main(WCSAdmin.java:901)&#xA;    07/18/13 10:25:40.396 ERROR [admin] [main] Problem using CARS API:&#xA;    com.cisco.cars.fnd.CARSException: CARS_FAILURE : -999 : Failed to get UDI configuration. : Failure occurred during request&#xA;            at com.cisco.cars.fnd.CARSException.analyzeReturnCode(CARSException.java:118)&#xA;            at com.cisco.cars.serviceEngine.impl.EngineAdminServiceImpl.getUDI(EngineAdminServiceImpl.java:66)&#xA;            at com.cisco.wnbu.udi.impl.UDIManager.generateUDI(UDIManager.java:69)&#xA;            at com.cisco.wnbu.udi.impl.UDIManager.setVirtualPID(UDIManager.java:169)&#xA;            at com.cisco.packaging.WCSAdmin.start(WCSAdmin.java:333)&#xA;            at com.cisco.packaging.WCSAdmin.runMain(WCSAdmin.java:281)&#xA;            at com.cisco.packaging.WCSAdmin.main(WCSAdmin.java:901)&#xA;    07/18/13 10:25:40.397 ERROR [admin] [main] Problem using CARS API:&#xA;    com.cisco.cars.fnd.CARSException: CARS_FAILURE : -999 : Failed to get UDI configuration. : Failure occurred during request&#xA;            at com.cisco.cars.fnd.CARSException.analyzeReturnCode(CARSException.java:118)&#xA;            at com.cisco.cars.serviceEngine.impl.EngineAdminServiceImpl.getUDI(EngineAdminServiceImpl.java:66)&#xA;            at com.cisco.wnbu.udi.impl.UDIManager.generateUDI(UDIManager.java:69)&#xA;            at com.cisco.wnbu.udi.impl.UDIManager.setPhysicalPID(UDIManager.java:154)&#xA;            at com.cisco.packaging.WCSAdmin.start(WCSAdmin.java:334)&#xA;            at com.cisco.packaging.WCSAdmin.runMain(WCSAdmin.java:281)&#xA;            at com.cisco.packaging.WCSAdmin.main(WCSAdmin.java:901)&#xA;    07/18/13 10:25:40.397 ERROR [admin] [main] Problem using CARS API:&#xA;    com.cisco.cars.fnd.CARSException: CARS_FAILURE : -999 : Failed to get UDI configuration. : Failure occurred during request&#xA;            at com.cisco.cars.fnd.CARSException.analyzeReturnCode(CARSException.java:118)&#xA;            at com.cisco.cars.serviceEngine.impl.EngineAdminServiceImpl.getUDI(EngineAdminServiceImpl.java:66)&#xA;            at com.cisco.wnbu.udi.impl.UDIManager.generateUDI(UDIManager.java:69)&#xA;            at com.cisco.wnbu.udi.impl.UDIManager.getUDI(UDIManager.java:112)&#xA;            at com.cisco.wnbu.udi.impl.UDIManager.isPhysicalAppliance(UDIManager.java:184)&#xA;            at com.cisco.packaging.WCSAdmin.start(WCSAdmin.java:335)&#xA;            at com.cisco.packaging.WCSAdmin.runMain(WCSAdmin.java:281)&#xA;            at com.cisco.packaging.WCSAdmin.main(WCSAdmin.java:901)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any Help is appreciated&lt;/p&gt;&#xA;" OwnerUserId="2106" LastEditorUserId="775" LastEditDate="2013-07-18T17:45:02.050" LastActivityDate="2013-07-18T19:18:43.433" Title="Cisco Prime NCS not starting" Tags="|cisco|monitoring|nms|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2417" PostTypeId="1" AcceptedAnswerId="2419" CreationDate="2013-07-18T19:09:57.890" Score="4" ViewCount="826" Body="&lt;p&gt;At the Cisco 4500 Chassis model comparison page it says the Supervisor 7E is &quot;Hardware Ready&quot; for SDN.  It was released in late 2011.  URL for that page can be found here:  &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_models_comparison.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/products/hw/switches/ps4324/prod_models_comparison.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All info I could find on the Cisco 4500-X doesn't mention anything about being hardware ready for Cisco ONE/SDN.  It was however released after Supervisor 7E and from what I've read it's based largely on the Supervisor 7E.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone found information confirming whether the Cisco 4500-X is hardware ready for SDN and will have Cisco ONE support in the future?  It would be nice if there was a page that clearly summarized which switch models are &quot;Hardware Ready&quot; and will support OnePK over the next few years.&lt;/p&gt;&#xA;" OwnerUserId="2107" LastActivityDate="2013-07-18T22:30:31.930" Title="Will the Cisco 4500-X have OnePK/SDN Support?" Tags="|cisco|cisco-4500|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2418" PostTypeId="2" ParentId="2416" CreationDate="2013-07-18T19:18:43.433" Score="3" Body="&lt;p&gt;Prime/NCS is only supported on Vmware ESX 4.x and 5.X.&#xA;see &#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/ncs/1.1/release/notes/NCS_RN1.1.html#wp167866&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/wireless/ncs/1.1/release/notes/NCS_RN1.1.html#wp167866&lt;/a&gt;&#xA;&lt;br&gt;and &#xA;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps6504/ps6528/ps12239/data_sheet_c78-715144.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps6504/ps6528/ps12239/data_sheet_c78-715144.html&lt;/a&gt;&lt;br&gt;&#xA;for more details.&lt;/p&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-18T19:18:43.433" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2419" PostTypeId="2" ParentId="2417" CreationDate="2013-07-18T22:30:31.930" Score="4" Body="&lt;p&gt;SDN is a bit of an umbrella term that could mean a lot of things. To say something is &quot;hardware ready for SDN&quot; sounds like some marketing at best. They could be referring to OpenFlow which would have some specific hardware requirements. Cisco's onePK is mostly dependent on support within the IOS/NX-OS image, so there's a good chance it will find its way into all platforms, eventually. Until onePK goes into general release, it's hard to say definitively. &lt;/p&gt;&#xA;" OwnerUserId="460" LastActivityDate="2013-07-18T22:30:31.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2420" PostTypeId="1" CreationDate="2013-07-19T05:26:02.807" Score="8" ViewCount="2831" Body="&lt;p&gt;What are the causes of duplex mismatch other than misconfiguration? (power outage? improper cabling? auto negotiation implementation bugs?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts on discovering duplex mismatch? NetMRI seems to use interface error rate. Is it sufficient to just poll all interface error rates on switches/servers? What if this feature is not available on a device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Drivers can definitely cause problems with duplex. I have seen Broadcom NIC stuck in half-duplex on FreeBSD.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2013-07-19T10:23:42.813" LastActivityDate="2016-04-22T14:16:04.503" Title="discover duplex mismatch interfaces in the network" Tags="|duplex|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2421" PostTypeId="1" CreationDate="2013-07-19T06:07:00.117" Score="4" ViewCount="10405" Body="&lt;p&gt;I have this error on a Cisco router running IOS version 12.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This coincide with an error received on our alarming system saying that on this router we have an interface with &quot;line protocol down&quot;. The interface seems to be admin down, but I don't know why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are these 2 issues related? I don't see any other alarm at that time on the router.&#xA;Can an interface be admin down without someone doing &lt;code&gt;shutdown&lt;/code&gt; command on the interface? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router#show logging&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;Jul 19 01:00:07.863 EDT: %RMON-5-FALLINGTRAP: Falling trap is generated because the value of ifOperStatus.8 has fallen below the falling-threshold value 1&#xA;Jul 19 01:00:12.863 EDT: %RMON-5-RISINGTRAP: Rising trap is generated because the value of ifOperStatus.8 exceeded the rising-threshold value 2&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router#show interfaces Gi1/8&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GigabitEthernet1/8 is administratively down, line protocol is down (disabled)&#xA;  Hardware is C7600 1Gb 802.3...&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know the interface shows &quot;shutdown, but from what I know nobody did this. Strange! &quot; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show running-config interface Gi1/8&#xA;Building configuration... &#xA;Current configuration : 250 bytes ! &#xA;interface GigabitEthernet1/8 &#xA;description Connection to Firewall switchport &#xA;switchport access vlan 2 &#xA;switchport mode access &#xA;logging event link-status &#xA;load-interval 30 &#xA;shutdown &#xA;spanning-tree portfast &#xA;spanning-tree bpduguard enable &#xA;end &#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The interface seems to be admin down, but I don't know why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are these 2 issues related? I don't se&lt;/p&gt;&#xA;" OwnerUserId="2053" LastEditorUserId="267" LastEditDate="2013-08-01T17:11:17.400" LastActivityDate="2013-08-01T17:11:17.400" Title="Line protocol is down on Cisco Router / IOS 12.2" Tags="|cisco|cisco-ios|snmp|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2422" PostTypeId="2" ParentId="2421" CreationDate="2013-07-19T06:30:45.190" Score="3" Body="&lt;p&gt;As a general rule, interfaces won't be &quot;admin down&quot; unless someone &quot;shut&quot; them.  I've forgotten how they show up when errdisable kills a port -- but that would be on a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at &lt;code&gt;show run int gi1/8&lt;/code&gt; to see what it's current configured state is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[edit] Based on the current running interface configuration, &lt;em&gt;someone&lt;/em&gt; intentionally shut it down.  This could be done via CLI, web interface, or SNMP.  How and by whom is not something the internet at large can answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(also, you can (should) edit your question to add what you've provided here as comments)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-07-19T19:36:41.950" LastActivityDate="2013-07-19T19:36:41.950" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2423" PostTypeId="2" ParentId="2420" CreationDate="2013-07-19T06:44:35.697" Score="16" Body="&lt;p&gt;By far the most common issue would be misconfiguration. Some people still hold on to old beliefs that auto negotation does not work reliably.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have different vendors there can be issues but I don't see it very often. I would much rather rely on auto negotiation as my first solution and if that fails fall back to hard coding it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is quite common to see ports operating in 100/half because if one side has auto and other side has 100/full then the speed can be detected but the duplex must be assumed to be half because it can't be negotiated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your NMS should be able to detect this but you could do a script that logins and does:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh int status | i half&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And reports back all interfaces running in half duplex. This would only work for switches. For routers you would need something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh interfaces | i Fast|Giga|half&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you would need to parse it in some way. It's probably nicer to use SNMP though. Browsing Ciscos SNMP page &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=portDuplex&quot;&gt;SNMP Object Navigator&lt;/a&gt; indicates that you should be able to use OID 1.3.6.1.4.1.9.5.1.4.1.1.10 which is PortDuplex.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-07-19T06:44:35.697" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2424" PostTypeId="2" ParentId="2420" CreationDate="2013-07-19T10:03:22.800" Score="2" Body="&lt;p&gt;One of the symptoms of a duplex mismatch is late collisions. Having your NMS alert you on these collisions is a good way of finding them. At least some Cisco models/IOS versions can send SNMP traps for these collisions.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-07-19T10:03:22.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2425" PostTypeId="2" ParentId="2301" CreationDate="2013-07-19T10:47:49.843" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I was wondering if certain CDN clients might be assigned certain IP addresses within the CDN block -- I thought that someone else might have come up with a lookup table or a database for sale, but I can't find anything like that by googling, so maybe that is not a viable approach.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Usually this kind of data (ip address distribution between projects) is internal, so trying to achieve it will lead you to the grey area at best, with all the consequences.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I currently only have easy access to the IP address that flows are going to. With that data, is dis-aggregating this CDN traffic further impossible? If I know it is not possible I will stop looking.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think you need to go deeper in L7 headers (particularly, HTTP and DNS) and somehow correlate it to URLs of the websites serving data through CDN. So, no, there's not much can be done having only IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="1893" LastActivityDate="2013-07-19T10:47:49.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2426" PostTypeId="2" ParentId="2409" CreationDate="2013-07-19T11:02:11.437" Score="7" Body="&lt;p&gt;You can do a write mem all:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Saving All Context Configurations at the Same Time&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To save all context configurations at the same time, as well as the&#xA;  system configuration, enter the following command in the system&#xA;  execution space:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Command Purpose write memory all [/noconfirm] Example: hostname# write&#xA;  memory all /noconfirm Saves the running configuration to the startup&#xA;  configuration for all contexts and the system configuration.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If you do not enter the /noconfirm keyword, you see the following&#xA;  prompt:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Are you sure [Y/N]: After you enter Y, the ASA saves the system&#xA;  configuration and each context. Context startup configurations can&#xA;  reside on external servers. In this case, the ASA saves the&#xA;  configuration back to the server you identified in the context URL,&#xA;  except for an HTTP or HTTPS URL, which do not let you save the&#xA;  configuration to the server.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/intro_start.html&quot;&gt;http://www.cisco.com/en/US/docs/security/asa/asa90/configuration/guide/intro_start.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-07-19T11:02:11.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2427" PostTypeId="1" AcceptedAnswerId="2454" CreationDate="2013-07-19T12:39:05.373" Score="9" ViewCount="2491" Body="&lt;p&gt;(First of all, I'm sorry for this wall of text. I don't know how to make it any shorter without losing important information. I originally wanted to use the chat room for this, like we do on serverfault for these kind of questions, but there is nobody in the network engineering room).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're a corporation with several daughter companies, where we have a rather large managed IP-VPN with about 70 different locations, varying from 2Mbps SHDSL to 100Mbps fiber. The IP-VPN carries multiple VPNs (or tunnels to be exact).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The priority of traffic is this, from a management and design standpoint:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;VoIP (Avaya and Lync)&lt;/li&gt;&#xA;&lt;li&gt;Video (Lync)&lt;/li&gt;&#xA;&lt;li&gt;RDP&lt;/li&gt;&#xA;&lt;li&gt;Internal services (fileservers, Active Directory, intranet etc)&lt;/li&gt;&#xA;&lt;li&gt;Non-prioritized internal services (proxy servers for internet usage, windows update services, system center configuration management, antivirus update proxies etc)&lt;/li&gt;&#xA;&lt;li&gt;The not matched traffic (internet)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;VoIP is only used at certain offices, where there is a low amount of users. The biggest remote office that use VoIP right now has a 4mbps SHDSL with 5 employees and 5 avaya IP phones running the G.711 ALAW 64K codec. This should never bring the voip data traffic up to more than 320kbps.&#xA;I've verified that the phones use DSCP 46 for audio, and it's therefore correctly matched as EF (see config below). The signaling however is matched as DSCP 24, which I'm not sure if our QoS profile picks up..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All remote locations use RDP against several RDS farms at our HQ (2x100Mbit fiber). The bandwidth used for RDP is not so easy to figure out, since it basically uses everything it gets. We do have certain limitations set to make sure that it's not too resource hungry, but that is probably out of scope for this site. We do have some rather severe problems with RDP lately (&lt;a href=&quot;https://serverfault.com/questions/515809/mouse-cursor-jumps-around-when-using-rdp&quot;&gt;https://serverfault.com/questions/515809/mouse-cursor-jumps-around-when-using-rdp&lt;/a&gt;), which is why I'm posting this on network engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lync uses DSCP 46 for audio and DSCP 34 for video. Internal services and non-prioritized internal services are just matched by subnets, and everything else is just match any.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a copy of the latest QoS config revision, which I have modified slightly to hide certain names and IP addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;class-map match-any INTERNAL-PRI&#xA; match access-group name CUST-INT-PRI&#xA; match access-group name CUST-DMZ&#xA;class-map match-any INTERNAL-NOPRI&#xA; match access-group name CUST-INT-NOPRI&#xA;class-map match-any REMOTEDESKTOP&#xA; match access-group name RDP&#xA;class-map match-any ALL&#xA; match any&#xA;class-map match-any NETWORK&#xA; match ip precedence 6&#xA; match ip precedence 7&#xA;class-map match-any EF&#xA; match ip dscp ef&#xA; match ip dscp cs5&#xA;class-map match-any AF-HIGH&#xA; match ip dscp af41&#xA; match ip dscp cs4&#xA;class-map match-any AF-MEDHI&#xA; match ip dscp af31&#xA; match ip dscp cs3&#xA;class-map match-any AF-MEDIUM&#xA; match ip dscp af21&#xA; match ip dscp cs2&#xA;class-map match-any AF-LOW&#xA; match ip dscp af11&#xA; match ip dscp cs1&#xA;class-map match-any BE&#xA; match ip dscp default&#xA;!&#xA;!&#xA;policy-map setTos&#xA; class EF&#xA; class REMOTEDESKTOP&#xA;  set ip dscp af31&#xA; class INTERNAL-PRI&#xA;  set ip dscp af21&#xA; class INTERNAL-NONPRI&#xA;  set ip dscp af11&#xA; class class-default&#xA;  set ip dscp default&#xA;policy-map useTos&#xA; class EF&#xA;  priority percent 10&#xA; class AF-HIGH&#xA;  bandwidth remaining percent 35&#xA; class AF-MEDHI&#xA;  bandwidth remaining percent 25&#xA; class AF-LOW&#xA;  bandwidth remaining percent 20&#xA; class BE&#xA;  bandwidth remaining percent 10&#xA; class NETWORK&#xA;policy-map QOS&#xA; class ALL&#xA;  shape average 4096000&#xA;  service-policy useTos&#xA;!&#xA;!         &#xA;ip access-list standard CUST-DMZ&#xA; permit 123.123.123.0 0.0.0.255&#xA;!&#xA;ip access-list standard CUST-INT-PRI&#xA; permit 10.50.0.0 0.0.0.255&#xA; permit 10.51.0.0 0.0.0.255&#xA;!&#xA;ip access-list standard CUST-INT-NOPRI&#xA; permit 10.50.10.0 0.0.0.255&#xA; permit 10.51.10.0 0.0.0.255&#xA;!&#xA;ip access-list extended RDP&#xA; permit tcp any eq 3389 any&#xA; permit tcp any any eq 3389&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, it's a rather large QoS configuration. Note that we did not create this config our selves, it was all done by a previous employee at our IP-VPN provider. Note also that the shape value is changed according to what kind of connection it is (2mbps, 4mbps, 8mbps and 10mbps).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By now you're probably wondering - What's the question here? Here goes..&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Like I mentioned earlier, we are drowning in complaints from RDP users about lag/user input not being recognized. Are we not prioritizing it correctly? Is it possible to make sure that RDP gets a minimum amount of packet loss, latency and jitter, but still being restricted in bandwith?&lt;/li&gt;&#xA;&lt;li&gt;I'm not seeing any mention of queues in this config. I've read some Microsoft documentation, and they recommend to use priority queue on VoIP and WRED on video. How do I make this happen?&lt;/li&gt;&#xA;&lt;li&gt;As the config shows, none of the AF classings use medium or high drop. What kind of services are safe to drop? RDP, video and voip does not work well with drops..&lt;/li&gt;&#xA;&lt;li&gt;Are the bandwith percentages in order? It sums up to 100% usage&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any other suggestion(s) are welcome, as I'm desperate to get this sorted out. If you think it's too much to answer on a Q&amp;amp;A site I'll just bite the dust and hire a consultant from our Cisco Gold partner, which is financially OK - I just want to learn this if I can.&lt;/p&gt;&#xA;" OwnerUserId="122" LastEditorDisplayName="user36472" LastEditDate="2019-02-25T11:57:14.127" LastActivityDate="2019-02-25T11:57:14.127" Title="QoS woes - managed IP VPN" Tags="|cisco|qos|avaya|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2429" PostTypeId="1" AcceptedAnswerId="2431" CreationDate="2013-07-19T17:59:11.423" Score="3" ViewCount="92" Body="&lt;p&gt;One vendor wanted to install their VPN device (Cisco 800) behind the firewall. They asked us to open ports so they can establish the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another vendor wanted to install their VPN device (Cisco 1921) outside the firewall, but physically attached to our network. They would then be routed into our network through the gateway. (Is this even possible? This is a secondary question that doesn't have to be answered here)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, which is more secure?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the pro/con of each configuration?&lt;/p&gt;&#xA;" OwnerUserId="13" LastActivityDate="2013-07-19T18:21:13.150" Title="3rd Party VPN Device Security" Tags="|cisco|security|vpn|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2430" PostTypeId="2" ParentId="2427" CreationDate="2013-07-19T18:19:33.163" Score="7" Body="&lt;p&gt;The first thing that jumps out at me is that you appear to be shaping everything to 4 Mbps. I imagine that the rate changes on routers/sites with different circuit speeds, but you generally want to avoid shaping when dealing with latency-sensitive applications like VoIP and RDP as it can cause excessive buffering and jitter during periods of congestion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the &lt;code&gt;bandwidth remaining percent&lt;/code&gt; command is a bit tricky: Each instance actually allocates n% of the remaining available bandwidth, not n% of the total. This graphic from &lt;a href=&quot;http://ardenpackeer.com/tutorials/qos-voip/tutorial-what-is-the-difference-between-bandwidth-percent-and-bandwidth-remaining-percent/&quot; rel=&quot;nofollow noreferrer&quot;&gt;an article by Arden Packeer&lt;/a&gt; should help illustrate the idea:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6rmbY.gif&quot; alt=&quot;&amp;#39;Bandwidth&amp;#39; vs &amp;#39;bandwidth remaining&amp;#39;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's important to note that any classifications you define need to match what your WAN provider supports. Most providers offer only a handful of pre-configured QoS profiles from which you must choose which best suits your needs. You can classify however you'd like on incoming traffic at the WAN edge, but the provider's QoS controls are what control the the treatment of traffic during transit across the WAN.&lt;/p&gt;&#xA;" OwnerUserId="5" LastEditorUserId="5" LastEditDate="2013-07-20T01:10:12.940" LastActivityDate="2013-07-20T01:10:12.940" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2431" PostTypeId="2" ParentId="2429" CreationDate="2013-07-19T18:21:13.150" Score="2" Body="&lt;p&gt;for an ipsec tunnel i believe you need to allow the following traffic between endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip protocol 50&#xA;ip protocol 51&#xA;udp 500&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the second option sounds like their 1921 will have to be in the outside ip space of your firewall.  they will terminate their traffic to the 1921 and your layer 3 protocols will take over from there.&lt;/p&gt;&#xA;" OwnerUserId="352" LastActivityDate="2013-07-19T18:21:13.150" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2432" PostTypeId="1" AcceptedAnswerId="2433" CreationDate="2013-07-19T18:34:04.250" Score="10" ViewCount="6480" Body="&lt;p&gt;I am working on a Cisco L3 switch where most of SVIs are having &lt;code&gt;ip helper-address&lt;/code&gt; configured for DHCP relay but also a couple of DHCP pools have been configured in the switch itself to serve dynamic addresses to a couple of VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm planning some changes where I would like to disable only one of the DHCP pools in the switch. So far, I have read about the following options related to disabling DHCP in IOS:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Adding &lt;code&gt;no service dhcp&lt;/code&gt; in global config: not suitable for my scenario, as it would disable all DHCP relay and all DHCP pools. &lt;/li&gt;&#xA;&lt;li&gt;Deleting configuration for the pool to be disabled: this would work in my scenario but I would like to keep the pool configuration in running config, just in case I need to rollback the change. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So my question is: for an IOS based device, is there a way  to disable a single DHCP pool while keeping the pool configuration in running config? Something like &lt;code&gt;shutdown&lt;/code&gt; for an interface? &lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2017-04-25T17:05:21.197" Title="Is it possible to disable a single DHCP pool in IOS?" Tags="|cisco|cisco-ios|dhcp|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2433" PostTypeId="2" ParentId="2432" CreationDate="2013-07-19T18:43:19.133" Score="14" Body="&lt;p&gt;Well, one way to do this would be to exclude the entire pool from assignment. This would leave the configuration of the pool in there and you would just remove the exclusion if you wanted it to assign addresses again.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address &amp;lt;first address&amp;gt; &amp;lt;last address&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I would just archive a copy of the config and remove the pool.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-07-19T18:43:19.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2434" PostTypeId="2" ParentId="2432" CreationDate="2013-07-19T18:48:24.877" Score="4" Body="&lt;p&gt;You could create dummy VRF and associate the pool to that VRF. Not exactly clean solution, but seems to satisfy your requirement.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf NO_DHCP&#xA;  rd 1:1&#xA;!&#xA;ip dhcp pool foo&#xA;  vrf NO_DHCP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-07-19T18:48:24.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2435" PostTypeId="2" ParentId="2432" CreationDate="2013-07-19T18:59:25.227" Score="1" Body="&lt;p&gt;It's not quite what you wanted, but you could also remove the &lt;i&gt;'network ...'&lt;/i&gt; statement from the pool.&lt;/p&gt;&#xA;" OwnerUserId="1894" LastEditorUserId="76" LastEditDate="2013-07-23T19:48:39.133" LastActivityDate="2013-07-23T19:48:39.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2436" PostTypeId="1" AcceptedAnswerId="2733" CreationDate="2013-07-19T22:19:42.460" Score="4" ViewCount="7924" Body="&lt;p&gt;I have a 5515X 9.1.2 configured with AnyConnect 3.1.04059. I have successfully configured it to accept RSA secureID tokens by means of using the PIN+TokenCode. Now I simply want to enable it so Windows users can just enter their PIN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have already:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Enabled &lt;code&gt;proxy-auth SDI&lt;/code&gt; in the tunnel-group (same as &quot;Enable the display of SecurID messages&quot; from ASDM)&lt;/li&gt;&#xA;&lt;li&gt;Enabled &lt;code&gt;SoftwareToken&lt;/code&gt; in the Anyconnect profile which gives me a prompt of &quot;PIN:&quot; when attempting the connection.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Upon entering my PIN only, the RSA server is giving this error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Bad tokencode, but good PIN detected for token serial number “0001162345211323” assigned to user “suser” in security domain “SystemDomain” from “Microsoft AD - MYDOM” identity source&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;At this point I'm thinking that the new AnyConnect software doesn't know how to interact with RSAs stauto32.dll to get the token code. However I don't know how to troubleshoot that.&lt;/p&gt;&#xA;" OwnerUserId="949" LastEditorUserId="-1" LastEditDate="2013-07-21T07:32:54.200" LastActivityDate="2014-11-13T06:36:54.897" Title="Trouble configuring AnyConnect to use a RSA token PIN only for authentication" Tags="|cisco|cisco-asa|cisco-anyconnect|authentication|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2437" PostTypeId="1" AcceptedAnswerId="2447" CreationDate="2013-07-19T22:30:37.510" Score="6" ViewCount="1271" Body="&lt;p&gt;We have Ciscoworks AKA Cisco Prime LMS version 4.2.2. We also have some multi context firewalls. Is LMS capable of going into the admin context of the firewall and backing up all of the configs from the other contexts? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or more simply, whats the solution to backup the config of the system context of a multi context firewall?&lt;/p&gt;&#xA;" OwnerUserId="949" LastEditorUserId="-1" LastEditDate="2013-07-21T07:33:02.513" LastActivityDate="2013-07-30T19:32:27.787" Title="Backing up configs from a multi context firewall to Ciscoworks LMS Prime" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2438" PostTypeId="1" CreationDate="2013-07-20T09:45:04.380" Score="2" ViewCount="3999" Body="&lt;p&gt;I am a bit lost. I'm trying to find the physical interface speed that is negotiated on a Gigabit interface on a Cisco 2900 and 3900 series ISR G2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a switch, I am used to giving &lt;code&gt;sh interfaces status&lt;/code&gt; which gives the speed, and wether it is fixed or negotiated. However, this command is only usable on switch ports, and so it is not available on L3 interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The show interface only gives me the info that the speed is set to &quot;auto&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Where can I find what speed is negotiated?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="209" LastEditorUserId="49" LastEditDate="2013-07-22T19:16:24.000" LastActivityDate="2013-07-22T19:16:24.000" Title="Find negotiated speed on Cisco router" Tags="|cisco|speed|interface|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2439" PostTypeId="2" ParentId="2438" CreationDate="2013-07-20T10:00:39.313" Score="7" Body="&lt;p&gt;The command &lt;code&gt;show interface&lt;/code&gt; should be showing you the information you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show ver | i 29&#xA;Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.3(2)T, RELEASE SOFTWARE (fc3)&#xA;&#xA;router#show int | i Giga.*up|Duplex&#xA;GigabitEthernet0/0 is up, line protocol is up&#xA;  Full Duplex, 100Mbps, media type is RJ45&#xA;GigabitEthernet1/0 is up, line protocol is up&#xA;  Full Duplex, 1Gbps, media type is internal&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-07-20T10:00:39.313" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2440" PostTypeId="1" AcceptedAnswerId="2441" CreationDate="2013-07-20T16:15:25.123" Score="1" ViewCount="4076" Body="&lt;p&gt;I am just learning on a 2948G managed switch. I have 48 ports and I would like to divide those up into 4 networks with 12 ports each. I don't want them to be able to communicate between networks at all as a security measure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I have a lot of questions and I have tried to read and understand these on my own. I have put the more important questions at the top if you can answer any of them I would appreciate it!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to understand the difference between VLAN and trunking and etherchannel and which one would do what I am trying to do above. It sounds like VLAN might be it, but isn't that about the same as just letting the connected devices assign static IPs in the same range? Or does setting it up as a VLAN ensure that none of the devices try to change their IP to connect to another port in another subnet that I don't want it to access?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does trunking in effect connect those separate networks? For instance, if network A has ports 1-12 and network B 13-24, would port 3 and 18 still be able to communicate with trunking on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I'm not sure if there are specific groups of ports that would make traffic move more smoothly. Eg) is there one central hub in the back of the switch that all data going form port 1-&gt;2 and also 1-&gt;48 will pass through? Or can 1 communicate with 2 without interfering with data from 47 to 48? Or when the ports are all in module 1, does that mean the module itself has a central hub that all data will pass through?&lt;/p&gt;&#xA;" OwnerUserId="2126" LastEditorUserId="343" LastEditDate="2013-07-22T01:48:17.623" LastActivityDate="2017-03-23T23:39:40.753" Title="vlan/trunk/etherchannel differences in cisco switch (noob lots of q's)" Tags="|cisco-catalyst|vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2441" PostTypeId="2" ParentId="2440" CreationDate="2013-07-20T17:12:20.307" Score="7" Body="&lt;p&gt;What you are trying to achieve is done with VLANs. A VLAN is basically a logical L2 domain so two hosts on the same VLAN will be able to communicate without a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trunking basically means 'allow more than one VLAN on the same port'. You can do that to allow a host to be able to connect to different VLANs using the same port or for interswitch communications. If you have two switches you will want to connect them with a trunk so the hosts in VLAN A on SW1 can communicate with hosts in VLAN A on SW2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Etherchannel is used to aggregate two ports into one logical port adding the bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the architecture of this specific hardware I am not sure. Usually ports are connected by groups. Ports 1-8 belong to the same ASIC, so port 2 to get to port 9 (which is in a different ASIC) will have to go through the backplane. However, from port 1 to port 2 you do not need to get to the backplane. However, this is very platform specific so read the switch architecture to be sure about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards.&lt;/p&gt;&#xA;" OwnerUserId="2079" LastEditorUserId="30228" LastEditDate="2017-03-23T23:39:40.753" LastActivityDate="2017-03-23T23:39:40.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2442" PostTypeId="2" ParentId="2440" CreationDate="2013-07-20T20:12:02.117" Score="0" Body="&lt;p&gt;Vlans will allow you to have 4 networks that do not talk to each other without (usually) going though a L3 devices. You need 1 IP address space per VLAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a single connection to the L3 device you use trunking, that allows the 4 vlans to use a single wire (don't forget you need to reserve an uplink port for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Etherchannel allows multiple links to look like 1 link to spanning tree, so if 1 link fails traffic just flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to internal hardware, does not matter in 99% of the cases on low end hardware, there are some platforms that only allow etherchannels on the same parts of the switch.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-07-20T20:12:02.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2443" PostTypeId="1" AcceptedAnswerId="2444" CreationDate="2013-07-20T22:45:35.023" Score="5" ViewCount="2397" Body="&lt;p&gt;Is it possible to combine a 4500E with a 4500X into a VSS pair or do they have to be the same model to pair up? If it requires same model, is it due to hardware or software? For example if it is something in software maybe in the future the two different models could be paired up.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-07-21T00:07:49.637" Title="4500E / 4500X VSS pairing" Tags="|cisco|cisco-catalyst|vss|cisco-4500|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2444" PostTypeId="2" ParentId="2443" CreationDate="2013-07-20T23:09:57.823" Score="3" Body="&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: After further research, my original answer is not exactly accurate.  It looks like Cisco TAC would like you to use the same hardware, but I believe it is not a requirement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps9336/prod_qas0900aecd806ed74b.html&quot; rel=&quot;nofollow&quot;&gt;6500 VSS FAQ&lt;/a&gt;, which was indicated to also apply to the 4500 series.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q. How many Cisco Catalyst 6500 Series Switches can be part of a VSS?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A. The VSS1440 will allow up to two physical Cisco Catalyst 6500 Series Switches to operate as a VSS. The two physical chassis does not need to be identical in the type of modules installed or even type of chassis. For example, a WS-C6503-E chassis can be combined with a WS-C6513 chassis to form a VSS.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I stick by the rule of thumb though, from discussion with Cisco and other people in the last few years, using identical hardware tends to result in a better VSS experience.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Original Answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches should be the same model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A 4500E should only form a VSS pair with another 4500E, and likewise for the 4500X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best rule of thumb for making VSS function properly:&#xA;&lt;em&gt;Use Identical Hardware&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've heard anecdotal evidence that VSS can be forced to work in other configurations (that is to say, it may be allowed via software), but I doubt Cisco TAC would support them.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For more in-depth detail, see this doc from the &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-29472&quot; rel=&quot;nofollow&quot;&gt;Cisco Support Communities&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-07-20T23:17:04.507" LastActivityDate="2013-07-20T23:17:04.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2445" PostTypeId="2" ParentId="2443" CreationDate="2013-07-21T00:07:49.637" Score="1" Body="&lt;p&gt;Though you can have the same supervisor in each switch, the key requirement for VSS is that both chassis have the same number or slots. In this case the fixed 4500X and modular 4500E will not, and cannot be put in a pair.&#xA;Hardware requirements can be found here:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1.2/XE_340/configuration/guide/vss.html#wp1053927&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1.2/XE_340/configuration/guide/vss.html#wp1053927&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-21T00:07:49.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2447" PostTypeId="2" ParentId="2437" CreationDate="2013-07-21T12:46:54.777" Score="5" Body="&lt;p&gt;Unfortunately, you have to back up each context individually by configuring it as it's own &quot;device&quot; in CiscoWorks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has been requested to add capabilities to backup from the admin context, but it isn't available at this time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See this &lt;a href=&quot;http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&amp;amp;bugId=CSCsl65838&quot; rel=&quot;nofollow&quot;&gt;bug/enhancement request&lt;/a&gt; (CCO login required).&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-07-21T13:11:28.463" LastActivityDate="2013-07-21T13:11:28.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2449" PostTypeId="1" AcceptedAnswerId="2452" CreationDate="2013-07-21T18:48:50.990" Score="8" ViewCount="1061" Body="&lt;p&gt;I have a 3 site network: one is a data center colo and the other two are offices. The new Metro Ethernet service we just installed requires the colo site's traffic destined to the offices to be in VLAN 10 or 20 depending on the office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, they picked the VLANs without my input and they overlap with the VLANs that I am currently using. VLAN 10 is being used in the colo and vlan 20 is being used in one of the offices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything I can do to get this working without having to renumber my VLANs and without making the carrier renumber theirs? From what I've read, my switches don't appear to support transaltional VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The colo site has a Cisco Catalyst 3560-X switch with ipservices iOS 15.0(2)SE and the offices are running 3560/3750's with ipbase iOS 12.2.something.&lt;/p&gt;&#xA;" OwnerUserId="2128" LastActivityDate="2013-07-25T19:59:33.070" Title="carrier's vlan tags overlap my own" Tags="|cisco-catalyst|vlan|metro-ethernet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2450" PostTypeId="1" AcceptedAnswerId="39274" CreationDate="2013-07-21T19:46:01.810" Score="7" ViewCount="3349" Body="&lt;p&gt;I am looking for a technology to achieve TCP connection fault tolerance with the help of two links between hosts and without time delays for route failure detection. Something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                       link1   packet1copy1-&amp;gt;&#xA;                     --------------------------&#xA;      packet1-&amp;gt;     /                          \    packet1copy1/packet1copy2-&amp;gt;&#xA;host1--------router1                            router2 ------------------------host2&#xA;                    \  link2   packet1copy2-&amp;gt;  /&#xA;                     --------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;host1&lt;/code&gt; and &lt;code&gt;host2&lt;/code&gt; are connected via &lt;code&gt;router1&lt;/code&gt; and &lt;code&gt;router2&lt;/code&gt; with two links between them. Each router duplicates every packet coming from hosts before forwarding them into both links simultaneously. Then either the peer router or the destination host IP stack take care of redundant packet elimination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;This is in fact a search for a general purpose &lt;em&gt;fault-tolerance-by-replication&lt;/em&gt; solution for TCP (IP) transport. The solution should be of &lt;em&gt;no-need-to-recover&lt;/em&gt; type as opposed to &lt;em&gt;reasonably-fast-to-recover&lt;/em&gt; approaches like BGP / OSPF / Cisco IP SLA, etc. Some proprietary packet redundancy solutions are known already, though insufficiently universal. In particular, Engage Communication offers &lt;a href=&quot;http://www.engageinc.com/downloads/IPTube_Protector_White.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;IP Tube Protector&lt;/a&gt; for VoIP. Unfortunately this solution 1) is more of equipment than of standard technology and 2) is confined to VoIP domain only. It may be also worth noting &lt;a href=&quot;https://www.juniper.net/techpubs/en_US/ctp6.5/topics/concept/packet-protection.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Juniper Packet Redundancy&lt;/a&gt; technology, though it looks like limited to single link only, and not to redundant links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder why I can't find anything similar from Cisco... Does any standard or at least general purpose technology address this?&lt;/p&gt;&#xA;" OwnerUserId="2127" LastEditorUserId="2127" LastEditDate="2017-12-14T12:38:12.283" LastActivityDate="2023-10-26T06:37:29.610" Title="Redundant IP link aggregation for failover operation without route failure detection" Tags="|tcp|redundancy|failover|architecture|packet-loss|" AnswerCount="7" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2452" PostTypeId="2" ParentId="2449" CreationDate="2013-07-21T23:56:22.477" Score="9" Body="&lt;p&gt;Depending on the actual &quot;Metro Ethernet&quot; service that your carrier is providing, you have several possible solutions.  I'll address what I see as the most likely scenario, and some of the solutions in that scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Your carrier is probably using Q-in-Q tagging, and your local VLANs are irrelevant.&lt;/strong&gt; (See the &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1ad&quot;&gt;Wikipedia page on 802.1ad&lt;/a&gt; for info on Q-in-Q, or this Cisco config guide on &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_55_se/configuration/guide/swtunnel.html&quot;&gt;VLAN tunneling&lt;/a&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This situation, where the carrier is using Q-in-Q, is usually the case in my experience.  They will accept whatever VLAN's you send, and then apply Q-in-Q tagging and send the traffic across their network.  So inside the carrier network, your traffic destined towards Site-A could be tagged with VLAN 10.  When the frame arrives at the PE equipment, it will have that additional VLAN tag stripped, and be forwarded onto your equipment with the original VLAN tagging intact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;It is possible that the carrier is utilizing your applied VLAN tags to direct the traffic.&lt;/strong&gt; (i.e. VLAN 10 for Site-A and VLAN 20 for Site-B.) &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;The easiest solution&lt;/strong&gt;:  Tell your carrier that they have to choose different VLANs for this traffic engineering purpose.  &lt;strong&gt;You are the customer!!&lt;/strong&gt;  Their sales-engineers should have gathered the appropriate information to make sure there wasn't overlap before designing this solution/service for you.  Don't accept the circuits until they resolve their issue.  &lt;strong&gt;IF&lt;/strong&gt; they are using Q-in-Q, they only need to know which VLAN goes to which location for administrative purposes, not for any technical reason, and should be able to change their configuration.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;More complicated solution:  Investigate Q-in-Q tagging/VLAN tunneling, for yourself. Depending on your hardware/licensed capabilities, you could maintain your locally significant VLAN tags, and then slap another tag on the frame for the carrier.  Then when the frame arrives at your destination, strip the extra tag off, then send the frame on it's way based on the original VLAN.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;With all of that stated, there may be some other scenario where they &lt;strong&gt;HAVE&lt;/strong&gt; to use VLANs 10 and 20.  Ask your carrier for the explanation as to why this is the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your carrier is difficult to work with in this scenario, (won't provide an explanation, or work around your local VLAN structure) imagine what they'll be like during a service outage.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Always use the install process to test your service provider!  If customer service isn't on their radar, you should be leery of their services.  That is to say, if they perform poorly on the install, you usually have more of the same &quot;quality service&quot; to look forward to for the length of your entire contract.  &lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-07-22T00:02:33.873" LastActivityDate="2013-07-22T00:02:33.873" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2453" PostTypeId="2" ParentId="2391" CreationDate="2013-07-22T06:11:26.190" Score="0" Body="&lt;pre&gt;&lt;code&gt;The   basic  issue   is   that  the   BGP   speaker  configured   with&#xA;&quot;multipath-relax&quot;   gets  into   a  control   plane  &amp;lt;-&amp;gt;   data  plane&#xA;inconsistency; i.e.  it advertises  only the  best path,  but installs&#xA;multiple paths in the forwarding  that have different ASPATHs than the&#xA;best. This breaks the basic tool BGP has to detect loops - ASPATH loop&#xA;check.&#xA;&#xA;A (distorted) scenario below. I am sure you can come up with&#xA;a better example with a bit more time at hand.&#xA;&#xA;            ...............&#xA;            : R4  AS1 (10/8)&#xA;           /:..............&#xA;     ..../......&#xA;     :  R5 AS2&#xA;     :....\.....&#xA;       /   \  ...............&#xA;     /      --:--R1&#xA;  R6 AS4      :    \    AS3&#xA;     \--------:--- R2&#xA;              :    /&#xA;              : R3 (10/8)&#xA;              :..............&#xA;&#xA;In this example,&#xA;- R3 in AS3 and R4 in AS1 announce a prefix 10/8. R5 in AS2 receives&#xA;  the prefix from R1(AS3) and R4(AS1).&#xA;- AS2 is configured with 'multipath-relax' and chooses both paths&#xA;  for multipath forwarding, though it selects AS1's path as best.&#xA;- R5 advertises the prefix with AS_PATH &quot;2 1&quot; to R6, and R6 in turn&#xA;   to R2.&#xA;- Because of some specific policy, it is possible that R2(AS3)&#xA;  chooses R6's path as best. If it happens, there is a loop.&#xA;  Note that R1-R2-R3 represents the physical connectivity of&#xA;  the routers in AS3.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2129" LastActivityDate="2013-07-22T06:11:26.190" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2454" PostTypeId="2" ParentId="2427" CreationDate="2013-07-22T07:36:03.760" Score="6" Body="&lt;p&gt;To answer your questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RDP traffic should get up to the 25% of the remaining bandwidth. Where the already reserved bandwidth is the 35% ( &lt;strong&gt;class-default&lt;/strong&gt; gets 25% by default and EF get 10% ). So, if i'm right, you assigned ~665Kbps to RDP. Anyway you should check if you're dropping packets issuing the command below:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show policy-map &amp;lt;your wan interface&amp;gt; output class REMOTEDESKTOP&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and checking for dropped packets.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Cisco assign a queue to each user-defined class that includes the &lt;strong&gt;bandwidth&lt;/strong&gt; or &lt;strong&gt;police&lt;/strong&gt; commands. To make a long-story simple those commands define the amount of bandwidth assigned to every queue during congestions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In theory every TCP based stream should be OK with drops. In practice some of them aren't. Dropping precedence bits tell the routers what packets should be dropped, within a given class, before congestion happens. Since RDP is the only type of traffic defined in your &lt;em&gt;REMOTEDESKTOP&lt;/em&gt; class, you should not worry about it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Bandwidth percentage are not in order ( as Jeremy stated ).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That said, there are a lot of things that i would change in your configuration:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;There are no matches between some of classes of the &lt;em&gt;setTos&lt;/em&gt; and the &lt;em&gt;useTos&lt;/em&gt; policy-map. For instance the one named AF-HIGH is processing no packets since no class in &lt;em&gt;setTos&lt;/em&gt; sets DSCP to AF41.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;BE&lt;/em&gt; class in &lt;em&gt;setTos&lt;/em&gt; is somehow self-defeating since it makes the &lt;strong&gt;class-default&lt;/strong&gt; class useless. Note that &lt;strong&gt;class-default&lt;/strong&gt; is the only system-defined class and get the 25% of the bandwidth by default ( 100 - max-reserved-bandwidth ) .&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;bandwidth remaining percent&lt;/strong&gt; is not the best options ( as Jeremy explained ). I would change it to &lt;strong&gt;bandwidth percent&lt;/strong&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I would prefer to mark EF packets by myself and not to rely on the phones' settings.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="530" LastActivityDate="2013-07-22T07:36:03.760" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2455" PostTypeId="1" CreationDate="2013-07-22T09:12:04.530" Score="5" ViewCount="4589" Body="&lt;p&gt;Could you advise from your own experience is it good practise to use LAG (Link Aggregation) on CISCO wireless lan controllers on not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Benefits (as for me): redundancy and a little bit simplification (less interfaces).&#xA;Drawbacks: LAG doesn't support aggregation control messages, so it is like simple link bondings.&lt;/p&gt;&#xA;" OwnerUserId="904" LastActivityDate="2013-07-24T04:48:49.833" Title="CISCO WLC: use LAG or not?" Tags="|cisco|wireless|wlc|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2456" PostTypeId="2" ParentId="2455" CreationDate="2013-07-22T09:31:51.150" Score="4" Body="&lt;p&gt;We like LAGs on Cisco Wireless controllers, but how you do it depends on the model.  We used to have 4404 controllers that required static LAGs.  Now we have the 5508 and it supports LACP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We had no problem with LAG, and I prefer it for uplinks from the controller.&lt;/p&gt;&#xA;" OwnerUserId="2096" LastActivityDate="2013-07-22T09:31:51.150" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2457" PostTypeId="1" AcceptedAnswerId="2466" CreationDate="2013-07-22T10:05:37.790" Score="19" ViewCount="3568" Body="&lt;p&gt;We use the Cisco ASA 5585 in a layer2 transparent mode.  The configuration is just two 10GE links between our business partner dmz and our inside network.  A simple map looks like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.4.2.9/30                    10.4.2.10/30&#xA;core01-----------ASA1----------dmzsw&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ASA has 8.2(4) and SSP20.  The switches are 6500 Sup2T with 12.2.  There are no packet drops on any switch or ASA interface!!  Our maximum traffic is about 1.8Gbps between the switches and the CPU load on the ASA is very low.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a strange problem.  Our nms admin sees very bad packet loss that started sometime in June.  The packet loss is growing very fast, but we do not know why.  Traffic through the firewall has remained constant, but packet loss is growing quickly.  These are the nagios ping failures we see through the firewall.  Nagios sends 10 pings to every server.  Some of the failures loose all pings, not all failures loose all ten pings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nKyU4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The strange thing is that if we use mtr from the nagios server, the packet loss isn't very bad.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                             My traceroute  [v0.75]&#xA;nagios    (0.0.0.0)                                    Fri Jul 19 03:43:38 2013&#xA;Keys:  Help   Display mode   Restart statistics   Order of fields   quit&#xA;                                  Packets               Pings&#xA; Host                           Loss%   Snt Drop   Last  Best   Avg  Wrst StDev&#xA; 1. 10.4.61.1                    0.0%  1246    0    0.4   0.3   0.3  19.7   1.2&#xA; 2. 10.4.62.109                  0.0%  1246    0    0.2   0.2   0.2   4.0   0.4&#xA; 3. 10.4.62.105                  0.0%  1246    0    0.4   0.4   0.4   3.6   0.4&#xA; 4. 10.4.62.37                   0.0%  1246    0    0.5   0.4   0.7  11.2   1.7&#xA; 5. 10.4.2.9                     1.3%  1246   16    0.8   0.5   2.1  64.8   7.9&#xA; 6. 10.4.2.10                    1.4%  1246   17    0.9   0.5   3.5 102.4  11.2&#xA; 7. dmz-server                   1.1%  1246   13    0.6   0.5   0.6   1.6   0.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When we ping between the switches, we don't loose many packets, but it is obvious the problem starts somewhere between the switches.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;core01#ping ip 10.4.2.10 repeat 500000&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 500000, 100-byte ICMP Echos to 10.4.2.10, timeout is 2 seconds:&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;Success rate is 99 percent (499993/500000), round-trip min/avg/max = 1/2/6 ms&#xA;core01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can we have so many ping failures and no packet drops on the interfaces?  How can we find where the problem is?  Cisco TAC is going in circles on this problem, they keep asking for show tech from so many different switches and it is obvious that the problem is betwen core01 and dmzsw.  Can someone help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update July 30, 2013&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you to everyone for helping me find the problem.  It was a misbehaving application that sent a lot of small UDP packets for about 10 seconds at a time.  These packets were were denied by the firewall.  It looks like my manager wants to upgrade our ASA so we don't have this problem again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;More Information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From questions in the comments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA1# show inter detail | i ^Interface|overrun|error&#xA;Interface GigabitEthernet0/0 &quot;&quot;, is administratively down, line protocol is down&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface GigabitEthernet0/1 &quot;&quot;, is administratively down, line protocol is down&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface GigabitEthernet0/2 &quot;&quot;, is administratively down, line protocol is down&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface GigabitEthernet0/3 &quot;&quot;, is administratively down, line protocol is down&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface GigabitEthernet0/4 &quot;&quot;, is administratively down, line protocol is down&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface GigabitEthernet0/5 &quot;&quot;, is administratively down, line protocol is down&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface GigabitEthernet0/6 &quot;&quot;, is administratively down, line protocol is down&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface GigabitEthernet0/7 &quot;&quot;, is administratively down, line protocol is down&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface Internal-Data0/0 &quot;&quot;, is up, line protocol is up&#xA;     2749335943 input errors, 0 CRC, 0 frame, 2749335943 overrun, 0 ignored, 0 abort&#xA;         0 output errors, 0 collisions, 0 interface resets&#xA;           RX[00]: 156069204310 packets, 163645512578698 bytes, 0 overrun&#xA;           RX[01]: 185159126458 packets, 158490838915492 bytes, 0 overrun&#xA;           RX[02]: 192344159588 packets, 197697754050449 bytes, 0 overrun&#xA;           RX[03]: 173424274918 packets, 196867236520065 bytes, 0 overrun&#xA;Interface Internal-Data1/0 &quot;&quot;, is up, line protocol is up&#xA;    26018909182 input errors, 0 CRC, 0 frame, 26018909182 overrun, 0 ignored, 0 abort&#xA;    0 output errors, 0 collisions, 0 interface resets&#xA;           RX[00]: 194156313803 packets, 189678575554505 bytes, 0 overrun&#xA;           RX[01]: 192391527307 packets, 184778551590859 bytes, 0 overrun&#xA;           RX[02]: 167721770147 packets, 179416353050126 bytes, 0 overrun&#xA;           RX[03]: 185952056923 packets, 205988089145913 bytes, 0 overrun&#xA;Interface Management0/0 &quot;Mgmt&quot;, is up, line protocol is up&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface Management0/1 &quot;&quot;, is administratively down, line protocol is down&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface TenGigabitEthernet0/8 &quot;Inside&quot;, is up, line protocol is up&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;Interface TenGigabitEthernet0/9 &quot;DMZ&quot;, is up, line protocol is up&#xA;        0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;        0 output errors, 0 collisions, 0 interface resets&#xA;&#xA;ASA1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2096" LastEditorUserId="2096" LastEditDate="2013-07-30T09:24:54.197" LastActivityDate="2013-07-30T09:24:54.197" Title="Finding transparent firewall packet loss" Tags="|cisco|switch|cisco-asa|firewall|packet-loss|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="2458" PostTypeId="2" ParentId="2450" CreationDate="2013-07-22T12:00:50.257" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am looking for a technology to achieve TCP connection fault tolerance with the help of two links between hosts and without time delays for route failure detection. Something like this:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                       link1   packet1copy1-&amp;gt;&#xA;                     --------------------------&#xA;      packet1-&amp;gt;     /                          \    packet1copy1/packet1copy2-&amp;gt;&#xA;host1--------router1                            router2 ------------------------host2&#xA;                    \  link2   packet1copy2-&amp;gt;  /&#xA;                     --------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are a few things working against your proposal...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You are going to make host1 and host2 work very hard to untangle your intentional packet duplication scheme for no good reason&lt;/li&gt;&#xA;&lt;li&gt;You are burning horsepower on your ipsec encryption points for no good reason&lt;/li&gt;&#xA;&lt;li&gt;TCP has been refined for over three decades to automatically recover from infrastructure flaws and failures; &quot;helping&quot; TCP in such a way fixes the wrong problem.   You need to make your infrastructure react to mitigate problems, you should not duct-tape TCP to survive problematic infrastructure.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I am going to answer with the the same comment I made, since your failure detection requirements are twenty seconds...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Build 2 IPSec tunnels with ISP diversity as required.  Run a routing protocol through your IPSec tunnels, and tune the protocol timers to fail around sustained infrastructure packet loss.  If you have Cisco end to end, EIGRP has long had very fast convergence around failures, although Link state protocols are getting the same these days with the IETF loop free alternative implementations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Optionally use IP SLA on both sides to take down a tunnel that does not meet any jitter / delay / packet loss requirements.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-23T02:03:21.060" LastActivityDate="2013-07-23T02:03:21.060" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="2459" PostTypeId="1" AcceptedAnswerId="2461" CreationDate="2013-07-22T14:23:46.727" Score="12" ViewCount="85812" Body="&lt;p&gt;for sniffing purposes I need to mirror traffic on an HP 2915. How would I go about doing so?&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="378" LastEditDate="2013-07-22T16:19:43.080" LastActivityDate="2013-07-22T16:19:43.080" Title="Port mirroring on an HP Switch (HP 2915-8G)" Tags="|hp|switching|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2460" PostTypeId="2" ParentId="2459" CreationDate="2013-07-22T14:39:28.183" Score="5" Body="&lt;p&gt;A better term would be &quot;port mirroring&quot;. This concept is generally universal among vendor products. (Cisco would call theirs SPAN, but it's essentially the same thing). You take a range of ports or VLANs, and simply copy all traffic to a destination port, where you'd hook up a PC with wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try &lt;a href=&quot;http://h30499.www3.hp.com/t5/Switches-Hubs-Modems-Legacy-ITRC/port-mirroring/td-p/3685231#.Ue1Deo3vt30&quot; rel=&quot;noreferrer&quot;&gt;this thread&lt;/a&gt; - it's not a complete exhaustive walkthrough but it will point you in the right direction. Regardless, searching for terms like &quot;HP Port Mirroring&quot; should yield better results.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-07-22T14:39:28.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2461" PostTypeId="2" ParentId="2459" CreationDate="2013-07-22T14:55:40.813" Score="12" Body="&lt;p&gt;You can certainly use Port Mirroring with the HP 2915.  You can find the information for port mirroring on page B-23 in the &lt;a href=&quot;http://bizsupport1.austin.hp.com/bc/docs/support/SupportManual/c02564193/c02564193.pdf&quot;&gt;documentation for the 2915&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will be able to designate monitoring of inbound and outbound traffic on either individual ports, groups of ports, static port trunks, and one static VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example to assign a port as the monitoring port: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ProCurve(config)# mirror-port 8&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Removing port 8 as the monitoring port:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ProCurve(config)# no mirror-port &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Once you assign the monitor port you can then select the source interfaces:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ProCurve(config)# int 1-4, monitor&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To show the current monitor (this will display what port is the monitor port, called the mirror port, and what the sources being monitored are)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ProCurve(config)# show monitor&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="9" LastActivityDate="2013-07-22T14:55:40.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2463" PostTypeId="2" ParentId="2415" CreationDate="2013-07-23T03:17:24.337" Score="4" Body="&lt;p&gt;&lt;em&gt;This is my interpretation of TCP Vegas for your questions.  Other scholars here could correct this or augment it.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1. &quot;The change of the modified slow-start is that the window is increased every other RTT..., but what is the meaning of other RTT?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A1.  During SlowStart, the cwin (congestion window) is increased every other RTT, meaning this is in comparison to TCP Reno which increases every RTT&lt;/strong&gt;; the algorithm simply skips every other RTT that may be seen with ACKs, for example, in computing the RTT metrics and exponentially increasing the window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2.  &quot;When the algorithm change to the lineal growth phase (or congestion avoidance phase)?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP Vegas only allows exponential growth every other RTT.  When the window is not increasing -- the other &quot;every other&quot; RTT -- &lt;strong&gt;Vegas compares the expected and actual rates and comes out of SlowStart when the actual rate falls below the expected rate by one MSS.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3. &quot;And, there is any reduction of the window when a duplicated ACK is received?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Vegas only decreases the cwin if the retransmitted segment was previously sent after the last decrease.&lt;/strong&gt;  Segment losses before the last window decrease do not imply the current cwin is congested, so the cwin is not decreased further.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-07-23T03:17:24.337" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2464" PostTypeId="2" ParentId="2450" CreationDate="2013-07-23T08:02:40.233" Score="0" Body="&lt;p&gt;I'm not aware of tricks or protocols that can perform this type of &lt;em&gt;forward&lt;/em&gt; replication on the network devices in question - for this type of application I would recommend redundancy and fast failure detection using BGP fast-failover, BFD and other tools. However, I came across this open source project called 'Tunnel Splitter' &lt;a href=&quot;http://coderrr.wordpress.com/2010/01/10/tunnel-splitter-accelerating-a-single-tcp-connection-over-multiple-isps/&quot; rel=&quot;nofollow&quot;&gt;http://coderrr.wordpress.com/2010/01/10/tunnel-splitter-accelerating-a-single-tcp-connection-over-multiple-isps/&lt;/a&gt; that seems to fit what you're looking for.  In short, the TS boxes installed at each site proxy the TCP connections between host1 and host2, and then split the traffic between them over tunnels. As each tunnel has a unique source address, PBR (policy-based routing) can be used at the routers to direct traffic for tunnel1 over link1 and tunnel2 over link2. The TS boxes terminate the tunnels, and have a single tcp connection to host1 and host2. Of course, you would need to really,really test this but it seems to work on the whiteboard!&lt;/p&gt;&#xA;" OwnerUserId="1894" LastActivityDate="2013-07-23T08:02:40.233" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2466" PostTypeId="2" ParentId="2457" CreationDate="2013-07-23T10:56:55.933" Score="8" Body="&lt;pre&gt;&lt;code&gt;Interface Internal-Data0/0 &quot;&quot;, is up, line protocol is up&#xA;     2749335943 input errors, 0 CRC, 0 frame, 2749335943 overrun, 0 ignored, 0 abort&#xA;                                              ^^^^^^^^^^^^^^^^^^&#xA;         0 output errors, 0 collisions, 0 interface resets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You show &lt;em&gt;overruns&lt;/em&gt; on the InternalData interfaces, so you &lt;em&gt;are&lt;/em&gt; dropping traffic through the ASA.  With that many drops, it's not hard to imagine that this is contributing to problem.  Overruns happen when the internal Rx FIFO queues overflow (normally because of some problem with load).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;EDIT to respond to a question in the comments&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I don't understand why the firewall is overloaded, it is not close to using 10Gbps. Can you explain why we are seeing overruns even when the CPU and bandwidth are low? The CPU is about 5% and the bandwidth either direction never goes much higher than 1.4Gbps.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I have seen this happen over and over when a link is seeing &lt;a href=&quot;http://en.wikipedia.org/wiki/Micro-bursting_%28networking%29&quot; rel=&quot;noreferrer&quot;&gt;traffic microbursts&lt;/a&gt;, which exceed either the bandwidth, connection-per-second, or packet-per-second horsepower of the device.  So many people quote 1 or 5 minute statistics as if the traffic is relatively constant across that timeframe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would take a look at your firewall by running these commands every two or three seconds (run &lt;code&gt;term pager 0&lt;/code&gt; to avoid paging issues)...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show clock&#xA;show traffic detail | i ^[a-zA-Z]|overrun|packets dropped&#xA;show asp drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now graph out how much traffic you're seeing every few seconds vs drops; if you see massive spikes in policy drops or overruns when your traffic spikes, then you're closer to finding the culprit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't forget that you can sniff directly on the ASA with this if you need help identifying what's killing the ASA... you have to be quick to catch this sometimes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;capture FOO circular-buffer buffer &amp;lt;buffer-size&amp;gt; interface &amp;lt;intf-name&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Netflow on your upstream switches could help as well.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-25T10:36:58.883" LastActivityDate="2013-07-25T10:36:58.883" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2468" PostTypeId="1" AcceptedAnswerId="2469" CreationDate="2013-07-23T14:14:11.740" Score="2" ViewCount="383" Body="&lt;p&gt;I have four switches node arranged in a ring topology; I am using RSTP or STP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I learned the classic three switches ring topology. Is the four switches topology using the same method as three switches to decide the port state? If so, at what step and what is the different between RSTP and STP? How can I know what state the switch port is in besides testing it?&lt;/p&gt;&#xA;" OwnerUserId="1268" LastEditorUserId="1268" LastEditDate="2013-07-23T14:40:54.043" LastActivityDate="2013-07-24T00:22:04.677" Title="Deciding the port state with RSTP and STP" Tags="|ethernet|spanning-tree|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2469" PostTypeId="2" ParentId="2468" CreationDate="2013-07-23T17:57:18.607" Score="8" Body="&lt;p&gt;STP does not operate differently whether the network has three, four, or a dozen switches. Each switch applies the same logic locally, and don't even actually know how many switches exist within the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Legacy and rapid STP behave differently (you'll need to research the differences) but both operate on the same basic principle: calculate the best path to the root bridge and disable all redundant paths. If you know the topology of and the costs associated with each link in the network, it's entirely possible to calculate the best path on paper alone.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-07-23T17:57:18.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2472" PostTypeId="2" ParentId="785" CreationDate="2013-07-23T19:12:02.660" Score="0" Body="&lt;p&gt;To clarify the original question -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Route refresh message is sent to request the peer to advertise its routes back to you. It is thus useful if you issue 'clear bgp ... in' command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the command you are interested in, 'route refresh message' statistics won't go up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no easy way to test the success of 'clear bgp * soft out'. The best bet is to look at the outgoing message counters (e.g. updates sent). Those should go up considerably compared to what they were before you issued the command (based on the number of prefixes you have).&lt;/p&gt;&#xA;" OwnerUserId="2129" LastActivityDate="2013-07-23T19:12:02.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2473" PostTypeId="1" AcceptedAnswerId="2474" CreationDate="2013-07-23T19:15:25.713" Score="1" ViewCount="852" Body="&lt;p&gt;I handle the network at a small business; it's not my primary job but one that I am in charge of. My boss owns a house next to the office that he uses as a general meeting area and as a guest house for friends and family. The house is close enough to the office that our office WLAN covers most of the house.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our office router (Cisco Linksys EA4500) supports a &quot;guest&quot; network, which is okay for people that pop in for meetings, but not so great for family and friends that may stay for several days or a week. The guest profile times out, and they have to reconnect. I have no way to set the timeout period for the guest profile. But mainly, there are several &quot;dead spots&quot; in the wifi coverage in the house. Also, there is an Ethernet cable running from the office to the house that is not currently being used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to have a WLAN in the house wherein the guests do not have access to the office network. Optimally, I would just use the spare Ethernet cable to setup a separate WLAN in the house. But I don't know how to do it so that the guests cannot get access to our office network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would this be as simple as connecting a wireless router to the office network and putting it on a different subnet? Or will that still allow the guests to &quot;see&quot; the office network? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a more &quot;optimal&quot; setup?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's been suggested that we get a second IP from our ISP, and use it for the house internet. But I would prefer not to incur the additional monthly charge if possible.&lt;/p&gt;&#xA;" OwnerUserId="2147" LastEditorUserId="775" LastEditDate="2013-07-23T19:28:00.937" LastActivityDate="2014-07-20T03:52:28.247" Title="How to keep office LAN private from public WLAN" Tags="|wireless|routing|router|ieee-802.11|" AnswerCount="3" CommentCount="2" ClosedDate="2014-07-20T08:32:44.807" ContentLicense="CC BY-SA 3.0" />
  <row Id="2474" PostTypeId="2" ParentId="2473" CreationDate="2013-07-23T19:31:21.750" Score="5" Body="&lt;p&gt;If that EA4500 is the only router you have in the office, then you need a router with more interfaces. Then you can connect your ISP/WAN segment, office segment, and house segments on three separate interfaces. Within the router you can then control what traffic may flow where.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you really need, is a routing/networking professional to come in and design your a proper network. I believe you've reached the point where &quot;being the network guy&quot; is going to provide diminishing returns for your boss/company.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-07-23T19:31:21.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2475" PostTypeId="1" CreationDate="2013-07-23T20:42:56.950" Score="5" ViewCount="1314" Body="&lt;p&gt;In our environment, we run our computers inline with Cisco IP phones to our switch. The problem is that our phones are on a separate VLAN from our normal access traffic. I would like to know if it is possible to map the private VLAN to both our access and voice SVIs. On top of that, is it possible to have our access and voice &quot;layer 2&quot; VLAN statements associated with the same private VLAN? Even if these two queries are possible, is can I assign the physical ports to have multiple private VLAN associations? (This seems like a mouthful. I apologize)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of what I have setup already:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 101&#xA; name WKS-VLAN&#xA; private-vlan primary&#xA; private-vlan association 1000,2000&#xA;!&#xA;vlan 254&#xA; name VOIP-VLAN&#xA;!&#xA; vlan 1000&#xA;  private-vlan isolated&#xA;!&#xA;vlan 2000&#xA; private-vlan community&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SVIs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan101&#xA; description WKS-VLAN&#xA; ip address x.x.x.x 255.255.252.0&#xA; private-vlan mapping 1000,2000&#xA;!&#xA;interface Vlan254&#xA; description VoIP-VLAN&#xA; ip address x.x.x.x 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example Port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet2/46&#xA; switchport private-vlan host-association 101 1000&#xA; switchport mode private-vlan host&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any help!&lt;/p&gt;&#xA;" OwnerUserId="2144" LastActivityDate="2013-11-11T14:15:48.037" Title="Is it possible for a private VLAN to have two simultaneous SVI mappings?" Tags="|cisco|vlan|switching|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2477" PostTypeId="1" CreationDate="2013-07-23T22:20:12.217" Score="9" ViewCount="5074" Body="&lt;p&gt;I am having the same issue on my business connection 5Mbps as in another &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/780/what-would-cause-high-latency-anytime-there-is-traffic-on-wan&quot;&gt;posting&lt;/a&gt; on this site. As soon as any computer starts a download the latency on the first hop past our DFG provided by our ISP (Bell) goes off the chart.&#xA;This first hop is likely in our same building and is 1ms constantly, start a download, eg windows update, and it jumps to 200-1000ms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have spent hours on the phone with support all saying you have reach the max available bandwidth, it is normal for your latency to spike. But my reading tells me they are breaking something with TCP. I have run tests on a home Shaw connection and even on a Rogers LTE running downloads and reaching the max Mbps for my account but the latency does not go through the roof.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I right in my understanding that Bell is doing something to break TCP's built-in technologies to manage its rate based on the available bandwidth between the 2 end points?&lt;/p&gt;&#xA;" OwnerUserId="2149" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2024-02-24T12:53:10.503" Title="High latency during downloads" Tags="|latency|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2478" PostTypeId="2" ParentId="2477" CreationDate="2013-07-23T23:20:06.003" Score="12" Body="&lt;p&gt;Bell is telling you the truth.  When you try to push 5Mbps (or more) into a 5Mbps connection, everything files into a neat little order (read: queue.) Your ping goes out without delay because there's no backlog.  The reply, however, is now at the end of the queue. TCP is doing exactly what it's supposed to here -- the sender is filling the allowed receive window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are things you can do on your side of the line (QoS, WRED, etc.) to help reduce the effects, but this is the sort of thing you're going to see when there's a large difference between sender and receiver bandwidth.  I've lived with it for &lt;em&gt;years&lt;/em&gt; (T1, 6Mbps DS3, even 10Mbps cablemodem) You could ask the ISP to reduce the queue size on their side, but they're not likely to do it, as it'll result in packet drops.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-07-23T23:20:06.003" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2479" PostTypeId="2" ParentId="2468" CreationDate="2013-07-24T00:22:04.677" Score="3" Body="&lt;p&gt;Assuming that all link speeds are the same, things become  hop count. If you explicitly set a root bridge the switch 'across' from it in the ring will have the blocked port, it will be the port with the higher MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no real difference in blocked port selection between rapid and 'classic' STP&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-07-24T00:22:04.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2480" PostTypeId="2" ParentId="2473" CreationDate="2013-07-24T01:23:37.737" Score="1" Body="&lt;p&gt;Your suggestion setup will NOT prevent the guest from seeing your office network as their traffic will still need to go via the office. However, your setup can still work with some tweaks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simplest (not the optimal) solution will be to setup the network as you have suggested but enable the firewall on the home WLAN AP to block/deny all traffic to the office subnet except the default gateway as you need access to the GW to get to the internet. &lt;/p&gt;&#xA;" OwnerUserId="2152" LastEditorUserId="775" LastEditDate="2013-07-24T02:07:38.533" LastActivityDate="2013-07-24T02:07:38.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2481" PostTypeId="2" ParentId="2450" CreationDate="2013-07-24T01:37:29.657" Score="1" Body="&lt;p&gt;This is an application layer problem and not a network level problem. This is because one of the core principles of IP is prevent duplicates especially when TCP retransmission is invoked.&lt;br&gt;&#xA;In highly critical environments, the approach will be to have 2 NICs on the end hosts and get the application to generate 2 unique packets. With this approach you can use existing technologies and network principles using variable paths and metrics.&lt;/p&gt;&#xA;" OwnerUserId="2152" LastActivityDate="2013-07-24T01:37:29.657" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2482" PostTypeId="2" ParentId="2477" CreationDate="2013-07-24T02:04:13.870" Score="1" Body="&lt;p&gt;What you are seeing is entirely typical.  Many service providers will rate limit and/or use a QoS mechanism to lower the priority of ICMP (which includes traditional ping and traceroute) as it has been used in denial of service attacks at times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While a link isn't congested, the lowered priority doesn't affect anything as no traffic is being queued.  During these periods, your latency remains low because the ICMP packets will be forwarded immediately and not be delayed at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the link is congested, higher priority queues get more attention.  Depending on the queuing mechanism, it might forward multiple packets from a higher priority queue for each packet from a lower priority queue or even forward only when there is nothing in a higher priority queue.  In any case, a packet relegated to a lower priority queue will generally be held back longer than on a link with no congestion, increasing the latency.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-07-24T02:04:13.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2483" PostTypeId="2" ParentId="2455" CreationDate="2013-07-24T04:48:49.833" Score="0" Body="&lt;p&gt;Pleae keep in mind that the WLC LAG implementation is broken by design and you have to dumb down your channel loadbalancing to&lt;/p&gt;&#xA;&#xA;&lt;p&gt;port-channel load-balance src-dst-ip (exclude vlan)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(where the exclude vlan needs to be applied only if available). Since this is a chassis wide operation it will impact all the other channels...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has something to do with DTLS crypto.&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-07-24T04:48:49.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2485" PostTypeId="1" AcceptedAnswerId="2486" CreationDate="2013-07-24T11:28:56.357" Score="9" ViewCount="1579" Body="&lt;p&gt;While studying for Cisco and Microsoft certifications I read a lot about NIC Teaming, Etherchannels and similar stuff. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know you can do static teaming in MS Windows Server or creating a port-channel in Cisco or use Dynamic protocols such as LACP and PAgP. But they all offer load-balancing using source or destination MAC address or IP address, a combination XORed together or similar things, right? And it seems there's no way to increase your actual throughput if you have a long long file transfer from one server to another (ex. having 4 GigE bonded together to increase it to 4 Gbps). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I wonder if it is true? Is there a way to use all the bandwidth of bonded interfaces? I heard from few sources that there's something like SLB (Switch-Assisted Load Balancing w/ Fault Tolerance) which supports full load balancing and allows to use full bandwidth (like 4 Gbps from my example between two servers in one transaction). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've heard so many contradictory things about that, and I am totally confused. Help me guys!&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="775" LastEditDate="2013-08-01T12:29:05.067" LastActivityDate="2013-08-01T12:29:05.067" Title="Switch-Assisted Load Balancing w/ Fault Tolerance" Tags="|switch|bandwidth|ieee-802.1ax|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2486" PostTypeId="2" ParentId="2485" CreationDate="2013-07-24T12:39:09.033" Score="8" Body="&lt;p&gt;At layer 2, all load balancing is, at best, done by an XOR or hash of the source and destination MAC, and if you're lucky, it may even read into layer 3 and hash that data too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At layer 3, however, where we're basically talking about multiple gateways (so, effectively, two physical links with a unique next-hop across each) you &lt;em&gt;can&lt;/em&gt; max out the bandwidth across the links IF you're prepared to do per-packet balancing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before I go on, per-packet balancing is generally a &lt;strong&gt;bad thing&lt;/strong&gt; due to the fact that it can result in out-of-order packet delivery, this can be especially terrible with TCP connections, but that of course comes down to the implementation and most modern stacks can tolerate this relatively well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to do per-packet balancing, obviously one requirement is that the source and destination IP addresses are not at all on-link to the devices that have the multiple paths since they need to be routed in order for balancing to be possible. Redundancy can be achieved via a routing protocol such as BGP, OSPF, ISIS, RIP, or alternatively, BFD or simple link-state detection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, there is of course a transport layer solution - protocols like SCTP support connecting to multiple endpoints, and TCP already has drafts in the making that will add options to do similar things. Or... you can just make your application open multiple sockets.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-07-24T12:39:09.033" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2487" PostTypeId="1" CreationDate="2013-07-24T12:49:07.530" Score="3" ViewCount="712" Body="&lt;p&gt;I'm trying to configure an EX2500 (first time with a Juniper), and I configured a trunk on our Cisco device, and then tagged the port on the EX2500. The link between the two comes up fine. However, I am unable to ping the primary IP address I set on the ex2500. Looking at &lt;code&gt;sh ip information&lt;/code&gt; on the EX2500, I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Interface information:&#xA;&#xA;   1: 192.168.28.230       255.255.255.192     192.168.28.192,vlan216, up&#xA;&#xA;Default gateway information:&#xA;  192.168.28.193, enabled,  down&#xA;&#xA;Current IP forwarding settings: OFF, noicmprd enabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a reason why the gateway would be enabled but listed as down?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My configuration: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree mode pvrst&#xA;&#xA;interface ip 1&#xA; ipvlan 216&#xA; ip address  192.168.28.230 255.255.255.192&#xA; enable&#xA;!&#xA;interface ip 1&#xA;ip gateway address 192.168.28.193&#xA;ip gateway enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I created the VLAN, and the port is assigned to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VLAN is allowed on the Cisco device trunk as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="8499" LastEditDate="2016-04-03T22:51:10.910" LastActivityDate="2016-04-03T22:51:10.910" Title="Juniper EX2500 - default gateway enabled but down" Tags="|juniper|trunk|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2489" PostTypeId="2" ParentId="2485" CreationDate="2013-07-24T13:27:22.327" Score="5" Body="&lt;p&gt;First, let's be realistic about your system performance; you have to ensure that your system can consistently spool the bandwidth you're asking about from disk to the NICs in question (see bottom of answer)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as you're willing to use FTP for your file transfers, you can use a client that supports segmenting the file via FTP &lt;code&gt;REST&lt;/code&gt; command for downloads, and a server that supports the FTP &lt;code&gt;COMB&lt;/code&gt; command for segmented uploads.  By using FTP clients that support segmenting, you can open multiple FTP sessions per file transfer and take advantage of the Layer4 LACP hashing supported by many switch vendors... regardless of whether you're bonding 1GE or 10GE links, segmented transfers accelerate your performance across LACP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://filesharefreak.com/2010/03/10/increase-ftp-speeds-with-segmented-downloading&quot; rel=&quot;noreferrer&quot;&gt;CuteFTP for Windows supports REST transfers&lt;/a&gt; and &lt;a href=&quot;http://trac.filezilla-project.org/ticket/2102&quot; rel=&quot;noreferrer&quot;&gt;Filezilla supports the COMB command&lt;/a&gt;.  These are just two of several options you could use.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;System limits&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know what kind of disk you have, but often the single-system limit is disk I/O... there are several points of interest here... from the controller's perspective...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SATA (revision 1) max xfer: 1.2Gbps after 8b/10b overhead&lt;/li&gt;&#xA;&lt;li&gt;SATA (revision 2) max xfer: 2.4Gbps after 8b/10b overhead&lt;/li&gt;&#xA;&lt;li&gt;SATA (revision 3) max xfer: 4.8Gbps after 8b/10b overhead&lt;/li&gt;&#xA;&lt;li&gt;4G Fibre Channel max xfer: 3.56Gbps&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another possible limit is the disk speed / spindles / arms... unless you're using an SSD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally you need NICs with sufficient capacity to the motherboard... check how many lanes are on your PCIe NIC.  I'm assuming you're on a LAN and that packet loss / congestion won't be an issue.   You might want to turn on jumbos if you find that CPU is a limiting factor for your transfers.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-24T13:58:57.000" LastActivityDate="2013-07-24T13:58:57.000" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2491" PostTypeId="1" AcceptedAnswerId="2492" CreationDate="2013-07-24T23:11:33.693" Score="2" ViewCount="340" Body="&lt;p&gt;I am working on a project currently in our lab.  I have 1 3548XL with an uplink to our telco.&lt;br&gt;&#xA;Most of my Cisco experience is on the 6500 platform so I am used to having L3 features at my disposal.  Is it possible with the 3548 to have each of my nodes in a different VLAN and still get out to the Internet via our uplink?  I cannot run dot1q for our uplink.  An engineer told me this wasn't possible without router on a stick or an L3 switch.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice here is appreciated, for the sake of learning, if the answer is &quot;no&quot;, could you explain why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="1976" LastActivityDate="2013-07-24T23:19:55.233" Title="Cisco 3548XL VLANs, no router" Tags="|vlan|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2492" PostTypeId="2" ParentId="2491" CreationDate="2013-07-24T23:19:55.233" Score="6" Body="&lt;p&gt;The 3548XL is a L2 only switch. It does not have the capability to route. If you had to use a Cisco switch to route you could use a 3550/3560/3750.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-07-24T23:19:55.233" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2495" PostTypeId="1" CreationDate="2013-07-25T08:53:31.920" Score="3" ViewCount="28334" Body="&lt;p&gt;I have a small and inexpensive ethernet switch which is giving me some headache. For some reason some devices only work when I plug them into specific ports. The ports are not broken, as other devices work on the same ports. Also, if I just take the cable from one of the ports that doesn't work and plug it into another port, it works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I say the devices don't work, they actually show activity on the LEDs such as LINK and ACT, but I can't ping them, but I have no explanation. I also tried to restart the switch, computer, flush ARP cache etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read that some switches have automatic MAC address aging and learning. Could that be related? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They reason why I am asking is because soon I will undergo a massive operation where we have to connect hundreds of these devices to the network, and we plan to buy 48 port switches for this purpose. If they start playing strange games like this, I am absolutely unsure what is going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could this be a problem with the switch, is this expected, or do you believe it is rather a computer problem or router problem (the switch is connected to a router), but I am not using a gateway on these devices or the computer (and as said, as soon as I plugin the devices on a different port, they start working).&lt;/p&gt;&#xA;" OwnerUserId="2167" LastActivityDate="2020-02-18T20:26:47.850" Title="Ethernet device works on certain ports on Ethernet switch but not on others" Tags="|switch|ethernet|" AnswerCount="4" CommentCount="7" ClosedDate="2023-08-04T16:22:52.383" ContentLicense="CC BY-SA 3.0" />
  <row Id="2496" PostTypeId="1" AcceptedAnswerId="2498" CreationDate="2013-07-25T08:59:56.727" Score="8" ViewCount="12298" Body="&lt;p&gt;I had a bad experience with Cisco ASA when changing/renaming &quot;nameif&quot; interface attributes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know if renaming or simply deleting existing names used in ASA config will do any damage to the configuration.&lt;/p&gt;&#xA;" OwnerUserId="794" LastEditorUserId="775" LastEditDate="2013-07-25T10:50:07.910" LastActivityDate="2013-07-25T12:01:42.047" Title="Cisco ASA - Delete or rename &quot;names&quot;" Tags="|cisco|cisco-asa|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2497" PostTypeId="1" CreationDate="2013-07-25T10:07:06.440" Score="11" ViewCount="623" Body="&lt;p&gt;In essence we purchase a 80/20 line from the carrier who provides the transport between the customer premises &amp;amp; the local exchange where the carrier terminates into our PE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Juniper PE) &amp;lt;--&gt; [Carrier interconnect in Exchange &amp;lt;---&gt; NTE in customer property] &amp;lt;---&gt; (Cisco CPE - 881,1921,1941,2921))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The circuit between the customer property and the local street cabinet is still copper and therefore as the noise/distance increases the speed reduces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the actual line speed negotiation is taking place on the carriers NTE not our CPE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how can I ensure that when the link is saturated priority packets don't get dropped , without actually knowing what the line speed has authenticated to ? can something be done with ipsla  ?&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="1092" LastEditDate="2013-07-25T14:08:48.927" LastActivityDate="2014-02-20T17:44:41.467" Title="enforcing QoS on a &quot;variable&quot; speed link where the negotiation is done by the carriers NTE" Tags="|qos|cisco-ios-15|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="2498" PostTypeId="2" ParentId="2496" CreationDate="2013-07-25T10:48:49.437" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I would like to know if renaming or simply deleting existing names used in ASA config will do any damage to the configuration.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can safely delete and add &lt;code&gt;name&lt;/code&gt; aliases because the ASA reverts to the IP address when the name disappears...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original alias is &lt;code&gt;Xbox&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa5505(config)# sh runn | i Xbox&#xA;name 172.16.1.20 Xbox description Xbox&#xA;access-list INSIDE_in extended permit udp host Xbox any eq domain&#xA;access-list INSIDE_in extended permit tcp host Xbox any eq domain&#xA;access-list INSIDE_in extended permit udp host Xbox any eq 3074&#xA;access-list INSIDE_in extended permit tcp host Xbox any eq 3074&#xA;access-list INSIDE_in extended permit udp host Xbox any eq 88&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now deleting &lt;code&gt;Xbox&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa5505(config)# no name 172.16.1.20 Xbox&#xA;asa5505(config)# sh runn | i 172.16.1.20&#xA;access-list INSIDE_in extended permit udp host 172.16.1.20 any eq domain&#xA;access-list INSIDE_in extended permit tcp host 172.16.1.20 any eq domain&#xA;access-list INSIDE_in extended permit udp host 172.16.1.20 any eq 3074&#xA;access-list INSIDE_in extended permit tcp host 172.16.1.20 any eq 3074&#xA;access-list INSIDE_in extended permit udp host 172.16.1.20 any eq 88&#xA;asa5505(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And adding &lt;code&gt;Xbox-new&lt;/code&gt; on the same address...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa5505(config)# name 172.16.1.20 XBox-new descr temporary example&#xA;asa5505(config)# sh runn | i 172.16.1.20&#xA;name 172.16.1.20 XBox-new description temporary example&#xA;asa5505(config)# sh runn | i XBox&#xA;name 172.16.1.20 XBox-new description temporary example&#xA;access-list INSIDE_in extended permit udp host XBox-new any eq domain&#xA;access-list INSIDE_in extended permit tcp host XBox-new any eq domain&#xA;access-list INSIDE_in extended permit udp host XBox-new any eq 3074&#xA;access-list INSIDE_in extended permit tcp host XBox-new any eq 3074&#xA;access-list INSIDE_in extended permit udp host XBox-new any eq 88&#xA;asa5505(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bonus material: renaming a &lt;code&gt;nameif&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I had a bad experience with Cisco ASA when changing/renaming &quot;nameif&quot; interface attributes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Renaming &lt;code&gt;nameif&lt;/code&gt; on an interface works just fine in ASA 8.2(5)... This is an example of changing &lt;code&gt;nameif OUTSIDE&lt;/code&gt; to &lt;code&gt;nameif newOUTSIDE&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa5505# sh nameif&#xA;Interface                Name                     Security&#xA;Vlan100                  OUTSIDE                    0&#xA;Vlan200                  INSIDE                   100&#xA;asa5505# sh runn | i access-group&#xA;access-group OUTSIDE_in in interface OUTSIDE&#xA;access-group INSIDE_in in interface INSIDE&#xA;asa5505# conf t&#xA;asa5505(config)# int vlan100&#xA;asa5505(config-if)# nameif newOUTSIDE&#xA;asa5505(config-if)# show nameif&#xA;Interface                Name                     Security&#xA;Vlan100                  newOUTSIDE                 0&#xA;Vlan200                  INSIDE                   100&#xA;asa5505(config-if)# sh runn | i newOUTSIDE&#xA; nameif newOUTSIDE&#xA;mtu newOUTSIDE 1500&#xA;global (newOUTSIDE) 1 interface&#xA;access-group OUTSIDE_in in interface newOUTSIDE&#xA;ssl trust-point LOCAL_CERT_gw_200904 newOUTSIDE&#xA;asa5505(config-if)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ASA even renamed the interface references from &lt;code&gt;OUTSIDE&lt;/code&gt; to &lt;code&gt;newOUTSIDE&lt;/code&gt; automatically... TCP sessions through the FW did not drop when I did it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;WARNING&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whatever you do, do &lt;em&gt;not&lt;/em&gt; try &lt;code&gt;no nameif &amp;lt;something here&amp;gt;&lt;/code&gt;... it will hose your config...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa5505(config)# int vlan100&#xA;asa5505(config-if)# no nameif OUTSIDE&#xA;asa5505(config-if)# nameif newBrokenOUTSIDE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-07-25T12:01:42.047" LastActivityDate="2013-07-25T12:01:42.047" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2499" PostTypeId="1" CreationDate="2013-07-25T11:06:34.723" Score="6" ViewCount="1216" Body="&lt;p&gt;We have some Cisco switches running PVST.  I need to convert them to use extended system-id so I can use high numbered vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/spantree.html#wp1115218&quot;&gt;Cisco stp docs say&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When you enable or disable the extended&#xA;  system ID, the bridge IDs of all active STP instances are updated,&#xA;  which might change the spanning tree topology.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If I start at the PVST root and change my primary root, then secondary root, and then all other switches, are there any risks of loops or nasty downtime?&lt;/p&gt;&#xA;" OwnerUserId="2015" LastActivityDate="2013-07-26T19:19:58.553" Title="Converting to extended STP system-id" Tags="|cisco|ethernet|cisco-catalyst|vlan|spanning-tree|" AnswerCount="2" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2500" PostTypeId="1" AcceptedAnswerId="2506" CreationDate="2013-07-25T11:42:52.543" Score="3" ViewCount="1336" Body="&lt;p&gt;In what situations will an ASA perform route lookup? (transparent mode)&lt;/p&gt;&#xA;" OwnerUserId="2090" LastEditorUserId="49" LastEditDate="2013-07-31T11:13:32.660" LastActivityDate="2013-07-31T11:13:32.660" Title="ASA Transparent Mode Route Lookup" Tags="|cisco|routing|cisco-asa|firewall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2501" PostTypeId="1" CreationDate="2013-07-25T13:48:34.217" Score="9" ViewCount="12752" Body="&lt;p&gt;Occasionally I have an issue when I try to SCP a file to one of our Cisco devices. When the connection starts, it immediately drops and says &quot;lost connection&quot;. I've had this happen when there wasn't enough space on the flash drive but this isn't the case today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the failure from a 3750X switch and the pertinent config info from the switch.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;laptop:C3750X user$ scp c3750e-universalk9-tar.150-2.SE4.tar cisco@10.2.55.149:c3750e-universalk9-tar.150-2.SE4.tar&#xA;Password: &#xA;c3750e-universalk9-tar.150-2.SE4.tar            0%    0     0.0KB/s   --:-- ETAConnection to 10.2.55.149 closed by remote host.&#xA;lost connection&#xA;laptop:C3750X user$ ssh cisco@10.2.55.149&#xA;Password: &#xA;&#xA;temp#&#xA;temp#sh run | sec aaa&#xA;aaa new-model&#xA;aaa authentication login default local&#xA;aaa authorization exec default local &#xA;aaa session-id common&#xA;temp#sh run | sec ssh|scp&#xA;ip ssh version 2&#xA;ip scp server enable&#xA; transport input ssh&#xA;temp#sh run | sec line&#xA;line con 0&#xA;line vty 5 15&#xA; transport input ssh&#xA;temp#dir&#xA;Directory of flash:/&#xA;&#xA;  526  -rwx         616  Mar 30 2011 01:39:31 +00:00  vlan.dat&#xA;  527  -rwx        2072  Mar 30 2011 01:40:52 +00:00  multiple-fs&#xA;  528  drwx         512  Mar 30 2011 03:23:11 +00:00  update&#xA;  529  -rwx        2955  Mar 30 2011 01:40:52 +00:00  config.text&#xA;  530  -rwx        3561  Mar 30 2011 01:40:52 +00:00  private-config.text&#xA;    2  drwx         512   Mar 1 1993 00:12:47 +00:00  c3750e-universalk9npe-mz.150-2.SE3&#xA;&#xA;57671680 bytes total (31971328 bytes free)&#xA;temp#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I forgot to include the user section but cisco/cisco is a temp account with privilege 15.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas why SCP is failing when SSH works just fine?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: SCP debug output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;temp#&#xA;Mar 30 03:33:37.452: SCP: [22 -&amp;gt; 10.0.13.120:60706] send &amp;lt;OK&amp;gt;&#xA;Mar 30 03:33:37.687: SCP: [22 &amp;lt;- 10.0.13.120:60706] recv C0644 25548800 c3750e-universalk9-tar.150-2.SE4.tar&#xA;Mar 30 03:33:37.704: SCP: [22 -&amp;gt; 10.0.13.120:60706] send &amp;lt;OK&amp;gt;&#xA;Mar 30 03:33:38.400: SCP: [22 -&amp;gt; 10.0.13.120:60706] send Write failed&#xA;temp#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2016-12-08T22:07:54.317" Title="SCP lost connection" Tags="|cisco|cisco-catalyst|cisco-ios|" AnswerCount="4" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="2502" PostTypeId="1" CreationDate="2013-07-25T14:22:53.203" Score="2" ViewCount="1647" Body="&lt;p&gt;So I have a weird issue.  If I configure a /30 ip on an ethernet interface, for example 10.10.10.1/30 on Router1 and 10.10.10.2/30 on an ethernet interface on Router2, I can ping each other fine...no issues with OSPF (adjacency is formed, etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I remove those configs and assign each ip to the loopback0 interface on each router, I'm unable to ping them and no adjacency is formed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have OSPF configured and the interfaces are added to area 0.  I'm not sure why this is happening.  If you need any configs/output from me, please let me know.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router 1 - with private ip configured on ethernet interface as ptp link comes up fine.&#xA;---------&#xA;#sho ip ospf neighbor&#xA;&#xA;Port          Address         Pri State      Neigh Address   Neigh ID        Ev&#xA;8/21-8/22     10.10.10.1      1   FULL/OTHER 10.10.10.2      10.10.10.2    5&#xA;&#xA;ethernet 8/21-8/22,OSPF enabled&#xA;     IP Address 10.10.10.1, Area 0&#xA;     OSPF state ptr2ptr, Pri 1, Cost 1, Options 2, Type pt-2-pt Events 3&#xA;&#xA;Router 2&#xA;---------&#xA;#sh ip ospf neighbor&#xA;&#xA;Port        Address         Pri State      Neigh Address   Neigh ID        Ev&#xA;5/1-5/2     10.10.10.2      1   FULL/OTHER 10.10.10.1      10.10.10.1    14&#xA;&#xA;If I switch to the loopbacks with the publicly routable ip, here is the output:&#xA;&#xA;Router 1&#xA;--------&#xA;No ospf neighbor formation&#xA;&#xA;lb2,OSPF enabled&#xA;     IP Address 111.111.111.1, Area 0&#xA;     OSPF state DR, Pri 1, Cost 0, Options 2, Type broadcast Events 5&#xA;     Timers(sec): Transit 1, Retrans 5, Hello 10, Dead 40&#xA;     DR:  Router ID 111.111.111.1      Interface Address 111.111.111.1&#xA;     BDR: Router ID 0.0.0.0           Interface Address 0.0.0.0&#xA;     Neighbor Count = 0, Adjacent Neighbor Count= 0&#xA;&#xA;#sh ip route 111.111.111.0&#xA;Total number of IP routes: 262007, avail: 137 (out of max 262144)&#xA;        Destination     NetMask         Gateway         Port       Cost   Type&#xA;        111.111.111.0    255.255.255.252 0.0.0.0         lb2        1      D&#xA;&#xA;Router 2&#xA;--------&#xA;No ospf neighbor formation&#xA;&#xA;lb1,OSPF enabled&#xA;     IP Address 111.111.111.2, Area 0&#xA;     OSPF state DR, Pri 1, Cost 0, Options 2, Type broadcast Events 11&#xA;     Timers(sec): Transit 1, Retrans 5, Hello 10, Dead 40&#xA;     DR:  Router ID 111.111.111.2      Interface Address 111.111.111.2&#xA;     BDR: Router ID 0.0.0.0           Interface Address 0.0.0.0&#xA;     Neighbor Count = 0, Adjacent Neighbor Count= 0&#xA;&#xA;#sh ip route 111.111.111.0&#xA;Total number of IP routes: 262119, avail: 21 (out of max 262144)&#xA;        Destination     NetMask         Gateway         Port       Cost   Type&#xA;        111.111.111.0    255.255.255.252 0.0.0.0         lb1        1      D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="864" LastEditorUserId="864" LastEditDate="2013-07-25T16:34:08.103" LastActivityDate="2013-07-25T16:34:08.103" Title="loopback ip issue" Tags="|routing|router|ospf|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2503" PostTypeId="2" ParentId="2497" CreationDate="2013-07-25T14:24:33.540" Score="1" Body="&lt;p&gt;One possibility is if you want to QoS traffic upstream toward the CPE's gateway is to shape the traffic outbound, and then prioritise important traffic within that shaping bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is an 80/20 line and you know the average up speed is say 15Mbps, you could shape the outbound traffic to 15Mbps and prioritise voice within that 15Mbps. If sync speed drops a couple of Mbps it won't make a huge amount of difference. If sync speed rises up to 17Mbps, they will be short of a couple Mbps of upload bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use a config like the blow on some EFM lines. The EFM speed can vary due to line conditions, once installed though they seem to be very consistent. So in this example, this CPE is connected to 20/20 EFM line that actually reliably syncs at 10/10, the upload is shaped to 10Mbps.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any CM-VOICE-TRAFFIC&#xA; match access-group 100&#xA;!&#xA;policy-map PM-PRIORITISE-VOICE&#xA; class CM-VOICE-TRAFFIC&#xA;   set ip dscp ef&#xA;   priority 1000&#xA; class class-default&#xA;   fair-queue&#xA;!&#xA;policy-map PM-SHAPE-10M&#xA; class class-default&#xA;  shape average 10000000&#xA;  service-policy PM-PRIORITISE-VOICE&#xA;!&#xA;interface FastEthernet0/1&#xA; Description WAN Interface&#xA; bandwidth 10000&#xA; service-policy output PM-SHAPE-10M&#xA;!&#xA;access-list 100 remark Priority IP Destinations&#xA;access-list 100 permit ip 1.2.3.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's important that we shape here not rate-limit or police, so that traffic isn't dropped, it's &quot;shaped&quot; to the bandwidth available. Have a read of &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/qos/configuration/guide/qcfpolsh.html#wp1001122&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; Cisco page for some additional info.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-07-25T14:24:33.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2504" PostTypeId="2" ParentId="2502" CreationDate="2013-07-25T14:35:52.620" Score="7" Body="&lt;p&gt;Router1 and Router2 have a connected route when you configure the interfaces. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you configure the loopback that connected route isn't related to the ethernet interface for L3 to pass over. &lt;/p&gt;&#xA;" OwnerUserId="824" LastActivityDate="2013-07-25T14:35:52.620" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2505" PostTypeId="2" ParentId="2502" CreationDate="2013-07-25T16:15:53.407" Score="0" Body="&lt;p&gt;When you assign the IP to the ethernet interface as a &lt;code&gt;/30&lt;/code&gt;, The router sends out an ARP query for the MAC address of the neighbouring IP since it's on-link and thus requires a known MAC address in order to actually send packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you move the IP to loopback, obviously that is an internal, virtual interface that is not neighbouring anything and thus, nothing happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could get around this by creating a manual ARP entry and route for the neighbour IP, but there really isn't a sensible reason to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, consider using a /31 rather than a /30 - make sure that both devices are happy with it (most are) and you'll have saved yourself a couple of addresses.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-07-25T16:15:53.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2506" PostTypeId="2" ParentId="2500" CreationDate="2013-07-25T16:54:57.027" Score="12" Body="&lt;p&gt;&lt;strong&gt;Primary answer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA will perform MAC Address lookup when in transparent mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will do Route lookup only for the following reasons;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Traffic that originate from the ASA (Syslog for example).&lt;/li&gt;&#xA;&lt;li&gt;Traffic that is one hop away from the ASA with NAT enabled.&lt;/li&gt;&#xA;&lt;li&gt;VoIP and DNS traffic with inspection enabled and endpoint is one hop away from the ASA.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/fwmode.html#wp1245468&quot; rel=&quot;noreferrer&quot;&gt;Cisco's own doc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second situation in detail&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, source: &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/cfgnat.html#wp1102744&quot; rel=&quot;noreferrer&quot;&gt;Cisco's own doc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/EKCeX.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a nutshell, when the host 192.168.1.2 goes out to reach www.example.com, it will be NATed behind 209.165.201.15.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the packets come back, the destination is...of course...209.165.201.15. The transparent firewall will &quot;De-Nat&quot; the packet with destination 192.168.1.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since it does not have a MAC address for that specific host (because of the router between the host and the firewall) it will look in it's routing table and send the packets to 10.1.1.3.&lt;/p&gt;&#xA;" OwnerUserId="2172" LastEditorUserId="2172" LastEditDate="2013-07-25T18:23:30.223" LastActivityDate="2013-07-25T18:23:30.223" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2507" PostTypeId="2" ParentId="2495" CreationDate="2013-07-25T18:03:19.553" Score="3" Body="&lt;p&gt;One problem that I have experienced with cheap switches is that many don't have good &lt;a href=&quot;https://en.wikipedia.org/wiki/Auto_MDI/MDIX&quot; rel=&quot;nofollow&quot;&gt;Auto MDI/MDIX&lt;/a&gt; support. This means that the switch cannot detect the difference between crossover or straight-trough wiring and cannot adjust to the current wiring situation. The most common setup that I've seen is switches with some of each. Usually, the port marked 'uplink' is wired for crossover connections to other switches/routers, and other ports are setup for straight-through connections to client devices. I've also seen some switches that have a hardware toggle to change the wiring scheme of a port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would suggest is to experiment with &lt;a href=&quot;https://en.wikipedia.org/wiki/Ethernet_crossover_cable&quot; rel=&quot;nofollow&quot;&gt;crossover and straight-through cables&lt;/a&gt; and see if that fixes the issue for those ports. In the long term, inexpensive consumer hardware is just not equipped to deal with many use cases and you may want to look into upgrading as some commenters suggested. &lt;/p&gt;&#xA;" OwnerUserId="2063" LastActivityDate="2013-07-25T18:03:19.553" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2508" PostTypeId="2" ParentId="2499" CreationDate="2013-07-25T18:59:08.333" Score="5" Body="&lt;p&gt;If anything it may just need to reconverge. About 45 seconds of interruption IIRC. If you can, while you are changing it on all the switches anyway, use rapid PVST. That will allow for faster convergence. &lt;/p&gt;&#xA;" OwnerUserId="1923" LastActivityDate="2013-07-25T18:59:08.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2511" PostTypeId="2" ParentId="2495" CreationDate="2013-07-25T19:45:04.693" Score="1" Body="&lt;p&gt;As your switch doesn’t support MDX so use appropriate cable type, if other end is also switch then use cross cable&lt;/p&gt;&#xA;" OwnerUserId="2111" LastActivityDate="2013-07-25T19:45:04.693" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2512" PostTypeId="2" ParentId="2449" CreationDate="2013-07-25T19:59:33.070" Score="0" Body="&lt;p&gt;With your data&#xA;Colo to office A -  vlan 10&#xA;Colo to office B -  vlan 20&#xA;Vlan 10 used in coloration &amp;amp; 20 in office. &#xA;As a work around you can ask ISP to give u port with Access mode.  Which is to be transported to your switch in access mode,  u may modify vlan at Port as per your convenience &lt;/p&gt;&#xA;" OwnerUserId="2111" LastActivityDate="2013-07-25T19:59:33.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2513" PostTypeId="2" ParentId="2495" CreationDate="2013-07-25T20:05:28.753" Score="7" Body="&lt;p&gt;Just because some devices will link doesn't mean the switch isn't still bad.  Some NICs will be more tolerant of marginal signaling and/or timing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personal example... I have a Nortel ERS with a damaged clock circuit (power outage killed it.) I've verified with a scope that the clock for the second half of the switch is noisy and marginally out of spec.  As a result, some network cards will link, and actually function. However, most, including the other half of the switch and every other switch I have, &lt;em&gt;won't&lt;/em&gt;.  10M works fine, because the PHYs generate their own clock. 100M only works with &quot;loose&quot; NICs. 1000M won't even link with itself -- that signal is pure noise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheap switches are cheap for a reason.  I'm not going to say how many sub-50$ &quot;hubs&quot; I've thrown away.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-07-25T20:05:28.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2517" PostTypeId="2" ParentId="2108" CreationDate="2013-07-26T09:22:56.923" Score="-1" Body="&lt;p&gt;One of the workaround for this is to rate limit Torrent traffic by making specific set of Control list.&#xA;Soure Port and Destination IP ( your IP Pools).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exclude ports for common services like RDP ( Remote Desktop 3389), VNC, HTTP 8080 (subsitute to 80)&lt;/p&gt;&#xA;" OwnerUserId="2111" LastActivityDate="2013-07-26T09:22:56.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2518" PostTypeId="2" ParentId="2450" CreationDate="2013-07-26T13:40:36.680" Score="4" Body="&lt;p&gt;OK, from the top;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Down vote on your question from me; your question isn't clear enough based on your responses in comments to other peoples answer. You have assumed the solution is networking engineering related but you don't seem to know, and give the impression that you hope someone is going to give you the answer you need.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You have the following problem requirement;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;host1 and host2 are connected via router1 and router2 with two links&#xA;  between them. Each router duplicates every packet coming from hosts&#xA;  before forwarding them into both links simultaneously. Then either the&#xA;  peer router or the destination host IP stack take care of redundant&#xA;  packet elimination.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Unless your end host's connection to their local router is double the speed of the traffic going over a single link between &lt;code&gt;router1&lt;/code&gt; and &lt;code&gt;router2&lt;/code&gt;, which you haven't mentioned, your hosts will need two connections to their local router. There is &lt;strong&gt;NO&lt;/strong&gt; native software or product &lt;strong&gt;ANYWHERE&lt;/strong&gt; that can run on an end hosts and take two TCP streams down the same NIC or two separate ones and pull from an alternate stream missing packets from the first stream. How do I know this? Because that is not how networking works, IP &amp;amp; TCP simply weren't designed to work like that. There maybe products for duplicating packets, but these are a niche, not wide spread, becasue it's the wrong answer to the question.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Why is this such a bonkers request;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You seem to be trying to put a round peg into a square hole. My understanding of your problem requirement is that you want redundancy for your application's data travelling between to remote hosts. Data is sent twice end to end in case of a link failure. That is all you are protecting against here with dual TCP flows though, physical layer 1 failure. If there is a pause in sending a packet from one host to the other, it will be late arriving down both router-to-router links. If a transient problem occurs on one link but not the other, such as congestion, the router at the end of the link, would need to track both TCP streams simultaneously to see that when a packet arrives on link2 with the proceeding sequence number in its header, and nothing has arrived on link1, then the packet on link1 is late, and if it does turn up, it needs to drop it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if you find your self in a situation where there is congestion on link1 but no traffic is dropped, due to a good QoS schema, but it is queues, packets down link1 are now always behind link2. What if link2 fails now and the router passes packets on link1 to the end hosts, it's going to receive dup packets, and stop and retransmit etc, and cause a delay. Nothing was achieved here.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Moving on to a solution;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;A better idea in my opinion would be to have dual layer 2 links between the two end hosts, extending their broadcast domains to include each others NIC. You can do this via direct layer 2 interconnects, MPLS/VPLS extension, carrier layer 2 service, take you pick, that isn't strictly relevant here. Extending the layer 2 network between hosts means you don't need to mess with TCP or do any crazy black magic or band-aid type fixes. TCP will be completely agnostic of the underlying technology and you will still have you layer 1 / physical link redundancy.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you use an MPLS based solution you can use features like traffic engineering (MPLS-TE) to monitor the latency across the links and always use the link with the lowest latency. You can use BFD with MPLS FRR, which can get you 50ms~ fail over time between links. I know you said you don't want a redundancy fail over solution, but 50ms is pretty fast in my opinion. If your application can't handle a 50ms loss of connectivity, then you need to go back to the application drawing board. No system is up 100% of the time, you must plan for failures, planned maintenance, and outages through malicious intent / security related; to all occur at some point. You must be realistic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In one comment you said the following;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;well, IP SLA is the technology being used at least at one end so&#xA;  far... :) still it takes quite a time for both ends to detect link&#xA;  failure, and the application gets out of sync sometimes... and the&#xA;  links may be twinkling sometimes... that's why we are looking for&#xA;  something delay-free&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No such thing; Time must pass for possible events to become actualities. You need to re-think this to an &quot;acceptable&quot; level of delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also in another comment you said;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;BGP it takes quite a time to discover that the route deemed&#xA;  operational is now down; finally the routers realize this and switch&#xA;  active routes, but it takes time, and application-level protocol may&#xA;  suffer&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;BGP has a hello timer, this is detecting the the presence of it's immediate neighbour. Default is 30 seconds, I suspect this is what you are referring too. If both routers in your topology speak BGP with the ISP at each site or even directly to each other, over those peerings build IP-in-IP tunnels of GRE or L2TP(v3) tunnels between the two routers, over those tunnels run BFD or IP SLA. Now you can detect end-to-end connectivity loss in 1 or 2 seconds, and reroute to the other tunnel using tacking objects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, you seem to be mixing up different layers of technology. BGP isn't suppose to provide fast re-routing, TCP isn't supposed to be duplicated, and so on. You're looking at the wrong levels of abstraction to tackle this problem. I hope this has helped.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-07-28T11:49:34.713" LastActivityDate="2013-07-28T11:49:34.713" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="2520" PostTypeId="1" CreationDate="2013-07-26T19:13:37.347" Score="3" ViewCount="660" Body="&lt;p&gt;We made did a campus LAN upgrade recently, during which we migrated from a mixed EIGRP/OSPF IGP to a multi-area OSPF redistributing to/from BGP on our WAN.  We have two entry points on different sides of the campus with two different AS' numbers, so not running iBGP.  We accidentally introduced asymmetric routing to our WAN, which we bandaided with static routes.  We're working on changing the routing - using the same AS and running iBGP between the two routers to the WAN, sending community strings changing the provider's local pref, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question is:  Why did the asymmetric routing - going out router1, coming back router2 - why did it matter to the applications?  How do the applications know there's asymmetric routing?  What immediately broke for us was XEN desktops, and Microsoft Remote Desktop.  I can understand how the network would be able to tell with something like URPF, but why does it matter to applications and how do they know?&lt;/p&gt;&#xA;" OwnerUserId="892" LastEditorUserId="378" LastEditDate="2013-07-27T01:06:46.587" LastActivityDate="2013-07-27T04:39:40.307" Title="How do apps know about asymmetric routing?" Tags="|routing|asymmetric-routing|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2521" PostTypeId="2" ParentId="2499" CreationDate="2013-07-26T19:19:58.553" Score="2" Body="&lt;p&gt;Be aware - when you change your root, you'll cause a topology change, at which time all your STP will pause and recalculate.  While 45 seconds doesn't sound like very long - it's an eternity to the systems on your network, some of which think .15 seconds (150ms) is a long time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I caused a topology change accidentally on my &quot;storage&quot; vlan (NAS).  SQL servers lost their connection to NAS attached hard drives - and all crashed, which caused front end systems to crash.  It was a poor design, that was like that when I got there, and I stepped on a mine in the mine field - so I didn't get fired.  But the server team had to spend the rest of the day bringing servers back up.  Then they had to do it again, when we fixed spanning tree and it recalculated again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure to CYA - advise management, in writing, that this is highly risky to the uptime of the network, and make sure you get a change window, with an approved change control (with an OK from the Server Team management).  All of course depending on your network and environment.&lt;/p&gt;&#xA;" OwnerUserId="892" LastActivityDate="2013-07-26T19:19:58.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2522" PostTypeId="2" ParentId="2520" CreationDate="2013-07-26T19:24:30.757" Score="0" Body="&lt;p&gt;they shouldn't, and it shouldn't matter. Asymmetric routing is a feature of the Internet and it also happens outside your control, ie. upstream. I'd look at something else (blackholing?) for a root cause.&#xA;The only way asymmetric routing should matter is when using strict uRPF, but you've stated that already so I assume it's not that.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-07-26T19:24:30.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2526" PostTypeId="2" ParentId="2520" CreationDate="2013-07-27T00:48:24.637" Score="0" Body="&lt;p&gt;Async routing does not matter IF both links are the same from a bandwidth/latency/drops etc. It would be that 1 link is not as good as the other and the app never used it and now it does. Also if you are say redistribute into OSPF with E2 then both links will not include costs to get to them inside the campus so also consider the location relative to the location of the 2 links are they equidistant&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-07-27T00:48:24.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2527" PostTypeId="2" ParentId="2520" CreationDate="2013-07-27T04:39:40.307" Score="4" Body="&lt;p&gt;If you're doing NAT on your WAN routers, that would definitely get you.  You'd create a dynamic translation on Router1 as that is your best path to the destination.  The destination then uses a different path to get to the source, and uses Router2.  Router 2 has no NAT entry for that IP, and drops the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got my money on NAT issues.  Stupid NAT! =)&lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2013-07-27T04:39:40.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2529" PostTypeId="1" AcceptedAnswerId="2541" CreationDate="2013-07-27T16:25:06.253" Score="7" ViewCount="4097" Body="&lt;p&gt;Single Cisco IOS device in a remote DC, I have an &lt;a href=&quot;/tags/oob&quot; title=&quot;Out of Band&quot;&gt;OOB&lt;/a&gt; connection delivered into the rack (length of Cat5e into my rack from another onsite providers rack, who have diverse routes from my own, in and out of the building) which is simply a L3 connection to the Internet, a /29 is delivered down it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VTY access via Telnet or SSH is typically limited by an access list to on-net devices, with IPs local to the network/AS. This remote router is in a PoP with long-haul Ethernet circuits back to the core network. The OOB connection would be used in emergencies by off-net devices (such a broken link, dead IGP, etc), with connections coming from potentially any IP or Autonomous System around the world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we theorise that the device is configured as below, with the OOB interface configured with a public IP from the OOB connection provider;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface Fa0/2&#xA; Descriptioc OOB Connection&#xA; ip address 5.5.5.1 255.255.255.248&#xA;!&#xA;line vty 0 4&#xA; access-class 10&#xA;!&#xA;access-list 10 remark ACL-ON-NET-MANAGEMENT-IPS&#xA;access-list 10 permit 10.0.0.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is essential two really;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I handle a scenario during which the devices has a L3 melt down, and it can't route traffic out of the PoP because IGP has collapsed or similar; the routing table has emptied its self now containing only locally connected routes. &lt;strong&gt;If I'm on holiday and connect to the OOB IP from some Hotel Wi-fi, traffic isn't going to have a route back to my remote IP&lt;/strong&gt; if IGP has collapsed and the devices have lost their peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could put the OOB interface Fa0/2 into a VRF and add a static 0/0 route via the OOB provider gateway address within the /29 they have assigned to me. I could change the vty statement to be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; access-class 10 in vrf-also&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To allow management access from the VRF interface, but this will clash with my ACL. I would need to add 0/0 to the ACL, removing the point in having the ACL. &lt;strong&gt;Can I keep the ACL as it is, but allow any IP to connect when connecting to the OOB interface specifically?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps I can use a route-map some how to route any traffic that come in from the OOB interface back out via that gateway? Or don't use a VRF, and add a 0.0.0.0/0 route to the default table with metric 254, and add an ACL outbound on the OOB interface that only allows out traffic coming from TCP 22 from that interface's IP (so SSH management traffic). That way only management traffic would be allowed out? I'm lost for idea's here.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="49" LastEditDate="2013-07-29T14:40:20.450" LastActivityDate="2013-07-30T18:46:03.203" Title="How to configure OOB access via IP" Tags="|cisco|router|acl|oob|vrf|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2530" PostTypeId="2" ParentId="2477" CreationDate="2013-07-27T18:24:26.753" Score="6" Body="&lt;p&gt;Most forms of &amp;quot;QoS&amp;quot; these days do not include AQM as vendors found it too hard to configure RED automagically without doing harm. This leads to the horrendous delays you see on many common devices today, notably cable modems and wireless. So merely recommending &amp;quot;turning qos on&amp;quot;... doesn't help. In fact on at least one of Netgear's products, turning on the rate limiter for &amp;quot;QoS&amp;quot; leads to vastly worse results....&lt;/p&gt;&#xA;&lt;p&gt;Recently a new fair queueing + AQM algorithm has appear that does appear to work extremely well, and better, requires almost no configuration besides setting the rate limiter. It's called &lt;code&gt;fq_codel&lt;/code&gt;, and it is now widely available in most Linux (post linux kernel 3.5) and has been ported to BSD as well. It's part of the default &amp;quot;QoS&amp;quot; in openwrt barrier breaker, cerowrt, and gargoyle uses a (pretty good) earlier version called &lt;code&gt;sfqred&lt;/code&gt; with an innovative automatic rate adjusting scheme called ACC.&lt;/p&gt;&#xA;&lt;p&gt;So you can slam a box based on this in front of your misbehaving link, turn on their QoS rate limiter (set just slightly below your providers inbound and outbound settings so you take control) + &lt;code&gt;fq_codel&lt;/code&gt;, and get much better performance for everybody using it. I mean &lt;em&gt;astoundingly&lt;/em&gt; better: see the &lt;a href=&quot;http://www.bufferbloat.net/projects/cerowrt/wiki/Bloat-videos&quot; rel=&quot;nofollow noreferrer&quot;&gt;ietf demo&lt;/a&gt;, the report to the iccrg working group at the ietf, etc.&lt;/p&gt;&#xA;&lt;p&gt;For way more detail on the bufferbloat problem see &lt;a href=&quot;http://www.bufferbloat.net/projects/cerowrt/wiki/Bloat-videos&quot; rel=&quot;nofollow noreferrer&quot;&gt;the fixes for it&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;We are (of course) trying to convince various ISP CPE vendors to pay attention, as is cablelabs, which published a &lt;a href=&quot;http://www.cablelabs.com/downloads/pubs/Active_Queue_Management_Algorithms_DOCSIS_3_0.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;wonderful study of this new stuff&lt;/a&gt; a few months back, which also contains some detail on the current misbehavior of cable modems in particular.&lt;/p&gt;&#xA;" OwnerUserId="2192" LastEditorUserId="775" LastEditDate="2024-02-24T12:53:10.503" LastActivityDate="2024-02-24T12:53:10.503" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2532" PostTypeId="1" CreationDate="2013-07-28T06:31:09.797" Score="8" ViewCount="4448" Body="&lt;p&gt;From what I understand, there is no way to change the prefix lifetime once hosts install the prefix. If I shorten the valid/preferred timer for a prefix, it has no effect on hosts already using the prefix with &lt;a href=&quot;/tags/slaac&quot; title=&quot;StateLess Address AutoConfiguration&quot;&gt;SLAAC&lt;/a&gt; until the host tries to renew the address? Unlike RA lifetime (for purpose of default gateway), RA lifetime gets extended upon receiving a RA message. Can someone point me to the RFC section for prefix/default-gateway renewal process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to achieve is to delete a SLAAC prefix through the network before the valid lifetime expires, is there any way to do it? Either router side or access/host side. I tested on IOS 12.4 even shut/no shut an interface won't remove the prefix learned from SLAAC. I can configure another prefix but I don't want hosts to continue using the old one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I saw somewhere RA with a prefix lifetime=0 can mark a prefix for deletion, is this an RFC or just some vendor specific thing? If there is such a thing, how can I force this message to be regenerated in case some hosts missed the first one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the guideline for configuring RA/prefix lifetime? How short can it be? HA design considerations? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="49" LastEditDate="2013-07-29T14:41:50.727" LastActivityDate="2015-02-23T14:48:27.320" Title="IPv6 RA SLAAC prefix lifetime" Tags="|ipv6|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2533" PostTypeId="1" AcceptedAnswerId="2536" CreationDate="2013-07-28T14:33:33.987" Score="18" ViewCount="66043" Body="&lt;p&gt;For Cisco routers and switches, is there a show command, or something similar, that will display what physical and logical interfaces an ACL is implemented on and what direction it is applied in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking for something simpler than a &lt;code&gt;show run | &amp;lt;some regex&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2016-10-28T19:42:06.793" Title="Cisco command to show which interfaces an ACL is applied to" Tags="|cisco|switch|router|acl|interface|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2535" PostTypeId="2" ParentId="2533" CreationDate="2013-07-28T17:27:55.720" Score="0" Body="&lt;p&gt;&lt;code&gt;show ip interface&lt;/code&gt; should do the trick.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastEditorUserId="44" LastEditDate="2013-07-28T18:12:46.650" LastActivityDate="2013-07-28T18:12:46.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2536" PostTypeId="2" ParentId="2533" CreationDate="2013-07-28T17:44:14.127" Score="19" Body="&lt;p&gt;I don't believe that there is anything simpler than &lt;code&gt;show interfaces | &amp;lt;some regex&amp;gt;&lt;/code&gt; unfortunately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the comments below, @&lt;a href=&quot;https://networkengineering.stackexchange.com/users/460/santino&quot;&gt;Santino&lt;/a&gt; pointed out a more concise RegEx:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip interface | include line protocol|access list&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My testing so far indicates that this gives the same results as my longer RegEx below.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I usually use the following to find where ACLs are applied:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip interface | include is up|is administratively|is down|Outgoing|Inbound&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This gives you every interface, no matter the state, then what the Outbound and Inbound ACL's are.  For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LAB-4510-A#show ip interface | include is up|is administratively|is down|Outgoing|Inbound &#xA;Vlan1 is administratively down, line protocol is down&#xA;Vlan110 is up, line protocol is up&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is VENDOR-&amp;gt;INTERNET&#xA;Vlan140 is administratively down, line protocol is down&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;Vlan150 is down, line protocol is down&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is VENDOR-&amp;gt;INTERNET&#xA;Vlan210 is up, line protocol is up&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;FastEthernet1 is administratively down, line protocol is down&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;GigabitEthernet1/1 is up, line protocol is up&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;GigabitEthernet1/2 is down, line protocol is down&#xA;  Inbound  access list is not set&#xA;  Outgoing access list is not set&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And so on for every interface.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This command works on both Cisco switches and routers.  See sample output from a 7200 Router below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LAB-7204-A#show ip interface | include is up|is administratively|is down|Outgoing|Inbound&#xA;GigabitEthernet0/1 is up, line protocol is up&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;FastEthernet0/2 is administratively down, line protocol is down&#xA;GigabitEthernet0/2 is up, line protocol is up&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;GigabitEthernet0/3 is administratively down, line protocol is down&#xA;SSLVPN-VIF0 is up, line protocol is up&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;Loopback0 is up, line protocol is up&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;Loopback1 is up, line protocol is up&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-07-28T18:09:48.827" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2537" PostTypeId="2" ParentId="2533" CreationDate="2013-07-28T18:08:06.863" Score="3" Body="&lt;p&gt;If you have a &lt;code&gt;show run | &amp;lt;some regex&amp;gt;&lt;/code&gt; command you like that displays the information you need, you could always make an alias.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example using this command: &#xA;&lt;code&gt;alias exec shacls sh ip int | inc line protocol|access list is [^ ]+$&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can just use &lt;code&gt;alias-name&lt;/code&gt; (in this instance shacls) and it will be the same as &lt;code&gt;show run | &amp;lt;some regex&amp;gt;&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; You would need to do this on each IOS device.  ASAs are slightly different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I can't take credit for &lt;code&gt;sh ip int | inc line protocol|access list is [^ ]+$&lt;/code&gt; as that was from &lt;a href=&quot;http://packetlife.net/wiki/ios-tips/&quot; rel=&quot;nofollow&quot;&gt;PacketLife IOS Tips&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="9" LastEditorUserId="9" LastEditDate="2013-07-28T18:13:37.960" LastActivityDate="2013-07-28T18:13:37.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2541" PostTypeId="2" ParentId="2529" CreationDate="2013-07-29T06:59:21.507" Score="2" Body="&lt;p&gt;Depending on the hardware you're talking about you should take different considerations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance Cisco provides a dedicated set of port/RAM and flash for OOB access on SUP2T, so you would be able to access to your device even when RP hangs. OTOH, in some Juniper boxes, the management port is attached directly to the RE and so you should easily hang your router from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, I would recommend you to put a management CPE between your devices and your OOB internet access and set up a GRE tunnel between it and your central management server.&lt;/p&gt;&#xA;" OwnerUserId="530" LastActivityDate="2013-07-29T06:59:21.507" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2542" PostTypeId="1" AcceptedAnswerId="2543" CreationDate="2013-07-29T08:03:38.093" Score="10" ViewCount="39164" Body="&lt;h1&gt;Context&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I've deployed a standard QoS config to a customer site running a Cisco 891 router with IOS 15.1(4)M4. The WAN link is a single ADSL2+ link (24/1Mbps) connected to FE8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've previously tested this configuration at another site by using iperf from the LAN to generate 1+ Mbps of upstream traffic and confirmed a noticeable change in call quality when enabling QoS on the WAN interface. This is how I initially confirmed my configuration worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've recently deployed this same configuration to another site, but they are still having issues with upstream VOIP bandwidth. I would like to reasonably confirm that QoS is working without going to the effort of actually saturating the link (particularly because they are out of state, and there's no tech onsite). And then try and isolate what I might be able to teak to get better voice quality.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Questions&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Given the policy-map output below, focusing specifically on the VOICE class-map as an example, what do the following statistics mean?:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;3860628 packets, 1070196895 bytes:&lt;/em&gt; Can I assume that this is the total number of packets/bytes matched in the class-map?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;5 minute offered rate 0 bps, drop rate 0 bps:&lt;/em&gt; Is the &quot;offered rate&quot; the rate in bps of traffic that has been prioritised, if not then what? And similarly, is the drop rate the excess rate of traffic that could not be prioritised due to lack of bandwidth? Would that then indicate that we need X bps more bandwidth for VOICE to accommodate such traffic peaks?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;Priority: 40% (340 kbps), burst bytes 8500, b/w exceed drops: 5:&lt;/em&gt; In this line, I'm unsure what b/w exceed drops means?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Logging&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Given that these statistics are likely to change (I imagine) during peak times (which is when you'd most want to see them). Is there some way that I can log these numbers, or perhaps query them via SNMP so they can be graphed programmatically?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Learning&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I understand that QoS is a fairly wide-ranging topic. When trying to learn about this, I am often being overwhelmed by different information either because I'm reading about different types of QoS implementations, or because of differing IOS verions (eg. Older docs using commands where the syntax or output has changed). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To this end, can anyone recommend some Cisco training docs or video courses that might help me focus in on getting a better grip on working with QoS?&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Some additional Info&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Here's a sample QoS config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any SSH&#xA; match protocol ssh&#xA;class-map match-any LogMeIn&#xA; match access-group name LogMeIn&#xA;class-map match-any VOICE&#xA; match protocol sip&#xA; match protocol rtp&#xA;&#xA;policy-map ADSLPrioritisationOutbound&#xA; class VOICE&#xA;  priority percent 40&#xA; class SSH&#xA;  bandwidth 80&#xA; class LogMeIn&#xA;  priority percent 20&#xA; class class-default&#xA;  fair-queue&#xA;policy-map ADSLPrioritisationOutboundParent&#xA; class class-default&#xA;  shape average 850000&#xA;  service-policy ADSLPrioritisationOutbound&#xA;&#xA;interface FastEthernet8&#xA; no ip address&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; pppoe-client dial-pool-number 1&#xA; service-policy output ADSLPrioritisationOutboundParent&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And policy-map interface output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet8&#xA;&#xA;Service-policy output: ADSLPrioritisationOutboundParent&#xA;&#xA;Class-map: class-default (match-any)&#xA;  18968101 packets, 6998385051 bytes&#xA;  5 minute offered rate 3000 bps, drop rate 0 bps&#xA;  Match: any&#xA;  Queueing&#xA;  queue limit 64 packets&#xA;  (queue depth/total drops/no-buffer drops) 0/93737/0&#xA;  (pkts output/bytes output) 18874363/6936577128&#xA;  shape (average) cir 850000, bc 3400, be 3400&#xA;  target shape rate 850000&#xA;&#xA;  Service-policy : ADSLPrioritisationOutbound&#xA;&#xA;    queue stats for all priority classes:&#xA;&#xA;      queue limit 64 packets&#xA;      (queue depth/total drops/no-buffer drops) 0/0/0&#xA;      (pkts output/bytes output) 3860623/1070194985&#xA;&#xA;    Class-map: VOICE (match-any)&#xA;      3860628 packets, 1070196895 bytes&#xA;      5 minute offered rate 0 bps, drop rate 0 bps&#xA;      Match: protocol sip&#xA;        97348 packets, 49867304 bytes&#xA;        5 minute rate 0 bps&#xA;      Match: protocol rtp&#xA;        3763280 packets, 1020329591 bytes&#xA;        5 minute rate 0 bps&#xA;      Match: access-group name NEC-PBX&#xA;        0 packets, 0 bytes&#xA;        5 minute rate 0 bps&#xA;      Priority: 40% (340 kbps), burst bytes 8500, b/w exceed drops: 5&#xA;&#xA;&#xA;    Class-map: SSH (match-any)&#xA;      89497 packets, 19838544 bytes&#xA;      5 minute offered rate 2000 bps, drop rate 0 bps&#xA;      Match: protocol ssh&#xA;        89497 packets, 19838544 bytes&#xA;        5 minute rate 2000 bps&#xA;      Queueing&#xA;      queue limit 64 packets&#xA;      (queue depth/total drops/no-buffer drops) 0/0/0&#xA;      (pkts output/bytes output) 89497/19838544&#xA;      bandwidth 80 kbps&#xA;&#xA;    Class-map: LogMeIn (match-any)&#xA;      0 packets, 0 bytes&#xA;      5 minute offered rate 0 bps, drop rate 0 bps&#xA;      Match: access-group name LogMeIn&#xA;        0 packets, 0 bytes&#xA;        5 minute rate 0 bps&#xA;      Priority: 20% (170 kbps), burst bytes 4250, b/w exceed drops: 0&#xA;&#xA;&#xA;    Class-map: class-default (match-any)&#xA;      15017976 packets, 5908349612 bytes&#xA;      5 minute offered rate 0 bps, drop rate 0 bps&#xA;      Match: any&#xA;      Queueing&#xA;      queue limit 64 packets&#xA;      (queue depth/total drops/no-buffer drops/flowdrops) 0/93732/0/93732&#xA;      (pkts output/bytes output) 14924243/5846543599&#xA;      Fair-queue: per-flow queue limit 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="846" LastEditorUserId="44" LastEditDate="2013-07-29T12:39:23.510" LastActivityDate="2013-07-29T12:39:23.510" Title="How can I reasonably verify my QoS configuration is working?" Tags="|cisco|qos|cisco-ios|voip|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2543" PostTypeId="2" ParentId="2542" CreationDate="2013-07-29T08:29:49.373" Score="10" Body="&lt;p&gt;Your question's pretty broad.  There's a lot of different commands you can use to troubleshoot and monitor QoS, so I'll focus on the primary question you have, which is how to reasonably verify your QoS configuration is working and how to read the policy-map interface output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only &lt;em&gt;true&lt;/em&gt; way to verify that QoS is working is to hook up a traffic generator and monitor your drop rate in various queues.  Since that isn't typically feasible, particularly in a production environment, all you can really do is verify that the traffic is being marked and classified properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you're really looking for, when it comes to verifying if your QoS configuration is working, is for the counters in the policy-map interface command to increment.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for example, in the output your provided:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Class-map: VOICE (match-any)&#xA;  3860628 packets, 1070196895 bytes&#xA;  5 minute offered rate 0 bps, drop rate 0 bps&#xA;  Match: protocol sip&#xA;    97348 packets, 49867304 bytes&#xA;    5 minute rate 0 bps&#xA;  Match: protocol rtp&#xA;    3763280 packets, 1020329591 bytes&#xA;    5 minute rate 0 bps&#xA;  Match: access-group name NEC-PBX&#xA;    0 packets, 0 bytes&#xA;    5 minute rate 0 bps&#xA;  Priority: 40% (340 kbps), burst bytes 8500, b/w exceed drops: 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that you're seeing packets under SIP and RTP, but not NEC-PBX.  If you know you're getting SIP and RTP traffic across a link, you should see the packet counts increment and that's a reasonable way to know that your configuration is basically working.&lt;/p&gt;&#xA;" OwnerUserId="2065" LastActivityDate="2013-07-29T08:29:49.373" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2544" PostTypeId="1" AcceptedAnswerId="2550" CreationDate="2013-07-29T12:49:13.653" Score="7" ViewCount="18615" Body="&lt;p&gt;I have the following configuration on an ASA running 8.4 already;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network SERVER-01&#xA; host 192.168.0.1&#xA;!&#xA;object network SERVER-01&#xA; nat (Inside,Outside) static interface service tcp 3389 5001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have this config repeated several times to allow RDP to multiple machines behind the ASA, on different ports; 5001 forwards to one server, 5002 to another, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this one server in the above config though, I want to forward port 5555 publicly to port 5555 at the same private IP, 192.168.0.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try to enter the above config but with different port numbers, it is overwritten, &lt;strong&gt;I can't seem to &lt;em&gt;add&lt;/em&gt; an additional NAT entry, only replace that one&lt;/strong&gt;. This indicates I can only have one port forwarded to each internal IP at a time. Is that correct, or can I forward various public ports to an internal host, but using some other method? If so, how?&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-07-29T13:39:35.650" Title="Cisco ASA 8.4(3); NAT multiple ports on public IP to private IP" Tags="|cisco|cisco-asa|nat|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2545" PostTypeId="5" CreationDate="2013-07-29T12:53:22.340" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_Routing_and_Forwarding&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt; page - This tag is for discussing Virtual Routing and Forwarding (creating, using and troubleshooting virtual FIBs/routing tables, on a device) with MPLS (in Cisco terminology this is acronym instead means &lt;em&gt;VPN Routing and Forwarding&lt;/em&gt;) and without MPLS which is typically called VRF-Lite.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-07-29T14:05:41.720" LastActivityDate="2013-07-29T14:05:41.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2546" PostTypeId="4" CreationDate="2013-07-29T12:53:22.340" Score="0" Body="Questions relating to the usage of Virtual Routing and Forwarding and VPN Routing and Forwarding." OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-07-29T14:05:30.890" LastActivityDate="2013-07-29T14:05:30.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2547" PostTypeId="5" CreationDate="2013-07-29T12:58:44.207" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Out-of-band&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt; page - OoB has different meanings for telecommunications and computer networking communications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In computer networking and communication OOB typically refers to a physically separate network to a production network, that provides emergency access for network operators to the main production networking, during a systems failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For telecommunications out-of-band communication is typically referring to the exchange of call control information in a separate band from the data or voice stream, or on an entirely separate, dedicated channel.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="8499" LastEditDate="2016-11-29T19:10:52.867" LastActivityDate="2016-11-29T19:10:52.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2548" PostTypeId="4" CreationDate="2013-07-29T12:58:44.207" Score="0" Body="For questions about Out-of-Band (OoB); Emergency and/or recovery network elements, that form a separate network from them production network, to provide access and control contingency." OwnerUserId="253" LastEditorUserId="8499" LastEditDate="2016-11-29T19:10:09.277" LastActivityDate="2016-11-29T19:10:09.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2549" PostTypeId="2" ParentId="2544" CreationDate="2013-07-29T13:30:51.837" Score="5" Body="&lt;p&gt;Create a second object with the same host &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network SERVER-02&#xA; host 192.168.0.1&#xA;!&#xA;object network SERVER-02&#xA; nat (Inside,Outside) static interface service tcp 5555 5555&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="460" LastEditorUserId="460" LastEditDate="2013-07-29T13:39:35.650" LastActivityDate="2013-07-29T13:39:35.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2550" PostTypeId="2" ParentId="2544" CreationDate="2013-07-29T13:31:27.793" Score="8" Body="&lt;p&gt;Unfortunately from the &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/nat_objects.html#wp1103116&quot;&gt;Configuring Network Object NAT&lt;/a&gt; documentation for 8.4 it states&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You can only define a single NAT rule for a given object; if you want to configure multiple NAT rules for an object, you need to create multiple objects with different names that specify the same IP address, for example, object network obj-10.10.10.1-01, object network obj-10.10.10.1-02, and so on.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So you will have to create multiple objects with the same host just different names.&lt;/p&gt;&#xA;" OwnerUserId="9" LastActivityDate="2013-07-29T13:31:27.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2553" PostTypeId="1" CreationDate="2013-07-29T18:18:42.777" Score="6" ViewCount="405" Body="&lt;p&gt;I have the following setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Distro Switch 1 &amp;lt;-&amp;gt; Distro Switch 2&#xA;                 ||&#xA;                 ||&#xA;           Access Switch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One cable is going from port 47 to Distro switch 1 and another is going from port 48 to Distro switch 2.  Vlan 1  is configured for this particular example.  There is an LACP trunk setup btw the distro switches to pass vlan traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, If both 47+48 are enabled on the access switch, I thought one of the ports would go into a blocking state.  That is not the case.  Both ports stay forwarding.  If I do a show spanning-tree vlan 1, I do not see any trunk ports in the vlan on any of the switches.  Is there something I'm missing on the trunk configuration for this to work properly?  Ultimate goal is for redundancy for the access switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw, I am running 802.1w.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am running Foundry SX's for the distro switches and have a cisco 3550 for the access switch.&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="775" LastEditDate="2013-07-29T18:35:19.487" LastActivityDate="2013-07-29T19:32:46.180" Title="Spanning tree question" Tags="|cisco|ethernet|spanning-tree|foundry|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2556" PostTypeId="2" ParentId="2553" CreationDate="2013-07-29T18:53:45.883" Score="9" Body="&lt;p&gt;I am assuming several things since there are some points missing. You did not configure anything except for LACP ether-channel between the distro switches. NOTE: LACP is ether-channel protocol not trunking protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to check several for several things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Ports 47 and 48 are trunks (either statically configured or negotiated through DTP) check on both sides the distro switches and cisco side. &lt;code&gt;sh int trunk&lt;/code&gt; should list 47 - 48&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the ports are trunk, but the &lt;code&gt;sh spanning tree vlan 1&lt;/code&gt; does not include them make sure that VLAN 1 is allowed on that trunk. If it is not, these ports will not show up in &lt;code&gt;sh spanning vlan 1&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now as for why both ports stay in forwarding, it could be a simple issue of which switch is becoming the root bridge, that is cisco 3550, since both of the ports stay forwarding. You need to configure bridge priorities on distro switches so that one of them becomes root bridge and the other becomes secondary root bridge. This way you will now for sure that cisco 3550 s port 48 will become blocked if the root bridge will be the distro 1 switch and the secondary will be the distro 2 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also try without the ether-channel to eliminate some possible miss-configuration issues or bugs.&lt;/p&gt;&#xA;" OwnerUserId="1401" LastEditorUserId="76" LastEditDate="2013-07-29T19:32:46.180" LastActivityDate="2013-07-29T19:32:46.180" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2557" PostTypeId="1" CreationDate="2013-07-30T06:28:05.010" Score="3" ViewCount="160" Body="&lt;p&gt;I am trying to develop a server-client paradigm based application suite. I am planning the app to work with both tcp and sctp protocol support. Now my question is if any of the TCP/SCTP packet is lost, then should I explicitly maintain application level re-transmission mechanism? Or re-transmission is handled by the TCP/SCTP protocol?&lt;/p&gt;&#xA;" OwnerUserId="2212" LastActivityDate="2014-11-17T12:13:57.170" Title="Is application level re-transmission needed for TCP and SCTP" Tags="|tcp|sctp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2558" PostTypeId="2" ParentId="2557" CreationDate="2013-07-30T06:50:08.113" Score="9" Body="&lt;p&gt;Retransmission is handled by the underlying transport protocol, so no you don't have to worry about it.&lt;/p&gt;&#xA;" OwnerUserId="1682" LastActivityDate="2013-07-30T06:50:08.113" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2559" PostTypeId="1" AcceptedAnswerId="2562" CreationDate="2013-07-30T08:05:52.843" Score="5" ViewCount="591" Body="&lt;p&gt;I am not able to find information on BHH; I got this link to &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-bhh-mpls-tp-oam-y1731-04&quot; rel=&quot;nofollow noreferrer&quot;&gt;draft-bhh-04&lt;/a&gt; but was not able to understand the operation/function of BHH.&lt;/p&gt;&#xA;&lt;p&gt;If you guys have any info on above topics please let me know.&lt;/p&gt;&#xA;" OwnerUserId="2213" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-07-30T10:58:51.377" Title="Need information on MPLS-TP, BHH &amp; BFD" Tags="|mpls|network-core|mpls-tp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2560" PostTypeId="1" AcceptedAnswerId="2561" CreationDate="2013-07-30T08:11:02.923" Score="4" ViewCount="1250" Body="&lt;p&gt;I know that Cisco gear can do this, but can a Procurve be made to do it as well?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a scenario of around 16 access switches, one switch per building, connected to two aggregation/core switches all via a redundant set of 10 Gbps uplinks. Each switch has one link to one of the two cores. I was thinking of creating multiple VLANs per access switch (one per floor), then using InterVLAN routing on the switch for inter-floor communications, then aggregating traffic on the upper half of the floors on the 10GigE link going to Core1, and the lower half going on the 10GigE link to Core2, with said VLANs failing over to the other link in case a core goes down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The core switches handle InterVLAN communications between buildings, and the two HyperV nodes connect directly via two 10GigE links to the core, one link to one core switch. Ideally I'd do load balancing as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm used to cisco gear, so I'm not really sure if this is feasible or even recommended. Any tips?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: To clarify - everything is procurve, both access and aggregation switches. From what I understand, if STP is enabled and you have two links to a root switch, one is set to forwarding and one is set to backup per VLAN, which can result in all VLAN traffic &quot;congealing&quot; to a single 10GigE link. I would like to configure differing root switches per VLAN so that the traffic across the network is semi-distributed across the two links, basically balancing by source subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, each switch has a link to the Hyper-V cluster nodes (2 nodes). I believe LACP on 10GigE NICs for Windows Server 2008 R2 is still a bit problematic, so I plan on manually tuning things, unless of course LACP for Intel 10GigE cards on Procurve 5406'es are okay now?&lt;/p&gt;&#xA;" OwnerUserId="2214" LastEditorUserId="2214" LastEditDate="2013-07-31T00:56:15.980" LastActivityDate="2016-03-02T19:48:38.633" Title="HP Procurve 5406 Traffic Control Via VLANs and STP" Tags="|switch|vlan|design|throughput|hp-procurve|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2561" PostTypeId="2" ParentId="2560" CreationDate="2013-07-30T09:25:59.053" Score="3" Body="&lt;p&gt;You can do virtually anything Cisco does on ProCurves. It's just a tiny little bit of a different logic when implementing the configuration. You can setup VRRP (and of course different STP root bridges) on distribution layer switches, which will perform inter-vlan routing, to load balance the traffic from different VLANs between the switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, you can set one switch as a VRRP master for 1,3,5 floor VLANs and the second one for 2,4 floor VLANs or similar.&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="2093" LastEditDate="2016-03-02T19:48:38.633" LastActivityDate="2016-03-02T19:48:38.633" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2562" PostTypeId="2" ParentId="2559" CreationDate="2013-07-30T10:58:32.013" Score="6" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;I am not able to find information on BHH; I got this link to &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-bhh-mpls-tp-oam-y1731-04&quot; rel=&quot;nofollow noreferrer&quot;&gt;draft-bhh-04&lt;/a&gt; but was not able to understand the operation/function of BHH.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;We are stepping into territory that is very divisive and opinionated.  My intent is just to provide information about the question.  A very good overview of all the issues (from a US carrier's perspective) can be found in &lt;a href=&quot;http://www.ieeeboston.org/publications/society_presentations/Andrew%20Malis%20MPLS-TP%20IEEE.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Andrew Malis' MPLS-TP presentation&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;BHH&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-bhh-mpls-tp-oam-y1731-08&quot; rel=&quot;nofollow noreferrer&quot;&gt;draft-bhh&lt;/a&gt; refers to an &lt;a href=&quot;http://en.wikipedia.org/wiki/MPLS-TP&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS-TP&lt;/a&gt; fault-signalling approach that uses &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1ag#Y.1731&quot; rel=&quot;nofollow noreferrer&quot;&gt;ITU-T Y.1731&lt;/a&gt; OAM signalling that the ITU added to the original &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1ag&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethernet OAM (IEEE 802.1ag)&lt;/a&gt; standard.  &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-bhh-mpls-tp-oam-y1731-08&quot; rel=&quot;nofollow noreferrer&quot;&gt;draft-bhh&lt;/a&gt; is endorsed by China Mobile, China Telecomm and Telecomm Italia as their preferred solution to a very long and involved battle over industry standards; ZTE / Huawei / Alcatel already support implementations of &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-bhh-mpls-tp-oam-y1731-08&quot; rel=&quot;nofollow noreferrer&quot;&gt;draft-bhh&lt;/a&gt; (and the aforementioned carriers already have their equipment).  It is supposed to comply with &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5860&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5860 - MPLS-TP OAM Requirements&lt;/a&gt; and it falls under &lt;a href=&quot;http://www.itu.int/rec/T-REC-G.8113.1/en&quot; rel=&quot;nofollow noreferrer&quot;&gt;ITU-T G.8113.1&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Bonus material: BFD&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The competing proposal to &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-bhh-mpls-tp-oam-y1731-08&quot; rel=&quot;nofollow noreferrer&quot;&gt;draft-bhh&lt;/a&gt; is &lt;a href=&quot;http://www.itu.int/rec/T-REC-G.8113.2/en&quot; rel=&quot;nofollow noreferrer&quot;&gt;ITU-T G.8113.2&lt;/a&gt;, which is based on BFD + other fault isolation / management protocols.  This approach is favored by many US carriers, but vendor implementations are still baking.  There have been some demonstrations of the technology by Cisco / Ixia.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-07-30T10:58:32.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2563" PostTypeId="1" AcceptedAnswerId="2564" CreationDate="2013-07-30T11:48:51.590" Score="3" ViewCount="25687" Body="&lt;p&gt;If I have a layer 2 switch, is it possible to access two VLANs from one computer?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN1: 192.168.1.x with netmask 255.255.255.0&lt;/li&gt;&#xA;&lt;li&gt;VLAN2: 192.168.2.x with netmask 255.255.255.0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If my computer has only one NIC, can it be connected to both VLANs? IF I had two NICs, I know I could do it using two cables, but how to do it with a Layer 2 switch - Cisco 2950?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OS: Windows 7 Professional&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal: make a computer access the engineering and the production VLANs to use some NAS and to print in a specific printer &lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="775" LastEditDate="2013-07-31T01:23:01.280" LastActivityDate="2013-07-31T10:00:12.683" Title="Is it possible to access more than one VLAN?" Tags="|ethernet|vlan|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2564" PostTypeId="2" ParentId="2563" CreationDate="2013-07-30T12:02:58.810" Score="11" Body="&lt;p&gt;You could access the two VLANs via a 802.1q trunk on the switchport connected to the computer. The NIC would have to be able to tag packets and recognize tagged packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The L2 switch by itself will not allow you to communicate between the two VLANs. You would need a router.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-07-30T12:02:58.810" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2565" PostTypeId="2" ParentId="2563" CreationDate="2013-07-30T12:37:56.640" Score="6" Body="&lt;p&gt;First you have to use 802.1q trunking on the switchport:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk encapsulation dot1q&#xA;(switchport trunk native vlan 1)&#xA;switchport trunk allowed vlan 2-4094&#xA;switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you have to configure your NIC to recognize and send tagged packets. On some Broadcom NICs for example you can do this with a windows utility. With Linux you can configure the kernel to support 802.1q and create virtual NICs for each vlan. Can you give some more details about what you want to achieve and what OS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: For windows you have to check if your NIC supports vlan tagging. Many Intel and Broadcom NICs do...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check in the driver settings of you NIC if there is a field like &quot;vlan trunk&quot; or anything similar and/or check the manual of your NIC. Sometime you also need a special driver for this. I maybe can give you some more detailed information if you can tell me what NIC you have exactely...&lt;/p&gt;&#xA;" OwnerUserId="2112" LastEditorUserId="2112" LastEditDate="2013-07-31T10:00:12.683" LastActivityDate="2013-07-31T10:00:12.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2567" PostTypeId="1" CreationDate="2013-07-30T16:01:39.387" Score="5" ViewCount="12940" Body="&lt;p&gt;This scenario is a network with four routers in a square; each has a connection to a different transit provider with a full BGP table from each.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1----R2&#xA;|     |&#xA;|     |&#xA;R3----R4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;How do I calculate the (BGP) memory requirement for one of these routers? (not including IGP and LDP/RSVP etc)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example network all routers are Cisco 7301's with NPE-G1. Graphing the memory usage on them, they are all currently around the 500MB mark of used RAM, and the BGP table is approaching 500k prefixes (circa 470k at the time of writing). I know there is typically a margin of deviation here, but is there a rough way I can calculate how much memory a router needs if it is going to take a full BGP feed. It only needs to be rough, because if say 500k prefixes requires 500MBs, and 600k prefixes requires 600MBs of RAM, I'm not going to drop in a router that has exactly that much RAM, otherwise it has no growth room. So I'm after a rough method. Lets say I want to add a 5th router into this ring between R3 &amp;amp; R4, connected to another transit provider with a full BGP table feed; &lt;strong&gt;How do I work out how much RAM that router needs?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-08-01T05:07:10.340" Title="Calculating Cisco router memory requirements for full BGP feeds" Tags="|cisco|bgp|memory|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2568" PostTypeId="1" AcceptedAnswerId="2654" CreationDate="2013-07-30T16:17:46.577" Score="6" ViewCount="5314" Body="&lt;p&gt;This scenario is a network with four routers in a square; each has a connection to a different transit provider with a full BGP table from each.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1----R2&#xA;|     |&#xA;|     |&#xA;R3----R4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;How do full BGP feeds affect the memory requirement of the routers in the ring, other than the router receiving the full feed?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All four routers here take full feeds from different providers, and are iBGP meshed (you can imagine diagonal lines join R1 &amp;amp; R4, and R2 &amp;amp; R3, my ASCII art isn't brilliant).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iBGP peers send each other all eBGP routes so, R1 receives full table from upstream1. R2 receives a full feed from upstream2. R2 will send R1 all its external routes and vice versa. For any received routes that are better via upstream2, R1 will place into it's FIB, and send traffic to R2. And so on and so fourth, for all four routers and upstream providers. Now, for traffic that has a better path via upstream3, it will be sent via R3,  even when it comes from a device attached to R1. That is the beauty of BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets just use R1 and R2 to keep it simple for now, and they are booth bringing up BGP peerings for the first time;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When R1's BGP session with upstream1 first establishes, it receives BGP updates from upstream1, it processes the routes and they progress from BGP RIB into the FIB.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;All of these routes on R1 are now passed to R2 via iBGP, and R2 pushes them all from its BGP RIB into FIB (these are the only external routes it has at present).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;R2's session with upstream2 comes up and upstream2 sends BGP updates to R2. At this point, does R2 compare the routes in it's BGP RIB, keeping the better ones, drop the lesser ones, than it has from upstream1, and push the replaced better ones into FIB (assuming no better routes in FIB from other routing protocols or sources). &lt;strong&gt;Does R2's BGP RIB still only contains one full BGP table at this point, but its a mix of both upstream providers table views?&lt;/strong&gt; Is the correct?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The same now happens in reverse, with R2 sending updates to R1. R1 ends up with the same BGP view.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Am I correct that unless &lt;code&gt;soft-reconfiguration inbound&lt;/code&gt; or something similar is configured, any router in this square only holds the equivalent of one full table? What change in memory requirements would enabling &lt;code&gt;soft-reconfiguration inbound&lt;/code&gt; here make, would each router hold 4 full tables and need 4 times as much memory?&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="530" LastEditDate="2013-07-30T17:59:43.123" LastActivityDate="2013-08-06T11:57:24.493" Title="Impact of IOS BGP soft-reconfiguration-inbound and peering options" Tags="|cisco|bgp|memory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2570" PostTypeId="2" ParentId="2529" CreationDate="2013-07-30T18:46:03.203" Score="1" Body="&lt;p&gt;I'm dealing with similar issues. From my experience the best thing is to have a dedicated management processor which is always accessible and independent of Sup/routing engine. You did not specify what type of router you have. In your situation i would rely on a small ASA (5505 maybe?), connect it back to back with this router's OOB interface and bring up SSL VPN. No need for a default route, except if you want to do some monitoring via this connection. And you still need the ACL on the VTY lines.&lt;/p&gt;&#xA;" OwnerUserId="1049" LastActivityDate="2013-07-30T18:46:03.203" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2572" PostTypeId="2" ParentId="2568" CreationDate="2013-07-30T19:29:04.243" Score="10" Body="&lt;p&gt;Cisco constantly works on the BGP stack to achieve better performance and, so, memory consumption should vary between different versions. Check the this document for details: &lt;a href=&quot;https://www.google.it/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=2&amp;amp;cad=rja&amp;amp;ved=0CDwQFjAB&amp;amp;url=http://www.ciscoknowledgenetwork.com/files/195_Webinar_v4_.pdf?utm_source=&amp;amp;utm_medium=&amp;amp;utm_campaign=&amp;amp;PRIORITY_CODE=&amp;amp;ei=_g74UaTvH4Wl4ASm64DQDA&amp;amp;usg=AFQjCNFk0VjKVLRwfk9j-0k_3B2T2ZNtQA&amp;amp;sig2=IUodhGdn7yNuElNdZJms-A&amp;amp;bvm=bv.49967636,d.bGE&quot;&gt;BGP – From Dinosaur to racecar&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said the use of &lt;strong&gt;soft-reconfiguration inbound&lt;/strong&gt; has been discouraged since the introduction of the &lt;a href=&quot;http://www.cisco.com/en/US/products/ps6599/products_data_sheet09186a0080087b3a.html&quot;&gt;BGP Soft Reset Enhancement&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make a long story short, with soft-reconfiguration inbound enabled IOS first saves a local copy of the received NLRIs for each of its peers and then recursively applies ingress routing policy to them to calculate the BGP actual BGP RIB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the &lt;em&gt;BGP Soft reset Enhancement&lt;/em&gt; the router is able to ask to its peers to re-send the entire BGP feed avoiding the need to store in memory multiple copies of the same information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, to answer your question at point #2, memory consumption of BGP informations in Cisco IOS isn't linear, because a single NLRI is associated to differents next-hop/policy to achieve best memory utilization.&#xA;So two FRTs consume less then the double of what one does.&lt;/p&gt;&#xA;" OwnerUserId="530" LastActivityDate="2013-07-30T19:29:04.243" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2573" PostTypeId="2" ParentId="2437" CreationDate="2013-07-30T19:32:27.787" Score="0" Body="&lt;p&gt;The tool of choice for this task would be Cisco Security Manager.&#xA;For multi-vendor enviroment i would recommend HP Network Automation. &lt;/p&gt;&#xA;" OwnerUserId="1049" LastActivityDate="2013-07-30T19:32:27.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2576" PostTypeId="1" AcceptedAnswerId="2621" CreationDate="2013-07-30T23:16:25.840" Score="5" ViewCount="8347" Body="&lt;p&gt;The cisco documentation claims that the ASA 5512-X does not support traffic shaping because it is a multi processor device. Why is this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is shaping just inherently active? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like the shapper is a good feature, i don't understand why it is not available. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To add more details, the shape command is not available under the class default policy, it is located elsewhere? &#xA;Here is what I normally apply&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map RTP-traffic&#xA; match dscp ef &#xA;class-map SIP-traffic&#xA; match dscp af31 &#xA;&#xA;policy-map voice-policy&#xA; class RTP-traffic&#xA;  priority&#xA; class SIP-traffic&#xA;  priority&#xA;&#xA;policy-map outside-policy&#xA; class class-default&#xA;  shape average 5000000&#xA;  service-policy voice-policy&#xA;&#xA;service-policy outside-policy interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I go to apply this i only see&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASAX(config-pmap-c)# policy-map outside-policy&#xA;ASAX(config-pmap)#  class class-default&#xA;ASAX(config-pmap-c)# ?&#xA;&#xA;MPF policy-map class configuration commands:&#xA;  exit             Exit from MPF class action configuration mode&#xA;  help             Help for MPF policy-map class/match submode commands&#xA;  no               Negate or set default values of a command&#xA;  police           Rate limit traffic for this class&#xA;  priority         Strict scheduling priority for this class&#xA;  quit             Exit from MPF class action configuration mode&#xA;  set              Set connection values&#xA;  user-statistics  configure user statistics for identity firewall&#xA;  &amp;lt;cr&amp;gt;&#xA;  csc              Content Security and Control service module&#xA;  flow-export      Configure filters for NetFlow events&#xA;  inspect          Protocol inspection services&#xA;  ips              Intrusion prevention services&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the shape is not available. &lt;/p&gt;&#xA;" OwnerUserId="1352" LastEditorUserId="1352" LastEditDate="2013-07-31T01:49:03.583" LastActivityDate="2013-08-02T18:39:49.377" Title="Why does the ASA 5512-X not support traffic shaping?" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2577" PostTypeId="2" ParentId="2563" CreationDate="2013-07-30T23:45:20.893" Score="1" Body="&lt;p&gt;You should be able to connect two VLANs on the same NIC if you are using a server NIC that has more than one interface. I use a 4 port 10/100/1000 Intel NIC on my firewall. Two of those ports are trunked together to one VLAN and the other is going to a different VLAN. But I am not running each pair at the same time all the time. Most of the time it is set up for one trunked pair to take over if the main connection goes down. Unlike a an 802.1q trunk you will not be able to inter communicate between the two VLANs because you need a router to do that, but your computer should be able to talk to each VLAN. Let me know how it goes for you... &lt;/p&gt;&#xA;" OwnerUserId="2048" LastActivityDate="2013-07-30T23:45:20.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2578" PostTypeId="2" ParentId="2576" CreationDate="2013-07-31T00:37:30.537" Score="4" Body="&lt;p&gt;The 5580 and 5585X are multi processor units. The 5512X is not and does support traffic shaping except it does not support it on the Management interface (M0/0).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Traffic shaping is not supported on multi-processor models, such as&#xA;the ASA 5580 or ASA 5585-X.&lt;/p&gt;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&lt;p&gt;(ASA 5512-X through ASA 5555-X) Priority queuing is not supported on&#xA;the Management 0/0 interface.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa84/configuration/guide/conns_qos.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring QoS on ASA 8.4&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-07-31T01:04:13.163" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2579" PostTypeId="1" AcceptedAnswerId="2580" CreationDate="2013-07-31T01:08:33.807" Score="8" ViewCount="2131" Body="&lt;p&gt;My organization is soon going to be deploying approximately 600 new Cisco 2602i access points in a CAPWAP deployment with several 5508 controllers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an infrastructure refresh; currently we have a mix of older Cisco AP's using CAPWAP with several sets of WiSM controllers.   Our current procedure for deploying new/replacement AP's is, to my understanding, the standard priming procedure as listed in &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-1540&quot;&gt;this Cisco Support Forum document&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Connect new access point to the network at our desks&lt;/li&gt;&#xA;&lt;li&gt;AP gets a DHCP address&lt;/li&gt;&#xA;&lt;li&gt;DHCP Option 43 points AP to a controller&lt;/li&gt;&#xA;&lt;li&gt;Log into NCS Prime and find the new AP&lt;/li&gt;&#xA;&lt;li&gt;Change AP name and Primary/Secondary controller&lt;/li&gt;&#xA;&lt;li&gt;Box AP back up and take to site for deployment&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I know there are other options for initially getting the AP to talk to a controller, such as &lt;a href=&quot;http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a008093d74a.shtml&quot;&gt;Over-the-Air-Provisioning&lt;/a&gt; or placing the AP into a Layer 2 VLAN with a controller.  But these seem focused on just getting the AP connected to ANY controller, not priming it for a specific Primary/Secondary controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to setup some sort of staging/prep area for pre-configuring the new access points, conducting inventory, tagging with asset tags, sorting AP by final deployment area, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In setting up this staging area, is there a better way to prime these AP's quickly and easily?  Or are we already doing this in the most efficient manner?&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-08-14T19:08:59.687" Title="Staging Many Lightweight Cisco AP's for Deployment" Tags="|cisco|wireless|capwap|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2580" PostTypeId="2" ParentId="2579" CreationDate="2013-07-31T01:56:34.050" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I would like to setup some sort of staging/prep area for pre-configuring the new access points, conducting inventory, tagging with asset tags, sorting AP by final deployment area, and so on.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In setting up this staging area, is there a better way to prime these AP's quickly and easily? Or are we already doing this in the most efficient manner?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;NOTE: I am assuming you're already familiar with loading MIBs on a Windows / Linux machine, and using &lt;code&gt;snmpwalk&lt;/code&gt; / &lt;code&gt;snmpset&lt;/code&gt;... if not, please let me know&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently discovered how well you can manage Cisco's LWAPs through the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;step=2&amp;amp;mibName=AIRESPACE-WIRELESS-MIB&quot; rel=&quot;nofollow&quot;&gt;AIRESPACE-WIRELESS-MIB&lt;/a&gt;, in fact I have mostly forsaken our WCS in favor of managing our LWAPs with the MIB (we have a couple hundred LWAPs spread across multiple WLCs at our facility).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you know Perl, you could write a loop to poll your WLCs for the new LWAPs; then the script reacts accordingly when it sees a new LWAP mac-address on a WLC.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Loop through a list of all controllers, then poll the LWAPs on each controller with &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.33#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPEthernetMacAddress (ro)&lt;/a&gt;.  Use the mac-address as the unique identifying key for all activity on this LWAP.&lt;/li&gt;&#xA;&lt;li&gt;When you see a new LWAP, print the discovery time / mac-address of the LWAP; then ask the user what hostname / location to assign to this LWAP&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Optionally perform &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.18#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPClearConfig (rw)&lt;/a&gt; using &lt;code&gt;snmpset&lt;/code&gt; (note 255.254.253.252.251.250 is the hexidecimal index to &lt;code&gt;bsnAPTable&lt;/code&gt; translated into decimal octets); setting &lt;code&gt;bsnAPClearConfig&lt;/code&gt; will immediately reboot the LWAP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpset -v 2c -OXsq -c private -m AIRESPACE-WIRELESS-MIB &amp;lt;WLC_IP&amp;gt; \&#xA;  bsnAPClearConfig.255.254.253.252.251.250 integer 1&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Assign &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.3#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPName (rw)&lt;/a&gt;, &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.10#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPPrimaryMwarName (rw)&lt;/a&gt;, &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.23#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPSecondaryMwarName (rw)&lt;/a&gt; using &lt;code&gt;snmpset&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Get the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.17#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPSerialNumber (ro)&lt;/a&gt;; save it to a CSV file along with &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.33#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPEthernetMacAddress (ro)&lt;/a&gt;, &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.3#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPName (rw)&lt;/a&gt;, &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.10#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPPrimaryMwarName (rw)&lt;/a&gt;, and &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.23#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPSecondaryMwarName (rw)&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;Reset the LWAP if required with &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.2.1.1.11#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnAPReset (rw)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Using SNMP to manage LWAPs has been helpful, since I can automatically react to changes in LWAP to WLC mappings, as well as when an AP drops offline or gets large error / user counts.  I usually poll them all every 15 minutes and record who is on them, as well as recording what LWAPs are on each controller.  The WLC is powerful, but I like building custom-reaction scripts and reports.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-08-14T19:08:59.687" LastActivityDate="2013-08-14T19:08:59.687" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2581" PostTypeId="2" ParentId="1929" CreationDate="2013-07-31T02:41:12.223" Score="0" Body="&lt;p&gt;It does not seem like it is supported, so the work around is to just change the password that does not have the @ special character if you need to automate the process. &lt;/p&gt;&#xA;" OwnerUserId="1352" LastActivityDate="2013-07-31T02:41:12.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2582" PostTypeId="2" ParentId="2567" CreationDate="2013-07-31T07:05:37.093" Score="4" Body="&lt;p&gt;From my experience I usually go for:&#xA; - 20 prefixes taking usually 1 kbyte of memory &#xA; - 20 network entries usually take 2.5 kbytes of memory&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we have to add some memory for AS-Path entries, for BGP path/bestpath entries and for community entries, usually with 10 prefixes for 0.8 kbytes of memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bear in mind that if you add another router bringing 500k prefixes it will probably require memory only for the prefix table and doubtfully no for network tables as this is already filled up from the other neighbors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on these computations I would assume for 170 Mbytes of memory for a router peering with two 500k prefixes eBGP neighbors.&lt;/p&gt;&#xA;" OwnerUserId="794" LastEditorUserId="2092" LastEditDate="2013-08-01T05:07:10.340" LastActivityDate="2013-08-01T05:07:10.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2583" PostTypeId="1" AcceptedAnswerId="2588" CreationDate="2013-07-31T10:43:02.383" Score="5" ViewCount="33560" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Edit:&#xA;  While Mikrotik is well known for their consumer-grade wireless&#xA;  routers, this question is about their rack mounted,&#xA;  carrier-grade, aggregation service routers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I need to send a VLAN trunk over an EoIP tunnel through two RouterOS/Mikrotik routers. I have thus bridged an ethernet interface on each side of the link with the respective EoIP interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seeing how different VLANs and trunks are handled on RouterOS makes me wonder how I should go about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The frames will be tagged on egress from Catalyst switches on either side of the routers. Can one simply skip any VLAN configuration on RouterOS in this case? Will it bridge the frames with 802.1q tags intact?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume that such configuration will cause the IP addresses of the routers to be accessible from any VLAN on the trunk, if any addresses are configured on the bridged ethernet interfaces. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other downside to this configuration? Is there a better way?&lt;/p&gt;&#xA;" OwnerUserId="1947" LastEditorUserId="8499" LastEditDate="2018-02-14T16:27:08.633" LastActivityDate="2018-02-14T16:27:08.633" Title="Bridging VLAN trunks on RouterOS" Tags="|vlan|" AnswerCount="3" CommentCount="1" ClosedDate="2017-08-09T23:38:09.753" ContentLicense="CC BY-SA 3.0" />
  <row Id="2585" PostTypeId="1" AcceptedAnswerId="2606" CreationDate="2013-07-31T15:42:35.830" Score="5" ViewCount="516" Body="&lt;p&gt;Cisco 7604 + RSP720 3CXL + WS-X6704-10GE, need to understand how much traffic from the client comes to external resources, and how much goes to internal network resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mark incoming traffic to external resources:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    interface TenGigabitEthernet3/4.AAA&#xA; description -= WORLD =-&#xA; encapsulation dot1Q AAA&#xA; ip address XXX.XXX.XXX.XXX XXX.XXX.XXX.XXX&#xA; service-policy input WORLD-IN-MARKING&#xA; service-policy output WORLD-OUT-SHAPING&#xA;end&#xA;&#xA;#sh policy-map WORLD-IN-MARKING&#xA;  Policy Map WORLD-IN-MARKING&#xA;    Class class-default&#xA;      set dscp cs1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;check that passes through the policy-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh policy-map interface Te3/4.AAA input&#xA; TenGigabitEthernet3/4.AAA&#xA;&#xA;  Service-policy input: WORLD-IN-MARKING&#xA;&#xA;    class-map: class-default (match-any)&#xA;      Match: any&#xA;      set dscp 8:&#xA;      Earl in slot 1 :&#xA;        164559208445 bytes&#xA;        5 minute offered rate 788760744 bps&#xA;        aggregate-forwarded 164559208445 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;bps identical with graphics loading interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client Interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface TenGigabitEthernet3/4.BBB&#xA; description -= CLIENT =-&#xA; encapsulation dot1Q BBB&#xA; ip address YYY.YYY.YYY.YYY YYY.YYY.YYY.YYY &#xA; service-policy output CLIENT-W-IN&#xA;end&#xA;&#xA;#sh policy-map CLIENT-W-IN&#xA;  Policy Map CLIENT-W-IN&#xA;    Class WORLD-IN&#xA;     police cir 1000000000 bc 31250000&#xA;       conform-action transmit&#xA;       exceed-action drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;check that passes through the policy-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh policy-map interface TenGigabitEthernet3/4.BBB&#xA; TenGigabitEthernet3/4.BBB&#xA;&#xA;  Service-policy output: CLIENT-W-IN&#xA;&#xA;    class-map: WORLD-IN (match-all)&#xA;      Match:  dscp cs1 (8)&#xA;      police :&#xA;        1000000000 bps 31250000 limit 31250000 extended limit&#xA;      Earl in slot 1 :&#xA;        411124 bytes&#xA;        5 minute offered rate 2568 bps&#xA;        aggregate-forwarded 411124 bytes action: transmit&#xA;        exceeded 0 bytes action: drop&#xA;        aggregate-forward 2216 bps exceed 0 bps&#xA;&#xA;    Class-map: class-default (match-any)&#xA;      0 packets, 0 bytes&#xA;      5 minute offered rate 0000 bps, drop rate 0000 bps&#xA;      Match: any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;bps shows the value that is much smaller than in the graphs loading interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A similar scheme works fine on the Cisco ASR1001.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tried to mark dscp af11, then set dscp cs1 - no changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I fix this?&lt;/p&gt;&#xA;" OwnerUserId="2228" LastActivityDate="2013-08-01T12:01:39.050" Title="Cisco 7604 + RSP720 3CXL + WS-X6704-10GE QOS marking problem" Tags="|cisco|qos|cisco-ios-15|cisco-7600|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2586" PostTypeId="1" CreationDate="2013-07-31T16:07:37.543" Score="7" ViewCount="605" Body="&lt;p&gt;We are using PXE boot to image computers from Win XP to Windows 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The powers that be have created an imaging vlan dedicated specifically for this purpose, presumably for load balancing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that once that image is finished, we have to switch the vlan back to the user vlan, creating extra work for us. &lt;strong&gt;Is there any way around this?&lt;/strong&gt; We are trying to automate this process as much as possible and this extra bit of work does not lend itself to efficiency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or can a script be created that carries out this process automatically upon X? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As in, IF X, change PC_1 TO Vlan40 (after image is finished)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The trigger could be doing an OS lookup. IF WIN_7 ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thoughts?&lt;/p&gt;&#xA;" OwnerUserId="944" LastActivityDate="2013-08-02T13:20:56.613" Title="How can I avoid having to change the vlan back and forth when imaging pc's" Tags="|cisco|switch|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2587" PostTypeId="1" AcceptedAnswerId="2589" CreationDate="2013-07-31T16:15:13.643" Score="5" ViewCount="1811" Body="&lt;p&gt;Working through a lab for CCNP prep.  Task is simple - create 4 loopback addresses on R3 - all 172.16.X.0/24 addresses, and share the routes to neighboring routers so that they appear as /22's instead... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went to the eigrp process on R3 and typed in 'network 172.16.0.0 0.0.3.255' but no summary routes are shared with neighbors.  What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the record several other routes are already shared through this particular process so there is no underlying issue with with the eigrp setup (afaik).&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2013-07-31T16:25:32.790" LastActivityDate="2013-07-31T20:44:22.520" Title="Summarized route not being shared in EIGRP" Tags="|cisco|router|eigrp|route-summarization|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2588" PostTypeId="2" ParentId="2583" CreationDate="2013-07-31T17:16:53.027" Score="5" Body="&lt;p&gt;To be sure, create VLAN sub-interfaces on the physical interfaces and bridge the sub-interfaces. Any IP addresses are then configured on the respective bridges. VLANs are isolated from each other on layer 2 like on any switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Treat the EoIP tunnel interface like a physical interface for this exercise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oddly enough, the procedure is very similar to how VLAN trunks are configured on Juniper MX series routers :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Manual:Interface/VLAN&lt;/a&gt; has the details.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorUserId="1947" LastEditDate="2016-08-03T09:06:04.163" LastActivityDate="2016-08-03T09:06:04.163" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2589" PostTypeId="2" ParentId="2587" CreationDate="2013-07-31T17:22:04.227" Score="9" Body="&lt;p&gt;The &quot;network&quot; command is not responsible for summarizing routes. In EIGRP, this command merely enables the EIGRP process on all matched interfaces. You should use the &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip summary-address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;command on all interfaces on which you wish to advertise a summary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What the &quot;network&quot; command does is define a range of addresses that enables EIGRP on all interfaces with IP addresses that fall within that range.  For example, if you define a network like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;network 192.168.0.1 0.0.0.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For an IP address with the address 192.168.0.1 and a 24-bit mask, it would not advertise a 32-bit network, but rather the 24-bit network of the interface matched by THAT SPECIFIC IP address. This &quot;pool&quot; of addresses only contains that single IP address because of the all-zeros wildcard mask.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastEditorUserId="1007" LastEditDate="2013-07-31T20:44:22.520" LastActivityDate="2013-07-31T20:44:22.520" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2590" PostTypeId="2" ParentId="2587" CreationDate="2013-07-31T17:26:15.927" Score="6" Body="&lt;p&gt;ip summary-address eigrp 172.16.0.0 255.255.252.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure this on the intefaces facing the neighbor(s) you want to advertise the summary route.&lt;/p&gt;&#xA;" OwnerUserId="2230" LastActivityDate="2013-07-31T17:26:15.927" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2591" PostTypeId="2" ParentId="2586" CreationDate="2013-07-31T17:35:58.537" Score="2" Body="&lt;p&gt;You probably do not want to add any automated configuration capability to your imaging script/PE environment. That wouldn't really jive with most change control systems or frameworks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they do not want to allow PXE booting or imaging in general on the production network then you will either want to prep new computers on a dedicated port in your office and rely on USMT to backup and restore customer data from a file server. This is what we did at my office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above is easy to do when you are on-site, but quickly becomes cumbersome when you are working remotely. We had to &quot;set customer expectations&quot; and ship newly imaged machines with their data restored to the customer. A &quot;technical contact&quot; would assist in its installation and they would ship the old unit to us for disposal or redeployment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, without any sort of assistance from your network team I don't believe that there is a good automated solution.&lt;/p&gt;&#xA;" OwnerUserId="1859" LastActivityDate="2013-07-31T17:35:58.537" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2593" PostTypeId="1" AcceptedAnswerId="2595" CreationDate="2013-07-31T19:05:01.460" Score="2" ViewCount="166" Body="&lt;p&gt;Is there a reason to punch down all four pairs of a cable on a 66 or 110 block if I'm only going to have one twisted pair connected on the other side?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I hope this is the right site for this).&lt;/p&gt;&#xA;" OwnerUserId="2235" LastActivityDate="2013-07-31T19:41:21.923" Title="Terminating Cat5 for Voice" Tags="|cabling|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2594" PostTypeId="1" CreationDate="2013-07-31T19:18:53.297" Score="3" ViewCount="25779" Body="&lt;p&gt;I am doing some CCNA training videos and using packet tracer and they showed using a serial cable to connect two routers.  Why are serial cables used instead of Ethernet cables? Does it depend on the router or is it just a Cisco thing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cable connection in question is &lt;code&gt;dce to dte&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1963" LastEditorUserId="8499" LastEditDate="2018-12-21T04:08:22.487" LastActivityDate="2018-12-21T04:08:22.487" Title="Routing Serial cables instead of Ethernet" Tags="|cisco|routing|router|layer1|cable|" AnswerCount="5" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2595" PostTypeId="2" ParentId="2593" CreationDate="2013-07-31T19:36:51.910" Score="6" Body="&lt;p&gt;If it's infrastructure wiring, then punch all of them.  You never know what might be need in the future.  If it's just a loose cable, then it doesn't much matter as the other pairs can be terminated whenever needed.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-07-31T19:36:51.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2596" PostTypeId="2" ParentId="2593" CreationDate="2013-07-31T19:41:21.923" Score="2" Body="&lt;p&gt;You're using a Cat5 cable, but you didn't specify what jack is on &quot;the other side&quot;.  Punch down all of the pairs that are physically connected on the other end.  (If you're just running 4 wires to a POTS jack, there's no need to punch down the spare pairs.)&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-07-31T19:41:21.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2597" PostTypeId="2" ParentId="2594" CreationDate="2013-07-31T22:01:08.030" Score="12" Body="&lt;p&gt;One of the jobs of a router is to connect networks that have physically different transmission media.  Twisted-pair Ethernet is extremely common these days, but fiber (Ethernet, SONET/OC, and others) is used for most high-speed or long-distance runs, and different types of layer-2 and layer-1 networks have been used in the past and are still in use today, such as T1/T3 lines, ISDN, and Token Ring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For historical reasons, serial cables such as &lt;a href=&quot;http://en.wikipedia.org/wiki/High-Speed_Serial_Interface&quot;&gt;HSSI&lt;/a&gt; may be used to connect equipment such as T1/T3 terminating devices. These will show up as &lt;code&gt;interface SerialN&lt;/code&gt;, and you can get detailed information on the hardware installed in a router with &lt;code&gt;show controllers serial&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, &quot;DCE/DTE&quot; technically applies to a number of different hardware signaling schemes. In the context of networking, it's most likely to refer to a serial interface that's used to connect to a WAN drop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of your simulator, you should practice with both types of interfaces. In most business networks, the &quot;inside&quot; interfaces will be Ethernet, while the WAN interface will be either serial or Ethernet depending on what service the telco is providing, and you'll need to be able to configure either one.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-07-31T22:01:08.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2598" PostTypeId="1" AcceptedAnswerId="2599" CreationDate="2013-07-31T22:36:51.870" Score="13" ViewCount="11925" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080093f0d.shtml&quot;&gt;this&lt;/a&gt; article two routers will get stuck in the exstart adjacency state when their configured MTU sizes do not match. Does a VLAN tag affect this as well even if the routers involved are unconcerned with which VLAN the packet is coming from or heading to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll try to clarify the question if it is unclear at all.&lt;/p&gt;&#xA;" OwnerUserId="1859" LastActivityDate="2013-11-25T22:25:43.157" Title="OSPF Stuck in Exstart Adjacency State" Tags="|router|routing|vlan|ospf|mtu|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2599" PostTypeId="2" ParentId="2598" CreationDate="2013-07-31T22:52:59.420" Score="9" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;According to this article two routers will get stuck in the exstart adjacency state when their configured MTU sizes do not match. Does a VLAN tag affect this as well even if the routers involved are unconcerned with which VLAN the packet is coming from or heading to?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Most Cisco routers and switches allow 1500 byte IP payloads by default, even when tagged with dot1q.  You can verify this with &lt;code&gt;show ip interface SomeIntfName&lt;/code&gt;...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Router1#sh ip int vlan105&#xA;Vlan105 is up, line protocol is up&#xA;  Internet address is 10.15.2.19/30&#xA;  Broadcast address is 255.255.255.255&#xA;  Address determined by setup command&#xA;  MTU is 1500 bytes  &amp;lt;-------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The reason dot1q on a Cisco interface works without bumping the physical interface MTU is because most Cisco routers support what Cisco calls &amp;quot;baby giants&amp;quot;... a baby giant has an Ethernet MTU above 1518 (which includes the eth header size), but not very much over 1518... usually the default values is 1522 bytes... see this &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps700/products_configuration_example09186a008010edab.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;MTU configuration doc&lt;/a&gt; for more information.  Many Cisco platforms support configurable ethernet baby giant MTUs to 1532 bytes (or even higher), which is also why MPLS tag stacks (2 or 3 tags deep) can work through legacy ethernet links.&lt;/p&gt;&#xA;&lt;p&gt;Even though Cisco ethernet interfaces support baby giants, they leave the default IP MTU at 1500 bytes.  As long as the default IP MTU of 1500 is maintained, you'll have no problems with the default settings of any other router with a 1500-byte IP MTU... quoting &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#page-103&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328 Section 10.8&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;10.8.  Sending Database Description Packets&#xA;&#xA;    This section describes how Database Description Packets are sent&#xA;    to a neighbor. The Database Description packet's Interface MTU&#xA;    field is set to the size of the largest IP datagram that can be&#xA;    sent out the sending interface, without fragmentation.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-11-25T22:25:43.157" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2600" PostTypeId="2" ParentId="2598" CreationDate="2013-07-31T22:58:50.587" Score="6" Body="&lt;p&gt;So the VLAN tag affects the amount you can transfer through the interface below the Ethernet header, but it doesn't change the actual MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF starts by sending out Hello packets on the broadcast medium (multicast 224.0.0.5) to find neighbours, then performs the DR and BDR election.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the election has completed, each hosts sends out a DB description packet. Within this packet there is a field &lt;code&gt;[IP -&amp;gt; OSPF -&amp;gt; OSPF DB-Description -&amp;gt; Interface MTU]&lt;/code&gt; that OSPF sets to the outgoing interface's MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If peers' MTUs don't match, they won't move past the ExStart phase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would take a packet capture (if possible) and drill down into this field to see what's happening, or perform a &lt;code&gt;debug ip ospf adj&lt;/code&gt; just to make sure this is the case..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;code&gt;show interface &amp;lt;int&amp;gt; | MTU&lt;/code&gt; will give you the MTU of an interface.&lt;/p&gt;&#xA;" OwnerUserId="1682" LastEditorUserId="1682" LastEditDate="2013-07-31T23:07:25.137" LastActivityDate="2013-07-31T23:07:25.137" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2602" PostTypeId="1" AcceptedAnswerId="2880" CreationDate="2013-08-01T00:00:49.217" Score="5" ViewCount="924" Body="&lt;p&gt;I'm trying to troubleshoot a situation between a foundry sx and a brocade icx.  I setup tagged ports and vlans between them both.  Now when I connect the 2 switches with an ethernet cable, ospf comes up and everything works nicely however when I connect them using fiber, they fail to establish any adjacencies nor can I ping between them even with private ip's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the sfp ports for the icx, it says to configure the ports manually to:  1000-full-master and the other end to 1000-full-slave which I did.  The link comes up but I can't pass any traffic between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on why this may be at all?&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="267" LastEditDate="2013-08-01T00:33:45.660" LastActivityDate="2013-08-19T11:58:28.937" Title="Fiber Port Issue" Tags="|switch|brocade|fiber|foundry|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2603" PostTypeId="2" ParentId="2586" CreationDate="2013-08-01T00:42:06.123" Score="0" Body="&lt;p&gt;Most products require you to configure MAC addresses in DHCP for imaging to, so a normal PC will not use DHCP addresses from the imaging server, this begs the question why have a PXE VLAN? I use one for servers but all production networks are tagged so we can rebuild the server without needing to change the switch, but I would suggest this setup is needlessly complex. Use 2 DHCP servers 1 to build and one for normal operations and have a small scope in the build DHCP server.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-08-01T00:42:06.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2604" PostTypeId="1" CreationDate="2013-08-01T01:17:33.933" Score="7" ViewCount="401" Body="&lt;p&gt;I have one switch that I want to use as an 802.1q tunnel, to make the spanning tree and etherchannel transparent, a pass through switch between a core switch and access closets, because I do not have enough phyiscal cabling to run to the core from each access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what is considers point-to-point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have one connection to the core, and on my dot1q tunnel switch each access switch has a separate connection, would the access switches be considered point-to-point to the core?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          CORE&#xA;            |          &#xA;       dot1qswitch&#xA;       /     |     \&#xA; access1   acess2  access 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After connections are made, i want etherchannel and cdp neighbors and spanning tree to see the core and the access switches as if they were cabled up directly port to port core to access.&lt;/p&gt;&#xA;" OwnerUserId="166" LastActivityDate="2013-08-27T11:56:48.277" Title="In 802.1Q Tunneling what exactly is meant by &quot;a point-to-point topology before you enable tunneling for PAgP, LACP, or UDLD&quot;" Tags="|cisco-catalyst|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="2606" PostTypeId="2" ParentId="2585" CreationDate="2013-08-01T07:53:45.673" Score="2" Body="&lt;p&gt;The above-described behavior is by design for the Cisco 76XX platform: See the &lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SR/configuration/guide/qos.html.&quot; rel=&quot;nofollow&quot;&gt;Configuration guide for QOS on Cisco 7600's&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solved the problem of marking traffic on another router before it is sent to this router.&lt;/p&gt;&#xA;" OwnerUserId="2228" LastEditorUserId="44" LastEditDate="2013-08-01T12:01:39.050" LastActivityDate="2013-08-01T12:01:39.050" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2608" PostTypeId="1" AcceptedAnswerId="2609" CreationDate="2013-08-01T16:35:43.500" Score="5" ViewCount="2479" Body="&lt;p&gt;Prepping for CCNP - In my topology the path R1 takes to a Loopback Ip is via R2 by default.  My goal is to have a feasible successor route through R3.  I've attached a diagram of topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/etjBp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/etjBp.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem is: R1 only has one entry for the loopback ip of 3.3.3.3 in it's topology table.  When I look at R3, it has two entries for this network, but somehow it's not sharing it.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had planned to manipulate delay to add the FS route in R1, so I tried that on all links from R3 to the loopback (reduced delay to 10 usec), and for one update I saw R1 have both entries.. after another update though it removed it.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding was that even if it wasn't a FS the topology table (using the 'detail' switch) would show all possibilities?  What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="59" LastEditDate="2013-08-05T12:34:22.470" LastActivityDate="2014-03-11T00:23:46.897" Title="EIGRP topology table - unexpected behavior" Tags="|cisco|eigrp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2609" PostTypeId="2" ParentId="2608" CreationDate="2013-08-01T16:52:13.550" Score="4" Body="&lt;p&gt;Try using the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip eigrp topology all-links&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should allow you to view all routes including non-successor/non-feasible routes&lt;/p&gt;&#xA;" OwnerUserId="2231" LastActivityDate="2013-08-01T16:52:13.550" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2610" PostTypeId="2" ParentId="2608" CreationDate="2013-08-01T16:52:34.583" Score="4" Body="&lt;p&gt;The default view of the EIGRP topology table actually does not contain ALL paths to a network. You'll see a next-hop if it is either a successor, or a feasible successor. If a certain path doesn't qualify as either of those, then it doesn't go in the topology table.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;EDIT: As another answer correctly points out, you can use the &quot;all-links&quot; argument to get the topology table to list every potential next-hop. EIGRP will still need to re-compute DUAL to guarantee a loop-free topology, but this way you can at least see the non-feasible and non-successor routes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is different from OSPF (at least within an area), where the &quot;topology table&quot; (the OSPF Link-State Database) contains all information about the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a route goes active in the topology table, it is because it has neither an S or a FS. An active route is actively asking the network for valid next-hops to reach said network. In this case, the metric to your loopback network from R1's perspective through R3 is considered not good enough to qualify as a FS, so it merely installs the single route through R2 into the routing table as a successor. If this path were to fail, the route to 3.3.3.0 would go active, and R3 would respond, saying that it is able to offer reachability to this network the long way around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3 uses both potential paths because your metric weights make it so that only delay is used in the metric computation. So, from R3's perspective, the two paths to the loopback are equal-cost, so both are successors (see your topology table?)&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-08-01T16:52:34.583" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2611" PostTypeId="2" ParentId="2586" CreationDate="2013-08-02T07:15:52.663" Score="3" Body="&lt;p&gt;A few options come to mind.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If you have &lt;strong&gt;802.1X&lt;/strong&gt; in your environment, you could push the &lt;strong&gt;VLAN assignement&lt;/strong&gt; to the port based on a username used to authenticate after the imaging is done.  One username per vlan for imaging to make the VLAN assignments automatic.&lt;/li&gt;&#xA;&lt;li&gt;If the imaging is done in a central location, get a &lt;strong&gt;L2 switch and trunk&lt;/strong&gt; that back to the production network, and then simply have different ports tied to different VLANs.  The automatic part comes from you physically using different cables from a different ports or swapping your one cable out from one port to another.&lt;/li&gt;&#xA;&lt;li&gt;Script the VLAN switchport change via &lt;strong&gt;SNMP or CLI&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-08-02T07:15:52.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2615" PostTypeId="2" ParentId="2586" CreationDate="2013-08-02T13:20:56.613" Score="0" Body="&lt;p&gt;Split your 3750x and assign some ports for the imaging VLAN and some ports for your regular user traffic VLAN.  When your imaging is complete simply swap your patch cable to the correct port.  Or you can simply allow your image VLAN to access necessary network resources to complete your imaging process, this can be done through ACLs. &lt;/p&gt;&#xA;" OwnerUserId="2250" LastActivityDate="2013-08-02T13:20:56.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2617" PostTypeId="1" AcceptedAnswerId="2619" CreationDate="2013-08-02T16:02:27.470" Score="8" ViewCount="1185" Body="&lt;p&gt;I'm trying to work out how to enable dhcp snooping and dynamic arp inspection on our guest network and I'm a little confused.... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the situation:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a hub and spoke topology, with a main core switch connecting to multiple layer 3/distribution switches. The edge switches all carry guest network traffic on guest vlan 10. That traffic is then separated from the rest of the network on layer 3 via a VRF. Between each distribution switch and the main core is a different guest network vlan, vlan 8xx. The access layer switches are Cisco 2960S and the core/distribution switches are 4507's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dhcp server connects to the main core.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I need to enable dhcp snooping on vlan 10 and set the trunk interfaces as trusted interfaces, but where I'm confused is at the distribution layer where it passes to the vrf. Do I need to also enable snooping on the vrf guest vlans (8xx)? &lt;/p&gt;&#xA;" OwnerUserId="269" LastEditorUserId="775" LastEditDate="2015-03-28T00:09:35.323" LastActivityDate="2015-03-28T00:09:35.323" Title="DHCP Snooping Confusion" Tags="|cisco|security|dhcp|vrf|dhcp-snooping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2618" PostTypeId="1" AcceptedAnswerId="2620" CreationDate="2013-08-02T16:12:09.717" Score="5" ViewCount="3677" Body="&lt;p&gt;Situation: We have a 3750 with a monitoring session setup on it, grabs a few VLAN's running over the switch and has a destination port on that device (normal SPAN not RSPAN). Historically speaking - that destination port had a 1GB cable plugged into it connecting down to a 3020 (in the back of an HP blade chassis), and hosts in that chassis could be set with a promiscuous NIC to monitor the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 3020 has lost it's config.  How do I set up the port on the 3020 to pass the SPAN traffic?  Very curious about this because I had thought RSPAN was needed for a setup like this, but it's worked for years in the manner described above with regular SPAN.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2013-08-02T18:40:08.183" Title="Setting up a switch to pass data from a SPAN port" Tags="|cisco-3750|mirror|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2619" PostTypeId="2" ParentId="2617" CreationDate="2013-08-02T17:18:44.580" Score="7" Body="&lt;p&gt;If no DHCP clients are connected directly to your distribution or core then you wouldn't need to configure DHCP snooping there. You would just configure your access layer switches to untrust every port except for your uplinks to the distribution switches.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-08-02T17:18:44.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2620" PostTypeId="2" ParentId="2618" CreationDate="2013-08-02T18:07:34.140" Score="6" Body="&lt;p&gt;A back-to-back SPAN session would seem to work. I can't say that is what was used in your environment but I just labbed it up and it worked with no problems. I was able to capture packets on the laptop that were from the gi0/7 interface on the 2960G. A poor mans RSPAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test layout and configurations below. No special configuration on the switchports at all, just our leftover lab stuff. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;rest-of-world ======== [gi0/7]2960G[gi0/2] ====== [fa1/0/1]3750-24[fa1/0/2] =========== laptop&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2960G&#xA;====================&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport access vlan 705&#xA; switchport mode access&#xA; switchport nonegotiate&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/7&#xA; description Trunk to rest of world&#xA; switchport trunk allowed vlan 1,4,113,125,130,132,270,420,444,655,705,998&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; logging event trunk-status&#xA;!&#xA;monitor session 1 source interface Gi0/7&#xA;monitor session 1 destination interface Gi0/2&#xA;!&#xA;&#xA;3750-24&#xA;=======================&#xA;!&#xA;interface FastEthernet1/0/1&#xA; switchport access vlan 777&#xA; spanning-tree portfast&#xA;!&#xA;interface FastEthernet1/0/2&#xA; switchport access vlan 777&#xA; spanning-tree portfast&#xA;!&#xA;monitor session 1 source interface Fa1/0/1&#xA;monitor session 1 destination interface Fa1/0/2&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit: Does not work with &quot;encapsulation replicate&quot; on the monitor destination command.&lt;/p&gt;&#xA;" OwnerUserId="267" LastEditorUserId="267" LastEditDate="2013-08-02T18:40:08.183" LastActivityDate="2013-08-02T18:40:08.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2621" PostTypeId="2" ParentId="2576" CreationDate="2013-08-02T18:39:49.377" Score="5" Body="&lt;p&gt;Shaping is not supported at this time on the new hardware. This is a hardware limitation with multi-processor multi-core units, not a software limitation. &#xA;This is not specifically detailed in the document mentioned above. I asked a Cisco product rep and he confirmed that it is not support. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/thread/2231107&quot; rel=&quot;noreferrer&quot;&gt;https://supportforums.cisco.com/thread/2231107&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1352" LastActivityDate="2013-08-02T18:39:49.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2623" PostTypeId="1" CreationDate="2013-08-03T04:42:56.307" Score="3" ViewCount="1654" Body="&lt;p&gt;I currently have a NETGEAR FVS338. If I was to connect another firewall of it's type directly to it or to the switch under the first firewall, could I still VPN into the 2nd firewall?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to setup a private network behind the 2nd firewall that can only be accessible on that specific network but still be allowed to access the internet.&lt;/p&gt;&#xA;" OwnerUserId="1963" LastActivityDate="2013-08-03T10:07:18.973" Title="Firewall behind a firewall" Tags="|vlan|security|firewall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2624" PostTypeId="2" ParentId="2623" CreationDate="2013-08-03T09:23:15.253" Score="4" Body="&lt;p&gt;You can connect the second firewall directly to the Internet. It is of the same type, so has the same capabilties and can protect itself and the network behind it in a similar way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you would like to put the firewall behind the other one, you need to allow the VPN protocols to pass the first firewall. Note, for VPN you may need a public IP address like your firewall for internet has (which usually does NAT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my business I have a main firewall and in addition a VPN gateway (of the same firewall type) which provides a lot of VPNs to partners. This VPN gateway is directly connected to the internet. But it's like a DMZ: to enter our internal LAN, it has to pass the main firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, instead of allowing tunneling through your first firewall, so your VPN user is directly inside your LAN, I would check if it's better to make the VPN directly to a firewall and use the second firewall to protect your internal LAN from the VPN subnets.&lt;/p&gt;&#xA;" OwnerUserId="231" LastEditorUserId="775" LastEditDate="2013-08-03T10:07:18.973" LastActivityDate="2013-08-03T10:07:18.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2631" PostTypeId="1" CreationDate="2013-08-04T13:22:44.930" Score="3" ViewCount="1131" Body="&lt;p&gt;I am setting up a Cisco 891-K9 with dual WAN.  How do I setup policy based routing for all torrent traffic to be sent over the secondary WAN link?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recall seeing routers that detect traffic type.  Do they just look for traffic on common torrent ports (6881-6889)?&lt;/p&gt;&#xA;" OwnerUserId="1331" LastActivityDate="2013-08-05T13:27:04.813" Title="How do I set up PBR for torrent traffic with a Cisco 891?" Tags="|cisco|pbr|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2634" PostTypeId="1" CreationDate="2013-08-04T23:07:45.037" Score="6" ViewCount="3973" Body="&lt;p&gt;Really stupid questions guys so I apologize. When sending Syslog messages to a server we use the command &lt;code&gt;logging x.x.x.x&lt;/code&gt;.  I get that part. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SNMP is used to gather stats or change configurations on our devices. I get that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The part where I am drawing a blank is what is the need for the &lt;code&gt;snmp-server host&lt;/code&gt; command along with enabling traps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this scenario is the SNMP server also operating as a Syslog server?&lt;/p&gt;&#xA;" OwnerUserId="495" LastEditorUserId="44" LastEditDate="2013-08-04T23:36:55.043" LastActivityDate="2013-08-05T12:52:10.997" Title="SNMP and Syslog in configuration" Tags="|cisco|cisco-commands|snmp|logging|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2635" PostTypeId="2" ParentId="2634" CreationDate="2013-08-04T23:33:28.170" Score="8" Body="&lt;p&gt;You're partially right in that Syslog and SNMP Traping do serve similar functions, however there are some fundamental differences.  (Based on your commands/tags on the quesiton, I assume you're asking specifically about their function on a Cisco Router/Switch.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Snmp&quot; rel=&quot;nofollow&quot;&gt;SNMP&lt;/a&gt; serves three main functions as you mentioned:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Gathering of information with &lt;code&gt;snmpget&lt;/code&gt;, &lt;code&gt;snmpwalk&lt;/code&gt;, etc.&lt;/li&gt;&#xA;&lt;li&gt;Changing configuration on a devices via &lt;code&gt;snmpset&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Alerting via SNMP Traps, which will give you similar information to your Syslog events.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Syslog&quot; rel=&quot;nofollow&quot;&gt;Syslog&lt;/a&gt; is only capable of the third option, sending information from the device to a server.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The primary differences between Syslog and SNMP are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Syslog will only send messages based on your current logging level and debugs in a Cisco device.  SNMP Traps can be configured independently of your current logging level.&lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;Syslog is insecure, the messages are in plain text.&lt;/s&gt; &lt;strong&gt;EDIT:&lt;/strong&gt; Per @ytti in the comments below, there is an encrypted transport option for Syslog on IOS devices.  See &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t11/htnmsylg.html&quot; rel=&quot;nofollow&quot;&gt;this Cisco document on Reliable Transport of Syslog&lt;/a&gt; for more information on BEEP transport with TLS encryption.  With that said, I would still recommend looking at SNMP v3, as it has built in encryption and authentication for the handling of it's transactions without needing to change the transport protocol/configuration.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For the most part, which logging method you should use really depends on your environment.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've worked in shops that only used SNMP Traps, shops that only used Syslog events, and shops that used both (sent to two different servers under the control of two different departments).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will depend greatly on the NMS/Syslog server you are using to gather this information, and what you wish to monitor in each Cisco device.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For more information on SNMP Traps in Cisco IOS devices, &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a05.shtml&quot; rel=&quot;nofollow&quot;&gt;see this Cisco Tech Note&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information on Syslog in Cisco devices (including PIX/ASA), &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=426638&amp;amp;seqNum=3&quot; rel=&quot;nofollow&quot;&gt;see this Cisco Press Article&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information on Logging in general on Cisco IOS devices &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-4788&quot; rel=&quot;nofollow&quot;&gt;see this Cisco Support Forum Doc on logging on IOS devices&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-08-05T12:52:10.997" LastActivityDate="2013-08-05T12:52:10.997" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2636" PostTypeId="2" ParentId="2634" CreationDate="2013-08-04T23:43:11.910" Score="5" Body="&lt;p&gt;The 'snmp-server host' command determines the server(s) the traps are sent to. This needn't be the same server that receives syslog messages but it needs to run some  trap-handling software to be useful... &lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorDisplayName="user661" LastEditDate="2013-08-04T23:56:48.370" LastActivityDate="2013-08-04T23:56:48.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2637" PostTypeId="1" CreationDate="2013-06-08T08:35:25.640" Score="9" ViewCount="180" Body="&lt;p&gt;In EIGRP when showing topology table, i notice in some entries are like below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;P 10.1.6.0/24, 1 successors, FD is 793600&#xA;            via 10.1.2.2 (2195456/281600), Serial0/0/0&#xA;           via 10.1.3.2 (77081600/281600), Serial0/0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems the successor should be 10.1.2.2, but why its FD shows 2195456, not equal to 793600?&lt;/p&gt;&#xA;" OwnerDisplayName="user1559625" LastEditorUserId="33" LastEditDate="2013-09-04T07:03:55.580" LastActivityDate="2013-09-04T14:42:42.393" Title="EIGRP FD not the same in topology table" Tags="|cisco|eigrp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2639" PostTypeId="1" AcceptedAnswerId="2644" CreationDate="2013-08-05T13:04:53.863" Score="10" ViewCount="1695" Body="&lt;p&gt;Cisco 7604 + RSP720 3CXL + WS-X6704-10GE increasing the error counters on the port, but there is no loss through the port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   #sh interfaces Te3/4&#xA;  TenGigabitEthernet3/4 is up, line protocol is up (connected)&#xA;  Hardware is C7600 10Gb 802.3, address is 588d.09b4.8d80 (bia 588d.09b4.8d80)&#xA;  MTU 1500 bytes, BW 10000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 42/255, rxload 42/255&#xA;  Encapsulation 802.1Q Virtual LAN, Vlan ID  1., loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 10Gb/s&#xA;  Transport mode LAN (10GBASE-R, 10.3125Gb/s)&#xA;  input flow-control is off, output flow-control is off&#xA;  Clock mode is auto&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:00, output 00:00:00, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 3d03h&#xA;  Input queue: 0/75/291/291 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 1667291000 bits/sec, 244099 packets/sec&#xA;  5 minute output rate 1665910000 bits/sec, 243961 packets/sec&#xA;  L2 Switched: ucast: 4875 pkt, 1667250 bytes - mcast: 0 pkt, 0 bytes&#xA;  L3 in Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes mcast&#xA;  L3 out Switched: ucast: 0 pkt, 0 bytes mcast: 0 pkt, 0 bytes&#xA;     46982598919 packets input, 40800999530943 bytes, 0 no buffer&#xA;     Received 1748682 broadcasts (0 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     155706 input errors, 65000 CRC, 11401 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     46985469520 packets output, 40792363160570 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The router is used for the termination of customers and channel limits to them with the using Policing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh int te3/4 transceiver detail&#xA;ITU Channel not available (Wavelength not available),&#xA;Transceiver is internally calibrated.&#xA;mA: milliamperes, dBm: decibels (milliwatts), NA or N/A: not applicable.&#xA;++ : high alarm, +  : high warning, -  : low warning, -- : low alarm.&#xA;A2D readouts (if they differ), are reported in parentheses.&#xA;The threshold values are calibrated.&#xA;&#xA;                              High Alarm  High Warn  Low Warn   Low Alarm&#xA;           Temperature        Threshold   Threshold  Threshold  Threshold&#xA;Port       (Celsius)          (Celsius)   (Celsius)  (Celsius)  (Celsius)&#xA;---------  -----------------  ----------  ---------  ---------  ---------&#xA;Te3/4        28.2                   70.0       60.0        5.0        0.0&#xA;&#xA;                              High Alarm  High Warn  Low Warn   Low Alarm&#xA;           Voltage            Threshold   Threshold  Threshold  Threshold&#xA;Port       (Volts)            (Volts)     (Volts)    (Volts)    (Volts)&#xA;---------  -----------------  ----------  ---------  ---------  ---------&#xA;Te3/4        0.00                    N/A        N/A        N/A        N/A&#xA;&#xA;                              High Alarm  High Warn  Low Warn   Low Alarm&#xA;           Current            Threshold   Threshold  Threshold  Threshold&#xA;Port       (milliamperes)     (mA)        (mA)       (mA)       (mA)&#xA;---------  -----------------  ----------  ---------  ---------  ---------&#xA;Te3/4         N/A                    N/A        N/A        N/A        N/A&#xA;&#xA;           Optical            High Alarm  High Warn  Low Warn   Low Alarm&#xA;           Transmit Power     Threshold   Threshold  Threshold  Threshold&#xA;Port       (dBm)              (dBm)       (dBm)      (dBm)      (dBm)&#xA;---------  -----------------  ----------  ---------  ---------  ---------&#xA;Te3/4         N/A         ++         0.9        0.4       -8.2       -8.1&#xA;&#xA;           Optical            High Alarm  High Warn  Low Warn   Low Alarm&#xA;           Receive Power      Threshold   Threshold  Threshold  Threshold&#xA;Port       (dBm)              (dBm)       (dBm)      (dBm)      (dBm)&#xA;---------  -----------------  ----------  ---------  ---------  ---------&#xA;Te3/4         N/A         ++         0.9        0.4      -14.4      -15.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm using an adapter &quot;XENPACK to SFP +&quot; and &quot;Direct Attach Cable SFP + to SFP +&quot; - this complicates the diagnosis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where to find the cause of growth counters?&lt;/p&gt;&#xA;" OwnerUserId="2228" LastEditorUserId="2228" LastEditDate="2013-08-06T06:49:49.877" LastActivityDate="2013-08-06T09:54:18.673" Title="Cisco 7604 + RSP720 3CXL + WS-X6704-10GE increasing the error counters on the port, but there is no loss through the port" Tags="|cisco|cisco-ios-15|errors|policing|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2640" PostTypeId="2" ParentId="2631" CreationDate="2013-08-05T13:27:04.813" Score="2" Body="&lt;p&gt;Assuming you can choose the port range your torrent client will use, you should set up PBR as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;ip access-list extended torrent&#xA; permit tcp any range $STARTPORT $ENDPORT any&#xA;!&#xA;interface $LAN&#xA; ip policy route-map PBR  &#xA;!&#xA;route-map PBR permit 10&#xA; match ip address torrent&#xA; set ip next-hop $WAN1-IP       &#xA;!&#xA;route-map Texas permit 20&#xA; set ip next-hop $WAN2-IP       &#xA;&lt;/pre&gt;&#xA;" OwnerUserId="530" LastActivityDate="2013-08-05T13:27:04.813" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2641" PostTypeId="1" AcceptedAnswerId="2643" CreationDate="2013-08-05T14:06:27.973" Score="14" ViewCount="2327" Body="&lt;h2&gt;QUESTION&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;For a Cisco 2960-S switch, when connecting on the console port, normally the prompt is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SwitchName&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then you issue an &lt;code&gt;enable&lt;/code&gt; command and end-up with a prompt like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SwitchName#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I stumbled to diagnostic a switch which was improperly booted with this prompt:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the hostname wasn't shown, &lt;code&gt;switch:&lt;/code&gt; is the exact prompt displayed, ending with a colon. I tried finding more information about this mode so that I can understand what happened and if it will happen again, but couldn't.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;ADDITIONAL CONTEXT&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;there was a blinking-amber light on the front panel (I must admit I did not note which one, but it was one of the top ones, I think it could be RPS)&lt;/li&gt;&#xA;&lt;li&gt;this was following a power outage&lt;/li&gt;&#xA;&lt;li&gt;none of the ports had any indicators ON&lt;/li&gt;&#xA;&lt;li&gt;no command of my knowledge were recognized on that prompt&lt;/li&gt;&#xA;&lt;li&gt;I ended-up powering off twice the switch until it booted properly again&lt;/li&gt;&#xA;&lt;li&gt;I haven't been able to reproduce since&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2271" LastEditorUserId="2271" LastEditDate="2013-08-05T16:19:18.223" LastActivityDate="2013-08-05T21:57:14.350" Title="In what mode does the 2960-S IOS prompt ends with a colon &quot;:&quot;" Tags="|cisco|switch|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2642" PostTypeId="2" ParentId="2639" CreationDate="2013-08-05T14:07:26.370" Score="9" Body="&lt;p&gt;There is loss, you're just not seeing the impact.  The display is only showing 155706 input errors out of 46982598919 packets in the previous three days and four hours.  This is .0003% packet loss, which is why it's so difficult to see first hand during testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not seeing any operational impact, odds are that this can be safely ignored.  Such a low level of packet loss has a pretty negligible effect in a standard IP network and the upper-layer protocols will adapt accordingly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're intent on tracking down the source, it will be difficult.  As Mike pointed out, the first step will be to check signal strength (show interface xxxx transceiver; this requires modules with DOM capability) and try cleaning the termination points of your patch cords.  If that doesn't work, try replacing the patch cords.  As a final straw, replace the actual optical modules.&lt;/p&gt;&#xA;" OwnerUserId="2065" LastEditorUserId="2065" LastEditDate="2013-08-06T09:03:28.883" LastActivityDate="2013-08-06T09:03:28.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2643" PostTypeId="2" ParentId="2641" CreationDate="2013-08-05T14:10:45.983" Score="14" Body="&lt;p&gt;The colon indicates that you've entered the switch bootloader.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_55_se/commmand/reference/bootldr.html&quot;&gt;a few things&lt;/a&gt; you can do in this mode, the most popular I can think of is replacing a corrupted IOS image, which would be a good reason why you ended up there in the first place.&lt;/p&gt;&#xA;" OwnerUserId="1007" LastEditorUserId="49" LastEditDate="2013-08-05T14:45:04.340" LastActivityDate="2013-08-05T14:45:04.340" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2644" PostTypeId="2" ParentId="2639" CreationDate="2013-08-05T14:23:46.057" Score="4" Body="&lt;p&gt;You're seeing CRC and framing errors and general input errors. If this happened while setting up the port this could be caused by people still fiddling with the fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this happens during normal operation most of the time it indicates a low light level or some other error with the fiber(s) or optics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check the light levels with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interfaces transceiver &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Beware that this might report incorrect readings for 3rd party optics. You would then have to look up the power budget / limits of the optic to see if you're in range with the specifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Mike suggested, try cleaning all the fiber terminations. If that doesn't help try replacing the optics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment the errors are too small to be noticed but that can change very quickly. Better fix it now than being woken at 3am because there is suddenly more loss on the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also for interface (error) counters it sometimes pays off to use the Cisco output interpreter to analyse what you're seeing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/pcgi-bin/Support/OutputInterpreter/home.pl&quot; rel=&quot;nofollow&quot;&gt;https://www.cisco.com/pcgi-bin/Support/OutputInterpreter/home.pl&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take the analysis with a grain of salt, sometimes they're missing the point but it can help in getting a quick view about what's wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using a XENPAK/SFP+ Adapter and DAC cables the problem could be with either of them. Try replacing the Adapter(s) and/or cables. As DAC has no optics in it (it's copper), the &lt;code&gt;interface transceiver&lt;/code&gt; command will not show anything useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the cable length and possible electromagnetic interferences could cause problems with DAC. If everything fails try switching to optics and optical cabling and see if that helps.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2013-08-06T09:54:18.673" LastActivityDate="2013-08-06T09:54:18.673" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2645" PostTypeId="1" AcceptedAnswerId="2681" CreationDate="2013-08-05T15:28:06.740" Score="2" ViewCount="374" Body="&lt;p&gt;I want to know how static routes are evaluated in Linux. Have a few more specific questions.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How are metrics used?&lt;/li&gt;&#xA;&lt;li&gt;If the packet is the last hop what do I put in the next hop field of the route? For example, if the packet is going to 192.168.1.2 should the router at .1 have a next hop of 192.168.1.1?&lt;/li&gt;&#xA;&lt;li&gt;What order are the routes applied?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any explanation or external links are welcome. Thank you. &lt;/p&gt;&#xA;" OwnerUserId="2272" LastEditorUserId="42290" LastEditDate="2017-12-13T10:02:01.727" LastActivityDate="2017-12-13T10:02:01.727" Title="Static routing in Linux" Tags="|routing|linux|" AnswerCount="1" CommentCount="5" FavoriteCount="0" ClosedDate="2019-01-24T00:17:33.697" ContentLicense="CC BY-SA 3.0" />
  <row Id="2646" PostTypeId="1" CreationDate="2013-08-05T15:56:12.937" Score="6" ViewCount="3431" Body="&lt;p&gt;I am trying to split the bandwidth between 2 parties using a C3750-X. It has the Lan base licence and is running on the 12.2 train.&#xA;The following is my config on an otherwise blank switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended ACL_20M  &#xA;permit ip any any  &#xA;!  &#xA;class-map match-all CLASS_20M  &#xA;  match access-group name ACL_20M  &#xA;!  &#xA;policy-map POLICY_20M  &#xA;  class CLASS_20M  &#xA;    police 20000000 100000 exceed-action drop  &#xA;!  &#xA;interface GigabitEthernet1/0/1  &#xA; service-policy input POLICY_20M  &#xA;!  &#xA;ip access-list extended ACL_180M  &#xA; permit ip any any  &#xA;!  &#xA;class-map match-all CLASS_180M  &#xA;  match access-group name ACL_180M  &#xA;!  &#xA;policy-map POLICY_180M  &#xA;  class CLASS_180M  &#xA;    police 180000000 100000 exceed-action drop  &#xA;!  &#xA;interface GigabitEthernet1/0/13  &#xA; service-policy input POLICY_180M  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm testing with iperf but don't see any effect when applying  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;service-policy input POLICY_whichever&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to an interface. Any assistance on why it doesn't work would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="2273" LastEditorUserId="8499" LastEditDate="2017-08-09T23:34:01.813" LastActivityDate="2017-08-09T23:34:01.813" Title="Traffic policing on 3750-x Lan base" Tags="|cisco|cisco-catalyst|policing|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2647" PostTypeId="1" AcceptedAnswerId="2696" CreationDate="2013-08-05T17:18:59.250" Score="10" ViewCount="5246" Body="&lt;p&gt;Cisco switches seem to allocate unique MAC address for each interface they have, this includes ports and vlan interfaces. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These unique MAC are derived from a &quot;Base ethernet MAC Address&quot;, which can be found with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MySwitch#show version&#xA;...snip...&#xA;Base ethernet MAC Address        : 70:10:5C:22:83:80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The interfaces MAC, then look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MySwitch#show interface FastEthernet0/1&#xA;Hardware is Fast Ethernet, address is 7010.5c22.8381&#xA;...snip...&#xA;&#xA;MySwitch#show interface vlan87&#xA;Hardware is EtherSVI, address is 7010.5c22.83c6&#xA;...snip...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, if I inspect a CDP packet received from a switch, the MAC address on the packet is the actual &quot;port&quot; MAC address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a reliable way to infer the switch &quot;Base ethernet MAC Address&quot; from receiving such a CDP interface MAC Address, so that I can use that &quot;Base ethernet MAC Address&quot; as a globally unique identifier for the switch device equipment on the network?&lt;/p&gt;&#xA;" OwnerUserId="2271" LastActivityDate="2013-08-08T02:55:01.203" Title="How to infer 2960S switch base ethernet MAC Address" Tags="|cisco|cisco-catalyst|mac-address|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2648" PostTypeId="2" ParentId="2646" CreationDate="2013-08-05T17:50:43.387" Score="1" Body="&lt;p&gt;You've most likely already done this but wanted to ensure you've enabled QOS on the interface or globally by using the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; mls qos&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2231" LastActivityDate="2013-08-05T17:50:43.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2650" PostTypeId="2" ParentId="2646" CreationDate="2013-08-05T21:29:49.997" Score="4" Body="&lt;p&gt;You're configuring it wrong. In order to get policing working on these switches you need to configure the following (I've taken this from a working switch of mine)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mls qos&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; switchport access vlan 500&#xA; switchport mode access&#xA; mls qos vlan-based&#xA;!&#xA;class-map match-all CUSTOMER_2&#xA; match input-interface  GigabitEthernet1/0/2&#xA;!&#xA;policy-map VLAN500_POLICE&#xA; class CUSTOMER_2&#xA;  police 10000000 1000000 exceed-action drop&#xA;!&#xA;policy-map VLAN500_PARENT&#xA; class class-default&#xA;  set dscp default&#xA;  service-policy VLAN500_POLICE&#xA;!&#xA;interface Vlan500&#xA; ip address 192.168.203.1 255.255.255.248&#xA; ip ospf 1 area 0&#xA; service-policy input VLAN500_PARENT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the only way I've ever got policing to work on a 3750&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-08-05T21:29:49.997" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2651" PostTypeId="2" ParentId="2641" CreationDate="2013-08-05T21:57:14.350" Score="2" Body="&lt;p&gt;You've most likely accidentally pushed the &quot;Mode&quot; button on the front-left of the switch while it was booting.  This will put the switch into &quot;switch: mode&quot;, where you can perform functions such as password recovery, work with the flash, etc. -- see Cisco here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps628/products_password_recovery09186a0080094184.shtml#topic1&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/products/hw/switches/ps628/products_password_recovery09186a0080094184.shtml#topic1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can type the command &quot;boot&quot; to reload the switch (or simply power cycle it), and it should then boot up normally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Rob.&lt;/p&gt;&#xA;" OwnerUserId="1680" LastActivityDate="2013-08-05T21:57:14.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2652" PostTypeId="1" CreationDate="2013-08-06T06:49:21.313" Score="2" ViewCount="100" Body="&lt;p&gt;I've setup per user Layer 2 policing on a pair of Cat6k with SUP720-3C to rate-limit wireless guest users. This is working fine and the flow table is populated as expected (with L2 QoS flows).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question: Is it possible to export these flows with NetFlow? I know that I cannot use NetFlow to gather additional flows because of flow-mask collision (policing is using &lt;code&gt;src-only&lt;/code&gt; and &lt;code&gt;dst-only&lt;/code&gt; already), but the table is already filling up. So it should be possible that NetFlow exports these when they age out?&lt;/p&gt;&#xA;" OwnerUserId="1334" LastEditorUserId="8499" LastEditDate="2017-08-08T14:09:41.593" LastActivityDate="2017-08-08T14:09:41.593" Title="NDE for QoS Flows on SUP720-3C?" Tags="|qos|cisco-6500|netflow|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2653" PostTypeId="2" ParentId="186" CreationDate="2013-08-06T11:32:17.583" Score="2" Body="&lt;p&gt;One use case of deploying MPLS would be to then deploy VPLS on top of this to &lt;em&gt;emulate&lt;/em&gt; a regular L2 network. MPLS/VPLS will bring certain benefits like load sharing over multiple backbone routers (whereas L2 would just pick one best path) or that you could deploy other MPLS based features in parallel to your VPLS cloud.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some Internet exchanges has moved to VPLS fairly recently, one being AMS-IX who have also posted some information on their setup; &lt;a href=&quot;https://www.ams-ix.net/technical/ams-ix-infrastructure/the-ams-ix-mplsvpls-infrastructure&quot; rel=&quot;nofollow&quot;&gt;https://www.ams-ix.net/technical/ams-ix-infrastructure/the-ams-ix-mplsvpls-infrastructure&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't build VPLS directly from your EX[34]xx boxes. EX4550 possibly does VPLS but I'm a tad uncertain. If you are running MX core you can do CCC (like EoMPLS but Juniper proprietary and only using one label) from the ports on the EX to the MX and switch it in the MX. I'm not sure what gain you would have from that though. If you only have one or two routers though, I don't see how this L2 topology will gain anything by the addition of &lt;strike&gt;bacon&lt;/strike&gt;MPLS/VPLS.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2013-08-06T11:32:17.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2654" PostTypeId="2" ParentId="2568" CreationDate="2013-08-06T11:57:24.493" Score="4" Body="&lt;p&gt;Just like BGP attributes are packed when sending BGP UPDATEs, they are stored in memory in a rather compact format where each prefixes only holds references to the attributes that apply to that route. The AS path and the communities applied to a route are typically the attributes that are largest in size and as these are often the same over a large amount of routes, a great deal of memory can be saved by just storing an AS path once and then keeping references to all routes for which this AS path applies. The exact in-memory format changes with different versions of IOS/JUNOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A route for the same prefix received via different eBGP sessions will likely share many attributes (especially if the eBGP sessions are to the same upstream) and so they can be &quot;packed&quot; quite efficiently in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your explanation of BGP behaviour is mostly correct. R1 has sent the content of its entire BGP RIB to R2. R2s eBGP session is enablde and for every route received, R2 will compare it to the one in its BGP RIB (which mostly contains routes from R1). When R2 finds a prefix from its new eBGP peer that is better than the one in BGP RIB, it will use the new eBGP route and announce it to R1. If R1 finds the route received from R2 to be better than its own route (received from its eBGP session) then R2 will withdraw the route that it announced to R2. The routers will only announce their best route and if the best route is not from eBGP but from another iBGP neighbor, it will not announce it unless you have some route-reflection going on as well. You can easily end up in a scenario where both R1 and R2 each select all the routes learnt from their respective eBGP session as the best routes and that means they will always announce a full table to their iBGP buddies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also something called &quot;best external&quot; which means you always announce your best eBGP route regardless if that's the one you have chosen as best path or not. Best external enhances convergence time by not having to go through &quot;BGP path hunting&quot; when something breaks. Obviously it consumes more memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I don't think BGP Soft reset enhancement is much of an enhancement. RAM is cheap, so keeping the routes, exactly as received from your neighbor, in memory is quite easy, especially on a modern router. JUNOS doesn't even offer you the option to not store it - it always keeps the Adj-RIB-IN, but JUNOS was designed in the late 90s when RAM was plentiful and not in the 80s when IOS made the scene. If someone out there designing a router thinks &quot;let's save on RAM because we have BGP soft reset enhancement&quot;, I'd like to shoot that person ;)&#xA;On the other hand, if you are running a network with old routers running low on memory I totally understand if you don't enable soft-reconf.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bottom line, it's difficult to say and depends on your environment.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2013-08-06T11:57:24.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2655" PostTypeId="5" CreationDate="2013-08-06T12:09:58.600" Score="0" Body="&lt;p&gt;Access-Control-Lists (ACLs) are typically lists of statements, used to match traffic passing through a device such as a router or firewall. This could be for use with QoS and prioritisation, filtering, or reporting.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-08-06T12:52:59.620" LastActivityDate="2013-08-06T12:52:59.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2656" PostTypeId="4" CreationDate="2013-08-06T12:09:58.600" Score="0" Body="Discussion on Access-Control-Lists (ACL) or Access-Control-Entries (ACE)" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-08-06T12:53:06.480" LastActivityDate="2013-08-06T12:53:06.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2658" PostTypeId="1" AcceptedAnswerId="2688" CreationDate="2013-08-06T14:03:36.733" Score="5" ViewCount="7722" Body="&lt;p&gt;I've the challenge to configure REP on a ring with 2 4500-X and 2 4506 as you can see on topologie picture. I was able to configure a basic REP ring but don't know how to define the block port as on picture. With my configuration the blocked port it's the 4500x-1 - Te1/16.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the configuration applied. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! ### On every Switch ###&#xA;! Configure REP on a admin vlan&#xA;!&#xA;conf t&#xA;rep admin vlan 1100&#xA;!&#xA;! ### 4500x-1 ###&#xA;!&#xA;! # Port to  4500x-2&#xA;interface TenGigabitEthernet1/1&#xA;! the port must be on trunk or PVLAN promiscuous trunk port. &#xA;rep segment 1 edge&#xA;!&#xA;! # Port to  4506-1&#xA;interface TenGigabitEthernet1/16 &#xA;rep segment 1 edge primary &#xA;!&#xA;!&#xA;! ### 4500x-2 ###&#xA;!&#xA;! # Port to  4500x-1&#xA;interface TenGigabitEthernet1/1 &#xA;rep segment 1 &#xA;!&#xA;! # Port to  4506-2&#xA;interface TenGigabitEthernet1/16 &#xA;no rep segment 1 edge primary &#xA;rep segment 1 edge&#xA;!&#xA;!&#xA;! ### 4506-1 ###&#xA;!&#xA;! # Port to  4500x-1&#xA;interface TenGigabitEthernet1/1 &#xA;rep segment 1 &#xA;!&#xA;! # Port to  4506-2&#xA;interface TenGigabitEthernet1/2 &#xA;rep segment 1&#xA;!&#xA;!&#xA;! ### 4506-2 ###&#xA;!&#xA;! # Port to  4500x-2&#xA;interface TenGigabitEthernet1/1 &#xA;rep segment 1 &#xA;!&#xA;! # Port to  4506-1&#xA;interface TenGigabitEthernet1/2 &#xA;rep segment 1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NV7M2.png&quot; alt=&quot;Topologie&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm looking is a solution for the describe problem - How to define certain port as blocked ? What is the best practice on REP implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read the official documentation and I'm still confuse on. If someone can share with me some document (other than the &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/15.02SG/configuration/guide/swrep.html&quot; rel=&quot;noreferrer&quot;&gt;official&lt;/a&gt;) to better understanding, I will be grateful.&lt;/p&gt;&#xA;" OwnerUserId="206" LastActivityDate="2017-07-12T19:50:22.900" Title="REP (Resilient Ethernet Protocol - Cisco Proprietary) configuration" Tags="|cisco|switch|rep|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2659" PostTypeId="1" CreationDate="2013-08-06T14:21:58.810" Score="3" ViewCount="3626" Body="&lt;p&gt;We are deploying a Cisco wireless network with a Cisco WLC 2504 controller and 2602 AP's.&#xA;Can you tell about your recommendation to deploy good L2 wireless roaming? What about such features as 802.11k (wlan assited-roaming neighbor-list, wlan assited-roaming dual-list, wlan assited-roaming prediction), 802.11r (Fast Roaming) and CCX Location Mesurement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I discovered that there are a lot of problems with 802.11r and clients that do not support this feature.&lt;/p&gt;&#xA;" OwnerUserId="904" LastEditorUserId="775" LastEditDate="2013-08-06T14:36:29.300" LastActivityDate="2013-11-23T19:18:56.200" Title="CISCO Wireless roaming: best practices" Tags="|cisco|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2660" PostTypeId="1" CreationDate="2013-08-06T14:29:01.450" Score="4" ViewCount="1105" Body="&lt;p&gt;I have a Centos 5 box running quagga 0.98.2 which is flooding &lt;code&gt;ospfd.log&lt;/code&gt; with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OSPF: Link State Update: LSA checksum error 2a32, 58d5.&#xA;OSPF: Link State Update: LSA checksum error 2a32, 63bf.&#xA;OSPF: Link State Update: LSA checksum error 2a32, 63bf.&#xA;OSPF: Link State Update: LSA checksum error 2a32, 63bf.&#xA;OSPF: Link State Update: LSA checksum error 2a32, 6ab1.&#xA;OSPF: Link State Update: LSA checksum error 2a32, 6dab.&#xA;OSPF: Link State Update: LSA checksum error 2a32, 6fa7.&#xA;OSPF: Link State Update: LSA checksum error 2a32, 6fa7.&#xA;OSPF: Link State Update: LSA checksum error 2a32, 6fa7.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It has 20 neighbors and same error appears only on one of them which is on the same physical network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is what can cause LSA checksum errors and how to identify which host is sending broken LSA updates?&lt;/p&gt;&#xA;" OwnerUserId="46" LastEditorUserId="775" LastEditDate="2013-08-06T14:38:02.707" LastActivityDate="2013-08-07T15:24:12.217" Title="OSPF LSA checksum error" Tags="|ospf|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2661" PostTypeId="1" AcceptedAnswerId="2663" CreationDate="2013-08-06T16:12:09.613" Score="10" ViewCount="4588" Body="&lt;p&gt;I am runing some BGP tests through the lab before rolling them out in production (thus, any IP addresses or AS numbers etc used here are done so in a completely fictitious manner).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something that has always bugged me is the output on Cisco IOS of &lt;code&gt;show ip route&lt;/code&gt;. What order are these routes in, it isn't numerical, 1, 2, 58 ,10! They aren't grouped by protocol , or metric either.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;br2#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     1.0.0.0/32 is subnetted, 4 subnets&#xA;B       1.1.1.1 [200/0] via 10.10.0.1, 00:20:24&#xA;B       1.1.0.1 [200/0] via 10.10.0.1, 00:20:24&#xA;B       1.1.0.2 [20/0] via 10.20.0.1, 00:15:03&#xA;B       1.1.2.1 [200/0] via 10.10.0.1, 00:20:24&#xA;     2.0.0.0/32 is subnetted, 4 subnets&#xA;B       2.1.2.1 [20/0] via 10.100.0.1, 07:41:53&#xA;B       2.1.3.1 [20/0] via 10.200.0.1, 07:41:53&#xA;B       2.1.1.1 [20/0] via 10.100.0.1, 07:41:53&#xA;B       2.1.4.1 [20/0] via 10.200.0.1, 07:41:53&#xA;     58.0.0.0/8 is variably subnetted, 3 subnets, 2 masks&#xA;B       58.58.58.2/32 [200/0] via 10.65.12.2, 00:20:25&#xA;S       58.58.58.0/24 is directly connected, Null0&#xA;B       58.58.58.1/32 [200/0] via 10.65.11.2, 00:20:26&#xA;     10.0.0.0/8 is variably subnetted, 15 subnets, 3 masks&#xA;i L2    10.10.0.0/30 [115/10] via 10.65.0.1, FastEthernet0/0&#xA;C       10.0.0.2/32 is directly connected, Loopback0&#xA;i L2    10.0.1.2/32 [115/30] via 10.65.0.1, FastEthernet0/0&#xA;i L2    10.0.0.1/32 [115/20] via 10.65.0.1, FastEthernet0/0&#xA;C       10.20.0.0/30 is directly connected, FastEthernet1/0&#xA;i L2    10.65.11.0/30 [115/20] via 10.65.0.1, FastEthernet0/0&#xA;i L2    10.65.13.0/30 [115/20] via 10.65.0.1, FastEthernet0/0&#xA;i L2    10.65.12.0/30 [115/20] via 10.65.0.1, FastEthernet0/0&#xA;i L2    10.65.1.0/28 [115/20] via 10.65.0.1, FastEthernet0/0&#xA;B       10.65.12.12/32 [200/0] via 10.65.12.2, 00:20:26&#xA;B       10.65.11.11/32 [200/0] via 10.65.11.2, 00:20:26&#xA;C       10.65.0.0/28 is directly connected, FastEthernet0/0&#xA;C       10.100.0.0/30 is directly connected, FastEthernet2/0.100&#xA;C       10.200.0.0/30 is directly connected, FastEthernet2/0.200&#xA;B       10.10.200.0/30 [20/0] via 10.200.0.1, 07:41:57&#xA;     60.0.0.0/32 is subnetted, 1 subnets&#xA;B       60.0.0.60 [200/0] via 10.65.13.2, 00:20:27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Even within the class-full boundaries or integer boundaries of prefix groups for example, &lt;code&gt;10.65.0.0/28&lt;/code&gt; comes after &lt;code&gt;10.65.11.11/32&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-08-07T11:46:36.423" Title="Cisco IOS: Show ip route output order" Tags="|cisco-commands|cisco-ios-12|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2662" PostTypeId="2" ParentId="2658" CreationDate="2013-08-06T16:39:37.400" Score="2" Body="&lt;p&gt;As this is strictly single ring topology, just configure all core ports as 'rep segment 1' and then the one port you normally want to be blocking as 'rep segment 1 edge primary' and 'rep preempt delay 15'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is network outage, the edge primary port will unblock and when connectivity is restored the topology will restore to original in 15s.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-08-07T17:17:59.217" LastActivityDate="2013-08-07T17:17:59.217" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2663" PostTypeId="2" ParentId="2661" CreationDate="2013-08-06T17:06:55.473" Score="13" Body="&lt;p&gt;They are in order of specificity; The most specific (longest network mask) is first, and the least specific (shortest netmask) is last. If the network is variably subnetted, then they are grouped with the least-specific of the various netmasks, and ordered most-specific-first in each of the groupings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems the output of &lt;code&gt;show ip route&lt;/code&gt; is in the order of the internal tree structure, rather than an explicitly ordered (in the sense of route selection order) listing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, here's an old post from the Cisco forums; &lt;a href=&quot;https://supportforums.cisco.com/thread/344940&quot;&gt;https://supportforums.cisco.com/thread/344940&lt;/a&gt; regarding IOS 12.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(If anyone can write a more authoritative answer, please leave me a comment and I'll delete my answer.)&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2013-08-07T11:46:36.423" LastActivityDate="2013-08-07T11:46:36.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2665" PostTypeId="1" AcceptedAnswerId="2674" CreationDate="2013-08-06T18:41:31.473" Score="10" ViewCount="46163" Body="&lt;p&gt;I am studying for CCNA. In my book I read that wireless access points belong to OSI layer 2. I did some research and I found that is correct. This raised lots of questions in my head so I hope I don't get on your nerves :P&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that these devices are connected to switches or routers, I also know that AP's use CSMA-CA (at layer 2).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is this the only reason why they are Layer 2?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there some kind of switching table inside the AP where it associates MAC's with output interfaces? What logical stuff does an AP have inside it? I ask this because if it has to forward packets it has to choose whether to send to the air or to the switch or router direclty connected to it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2284" LastEditorUserId="253" LastEditDate="2013-08-07T14:11:44.040" LastActivityDate="2017-02-03T18:22:24.960" Title="What OSI layer do Access Points operate on?" Tags="|wireless|switching|layer2|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2666" PostTypeId="1" AcceptedAnswerId="2675" CreationDate="2013-08-06T18:47:47.823" Score="8" ViewCount="20413" Body="&lt;p&gt;In case of multiple SSID's on some AP, how is the information forwarded?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean, the simplest AP's have just one wireless interface so its basically receiving trough one antenna and send it trough the same antenna which does not make much sense to me since in this case they end up beeing in the same collision domain.&lt;/p&gt;&#xA;" OwnerUserId="2284" LastEditorUserId="49" LastEditDate="2013-08-06T18:49:35.633" LastActivityDate="2022-05-20T21:38:33.517" Title="How are multiple SSID's handled on same access point?" Tags="|wireless|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2668" PostTypeId="1" AcceptedAnswerId="2676" CreationDate="2013-08-06T18:54:17.017" Score="8" ViewCount="2158" Body="&lt;p&gt;When I send packets to another computer (both computers have wi-fi) is the AP required to communicate or can the other machine receive the information directly from my computer without the AP?&lt;/p&gt;&#xA;" OwnerUserId="2284" LastEditorUserId="775" LastEditDate="2013-08-07T03:53:33.130" LastActivityDate="2013-08-07T03:53:33.130" Title="Does a wireless access point has a role between two wireless devices?" Tags="|wireless|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2669" PostTypeId="2" ParentId="2665" CreationDate="2013-08-06T19:43:48.887" Score="2" Body="&lt;p&gt;AP serves as a connectivity provider for clients on wireless,  it maintains MAC entries against each client. It provides IP using DHCP server on LAN side.  Forwards traffic on WAN side (can be on static or dynamic IP). &#xA;Works on Layer 2 and mostly can be said as connectivity provider between wired and wireless. &lt;/p&gt;&#xA;" OwnerUserId="2111" LastActivityDate="2013-08-06T19:43:48.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2671" PostTypeId="1" AcceptedAnswerId="2678" CreationDate="2013-08-06T20:47:29.170" Score="5" ViewCount="3556" Body="&lt;p&gt;I've been looking around trying to find the ALU version of Cisco's &quot;default-originate&quot; but have been unable to find it.  Is there a way to generate a zero route towards a BGP neighbor without having to redistribute a static/dynamic zero route into the BGP table?&lt;/p&gt;&#xA;" OwnerUserId="625" LastEditorUserId="561" LastEditDate="2013-08-07T07:41:34.197" LastActivityDate="2013-08-07T07:41:34.197" Title="Alcatel-Lucent BGP Default-Originate" Tags="|bgp|alcatel-lucent-7750|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2672" PostTypeId="2" ParentId="2666" CreationDate="2013-08-06T22:49:07.823" Score="3" Body="&lt;p&gt;Yes, multiple SSIDs on an AP will share the same collision domain.  Think of the SSIDs like a VLAN in that the SSID that the client associates to is a way to identify &quot;I'm part of this network&quot; and thus allow the AP to apply different security policies, for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of actual broadcast collisions and throughput, 20 devices on one SSID is functionally the same as 5 devices on 5 different SSIDs, all on the same AP.  The different SSIDs allow you to segregate the clients and treat them differently.&lt;/p&gt;&#xA;" OwnerUserId="142" LastActivityDate="2013-08-06T22:49:07.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2673" PostTypeId="2" ParentId="2668" CreationDate="2013-08-06T23:11:26.387" Score="4" Body="&lt;p&gt;In ad-hoc networks wireless clients talk directly to each other without any intermediate device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In infrastructure networks the APs are working as network bridges and all communication between wireless clients is going through them (even communication between clients associated to the same AP) This allows for advanced functionality such as &lt;a href=&quot;https://security.stackexchange.com/questions/16751/wireless-client-isolation-how-does-it-work-and-can-it-be-bypassed&quot;&gt;client isolation&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.953" LastActivityDate="2013-08-06T23:11:26.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2674" PostTypeId="2" ParentId="2665" CreationDate="2013-08-06T23:27:56.550" Score="9" Body="&lt;p&gt;Strictly speaking, access points are a L2 device.  Their primary function is to bridge 802.11 WLAN traffic to 802.3 Ethernet traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the real world, enterprise wireless vendors often push more functionality to either the AP itself and/or tie them into a controller, with the end result that they often incorporate functionality from higher layers as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't entirely follow #1, but neither the connection to a switch or router nor the use of CSMA-CA has anything to do with their function as a L2 device.  It is a L2 device because that is the layer of the network where it is designed to function.  It doesn't care nor need L3 or above to operate and allow devices to communicate (again strictly speaking).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for #2, yes, an AP (or any bridge) needs to keep track of which interface any individual device is connected.  In general (and simply), they work on the principle of frames destined to an associated station gets forwarded out the wireless interface and any other frames get forwarded out the wired interface (or sent to the controller).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-08-06T23:27:56.550" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2675" PostTypeId="2" ParentId="2666" CreationDate="2013-08-06T23:48:00.877" Score="8" Body="&lt;p&gt;The SSID is only part of the information used between an AP and a station, and many software clients will aggregate or simplify the networks they find into one entry in the wireless networks.  However with most enterprise wireless solutions, each AP will have a separate BSSID (looks like a MAC address) that is associated with a logical interface on the physical interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With some software clients (Intel used to do this, but I haven't used it in a while so not sure if they still do), you will see each unique AP/BSSID listed in the wireless network list, so you end up with multiple entries with the same SSID.  You can also use a software tool like &lt;a href=&quot;http://www.metageek.net/products/inssider/&quot;&gt;InSSIDer&lt;/a&gt; to view the individual devices broadcasting the same SSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are correct in that they share the same &quot;collision domain&quot; and resources, however there are many reasons to do so.  For instance, you may want to provide different security mechanisms such as WPA2-Enterprise for your employees and an &quot;Open&quot; network with a captive portal for guests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could do this with two different sets of APs, each doing one or the other.  However in the 2.4GHz space, you really only have three channels to work with in your channel plan, so unless you only need one AP for each, you are going to have channel overlap and still be sharing the &quot;collision domain&quot; (and this also complicates the channel planning significantly, but that's another discussion).  Better to do so with multiple logical interfaces on one device as this means less devices, a lower cost (both capital and operational), and a simpler network to manage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now there is a caveat, and that is with each additional BSSID/SSID on a physical device, the more you do lower the efficiency of the RF use, mainly because you are creating additional management traffic in the air.  While dated, you can find a good explanation on this effect in &lt;a href=&quot;http://www.arubanetworks.com/pdf/technology/whitepapers/wp_Virtual-Access-Points.pdf&quot;&gt;this document&lt;/a&gt;, if you are interested.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-08-06T23:48:00.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2676" PostTypeId="2" ParentId="2668" CreationDate="2013-08-07T00:05:05.210" Score="13" Body="&lt;p&gt;Since you mention two computers and an AP, I assume you are not talking about ad-hoc or direct connect, rather are referring to infrastructure mode operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, all communication is between each station and the AP.  This is because the station associates to the AP, establishing a relationship between the two devices, but there is no relationship between the stations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has a number of implications, but I will limit myself to two of the larger considerations in wireless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, just because a station can transmit to/from the AP, does not mean that any two stations associated to the same AP will be able to transmit to/from each other.  To simplify, if you picture the AP's coverage zone as a clock (analog with hands) with the AP in the middle, a station at &quot;12 o'clock&quot; that is talking to the AP may not be able to hear a station at &quot;6 o'clock&quot; on the circle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, the encryption key for security (whether based on personal/PSK or enterprise) is negotiated between the station and the AP.  Even if a station can hear a second station, it won't be able to understand any of the encrypted data in the frame. (&lt;strong&gt;Note:&lt;/strong&gt; in some cases you can intentionally decrypt this data, even if not the station and AP involved, however this is not normal operation.)&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-08-07T00:05:05.210" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2677" PostTypeId="2" ParentId="2660" CreationDate="2013-08-07T02:49:00.297" Score="4" Body="&lt;p&gt;Are all neighbors Quagga boxes as well or cisco/juniper/etc?  Could be any number of things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Bad interface on one of the neighbors&lt;/li&gt;&#xA;&lt;li&gt;Bad interface on switch facing one of neighbors on this network&lt;/li&gt;&#xA;&lt;li&gt;Misbehaving ospfd process on one of the quagga boxes &lt;/li&gt;&#xA;&lt;li&gt;Bug in Quagga?&lt;/li&gt;&#xA;&lt;li&gt;Bug in version of code running on actual router hardware (if one of your neighbors is not a Quagga box)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="190" LastActivityDate="2013-08-07T02:49:00.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2678" PostTypeId="2" ParentId="2671" CreationDate="2013-08-07T06:11:33.837" Score="5" Body="&lt;p&gt;I'm quite sure there is no such command or feature in TiMOS. The one way you can emulate such behavior is with a static blackhole-route, a prefix-list and a policy-statement. It's not what you asked but still pretty decent. Sample configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure router&#xA;    static-route 0.0.0.0/0 black-hole&#xA;    static-route ::/0 black-hole&#xA;    policy-options&#xA;        prefix-list &quot;default-only&quot;&#xA;            prefix 0.0.0.0/0 exact&#xA;            prefix ::/0 exact&#xA;        exit&#xA;        policy-statement &quot;default-originate&quot;&#xA;            entry 10&#xA;                from&#xA;                    protocol static&#xA;                    prefix-list &quot;default-only&quot;&#xA;                    family ipv4 ipv6&#xA;                exit&#xA;                action accept&#xA;                exit&#xA;            exit&#xA;            default-action next-policy&#xA;        exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you can apply that policy as an export policy in BGP group level before your normal export policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: Of course advertising default to your CE device without knowing if you have upstream connectivity could be considered as poor design. One way to enhance the configuration above is to make prefix-list of known dynamically learned prefixes from your network (or internet) and make those static blackhole routes conditional. This can be achieved with &lt;code&gt;prefix-list &amp;lt;name&amp;gt; [all|none]&lt;/code&gt; parameter in the static-route context. By default, logical OR is used.&lt;/p&gt;&#xA;" OwnerUserId="1197" LastEditorUserId="1197" LastEditDate="2013-08-07T06:37:40.807" LastActivityDate="2013-08-07T06:37:40.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2680" PostTypeId="1" AcceptedAnswerId="2708" CreationDate="2013-08-07T14:07:39.313" Score="4" ViewCount="221" Body="&lt;p&gt;Buffing up on Frame-Relay for testing EIGRP nuances over FR for CCNP - topology and relevant show command output here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YUhcq.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/YUhcq.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant PVC is between DLCI 103/301 (R1/R4)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does R4 send echo replies to 192.168.123.1, when I ping from R1?? &#xA;I know that if I source the ping from s0/0.103 it is successful, but I don't understand this conceptually.  I figured when R4 ARP'd for 192.168.123.4 it would receive the DLCI 103 and the combination of the map in R2 and route in R4 would get it to where it needed to go, but I'm clearly missing something.  Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="8499" LastEditDate="2018-12-21T05:28:40.153" LastActivityDate="2018-12-21T05:28:40.153" Title="Strange ping over frame-relay network" Tags="|cisco|ping|frame-relay|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2681" PostTypeId="2" ParentId="2645" CreationDate="2013-08-07T14:20:52.543" Score="3" Body="&lt;p&gt;1) Metrics show preference over another route with same prefix. For example you can  assign a low metric on a fast interface and a higher metric on a slow interface. If the fast interface goes down for some reason the slow interface will be used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Next hop is the gateway for this route. If your device is 192.168.1.100/24 and you want to add a static route for 10.0.0.0/8 with the gateway being 192.168.1.1, this is going to be your next hop. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) There is no special order. After you enter all the routes you want they will be used depending on the closest match, e.g 10.0.0.1/32 is preferred over 10.0.0.0/24, or the metric.&lt;/p&gt;&#xA;" OwnerUserId="2294" LastActivityDate="2013-08-07T14:20:52.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2682" PostTypeId="2" ParentId="2665" CreationDate="2013-08-07T14:56:24.097" Score="4" Body="&lt;p&gt;1) Access points normally operate in L2. There are some exceptions to this, but let's stick to the rule. They are L2 devices cause they are forwarding frames based on decisions made by looking at the mac-address table they have. When some device connects on the wired or wireless interfaces, the AP learns its mac address from the broadcasts and stores the mac address in a list, depending from which interface the address was learnt. So when a frame arrives at the AP it will look up the mac table and decide on which interface it will be sent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Regular access points shared the same logic as the switches. As I mentioned above, they have a mac address table were they store mac address associations depending on the interface the mac was learnt. &lt;/p&gt;&#xA;" OwnerUserId="2294" LastActivityDate="2013-08-07T14:56:24.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2683" PostTypeId="1" AcceptedAnswerId="2781" CreationDate="2013-08-07T15:14:48.733" Score="9" ViewCount="2241" Body="&lt;p&gt;I've got a catalyst 2960G, connected to a Netgear Prosafe GS718T switch (cheap manageable switch). Idea is I have a couple of users that need access to a test environment - hence the cheap switch. It's connected via fibre through a 1Gbit SFP over multimode, layer 1 looks ok, interface on the catalyst and the netgear are both up/up, but I can't get any traffic over it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The int on the 2960G is configured as default except it's in access mode (tried it with DTP on - doesn't work) on a specific VLAN, and the netgear is in it's default config, so it should just be acting as a dumb switch with no tagging on the link to the cat. However I do a &lt;code&gt;#sh mac address table&lt;/code&gt; on the cat and it doesn't return anything against the interface facing the netgear, and I try to ping to a good IP at the cat end from the netgear end and get nothing. Again interfaces are all up/up and the cat isn't blocking multiple mac addresses of one port (ie no port-security). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone else tried to use on of these Netgear GS switches with a cisco switch or similar over it's fibre int and got it working? The web interface is horrible, been trying to see if I can do anything in it, really want to avoid trunking it if I can as it's not needed and it looks like a real hassle on the netgear. Ideally I'd be using another catalyst but we've got none spare, and this netgear is meant to support all the ethernet standards. &lt;/p&gt;&#xA;" OwnerUserId="1411" LastEditorUserId="76" LastEditDate="2013-08-08T19:27:55.610" LastActivityDate="2013-08-12T19:31:54.377" Title="Problems Connecting Catalyst 2960G to Netgear Prosafe Via Fibre" Tags="|cisco-catalyst|switching|netgear-prosafe|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="2684" PostTypeId="2" ParentId="2660" CreationDate="2013-08-07T15:24:12.217" Score="0" Body="&lt;p&gt;Apparently it's very rare quagga bug which has been fixed in version 0.99.13&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will try upgrading and see if it fixes the problem.&lt;/p&gt;&#xA;" OwnerUserId="46" LastActivityDate="2013-08-07T15:24:12.217" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2685" PostTypeId="1" CreationDate="2013-08-07T15:38:14.823" Score="6" ViewCount="1755" Body="&lt;p&gt;I have two MX80 routers which are connected. When I enable the interface on one router I get the following packet from the other router which I can't explain:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;17:23:46.004429  In IP6 (hlim 1, next-header: Options (0), length: 32) fe80::aad0:e501:335e:b368 &amp;gt; ff02::2: HBH (rtalert: 0x0000) [icmp6 sum ok] ICMP6, multicast listener report max resp delay: 0 addr: ff02::2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also the local router sends a identical packet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;17:23:41.441762 Out IP6 (hlim 1, next-header: Options (0), length: 32) fe80::aad0:e501:3358:2a1b &amp;gt; ff02::2: HBH (rtalert: 0x0000) [icmp6 sum ok] ICMP6, multicast listener report max resp delay: 0 addr: ff02::2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MLD is off on the routers and I'm not sure what purpose this packet serves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas would be welcome.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-08-07T16:02:37.587" Title="Strange IPv6 packet seen when enabling interface on Juniper MX" Tags="|juniper|ipv6|juniper-mx|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2686" PostTypeId="2" ParentId="2685" CreationDate="2013-08-07T16:02:37.587" Score="1" Body="&lt;p&gt;This is not so much related to MLD so much as it is to listening on the built-in IPv6 multicast groups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ff02::1 is the all-nodes multicast - I'm actually surprised you don't see that too (are you sure that you don't?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ff02::2 is the all-routers multicast, any device configured to forward IPv6 packets will listen on it.&lt;/p&gt;&#xA;" OwnerUserId="378" LastActivityDate="2013-08-07T16:02:37.587" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2688" PostTypeId="2" ParentId="2658" CreationDate="2013-08-07T17:10:41.550" Score="3" Body="&lt;p&gt;I found the solution to my issue, read more carefully the cisco doc, take some notes and test. It's working now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's ring topology. We should configure on the same switch the ports, one 'edge' and the other 'edge primary' . In my example, I configure 4500x-1 the te1/1 as 'edge' and te1/16 'edge primary'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To achieve my goal, defining the alternate (block) port.&#xA;I found two ways,&lt;br&gt;&#xA;- By the command - &lt;code&gt;rep block port id &amp;lt;port-id&amp;gt; vlan all&lt;/code&gt; to be configured under primary edge port. &#xA;and the port id can be found here on interface to be block : &lt;code&gt;show interface &amp;lt;interface-id&amp;gt; rep&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other way is to configure under the port to be preferred as alternate entering under the interface configuration the following command &lt;code&gt;rep segment 1 preferred&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://8config.com/template/rJuIA4xpl&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuration Generator Link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! ### On every Switch ###&#xA;! Configure REP on a admin vlan&#xA;!&#xA;conf t&#xA;rep admin vlan 1XXX&#xA;!&#xA;! ### 4500x-1 ###&#xA;!&#xA;! # Port to  4500x-2&#xA;interface TenGigabitEthernet1/1&#xA;! the port must be on trunk or PVLAN promiscuous trunk port. &#xA;rep segment 1 edge&#xA;!&#xA;! # Port to  4506-1&#xA;interface TenGigabitEthernet1/16 &#xA;rep segment 1 edge primary&#xA;rep block port 00817CADXXXXXXXX vlan Y,Z&#xA;rep preempt delay 15&#xA;!&#xA;!&#xA;! ### 4500x-2 ###&#xA;!&#xA;! # Port to  4500x-1&#xA;interface TenGigabitEthernet1/1 &#xA;rep segment 1&#xA;!&#xA;! # Port to  4506-2&#xA;interface TenGigabitEthernet1/16 &#xA;rep segment 1 edge&#xA;!&#xA;!&#xA;! ### 4506-1 ###&#xA;!&#xA;! # Port to  4500x-1&#xA;interface TenGigabitEthernet1/1 &#xA;rep segment 1 &#xA;!&#xA;! # Port to  4506-2&#xA;interface TenGigabitEthernet1/2 &#xA;rep segment 1&#xA;!&#xA;!&#xA;! ### 4506-2 ###&#xA;!&#xA;! # Port to  4500x-2&#xA;interface TenGigabitEthernet1/1 &#xA;rep segment 1 &#xA;!&#xA;! # Port to  4506-1&#xA;interface TenGigabitEthernet1/2 &#xA;rep segment 1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT : Corrected, the previous config isn't right and I had an working but instable configuration. &lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2017-04-03T21:28:29.073" LastActivityDate="2017-04-03T21:28:29.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2690" PostTypeId="1" AcceptedAnswerId="3158" CreationDate="2013-08-07T17:43:55.960" Score="8" ViewCount="2284" Body="&lt;p&gt;I've an issue leading with Private Vlans. I've fiber modem and they can't reach the DHCP/TFTP to be provision. I suspect from the configuration of Private VLANs. Can you review them ? My doubts are mainly on access switch and trunk configuration on gigabit port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In brief, the modem when they power up they tried to get an IP through DHCP, send an untagged frame arrive at Access switch 4506 and should be handle on vlan 11 due they are the untagged private-vlan. After broadcast discovery DHCP should go to aggregator switch through vlan 10. On aggregator switch 4500x, there is an SVI vlan 10 with ip helper-address of provisioning server who send in unicast the packet to him.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/phmCW.png&quot; alt=&quot;pvlan topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Config on access switch 4506 : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 10&#xA;name vlan_10&#xA; private-vlan primary&#xA;!&#xA;vlan 20&#xA;name vlan_20&#xA; private-vlan primary&#xA;!&#xA;vlan 30&#xA;name vlan_30&#xA; private-vlan primary&#xA;!&#xA;! Isolated VLAN: Connects all CPE hosts to Switch &#xA;!&#xA;vlan 11&#xA;name Pvlan_11&#xA; private-vlan isolated&#xA;!&#xA;vlan 21&#xA;name Pvlan_21&#xA; private-vlan isolated&#xA;!&#xA;vlan 31&#xA;name Pvlan_31&#xA; private-vlan isolated&#xA;!&#xA;!  Associating&#xA;!&#xA;vlan 10&#xA; private-vlan assoc 11&#xA;!&#xA;vlan 20&#xA; private-vlan assoc 21&#xA;!&#xA;vlan 30&#xA; private-vlan assoc 31&#xA;!&#xA;! Isolated port (Can only communicate with Primary port)&#xA;!&#xA;interface giX/Y&#xA;switchport mode private-vlan trunk promiscuous&#xA;switchport private-vlan trunk native vlan 11&#xA;switchport private-vlan trunk allowed vlan 11,21,31&#xA;switchport private-vlan mapping trunk 10 11&#xA;switchport private-vlan mapping trunk 20 21&#xA;switchport private-vlan mapping trunk 30 31&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2013-08-07T18:04:33.330" LastActivityDate="2017-04-03T21:16:59.257" Title="Private-vlan configuration - connectivity issue" Tags="|cisco|switch|private-vlan|ftth|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2691" PostTypeId="2" ParentId="2240" CreationDate="2013-08-07T17:44:18.333" Score="1" Body="&lt;p&gt;There is also mrtg (&lt;a href=&quot;http://oss.oetiker.ch/mrtg/&quot; rel=&quot;nofollow&quot;&gt;http://oss.oetiker.ch/mrtg/&lt;/a&gt;), multi platform and free.&lt;/p&gt;&#xA;" OwnerUserId="2294" LastActivityDate="2013-08-07T17:44:18.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2692" PostTypeId="1" CreationDate="2013-08-07T18:42:30.810" Score="7" ViewCount="375" Body="&lt;p&gt;Can you make an HA pair out of an actual Nexus 1110 appliance vsm and a 1000V VM based vsm in one pair? If so can anyone point to documentation that allows it?&lt;/p&gt;&#xA;" OwnerUserId="919" LastActivityDate="2013-08-07T19:20:05.590" Title="Nexus 1000V HA with appliance and VM" Tags="|cisco|cisco-nexus-1000v|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2693" PostTypeId="2" ParentId="2692" CreationDate="2013-08-07T19:09:59.363" Score="5" Body="&lt;p&gt;I found only one reference to this, and it was the &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/nexus1000/sw/4_2_1_s_p_1_2/software/configuration/guide/n1010_vsvcs_cfg_6migrate.html&quot; rel=&quot;noreferrer&quot;&gt;software configuration guide for the Nexus 1010 appliance&lt;/a&gt;. Read through and you'll see the following statement:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Once you have created the virtual service on the primary Cisco Nexus&#xA;  1010, an HA pair forms between the secondary VSM on the ESX and the&#xA;  primary virtual service on the Cisco Nexus 1010.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This implies that - while meant to only be a transitory state, I'm sure - it is at least possible to form an HA pair between a 1000v VSB on a 1010 appliance and the ESXi-hosted VSM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you're using the newer 1110 model, I'd refer to the &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/nexus1000/sw/4_2_1_s_p_1_5_1/software/configuration/guide/n1010_vsvcs_cfg_9migrate_vsb.html&quot; rel=&quot;noreferrer&quot;&gt;new guide&lt;/a&gt;, but the aforementioned statement has been changed to only reflect migrations from the 1010 to the 1110, and does not include a migration directly from the hypervisor to the 1110:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Once you have created the virtual service on the primary Cisco Nexus&#xA;  1110 Series, an HA pair forms between the secondary VSB on the Cisco&#xA;  Nexus 1010 series and the primary virtual service on the Cisco Nexus&#xA;  1110 Series.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; I neglected to read the section titled &quot;Migrating a VSM&quot;. I instead linked to &quot;Migrating a VSB&quot; which of course is an appliance-only concept. Refer &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/nexus1000/sw/4_2_1_s_p_1_5_1/software/configuration/guide/n1010_vsvcs_cfg_6migrate.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; and you'll see a very promising, similar statement to before:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Once you have created the virtual service on the primary Cisco Nexus&#xA;  Virtual Services Appliance, an HA pair forms between the secondary VSM&#xA;  on the ESX and the primary virtual service on the Cisco Nexus Virtual&#xA;  Services Appliance.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I will say this much - I wouldn't recommend mixing the two permanently (i.e. not as part of a transitory migration state). Technical issues aside, you're undoubtedly going to get an earful every time you call TAC. If there's budgetary constraints that prevent you from getting a second physical appliance, just go all-virtual. &lt;/p&gt;&#xA;" OwnerUserId="1007" LastEditorUserId="1007" LastEditDate="2013-08-07T19:20:05.590" LastActivityDate="2013-08-07T19:20:05.590" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2695" PostTypeId="2" ParentId="2647" CreationDate="2013-08-07T20:42:30.807" Score="0" Body="&lt;p&gt;The size depends on the specific Cisco device, but you'll notice that the first MAC address ends in &lt;code&gt;80&lt;/code&gt; (and I've personally only ever seen Cisco switches end in &lt;code&gt;80&lt;/code&gt; or &lt;code&gt;00&lt;/code&gt;). It should be possible to take the MAC address you're seeing on the SVI and just mask off &lt;code&gt;0x7f&lt;/code&gt; on the LSB, though you'd need to confirm the size of the blocks, as they may vary with switch port density, and I know they vary for line cards. Try &lt;code&gt;sh diag&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-08-07T20:42:30.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2696" PostTypeId="2" ParentId="2647" CreationDate="2013-08-08T00:57:39.060" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a reliable way to infer the switch &quot;Base ethernet MAC Address&quot; from receiving such a CDP interface MAC Address, so that I can use that &quot;Base ethernet MAC Address&quot; as a globally unique identifier for the switch device equipment on the network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ccie20728.wordpress.com/2010/10/07/mac-addresses-of-switches/&quot; rel=&quot;nofollow&quot;&gt;You can't determine the base ethernet mac from CDP without guessing or assumptions&lt;/a&gt; about how Cisco behaves today (as well as future behavior).  On the other hand, if all you want is a unique identifier, use the Chassis serial number; however, that would require polling the CDP source for &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.47.1.1.1.1.11&quot; rel=&quot;nofollow&quot;&gt;entPhysicalSerialNum&lt;/a&gt;... a small price to eliminate guesswork.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.47.1.1.1.1.11&quot; rel=&quot;nofollow&quot;&gt;entPhysicalSerialNum&lt;/a&gt; has the added bonus of working across many of Cisco's current platforms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Sample SNMP walk of &lt;code&gt;entPhysicalSerialNum&lt;/code&gt;:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ snmpbulkwalk -OXsq -v 2c -c ciscoro -m ENTITY-MIB \&#xA;  172.16.1.200 entPhysicalDescr&#xA;entPhysicalDescr[1] 2650 chassis&#xA;entPhysicalDescr[2] 2600 Chassis Slot&#xA;entPhysicalDescr[3] C2600 Mainboard&#xA;entPhysicalDescr[4] 2600 DaughterCard Slot&#xA;entPhysicalDescr[5] 2600 DaughterCard Slot&#xA;entPhysicalDescr[6] AIM Container Slot 0&#xA;entPhysicalDescr[7] 2600 Chassis Slot&#xA;entPhysicalDescr[8] One port Fastethernet TX&#xA;entPhysicalDescr[9] AmdFE&#xA;entPhysicalDescr[10] AmdFE&#xA;[mpenning@tsunami ~]$ snmpbulkwalk -OXsq -v 2c -c ciscoro -m ENTITY-MIB \&#xA;  172.16.1.200 entPhysicalSerialNum&#xA;entPhysicalSerialNum[1] JAB05290Z8Q&#xA;entPhysicalSerialNum[2]&#xA;entPhysicalSerialNum[3] yyyyyyyyyyy&#xA;entPhysicalSerialNum[4]&#xA;entPhysicalSerialNum[5]&#xA;entPhysicalSerialNum[6]&#xA;entPhysicalSerialNum[7]&#xA;entPhysicalSerialNum[8] 25809045&#xA;entPhysicalSerialNum[9]&#xA;entPhysicalSerialNum[10]&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-08-08T02:55:01.203" LastActivityDate="2013-08-08T02:55:01.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2697" PostTypeId="1" AcceptedAnswerId="9926" CreationDate="2013-08-08T02:01:22.503" Score="1" ViewCount="3918" Body="&lt;p&gt;Scenario:&#xA;Host A (trusted side of firewall) needs to talk to a web server on port 443 (untrusted side)&#xA;Trusted rule exists on the Cisco ASA - permit Host_A Web_SVR port 443&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The trusted rule should allow Host A to talk to the web server on port 443 and also allow the return traffic for that session through the firewall due to the session being initiated by the trusted source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everywhere I have read that the ASA is state full and return traffic rule should not be needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is in my specific situation the ASA is denying the return traffic due to the source/destination ip's and protocols being reversed.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is what configurations exist in the default setup that make the Cisco ASA act in a stateful manner?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Historical Information:&#xA;The stateful manner was working previously.  We did an OS upgrade and received a new baseline config around the same time a few months ago.  This is around when the issue started.  I'm thinking it's a possible bug in the new IOS or a necessary config was overlooked or didn't take with the new IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've compared the old config and new config and there were a few object/service type syntax changes which were updated prior to loading the new config.  I did not notice any failed commands when the new configs were loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any suggestions as to what I should try to look for I would appreciate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&#xA;J&lt;/p&gt;&#xA;" OwnerUserId="2302" LastActivityDate="2016-08-28T05:56:10.033" Title="Default Stateful nature of Cisco ASA not working. What should I look for?" Tags="|cisco|cisco-asa|firewall|" AnswerCount="3" CommentCount="5" ClosedDate="2019-02-28T03:30:41.210" ContentLicense="CC BY-SA 3.0" />
  <row Id="2698" PostTypeId="2" ParentId="849" CreationDate="2013-08-08T02:01:48.867" Score="5" Body="&lt;p&gt;Both water intrusion and bending (literally the bend radius of parts of the cable) have detrimental effects that vary with wavelength. As such, a cable disturbance that made a bend tighter would be a classic, textbook reason for losing the longer wavelength - so would a failure of waterproofing. A multiple wavelength OTDR would be a textbook approach to finding that problem. If a section of cable has much higher attenuation at a longer wavelength than a shorter one, you look for a problem at that point in the cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Outside the textbook, looking at the more exposed cabling and connections at each end is a good practice, as they are more commonly disturbed, and thus more commonly the problem. Specifics of the fiber you have, the frequencies you had, which one you lost, and your available test equipment and ability to use it would be helpful. If you can relate any changes that were happening to the time that one frequency was lost, that can be helpful - if work was being done in the cable path, or if a network closet or server room had work going on at the time, that helps guide where to look first. It may not have been &quot;network work&quot; - cables and patch cords can be disturbed by electricians, HVAC and plumbers, or even furniture movers and custodial staff, depending on how exposed they are, or where they were routed. Even well-intentioned but ill-informed IT folks can cause a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think (having built a campus singlemode network from scratch) any decently competent network tech who wants to learn this stuff can, but there are a lot of people who do more harm than good through not understanding what they are dealing with, starting with the importance of clean connectors...and one dirty connector can damage a lot of formerly fine connectors. Depending on the type of &quot;dirt&quot; you won't just make the other connectors dirty - you can harm them to the point that they need to be replaced. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have, or can get, an OTDR and are, or can get, or can become someone who knows how to use it, it's the gold standard for finding problems. But you need a fair amount of gold to get one, or even rent one, which is why folks often use lesser tools to try and sort things out. Also, know what you are doing with respect to fibers and eye damage - most fiber lasers are invisible. Best practice is to isolate and disconnect both ends of the fiber before testing/examining, but in any case to use only optical systems that will protect your eye (either with filters, or by inserting a video step) when examining the ends of fibers to be sure they are clean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the two wavelengths are being used in opposite directions (as a Bi-Directional single-fiber link) you might also have something simple, like a multi-mode patch-cord on a singlemode system - that is non-blessed in either direction, but might allow reception at its end, while utterly ruining transmission from the end it is at.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2013-08-08T04:20:49.213" LastActivityDate="2013-08-08T04:20:49.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2699" PostTypeId="2" ParentId="493" CreationDate="2013-08-08T02:46:27.683" Score="6" Body="&lt;p&gt;Singlemode fiber often costs &lt;strong&gt;less&lt;/strong&gt; than multimode fiber. When building a 1Gb fiber network that I wanted to be able to go to 10Gb or faster on eventually, I found that the savings on cost of fiber (about half-price) for singlemode .vs. OM3 or OM4 multimode more than covered the (35% or so with adequate shopping) increase in cost for (brand-new) SFPs at that time - and did not limit my link lengths as OM3 or OM4 did. Nor is it limited to 10Gb. I also gained a huge loss budget, since a singlemode LX set is designed to go 10Km (but also works fine at 5m.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conventional wisdom has not caught up with that particular reality. If you are willing to look at used ex-fiberchannel SFPs (I was, but I didn't use them in the economic justification phase), the price of singlemode 1Gbe drops through the floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My preference is to ONLY use singlemode (and, inside buildings, 5e copper) at this point in time. I'll be doing a 25m singlemode fiber sometime soon, becasue it's a between-buildings connection, and I have been eliminating copper between building connections and having a lot less trouble with thunderstorms as a direct result of that. Under different constraints, I would probably consider using OM3/4 multimode for short, easily replaced runs inside buildings or within a server room; under the actual constraints I have to operate in (low budget) 10Gbe is still some time in the future - but I can go there on the cabling I have, when I can afford to. In my opinion, any multimode fiber should be considered as a short-term purchase with the progression of data rates. Just ask anyone with a 62.5 multimode plant (100Mbit, 2Km, IIRC) in place - the singlemode that could have been installed at the same time still works at today's data rates. OM1 is obsolete. OM2 is obsolete. OM3 is darn near obsolete. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have budget for and need for 10Gb short connections, fiber appears preferable to 10Gb copper, and the economics at last check still supported multimode. Keep an eye on those economics though, as history suggests that the price premium for singlemode will drop.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2013-08-08T02:46:27.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2701" PostTypeId="1" AcceptedAnswerId="2711" CreationDate="2013-08-08T03:12:23.413" Score="7" ViewCount="3093" Body="&lt;p&gt;We just got a new Supervisor7 with os 3.4.1.  I'm trying to configure authentication with tacacs, and I can't understand how to make it work.  This configuration works on our other switches, but it doesn't work on this 4500.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;username cisco privilege 15 secret 5 $1$qLGb$VQ7BdaJEpzGFqPeC979Uh1&#xA;tacacs-server host 10.4.25.8 key ourKeyIsSecret&#xA;aaa authentication login default group tacacs+ local&#xA;line vty 0 15&#xA; login authen default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can only login with the fallback password.  The switch is not even trying to contact tacacs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help?&lt;/p&gt;&#xA;" OwnerUserId="2068" LastEditorUserId="775" LastEditDate="2013-08-11T11:50:09.597" LastActivityDate="2013-08-11T11:50:09.597" Title="Tacacs VRF authentication" Tags="|cisco|cisco-catalyst|aaa|vrf|tacacs|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2702" PostTypeId="2" ParentId="1278" CreationDate="2013-08-08T03:45:04.590" Score="3" Body="&lt;p&gt;With LX optics, you can connect two units with a short patch cord and expect them to work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With ZX optics, you will need an attenuator if you are not connected to a long section of fiber. If the optical receiver is expecting a signal that has passed through 40-70Km of fiber, it can be overloaded by one that's passed through 5m of patch cord instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at Cisco's specs, and remembering that every 3dB is double/half the power, we see that a receiver twice as sensitive is coupled to a more powerful laser (almost 4 times as powerful at maximum):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/metro/me6500/hardware/installation/guide/0Bxcvrs.pdf&quot; rel=&quot;nofollow&quot;&gt;This page includes information about power out and power in for Cisco SFPs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note (under fiber loss budgets) that the maximum power out of a ZX is 5 dBm (min 0 dBm), and the maximum power in is -3 dBm - while the maximum power out of an LH/LX is -3 dbm (min -9.5 dBm), and the maximum power in is also -3dbm. That means a ZX with a low-loss link will overload its receiver, while an LX will not and cannot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The minimum receive power is -20 dBm LX, -23 dBm ZX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, the total loss budget for a ZX is between 23 &amp;amp; 28 dBm, and for an LX it's between 10.5 &amp;amp; 17 dBm.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2013-08-08T12:41:47.723" LastActivityDate="2013-08-08T12:41:47.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2703" PostTypeId="2" ParentId="2697" CreationDate="2013-08-08T03:46:01.157" Score="3" Body="&lt;p&gt;Can you post some configuration?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you can do is perform a packet trace to see how it passes through the ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA# packet-tracer input &amp;lt;trust-interface-name&amp;gt; tcp &amp;lt;src-addr&amp;gt; &amp;lt;src port&amp;gt; &amp;lt;dst ip&amp;gt; https&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One thing to note is that the source port probably doesn't matter, so just use 1234&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should give you a step by step rundown of the operations the packet is going through, and where it's being blocked.&lt;/p&gt;&#xA;" OwnerUserId="1682" LastActivityDate="2013-08-08T03:46:01.157" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2704" PostTypeId="1" AcceptedAnswerId="2705" CreationDate="2013-08-08T05:49:40.917" Score="4" ViewCount="1978" Body="&lt;p&gt;This content comes from one of my lectures on &quot;security&quot; module related to IP V6 section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no reference in the suggested book or lecture slides what that exactly is. However it is constantly added up to content like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Apply appropriate IPv6 controls, even if &quot;IPv4&quot; only&quot; (eg. rogue RA protection)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;IPv6 security issues:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IpV4 equivalents&lt;/li&gt;&#xA;&lt;li&gt;new issues (IPv6 rogue RA) &quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I tried to google - the content is not for mortal students. Could you please explain this phenomena of &quot;rogue router advertisement&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really need little detail, just what RA is, what exactly it does and why rogue RA is bad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much,&lt;/p&gt;&#xA;" OwnerUserId="2304" LastActivityDate="2013-08-08T06:23:21.953" Title="Rogue RA what is this and how to counter it?" Tags="|ipv6|rogue|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2705" PostTypeId="2" ParentId="2704" CreationDate="2013-08-08T06:23:21.953" Score="7" Body="&lt;p&gt;Router Advertisements (RAs) can provide autoconfiguration of default gateways for hosts instead of manually configuring each system.  The downside is similar to the Rogue DHCP Server scenario: A Rogue RA coming from a misconfigured router or even a Windows desktop in a wireless network, for example, can offer a default gateway that doesn't work as intended.&lt;/p&gt;&#xA;&lt;p&gt;Appropriate controls could be ACLs to block these from untrusted interfaces or implement RA Snooping (aka RA Guard) similar to DHCP Snooping.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;See source of Rogue RA info @ RFC6104 &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6104#section-3&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rogue IPv6 Router Advertisement Problem Statement&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;RA Guard config @ &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/ipv6/configuration/15-2s/ip6-ra-guard.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IPv6 Configuration Guide&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-08-08T06:23:21.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2708" PostTypeId="2" ParentId="2680" CreationDate="2013-08-08T08:39:28.887" Score="5" Body="&lt;p&gt;Your configuration is a bit strange. You have the same subnet on two multipoint interfaces. When you don't specify a source from R1 it chooses 192.168.123.1 as the source IP of the packet. R4 does not know how to encapsulate the frame to 192.168.123.1. This is how it looks from R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#ping 192.168.123.3&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.168.123.3, timeout is 2 seconds:&#xA;&#xA;IP: tableid=0, s=192.168.123.1 (local), d=192.168.123.3 (Serial0/0.103), routed via FIB&#xA;IP: s=192.168.123.1 (local), d=192.168.123.3 (Serial0/0.103), len 100, sending&#xA;Serial0/0.103(o): dlci 103(0x1871), pkt type 0x800(IP), datagramsize 104.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you look at CEF you can see that R1 has two entries for 192.168.123.0/24.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh ip cef 192.168.123.0 255.255.255.0&#xA;192.168.123.0/24, version 37, epoch 0, attached, connected, per-destination sharing&#xA;0 packets, 0 bytes&#xA;  via Serial0/0.102, 0 dependencies&#xA;    traffic share 1&#xA;    valid glean adjacency&#xA;  via Serial0/0.103, 0 dependencies&#xA;    traffic share 1&#xA;    valid glean adjacency&#xA;  0 packets, 0 bytes switched through the prefix&#xA;  tmstats: external 0 packets, 0 bytes&#xA;           internal 0 packets, 0 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R4 does not know how to encapsulate the frame.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Serial0/0(i): dlci 301(0x48D1), pkt type 0x800, datagramsize 104&#xA;ICMP: echo reply sent, src 192.168.123.3, dst 192.168.123.1&#xA;Serial0/0.301:Encaps failed--no map entry link 7(IP)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can add a frame map to resolve it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4(config)#int s0/0.301&#xA;R4(config-subif)#frame map ip 192.168.123.1 301&#xA;&#xA;R1#ping 192.168.123.3&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.168.123.3, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 36/49/60 ms&#xA;&#xA;ICMP: echo reply sent, src 192.168.123.3, dst 192.168.123.1&#xA;Serial0/0.301(o): dlci 301(0x48D1), pkt type 0x800(IP), datagramsize 104&#xA;Serial0/0(i): dlci 301(0x48D1), pkt type 0x800, datagramsize 104&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-08-08T08:39:28.887" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2709" PostTypeId="2" ParentId="2701" CreationDate="2013-08-08T09:34:05.823" Score="1" Body="&lt;p&gt;This is a part of the config I am using on 4506 running 12.2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username failsafe secret [local password]&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication attempts login 3&#xA;aaa authentication fail-message ^Your fail message here.^&#xA;aaa authentication login default group tacacs+ local&#xA;aaa authentication enable default group tacacs+ enable&#xA;aaa authorization exec default group tacacs+ if-authenticated &#xA;aaa accounting exec default start-stop group tacacs+&#xA;! &#xA;!&#xA;!&#xA;aaa session-id common&#xA;tacacs-server host [IP address]&#xA;tacacs-server timeout 10&#xA;no tacacs-server directed-request&#xA;tacacs-server key [key]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nothing on VTY for login. &#xA;Hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="2294" LastActivityDate="2013-08-08T09:34:05.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2710" PostTypeId="2" ParentId="2697" CreationDate="2013-08-08T09:36:04.680" Score="0" Body="&lt;p&gt;Could be bilateral routing on the ASA. If you have redundant paths between the source/destination over the ASA via multiple interfaces, and the packet leaves via one interface, and the response comes back on a different interface, then it's not in the state table and the ASA will drop it. I've had this quite a lot due to a out of band management network causing complexities around routing, we ended up having to fix it using PBR. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ACL's on the ASA do stateful by deafult, but it is possible to make an exception, can't remember how to do that off the top of my head, i'll have a look around and see if i can find it. &lt;/p&gt;&#xA;" OwnerUserId="1411" LastActivityDate="2013-08-08T09:36:04.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2711" PostTypeId="2" ParentId="2701" CreationDate="2013-08-08T10:12:53.087" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;This configuration works on our other switches, but it doesn't work on this 4500.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're using the on-board Sup7 FastEthernet port, so this is your problem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication login default group tacacs+ local&#xA;                                 ^^^^^^^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/15.1/XE_330SG/configuration/guide/sw_int.html#wp1138747&quot;&gt;The Sup7 OOB port is in a VRF&lt;/a&gt;; therefore, you have to configure &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_tacacs/configuration/xe-3s/sec-vrf-tacas-svrs.html&quot;&gt;Tacacs+ in a VRF&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;!&#xA;no tacacs-server host 10.4.25.8&#xA;!&#xA;aaa group server tacacs+ TacacsVrf&#xA;  server-private 10.4.25.8 key 7 ourKeyIsSecret&#xA;  ip vrf forwarding mgmtVrf&#xA;  ip tacacs source FastEthernet1&#xA;!&#xA;aaa authentication login default group TacacsVrf local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-08-08T12:03:03.963" LastActivityDate="2013-08-08T12:03:03.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2713" PostTypeId="1" AcceptedAnswerId="2739" CreationDate="2013-08-08T10:58:37.327" Score="6" ViewCount="5582" Body="&lt;p&gt;I need to remotely check the status of the fans and temperature of a switch that I currently do not have physical access to. I have done so in the past on a 2950 with the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Show environment&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I don't have this command on this platform. Does anyone know a command I can use check this? I don't have SNMP configured at the moment, I can do if its needed but I would rather just look it up with a command if possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Switch is a WS-C3548-XL running IOS 12.0(5)WC17.&lt;/p&gt;&#xA;" OwnerUserId="80" LastActivityDate="2013-08-09T06:23:14.970" Title="Chassis temperature and Fan status on Cisco 3548 switch" Tags="|cisco|switch|cisco-catalyst|cisco-commands|environmental-monitoring|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2716" PostTypeId="1" AcceptedAnswerId="2717" CreationDate="2013-08-08T13:22:56.100" Score="4" ViewCount="1020" Body="&lt;p&gt;I'm networking beginner&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a remote site without any servers and a Cisco 861 that has and IPsec VPN tunnel back to the main office.  I get an alert that it's offline via a ping test.  Yesterday this happened and I just power cycled the unit and they were back up in a few minutes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It happened again this morning (approx. 15 hours later) so I investigated further:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;LEDs look ok (WAN is blinking a bit)&lt;/li&gt;&#xA;&lt;li&gt;Can't ping inside interface via the LAN&lt;/li&gt;&#xA;&lt;li&gt;Unable to connect to console&lt;/li&gt;&#xA;&lt;li&gt;Power cycled&lt;/li&gt;&#xA;&lt;li&gt;Console connection displays the boot process and everything is back to normal after it boots up.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If I can't even connect to the console to review where should I start?  I have a desktop PC that could collect syslog info but I wouldn't think that would be helpful given the problem accessing the console.  There are only 10 users connecting to the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: include show version&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sho ver&#xA;Cisco IOS Software, C860 Software (C860-UNIVERSALK9-M), Version 15.0(1)M5, RELEASE SOFTWARE (fc2)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2011 by Cisco Systems, Inc.&#xA;Compiled Wed 23-Feb-11 19:44 by prod_rel_team&#xA;&#xA;ROM: System Bootstrap, Version 12.4(22r)YB5, RELEASE SOFTWARE (fc1)&#xA;&#xA;uptime is 39 minutes&#xA;System returned to ROM by power-on&#xA;System image file is &quot;flash:c860-universalk9-mz.150-1.M5.bin&quot;&#xA;Last reload type: Normal Reload&#xA;&#xA;&#xA;&#xA;Cisco 861 (MPC8300) processor (revision 1.0) with 236544K/25600K bytes of memory.&#xA;Processor board ID FTX151603YG&#xA;&#xA;5 FastEthernet interfaces&#xA;1 Virtual Private Network (VPN) Module&#xA;256K bytes of non-volatile configuration memory.&#xA;126000K bytes of ATA CompactFlash (Read/Write)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="2309" LastEditorUserId="76" LastEditDate="2013-08-08T19:02:29.703" LastActivityDate="2013-08-09T07:44:38.250" Title="Can't connect to console on down Cisco 861 Router" Tags="|cisco|router|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2717" PostTypeId="2" ParentId="2716" CreationDate="2013-08-08T13:42:25.353" Score="7" Body="&lt;p&gt;I haven't understood if you are or are not able to access the console when the device is not working. If you cannot access the console, it looks bad. Adding a syslog server is a very good idea, the device might send something prior to crashing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check if the IOS you are running is fine or deprecated due to problems and upgrade accordingly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually such behavior is a good reason to open a tac case at cisco, provided you still have some support contract. &lt;/p&gt;&#xA;" OwnerUserId="2294" LastActivityDate="2013-08-08T13:42:25.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2718" PostTypeId="2" ParentId="2716" CreationDate="2013-08-08T13:42:36.243" Score="0" Body="&lt;p&gt;Do a &lt;code&gt;show version&lt;/code&gt;, it might tell you why box froze. I'd also check the IOS version to see if there is a more recent version from cisco. Also have a look at the syslog, it might give you information on why the router died. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: - Much newer IOS available from Cisco - they're upto 15.3, and that version has been pulled from the download which could suggest bugs with it. &lt;/p&gt;&#xA;" OwnerUserId="1411" LastEditorUserId="1411" LastEditDate="2013-08-09T07:44:38.250" LastActivityDate="2013-08-09T07:44:38.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2721" PostTypeId="2" ParentId="2532" CreationDate="2013-08-08T15:05:31.873" Score="2" Body="&lt;p&gt;RFC4861 section 6.3.4.  Processing Received Router Advertisements:&#xA;      - If the prefix is already present in the host's Prefix List as&#xA;        the result of a previously received advertisement, reset its&#xA;        invalidation timer to the Valid Lifetime value in the Prefix&#xA;        Information option.  If the new Lifetime value is zero, time-out&#xA;        the prefix immediately (see Section 6.3.5).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, prefix is not forgotten immediately by host, at least if the implementation is robust and follows RFC4862. There are additional rules for prefix lifetime handling:&#xA;See RFC4862 section 5.5.3. Router Advertisement Processing, point e) more specific.&#xA;There is 2 hours &quot;safety&quot; period before prefix discard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When selecting the lifetimes, keep Preferred lifetime &amp;lt;= Valid lifetime!&lt;/p&gt;&#xA;" OwnerUserId="2310" LastActivityDate="2013-08-08T15:05:31.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2724" PostTypeId="5" CreationDate="2013-08-08T18:43:49.013" Score="0" Body="" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2013-08-08T19:13:04.050" LastActivityDate="2013-08-08T19:13:04.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2725" PostTypeId="4" CreationDate="2013-08-08T18:43:49.013" Score="0" Body="Fiber optic data transmission, cabling, connectors, interfaces. Questions should have this tag if they directly involve fiber optic transmission of data, fiber optic cabling and/or connectors, or interface devices directly attached to fiber optic cable. " OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2013-08-08T19:12:21.500" LastActivityDate="2013-08-08T19:12:21.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2726" PostTypeId="5" CreationDate="2013-08-08T18:57:04.820" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-08-08T18:57:04.820" LastActivityDate="2013-08-08T18:57:04.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2727" PostTypeId="4" CreationDate="2013-08-08T18:57:04.820" Score="0" Body="Passive Optical Networks (PONs) typically use long-range singlemode fiber to reduce or eliminate intermediate powered switches - this collapses the network into many connections to a single switch stack, and can eliminate the need for power and cooling of network closets, which become patchbays (no active electronics - thus, passive.)" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2013-08-08T19:12:47.627" LastActivityDate="2013-08-08T19:12:47.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2728" PostTypeId="1" AcceptedAnswerId="2734" CreationDate="2013-08-08T19:04:00.213" Score="9" ViewCount="784" Body="&lt;p&gt;When I erase the nvram on a Cisco AP (1252 and 1262), the static IP assigned to interface BVI1 is not erased. When I do a &lt;code&gt;show startup-config&lt;/code&gt; it says there is no startup config. But it always boots with that IP until I manually set it to DHCP assigned. Then when I reboot (without saving) it comes up as DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I erase it using the reset button on power up, the IP does not stick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can only imagine this is intended to keep from losing access to the AP when you erase the config. If this is the case, is there a command to wipe the IP too?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extra details:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IOS: 15&lt;/li&gt;&#xA;&lt;li&gt;Autonomous&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-08-09T12:05:00.200" LastActivityDate="2013-08-09T12:05:00.200" Title="Why does a Cisco AP keep its static IP when erasing NVRAM?" Tags="|cisco|wireless|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2729" PostTypeId="5" CreationDate="2013-08-08T19:41:27.527" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-08-08T19:41:27.527" LastActivityDate="2013-08-08T19:41:27.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2730" PostTypeId="4" CreationDate="2013-08-08T19:41:27.527" Score="0" Body="Optical networking not adequately covered by the &quot;fiber&quot; tag - or &quot;beyond&quot; it. Optical multiplexing and switching (in the optical domain, not optic modules plugged into an electrical switch) - CWDM, DWDM, ROADM, etc. Optical Amplification - EDFA, SOA, Raman." OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2013-08-08T19:51:50.307" LastActivityDate="2013-08-08T19:51:50.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2732" PostTypeId="2" ParentId="2716" CreationDate="2013-08-08T20:57:52.600" Score="1" Body="&lt;p&gt;Most of the good advice has been covered, but also: There's an outside chance that a &lt;code&gt;debug&lt;/code&gt; command could have been responsible. They're not preserved between reboots, but if some &lt;code&gt;debug&lt;/code&gt; option is getting set (via SNMP, some newbie admin like young @chrylis), it can linger until triggered and then crush the router's entire processing capability so hard it'll never come back.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-08-08T20:57:52.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2733" PostTypeId="2" ParentId="2436" CreationDate="2013-08-08T22:49:52.197" Score="3" Body="&lt;p&gt;I upgraded to Anyconnect 3.1.04063 and this has resolved my problem.&lt;/p&gt;&#xA;" OwnerUserId="949" LastActivityDate="2013-08-08T22:49:52.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2734" PostTypeId="2" ParentId="2728" CreationDate="2013-08-08T23:01:04.677" Score="11" Body="&lt;p&gt;You are correct, they leave the IP information so that you don't accidentally lose connectivity when working on an AP remotely.  As you noted, the button (which requires you to be local) will default the configuration including the IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also do this by entering the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;write default-config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-08-09T00:47:15.470" LastActivityDate="2013-08-09T00:47:15.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2735" PostTypeId="5" CreationDate="2013-08-09T04:06:52.280" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-08-09T04:06:52.280" LastActivityDate="2013-08-09T04:06:52.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2736" PostTypeId="4" CreationDate="2013-08-09T04:06:52.280" Score="0" Body="For questions about DHCP in in relation to network devices. For instance, you are setting up DHCP on a layer 3 switch. " OwnerUserId="2301" LastEditorUserId="8499" LastEditDate="2019-02-14T19:24:58.663" LastActivityDate="2019-02-14T19:24:58.663" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2737" PostTypeId="5" CreationDate="2013-08-09T04:14:05.860" Score="0" Body="&lt;p&gt;Network Address Translation, originally defined in RFC 1631 (subsequently updated in multiple RFCs), was developed as a temporary solution for the IPv4 address shortage until IPv6 could be developed and deployed. NAT is often confused with security, but it is not a security solution.&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T19:07:57.607" LastActivityDate="2016-11-29T19:07:57.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2738" PostTypeId="4" CreationDate="2013-08-09T04:14:05.860" Score="0" Body="For questions about Network Address Translation (NAT), a method of modifying network address information in IPv4 packet headers." OwnerUserId="7707" LastEditorUserId="8499" LastEditDate="2016-11-29T19:07:57.607" LastActivityDate="2016-11-29T19:07:57.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2739" PostTypeId="2" ParentId="2713" CreationDate="2013-08-09T06:23:14.970" Score="5" Body="&lt;p&gt;To extend my comment, these switches don't have any pollable environment sensors. Only WS-C3524-PWR-XL-EN model has pollable fan sensor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They've been completely out of support since 2007 and you'll never get newer software than WC17 which you are running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are having difficulties finding people who'll accept them free from us, so we usually just trash them.&#xA;If I'd have XL switches and no budget I'd upgrade them to 3550, which is also EOL, but much superior switch and can be acquired for 50USD/pcs. 3550 runs modern IOS, 12.2(55)SE8 but technically is out of SW maintenance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With 3550 you'd at least get MST, QinQ, L2PT, SSH, proper storm-control, IP routing, QoS, ACLs, SPAN.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-08-09T06:23:14.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2740" PostTypeId="1" AcceptedAnswerId="2751" CreationDate="2013-08-09T08:45:50.520" Score="5" ViewCount="16413" Body="&lt;p&gt;I'm trying to create route-based VPN connection between Cisco ASA and Juniper SRX, but I have a problem with ACL and Proxy IDs. Cisco ASA log states that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[IKEv1]Group = A.A.A.A, IP = A.A.A.A, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy B.B.B.B/255.255.255.0/6/0 local proxy Z.Z.Z.Z/255.255.255.255/6/22 on interface comcastpublic&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know how to make B.B.B.B/255.255.255.0/6/22 and where the problem is. The aim is to pass &lt;strong&gt;only SSH traffic&lt;/strong&gt; through this VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A.A.A.A - Juniper public IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B.B.B.B - Juniper private IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Y.Y.Y.Y - Cisco public IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Z.Z.Z.Z - Cisco private IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper SRX config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    fe-0/0/0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address A.A.A.A/26;&#xA;            }&#xA;        }&#xA;    }&#xA;    fe-0/0/7 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address B.B.B.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    st0 {&#xA;        unit 0 {&#xA;            multipoint;&#xA;            family inet {&#xA;                next-hop-tunnel 10.10.10.1 ipsec-vpn ipsec-vpn-1-cfgr;&#xA;                next-hop-tunnel 10.10.10.3 ipsec-vpn ipsec-vpn-2-cfgr;&#xA;                address 10.10.10.2/24;&#xA;            }&#xA;        }&#xA;        unit 1 {&#xA;            point-to-point;&#xA;            family inet {&#xA;                next-hop-tunnel 10.10.10.4 ipsec-vpn ipsec-vpn-remote-cfgr;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop A.A.A.1;&#xA;        route B.B.1.0/24 next-hop 10.10.10.1;&#xA;        route B.B.3.0/24 next-hop 10.10.10.3;&#xA;        route Z.Z.Z.Z/32 next-hop st0.1;&#xA;    }&#xA;}&#xA;security {&#xA;    ike {&#xA;        traceoptions {&#xA;            file size 1m;&#xA;            flag ike;&#xA;            flag next-hop-tunnels;&#xA;            flag all;&#xA;        }&#xA;        proposal ike-proposal-cfgr {&#xA;            authentication-method pre-shared-keys;&#xA;            dh-group group2;&#xA;            authentication-algorithm sha1;&#xA;            encryption-algorithm 3des-cbc;&#xA;            lifetime-seconds 3600;&#xA;        }&#xA;        policy ike-policy-remote-cfgr {&#xA;            mode main;&#xA;            proposals ike-proposal-cfgr;&#xA;            pre-shared-key ascii-text &quot;********&quot;;&#xA;        }&#xA;        gateway ike-gate-remote-cfgr {&#xA;            ike-policy ike-policy-remote-cfgr;&#xA;            address Y.Y.Y.Y;&#xA;            external-interface fe-0/0/0.0;&#xA;        }&#xA;    }&#xA;    ipsec {&#xA;        traceoptions {&#xA;            flag all;&#xA;        }&#xA;        proposal ipsec-proposal-remote-cfgr {&#xA;            protocol esp;&#xA;            authentication-algorithm hmac-sha1-96;&#xA;            encryption-algorithm 3des-cbc;&#xA;            lifetime-seconds 86400;&#xA;            lifetime-kilobytes 28800;&#xA;        }&#xA;        policy ipsec-policy-remote-cfgr {&#xA;            proposals ipsec-proposal-remote-cfgr;&#xA;        }&#xA;        vpn ipsec-vpn-remote-cfgr {&#xA;            bind-interface st0.1;&#xA;            vpn-monitor {&#xA;                optimized;&#xA;            }&#xA;            ike {&#xA;                gateway ike-gate-remote-cfgr;&#xA;                proxy-identity {&#xA;                    local B.B.B.B/24;&#xA;                    remote Z.Z.Z.Z/32;&#xA;                    service junos-ssh;&#xA;                }&#xA;                ipsec-policy ipsec-policy-remote-cfgr;&#xA;            }&#xA;            establish-tunnels immediately;&#xA;        }&#xA;    }&#xA;    alg {&#xA;        traceoptions {&#xA;            file alg.log size 100000 files 2;&#xA;        }&#xA;        dns disable;&#xA;        msrpc disable;&#xA;        rsh disable;&#xA;        sql disable;&#xA;    }&#xA;    flow {&#xA;        tcp-mss {&#xA;            all-tcp {&#xA;                mss 1400;&#xA;            }&#xA;            ipsec-vpn {&#xA;                mss 1350;&#xA;            }&#xA;        }&#xA;        tcp-session {&#xA;            no-syn-check;&#xA;            no-syn-check-in-tunnel;&#xA;            no-sequence-check;&#xA;        }&#xA;    }   &#xA;    policies {&#xA;        from-zone guest to-zone remote {&#xA;            policy local-to-spokes {&#xA;                match {&#xA;                    source-address net-cfgr_B-B-B-B--24;&#xA;                    destination-address net-cfgr_Z-Z-Z-Z--32;&#xA;                    application junos-ssh;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone remote to-zone guest {&#xA;            policy spokes-to-local {&#xA;                match {&#xA;                    source-address net-cfgr_Z-Z-Z-Z--32;&#xA;                    destination-address net-cfgr_B-B-B-B--24;&#xA;                    application junos-ssh;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    zones {&#xA;        security-zone remote {&#xA;            address-book {&#xA;                address net-cfgr_Z-Z-Z-Z--32 Z.Z.Z.Z/32;&#xA;            }&#xA;            interfaces {&#xA;                st0.1;&#xA;            }&#xA;        }&#xA;        security-zone guest {&#xA;            address-book {&#xA;                address net-cfgr_B-B-B-B--24 B.B.B.B/24;&#xA;            }&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                fe-0/0/7.0;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco ASA config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 9.0(2) &#xA;!&#xA;interface GigabitEthernet0/0&#xA; nameif comcastpublic&#xA;  ip address Y.Y.Y.Y &#xA;!&#xA;object network VPNPC&#xA; host Z.Z.Z.Z&#xA; description VPN PC S2S&#xA;object network REMOTE&#xA; subnet B.B.B.B 255.255.255.0&#xA;&#xA;access-list comcastpublic_access_in extended permit object SSH object VPNPC object REMOTE &#xA;&#xA;access-list comcastpublic_cryptomap_3 extended permit tcp object VPNPC object REMOTE eq ssh &#xA;&#xA;nat (private,comcastpublic) source static VPNPC VPNPC destination static REMOTE REMOTE no-proxy-arp route-lookup&#xA;nat (comcastpublic,private) source static any any destination static &#xA;!&#xA;nat (private,comcastpublic) after-auto source dynamic any interface dns&#xA;access-group comcastpublic_access_in in interface comcastpublic&#xA;&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac &#xA;&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;&#xA;crypto map comcastpublic_map 4 match address comcastpublic_cryptomap_3&#xA;crypto map comcastpublic_map 4 set peer A.A.A.A &#xA;crypto map comcastpublic_map 4 set ikev1 transform-set ESP-3DES-SHA&#xA;crypto map comcastpublic_map 4 set ikev2 ipsec-proposal 3DES&#xA;crypto map comcastpublic_map 4 set security-association lifetime seconds 86400&#xA;crypto map comcastpublic_map 4 set security-association lifetime kilobytes 28800&#xA;crypto map comcastpublic_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map comcastpublic_map interface comcastpublic&#xA;&#xA;crypto ikev2 policy 2&#xA; encryption 3des&#xA; integrity sha&#xA; group 2&#xA; prf sha&#xA; lifetime seconds 28800&#xA;crypto ikev2 policy 30&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;&#xA;crypto ikev2 enable comcastpublic&#xA;crypto ikev1 enable comcastpublic&#xA;&#xA;crypto ikev1 policy 1&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 28800&#xA;crypto ikev1 policy 8&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 3600&#xA;crypto ikev1 policy 100&#xA; authentication crack&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 110&#xA; authentication rsa-sig&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 120&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;&#xA;!&#xA;group-policy GroupPolicy_A.A.A.A internal&#xA;group-policy GroupPolicy_A.A.A.A attributes&#xA; vpn-tunnel-protocol ikev1 ikev2 &#xA;&#xA;&#xA;tunnel-group A.A.A.A type ipsec-l2l&#xA;tunnel-group A.A.A.A general-attributes&#xA; default-group-policy GroupPolicy_A.A.A.A&#xA;tunnel-group A.A.A.A ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Received local Proxy Host data in ID Payload:  Address Z.Z.Z.Z, Protocol 6, Port 22&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, QM IsRekeyed old sa not found by addr&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Static Crypto Map check, checking map = comcastpublic_map, seq = 1...&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Static Crypto Map check, map = comcastpublic_map, seq = 1, ACL does not match proxy IDs src:B.B.B.B dst:Z.Z.Z.Z&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Static Crypto Map check, checking map = comcastpublic_map, seq = 2...&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Static Crypto Map check, map = comcastpublic_map, seq = 2, ACL does not match proxy IDs src:B.B.B.B dst:Z.Z.Z.Z&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Static Crypto Map check, checking map = comcastpublic_map, seq = 3...&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Static Crypto Map check, map = comcastpublic_map, seq = 3, ACL does not match proxy IDs src:B.B.B.B dst:Z.Z.Z.Z&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Static Crypto Map check, checking map = comcastpublic_map, seq = 4...&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Static Crypto Map check, map = comcastpublic_map, seq = 4, ACL does not match proxy IDs src:B.B.B.B dst:Z.Z.Z.Z&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Static Crypto Map check, checking map = comcastpublic_map, seq = 5...&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Static Crypto Map check, map = comcastpublic_map, seq = 5, ACL does not match proxy IDs src:B.B.B.B dst:Z.Z.Z.Z&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Skipping dynamic map SYSTEM_DEFAULT_CRYPTO_MAP sequence 65535: cannot match peerless map when peer found in previous map entry.&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy B.B.B.B/255.255.255.0/6/0 local proxy Z.Z.Z.Z/255.255.255.255/6/22 on interface comcastpublic&#xA;Aug 05 05:19:23 [IKEv1 DEBUG]Group = A.A.A.A, IP = A.A.A.A, sending notify message&#xA;Aug 05 05:19:23 [IKEv1 DEBUG]Group = A.A.A.A, IP = A.A.A.A, constructing blank hash payload&#xA;Aug 05 05:19:23 [IKEv1 DEBUG]Group = A.A.A.A, IP = A.A.A.A, constructing qm hash payload&#xA;Aug 05 05:19:23 [IKEv1]IP = A.A.A.A, IKE_DECODE SENDING Message (msgid=d07c313e) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 216&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, QM FSM error (P2 struct &amp;amp;0x00007fffa28c2920, mess id 0x5ef38480)!&#xA;Aug 05 05:19:23 [IKEv1 DEBUG]Group = A.A.A.A, IP = A.A.A.A, IKE QM Responder FSM error history (struct &amp;amp;0x00007fffa28c2920)  &amp;lt;state&amp;gt;, &amp;lt;event&amp;gt;:  QM_DONE, EV_ERROR--&amp;gt;QM_BLD_MSG2, EV_NEGO_SA--&amp;gt;QM_BLD_MSG2, EV_IS_REKEY--&amp;gt;QM_BLD_MSG2, EV_CONFIRM_SA--&amp;gt;QM_BLD_MSG2, EV_PROC_MSG--&amp;gt;QM_BLD_MSG2, EV_HASH_OK--&amp;gt;QM_BLD_MSG2, NullEvent--&amp;gt;QM_BLD_MSG2, EV_COMP_HASH&#xA;Aug 05 05:19:23 [IKEv1 DEBUG]Group = A.A.A.A, IP = A.A.A.A, sending delete/delete with reason message&#xA;Aug 05 05:19:23 [IKEv1]Group = A.A.A.A, IP = A.A.A.A, Removing peer from correlator table failed, no match!&#xA;Aug 05 05:19:23 [IKEv1 DEBUG]Group = A.A.A.A, IP = A.A.A.A, IKE SA MM:f4ec0f2f rcv'd Terminate: state MM_ACTIVE  flags 0x00010042, refcnt 1, tuncnt 0&#xA;Aug 05 05:19:23 [IKEv1 DEBUG]Group = A.A.A.A, IP = A.A.A.A, IKE SA MM:f4ec0f2f terminating:  flags 0x01010002, refcnt 0, tuncnt 0&#xA;Aug 05 05:19:23 [IKEv1 DEBUG]Group = A.A.A.A, IP = A.A.A.A, sending delete/delete with reason message&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could anybody help with this problem?&lt;/p&gt;&#xA;" OwnerUserId="2313" LastEditorUserId="2313" LastEditDate="2013-08-09T12:15:53.780" LastActivityDate="2021-02-26T17:15:55.443" Title="Site-to-site VPN between Cisco ASA and Juniper SRX" Tags="|cisco|vpn|juniper|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2742" PostTypeId="1" AcceptedAnswerId="2743" CreationDate="2013-08-09T09:37:21.087" Score="9" ViewCount="5924" Body="&lt;p&gt;I'm not sure what is the difference in behaviour between &lt;code&gt;switchport block multicast&lt;/code&gt; and &lt;code&gt;storm-control multicast&lt;/code&gt; and I don't think cisco elaborates the difference very well in their documentation, other than the fact storm-control grants you levels of control, but for this case, suppose the storm-control only lets you pick up 0 or 100. How is it any different from switchport block, for instance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: I accidentally wrote &quot;switchport block unicast&quot; when I intended to write &quot;switchport block multicast&quot;. &lt;/p&gt;&#xA;" OwnerUserId="2314" LastEditorUserId="8499" LastEditDate="2018-03-19T16:13:57.510" LastActivityDate="2018-03-19T16:13:57.510" Title="switchport block multicast vs storm-control multicast" Tags="|cisco|switch|multicast|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2743" PostTypeId="2" ParentId="2742" CreationDate="2013-08-09T09:52:01.243" Score="12" Body="&lt;p&gt;Well the first difference would be that &lt;code&gt;switchport block unicast&lt;/code&gt; blocks unknown unicast and &lt;code&gt;storm-control multicast&lt;/code&gt; blocks multicast packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference between &lt;code&gt;switchport block XXXcast&lt;/code&gt; and &lt;code&gt;storm-control XXXcast&lt;/code&gt; is exactly what you want to exclude in your question. You can pick any percent value for &lt;code&gt;storm-control&lt;/code&gt;. It will block traffic of the specified type which exceeds this percentage of bandwidth on the port. &lt;code&gt;switchport block&lt;/code&gt; is a simple yes/no. It blocks everything when activated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As ytti mentioned, on some low-end boxes when &lt;code&gt;storm-control multicast&lt;/code&gt; is exceeded all traffic will get filtered. In that case &lt;code&gt;storm-control multicast&lt;/code&gt; is dangerous and useless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also on high-bandwidth interfaces (1/10GE) please remember that even a small percentage of the bandwidth can kill a box that punts the packets to the CPU. If possible use CoPP to protect the control plane. Also always use pps instead of bps for CoPP if possible.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2013-08-09T12:25:48.003" LastActivityDate="2013-08-09T12:25:48.003" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2745" PostTypeId="1" AcceptedAnswerId="2806" CreationDate="2013-08-09T12:13:46.477" Score="5" ViewCount="6390" Body="&lt;p&gt;I've a CPE connected to a 4506 switch. The interface is Up but I don't see traffic CPE MAC address on MAC sddes-table&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've already replaced the cable, SFP and port. Now I've the minimal config (nothing i.e. switchport access) and no MAC yet. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4506-1#sh int gi2/3&#xA;GigabitEthernet2/3 is up, line protocol is up (connected) &#xA;  Hardware is Gigabit Ethernet Port, address is XXXX.XX7b.c407 (bia XXXX.XX7b.c407)&#xA;  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec, &#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 1000Mb/s, link type is force-up, media type is 1000Base-2BX10-D&#xA;  input flow-control is on, output flow-control is on &#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 00:13:11&#xA;  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     444 packets input, 200910 bytes, 0 no buffer&#xA;     Received 446 broadcasts (0 multicasts)&#xA;     0 runts, 0 giants, 0 throttles &#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 input packets with dribble condition detected&#xA;     463 packets output, 35901 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&#xA;4506-1#sh mac address-table &#xA;Unicast Entries&#xA; vlan     mac address     type        protocols               port&#xA;---------+---------------+--------+---------------------+-------------------------&#xA;   1      XXXX.XX43.23ad   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;   1      XXXX.XX43.23ad   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1100      XXXX.XX6a.2548   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1100      XXXX.XXa1.6f3f   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1100      XXXX.XXa1.7b7f   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1100      XXXX.XX48.fabf    static ip,ipx,assigned,other Switch                     &#xA;1110      XXXX.XX07.ac01   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1111      XXXX.XX07.ac01   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1111      XXXX.XXa1.6f3f   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1112      XXXX.XX07.ac01   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1112      XXXX.XXa1.6f3f   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1120      XXXX.XX07.ac01   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1120      XXXX.XXa1.7b7f   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1121      XXXX.XX07.ac01   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1121      XXXX.XXa1.7b7f   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1122      XXXX.XX07.ac01   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;1122      XXXX.XXa1.7b7f   dynamic ip,ipx,assigned,other TenGigabitEthernet1/1      &#xA;&#xA;4506-1#sh mac address-table int gi2/3&#xA;Multicast Entries&#xA; vlan      mac address     type    ports&#xA;---------+---------------+-------+--------------------------------------------&#xA;   1      ffff.ffff.ffff   system Gi2/3,Te1/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SFP is 1000Base-2BX10-D and I check the &lt;a href=&quot;https://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6577/product_data_sheet0900aecd8033f885.pdf&quot; rel=&quot;nofollow&quot;&gt;specifications&lt;/a&gt;. I saw the operation range for the SFP is RX: -3 to -19.5 and TX: -3 to -9. &#xA;When I type the command,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4506-1#sh int gi2/1 transceiver &#xA;ITU Channel not available (Wavelength not available),&#xA;Transceiver is internally calibrated.&#xA;If device is externally calibrated, only calibrated values are printed.&#xA;++ : high alarm, +  : high warning, -  : low warning, -- : low alarm.&#xA;NA or N/A: not applicable, Tx: transmit, Rx: receive.&#xA;mA: milliamperes, dBm: decibels (milliwatts).&#xA;&#xA;                                 Optical   Optical&#xA;           Temperature  Voltage  Tx Power  Rx Power&#xA;Port       (Celsius)    (Volts)  (dBm)     (dBm)&#xA;---------  -----------  -------  --------  --------&#xA;Gi2/1        36.3       3.25      -6.1     -22.0  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I think this is related with Fiber Optic link but the packets counters are incrementing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ADD info :  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Patched cable of 3M cable due to specification. Problem not solved. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output of &lt;code&gt;debug platform packet all int gi2/2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Aug 12 03:30:03.803: Tx packet to Port Gi2/2 Vlan Tag 1 FwdVlan 1 CoS 7 TagType No   Tag Src XX:XX:XX:7B:C4:06 Dst 01:80:C2:00:00:00 Type/Len 0x0026 Length 60  &#xA;*Aug 12 03:30:05.802: Tx packet to Port Gi2/2 Vlan Tag 1 FwdVlan 1 CoS 7 TagType No   Tag Src XX:XX:XX:7B:C4:06 Dst 01:80:C2:00:00:00 Type/Len 0x0026 Length 60  &#xA;*Aug 12 03:30:07.802: Tx packet to Port Gi2/2 Vlan Tag 1 FwdVlan 1 CoS 7 TagType No    Tag Src XX:XX:XX:7B:C4:06 Dst 01:80:C2:00:00:00 Type/Len 0x0026 Length 60  &#xA;*Aug 12 03:30:09.802: Tx packet to Port Gi2/2 Vlan Tag 1 FwdVlan 1 CoS 7 TagType No   Tag Src XX:XX:XX:7B:C4:06 Dst 01:80:C2:00:00:00 Type/Len 0x0026 Length 60  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2013-08-12T08:42:03.687" LastActivityDate="2014-06-04T08:10:35.467" Title="SFP / Fiber Link Issue - Can't connect a Fiber CPE" Tags="|cisco|switch|interface|" AnswerCount="2" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2747" PostTypeId="1" AcceptedAnswerId="2748" CreationDate="2013-08-09T14:59:08.757" Score="10" ViewCount="4088" Body="&lt;p&gt;Whenever we boot or reboot a Cisco router or switch we have to wait a number of minutes before we can get a username prompt for login. We get a few fail messages&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Press RETURN to get started.&#xA;% Authentication failed&#xA;&#xA;% Authentication failed&#xA;&#xA;% Authentication failed&#xA;&#xA;Press RETURN to get started.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After a few minutes the below error message comes up and we can then successfully get a username prompt to start the login process.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Aug  9 09:48:25.719: %AAA-3-DROPACCTFAIL: Accounting record dropped, send to server failed: system&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Our default AAA config was created a long time ago so it may need some updating if it is the cause of our issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VRF devices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;aaa new-model&#xA;aaa group server tacacs+ tacacs1&#xA; server-private &amp;lt;IP&amp;gt; key 7 &amp;lt;key&amp;gt;&#xA; server-private &amp;lt;IP&amp;gt; key 7 &amp;lt;key&amp;gt;&#xA; ip vrf forwarding &amp;lt;vrf-name&amp;gt;&#xA; ip tacacs source-interface &amp;lt;interface&amp;gt;&#xA;aaa authentication login default group tacacs1 local&#xA;aaa authentication login no_tacacs enable&#xA;aaa authentication login eap_methods group rad_eap&#xA;aaa authentication login mac_methods local&#xA;aaa authentication ppp default group tacacs1&#xA;aaa authorization exec default group tacacs1 local&#xA;aaa authorization network default group tacacs1 local&#xA;aaa accounting exec default start-stop group tacacs1&#xA;aaa accounting commands 1 default stop-only group tacacs1&#xA;aaa accounting commands 15 default start-stop group tacacs1&#xA;aaa accounting network default start-stop group tacacs1&#xA;aaa accounting network acct_methods start-stop group rad_acct&#xA;aaa accounting connection default start-stop group tacacs1&#xA;aaa accounting system default start-stop group tacacs1&#xA;aaa session-id common&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Non-VRF devices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;aaa new-model&#xA;aaa authentication login default group tacacs+ local&#xA;aaa authentication login no_tacacs enable&#xA;aaa authentication ppp default group tacacs+&#xA;aaa authentication dot1x default group radius&#xA;aaa authorization exec default group tacacs+ local&#xA;aaa authorization network default group radius&#xA;aaa accounting exec default start-stop group tacacs+&#xA;aaa accounting commands 1 default stop-only group tacacs+&#xA;aaa accounting commands 15 default start-stop group tacacs+&#xA;aaa accounting network default start-stop group tacacs+&#xA;aaa accounting connection default start-stop group tacacs+&#xA;aaa accounting system default start-stop group tacacs+&#xA;aaa session-id common&#xA;!&#xA;tacacs-server host &amp;lt;ip&amp;gt;&#xA;tacacs-server host &amp;lt;ip&amp;gt;&#xA;tacacs-server directed-request&#xA;tacacs-server key 7 &amp;lt;key&amp;gt;&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="267" LastEditorUserId="267" LastEditDate="2013-08-09T17:24:51.913" LastActivityDate="2013-08-09T17:24:51.913" Title="Long login delay when cisco device is booted" Tags="|switch|router|cisco-ios-12|cisco-ios-15|tacacs|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2748" PostTypeId="2" ParentId="2747" CreationDate="2013-08-09T15:47:00.380" Score="13" Body="&lt;p&gt;If your switch supports it (not all IOS versions do), the following command should fix this for you:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no aaa accounting system guarantee-first&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is an article that goes into more depth:  &lt;a href=&quot;http://ccie-in-3-months.blogspot.com/2009/03/would-you-mind-waiting-for-2-3-mins-in.html&quot;&gt;Would you mind waiting for 2-3 mins in a console?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And a bit from &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_a1.html&quot;&gt;Cisco's documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Establishing a Session with a Router if the AAA Server is Unreachable&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The aaa accounting system guarantee-first command guarantees system&#xA;  accounting as the first record, which is the default condition. In&#xA;  some situations, users may be prevented from starting a session on the&#xA;  console or terminal connection until after the system reloads, which&#xA;  can take more than three minutes.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To establish a console or telnet session with the router if the AAA&#xA;  server is unreachable when the router reloads, use the no aaa&#xA;  accounting system guarantee-first command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="266" LastEditorUserId="266" LastEditDate="2013-08-09T15:52:29.560" LastActivityDate="2013-08-09T15:52:29.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2749" PostTypeId="5" CreationDate="2013-08-09T16:09:26.967" Score="0" Body="&lt;p&gt;&lt;strong&gt;Remote Authentication Dial In User Service (RADIUS)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RADIUS is an authentication and accounting service defined by RFC 2865.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Among many other things, RADIUS can be used to implement 802.1X port-based security, as part of a strategy to keep unauthorized users off of a network (or on a non-sensitive network in parallel with secured network.)&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="8499" LastEditDate="2016-11-29T21:00:47.387" LastActivityDate="2016-11-29T21:00:47.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2750" PostTypeId="4" CreationDate="2013-08-09T16:09:26.967" Score="0" Body="For questions about RADIUS, an authentication and accounting service defined by RFC 2865." OwnerUserId="2301" LastEditorUserId="8499" LastEditDate="2016-11-29T21:00:47.387" LastActivityDate="2016-11-29T21:00:47.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2751" PostTypeId="2" ParentId="2740" CreationDate="2013-08-09T16:59:14.693" Score="7" Body="&lt;p&gt;ASA crypto map ACLs do not support protocol traffic matching (yeah, I know). The crypto map ACL should match on network, and then either use the global &lt;code&gt;no sysopt connection permit-vpn&lt;/code&gt; to apply the interface ACL to tunneled traffic (not recommended) or use a vpn-filter in your tunnel group policy to restrict traffic by protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if the ASA did allow the protocol-based crypto ACL, your ACL as written does not match the packets being received. Your ACL matches the remote proxy on port 22, and the logs indicate the local proxy is port 22.&lt;/p&gt;&#xA;" OwnerUserId="460" LastEditorUserId="460" LastEditDate="2013-08-09T23:58:34.253" LastActivityDate="2013-08-09T23:58:34.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2752" PostTypeId="2" ParentId="2745" CreationDate="2013-08-09T17:07:59.877" Score="5" Body="&lt;p&gt;You're not getting adequate signal for the receiver: -22 when it wants at least -19.5 dBm. Could be a bad/dirty connector, fiber trouble, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My immediate suspicion is, however, the bone-simple one. I notice you are using a &lt;strong&gt;1000Base-2BX10-D&lt;/strong&gt; - is the &lt;strong&gt;other end&lt;/strong&gt; also a &lt;strong&gt;1000Base-2BX10-D&lt;/strong&gt;, or is is it a &lt;strong&gt;1000Base-2BX10-U&lt;/strong&gt;? The two types &lt;em&gt;must be used in pairs&lt;/em&gt;, one D (downlink) the other U (uplink) - the same type of single-fiber SFP is sometimes tagged A and B from other makers - they are also generally color-coded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since they work over one fiber by transmitting at one wavelength and receiving on a different one the transmitter on one end must match the receiver on the other, and vice versa. If both are sending on 1490 and listening on 1310, nothing works. Likewise, if one is transmitting on 1310 and listening on 1490, while the other is transmitting on 1490 and listening on 1550, the link won't work, even though one direction matches. You need one &lt;strong&gt;D&lt;/strong&gt; transmitting on 1490 and listening on 1310 while the other &lt;strong&gt;U&lt;/strong&gt; transmits on 1310 and listens on 1490 (more generally, for different Bi-Directional pairs, substitute in any matching set of wavelengths - 1550/1490, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presumably the &quot;wavelength not available&quot; message relates to the excessively low signal on the receiver.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2013-08-09T17:30:47.520" LastActivityDate="2013-08-09T17:30:47.520" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2755" PostTypeId="1" AcceptedAnswerId="2757" CreationDate="2013-08-10T06:47:14.160" Score="8" ViewCount="7052" Body="&lt;p&gt;I have some concept problem with the NAT. Here is the Cisco definition for the local and Global and the NAT operation.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Local address—A local address is any address that appears on the inside portion of the network.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Global address—A global address is any address that appears on the outside portion of the network.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Packets sourced on the inside portion of the network have an inside local address as the source address and an outside local address as the destination address of the packet, while the packet resides on the inside portion of the network. When that same packet gets switched to the outside network, the source of the packet is now known as the inside global address and the destination of the packet is known as the outside global address.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Conversely, when a packet is sourced on the outside portion of the network, while it is on the outside network, its source address is known as the outside global address. The destination of the packet is known as the inside global address. When the same packet gets switched to the inside network, the source address is known as the outside local address and the destination of the packet is known as the inside local address.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Ref::&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094837.shtml#defining&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094837.shtml#defining&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My question is the term &quot;local&quot; mean the traffic in the LAN side of the network and the term &quot;global&quot; mean the traffic in the WAN side of the network?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and when I use the command &quot;&lt;em&gt;ip nat inside destination&lt;/em&gt;&quot;, I will set up a translation between a local inside address and a global inside address, and for the command &quot;&lt;em&gt;ip nat outside source&lt;/em&gt;&quot;, I will set up a translation between a local outside address and a global outside address, is this correct? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last one, why we don't need to set up the NAT between the Outside local and Inside global? or the NAT between the Outside global and Inside local?&lt;/p&gt;&#xA;" OwnerUserId="1268" LastEditorUserId="623" LastEditDate="2013-10-29T14:29:09.023" LastActivityDate="2013-10-29T14:29:09.023" Title="About the inside local and outside local and inside global and outside global" Tags="|cisco|cisco-commands|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2756" PostTypeId="1" AcceptedAnswerId="2758" CreationDate="2013-08-10T07:28:40.560" Score="11" ViewCount="2099" Body="&lt;p&gt;How could one mitigate SYN FLOOD DOS on Catalyst 3750/3560 as it has no control plane protection? &lt;/p&gt;&#xA;" OwnerUserId="785" LastEditorUserId="630" LastEditDate="2013-09-12T08:24:34.963" LastActivityDate="2013-09-12T08:24:34.963" Title="Cisco Catalyst 3750/3560 SYN FLOOD protection" Tags="|cisco|cisco-catalyst|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2757" PostTypeId="2" ParentId="2755" CreationDate="2013-08-10T08:03:54.687" Score="11" Body="&lt;p&gt;Usually NAT will be used to translate between private to public IP address but this is not the only use case. You can also translate between any addresses you want such as private to private.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The terms local and global most often refer to the inside and outside of your network but this doesn't mean that it MUST be LAN and WAN although it often is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So say that we have a webserver on our LAN with the IP 10.0.0.1. We want the webserver to be accessible from a public IP of 130.130.130.130.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static 10.0.0.1 130.130.130.130&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What this does is to translate all packets from 10.0.0.1 (Source IP) to a source of 130.130.130.130 when exiting on the outside interface. This command is bidirectional so all packets entering the outside interface with a destination IP of 130.130.130.130 will also get translated to 10.0.0.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ip nat inside destination command translates from inside global to one or several inside locals. This is primarily used to do primitive load sharing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside destination list 1 pool real-hosts&#xA;ip nat pool real-hosts 10.0.0.1 10.0.0.3 prefix-length 24 type rotary&#xA;access-list 1 permit 130.130.130.130&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What this does is to translate from 130.130.130.130 to 10.0.0.1, 10.0.0.2 and 10.0.0.3 in a rotary fashion. So for every incoming request to the inside global IP of 130.130.130.130 it will be translated to a different inside local address in a round robin fashion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP nat outside source static translates between outside global and outside local IP. One common use case would be if you have overlapping subnets. Like if you are doing a merger and both companies use the same IP subnets. So say that both company A and company B are using 10.0.0.0/24 for something. So you are working for company A and you want to translate all 10.0.0.0/24 on the outside to 192.168.0.0/24.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat outside source static network 10.0.0.0 192.168.0.0 /24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you would have to do the same for traffic going from the inside to the outside of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your last question it only really makes sense to either translate the source or the destination of the packet. What you are suggesting sounds like some kind of policy routing. You can use inside and outside NAT to do everything you need.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-08-10T08:03:54.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2758" PostTypeId="2" ParentId="2756" CreationDate="2013-08-10T08:19:00.877" Score="11" Body="&lt;p&gt;3750 does have some internally priority on what it prefers to punt when congested, but it's not configurable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you should rely on common best practices, that is on all your network edges you should have iACL (infrastructure ACL). In iACL you'd allow UDP highports, ICMP to infrastructure network addresses and drop rest. This way ping and traceroute work, but infrastructure cannot be attacked.&lt;br&gt;&#xA;iACL should be complemented by policing the allowed traffic to small acceptable rates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way when external party is attacking addresses on your 3750, it'll be dropped by network border in the edge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iACL usually is 100% static so it's low maintenance, as it'll only include infrastructure addresses (loopback, core links). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will still leave wide open cases where your router is facing customer LAN directly, like when LAN is 192.0.2.0/24 and 3750 has 192.0.2.1 then usually 192.0.2.1 would not be covered by iACL and can be attacked.&lt;br&gt;&#xA;Solution for those devices is either to invest on device with proper CoPP capabilities or maintain dynamic iACL always adding the router's customer facing address there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you only face customers via link-networks (/30 or /31) solution is much cleaner, you just omit advertising the link-network and add static /32 route for the CPE side, this way external to this router parties cannot attack the router, as they won't have route.&lt;br&gt;&#xA;Alternative solution to same issue is to use non-continuous ACL entry in iACL, if your CPE link-network is 198.51.100.0/24 in iACL you could do 'deny ip any 198.51.100.0 0.0.0.254' then all the even addresses would be allowed and odd addresses denied, so if CPE is even and 3750 is odd, all current and future links are protected without updating iACL.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-08-13T07:18:03.270" LastActivityDate="2013-08-13T07:18:03.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2759" PostTypeId="2" ParentId="2261" CreationDate="2013-08-10T15:02:13.267" Score="7" Body="&lt;p&gt;What happens is that your wireless device, even when tuned for channel 6 (2437) also have a small probability to receive frames from neighboring channels, such as channel 5 and 7. and even further (with less probability).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is highly dependent on the wireless interface that you use. The worst radio that I found was an AR9170 based USB adapter, which was able to pick traffic on channel 1 when turned for channel 6. Some other interfaces (e.g. AR9280) do not have this problem, or it is fairly reduced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: AR9271 is not supported by the ath9k driver, but by the ath9k_htc driver. Because this card seems to be the natural successor to AR9170, I am not surprised that you experience the same issue.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2013-08-10T15:02:13.267" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2760" PostTypeId="1" AcceptedAnswerId="2761" CreationDate="2013-08-10T15:30:11.493" Score="2" ViewCount="1150" Body="&lt;p&gt;Hello a relative of mine is the administrator at a three story 55 small apartment complex. The residents stay there only during summer and they decided to setup a central internet connections for all the apartments, with wireless coverage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The complex is shaped like this picture &lt;a href=&quot;https://imgur.com/pkoRzNO&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://imgur.com/pkoRzNO&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The local ISP has two different lines ending in the complex, and the max speed for one line 10Mbps (you can buy multiple lines).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My plan is to setup two different networks one for each side. Each network would have a router with three switches connected to it (one on each floor), and 1 access point for every two or three apartments, connected to the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problems is I don't really have experience with networks of this size so I am looking for general advice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice on equipment? I was thinking of pfsense or mikrotik routers, I will definately need good QoS and I am thinking I sould go dual wan in case we need more lines in the future. Also the access points will be outdoors. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would a 10Mbps line on each side cover normal internet usage for so many clients, or should I get more from the beggining?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is my plan realistic? Am I missing something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any advice.&lt;/p&gt;&#xA;" OwnerUserId="2323" LastActivityDate="2013-08-10T20:35:19.793" Title="Wireless coverage for 55 apartment complex" Tags="|wireless|" AnswerCount="1" CommentCount="0" ClosedDate="2023-08-04T16:41:10.753" ContentLicense="CC BY-SA 3.0" />
  <row Id="2761" PostTypeId="2" ParentId="2760" CreationDate="2013-08-10T20:35:19.793" Score="1" Body="&lt;p&gt;You can start with 4x10Mbps lines and see how it goes, if clients utilize it all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the wireless part I suggest the &lt;a href=&quot;http://www.ubnt.com/unifi&quot; rel=&quot;nofollow&quot;&gt;Unifi&lt;/a&gt;, which is easy to install and has good reviews. Moreover I wanted to install it too in a hotel but I keep postponing it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For router, since you mentioned Mikrotik, I was very satisfied by the 750G. It has 5 ports, so you can use one for downlink to switches and the other ports can connect to the uplink ISP, so you have 4 ports for ISP connections. Of course Alix boards with pfsense will also do the work you want. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other thing to take in consideration is how will you load balance the customers between the multiple wans. I think it would be easier to have all clients in same network and use one router in order to avoid messing with first hop redundancy issues. Moreover since you are not experienced keep it simple and not run dynamic routing with your isp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switched don't have to be something special, something with gigabit ports is enough to relay wireless customers. &lt;/p&gt;&#xA;" OwnerUserId="2294" LastActivityDate="2013-08-10T20:35:19.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2762" PostTypeId="1" AcceptedAnswerId="2763" CreationDate="2013-08-10T22:32:21.357" Score="13" ViewCount="4833" Body="&lt;p&gt;What is the difference between these two (in distance and function)?  I understand that a Central Office is a place where the ISP stores equipment that connects many clients. But the POP has a similar definition.  It is a place where many clients connect and there are multiple POP's for each ISP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="2284" LastEditorUserId="775" LastEditDate="2013-08-11T11:19:56.247" LastActivityDate="2013-08-11T11:19:56.247" Title="Point Of Presence vs. Central Office" Tags="|telephony|service-provider|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2763" PostTypeId="2" ParentId="2762" CreationDate="2013-08-10T23:29:50.990" Score="16" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the difference between this two (in distance and function).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Short answer&lt;/em&gt;: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Distances - not very much, these days&lt;/li&gt;&#xA;&lt;li&gt;Function - Basic / Enhanced 911 is still processed through the Central Office; however other &lt;a href=&quot;http://en.wikipedia.org/wiki/Competitive_local_exchange_carrier&quot;&gt;CLECs&lt;/a&gt; can trunk customers' 911 calls back to the &lt;a href=&quot;http://en.wikipedia.org/wiki/Public-safety_answering_point&quot;&gt;Public Service Answering Point (PSAP)&lt;/a&gt; via the local Central Office... I also think &lt;a href=&quot;http://www.intrado.com/&quot;&gt;Intrado&lt;/a&gt; has equipment for &lt;a href=&quot;http://en.wikipedia.org/wiki/Competitive_local_exchange_carrier&quot;&gt;CLECs&lt;/a&gt; to provide 911 services...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Long answer&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The differences between them have much more to do with historical context...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Central Office is a term that has deep roots in the &lt;a href=&quot;http://en.wikipedia.org/wiki/Bell_System&quot;&gt;Bell companies&lt;/a&gt;, where the Central Office also called a &lt;a href=&quot;http://en.wikipedia.org/wiki/Telephone_exchange&quot;&gt;telephone exchange&lt;/a&gt;.  Originally they housed circuit-switching technologies; these days they have similar routers and switches as you'll see in a &lt;a href=&quot;http://en.wikipedia.org/wiki/Point_of_presence&quot;&gt;Point of Presence&lt;/a&gt;.  Telephone copper pairs star out of the Central Office to normally about 15,000-18,000 feet; however, you can also star the copper out from a &lt;a href=&quot;http://en.wikipedia.org/wiki/Digital_loop_carrier&quot;&gt;DLC can&lt;/a&gt; to cover a much larger area, because the DLCs can be connected via fiber.  The key points to remember:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Because the Central Office is associated with the &lt;a href=&quot;http://en.wikipedia.org/wiki/Bell_System&quot;&gt;Bell companies&lt;/a&gt;, they are heavily regulated by the government.  Incumbent carriers in many other countries are also regulated in a similar manner.&lt;/li&gt;&#xA;&lt;li&gt;Construction and installations within a Central Office normally comply with Telecordia standards, such as &lt;a href=&quot;http://telecom-info.telcordia.com/site-cgi/ido/docs.cgi?ID=SEARCH&amp;amp;DOCUMENT=GR-63?&quot;&gt;GR-63 NEBS&lt;/a&gt;.  NEBS-compliant equipment is a big deal to RBOCs and incumbents... NEBS requires routers / switches to have front-to-back cooling and other features that comply with Telecordia's requirements.&lt;/li&gt;&#xA;&lt;li&gt;They always have responsibility for maintaining last-mile transport to customers.&lt;/li&gt;&#xA;&lt;li&gt;Basic / Enhanced 911 is routed through the Central Office&lt;/li&gt;&#xA;&lt;li&gt;Most of the labor is unionized.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Point_of_presence&quot;&gt;Point of Presence&lt;/a&gt; does not always carry the same loaded meaning that Central Office does.  Most of the time, it refers to a building that is carefully selected to host internet circuits between various carriers.  Customer connectivity to a Point of Presence these days is usually over &lt;a href=&quot;http://en.wikipedia.org/wiki/Metro_Ethernet&quot;&gt;Metro ethernet&lt;/a&gt; or &lt;a href=&quot;http://en.wikipedia.org/wiki/Synchronous_optical_networking&quot;&gt;SONET rings&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;These facilities are often not regulated by the government.&lt;/li&gt;&#xA;&lt;li&gt;Construction and installations don't need to comply with Telecordia standards, such as &lt;a href=&quot;http://telecom-info.telcordia.com/site-cgi/ido/docs.cgi?ID=SEARCH&amp;amp;DOCUMENT=GR-63?&quot;&gt;GR-63 NEBS&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;The carriers within a POP often are &lt;em&gt;not&lt;/em&gt; associated with the remains of the original &lt;a href=&quot;http://en.wikipedia.org/wiki/Bell_System&quot;&gt;Bell companies&lt;/a&gt;, and they are not required to host last-mile transport to a customer (although they often do). It's quite common for the local AT&amp;amp;T / Verizon / other bellco to offer &lt;a href=&quot;http://en.wikipedia.org/wiki/T-carrier&quot;&gt;T-carrier&lt;/a&gt; services from a POP because they will co-locate within the POP to spoon as much transport business as they can from the other carriers who might need last-mile transport to customers.&lt;/li&gt;&#xA;&lt;li&gt;POPs don't have to handle 911&lt;/li&gt;&#xA;&lt;li&gt;Labor might not be unionized.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-08-11T11:11:41.820" LastActivityDate="2013-08-11T11:11:41.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2765" PostTypeId="1" AcceptedAnswerId="2767" CreationDate="2013-08-11T13:48:55.007" Score="9" ViewCount="3837" Body="&lt;p&gt;Is it possible to configure OSPF to use latency in its link cost/metric calculations. The idea being to enable performance based routing whereby the fastest and least congested links in the network will be chosen dynamically, rather than relying on OSPF's default behaviour which results in 100Mbps links having the same cost as 1Gbps links. &lt;/p&gt;&#xA;" OwnerUserId="2327" LastActivityDate="2013-08-12T06:10:23.433" Title="Using latency to calculate OSPF metrics" Tags="|cisco|ospf|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2766" PostTypeId="2" ParentId="2765" CreationDate="2013-08-11T14:00:53.937" Score="6" Body="&lt;p&gt;You shouldn't rely on default metrics/cost, not in IGP or STP. My one question review if LAN was designed is to ask which link is blocking, if engineer can't answer without looking, it's strong indication the network was not designed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should design how you want traffic to flow under normal operation and under fault scenarios and then design metric standard with satisfies those requirements. I prefer to do this with pen and paper add coffee if so inclined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I greatly prefer &lt;em&gt;role based&lt;/em&gt; metric standard, where P-P, P-PE, PE-PE etc each have same metric value, regardless of bandwidth or latency. That is, I know where I want my traffic to go, to me it does not matter what the latency is or what the capacity is, if I don't have enough capacity where I want the traffic to flow, I'll upgrade the links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Role based certainly isn't only way to do it, if you want to base your metric standard on link speed or measured latency, go ahead.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regardless how you design your metric standard it will be fully static and unaware of actual link conditions such as packet loss, latency, jitter, capacity etc. If you want network to more dynamically respond (demand which I tend to think often rises from poor planning) to changing network conditions, you need to look into RSVP or even SDN.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-08-11T14:00:53.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2767" PostTypeId="2" ParentId="2765" CreationDate="2013-08-11T14:12:37.603" Score="6" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Is it possible to configure OSPF to use latency in its link cost/metric calculations. The idea being to enable performance based routing whereby the fastest and least congested links in the network will be chosen dynamically, rather than relying on OSPF's default behaviour which results in 100Mbps links having the same cost as 1Gbps links.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Short answer: No, not with OSPF alone&lt;/p&gt;&#xA;&lt;p&gt;Long answer:&lt;/p&gt;&#xA;&lt;p&gt;The only way for OSPF to dynamically calculate paths based on latency / congestion is to use &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk436/tk428/technologies_configuration_example09186a0080093fd0.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS Traffic Engineering&lt;/a&gt; with &lt;a href=&quot;http://www.cariden.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;offline optimizations of MPLS TE costs based on your criteria&lt;/a&gt;; &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3630&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS TE uses OSPF LSAs&lt;/a&gt; to carry information about the label switched paths.  However, &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk436/tk428/technologies_configuration_example09186a0080093fd0.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS Traffic Engineering&lt;/a&gt; is a heavy hammer and many network operations can't deal with the additional workflow introduced into provisioning or troubleshooting MPLS TE.&lt;/p&gt;&#xA;&lt;p&gt;Another answer suggests that you should not adjust link costs based on bandwidth, and to use the role of a node for costs.  I can't speak for his network, but this guidance is unnecessary in many cases since the lowest cost path in a well-designed topology automatically follows through the core of the network.  I wouldn't try to adjust an inefficient topology with link costs... just make traffic flow through the core naturally and ensure that OSPF sees a 1GE as a better path than a FastEthernet link.  This will naturally happen if you lay out the topology well, and use &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_q_and_a_item09186a0080094704.shtml#qtwo&quot; rel=&quot;nofollow noreferrer&quot;&gt;auto-cost reference-bandwidth&lt;/a&gt; under the OSPF process.  Be sure you use this on all OSPF routers so they understand the link costs in the same way.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2013-08-11T20:39:40.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2768" PostTypeId="2" ParentId="2765" CreationDate="2013-08-11T14:52:12.300" Score="4" Body="&lt;p&gt;Another option if to use PfR or OER that is routers use active probes or netflow data to select a path dynamically. Or of course the very simple option is to hard code OSPF cost values.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other consideration is are you trying to code a static metric or do you want dynamic behavior (latency changes with traffic load).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally as was mentioned above, are you sure you want the complexity, if you look at EIGRP it has a load metric but no one ever uses because it adds operational complexity and you can get traffic oscillation.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastEditorUserId="2301" LastEditDate="2013-08-12T06:10:23.433" LastActivityDate="2013-08-12T06:10:23.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2774" PostTypeId="1" AcceptedAnswerId="3062" CreationDate="2013-08-12T14:25:14.827" Score="8" ViewCount="21385" Body="&lt;p&gt;I have a single Cisco AP-1602 broadcasting 3 SSIDs in a small office.  Some of my team are complaining about random drops in network connectivity. (Over 3 days, I've had 3 different users complain about drops every 10 minutes or so.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be causing this?  Are 3 SSIDs on the same channel at the same strength (because they are all from the same AP) causing interference? Are these APs built to broadcast multiple networks or was I sold a bill of goods by a reseller?&lt;/p&gt;&#xA;" OwnerUserId="1331" LastActivityDate="2015-09-10T18:41:31.097" Title="Wifi dropping randomly on Cisco AP-1602" Tags="|cisco|wireless|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2776" PostTypeId="1" CreationDate="2013-08-12T15:26:09.503" Score="7" ViewCount="1361" Body="&lt;p&gt;Have establsihed a lab to test IP DHCP SNOOPING prior to implemntation. So far everything works as advertised. Given that the Uplink port of a switch must be trusted, why is it not necessary to add the trust to a access point?&#xA;&lt;img src=&quot;https://i.stack.imgur.com/o9uK6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="975" LastEditorUserId="775" LastEditDate="2015-03-28T00:05:45.753" LastActivityDate="2015-03-28T00:05:45.753" Title="Establishing IP DHCP Snooping" Tags="|ipv4|dhcp-snooping|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2777" PostTypeId="1" AcceptedAnswerId="2784" CreationDate="2013-08-12T15:30:39.303" Score="3" ViewCount="1194" Body="&lt;p&gt;With the various DSL flavours such as ADSL2+, which allows the PHY line to re-sync as conditions worsen and improve at higher and lower sync rates (which is effectively Tx and Rx rate), does the MTU size ever change? I know that it is using fixed size ATM frames here, but will the MTU size ever drop below the minimum ATM frame size?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what about Wireless (802.11)? As the wireless signal becomes weaker and the error rate increases, is the MTU ever shrunk so smaller frames are sent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that at an the IP level the window size can be shrunk/grown as with the MSS at the TCP level for example. But what about at OSI layer 2, using Ethernet and ATM for example, &lt;strong&gt;are there any scenarios where the MTU size would ever change over the course of a link's life?&lt;/strong&gt; I don't mean over 20 years either, I mean within a reasonable time span, such as days or weeks?&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-08-13T12:48:39.750" LastActivityDate="2013-08-15T08:51:25.867" Title="Is MTU adaptive for any OSI layer 2 protocols?" Tags="|mtu|layer2|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2778" PostTypeId="2" ParentId="2776" CreationDate="2013-08-12T17:42:38.810" Score="11" Body="&lt;p&gt;DHCP snooping works by inspecting DHCP packets and dropping any such packet &lt;em&gt;received&lt;/em&gt; on an untrusted port that is of a type sent by a DHCP server (most often OFFER, ACK and NACK).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason that you don't need to trust an AP port is that you should only be receiving client types of DHCP traffic on that port. While you receive DISCOVERY, REQUEST and INFO packets, you should not be receiving any OFFER, ACK or NACK packets on the AP port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The caveat to this is that if you are using the AP as a bridge for a redundant path, then you would need to trust the port.  If the primary link were to fail, then you would be passing DHCP server traffic back down to clients through the AP.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-08-12T17:42:38.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2779" PostTypeId="1" CreationDate="2013-08-12T18:33:39.263" Score="3" ViewCount="5129" Body="&lt;p&gt;Is there any way to limit the MTU per L2 interface on this switch if you configure the system MTU for Jumbo frames?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next question assuming no, are there any Cisco stackable switches with this capability?&lt;/p&gt;&#xA;" OwnerUserId="308" LastEditorUserId="509" LastEditDate="2013-08-13T07:33:31.937" LastActivityDate="2013-08-13T07:54:58.513" Title="Cisco 3560G MTU options" Tags="|cisco|cisco-catalyst|mtu|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2780" PostTypeId="2" ParentId="2774" CreationDate="2013-08-12T19:24:37.350" Score="10" Body="&lt;p&gt;There could be many causes for this, but your suspicion about the AP not being built to broadcast multiple WLANs is not one of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would start by looking at this list:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What version of code are you running on the AP?  Upgrade to a more recent code if possible, as there may be bugs in your current code.&lt;/li&gt;&#xA;&lt;li&gt;Check for sources of interference or other usage on the channel you are using.  The 1602 includes clean air express I believe, so you should be able to do this from the hardware built into the AP itself.&lt;/li&gt;&#xA;&lt;li&gt;Check the hardware that is having problems for similarities and look for problems related to the hardware (make sure their drivers are up to date).  For instance, some Apple 802.11n products have issues if you disable lower 802.11n rates.  Or some clients have issues with PMK caching (don't remember if Cisco has this or what it is called) if enabled.  Could be re-authentication issues.&lt;/li&gt;&#xA;&lt;li&gt;Check power save configurations on the AP and clients.  Could be an issue related to clients entering/leaving power save modes.&lt;/li&gt;&#xA;&lt;li&gt;Check for other configuration that could be causing the problem.  Disable anything you don't need on the AP or may cause problems outside of a larger deployment.  For instance, with a single AP, make sure any rogue detection or scanning is disabled.  You also wouldn't need any roaming features.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hopefully something there will get you looking in the right direction.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-08-12T19:24:37.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2781" PostTypeId="2" ParentId="2683" CreationDate="2013-08-12T19:31:54.377" Score="2" Body="&lt;p&gt;Fixed! Turns out, after slagging off the netgear, it was the cisco that was causing the problem. Seems when I configured the interface &lt;code&gt;switchport access vlan 20&lt;/code&gt; it didn't create vlan 20 on the switch automatically like it would normally. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Found it by doing a &lt;code&gt;sh trunk&lt;/code&gt;and VLAN 20 wasn't included in any of the trunks, did a &lt;code&gt;sh vlan&lt;/code&gt; and it wasn't listed either, so created it and all working. Very odd. &lt;/p&gt;&#xA;" OwnerUserId="1411" LastActivityDate="2013-08-12T19:31:54.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2782" PostTypeId="2" ParentId="2779" CreationDate="2013-08-12T20:05:15.483" Score="4" Body="&lt;p&gt;Catalyst 3750/3560 Series switches support an MTU of 1998 bytes for all 10/100 interfaces. All Gigabit Ethernet interfaces support jumbo frames up to 9000 bytes. The default MTU and jumbo frame size is 1500 bytes. You cannot change the MTU on an individual interface. You must set the MTU globally. Reset the switch afterwards for the MTU change to take effect. Gigabit Ethernet ports are not affected by the system mtu command; 10/100 ports are not affected by the system mtu jumbo command. If you do not configure the system mtu jumbo command, the setting of the system mtu command applies to all Gigabit Ethernet interfaces. If Gigabit Ethernet interfaces are configured to accept frames greater than the 10/100 interfaces, jumbo frames that ingress on a Gigabit Ethernet interface and egress on a 10/100 interface are dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not aware of any Cisco switches that support a per L2 interface MTU size. The Nexus class switches can use class of service, So in order to do increased MTU for your iSCSI traffic, you should create a policy-map identifying your iSCSI traffic, place the traffic in a separate queue with increased MTU.&lt;/p&gt;&#xA;" OwnerUserId="975" LastActivityDate="2013-08-12T20:05:15.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2783" PostTypeId="2" ParentId="2291" CreationDate="2013-08-12T21:41:54.093" Score="6" Body="&lt;p&gt;We upgraded firmware on the AP to version 12.4.25d-JA2 and the problem has disappeared. It has been working for one month withouth any issue. &lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2013-08-12T21:41:54.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2784" PostTypeId="2" ParentId="2777" CreationDate="2013-08-12T23:44:20.980" Score="4" Body="&lt;p&gt;An ATM cell is 53 bytes.  Using AAL5, there's 48 bytes of payload.  With the minimum ethernet frame of 64 bytes, you are unlikely to ever find an MTU smaller than an ATM cell.  Even if you did, every protocol I know of with a fixed minimum includes padding to get to the minimum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MTU is an interface &lt;strong&gt;setting&lt;/strong&gt;.  It is not negotiated. It does not change over time.  Your MTU will be what you set it to (or some default (1500, 4470, etc.)) until you change it.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-08-12T23:44:20.980" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2785" PostTypeId="2" ParentId="2777" CreationDate="2013-08-13T00:17:03.517" Score="2" Body="&lt;p&gt;The only dynamic adjustment of MTU size is to avoid IP fragmentation. That is changing the TCP segment size, to match the smallest IP packet size. IP packets can be divided up by say multilink PPP but that only lasts for the single MLPPP hop. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bottom line no protocol ever changed sizes to reduce retransmissions it was said in the old days that you might want to manually adjust data sizes down when using bad links but we are talking at least 15 years ago.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-08-13T00:17:03.517" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2786" PostTypeId="1" AcceptedAnswerId="2798" CreationDate="2013-08-13T01:28:08.287" Score="10" ViewCount="6516" Body="&lt;p&gt;I want to configure our Ciscos so they can do forward DNS resolution, but not reverse DNS resolution from the CLI.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R01(config)#ip domain-name domain.local&#xA;R01(config)#ip name-server 10.1.1.1&#xA;R01(config)#ip domain-lookup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That config makes the router do a forward lookup when we ping, and reverse lookup under show commands that return ip addresses.  When we do a &quot;show user&quot;, the router does a reverse lookup for every one of the source ip addresses.  It looks like we get both forward and reverse lookups when we turn on &quot;ip domain-lookup&quot;.  Is there a way to turn off reverse lookups and leave forward lookups on?&lt;/p&gt;&#xA;" OwnerUserId="2339" LastEditorUserId="2339" LastEditDate="2013-08-13T01:51:46.623" LastActivityDate="2013-08-13T16:59:53.943" Title="Cisco IOS Forward / reverse name lookups" Tags="|cisco|dns|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2787" PostTypeId="1" CreationDate="2013-08-13T02:09:22.497" Score="5" ViewCount="7124" Body="&lt;p&gt;First, please see the attached network diagram to see what I am trying to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ru3VL.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the 2 distribution switches, we run HSRP and have one Fortigate going to SW1 and the other going to SW2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we have vmware esx hosts with connections to each of the fortigates.  The fortigates are configured in an active-active ha config as are the vmware vswitches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for some reason, when we disconnect the cable from the monitored wan1 port on either of the fortigates, the ip assigned the a vm on either of the esx hosts fails to be reachable however the ip assigned to the fortigates is reachable just fine.  For some reason, traffic isn't being passed through the fortigates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you look at this diagram, the vm ip is reachable just fine when the devices failover.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GWKfs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried setting different interface tracking options in hsrp and tried using &quot;ip sla&quot; as well to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something somewhere either on the fortigates or on the distro switches?&lt;/p&gt;&#xA;" OwnerUserId="864" LastActivityDate="2013-08-13T07:24:58.707" Title="Fortigate 100D Firewalls and HSRP" Tags="|hsrp|vmware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2788" PostTypeId="2" ParentId="2787" CreationDate="2013-08-13T02:34:47.880" Score="0" Body="&lt;p&gt;I haven't set it up before but I think you'll need to either configure 'full-mesh' HA between the 100D's and your two switches. We use stacked 3750's for redundancy with 2x 100D's in HA instead, seems to work well enough. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs.forticare.com/fos50hlp/50/FortiOS%205.0%20Help/full_mesh.120.05.html&quot; rel=&quot;nofollow&quot;&gt;http://docs.forticare.com/fos50hlp/50/FortiOS%205.0%20Help/full_mesh.120.05.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would assume on the the FG HA is working fine, but your 'Internal' switch isn't getting the message that the Primary 'internal' FG link is no longer the one it should be talking to. &lt;/p&gt;&#xA;" OwnerUserId="2341" LastActivityDate="2013-08-13T02:34:47.880" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2789" PostTypeId="1" AcceptedAnswerId="2790" CreationDate="2013-08-13T02:57:24.623" Score="3" ViewCount="1811" Body="&lt;p&gt;I'm trying to calculate how much bandwidth is utilised for a particular protocol, at the different layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark Protocol Hierarchy gives something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Protocol     %Bytes     Bytes&#xA;Frame        100%       158223&#xA; Ethernet    100%       158223&#xA;  IPv4       100%       158223&#xA;   TCP       100%       158223&#xA;    HTTP     32.3%      50786&#xA;    SSL      8.03       12708&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now what that mean? Its obvious that all traffic was TCP, and of that, some was HTTP and some SSL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what confuses me is that the Byte count for Layers 1, 2, 3 and 4 are all the same. So is 158223 the size of the TCP traffic, or the frame?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would expect each higher layer to be less, to the value of the header overhead. So something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Protocol     %Bytes     Bytes&#xA; Frame        100%       158223&#xA;  Ethernet    100%       157000 (158223 - x per packet, where x is Frame overhead)&#xA;   IPv4       100%       154000 (157000 - 18 bytes per packet Ethernet overhead)&#xA;    TCP       100%       152000 (154000 - 20 bytes per packet IPv4 overhead)&#xA;     HTTP     32.3%      50786&#xA;     SSL      8.03       12708&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2091" LastEditorUserId="2091" LastEditDate="2013-08-13T06:42:35.857" LastActivityDate="2013-08-13T06:42:35.857" Title="Wireshark Protocol Hierarchy explanation" Tags="|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2790" PostTypeId="2" ParentId="2789" CreationDate="2013-08-13T03:13:50.847" Score="4" Body="&lt;p&gt;Generally speaking, everything you capture at L2 is a frame, no matter if it is Ethernet, FDDI, ATM, etc.  In your example of the 158223 bytes captured, 100% were Ethernet frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;100% bytes of those frames contained L3 information.  In your example, 100% of them are IPv4 packets.  They could also include IPv6 or some other L3 protocol (or contain no L3 information at all).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;100% bytes of those packets contain L4 information.  In your examples, 100% of them are TCP segments.  They could also include UDP for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of those segments, 32.4% bytes are HTTP and bytes 8.03% are SSL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to answer your question, 158223 is the size of both the TCP traffic and the frame traffic (as well as the Ethernet and the IPv4 traffic).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-08-13T03:13:50.847" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2791" PostTypeId="2" ParentId="2787" CreationDate="2013-08-13T04:20:26.443" Score="3" Body="&lt;p&gt;Let me preface this by saying that I have not used Fortigate, but speaking generally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should have two links from each firewall (FW ), one to each switch (SW), just as you have a link from each FW to each server (SRV).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I suspect is happening.  Assuming SW1 is the HSRP active interface, it initially receives traffic from SRV2 on the link to SW2 and creates an entry in the MAC and ARP tables.  When the link between SW2 and FW2 goes down, SW2 removes the entries for that interface from it's tables, but SW1 doesn't know the link is down and maintains it's entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When traffic comes in to SW1 for SRV2, it looks up the ARP/MAC information and sends the traffic to SW2.  SW2 doesn't have an entry for SRV2 anymore, and floods it out all ports except the one it received the traffic on (normal switch operations).  This results in the traffic never reaching SRV2 as none of the other links on SW2 provide a path to SRV2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the second link the traffic between FWs and SWs, the flooded traffic would then be received at FW1 and be able to get to SRV2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have outbound traffic from SRV2 after the link goes down, or you clear the MAC entries on SW1, I suspect that this would work as well.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-08-13T07:24:58.707" LastActivityDate="2013-08-13T07:24:58.707" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2792" PostTypeId="1" CreationDate="2013-08-13T05:16:30.163" Score="5" ViewCount="3075" Body="&lt;p&gt;The lab is configured with PVST+ on all switches. &#xA;Currently I am using wireless bridges to connection different sections of a lab environment for the sake of mobility. Basically just bridging the the wireless interface and ethernet interface. All ethernet ports on the bridge are in the same VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW1 ------ Wireless_Bridge_1 ~~~~~~~~~~~~~Wireless_Bridge_2 ------SW2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When frames go through the wireless bridge, the source MAC address is changed to MAC address of the bridge's wireless interface. Does this cause problems with layer 2 features (spanning tree, VTP etc.)&#xA;At the moment STP seems to be working fine. What if I connect more STP speaking switches to the bridge? I think BPDUs should have all the information needed for STP to work, but the source address overwriting can be kinda confusing. Which layer 2 features can I expect to work over this type of wireless link (aka features that work just like it's an Ethernet link)?&lt;/p&gt;&#xA;" OwnerUserId="34" LastActivityDate="2013-11-19T09:17:07.120" Title="Design considerations with Spanning Tree when Wireless bridges are involved?" Tags="|spanning-tree|" AnswerCount="2" CommentCount="2" ClosedDate="2019-04-25T03:59:21.603" ContentLicense="CC BY-SA 3.0" />
  <row Id="2793" PostTypeId="1" AcceptedAnswerId="2795" CreationDate="2013-08-13T07:44:52.603" Score="6" ViewCount="885" Body="&lt;p&gt;I am trying to calculate what the bandwidth utilisation for a specific protocol would be over different links. As a start, I have the utilisation for this protocol over Ethernet. E.g 70kbytes/sec, and this would be at the TCP layer, i.e it would include L1 to L4.&#xA;I got this answer by doing a Wireshark trace, and then Statistics -&gt; Summary, which gives the Ave Bytes per sec for my filter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to calculate/estimate what it would be for the following link types:&#xA;802.1Q, ATM, HDLC, PPP, Frame Relay and Fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be a good technique to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be sufficient if I took the average packet size, then removed the Ethernet overhead, and added the different overheads for each link type&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g 70 KBytes per sec, which was 158223 Bytes over 315 packets. The average packet size would then be 502.2952 Bytes per packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I then just remove 18 bytes for Ethernet, and then add the following to get the bandwidth for each different transport:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ATM               ?&#xA;Ethernet          18&#xA;Ethernet 802.1Q   22&#xA;HDLC          ?&#xA;PPP               7&#xA;FrameRelay        7&#xA;Fiber         ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can you also help me complete the above missing overhead values?&lt;/p&gt;&#xA;" OwnerUserId="2091" LastEditorUserId="2091" LastEditDate="2013-08-13T10:40:26.897" LastActivityDate="2013-08-13T10:40:26.897" Title="Bandwidth calculation for protocol over different Data/Physical links" Tags="|bandwidth|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2794" PostTypeId="2" ParentId="2779" CreationDate="2013-08-13T07:54:58.513" Score="2" Body="&lt;p&gt;It is important to know that in small catalysts like 3750/3560 there is different MTU for routed traffic and switched traffic. 1998B is largest packet you can route, even when using 1GE ports, the 9000B is strictly for switched traffic in 1GE ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not very uncommon for Cisco switches to support per interface MTU, ancient 3500XL does it as does 4500, 6500, 7600 at least.&lt;br&gt;&#xA;3850 supports per-interface IPv4/IPv6 MTU, which is sufficient, per-interface L2 MTU is not important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4500-X would support stack of two switches (VSS). 3850 would support stack of four switches (StackWise-480).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's good to standardize L2 MTU as large as possible. Artificially reducing L2 MTU does little good to you, as dropped L2 frames will give no information to the sender of what went wrong. It is however crucial that L3 MTU is same in both ends of the L2 network.&lt;br&gt;&#xA;There are some exceptions when you may not want to have large L2 MTU, which are related to buffer carving, but they are platform dependent issues and you shouldn't worry about them until you hit the issues, they're not common.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-08-13T07:54:58.513" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2795" PostTypeId="2" ParentId="2793" CreationDate="2013-08-13T08:23:28.490" Score="7" Body="&lt;p&gt;Assuming you're untagged, your current stack on the wire is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;7B preamble&lt;/li&gt;&#xA;&lt;li&gt;1B SFD&lt;/li&gt;&#xA;&lt;li&gt;6B DMAC&lt;/li&gt;&#xA;&lt;li&gt;6B SMAC&lt;/li&gt;&#xA;&lt;li&gt;2B type&lt;/li&gt;&#xA;&lt;li&gt;20B IPv4&lt;/li&gt;&#xA;&lt;li&gt;20B TCP&lt;/li&gt;&#xA;&lt;li&gt;nB application data&lt;/li&gt;&#xA;&lt;li&gt;4B CRC&lt;/li&gt;&#xA;&lt;li&gt;12B IFG&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;First thing is very important, you are looking at L2 overhead, you must consider L1 overhead also.&lt;br&gt;&#xA;For ethernet preamble, sfd and ifg are L1, they are not really bytes but ethernet defines them strictly at byte sized amount of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For ATM you can't get very accurate reading with your methodology, because it assumes static overhead. If you try send payload of 49B you'll fit it in single ethernet frame, but you'll need two ATM cell, second cell has 52B of overhead and 1B of data.&lt;br&gt;&#xA;This problem does not exist in HDLC, PPP or FrameRelay, and your methodology will give decent approximation on those. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want really accurate data, you need to have size of each packet send, then calculate what they are when serialized to given L1 technology with given L2 technology.&lt;br&gt;&#xA;The larger the packets are that you send, the less sensitive your calculations are to the approximation method as overhead will be smaller contributor.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-08-13T08:23:28.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2796" PostTypeId="1" CreationDate="2013-08-13T09:23:40.493" Score="7" ViewCount="4211" Body="&lt;p&gt;I have an issue with a mixture of remote access, L2L and dynamic L2L tunnels on an ASA5540 running 8.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a snip of the relevant config:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto dynamic-map outside-crypto-dynamic-map 10 match address outside-crypto-dynamic-map-10&#xA;crypto dynamic-map outside-crypto-dynamic-map 10 set transform-set ESP-3DES-MD5&#xA;crypto dynamic-map outside-crypto-dynamic-map 20 set transform-set ESP-3DES-MD5&#xA;crypto map outside-crypto-map 201 match address outside-crypto-map-201&#xA;crypto map outside-crypto-map 201 set peer X.X.X.X&#xA;crypto map outside-crypto-map 201 set transform-set ESP-3DES-MD5&#xA;crypto map outside-crypto-map 202 match address outside-crypto-map-202&#xA;crypto map outside-crypto-map 202 set peer Y.Y.Y.Y&#xA;crypto map outside-crypto-map 202 set transform-set ESP-AES256-SHA&#xA;crypto map outside-crypto-map 65535 ipsec-isakmp dynamic outside-crypto-dynamic-map&#xA;crypto map outside-crypto-map interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a number of remote sites that use dynamic IPs. The LAN subnets for these are in an ACL &quot;outside-crypto-dynamic-map-10&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These match fine based on this line:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto dynamic-map outside-crypto-dynamic-map 10 match address outside-crypto-dynamic-map-10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have other &quot;static&quot; L2L tunnels that work fine per 201 and 202 in the config above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With my remote access (Cisco VPN Client) users, unless I have the following line, they won't connect:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto dynamic-map outside-crypto-dynamic-map 20 set transform-set ESP-3DES-MD5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I try to add a &quot;match address&quot; statement to that sequence (like below), then remote access stops working (where &quot;vpc-client-subnet&quot; is an ACL containing the subnet from the IP pool used for the remote access clients) as it cannot find a matching local/remote.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto dynamic-map outside-crypto-dynamic-map 20 match address vpc-client-subnet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that I have a number of L2L endpoints out there (that I no longer want connected but have no control over) that are still configured (on the remote end) with the PSK used by the dynamic L2L peers. I have removed their LAN subnets from &quot;outside-crypto-dynamic-map-10&quot; (as I don't want them connected any more) so they don't match on the dynamic-map seq 10 anymore, however they are still able to successfully complete phase 2 against &quot;outside-crypto-dynamic-map 20&quot; and it seems as if this end just accepts whatever the remote proposes as the local/remote for the SA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not in a position to change the PSK. I can't add a &quot;match address&quot; to the &quot;outside-crypto-dynamic-map 20&quot; as it will prevent remote access clients from connecting, however if I don't, then it acts as a catch-all for other peers that otherwise know the PSK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally I could add &quot;match address&quot; to seq 20, so that remote access users will match against it, but the &quot;old&quot; seq 10 peers will not. Alternatively, is there a way to prevent the ASA from accepting the remote peers idea of the local/remote for the SA when it has matched against a map that doesn't have a &quot;match address&quot; statement?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant tunnel group config:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tunnel-group DefaultL2LGroup ipsec-attributes&#xA; pre-shared-key *****&#xA; peer-id-validate nocheck&#xA; isakmp keepalive threshold 30 retry 5&#xA;&#xA;tunnel-group x.x.x.x type ipsec-l2l&#xA;tunnel-group x.x.x.x ipsec-attributes&#xA; pre-shared-key *****&#xA; isakmp keepalive threshold 30 retry 5&#xA;&#xA;tunnel-group ravpn type remote-access&#xA;tunnel-group ravpn general-attributes&#xA; address-pool ip-pool-ravpn&#xA; authentication-server-group Edirectory&#xA; default-group-policy ravpn&#xA;tunnel-group ravpn ipsec-attributes&#xA; pre-shared-key *****&#xA; isakmp keepalive threshold 30 retry 2&#xA;&#xA;tunnel-group-map default-group DefaultL2LGroup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are multiple tunnel-groups for the &quot;static&quot; tunnels (per the x.x.x.x example above). The remote access users hit the &quot;ravpn&quot; tunnel-group, and the dynamic ones all match the &quot;DefaultL2LGroup&quot;. The PSK is not the same between these.&lt;/p&gt;&#xA;" OwnerUserId="2344" LastEditorUserId="2344" LastEditDate="2013-08-15T06:19:38.553" LastActivityDate="2016-05-18T22:15:43.943" Title="Problem with remote access, fixed L2L and dynamic L2L IPSEC working together on ASA 5540 8.2" Tags="|cisco|cisco-asa|ipsec|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2798" PostTypeId="2" ParentId="2786" CreationDate="2013-08-13T11:27:43.570" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a way to turn off reverse lookups and leave forward lookups on?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Summary:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Use &lt;code&gt;no domain-lookup&lt;/code&gt; under &lt;code&gt;line vty 0 4&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Details:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You're right, the default behavior is to perform &amp;amp; cache a forward / reverse lookup for the addresses in show commands.  This config starts similar to yours...&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Baseline behaviour: Forward / Reverse lookups&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HotCoffee#clear host *&#xA;HotCoffee#sh runn | i ip domain|ip name|^ +domain|NTP&#xA;Time source is NTP, 06:10:42.327 CDT Tue Aug 13 2013&#xA;ip domain name pennington.net&#xA;ip name-server 172.16.1.5&#xA; domain-name pennington.net&#xA;HotCoffee#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After clearing the host cache, there are no entries in it...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HotCoffee#show host&#xA;Load for five secs: 0%/0%; one minute: 1%; five minutes: 1%&#xA;Time source is NTP, 06:11:46.864 CDT Tue Aug 13 2013&#xA;&#xA;Default domain is pennington.net&#xA;Name/address lookup uses domain service&#xA;Name servers are 172.16.1.5&#xA;&#xA;Codes: UN - unknown, EX - expired, OK - OK, ?? - revalidate&#xA;       temp - temporary, perm - permanent&#xA;       NA - Not Applicable None - Not defined&#xA;&#xA;Host                      Port  Flags      Age Type   Address(es)&#xA;HotCoffee#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Doing a &lt;code&gt;show user&lt;/code&gt; or &lt;code&gt;ping&lt;/code&gt; populates the host cache...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HotCoffee#sh user&#xA;    Line       User       Host(s)              Idle       Location&#xA;* 66 vty 0     cisco      idle                 00:00:00 tsunami.pennington.net&#xA;&#xA;  Interface    User               Mode         Idle     Peer Address&#xA;&#xA;HotCoffee#ping flame&#xA;Translating &quot;flame&quot;...domain server (172.16.1.5)&#xA;&#xA;Translating &quot;flame&quot;...domain server (172.16.1.5) [OK]&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:&#xA;.!!!!&#xA;Success rate is 80 percent (4/5), round-trip min/avg/max = 1/2/4 ms&#xA;HotCoffee#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now there are host entries for both the &lt;code&gt;ping&lt;/code&gt; target and &lt;code&gt;show user&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HotCoffee#sh hosts&#xA;Load for five secs: 1%/0%; one minute: 0%; five minutes: 0%&#xA;Time source is NTP, 06:16:32.811 CDT Tue Aug 13 2013&#xA;&#xA;Default domain is pennington.net&#xA;Name/address lookup uses domain service&#xA;Name servers are 172.16.1.5&#xA;&#xA;Codes: UN - unknown, EX - expired, OK - OK, ?? - revalidate&#xA;       temp - temporary, perm - permanent&#xA;       NA - Not Applicable None - Not defined&#xA;&#xA;Host                      Port  Flags      Age Type   Address(es)&#xA;tsunami.pennington.net    None  (temp, OK)  0   IP    172.16.1.5&#xA;flame.pennington.net      None  (temp, OK)  0   IP    172.16.1.1&#xA;flame                     None  (temp, UN)  0  IPv6 &#xA;HotCoffee#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Solution: Only Forward lookups&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Use &lt;em&gt;&lt;code&gt;no domain-lookup&lt;/code&gt;&lt;/em&gt; under the vty / console lines to restrict IOS behaviour to only forward lookups...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HotCoffee#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;HotCoffee(config)#line vty 0 4&#xA;HotCoffee(config-line)#no domain-lookup&#xA;HotCoffee(config-line)#end&#xA;HotCoffee#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First I clear the host cache for a clean test...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HotCoffee#clear host *&#xA;HotCoffee#&#xA;HotCoffee#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show user&lt;/code&gt; formerly performed a reverse-lookup on 172.16.1.5 as well as populating the host cache, but neither happens now...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HotCoffee#sh user&#xA;Load for five secs: 1%/0%; one minute: 0%; five minutes: 0%&#xA;Time source is NTP, 06:20:00.250 CDT Tue Aug 13 2013&#xA;&#xA;    Line       User       Host(s)              Idle       Location&#xA;* 66 vty 0     cisco      idle                 00:00:00 172.16.1.5   &amp;lt;----&#xA;&#xA;  Interface    User               Mode         Idle     Peer Address&#xA;&#xA;HotCoffee#&#xA;HotCoffee#sh host&#xA;Load for five secs: 2%/0%; one minute: 0%; five minutes: 0%&#xA;Time source is NTP, 06:20:06.729 CDT Tue Aug 13 2013&#xA;&#xA;Default domain is pennington.net&#xA;Name/address lookup uses domain service&#xA;Name servers are 172.16.1.5&#xA;&#xA;Codes: UN - unknown, EX - expired, OK - OK, ?? - revalidate&#xA;       temp - temporary, perm - permanent&#xA;       NA - Not Applicable None - Not defined&#xA;&#xA;Host                      Port  Flags      Age Type   Address(es)&#xA;                                                                    &amp;lt;----&#xA;HotCoffee#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just to show that forward lookups still function...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HotCoffee#&#xA;HotCoffee#ping flame&#xA;Translating &quot;flame&quot;...domain server (172.16.1.5)&#xA;&#xA;Translating &quot;flame&quot;...domain server (172.16.1.5) [OK]&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 172.16.1.1, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms&#xA;HotCoffee#&#xA;HotCoffee#&#xA;HotCoffee#&#xA;HotCoffee#sh hosts&#xA;Load for five secs: 0%/0%; one minute: 0%; five minutes: 0%&#xA;Time source is NTP, 06:25:43.237 CDT Tue Aug 13 2013&#xA;&#xA;Default domain is pennington.net&#xA;Name/address lookup uses domain service&#xA;Name servers are 172.16.1.5&#xA;&#xA;Codes: UN - unknown, EX - expired, OK - OK, ?? - revalidate&#xA;       temp - temporary, perm - permanent&#xA;       NA - Not Applicable None - Not defined&#xA;&#xA;Host                      Port  Flags      Age Type   Address(es)&#xA;tsunami.pennington.net    None  (temp, OK)  0   IP    172.16.1.5&#xA;flame.pennington.net      None  (temp, OK)  0   IP    172.16.1.1&#xA;flame                     None  (temp, UN)  0  IPv6 &#xA;HotCoffee#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-08-13T16:59:53.943" LastActivityDate="2013-08-13T16:59:53.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2799" PostTypeId="1" CreationDate="2013-08-13T12:21:52.897" Score="6" ViewCount="1298" Body="&lt;p&gt;Can anyone help me with understanding one thing about AAA authorization on Cisco IOS. Here is a config fragment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authorization config-commands&#xA;aaa authorization exec default group tacacs+ local&#xA;aaa authorization commands 1 default group tacacs+&#xA;aaa authorization commands 15 default group tacacs+ local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do I understand correctly that authorization allows some commands (like &quot;commands 15&quot;) for some users (like &quot;group tacacs+&quot;)? So why there is no option &quot;group&quot; for the config-commands? &lt;/p&gt;&#xA;" OwnerUserId="2347" LastActivityDate="2013-08-15T21:15:29.200" Title="Cisco AAA authorization with no user group" Tags="|cisco|aaa|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2800" PostTypeId="1" AcceptedAnswerId="2801" CreationDate="2013-08-13T13:47:23.543" Score="20" ViewCount="42424" Body="&lt;p&gt;I'm in the process of connecting together some sites via optical fibre. The trans-site multimode fibres are terminated with SC jacks on patch panels from where they are patched to the corresponding switch ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to receive a working connection, the cables need to be crossed at one point to let RX point to TX and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should this cross-connection be made in the transit cable (i.e. between the patch panels) or one of the patch cables between the panel and the switch? Is there a common practice?&lt;/p&gt;&#xA;" OwnerDisplayName="user2348" LastEditorUserId="8499" LastEditDate="2018-03-07T20:31:45.843" LastActivityDate="2018-03-07T22:03:50.623" Title="Where to cross RX/TX line in fibre optical cabling" Tags="|fiber|layer1|cabling|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2801" PostTypeId="2" ParentId="2800" CreationDate="2013-08-13T13:59:49.783" Score="9" Body="&lt;p&gt;Cross on one of your patch cables.  You want your installed fiber plant to be labeled correctly at both ends (Strand 1 at Site A = Strand 1 at Site B).&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2013-08-13T13:59:49.783" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2802" PostTypeId="2" ParentId="2799" CreationDate="2013-08-13T14:00:35.610" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/security/command/reference/srfauth.html#wp1021814&quot; rel=&quot;nofollow&quot;&gt;CCO docs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If aaa authorization commands level method command is enabled, all&#xA;  commands, including configuration commands, are authorized by AAA&#xA;  using the method specified. Because there are configuration commands&#xA;  that are identical to some EXEC-level commands, there can be some&#xA;  confusion in the authorization process. Using the no aaa authorization&#xA;  config-commands command stops the network access server from&#xA;  attempting configuration command authorization.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It never really occurred to me, but the way you suggest would make more sense than the way it works. Now it just inherits the server which it should query from 'commands level' and documents are unclear &lt;em&gt;which&lt;/em&gt; level, as they may be different, but I guess it would be level 15.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-08-13T14:00:35.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2803" PostTypeId="1" CreationDate="2013-08-13T14:10:17.717" Score="4" ViewCount="274" Body="&lt;p&gt;A branch office has a small 2950 in front of their PIX firewall (so failover can plug into it.  The upstream router (owned by teleco company) only has one input port).  I'm attempting to manage the device remotely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PIX is the gateway for everything in the office: 10.1.128.254&#xA;The switch has management setup: 10.1.128.249&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've added ACL allowances for remote management (SSH), and a static route specifically for managing this device.  Doing these two things has allowed me to be able to ping the device (from the PIX) but not from machines on the inside.. Remote access via SSH (putty) still unsuccessful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've packet-traced from inside to 10.1.128.249 and nothing is preventing this communication that I can see.  Thanks in advance all!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Assume that I cannot connect this to the internal network (physically).&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2013-08-13T14:36:40.087" LastActivityDate="2013-08-13T14:36:40.087" Title="SSH to switch on OUTSIDE of old PIX Firewall" Tags="|cisco|pix|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2804" PostTypeId="2" ParentId="2803" CreationDate="2013-08-13T14:16:27.780" Score="3" Body="&lt;p&gt;I typically set up such DMZ switches with a dedicated management interface with layer two access to the inside network, so that management access bypasses the firewall entirely. Since the 2950 does not have a dedicated management interface, you could simply designate a separate VLAN for management, configure its SVI, and assign to an access port which connects to the inside network. This ensures that you will have access to the switch in the event of a firewall failure for troubleshooting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note that Internet access from the switch will go through the inside network, the firewall, and pass back through the switch itself; it will not have direct outside connectivity.)&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2013-08-13T14:16:27.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2805" PostTypeId="1" CreationDate="2013-08-13T16:06:30.293" Score="4" ViewCount="717" Body="&lt;p&gt;Because of how routers separate networks is it possible to say use the network 192.168.1.0/24 several times as long as you have enough networks to separate?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0/24 &amp;lt;--&gt; 172.16.0.0/24 &amp;lt;--&gt; 192.168.1.0/24&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="762" LastEditDate="2013-08-14T18:35:30.507" LastActivityDate="2020-07-12T15:41:59.240" Title="Can the same network IPs be used more than once" Tags="|router|routing|" AnswerCount="7" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="2806" PostTypeId="2" ParentId="2745" CreationDate="2013-08-13T16:09:04.183" Score="2" Body="&lt;p&gt;After reading the specification of SFP, I change the fiber cable and the issue persist. I check the two sides (SFP and CPE), both are sending packet and the counters are incrementing. So a colleague suggest this probably it's the negotiation (speed/duplex). I configure the &lt;code&gt;speed&lt;/code&gt; on no-negotiate, strangely I can set a numerical speed (100/1000/...) as other switchs, only &lt;code&gt;Auto&lt;/code&gt; or &lt;code&gt;Nonegotiate&lt;/code&gt;. I set too the &lt;code&gt;duplex&lt;/code&gt; on full, the problem persist. I contact our supplier of CPE Packetfront. We tried to tshoot the link. After a while and reading the Release Note of CPE we found there is improvements on firmware on negotiation with Cisco equipment, so he strongly recommend to upgrade version to the last version (1.10). Update done the CPE works fine. Thanks all for the support.&lt;/p&gt;&#xA;" OwnerUserId="206" LastActivityDate="2013-08-13T16:09:04.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2809" PostTypeId="2" ParentId="2805" CreationDate="2013-08-13T17:56:52.063" Score="15" Body="&lt;p&gt;I will only work if there is NAT between each of the networks (IP space re-use via VRF set aside). Otherwise each network has to be unique or routing will fail.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-08-13T17:56:52.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2810" PostTypeId="2" ParentId="2805" CreationDate="2013-08-13T17:57:19.257" Score="5" Body="&lt;p&gt;Any given network that serves the public probably has a few thousand instances of 192.168.1.0/24 attached to it at any given moment, so it works. It would be somewhat insane to do so deliberately on networks managed by one company, so I'm glad to hear you wouldn't. In the case you provide where you are connecting two private networks to a third private network, there will also be some potential lack-of-joy from &quot;double NAT&quot; if a connection to the outside world (public IP address) is contemplated - perhaps even triple NAT depending where you connect to. Best to avoid that, IME.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some lack of joy when setting up VPN, I have eliminated all instances of 192.168.0.0, 192.168.1.0, 192.168.2.0, 192.168.100.0, 10.0.0.0, 172.16.0.0 from any of my networks. Up until that point 192.168.1.0 was fine for many years, but having been through that, even networks I don't currently plan to connect to VPN get an address that's as non-default as I can manage, and none of them are the same. Picking a non-default section of the private address space greatly reduces issues when users are connecting from places that (nearly always) are using one of those defaults.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2013-08-13T17:57:19.257" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2812" PostTypeId="2" ParentId="2805" CreationDate="2013-08-14T12:10:15.260" Score="-2" Body="&lt;p&gt;With this kind of configuration, when you try to ping a 192.168.1.0/24 network from 172.16.0.0/24 network, one ping would be successful and the next ping will be dropped. You will see something like this !.!.!.!.! when you try to ping.&lt;/p&gt;&#xA;" OwnerUserId="2357" LastActivityDate="2013-08-14T12:10:15.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2813" PostTypeId="2" ParentId="2805" CreationDate="2013-08-14T13:21:53.683" Score="0" Body="&lt;p&gt;Simplest answer is, Yes.  However, each &quot;network&quot; will have issues reaching the other two.&lt;/p&gt;&#xA;" OwnerUserId="892" LastActivityDate="2013-08-14T13:21:53.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2814" PostTypeId="1" CreationDate="2013-08-14T13:30:42.877" Score="16" ViewCount="70245" Body="&lt;p&gt;Our topology is such that we have two 4510's in our &lt;a href=&quot;/tags/idf&quot; title=&quot;Intermediate Distribution Frame&quot;&gt;IDF&lt;/a&gt; closets.  Each switch has a data VLAN and a voice VLAN.  The switches are layer 2 trunked to the core, where the VLAN interfaces are, routing happens, and &lt;a href=&quot;/tags/dhcp&quot; title=&quot;Dynamic Host Configuration Protocol&quot;&gt;DHCP&lt;/a&gt; is forwarded to the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best practice to provide DHCP service redundancy?  If there are two dhcp servers, and two &quot;ip-helper&quot; addresses, will the network only forward dhcp requests to the first IP as long as it's reachable from a network perspective?  If it goes down, then dhcp goes to the second address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if the first server's dhcp service is having a problem - but the server is still reachable via the network (you can ping it, but dhcp service is down)?  Or what if the DHCP scope is full?  Will the second ip-helper address help?  Will the second address only come into play if the first server is hard down?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to get the ip-helper to &quot;round-robin&quot; between the two?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS.  Unfortunately, this is a Microsoft only DHCP Server option.  I was asked about ideas and I mentioned Infoblox, but that's in the future .... maybe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="892" LastEditorUserId="49" LastEditDate="2013-08-14T14:36:00.860" LastActivityDate="2014-01-30T09:25:14.857" Title="Best practice using Cisco's &quot;ip-helper&quot; for DHCP?" Tags="|dhcp|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2815" PostTypeId="2" ParentId="2805" CreationDate="2013-08-14T13:46:17.187" Score="0" Body="&lt;p&gt;If you are just attempting to transit these duplicate networks, it will work.  However, without NAT, or some other kludge, one duplicate network will not be able to talk to another.  In your example, each router directly connected to one of the 192.168.1.0/24 networks will have a single &quot;connected&quot; route to 192.168.1.0/24.  Neither will have a route to the far-side 192.168.1.0/24.  Don't do this, it's very bad design.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2013-08-14T13:46:17.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2816" PostTypeId="2" ParentId="2814" CreationDate="2013-08-14T13:55:54.337" Score="10" Body="&lt;p&gt;The router will forward all DHCP requests to all servers configured with ip helper.  The first server to respond with a usable address wins.  I'm unaware of a way to round-robin from the router.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2013-08-14T13:55:54.337" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2817" PostTypeId="2" ParentId="2814" CreationDate="2013-08-14T13:59:05.520" Score="7" Body="&lt;p&gt;All broadcast traffic (DHCPDISCOVERs and DHCPREQUESTs) will be forwarded to all ip-helper addresses. The order in which the ip-helper statements are configured makes no difference. The device will take an address from the first server it receives a DHCPOFFER from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to get around a scope being full is to configure a secondary subnet on the interface. In Cisco IOS, the config looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface f0/1&#xA;ip address 192.168.1.1 255.255.255.0&#xA;ip address 192.168.2.1 255.255.255.0 secondary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2183" LastActivityDate="2013-08-14T13:59:05.520" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2822" PostTypeId="2" ParentId="2814" CreationDate="2013-08-15T00:20:07.440" Score="0" Body="&lt;p&gt;The point of all this is that DHCP redundancy is 80% a DHCP server issue, you can do a split scope approach, windows 2012 lets you have active and standby with replication without clustering. We just have daily backups (we use 7 day leases) and then restore to another box or VM. Check what you DHCP server software provides, the helper address is really the least of your worries&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-08-15T00:20:07.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2823" PostTypeId="2" ParentId="2800" CreationDate="2013-08-15T05:38:40.130" Score="9" Body="&lt;p&gt;Common practice would be just to cross everywhere since you will always get an uneven number of crosses which will result in an overall cross. But this only works if your fibres were installed by a sane company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically you need to know that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a) Couplings cross&#xA;b) You need crossed cables/trunks everywhere (which *should* be default)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So let's test that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Device - Cable - Device: 1 cross&#xA;Device - Cable - Coupling - Cable - Device: 3 crosses&#xA;Device - Cable - Coupling - Trunk - Coupling - Cable - Device: 5 crosses&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Problem is if you have straight cables somewhere, even worse if it is your site-to-site trunks. Depending on how the patchpanel is built you can maybe swap the fibres on one side. If you can't you have the only choice to define a point of crossing - depending on how your other fibres are setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a hint: I would label them. We have a single straight through panel on site out of hundred of crossed ones. It annoys the hell out of you! Then someone starts flipping calbes &lt;em&gt;somewhere&lt;/em&gt; to get the connections to work. A year later someone else removes the tampered cables and puts them back into storage. Guess what happens next?&lt;/p&gt;&#xA;" OwnerUserId="1334" LastActivityDate="2013-08-15T05:38:40.130" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2824" PostTypeId="2" ParentId="2814" CreationDate="2013-08-15T07:16:33.857" Score="2" Body="&lt;p&gt;All &lt;code&gt;ip helper-address&lt;/code&gt; lines configured in your VLAN take the DHCP broadcast from the client, add the router's (gateway) address into the UDP packet, then unicasts to the DHCP servers.  [I'm sure the packet rewrite is only done once, then a copy sent to each DHCP server.]  All the listed servers configured receive the DHCPDiscover packet by the router relay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The redundancy of your DHCP servers not only depends on your OS, but the specific version!  For Windows that was mentioned, your options range from a true split-scope in &#xA;Windows 2008 R2 to active-failover redundancy in Windows 2012.  For not-so-robust DHCP servers (i.e., Windows 2003), you can manually configure a split-scope.  Common recommendation is the 80/20 rule with 80% of the leases configured on what you (and you alone) consider your primary DHCP server and 20% and the secondary. Exclusions get added to each DHCP server as they have overlapping scopes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I'm not a fan of overlapping scopes in Windows 2003 as the &lt;em&gt;exclusions&lt;/em&gt; tend to get hidden from view, I prefer to simply split the subnet in half for each DHCP server.  A /24 block for client leases becomes two /25 blocks.  They key is the subnet mask in the scope is still a /24.  Your start and end IP addresses in the range configured in the scope follows the /25. Now I do recommend some exclusions for network devices like VLAN interface IP addr's and HSRP as well as some for static devices (e.g. printers) in the same subnet.  So I exclude the first 16 (0-15) addresses -- zero address wouldn't be used, of course, anyway -- and exclude the top 16 (240-255) -- 255 broadcast, of course.  You can actually get away with not configuring the exclusion by simply starting and ending the IP address appropriately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic scope information in a manually configured 50/50 split-scope (2x/25=/24) is similar to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;DHCP Primary&#xA;  Scope-lower: 192.0.2.0/24, start 192.0.2.16, end 192.0.2.127, no exclusions&#xA;DHCP Secondary&#xA;  Scope-upper: 192.0.2.0/24, start 192.0.2.128, end 192.0.2.239, no exclusions&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configure identical scopes (2x/24) with appropriate exclusions if you prefer this method:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;DHCP Primary&#xA;  Scope-full: 192.0.2.0/24, start 192.0.2.16, end 192.0.2.239, exclusions 1-15, 128-254&#xA;DHCP Secondary&#xA;  Scope-full: 192.0.2.0/24, start 192.0.2.16, end 192.0.2.239, exclusions 1-127, 240-254&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As there is an every so slight delay with the duplicate DHCPDiscover packets unicast to each &lt;code&gt;ip helper-address&lt;/code&gt;, all else being equal, the first DHCP server listed will usually be the first to respond with a DHCPOffer, and the address chosen by the client when it makes its DHCPRequest -- no guarantee though.  So place your primary DHCP server first in your SVI for the VLAN.  A client typically receives multiple DHCPOffers and decides on the best which is usually the first one received.  The assignment completes only after the client sends a DHCPRequest back to the server -- in case the server changed its mind about the lease or is no longer reachable or ??? -- and the server sends a DHCPACK. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface vlan123&#xA;  desc svi for vl123 dhcp relay example&#xA;  ip address 192.0.2.1&#xA;  ip helper-address 192.0.4.1 ! Primary DHCP server&#xA;  ip helper-address 192.0.4.2 ! Secondary DHCP server&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Between your data and voice VLANs, you may want to alternate what you consider the primary DHCP server for a given VLAN.  I do this to help spread the lease load out a bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a DHCP server's scope is full, it won't reply with a DHCPOffer, so the &lt;em&gt;offer&lt;/em&gt; would come from another DHCP server, assuming it's not also full.  Keep in mind when troubleshooting that a Windows client will remember the IP they had leased last and attempt to get that again.  Also keep in mind any reservations you do must be done on both servers and accounted in any ACLs you have such as in firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a00800f0804.shtm&quot; rel=&quot;nofollow&quot;&gt;Understanding and Troubleshooting DHCP in Catalyst Switch or Enterprise Networks&lt;/a&gt; for detailed explanation and sniffer traces of the DHCP relay process.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2014-01-30T09:25:14.857" LastActivityDate="2014-01-30T09:25:14.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2826" PostTypeId="2" ParentId="2777" CreationDate="2013-08-15T08:51:25.867" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, what about Wireless (802.11)? As the wireless signal becomes weaker and the error rate increases, is the MTU ever shrunk so smaller frames are sent?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The 802.11 specification does not suggest to shrink the MTU in case of bad links. But the layer 2 isn't independent of the frame size: The option to use RTS/CTS or layer2 fragmentation/aggregation depends on the frame size. The chosen modulation rates could also depends on the frame size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And since the layer 1 is a shared radio environment, it's packet loss probability may depend on the size of the frame. You could theoretically have a lossy environment where larger frame have a higher loss probability than short frames, but you could also have the opposite. This depends on the radio environment, the amount and type of noise or competing radio technologies in use. But if you use Wi-Fi in ESS/infrastructure mode, the association will be dropped well before you get to that point.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2013-08-15T08:51:25.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2827" PostTypeId="1" AcceptedAnswerId="2831" CreationDate="2013-08-15T09:26:40.900" Score="6" ViewCount="4006" Body="&lt;p&gt;We have a Cisco 5508 wireless controller, Cisco Prime NCS, and the Cisco MSE.  Our company needs three SSIDs, and each SSID must have a different Vlan.  We have a mixture of Cisco 1242 and Cisco 3602i APs; our environment is mostly Windows 7.  We want to use the CleanAir technology on the 3602i APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a problem using CleanAir on the 3602i APs in the same building with the 1242 APs, which don't have CleanAir?  If it's ok to do this, how do I set CleanAir up on the 3602i and no CleanAir on the 1242 APs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are we able to mix 1242 APs with CleanAir 3602i APs on the same SSID?  If so, how do I set this up?  Are there any problems to watch out for?&lt;/p&gt;&#xA;" OwnerUserId="2369" LastEditorUserId="2369" LastEditDate="2013-08-15T09:33:01.757" LastActivityDate="2013-08-15T17:23:00.250" Title="Cisco wireless: APs with and without CleanAir" Tags="|cisco|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2828" PostTypeId="2" ParentId="2805" CreationDate="2013-08-15T10:56:03.943" Score="4" Body="&lt;p&gt;If you carefully set up the routing, configurations like that can be used for anycast addresses. E.g. 2 DNS servers each in the duplicate subnet with the same IP address - the closer one would respond to DNS requests from other subnets.&lt;/p&gt;&#xA;" OwnerUserId="2370" LastActivityDate="2013-08-15T10:56:03.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2829" PostTypeId="1" AcceptedAnswerId="2973" CreationDate="2013-08-15T12:28:28.710" Score="9" ViewCount="12876" Body="&lt;p&gt;I have a firewall, where I have to lower the TCP session timeout from 24h to 1h.&lt;br&gt;&#xA;Before I do that, I'm trying to determine if this will break any applications, i.e applications that have sessions that can be idle for a long time, but are not able to re-establish the connection if the firewall drops it.&lt;br&gt;&#xA;So I want to filter out connections from my connection table, that have been idle for more than 60 minutes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firewall is CheckPoint R75.40, and I'm looking at the connection table with the &quot;fw tab -t connections -u&quot; command. &#xA;I suppose the information I want is in the output, but what am I looking for?&lt;/p&gt;&#xA;" OwnerUserId="282" LastActivityDate="2013-08-27T00:48:52.677" Title="Find idle connections in Check Point firewall" Tags="|firewall|checkpoint|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2831" PostTypeId="2" ParentId="2827" CreationDate="2013-08-15T17:23:00.250" Score="6" Body="&lt;p&gt;Clean Air is enabled by default on the radios of AP that support Clean Air. It is primarily hardware based so it is 'bound' to a radio, not SSID. You can mix them (APs), but only the ones with Clean Air will do spectrum monitoring on the channel they are on and report configured events.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You enable Clean Air for &lt;code&gt;a/n&lt;/code&gt; and &lt;code&gt;b/g/n&lt;/code&gt; under the wireless tab at your WLC. You can configure it to report detected interference and tune what type of interference to ignore or detect. Also you can disable Clean Air on AP basis, you should see Clean Air capable field somewhere on the configuration page for the AP. This will override the global WLC setting for that AP since it is more specific.&lt;/p&gt;&#xA;" OwnerUserId="2358" LastActivityDate="2013-08-15T17:23:00.250" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2834" PostTypeId="2" ParentId="780" CreationDate="2013-08-15T20:05:09.423" Score="0" Body="&lt;p&gt;If you are connecting over a 10/100 switch and have autonegotiate on part of it you may have a duplex mismatch.  This will cause frequent collisions when there is load on the network that won't show up when things are relatively quiet.  The collisions will cause resends as will as forcing communications to backoff and can cause a seemingly unreasonable slowdown.&lt;/p&gt;&#xA;" OwnerUserId="2374" LastActivityDate="2013-08-15T20:05:09.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2835" PostTypeId="2" ParentId="2799" CreationDate="2013-08-15T20:12:01.340" Score="2" Body="&lt;p&gt;What the last line in your example config does is require level 15 commands to be authorized through tacacs+, or if tacacs+ is not available, to utilize the local database. The previous line requires authorization of level 1 commands through tacacs+ only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has nothing to do with specifying groups of users.&lt;/p&gt;&#xA;" OwnerUserId="2375" LastEditorUserId="775" LastEditDate="2013-08-15T21:15:29.200" LastActivityDate="2013-08-15T21:15:29.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2836" PostTypeId="1" AcceptedAnswerId="2856" CreationDate="2013-08-16T01:20:55.197" Score="4" ViewCount="15849" Body="&lt;p&gt;I'm on a MacBook air, and I got a book form the library about wireless network security. I've been following pretty diligently, but it seems like no matter what I do I &lt;strong&gt;cannot capture packets of other devices on my network&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried using WireShark, with the &quot;promiscuous&quot; box checked, on my en0 interface. (en0 is the only internet interface on a macbook air, the other options being loopback, and peer to peer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've added the wireless SSID and password to wireshark, and applied that change, I also tried disconnecting and reconnecting my iPhone to the network several times, hoping to pick up the traffic from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last try: I used the raw tcpdump command as root, with and without the &lt;code&gt;-p&lt;/code&gt; flag (without &lt;code&gt;-p&lt;/code&gt; means run in promiscuous mode), and then analyzed the packets from the pcap file, which there were plenty of, just not any from any other machines. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly there is something I am missing, maybe some kind of internal configuration deal. I would really appreciate help on this, it would make a great demo for job interviews, and would be an awesome skill to have. &lt;/p&gt;&#xA;" OwnerUserId="1898" LastActivityDate="2017-11-09T14:58:43.543" Title="Packet sniffing promiscuously on MacBook Air" Tags="|wireshark|packet-analysis|tcpdump|" AnswerCount="5" CommentCount="3" ClosedDate="2019-01-25T23:27:44.140" ContentLicense="CC BY-SA 3.0" />
  <row Id="2840" PostTypeId="1" AcceptedAnswerId="2842" CreationDate="2013-08-16T07:26:07.343" Score="45" ViewCount="5541" Body="&lt;p&gt;Why is so large a range of IPv4 addresses assigned to &lt;code&gt;localhost&lt;/code&gt;, (&lt;code&gt;127.0.0.0&lt;/code&gt; through &lt;code&gt;127.255.255.255&lt;/code&gt;)?&lt;/p&gt;&#xA;" OwnerUserId="2377" LastEditorUserId="49" LastEditDate="2013-08-16T11:42:28.283" LastActivityDate="2014-01-21T17:54:02.773" Title="Why is such a large IPv4 range assigned to localhost?" Tags="|ipv4|loopback|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2841" PostTypeId="1" AcceptedAnswerId="2843" CreationDate="2013-08-16T07:31:51.463" Score="6" ViewCount="17702" Body="&lt;p&gt;How many TCP/IP layers are involved when I am pinging my router and my PC?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My router : &lt;code&gt;ping 192.168.1.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My PC : &lt;code&gt;ping 127.0.0.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My PC : &lt;code&gt;Ping 192.168.1.10&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to know how the data is transferred in all the three cases through the layers.&lt;/p&gt;&#xA;" OwnerUserId="2377" LastEditorUserId="44" LastEditDate="2013-08-16T13:36:39.190" LastActivityDate="2013-08-17T11:17:38.403" Title="How many TCP/IP layers are involved when I am pinging my router and my PC?" Tags="|ipv4|protocol-theory|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2842" PostTypeId="2" ParentId="2840" CreationDate="2013-08-16T07:36:50.560" Score="48" Body="&lt;p&gt;It comes from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc990#page-6&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 990, pg 5&lt;/a&gt;, under &amp;quot;Special Addresses&amp;quot;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The class A network number 127 is assigned the &amp;quot;loopback&amp;quot; function, that is, a datagram sent by a higher level protocol to a network 127 address should loop back inside the host.  No datagram &amp;quot;sent&amp;quot; to a network 127 address should ever appear on any network anywhere.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;At the time (1986), the internet was completely classful and nobody really gave much thought to allocating this much space to the loopback address.  Thus, the loopback got an entire Class A network.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-08-16T07:36:50.560" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2843" PostTypeId="2" ParentId="2841" CreationDate="2013-08-16T07:50:17.123" Score="10" Body="&lt;p&gt;First of all, remember that TCP/IP has only 4 layers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Application&lt;/li&gt;&#xA;&lt;li&gt;Transport ( TCP/UDP )&lt;/li&gt;&#xA;&lt;li&gt;Internet ( IP )&lt;/li&gt;&#xA;&lt;li&gt;Link (Frame)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When you ping your PC from itself, doesn't matter if it is the &quot;canonical&quot; localhost or a user defined address, only the second of the four layers is involved since the network stack does not need to access any network to reach itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Contrary, when you send a echo request to another box ,the running OS first resolve the L2 mappings ( even dynamically or by configuration ) and then uses those information to build the packet and to send it to the destination box.&lt;/p&gt;&#xA;" OwnerUserId="530" LastEditorUserId="630" LastEditDate="2013-08-17T08:36:20.073" LastActivityDate="2013-08-17T08:36:20.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2844" PostTypeId="2" ParentId="2215" CreationDate="2013-08-16T07:56:32.833" Score="0" Body="&lt;p&gt;I know it is not always possible to have a spare chassis for lab testing, but i would recommend that you at least reserve one downstream and one upstream for testing purposes. If you have free connectors you can create new Bundle interface and configure it with ip-helper address of the new server. This way you can also test parsing DHCP options, source-verify, leasequery-filter, dynamic shared secret or whatever you use in combination with DHCP and TFTP servers. You don't want to put new server in production without fully testing everything the way it will actually run in production, especially in ISP environment.&lt;/p&gt;&#xA;" OwnerUserId="2358" LastActivityDate="2013-08-16T07:56:32.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2845" PostTypeId="2" ParentId="2841" CreationDate="2013-08-16T08:13:08.857" Score="2" Body="&lt;p&gt;TCP/IP doesn't really map cleanly onto the OSI model (which was designed top-down by a committee). If you want the closest map onto the OSI layers, the answer is probably 3.5: ICMP (which is what &lt;code&gt;ping&lt;/code&gt; uses) is implemented directly on top of IP packets and doesn't use a transport layer (OSI layer 4) like TCP or UDP.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-08-16T08:13:08.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2847" PostTypeId="2" ParentId="2841" CreationDate="2013-08-16T08:34:37.823" Score="3" Body="&lt;p&gt;No matter what IP address is in question, ICMP packet will have the same format. ICMP is part of TCP/IP protocol suite which resides on layer 3. If you do a packet capture can easily see what type of information is sent. You can also see that ICMP is on top of IP so it is also said it is a on 3.5 layer. No matter what you ping (loopback or some distant address) packet &lt;strong&gt;must&lt;/strong&gt; have all required layers (in this case from 1 through 3). The way the packet destined for loopback adapters is processed is another question but that does not affect the packet format or protocols/layers used.&lt;/p&gt;&#xA;" OwnerUserId="2358" LastActivityDate="2013-08-16T08:34:37.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2850" PostTypeId="2" ParentId="2829" CreationDate="2013-08-16T12:25:04.533" Score="3" Body="&lt;p&gt;If you want to use command line you can just add –f flag to the command, it will format output to readable text format. “fw tab -t connections –u -f”&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to use Smartview Tracker and check the active connections from the Active tab. Be careful though if you have performance issues, viewing active connections will raise CPU load significantly on the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet another way is to enable accounting (Track column -&gt; Other -&gt; Account) on rules that could be matching long idle connections, in this case the connection duration will be visible in log file after the connection has been closed. Using the logs you can run a custom report with Check Point tools or just manually filter and view through them.  This is maybe the best option, if you have time and want the most accurate results.&lt;/p&gt;&#xA;" OwnerUserId="2378" LastEditorUserId="2378" LastEditDate="2013-08-19T07:57:30.320" LastActivityDate="2013-08-19T07:57:30.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2851" PostTypeId="2" ParentId="303" CreationDate="2013-08-16T13:30:35.477" Score="0" Body="&lt;p&gt;Here's a GET VPN configuration example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.certvideos.com/get-vpn-configuration-example/&quot; rel=&quot;nofollow&quot;&gt;http://www.certvideos.com/get-vpn-configuration-example/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2381" LastActivityDate="2013-08-16T13:30:35.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2856" PostTypeId="2" ParentId="2836" CreationDate="2013-08-16T18:40:54.880" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I've tried using WireShark, with the &quot;promiscuous&quot; box checked, on my en0 interface.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You say &quot;en0&quot;, so you're running OS X (rather than, for example, Linux), so the &quot;monitor mode&quot; checkbox should work, and you're on a MacBook Air, so that's your AirPort interface, i.e. it's an 802.11 interface.  &quot;Promiscuous&quot; mode doesn't necessarily work the way you'd want on 802.11 interfaces, so you need &quot;monitor&quot; mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try checking the monitor mode checkbox, &lt;em&gt;but&lt;/em&gt; note that, in monitor mode, traffic won't be decrypted if you're on a &quot;protected&quot; (WEP or WPA/WPA2) network; see &lt;a href=&quot;http://wiki.wireshark.org/HowToDecrypt802.11&quot;&gt;the Wireshark Wiki &quot;How to decrypt 802.11&quot; page&lt;/a&gt; for details on how to decrypt the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to use a command-line tool such as tcpdump or TShark, use the &lt;code&gt;-I&lt;/code&gt; command-line flag to turn monitor mode on.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2013-08-16T18:40:54.880" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2857" PostTypeId="2" ParentId="1204" CreationDate="2013-08-16T19:04:34.827" Score="0" Body="&lt;p&gt;It is possible to have WLC and APs in the same subnet, but unlikely since it is hard to manage especially in large environments or when you deploy new access points frequently. From my experience: On small locations where you have 10-20 APs and WLC on site it is easier to put them in the same VLAN. On larger installations where you have one (or more redundant) centralized WLC and a lot of APs that are (geographically) scattered, easy-to-configure and 'clean' solution is to use DNS for discovery process. When you have more complex networks, either because of specific requirements or maybe bad design you can use DHCP option 43 (or static configuration).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using DNS record is a simple solution for discovering the controller especially if you have only one in your domain or you don't care which WLC the AP will join. I like to use DHCP vendor specific options for the discovery process since it is easier then manually configuring the &lt;code&gt;lwapp ap controller ip address&lt;/code&gt; but gives more control especially when you can't use different domains for some reason and want to be able to send different WLC IPs to the APs. You can create scope-based policy that have DHCP option 43 with IP address of the controller for the VCIs (Vendor Class Identifiers) of your access points. VCI is sent in option 60 by DHCP client during the initial DHCP discover broadcast and is used to identify the specific class of devices (hence the name). For matched VCIs DHCP will send option 43 with 102 or 241 suoptions that you will configure to hold IP addresses of your controllers (and other clients will not see them).&lt;/p&gt;&#xA;" OwnerUserId="2358" LastActivityDate="2013-08-16T19:04:34.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2858" PostTypeId="1" AcceptedAnswerId="2863" CreationDate="2013-08-17T00:18:34.287" Score="6" ViewCount="23621" Body="&lt;p&gt;Current configuration with HP Procurve 2848 switch at a colocation facility consists of using the ISP switchport as the default gateway. The current configuration is very basic with only 1 vlan assign to all switch ports. Routing is not currently enabled and the switch only functions at layer2 at the moment. There are 2 HP procurve switches connected together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I now need to configure HP switch to do the routing instead of using the ISP switchport as the default gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The commands are similar to cisco commands but I can find the HP commands which relate. However, I just want to confirm I am thinking of this the best way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was going to configure a new vlan on an unsued access port and assign that Vlan with the IP of the /30 that is being configured to connect to the ISP switchport. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I was going to enable IP routing on the HP switch and assign our current IP subnet as well as new subnets to the current vlan, and statically route it to the new vlan that was configured with the /30 to connect to the ISP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which HP or Cisco commands might help achieve the above? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also just to note, we statically assign private 192.168.1.0/24 IP addresses to some devices connected to the HP switches. There is no actual gateway or route configured for this /24. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Summary:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Servers are located in a colocation facility. &lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Right now HP switch functions only as a switch and utilizes the uplink port from the ISP(colocation facility) as the default gateway. So the ISP does the routing to my network. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In order to obtain new IP's, we need to configure our switch to begin routing. The ISP will assign us public IPs and put it to our HP switch via the /30 IP. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;I need to be able to move a cable from any switch port to another switchport and still allow it to communicate on the network. (Meaning the default way a switch works where any network can communicate from any port)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The end result should resemble something similar to this image:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1HyPD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE: Working Example Below&lt;/strong&gt;&#xA;- Note: Due to time constraints I performed the IP configurations on Vlan 1 since that is the default vlan that exists in both switches. The ISP went into Port 2 of the switch. HP Switch B connected to Port 1 of Switch A. &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;HP Switch A&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config&#xA;ip routing&#xA;ip route 0.0.0.0 0.0.0.0 192.224.10.9&#xA;&#xA;vlan 1&#xA;ip address 192.127.16.193 255.255.255.224&#xA;ip address 192.224.16.193 255.255.255.224&#xA;ip address 192.168.1.1 255.255.255.0&#xA;exit&#xA;&#xA;vlan 30 name ISP&#xA;vlan 30&#xA;ip address 192.224.10.10 255.255.255.252&#xA;untagged 2&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;HP Switch B&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config&#xA;ip default-gateway 192.127.16.193&#xA;vlan 1&#xA;ip address 192.127.16.194 255.255.255.224&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2263" LastEditorUserId="2263" LastEditDate="2013-08-26T16:23:48.377" LastActivityDate="2015-06-18T10:04:20.093" Title="Reconfiguring Layer3 Switch to enable IP routing and become the default gateway" Tags="|routing|cisco-commands|hp-procurve|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2859" PostTypeId="2" ParentId="2841" CreationDate="2013-08-17T11:17:38.403" Score="4" Body="&lt;p&gt;To answer your first question, I would say ICMP run up on the third layer TCP/IP but don't use the fourth (TCP/UDP not involved) so I think it's correct to describe it as running on 3.5 Layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can analyze yourself the data inside ICMP using a packet analyser (Wireshark recommended). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here a picture to get a better idea. &#xA;&lt;img src=&quot;https://i.stack.imgur.com/LIElL.png&quot; alt=&quot;icmp_wireshark&quot;&gt;     &lt;/p&gt;&#xA;" OwnerUserId="206" LastActivityDate="2013-08-17T11:17:38.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2861" PostTypeId="2" ParentId="2858" CreationDate="2013-08-17T12:10:15.893" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Then I was going to enable IP routing on the HP switch and assign our&#xA;  current IP subnet as well as new subnets to the current vlan&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Despite this is possible, I would recommend you to use a different VLAN for each subnet. This is considered a best practice as it provides several advantages. For instance:  it reduces the amount of broadcast traffic that every network client has to process.&lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-08-17T20:57:31.863" LastActivityDate="2013-08-17T20:57:31.863" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2863" PostTypeId="2" ParentId="2858" CreationDate="2013-08-17T22:28:27.237" Score="4" Body="&lt;p&gt;I tried to upload a visio picture that shows what I think you are trying to accomplish, but I guess I need more reputation!  You basically need to enable IP routing on the HP switch that will be the gateway, and add a default route. I definitely recommend using separate VLANs for your different networks.  You will also need to make sure that your ISP router has a route back to your HP switch for your 192.168.1.0/24 network:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP Router    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Int fa0/0    &#xA;Ip address X.X.X.1 255.255.255.252    &#xA;Ip route 192.168.1.0 255.255.255.0 X.X.X.2  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HP Switch 1  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ip routing  &#xA;Vlan 10 name ISP  &#xA;Ip address X.X.X.2 255.255.255.252  &#xA;Untagged 1  &#xA;Vlan 20 name LAN  &#xA;Ip address 192.168.1.1 255.255.255.0  &#xA;Untagged 2-48  &#xA;Ip route 0.0.0.0 0.0.0.0 X.X.X.1  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HP Switch 2   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ip default-gateway 192.168.1.1  &#xA;Vlan 20 name LAN  &#xA;Ip address 192.168.1.2 255.255.255.0  &#xA;Untagged 1-48  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2368" LastEditorUserId="76" LastEditDate="2013-08-18T21:15:46.307" LastActivityDate="2013-08-18T21:15:46.307" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2864" PostTypeId="2" ParentId="2858" CreationDate="2013-08-17T22:34:09.450" Score="2" Body="&lt;p&gt;I am guessing you have a /24 given to you by your ISP, you can divide that address space up into several Vlans with no problem, but if you create extra /24 Vlans you either have to get the address space from the provider or if it is your address space ensure that the provider side has static routes configured and redistributed in order to reach you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As was said above almost on one uses multiple addresses spaces on the same VLAN unless you are doing something like a DHCP scope migration. You might be thinking of publically routeable vs private addresses spaces but your question did not detail that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition you would need static routes on your WAN device pointing to your switch, you only need the default route on your HP switch.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-08-17T22:34:09.450" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2865" PostTypeId="2" ParentId="2858" CreationDate="2013-08-18T03:40:28.847" Score="1" Body="&lt;p&gt;Ok then just put both subnet gateways under the same interface&#xA;vlan 20 name lans&#xA;ip address 192.168.20.1 255.255.255.0&#xA;ip address 199.199.20.1 255.255.255.0&#xA;you can communicate between the two subnets but do not need to set up trunking to servers or divide ports between vlans&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-08-18T03:40:28.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2866" PostTypeId="1" AcceptedAnswerId="2906" CreationDate="2013-08-18T05:17:45.973" Score="9" ViewCount="9329" Body="&lt;p&gt;Does having &lt;code&gt;switchport protected&lt;/code&gt; configured on an interface prevent unicast flooding for a MAC address the switch hasn't learned?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The information that I'm seeing conflicts -- the &lt;a href=&quot;http://en.wikipedia.org/wiki/Unicast_flood#Remedies&quot; rel=&quot;noreferrer&quot;&gt;wikipedia page&lt;/a&gt; on unicast flooding cites protected mode as a mechanism to block flooding, while Cisco's documentation says that &lt;code&gt;switchport protected&lt;/code&gt; doesn't matter, and that &lt;code&gt;switchport block unicast&lt;/code&gt; would still be needed to prevent flooding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I recently ran into an issue where on a 2950G running some relatively ancient 12.1(22) code, unicast flooding seemed to be completely broken for a protected port -- the aging time on the switch was 5 minutes, while the router's ARP timeout was 30 minutes, and the one TCP connection utilizing this interface had a tendency to sit dormant for 10 minutes at a time - and be non-functional when waking up after 10 minutes in this case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Captures run on the host showed no unicast flooding when it was expected, and increasing the MAC aging timer on the switch to match ARP completely resolved the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this behavior undefined or inconsistent in older IOS versions, or is this just a bug in this old code?&lt;/p&gt;&#xA;" OwnerUserId="221" LastEditorUserId="775" LastEditDate="2013-08-21T10:53:04.847" LastActivityDate="2013-08-22T09:28:41.340" Title="Is 'switchport protected' supposed to block unicast flooding?" Tags="|cisco|cisco-catalyst|ethernet|cisco-ios-12|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2870" PostTypeId="2" ParentId="2192" CreationDate="2013-08-18T18:03:18.757" Score="0" Body="&lt;p&gt;The idea if not use ECMP if HSRP is in use may be ok for SERVERS where ingress traffic may be higher than egress traffic, in a PC situation IN GENERAL ingress traffic from the WAN (responses) is higher than egress traffic (ingress). We like most people just set the ARP timers. you can mess with CAM timers BUT if you have say an MDF with the layer 3 switch and an IDF with 2 collection switches and say 5 access switches, it is a LOT easer to configure on the L3 SVI than doing all access switches.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-08-18T18:03:18.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2871" PostTypeId="1" AcceptedAnswerId="2873" CreationDate="2013-08-18T19:41:45.957" Score="19" ViewCount="27098" Body="&lt;p&gt;I am studying for CCNA and on Wendell Odom's book is said that(regarding autonegotiation):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When autonegotiation fails on one node, to choose (half/full-duplex) we must use the rule:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you have a 10/100 Mb/s interface -&gt; use half-duplex&lt;/li&gt;&#xA;&lt;li&gt;If you have a 1000 Mb/s interface-&gt; use full-duplex&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Why is that?&lt;/p&gt;&#xA;" OwnerUserId="2284" LastEditorUserId="775" LastEditDate="2013-08-19T09:23:38.850" LastActivityDate="2013-08-19T20:40:04.280" Title="Ethernet autonegotiation differences between (10M | 100M | 1G) Ethernet" Tags="|switch|ethernet|duplex|autonegotiation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2872" PostTypeId="2" ParentId="2871" CreationDate="2013-08-18T20:26:09.327" Score="12" Body="&lt;p&gt;&lt;em&gt;&lt;strong&gt;When autonegotiation fails on one node, to choose (half/full-duplex) we must use the rule:&#xA;-&gt;If you have a 10/100 Mb/s interface -&gt; use half-duplex&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the event that a hub is connected, a default of full duplex would cause too many collisions. A default of half duplex ensures communications continue regardless of the connected device (Switch or hub)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;-&gt;If you have a 1000 Mb/s interface-&gt; use full-duplex&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 1000Base-T standard was designed to require auto-negotiation, as well as a switched layer 2 domain (no hubs). This is because all four pairs need to communicate in full duplex at 250Mbps. As such, it is assumed that no hubs exist on the connection for the purpose of bidirectional communication.&lt;/p&gt;&#xA;" OwnerUserId="2403" LastActivityDate="2013-08-18T20:26:09.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2873" PostTypeId="2" ParentId="2871" CreationDate="2013-08-18T22:21:10.407" Score="20" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;When autonegotiation fails on one node, to choose (half/full-duplex) we must use the rule:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;If you have a 10/100 Mb/s interface -&gt; use half-duplex&lt;/li&gt;&#xA;  &lt;li&gt;If you have a 1000 Mb/s interface-&gt; use full-duplex&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Why is that?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Summary&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In brief, &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.3#Communication_Standards&quot; rel=&quot;noreferrer&quot;&gt;ethernet has been around since the 1980s&lt;/a&gt;... as a result&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Old ethernet NICs only supported half duplex operation with no auto-negotiation.  If you have auto-negotiation enabled in this situation, you must support all old NICs (which means falling back to half-duplex operation).  Another answer mentions hubs, which also fall into this category.&lt;/li&gt;&#xA;&lt;li&gt;Auto-negotiation is required by the 1GE spec; therefore, there is no point in forcing failure to half-duplex at 1GE speeds.  1GE auto-negotiation announces whether it is half / full-duplex capable.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These days, you should always try to use auto-negotiation unless you know the other port doesn't support it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The table below may help explain the twisted history around auto-negotiation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+------------+------+---------------+--------------+-----------------------+&#xA;| Standard   | Year | Speeds        | Media        | Auto-neg Status       |&#xA;+------------+------+---------------+--------------+-----------------------+&#xA;| 802.3i     | 1990 | 10M           | Twisted Pair | No auto-negotiation   |&#xA;+------------+------+---------------+--------------+-----------------------+&#xA;| 802.3u     | 1995 | 10/100M       | Twisted Pair | Optional, not trusted |&#xA;+------------+------+---------------+--------------+-----------------------+&#xA;| 802.3-1998 | 1998 | 100/100M      | Twisted Pair | Optional              |&#xA;+------------+------+---------------+--------------+-----------------------+&#xA;| 802.3ab    | 1999 | 10/100/1000M  | Twisted Pair | Optional @ 10/100M    |&#xA;|            |      |               |              | Required @ 1Gbps      |&#xA;+------------+------+---------------+--------------+-----------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;&lt;em&gt;Impact of Duplex Mismatches:&lt;/em&gt;&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Regarding Cisco's practice of falling back to half-duplex when auto-negotiation fails... One could rightfully object that falling back to half-duplex if auto-negotiation fails introduces a misconfiguration; however, the misconfiguration is tolerable.  The worst that can happen in this situation is you get manually hard coded full-duplex on one side of a FastEthernet link, and auto-negotiation failing to half duplex on the other side of the link... the mismatched duplex  causes link-level errors (collisions and runts), but you still can communicate pretty well, as long as you arent trying to exceed about one third of the link speed (i.e about 35Mbps on FastEthernet).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Potentially interesting details:&lt;/h2&gt;&#xA;&#xA;&lt;h3&gt;&lt;em&gt;Original FastEthernet Auto-negotiation == bad juju&lt;/em&gt;&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;People had such bad experiences with early auto-negotiation in IEEE 802.3u (FastEthernet) that conventional wisdom was to disable auto-negotiation, and lock speed / duplex manually on all ethernet copper ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This practice of disabling auto-negotiation on all copper ports became so entrenched in old-timer's minds that it's still not unusual to find locked speed / duplex on Cat5e / Cat6 today, even though industry auto-negotiation implementations have reliable for over a decade.  FYI, some ISPs still force 100M / full on their customer circuits under the misguided assumption that manual speed / duplex is more reliable.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;&lt;em&gt;Vendor support for advertising specific 1GE duplex modes&lt;/em&gt;&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Auto-negotiation is required as part of IEEE 802.3ab (Gigabit Ethernet over copper); however, you still find some vendor implementations that permit you to hard-code GigE speed / duplex... I have seen some JunOS switches that permit full-duplex configuration on 1GE switch ports.  Does this mean that the JunOS switch disables auto-negotiation on that 1GE port?  No, this effectively means JunOS only advertises the configured speed / duplex during auto-negotiation.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;&lt;em&gt;Update for @ytti's question: Ethernet line conditioning&lt;/em&gt;&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;1GE auto-negotiation includes (quoting 802.3-2012, Clause 40.5.1):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Negotiation for 1000Base-T half / full duplex, or &lt;a href=&quot;https://stackoverflow.com/a/7843785/667301&quot;&gt;falling back to lower speeds, as required&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Determining MASTER-SLAVE relationship between the PHYs&lt;/li&gt;&#xA;&lt;li&gt;Negotiating EEE capabilities&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Auto-negotiation is required by 802.3ab at 1GE, because GigabitEthernet auto-negotiation includes special line conditioning; this conditioning happens during the TRAINING mode of the MASTER/SLAVE PHY startup; the TRAINING mode ensures the line is stable enough to push 1000Mbps over Cat5e runs up to 100m long.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2013-08-19T20:40:04.280" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="2874" PostTypeId="1" AcceptedAnswerId="2969" CreationDate="2013-08-19T00:09:24.153" Score="8" ViewCount="861" Body="&lt;p&gt;For &lt;strong&gt;Remote Access&lt;/strong&gt; (RA) and &lt;strong&gt;LAN-to-LAN&lt;/strong&gt; (L2L) &lt;strong&gt;VPN&lt;/strong&gt;, I currently operate a pair of Cisco VPN 3005 Concentrators tied to Internet edge routers on the outside and the inside tied to an internal pair of PIX 535s on what is the firewall outside interface before being allowed to pass through to our real internal networks.  Both the VPN 3005s and the PIX 535s are being replaced with the ASA-5545X platform.  These firewalls are not for our primary Internet traffic, only VPN, and they may also serve as an internal firewalls for traffic going into the data center across private lines. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;With the internal firewall ACLs being combined in a single firewall that serves VPN traffic and potentially other private line traffic, for security boundaries and to eliminate any potential routing issues, should the inside interface of the VPN-firewall (5545) stay in a separate subnet from the main Internet firewall or does it really not matter?&lt;/strong&gt;  OSPF is currently running on the Internet firewall (w/default-originate) and the VPN 3005.  As this data center is our primary DC for web traffic -- our bread and butter -- I must eliminate any potential issues with the placement of the VPN firewalls that could interfere with this even in the slightest way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;**Should the inside interface of the 5545 land first on the L2 edge switches and then trunk to the agg switches for better security or just have the inside drop straight into the Agg layer, also considering that private line traffic may come through yet another interface on the 5545 in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only the relevant parts of the L3 connectivity are shown below with the ASA-5545X* that's in question.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;                     Internet&#xA;                        |&#xA;               Edge rtr + Edge rtr&#xA;                        |&#xA;5545* (VPN/Internal fw) + 5540 (Internet fw for traffic in/out DC)&#xA;                        |&#xA;                  Agg-1 + Agg-2&#xA;                        |&#xA;                       etc&#xA;&#xA;A pair of L2 switches connect all the edge devices before reaching the Agg switches.&#xA;Public IP space outside of firewalls, private on inside.&#xA;(Each firewall is part of a separate failover pair not shown; the 5545 and 5540&#xA;have no interaction.)&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Looking for answers/comments that could be considered best practice or what you've found works best in a typical enterprise network.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-08-19T06:46:02.377" LastActivityDate="2013-08-26T09:15:05.420" Title="Placement of firewall for VPN RA and L2L tunnels" Tags="|cisco|security|cisco-asa|vpn|switching|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2876" PostTypeId="1" AcceptedAnswerId="2877" CreationDate="2013-08-19T11:17:31.530" Score="12" ViewCount="15253" Body="&lt;p&gt;Let's say I am on a network 192.168.1.X and I use the below ping commands.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;ping 255.255.255.255&lt;/li&gt;&#xA;&lt;li&gt;ping 192.168.1.255&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Why we are calling 1st one as limited and 2nd one as directed ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In what category does the below will come ?&#xA;ping 10.X.X.X &lt;/p&gt;&#xA;&#xA;&lt;p&gt;X is denoting the feasible value in an IP.&lt;/p&gt;&#xA;" OwnerUserId="2377" LastActivityDate="2013-08-19T12:39:47.820" Title="Directed and Limited Broadcast confusion" Tags="|ipv4|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2877" PostTypeId="2" ParentId="2876" CreationDate="2013-08-19T11:26:42.867" Score="9" Body="&lt;p&gt;The first one reaches the NICs in the network segment, routers don't forward it, so it's limited. The second will reach all the hosts in the network if it's allowed by a router, so it's directed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're talking about pinging 10.255.255.255, it's directed.&lt;/p&gt;&#xA;" OwnerUserId="2405" LastActivityDate="2013-08-19T11:26:42.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2878" PostTypeId="1" CreationDate="2013-08-19T11:29:47.433" Score="6" ViewCount="10887" Body="&lt;p&gt;Is it possible for a specific interface to only allow access to specific dhcp pools? This is assuming a cisco router(IOS) with dhcp server capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. For some router, hosts on fa0/0 can obtain an address from pool1 (192.168.0.0/29) via dhcp, hosts on interface fa0/1 can obtain an address from pool2 (172.16.0.0/29) via dhcp.&lt;/p&gt;&#xA;" OwnerUserId="2406" LastActivityDate="2013-08-19T11:54:00.420" Title="Specific DHCP pool on specific interface - IOS" Tags="|cisco|cisco-ios|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2879" PostTypeId="2" ParentId="2878" CreationDate="2013-08-19T11:54:00.420" Score="9" Body="&lt;p&gt;If you configure an IP address on an interface the router will use the corresponding DHCP pool to answer DHCP requests. In your case you would do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Fa0/0&#xA; ip address 192.168.0.1 255.255.255.248&#xA;!&#xA;interface Fa0/1&#xA; ip address 172.16.0.1 255.255.255.248&#xA;!&#xA;ip dhcp pool 0&#xA; network 192.168.0.0 255.255.255.248&#xA; ...&#xA;!&#xA;ip dhcp pool 1&#xA; network 172.16.0.0 255.255.255.248&#xA; ...&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The interface IP on Fa0/0 is inside the network for DHCP pool 0 and the IP on Fa0/1 is inside pool 1. So hosts on Fa0/0 will get addresses from pool 0 and hosts on Fa0/1 will get addresses from pool 1.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-08-19T11:54:00.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2880" PostTypeId="2" ParentId="2602" CreationDate="2013-08-19T11:58:28.937" Score="0" Body="&lt;p&gt;Issue resolved. Turned out to be a bad module on the SX...can't believe all 12 sfp ports didn't work! Swapped to different one and everything works fine now. Thanks for the suggestions.&lt;/p&gt;&#xA;" OwnerUserId="864" LastActivityDate="2013-08-19T11:58:28.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2881" PostTypeId="2" ParentId="2876" CreationDate="2013-08-19T12:18:58.260" Score="7" Body="&lt;p&gt;Example may help to illuminate the subject:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A - B - C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A-B is 10.10.10.0/24&lt;br&gt;&#xA;B-C is 10.10.20.0/23&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If 10.10.10.42 wants to do say WOL (Wake-On-Lan) for 10.10.21.42, 10.10.10.42 on subnet A-B can send packet to directed broadcast 10.10.21.255, and B is happy to to forward the packet towards C, so each host in C LAN will receive it, including 10.10.21.42 machine which can then power itself on.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.10.10.42 couldn't unicast it to 10.10.21.42, because the machine is not on and would not be visible in ARP table, so it would be just dropped after unsuccessful 'ARP WHO HAS' query.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If A tries to send it to 255.255.255.255, B will not forward it to C. 255.255.255.255 is only special case 'limited broadcast' address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example 10.10.20.255 might not be a broadcast at all. So we cannot conclude if address is directed broadcast address without knowing the mask.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="775" LastEditDate="2013-08-19T12:39:47.820" LastActivityDate="2013-08-19T12:39:47.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2882" PostTypeId="1" AcceptedAnswerId="2883" CreationDate="2013-08-19T09:01:44.740" Score="5" ViewCount="4467" Body="&lt;p&gt;We have been using 2 Cisco 2960-S 48 Port switches which were connected together using a regular Cat5e cable and everything was working fine, however we have purchased a 3rd switch of the same model and need to connect it to the other switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the best way to connect all 3 switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches will be in a ring like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          switch 1&#xA;         /        \&#xA;        /          \&#xA;switch 2------------switch 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On another site on an old thread I found, someone said this would cause a loop and cause problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone shed any light on if this config would work or cause any problems?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help greatly appreciated!&lt;/p&gt;&#xA;" OwnerDisplayName="Jon Davies" LastEditorUserId="44" LastEditDate="2013-08-20T00:20:16.317" LastActivityDate="2013-08-20T12:54:17.500" Title="Connect 3 Cisco switches via ethernet ports?" Tags="|cisco|spanning-tree|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2883" PostTypeId="2" ParentId="2882" CreationDate="2013-08-19T10:27:50.220" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;We have been using 2 Cisco 2960-S 48 Port switches which were connected together using a regular Cat5e cable and everything was working fine, however we have purchased a 3rd switch of the same model and need to connect it to the other switches.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;What would be the best way to connect all 3 switches?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Generally, you connect all three switches in a &quot;triangle&quot;.  There is no problem with this configuration as long as you have some version of spanning-tree running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what state your network is in right now, so I'm assuming you might not have spanning-tree running, and you have not connected the third switch.  Generic steps to introduce the new switch:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Make sure the third switch is disconnected. Configure &lt;code&gt;spanning-tree mode rapid-pvst&lt;/code&gt; on all switches.&lt;/li&gt;&#xA;&lt;li&gt;Configure &lt;code&gt;spanning-tree vlan 1-4094 priority 4096&lt;/code&gt; on the switch closest to your Internet / WAN connection&lt;/li&gt;&#xA;&lt;li&gt;Configure &lt;code&gt;spanning-tree vlan 1-4094 priority 8192&lt;/code&gt; on the other (running) switch&lt;/li&gt;&#xA;&lt;li&gt;Configure &lt;code&gt;spanning-tree portfast disable&lt;/code&gt; on all ports connecting to the other switches.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I gave you a very basic recipe to make this work... depending on the bandwidth needs of the clients, you might want to bundle multiple links between these switches with LACP or EtherChannel.&lt;/p&gt;&#xA;" OwnerUserId="775" OwnerDisplayName="Mike Pennington" LastActivityDate="2013-08-19T10:27:50.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2888" PostTypeId="1" AcceptedAnswerId="2902" CreationDate="2013-08-20T16:49:13.217" Score="10" ViewCount="3923" Body="&lt;p&gt;Will any issues occur if I have a topology involving 3 subnets and two OSPF areas where one subnet is in AREA 0 and the other two subnets are both in AREA 1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[area 1, subnet 1]---[ABR #1]---[area 0, subnet 2]---[ABR #2]---[area 1, subnet 3]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1453" LastEditorUserId="1453" LastEditDate="2013-08-21T21:29:43.363" LastActivityDate="2014-03-27T17:41:00.183" Title="3 subnets, 2 OSPF areas - Will This Work?" Tags="|routing|ospf|redundancy|subnet|route-summarization|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2889" PostTypeId="2" ParentId="2888" CreationDate="2013-08-20T17:15:54.217" Score="8" Body="&lt;p&gt;This will work but it would be a poor design choice (IMHO) unless you have a specific reason for doing so.&lt;/p&gt;&#xA;&lt;p&gt;See this discussion:&#xA;&lt;a href=&quot;https://supportforums.cisco.com/thread/21150&quot; rel=&quot;nofollow noreferrer&quot;&gt;Duplicate OSPF area IDs&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://bestpractices.wikia.com/wiki/OSPF&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSPF Best Practicies&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cciezone.com/?p=67&quot; rel=&quot;nofollow noreferrer&quot;&gt;Recommended OSPF configuration best-practices (using the SSM example)&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ipspace.net/2008/10/ospf-area-configuration-best-practices.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSPF area configuration best practices&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update #1&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;For the sake of completeness, I mocked up this situation using dyanmips.  The platform was Cisco 3725s running IOS ver 12.4(15)T13.&lt;/p&gt;&#xA;&lt;p&gt;R1 (lo0 1.1.1.1, f0/0 10.12.0.1) &amp;lt;-&amp;gt; R2 (lo0 2.2.2.2, f0/0 10.12.0.2, f0/1 10.23.0.2) &amp;lt;-&amp;gt; R3 (lo0 3.3.3.3, f0/0 10.23.0.3).&lt;/p&gt;&#xA;&lt;p&gt;Loopback interfaces of R1 &amp;amp; R3 were placed in area 1, all other interfaces are in area 0.&lt;/p&gt;&#xA;&lt;p&gt;Pings were then done (e.g. R3#ping ip 1.1.1.1 source 3.3.3.3) between the R1 &amp;amp; R3 boxes confirming connectivity.&lt;/p&gt;&#xA;&lt;p&gt;In my opinion I would still shy away from this architecture.  Mike&#xA;makes perfectly valid points (and testing confirms) that this works.  OSPF areas are useful tools to control route propagation and reduce the size of the router's link state database - but they also function (to me at least) to document that I intend &amp;quot;this&amp;quot; part of the network to be separate architecturally from &amp;quot;that&amp;quot; part of the network for some reason.&lt;/p&gt;&#xA;&lt;p&gt;If in the future you decide to connect R1 to R3 and are using the same area # then you have lucked out and backed into saving yourself a lot issues with changing area numbers or having to use virtual links. So maybe this is an argument in favor of using two area IDs (0 &amp;amp; 1) everywhere - but then again you did not originally intend R1 and R3 to be able to communicate directly. &lt;em&gt;shrug&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is a matter of style and personal preference - there appears to be no technical reason why this shouldn't work and I never intended to represent otherwise.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update #2&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Adding non-ascii art diagram of connections - drawn linearly and as a triangle.  What is intended between R1 &amp;amp; R3? Is area1 supposed to be contiguous or separate?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MLZXd.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;" OwnerUserId="266" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-08-22T13:19:49.113" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="2892" PostTypeId="1" AcceptedAnswerId="2913" CreationDate="2013-08-20T21:49:42.993" Score="12" ViewCount="646" Body="&lt;p&gt;Consider the following output from &lt;code&gt;show interface&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface GigabitEthernet0/1 &quot;inside&quot;, is up, line protocol is up&#xA;  Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec&#xA;    Full-Duplex(Full-duplex), 1000 Mbps(1000 Mbps)&#xA;    Input flow control is unsupported, output flow control is off&#xA;    MAC address 5057.aaaa.25d7, MTU 1500&#xA;    IP address 10.0.0.7, subnet mask 255.255.255.0&#xA;    2708954646 packets input, 1614638330819 bytes, 0 no buffer&#xA;    Received 786860 broadcasts, 0 runts, 0 giants&#xA;    7262 input errors, 7262 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;    0 pause input, 0 resume input&#xA;    0 L2 decode drops&#xA;    2622997029 packets output, 1295347863682 bytes, 6396 underruns&#xA;    0 pause output, 0 resume output&#xA;    0 output errors, 0 collisions, 90 interface resets&#xA;    0 late collisions, 0 deferred&#xA;    0 input reset drops, 7908 output reset drops, 31 tx hangs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The last line says &lt;code&gt;31 tx hangs&lt;/code&gt;. What does this mean?&lt;/p&gt;&#xA;" OwnerUserId="949" LastActivityDate="2013-08-21T21:07:16.683" Title="Cisco ASA: What is the &quot;tx hangs&quot; counter on show interface?" Tags="|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2893" PostTypeId="1" CreationDate="2013-08-20T23:55:47.273" Score="9" ViewCount="10396" Body="&lt;p&gt;I am trying to understand how Cisco interfaces are named, so I am reading the document &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/routers/ps282/products_tech_note09186a008035b051.shtml&quot;&gt;Interface and Line Numbers in Cisco 1800, 2800 and 3800 Series Routers&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am having some issues understanding the principles mainly because I don't understand the difference between a slot and a sub-slot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain this to me?&lt;/p&gt;&#xA;" OwnerUserId="2284" LastEditorUserId="76" LastEditDate="2013-08-21T12:41:15.513" LastActivityDate="2013-08-22T13:17:56.927" Title="slot vs sub-slot?" Tags="|cisco|router|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2894" PostTypeId="2" ParentId="2888" CreationDate="2013-08-21T00:13:59.860" Score="1" Body="&lt;p&gt;Well you normally need to use virtual links to talk to area 0 via a different non area 0 area or you connect 2 parts of area 0 through a non zero area. So virtual links do not apply. You can have a non contigious area if its not area 0, but as hinted above, not really a good idea. That being said you proposed topology will work without virtual links.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-08-21T00:13:59.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2897" PostTypeId="2" ParentId="2792" CreationDate="2013-08-21T07:35:51.770" Score="1" Body="&lt;p&gt;If your DD-WRT devices are setup as AP - WDS and STATION - WDS, then they should act as an ethernet cable... forwarding all macs they see, and not forcing traffic that passes through them to inherit the interface MAC of the wireless bridges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WDS is not cross-vendor, keep that in mind. There was never any official standard for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can imagine that STP would &quot;break&quot; because it's only seeing a repeating MAC (wireless bridge), but I can't confirm this.&lt;/p&gt;&#xA;" OwnerUserId="2422" LastActivityDate="2013-08-21T07:35:51.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2900" PostTypeId="1" AcceptedAnswerId="2904" CreationDate="2013-08-21T07:55:46.070" Score="33" ViewCount="89595" Body="&lt;p&gt;I would like to get ARP tables from a switch to a syslog-ng server that has been set up on Ubuntu Server 12.04 LTS. I have read about SNMP and I know the server will act as a manager and the switch as an agent. I have details as to where the MIB is contained, and I must use the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpwalk -v2c -c &amp;lt;community&amp;gt; &amp;lt;SwitchIP&amp;gt; .1.3.6.1.2.1.17.4.3.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want the resulting arp tables to be directed to a  my server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that I don't know where exactly to run the command, or save the output to a file.&lt;/p&gt;&#xA;" OwnerUserId="2421" LastEditorUserId="20757" LastEditDate="2017-05-11T21:48:41.593" LastActivityDate="2017-09-16T19:19:49.760" Title="Using SNMP to retrieve the ARP and mac-address tables from a switch" Tags="|cisco|switch|ethernet|vlan|snmp|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2901" PostTypeId="2" ParentId="2792" CreationDate="2013-08-21T07:55:57.787" Score="1" Body="&lt;p&gt;I have dealt with Ethernet-to-WiFi bridges that rewrite MAC addresses (MOXAs, in my case), and I can confirm absolutely that it will wreck your STP, and ARP/ND will get broken if you end up in a scenario where you have multiple paths (e.g., if you use the wireless as a backup to a hard-wired Ethernet connection).  You can probably get away with it if you'll only ever be using the wireless connection, but it's essentially the same scenario as NAT-PT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check to make sure that the AP really is doing this; the ARP tables on hosts connected to the switches should be able to tell you.  DD-WRT is based on Linux, and I haven't seen Linux do &quot;MAC NATting&quot; like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How this fails:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try connecting a host to a switch that has such a wireless bridge connected to one port, and create a mirrored replica on the other side, but don't wire the switches together:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HostA---SwA         SwB---HostB&#xA;         |           |&#xA;        WiFi--------WiFi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should be able to make connections and ping back and forth between HostA and HostB. Check the ARP tables, and observe that the MAC address is actually that of the other AP. Now connect a cable between the switches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HostA---SwA---------SwB---HostB&#xA;         |           |&#xA;        WiFi--------WiFi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your connections will stay up, since the network still knows how to send the frames the &quot;long way around&quot; through the WiFi bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that bridge goes down, however, and you're left with just the hardwired network (that's not rewriting MACs), your connections fall over until the ARP tables age out and the hosts re-request MACs.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-08-21T07:55:57.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2902" PostTypeId="2" ParentId="2888" CreationDate="2013-08-21T08:20:04.360" Score="7" Body="&lt;p&gt;Regarding the question of splitting area 1 across the backbone (area 0):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;[area 1, subnet 1]---[ABR #1]---[area 0, subnet 2]---[ABR #2]---[area 1, subnet 3]&lt;/p&gt;&#xA;&lt;p&gt;[area 1, subnet 1]---[Router #1]---[area 0, subnet 2, end device #1]---[Router #2]---[area 0, subnet 2, end device #2]---[Router #3]---[area 1, subnet 3]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Short answer: There is no problem with your proposal...&lt;/p&gt;&#xA;&lt;p&gt;Long answer:&lt;/p&gt;&#xA;&lt;p&gt;Even Peter's answer, which argues that reusing area numbers is bad design, offers no proof that this is a bad design; if you examine the hyperlinks he used, there is no explanation of undesirable consequences for this design.  Furthermore, the argument that you might have problems connecting R1 and R3 falls short, since the R1 to R3 link could legitimately be configured in either Area 0 or Area 1, depending on what traffic you want to transit it.  The difficulties he mentions are a false dilemma.&lt;/p&gt;&#xA;&lt;p&gt;In &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#page-38&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328, Section 3.7&lt;/a&gt; OSPF explicitly allows you to use discontiguous non-backbone areas (which are called &amp;quot;area partitions&amp;quot;, below):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    OSPF does not actively attempt to repair area partitions.  When&#xA;    an area becomes partitioned, each component simply becomes a&#xA;    separate area.  The backbone then performs routing between the&#xA;    new areas.  Some destinations reachable via intra-area routing&#xA;    before the partition will now require inter-area routing.&#xA;    ...  Also, the backbone itself must not partition.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Thus whether you use the proposed discontiguous Area 1 is just a matter of taste... some people find it illogical to use the configuration in your diagram; these people might suggest that you keep OSPF area numbers together... so you'd have to change [area 1, subnet 3] on Router #3 to [area 3, subnet 3].  Other people see no problem with reusing Area 1, since OSPF area numbers are only locally significant to the router originating OSPF hellos.&lt;/p&gt;&#xA;&lt;p&gt;Either way, we should admit that OSPF is a remarkably flexible protocol; regardless of choosing one side or another in this debate.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-08-21T18:54:41.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2903" PostTypeId="2" ParentId="2893" CreationDate="2013-08-21T09:15:57.280" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In order to overcome this limitation, Cisco 1800, Cisco 2800, and&#xA;  Cisco3800 series platforms now have a three-tiered interface numbering&#xA;  format (slot/subslot/port) for interfaces on WIC slots only.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I understand it like that: you can insert your WIC in the slot, and on the card itself there are subslots with ports. Juniper has similar naming convention if I remember correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure about this one though.&lt;/p&gt;&#xA;" OwnerUserId="2405" LastActivityDate="2013-08-21T09:15:57.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2904" PostTypeId="2" ParentId="2900" CreationDate="2013-08-21T09:36:13.670" Score="39" Body="&lt;p&gt;There seems to be a little confusion... you are asking about ARP tables, and you're using OID &lt;code&gt;.1.3.6.1.2.1.17.4.3.1.2&lt;/code&gt;; however, that OID actually is for the mac-address table in the switch.&lt;/p&gt;&#xA;&lt;p&gt;I am assuming you know how to login to your Ubuntu server, and that &lt;code&gt;NET-SNMP&lt;/code&gt; is installed... please let me know if you need pointers for doing this (see &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2990/translating-snmpwalk-output-into-human-readable-format/775/&quot;&gt;this question for hints about loading MIBs in linux&lt;/a&gt;).  Some of my examples assume you have the MIBs loaded on your server... you just need to remove the &lt;code&gt;-m &amp;lt;mib-name&amp;gt;&lt;/code&gt; option in the commands if you don't have the MIBs loaded locally.&lt;/p&gt;&#xA;&lt;p&gt;I apologize in advance for the length of this answer... I wish polling with SNMP wasn't as complicated...&lt;/p&gt;&#xA;&lt;h3&gt;Polling the mac-address table:&lt;/h3&gt;&#xA;&lt;p&gt;If you really want the mac-address table from the switch, then remember you have to change the community string you poll with... it should be in the form of &lt;code&gt;&amp;lt;commity@vlan&amp;gt;&lt;/code&gt;... each vlan you poll needs a different community.&lt;/p&gt;&#xA;&lt;p&gt;In my example below, the switch at 172.16.1.210 is configured with &lt;code&gt;snmp-server community public ro&lt;/code&gt;, and I'm polling the mac-address table in vlan-10 with &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=dot1dTpFdbPort&quot; rel=&quot;noreferrer&quot;&gt;dot1dTpFdbPort&lt;/a&gt; from &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;step=2&amp;amp;mibName=BRIDGE-MIB&quot; rel=&quot;noreferrer&quot;&gt;BRIDGE-MIB&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public@10 -OXsq 172.16.1.210 \&#xA;  .1.3.6.1.2.1.17.4.3.1.2&#xA;dot1dTpFdbPort[0:6:53:fe:39:e0] 52&#xA;dot1dTpFdbPort[0:1d:a1:cd:53:46] 52&#xA;dot1dTpFdbPort[0:30:1b:bc:a7:d7] 52&#xA;dot1dTpFdbPort[0:80:c8:0:0:0] 52&#xA;dot1dTpFdbPort[38:ea:a7:6d:2e:8e] 52&#xA;dot1dTpFdbPort[80:ee:73:2f:b:40] 52&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In the output above, 52 is the value of &lt;code&gt;dot1dBasePort&lt;/code&gt;, which is a number the MIB uses to index the dot1dTp table.  To translate that into a normal interface name, you have to map that to an ifName... &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;step=2&amp;amp;mibName=BRIDGE-MIB&quot; rel=&quot;noreferrer&quot;&gt;BRIDGE-MIB&lt;/a&gt; does that with &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=dot1dBasePortIfIndex&quot; rel=&quot;noreferrer&quot;&gt;dot1dBasePortIfIndex&lt;/a&gt;...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public@10 -m BRIDGE-MIB 172.16.1.210 \&#xA;  .1.3.6.1.2.1.17.1.4.1.2&#xA;BRIDGE-MIB::dot1dBasePortIfIndex.52 = INTEGER: 10048&#xA;[mpenning@tsunami ~]$&#xA;[mpenning@tsunami ~]$ snmpget -v 2c -c public 172.16.1.210 ifName.10048&#xA;IF-MIB::ifName.10048 = STRING: Fa0/48&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Thus we know that all the mac-addresses on this switch were learned through FastEthernet 0/48 in vlan-10.&lt;/p&gt;&#xA;&lt;h3&gt;Polling the active Vlans:&lt;/h3&gt;&#xA;&lt;p&gt;If you're not sure which vlans to poll on a switch, you can get that information from &lt;code&gt;.1.3.6.1.4.1.9.9.46.1.3.1.1.2&lt;/code&gt;, which is &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=vtpVlanState&quot; rel=&quot;noreferrer&quot;&gt;vtpVlanState&lt;/a&gt; in the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;step=2&amp;amp;mibName=CISCO-VTP-MIB&quot; rel=&quot;noreferrer&quot;&gt;CISCO-VTP-MIB&lt;/a&gt;...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public -OXsq -m CISCO-VTP-MIB 172.16.1.210 \&#xA;   .1.3.6.1.4.1.9.9.46.1.3.1.1.2&#xA;vtpVlanState[1][1] operational&#xA;vtpVlanState[1][10] operational&#xA;vtpVlanState[1][1002] operational&#xA;vtpVlanState[1][1003] operational&#xA;vtpVlanState[1][1004] operational&#xA;vtpVlanState[1][1005] operational&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Keep in mind that Vlans 1002-1005 are &lt;a href=&quot;https://supportforums.cisco.com/thread/30589&quot; rel=&quot;noreferrer&quot;&gt;internal Cisco Vlans&lt;/a&gt; that you should not poll.&lt;/p&gt;&#xA;&lt;h3&gt;Polling the ARP table&lt;/h3&gt;&#xA;&lt;p&gt;If you really want the ARP table from the switch, then you need to poll &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=atphysaddress&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot; rel=&quot;noreferrer&quot;&gt;atPhysAddress&lt;/a&gt;...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public -OXsq  172.16.1.210 \&#xA;  .1.3.6.1.2.1.3.1.1.2&#xA;atPhysAddress[10][1.172.16.1.5] &amp;quot;80 EE 73 2F 0B 40 &amp;quot;&#xA;atPhysAddress[10][1.172.16.1.25] &amp;quot;38 EA A7 6D 2E 8E &amp;quot;&#xA;atPhysAddress[10][1.172.16.1.32] &amp;quot;BC 51 FE 50 16 F8 &amp;quot;&#xA;atPhysAddress[10][1.172.16.1.200] &amp;quot;00 06 53 FE 39 E0 &amp;quot;&#xA;atPhysAddress[10][1.172.16.1.210] &amp;quot;00 18 BA 51 5B 41 &amp;quot;&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;Saving command output to a file&lt;/h3&gt;&#xA;&lt;p&gt;We're delving into areas that go outside the normal scope of this site, but to save the ARP table above to a file in &lt;code&gt;/tmp/S01_ARP.txt&lt;/code&gt;, the you'd add &lt;code&gt;&amp;gt; /tmp/S01_ARP.txt&lt;/code&gt; to the end of the &lt;code&gt;snmpbulkwalk&lt;/code&gt; above...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public -OXsq  172.16.1.210 \&#xA;      .1.3.6.1.2.1.3.1.1.2 &amp;gt; /tmp/S01_ARP.txt&#xA;[mpenning@tsunami ~]$ cat /tmp/S01_ARP.txt&#xA;atPhysAddress[10][1.172.16.1.5] &amp;quot;80 EE 73 2F 0B 40 &amp;quot;&#xA;atPhysAddress[10][1.172.16.1.25] &amp;quot;38 EA A7 6D 2E 8E &amp;quot;&#xA;atPhysAddress[10][1.172.16.1.32] &amp;quot;BC 51 FE 50 16 F8 &amp;quot;&#xA;atPhysAddress[10][1.172.16.1.200] &amp;quot;00 06 53 FE 39 E0 &amp;quot;&#xA;atPhysAddress[10][1.172.16.1.210] &amp;quot;00 18 BA 51 5B 41 &amp;quot;&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you see above, you can use &lt;code&gt;cat&lt;/code&gt; in linux to get all output from a text file.  NOTE: Some linux distributions (ahem... CentOS) clean out the &lt;code&gt;/tmp&lt;/code&gt; directory on a monthly basis.  You should use your &lt;code&gt;HOME&lt;/code&gt; directory in linux to store the file.  I don't remember Ubuntu cleaning out &lt;code&gt;/tmp&lt;/code&gt;, but to be safe I'd avoid storing things there.&lt;/p&gt;&#xA;&lt;h3&gt;Miscellaneous notes about SNMP...&lt;/h3&gt;&#xA;&lt;p&gt;If you haven't loaded all Cisco's MIBs on your Ubuntu machine, then you should avoid using the &lt;code&gt;-m &amp;lt;mib-name&amp;gt;&lt;/code&gt; flags in the &lt;code&gt;snmpbulkwalk&lt;/code&gt; commands.  Loading MIBs allows you to poll with an OID name, instead of the long dotted number...&lt;/p&gt;&#xA;&lt;hr&gt;&#xA;&lt;h3&gt;Reference information:&lt;/h3&gt;&#xA;&lt;p&gt;I am including some show commands from the switch, in case you have questions about the CLI for the SNMP commands above...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;S01#sh ver | i IOS&#xA;Cisco IOS Software, C3560 Software (C3560-IPBASEK9-M), Version 12.2(37)SE, RELEASE SOFTWARE (fc2)&#xA;S01#&#xA;S01#sh mac address-table dynamic&#xA;          Mac Address Table&#xA;-------------------------------------------&#xA;&#xA;Vlan    Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA;  10    0006.53fe.39e0    DYNAMIC     Fa0/48&#xA;  10    001d.a1cd.5346    DYNAMIC     Fa0/48&#xA;  10    0030.1bbc.a7d7    DYNAMIC     Fa0/48&#xA;  10    0080.c800.0000    DYNAMIC     Fa0/48&#xA;  10    38ea.a76d.2e8e    DYNAMIC     Fa0/48&#xA;  10    80ee.732f.0b40    DYNAMIC     Fa0/48&#xA;Total Mac Addresses for this criterion: 6&#xA;S01#&#xA;S01#sh arp&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  172.16.1.210            -   0018.ba51.5b41  ARPA   Vlan10&#xA;Internet  172.16.1.200            0   0006.53fe.39e0  ARPA   Vlan10&#xA;Internet  172.16.1.32             0   bc51.fe50.16f8  ARPA   Vlan10&#xA;Internet  172.16.1.25             0   38ea.a76d.2e8e  ARPA   Vlan10&#xA;Internet  172.16.1.5              1   80ee.732f.0b40  ARPA   Vlan10&#xA;S01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-10-24T11:23:38.783" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2905" PostTypeId="1" AcceptedAnswerId="2907" CreationDate="2013-08-21T09:56:15.433" Score="9" ViewCount="1154" Body="&lt;p&gt;I have been going through the MPLS technology recently.I have this doubt in my mind after reading some of the features of the MPLS.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A---B---c&#xA;    |    |&#xA;    D----E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lets say routers A,E are LER and B,C,D are LSR,we want to send traffic from A-&gt;E.&#xA;I have learnt that only LSR can initially assign labels and In LDP, downstream routers initiate the distribution of labels and the label/FEC binding.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Can someone please explain me&#xA;1.)how A(LER) can transmit the packets to B(LSR).&#xA;2.)how can B know which label and port to forward,if it receives the distribution from C(Where C and D are downstream routers)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2424" LastActivityDate="2013-08-21T10:51:28.257" Title="Label Distribution Protocol(LDP) in MPLS" Tags="|switch|mpls|network-core|mpls-tp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2906" PostTypeId="2" ParentId="2866" CreationDate="2013-08-21T10:27:49.330" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The information that I'm seeing conflicts -- the wikipedia page on unicast flooding cites protected mode as a mechanism to block flooding, while Cisco's documentation says that switchport protected doesn't matter, and that switchport block unicast would still be needed to prevent flooding.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;switchport protected&lt;/code&gt; is used to enforce privacy within a vlan... the command prevents ports from talking to other ports configured with &lt;code&gt;switchport protected&lt;/code&gt;.  This command reduces flooding as a side-effect of using it on all ports in a Vlan, but it does much more than &quot;just&quot; remove flooding from a switchport.  Honestly, I think there are better ways to accomplish your goals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;switchport protected&lt;/code&gt; is useful if you're aggregating colocation customers in the same vlan; this command is one way to offer privacy between the customers without the complications of private vlans.  The wikipedia article you mentioned, says you can &quot;bounce&quot; traffic off the default gateway (which should not be on a protected switchport) to reach those other destinations... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;switchport block unicast&lt;/code&gt; does stop unknown unicast flooding; however, see below for why I think you shouldn't need this command.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;However, I recently ran into an issue where on a 2950G running some relatively ancient 12.1(22) code, unicast flooding seemed to be completely broken for a protected port -- the aging time on the switch was 5 minutes, while the router's ARP timeout was 30 minutes, and the one TCP connection utilizing this interface had a tendency to sit dormant for 10 minutes at a time - and be non-functional when waking up after 10 minutes in this case.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I mentioned in my comment, if there is any potential for an asymmetric routed path in this network, you either need unknown unicast flooding, or you need to match the CAM and ARP timers to ensure that CAM entries don't age out before the ARP entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most cases, &lt;a href=&quot;https://networkengineering.stackexchange.com/a/2193/775&quot;&gt;matching the ARP and CAM timers is the right way to fix the situation&lt;/a&gt;, but the choice is yours...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT to respond to the comments:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Setting the timers to match is working great as a workaround - I just don't understand why the flooding isn't happening as expected.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Quoting from &quot;CCIE Practical Studies, Volume 2&quot;, page 115 by Karl Solie, Leah Lynch, Charles Ragan:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If unknown unicast and multicast traffic is forwarded to a protected port, there could be security issues. To prevent unknown unicast or multicast traffic from being forwarded from one port to another, you can configure a port (protected or nonprotected) to block unknown unicast and multicast traffic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3550_switch(config-if)#switchport block unicast&#xA;3550_switch(config-if)#switchport block multicast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2013-08-22T09:28:41.340" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2907" PostTypeId="2" ParentId="2905" CreationDate="2013-08-21T10:33:40.943" Score="12" Body="&lt;p&gt;Label itself is either an aggregate label, which means label does not have rewrite information attached to it, so it does not know egress interface nor egress MAC address. Aggregate labels are used for example to connected networks.&lt;br&gt;&#xA;Aggregate label implies that you do not know egress information after MPLS lookup, so you must do normal IP lookup to determine egress information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normal label is attached with egress rewrite information, that is lookup against label will return egress interface (with all necessary information, like MAC address, VLAN etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets assume all links are IGP metric 1, except B-C is metric 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For A to send to E's loopback (192.0.2.5) following will happen&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;E will allocate either explicit (0) or implicit (default) for 192.0.2.5/32 &lt;/li&gt;&#xA;&lt;li&gt;E will distribute the prefix+label (FEC) to C and D, using LDP&lt;/li&gt;&#xA;&lt;li&gt;C will allocate local label for this, say 100 (could be anything)&#xA;&lt;ol&gt;&#xA;&lt;li&gt;C will program FIB entry, so that label 100 points to interface towards E, and MPLS label operations 'SWAP 0' if explicit null, or 'POP' if implicit null&lt;/li&gt;&#xA;&lt;li&gt;C will program FIB entry, so that prefix 192.0.2.5/32 points to interface towards E, and MPLS label operation 'PUSH 0' if explicit null&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;D will allocate local label for this, say 200 (could be anything, even 100, 300, 400)&#xA;&lt;ol&gt;&#xA;&lt;li&gt;D will program FIB entry, so that label 200 points to interface towards E, and MPLS label operation 'SWAP 0' if explicit null, or 'POP' if implicit null&lt;/li&gt;&#xA;&lt;li&gt;D will program FIB entry, so that prefix 192.0.2.5/32 points to interface towards E, and MPLS label operation 'PUSH 0' if explicit null&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;D and C will distribute the prefix+label to B, using LDP&lt;/li&gt;&#xA;&lt;li&gt;B will allocate local label for this, say 300 (could be anything)&#xA;&lt;ol&gt;&#xA;&lt;li&gt;B will program FIB entry, so that label 300 points to interface towards D (because of IGP metric!), and MPLS label operation 'SWAP 200'&lt;/li&gt;&#xA;&lt;li&gt;B will program FIB entry, so that prefix 192.0.2.5/32 points to interface towards D, and MPLS label operation 'PUSH 200'&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;B will distribute the prefix+label to A, using LDP&lt;/li&gt;&#xA;&lt;li&gt;A will allocate local label for this, say 400 (could be anything)&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A will program FIB entry, so that label 400 points to interface towards B, and MPLS label operation 'SWAP 300'&lt;/li&gt;&#xA;&lt;li&gt;A will program FIB entry, so that prefix 192.0.2.5/32 points to interface towards B, and MPLS label operation 'PUSH 300'&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now what happens in forwarding plane when A sends to 192.0.2.5/32&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A will PUSH (impose) label 300 and send towards B&lt;/li&gt;&#xA;&lt;li&gt;B will consult FIB for 300, which is Interface D and SWAP 200&lt;/li&gt;&#xA;&lt;li&gt;D will consult FIB for 200, which is Interface E and POP (or SWAP 0)&lt;/li&gt;&#xA;&lt;li&gt;E will receive frame&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-08-21T10:51:28.257" LastActivityDate="2013-08-21T10:51:28.257" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2908" PostTypeId="2" ParentId="2893" CreationDate="2013-08-21T11:47:56.550" Score="7" Body="&lt;p&gt;It will probably be easier to understand if you look at larger chassis (7600, 12k) and for example their SPA Interface Processor modules (SIPs) and SPA cards. Chassis have slots in which you can place designated hardware modules and those modules can have sub-slots. Keep in mind that some of this stuff can be integrated (probably the thing that is confusing you) or left for you to populate with desired hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in my example with SIP and SPA you will place SIP module in slot of the chassis, and then you place SPA cards inside sub-slots of the SIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In these configurations you will have interface names as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  &amp;lt;slot&amp;gt;/&amp;lt;sub-slot&amp;gt;/&amp;lt;port&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In larger, high end routers, with IOS XR you can also see the chassis:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  &amp;lt;chassis&amp;gt;/&amp;lt;slot&amp;gt;/&amp;lt;sub-slot&amp;gt;/&amp;lt;port&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the interface name describes the location of the interface from most significant part (slot in my example) to a least significant part (port in my example).&lt;/p&gt;&#xA;" OwnerUserId="2358" LastEditorUserId="76" LastEditDate="2013-08-21T20:52:42.743" LastActivityDate="2013-08-21T20:52:42.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2909" PostTypeId="2" ParentId="2893" CreationDate="2013-08-21T12:54:54.230" Score="2" Body="&lt;p&gt;The x800 series you mentioned are the ISR G1 series routers.  If you use the interface numbering model as interface type/slot/subslot/port, the built-in interfaces on the x800s are all slot 0.  Thus, the first FastEthernet interface would be Fa0/0 (no subslot in this case).  The x800s also have built-in WIC slots.  So if a 2 port serial card is inserted into the first built-in WIC slot, the interfaces are number Se0/0/0 and Se0/0/1.  If the second built-in WIC slot is populated with the same 2 port serial card, the numbering is Se0/1/0 and Se0/1/1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next slot available on an x800 would be the first network module slot.  Thus, it won't be until you populate the first network module slot that you'll have anything other than &quot;0&quot; in the  portion of the interface numbering on the x800 series.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, on the x800s, the numbering is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;1.  network module or &quot;0&quot; for built-in&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;ol&gt;&#xA;2.  WIC (if applicable)&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;ol&gt;&#xA;3.  port number.&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2104" LastEditorUserId="2104" LastEditDate="2013-08-22T13:17:56.927" LastActivityDate="2013-08-22T13:17:56.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2910" PostTypeId="1" CreationDate="2013-08-21T14:35:36.473" Score="2" ViewCount="872" Body="&lt;p&gt;I'm looking for Cisco OIDs for monitoring Cisco ASA series. Is the CISCO-UNIFIED-FIREWALL-MIB enough? What are the statistics and status indicators I should gather? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm interested in :  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Resource consumption (CPU utilization/memory usage)  &lt;/li&gt;&#xA;&lt;li&gt;Current Active Connections  &lt;/li&gt;&#xA;&lt;li&gt;Active VPN Tunnels - Items: AnyConnect (SSL client), WebVPN (SSL clientless), IPsec, IPsec L2L, etc.  &lt;/li&gt;&#xA;&lt;li&gt;RAS Sessions (Total)  &lt;/li&gt;&#xA;&lt;li&gt;Traffic in/out (packets/bytes)  &lt;/li&gt;&#xA;&lt;li&gt;IKE Dropped Packets  &lt;/li&gt;&#xA;&lt;li&gt;IKE Traffic (bits/sec)  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2426" LastEditorUserId="775" LastEditDate="2013-08-22T10:29:20.037" LastActivityDate="2013-08-22T10:29:22.383" Title="Common Cisco Firewall SNMP performance counters" Tags="|cisco-asa|monitoring|snmp|" AnswerCount="0" CommentCount="4" ClosedDate="2019-04-18T22:50:09.653" ContentLicense="CC BY-SA 3.0" />
  <row Id="2913" PostTypeId="2" ParentId="2892" CreationDate="2013-08-21T21:07:16.683" Score="5" Body="&lt;p&gt;A hang usually refers to an ethernet frame transmission that &quot;takes too long&quot; resulting in a controller or interface reset. What &quot;takes too long&quot; means is a bit of a mystery though.&lt;/p&gt;&#xA;" OwnerUserId="460" LastActivityDate="2013-08-21T21:07:16.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2914" PostTypeId="2" ParentId="2501" CreationDate="2013-08-21T22:34:01.717" Score="0" Body="&lt;p&gt;I'll just attempt to enter an answer.. I've never seen an scp copy to a Cisco device work in the way you are trying to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe you should be able to use the Cisco Flash MIB to do remote pulls (initiated by your management server, as you are trying to do.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe this article should help you accomplish this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://bodgitandscarper.co.uk/networks/using-snmp-to-upgrade-ios-on-cisco-devices/&quot; rel=&quot;nofollow&quot;&gt;http://bodgitandscarper.co.uk/networks/using-snmp-to-upgrade-ios-on-cisco-devices/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2013-08-21T22:34:01.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2916" PostTypeId="1" CreationDate="2013-08-22T06:24:11.800" Score="6" ViewCount="701" Body="&lt;p&gt;I'm looking for a device to use as PE in a provider network. It should have the following features:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;MPLS&lt;/li&gt;&#xA;  &lt;li&gt;VPLS&lt;/li&gt;&#xA;  &lt;li&gt;Q-in-Q&lt;/li&gt;&#xA;  &lt;li&gt;BGP&lt;/li&gt;&#xA;  &lt;li&gt;Reasonable buffers&lt;/li&gt;&#xA;  &lt;li&gt;IGP (OSPF/ISIS)&lt;/li&gt;&#xA;  &lt;li&gt;VLAN rewriting&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The perfect fit ideally would be ME3600/3800. However I'm concerned about:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Poor port density&lt;/li&gt;&#xA;  &lt;li&gt;Lack of 10GE ports&lt;/li&gt;&#xA;  &lt;li&gt;No redundant supervisor or equivalent&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For that reason I have been contemplating the upcoming Catalyst 6880-X with SUP2T or even the Catalyst 6500 with SUP2T. I am a bit uncomfortable putting an &quot;enterprise&quot; switch as a PE device in a provider network though.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;So the question is if SUP2T is suitable to use in a provider network?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any operational input would be highly appreciated as well. If you are rolling ME3600/3800 how are you deplyoing it regarding redundancy and port density.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-08-22T09:08:34.003" Title="Suitability of Catalyst 6500/6800 with SUP2T as a provider PE device" Tags="|vpls|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2917" PostTypeId="2" ParentId="16" CreationDate="2013-08-22T07:15:38.973" Score="1" Body="&lt;p&gt;Change the domain of the client and rechange it back to the same domain this should reset the VTP counter and now the client will get the VLANS from the VLAN server&lt;/p&gt;&#xA;" OwnerUserId="2432" LastActivityDate="2013-08-22T07:15:38.973" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2919" PostTypeId="2" ParentId="2916" CreationDate="2013-08-22T09:08:34.003" Score="5" Body="&lt;p&gt;I have first-hand knowledge of several large US service providers who are using the Catalyst 6500 in both Aggregation and Edge roles.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So the question is if SUP2T is suitable to use in a provider network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Longer answer:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't let the enterprise heritage of the 6500 fool you...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The 6500 includes a Catalyst 6500 V-E chassis, which supports NEBS front-to-back airflow.&lt;/li&gt;&#xA;&lt;li&gt;The Cisco 7600 (which was marketed to service providers) was heavily based on the Catalyst 6500, to the point that most people called it a 6500 with &quot;new paint&quot;&lt;/li&gt;&#xA;&lt;li&gt;See this &lt;a href=&quot;http://www.gossamer-threads.com/lists/cisco/nsp/149849&quot; rel=&quot;noreferrer&quot;&gt;Cisco NSP thread&lt;/a&gt; when Sup2T was released.  There was no fear of the system for service provider use&lt;/li&gt;&#xA;&lt;li&gt;You may want to avoid &lt;a href=&quot;http://www.mail-archive.com/cisco-nsp@puck.nether.net/msg51618.html&quot; rel=&quot;noreferrer&quot;&gt;netflow&lt;/a&gt;, I saw several comments like this.&lt;/li&gt;&#xA;&lt;li&gt;Search the &lt;a href=&quot;https://www.google.com/search?q=sup2t+cisco+nsp&quot; rel=&quot;noreferrer&quot;&gt;Cisco NSP archives and see if you like it&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;One thing I can't speak for are features / IOS questions... however, those are outside the scope of your question.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-08-22T09:08:34.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2923" PostTypeId="1" AcceptedAnswerId="3058" CreationDate="2013-08-22T10:40:16.430" Score="11" ViewCount="7815" Body="&lt;p&gt;In essence I want to know if there is any way that we can use extended ping or any other command variants to prove to the customer that that the circuit is able to achieve the minimum CIR. The CE routers are Cisco ISRs 881,19x1 &amp;amp; 29x1 running 15.1, and the PE routers are Juniper MXs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an ideal world we would just plug a laptop into a LAN port and use iperf to a remote destination behind the CE routers, but the WAN / LAN deployment is being done on separate days and therefore have been instructed to leave the LAN ports shutdown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We need to contractually prove that 80/20MBps VDSL2 circuit meets the minimum 20/4MBps CIR requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference: On the Juniper MX side, we can drop down into the shell and and run multiple flood pings with the DF flags set, but the problem is currently with the Cisco ISRs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: RE-Protect will be disabled for the bandwidth test period and therefore wont be a factor. and were potentially deploying 12 sites a day so simplicity is a key success factor.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  +---------------+          +---------------+             +-------------+&#xA;  |               |+--20mb--&amp;gt;|               |             |Cisco ISR CE |&#xA;  |Juniper MX PE  |          |Carrier network|&amp;lt;------4mb---|             |&#xA;  +---------------+          +---------------+             +-------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="1092" LastEditDate="2013-08-22T12:25:46.073" LastActivityDate="2013-09-01T04:43:18.127" Title="Traffic generation from Cisco IOS device to prove WAN circuit" Tags="|cisco|cisco-ios|bandwidth|testing|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2925" PostTypeId="1" AcceptedAnswerId="3801" CreationDate="2013-08-22T12:56:30.390" Score="16" ViewCount="6304" Body="&lt;p&gt;I am trying to understand the cross-over point for when I would deploy active DWDM over passive DWDM (as active seems to be more expensive based on my initial research);&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Passive DWDM takes in various colours / wavelengths and muxes them onto a single fibre pair.  This seems to be the same principal as a CWDM mux/demux, however with DWDM we know, we can get a lot more channels. (Also I believe that with CWDM we are using different frequencies within the ITU grid?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Active DWDM can take in 8/16/32 etc channels all on the same wavelength (say 1310nm) and them shift them all to different individual frequencies before muxing them onto a single fibre. They can be demuxed at the other end all back to the same frequency again (say 1310nm).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So am I correct that the reasons for deploying active DWDM over passive are that&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Active can provide more channels&lt;/li&gt;&#xA;&lt;li&gt;Active can use all the same input frequency, thereby any 1310nm device can connect to it, without the need for tuned/coloured optics?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Have I missed any pro's of active over passive? What are the con's?&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="8499" LastEditDate="2017-08-21T15:05:14.643" LastActivityDate="2017-08-21T15:05:14.643" Title="DWDM active and passive comparison" Tags="|fiber|layer1|optical|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2926" PostTypeId="2" ParentId="2160" CreationDate="2013-08-22T19:09:06.060" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is: Can someone think of a way of connecting these VMs together in such a way that it would simulate physical Vyatta machines connected via Cisco (or otherwise) switches, so that I can test STP (and anything else I can think of)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can use ESXi hypervisor to run the VM's which is free and add on the NEXUS 1000 Cisco virtual switch.  &lt;a href=&quot;http://www.cisco.com/en/US/products/ps9902/index.html&quot; rel=&quot;nofollow&quot;&gt;Nexus switch download&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2302" LastEditorUserId="775" LastEditDate="2013-08-22T19:35:56.523" LastActivityDate="2013-08-22T19:35:56.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2927" PostTypeId="2" ParentId="16" CreationDate="2013-08-22T19:46:01.347" Score="5" Body="&lt;p&gt;An alternate way to force an update is to change the switch that needs the update to Transparent mode which resets the counter to Zero and then put it back into client mode or server mode.  This will force the switch to jump from revision 0 to whatever the current highest revision is and the database will be overwritten.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="2302" LastActivityDate="2013-08-22T19:46:01.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2928" PostTypeId="1" CreationDate="2013-08-22T23:03:51.783" Score="5" ViewCount="1346" Body="&lt;p&gt;I'm using a Procurve 5406zl (J8697A) layer 3 switch with multiple vlans:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;VLANs:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;v10 Main Network 10.1.4.1&lt;/li&gt;&#xA;&lt;li&gt;v12 Wireless 10.1.8.1&lt;/li&gt;&#xA;&lt;li&gt;v13 Restricted Wireless 10.0.0.1&lt;/li&gt;&#xA;&lt;li&gt;v14 Tech 192.168.7.1&lt;/li&gt;&#xA;&lt;li&gt;v50 Internet 192.168.10.254&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;And Untangle with 3 nics:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;External (Uverse)&lt;/li&gt;&#xA;&lt;li&gt;Internal (LAN)&lt;/li&gt;&#xA;&lt;li&gt;Primary IP: 192.168.10.1 /24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;IP Aliases:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10.1.4.0 /22&lt;/li&gt;&#xA;&lt;li&gt;10.1.8.0 /22&lt;/li&gt;&#xA;&lt;li&gt;10.1.12.0 /22&lt;/li&gt;&#xA;&lt;li&gt;192.168.7.0 /24&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;10.0.0.0 /20&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DMZ (DSL Connection, this connection we're doing away with)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;eth3 (New fiber connection)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;And Static Routes:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Target: 10.1.4.0 - Gateway: 192.168.10.254&lt;/li&gt;&#xA;&lt;li&gt;Target: 10.1.8.0- Gateway: 192.168.10.254&lt;/li&gt;&#xA;&lt;li&gt;Target: 192.168.7.0 - Gateway: 192.168.10.254&lt;/li&gt;&#xA;&lt;li&gt;Target: 10.0.0.0 - Gateway: 192.168.10.254&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Changes I'm looking to make:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to start utilizing the new fiber connection added to eth3 interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to have all of the VLANs to start using the eth3 it except for VLAN 13 which is our public wifi id like for it to continue to use the &quot;External&quot; interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I need to do in order to start utilizing this new connection on eth3?&lt;/p&gt;&#xA;" OwnerUserId="2439" LastEditorUserId="8499" LastEditDate="2018-12-21T04:42:18.760" LastActivityDate="2018-12-21T04:42:18.760" Title="Layer 3 network, multiple internet connections" Tags="|routing|vlan|layer3|hp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2929" PostTypeId="2" ParentId="2928" CreationDate="2013-08-23T00:10:31.650" Score="2" Body="&lt;p&gt;This will require a &quot;policy-based routing&quot;-esque configuration, since you'll essentially be routing based on source address/subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should be possible with &lt;a href=&quot;http://www.untangle.com/store/wan-balancer-conf.html&quot; rel=&quot;nofollow&quot;&gt;WAN balancer&lt;/a&gt; if memory serves, but it's been a while so I recommend looking at it's requirements first. (i.e. requires separate cards for each WAN connection)&lt;/p&gt;&#xA;" OwnerUserId="1007" LastActivityDate="2013-08-23T00:10:31.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2933" PostTypeId="2" ParentId="2160" CreationDate="2013-08-23T05:01:34.940" Score="0" Body="&lt;p&gt;ok, you have to have stp on, do any of the users have a laptop? long Ethernet cables? two-port adaptors? hehe, user rules! what about the server farm? no loop potential there eh?&lt;/p&gt;&#xA;" OwnerUserId="2442" LastActivityDate="2013-08-23T05:01:34.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2937" PostTypeId="1" AcceptedAnswerId="2938" CreationDate="2013-08-23T11:57:18.567" Score="2" ViewCount="2718" Body="&lt;p&gt;My workplace has a HP 1400-24G J9078A switch. I want to connect to it via browser. I tried the manual and other options but could not find any reference.&lt;/p&gt;&#xA;" OwnerUserId="2445" LastEditorUserId="775" LastEditDate="2013-08-23T12:21:01.840" LastActivityDate="2013-08-23T13:18:49.267" Title="Browser access to HP ProCurve 1400-24G" Tags="|switch|hp-procurve|hp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2938" PostTypeId="2" ParentId="2937" CreationDate="2013-08-23T13:18:49.267" Score="9" Body="&lt;p&gt;The 1400 is a completely unmanaged switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's nothing to connect to with a browser.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-08-23T13:18:49.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2939" PostTypeId="1" CreationDate="2013-08-23T13:33:14.150" Score="4" ViewCount="3934" Body="&lt;p&gt;How to install our own SSL key and certificate on a SG-300-10 switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The manual simply doesn't seem to bear much resemblance to what's available in the web interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the manual, one should navigate to &quot;Security &gt; SSL Server &gt; SSL Server Authentication Settings&quot;.  But the only entries under Security are TACAS+, RADIUS, Password Strength, Management Access Authentication, Mgmt Access Method, TCP/UDP Services, Storm Control, Port Security, 802.1X, Denial of Service Prevention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, having looked through the other menus, I can't find anywhere else where this could be configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly with SSH keys.  The manual talks about web interface pages called &quot;SSH User Authentication&quot; and &quot;SSH Server Authentication&quot;, but the web interface I see does not have pages with these titles.  How would I go about reconfiguring, or even viewing, the SSH keys on the device?&lt;/p&gt;&#xA;" OwnerUserId="2446" LastEditorUserId="8499" LastEditDate="2018-02-16T04:27:36.627" LastActivityDate="2019-10-01T20:17:03.197" Title="How to install SSL key and certificate on SG 300-10 (and SSH functionality)" Tags="|cisco|ssh|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2940" PostTypeId="1" AcceptedAnswerId="2941" CreationDate="2013-08-23T15:58:25.620" Score="15" ViewCount="14164" Body="&lt;p&gt;If there's a duplicate IP address, which one &quot;wins&quot;?  First, last, flaps, neither?&lt;/p&gt;&#xA;" OwnerUserId="892" LastEditorUserId="8499" LastEditDate="2018-03-19T18:00:35.327" LastActivityDate="2018-03-19T18:00:35.327" Title="Duplicate IP Address - which one wins?" Tags="|ipv4|dhcp|ipv6|arp|ip-address|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2941" PostTypeId="2" ParentId="2940" CreationDate="2013-08-23T16:08:26.643" Score="18" Body="&lt;p&gt;&lt;strong&gt;IPv4:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will &quot;flap&quot;. On the sending host (another host or the gateway/router) there will be an ARP entry for the IP pointing to the MAC address of one of the hosts. Packets will go to one of the hosts, wherever the ARP entry currently points. This will effectively disrupt connectivity for both hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IPv6:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The neighbor discovery protocol will do a Duplicate Address Detection (DAD) before configuring/activating a new address. When it detects that the new tentative address is already in use it will not activate the address so the &quot;first&quot; host will continue to have connectivity.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2014-07-17T08:21:19.487" LastActivityDate="2014-07-17T08:21:19.487" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2943" PostTypeId="1" CreationDate="2013-08-23T17:06:46.747" Score="6" ViewCount="1110" Body="&lt;p&gt;I've got a vendor that supports some specialized equipment, the network engineer before me set them up with remote access VPN terminating to a Cisco ASA 5510 so they can remotely administer/troubleshoot the system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The requirements is to get alert/notification (E-mail or syslog) when the VPN connection is established and when it is disconnected. this is mainly for billing purposes i.e when they vendor claims they spent X hours doing work, we would like some verification method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm hoping someone can point me in the right direction, or if there is a better way of doing this, I'm open to ideas ?&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;EDIT to show what I've attempted so far&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This is the config I have on the ASA from when I tried it last time, didn't work.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging enable  &#xA;logging timestamp  &#xA;logging buffered notifications  &#xA;logging trap critical  &#xA;logging history notifications  &#xA;logging asdm informational  &#xA;logging from-address [ASA email]  &#xA;logging recipient-address [myemail address] level critical  &#xA;logging host inside [syslog server]  &#xA;logging class vpn mail debugging  &#xA;logging class vpnc mail debugging  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1019" LastEditorUserId="775" LastEditDate="2013-08-23T21:28:06.793" LastActivityDate="2013-08-31T13:23:38.377" Title="RA VPN notification" Tags="|cisco|cisco-asa|security|vpn|monitoring|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2944" PostTypeId="1" AcceptedAnswerId="2947" CreationDate="2013-08-23T19:47:43.063" Score="2" ViewCount="10479" Body="&lt;p&gt;I am using a ADSL 2+ broadband service. My router shows very low SNR margin. While I quite understand what is SNR, I was curious to know what causes low SNR practically.&lt;/p&gt;&#xA;" OwnerUserId="2445" LastEditorUserId="775" LastEditDate="2013-08-26T06:50:19.467" LastActivityDate="2013-08-26T06:50:19.467" Title="Causes of low SNR" Tags="|wan|atm|adsl|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2945" PostTypeId="2" ParentId="2940" CreationDate="2013-08-23T20:44:06.817" Score="4" Body="&lt;p&gt;If there's no ARP entry (another host wants to talk to the dup), then who ever answers first wins; and hosts (and many routers) cache ARP entries sometimes for hours.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-08-23T20:44:06.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2946" PostTypeId="2" ParentId="2943" CreationDate="2013-08-23T20:46:46.370" Score="2" Body="&lt;p&gt;Syslog is pretty much automatic. (they can be &lt;em&gt;very&lt;/em&gt; verbose)  You'll have to setup something to parse the syslog output (splunk, etc.)  Also, if there's an authentication (accounting) system in place, you could look there for login/logout events.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-08-23T20:46:46.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2947" PostTypeId="2" ParentId="2944" CreationDate="2013-08-23T20:58:48.243" Score="6" Body="&lt;p&gt;There are many things that can cause low SNR. If you put aside natural reasons such as attenuation caused by  distance, most of the time problem lies in bad infrastructure. Bad cables (damaged shielding and exposed wires), ingress noise, crosstalk, impedance mismatches, bad connectors and micro-reflections, bad splitters and filters and stuff like that. It depends on many different things and it varies in real time.&lt;/p&gt;&#xA;" OwnerUserId="2358" LastActivityDate="2013-08-23T20:58:48.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2948" PostTypeId="2" ParentId="2940" CreationDate="2013-08-23T21:23:40.460" Score="5" Body="&lt;p&gt;For IPv4, IP-packets sent to the duplicate address will be sent to the MAC address currently in the ARP cache. Flapping will only occur if both hosts send ARP replies to the sender, flapping the ARP entry. If no ARP replies are received, connectivity will be fine with one of the owners of the duplicate IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the last host to answer (or have answered) an ARP request will &quot;win&quot;. This competition will be held for every new host that wants to communicate with the duplicate IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could rig the competition by regularly sending gratuitous ARPs.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-08-23T21:23:40.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2949" PostTypeId="2" ParentId="2940" CreationDate="2013-08-23T22:31:31.200" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If there's a duplicate IP address, which one &quot;wins&quot;? First, last, flaps, neither?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I have been thinking about this question for the last six hours... I think the most appropriate answer is &lt;em&gt;&quot;Nobody wins&quot;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, at least two computers can't be used reliably.  Furthermore, you are spending time fixing a problem, and that time could have been used on something much more productive.  Anyone who has been a network engineer for long knows that time is one thing we often run short on.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;A basic solution to prevent IP conflicts&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;IP conflicts indicate a basic breakdown in, or lack of good IP allocation processes. If the process is at fault, these kind of issues should be addressed quickly; otherwise you could spend too many cycles on tactical problems like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Proactive planning could be using:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DHCP for PCs&lt;/li&gt;&#xA;&lt;li&gt;Static DHCP reservations for servers&lt;/li&gt;&#xA;&lt;li&gt;DHCP snooping on switchports&lt;/li&gt;&#xA;&lt;li&gt;IP Source Guard on switchports&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/dynarp.html&quot;&gt;Dynamic ARP Inspection&lt;/a&gt; on switchports&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In Cisco IOS, the IP Source Guard and DHCP snooping config would look something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!! NOTE: Source guard requires DHCP Snooping global config&#xA;!! NOTE: Source guard requires DHCP Snooping on vlan&#xA;!! NOTE: Source guard *static* bindings REQUIRE DHCP snooping on the switch&#xA;!!     (even if you aren't using DHCP anywhere else)&#xA;ip dhcp snooping&#xA;ip dhcp snooping vlan 100,200&#xA;!&#xA;! static Source Guard binding for a non-DHCP device&#xA;ip source binding 0011.2233.4455 vlan 100 10.71.2.85 interface GigabitEthernet 5/48&#xA;!&#xA;interface GigabitEthernet 4/1&#xA; description For DHCP_SERVER port&#xA; switchport access vlan 200&#xA; ! Trust DHCP server ports&#xA; ip dhcp snooping trust&#xA;!&#xA;interface GigabitEthernet 5/20&#xA; description For DHCP_PC port&#xA; switchport access vlan 200&#xA; no ip dhcp snooping trust&#xA; ip verify source&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A solution like this will prevent IP conflicts before they start. If you already have the problem, I would start building a plan to solve it.  This is just one possible solution.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-08-24T01:10:04.697" LastActivityDate="2013-08-24T01:10:04.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2950" PostTypeId="2" ParentId="2944" CreationDate="2013-08-23T23:55:06.157" Score="5" Body="&lt;p&gt;Fundamentally, loss of signal and/or increase in noise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your SNR is always low and has always been low, it may simply be near the distance limit. Then again, it could be that it's always run over a lousy chunk of cable or bad splice. A few years back I had two ADSL circuits to campus, which took different routes - one significantly longer. Both cost the same, but the shorter one always ran faster in practice. When I got better options I shut them both down.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2013-08-23T23:55:06.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2952" PostTypeId="2" ParentId="2088" CreationDate="2013-08-24T00:41:02.387" Score="0" Body="&lt;p&gt;I agree with Jeremy.  I think the unmanaged switch is actually masking problems with your network.  Check the 5400 switch logs for errors relating to that port.  Spanning tree issues and broadcast limits are the first things I would be checking for.  Showing your port counters and switch configs might help us make other useful suggestions.&lt;/p&gt;&#xA;" OwnerUserId="225" LastActivityDate="2013-08-24T00:41:02.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2954" PostTypeId="1" AcceptedAnswerId="3018" CreationDate="2013-08-24T05:14:27.023" Score="4" ViewCount="5578" Body="&lt;p&gt;I recently decided to run some CAT6 cabling and wanted to ensure that my Crimpmaster RJ45 die would work fine for the CAT6A shielded connectors.  I noticed that several people had trouble using the CAT6 connectors (eg, from Monoprice for one) for different reasons, one of which seemed to be compatibility with their crimpers (eg, bad pin contact).  There are EZRJ45 connectors that need a special crimper (Platinum Tools), and that crimper seems to work for standard connectors as well... but not AMP; so EZRJ45 just seems to be a proprietary connector.  I've used my Ideal Crimpmaster for years for CAT5e and never knew there to be a difference in connectors needed; Ideal says that its die is AMP.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I came across this tidbit on Wikipedia, but I can't seem to find more detail: &lt;a href=&quot;http://en.wikipedia.org/wiki/RJ45_%28computers%29#Types_and_incompatibility&quot;&gt;http://en.wikipedia.org/wiki/RJ45_%28computers%29#Types_and_incompatibility&lt;/a&gt;  Only after looking for the differences do I find that some crimp tools manufacturers make different WE/SS and TE-AMP compatible crimpers with further explanation, but in all my years I've never heard of different RJ45 standards to be concerned about. I know that solid and stranded connectors can use different pins to make wire contact, and that CAT6A and CAT7 cable diameters can be larger than CAT5, but I've seen no mention that new crimpers must be used for CAT6A/7 vs CAT5.  Is it time to upgrade my tools and connectors?!&lt;/p&gt;&#xA;" OwnerUserId="2451" LastActivityDate="2019-02-24T19:00:37.160" Title="What is the difference between RJ45 connection standards WE/SS and TE-AMP and when and where are they used?" Tags="|ethernet|cabling|standardisation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2957" PostTypeId="2" ParentId="2943" CreationDate="2013-08-24T07:50:26.920" Score="3" Body="&lt;p&gt;You need &lt;code&gt;logging mail&lt;/code&gt; -- see &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa82/command/reference/l2.html#wp1773126&quot; rel=&quot;nofollow&quot;&gt;Cisco ASA 5500 Series Command Reference, 8.2&lt;/a&gt; (or other version) -- to trigger the email.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging list emaillogin level alerts class auth&#xA;logging mail emaillogin&#xA;! ^^^^^^^^^^^^^^^^^^^^^&#xA;logging from-address asa5510@example.com&#xA;logging recipient-address you@example.com level alerts&#xA;logging class auth mail alerts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastEditorUserId="775" LastEditDate="2013-08-24T09:51:05.433" LastActivityDate="2013-08-24T09:51:05.433" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2962" PostTypeId="1" CreationDate="2013-08-24T16:14:32.097" Score="41" ViewCount="38700" Body="&lt;p&gt;Why was ethernet MTU calculated as 1500 bytes?&lt;/p&gt;&#xA;&lt;p&gt;What specific calculation was done to arrive at 1500 byte ethernet MTUs, and what factors were considered for that calculation?&lt;/p&gt;&#xA;" OwnerUserId="2463" LastEditorUserId="775" LastEditDate="2021-10-22T00:41:39.810" LastActivityDate="2022-11-17T16:48:06.347" Title="Why was the MTU size for ethernet frames calculated as 1500 bytes?" Tags="|ethernet|mtu|protocol-theory|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="2963" PostTypeId="2" ParentId="2962" CreationDate="2013-08-24T17:22:16.400" Score="2" Body="&lt;p&gt;Originally, max. payload  was defined as 1500 bytes in 802.3.  Ethernet v2 supports frame length of &gt;=1536 and this is what IP implementations use. Most carrier-class vendors support around 9000 bytes (&quot;jumbo frames&quot;) these days.&#xA;Since 1500 byte is the standard that all Ethernet implementations must support, this is what is normally set as default on all interfaces.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorDisplayName="user661" LastEditDate="2013-08-24T18:30:03.163" LastActivityDate="2013-08-24T18:30:03.163" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2964" PostTypeId="2" ParentId="2962" CreationDate="2013-08-24T17:35:42.257" Score="29" Body="&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/users/2463/padmaraj&quot;&gt;padmaraj&lt;/a&gt; asked:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Why was ethernet MTU calculated as 1500 bytes?&lt;br&gt;&lt;br&gt;What specific calculation was done to arrive at 1500 byte ethernet MTUs, and what factors were considered for that calculation?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h4&gt;Short story&lt;/h4&gt;&#xA;&lt;p&gt;The answer to &amp;quot;Why is Ethernet MTU calculated as 1500 bytes?&amp;quot; is layered.  A lot depends on the Ethernet protocols in question.&#xA;Unfortunately we don't always know in advance what Layer-2 protocol is wrapped by an Ethernet frame header.&lt;/p&gt;&#xA;&lt;p&gt;Ethernet uses the two / four bytes after the source mac-address in different ways:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;802.1Q tagged frames use the FOUR bytes following the source mac-address as a vlan tag.  802.1Q is &lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType&quot; rel=&quot;nofollow noreferrer&quot;&gt;EtherType&lt;/a&gt; 0x8100&lt;/li&gt;&#xA;&lt;li&gt;Untagged Ethernet II DIX frames use TWO bytes after the Ethernet source mac-address for a &lt;em&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType&quot; rel=&quot;nofollow noreferrer&quot;&gt;EtherType&lt;/a&gt;&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;802.3 frames (such as 802.2 ISIS / Spanning-Tree) use TWO bytes after the Ethernet source mac-address as a &lt;em&gt;Length&lt;/em&gt; field.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;How do you know which Ethernet Layer-2 protocol we're parsing off the wire?  Usually, we know from the MAC-layer &lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType&quot; rel=&quot;nofollow noreferrer&quot;&gt;EtherType&lt;/a&gt;, but 802.3 with 802.2 LLC encap doesn't have an &lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType&quot; rel=&quot;nofollow noreferrer&quot;&gt;EtherType&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Thus, the payload of ISO 802.2 LLC frames (such as ISIS or Spanning-Tree) should not exceed 1500 bytes.  Other Ethernet protocols (such as Ethernet II DIX) unofficially can exceed 1500 bytes as long as their Ethernet PHY-layer doesn't depend on CSMA/CD.&lt;/p&gt;&#xA;&lt;h4&gt;Longer story&lt;/h4&gt;&#xA;&lt;p&gt;A lot depends on the Ethernet protocols in question.  The most basic technique to read Ethernet headers is explained in &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-isis-ext-eth-01&quot; rel=&quot;nofollow noreferrer&quot;&gt;draft-ietf-isis-ext-eth-01&lt;/a&gt;, specifically &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-isis-ext-eth-01#section-5&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section 3-5&lt;/a&gt;.  Quoting from that RFC draft...&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;&lt;strong&gt;Problem with Large Length interpretation Frames in the presence of Type Interpretation Frames&lt;/strong&gt;&lt;br&gt;&lt;br&gt;&#xA;Some protocols commonly used in the Internet have no reserved &lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType&quot; rel=&quot;nofollow noreferrer&quot;&gt;EtherType&lt;/a&gt;.  An example is the set of ISO Network layer protocols, of which ISIS is a member. Such protocols are only defined to use the IEEE 802.3/802.2 encoding, and so their packets are limited in length to 1500 bytes.&lt;br&gt;&lt;br&gt;Type Interpretation frames have no length field. Protocols encapsulated in Type interpretation frames, such as IP, are not limited in length to 1500 bytes by framing.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I'm including an annotated diagram below of Ethernet II DIX and 802.3 frames, these illustrate where the conflicting bytes are in the ethernet header:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc894&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 894&lt;/a&gt; Ethernet II (DIX) frames have an &lt;em&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType&quot; rel=&quot;nofollow noreferrer&quot;&gt;EtherType&lt;/a&gt;&lt;/em&gt; after the source mac-address&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    +----+----+-----------+------+-----+&#xA;    | DA | SA | EtherType | Data | FCS |&#xA;    +----+----+-----------+------+-----+&#xA;              ^^^^^^^^^^^^^&#xA;&#xA;    DA           Destination MAC Address (6 bytes)&#xA;    SA           Source MAC Address      (6 bytes)&#xA;    EtherType    Protocol                (2 bytes: &amp;gt;= 0x0600 or 1536 decimal)  &amp;lt;---&#xA;    Data         Protocol Data           (46 - 1500 bytes)&#xA;    FCS          Frame Checksum          (4 bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IEEE 802.3 with ISO 802.2 LLC / SNAP (used by [Spanning-Tree], ISIS) use these same bytes for &lt;em&gt;Length&lt;/em&gt;; 802.2 ISO ISIS doesn't have an EtherType and &lt;a href=&quot;https://networkengineering.stackexchange.com/a/49654/775&quot;&gt;Spanning-Tree doesn't have an EtherType&lt;/a&gt;.  Therefore 802.2 frame payloads MUST be smaller than 1500 bytes in order for the Length field to avoid conflict with reserved &lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType&quot; rel=&quot;nofollow noreferrer&quot;&gt;EtherType&lt;/a&gt; values.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    +----+----+------+-------------------------+------------+&#xA;    | DA | SA | Len  | DSAP / SSAP / Ctl (DSC) | Data | FCS |&#xA;    +----+----+------+-------------------------+------------+&#xA;              ^^^^^^^^&#xA;&#xA;    DA      Destination MAC Address (6 bytes)&#xA;    SA      Source MAC Address      (6 bytes)&#xA;    Len     Length of Data field    (2 bytes: &amp;lt;= 0x05DC or 1500 decimal)  &amp;lt;---&#xA;    DSC     802.2 DSAP, SSAP, Ctl   (3 bytes)&#xA;    Data    Protocol Data           (46 - 1500 bytes)&#xA;    FCS     Frame Checksum          (4 bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h4&gt;&lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-isis-ext-eth-01#section-10&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE's objections to official Jumbo frame support&lt;/a&gt;&lt;/h4&gt;&#xA;&lt;pre&gt;&lt;code&gt;    General comments on the use of jumbo frames in Ethernet networks:&#xA;&#xA;    Consideration #1: The expectation of no more than 15-1600 bytes&#xA;    between frames and an interpacket gap before the next frame is&#xA;    deeply ingrained throughout the design and implementation of&#xA;    standardized Ethernet/802.3 hardware. This shows up in buffer&#xA;    allocation schemes, clock skew and tolerance compensation and fifo&#xA;    design.&#xA;&#xA;    Consideration #2: For some Ethernet/802.3 hardware (repeaters are&#xA;    one specific example) it is not possible to design compliant&#xA;    equipment which meets all of the requirements and will still pass&#xA;    extra long frames.  Further, since clock frequency may vary with&#xA;    time and temperature, equipment may successfully pass long frames&#xA;    at times and corrupt them at other times.  Therefore, attempts to&#xA;    verify the ability to send long frames over a path may produce&#xA;    inaccurate results.&#xA;&#xA;    Consideration #3: The error checking mechanism embodied in the 4&#xA;    byte checksum has not been well characterized at greater frame&#xA;    lengths, but is known to degrade. Therefore the data reliability of&#xA;    transfers in long frame transfers will have a greater rate of&#xA;    undetected frame errors.&#xA;&#xA;    Consideration #4: The length of frames proposed by this draft can&#xA;    not be assured to pass through standards conformant hardware. The&#xA;    huge value of Ethernet/802.3 systems in the data networking&#xA;    universe is their standardization and the resulting assurance that&#xA;    systems will all interoperate. No such assurance can be provided&#xA;    for oversize frames with both the current broadly accepted standard&#xA;    and the large installed base ofstandards based equipment.&#xA;&#xA;    In summary with regard to greatly longer frames for Ethernet, much&#xA;    of the gear produced today would be intolerant of greatly longer&#xA;    frames.  There is no way proposed to distinguish between frame&#xA;    types in the network as they arrive from the media. Bridges might&#xA;    and repeaters would drop or truncate frames (and cause errors doing&#xA;    so) right and left for uncharacterized reasons. It would be a&#xA;    mess. What might seem okay for small carefully characterized&#xA;    networks would be enormously difficult or impossible to do across&#xA;    the Standard.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h4&gt;Summary&lt;/h4&gt;&#xA;&lt;p&gt;The safest Ethernet MTU is 1500-byte payloads; &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-isis-ext-eth-01#section-10&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE refuses to endorse Ethernet payloads &amp;gt; 1500 bytes&lt;/a&gt;.  Depending on circumstances, we can CAUTIOUSLY increase Ethernet II payloads over the existing MTU of 1500-bytes.&lt;/p&gt;&#xA;&lt;p&gt;If you want to implement jumbo frames (MTU &amp;gt; 1500), you should test your network to ensure you aren't breaking things in subtle ways.  Thoroughly read IEEE's objections to jumbo frames (see above) before you test.&lt;/p&gt;&#xA;&lt;p&gt;I will summarize with some simple guidance around jumbo frame support:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ethernet 802.2 LLC ISIS / Spanning-Tree frames must NOT exceed a 1500-byte payload (to avoid &lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType&quot; rel=&quot;nofollow noreferrer&quot;&gt;EtherType&lt;/a&gt; / frame Length conflicts).&lt;/li&gt;&#xA;&lt;li&gt;Ethernet II DIX frame payloads CAN exceed 1500 bytes &lt;em&gt;on full-duplex links&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;Ethernet II DIX frame payloads must NOT exceed 1500 bytes &lt;em&gt;on half-duplex links&lt;/em&gt;, which use &lt;a href=&quot;https://en.wikipedia.org/wiki/Carrier-sense_multiple_access_with_collision_detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;CSMA/CD&lt;/a&gt; (and Ethernet CSMA/CD assumes the payload is &amp;lt;= 1500 bytes)&lt;/li&gt;&#xA;&lt;li&gt;802.1Q Frames cannot use 802.3 / 802.2 encapsulation, and 802.1Q frame payloads CAN exceed 1500 bytes &lt;em&gt;on full-duplex links&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;As mentioned above, if you implement jumbo frames, test to ensure you aren't breaking things.&lt;/p&gt;&#xA;&lt;p&gt;FYI, I am including a link to pdf copies of the &lt;a href=&quot;http://www.pennington.net/archives/ethernet/Ethernet_Version_1.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethernet Version 1 spec&lt;/a&gt; and &lt;a href=&quot;http://www.pennington.net/archives/ethernet/Ethernet_Version_2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethernet Version 2 spec&lt;/a&gt;, in case anyone is interested...&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2022-11-17T16:48:06.347" LastActivityDate="2022-11-17T16:48:06.347" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="2966" PostTypeId="2" ParentId="2874" CreationDate="2013-08-25T02:49:27.080" Score="2" Body="&lt;p&gt;From what I understand of your scenario, it does not matter if you have two different firewalls internal interface on the same internal subnet. You need to keep the following in your mind when making this decision:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does having them on the same subnet make configuration simpler and easier?&lt;/li&gt;&#xA;&lt;li&gt;Will it help if they were on separate subnets in any way?&lt;/li&gt;&#xA;&lt;li&gt;Have I done proper routing and I understand the path of any connection scenario? For example, internal traffic will pass though which devices before reaching the destination?&lt;/li&gt;&#xA;&lt;li&gt;Have I all configured all rules on the firewalls properly to make sure no inter-Domain routing is occurring? This means that traffic on the same subnet that belongs to other device (other firewall) is not routed. This might be the most critical thing in your setup which you are concerned about. Again it depends all on your required traffic paths.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2440" LastActivityDate="2013-08-25T02:49:27.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2967" PostTypeId="2" ParentId="2962" CreationDate="2013-08-25T04:19:36.273" Score="17" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;At the other end of the range - 1500 bytes, there were two factors that lead to the introduction of this limit. First, if the packets are too long, they introduce extra delays to other traffic using the Ethernet cable. &lt;strong&gt;The other factor was a safety device built into the early shared cable transceivers. This safety device was an anti-babble system.&lt;/strong&gt; If the device connected to a transceiver developed a fault and started transmitting continuously, then it would effectively block any other traffic from using that Ethernet cable segment. To protect from this happening, the early transceivers were designed to shut off automatically if the transmission exceeded about 1.25 milliseconds. This equates to a data content of just over 1500 bytes. However, as the transceiver used a simple analogue timer to shut off the transmission if babbling was detected, then the 1500 limit was selected as a safe approximation to the maximum data size that would not trigger the safety device.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://answers.yahoo.com/question/index?qid=20120729102755AAn89M1&quot;&gt;http://answers.yahoo.com/question/index?qid=20120729102755AAn89M1&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1171" LastEditorUserId="619" LastEditDate="2013-08-26T20:03:11.543" LastActivityDate="2013-08-26T20:03:11.543" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2969" PostTypeId="2" ParentId="2874" CreationDate="2013-08-25T17:57:27.793" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Should the inside interface of the 5545 land first on the L2 edge switches and then trunk to the agg switches for better security or just have the inside drop straight into the Agg layer, also considering that private line traffic may come through yet another interface on the 5545 in the future&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since you did not say that the L2s would be running ACLs, I would not see a difference. I am guessing you will run tagging on the inside ASAs to the distribution layer. My firewalls connect directly to aggregation switches with a dedicated vlan that runs HSRP/VRRP between each set of firewalls and the agg &#xA;switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to private line traffic, I do not use ASA but I think they have the zones construct like IOS ZBF and you will keep VPN traffic from going to/from the private line traffic without going through packet filtering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like default route points to the 5540 and you will use more specific routes to get to your internal VPN access pools and the private line addresses.&#xA;The 5545 has the default route pointing to the 5540 and it is ok for VPN traffic to hit the internet directly (don't know if you split tunnel on your VPN clients) and other routes to your internal address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I can not see any real problems with your plan. But some of my above assumptions may be wrong&lt;/p&gt;&#xA;" OwnerUserId="1461" LastEditorUserId="775" LastEditDate="2013-08-25T18:16:52.517" LastActivityDate="2013-08-25T18:16:52.517" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2971" PostTypeId="2" ParentId="2874" CreationDate="2013-08-26T09:15:05.420" Score="2" Body="&lt;p&gt;I have deployed ASAs in similar scenarios and all went well, with careful planning and maintenance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the outside interface, first of all secure your OSPF process using MD5. You are to connect this interface to your L2-aggregate switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On your inside interface we can dive into:&#xA; - technically you can connect it to your L3 switch so you will split the role or the load between your network devices, also makes sense for a regular firewall (if at some moment you will have issues with your L2-aggreg devices, at least the network from bottom to the firewall is working)&#xA; - for this scenario as ASA is VPN-used it means you can also connect your inside to the L2-aggregation switches. Without those L2-aggreg switches your 5545 will become useless for your network. &#xA;Nevertheless for this choice you have to think about monitored interfaces as all your firewall physical interfaces will be connected to one physical device.&#xA;Bottom line: if I have ports and capacity for better logical and troubleshooting I would connect inside straight to L3-bottom-switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally regarding your 1st question:&#xA; I have used inside interface both as a shared network with the other inside firewall (you could run into some details with &lt;em&gt;same-security-traffic&lt;/em&gt; command and also as a dedicated network, than using bottom switches connect to the rest of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I prefer the last one as in this case VPN L2L filtering is done on the firewall (ASA 5545) instead of group-policy ACL (and then applying it to the tunnel-group). It is easy to manage, view, troubleshoot (for me) and also it keeps me away from some ASA more delicate traffic hairpin scenarios.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-08-26T09:15:05.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2973" PostTypeId="2" ParentId="2829" CreationDate="2013-08-26T11:17:24.497" Score="4" Body="&lt;p&gt;The command for doing this would be:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fw tab -t connections -u -f | grep 86400 \&#xA; |awk '{ split($41,a,&quot;/&quot;); if( a[1] &amp;lt; 82800) print $2,$9,$13,$15,$41; }' &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;86400 is the current TCP session timeout in seconds.&lt;br&gt;&#xA;Thanks to toottoot for the &lt;code&gt;-f&lt;/code&gt; flag.&lt;/p&gt;&#xA;" OwnerUserId="282" LastEditorUserId="775" LastEditDate="2013-08-27T00:48:52.677" LastActivityDate="2013-08-27T00:48:52.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2976" PostTypeId="2" ParentId="2962" CreationDate="2013-08-27T00:26:23.693" Score="10" Body="&lt;p&gt;When Ethernet was originally developed as a shared medium or bus with 10Base5 and 10Base2, collisions of frames were frequent (what else you would expect in a connection where you fork the signal by drilling a tap into the cable) and expected &lt;em&gt;as part of the design&lt;/em&gt;. Contrast this to today, when most everything is switched with separate collision domains and running full-duplex, where no one expects to see collisions.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The mechanism to share the &quot;ether&quot; employed &lt;a href=&quot;http://en.wikipedia.org/wiki/Carrier_sense_multiple_access_with_collision_detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;CSMA/CD&lt;/a&gt; (Carrier Sense Multiple Access/Collision Detection)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Carrier Sense meant that a station wanting to transmit must listen to the wire -- sense the carrier signal -- to ensure no one else was talking since it was Multiple Access on that medium. &lt;code&gt;Allowing 1500 bytes (though an arbitrary number as far as I can tell) was a compromise that meant a station could not capitalize the wire too long by talking too much at one time.&lt;/code&gt; The more bytes transmitted in a frame, the longer all other stations must wait until that transmission completes.  In other words, shorter bursts or smaller MTU meant other stations got more opportunity to transmit and a fairer share. The slower the rate of the transmission medium (10Mb/s), stations would have longer delays to transmit as the MTU increases (if allowed to exceed 1500).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;An interesting corollary question would be why the minimum frame size of 64 bytes?&lt;/strong&gt;  Frames were transmitted in &quot;slots&quot; that are 512 bits and took 51.2 microseconds for round-trip signal propagation in the medium.  A station has to not only listen to when to start talking by sensing the IFG (interframe gap of 96 bits), but to listen for collisions with other frames.  Collision Detection assumes maximum propagation delay and doubles that (to be safe) so it doesn't miss a transmission starting about the same time from the other end of the wire or a signal reflection of its own transmission when someone forgot the terminating resistor at the ends of the cable. The station must not complete the sending of its data before sensing a collision, so waiting 512 bits or 64 bytes guarantees this.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="65255" LastEditDate="2020-02-19T21:23:06.143" LastActivityDate="2020-02-19T21:23:06.143" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="2977" PostTypeId="1" AcceptedAnswerId="2978" CreationDate="2013-08-27T03:49:16.740" Score="8" ViewCount="6562" Body="&lt;p&gt;I have a network which has many devices sending data to 224.0.0.225 on a VLAN which spans multiple switches. Each device (aprox 12 of them) is sending reporting data at roughly 500-600 kbps. Each port on the VLAN, whether the receiver sends a join or not, is getting flooded with roughly 6mbps of multicast traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IGMP snooping is enabled on all the switches and the local VLAN.&lt;br&gt;&#xA;pim sparse-mode is configred on the mrouter/default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I do a &lt;code&gt;show ip igmp snooping groups&lt;/code&gt; on the switch, there is no entry in the snooping table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know 224.0.0.1 - 224.0.0.255 fall within the link-local reserved IP Multicast range meaning a router will not forward packets within this range. These ranges are also used for routing protocol chatter. eg) EIGRP, OSPF, HSRP...etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two questions:&lt;br&gt;&#xA;1) I think the answer is YES - for 224.0.0.1 224.0.0.255...does IGMPv2 ignore this range for snooping and does the switch just forward this to all ports?&lt;br&gt;&#xA;2) Is there a way to force IGMP to snoop this multicast traffic and only send it to the ports which request it with an IGMP join?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a feeling this is one of those instances where the application/programmers need to design their devices and application to respect scalable non-consumer networks. Thus they should be using a multicast address in the 239.0.0.0/8 range.&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="8499" LastEditDate="2018-03-19T15:46:41.553" LastActivityDate="2018-03-19T15:46:41.553" Title="IGMP snooping and link-local multicast addresses" Tags="|cisco|cisco-catalyst|multicast|igmp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2978" PostTypeId="2" ParentId="2977" CreationDate="2013-08-27T04:34:35.467" Score="8" Body="&lt;p&gt;I've kept digging around the internet....and I think I've answered my own question.&lt;br /&gt;&#xA;Now I need to go back to the application/device owners/developers and see what we can do or further lock these devices down to their own VLAN.&lt;/p&gt;&#xA;&lt;p&gt;Please leave comments or answers with any further advice.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4541&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4541 2.1.2&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Packets with a destination IP address outside 224.0.0.X which are&#xA;not IGMP should be forwarded according to group-based port&#xA;membership tables and must also be forwarded on router ports.&lt;/p&gt;&#xA;&lt;p&gt;This is the main IGMP snooping functionality for the data path.&#xA;One approach that an implementation could take would be to&#xA;maintain separate membership and multicast router tables in&#xA;software and then &amp;quot;merge&amp;quot; these tables into a forwarding cache.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Packets with a destination IP (DIP) address in the 224.0.0.X range&#xA;which are not IGMP must be forwarded on all ports.&lt;/p&gt;&#xA;&lt;p&gt;This recommendation is based on the fact that many host systems do&#xA;not send Join IP multicast addresses in this range before sending&#xA;or listening to IP multicast packets.  Furthermore, since the&#xA;224.0.0.X address range is defined as link-local (not to be&#xA;routed), it seems unnecessary to keep the state for each address&#xA;in this range.  Additionally, some routers operate in the&#xA;224.0.0.X address range without issuing IGMP Joins, and these&#xA;applications would break if the switch were to prune them due to&#xA;not having seen a Join Group message from the router.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="343" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-08-27T12:24:59.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2979" PostTypeId="1" CreationDate="2013-08-27T08:19:40.117" Score="4" ViewCount="3727" Body="&lt;p&gt;Is it possible to throttle traffic coming or going to a specific ip address on a cisco 877 running : C870-ADVIPSERVICESK9-M, 12.4(15)T12, RELEASE SOFTWARE (fc3)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Background: we have a WAN where thinclients login using citrix. When a big print job is sent, the desktop sessions suffer. So I would like to limit the traffic with source/destination the print server.&lt;/p&gt;&#xA;" OwnerUserId="2478" LastEditorUserId="775" LastEditDate="2013-08-27T09:20:19.857" LastActivityDate="2013-08-27T09:20:19.857" Title="cisco 877 router QoS on traffic with a specific destination" Tags="|cisco|router|qos|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2980" PostTypeId="2" ParentId="2979" CreationDate="2013-08-27T08:52:03.783" Score="6" Body="&lt;p&gt;What you describe would be something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all Printer&#xA; match access-group name Printer&#xA;!&#xA;policy-map WAN-OUT&#xA; class Printer&#xA;  shape average 1000000&#xA; class class-default&#xA;  fair-queue&#xA;  random-detect&#xA;!&#xA;int WAN&#xA;  service-policy output WAN-OUT&#xA;!&#xA;ip access-list extended Printer&#xA; permit ip any 192.0.2.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would match traffic going to 192.0.2/24 and shape it to 1Mbps. However I don't think this is necessarily what you want, what if there is no other demand to the circuit, wouldn't you want print job to get full capacity at that time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe classify traffic in 3 classes, like&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Important&lt;/li&gt;&#xA;&lt;li&gt;Normal&lt;/li&gt;&#xA;&lt;li&gt;Scavanger&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Configuration could be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any Important&#xA; match access-group name Important&#xA; match precedence 4  5  6  7 &#xA; match precedence 1  2  3 &#xA;class-map match-any Normal&#xA; match precedence 0 &#xA; match access-group name Normal&#xA;class-map match-any Scavanger&#xA; match access-group name Scavanger&#xA;!&#xA;class-map match-all QOS5&#xA; match qos-group 5&#xA;class-map match-all QOS3&#xA; match qos-group 3&#xA;class-map match-all QOS0&#xA; match qos-group 0&#xA;!&#xA;policy-map LAN-IN&#xA; class Scavanger&#xA;  set qos-group 0&#xA; class Important&#xA;  set qos-group 5&#xA; class Normal&#xA;  set qos-group 3&#xA;!&#xA;policy-map WAN-OUT&#xA; class QOS5&#xA;  priority percent 80&#xA; class QOS3&#xA;  bandwidth percent 20 &#xA; class QOS0&#xA;!&#xA;int LAN&#xA;  service-policy input LAN-IN&#xA;int WAN&#xA;  service-policy output WAN-OUT&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now in LAN ingress we match on traffic and give it internal qos-group 5, 3, 0, these numbers are insignificant they could be anything, it's just way to differentiate the traffic without mangling the existing CoS/PREC/DSCP bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After we've marked the traffic in LAN ingress, on WAN egress we match on the earlier defined qos-groups and treat traffic differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here we give Important traffic 80% low-latency privilege to the capacity. For Normal traffic we give 20% contract, so if Important traffic sends 100% and you start to send Normal traffic, 20% of Important traffic would be dropped in favor of letting some Normal traffic pass. We give no contractual capacity to Scavanger class, it'll only send if either Important or Normal class are using less than contractual capacity.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-08-27T08:52:03.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2981" PostTypeId="2" ParentId="2979" CreationDate="2013-08-27T08:52:59.603" Score="5" Body="&lt;p&gt;Given your aim is to avoid the Citrix sessions lagging, I would expect you'd prefer just to prioritise Citrix traffic over all other traffic? That way if something other than a large print job causes saturation, the same QoS still applies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've not tested this configuration explicitly with Citrix, but this is what I use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;NOTE: I'm assuming your 877 is an ADSL Modem/Router&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you want to define a &lt;strong&gt;class-map&lt;/strong&gt; to match the traffic you want to apply a QoS rule to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! You could match against traffic in other ways, such as via an ACL of some kind.&#xA;class-map match-any Citrix&#xA; match protocol citrix &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you want to define your QoS policy. I am assuming your WAN link is a public internet link. If you have some kind of private WAN link (assuming QoS is not still stripped), it would benefit you to have QoS on both incoming and outgoing traffic, and on both sides of the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the cases where QoS is stripped over the WAN link, though, the best you can do is to prioritise your upstream traffic so as to improve overall performance.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map OutboundPrioritisationPolicy&#xA; class Citrix&#xA;! In this example I'm allowing Citrix to take up to 70% of your upstream traffic,&#xA;! as it requires, which may be overkill, depending on how many sessions you have&#xA;! running and how important they are vs. other traffic.&#xA;    priority percent 70&#xA; ! I've also added fair-queue to all other traffic as I find it helps generally. &#xA; ! But this is optional for what you're trying to achieve.&#xA; class class-default&#xA;    fair-queue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you're using ADSL, you will need to apply a &quot;parent&quot; policy, which is the one that actually gets applied to the WAN interface. This has to do with the way virtual interfaces are used with ADSL, I believe. The maximum upload speed of the link must be enforced using a shaper.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Use the shape average command to define your maximum upload speed.&#xA;! In this case I've set it to 1.2 Mbps. But you will want to confirm your own maximum.&#xA;policy-map OutboundPrioritisationPolicyParent&#xA; class class-default&#xA;    shape average 1200000&#xA;  service-policy OutboundPrioritisationPolicy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, apply your policy to the appropriate interface, on the 877 I've done this before, it seemed to work &lt;strong&gt;(The line you want is the &quot;service-policy&quot; command)&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See here for reference: &lt;a href=&quot;https://supportforums.cisco.com/thread/2010527&quot; rel=&quot;noreferrer&quot;&gt;https://supportforums.cisco.com/thread/2010527&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! We want to apply the policy to the PVC interface&#xA;interface ATM0.1 point-to-point&#xA; atm route-bridged ip&#xA; pvc 8/35&#xA;  ! Policy added here&#xA;  service-policy output OutboundPrioritisationPolicy&#xA;  vbr-nrt 766 766&#xA;  tx-ring-limit 4&#xA;  encapsulation aal5mux ppp dialer&#xA;  dialer pool-member 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After you've applied your service policy, you would want to of course make sure it's working. There's two main things I usually do:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Firstly, and most easily, check the packet counters on the policy. They should be increasing on the policy-map you're trying to apply QoS rules to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) This is a bit more involved, and should be done after hours, but is a better test.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Setup a PC on the LAN running iperf or some other traffic generator&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Setup your traffic generator to send out enough traffic to saturate your upstream speed. So for example, if you have an ADSL line with a maximum upstream speed of 1 Mbps, you would want to generate close to that amount in order to get an easily noticeable degredation of quality for your Citrix clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: &lt;em&gt;iperf -c X.X.X -u -p 5001 --time 360 -i 3 -b 2&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case we are sending UDP:5001 traffic, for 6 minutes, with updates every 3 seconds. 2 Mbp/s of traffic is being generated to a destination of X.X.X.X (NOTE: If you generate UDP traffic then it's not strictly necessary to run the iperf server).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Try logging into Citrix, it should be noticeably horrible.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now apply your service-policy. It should be noticeably better.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Maybe try this a few times, make sure you notice a difference with and without QoS to ensure it's doing it's job.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="846" LastEditorUserId="846" LastEditDate="2013-08-27T09:19:37.927" LastActivityDate="2013-08-27T09:19:37.927" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2982" PostTypeId="2" ParentId="2977" CreationDate="2013-08-27T09:15:34.567" Score="6" Body="&lt;p&gt;There is another caveat: Depending on platform, the switch will punt &lt;strong&gt;all&lt;/strong&gt; link-local multicast to the CPU. This includes for example OSPF traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed this on Ciscos Catalyst 4500 which will send all 224.0.0.x traffic to the CPU. When the CPU is busy it will drop the packets, including your OSPF packets. Have fun debugging why your OSPF session(s) drop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also turning off igmp snooping on the platform does not help. At some time Cisco noticed that this is probably not the best idea and introduced the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list hardware capture mode vlan&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will bridge the multicast packets in hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/52sg/configuration/guide/secure.html#wp1128851&quot;&gt;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/52sg/configuration/guide/secure.html#wp1128851&lt;/a&gt; for details&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-08-27T09:15:34.567" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="2984" PostTypeId="2" ParentId="2604" CreationDate="2013-08-27T11:56:48.277" Score="3" Body="&lt;p&gt;I created a QinQ tunnel over dot1q trunk between a 3750 switch stack at each location, with physical cat5 cables off the 6500 core switch to create point to point tunnels to do the PAgP to each access switch. This is working so far as a good work around for lack of cable infrastructure between the 2 buildings.&lt;/p&gt;&#xA;" OwnerUserId="166" LastActivityDate="2013-08-27T11:56:48.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2985" PostTypeId="1" CreationDate="2013-08-27T12:07:09.217" Score="6" ViewCount="4826" Body="&lt;p&gt;I have a few routers and switches that were deployed to remote locations and the crypto key was not generated before they were shipped, they are working and I have SNMPv3 write access to them but I want to ssh to them without having to travel to site with console cable and laptop. Want to know snmpset oid to generate crypto key.&lt;/p&gt;&#xA;" OwnerUserId="166" LastActivityDate="2013-08-28T04:54:52.583" Title="What is the OID needed to generate a ssh crypto key on a Cisco switch or router running IOS using snmpset?" Tags="|snmp|ssh|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="2988" PostTypeId="2" ParentId="2985" CreationDate="2013-08-27T20:43:23.950" Score="2" Body="&lt;p&gt;I don't know if you can fix the SSH directly through SNMP. However, a lot of Cisco's suppport SNMP triggered config downloading or uploading from/to a TFTP server. You should be able to upload a new config containing the SSH stuff. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;mibName=CISCO-CONFIG-COPY-MIB&quot; rel=&quot;nofollow&quot;&gt;CISCO-CONFIG-COPY-MIB&lt;/a&gt;, available on IOS &gt;= 12.0. If you have the device config, you can create a new version including the SSH stuff and upload it. If not, first download the running config from the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Important note: uploading to the running config &lt;em&gt;merges&lt;/em&gt; your upload into the existing config, but uploading to the startup config &lt;em&gt;overwrites&lt;/em&gt; what's already there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco's instructions can be found &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_configuration_example09186a0080094aa6.shtml&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-08-27T20:43:23.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2989" PostTypeId="2" ParentId="2985" CreationDate="2013-08-28T01:21:16.693" Score="3" Body="&lt;p&gt;You can use the below to just send a list of commands to the router the file has the actual commands&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config t&#xA;crypto key generate rsa&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then ssh to the router and complete the config&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or just enable telnet if you can get away with it&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config t&#xA;vty 0 4 &#xA;transport input ssh telnet&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a perl script &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a008009463e.shtml&quot; rel=&quot;nofollow&quot;&gt;that does this&lt;/a&gt; to reset enable passwords&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mib is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostConfigSet .1.3.6.1.4.1.9.2.1.53 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the management station command line, with the use of the MIB object hostConfigSet, enter this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% snmpset -t 60 172.16.99.22 \&#xA;    private .1.3.6.1.4.1.9.2.1.53.171.68.191.135 \&#xA;    s router-config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% snmpset -t 60 172.16.99.22 private \&#xA;  enterprises.9.2.1.53.171.68.191.135 = &quot;router-config&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1461" LastEditorUserId="775" LastEditDate="2013-08-28T04:54:52.583" LastActivityDate="2013-08-28T04:54:52.583" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="2990" PostTypeId="1" AcceptedAnswerId="2993" CreationDate="2013-08-28T07:42:38.243" Score="12" ViewCount="7838" Body="&lt;p&gt;I am asking this question which is related to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2900/using-snmp-to-retrieve-the-arp-and-mac-address-tables-from-a-switch?rq=1&quot;&gt;a question I previously asked&lt;/a&gt; and was comprehensively answered by @MikePennington.  When I asked that question, I intended to know how to poll arp table from a switch, but in his answer, he included mac address tables as well.  Out of curiousity, I polled for the mac address tables. I used the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; sudo /usr/bin/snmpbulkwalk -v 2c -c public@1 -OXsq 10.0.0.98 .1.3.6.1.2.1.17.4.3.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In Mike`s solution, he had a clear result shown below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public@10 -OXsq \&#xA;    172.16.1.210 .1.3.6.1.2.1.17.4.3.1.2 &#xA;dot1dTpFdbPort[0:6:53:fe:39:e0] 52 &#xA;dot1dTpFdbPort[0:1d:a1:cd:53:46] 52 &#xA;dot1dTpFdbPort[0:30:1b:bc:a7:d7] 52&#xA; dot1dTpFdbPort[0:80:c8:0:0:0] 52 &#xA;dot1dTpFdbPort[38:ea:a7:6d:2e:8e] 52 &#xA;dot1dTpFdbPort[80:ee:73:2f:b:40] 52 &#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a clear solution in which you can easily tell the port and Mac Address. However, my own solution comes out in the form of&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iso.3.6.1.2.1.17.4.3.1.2.0.20.42.49.139.235 25&#xA;iso.3.6.1.2.1.17.4.3.1.2.0.21.23.10.229.224 25&#xA;iso.3.6.1.2.1.17.4.3.1.2.28.111.101.71.85.113 25&#xA;iso.3.6.1.2.1.17.4.3.1.2.28.111.101.174.157.35 25&#xA;iso.3.6.1.2.1.17.4.3.1.2.48.133.169.153.178.62 25&#xA;iso.3.6.1.2.1.17.4.3.1.2.60.208.248.182.16.108 25&#xA;iso.3.6.1.2.1.17.4.3.1.2.108.240.73.231.208.120 25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand that the port number is 25, but do the other numbers represent a MAC address and if so, why are they different from the give solution?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any Help will be truly appreciated. I am polling a Cisco Catalyst 2960 switch.&lt;/p&gt;&#xA;" OwnerUserId="2421" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-09-21T11:44:13.310" Title="Translating SNMPWALK output into human-readable format" Tags="|cisco|cisco-catalyst|snmp|management|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="2991" PostTypeId="2" ParentId="2796" CreationDate="2013-08-28T08:35:33.840" Score="2" Body="&lt;p&gt;I would suggest to create a 2nd Remote-Access tunnel group for all your remote-access users.&#xA;Start migrating them, one by one and when you are done you can delete the existing Default L2L Group, or you can change the PSK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you encounter some users that don't want to change, you can enforce a specific VPN Client version and inform them you are doing a major security update.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-08-28T08:35:33.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2993" PostTypeId="2" ParentId="2990" CreationDate="2013-08-28T13:13:33.840" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;my own solution comes out in the form of&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;iso.3.6.1.2.1.17.4.3.1.2.0.20.42.49.139.235 25&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;... do the other numbers represent a MAC address and if so, why are they different from the give solution?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First, I apologize for not including this dependency...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MIB tables you're polling are indexed by a value.  In this case, you're polling &lt;code&gt;dot1dTpFdbPort&lt;/code&gt; (which shows up as &lt;em&gt;iso.3.6.1.2.1.17.4.3.1.2&lt;/em&gt;, if you don't have the BRIDGE-MIB loaded).  That OID is indexed by a mac-address.  Therefore, &lt;em&gt;0.20.42.49.139.235&lt;/em&gt; is the mac-address in dotted-decimal format...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see the results you expect, you need to &lt;a href=&quot;ftp://ftp.cisco.com/pub/mibs/v2/v2.tar.gz&quot;&gt;get the v2 mibs from Cisco's FTP site&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;mkdir /usr/share/snmp/mibs/cisco&lt;/code&gt; (as root)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;cd /usr/share/snmp/mibs/cisco&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Copy &lt;code&gt;v2.tar.gz&lt;/code&gt; that you just downloaded to &lt;code&gt;/usr/share/snmp/mibs/cisco/v2.tar.gz&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;tar xvfz v2.tar.gz&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Edit &lt;code&gt;/etc/snmp/snmp.conf&lt;/code&gt; and make this the first line in the file: &lt;code&gt;mibdirs +/usr/share/snmp/mibs/cisco&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Assumptions&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You're using NET-SNMP libraries to poll&lt;/li&gt;&#xA;&lt;li&gt;Your NET-SNMP default MIBs are loaded in &lt;code&gt;/usr/share/snmp/mibs/&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Your NET-SNMP configuration is in &lt;code&gt;/etc/snmp/snmp.conf&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-08-28T13:13:33.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2994" PostTypeId="1" CreationDate="2013-08-28T13:46:05.413" Score="4" ViewCount="380" Body="&lt;p&gt;The problem is: I generate a key pair on a switch and when i use: show crypto key mypubkey rsa it shows two keys. A geral-purpose key and an encryption key. The general-purpose key is the key i created because it has the same of my switch plus my domain. The other has the same name but with .server termination. I read on cisco website:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Secure Shell (SSH) may generate an additional RSA key pair if you generate a key pair on a router having no RSA keys. The additional key pair is used only by SSH and will have a name such as {router_FQDN}.server. For example, if a router name is &quot;router1.cisco.com,&quot; the key name is &quot;router1.cisco.com.server.&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So. What is this key for?&lt;/p&gt;&#xA;" OwnerUserId="2284" LastEditorUserId="2284" LastEditDate="2013-08-28T13:51:07.730" LastActivityDate="2013-08-28T14:19:24.347" Title="Cisco switch generates two pairs of keys" Tags="|cisco|switch|ssh|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="2995" PostTypeId="1" AcceptedAnswerId="2997" CreationDate="2013-08-28T14:17:33.677" Score="15" ViewCount="20960" Body="&lt;p&gt;A small company has 2 Cisco Catalyst 3550, with 24 ports each, connecting their equipaments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some trouble, we found that two NICs had the same MAC address. After the initial reaction of blaming who bought such NICs, etc., I began to wonder: if the NICs belong to separate VLANs, would it still cause problems?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could I connect each NIC to a different VLAN and work ok (except in the future, if someone forget that and connect them to the same VLAN again) ?&lt;/p&gt;&#xA;" OwnerUserId="145" LastEditorUserId="33" LastEditDate="2015-07-03T03:56:08.950" LastActivityDate="2015-07-03T03:56:08.950" Title="Will duplicated MAC address give problems, if in different VLANs?" Tags="|vlan|mac-address|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="2996" PostTypeId="2" ParentId="2994" CreationDate="2013-08-28T14:19:24.347" Score="5" Body="&lt;p&gt;General-purpose key pairs may be used for multiple purposes, including SSL (e.g., for the HTTPS management interface) and IPsec. The SSH key pair is reserved for SSH and no other tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One practical difference in management between IPsec/SSL and SSH keys is that the former are typically signed (either by a public CA or by a company's in-house certificate chain) and are often only used until the certificate expires, at which point they're replaced. SSH keys usually aren't signed, and their management is often handled on a different maintenance schedule.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-08-28T14:19:24.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2997" PostTypeId="2" ParentId="2995" CreationDate="2013-08-28T14:24:05.320" Score="12" Body="&lt;p&gt;As long as the NICs are in completely different layer-2 broadcast domains, it shouldn't be a problem, but it is a headache waiting to happen when one of them is moved. If there are just two offending NICs, it's probably better to replace one.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-08-28T14:24:05.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="2998" PostTypeId="1" CreationDate="2013-08-28T14:49:32.107" Score="3" ViewCount="9190" Body="&lt;p&gt;I'm trying to test ACL's coming inbound from a remote peer site (using packet-tracer) (IPSec site to site VPN) and I wanted to know what interfaces ACL's are checked in this case and which interface I use for packet-tracer command?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If incoming IP's are coming in over a site-to-site tunnel do they hit the inside interface's ACL's? Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2013-08-28T16:47:59.877" Title="How does an ASA view packets coming from a remote site-to-site peer? As inside or outside?" Tags="|cisco-asa|vpn|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="2999" PostTypeId="1" AcceptedAnswerId="3005" CreationDate="2013-08-28T14:59:33.460" Score="4" ViewCount="464" Body="&lt;p&gt;We're a smallish business about to move to a larger space, so I have a question about the way we've wired our network. Our current scheme is to use smaller switches (8 ports) at each &quot;cluster&quot; of desks, as shown here. (A cluster includes four workstations, and usually a printer and scanner, so generally 6 devices total). Each 8-port switch connects to a central 24-port switch. We have four such clusters, and everything has been fine. When we move, we'll have two more of these clusters. I just want to make sure that this setup is OK as we expand. I suppose the alternative is to run a dedicated ethernet cable for each desktop/device, but this would require a lot of wiring, and also a much bigger central switch. So I'm just curious as to reactions this design. Thanks in advance. &lt;a href=&quot;https://i.stack.imgur.com/l2uRW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Picture is here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2496" LastEditorUserId="2496" LastEditDate="2013-08-28T15:31:01.580" LastActivityDate="2013-08-28T18:09:46.113" Title="Question about design of a small/medium office network" Tags="|switch|design|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3000" PostTypeId="2" ParentId="2998" CreationDate="2013-08-28T16:47:59.877" Score="7" Body="&lt;p&gt;They originate on the outside interface. This is one of my NAT entries for an international site connected via L2L:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside-office,ISPA) source static Corporate Corporate destination static France France no-proxy-arp route-lookup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ISPA -&gt; translates to outside for most people, 0 security interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Corporate -&gt; object-group network containing the local/MPLS subnets&lt;/p&gt;&#xA;&#xA;&lt;p&gt;France -&gt; object-group network containing the remote site subnets&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This applies to the ACLs as well. However you will need to use:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no sysopt connection permit-vpn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Otherwise the VPN traffic will bypass the ACLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However you can use a VPN filter instead of placing ACLs on the interface and avoid turning off the &lt;code&gt;sys opt connection permit-vpn&lt;/code&gt; option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example may be found here: &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml#configs&quot;&gt;http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9a87.shtml#configs&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-08-28T16:47:59.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3003" PostTypeId="1" AcceptedAnswerId="3004" CreationDate="2013-08-28T17:29:40.380" Score="6" ViewCount="8107" Body="&lt;p&gt;In an office building with 20-some employees, our internet service sometimes drops to about .3 Mbits/sec from 5 Mbits/sec. I use speedtest.net to test the speed. When the speed drops, how can I tell the source of the issue?  Namely, are my speedtest results affected by employee streaming/downloading/etc, as opposed to an ISP problem?  Would I need a virtually quiet network to accurately test speed?&lt;/p&gt;&#xA;" OwnerUserId="2499" LastActivityDate="2013-08-28T21:46:05.493" Title="Simple Question: Does High Bandwidth usage affect Speedtest.net Results?" Tags="|testing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3004" PostTypeId="2" ParentId="3003" CreationDate="2013-08-28T17:50:01.187" Score="6" Body="&lt;p&gt;To answer your first question, yes high bandwidth use will affect speedtest.net results. And yes, you would be best to wait until a time of low traffic to get a better/more accurate reading of your maximum possible speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another metric of maximum possible speed would be (assuming you are connecting via ADSL) the line sync speed as reported by your modem. &lt;em&gt;Although it may not be as accurate, this would allow you to find out the maximum without having to wait until low bandwidth periods.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of determining the source of the internet traffic, you will need to use some mechanism to examine the traffic going between your LAN and the internet. There are a number of ways you could do this, depending on what you have available:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You could issue &quot;show ip flow top-talkers&quot; from your router, if it is a Cisco IOS router and you have Netflow configured properly. This is probably the easiest way to determine who is using the most traffic, and where it's going.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You could examine the NAT translations table on your router (assuming you use NAT), to show you which internal IPs have the most translations. This would give you a &lt;em&gt;rough&lt;/em&gt; idea as to where your bandwidth is going. But it's hardly the best indicator.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You could setup a mirror port on your LAN switch, to mirror traffic to/from the router, and then use a packet capture utility such as Wirekshark to analyse the traffic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You could setup a PC as a bridge to sit between your router and your LAN, with internet traffic passing through it, allowing you to again run a packet capture utility and analyse it to find the culprit(s). &lt;strong&gt;NOTE: In this case, you risk slowing down your internet speed while you do the capture. This would be best left until after-hours if done.&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Cisco 'Top Talkers' Example Config&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Configure top-talkers&#xA;ip flow-top-talkers&#xA; top 100&#xA; sort-by bytes&#xA;&#xA;! Configure NetFlow on the appropriate interface on the router&#xA;interface Vlan1&#xA; ip flow ingress&#xA; ip flow egress&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="846" LastEditorUserId="846" LastEditDate="2013-08-28T18:03:28.160" LastActivityDate="2013-08-28T18:03:28.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3005" PostTypeId="2" ParentId="2999" CreationDate="2013-08-28T18:03:58.770" Score="4" Body="&lt;p&gt;Practically speaking, your setup as is will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For maximum performance (and less hardware to run/power - all those 8-port switches add up) a single 24 (or, as expansion might require, 48) port switch and wires is better (so long as the wires are less than 100 meters - which you have said they should be); any pair of devices can be connected directly with that setup, and one computer in a cluster using bandwidth to the file server will not impact another computer in the same cluster accessing the internet - in the current setup, it will. How much that's a problem depends on use/expectations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A middle path, if the switches allow, would be to use a trunked pair of ports from each 8 port switch to the central switch - it's not AS good as the one-big-switch option, but it's better than 4-6 switches connected by a single port to the central switch.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2013-08-28T18:09:46.113" LastActivityDate="2013-08-28T18:09:46.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3007" PostTypeId="1" CreationDate="2013-08-28T18:19:15.587" Score="7" ViewCount="3361" Body="&lt;p&gt;In an Ethernet frame header, the destination MAC (DMAC) is placed before the source MAC for obvious reasons (stations accept based on DMAC). But why is not the same thing maintained for destination IP (DIP) and source IP (SIP) in the IP Header?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is SIP ahead of DIP in an IP Frame header, unlike in an Ethernet frame where DMAC is ahead of SMAC?&lt;/p&gt;&#xA;" OwnerUserId="2501" LastEditorUserId="189" LastEditDate="2013-08-28T19:40:49.020" LastActivityDate="2013-08-28T23:55:07.370" Title="Position of source and destination IP in an IP packet" Tags="|ethernet|ipv4|mac-address|" AnswerCount="1" CommentCount="4" ClosedDate="2021-01-04T01:55:17.803" ContentLicense="CC BY-SA 3.0" />
  <row Id="3008" PostTypeId="2" ParentId="3003" CreationDate="2013-08-28T21:46:05.493" Score="2" Body="&lt;p&gt;If your router or switch has SNMP functions, it's useful to simply monitor traffic on the interfaces with a simple SNMP reporting tool running on your computer - then you will see the traffic that is going on. If you have a 5Mb connection and it's flowing at 5Mb, you might well have a hard time getting more than 0.3 in edgewise to speedtest - but you'd know that 5Mb was flowing somewhere, so it's not an ISP problem. If nothing is moving and you can only get 0.3Mb to speedtest, then you might have an ISP problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your switch(es) do SNMP, then you'd also know where (on your network) it's flowing to. SNMP capable switches allow tracking the culprit (or legitimate user, if the company is doing things that eat bandwidth...) down to the port level without needing to do detailed analysis - if ports map directly to computers, you can then choose whether you want to talk to the person, or do detailed analysis from that point before talking to them. There are many complex and/or expensive SNMP reporting tools, but for a small office simple and free ones may be adequate, at least to get started. &lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2013-08-28T21:46:05.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3009" PostTypeId="2" ParentId="3007" CreationDate="2013-08-28T23:55:07.370" Score="3" Body="&lt;p&gt;The idea was to know as soon as possible whether a frame was multicast; the network byte order was screwed up slightly in the design, so that's in the second instead of the first nibble.&lt;/p&gt;&#xA;" OwnerUserId="56" LastActivityDate="2013-08-28T23:55:07.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3010" PostTypeId="2" ParentId="2995" CreationDate="2013-08-28T23:59:51.037" Score="7" Body="&lt;p&gt;It's very common to have the same MAC address in multiple VLANs.  Look at any Catalyst 6500/7600 router, for example: all its routed interfaces will have the same MAC address.  Same goes for Brocade MLX/XMR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All switches these days index their CAM on (MAC, VLAN) instead of merely (MAC); your Catalyst 3550 certainly does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should switch network card vendors if they're really identical.  I once lost a crate of beer to a co-worker when I thought I had two NICs with the same MAC address and he replied with &quot;Want to bet?&quot; and it turned out I and by that point a few other co-workers too had read over a few bytes in the middle that differed.&lt;/p&gt;&#xA;" OwnerUserId="56" LastActivityDate="2013-08-28T23:59:51.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3011" PostTypeId="1" CreationDate="2013-08-29T00:21:47.010" Score="6" ViewCount="214" Body="&lt;p&gt;Is the WIC plug and play or are there commands that I need to run? The router is not showing the interfaces. I tried using the sh diag and it didn't show anything.&lt;/p&gt;&#xA;" OwnerUserId="2502" LastEditorUserId="775" LastEditDate="2013-08-29T02:08:22.953" LastActivityDate="2013-08-29T02:08:22.953" Title="Cisco 3620, installing nm-2fe2w" Tags="|cisco|router|cisco-ios|cisco-ios-12|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3012" PostTypeId="1" CreationDate="2013-08-29T01:50:48.797" Score="20" ViewCount="100401" Body="&lt;p&gt;I've been doing some work with some big businesses and so far I've learned yellow is internet and blue is phone. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a standard or is this just a personal chose? Do colors mean different tasks?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="8499" LastEditDate="2018-12-21T04:03:11.060" LastActivityDate="2019-09-21T17:55:27.487" Title="Cable Colors and Purpose" Tags="|layer1|cable|cabling|best-practices|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3013" PostTypeId="1" CreationDate="2013-08-29T02:00:45.733" Score="5" ViewCount="296" Body="&lt;p&gt;I'm currently looking at the Cisco RV042 VPN router, and I am wondering if I will be able to setup individual networks with it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I know which routers or firewalls are capable of setting up separate networks?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="775" LastEditDate="2013-08-29T02:17:57.167" LastActivityDate="2016-12-05T22:05:17.133" Title="Are VPN Routers the same as a Router" Tags="|cisco|router|routing|firewall|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3014" PostTypeId="2" ParentId="3011" CreationDate="2013-08-29T02:07:56.810" Score="4" Body="&lt;p&gt;You're running IOS 11, but you need one of these (or higher) for the nm-2fe2w card to work...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;12.0(7)XK&lt;/li&gt;&#xA;&lt;li&gt;12.1(1)T&lt;/li&gt;&#xA;&lt;li&gt;12.1(5)YB&lt;/li&gt;&#xA;&lt;li&gt;12.2(1)&lt;/li&gt;&#xA;&lt;li&gt;12.2(2)T&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you have enough DRAM / Flash, I would go with the latest 12.2 for the Cisco3620... that's 12.2(26c)GD...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI, the &lt;code&gt;c3620-d-mz.122-26c.bin&lt;/code&gt; image will fit on 32M DRAM and 8M flash... avoid 12.2T if possible.  As we discussed in comments, load it on a PCMCIA with another 3600 and sneakernet.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-08-29T02:07:56.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3015" PostTypeId="1" AcceptedAnswerId="3017" CreationDate="2013-08-29T02:42:34.887" Score="4" ViewCount="1853" Body="&lt;p&gt;I always has this question in my mind.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, FM Radio Station and Radio player, strong signal from Radio Station could help, because Station --&gt; player is one direction only communication.   &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;But in the case of WIFI, is it the same? high power wifi from router could be helpful?  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What if router wifi --&gt; computer is very strong, but computer wifi --&gt; router is very weak.&lt;br&gt;&#xA;The network feedback from computer back to internet will fail anyway, no matter how strong is the router?  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Am I understanding is correct?  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;So.....Repeater is a must to solve weak signal problem?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user2503" LastActivityDate="2013-08-29T13:49:56.050" Title="Is router with high penetrate power WIFI really useful?" Tags="|wireless|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3016" PostTypeId="2" ParentId="3012" CreationDate="2013-08-29T03:01:35.510" Score="7" Body="&lt;p&gt;As far as I know there is no standard for colors in twisted pair ethernet pigtails. As Mike already explained, color codes are local to the facility and different facilities could use different color codes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding optical fiber pigtails, there is a standard color code for them. SMF pigtails are yellow and MMF are blue or orange depending on its core diameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have further details optical fiber cable colors in the following link: &lt;a href=&quot;http://www.thefoa.org/tech/ColCodes.htm&quot;&gt;http://www.thefoa.org/tech/ColCodes.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2013-08-29T03:01:35.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3017" PostTypeId="2" ParentId="3015" CreationDate="2013-08-29T03:42:05.663" Score="5" Body="&lt;p&gt;What you are describing is an imbalanced power situation, where one station (the access point) is transmitting at a higher power setting than the others.  Increasing the transmit power of the AP will not really increase your coverage as your client has to be able to transmit back to the AP as you indicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if the majority of your traffic is downstream (from AP to client), then this can sometimes increase performance.  The reason this can help is that the larger data frames (in this case the majority of traffic) can be transmitted and received more reliably at higher data rates, with less retries/loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful though as this can also lead to a number of situations where you will actually hurt your performance.  For instance, setting the transmit power too high (higher than the manufacturer intended) can increase the distortion of a signal (especially with cheaper hardware).  In addition, some hardware will not allow you to increase the transmit power above a certain point, even if the firmware seems to indicate you can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, you are better off using a passive means of producing gain, such as a higher dBi antenna.  This will produce an increase for both transmit and receive signal strength.  Make sure you understand how this will affect your environment (for instance a higher gain dipole will get you more signal strength on the horizontal/azimuth plane than a lower gain dipole, but it reduce the vertical/elevation providing less coverage above/below the plane of the antenna).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for a repeater being a must to solve weak signal problems, I have found that often repeaters create more problems than they solve.  They will typically decrease performance of a busy wireless network and can introduce other problems as well (hidden node, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of repeaters, I would recommend additional APs to provide additional coverage.  You can do this by planning the placement of the additional APs or using directional/semi-directional antennas forming an &quot;AP array&quot; from a central location.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-08-29T03:42:05.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3018" PostTypeId="2" ParentId="2954" CreationDate="2013-08-29T04:17:34.557" Score="5" Body="&lt;p&gt;As I recall (and I will admit I am too busy ATM to go research this myself), the RJ standards define the mechanical characteristics of the connector (shape, size, contacts, etc).  They do not define the manner of crimping the connector to a cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each manufacturer could make their own decisions on the manner of crimping, but there isn't really much you can vary in this process.  The result is that there were two major crimp dies and types of connectors that provided at least the majority (or possibly the entirety) of the market.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is true prior to Cat6.  With Cat6 it is more difficult to adhere to the standard when making terminations, as you have very little room to &quot;untwist&quot; pairs and need to maintain proper separation of the pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This led to a whole new range of connector products and tools that may or may not be compatible with older tools.  For instance, I have seen Cat6 connectors where you wire the cable to an &quot;insert&quot; that is then inserted and crimped into the connector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Morale of the story is that you need to do your research and make sure that you are getting connectors that work with your current tools or buy the right tools with the connectors.  On top of that you need to know what you are doing or you may produce cables that will only pass a Cat5 certifications at the extra costs of Cat6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My advice generally, and especially if you are looking to do Cat6 or better, buy your cables pre-manufactured.  The failure rate of hand made cables is much higher and can cost more in troubleshooting/downtime in the long run.  Especially since many of these are made in organizations that are &quot;trying to save money&quot; and also don't have the tools to properly test the cables they are making (certification testers are not cheap).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-08-29T04:17:34.557" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3019" PostTypeId="2" ParentId="3012" CreationDate="2013-08-29T05:45:50.150" Score="7" Body="&lt;p&gt;The colors for RJ45 cables are not specified. You can get any color you want. In the DC we color-code length:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0,5m yellow&lt;/li&gt;&#xA;&lt;li&gt;1,0m white&lt;/li&gt;&#xA;&lt;li&gt;2,0m blue&lt;/li&gt;&#xA;&lt;li&gt;...&lt;/li&gt;&#xA;&lt;li&gt;Everything &gt;20m white again&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In the office we use black cables for all equipment as it doesn't stick out. (Bright orange/red in a snazzy conference room doesn't look too good IMHO.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &lt;strong&gt;optical cables&lt;/strong&gt; &lt;em&gt;most of the time&lt;/em&gt; you've got &lt;strong&gt;yellow&lt;/strong&gt; for &lt;strong&gt;SM&lt;/strong&gt; cables, &lt;strong&gt;orange&lt;/strong&gt; for &lt;strong&gt;MM&lt;/strong&gt; cables. Sometimes MM cables come in &lt;strong&gt;aqua&lt;/strong&gt; when they have &lt;strong&gt;50µm laser-optimized&lt;/strong&gt; cores.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Please beware:&lt;/strong&gt; This is not always the case. I've seen enough yellow MM cables and orange SM cables to always check the print on the cable. MM is often orange whatever the core size is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the standard colors for &lt;strong&gt;connectors&lt;/strong&gt; are &lt;strong&gt;blue&lt;/strong&gt; for &lt;strong&gt;PC/UPC (0°)&lt;/strong&gt; and &lt;strong&gt;green&lt;/strong&gt; for &lt;strong&gt;APC (8°)&lt;/strong&gt; connectors on SM cables. Again, this is for most of the cables, not all of them. Better check before connecting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information on Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Optical_fiber_cable#Color_coding&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Optical_fiber_cable#Color_coding&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="3912" LastEditDate="2014-11-08T09:02:04.887" LastActivityDate="2014-11-08T09:02:04.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3020" PostTypeId="2" ParentId="3013" CreationDate="2013-08-29T06:05:25.003" Score="4" Body="&lt;p&gt;Yes, VPN routers are also routers. So you just have to carefully read the router datasheet/documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are looking to &quot;vpn router&quot;, this usually names a small business product, marketed with VPN to make you buy it. I wouldn't expect to have broad capabilities, nevertheless some products allows you to splin LAN into several VLANs or at least use one port as DMZ (basically offering you two &quot;Lan ports&quot;).&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-08-29T06:05:25.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3021" PostTypeId="2" ParentId="3015" CreationDate="2013-08-29T07:27:23.613" Score="1" Body="&lt;p&gt;Also I want to share one more case in addition to the brilliant answer of YLearn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have powerful signal you get a better coverage. But not always a better coverage is better for you. The better coverage allows more client devices to connect. More client devices make more load on your access point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm agree with YLearn. You need to add more AP to get bigger coverage.&lt;/p&gt;&#xA;" OwnerUserId="2453" LastActivityDate="2013-08-29T07:27:23.613" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3022" PostTypeId="1" AcceptedAnswerId="3046" CreationDate="2013-08-29T10:10:35.663" Score="13" ViewCount="8238" Body="&lt;p&gt;I am trying to recover a root password on an MX80 but I'm receiving some errors and have no idea what they mean (it's not live so suggestive &quot;disruptive&quot; steps is acceptable);&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The steps I have taken are as follows;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Reboot the router, at the prompt &lt;code&gt;Hit [Enter] to boot immediately, or space bar for command prompt&lt;/code&gt; - I hit space&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I enter &lt;code&gt;boot -s&lt;/code&gt; to boot into single user mode&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;At the prompt &lt;code&gt;Enter full pathname of shell or 'recovery' for root password recovery or RETURN for /bin/sh:&lt;/code&gt; I enter &lt;code&gt;recovery&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Once into the CLI I enter configuration mode and then attempt to reset root password and commit the config;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is were I experience the errors; What do they mean, and how can I correct this? Does it even need correcting (I'd assume so!):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit]&#xA;root# set system root-authentication plain-text-password &#xA;New password:&#xA;Retype new password:&#xA;&#xA;[edit]&#xA;root# commit    &#xA;error: could not open database: /var/run/db/juniper.data: No such file or directory&#xA;error: Database open failed for file '/var/run/db/juniper.data': No such file or directory&#xA;error: commit failed: daemon file propagation failed&#xA;&#xA;[edit]&#xA;root# WATCHDOG_TIMER : Loss of soft watchdog&#xA;panic: Loss of soft watchdog&#xA;Entering boot mastership relinquish phase&#xA;KDB: enter: panic&#xA;[thread pid 11 tid 100005 ]&#xA;Stopped at      kdb_enter+0x1a4:        addis   r3, r0, -0x5f7a&#xA;db&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The MX80 is running JunOS 11.4R1.14. I have rebooted and the password hasn't been reset. Should I try again, or is something wrong with this router which I should address first? I don't want to damage anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an update to this; Today I booted into recovery mode again and did nothing, I was on the phone with the router sitting at the &quot;root&gt;&quot;. Whilst on the phone for a few minutes the router suddenly had a panic;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Enter full pathname of shell or 'recovery' for root password recovery or RETURN for /bin/sh: recovery&#xA;&#xA;Performing filesystem consistency checks ...&#xA;/dev/da0s1a: 1466 files, 91908 used, 361032 free (56 frags, 45122 blocks, 0.0% fragmentation)&#xA;/dev/da0s1e: 9 files, 8 used, 50273 free (17 frags, 6282 blocks, 0.0% fragmentation)&#xA;&#xA;Performing mount of main filesystems ...&#xA;&#xA;Performing filesystem consistency of secondary filesystems ...&#xA;/dev/da1s1f: 232 files, 362550 used, 1105677 free (125 frags, 138194 blocks, 0.0% fragmentation)&#xA;&#xA;Performing mount of secondary filesystems ...&#xA;Verified manifest signed by PackageProduction_11_4_0&#xA;Verified jboot signed by PackageProduction_11_4_0&#xA;Verified jbase-ppc-11.4R1.14 signed by PackageProduction_11_4_0&#xA;Mounted jkernel package on /dev/md1...&#xA;Verified manifest signed by PackageProduction_11_4_0&#xA;veriexec: fingerprint for dev 73, file 49356 f743694d46ccdfd6bc72f0793c1cc0e8e5bdf80e != b3dfc26ab4c595f569e86791aa3dcfa4a277892c&#xA;Verified jkernel-ppc-11.4R1.14 signed by PackageProduction_11_4_0&#xA;Mounted jpfe package on /dev/md2...&#xA;Mounted jdocs package on /dev/md3...&#xA;Verified manifest signed by PackageProduction_11_4_0&#xA;Verified jdocs-11.4R1.14 signed by PackageProduction_11_4_0&#xA;Mounted jroute package on /dev/md4...&#xA;Verified manifest signed by PackageProduction_11_4_0&#xA;Verified jroute-ppc-11.4R1.14 signed by PackageProduction_11_4_0&#xA;Mounted jcrypto package on /dev/md5...&#xA;Verified manifest signed by PackageProduction_11_4_0&#xA;Verified jcrypto-ppc-11.4R1.14 signed by PackageProduction_11_4_0&#xA;machdep.bootsuccess: 1 -&amp;gt; 1&#xA;&#xA;Performing initialization of management services ...&#xA;mgd: error: could not open database: /var/run/db/schema.db: No such file or directory&#xA;mgd: error: Database open failed for file '/var/run/db/schema.db': No such file or directory&#xA;mgd: error: could not open database schema: /var/run/db/schema.db&#xA;mgd: error: could not open database schema&#xA;mgd: error: database schema is out of date, rebuilding it&#xA;mgd: error: could not open database: /var/run/db/juniper.data: No such file or directory&#xA;mgd: error: Database open failed for file '/var/run/db/juniper.data': No such file or directory&#xA;mgd: error: Cannot read configuration: Could not open configuration database&#xA;&#xA;Performing checkout of management services ...&#xA;&#xA;NOTE: Once in the CLI, you will need to enter configuration mode using&#xA;NOTE: the 'configure' command to make any required changes. For example,&#xA;NOTE: to reset the root password, type:&#xA;NOTE:    configure&#xA;NOTE:    set system root-authentication plain-text-password&#xA;NOTE:    (enter the new password when asked)&#xA;NOTE:    commit&#xA;NOTE:    exit&#xA;NOTE:    exit&#xA;NOTE: When you exit the CLI, you will be asked if you want to reboot&#xA;NOTE: the system&#xA;&#xA;Starting CLI ... &#xA;root&amp;gt; WATCHDOG_TIMER : Loss of soft watchdog&#xA;panic: Loss of soft watchdog&#xA;###Entering boot mastership relinquish phase&#xA;KDB: enter: panic&#xA;[thread pid 11 tid 100005 ]&#xA;Stopped at      kdb_enter+0x1a4:        addis   r3, r0, -0x5f7a&#xA;db&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I will reinstall and see what happens.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-08-30T09:53:45.043" LastActivityDate="2013-08-30T12:09:30.627" Title="JunOS: Password recovery has failed" Tags="|juniper-junos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3023" PostTypeId="2" ParentId="3012" CreationDate="2013-08-29T10:22:37.820" Score="24" Body="&lt;p&gt;Contrary to popular belief, there are cable color standards defined, just hardly anyone (myself included) follow them closely or at all.  Check local jurisdictions for variants.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://www.mohawk-cable.com/support/ansi-tia-eia-606-a.html&quot; rel=&quot;noreferrer&quot;&gt;ANSI/TIA/EIA-606-A&lt;/a&gt;&lt;/strong&gt; &lt;em&gt;Administration Standard for the Telecommunications&#xA;Infrastructure of Commercial Buildings&lt;/em&gt; or the updated &lt;a href=&quot;https://www.bicsi.org/uploadedfiles/bicsi_conferences/Winter/2013/presentations/Wednesday/9%20am/ANSI-TIA-606-B%20-%20The%20Updated%20Labeling%20Standard%20-%20Todd%20Fries%20-%20HellermannTyton.pdf&quot; rel=&quot;noreferrer&quot;&gt;ANSI/TIA/EIA-606-B&lt;/a&gt; documents these standards.  Generally, anyone who wants to following building standards should be familiar with &lt;a href=&quot;https://www.bicsi.org&quot; rel=&quot;noreferrer&quot;&gt;BICSI&lt;/a&gt; and vendors who are BICSI certified would be familiar with these as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cable colors are specified using Pantone numbers. These colors or their equivalent are to be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vc1pa.png&quot; alt=&quot;TIA-606-Colors&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;a href=&quot;http://generalnetworkerror.com/gallery/cheat-sheets/18588490&quot; rel=&quot;noreferrer&quot;&gt;Source/PDF on generalnetworkerror.com&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other color coded references for TIA/EIA 606 and other standards can be found at &lt;a href=&quot;http://www.huffmanreference.com/pdf_download.html#606%20Colors&quot; rel=&quot;noreferrer&quot;&gt;Huffmanreference.com.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2014-11-08T03:44:57.750" LastActivityDate="2014-11-08T03:44:57.750" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3025" PostTypeId="2" ParentId="3015" CreationDate="2013-08-29T13:43:24.387" Score="2" Body="&lt;p&gt;Your understanding is generally good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is one place (that I know of) where higher than standard power is/can be of some use - and that is where you are making a connection between two devices BOTH of which can run at higher than normal power. Of course, this also makes them more prone to interfere with other devices. In a rural environment where you have, for some reason, no cable/fiber between buildings, or getting fiber between buildings is on the plate but you need network before that, a dedicated pair wireless link (preferably with both ends also using horizontal polarization and directional antennas, so they interfere less with normal AP traffic that tends to be vertical polarized) can be of use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;End-user computers would NOT be connecting to the link in this case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But. Fiber beats the heck out of that all day every day. It's a temporary expedient at best, IME; I have done both.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2013-08-29T13:49:56.050" LastActivityDate="2013-08-29T13:49:56.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3029" PostTypeId="2" ParentId="2227" CreationDate="2013-08-29T16:28:26.670" Score="1" Body="&lt;p&gt;I think on conventional semi-tuned hardware you should be able to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Go out your host network stack&lt;/li&gt;&#xA;&lt;li&gt;Up your next network stack&lt;/li&gt;&#xA;&lt;li&gt;Back out that network stack with your 'new' packet&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In ~ 10 us at 10gig. If you really lock things down, that number can be significantly lower.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Almost ALL of the latency you're going to see is not from networking hardware/cables, but from your host systems. A reasonable cut through switch, (Arista, Gnodal, New Cisco, etc) is going to be sub 1us. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start with ensuring the processes consuming the UDP packets are pinned to the same core as your NIC interrupts. From there, ensure that coalescing on your NIC is disabled, and from there make sure you've got MSI-X and DCA on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're more serious...check out SolarFlare's OpenOnload. They have a great suite of tools for testing/verifying performance as well. &lt;/p&gt;&#xA;" OwnerUserId="2515" LastActivityDate="2013-08-29T16:28:26.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3031" PostTypeId="1" CreationDate="2013-08-29T17:26:30.113" Score="19" ViewCount="9732" Body="&lt;p&gt;Is it possible for the DHCP Server to determine the client operating system?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on a monitoring tool for gateways on local networks that is web-based and would like to be able to somehow determine what OS a device on the network is running and it seems to me the most obvious place to discover that is at the time an IP address is assigned by the DHCP Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failing that, I do know how to filter traffic on port 80 and pull the HTML header info, but this method relies on waiting for the device to surf the web and thus less desirable than a very early on detection/resolution, esp. as not every device will be used to browse the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have complete control of the gateway's configuration -- its running a pared down debian distro, so any other tools that would do the job -- DHCP, DNS, ARP, etc, I'm open to suggestions!&lt;/p&gt;&#xA;" OwnerUserId="2517" LastEditorUserId="775" LastEditDate="2013-08-29T18:14:52.877" LastActivityDate="2015-08-22T09:17:25.917" Title="Can DHCP Server determine client's OS?" Tags="|dhcp|protocol-theory|" AnswerCount="4" CommentCount="1" ClosedDate="2017-08-10T00:25:15.530" ContentLicense="CC BY-SA 3.0" />
  <row Id="3032" PostTypeId="2" ParentId="3031" CreationDate="2013-08-29T17:46:56.840" Score="2" Body="&lt;p&gt;As part of the DHCP process itself, I don't believe so. However, you could scrape your dhcpd logs, watch for dhcp acks and based on those execute an external process like nmap os fingerprinting to see if you can figure out what's behind the IP that was just assigned.&lt;/p&gt;&#xA;" OwnerUserId="1286" LastActivityDate="2013-08-29T17:46:56.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3034" PostTypeId="2" ParentId="3031" CreationDate="2013-08-29T17:59:19.077" Score="3" Body="&lt;p&gt;Some DHCP clients do not reliably disclose the OS information at boot.  As was mentioned above,  there is some intellectual property associated with these techniques; for instance,  Infoblox and Cisco ISE can build client OS profiles based on the dhcp packets they see.  Actually Cisco ISE includes some fairly sophisticated OS classification algorithms,  if you can send more than dhcp to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively,  you could use a heuristic like the &lt;a href=&quot;http://wiki.wireshark.org/DHCP#Windows_Endian_Bug_Detection&quot; rel=&quot;nofollow&quot;&gt;Windows endian bug&lt;/a&gt; in the &quot;seconds elapsed&quot; field, but relying on an OS bug is a poor way to handle OS detection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really must detect the OS without a dedicated vendor appliance, just issue an IP address, and scan the host with NMAP after sending the DHCP Ack.  Using HTTP headers is not as reliable as &lt;a href=&quot;http://nmap.org/&quot; rel=&quot;nofollow&quot;&gt;nmap&lt;/a&gt;, because anyone can change the UserAgent string if they want.  &lt;a href=&quot;http://nmap.org/&quot; rel=&quot;nofollow&quot;&gt;nmap&lt;/a&gt; is not 100% reliable at OS detection, but it is about as good as you will find if you must choose a single method for everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would make this a configurable option on the server since some folks may not like a default &lt;a href=&quot;http://nmap.org/&quot; rel=&quot;nofollow&quot;&gt;nmap&lt;/a&gt; scan on every DHCP host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example &lt;a href=&quot;http://nmap.org/&quot; rel=&quot;nofollow&quot;&gt;nmap&lt;/a&gt; OS scan against Windows7:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@myhost ~]$ sudo nmap -O 10.1.1.1&#xA;&#xA;Starting Nmap 5.51 ( http://nmap.org ) at 2013-08-24 16:20 CDT&#xA;Nmap scan report for 10.1.1.1&#xA;Host is up (0.00078s latency).&#xA;Not shown: 985 closed ports&#xA;PORT      STATE SERVICE&#xA;135/tcp   open  msrpc&#xA;139/tcp   open  netbios-ssn&#xA;445/tcp   open  microsoft-ds&#xA;&#xA;Device type: general purpose&#xA;Running: Microsoft Windows Vista|2008|7&#xA;OS details: Microsoft Windows Vista SP0 - SP2, Server 2008, or Windows 7 Ultimate&#xA;Network Distance: 5 hops&#xA;&#xA;OS detection performed. Please report any incorrect results at http://nmap.org/submit/ .&#xA;Nmap done: 1 IP address (1 host up) scanned in 5.25 seconds&#xA;[mpenning@myhost ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-05-27T17:38:38.373" LastActivityDate="2014-05-27T17:38:38.373" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3035" PostTypeId="2" ParentId="3031" CreationDate="2013-08-29T18:42:36.457" Score="2" Body="&lt;p&gt;Shortest accurate answer is no. You already got useful answers about &lt;code&gt;nmap&lt;/code&gt;, but if it must be via DHCP many clients send their vendor class identifiers (DHCP option 60) in their discover packets so the DHCP server can provide an offer with vendor specific options (DHCP option 43). If you run tcpdump an look at DHCP discover packets sent by clients for option 60 you can see stuff like &lt;code&gt;MSFT 5.0&lt;/code&gt; for Windows clients, &lt;code&gt;udhcpc&lt;/code&gt; usualy for embedded devices running micro dhcp client, etc. Keep in mind that this information is not very specific since it is used to distinguish DHCP client rather then operating system.&lt;/p&gt;&#xA;" OwnerUserId="2358" LastActivityDate="2013-08-29T18:42:36.457" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3036" PostTypeId="2" ParentId="3031" CreationDate="2013-08-29T19:02:46.187" Score="15" Body="&lt;p&gt;Some work has been done to determine subtle differences in DHCP packets from different OSes, resulting in DHCP fingerprints. Examples include the options present in DHCP request and their order, and the content of certain options like option 55 (parameter list).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look at the papers and signatures at &lt;a href=&quot;http://www.fingerbank.org&quot; rel=&quot;nofollow&quot;&gt;fingerbank.org&lt;/a&gt;. This suggests (have not tested it myself) passive OS fingerprinting based on DHCP traffic can be done. The result can possibly be improved by including other information, like generic IP properties (TTL, diffserv, ...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Active fingerprinting might provide a better result, but might not be an option in your use case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Fingerbank website mentions a couple of open source products which use the signatures. Proprietary DHCP appliance Infoblox seems to include a similar feature, but no technical details are provided.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2014-05-27T14:17:20.250" LastActivityDate="2014-05-27T14:17:20.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3038" PostTypeId="2" ParentId="3012" CreationDate="2013-08-30T01:07:07.437" Score="3" Body="&lt;p&gt;The biggest thing I would use different colored cables for is to differentiate the importance of the cable.  This way crucial cables between switches, routers, and other important devices are noted to prevent accidentally causing outages in your network.  A new employee, contractor, or regular employee can quickly learn the coloring scheme.  Sometimes it does get confusing when all the cables are the same color!  If you can follow a standard provided in the other answers, that would be great.  But not everyone can change all their cables in their existing infrastructure.&lt;/p&gt;&#xA;" OwnerUserId="449" LastActivityDate="2013-08-30T01:07:07.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3046" PostTypeId="2" ParentId="3022" CreationDate="2013-08-30T12:09:30.627" Score="6" Body="&lt;p&gt;It could be a corrupt filesystem - was the router rebooted w/o proper shutdown? If it is the case, try booting from USB stick and re-install (with re-partition) the CF card:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;request system snapshot partition media compact-flash (or similar, check manual for exact device name) &lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2013-08-30T12:09:30.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3049" PostTypeId="2" ParentId="3013" CreationDate="2013-08-30T17:43:57.963" Score="5" Body="&lt;p&gt;By separated networks, you mean VLANs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, there is a tutorial provided by CISCO on how to do it: &lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/csbr/app_notes/RV0xx_an_vlan_78-21017.pdf&quot;&gt;http://www.cisco.com/en/US/docs/routers/csbr/app_notes/RV0xx_an_vlan_78-21017.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or do you mean separated WANs, perhaps one being the master and the other the backup, or even with load balancing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, there is also a tutorial by CISCO: &#xA;&lt;a href=&quot;http://sbkb.cisco.com/CiscoSB/Loginr.aspx?login=1&amp;amp;pid=2&amp;amp;app=search&amp;amp;vw=1&amp;amp;articleid=622&quot;&gt;http://sbkb.cisco.com/CiscoSB/Loginr.aspx?login=1&amp;amp;pid=2&amp;amp;app=search&amp;amp;vw=1&amp;amp;articleid=622&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or do you mean different subnets? That you can find here: &lt;a href=&quot;http://sbkb.cisco.com/CiscoSB/Loginr.aspx?login=1&amp;amp;pid=4&amp;amp;app=search&amp;amp;vw=1&amp;amp;articleid=673&quot;&gt;http://sbkb.cisco.com/CiscoSB/Loginr.aspx?login=1&amp;amp;pid=4&amp;amp;app=search&amp;amp;vw=1&amp;amp;articleid=673&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-08-30T17:43:57.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3050" PostTypeId="1" AcceptedAnswerId="3051" CreationDate="2013-08-30T22:21:39.233" Score="6" ViewCount="1323" Body="&lt;p&gt;Our customer has two Cisco WiSM(1) blades running code 7.0.x and wants to migrate to Cisco 5508 controller which have code version 7.5.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The WiSM(1) blades are EoL and they aren't able to run newer code than 7.0.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/controller/5500/tech_notes/Wireless_Software_Compatibility_Matrix.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Wireless Solutions Software Compatibility Matrix&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The challenge is that our customer has a large install base of 1230 series APs (around 100 pcs) which are totally EOL and are not supported in 7.0.x+ code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately we need to run at least a 7.3+ code on the new 5508 because our customer is going to replace those APs with 2600 series APs which are not supported with the 7.0.x code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of the physical topology it's not possible to replace all those APs in a &quot;big bang&quot; fashion, that means we have to assure that roaming in those parts of the building, mostly warehouses, is possible between an old 1230 AP (connected to the WiSM) and the new 2600 APs (connected to the 5508 WLC)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the easiest way would be to form a mobility group between WiSM and 5508 controllers but i tried to setup a mobility group in-between the WiSM and the 5508 Controller but it seems like this scenario is not supported with such a different major code releases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case, my next question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be a best practice scenario to migrate the APs with the least amount of downtime and roaming issues?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To give you a background overview about the topology without going into to much details.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;At the moment new APs resolve their controller via DNS entry CISCO-CAPWAP-CONTROLLER which points to the AP-Manager IP of the WiSM blades. &lt;/li&gt;&#xA;&lt;li&gt;all access points are &quot;primed&quot; with the IP Address of the WISM Controllers, that means they should have the IP hardcoded and localy stored in their flash.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;On one hand, we need to make sure that new 2600 APs will connect to the new 5508 controllers to get provisioned. But on the other hand it's important that if a old AP reboots, still find the WiSM Controllers to connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion that cancels out to reconfigure the DNS Records to the 5508'ers!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It maybe also possible to configure the DHCP option 43 for those scopes which contain APs which are going to be migrated. That would at least give us the flexibility to have the leverage to control over which APs connects to which controller. However, it would still not solve the problem where clients could not roam between old and new AP's since they're still on separate controllers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Gjsjb.jpg&quot; alt=&quot;basic szenario to visualize the situation click here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2033" LastEditorUserId="343" LastEditDate="2013-08-31T00:47:15.057" LastActivityDate="2013-08-31T01:11:20.763" Title="Cisco WLC Mobility Group between 7.0.x and 7.5.x" Tags="|cisco|wireless|wlc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3051" PostTypeId="2" ParentId="3050" CreationDate="2013-08-31T01:11:20.763" Score="4" Body="&lt;p&gt;I've never had to do a migration from 7.0 to 7.5 code in my environments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2600 series APs were first supported in 7.2.110.&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn7_2_115_2.html#wp976967&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/wireless/controller/release/notes/crn7_2_115_2.html#wp976967&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 5508 can run also 7.2. If you could get the mobility group/anchor to work with 7.2, then why you could downgrade it to 7.2 during the transition process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to change CISCO-CAPWAP-CONTROLLER to your new 5508 controller so the 2600 APs will establish a connection with the new controller out of the box.&lt;br&gt;&#xA;All CAPWAP and LWAP APs should remember the previous controller that they connected to and will attempt to establish a connection to those controllers before trying to go for the DNS lookup. See the &lt;a href=&quot;http://revolutionwifi.blogspot.com/2010/11/capwap-controller-discovery-process_23.html&quot; rel=&quot;nofollow&quot;&gt;CAPWAP controller discovery process&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, if one of your 1230 APs were to reboot - even if it does a DNS lookup for CISCO-CAPWAP-CONTROLLER (which would then return the 5508 IP), it should still connect to the old controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also assume that your new 5508 has SMARTnet? Open a TAC case with Cisco and see what they say!&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2013-08-31T01:11:20.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3052" PostTypeId="2" ParentId="2943" CreationDate="2013-08-31T13:23:38.377" Score="3" Body="&lt;p&gt;Expanding on generalnetworkerror's answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to adding the mail server to send out mail from (&lt;code&gt;smtp-server XXX.XXX.XXX.XXX&lt;/code&gt;), you must use logging level info for seeing when someone connects or if you just want when they disconnect (which has a duration in the message), use logging level warn. These are the email results from a lab ASA5505 running 8.4 using logging level info (1 line per email):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&amp;lt;166&gt;%ASA-6-113009: AAA retrieved default group policy&#xA;  (anyconnect-split-policy) for user = your_vendor_account&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&amp;lt;166&gt;%ASA-6-113008: AAA transaction status ACCEPT : user =&#xA;  your_vendor_account&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&amp;lt;164&gt;%ASA-4-113019: Group = anyconnect-split-group, Username =&#xA;  your_vendor_account, IP = 70.210.XXX.XXX, Session disconnected.&#xA;  Session Type: SSL, Duration: 0h:02m:10s, Bytes xmt: 7490, Bytes rcv:&#xA;  1210, Reason: User Requested&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;ASA-6: Info level&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA-4: Warn level&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first two entries are from the login. The last is when I logged my phone out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA will complain about SMTP logging being inefficient and that you may overwhelm the SMTP server. However if you use the steps from generalnetworkerror, the logging is limited to &quot;AUTH&quot; entries and you shouldn't be overwhelmed.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-08-31T13:23:38.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3053" PostTypeId="1" AcceptedAnswerId="3055" CreationDate="2013-08-31T14:19:33.617" Score="18" ViewCount="2591" Body="&lt;p&gt;What are the differences between multihoming in IPv4 versus IPv6?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can an enterprise request a provider-independent IPv6 address space from its RIR/LIR which can be advertised to multiple upstream providers via BGP just as in IPv4?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are the rules for requesting a provider-independent IPv6 allocation the same for all RIRs?&lt;/p&gt;&#xA;" OwnerUserId="86" LastEditorUserId="95" LastEditDate="2013-08-31T17:23:07.523" LastActivityDate="2017-06-02T12:41:55.607" Title="How does multihoming work with ipv6?" Tags="|routing|ipv4|bgp|ipv6|bgp-ipv6|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3054" PostTypeId="1" CreationDate="2013-08-31T14:48:51.690" Score="10" ViewCount="6494" Body="&lt;p&gt;I'm network traffic and wish to divide each TCP session into a series of requests and responses (the protocols I'm working with all work that way, like HTTP or SSL).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a simple assumption (ignoring out of order and resent packets) - given a chunk of data that needs to be sent, it will be sent using the largest possible packets and the last packet will be either smaller than the maximum size or be followed by a packet from the other side (ignoring ACK empty packets). So in an HTTP session I expect to see something like (again, disregarding acks) - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet 1 - Request &quot;Get...&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet 2 - Response, size 1434&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet 3 - Response, size 1434&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet 4 - Response, size 1434&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet 5 - Response, size 500&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is what I get on most of the sessions, however there's at least one occasion I saw which looked like &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet 1 - Request &quot;Get...&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet 2 - Response, size 1434&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet 3 - Response, size 1080&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet 4 - Response, size 1434&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet 5 - Response, size 500&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No retransmissions, out of order packets here or no exceptional delays on the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know - what can cause this and when will it occur? How wrong is my assumption?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I put an example pcap file &lt;a href=&quot;https://docs.google.com/file/d/0Bw2JuIECGSdNb04tYXJ2Zm5lbWc/edit?usp=sharing&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Including a &lt;code&gt;tshark&lt;/code&gt; dump with relevant fields...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ tshark -r http_1082.pcap -T fields -e frame.number -e frame.len \&#xA;    -e ip.src -e ip.dst -e tcp.flags.push -e http.request.method \&#xA;    -e http.request.uri -e http.response.code | head -n 47&#xA;1     66      192.168.1.103    206.33.49.126    0            &#xA;2     62      206.33.49.126    192.168.1.103    0            &#xA;3     64      192.168.1.103    206.33.49.126    0            &#xA;4     411     192.168.1.103    206.33.49.126    1    GET    /money/.element/script/3.0/video/xmp/xmp_playlistapi.js    &#xA;5     54      206.33.49.126    192.168.1.103    0            &#xA;6     1434    206.33.49.126    192.168.1.103    0            &#xA;7     1434    206.33.49.126    192.168.1.103    0            &#xA;8     64      192.168.1.103    206.33.49.126    0            &#xA;9     1434    206.33.49.126    192.168.1.103    0            &#xA;10    1434    206.33.49.126    192.168.1.103    0            &#xA;11    1434    206.33.49.126    192.168.1.103    0            &#xA;12    64      192.168.1.103    206.33.49.126    0            &#xA;13    1434    206.33.49.126    192.168.1.103    0            &#xA;14    1434    206.33.49.126    192.168.1.103    0            &#xA;15    1434    206.33.49.126    192.168.1.103    0            &#xA;16    1434    206.33.49.126    192.168.1.103    0            &#xA;17    64      192.168.1.103    206.33.49.126    0            &#xA;18    1434    206.33.49.126    192.168.1.103    0            &#xA;19    1434    206.33.49.126    192.168.1.103    0            &#xA;20    1434    206.33.49.126    192.168.1.103    0            &#xA;21    1434    206.33.49.126    192.168.1.103    0            &#xA;22    1434    206.33.49.126    192.168.1.103    0            &#xA;23    64      192.168.1.103    206.33.49.126    0            &#xA;24    1434    206.33.49.126    192.168.1.103    0            &#xA;25    1434    206.33.49.126    192.168.1.103    0            &#xA;26    1434    206.33.49.126    192.168.1.103    0            &#xA;27    1434    206.33.49.126    192.168.1.103    0            &#xA;28    1434    206.33.49.126    192.168.1.103    0            &#xA;29    1434    206.33.49.126    192.168.1.103    0            &#xA;30    64      192.168.1.103    206.33.49.126    0            &#xA;31    1434    206.33.49.126    192.168.1.103    0            &#xA;32    1434    206.33.49.126    192.168.1.103    0            &#xA;33    1434    206.33.49.126    192.168.1.103    0            &#xA;34    1082    206.33.49.126    192.168.1.103    1     &amp;lt;------ Packet in question        &#xA;35    1434    206.33.49.126    192.168.1.103    0            &#xA;36    1434    206.33.49.126    192.168.1.103    0            &#xA;37    1434    206.33.49.126    192.168.1.103    0            &#xA;38    64      192.168.1.103    206.33.49.126    0            &#xA;39    1434    206.33.49.126    192.168.1.103    0            &#xA;40    1434    206.33.49.126    192.168.1.103    0            &#xA;41    1434    206.33.49.126    192.168.1.103    0            &#xA;42    1434    206.33.49.126    192.168.1.103    0            &#xA;43    1434    206.33.49.126    192.168.1.103    0            &#xA;44    1434    206.33.49.126    192.168.1.103    0            &#xA;45    1434    206.33.49.126    192.168.1.103    0            &#xA;46    626     206.33.49.126    192.168.1.103    1            200&#xA;47    64      192.168.1.103    206.33.49.126    0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2229" LastEditorUserId="775" LastEditDate="2013-09-02T01:12:37.510" LastActivityDate="2017-02-15T13:00:23.073" Title="Packet sizes in a TCP stream" Tags="|ipv4|tcp|packet-analysis|protocol-theory|" AnswerCount="5" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3055" PostTypeId="2" ParentId="3053" CreationDate="2013-08-31T15:25:12.550" Score="14" Body="&lt;p&gt;You can indeed request a Provider Independent (PI) assignment from the local RIR through an LIR. Routing a block of IPv6 address space is done with BGP in the same way as a block of IPv4 address space. The block is only a bit bigger :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPv4 it is common that a block smaller than a /24 (so a /25 or longer prefix) will not be commonly routed by ISPs. In IPv6 the common limit these days seems to be a /48.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every RIR has its own policies, so you will have to look at the RIR in your own region to get the specifics. If you happen to be in the RIPE NCC service region I can answer any questions you might have.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2013-08-31T15:25:12.550" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3056" PostTypeId="2" ParentId="3054" CreationDate="2013-08-31T15:34:22.937" Score="3" Body="&lt;p&gt;The packet size depends on how the application and/or the OS buffers and sends network data. If the application and/or the OS decides to send the data after 1080 bytes are in the buffer then the packet will be 1080 bytes (plus headers). There could be many reasons for it to do that. In your case you would have to look in the webserver source code and/or the OS network stack.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-08-31T15:34:22.937" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3058" PostTypeId="2" ParentId="2923" CreationDate="2013-09-01T04:43:18.127" Score="8" Body="&lt;p&gt;IOS includes ttcp, albeit it might not be supported officially by Cisco it can come in handy in situations like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;JUNOS does not support ttcp as far as I know, but it's probably not too much hassle adding one central Linux machine connected to the PE that you can do measurements with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On IOS, you simply run 'ttcp', like so;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LAB-C7600-1#ttcp&#xA;transmit or receive [receive]: transmit&#xA;Target IP address: 1.3.3.7&#xA;calculate checksum during buffer write [y]: &#xA;perform tcp half close [n]: &#xA;send buflen [32768]: &#xA;send nbuf [2048]: &#xA;bufalign [16384]: &#xA;bufoffset [0]: &#xA;port [5001]: &#xA;sinkmode [y]: &#xA;buffering on writes [y]: &#xA;show tcp information at end [n]: y&#xA;&#xA;ttcp-t: buflen=32768, nbuf=2048, align=16384/0, port=5001  tcp  -&amp;gt; 1.3.3.7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I don't have a second end point, but you get the idea :)&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2013-09-01T04:43:18.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3059" PostTypeId="2" ParentId="2796" CreationDate="2013-09-01T05:22:08.560" Score="0" Body="&lt;p&gt;Typically your remote VPN users only need a couple lines under the dynamic crypto map that allow them to connect properly. Something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;crypto dynamic-map DYN_CRY_MAP 65535 set transform-set ESP-AES-128-SHA&#xA;&#xA;crypto map OUTSIDE_map 65535 ipsec-isakmp dynamic DYN_CRY_MAP&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is assuming you have the appropriate matching transform-set already specified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your remote user VPN subnets do not need to be specified in the crypto map since they are dynamic endpoints. The ASA knows this and adjusts the the crypto tables accordingly. Your dynamic L2L endpoints also do not need to be specified under the crypto map and will operate in the same way. Also, a &quot;feature&quot; is that the last of the two lines above MUST be applied at the very end of your crypto map. You already have it there, but just wanted to let you know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This line is what allows Phase 1 to connect from a dynamic L2L endpoint:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;tunnel-group DefaultL2LGroup ipsec-attributes&#xA;&#xA; pre-shared-key *****&#xA;&#xA; peer-id-validate nocheck&#xA;&#xA; isakmp keepalive threshold 30 retry 5&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Phase 2 is handled by your crypto map entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm afraid that the easiest and most effective way to do this would be to change the PSK on the DefaultL2LGroup tunnel-group and then change it on all of the devices that you still want connected. Since they're dynamic endpoints, you can't really filter by IP on the outside interface, and you have no control over them establishing a tunnel if they know the PSK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any questions, please don't hesitate to ask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ian&lt;/p&gt;&#xA;" OwnerUserId="2532" LastEditorUserId="509" LastEditDate="2013-09-01T11:36:56.017" LastActivityDate="2013-09-01T11:36:56.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3060" PostTypeId="2" ParentId="3054" CreationDate="2013-09-01T06:19:54.393" Score="6" Body="&lt;p&gt;The TCP layer uses the Nagle algorithm to buffer traffic (it sends fewer large packets, instead of more small packets... making it more efficent); there is a way for the application to say 'send it now'.  You see that in the TCP header with a flag called the PSH (push) bit. While the bit is set by the stack, the push is done at the request of the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this is intended and normal behavior. &lt;/p&gt;&#xA;" OwnerUserId="1461" LastEditorUserId="775" LastEditDate="2013-09-01T13:49:14.403" LastActivityDate="2013-09-01T13:49:14.403" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3062" PostTypeId="2" ParentId="2774" CreationDate="2013-09-01T11:56:19.443" Score="6" Body="&lt;p&gt;The problem seemed to be solved by two things that neither one should have changed anything:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;switched from WPA2 to WPA. (Yes, I know that any post 2007 device should be fine with WPA2.)&lt;/li&gt;&#xA;&lt;li&gt;reduced the number of ssid's being broadcast from 3 to 1. (Yes, as @YLearn responded, the AP should be fine with multiple SSIDs.)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So the problem is gone but the best explanation I have is, sadly, magic.&lt;/p&gt;&#xA;" OwnerUserId="1331" LastActivityDate="2013-09-01T11:56:19.443" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3065" PostTypeId="2" ParentId="3053" CreationDate="2013-09-02T11:17:37.247" Score="5" Body="&lt;p&gt;This seems to be the approach that a number of businesses are trying, but the goal behind the IPv6 design was to prevent all but peering-sized companies (e.g., Google) from getting provider-independent blocks to reduce the size of the global routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 hosts are required to be able to handle multiple addresses per interface, and the intention was for multihoming to work by having the enterprise's egress routers each advertise the block (generally a /48 or /56) available via its uplink, and for the routers inside the enterprise to append the global prefix (generally read via DHCPv6) to a prefix-independent subnet number. Migrating hosts that are getting their information from router advertisements can be done gradually and without admin intervention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, in actual deployment this model was hampered by the adoption of the &lt;code&gt;AAAA&lt;/code&gt; DNS record (which stores just a literal IP address) over the &lt;code&gt;A6&lt;/code&gt; record, which allowed specifying address components (e.g., an enterprise-wide 48-bit prefix part and an 80-bit host part) that could be managed and update independently; and by flaky prefix-based address support in early router software versions, and it seems rather unlikely that the multi-address model will gain any traction over the PI+BGP model. Early RFCs recommended against assigning PI blocks to non-transit organizations, but as of at least RFC6177 this recommendation seems to have been withdrawn.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-09-02T11:17:37.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3066" PostTypeId="1" CreationDate="2013-09-02T11:41:59.580" Score="7" ViewCount="1742" Body="&lt;p&gt;I have one SP right now that serves 100 Sites and we are currently planning to migrate all the sites to a new SP. However, this will be a phased migration, so we will have some sites in the new SP cloud and others in the old one.&#xA;The SPs will not be running any sort of Inter-AS between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What other alternatives do we have to keep communication between sites in the old SP cloud and on the new SP cloud?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;EDIT&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sites are now connected via a single MPLS cloud, there is no IPSec. All the sites connect on a single MPLS cloud. We will be moving some sites to the new MPLS cloud and since there is no connection between the two MPLS clouds (different SPs) and they are not running Inter-AS, the question is what other alternatives do we have to keep sites on, let's say, MPLS-A communicating with sites at MPLS-B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is MPLS VPN with BGP routes being exchanged with the PE routers for the Service Provider. So it is basically MPLS L3VPN. Let me know if you need additional info..&lt;/p&gt;&#xA;" OwnerUserId="1426" LastEditorUserId="775" LastEditDate="2013-09-02T15:40:58.450" LastActivityDate="2021-03-29T07:26:14.490" Title="Alternatives to multiple Service Providers" Tags="|routing|mpls|service-provider|mpls-vpn|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3067" PostTypeId="1" AcceptedAnswerId="3069" CreationDate="2013-09-02T14:16:47.297" Score="9" ViewCount="9097" Body="&lt;p&gt;I have come across a situation that I cannot understand.  We have a Fortigate firewall that we  have enabled to do load-balancing across two back-end Apache web servers. A DNS name is then mapped to the virtual IP on the Load Balancer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As expected, when you browse to the &lt;strong&gt;DNS&lt;/strong&gt; name/URL (e.g. www.something.com), the Load Balancer serves up a page from one of the back-end Apache  web servers. The URL in the browser stays  &lt;em&gt;www.something.com&lt;/em&gt;. From what I understand, the Load Balancer in this case is simply forwarding packets between the browser and Apache while always staying in-path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I browse to the &lt;strong&gt;IP address&lt;/strong&gt; that the DNS is mapped to, then the Load Balancer returns a HTTP 302 Found, with the Location header set to the DNS URL of one of the Apaches. The URL in the browser changes to the back-end server DNS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is the Load Balancer redirecting when queried via IP, but correctly forwarding in-path when  queried via DNS name.&lt;/p&gt;&#xA;" OwnerUserId="2091" LastEditorUserId="2091" LastEditDate="2013-10-03T06:15:25.577" LastActivityDate="2013-10-03T06:15:25.577" Title="load-balancing difference between DNS and IP - forwarding vs redirecting" Tags="|firewall|fortigate|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3069" PostTypeId="2" ParentId="3067" CreationDate="2013-09-02T14:58:48.367" Score="10" Body="&lt;p&gt;I haven't used a Fortigate FW for load balancing, so I will answer some of the questions more generally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, as to your problem, the load balancer is doing exactly as it is supposed to do and I think your servers may not be configured correctly to respond to a request on their IP address.  If you were to test this behind the load balancing, you could set the domain name in a local client's hosts file, behind the firewall with the server and access it both with domain name and internal IP.  You will probably get the same result you are seeing now.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that you have virtual hosting turned on (to support multiple domains on a single server) and the &quot;default&quot; is not serving the same pages as your domain.  You are getting a web page back from the server in both cases.  If you need help with configuring your web server, you may want to try on &lt;a href=&quot;http://serverfault.com&quot;&gt;ServerFault&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, to get into a bit more detail.  A load balancer typically operates at L7 for at least HTTP and HTTPS clusters.  This means that they don't just look at the IP address and forward it, nor do they &quot;redirect&quot; the page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When they receive a request, they actually parse the request and forward it to a server after processing the request.  There are many things that they can do at this point, such as rewriting the headers in both directions, potentially adding cookies (for persistence) into the data going back to the client, terminating SSL sessions, matching based on the URL, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend you spend some time fully reading the vendor documents to get a better understanding of how load balancing works (with Fortigate you can read both theirs and Coyote Point - another load balancing company Fortigate acquired).  Understanding what it is doing will help you in cases like this and will allow you to unlock capabilities that you didn't realize existed.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-09-02T15:28:41.183" LastActivityDate="2013-09-02T15:28:41.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3070" PostTypeId="2" ParentId="3066" CreationDate="2013-09-02T17:17:42.713" Score="8" Body="&lt;p&gt;I had this issue. You did not indicate of you have a data center or not. Making the assumption that inter remote site traffic is manageable, in your data centers you allow prefixes to be advertied between the two SP clouds using your data centers as trasits. It is true that remote site to remote side will take the hop through your data centers but there is not much to do. I am also assuming that you will attach your data centers to both providers first, then migrate remote sites the remove your data centers form the old ISP. This will happen by default. If you do not flash cut your remote sites (both providers are connected for a time) use a filter list in BGP to block transit at the remote sites. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using BGP as your routing protocol PE to CE then this will happen almost by default, if not please indicate how you are routing PE to CE.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-09-02T17:17:42.713" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3072" PostTypeId="2" ParentId="3067" CreationDate="2013-09-02T20:34:43.553" Score="3" Body="&lt;p&gt;After reading the &lt;em&gt;HTTP host-based load balancing&lt;/em&gt; in the &lt;a href=&quot;http://docs.fortinet.com/fgt/handbook/50/fortigate-load-balance-50.pdf&quot; rel=&quot;nofollow&quot;&gt;Fortigate Load Balancing&lt;/a&gt; doc, I can see how you can have an atypical load-balancing configuration that could result in what you describe.  However, without part of your config, we cannot be certain if this is the case for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Fortigate FortiOS allows a Virtual Server to be created that is tied to Real Servers that each have a different host header configuration&lt;/strong&gt;.  Should any requests match the VIP of your Virtual Server, the load balanced requests will only go to Real Servers that match that &lt;code&gt;host header&lt;/code&gt;.  &lt;strong&gt;The most important part which nicely explains your symptoms, is that one of the Real Servers can omit the host header so it matches on &lt;em&gt;any&lt;/em&gt; host header.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Real Server without a host header might have been configured as a sort of &quot;catch-all&quot; that lands on a site that does the redirect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the example below, only the 1st and 2nd rservers handle traffic matching your preferred DNS name via the host header, but the 3rd rserver takes anything matching all other host headers which includes the DNS VIP itself and sends to a site that could do a redirect.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;config firewall vip&#xA; edit &quot;http-host-ldb&quot;&#xA;  set type server-load-balance&#xA;  set extip 192.0.2.1&#xA;  set extintf &quot;lan&quot;&#xA;  set server-type http&#xA;  set ldb-method http-host&#xA;  set extport 80&#xA;  config realservers&#xA;    edit 1&#xA;      set http-host &quot;www.example.com&quot;&#xA;      set ip 192.168.2.1&#xA;      set port 80&#xA;      next&#xA;    edit 2&#xA;      set http-host &quot;www.example.com&quot;&#xA;      set ip 192.168.2.2&#xA;      set port 80&#xA;      next&#xA;    edit 3&#xA;      set ip 192.168.2.3&#xA;      set port 80&#xA;      next&#xA;    end&#xA; end&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I suppose the firewall load-balancing could be doing the redirect itself, but we cannot tell with the limited info provided.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-09-02T20:34:43.553" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3073" PostTypeId="2" ParentId="3066" CreationDate="2013-09-03T00:14:58.307" Score="7" Body="&lt;p&gt;This is a very common situation, which I've seen many times over the years.  Regardless of whether you're turning down and replacing legacy Point-to-Point T1 circuits, integrating networks in an acquisition/merger, or just changing providers as in this question, the solution will almost always involve utilizing your existing network equipment/routing configuration for transiting traffic between the different networks.  That is the simplest solution and gives you the greatest level of control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get on my soap-box for a minute, this is where a &lt;a href=&quot;http://www.cisco.com/en/US/docs/solutions/Enterprise/Campus/HA_campus_DG/hacampusdg.html#wp1107687&quot; rel=&quot;nofollow&quot;&gt;clearly-defined, hierarchical network design&lt;/a&gt; comes in handy.  If you're utilizing a design with &lt;strong&gt;Core-Aggregation-Distribution&lt;/strong&gt; layers (or even a simple Core-Distribution layer setup), you would simply connect each separate MPLS service provider to your Core/Aggregation equipment.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the routes to each site (regardless of provider) are in your Core/Aggregation equipment, your network's existing routing protocols can handle the traffic distribution between the two networks.  To any router, they will simply be separate subnets available on your network.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Current configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; MPLS Service Provider A&#xA;            |&#xA;           BGP&#xA;            |&#xA;       -~-~-~-~-~-&#xA;       |100 Sites|&#xA;       -~-~-~-~-~-&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Desired End configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; MPLS Service Provider B&#xA;            |&#xA;           BGP&#xA;            |&#xA;       -~-~-~-~-~-&#xA;       |100 Sites|&#xA;       -~-~-~-~-~-&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you're seeking the bridge/migration strategy between the two.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; Clarifying the below solution description per @fredpbaker's comments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see two solutions, which both involve connecting your MPLS providers into a core layer at one location (although two would be better for redundancy purposes, and is what is diagrammed below).  This would allow your existing network equipment to connect the sites from each provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At all other locations/sites, the MPLS provider would be irrelevant.  They could be connected to Provider A or Provider B (or both), and traffic would flow between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you could redistribute BGP into your existing IGP and allow your equipment to route the traffic transiting between each provider:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Redistribute into OSPF/EIGRP&#xA;     /                      \&#xA;-~-~-~-~-~-             -~-~-~-~-~-&#xA;| Core A  |-\         /-| Core B  |&#xA;-~-~-~-~-~-   \     /   -~-~-~-~-~-&#xA;    |           \ /           |&#xA;    |           / \           |&#xA;   BGP       BGP    BGP      BGP&#xA;    |        /       \        |&#xA; -~-~-~-~-~-~-       -~-~-~-~-~-~-&#xA; | MPLS SP A |       | MPLS SP B |&#xA; -~-~-~-~-~-~-       -~-~-~-~-~-~- &#xA;             |       |&#xA;            BGP     BGP&#xA;             |       |&#xA;             |       |&#xA;             |       |       &#xA;         -~-~-~-~-~-~-~-~-~&#xA;         | 98 Other Sites |&#xA;         |  Connected to  |&#xA;         |   Either MPLS  |&#xA;         |    Provider    |&#xA;         -~-~-~-~-~-~-~-~-~&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Secondly, if you don't have an IGP running, or don't want to redistribute into it, you could utilize &lt;a href=&quot;http://packetlife.net/blog/2010/mar/29/inter-vrf-routing-vrf-lite/&quot; rel=&quot;nofollow&quot;&gt;Inter-VRF routing with VRF lite (as laid out by Stretch over at PacketLife)&lt;/a&gt;, and take the routes from each provider into a VRF on each Core router, and export them to the appropriate VRF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Import/Export routes between VRF's as needed&#xA;         /                      \&#xA;    -~-~-~-~-~-             -~-~-~-~-~-&#xA;    | Core A  |VRF-B   VRF-A| Core B  |&#xA;    -~-~-~-~-~-   \     /   -~-~-~-~-~-&#xA;      VRF-A         \ /         VRF-B&#xA;        |           / \           |&#xA;       BGP       BGP    BGP      BGP&#xA;        |        /       \        |&#xA;     -~-~-~-~-~-~-       -~-~-~-~-~-~-&#xA;     | MPLS SP A |       | MPLS SP B |&#xA;     -~-~-~-~-~-~-       -~-~-~-~-~-~- &#xA;                 |       |&#xA;                BGP     BGP&#xA;                 |       |&#xA;                 |       |&#xA;                 |       |       &#xA;             -~-~-~-~-~-~-~-~-~&#xA;             | 98 Other Sites |&#xA;             |  Connected to  |&#xA;             |   Either MPLS  |&#xA;             |    Provider    |&#xA;             -~-~-~-~-~-~-~-~-~&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-09-04T03:21:57.577" LastActivityDate="2013-09-04T03:21:57.577" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3074" PostTypeId="2" ParentId="3066" CreationDate="2013-09-03T02:23:43.327" Score="1" Body="&lt;p&gt;If you are using Cisco routers, you may want to investigate the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6830&quot; rel=&quot;nofollow noreferrer&quot;&gt;LISP protocol&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The LISP technology can be easily deployed as an overlay seamlessly interconnecting your two sites across SPs.&lt;/p&gt;&#xA;&lt;p&gt;There are multiple presentations detailing the &lt;a href=&quot;http://lisp4.cisco.com/LISP_Update.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;most common use-cases&lt;/a&gt; but it can easily be extended to your case to provide site extensibility across SPs or even help you in the transition using its host mobility solution.&lt;/p&gt;&#xA;" OwnerUserId="1171" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-09-03T03:04:59.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3079" PostTypeId="1" CreationDate="2013-09-04T03:23:13.813" Score="15" ViewCount="37954" Body="&lt;p&gt;How do I find out a company like facebook's IP addresses. I am trying to block facebook at work and having some difficulties with HTTPs and URL blocking. Everytime I block a facebook IP more seem to pop up. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any easy way to find out all the IPs that Facebook, Myspace, Snapchat etc uses? &lt;/p&gt;&#xA;" OwnerUserId="2558" LastEditorUserId="2339" LastEditDate="2013-09-04T10:56:42.940" LastActivityDate="2014-01-23T06:16:28.433" Title="Finding IP Addresses for Social Network Sites" Tags="|ipv4|security|firewall|acl|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3080" PostTypeId="2" ParentId="3079" CreationDate="2013-09-04T03:40:20.537" Score="14" Body="&lt;p&gt;There are several ways to find the IP ranges of major organizations such as Facebook. The most basic of these, is to open up your terminal/command line of choice and issue the command: &lt;code&gt;nslookup facebook.com&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This gives you the associated IP address to that DNS name; in this case, &lt;code&gt;173.252.110.27&lt;/code&gt; was the answer from my DNS server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then run a &quot;whois&quot; lookup for that IP address (you can go to &lt;a href=&quot;http://whois.net&quot; rel=&quot;nofollow&quot;&gt;Whois.net&lt;/a&gt; if you don't have a whois tool in your command line): &lt;code&gt;whois 173.252.110.27&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant output in this case is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NetRange:       173.252.64.0 - 173.252.127.255&#xA;CIDR:           173.252.64.0/18&#xA;OriginAS:       AS32934&#xA;NetName:        FACEBOOK-INC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Facebook has been assigned the entire /18 block of &lt;code&gt;173.252.64.0/18&lt;/code&gt;, so simply use that range for your ACL.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; With all of that stated, blocking by IP can become cumbersome very quickly, and is highly ineffective in many cases.  Organizations the size of Facebook will constantly be adding new IP space, which will be outside of your filtered range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some sites might change to using a new &lt;a href=&quot;http://en.wikipedia.org/wiki/Content_delivery_network&quot; rel=&quot;nofollow&quot;&gt;CDN&lt;/a&gt;, which of course will use a different IP space as well.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're having specific issues with your HTTPS and URL blocking, depending on the equipment, you could ask in another question for assistance on those specific problems.  The answers might better aid you in blocking access to these sites.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-09-09T20:22:24.320" LastActivityDate="2013-09-09T20:22:24.320" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3081" PostTypeId="2" ParentId="3079" CreationDate="2013-09-04T05:43:04.740" Score="6" Body="&lt;p&gt;To block an unacceptable website you would normally use a proxy server or web filtering firewall. Either by forcing everybody to use the proxy and blocking the normal access to the web or use a firewall and block the offending URL(s). Using IP addresses is never a good option for websites as these addresses can change very often for big sites (when they switch to/from CDNs, when they add another cluster that's nearer at your location, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding out &lt;em&gt;all&lt;/em&gt; IP addresses a big website uses is very difficult with big players like Facebook and Google. Also there are many services who can be used as a proxy to access these sites despite you blocking the IP.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2013-09-04T05:43:04.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3084" PostTypeId="1" AcceptedAnswerId="3085" CreationDate="2013-09-04T10:30:14.287" Score="12" ViewCount="11805" Body="&lt;p&gt;We just bought some new Cat4507R+E distribution switches.  When we bought the switches, we asked for an Advanced Services K9 image, but our reseller told us they only come with a Universal K9 image.  I didn't know better, so I said OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I tried to bring the switches online in production, I had a problem with a huge number of unreachable subnets.   After sweating it for a very long fifteen minutes (while my boss insulted me for not testing the switch), I finally tracked the problem down to &lt;code&gt;eigrp stub connected&lt;/code&gt; in the EIGRP process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried remove the &quot;eigrp stub&quot; statement but I couldn't. When I tried, the switch errors out with &lt;code&gt;EIGRP is restricted to stub configurations only on this platform&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had to roll back to our original distributions and my boss got even hotter about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My google searches blame this problem on the ip base license, which only supports EIGRP stub routing.   Our reseller says it will take at least 24 hours and thousands of dollars to get the Advanced Services K9 upgrade.  We didn't budget for the extra expense and we have other business units waiting on the upgrade.  Oh yeah, and my boss isn't happy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before we borrow money from another department, is there anything else we can do to get this working now?&lt;/p&gt;&#xA;" OwnerUserId="2561" LastEditorUserId="775" LastEditDate="2013-10-19T19:33:58.847" LastActivityDate="2021-03-12T21:49:45.437" Title="Error: `EIGRP is restricted to stub configurations only on this platform`" Tags="|cisco|routing|router|eigrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3085" PostTypeId="2" ParentId="3084" CreationDate="2013-09-04T10:42:36.643" Score="17" Body="&lt;p&gt;I really don't like how Cisco crippled EIGRP in the ipbase image... at a minimum, you should get some kind of warning that your configuration won't work, but they haven't done that either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you discovered, &lt;code&gt;eigrp stub&lt;/code&gt; prevents EIGRP from advertising downstream routes from the switches connected to your distribution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can trick EIGRP into advertising routes it learned from other rotuers (even as a &lt;code&gt;stub&lt;/code&gt; router) by using a &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/iproute_eigrp/command/reference/ire_a1.html#wp1065119&quot;&gt;stub leak-map&lt;/a&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list p~MATCH_ANY seq 5 permit 0.0.0.0/0 le 32&#xA;!&#xA;route-map r~MATCH_ANY permit 10&#xA; match ip address prefix-list p~MATCH_ANY&#xA;!&#xA;router eigrp 100&#xA; no auto-summary&#xA; network 172.16.0.0&#xA; eigrp log-neighbor-warnings&#xA; eigrp log-neighbor-changes&#xA; eigrp stub connected summary static redistributed leak-map r~MATCH_ANY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Technically, you can get away with using &lt;code&gt;eigrp stub leak-map&lt;/code&gt; indefinitely, without upgrading your ipbase image.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-09-04T10:49:02.263" LastActivityDate="2013-09-04T10:49:02.263" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3086" PostTypeId="1" CreationDate="2013-09-04T11:04:16.847" Score="1" ViewCount="1770" Body="&lt;p&gt;I am an undergraduate student where I decided to develop a firmware that would eliminate the security vulnerabilities that exist within the current technologies used. such as tunneling, translation and dual stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do this I need to understand the packet transporting/routing differences between IPv4 and IPv6 in-order to provide a viable solution. But I couldnt find any resource that would compare these two protocols via diagrams and structures. I was hoping if I could assistance with some resources that i could use to better understand the differences of these two protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to first focus on the differences in IPsec.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;i know that IPsec is added to the Packet on the Network layer of the OSI model. But how does the IPv4 and IPv6 differ from one another when it comes to IPsec? &lt;/li&gt;&#xA;&lt;li&gt;how is the security info is added to both of these at start and removed from at the destination?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2563" LastEditorUserId="775" LastEditDate="2013-09-05T09:32:29.317" LastActivityDate="2019-03-02T01:54:41.443" Title="IPv4 &amp; IPv6 IPSec differences" Tags="|routing|ipv4|cisco-ios|ipv6|ipv6-transition|" AnswerCount="3" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="3088" PostTypeId="2" ParentId="3086" CreationDate="2013-09-04T14:31:15.780" Score="0" Body="&lt;p&gt;There are differences in the headers between IPv4 and IPv6 but IPv6 still resides at layer 3 in the OSI model just like IPv4.  &lt;/p&gt;&#xA;" OwnerUserId="190" LastActivityDate="2013-09-04T14:31:15.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3089" PostTypeId="2" ParentId="2637" CreationDate="2013-09-04T14:42:42.393" Score="3" Body="&lt;p&gt;When you manipulate the various k-values in order to affect route preference, this sort of output will sometimes be displayed until you reset your EIGRP neighbors. You can accomplish this by entering the following command(assuming Cisco gear): &lt;em&gt;clear ip eigrp (AS#) neighbors&lt;/em&gt; where &lt;em&gt;(AS#)&lt;/em&gt; is the EIGRP autonomous system number. The few times I have seen output similar to that posted(all in lab scenarios, btw), this has fixed it.&lt;/p&gt;&#xA;" OwnerUserId="2375" LastActivityDate="2013-09-04T14:42:42.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3092" PostTypeId="2" ParentId="3086" CreationDate="2013-09-04T20:51:01.480" Score="2" Body="&lt;p&gt;IPv4 and IPv6 &quot;coexist&quot; the same as Appletalk and IPX. That is &quot;&lt;em&gt;completely oblivious to each other&lt;/em&gt;&quot;.  While they both start with &lt;em&gt;eye-pee&lt;/em&gt;, and share a packet format (at the most basic level), beyond the version number in the IP header, they are completely alien to each other.  Study how IPv4 works, then study how IPv6 works. They are far more different than their names suggest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I've worked with this stuff for decades, but I cannot point you to any single book (or webpage) that can give you everything you need to know. We're not assembling Ikea furniture here.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-09-04T20:51:01.480" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3093" PostTypeId="2" ParentId="3084" CreationDate="2013-09-05T04:29:39.020" Score="9" Body="&lt;p&gt;Your 4507 comes with an evaluation license that will let you run enterprise services for 60 days.  You can activate the eval with the &quot;license boot level entservices&quot; command.  Note this requires a reload of the switch.  This will buy you some time while you purchase a permanent license.&lt;/p&gt;&#xA;" OwnerUserId="86" LastActivityDate="2013-09-05T04:29:39.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3096" PostTypeId="2" ParentId="3079" CreationDate="2013-09-05T07:57:23.667" Score="2" Body="&lt;p&gt;I've been using &lt;strong&gt;NBAR&lt;/strong&gt; to throttle Facebook, but you can tweak it to block.  This will only work on plain-text HTTP requests which effectively blocks someone entering the address in the browser before a redirect to HTTPS can take place.  SSL (TLS) bookmarks to FB would be missed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;You could also look at the new ASA-X CX (Context Aware security) that should be able to handle this, though I haven't deployed this yet.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;class-map match-any facebook-not4you&#xA; match protocol http host &quot;*facebook.com&quot;  &#xA; match protocol http host &quot;*fbcdn.net&quot; &#xA;!&#xA;policy-map badfacebookbad&#xA;  class facebook-not4you&#xA;    drop&#xA;!&#xA;interface Gi0/1&#xA;  service-policy output badfacebookbad&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-09-05T07:57:23.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3100" PostTypeId="1" CreationDate="2013-09-05T13:34:36.283" Score="5" ViewCount="478" Body="&lt;p&gt;I've been trying to set up local web-filtering (no license required, right?) on customer's SRX 240.&#xA;Every guide that I had managed to find said that it was to be configured under &quot;edit security utm&quot;. But there is no &quot;utm&quot; option on this device.&#xA;The only idea I got (by cat /etc/rc.utm) is that UTM requires at least 768MB RAM while I got only 512. That`s why &quot;utm&quot; is missing.&#xA;Anyone can confirm that? &#xA;Cheers!&lt;/p&gt;&#xA;" OwnerUserId="195" LastEditorUserId="509" LastEditDate="2013-10-05T14:55:36.497" LastActivityDate="2013-10-06T14:47:54.113" Title="Juniper SRX security utm missing" Tags="|juniper|srx|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3101" PostTypeId="1" AcceptedAnswerId="3103" CreationDate="2013-09-05T14:11:01.297" Score="2" ViewCount="572" Body="&lt;p&gt;Looking for a good low end cisco switch for access layer at a branch office, it needs:&#xA;+ to utilize the standard CLI interfaces / IOS setups - no SMB solutions&#xA;+ 24 1GB copper ports, with some sort of SFP/GBIC expansion module for uplinks&#xA;+ to be at/near/or under 1k&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We currently have two HP ProCurve's (unsure of the model at this time).  Current bid from management is a low end HP switch (SMB) but I'd really like to get our environment consistently Cisco.  Trying to stay under 1k new for each device.  Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2013-09-06T01:45:24.233" Title="Low end cisco switch with 'regular' CLI?" Tags="|cisco|" AnswerCount="2" CommentCount="3" ClosedDate="2018-03-07T00:33:02.217" ContentLicense="CC BY-SA 3.0" />
  <row Id="3102" PostTypeId="2" ParentId="3100" CreationDate="2013-09-05T14:11:14.530" Score="5" Body="&lt;p&gt;Yep, indeed, this is a base memory SRX. UTM is supported on high memory devices only. Bad luck. :(&lt;/p&gt;&#xA;" OwnerUserId="195" LastActivityDate="2013-09-05T14:11:14.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3103" PostTypeId="2" ParentId="3101" CreationDate="2013-09-05T15:23:45.650" Score="3" Body="&lt;p&gt;You're not going to hit that price point with those requirements. A 2960X will meet those requirements at a 2.5kish price point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would stick with HP if your price point is 1k. The ProCurve line works well and has a lifetime warranty. Anytime I cannot get the funds for Cisco, that is my backup. Though I usually opt for the 2910al ProCurves which are 2.5k or so new.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Some Cisco options a bit above 1k...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2960X-24TS-L 1600USD&lt;/li&gt;&#xA;&lt;li&gt;2960X-24TS-LL 1300USD&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You will want to look at what limitations the Lan Lite model has (LL).&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-09-05T15:29:47.537" LastActivityDate="2013-09-05T15:29:47.537" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3104" PostTypeId="1" AcceptedAnswerId="3108" CreationDate="2013-09-05T18:58:43.813" Score="7" ViewCount="1634" Body="&lt;p&gt;I asked a previous question &quot;Low end cisco switch with 'regular' CLI - which led me to look at the 2960X platform as an affordable access layer switch at a branch office.. I know on the older 2950's managing them was the same as managing any other standard device via CLI.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2960 platforms list 'simplified management' .. which scares me.  Anyone using these now can verify it's just regular cat IOS, using all standard commands etc, just with a reduced set of features?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it uses a fruity SMB type CLI I want to avoid this platform.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2013-09-12T14:03:49.580" Title="Cisco 2960X is 'normal' IOS CLI or not?" Tags="|cisco|cisco-catalyst|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3107" PostTypeId="1" CreationDate="2013-09-05T21:02:38.123" Score="16" ViewCount="3664" Body="&lt;p&gt;I'm seeing an issue with &lt;a href=&quot;/tags/bfd&quot; title=&quot;Bidirectional Forwarding Detection&quot;&gt;BFD&lt;/a&gt; on a link that's being policed egress where it appears during times where the policer is maxed BFD packets are not getting to the other side.  I'm wondering if BFD hellos are subject to the policer or if they fall outside of the policer.  If they are subject to a policer is it as simple as adding a match for DSCP CS6 and giving it priority?  Below is the config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/1&#xA; service-policy output 500meg&#xA;end&#xA;&#xA;Router-1#sh policy-map 500meg&#xA;  Policy Map 500meg&#xA;    Class class-default&#xA;     police cir 500000000 bc 31250000 be 31250000&#xA;       conform-action transmit&#xA;       exceed-action drop&#xA;       violate-action drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="625" LastEditorUserId="49" LastEditDate="2013-09-06T13:47:37.307" LastActivityDate="2015-08-13T06:38:58.320" Title="class-default matches control traffic?" Tags="|cisco|router|ethernet|qos|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3108" PostTypeId="2" ParentId="3104" CreationDate="2013-09-05T23:38:03.630" Score="15" Body="&lt;p&gt;The Cisco 2960-X is an IOS platform. According the to the datasheet it ships with LAN Lite, LAN Base, or IP Lite(&lt;em&gt;all IOS variants&lt;/em&gt;) depending on the hardware you select. You may want to consult the documents linked below to determine what feature(s) you require, as the lite models cannot be upgraded to the comparable base IOS version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ekr4o.png&quot; alt=&quot;2960 LAN-LITE&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps12995/data_sheet_c78-728232.html&quot; rel=&quot;noreferrer&quot;&gt;2960-X Data Sheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps6406/prod_qas0900aecd80322c37.html&quot; rel=&quot;noreferrer&quot;&gt;2960 Q&amp;amp;A&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2476" LastActivityDate="2013-09-05T23:38:03.630" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3111" PostTypeId="2" ParentId="3101" CreationDate="2013-09-06T01:45:24.233" Score="1" Body="&lt;p&gt;A 2960S-24TS-S meets those requirements and depending on your discount level it should be in the neighborhood of $1k&lt;/p&gt;&#xA;" OwnerUserId="86" LastActivityDate="2013-09-06T01:45:24.233" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3112" PostTypeId="1" CreationDate="2013-09-06T02:09:20.483" Score="3" ViewCount="3248" Body="&lt;p&gt;Work got a couple of Palo Alto boxes that will be used for a customer. No real gameplan has been issued yet, but I was wondering what exactly sets these boxes apart from, say, an ASA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears to me to just be a linux machine with their custom overlay. I'm sure there's a lot I'm not seeing as I haven't done much with them, but I can't help but be wary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm asking is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What are the strengths of Palo Alto Firwalls(specifically the 3000 series)&lt;/li&gt;&#xA;&lt;li&gt;In what cases would you use one over a Cisco ASA?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="301" LastEditorUserId="301" LastEditDate="2013-09-07T01:03:57.240" LastActivityDate="2013-09-19T16:02:14.297" Title="Palo Alto - What's the big deal?" Tags="|cisco|firewall|palo-alto|" AnswerCount="3" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="3113" PostTypeId="1" AcceptedAnswerId="3123" CreationDate="2013-09-06T02:31:04.307" Score="6" ViewCount="201" Body="&lt;p&gt;We have a customer who we are advertising full routes to, and he is sending prefixes to us.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the customer wants his ASN to show in the as path for his /24.  Right now his /24 is terminating at our ASN, and I'm not sure what configuration parameter needs to be set to allow his ASN to show in the as path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit (added parts of config):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; neighbor x.x.x.x route-map in RX:xxxxx&#xA; neighbor x.x.x.x route-map out SSSSSS&#xA;&#xA;#sh route-map SSSSSS&#xA;route-map SSSSSS permit 10&#xA; match as-path  10&#xA;&#xA;ip as-path access-list 10 seq 5 permit .*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have the customers /24 added to the upstream's prefix list.  Do I not do this?&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="775" LastEditDate="2013-09-09T07:58:40.537" LastActivityDate="2015-07-17T19:05:00.343" Title="Originate Customer AS" Tags="|routing|bgp|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="3114" PostTypeId="2" ParentId="3107" CreationDate="2013-09-06T06:59:28.850" Score="-1" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/en/US/technologies/tk648/tk365/tk480/technologies_white_paper0900aecd80244005_ps6599_Products_White_Paper.html&quot; rel=&quot;nofollow&quot;&gt;this cisco document&lt;/a&gt; &quot;Users cannot, for example, filter or apply Quality of Service (QoS) to transmitted BFD packet&quot;. So I suppose those packets get the &lt;a href=&quot;http://www.cisco.com/en/US/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND/QoSIntro.html#wp46814&quot; rel=&quot;nofollow&quot;&gt;PAK_PRIORITY flag&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="530" LastActivityDate="2013-09-06T06:59:28.850" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3115" PostTypeId="2" ParentId="3079" CreationDate="2013-09-06T07:14:54.290" Score="2" Body="&lt;p&gt;In your place, if i were in the chance to spend some moneys, I would  put a UTM capable box between your gateway and your LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance is extremely easy to put a FortiGate firewall in transparent mode ( working like a ethernet bridge ) and drop all the web requests destined to the &quot;Social Networking&quot; sites category. &lt;/p&gt;&#xA;" OwnerUserId="530" LastActivityDate="2013-09-06T07:14:54.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3116" PostTypeId="1" CreationDate="2013-09-06T08:42:28.813" Score="7" ViewCount="7702" Body="&lt;p&gt;i have a CAT2960 switch from which i am polling mac address tables the cable from the ethernet socket to the switch is placed in port 24, and i have 2 more pc ethernet cables in port 3 and port 7. when i use the command &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[sosytee@20090886~]$ snmpbulkwalk -v 2c -c public@1 -OXsq 10.0.0.98 \ &#xA;  .1.3.6.1.2.1.17.4.3.1.2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I get so many different mac addresses for port 24, here is an extract of what i get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dot1dTpFdbPort[0:6:53:fe:39:e0] 24 &#xA; dot1dTpFdbPort[0:1d:a1:cd:53:46] 24 &#xA; dot1dTpFdbPort[0:30:1b:bc:a7:d7] 3 &#xA; dot1dTpFdbPort[0:80:c8:0:0:0] 7 &#xA; dot1dTpFdbPort[38:ea:a7:6d:2e:8e] 24 &#xA; dot1dTpFdbPort[80:ee:73:2f:b:40] 24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would want to know how i should interpret this because i was assuming each port presents one mac address. Or is it that the switch has many mac addresses.&lt;/p&gt;&#xA;" OwnerUserId="2421" LastActivityDate="2016-09-20T06:24:45.480" Title="MAC Address table brings several different mac addresses for one port" Tags="|cisco-catalyst|snmp|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3121" PostTypeId="1" CreationDate="2013-09-06T12:01:10.417" Score="6" ViewCount="2564" Body="&lt;p&gt;I recently got around to measuring effective throughputs on a pretty big, switched network. I measured the throughputs by having two laptops, both running Iperf; one being the server, the other a client. I made sure to measure both the up- and downlink throughputs. My problem comes from the fact that some 100 Mbit/s paths were measured as everything from 50 to 80 Mbit/s. That seems kind of low, even taking overhead and plenty of active users into account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some useful information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network uses RSTP and has no routed hops.&#xA;There are at least 100 active users along the path from the Iperf client to the server.&#xA;The throughputs were measured on paths with at least three 100 Mbit/s switches between the two laptops.&#xA;I measured using TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question can be summarized as: are these values something to be expected&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another question: I also got about 250-300 Mbit/s on a Gigabit switch while having the two nodes plugged into it. I used regular straight-through cables for both nodes. This can't be expected, even though the switch is in use by other machines, right?&lt;/p&gt;&#xA;" OwnerUserId="2581" LastActivityDate="2013-11-14T00:02:33.097" Title="Typical throughput on switched network" Tags="|switch|throughput|" AnswerCount="3" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="3122" PostTypeId="1" AcceptedAnswerId="3126" CreationDate="2013-09-06T12:39:13.327" Score="4" ViewCount="283" Body="&lt;p&gt;I am new to the whole networking world and I apologize if this is a re-post of a question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to know is that is there a mechanism for routers to discover its environment. NOT what a dynamic routing table does. but more than that. for example an intelligent system that would discover its environment such as what are the supporting routing and security protocols each neighboring routers are using. more like an advanced routing table which stores more than what a dynamic routing table holds. any references would be of great help :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I directed this question to you experts cause i do not have the knowledge or know the keywords to search online on this subject matter.&lt;/p&gt;&#xA;" OwnerUserId="2563" LastEditorUserId="775" LastEditDate="2013-09-06T16:51:35.007" LastActivityDate="2013-09-11T12:37:16.893" Title="Router neighbour config discovery" Tags="|routing|router|security|management|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3123" PostTypeId="2" ParentId="3113" CreationDate="2013-09-06T12:48:56.943" Score="7" Body="&lt;p&gt;I believe I found the problem.  It looks like another tech had &quot;nailed&quot; down his /24 to our routers to null0 which was why it was terminating at our ASN.  Removing the null0 route resolved the issue it seems.&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="33" LastEditDate="2015-07-17T19:05:00.343" LastActivityDate="2015-07-17T19:05:00.343" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3124" PostTypeId="2" ParentId="3116" CreationDate="2013-09-06T13:15:54.720" Score="12" Body="&lt;p&gt;I think that you have another switch or hub connected to port 24 of your 2960, and there are 4 hosts connected to that switch/hub.&lt;/p&gt;&#xA;" OwnerUserId="502" LastEditorUserId="49" LastEditDate="2013-09-06T13:52:38.280" LastActivityDate="2013-09-06T13:52:38.280" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3126" PostTypeId="2" ParentId="3122" CreationDate="2013-09-06T14:37:57.703" Score="2" Body="&lt;p&gt;Converting my comments to an answer...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration discovery is a complicated task that involves both seeing and interpreting device configs.  This task is manual today... there is no comprehensive automation for it.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-09-06T14:37:57.703" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3128" PostTypeId="1" AcceptedAnswerId="3160" CreationDate="2013-09-06T18:02:39.953" Score="7" ViewCount="2011" Body="&lt;p&gt;I have users that need to be able to work remotely.  In their current environment they use workstations with unique software that requires their IP address remain the same.  Now that they are working remotely, they are assigned a new DHCP subnet for the VPN remote access and the software no longer works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm considering creating a NAT for the remote users IP address to their &lt;em&gt;former&lt;/em&gt; LAN IP so the software would work.  However, I'm concerned this would cause a conflict even though the NAT wouldn't be used until the laptop leaves the office and remotes in.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I may be able to reserve IPs based on the remote users login at my VPN/firewall, but this only would help a single office location and not every office has an Internet connection and firewall/VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those other offices are connected via a private WAN and NATting those LAN subnet IPs at the main office with Internet access would result in duplicate BGP advertisements on the private WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone run into this before, is it possible to do?  I expect I will end up running Citrix, RDP, or Terminal Services.  However, I'm curious if there is a simpler way. Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--ALSO--&#xA;Here are some examples of threads in the same 'spirit', although I'm looking to utilize a software VPN client and not a site-to-site VPN configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forums.juniper.net/t5/SRX-Services-Gateway/Possible-to-bridge-same-subnet-over-VPN/td-p/112432&quot;&gt;http://forums.juniper.net/t5/SRX-Services-Gateway/Possible-to-bridge-same-subnet-over-VPN/td-p/112432&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.aminus.org/blogs/index.php/2005/04/16/site_to_site_bridged_ethernet_using_open_2?blog=2&quot;&gt;http://www.aminus.org/blogs/index.php/2005/04/16/site_to_site_bridged_ethernet_using_open_2?blog=2&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1989" LastEditorUserId="1989" LastEditDate="2013-09-06T18:46:08.447" LastActivityDate="2020-05-05T16:00:49.193" Title="Users want to work remotely, but need to use the same LAN IP addresses" Tags="|cisco|vpn|firewall|" AnswerCount="6" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3129" PostTypeId="1" AcceptedAnswerId="3131" CreationDate="2013-09-06T21:38:28.657" Score="40" ViewCount="41397" Body="&lt;p&gt;Lately I have been checking datasheets of several switch models from diferent vendors. For a given switch, vendors publish a couple of figures that I think are a measure of the capacity/performance of the switch: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One value is always measured in packets per second &lt;/li&gt;&#xA;&lt;li&gt;The other one is always measured in bits per second &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Despite different vendors use different names for the figures, seems the meaning is always the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to understand three things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is the exact meaning of each figure?&lt;/li&gt;&#xA;&lt;li&gt;What is the difference between them? &lt;/li&gt;&#xA;&lt;li&gt;When should I focus on each value for switch assessment?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="76" LastActivityDate="2013-09-11T12:30:46.940" Title="Bits per second vs. Packets per second" Tags="|switch|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3130" PostTypeId="2" ParentId="3129" CreationDate="2013-09-07T00:48:02.547" Score="10" Body="&lt;p&gt;Usually you are presented with throughput in Mbps (M-bits/sec) and Mpps (M-packets/sec).  These are considered backplane or box throughput numbers.  &lt;strong&gt;Marketing materials usually present the numbers in the best light which is under ideal conditions of large packets with 1500 bytes in length.  Realistic throughput can be obtained under test conditions that use &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Mix&quot;&gt;Internet Mix&lt;/a&gt; (IMIX) of data where both packets lengths and protocols vary.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Mbps vs Mpps -- &quot;M&quot; included as the numbers are often shown x 10^6 -- is simply the difference between the raw &quot;bit&quot; vs &quot;packet&quot; switching or processing capacity.  When hardware switching is possible, the numbers assume the best conditions where process-switching (punting to CPU) isn't necessary on every packet.&lt;/li&gt;&#xA;&lt;li&gt;Since large frames (not Jumbos) have payloads of 1500 Bytes, this 1 packet of 1500 Bytes x 8 bits/Byte = 12,000 bits.&lt;/li&gt;&#xA;&lt;li&gt;The Mbps clues you into the capacity of bit switching when aggregating all the interfaces.  The Mpps helps you understand how many aggregate packets can be handled.  This can all be changed if you're considering something like Cisco switch modules with DFC.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-09-07T00:48:02.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3131" PostTypeId="2" ParentId="3129" CreationDate="2013-09-07T00:48:25.207" Score="32" Body="&lt;p&gt;I just want to briefly mention the reality of marketing math when you're considering vendor data sheets.  It is very common for vendors to double-count bps or pps capacity when you have full-duplex links.  For instance, Cisco's Catalyst 6500 has a Supervisor 720.  720 is used because it is marketed as having 720Gbps of fabric capacity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But... if you ask how Cisco calculates 720Gbps, the answer is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;80Gbps of fabric per slot times 9 slots in a chassis&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The issue here is their fabric is only a 40Gbps full-duplex fabric... However, Cisco counts both ingress and egress in the 720G number, even though it doesn't really make sense to count like that.  The take-away is you sometimes need to be careful and inspect how you can apply the numbers in vendor literature to reality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Almost every vendor twists marketing numbers like this, and I only pick the Cat6500 because I'm very familiar with the platform.  This is not a condemnation of Cisco or the Cat6500 (which I actually have quite a passion for).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the exact meaning of each figure?  What is the difference between them?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;bps&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Number of bits of data per second that can be processed without dropping data.  bps is almost always measured using 1500 byte (or potentially larger) ethernet payloads.&lt;/li&gt;&#xA;&lt;li&gt;bps is frequently used when measuring the capacity of components which interconnect multiple linecards or ports within a chassis (like a switch fabric).  Occasionally, a central processing engine might have a bps limitation...&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;pps&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Number of packets of data per second that can be processed before dropping data; pps is always measured using the smallest packet sizes possible.&lt;/li&gt;&#xA;&lt;li&gt;pps is frequently used when measuring components that look inside a packet header (for an IP address, mac-address, DSCP value, etc...).   For example, the capacity of route and switch processors are measured in pps.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When should I focus on each value for switch assessment?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is a time and place for this kind of analysis, but most people only use a tiny fraction of their switch pps / bps capacity, unless it's a top of rack switch in a busy data center, or a core switch for a mid to large service provider POP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even so, vendor sales staff might not be interested in highlighting the product limitations, or may not understand the limits well themselves.  Also, the packet-per-second numbers often change depending on the features, or combination of features that you turn on... there really is no substitute for coming up with a few good test cases, and testing the performance of the box with the combination of features you think you realistically need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to variances and the games people can play with numbers on data sheets, the most important thing you can ask the vendor is &quot;&lt;em&gt;show me how you calculated the bps and pps numbers for this component&lt;/em&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, hardware and software features are as important, or more important to consider than drag-race bps / pps numbers... I'm including a small sample of items you might want to look at... this is very subjective...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;On forwarding engines (normally measured in pps)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Add up the bandwidth of an average chassis port count, and find the average packet size (at the advertised non-drop rate) with features on and then with off (compare how these numbers may change)&lt;/li&gt;&#xA;&lt;li&gt;Aggregate IPv4 / IPv6 / MPLS pps performance (these numbers may change, depending on the platform, or combinations of features that you use)&lt;/li&gt;&#xA;&lt;li&gt;ACL rule limitations (on number of ACEs, header fields you can filter on, counters, etc...)&lt;/li&gt;&#xA;&lt;li&gt;Total number of prefixes / mac addresses supported in HW and in DRAM&lt;/li&gt;&#xA;&lt;li&gt;SNMP MIBs supported&lt;/li&gt;&#xA;&lt;li&gt;QoS modes and features supported, as well as how easily you can integrate these QoS features into the rest of your network.&lt;/li&gt;&#xA;&lt;li&gt;Route processor failover times&lt;/li&gt;&#xA;&lt;li&gt;Availability and reliability of In service software upgrades&lt;/li&gt;&#xA;&lt;li&gt;Does the OS have modular software components&lt;/li&gt;&#xA;&lt;li&gt;Are Vlans locally significant to an interface, or does the box have global vlan utilization&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;fabric / linecard fabric connections / linecard ASICs (normally measured in bps)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Average cost per 1GE or 10GE port&lt;/li&gt;&#xA;&lt;li&gt;Port count and linecard oversubscription ratios&lt;/li&gt;&#xA;&lt;li&gt;Linecard and port buffer sizes&lt;/li&gt;&#xA;&lt;li&gt;Whether the switch supports backpressure to ingress linecards, if the egress fabric port is congested&lt;/li&gt;&#xA;&lt;li&gt;Ingress vs Egress multicast replication&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-09-07T05:00:18.053" LastActivityDate="2013-09-07T05:00:18.053" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3132" PostTypeId="1" AcceptedAnswerId="3211" CreationDate="2013-09-07T01:07:42.430" Score="8" ViewCount="2128" Body="&lt;p&gt;In an one-armed SLB configuration, SNAT is used to force return-traffic to pass through the SLB.  This has one negative: simply that web logs cannot capture the true client IP unless passed in XFF (X-Forwarded-For) header and the web server is able to log.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative is to use PBR (policy based routing) to get the return-traffic back to the SLB, but I try to avoid PBR unless there's no other/better solution  On the 6500E platform with SUP720/PFC3B -- and I know the particular IOS version can be a factor too -- &lt;strong&gt;does PBR add any latency over doing SNAT assuming PBR is all done in hardware?&lt;/strong&gt;  If PBR is done in hardware using only the commands supported by it today, is it possible upgrading IOS in the future could change PBR to be done in software/process-switched?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, our load-balancers have most of the web server VLANs directly behind them -- default g/w pointing to SLB -- and other servers like SQL in non-SLB VLANs.  However, this web-sql traffic transits the SLB.  Our goal would be to avoid crossing the SLB and just keeping SQL traffic separate, and still retaining the true client in web logs.  I'd prefer to not introduce troubleshooting complexity with PBR and possibly having this change from hardware to software processed in the future.  &lt;strong&gt;Short of the XFF and SNAT mentioned earlier, is PBR the only option here and what's the best way to keep PBR tightly configured?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="775" LastEditDate="2013-09-14T09:11:52.987" LastActivityDate="2013-09-17T02:25:53.777" Title="SNAT vs PBR for Server Load Balancing" Tags="|cisco|nat|cisco-6500|pbr|load-balancer|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3133" PostTypeId="1" AcceptedAnswerId="3136" CreationDate="2013-09-07T01:59:57.793" Score="10" ViewCount="4742" Body="&lt;p&gt;Unicast RPF is supposed to prevent source addresses that differ from what they should be to be allowed. While reading Cisco's documentation for URPF, I noticed that there are options to allow it to be used on an uplink interface by letting it go by the routing-table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, if it's going by a default route wouldn't all source addresses be allowed? What benefit would URPF be doing at that point? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure I'm missing something, so I'd really like a point in the right direction.&lt;/p&gt;&#xA;" OwnerUserId="301" LastEditorUserId="775" LastEditDate="2013-09-07T12:42:43.903" LastActivityDate="2013-09-07T12:42:43.903" Title="Unicast RPF On the Edge" Tags="|ipv4|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3134" PostTypeId="1" CreationDate="2013-09-07T02:41:30.440" Score="32" ViewCount="5817" Body="&lt;p&gt;There's no doubt the vast majority of Ethernet frames are transporting IP packets. I know there are various other protocols that can be transported over Ethernet as well, but those can be transported over IP as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With modern Ethernet networks being full-duplex, Ethernet has effectively turned into a point-to-point interconnect between an endpoint and a switch, which switches the packet based on the MAC destination. L3 switches do the same thing but also perform some IP routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since we use Ethernet mostly only as a means to transport IP, is there any reason to have that extra layer of L2 overhead? Why not just route packets based on the destination IP? I suppose that would be breaking the OSI model, to some extent, in that L2 would cease to exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine a link layer technology that was designed only to transport IP, and didn't have any specific L2 functionality or header of its own. Switches and routers would continue to exist like today: switches would be &quot;basic routers&quot; (just like L3 switches are) and mostly only take fixed routes and a default route. Switching flow: is there a route in place for this destination? Stick it in that interface's queue. If not, stick it in the default route's interface's queue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any compelling argument for keeping things the way they are?&lt;/p&gt;&#xA;" OwnerUserId="2586" LastEditorUserId="775" LastEditDate="2013-09-07T23:52:57.757" LastActivityDate="2021-10-22T05:57:53.563" Title="Why do we still use Ethernet?" Tags="|ethernet|protocol-theory|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3136" PostTypeId="2" ParentId="3133" CreationDate="2013-09-07T04:49:56.057" Score="15" Body="&lt;p&gt;Unicast Reverse Path Forwarding (RPF) functions in three distinct modes and can potentially help reduce a router's attack vector, specifically from spoofed IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Strict Mode&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(config-if)#ip verify unicast source reachable-via rx&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In strict mode, a router will inspect and check an incoming packet's source IP address against it's Forwarding Information Base (FIB) table for a matching route. &lt;em&gt;If the route to that source IP address is reachable via the interface it was received on&lt;/em&gt;, the packet will be received. By default, a default route is not considered in strict mode (as configured above).&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;&lt;em&gt;Strict Mode Options:&lt;/em&gt;&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Following the configuration of Unicast RPF strict mode on a given interface, a router can no longer ping itself on that interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh ip int bri | ex unas|Int&#xA;FastEthernet0/0            11.0.11.1&#xA;&#xA;#ping 11.0.11.1                                    &#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Verification of URPF dropped packets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show ip int fa0/0 | i ^  [1-9]+ verification drops&#xA;     5 verification drops&#xA;#show ip traffic | i unicast&#xA;     0 no route, 5 unicast RPF, 0 forced drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This behavior can be altered by adding the &lt;code&gt;allow-self-ping&lt;/code&gt; syntax:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(config-if)#ip verify unicast source reachable-via rx allow-self-ping&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, as mentioned in your question, strict mode can allow incoming packet's source IP addresses to be checked against a default route. This is enabled by the syntax &lt;code&gt;allow-default&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In strict mode, adding the syntax &lt;code&gt;allow-default&lt;/code&gt; by itself will only prevent receipt from incoming packet's source IP address that have a route out via a different interface than received. This is assuming there are no access-lists or null routes configured on the router. All routeable source addresses that are reachable out the interface they're received will either match against specific routes or the default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you were to employ null routes, the most specific route will be evaluated first, before the URPF check gets to the default route, and will act as a black list(s) for known malicious IP ranges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Example -&lt;/em&gt; All traffic sourced from 3.0.0.0/8 will be dropped by the URPF check:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-if)#ip verify unicast source reachable-via rx allow-default&#xA;(config)#ip route 3.0.0.0 255.0.0.0 null 0&#xA;&#xA;Bad-Source-RTR#ping 11.0.11.1 so l1&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 11.0.11.1, timeout is 2 seconds:&#xA;Packet sent with a source address of 3.3.3.3 &#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Furthermore, you can specify an Access-Control List (ACL) in stead of adding the &lt;code&gt;allow-default&lt;/code&gt; syntax to accomplish a structured list of allowed and denied addresses. Addresses that are reachable out of the interface they were received on and are matched in a defined ACL are either dropped or permitted accordingly.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;access-list 23 permit 3.0.0.0 0.255.255.255&#xA;access-list 23 deny   4.0.0.0 0.255.255.255 log&#xA;access-list 23 permit any&#xA;!&#xA;(config)#int fa0/0                                 &#xA;(config-if)#ip verify unicast source reachable-via rx 23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, you can specify an ACL with the &lt;code&gt;allow-default&lt;/code&gt; syntax, but it will have no effect. The packets will not be checked against ACLs specified with the &lt;code&gt;allow-default&lt;/code&gt; option.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#ip verify unicast source reachable-via rx allow-default ? &#xA;  &amp;lt;1-199&amp;gt;          A standard IP access list number&#xA;  &amp;lt;1300-2699&amp;gt;      A standard IP expanded access list number&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Loose Mode&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config-if)#ip verify unicast source reachable-via any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In loose mode, a router will inspect an incoming packet's source IP address, and check it against it's FIB table for a matching route. If the route to that source IP address is reachable, the packet can be received, &lt;em&gt;regardless of the interface it was received on.&lt;/em&gt; By default, a default route is not considered in loose mode (as configured above).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Loose mode and strict mode have similar configuration options; The main differences are the syntax that's used (&lt;code&gt;any&lt;/code&gt; vs. &lt;code&gt;rx&lt;/code&gt;) and whether or not the the incoming packet's source IP address is reachable via the interface it was received on.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-if)#ip verify unicast source reachable-via any ?&#xA;  &amp;lt;1-199&amp;gt;          A standard IP access list number&#xA;  &amp;lt;1300-2699&amp;gt;      A standard IP expanded access list number&#xA;  allow-default    Allow default route to match when checking source address&#xA;  allow-self-ping  Allow router to ping itself (opens vulnerability in&#xA;                   verification)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;VRF Mode&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;VRF mode can leverage either loose or strict mode in a given VRF and will evaluate an incoming packet's source IP address against the VRF table configured for an eBGP neighbor. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;References:&lt;/strong&gt; &lt;br&gt;&#xA;&lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/urpf.pdf&quot;&gt;Cisco URPF white paper&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/unicast-rpf.html&quot;&gt;Understanding Unicast Reverse Path Forwarding&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfrpf.html&quot;&gt;URPF configuration guide&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2476" LastEditorUserId="2476" LastEditDate="2013-09-07T11:49:15.207" LastActivityDate="2013-09-07T11:49:15.207" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3138" PostTypeId="2" ParentId="3129" CreationDate="2013-09-07T06:16:21.890" Score="9" Body="&lt;p&gt;To add to good answers given by @generalnetworkerror and @MikePennington &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both pps and bps reported in datasheets are idealized numbers, not only is bps often double counted (the double counting comes from the fact that to cater 10Gbps interface, you'll need 20Gbps of memory bandwidth, so in this context it's fair, but may be confusing to buyer) like Mike explained.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But they, especially pps are also idealized to a scenario of vendor's definition of 'typical', the scenario has much less affect in switch-like devices (Cisco catalyst, Juniper ex, Force10, Brocade) as they tend to run in constant-time ASIC type devices for lookup. And it tends to have more effect to router-like devices (Cisco ASR9k, Juniper MX, Alcatel SR) as they tend to run NPU, which is close to normal CPU in design, and it'll take variable time to perform work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This inherent feature is exploited when vendors buy 'verified by 3rd party' tests, like Cisco might pay Miercom to test Cisco+Juniper and Juniper might pay EANTC to test Cisco+Juniper.&lt;br&gt;&#xA;These EANTC and Miercom engineers are given inside information for both platforms and they use this inside information to show how one platform (of paying customer) out-performs another platform. Because they choose test-cases which target compromises in the idealized scenario chosen by that vendor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luckily rarely will in switch-like device will pps or bps become an issue to you, it's far more likely you'll be bitten by for example micro-bursting (consequence of small buffers) before even close to platforms bps/pps limits.&lt;br&gt;&#xA;More typically pps and bps affect you in low-end boxes running COTS CPU's, i.e. software-based boxes, like Cisco ISR, Juniper SRX branch or firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In very generic and rough terms, bps measures memory bandwidth and pps measures lookup performance ('CPU' speed)&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-09-07T06:16:21.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3139" PostTypeId="2" ParentId="3134" CreationDate="2013-09-07T06:53:18.123" Score="22" Body="&lt;p&gt;That's a very good question.&lt;/p&gt;&#xA;&lt;p&gt;I don't think we'll get rid of Ethernet, as multi-access links are still going to be needed indefinitely.&lt;/p&gt;&#xA;&lt;p&gt;However, much of the core network really has no use at all for DMAC/SMAC, so there certainly should be 'point-to-point' variant of Ethernet with much shorter frame. Instead of current 18B (DMAC+SMAC+Type+FCS), you could do with 6B (Type+FCS).&lt;br /&gt;&#xA;This point-to-point variant of ethernet would nicely offset the overhead needed in core (MPLS labels, VLAN tags) so customer/edge frame-size would more closely follow core frame-size. It would also remove need for ARP and ND, reducing risks and simplifying the core.&lt;br /&gt;&#xA;Technically, there is no reason why you couldn't entirely drop L2 part of ethernet, but you're going to need its L1 part, as IP itself has no specification how to code it to any wire. So you could run L1 ethernet with L2 payload (IP) directly on top of it.&lt;/p&gt;&#xA;&lt;p&gt;I'm personally convinced that when the time comes that we'll specify new ethernet header to use &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/23566/what-are-eui-48-and-eui-64&quot;&gt;EUI64&lt;/a&gt; instead of EUI48, people will want a point-to-point flavor of that L2 protocol. I don't believe it will be 'null L2', as at least Frame Check Sequence (FCS) and payload-type (IP? MPLS? Ethernet?) seem desirable.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="36720" LastEditDate="2021-10-22T05:57:53.563" LastActivityDate="2021-10-22T05:57:53.563" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="3140" PostTypeId="2" ParentId="3134" CreationDate="2013-09-07T12:23:50.683" Score="28" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Since we use Ethernet mostly only as a means to transport IP, is there any reason to have that extra layer of L2 overhead?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Naming a few common protocols or features that require L2 overhead such as Ethernet:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Spanning-Tree (requires 802.2 LLC)&lt;/li&gt;&#xA;&lt;li&gt;ISIS (requires 802.2 LLC)&lt;/li&gt;&#xA;&lt;li&gt;Vlans&lt;/li&gt;&#xA;&lt;li&gt;ARP (which is not just for ethernet)&lt;/li&gt;&#xA;&lt;li&gt;Choosing between IPv4 and IPv6&lt;/li&gt;&#xA;&lt;li&gt;IEEE 802.11 Wifi (which shares many basic functions with 802.3 Ethernet, but is fundamentally a different protocol)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Ethernet has effectively turned into a point-to-point interconnect between an endpoint and a switch, which switches the packet based on the MAC destination. Is there any compelling argument for keeping things the way they are?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;If you say Ethernet is only for addressing and point-to-point connections, you are over-simplifying the protocol. IEEE 802.3 also covers the physical layer: various forms of copper and fiber media, encoding on the wire, error recovery, line conditioning, and so on. If you add all these functions directly on IPv4, you duplicate many of Ethernet's functions and what have you really saved?  This also ignores the monumental standardization and engineering effort to build these functions directly into IPv4 and IPv6. My brain hurts to think how this would work at a practical level anyway.&lt;/p&gt;&#xA;&lt;p&gt;In the end, the argument is economics. The entire planet has engineered servers / switches / operating systems / etc around the assumption of a link-layer between IP and the signal encoding on the wire (or wifi-radio). Ethernet does a lot for us, and it's extremely cheap because it's the de facto interconnect technology for most computers on the planet.  Replacing Ethernet is somewhat akin to replacing the US Congress as a governing body. It may not be perfect, but it's inconceivable to do anything else at this point.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2021-10-22T00:29:44.973" LastActivityDate="2021-10-22T00:29:44.973" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="3141" PostTypeId="1" AcceptedAnswerId="3143" CreationDate="2013-09-07T15:13:16.820" Score="3" ViewCount="4091" Body="&lt;p&gt;I'm having a problem understanding this question regarding circuit-switched networks. I get the main concept that the connections are reserved for each link, but these two questions are confusing me. I was asked to find two things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The maximum number of simultaneous connections that can be in progress at any one time.&lt;/li&gt;&#xA;&lt;li&gt;The maximum number of simultaneous connections that can be in progress at any one time if all the connections are between the switch in the upper-left-hand corner and the switch in the lower-right-had corner.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm not sure about the first question (my guess is 4 connections), but I'm pretty positive that the answer for the second question is 4 connections.&#xA;I'm not asking for an answer. I'm just trying to understand the difference between the two questions. Thanks for the help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zLEv9.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solution for question 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dV7aB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user2592" LastEditorDisplayName="user2592" LastEditDate="2013-09-07T20:23:59.743" LastActivityDate="2022-10-28T05:44:27.187" Title="Simple circuit-switched network" Tags="|switch|" AnswerCount="2" CommentCount="3" ClosedDate="2022-10-28T12:14:12.033" ContentLicense="CC BY-SA 3.0" />
  <row Id="3143" PostTypeId="2" ParentId="3141" CreationDate="2013-09-07T18:03:06.397" Score="2" Body="&lt;p&gt;Circuit-switched networks have to reserve a segment for each hop along the journey, so the farther away the two connected endpoints are, the more links are reserved for the call. In your case, if the upper-left router were making calls to the lower-left router, only the segments on the left side of the diagram were being in use, while all the others were still free, but as shown, when it calls the lower-right router, it has to use segments from two of the sides to get there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can fit a lot more calls in if each call just needs one hope than if each call needs multiple.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-09-07T18:03:06.397" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3144" PostTypeId="2" ParentId="3116" CreationDate="2013-09-07T20:08:03.330" Score="5" Body="&lt;p&gt;You are polling a table with the known MAC addresses. It seems that your switch is connected to another one on port 24 so all MAC's that come from the other switch are seen on port 24. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find a description of the SNMP MIB here :  &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=dot1dTpFdbPort&quot; rel=&quot;nofollow&quot;&gt;dot1dTpFdbStatus&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Either the value '0', or the port number of the port on which a frame&#xA;  having a source address equal to the value of the corresponding&#xA;  instance of dot1dTpFdbAddress has been seen. A value of '0' indicates&#xA;  that the port number has not been learned but that the bridge does&#xA;  have some forwarding/filtering information about this address (e.g. in&#xA;  the dot1dStaticTable). Implementors are encouraged to assign the port&#xA;  value to this object whenever it is learned even for addresses for&#xA;  which the corresponding value of dot1dTpFdbStatus is not learned(3).&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2595" LastEditorUserId="775" LastEditDate="2013-12-31T18:44:28.563" LastActivityDate="2013-12-31T18:44:28.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3145" PostTypeId="1" AcceptedAnswerId="3146" CreationDate="2013-09-08T03:29:17.767" Score="13" ViewCount="37148" Body="&lt;p&gt;Simple question and the answer is layer 3 of course, but can we say that PAT is working on layer 4 also because it deals with port numbers which is a layer 4 function?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is it only a layer 3 protocol?&lt;/p&gt;&#xA;" OwnerUserId="2596" LastEditorUserId="8499" LastEditDate="2018-03-21T00:57:55.213" LastActivityDate="2020-07-31T23:54:06.887" Title="What layer of the OSI model does NAT work?" Tags="|nat|layer3|layer4|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3146" PostTypeId="2" ParentId="3145" CreationDate="2013-09-08T05:17:03.883" Score="14" Body="&lt;p&gt;NAT works at layer 3 because it is modifying the IP header. If you use PAT you could argue that it is working at layer 4 as well because it MIGHT change the source port of the packet in case it is not unique.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Several internal addresses can be NATed to only one or a few external&#xA;addresses by using a feature called Port Address Translation (PAT)&#xA;which is also referred to as &amp;quot;overload&amp;quot;, a subset of NAT&#xA;functionality.&lt;/p&gt;&#xA;&lt;p&gt;PAT uses unique source port numbers on the Inside&#xA;Global IP address to distinguish between translations. Because the&#xA;port number is encoded in 16 bits, the total number could&#xA;theoretically be as high as 65,536 per IP address.&lt;/p&gt;&#xA;&lt;p&gt;PAT will attempt to&#xA;preserve the original source port, if this source port is already&#xA;allocated PAT will attempt to find the first available port number&#xA;starting from the beginning of the appropriate port group 0-511,&#xA;512-1023 or 1024-65535.&lt;/p&gt;&#xA;&lt;p&gt;If there is still no port available from the&#xA;appropriate group and more than one IP address is configured, PAT will&#xA;move to the next IP address and try to allocate the original source&#xA;port again. This continues until it runs out of available ports and IP&#xA;addresses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So the port will only be modified in case it is not unique.&lt;/p&gt;&#xA;&lt;p&gt;This &lt;a href=&quot;http://www.cisco.com/en/US/technologies/tk648/tk361/tk438/technologies_white_paper09186a0080091cb9.html&quot; rel=&quot;noreferrer&quot;&gt;link&lt;/a&gt; to Cisco is a pretty good overview of NAT.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2020-06-08T15:32:08.003" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="3147" PostTypeId="2" ParentId="2178" CreationDate="2013-09-08T12:09:37.173" Score="5" Body="&lt;p&gt;I configure all my core OSPF interfaces as p2p. I would do the same for integrated IS-IS. This stops the DR/DIS election process from happening which can take a fair amount of time in a re-convergence scenario. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You do not HAVE to have them running as /31. It could be any mask as long as you only have two active speakers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An added advantage on the OSPF side is that you get no type2 generated for the link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Cisco's site as well in regards to integrated IS-IS (&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2s/feature/guide/fissp2p.html#wp1037322&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/docs/ios/12_2s/feature/guide/fissp2p.html#wp1037322&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Benefits of Integrated IS-IS Point-to-Point Adjacency over Broadcast&#xA;  Media&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Configuring an IS-IS point-to-point adjacency over broadcast media&#xA;  provides performance improvements to the network convergence times of&#xA;  the customer's network because the feature saves the system from&#xA;  electing a designated router (DR), prevents flooding from using CSNPs&#xA;  for database synchronization, and simplifies shortest path first (SPF)&#xA;  computations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-09-08T12:09:37.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3148" PostTypeId="1" CreationDate="2013-09-08T19:41:38.720" Score="13" ViewCount="1901" Body="&lt;p&gt;I'm going over the VPLS multihoming options on Juniper's web site. I'm not concerned with LAG and MC-LAG for the moment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I'm aware:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;FEC128 is when you are using manual discovery of pseudowires (LDP)&lt;/li&gt;&#xA;&lt;li&gt;FEC129 is when you are using BGP auto-discovery.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Juniper techpub for FEC129 multihoming I don't have a problem with as &lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junos/topics/topic-map/vpls-bgp-multihoming.html&quot;&gt;Juniper shows how to multihome with BGP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos/topics/usage-guidelines/vpns-configuring-vpls-multihoming.html&quot;&gt;The FEC128 multihome techpub&lt;/a&gt; says that you cannot enable LDP signalling, you have to use BGP signalling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that you can use LDP for manual discovery and LDP will then signal VC labels. You can also use BGP for auto-discovery and LDP for VC label signalling. You can also use BGP for both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I don't get is how you could use FEC128 with BGP signalling. Junos doesn't give you the option to only signal through BGP but manual discovery through LDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, when exactly would the FEC128 config be used over the FEC129 config? If you are using BGP for signalling are you not using BGP for discovery at the same time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or maybe I'm just misunderstanding something?&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-09-08T20:10:44.527" LastActivityDate="2015-03-30T14:50:41.777" Title="VPLS Multihoming on Junos - FEC confusion‏" Tags="|bgp|mpls|juniper-junos|vpls|ldp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3150" PostTypeId="2" ParentId="3116" CreationDate="2013-09-09T08:52:35.417" Score="0" Body="&lt;p&gt;As others on here have stated, you will find many MAC addresses coming from a single port if there is another switch off that port with other hosts connected to it. On a Cisco switch you can view the CAM table (MAC address table) by issuing the &quot;show mac address-table&quot; command. In this output of this table, if your switch has a trunk to another switch that has hosts connected to it, you will see in your MAC address table that number of clients being learned from a single switchport, or, your trunk to the other switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is just the result of switching -- managing layer 2 data links.&lt;/p&gt;&#xA;" OwnerUserId="2600" LastActivityDate="2013-09-09T08:52:35.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3153" PostTypeId="2" ParentId="395" CreationDate="2013-09-09T12:19:47.713" Score="1" Body="&lt;p&gt;One thing that can be done here, is to see what machines are connected to the switch using the commands &lt;code&gt;show cdp neighbor&lt;/code&gt; or &lt;code&gt;show lldp neighbor&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the BPDU guard command is not being used, and someone connects a rogue switch with lower priority (or older mac-address), the new device will negotiate as Spanning Tree root which will surely cause a problem.&lt;/p&gt;&#xA;" OwnerUserId="2579" LastEditorUserId="44" LastEditDate="2013-09-09T23:54:36.510" LastActivityDate="2013-09-09T23:54:36.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3156" PostTypeId="2" ParentId="3134" CreationDate="2013-09-09T19:43:55.447" Score="10" Body="&lt;p&gt;I'll answer this with an absurd question... Why don't we still use &lt;a href=&quot;http://en.wikipedia.org/wiki/ARCNET&quot; rel=&quot;noreferrer&quot;&gt;ARCnet&lt;/a&gt;? Or Token Ring?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are (were, and will be) numerous layer-2 technologies.  For &quot;desktop&quot; systems, ethernet won.  Why do we still use it... the simplest answer is because it works; the technology is simple, cheap, robust, and plentiful. (read: &lt;em&gt;proven technology&lt;/em&gt;) For the record, there are PCI &quot;desktop&quot; ATM cards -- I've not seen one in years, and I've never seen one actually in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you suggest is merely a new layer-2 technology.  I wish you the best of luck getting the world to adopt it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Ok, token-ring still exists, but it's exceeding rare.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-09-09T19:43:55.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3157" PostTypeId="2" ParentId="3128" CreationDate="2013-09-09T21:58:47.953" Score="2" Body="&lt;p&gt;You can easily accomplish this with openvpn. There are a lot of examples on the internet apart from the very nice documentation they have in their site. Just be aware you will need to set up a tap tunnel in order to bridge it with your lan and not a tun tunnel, which is routed. &#xA;&lt;a href=&quot;http://openvpn.net/index.php/open-source/documentation/howto.html#examples&quot; rel=&quot;nofollow&quot;&gt;http://openvpn.net/index.php/open-source/documentation/howto.html#examples&lt;/a&gt;&#xA;If you need more help on than contact me, I could share with you my working configuration.&lt;/p&gt;&#xA;" OwnerUserId="2294" LastActivityDate="2013-09-09T21:58:47.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3158" PostTypeId="2" ParentId="2690" CreationDate="2013-09-10T06:00:29.483" Score="2" Body="&lt;p&gt;After a few tests, I found the solution and it's working. My first configuration was incomplete. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PhHC0.png&quot; alt=&quot;schema&quot;&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://8config.com/template/S13tjNlpe&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuration Generator&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here a working configuration :  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 10&#xA;name vlan_10&#xA; private-vlan primary&#xA;!&#xA;vlan 20&#xA;name vlan_20&#xA; private-vlan primary&#xA;!&#xA;vlan 30&#xA;name vlan_30&#xA; private-vlan primary&#xA;!&#xA;! Isolated VLAN: Connects all CPE hosts to Switch &#xA;!&#xA;vlan 11&#xA;name Pvlan_11&#xA; private-vlan isolated&#xA;!&#xA;vlan 21&#xA;name Pvlan_21&#xA; private-vlan isolated&#xA;!&#xA;vlan 31&#xA;name Pvlan_31&#xA; private-vlan isolated&#xA;!&#xA;!  Associating&#xA;!&#xA;vlan 10&#xA; private-vlan assoc 11&#xA;!&#xA;vlan 20&#xA; private-vlan assoc 21&#xA;!&#xA;vlan 30&#xA; private-vlan assoc 31&#xA;!&#xA;! Isolated/Access port&#xA;!&#xA;interface GigabitEthernet1/1&#xA;switchport private-vlan trunk native vlan 11&#xA;switchport private-vlan trunk allowed vlan 11,21,31&#xA;switchport private-vlan association trunk 10 11&#xA;switchport private-vlan association trunk 20 21&#xA;switchport private-vlan association trunk 30 31&#xA;switchport mode private-vlan trunk secondary&#xA;!&#xA;! Promiscuous port (interconnect switchs) &#xA;!&#xA;interface TenGigabitEthernet1/1&#xA;switchport private-vlan trunk native vlan 10&#xA;switchport private-vlan mapping trunk 10 11&#xA;switchport private-vlan mapping trunk 20 21&#xA;switchport private-vlan mapping trunk 30 31&#xA;switchport mode private-vlan trunk promiscuous&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2017-04-03T21:16:59.257" LastActivityDate="2017-04-03T21:16:59.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3159" PostTypeId="2" ParentId="3128" CreationDate="2013-09-10T06:18:04.660" Score="2" Body="&lt;p&gt;Doesn't solve your imediate problem but given your title LISP would most definitely  allow for a user to have one ip address in various &quot;zones&quot; although it probably still a bit complex for work/home usage.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;What is LISP?&#xA;&#xA;LISP is a network architecture and set of protocols that implements a new semantic for IP addressing. LISP creates two namespaces&#xA;and uses two IP addresses: Endpoint Idenfitiers (EIDs), which are assigned to end-hosts, and Routing Locators (RLOCs), which are &#xA;assigned to devices (primarily routers) that make up the global routing system. Performing this separation offers several advantages,&#xA;including:&#xA;- Improved routing system scalability by using topologically-aggregated RLOCs&#xA;- Provider-independence for devices numbered out of the EID space (IP portability)&#xA;- Low-OPEX multi-homing of end-sites with improved traffic engineering&#xA;- IPv6 transition functionality&#xA;- IP mobility (EIDs can move without changing - only the RLOC changes!)&#xA;LISP is a simple, incremental, network-based implementation that is deployed primarily in network edge devices. &#xA;It requires no changes to host stacks, DNS, or local network infrastructure, and little to no major changes to &#xA;existing network infrastructures.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://lisp4.cisco.com/lisp_over.html&quot; rel=&quot;nofollow&quot;&gt;Cisco LISP explanation &lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1092" LastActivityDate="2013-09-10T06:18:04.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3160" PostTypeId="2" ParentId="3128" CreationDate="2013-09-10T11:06:56.890" Score="7" Body="&lt;p&gt;The only way to properly do this, if their IP HAS to be the same as their desktop, is for them to RDP onto their desktop over the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or fix the software that's got this ludicrous requirement &lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-09-10T11:06:56.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3161" PostTypeId="1" AcceptedAnswerId="3177" CreationDate="2013-09-10T13:49:39.947" Score="5" ViewCount="2055" Body="&lt;p&gt;We all know that there are various encoding schemes to encode data like Manchester Encoding, before sending it. But why is there a need to encode the data to a signal? Why can't we just transmit the waveforms?&lt;/p&gt;&#xA;" OwnerUserId="2604" LastEditorUserId="8499" LastEditDate="2016-11-29T02:44:15.957" LastActivityDate="2016-11-29T02:44:15.957" Title="Importance of encoding data to signal" Tags="|protocol-theory|layer1|transceiver|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3163" PostTypeId="2" ParentId="3122" CreationDate="2013-09-10T14:23:20.390" Score="3" Body="&lt;p&gt;CDP &amp;amp; LLDP permits the sharing of some very basic information, but that's really not enough to do something like you ask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a network operation point of view, you normally want a Known State, not dynamic configuration.  Just look at all the problem that VTP can cause (a single switch newly connected can bring down the whole network in certain circumstances).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Troubleshooting Dynamic configuration stuff is always harder, because you have to validate the dynamic protocols first to see if they have done their job and to understand their current state, check if it's a &quot;correct&quot; state, then try to find the issue you're looking for, instead of simply having to look out for something that is not how it was configured (interfaces states/trunking/forwarding, VLAN propagation, etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And for security reason, it would not be a good idea to have such mechanism either, as it would makes it easier for someone to connect/break your network&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2013-09-10T14:23:20.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3164" PostTypeId="2" ParentId="3161" CreationDate="2013-09-10T14:50:17.540" Score="4" Body="&lt;p&gt;The systems simply work better with the benefits brought by various encoding schemes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So your Manchester Encoding example has the benefit of ensuring frequent -- more frequent than would be the case with typical data -- voltage changes on the wires. More frequent voltage changes have the side effect, in this example, of making clock/timing work better. Other encodings have other benefits that befit their transmission mediums.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-09-10T14:50:17.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3165" PostTypeId="2" ParentId="3161" CreationDate="2013-09-10T17:03:51.883" Score="4" Body="&lt;p&gt;Traditional encoding mechanisms were built to deal with certain media characteristics - specifically electrical issues on traditional copper media or high BER carriers in the various wireless domains.  With modern transmission systems there has been a push to streamline these mechanisms to simplify protocol stacks and make better use of available bandwidth by removing associated overhead (i.e. removing SONET encoding from the equation for IPoWDM).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the larger sense the issue with transmitting native waveforms with no encoding is that some kind of system is required to map between the information to be transmitted and the media over which transmission is to occur.  In the case of a T1 circuit (for example) this corresponds to a set of voltage thresholds and an expected signalling rate.  Without such a system there is no guarantee (or even likely hope) that what one side transmits is what the other side receives.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-09-10T17:03:51.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3167" PostTypeId="2" ParentId="3128" CreationDate="2013-09-10T21:42:57.983" Score="2" Body="&lt;p&gt;Cisco implementation for RFC2002, aka mobile IP:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/products/ps6590/products_ios_protocol_group_home.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/products/ps6590/products_ios_protocol_group_home.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and here's how to configure it(http web page link somehow does't work):&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/ipmobility/configuration/guide/12_4t/imo_12_4t_book.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/ios/ipmobility/configuration/guide/12_4t/imo_12_4t_book.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out the presentation and white papers. Page 41 of 2nd listed presentation says 1700/1800/2600xm/2800/3700/3800/7200 with proper IOS are supported. One caveat is that you need Cisco Mobile IP client software installed on user's PC.&lt;/p&gt;&#xA;" OwnerUserId="1554" LastEditorUserId="1554" LastEditDate="2013-09-10T23:49:55.357" LastActivityDate="2013-09-10T23:49:55.357" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3168" PostTypeId="2" ParentId="3132" CreationDate="2013-09-11T00:22:12.573" Score="1" Body="&lt;p&gt;If your load balancer supports it Direct Server Return would also do what you want. It needs to be supported by your load balancer and there are some operating system concerns. It involves putting 'loopback' interfaces in each server that all have the IP address of the VIP, the load balancer while having the real server addresses only use the MAC address of the real server to forward the packet, since server has the loopback interface with the VIP in it, the server accepts the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to consult the doc of the specific LB vendor and your server teams have to be able to manage the virtual adapter (we do not use this feature because of we did not think our automated server provisioning could manage an MS loopback adapter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this does not use NAT in the LB and you don't have to do PBR.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-09-11T00:22:12.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3169" PostTypeId="1" AcceptedAnswerId="3185" CreationDate="2013-09-11T05:05:58.840" Score="13" ViewCount="17648" Body="&lt;p&gt;I have inherited support of a remote site which contains a Cisco 4500 and is connected to ~2 dozen cisco access switches - primarily 2960s with a couple of 3750s and 3560s.  Not all access switches are directly connected to the 4500 - there is some daisy chaining of switches which was apparently done as a result of inadequate cabling.  Recently i've noticed serror messages on the 4500 which indicate frames have been received with an invalid source mac address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;*Sep 10 09:29:48.609: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 102563 times)Packet received with invalid source MAC address (00:00:00:00:00:00) on port Te5/1 in vlan 1460&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device connected to Te5/1 is an access switch (Cisco 3750).  It in turn is connected to 6 other access switches.  After a bit of googling it appears the 4500 is the only cisco platform which logs invalid source mac addresses.  From my reading, other platforms (2960, 3750, etc) seem to forward the frames along but don't log them as invalid, nor do they add an entry to the mac address-table.  I suspect the root cause of the invalid source mac addresses could be a faulty nic, a software bug or perhaps a misconfigured vmware server.  What tools are available on the access switches to track down the offending port?&lt;/p&gt;&#xA;" OwnerUserId="86" LastEditorUserId="76" LastEditDate="2013-09-12T06:15:10.497" LastActivityDate="2013-09-12T22:38:44.827" Title="Tracking down an invalid source mac address" Tags="|cisco|switch|layer2|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3173" PostTypeId="1" AcceptedAnswerId="3235" CreationDate="2013-09-11T09:29:43.230" Score="10" ViewCount="573" Body="&lt;p&gt;I am trying to configure a dynamic crypto map for use on a pure IPv6 network, on Cisco 15.2M. The problem is when I try to add an ipv6 access list to the dynamic crypto map, I get an error message. Below the config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto dynamic-map DYNMAP 5&#xA; set transform-set IPSECVPN-PeerA&#xA; set ikev2-profile IKEV2-SETUP-DYN&#xA;ipv6 access-list VPN_PEER_A_IPV6_ANY&#xA; permit ipv6 2001:1::/64 any&#xA; permit ipv6 2001:2::/64 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I try to add the access list to the crypto map, I get the following error&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list type conflicts with prior definitionERROR: &quot;VPN_PEER_A_IPV6_ANY&quot; is either an invalid name or the&#xA;    list already exists but is the wrong type.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe this is due to 15.2 not supporting dynamic IPv6 crypto maps. Can anybody give me a hint?&lt;/p&gt;&#xA;" OwnerUserId="2619" LastEditorUserId="16668" LastEditDate="2015-07-18T07:30:30.330" LastActivityDate="2015-07-18T07:30:30.330" Title="Dynamic Crypto Map with IPv6 access list" Tags="|cisco|ipv6|ipsec|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3174" PostTypeId="2" ParentId="3112" CreationDate="2013-09-11T10:40:33.013" Score="7" Body="&lt;p&gt;Most network vendor software (IOS included) is *nix based, I don't see why this is an issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Palo Alto has a number of strengths over an ASA primarily based on an application-based rather than TCP focus:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;L7 Application awareness, allowing you to restrict application functions rather than just IPs and port numbers. This provides protection where applications (such as Skype) use dynamic ports.&lt;/li&gt;&#xA;&lt;li&gt;Agent-free user awareness, allowing you to restrict access and functions based on a user's credentials and AD group membership for instance. &lt;/li&gt;&#xA;&lt;li&gt;Comprehensive user directory support.&lt;/li&gt;&#xA;&lt;li&gt;An advanced GUI&lt;/li&gt;&#xA;&lt;li&gt;A virtual edition&lt;/li&gt;&#xA;&lt;li&gt;A REST API&lt;/li&gt;&#xA;&lt;li&gt;BGP Support&lt;/li&gt;&#xA;&lt;li&gt;Data Loss Prevention features&lt;/li&gt;&#xA;&lt;li&gt;Additional modes of operation (L1 transparent, Tap) that I don't believe the ASA provides&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;http://packetpushers.net/show-160-palo-alto-and-everything-you-always-wanted-to-know-about-next-gen-firewalls-sponsored/&quot; rel=&quot;noreferrer&quot;&gt;Packetpushers Podcast&lt;/a&gt; provides a good overview and further information.&lt;/p&gt;&#xA;" OwnerUserId="537" LastEditorUserId="537" LastEditDate="2013-09-16T15:33:09.963" LastActivityDate="2013-09-16T15:33:09.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3175" PostTypeId="2" ParentId="3112" CreationDate="2013-09-11T11:58:48.477" Score="0" Body="&lt;p&gt;Palo Alto is a next generation firewall and they are the first to introduce the user and application identification in the firewalls. They have set the standards for the next generation firewalls by being the first to introduce the concepts. The firewalls work on layer 7 compared to layer 4 by the conventional firewall.&lt;/p&gt;&#xA;" OwnerUserId="2440" LastActivityDate="2013-09-11T11:58:48.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3176" PostTypeId="2" ParentId="3128" CreationDate="2013-09-11T12:11:24.370" Score="0" Body="&lt;p&gt;I would forward the VPN to a windows server from the firewall, have the windows server handle the VPN connections.&#xA;As long as the windows box is in the same subnet, users should receive the same ip's from DHCP within the same subnet as the windows box.&lt;/p&gt;&#xA;" OwnerUserId="1014" LastActivityDate="2013-09-11T12:11:24.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3177" PostTypeId="2" ParentId="3161" CreationDate="2013-09-11T12:19:09.853" Score="6" Body="&lt;p&gt;Electrically speaking, encoding schemes are important to keep the line balanced - even if the data changes state often enough to clock and be distinguishable from a dead line, if it has an uneven number of 1's/0's the receiver develops an unbalanced offset voltage. Encoding ensures both that there are no long strings of 1's or 0's, and that the total number is effectively balanced over time.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2013-09-12T02:07:23.373" LastActivityDate="2013-09-12T02:07:23.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3178" PostTypeId="2" ParentId="3129" CreationDate="2013-09-11T12:30:46.940" Score="2" Body="&lt;p&gt;Agree with the above statements, also know that every vendor fudges their stats a little bit.&#xA;ie&#xA;Enable PAT, simple firewall rules, access control lists, QOS and you will find these numbers can even halve some of the time - this is often due to the processing capacity of a network device and every service running on a network device requires a certain amount of CPU resources.&#xA;PPS and BPS arent always the best stats to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When considering your upgrade, see what you are currently utilising. SNMP (Simple Network Management Protocol) can help you achieve this.&#xA;Have room for growth by upgrading your environment to achieve less than %50 bandwidth on the current network utilisation on the new device and less than %40 CPU usage.&lt;/p&gt;&#xA;" OwnerUserId="1014" LastActivityDate="2013-09-11T12:30:46.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3179" PostTypeId="2" ParentId="3122" CreationDate="2013-09-11T12:37:16.893" Score="1" Body="&lt;p&gt;If you knew the SNMP string for each device on the network, you could automate pulling the configuration from each network device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are talking about discovering routes, I would suggest enabling a dynamic routing protocol, having that device learn the network routes and use a &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show IP route&lt;/code&gt; in cisco&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show route&lt;/code&gt;in junos&lt;/p&gt;&#xA;&#xA;&lt;p&gt;etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for learning or centrally managing the network from one device, I would suggest a cloud solution such as Cisco's new Merakai platform. This would automate what you are talking about from one device using SDN (software Define Networking).&lt;/p&gt;&#xA;" OwnerUserId="1014" LastActivityDate="2013-09-11T12:37:16.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3180" PostTypeId="2" ParentId="3104" CreationDate="2013-09-11T12:39:53.403" Score="0" Body="&lt;p&gt;The 2960X utilises a similar IOS as previous 2960 switches in terms of commands. The only differences come from the different IOS images - this depends on the feature sets and how much you pay. You will also find that you can add more than 1 SVI on the newest series too. (Up to 3 depending on the feature set of your IOS image (which can be nifty for a management vlan)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your fears, no, the newer series of 2960X is not running the same OS as the equivalent Linksys small business switch line CLI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some common questions and answers re: the new 2960X series.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps12995/qa_c67-728348.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps12995/qa_c67-728348.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1014" LastEditorUserId="1014" LastEditDate="2013-09-12T14:03:49.580" LastActivityDate="2013-09-12T14:03:49.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3182" PostTypeId="1" AcceptedAnswerId="3183" CreationDate="2013-09-11T15:01:39.637" Score="10" ViewCount="5435" Body="&lt;p&gt;So, if I have a site that has 2 (or more) internet connections, with a routable IP subnet that I own, and one ISP goes down, how do I tell the rest of the world to send traffic addressed to my network through ISP B instead of ISP A? This is in relation to a high-availability type setup. I'm pretty sure it involves BGP, but I don't know how to implement it.&lt;/p&gt;&#xA;" OwnerUserId="283" LastActivityDate="2013-09-12T08:08:58.040" Title="How would one route an IP network through different ISPs?" Tags="|routing|bgp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3183" PostTypeId="2" ParentId="3182" CreationDate="2013-09-11T19:34:27.163" Score="10" Body="&lt;p&gt;Multihoming is normally done with BGP by announcing your ASN (Autonomous System number) &amp;amp; Prefixes (&quot;Network/Subnet&quot;) to both of your ISPs. This mean that you have to have your own ASN and valid Public ip address space)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You Peer in BGP with both ISPs, they re-announce your ASN &amp;amp; Prefixes upstream of them so any traffic for your network is directed through them depending on BGP policies (AS-Path, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you plan on announcing your ASN yourself, be sure to have GOOD LINKS (DSL will cause you problems if it flaps - BGP is treating flapping/unstable route as BAD and will drop them until they're stable for a while).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FUN of BGP is that you can control how traffic comes in and out.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;With AS-Path Prepending you can make some links &quot;worse&quot; than others (even if they're much greater than speed) as the AS-PATH length is what's first looked at when deciding which route is the best. This can be done on a prefix-by prefix basis.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;With Local-Preference and Route-Maps, you can decide which ISP to use for your egress traffic and for any flows you want (basically, you manipulate routes matching some conditions before accepting them in your own routing table).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1645" LastEditorUserId="630" LastEditDate="2013-09-12T08:08:58.040" LastActivityDate="2013-09-12T08:08:58.040" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3184" PostTypeId="2" ParentId="3121" CreationDate="2013-09-11T20:17:07.397" Score="1" Body="&lt;p&gt;Test with UDP to get an accurate throughput measurement.  Also, you'll need to increase the UDP send rate above the default to get a good measurement.  With TCP, you'll be dealing with windowing which will give you an artificially low number for your purposes.  I typically try to send UDP above the known link speed.  You'll then see your send rate as X and your actual throughput as some number less than X.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2013-09-11T20:17:07.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3185" PostTypeId="2" ParentId="3169" CreationDate="2013-09-11T20:19:41.227" Score="4" Body="&lt;p&gt;You could try if the frames can be blocked using a MAC ACL on interfaces and/or on vlans on the access switches. By applying the blocks selectively and checking if the error messages on the 4500 disappear or not, you can home in on the source of the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moving cables around to see if the port mentioned in the error message on the 4500 follows could also help, but might prove tricky in a production environment.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-09-11T20:19:41.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3188" PostTypeId="1" CreationDate="2013-09-12T07:45:49.363" Score="7" ViewCount="12554" Body="&lt;p&gt;Our F5 load balancers run version 10.2.4.  We migrated from Cisco load balancer cards on the Catalyst 6500 and used to be able to run xterm sessions to our solaris and linux servers without the sessions dying after 15 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our boss is afraid of raising the 900 second number in our F5 tcp profile, because at another company he was at they did this and it exhausted all the resources in the F5 from hung connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there another way to keep the sessions from resetting without changing the timeout?  This is our config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;profile fastL4 fwd_fastL4_15m {&#xA;  defaults from fastL4&#xA;  idle timeout 900&#xA;}&#xA;&#xA;virtual route_outbound {&#xA;  destination any:any&#xA;  mask none&#xA;  ip forward&#xA;  profile fwd_fastL4_15m&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2561" LastEditorUserId="775" LastEditDate="2013-09-12T08:49:36.523" LastActivityDate="2013-09-12T09:09:51.337" Title="F5 session timeouts" Tags="|ipv4|tcp|f5|load-balancer|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3189" PostTypeId="2" ParentId="3188" CreationDate="2013-09-12T08:00:14.970" Score="6" Body="&lt;p&gt;For term sessions, I believe the best option is to &lt;strong&gt;use app or OS keepalives&lt;/strong&gt; to maintain the connection through the SLB which allows you to keep your idle timeout where you want it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is app and OS dependent.  See &lt;a href=&quot;http://www.howtogeek.com/howto/linux/keep-your-linux-ssh-session-from-disconnecting/&quot; rel=&quot;noreferrer&quot;&gt;Keep Your Linux SSH Session From Disconnecting&lt;/a&gt; as one method that may work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The concern of your manager in raising the idle timeout is highly subjective.  The typical flow rate (conn/sec) and idle durations between your environment and his last could be vastly different.  If your flow rate or idle durations are much lower, you could afford to increase the timeout.  You'll need to zero into flow capacity, what you have free, and how quickly you cycle through them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/csm/4.1.x/4.1.2/command/reference/t_v.html#wp1059539&quot; rel=&quot;noreferrer&quot;&gt;CSM's default idle timeout&lt;/a&gt; is 3600.  Same for the &lt;a href=&quot;http://www.cisco.com/en/US/docs/interfaces_modules/services_modules/ace/vA4_1_0/configuration/security/guide/tcpipnrm.html#wp1200622&quot; rel=&quot;noreferrer&quot;&gt;ACE for idle TCP connections&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-09-12T09:01:10.180" LastActivityDate="2013-09-12T09:01:10.180" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3191" PostTypeId="1" CreationDate="2013-09-12T08:27:52.927" Score="8" ViewCount="3746" Body="&lt;p&gt;We have a simple problem.  We want to restrict our wireless users to certain business websites based on their username when they login.  We have many kinds of wireless devices: voip phones, cell phone, laptops, barcode scanners, and tablets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose there are all these website categories, which we have an SSID and Vlan assigned for user source addresses:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Internet (SSID-Internet, Vlan101)&lt;/li&gt;&#xA;&lt;li&gt;Voice (SSID-Internet, Vlan102)&lt;/li&gt;&#xA;&lt;li&gt;Accounting (SSID-Business, Vlan103)&lt;/li&gt;&#xA;&lt;li&gt;HR (SSID-Business, Vlan104)&lt;/li&gt;&#xA;&lt;li&gt;Inventory (SSID-Business, Vlan105)&lt;/li&gt;&#xA;&lt;li&gt;Research (SSID-Business, Vlan106)&lt;/li&gt;&#xA;&lt;li&gt;Quality Assurance (SSID-Business, Vlan107)&lt;/li&gt;&#xA;&lt;li&gt;Manufacturing (SSID-Business, Vlan108)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Each of our users might need to use their Windows login to authenticate into the wireless network, but they should only have access to certain services.  Some examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;User1: Login using Windows credentials using VoIP phone to SSID-Voice, and can only access the Voice network from this phone&lt;/li&gt;&#xA;&lt;li&gt;User1: Login using Windows credentials using Laptop to SSID-Business, and can only access the Accounting websites from his laptop&lt;/li&gt;&#xA;&lt;li&gt;User1: Login using Windows credentials using cell phone to SSID-Internet and can only access the internet through a proxy.&lt;/li&gt;&#xA;&lt;li&gt;User2: Login using Windows credentials using VoIP phone to SSID-Voice, and can only access the Voice network from his phone&lt;/li&gt;&#xA;&lt;li&gt;User2: Login using Windows credentials using barcode scanner to SSID-Business and can only access the Inventory websites from his barcode scanner&lt;/li&gt;&#xA;&lt;li&gt;User2: Login using Windows credentials using cell phone to SSID-Internet and can only access the internet through a proxy.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Every user should be able to login with their cell phone to SSID-Internet, and wifi phone to SSID-Voice.  This seems easy enough if we use mac-address filtering.  We will use a firewall to ensure users in the Vlans don't go outside their access limits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that we don't want to create a lot of SSIDs, so the number of different Vlans for SSID-Business is hard.  We want to assign users to several different Vlans when they login to SSID-Business.  Can Cisco ISE &amp;amp; Cisco ACS do this?  If so, what features do we need to use in Cisco ISE, Cisco ACS and the WLC?  Can all these functions work if we only have one Windows username per user?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our WLC is a 5508 running 7.4.  We have Cisco ACS 5 and Cisco ISE 1.2.&lt;/p&gt;&#xA;" OwnerUserId="2631" LastActivityDate="2014-09-23T20:28:12.033" Title="Cisco WLC: Per user authentication, many Vlans, few SSIDs" Tags="|cisco|wireless|firewall|wlc|aaa|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3192" PostTypeId="2" ParentId="3188" CreationDate="2013-09-12T09:09:51.337" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there another way to keep the sessions from resetting without changing the timeout?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You already mentioned that keepalives were not used on your old Cisco load-balancer, so I will focus on what you can do with the F5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two problems you need to solve...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The F5 sends a reset to the client when the TCP session expires from the state table&lt;/li&gt;&#xA;&lt;li&gt;The F5 removes the TCP session after it expires&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Those two issues seem related, but they have different solutions on the F5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solving &lt;strong&gt;TCP Resets&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;F5 resets timed-out TCP sessions by default.  You can disable that behavior with &lt;code&gt;reset on timeout disable&lt;/code&gt; inside your TCP profile.  However, all this does is keep the F5 from resetting the client connection, but the session will still be expired from the F5's state table the next time someone takes a break for a couple of hours, and then moves the mouse pointer again in the xterm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solving &lt;strong&gt;Session expiration inside the F5&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use &lt;code&gt;loose initiation enable&lt;/code&gt; in your TCP profile.  &lt;code&gt;loose initiation&lt;/code&gt; allows the F5 to create an entry in the TCP state table whenever it sees an unknown TCP packet.  As long as these connections are trusted, and inside your company, there is no problem turning &lt;code&gt;loose initiation&lt;/code&gt; on.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, &lt;code&gt;loose initiation&lt;/code&gt; makes the F5 behave more like a router than a load-balancer, which is what you need in this situation.  xterm sessions create a TCP socket sourced from TCP/6000 to the client.  In this case, you aren't load-balancing the xterm sessions anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Final solution&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your final profile should look like this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;profile fastL4 fwd_fastL4_5m_loose {&#xA;  defaults from fastL4&#xA;  reset on timeout disable&#xA;  idle timeout 300&#xA;  loose initiation enable&#xA;}&#xA;virtual route_outbound {&#xA;  destination any:any&#xA;  mask none&#xA;  ip forward&#xA;  profile fwd_fastL4_5m_loose&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Technically, you can change the timeout from 900 seconds to 300 seconds, since you're enabling loose session initiation on the &lt;code&gt;route_outbound&lt;/code&gt; service.  &lt;a href=&quot;http://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html&quot;&gt;F5 Solution Document 7595&lt;/a&gt; is a good reference for forwarding virtual server configurations like this... see the section titled, &quot;Emulating stateless IP routing with BIG-IP LTM forwarding virtual servers&quot;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-09-12T09:09:51.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3193" PostTypeId="2" ParentId="3191" CreationDate="2013-09-12T11:41:17.693" Score="1" Body="&lt;p&gt;Cisco Identitiy SErvices Engine (ISE) can do exactly what you are looking for. The feature is called &quot;Profiling&quot; your netowrk devices. Cisco ACS will be used for Authentication and Integration with your Active Directory. Please note that in order to achieve what you are looking for, you might need a range of devices in the structure of your netowrk. &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/vpndevc/ps5712/ps11637/ps11195/at_a_glance_c45-654884.pdf&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; link has an overview of the solution that will give you better understanding of what you need. Refer to 'Deployment Components'&#xA; section for an idea of what it takes to have profiling. The solution might sound complicated but it all depends on your deployment. If would be wrong to buy a couple of devices thinking that it will suffice to give you the functionality you are looking for. Cisco's solutions usually involve many components and must be carefully planned.&lt;/p&gt;&#xA;" OwnerUserId="2440" LastActivityDate="2013-09-12T11:41:17.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3195" PostTypeId="2" ParentId="2475" CreationDate="2013-09-12T12:31:33.503" Score="4" Body="&lt;p&gt;&lt;strong&gt;Q: It is possible to map the private VLAN to both our access and voice SVIs?&lt;/strong&gt;&#xA;A: No. You are creating &amp;quot;In theory&amp;quot; a bridge between two main VLANs.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Q: Is it possible to have our access and voice &amp;quot;layer 2&amp;quot; VLAN statements associated with the same private VLAN?&lt;/strong&gt;&#xA;A: This is like haveing the same VLAN name on two different networks. The private VLAN scope is within its main VLAN. Technically it would not make the private VLAN part of two main VLANs but it might be against the allowed configuration to have the same name for two private VLANs on the same switch. I am not sure but logically it would be confusing.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Q: Can I assign the physical ports to have multiple private VLAN associations?&lt;/strong&gt;&#xA;A: I cant think of a reason for doing so except for the 'P' port which you will need to do on at least one port/SVI.&lt;/p&gt;&#xA;&lt;p&gt;Check &lt;a href=&quot;http://blog.internetworkexpert.com/2008/07/14/private-vlans-revisited/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; link for a great explaination on private VLANs.&lt;/p&gt;&#xA;" OwnerUserId="2440" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-09-12T12:31:33.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3196" PostTypeId="2" ParentId="3169" CreationDate="2013-09-12T13:18:40.113" Score="0" Body="&lt;p&gt;It appears to me that this error is not affecting network performance, as you discovered the log messages on your own, rather than your being inundated with user complaints. This leads me to suspect that the issue lies with some connected, but partially configured or misconfigured software or service that is not currently in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your best course may be to let this sleeping dog lie, until such time as some user reports a problem. Alternatively, if you have the time to spare, you can run SPAN sessions as @Daniel Dib suggested, and give the output close scrutiny until you determine a suspect port or device.&lt;/p&gt;&#xA;" OwnerUserId="2375" LastActivityDate="2013-09-12T13:18:40.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3197" PostTypeId="2" ParentId="3191" CreationDate="2013-09-12T14:21:52.577" Score="0" Body="&lt;p&gt;A solution would be applying 802.11x on the wireless access points (RADIUS) and integrating the authentication for this via LDAP with windows, then only users that have a windows username and password can access the APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The benefit of this is that windows server can then control what can be accessed based on the user's login details using group policy, security permissions in Active Directory etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this solution is 2 tiered, the windows guys need to understand how this is going to work and the network side has to be setup as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The previous poster also mentioned Cisco Identity Services Engine (ISE) which would also work.&#xA;It really depends on your setup&lt;/p&gt;&#xA;" OwnerUserId="1014" LastActivityDate="2013-09-12T14:21:52.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3198" PostTypeId="1" AcceptedAnswerId="3202" CreationDate="2013-09-12T15:43:19.147" Score="13" ViewCount="31503" Body="&lt;p&gt;Just got asked today about implementing two factor authentication for users of SSLVPN within our company (connecting via Cisco AnyConnect we don't support/use WebVPN).  Currently we use LDAP for authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've identified a company that integrates directly with anyConnect and the mobility client to afford token based two factor authentication, but was wondering what are more common ways of implementing two-factor in this sort of setting?  First thing that came to my mind was Google Authenticator or RSA, but finding information on these types of setups in conjunction with AnyConnect was surprisingly hard to find (I found nothing .. in fact)&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2016-11-04T20:14:01.563" Title="Two-factor authentication for SSLVPN (cisco)?" Tags="|cisco|sslvpn|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3202" PostTypeId="2" ParentId="3198" CreationDate="2013-09-12T20:32:37.813" Score="13" Body="&lt;p&gt;The two paths I can think of are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You want to use the built-in Cisco ASA secondary authentication&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You are open to using a radius server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The Concept for #2:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Pick an authenticator. For example, Google, LDAP, AD, etc...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Setup a Radius Server (FreeRADIUS, Windows NPM, Cisco ACS, etc...) that supports the authenticator.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure the authentication on your Cisco ASA to use that Radius server (IP Address, ports, secret key, etc...) and then you are done. Adjust timeouts as needed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;About Google Authenticator&lt;/em&gt;:&lt;br&gt;&#xA;You can setup &lt;a href=&quot;http://www.supertechguy.com/help/security/freeradius-google-auth&quot; rel=&quot;noreferrer&quot;&gt;FreeRadius to use Google Authenticator&lt;/a&gt; and then setup the Cisco ASA aaa-server to use the FreeRadius server. Done :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;About Duo Security&lt;/em&gt;:&lt;br&gt;&#xA;I have used Duo Security and it works great. This &lt;a href=&quot;https://www.duosecurity.com/docs/cisco#add_the_duo_ldap_server&quot; rel=&quot;noreferrer&quot;&gt;configuration link&lt;/a&gt; shows how to set up 2-Factor Authentication without installing the Duo Security application. However, if you install the application (acts as a RADIUS server) then the setup becomes even easier. Below is a sample config that should help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CAVEATS to this setup:&lt;br&gt;&#xA;Increase your timeouts! I've had issues with this.&#xA;Do not install the Duo application on an existing RADIUS server (listening port conflict).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;After installing the application on a server you need to modify the &lt;code&gt;authproxy.cfg&lt;/code&gt; file to use Active Directory as your primary authenticator, at the top of your &lt;code&gt;authproxy.cfg&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set client to &lt;code&gt;ad_client&lt;/code&gt; and server to &lt;code&gt;radius_server_auto&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[main]  &#xA;client=ad_client  &#xA;server=radius_server_auto  &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Create a section called &lt;code&gt;ad_client&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ad_client]&#xA;host=10.x.x.11&#xA;host_2=10.x.x.12&#xA;service_account_username=ldap.duo&#xA;service_account_password=superSecretPassword&#xA;search_dn=DC=corp,DC=businessName,DC=com&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;security group is optional. this group allows users to authenticate.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;security_group_dn=CN=Administrators,CN=Builtin,DC=example,DC=com&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Specific DUO security config info&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[radius_server_auto]&#xA;ikey=xxxxxxxxxxxxx&#xA;skey=xxxxxxxxxxxxx&#xA;api_host=api-xxxxx.duosecurity.com&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Safe or secure are the options here.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Safe=allow auth&lt;/code&gt; if Duo is unreachable.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;Secure=do not allow auth&lt;/code&gt; if Duo is unreachable&#xA;failmode=safe&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IP address of Cisco ASA that you want to hit and the key&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radius_ip_1=10.x.x.1&#xA;radius_secret_1=superSecretPassword&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Windows Server that has the DuoSecurity App installed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;net stop DuoAuthProxy&#xA;net start DuoAuthProxy&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Cisco ASA 8.4 Configuration&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Add new aaa-server to corresponding VPN policy&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa-server DUO protocol radius&#xA;!&#xA;aaa-server DUO (inside) host 10.x.x.101&#xA; accounting-port 1813&#xA; authentication-port 1812&#xA; key superSecretPassword&#xA; retry-interval 10&#xA; timeout 300&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="881" LastEditorUserId="775" LastEditDate="2014-02-17T16:39:29.130" LastActivityDate="2014-02-17T16:39:29.130" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3203" PostTypeId="2" ParentId="3191" CreationDate="2013-09-12T22:22:33.380" Score="5" Body="&lt;p&gt;If you don't need to confuse your users with multiple VLANs, don't do it.  Leverage the tools you have.  You mentioned you have ISE and you should be able to do all this with one SSID.  As AdnanG already mentioned, you can utilize the profiling features of ISE to classify the devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your ACS should be able to tie into the MS AD authentication and be able to provide user authentication and group information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, you just need to combine the user/groups with the device profiles and then tie it to a VLAN.  So, for instance, if the device is identified as a cell phone and the user is part of &quot;group A&quot;, then the get put in the &quot;group A - internet&quot; VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't done it personally with ISE, so can't give exact steps, but this is how Cisco marketing is selling ISE in the BYOD space.  I also know of several people who have done similar setups to what is suggested.  I would start by looking through &lt;a href=&quot;http://www.cisco.com/en/US/products/ps10315/products_tech_note09186a0080bba10d.shtml#topic2&quot; rel=&quot;noreferrer&quot;&gt;this Cisco BYOD document&lt;/a&gt; that would give you a general overview of how BYOD is done with with Cisco ISE.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-09-12T22:22:33.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3204" PostTypeId="2" ParentId="3169" CreationDate="2013-09-12T22:38:44.827" Score="7" Body="&lt;p&gt;Generally when I have seen this, it comes from a poorly configured VM (often hosted on a user machine).  Depending on the situation and environment, they can be difficult to track down (saw a lot of these at a University in the CS and ECE department buildings which moved and came/went as students did).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have a couple great answers already, but another option you can pursue is to add the following config to the downstream switches (37xx, 36xx, 29xx):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   mac address-table static 0000.0000.0000 vlan &amp;lt;VLAN ID&amp;gt; drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will drop any traffic with this MAC rather than forward it on and since it should be done in hardware (barring any features/problems that cause MAC lookups to be done in software), it shouldn't have a negative impact on performance.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-09-12T22:38:44.827" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3205" PostTypeId="2" ParentId="2141" CreationDate="2013-09-12T23:23:52.013" Score="10" Body="&lt;p&gt;Try adding the &lt;em&gt;counter&lt;/em&gt; command under the SVI (see &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/54sg/configuration/guide/l3_int.pdf&quot;&gt;here&lt;/a&gt; for more information, specifically the &quot;Understanding L3 interface counters&quot; section).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Cisco#config t&#xA; Cisco(config)#interface vlan 100&#xA; Cisco(config-if)#counter ?&#xA;   ipv4  Enable IPv4 statistic counters&#xA;   ipv6  Enable IPv6 statistic counters&#xA;   &amp;lt;cr&amp;gt;&#xA; Cisco(config-if)#counter&#xA; Cisco(config-if)#end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Combined with Mike's excellent answers this will probably be what you want.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-09-13T00:12:01.697" LastActivityDate="2013-09-13T00:12:01.697" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3206" PostTypeId="1" CreationDate="2013-09-13T08:19:18.290" Score="6" ViewCount="486" Body="&lt;p&gt;I am polling ARP tables from a Cisco Catalyst 2960 switch. The problem I encounter is that I have 3 ports into which I placed a server, a laptop and the cable from the switch. When I poll the ARP table I get details for only the switch and the server, but not for the laptop. The server and the switch have static IP`s whereas the laptop has a dynamic IP from DHCP. What could be the reason for this?&lt;/p&gt;&#xA;" OwnerUserId="2421" LastEditorUserId="80" LastEditDate="2013-09-13T09:11:21.733" LastActivityDate="2013-09-13T15:01:12.883" Title="Cisco Catalyst 2960 switch does not produce 3rd PC details in ARP table" Tags="|cisco-catalyst|snmp|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3207" PostTypeId="2" ParentId="3206" CreationDate="2013-09-13T08:50:22.877" Score="6" Body="&lt;p&gt;Please ping the DHCP machine before polling.  After the ping, tables will be populated.  If you can't ping the DHCP laptop, then you know why you can't see it in the ARP table.&lt;/p&gt;&#xA;" OwnerUserId="2369" LastActivityDate="2013-09-13T08:50:22.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3208" PostTypeId="1" AcceptedAnswerId="3209" CreationDate="2013-09-13T09:08:19.097" Score="8" ViewCount="17488" Body="&lt;p&gt;Apologies about the very open ended question, but I am struggling to differentiate between VPLS &amp;amp; L2 VPN's. I'm aware they both run over MPLS, but I can't find any documentation or sites that clearly explain what either are etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've recently implemented a VPLS in the business to interconnect some of our sites. But I overheard one of the other engineers saying that we also have another a L2 VPN running over our MPLS links. And I am unsure, how the 2 interlink thats all as I was under the impression they were the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sorry if it isn't too clear, but I generally don't know the difference, and I just needed a bit of help either with clarifying the two terminologies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am moving into my first networking role, and these terms have been mentioned a few times.&lt;/p&gt;&#xA;" OwnerUserId="2645" LastEditorUserId="20757" LastEditDate="2017-05-11T21:48:35.537" LastActivityDate="2018-12-07T11:44:33.123" Title="What is the difference between VPLS vs Layer 2 VPN?" Tags="|vpn|mpls|vpls|l2vpn|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3209" PostTypeId="2" ParentId="3208" CreationDate="2013-09-13T09:56:53.377" Score="12" Body="&lt;p&gt;L2VPN is generic term for group of technologies out of which one is VPLS, but could be number of other technologies such as emerging EVPN.&lt;/p&gt;&#xA;&lt;p&gt;For more information read &lt;a href=&quot;http://datatracker.ietf.org/wg/l2vpn/charter/&quot; rel=&quot;nofollow noreferrer&quot;&gt;WG charter&lt;/a&gt;/mailing lists as L2VPN has lot of active work going on. Also read &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6624&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6624&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4761&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4761&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-09-13T09:56:53.377" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3210" PostTypeId="2" ParentId="3206" CreationDate="2013-09-13T10:20:53.147" Score="2" Body="&lt;p&gt;ARP tables are populated when the machine sends any traffic to the network (DHCP or any other). The switch receives the packets generated by the machine and grabs the mac address of the machine and puts in ARP table with the information of the port it came from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if you can't see the ARP entry of the laptop, it means that the laptop did not exchange any packets with switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A note, there are two commands for arp: &lt;code&gt;sh arp&lt;/code&gt; and &lt;code&gt;sh ip arp&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh arp: will show you arp entries for non-IP protocols like appletalk, ipx etc.&#xA;&#xA;sh ip arp: will show you only about IP protocol.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2440" LastEditorUserId="2440" LastEditDate="2013-09-13T15:01:12.883" LastActivityDate="2013-09-13T15:01:12.883" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3211" PostTypeId="2" ParentId="3132" CreationDate="2013-09-13T10:21:27.933" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;does PBR add any latency over doing SNAT assuming PBR is all done in hardware?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SR/configuration/guide/layer3.html#wp1027016&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sup720 supports PBR in HW&lt;/a&gt;, the additional latency (if any) is negligible because PBR doesn't add more interface queueing.  I think PBR would make things harder than they need to be (and I'm still not even sure whether it would work... the specifics of that option aren't totally clear)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Short of the XFF and SNAT mentioned earlier, is PBR the only option here and what's the best way to keep PBR tightly configured?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;PBR is not the only option.  Your proposed option is a bit unclear, but PBR normally boils down to nothing more than a fancier way to do static routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically this is the best topology for load-balanced services that require SQL queries...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Put your VIPs on a front-side subnet... 172.16.1.0/24 in the diagram&lt;/li&gt;&#xA;&lt;li&gt;Put your server pools in a back-side subnet... 172.16.2.0/24 in the diagram&lt;/li&gt;&#xA;&lt;li&gt;Put your SQL queries on another interface... 172.16.3.0/24 in the diagram.  Add a second interface to all servers that require SQL queries.  Make all your SQL queries to addresses on this subnet.  This topology works for both Unix and Windows, since you're only relying on ARP or host-routes (depending on your preference) for SQL connectivity.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vp3jI.png&quot; alt=&quot;LB w SQL query network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This topology has additional benefits:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It separates SQL interfaces from web traffic, since SQL queries are bursty and may wind up congesting web traffic.&lt;/li&gt;&#xA;&lt;li&gt;It provides different MTUs for your load-balanced services (which usually need to stay at 1500 or lower, if they transit the internet) and your SQL services (which favor jumbo frames).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any one-armed load-balancer topology is a less desirable option since you wind up cutting your max throughput in half because of the one-armed topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT for question about HW vs SW switching on Sup720&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a deep topic, but I will give the summary version... Sup720 applies an ACL in each direction (ingress / egress) and the ACL must fit into TCAM based on whatever merge algorithm the platform has chosen.  Sup720's Feature Manager (i.e. fm) is responsible for mediating the features into TCAM and reporting whether you have a punt adjacency (meaning SW switching), or whether the combination of protocol and direction is switched in HW.  To isolate whether &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;First, identify all ingress and egress Layer3 interfaces that the PBR traffic &lt;em&gt;could&lt;/em&gt; transit&lt;/li&gt;&#xA;&lt;li&gt;Next, examine the output of &lt;code&gt;show fm fie int &amp;lt;L3_intf_name&amp;gt; | i ^Interf|Result|Flow|Config&lt;/code&gt; (you must look at &lt;em&gt;both ingress and egress directions for all interfaces in Step 1&lt;/em&gt;).  Your traffic will be HW switched if the values in CAPS match the values you see below...  note that the output of the command I'm using is very similar to what you see in &lt;code&gt;show fm fie summary&lt;/code&gt;...&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tx.Core01#sh fm fie int Vl220 | i ^Interf|Result|Flow|Config&#xA;Interface Vl220:&#xA; Flowmask conflict status for protocol IP : FIE_FLOWMASK_STATUS_SUCCESS      &amp;lt;--- in HW&#xA; Flowmask conflict status for protocol OTHER : FIE_FLOWMASK_STATUS_SUCCESS   &amp;lt;--- in HW&#xA; Flowmask conflict status for protocol IPV6 : FIE_FLOWMASK_STATUS_SUCCESS    &amp;lt;--- in HW&#xA;Interface Vl220 [Ingress]:&#xA; FIE Result for protocol IP : FIE_SUCCESS_NO_CONFLICT                        &amp;lt;--- in HW&#xA; Features Configured : V4_DEF   - Protocol : IP&#xA; FIE Result for protocol OTHER : FIE_SUCCESS_NO_CONFLICT                     &amp;lt;--- in HW&#xA; Features Configured : OTH_DEF   - Protocol : OTHER&#xA; FIE Result for protocol IPV6 : FIE_SUCCESS_NO_CONFLICT                      &amp;lt;--- in HW&#xA; Features Configured : V6_DEF   - Protocol : IPV6&#xA;Interface Vl220 [Egress]:&#xA; No Features Configured&#xA;No IP Guardian Feature Configured&#xA;No IPv6 Guardian Feature Configured&#xA;No QoS Feature Configured&#xA;Tx.Core01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The interface above doesn't show egress output, but that's irrelevant... the output is similar to the Ingress direction.  &lt;a href=&quot;https://supportforums.cisco.com/thread/2098382#discussion-3416179&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ricky Micky wrote up an outstanding explanation of 'sh fm fie interface'&lt;/a&gt; if you would like more details on the dynamics of TCAM banks / merge results.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-09-17T02:25:53.777" LastActivityDate="2013-09-17T02:25:53.777" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3213" PostTypeId="2" ParentId="3206" CreationDate="2013-09-13T11:33:05.773" Score="6" Body="&lt;p&gt;You probably want to be polling the CAM/MAC tables, that would have the MAC address of any devices send any traffic through the switch. ARP is L3 CAM/ARP is L2&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-09-13T11:33:05.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3216" PostTypeId="2" ParentId="3206" CreationDate="2013-09-13T14:50:42.277" Score="2" Body="&lt;p&gt;There isn't a lot of detail to go on here, but I will make some guesses and try to provide the best answer I can.  If you do provide more details, then I will edit my answer if anything changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The essence of your question is why the entry for the laptop isn't there, and simply the answer is that there has been no need for the switch to have added the entry to the ARP table.  The switch will only add the entry to the ARP table if it needs to interact with a device at L3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, based on your description, I would presume that the 2960 is &lt;em&gt;not&lt;/em&gt; the gateway device.  Nor has the laptop connected to the management interface of the 2960 (ping, telnet, ssh, snmp, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server is probably the device making the SNMP requests, and therefore connecting to the management interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the third device, you mention the &quot;cable from the switch&quot; but since you aren't (I hope) connecting the 2960 to itself, I would guess this is the built in switch of some sort of gateway device, and this is the other device you have listed in the ARP table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you ping the 2960 with the laptop, you should find that the ARP table will populate an entry for it (until it times out).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-09-13T14:50:42.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3217" PostTypeId="1" CreationDate="2013-09-13T16:02:22.930" Score="7" ViewCount="3311" Body="&lt;p&gt;I've been spending the last week or so troubleshooting some (maybe related, but probably not) issues with Quagga. I have a test router - 7204VXR-NPEG2 running 12.4(24)T6 - with a single BGP session to a Quagga host. The only BGP session on the 7204 is with the Quagga box. This is an eBGP session. There is literally zero policy configured on either side, yet I get this without fail in &lt;code&gt;show ip bgp neighbor x.x.x.x&lt;/code&gt; output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                   Outbound    Inbound&#xA;  Local Policy Denied Prefixes:    --------    -------&#xA;    Bestpath from this peer:          19270        n/a&#xA;    Total:                            19270          0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Coincidentally (or maybe not?) this number is always the same as the number of prefixes that I am receiving from the peer (&lt;code&gt;show ip bgp summary&lt;/code&gt;) There's a couple reasons why this is really puzzling:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Like I said, there is no policy. This is my BGP/neighbor config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp XXXXX&#xA; no synchronization&#xA; bgp router-id X.X.X.X&#xA; no bgp enforce-first-as&#xA; bgp log-neighbor-changes&#xA; neighbor X.X.X.X remote-as XXXXX&#xA; neighbor X.X.X.X next-hop-self&#xA; neighbor X.X.X.X soft-reconfiguration inbound&#xA; no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) The 7204 is not announcing anything - it's only meant to receive prefixes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone care to shed some light on what this means? Is this normal/expected output? A google search only yielded me one tidbit of information pulled from CCO:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Bestpath from this peer &lt;br&gt;Displays inbound denials because the bestpath came from the local router.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This would make sense ... for inbound. What about outbound? I can easily see this being a stupid bug, but figured I'd reach out to other folks to see if they'd seen this before.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-09-14T04:14:50.447" LastActivityDate="2013-10-02T20:18:00.787" Title="&quot;Local Policy Denied Prefixes&quot; in 'show ip bgp neighbor' output" Tags="|bgp|cisco-commands|cisco-ios-12|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3218" PostTypeId="1" AcceptedAnswerId="3220" CreationDate="2013-09-13T18:18:45.443" Score="7" ViewCount="2823" Body="&lt;p&gt;I am writing code to verify that the version I retrieved from &lt;a href=&quot;https://en.wikipedia.org/wiki/Cisco_Unified_Communications_Manager&quot; rel=&quot;noreferrer&quot;&gt;CUCM/CallManager&lt;/a&gt; (e.g. 7.1.5.34900-7) includes a security fix found in a particular patch/update (e.g. 7.1(5b)su6a). Given that these two versions are of different formats, I am having trouble figuring out the connection enough to structure my logic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a strict 1 to 1 relationship between the versions I can retrieve from CUCM (available on the home page, e.g. &quot;System version: 8.6.2.23900-10&quot;) and the versions listed in bulletins (e.g. 8.6.2SU3)? In other words, will there ever be a single &quot;system version&quot; that will relate to more than one &quot;CUCM version&quot; or the otherway around? In an upgrade compatibility &lt;a href=&quot;http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/compat/ccmcompmatr1.pdf&quot; rel=&quot;noreferrer&quot;&gt;document&lt;/a&gt; there is a table mapping &quot;system version&quot; to &quot;CUCM version&quot;, and I have been using that to look up correspondences. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read &lt;a href=&quot;http://htluo.blogspot.com/2009/02/decrypt-cucm-version-numbers.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; that the format of the system version is Major.Minor.Release.Build-InHouseBuild. The article also states that the &quot;build&quot; part can increment by 1,000 for non-CUCM patches (i.e. OS security patch). The example they gave (which may or may not be real) is 6.1.2.2000 and 6.1.2.1112. The claim is that the latter contains CUCM patches that former does not. Do I need to ignore the &quot;thousand&quot; digit then when comparing? Or will this not occur in the wild with CUCM security updates?&lt;/p&gt;&#xA;" OwnerUserId="2573" LastEditorUserId="44" LastEditDate="2013-09-14T00:28:13.147" LastActivityDate="2013-09-14T00:44:26.943" Title="What is the relationship between &quot;System version&quot; and CUCM update versions?" Tags="|cisco|cisco-voip|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3220" PostTypeId="2" ParentId="3218" CreationDate="2013-09-14T00:27:40.440" Score="5" Body="&lt;p&gt;Cisco does a fantastic job obscuring this information for some reason.  To answer your specific questions:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;System Version &lt;code&gt;7.1.5.34900-7&lt;/code&gt; is actually CUCM Version &lt;code&gt;7.1(5b)SU4&lt;/code&gt;.  You'll need to download System Version &lt;code&gt;7.1.5.35901-1&lt;/code&gt; or higher, to get the OS and Application fixes that are found in CUCM Version &lt;code&gt;7.1(5b)SU6a&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;I wouldn't go so far as to say that there is &lt;strong&gt;always&lt;/strong&gt; a 1-to-1 relationship between the two formats (CUCM Version vs System Version).  However, in my experience, when Cisco releases a new System Version, they also increment the CUCM version number.&lt;/li&gt;&#xA;&lt;li&gt;In older versions of CUCM, there was a much greater disconnect between &amp;quot;OS Fixes&amp;quot; and &amp;quot;CUCM Fixes&amp;quot;, which would give you the disparity that Michael Luo describes in the page you linked.  However in recent times (post version 7.1 days), all of the recommendations that I have received from Cisco TAC, seem to indicate that the higher the number, the better, period.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The only exceptions that I have encountered, are unreleased &amp;quot;Engineering Special&amp;quot; versions; special releases that are usually only distributed by TAC to fix a very specific and uncommon bug.  In the event that you are on an &amp;quot;Unreleased ES&amp;quot; version, you should contact TAC for upgrade support anyway, as there may be undocumented bugs related to upgrading from that version to a normal, mainline release.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;The longer answer is that we can piece together a good picture using information from the two sources you linked.  They are actually my two &amp;quot;go to&amp;quot; locations for deciphering this information.&lt;/p&gt;&#xA;&lt;p&gt;First, according to the page you linked from &lt;a href=&quot;http://htluo.blogspot.com/2009/02/decrypt-cucm-version-numbers.html&quot; rel=&quot;noreferrer&quot;&gt;Michael Luo over at UC Corner&lt;/a&gt;, we get a picture of how Cisco is structuring the CUCM/Unity Connection/Presence/UCCX build numbers:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;On each sub-version, there are also &amp;quot;build-numbers&amp;quot;. e.g. 6.1.2.1000, 6.1.2.2000, etc. Build-number is the most confusing part.&lt;/p&gt;&#xA;&lt;p&gt;Generally speaking, build numbers should increase in 1000, such as 6.1.2.1000, 6.1.2.2000, etc.&lt;/p&gt;&#xA;&lt;p&gt;CUCM is built on Linux OS. Whenever Cisco release an OS security patch, they'll increase the build number by 1000. This is called PSIRT patch.&lt;/p&gt;&#xA;&lt;p&gt;Remember CUCM is an application running on Linux. OS patch does not contain any CUCM bug fixes. Any bug fixes would be in ES (Engineering Special). ES versions would be indentified by the last three digits in build numbers (e.g. 6.1.2.1112)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Secondly, from the &lt;a href=&quot;http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/compat/ccmcompmatr1.pdf&quot; rel=&quot;noreferrer&quot;&gt;CUCM Software Compatability Matrix&lt;/a&gt; PDF, (sourced from &lt;a href=&quot;http://www.cisco.com/en/US/products/sw/voicesw/ps556/products_device_support_tables_list.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco Support documentation here&lt;/a&gt;), we can find a rough guide of what CUCM Version Number matches which System Version number.  This has always in my experience proved to be an accurate guide.&lt;/p&gt;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CUCM Version    |    System Version&#xA;-----------------------------------&#xA;9.1(1a)         |    9.1.1.20000-5&#xA;9.1(1)          |    9.1.1.10000-11&#xA;9.0(1)          |    9.0.1.10000-37&#xA;8.6(2a)SU3      |    8.6.2.23900-10&#xA;8.6(2a)SU2      |    8.6.2.22900-9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-09-14T00:44:26.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3221" PostTypeId="2" ParentId="3217" CreationDate="2013-09-14T01:11:11.667" Score="0" Body="&lt;p&gt;I will assume you are running IBGP, you never send a prefix you received via IBGP to an IBGP neighbor, also there would be split horizon (don't send a route back to the person who sent it to you). Since this box only has one neighbor and it is not originating any routes by itself, it will not send any routes, so the policy is implicit, but there.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-09-14T01:11:11.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3223" PostTypeId="2" ParentId="16" CreationDate="2013-09-14T02:08:18.417" Score="0" Body="&lt;p&gt;I think you should check whether you configure the client switch port with mode trunk or not, it update automatically, right after you put the right domain name and password.&lt;/p&gt;&#xA;" OwnerUserId="2651" LastActivityDate="2013-09-14T02:08:18.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3226" PostTypeId="1" AcceptedAnswerId="3228" CreationDate="2013-09-14T12:47:06.570" Score="5" ViewCount="4719" Body="&lt;p&gt;I am learning about the AODV (ad-hoc on-demand distance vector) protocol.  I saw a &quot;sequence number&quot; with a value like &quot;A 46&quot;; however, I don't understand why incrementing this sequence number can prevent loops.  Why does this help?&lt;/p&gt;&#xA;" OwnerUserId="2655" LastEditorUserId="775" LastEditDate="2013-09-14T17:41:39.167" LastActivityDate="2014-01-17T10:43:15.157" Title="AODV sequence numbers and loop prevention" Tags="|wireless|routing|router|protocol-theory|ad-hoc-wireless|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3227" PostTypeId="1" AcceptedAnswerId="3229" CreationDate="2013-09-14T14:19:24.877" Score="3" ViewCount="894" Body="&lt;p&gt;I read the following from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3561#page-11&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3561 - AODV, page 11&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;A destination node increments its own sequence number in two circumstances:&#xA;&#xA;   -  Immediately before a node originates a route discovery, it MUST&#xA;      increment its own sequence number.  This prevents conflicts with&#xA;      previously established reverse routes towards the originator of a&#xA;&#xA;   -  Immediately before a destination node originates a RREP in&#xA;      response to a RREQ, it MUST update its own sequence number to the&#xA;      maximum of its current sequence number and the destination&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I don't understand how incrementing sequence numbers prevents conflicts with previously established reverse routes; why does this help? Also, what does it mean by &amp;quot;it MUST update its own sequence number to the maximum of its current sequence number&amp;quot;, what does this maximum mean?&lt;/p&gt;&#xA;" OwnerUserId="2655" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2018-12-26T05:04:51.540" Title="Destination node sequence number increment policy" Tags="|routing|protocol-theory|rfc|ad-hoc-wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3228" PostTypeId="2" ParentId="3226" CreationDate="2013-09-14T16:33:07.500" Score="7" Body="&lt;p&gt;Mike's suggestion to read &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3561&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3561 - Ad hoc On-Demand Distance Vector (AODV) Routing&lt;/a&gt; should do the trick; in the meantime, I will go ahead and summarize it for you.&lt;/p&gt;&#xA;&lt;p&gt;Wireless (routing) protocols, such as AODV protocols, use sequence numbers in a different way than wireline protocols do.  AODV maintains a table of destination IP addresses, along with the last sequence number.  This way, if it receives the same routing sequence number in an update, it detects the duplicate and drops the update; thus, avoiding a potential loop. Additionally, AODV does not forward/process update packets that it has seen before.  The sending node (based on whatever message they send Route request, Route Reply), maintains their own sequence numbers and increments it before sending a new packet out.&lt;/p&gt;&#xA;&lt;p&gt;AODV is hardly alone in depending upon sequence numbers to avoid loops; &lt;a href=&quot;http://www.ietf.org/rfc/rfc4728.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4728 - Dynamic Source Routing (DSR)&lt;/a&gt; also depends on sequence numbers. Yet another wireless (multicast) routing protocol that uses sequence number to avoid looping is &lt;a href=&quot;http://www.monarch.cs.rice.edu/internet-drafts/draft-jetcheva-manet-admr-00.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;IETF Draft - The Adaptive Demand-Driven Multicast Routing Protocol for Mobile Ad Hoc Networks (ADMR)&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;We should note that layer-2 in wireless networks (typically) do not use Spanning Tree Protocol (STP) for loop prevention.&lt;/p&gt;&#xA;" OwnerUserId="2450" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-09-14T19:26:18.383" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3229" PostTypeId="2" ParentId="3227" CreationDate="2013-09-14T17:10:17.380" Score="3" Body="&lt;p&gt;Case of RREP: When nodes receive RREQ (Route request) for a destination node, then two types of nodes can respond to it. One is the destination node itself -- in this case, it can increase the seqeunce ID. The second types of nodes are those that have an existing route to the destination node. Now, they have already saved the seq number that was generated by the destination node, when they received the route. When sending a RREP, these intermediate nodes simply copy the earlier learnt sequence number (and do not generate a new one). This way, if the destination were to send a new route, then the node that generated RREQ, when it receives the RREP, it can pick the one with the latest sequence number and ignore the ones that are stale.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what the RFC says about the destination node sending RREP:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the generating node is the destination itself, it MUST increment its own sequence number by one if the sequence number in the RREQ packet is equal to that incremented value.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Case of RREQ: Nodes also maintain reverse routes (let us say, for node X) and they would want to update the route to originator of RREQ (node X) only when they receive a new RREQ from node X. One way to do this is to let X increment the sequence number whenever it sends a RREQ. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A note on destination sequence number field in the RREQ:&lt;/strong&gt; As per section 5.1, when originating RREQ: &quot;Destination Sequence Number: The latest sequence number received in the past by the originator for any route towards the destination.&quot;. As per section 6.5, when processing RREQ:  &quot;Lastly, the Destination Sequene number for the requested dest is set to the maximum of the corresponding value received in the RREQ message, and the destination sequence value currently maintained by the node for the requested destination.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, basically, settting/updating Dest Seq Number means that the sender or forwarder of RREQ is indicating that I have the information till, let us say seq 101, that was sent by the destination node. If that is not the latest, then the destination node does not bother to increase its own sequence number before sending the RREP (section 6.6.1).&lt;/p&gt;&#xA;" OwnerUserId="2450" LastEditorUserId="2450" LastEditDate="2013-09-15T08:06:42.023" LastActivityDate="2013-09-15T08:06:42.023" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3232" PostTypeId="1" CreationDate="2013-09-15T08:45:33.780" Score="8" ViewCount="4282" Body="&lt;p&gt;&lt;a href=&quot;http://juniper.cluepon.net/index.php/JunOS&quot; rel=&quot;noreferrer&quot;&gt;http://juniper.cluepon.net/index.php/JunOS&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;JUNOS prior to 5.0 was based on FreeBSD 2.2.6.&#xA;JUNOS between 5.0 and 7.2 (inclusive) is based on FreeBSD 4.2.&#xA;JUNOS 7.3 and higher is based on FreeBSD 4.10.&#xA;JUNOS 8.5 is based on FreeBSD 6.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's all I can find about JunOS's FreeBSD version (not sure if it's even correct).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see anything in Juniper documents about the corresponding FreeBSD version. Can anyone provide the FreeBSD version for newer JunOS releases up to 13.2?&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="775" LastEditDate="2013-09-15T10:56:28.077" LastActivityDate="2016-09-12T07:08:29.650" Title="JunOS FreeBSD version?" Tags="|juniper-junos|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3233" PostTypeId="2" ParentId="3232" CreationDate="2013-09-15T09:37:08.320" Score="12" Body="&lt;p&gt;% strings jkernel-ppc-13.2R1.7|grep &quot;FreeBSD: release&quot;&lt;br&gt;&#xA;$FreeBSD: release/7.3.0/sys/kern/kern_pmc.c 193634 2009-06-07 10:00:35Z fabient $&lt;/p&gt;&#xA;&#xA;&lt;p&gt;13.3 will be running 10.0. (edit: alas, this turned out not to be true)&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-11-19T07:11:10.640" LastActivityDate="2013-11-19T07:11:10.640" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3235" PostTypeId="2" ParentId="3173" CreationDate="2013-09-16T08:00:36.453" Score="5" Body="&lt;p&gt;I found the answer, &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_vpnips/configuration/15-2mt/sec-cfg-vpn-ipsec.html#GUID-E60D2A18-9162-47EE-BE21-CDCDB82259E9&quot; rel=&quot;nofollow&quot;&gt;Dynamic Crypto Maps with IPv6 are NOT SUPPORTED by Cisco IOS 15.2&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2619" LastEditorUserId="2619" LastEditDate="2013-09-26T10:52:18.580" LastActivityDate="2013-09-26T10:52:18.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3237" PostTypeId="1" AcceptedAnswerId="3238" CreationDate="2013-09-16T11:46:50.417" Score="14" ViewCount="2015" Body="&lt;p&gt;could anyone tell me what &lt;code&gt;ip as-path access-list 100 deny .+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+&lt;/code&gt; stands for?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched over the internet for the meaning of this regular expression, but I was unable to find any info.&lt;/p&gt;&#xA;" OwnerUserId="2665" LastEditorUserId="775" LastEditDate="2013-09-16T13:13:33.883" LastActivityDate="2018-05-02T11:55:58.780" Title="BGP regular expression .+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+_.+" Tags="|cisco|routing|router|bgp|acl|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3238" PostTypeId="2" ParentId="3237" CreationDate="2013-09-16T12:22:42.720" Score="18" Body="&lt;p&gt;Every time you see &lt;code&gt;.+_&lt;/code&gt;, that regular expression represents a single BGP autonomous system.  This as-path list denies BGP as paths equal to or longer than 12 paths long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The regular expression works because &lt;code&gt;.&lt;/code&gt; represents any character, &lt;code&gt;+&lt;/code&gt; is a wild card which optionally repeats the previous character an unlimited number of times, and &lt;code&gt;_&lt;/code&gt; represents the space between the autonomous system paths.  For more information, refer to the &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/termserv/configuration/guide/tcfaapre_ps1835_TSD_Products_Configuration_Guide_Chapter.html#wp1022889&quot;&gt;Cisco IOS Regular Expression guide&lt;/a&gt;, or this &lt;a href=&quot;http://blog.ine.com/2008/01/06/understanding-bgp-regular-expressions/&quot;&gt;INE BGP Regular Expressions blog&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-09-16T13:22:27.953" LastActivityDate="2013-09-16T13:22:27.953" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3239" PostTypeId="1" AcceptedAnswerId="3656" CreationDate="2013-09-16T13:49:18.923" Score="2" ViewCount="5767" Body="&lt;p&gt;I'm trying to set up a L2TP/IPSec VPN on a Windows 7 client, to a Cisco ASA 5505 SecPlus license.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA have dual WAN connections:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;wan1: a mobile 3G connection behind the ISP router, used for Internet browsing.&lt;/li&gt;&#xA;&lt;li&gt;wan2: a DSL connection with &quot;static&quot; DHCP IP, used for incoming firewall traffic.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A static route with tracking is set so if the 3G is down it will failover to DSL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;route wan1 0.0.0.0 0.0.0.0 192.168.98.1 1 track 1&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;wan2 have this config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;dhcp client route distance 200&#xA;ip address dhcp setroute &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All that is working fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have tried to make a L2TP/IPsec VPN connection from a Windows 7 client to the wan2 interface, I get these errors:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;Duplicate first packet detected.  Ignoring packet.&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;Phase 1 failure:  Mismatched attribute types for class Group Description:  Rcv'd: Unknown  Cfg'd: Group 2&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first error I'm also getting with the &quot;old&quot; Cisco VPN client, using the ASDM Wizard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA version is: 9.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question is: Do I miss something? I suspect the dual wan setup to be the problem. Do the ASA send VPN reply back on the default route (wan1)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/Kim&lt;/p&gt;&#xA;" OwnerUserId="2666" LastActivityDate="2013-10-21T13:15:44.363" Title="Cisco ASA - Remote VPN - Dual ISP" Tags="|cisco|cisco-asa|vpn|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3243" PostTypeId="1" AcceptedAnswerId="3244" CreationDate="2013-09-16T16:49:43.830" Score="8" ViewCount="2529" Body="&lt;p&gt;I have 2 force10 s25 switches that are used for a dark fiber link between two school buildings.  One of my switches is filling its ARP table to the brim and then failing.  This can happen as often as every 1.5 hours.  I noticed that one of the addresses in the cache is an address from our previous web filter that has not been online in 6 months.  We can't think of anything that would be holding an ARP cache but something seems to be feeding our force10 with addresses, but by running show arp summary, sometimes up to 50 new addresses per second are being added.  What should I be looking for to figure out where this is coming from?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my show ip route connected&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MiddleSchool#show ip route connected&#xA;   Destination        Gateway                      Dist/Metric Last Change&#xA;   -----------        -------                      ----------- -----------&#xA;  C    10.4.0.0/16        Direct, Vl 400                       0/0    03:39:18&#xA;  C    192.168.1.0/30     Direct, Te 0/28                      0/0    03:39:20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only static route is the default route (0.0.0.0 /0 over the tengig 0/28 port) over the fiber link since all traffic must leave this switch and go to the other building to reach the internet.&lt;/p&gt;&#xA;" OwnerUserId="2670" LastEditorUserId="775" LastEditDate="2013-09-16T20:20:19.010" LastActivityDate="2013-09-16T20:20:19.010" Title="Something is filling my force10 ARP table" Tags="|switch|routing|router|ethernet|arp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3244" PostTypeId="2" ParentId="3243" CreationDate="2013-09-16T18:32:05.483" Score="6" Body="&lt;p&gt;I looked at the configs in &lt;a href=&quot;https://stackoverflow.com/questions/18731188/force10-s25-switch-has-a-memory-leak-that-i-cant-solve&quot;&gt;your stack overflow question&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By way of review, this is your topology...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      Ten0/28  Ten0/28&#xA;Bldg_L----------------Bldg_S&#xA;F10 S25               F10 S25&#xA;  |                     |&#xA;  Vlan200               Vlan400&#xA;  10.2.0.101            10.4.0.101/16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that building L's switch proxy-ARPs to resolve &lt;code&gt;10.4.0.0/16&lt;/code&gt; and building S's switch proxy-ARPs for &lt;code&gt;10.2.0.0/16&lt;/code&gt;... interface TenGig0/28 (your transit link between the buildings) is answering proxy-ARPs requests.  Remove those 10-net statics and use...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Building L: &lt;code&gt;ip route 10.4.0.0 255.255.0.0 192.168.1.2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Building S: &lt;code&gt;ip route 10.2.0.0 255.255.0.0 192.168.1.1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The reason that a route like &lt;code&gt;ip route 10.4.0.0 255.255.0.0 TenGigabit0/28&lt;/code&gt; proxy-ARPs is because you are essentially telling the switch that the entire /16 subnet is directly connected to TenGigabit0/28 when you static route out an interface like this.  Using an IP next-hop only requires an ARP entry for that specific next-hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably need to move the default gateway to a new interface on the Building L switch, so the whole subnet can default through 10.2.0.101 and either reach 10.4.0.0/16 or the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry to say it, but you are leaving yourself wide open to ARP resource exhaustion problems when you assign a /16 as a connected subnet...  ARP is an unauthenticated protocol, and anyone on the LAN can flood the switch with ARPs and it has no choice but to cache / answer them... even for phantom addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Proactively, you might consider DHCP snooping and dynamic ARP inspection, if your version of FTOS supports it.  These feature normally require some thought and testing before deployment; however they are well worth using if you have 100s of kids with nothing more exciting than showing off their &quot;hacking&quot; skills.  I did a quick search to see if Force10 supports what Cisco calls port security, but I couldnt find it; port security can be used to limit the number of macs learned on a switch port.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2013-09-16T20:10:58.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3245" PostTypeId="1" AcceptedAnswerId="3260" CreationDate="2013-09-16T19:11:32.363" Score="13" ViewCount="36286" Body="&lt;p&gt;In a WLAN iperf TCP throughput test, multiple parallel streams will give me higher throughput than 1 stream. I tried increasing the TCP window size, but I still cannot achieve the max throughput with just 1 stream. Is there something else in the TCP layer that is preventing the full link capacity from being used?&lt;/p&gt;&#xA;" OwnerUserId="2360" LastEditorUserId="775" LastEditDate="2013-09-17T12:54:16.320" LastActivityDate="2023-06-20T12:02:00.123" Title="Wifi TCP iperf throughput: 1 stream vs multiple streams?" Tags="|wireless|ipv4|tcp|testing|iperf|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3246" PostTypeId="1" AcceptedAnswerId="3250" CreationDate="2013-09-16T19:27:08.083" Score="11" ViewCount="11692" Body="&lt;p&gt;I am looking for a way to backup the controller configuration file via an automatic process.  I've seen links to the web interface which appears to do a one-time tftp copy of the config to a remote host, however I'm looking for a way to schedule the copy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know of a way to automate configuration backups for Cisco WLCs?&lt;/p&gt;&#xA;" OwnerUserId="154" LastActivityDate="2014-08-13T11:29:21.713" Title="Is there an automatable way to backup the configuration from a WLC 2504 controller?" Tags="|cisco|wireless|wlc|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3247" PostTypeId="1" CreationDate="2013-09-16T19:31:41.010" Score="3" ViewCount="4920" Body="&lt;p&gt;We have a ZoneDirector 1100 appliance with 8 access points. Our software engineers are accessing the network via DHCP-provisioned IP addresses. Normally, whatever IP they land on is irrelevant to their day to day activities. But we now have a team currently working on a project that requires a reasonably consistent IP. I set the DHCP lease time to 'two weeks', yet we're seeing IP's being renewed more on the scale of hours, if not minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone make a reasonable guess as to what is causing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are on the latest firmware, and I searched through the support site to no avail.&lt;/p&gt;&#xA;" OwnerUserId="2671" LastEditorUserId="44" LastEditDate="2013-09-17T18:27:45.633" LastActivityDate="2013-09-17T18:27:45.633" Title="Ruckus ZoneDIrector frequently issues new IP addresses" Tags="|wireless|dhcp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3248" PostTypeId="2" ParentId="3246" CreationDate="2013-09-16T19:50:16.197" Score="4" Body="&lt;p&gt;Depending on how many devices you have, you could hack &lt;a href=&quot;http://www.gossamer-threads.com/lists/rancid/users/4590&quot; rel=&quot;nofollow&quot;&gt;Rancid&lt;/a&gt; to get it to work with them. Then you can set it up with a version control system and have a nice web gui with diffs over time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have many devices, the [&lt;code&gt;clogin&lt;/code&gt; part of Rancid] should be sufficient in a script called from &lt;code&gt;crontab&lt;/code&gt; daily, á la&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for device in wlc1 wlc2 wlc3 (..) wlcN; do&#xA;    clogin -c &quot;show run; show clock&quot; $device &amp;gt; ~/WLC-config-backups/$(date +%Y-%m-%d)-$device-backup.txt&#xA;done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's a basic &lt;code&gt;bash&lt;/code&gt; &lt;em&gt;for&lt;/em&gt; loop that can be extended almost infinitely.&lt;/p&gt;&#xA;" OwnerUserId="399" LastEditorUserId="399" LastEditDate="2014-08-13T11:29:21.713" LastActivityDate="2014-08-13T11:29:21.713" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3249" PostTypeId="1" AcceptedAnswerId="3251" CreationDate="2013-09-16T21:05:35.180" Score="7" ViewCount="36953" Body="&lt;p&gt;I am a complete newbie at BGP configurations.Need some clarification on understanding BGP network command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of our MPLS site routers have the following config : (Pasting only config snippets )&#xA;&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#&#xA;interface Loopback0&#xA; ip address 10.129.110.157 255.255.255.252&#xA;&#xA;interface GigabitEthernet0/0&#xA; ip address 10.129.110.154 255.255.255.252&#xA;&#xA;interface GigabitEthernet0/1.10&#xA; encapsulation dot1Q 10 native&#xA; ip address 10.129.135.129 255.255.255.192&#xA;&#xA;!         &#xA;interface GigabitEthernet0/1.20&#xA; encapsulation dot1Q 20&#xA; ip address 10.129.135.193 255.255.255.192&#xA;&#xA;&#xA;&#xA;router bgp XXXXX&#xA; bgp log-neighbor-changes&#xA; neighbor 10.129.110.153 remote-as 7795&#xA; neighbor 10.129.110.153&#xA; neighbor 10.129.110.153 ebgp-multihop 10&#xA; !&#xA; address-family ipv4&#xA;  neighbor 10.129.110.153 activate&#xA;  neighbor 10.129.110.153 send-community&#xA;  neighbor 10.129.110.153 soft-reconfiguration inbound&#xA;  no auto-summary&#xA;  no synchronization&#xA;  **network 10.129.110.152 mask 255.255.255.248**&#xA;  network 10.129.135.128 mask 255.255.255.128&#xA; exit-address-family&#xA;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the BGP network command   &lt;code&gt;&quot;network 10.129.110.152 mask 255.255.255.248&quot;&lt;/code&gt;  was put in , we cud not get connectivity to the loop back address &quot;10.129.110.157&quot;and the router  from any where else from our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but when we split the network command individually&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; &quot;network 10.129.110.152 mask 255.255.255.252&quot;&#xA; &quot; network 10.129.110.156 mask 255.255.255.252&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;every thing worked fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can some body explain me the correct uasge of network command in BGP.&#xA;Also, When and in what cases do we use the aggregate-address in BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="450" LastActivityDate="2013-09-16T23:26:09.513" Title="Injecting routes in to BGP for advertisement: BGP network command" Tags="|bgp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3250" PostTypeId="2" ParentId="3246" CreationDate="2013-09-16T21:43:05.140" Score="8" Body="&lt;p&gt;Use a script to login to the WLC and run the transfer command:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/controller/6.0/command/reference/cli60.html#wp1327209&quot;&gt;http://www.cisco.com/en/US/docs/wireless/controller/6.0/command/reference/cli60.html#wp1327209&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use this to upload the config from the WLC to another server via TFTP/SFTP/FTP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(Cisco Controller) &amp;gt;transfer upload mode sftp &#xA;&#xA;(Cisco Controller) &amp;gt;transfer upload username my-osx-user&#xA;&#xA;(Cisco Controller) &amp;gt;transfer upload password my-os-password&#xA;&#xA;(Cisco Controller) &amp;gt;transfer upload serverip 192.168.1.10&#xA;&#xA;(Cisco Controller) &amp;gt;transfer upload path /Users/my-osx-user/&#xA;&#xA;(Cisco Controller) &amp;gt;transfer upload filename wlc.config&#xA;&#xA;(Cisco Controller) &amp;gt;transfer upload datatype config&#xA;&#xA;(Cisco Controller) &amp;gt;transfer upload start&#xA;&#xA;Mode............................................. SFTP&#xA;SFTP Server IP................................... 192.168.1.10&#xA;SFTP Server Port................................. 22&#xA;SFTP Path........................................ /Users/my-osx-user/&#xA;SFTP Filename.................................... wlc.config&#xA;SFTP Username.................................... my-osx-user&#xA;SFTP Password.................................... *********&#xA;Data Type........................................ Config File &#xA;Encryption....................................... Disabled&#xA;&#xA;                                                          **************************************************&#xA;                            ***  WARNING: Config File Encryption Disabled  ***&#xA;                                                                              **************************************************&#xA;&#xA;&#xA;Are you sure you want to start? (y/N) y&#xA;&#xA;SFTP Config transfer starting.&#xA;&#xA;File transfer operation completed successfully.&#xA;&#xA;(Cisco Controller) &amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While the link points to WLC 6.0, the example was run on 7.4.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-09-16T21:43:05.140" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3251" PostTypeId="2" ParentId="3249" CreationDate="2013-09-16T22:13:11.873" Score="5" Body="&lt;p&gt;From an old archive config...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 7866&#xA;...&#xA; network 66.152.0.0 mask 255.255.224.0&#xA;...&#xA;ip route 66.152.0.0 255.255.224.0 Null0 200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We controlled exactly what was broadcast using &lt;code&gt;network&lt;/code&gt;. Null routes a) prevent flapping (when there's an actual interface for that network -- eg. customer provided block), and b) put networks in the route table that wouldn't be there otherwise.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-09-16T22:13:11.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3252" PostTypeId="2" ParentId="3249" CreationDate="2013-09-16T22:19:06.477" Score="6" Body="&lt;p&gt;If you're familiar with IGP's(EIGRP, OSPF), the network command is used for advertising networks and establishing neighbors using multicast addresses.  BGP is different because we statically assign neighbors and the network command is used to simply advertise routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With IGP's, you will advertise all prefixes within the aggregate network block so if you have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;network 10.129.110.152 mask 255.255.255.248&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;under say, EIGRP, you will advertise both of the /30's within that network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP works differently in that in that you must have an exact match for you network statement in the RIB.  Because you didn't have an exact match for the 10.129.110.152/29 network, it didn't advertise.  Once you added the network statements that matched the RIB, you were good to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some cases, you may prefer to anchor the advertisement with a null route.  So you could have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ip route 10.129.110.152 255.255.255.248 null 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would place the network route in the routing table and would always advertise the route even if the more specific routes are unavailable.  This also helps when you have a flapping link because your advertisements won't withdraw and re-advertise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Aggregate-address is different than the network command.  With the Aggregate-address command, you need a match in the BGP table and not the RIB.  The network doesn't need to be an exact match, there only needs to be a longer prefix within the aggregate address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a link to an incredibly helpful troubleshooting resource as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.nanog.org/meetings/nanog33/presentations/troubleshooting.pdf&quot; rel=&quot;noreferrer&quot;&gt;NANOG BGP troubleshooting&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2231" LastEditorUserId="2231" LastEditDate="2013-09-16T23:26:09.513" LastActivityDate="2013-09-16T23:26:09.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3253" PostTypeId="1" CreationDate="2013-09-16T22:23:12.643" Score="8" ViewCount="599" Body="&lt;p&gt;Is there any way to detect the underlying layout physical layout of a VLAN. For instance, to know whether two devices in the same VLAN are connected via the same wifi AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To clarify, this would be from the perspective of a device connected to the WLC, with no special privileges. If you can operate in monitor mode then of course the underlying structure can be seen from beacons/probes etc, but assuming these are not available to you, as on many devices they aren't, I was wondering if anything could be done 'actively'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ping time and % packet loss is an obvious option, but I think there's too much variance in both to give a reliable answer.  I suspect the answer is no, unless you have admin access to the switch via SNMP. I just want to check there isn't something clever that could be done with LLDP, DHCP or ARP etc.&lt;/p&gt;&#xA;" OwnerUserId="2673" LastEditorUserId="2673" LastEditDate="2013-09-17T00:19:22.587" LastActivityDate="2014-02-02T23:21:03.117" Title="Map the underlying structure of a VLAN" Tags="|wireless|vlan|dhcp|snmp|lldp|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3254" PostTypeId="1" AcceptedAnswerId="3257" CreationDate="2013-09-16T22:28:24.953" Score="6" ViewCount="585" Body="&lt;p&gt;I have enabled the SLA monitor on an ASA, and I was wondering what the RTTSum and RTTSum2  Metric Represents?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RTT stands for &quot;Rout Trip Time&quot; I am having trouble figuring what the RTTSum actually represent, how would I read it and apply it to troubleshooting?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Modification time: 16:46:11.982 EST Mon Sep 16 2013&#xA;Number of Octets Used by this Entry: 1480&#xA;Number of operations attempted: 197&#xA;Number of operations skipped: 0&#xA;Current seconds left in Life: Forever&#xA;Operational state of entry: Active&#xA;Last time this entry was reset: Never&#xA;Connection loss occurred: FALSE&#xA;Timeout occurred: FALSE&#xA;Over thresholds occurred: FALSE&#xA;Latest RTT (milliseconds): 10&#xA;Latest operation start time: 17:18:51.982 EST Mon Sep 16 2013&#xA;Latest operation return code: OK&#xA;RTT Values:&#xA;RTTAvg: 10  RTTMin: 10  RTTMax: 10&#xA;NumOfRTT: 3 RTTSum: 30  RTTSum2: 300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And another example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Number of Octets Used by this Entry: 1480&#xA;Number of operations attempted: 243&#xA;Number of operations skipped: 0&#xA;Current seconds left in Life: Forever&#xA;Operational state of entry: Active&#xA;Last time this entry was reset: Never&#xA;Connection loss occurred: FALSE&#xA;Timeout occurred: FALSE&#xA;Over thresholds occurred: FALSE&#xA;Latest RTT (milliseconds): 13&#xA;Latest operation start time: 17:26:31.992 EST Mon Sep 16 2013&#xA;Latest operation return code: OK&#xA;RTT Values:&#xA;RTTAvg: 13  RTTMin: 10  RTTMax: 20&#xA;NumOfRTT: 3 RTTSum: 40  RTTSum2: 600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="1352" LastActivityDate="2013-09-17T04:41:50.440" Title="What does the RTTSum and RTTSum2 represent in a ASA SLA monitor?" Tags="|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3255" PostTypeId="2" ParentId="3245" CreationDate="2013-09-16T23:04:41.197" Score="2" Body="&lt;p&gt;Here's the calculation for the maximum throughput of a single tcp stream.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(TCP Window [bytes]/RTT[seconds]) * 8 [bits/byte] = Max single tcp throughput in (bps)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you have a bottleneck and latency plays a large role.&lt;/p&gt;&#xA;" OwnerUserId="2231" LastActivityDate="2013-09-16T23:04:41.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3256" PostTypeId="2" ParentId="3253" CreationDate="2013-09-17T00:36:50.190" Score="0" Body="&lt;p&gt;Assuming you have the two devices's MAC addresses, you could use MAC tables to see on which interface the MACs came in on. If they come in on the same interface then they're associated to the same AP.&lt;/p&gt;&#xA;" OwnerUserId="889" LastActivityDate="2013-09-17T00:36:50.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3257" PostTypeId="2" ParentId="3254" CreationDate="2013-09-17T04:41:50.440" Score="8" Body="&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=rttMonLatestJitterOperRTTSum&amp;amp;translate=Translate&quot;&gt;RTTSum&lt;/a&gt; is the sum of samples, divide it by sample count and you've got arithmetic mean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=rttMonLatestJitterOperRTTSum2&amp;amp;translate=Translate&quot;&gt;RTTSum2&lt;/a&gt; is sum of squares of samples, you need it for example to derive standard deviation.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-09-17T04:41:50.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3259" PostTypeId="2" ParentId="3239" CreationDate="2013-09-17T09:03:34.430" Score="1" Body="&lt;p&gt;You do have asymmetrical routing, but that shouldn't be the issue.  &lt;strong&gt;Instead, I suspect the issue is link delay involving your 3G link.&lt;/strong&gt;  Since IPSec IKE uses UDP/500 or UDP/4500 with NAT-Traversal, there's no guarantee of packet delivery.  Your VPN client -- the IKE initiator -- sends the first IKE message and is awaiting a response from your ASA.  The ASA IKE response message is either dropped or delayed too long that your VPN client sends another IKE message, causing the ASA to log the &lt;code&gt;Duplicate first packet received&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would think your DSL link is more reliable -- less delay, less jitter, less packet loss -- than the 3G mobile network.  Any reason that's not your default gateway?  To test the 3G link as the issue, force the DSL to be your default.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-09-17T09:03:34.430" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3260" PostTypeId="2" ParentId="3245" CreationDate="2013-09-17T10:59:06.647" Score="15" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;In a WLAN iperf TCP throughput test, multiple parallel streams will give me higher throughput than 1 stream. I tried increasing the TCP window size, but I still cannot achieve the max throughput with just 1 stream. Is there something else in the TCP layer that is preventing the full link capacity from being used?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In my experience, if you see significantly different results between 1 TCP stream and multiple TCP streams the issue is normally packet loss; so the &amp;quot;something else&amp;quot; in the TCP layer is retransmission (due to lower-layer packet loss).&lt;/p&gt;&#xA;&lt;p&gt;An example I cooked up to illustrate how packet loss affects single-stream throughput...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                   [Wifi||LAN-0.0%-Loss||LAN-2.0%-Loss]&#xA;+--------------+                                        +--------------+&#xA;|              |                                        |              |&#xA;| Thinkpad-T61 |----------------------------------------| Linux Server |&#xA;|              |                                        | Tsunami      |&#xA;+--------------+                                        +--------------+&#xA;iperf client             ------------------&amp;gt;            iperf server&#xA;                             Pushes data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is a table that summarizes the test results of a 60 second &lt;code&gt;iperf&lt;/code&gt; test between a client and server... you might see a little variation in iperf results from RTT jitter (i.e higher RTT standard deviation); however, the most significant difference came when I simulated 2% loss leaving the client wired NIC.  172.16.1.56 and 172.16.1.80 are the same laptop (running Ubuntu).  The server is 172.16.1.5, running Debian.  I used &lt;a href=&quot;http://www.linuxfoundation.org/collaborate/workgroups/networking/netem&quot; rel=&quot;nofollow noreferrer&quot;&gt;netem&lt;/a&gt; on the client wired NIC to simulate packet loss...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Client IP       Transport    Loss     avg RTT    RTT StdDev    TCP Streams   Tput&#xA;-----------     ----------   ----     -------    ----------    -----------   ----------&#xA;172.16.1.56     802.11g      0.0%      0.016s          42.0              1     19.5Mbps&#xA;172.16.1.56     802.11g      0.0%      0.016s          42.0              5     20.5Mbps&#xA;172.16.1.80     1000BaseT    0.0%     0.0002s           0.0              1    937  Mbps&#xA;172.16.1.80     1000BaseT    0.0%     0.0002s           0.0              5    937  Mbps&#xA;172.16.1.80     1000BaseT    2.0%     0.0002s           0.0              1    730  Mbps &amp;lt;---&#xA;172.16.1.80     1000BaseT    2.0%     0.0002s           0.0              5    937  Mbps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT for comment responses&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Can you explain what is happening in the last scenario (1000BaseT, 5 streams, 2.0% loss)? Even though there is packet loss, the total throughput is still saturated at 937 Mbits/sec.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Most TCP implementations decrease their &lt;a href=&quot;http://en.wikipedia.org/wiki/Congestion_window&quot; rel=&quot;nofollow noreferrer&quot;&gt;congestion window&lt;/a&gt; when packet loss is detected.  Since we're using &lt;a href=&quot;http://www.linuxfoundation.org/collaborate/workgroups/networking/netem&quot; rel=&quot;nofollow noreferrer&quot;&gt;netem&lt;/a&gt; to force 2% packet loss from the client to the server, some of the client's data gets dropped.  The net effect of &lt;a href=&quot;http://www.linuxfoundation.org/collaborate/workgroups/networking/netem&quot; rel=&quot;nofollow noreferrer&quot;&gt;netem&lt;/a&gt; in this example is a single-stream average transmit rate of 730Mbps.  Adding multiple streams means that the individual TCP streams can work together to saturate the link.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;My goal is to achieve the highest TCP throughput possible over WiFi. As I understand it, I should increase the number of streams in order to counter the decrease in throughput caused by packet loss. Is this correct?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;In addition, at what point will too many streams start to negatively impact throughput? Would this be caused by limited memory and/or processing power?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I can't really answer that without more experiments, but for 1GE links, 1 stream can saturate it under the right circumstances. Even if there is packet loss, I have never had a problem saturating a 1GE link with 5 parallel streams.  To give you an idea of how scalable TCP is, linux servers can handle over &lt;a href=&quot;https://security.appspot.com/vsftpd.html#performance&quot; rel=&quot;nofollow noreferrer&quot;&gt;1500 concurrent TCP sockets&lt;/a&gt; under the right circumstances.  This is &lt;a href=&quot;https://stackoverflow.com/a/3923785/667301&quot;&gt;another SO discussion&lt;/a&gt; that is relevant to scaling concurrent TCP sockets, but in my opinion anything above 20 parallel sockets would be overkill if you're merely trying to saturate a link.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I must have a misunderstanding that iperf uses the -w window size as a maximum as it sounds like you're saying it grew beyond that 21K initial value&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I didn't use &lt;code&gt;iperf -w&lt;/code&gt;, so I think there is a misunderstanding.  Since you have so many questions about the wifi case, I'm including a wireshark graph of TCP throughput for the wifi single TCP stream case.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rO1gU.png&quot; alt=&quot;Wifi TCP single-stream throughput&quot; /&gt;&lt;/p&gt;&#xA;&lt;hr&gt;&#xA;&lt;h2&gt;Test Data&lt;/h2&gt;&#xA;&lt;p&gt;I am also including raw test data in case you'd like to see how I measured these things...&lt;/p&gt;&#xA;&lt;h3&gt;802.11g, 1 TCP Stream&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;mpenning@mpenning-ThinkPad-T61:~$ mtr --no-dns --report \&#xA;  --report-cycles 60 172.16.1.5&#xA;HOST: mpenning-ThinkPad-T61       Loss%   Snt   Last   Avg  Best  Wrst StDev&#xA;  1.|-- 172.16.1.5                 0.0%    60    0.8  16.0   0.7 189.4  42.0&#xA;mpenning@mpenning-ThinkPad-T61:~$&#xA;&#xA;[mpenning@tsunami]$ iperf -s -p 9000 -B 172.16.1.5&#xA;&#xA;mpenning@mpenning-ThinkPad-T61:~$ iperf -c 172.16.1.5 -p 9000 -t 60 -P 1&#xA;------------------------------------------------------------&#xA;Client connecting to 172.16.1.5, TCP port 9000&#xA;TCP window size: 21.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  3] local 172.16.1.56 port 40376 connected with 172.16.1.5 port 9000&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  3]  0.0-60.1 sec   139 MBytes  19.5 Mbits/sec&#xA;mpenning@mpenning-ThinkPad-T61:~$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;802.11g, 5 TCP Streams&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami]$ iperf -s -p 9001 -B 172.16.1.5&#xA;&#xA;mpenning@mpenning-ThinkPad-T61:~$ iperf -c 172.16.1.5 -p 9001 -t 60 -P 5&#xA;------------------------------------------------------------&#xA;Client connecting to 172.16.1.5, TCP port 9001&#xA;TCP window size: 21.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  3] local 172.16.1.56 port 37162 connected with 172.16.1.5 port 9001&#xA;[  5] local 172.16.1.56 port 37165 connected with 172.16.1.5 port 9001&#xA;[  7] local 172.16.1.56 port 37167 connected with 172.16.1.5 port 9001&#xA;[  4] local 172.16.1.56 port 37163 connected with 172.16.1.5 port 9001&#xA;[  6] local 172.16.1.56 port 37166 connected with 172.16.1.5 port 9001&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  3]  0.0-60.0 sec  28.0 MBytes  3.91 Mbits/sec&#xA;[  5]  0.0-60.1 sec  28.8 MBytes  4.01 Mbits/sec&#xA;[  4]  0.0-60.3 sec  28.1 MBytes  3.91 Mbits/sec&#xA;[  6]  0.0-60.4 sec  34.0 MBytes  4.72 Mbits/sec&#xA;[  7]  0.0-61.0 sec  30.5 MBytes  4.20 Mbits/sec&#xA;[SUM]  0.0-61.0 sec   149 MBytes  20.5 Mbits/sec&#xA;mpenning@mpenning-ThinkPad-T61:~$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;1000BaseT, 1 Stream, 0.0% loss&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;mpenning@mpenning-ThinkPad-T61:~$ mtr --no-dns --report \&#xA;&amp;gt;   --report-cycles 60 172.16.1.5&#xA;HOST: mpenning-ThinkPad-T61       Loss%   Snt   Last   Avg  Best  Wrst StDev&#xA;  1.|-- 172.16.1.5                 0.0%    60    0.2   0.2   0.2   0.2   0.0&#xA;mpenning@mpenning-ThinkPad-T61:~$&#xA;&#xA;[mpenning@tsunami]$ iperf -s -p 9002 -B 172.16.1.5&#xA;&#xA;mpenning@mpenning-ThinkPad-T61:~$ iperf -c 172.16.1.5 -p 9002 -t 60 -P 1&#xA;------------------------------------------------------------&#xA;Client connecting to 172.16.1.5, TCP port 9002&#xA;TCP window size: 21.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  3] local 172.16.1.80 port 49878 connected with 172.16.1.5 port 9002&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  3]  0.0-60.0 sec  6.54 GBytes   937 Mbits/sec&#xA;mpenning@mpenning-ThinkPad-T61:~$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;1000BaseT, 5 Streams, 0.0% loss&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami]$ iperf -s -p 9003 -B 172.16.1.5&#xA;&#xA;mpenning@mpenning-ThinkPad-T61:~$ iperf -c 172.16.1.5 -p 9003 -t 60 -P 5&#xA;------------------------------------------------------------&#xA;Client connecting to 172.16.1.5, TCP port 9003&#xA;TCP window size: 21.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  7] local 172.16.1.80 port 47047 connected with 172.16.1.5 port 9003&#xA;[  3] local 172.16.1.80 port 47043 connected with 172.16.1.5 port 9003&#xA;[  4] local 172.16.1.80 port 47044 connected with 172.16.1.5 port 9003&#xA;[  5] local 172.16.1.80 port 47045 connected with 172.16.1.5 port 9003&#xA;[  6] local 172.16.1.80 port 47046 connected with 172.16.1.5 port 9003&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  4]  0.0-60.0 sec  1.28 GBytes   184 Mbits/sec&#xA;[  5]  0.0-60.0 sec  1.28 GBytes   184 Mbits/sec&#xA;[  3]  0.0-60.0 sec  1.28 GBytes   183 Mbits/sec&#xA;[  6]  0.0-60.0 sec  1.35 GBytes   193 Mbits/sec&#xA;[  7]  0.0-60.0 sec  1.35 GBytes   193 Mbits/sec&#xA;[SUM]  0.0-60.0 sec  6.55 GBytes   937 Mbits/sec&#xA;mpenning@mpenning-ThinkPad-T61:~$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;1000BaseT, 1 Streams, 2.0% loss&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;mpenning@mpenning-ThinkPad-T61:~$ sudo tc qdisc add dev eth0 root netem corrupt 2.0%&#xA;&#xA;mpenning@mpenning-ThinkPad-T61:~$ mtr --no-dns --report   --report-cycles 60 172.16.1.5&#xA;HOST: mpenning-ThinkPad-T61       Loss%   Snt   Last   Avg  Best  Wrst StDev&#xA;  1.|-- 172.16.1.5                 1.7%    60    0.2   0.2   0.2   0.2   0.0&#xA;mpenning@mpenning-ThinkPad-T61:~$&#xA;&#xA;[mpenning@tsunami]$ iperf -s -p 9004 -B 172.16.1.5&#xA;&#xA;mpenning@mpenning-ThinkPad-T61:~$ iperf -c 172.16.1.5 -p 9004 -t 60 -P 1&#xA;------------------------------------------------------------&#xA;Client connecting to 172.16.1.5, TCP port 9004&#xA;TCP window size: 42.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  3] local 172.16.1.80 port 48910 connected with 172.16.1.5 port 9004&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  3]  0.0-64.1 sec  5.45 GBytes   730 Mbits/sec&#xA;mpenning@mpenning-ThinkPad-T61:~$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;1000BaseT, 5 Streams, 2.0% loss&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami]$ iperf -s -p 9005 -B 172.16.1.5&#xA;&#xA;mpenning@mpenning-ThinkPad-T61:~$ iperf -c 172.16.1.5 -p 9005 -t 60 -P 5&#xA;------------------------------------------------------------&#xA;Client connecting to 172.16.1.5, TCP port 9005&#xA;TCP window size: 21.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  7] local 172.16.1.80 port 50616 connected with 172.16.1.5 port 9005&#xA;[  3] local 172.16.1.80 port 50613 connected with 172.16.1.5 port 9005&#xA;[  5] local 172.16.1.80 port 50614 connected with 172.16.1.5 port 9005&#xA;[  4] local 172.16.1.80 port 50612 connected with 172.16.1.5 port 9005&#xA;[  6] local 172.16.1.80 port 50615 connected with 172.16.1.5 port 9005&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  3]  0.0-60.0 sec  1.74 GBytes   250 Mbits/sec&#xA;[  7]  0.0-60.0 sec   711 MBytes  99.3 Mbits/sec&#xA;[  4]  0.0-60.0 sec  1.28 GBytes   183 Mbits/sec&#xA;[  6]  0.0-60.0 sec  1.59 GBytes   228 Mbits/sec&#xA;[  5]  0.0-60.0 sec  1.24 GBytes   177 Mbits/sec&#xA;[SUM]  0.0-60.0 sec  6.55 GBytes   937 Mbits/sec&#xA;mpenning@mpenning-ThinkPad-T61:~$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;Remove packet loss simulation&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;mpenning@mpenning-ThinkPad-T61:~$ sudo tc qdisc del dev eth0 root&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2023-06-20T12:02:00.123" LastActivityDate="2023-06-20T12:02:00.123" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="3261" PostTypeId="2" ParentId="3247" CreationDate="2013-09-17T13:54:11.777" Score="1" Body="&lt;p&gt;This is likely client related as a DHCP server does not renew an address unless requested by the client.  Princeton has some interesting posts on iOS bugs that may be related.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.net.princeton.edu/apple-ios/ios40-requests-DHCP-too-often.html&quot; rel=&quot;nofollow&quot;&gt;http://www.net.princeton.edu/apple-ios/ios40-requests-DHCP-too-often.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2681" LastActivityDate="2013-09-17T13:54:11.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3262" PostTypeId="2" ParentId="3247" CreationDate="2013-09-17T15:06:25.707" Score="3" Body="&lt;p&gt;Although it doesn't answer the specific question of &quot;Why is this happening?&quot;, the best answer I could give you is: &lt;strong&gt;Don't use the Zone Director for DHCP.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per Ruckus Wireless themselves in the &lt;a href=&quot;https://support.ruckuswireless.com/documents/223-zonedirector-release-9-5-user-guide/download&quot; rel=&quot;nofollow&quot;&gt;Zone Director User Guide&lt;/a&gt; under the &quot;Enabling the Built-in DHCP Server&quot; section:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;NOTE: Ruckus Wireless recommends that you only enable the built-in DHCP server if there are &#xA;  no other DHCP servers on the network&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it appears &lt;strong&gt;they&lt;/strong&gt; don't even recommend using it for DHCP; probably because of odd behavior such as you are seeing.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the very least, it is an extremely limited feature-set.  Most work-arounds for your problem would be to configure the trouble clients with statically configured IP addresses/fixed leases in the DHCP server.  However there is no capability for that in the Zone Director 1100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way around your problem at this point, would be to configure the Zone Director for DHCP Relay.    Once the Zone Director forwards the DHCP requests to an actual DHCP server, you would have much greater control over the DHCP process.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-09-17T15:13:15.220" LastActivityDate="2013-09-17T15:13:15.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3263" PostTypeId="1" CreationDate="2013-09-17T18:11:06.350" Score="2" ViewCount="6369" Body="&lt;p&gt;I have a network that consists of 3 VLANs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 -&gt; Desktops and Laptops&lt;/li&gt;&#xA;&lt;li&gt;50 -&gt; IP Cameras&lt;/li&gt;&#xA;&lt;li&gt;200 -&gt; Servers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Just to make this simple, treat all devices in a VLAN the same:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 is a member of 200, as computers here need to talk to Servers&lt;/li&gt;&#xA;&lt;li&gt;50 is a member of 200, as the IP Cameras stream to a NAS&lt;/li&gt;&#xA;&lt;li&gt;200 is a member of 50, as the NAS controls attributes of the cameras&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;200 is a member of 1, as the servers and computers talk to each other&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;VLAN 1 &amp;lt;---------&amp;gt; VLAN 200  &amp;lt;---------&amp;gt; VLAN 50&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All devices have an IP of &lt;code&gt;10.1.1.x&lt;/code&gt; (&lt;code&gt;x&lt;/code&gt; is device dependent)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this configuration, the primary goal of having IP Cameras in a separate VLAN is so that this traffic is not seen by the desktops and laptops in VLAN 1. This works fine, however, when the NAS sends an ACK for the IP Camera traffic, and because its port on the switch is mapped to VLAN 200, devices on VLAN 1 (bad) and VLAN 50 (good) are seeing the same packets. Because this is IP Camera related, I would prefer that this traffic only to VLAN 50 (e.g. 200 -&gt; 50 and not 200 -&gt; 1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get traffic from VLAN 200 devices to route to the VLAN they are intended for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm hoping for a solution that doesn't require a dedicated router and my switch is a Netgear GS108T, but if necessary upgrading a step to something like a Netgear M4100 or even to an Enterprise class switch is not an issue - I am just looking for the best configuration right now.&lt;/p&gt;&#xA;" OwnerUserId="2685" LastEditorUserId="3146" LastEditDate="2013-11-05T17:47:25.663" LastActivityDate="2013-11-05T17:47:25.663" Title="Can I route packets to different VLANs based on destination IP?" Tags="|switch|vlan|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3265" PostTypeId="2" ParentId="3263" CreationDate="2013-09-17T18:26:31.347" Score="8" Body="&lt;p&gt;Each VLAN should have its own subnet. Example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN1: 10.1.1.0/24&lt;/li&gt;&#xA;&lt;li&gt;VLAN50: 10.1.50.0/24&lt;/li&gt;&#xA;&lt;li&gt;VLAN200: 10.1.200.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then you will need a device to route between them. A quick lookup on your switch did not show it as supporting layer 3 routing. So you may need an upgrade or a dedicated router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have a router, you would configure 3 interfaces, one per VLAN for routing. On these interfaces you can apply an ACL to block traffic you don't want.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ACL Laptop/Desktop Traffic: permit access to servers&lt;/li&gt;&#xA;&lt;li&gt;ACL IP Cameras: permit access to servers&lt;/li&gt;&#xA;&lt;li&gt;ACL Servers: Permit all access&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-09-17T19:53:59.880" LastActivityDate="2013-09-17T19:53:59.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3266" PostTypeId="1" AcceptedAnswerId="3311" CreationDate="2013-09-17T18:35:42.303" Score="9" ViewCount="2281" Body="&lt;p&gt;I've built a test lab where I am testing Filter Based Forwarding (FBF), aka Policy Based Routing. Question will follow below, but first, the details:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the topology diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ymwkQ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OBJECTIVE:&lt;/strong&gt; Any traffic destined to Staging from Site 1 should route via Link 2 into the WAN and NOT via Link 1. Since Link 1 will be saturated with replication traffic between the two data centers.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SW-1 &amp;amp; SW-2 are Juniper EX4200 switches&lt;/li&gt;&#xA;&lt;li&gt;RTR-1 &amp;amp; RTR-2 are Juniper J4350's&lt;/li&gt;&#xA;&lt;li&gt;PE-1 &amp;amp; PE-2 are Cisco 1841 routers running ISIS and MPLS VPN to simulate provider WAN backbone&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;SW-1, SW-2, RTR-1 and RTR-2 are all OSPF neighbors in Area 0. Both RTR-1 and RTR-2 are ASBR's and injecting BGP learned routes into OSPF. Each router is advertising routes into the WAN for its respective site (as well as pre-pended routes for the other site for redundancy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing traffic from Site 1 to Staging at Site 2 is easily accomplished by simply redistributing the static route to Staging on SW-2 into OSPF with a higher metric. Since that route gets advertised by RTR-2 into the WAN, RTR-1 will learn that route and redistribute it into OSPF with a metric of 0. The OSPF route learned on SW-1 from SW-2 would have a higher metric, thus routing would be preferred over the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Return traffic from site 2 also needs to flow this way so that we avoid asymmetric routing.&#xA;FBF is applied on the inbound interface (Link 4) entering SW-2. This filter will take all traffic sourced from Staging (10.100.190 /24) and make the next-hop RTR-2. This portion of the FBF is working, as I have tested in the lab.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since RTR-2's preferred route back to Site 1 is via Link 1, we need to apply FBF once again at the inbound LAN interface of RTR-2 (facing SW-2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the problem... When FBF is applied on that router, OSPF adjacency with SW-2 breaks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;QUESTION:&lt;/strong&gt; Why is OSPF adjacency breaking between RTR-2 and SW-2??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration for RTR-2 and SW-2 are attached:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;RTR-2 Configs&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@RTR-2&amp;gt; show configuration interfaces | display set    &#xA;set interfaces ge-0/0/0 unit 0 family inet filter input FBF-TEST&#xA;deactivate interfaces ge-0/0/0 unit 0 family inet filter&#xA;set interfaces ge-0/0/0 unit 0 family inet address 10.100.254.2/24&#xA;set interfaces ge-0/0/3 description &quot;Uplink to WAN&quot;&#xA;set interfaces ge-0/0/3 unit 0 family inet address 200.200.200.2/30&#xA;set interfaces lo0 unit 0 family inet address 10.100.199.4/32&#xA;&#xA;root@RTR-2&amp;gt; show configuration routing-options | display set &#xA;set routing-options interface-routes rib-group inet STAGING-RIB&#xA;set routing-options rib-groups STAGING-RIB import-rib inet.0&#xA;set routing-options rib-groups STAGING-RIB import-rib PATH-1.inet.0&#xA;set routing-options rib-groups STAGING-RIB import-rib PATH-2.inet.0&#xA;set routing-options router-id 200.200.200.2&#xA;set routing-options autonomous-system 1&#xA;&#xA;root@RTR-2&amp;gt; show configuration routing-instances | display set  &#xA;set routing-instances PATH-1 instance-type forwarding&#xA;set routing-instances PATH-1 routing-options static route 10.100.30.0/24 next-hop 200.200.200.1&#xA;set routing-instances PATH-1 routing-options static route 10.100.30.0/24 qualified-next-hop 10.100.254.1 preference 100&#xA;set routing-instances PATH-2 instance-type forwarding&#xA;set routing-instances PATH-2 routing-options static route 10.100.30.0/24 next-hop 10.100.254.1&#xA;set routing-instances PATH-2 routing-options static route 10.100.30.0/24 qualified-next-hop 200.200.200.1 preference 100&#xA;&#xA;root@RTR-2&amp;gt; show configuration firewall | display set             &#xA;set firewall family inet filter FBF-TEST term TERM-1 from source-address 10.100.190.0/24&#xA;set firewall family inet filter FBF-TEST term TERM-1 from source-address 10.100.191.0/24&#xA;set firewall family inet filter FBF-TEST term TERM-1 then routing-instance PATH-1&#xA;set firewall family inet filter FBF-TEST term DEFAULT then routing-instance PATH-2&#xA;&#xA;root@RTR-2&amp;gt; show configuration protocols | display set &#xA;set protocols bgp path-selection cisco-non-deterministic&#xA;set protocols bgp log-updown&#xA;set protocols bgp group TEST type external&#xA;set protocols bgp group TEST local-address 200.200.200.2&#xA;set protocols bgp group TEST import REJECT&#xA;set protocols bgp group TEST export ADVERTISED&#xA;set protocols bgp group TEST peer-as 65000&#xA;set protocols bgp group TEST neighbor 200.200.200.1 preference 20&#xA;set protocols ospf rib-group STAGING-RIB&#xA;set protocols ospf export BGP-to-OSPF&#xA;set protocols ospf area 0.0.0.0 interface ge-0/0/0.0 priority 150&#xA;set protocols ospf area 0.0.0.0 interface lo0.0 passive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SW-2 Configs&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@SW-2&amp;gt; show configuration interfaces | display set &#xA;set interfaces ge-0/0/0 unit 0 family inet address 10.10.10.2/30&#xA;set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode access&#xA;set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members VLAN-254&#xA;set interfaces ge-0/0/11 description &quot;Uplink to STAGING&quot;&#xA;set interfaces ge-0/0/11 unit 0 family inet filter input FBF-TEST&#xA;set interfaces ge-0/0/11 unit 0 family inet address 10.100.100.1/30&#xA;set interfaces lo0 unit 0 family inet address 10.100.199.2/32&#xA;set interfaces vlan unit 2 family inet address 10.100.2.1/24&#xA;set interfaces vlan unit 251 family inet address 10.100.251.1/24&#xA;set interfaces vlan unit 254 family inet address 10.100.254.1/24&#xA;&#xA;root@SW-2&amp;gt; show configuration routing-options | display set &#xA;set routing-options nonstop-routing&#xA;set routing-options interface-routes rib-group inet STAGING-RIB&#xA;set routing-options static route 172.22.128.0/21 next-hop 10.22.76.1&#xA;set routing-options static route 10.22.20.0/24 next-hop 10.22.76.1&#xA;set routing-options static route 10.100.190.0/24 next-hop 10.100.100.2&#xA;set routing-options static route 10.100.191.0/24 next-hop 10.100.100.2&#xA;set routing-options rib-groups STAGING-RIB import-rib inet.0&#xA;set routing-options rib-groups STAGING-RIB import-rib PATH-1.inet.0&#xA;set routing-options rib-groups STAGING-RIB import-rib PATH-2.inet.0&#xA;set routing-options router-id 10.100.254.1&#xA;&#xA;root@SW-2&amp;gt; show configuration routing-instances | display set  &#xA;set routing-instances PATH-1 instance-type forwarding&#xA;set routing-instances PATH-1 routing-options static route 10.100.30.0/24 next-hop 10.100.254.2&#xA;set routing-instances PATH-1 routing-options static route 10.100.30.0/24 qualified-next-hop 10.10.10.1 preference 100&#xA;set routing-instances PATH-2 instance-type forwarding&#xA;set routing-instances PATH-2 routing-options static route 10.100.30.0/24 next-hop 10.10.10.1&#xA;set routing-instances PATH-2 routing-options static route 10.100.30.0/24 qualified-next-hop 10.100.254.2 preference 100&#xA;&#xA;root@SW-2&amp;gt; show configuration firewall | display set             &#xA;set firewall family inet filter FBF-TEST term TERM-1 from source-address 10.100.190.0/24&#xA;set firewall family inet filter FBF-TEST term TERM-1 from source-address 10.100.191.0/24&#xA;set firewall family inet filter FBF-TEST term TERM-1 then routing-instance PATH-1&#xA;set firewall family inet filter FBF-TEST term DEFAULT then routing-instance PATH-2&#xA;&#xA;root@SW-2&amp;gt; show configuration protocols | display set   &#xA;set protocols ospf export ADVERTISED&#xA;set protocols ospf area 0.0.0.0 interface ge-0/0/0.0 interface-type p2p&#xA;set protocols ospf area 0.0.0.0 interface vlan.2 passive&#xA;set protocols ospf area 0.0.0.0 interface vlan.251 passive&#xA;set protocols ospf area 0.0.0.0 interface vlan.254 priority 250&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2686" LastEditorUserId="2686" LastEditDate="2013-09-18T13:31:05.183" LastActivityDate="2013-09-20T19:17:00.587" Title="JUNIPER: Why is OSPF adjacency breaking when I enable FBF on an OSPF interface?" Tags="|ospf|juniper|pbr|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3267" PostTypeId="2" ParentId="3054" CreationDate="2013-09-17T19:19:07.843" Score="1" Body="&lt;p&gt;Packet size is defined by the OS (in general), and is related to buffers, amount of data provided by the application, etc. Many strategies can be used to achieve maximum performance, and sometimes send smaller packets can be faster than waiting to create a bigger packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes the amount of apps running can demand the OS to be faster (send whatever it has in the buffer so far) instead of saturating the buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps, you could give us more detail about the scenario you were working with (ex.: server OS, apps running on it).&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-09-17T19:19:07.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3268" PostTypeId="2" ParentId="3263" CreationDate="2013-09-17T19:27:53.683" Score="3" Body="&lt;p&gt;Each VLAN can be viewed as an independent LAN, without connections to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If one device from one VLAN needs to communicate with a device of any other VLAN, you'll need routing among the VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be done by a layer-3 switch (and I think yours doesn't support it), or by using any external router.&lt;/p&gt;&#xA;" OwnerUserId="145" LastActivityDate="2013-09-17T19:27:53.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3269" PostTypeId="2" ParentId="3246" CreationDate="2013-09-17T19:43:57.727" Score="5" Body="&lt;p&gt;&lt;a href=&quot;http://www.tcl.tk/man/expect5.31/expect.1.html&quot; rel=&quot;noreferrer&quot;&gt;Expect&lt;/a&gt; may be a good candidate to consider for the job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is an example template I've put together that is commented out for you to play with. It will log into a WLC, grab the running configuration and append it to a file of your choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The example file name and location is &lt;code&gt;/var/log/script-log/config-log.txt&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need to modify the file name and location to a file of your choice (with adequate permissions) as well as the username, password and IP address of your WLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally you can edit your crontab to execute the backup script using a desired interval.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Crontab example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;# Run configuration backup every night at midnight&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;0 0 * * * /path/to/script/script-name&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration backup script example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/expect&#xA;&#xA;set timeout 15&#xA;&#xA;set user &quot;username-here&quot;&#xA;set password &quot;password-here&quot;&#xA;set ipaddress1 &quot;ip-address-here&quot;&#xA;&#xA;&#xA;# Store the current date in 'date' and add header to log for appending separation&#xA;&#xA;catch { exec sh -c { date } } date&#xA;set env(date) &quot;$date&quot;&#xA;exec sh -c {&#xA;             {&#xA;               echo -e &quot;\n\n===================================================&quot;&#xA;               echo -e &quot;= WLC Configuration - $date&quot;&#xA;               echo -e &quot;===================================================\n\n&quot;&#xA;             } &amp;gt;&amp;gt;/var/log/script-log/config-log.txt&#xA;}&#xA;&#xA;# Log to the log.txt file and append to the log on subsequent runs (a)&#xA;&#xA;set log [open &quot;/var/log/script-log/config-log.txt&quot; a]&#xA;set accum {}&#xA;&#xA;# Expect diagnostic information with 1 | off = 0&#xA;&#xA;exp_internal 0&#xA;&#xA;# View stdout with 1 | off = 0&#xA;&#xA;log_user 0&#xA;&#xA;# Connect to physical WLC (ipaddr) with ssh&#xA;&#xA;spawn ssh $ipaddress1&#xA;match_max 100000&#xA;sleep 1&#xA;&#xA;match_max [expr 32 * 1024]&#xA;while 1  {&#xA;      expect {&#xA;        &quot;no)?&quot; {send &quot;yes\r&quot;}&#xA;        &quot;n as:*&quot; {send &quot;$user\r&quot;}&#xA;        &quot;ser:*&quot; {send &quot;$user\r&quot;}&#xA;        &quot;assword:*&quot; {send &quot;$password\r&quot;}&#xA;        &quot;r) &amp;gt;&quot;             {break}&#xA;        &quot;denied&quot;        {send_user &quot;Can't login\r&quot;; exit 1}&#xA;        &quot;refused&quot;       {send_user &quot;Connection refused\r&quot;; exit 2}&#xA;        &quot;failed&quot;        {send_user &quot;Host exists. Check ssh_hosts file\r&quot;; exit 3}&#xA;         timeout         {send_user &quot;Timeout problem\r&quot;; exit 4}&#xA;      }&#xA;    }&#xA;&#xA;# send carriage return (\r) to make sure we get back to CLI prompt&#xA;&#xA;send &quot;\r&quot;&#xA;sleep 1&#xA;&#xA;# Remove scroll limit and show running configuration&#xA;&#xA;send &quot;config paging disable\r&quot;&#xA;sleep 1&#xA;send &quot;show run-config\r&quot;&#xA;sleep 1&#xA;expect {&#xA;         &quot;nue...&quot; {send &quot;\r&quot;}&#xA;}&#xA;sleep 1&#xA;send &quot;logout\r&quot;&#xA;sleep 1&#xA;# Upon logging out you can either save any pending changes with y or simply use n to ignore them&#xA;send &quot;y\r&quot;&#xA;sleep 4&#xA;&#xA;# Grab string that matched the greedy regexp&#xA;&#xA;expect {&#xA;        -regexp {..*} {&#xA;            set accum &quot;${accum}$expect_out(0,string)&quot;&#xA;            exp_continue&#xA;        }&#xA;    }&#xA;&#xA;puts $log $accum&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2476" LastActivityDate="2013-09-17T19:43:57.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3270" PostTypeId="2" ParentId="3263" CreationDate="2013-09-17T20:08:53.293" Score="1" Body="&lt;p&gt;As legioxi mentioned:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to have proper segmentation. If your switch does not do L3, consider a router on a stick approach. LAN interface of router would connect to switch port set up as a trunk. Configure sub-interfaces on the router for each VLAN and DOT1Q tag the traffic. Only trunk the necessary vlans from the switch that you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point you should be able to implement ACL's to permit/block traffic from hosts in one VLAN to another.&lt;/p&gt;&#xA;" OwnerUserId="2686" LastActivityDate="2013-09-17T20:08:53.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3271" PostTypeId="2" ParentId="3112" CreationDate="2013-09-17T22:29:55.937" Score="6" Body="&lt;p&gt;L7 awareness is the big differentiator. The canonical example everyone gives is allowing Facebook news feeds but blocking Facebook games. A conventional firewall like the ASA that just blocks or allows port 80 or 443 can't do that. There are lots of other examples, such as allowing certain URLs, allowing Google Chat but blocking video transfer, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Palo Alto was very early in this market if not the first. There are also other application-aware firewalls shipping from Check Point, Dell/Sonicwall, and Fortinet, and this list is surely incomplete.&lt;/p&gt;&#xA;" OwnerUserId="2688" LastActivityDate="2013-09-17T22:29:55.937" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3274" PostTypeId="1" AcceptedAnswerId="3275" CreationDate="2013-09-18T11:58:20.557" Score="8" ViewCount="7167" Body="&lt;p&gt;I know how to use both SPAN and RSPAN. If I'm not wrong, ERSPAN leads us to the possibility of remotely monitoring a router through an IP network and a GRE tunnel. However a tunnel end-point is needed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, is it possible for the tunnel endpoint to be a desktop computer to receive the mirrored traffic? I'm mostly looking for an OpenSource/Freware solution, since I guess a proprietary one would involve VMWare Vswitch or Nexus1000V.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dynamips could be a solution, but I don't think any routers support ERSPAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know about &lt;a href=&quot;http://openvswitch.org/&quot; rel=&quot;noreferrer&quot;&gt;OpenVswitch&lt;/a&gt;, but it does not support ERSPAN.&lt;/p&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="775" LastEditDate="2014-05-01T11:59:18.360" LastActivityDate="2019-05-25T22:51:16.317" Title="Remote sniffing with ERSPAN to the desktop" Tags="|cisco|ethernet|monitoring|cisco-7600|mirror|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3275" PostTypeId="2" ParentId="3274" CreationDate="2013-09-18T12:21:06.020" Score="9" Body="&lt;p&gt;There are a couple of options, depending on how much traffic you will receive:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you're going to receive a lot of traffic, should use &lt;a href=&quot;http://staff.washington.edu/corey/gulp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;gulp&lt;/a&gt;, which runs on linux; &lt;a href=&quot;http://staff.washington.edu/corey/gulp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;gulp&lt;/a&gt; requires the linux &lt;a href=&quot;http://www.ntop.org/products/pf_ring/&quot; rel=&quot;nofollow noreferrer&quot;&gt;pf_ring&lt;/a&gt; kernel module.&lt;/li&gt;&#xA;&lt;li&gt;If the bandwidth requirements are reasonable, you could simply use your laptop with &lt;a href=&quot;https://www.wireshark.org/lists/wireshark-bugs/201009/msg00508.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;wireshark's ERSPAN decoder&lt;/a&gt;; wireshark can see the protocols inside &lt;a href=&quot;https://supportforums.cisco.com/document/139236/understanding-spanrspanand-erspan&quot; rel=&quot;nofollow noreferrer&quot;&gt;ERSPAN&lt;/a&gt; v2 and v3 packets.  Use &lt;code&gt;ip proto 0x2f&lt;/code&gt; as your capture filter, if you want to only capture ERSPAN traffic.  I use the wireshark to capture &lt;a href=&quot;https://supportforums.cisco.com/document/139236/understanding-spanrspanand-erspan&quot; rel=&quot;nofollow noreferrer&quot;&gt;ERSPAN&lt;/a&gt; from Catalyst6500 user ports when I need to remotely sniff a port without walking up to the switch with a laptop.  This works well for user ports and even some server ports (as long as they aren't sending tons of traffic)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Example Cat6500 ERSPAN config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;monitor session 2 type erspan-source&#xA; source interface GigabitEthernet7/22&#xA; destination&#xA;  erspan-id 1&#xA;  ! This is the ip address of gulp, or the wireshark laptop&#xA;  !    If using wireshark, capture with &quot;ip proto 0x2f&quot;&#xA;  ip address 10.1.1.5&#xA;  ! This is the IP address of the switch sourcing ERSPAN packets&#xA;  origin ip address 10.21.4.12&#xA; no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example Nexus9000 ERSPAN config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;monitor session 1 type erspan-source&#xA;  erspan-id 1&#xA;  ! Specify the vrf that ERSPAN will use to route to the destination IP&#xA;  !  NOTE: I have not found a way to use &quot;vrf management&quot; on the 9000 series&#xA;  vrf default&#xA;  ! This is the ip address of gulp, or the wireshark laptop&#xA;  !    If using wireshark, capture with &quot;ip proto 0x2f&quot;&#xA;  destination ip 10.5.69.226&#xA;  source interface port-channel1001 both&#xA;  no shut&#xA;&#xA;! This is the IP address of the switch sourcing ERSPAN packets&#xA;monitor erspan origin ip-address 172.16.12.80 global&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2019-05-25T22:51:16.317" LastActivityDate="2019-05-25T22:51:16.317" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="3276" PostTypeId="1" AcceptedAnswerId="3279" CreationDate="2013-09-18T13:15:50.990" Score="3" ViewCount="1973" Body="&lt;p&gt;After a look at an intrusion detection system, I saw the following statement :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;The IDS is able to analyse 10.000 characters (from packets) in 0.17ms&quot; and I wanted to know the throughput in Gbps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I came up with the following solution but I would like someone to tell me if I do something wrong here.  (the 8 comes from the fact that 1char = 8 bit)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5LyTl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This actually gives me :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QFUiV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I have 0.438269447 in Gbps ?  but I was confused looking at this &lt;a href=&quot;http://www.convertunits.com/from/Gbps/to/GB/s&quot; rel=&quot;nofollow noreferrer&quot;&gt;website&lt;/a&gt;, does that mean my answer is in Gbps or GB/s &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(and does this mean, that the IDS is able to analyse almost half of the packets sent on a 1Gbps NIC) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you. &lt;/p&gt;&#xA;" OwnerUserId="2695" LastEditorUserId="2695" LastEditDate="2013-09-18T13:56:40.443" LastActivityDate="2013-09-18T13:58:18.273" Title="How to Calculate Throughput in Gbps" Tags="|throughput|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3277" PostTypeId="2" ParentId="2740" CreationDate="2013-09-18T13:18:43.657" Score="0" Body="&lt;p&gt;FWIW, I have a very similar setup, SRX240 to partner's ASA 5510. Took us many hours of working with JTAC and Cisco TAC to get it working. In the end, we ended up going with Policy-Based VPN vs Route-Based. For some reason, SRX's only seems to do RB better with SRX or Screen OS devices. If you plan to on going from SRX to any other vendor, using route-based, good luck. Save yourself the time and headache and go policy based. I know it's not preferred as you will have many more lines of code in your policies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're still sticking with RB, definitely check out the Juniper SRX Forum:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forums.juniper.net/t5/SRX-Services-Gateway/ASA-to-SRX-golden-configuration/td-p/107774&quot; rel=&quot;nofollow&quot;&gt;http://forums.juniper.net/t5/SRX-Services-Gateway/ASA-to-SRX-golden-configuration/td-p/107774&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forums.juniper.net/t5/SRX-Services-Gateway/Route-Based-with-Cisco-ASA-VPN-Issue/td-p/109166&quot; rel=&quot;nofollow&quot;&gt;http://forums.juniper.net/t5/SRX-Services-Gateway/Route-Based-with-Cisco-ASA-VPN-Issue/td-p/109166&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you change your mind, here is our PB VPN config. Unfortunately I don't have ASA side since we do not manage it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security ike proposal PH1-PSK-3DES-G5-MD5-86400 authentication-method pre-shared-keys&#xA;set security ike proposal PH1-PSK-3DES-G5-MD5-86400 dh-group group5&#xA;set security ike proposal PH1-PSK-3DES-G5-MD5-86400 authentication-algorithm md5&#xA;set security ike proposal PH1-PSK-3DES-G5-MD5-86400 encryption-algorithm 3des-cbc&#xA;set security ike proposal PH1-PSK-3DES-G5-MD5-86400 lifetime-seconds 86400&#xA;set security ike policy PARTNER-1-POLICY mode main&#xA;set security ike policy PARTNER-1-POLICY proposals PH1-PSK-3DES-G5-MD5-86400&#xA;set security ike policy PARTNER-1-POLICY pre-shared-key ascii-text &quot;**************&quot;&#xA;set security ike gateway PARTNER-1-GATEWAY ike-policy PARTNER-1-POLICY&#xA;set security ike gateway PARTNER-1-GATEWAY address 1.2.3.4&#xA;set security ike gateway PARTNER-1-GATEWAY external-interface ge-0/0/0&#xA;&#xA;set security ipsec proposal PH2-Proposal-2 description &quot;Generic 8HR PH2 proposal for ESP-3DES-MD5&quot;&#xA;set security ipsec proposal PH2-Proposal-2 protocol esp&#xA;set security ipsec proposal PH2-Proposal-2 authentication-algorithm hmac-md5-96&#xA;set security ipsec proposal PH2-Proposal-2 encryption-algorithm 3des-cbc&#xA;set security ipsec proposal PH2-Proposal-2 lifetime-seconds 28800&#xA;set security ipsec policy CISCO-ASA proposals PH2-Proposal-1&#xA;set security ipsec vpn PARTNER-1-VPN ike gateway PARTNER-1-GATEWAY&#xA;set security ipsec vpn PARTNER-1-VPN ike ipsec-policy CISCO-ASA&#xA;set security ipsec vpn PARTNER-1-VPN establish-tunnels on-traffic&#xA;&#xA;set security zones security-zone untrust address-book address PARTNER-HOST-1 192.168.1.0/24&#xA;set security zones security-zone untrust address-book address PARTNER-HOST-2 10.1.0.0/22&#xA;set security zones security-zone trust address-book address HOST-5 10.22.0.32/32&#xA;&#xA;set security policies from-zone untrust to-zone trust policy untrust-to-trust-vpn-1 match source-address PARTNER-HOST-1&#xA;set security policies from-zone untrust to-zone trust policy untrust-to-trust-vpn-1 match destination-address HOST-5&#xA;set security policies from-zone untrust to-zone trust policy untrust-to-trust-vpn-1 match application any&#xA;set security policies from-zone untrust to-zone trust policy untrust-to-trust-vpn-1 then permit tunnel ipsec-vpn PARTNER-1-VPN&#xA;set security policies from-zone untrust to-zone trust policy untrust-to-trust-vpn-10 match source-address PARTNER-HOST-2&#xA;set security policies from-zone untrust to-zone trust policy untrust-to-trust-vpn-10 match destination-address HOST-5&#xA;set security policies from-zone untrust to-zone trust policy untrust-to-trust-vpn-10 match application any&#xA;set security policies from-zone untrust to-zone trust policy untrust-to-trust-vpn-10 then permit tunnel ipsec-vpn PARTNER-1-VPN&#xA;&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust-vpn-1 match source-address HOST-5&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust-vpn-1 match destination-address PARTNER-HOST-1&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust-vpn-1 match application any&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust-vpn-1 then permit tunnel ipsec-vpn PARTNER-1-VPN&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust-vpn-10 match source-address HOST-5&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust-vpn-10 match destination-address PARTNER-HOST-2&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust-vpn-10 match application any&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust-vpn-10 then permit tunnel ipsec-vpn PARTNER-1-VPN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2686" LastActivityDate="2013-09-18T13:18:43.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3279" PostTypeId="2" ParentId="3276" CreationDate="2013-09-18T13:58:18.273" Score="5" Body="&lt;p&gt;tl;dr: gigabits per second (Gbps)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your 470588235 is bits-per-second. 8 bits per character; cancels the characters unit in the numerator, leaving your bits per second overall. &quot;bps&quot; (as in, Gbps, Mbps, Kbps) means &quot;bits per second&quot;, versus the &quot;B&quot; (as in GB, MB, KB) meaning &quot;byte(s)&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;G&quot; prefix normally means the metric &quot;giga&quot;, which is 1,000^3 (or 10^9). So you would -- as you've shown -- shift the decimal nine spots. Giving you about 0.4Gbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the kilo, mega, giga, etc concepts can also be used in a binary (base-2 math) context. That is written as &quot;Ki&quot; (meaning x1024, instead of &quot;K&quot; meaning x1,000), &quot;Mi&quot; meaning x1024^2 (instead of M meaning x1,000^2.)&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2013-09-18T13:58:18.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3281" PostTypeId="1" CreationDate="2013-09-18T19:14:34.190" Score="0" ViewCount="9579" Body="&lt;p&gt;I'm trying to configure a Sonicwall TZ-205 N to have 2 wireless networks. The first wireless network is a guest network which only has access to the internet (client isolation would be nice but is not a requirement). The second wireless network is a hidden network that has access to the internet as well as other devices on the LAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can this all be accomplished with a single device or will I need to purchase a second sonicwall wireless device?&lt;/p&gt;&#xA;" OwnerUserId="2701" LastActivityDate="2017-08-03T20:25:45.780" Title="Configure a Guest network on a Sonicwall TZ-205 N" Tags="|wireless|router|sonicwall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3284" PostTypeId="1" CreationDate="2013-09-18T21:43:16.283" Score="5" ViewCount="435" Body="&lt;p&gt;I am planning on replacing our pair of Noka IP560s running CheckPoint. I need to size the replacement accurately so i need to see the maximum throughput the Firewall has ever had to deal with. I can look in SmartView Monitor and get the current throughput but is there a &quot;high water mark&quot; option?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Nokias are running Check Point R71 and SmartView Mointor is 75.20. Thoughts? &lt;/p&gt;&#xA;" OwnerUserId="2703" LastActivityDate="2013-11-22T12:18:50.573" Title="Monitor Throughput on Nokia IP560" Tags="|throughput|checkpoint|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3285" PostTypeId="2" ParentId="3281" CreationDate="2013-09-18T22:27:49.893" Score="1" Body="&lt;p&gt;One option with the sonicwall enhanced os for the TZ-205 would be setting up wireless guest services (&lt;a href=&quot;http://www.sonicwall.com/us/en/support/2213.html?fuzeurl=http://www.fuzeqna.com/sonicwallkb/ext/kbdetail.aspx?kbid=4955&quot; rel=&quot;nofollow&quot;&gt;http://www.sonicwall.com/us/en/support/2213.html?fuzeurl=http://www.fuzeqna.com/sonicwallkb/ext/kbdetail.aspx?kbid=4955&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise I think you may be able to setup new wireless profile and virtual access point. Then manually prevent access from it to your LAN zone with firewall rules.&lt;/p&gt;&#xA;" OwnerUserId="499" LastActivityDate="2013-09-18T22:27:49.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3289" PostTypeId="1" CreationDate="2013-09-19T08:48:45.213" Score="1" ViewCount="698" Body="&lt;p&gt;I am studying the evolution of mobile network technologies and trying to get a clear overview of the UMTS network achitecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I found it hard to decide which release of UMTS is considered its &quot;latest&quot; and more appropriate to work on. By &quot;appropriate&quot; I mean most commonly deployed and/or usually studied by people that want to gain an understanding of UMTS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it Release 99, in which UMTS is introduced?&#xA;Or maybe Release 7, the last one before LTE?&#xA;Or, maybe another release?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, is it a good idea to think of HSPA(+), simply as an enhanced version of UMTS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, when looking for a clear overview of what changed in the architecture between the releases the information was poor. Of course, there is always the 3GPP specifications webpage but I found it hard to follow, as a rookie.&lt;/p&gt;&#xA;" OwnerUserId="2707" LastEditorUserId="56030" LastEditDate="2020-06-20T12:29:23.457" LastActivityDate="2020-06-20T12:29:23.457" Title="UMTS Architecture and differences between releases" Tags="|mobile|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3290" PostTypeId="1" AcceptedAnswerId="5383" CreationDate="2013-09-19T09:17:59.327" Score="7" ViewCount="1334" Body="&lt;p&gt;I have strange issue with HP ProCurve J8692A 3500yl-24G.&#xA;If I display MACs on port I see it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3500(config)# sh mac 10 | inc 5cf3fc-a53456&#xA;5cf3fc-a53456&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if I try to find where is this MAC then I have no luck:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config)# sh mac 5cf3fc-a53456&#xA; Status and Counters - Address Table - 5cf3fc-a53456 &#xA;MAC address 5cf3fc-a53456 not found.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas where can be the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edited:&#xA;I test another MAC:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3500# sh mac 003048-33d8f6&#xA;&#xA; Status and Counters - Address Table - 003048-33d8f6&#xA;&#xA;MAC address 003048-33d8f6 not found.&#xA;3500# sh mac | inc 003048-33d8f6&#xA;  003048-33d8f6 5&#xA;3500#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so this not looks as MAC, config mode or port issue.&#xA;Also:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MAC addr count#                1241       1257       1248       1449       1391&#xA;                     Low          *          *       1229       1222       1219&#xA;                    High          *          *       1266       1897       1897&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this switch have much larger (AFAIR 64k) MAC address table size, so it not looks like full MAC address table issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS.&#xA;It run on bit old K.14.41 software. I check &lt;a href=&quot;http://h20565.www2.hp.com/portal/site/hpsc/template.BINARYPORTLET/public/kb/docDisplay/resource.process/?spf_p.tpst=kbDocDisplay_ws_BI&amp;amp;spf_p.rid_kbDocDisplay=docDisplayResURL&amp;amp;javax.portlet.begCacheTok=com.vignette.cachetoken&amp;amp;spf_p.rst_kbDocDisplay=wsrp-resourceState=docId%253Demr_na-c03790791-1%257CdocLocale%253D&amp;amp;javax.portlet.endCacheTok=com.vignette.cachetoken&quot; rel=&quot;nofollow&quot;&gt;Release notes&lt;/a&gt; for K.14 series, but I don't see similar problem resolved in any next release.&lt;/p&gt;&#xA;" OwnerUserId="150" LastEditorUserId="150" LastEditDate="2013-10-12T08:11:53.940" LastActivityDate="2013-12-09T22:10:38.220" Title="HP Procurve 3500 with K.14 - strange MAC search issue" Tags="|hp|hp-procurve|mac-address|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3291" PostTypeId="1" CreationDate="2013-09-19T11:35:31.503" Score="4" ViewCount="591" Body="&lt;p&gt;What is Meant by RFC 4541 when it says...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;4) All non-IPv4 multicast packets should continue to be flooded out to all remaining ports in the forwarding state as per normal IEEE bridging operations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerDisplayName="user190627" LastEditorUserId="8499" LastEditDate="2018-12-26T04:31:35.790" LastActivityDate="2018-12-26T04:31:35.790" Title="IGMP snooping (Bridge operation)" Tags="|switch|ipv4|protocol-theory|multicast|rfc|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3292" PostTypeId="2" ParentId="3291" CreationDate="2013-09-19T13:00:37.023" Score="3" Body="&lt;p&gt;This part of the RFC discusses what should happen to ipv6 multicasts (or any other ethernet multicast mac address) that might share the same mac address with the ipv4 multicast IGMP join received by the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Section 1 makes this clear...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note that the IGMP snooping function should apply only to IPv4 multicasts. Other multicast packets, such as IPv6, might be suppressed by IGMP snooping if additional care is not taken in the implementation as mentioned in the recommendations section. It is desired not to restrict the flow of non-IPv4 multicasts other than to the degree which would happen as a result of regular bridging functions. Likewise, MLD snooping switches are discouraged from using topological information learned from IPv6 traffic to alter the forwarding of IPv4 multicast packets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-09-19T13:00:37.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3295" PostTypeId="1" AcceptedAnswerId="3307" CreationDate="2013-09-19T15:02:22.857" Score="6" ViewCount="316" Body="&lt;p&gt;I was wandering if there are any CISCO routers and firmware for purchase or download for developers so I could test my implementations on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am developing a firmware plugin to increase security on dual stack methodologies. Therefore i need a router that would grant me access to its firmware so that i could alter it to plugin my solution :) &lt;/p&gt;&#xA;" OwnerUserId="2563" LastEditorUserId="775" LastEditDate="2013-09-20T17:05:37.807" LastActivityDate="2013-09-20T17:05:37.807" Title="CISCO developer routers/ firmware" Tags="|cisco|router|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3298" PostTypeId="1" AcceptedAnswerId="3310" CreationDate="2013-09-20T08:15:23.793" Score="2" ViewCount="5350" Body="&lt;p&gt;Please explain: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two routers with QoS on them.. Both WAN-facing interfaces have a bandwidth command with the same value (100000) but the priority queue (also the other reservations) calculates a different amount of kbps for this queue? I would think that when the bandwidth is the same the calculated result of kbps per queue should be the same?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fist router (lets call it router a) is at the main office and has a multi-point connection to 3 other routers at branch offices. The real bandwidth at the main office is 300Mbit and at the branches its 100Mbit. I made a HQos script to shape the bandwidth &#xA;at the main to 100mbit per site (parent) and then the QoS queues (child). I put the bandwidth on the main to 100Mbit to make sure it would calculate the bandwidth (all in percentages) in the correct way (e.g. 100mbit per site). I know i could use a strict amount of bandwidth but I wonder why this is not functioning the way I think it should..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;main router (A):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description WAN&#xA; bandwidth 100000&#xA; ip address 172.16.2.1 255.255.255.0&#xA; ip flow ingress&#xA; ip flow egress&#xA; ip ospf message-digest-key 1 md5 7 &#xA; duplex full&#xA; speed 1000&#xA; service-policy output 300Mb-forward-qos&#xA;end&#xA;&#xA;&#xA;&#xA;Service-policy output: 300Mb-forward-qos&#xA;&#xA;Class-map: site1-100Mb-forward-qos (match-all)&#xA;  97350980 packets, 60719394859 bytes&#xA;  5 minute offered rate 1891000 bps, drop rate 0 bps&#xA;  Match: access-group name site1&#xA;  Queueing&#xA;  queue limit 64 packets&#xA;  (queue depth/total drops/no-buffer drops) 0/864/0&#xA;  (pkts output/bytes output) 97350116/60718176568&#xA;  shape (peak) cir 97000000, bc 388000, be 388000&#xA;  target shape rate 194000000&#xA;&#xA;  Service-policy : forward-qos&#xA;&#xA;    queue stats for all priority classes:&#xA;&#xA;      queue limit 64 packets&#xA;      (queue depth/total drops/no-buffer drops) 0/0/0&#xA;      (pkts output/bytes output) 148794/7659376&#xA;&#xA;    Class-map: forward-qos-class-prec5 (match-all)&#xA;      148794 packets, 7659376 bytes&#xA;      5 minute offered rate 0 bps, drop rate 0 bps&#xA;      Match: ip precedence 5&#xA;      Priority: 10% (2500 kbps), burst bytes 62500, b/w exceed drops: 0&#xA;      !^^^^^^^^^^^^^^^^^^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router at branch (B)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description WAN&#xA; bandwidth 100000&#xA; ! ^^^^^^^^^^^^^^&#xA; ip address 172.16.2.4 255.255.255.0&#xA; ip ospf message-digest-key 1 md5 7 12480603150C02573E&#xA; duplex auto&#xA; speed auto&#xA; service-policy output 100Mb-forward-qos&#xA;end&#xA;&#xA;&#xA;&#xA;  Service-policy : forward-qos&#xA;&#xA;    queue stats for all priority classes:&#xA;&#xA;      queue limit 64 packets&#xA;      (queue depth/total drops/no-buffer drops) 0/0/0&#xA;      (pkts output/bytes output) 3873239/716718654&#xA;&#xA;    Class-map: forward-qos-class-prec5 (match-all)&#xA;      3873238 packets, 716718440 bytes&#xA;      5 minute offered rate 123000 bps, drop rate 0 bps&#xA;      Match: ip precedence 5&#xA;      Priority: 10% (5000 kbps), burst bytes 125000, b/w exceed drops: 0&#xA;      !^^^^^^^^^^^^^^^^^^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="209" LastEditorUserId="1395" LastEditDate="2013-10-25T16:52:50.563" LastActivityDate="2013-10-25T16:52:50.563" Title="QoS bandwith calculation" Tags="|cisco|qos|bandwidth|h-qos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3299" PostTypeId="2" ParentId="3291" CreationDate="2013-09-20T09:35:16.237" Score="-1" Body="&lt;p&gt;IGMP snooping is a feature that lets a switch save bandwidth by only sending multicast packets to downstream ports where some client has asked for the multicast stream; by default, a layer-2 switch would need to send Ethernet multicast frames out all downstream ports, even the ones where nobody cared about the stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That line in the RFC explains that if a switch uses IGMP snooping, it has to be careful to only filter out unwanted Ethernet frames that contain IPv4 multicast packets, not all Ethernet multicast frames, since some other layer-3 protocol that uses Ethernet multicast (like IPv6 multicast) might get filtered out incorrectly.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-09-20T09:35:16.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3303" PostTypeId="1" AcceptedAnswerId="3306" CreationDate="2013-09-20T12:13:03.833" Score="5" ViewCount="4948" Body="&lt;p&gt;I have a Cisco switch who have an user configured with &lt;strong&gt;privilege&lt;/strong&gt; level 3 configured as below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! the user can configure an interface &#xA;privilege configure level 3 interface&#xA;privilege exec level 3 configure terminal&#xA;privilege exec level 3 configure&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wonder how can I get him the privilege to execute the following command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the goal :  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy run tftp:XXX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;by curiosity :   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show run               &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT: I found the answer for the first &lt;strong&gt;copy run tftp:XXX&lt;/strong&gt; add the following command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;privilege exec level 3 copy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If anyone know how to view the &lt;strong&gt;show run&lt;/strong&gt; will be great. &lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2013-09-20T12:25:56.070" LastActivityDate="2013-09-23T07:39:19.787" Title="Privilege configuration on cisco switch" Tags="|cisco|cisco-ios|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3306" PostTypeId="2" ParentId="3303" CreationDate="2013-09-20T12:55:44.783" Score="6" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800949d5.shtml&quot;&gt;http://www.cisco.com/en/US/tech/tk59/technologies_tech_note09186a00800949d5.shtml&lt;/a&gt; probably answers your question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;privilege exec level 3 show running &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-09-20T12:55:44.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3307" PostTypeId="2" ParentId="3295" CreationDate="2013-09-20T15:41:40.697" Score="9" Body="&lt;p&gt;I think the best you could do is to look for Cisco ONE programming kit. Otherwise, as Brett said, Cisco does not provide access to its software. Via ONE programming kit, Cisco would be providing APIs to program the router in some of the new releases. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some links: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/web/solutions/trends/open_network_environment/index.html&quot;&gt;http://www.cisco.com/web/solutions/trends/open_network_environment/index.html&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/prod/iosswrel/onepk.html&quot;&gt;http://www.cisco.com/en/US/prod/iosswrel/onepk.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will have to check which releases would support ONE pk. &lt;/p&gt;&#xA;" OwnerUserId="2450" LastEditorUserId="2450" LastEditDate="2013-09-20T16:05:47.203" LastActivityDate="2013-09-20T16:05:47.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3308" PostTypeId="2" ParentId="3303" CreationDate="2013-09-20T16:05:05.573" Score="1" Body="&lt;p&gt;Thanks to @Teun Vink for finding the link that addresses this point. If you carefully read the document, you will find that merely adding the &lt;em&gt;privilege exec level 3 show running&lt;/em&gt; command will not allow the user to see very much of the actual configuration. Cisco limits the amount of the config that you can see based on your privilege level, and the commands available at that level, for security purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you grant the user &lt;em&gt;privilege exec level 3 show config&lt;/em&gt; , he/she will be permitted to view the last configuration that was saved to memory, which may differ from the current running-config.&lt;/p&gt;&#xA;" OwnerUserId="2375" LastActivityDate="2013-09-20T16:05:05.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3309" PostTypeId="1" CreationDate="2013-09-20T16:57:25.700" Score="5" ViewCount="15701" Body="&lt;p&gt;Trying to get my head round how best to achieve the above&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In essence we have s speed test server that is available in the CPE's global routing table , that we would like the customer in VRF X to test against , however due to the &#xA;fact  that customer X is using RFC1918 in their VRF we want to nat all LAN traffic destined to the speed server only via the WAN address ( with is public)  located in global table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CPE's are ISR (881,19x1,29x1) running 15.1.4M6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also due to the fact that we want to use this to test the speed to the broadband circuit I would if possible like to reduce the Nat effect on the cpu , but that’s is not the primary objective. in summary I am looking for a way to share the server with numerous mpls VRF that have overlapping RFC1918 addressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is this on the right track ? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list &amp;lt;ACL_LAN&amp;gt; interface &amp;lt;WAN_INT&amp;gt; vrf &amp;lt;vrf-name&amp;gt; overload&#xA;ip route vrf &amp;lt;vrf-name&amp;gt;  &amp;lt;server-ip&amp;gt; 255.255.255.255 &amp;lt;Global-WAN-nexthop&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="1092" LastEditDate="2013-09-30T08:59:07.940" LastActivityDate="2013-09-30T10:00:40.187" Title="IOS - Nat from a VRF to WAN interface in global routing table" Tags="|nat|vrf|cisco-ios|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3310" PostTypeId="2" ParentId="3298" CreationDate="2013-09-20T19:14:25.710" Score="5" Body="&lt;p&gt;There is no need to put a bandwidth statement on the router (A) interface. If you're doing H-QoS then you shape to 100Mb on the parent, while the child policies then inherit that shaped value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map parent&#xA; class class-default&#xA;  shape average 100m&#xA;  service-policy child&#xA;&#xA;policy-map child&#xA; class EF&#xA;  priority percent 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you put bandwidth statement on the physical interface you mess up the H-QoS calculation. It's fine for the branches as they are not running H-QoS&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-09-20T19:14:25.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3311" PostTypeId="2" ParentId="3266" CreationDate="2013-09-20T19:17:00.587" Score="4" Body="&lt;p&gt;So, after working with JTAC yesterday, &quot;I&quot;, as in I really didn't need JTAC since I figured out the issue on my own.. realized that my firewall filter was a bit redundant and was lacking a &quot;permit any&quot; statement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF adjacency was breaking because the firewall filter was taking the &quot;else&quot; traffic (term DEFAULT) and sending it to routing-instance PATH-2, which didn't help either way since it was sending traffic right back to SW-2, something a &quot;then accept&quot; statement would have done easily&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to repair the issue..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;New SW-2 &amp;amp; RTR-2 corrected configlets:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;delete routing-instances PATH-2&#xA;delete firewall family inet filter FBF-TEST term DEFAULT&#xA;set firewall family inet filter FBF-TEST term PERMIT-ANY then accept&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;New config snips for SW-2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routing-options {&#xA;    nonstop-routing;&#xA;    interface-routes {&#xA;        rib-group inet STAGING-RIB;&#xA;    }&#xA;    static {&#xA;        route 10.100.190.0/24 next-hop 10.100.100.2;&#xA;        route 10.100.191.0/24 next-hop 10.100.100.2;&#xA;    }&#xA;    rib-groups {&#xA;        STAGING-RIB {&#xA;            import-rib [ inet.0 PATH-1.inet.0 ];&#xA;        }&#xA;    }&#xA;    router-id 10.100.254.1;&#xA;}&#xA;firewall {&#xA;    family inet {&#xA;        filter FBF-TEST {&#xA;            term TERM-1 {&#xA;                from {&#xA;                    source-address {&#xA;                        10.100.190.0/24;&#xA;                        10.100.191.0/24;&#xA;                    }&#xA;                }&#xA;                then {&#xA;                    routing-instance PATH-1;&#xA;                }&#xA;            }&#xA;            term PERMIT-ANY {&#xA;                then accept;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-instances {&#xA;    PATH-1 {&#xA;        instance-type forwarding;&#xA;        routing-options {&#xA;            static {&#xA;                route 10.100.30.0/24 {&#xA;                    next-hop 10.100.254.2;&#xA;                    qualified-next-hop 10.10.10.1 {&#xA;                        preference 100;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;New config snips for RTR-2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routing-options {&#xA;    interface-routes {&#xA;        rib-group inet STAGING-RIB;&#xA;    }&#xA;    rib-groups {&#xA;        STAGING-RIB {&#xA;            import-rib [ inet.0 PATH-1.inet.0 ];&#xA;        }&#xA;    }&#xA;    router-id 200.200.200.2;&#xA;    autonomous-system 1;&#xA;}&#xA;firewall {&#xA;    family inet {&#xA;        filter FBF-TEST {&#xA;            term TERM-1 {&#xA;                from {&#xA;                    source-address {&#xA;                        10.100.190.0/24;&#xA;                        10.100.191.0/24;&#xA;                    }&#xA;                }&#xA;                then {&#xA;                    routing-instance PATH-1;&#xA;                }&#xA;            }&#xA;            term PERMIT-ANY {&#xA;                then accept;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-instances {&#xA;    PATH-1 {&#xA;        instance-type forwarding;&#xA;        routing-options {&#xA;            static {&#xA;                route 10.100.30.0/24 {&#xA;                    next-hop 200.200.200.1;&#xA;                    qualified-next-hop 10.100.254.1 {&#xA;                        preference 100;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2686" LastActivityDate="2013-09-20T19:17:00.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3312" PostTypeId="2" ParentId="58" CreationDate="2013-09-20T21:02:04.787" Score="2" Body="&lt;p&gt;As a follow-up on this question I've been working with Cisco TAC on this for over a year.  They've finally identified that this is a bug with the way the ASA platform handles connections.  essentially it wasn't clearing connections from one interface when it moved the tunnel to the other interface and it would spiral out of control as it started to see entries in the connection table out both interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've deployed IOS version 8.4.7 on the firewall with two ISPs and it actually appears to be behaving properly.  Failover is happening when the primary interface goes down, and then moving back when that interface comes back AND remaining on that interface.  We'll see.&lt;/p&gt;&#xA;" OwnerUserId="142" LastActivityDate="2013-09-20T21:02:04.787" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3313" PostTypeId="1" AcceptedAnswerId="3395" CreationDate="2013-09-21T00:21:01.580" Score="10" ViewCount="3523" Body="&lt;p&gt;&lt;em&gt;The issue&lt;/em&gt;: CCI (Co-channel Interference) on 2.4GHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The Environment&lt;/em&gt;: 40 seats per classroom. Higher-ed, so extremely mixed client base.&#xA;AP-on-a-stick set to 24Mb lowest Mandatory data rate &amp;amp; lowest Tx power setting (2 dBm)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The Problem&lt;/em&gt;: Needing to disable 2.4GHz radio's to achieve the required density does not seem optimal. Am I going about this wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The plan&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used the following formula for AP density and number of radios:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;TTc = Target TCP/UDP Throughput, per client&lt;/li&gt;&#xA;&lt;li&gt;TCc = Throughput Capabilities of client&lt;/li&gt;&#xA;&lt;li&gt;CUm = Maximum realistic Channel Utilization&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;c   = Number of clients&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TTc / TCc / CUm * c = # of Radios&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;At 40 seats per classroom, assuming each student has a laptop and a smartphone or tablet, with a target throughput of 3Mbps for laptops &amp;amp; 1Mbps for smartphone/tablets:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Laptops: 3Mbps / 150 / .8 * 40 = 1&lt;/li&gt;&#xA;&lt;li&gt;Smartphone/Tablet: 1Mbps / 30 / .8 * 40 = 1.6&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Total radios needed per classroom = 2.6. Each AP having 2 radios, this brings me to 1 AP per classroom; if rounding down. All classrooms are in use, and fully populated every day. Current client base shows about 30% 5GHz capable, campus-wide. I expect this number to increase rapidly as most clients are becoming 5GHz capable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Antenna in use: &lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/antenna/installation/guide/ant2566p4w.pdf&quot; rel=&quot;noreferrer&quot;&gt;AIR-ANT2566P4W-R (Dual-band patch)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PDF picture is result of placing the AP/Antenna at the front of classroom (facing East, or away from the hallway).  There is very little attenuation between the rooms (sheetrock walls).  This is a 3-story building, with same layout on each floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Current plan&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One AP per classroom, with patch antenna mounted facing east, for classrooms which have an exterior wall (see diagram), except using Mechanical down-tilt on first floor to reduce the signal in the rooms 'behind' the Anetanna. 2nd &amp;amp; 3rd floors have antenna mounted as drawn, w/ no downtilt. Using 20MHz 5GHz channels, and disabling some of the 2.4GHz radio's, to reduce CCI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interior classrooms will utilize same patch antenna, again using down-tilt on first floor and not on upper floors. Disabling some of the 2.4GHz radio's. If down-tilt is utilized on 2nd/3rd floors, the signal penetrates the floors too much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Options I've considered:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Purposefully creating attenuation 'behind' the antenna (mesh on wall, RF blocking paint etc.) to reduce the signal 'behind').&lt;/li&gt;&#xA;&lt;li&gt;Using non-Cisco antenna, with a better front-to-back ratio, which would reduce CCI as a result of the radiation of signal 'behind'. Not sure if an equivelant one exists. Essentially, I'd benefit from a similiar radiation patter, minus the back-lobes.&lt;/li&gt;&#xA;&lt;li&gt;Using internal antenna, and just disabling more 2.4GHz radio's (ea. antenna is ~500$)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The picture represents the results of having an antenna mounted in room 222, pointing out/east/towards the exterior wall; and client RSSI readings from various locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/aU6nk.jpg&quot; alt=&quot;ap-on-a-stick_results&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2723" LastEditorUserId="775" LastEditDate="2013-09-21T11:40:10.213" LastActivityDate="2013-09-26T20:29:10.887" Title="High-Density WiFi &amp; 2.4GHz Co-channel Interference design" Tags="|cisco|wireless|design|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3315" PostTypeId="1" AcceptedAnswerId="3358" CreationDate="2013-09-21T11:36:39.143" Score="8" ViewCount="25380" Body="&lt;p&gt;I want to make a script to copy the running config of a switch 4506 in one line. &#xA;So far, I see two option :  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;copy run tftp:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw#copy run tftp://10.0.0.1/cfg.cfg&#xA;Address or name of remote host [10.0.0.1]? &#xA;Destination filename [cfg.cfg]? &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cons: need confirmation, press enter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Info : I have define the &lt;code&gt;ip tftp source-interface Vlan10&lt;/code&gt; with management vlan to have connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show running-config | redirect tftp://10.0.0.1/run-R1.cfg&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw#show running-config | redirect tftp://10.0.0.1/run-R1.cfg&#xA;.....&#xA;%Error opening tftp://10.0.0.1/run-R1.cfg (Timed out)&#xA;sw#sh ip route 10.0.0.1 &#xA;% Subnet not in table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cons: the ip source of the redirect is an private IP 172.16.0.2 due this is a transit subnet. So no connectivity with the outgoing interface IP but connectivity with the managment subnet. as you can see below. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw#ping 10.0.0.1 source vlan 10    &#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:&#xA;Packet sent with a source address of 172.16.0.2 &#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;sw#ping 10.0.0.1 source vlan 11&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:&#xA;Packet sent with a source address of &amp;lt;Public_IP&amp;gt; &#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 4/6/8 ms&#xA;sw#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip tftp source-interface Vlan10&lt;/code&gt; does not help with &lt;code&gt;redirect&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions :&lt;br&gt;&#xA;- Is there the possibility of no confirmation copy with 'copy run tftp:' ?&lt;br&gt;&#xA;- How can I define for all packet sourced on switch should be sourced with a defined IP ?  &lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="775" LastEditDate="2013-09-21T12:18:48.510" LastActivityDate="2013-10-16T15:45:25.060" Title="Copy running config in one line" Tags="|cisco|switch|cisco-ios|" AnswerCount="5" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3316" PostTypeId="2" ParentId="3315" CreationDate="2013-09-21T11:45:48.623" Score="0" Body="&lt;p&gt;It might be easier to enable SCP server on the router and script the backup from the other side. Instead of trying to push it it from the router, why not pull it from the backup server? You will have greater scripting flexibility this way.&lt;/p&gt;&#xA;" OwnerUserId="1613" LastActivityDate="2013-09-21T11:45:48.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3317" PostTypeId="2" ParentId="3315" CreationDate="2013-09-21T13:48:23.283" Score="2" Body="&lt;p&gt;You can do this with FTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First you need to setup the FTP username and password:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip ftp username xxx&#xA;ip ftp password xxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then get your script to do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show run | redirect ftp://1.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IOS will then use the local username and password set up before&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-09-21T13:48:23.283" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3318" PostTypeId="1" CreationDate="2013-09-21T19:36:27.730" Score="5" ViewCount="1694" Body="&lt;p&gt;My current Setup:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Two SSIDs broadcasted&lt;/li&gt;&#xA;&lt;li&gt;SSID 1 (airlan) is configured with dot1X and dynamic vlan association&lt;/li&gt;&#xA;&lt;li&gt;SSID 2 (prv) with PSK and a static vlan&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've recognized, that every 60s the devices on the second SSID disconnected from the AP. After some investigation i found out, that 60s is the default &lt;strong&gt;activity timeout for non-aironet devices&lt;/strong&gt;. Increasing this timeout increases the interval they disconnect as expected. This seems to solve the Problem with some devices that stopped reconnecting after some hours or days. But I don't think thats an ideal solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices connected to the first SSID (airlan) never had this problem and comparing the information given by &quot;show dot11 association xxxx.xxxx.xxx&quot; reveals, that on the second SSID the &lt;strong&gt;&quot;Last Activity&quot; counter constantly increases&lt;/strong&gt; while on the first it resets when activity happens. The AP does not seem to recognize activity (whatever Cisco defines activity as). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a firmware-bug or can I do something different to solve this situation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hardware Info&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I know, that there are two newer images, but I don't have access at the moment)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;air4#show hardware&#xA;Cisco IOS Software, C1600 Software (AP1G2-K9W7-M), Version 15.2(2)JB, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2012 by Cisco Systems, Inc.&#xA;Compiled Tue 11-Dec-12 04:30 by prod_rel_team&#xA;&#xA;ROM: Bootstrap program is C1600 boot loader&#xA;BOOTLDR: C1600 Boot Loader (AP1G2-BOOT-M) LoaderVersion 15.2(2)JAX, RELEASE SOFTWARE (fc1)&#xA;&#xA;air4 uptime is 1 day, 7 hours, 16 minutes&#xA;System returned to ROM by power-on&#xA;System restarted at 14:11:45 MET-DST Fri Sep 20 2013&#xA;System image file is &quot;flash:/ap1g2-k9w7-mx.152-2.JB/ap1g2-k9w7-mx.152-2.JB&quot;&#xA;Last reload reason: &#xA;&#xA;cisco AIR-SAP1602E-E-K9    (PowerPC) processor (revision A0) with 98294K/32768K bytes of memory.&#xA;Processor board ID FGL1710ZCBU&#xA;PowerPC CPU at 533Mhz, revision number 0x2151&#xA;Last reset from power-on&#xA;1 Gigabit Ethernet interface&#xA;2 802.11 Radios&#xA;&#xA;32K bytes of flash-simulated non-volatile configuration memory.&#xA;Base ethernet MAC Address: 00:06:F6:21:XX:XX&#xA;Part Number                          : 73-14508-04&#xA;PCA Assembly Number                  : 000-00000-00&#xA;PCA Revision Number                  : &#xA;PCB Serial Number                    : &#xA;Top Assembly Part Number             : -01&#xA;Top Assembly Serial Number           : &#xA;Top Revision Number                  : &#xA;Product/Model Number                 : AIR-SAP1602E-E-K9   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Running Config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 5150 bytes&#xA;aaa session-id common&#xA;clock timezone met 1 0&#xA;&#xA;clock summer-time MET-DST recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;no ip igmp snooping&#xA;ip cef&#xA;ip name-server 10.0.1.254&#xA;!&#xA;!&#xA;dot11 syslog&#xA;dot11 activity-timeout unknown default 3000&#xA;!&#xA;dot11 ssid airlan&#xA;   vlan 5&#xA;   authentication open eap eap_methods &#xA;   authentication key-management wpa version 2&#xA;   accounting eap_acct_methods&#xA;   mbssid guest-mode&#xA;!&#xA;dot11 ssid prv&#xA;   vlan 60&#xA;   authentication open &#xA;   authentication key-management wpa version 2&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 070E274A4B07125503080E1C163C&#xA;!&#xA;!&#xA;dot11 network-map&#xA;dot11 arp-cache optional&#xA;crypto pki token default removal timeout 0&#xA;!&#xA;!&#xA;username Cisco password 7 05280F1C2243&#xA;!&#xA;!&#xA;ip ssh version 2&#xA;bridge irb&#xA;!&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; !&#xA; encryption vlan 6 mode ciphers aes-ccm &#xA; !&#xA; encryption vlan 5 mode ciphers aes-ccm &#xA; !&#xA; encryption vlan 4 mode ciphers aes-ccm &#xA; !&#xA; encryption vlan 60 mode ciphers aes-ccm &#xA; !&#xA; encryption mode ciphers aes-ccm &#xA; !&#xA; ssid airlan&#xA; !&#xA; ssid prv&#xA; !&#xA; countermeasure tkip hold-time 0&#xA; antenna gain 0&#xA; stbc&#xA; beamform ofdm&#xA; mbssid&#xA; no preamble-short&#xA; station-role root&#xA; no dot11 extension aironet&#xA; world-mode dot11d country-code DE both&#xA;!   &#xA;interface Dot11Radio0.1&#xA; encapsulation dot1Q 1 native&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.4&#xA; encapsulation dot1Q 4&#xA; bridge-group 4&#xA; bridge-group 4 subscriber-loop-control&#xA; bridge-group 4 spanning-disabled&#xA; bridge-group 4 block-unknown-source&#xA; no bridge-group 4 source-learning&#xA; no bridge-group 4 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.5&#xA; encapsulation dot1Q 5&#xA; bridge-group 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2724" LastActivityDate="2014-11-25T11:34:34.993" Title="Cisco Aironet Last Activity Counter seems not to work causing clients to drop frequently" Tags="|cisco|troubleshooting|aironet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3321" PostTypeId="1" AcceptedAnswerId="3322" CreationDate="2013-09-22T00:31:09.497" Score="8" ViewCount="31747" Body="&lt;p&gt;I have 3 simple questions:-&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is is possible to have multiple subnets behind a router? I believe it is, e.g. router LAN interface would have subnet mask 255.255.0.0 and machines connecting to the router would have subnet mask 255.255.255.0.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a usecase to have multiple subnets behind a router? I don't see any, unless anybody else can point out otherwise.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a performance benefit of having multiple subnets behind a router? Again, i don't see any. One of the uses of a subnet is to separate traffic between different set of users. However, in this case all the traffic meant for multiple subnets is ending up on the same router.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;[ADDED]&#xA;I think there some confusion due to the wording i used. Thanks for all the answers but let me rephrase the questions.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is is possible to have computers belonging to multiple subnet's connected to one router?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a usecase to have computers belonging to multiple subnet's connected to one router?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a performance benefit to have computers belonging to multiple subnet's connected to one router?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2727" LastEditorUserId="2727" LastEditDate="2013-09-23T00:39:41.970" LastActivityDate="2017-06-13T18:29:58.247" Title="Multiple sub-nets behind a router" Tags="|router|subnet|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3322" PostTypeId="2" ParentId="3321" CreationDate="2013-09-22T01:30:05.030" Score="8" Body="&lt;p&gt;1)  It is possible to have multiple subnets &quot;behind&quot; one router; the Internet would be a very broken place with millions more routers needed if it were not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, your example of using a /16 subnet mask on the LAN interface, with many /24's connecting to it, is not exactly how it would actually function.  (More on that in a moment.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2)  There are many use cases.  This aggregation and routing of traffic for many networks/ subnets is the purpose of a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take for a simple example, a branch office location with VoIP telephones.  At this site, there is a router connected via Dot1q trunking to a layer 2 access switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is, of course, a need for separation of the Voice and Data traffic, which can be achieved by using separate VLANS on the access switches.  Each VLAN will have a separate subnet back on our router.  Each subnet would terminate on its own &quot;sub interface&quot;, a logical partitioning of the physical connection to the access switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example, there are two subnets (one for data, and one for voice) living &quot;behind&quot; the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3)  The performance benefit is that you don't need a different physical device to handle the routing for every single subnet in your network. You talk about the traffic ending up on the same router, and it does, but the traffic is still separated unless you specifically allow it to move between the subnets.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-09-22T01:30:05.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3323" PostTypeId="1" AcceptedAnswerId="3324" CreationDate="2013-09-22T03:28:16.157" Score="9" ViewCount="10920" Body="&lt;p&gt;I am working on a lab right now and am having some issues with ASA routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the current network topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qzo2h.png&quot; alt=&quot;Network Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently if I login to the console on the ASA or Router I can get outside to the internet no problem. The second I login to the layer 3 switch I can only ping the inside interface of the ASA. This leads me to believe I have issues with the return routing from the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the layer 3 switch to do the intervlan routing (which it is).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This brings up a couple of questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Best practice wise - should I let the router or the ASA handle NAT (Overloading)?&lt;/li&gt;&#xA;&lt;li&gt;I can ping the 172.16.2.2 interface but not 172.16.2.1 from a pc connected to one of the layer 2 switches (proves intervlan routing is working -- i have a 172.20.100.8 address on the PC). Why can't I ping 172.16.2.1 from a PC but I can from the Layer 3 Switch?&lt;/li&gt;&#xA;&lt;li&gt;I cannot get an ip address right now from the DHCP server (windows). Any insight into why?&lt;/li&gt;&#xA;&lt;li&gt;And most of all -- Why can't I get out to the internet from the Layer 3 switch?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here are concatenated dumps of the configs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 3 Switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;version 15.1&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;service compress-config&#xA;service unsupported-transceiver&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;ip vrf mgmtVrf&#xA;!         &#xA;!         &#xA;!         &#xA;vtp mode transparent&#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!         &#xA;vlan internal allocation policy ascending&#xA;!         &#xA;vlan 3,12,100 &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;interface FastEthernet1&#xA; ip vrf forwarding mgmtVrf&#xA;no ip address&#xA; speed auto&#xA; duplex auto&#xA;!         &#xA;interface GigabitEthernet1/1&#xA; no switchport&#xA; ip address 172.16.2.2 255.255.255.224&#xA;!         &#xA;interface GigabitEthernet1/2&#xA; switchport mode trunk&#xA; shutdown &#xA;!         &#xA;interface GigabitEthernet1/3&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/4&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/5&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/6&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/7&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/8&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/9&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/10&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/11&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/12&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/13&#xA; switchport mode trunk&#xA;!         &#xA;interface GigabitEthernet1/14&#xA; shutdown &#xA;!         &#xA;interface GigabitEthernet1/15&#xA; shutdown &#xA;!         &#xA;interface GigabitEthernet1/16&#xA; shutdown &#xA;!         &#xA;interface Vlan1&#xA; no ip address&#xA;!         &#xA;interface Vlan3&#xA; ip address 172.19.3.1 255.255.255.0&#xA; ip helper-address 172.20.100.27&#xA;!     &#xA;interface Vlan12&#xA; ip address 172.19.12.1 255.255.255.240&#xA; ip helper-address 172.20.100.27&#xA;!        &#xA;interface Vlan100&#xA; ip address 172.20.100.1 255.255.255.224&#xA; ip helper-address 172.20.100.27&#xA;!         &#xA;!         &#xA;no ip http server&#xA;ip route 0.0.0.0 0.0.0.0 172.16.2.1&#xA;!         &#xA;!         &#xA;!         &#xA;!     &#xA;line con 0&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; login    &#xA;!         &#xA;end&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;ASA Version 8.6(1)2 &#xA;!&#xA;hostname ciscoasa&#xA;names&#xA;!&#xA;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 172.16.1.10 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 172.16.2.1 255.255.255.224 &#xA;!&#xA;interface GigabitEthernet0/2&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/3&#xA; shutdown     &#xA; no nameif    &#xA; no security-level&#xA; no ip address&#xA;!             &#xA;interface GigabitEthernet0/4&#xA; shutdown     &#xA; no nameif    &#xA; no security-level&#xA; no ip address&#xA;!             &#xA;interface GigabitEthernet0/5&#xA; shutdown     &#xA; no nameif    &#xA; no security-level&#xA; no ip address&#xA;!             &#xA;interface Management0/0&#xA; nameif management&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0 &#xA; management-only&#xA;&#xA;ftp mode passive&#xA;object network OBJ_GENERIC_ALL&#xA; subnet 0.0.0.0 0.0.0.0&#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu management 1500&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;no failover   &#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-66114.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;nat (inside,outside) source dynamic OBJ_GENERIC_ALL interface&#xA;route outside 0.0.0.0 0.0.0.0 172.16.1.1 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;http server enable&#xA;http 192.168.1.0 255.255.255.0 management&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart&#xA;telnet timeout 5&#xA;ssh timeout 5 &#xA;console timeout 0&#xA;dhcpd address 192.168.1.2-192.168.1.254 management&#xA;dhcpd enable management&#xA;!             &#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn        &#xA;!             &#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!             &#xA;!             &#xA;policy-map type inspect dns preset_dns_map&#xA;parameters   &#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;!             &#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;version 15.3&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;no platform punt-keepalive disable-kernel-core&#xA;!&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;vrf definition Mgmt-intf&#xA; !&#xA; address-family ipv4&#xA; exit-address-family&#xA; !&#xA; address-family ipv6&#xA; exit-address-family&#xA;!         &#xA;!         &#xA;no aaa new-model&#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;&#xA;&#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;multilink bundle-name authenticated&#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;redundancy&#xA; mode none&#xA;!         &#xA;!         &#xA;!         &#xA;ip tftp source-interface GigabitEthernet0&#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;interface GigabitEthernet0/0/0&#xA; ip address 204.28.125.74 255.255.255.252&#xA; ip nat outside&#xA; negotiation auto&#xA;!         &#xA;interface GigabitEthernet0/0/1&#xA; no ip address&#xA; shutdown &#xA; negotiation auto&#xA;!         &#xA;interface GigabitEthernet0/0/2&#xA; no ip address&#xA; shutdown &#xA; negotiation auto&#xA;!         &#xA;interface GigabitEthernet0/0/3&#xA; ip address 172.16.1.1 255.255.255.0&#xA; ip nat inside&#xA; negotiation auto&#xA;!         &#xA;interface GigabitEthernet0&#xA; vrf forwarding Mgmt-intf&#xA; no ip address&#xA; shutdown &#xA; negotiation auto&#xA;!         &#xA;ip nat inside source list 1 interface GigabitEthernet0/0/0 overload&#xA;ip forward-protocol nd&#xA;!         &#xA;no ip http server&#xA;no ip http secure-server&#xA;ip route 0.0.0.0 0.0.0.0 200.200.200.200&#xA;!         &#xA;access-list 1 permit 172.16.1.0 0.0.0.255&#xA;!         &#xA;!         &#xA;!         &#xA;control-plane&#xA;!         &#xA;!         &#xA;line con 0&#xA; logging synchronous&#xA; stopbits 1&#xA;line aux 0&#xA; stopbits 1&#xA;line vty 0 4&#xA; login    &#xA;!         &#xA;!         &#xA;end       &#xA;&lt;/pre&gt;&#xA;" OwnerUserId="1551" LastEditorUserId="8499" LastEditDate="2018-12-21T04:58:37.950" LastActivityDate="2018-12-21T04:58:37.950" Title="Cisco ASA Routing Issue" Tags="|cisco|switch|cisco-asa|firewall|layer3|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3324" PostTypeId="2" ParentId="3323" CreationDate="2013-09-22T05:36:47.967" Score="13" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Best practice wise - should I let the router or the ASA handle NAT&#xA;(Overloading)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In the most general of design best practices NAT is performed between an &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080094837.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;inside and outside network&lt;/a&gt;. NAT overloading is generally performed at the edge when there is limited public IP address space. You can learn more about NAT overloading, also known as Port Address Translation or PAT, in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2663&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2663&lt;/a&gt; (PAT is referred to as Network Address Port Translation (NAPT) in section 4.1.2).&lt;/p&gt;&#xA;&lt;p&gt;In this particular scenario you can argue that you have two inside and outside networks and will need to perform some form of NAT on both the ASA (whether that is the NAT overloading you're using now, &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-31116#TWICE-NAT-MANUAL-NAT&quot; rel=&quot;nofollow noreferrer&quot;&gt;NAT exemption&lt;/a&gt;, &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-31116#TWICE-NAT-MANUAL-NAT&quot; rel=&quot;nofollow noreferrer&quot;&gt;static NAT&lt;/a&gt;, &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-31116&quot; rel=&quot;nofollow noreferrer&quot;&gt;etc&lt;/a&gt;) and the &lt;em&gt;Cisco Router&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I can ping the &lt;code&gt;172.16.2.2&lt;/code&gt; interface but not &lt;code&gt;172.16.2.1&lt;/code&gt; from a pc&#xA;connected to one of the layer 2 switches (proves intervlan routing is&#xA;working -- i have a &lt;code&gt;172.20.100.8&lt;/code&gt; address on the PC). Why can't I ping&#xA;&lt;code&gt;172.16.2.1&lt;/code&gt; from a PC but I can from the Layer 3 Switch?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The ASA &lt;code&gt;172.16.2.2&lt;/code&gt; is receiving the ICMP echo-request but does not have a route back to &lt;code&gt;172.20.100.0/27&lt;/code&gt;. The echo-reply is actually being forwarded to the Router &lt;code&gt;172.16.1.1&lt;/code&gt; via the default route.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;And most of all -- Why can't I get out to the Internet from the Layer 3 switch?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Currently your ASA and &lt;em&gt;Cisco Router&lt;/em&gt; do not have routes to internal devices other than their connected routes.&lt;/p&gt;&#xA;&lt;h3&gt;Your ASA configuration:&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;route outside 0.0.0.0 0.0.0.0 172.16.1.1 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This will provide a default route via the outside interface, but how will the ASA know how to reach subnets residing behind the &lt;em&gt;Layer 3 Distribution Switch&lt;/em&gt;?&lt;/p&gt;&#xA;&lt;p&gt;You'll need to add routes to the internal subnets via the inside interface using the &lt;em&gt;Layer 3 Distribution Switch&lt;/em&gt; as the next-hop IP address.&lt;/p&gt;&#xA;&lt;h3&gt;ASA static routing example:&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;route inside 172.19.12.0 255.255.255.240 172.16.2.2&#xA;route inside 172.19.3.0 255.255.255.0 172.16.2.2&#xA;route inside 172.20.100.0 255.255.255.224 172.16.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Further reading: &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_static.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASA static routing&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h3&gt;Your Cisco Router's configuration:&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 200.200.200.200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Additionally, how will your border router know how to reach subnets other than it's connected routes, and the &lt;em&gt;catch all default route&lt;/em&gt; via the outside interface's next-hop address &lt;code&gt;200.200.200.200&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;h3&gt;Router static routing example:&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip route 172.19.12.0 255.255.255.240 172.16.1.10&#xA;ip route 172.19.3.0 255.255.255.0 172.16.1.10&#xA;ip route 172.19.100.0 255.255.255.224 172.16.1.10&#xA;ip route 172.16.2.0 255.255.255.224 172.16.1.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Further reading: &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a00800ef7b2.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;ISR static routing&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I cannot get an ip address right now from the DHCP server (Windows).&#xA;Any insight into why?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Ensure you have end-to-end IP reachability between the client(s) sending DHCP discover messages and the DHCP server.&lt;/p&gt;&#xA;&lt;p&gt;From what I can gather from your topology and configuration, the subnets &lt;code&gt;172.19.3.0/24&lt;/code&gt;, &lt;code&gt;172.19.12.0/28&lt;/code&gt; and &lt;code&gt;172.20.100.0/27&lt;/code&gt; should have no issues connecting to each other (assuming they are configured to use their respective default gateways) from a networking perspective.&lt;/p&gt;&#xA;&lt;p&gt;You can remove the &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_53_se/configuration/guide/swdhcp82.html#wp1266823&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ip helper-address&lt;/code&gt;&lt;/a&gt; syntax from the SVI 100 given that the DHCP server is on the same segment and that command is used for a DHCP server(s) that is on a different segment.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan100&#xA;ip address 172.20.100.1 255.255.255.224&#xA;ip helper-address 172.20.100.27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2476" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2016-02-14T21:04:18.057" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3325" PostTypeId="2" ParentId="3321" CreationDate="2013-09-22T06:56:20.610" Score="2" Body="&lt;p&gt;&lt;em&gt;Keeping these answers deliberately simple for the simple questions asked.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is is possible to have multiple subnets behind a router? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The very purpose of a router is for reachability to multiple other networks or subnets.  You're confusing routes from connected interfaces with routes that the router knows are off in the distance (i.e., not directly connected).  And when speaking of subnet masks, these are meaningless without applying to a network prefix -- 192.0.2.0/16 (255.255.0.0) is a different network from 192.0.2.0/24 (255.255.255.0).  The router is a traffic cop that needs to know which paths to take; this is learned from the connected interfaces it has or through either static routes or a dynamic routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a use-case to have multiple subnets behind a router? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Stating &quot;behind a router&quot; doesn't mean directly connected.  The use-case could be three routers R1-R3 and three subnets sA-sC as described below.  The routers could be at separate physical locations.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1&#xA;|&#xA;sA&#xA;|&#xA;R2&#xA;|&#xA;sB&#xA;|&#xA;R3&#xA;|&#xA;sC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the perspective of R1 and looking down, sA-sC are &quot;behind&quot; router R1.  sB-sC are behind R2, and only sC is behind R3.  R1 is only directly connected to sA, R2 is directly connected to sA and sB, and R3 is directly connected to sB and sC.  R1 would need either a static route or a dynamic routing protocol to learn about sC and that it should send packets destined for sC to R2 (next-hop).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a performance benefit of having multiple subnets behind a router? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is more of a scalability issue than performance.  Only a limited number of directly connected subnets will go to a router which handles routing for a far larger number of networks.  Performance becomes an issue on a router when Mbps (bits/sec) or Mpps (packets/sec) realistic maximums are hit among other things and less about how many subnets are behind it unless it's handling a large number of networks that requires a lot of Mbps and Mpps throughput.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-09-22T07:04:28.910" LastActivityDate="2013-09-22T07:04:28.910" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3326" PostTypeId="1" AcceptedAnswerId="3327" CreationDate="2013-09-22T11:33:21.470" Score="4" ViewCount="9075" Body="&lt;p&gt;In gns3, when i configure a router with a NM-16ESW module to use as a switch. And I can not configure PAgP or LACP on this router. It has only one mode ON, and there is no DESIRABLE or AUTO or ACTIVE or PASSIVE mode. &#xA;Can you show me help me to do this ? &#xA;I saw in this video: &lt;a href=&quot;http://gns3vault.com/Switching/pagp-lacp-etherchannel.html&quot; rel=&quot;nofollow&quot;&gt;http://gns3vault.com/Switching/pagp-lacp-etherchannel.html&lt;/a&gt;&#xA;he did it very easy with no problem.&#xA;Thanks you.&lt;/p&gt;&#xA;" OwnerUserId="2651" LastActivityDate="2017-04-10T22:55:17.063" Title="How to configure PAgP or LACP on GNS3" Tags="|etherchannel|gns3|ieee-802.1ax|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3327" PostTypeId="2" ParentId="3326" CreationDate="2013-09-22T12:21:59.167" Score="6" Body="&lt;p&gt;You will need real switches since there is no emulator for their ASICs. GNS3 can emulate only routers (and run their IOS images). You can try Cisco Packet Tracer for switches, but keep in mind that it is a simulator and it does not have full set of features you will find on real equipment.&lt;/p&gt;&#xA;" OwnerUserId="2358" LastActivityDate="2013-09-22T12:21:59.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3328" PostTypeId="2" ParentId="3315" CreationDate="2013-09-22T14:08:58.670" Score="3" Body="&lt;p&gt;The copy command (at least with Cisco boxes) allows you to specify the username and password all in one line. Something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy running-config ftp://put_user_name_here:put_password_here@put_machie_name_or_ip_here//home/users/some_location/ut-running-config.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should be able to use scp or tftp in place of ftp as well.&lt;/p&gt;&#xA;" OwnerUserId="2450" LastActivityDate="2013-09-22T14:08:58.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3329" PostTypeId="1" AcceptedAnswerId="3342" CreationDate="2013-09-22T14:35:28.450" Score="56" ViewCount="101084" Body="&lt;p&gt;If my computer has an IP address,why does it need a MAC address?&lt;/p&gt;&#xA;" OwnerUserId="2604" LastEditorUserId="8499" LastEditDate="2018-03-19T18:34:22.273" LastActivityDate="2022-02-14T17:56:40.243" Title="Reason for both a MAC and an IP address" Tags="|ipv4|mac-address|ip-address|" AnswerCount="10" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="3330" PostTypeId="2" ParentId="3329" CreationDate="2013-09-22T16:24:40.127" Score="39" Body="&lt;p&gt;MAC addresses and IP addresses operate on different layers of the &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Protocol_Suite&quot;&gt;internet protocol suite&lt;/a&gt;. MAC addresses are used to identify machines within the same broadcast network on layer 2, while IP addresses are used on layer 3 to identify machines throughout different networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if your computer has an IP address, it still needs a MAC address to find other machines on the same network (especially the router/gateway to the rest of the network/internet), since every layer is using underlying layers. On the &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Protocol_Suite&quot;&gt;page&lt;/a&gt; mentioned earlier you can find some nice diagrams explaining the protocol suite in detail.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-09-22T16:24:40.127" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3332" PostTypeId="2" ParentId="3321" CreationDate="2013-09-23T04:20:29.910" Score="1" Body="&lt;p&gt;having multiple subnets behind one router could be accomplished using a router-on-a-stick setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;basically you configure a trunk between a router and a switch and on the router's port of the trunk you create sub-interfaces where you specify the sub-net of the specific sub-interface and what vlan should the packets be tagged as.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so now you have one link to the router, which is split into sub-interfaces that are logically separated from each-other and the router can route between them and as far as the switch on the other side is concerned it's just another trunk, except this one happens to be the one where all the gateways are.&lt;/p&gt;&#xA;" OwnerUserId="2733" LastActivityDate="2013-09-23T04:20:29.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3334" PostTypeId="2" ParentId="3329" CreationDate="2013-09-23T06:31:08.327" Score="21" Body="&lt;p&gt;There isn't anything physically stopping you from designing a network which has just IP addresses for L2 and L3. Then 'ethernet switch' would learn the SIP address of incoming packets and flood or forward towards a DIP address.&lt;/p&gt;&#xA;&lt;p&gt;However, this network would only ever support IP, when the next-generation of IPvX come's, it would not work, as the 'ethernet switch' couldn't support that protocol. You also couldn't run various other protocols, like IPX and AppleTalk, or some new protocol you're developing and testing in your home.&lt;/p&gt;&#xA;&lt;p&gt;Abstraction layers increase development speed and encourage innovation, as you don't need to rebuild the whole house to change a window.&lt;/p&gt;&#xA;&lt;p&gt;Now you could have ran the same ethernet switches and migrated your network in between from IPX to IPv4 to IPv6, without touching your LAN at all.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="82313" LastEditDate="2022-02-13T13:31:27.290" LastActivityDate="2022-02-13T13:31:27.290" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="3335" PostTypeId="2" ParentId="3329" CreationDate="2013-09-23T07:03:06.333" Score="27" Body="&lt;p&gt;&lt;strong&gt;When you understand that IP-to-IP communication is really just a series of MAC-to-MAC communication taking place at each router hop, then you'll see why both are necessary.&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IP header of a packet leaving your workstation destined to an IP in a different subnet will maintain the source IP and destination IP, forgetting about NAT for the moment. [Later, I will discuss what happens when the destination is within the same subnet.]  The Ethernet header contains your source MAC and the destination MAC of your default gateway.  &lt;em&gt;There's no knowledge of the final destination MAC from your perspective.&lt;/em&gt;  That first router will rewrite the source MAC to itself and the destination MAC to the next router hop, and so on, until the packet arrives at the last router that is directly connected to the destination subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To attempt a simple illustration, consider the L2/L3 headers as a packet moves from the source IP (sIP) to a destination IP (dIP) and the source and destination MACs are rewritten along the way -- fs=first-source and ld=last-destination, and r1-r3 are routers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fsMAC-r1MAC / sIP-dIP &#xA;r1MAC-r2MAC / sIP-dIP&#xA;r2MAC-r3MAC / sIP-dIP&#xA;r3MAC-ldMAC / sIP-dIP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any L2 switches involved will not modify the MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for communication to another IP within your subnet, direct MAC communication is needed, but to get that MAC addr requires the ARP protocol that uses a broadcast in the subnet to find it.  &lt;em&gt;By the way, this is how your workstation gets the MAC address of your default gateway that must exist in your same subnet.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2014-12-30T01:42:35.503" LastActivityDate="2014-12-30T01:42:35.503" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3336" PostTypeId="1" AcceptedAnswerId="3338" CreationDate="2013-09-23T07:28:45.983" Score="4" ViewCount="1006" Body="&lt;p&gt;For an enterprise migrating from traditional Internet IPSec L2L VPNs for branch offices to a MPLS-based VPN, there are options for either a L2VPN  or L3VPN.  The L2VPN looks more attractive as you have nearly complete control over it to run your own routing protocols that don't require ISP coordination or MP-BGP in their network to support the VRF routing.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If a MPLS-VPN (L3VPN) is used, DIA can be provided on that same service, though I have no direct experience with this and am not sure if it's generally a good or bad idea.  &lt;/li&gt;&#xA;&lt;li&gt;Also, I don't think DIA is generally provided as a service or possible with L2VPN, but please confirm.  &lt;/li&gt;&#xA;&lt;li&gt;WAAS will also be used in the future if that has any influence on whether to go L2 or L3VPN.  Each branch office currently has their own DIA and will continue to have that provided either separately or multiplexed with the VPN.  WAAS would be done in 2900 ISRs in the branch office and TBD in main corporate office.&lt;/li&gt;&#xA;&lt;li&gt;Should encryption -- not PCI/not HIPPA required -- be mandatory as we do now with IPSec or is there usually enough inherent trust with either the L2 or L3VPN implementations with VRFs; specifically, does SOX say anything about requiring encryption?&lt;/li&gt;&#xA;&lt;li&gt;(Bonus points) Terminating the VPN on a router inside the firewall seems to be the way to go, though with DIA multiplexed on the VPN seems to thrown a monkey-wrench into this as DIA is usually outside the firewall.  With or without DIA to worry about, having the VPN on the Internet edge router outside the firewall would usually deal with public IP space, so to continue using private addressing between sites, is it recommended to just to do no-NAT or identity-NAT at the firewall.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2013-09-23T07:37:50.173" LastActivityDate="2013-09-23T08:03:45.057" Title="L2 vs L3VPN with DIA and WAAS" Tags="|vpn|l2vpn|waas|mpls-vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3337" PostTypeId="2" ParentId="3303" CreationDate="2013-09-23T07:39:19.787" Score="2" Body="&lt;p&gt;Due to weird IOS architectural reasons you need to have full privilege level 15 to do 'show run'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modern replacement to various privilege levels is &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_3t/12_3t7/feature/guide/gtclivws.html&quot; rel=&quot;nofollow&quot;&gt;RBAC&lt;/a&gt; or Role Based Access Control. Here you can define each user separate view, command by command. You could allow user to do 'show run' and add new permit lines in access-lists in configuration mode, but nothing else.&lt;br&gt;&#xA;Nice thing about RBAC is, that user also only sees commands which are allowed, so when she punches in '?', only commands shown to her are the ones previously allowed by operator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;parser view arbitrary_name&#xA; commands ipenacl include permit ip&#xA; commands ipenacl include permit&#xA; commands configure include ip access-list extended&#xA; commands configure include ip access-list&#xA; commands configure include ip&#xA; commands exec include configure terminal&#xA; commands exec include configure&#xA; commands exec include all show running-config&#xA; commands exec include show&#xA;!&#xA;username some_user view arbitrary_name secret poop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And how it looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bu.ip.fi#show ?&#xA;  flash:          display information about flash: file system&#xA;  parser          Display parser information&#xA;  running-config  Current operating configuration&#xA;&#xA;bu.ip.fi#show running-config view full | i hostname&#xA;hostname bu.ip.fi&#xA;bu.ip.fi#configure ?&#xA;  terminal  Configure from the terminal&#xA;  &amp;lt;cr&amp;gt;&#xA;&#xA;bu.ip.fi#configure terminal &#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;bu.ip.fi(config)#?&#xA;Configure commands:&#xA;  do-exec  To run exec commands in config mode&#xA;  exit     Exit from configure mode&#xA;  ip       Global IP configuration subcommands&#xA;&#xA;bu.ip.fi(config)#ip ?&#xA;Global IP configuration subcommands:&#xA;  access-list  Named access-list&#xA;&#xA;bu.ip.fi(config)#ip access-list extended foo&#xA;bu.ip.fi(config-ext-nacl)#?&#xA;Ext Access List configuration commands:&#xA;  &amp;lt;1-2147483647&amp;gt;  Sequence Number&#xA;  exit            Exit from access-list configuration mode&#xA;  permit          Specify packets to forward&#xA;&#xA;bu.ip.fi(config-ext-nacl)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-09-23T07:39:19.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3338" PostTypeId="2" ParentId="3336" CreationDate="2013-09-23T08:03:45.057" Score="4" Body="&lt;p&gt;Putting myself in a customer perspective, with presumption that customer has solid technical competence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have multiple offices, you should confirm that L2VPN product you're offered is multipoint, any-to-any solution, like VPLS. Then ask how many MAC addresses can be in each sites, how are bcast/mcast/unknown unicast limited. If there are no limitation, it likely is not a good news, then it might mean if some other customer fills MAC table, you'll suffer as well.&lt;br&gt;&#xA;It would be prudent to test that limits are enforced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would shy away from getting Internet access in L2VPN or L3VPN, it will probably contain several SPOFs as implemented by operator, you might be more comfortable controlling those SPOFs yourself, so you don't have to wait for operator to fix something while all your offices are without Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, both L2VPN and L3VPN commonly are provided with Internet access. In L2VPN (particularly ELAN/VPLS) it's actually very easy, provided you're using routable IP addresses, as then operator will just drop in IRB interfaces in the L2VPN instance acting as your default-gw inside the operator network, HSRP/VRRP if needed.&lt;br&gt;&#xA;In L3VPN Internet Access product probably assumes RFC1918 addresses and there likely is no ability to order direct INET connection to each site, from closest PE. Only option likely offered is centralized firewall, which may or may not contain large amount of SPOFs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In either case, please be sure you understand how the INET access is implemented and if you're ready to carry the risks. If not, just order additional INET access to one or more sites and handle INET yourself, which I'd prefer to do anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no comment on WAAS, I've never used them, but can understand how they might be useful in slow-speed accesses using badly designed applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If encryption is not mandated by regulatory authority, I would not do it personally, it's just more things to cause problems, require maintenance and increase cost of CE.&lt;br&gt;&#xA;I would however acquire actively knowledge what applications we're using internally which of them are using encryption, which can be migrated to encryption and which cannot use encryption and device long-term plan to move all applications to encryption.&lt;br&gt;&#xA;Security should not have higher cost than the risk carried in the breach of security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure I understand bonus point question, I would certainly not put a firewall between my CE and operator PE. States should be kept at last possible moment. I personally would only want FW in front of human LANs, where guaranteeing software hygine is difficulty. I would not put FW in front of servers, because it'll dilute my investments in availability and performance. Enterprise world has too much love for FWs.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-09-23T08:03:45.057" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3341" PostTypeId="2" ParentId="3284" CreationDate="2013-09-23T11:31:31.410" Score="2" Body="&lt;p&gt;If you have monitor license for the firewall you can check historical throughput graph from SmartView Monitor (System counters – FireWall History). Historical throughput averages over time, so use the shortest timeframe for more accurate results. Without license your options are to use a third party tool for polling the interfaces or keep staring the Network Activity page.&lt;/p&gt;&#xA;" OwnerUserId="2378" LastActivityDate="2013-09-23T11:31:31.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3342" PostTypeId="2" ParentId="3329" CreationDate="2013-09-23T14:43:24.340" Score="27" Body="&lt;p&gt;Without going into OSI model, TCP layer, etc.:&lt;/p&gt;&#xA;&lt;p&gt;Back in time, networks were created: some computers would communicate with each other to share something. TO do that, they need to know who was talking and who was being talked to. So, instead of giving each computer a name, we gave them an ID. This ID is called MAC address, is should uniquely identify each computer.&lt;/p&gt;&#xA;&lt;p&gt;(ok, identify each network card, but back that time, you could think of one MAC address for each computer).&lt;/p&gt;&#xA;&lt;p&gt;There wasn't a unique specification on how computers would talk to each other: many protocols appeared: TCP/IP, IPX/SPX, and so on. Each protocol would specify things as they thought were ok. For example, IPX/SPX would address each computer using the MAC address and some more information.&lt;/p&gt;&#xA;&lt;p&gt;But the TCP/IP protocol was designed a little bit different: they decided that having an virtual address, made of 4 bytes (0.0.0.0 to 255.255.255.255) was enough, and was even easier to manage: it doesn't matter if your network cards all have a similar MAC address or not; we'll group our computer so that all TCP/IP address that began with 10.0.x.x. are part of the engineering group, and those of 10.1.x.x. are the printers, and...&lt;/p&gt;&#xA;&lt;p&gt;So, if a TCP/IP address needs to communicate with another, is just uses the TCP/IP address. But the network devices need to know to which network card that message is going, so they, somehow, translate the TCP/IP address with to the MAC address.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Why not simply eliminate the MAC and instead use just TCP/IP ?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;some reasons:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;easy to group TCP/IP addresses,&lt;/li&gt;&#xA;&lt;li&gt;all devices are built to take care of the MAC address, in that low-level requirement, and would need to be changed.&lt;/li&gt;&#xA;&lt;li&gt;despite being the vast majority (I think :-P ), some other protocols are still in use and they rely on the MAC address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="145" LastEditorUserId="82313" LastEditDate="2022-02-11T16:37:54.137" LastActivityDate="2022-02-11T16:37:54.137" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="3344" PostTypeId="1" AcceptedAnswerId="3346" CreationDate="2013-09-23T19:14:53.907" Score="6" ViewCount="27142" Body="&lt;p&gt;I want to know on what basis Cisco designed the different modes in their routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;config&lt;/code&gt; mode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;execution&lt;/code&gt; mode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can any one give the perfect reasons behind the different modes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the configurations that come under &lt;code&gt;execution&lt;/code&gt; and &lt;code&gt;config&lt;/code&gt; modes?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="44" LastEditDate="2013-09-24T14:14:59.877" LastActivityDate="2013-09-24T14:14:59.877" Title="What are the different modes in Cisco routers, and why these modes?" Tags="|cisco|router|cisco-ios|aaa|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3345" PostTypeId="2" ParentId="3344" CreationDate="2013-09-23T19:26:52.363" Score="10" Body="&lt;p&gt;exec mode is used for &lt;code&gt;show&lt;/code&gt; and &lt;code&gt;debug&lt;/code&gt; commands.  There are multiple privilege levels associated with exec mode.  These command privs (and who can use them) can be managed with Cisco's &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfaaa.html&quot;&gt;AAA&lt;/a&gt; features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;config mode is used to enter configurations from the CLI.  Individual config commands can be limited with &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/security/configuration/guide/scfaaa.html&quot;&gt;AAA&lt;/a&gt; features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two modes are useful so you can assign privileges to network engineers and administrators, based on their skill sets and the needs of the company.  As an example, Tier-1 NOC personnel typically shouldn't be allowed to go into configuration mode, but network engineers typically have full config privs.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-09-23T19:41:31.310" LastActivityDate="2013-09-23T19:41:31.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3346" PostTypeId="2" ParentId="3344" CreationDate="2013-09-23T23:56:17.023" Score="12" Body="&lt;p&gt;Cisco's IOS uses the &lt;a href=&quot;http://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/02_cisco_ios_hierarchy.htm&quot;&gt;different &lt;code&gt;EXEC&lt;/code&gt; modes&lt;/a&gt; as a basic way to control user privileges. These user privilege controls can be delegated through an enable password, the local user database or AAA (RADIUS, TACACS+).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two &lt;code&gt;EXEC&lt;/code&gt; modes are &lt;strong&gt;user mode&lt;/strong&gt; and &lt;strong&gt;privileged mode&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;user EXEC mode&amp;gt;&lt;/code&gt; is limited to an array of show commands, basic reachability tests, such as ping and traceroute, as well as other ways of viewing configurations and status info of a Cisco device without the ability to make changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;privileged EXEC mode#&lt;/code&gt; is for users that have been delegated admin privileges and need to make changes, view more show commands and debugs as well as using the ability to move further down the configuration hierarchy (such as global configuration mode, interface configuration mode, &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/isg/configuration/xe-3s/isg-mqc-ip-sess.html&quot;&gt;MQC&lt;/a&gt;, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, both the user EXEC and privileged EXEC modes are subject to further controls known as &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/sec_user_services/configuration/guide/sec_cfg_sec_4cli.html#wp1054522&quot;&gt;privilege levels&lt;/a&gt;. By default the user EXEC mode has a privilege level of 1(includes all user-level commands) and the privileged EXEC mode has a privilege of 15(full privileges). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/E-Learning/bulk/public/tac/cim/cib/using_cisco_ios_software/02_cisco_ios_hierarchy.htm&quot;&gt;Here is a nice visual&lt;/a&gt; along with more information.&lt;/p&gt;&#xA;" OwnerUserId="2476" LastEditorUserId="2476" LastEditDate="2013-09-24T01:56:46.440" LastActivityDate="2013-09-24T01:56:46.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3348" PostTypeId="1" AcceptedAnswerId="3350" CreationDate="2013-09-24T00:18:38.703" Score="8" ViewCount="3078" Body="&lt;p&gt;We have a &lt;strong&gt;Cisco 1900 ISR&lt;/strong&gt; and have recently setup a web-server at &lt;code&gt;ourdomain.com&lt;/code&gt;. &#xA;The site works perfectly, however from the LAN we cannot use &lt;code&gt;ourdomain.com&lt;/code&gt; to access the site, instead everyone has to use the local IP address &lt;code&gt;10.1.1.xxx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've come to understand that its a limitation with Cisco routers. My extensive googling has turned up &lt;strong&gt;DNS doctoring&lt;/strong&gt; (or DNS reply modification)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've attempted many time to setup DNS doctoring but I just cant get it work, I believe because our ISR doesnt have the capability to peform the commands I'm trying:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network our_server&#xA;host 10.1.1.xx&#xA;nat (inside,outside) static 50.100.100.10 dns&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there another way to achieve DNS doctoring or otherwise access our local server using the external address?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our network config is as follows: &lt;code&gt;Modem &amp;gt; ISR &amp;gt; Switch &amp;gt; End Users&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our ISR is running: &lt;code&gt;Cisco IOS Software, C1900 Software (C1900-UNIVERSALK9-M), Version 15.1(4)M4, RELEASE SOFTWARE (fc1)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="2742" LastEditorUserId="2742" LastEditDate="2013-09-24T00:23:45.150" LastActivityDate="2013-09-24T04:18:30.667" Title="DNS Doctoring / Reply Modification on Cisco 1900 series ISR" Tags="|cisco|cisco-ios-15|dns|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3350" PostTypeId="2" ParentId="3348" CreationDate="2013-09-24T03:53:54.113" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I've attempted many time to setup DNS doctoring but I just cant get it work, I believe because our ISR doesnt have the capability to peform the commands I'm trying&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your first problem is that you're using Cisco ASA commands on a Cisco router; you're also assuming this is a problem with your Cisco router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In reality, this is a DNS issue that can be solved with your Cisco router; however, it's normally solved with a &lt;a href=&quot;http://en.wikipedia.org/wiki/Split-horizon_DNS&quot;&gt;split-DNS&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there another way to achieve DNS doctoring or otherwise access our local server using the external address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes... Cisco calls it Network address translation (or &lt;code&gt;nat&lt;/code&gt;)... Let's assume you have this topology...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                               +------------+&#xA;                        Fa0/0  | Cisco ISR  | Fa0/1&#xA;LAN w/ Webhost-----------------|            |-------------------&#xA;                        inside |            | outside (To ISP)&#xA;                   10.1.1.0/24 +------------+ 192.0.2.1&#xA;                                              192.0.2.2 (static translation for the webhost)&#xA;&#xA;interface Fa0/0&#xA; ip address 10.1.1.1 255.255.255.0&#xA; no ip proxy-arp&#xA; ip nat inside&#xA;interface Fa0/1&#xA; ip address 192.0.2.1 255.255.255.0&#xA; no ip proxy-arp&#xA; ip nat outside&#xA;!&#xA;ip nat inside source list INSIDE_ADDRS interface FastEthernet0/1 overload&#xA;ip nat inside source static 10.1.1.50 192.0.2.2&#xA;!&#xA;ip access-list extended INSIDE_ADDRS&#xA; permit ip 10.1.1.0 0.0.0.255 any&#xA; deny   ip any any&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 192.0.2.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assume your internal Webhost address is 10.1.1.50 and you're using 192.0.2.2 (a second address given by your ISP) for your public A-record..  Thus, when you resolve &quot;ourdomain.com&quot; from google's resolver, you get...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@Bucksnort ~]$ dig +short @8.8.8.8 ourdomain.com&#xA;10.1.1.50&#xA;[mpenning@Bucksnort ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming Bucksnort is 10.1.1.12, if you perform &lt;code&gt;debug ip nat&lt;/code&gt; on your router during a DNS query, you see...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sep 23 23:12:29.132 CDT: NAT: s=10.1.1.12-&amp;gt;192.0.2.1, d=8.8.8.8 [0]&#xA;Sep 23 23:12:29.132 CDT: NAT: DNS resource record 192.0.2.2 -&amp;gt; 10.1.1.50&#xA;Sep 23 23:12:29.136 CDT: NAT: s=8.8.8.8, d=192.0.2.1-&amp;gt;10.1.1.12 [628]&#xA;Sep 23 23:12:29.140 CDT: NAT: s=10.1.1.12-&amp;gt;192.0.2.1, d=8.8.8.8 [0]&#xA;Sep 23 23:12:29.140 CDT: NAT: DNS resource record 192.0.2.2 -&amp;gt; 10.1.1.50&#xA;Sep 23 23:12:29.140 CDT: NAT: s=8.8.8.8, d=192.0.2.1-&amp;gt;10.1.1.12 [629]&#xA;Sep 23 23:12:29.144 CDT: NAT: s=10.1.1.12-&amp;gt;192.0.2.1, d=8.8.8.8 [0]&#xA;Sep 23 23:12:29.148 CDT: NAT: DNS resource record 192.0.2.2 -&amp;gt; 10.1.1.50&#xA;Sep 23 23:12:29.148 CDT: NAT: s=8.8.8.8, d=192.0.2.1-&amp;gt;10.1.1.12 [630]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-09-24T04:18:30.667" LastActivityDate="2013-09-24T04:18:30.667" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3354" PostTypeId="1" AcceptedAnswerId="3363" CreationDate="2013-09-24T10:57:22.910" Score="4" ViewCount="1286" Body="&lt;p&gt;As stated here:&#xA;&lt;a href=&quot;http://documentation.netgear.com/wag102/enu/202-10120-01/v1/WAG102-4-10.html&quot; rel=&quot;nofollow&quot;&gt;http://documentation.netgear.com/wag102/enu/202-10120-01/v1/WAG102-4-10.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and in many other sources, WEP key can be 64bit, 128bit (factors of 2) and 152bit length.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Factor of 2 length I do understand. It is convenient to use in low-level processing, where you have to use boolean logic and save everything in bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea why the 152bit key was selected?&lt;/p&gt;&#xA;" OwnerUserId="2745" LastActivityDate="2013-09-25T00:07:00.070" Title="WEP 152bit encryption key.... Why?" Tags="|wireless|security|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3355" PostTypeId="1" AcceptedAnswerId="14758" CreationDate="2013-09-24T12:11:46.597" Score="9" ViewCount="796" Body="&lt;p&gt;I was listening to a &lt;a href=&quot;http://sverigesradio.se/sida/artikel.aspx?programid=101&amp;amp;artikel=5596344&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Swedish link&quot;&gt;interview&lt;/a&gt; regarding the back country and Fiber to the home with the Swedish professor in telecommunications Per Ödling. Once in the interview he was referring to technologies that was on the way that was &quot;as good as fiber&quot; for Internet connectivity but much cheaper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really wished he would continue on that subject because I don't know any technologies that could be &quot;as good&quot;. LTE could reach 300Mbit/s under ideal circumstances. You could use the Cable TV net to reach high speeds (don't know how high you can go). But fiber is a whole other league that without problems can go up to 10Gbit and probably even faster in the future. I really don't believe any of the other alternatives has potential even near what fiber can do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question is crucial to me because I want to convince a small organization to bet on fiber in it's buildings while the Swedish government is subsidizing this investment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is what technologies could Ödling possibly have spoken about that is on the way and is &quot;as good&quot; as fiber? What alternatives could there be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Related: &lt;a href=&quot;https://physics.stackexchange.com/questions/56240/maximum-theoretical-bandwidth-of-fibre-optics&quot;&gt;Maximum theoretical bandwidth of fibre-optics&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2746" LastEditorUserId="-1" LastEditDate="2017-04-13T12:40:14.187" LastActivityDate="2015-12-03T20:48:32.480" Title="FTTH and alternatives" Tags="|fiber|ftth|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3357" PostTypeId="1" AcceptedAnswerId="3366" CreationDate="2013-09-24T12:56:50.760" Score="14" ViewCount="9090" Body="&lt;p&gt;I have a question about Wifi, I couldn't find the answer anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to send a packet over wifi &lt;strong&gt;without having joined any kind of network (ad-hoc or not)?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to be able to send packets in the air without joining a network. Another device in monitor mode would be able to recognize which packets it should treat. I know wifi may not be the best way to do this, just wanted to know how it works technically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed, there must be some kind of packets sent during wireless network discovery? How are the various SSIDs transferred over network without a connection being made? What kind of packets are sent to discover networks over wifi?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone could just point me in the direction of some documentation about this, I couldn't find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="2747" LastActivityDate="2018-11-29T09:21:48.523" Title="Broadcasting wifi packets without a network" Tags="|wireless|packet-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3358" PostTypeId="2" ParentId="3315" CreationDate="2013-09-24T17:20:03.070" Score="18" Body="&lt;p&gt;Try turning file prompt behavior to quiet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6506(config)#file prompt quiet&#xA;6506(config)#end&#xA;6506#copy run tftp://192.168.1.1/file.txt&#xA;.....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2752" LastActivityDate="2013-09-24T17:20:03.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3359" PostTypeId="1" AcceptedAnswerId="3367" CreationDate="2013-09-24T18:53:12.587" Score="9" ViewCount="503" Body="&lt;p&gt;I am almost 100% sure this is not possible, but just thought about double checking with someone with more expertise on wireless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I have the following scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WLC-1 with 25 licenses on building 1 (5508)&#xA;WLC-2 with 100 licences on building 2 (5508) -- new one being added to the network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a total of 75 APs. 25 APs of those APs are in building 1 and primed to WLC-1.  WLC-2 will be added and it will be the primary WLC for 50 APs. With the addition of the second WLC, we want to add some redundancy, as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add WLC-2 as a secondary WLC for the 25 APs in building 1 and add WLC-1 as the secondary WLC for the other 50 APs in building 2, so we could have some redundancy, should one of the WLC fail, the other one would accept the associations of all the APs. Obviously this would be a problem, as WLC-1 only have 25 licenses and once WLC-2 fail, all the other 50 APs would be able to associate with WLC-1 as all the 25 licenses are already used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thought process, is that we need 75 more licenses on WLC-1, so both WLCs would have the same number of licenses and the number of licenses is greater than the number of APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem is that someone told our customer that we should be able to keep WLC-1 with 25 licenses and leverage Cisco Prime NCS, buying 100 licenses (L-NCS-1.0-100). According to them, this license would give the ability of the WLCs &quot;sharing&quot; (if you will) all the 100 licenses, so should one WLC fail, the other one could use the licenses.&#xA;I am almost sure that this is wrong, as NCS is more of a management platform with several troubleshooting capabilities, like generating reports and helping on troubleshooting signal issues, etc. So bottom line is that the license, would be for the amount of devices that NCS could have visibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone tell me if NCS should be able to share its licenses with the WLC or if my initial understanding of having to buy +75 licenses for WLC-1 is the correct approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot in advance..&lt;/p&gt;&#xA;" OwnerUserId="1426" LastActivityDate="2013-09-25T02:43:19.220" Title="NCS Cisco Prime licenses" Tags="|wireless|wlc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3361" PostTypeId="1" AcceptedAnswerId="3362" CreationDate="2013-09-24T21:23:48.000" Score="7" ViewCount="654" Body="&lt;p&gt;Here is the config of one of our routers. Can any one give an overview?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe its for VOIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are going to replace this router with a non Cisco firewall, will there be any issue for VOIP in the internal network?  If yes, may I know in what way.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;application&#xA;service new-call flash:bootstrap.vxml&#xA;paramspace english index 0&#xA;paramspace english language en&#xA;paramspace english location flash&#xA;paramspace english prefix en&#xA;!&#xA;service cvp-survivability flash:survivability.tcl&#xA;paramspace english index 0&#xA;paramspace english language en&#xA;paramspace english location flash&#xA;paramspace english prefix en&#xA;!&#xA;service CVPSelfService flash:CVPSelfServiceBootstrap.vxml&#xA;!&#xA;service app_transfer flash:CVPSelfService.tcl&#xA;param CVPBackupVXMLServer &amp;lt;private IP address of another location&amp;gt;&#xA;paramspace english language en&#xA;paramspace english index 0&#xA;paramspace english location flash&#xA;param CVPSelfService-port 7000&#xA;param CVPSelfService-app HelloWorld&#xA;paramspace english prefix en&#xA;param CVPPrimaryVXMLServer &amp;lt;private IP address of another location&amp;gt;&#xA;!&#xA;service ringtone flash:ringtone.tcl&#xA;paramspace english language en&#xA;paramspace english index 0&#xA;paramspace english location flash&#xA;paramspace english prefix en&#xA;!&#xA;service cvperror flash:cvperror.tcl&#xA;paramspace english language en&#xA;paramspace english index 0&#xA;paramspace english location flash&#xA;paramspace english prefix en&#xA;!&#xA;service handoff flash:handoff.tcl&#xA;paramspace english language en&#xA;paramspace english index 0&#xA;paramspace english location flash&#xA;paramspace english prefix en&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2756" LastEditorUserId="44" LastEditDate="2013-09-26T18:03:51.713" LastActivityDate="2013-09-26T23:01:11.933" Title="Overview of following cisco 2800 config" Tags="|cisco|voip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3362" PostTypeId="2" ParentId="3361" CreationDate="2013-09-24T23:02:31.080" Score="13" Body="&lt;p&gt;You are correct this is a VoIP configuration.  This is part of the configuration for CVP call center survivability.   If this site lost it's connection to the Internet or WAN (however its connecting back to your Data Center), the 2800 would take over call processing for the IP phones.   It is used in combination with the standard SRST functionality on Cisco's ISR and ISR G2 platforms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRST keeps the phone operative and receiving/placing calls and CVP Survivability keeps your call center functioning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read more on CVP survivability &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-1127&quot; rel=&quot;noreferrer&quot;&gt;here on the Cisco Support Forums&lt;/a&gt;.   It says, in part:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For Unified CVP calls, survivability is handled by a combination of&#xA;  services from a TCL script (survivability.tcl) and SRST functions.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The survivability TCL script is used to monitor the H.225 or SIP&#xA;  connection for all calls that ingress through the remote gateway. If a&#xA;  signaling failure occurs, the TCL script takes control of the call and&#xA;  redirects it to a configurable destination. The destination choices&#xA;  for the TCL script are configured as parameters in the Cisco IOS&#xA;  Gateway configuration.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So there should also be some .tcl files on the router which these services would use to execute their functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want more general information on Cisco's CVP product and configuring IOS device for PSTN ingress for it, I would recommend &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk652/tk90/technologies_configuration_example09186a00808c8785.shtml&quot; rel=&quot;noreferrer&quot;&gt;this config example/call flow guide&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: In the comments, you asked, what would be the impact of removing this Cisco router and replacing it with another vendor's firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have Cisco VoIP telephones at this location, removing the Cisco ISR will remove their &lt;a href=&quot;http://www.cisco.com/en/US/products/sw/voicesw/ps2169/products_configuration_example09186a0080509462.shtml&quot; rel=&quot;noreferrer&quot;&gt;SRST&lt;/a&gt; functionality.  That is to say, if you lose WAN connectivity to your CUCM cluster, the phones will have no way to stay in service. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This possible loss of service can be an acceptable risk, depending on the business purpose of this site and other factors.  However, there was likely a good reason (business continuity, revenue generation, etc) for keeping those phones operational at all costs.   Someone went through the effort to install the UCCE suite and CVP Survivability, which is usually VERY EXPENSIVE, not to mention complicated to build and maintain.  Organizations, in my experience, don't undertake that expense and effort lightly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure that you have contacted whoever is responsible for the telephony portion of your network, and verify with them any plans for equipment replacement.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-09-26T23:01:11.933" LastActivityDate="2013-09-26T23:01:11.933" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3363" PostTypeId="2" ParentId="3354" CreationDate="2013-09-25T00:07:00.070" Score="4" Body="&lt;p&gt;I will preface this by saying this is a terrible answer, first because I can't find any of the references and am going off of memory.  Second because I haven't put much thought into WEP for so long that my memory fails me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to why it was 152-bit, IIRC, this was a 128-bit standard WEP key with an additional 24-bit extension.  The 24-bit extension was one of several proprietary extensions in an attempt to make WEP more secure (or at least appear more secure).  Cisco's MIC and TKIP won out as the most widely recognized extensions to make WEP more secure (more commonly known as WPA).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;152-bit WEP ultimately faded away as many proprietary extensions do when they don't get enough industry support and/or are over shadowed by better extensions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, it really doesn't matter at this point though as WEP is a fundamentally broken technology and WEP, WPA/TKIP and WPA2/TKIP are all defunct technologies.  By this I mean that the 802.11n amendment says an AP has to disable the high throughput data rates and function as an 802.11a/g device if any of the above are enabled. &lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-09-25T00:07:00.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3364" PostTypeId="1" AcceptedAnswerId="3369" CreationDate="2013-09-25T00:17:23.467" Score="7" ViewCount="13946" Body="&lt;p&gt;I have been at this for 2 days, been through countless forums and tutorials as far as configuring my ASA-5505.  I can't get out to the internet (even using ping from the ASA), I can't &quot;see&quot; the ASA on the network .. Basically it's a dead piece of hardware other than the Console.  My modem has been set to bridged mode as well.  This is the tutorial I followed: &lt;a href=&quot;http://www.firewall.cx/forum/10-firewall-filtering-idsips-a-security/32041-howto-basic-asa-5505-configuration.html&quot; rel=&quot;noreferrer&quot;&gt;HERE&lt;/a&gt;..  Not sure where to go next ..  The &quot;outside&quot; vlan seems to be misconfigured, and I've tried so many permeations, that I am sure I am overlooking something major, and obvious.   When I am able to ping 8.8.8.8, from the ASA, I'll be happy! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are my Comcast settings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway MAC Address           78:CD:8E:D9:FB:34&#xA;WAN MAC Address               78:CD:8E:D9:FB:37&#xA;WAN DHCP IP Address           50.135.170.116&#xA;WAN DHCP IPv6 Address         ::/64&#xA;WAN DHCP IPv6 DNS (primary)   ::&#xA;WAN DHCP IPv6 DNS (secondary) ::&#xA;WAN DHCP Subnet Mask          255.255.254.0&#xA;WAN DHCP Default Gateway      50.xx.xx.1&#xA;WAN Internet IP Address       74.xx.xx.230&#xA;DNS (primary)                 75.75.75.75&#xA;DNS (secondary)               75.75.76.76&#xA;DHCP Time Remaining           92h:42m:22s&#xA;Internal Gateway IP Address   10.1.10.1&#xA;Internal Subnet Mask          255.255.255.0&#xA;INTERNAL DHCP                 DISABLED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is my ASA configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 8.2(5)&#xA;!&#xA;hostname DTS-ASA&#xA;enable password xxxxxxxxxxxxxx encrypted&#xA;passwd xxxxxxxxxxx encrypted&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA; shutdown&#xA;!&#xA;interface Ethernet0/3&#xA; shutdown&#xA;!&#xA;interface Ethernet0/4&#xA; shutdown&#xA;!&#xA;interface Ethernet0/5&#xA; shutdown&#xA;!&#xA;interface Ethernet0/6&#xA; shutdown&#xA;!&#xA;interface Ethernet0/7&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.1.10.100 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 74.xx.xx.230 255.255.255.248&#xA;!&#xA;ftp mode passive&#xA;pager lines 24&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 10 interface&#xA;nat (inside) 10 10.1.10.0 255.255.255.0&#xA;route outside 0.0.0.0 0.0.0.0 74.xx.xx.230 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;username cisco password ZBZ8GNEdrJsjFvsR encrypted privilege 15&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect ip-options&#xA;  inspect netbios&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect skinny&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect sunrpc&#xA;  inspect tftp&#xA;  inspect sip&#xA;  inspect xdmcp&#xA;!&#xA; service-policy global_policy global&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;Cryptochecksum:86f051cb52af3d343c52cf1a222c6901&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Link I said, I am probably missing something critical and obvious, however having a development background networking is a somewhat foreign concept.&lt;/p&gt;&#xA;" OwnerUserId="2758" LastEditorUserId="775" LastEditDate="2013-09-25T10:00:42.357" LastActivityDate="2015-03-02T06:07:22.603" Title="Cannot get Cisco-ASA 5505 properly configured" Tags="|cisco|cisco-asa|firewall|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3365" PostTypeId="1" CreationDate="2013-09-25T00:56:41.300" Score="1" ViewCount="856" Body="&lt;p&gt;When I do an Omnipeek capture of an iPerf TCP throughput test over WiFi, I only see TCP Acks from the iPerf server to the client. How come I don't see any TCP frames from the client to the server? I thought iPerf traffic moves from client to server.&lt;/p&gt;&#xA;" OwnerUserId="2360" LastActivityDate="2014-06-11T17:24:36.717" Title="Why don't I see client-to-server TCP traffic when sniffing iPerf TCP throughput?" Tags="|tcp|iperf|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3366" PostTypeId="2" ParentId="3357" CreationDate="2013-09-25T02:21:01.553" Score="12" Body="&lt;p&gt;The short answer is yes, it is not only possible, but happens all the time.  Examples of this are CTS-to-self, beacons (sent by APs), probe requests, probe responses and a number of other management types of frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it seems that isn't exactly what you mean and are looking for a way to transmit data from one device to another without any sort of established relationship.  The only software I know of that transmits data in this fashion are tools used when penetration testing wireless security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, these work by replaying data captures back into the air.  Instead of replaying captured traffic, you could craft your own 802.11 frames into a &quot;capture&quot; file and replay any data you wanted.  Your second station in monitor mode could then capture the traffic out of the air.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do keep in mind that this would be a very rudimentary form of wireless communication and  does not provide any mechanism for retries/retransmissions (recovery from collisions or other interference) or a means of encryption (unless you encrypt the data before creating your frames).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-09-25T02:21:01.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3367" PostTypeId="2" ParentId="3359" CreationDate="2013-09-25T02:43:19.220" Score="5" Body="&lt;p&gt;Unless something changed recently in regards to WLC/Prime licensing, you can only do this when you are running a two controllers in a HA active/standby state.  In this case, you only need permanent count licenses on the active WLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/netmgtsw/ps6504/ps6528/ps12239/deployment_guide_c07-721232.html#wp9000614&quot; rel=&quot;noreferrer&quot;&gt;Cisco documentation&lt;/a&gt;: &lt;em&gt;&quot;In Cisco Prime Infrastructure, the only HA configuration is supported is 1:1 - 1 primary system, 1 secondary system.&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Prime Infrastructure does not support HA in an active/active mode.  While the APs can have a backup controller configured, this is not considered HA.  In this case, each controller would require sufficient licenses to support the APs that would be connecting to it.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-09-25T02:43:19.220" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3368" PostTypeId="2" ParentId="2501" CreationDate="2013-09-25T03:47:31.110" Score="6" Body="&lt;p&gt;So, just to make sure that you haven't simply missed or misconfigured a step. Check Cisco's guide to SCP &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_ssh/configuration/xe-3s/asr1000/sec-usr-ssh-sec-copy.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I noticed that your scp command was in the form &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA; scp image.tar cisco@10.2.55.149:image.tar&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may want to try  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;scp image.tar cisco@10.2.55.149:flash:image.tar&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I added &lt;code&gt;flash:&lt;/code&gt; per the sugggetion in &lt;a href=&quot;https://supportforums.cisco.com/thread/2192342#3827614&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; support forum on cisco. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So, just to break it down, make sure you have an AAA model created, a user created, and the scp server enabled, then try it again. Also try connecting  with the &lt;code&gt;flash:&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="1638" LastActivityDate="2013-09-25T03:47:31.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3369" PostTypeId="2" ParentId="3364" CreationDate="2013-09-25T10:00:24.183" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The &quot;outside&quot; vlan seems to be misconfigured, and I've tried so many permeations, that I am sure I am overlooking something major, and obvious. When I am able to ping 8.8.8.8, from the ASA, I'll be happy! &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Basic Config&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As others have mentioned, your configuration is &quot;suboptimal&quot;... &lt;strike&gt;the biggest problem you have is that you're not using DHCP on the outside Vlan interface&lt;/strike&gt; the biggest problem is that your default gw address is assigned to Vlan2... to recover, login to the console and...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;copy runn flash:foobar.cfg&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;config t&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;configure factory-default 10.1.10.100 255.255.255.0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;While you're in config mode, use this configuration...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname DTS-ASA&#xA;password ChangeMeNow&#xA;enable password ChangeMeNow&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Vlan2&#xA; ! I don't think you need this, since it's an SMC MAC addr&#xA; ! However, this illustrates how you can manually change the mac&#xA; ! on your outside Vlan, if Comcast is restricting you&#xA; ! to one mac (and now refuses to change it)&#xA; ! mac-address 78cd.8ed9.fb37&#xA; nameif outside&#xA; security-level 0&#xA; ip address 74.xx.xx.225 255.255.255.248&#xA;!&#xA;route outside 0.0.0.0 0.0.0.0 74.xx.xx.230&#xA;global (outside) 1 interface&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;end&#xA;wr mem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please change the password :-)... now you need fw rules, but that's a different issue&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;WAN Validation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Make sure you really do have the Comcast modem attached to Eth0/0...  After you're up and running, you should be able to check the address you got from Comcast like this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DTS-ASA# sh int vlan2&#xA;Interface Vlan2 &quot;outside&quot;, is up, line protocol is up&#xA;  Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec&#xA;        MAC address 0030.dead.beef, MTU 1500&#xA;        IP address 74.xx.xx.225, subnet mask 255.255.255.248     &amp;lt;------------&#xA;  Traffic Statistics for &quot;outside&quot;:&#xA;        108703406 packets input, 119199091796 bytes&#xA;        69134254 packets output, 8083775282 bytes&#xA;        1654709 packets dropped&#xA;      1 minute input rate 2 pkts/sec,  280 bytes/sec&#xA;      1 minute output rate 3 pkts/sec,  414 bytes/sec&#xA;      1 minute drop rate, 0 pkts/sec&#xA;      5 minute input rate 3 pkts/sec,  716 bytes/sec&#xA;      5 minute output rate 4 pkts/sec,  520 bytes/sec&#xA;      5 minute drop rate, 0 pkts/sec&#xA;DTS-ASA#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then check your ping to google's DNS...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DTS-ASA# ping 8.8.8.8&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 10/18/20 ms&#xA;DTS-ASA#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If not, be sure you can ping your default-gw...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DTS-ASA# sh route&#xA;&#xA;Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area&#xA;       * - candidate default, U - per-user static route, o - ODR&#xA;       P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 74.xx.xx.230 to network 0.0.0.0&#xA;&#xA;C    74.xx.xx.230 255.255.255.248 is directly connected, outside&#xA;C    10.1.10.0 255.255.255.0 is directly connected, inside&#xA;d*   0.0.0.0 0.0.0.0 [1/0] via 74.xx.xx.230, outside          &amp;lt;------&#xA;DTS-ASA#&#xA;DTS-ASA# ping 74.xx.xx.230&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-09-25T20:04:02.220" LastActivityDate="2013-09-25T20:04:02.220" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3370" PostTypeId="1" CreationDate="2013-09-25T13:09:14.827" Score="7" ViewCount="229" Body="&lt;p&gt;Is there any real difference over placing Access Points over Wireless Extenders? How do you know when to use one or the other?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="2349" LastEditDate="2013-09-25T19:41:19.010" LastActivityDate="2013-09-25T19:41:19.010" Title="Access Point over Wireless Extenders" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3372" PostTypeId="2" ParentId="3370" CreationDate="2013-09-25T14:43:29.793" Score="11" Body="&lt;p&gt;My personal recommendation is to never use extenders/repeaters if you can avoid it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeaters do just what they say and repeat a signal they hear.  This reduces the overall performance of wireless, as wireless is a shared medium which means only one device can be &quot;talking&quot; in the same area at the same time.  Each frame (in both directions) is now transmitted twice, taking up twice the air time and halving the actual throughput you can achieve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, repeaters can introduce or make worse other problems.  They are really only suited to home environments with few devices and air time to spare, not in a campus environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional access points add extra capacity by using multiple channels and creating some separation between devices on the same channel. Keep in mind that a campus wireless deployment should be planned properly before implementation.  It is not something you can just &quot;throw in&quot; like you may have been able to get away with 5-10 years ago.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-09-25T15:04:03.813" LastActivityDate="2013-09-25T15:04:03.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3373" PostTypeId="1" AcceptedAnswerId="3374" CreationDate="2013-09-25T17:24:02.140" Score="6" ViewCount="491" Body="&lt;p&gt;As we know that URIB (Unicast RIB) holds various route entries that have been added by routing protocols running on the box (like BGP, EIGRP, etc). Typically, &quot;show ip route&quot; woudl display all entries that are present in the URIB. Does anyone know if we can access these using (SNMP) MIB objects? Can someone point me to the RFC/draft, if there is one?&lt;/p&gt;&#xA;" OwnerUserId="2450" LastEditorUserId="8499" LastEditDate="2018-12-26T05:05:49.963" LastActivityDate="2018-12-26T05:05:49.963" Title="Do we have an SNMP MIB for URIB" Tags="|routing|snmp|management|rfc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3374" PostTypeId="2" ParentId="3373" CreationDate="2013-09-25T18:01:06.080" Score="7" Body="&lt;p&gt;Have you taken a look at the &lt;code&gt;ipRouteTable&lt;/code&gt; OID in the RFC1213-MIB?  &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.4.21#oidContent&quot;&gt;(OID  number 1.3.6.1.2.1.4.21)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I utilize this to pull the routing table out of several devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is referenced by &lt;a href=&quot;http://www.ietf.org/rfc/rfc1213.txt&quot;&gt;RFC 1213&lt;/a&gt; which, on page 33, gives the following information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      -- The IP routing table contains an entry for each route&#xA;      -- presently known to this entity.&#xA;&#xA;      ipRouteTable OBJECT-TYPE&#xA;          SYNTAX  SEQUENCE OF IpRouteEntry&#xA;          ACCESS  not-accessible&#xA;          STATUS  mandatory&#xA;          DESCRIPTION&#xA;                  &quot;This entity's IP Routing table.&quot;&#xA;          ::= { ip 21 }&#xA;&#xA;      ipRouteEntry OBJECT-TYPE&#xA;          SYNTAX  IpRouteEntry&#xA;          ACCESS  not-accessible&#xA;          STATUS  mandatory&#xA;          DESCRIPTION&#xA;                  &quot;A route to a particular destination.&quot;&#xA;          INDEX   { ipRouteDest }&#xA;          ::= { ipRouteTable 1 }&#xA;&#xA;      IpRouteEntry ::=&#xA;          SEQUENCE {&#xA;              ipRouteDest&#xA;                  IpAddress,&#xA;              ipRouteIfIndex&#xA;                  INTEGER,&#xA;              ipRouteMetric1&#xA;                  INTEGER,&#xA;              ipRouteMetric2&#xA;                  INTEGER,&#xA;              ipRouteMetric3&#xA;                  INTEGER,&#xA;              ipRouteMetric4&#xA;                  INTEGER,&#xA;              ipRouteNextHop&#xA;                  IpAddress,&#xA;              ipRouteType&#xA;                  INTEGER,&#xA;              ipRouteProto&#xA;                  INTEGER,&#xA;              ipRouteAge&#xA;                  INTEGER,&#xA;              ipRouteMask&#xA;                  IpAddress,&#xA;              ipRouteMetric5&#xA;                  INTEGER,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-09-25T18:01:06.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3375" PostTypeId="1" AcceptedAnswerId="3376" CreationDate="2013-09-25T20:24:11.297" Score="6" ViewCount="7901" Body="&lt;p&gt;I just got my outside vlan configured up-and-running &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3364/cannot-get-cisco-asa-5505-properly-configured&quot;&gt;See Post Here&lt;/a&gt;.  I was able to get vlan 2 pinging to the internet 8.8.8.8 specifically.  However, now I honestly think I am misunderstanding what parameters I should be using ...  Here is my config so far:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.1.10.100 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 74.xx.xx.225 255.255.255.248&#xA;!&#xA;ftp mode passive&#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 10 10.1.10.0 255.255.255.0&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;route outside 0.0.0.0 0.0.0.0 74.xx.xx.230 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;http server enable&#xA;http 10.1.10.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;dhcpd auto_config outside&#xA;!&#xA;dhcpd address 10.1.10.104-10.1.10.254 inside&#xA;dhcpd enable inside&#xA;!&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA; policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc&#xA;  inspect xdmcp&#xA;  inspect sip&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect ip-options&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, I have a PC connected and assigned &lt;code&gt;10.1.10.104&lt;/code&gt;.  So dhcp is working correctly .. It just can't see the outside world!!&lt;/p&gt;&#xA;" OwnerUserId="2758" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-09-26T09:07:41.803" Title="Cisco ASA cannot get &quot;inside&quot; vlan to internet through &quot;outside&quot; vlan" Tags="|cisco|routing|cisco-asa|firewall|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3376" PostTypeId="2" ParentId="3375" CreationDate="2013-09-25T21:30:29.747" Score="5" Body="&lt;p&gt;All you should need is...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;no nat (inside) 10 10.1.10.0 255.255.255.0&#xA;dhcpd dns 75.75.75.75 75.75.76.76&#xA;end&#xA;wr mem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since your inside interface is already a higher security level than outside interface and you are nating everthing, you should not need an internal or external acl.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do a release / renew to pick up the dns setting, and then start surfing...&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-09-25T21:30:29.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3377" PostTypeId="1" AcceptedAnswerId="3380" CreationDate="2013-09-25T22:14:44.427" Score="21" ViewCount="24558" Body="&lt;p&gt;My company has received a large industrial machine with many networked devices on it. Unfortunately the engineer in charge has used a public IP address range on the machine. I'm in Europe. The chosen address range belongs to a USA company. Let's say it's 143.166.0.0 (which actually belongs to Dell).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume I don't connect the machine to our company LAN (for now) but I do connect my laptop to it to program a device - say 143.166.0.1. Let's also say that my laptop wireless network adaptor is connected to the company LAN and hence to the Internet. Now I have two possible routes to two devices that share an address. The local one I want and the Dell address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, &quot;How worried should I be?&quot; &lt;strong&gt;What should and would happen in this case?&lt;/strong&gt; My guess is that the local machine would respond first and that I might get away with it but that eventually I will get bitten. Incidentally, I've seen public ip addresses on other machines too. It seems the engineers either don't understand private addressing or don't expect their machine to be connected to the wider world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas / comments? (that don't involve violence to the machine engineer)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Epilogue&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We found an interesting problem that has forced us to change the IP addresses to private.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One of the devices on the machine is programmed via Internet Explorer using an ActiveX component. This device will try to push data to the ActiveX 'listener' (rather than the usual browser mode of requesting data from a remote server).&lt;/li&gt;&#xA;&lt;li&gt;Our Active Directory configuration downloads security policies to our computers at login. Included in the policy is the list of trusted sites. These include:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Approved company addresses.&lt;/li&gt;&#xA;&lt;li&gt;Various external addresses such as our bank.&lt;/li&gt;&#xA;&lt;li&gt;Private addresses 192.168.0.0/16, 172.16.0.0/20 and 10.0.0.0/24.&lt;/li&gt;&#xA;&lt;li&gt;Everything else is blocked.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Due to the security policy, the ActiveX component never received any data as the incoming traffic is blocked by the security policy!&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This has forced me to have the vendor change the addresses to 172.16.0.0. I'll sleep easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for all the interest.&lt;/p&gt;&#xA;" OwnerUserId="2763" LastEditorUserId="2763" LastEditDate="2013-09-28T00:03:00.350" LastActivityDate="2013-09-28T00:03:00.350" Title="Risks of using non-private IP addresses internally?" Tags="|routing|ipv4|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3378" PostTypeId="2" ParentId="3377" CreationDate="2013-09-25T22:24:41.257" Score="0" Body="&lt;p&gt;Below, is my &lt;em&gt;edited&lt;/em&gt; answer - which originally didn't get that it wasn't &quot;owned&quot; IP space, but instead someone else's space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as &lt;em&gt;it's your&lt;/em&gt;  space, it doesn't matter.  An IP address is an ip address.  Your applications don't know what's private, and what's public.  If you have space, you might even have some subnets which are &quot;internal&quot; and some which are &quot;externally&quot; accessible - controllable with the usual routing controls, firewalls, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the public space on the inside means is that you don't have to worry about NAT to go in or out of your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;If it's NOT your own IP space, but someone else's, it can technically work.  However you won't ever be able to reach their space without a lot of extra effort and confiuration - such as tunneling, NAT or double NAT, or more specific routing.  It would be best to suggest readdressing your network, in writing, and detail how to do it, how it can be managed, etc.  Get it in writing, then if there's ever problems, you can pull out your &quot;I told you so email&quot;.&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The down votes below were from my original answer, in which I misread the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks everyone.&lt;/p&gt;&#xA;" OwnerUserId="892" LastEditorUserId="892" LastEditDate="2013-09-26T23:26:04.993" LastActivityDate="2013-09-26T23:26:04.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3379" PostTypeId="2" ParentId="3377" CreationDate="2013-09-25T22:32:58.380" Score="12" Body="&lt;p&gt;The only issue will be an inability to talk to the real (internet) machines with those addresses.  Of course, you can put a firewall (&quot;nat box&quot;) between your network and this thing to make it look like private addresses to your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This sort of thing has popped up all over the place for many years due to people being lazy and using &quot;unassigned&quot; addresses for their own purposes; now that they're assigned, it presents a small problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Edit: for the record, I never renumbered my home network. but I'm not likely to ever need to talk to the people who now have that address space. 15 years and counting...]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-09-25T22:32:58.380" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3380" PostTypeId="2" ParentId="3377" CreationDate="2013-09-25T22:32:59.677" Score="21" Body="&lt;p&gt;Short answer: Duplicating allocated public addresses is a bad idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Slightly longer answer: Leaving aside the routing issues for the moment, it's not safe to assume that you will never need to reach this machine from some place other than a directly attached cable, or that public or private address allocations are static and will never change. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The remote-access issues are obvious: The global Internet thinks 143.166/16 is in one place, and you want it to be in another. Routers won't go to your machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And ownership could change. Even if this address weren't assigned to Dell, it could be allocated to them in the future. Dell does have this address today, but someone else might tomorrow, with a different route. Who knows? Your organization might even buy that address block, with even more routing adventures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bottom line: Don't assume duplicate IPs can safely be walled off forever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the routing, your wired interface would prefer the local address over Dell's. Your wired interface would send an ARP request for that address and get it directly from the industrial machine, no gateway required. Thereafter, packets destined to that address would use the destination MAC address of the industrial machine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That will work fine as you only use a cable for access, and as long as you never need to reach this machine from someplace else, and as long as the global routing table remains static. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's a lot of ifs. You're better off avoiding the issue by using either a unique public address or something out of the private address pool.&lt;/p&gt;&#xA;" OwnerUserId="2688" LastActivityDate="2013-09-25T22:32:59.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3385" PostTypeId="2" ParentId="3377" CreationDate="2013-09-26T10:40:10.447" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is, &quot;How worried should I be?&quot; What should and would&#xA;  happen in this case? My guess is that the local machine would respond&#xA;  first and that I might get away with it but that eventually I will get&#xA;  bitten.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As a side note, it is not about who answers first. If you give your computer an address in the same subnet, the traffic will go straight to the machine, no routers involved. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you would use routing, entering a route to 143.166.0.0/16 on some internal router(s) in your network, they will prefer this route over their (default?) route to the internet. This happens because the &quot;longest prefix match&quot; is preferred, ie. the most specific route is chosen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your correct about the net result, the 143.166.0.0/16 part of the internet will be unreachable for you or your network should you install the route in your internal routers. /16 seems a bit large for this issue, the smaller the subnet you route to, the smaller the chance of getting bitten.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-09-26T10:40:10.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3386" PostTypeId="1" CreationDate="2013-09-26T12:23:31.453" Score="5" ViewCount="1088" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5MX2J.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host1 wants to join Multicast group as IGMPv3 include (G,S). The same group and source Host2 send as Exclude(G,S) report. what process done in switch?  &lt;/p&gt;&#xA;" OwnerUserId="2716" LastEditorUserId="775" LastEditDate="2013-09-26T12:32:41.247" LastActivityDate="2013-10-27T05:06:58.277" Title="IGMP snooping in iptv" Tags="|switch|ethernet|ipv4|multicast|protocol-theory|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3387" PostTypeId="1" AcceptedAnswerId="3394" CreationDate="2013-09-26T13:06:13.103" Score="2" ViewCount="299" Body="&lt;p&gt;I have my topology as follows ...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;----------------------&#xA;|                    |&#xA;|     LAN-1          |&#xA;| (192.168.2.0/24)   |&#xA;|                    |&#xA;|                    |&#xA;|                    |&#xA;---------------------|               &#xA;|     INTERNET       | &#xA;|                    |&#xA;|                    |&#xA;|                    |&#xA;|                    |&#xA;---------------------- &#xA;|     LAN-2          |&#xA;|  (192.168.2.0/24)  |&#xA;|                    |&#xA;|                    |&#xA;|                    |&#xA;|                    |&#xA;----------------------       &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here from the above diagram we can observe &lt;code&gt;2 LANS&lt;/code&gt; are connected to INTERNET.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) &lt;code&gt;LAN-1&lt;/code&gt; is having the network 192.168.2.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) &lt;code&gt;LAN-2&lt;/code&gt; is having the  same network as LAN-1 192.168.2.0/24&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;My Requirement&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;My requirement is i want to access the deivces from LAN-1 to LAN-2 by using VPN .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;For Example&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I want to ping 192.168.2.4 from LAN-1 to 192.168.2.10 which is in LAN-2 . But the ping is always going to my own network as my own network is havnig the destination network . How can i overcome this situation .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Note :&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I know  , I should always make sure that 2 LANS should be configured with different subnets .&#xA;&#xA;&#xA;I don't want to do that , &#xA;&#xA;Any solution for this ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2736" LastActivityDate="2013-09-29T00:30:44.743" Title="Need Clarification Regarding VPN and Routing" Tags="|routing|vpn|protocol-theory|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3388" PostTypeId="2" ParentId="3355" CreationDate="2013-09-26T14:29:02.440" Score="3" Body="&lt;p&gt;Wireless solutions may well be cheaper for low-density deployments (rural, or &quot;back country&quot;), and perhaps under ideal circumstances faster (throughput- rather than latency-wise) than 100 Mbps legacy speeds over access fiber.&lt;/p&gt;&#xA;" OwnerUserId="56" LastActivityDate="2013-09-26T14:29:02.440" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3389" PostTypeId="2" ParentId="3387" CreationDate="2013-09-26T14:35:50.927" Score="2" Body="&lt;p&gt;Bridging and Proxy ARP. OpenVPN should be capable of providing this with a host on each end, probably also any Cisco with irb configured between an ethernet interface and an ipsec tunnel.&lt;/p&gt;&#xA;" OwnerUserId="56" LastActivityDate="2013-09-26T14:35:50.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3391" PostTypeId="1" AcceptedAnswerId="3393" CreationDate="2013-09-26T18:25:15.810" Score="5" ViewCount="6200" Body="&lt;p&gt;I am working with an ASA-5505.  I am trying to set aside a set of 10 IP addresses.   Currently I have internally 10.1.10.100 - 254 set for my current vlan -- &lt;code&gt;vlan 1&lt;/code&gt;, and all equipment attached is receiving it's IP via dhcp from the ASA.   I would like to reserve the group &lt;code&gt;10.1.10.200 through .210&lt;/code&gt; for static IPs ..  For servers, equipment and whatnot.  Is it possible to to this on the ASA?  Would I have to set up a separated vlan on it's own switch?  I have googled and googled, however I cannot piece together exactly what I am asking.  Is it possible to reserve these IP's from the dhcp so they don't get leased out and possibly change/conflict with other appliances on the network?  Any help appreciated from this networking noob..&lt;/p&gt;&#xA;" OwnerUserId="2758" LastActivityDate="2014-03-27T06:36:12.193" Title="Obtain Static IP set in DHCP on Cisco ASA" Tags="|ipv4|cisco-asa|dhcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3393" PostTypeId="2" ParentId="3391" CreationDate="2013-09-26T18:42:42.333" Score="6" Body="&lt;p&gt;The ASA does not have a means of excluding addresses (or adding reservations.) The only option is to use addresses outside the DHCP scope (i.e. adjust the range to not include your statics.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ccie-or-null.net/2013/02/06/dhcp-reservations-on-a-cisco-asa-5505-maybe/&quot;&gt;This&lt;/a&gt; suggests a static arp entry may steer dhcp assignments, but a) it's not a documented/supported feature, and b) others report it not working.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-09-26T18:42:42.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3394" PostTypeId="2" ParentId="3387" CreationDate="2013-09-26T18:59:19.430" Score="5" Body="&lt;p&gt;Renumbering is the right answer.  If you don't want to do that, then implement NAT in both directions.  This would allow you to keep the existing IPs in both locations.  However, each side would &quot;look&quot; like a different subnet from the other side.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2013-09-26T18:59:19.430" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3395" PostTypeId="2" ParentId="3313" CreationDate="2013-09-26T20:29:10.887" Score="6" Body="&lt;p&gt;You seem to be going about this the right way (which is the only real question I can find in your post), but I will throw in a few more considerations and/or options.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;With this many APs deployed and as many users as you expect (and the other non-802.11 devices they bring with such as bluetooth), what is the noise floor in 2.4GHz?  It may be that your noise floor is in the -70 to -80 range, which means that &quot;usable&quot; signal outside the room is nominal.&lt;/li&gt;&#xA;&lt;li&gt;You mentioned RF paint (or mesh), behind the APs.  Another option to consider is using it on all walls and deploying two APs per room (for redundancy and extra capacity).  You may also need to use it on ceilings of rooms below.  However, test any product before using it widely as some do not work as advertised.&lt;/li&gt;&#xA;&lt;li&gt;You mention that your transmit power is  set to the lowest setting (2dBm) and your antenna is 6dBi.  Since you can't turn down the transmit power anymore, you could consider a lower gain antennas or use &lt;a href=&quot;http://www.terra-wave.com/shop/accessories-attenuators-c-1017_1019_98.html&quot; rel=&quot;noreferrer&quot;&gt;attenuators&lt;/a&gt; to further decrease the signal strength.  You will want to make sure that you are able to produce enough signal for a good connection (and high data rates) for a range of devices that will likely be found in the room.&lt;/li&gt;&#xA;&lt;li&gt;Test. Test. Test.  High density deployments are a challenge, and the challenges change all the time as technology and the types of devices users bring into the environment are always changing.  Unfortunately, you can't just set it in place and walk away.&lt;/li&gt;&#xA;&lt;li&gt;Realize that there will be problems and issues.  This is just a fact of life in an environment where you don't have control over devices that will be brought onto your wireless network. Keep a list of device details that have been reported as having issues (type, make, wireless chipset, driver version, OS, what steps resolved the issue, etc) as this will allow you to start finding trends and general solutions so you can provide information (i.e. &quot;try these steps&quot; or &quot;avoid this hardware&quot;) to your support staff and/or end users.&lt;/li&gt;&#xA;&lt;li&gt;Subscribe to mailing lists and utilize resources such as forums and industry blogs regularly to keep aware of problems that might be the result of OS updates or other problems.  Some examples: &lt;a href=&quot;http://www.educause.edu/discuss/networking-and-emerging-technologies/wireless-local-area-networking-constituent-group&quot; rel=&quot;noreferrer&quot;&gt;Educause wireless-lan mailing list&lt;/a&gt; (probably applies since you are an education organization of some sort), &lt;a href=&quot;http://community.arubanetworks.com/t5/Discuss/ct-p/discuss&quot; rel=&quot;noreferrer&quot;&gt;Aruba Airheads forums&lt;/a&gt;, &lt;a href=&quot;http://community.ubnt.com/t5/custom/page/page-id/Forums&quot; rel=&quot;noreferrer&quot;&gt;Ubiquiti forums&lt;/a&gt;, &lt;a href=&quot;https://supportforums.cisco.com/community/netpro/wireless-mobility&quot; rel=&quot;noreferrer&quot;&gt;Cisco Wireless-Mobility support forums&lt;/a&gt;, &lt;a href=&quot;http://www.theruckusroom.net/&quot; rel=&quot;noreferrer&quot;&gt;Ruckus Room&lt;/a&gt; (while a number of these are vendor sites, there can be very good information on them and many wireless problems will apply to other vendor environments as well).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-09-26T20:29:10.887" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3396" PostTypeId="2" ParentId="3386" CreationDate="2013-09-27T04:31:26.357" Score="2" Body="&lt;p&gt;Generally speaking, for IGMPv3 to work correctly in an IGMP snooping environment, all devices should support IGMPv3 (even if they are treating IGMPv3 joins as IGMPv2 joins).  This includes the source/router, the host and all devices in between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switches doing IGMP snooping do not support IGMPv3, this can potentially cause problems, but this will vary depending on the vendor and/or version of code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Someone please correct the below if I am wrong, as I have not tested this setup, however I believe my understanding is sound. A bit concerned because I feel I confused myself in trying to type it up.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, assuming the switch that is doing IGMP snooping supports IGMPv3, and that both &lt;em&gt;G1,S1&lt;/em&gt; (Host1's include) and &lt;em&gt;G2,S2&lt;/em&gt; (Host2's exclude) are the same, then it should forward all multicast for that group down to the hub (no matter the source).  Since a hub then repeats all traffic on all ports, this results in both hosts receiving all traffic for the multicast group and requiring both hosts to ignore unwanted traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;em&gt;G1/G2&lt;/em&gt; are the same and &lt;em&gt;S1/S2&lt;/em&gt; are different, then all multicast traffic for the group except traffic sourced from &lt;em&gt;S2&lt;/em&gt; should be forwarded to the hub.  This would require Host1 to to ignore unwanted traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;em&gt;G1,S1&lt;/em&gt; is different from &lt;em&gt;G2,S2&lt;/em&gt;, then all traffic for multicast group &lt;em&gt;G1&lt;/em&gt; from source &lt;em&gt;S1&lt;/em&gt; and all traffic for multicast group &lt;em&gt;G2&lt;/em&gt; except from source &lt;em&gt;S2&lt;/em&gt; should be forwarded to the hub.  This would again require both hosts to ignore unwanted traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reasoning behind this is that this IGMP snooping switch will have separate entries (that contain their respective group memberships along with their include or exclude filters) for both hosts on the interface going towards the hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, the hosts should ignore the unwanted multicast, the same as if they were in an environment without IGMP snooping where all multicast is forwarded.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-09-27T04:31:26.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3397" PostTypeId="2" ParentId="3387" CreationDate="2013-09-27T05:14:19.367" Score="-1" Body="&lt;p&gt;if you dont want to change change your addressing scheme then best possible solution is the usage of NAT&lt;/p&gt;&#xA;" OwnerUserId="2775" LastActivityDate="2013-09-27T05:14:19.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3398" PostTypeId="1" CreationDate="2013-09-27T05:34:51.170" Score="5" ViewCount="2220" Body="&lt;p&gt;Is there any methods in cisco switches (without using extra devices or softwares)to detect and prevent the unauthorised access points connected? I found a method using wireless lan controller (WLC). But some one said that there is another method using commands to block the unauthorised access points. Is there any such methods?&lt;/p&gt;&#xA;" OwnerUserId="2775" LastEditorUserId="775" LastEditDate="2013-09-27T06:59:29.917" LastActivityDate="2013-10-25T05:59:22.857" Title="Cisco commands to find rogue access point connected" Tags="|cisco|wireless|security|wlc|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3399" PostTypeId="2" ParentId="3398" CreationDate="2013-09-27T09:24:33.520" Score="5" Body="&lt;p&gt;Try with &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/port_sec.html&quot; rel=&quot;noreferrer&quot;&gt;Port Security&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port security allows you to specify a maximum number of MAC addresses per interface and a security policy if the maximum number of addresses is reached. Since an AP is a L2 device your switch will learn multiple MAC addresses from a single ethernet interface (as if it was a switch).&lt;/p&gt;&#xA;" OwnerUserId="2663" LastActivityDate="2013-09-27T09:24:33.520" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3401" PostTypeId="2" ParentId="3387" CreationDate="2013-09-27T13:23:48.697" Score="1" Body="&lt;p&gt;You will need double NATing to achieve this without changing IP addresses. You can not ping an IP that is in your LAN and expect it to reach somewhere else. As long as you are part of a LAN and communicate locally, your traffic to IP address in 192.168.2.0/24 will always go to your local network. As mentioned above, you will need two IP ranges lets say 192.168.102.0/24 and 192.168.202 that will be used for double NATing like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;LAN1 (source:192.168.2.100, destination:192.168.202.100) -------&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;LAN1 Gateway Router which will do NATing and VPN.&#xA;(change source:192.168.102.100,destination:192.168.202.100) ---------------&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;LAN2 Gateway Router which will terminate VPN and do NATing (source:192.168.102.100,change destination:192.168.2.100) ------------------------------------------------------&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Packet reaches LAN2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The return path will work similarly:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;LAN2 (source:192.168.2.100, destination:192.168.102.100) ------&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;LAN2 Gateway Router which will do NATing and VPN.&#xA;(change source:192.168.202.100,destination:192.168.102.100) --------------&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;LAN1 Gateway Router which will terminate VPN and do NATing (source:192.168.202.100,change destination:192.168.2.100) -----------------------------------------------------&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Packet reaches LAN1.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As you can see, LAN1 appears to LAN2 as 192.168.102.0/24&#xA;and LAN2 appears to LAN1 as 192.168.202.0/24. &lt;/p&gt;&#xA;" OwnerUserId="2440" LastActivityDate="2013-09-27T13:23:48.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3402" PostTypeId="1" CreationDate="2013-09-27T16:25:44.630" Score="3" ViewCount="1384" Body="&lt;p&gt;Many of the wireless access points and routers now come with guest based access. However, they place the users on the same network as the private network giving them access to everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need a specific device that separates the two? Or do I need multiple devices and configure vlans&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="509" LastEditDate="2013-09-27T23:17:41.517" LastActivityDate="2013-09-27T23:17:41.517" Title="Setting up a guest network with isolation" Tags="|wireless|vlan|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3403" PostTypeId="2" ParentId="3402" CreationDate="2013-09-27T16:44:35.307" Score="3" Body="&lt;p&gt;This depends very much on your specific situation. Generally, most enterprise access points these days will handle multiple SSIDs and tag the different SSIDs as different VLANs, which you can then route and isolate as you would normally. If you are dealing with smaller-scale equipment such as Cisco's &quot;small-business&quot; line, unless the device offers some way to configure multiple SSIDs into multiple subnets (such as OpenWrt does), you'd have to use multiple access points plugged into separate switch ports.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-09-27T16:44:35.307" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3404" PostTypeId="1" AcceptedAnswerId="3411" CreationDate="2013-09-28T03:36:11.843" Score="2" ViewCount="1241" Body="&lt;p&gt;I might be over thinking things, but I'm lost.  I'm trying to modernize our farm.  Cable broadband comes into the farmhouse.  Spread throughout our multi-acre property, we have a total of 7 buildings (including farmhouse).  I want internet shared to all 7.  I want isolation (at least with some) because there are seasonal workers and/or guests and I don't want different buildings being able to see files in other buildings.  However, I think I want one server available to all buildings.  In fact, it wouldn't be a bad idea to be able to, for example, put an IP camera out at an outbuilding and have it accessible at the house.  So I want security/isolation, but with the ability to modify that as desired (if possible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The distances are too far for CAT, and I can't really trench anyway without incurring unacceptable costs.  So the building-to-building connections have to be wireless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done a reasonable amount of Googling over the past few days and I think I've figured out the hardware for the wireless:  point to multipoint.  One high powered Omni AP on the roof of the house with high powered directional bridges on each building with a wifi router in each to serve their own subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not yet talking about configuration at all.  I'm currently just trying to figure out the hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides the wireless AP/bridges I described above... I think I need a vlan enabled switch and a router on a stick.  &lt;em&gt;What hardware do I require, end-to-end, to have communication between clients of a building and between clients and server in other buildings while blocking communication client-of-one-building with client-of-another?&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="2781" LastEditorUserId="253" LastEditDate="2013-09-30T11:10:00.060" LastActivityDate="2013-09-30T11:10:00.060" Title="Securely sharing access across subnets with point to multipoint wireless" Tags="|wireless|vlan|point-to-point|" AnswerCount="1" CommentCount="1" ClosedDate="2019-04-20T21:41:53.150" ContentLicense="CC BY-SA 3.0" />
  <row Id="3406" PostTypeId="1" CreationDate="2013-09-28T19:09:16.297" Score="4" ViewCount="574" Body="&lt;p&gt;We are going to deploy customer access switches. We can chose between two switch solutions: 1) CISCO 2960S   2) line card WS-X4648 in CISCO 4507R+E (Sup7L-E). Our customers will work with video software and will upload/download media files through the network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found information about 2960S that ports have 4 queues with 2Mb buffers, but I can't find information about those capabilities for WS-X4648.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2960s is cheaper than line card to chassis and we don't realy want insert such card in our chassis, but we worry about possible future problems. 2960s is rather weak switch.&lt;/p&gt;&#xA;" OwnerUserId="904" LastActivityDate="2013-09-30T20:10:59.660" Title="Interface capabilities: CISCO 2960S vs WS-X4648" Tags="|cisco-catalyst|cisco-2960|cisco-4500|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3408" PostTypeId="2" ParentId="3355" CreationDate="2013-09-28T23:24:05.013" Score="6" Body="&lt;p&gt;In the U.S., and I assume world-wide, CableLabs is working on the DOCSIS 3.1 standard. This has a theoretical capacity of up to 10 Gbps over existing hardline coax plant. There are a lot of questions to be answered on deployment though, as far as how much the existing cable plant would have to be conditioned to run at QAM 4096. I worked on new plant that had to be re-worked to allow QAM256 to work efficiently, so for DOCSIS 3.1 to work, the plant would have to be insanely clean. There are a lot of questions to be answered but many of the cable companies are banking on it to compete with the coming Google Fiber/ATT onslaught.&lt;/p&gt;&#xA;" OwnerUserId="2791" LastActivityDate="2013-09-28T23:24:05.013" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3409" PostTypeId="2" ParentId="3387" CreationDate="2013-09-29T00:30:44.743" Score="3" Body="&lt;p&gt;NAT is an option but it's going to be complicated, and overly so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMO the better solution to accomplish this is with VPLS or L2TPv3. Contact your carrier to see if they can provide VPLS or other L2VPN services.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-09-29T00:30:44.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3410" PostTypeId="2" ParentId="3406" CreationDate="2013-09-29T05:25:06.557" Score="2" Body="&lt;p&gt;The selection criteria between the two choices needs to be refined further in your question. If all you care about the throughput on the switch and ignore all other things, you can go with the device that provides more throughput. 4500 switch is a layer 3 switch used for access or distribution (even core for small networks) with huge capabilities and flexibility. It is a modular switch meaning that you add modules based on your needs. For sure it will be more expensive and might be an over kill for your needs if all you need is to add a few servers to your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Buying the 2960S stackable switch on the other hand will be cheaper as it is a layer 2 switch used only for access layer. You can always always buy more switches add stack them together if you need to add more servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please keep in mind that your server performance is not only governed by the access layer switch you will buying. It will depend on the complete path your user data traverses before reaching your servers.&lt;/p&gt;&#xA;" OwnerUserId="2440" LastActivityDate="2013-09-29T05:25:06.557" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3411" PostTypeId="2" ParentId="3404" CreationDate="2013-09-29T07:54:23.290" Score="2" Body="&lt;p&gt;Concepts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN: a logical separation of networked devices (Different IP address ranges as well) on the same switch or multiple switches such that users of one VLAN can not communicate with the users of other VLANs unless there is a router (a layer 3 device) that routes the traffic between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A trunk link: a network link that carries more than one VLAN. The traffic of each VLAN is marked so the other end knows what traffic goes in which VLAN. If the other end is a device that only needs one VLAN, it will take the relevant traffic and ignore the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router on a stick: It is a layer 3 device capable of routing traffic between different VLANs but it has only one physical link. The traffic comes to the router in a trunk on the link and gets routed from one VLAN to other on the same link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UTM: Unified Threat Management box that provides firewall, routing, authentication, anti-malware, web filtering, guest user authentication and more. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your basic requirements are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Internet access in 7 buildings where these buildings are more than 120 meters from each other. You have a main building where internet is available. (UTP cables are not an option for buildings connectivity)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You want a guest access in addition to normal user access in those buildings for temporary users.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You want security cameras installed and their traffic to be isolated from users for security reasons.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You want users of each building to be separated from users of other buildings such that you can control who sees what.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You need a central server available to users of your choice.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I am assuming that your users in each building will be both wired and wireless so they can utilize internet on their mobile phones as well.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In terms of the hardware, you will need the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;A switch in each building. This switch can be layer 2 switch (only VLANs with no local routing) or it could be a layer three capable switch that will do routing as well. The selection criteria depends on what type of setup you are looking for. In case of layer 2 switch, all traffic will always be sent over the wireless links to the gateway in the main building if the traffic is junk causing unnecessary traffic on your wireless links eating up your valuable bandwidth unless you have high capacity wireless links. Layer 3 switch on the other hand can be setup to filter some traffic locally and block any unnecessary traffic over the wireless links. Each VLAN will have it's own subnet and the gateway of each VLAN will have to be on the local switch in case of layer 3 switches in each site or on the central router/firewall in case you installed layer 2 switches in site.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For the wireless setup, you will need one or two Omni directional Antenna Access Points depending on the wireless capacity of the APs, location of the buildings to be connected and possible obstacles in the line of sight between the buildings. You should get a professional do a survey for you before installing the wireless network. The APs that will connect more than one building or the buildings where you will have more than one VLAN must support multi VLAN trunking so that you could have each site in one  or more VLANs instead of one flat VLAN for all sites.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You will need a layer 3 device with firewall capabilities in the main site that will give you control on which traffic/user is allowed to go where. The &lt;a href=&quot;http://www.sophos.com/en-us/products/free-tools/sophos-utm-home-edition.aspx&quot; rel=&quot;nofollow&quot;&gt;SOPHOS&lt;/a&gt; free box is a good choice if your number of users are less than 50. Else you will have to buy another one of your choice that gives you the desired functionality. I would suggest that you go for a UTM to make it easier on your self.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You will need a server for whatever the reason you want it for as per your needs and put it on the switch of main building. It is a good idea that you put it on a separate VLAN (with different IP range) to have more control on what users are allowed to access your server from different VLANs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You will need indoor access points for each building either with a controller or without. The controller will help in managing the APs if you have many and require a lot of changes on the wireless network frequently. I don’t think that it is the case in your case and you can do without a controller. Just keep wireless users on different VLANs from the wired users. Also, you can have different wireless VLAN for temporary guest access.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You will need to do internal cabling and have the patch panels and cabinets as your budget allows.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is the basic design of your requirements.&lt;/p&gt;&#xA;" OwnerUserId="2440" LastEditorUserId="2440" LastEditDate="2013-09-30T04:28:25.923" LastActivityDate="2013-09-30T04:28:25.923" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3419" PostTypeId="1" CreationDate="2013-09-30T09:53:11.427" Score="0" ViewCount="214" Body="&lt;p&gt;In Igmp snooping switch receives an Igmp leave report? Is it possible to change the timeout value in Igmp snooping switch?&lt;/p&gt;&#xA;" OwnerUserId="2716" LastEditorUserId="8499" LastEditDate="2018-03-19T15:46:01.050" LastActivityDate="2021-11-20T10:21:37.727" Title="Igmp snooping based multicast forwarding" Tags="|switch|multicast|igmp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3420" PostTypeId="2" ParentId="3309" CreationDate="2013-09-30T10:00:40.187" Score="6" Body="&lt;h2&gt;Summary&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is this on the right track?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes... very similar to the link in the comment...  As you mentioned, you only need to do two things...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configure NAT overload on the global interface&lt;/li&gt;&#xA;&lt;li&gt;Put a static route in the VRF for the speed test server...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Details&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Assume your speed test server is at 172.16.10.5... and you're trying to ping it from a CE switch in VRF01.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  To Speed Test Server&#xA;  (172.16.10.5, NH 172.16.1.1)&#xA;   &amp;lt;-------&#xA;&#xA;Fa0/0 (global table) +-----+ Fa1/0 (VRF01)             Fa0/17 +-----+&#xA;        172.16.1.200 |     | 192.0.2.1/24      192.0.2.100/24 |     |&#xA;---------------------| PE1 |----------------------------------| CE1 |&#xA;                     |     |                                  |     |&#xA;                     +-----+                                  +-----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;PE1's Config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!!! PE1 Config&#xA;!&#xA;hostname PE1&#xA;!&#xA;ip vrf VRF01&#xA; rd 100:1&#xA; route-target export 100:1&#xA; route-target import 100:1&#xA;!&#xA;interface FastEthernet0/0&#xA; description global table interface&#xA; ip address 172.16.1.200 255.255.255.0&#xA; no ip proxy-arp&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA;!&#xA;!&#xA;interface FastEthernet1/0&#xA; ip vrf forwarding VRF01&#xA; ip address 192.0.2.1 255.255.255.0&#xA; no ip proxy-arp&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;ip route vrf VRF01 172.16.10.5 255.255.255.255 172.16.1.1 global&#xA;!&#xA;!! Insert other PE1 global routing configs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;CE1's config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!!! CE1 Config&#xA;!&#xA;hostname CE1&#xA;!&#xA;interface FastEthernet0/17&#xA; switchport access vlan 11&#xA; switchport mode access&#xA; switchport nonegotiate&#xA;!&#xA;!&#xA;interface Vlan11&#xA; ip address 192.0.2.100 255.255.255.0&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 192.0.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ping proof...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CE1#ping 172.16.10.5&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 172.16.10.5, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms&#xA;CE1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NAT entry...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE1#sh ip nat trans&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;icmp 172.16.1.200:3    192.0.2.100:3      172.16.10.5:3      172.16.10.5:3&#xA;PE1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-09-30T10:00:40.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3421" PostTypeId="2" ParentId="3329" CreationDate="2013-09-30T15:11:43.707" Score="2" Body="&lt;p&gt;The IP protocol provides the foundation to support the notion of subnets and routing. This means IP doesn't assume your destination is on the same network as you-if it's not, your traffic needs to be forwarded through an intermediary device such as a router. IP has TTL and Hop Limit fields that support this.&lt;/p&gt;&#xA;&lt;p&gt;Ethernet assumes that the destination MAC is directly reachable when data is shipped out of its interface. Ethernet was originally designed when the most common way to connect computers in a network was through a physical bus topology. Even though almost all wired Ethernet traffic is switched now, logically, it still works like a bus topology. So the underlying assumption with Ethernet is that the node with the destination MAC is physically on the same network as the source. There is no such assumption with IP.&lt;/p&gt;&#xA;&lt;p&gt;I guess you could &amp;quot;hack&amp;quot; Ethernet into doing subnets and routing. But you might as well engineer a protocol that doesn't rely on the low-level details and assumptions of Ethernet, and that's why we have IP.&lt;/p&gt;&#xA;" OwnerUserId="2800" LastEditorUserId="82313" LastEditDate="2022-02-11T16:37:40.750" LastActivityDate="2022-02-11T16:37:40.750" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="3422" PostTypeId="2" ParentId="3419" CreationDate="2013-09-30T15:27:14.237" Score="3" Body="&lt;p&gt;We should be able to configure member leave time in the switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Cisco boxes, we can configured this timer globally or on a vlan-basis: &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/50sg/configuration/guide/multi.html#wp1126514&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/50sg/configuration/guide/multi.html#wp1126514&lt;/a&gt; . &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;##To configure globally&#xA;ip igmp snooping last-member-query-interval time &#xA;&#xA;##To configure on a per-vlan basis:&#xA;ip igmp snooping vlan vlan_ID last-member-query-interval time &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Juniper boxes also support this feature: &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos/topics/task/configuration/igmp-snooping-ex-series-cli.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/en_US/junos/topics/task/configuration/igmp-snooping-ex-series-cli.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend doing some more Google.&lt;/p&gt;&#xA;" OwnerUserId="2450" LastEditorUserId="2450" LastEditDate="2013-09-30T16:31:43.073" LastActivityDate="2013-09-30T16:31:43.073" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3424" PostTypeId="1" AcceptedAnswerId="3444" CreationDate="2013-09-30T20:04:16.140" Score="6" ViewCount="4775" Body="&lt;p&gt;I'm contemplating a 10 Gigabit link between an &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/ps10265/ps10493/Intel_X520_for_Rack.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Intel x520 NIC&lt;/a&gt; and a &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps10903/ps12128/c78-695646_data_sheet.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco SG500X switch&lt;/a&gt;.  These two would be within 5m of one another, so using one of the Cisco SFP+ passive Direct Attach cables like the &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/modules/ps5455/data_sheet_c78-455693.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SFP-H10GB-CUxM&lt;/a&gt; seems an obvious choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IDYwg.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new to spec'ing SFP components.  It's not obvious to me how to determine that the Intel NIC is compatible with this cable and switch.  The Cisco switch supports the Cisco cable.  The Cisco cable is SFF-8431 compliant and so is the Intel NIC.  However, I'm not sure that's sufficient for this to work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the correct way to determine compatibility?&lt;/p&gt;&#xA;" OwnerUserId="2662" LastEditorUserId="8499" LastEditDate="2018-03-21T00:34:28.513" LastActivityDate="2018-03-21T00:34:28.513" Title="What is the correct way to determine SFP+ Direct Attach cable compatibility between switches and NICs?" Tags="|cisco|switch|ethernet|layer1|cable|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3425" PostTypeId="2" ParentId="3406" CreationDate="2013-09-30T20:10:59.660" Score="1" Body="&lt;p&gt;The 2960S has very small buffers.  For loss tolerant protocols like TCP, this isn't a problem. However, iSCSI and FCoE absolutely will not like that. (esp. FCoE)  I don't know what the buffers are for the line-card, but I suspect it'll be in the same range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I like the 2960S as they're cheap (ish) and have lifetime support.  But they're desktop class switches.  I use them in a vmware lab with jumbo-frame iSCSI, hundreds of vlans, etc. and they've not made a mess, yet. (but iSCSI is going to be a problem)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-09-30T20:10:59.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3427" PostTypeId="1" CreationDate="2013-09-30T20:53:16.320" Score="5" ViewCount="650" Body="&lt;p&gt;I'm currently learning IPv6 and they mentioned broadcast is gone in IPv6 and replaced with multicast and unicast. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there some situations where multicast or unicast is better over the other in setups?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="775" LastEditDate="2013-10-01T03:52:48.030" LastActivityDate="2013-10-05T05:24:37.543" Title="IPv6 Multicast vs Unicast" Tags="|ethernet|ipv6|multicast|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3428" PostTypeId="2" ParentId="3427" CreationDate="2013-09-30T21:08:36.540" Score="7" Body="&lt;p&gt;&quot;broadcast&quot; was replaced with more specific multicast methods.  All-station-broadcast would become a huge mess given the available size of IPv6 LANs -- imagine thousands of nodes broadcasting ARPs looking for each other. (it falls apart in IPv4 already)  Multicast Neighbor Discovery limits who hears the requests and answers, in a network with multicast aware hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there are specific link-local addresses to speak to everyone on the link in the same manner as IPv4 broadcast, without using globally routable addresses.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-09-30T21:08:36.540" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="3431" PostTypeId="1" AcceptedAnswerId="3433" CreationDate="2013-09-30T21:33:27.673" Score="2" ViewCount="4027" Body="&lt;p&gt;We've implemented Microsoft NLB before, but it's not a common thing for our environment, consequently I've not looked at the config in a while.  The topology is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDGE == 3750X's (stack of 2) == N5K's (vpc'd together) == Blade switches == servers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking through our existing config.. I see static ARP entries in the 3750 (which make sense to me), and in the N5K I see static MAC address-table entries.  the thing is that there are 3 static ARP entries (all 3 are NLB clients of ours), but only one static MAC address table entry, but all 3 are working without issue.  So it got me thinking.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to include the static MAC address entries in the N5K? I am pretty sure the only contention with NLB was telling the L3 device, that 'yes you can send this unicast response back to this multicast MAC' by making a static ARP entry.  Thanks for any clarification.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="8499" LastEditDate="2018-03-19T19:29:27.490" LastActivityDate="2018-03-19T19:29:27.490" Title="Microsoft NLB - static MAC necessary?" Tags="|cisco|mac-address|arp|cisco-nexus-5k|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3432" PostTypeId="2" ParentId="3427" CreationDate="2013-09-30T23:09:30.533" Score="2" Body="&lt;p&gt;When a node issues a broadcast packet, the packet is replicated to all other hosts on the medium or subnet.  So if you have a 32 port switch, and one node issues a broadcast, it goes out each of the 32 ports.  This takes away potential bandwidth from everyone else, especially if it is overused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast requires that interested parties &quot;subscribe&quot; to a multicaster.  Multicasted traffic only replicates to previously identified subscribed parties, so there is less bandwidth consumed by unwanted traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So multicast is really the better way to go if it is possible and supported by the software and hardware.&lt;/p&gt;&#xA;" OwnerUserId="2800" LastActivityDate="2013-09-30T23:09:30.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3433" PostTypeId="2" ParentId="3431" CreationDate="2013-09-30T23:25:52.580" Score="2" Body="&lt;p&gt;You should not need to manually configure any static MAC address entries in any of your switches for MS NLB to work.  As a point in fact, doing so can break a MS NLB setup as the MS server/cluster can no longer shift instances between links or servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally you would configure IGMP snooping on the Cisco devices and it will learn the hosts who want to be part of the multicast group and the ports they are on.  IOS will then automatically add or remove static multicast entries on the switch as needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rather than your assertion about unicast/multicast response, this limits where the multicast traffic should go.  Normal switch operations would be to flood multicast traffic out of all ports, which isn't generally necessary and only adds unnecessary traffic to a number of devices.  IGMP snooping gives a mapping to the switch of which ports should be sent traffic for the multicast destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend reading (and possibly rereading) documents on MS NLB, Cisco IGMP snooping and general multicast.  Searching in your engine of choice should find you any number of documents.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-09-30T23:25:52.580" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3434" PostTypeId="1" CreationDate="2013-10-01T06:07:02.673" Score="3" ViewCount="158" Body="&lt;p&gt;I am reviewing one of the Cisco ASA configurations and not able to understand the 2nd line with ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list ABC extended permit tcp any host P.Q.R.S eq www //&#xA;access-list DEF extended permit tcp host P.Q.R.S eq www any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not using here NAT for the IP P.Q.R.S, also there is no need of reverse route for service www, as it will maintain the state, then whey they have allowed traffic from source port www?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is mistake, or if it is right, why it is needed?&lt;/p&gt;&#xA;" OwnerUserId="2809" LastEditorUserId="775" LastEditDate="2013-10-01T10:50:57.143" LastActivityDate="2018-04-02T14:32:21.330" Title="Cisco ASA ACL help" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3437" PostTypeId="2" ParentId="3434" CreationDate="2013-10-01T12:53:55.703" Score="2" Body="&lt;p&gt;It depends on the interface's security-level.&#xA;ASA keeps track of a connection.&#xA;There is no need of the 2nd ACL.&lt;/p&gt;&#xA;" OwnerUserId="2090" LastActivityDate="2013-10-01T12:53:55.703" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3439" PostTypeId="2" ParentId="3329" CreationDate="2013-10-01T16:24:33.520" Score="-3" Body="&lt;p&gt;MAC address represents the hardware ones(IDs), its assembled it is constant and different systems in our network made by different vendors have very different range of mac address so that they are difficult to arrange as a network. But using IP address we can arrange the devices in our network in arrange that is simultaneous addresses.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Also we can not send our mac address to outside networks&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="2775" LastEditorUserId="82313" LastEditDate="2022-01-30T19:05:28.670" LastActivityDate="2022-01-30T19:05:28.670" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="3440" PostTypeId="1" CreationDate="2013-10-01T17:27:56.607" Score="4" ViewCount="161" Body="&lt;p&gt;I have a series of radio sites are connected as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A-B-C-D&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sites have the following radios:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A - AP- rocket m5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B -AP, STATION 2x nanostation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C- AP, Station 2x nano station&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D-Station 1 x nano station&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data to be transfered is nearly entirely in one direction- D-&gt;A, with each site producing data and sending it to A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Couple Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What optimizations can be made that allow assyemtrical information to transfer faster? (packet size, Timeouts, etc) &lt;/li&gt;&#xA;&lt;li&gt;What optimizations can be made that will help speed up Daisy chain style connections such as this one?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2813" LastEditorUserId="775" LastEditDate="2013-10-01T23:08:34.430" LastActivityDate="2016-01-07T07:29:38.010" Title="Optimising a Series Asymetrical Wireless Radio Connection" Tags="|wireless|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3442" PostTypeId="1" AcceptedAnswerId="3443" CreationDate="2013-10-01T19:18:44.477" Score="5" ViewCount="1760" Body="&lt;p&gt;I've got a pool of IP's tied to an SSLVPN connection profile that I need to expand.  Currently this is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip local pool LDAPTESTPOOL 192.168.245.101-192.168.245.110 mask 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could I just overwrite this command with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip local pool LDAPTESTPOOL 192.168.245.101-192.168.245.150 mask 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Without impacting users already connected to the connection profile that uses this pool?  Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="76" LastEditDate="2013-10-01T20:34:07.810" LastActivityDate="2013-10-02T04:49:32.047" Title="Expanding local ip pool can be done hot?" Tags="|cisco|sslvpn|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3443" PostTypeId="2" ParentId="3442" CreationDate="2013-10-01T19:55:55.080" Score="3" Body="&lt;p&gt;Since you're not changing the netmask or default gateway I'd expect this not to be a problem at all, but I don't have the means to test this right now.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-10-01T19:55:55.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3444" PostTypeId="2" ParentId="3424" CreationDate="2013-10-01T20:52:12.453" Score="7" Body="&lt;p&gt;I usually check the &lt;a href=&quot;http://www.cisco.com/en/US/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL_6981.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco Gigabit Ethernet Transceiver Modules Compatibility Matrix&lt;/a&gt; and the &lt;a href=&quot;http://www.cisco.com/en/US/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL_6974.html&quot; rel=&quot;noreferrer&quot;&gt;10-Gigabit Ethernet Transceiver Modules Compatibility Matrix&lt;/a&gt;. However, none of them contains any reference to SG500X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway: regarding the switch,  SFP-H10GB-CUxM is listed in the datasheet of the 500 Series as an option for 10G connectivity, so you should have no problem to attach it to the switch. Regarding the NIC, its specification states it supports standard SFF-8431 and according to &lt;a href=&quot;http://www.cisco.com/en/US/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL_6974.html&quot; rel=&quot;noreferrer&quot;&gt;10-Gigabit Ethernet Transceiver Modules Compatibility Matrix&lt;/a&gt; the SFP-H10GB-CUxM does also support SFF-8431 (as you can see next), so they should be able to work toghether. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Regulatory and Standards Compliance&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Standards:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;• GR-20-CORE: Generic Requirements for Optical Fiber and Optical Fiber&#xA;  Cable&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;• GR-326-CORE: Generic Requirements for Single-Mode Optical Connectors&#xA;  and Jumper Assemblies&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;• GR-1435-CORE: Generic Requirements for Multifiber Optical Connectors&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;• IEEE 802.3: 10-Gigabit Ethernet&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;• ITU-T G.709: Interfaces for the Optical Transport Network&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;• ITU-T G.975: GFEC&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;• ITU-T G.975.1: EFEC&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;• SFP+ MSA &lt;strong&gt;SFF-8431&lt;/strong&gt; (Optical Modules, Active Optical Cables, and&#xA;  Passive Twinax cables)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;• SFP+ MSA SFF-8461 (Active Twinax cables)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="76" LastEditorUserId="76" LastEditDate="2013-10-01T21:14:38.020" LastActivityDate="2013-10-01T21:14:38.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3446" PostTypeId="1" AcceptedAnswerId="3447" CreationDate="2013-10-01T21:44:42.840" Score="4" ViewCount="1496" Body="&lt;p&gt;I had just enabled site to site VPN access  ...   I am assuming something got messed up with NAT  ...  It's the strangest thing ..   I cannot find anything wrong through ASDM, or CLI .. Yet, I can ping out of the network, and pings are received by host, replied to, and then blocked by the ASA.  I can get out, but no return traffic ..  Here is my config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Result of the command: &quot;show run&quot;&#xA;&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.1.10.100 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 74.xx.xx.225 255.255.255.248 &#xA;!&#xA;ftp mode passive&#xA;object-group network PPTP-server&#xA;object-group network hst-10.1.10.122&#xA; description VPN-Server&#xA;access-list outside_access_in extended permit tcp any interface outside eq pptp &#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 1 10.1.10.0 255.255.255.0&#xA;static (inside,outside) tcp interface pptp 10.1.10.122 pptp netmask 255.255.255.255 &#xA;access-group outside_access_in in interface outside&#xA;route outside 0.0.0.0 0.0.0.0 74.xx.xx.230 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;http server enable&#xA;http 10.1.10.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto isakmp enable inside&#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 10&#xA; authentication crack&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 20&#xA; authentication rsa-sig&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 30&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 40&#xA; authentication crack&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 50&#xA; authentication rsa-sig&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 60&#xA; authentication pre-share&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 70&#xA; authentication crack&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 80&#xA; authentication rsa-sig&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 90&#xA; authentication pre-share&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 100&#xA; authentication crack&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 110&#xA; authentication rsa-sig&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 120&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 130&#xA; authentication crack&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 140&#xA; authentication rsa-sig&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 150&#xA; authentication pre-share&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;dhcpd dns 75.75.75.75 75.75.76.76&#xA;dhcpd auto_config outside&#xA;!&#xA;dhcpd address 10.1.10.104-10.1.10.254 inside&#xA;dhcpd enable inside&#xA;!&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect pptp &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is slightly irritating, however I am assuming that it's something pretty simple..  Any ideas out there?&lt;/p&gt;&#xA;" OwnerUserId="2758" LastEditorUserId="623" LastEditDate="2013-10-04T15:02:18.147" LastActivityDate="2013-10-04T15:02:18.147" Title="Enabled VPN -- Site to site -- Cannot access internet now .. Cisco ASA 5505" Tags="|cisco-asa|cisco-commands|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3447" PostTypeId="2" ParentId="3446" CreationDate="2013-10-02T01:04:42.333" Score="5" Body="&lt;p&gt;You've added an ACL to the outside interface that doesn't permit ICMP (&quot;ping&quot;), and the default inspection policy doesn't track icmp (no inspect icmp)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(And you've not setup &quot;site to site vpn&quot;. You added an internal PPTP server. Those &lt;code&gt;crypto isakmp policy&lt;/code&gt;'s are only cluttering the config -- if that's actually all of your config.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-10-02T01:04:42.333" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3448" PostTypeId="1" AcceptedAnswerId="3461" CreationDate="2013-10-02T01:46:40.493" Score="3" ViewCount="1731" Body="&lt;p&gt;Been discussing this with people and reading up, would like people's thoughts on whether or not its worth running IPv6 in a VRF or just let it loose in the global routing table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though presently we use a VRF topology for various reasons, for IPv6 I am strongly on the side of running it natively&#xA;- resource consumption (thinking of full internet routing tables in IPv6 in a VRF, yech)&#xA;- no more multiple routing processes per router&#xA;- lots of our present HW that is not going to go EOL in the next year or two struggles with IPv6 in a VRF (3750, 3560) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For purposes of 'mimicking' VRF separation for areas that require it going to bite the bullet and put firewalls where I need, the only alternative (short of mirroring the present VRF topology)  is to go to a nightmare of tunnels and PBRS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess the penny dropped when reading about IPv6 on MPLS 6PE. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thoughts appreciated (especially the ones telling me I'm wrong! its how I learn lol)&lt;/p&gt;&#xA;" OwnerUserId="203" LastEditorUserId="203" LastEditDate="2013-10-02T02:04:53.333" LastActivityDate="2013-11-02T17:09:08.093" Title="IPv6: to VRF or not to VRF" Tags="|bgp|ipv6|mpls|vrf|vrf-lite|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3449" PostTypeId="2" ParentId="3442" CreationDate="2013-10-02T04:49:32.047" Score="0" Body="&lt;p&gt;There is an option to resolve IP conflicts between clients on Cisco IOS. It needs to be configured carefully. from &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/ip_addr/configuration/guide/htdhcpsv.html#wp1122709&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; source:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Configuring a DHCP Database Agent or Disabling Conflict Logging &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Perform this task to configure a DHCP database agent. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Database Agents &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A DHCP database agent is any host (for example, an FTP, TFTP, or rcp&#xA;  server) or storage media on the DHCP server (for example, disk0) that&#xA;  stores the DHCP bindings database. You can configure multiple DHCP&#xA;  database agents, and you can configure the interval between database&#xA;  updates and transfers for each agent.   Automatic bindings are IP&#xA;  addresses that have been automatically mapped to the MAC addresses of&#xA;  hosts that are found in the DHCP database. Automatic binding&#xA;  information (such as lease expiration date and time, interface index,&#xA;  and VPN routing and forwarding [VRF] name) is stored on a database&#xA;  agent. The bindings are saved as text records for easy maintenance.&lt;br&gt;&#xA;  Address Conflicts &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;An address conflict occurs when two hosts use the same IP address.&#xA;  During address assignment, DHCP checks for conflicts using ping and&#xA;  gratuitous Address Resolution Protocol (ARP). If a conflict is&#xA;  detected, the address is removed from the pool. The address will not&#xA;  be assigned until the administrator resolves the conflict.&lt;br&gt;&#xA;  Restrictions &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;We strongly recommend using database agents. However, the Cisco IOS&#xA;  server can run without them. If you choose not to configure a DHCP&#xA;  database agent, disable the recording of DHCP address conflicts on the&#xA;  DHCP server by using the no ip dhcp conflict logging command in global&#xA;  configuration mode. If there is conflict logging but no database agent&#xA;  configured, bindings are lost across router reboots. Possible false&#xA;  conflicts can occur causing the address to be removed from the address&#xA;  pool until the network administrator intervenes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you have the conflict resolution configuration in place, the device will chack if the IP address is already assigned to another client or not. Also, If the clients are already assigned an IP and the DHCP for some reason stops, the client will continue to communicate normally before the renew period expires. So in case you reconfiguration affects the DHCP, you clients that already have an IP will not be affected. The new ones will get the IP from the new pool after the conflict test is passed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if your setup is critical, I strongly advise you to do a test of this scenarion on a spare router before implementing it on a live system. Also try to find a low traffic period for your change.&lt;/p&gt;&#xA;" OwnerUserId="2440" LastActivityDate="2013-10-02T04:49:32.047" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3450" PostTypeId="1" AcceptedAnswerId="3451" CreationDate="2013-10-02T16:32:57.033" Score="10" ViewCount="2366" Body="&lt;p&gt;I'm hoping to get some advice regarding the best practice to delegate a limited Internet connection between two VLANs. In my case, one VLAN is for an office network, and the other is for guests. What I'm hoping to do is allow a certain percentage of bandwidth to the Office network with priority over the Guest network. For example if I have a 10Mbps down speed, I'd like up to 7Mbps of that to always be available to the Office if needed, otherwise, the guest connection could use it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main concern is that if I rate limit the guest network to say 3Mbps and the router start to drop packets over that limit, that I am wasting packets from the ISP. If I understand correctly, the ISP would be sending at say 10Mbps, then my router starts dropping anything over that limit to the guest network, isn't that wasted bandwidth that will have to be resent? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, rate-limiting the upload makes a lot of sense because I have full control over that with my router, but I'm not sure you can effectively rate limit down-stream traffic from the ISP as I have no control over their routers. So if you can rate limit down-stream traffic without wasting it, how do you recommend going about it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;David&lt;/p&gt;&#xA;" OwnerUserId="2821" LastEditorUserId="42290" LastEditDate="2017-12-13T11:55:54.213" LastActivityDate="2017-12-13T11:55:54.213" Title="QoS between two VLANs with Cisco 881 Router (IOS)" Tags="|routing|qos|cisco-commands|cisco-ios|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3451" PostTypeId="2" ParentId="3450" CreationDate="2013-10-02T18:33:03.890" Score="9" Body="&lt;p&gt;Unfortunately, I don't think there's a good way to do what you want without the provider's involvement.  Working within that restriction, your best bet may be to implement an outbound policy on your LAN interface.  For example, if you are PATing the business network and guest networks separately, so that the return traffic can be identified by destination IP, then a hierarchical policy that guarantees bandwidth to the business network will help.  Essentially, the parent policy would shape all traffic to 10 Mbps.  The parent would then call a child policy that guarantees 7 Mbps for the business network.  The remaining traffic (guest network) would then be able to use whatever is left over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that this is imperfect, since the traffic has already traversed the WAN.  However, if the guest traffic is TCP, and starts getting dropped by your outbound LAN policy, the TCP session should throttle itself.  This won't work for UDP at the transport layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sample policy would look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended BUSINESS-NETWORK &#xA; permit ip any host 1.1.1.1&#xA;! &#xA;class-map BUSINESS-NETWORK &#xA; match access-group name BUSINESS-NETWORK &#xA;! &#xA;policy-map PARENT &#xA; class class-default &#xA;  shape average 10000000&#xA;  service-policy CHILD&#xA;! &#xA;policy-map CHILD &#xA; class BUSINESS-NETWORK &#xA;  bandwidth 7000 &#xA;! &#xA;interface Fa0/0 &#xA; description LAN interface &#xA; ip address x.x.x.x &#xA; service-policy output PARENT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is an imperfect example, but is the best I can come up with without provider involvement.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastEditorUserId="244" LastEditDate="2013-10-03T08:29:52.647" LastActivityDate="2013-10-03T08:29:52.647" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3452" PostTypeId="2" ParentId="3217" CreationDate="2013-10-02T20:18:00.787" Score="1" Body="&lt;p&gt;This is most probably because of EBGP split horizon kicking in... i.e. 7204 router receives those prefixes from Quagga, selects best path, and attempts to advertise them. Since the only neighbor is the neighbor the best path was received from, it filters the advertisements. The counter above shows that.&lt;/p&gt;&#xA;" OwnerUserId="2129" LastActivityDate="2013-10-02T20:18:00.787" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3454" PostTypeId="2" ParentId="653" CreationDate="2013-10-03T10:29:37.050" Score="1" Body="&lt;p&gt;Show IP interface brief is my personal favourite. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Makes it slightly easier for you to view. If not there are plenty of tools out there to help track port usage across many switches. &lt;/p&gt;&#xA;" OwnerUserId="2645" LastActivityDate="2013-10-03T10:29:37.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3455" PostTypeId="1" AcceptedAnswerId="3457" CreationDate="2013-10-03T13:18:47.567" Score="11" ViewCount="3219" Body="&lt;p&gt;Let's suppose we are doing a TCP connect scan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a nmap scan on google returns the following output :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PORT    STATE SERVICE&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;80/tcp  open  http&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;443/tcp open  https&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, if I try to open a socket with netcat or telnet on google.com on the port 12 for example, netcat or telnet hangs indefinitely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nmap detects the port 12 (and other ports other than 80 or 443) as closed but initiating a TCP connection to them does not instantly closes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can nmap know those ports are not filtered but closed ?&lt;/p&gt;&#xA;" OwnerUserId="2828" LastEditorUserId="623" LastEditDate="2013-10-04T15:02:33.150" LastActivityDate="2019-08-20T09:47:01.597" Title="How does nmap distinguish closed ports from filtered ports" Tags="|monitoring|tcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3457" PostTypeId="2" ParentId="3455" CreationDate="2013-10-03T13:58:04.690" Score="14" Body="&lt;p&gt;With nmap scan, you usually get 3 states:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Open - remote computer responded with a SYN/ACK to your SYN &lt;/li&gt;&#xA;&lt;li&gt;Closed - remote computer rejected your connection attempt with a RST packet &lt;/li&gt;&#xA;&lt;li&gt;Filtered - nothing came back, timeout occured &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Opening a netcat to port 80 and waiting will not do anything. Port 80 (usually) means a http server is listening on the other side, and it is waiting for a HTTP command (until its own timeout). After netcatting to port 80, try sedinng a &lt;code&gt;GET /&lt;/code&gt; to see if you get a reply (probably a http error). &lt;/p&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="1220" LastEditDate="2019-08-20T09:47:01.597" LastActivityDate="2019-08-20T09:47:01.597" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="3458" PostTypeId="2" ParentId="3455" CreationDate="2013-10-03T13:58:45.217" Score="8" Body="&lt;p&gt;A closed port is a port that doesn't have any software listening on it, so an attempt to make a connection to that port on that system will result in the system sending back a TCP RST packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A filtered port, on the other hand is typically a port that is blocked by a firewall in the network path, so an attempt to make a connection to that port on that system will result in nothing coming back at all...not even a TCP RST...so a connection attempt will sit there until TCP times out the attempt to connect.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-10-03T13:58:45.217" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3461" PostTypeId="2" ParentId="3448" CreationDate="2013-10-03T16:37:54.310" Score="3" Body="&lt;p&gt;IPv4 and IPv6 operate as 'ships in the night' as far as routing is concerned, so I see not benefit to separate VRFs with ipv4 in one and ipv6 in another. Also any dual stack hosts would need separate interfaces or separate tagged VLANs to operate dual stack. Now if you are concerned about RAM in the router VRF will not help that, for that concern route summarization or default routing would help there, and that applies to both IPv6 and ipv4&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-10-03T16:37:54.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3466" PostTypeId="1" CreationDate="2013-10-03T19:57:26.573" Score="9" ViewCount="10936" Body="&lt;p&gt;Investigating output drops on a 3750x stack.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two interfaces that connects to a file server (broadcom teamed interfaces) shows some output drops when i transfer large files. The utilization of the ports are still below the 1Gb port speed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as i can see a 3750 has 2 asics (sh platform port-asic version). I think the problem must be on the asic because the port is not fully utilized (as far as i can see). When this is the case would i see more drops on interfaces that are connected to the same asic? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to see what ports are mapped to what asic? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In each stack member there is a 10Gb card (uplink to the core). Does this card have 1 asic dedicated for this card? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read things about microburst and i wonder what i can do to determine if this is the case? Can wireshark help me with this?&lt;/p&gt;&#xA;" OwnerUserId="209" LastActivityDate="2013-10-03T22:49:58.710" Title="Troubleshoot output drops cisco 3750x" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3469" PostTypeId="2" ParentId="3466" CreationDate="2013-10-03T22:49:58.710" Score="5" Body="&lt;p&gt;I hope this link is helpful to you:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://networking.ventrefamily.com/2010/08/asic-to-port-mappings.html&quot; rel=&quot;noreferrer&quot;&gt;http://networking.ventrefamily.com/2010/08/asic-to-port-mappings.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sh platform pm if-numbers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output did not format very well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ‘port’ column lists the asic/port number (can use this to balance ports by splitting devices onto different ASIC although some platforms only have two!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have QoS enabled on the switch?  If so the port buffers are shared between the four queues although the queue-set configuration can be increased to 3200%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nick&lt;/p&gt;&#xA;" OwnerUserId="2835" LastActivityDate="2013-10-03T22:49:58.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3473" PostTypeId="1" AcceptedAnswerId="3474" CreationDate="2013-10-04T08:43:41.627" Score="5" ViewCount="13008" Body="&lt;p&gt;Is there a way to shutdown an interface on a Cisco router based on time periods? &#xA;I would like to shut the cellular interface when it is not necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can this be done with the event manager and action in combination of time-based access-list or track?&lt;/p&gt;&#xA;" OwnerUserId="790" LastEditorUserId="775" LastEditDate="2013-10-04T09:53:32.690" LastActivityDate="2013-10-04T13:45:37.863" Title="time based interface shutdown on cisco router" Tags="|cisco|cisco-commands|interface|cisco-eem|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3474" PostTypeId="2" ParentId="3473" CreationDate="2013-10-04T08:47:07.927" Score="6" Body="&lt;p&gt;You can do this with time-based ACL's when talking about ports, or with EEM when talking about interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface wlan0&#xA;ip address 10.1.1.1 255.255.255.0 &#xA;ip access-group 101 in      &#xA;&#xA;access-list 101 permit tcp 10.1.1.0 0.0.0.255 172.16.1.0 0.0.0.255        &#xA;eq telnet time-range EVERYOTHERDAY  &#xA;&#xA;time-range EVERYOTHERDAY &#xA;periodic Monday Wednesday Friday 8:00 to 17:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#timebasedtimerange&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml#timebasedtimerange&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you want to shut down an &lt;strong&gt;interface&lt;/strong&gt;, take a look at the next article:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/thread/202630&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/thread/202630&lt;/a&gt; (answer Joseph Clarke)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;event manager applet shutdown_port&#xA;event timer cron cron-entry &quot;0 0 * * *&quot;&#xA;action 010 cli command &quot;enable&quot;&#xA;action 020 cli command &quot;config t&quot;&#xA;action 030 cli command &quot;interface FastEthernet1/0/1&quot;&#xA;action 040 cli command &quot;shut&quot;&#xA;action 050 cli command &quot;end&quot;&#xA;action 060 syslog msg &quot;Interface FastEthernet1/0/1 has been shutdown&quot;&#xA;&#xA;event manager applet noshut_port&#xA;event timer cron cron-entry &quot;0 8 * * *&quot;&#xA;action 010 cli command &quot;enable&quot;&#xA;action 020 cli command &quot;config t&quot;&#xA;action 030 cli command &quot;interface FastEthernet1/0/1&quot;&#xA;action 040 cli command &quot;no shut&quot;&#xA;action 050 cli command &quot;end&quot;&#xA;action 060 syslog msg &quot;Interface FastEthernet1/0/1 has been restored&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in the example above:&#xA;The port will be shutdown every day at midnight, and brought back up every day at 8 am.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should look into the cron-entry option (like crontabs in linux/unix)&#xA;reference: &lt;a href=&quot;http://www.rogerperkin.co.uk/ccie/index.php/eem-2/understanding-cisco-eem-event-timer-cron/&quot; rel=&quot;nofollow&quot;&gt;http://www.rogerperkin.co.uk/ccie/index.php/eem-2/understanding-cisco-eem-event-timer-cron/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 5 values you can specify for the cron timer&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;minute – this controls what minute of the hour the command will fire    values between 0 and 59 &lt;/li&gt;&#xA;&lt;li&gt;hour – this controls what hour the command    will run – specified in the 24 hour clock format 0-23 0=midnight &lt;/li&gt;&#xA;&lt;li&gt;dom – day of month that you want the command to run e.g 20th = 20 &lt;/li&gt;&#xA;&lt;li&gt;dow – day of week it can be numeric 0-7 or name of day e.g sat&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01 * * * * This command is run at one min past every hour&#xA;17 8 * * * This command is run daily at 8:17 am&#xA;*/1 **** this command runs every minute&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="623" LastEditorUserId="623" LastEditDate="2013-10-04T13:45:37.863" LastActivityDate="2013-10-04T13:45:37.863" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3475" PostTypeId="1" AcceptedAnswerId="3477" CreationDate="2013-10-04T10:02:24.240" Score="4" ViewCount="741" Body="&lt;p&gt;From a Cat6K, RP crashinfo indicates parity error.  Guidance seems to be to not do anything unless this happens more than once in 12-month period.  &lt;strong&gt;At what point do you push Cisco for hardware or RAM replacement?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&#xA;Cache error detected!&#xA;  CPO_ECC     (reg 26/0): 0x00000064&#xA;  CPO_CACHERI (reg 27/0): 0x20000000&#xA;  CP0_CAUSE   (reg 13/0): 0x00000400&#xA;&#xA;Real cache error detected.  System will be halted.&#xA;&#xA;Error: Primary instr cache, fields: data,&#xA;Actual physical addr 0x00000000,&#xA;virtual address is imprecise.&#xA;&#xA; Imprecise Data Parity Error&#xA;&#xA; Imprecise Data Parity Error&#xA;&#xA;Interrupt exception, CPU signal 20, PC = 0x41AAE2DC&#xA;&lt;/pre&gt;&#xA;&lt;p&gt;Also took exceedingly long to failover from active SUP720-PFC3B to hot standby -- 18 minutes -- w/SSO.  **From my research, it appears long failover time could be due to crashdumps, but I don't see coredumps configured.  And without crashdumps, wouldn't root-cause be difficult if not impossible.&lt;/p&gt;&#xA;&lt;p&gt;Cisco's states the following for failover time.  Without coredumps configured -- no &lt;code&gt;exception&lt;/code&gt; type commands -- why would SSO take so long (18 min)?  I was completely down during this period; even my HSRP VIPs that were active seemed to have stay alive on a dead SUP instead of moving to another Cat6K; need more log analysis to know fo sure.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The time required by the device to switch over from the active RP to the standby RP is between zero and three seconds.&lt;/p&gt;&#xA;&lt;p&gt;Although the newly active processor takes over almost immediately following a switchover, the time required for the device to begin operating again in full redundancy (SSO) mode can be several minutes, depending on the platform. The length of time can be due to a number of factors including the time needed for the previously active processor to obtain crash information, load code and microcode, and synchronize configurations between processors.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&#xA;s-oc4-n2-agg1#sh redundancy states&#xA;       my state = 13 -ACTIVE&#xA;     peer state = 8  -STANDBY HOT&#xA;           Mode = Duplex&#xA;           Unit = Secondary&#xA;        Unit ID = 6&#xA;Redundancy Mode (Operational) = sso&#xA;Redundancy Mode (Configured)  = sso&#xA;Redundancy State              = sso&#xA;&#xA;     Split Mode = Disabled&#xA;   Manual Swact = Enabled&#xA; Communications = Up&#xA;&#xA;   client count = 62&#xA; client_notification_TMR = 30000 milliseconds&#xA;          keep_alive TMR = 9000 milliseconds&#xA;        keep_alive count = 0&#xA;    keep_alive threshold = 19&#xA;           RF debug mask = 0x0&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-10-05T02:02:35.140" Title="Cat6K parity failure and long SSO failover" Tags="|cisco|switch|cisco-6500|failover|cisco-ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3476" PostTypeId="1" CreationDate="2013-10-04T10:07:32.070" Score="6" ViewCount="1335" Body="&lt;p&gt;I've got a cisco 1921 in a lab setting where we've added an extra interface (EHWIC-1GE-SFP-CU) and as long as a network cable is connected it works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if the network cable is disconnected and then reconnected the inteface doesn't start up again until I log into the router, enter config mode for the interface and issue&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;wait for a while and then issue&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Doing this makes everything work again, but in a production setting that is, unfortunately, not a viable option. Why does this happen? Is it a hardware fault? Config issue?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0/0&#xA; ip address 10.0.4.35 255.255.255.0&#xA; no ip redirects&#xA; duplex half&#xA; speed 10&#xA; no cdp enable&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2841" LastActivityDate="2014-07-21T17:19:15.280" Title="why does an interface card in cisco 1921 router not restart after cable disconnect?" Tags="|cisco|interface|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3477" PostTypeId="2" ParentId="3475" CreationDate="2013-10-04T10:41:41.213" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;At what point do you push Cisco for hardware or RAM replacement?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Whenever you feel like you can't afford the risk of the HW being bad.  Single-bit parity errors happen because Cisco used non-ECC memory in some components of the Supervisor.  As long as an occasional 3-second SSO failover is tolerable, just roll with Cisco's recommendation, because solar radiation causes most parity bit failures in IOS.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;From my research, it appears my only option to reduce failover time is to disable crashdumps altogether; is this correct? And without crashdumps, root-cause will be difficult if not impossible.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Having a &lt;a href=&quot;http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_tech_note09186a00800c7d59.shtml&quot; rel=&quot;nofollow&quot;&gt;core dump&lt;/a&gt; is great, but I would only enable ftp core dumps when you must figure out the cause of a recurring bug in your network... the reasons...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A core dump sends the entire entire contents of RAM to disk. Cisco IOS writes from the MSFC to the network very slowly, and as you noticed a core dump from a RP with half a gigabyte (or more) of DRAM takes a long time.&lt;/li&gt;&#xA;&lt;li&gt;Only Cisco IOS developers will care about the core dump (TAC will just attach it to the case, but only a developer can analyze it since it requires special skills).  Getting a developer's attention is pointless if it's the root cause of the bug is known... and suffering 15 minute outages for every solar flare event is too heavy a price to pay.&lt;/li&gt;&#xA;&lt;li&gt;Many failover events are caused by &lt;a href=&quot;http://en.wikipedia.org/wiki/Soft_error&quot; rel=&quot;nofollow&quot;&gt;soft parity errors from cosmic radiation&lt;/a&gt;.  Waiting all that time for a core dump is useless because there is no bug to be fixed.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;BTW, a bug's root cause can be found without a core dump; Cisco IOS developers do this all the time based on the &lt;a href=&quot;http://www.cisco.com/stack/sample_trace&quot; rel=&quot;nofollow&quot;&gt;stack trace&lt;/a&gt; you find in IOS crashinfo.  Also see &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/routers/ps167/products_tech_note09186a00800a6743.shtml#example&quot; rel=&quot;nofollow&quot;&gt;this example crashinfo&lt;/a&gt;.  I diagnosed crashes for several years in Cisco Adv Services, and crashinfo is how we isolated most Cisco bugs.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-10-04T18:08:15.683" LastActivityDate="2013-10-04T18:08:15.683" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3478" PostTypeId="2" ParentId="3476" CreationDate="2013-10-04T10:53:14.800" Score="4" Body="&lt;p&gt;You should be able to hard code speed / duplex and get the interface to go up / down without kicking it.  Unless there is a problem with the cable, or the hub it's connected to, that behavior looks like a bug... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open a TAC case, or get a $25 switch from walmart that can autonegotiate.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-10-04T10:53:14.800" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3479" PostTypeId="5" CreationDate="2013-10-04T12:05:03.380" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-10-04T12:05:03.380" LastActivityDate="2013-10-04T12:05:03.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3480" PostTypeId="4" CreationDate="2013-10-04T12:05:03.380" Score="0" Body="Used for questions about the commands for Cisco devices." OwnerUserId="623" LastEditorUserId="775" LastEditDate="2013-10-04T12:11:28.953" LastActivityDate="2013-10-04T12:11:28.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3482" PostTypeId="1" AcceptedAnswerId="3483" CreationDate="2013-10-04T14:16:03.507" Score="27" ViewCount="72157" Body="&lt;p&gt;The Tag Protocol Identifier is set to 16 bits.&#xA;In the CCNA certification it is said that it's not possible to have more than 4096 VLANs.&#xA;4096 in binary is 1000000000000000.&#xA;Since 16 bits are allocated anyway, the limit could be 65535(1111111111111111)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is that limit set to 4096?&lt;/p&gt;&#xA;" OwnerUserId="2843" LastEditorUserId="775" LastEditDate="2013-10-04T20:54:00.510" LastActivityDate="2018-12-10T18:20:35.060" Title="Why is 4096 the max value for VLANs" Tags="|ethernet|vlan|protocol-theory|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3483" PostTypeId="2" ParentId="3482" CreationDate="2013-10-04T14:23:25.067" Score="33" Body="&lt;p&gt;Only 12 bits are used for VLANs in 802.1q, so you can only use VLANs from 0-4095 (=4096* different VLANs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*actually 2 less, 0 and 4095 are reserved&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1Q#Frame_format&quot;&gt;http://en.wikipedia.org/wiki/IEEE_802.1Q#Frame_format&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4096(DEC) is 1000000000000(BIN)&#xA;4095(DEC) is  111111111111(BIN)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="1220" LastEditDate="2013-10-04T14:28:36.410" LastActivityDate="2013-10-04T14:28:36.410" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3485" PostTypeId="2" ParentId="3476" CreationDate="2013-10-04T15:06:02.700" Score="2" Body="&lt;p&gt;Have you tried spanning-tree portfast? I've used this before in situations when a device wouldn't connect properly without intervention, even with a hard-set port. &lt;/p&gt;&#xA;" OwnerUserId="2821" LastActivityDate="2013-10-04T15:06:02.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3491" PostTypeId="2" ParentId="3427" CreationDate="2013-10-05T05:24:37.543" Score="4" Body="&lt;p&gt;There is so much different multicast possible in IPv6... are you talking about multicast traffic (for streaming) or generic multicasts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FF:: is the multicast range....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FF02:: is Link Local scope, with FF02::1 being the equivalent of the Broadcast Address of a subnet in IPv4&#xA;FF02::2 is Link Local, All routers&#xA;FF05:: is Site Local, again ::1 for All Node, ::2 for All Routers...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, IPv6 multicasr permits a better targetting of many types of traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, for Using Multicast for streaming, it's a lot like in IPv4, with PIM Sparse Mode (no more Dense Mode), MLD (replacing IGMP), Rendez-Vous Points, etc.  There are differences, but not as much as replacing Broadcasts by Scoped Multicasts&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2013-10-05T05:24:37.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3492" PostTypeId="1" CreationDate="2013-10-05T14:12:45.687" Score="7" ViewCount="758" Body="&lt;p&gt;A small ISP I provide service for has recently been consolidating their equipment. One of their small branches only has a handful (5 or so) of users receiving their internet through a router, a Cisco 3725, using PPP with a RADIUS server for AAA, and a VirtualAccess template.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of keeping a server dedicated to providing RADIUS, I would like to retire it, and put usernames, passwords, and any other rules in the router's configuration. I've done this in a testing environment, and notice that it works, with one major difference:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In the original RADIUS setup,  a completely new VirtualAccess (Vi1, Vi2, Vi3, etc) interface was created with each user.&lt;/li&gt;&#xA;&lt;li&gt;In the local setup, a sub-interface of VirtualAccess1 (Vi1.1, Vi1.2, Vi1.3) is created for each user.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is their any way to create a separate VirtualAccess interface for each user, but keep the authentication local?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much of the configuration has been copied from our production environment, and such is heavily edited here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.3&#xA;service timestamps debug datetime year&#xA;service timestamps log datetime year&#xA;service password-encryption&#xA;!&#xA;hostname [removed]&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;logging buffered 131072 debugging&#xA;logging console alerts&#xA;enable password [removed]&#xA;!&#xA;aaa new-model&#xA;aaa session-mib disconnect&#xA;!&#xA;!         &#xA;!&#xA;aaa authentication ppp default none&#xA;aaa authentication ppp [isp]-auth local&#xA;aaa authorization network [isp]-auth local &#xA;aaa accounting delay-start &#xA;aaa accounting update periodic 1&#xA;!&#xA;aaa attribute list [username 1 removed]&#xA; attribute type addr [ip 1 removed]&#xA;!&#xA;aaa attribute list [username 2 removed]&#xA; attribute type addr [ip 2 removed]&#xA;!&#xA;aaa attribute list [username 3 removed]&#xA; attribute type addr [ip 3 removed]&#xA;!&#xA;aaa session-id common&#xA;!&#xA;resource policy&#xA;!&#xA;no ip subnet-zero&#xA;ip cef&#xA;!&#xA;!&#xA;no ip dhcp use vrf connected&#xA;ip dhcp excluded-address 10.255.254.1 10.255.254.50&#xA;ip dhcp excluded-address 10.255.252.1 10.255.252.50&#xA;!&#xA;ip dhcp pool [isp]-wasteland1&#xA;   network 10.255.254.0 255.255.254.0&#xA;   domain-name [isp].com&#xA;   dns-server 4.2.2.2 8.2.2.2 &#xA;   default-router 10.255.254.1 &#xA;!&#xA;ip dhcp pool [isp]-wasteland2&#xA;   network 10.255.252.0 255.255.254.0&#xA;   domain-name [isp].com&#xA;   dns-server 4.2.2.2 8.2.2.2 &#xA;   default-router 10.255.252.1 &#xA;!&#xA;!&#xA;ip domain name [removed]&#xA;ip name-server 4.2.2.2&#xA;virtual-profile if-needed&#xA;virtual-profile virtual-template 11&#xA;!&#xA;no ftp-server write-enable&#xA;async-bootp dns-server 4.2.2.2 8.2.2.2&#xA;!&#xA;!&#xA;!         &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;username [username] password [password]&#xA;username [username] password [password]&#xA;username [username] password [password]&#xA;... (5 more)&#xA;!&#xA;!&#xA;class-map match-all default-class&#xA; match any &#xA;!&#xA;!&#xA;[removed policy maps]&#xA;!&#xA;! &#xA;crypto isakmp ccm&#xA;!&#xA;!&#xA;!&#xA;bba-group pppoe global&#xA; virtual-template 11&#xA;!&#xA;!&#xA;interface Loopback0&#xA; no ip address&#xA;!&#xA;interface FastEthernet0/0&#xA; description [removed]&#xA; ip address [ip address] [subnet] secondary&#xA; ip address [ip address] [subnet]&#xA; duplex auto&#xA; speed auto&#xA; service-policy input [removed]&#xA; service-policy output [removed]&#xA;!&#xA;interface Serial0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1&#xA; description [removed]&#xA; no ip address&#xA; speed 100&#xA; full-duplex&#xA;!&#xA;interface FastEthernet0/1.217&#xA; description [removed]&#xA; encapsulation dot1Q 217&#xA; ip address [ip address] [subnet]&#xA; pppoe enable group global&#xA;!&#xA;interface FastEthernet0/1.218&#xA; description [removed]&#xA; encapsulation dot1Q 218&#xA; ip address [ip address] [subnet] secondary&#xA; ip address [ip address] [subnet]&#xA; pppoe enable group global&#xA;!&#xA;interface FastEthernet0/1.219&#xA; description [removed]&#xA; encapsulation dot1Q 219&#xA; ip address [ip address] [subnet]&#xA; service-policy input [removed]&#xA; service-policy output [removed]&#xA;!&#xA;interface FastEthernet0/1.220&#xA; description ** UNUSED **&#xA; encapsulation dot1Q 220&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1.221&#xA; description ** UNUSED **&#xA; encapsulation dot1Q 221&#xA; shutdown&#xA;!&#xA;!&#xA;interface Virtual-Template11 &#xA; description PPPoE user&#xA; ip unnumbered FastEthernet0/0&#xA; peer default ip address pool [pool-name]&#xA; ppp authentication pap [isp]-auth&#xA; ppp authorization [isp]-auth&#xA; ppp accounting [isp]-auth&#xA; service-policy [removed]&#xA; service-policy [removed]&#xA;!&#xA;ip local pool [pool-name] [xxx.xxx.xxx].130 [xxx.xxx.xxx].189&#xA;ip local pool [pool-name] [xxx.xxx.xxx].64 [xxx.xxx.xxx].126&#xA;no ip classless&#xA;ip route 0.0.0.0 0.0.0.0 [gateway]&#xA;!&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;logging trap debugging&#xA;logging facility local4&#xA;logging [logging ip]&#xA;access-list 101 permit ip any any&#xA;snmp-server community [isp]-public RO&#xA;snmp-server community [isp]-read-write RW&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA; privilege level 2&#xA; [password removed]&#xA; transport input telnet ssh&#xA;!&#xA;ntp clock-period 17180651&#xA;ntp server 204.2.134.164&#xA;ntp server 204.2.134.163&#xA;ntp server 77.66.37.130&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2852" LastEditorUserId="8499" LastEditDate="2016-03-29T17:38:59.983" LastActivityDate="2016-03-29T17:38:59.983" Title="VirtualAccess Behavior with PPP" Tags="|cisco|router|cisco-ios-12|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3493" PostTypeId="1" AcceptedAnswerId="3496" CreationDate="2013-10-06T08:07:50.363" Score="3" ViewCount="291" Body="&lt;p&gt;We currently have several locations where we have Point to Point T1s setup in a star fashion and since they're very low traffic and do not require the sort of high level of availability T1s provide, we want to switch some to VPN. I wish to be able to setup the VPNs in such a way as from the other routers' perspectives everything is the same, so I don't have to reconfigure locations which are just fine with the T1s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each location has a Point to Point T1 to central and a cable or DSL connection for all Internet traffic. All of the routers are Cisco 2801 and have VWIX T1 cards and are setup thusly:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interfaces on either side have 192.168.[location].1 and 192.168.[location].2 for the Point to Point themselves. However the actual networks are 10.[location].x.x. Here's an outlying location and the central location:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[ Outside #5 ]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;controller T1 0/1/0&#xA; framing esf&#xA; linecode b8zs&#xA; channel-group 0 timeslots 1-24&#xA;&#xA;interface FastEthernet0/0&#xA; description $$$LAN CONNECTION$$$&#xA; ip address 10.5.0.1 255.255.0.0&#xA; ip nat inside&#xA; duplex auto&#xA; speed auto&#xA;&#xA;interface FastEthernet0/1&#xA; ip address [IP for ISP] 255.255.255.224&#xA; ip access-group 102 out&#xA; ip nat outside&#xA; duplex auto&#xA; speed auto&#xA;&#xA;interface Serial0/1/0:0&#xA; description $$$CONNECTION TO DOWNTOWN$$$&#xA; ip address 192.168.5.2 255.255.255.252&#xA;&#xA;ip route 0.0.0.0 0.0.0.0 [IP for ISP]&#xA;ip route 10.1.0.0 255.255.0.0 192.168.5.1&#xA;ip route 10.2.0.0 255.255.0.0 192.168.5.1&#xA;...&#xA;ip route 10.6.0.0 255.255.0.0 192.168.5.1&#xA;ip route 192.168.1.0 255.255.255.252 192.168.5.1&#xA;ip route 192.168.2.0 255.255.255.252 192.168.5.1&#xA;...&#xA;ip route 192.168.6.0 255.255.255.252 192.168.5.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[ Central Location ]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;controller T1 0/1/0&#xA; framing esf&#xA; clock source internal&#xA; linecode b8zs&#xA; channel-group 0 timeslots 1-24&#xA;&#xA;controller T1 0/1/1&#xA;...&#xA;controller T1 0/2/0&#xA;...&#xA;controller T1 0/3/0&#xA;...&#xA;&#xA;interface FastEthernet0/0&#xA; description $$$LAN CONNECTION$$$&#xA; ip address 10.1.1.1 255.255.0.0&#xA; ip access-group 101 in&#xA; ip nat inside&#xA; speed 100&#xA; full-duplex&#xA;&#xA;interface FastEthernet0/1&#xA; description $$$CONNECTION TO GATEWAY ROUTER$$$&#xA; ip address 172.16.2.2 255.255.255.252&#xA; ip nat outside&#xA; speed 100&#xA; full-duplex&#xA;&#xA;interface Serial0/1/0:0&#xA; description $$$CONNECTION TO LOCATION 1$$$&#xA; ip address 192.168.1.1 255.255.255.252&#xA;&#xA;interface Serial0/1/1:0&#xA; description $$$CONNECTION TO LOCATION 2$$$&#xA; ip address 192.168.2.1 255.255.255.252&#xA;&#xA;...&#xA;&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 [gateway router sends to internet T1 or cable depending various things]&#xA;ip route 10.2.0.0 255.255.0.0 192.168.1.2&#xA;ip route 10.3.0.0 255.255.0.0 192.168.2.2&#xA;...&#xA;ip route 10.9.0.0 255.255.0.0 192.168.9.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, in what way could I setup the VPNs to where they function essentially the same as the T1s from a networking perspective (especially to other locations) where I do not have to renumber or do anything to locations which are fine? I should mention I've never setup a VPN on Cisco previously, I've only done this.&lt;/p&gt;&#xA;" OwnerUserId="2858" LastActivityDate="2013-10-06T16:42:35.603" Title="Replacing Point-to-Point T1s with VPN over business ISP" Tags="|cisco|vpn|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3494" PostTypeId="2" ParentId="3100" CreationDate="2013-10-06T13:36:21.317" Score="5" Body="&lt;p&gt;Look at the &lt;a href=&quot;http://goo.gl/EobZZF&quot; rel=&quot;nofollow&quot;&gt;Juniper SRX datasheet&lt;/a&gt; for more detail.  If you use the SRX100B model, you can buy an additional license to use UTM.  The SRX100B has 1GB RAM, but only half of that is accessible.&lt;/p&gt;&#xA;" OwnerUserId="235" LastEditorUserId="775" LastEditDate="2013-10-06T14:47:54.113" LastActivityDate="2013-10-06T14:47:54.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3496" PostTypeId="2" ParentId="3493" CreationDate="2013-10-06T16:42:35.603" Score="3" Body="&lt;p&gt;You can replace the T1 connections with site-to-site IPSEC VPN connections to the central location. This should not have to affect your current IP scheme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if the 2801's you currently have support IPSEC (may depend on the image you're running) and if they're capable performance wise. Depending on the number of nodes connecting to the central location you may need something heavier on the central location.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-10-06T16:42:35.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3499" PostTypeId="1" CreationDate="2013-10-06T19:47:13.410" Score="6" ViewCount="12132" Body="&lt;p&gt;I have several questions on OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 OSPF is a link-state prototol, so routers inside an AS only broadcast their link states to all the other routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering if a router doesn't tell other routers its routing table, how can other routers know what packets should be destined to it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example, if a router A is an edge router(leaf router) which interfaces the subnet 10.0.2.1/24. Assume another router B receives a packet with destination IP 10.0.0.2.4. From OSPF, B knows the shortest path to A, but B doesn't know A is an edge router interfacing the subnet 10.0.2.1/24, so how will B route this packet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 if a router receives a packet with destination outside the AS, according to my understanding, the packet will follow the default route 0.0.0.0 and the router will route the packet to a ABR. but ususally an AS has several ABR, so how does a router select one from these ABRs?&lt;/p&gt;&#xA;" OwnerUserId="2862" LastActivityDate="2015-12-31T01:06:42.523" Title="OSPF and routing table" Tags="|routing|ospf|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3500" PostTypeId="2" ParentId="3499" CreationDate="2013-10-06T20:21:33.093" Score="0" Body="&lt;p&gt;Question 1 is a little unclear to me, but the leaf concept really only relates to the need to run SPF (and how it is run). If you have a basic network like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(10.0.2.0/24)---(a)----(c)----(b)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A tells C: I'm connected to 10.0.2.0/24&#xA;C tells B: I'm connected to A, also, here is what A is connected to.&#xA;B then puts these together: 10.0.2.0/24 is connected to A. C is connected to A, I'm connected to see, so B -&gt; C -&gt; A -&gt; 10.0.2.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I know about A, but don't know about the specific prefix A has behind it then I would drop the packet (or send it towards my default route).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) Route metrics. If I have multiple default routes the &quot;best&quot; default route is the one with the lowest metric. &lt;/p&gt;&#xA;" OwnerUserId="123" LastActivityDate="2013-10-06T20:21:33.093" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3501" PostTypeId="2" ParentId="3499" CreationDate="2013-10-06T20:49:20.077" Score="11" Body="&lt;p&gt;OSPF is a link state protocol that uses multicast. It sends Link State Advertisements (LSAs) that are flooded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every router builds a tree by running SPF where the router itself is the root of the tree. In OSPF we have transit networks and stub networks. Transit networks are networks that are used for transit to reach networks while stub networks are the endpoints or leaves as you described it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we are in the same area then the router LSA (type-1) is examined to find the destination. Here is a router-LSA to reach the network of R1 which has a RID of 1.1.1.1. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sh ip ospf data router 1.1.1.1&#xA;&#xA;            OSPF Router with ID (2.2.2.2) (Process ID 1)&#xA;&#xA;                Router Link States (Area 0)&#xA;&#xA;  LS age: 256&#xA;  Options: (No TOS-capability, DC)&#xA;  LS Type: Router Links&#xA;  Link State ID: 1.1.1.1&#xA;  Advertising Router: 1.1.1.1&#xA;  LS Seq Number: 80000005&#xA;  Checksum: 0x4B09&#xA;  Length: 60&#xA;  Number of Links: 3&#xA;&#xA;    Link connected to: a Stub Network&#xA;     (Link ID) Network/subnet number: 1.1.1.1&#xA;     (Link Data) Network Mask: 255.255.255.255&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 1&#xA;&#xA;    Link connected to: a Transit Network&#xA;     (Link ID) Designated Router address: 13.13.13.1&#xA;     (Link Data) Router Interface address: 13.13.13.1&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 10&#xA;&#xA;    Link connected to: a Transit Network&#xA;     (Link ID) Designated Router address: 12.12.12.2&#xA;     (Link Data) Router Interface address: 12.12.12.1&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 has a cost of 1 to this stub network. R2 can reach this network through the 12.12.12.0/24 transit network. So we need to add a cost of 10 which brings the total metric to 11.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sh ip route 1.1.1.1&#xA;Routing entry for 1.1.1.1/32&#xA;  Known via &quot;ospf 1&quot;, distance 110, metric 11, type intra area&#xA;  Last update from 12.12.12.1 on FastEthernet0/0, 00:06:49 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 12.12.12.1, from 1.1.1.1, 00:06:49 ago, via FastEthernet0/0&#xA;      Route metric is 11, traffic share count is 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is an intra area route. For inter area routes OSPF actually behaves like a distance vector protocol because traffic is sent through the ABR. How can we identify an ABR? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4#sh ip ospf data router 2.2.2.2&#xA;&#xA;            OSPF Router with ID (4.4.4.4) (Process ID 1)&#xA;&#xA;                Router Link States (Area 1)&#xA;&#xA;  Routing Bit Set on this LSA&#xA;  LS age: 573&#xA;  Options: (No TOS-capability, DC)&#xA;  LS Type: Router Links&#xA;  Link State ID: 2.2.2.2&#xA;  Advertising Router: 2.2.2.2&#xA;  LS Seq Number: 80000002&#xA;  Checksum: 0xCCB6&#xA;  Length: 36&#xA;  **Area Border Router**&#xA;  Number of Links: 1&#xA;&#xA;    Link connected to: a Transit Network&#xA;     (Link ID) Designated Router address: 24.24.24.2&#xA;     (Link Data) Router Interface address: 24.24.24.2&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The B bit is set in the OSPF header which makes a router an ABR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be seen in a packet capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/olpUA.png&quot; alt=&quot;OSPF ABR B bit&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find the metric of an inter area route the metric of the ABR to the destination + the metric of the local route to the ABR is added.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4#sh ip ospf border-routers &#xA;&#xA;OSPF Process 1 internal Routing Table&#xA;&#xA;Codes: i - Intra-area route, I - Inter-area route&#xA;&#xA;i 2.2.2.2 [10] via 24.24.24.2, FastEthernet0/0, ABR, Area 1, SPF 4&#xA;i 3.3.3.3 [10] via 34.34.34.3, FastEthernet0/1, ABR, Area 1, SPF 4&#xA;R4#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here the cost is 10 to reach the two ABRs. Because the cost was 11 from the ABR to the destination that should mean that R4 has a metric of 21.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4#sh ip route 1.1.1.1&#xA;Routing entry for 1.1.1.1/32&#xA;  Known via &quot;ospf 1&quot;, distance 110, metric 21, type inter area&#xA;  Last update from 24.24.24.2 on FastEthernet0/0, 00:09:37 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 34.34.34.3, from 3.3.3.3, 00:09:37 ago, via FastEthernet0/1&#xA;      Route metric is 21, traffic share count is 1&#xA;    24.24.24.2, from 2.2.2.2, 00:09:37 ago, via FastEthernet0/0&#xA;      Route metric is 21, traffic share count is 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which it is. Because there are two ABRs here with the same cost both routes are installed into the RIB/FIB. If we increase the cost to one ABR then only one entry will be installed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;R4(config)#int f0/0&#xA;R4(config-if)#ip ospf cost 11&#xA;R4(config-if)#^Z&#xA;R4#sh ip route 1.1.1.1&#xA;Routing entry for 1.1.1.1/32&#xA;  Known via &quot;ospf 1&quot;, distance 110, metric 21, type inter area&#xA;  Last update from 34.34.34.3 on FastEthernet0/1, 00:10:58 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 34.34.34.3, from 3.3.3.3, 00:10:58 ago, via FastEthernet0/1&#xA;      Route metric is 21, traffic share count is 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There really is no concept of AS in OSPF but you can originate a default route and then the best metric would win. I recommend that you read through &lt;a href=&quot;http://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;noreferrer&quot;&gt;RFC 2328&lt;/a&gt; and &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0201634724&quot; rel=&quot;noreferrer&quot;&gt;OSPF: Anatomy of an Internet Routing Protocol&lt;/a&gt; if you want more understanding of OSPF.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-10-06T20:49:20.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3503" PostTypeId="1" AcceptedAnswerId="3509" CreationDate="2013-10-07T05:50:09.173" Score="6" ViewCount="10107" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fzHQv.png&quot; alt=&quot;HeadFirst Networking Exercise Solution&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was just reading a book called &lt;em&gt;HeadFirst Networking&lt;/em&gt; and I'm a bit confused about something. I am attaching an image from the book. The page says that the direction of the frames as maintained in the switch lookup table should be a mapping between MAC address and the ports. But I'm not sure whether the address is that of the source or destination.&lt;/p&gt;&#xA;" OwnerUserId="2604" LastEditorUserId="6350" LastEditDate="2014-07-02T19:11:53.910" LastActivityDate="2014-07-03T07:34:28.233" Title="Switch Lookup Table" Tags="|switch|mac-address|switching|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3504" PostTypeId="2" ParentId="3503" CreationDate="2013-10-07T06:03:25.977" Score="2" Body="&lt;p&gt;The switch maps the device that is connected to that port in its table. It does this when it learns a new MAC for the port automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at (2min20s):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=WqjpBn-0oI4&quot; rel=&quot;nofollow&quot;&gt;http://www.youtube.com/watch?v=WqjpBn-0oI4&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This explains it a bit more in depth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When computer 1 sends data to computer 3, the switch analyses the destination and source MAC address and adds it both to the table. (unless it is already known of course)&#xA;The source MAC isn't hard to add to the table. However, the destination MAC if not known is first flooded by the switch to all ports. If a response follows, the switch can add this address as well. &lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="988" LastEditDate="2014-07-03T07:34:28.233" LastActivityDate="2014-07-03T07:34:28.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3505" PostTypeId="1" AcceptedAnswerId="3508" CreationDate="2013-10-07T06:50:23.947" Score="5" ViewCount="474" Body="&lt;p&gt;Currently i'm CCNA and going for CCNP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a qustion about BGP. Why would companies use BGP for Internet connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="2866" LastEditorUserId="623" LastEditDate="2013-10-07T13:39:24.233" LastActivityDate="2014-02-07T13:15:02.150" Title="BGP for Internet connection" Tags="|routing|bgp|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3506" PostTypeId="1" AcceptedAnswerId="3507" CreationDate="2013-10-07T07:00:12.697" Score="6" ViewCount="8776" Body="&lt;p&gt;As far as my understading goes MAC address is used to recognize a computer node in a LAN where as internet communications happen over IPv4 address. When a request comes from the internet to the gateway the packet has the destination IP address. Now the cached ARP table is looked up to see the corresponding MAC address. If not ARP broadcast request is sent to get the corresponding MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in case of virtual machine(Windows XP) running on my CentOS both will have same MAC address but different IPV4 addresses. So how the packet will be delievred to the correct host?&lt;/p&gt;&#xA;" OwnerUserId="2867" LastActivityDate="2016-07-12T02:47:14.583" Title="How ARP works in case of Virtual machine?" Tags="|mac-address|arp|vmware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3507" PostTypeId="2" ParentId="3506" CreationDate="2013-10-07T07:17:46.703" Score="12" Body="&lt;p&gt;I am assuming you're using &quot;bridge-mode&quot; for networking (your internal, virtual adapter is bridged to your host's physical adapter).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case (unless you explicitlly manually set them to the same address, which causes a lot of other problems), your guest (WinXP) machine will have a different MAC address than your host (CentOS). Due to bridge-mode, your host acts as an ethernet switch, and forwards packets to the guest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when an ARP broadcast comes, your host gets the packet and also forwards it to your guest machine. When packets for your host come, they are processed by your host's network stack. When packets for your guest come, the host forwards them to your guest, which then processes them as needed.&lt;/p&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="3662" LastEditDate="2013-12-29T19:36:40.530" LastActivityDate="2013-12-29T19:36:40.530" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3508" PostTypeId="2" ParentId="3505" CreationDate="2013-10-07T07:24:35.157" Score="9" Body="&lt;p&gt;BGP is the protocol used to exchange routing information between routers on the (global) internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each organization (large enough, or with a need for that) is assigned an &lt;a href=&quot;http://en.wikipedia.org/wiki/Autonomous_System_%28Internet%29&quot;&gt;AS number&lt;/a&gt;, and a range (subnet) (or more) of IP addresses. For routing between those autonomous systems (AS'), BGP is used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why BGP? Probably because it is simple enough to work with ~400k routes, and due to legacy reasons (all the edge routers in the world would have to be updated to use another routing protocol). &lt;/p&gt;&#xA;" OwnerUserId="1220" LastActivityDate="2013-10-07T07:24:35.157" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3509" PostTypeId="2" ParentId="3503" CreationDate="2013-10-07T07:30:53.993" Score="4" Body="&lt;p&gt;It remembers the MAC of the computer attached to that port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you have four computers connected to a switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC1 with MAC1 connected to PORT1&#xA;PC2 with MAC2 connected to PORT2&#xA;PC3 with MAC3 connected to PORT3&#xA;PC4 with MAC4 connected to PORT4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Imagine you just turned the switch on, and the MAC table is empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you send a packet from PC1 to PC2, the switch doesnt yet know where the PC with MAC2 is (on which port), but it knows that it recieved a packet from MAC1 on PORT1 (and it adds this entry to the MAC table). Since it doesnt know where PC2 is, it sends the packet to all ports (except PORT1, since the packet came from there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All three other PCs get the packet, PC3 and PC4 ignore it, but PC2 probably replies. Since the switch just recieved a packet from a PC with MAC2 on PORT2, it adds this entry to the MAC table. Since it also has an entry for MAC1 on PORT1, it sends the packet there (and only there).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After such a packet exchange (eg. ping), the state of the MAC table would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a device with MAC1 is located on PORT1&#xA;a device with MAC2 is located on PORT2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1220" LastActivityDate="2013-10-07T07:30:53.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3510" PostTypeId="2" ParentId="3505" CreationDate="2013-10-07T09:32:22.613" Score="6" Body="&lt;p&gt;BGP is very scalable and can be configured easily (however to be able to troubleshoot, you need to know BGP indepth). It is used on a global scale by ISP's as well. To calculate the routing path, BGP uses a few variables and not just a metric or number of paths. So this should be more accurate. Even if you want to set up a backup path, this can be done simply by adding the same AS number over and over in the path... . The routing table can handle large amounts of entry's as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want further information, I do suggest you take the CNNP BGP course. It's very good, but a lot to put in one post of course :)&lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="623" LastEditDate="2013-10-07T13:33:15.313" LastActivityDate="2013-10-07T13:33:15.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3511" PostTypeId="1" CreationDate="2013-10-07T09:37:42.383" Score="1" ViewCount="1126" Body="&lt;p&gt;I'm looking to host a few workloads for friends. I have an ASA5510 and a 3500 switch. We plan to have a few VLANs behind the switch, all sharing the single internet connection. I was thinking of trunking a port from the ASA to the 3500, configuring sub-interfaces on the ASA for each VLAN and having the switch point to the ASA for default traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, with regards to the routing side, do I assign an IP to the SVI for each VLAN on the switch (i.e. int VLAN20, ip address 192.168.20.1 255.255.255.0) and have a the next hop pointing to the ASA's sub-interface for that VLAN? I guess that would mean i'd need a default route for each VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the suggestions?&lt;/p&gt;&#xA;" OwnerUserId="1001" LastEditorUserId="775" LastEditDate="2013-10-07T12:49:57.543" LastActivityDate="2013-10-07T22:04:40.863" Title="ASA 5510 + 3550" Tags="|cisco|routing|ethernet|cisco-asa|firewall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3512" PostTypeId="2" ParentId="3503" CreationDate="2013-10-07T10:47:57.770" Score="1" Body="&lt;p&gt;The switch learns from the source address field so future frames that contain that learned address as a destination can be forwarded out the port it learned it from earlier.&#xA;If the switch hasn't yet learned the address in the destination address it &quot;floods&quot; the frame out all ports except the port the frame arrived on.&lt;/p&gt;&#xA;" OwnerUserId="2872" LastEditorUserId="2872" LastEditDate="2013-10-07T10:53:06.967" LastActivityDate="2013-10-07T10:53:06.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3513" PostTypeId="2" ParentId="3511" CreationDate="2013-10-07T11:17:01.253" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is, with regards to the routing side, do i assign an IP to the SVI for each VLAN on the switch (i.e. int VLAN20, ip address 192.168.20.1 255.255.255.0) and have a the next hop pointing to the ASA's sub-interface for that VLAN? I guess that would mean i'd need a default route for each VLAN?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since you're building an ASA subinterface (with an IP address), it is more work to add a Layer3 SVI on the 3550.  If you have a subinterface on the ASA and an SVI on the 3550, then you need static / dynamic routing between the ASA and 3550.  If you do not add an SVI on the 3550, you need no special routing between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trunk all your 3550 vlans as dot1q through (Fa0/1 below) to the ASA interface (Gi0/0 below), and default your users through that ASA's IP address on the appropriate vlan.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                  +---------+ Gi0/0      Fa0/1 +------+&#xA;Internet &amp;lt;--------|   ASA   |------------------| 3550 |&#xA;                  +---------+       dot1q      +------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-10-07T11:17:01.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3517" PostTypeId="2" ParentId="3499" CreationDate="2013-10-07T13:59:37.767" Score="2" Body="&lt;p&gt;@misteryes; Your initial concept, that OSPF routers in an area do not share their routing information, is erroneous. In your first example, the connection to the 10.0.2.0 network is in Router A's database, and that information will be shared with Router B. Router B will update its topological database with this information, and if that is the best route to the 10.0.2.0 network, it will add the route through Router A to its routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your second sub-question is unclear to me. You appear to be somewhat confused by OSPF terminology (most of us were, at one point in our careers). Cisco has some good basic information on how OSPF works available online, as well as the various books available from Cisco Press. The manner in which default routes are handled in OSPF depends upon the way you are implementing it, so there is no one &quot;right answer&quot; to your query.&lt;/p&gt;&#xA;" OwnerUserId="2375" LastActivityDate="2013-10-07T13:59:37.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3518" PostTypeId="2" ParentId="3505" CreationDate="2013-10-07T14:00:30.537" Score="3" Body="&lt;p&gt;Using a routing information protocol such as BGP becomes necessary as soon as you have multiple connections to the rest of the Internet:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;you now have to decide for every packet which connection to send it out to&lt;/li&gt;&#xA;&lt;li&gt;all of your providers need to be aware of your IP address block.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;With a &lt;em&gt;multi-homed&lt;/em&gt; setup, your IP addresses are no longer assigned by your provider, but rather directly from the relevant registry; BGP is used to announce these addresses to each of your providers, which then in turn announce to their peers that they know how to reach your addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, for each outgoing packet, you want to use the connection that is closer to the destination, so you construct the routing table on your edge router from the BGP announcements received from both your providers.&lt;/p&gt;&#xA;" OwnerUserId="2069" LastActivityDate="2013-10-07T14:00:30.537" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3519" PostTypeId="1" AcceptedAnswerId="3520" CreationDate="2013-10-07T14:12:22.170" Score="7" ViewCount="2596" Body="&lt;p&gt;I saw this example &lt;a href=&quot;http://compnetworking.about.com/od/workingwithipaddresses/a/cidr_notation.htm&quot; rel=&quot;noreferrer&quot;&gt;online&lt;/a&gt; .&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;192.168.12.0/23&lt;/strong&gt; &#xA;   applies the network mask 255.255.254.0 to the 192.168 network, starting at 192.168.12.0. This notation represents the address range 192.168.12.0 - 192.168.13.255.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How do I obtain the applicable address range ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my understanding (most likely flawed) of the 192.168.12.0/23 CIDR IP address :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;/23 written in bits is 11111111.11111111.11111110.00000000 .&lt;/li&gt;&#xA;&lt;li&gt;Therefore, it &quot;borrowed&quot; 7 bits from the host field.&lt;/li&gt;&#xA;&lt;li&gt;2^7 = 128 subnets being created.&lt;/li&gt;&#xA;&lt;li&gt;2^1 = Each subnet has a maximum of 2 hosts. &lt;/li&gt;&#xA;&lt;li&gt;There are 128 possible network IDs, possible ones are 192.168.0.0, 192.168.170.0&#xA;192.168.254.0. &lt;/li&gt;&#xA;&lt;li&gt;The range of ip addresses are from 192.168.0.0 to 192.168.254.0 ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="365" LastEditorUserId="775" LastEditDate="2013-10-07T14:34:57.560" LastActivityDate="2021-01-09T11:54:07.257" Title="Subnetting aggregation" Tags="|ipv4|subnet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3520" PostTypeId="2" ParentId="3519" CreationDate="2013-10-07T14:25:04.560" Score="7" Body="&lt;pre&gt;&lt;code&gt;Address:   192.168.12.0         11000000.10101000.0000110 0.00000000&#xA;Netmask:   255.255.254.0 = 23   11111111.11111111.1111111 0.00000000&#xA;Network:   192.168.12.0/23      11000000.10101000.0000110 0.00000000&#xA;HostMin:   192.168.12.1         11000000.10101000.0000110 0.00000001&#xA;HostMax:   192.168.13.254       11000000.10101000.0000110 1.11111110&#xA;Broadcast: 192.168.13.255       11000000.10101000.0000110 1.11111111&#xA;Hosts/Net: 510                   Class C, Private Internet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here you go. First you take the network id (192.168.12.0), and the mask (23) says the first 23 bits are static, and the remaining 9 bits are used in your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in your case:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11000000.10101000.0000110 0.00000000&#xA;First 23 bits are to here^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remaining 9 bits go from all zeros to all ones&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you write the IP back to decimal form, you get IPs from 192.168.12.0 (last 9 bits are zeros), to 192.168.13.255 (last 9 bits are all ones). First 23 bits are unchanged. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since 9 bits are used for host IPs, thats 2^9 = 512 IPs (minus one for network ID and minus one for the broadcast address = 510 usable IPs).&lt;/p&gt;&#xA;" OwnerUserId="1220" LastActivityDate="2013-10-07T14:25:04.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3521" PostTypeId="2" ParentId="3519" CreationDate="2013-10-07T14:25:17.773" Score="4" Body="&lt;p&gt;the 1 bits in the address are the network part of the address, this cannot be used for assigning hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example, you can use 9 bits for the hosts (minus 2 hosts, reserved for the broadcast and network address).In the /23 you have, you can use: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;11000000.10101000.0000110 | 0.00000000 = 192.168.12.0&lt;/li&gt;&#xA;&lt;li&gt;11000000.10101000.0000110 | 1.11111111 = 192.168.13.255&lt;/li&gt;&#xA;&lt;li&gt;11111111.11111111.1111111 | 0.00000000 = 255.255.254.0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;everything before the &quot;|&quot; is the network area, that cannot be changed in this subnet. Everything after, you can use for your hosts, except the all-0's and all-1's. This is clear if you put the subnetmask under it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can calculate everything here (and on other sites):&#xA;&lt;a href=&quot;http://www.adminsub.net/ipv4-subnet-calculator/192.168.12.0/23&quot; rel=&quot;nofollow&quot;&gt;http://www.adminsub.net/ipv4-subnet-calculator/192.168.12.0/23&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="623" LastEditDate="2013-10-08T05:27:51.293" LastActivityDate="2013-10-08T05:27:51.293" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3522" PostTypeId="2" ParentId="3511" CreationDate="2013-10-07T22:04:40.863" Score="1" Body="&lt;p&gt;If you're using the 3550 as a pure layer-2 switch, then no, the SVI's don't need addresses. The switch only needs one interface with an address for management. The ASA's interface is the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, however, you use the 3550 as a layer-3 switch, each SVI needs an address and that's the gateway address for that VLAN. An additional VLAN is then used for routing to the ASA.  No trunking is then required, and inter-vlan traffic isn't bounced through the ASA. The drawback is the ASA cannot inspect the inter-vlan traffic, however it removes the bottleneck of the single link to the ASA. (and internal communication can continue with the ASA down.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-10-07T22:04:40.863" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3523" PostTypeId="2" ParentId="3506" CreationDate="2013-10-07T22:12:09.160" Score="4" Body="&lt;p&gt;Think of it like a mailbox.  The MAC identifies a specific box. The person who empties that box then looks at the name (i.e. IP) and hands each item to the correct person, which might mean placing more than one person's items into yet another box.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-10-07T22:12:09.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3524" PostTypeId="1" AcceptedAnswerId="3525" CreationDate="2013-10-08T03:21:09.320" Score="13" ViewCount="18191" Body="&lt;p&gt;Consider the following: NAS with 10G interface connected to 10G interface on switch. Client computers connected to switch via gigabit Ethernet. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Will there be any gain in performance if MTU size is increased on NAS and switch port to which NAS is connected if the MTU size is not increased from the standard 1500 bytes on the client NICs?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Will this cause fragmentation problems?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How do devices &quot;handle&quot; mismatches in MTU for interfaces across a switched network?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2881" LastEditorUserId="775" LastEditDate="2013-10-08T08:19:19.590" LastActivityDate="2018-03-26T10:57:00.630" Title="MTU and Fragmentation" Tags="|ethernet|protocol-theory|switching|layer2|mtu|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3525" PostTypeId="2" ParentId="3524" CreationDate="2013-10-08T04:59:17.367" Score="21" Body="&lt;p&gt;No performance gain will exist without everyone using larger packets. The point of jumbo frames is to pack more payload with the same overhead.  The NAS's ability to send larger packets is meaningless if the clients don't as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will be no &quot;fragmentation&quot; at all. Layer-2 (ethernet) has no means if indicating &quot;fragmentation needed&quot;.  This is figured out at Layer-3 (IP) by routers sending an ICMP message when it has to drop the packet because it won't fit on the next-hop interface.  This cannot happen where there's no router -- on a flat, switched LAN.  The jumbo packets sent from the NAS will be dropped by the client as an oversized frame -- or dropped by the switch for the same reason. [A 9k packet cannot be sent on a 1500B interface.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-10-08T04:59:17.367" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3526" PostTypeId="2" ParentId="3524" CreationDate="2013-10-08T05:00:08.283" Score="5" Body="&lt;p&gt;&lt;strong&gt;Q: Will there be any gain in performance if MTU size is increased on NAS and switch port to which NAS is connected if the MTU size is not increased from the standard 1500 bytes on the client NICs?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answer: No, because the the increased MTU size is not being utilized by the client. If you wanted to transport 100 people from point A to point B, you could use two busses or 25 sedans. If the road between A and B is made so that the busses can more easily move with no delays, and you still move them in sedans, you're not gaining anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Q: Will this cause fragmentation problems?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answer: No, fragmentation happens in the opposite scenario when you send a large packet while the path does not support it and needs to chop it into supported sized packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Q: How do devices &quot;handle&quot; mismatches in MTU for interfaces across a switched network?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answer: If the packet is smaller than the allowed packet size, it is passed with no issue. If the packet is larger than the allowed size, it is dropped.&lt;/p&gt;&#xA;" OwnerUserId="2440" LastEditorUserId="5483" LastEditDate="2015-06-05T15:44:32.410" LastActivityDate="2015-06-05T15:44:32.410" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3529" PostTypeId="1" AcceptedAnswerId="3530" CreationDate="2013-10-08T10:48:04.753" Score="10" ViewCount="17174" Body="&lt;p&gt;On a Cisco IOS device the command &lt;code&gt;logging buffered 51200 notifications&lt;/code&gt; logs most information to the routers memory (obviously you can change that to &lt;code&gt;informational&lt;/code&gt; or &lt;code&gt;debugging&lt;/code&gt; as required).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When connected to the router via telnet or SSH I can execute the command &lt;code&gt;terminal monitor&lt;/code&gt; (&lt;code&gt;term mon&lt;/code&gt;) to have these events displayed in my session live as they are happening. When connected via the console this happens automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I achieve the same effect on JunOS; When I am adding IGP/EGB neighbors for example, I'd like to see the new adjacencies coming up rather than constantly looking through the logs.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-10-08T10:56:17.110" LastActivityDate="2016-09-12T14:11:23.207" Title="JunOS: Can I have a live console log?" Tags="|juniper-junos|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3530" PostTypeId="2" ParentId="3529" CreationDate="2013-10-08T11:11:59.233" Score="12" Body="&lt;p&gt;'monitor start messages' is roughly equivalent to 'term mon. 'messages' is the name of the log file you want to monitor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't see the output you expect, you need to change what is logged to given file from 'set configuration system syslog file X ...'.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-10-08T11:11:59.233" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3531" PostTypeId="1" CreationDate="2013-10-08T11:39:38.610" Score="3" ViewCount="1249" Body="&lt;p&gt;What is the difference between &lt;a href=&quot;/tags/dymo&quot; title=&quot;Route REQuest&quot;&gt;RREQ&lt;/a&gt; ID and Destination Sequence number (DestSeqNum) in RREQ packet of &lt;a href=&quot;/tags/aodv&quot; title=&quot;Ad hoc On-demand Distance Vector&quot;&gt;AODV&lt;/a&gt; protocol?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DestSeqNum in RREQ packet is used for a reverse route maintaining and should be incremented before sending every RREQ. RREQ ID, on the other hand, should be also incremented with every RREQ sent. Why do we have duplicity? Or what do I understand wrong?&#xA;Thanks a lot in advance.&lt;/p&gt;&#xA;" OwnerUserId="2887" LastEditorUserId="762" LastEditDate="2013-10-08T17:56:20.417" LastActivityDate="2013-10-08T21:07:59.600" Title="Difference between RREQ ID and DestSeqNum in RREQ packet of AODV protocol?" Tags="|wireless|routing|router|protocol-theory|ad-hoc-wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3532" PostTypeId="1" AcceptedAnswerId="3535" CreationDate="2013-10-08T16:22:44.657" Score="9" ViewCount="3416" Body="&lt;p&gt;We recently bought some new &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/wireless/ps5678/ps11983/data_sheet_c78-686782.html&quot;&gt;AP3602E&lt;/a&gt;s from Cisco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to understand why this AP will not turn on the radio when we are sending enough power to the AP.  I'm using inline power from the switch, but after the AP comes on, it sends &lt;code&gt;%CDP_PD-2-POWER_LOW: All radios disabled&lt;/code&gt; to the console.  The LED on the AP flashes green.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+---------------+ Gi1/0/1   Gi0/1 +-----------+&#xA;|   AP_Test     |                 |           |&#xA;|   Cat2960S    |-----------------|  AP3602E  |&#xA;|               |                 |           |&#xA;+---------------+                 +-----------+&#xA;                       &amp;lt;------- cdp Req 13000mW&#xA;power inline 13000mW -------&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The AP is running a 12.4(25e)JAL1a &lt;code&gt;rcvk9w8&lt;/code&gt; receive image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2960S is running 12.2(55)SE7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Question&lt;/em&gt;: How can I make this AP turn on the radios?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;Misc output...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;debug cdp ilp&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AP0006.6566.a57b#debug cdp ilp&#xA;*May  8 00:11:54.391: CDP-ILP: sent cdp msg:power consumed  pwr=13000&#xA;*May  8 00:11:54.391: CDP-ILP: sent cdp msg:power request reqid=47837 manid=3 rlevel(1)=13000&#xA;*May  8 00:11:54.635: CDP-ILP: rcvd cdp msg:power available reqid=47837 manid=3 alevel=13000 mlevel=13000&#xA;*May  8 00:11:54.635: CDP-ILP: power state:NEGOTIATED_UNCHANGED event:BOTH_ID_unCHANGED unchanged&#xA;AP0006.6566.a57b#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show power inline&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AP_Test#show power inline gi1/0/1&#xA;Interface Admin  Oper       Power   Device              Class Max&#xA;                            (Watts)&#xA;--------- ------ ---------- ------- ------------------- ----- ----&#xA;Gi1/0/1   auto   on         13.0    AIR-CAP3602E-A-K9     4   30.0&#xA;&#xA;Interface  AdminPowerMax   AdminConsumption&#xA;             (Watts)           (Watts)&#xA;---------- --------------- ------------------&#xA;&#xA;Gi1/0/1        30.0             30.0&#xA;AP_Test#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2960S switch port interface configuration...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet1/0/1&#xA; switchport access vlan 385&#xA; switchport mode access&#xA; switchport nonegotiate&#xA; switchport port-security&#xA; switchport port-security aging time 5&#xA; switchport port-security violation protect&#xA; switchport port-security aging type inactivity&#xA; storm-control broadcast level 0.50&#xA; storm-control action trap&#xA; spanning-tree portfast&#xA; spanning-tree bpduguard enable&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-10-10T17:58:41.627" LastActivityDate="2017-02-14T00:36:59.957" Title="AP3602 with rcvk9w8 image throws &quot;%CDP_PD-2-POWER_LOW: All radios disabled&quot;" Tags="|cisco|wireless|ethernet|cisco-ios|power-over-ethernet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3534" PostTypeId="2" ParentId="3532" CreationDate="2013-10-08T17:38:51.657" Score="6" Body="&lt;p&gt;Some 3600's do require 802.3at power and it looks like this one does, and for some reason it is only drawing 802.3af power levels.  Not sure if there is a bug in either the switch or AP code that could cause this, but here are a couple things to try.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some cases (usually with non-Cisco devices) I have had to add on the following on the interface (shut the interface before adding/removing):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;power inline port 2x-mode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If that doesn't do it, sometimes disabling CDP on the interface can help by forcing it into using the IEEE class negotiation for 802.3at rather than CDP.  Often not as power efficient, but may resolve the issue.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-10-08T17:38:51.657" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3535" PostTypeId="2" ParentId="3532" CreationDate="2013-10-08T20:55:14.120" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;it sends &lt;code&gt;%CDP_PD-2-POWER_LOW: All radios disabled to the console&lt;/code&gt;...&lt;br&gt;&#xA;  Question: How can I make this AP turn on the radios?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I talked with a Cisco Wireless Consulting SE... The first problem is that the recovery image (i.e. &lt;code&gt;rcv-w8&lt;/code&gt; image) does not have the firmware for Dot11 radios... so I had to upload new firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I normally use &lt;code&gt;archive download-sw /force-reload /overwrite tftp://...&lt;/code&gt; to upgrade the image when I am dealing with older Cisco AP 1242 models; however, under this image I kept getting an error until I used &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-18274&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;debug capwap console cli&lt;/code&gt;&lt;/a&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AP0006.6566.a57b#arch?&#xA;% Unrecognized command&#xA;AP0006.6566.a57b#debug capwap console cli&#xA;AP0006.6566.a57b#arch?&#xA;archive&#xA;&#xA;AP0006.6566.a57b#archive download-sw /force-reload /overwrite tftp://192.0.2.100/ap32g2-k9w7-tar.152-4.JA1.tar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After upgrading to &lt;code&gt;ap32g2-k9w7-tar.152-4.JA1.tar&lt;/code&gt; (the &lt;code&gt;w7&lt;/code&gt; is an autonomous AP image) the Dot11radio interfaces came up.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Purely informational... this is the open-auth autonomous AP config we're using for our 2.4G and 5.0G survey...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 15.2&#xA;no service pad&#xA;service tcp-keepalives-in&#xA;service tcp-keepalives-out&#xA;service timestamps debug datetime localtime show-timezone&#xA;service timestamps log datetime localtime show-timezone&#xA;service password-encryption&#xA;!&#xA;hostname Survey_AP&#xA;!&#xA;!&#xA;logging rate-limit console 9&#xA;enable secret Cisco&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login default local&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;clock timezone CST -6 0&#xA;clock summer-time CDT recurring&#xA;no ip source-route&#xA;no ip routing&#xA;no ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;login on-failure log&#xA;login on-success log&#xA;dot11 syslog&#xA;!&#xA;dot11 ssid WifiSurvey&#xA;   vlan 1&#xA;   max-associations 50&#xA;   authentication open&#xA;   mbssid guest-mode&#xA;!&#xA;!&#xA;dot11 guest&#xA;!&#xA;!&#xA;!&#xA;username Cisco password 7 05280F1C2243&#xA;!&#xA;ip dhcp excluded-address 192.0.2.254&#xA;!&#xA;ip dhcp pool SURVEY_DHCP&#xA; network 192.0.2.0 255.255.255.0&#xA; lease 0 0 15&#xA; domain-name survey.local&#xA; default-router 192.0.2.254&#xA; dns-server 192.0.2.254&#xA;!&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; ssid WifiSurvey&#xA; no shutdown&#xA; !&#xA; antenna gain 0&#xA; ! Block access to 802.11b clients: set 12Mbps as required speed&#xA; speed basic-12.0 m0-7 m8-15&#xA; ! Optional: Power is specified in mW&#xA; ! power local 11&#xA; ! power client 11&#xA; stbc&#xA; mbssid&#xA; station-role root&#xA; world-mode dot11d country-code US indoor&#xA;!&#xA;interface Dot11Radio0.1&#xA; encapsulation dot1Q 1 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; ssid WifiSurvey&#xA; no shutdown&#xA; !&#xA; antenna gain 0&#xA; ! Block access to 802.11b clients: set 12Mbps as required speed&#xA; speed basic-12.0 m0-7 m8-15&#xA; ! Optional: Power is specified in mW&#xA; ! power local 11&#xA; ! power client 11&#xA; peakdetect&#xA; dfs band 3 block&#xA; stbc&#xA; mbssid&#xA; channel dfs&#xA; station-role root&#xA; world-mode dot11d country-code US indoor&#xA;!&#xA;interface Dot11Radio1.1&#xA; encapsulation dot1Q 1 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; no ip route-cache&#xA; duplex auto&#xA; speed auto&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; no bridge-group 1 source-learning&#xA;!&#xA;interface BVI1&#xA; ip address 192.0.2.254 255.255.255.0&#xA; no ip route-cache&#xA; ipv6 address dhcp&#xA; ipv6 address autoconfig&#xA; ipv6 enable&#xA;!&#xA;ip forward-protocol nd&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;bridge 1 route ip&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; transport preferred none&#xA; transport input all&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2017-02-14T00:36:59.957" LastActivityDate="2017-02-14T00:36:59.957" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3536" PostTypeId="2" ParentId="3531" CreationDate="2013-10-08T21:07:59.600" Score="2" Body="&lt;p&gt;These two sequence numbers help avoid looping and stale routes in the route discovery process. They act as a time-reference (using it for a lack of b identifier for the originator of RREQ and the intended receiver (destination) of the RREQ. Since they act as a time-reference for different nodes, there is no duplication!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RREQ ID (let us seqA) identifies the originator of the RREQ packet (let us say nodeA). Other nodes that receive the RREQ can learn a route to the originator and mark that with seqA. Now, if these nodes were to receive any route update for nodeA, then they would compare the sequence number in that packet against seqA -- if it is lower, then they would discard it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The destination sequence number (let us say seqB) helps identify the destination node for which we are sending the RREQ (let us say nodeB). It is possible that other nodes in the path may already have a route for nodeB along with an associated sequence number. If seqB is higher than the associated sequence number, then these intermediate devices would know that nodeA is looking for a newer route and would not reply to that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your closely is perhaps similar to an earlier question: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3226/aodv-sequence-numbers-and-loop-prevention/3228#3228&quot;&gt;AODV sequence numbers and loop prevention&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2450" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2013-10-08T21:07:59.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3537" PostTypeId="2" ParentId="3529" CreationDate="2013-10-08T23:12:54.323" Score="3" Body="&lt;p&gt;See below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    [edit protocols bgp]&#xA;    root@vr-device# show&#xA;    traceoptions {&#xA;        file bgp-log;&#xA;        flag packets detail;&#xA;    }&#xA;    group test {&#xA;        type external;&#xA;        peer-as 2;&#xA;        local-as 1;&#xA;        neighbor 172.16.12.110;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[edit protocols bgp]&#xA;root@vr-device# &lt;strong&gt;run monitor start bgp-log&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[edit protocols bgp]&#xA;root@vr-device#&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    *** bgp-log ***&#xA;    Jun 24 10:58:19.384061 bgp_connect_complete: error connecting to 172.16.12.110              &#xA;    (External AS 2): Socket is not connected&#xA;    Jun 24 10:58:33.408670&#xA;    Jun 24 10:58:33.408670 BGP RECV 172.16.12.110+54592 -&amp;gt; 172.16.12.128+179&#xA;    Jun 24 10:58:33.408790 BGP RECV message type 1 (Open) length 59&#xA;    Jun 24 10:58:33.408792 BGP RECV version 4 as 2 holdtime 90 id 20.0.0.2 parmlen 30&#xA;    Jun 24 10:58:33.408794 BGP RECV MP capability AFI=1, SAFI=1&#xA;    Jun 24 10:58:33.408809 BGP RECV Refresh capability, code=128&#xA;    Jun 24 10:58:33.408811 BGP RECV Refresh capability, code=2&#xA;    Jun 24 10:58:33.408920 BGP RECV Restart capability, code=64, time=120, flags=&#xA;    Jun 24 10:58:33.408922 BGP RECV 4 Byte AS-Path capability (65), as_num 2&#xA;    Jun 24 10:58:33.409054 advertising graceful restart receiving-speaker-only capability to neighbor 172.16.12.110 (External AS 2)&#xA;    Jun 24 10:58:33.409056 bgp_send: sending 59 bytes to 172.16.12.110 (External AS 2)&#xA;    Jun 24 10:58:33.409058&#xA;    Jun 24 10:58:33.409058 BGP SEND 172.16.12.128+179 -&amp;gt; 172.16.12.110+54592&#xA;    Jun 24 10:58:33.409060 BGP SEND message type 1 (Open) length 59&#xA;    Jun 24 10:58:33.409062 BGP SEND version 4 as 1 holdtime 90 id 192.168.11.3 parmlen 30&#xA;    Jun 24 10:58:33.409064 BGP SEND MP capability AFI=1, SAFI=1&#xA;    Jun 24 10:58:33.409066 BGP SEND Refresh capability, code=128&#xA;    ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;run monitor stop&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="2895" LastActivityDate="2013-10-08T23:12:54.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3539" PostTypeId="1" AcceptedAnswerId="3592" CreationDate="2013-10-09T02:25:29.310" Score="8" ViewCount="11355" Body="&lt;p&gt;We have a number of Cisco 891 routers configured with dual WAN links. All of these routers are running Cisco IOS 15.x In some cases, we use policy based routing to force particular traffic down one link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use PBR a lot with Dual WAN setups, as the customer generally wants certain traffic to go over a particular link. For example, I will often need to have real-time traffic such as VOIP go over one link, then general internet to go over another, and typically will use PBR to route the traffic according to source/destination IP, VLAN, or whatever fits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, it is best to still offer a degraded service if the dedicated voice link should go offline. I tend to use &lt;code&gt;set next-hop verify-availability&lt;/code&gt; with an IP SLA tracking object in order to allow the traffic to still fail-over to the other WAN, should it need to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is:&lt;/strong&gt; Is it at all possible to do the same config (wth a tracking object to verify availability) when using PBR to set an interface, instead of a next-hop?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a couple of reasons for this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;We auto-negotiate IP and routing settings in all our PPPoE Dialer interface. One of our third-party ISPs went ahead and changed the default-route for all their DSL connections. This meant that, since I had hard-coded the next-hop into the PBR config, it stopped working. Luckily, the PBR failed over to the other WAN, but in any case, I've been looking to avoid dependency on hard-coding the IP wherever I can, similar to how I do the default routes: &lt;code&gt;ip route 0.0.0.0 0.0.0.0 Dialer0 10 track 1&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Today I've been asked to configure dual WANs on some new CPE, and was going to use PBR to force our VOIP traffic down a dedicated line, failing back to the internet link if needed. The catch is that this customer is using two DSL lines from the same ISP, and so the next-hop would be the same in both cases. So obviously what I'll next do is set the interface instead, but this then means I lose my verify-avilability.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hoping some one knows what PBR config I can use to achieve this when setting interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, here's how I currently do it, with &lt;code&gt;next-hop&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; Included more detailed example.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;track 1 ip sla 1&#xA; delay down 20 up 10&#xA;!&#xA;track 2 ip sla 2&#xA; delay down 20 up 10&#xA;!&#xA;&#xA;interface FastEthernet8&#xA; description PPPoE ADSL2+ VOIP&#xA; no ip address&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 1&#xA;&#xA;interface GigabitEthernet0&#xA; description PPPoE ADSL2+ All Internet Traffic&#xA; no ip address&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 2&#xA;&#xA;interface Vlan1&#xA; description $ETH_LAN$&#xA; ip address 192.168.1.254 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; ip tcp adjust-mss 1452&#xA; ip policy route-map PBR-LAN&#xA;&#xA;interface Dialer0&#xA; description VOIP ADSL2+ Dialer Interface&#xA; bandwidth 1024&#xA; bandwidth receive 20480&#xA; ip address negotiated&#xA; no ip redirects&#xA; no ip proxy-arp&#xA; ip mtu 1492&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; encapsulation ppp&#xA; ip tcp adjust-mss 1452&#xA; dialer pool 1&#xA; dialer-group 1&#xA; ppp authentication chap pap callin&#xA; ppp chap hostname xxxx@cust.example.com&#xA; ppp chap password 0 yyyy&#xA; ppp pap sent-username xxxx@cust.example.com password 0 yyyy&#xA; no cdp enable&#xA;&#xA;interface Dialer1&#xA; description Internet ADSL2+ Dialer Interface&#xA; bandwidth 1024&#xA; bandwidth receive 20480&#xA; ip address negotiated&#xA; no ip redirects&#xA; no ip proxy-arp&#xA; ip mtu 1492&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; encapsulation ppp&#xA; ip tcp adjust-mss 1452&#xA; dialer pool 2&#xA; dialer-group 2&#xA; ppp authentication chap pap callin&#xA; ppp chap hostname zzz@cust2.example.com&#xA; ppp chap password 0 aaa&#xA; ppp pap sent-username zzz@cust2.example.com password 0 aaa&#xA; no cdp enable&#xA;&#xA;ip local policy route-map PBR-LOCAL&#xA;ip nat inside source route-map DSL2-DATA-NAT interface Dialer1 overload&#xA;ip nat inside source route-map DSL2-VOIP-NAT interface Dialer0 overload&#xA;ip route 0.0.0.0 0.0.0.0 Dialer0 10 track 1&#xA;ip route 0.0.0.0 0.0.0.0 Dialer1 track 2&#xA;&#xA;&#xA;ip access-list extended NAT-POOL&#xA; remark Be sure to exclude remote LANs in this ACL&#xA; deny   ip 192.168.1.0 0.0.0.255 192.168.7.0 0.0.0.255&#xA; permit ip 192.168.1.0 0.0.0.255 any&#xA;ip access-list extended PBR-DSL-DATA&#xA; remark Match local traffic with DSL DATA src IP&#xA; permit ip host 89.123.45.67 any&#xA;ip access-list extended PBR-DSL-VOIP&#xA; remark Match local traffic with DSL VOIP src IP&#xA; permit ip host 89.123.45.70 any&#xA;ip access-list extended VOIP-PBX&#xA; remark Match traffic to/from our VOIP PBX so it can use dedicated link.&#xA; permit ip host 89.123.45.10 any&#xA; permit ip any host 89.123.45.10&#xA;&#xA;! For the IP SLAs I simply ping the gateway of the circuit&#xA;! In this case, we have two DSL links from the same ISP&#xA;! So I simply ping the same gateway for both, with different source interfaces.&#xA;ip sla 1&#xA; icmp-echo 89.123.45.1 source-interface Dialer0&#xA; threshold 4000&#xA; frequency 5&#xA;ip sla schedule 1 life forever start-time now&#xA;ip sla 2&#xA; icmp-echo 89.123.45.1 source-interface Dialer1&#xA; threshold 4000&#xA; frequency 5&#xA;ip sla schedule 2 life forever start-time now&#xA;&#xA;! These PBR-LOCAL route-maps are used for traffic coming from&#xA;! The router itself. (eg. ICMP, IPSec) Allows it to correctly&#xA;! Respond on both links, no matter which is the primary/active link.&#xA;route-map PBR-LOCAL permit 10&#xA; description Route traffic with src IP VOIP DSL&#xA; match ip address PBR-DSL-VOIP&#xA; set interface Dialer0&#xA;!&#xA;route-map PBR-LOCAL permit 20&#xA; description Route traffic with src IP DATA DSL&#xA; match ip address PBR-DSL-DATA&#xA; set interface Dialer1&#xA;!&#xA;&#xA;route-map PBR-LAN permit 1&#xA; description This route map is to match all VOIP traffic and force it over the correct ADSL line&#xA; match ip address VOIP-PBX&#xA; ! Using next-hop is how I would typically do this sort of thing.&#xA; ! However - in this case since both links are from the same ISP, the next-hop is the same in both cases.&#xA; ! So, although I haven't tried it, I am sure the router would have no way to know exactly which link I mean.&#xA; !&#xA; ! In this example, I've used 89.123.45.1 as the gateway IP for both DSL links.&#xA; !&#xA; !&#xA; ! Try using VOIP Link&#xA; ! set ip next-hop verify-availability 89.123.45.1 1 track 1&#xA; ! If that fails, try the DATA link&#xA; ! set ip next-hop verify-availability 89.123.45.1 2 track 2&#xA; !&#xA; !&#xA; ! Because of this, my work-around has been to simply specify the Dialer interface&#xA; ! of the link I want to use. But this also means no failover to the data link.&#xA; ! Hope this makes sense.&#xA; !&#xA; !&#xA; set interface Dialer0&#xA;&#xA;&#xA;route-map DSL2-VOIP-NAT permit 10&#xA; description This route match is to match NAT traffic for the VOIP ADSL2+ Connection&#xA; match ip address NAT-POOL&#xA; match interface Dialer0&#xA;!&#xA;route-map DSL2-DATA-NAT permit 10&#xA; description This route match is to match NAT traffic for the DATA ADSL2+ Connection&#xA; match ip address NAT-POOL&#xA; match interface Dialer1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="846" LastEditorUserId="775" LastEditDate="2013-10-16T09:24:21.547" LastActivityDate="2013-10-16T09:29:01.507" Title="Cisco PBR verify-availability with interface instead of next-hop" Tags="|cisco|routing|router|cisco-ios-15|pppoe|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3540" PostTypeId="1" CreationDate="2013-10-09T11:11:13.140" Score="8" ViewCount="2350" Body="&lt;p&gt;I'm setting up dhcp snooping with IP source guard and DAI on some 3com S4210 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found problem with recording bindings in snooping database. In some cases I know that there is PC connected to interface, it use the DHCP, even switch say in debbuging that there are DHCP traffic, connection on PC works with assigned address but there's no record when I execute &lt;em&gt;display dhcp-snooping&lt;/em&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By making some experiments on table lab I found that if DHCP traffic goes within 2 access ports (both client and server are at same vlan, both connected to access ports) than it is recorded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After than I connected DHCP to trunk interface (as it is in live network, DHCP server is connected to another switch and there is relay on router), when DHCP is communicating at untagged vlan of that trunk the binding is recorded (same behavior if use client on access port with vlan 1 or client connected on port with access vlan X and I set on trunk port command &lt;em&gt;port trunk pvid vlan X&lt;/em&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If DHCP traffic comes tagged throw trunk the binding is not recorded on switch. In all cases no matter how it is configured client receives correct address from DHCP and can communicate correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without proper working binding db I can't enable IP source guard and DAI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have latest FW for this switch available (wasn't easy to find it on HP webpages but Google helped after some time)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By Google i found that on Cisco products you need to enable dhcp-snooping for vlans but on 3com did'nt find anything similar in documentation or any similar command in switch command line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did anybody had these issues to and figured out where is problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can't ask HP directly because our technical support warranty already expired and they won't talk to me (tried in different situation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Michal&lt;/p&gt;&#xA;" OwnerUserId="2898" LastEditorUserId="775" LastEditDate="2015-03-28T00:10:37.300" LastActivityDate="2015-03-28T00:10:37.300" Title="DHCP-Snooping on 3com S4210" Tags="|security|dhcp|dhcp-snooping|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3541" PostTypeId="1" AcceptedAnswerId="3542" CreationDate="2013-10-09T16:02:52.537" Score="3" ViewCount="1228" Body="&lt;p&gt;I my current setup is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco ASA port 1  | internet  | outside | vlan2&#xA;Cisco ASA port 2  | intranet  | inside  | vlan1 - dhcp 10.1.10.100 - 254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is what I am attempting to accomplish:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco ASA port 1  | internet  | outside | vlan2&#xA;Cisco ASA port 2  | intranet  | inside  | vlan1 - dhcp 10.1.10.100 - 254&#xA;Cisco ASA port 3  | intranet  | inside  | vlan3 - static 10.1.10.10 - 99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am unsure as to how to accomplish this, after searching for similar solutions, I have yet to come across a solution that is like what I need.  The reason I want this done, is we have 30+ PC's that receive their IP's dynamically, including phones, pads etc ...  However we have a few static devices, such as a few windows servers, printers and a few other devices that are intended to be static.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my current configuration, so that you might better understand what I have, vs. what I am attempting: (I will be filtering sensitive data, but will attempt to leave most of the config intact)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Result of the command: &quot;show run&quot;&#xA;&#xA;: Saved&#xA;:&#xA;ASA Version 8.2(5) &#xA;!&#xA;hostname HOST&#xA;enable password xxxxxxxxxxxxxxxx&#xA;passwd xxxxxxxxxxxxxxxxxxxxx&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.1.10.100 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 74.xx.xx.225 255.255.255.248 &#xA;!&#xA;ftp mode passive&#xA;object-group network PPTP-server&#xA;object-group network hst-10.1.10.122&#xA; description VPN-Server&#xA;object-group network DM_INLINE_NETWORK_1&#xA; network-object 192.xx.xx.0 255.255.255.0&#xA; network-object 192.xx.xx.0 255.255.255.0&#xA;access-list outside_access_in extended permit tcp any interface outside eq pptp &#xA;access-list outside_access_in extended permit icmp any any &#xA;access-list outside_1_cryptomap extended permit ip 10.1.10.0 255.255.255.0 object-group DM_INLINE_NETWORK_1 &#xA;access-list inside_nat0_outbound extended permit ip 10.1.10.0 255.255.255.0 192.xx.xx.0 255.255.255.0 &#xA;access-list inside_nat0_outbound extended permit ip 10.1.10.0 255.255.255.0 192.xx.xx.0 255.255.255.0 &#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 0 access-list inside_nat0_outbound&#xA;nat (inside) 1 10.1.10.0 255.255.255.0&#xA;static (inside,outside) tcp interface pptp 10.1.10.122 pptp netmask 255.255.255.255 &#xA;access-group outside_access_in in interface outside&#xA;route outside 0.0.0.0 0.0.0.0 74.xx.xx.230 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;http server enable&#xA;http 10.1.10.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto map outside_map 1 match address outside_1_cryptomap&#xA;crypto map outside_map 1 set pfs group5&#xA;crypto map outside_map 1 set peer 63.xx.xx.xx &#xA;crypto map outside_map 1 set transform-set ESP-3DES-SHA&#xA;crypto map outside_map interface outside&#xA;crypto isakmp enable inside&#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 10&#xA; authentication crack&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 20&#xA; authentication rsa-sig&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 30&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 40&#xA; authentication crack&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 50&#xA; authentication rsa-sig&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 60&#xA; authentication pre-share&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 70&#xA; authentication crack&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 80&#xA; authentication rsa-sig&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 90&#xA; authentication pre-share&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 100&#xA; authentication crack&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 110&#xA; authentication rsa-sig&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 120&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 130&#xA; authentication crack&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 140&#xA; authentication rsa-sig&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 150&#xA; authentication pre-share&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 170&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 5&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;dhcpd dns 75.75.75.75 75.75.76.76&#xA;dhcpd auto_config outside&#xA;!&#xA;dhcpd address 10.1.10.104-10.1.10.254 inside&#xA;dhcpd enable inside&#xA;!&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA;tunnel-group 63.xx.xx.xx type ipsec-l2l&#xA;tunnel-group 63.xx.xx.xx ipsec-attributes&#xA; pre-shared-key *****&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect pptp &#xA;  inspect icmp &#xA;!&#xA;service-policy global_policy global&#xA; : end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think being layer 3 is an issue?  Not sure? Any help achieving what I am looking for would be appreciated!  also notice there is a VPN site-to-site tunnel set up.  The configuration cannot interfere with that.&lt;/p&gt;&#xA;" OwnerUserId="2758" LastActivityDate="2013-10-09T16:23:41.627" Title="Create separated vlans for static vs dhcp -- Cisco ASA 5505" Tags="|cisco-asa|vlan|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3542" PostTypeId="2" ParentId="3541" CreationDate="2013-10-09T16:17:50.350" Score="3" Body="&lt;p&gt;I am assuming you want the devices to be in the same network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, you already have all that set up. Just set the static IP addresses on the servers/printers/..., and connect them to the same VLAN as your dynamic devices. Since your DHCP range is &lt;code&gt;.100-.254&lt;/code&gt;, using addresses below &lt;code&gt;.100&lt;/code&gt; as on statically set up devices, won't cause any problems (collisions). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish, you can connect them to the same switch as DHCP devices, or just set the &lt;code&gt;port3&lt;/code&gt; to &lt;code&gt;vlan1&lt;/code&gt; and connect them there.&lt;/p&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="1220" LastEditDate="2013-10-09T16:23:41.627" LastActivityDate="2013-10-09T16:23:41.627" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3546" PostTypeId="1" AcceptedAnswerId="3549" CreationDate="2013-10-09T20:57:02.770" Score="3" ViewCount="735" Body="&lt;p&gt;I just went through and restructured my IP pool on &lt;code&gt;vlan 1&lt;/code&gt;.  My issue is that my Windows VPN Server is now &lt;code&gt;10.1.10.11&lt;/code&gt; instead of &lt;code&gt;10.1.10.122&lt;/code&gt;.  I statically assigned the Windows server outside of my IP pool so that it would remain static.  How do I accomplish this IP address change in the ASA?  I've tried changing the object IP in the ASDM, no avail...  I am unsure what is the next step to take.  Here is my &lt;code&gt;show run&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network PPTP-server&#xA;object-group network hst-10.1.10.122  &amp;lt;-- THIS IS WHAT I NEED TO CHANGE&#xA; description VPN-Server&#xA;object-group network DM_INLINE_NETWORK_1&#xA; network-object 10.xx.xx.0 255.255.255.0&#xA; network-object 10.xx.xx.0 255.255.255.0&#xA;access-list outside_access_in extended permit tcp any interface outside eq pptp &#xA;access-list outside_access_in extended permit icmp any any &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2758" LastEditorUserId="623" LastEditDate="2013-10-10T06:04:10.187" LastActivityDate="2013-10-10T14:38:50.793" Title="CIsco ASA 5505 have to change IP address of Server due to restructure" Tags="|cisco|ipv4|cisco-asa|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3547" PostTypeId="1" AcceptedAnswerId="3548" CreationDate="2013-10-10T08:42:23.603" Score="10" ViewCount="9534" Body="&lt;p&gt;I understand (or at least I believe I do) the concept of Erlang load unit when it is applied to voice communications. Voice communications occur in real-time and measured against real-time, so naturally we can just divide the total amount of voice traffic handled by the system (measured in minutes) in certain period of time by the length of that period of time (also measured in minutes) and obtain the dimensionless load factor known as Erlang. Naturally, 60 minutes of voice carried in 60 minutes of time is 1 Erlang.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how can one apply this Erlang unit to data traffic? What do we divide by what? What is 1 Erlang for a data network? Is it even applicable? The reason I ask is that I see various Erlang-related formulas (Erlang-B and Erlang-C) being used to perform load analysis of data networks. But I'm having hard time applying the idea of Erlang unit to a network whose traffic is not measured in units of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The higher-level problem I'm working on is estimation of the load on a device that handles voice and data traffic simultaneously. And the data traffic in this case is general Internet traffic, not tied to voice communications in any way. For example, consider a cellular base station, AKA a cell site. The device has independent channels for handling voice and data traffic. How does one estimate the load in Erlangs for such device, if it is at all possible? How does one bring the different types of traffic to some sort of practically meaningful common measure?&lt;/p&gt;&#xA;" OwnerUserId="2908" LastEditorUserId="2908" LastEditDate="2013-10-10T22:25:21.943" LastActivityDate="2015-06-03T10:16:12.620" Title="What is &quot;1 Erlang&quot; for network data traffic?" Tags="|protocol-theory|terminology|voice|telephony|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3548" PostTypeId="2" ParentId="3547" CreationDate="2013-10-10T08:51:49.677" Score="13" Body="&lt;h2&gt;Background&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;An &lt;a href=&quot;http://en.wikipedia.org/wiki/Erlang_%28unit%29&quot;&gt;Erlang&lt;/a&gt; measures load on a &lt;a href=&quot;http://en.wikipedia.org/wiki/Circuit_switching&quot;&gt;Circuit-Switched&lt;/a&gt; link.  Quoting &lt;a href=&quot;http://www.unc.edu/~rowlett/units/dictE.html#erlang&quot;&gt;Russ Rowlett's page&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The erlang is a dimensionless &quot;unit&quot; representing a traffic density of one call-second per second (or one call-hour per hour, etc.).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The classical definition of an &lt;a href=&quot;http://en.wikipedia.org/wiki/Erlang_%28unit%29&quot;&gt;Erlang&lt;/a&gt; was developed in the early 1900s by Professor &lt;a href=&quot;http://en.wikipedia.org/wiki/Agner_Krarup_Erlang&quot;&gt;A.K. Erlang&lt;/a&gt;.  Erlang's definition does not apply generically to data traffic, because there is no standard definition of a &quot;call&quot; in data traffic, nor is there call-blocking as you would find in a fully-utilized &lt;a href=&quot;http://en.wikipedia.org/wiki/Circuit_switching&quot;&gt;Circuit-Switched&lt;/a&gt; link.  If we make some assumptions about the data network and the type of calls, we can shoe-horn the measurement into a data network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Erlang-B and Erlang-C evolved from classical analysis of circuit-switched networks; they can also be &lt;a href=&quot;http://www.scirp.org/journal/PaperDownload.aspx?paperID=6770&quot;&gt;adapted for use in data networks&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Q &amp;amp; A&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Question 1&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Q1&lt;/strong&gt;: How does this apply to data traffic?&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;A1&lt;/strong&gt;: You first have to define what a call is, the bandwidth consumed by a call, and the criteria for blocking a call.  Typically you define bandwidth per data call by referencing how much bandwidth is consumed by the &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk652/tk698/technologies_tech_note09186a0080094ae2.shtml#topic1&quot;&gt;Voice Codec&lt;/a&gt; in question.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Question 2&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Q2&lt;/strong&gt;: What do we divide by what?&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;A2&lt;/strong&gt;: If you're strictly asking about basic &lt;a href=&quot;http://en.wikipedia.org/wiki/Erlang_%28unit%29&quot;&gt;Erlang&lt;/a&gt; calculations, see below.  Erlang-B and Erlang-C are a little easier to apply to a data network, because of queuing dynamics that are common to both circuit-switched and data networks.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the purposes of a basic Erlang calculation... First, let's assume that voice gets absolute priority across the data network in question.  Next, let's define the type of link we're dealing with (because the overhead of a call on &lt;a href=&quot;http://en.wikipedia.org/wiki/Ethernet&quot;&gt;Ethernet&lt;/a&gt; is different than a &lt;a href=&quot;http://en.wikipedia.org/wiki/Packet_over_SONET/SDH&quot;&gt;Packet-over-SONET&lt;/a&gt; link).  Finally, let's define some call rejection criteria... the simplest is that the call is rejected if you don't have enough incremental bandwidth for another call (ref the &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk652/tk698/technologies_tech_note09186a0080094ae2.shtml#topic1&quot;&gt;Voice Codec&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you define those boundaries...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;C is the total capacity (in bits-per-second) dedicated to voice traffic&lt;/li&gt;&#xA;&lt;li&gt;A is the bandwidth consumed by a single voice call, (ref &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk652/tk698/technologies_tech_note09186a0080094ae2.shtml#topic1&quot;&gt;Voice Codec&lt;/a&gt;s)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The formula to calculate the Erlang capacity (per unit of time)... &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Erlang capacity (per unit of time) = C / A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's apply this to a 100Mbps Ethernet link, using &lt;a href=&quot;http://en.wikipedia.org/wiki/G.729&quot;&gt;G.729&lt;/a&gt; voice calls (i.e 39200 bps per call).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;C = 100000000&lt;/li&gt;&#xA;&lt;li&gt;A = 39200&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Maximum Erlang capacity of a FastEthernet link (using &lt;a href=&quot;http://en.wikipedia.org/wiki/G.729&quot;&gt;G.729&lt;/a&gt; calls, which are assumed to have 100% of the link):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;100000000 bps / 39200 bps = 2551.02 Erlangs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Bandwidth Assumptions&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My assumptions about the &lt;a href=&quot;http://en.wikipedia.org/wiki/G.729&quot;&gt;G.729&lt;/a&gt; packet (ref Cisco's &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk652/tk698/technologies_tech_note09186a0080094ae2.shtml#topic1&quot;&gt;Voice Codec&lt;/a&gt; numbers)...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ethernet inter-frame overhead - &lt;a href=&quot;http://en.wikipedia.org/wiki/Preamble_%28communication%29&quot;&gt;Preamble&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Start_frame_delimiter&quot;&gt;SFD&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Interframe_gap&quot;&gt;IFG&lt;/a&gt;: 20 Bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Ethernet&quot;&gt;Ethernet&lt;/a&gt; II header &amp;amp; CRC: 18 Bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/IPv4&quot;&gt;IP&lt;/a&gt;v4 Header: 20 Bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/User_Datagram_Protocol&quot;&gt;UDP&lt;/a&gt; Header: 8 Bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Real-time_Transport_Protocol&quot;&gt;RTP&lt;/a&gt; Header: 12 Bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/G.729&quot;&gt;G.729&lt;/a&gt; Voice Payload: 20 Bytes &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Total &lt;a href=&quot;http://en.wikipedia.org/wiki/G.729&quot;&gt;G.729&lt;/a&gt; ethernet frame (including all overhead): 98 Bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Total bandwidth of &lt;a href=&quot;http://en.wikipedia.org/wiki/G.729&quot;&gt;G.729&lt;/a&gt; over ethernet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;50 G.729 packets/sec * 98 Bytes/G.729 packet * 8 bits/Byte =  39200 bits/second&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: I took the liberty of modifying Cisco's listed bandwidth of 31.2Kbps per &lt;a href=&quot;http://en.wikipedia.org/wiki/G.729&quot;&gt;G.729&lt;/a&gt; call, because they leave out the Ethernet framing overhead in that number.  The simplest way to illustrate this without making the math more complicated is to include ethernet inter-frame overhead in the &lt;a href=&quot;http://en.wikipedia.org/wiki/G.729&quot;&gt;G.729&lt;/a&gt; bandwidth consumed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Question 3&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Q3&lt;/strong&gt;: What is one Erlang of data traffic?&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;A3&lt;/strong&gt;: It's probably obvious by now... it depends on how the call is sent over the data network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-10-10T13:05:54.373" LastActivityDate="2013-10-10T13:05:54.373" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3549" PostTypeId="2" ParentId="3546" CreationDate="2013-10-10T13:01:23.470" Score="5" Body="&lt;p&gt;That's actually just the name/identifier for that object. The object in question actually has no host address associated with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to add to that existing object, then type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config t&#xA;object-group network hst-10.1.10.122&#xA; network-object 10.1.10.11 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you want to rename the object and add the host to it, do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config t&#xA;no object-group network hst-10.1.10.122 ! This deletes the object&#xA;object-group network [desired name]&#xA; network-object 10.1.10.11 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A word of warning would be to make sure that object isn't being referred to anywhere else in the config. If it is, make sure to replace all instances with your new object if necessary. &lt;/p&gt;&#xA;" OwnerUserId="301" LastEditorUserId="301" LastEditDate="2013-10-10T14:38:50.793" LastActivityDate="2013-10-10T14:38:50.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3550" PostTypeId="1" CreationDate="2013-10-10T15:21:32.207" Score="0" ViewCount="153" Body="&lt;p&gt;I've setup some static nat entries in an ASA 5505.  If I ping the external ip, the response I get back is the internal ip address...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ping 12.12.12.4&#xA;PING 12.12.12.4 (12.12.12.4): 56 data bytes&#xA;64 bytes from 10.10.3.4: icmp_seq=0 ttl=125 time=1.342 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;12.12.12.4 is the external ip and 10.10.3.4 is the internal ip of the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The asa has the following static nat entry:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static (inside,outside) 12.12.12.4 10.10.3.4 netmask 255.255.255.255 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there anything I can be missing that would cause this?  &lt;/p&gt;&#xA;" OwnerUserId="864" LastActivityDate="2013-10-11T22:55:16.593" Title="ASA 5505 Odd Issue" Tags="|cisco-asa|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3553" PostTypeId="2" ParentId="3550" CreationDate="2013-10-10T23:04:32.243" Score="1" Body="&lt;p&gt;From the look of it, you want to translate incoming packets originating from the 12.12.12.4 address, so that they appear to have the source address of the internal IP 10.10.3.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The syntax for this command is: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;i&gt;static (outside,inside) 10.10.3.4 12.12.12.4 netmask 255.255.255.255&lt;/i&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &#xA;Cisco ASA 5500 Series Configuration Guide Using CLI 8.2 - Configuring Static NAT&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_static.html#wp1080960&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_static.html#wp1080960&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2912" LastEditorUserId="2912" LastEditDate="2013-10-11T22:55:16.593" LastActivityDate="2013-10-11T22:55:16.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3556" PostTypeId="1" AcceptedAnswerId="3561" CreationDate="2013-10-11T05:17:23.567" Score="8" ViewCount="685" Body="&lt;p&gt;Suppose an ADSL2 Annex A device had a upload speed of 300kbps; tested using a TCP connection. Now suppose I want to send 8-byte UDP keep-alive packets at the maximum possible rate*. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would the effective packet forwarding rate be 4,800 p/s or considerably less than this due to the tiny size of the packets? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the packet forwarding rate for UDP strictly linear to packet size? (i.e. Half the size, twice the rate.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;* The application's objective being to notify as many different known peers as possible that this peer is &quot;alive and open for business&quot; without requiring a centralised tracker. The maximum packet forwarding rate defines the maximum decentralised size of the application's P2P (sparse) mesh network.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="2864" LastEditorUserId="775" LastEditDate="2013-10-11T09:37:03.087" LastActivityDate="2013-10-15T17:30:59.977" Title="Is ADSL's UDP packet forwarding rate strictly linear to packet size?" Tags="|ethernet|protocol-theory|adsl|atm|pppoe|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3557" PostTypeId="1" CreationDate="2013-10-11T05:57:56.303" Score="2" ViewCount="1088" Body="&lt;p&gt;ASA 5585-X with SSP-10 and IPS-SSP 60&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Slot 0:SSP-10 works fine&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Slot 1:IPS-SSP-60 is not responsive, ports not coming up, show module cannot detect software version, boot image missing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Management 0/0 on SSP-10 is connected to tftp server. I can download the image from tftp to CF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image recovery procedure in Cisco documentations say there is no way to directly set boot image for IPS SSP. I have to use tftp in rommon or put the module in recovery mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set recovery config and put the module into recovery mode but console on IPS SSP still shows boot loop because no valid image found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I know SSP-10 + IPS-SSP 60 is not supported by TAC. Does this work at all? ports can stay up for only 20 seconds on IPS-SSP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Why management interfaces on IPS SSP not showing up as management 1/0, 1/1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Do I need to connect IPS SSP's management port to tftp server (SSP's management port already connected to tftp server)? Then how do I reference the management ports on IPS SSP since they are not shown in #show interface ip brief&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone give me some hints why the recovery is not working? Apparently I can't open a case with TAC for this issue.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="775" LastEditDate="2013-10-11T06:35:35.527" LastActivityDate="2013-11-10T20:15:46.247" Title="ASA 5585-X IPS-SSP image recovery?" Tags="|cisco|cisco-asa|intrusion-prevention|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3558" PostTypeId="1" CreationDate="2013-10-11T05:59:08.290" Score="3" ViewCount="459" Body="&lt;p&gt;How can I monitor on a Cisco router if dot1Q packets arrive on the trunk interface or if others arrive on that interface (like ISL, the old protocol of Cisco)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this and what is the best way to do this? Can it be done via monitoring or through the use of ACL's or debugging options? This would be handy for troubleshooting.&lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="105" LastEditDate="2013-10-11T06:50:38.587" LastActivityDate="2013-10-11T10:30:20.357" Title="Cisco router dot1Q monitoring" Tags="|cisco|cisco-commands|monitoring|best-practices|dot1q|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3559" PostTypeId="5" CreationDate="2013-10-11T06:54:30.277" Score="0" Body="&lt;p&gt;Intrusion Prevention devices monitor networks for malicious behavior. Typically they:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Attempt to classify behavior as malicious&lt;/li&gt;&#xA;&lt;li&gt;Log information about malicious behavior&lt;/li&gt;&#xA;&lt;li&gt;Attempt to block the malicious behavior&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Intrusion Prevention devices detect malicious behavior by using one, or a combination of the following methods&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Detect attack signatures: The device monitors bit patterns on the network, and classifies behavior based on the bit patterns it sees&lt;/li&gt;&#xA;&lt;li&gt;Detect statistical anomalies: The device monitors patterns such as traffic volume, protocol ports, and time of day.  Behavior is classified when statistical anomalies are identified in the behavior&lt;/li&gt;&#xA;&lt;li&gt;Detect unusual protocol states: The device is programmed detailed information about the states of a variety of protocols.  Behavior is classified based on anomalous protocol state patterns.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-10-11T06:54:30.277" LastActivityDate="2013-10-11T06:54:30.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3560" PostTypeId="4" CreationDate="2013-10-11T06:54:30.277" Score="0" Body="This tag is for questions about any device that performs an intrusion prevention function." OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-10-11T06:54:30.277" LastActivityDate="2013-10-11T06:54:30.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3561" PostTypeId="2" ParentId="3556" CreationDate="2013-10-11T09:24:15.413" Score="10" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Is ADSL's UDP packet forwarding rate strictly linear to packet size?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The answer is &amp;quot;no, because of the variable nature of ATM AAL5 padding used in ADSL lines&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Since you aren't sure what encapsulation is used on the ADSL modem, I'll assume it's &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2516&quot; rel=&quot;nofollow noreferrer&quot;&gt;PPPoE&lt;/a&gt;, most providers use &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2516&quot; rel=&quot;nofollow noreferrer&quot;&gt;PPPoE&lt;/a&gt; for customer connections.  I also assume that you've measured the full ATM bandwidth available to the modem.  I made several other assumptions... see below for all of them.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Would the effective packet forwarding rate be 4,800 p/s or considerably less than this due to the tiny size of the packets?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It is considerably less than 4800 pps because PPPoE requires the ADSL modem to encapsulate the entire ethernet frame in the ADSL payload.  To find the forwarding rate of 8-byte UDP packets on this ADSL line...&#xA;&lt;br&gt;&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;First we have to find how many packets per second of PPPoE you're sending when you measured the download speed.  Given the assumption of 300Kbps (1452-byte TCP payloads) in the question, calculate the PPPoE packets per second (pps)...&lt;/p&gt;&#xA;&lt;p&gt;(300*1000 bps) / (1452 Bytes/packet * 8 bits/Byte) = 25.826 1452-byte TCP pps&#xA;&lt;br&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now we need to calculate the number of ATM cells per second required for 300Kbps of 1452-byte TCP payloads over PPPoE... Assume the AAL5 MUX PDU is 1536 Bytes including padding, which equates to 32 ATM Cells per PPPoE packet (at 1452 byte TCP payloads).&lt;/p&gt;&#xA;&lt;p&gt;(25.826 PPPoE pps) * (32 ATM Cells per PPPoE packet) = 826.45 ATM Cells per second&#xA;(826.45 ATM Cells per second) * (53 bytes per ATM cell) * (8 bits per Byte) = 350413.22 bps&#xA;&lt;br&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Finally, we can use this number to derive the number of 8-byte UDP payloads... each 8-byte UDP packet encapsulated in PPPoE is 2 ATM cells...&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;strong&gt;Answer&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;(826.45 cells per second) / (2 cells per UDP packet) = 413.22 8-byte UDP pps&lt;/code&gt;&lt;/p&gt;&#xA;&lt;h2&gt;References &amp;amp; Assumptions&lt;/h2&gt;&#xA;&lt;p&gt;Informational references:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080093c9a.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Measuring the Utilization of ATM PVCs&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Point-to-point_protocol_over_Ethernet#Protocol_overhead&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia: PPPoE Overhead&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I am assuming:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You have 1518 byte &lt;a href=&quot;http://en.wikipedia.org/wiki/Ethernet_II#Ethernet_II&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethernet II&lt;/a&gt; frames on your LAN...&lt;/li&gt;&#xA;&lt;li&gt;You have a constant bit rate upload at the ATM layer (ADSL uses ATM cells)&lt;/li&gt;&#xA;&lt;li&gt;Your provider requires &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2516&quot; rel=&quot;nofollow noreferrer&quot;&gt;PPPoE&lt;/a&gt; encapsulation&lt;/li&gt;&#xA;&lt;li&gt;You have no rate-limiting on your LAN&lt;/li&gt;&#xA;&lt;li&gt;You measured 100% of your ADSL modem's ATM cell capacity when you measured 300Kbps of TCP payload&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;A generic Ethernet UDP packet with an 8-byte payload, inside &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2516&quot; rel=&quot;nofollow noreferrer&quot;&gt;PPPoE&lt;/a&gt; looks like this...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;+------------------------------+&#xA;| Ethernet II Header: 14 Bytes |&#xA;+------------------------------+&#xA;|     PPP Header: 2 Bytes      |&#xA;+------------------------------+&#xA;|    PPPoE Header: 6 Bytes     |&#xA;+------------------------------+&#xA;|    IPv4 Header: 20 Bytes     |&#xA;+------------------------------+&#xA;|      UDP Header: 8 Bytes     |&#xA;+------------------------------+&#xA;|      UDP Payload: 8 Bytes    |  &amp;lt;------ Payload here&#xA;+------------------------------+&#xA;| Ethernet padding to 64 Bytes |&#xA;|     This pad is 2 Bytes      |&#xA;+------------------------------+&#xA;|   Ethernet CRC32: 4 Bytes    |&#xA;+------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;A generic AAL5 MUX PDU with PPPoE and a 8-byte UDP payload looks like this... With AAL5 padding, the total PDU is 96 bytes, which is 2 ATM cells.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;+------------------------------+&#xA;| Ethernet II Header: 14 Bytes |&#xA;+------------------------------+&#xA;|     PPP Header: 2 Bytes      |&#xA;+------------------------------+&#xA;|    PPPoE Header: 6 Bytes     |&#xA;+------------------------------+&#xA;|    IPv4 Header: 20 Bytes     |&#xA;+------------------------------+&#xA;|      UDP Header: 8 Bytes     |&#xA;+------------------------------+&#xA;|      UDP Payload: 8 Bytes    |&#xA;+------------------------------+&#xA;| Ethernet padding to 64 Bytes |&#xA;|     This pad is 2 Bytes      |&#xA;+------------------------------+&#xA;|   Ethernet CRC32: 4 Bytes    |&#xA;+------------------------------+&#xA;| AAL5 Padding: Up to 47 Bytes |  &amp;lt;------ Used to keep the PDU at even 48-byte ATM payloads&#xA;|     This pad is 24 Bytes     |&#xA;+------------------------------+&#xA;|  AAL5 CPCS Trailer: 8 Bytes  |&#xA;+------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;A generic Ethernet MTU-sized TCP packet inside &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2516&quot; rel=&quot;nofollow noreferrer&quot;&gt;PPPoE&lt;/a&gt; looks like this...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;+------------------------------+&#xA;| Ethernet II Header: 14 Bytes |&#xA;+------------------------------+&#xA;|     PPP Header: 2 Bytes      |&#xA;+------------------------------+&#xA;|    PPPoE Header: 6 Bytes     |&#xA;+------------------------------+&#xA;|    IPv4 Header: 20 Bytes     |&#xA;+------------------------------+&#xA;|     TCP Header: 20 Bytes     |&#xA;+------------------------------+&#xA;|   TCP Payload: 1452 Bytes    |  &amp;lt;------ Payload here&#xA;+------------------------------+&#xA;|   Ethernet CRC32: 4 Bytes    |&#xA;+------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;A generic AAL5 MUX PDU with PPPoE and a 1452-byte TCP payload looks like this... with AAL5 padding the total PDU is 1536 bytes, which is 32 ATM cells.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;+------------------------------+&#xA;| Ethernet II Header: 14 Bytes |&#xA;+------------------------------+&#xA;|     PPP Header: 2 Bytes      |&#xA;+------------------------------+&#xA;|    PPPoE Header: 6 Bytes     |&#xA;+------------------------------+&#xA;|    IPv4 Header: 20 Bytes     |&#xA;+------------------------------+&#xA;|     TCP Header: 20 Bytes     |&#xA;+------------------------------+&#xA;|   TCP Payload: 1452 Bytes    |&#xA;+------------------------------+&#xA;|   Ethernet CRC32: 4 Bytes    |&#xA;+------------------------------+&#xA;| AAL5 Padding: Up to 47 Bytes |  &amp;lt;------ Used to keep the PDU at even 48-byte ATM payloads&#xA;|     This pad is 10 Bytes     |&#xA;+------------------------------+&#xA;|  AAL5 CPCS Trailer: 8 Bytes  |&#xA;+------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-10-15T17:30:59.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3562" PostTypeId="1" CreationDate="2013-10-11T10:23:18.277" Score="6" ViewCount="3136" Body="&lt;p&gt;I am trying to figure out a way to keep track of network equipment, including chassis and service modules/line cards. So when I need to find something, I know where I can find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) telnet access available&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) IOS, IOS-XE, IOS-XR, NX-OS, ASA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering how feasible is it to use script to parse something like #show modules, #show diag in a large scale. Any better ideas? Yes they do have asset tags but they keep getting moved around and scanning the tags is way too much work to keep the information updated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw SNMP is nice but it's probably not going to work in this environment. Connections and configs get changed on daily basis.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="775" LastEditDate="2013-10-16T08:54:17.073" LastActivityDate="2013-10-16T08:54:17.073" Title="Solution for network inventory?" Tags="|cisco|management|" AnswerCount="6" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3563" PostTypeId="2" ParentId="3558" CreationDate="2013-10-11T10:30:20.357" Score="2" Body="&lt;p&gt;If your router supports span ports you can anaylze the traffic using Wireshark. Wireshark understands both ISL and dot1q, for more information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark ISL reference &lt;a href=&quot;http://www.wireshark.org/docs/dfref/i/isl.html&quot; rel=&quot;nofollow&quot;&gt;http://www.wireshark.org/docs/dfref/i/isl.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of a capture containing both techniques: &lt;a href=&quot;http://wiki.wireshark.org/SampleCaptures?action=AttachFile&amp;amp;do=get&amp;amp;target=isl-2-dot1q.cap&quot; rel=&quot;nofollow&quot;&gt;http://wiki.wireshark.org/SampleCaptures?action=AttachFile&amp;amp;do=get&amp;amp;target=isl-2-dot1q.cap&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2914" LastActivityDate="2013-10-11T10:30:20.357" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3564" PostTypeId="2" ParentId="3562" CreationDate="2013-10-11T10:31:01.987" Score="3" Body="&lt;p&gt;I run python scripts to parse inventory (for the same platforms) on a daily basis... The best options I have found are parsing CLI &lt;a href=&quot;http://www.cisco.com/en/US/docs/net_mgmt/network_analysis_module_software/4.2/command/reference/guide/cmdspart5.html#wp1064721&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;show inventory&lt;/code&gt;&lt;/a&gt;, &quot;show mod&quot; (for platforms that don't support &lt;code&gt;show inventory&lt;/code&gt;), and polling &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.47&quot; rel=&quot;nofollow&quot;&gt;ENTITY-MIB&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly, I have to use all three mechanisms, since there isn't a one-size fits all solution for all Cisco HW / SW permutations, unless &lt;a href=&quot;http://www.cisco.com/en/US/products/ps11686/index.html&quot; rel=&quot;nofollow&quot;&gt;Cisco NCS&lt;/a&gt; can do it... I haven't tried NCS yet, so I can't say.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-10-11T10:31:01.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3566" PostTypeId="1" AcceptedAnswerId="3569" CreationDate="2013-10-11T16:32:56.177" Score="1" ViewCount="741" Body="&lt;p&gt;I am configuring some policy statements on JunOS 11. I am filtering inbound BGP prefixes using the below syntax. It's fairly simply and self explanatory, you can guess whats it's doing just by looking at it. However I am unsure of the &lt;code&gt;route-filter&lt;/code&gt; keyword.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routes come in from a BGP neighbor and go through the various tables and processes etc (too much to expand on here), is the &lt;code&gt;route-filter&lt;/code&gt; a part of the OS that all received prefixes are passed through before hitting a process RIB (like BGP RIP of ISIS RIB) or the main FIB? By creating this policy statement does it create hooks inside the &lt;code&gt;route-filter&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-statement PS-Deny-Some-Prefixes-Mwuhahaha {&#xA;    term 1 {&#xA;        from {&#xA;            route-filter 1.2.3.0/24 orlonger reject;&#xA;            route-filter 7.7.7.0/7 orlonger reject;&#xA;        }&#xA;        then reject;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As a side question; JunOS allowed be to write the &lt;code&gt;reject&lt;/code&gt; keyword on the end of the prefix statements, will his have any effect as I have a &lt;code&gt;then&lt;/code&gt; clause? Is either place preferred over the other? I would say the &lt;code&gt;then&lt;/code&gt; clause is neater but is there any other benefit?&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="623" LastEditDate="2013-10-12T14:10:14.767" LastActivityDate="2013-10-12T14:10:14.767" Title="JunOS: Using route-filter in policy statements" Tags="|security|firewall|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3567" PostTypeId="2" ParentId="3562" CreationDate="2013-10-11T18:14:47.717" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://sourceforge.net/projects/switchmap/&quot; rel=&quot;nofollow&quot;&gt;Switchmap&lt;/a&gt; is SNMP-based, but it might be worth taking a look at for building inventories of equipment, modules, etc.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-10-11T18:14:47.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3568" PostTypeId="2" ParentId="3557" CreationDate="2013-10-11T19:14:17.583" Score="3" Body="&lt;p&gt;From the &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/ips/7.1/installation/guide/hw_installing_ssp.pdf&quot; rel=&quot;nofollow&quot;&gt;Cisco documentation&lt;/a&gt;: &quot;The ASA 5585-X IPS SSP must be at the same level as the ASA 5585-X SSP model; for example, if you have the ASA 5585-X with SSP-10, you can only install the IPS SSP-10.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, generally to answer your questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) No, it should not be possible, and somewhere in the logging or debugging it will probably tell you that it is disabling the IPS-SSP because it isn't compatible; or it will show that the SSP is trying to transfer an incompatible image to the IPS-SSP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) If the module is disabled (or booting), the interfaces generally won't be shown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) This is really a moot point since you probably won't be able to do anything at all with the IPS-SSP if it is disabled or not booted entirely.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-10-11T19:31:10.147" LastActivityDate="2013-10-11T19:31:10.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3569" PostTypeId="2" ParentId="3566" CreationDate="2013-10-11T21:55:52.377" Score="4" Body="&lt;p&gt;I think (and someone please correct me if my thinking is wrong). Your prefixes come to RIBin where they filtered and put in RIBlocal, and if you want them advertised/exported and filtered maybe ,they are put in RIBout. You can view this with 'show route [receive-protocol | advertising-protocol]'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the side question, reject/accept keyword takes preference over the then clause, you can have for example one reject route filter and one route filter that is accepted in the then clause.&#xA;Policy statements with such route filters should be read carefully.&lt;/p&gt;&#xA;" OwnerUserId="235" LastEditorUserId="235" LastEditDate="2013-10-11T22:28:44.820" LastActivityDate="2013-10-11T22:28:44.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3570" PostTypeId="1" AcceptedAnswerId="3611" CreationDate="2013-10-11T22:03:39.457" Score="6" ViewCount="5464" Body="&lt;p&gt;Our current 802.11 setup has a large number of SSIDs to segregate traffic by subnet. This isn't ideal, and I've been attempting to consolidate to a single SSID but use dynamic VLANs instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is on a Ruckus Zonedirector 3000 and Microsoft NPS as the RADIUS server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My test clients connect to the SSID, and are prompted for credentials. I can see the credentials accepted on the NPS server, and wireshark confirms the Access-Accept message contains the Tunnel-Private-Group-ID value for the desired VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point the client stalls trying to get a DHCP lease. The DHCP server is working, as these are existing scopes and subnets and I can connect a wired client into the switch on an access port for the same vlan and get a lease.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark shows no DHCP broadcast request from the client at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switchport for the AP is a trunk, with the VLAN tagged and allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any assistance would be greatly appreciated!&#xA;Rob&lt;/p&gt;&#xA;" OwnerUserId="309" LastEditorUserId="775" LastEditDate="2013-10-30T06:13:08.720" LastActivityDate="2013-10-30T06:13:08.720" Title="Wireless (Ruckus) and Dynamic VLAN Assignment via Microsoft NPS" Tags="|wireless|vlan|dhcp|ieee-802.1x|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3572" PostTypeId="2" ParentId="3562" CreationDate="2013-10-12T00:49:39.197" Score="5" Body="&lt;p&gt;Something like &lt;a href=&quot;http://www.shrubbery.net/rancid/&quot;&gt;RANCID&lt;/a&gt; might help you out here. Plus, if you don't do config management it would take care of that for you as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RANCID goes out and logs into all of your devices [launched via cron] grabs config/inventory, places it in a source control system and emails you config/inventory diffs. (This would catch any hardware moving around)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using RANCID for inventory tracking isnt all that pretty though. I just grep what I am looking for from the config/inventory archive.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rancid@network configs$ grep XENPAK *&#xA;6509-1.stackexchange.com:!PID: XENPAK-10GB-SR&#xA;6509-1.stackexchange.com:!PID: XENPAK-10GB-SR&#xA;6509-1.stackexchange.com:!PID: XENPAK-10GB-LR&#xA;6509-1.stackexchange.com:!PID: XENPAK-10GB-SR&#xA;6509-1.stackexchange.com:!PID: XENPAK-10GB-SR&#xA;6509-1.stackexchange.com:!PID: XENPAK-10GB-SR&#xA;6509-1.stackexchange.com:!PID: XENPAK-10GB-LR&#xA;6509-1.stackexchange.com:!PID: XENPAK-10GB-SR&#xA;core-2.stackexchange.com:!PID: XENPAK-10GB-LR            VID: V02 , SN: XXXXXXXXXXX&#xA;core-2.stackexchange.com:!PID: XENPAK-10GB-LR            VID: V02 , SN: XXXXXXXXXXX&#xA;core-2.stackexchange.com:!PID: XENPAK-10GB-LR            VID: V02 , SN: XXXXXXXXXXX&#xA;core-2.stackexchange.com:!PID: XENPAK-10GB-LR            VID: V02 , SN: XXXXXXXXXXX&#xA;rancid@network configs$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since this is all kept in a revision control system you can look back to see when a module was added or removed.&lt;/p&gt;&#xA;" OwnerUserId="2920" LastActivityDate="2013-10-12T00:49:39.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3573" PostTypeId="1" CreationDate="2013-10-12T04:33:30.810" Score="-1" ViewCount="792" Body="&lt;p&gt;Everything I have read and experienced with both Cisco 2950 and 3550 switches seems to confirm the ports will not support Auto-MDIX. However yesterday when connecting a 3550 and 2950 I forgot to use a crossover cable. It worked anyway. Am I missing something? &lt;/p&gt;&#xA;" OwnerUserId="2921" LastEditorUserId="8499" LastEditDate="2018-12-21T04:07:28.940" LastActivityDate="2018-12-21T04:07:28.940" Title="Cisco 2950 - 3550 with a straight through cable" Tags="|cisco|layer1|cable|cabling|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3574" PostTypeId="2" ParentId="3573" CreationDate="2013-10-12T16:10:18.033" Score="1" Body="&lt;p&gt;In my experience, I've observed virtually all newer (by newer, I mean post-2005) Cisco switch and router platforms support auto-sensing - at minimum on GBIC/SFP interfaces, and usually on all ethernet interfaces. Even the Cisco 500 series small-business switches have support for it, although it's not clearly documented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While the platforms do [mostly] support it, it's a good idea to assume the platform doesn't and use the proper cables anyway.&lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2013-10-12T16:10:18.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3575" PostTypeId="1" CreationDate="2013-10-12T18:27:22.287" Score="4" ViewCount="1640" Body="&lt;p&gt;I've been doing some research in to OpenVPN, MTU, JumboFrames, ect... and want to make sure that I have this right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I increase the MTU over 1500 to 9000 for OpenVPN when connecting to a remote server over the internet, I'll have fragmentation and won't gain any performance due to the fact that I don't know if the routers that handle my packets support jumboframes?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="8499" LastEditDate="2018-03-22T15:10:18.257" LastActivityDate="2018-03-22T15:10:18.257" Title="OpenVPN, JumboFrames and the Internet" Tags="|ipv4|vpn|internet|mtu|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3576" PostTypeId="2" ParentId="3575" CreationDate="2013-10-12T18:53:10.573" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If I increase the MTU over 1500 to 9000 for OpenVPN when connecting to a remote server over the internet, I'll have fragmentation and won't gain any performance due to the fact that I don't know if the routers that handle my packets support jumboframes?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Many providers still use 1500 byte IP MTUs; you cannot depend on anything larger.  It is very unlikely that you will see 9000 Byte IP packets make it to another internet destination without fragmentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI, fragmentation almost always happens in a router's CPU packet procesing path.  ASICs normally don't handle fragmentation, it's done by punting to the CPU of the router / L3 switch... thus you stand a decent chance of making your performance worse by using Jumbos through the internet... the first-hop that has a 1500 Byte MTU would punt all jumbos to the CPU, which would limit your transfer speed as well.  On the other end, you wind up reassembling the packets, which adds yet another possible complication to making transfers faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Caveat:  I personally don’t know if OpenVPN sets or clears the DF bit in the IP header.  If it’s set, packets larger than the providers IP MTU will get dropped.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2018-03-22T11:33:19.447" LastActivityDate="2018-03-22T11:33:19.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3577" PostTypeId="1" AcceptedAnswerId="3579" CreationDate="2013-10-12T20:45:59.347" Score="6" ViewCount="2146" Body="&lt;p&gt;I'm struggling to understand 1 or 2 things about packet and circuit switching.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;In circuit switching, resources are not shared and a it's guaranteed full capacity to the call right? They are &quot;reserved&quot; for a certain call/circuit. But in TDM aren't users sharing the link? And in FDM the capacity is divided so users can use the link at same time, but on different frequencies, isn't that sharing and capacity division?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Why is circuit switching slower and less responsive than packet switching?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="2925" LastActivityDate="2014-05-07T20:13:54.100" Title="Circuit and Packet Switching" Tags="|switch|switching-modes|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3578" PostTypeId="2" ParentId="3577" CreationDate="2013-10-12T21:56:56.207" Score="4" Body="&lt;p&gt;A &quot;circuit&quot; doesn't necessarily mean the same thing as a physical electrical circuit. That's where the term started out, but when various multiplexing schemes were invented, such as TDM, &quot;circuit&quot; acquired the meaning of a certain channel or slot inside the physical connection. In the T-carrier system, for example, the unit called the &quot;circuit&quot; is the 64kbps DS0 signal, and a T1 or T3 is a logical collection of these circuits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FDM actually can be used for circuit switching, and &lt;a href=&quot;http://en.wikipedia.org/wiki/12-channel_carrier_system&quot; rel=&quot;nofollow&quot;&gt;this was actually done&lt;/a&gt; in the early days of long-distance telephony. In this scheme, the &quot;circuit&quot; is a logical unit of a certain analog bandwidth, and each of these can be set up and disconnected individually at the multiplexer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Circuit switching is not &lt;em&gt;necessarily&lt;/em&gt; slower, because the capacity and delay guarantees can prevent slowdowns that result from overuse of links. The sense in which this is normally said is that a circuit-switched network requires some time to establish a connection before sending data, whereas a packet-switched one can just fire off a packet to some host without need handshaking.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-10-12T21:56:56.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3579" PostTypeId="2" ParentId="3577" CreationDate="2013-10-12T23:41:20.327" Score="7" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;With circuit switching, you have a 1-to-1 circuit with some predefined channel capacity which is guaranteed. For it to work, you must first establish a circuit/connection before you send any data, and break the connection after. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;With packet switching, it's somewhat like the local post office - you bring the packets, send them, and let the other devices forward them around, to one or many different destinations. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What you mentioned in the first part is called multiplexing. When you establish, for example, a phone call, you get a 1-on-1 connection with the other side, and full channel capacity&amp;nbsp;— 0–3400kHz for voice (at least in some parts of Europe), which only you can use. Since using separate wires is expensive, different multiplexing technologies have appeared, such as TDM, where your channel is &quot;compressed&quot;, but you still have a 1-to-1 connection with the same capacity. With FDM, your call is mixed up to higher frequencies, but you still get a 1-to-1 channel, with the same capacity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, the medium is shared, but you still get the full capacity you have payed for, and a 1-to-1 channel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to the second part, circuit switching requires a circuit to be set up (you have to dial a number), and after sending the data/voice, you have to break down (shut down) the connection. When you need to communicate to a a lot of different people/devices, this takes time, since when one connection (call) is active, you cannot use that line for anything else, even if you are still waiting for the other person to answer/recieve the data.  If compared to traditional networks, it takes a lot less time to send a 100 letters by post, then calling 100 different people.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another problem with circuit switched systems is that the channel is used up even when no data is sent through it (noone else can use that channel at that time). If you have an 8-line telephone uplink, and even if all 8 callers are waiting on hold, your channel is still used up. With packet switched networks you can even oversell your connection (due to statistical multiplex)&amp;nbsp;— if you're an ISP and have a 8Mbit/s uplink, you can sell 10, 20, maybe even more 1Mbit/s connections, since it is statistically improbable, that all of the users will use the connection fully at the same time. And even if they do, their connection still works, with lower speed (compared to blocked/dropped calls on circuit switched networks).&lt;/p&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="3662" LastEditDate="2013-12-29T19:36:11.230" LastActivityDate="2013-12-29T19:36:11.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3584" PostTypeId="1" AcceptedAnswerId="3588" CreationDate="2013-10-13T15:16:42.323" Score="2" ViewCount="3044" Body="&lt;p&gt;I see on Cisco guide that:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Each EtherChannel can consist of up to eight compatibly configured&#xA;  Ethernet interfaces. All interfaces in each EtherChannel &lt;strong&gt;must be the&#xA;  same speed&lt;/strong&gt;, and all must be configured as either Layer 2 or Layer 3&#xA;  interfaces&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But when I try combining 2 fast ethernet link and 1 gigabit link in packet tracer, there is no error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Group: 1&#xA;----------&#xA;                Port-channels in the group:&#xA;                ---------------------------&#xA;&#xA;Port-channel: Po1    (Primary Aggregator)&#xA;------------&#xA;&#xA;Age of the Port-channel   = 00d:00h:06m:15s&#xA;Logical slot/port   = 2/1       Number of ports = 3&#xA;GC                  = 0x00000000      HotStandBy port = null&#xA;Port state          = Port-channel &#xA;Protocol            =   LACP&#xA;Port Security       = Disabled&#xA;&#xA;Ports in the Port-channel:&#xA;&#xA;Index   Load   Port     EC state        No of bits&#xA;------+------+------+------------------+-----------&#xA;  0     00     Gig1/1   Active             0&#xA;  0     00     Fa0/2    Active             0&#xA;  0     00     Fa0/1    Active             0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;can anyone explain this ? thank you.&lt;/p&gt;&#xA;" OwnerUserId="2651" LastEditorUserId="76" LastEditDate="2013-10-13T22:11:30.203" LastActivityDate="2013-10-13T22:11:30.203" Title="Can we combine different kind of interface in Etherchannel?" Tags="|etherchannel|ieee-802.1ax|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3585" PostTypeId="1" AcceptedAnswerId="3601" CreationDate="2013-10-13T16:20:21.913" Score="7" ViewCount="13932" Body="&lt;p&gt;When sending ARP request, what must be filled in the target hardware address (THA)? &lt;a href=&quot;http://blogs.technet.com/b/networking/archive/2009/03/30/tcp-ip-networking-from-the-wire-up.aspx&quot; rel=&quot;nofollow&quot;&gt;This technet blog post&lt;/a&gt; says it is to be filled with zeros (0.0.0.0) -although doesn't look like a MAC address!, and &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_Resolution_Protocol&quot; rel=&quot;nofollow&quot;&gt;the Wikipedia article&lt;/a&gt; suggests FF:FF:FF:FF:FF:FF would be acceptable to &lt;strong&gt;all computers&lt;/strong&gt;, and also stating that &lt;strong&gt;&lt;em&gt;This field is ignored in requests&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the above two articles, I'm given the understanding that there is several implementation for ARP regarding this field. What are the widely used implementation and is there any further standardization for this? And is there any problems so there would be mis-understanding between these implementations? And is there any applications that require specific implementation to that field?&lt;/p&gt;&#xA;" OwnerUserId="808" LastEditorUserId="33" LastEditDate="2015-07-03T03:57:13.680" LastActivityDate="2015-07-03T03:57:13.680" Title="What to use as ARP request Target Hardware Address?" Tags="|protocol-theory|mac-address|arp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3586" PostTypeId="2" ParentId="3585" CreationDate="2013-10-13T17:07:16.407" Score="7" Body="&lt;p&gt;According to RFC 5227:&#xA;The 'target hardware address' field is ignored and SHOULD be set to all zeroes.&lt;/p&gt;&#xA;&lt;p&gt;Setting the THA is not required by the RFC, but all implementations should ignore the field anyway.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5227#page-5&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc5227#page-5&lt;/a&gt; - Top of page 5&lt;/p&gt;&#xA;" OwnerUserId="2933" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-10-13T17:07:16.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3587" PostTypeId="2" ParentId="3585" CreationDate="2013-10-13T17:08:09.997" Score="1" Body="&lt;p&gt;I have looked at many traces and have never see an arp with all 0s. RFC 826 says Ethernet is all 1s. I would assume the blog is not correct or some sort of corner case&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-10-13T17:08:09.997" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3588" PostTypeId="2" ParentId="3584" CreationDate="2013-10-13T17:13:50.323" Score="6" Body="&lt;p&gt;Packet tracer is a simulation for Network academy not a IOS emulator (like say GNS3) if there is a conflict between the doc and packet tracer, packet tracer looses. If you read further in the documentation a LOT of things have to match for an etherchannel bundle can form and link speed is one of them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A corner case MAY be etherchannel autonegotated ports that end up at different speeds, but etherchannel will react to dynamic changes and drop ports out of the etherchannel so I don't think that will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nor do you want it to as with non nexus hardware the load balance is power of 2 (3 ports will result in 1 of them getting 50% of the traffic) and there is no variable load balancing (a gig port gets 2x traffic of say 5 100 meg ports)&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-10-13T17:13:50.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3589" PostTypeId="1" AcceptedAnswerId="3590" CreationDate="2013-10-13T18:32:31.903" Score="2" ViewCount="1415" Body="&lt;p&gt;For reasons like hsrp on a pair of border routers, I need to replace the default gateway on a Cisco ASA. Ideally, I'd like to do it with no noticable downtime (a few lost packets would be OK). I suppose I could add a second &quot;0/0&quot; route to the other ip with a higher metric, and simply remove the lowered metric route. Is this advisable, or are there a better way of doing it?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# currently&#xA;route outside 0.0.0.0 0.0.0.0 100.50.0.13 1&#xA;&#xA;# plan&#xA;route outside 0.0.0.0 0.0.0.0 100.50.0.14 2&#xA;no route outside 0.0.0.0 0.0.0.0 100.50.0.13 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The addresses are on the same subnet. A pair of routers speaking bgp with transit providers.&lt;/p&gt;&#xA;" OwnerUserId="2934" LastActivityDate="2013-10-13T18:55:52.670" Title="Cisco ASA - replace default gateway in production" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3590" PostTypeId="2" ParentId="3589" CreationDate="2013-10-13T18:49:47.860" Score="4" Body="&lt;p&gt;Your plan looks pretty good... the only suggestion for minimal downtime would to add a ping of the new HSRP address...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! currently: route outside 0.0.0.0 0.0.0.0 100.50.0.13 1&#xA;! ping ensures there is no possibility to need an ARP for the new NH&#xA;ping 100.50.0.14&#xA;conf t&#xA;route outside 0.0.0.0 0.0.0.0 100.50.0.14 2&#xA;no route outside 0.0.0.0 0.0.0.0 100.50.0.13 1&#xA;!!! Optional&#xA;!      This leaves the new default at a distance of 1...&#xA;route outside 0.0.0.0 0.0.0.0 100.50.0.14 1&#xA;no route outside 0.0.0.0 0.0.0.0 100.50.0.14 2&#xA;end&#xA;wr mem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously if the HSRP gateway was just turned up, you'll get a gratuitous ARP from HSRP and the ping is not required... if not, the ping will ensure you don't have to buffer traffic while the ARP is answered (which wouldn't be very long anyway.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-10-13T18:55:52.670" LastActivityDate="2013-10-13T18:55:52.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3592" PostTypeId="2" ParentId="3539" CreationDate="2013-10-14T07:03:24.970" Score="4" Body="&lt;p&gt;As discussed in chat, PBX / SIP traffic is unique to an IP host route in your case.  Therefore, you can remove PBR and use tracking objects on overlapping static routes, which go out different &lt;code&gt;dialer&lt;/code&gt; interfaces to solve the problem.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 89.123.45.10 255.255.255.255 Dial0 track 1 1 name PBX_Pri&#xA;ip route 89.123.45.10 255.255.255.255 Dial1 track 2 10 name PBX_Bak&#xA;ip route 0.0.0.0 0.0.0.0 Dial 1 track 2 1 name Data_Pri&#xA;ip route 0.0.0.0 0.0.0.0 Dial 0 track 1 10 name Data_Bak&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-10-16T09:29:01.507" LastActivityDate="2013-10-16T09:29:01.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3593" PostTypeId="2" ParentId="3562" CreationDate="2013-10-14T07:39:38.980" Score="1" Body="&lt;p&gt;My favorite Tool for this is &lt;a href=&quot;http://www.spoerr.org/wktools/&quot; rel=&quot;nofollow&quot;&gt;WKTOOL&lt;/a&gt; but it's only supported under Windows. &lt;/p&gt;&#xA;" OwnerUserId="2690" LastEditorUserId="775" LastEditDate="2013-10-14T08:13:25.780" LastActivityDate="2013-10-14T08:13:25.780" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3594" PostTypeId="2" ParentId="3562" CreationDate="2013-10-14T09:29:16.513" Score="0" Body="&lt;p&gt;You can set up the basic Zenoss monitoring server, it's supports Cisco Devices information gathering via SNMP. This provides a lot of information just by adding an IP (like: IOS version, interfaces + IP configuration, ...)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://community.zenoss.org/index.jspa&quot; rel=&quot;nofollow&quot;&gt;http://community.zenoss.org/index.jspa&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Zenoss + Cisco howto:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=hj9vqYeXtyg&quot; rel=&quot;nofollow&quot;&gt;http://www.youtube.com/watch?v=hj9vqYeXtyg&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-10-14T09:29:16.513" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3596" PostTypeId="2" ParentId="3365" CreationDate="2013-10-14T13:38:39.833" Score="3" Body="&lt;p&gt;It seems that your omnipeek client card cannot capture higher data rate traffic. &#xA;The ACK frames are sent with basic data rates and the DATA frames are sent with higher data rates. The issue can come up if your client and AP are transmitting on 3 stream and 40 MHz and omnipeek can listen on 1 stream and 20 MHz.&#xA;This can also happen if the omnipeek client card is at a distance as it may not see the date frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please make sure the the Omnipeek client card supports 3 (or at-least 2 streams) and it also supports 40MHz channel bandwidth&lt;/p&gt;&#xA;" OwnerUserId="2942" LastActivityDate="2013-10-14T13:38:39.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3598" PostTypeId="2" ParentId="3562" CreationDate="2013-10-14T18:10:50.503" Score="0" Body="&lt;p&gt;If you want something that will show you your gear in a rack type of diagram, I would recommend either of the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;www.drackula.net&lt;/p&gt;&#xA;&#xA;&lt;p&gt;www.noclayer.com&lt;/p&gt;&#xA;" OwnerUserId="864" LastActivityDate="2013-10-14T18:10:50.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3601" PostTypeId="2" ParentId="3585" CreationDate="2013-10-14T22:27:39.437" Score="8" Body="&lt;p&gt;You are mixing up two different pieces of information.  The Wikipedia article you link mentions FF:FF:FF:FF:FF:FF as the destination address, not as the target address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The destination address is part of the L2 Ethernet header, whereas the THA is part of the ARP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To illustrate, I pulled a random ARP packet out of a random capture I had stored on my computer in Wireshark.  Note in this image that the destination is ff:ff:ff:ff:ff:ff (L2 broadcast) in the Ethernet header section but below in the ARP request section the &quot;Target MAC Address&quot; is all zeroes as it should be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/YSuzO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;EDIT&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also worth mentioning that the &lt;a href=&quot;http://blogs.technet.com/blogfiles/networking/WindowsLiveWriter/TCPIPNetworkingfromtheWireUp_9956/ARP1%20(2)_1366a185-a308-4344-aedd-52cf74ada3be.jpg&quot; rel=&quot;noreferrer&quot;&gt;Technet Author's diagram&lt;/a&gt; confirms that using 0.0.0.0 for the THA was a typo in his blog.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="775" LastEditDate="2013-10-15T01:16:56.773" LastActivityDate="2013-10-15T01:16:56.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3602" PostTypeId="1" AcceptedAnswerId="3617" CreationDate="2013-10-14T23:26:34.657" Score="4" ViewCount="910" Body="&lt;p&gt;I would like to know if Fortigate-60D is a fanless model or not. However, neither &lt;a href=&quot;http://www.fortinet.com/sites/default/files/productdatasheets/FortiGate-60D.pdf&quot; rel=&quot;nofollow&quot;&gt;Fortigate-60D datasheet&lt;/a&gt; nor &lt;a href=&quot;http://www.fortinet.com/sites/default/files/basicfiles/ProductMatrix.pdf&quot; rel=&quot;nofollow&quot;&gt;Fortinet Product Matrix&lt;/a&gt; provide any information about this topic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you please confirm, either by your own experience or referencing any other document?&lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2015-05-29T11:29:56.110" Title="Is Fortigate-60D a fanless model?" Tags="|fortigate|fortinet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3603" PostTypeId="1" AcceptedAnswerId="3604" CreationDate="2013-10-15T09:27:07.590" Score="8" ViewCount="12243" Body="&lt;p&gt;This one might be the dumber question ever asked in this place, but here it is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have 20 machines, all equipped with gigabit ethernet NICs, all connected to a gigabit switch, is the maximum volume of data going through the switch per second equal to 1Gbps, or is it more like 1Gbps * 20?&lt;/p&gt;&#xA;" OwnerUserId="2947" LastEditorUserId="775" LastEditDate="2013-10-15T10:10:18.510" LastActivityDate="2013-12-29T19:33:24.497" Title="Aggregate bandwidth of a gigabit switch" Tags="|switch|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3604" PostTypeId="2" ParentId="3603" CreationDate="2013-10-15T09:35:43.337" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If I have 20 machines, all equipped with gigabit ethernet NICs, all connected to a gigabit switch, is the maximum volume of data going through the switch per second equal to 1Gbps, or is it more like 1Gbps * 20?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is closer to 1Gbps * 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Throughput is usually written in the documentation and is expressed in packets per second, which can be translated to mega/gigabits per second depending on packet sizes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It really depends on the switch, its intended use, price, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, cheap SOHO 8 port L2 gigabit switches usually get throughputs from 1–5Gbps (on all ports together&amp;nbsp;— out of 16Gbit full-duplex theoretical max). Enterprise/datacenter/ISP switches can do a lot more. &lt;/p&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="3662" LastEditDate="2013-12-29T19:33:24.497" LastActivityDate="2013-12-29T19:33:24.497" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3605" PostTypeId="1" AcceptedAnswerId="3612" CreationDate="2013-10-14T02:56:49.443" Score="5" ViewCount="523" Body="&lt;p&gt;For example, can 128.92.128.0/17 and 128.92.128.0/18 be contained in one forwarding table together? Or the first one must be changed to 128.92.192.0/18? Because the other half will go to the second prefix?&lt;/p&gt;&#xA;" OwnerUserId="2953" OwnerDisplayName="Haowen Cao" LastEditorUserId="775" LastEditDate="2013-10-16T08:52:38.843" LastActivityDate="2017-01-08T18:27:42.270" Title="coexistance for the longest prefix match" Tags="|routing|ipv4|ip-forwarding-table|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3607" PostTypeId="2" ParentId="3605" CreationDate="2013-10-14T14:10:23.397" Score="6" Body="&lt;p&gt;IP forwarding tables are commonly stored in an &lt;a href=&quot;http://www.freepatentsonline.com/7149216.html&quot; rel=&quot;noreferrer&quot;&gt;m-trie&lt;/a&gt;, which is a 256-way &lt;a href=&quot;http://en.wikipedia.org/wiki/Trie&quot; rel=&quot;noreferrer&quot;&gt;trie&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the forwarding table was implemented as a 256-way m-trie, then 128.92.128.0/17 would contain the mtrie entries for 128.92.128.0/18... although these two routes could easily go to different IPv4 next-hops, since IP routing works on the principle of longest-prefix-match wins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a simplified view of an mtrie for 128.92.128.0/17...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/E1pIm.png&quot; alt=&quot;128.92.128.0/17 mtrie&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a simplified view of an mtrie for 128.92.128.0/18 (which is contained inside 128.92.128.0/17)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XqAdn.png&quot; alt=&quot;128.92.128.0/18 mtrie&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" OwnerDisplayName="Mike Pennington" LastEditorUserId="59" LastEditDate="2013-10-15T12:54:49.303" LastActivityDate="2013-10-15T12:54:49.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3608" PostTypeId="1" AcceptedAnswerId="3609" CreationDate="2013-10-15T14:23:09.450" Score="5" ViewCount="2519" Body="&lt;p&gt;Is there a way in JunOS (I'm testing on 11.4R1.14) to see the prefixes filtered out by a policy statement?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following in the lab dropping unwanted prefixes from BGP neighbors;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-statement PS-Filter-Prefix-Size {&#xA;    from {&#xA;        route-filter 0.0.0.0/0 prefix-length-range /27-/32;&#xA;        route-filter 0.0.0.0/0 prefix-length-range /0-/5;&#xA;    }&#xA;&#xA;protocols {&#xA;    bgp {                               &#xA;        group my-peers {&#xA;            type external;&#xA;            import [ PS-Filter-Prefix-Size ];&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This seems to be working, as &lt;code&gt;show route hidden&lt;/code&gt; reveals some test /32 routes which are not present in the output of &lt;code&gt;show route&lt;/code&gt; or &lt;code&gt;show route forwarding-table&lt;/code&gt;. Other /24 routes are coming in though for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I displays routes that have been caught by a filter?&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-10-15T15:25:24.967" Title="JunOS: View route-filter import policy matches" Tags="|juniper-junos|route-filter|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3609" PostTypeId="2" ParentId="3608" CreationDate="2013-10-15T15:15:47.523" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;test policy PS-Filter-Prefix-Size 0.0.0.0/0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This should display routes passing the policy&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There isn't direct way to ask the opposite, but you could create policy which calls 'PS-Filter-Prefix-Size' and then rejects and accepts rest.&lt;br&gt;&#xA;Testing this policy would yield opposite results, showing routes not passing 'PS-Filter-Prefix-Size'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I understand your 'PS-Filter-Prefix-Size' does nothing, as there is no action, so existing 'default-action' is honored.&lt;br&gt;&#xA;You should have 'then accept' or 'then reject', and preferably after that explicit catch-all rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your situation I'd do something like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;term bogus_size {&#xA;    from {&#xA;        family inet;&#xA;        route-filter 0.0.0.0/0 prefix-length-range /25-/32;&#xA;        route-filter 0.0.0.0/0 prefix-length-range /1-/7;&#xA;    }&#xA;    then reject;&#xA;}&#xA;term accept {&#xA;    then accept;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-10-15T15:25:24.967" LastActivityDate="2013-10-15T15:25:24.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3610" PostTypeId="2" ParentId="3603" CreationDate="2013-10-15T17:06:32.580" Score="0" Body="&lt;p&gt;To really be specific here, a full line rate switch [please refer to specific switch documentation to determine what your specific fabric can handle] with 20 one gigabit connected machines on it will have a max throughput of...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20 machines * (1 gigabit * 2) = 40gbps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is due to traffic being full duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A single one gigabit device can account for two gigabit on the switch. One gigabit going into the switchport from the host and one gigabit leaving the switchport towards the host.&lt;/p&gt;&#xA;" OwnerUserId="2920" LastActivityDate="2013-10-15T17:06:32.580" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3611" PostTypeId="2" ParentId="3570" CreationDate="2013-10-15T19:52:18.340" Score="4" Body="&lt;p&gt;I found the answer here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://forums-archive.ruckuswireless.com/forums/8/topics/1278&quot; rel=&quot;nofollow&quot;&gt;http://forums-archive.ruckuswireless.com/forums/8/topics/1278&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NPS does not return AD group memberships back to the ZoneDirector without setting a vendor-specific attribute on NPS. A role has to be configured for each group on the ZoneDirector and a network policy has to be configured for each group on NPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This seems rather redundant as I've already got authorization and vlan assignment happening on NPS, why would the ZoneDirector also require a role to authorize access to the specified WLAN? Oh well at least it works now.&lt;/p&gt;&#xA;" OwnerUserId="309" LastActivityDate="2013-10-15T19:52:18.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3612" PostTypeId="2" ParentId="3605" CreationDate="2013-10-15T20:31:32.993" Score="4" Body="&lt;p&gt;Both routes would be installed into the active routing table and the more specific route would win if it was relevant to the packet being routed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;128.92.128.0/18 will be installed but so will 128.92.128.0/17 as the /18 doesn't cover all of the /17.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had static routes configured like this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.92.128.0/18 VIA x.x.x.x&#xA;128.92.128.0/17 VIA z.z.z.z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You would have the following results in the active table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.92.128.0 - 128.92.191.255 will be routed via x.x.x.x&#xA;128.92.192.0 - 128.92.255.255 will be routed via z.z.z.z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only way the /17 route wouldn't show up in your routing table is if you had something like this going on for static routes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.92.128.0/18 VIA x.x.x.x&#xA;128.92.192.0/18 VIA y.y.y.y&#xA;128.92.128.0/17 VIA z.z.z.z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your active table would look like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.92.128.0 - 128.92.191.255 will be routed via x.x.x.x&#xA;128.92.192.0 - 128.92.255.255 will be routed via y.y.y.y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since you have all of the /17 covered by more specific /18 routes the /17 drops out of the active routing table.&lt;/p&gt;&#xA;" OwnerUserId="2920" LastEditorUserId="2920" LastEditDate="2017-01-08T18:27:42.270" LastActivityDate="2017-01-08T18:27:42.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3613" PostTypeId="2" ParentId="1411" CreationDate="2013-10-16T03:44:09.423" Score="5" Body="&lt;p&gt;An alternate syntax involving single quotes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show run | inc 'interface Vlan|ip address'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In NX-OS, argument parsing works a lot like bash.&lt;/p&gt;&#xA;" OwnerUserId="1607" LastActivityDate="2013-10-16T03:44:09.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3614" PostTypeId="1" AcceptedAnswerId="3751" CreationDate="2013-10-16T04:28:48.020" Score="4" ViewCount="1123" Body="&lt;p&gt;I'm running NX-OS version 5.2(1)N1(5) on a pair of Nexus 5020s that are mirrors of each other for all intents and purposes. After OS upgrades some of the configuration that was inside the &lt;code&gt;switch-profile&lt;/code&gt; managed to end up outside of it. Apart form being not-synchronized, this causes a number of other problems like not being able to modify bits of the configuration (&lt;code&gt;switchport trunk allowed vlan ...&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example configuration for both switches in the VPC pair.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Relevant pieces from: show running-config include-switch-profile&#xA;&#xA;interface port-channel301&#xA;  speed 10000&#xA;&#xA;interface Ethernet1/17&#xA;  channel-group 301 mode active&#xA;&#xA;&#xA;switch-profile PROFILE&#xA;  sync-peers destination 192.168.0.2 ! This is .2 on switch-2&#xA;&#xA;  interface port-channel301&#xA;    description SERVER-1&#xA;    switchport mode trunk&#xA;    switchport trunk allowed vlan 10, 20, 30-50&#xA;    spanning-tree port type edge trunk&#xA;    vpc 301&#xA;&#xA;  interface Ethernet1/17&#xA;    description PO301 - SERVER-1&#xA;    switchport mode trunk&#xA;    switchport trunk allowed vlan 10, 20, 30-50&#xA;    spanning-tree port type edge trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While trying to bring that configuration back into the switch-profile, simply running &lt;code&gt;import interface port-channel301&lt;/code&gt; will cause a mutual exclusion failure on &lt;code&gt;commit&lt;/code&gt; since the configuration exists on both sides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best solution I can extract from the &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/troubleshooting/guide/n5K_ts_confg-sync.html&quot; rel=&quot;nofollow&quot;&gt;NX-OS troubleshooting guide&lt;/a&gt; is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Remove the &lt;code&gt;sync-peers destination&lt;/code&gt; stanza from both switch-1, and switch-2.&lt;/li&gt;&#xA;&lt;li&gt;Import the desired configuration on both switches and commit.&lt;/li&gt;&#xA;&lt;li&gt;Add the &lt;code&gt;sync-peers destination&lt;/code&gt; back.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It seems like this is prone to human error. I'm specifically concerned about adding the &lt;code&gt;sync-peers destination&lt;/code&gt; stanza back. There's not very much information on what happens if the profiles aren't the exact same and what to do in that case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this really the best way? Are there any best-practices people have when doing this kind of import? What happens if the switch-profiles do end up different? There's some institutional knowledge about this, but not much in the official NX-OS documentation.&lt;/p&gt;&#xA;" OwnerUserId="1607" LastEditorUserId="775" LastEditDate="2013-10-16T08:56:43.993" LastActivityDate="2013-10-26T17:42:15.420" Title="NX-OS: Importing already mirrored config into a switch-profile" Tags="|cisco|management|cisco-nexus-5k|vpc|cisco-nx-os|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3615" PostTypeId="5" CreationDate="2013-10-16T09:31:25.720" Score="0" Body="" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-10-16T09:31:25.720" LastActivityDate="2013-10-16T09:31:25.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3616" PostTypeId="4" CreationDate="2013-10-16T09:31:25.720" Score="0" Body="For questions involving the IPv4 or IPv6 Forwarding Information Base (FIB)." OwnerUserId="775" LastEditorUserId="8499" LastEditDate="2016-11-29T18:20:49.783" LastActivityDate="2016-11-29T18:20:49.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3617" PostTypeId="2" ParentId="3602" CreationDate="2013-10-16T15:23:35.743" Score="5" Body="&lt;p&gt;The product datasheet for the Fortigate-60 specs out the &lt;strong&gt;Heat Dissipation&lt;/strong&gt; at &lt;strong&gt;40BTU/h&lt;/strong&gt; and &lt;strong&gt;Operating Temperature&lt;/strong&gt; at a max of &lt;strong&gt;104F&lt;/strong&gt;. This is typical for a fanless design. See &lt;a href=&quot;http://h17007.www1.hp.com/us/en/networking/products/switches/HP_1405_Small_Office_Switch_Series/index.aspx#J9792A&quot; rel=&quot;noreferrer&quot;&gt;these small HP office switches&lt;/a&gt; with similar power rating showing &lt;strong&gt;Fanless&lt;/strong&gt; designation. &lt;/p&gt;&#xA;" OwnerUserId="2956" LastEditorUserId="775" LastEditDate="2013-10-16T15:46:52.550" LastActivityDate="2013-10-16T15:46:52.550" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3618" PostTypeId="2" ParentId="3315" CreationDate="2013-10-16T15:43:05.230" Score="0" Body="&lt;p&gt;You might also consider creating an &lt;code&gt;alias&lt;/code&gt; with this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alias exec .save copy run tftp://192.168.1.1/file.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and issue &lt;code&gt;.save&lt;/code&gt; instead of typing the entire line every time.&lt;/p&gt;&#xA;" OwnerUserId="2956" LastEditorUserId="775" LastEditDate="2013-10-16T15:45:25.060" LastActivityDate="2013-10-16T15:45:25.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3621" PostTypeId="1" AcceptedAnswerId="3623" CreationDate="2013-10-17T03:08:17.803" Score="3" ViewCount="452" Body="&lt;p&gt;I'm trying to figure out how to setup multiple IPsec VPN tunnels, and before I spend any money on hardware, I want to make sure I'm understanding this correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My plan is to setup a Vyatta Core server with a static IP address to be one endpoint of the IPsec VPN.  Then, I will have 2 Cisco RV042's in different locations that will connect with the Vyatta server.  Theoretically, I think this should be fine.  The problem is the Cisco RV042's will have Dynamic IP addresses.  One of them will be behind multiple layers of NAT and behind a firewall, which I will have no access to change settings on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this going to work?  If not, are there any alternatives?&lt;/p&gt;&#xA;" OwnerUserId="2963" LastActivityDate="2013-10-17T09:29:35.920" Title="IPsec VPN Tunnel Through an Uncontrolled Network" Tags="|vpn|ipsec|tunnel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3622" PostTypeId="2" ParentId="123" CreationDate="2013-10-17T07:11:29.800" Score="0" Body="&lt;p&gt;Have you give any thought to overlay wireless intrusion prevention systems (WIPS)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rogue APs come in many forms shapes and sizes (ranging from usb/soft AP to actual physical Rogue APs). You need a system can monitors both the air and wired side and correlated the information from both sides of the network to deduce if a threat is actually present. It should be able to comb thru 100s of Ap and find the one that is plugged into your network &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rogue Ap is just 1 kind of wifi threat, how about your wifi clients connecting to external APs visible from your office.&#xA;Wired IDS/IPS system can not fully protect against these kind of threats.&lt;/p&gt;&#xA;" OwnerUserId="2942" LastActivityDate="2013-10-17T07:11:29.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3623" PostTypeId="2" ParentId="3621" CreationDate="2013-10-17T08:31:47.213" Score="2" Body="&lt;p&gt;IPSEC with nat-traversal turned on (upd header added) works with most setups simmilar yours. Depending on the firewall settings, this might also be blocked/disallowed, so there is no way to know without knowing the firewall setting.&lt;/p&gt;&#xA;" OwnerUserId="1220" LastActivityDate="2013-10-17T08:31:47.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3625" PostTypeId="2" ParentId="3621" CreationDate="2013-10-17T09:29:35.920" Score="3" Body="&lt;p&gt;If you don't have access to the NAT_Firewall this will not work. Presumably that firewall will SNAT, still you need a DNAT for ISAKMP connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A solution that probably will work would be to have two Cisco devices and use Cisco Easy VPN, one device acting as a simple client behind the NAT_Firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cheapest devices would be some 88x, 89x Cisco routers with Security License enabled.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-10-17T09:29:35.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3627" PostTypeId="1" CreationDate="2013-10-17T10:14:57.207" Score="6" ViewCount="3611" Body="&lt;p&gt;There are two &quot;central&quot; locations each one having one satellite or spoke site. Let's have:&#xA;- zone A and its spoke_zone A1&#xA;- zone E and its spoke_zone E1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both region A and region E have a similar deployment scenarios:&#xA;- 1 x 5508 WLC&#xA;- several LWAPs in the existing network (local network).&#xA;- FlexConnect for other several LWAPs for the spoke zones A for the A1 and E for the E1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking how can I achieve a backup solution for all these 4 sites:&#xA;- A1 and E1 can achieve it through FlexConnect and one mode only: local switching &amp;amp; local authentication.&#xA;- what about A and E regions? How can I bring some backup WLC solution here? I know of Mobility Groups, still I don't think it helps too much as I have only L3 connectivity between A and E region through MPLS.&#xA;What if I try and get L2 connectivity in between using some solutions like &quot;poor-man's EoMPLS&quot; like L2TP v3, I will be able to connect one VLAN pair, will this be enough ?&#xA;- what else can I do in case of WLC breakdown in either of the two regions (A or E)?&lt;/p&gt;&#xA;" OwnerUserId="794" LastEditorUserId="44" LastEditDate="2013-10-18T19:42:21.547" LastActivityDate="2013-10-19T19:17:10.787" Title="WLC geographical redundancy" Tags="|cisco|wireless|wlc|redundancy|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3628" PostTypeId="1" AcceptedAnswerId="5863" CreationDate="2013-10-17T14:42:23.387" Score="12" ViewCount="8865" Body="&lt;p&gt;&lt;strong&gt;What are the correct usage guidelines for SI and IEC binary prefixes when using decimal (power of 10) units of measurement relating to computer networking and binary (power of 2) units of measurement&lt;/strong&gt; (data transfer in particular, but also file size) &lt;strong&gt;?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Binary_prefix&quot; rel=&quot;noreferrer&quot;&gt;This&lt;/a&gt; Wiki page gives a detailed description of the problem and different solutions. I find that Wiki paged linked above a bit confusing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I always use the SI (decimal) units for data throughput and IEC values (binary prefixes of 2^) for file sizes. From time to time however, I do see people calculating speed using a multiple of &lt;code&gt;1024&lt;/code&gt; in their sums.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have always used multiples of 1000 for speed measurement, such as 1Kbps = 1000Bps;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;100 bps == 100bps (bit per second)&lt;/li&gt;&#xA;&lt;li&gt;100 000 bps == 100Kbps (kilo bits per second)&lt;/li&gt;&#xA;&lt;li&gt;100 000 000 bps == 100Mbps (mega bits per second)&lt;/li&gt;&#xA;&lt;li&gt;and so on...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;With measurements of file size or memory I have always used multiples of 1024 (binary prefixes) such as 1KB file is 1024 bytes in size;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;100Bs == 100B (byte) file&lt;/li&gt;&#xA;&lt;li&gt;100 000Bs == 100KB (kilobyte) file&lt;/li&gt;&#xA;&lt;li&gt;100 000 000Bs == 100MB (megabyte) file&lt;/li&gt;&#xA;&lt;li&gt;and so on...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There is some room for discrepancy to arise here between networks and customers. A standard billing issue example is that a customer of an ISP has a 50GB per month bandwidth allowance. Different operating systems use difference units of measurement for both speed and memory and display this using the different IEC and SI prefixes. &lt;a href=&quot;http://en.wikipedia.org/wiki/Binary_prefix#Operating_systems&quot; rel=&quot;noreferrer&quot;&gt;This section&lt;/a&gt; of the same Wiki page on Operating Systems and Software lists the discrepancies between operating systems and software packages that mix and match different prefixes with units of measurement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible for an ISP to measure 50GBs of data transfered as &lt;code&gt;(1024^3) bytes * 50 == 50GBs&lt;/code&gt; (1GB == 1073741824 bytes). and the user may disagree when the 50GB limit is reached. A users who's machine displays Gibibytes for example would show 46.57 Gibibytes transfered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the network's perspective&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;50GBs in bits: &lt;code&gt;((((50GBs*1000)*1000)*1000)*8)=400000000000 bits&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Bps to copy 50GBs in one hour: &lt;code&gt;(((400000000000/60)/60)/24)/24=192901.23&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;This speed in Mbps: &lt;code&gt;((192901.23/1000)/1000)*24*24 = 111.11Mbps&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A Gibibyte is this many bits: &lt;code&gt;((((50GiB*1024)*1024)*1024)*8)=429496729600&lt;/code&gt; which is more. So a link that runs at 111.11Mbps for 1 hour hasn't transfered a Gibibyte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Purely from a networking and technical view point here (not legal regarding fair usage policies or T&amp;amp;Cs etc), what is a best practice, always used mega/giga/tera or mibi/gibi, IEC or SI notation for measurements and monitoring etc? How do you keep everything uniform?&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2023-03-23T18:27:35.430" Title="IEC or SI units (binary prefixes) used for network measurement?" Tags="|standardisation|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3630" PostTypeId="2" ParentId="3627" CreationDate="2013-10-18T00:01:05.897" Score="9" Body="&lt;p&gt;There are two main options for controller redundancy in Cisco's current wireless offerings.  You can either use &lt;strong&gt;Backup Controllers&lt;/strong&gt; or &lt;strong&gt;High Availability&lt;/strong&gt;; depending on the firmware level of your 5508's, your acceptable failover time, and your budget.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your question, we're working with the following topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/01bif.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traditionally, utilizing &lt;strong&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/controller/7.4/configuration/guides/consolidated/b_cg74_CONSOLIDATED_chapter_01110011.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Backup Controllers&lt;/a&gt;&lt;/strong&gt; was the main way to provide redundancy for a WLC failure.  For Zone A, you could just select the Wireless LAN Controller at Zone E, and assign that as the Secondary Controller for each AP as desired.  You can set the Primary and Secondary controllers for the AP on the controller via the GUI, the CLI, or even SNMP as pointed out by Mike Pennington's answer to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2579/staging-many-lightweight-cisco-aps-for-deployment&quot;&gt;this question&lt;/a&gt;.  With Backup Controllers, in the case of a WLC failure AP's would begin to search for their Secondary Controller and re-establish their CAPWAP tunnel.  The obvious downside to this, is the outage that occurs from the client prospective while the AP drops it's tunnel and begins to build it again to the Secondary Controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In response to the need for a somewhat better failover scenario, Cisco brought out &lt;strong&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/wireless/ps6302/ps8322/ps10315/qa_c67-714540.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;High Availability&lt;/a&gt;&lt;/strong&gt; in WLC firmware 7.3.  In this scenario, you purchase a second WLC and license it specifically to serve as a standby.  You place it adjacent to your existing WLC, and it shares an IP address and session/Config/AP information with the main controller.   Now in the event of a WLC failure, the failover from the AP perspective is intended to be transparent.  (As with all new features, and wireless in general in my experience, your milage will vary.  However, in some of the newer code revisions, the failover is supposed to be getting nearly transparent to the AP and the client.)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now with all of that said, which is better?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Backup Controllers is the cheaper way if your existing 5508's at Zone A and Zone E have enough available capacity to carry the load of either site, and your business can tolerate a few minutes of downtime in the event of a WLC failure.  In that case, simply configure your secondary controllers on each Access Point, and off you go.  Note that there is some more management overhead with using Backup Controllers, you will have to configure VLANs/Interfaces for all of your SSID's in each zone, make your AP Groups on each controller if you use them, etc.    Now, when the WLC goes down at their site, users will experience some downtime as the AP's migrate, but at least they're not down hard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;High Availability becomes a reasonable solution here if you don't have capacity on your existing 5508's and/or your business can't tolerate the failover time in the Backup Controllers method.  In other words, if you don't have capacity on your existing controller to use them as a backup for each other, and you're going to have to spend some money anyways, I would recommend looking into the High Availability solution and pricing.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Also, I wanted to clarify some of what you mentioned at the end of your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mobility Groups can be used over a L3 connection, but Cisco's Mobility feature is for allowing seamless client roaming across AP's connected to different controllers, not to give you redundancy in the event of a WLC failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flexconnect (formerly HREAP) is not entirely intended to help you with WLC failure, but with loss of network connectivity to a remote site.  The end result is the same, the remote AP can't connect to it's controller, however it is important to think of the failure scenario it is created for.  If you're only trying to solve the WLC failure scenario, you don't need Flexconnect at your remote sites, you can just use either Backup Controllers or High Availability.  However if you ARE trying to solve the network isolation failure scenario, by all means, check out Flexconnect.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; In response to your two questions in the comments below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) You are correct, assuming there is complete L3 reach-ability between Zone A's subnets and Zone E's subnets.   If, for example, you have configured Backup Controllers for the AP's in Zone A.  Then, if an AP loses it's connection to the WLC in Zone A, it will look for the WLC in Zone E directly across the L3 connection.  Upon reaching it, it will begin the CAPWAP join process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) You are correct that the process involves:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Creating a trunk port to the WLC and connected switch&lt;/li&gt;&#xA;&lt;li&gt;Adding/Creating new VLAN(s) on the connected switch&lt;/li&gt;&#xA;&lt;li&gt;Adding the new VLAN(s) to the trunk port&lt;/li&gt;&#xA;&lt;li&gt;Adding an interface(s) for the new VLAN(s) to the WLC&lt;/li&gt;&#xA;&lt;li&gt;Associating those VLAN interfaces on the WLC to an SSID (either on the main WLAN or under an AP Group)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, if you've done that at Zone A and everything is working fine there, you can either do that process all again over on the WLC and switch in Zone E, or use your existing VLANs/Interfaces on Zone E.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, the VLAN's/IP Addressing will be different between the two zones, but as long as the SSID's/AP Groups correspond between the two controllers, it doesn't matter to the WLC/AP/Client what VLAN the traffic uses. (It might matter to you, for managment/traffic separation/routing purposes, but the WLC doesn't care what VLAN it puts traffic out onto from a particular SSID.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 2:&lt;/strong&gt;  Attempting to clarify the VLAN assignment per WLC in each Zone per comments below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per your example in the comments, imagine that the WLC in ZoneA is serving two VLANs/SSIDs to your wireless clients:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 10 - Office - 10.0.0.0/24&lt;/li&gt;&#xA;&lt;li&gt;VLAN 20 - Guest - 10.0.1.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And the WLC in Zone E is also serving two VLANs/SSIDs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 11 - Office - 10.1.0.0/24&lt;/li&gt;&#xA;&lt;li&gt;VLAN 22 - Guest - 10.1.1.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, also assume that you have configured the AP's in Zone A to use the WLC in Zone E as their secondary WLC, and vice versa for the AP's in Zone E.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under normal circumstances, clients connecting to the Office SSID at Zone A will get addresses in the 10.0.0.0/24 subnet.  However, if the WLC in Zone A fails, and the AP's re-register to the WLC in Zone E, clients will begin to get IP addresses from the 10.1.0.0/24 subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, depending on your network configuration, this could be perfectly acceptable.  It could possibly not impact your users at Zone A at all for them to now have an address from Zone E.  As long as the normal resources they connect to in Zone A, or wherever on your network, are available to the 10.1.0.0/24 subnet over in Zone E.  However, if you have anything configured on your network, (ACLs, Web Proxies, etc,) that require the clients at Zone A to have an address in the 10.0.0.0/24 subnet, then we have a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point, you would have several options.  You could look at allowing the 10.1.0.0/24 Zone E subnet to access those resources (but if there are restrictions in place, they are likely there for some infrastructure or security reason).   Or you could extend some sort of L2 tunneling across your MPLS connection so that VLANs 10 and 20 from Zone A can also live in Zone E.  This creates it's own problems and wherever possible I try to refrain from tunneling L2 connectivity all over creation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My recommendation however, should you find yourself in the scenario where users from Zone A &lt;strong&gt;MUST&lt;/strong&gt; have addresses the 10.0.0.0/24 subnet, would be to look into simply placing a second WLC in Zone A.  It is, by far, the simplest solution to that particular problem.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-10-19T19:17:10.787" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3631" PostTypeId="1" CreationDate="2013-09-20T13:46:37.400" Score="4" ViewCount="9144" Body="&lt;p&gt;Here is the question -&gt;&lt;br/&gt;&#xA;  I have added a floating static route with administrative distance 200 to a router, as default, &lt;code&gt;show ip route static&lt;/code&gt; only displays one static route with the lowest administrative distance.&lt;br/&gt;&#xA;  Is there a command will show both static routes at once ?&lt;br/&gt;&#xA;  I recall, &lt;code&gt;show eigrp topology&lt;/code&gt; will display all the alternatives routes with different cost at one table.&lt;br/&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="SaxonC" LastActivityDate="2013-10-18T16:41:21.757" Title="Cisco show all static route" Tags="|router|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3632" PostTypeId="1" AcceptedAnswerId="3685" CreationDate="2013-10-18T02:57:02.463" Score="3" ViewCount="4090" Body="&lt;p&gt;I would like to test the Wi-Fi Multimedia (WMM) feature of an access point AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I test it using Candela Technologies LANforge-WiFIRE WiFi traffic generator?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some thoughts after reading the WMM whitepaper:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Assuming the capacity of the wireless link is 60 Mbps, set up a virtual station STA-1 with a video UDP uplink stream of 30 Mbps.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set up another virtual station STA-2 with a background TCP uplink stream of 30 Mbps.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set up another STA-3 with a background TCP uplink stream of 30 Mbps, starting after 10 seconds.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When WMM is enabled, there should be a drastic drop in throughput for the first background stream while there should be no change for the video stream. When WMM is disabled, the video stream should suffer a loss in rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should be the best procedure?&lt;/p&gt;&#xA;" OwnerUserId="2974" LastEditorUserId="2974" LastEditDate="2013-10-23T08:10:59.560" LastActivityDate="2017-03-07T07:12:11.203" Title="How to test Wi-Fi Multimedia (WMM) QoS management with LANforge?" Tags="|wireless|qos|testing|throughput|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3634" PostTypeId="1" CreationDate="2013-10-18T08:44:30.020" Score="0" ViewCount="122" Body="&lt;p&gt;I have a Cyberoam UTM and a Static ip address provided to me by my ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what I can do if my firewall or my UTM gets damaged or stops working. What hardware or resources I need in case my utm stops working?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The connection is like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP internet cable - - &gt; UTM - - &gt; Local Network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway I can connect my local network to the internet in case if my utm stops working. Thanks. &lt;/p&gt;&#xA;" OwnerUserId="2705" LastActivityDate="2016-05-27T17:45:45.767" Title="How to enable internet connection if router stops working" Tags="|router|" AnswerCount="2" CommentCount="2" ClosedDate="2019-03-11T22:51:56.503" ContentLicense="CC BY-SA 3.0" />
  <row Id="3635" PostTypeId="1" AcceptedAnswerId="3644" CreationDate="2013-10-18T09:40:33.770" Score="4" ViewCount="627" Body="&lt;p&gt;We have a single E1 line from ISP at one site, and a backup E1 line at other site. RAD DXC-10A have 4xE1 ports and used as E1 cross-connect. At each site we have single Cisco router with no backup. Is it possible to get automatic failover with 1xE1 and 2 routers at each site?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4vdvh.png&quot; alt=&quot;E1 failover&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="197" LastActivityDate="2013-10-18T20:16:28.533" Title="Is it possible to design an E1 redundancy with failover router and single E1 WAN link?" Tags="|cisco|redundancy|failover|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3636" PostTypeId="1" AcceptedAnswerId="3637" CreationDate="2013-10-18T09:51:05.227" Score="7" ViewCount="715" Body="&lt;p&gt;Iam just curious to know whether ipv4 routes can be redistributed to ipv6 address-families.&#xA;Eg: I have a router for BGP configuration with ipv6 address-family and OSPF in ipv4 with other neighbor. Can I do the redistribution?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          BGP                           OSPF&#xA;R1 &amp;lt;---------------------&amp;gt; R2 &amp;lt;---------------------&amp;gt; R3&#xA;11::1/64          11::2/64    1.1.1.1/24          1.1.1.2/24 &#xA;                                                  Route - 2.0.0.0/8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BGP configs:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;R2:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA;neighbor 11::2 remote-as 200&#xA;address-family ipv6 unicast&#xA;neighbor 11::2 activate&#xA;redistribute ospf&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible for redistribution of ospf ipv4 routes onto BGP ipv6 address-family.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or If dual-stack is supported, can we do redistribution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone please clarify on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate the help.&lt;/p&gt;&#xA;" OwnerUserId="2736" LastActivityDate="2013-10-18T10:30:15.743" Title="Can we do redistribution of ipv4 routes onto v6 address families?" Tags="|bgp|ospf|ipv6|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3637" PostTypeId="2" ParentId="3636" CreationDate="2013-10-18T10:30:15.743" Score="5" Body="&lt;p&gt;Yes you can - &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5549&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc5549&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;However this is quite rare. It's far more common to do it the other way around with v6 nlri advertised over the v4 connection (used by 6PE and 6VPE)&lt;/p&gt;&#xA;&lt;p&gt;If you're dual-stacked it's far better to simply have a v6 and v4 BGP connection and advertise the correct address families for each&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-10-18T10:30:15.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3638" PostTypeId="2" ParentId="3631" CreationDate="2013-10-18T10:56:44.313" Score="8" Body="&lt;p&gt;The route table only shows the live routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to show all statics you'll need to show what's configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show run | inc ip route&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is on IOS of course&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="1055" LastEditDate="2013-10-18T16:41:21.757" LastActivityDate="2013-10-18T16:41:21.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3639" PostTypeId="1" CreationDate="2013-10-18T06:48:03.860" Score="1" ViewCount="173" Body="&lt;p&gt;How does a gateway identify the destination PC when the response comes back to it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose there is an organisation which has many computers.  All these computers have a specific range of IP addresses, and they are all connected through a gateway router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does the gateway router differentiate between the computers when sending the requests out of the company, and returning the responses to the company computers?  In my understanding, a router acts as an entry and exit point for an internal network.&lt;/p&gt;&#xA;" OwnerDisplayName="ravigs" LastEditorUserId="775" LastEditDate="2013-10-18T11:33:32.150" LastActivityDate="2013-10-18T21:27:03.920" Title="Clarification about Corporate Networking Gateway" Tags="|routing|router|ipv4|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3640" PostTypeId="2" ParentId="3639" CreationDate="2013-10-18T07:42:30.773" Score="0" Body="&lt;p&gt;Plain and simple ...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computer networking, a default gateway is the device that passes&#xA;  traffic from the local subnet to devices on other subnets. The default&#xA;  gateway often connects a local network to the Internet, although&#xA;  internal gateways for local networks also exist. Internet default&#xA;  gateways are typically one of two types:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;On home or small business networks with a broadband router to share&#xA;  the Internet connection, the home router serves as the default&#xA;  gateway.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;On home or small business networks without a router, such as for&#xA;  residences with dialup Internet access, a router at the Internet&#xA;  Service Provider location serves as the default gateway. Default&#xA;  network gateways can also be configured using an ordinary computer&#xA;  instead of a router. These gateways use two network adapters, one&#xA;  connected to the local subnet and one to the outside network. Either&#xA;  routers or gateway computers can be used to network local subnets such&#xA;  as those in larger businesses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://technet.microsoft.com/en-us/library/cc779696%28v=ws.10%29.aspx&quot; rel=&quot;nofollow&quot;&gt;Source 1&lt;/a&gt; - &lt;a href=&quot;http://compnetworking.about.com/od/internetaccessbestuses/f/default_gateway.htm&quot; rel=&quot;nofollow&quot;&gt;Source 2&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1887" OwnerDisplayName="t.thielemans" LastActivityDate="2013-10-18T07:42:30.773" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3641" PostTypeId="2" ParentId="3639" CreationDate="2013-10-18T11:34:20.310" Score="0" Body="&lt;p&gt;A router has a routing table (statically set, or defined automatically via some routing protocol), which contains the data where to send the packet. In this table it maintans entries for destination networks, so it knows where to send packets with some destination number:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network1 - send via gateway1&#xA;network2 - directly connected to interface2&#xA;network3 - send via gateway3&#xA;default  - gateway4 (default gateway)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So when a packet comes to an interface, it checks the destination IP, see if it matches any of the networks defined in it's routing table, and sends the packet there. If it doesn't match any of the defined routes, it sends it via the default route/gateway (&quot;all other destinations&quot;). If the default route/gateway is not set, it sends back the &quot;destination unreachable&quot; icmp message to the packet source. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have NAT turned on, it also keeps a NAT table, where it keeps all the connections. So when your internal PC with an ip from a private range (eg 192.168.1.2) sends a packet outside, the router replaces the private source address, in the IP header, with a public one, assigned to the router, and stores the connection in the NAT table. So when a packet comes back, to the routers public interface, it checks the NAT table to see where it should send it, and changes the destination IP (public one on the router) to an internal one (eg. 192.168.1.2). &lt;/p&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="1220" LastEditDate="2013-10-18T11:49:20.537" LastActivityDate="2013-10-18T11:49:20.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3642" PostTypeId="2" ParentId="3634" CreationDate="2013-10-18T11:44:28.327" Score="1" Body="&lt;p&gt;The google search indicates the UTM appears to be a firewall. While you could get say a cheap router/firewall put it on a shelf and if the UTM dies physially replace it, that seems a bad idea as that boxes are not functionally equivlant. This is a form of redundancy though a static kind, as mentioned in the comment. Net of this is that if you need the firewall function you need a duplicate physical box. MAYBE you can 'limp along' with a less expensive spare box while you wait for your replacement firewall but that is a business call. Lastly most people here will tell you that your ISP connection will fail far more often than your hardware and that is what you need to make redundant first.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-10-18T11:44:28.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3644" PostTypeId="2" ParentId="3635" CreationDate="2013-10-18T20:07:59.727" Score="3" Body="&lt;p&gt;I am no expert on these devices, but in looking at the &lt;a href=&quot;http://www.rad.com/Media/5329_dxc-d4e1.pdf&quot; rel=&quot;nofollow&quot;&gt;D4E1/D8Eq&lt;/a&gt; modules that you reference, it looks like you could possibly take the incoming E1 circuit and break it into two fractional-E1 circuits.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you could connect one half of the E1 to each router, but you would be permanently halving your throughput on that particular E1.  Perhaps you could send 20 channels to the primary router and only 3 to the backup router, instead of splitting the E1 in half exactly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, two caveats:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I would reach out to &lt;a href=&quot;http://www.rad.com/3-2242/Contact-Us/&quot; rel=&quot;nofollow&quot;&gt;RAD&lt;/a&gt; and ask them if this is a supported/intended use for their device.  It is very possible that the device simply muxes/demuxes the circuits, but provides no supervision in the sense that your CPE is currently doing.  That is to say, an E1 from your carrier may not be able to establish connectivity when connected to this device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) In my opinion, you're fixing the wrong failure scenario. I've seen the carrier's E1/T1 go down FAR, FAR, more often than a failure of the CPE. (This seemed to be true both when I was the carrier and working in the enterprise sector.) I would look at carrier redundancy first, then look into duplicating your edge equipment.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-10-18T20:16:28.533" LastActivityDate="2013-10-18T20:16:28.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3645" PostTypeId="2" ParentId="3639" CreationDate="2013-10-18T21:27:03.920" Score="5" Body="&lt;p&gt;Making a few assumptions&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You are talking about an Internet gateway router&lt;/li&gt;&#xA;&lt;li&gt;You are using RFC1918 addresses on the inside&lt;/li&gt;&#xA;&lt;li&gt;You have a single IP assigned to you from your ISP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;With all of this being the case, Your gateway router is going to be performing PAT [Port Address Translation]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a request goes through your gateway from a client it has a few important pieces of information. Source IP, source port, destination IP, destination port, all of which Your router will keep track of all of this in a table [Translation table].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So lets look at an example. In this example your IP that your router has from your ISP is 123.123.123.123&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BEFORE TRANSLATION&#xA;SRC IP = 10.10.10.1 SRC Port = TCP/12345 ==&amp;gt; DST IP 8.9.10.11 DST Port TCP/80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As this travels through the router it will translate the source info.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AFTER TRANSLATION&#xA;SRC IP = 123.123.123.123 SRC Port = TCP/54321 ==&amp;gt; DST IP 8.9.10.11 DST Port TCP/80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When 8.9.10.11 responds it will respond like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RESPONSE&#xA;SRC IP 8.9.10.11 SRC Port TCP/80 ==&amp;gt; DST IP = 123.123.123.123 DST Port = TCP/54321&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your router will look at its translation table and discover that TCP/54321 was the source port of a connection that initially came from 10.10.10.1 with an original source port of TCP/12345.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router will the rewrite the packet/segment and send it back to the inside host.&lt;/p&gt;&#xA;" OwnerUserId="2920" LastActivityDate="2013-10-18T21:27:03.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3648" PostTypeId="1" CreationDate="2013-10-19T21:05:44.117" Score="7" ViewCount="1553" Body="&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/a/954/2662&quot;&gt;These best practices&lt;/a&gt; espouse having a dedicated physical console connection to network equipment for management.  Assuming your device is within RS232 range of your management workstation, this would likely mean connecting to your devices' RS232 console ports over structured UTP already in place.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a collection of three current Cisco devices all within RS232 range of my management workstation.  Their RS232 console ports are not all the same, however:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Device      Console Connector&#xA;======      =================&#xA;ASA5505     RJ45 Jack&#xA;SG500X      DE9 Male&#xA;SG300       DE9 Male&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course, it is trivial to connect to the RJ45 console port using structured ethernet cabling.  When you do that, you end up with the following RS232 signal map to your UTP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0qiQm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the DE9 console ports, the only standard to connect RS232 over RJ45-terminated UTP seems to be &lt;a href=&quot;http://www.zytrax.com/tech/layer_1/cables/tech_rs232.htm#rj45&quot; rel=&quot;nofollow noreferrer&quot;&gt;TIA-561 (aka RS-232D)&lt;/a&gt;.  When you do that, you end up with the following RS232 signal map to your UTP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wtR5n.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see this results in RS232 signals on the UTP that are different for the different console port types -- and this is with a collection of just three current devices from a single vendor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I'm sure I could document this and make sure all admins have just the right cables/adapters available to make a successful connection it seems unnecessarily error-prone.  Particularly since the console connection is often used only as a backup during stressful periods when other methods of connecting to the device have already failed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, all RS232 on the structured cabling would follow the same pinout.  I can force everything to follow TIA-561 with custom adapters at each device and workstation, but I've never seen that done anywhere else.  Is there a good way to standardize RS232 over RJ45 pinouts?&lt;/p&gt;&#xA;" OwnerUserId="2662" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2013-10-20T00:17:04.077" Title="Is there a good way to standardize on an RS232 over RJ45 pinout that is used for connecting to network device console ports?" Tags="|management|cabling|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3649" PostTypeId="2" ParentId="3648" CreationDate="2013-10-20T00:17:04.077" Score="2" Body="&lt;p&gt;I cannot speak for anyone else but I do a TOR 8 to 16 port 'terminal server' that is connected to a management Ethernet, we do not try to use the structured cable to bring them to a central set of terminal servers. We then test as part of the turn up. We also home run the cables, as it is less likely that someone will disconnect one in error and you don't know that the cabling is wrong till you really need it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you have on site people you really trust, I would not try to save $$s on this.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-10-20T00:17:04.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3656" PostTypeId="2" ParentId="3239" CreationDate="2013-10-21T13:15:44.363" Score="1" Body="&lt;p&gt;I've solved the problem by getting a static IP for the client too, which also was a 3G link. Then I could create that static route for this client only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP also require both endpoints to have static IP for communication to work as they both are on same ISP.&lt;/p&gt;&#xA;" OwnerUserId="2666" LastActivityDate="2013-10-21T13:15:44.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3657" PostTypeId="1" AcceptedAnswerId="5520" CreationDate="2013-10-21T13:56:22.730" Score="9" ViewCount="3104" Body="&lt;p&gt;We have two Cisco 2602E APs and one Cisco 3602E AP deployed at a location in China. They are connected to an HP ProCurve 2910al PoE switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 3602E powers up fine when the switch is rebooted (i.e. power loss, they have rolling blackouts in this city) but the 2602E APs both require someone pressing the mode button on them before they power on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before the mode button is pressed, the HP switch shows no device on the ports and no power being pulled on them. The APs have no LED activity, they appear off. When someone presses the mode button they mysteriously power on. The HP switch now shows power draw and their LED turns on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cable runs to them are around 200'. The switch is PoE+ so it has plenty of wattage to cover any loss over the distance. The 3602 is on a shorter run and has no issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a second facility in China with the same setup and they do not have this issue. All APs have the same boot loader and IOS per model (i.e. the 2602Es in each site have the same boot loader and IOS rev).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This same issue occurs when using a Cisco 3560C PoE+ switch and the existing cabling setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As this is in China, my ability to troubleshoot is a bit limited right now. I am hoping someone has experienced a similar problem and can point me in the right direction. This wouldn't be such a big issue if the APs weren't mounted in a factory ceiling that requires a lift to get to them for pressing the mode button.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be causing the 2602Es to not power up with the switch?&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2013-12-18T04:38:39.217" LastActivityDate="2020-09-12T05:23:30.933" Title="Cisco AP not powering up until pressing mode button" Tags="|cisco|wireless|hp-procurve|aironet|cisco-wireless|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3658" PostTypeId="1" CreationDate="2013-10-21T15:54:37.967" Score="1" ViewCount="595" Body="&lt;p&gt;I have a basic question about ECMP, say I have a /20 route and also a /16 route to a host, and both are reachable, can ECMP load-balance between different prefix length or is it like, hardware first determines the route through LPM and then only applies ECMP?&#xA;I mean not just about hardware, is there something wrong in this approach by principles? What are the general hardware capabilities like? Like ASICS from Broadcom etc. Do they support this if at all this is reasonable? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no hidden thing, I work with a networking company, and just learning routing related things and wanted to understand. I just got this question that what prevents ECMP in this situation ? Why do you think that its random ? Since my company uses these chips so I asked about this. &lt;/p&gt;&#xA;" OwnerUserId="2994" LastEditorUserId="775" LastEditDate="2013-10-21T17:51:35.313" LastActivityDate="2013-10-21T18:30:10.427" Title="ECMP between next-hops with different route prefix length" Tags="|routing|switch|ecmp|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3659" PostTypeId="2" ParentId="3658" CreationDate="2013-10-21T18:24:22.353" Score="3" Body="&lt;p&gt;&lt;strong&gt;Question 1&lt;/strong&gt;:  I have a basic question about ECMP, say I have a /20 route and also a /16 route to a host, and both are reachable, can ECMP load-balance between different prefix length or is it like, hardware first determines the route through LPM and then only applies ECMP?&lt;/p&gt;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1812#page-24&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc 1812, Requirements for IPv4 Routers, Section 2.2.5.2&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Routers must use the most specific matching route (the longest matching network prefix) when forwarding traffic.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Once the router has picked the longest match prefix for the destination (using what the rfc calls &amp;quot;pruning rules&amp;quot;), it must pick the next-hop to forward the traffic to.  At this point ECMP (or &amp;quot;load-splitting&amp;quot;) occurs...&lt;/p&gt;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1812#page-73&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc 1812, Requirements for IPv4 Routers, Section 5.2.4.3 Next Hop Address&lt;/a&gt;,&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Conceptually, any route lookup algorithm starts out with a set of&#xA;candidate routes that consists of the entire contents of the FIB.&#xA;The algorithm consists of a series of steps that discard routes from&#xA;the set.  These steps are referred to as Pruning Rules.  Normally,&#xA;when the algorithm terminates there is exactly one route remaining in&#xA;the set.  If the set ever becomes empty, the packet is discarded&#xA;because the destination is unreachable.  It is also possible for the&#xA;algorithm to terminate when more than one route remains in the set.&#xA;In this case, the router may arbitrarily discard all but one of them,&#xA;or may perform &amp;quot;load-splitting&amp;quot; by choosing whichever of the routes&#xA;has been least recently used.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr&gt;&#xA;&lt;p&gt;&lt;strong&gt;Question 2&lt;/strong&gt;: How it would cause loops? Could you please explain in detail?&lt;/p&gt;&#xA;&lt;p&gt;Assumptions...&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Suppose R1, R2, and R3 below all run iBGP with each other in a full-mesh of peers, and they run OSPF to cover next-hop routing for their iBGP prefixes&lt;/li&gt;&#xA;&lt;li&gt;R1 announces an iBGP route to 10.1.0.0/20 with an OSPF E2 next-hop via S1/0&lt;/li&gt;&#xA;&lt;li&gt;R3 announces an iBGP route to 10.1.0.0/16 with an OSPF E2 next-hop via S3/0&lt;/li&gt;&#xA;&lt;li&gt;Assume the OSPF E2 metrics for R1:S1/0 and R3:S3/0 are the same&lt;/li&gt;&#xA;&lt;li&gt;R2 receives a packet for 10.1.15.0 on R2:S2/0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Diagram...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                S1/0       S1/2   S2/1     S2/3   S3/2    S3/0&#xA;Static Route to    +------+         +------+        +------+       Static Route to&#xA;10.1.0.0/20 &amp;lt;------|  R1  |---------|  R2  |--------|  R3  |-----&amp;gt; 10.1.0.0/16&#xA;                   +------+         +------+        +------+&#xA;                                        | S2/0&#xA;                                        |&#xA;                                        &#xA;                                        ^&#xA;                                        ^&#xA;                                        | Ingress packet to 10.1.15.1&#xA;                                        |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If R1, R2 and R3 &lt;em&gt;do not&lt;/em&gt; choose the longest-prefix match before an ECMP algorithm, then R2 could use ECMP to randomly choose whether it forwards 10.1.15.1 out R2:S2/1 or R2:S2/3.  When R3:S3/2 gets a packet for 10.1.15.1, it could be forwarded back to R2:2/3.&lt;/li&gt;&#xA;&lt;li&gt;If R1, R2 and R3 choose the longest-prefix match first, then R2 will always forward 10.1.15.1 out R2:S2/1.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr&gt;&#xA;&lt;p&gt;&lt;strong&gt;Question 3&lt;/strong&gt;: So I see you are saying that hardware are really not capable of not doing it. Does this apply to all kind of chips?&lt;/p&gt;&#xA;&lt;p&gt;This applies to all kinds of chips that handle IP forwarding. Relevant portions of RFC compliance are required if the silicon vendor wants any hope of selling their chips.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-10-21T18:30:10.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3660" PostTypeId="1" AcceptedAnswerId="3665" CreationDate="2013-10-21T20:14:21.117" Score="3" ViewCount="778" Body="&lt;p&gt;I have a main building with static NAT (One IP Address from ISP) and a remote building with a Point to Point T1 connecting it to the main building.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I use eigrp and redistribute static I can access both subnets but do not gain internet access from the branch building. I have tested several different eigrp and static routing configs with no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;main building:&lt;br&gt;&#xA;router eigrp 1&lt;br&gt;&#xA;network 10.1.1.0 0.0.0.3&lt;br&gt;&#xA;network 10.10.16.0 0.0.0.255&lt;br&gt;&#xA;redistribute static metric 1544 2000 255 1 1500&lt;/p&gt;&#xA;&#xA;&lt;p&gt;branch building:&lt;br&gt;&#xA;router eigrp 1&lt;br&gt;&#xA;network 10.1.1.0 0.0.0.3&lt;br&gt;&#xA;network 10.10.17.0 0.0.0.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The attached diagram shows my current conifg to allow all subnets to use the one isp internet connection. But doing double nat isn't best solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vCi3q.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2995" LastActivityDate="2013-10-21T22:02:05.910" Title="internet access to remote subnet" Tags="|cisco|nat|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3665" PostTypeId="2" ParentId="3660" CreationDate="2013-10-21T21:42:14.890" Score="2" Body="&lt;p&gt;&lt;strong&gt;Regarding NAT:&lt;/strong&gt;&#xA;I get that you are fixing the problem with your NAT by NAT-ing everything from the branch point-to-point subnet so the interfaced is marked for NAT at HQ. But i would remove that and create a static NAT on HQ for the branch office network, so that traffic get's NAT-ted as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Regarding EIGRP:&lt;/strong&gt;&#xA;Please make sure you have no auto-summary on eigrp peers. From the discussion and the info we have nothing seems the matter with the EIGRP config. &#xA;However have a look at if you by accident don't have a static default route on your branch router.&#xA;Make sure your branch router has IP Classless enabled, this makes sure that if a packet is received which does not have a more specific route it will choose the default route. Check your routing table and eigrp topology table to see if you see the route. &#xA;You can also do debug eigrp to see if you see any relevant updates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all else fails try clear your adjacency to make sure that the tables aren't stuck. To make sure you can double check by creating as static route point to HQ router since it's such a small setup, and not that dynamic ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also other methods for redistributing, though the method you chose is the most common one.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create a static route and redistribute (you can have metric or skip it for default metrics)&lt;/li&gt;&#xA;&lt;li&gt;Create a ip summary address to default route towards the branch&lt;/li&gt;&#xA;&lt;li&gt;ip default-network (BAD)&lt;/li&gt;&#xA;&lt;li&gt;network 0.0.0.0 command under eigrp (BAD)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;EDIT: The NAT&lt;/p&gt;&#xA;" OwnerUserId="381" LastEditorUserId="381" LastEditDate="2013-10-21T22:02:05.910" LastActivityDate="2013-10-21T22:02:05.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3667" PostTypeId="1" CreationDate="2013-10-22T03:24:37.103" Score="-2" ViewCount="9145" Body="&lt;p&gt;need your thoughts on this, i have a switch that runs on 1000mb Full duplex and a firewall with 100Mb Full duplex, is there a possibility traffic wont pass through? &lt;/p&gt;&#xA;" OwnerUserId="2999" LastActivityDate="2017-05-31T12:49:44.780" Title="speed/duplex mismatch between 1000Mb and 100Mb full duplex" Tags="|speed|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3668" PostTypeId="2" ParentId="3667" CreationDate="2013-10-22T03:55:33.880" Score="2" Body="&lt;p&gt;Short answer: The switch should auto-negotiate down to 100-full on its own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer: If the switch for some whatever reason refuses to properly auto-negotiate with the firewall (or vice-versa) you may need to force the switch interface to 100-Full. This can actually happen in a few scenarios. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some older firewalls and older routers (various makes/models) have interfaces that only talk at 100-Full - they won't properly auto-negotiate with other equipment. As a result, you sometimes need to force the speed/duplex on the other equipment (in this case, the switch). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you hook them up, take a look at the switch and firewall error logs - if you see speed/duplex mismatch errors and/or other errors that increment frequently, go ahead and force the switch to 100-full.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No errors? Congratulations, that means your equipment is properly auto-negotiating! Happy networking.&lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2013-10-22T03:55:33.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3669" PostTypeId="2" ParentId="3667" CreationDate="2013-10-22T05:15:22.083" Score="3" Body="&lt;p&gt;You don't give a lot of detail, but you do have a specific question.  Yes it is entirely possible that traffic won't pass between a 1000/Full interface and a 100/Full interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While many 1Gig connections will have the capability to run at 100/Full, there are also a fair number that do not.  For instance, most 1Gig transceiver hardware will not work at 100/Full.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know which make/model of switch you have, but on most enterprise class switches there is a command that will give you all sorts of details on the the features and capabilities of the port.  For example, on a Cisco switch you would use a command similar to &lt;strong&gt;&lt;em&gt;show interfaces capabilities module [module number]&lt;/em&gt;&lt;/strong&gt; command and you would get output similar to the below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GigabitEthernet3/1&#xA;  Model:                 WS-X4306-GB-Gbic&#xA;  Type:                  1000BaseSX&#xA;  Speed:                 1000&#xA;  Duplex:                full&#xA;  Auto-MDIX:             no&#xA;  Trunk encap. type:     802.1Q,ISL&#xA;  Trunk mode:            on,off,desirable,nonegotiate&#xA;  Channel:               yes&#xA;  Broadcast suppression: percentage(0-100), hw&#xA;  Flowcontrol:           rx-(off,on,desired),tx-(off,on,desired)&#xA;  VLAN Membership:       static, dynamic&#xA;  Fast Start:            yes&#xA;  CoS rewrite:           yes&#xA;  ToS rewrite:           yes&#xA;  Inline power:          no&#xA;  SPAN:                  source/destination&#xA;  UDLD:                  yes&#xA;  Link Debounce:         no&#xA;  Link Debounce Time:    no&#xA;  Port Security:         yes&#xA;  Dot1x:                 yes&#xA;  Maximum MTU:           9198 bytes (Jumbo Frames)&#xA;  Multiple Media Types:  no&#xA;  Diagnostic Monitoring: N/A&#xA;  Queuing:               rx-(N/A), tx-(1p3q1t, Sharing/Shaping)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This shows an example of an interface that will not be able to communicate with your 100/Full firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, your interfaces may also not support Auto-MDIX.  In this case, you may or not need a crossover cable to connect the devices depending on the hardware.  Having the wrong cable will prevent the interfaces from establishing a connection.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-10-22T05:30:09.963" LastActivityDate="2013-10-22T05:30:09.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3670" PostTypeId="1" AcceptedAnswerId="3672" CreationDate="2013-10-22T11:06:30.260" Score="3" ViewCount="3004" Body="&lt;p&gt;At this moment in my company i have two gigabit switches (zyxel dimension gs1116) and one 24 port 100M linksys switch . None of them is managed. In server room are 2 switches. One gigabit switch and linksys. Second gigabit switch is located on buildings 4th floor. Also somewhere is basic 8 port edimax switches (2 or 3).&lt;br&gt;&#xA;Now we bought &lt;code&gt;HP V1910-48G&lt;/code&gt; witch is 48 port gigabit switch. Now i remove two switches in server room and place HP there. New switch is placed, because we need to separate public wifi from company's network. And also move cash registers into separate network. &#xA;I created two VLANs. VLAN with id 2 is company network and vlan with id 3 is for guest wireless access.&lt;br&gt;&#xA;VLAN 2 and 3 have assigned port range from 1 to 32. Booth VLANs port membership is tagged.&lt;br&gt;&#xA;&lt;code&gt;And question is:&lt;/code&gt; if i connect all cables to new switch, all stuff works? Or i can get in trouble.&lt;br&gt;&#xA;Of course i will replace switches after working hours and test connectivity. I am asking, because to be know if i need made some changes to router too. And does basic switches can handle VLANs ? Or they don't care that?&lt;br&gt;&#xA;&lt;code&gt;Firewall:&lt;/code&gt; Firewall is basic computer running &lt;code&gt;iptables&lt;/code&gt; (shorewall). I know that i must reconfigure firewall, to forward wifi guest packets to gateway interface only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN with id 1 (default) i leave unchanged (all ports is assigned as untagged).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagined second scenario: company network uses untagged ports and only mark public wifi traffic? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Public wifi is planned to mark via separate SSID&lt;/p&gt;&#xA;" OwnerUserId="3002" LastActivityDate="2013-10-22T16:22:03.637" Title="Adding VLANs to existing infrastructure" Tags="|vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3672" PostTypeId="2" ParentId="3670" CreationDate="2013-10-22T16:22:03.637" Score="5" Body="&lt;p&gt;If you assign switch ports to specific VLANs, the switch treats them as if they were all in their own little Ethernet network, and the end stations are usually unaware that they're connected to a VLAN-based switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a switch port is tagged, that means that all of the frames that aren't in the default VLAN (usually 1, which you're right to leave alone) have a 4-byte 802.1q header attached that says what VLAN they go with (as well as basic QoS information). A device attached to a tagged port needs to be aware of the VLAN setup if it's going to properly process such packets, but these are typically other switches (either traditional switches or software switches inside a VM hypervisor).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should usually force end-user ports to untagged to ensure that someone can't insert a custom VLAN tag and get access to a different VLAN (known as VLAN hopping). On your switch, all of the ports should be untagged unless the WiFi APs are capable of talking on multiple VLANs so that they can have a management address on a different VLAN from the one they're sending client traffic over, or so that single APs can connect multiple SSIDs to different VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether a &quot;basic&quot; switch &quot;handles&quot; VLANs depends on what each term means. Most unmanaged switches will simply pass 802.1q-tagged frames along as-is, with no attempt to direct them anywhere in particular, so plugging an unmanaged switch into an untagged port is simply the same as not using VLANs at all, while plugging one into a tagged port is like having a shared tagged segment among the different equipment that knows about the VLANs.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-10-22T16:22:03.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3673" PostTypeId="1" CreationDate="2013-10-22T17:01:29.297" Score="6" ViewCount="36133" Body="&lt;p&gt;I am going through a course of networking and want to know the difference between the mentioned devices. I have heard that the switches:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Establish a temporary connection between the devices connected to it&#xA;and wanting to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If this is the case then why does the connection needs to be temporary or where is it helpful?&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Reads the destination address from packet header and sends it to the&#xA;mentioned receiver.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And Bridges:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Establish permanent connection amongst networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If temporary connection is sufficient, why have a permanent one?&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Forwards packets only if it were requested by any of the host in the rest of the network. (For which a filter table is maintained)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Are the following true or false. Correct them if false:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I can only use either a router or a bridge to connect same protocol&#xA;following multiple networks (amongst themselves).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;All the devices are gateways falling under different layers of OSI&#xA;model and have ability to translate between all the protocols of that&#xA;layer.(for eg. router is a gateway falling in network layer and is&#xA;capable of translating protocols TCP followed by network A to UDP&#xA;followed by network B (two of the protocols operating at networking&#xA;layer) and vice versa)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A gateway in general operates in application, session and presentation&#xA;layer.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also I am not convinced by the fact that a protocol needs to be translated into another and hence the need of devices. The reason is that if the networking by definition means that it needs to agree on a protocol, why is there a need of translation? I would be grateful to the answers clearing the doubts(without raising any other :-)).&lt;/p&gt;&#xA;" OwnerUserId="3006" LastActivityDate="2018-05-16T10:25:49.463" Title="Difference between gateway, router, switches and bridge" Tags="|switch|router|bridge|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3674" PostTypeId="2" ParentId="3673" CreationDate="2013-10-22T17:58:16.890" Score="10" Body="&lt;p&gt;The description of switches and bridges is &amp;quot;sort of&amp;quot; correct, &amp;quot;sort of&amp;quot; not.&lt;/p&gt;&#xA;&lt;p&gt;Bridges &lt;i&gt;typically&lt;/i&gt; don't have the capability to filter &lt;i&gt;frames&lt;/i&gt;. Switches may have the capability to filter, based on things like access control lists, but that's for a bit later in your networking course.&lt;/p&gt;&#xA;&lt;p&gt;For right now, consider the following:&lt;/p&gt;&#xA;&lt;p&gt;&lt;i&gt;A bridge forwards frames from one segment to another segment.&lt;/i&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;i&gt;A switch is essentially a multi-port bridge.&lt;/i&gt;&lt;/p&gt;&#xA;&lt;p&gt;To answer your true-or-false questions:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Are the following true or false. Correct them if false:&lt;/p&gt;&#xA;&lt;p&gt;I can only use either a router or a bridge to connect same protocol following multiple &amp;gt;networks (amongst themselves).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;False. You'll typically use switches for this task - in much larger networks, you'll use &lt;i&gt;routers&lt;/i&gt; and &lt;i&gt;firewalls&lt;/i&gt; between geographically separated sites, but that's beyond the scope of your current studies.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;All the devices are gateways falling under different layers of OSI model and have ability &amp;gt;to translate between all the protocols of that layer.(for eg. router is a gateway falling &amp;gt;in network layer and is capable of translating protocols TCP followed by network A to UDP &amp;gt;followed by network B (two of the protocols operating at networking layer) and vice versa)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;False. Routers examine &lt;i&gt;Layer 3&lt;/i&gt; packets encapsulated inside &lt;i&gt;Layer 2&lt;/i&gt; frames for network information, and then direct them out interfaces according to their destination. In contrast, a switch looks only at the &lt;i&gt;Layer 2&lt;/i&gt; MAC address to determine its destination. A program (Application Layer) which talks with the UDP protocol will only &amp;quot;talk&amp;quot; on that protocol: the router cannot dynamically change it to &amp;quot;TCP&amp;quot; - it doesn't work that way. The router only encapsulates the data in a format which can traverse links between different Layer 3 networks.&lt;/p&gt;&#xA;&lt;p&gt;Protocols like TCP and UDP operate at OSI Layer 4 - the &amp;quot;Transport&amp;quot; layer, and they differ in very specific ways and are used for different purposes. For example, UDP has no mechanism to detect whether packets are successfully received at the other end - they might get lost! TCP has a mechanism to detect whether data reaches the other end, and if not, to retransmit the lost packets.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A gateway in general operates in application, session and presentation layer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;False. Gateways operate at Layer 3.&lt;/p&gt;&#xA;&lt;p&gt;Example: We're going to use a typical home network topology.&lt;/p&gt;&#xA;&lt;p&gt;Computer A in Los Angeles wants to connect to Website B in New York. Computer A performs a DNS lookup of Website A, which translates to an IP address. Computer A sees that the IP address returned is not on the same network as itself, so it sends the packets to its &lt;i&gt;default gateway&lt;/i&gt;. The default gateway is usually a router, which contains a &lt;i&gt;routing table&lt;/i&gt;, which tells the router which external networks are reachable through which interfaces - it also has a &lt;i&gt;default route&lt;/i&gt; which tells the router which interface or IP address to direct traffic to, if the destination does not appear in its routing table. In this case, because it's a consumer-grade appliance connected to a home network, the &lt;i&gt;gateway&lt;/i&gt; sends all packets to unknown destinations upstream to the ISP.&lt;/p&gt;&#xA;" OwnerUserId="2912" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-10-23T03:41:31.720" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3675" PostTypeId="1" AcceptedAnswerId="3679" CreationDate="2013-10-22T18:12:24.890" Score="3" ViewCount="3885" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/waG32.png&quot; alt=&quot;enter image description here&quot;&gt;Network: 100.10.0.0/21&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1, 100.10.0.9/29 (loopback 100.10.0.1/32)&#xA;R2, 100.10.0.10/29 (loopback 100.10.0.2/32)&#xA;&#xA;ASA (active), 100.10.0.11/29&#xA;ASA (passive), 100.10.0.12/29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 has two bgp transit upstreams. R2 and R1 has iBGP so R2 can route via R1. R2 will, after ospf is confirmed working, get one of the transit upstreams. Both R1 and R2 now has a static route for 100.10.0.0/21 to 100.10.0.11 (asa).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to divide the /21 subnet into smaller areas, or can it, in its whole, be part of area 0 (if so, I don't understand how R1 or R2 would know to reach everything on the /21 by routing to the asa).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Divide the /21&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;area 0&#xA;    network 100.10.0.8 255.255.255.248&#xA;&#xA;area 1&#xA;    network 100.10.1.0 255.255.255.0&#xA;    network 100.10.2.0 255.255.255.0&#xA;    network 100.10.3.0 255.255.255.0&#xA;    network 100.10.4.0 255.255.255.0&#xA;    network 100.10.5.0 255.255.255.0&#xA;    network 100.10.6.0 255.255.255.0&#xA;    network 100.10.7.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OR, have the network as a whole in area 0?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;area 0&#xA;    network 100.10.0.0 255.255.248.0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3007" LastEditorUserId="3007" LastEditDate="2013-10-23T11:51:53.570" LastActivityDate="2013-10-23T11:51:53.570" Title="OSPF between ASA and IOS: Subnet and area design" Tags="|routing|cisco-asa|ospf|cisco-ios-12|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3677" PostTypeId="1" CreationDate="2013-10-22T19:53:07.737" Score="4" ViewCount="159" Body="&lt;p&gt;We have an IPS module inside a Cisco ASA. It is an SSM-10. Looking in the show tech of the IPSM I see this line:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Halt Device on Over Temp   : 1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe that means the system will halt when the temperature gets too hot. What is considered too hot?&lt;/p&gt;&#xA;" OwnerUserId="949" LastEditorUserId="775" LastEditDate="2013-10-24T12:33:42.783" LastActivityDate="2013-10-24T12:33:42.783" Title="Cisco IPS - At what temperature will the IPS halt?" Tags="|cisco|cisco-asa|firewall|intrusion-prevention|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3678" PostTypeId="1" AcceptedAnswerId="5646" CreationDate="2013-10-22T23:13:43.377" Score="3" ViewCount="949" Body="&lt;p&gt;I would like to install a Cisco ASA onto an existing network to provide VPN access to a remote office using an ASA at the remote office. In this scenario i am not able to replace the production firewall with the ASA as the main firewall.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to make either office subnet available to the remote office, would I just add a static route on their existing firewall / router to send traffic to the IP of the ASA to be forwarded down the tunnel? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Local Office&#xA;Network = 192.168.1.0/24&#xA;Router = 192.168.1.1&#xA;&#xA;Remote Office &#xA;Network = 10.1.1.0/24&#xA;Router = 10.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's Say I add the ASA at the following IPs and enstablish a VPN to either office via a static IP Ipsec VPN&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA 1 = 192.168.1.254&#xA;ASA 2 = 10.1.1.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would I add the following static route to direct traffic to the ASA on either site's router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Site 1 Route  10.1.1.0 255.255.255.0 192.168.1.254&#xA;Site 2 Route 192.168.1.0 255.255.255.0 10.1.1.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks for your insight. &lt;/p&gt;&#xA;" OwnerUserId="1352" LastActivityDate="2013-12-30T20:20:28.230" Title="Installing a Cisco ASA VPN into an existing network" Tags="|cisco-asa|vpn|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3679" PostTypeId="2" ParentId="3675" CreationDate="2013-10-22T23:45:52.783" Score="2" Body="&lt;p&gt;Like Mike said (in the comments) the network command will search for interfaces within that range and start advertising through it. It will also take the subnet of that interface and advertise it into OSPF. A cleaner way of looking at it that now a days instead of giving the network command you can go into an interface and add it to the OSPF proccess. This in turn does the same as the network command (find interface - advertise it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you say /24 or /21 doesn´t matter it's just a wider scope for OSPF to search for the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now back to your issue, the /21 won´t be advertised unless you have an interface as /21 and are advertising it in OSPF. What you could do is a static route (pointing to null0) on the ASA and redistribute it into OSPF (redistribute static subnets). Other methods like summary address are only available in ABR and ASBR  (OSPF Border routers). Or you could, if applicable inject a default route in OSPF at the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The area part totally depends on your setup but if we are only talking OSPF within routers and ASA we can safely assume that one Area 0 will suffice. Try not to get mixed up with areas and networks here. Without going into to much detail and explinations of area and LSA just remember the golden rule, every area has to connect to the center (area 0), and area 0 can not be discontiguous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also remember if you want to redistribute iBGP into OSPF you need to allow it within BGP with &quot;bgp redistribute-internal&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your information i hope this is what you where looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: OSPF area&lt;/p&gt;&#xA;" OwnerUserId="381" LastEditorUserId="381" LastEditDate="2013-10-22T23:52:02.403" LastActivityDate="2013-10-22T23:52:02.403" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3682" PostTypeId="1" AcceptedAnswerId="3684" CreationDate="2013-10-23T04:17:32.180" Score="0" ViewCount="178" Body="&lt;p&gt;In my new house I've found a set of four terminals with one ethernet cable connected to all of them.  The cable is split so that there is only one twisted pair connected to each terminal.  What on earth is this for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--&#xA;Edit:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/5iNAb.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5iNAb.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;Link to larger image&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3014" LastEditorUserId="775" LastEditDate="2013-10-23T10:49:21.077" LastActivityDate="2013-10-23T10:49:21.077" Title="New house, found 4 terminals with one twisted pair connected to each?" Tags="|ethernet|" AnswerCount="1" CommentCount="6" ClosedDate="2013-10-23T10:58:23.680" ContentLicense="CC BY-SA 3.0" />
  <row Id="3683" PostTypeId="1" AcceptedAnswerId="3690" CreationDate="2013-10-23T05:58:55.190" Score="2" ViewCount="1470" Body="&lt;p&gt;Does anyone know how to us dhcpd option 121 correctly with the Cisco ASA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to provide a static route to hosts&lt;/p&gt;&#xA;&#xA;&lt;p&gt;example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Destination Network   Destination Mask  Via IP&#xA;192.168.168.0         255.255.255.0     192.168.201.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried doing the hex calculator, but I do not this either of these are right&lt;/p&gt;&#xA;&#xA;&lt;p&gt;24c0a8a800c0a8a801&#xA;ffffff00c0a8a800c0a8c9fe&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="1352" LastActivityDate="2013-11-22T14:18:50.637" Title="How do I use dhcpd option 121 with a Cisco ASA" Tags="|cisco-asa|dhcp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3684" PostTypeId="2" ParentId="3682" CreationDate="2013-10-23T05:59:32.090" Score="1" Body="&lt;p&gt;They're attached to the blue pair, which is the center pins. So that would be &quot;phone&quot; (or DSL), but why it's RJ45 (4 pair) instead of RJ11/12 (single pair) is unknown.  My only advice would be to trace out where they go / what's attached (assuming there is anything still there.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note: I've seen some truly odd setups around PBX's. But there's no reason to have a PBX in most houses.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-10-23T05:59:32.090" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3685" PostTypeId="2" ParentId="3632" CreationDate="2013-10-23T08:20:34.030" Score="3" Body="&lt;p&gt;This is the record of the testing done on the AP using the LANforge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside the anechoic chamber, the LANforge (eth1) is connected to the AP under test via a LAN cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set up 4 virtual stations in the LANforge, with the same SSID as the AP. This results in a loop that allows the LANforge to measure the throughputs of the various streams. The stations are named:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STA-1-BK (background)&#xA;STA-2-BE (best effort)&#xA;STA-3-VI (video)&#xA;STA-4-VO (voice)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configure 1 uplink stream per station. Each stream is set as 10 Mbps UDP. Notice that the streams are in an increasing order of priority.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tests are conducted when WMM is disabled, and the same tests are conducted when WMM is enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The test procedure is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STA-1 starts transmitting.&#xA;Then STA-i starts transmitting at time (i-1)*30 s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that the video and voice streams are not able to achieve the desired 10 Mbps, when WMM is disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, WMM is enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When WMM is enabled, the QoS priority of the data streams are taken into account. When the video or voice streams are turned on, they maintain the constant desired throughput, while the background and best effort streams are starved of throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, when WMM is enabled, only the background and best effort streams shows large latency. The video and voice streams have very little latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, it can be seen that the WMM feature is working in AP under test.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference:&#xA;Wi-Fi Multimedia (WMM)&#xA;www.uniroma2.it/didattica/TPI2/deposito/wmm.pdf&lt;/p&gt;&#xA;" OwnerUserId="2974" LastEditorUserId="2974" LastEditDate="2013-10-23T08:27:10.137" LastActivityDate="2013-10-23T08:27:10.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3688" PostTypeId="1" AcceptedAnswerId="3689" CreationDate="2013-10-23T11:49:34.310" Score="5" ViewCount="4278" Body="&lt;p&gt;This question involves network latency as opposed to bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a small remote office with a single Cisco 881W Integrated Services Router (Ethernet WAN). The WAN modem is an AdTran NetVanta 8341. The WAN service is a 5Mb symmetrical /27 &quot;Virtual Ethernet&quot; on dedicated copper configured over 4-wire g.shdsl.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I connect to the home server about 200 mile away via Cisco VPN client version 5.0.07.0290 running on Windows 7 x64 clients. When I physically connect a client to the LAN side Ethernet of the router, I can ping my home server with a consistent return time of 27ms. That's pretty good. However, when the same client is on the 881W WiFi access point, the ping return time 135ms average, and varies widely, from about 80ms to about 250ms. Is this &quot;normal&quot;? If not, how should I troubleshoot this issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The extra latency has a pretty extreme effect on some applications, most notably X.11 forwarding apps running on remote workstations.&lt;/p&gt;&#xA;" OwnerUserId="1942" LastEditorUserId="4795" LastEditDate="2017-01-25T19:35:45.687" LastActivityDate="2017-01-25T19:35:45.687" Title="Network Latency issues with Cisco AP" Tags="|cisco|wireless|latency|cisco-isr|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3689" PostTypeId="2" ParentId="3688" CreationDate="2013-10-23T13:41:16.893" Score="4" Body="&lt;p&gt;First of all you need to consider that the air is a shared media. In contrast to the switched wires where collisions are rare, in the air they are quite frequent and as a result retransmissions are part of the game. A lot of clients may compete on who will send a frame first to the access point and the losers have to retransmit. It gets worse when signal from one client is stronger than others and covers them, so that the access point cannot &quot;hear&quot; them. Finally neighbor wirelesses can also affect you if you are operating in nearby channels or you use turbo, super etc modes that utilize a wider band and are more easily affected by interferences. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest that you scan the area for other wifi signals. Try to use a less congested channel. &#xA;Avoid the wide bandwidth modes, even the 11g is utilizing a wide range of frequencies to achieve the 54Mbps.&#xA;If you have a lot of local wireless clients consider expanding the access points to share the load. &#xA;And just to be safe, make sure no other client is not utilizing any heavy downloading software, like torrents.&lt;/p&gt;&#xA;" OwnerUserId="2294" LastActivityDate="2013-10-23T13:41:16.893" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3690" PostTypeId="2" ParentId="3683" CreationDate="2013-10-23T13:53:58.753" Score="2" Body="&lt;p&gt;Cisco ASA dhcp server supports the options listed in rfc 2132 &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2132.txt&quot; rel=&quot;nofollow&quot;&gt;https://www.rfc-editor.org/rfc/rfc2132.txt&lt;/a&gt;&#xA;So you have only option 33, but it is only working with hosts and not subnets. &lt;/p&gt;&#xA;" OwnerUserId="2294" LastActivityDate="2013-10-23T13:53:58.753" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3695" PostTypeId="1" AcceptedAnswerId="3706" CreationDate="2013-10-23T14:57:32.473" Score="4" ViewCount="2943" Body="&lt;p&gt;I trying to establish if there is a function within IOS somewhere that can provide the same results of MTR , i know it can be run from Juniper devices / *Nix &amp;amp; Windows devices.&lt;/p&gt;&#xA;&lt;p&gt;Goal is to troubleshoot intermittent voice packet loss , potentially due to latency somewhere in the network.&lt;/p&gt;&#xA;&lt;p&gt;MTR summary: probes routers on the route path by limiting the number of hops individual packets may traverse, and listening to responses of their expiry. It will regularly repeat this process, usually once per second, and keep track of the response times of the hops along the path.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Mb56J.png&quot; alt=&quot;MTR example from a unix host&quot; /&gt;&lt;/p&gt;&#xA;&#xA;" OwnerUserId="1092" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-04-18T19:32:05.987" Title="Cisco - MtR alternatives" Tags="|latency|cisco-ios|mtr|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3697" PostTypeId="1" AcceptedAnswerId="3873" CreationDate="2013-10-23T15:57:09.410" Score="262" ViewCount="495506" Body="&lt;p&gt;What does &lt;code&gt;/16&lt;/code&gt; mean in &lt;code&gt;192.168.0.0/16&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="3021" LastEditorUserId="85981" LastEditDate="2023-05-26T19:04:08.820" LastActivityDate="2023-05-27T12:20:28.130" Title="The slash after an IP Address - CIDR Notation" Tags="|ipv4|subnet|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="3698" PostTypeId="2" ParentId="3697" CreationDate="2013-10-23T16:08:13.233" Score="34" Body="&lt;p&gt;The slash following the IP address is the abbreviation for the subnet mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The binary version of a subnet mask is going to be comprised of ones and zeros just as the binary verison of an IP address would be, however, the ones in a subnet mask are all consecutive.  The amount of ones in the subnet mask is equal to the number of the abbreviation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the /16 subnet mask you asked about would have 16 ones in a row, the rest of the numbers being zeros.  11111111.11111111.00000000.00000000.  When converted from the base 2 number system of binary into the base 10 number system of the decimal version of the IP address, it therefore equals 255.255.0.0.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A /9 subnet mask would be 11111111.10000000.00000000.00000000, or 255.128.0.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A /30 subnet mask would be 11111111.11111111.11111111.11111100, or 255.255.255.252 which is great for creating a network that only accounts for 2 routers or layer 3 switches because there are only 4 total IP addresses and only 2 of those are usable host IP addresses.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot can be done with subnetting, but subnetting is a whole new monster to tackle if you are just getting started.&lt;/p&gt;&#xA;" OwnerUserId="2670" LastEditorUserId="2670" LastEditDate="2013-10-24T12:16:45.830" LastActivityDate="2013-10-24T12:16:45.830" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3700" PostTypeId="2" ParentId="3697" CreationDate="2013-10-23T18:18:05.743" Score="206" Body="&lt;p&gt;The slash and the number following it is just a shorthand way to write a subnet mask. It's called CIDR (Classless Inter-Domain Routing) notation. It's also commonly referred to as the &lt;em&gt;prefix length&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The number after the slash represents the number of consecutive 1's in the subnet mask. For example, &lt;code&gt;192.168.10.0/24&lt;/code&gt; is equal to the network &lt;code&gt;192.168.10.0&lt;/code&gt; with a &lt;code&gt;255.255.255.0&lt;/code&gt; subnet mask. If you convert &lt;code&gt;255.255.255.0&lt;/code&gt; to binary, you end up with 24 consecutive &lt;code&gt;1&lt;/code&gt;'s:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;11111111.11111111.11111111.00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Another example could be &lt;code&gt;10.0.0.0/8&lt;/code&gt;. 8 consecutive &lt;code&gt;1&lt;/code&gt;'s in the subnet mask gives you &lt;code&gt;11111111.00000000.00000000.00000000&lt;/code&gt; or &lt;code&gt;255.0.0.0&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;For more information, see &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4632#section-3.1&quot; rel=&quot;noreferrer&quot;&gt;RFC 4632, Section 3.1&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2016-01-11T16:45:06.867" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3702" PostTypeId="5" CreationDate="2013-10-23T19:26:55.200" Score="0" Body="&lt;p&gt;MTR (My traceroute, originally called Matt's traceroute) is a computer program which combines the functionality of the traceroute and ping programs in a single network diagnostic tool.&lt;a href=&quot;http://en.wikipedia.org/wiki/MTR_%28software%29&quot; rel=&quot;nofollow&quot;&gt;1&lt;/a&gt;&#xA;MTR probes routers on the route path by limiting the number of hops individual packets may traverse, and listening to responses of their expiry. It will regularly repeat this process, usually once per second, and keep track of the response times of the hops along the path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/MTR_%28software%29&quot; rel=&quot;nofollow&quot;&gt;Full wiki article here &lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="1092" LastEditDate="2013-10-23T21:09:11.793" LastActivityDate="2013-10-23T21:09:11.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3703" PostTypeId="4" CreationDate="2013-10-23T19:26:55.200" Score="0" Body="mtr is a computer program which combines the functionality of the traceroute and ping programs in a single network diagnostic tool.  Use this tag for questions about mtr, or which depend heavily on mtr" OwnerUserId="1092" LastEditorUserId="775" LastEditDate="2013-10-23T20:38:45.350" LastActivityDate="2013-10-23T20:38:45.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3704" PostTypeId="1" CreationDate="2013-10-23T20:44:25.847" Score="3" ViewCount="1157" Body="&lt;p&gt;I have a 24 port Cisco 3560G switch that I'm using to try and pass broadcasted Ethernet packets. I have a computer plugged into one port, and a IEC-61850 GOOSE publisher plugged into another port. Both devices have an IP address assigned, and I can ping each from the other. However, when I run tcpdump on the computer I'm not seeing the broadcasted GOOSE messages from the publisher device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I directly connect the two machines, I can see the GOOSE messages with tcpdump. I can also replace the Cisco switch with a simple NetGear 4-port switch and still see the GOOSE packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to use the Cisco switch such that I can leverage VLANs to eventually get the GOOSE packets to machines connected to other switches, but first I need to get this simple test case working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="3028" LastActivityDate="2013-10-23T21:20:04.273" Title="Any ideas why Cisco 3560G switch isn't passing broadcasted Ethernet packets?" Tags="|cisco|ethernet|multicast|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="3705" PostTypeId="2" ParentId="3704" CreationDate="2013-10-23T21:20:04.273" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;GOOSE uses VLAN and priority tagging as per IEEE 802.1Q to have separate virtual network within the same physical network and sets appropriate message priority level. -- &lt;a href=&quot;http://en.wikipedia.org/wiki/GOOSE#Generic_Object_Oriented_Substation_Events_.28GOOSE.29&quot;&gt;wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That would suggest this traffic is actually within a VLAN. So even if it is broadcast (or multicast), it's only going to go where that VLAN goes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tcpdump&lt;/code&gt; has a rather annoying feature of not showing vlan tags unless you get rather verbose with it. Use wireshark (or &lt;code&gt;tshark&lt;/code&gt;) and look at the complete contents (every. single. bit.) in each frame. Also note, many modern NICs process the vlan tag internally, so the OS doesn't normally see them -- the interface must be in promiscuous mode to turn that off. (and some drivers &lt;em&gt;continue&lt;/em&gt; to eat them even then.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-10-23T21:20:04.273" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3706" PostTypeId="2" ParentId="3695" CreationDate="2013-10-23T21:28:18.583" Score="7" Body="&lt;p&gt;One option would be to use IP SLA set up to send udp packets of the appropriate size / codec / etc.  This can provide you back tons of information on the quality of your network, MOS score, etc.  This is a reasonable article describing one way of setting up IP SLA feature that is relevant to voice diagnostics:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.networkworld.com/community/node/30924&quot;&gt;http://www.networkworld.com/community/node/30924&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A second alternative would be to leverage Cisco Medianet capabilities built in to a number of routers, switches, etc.  Medianet provides a ton of diagnostic information including the ability to run simulations and introduce load directly from your network devices to diagnose real-time communications problems (voice, video, etc).  It also offers the capability you're describing to do hop-by-hop mapping to quickly determine where in a path loss is occurring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start here to begin learning about Medianet:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/web/solutions/medianet/knowledgebase/index.html&quot;&gt;http://www.cisco.com/web/solutions/medianet/knowledgebase/index.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1104" LastActivityDate="2013-10-23T21:28:18.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3707" PostTypeId="2" ParentId="3695" CreationDate="2013-10-23T22:03:06.227" Score="-2" Body="&lt;p&gt;Have you tried &quot;traceroute&quot; command on Cisco IOS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_tech_note09186a00800a6057.shtml#traceroute&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_tech_note09186a00800a6057.shtml#traceroute&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2942" LastActivityDate="2013-10-23T22:03:06.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3709" PostTypeId="1" CreationDate="2013-10-23T22:40:37.583" Score="18" ViewCount="30022" Body="&lt;p&gt;after years away from JunOS, working with Foundry (now Brocade) routers, I find myself with a new Juniper MX10.  All I want to do is create a simple VLAN such that two ports share one routing interface, which has one IP address.  On a Brocade, this is quite simple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 200 name layer3&#xA; untagged ethe 1/3 to 1/4 &#xA; router-interface ve 200&#xA;interface ve 200&#xA; ip address 192.168.1.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On JunOS, I've been googling and reading documentation for days.  There are very intricate VLAN options, but, I haven't found anything that drills down to the simple stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help; I'd rather not start any routing loops.&lt;/p&gt;&#xA;" OwnerUserId="3032" LastEditorUserId="59" LastEditDate="2013-10-24T15:15:05.157" LastActivityDate="2021-12-02T01:23:55.090" Title="Adding a simple VLAN on a Juniper MX" Tags="|vlan|juniper|brocade|juniper-junos|juniper-mx|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3711" PostTypeId="2" ParentId="3688" CreationDate="2013-10-24T00:47:19.003" Score="4" Body="&lt;p&gt;This could be entirely normal depending on the environment (number of users, amount of traffic, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However there are definitely issues that can create this problem as well.  To start with I would ensure that you have a newer image on the wireless device.  Haven't worked on the 880 ISR's myself, but I believe the AP runs a separate image then the router itself (someone with experience, please correct me if I am wrong).  You should find details on the Cisco web site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, I would make sure that the wireless drivers are upgraded on the client devices as older drivers can be a source of significant performance problems.  In Windows, this is unfortunately not always a simple process.  With some wireless manufacturers, there are updates through Windows update, some provide driver updates on their website and some you may need to get the drivers from the chipset manufacturers website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, try to make sure you are on an uncongested channel.  You will want to use channels 1, 6 or 11 (or 1, 7 and 13 if you are in a country that allows the use of channel 13).  If you don't have the tools to measure channel utilization, you may have to experiment for the best channel (the AP should be able to provide you with channel utilization on it's current channel).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple tool, such as &lt;a href=&quot;http://www.metageek.net/products/inssider/&quot; rel=&quot;nofollow&quot;&gt;inSSIDer&lt;/a&gt; will give you an idea of how many other networks will be overlapping with your current channel, however this isn't a complete picture as it doesn't indicate if any of those networks are busy (i.e. causing high channel utilization).  Being on a channel with a very busy network will generally be worse than being on a channel with multiple non-busy networks, but often this will get you headed in the right direction.  Also keep in mind that even with the right tools, you are only getting a picture of &quot;this moment&quot; and &quot;this specific location&quot; view of things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond that, there are many things you can still do to improve performance, but I don't want to turn this into a novel.  For instance, you can look at dropping lower data rates (1, 2, 5.5 to start), disabling 802.11b, turning off protection mechanisms (or turning them on depending on the situation), reducing the number of SSIDs (if you have more than one), using QoS, and many more wireless tweaks.  Many of these are dependent on your environment and needs though, and there is nowhere near enough information in the question to know which may be best.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-10-24T00:47:19.003" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3715" PostTypeId="2" ParentId="3709" CreationDate="2013-10-24T06:34:30.337" Score="6" Body="&lt;p&gt;have you read this? &lt;a href=&quot;http://forums.juniper.net/t5/Junos-and-Junosphere/How-to-setup-trunk-and-access-ports-in-an-MX80/td-p/53902&quot;&gt;How to setup trunk and access ports in an MX80? - J-Net Community&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It explains quickly how to set a bridge domain for your L3 interface, and add ports as either access or trunk. &lt;code&gt;irb.200&lt;/code&gt; would be your &lt;code&gt;ve 200&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="7" LastActivityDate="2013-10-24T06:34:30.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3716" PostTypeId="2" ParentId="3688" CreationDate="2013-10-24T08:28:50.313" Score="4" Body="&lt;p&gt;These kind of latencies are typically related to power management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens is that your client wifi card sleeps all the time and only wakes up typically every 204,8 ms (DTIM interval × Beacon interval).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While the station's wifi card sleeps, the AP keeps the frames that it should send to the station.  Every 2 beacon, (typical value for DTIM interval), the AP includes TIM bits in its beacons that indicates if it has pending frames, and if it has, for which stations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Power saving STAs typically wakes up only to receive this DTIM beacon, and go back to sleep if there is no frame for them, else they stay awake to request the pending frames, then get back to sleep again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typical test for this is to request the client to sends frames regularly (e.g. 50ms), since Wi-Fi drivers typically wakes up the wifi card immediately when there are pending frames to be sent.  If ping times goes down, then power management is responsible for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Easiest solution is to disable Wi-Fi power management on the station.  Many OS enables it by default, even for desktops computers and laptops connected to AC power.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2013-10-24T08:28:50.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3717" PostTypeId="2" ParentId="3677" CreationDate="2013-10-24T12:28:56.233" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is considered too hot?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The environmental specs (including operating temperature) are listed on the &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/vpndevc/ps6032/ps6094/ps6120/ps6823/product_data_sheet0900aecd80402e4f_ps6120_Products_Data_Sheet.html&quot; rel=&quot;nofollow&quot;&gt;data sheet for the module&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, it appears that the operating temperature range is 32 to 104ºF (0º to 40ºC).&lt;/p&gt;&#xA;" OwnerUserId="3037" LastEditorUserId="775" LastEditDate="2013-10-24T12:31:55.573" LastActivityDate="2013-10-24T12:31:55.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3718" PostTypeId="2" ParentId="3709" CreationDate="2013-10-24T14:46:55.410" Score="27" Body="&lt;p&gt;The MX platform does not have the general concept of a &quot;VLAN&quot; that is present on the whole platform. The MX only &quot;sees&quot; VLAN tags on incoming packets and can then act on these tags. What you want is to bridge packets from two ports that have the same VLAN-ID in the L2 header and then add a L3 interface to that bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the MX platform you have two ways of configuring bridges. &lt;em&gt;Service Provider Style&lt;/em&gt; and &lt;em&gt;Enterprise Style&lt;/em&gt;. As I'm more familiar with the SP style I'll answer your question that way:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Juniper MX SP Style Bridging&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First you configure your interfaces to accept packets with the right VLAN tags:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    ge-0/0/0 {&#xA;        vlan-tagging;&#xA;        encapsulation extended-vlan-bridge;&#xA;        unit 200 {&#xA;            vlan-id 200;&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        vlan-tagging;&#xA;        encapsulation extended-vlan-bridge;&#xA;        unit 200 {&#xA;            vlan-id 200;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then configure a bridge domain that bridges these two:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bridge-domains {&#xA;    vlan-200 {&#xA;        vlan-id 200;&#xA;        interface ge-0/0/0.200;&#xA;        interface ge-0/0/1.200;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you have a bridged VLAN 200 on these two ports.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Untagged / Access Interfaces&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If you have an untagged &quot;access&quot; port that you want to bridge, you can do that too by using this syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    ge-0/0/0 {&#xA;        encapsulation ethernet-bridge;&#xA;        unit 0 {&#xA;            family bridge;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then use &lt;code&gt;ge-0/0/0.0&lt;/code&gt; in your bridge configuration.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;L3 Interface / Routing Interface&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;To add a L3 interface to the mix, first define an &lt;em&gt;Integrated Routing and Bridging&lt;/em&gt; Interface (IRB) with your IP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;irb {&#xA;    unit 200 {&#xA;        family inet {&#xA;            address 192.168.1.1/24;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then add this interface to your bridge:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bridge-domains {&#xA;    vlan-200 {&#xA;        vlan-id 200;&#xA;        routing-interface irb.200;&#xA;        interface ge-0/0/0.200;&#xA;        interface ge-0/0/1.200;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That should complete your setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a bit more complex than the &quot;normal&quot; VLAN concept found on other switches/devices but it's also way more flexible. For example you could have another two ports that also have VLAN-ID 200 configured and they could have their own bridge, completely separated from the first bridge you just configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a lot more information about the MX platform, including great examples, I recommend the MX Series book from O'Reilly/Douglas Hanks: &lt;a href=&quot;http://shop.oreilly.com/product/0636920023760.do&quot;&gt;http://shop.oreilly.com/product/0636920023760.do&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2013-10-24T15:09:32.303" LastActivityDate="2013-10-24T15:09:32.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3721" PostTypeId="2" ParentId="2659" CreationDate="2013-10-24T18:24:27.597" Score="2" Body="&lt;p&gt;Your are correct about 802.11r and it's issues with lack of client-support. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming your deploying WPA2-Enterprise or similar (where session keys are established)...you should take a look at the following. It's great reading, especially since your inquiring about 'best practices' with very little detail on your deployment (ie target devices/applications...VoWiFi?):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11r/k: &#xA;&lt;a href=&quot;http://www.revolutionwifi.net/2013/05/apple-ios-fast-roaming-with-aerohive-wi.html&quot; rel=&quot;nofollow&quot;&gt;http://www.revolutionwifi.net/2013/05/apple-ios-fast-roaming-with-aerohive-wi.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CCKM/PCK-OKC and description of roaming techniques: &lt;a href=&quot;http://www.revolutionwifi.net/2012/02/wi-fi-roaming-analysis-part-2-roaming.html&quot; rel=&quot;nofollow&quot;&gt;http://www.revolutionwifi.net/2012/02/wi-fi-roaming-analysis-part-2-roaming.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follow the links at the bottom of the 2nd URL for Cisco recommendations, but again...will depend heavily on your target device/application.&lt;/p&gt;&#xA;" OwnerUserId="2723" LastActivityDate="2013-10-24T18:24:27.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3723" PostTypeId="1" CreationDate="2013-10-24T20:27:43.163" Score="3" ViewCount="5354" Body="&lt;p&gt;What are the consequences of having a subnet within a subnet? Eg. First network is 10.0.0.0/8 and the second is 10.0.1.0/24. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for everyone's replies. The original design, which is not my own, was to simply have two separate networks that have no need to communicate with each other. For some reason the tech that set it up did it this way. I realize that they are separate subnets and therefor unable to fully talk without routing. Just a little confusing that they were setup within each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main concern though is if this would degrade performance within the 10.0.0.0/8 network because of unreturned responses from the 10.0.1.0/24 network's devices. Any ideas or am I crazy?&lt;/p&gt;&#xA;" OwnerUserId="3042" LastEditorUserId="3042" LastEditDate="2013-10-25T14:53:21.853" LastActivityDate="2013-10-25T14:53:21.853" Title="Subnet within a subnet" Tags="|ipv4|subnet|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3724" PostTypeId="2" ParentId="3723" CreationDate="2013-10-24T20:38:11.247" Score="0" Body="&lt;p&gt;10.0.0.0/8 is a classfull network.&lt;br/&gt;&#xA;10.0.1.0/24 is a subnet of /8 classfull network.&lt;br/&gt;&#xA;After subbneting you're creating a range of address that are separated logical.&lt;br/&gt;&#xA;Host from /8 network will not be able to communicate with host from /24 subnet without router.&lt;/p&gt;&#xA;" OwnerUserId="2866" LastActivityDate="2013-10-24T20:38:11.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3725" PostTypeId="1" AcceptedAnswerId="3733" CreationDate="2013-10-24T21:20:51.987" Score="1" ViewCount="330" Body="&lt;p&gt;One of the reasons that we use SAN is to make it appear to the server as if it were local. What is the advantage of a SAN over a NAS storage that is mounted to a device?&lt;/p&gt;&#xA;" OwnerUserId="3043" LastEditorUserId="3043" LastEditDate="2013-10-24T21:34:20.547" LastActivityDate="2019-07-07T09:29:57.553" Title="Advantage of SAN over a NAS storage that is mounted to a device?" Tags="|san|" AnswerCount="3" CommentCount="1" ClosedDate="2019-07-07T22:24:36.627" ContentLicense="CC BY-SA 3.0" />
  <row Id="3727" PostTypeId="2" ParentId="3723" CreationDate="2013-10-24T22:40:44.523" Score="0" Body="&lt;p&gt;David, depending on your setup this might work and is a known way of directing traffic to the most-specific prefix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could announce the /8 and the /24 from two different interfaces and this would shove the traffic that wasn't in the /24 into one path and the /24 to another.&lt;/p&gt;&#xA;" OwnerUserId="7" LastActivityDate="2013-10-24T22:40:44.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3728" PostTypeId="2" ParentId="3723" CreationDate="2013-10-24T23:04:27.827" Score="0" Body="&lt;p&gt;Well, 10.0.0.0/8 and 10.0.1.0/24 overlap each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.0.0.0/8 does well if you're using it to refer to other networks you have within that range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if you have addresses in 10.0.0.0/8 that spill over in 10.0.1.0/24 range then they can't communicate. &lt;/p&gt;&#xA;" OwnerUserId="301" LastActivityDate="2013-10-24T23:04:27.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3730" PostTypeId="1" AcceptedAnswerId="3736" CreationDate="2013-10-25T02:08:45.333" Score="1" ViewCount="579" Body="&lt;p&gt;I would like to test the dynamic channel selection (DCS) feature of an access point AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I test it using Candela Technologies LANforge-WiFIRE WiFi traffic generator?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would the following steps be appropriate?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Place the LANforge next to the AP under test, and setup a virtual AP.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set the AP under test to use Auto for the channel selection.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Switch the channel of the virtual AP to whatever channel the tested AP has selected.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The AP under test should switch to another channel with less interference.&lt;/p&gt;&#xA;" OwnerUserId="2974" LastActivityDate="2013-10-25T10:20:46.770" Title="How to test dynamic channel selection (DCS) with LANforge?" Tags="|wireless|testing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3731" PostTypeId="2" ParentId="3723" CreationDate="2013-10-25T03:42:14.717" Score="2" Body="&lt;p&gt;The hosts in 10.0.1.0/24 will not be able to communicate with any other hosts in any other subnets of 10.0.0.0/8 without a default-gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hosts in 10.0.0.0/8 will be able to communicate with all hosts in 10.0.0.0/8, which includes 10.0.1.0/24, but only one-way if the hosts in 10.0.1.0/24 do not have a default-gateway with access to both subnets.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-10-25T03:42:14.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3733" PostTypeId="2" ParentId="3725" CreationDate="2013-10-25T05:34:47.053" Score="2" Body="&lt;p&gt;A SAN appears as a raw block device and can do the things that a block device can but a filesystem can't. Two very common cases include data storage where an application is using the block device directly (as some databases can), or to serve as a boot volume for a diskless server (some servers and blade systems can speak iSCSI from firmware well enough to treat a SAN device as if it were locally attached long enough for the OS to get up and running).&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-10-25T05:34:47.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3734" PostTypeId="2" ParentId="3398" CreationDate="2013-10-25T05:59:22.857" Score="2" Body="&lt;p&gt;Not really sure if this counts as a &quot;method&quot; but as pointed out, AP's are L2, so looking at the CAM table &quot;show mac-address table&quot; for interfaces with multiple macs is usually a giveaway that either an AP, soho-switch/hub etc. is connected to that port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also set up dedicated AP's for RLDP. WCS also has a 'switch-port tracer' for Rogues (not sure if this was ported to Cisco Prime Infrastructure); but both the latter methods require a lightweight infrastructure (ie WLC's).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that even if you &quot;contain&quot; rogues with deauth frames, or simply 'shut' the port they are connected to, this does not address possibly the biggest issue (other than 'security') of rogue AP's...the RF. Policy, the staff to 'locate' them and the 'tools' is really the best method. The best tool I've found for 'locating' them, once on-site is Fluke AirCheck w/ directional antenna.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sample RF policy: &lt;a href=&quot;https://www.cisco.com/en/US/prod/collateral/wireless/ps9391/ps9393/prod_white_paper0900aecd8073bef9.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.cisco.com/en/US/prod/collateral/wireless/ps9391/ps9393/prod_white_paper0900aecd8073bef9.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're probably already aware of this RLDP info: &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a0080722d8c.shtml&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a0080722d8c.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2723" LastActivityDate="2013-10-25T05:59:22.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3735" PostTypeId="2" ParentId="3657" CreationDate="2013-10-25T10:06:07.967" Score="0" Body="&lt;p&gt;If some of the pins do not pass cable certification, that could cause PoE issues. Depending on the strand that is at fault, it is feasible that data passes just fine while PoE does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wiki article table showing pins used for PoE: &lt;a href=&quot;http://en.wikipedia.org/wiki/Power_over_Ethernet#Power_capacity_limits&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Power_over_Ethernet#Power_capacity_limits&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2723" LastEditorUserId="2723" LastEditDate="2013-10-26T03:25:34.113" LastActivityDate="2013-10-26T03:25:34.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3736" PostTypeId="2" ParentId="3730" CreationDate="2013-10-25T10:20:46.770" Score="1" Body="&lt;p&gt;Your order seems ok, but keep in mind there is more to the Radio Resource Managment (RRM) algorithm than just 'neighbors on same channel'. More specifically, if it is determined that other channels in the area are 'busier' or 'noisier' RF-wise, it may be decided to remain on that same channel as your tester.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming a clean RF environment however, I don't see anything wrong with that test.&lt;/p&gt;&#xA;" OwnerUserId="2723" LastActivityDate="2013-10-25T10:20:46.770" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3739" PostTypeId="5" CreationDate="2013-10-25T11:42:21.723" Score="0" Body="&lt;p&gt;Use this tag for questions about network protocols published in a Standard or RFC.  Do not use this tag merely because the question mentions a networking protocol in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This tag is suitable for questions about protocols similar to these:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Transport protocols: &lt;a href=&quot;http://en.wikipedia.org/wiki/802.3&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Ethernet&quot;&gt;IEEE 802.3 Ethernet&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/802.11&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Wifi&quot;&gt;IEEE 802.11 Wireless Ethernet&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/SONET&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;SONET&quot;&gt;SONET / SDH&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Asynchronous_Transfer_Mode&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Asynchronous Transfer Mode (ATM)&quot;&gt;ATM&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Link-layer protocols: &lt;a href=&quot;http://en.wikipedia.org/wiki/Point-to-point_protocol&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Point to Point Protocol (PPP)&quot;&gt;PPP&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/HDLC&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;HDLC&quot;&gt;HDLC&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Frame_relay&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Frame Relay&quot;&gt;Frame Relay&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/PPPoE&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;PPPoE&quot;&gt;PPPoE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Network Protocols: &lt;a href=&quot;http://en.wikipedia.org/wiki/Ipv4&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;IPv4&quot;&gt;IPv4&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Ipv6&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;IPv6&quot;&gt;IPv6&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/CLNS&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;CLNP&quot;&gt;CLNP&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Routing Protocols: &lt;a href=&quot;http://en.wikipedia.org/wiki/Ospf&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;OSPF&quot;&gt;OSPF&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/RIP&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;RIP or RIPv2&quot;&gt;RIP&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Bgp&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Border Gateway Protocol&quot;&gt;BGP&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Questions with this tag &lt;em&gt;could&lt;/em&gt; be closed if they do not explain why the question is relevant and important to answer; this is necessary to avoid issues with tangential / trivial questions or help vampires.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorDisplayName="user36472" LastEditDate="2018-01-29T15:38:58.073" LastActivityDate="2018-01-29T15:38:58.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3740" PostTypeId="4" CreationDate="2013-10-25T11:42:21.723" Score="0" Body="For questions about network protocols published in a Standard or RFC.  Do not use this tag merely because the question mentions a networking protocol in it.  Questions with this tag *could* be closed if they do not explain why the question is relevant and important to answer; this is necessary to avoid issues with tangential / trivial questions or help vampires." OwnerUserId="775" LastEditorUserId="40371" LastEditDate="2018-11-01T14:30:49.840" LastActivityDate="2018-11-01T14:30:49.840" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="3741" PostTypeId="1" CreationDate="2013-10-25T12:09:42.597" Score="3" ViewCount="2202" Body="&lt;p&gt;I have been wondering for a while about this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco switches you can configure a VLAN and nest private community and private isolated VLANs into it. You can also configure promiscuous ports that can be accessed by any member of the child VLANs. I know members of one community VLAN can communicate to each other without a need for a gateway and they can't with a different community VLAN. Also there's isolated VLAN members of which can only communicate with promiscuous ports. My question is, how does it work if I want to still reach another host from the same isolated VLAN I am in? Does the router still get you there? (So that's the question number one)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if so, what about VACLs then? If I understand correctly, they prohibit getting out of VLAN and getting back or do they just restrict sitting in a VLAN with incorrect prefix/mask? (Question number two)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/pCShi.jpg&quot; alt=&quot;Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I wanted to ask how for example I can get &lt;code&gt;from host .24 to host .25&lt;/code&gt; or &lt;code&gt;from host .66 to host .24&lt;/code&gt; (Between AUX VLANs)? I am confused about the routing happening. I know you cannot access them via layer 2. So how do these PCs get there? Do they still use the router? How does the router handle this? I mean, it's the same subnet, but that's different aux. VLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry if that sounds confusing at all.&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="2093" LastEditDate="2013-11-25T10:55:01.777" LastActivityDate="2013-11-25T10:55:01.777" Title="Isolated VLAN members on a private VLAN (Cisco)" Tags="|cisco|vlan|private-vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3742" PostTypeId="2" ParentId="3723" CreationDate="2013-10-25T13:23:01.680" Score="2" Body="&lt;p&gt;The short answer is that the two subnets will not be able to communicate.  The 10.0.0.0/8 subnet will believe that the 10.0.1.0/24 subnet is local.  Thus, traffic from 10.0.0.0/8 to 10.0.1.0/24 will never be routed (it will stay local).  Traffic from 10.0.1.0/24 to 10.0.0.0/8 will be routed to the default gateway.  This traffic will make to the desired host in the 10.0.0.0/8 subnet; however, return traffic (required for TCP) will not be returned.  In theory, UDP from 10.0.1.0/24 to 10.0.0.0/8 will be successful.  However, if there is any requirement at the application level for acknowledgements (TFTP, etc.), the application will fail.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2013-10-25T13:23:01.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3747" PostTypeId="1" CreationDate="2013-10-26T08:46:47.720" Score="1" ViewCount="958" Body="&lt;p&gt;Connecting on VPN to office, disconnects the communication with my local VMware PC, set with Network connection as Host - only ( A private network shared with host) .&#xA;Should be a case of address colition due to non global ip address assignment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use Cisco anyconnect security mobility client. Please help to understand the issue, and alternatives.&lt;/p&gt;&#xA;" OwnerUserId="3056" LastActivityDate="2013-10-27T10:05:33.673" Title="Connecting on VPN, disconnects the communication with local Host-only VMware" Tags="|vpn|vmware|" AnswerCount="1" CommentCount="2" ClosedDate="2018-03-18T23:40:55.113" ContentLicense="CC BY-SA 3.0" />
  <row Id="3751" PostTypeId="2" ParentId="3614" CreationDate="2013-10-26T17:42:15.420" Score="6" Body="&lt;p&gt;The bug-id you are hitting is probably &lt;a href=&quot;http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&amp;amp;bugId=CSCuf56076&quot;&gt;CSCuf56076&lt;/a&gt;, which is fixed in 6.0(2)N2(1). Unfortunately this is the best solution for this problem. Luckily it doesn't impact the traffic on the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For debugging you can see which part of the config is in the global database:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show system internal csm info global-db seq-tbl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and which part is in the synced database:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show system internal csm info switch-profile &amp;lt;switch-profile-name&amp;gt; cfgd-db seq-tbl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the &lt;code&gt;sync-peer&lt;/code&gt; are removed you should make sure that both switches have the same config, and that the same parts of the config are in the switch-profile. Then re-add the &lt;code&gt;sync-peer&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be aware that, depending on what exactly goes wrong, this bug might re-appear after every reload of the switch. When we hit this bug we first performed the fix in the middle of the night to make sure there was no downtime. After getting more confident that traffic was not impacted we dared to fix these problems at slightly more convenient hours of the day (but still early in the morning) until Cisco released a version that fixed this.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2013-10-26T17:42:15.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3753" PostTypeId="1" CreationDate="2013-10-26T20:04:59.267" Score="3" ViewCount="3478" Body="&lt;p&gt;I have a scenario of six switches (C2960S, Version 12.2) running out of PVST instances so a transition to MST is inevitable. Seeing how small scale the setup is, I assume I could shut a few links to ensure there are no loops, turn off spanning-tree and then configure MST.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once done I should be able 'no shut' the shutted links. Am I right in it being this straight forward, or are there any caveats with my approach?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7nRzm.png&quot; alt=&quot;switch topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE 1:&#xA;I did convert the root bridge, after shutting enough links to not have a ring/loop, to mst using the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#spanning-tree mst configuration&#xA;#name data&#xA;#revision 10&#xA;#instance 1 vlan 1-1024&#xA;#spanning-tree mode mst&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this I lost connection between the root bridge and a neighbor switch. The state of the port was BKN. I proceeded to check all trunks native vlans, but couldn't find a mismatch. I quickly reverted and here I am, with not much more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATED QUESTION 1:&#xA;Given the simple topology, if I disable enough links to prevent the ring and thus loops, could I not disable stp altogether and then set up mst on a switch at a time?&lt;/p&gt;&#xA;" OwnerUserId="3007" LastEditorUserId="3007" LastEditDate="2014-01-04T11:51:40.087" LastActivityDate="2014-01-04T11:51:40.087" Title="Easy PVST to MST transition" Tags="|spanning-tree|cisco-ios|ieee-802.1s|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3754" PostTypeId="1" AcceptedAnswerId="3757" CreationDate="2013-10-26T20:21:22.577" Score="11" ViewCount="4732" Body="&lt;p&gt;I have very simple question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If device which uses regular WiFi (2.4 GHz) connection (i.e. USB receiver for wireless mouse or mobile phone) is put into plexiglass case, would that lower connection quality?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've heard a lot of contradiction claims about it and I can't google anything that will confirm truth, so I hope someone can help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&lt;/p&gt;&#xA;" OwnerUserId="3060" LastActivityDate="2015-04-09T13:35:14.760" Title="Plexiglass and 2.4GHz wifi signal" Tags="|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3755" PostTypeId="1" AcceptedAnswerId="3756" CreationDate="2013-10-27T00:05:13.630" Score="1" ViewCount="3204" Body="&lt;p&gt;Why is ipv6 hex? Is it still okay to express it in denary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sure xxx.xxx.xxx.xxx.xxx is easier to remember than AAAA AAAA AAAA AAAA AAAA AAAA ?&lt;/p&gt;&#xA;" OwnerUserId="3061" LastEditorUserId="509" LastEditDate="2013-10-27T11:29:05.750" LastActivityDate="2013-10-27T11:29:05.750" Title="Why is IPv6 expressed in hexadecimal format?" Tags="|ipv6|internet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3756" PostTypeId="2" ParentId="3755" CreationDate="2013-10-27T00:29:55.183" Score="8" Body="&lt;p&gt;The reason for switching to a hex-based representation is twofold: They're long enough that using a larger character base is helpful, and in networking in general, a power-of-two base makes calculations simpler for humans since subnet masks are bitmasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv4 addresses are about at the limit of what humans can remember without active memorization techniques, and there's perhaps some value to writing IPv4 addresses in base 10. IPv6 addresses are almost entirely impossible to remember, except occasionally as chunks of prefix+subnet+role-based address, and even in the latter, hex makes concatenating the chunks easier.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastActivityDate="2013-10-27T00:29:55.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3757" PostTypeId="2" ParentId="3754" CreationDate="2013-10-27T00:36:10.093" Score="18" Body="&lt;p&gt;Robert Wilson, a graduate student at USC, prepared &lt;a href=&quot;http://www.am1.us/Protected_Papers/E10589_Propagation_Losses_2_and_5GHz.pdf&quot; rel=&quot;noreferrer&quot;&gt;an analysis of 2.4GHz and 5GHz propagation through common materials&lt;/a&gt;, with a useful Table 3. It looks like Plexiglas incurs about a .36dB loss at 2.3GHz and about a .93dB loss at 5.25GHz, in addition to the slowdown caused by the slower speed inside the material.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably wouldn't notice any decline in connection quality through walls of a normal thickness, though for a mouse, there might be enough lag to interfere with gaming.&lt;/p&gt;&#xA;" OwnerUserId="2237" LastEditorUserId="3604" LastEditDate="2015-04-09T13:35:14.760" LastActivityDate="2015-04-09T13:35:14.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3758" PostTypeId="2" ParentId="3747" CreationDate="2013-10-27T10:05:33.673" Score="1" Body="&lt;p&gt;You're not giving us a lot of details like routing tables, but one thing I've seen quite often which may cause this is situations where all network traffic is routed via the VPN connection, isolating the machine from the local network.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-10-27T10:05:33.673" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3760" PostTypeId="1" CreationDate="2013-10-27T11:31:47.793" Score="2" ViewCount="575" Body="&lt;p&gt;Scenairo: SSG140 in HA configuration. Four interfaces:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;LAN (trust) eth0/0 172.20.0.0./24&lt;/li&gt;&#xA;&lt;li&gt;ISP1 (untrust) eth0/1 1.1.1.130/28 &lt;/li&gt;&#xA;&lt;li&gt;ISP2 (untrust) eth0/2 2.2.2.194/28&lt;/li&gt;&#xA;&lt;li&gt;ISP3 (untrust) eth0/3 3.3.3.130/28&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;ServerX with LAN IPs, and Mapped IPs (MIPs)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;172.20.10.100 -&gt; 1.1.1.135&lt;/li&gt;&#xA;&lt;li&gt;172.20.20.100 -&gt; 2.2.2.195&lt;/li&gt;&#xA;&lt;li&gt;172.20.30.100 -&gt; 3.3.3.135&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Default route 0.0.0.0/0 eth0/1 gw 1.1.1.129 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static destination routes for DNS servers of each ISP to use respective gateways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DNS-ISP1  1.7.8.9/32 eth0/1 gw 1.1.1.129 &lt;/li&gt;&#xA;&lt;li&gt;DNS-ISP2  2.5.6.4/32 eth0/1 gw 2.2.2.193 &lt;/li&gt;&#xA;&lt;li&gt;DNS-ISP3  3.1.2.3/32 eth0/1 gw 3.3.3.129 &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;One vrouter:  trust-vr.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is our challenge:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Outbound traffic bound to 172.20.10.100 will pickup MIP 1.1.1.135 &lt;/li&gt;&#xA;&lt;li&gt;Outbound traffic bound to 172.20.20.100 will pickup IP 1.1.1.130 &lt;/li&gt;&#xA;&lt;li&gt;Outbound traffic bound to 172.20.30.100 will pickup IP 1.1.1.130&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Required:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Outbound traffic bound to 172.20.10.100 will pickup MIP 1.1.1.135 &lt;/li&gt;&#xA;&lt;li&gt;Outbound traffic bound to 172.20.20.100 will pickup MIP 2.2.2.195 &lt;/li&gt;&#xA;&lt;li&gt;Outbound traffic bound to 172.20.30.100 will pickup MIP 3.3.3.135&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If we setup default routes on eth0/2 and eth0/3 then this has no effect as to the outbound traffic result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we setup connected routes on eth0/2 and eth0/3 then this overrides any destination routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we setup source based routing for the server based on its 172.20.0.0/24 addresses, then this affects tunnel traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we setup source based routing for the server based on its MIP'ed addresses, then this has no material effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should we be using policy based routing? Or are we missing a trick?&lt;/p&gt;&#xA;" OwnerUserId="3066" LastActivityDate="2013-10-27T11:31:47.793" Title="How to force route for MIP in screenos, multiple ISP untrust" Tags="|routing|nat|screenos|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3764" PostTypeId="2" ParentId="3741" CreationDate="2013-10-28T01:28:51.707" Score="2" Body="&lt;p&gt;When an isolated port transmits data, that data is mapped into an auxiliary VLAN.  Data in the auxiliary VLAN will be mapped to the primary VLAN -only- for transmission to promiscuous ports.  Promiscuous ports, in turn, transmit data into the primary VLAN.  All ports can receive information in the primary VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Putting an otherwise isolated port into a community VLAN means that traffic it transmits will be mapped into both the auxiliary and the community VLAN.  Community ports will receive data from both the primary and the community VLAN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A given pair of ports will have bidirectional communication under the following conditions-&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;One or both are promiscuous, or...&lt;/li&gt;&#xA;&lt;li&gt;Both are in the same PVLAN community.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;VACL's are a completely different mechanism and provide some measure of per-packet (and usually protocol based) control of traffic bridged within a given VLAN.  You might, for instance, block traffic on TCP/80 between all hosts within the VLAN while allowing all other traffic to pass.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible to approximate the effects of PVLAN's by using a VACL but this tends to be somewhat fragile, difficult to manage and there are often inherent hardware limitations with which to contend (...highly dependent on platform).  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2013-10-28T01:28:51.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3766" PostTypeId="1" AcceptedAnswerId="3771" CreationDate="2013-10-28T21:50:17.943" Score="15" ViewCount="22454" Body="&lt;p&gt;Why do people say a lot of times that they have two connections between two offices - the main one being over MPLS and the backup one over VPN. Why not run a VPN over MPLS too? Is MPLS secure? Can no one evesdrop on the traffic?&lt;/p&gt;&#xA;" OwnerUserId="3080" LastEditorUserId="775" LastEditDate="2013-10-29T01:49:05.367" LastActivityDate="2013-10-29T06:26:33.717" Title="MPLS vs Encrypted VPNs - traffic security?" Tags="|routing|security|mpls|mpls-vpn|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3769" PostTypeId="2" ParentId="3766" CreationDate="2013-10-28T22:44:28.537" Score="9" Body="&lt;p&gt;I'm assuming you are talking about MPLS VPN. The MPLS VPN is more secure than a regular Internet connection, it's basically like a virtual leased line. However it runs no encryption. So it is free from eavesdropping unless someone misconfigures the VPN but if you carry sensitive traffic it should still be encrypted. This kind of VPN is not authenticated so it's a private network but not authenticated and encrypted like IPSEC. If someone has physical access to your network they could sniff packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the regular VPN I assume you mean IPSEC. IPSEC is authenticated and encrypted depending on which mode you are running. So if someone gets hold of the packets they should still not be able to read them.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="105" LastEditDate="2013-10-29T06:26:33.717" LastActivityDate="2013-10-29T06:26:33.717" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3770" PostTypeId="2" ParentId="3766" CreationDate="2013-10-28T22:44:38.183" Score="6" Body="&lt;p&gt;&quot;VPN&quot; in the most common definition doesn't necessarily imply security. The same goes for MPLS, and the two terms are often combined (see &quot;MPLS VPN&quot;) because certain aspects of MPLS can provide similar functionality to a traditional VPN (AToMPLS, EoMPLS, TDMoMPLS, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's entirely possible to run MPLS over an encrypted VPN tunnel, and to run encrypted VPN traffic over an MPLS circuit. MPLS itself is not &quot;secure&quot; but again it's primarily used for transport services, where the underlying protocols can be secure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically the scenario you describe could result from an organization wanting diverse connectivity from two separate providers, and one of those providers does not offer MPLS services.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-10-28T22:44:38.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3771" PostTypeId="2" ParentId="3766" CreationDate="2013-10-29T01:34:48.403" Score="20" Body="&lt;p&gt;Both Daniel and John gave very good answers to your question; I'll just add some practical things that come to mind when I read the question.&lt;/p&gt;&#xA;&lt;p&gt;Keep in mind that much discussion about the security of &lt;a href=&quot;http://en.wikipedia.org/wiki/MPLS_VPN&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS VPN&lt;/a&gt;s comes by way of the trust normally afforded to &lt;a href=&quot;http://en.wikipedia.org/wiki/Frame_relay&quot; rel=&quot;nofollow noreferrer&quot;&gt;Frame Relay&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Asynchronous_Transfer_Mode&quot; rel=&quot;nofollow noreferrer&quot;&gt;ATM&lt;/a&gt; VPNs.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Is MPLS secure?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Ultimately the question of security comes down to one unasked question, which is &lt;em&gt;&amp;quot;Who do you trust with your business-critical data?&amp;quot;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the answer is &amp;quot;nobody&amp;quot;, then you must overlay your data through an encrypted VPN&lt;/li&gt;&#xA;&lt;li&gt;If you trust your &lt;a href=&quot;http://en.wikipedia.org/wiki/MPLS_VPN&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS VPN&lt;/a&gt; provider, then there is no need to encrypt your data&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Why not run a VPN over MPLS too?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;By most common usage, MPLS &lt;em&gt;is&lt;/em&gt; a VPN, but it's an unencrypted VPN. I assume you mean an encrypted VPN, such as &lt;a href=&quot;http://en.wikipedia.org/wiki/Point-to-Point_Tunneling_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;PPTP&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/IPsec&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPSec&lt;/a&gt;, or &lt;a href=&quot;http://openvpn.net/index.php/open-source/339-why-ssl-vpn.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SSL VPN&lt;/a&gt; when you mention &amp;quot;VPN&amp;quot;. However, if you need strong &lt;a href=&quot;http://en.wikipedia.org/wiki/Encryption&quot; rel=&quot;nofollow noreferrer&quot;&gt;encryption&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Data_integrity#Physical_vs._Logical_Integrity&quot; rel=&quot;nofollow noreferrer&quot;&gt;data integrity&lt;/a&gt;, or &lt;a href=&quot;http://en.wikipedia.org/wiki/Authentication&quot; rel=&quot;nofollow noreferrer&quot;&gt;Authentication&lt;/a&gt; inside the VPN, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4381#section-5.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc4381 MPLS VPN Security, Section 5.2&lt;/a&gt; recommends encrypting inside &lt;a href=&quot;http://en.wikipedia.org/wiki/MPLS_VPN&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS VPN&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;However, encrypted VPNs are not without problems themselves; they generally suffer from:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Additional expenses for the infrastructure&lt;/li&gt;&#xA;&lt;li&gt;Throughput / scalability limitations (due to complexities in HW encryption)&lt;/li&gt;&#xA;&lt;li&gt;Additional expenses for personnel / training&lt;/li&gt;&#xA;&lt;li&gt;Increased &lt;a href=&quot;http://en.wikipedia.org/wiki/Mean_time_to_repair&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mean Time to Repair&lt;/a&gt; when debugging problems through the encrypted VPN&lt;/li&gt;&#xA;&lt;li&gt;Increased management overhead (i.e. &lt;a href=&quot;http://www.cisco.com/en/US/docs/solutions/Enterprise/Security/DCertPKI.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;maintaining PKI&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Technical difficulties, such as lower &lt;a href=&quot;http://en.wikipedia.org/wiki/Maximum_segment_size&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP MSS&lt;/a&gt;, and often &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk827/tk369/technologies_white_paper09186a00800d6979.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;problems with PMTUD&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Less efficient links, because you have the encapsulation overhead of the encrypted VPN (which is already inside the overhead from the &lt;a href=&quot;http://en.wikipedia.org/wiki/MPLS_VPN&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS VPN&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Can no one evesdrop on the traffic?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, evesdropping is quite possible, regardless of whether you think you can trust your provider.  I will quote from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4381#section-7&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc4381 MPLS VPN Security, Section 7&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;As far as attacks from within the MPLS core are concerned, all [unencrypted] VPN&#xA;classes (BGP/MPLS, FR, ATM) have the same problem: If an attacker can&#xA;install a sniffer, he can read information in all VPNs, and if the&#xA;attacker has access to the core devices, he can execute a large&#xA;number of attacks, from packet spoofing to introducing new peer&#xA;routers.  There are a number of precautionary measures outlined above&#xA;that a service provider can use to tighten security of the core, but&#xA;the security of the BGP/MPLS IP VPN architecture depends on the&#xA;security of the service provider.  If the service provider is not&#xA;trusted, the only way to fully secure a VPN against attacks from the&#xA;&amp;quot;inside&amp;quot; of the VPN service is to run IPsec on top, from the CE&#xA;devices or beyond.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;hr&gt;&#xA;&lt;p&gt;I'll mention a final point, which is just a practical question.  One might argue that there is no point in using an &lt;a href=&quot;http://en.wikipedia.org/wiki/MPLS_VPN&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS VPN&lt;/a&gt;, if you're going to use an encrypted VPN over basic internet service; I would disagree with that notion.  The advantages of an encrypted VPN through MPLS VPN are working with one provider:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;While you troubleshoot issues (end to end)&lt;/li&gt;&#xA;&lt;li&gt;To guarantee quality of service&lt;/li&gt;&#xA;&lt;li&gt;To provision services&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-10-29T01:34:48.403" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3774" PostTypeId="1" AcceptedAnswerId="3787" CreationDate="2013-10-29T11:18:44.627" Score="4" ViewCount="9878" Body="&lt;p&gt;I have encountered problems trying to catch packets in promiscuous mode from a wireless interface. I have used various adapters on different platforms, but i can only catch packets destined or originating from my machine, nothing from other computers in the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this even doable with commercial adapters and drivers?&lt;/p&gt;&#xA;" OwnerUserId="3084" LastEditorUserId="775" LastEditDate="2013-10-30T16:21:58.670" LastActivityDate="2013-10-30T16:21:58.670" Title="Using wireless cards in promiscuous mode" Tags="|wireless|monitoring|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3775" PostTypeId="2" ParentId="3774" CreationDate="2013-10-29T11:59:19.417" Score="0" Body="&lt;p&gt;I think the problem is the encryption used for wireless connected devices. This is probably possible, when not using any encryption. (not recommended, and be sure you only test this on your own network, otherwise, in most countries, this is considered illegal.)&lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="623" LastEditDate="2013-10-29T12:04:26.597" LastActivityDate="2013-10-29T12:04:26.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3776" PostTypeId="2" ParentId="3774" CreationDate="2013-10-29T12:40:19.370" Score="1" Body="&lt;p&gt;Two issues. Some cards will not support the mode or the drivers do not. For capturing packets on Linux the Onoco Gold (wavelan from lucent is what I have) would work. And Bulki's remark: after you capture packets you have to decrypt them.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastEditorUserId="623" LastEditDate="2013-10-29T14:28:54.350" LastActivityDate="2013-10-29T14:28:54.350" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3777" PostTypeId="1" CreationDate="2013-10-29T12:41:11.090" Score="1" ViewCount="179" Body="&lt;p&gt;I am using SonicWall NSA 2400 in my organization. We configured two different lans in  x0 and x3 interfaces. Initially we have only one Internet line which we configured in x2 and both the lan interfaces uses the internet line. Now we have a backup line from another provider. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to do NAT as below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN x0 -&gt; x2 TaTa&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN x3 -&gt; x4 AirTel&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I am confusing how to NAT voip lan(x3) to new interface (x4).&lt;/p&gt;&#xA;" OwnerUserId="3086" LastActivityDate="2013-12-01T03:55:06.117" Title="How to map wan to my voip lan?" Tags="|firewall|nat|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3780" PostTypeId="1" CreationDate="2013-10-29T13:39:46.613" Score="3" ViewCount="595" Body="&lt;p&gt;I have not been able to figure out any changes in MAC layer. If there doesn't occur any change then please give the reason&lt;/p&gt;&#xA;" OwnerUserId="3088" LastEditorUserId="8550" LastEditDate="2019-11-09T23:24:20.323" LastActivityDate="2019-11-09T23:24:20.323" Title="When LTE to UMTS IRAT handover is made, what changes occurs in MAC layer?" Tags="|mobile|lte|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3781" PostTypeId="1" AcceptedAnswerId="3783" CreationDate="2013-10-29T15:15:11.467" Score="13" ViewCount="15132" Body="&lt;p&gt;Learning more about OSPF for CCNP studies.  I'm looking at how OSPF builds its links, and have just covered Type1 LSAs.  Looking at Type1 LSAs, I'm wondering why these are even necessary?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The book I'm reading implies that Type2 LSAs are used to help the router build the 'puzzle' of the topology, as if just using Type1 LSAs it couldn't figure out all of the links in the topology.  It appears as if the Type1 LSA gives enough information for the router to be able to derive how two or even more routers are linked.  Maybe the book I'm reading has poor examples, but I can't see what OSPF gains from the Type2 LSAs and it's hard to understand how they work.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2013-10-30T06:10:42.787" LastActivityDate="2016-09-13T04:02:02.090" Title="Why does OSPF need Type2 LSAs?" Tags="|cisco|routing|router|ospf|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3783" PostTypeId="2" ParentId="3781" CreationDate="2013-10-29T17:03:04.197" Score="16" Body="&lt;p&gt;It's important to note that type 2 LSA's are only generated on segments where a DR/BDR has been elected - this includes BMA (Broadcast Multi-Access) and NBMA (Non-Broadcast Multi-Access) networks. The DR is what generates the type 2 LSA. This behavior can be bypassed by configuring your Ethernet interfaces that you're choosing to run OSPF on as &lt;code&gt;point-to-point&lt;/code&gt; (this will also prevent the DR election process).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Type 2 LSA's are beneficial when running OSPF over a Broadcast (Ethernet) or Non-Broadcast Multi-Access (Frame Relay) medium. Put simply, yes, the routers could use type 1 LSA's and detail every router's links to all other routers, but this is inefficient and will introduce unnecessary bloat into the OSPF LSDB. To mitigate this, the Type 2 (network) LSA is used to represent the broadcast subnet. Each router LSA then has a link to the broadcast subnet’s network LSA, and the network LSA has links to each of the router LSAs. It's a math problem - with every router using type 1 LSA's, you have &lt;code&gt;n * (n - 1)&lt;/code&gt; links in the link state database. With type 2 LSA's, this number is reduced to &lt;code&gt;n * 2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I highly recommend reading &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0201634724&quot; rel=&quot;nofollow noreferrer&quot;&gt;John Moy's book on OSPF&lt;/a&gt;. He also wrote the initial RFC's for the protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Very well explained!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe this graphic help visualize that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zesbp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zesbp.jpg&quot; alt=&quot;LSA Flow according area tructure&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="-1" LastEditDate="2016-05-16T06:38:59.330" LastActivityDate="2016-05-16T06:38:59.330" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3785" PostTypeId="1" AcceptedAnswerId="3786" CreationDate="2013-10-29T19:23:13.553" Score="8" ViewCount="1615" Body="&lt;p&gt;I pulled an old ASA5550 off the shelf, which had 8.4(2) loaded on it.  When I tried to boot it, I got the following error...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;-----------------------------------------------&#xA;Traceback output aborted.&#xA;Flushing first exception frame:&#xA;Abort: Assert failure&#xA;    vector 0x00000000&#xA;       edi 0x00000002&#xA;       esi 0x0973a2dc&#xA;       ebp 0x09fceef8&#xA;       esp 0x09fceeec&#xA;       ebx 0x00000187&#xA;       edx 0x09fcef30&#xA;       ecx 0x00000006&#xA;       eax 0x00000000&#xA;error code n/a&#xA;       eip 0xdd6a62a1&#xA;        cs 0x00000073&#xA;    eflags 0x00003246&#xA;       CR2 0x00000000&#xA;Nested traceback attempted via signal, from:&#xA;Abort: Assert failure&#xA;    vector 0x00000000&#xA;       edi 0x09fce92c&#xA;       esi 0x09fce9cc&#xA;       ebp 0x09fce7f8&#xA;       esp 0x09fce7ec&#xA;       ebx 0x00000187&#xA;       edx 0x09fce834&#xA;       ecx 0x00000006&#xA;       eax 0x00000000&#xA;error code n/a&#xA;       eip 0xdd6a62a1&#xA;        cs 0x00000073&#xA;    eflags 0x00003203&#xA;       CR2 0x00000000&#xA;&#xA;An internal error occurred.  Specifically, a programming assertion was&#xA;violated.  Copy the error message exactly as it appears, and get the&#xA;output of the show version command and the contents of the configuration&#xA;file.  Then call your technical support representative.&#xA;&#xA;assertion &amp;quot;_vf_mode_init&amp;quot; failed: file &amp;quot;vf_api.c&amp;quot;, line 99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What is the problem when you get &lt;code&gt;assertion &amp;quot;_vf_mode_init&amp;quot; failed: file &amp;quot;vf_api.c&amp;quot;, line 99&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;p&gt;Google searches turn up a lot of &lt;a href=&quot;http://www.gns3.net/&quot; rel=&quot;noreferrer&quot;&gt;GNS3&lt;/a&gt; discussion, and this &lt;a href=&quot;https://supportforums.cisco.com/thread/2183637&quot; rel=&quot;noreferrer&quot;&gt;Cisco Support Forums Case&lt;/a&gt;, but nothing gets to the root cause of the issue AFAICT.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-04-20T10:56:36.897" Title="ASA5550 Error: assertion &quot;_vf_mode_init&quot; failed: file &quot;vf_api.c&quot;, line 99" Tags="|cisco|cisco-asa|firewall|troubleshooting|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3786" PostTypeId="2" ParentId="3785" CreationDate="2013-10-29T19:23:13.553" Score="10" Body="&lt;p&gt;The ASA5550 &lt;a href=&quot;https://supportforums.cisco.com/thread/2152012&quot; rel=&quot;nofollow noreferrer&quot;&gt;requires the SSM-4GE-INC module to be plugged into the chassis&lt;/a&gt;&lt;sup&gt;1&lt;/sup&gt; when it is booted; if it is not, then you get &lt;code&gt;assertion &quot;_vf_mode_init&quot; failed: file &quot;vf_api.c&quot;, line 99&lt;/code&gt; printed to the console.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I discovered this&lt;sup&gt;2&lt;/sup&gt; after opening a case with TAC (who did not catch this problem), RMA'ing the original chassis, and then unplugging the SSM-4GE-INC module from the RMA'd chassis (so I could send it back to Cisco).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;NOTES:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt; The support forums link I referenced claims that you can't remove SSM-4GE-INC from the chassis; however, my ASA5550 allows the SSM-4GE-INC to be unscrewed from the chassis like other pluggable modules. One of my coworkers subsequently confessed to &quot;borrowing&quot; the module when he had to get some more interfaces on an ASA5510.&lt;br&gt;&#xA;&lt;sup&gt;2&lt;/sup&gt; I'm &lt;a href=&quot;https://networkengineering.meta.stackexchange.com/a/6/775&quot;&gt;answering my own question&lt;/a&gt; in hopes of helping future googlers.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-03-16T15:51:49.960" LastActivityDate="2013-10-29T19:23:13.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3787" PostTypeId="2" ParentId="3774" CreationDate="2013-10-29T21:45:32.783" Score="10" Body="&lt;p&gt;In Infrastructure/ESS mode, it doesn't make much sense to capture packets going to other stations in promiscuous mode, for several reasons :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The 802.11 ESS operation assumes that, in a BSS, all non-AP stations must send all their packets to the AP, regardless of the destination address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is implemented as follows: if a station wants to communicate with another station, it must send a packet to the AP with the transceiver and source address set to its MAC address, the receiver address set to the AP's MAC address (known as the BSSID) and the destination address set to the intended station's MAC.  The AP will then retransmit (or not) the packet to the destination station, changing only the transceiver and receiver address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means the AP essentially acts as a wireless switch. All stations only have a channel to the switch, and nothing else.  This has many implications on how the protocol (including security) works.  This means that a station can only reliably receive frames that are for him. The only exception being broadcast/multicast frames, which, guess what, are unreliable.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The 802.11 standard is made to be compatible with 802.3 networks.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The implication is that, on most OS, a 802.11 station is presented as an Ethernet interface, which carries Ethernet frames. You can already guess what you would see when capturing in promiscuous mode on a 802.11 managed interface: you get Ethernet frames that bear little resemblance with the actual 802.11 frames that got transmitted/received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that this &quot;promiscuous&quot; flag is only enabled on an Ethernet-like network interface.  On an switched Ethernet network, turning on promiscuous mode will not allow you to receive Ethernet frames that are not for you (it will merely enable you to see multicast frames that you are not interested in), so the 802.11-as-ethernet interface should do just the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More importantly: Even if promiscuous mode on that interface is meant to enable receiving frames for other stations, these frames can not be presented as Ethernet frames: A 802.11 frame has 3 or 4 addresses, can have their payload encrypted and has many other fields that Ethernet does not have. And 802.11 has support for AP that both allow encryption and clear text, so you cannot even enable that feature when connected to a open access point. And remember that receiving frames for other stations is unreliable, because the AP will retransmit these frames until the other station received it correctly, not until you receive it correctly.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;What you actually need is an interface that can fetch true 802.11 frames.  Depending on the OS, this is either presented as a different API or as a true 802.11 network interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On modern Linux system and cfg80211-based drivers, the 802.11 network card is presented as a &quot;wiphy&quot;, which is not a network interface nor allow you to capture frames. This wiphy is in fact a container of virtual network interfaces, known as &quot;vif&quot;s. These vifs are the part that actually assumes wifi modes (managed station, AP, IBSS station, mesh point).  There is usually one vif per wiphy, but additional vifs may be created if supported by the driver and card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One type of vif is the monitor vif.  This is a 802.11-with-radiotap network interface that receives as much 802.11 frames as the wifi card can provide to the kernel/driver.  Generally, these interface allow to receive frames for other stations associated to the same AP, but also frames that belong to other BSSes (depending on the monitor options).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most Linux drivers support monitor mode vifs.  When the driver doesn't, it generally because the card is a fullMAC wifi interface that does not provide the functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what you ask is a way to both act as a station AND receive frames from other stations.  For that you need two vifs: a managed station vif and a monitor vif.  This multi-vif configuration is supported by all mac80211 based softMAC drivers, but there is still the possibility that it is not supported by some fullMAC devices, even if they support a single monitor vif.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When this combination is supported, the monitor vif will automatically be slaved to whatever channel the managed vif is using, so you don't even have to configure the monitor channel or anything, and even if you try, it will most likely fail.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On a practical note: use &lt;code&gt;iw phy&lt;/code&gt; to list your wiphys, &lt;code&gt;iw dev&lt;/code&gt; to list the vif associated with the wiphys, use &lt;code&gt;iw phy phyX interface add mon0 type monitor&lt;/code&gt; to create a &lt;code&gt;mon0&lt;/code&gt; monitor vif associated with the &lt;code&gt;phyX&lt;/code&gt; wiphy. &lt;code&gt;iw dev wlanX interface add mon0 type monitor&lt;/code&gt; can also be used if you want to specify a vif of the wiphy instead of the wiphy itself.  Once that is done, you may turn that monitor interface up (&lt;code&gt;ip link set mon0 up&lt;/code&gt;) and start capturing packets with &lt;code&gt;tcpdump&lt;/code&gt; or whatever capture program of your choice that can understand 802.11-with-radiotap while the other is connected to your AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if your AP use encryption, you will capture encrypted frames. But note that on a RSN/WPA2 network with a single PSK, anyone knowing the PSK can decrypt all frames of the BSS if it has captured the 4 way handshake and SAE is not used. The &lt;code&gt;airdecap-ng&lt;/code&gt; tool from aircrack-ng implement that functionality.&lt;/p&gt;&#xA;" OwnerUserId="670" LastEditorUserId="623" LastEditDate="2013-10-30T13:32:24.047" LastActivityDate="2013-10-30T13:32:24.047" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3788" PostTypeId="1" CreationDate="2013-10-30T07:02:40.993" Score="4" ViewCount="1424" Body="&lt;p&gt;I'd like to know how to assign someone's client device to a different VLAN based on MAC address of that device.What kind of hardware/software would make this solution possible (if possible at all)? Would it be possbible to achieve the same using RADIUS authorization credentials instead of MAC addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why I'm asking this is because I'd like to migrate my company's internal network structure to something divided into separate subnets, isolating specific departments from each other, and providing separated, intranet isolated, guest accessible internet access. Would the method above be a right solution for this?&lt;/p&gt;&#xA;" OwnerUserId="3094" LastEditorUserId="775" LastEditDate="2013-10-30T07:05:25.410" LastActivityDate="2013-11-30T10:54:57.810" Title="VLAN assignment based on mac-address or RADIUS attribute" Tags="|vlan|mac-address|radius|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3790" PostTypeId="1" AcceptedAnswerId="3818" CreationDate="2013-10-30T13:53:26.503" Score="2" ViewCount="1834" Body="&lt;p&gt;I am using simple IPIP Tunnels on Centos 5 between my hosts, without IPSec or similar, using encryption on the application layer.  I would like to know, if I should add additional precautions regarding the origin of the tunnel packets.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words: If there was a way in &lt;code&gt;iptables&lt;/code&gt;, would it make sense to add a rule that only accepted tunneled packets from a predefined list of external IPs?  Or does the IPIP tunnel make sure itself that the packet is coming from the peer where it is supposed to send back the answer?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if such filtering would be advisable, how could I do it, &lt;code&gt;iptables&lt;/code&gt; seems to see only the inner address.  Could I do it with &lt;code&gt;ebtables&lt;/code&gt; maybe?&lt;/p&gt;&#xA;" OwnerUserId="3073" LastActivityDate="2013-11-01T11:55:27.773" Title="IP-over-IP tunnels - necessary to limit source IPs?" Tags="|security|tunnel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3791" PostTypeId="1" AcceptedAnswerId="3792" CreationDate="2013-10-30T15:16:02.683" Score="9" ViewCount="7384" Body="&lt;p&gt;I am about to upgrade the IOS on several hundred Cisco VG224's in preparation for a CUCM upgrade.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am attempting to streamline/automate this process as much as possible, and currently my main problem is the &quot;confirmation&quot; prompts that IOS gives back for the &lt;code&gt;copy&lt;/code&gt; command.  For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GW-TEST#copy scp://USER:PASSWORD@SERVER//path/path/vg224-i6k9s-mz.151-4.M7.bin slot0:vg224-i6k9s-mz.151-4.M7.bin&#xA;Destination filename [vg224-i6k9s-mz.151-4.M7.bin]? &#xA;Translating &quot;SERVER&quot;...domain server (192.168.101.2) [OK] &#xA; Sending file modes: C0644 28935060 vg224-i6k9s-mz.151-4.M7.bin&#xA;!!! ::SNIP:: !!!!&#xA;28935060 bytes copied in 501.532 secs (57693 bytes/sec)&#xA;&#xA;GW-TEST#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have found the appropriate syntax to have the device not prompt me for the username or password every time.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now, no matter what I do, it still prompts me to confirm the &lt;code&gt;Destination filename [vg224-i6k9s-mz.151-4.M7.bin]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to stop this behavior?&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2014-05-05T14:49:56.200" Title="Suppress confirmation prompts in IOS when copying files" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="3792" PostTypeId="2" ParentId="3791" CreationDate="2013-10-30T15:16:02.683" Score="13" Body="&lt;p&gt;The command you're looking for is &lt;code&gt;file prompt quiet&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you change this setting in Global Configuration mode, it will suppress the confirmation alerts you're seeing and allow one line, automated file operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it is worth noting that for the most part, the confirmation prompts are there to protect your system and &quot;CYA&quot;...  If you feed the wrong information into your file operations, you could potentially interrupt service on this device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do disable the file prompts, I would make sure that one of the last steps in your script is to reset it to the default of &lt;code&gt;file prompt alert&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/fundamentals/command/reference/cf_f1.pdf&quot;&gt;this Cisco PDF&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-10-30T15:16:02.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3793" PostTypeId="1" AcceptedAnswerId="3800" CreationDate="2013-10-30T15:59:37.007" Score="8" ViewCount="525" Body="&lt;p&gt;I have a SPAN on two different switch ports which are going to the same sniffer.  Host A's connecting port is SPANed, and host B's connecting port is SPANed as well. Because it's a router on a stick type of configuration, I was hoping that during a time that communication failures are reported from application logs, I can look for a particular packet on both sides.  I see in my trace that there are a massive amount of retransmissions, and I am curious if Wireshark's logic marks anything as a retransmission if it sees it twice?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any tips on when they are tracing something like this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="121" LastActivityDate="2013-10-31T02:26:41.217" Title="Will WireShark assume packets are DUP or Retransmitted?" Tags="|packet-analysis|wireshark|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3796" PostTypeId="1" AcceptedAnswerId="3819" CreationDate="2013-10-30T21:14:51.263" Score="6" ViewCount="9121" Body="&lt;p&gt;I'm trying to get a wireless link set up to a building about 1/2 mile away from the rest of my network. I'm using a pair of Engenius EOC2611P radios, and as far as I can tell everything is set up correctly. While in the remote building, my laptop works great. I'm there now, and I have a YouTube video playing in the background in HD as I write this. However, I can't get any &quot;mobile&quot; devices to get IP addresses. I've tested with an iPad 3, Kindle Fire, and at least three different kinds of smart phones. So far, only my laptop works. If I put a static IP address into the iPad, it's able to use the network just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;What do I need to do so that devices in the remote building can get IP valid addresses from our dhcp server?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the network information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Main network&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows 2008 R2 DNS/DHCP Server (10.1.1.11)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10.0.0.0/8 Scope for vlan 1 (Core network)&lt;/li&gt;&#xA;&lt;li&gt;192.168.7.0/24 Scope for vlan 3 (vlan 3 intended for remote building)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.7.1-26 excluded from scope, will not be distributed&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Several other scopes for various purposes, have worked for years (listed to show this isn't our only/first time using vlans)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;HP 5406zl core switch (10.1.1.1)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Connects directly to dhcp server&lt;/li&gt;&#xA;&lt;li&gt;Rules to forward dns/dhcp traffic on vlan 3 to 10.1.1.11 (like Cisco ip helper-address, works for other vlans)&lt;/li&gt;&#xA;&lt;li&gt;192.168.7.1 virtual interface for vlan 3&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Managed Switch in building nearest remote site&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Connected to core switch via 1Gbps fiber link&lt;/li&gt;&#xA;&lt;li&gt;fiber link tagged for vlan 3 at both ends&lt;/li&gt;&#xA;&lt;li&gt;Engenius EOC2611P (10.1.1.249)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Directional antenna pointed at new building&lt;/li&gt;&#xA;&lt;li&gt;Configured as access point&lt;/li&gt;&#xA;&lt;li&gt;Port on switch is untagged/PVID vlan 1, tagged for vlan 3&lt;/li&gt;&#xA;&lt;li&gt;Hidden SSID configured for 802.1q vlan separation, tags packets with vlan 3&lt;/li&gt;&#xA;&lt;li&gt;This configuration scheme is used successfully to give vlan-specific addresses in numerous other access points on our network&lt;/li&gt;&#xA;&lt;li&gt;My expectation is that everything the other side of this SSID will not use vlans, have 192.168.7.0/24 subnet&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Remote Network&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Engenius EOC2611P configured as Client Bridge (192.168.7.6)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Connects fine to other EOC2611P, good signal strength&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;8-port switch (192.168.7.7)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Wired to EOC2611P&lt;/li&gt;&#xA;&lt;li&gt;Limited 802.1q vlan support, but I'm not using it: all one vlan on this side of bridge&lt;/li&gt;&#xA;&lt;li&gt;No dhcp server&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Engenius ECB9500 AP (192.168.7.4)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Wired to 8-port switch&lt;/li&gt;&#xA;&lt;li&gt;&quot;YCHolthus&quot; SSID&lt;/li&gt;&#xA;&lt;li&gt;No security&lt;/li&gt;&#xA;&lt;li&gt;dhcp server only available in router mode, will not distribute dns info&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Other Info&lt;/strong&gt;&lt;br&gt;&#xA;My laptop connects to the YCHolthus SSID, gets an address just fine, internet works&lt;br&gt;&#xA;My laptop connects via cat5 direct to switch, get an address, internet works&lt;br&gt;&#xA;My laptop is able to connect to both EOC2611P devices from the remote site&lt;br&gt;&#xA;An iPad, Kindle Fire, and 3 different smart phones all fail to get an address&lt;br&gt;&#xA;If I manually enter an address in the iPad for the YCHolthus SSID, it can use the internet&lt;br&gt;&#xA;DHCP Server only lists leases for my laptop  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I get this much working, I'll add another access point (different make), two wired pcs, and a wired network printer to the switch at the remote location, and secure the SSID&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm tempted to see if I have another switch available with adequate dhcp support, and then disable dhcp for that scope on our normal dhcp server, but I'd really prefer to use the existing dhcp server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;br&gt;&#xA;DHCP logs on the server have two mentions of the iPad's MAC address during the period I was testing, though I made many more connection attempts. Both mentions are NACKS for the &lt;em&gt;wrong&lt;/em&gt; subnet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;Line 37232: 15,10/30/13,14:23:00,NACK,192.168.40.38,,4CB19930D3C3,,0,6,,,&#xA;Line 37233: 15,10/30/13,14:23:00,NACK,192.168.40.38,,4CB19930D3C3,,0,6,,,&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That address belongs to a different vlan on our network. I'm not sure why these would reach the server, but not others.&lt;/p&gt;&#xA;" OwnerUserId="1375" LastEditorUserId="1375" LastEditDate="2015-01-06T16:06:20.623" LastActivityDate="2015-01-06T16:06:20.623" Title="Mobile devices behind wireless bridge not getting IP address" Tags="|dhcp|bridge|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3800" PostTypeId="2" ParentId="3793" CreationDate="2013-10-31T00:25:24.520" Score="8" Body="&lt;p&gt;Wireshark stores the sequence number for a given TCP flow. If the new packet does not advance the sequence number, then it marks it as a retransmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the actual &lt;a href=&quot;http://anonsvn.wireshark.org/viewvc/trunk-1.4/epan/dissectors/packet-tcp.c?revision=33861&amp;amp;view=co&quot;&gt;Wireshark code in &lt;code&gt;epan/dissectors/packet-tcp.c&lt;/code&gt;&lt;/a&gt; (included inline below).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please look at the &lt;code&gt;tcp_analyze_sequence_number()&lt;/code&gt; function, more specifically the block starting at line 822.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Line 822 of &lt;code&gt;epan/dissectors/packet-tcp.c&lt;/code&gt; (Revision 33861)&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* RETRANSMISSION/FAST RETRANSMISSION/OUT-OF-ORDER&#xA; * If the segments contains data and if it does not advance&#xA; * sequence number it must be either of these three.&#xA; * Only test for this if we know what the seq number should be&#xA; * (tcpd-&amp;gt;fwd-&amp;gt;nextseq)&#xA; *&#xA; * Note that a simple KeepAlive is not a retransmission&#xA; */&#xA;if( seglen&amp;gt;0&#xA;&amp;amp;&amp;amp;  tcpd-&amp;gt;fwd-&amp;gt;nextseq&#xA;&amp;amp;&amp;amp;  (LT_SEQ(seq, tcpd-&amp;gt;fwd-&amp;gt;nextseq)) ){&#xA;    guint64 t;&#xA;&#xA;    if(tcpd-&amp;gt;ta &amp;amp;&amp;amp; (tcpd-&amp;gt;ta-&amp;gt;flags&amp;amp;TCP_A_KEEP_ALIVE) ){&#xA;        goto finished_checking_retransmission_type;&#xA;    }&#xA;&#xA;    /* If there were &amp;gt;=2 duplicate ACKs in the reverse direction&#xA;     * (there might be duplicate acks missing from the trace)&#xA;     * and if this sequence number matches those ACKs&#xA;     * and if the packet occurs within 20ms of the last&#xA;     * duplicate ack&#xA;     * then this is a fast retransmission&#xA;     */&#xA;    t=(pinfo-&amp;gt;fd-&amp;gt;abs_ts.secs-tcpd-&amp;gt;rev-&amp;gt;lastacktime.secs)*1000000000;&#xA;    t=t+(pinfo-&amp;gt;fd-&amp;gt;abs_ts.nsecs)-tcpd-&amp;gt;rev-&amp;gt;lastacktime.nsecs;&#xA;&#xA;&#xA;    if( tcpd-&amp;gt;rev-&amp;gt;dupacknum&amp;gt;=2&#xA;    &amp;amp;&amp;amp;  tcpd-&amp;gt;rev-&amp;gt;lastack==seq&#xA;    &amp;amp;&amp;amp;  t&amp;lt;20000000 ){&#xA;        if(!tcpd-&amp;gt;ta){&#xA;            tcp_analyze_get_acked_struct(pinfo-&amp;gt;fd-&amp;gt;num, TRUE, tcpd);&#xA;        }&#xA;        tcpd-&amp;gt;ta-&amp;gt;flags|=TCP_A_FAST_RETRANSMISSION;&#xA;        goto finished_checking_retransmission_type;&#xA;    }&#xA;&#xA;    /* If the segment came &amp;lt;3ms since the segment with the highest&#xA;     * seen sequence number, then it is an OUT-OF-ORDER segment.&#xA;     *   (3ms is an arbitrary number)&#xA;     */&#xA;    t=(pinfo-&amp;gt;fd-&amp;gt;abs_ts.secs-tcpd-&amp;gt;fwd-&amp;gt;nextseqtime.secs)*1000000000;&#xA;    t=t+(pinfo-&amp;gt;fd-&amp;gt;abs_ts.nsecs)-tcpd-&amp;gt;fwd-&amp;gt;nextseqtime.nsecs;&#xA;    if( t&amp;lt;3000000 ){&#xA;        if(!tcpd-&amp;gt;ta){&#xA;            tcp_analyze_get_acked_struct(pinfo-&amp;gt;fd-&amp;gt;num, TRUE, tcpd);&#xA;        }&#xA;        tcpd-&amp;gt;ta-&amp;gt;flags|=TCP_A_OUT_OF_ORDER;&#xA;        goto finished_checking_retransmission_type;&#xA;    }&#xA;&#xA;    /* Then it has to be a generic retransmission */&#xA;    if(!tcpd-&amp;gt;ta){&#xA;        tcp_analyze_get_acked_struct(pinfo-&amp;gt;fd-&amp;gt;num, TRUE, tcpd);&#xA;    }&#xA;    tcpd-&amp;gt;ta-&amp;gt;flags|=TCP_A_RETRANSMISSION;&#xA;    nstime_delta(&amp;amp;tcpd-&amp;gt;ta-&amp;gt;rto_ts, &amp;amp;pinfo-&amp;gt;fd-&amp;gt;abs_ts, &amp;amp;tcpd-&amp;gt;fwd-&amp;gt;nextseqtime);&#xA;    tcpd-&amp;gt;ta-&amp;gt;rto_frame=tcpd-&amp;gt;fwd-&amp;gt;nextseqframe;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2450" LastEditorUserId="775" LastEditDate="2013-10-31T02:26:41.217" LastActivityDate="2013-10-31T02:26:41.217" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3801" PostTypeId="2" ParentId="2925" CreationDate="2013-10-31T04:34:14.543" Score="16" Body="&lt;p&gt;It all really depends on your requirements and current setup.  That being said, here are some of the main ones.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Active&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Pros:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Active can fit a lot more wavelengths (colors) onto a single fiber pair.  The pro being, the composite signal that is sent over a single fiber pair can carry more bandwidth than a passive of the same size could, in turn you don't need as much physical fiber between your two sites (this really only applies if you require that much bandwidth).  This is advantageous when distance is a problem because it allows you to get more out of a single leased fiber pair as opposed to passive - &lt;a href=&quot;https://i.stack.imgur.com/w5UlJ.jpg&quot; rel=&quot;noreferrer&quot;&gt;see here&lt;/a&gt;.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Active setups grant you more control over your optical network, you can dynamically re-tune wavelengths without dropping connections (it's transparent to whatever is riding on that wavelength).  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Scalability - Active can be easier to scale as your network grows (you can fit more wavelengths on the fiber, see above), but again - we're talking seriously big iron.  I'll dig into it a bit more below.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cons:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;EXPENSIVE - Active DWDM setups are extremely expensive in comparison to passive, so as ytti mentioned, if your distance requirements aren't unreasonable this is not the route to go.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Setup/Configuration - Depending on your vendor, configuration can be a serious undertaking, and require a solid understanding of optical networks.  There are many more components in active builds.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Passive&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Pros:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Inexpensive (in comparison to active) - As mentioned above, less components are required, and less engineering time is required.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;INITIAL Setup - Because of the colored optics there isn't a need to tune wavelengths for all of your connections.  It's a matter of matching your colored optics and plugging it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cons:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Scalability - Not only are you limited to colored optics, and thus less wavelengths on the transport fiber as you grow you would be require to have more passive devices.  Furthermore, with the more passive devices you have the more difficult it can be to manage, you'll have to start managing the same wavelength on multiple passive devices and they could be serving different purposes on each depending on your setup.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Control - If you need to change a wavelength or connection for whatever reason, you're option is limited to taking it out of service and disconnecting the physical cabling as the wavelength is tied to the optic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3191" LastEditDate="2014-05-29T08:47:10.190" LastActivityDate="2014-05-29T08:47:10.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3803" PostTypeId="2" ParentId="3788" CreationDate="2013-10-31T10:12:24.337" Score="2" Body="&lt;p&gt;I am on the 1st phase of implementing a similar solution. 802.1x it's been for a while now and although it's grown up and globally supported it's vulnerable when meeting local OS network stack. I have deployed it several times on small and medium networks and usually it works for 90% of the workstations, maybe 95%. There is always an old Windows install that simply turns off your day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on that I am working with &lt;strong&gt;FreeRadius&lt;/strong&gt;. It requires broader knowledge except basic networking, but it doesn't interact in any way with the workstations, it's transparent for the user. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also try FreeNAC which is similar still it's been discontinued for some time now.&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2013-10-31T10:12:24.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3806" PostTypeId="2" ParentId="3790" CreationDate="2013-10-31T14:27:29.770" Score="2" Body="&lt;p&gt;Iptables can filter ip protocol. &#xA;You should use protocols 4 and 94 (&lt;a href=&quot;https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&quot; rel=&quot;nofollow&quot;&gt;https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&lt;/a&gt;) &#xA;In order to use the protocol in an Iptables rule use the option -p.&#xA;For example: iptables -A INPUT -p 4 --source-port 10.10.10.1 -i eth0 -j ACCEPT&#xA;iptables -A INPUT -p 94 --source-port 10.10.10.1 -i eth0 -j ACCEPT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ebtables is used if you have a bridge of interfaces and the frames are not captured by iptables (which I believe is not your case).&lt;/p&gt;&#xA;" OwnerUserId="2294" LastActivityDate="2013-10-31T14:27:29.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3807" PostTypeId="1" AcceptedAnswerId="3824" CreationDate="2013-10-31T20:12:02.147" Score="2" ViewCount="3464" Body="&lt;p&gt;We have a SonicWALL NSA 220 running SonicOS Enhanced 5.8.1.2-20o. Our ISP provides a symmetrical 100/100 ethernet handoff. Performance on the ingress achieves the full 100Mbps while egress only achieves ~30-40Mbps. What am I not considering in troubleshooting this? Is there anything that might cause this type of asymmetry in performance? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I have done so far: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;• Disabled auto-negotiation on WAN interface and coordinated hard coded 100/Full Duplex setting on ISP gateway&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• Confirmed MTU is 1500 bytes on all devices on the local ethernet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• Confirmed MTU is 1500 bytes on firewall and ISP gateway and ISP next hop &lt;/p&gt;&#xA;&#xA;&lt;p&gt;• Confirmed all services are disabled on SonicWall (including CFS, DPI, BWM, LB, etc.) - it is pretty much just running a stock configuration minus some port forwarding rules&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• Observed high CPU utilization (65%-95% for periods in excess of 10 minutes under a relatively light load 58 connections) &lt;/p&gt;&#xA;" OwnerUserId="2881" LastActivityDate="2013-11-03T18:30:57.627" Title="SonicWALL NSA 220 degraded egress performance" Tags="|routing|firewall|sonicwall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3808" PostTypeId="1" AcceptedAnswerId="29605" CreationDate="2013-10-31T21:43:58.533" Score="10" ViewCount="5120" Body="&lt;p&gt;Alright - been battling this for at least 20 hours consecutive.. Sorry if this seems like a long rant, or a blog post, but I'm getting to the point of exhaustion.&lt;/p&gt;&#xA;&lt;p&gt;So, here's the deal. We're using KEMP load balancers, who utilizes UCARP (a Linux clone of CARP, which is a VRRP clone) for HA heartbeat and persistent states. We want to utilize IGMP in our environment to prevent flooding across the datacenter.&lt;/p&gt;&#xA;&lt;p&gt;We have two Dell PowerConnect 8124F switches running SW 5.1.1.7 acting as top-of-rack. These two are connected to a stacked pair of Cisco 3750-X, which is our core.&lt;/p&gt;&#xA;&lt;p&gt;The problems began when we upgraded to the PowerConnect 5.1.x, where they apparently defaulted to leave IGMP snooping on unless you tell it otherwise. And behold - our load balancers went into split-brain, causing all sorts of warm fuzzy fun.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If I disable IGMP snooping on the VLAN where the load balancers do their multicast nothing happens, multicast is still dead&lt;/li&gt;&#xA;&lt;li&gt;If I set up IP PIM on our core, the PowerConnect switches sees it on the same VLAN, but still no multicast traffic&lt;/li&gt;&#xA;&lt;li&gt;If I enable flooding of all unregistered multicast traffic, it still does nothing at all.&lt;/li&gt;&#xA;&lt;li&gt;If I disable IGMP snooping &lt;em&gt;globally&lt;/em&gt; on the PowerConnect switches, all multicast traffic works. It works so great, that we get multicast traffic flooded to every single port that has the same VLAN tagged. Wonderful.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;I noticed some strange MAC address entries on the VLAN at our core:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;coresw#sh mac address-table vlan 367 | include 5e00&#xA; 367    0000.5e00.0101    DYNAMIC     Po13   seq_no:0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And I think.. Isn't that the multicast address? Why isn't this in the &amp;quot;sh mac address-table multicast&amp;quot;?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;coresw#sh mac address-table multicast vlan 367&#xA;Vlan    Mac Address       Type        Ports&#xA;----    -----------       ----        -----&#xA;coresw#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And then I read this in the PowerConnect CLI guide:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Multicast traffic is traffic that is destined to a host group. Host&#xA;groups are identified by the destination MAC address, i.e. the range&#xA;01:00:5e:00:00:00-01:00:5e:7f:ff:ff:ff for IPv4 multicast traffic or&#xA;33:33:xx:xx:xx:xx for IPv6 multicast traffic.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Seems like we are missing a &amp;quot;01&amp;quot; at the beginning of the MAC address, no? The dynamic MAC entry above start with &amp;quot;00&amp;quot;. At this point I'm thinking about calling KEMP, and letting them know that their product is horribly misconfigured. But then I go read &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5798#page-28&quot; rel=&quot;nofollow noreferrer&quot;&gt;the RFC for VRRP&lt;/a&gt; - and behold:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The virtual router MAC address associated with a virtual router is an&#xA;IEEE 802 MAC Address in the following format:&lt;/p&gt;&#xA;&lt;p&gt;IPv4 case: 00-00-5E-00-01-{VRID} (in hex, in Internet-standard bit-&#xA;order)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Alright - so switches doesn't normally pick up the multicast mac address range for VRRP. Fine, let's configure a static host group on the Dell switches. Nope.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Invalid input: Multicast MAC Address must be of format 01XX:XXXX:XXXX&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;OK then.. Next step, try to add a static mac entry:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;osl-sys-swrack03(config)#mac address-table multicast ?&#xA;&#xA;forbidden                forbid adding specific multicast addresses to&#xA;                         specific ports.&#xA;&#xA;osl-sys-swrack03(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So - no way to configure a static multicast MAC entry. If I try to do the same with a regular static MAC entry, I can only bind it to one port - this load balancing cluster runs across 4 different 10gig ports.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: There seems to be some confusion regarding MAC addresses.&#xA;172.30.1.0/24 is the front-facing loadbalancer network. 172.30.1.6 is the default shared VIP for the cluster, .7 is the management IP for the first load balancer and .8 is for the second load balancer.&#xA;All other addresses (30, 40, 70, 80 etc) are all VIP with different services on them.&#xA;When a failover occurs, all the VIP's change their MAC address to the second LB's physical MAC address.&#xA;The multicast address in the bottom table does &lt;em&gt;not&lt;/em&gt; change.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;coresw#sh ip arp vlan 367&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  172.30.1.6             78   0050.56b4.5004  ARPA   Vlan367    &amp;lt;- VIP - Loadbalancer1 physical MAC&#xA;Internet  172.30.1.40           204   0050.56b4.5004  ARPA   Vlan367    &amp;lt;- VIP - Loadbalancer1 physical MAC&#xA;Internet  172.30.1.80           167   0050.56b4.5004  ARPA   Vlan367    &amp;lt;- VIP - Loadbalancer1 physical MAC&#xA;Internet  172.30.1.70            38   0050.56b4.5004  ARPA   Vlan367    &amp;lt;- VIP - Loadbalancer1 physical MAC&#xA;Internet  172.30.1.66            12   0050.56b4.5004  ARPA   Vlan367    &amp;lt;- VIP - Loadbalancer1 physical MAC&#xA;Internet  172.30.1.35           185   0050.56b4.5004  ARPA   Vlan367    &amp;lt;- VIP - Loadbalancer1 physical MAC&#xA;Internet  172.30.1.60            97   0050.56b4.5004  ARPA   Vlan367    &amp;lt;- VIP - Loadbalancer1 physical MAC&#xA;Internet  172.30.1.30            80   0050.56b4.5004  ARPA   Vlan367    &amp;lt;- VIP - Loadbalancer1 physical MAC&#xA;Internet  172.30.1.61            33   0050.56b4.5004  ARPA   Vlan367    &amp;lt;- VIP - Loadbalancer1 physical MAC&#xA;Internet  172.30.1.7             27   0050.56b4.5004  ARPA   Vlan367    &amp;lt;- Management - Loadbalancer1 physical MAC&#xA;Internet  172.30.1.8             21   0050.56b4.08c2  ARPA   Vlan367    &amp;lt;- Management - Loadbalancer2 physical MAC&#xA;&#xA;osl-sys-coresw#sh mac address-table dynamic vlan 367&#xA;          Mac Address Table&#xA;-------------------------------------------&#xA;&#xA;Vlan    Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA; 367    0000.5e00.0101    DYNAMIC     Po13   seq_no:0   &amp;lt;- multicast HA mac (UCARP)&#xA; 367    0050.56b4.08c2    DYNAMIC     Po13   seq_no:0   &amp;lt;- Loadbalancer1 physical MAC&#xA; 367    0050.56b4.5004    DYNAMIC     Po13   seq_no:0   &amp;lt;- Loadbalancer2 physical MAC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And that's the story. What on earth am I going to do with this?&lt;/p&gt;&#xA;" OwnerUserId="122" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2016-04-15T17:06:07.903" Title="KEMP load balancers using UCARP (VRRP) - multicast MAC address not being picked up" Tags="|cisco-catalyst|multicast|vrrp|powerconnect|igmp|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3809" PostTypeId="2" ParentId="3807" CreationDate="2013-10-31T22:05:59.017" Score="1" Body="&lt;p&gt;You can try following things,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Disable IPS on ZONEs (LAN and WAN).&lt;/li&gt;&#xA;&lt;li&gt;Connect a laptop directly to WAN, have public IP and do a speed test and verify.&lt;/li&gt;&#xA;&lt;li&gt;Have a dummy Switch between your sonicwall and ISP modem.(mostly resolves the issue). &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2756" LastActivityDate="2013-10-31T22:05:59.017" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3810" PostTypeId="1" CreationDate="2013-10-31T22:27:43.750" Score="-1" ViewCount="785" Body="&lt;p&gt;Cisco ASA has following Config, the tunnel shows active but doesn't send any traffic. Please help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;configuration.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_cryptomap_1 line 1 extended permit ip object LAN_Subnet object Remote_Site_A &#xA;&#xA;      group-policy GroupPolicy_&amp;lt;RemoteWAN_IP&amp;gt; internal&#xA;      group-policy GroupPolicy_&amp;lt;RemoteWAN_IP&amp;gt; attributes&#xA;        vpn-tunnel-protocol ikev1&#xA;      exit&#xA;      tunnel-group &amp;lt;RemoteWAN_IP&amp;gt; type ipsec-l2l&#xA;      tunnel-group &amp;lt;RemoteWAN_IP&amp;gt; general-attributes&#xA;        default-group-policy GroupPolicy_&amp;lt;RemoteWAN_IP&amp;gt;&#xA;      tunnel-group &amp;lt;RemoteWAN_IP&amp;gt; ipsec-attributes&#xA;        ikev1 pre-shared-key **********&#xA;        isakmp keepalive threshold 10 retry 2&#xA;      crypto map WAN_map 1 match address outside_cryptomap_1&#xA;      crypto map WAN_map 1 set  peer  &amp;lt;RemoteWAN_IP&amp;gt;&#xA;      crypto map WAN_map 1 set  ikev1 transform-set ESP-AES-251-MD5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;running config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_cryptomap_1 extended permit ip object LocalLAN_subnet object RemoteLAN_subnet &#xA;nat (inside,outside) source static LocalLAN_subnet LocalLAN_subnet destination static RemoteLAN_subnet RemoteLAN_subnet no-proxy-arp route-lookup&#xA;crypto map outside_map 1 match address outside_cryptomap_1&#xA;crypto map outside_map 1 set peer &amp;lt;&amp;lt;RemoteWAN_IP&amp;gt;&amp;gt;&#xA;crypto map outside_map 1 set ikev1 transform-set ESP-AES-251-MD5 &#xA;crypto map outside_map 1 set security-association lifetime seconds 3100&#xA;crypto map outside_map 1 set security-association lifetime kilobytes 2147483147&#xA;crypto map outside_map interface outside&#xA;crypto isakmp nat-traversal 3100&#xA;group-policy GroupPolicy_&amp;lt;&amp;lt;RemoteWAN_IP&amp;gt;&amp;gt; internal&#xA;group-policy GroupPolicy_&amp;lt;&amp;lt;RemoteWAN_IP&amp;gt;&amp;gt; attributes&#xA; vpn-tunnel-protocol ikev1&#xA;isakmp keepalive threshold 10 retry 3&#xA;tunnel-group &amp;lt;&amp;lt;RemoteWAN_IP&amp;gt;&amp;gt; type ipsec-l2l&#xA;tunnel-group &amp;lt;&amp;lt;RemoteWAN_IP&amp;gt;&amp;gt; general-attributes&#xA; default-group-policy GroupPolicy_&amp;lt;&amp;lt;RemoteWAN_IP&amp;gt;&amp;gt;&#xA;tunnel-group &amp;lt;&amp;lt;RemoteWAN_IP&amp;gt;&amp;gt; ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA;policy-map global_policy&#xA; class inspection_default&#xA; inspect icmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2756" LastEditorUserId="775" LastEditDate="2013-11-01T07:03:20.663" LastActivityDate="2013-11-02T05:30:08.903" Title="Cisco ASA - Juniper VPN tunnel not sending traffic" Tags="|cisco-asa|vpn|firewall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3812" PostTypeId="2" ParentId="3808" CreationDate="2013-11-01T01:34:03.037" Score="2" Body="&lt;p&gt;The multicast address you're looking for is 224.0.0.18 [mac: 01005e.000012].  That is the control channel for all VRRP nodes. [edit] Unless KEMP changed the code, CARP (UCARP) originates traffic using the VRRP unicast MAC [00005e.0001xx] -- that's where a switch would naturally learn it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have a querier on the network (presumably in every segment), then your switches will eventually forget what groups are where -- hosts don't send periodic memberships unless asked. [edit: Depending on configuration, a switch could drop unknown multicast, vs. flooding.] That can be a dedicated querier (it sends the packet, it doesn't care about any answers), or more commonly the multicast router within your infrastructure.  In this simple case, a querier is all that's required as the VRRP messages are forbidden from crossing segments anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not familiar with Dell switches, so I don't know what cli commands you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[UPDATE]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vlan    Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA;367    0000.5e00.0101    DYNAMIC     Po13   seq_no:0   &amp;lt;- multicast HA mac (UCARP)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That is not the multicast mac.  That's the unicast MAC &lt;em&gt;source&lt;/em&gt; of the multicast traffic.  The multicast mac will not show up in the mac address table.  That's in a multicast group table. Cisco IOS has a &lt;code&gt;show mac-address-table multicast&lt;/code&gt; (shows nothing on my router) and &lt;code&gt;show ip igmp groups&lt;/code&gt; (shows 3 groups). That router is set to pim sparse-mode; nortel and cisco switches see it as a querier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the KEMP method is deeply flawed by using the host NIC MAC for virtual addresses. In your case, 5004 belongs to a nic.  When 5004 disappears, everybody is still going to have &quot;IP:6 == MAC:5004&quot; in their tables; they will continue trying to talk to the dead host until that entry is replaced. KEMP is obviously gambling on gratuitous-arp being honored by everything in the network. HSRP, VRRP, &lt;em&gt;and&lt;/em&gt; the OpenBSD designed CARP &lt;em&gt;all&lt;/em&gt; use a virtual MAC for this very reason. (they appear to have failed to hack UCARP to use the nic mac instead of the VRRP virtual mac when transmitting it's multcast traffic.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given they hackery of UCARP, are you sure it's even using multicast?&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-11-01T19:40:07.360" LastActivityDate="2013-11-01T19:40:07.360" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3815" PostTypeId="2" ParentId="3777" CreationDate="2013-11-01T03:06:46.967" Score="1" Body="&lt;p&gt;login to Sonicwall and go to Network --&gt; Routes.    Add following routes &lt;img src=&quot;https://i.stack.imgur.com/ZAhp5.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2756" LastActivityDate="2013-11-01T03:06:46.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3818" PostTypeId="2" ParentId="3790" CreationDate="2013-11-01T11:45:24.833" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Or does the IPIP tunnel make sure itself that the packet is coming from the peer where it is supposed to send back the answer? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Of course yes, otherwise, you would not be able to have multiple IPIP tunnels to different peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this can only happens if you have actually specified the address of the peer on the ipip interface. But you did, right ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you also specify the local address to be used by the tunnel, the kernel will also check it.&lt;/p&gt;&#xA;" OwnerUserId="670" LastEditorUserId="670" LastEditDate="2013-11-01T11:55:27.773" LastActivityDate="2013-11-01T11:55:27.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3819" PostTypeId="2" ParentId="3796" CreationDate="2013-11-01T12:41:49.997" Score="6" Body="&lt;p&gt;This sounds like broken broadcast to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the fact that your laptop works is maybe due to how Windows tend to do strange things with DHCP, like trying a unicast DHCPREQUEST with its previous lease to try to renew it.  I assume that it only works in your case because you always connect to the main site before connecting to the remote site, or your laptop was never connected to another network. Try connecting a laptop that has never seen the main network before, or use a LiveCD. I would expect it to not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either fix/configure your wireless bridge to support broadcast (I would look at the AP side, you maybe have to register the client bridge or something) or deploy a DHCP relay on your remote site.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2013-11-01T12:41:49.997" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3822" PostTypeId="1" AcceptedAnswerId="3836" CreationDate="2013-11-01T22:23:57.433" Score="6" ViewCount="1597" Body="&lt;p&gt;I'm trying to setup a redundant route link for our internal network using brocade layer 3 switches. I have setup up VRRP on both the green/blue and red/black networks. The reason for doing this is to simulate an active passive pairing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about it and noticed one issue. If the red connection fails VRRP will work and switch over to the black network but the green network doesn't know this fail over occurred and could be the default path for network traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what things I could do to prevent this issue from occurring. Is there a better way to implement them being an active passive pair?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simple diagram of how the network is setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/chwP5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2013-11-05&lt;/strong&gt;&lt;br&gt;&#xA;All connected or reconnected&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SSH@R1(config-vif-70)#show ip vrrp-extended bri&#xA;Inte- VRID Current  Flags  State  Master IP       Backup IP       Virtual IP      Short-&#xA;rface      Priority               Address         Address         Address         Path-Fwd&#xA;------------------------------------------------------------------------------------------&#xA;v3    3    105      P2     Master Local           Unknown         172.31.0.254&#xA;v70   70   105      P2     Master Local           Unknown         10.64.1.53&#xA;SSH@R2(config-vif-3)#show ip vrrp-e bri&#xA;Inte- VRID Current  Flags  State  Master IP       Backup IP       Virtual IP      Short-&#xA;rface      Priority               Address         Address         Address         Path-Fwd&#xA;------------------------------------------------------------------------------------------&#xA;v3    3    100      P2     Backup 172.31.0.1      Local           172.31.0.254&#xA;v70   70   100      P2     Backup 10.64.1.51      Local           10.64.1.53&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Connection Broken at R1b(v3)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SSH@R1(config-vif-70)#show ip vrrp-extended bri&#xA;Inte- VRID Current  Flags  State  Master IP       Backup IP       Virtual IP      Short-&#xA;rface      Priority               Address         Address         Address         Path-Fwd&#xA;------------------------------------------------------------------------------------------&#xA;v3    3    105      P2     Init   Unknown         Unknown         172.31.0.254&#xA;v70   70   95       P2     Backup 10.64.1.52      Local           10.64.1.53&#xA;&#xA;SSH@R2(config-vif-3)#show ip vrrp-e bri&#xA;Inte- VRID Current  Flags  State  Master IP       Backup IP       Virtual IP      Short-&#xA;rface      Priority               Address         Address         Address         Path-Fwd&#xA;------------------------------------------------------------------------------------------&#xA;v3    3    100      P2     Master Local           Unknown         172.31.0.254&#xA;v70   70   100      P2     Master Local           Unknown         10.64.1.53&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2774" LastEditorUserId="2774" LastEditDate="2013-11-05T23:14:57.763" LastActivityDate="2013-11-05T23:14:57.763" Title="In and Outbound Dual VRRP connections" Tags="|brocade|redundancy|vrrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3823" PostTypeId="2" ParentId="3822" CreationDate="2013-11-01T23:33:37.867" Score="5" Body="&lt;p&gt;You are really looking for the Brocade &lt;a href=&quot;http://www.brocade.com/support/Product_Manuals/ServerIron_SwitchRouterGuide/VRRP.7.2.html#23144&quot; rel=&quot;noreferrer&quot;&gt;Track Ports and Track Priority&lt;/a&gt; features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With these features configured, when the red connection fails, it will lower the priority of the green connection.  This should then allow the blue connection to take over as master in the group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I would also add a direct link between the two L3 switches as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also want to consider running a routing protocol between the two L3 switches and the firewall, if they all support one (such as OSPF), rather than VRRP.  However that may be overly complicated (not many details about your environment, equipment, staffing or the level of redundancy you hope to ultimately achieve).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-11-01T23:33:37.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3824" PostTypeId="2" ParentId="3807" CreationDate="2013-11-02T02:50:07.537" Score="4" Body="&lt;p&gt;The issue was resolved by updating the firmware. Firmware was updated to 5.9.x.&lt;/p&gt;&#xA;" OwnerUserId="2881" LastEditorUserId="2881" LastEditDate="2013-11-03T18:30:57.627" LastActivityDate="2013-11-03T18:30:57.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3825" PostTypeId="2" ParentId="3810" CreationDate="2013-11-02T05:30:08.903" Score="1" Body="&lt;p&gt;There is not quite enough information here to provide an answer and Stack exchange really discourages answering questions that leave much to the imagination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still there are some tools I might as well pass along that may be helpful for you. For one we need to determine if a phase 1 SA is ever even established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some commands I run frequently to troubleshoot tunnels&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show crypto isakmp sa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If that looks clean(active) run some debugs to see where things might be getting stuck. During your debugs send &lt;strong&gt;interesting&lt;/strong&gt; traffic and observe the log messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First) &lt;code&gt;Debug crypto isakmp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can't find an answer there then &lt;strong&gt;undebug all&lt;/strong&gt; and&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second) &lt;code&gt;debug crypto ipsec&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've successfully setup tunnels with Juniper(ScreenOS) in the past but they generally ran best over GRE as the tunneling protocol.&lt;/p&gt;&#xA;" OwnerUserId="1977" LastActivityDate="2013-11-02T05:30:08.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3826" PostTypeId="2" ParentId="3253" CreationDate="2013-11-02T05:48:38.097" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;to know whether two devices in the same VLAN are connected via the same wifi AP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If this is a cisco WLC you can view the current associations on any specific AP via a filter to find your two users by mac address. This is found under the &quot;Monitor&quot; tab.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise Christian Delapena's answer is adequate if you know which port the AP is plugged into. On the other hand this won't work for all AP/WLC configurations since some AP's tunnel traffic back to the controller in a packet. Cisco, for example, uses capwap.&lt;/p&gt;&#xA;" OwnerUserId="1977" LastActivityDate="2013-11-02T05:48:38.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3827" PostTypeId="1" AcceptedAnswerId="3828" CreationDate="2013-11-02T23:15:16.047" Score="6" ViewCount="4278" Body="&lt;p&gt;Consider this network diagram: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/aZxsAm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this scenario, the router is performing &quot;Dynamic PAT&quot; (I'm using &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_dynamic.html#wp1079326&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's definition&lt;/a&gt;) where all &quot;real&quot; or &quot;inside&quot; addresses are mapped to a single outside address provided by my ISP.  Can host 192.168.1.20 traceroute the hops between 108.180.223.48 and 8.8.8.8?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From google I see numerous threads indicating that many people seem to expect this to work if only you configure NAT and access-lists correctly -- but I don't see how that's possible.  Here's why:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Traceroute&quot; rel=&quot;nofollow noreferrer&quot;&gt;Traceroute&lt;/a&gt; relies on &lt;code&gt;ICMP Time Exceeded&lt;/code&gt; packets to be returned to the sender of an ICMP echo or UDP packet when received with a TTL of 1.  When a traceroute is initiated from 192.168.1.20, the router constructs an ICMP echo or UDP session in anticipation of reply traffic from the destination and translates the source address to 108.180.223.48.  When the &lt;code&gt;ICMP Time Exceeded packet&lt;/code&gt; is sent back from each hop, that packet isn't an expected part of the ICMP echo or UDP session.  Without something fancy going on, it seems the router would have no way of unambiguously knowing to which ICMP echo or UDP session an &lt;code&gt;ICMP Time Exceeded&lt;/code&gt; packet belongs.  The router would neither know to allow the Time Exceeded packet through nor to which host to send it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something here?  Can routers or firewalls do something fancy to make traceroutes work behind a Dynamic-PAT firewall?  If so, how?&lt;/p&gt;&#xA;" OwnerUserId="2662" LastEditorUserId="2662" LastEditDate="2013-11-03T22:22:40.627" LastActivityDate="2013-11-03T22:22:40.627" Title="Traceroute to an internet address when I'm behind a Dynamic-PAT firewall?" Tags="|router|firewall|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3828" PostTypeId="2" ParentId="3827" CreationDate="2013-11-03T01:09:35.027" Score="12" Body="&lt;p&gt;Yes, you're missing something. And yes, &quot;&lt;em&gt;something fancy&lt;/em&gt;&quot; is going on.  The router's NAT state table will map the inside-outside translation for the traceroute probe. (UDP normally)  As is required for ICMP to work through any firewall, an ICMP error message will be allowed as part of an established flow.  The &quot;fancy&quot; part is the fact the ICMP error carries the header of the packet that caused the error, so the router can match this against it's NAT table for translation to the correct host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Cisco's firewall product (ASA) will not map icmp errors unless configured to do so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map global_policy&#xA; class inspection_default&#xA;  ...&#xA;  inspect icmp error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IOS does so without any specific configuration.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-11-03T01:09:35.027" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3829" PostTypeId="1" CreationDate="2013-11-03T14:50:20.740" Score="3" ViewCount="340" Body="&lt;p&gt;After a day of super-slow network performance, I found that one computer was both uploading and downloading gigabytes of data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find this, I had to pull up a list of the IP addresses by usage ,and then go desk to desk to find the culprit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I setup Cisco EEM to monitor network (LAN/WAN) usage by IP address, and send an email to me if an IP address crosses X threshold? This would have let me at least start my day with the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware: Cisco 891&lt;/p&gt;&#xA;" OwnerUserId="1331" LastEditorUserId="8499" LastEditDate="2016-04-03T16:11:10.457" LastActivityDate="2018-06-02T05:56:22.770" Title="EEM to send email for problematic IP address" Tags="|cisco|monitoring|cisco-eem|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3830" PostTypeId="1" AcceptedAnswerId="3831" CreationDate="2013-11-03T14:53:04.873" Score="6" ViewCount="15358" Body="&lt;p&gt;I have an issue related to some stp packet that being sent every 1 or 2 second on my server interface eth1.&#xA;This interface is connected to my stack switch, and the port is in a public vlan.&#xA;Here is the output I have from the server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;server-1:&#xA;user@server-1:~$ sudo tcpdump -vvv -p -n -i eth1 stp&#xA;tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes&#xA;&#xA;15:44:10.772423 STP 802.1d, Config, Flags [none], bridge-id  8000.MAC.8687, length 43&#xA;        message-age 0.00s, max-age 20.00s, hello-time 2.00s, forwarding-delay 15.00s&#xA;        root-id 8000.MAC, root-pathcost 0&#xA;15:44:12.768245 STP 802.1d, Config, Flags [none], bridge-id 8000.MAC8.8687, length 43&#xA;        message-age 0.00s, max-age 20.00s, hello-time 2.00s, forwarding-delay 15.00s&#xA;        root-id 8000.MAC, root-pathcost 0&#xA;15:44:14.766513 STP 802.1d, Config, Flags [none], bridge-id 8000.MAC.8687, length 43&#xA;        message-age 0.00s, max-age 20.00s, hello-time 2.00s, forwarding-delay 15.00s&#xA;        root-id 8000.MAC, root-pathcost 0&#xA;15:44:16.766478 STP 802.1d, Config, Flags [none], bridge-id 8000.MAC.8687, length 43&#xA;        message-age 0.00s, max-age 20.00s, hello-time 2.00s, forwarding-delay 15.00s&#xA;        root-id 8000.MAC, root-pathcost 0&#xA;15:44:18.767851 STP 802.1d, Config, Flags [none], bridge-id 8000.MAC.8687, length 43&#xA;        message-age 0.00s, max-age 20.00s, hello-time 2.00s, forwarding-delay 15.00s&#xA;        root-id 8000.MAC, root-pathcost 0&#xA;---------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do anyone know what is the issue here!? I did a research over the Internet but all queries on this topic is never ended or there is no answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time.&lt;/p&gt;&#xA;" OwnerUserId="3122" LastEditorUserId="619" LastEditDate="2013-11-03T22:49:54.610" LastActivityDate="2014-12-12T21:20:52.390" Title="STP Packet on specific interface eth1" Tags="|vlan|spanning-tree|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3831" PostTypeId="2" ParentId="3830" CreationDate="2013-11-03T15:47:47.930" Score="6" Body="&lt;p&gt;This are just spanning tree packets from your switch. Disable spanning tree on your switch on the interface towards your server if you don't need it and don't want to see these packets. &lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-11-03T15:47:47.930" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="3832" PostTypeId="1" AcceptedAnswerId="6362" CreationDate="2013-11-03T18:39:45.993" Score="6" ViewCount="2051" Body="&lt;p&gt;About a month ago one of my SRX100 started to go into a bootloop for no obvious reason to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some hours, it eventually stopped and booted up the system again (primary) and I was happy that I could create a rescue config. However, I did not have time to copy the configuration to a remote host before this issue started again.&#xA;The device boots up, give me a few error messages that varies, such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SUMMARY INFORMATION BAD&#xA;SALVAGE? yes&#xA;&#xA;BLK(S) MISSING IN BIT MAPS&#xA;SALVAGE? yes&#xA;&#xA;FREE BLK COUNT(S) WRONG IN SUPERBLK&#xA;SALVAGE? yes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sometimes it also says (but as stated before, it varies):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INCORRECT BLOCK COUNT I=33517 (16 should be 0)&#xA;CORRECT? yes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I started google a bit and found several posts that looked similar and they where all recommended to install a fresh version of JUNOS from a USB or TFTP server. So I did the same. I installed the newest version I could find (junos-12.1X45-D15.5-domestic) using TFTP with the &lt;code&gt;--format&lt;/code&gt; option but I am still having the same problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, the device is fine and can boot up, I can even log in (the interfaces haven't activated yet though), and after about 50-60 sec it just reboots again, without any messages on the console. Looks like it got a power reset or something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also tried running the &lt;code&gt;nand-mediack.sh&lt;/code&gt; utility (just running the script, no options) but it just comes back empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, anyone have a clue of what's going on here? Is there any logs I can look at? Can I transfer my config out of there?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="3124" LastEditorUserId="3191" LastEditDate="2014-03-22T21:29:18.607" LastActivityDate="2014-04-21T21:47:03.720" Title="SRX100 in bootloop. Flash storage problem?" Tags="|juniper|troubleshooting|juniper-srx|srx|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3834" PostTypeId="1" AcceptedAnswerId="3837" CreationDate="2013-11-03T20:25:42.200" Score="3" ViewCount="1459" Body="&lt;p&gt;I have a Cisco 1811 configured with PAT:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0&#xA; ip address dhcp&#xA; ip nat outside       &#xA;interface Vlan1&#xA; ip address 192.168.0.1 255.255.255.0&#xA; ip nat inside&#xA;ip nat inside source route-map primary interface FastEthernet0 overload&#xA;route-map primary permit 10&#xA; match ip address 9&#xA; match interface FastEthernet0&#xA;access-list 9 permit 192.168.0.0 0.0.0.255&#xA;ip route 0.0.0.0 0.0.0.0 FastEthernet0 dhcp 99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm also using this router as a caching DNS relay:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dns server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Clients on VLAN1 could send DNS query's to 192.168.0.1 and the router would relay them to the DNS servers from the DHCP lease on Fas0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, recently my (residential) ISP began blocking inbound UDP port 53 (for good reason). This is posing a problem because the relayed packets from the Cisco router have SrcPort:53 and DestPort:53. The replies never make it back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is:&#xA;Is there anyway to re-write all UDP packets output from Fas0 changing ScrPort 53 to some other fixed port, and then re-writing them back when they return. Or is there some way I could force them to send from the inside of the NAT and would that solve the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All suggestions or ideas welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3125" LastActivityDate="2013-11-03T22:56:56.880" Title="Forcing Cisco DNS relay to send requests from behind PAT" Tags="|nat|cisco-ios|dns|" AnswerCount="1" CommentCount="0" ClosedDate="2018-03-05T00:32:36.617" ContentLicense="CC BY-SA 3.0" />
  <row Id="3836" PostTypeId="2" ParentId="3822" CreationDate="2013-11-03T21:46:49.997" Score="7" Body="&lt;p&gt;This is the logical view of what you're trying to achieve:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z2HqT.jpg&quot; alt=&quot;Dual VRRP Logical Architecture&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure the router priorities for both VRRP 'a' and VRRP 'b' as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router 1: 110 (master)&lt;/li&gt;&#xA;&lt;li&gt;Router 2: 100 (backup)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The configure interface tracking as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router 1 VRRP a: track interface R1b with a track priority of 90&lt;/li&gt;&#xA;&lt;li&gt;Router 1 VRRP b: track interface R1a with a track priority of 90&lt;/li&gt;&#xA;&lt;li&gt;Router 2 VRRP a: track interface R2b with a track priority of 90&lt;/li&gt;&#xA;&lt;li&gt;Router 2 VRRP b: track interface R2a with a track priority of 90&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If interface &lt;strong&gt;R1b&lt;/strong&gt; goes down, Router 1 will change its VRRP 'a' priority to 90.  This priority is now less than the VRRP 'a' priority that Router 2 has, so it will preempt and take over mastership for VRRP 'a'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, because interface R1b has gone down, then the VRRP hello packets will fail across VLAN 'b'.  This will be detected by Router 2 (after failing to receive a hello packet within the dead timer interval), at which point it will take over mastership for VRRP 'b'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If interface &lt;strong&gt;R1a&lt;/strong&gt; goes down, then in a similar fashion, Router 2 will take over mastership for both VRRP groups (Router 1 VRRP 'b' priority = 90, and the VRRP hello packets will fail across VLAN 'a').&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If either interface &lt;strong&gt;R2a&lt;/strong&gt; or &lt;strong&gt;R2b&lt;/strong&gt; goes down, then Router 1 will continue to be master for both VRRP groups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the priority value I've chosen above are quite arbitrary -- you may want to choose different values.  Also, if the VIP address of a particular VRRP group is the same as the interface address for one of the routers in that VRRP group, then that router will automatically take a priority of 255 (i.e. it will always be the master unless that interface goes down).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, to get the above logical architecture, you will need a physical architecture similar to the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7UnPd.jpg&quot; alt=&quot;Dual VRRP Physical Architecture&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read up on VRRP on Wikipedia here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_Router_Redundancy_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://en.wikipedia.org/wiki/Virtual_Router_Redundancy_Protocol&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Brocade's VRRP documentation is here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.brocade.com/support/Product_Manuals/ServerIron_SwitchRouterGuide/VRRP.7.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.brocade.com/support/Product_Manuals/ServerIron_SwitchRouterGuide/VRRP.7.2.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Brocade also have some VRRP configuration examples here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.brocade.com/support/Product_Manuals/ServerIron_SwitchRouterGuide/VRRP.7.11.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.brocade.com/support/Product_Manuals/ServerIron_SwitchRouterGuide/VRRP.7.11.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!  :)&lt;/p&gt;&#xA;" OwnerUserId="1680" LastEditorUserId="1680" LastEditDate="2013-11-05T19:32:36.743" LastActivityDate="2013-11-05T19:32:36.743" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3837" PostTypeId="2" ParentId="3834" CreationDate="2013-11-03T22:56:56.880" Score="4" Body="&lt;p&gt;When the routers NAT they will first check if the &quot;correct&quot; source address is available if so they will map that to that nat translation. If it is not available it will select a number as src port from a pool 1-512 (or 1024) for the service under port 512 (or 1024). Which ever is the first available and place that in the translation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going by this, and this is mainly an idea i had for a case i had with similar issue (NTP src port coming as port 1, because ntp port was taken and request denied from the ntp server as it was a non ntp port number and their firewall stopped it.) So reversing that what you can do is, if you somehow make sure that src port 53 is taken it will select another port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So have another service take over the translation forcing your real one to be mapped differently. Probably wont work in your case cause the router is doing the requests? Or create a static dummy static nat which creates a static entry in the translation table forcing your service to use another port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again it's an idea haven´t really tested it but it might work. Didn't at the time really find any good way to control which services got which source port without &quot;hacking&quot; a bit :).&lt;/p&gt;&#xA;" OwnerUserId="381" LastActivityDate="2013-11-03T22:56:56.880" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3841" PostTypeId="1" AcceptedAnswerId="3844" CreationDate="2013-11-04T14:09:45.833" Score="13" ViewCount="3159" Body="&lt;p&gt;How can someone distinguish between different packets in the Ethernet protocol? It has no &quot;length&quot; field/area as higher-level protocols use to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because this protocol has handling in both the physical and the logical scopes, I assume that the distinction is also separated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the logical separation performed using the &quot;EtherType&quot; protocol field? (i.e. obtaining the packet length using the type of the higher-level protocol, that has a length field in it's headers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the physical distinction is simply non-transmission of electrical signals? (To my knowledge, high/low electrical signals are representing 0/1 bits).&lt;/p&gt;&#xA;" OwnerUserId="3131" LastEditorUserId="3131" LastEditDate="2013-11-04T17:12:45.143" LastActivityDate="2013-12-31T18:06:48.407" Title="Detecting different Ethernet frames" Tags="|ethernet|protocol-theory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3842" PostTypeId="2" ParentId="3841" CreationDate="2013-11-04T14:13:16.967" Score="7" Body="&lt;p&gt;Ethernet has preamble and start frame delimiter at start and at end it has 'IFG' or inter-frame-gap. These are used to determine start and end of frame.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-11-04T14:13:16.967" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3843" PostTypeId="1" AcceptedAnswerId="3867" CreationDate="2013-11-04T15:08:01.103" Score="5" ViewCount="5227" Body="&lt;p&gt;So I'm using a pfsense openvpn to bridge my LAN segment so VPN users can access the servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I'm having now is that I can establish a connection, I can ping the LAN server from the VPN, but as soon as I ping the client from the LAN server, there is no connectivity anymore between both parties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;connect from the VPN client to the LAN =&gt; works&lt;/li&gt;&#xA;&lt;li&gt;ping the LAN from the VPN client =&gt; works&lt;/li&gt;&#xA;&lt;li&gt;access server from the VPN (ssh, ftp,...) =&gt; works&lt;/li&gt;&#xA;&lt;li&gt;ping client from server =&gt; doesn't work&lt;/li&gt;&#xA;&lt;li&gt;ping LAN from the VPN client =&gt;  doesn't work anymore&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My bridge has em1 and ovpns1 bridged. I noted with tcpdump that ICMP is reaching the bridge between LAN and the VPN segment. But it's not put onto the em1 interface for some reason. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My pfsense is running on an ESXi host with th vSwitch port enabled in promiscious mode. Firewall rules allow in and outbound traffic regardless origin or destination.&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2015-04-03T18:02:59.903" Title="OpenVPN Bridge on pfsense: once LAN pings clients, connectivity breaks" Tags="|vpn|pfsense|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3844" PostTypeId="2" ParentId="3841" CreationDate="2013-11-04T15:16:11.300" Score="15" Body="&lt;p&gt;Although ytti answered, there are some relevant details you may be interested in...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How can someone distinguish between different packets in the Ethernet protocol? It has no &quot;length&quot; field/area as higher-level protocols use to do so.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Actually ethernet has multiple encapsulations:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ethernet II (Typically used for IP, as specified in [RFC 894], is the most common encapsulation): Does not have a &lt;em&gt;length&lt;/em&gt; field, instead a type field is used...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       +----+----+------+------+-----+&#xA;       | DA | SA | Type | Data | FCS |&#xA;       +----+----+------+------+-----+&#xA;                 ^^^^^^^^&#xA;&#xA;       DA      Destination MAC Address (6 bytes)&#xA;       SA      Source MAC Address      (6 bytes)&#xA;       Type    Protocol Type           (2 bytes: &amp;gt;= 0x0600 or 1536 decimal)  &amp;lt;---&#xA;       Data    Protocol Data           (46 - 1500 bytes)&#xA;       FCS     Frame Checksum          (4 bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;802.2 LLC Ethernet: has a &lt;em&gt;length&lt;/em&gt; field&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       +----+----+------+------+------+------+-----+&#xA;       | DA | SA | Len  | LLC  | SNAP | Data | FCS |&#xA;       +----+----+------+------+------+------+-----+&#xA;                 ^^^^^^^^&#xA;&#xA;       DA      Destination MAC Address (6 bytes)&#xA;       SA      Source MAC Address      (6 bytes)&#xA;       Len     Length of Data field    (2 bytes: &amp;lt;= 0x05DC or 1500 decimal)  &amp;lt;---&#xA;       LLC     802.2 LLC Header        (3 bytes)&#xA;       SNAP                            (5 bytes)&#xA;       Data    Protocol Data           (46 - 1492 bytes)&#xA;       FCS     Frame Checksum          (4 bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Regardless of the existence of 802.2's length field, you can always detect the end of an ethernet frame on the wire by looking for the &lt;a href=&quot;http://en.wikipedia.org/wiki/Interframe_gap&quot; rel=&quot;nofollow noreferrer&quot;&gt;96-bit Interframe Gap&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the logical separation performed using the &quot;EtherType&quot; protocol field? (i.e. obtaining the packet length using the type of the higher-level protocol, that has a length field in it's headers).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;By logical separation, I assume you mean separation between different protocols carried inside ethernet, such is distinguishing between IPv4, IPv6 or perhaps Spanning-Tree Frames.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ethernet II normally uses the Type field&lt;/li&gt;&#xA;&lt;li&gt;802.2 LLC Ethernet normally uses the five-byte &lt;a href=&quot;http://www.wildpackets.com/resources/compendium/ethernet/frame_snap_iee8023&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.2 Ethernet SNAP extension&lt;/a&gt;.  Protocols are only decoded with the SNAP extension when the 802.2 DSAP / SSAP bytes are 0xAAAA.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the physical distinction is simply non-transmission of electrical signals? (To my knowledge, high/low electrical signals are representing 0/1 bits)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Simplistically, yes there is a 96-bit gap between Ethernet frames; however, note that ethernet uses an &lt;a href=&quot;https://electronics.stackexchange.com/questions/14387/alternating-patterns-in-8b-10b-encoding&quot;&gt;8b/10b encoding&lt;/a&gt; (FastEthernet) and &lt;a href=&quot;http://en.wikipedia.org/wiki/64b/66b_encoding&quot; rel=&quot;nofollow noreferrer&quot;&gt;64b/66b encoding&lt;/a&gt; (GigabitEthernet), so it's not technically correct to say the &quot;non-transmission of electrical signals&quot;, since 8b/10b doesn't have a &quot;silent&quot; state.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For the curious, I'm also linking to the original &lt;a href=&quot;http://www.pennington.net/archives/ethernet/Ethernet_Version_2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethernet Version 2 spec&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:08.917" LastActivityDate="2013-12-31T18:06:48.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3845" PostTypeId="1" AcceptedAnswerId="3846" CreationDate="2013-11-04T17:40:43.370" Score="9" ViewCount="4038" Body="&lt;p&gt;I'm doing some research on users connected to Internet via cable operators and I've seen some unusual route traces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit about setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically user has a home router connected to a DOCSIS modem. The router seems to receive a public IP address from the modem for its WAN interface using DHCP, but when traceroute is done, there is a number of routers in the path which have private IP addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example traceroute output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tracing route to google.com [5.22.190.25]&#xA;over a maximum of 30 hops:&#xA;&#xA;  1     3 ms     1 ms     1 ms  192.168.1.1//This router has public WAN address&#xA;  2    10 ms    12 ms     8 ms  10.14.0.1&#xA;  3    11 ms    19 ms     9 ms  bg-he-m-1-pc2.sbb.rs [89.216.6.94]&#xA;  4    12 ms    11 ms    11 ms  bg-he-m-1-pc2.sbb.rs [89.216.6.94]&#xA;  5    12 ms    11 ms    12 ms  cache.google.com [5.22.190.25]&#xA;&#xA;Trace complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've seen some examples on other providers as well which use the 176.16.0.0/12 addresses. The private addresses are always right after the user's CPE. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of my thoughts on this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I understand it, it shouldn't be possible to route private addresses over public Internet and all routers on the Internet should drop packets with private IP address destinations. I'm aware that the routers with private addresses here are in ISP's network, but I still don't understand how this all works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I expect that there is some sort of tunneling involved, but I believe that in that case only tunnel endpoints would be visible. The other option would be carrier grade NAT. I'm not sure how that would look like. From what I've heard (but I could be wrong), in CGN systems, users usually can't directly access the Internet and can't be directly accessed from the Internet. In setup I've seen, I can connect to user from the Internet using its IP address normally. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this rather long exposition, I've come to point where I should present the actual question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to know which technology is used here to enable such a setup? A little bit about architecture and some keywords for Google would be helpful as well. &lt;/p&gt;&#xA;" OwnerUserId="677" LastEditorUserId="775" LastEditDate="2013-11-04T18:11:17.657" LastActivityDate="2013-11-04T19:36:32.727" Title="How can hosts with public IP addresses have nodes with private IP addresses in their traceroute?" Tags="|routing|router|ipv4|service-provider|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3846" PostTypeId="2" ParentId="3845" CreationDate="2013-11-04T18:41:48.553" Score="13" Body="&lt;p&gt;There is no tunneling. This is completely normal. With IP routing you are concerned about the source and destination address which doesn't change unless something is NAT'd. If a router in the middle has an RFC1918 address that's fine as it can still forward transit traffic as again the source and destination is unchanged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each router will simply reply to the source with their own directly connected interface address. The 10.14.0.1 above is not being routed over the internet, it's simply the device that is attached to the CPE on the WAN side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no magic technology being used. It's pure standard routing. &lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-11-04T18:41:48.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3847" PostTypeId="1" AcceptedAnswerId="3848" CreationDate="2013-11-04T19:10:00.917" Score="5" ViewCount="1498" Body="&lt;p&gt;I have configured a Cisco WLC to authenticate users using External Web Authentication at Layer 3.  Are client wifi connections more resilient against eavesdroppers with a pre-shared key at Layer 2 versus simply having an open network and just using Layer 3 web auth?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, say there is a client that connects to wifi, but does not have a username/password for Layer 3 web auth.  If the wifi was open access would the client be able to sniff the airwaves and read unencrypted data (for example HTTP connections, or maybe that PDF being printed to the networked printer).  What if the wifi has a PSK?  Does the non-layer-3-authenticated client have less or the same amount of visibility to unencrypted traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on @BatchyX's comment, how difficult is it to intercept a WPA2 handshake and get the PSK without knowing it?  This network is in a coffee shop scenario where there are many clients and constant traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a better way to secure the network?  Is there a 802.1X variant that would allow per-user keys without the per-user certificate requirement?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="3132" LastEditorUserId="8499" LastEditDate="2018-03-21T00:45:20.943" LastActivityDate="2018-03-21T00:45:20.943" Title="Is Layer 3 web auth with Layer 2 PSK more secure?" Tags="|cisco|wireless|security|layer2|layer3|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3848" PostTypeId="2" ParentId="3847" CreationDate="2013-11-04T19:27:51.413" Score="6" Body="&lt;p&gt;Web authentication is really more of a means to limit/allow guest access on a clear network that requires no additional client configuration to connect.  It is not meant as a way of providing secure access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, unless the client only uses encrypted sessions (HTTPS, SSH, SFTP, VPN, etc.), then they are far more secure using a PSK than web authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit for the expanded question:&lt;/strong&gt;  Generally speaking a client connecting to the network in any means is not &quot;capturing&quot; any traffic in the air.  Attackers capturing traffic will not be connected to the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a client device is connected to a SSID that has no encryption, anyone in the area could &quot;listen in&quot; while there is data going to/from the client.  Any of that data that is not encrypted by other means would be easily decoded by someone who wanted to do so.  To be entirely clear, &quot;L3 web authentication&quot; provides no encryption. Specifically to answer your question, yes, anyone can capture traffic on an open/clear SSID using web authentication, whether they have a username/password or not making traffic like your example HTTP or print traffic vulnerable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A PSK is not actually used to encrypt the data, rather it is used as a common frame of reference (or starting point) to allow to devices to negotiate the keying material used for encryption.  Having the PSK will not allow you to decrypt the data.  However, as BatchyX pointed out, if you have the PSK &lt;strong&gt;and&lt;/strong&gt; capture the handshake, since you have the same &quot;starting point&quot; as the other device (i.e. the PSK), you will be able to get the keying material and decrypt any data using that keying material.  This provides much less visibility for an outsider to capture data, as they would need both the PSK and the handshake to do so.  One without the other will not suffice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for getting the PSK by capturing the handshake, this is a bit more involved, but can be done.  Basically, this is a &quot;brute force&quot; type of attack where the attacker uses different PSK values against the handshake until they find one that allows them to understand the full handshake.  Once they have this value, then they will be able to easily decrypt any other connection that they capture the handshake for as well.  While this is a simplistic description, if you are using WPA2/AES without a &quot;common&quot;, short, or dictionary PSK, know that this is very unlikely to occur.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted a better way of doing this without client certificates, then the most common one is 802.1X based WPA2-Enterprise using EAP-PEAP-MSCHAPv2.  This only requires the server side certificate, but is a more involved process to configure the client (although this has gotten much better for many devices in the past couple of years) to authenticate against a RADIUS server.  Not only does this make the keying material different for each user, but different for each session as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your coffee shop scenario, I would recommend using WPA2-Enterprise SSID for &quot;company&quot; devices.  As for customer access, a second SSID with either web authentication or PSK provides a mechanism for limiting access.  Normally most public places go with the web authentication because they can have a mechanism for providing a &quot;Terms of Use&quot; agreement to cover themselves in a legal sense.  They leave it to the customer to provide for their own protection of data.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-11-05T22:55:18.980" LastActivityDate="2013-11-05T22:55:18.980" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="3849" PostTypeId="2" ParentId="3845" CreationDate="2013-11-04T19:36:32.727" Score="10" Body="&lt;p&gt;The distinction you need to draw here is that your ISP is not the internet.  Any traffic leaving your ISP to the internet at large or any traffic being received by your ISP from other entities on the internet cannot use these IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, your ISP is well within their rights to use these IP addresses however they see fit internally on their own network.  It is only at the &lt;em&gt;edge&lt;/em&gt; of their network that they really need to worry about anything like NAT (if necessary).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many large, older ISPs will use public IP addresses on all their router interfaces, however many smaller/newer ISPs have found it much more difficult to get IP space and find they don't have enough available to use in this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may very well have a public IP address assigned to your CPE, which is then routed over devices using private IP addresses until it exits to the internet at large.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-11-04T19:36:32.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3851" PostTypeId="1" AcceptedAnswerId="3853" CreationDate="2013-11-04T22:38:35.057" Score="12" ViewCount="2044" Body="&lt;p&gt;How are the host names in this trace route able to use random top level domains? I didn't know there was an 'Empire' or 'victory' top level domain.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\Chloe&amp;gt; tracert 216.81.59.173&#xA;&#xA;Tracing route to read.more.at.beaglenetworks.net [216.81.59.173]&#xA;over a maximum of 30 hops:&#xA;&#xA;  1     *        *        *     Request timed out.&#xA;  2    27 ms    15 ms    11 ms  &#xA;  3    11 ms    11 ms    21 ms  &#xA;  4    12 ms    11 ms    11 ms  &#xA;  5    14 ms    15 ms    14 ms  &#xA;  6    17 ms    14 ms    15 ms  &#xA;  7    13 ms    14 ms    15 ms  &#xA;  8    15 ms    24 ms    23 ms  &#xA;  9    21 ms    23 ms    24 ms  100gigabitethernet11-1.core1.ash1.he.net [184.105.223.165]&#xA; 10    33 ms    31 ms    49 ms  10gigabitethernet1-2.core1.atl1.he.net [184.105.213.110]&#xA; 11    33 ms    30 ms    31 ms  216.66.0.26&#xA; 12    73 ms    72 ms    73 ms  10.26.26.22&#xA; 13    71 ms    73 ms    72 ms  Episode.IV [206.214.251.1]&#xA; 14    73 ms    72 ms    72 ms  A.NEW.HOPE [206.214.251.6]&#xA; 15    71 ms    71 ms    72 ms  It.is.a.period.of.civil.war [206.214.251.9]&#xA; 16    72 ms    72 ms    73 ms  Rebel.spaceships [206.214.251.14]&#xA; 17    73 ms    71 ms    73 ms  striking.from.a.hidden.base [206.214.251.17]&#xA; 18    73 ms    71 ms   101 ms  have.won.their.first.victory [206.214.251.22]&#xA; 19    72 ms    71 ms    72 ms  against.the.evil.Galactic.Empire [206.214.251.25]&#xA; 20    74 ms    72 ms    72 ms  During.the.battle [206.214.251.30]&#xA; 21    71 ms    73 ms    72 ms  Rebel.spies.managed [206.214.251.33]&#xA; 22    72 ms    72 ms    72 ms  to.steal.secret.plans [206.214.251.38]&#xA; 23    73 ms    91 ms    72 ms  to.the.Empires.ultimate.weapon [206.214.251.41]&#xA; 24    72 ms    71 ms    75 ms  the.DEATH.STAR [206.214.251.46]&#xA; 25    72 ms    75 ms    73 ms  an.armored.space.station [206.214.251.49]&#xA; 26    75 ms    72 ms    71 ms  with.enough.power.to [206.214.251.54]&#xA; 27    75 ms    75 ms    72 ms  destroy.an.entire.planet [206.214.251.57]&#xA; 28    72 ms    75 ms    71 ms  Pursued.by.the.Empires [206.214.251.62]&#xA; 29    77 ms    73 ms    71 ms  sinister.agents [206.214.251.65]&#xA; 30    71 ms    72 ms    71 ms  Princess.Leia.races.home [206.214.251.70]&#xA;&#xA;Trace complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3135" LastActivityDate="2013-11-05T10:19:12.553" Title="How are the hosts in the tracert 216.81.59.173 able to use random domain names?" Tags="|ipv4|dns|internet|" AnswerCount="3" CommentCount="1" ClosedDate="2018-03-11T03:50:03.267" ContentLicense="CC BY-SA 3.0" />
  <row Id="3852" PostTypeId="2" ParentId="3851" CreationDate="2013-11-04T22:54:05.883" Score="8" Body="&lt;p&gt;The PTR record doesn't have to be a valid FQDN. (for internal / non-internet DNS servers, this is not uncommon.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;1.1.168.192.in-addr.arpa. IN PTR i.saw.a.squirrel.&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-11-04T22:54:05.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3853" PostTypeId="2" ParentId="3851" CreationDate="2013-11-04T23:18:47.220" Score="13" Body="&lt;p&gt;This RFC explains the DNS system &lt;a href=&quot;http://www.ietf.org/rfc/rfc1035.txt&quot;&gt;http://www.ietf.org/rfc/rfc1035.txt&lt;/a&gt;. And most importantly, the section &quot;&lt;strong&gt;3.5. IN-ADDR.ARPA domain&lt;/strong&gt;&quot; explains how these names are set for reverse lookup of the IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yes, for intermittent hosts which are probably routers, one can set these to pretty much random names and these would turn up in the X.Y.Z.W.IN-ADDR.ARPA queries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The downside is that you can't really access that host throught the DNS name reported - but then, if they are part of the core infra, this should not be a major problem anyway.&lt;/p&gt;&#xA;" OwnerUserId="3136" LastActivityDate="2013-11-04T23:18:47.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3854" PostTypeId="1" CreationDate="2013-11-05T01:38:29.870" Score="0" ViewCount="6305" Body="&lt;p&gt;I have a topology like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC1 ------Switch&#xA;PC2 ------Layer --------- Router&#xA;PC3-------two&#xA;&#xA;PC1 192.168.1.34 VLAN 10.&#xA;&#xA;PC2 192.168.1.50 VLAN 20. &#xA;PC3 192.168.1.51 VLAN 20.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I configured a router on a stick to ping between any PC. Then, I want &lt;strong&gt;PC2 can ping PC1&lt;/strong&gt; and &lt;strong&gt;PC3 cannot ping PC1.&lt;/strong&gt; I use an access list to the switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;access-list 101 permit ip host 192.168.1.50 host 192.168.1.34&#xA;access-list 101 deny ip host 192.168.1.51 host 192.168.1.34&#xA;int f1/0&#xA;ip access-group 101 in&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it doesn't work. Can you tell me why? I've tried configuring to the router, but it's doesn't work, either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured in GNS3 which doesn't support access-map.&lt;/p&gt;&#xA;" OwnerUserId="2651" LastEditorUserId="8499" LastEditDate="2018-12-21T05:27:46.683" LastActivityDate="2018-12-21T05:27:46.683" Title="Block ICMP ping from a PC to a PC" Tags="|ping|acl|gns3|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3855" PostTypeId="2" ParentId="3854" CreationDate="2013-11-05T06:39:56.053" Score="1" Body="&lt;p&gt;Apply this ACL to the VLAN instead of the interface.&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-11-05T06:39:56.053" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3857" PostTypeId="2" ParentId="3851" CreationDate="2013-11-05T10:19:12.553" Score="5" Body="&lt;p&gt;This is almost certainly single host with many IP addresses routed to it and simple script to make it appear like it's traversing many hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Comparable hack for IPv6 can be seen here &lt;a href=&quot;https://github.com/job/ipv6-traceroute-faker&quot; rel=&quot;noreferrer&quot;&gt;https://github.com/job/ipv6-traceroute-faker&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like Ricky+Laazik say no limits what PTR can point to, like no limits where A can point to, just you won't be able to have it PTR -&gt; A -&gt; PTR unless you control both.&#xA;Obviously the person does not control A record for those hosts and couldn't have A resolve for them.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-11-05T10:19:12.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3863" PostTypeId="1" CreationDate="2013-11-05T22:24:49.190" Score="6" ViewCount="3060" Body="&lt;p&gt;May I have your opinion on the following matter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two 2911 routers.&#xA;Doing HSRP on Wan and LAN side with 2 standby groups.&#xA;Doing static NAT to internal servers.&#xA;Added redundacy keyword on the nat statements .&#xA;Tracking wan side interface in LAN side hsrp group and tracking&#xA;LAN side interface in WAN side hsrp group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All is working well but I discovered the following convergence time&#xA;Issues when HSRP failover.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;HSRP active device has a TCP translation in the table.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;HSRP active does a failover (shut the interface).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The failover goes well but the ip nat session table on the new active is updated with the TCP sessions after about 30s after the failover took place.&#xA;Seen from debugs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The new active device received  the NAT session table  update  message from the old active after 30 sec or more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My client wants the TCP session replication to take  place in less than 15s when a HSRP failover.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to make it work in less than 15s?&#xA;Also , what are the recommended ip nat translation timeout timers when doing HSRP and static NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I post  the config and debug messages: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debug messages:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;---Connecting to server on 80 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SPR2#telnet  10.31.71.20 80&#xA;Trying 10.31.71.20, 80 ... Open&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;--- NATGW1 is the hsrp active, simulate failover, shutdown the interface&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NATGW1(config-if)#shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;---  NATGW2 is the new active &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It moves from Standby to Active at 05:02:18.323 but receives the NAT session at Nov  5 05:02:48.604: .After 30 seconds. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NATGW2#debug ip nat detailed&#xA;IP NAT detailed debugging is on&#xA;NATGW2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It moves from Standby to Active at 05:02:18.323&#xA;*Nov  5 05:02:18.323: %HSRP-5-STATECHANGE: Ethernet0/1 Grp 200 state Standby -&gt; Active&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NATGW2#&#xA;*Nov  5 05:02:18.324: NAT: redundancy_update: Standby-&amp;gt;Active grp:OSE, Address:10.31.71.19&#xA;*Nov  5 05:02:18.324: NAT: Find alias : 10.31.71.19 Ethernet0/2&#xA;*Nov  5 05:02:18.324: NAT: Found alias&#xA;*Nov  5 05:02:18.325: NAT: Setup alias as Active&#xA;*Nov  5 05:02:18.325: NAT: redundancy_update: Standby-&amp;gt;Active grp:OSE, Address:10.31.71.20&#xA;*Nov  5 05:02:18.329: NAT: Find alias : 10.31.71.20 Ethernet0/2&#xA;*Nov  5 05:02:18.329: NAT: Found alias&#xA;*Nov  5 05:02:18.330: NAT: Setup alias as Active&#xA;NATGW2#&#xA;*Nov  5 05:02:19.377: %HSRP-5-STATECHANGE: Ethernet0/2 Grp 100 state Standby -&amp;gt; Active&#xA;NATGW2#&#xA;*Nov  5 05:02:21.399: NAT: redundancy_update: Active-&amp;gt;Active grp:OSE, Address:10.31.71.19&#xA;*Nov  5 05:02:21.399: NAT: Find alias : 10.31.71.19 Ethernet0/2&#xA;*Nov  5 05:02:21.399: NAT: Found alias&#xA;*Nov  5 05:02:21.399: NAT: Setup alias as Active&#xA;*Nov  5 05:02:21.400: NAT: redundancy_update: Active-&amp;gt;Active grp:OSE, Address:10.31.71.20&#xA;*Nov  5 05:02:21.400: NAT: Find alias : 10.31.71.20 Ethernet0/2&#xA;*Nov  5 05:02:21.400: NAT: Found alias&#xA;*Nov  5 05:02:21.400: NAT: Setup alias as Active&#xA;NATGW2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;receives the NAT session at Nov  5 05:02:48.604:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Nov  5 05:02:48.604: NAT: API parameters passed: src_addr:192.168.153.90, src_port:0 dest_addr:10.31.71.252, dest_port:0, proto:6 if_input:Ethernet0/1 pak:B046DD78 get_translated:1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Config:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NATGW1#show run | sec nat&#xA; ip nat inside&#xA; ip nat outside&#xA;ip nat inside source static 192.168.153.99 10.31.71.19 redundancy OSE&#xA;ip nat inside source static 192.168.153.90 10.31.71.20 redundancy OSE&#xA;&#xA;&#xA;NATGW2#show run | sec nat&#xA; ip nat inside&#xA; ip nat outside&#xA;ip nat inside source static 192.168.153.99 10.31.71.19 redundancy OSE&#xA;ip nat inside source static 192.168.153.90 10.31.71.20 redundancy OSE&#xA;&#xA;&#xA;NATGW1#show standby&#xA;Ethernet0/1 - Group 200&#xA;  State is Active&#xA;    8 state changes, last state change 00:02:27&#xA;  Virtual IP address is 192.168.153.253&#xA;  Active virtual MAC address is 0000.0c07.acc8&#xA;    Local virtual MAC address is 0000.0c07.acc8 (v1 default)&#xA;  Hello time 3 sec, hold time 10 sec&#xA;    Next hello sent in 2.944 secs&#xA;  Preemption enabled&#xA;  Active router is local&#xA;  Standby router is 192.168.153.252, priority 105 (expires in 9.792 sec)&#xA;  Priority 110 (configured 110)&#xA;    Track interface Ethernet0/2 state Up decrement 10&#xA;  Group name is &quot;OSE&quot; (cfgd)&#xA;Ethernet0/2 - Group 100&#xA;  State is Active&#xA;    11 state changes, last state change 00:02:28&#xA;  Virtual IP address is 10.31.71.103&#xA;  Active virtual MAC address is 0000.0c07.ac64&#xA;    Local virtual MAC address is 0000.0c07.ac64 (v1 default)&#xA;  Hello time 3 sec, hold time 10 sec&#xA;    Next hello sent in 0.352 secs&#xA;  Preemption enabled&#xA;  Active router is local&#xA;  Standby router is 10.31.71.102, priority 105 (expires in 9.584 sec)&#xA;  Priority 110 (configured 110)&#xA;    Track interface Ethernet0/1 state Up decrement 10&#xA;  Group name is &quot;hsrp-Et0/2-100&quot; (default)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks for helping. &lt;/p&gt;&#xA;" OwnerUserId="1860" LastEditorUserId="76" LastEditDate="2013-11-06T20:02:03.190" LastActivityDate="2013-11-07T10:51:57.870" Title="HSRP and Static NAT behavior" Tags="|nat|hsrp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3865" PostTypeId="1" CreationDate="2013-11-06T03:25:26.970" Score="3" ViewCount="1801" Body="&lt;p&gt;Please refer to the network diagram below, it is a very simplified version of an actual network installation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Router has 3 Vlans, OSPF has been configured and all the 3 vlans have been added to Area 0 so they can communicate with each other.&#xA;The Switch is a PnP Layer 2 managed switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the current setup, we are facing an issue: End Device 1 cannot communicate with End Device 2.&#xA;However, if we break the link between the Switch and Vlan2, the 2 End Devices are able to communicate with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody please explain why this phenomenon is occuring, and how it can be solved while maintaining both the connections from the switch to the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/k3tLu.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Router is an Extreme Summit X450a device. Refer to the sample config below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;create vlan “VLAN1”&#xA;configure vlan VLAN1 tag 10&#xA;configure vlan VLAN1 add ports 1-4 untagged&#xA;configure vlan VLAN1 ipaddress 10.0.0.1 255.255.255.0&#xA;&#xA;create vlan “VLAN2”&#xA;configure vlan VLAN2 tag 20&#xA;configure vlan VLAN2 add ports 5-8 untagged&#xA;configure vlan VLAN2 ipaddress 10.0.1.1 255.255.255.0&#xA;&#xA;create vlan “VLAN3”&#xA;configure vlan VLAN3 tag 30&#xA;configure vlan VLAN3 add ports 9-12 untagged&#xA;configure vlan VLAN3 ipaddress 10.0.2.1 255.255.255.0&#xA;&#xA;enable ipforwarding vlan VLAN1&#xA;enable ipforwarding vlan VLAN2&#xA;enable ipforwarding vlan VLAN3&#xA;&#xA;enable ipmcforwarding vlan VLAN1&#xA;enable ipmcforwarding vlan VLAN2&#xA;enable ipmcforwarding vlan VLAN3&#xA;&#xA;configure ospf routerid 10.0.2.1&#xA;enable ospf&#xA;configure ospf add vlan VLAN1 area 0.0.0.0&#xA;configure ospf add vlan VLAN2 area 0.0.0.0&#xA;configure ospf add vlan VLAN3 area 0.0.0.0&#xA;&#xA;configure pim add vlan VLAN1 dense&#xA;configure pim add vlan VLAN2 dense&#xA;configure pim add vlan VLAN3 dense&#xA;enable pim&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3153" LastEditorUserId="8499" LastEditDate="2018-12-21T05:04:58.287" LastActivityDate="2018-12-21T05:04:58.287" Title="Routing of 2 Gateways via a Layer 2 Switch" Tags="|routing|switch|ospf|layer2|layer3|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="3866" PostTypeId="2" ParentId="3865" CreationDate="2013-11-06T06:39:56.423" Score="4" Body="&lt;p&gt;The Extreme Summit X450a is actually a L3 switch, not a router, so your problem is most likley that spanning tree is putting the second (VLAN3) inter-switch link in blocking mode.  When you disconnect the first (VLAN2) inter-switch link, STP transitions the second link to forwarding mode making the second station reachable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of two links carrying one VLAN each, you should be using a single tagged or trunk port between the two switches.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-11-06T06:57:48.167" LastActivityDate="2013-11-06T06:57:48.167" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="3867" PostTypeId="2" ParentId="3843" CreationDate="2013-11-06T06:46:46.413" Score="5" Body="&lt;p&gt;Turns out there was an implicit rule in the firewall defined on the bridge which dropped fragmented packets. This is not shown in the normal firewall overview.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ended up turning off this 'feature' in the system -&gt;advanced -&gt; firewall/NAT section.&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-11-06T06:46:46.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3873" PostTypeId="2" ParentId="3697" CreationDate="2013-11-06T18:05:56.543" Score="263" Body="&lt;p&gt;The &lt;code&gt;/&amp;lt;number&amp;gt;&lt;/code&gt; is how a computer can quickly calculate what is part of its network and what is not.  It represents the bit length of the subnet mask, as indicated above.  The subnet mask is like masking when painting.  You place a mask over what you DO NOT want to paint on.  The subnet mask is a way to calculate the network portion of the address space and the host address space.  The network address space is assigned to you, the host address space you define which device receives what address in the host space.&lt;/p&gt;&#xA;&lt;p&gt;A computer performs binary math of ANDing the IP address and the network mask.&lt;/p&gt;&#xA;&lt;p&gt;IP Address 10.10.15.10/16&lt;/p&gt;&#xA;&lt;p&gt;Step 1)&#xA;Translate the IP address 4 octets into binary: 00001010.00001010.00001111.00001010&lt;br&gt;&lt;br&gt;&#xA;Step 2)&#xA;Translate the Subnet mask 4 octets into binary, which is easy using &lt;a href=&quot;http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing&quot; rel=&quot;noreferrer&quot;&gt;CIDR&lt;/a&gt;: 11111111.11111111.00000000.00000000&lt;br&gt;&lt;br&gt;&#xA;Step 3)&#xA;Perform the ANDing operation on the two addresses.  This will give you the Network Address for the subnet.&lt;/p&gt;&#xA;&lt;p&gt;ANDing rules are as follows:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 AND 1 = 1&lt;/li&gt;&#xA;&lt;li&gt;0 AND 1 = 0&lt;/li&gt;&#xA;&lt;li&gt;0 AND 0 = 0&lt;/li&gt;&#xA;&lt;li&gt;1 AND 0 = 0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;pre&gt;&#xA;         00001010.00001010.00001111.00001010&#xA;     AND 11111111.11111111.00000000.00000000&#xA;         ———————————————————————————————————&#xA;         00001010.00001010.00000000.00000000&#xA;&lt;/pre&gt;&#xA;&lt;p&gt;Step 4)&#xA;Convert it back to decimal: 10.10.0.0&lt;/p&gt;&#xA;&lt;p&gt;So now  a computer knows that any address from 10.10.0.0 to 10.10.255.255 is part of its network and any other address is not.&lt;/p&gt;&#xA;&lt;p&gt;It's like a binary network gang thing, you are in or you are not.&lt;/p&gt;&#xA;" OwnerUserId="3159" LastEditorUserId="85981" LastEditDate="2023-05-27T12:20:28.130" LastActivityDate="2023-05-27T12:20:28.130" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="3875" PostTypeId="2" ParentId="3121" CreationDate="2013-11-06T18:32:09.803" Score="3" Body="&lt;p&gt;With throughput defined as the amount of data transferred from point A to point B in a period of time.  The significant variables in throughput are: Latency, Packet Size, and Retransmissions (quality). This was proven with the Mathis Equation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.slac.stanford.edu/comp/net/wan-mon/thru-vs-loss.html&quot; rel=&quot;nofollow&quot;&gt;http://www.slac.stanford.edu/comp/net/wan-mon/thru-vs-loss.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP Basics:  TCP connections establish a session with a SYN, the receiving machine sends and ACK, Then data flows.  When the window (setting in windows saying how much data to collect before it asks for validation/acknowledgement of receipt) fills up another set of acknowledgements are sent to start the next flow of data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your environment has the default MTU of 1500, and you introduce a device that has an MTU of 1460, this will slow down your network because all packets flowing through the device will be fragmented; when the 1500 packet hits the device with MTU of 1460 it will fragment the packet into two packets and transmit it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have Jumbo frames enabled and your MTU is 9220 you will get much higher throughput, 5 times higher.  Each payload is larger even though the packet has the same latency. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short:&#xA;Throughput is conditional and depended on both host and network device settings.  Use the Mathis Equation as a guide for what you could expect with the given data points for your network.  Validate your findings and verify units; Megabit/sec and Megabyte or Kilobit and Kilobyte are not the same.&lt;/p&gt;&#xA;" OwnerUserId="3159" LastActivityDate="2013-11-06T18:32:09.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3877" PostTypeId="1" CreationDate="2013-11-06T22:22:41.080" Score="4" ViewCount="1721" Body="&lt;p&gt;I have 2 brand new Dell 5448 1 Gbps switches and an older 3448P. The newer switches stack with each other via an HDMI cable and have the ports for fiber optic, but the older 3448P switch has no HDMI ports, the ports for fiber (G1 &amp;amp; G2) and 2 1Gbps ports (G3 &amp;amp; G4) labeled 'Stacking'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to keep the 3448P in use for PoE devices and as a backup switch, can I add this unit to the stack? How would I do that? Link the 2 new switches with HDMI then run fiber from switch 2 to the 3448P then out of the 3448P back up to switch 1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could always just forget about the 3448P and do PoE injectors, but I like having the 3rd there for more ports and as a backup.&lt;/p&gt;&#xA;" OwnerUserId="3161" LastActivityDate="2018-02-22T04:37:09.900" Title="Stacking Different Model Dell Switches" Tags="|switch|dell|stacking|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3878" PostTypeId="1" AcceptedAnswerId="3880" CreationDate="2013-11-07T02:51:07.587" Score="16" ViewCount="12167" Body="&lt;p&gt;I'm investigating a complaint of poor performance from an end user accessing a site I help maintain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have these two mtr outputs to the end user, the first from the site:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                       Packets               Pings&#xA; Host                                Loss%   Snt   Last   Avg  Best  Wrst StDev&#xA; 1. 198.199.92.253                    0.0%   200    7.3   4.2   0.9  89.6   8.0&#xA; 2. 69.22.130.37                      0.0%   200    0.4   2.5   0.3  51.4   8.0&#xA; 3. 69.22.143.170                    42.5%   200    1.3   2.0   1.1  47.9   4.9&#xA; 4. 69.22.143.165                     0.0%   200    2.3   6.4   1.6  56.9   9.7&#xA; 5. 206.223.116.86                    0.0%   200    2.5   3.0   1.8  14.1   1.5&#xA; 6. 64.125.24.1                       0.0%   200    3.0   6.9   2.2  65.7   9.9&#xA; 7. 64.125.26.230                     0.0%   200   56.3  61.4  55.6 119.0  10.0&#xA; 8. 64.125.24.33                      0.5%   200   76.4  78.9  76.0 116.1   7.1&#xA; 9. 64.125.29.38                      0.0%   200   73.9  77.5  73.4 238.8  13.4&#xA;10. 64.125.31.181                     0.5%   200  160.0 159.4 156.2 181.4   4.3&#xA;11. 64.125.32.93                      0.0%   200  156.9 157.8 155.9 217.0   6.8&#xA;12. 62.253.174.190                    0.0%   200  166.0 166.5 165.6 172.8   1.2&#xA;13. 62.253.175.217                    0.0%   200  162.1 163.1 161.7 200.4   4.2&#xA;14. 213.105.159.194                   0.0%   200  163.8 165.0 163.4 241.2   8.3&#xA;15. 81.97.112.218                     0.0%   200  164.7 166.5 164.5 220.0   7.4&#xA;16. ???&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the second from my network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                       Packets               Pings&#xA; Host                                Loss%   Snt   Last   Avg  Best  Wrst StDev&#xA; 1. 216.16.235.1                      0.0%   115    0.4   0.4   0.3   0.6   0.1&#xA; 2. 216.16.232.37                     0.0%   115    0.9   0.9   0.6  18.8   1.7&#xA; 3. 216.16.255.141                    0.0%   115    0.8   0.7   0.6   1.1   0.1&#xA; 4. 216.16.255.130                    0.0%   114    1.0   1.0   0.8   1.4   0.1&#xA; 5. 24.153.3.141                      0.0%   114    1.9   3.6   1.5   6.5   1.2&#xA; 6. 64.71.241.97                      0.0%   114    3.4   5.3   3.3   7.4   1.1&#xA; 7. ???&#xA; 8. 64.124.128.193                   34.5%   114   18.9  19.2  18.7  39.0   2.3&#xA; 9. 64.125.21.74                      0.0%   114   19.2  20.4  18.9  49.9   5.0&#xA;10. 64.125.29.38                      0.0%   114   19.3  23.1  19.2  48.3   7.6&#xA;11. 64.125.27.186                     0.9%   114  105.2 106.1 105.1 137.8   3.2&#xA;12. 64.125.32.93                      0.0%   114  106.3 107.1 106.1 163.3   5.8&#xA;13. 62.253.174.190                    0.0%   114  181.8 123.5 115.8 206.3  20.9&#xA;14. 62.253.175.217                    0.0%   114  113.8 114.8 113.6 144.3   4.2&#xA;15. 213.105.159.194                   0.0%   114  115.3 115.9 115.2 163.5   4.6&#xA;16. 81.97.112.218                     0.0%   114  113.3 114.4 113.2 140.7   4.5&#xA;17. ???&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How should I interpret those hops with MASSIVE packet loss? I'm inclined to think those hops have some sort of asymmetric routing going on and one of the paths is congested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could this cause any problem for the end user?&lt;/p&gt;&#xA;" OwnerUserId="573" LastEditorUserId="775" LastEditDate="2013-11-07T10:26:30.900" LastActivityDate="2013-11-07T10:26:30.900" Title="mtr output with high packet loss on one hop" Tags="|routing|ipv4|troubleshooting|mtr|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3879" PostTypeId="2" ParentId="3878" CreationDate="2013-11-07T05:52:42.697" Score="1" Body="&lt;p&gt;I'll preface this by saying that yes, the routing you mention could be part of it. It would be the route BACK to your host from that hop that is taking a congested path that the others aren't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guy thinking: if this was a problem in the data plane on that particular router, I would expect to see packet loss for all hops after this hop - but you don't see that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the TTL of a packet reaches 0, it's up to control plane on the router to generate the ICMP response back to the sending host. My guess is that the control plane  CPU (at the point in time you were performing the trace) on that particular router is highly utilised, and its sending some responses back to you outside the timeout value of MTR.&lt;/p&gt;&#xA;" OwnerUserId="1682" LastActivityDate="2013-11-07T05:52:42.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3880" PostTypeId="2" ParentId="3878" CreationDate="2013-11-07T05:52:43.987" Score="16" Body="&lt;p&gt;MTR uses ICMP, which is often rate limited on the internet due to how it can be misused to created problems (high CPU, wasted bandwidth, DoS, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you see output like this, generally this is a sign that rate limiting for ICMP is in place.  With a quick web search I found this &lt;a href=&quot;https://library.linode.com/linux-tools/mtr#sph_icmp-rate-limiting&quot;&gt;documentation&lt;/a&gt; regarding using MTR.  While it is not official it looks decent (at least with a quick scan) and provides examples of some problems you may find using MTR.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-11-07T05:52:43.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3881" PostTypeId="2" ParentId="3878" CreationDate="2013-11-07T06:09:27.077" Score="14" Body="&lt;p&gt;As @YLearn already wrote ICMP ratelimiting on the router with packetloss might well be the cause, because replying to ICMP requests is done in CPU while forwarding of packets is usually done in the ASICs. So this does not need to be a problem at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A very good guide on interpreting traceroute (and MTR) output was written by Richard Steenbergen a few years ago. He did a nice &lt;a href=&quot;http://www.nanog.org/meetings/nanog47/presentations/Sunday/RAS_Traceroute_N47_Sun.pdf&quot;&gt;presentation&lt;/a&gt; on it at NANOG.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-11-07T06:09:27.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3882" PostTypeId="2" ParentId="3863" CreationDate="2013-11-07T08:27:53.353" Score="7" Body="&lt;p&gt;I have found the issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem was my testing procedure. &#xA;I simulated the http connection using telnet to http port but I did not generate any traffic(requests).  I repeated the tests using GET requests and the nat session table was replicated almost instant.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I post the debug messages. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NAT replication trigger is the next segment, request in the tcp session. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Debug messages &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Telnet from client &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;telnet 10.31.73.12 3099 &#xA;*Nov  7 03:52:17.071: TCBB2701B60 connected to 10.31.73.12.3099&#xA;GET / HTTP/1.0&#xA;GET / HTTP/1.0&#xA;GET / HTTP/1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;New active &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Becomes Active at 03:52:32,34  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NATGW2#&#xA;*Nov  7 03:52:32.700: %HSRP-5-STATECHANGE: Ethernet0/2 Grp 100 state Standby -&amp;gt; Active&#xA;NATGW2#&#xA;*Nov  7 03:52:32.701:  IP-ADDR: ipaddr_table_insert_w_tableid() 10.31.71.254, in global table on Ethernet0/2&#xA;NATGW2#&#xA;*Nov  7 03:52:34.657: %HSRP-5-STATECHANGE: Ethernet0/1 Grp 200 state Standby -&amp;gt; Active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;new Active listens for ARP requests for the HSRP IP&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Nov  7 03:52:34.658:  IP-ADDR: ipaddr_table_insert_w_tableid() 192.168.153.253, in global table on Ethernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The nat session is recreated on the new Active. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Nov  7 03:52:34.745: NAT: API parameters passed: src_addr:10.31.71.3, src_port:0 dest_addr:10.31.73.12, dest_port:0, proto:6 if_input:Ethernet0/2 pak:B072F0A8 get_translated:1&#xA;*Nov  7 03:52:34.745: ipnat_api_translated_address_and_port_common, out-&amp;gt;in want IL,OL&#xA;*Nov  7 03:52:34.745: NAT: API Translated-Info(1): (src-addr:10.31.71.3, src-port:0) (dest-addr:192.168.153.12, dest-port:0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1860" LastEditorUserId="775" LastEditDate="2013-11-07T10:51:57.870" LastActivityDate="2013-11-07T10:51:57.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="3884" PostTypeId="1" AcceptedAnswerId="3885" CreationDate="2013-11-07T16:48:24.387" Score="8" ViewCount="6462" Body="&lt;p&gt;I would like to know the command to configure CLI on cisco equipment to make the cursor move to the new line right away after it showed the message. &#xA;&lt;strong&gt;So for example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#&#xA;Router#&#xA;*00:00:00: Interface Ethernet0 chaged state to up.Link blablalba* ***(cursor is here)**** &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then the cursor stays on the same line where the message was displayed..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want it to move to the next line right away automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#&#xA;Router#&#xA;00:00:00: Interface Ethernet0 chaged state to up. Line protocol blablalba&#xA;Router#****(cursor is here)**** &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3165" LastEditorUserId="762" LastEditDate="2013-11-07T19:18:43.607" LastActivityDate="2013-11-07T21:06:19.370" Title="How to make CLI enter new line automatically" Tags="|cisco|router|cli|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="3885" PostTypeId="2" ParentId="3884" CreationDate="2013-11-07T16:55:59.803" Score="7" Body="&lt;p&gt;I think you're looking for &quot;logging synchronous&quot;.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastEditorUserId="2104" LastEditDate="2013-11-07T21:06:19.370" LastActivityDate="2013-11-07T21:06:19.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3887" PostTypeId="2" ParentId="3884" CreationDate="2013-11-07T17:46:38.677" Score="14" Body="&lt;p&gt;Specifically, you're looking for this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line con 0&#xA; logging synchronous&#xA;line vty 0 15&#xA; logging synchronous&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="155" LastActivityDate="2013-11-07T17:46:38.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3889" PostTypeId="2" ParentId="3877" CreationDate="2013-11-08T02:49:11.270" Score="2" Body="&lt;p&gt;Went trough the Dell documents and it doesn't explicitly say anything either way about stacking different platforms together.  However the complete lack of documentation regarding stacking different devices together sends a pretty clear message that they are only intended to stack with devices of the same model/line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More generally, most stacking solutions require that the the stacking technologies and the software versions be the same for switches to participate in a stack.  I am not sure if you can run the same version of code for the two platforms, but clearly the stacking technologies are different.  While there appear to be other differences in the stacking technologies as well, I will simply state that there is no way to connect the 10Gig HDMI stacking ports to the 1Gig RJ45 stacking ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can keep the older 3448P switch and use it, but it will have to be configured and managed separately. The &quot;stacking&quot; ports on the 3448P should be usable 1Gig ports and can t hen be used to connect to your new switches as noted in the &lt;a href=&quot;ftp://ftp.dell.com/Manuals/all-products/esuprt_ser_stor_net/esuprt_powerconnect/powerconnect-3448p_User%27s%20Guide_en-us.pdf&quot; rel=&quot;nofollow&quot;&gt;Dell documentation for the 34xx switches&lt;/a&gt; (&quot;two Copper ports which can be used to forward traffic in a stand-alone device, or as stacking ports when the device is stacked&quot;).  Exact configuration of the devices would be entirely dependent on your environment (do you need tagged/trunk links, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw, I can't find documentation of stacking for the 5448 (aside from the occasional use of the word &quot;stack&quot; and most of those had to do with dual stack IPv4/IPv6), so I am guessing that you meant to type 5548 which matches your description.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-11-08T02:49:11.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3894" PostTypeId="1" AcceptedAnswerId="6053" CreationDate="2013-11-08T10:36:02.783" Score="6" ViewCount="8318" Body="&lt;p&gt;Iam trying to configure a network that looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sSM1S.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Vlans and static routing seams to work fine, i am able to ping between the VLANs. My problem is, when i try to make a connection to the internet, I get a time out when trying to ping, i am aware that i need to configure some sort of NAT. But cant quite figure out what goes wrong. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to create a Policy Route, when i apply the policy but there is a unstable pattern in the replies, got a lot of timeouts, then at ones there is connectivity for a while and then it dies again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are screenshots of my configurations on FW1 and SW1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;FW1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network -&gt; Interface -&gt; VLAN&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/kklnb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network -&gt; Interface -&gt; Port Role&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yEajq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network -&gt; Routing -&gt; Static Route&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/st00s.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network -&gt; Routing -&gt; Policy Route&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have only added a rule and tested for the 102 vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/LtbBE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SW1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration -&gt; VLANs -&gt; VLAN Membership&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ng8cV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration -&gt; VLANs -&gt; Ports&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/z1uJP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3175" LastActivityDate="2018-10-25T22:23:24.257" Title="Zyxel USG100. GS1910 Vlans cannot access wan" Tags="|vlan|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3895" PostTypeId="1" AcceptedAnswerId="3896" CreationDate="2013-11-08T10:44:29.747" Score="6" ViewCount="1934" Body="&lt;p&gt;I'm in the process of replacing some switch blades and i'm looking through the &lt;code&gt;show port usage&lt;/code&gt; command on the older catos switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm struggling to understand the output for the &lt;code&gt;show port usage&lt;/code&gt; command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(enable) show port usage 6/47&#xA;&#xA;Port  Status          Last-Transition-Time&#xA;...&#xA;6/47  connected       Mon Sep 16 2013, 16:11:25    &amp;lt;------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That is my machine but I've restarted my machine since Sept 16th numerous times. Does restarting my machine not affect the transitioning which assume refers to rstp? (We're looking at this to see what ports we can safely unplug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We do have a port tracking tool, but I'm cross checking this on the switch to make sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These ports have portfast enabled which is what I'm thinking is the cause of this, but there is no information available that describes this command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="2645" LastEditorUserId="775" LastEditDate="2013-11-08T10:50:39.830" LastActivityDate="2013-11-08T10:59:02.807" Title="Cisco CatOS - show port usage output" Tags="|switch|cisco-catalyst|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="3896" PostTypeId="2" ParentId="3895" CreationDate="2013-11-08T10:52:24.603" Score="8" Body="&lt;p&gt;As you found, the port is plugged into a phone; so until the phone cycles the port will stay up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00800b1500.shtml&quot;&gt;&lt;code&gt;portfast&lt;/code&gt;&lt;/a&gt; command; when a switchport comes up, &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00800b1500.shtml#bkg&quot;&gt;spanning-tree moves through a series of states to bring the port up&lt;/a&gt;.  Legacy spanning-tree took 15 seconds in the Listening state and another 15 seconds learning.  During that time, the port cannot actually transmit traffic.  &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps708/products_tech_note09186a00800b1500.shtml&quot;&gt;&lt;code&gt;portfast&lt;/code&gt;&lt;/a&gt; is a shortcut to make the port transition to a forwarding state very quickly, which is what you want as long as no switches are connected to the port.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-11-08T10:59:02.807" LastActivityDate="2013-11-08T10:59:02.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3898" PostTypeId="1" CreationDate="2013-11-08T14:55:03.690" Score="3" ViewCount="7495" Body="&lt;p&gt;I just setup a nexus 5020 and while I know it's primary purpose is to be used as an L2 device, according to docs, I should still be able to set a default route in the global routing table.  However, it does not seem to be working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My setup is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nexus 5020 &amp;lt;---&amp;gt; Core L3 device&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I could not use the mgmt0 interface on the 5020 and have to set the mgmt ip on a vlan.  I have the ports trunked between the 5020 and the core l3 device.  I configured a default route on the 5020 however I am not able to ping out from the nexus nor reach the ip configured on the mgmt vlan from the outside world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts as to what I may be missing?&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="775" LastEditDate="2013-11-09T10:54:27.213" LastActivityDate="2018-12-23T22:30:29.187" Title="Nexus 5020 default route" Tags="|routing|cisco-nexus-5k|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3901" PostTypeId="1" AcceptedAnswerId="3902" CreationDate="2013-11-08T23:50:10.473" Score="2" ViewCount="847" Body="&lt;p&gt;Say for example I combine 16 existing prefixes which have '/12' netmask length, how would I calculate the netmask length of the new address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to combine 2 addresses, but not sure how to go about with this?&lt;/p&gt;&#xA;" OwnerUserId="3035" LastActivityDate="2013-11-09T10:38:04.070" Title="Calculating netmask length when combing network prefixes" Tags="|ipv4|subnet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3902" PostTypeId="2" ParentId="3901" CreationDate="2013-11-09T01:46:23.620" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I know how to combine 2 addresses...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's the exact same &quot;power of 2&quot; math... 2 = 2^1, so 2 /12's equal (12-1) /11.  16 = 2^4, so 16 /12's become a (12-4) /8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;In theory&lt;/em&gt;, in practice, the /12's may not fall on an even power of 2. [See Also: &lt;a href=&quot;http://checkforbees.com/subnet.html&quot; rel=&quot;nofollow&quot;&gt;Subnet Table&lt;/a&gt;] x.0/12 and x.16/12 can form x.0/11, but x.16/12 and x.32/12 cannot form x.16/11 (because 16 is the middle of x.0/11)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-11-09T01:46:23.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3904" PostTypeId="2" ParentId="3898" CreationDate="2013-11-09T04:03:17.653" Score="2" Body="&lt;p&gt;the management interface is in its own vrf, so in fact it can have 2 default routes one for the management adapter (vrf management) and if you enable SVIs you can put a default route in the default context. Also you have to ping from the box in the management context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vrf context management&#xA;  ip route 0.0.0.0/0 10.2.1.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;interface mgmt0&#xA;  ip address 10.2.7.50/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ping 10.2.1.1 vrf management&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See this&#xA;&lt;a href=&quot;https://supportforums.cisco.com/thread/344177&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/thread/344177&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-11-09T04:03:17.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3905" PostTypeId="2" ParentId="3901" CreationDate="2013-11-09T09:30:22.780" Score="4" Body="&lt;p&gt;The &lt;code&gt;aggregate&lt;/code&gt; tool written by Joe Abley (available in Ubuntu, probably in other Linux distribution as well) can be useful:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% aggregate&#xA;aggregate: maximum prefix length permitted will be 32&#xA;10.0.0.0/12&#xA;10.16.0.0/12&#xA;10.32.0.0/12&#xA;10.48.0.0/12&#xA;10.64.0.0/12&#xA;10.128.0.0/12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Results in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.0/10&#xA;10.64.0.0/12&#xA;10.128.0.0/12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-11-09T09:30:22.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3906" PostTypeId="2" ParentId="3901" CreationDate="2013-11-09T10:38:04.070" Score="4" Body="&lt;p&gt;I simply write them out and work it out. As an example let's take the following few prefixes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.32.0.0/16&#xA;10.45.0.0/16&#xA;10.37.0.0/16&#xA;.&#xA;.&#xA;.etc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They all match on the first octect so no worries. You need to figure out where they match on the first different octect. In the example above we write them out and convert them to binary. Make a note of where they are the same in binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;32&#xA;37&#xA;45&#xA;&#xA;00100000&#xA;00100101&#xA;00101101&#xA;----xxxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above all match in the first four bits, and so that becomes the boundary. The amount of bits also tells you the slash you're going to use. You then use the 'all zeros' address as the subnet. In the above example, they all match up to the 4th bit in the second octect. Each octect is 8 bits and so the new bit boundry becomes 8 + 4 = 12. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so our end result of the above is: 10.32.0.0/12&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-11-09T10:38:04.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="3907" PostTypeId="1" AcceptedAnswerId="3908" CreationDate="2013-11-09T15:54:56.007" Score="7" ViewCount="3364" Body="&lt;p&gt;I am a bit confused about the CISCO IOS operating system. My final year research project is based on solving some security vulnerabilities that i dug up that exists in the CISCO IOS, thus i need to find a CISCO router to implement my solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a very non technical question, but will any of you experts would be willing to help me to find a CISCO product that uses the CISCO IOS or does every product from CISCO use the CISCO IOS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried searching in many ways but could find any :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="2563" LastActivityDate="2013-11-28T02:57:15.260" Title="Devices that utilizes CISCO IOS Operating system" Tags="|cisco|cisco-ios-12|cisco-ios-15|cisco-ios|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="3908" PostTypeId="2" ParentId="3907" CreationDate="2013-11-09T16:13:57.337" Score="14" Body="&lt;p&gt;Cisco IOS is the standard operating system from Cisco. It runs on 800/1800/1900/2800/2900/3800/3900/7600 routers. It also runs on Catalyst 2960/3560/3750/4500/6500.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some newer platforms such as Catalyst 3650 and 3850 run IOS XE which is IOS running as a daemon on a Linux kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you have NXOS which runs on the Nexus platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IOS XR runs on the SP platforms such as ASR9k.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-11-09T16:13:57.337" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="3909" PostTypeId="1" AcceptedAnswerId="4910" CreationDate="2013-11-09T17:54:39.187" Score="24" ViewCount="58077" Body="&lt;p&gt;Can anyone explain why we need iBGP for the routes when we have the IGP protocols (OSPF, RIP) for internal communication within the AS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read a lot of articles and books, but I could not find the answer.&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="53804" LastEditDate="2019-01-20T21:11:40.863" LastActivityDate="2023-07-19T19:43:01.230" Title="Why use iBGP inside an Autonomous System, if IGP protocols fulfill the need for internal communication" Tags="|routing|router|bgp|ospf|igp|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="4909" PostTypeId="2" ParentId="3909" CreationDate="2013-11-09T18:11:28.790" Score="7" Body="&lt;p&gt;One reason I've seen quite often is clarity: all routes are carried within one routing protocol (BGP), IS-IS, OSPF or RIP is only used for adjacency. As a result there is no need to redistribute routes from one routing protocol to another.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-11-09T18:11:28.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4910" PostTypeId="2" ParentId="3909" CreationDate="2013-11-09T18:41:56.340" Score="28" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Can anyone explain me what is the need of IBGP communication for the routes, when we have the IGP protocols (OSPF, RIP) for internal communication?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Scalability&lt;sup&gt;1&lt;/sup&gt;: Imagine that you're receiving 500,000 EBGP routes in more than one location&lt;sup&gt;2&lt;/sup&gt;, and you need to influence the per route exit point in your AS.  BGP can handle many more routes than IGP protocols. Thus, iBGP is required unless you're willing to redistribute all the routes you've learned via eBGP&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Enforce boundaries of trust / control: BGP has more ways to filter peers than IGPs (for controlling what you advertise and receive).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Flexible data structures (somewhat related to the previous bullet): &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a00801475b2.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP communities&lt;/a&gt;, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4360&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP Extended communities&lt;/a&gt;, &lt;a href=&quot;http://bgpconcepts.blogspot.com/2008/11/bgp-local-preference-attribute.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;local-pref&lt;/a&gt;, etc... these make BGP an attractive way to implement custom routing policies within your own autonomous system (by using iBGP).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;As with everything there are trade offs; the scalability, control, and flexibility you get from iBGP means that it's a slower converging protocol than IGPs (in general).&lt;/p&gt;&#xA;&lt;hr&gt;&#xA;&lt;h3&gt;End Notes:&lt;/h3&gt;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt; &lt;em&gt;Scalability&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You use BGP because you don't want to carry your entire internet routing table in your IGP (i.e. in my case, OSPF)...&lt;/li&gt;&#xA;&lt;li&gt;OSPF was not designed to handle many thousands of routes in internet BGP tables... if you try to use OSPF for this purpose, it will break your network.  Using the example of OSPF, the LSA processing / flooding requirements from 500,000 routes uses too many resources in your routers.  Name any other IGP (EIGRP, RIPv1/2, IS-IS, IGRP) and the same story is true.&lt;/li&gt;&#xA;&lt;li&gt;There have been some notorious instances where a Tier-1 ISP accidentally redistributed their BGP table into their IGP (even when the internet table was a small fraction of its current size) and it caused major outages.  Countermeasures have now been implemented in IGP protocols (&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/fsoredis.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;like this one for OSPF in IOS&lt;/a&gt;) to prevent redistribution from BGP into OSPF from causing a major outage.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;sup&gt;2&lt;/sup&gt; &lt;em&gt;iBGP routing example&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;p&gt;To understand why you might want iBGP, consider this routing entry to 4.2.2.2...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;R2&amp;gt;sh ip bgp 4.2.2.2&#xA;BGP routing table entry for 4.0.0.0/9, version 3146&#xA;Paths: (32 available, best #7, table Default-IP-Routing-Table)&#xA;... &amp;lt;!-- extra BGP RIB entries deleted --&amp;gt;&#xA;  7660 2516 3356, (aggregated by 3356 4.69.130.4)&#xA;    203.181.248.168 from 203.181.248.168 (203.181.248.168)&#xA;      Origin IGP, localpref 100, valid, internal, atomic-aggregate&#xA;      Community: 2516:1030&#xA;  3356, (aggregated by 3356 4.69.130.6)&#xA;    4.69.184.193 from 4.69.184.193 (4.69.184.193)&#xA;      Origin IGP, metric 0, localpref 100, valid, internal, atomic-aggregate, best&#xA;      Community: 3356:0 3356:3 3356:100 3356:123 3356:575 3356:2012&#xA;... &amp;lt;!-- extra BGP RIB entries deleted --&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;There are 32 paths to consider... In this case, BGP chose to go to 4.0.0.0/9 via 4.69.184.193 (notice the &lt;code&gt;best&lt;/code&gt; under the RIB entry).  In this case, BGP chose this because this route has the shortest AS Path list.  However, not all routes will be preferred via AS3356 (attached to R1).  Some may be preferred out R3 (via AS7660).  iBGP gives you the ability to know (at R2) which way to go to take the shortest BGP path.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BGP route to 4.0.0.0/9 via                                              &#xA;NH: 4.69.184.193 [Path: 3356]                                  &#xA;  --------&amp;gt;                                                     &#xA;&#xA; eBGP w/ AS3356 }{              iBGP inside AS64000          }{   eBGP w/ AS7660&#xA;&#xA;                 S1/0       S1/2   S2/1     S2/3   S3/2    S3/0&#xA;Peered w/ AS3356    +------+         +------+        +------+       Peered w/ AS7660&#xA;4.69.184.193 &amp;lt;------|  R1  |---------|  R2  |--------|  R3  |-----&amp;gt; 203.181.248.168&#xA;                    +------+         +------+        +------+&#xA;                                         | S2/0&#xA;                                         |&#xA;                                        &#xA;                                         ^&#xA;                                         ^&#xA;                                         | Ingress packet to 4.2.2.2&#xA;                                         |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;R1, R2 and R3 are fully-iBGP meshed.  When iBGP advertises a route, the next-hop remains &lt;em&gt;unchanged&lt;/em&gt;.  This means I need to carry the subnet for 4.69.184.193 in OSPF...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;R2&amp;gt;sh ip route 4.69.184.193&#xA;Routing entry for 4.69.184.192/30&#xA;  Known via &amp;quot;ospf 100&amp;quot;, distance 110, metric 65536, type intra area&#xA;  Last update from 192.0.2.109 on GigabitEthernet3/1, 1w0d ago&#xA;  Routing Descriptor Blocks:&#xA;  * 192.0.2.109, from 192.0.2.3, 1w0d ago, via Serial2/1&#xA;      Route metric is 65536, traffic share count is 1&#xA;&#xA;R2&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Thus when a packet for 4.2.2.2 arrives at R2, R2 sends it out Serial2/1 because that's where iBGP tells us the next-hop is.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2019-01-10T11:43:33.597" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="4911" PostTypeId="2" ParentId="3909" CreationDate="2013-11-09T20:12:34.040" Score="10" Body="&lt;p&gt;IGP usually is OSPF or ISIS which are link-state based, this gives us all the information of the network, everyone knows network from everyone's point-of-view, which allows for very interesting convergence options and traffic engineering options.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP is essentially distance-vector, it knows very limited view on the network at whole. BGP handles very well filtering and modifying routing information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link-state protocol is quite expensive compared to distance-vector, it would be quite problematic to scale it to INET DFZ size.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So reason why we have both, is because inside one specific network, we have sufficiently low-complexity to handle it with link-state protocol, which allows us to gain all the advantages of high degree of knowledge of network.&lt;br&gt;&#xA;But as it does not scale to Internet size, we need some other network to connect these many link-state islands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could inside your own network carry all prefixes (including customer) in your IGP, but it will negatively impact IGP performance, while all the convergence and TE advantages can be gained by just carrying loopback addresses of core routers. Adding customer prefixes to IGP only hurts your network performance by making IGP unnecessarily complex.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-11-09T20:12:34.040" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4913" PostTypeId="1" AcceptedAnswerId="4914" CreationDate="2013-11-10T14:00:55.117" Score="6" ViewCount="3495" Body="&lt;p&gt;I am looking for information on whether it is actually possible to run an IPv6 only MPLS Core with respect to the transport labels, without the current requirement to tunnel across IPv4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To put this into perspective, I am running a dual stack Juniper network currently and can only get IPv6 to work on MPLS when I enable IPv6 tunneling, which in essence just uses the IPv4 labels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible currently with Juniper or Cisco?&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="44" LastEditDate="2013-11-10T18:52:39.543" LastActivityDate="2013-11-10T18:52:39.543" Title="Is it possible to run an IPv6 only MPLS core?" Tags="|cisco|ipv6|juniper|mpls|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4914" PostTypeId="2" ParentId="4913" CreationDate="2013-11-10T14:37:50.303" Score="13" Body="&lt;p&gt;No it's not possible today, because neither CSCO or JNPR have implemented LDP to distribute labels for IPV6 prefixes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion people have too sentimental view on this matter, thinking IPV6-only is value in itself, it's not. You should differentiate services you offer from your control-plane used to offer those.&lt;br&gt;&#xA;There is no particular reason to have dual-stack control-plane, it's just additional complexity. Personally, I'd be happy to run IPv4 + 6PE until in some far future I'll fork-lift or build new network with IPv6 + 4PE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running MPLS for IPv4 and native IPv6 is probably the silliest thing you could do, as you'll remove all the scaling, TE and convergence benefits you get from MPLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Segment Routing/SRING which uses IGP for labels instead of LDP will likely happen before LDP for IPv6 prefixes happen. So if you really for some strange reason want to have both control-planes that's your most likely source to get it soon.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-11-10T14:37:50.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4915" PostTypeId="1" CreationDate="2013-11-10T17:39:08.410" Score="5" ViewCount="4564" Body="&lt;p&gt;Based on the same statements in all the books and articles , OSPF is IGP (Interior Gateway Protocol) , i.e, we can use it between 2 routers that are in the same Autonomous system .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can we use OSPF for EGP Communication?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="775" LastEditDate="2013-11-12T13:43:46.877" LastActivityDate="2014-07-31T11:19:14.860" Title="Can't we use ospf between 2 routers that are in different Autonomous system?" Tags="|routing|router|bgp|ospf|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4917" PostTypeId="2" ParentId="4915" CreationDate="2013-11-10T18:30:20.280" Score="4" Body="&lt;p&gt;If your problem is that you have two sites/business parters etc that have separate Internet ASes you can connect them together NOT through the Internet but over a VPN or private link. You have a couple of things to watch for if the address spaces are also advertised via the internet relate to administrative distance and prefix matching. BGP is preferred for many reasons, and you have to use it to talk over the internet. A little more on your use case assuming it is not entirely theoretical would help. At the end of the day there is no law that prevents you from using an IGP. But remember that any network vendor is in the business of selling you rope, what you do with the rope...&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-11-10T18:30:20.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4918" PostTypeId="2" ParentId="4915" CreationDate="2013-11-10T18:47:06.513" Score="16" Body="&lt;p&gt;This question is akin to asking, &quot;Why can't I use a screwdriver to hammer nails?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You &lt;em&gt;could&lt;/em&gt; use OSPF in certain inter-AS situations if you REALLY, REALLY wanted to/needed to.  There would be many &quot;gotchas&quot; and caveats to keep in mind when utilizing OSPF as an EGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just like you &lt;em&gt;could&lt;/em&gt; hammer nails with a screwdriver.  However, you would risk breaking the screwdriver, harming yourself, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could do it, but why would you?  There is a perfectly usable/heavily implemented routing protocol created for inter-AS communication, BGP.   Why attempt to utilize OSPF for an undesigned purpose?&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-11-10T18:47:06.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4919" PostTypeId="2" ParentId="3907" CreationDate="2013-11-11T00:02:03.973" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I tried searching in many ways but could find any&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/go/fn&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/go/fn&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Feature Navigator -&gt; Research Software&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Select Software Type: &quot;IOS&quot;&#xA;Select your desired Major Release, and Release. The &quot;Platform&quot; drop down will then include every platform that is designed to run that release.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a specific platform in mind, select &quot;platform&quot; under &quot;search by&quot;. Then select your platform from the drop down.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="176" LastEditDate="2013-11-28T02:57:15.260" LastActivityDate="2013-11-28T02:57:15.260" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4922" PostTypeId="2" ParentId="4915" CreationDate="2013-11-11T09:02:50.313" Score="10" Body="&lt;p&gt;Nothing prevents you from using OSPF to connect two separate networks. When companies merge this happens quite often. Is it a good idea? Probably not. Why?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Scalability: OSPF needs a lot more resources (by design) than BGP. Every router needs a full OSPF database (ignoring features like stubby areas) and the SPF calculations need lots of CPU time.&lt;/li&gt;&#xA;&lt;li&gt;Filtering: You will get every route from your neighbour if you want to or not. You can't filter (again by design) because OSPF needs a full database on every router to make routing decisions. This is why you don't want to speak OSPF with your customers as well. If they send you more specifics for your networks you're screwed. If they send you 100k routes, you're screwed.&lt;/li&gt;&#xA;&lt;li&gt;Traffic engineering: With BGP you have much more possibilities to influence where your traffic is going. In OSPF you're rather limited to path costs and route types for external routes.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So in summary, there are situations where it is necessary to speak OSPF to an external entity but most of the time it's better to use a protocol designed to connect different autonomous entities, like BGP.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2013-11-11T11:45:02.740" LastActivityDate="2013-11-11T11:45:02.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4925" PostTypeId="1" AcceptedAnswerId="4926" CreationDate="2013-11-12T04:16:43.363" Score="5" ViewCount="547" Body="&lt;p&gt;Scope of the MPLS labels are within a router or within a interface right ?. So which means the peering neighbor LSR router can generate label values of its own.So say with below mpls topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;|LSR1|-------------lsp------------ |LSR2|&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can both LSR1 and LSR2 (Routers) generate same label say 10 to the same prefix say 10.0.0.1 or even if the can generate the same label 10 to two different prefixes and distribute among themself ??? Is this legal as per RFC ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastEditorUserId="8499" LastEditDate="2018-12-26T05:18:25.467" LastActivityDate="2018-12-26T05:18:25.467" Title="Can 2 peering LSR generate same Label to same or different prefix and distribute among them?" Tags="|protocol-theory|mpls|rfc|rsvp|ldp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4926" PostTypeId="2" ParentId="4925" CreationDate="2013-11-12T07:22:55.773" Score="9" Body="&lt;p&gt;Yes both LSR[12] could advertise given FEC, say 10.0.0.1/32 with label 10 to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then if IGP says to LSR1 10.0.0.1/32 egress interface is towards LSR2, it'll impose (or swap to) label 10 and send towards LSR2. LSR2 then will find egress interface being something else than towards LSR1 and swap label to what ever that direction has advertised, might be still label 10, or might be something else, does not really matter at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Labels are completely local today and some RFCs dictate that is how it should be. Personally I'd like IGP labels to be global for simplicity. Because MPLS LSR does not know how labels look from anyone else's POV, we need hacks like tLDP (targeted LDP) when implementing rLFA (remote loop free alternative). We need the tLDP to learn bindings of remote node.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With regards label scope, label space today is chassis-wide in every device I've ever seen, but standards fully allow per-interface label spaces.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-11-12T08:53:38.230" LastActivityDate="2013-11-12T08:53:38.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4928" PostTypeId="1" CreationDate="2013-11-12T11:20:37.987" Score="2" ViewCount="3871" Body="&lt;p&gt;I have configured Static NAT to forward port 443 to 192.168.0.3 internal IP address as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static tcp 192.168.0.3 443 interface Dialer1 443&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I see &quot;Page Not Found&quot; when I try to access it with a web browser over port 443 (internally and externally). I have also checked online port forward tester that port 443 is closed. I don't have any issue accessing server on 443 internally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I am not Cisco expert and this router has been configured by previous IT guys so I might not know everything configured in this config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please see following config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INTGATEWAY#sh conf&#xA;Using 6037 out of 262136 bytes&#xA;!&#xA;! Last configuration change at 15:46:10 Sydney Tue Aug 6 2013 by admin.cisco&#xA;! NVRAM config last updated at 16:13:31 Sydney Tue Aug 6 2013 by admin.cisco&#xA;! NVRAM config last updated at 16:13:31 Sydney Tue Aug 6 2013 by admin.cisco&#xA;version 15.1&#xA;service tcp-keepalives-in&#xA;service tcp-keepalives-out&#xA;service timestamps debug datetime msec localtime&#xA;service timestamps log datetime msec localtime&#xA;service password-encryption&#xA;service sequence-numbers&#xA;!&#xA;hostname INTGATEWAY&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no logging buffered&#xA;enable secret 5 Secret...Shhhh....&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login default local&#xA;aaa authentication ppp V_USERS group radius&#xA;aaa authorization network V_USERS group radius&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;!&#xA;clock timezone Sydney 10 0&#xA;clock summer-time Sydney date Mar 30 2003 3:00 Oct 26 2003 2:00&#xA;!&#xA;no ipv6 cef&#xA;ip source-route&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip domain name domain.com.au&#xA;ip name-server 203.12.160.35&#xA;ip name-server 203.12.160.36&#xA;ip inspect max-incomplete high 800&#xA;ip inspect max-incomplete low 600&#xA;ip inspect name FIREWALL ftp&#xA;ip inspect name FIREWALL h323&#xA;ip inspect name FIREWALL netshow&#xA;ip inspect name FIREWALL rcmd&#xA;ip inspect name FIREWALL realaudio&#xA;ip inspect name FIREWALL rtsp&#xA;ip inspect name FIREWALL smtp&#xA;ip inspect name FIREWALL sqlnet&#xA;ip inspect name FIREWALL streamworks&#xA;ip inspect name FIREWALL tftp&#xA;ip inspect name FIREWALL tcp&#xA;ip inspect name FIREWALL udp&#xA;ip inspect name FIREWALL vdolive&#xA;ip inspect name FIREWALL icmp&#xA;ip inspect name FIREWALL isakmp&#xA;ip inspect name FIREWALL ipsec-msft&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;vpdn enable&#xA;!&#xA;vpdn-group COMPANY_VPN&#xA;! Default L2TP VPDN group&#xA;accept-dialin&#xA;  protocol l2tp&#xA;  virtual-template 1&#xA;no l2tp tunnel authentication&#xA;!&#xA;crypto pki token default removal timeout 0&#xA;!&#xA;crypto pki trustpoint TP-self-signed-4155725390&#xA;enrollment selfsigned&#xA;subject-name cn=IOS-Self-Signed-Certificate-4155725390&#xA;revocation-check none&#xA;rsakeypair TP-self-signed-4155725390&#xA;!&#xA;!&#xA;crypto pki certificate chain TP-self-signed-4155725390&#xA;certificate self-signed 01 nvram:IOS-Self-Sig#1.cer&#xA;license udi pid CISCO1921/K9 sn FGL153820V4&#xA;!&#xA;!&#xA;username administrator privilege 15 password 7 Administrator_Password&#xA;username admin.cisco privilege 15 password 7 Cisco_Admin_Password&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip ftp passive&#xA;ip ssh time-out 60&#xA;ip ssh port 2222 rotary 1&#xA;ip ssh version 2&#xA;!&#xA;!&#xA;crypto isakmp policy 10&#xA;encr 3des&#xA;authentication pre-share&#xA;group 2&#xA;crypto isakmp key PreSharedKey address 0.0.0.0 0.0.0.0&#xA;!&#xA;!&#xA;crypto ipsec transform-set VPN esp-3des esp-sha-hmac&#xA;mode transport&#xA;!&#xA;crypto dynamic-map VPN-map 10&#xA;set nat demux&#xA;set transform-set VPN&#xA;reverse-route&#xA;!&#xA;!&#xA;crypto map VPN 10 ipsec-isakmp dynamic VPN-map&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA;description COMPANY LAN&#xA;ip address 192.168.0.253 255.255.255.0&#xA;ip nat inside&#xA;ip virtual-reassembly in&#xA;load-interval 30&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA;description TPG INTERNET EFM SERVICE&#xA;no ip address&#xA;ip access-group OUTSIDE_IN in&#xA;load-interval 30&#xA;duplex auto&#xA;speed auto&#xA;pppoe enable group global&#xA;pppoe-client dial-pool-number 1&#xA;!&#xA;interface Virtual-Template1&#xA;ip unnumbered GigabitEthernet0/0&#xA;ip nat inside&#xA;ip virtual-reassembly in&#xA;peer default ip address dhcp&#xA;ppp encrypt mppe auto&#xA;ppp authentication ms-chap-v2 V_USERS&#xA;ppp authorization V_USERS&#xA;!&#xA;interface Dialer1&#xA;mtu 1492&#xA;ip address negotiated&#xA;ip nat outside&#xA;ip inspect FIREWALL out&#xA;ip virtual-reassembly in&#xA;encapsulation ppp&#xA;dialer pool 1&#xA;dialer idle-timeout 0&#xA;dialer persistent&#xA;dialer-group 1&#xA;ppp pap sent-username USERNAME@TPG.COM.AU password 7 iNTERNET_PASSWORD&#xA;crypto map VPN&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip nat inside source list NAT interface Dialer1 overload&#xA;ip nat inside source static tcp 192.168.0.2 80 interface Dialer1 80&#xA;ip nat inside source static tcp 192.168.0.3 443 interface Dialer1 443&#xA;ip nat inside source static tcp 192.168.0.2 25 interface Dialer1 25&#xA;ip nat inside source static tcp 192.168.0.2 22 interface Dialer1 22&#xA;ip nat inside source static tcp 192.168.0.1 1723 interface Dialer1 1723&#xA;ip route 0.0.0.0 0.0.0.0 Dialer1&#xA;ip route 192.168.1.0 255.255.255.0 192.168.0.254&#xA;ip route 192.168.30.0 255.255.255.0 192.168.0.254&#xA;!&#xA;ip access-list extended DEBUG&#xA;permit tcp any any eq 1723 log&#xA;ip access-list extended NAT&#xA;permit ip 192.168.0.0 0.0.0.255 any&#xA;permit ip 192.168.1.0 0.0.0.255 any&#xA;permit ip 192.168.30.0 0.0.0.255 any&#xA;ip access-list extended OUTSIDE_IN&#xA;remark CCP_ACL Category=17&#xA;permit udp any any eq non500-isakmp&#xA;permit esp any any&#xA;permit gre any any&#xA;permit udp any any eq isakmp log&#xA;permit tcp any any eq 1723 log&#xA;permit tcp any any eq www&#xA;permit tcp any any eq 443&#xA;permit tcp any any eq smtp&#xA;permit icmp any any&#xA;permit tcp any any eq 3389&#xA;permit tcp any any eq 22&#xA;ip access-list extended SPLIT-TUNNEL&#xA;permit ip 192.168.0.0 0.0.0.255 192.168.0.0 0.0.0.255&#xA;!&#xA;access-list 22 remark CCP_ACL Category=16&#xA;access-list 22 permit 192.168.0.0 0.0.0.255&#xA;access-list 101 permit ip 192.168.0.0 0.0.0.255 192.168.0.0 0.0.0.255&#xA;dialer-list 1 protocol ip permit&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;snmp-server community kpublic911 RO 22&#xA;!&#xA;radius server WINDOWS_VPNSERVER&#xA;address ipv4 192.168.0.2 auth-port 1812 acct-port 1813&#xA;key 7 SharedKey&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;exec-timeout 30 0&#xA;logging synchronous&#xA;stopbits 1&#xA;line aux 0&#xA;stopbits 1&#xA;line 2&#xA;no activation-character&#xA;no exec&#xA;transport preferred none&#xA;transport input all&#xA;transport output pad telnet rlogin lapb-ta mop udptn v120 ssh&#xA;stopbits 1&#xA;line vty 0 4&#xA;logging synchronous&#xA;rotary 1&#xA;transport input telnet ssh&#xA;line vty 5 15&#xA;logging synchronous&#xA;transport input all&#xA;!&#xA;scheduler allocate 20000 1000&#xA;ntp update-calendar&#xA;ntp server 192.189.54.33&#xA;ntp server 150.101.221.106&#xA;ntp server 27.50.91.108&#xA;end&#xA;&#xA;&#xA;INTGATEWAY#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3196" LastEditorUserId="775" LastEditDate="2013-11-12T14:21:30.443" LastActivityDate="2013-11-13T15:51:31.587" Title="Unable to forward port 443 using Static NAT on Cisco 1921" Tags="|cisco|router|nat|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4929" PostTypeId="1" AcceptedAnswerId="4933" CreationDate="2013-11-12T13:09:19.150" Score="7" ViewCount="7328" Body="&lt;p&gt;I have a Dell PowerConnect 5524 that I'm trying to configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want is simple routing between VLANs and the &lt;a href=&quot;ftp://ftp.dell.com/Manuals/Common/powerconnect-5524_User%27s%20Guide_en-us.pdf&quot; rel=&quot;nofollow&quot;&gt;user guide&lt;/a&gt; is less than helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On page 220, it says (or implies) that all you need to do to have routing enabled between two VLANs is create the VLANs on the switch and then plug devices in and everything should automagically work. This is not the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see my current running-config file &lt;a href=&quot;http://www.saairey.co.uk/PowerConnect-5524-running-config.txt&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have my PC connected to port 21 (VLAN 2 192.168.2.41) and another PC connected to port 1 (VLAN 3 192.168.3.10) and they cannot reach each other, I just get a timeout when I try and ping (yes both PCs have ICMP echo requests enabled in the firewall).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at the management page on the switch, you can see when you plug devices into different ports that local routes get added for the appropriate subnets but it seems like no traffic is flowing through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done some reading and maybe what I need is a trunk port to connect the different VLANs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried connecting a cable to create a physical link between the VLANs in some fruitless last-ditch attempt and this didn't work either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm at a loss as to what to do next, I'm no network engineer. Any help is greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT(s):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;console# show ip route&#xA;Maximum Parallel Paths: 1 (1 after reset)&#xA;IP Forwarding:          enabled&#xA;&#xA;Codes: C - connected, S - static, D - DHCP&#xA;&#xA;S  0.0.0.0/0          [1/1] via  192.168.2.1  0:18:50              vlan 2&#xA;C  192.168.2.0/24     is directly connected                        vlan 2&#xA;C  192.168.3.0/24     is directly connected                        vlan 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I said in the comments, the PCs in both VLAN 2 and VLAN 3 can ping the addresses for the router on both VLANs, see below for clarification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC 1, VLAN 2, IP: 192.168.2.41&#xA;    ping 192.168.2.254: success&#xA;    ping 192.168.3.1: success&#xA;    ping 192.168.3.10: failure&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC 2, VLAN 3, IP: 192.168.3.10&#xA;    ping 192.168.3.1: success&#xA;    ping 192.168.2.254: success&#xA;    ping 192.168.2.41: failure&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly, when I have my internet cable plugged in to VLAN 2, the PC in VLAN 3 can ping the router on our internal network (192.168.2.1), tracert as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tracing route to 192.168.2.1 over a maximum of 30 hops&#xA;&#xA;  1     1 ms     4 ms     3 ms  192.168.3.1&#xA;  2     1 ms    &amp;lt;1 ms    &amp;lt;1 ms  192.168.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I have our internal network disconnected, the routing issues remain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traceroute from PC 2 to PC 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tracing route to 192.168.2.41 over a maximum of 30 hops&#xA;&#xA;  1     1 ms     4 ms     4 ms  192.168.3.1&#xA;  2     *        *        *     Request timed out.&#xA;  3     *        *        *     Request timed out.&#xA;  4     *        *        *     Request timed out.&#xA;  5     *        *        *     Request timed out.&#xA;  6     *        *        *     Request timed out.&#xA;  etc. etc.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2425" LastEditorUserId="2425" LastEditDate="2013-11-12T17:04:01.653" LastActivityDate="2013-11-13T09:38:49.143" Title="Dell PowerConnect 5524 VLAN routing" Tags="|routing|vlan|dell|powerconnect|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="4930" PostTypeId="1" AcceptedAnswerId="4931" CreationDate="2013-11-12T13:15:29.840" Score="6" ViewCount="3879" Body="&lt;p&gt;Does FEC correspond to a Next-hop ipaddress or Destination Ipaddress or a combination of Next-hop/Destination Ipaddress and QOS values ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastActivityDate="2013-11-12T13:44:36.617" Title="What is a FEC in MPLS domain?" Tags="|mpls|ldp|rsvp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4931" PostTypeId="2" ParentId="4930" CreationDate="2013-11-12T13:27:38.463" Score="10" Body="&lt;p&gt;FEC or 'Forwarding equivalence class' identifies identity for packet which will determine path it will take in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For pure IPv4 forwarding, with routing-table 10.0.0.0/24 -&gt; 192.0.2.1 you can think that addresses 10.0.0.0 - 10.0.0.255 share that FEC, as they are treated same way, each of them are going to go to 192.0.2.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In MPLS typically FEC is the same, some prefix gets specific label, and these are all sharing FEC. However it's completely valid to add more differentiation there, QoS (dscp, cos) could be another differentiator. So 10.0.0.0/24, CoS 1, could get label 42 and 10.0.0.0/24, CoS 0 could get label 100. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IPv4 FEC is determined hop-by-hop, first hop could have 10.0.0.0/24 next-hop could have 10.0.0.0/25 and 10.0.0.128/25, causing traffic that used be in one FEC, to diverge into two FECs.&lt;br&gt;&#xA;In MPLS FEC is only determined by ingress PE, the traffic will then share same FEC all the way to egress PE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So FEC is way to describe shared path in network for some group of packets, it does not strictly define how that group is defined.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-11-12T13:44:36.617" LastActivityDate="2013-11-12T13:44:36.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4933" PostTypeId="2" ParentId="4929" CreationDate="2013-11-12T17:14:37.980" Score="3" Body="&lt;p&gt;When testing networking connections, don't use windows machines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My firewall was set to allow ICMP traffic from any subnet on any domain profile yet it was still blocking the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turning the firewall off completely allowed the traffic through, so the routing is working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, pings probably aren't the best way to test network connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For anyone looking to route between two VLANs on the Dell PowerConnect 5524, the commands on page 220 of the &lt;a href=&quot;ftp://ftp.dell.com/Manuals/Common/powerconnect-5524_User%27s%20Guide_en-us.pdf&quot; rel=&quot;nofollow&quot;&gt;user guide&lt;/a&gt; are sufficient:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;en&#xA;config&#xA;&#xA;vlan database&#xA;vlan 100-101&#xA;exit&#xA;&#xA;interface gi1/0/1&#xA;switchport access vlan 100&#xA;ip address 1.1.1.1 255.255.255.0&#xA;exit&#xA;&#xA;interface gi1/0/2&#xA;switchport access vlan 101&#xA;ip address 2.1.1.1 255.255.255.0&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2425" LastEditorUserId="2425" LastEditDate="2013-11-13T09:38:49.143" LastActivityDate="2013-11-13T09:38:49.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4934" PostTypeId="2" ParentId="4929" CreationDate="2013-11-12T19:10:06.080" Score="2" Body="&lt;p&gt;Sean, your setup seems correct if you're making it from one VLAN to the next; which you can see when you traceroute from one switch IP to the next. If you aren't very familiar with networking, try making your life easier by simplifying your setup. Give this setup a go:&lt;/p&gt;&#xA;&lt;h3&gt;PC1&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switchport - Gig1/0/10&lt;/li&gt;&#xA;&lt;li&gt;IP Address - 10.1.10.100/24&lt;/li&gt;&#xA;&lt;li&gt;VLAN - 10&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;PC2&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switchport - Gig1/0/20&lt;/li&gt;&#xA;&lt;li&gt;IP Address - 10.1.20.100/24&lt;/li&gt;&#xA;&lt;li&gt;VLAN - 20&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;Switch&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 10 IP Address - 10.1.10.1/24&lt;/li&gt;&#xA;&lt;li&gt;VLAN 20 IP Address - 10.1.20.1/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2013-11-12T19:10:06.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4935" PostTypeId="1" AcceptedAnswerId="4936" CreationDate="2013-11-12T19:33:07.473" Score="4" ViewCount="1323" Body="&lt;p&gt;I'm working on extracting some traffic-direction results on several stateful firewalls and I pondered on how you define the direction of the traffic in these stateful firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bottom line: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I have to define what direction the traffic is flowing on those stateful firewalls.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg.:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You have a stateful firewall with VPN functionality with 2 interfaces (Inside and Outside) &lt;/li&gt;&#xA;&lt;li&gt;VPN users are connecting to the firewall on the Outside interface to gain access to the company network/or gain privacy from their current network&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Which direction is the traffic flowing in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply put, in the end, the traffic is flowing in both directions because:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The VPN users has to connect to the firewall to gain access/privacy - That's an inbound direction&lt;/li&gt;&#xA;&lt;li&gt;After the VPN connection is created, the traffic is now flowing in both directions because of the existing VPN connection between the VPN-client and the firewall - That's an inbound and outbound direction&lt;/li&gt;&#xA;&lt;li&gt;When the user is connected via the VPN connection and trying to go on a website, the traffic is still flowing in both directions because the traffic has to originate from the VPN-client through the firewall and out through the outside interface (to the WAN) - That's an inbound and outbound direction&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But the &quot;result-worthy&quot; way I see it, the traffic is flowing in an outbound direction because it goes without saying the connection between the VPN-client and the firewall is needed in this context and the VPN-client is actually acting as it was physically behind the firewall on the Inside interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone clarify the definition of traffic-direction? Does a clear definition to traffic-direction even exist, or is it up to how I look at it?&lt;/p&gt;&#xA;" OwnerUserId="3200" LastActivityDate="2013-11-12T20:35:14.153" Title="Defining the traffic-direction in stateful firewalls" Tags="|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4936" PostTypeId="2" ParentId="4935" CreationDate="2013-11-12T20:35:14.153" Score="7" Body="&lt;p&gt;Generally speaking, the direction of the traffic is determined by the location of the host &lt;em&gt;establishing&lt;/em&gt; the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, as you indicated, the original VPN connection (#1) is inbound because the traffic originates at a host outside the network which establishes a connection to an internal resource.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once this connection is established (#2), while the data flows in both directions, it is still an inbound connection because it was still initiated from the external host.  All return traffic is considered to be part of this original connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a client is connected to VPN, this establishes a &quot;virtual&quot; presence inside the network.  So, for the VPN client accessing the web site (#3), the physical host uses the inbound connection to the virtual host that was already created, and the virtual host establishes an outbound connection through the firewall to the web site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, this may not be universally true with all vendors, but generally this is how inbound/outbound connections are treated.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-11-12T20:35:14.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4939" PostTypeId="1" AcceptedAnswerId="4940" CreationDate="2013-11-12T23:04:37.270" Score="9" ViewCount="593" Body="&lt;p&gt;I was told by someone that a packet going between two hosts connected to the same Nexus 2k would end up being passed all the way up to the 5k that is managing said 2k for logic to be applied and then passed back down to the 2k and out the port the destination host is connected to. That seems extremely inefficient to me, so I'm looking for someone to either confirm or deny the information I've been given.&lt;/p&gt;&#xA;" OwnerUserId="88" LastEditorUserId="775" LastEditDate="2013-11-18T12:27:40.427" LastActivityDate="2013-11-18T12:27:40.427" Title="What path does a packet follow through a Cisco Nexus 5k/2k infrastructure?" Tags="|cisco|cisco-nexus-5k|cisco-nexus-2000|packet-path|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4940" PostTypeId="2" ParentId="4939" CreationDate="2013-11-12T23:21:27.350" Score="14" Body="&lt;p&gt;The Nexus 2k isn't an actual switch, but a &quot;fabric extender&quot; - it functions as a separate, self-contained linecard for the Nexus 5k. The following CiscoLive PDF has great details on the &lt;a href=&quot;http://d2zmdbbm9feqrf.cloudfront.net/2012/usa/pdf/BRKARC-3452.pdf&quot;&gt;Nexus 2k/5k architecture&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's clearly pointed out in page 56 that the 2k does &lt;em&gt;not&lt;/em&gt; perform any local switching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Nexus 5k is what performs all of the forwarding, integrating the Nexus 2k fabric extenders remotely into its backplane via IEEE 802.1BR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a future point of advice, googling for &quot;a day in the life of a packet on [x]&quot; where [x] is your favorite piece of gear will often produce good documentation on the architecture of that gear. YMMV with this however, as not all vendors make this information public.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="775" LastEditDate="2013-11-13T00:13:54.393" LastActivityDate="2013-11-13T00:13:54.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4947" PostTypeId="2" ParentId="4928" CreationDate="2013-11-13T15:18:36.837" Score="2" Body="&lt;p&gt;The &quot;OUTSIDE_IN&quot; ACL should be applied to the Dialer interface rather than the Physical Gigabit 0/1 interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;log in and run the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enable&#xA;configure terminal&#xA;interface G0/1&#xA;no ip access-group OUTSIDE_IN in&#xA;interface Dialer 1&#xA;ip access-group OUTSIDE_IN in&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would recommend having a consultant take care of your DMVPN, ACL rules, and static NAT. Just by looking at your configuration I can tell that you may need some security specialist help.&lt;/p&gt;&#xA;" OwnerUserId="3210" LastEditorUserId="775" LastEditDate="2013-11-13T15:51:31.587" LastActivityDate="2013-11-13T15:51:31.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4948" PostTypeId="2" ParentId="3121" CreationDate="2013-11-13T15:51:25.177" Score="0" Body="&lt;p&gt;You can turn off TCP windowing with iperf using the -N option for &quot;tcp no-delay&quot;. As per the documentation &quot;&lt;em&gt;set TCP no delay, disabling Nagle's Algorithm&lt;/em&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would highly recommend using this option with concurrent TCP sessions to simulate something closer to ACTUAL network traffic rather than shooting a UDP blast. &lt;/p&gt;&#xA;" OwnerUserId="3210" LastEditorUserId="3210" LastEditDate="2013-11-14T00:02:33.097" LastActivityDate="2013-11-14T00:02:33.097" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4949" PostTypeId="2" ParentId="3753" CreationDate="2013-11-13T20:34:33.990" Score="6" Body="&lt;p&gt;I recently went through a similar migration that eradicated proprietary protocols (i.e., PVST+, HSRP, etc.); our transition was focused on posturing us for a 'vendor neutral' network. Since you're running Cisco devices, you're likely running PVST+.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco covers this in more &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps708/products_configuration_example09186a00807b075f.shtml&quot;&gt;detail&lt;/a&gt;, but the crux of it is fairly simple: establish a hierarchy and, contrary to what common sense would tell you, start from the &lt;strong&gt;core&lt;/strong&gt; and move outward. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set your priorities in a manner that cascades down.  Base this hierarchy on what is closest to a central node. All nodes participating in this STP setup should be on a common structure, so for simplicities sake, manually set one root bridge with the &lt;code&gt;spanning-tree vlan xx,xx root primary&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you're ready for the migration to begin, start with the core. The reason for this is because MST is backwards compatible with PVST, not the other way around. A PVST core won't be able to communicate with BPDUs from MST nodes; those trunk links will drop. If everything is going right, you'll see a small drop while the new STP protocol comes online and figures out the current lay of the land. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then just trickle these protocol changes down all the way to your furthest nodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;End-users might not even notice the small blip while MST elects a root bridge.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2013-11-13T20:34:33.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4950" PostTypeId="1" AcceptedAnswerId="4951" CreationDate="2013-11-13T21:06:41.653" Score="6" ViewCount="429" Body="&lt;p&gt;I'm trying to find out if there is a &quot;clean&quot; way to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to setup a ACL on a FWSM that effects devices over multiple subnets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The structure looks like this:&#xA;10.10.1-254.1-15&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network example&#xA; network-object 10.10.1.0 255.255.255.240&#xA; ..&#xA; ..&#xA; network-object 10.10.254.0 255.255.255.240&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but i'm hoping there a way to do this without having to add each subnet?&lt;/p&gt;&#xA;" OwnerUserId="108" LastEditorUserId="108" LastEditDate="2013-11-13T23:21:01.867" LastActivityDate="2013-11-13T23:41:41.820" Title="Is it possible to have ranges in two octets in an ACL / object-group" Tags="|firewall|cisco-ios|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4951" PostTypeId="2" ParentId="4950" CreationDate="2013-11-13T21:22:07.690" Score="6" Body="&lt;p&gt;Certainly! I believe inverse masks were created to be dis-contiguous rather than a normal subnet mask that must be contiguous. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An ACL such as the following should do the trick on an &lt;strong&gt;IOS device&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ip access-list [standard/extended] SUBNET_240&lt;br&gt;&#xA; permit ip 10.10.0.0 0.0.255.15  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not familar with the FWSM but you should be able to create a similar ACL on an ASA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also just logged in to my &lt;strong&gt;ASA 5512&lt;/strong&gt; and I was able to create a network object with a dis-contiguous mask (but not inverse). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.0.0 255.255.0.240&lt;/p&gt;&#xA;" OwnerUserId="3210" LastEditorUserId="3210" LastEditDate="2013-11-13T23:41:41.820" LastActivityDate="2013-11-13T23:41:41.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4953" PostTypeId="1" AcceptedAnswerId="4980" CreationDate="2013-11-13T23:05:59.763" Score="6" ViewCount="2027" Body="&lt;p&gt;I have been unable to find any information or specific mounting brackets to fasten a Cisco 3825 2RU router to a wall, so I am wondering if anyone here has experience with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the regular rack mount brackets, but unlike other model routers, these do not allow you to rotate them for mounting on a wall.&lt;/p&gt;&#xA;" OwnerUserId="572" LastEditorUserId="775" LastEditDate="2013-11-15T12:14:52.060" LastActivityDate="2013-11-17T21:12:53.530" Title="Mount a 2U router on a wall" Tags="|cisco|router|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4954" PostTypeId="2" ParentId="4953" CreationDate="2013-11-13T23:58:14.387" Score="8" Body="&lt;p&gt;I don't know if there are any commercial solutions to this problem, (I'm sure there are) we've just been solving this for many years with a little bit of &quot;&lt;a href=&quot;http://www.urbandictionary.com/define.php?term=macgyvering&quot; rel=&quot;noreferrer&quot;&gt;macguyvering&lt;/a&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We take a rack-mount shelf such as &lt;a href=&quot;http://www.alliedelec.com/search/productdetail.aspx?SKU=70147606&quot; rel=&quot;noreferrer&quot;&gt;this one&lt;/a&gt;, and flush mount it to the wall/pressboard in the closet with anchors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, we simply put the standard rack ears on our gear, and hang the equipment vertically from the ears of the shelf.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We use this in MANY closets as a cheaper/more space efficient alternative to putting a two-post rack or a wall hanging cabinet in there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've attached a couple of pictures for clarity:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/3aBEi.png&quot; alt=&quot;Flush Mounted Switch and UPS&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/7MNtC.jpg&quot; alt=&quot;Wide Angle of Flush Mounted Switch&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Also, YES this is in a kitchen and under the hot-water heater... Not by our choice, but that's where the wiring was terminated when we took over the building.  As most of you know, you play the hand you're dealt... :)&lt;/em&gt; &lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-11-14T00:03:39.563" LastActivityDate="2013-11-14T00:03:39.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4955" PostTypeId="2" ParentId="4953" CreationDate="2013-11-14T00:40:17.820" Score="5" Body="&lt;p&gt;For a 2U device, normally I cut up a 4x4 and mount blocks (front and back for side air flow) or lengths (for front/rear airflow) to the wall (appropriate bolts/screws/anchors based on the wall).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mount the device &quot;horizontally&quot; so that no cables are hanging down (to vibrate loose or to be unplugged as in one case when someone need a place to &quot;hang something&quot;) and so dust and debris does not accumulate in upward facing ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do use the ears and screw the device to the 4x4s.  Depending on how much traffic in the area, I will mount plywood strips between the 4x4s across the device to secure it and/or a piece of plywood to protect it.  Plywood can also help to conceal if visibility is a concern.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep air flow in mind, both with spacing and the direction of exhaust.  Since it is wood, you should drill pilot holes to prevent splitting.  If you are paranoid (or have a boss/client who is), you can use FRT (fire retardant treated) wood, but it isn't necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Growing up with my father who worked with wood quite a bit, I sometimes go a bit crazy, using a sliding dovetail or hidden dovetail bracket on the wall to mount the 4x4.  Always thought it might be fun to turn one into a wall mounted book shelf at some point.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-11-14T00:40:17.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4956" PostTypeId="1" AcceptedAnswerId="4957" CreationDate="2013-11-14T02:36:27.867" Score="4" ViewCount="2162" Body="&lt;p&gt;The data/link rate reported by my AP differs from that reported by my client PC. Does the transmitting device always determine link rate? Or can, for example, an AP dictate both the TX and RX link rate?&lt;/p&gt;&#xA;" OwnerUserId="2360" LastActivityDate="2013-11-14T05:56:53.537" Title="Is the 802.11 PHY link rate always determined by the transmitter, never receiver?" Tags="|wireless|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4957" PostTypeId="2" ParentId="4956" CreationDate="2013-11-14T05:56:53.537" Score="7" Body="&lt;p&gt;While this seems like a fairly straightforward question, the answer is by no means straightforward.  This will get long, but the short answer is that both devices are adjusting the RX and TX rate all the time and these two data rates do not need to be the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In infrastructure mode, the access point determines the supported and base data rates in use for the wireless network.  Clients need to support as least the lowest base data rate to connect to the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are advertised in the beacons frames sent by the access point.  See below for an example of a beacon frame I pulled from one of the captures I had stored:&lt;img src=&quot;https://i.stack.imgur.com/mXTDB.png&quot; alt=&quot;Beacon Frame&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This Cisco access point is advertising the following data rates: 6, 9, 12, 18, 24, 36, 48, and 54 Mbps.  All of them are marked as base data rates as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An 802.11b client, which only operates at 1, 2, 5.5 and 11 Mbps would not be able to connect to this network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In operation, both the access point and the client device will use any or all of these data rates and are constantly adjusting them to account for changes in the environment.  Typically, they will start by trying to use the fastest, but if they don't get acknowledgements at the higher data rate, they will retry the transmission at lower data rates.  The access point and the client can be using two entirely different data rates and often do.  Each ultimately makes the decision of what data rate to use at any given point in time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exact process of how the device selects/adjusts the data rate is a process determined by the programmers for the device.  Some are very aggressive and will always start at the highest data rates and work their way down trying for the best performance, even if all the acknowledgements come in at very low data rates (resulting in many retries).  Others will keep track of the recent successful acknowledgements and conservatively adjust the data rate upward, sacrificing high data rates for a lower number of retries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There can also be &quot;lopsided&quot; capabilities in a wireless chipset.  For instance, the &lt;a href=&quot;http://wikidevi.com/wiki/Intel_WiFi_Link_5100_(abgn,_full_size)&quot; rel=&quot;noreferrer&quot;&gt;Intel 5100&lt;/a&gt; is a &lt;strong&gt;1x2:2&lt;/strong&gt; device.  It has only has one transmit radio chain but two receive radio chains, meaning it can only use one of it's spatial streams when transmitting.  This results in a receive data rate (2.4GHz, 20 MHz channel width, long GI) of 130 Mbps, but it can only transmit at data rates up to 65 Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to reporting the data rates, different APs and clients also do this differently.  I have seen some that report only the best possible data rate, some that report the TX rate, some that report the RX rate, and some that report both separately.  They may update this value close to real time or they may only update it once per x seconds.  They may use a median, mean or mode value for a data set; if they use the mean value then it may not even correspond to an actual data rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, whatever value is given is &lt;em&gt;not&lt;/em&gt; the single data rate in use.  To illustrate this, here is the output from a Meru access point for a client device showing the RX and TX distribution of data frames (as well as the success/failure rate on TX - the AP won't have this for RX since it should only really be receiving one usable frame and then ack it):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;***********************************************&#xA;  Rate --------------- Short Term -------------&#xA;  Kbps  #RX_frame(P)     Bytes&#xA;  6000       11(  0)      1455&#xA; 36000       15(  0)       420&#xA; 48000      214(  8)      6020&#xA; 54000     1069( 43)     31962&#xA; 81000      147(  5)     19426&#xA;108000      309( 12)     56322&#xA;121500      524( 21)     59948&#xA;135000      185(  7)     25439&#xA;***********************************************&#xA;***********************************************************************&#xA;   TX Rate Statistics for MAC address = xx:xx:xx:xx:xx:xx&#xA;                                BSSID = xx:xx:xx:xx:xx:xx &#xA;***********************************************************************&#xA;  rate ------------------------- Short Term ---------------------------&#xA;  Kbps  #frame(P)  #suces(P)   #fail    byteSuc  byteFail (S/T) &#xA;  6000     97(  4)     19(  1)     78       3938    10502 ( 19) &#xA; 54000     59(  2)     58(  3)      1      17130      178 ( 98) &#xA; 81000    312( 13)    272( 15)     40      56450    11380 ( 87) &#xA;108000   1074( 46)    857( 50)    217     165724    42175 ( 79) &#xA;121500    684( 29)    454( 26)    230      92321    47461 ( 66) &#xA;135000     96(  4)     52(  3)     44      12815    11743 ( 54) &#xA;************************************************************************&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-11-14T05:56:53.537" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4959" PostTypeId="1" AcceptedAnswerId="4960" CreationDate="2013-11-14T07:47:17.040" Score="4" ViewCount="824" Body="&lt;p&gt;What's the difference between ACL and FPM? In detail, please, but in a simple, easy-to-understand way.&lt;/p&gt;&#xA;" OwnerUserId="3218" LastEditorUserId="775" LastEditDate="2013-11-14T09:08:19.740" LastActivityDate="2013-11-14T10:06:47.927" Title="The Difference Between ACL and FPM" Tags="|cisco|router|ipv4|security|acl|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4960" PostTypeId="2" ParentId="4959" CreationDate="2013-11-14T09:07:53.173" Score="3" Body="&lt;p&gt;I assume you're asking to compare &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml&quot; rel=&quot;nofollow&quot; title=&quot;ACL&quot;&gt;Cisco Access Control Lists (ACL)&lt;/a&gt; and &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/ht_fpm.html#wp1053704&quot; rel=&quot;nofollow&quot; title=&quot;FPM&quot;&gt;Cisco Flexible Packet Matching (FPM)&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets contain a number of fields, such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IP source address&lt;/li&gt;&#xA;&lt;li&gt;IP destination address&lt;/li&gt;&#xA;&lt;li&gt;TCP Source Port&lt;/li&gt;&#xA;&lt;li&gt;TCP Destination Port&lt;/li&gt;&#xA;&lt;li&gt;UDP Source Port&lt;/li&gt;&#xA;&lt;li&gt;UDP Destination Port&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;ACLs&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Traditional &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml&quot; rel=&quot;nofollow&quot; title=&quot;Access Control List&quot;&gt;ACL&lt;/a&gt;s can only permit or deny based on a limited number of fields (some of most commonly used fields are listed above); these fields are well-known throughout the internet.  However, traditional &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml&quot; rel=&quot;nofollow&quot; title=&quot;Access Control List&quot;&gt;ACL&lt;/a&gt;s cannot filter &lt;em&gt;inside&lt;/em&gt; the payload of an IP packet, for instance if someone wanted to block certain kinds of &lt;a href=&quot;http://en.wikipedia.org/wiki/TIBCO_Rendezvous&quot; rel=&quot;nofollow&quot;&gt;Tibco RV&lt;/a&gt; UDP Multicast payloads, it's impossible to do so with traditional ACLs.  Traditional &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml&quot; rel=&quot;nofollow&quot; title=&quot;Access Control List&quot;&gt;ACL&lt;/a&gt;s look like this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Note: this ACL is only granular to a TCP port&#xA;access-list 102 permit tcp any any eq 80&#xA;access-list 102 permit tcp any any eq 443&#xA;access-list 102 permit tcp any any eq 23&#xA;access-list 102 permit tcp any any eq 25&#xA;access-list 102 permit tcp any any eq 110&#xA;access-list 102 deny ip any any log&#xA;!&#xA;interface FastEthernet0/0&#xA; ip access-group 102 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;FPM&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;However, &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/ht_fpm.html#wp1053704&quot; rel=&quot;nofollow&quot; title=&quot;Flexible Packet Matching&quot;&gt;FPM&lt;/a&gt; can block / allow on any bit inside a &lt;em&gt;single&lt;/em&gt; packet header or payload&lt;sup&gt;1&lt;/sup&gt;, as long as there is a valid &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/ht_fpm.html#wp1053771&quot; rel=&quot;nofollow&quot; title=&quot;Protocol Header Description Language&quot;&gt;PHDL&lt;/a&gt; file loaded for the field that needs to be blocked or allowed.  &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/ht_fpm.html#wp1053704&quot; rel=&quot;nofollow&quot; title=&quot;Flexible Packet Matching&quot;&gt;FPM&lt;/a&gt; can define a hierarchy of classes and policies to implement very granular control over the packets that are allowed or denied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an example policy, taken from the &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/ht_fpm.html#wp1053704&quot; rel=&quot;nofollow&quot; title=&quot;Flexible Packet Matching&quot;&gt;FPM&lt;/a&gt; docs, which matches a UDP packets sent by the &lt;a href=&quot;http://en.wikipedia.org/wiki/SQL_Slammer&quot; rel=&quot;nofollow&quot;&gt;Slammer Worm&lt;/a&gt;.  It would be impossible to block the hosts infected with the &lt;a href=&quot;http://en.wikipedia.org/wiki/SQL_Slammer&quot; rel=&quot;nofollow&quot;&gt;Slammer Worm&lt;/a&gt; using &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk361/technologies_configuration_example09186a0080100548.shtml&quot; rel=&quot;nofollow&quot; title=&quot;Access Control List&quot;&gt;ACL&lt;/a&gt;s unless you block both good and bad SQL traffic by individual IP source addresses.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;load protocol disk2:ip.phdf&#xA;load protocol disk2:udp.phdf&#xA;!&#xA;class-map type stack match-all ip-udp&#xA; description &quot;match UDP over IP packets&quot;&#xA; match field ip protocol eq 0x11 next udp&#xA;!&#xA;class-map type access-control match-all slammer&#xA; description &quot;match on slammer packets&quot;&#xA; match field udp dest-port eq 0x59A&#xA; match field ip length eq 0x194&#xA; match start l3-start offset 224 size 4 eq 0x4011010&#xA;!&#xA;policy-map type access-control fpm-udp-policy&#xA; description &quot;policy for UDP based attacks&quot;&#xA; class slammer&#xA;  drop&#xA;!&#xA;policy-map type access-control fpm-policy&#xA; description &quot;drop worms and malicious attacks&quot;&#xA; class ip-udp&#xA;  service-policy fpm-udp-policy&#xA;!&#xA;interface GigabitEthernet0/1&#xA; service-policy type access-control input fpm-policy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;End Notes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt; &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/ht_fpm.html#wp1053704&quot; rel=&quot;nofollow&quot; title=&quot;Flexible Packet Matching&quot;&gt;FPM&lt;/a&gt;'s limitation of inspecting a single IP packet is non-trivial, since that means it's possible to circumvent &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/ht_fpm.html#wp1053704&quot; rel=&quot;nofollow&quot; title=&quot;Flexible Packet Matching&quot;&gt;FPM&lt;/a&gt; if an attack manages to split the attack signatures across multiple IP fragments, or TCP packets (since the TCP stream is reassembled at the receiver).  That said, it's a still very powerful tool as long as you understand the limitations of the technology.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-11-14T09:07:53.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4962" PostTypeId="1" AcceptedAnswerId="4963" CreationDate="2013-11-14T09:45:59.933" Score="-1" ViewCount="338" Body="&lt;p&gt;The question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the Network ID 41.149.210.0/24, subnet to provide 12 usable hosts per subnet. What is the new mask in CIDR notation (without the leading /)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how... and elaborate! Cheers&lt;/p&gt;&#xA;" OwnerUserId="3220" LastEditorUserId="775" LastEditDate="2013-11-14T13:13:24.443" LastActivityDate="2013-11-14T13:13:24.443" Title="Determining the CIDR notation to provider host per subnet" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4963" PostTypeId="2" ParentId="4962" CreationDate="2013-11-14T09:54:20.247" Score="4" Body="&lt;p&gt;You need 12 usable hosts, lets start from 1 and multiply by two each time.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;1&lt;/li&gt;&#xA;&lt;li&gt;2&lt;/li&gt;&#xA;&lt;li&gt;4&lt;/li&gt;&#xA;&lt;li&gt;8&lt;/li&gt;&#xA;&lt;li&gt;16&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Ok 16 is enough, even if we remove 2 hosts, we are left with 14, which satisfies requirement for 12.&lt;br&gt;&#xA;And 16 is 5th number we found, so it is 5th smallest network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we just count backward from smallest possible network, i.e. /32, and we get&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;/32&lt;/li&gt;&#xA;&lt;li&gt;/31&lt;/li&gt;&#xA;&lt;li&gt;/30&lt;/li&gt;&#xA;&lt;li&gt;/29&lt;/li&gt;&#xA;&lt;li&gt;/28&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Ok, it must be /28.&lt;/p&gt;&#xA;" OwnerUserId="561" LastEditorUserId="561" LastEditDate="2013-11-14T10:32:45.780" LastActivityDate="2013-11-14T10:32:45.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4964" PostTypeId="2" ParentId="4959" CreationDate="2013-11-14T10:06:47.927" Score="2" Body="&lt;p&gt;Access Control Lists (ACL) are network statements that permit or deny access to a given set of conditions based on the first match.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Standard ACLs are the oldest forms of ACLs and operate in an incredibly broad manner.  They only match based on a single IP address, and because of this limited functionality, they operate much faster other types under most circumstances; this is not taking into account hardware-based acceleration.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose we want to limit access to a single host, below is what we would do.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rtr(config)# access-list 1 permit 10.1.1.100 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This ACL functionality is refined even further with the introduction of Extended ACLs.  This allows you to specify source and destination IP addresses, as well as port numbers and a few other parameters (e.g., tos, precedence, etc.).  The added functionality this provides also comes with a downside: increase overhead and packet inspection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose we wanted to refine the scenario above even further to limit this host to a single IP and allow HTTP access.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rtr(config)# access-list 199 permit tcp host 10.1.1.100 host 192.168.1.1 eq 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Flexible Packet Matching (FPM) is really the newest ACL that’s available.  The primary focus is for intrusion prevention/detection because of its extensive matching characteristics.  You can seemingly define any parameter inside a packet for inspection.  Like anything with additional features though, this comes with a significant performance toll.  I grabbed this next example from &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6723/prod_white_paper0900aecd803936f6.html&quot; rel=&quot;nofollow&quot;&gt;Cisco’s documentation&lt;/a&gt; on FPM and modified it to match the relevant fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose we want to refine the above restriction even further.  We want to allow access from that single host, and prevent any of those ‘trusted’ users from passing malicious queries (specifically &quot;GET \%&quot;) to the single host.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rtr(config)# load protocol flash:ip.phdf&#xA;rtr(config)# load protocol flash:tcp.phdf  &#xA;rtr(config)# class-map type stack match-all ip_tcp&#xA;rtr(config-cmap)# description &quot;match TCP over IP packets&quot;&#xA;rtr(config-cmap)# match field ip protocol eq 0x6 next tcp&#xA;rtr(config-cmap) # description &quot;Match HTTP Exploit Packets&quot;&#xA;rtr(config-cmap)# match field tcp dest-port eq 80&#xA;rtr(config-cmap)# match field ip source-addr eq 10.1.1.100&#xA;rtr(config-cmap)# match start tcp payload-start offset 0 size 32 regex &quot;.*GET \%&quot;&#xA;rtr(config)# policy-map type access-control fpm_tcp_policy&#xA;rtr(config-pmap)# description &quot;policy for TCP packets&quot;&#xA;rtr(config-pmap)# class http_psirt_class&#xA;rtr(config-pmap-c)# drop&#xA;rtr(config)# policy-map type access-control fpm_policy&#xA;rtr(config-pmap)# description &quot;policy HTTP Get exploitation&quot;&#xA;rtr(config-pmap)# class ip_tcp&#xA;rtr(config-pmap-c)# service-policy fpm_tcp_policy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2013-11-14T10:06:47.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4969" PostTypeId="1" AcceptedAnswerId="4973" CreationDate="2013-11-14T13:31:38.253" Score="2" ViewCount="4037" Body="&lt;p&gt;I have a server where speed and duplex are set to &lt;code&gt;auto&lt;/code&gt;. The NIC supports 1000mb/s, and is connected to my Cisco switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I check on port I see that the speed is set to 100Mb/s and Full Duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other unused ports on my switch are set to  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could the NIC drivers be the reason why I can not link at 1000Mb/s?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the issue, if it's not the NIC drivers?&lt;/p&gt;&#xA;" OwnerUserId="3122" LastEditorUserId="775" LastEditDate="2013-11-21T11:40:49.090" LastActivityDate="2013-11-21T11:40:49.090" Title="Full-Duplex and Speed negotiation" Tags="|ethernet|speed|duplex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4973" PostTypeId="2" ParentId="4969" CreationDate="2013-11-14T14:34:24.200" Score="7" Body="&lt;p&gt;The usual suspects in the case of autonegotiations are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;bad cables&lt;/li&gt;&#xA;&lt;li&gt;bad ports, SFPs or NICs&lt;/li&gt;&#xA;&lt;li&gt;port configs (are they both set to auto and do they both list the 1000BASE-T FD ability?)&lt;/li&gt;&#xA;&lt;li&gt;bugs, compatibility or legacy issues&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would not recommend a fixed speed and duplex setting in this (or almost any) situation. The days of frequent autoneg issues and incompatible implementations are gone, on recent equipment such issues are very rare. If autoneg is not working, switching to a fixed setting is a workaround, hiding the underlying issue that causes the autonegotiation to fail. Not fixing this issue might allow it to bite you later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the probability of speed or duplex mismatches and the like is actually much higher in an environment with fixed settings, caused by left over settings when moving equipment around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, if in your case the cable is to blame, setting both sides to 1000 fixed could disable the link with the faulty cable completely. Autonegotation gracefully degrades you to 100. It is of course up to you or your monitoring equipment to detect and fix this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interesting blog post, with links some vendor recommendations: &lt;a href=&quot;http://etherealmind.com/ethernet-autonegotiation-works-why-how-standard-should-be-set/&quot;&gt;&quot;EtherealMind on Autonegotiation&quot;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-11-14T14:34:24.200" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4974" PostTypeId="1" AcceptedAnswerId="4975" CreationDate="2013-11-14T15:11:57.883" Score="2" ViewCount="2300" Body="&lt;p&gt;I'm very new in computer networking. I'm reading &lt;code&gt;Computer Networking  A Top-Down Approach (KUROSE, ROSS)&lt;/code&gt; book.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the beginning of chapter one, it said : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We'll take the broader and more abstract view in the second half of&#xA;  this chapter.  We'll examine delay, loss and throughput of data in a&#xA;  computer network and provide simple quantitative models for &lt;strong&gt;end-to-end&lt;/strong&gt;&#xA;  throughput and delay: models that take  into account transmission,&#xA;  propagation, and queuing delays.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm confusing in peace that said &lt;code&gt;end-to-end&lt;/code&gt;. I don't know what it is!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please explain to me what is &lt;code&gt;end-to-end&lt;/code&gt; briefly ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance. &lt;/p&gt;&#xA;" OwnerUserId="3225" LastEditorUserId="509" LastEditDate="2015-08-18T21:56:50.030" LastActivityDate="2015-08-18T21:56:50.030" Title="What is end-to-end in Computer Networking?" Tags="|internet|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4975" PostTypeId="2" ParentId="4974" CreationDate="2013-11-14T15:14:40.790" Score="7" Body="&lt;p&gt;It means from point A to point B in the network and everything in between (in this context)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ex:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC (A)=&gt; switch =&gt; router =&gt; router =&gt; switch =&gt; PC (B)&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2013-11-14T15:14:40.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4976" PostTypeId="2" ParentId="3909" CreationDate="2013-11-14T15:41:29.943" Score="3" Body="&lt;p&gt;iBGP isn't really used for internal routing, it is used by all your eBGP routers to share their routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex: If you are peering with 3 other network, you want all your eBGP routers to know the routes received by the other ones so they can propagate that information to the peers if necessary/needed (opening thus the possibility of your peer using transit through you)&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2013-11-14T15:41:29.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4977" PostTypeId="1" AcceptedAnswerId="4978" CreationDate="2013-11-14T15:45:40.423" Score="3" ViewCount="1281" Body="&lt;p&gt;I have recently configured a Dell PowerConnect 5524 with 3 VLANs (&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/4929/dell-powerconnect-5524-vlan-routing&quot;&gt;Dell PowerConnect 5524 VLAN routing&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have connected this switch to our network with an IP of 192.168.2.254, it successfully routes traffic from the 192.168.3.0/24 subnet and even gets ping replies from our main router (the ASA on 192.168.2.1 and my PC 192.168.2.41) however if I try from my PC to ping anything on the other subnet, including the Dell's .3 IP (192.168.3.2), I get nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have added this route on the ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route inside 192.168.3.0 255.255.255.0 192.168.2.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This doesn't seem to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I add the route on my PC itself (via &lt;code&gt;route add&lt;/code&gt; in the command prompt) everything works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA and the Dell are directly connected via cable from port 21 on the Dell (VLAN 2, Internal .2) to port 5 on the ASA (VLAN 1, INSIDE).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I change the default gateway in Windows on my PC to the IP address of the Dell on this subnet (192.168.2.254), I can access devices on the other subnet with no problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full config for the PowerConnect can be found &lt;a href=&quot;http://www.saairey.co.uk/PowerConnect-5524-running-config.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full config for the ASA (IPs and sensitive info has been blanked out) can be found &lt;a href=&quot;http://www.saairey.co.uk/ASA-5505-running-config.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2425" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2013-11-26T08:50:22.223" Title="ASA 5505 routing issues" Tags="|cisco|routing|cisco-asa|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4978" PostTypeId="2" ParentId="4977" CreationDate="2013-11-14T15:55:34.030" Score="2" Body="&lt;p&gt;I would recommend using the switch as the default gateway for all of your subnets. For your scenario the default gateway of hosts on Vlan 3 should be set to 192.168.3.2 and hosts on Vlan 2 should be set to 192.168.2.254.&lt;/p&gt;&#xA;" OwnerUserId="3210" LastEditorUserId="3210" LastEditDate="2013-11-14T16:24:43.230" LastActivityDate="2013-11-14T16:24:43.230" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4979" PostTypeId="2" ParentId="4977" CreationDate="2013-11-14T16:58:27.123" Score="2" Body="&lt;p&gt;If you're dead set on using the ASA to route local traffic instead of the switch, you will need to update the ASA with NAT statements for inter-VLAN communication and also add &lt;code&gt;same-security-traffic permit intra-interface&lt;/code&gt; to the configuration to allow traffic to go to the ASA and back out the ASA on the same interface.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-11-14T16:58:27.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4980" PostTypeId="2" ParentId="4953" CreationDate="2013-11-14T17:57:58.773" Score="10" Body="&lt;p&gt;I use &lt;a href=&quot;http://www.racksolutions.com/wall-racks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;purpose-built wall mount&lt;/a&gt; racks for mounting server and networking equipment flush to a wall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hang the router vertically and use the traditional rack ears and cage nuts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1zExB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/iIZIJ.jpg&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="548" LastEditorUserId="548" LastEditDate="2013-11-17T21:12:53.530" LastActivityDate="2013-11-17T21:12:53.530" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="4983" PostTypeId="1" AcceptedAnswerId="4984" CreationDate="2013-11-14T19:09:25.890" Score="4" ViewCount="8821" Body="&lt;p&gt;I know on the Cisco ASA 5505 is limited to only a class C 254 addresses in the DCHPD pool, mainly because of physical resource limitations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this hold true for higher end models likes the 5512-X or 5515-X? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="1352" LastActivityDate="2014-08-13T00:00:01.963" Title="What is the Cisco ASA DHCP Server Address Limit on higher end modles" Tags="|cisco-asa|dhcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4984" PostTypeId="2" ParentId="4983" CreationDate="2013-11-14T19:39:57.140" Score="5" Body="&lt;p&gt;From the &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa91/configuration/general/basic_dhcp.html#wp1125251&quot; rel=&quot;noreferrer&quot;&gt;ASA Config Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For all ASA models, the maximum number of DHCP client addresses varies&#xA;  depending on the license:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•If the limit is 10 hosts, the maximum available DHCP pool is 32&#xA;  addresses.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•If the limit is 50 hosts, the maximum available DHCP pool is 128&#xA;  addresses.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•&lt;strong&gt;If the number of hosts is unlimited, the maximum available DHCP pool&#xA;  is 256 addresses.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Example from an&#xA;ASA5512X:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# dhcpd address 10.206.0.1-10.206.254.254 inside&#xA;Warning, DHCP pool range is limited to 256 addresses, set address range as: 10.206.0.1-10.206.1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-11-14T19:39:57.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4986" PostTypeId="1" AcceptedAnswerId="4995" CreationDate="2013-11-14T20:45:52.767" Score="1" ViewCount="2807" Body="&lt;p&gt;I'm trying to configure the phone configuration on my business' Cisco 2811 router. Without buying a bunch of dongles and connecting through the console port of the router, I'd like to try to SSH or Telnet into the router. &lt;strong&gt;My problem is that I don't know the IP of the Cisco 2811 router.&lt;/strong&gt; The topology goes something like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DSL -&amp;gt; DSL Motorola Modem -&amp;gt; Cisco 2950 Switch -&amp;gt; Cisco 2811 Router -&amp;gt; Phones                                           &#xA;                                               -&amp;gt; Workstations&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure that the modem is acting as a DHCP server and being a pretty dumb modem it doesn't offer a DHCP table to show which devices are getting which IP's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I basically need to do is backtrack through a workstation, to the switch, to somehow get the IP of the switch and SSH/Telnet into the switch to find out which IP the router is getting. Once I have the IP of the router I can try SSH/Telnetting into the router and be able to configure it that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone please correct me if I'm wrong but would this be a way to go about this?&lt;/p&gt;&#xA;" OwnerUserId="2584" LastEditorUserId="44" LastEditDate="2013-11-15T15:20:30.880" LastActivityDate="2013-11-19T05:16:51.573" Title="Find IP Address of Cisco 2811" Tags="|cisco|switch|router|dhcp|voip|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="4987" PostTypeId="2" ParentId="4986" CreationDate="2013-11-14T21:03:40.933" Score="3" Body="&lt;p&gt;&lt;code&gt;Traceroute&lt;/code&gt; seems like your easiest option. Point it to something outside of your network (like google).  Using that will resolve any device along the path.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;root@xxx:~# traceroute -n google.com&lt;br&gt;&#xA;  traceroute to google.com (173.194.37.100), 8 hops max, 60 byte packets&lt;br&gt;&#xA;  1  x.x.228.1  0.429 ms  0.495 ms  0.615 ms&lt;br&gt;&#xA;  2  x.x.214.57  1.392 ms  1.997 ms  2.717 ms&lt;br&gt;&#xA;  3  x.x.6.53  15.051 ms  15.432 ms  16.069 ms&lt;br&gt;&#xA;  4  x.x.77.253  19.433 ms  20.015 ms  20.553 ms&lt;br&gt;&#xA;  5  109.159.254.132  17.706 ms  18.263 ms  18.615 ms&lt;br&gt;&#xA;  6  195.99.126.109  20.793 ms  21.157 ms  21.433 ms&lt;br&gt;&#xA;  7  209.85.252.186  20.599 ms *  20.774 ms&lt;br&gt;&#xA;  8  209.85.253.94  21.257 ms  16.791 ms 209.85.244.240  17.158 ms  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;root@xxx:~#&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In the instance above, the router would likely be x.x.214.57.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2013-11-14T21:03:40.933" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="4988" PostTypeId="1" AcceptedAnswerId="5232" CreationDate="2013-11-15T00:13:01.943" Score="6" ViewCount="626" Body="&lt;p&gt;Say you have a 3x3 AP and three clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without MU-MIMO, &lt;strong&gt;one&lt;/strong&gt; client can receive &lt;strong&gt;three&lt;/strong&gt; spatial streams per time slot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With MU-MIMO, &lt;strong&gt;three&lt;/strong&gt; clients can each receive &lt;strong&gt;one&lt;/strong&gt; spatial stream per time slot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the total link capacity per client is still the same over time. So what's the benefit of MU-MIMO?&lt;/p&gt;&#xA;" OwnerUserId="2360" LastActivityDate="2013-11-29T11:49:47.487" Title="802.11ac: What is the benefit of MU-MIMO?" Tags="|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4992" PostTypeId="1" AcceptedAnswerId="4993" CreationDate="2013-11-15T09:01:15.733" Score="1" ViewCount="2830" Body="&lt;p&gt;I have two switches (Netgear Prosafe FS104's) and want to use these to create a LAN with cheap redundancy. So, if one switch fails, the other can still route traffic between our PCs and maintain communications with the outside world. Each switch has its own internet connection to the outside world. Each PC has only &lt;strong&gt;one&lt;/strong&gt; NIC. I was thinking of splitting the 2 pairs of TxRx lines available on each NIC and sending one pair to each switch. The question is what else would I need to get this to work? All PCs run Linux (Ubuntu). &lt;/p&gt;&#xA;" OwnerUserId="3236" LastEditorUserId="775" LastEditDate="2013-11-15T12:06:45.300" LastActivityDate="2013-11-22T01:47:34.103" Title="Simple redundant LAN" Tags="|switch|redundancy|netgear-prosafe|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4993" PostTypeId="2" ParentId="4992" CreationDate="2013-11-15T10:08:50.010" Score="2" Body="&lt;p&gt;End-user computers, generally, do not require this level of redundancy.  You would see this level of fault tolerance in a stacked/chassis setup for something like a server farm. You would have two routing engines, two power supplies, multiple cards and multiple links to that node with 802.1ax (i.e. LACP/PAgP) to help protect you in every instance from an outage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want redundancy, split the network into two. Have half your connections going to one switch, and the other half going to the former.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I was thinking of splitting the 2 pairs of TxRx lines available on&#xA;  each NIC and sending one pair to each switch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a very bad idea; not to mention it will not work how your anticipating it will. If you did split the pairs like this, you would only get use out of one set of them. Auto negotiation will allow a single pair to function by autoing down to 100Mb; remember, 100BASE-TX only functions on pairs 1,2,3 and 6. &lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2013-11-15T10:08:50.010" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="4995" PostTypeId="2" ParentId="4986" CreationDate="2013-11-15T13:41:26.260" Score="5" Body="&lt;p&gt;If your 2811 is providing the phone services for your Cisco IP Phones at this site, finding the IP Address of the 2811 is relatively easy:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Press the &quot;settings&quot; button on one of the phones&lt;/li&gt;&#xA;&lt;li&gt;Choose &quot;Device Configuration&quot;&lt;/li&gt;&#xA;&lt;li&gt;Choose &quot;Unifed CM Configuration&quot;&lt;/li&gt;&#xA;&lt;li&gt;Choose &quot;Unified CM 1&quot; or whichever says &quot;Active&quot;&lt;/li&gt;&#xA;&lt;li&gt;The listed IP address is the IP address of whatever device is controlling the phones (either the 2811 on site, or a CUCM at another facility)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The specific steps may vary depending on your phone models and firmware versions, but this should guide you in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;With all of that said, it really sounds like (based on your previous question and this one) that you're taking some stabs in the dark.   I &lt;strong&gt;&lt;em&gt;HIGHLY&lt;/em&gt;&lt;/strong&gt; recommend checking out Jeremy Ciora's book from Cisco Press: &quot;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/1587204177&quot; rel=&quot;nofollow&quot;&gt;CCNA Voice 640-461 Official Cert Guide&lt;/a&gt;&quot;.  It will help guide you through many of the questions you might have about Cisco IP telephony, and IP telephony in general.   I've given it to several folks over the years, and it has helped them greatly.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-11-15T13:50:58.863" LastActivityDate="2013-11-15T13:50:58.863" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="4997" PostTypeId="1" AcceptedAnswerId="4998" CreationDate="2013-11-15T19:45:14.610" Score="9" ViewCount="47356" Body="&lt;p&gt;As we know, during OSPF configuration we use the area.  Each area has its different number, while there is only one area (area 0) which creates communications between all other attached areas. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am confused that as we are using the same configuration techniques over all of the areas, but I don't know why we use areas if we can direct connect all of the PCs.&lt;/p&gt;&#xA;" OwnerUserId="3242" LastEditorUserId="775" LastEditDate="2013-11-18T11:46:43.557" LastActivityDate="2019-02-17T15:07:20.257" Title="What is the advantage of an &quot;area&quot; in OSPF configuration?" Tags="|routing|ospf|architecture|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="4998" PostTypeId="2" ParentId="4997" CreationDate="2013-11-15T20:01:32.133" Score="12" Body="&lt;p&gt;If you're asking specifically what Areas do in OSPF, there are many resources out there which have a wealth of information.  These are just a few selections:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;https://www.cisco.com/en/US/tech/tk365/technologies_white_paper09186a0080094e9e.shtml&quot;&gt;Cisco OSPF Design Guide&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;A Cisco Design Technote &lt;a href=&quot;https://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094aaa.shtml&quot;&gt;What Are OSPF Areas and Virtual Links?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;PacketLife.net blog entry on &lt;a href=&quot;http://packetlife.net/blog/2008/jun/24/ospf-area-types/&quot;&gt;OSPF Area Types&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However, a good answer to &quot;What is the advantage of OSPF Areas?&quot;, is this quote from the Cisco Design Technote, What are OSPF Areas:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An OSPF network can be divided into sub-domains called areas. An area is a logical collection of OSPF networks, routers, and links that have the same area identification.  A router within an area must maintain a topological database for the area to which it belongs. The router doesn't have detailed information about network topology outside of its area, thereby reducing the size of its database.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In short OSPF Areas allow you to segment your network topology to enable greater scalability and maintain a greater level of control.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;  In response to your comment &quot;How can OSPF Areas increase the speed of communication?&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By itself, using OSPF Areas doesn't increase the speed of communication.  It removes roadblocks to communication/scalability.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of it like this (this isn't a perfect analogy, and over-simplifies the issue, but it should help give the general idea): &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a company takes hundreds of telephone calls each day, and has to send all of it's telephone calls to a single secretary, calls into the company will be slow.  However if there is a central secretary who knows about many secretaries who all take calls for a different portion of the company, calls can more quickly be processed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A similar issue arises when routing tables for any one device get too large/unmanageable.  Splitting them into more manageable areas can help speed traffic along to it's destination.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-11-15T20:25:03.637" LastActivityDate="2013-11-15T20:25:03.637" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="4999" PostTypeId="1" AcceptedAnswerId="5001" CreationDate="2013-11-15T22:08:21.030" Score="3" ViewCount="10757" Body="&lt;p&gt;The topic says it all; is there any hope for using multi-mode transceivers on a single-mode fiber cable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I work exclusively with mobile setups, where I use pretty expensive fiber cables. The equipment I use is a mix of multi and single-mode, and I was hoping that I could settle on one common standard cable.&lt;/p&gt;&#xA;" OwnerUserId="3244" LastActivityDate="2023-12-11T06:12:50.510" Title="multi-mode transceivers on single-mode fiber" Tags="|fiber|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5000" PostTypeId="1" AcceptedAnswerId="5003" CreationDate="2013-11-15T22:13:18.477" Score="6" ViewCount="6815" Body="&lt;p&gt;I'm working with several cisco 1200 series APs, trying to get relevant client information off of them.  It would be helpful to see RSSI and SNR for individual clients connected, but I am unable to find any commands that are related to this.  I've checked around the cisco forums, and a lot of people were able to find this info using some perl scripts along with information from end user wireless cards, but that is not an option for me.  I have remote access only to the APs.  Other posts recommend using some kind of wireless controller to view this, but that is also not an option.  Any suggestions are appreciated.&lt;/p&gt;&#xA;" OwnerUserId="3245" LastEditorUserId="44" LastEditDate="2013-11-16T01:00:25.900" LastActivityDate="2013-11-16T01:07:40.443" Title="Cisco 1200 AP, client information from CLI" Tags="|cisco|wireless|cisco-ios|cli|cisco-wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5001" PostTypeId="2" ParentId="4999" CreationDate="2013-11-15T22:19:18.467" Score="12" Body="&lt;p&gt;Absolutely: &lt;strong&gt;NO&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think about it for a second... you're firing a 62.5um (or 50um) laser into a 9um fiber. That means ~85% of the signal is gone from the very start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The opposite will work: SM launched into a MM fiber, but it takes good fiber, a &lt;a href=&quot;http://www.lanshack.com/ModeConditioning.aspx&quot;&gt;Mode Conditioning Cable&lt;/a&gt;, and your distance will be compromised. But it can work.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-11-15T23:12:43.247" LastActivityDate="2013-11-15T23:12:43.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5002" PostTypeId="2" ParentId="4999" CreationDate="2013-11-16T00:06:39.833" Score="1" Body="&lt;p&gt;As Ricky has pointed out, no this will not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For people new to fiber, I always thought HP provided a nice visual layout in some of their documentation of the different transceiver types, the fiber they work on, and their distance limitations.  You can find this chart on page four of &lt;a href=&quot;http://www.hp.com/rnd/pdfs/100FXtechbrief.pdf&quot; rel=&quot;nofollow&quot;&gt;this document&lt;/a&gt; for one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other documents have the same information, but in a more tabular format (rather than the graphic/chart).  For example, you can start on page nine of &lt;a href=&quot;http://www.hp.com/rnd/pdfs/10gig_cabling_technical_brief.pdf&quot; rel=&quot;nofollow&quot;&gt;this document&lt;/a&gt; (other vendors provide this as well, but I stuck with HP for this answer).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-11-16T00:06:39.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5003" PostTypeId="2" ParentId="5000" CreationDate="2013-11-16T01:00:02.757" Score="6" Body="&lt;p&gt;&lt;em&gt;You state that a Wireless Controller is not an option, so I'm assuming these are Autonomous Access Points.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco Autonomous APs, you are looking for the &lt;code&gt;show dot11 associations&lt;/code&gt; command and it's associated sub commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It gives an output like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SPARKY#show dot11 associations                                  &#xA;&#xA;802.11 Client Stations on Dot11Radio0: &#xA;&#xA;SSID [sparky] : &#xA;&#xA;MAC Address    IP address      IPV6 address     Device        Name     Parent         State &#xA;XXXX.da1d.1b05 172.20.1.102    ::               unknown       -        self           Assoc&#xA;XXXX.2c90.c42f 172.20.1.103    ::               unknown       -        self           Assoc&#xA;XXXX.59c0.4ac4 172.20.1.116    ::               unknown       -        self           Assoc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once you have the MAC address of your client, you can run the &lt;code&gt;show dot11 associations &amp;lt;MAC ADDRESS&amp;gt;&lt;/code&gt; command where &lt;code&gt;&amp;lt;MAC ADDRESS&amp;gt;&lt;/code&gt; is the MAC address of the client you're interested in.  It should give you all the information you're after.  You can also run &lt;code&gt;show dot11 associations all-client&lt;/code&gt; and see this information for all associated clients.  See the below sample:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SPARKY#show dot11 associations XXXX.da1d.1b05&#xA;Address           : XXXX.da1d.1b05     Name             : NONE&#xA;IP Address        : 172.20.1.102       IPv6 Address        : ::                                      &#xA;Gateway Address   : 0.0.0.0            &#xA;Netmask Address   : 0.0.0.0            Interface        : Dot11Radio 0&#xA;Bridge-group        : 1&#xA;reap_flags_1        : 0x0     ip_learn_type       : 0x0       transient_static_ip : 0x0       &#xA;Device            : unknown            Software Version : NONE &#xA;CCX Version       : NONE               Client MFP       : Off&#xA;&#xA;State             : Assoc              Parent           : self               &#xA;SSID              : sparky                          &#xA;VLAN              : 10&#xA;Hops to Infra     : 1                  Association Id   : 3&#xA;Clients Associated: 0                  Repeaters associated: 0&#xA;Tunnel Address    : 0.0.0.0&#xA;Key Mgmt type     : WPAv2 PSK          Encryption       : AES-CCMP&#xA;Current Rate      : m7-2               Capability       : WMM ShortHdr ShortSlot&#xA;Supported Rates   : 1.0 2.0 5.5 11.0 6.0 9.0 12.0 18.0 24.0 36.0 48.0 54.0 m0-2 m1-2 m2-2 m3-2 m4-2 m5-2 m6-2 m7-2&#xA;Voice Rates       : disabled           Bandwidth        : 20 MHz &#xA;Signal Strength   : -59  dBm           Connected for    : 209172 seconds&#xA;Signal to Noise   : 34  dB            Activity Timeout : 25 seconds&#xA;Power-save        : Off                Last Activity    : 35 seconds ago&#xA;Apsd DE AC(s)     : NONE&#xA;&#xA;Packets Input     : 8306               Packets Output   : 4109      &#xA;Bytes Input       : 816594             Bytes Output     : 565535    &#xA;Duplicates Rcvd   : 17                 Data Retries     : 803       &#xA;Decrypt Failed    : 0                  RTS Retries      : 0         &#xA;MIC Failed        : 0                  MIC Missing      : 0         &#xA;Packets Redirected: 0                  Redirect Filtered: 0         &#xA;IP source guard failed : 0             PPPoE passthrough failed : 0             &#xA;DAI failed : IP mismatch  : 0             src MAC mismatch : 0             target MAC mismatch : 0           &#xA;Existing IP failed :  0              New IP failed :  0             &#xA;11w Status       : Off&#xA;Session timeout   : 0 seconds&#xA;Reauthenticate in : never&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-11-16T01:07:40.443" LastActivityDate="2013-11-16T01:07:40.443" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5004" PostTypeId="1" CreationDate="2013-11-16T02:58:09.247" Score="4" ViewCount="5644" Body="&lt;p&gt;Not so sure if this question is considered valid, but I'm trying my luck.&#xA;I acquired a Brocade Silkworm 3800 FC switch, and it came with password in it.&#xA;I do not have access to Password Recovery Firmware.&#xA;Will any of you resident experts point me to a right direction?&#xA;Thank You &lt;/p&gt;&#xA;" OwnerUserId="3247" LastActivityDate="2013-11-16T03:49:02.650" Title="Resetting a password for Brocade 3800 when you don't have support channels" Tags="|brocade|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5005" PostTypeId="2" ParentId="5004" CreationDate="2013-11-16T03:49:02.650" Score="5" Body="&lt;p&gt;The way I did it was with a &quot;fabric recovery&quot; tool.  But this requires you to have a second switch with a known password.  It erases the configuration (and passwords) from the entire fabric. (yes, a rather dangerous tool)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also the (nearly undocumented) root and factory accounts.  WARNING: root access drops you to an os shell (vxWorks) from which you can permanently damage the system.  Login as &lt;code&gt;root&lt;/code&gt; (passwd: &lt;code&gt;fibranne&lt;/code&gt;), and issue the command &lt;code&gt;passwddefault&lt;/code&gt; and then &lt;code&gt;exit&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The linux based systems 3250, 3850 are a bit more involved, but amount to booting in single mode and running &lt;code&gt;/sbin/passwddefault&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[BTW, the default user is &lt;code&gt;admin&lt;/code&gt; with password &lt;code&gt;password&lt;/code&gt;]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-11-16T03:49:02.650" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5006" PostTypeId="2" ParentId="4997" CreationDate="2013-11-16T04:47:43.590" Score="15" Body="&lt;p&gt;All routers within an OSPF area keep a link state database (note that this is completely separate from the main routing table), where they're aware of all other routers and their links within the area. Each router within the area builds a topology tree of the area, with shortest paths to all other links/routers &lt;strong&gt;with itself as the root.&lt;/strong&gt; This last part is important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When an area grows large, the link state database (the tree or topology) that each router must maintain also grows large. This means that it can become more and more intensive for the router to process link state (topology) changes as there are now a large number of entries in the link state database. The tree grows larger and is more difficult to &quot;keep up&quot; with as there become more and more branches/leaves of the tree. Something else to keep in mind is that as the area (network) grows larger, there is greater potential for link state changes, and thus a greater potential for recalculations of the link state database. While the details of which are somewhat &quot;out of scope&quot; of this answer, the OSPF link state update process is also relevant here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, as a single area grows larger and larger, the SPF recalculations themselves will take longer to complete, and you have more risk of those SPF recalculations happening due to various reasons - the moral of the story is your routers' CPUs will be sad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;advantage&quot; of OSPF areas is that they provide a means to alleviate the demands placed on the routers if they were otherwise in a single area, by way of cutting down entries within the link state database and pushing responsibilities of the link state database maintenance to area border routers for their respective areas. It allows for &lt;strong&gt;a way to keep the tree size manageable&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thorough thought and planning is mandatory for designing/implementing multi-area OSPF - there are a number of situations where poor design in multi-area OSPF can bite someone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using areas doesn't necessarily increase the &quot;speed of communication&quot; but it can have significant performance benefits (if done properly) to the routers in your OSPF network, especially if your network is very large, because their CPU's aren't having to work as hard.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-11-16T05:48:12.787" LastActivityDate="2013-11-16T05:48:12.787" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5007" PostTypeId="1" AcceptedAnswerId="5008" CreationDate="2013-11-16T14:53:45.400" Score="38" ViewCount="67597" Body="&lt;p&gt;I am currently in college for a bachelor's degree in Network Engineering, and one of my Professors explained in class that a traceroute that shows, for example, 15 hops is actually abstracting the path, and in reality many more nodes are involved. Is this true?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This contradicts everything I can find on traceroute. To my knowledge, traceroute works by sending ICMP (or UDP) packets to a specific destination with a TTL from 0 --&gt; n until the destination is reached. The probe packets that are sent out time out at each location along the way in succession, producing an ICMP &quot;time exceeded&quot; reply, and finally a &quot;port unreachable&quot; message when reaching the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the imperfections of traceroute - for example, traceroute traffic may be blocked by certain gateways, or the TTL of the reply packet may be set to the probe's remaining TTL, causing it to never return to the sender.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, after a lot of researching, I can't find anything referencing traceroute being inaccurate in the case of a traceroute that always returns the same path. Likewise, nothing referencing there being any &quot;extra&quot; hops not reported by traceroute (other than * * * hops that timed out with no reply).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm open to discussion, and I'm genuinely interested to know the answer to this.&lt;/p&gt;&#xA;" OwnerUserId="3187" LastActivityDate="2020-04-17T22:48:56.100" Title="Does a traceroute/tracert show every hop, or does it skip/hide some details of the path?" Tags="|routing|packet-analysis|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5008" PostTypeId="2" ParentId="5007" CreationDate="2013-11-16T15:43:11.707" Score="44" Body="&lt;p&gt;A traceroute will show you how many layer 3 hops you are getting through from A to B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However you could be going through hundreds of switches in between. You could also be going through 10 ISP routers running a layer 2 VPN which appears as a single hop. An MPLS network could hide its internals, or show its internals to you. You could have transparent firewalls in the path as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way your Professor is correct in saying that you cannot guarantee that every single device in the path will count as a hop to you. Because of the above points I mentioned, you could be going through 50 devices but it could look like three to you. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't happen all the time though. If you see 15 hops it very well could be 15 hops. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a basic example of an MPLS set up in regards to TTL: &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/configuration-statement/no-propagate-ttl-edit-protocols-mpls.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/configuration-statement/no-propagate-ttl-edit-protocols-mpls.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1055" LastEditorUserId="67628" LastEditDate="2020-04-17T22:48:56.100" LastActivityDate="2020-04-17T22:48:56.100" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="5011" PostTypeId="2" ParentId="5007" CreationDate="2013-11-16T18:51:37.407" Score="20" Body="&lt;p&gt;Any device, that does not decrement IP TTL field value is not going to show up in the traceroute path. For example, Cisco ASA Firewall can be configured to decrement the IP TTL field for packets traversing the firewall (&lt;em&gt;set connection decrement-ttl&lt;/em&gt;). By default, the TTL is not being decremented, thus hiding (well, somewhat) the firewall. &lt;/p&gt;&#xA;" OwnerUserId="1347" LastActivityDate="2013-11-16T18:51:37.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5016" PostTypeId="1" AcceptedAnswerId="5020" CreationDate="2013-11-17T00:50:45.833" Score="5" ViewCount="4470" Body="&lt;p&gt;I have some ports on a Catalyst 6509 set to MTU 9216.  Some of these ports belong to port channels with a displayed MTU of 1500.  I also have a great number of VLANs set to 1500 and not 9216.  This is on an aging 6509 chassis with mostly CFCs (though some DFCs) - PFC3A mode running 12.2(33)SXI.  What is the negative effect if any of not adjusting the MTUs of the port-channels and SVIs?&lt;/p&gt;&#xA;" OwnerUserId="43" LastEditorUserId="43" LastEditDate="2013-11-18T16:09:15.940" LastActivityDate="2013-11-18T17:32:47.713" Title="What is the effect of SVI MTU on Catalyst 6509?" Tags="|cisco|ethernet|mtu|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5017" PostTypeId="2" ParentId="5007" CreationDate="2013-11-17T02:45:26.963" Score="14" Body="&lt;p&gt;Traceroute will not show you devices that do not decrement the TTL fields of an IP datagram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also will not show devices which decrement the TTL field, and consume the packet if TTL reaches zero, but neglect to inform the sender of this event via an ICMP datagram. This is not entirely invisible though; you can infer the existence of this missing hop in the traceroute because when the next higher TTL value is used, the next device in the chain does respond, and we know that something between that and the previous device is decrementing TTL, but not announcing itself.  The traditional &lt;code&gt;traceroute&lt;/code&gt; utilty prints asterisks when it doesn't receive a response; it would print a row of asterisks for this type of host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also the remote possibility that some router in between selectively supresses these ICMP messages depending on their source address, making some parts of the path look invisible even though they generated the response.&lt;/p&gt;&#xA;" OwnerUserId="3253" LastActivityDate="2013-11-17T02:45:26.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5020" PostTypeId="2" ParentId="5016" CreationDate="2013-11-17T05:37:13.993" Score="6" Body="&lt;p&gt;Regarding jumbo frame support on the Cat6k, IIRC the default system MTU size is 9216, but there are some modules where a maximum ingress frame size of only 8092 bytes is supported vs 9216 bytes (they'll drop frames larger than 8092 bytes at ingress). Double check the documentation to find out which modules exactly have this limitation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the port-channels, if both ports in the port-channel are already set to the same MTU of 9216, it shouldn't make a difference if you configure the port-channel interface to have a 9216 MTU, but it wouldn't hurt for completeness'/clarity's sake in your configuration. You actually can't have two ports in an EtherChannel that have different MTU sizes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the SVI's, there's really not much of a difference between routing jumbo frames across a routed L3 interface or an SVI (they're essentially the same thing) - just realize that if fragmentation is required across an L3 interface (ie a jumbo frame is routed from one L3 interface to another with a smaller MTU), the frame is punted to the CPU for fragmentation in software, and this can lead to problems. The rule of thumb here is to keep your jumbo frame traffic localized to other destinations/networks that also support jumbo frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While changing the MTU on the VLANs themselves shouldn't really be necessary, make sure that the interface MTU is the same across all the interfaces in the VLAN before setting the VLAN MTU to that same value. And similar to the port-channels, if you already have 9216 as the interface MTU's and the VLAN MTU for those interfaces, it shouldn't actually cause problems to set the MTU of the SVI for those VLANs to 9216.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-11-17T05:37:13.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5023" PostTypeId="1" AcceptedAnswerId="5024" CreationDate="2013-11-17T19:31:12.593" Score="3" ViewCount="20798" Body="&lt;p&gt;I know that when a PC send a packets to any remoter router then first of all it checks out the  Router MAC address which is connected with it, but it gets this MAC Address of Router from ARP Cache, but i don't know is ther the same process of the ARP Cache in the Switch?&#xA;please elaborate me&lt;/p&gt;&#xA;" OwnerUserId="3242" LastEditorUserId="775" LastEditDate="2013-11-18T13:33:17.230" LastActivityDate="2013-11-19T05:50:55.813" Title="What is the main purposes of ARP CACHE in the Switch?" Tags="|switch|ethernet|arp|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5024" PostTypeId="2" ParentId="5023" CreationDate="2013-11-17T19:39:51.243" Score="9" Body="&lt;p&gt;Answering the original router question: Arp caches are there to map an IP addess to a mac address.  There's nothing unique about a router. .. it needs an ARP cache just like any other IP device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Managed switches likewise need an Arp cache so they can communicate with the stations managing them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As we discussed in &lt;a href=&quot;http://chat.stackexchange.com/rooms/11568/discussion-between-fahim-shah-and-mike-pennington&quot;&gt;chat&lt;/a&gt;, you need to add an IP address to your switch so you can communicate via ARP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 2&#xA; name management_vlan&#xA;!&#xA;interface Vlan2&#xA; ip address 192.0.2.20 255.255.255.0&#xA; no shutdown&#xA; no ip route-cache&#xA;!&#xA;ip default-gateway 192.0.2.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This isn't what you asked about, but if you need to see what mac addresses have been learned on a Cisco switch, use &lt;code&gt;show mac address-table&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that mac learning and ARP are completely different processes on a layer 2 switch.  Mac learning is used for communication through the switch.  ARP is required for communication to the switch itself.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-11-18T23:07:23.020" LastActivityDate="2013-11-18T23:07:23.020" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="5025" PostTypeId="2" ParentId="5023" CreationDate="2013-11-17T22:50:22.597" Score="7" Body="&lt;p&gt;You are confusing &quot;arp cache&quot; (layer-3) with the switch mac-address table (layer-2). ARP is for knowing what ethernet device handles traffic for a specific IP. The mac-addr table is a list of MACs known to be on a specific switch port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An ARP cache will only contain the addresses of other hosts with which the host is actively communicating. Routers may keep entries for hours, but hosts tend to keep them for minutes.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-11-17T22:50:22.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5026" PostTypeId="2" ParentId="5023" CreationDate="2013-11-17T23:05:57.807" Score="7" Body="&lt;p&gt;ARP is a protocol that adapts layer 2 (Ethernet) to layer 3 (IP) by mapping IP addresses to Ethernet hardware (MAC) addresses. A pure switch is a pure layer 2 device, operating at the Ethernet layer. So it has no need for an ARP cache. A managed switch may have an ARP cache to keep track of the hardware addresses of devices that are managing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch, of course, does have a CAM table, mapping MAC addresses to ports. But that has nothing to do with ARP (except that ARP traffic, like most Ethernet traffic, can populate the CAM table).&lt;/p&gt;&#xA;" OwnerUserId="3258" LastActivityDate="2013-11-17T23:05:57.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5028" PostTypeId="1" CreationDate="2013-11-18T03:16:41.007" Score="9" ViewCount="979" Body="&lt;p&gt;In MPLS enabled routers, is a unique label generated per Destination prefix in routing Table or is it per Next-hop in the routing table if not both, how is the mapping between unique labels and routing table entry ?&#xA;Also, if it is per Destination prefix, how sclable is it? &lt;strong&gt;As per my understanding maximum label value is 2^20 = 1048576. What if number of routing table entries is greater than 1048576?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="3193" LastActivityDate="2013-11-18T08:12:49.993" Title="Label to Route mapping, Label generation scalability" Tags="|mpls|ldp|mpls-vpn|rsvp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5029" PostTypeId="2" ParentId="5028" CreationDate="2013-11-18T03:47:53.090" Score="6" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;is a unique label generated per Destination prefix in routing Table or is it per Next-hop in the routing table? ...i have seen customer scenarios approaching 1 million routes...  But the MPLS doesn't have any common guidelines for label generation ? Is there not a common rule saying a unique label should be generated per Destination-prefix or per nexthop ? or is it just implementation specific?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;There seems to be a little confusion.  It's rather unlikely that someone would ever want to allocate a unique label per internet route.  A well-designed MPLS network should allocate labels based on IGP prefixes that are bound to your BGP next-hops (ref &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3031#section-4.6&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;RFC 3031, Section 4.6&quot;&gt;RFC 3031, Section 4.6&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;As such, I'm not really sure 1 Million labels in the LFIB is a serious MPLS design constraint today.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-11-18T04:01:24.340" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5030" PostTypeId="2" ParentId="5028" CreationDate="2013-11-18T08:03:46.437" Score="3" Body="&lt;p&gt;The exact practical scenario when labels might run out is debatable. There are some house-keeping issues also which are not directly related to labels running out but contribute to that effect.&lt;/p&gt;&#xA;&lt;p&gt;Label managers today in major vendors (CSCO, JNPR at least) are programmed so that they need continuous block per label application. Of course this could be fixed, with some cost in performance and complexity, but is certainly another issue to consider.&lt;/p&gt;&#xA;&lt;p&gt;Some MPLS services are quite hungry for label-space in the core, in the edge is mostly irrelevant as we can mask them under our 'IGP label'.&lt;br /&gt;&#xA;We need to remember MPLS is not just about IP, it is about FEC, if we need to give some service different treatment/path in the core, we need new FEC.&lt;/p&gt;&#xA;&lt;p&gt;There are some discussions about supporting &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-li-mpls-mega-label-00&quot; rel=&quot;nofollow noreferrer&quot;&gt;mega labels&lt;/a&gt; and &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-renwei-mpls-big-label-00&quot; rel=&quot;nofollow noreferrer&quot;&gt;big labels&lt;/a&gt;, their &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-mpls-big-label-ucase-req-00&quot; rel=&quot;nofollow noreferrer&quot;&gt;use cases&lt;/a&gt;, although more likely implementation will via &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-mpls-special-purpose-labels-03&quot; rel=&quot;nofollow noreferrer&quot;&gt;special purpose labels&lt;/a&gt;. Personally I'd hope/expect MPLS wire-format to be changed before 2^20 becomes an issue. As MPLS is mostly used only inside one operator network, changing the wire-format is super easy in comparison to IPv4-&amp;gt;IPV6 migration, so what ever problems we'll run into, addressing them will be quite simple. Some issues I'd like to be solved:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ability to retain label history in-transit&lt;/li&gt;&#xA;&lt;li&gt;Low byte overhead (TTL, TC are redundant in stacked labels)&lt;/li&gt;&#xA;&lt;li&gt;Remove need for transit P 'duck-typing' MPLS payload (breaks ECMP today)&lt;/li&gt;&#xA;&lt;li&gt;Extendable by design (special purpose labels introduce huge byte-cost)&lt;/li&gt;&#xA;&lt;li&gt;Increased label space&lt;/li&gt;&#xA;&lt;li&gt;Co-existence with MPLSv1&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="561" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-11-18T08:12:49.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5032" PostTypeId="1" CreationDate="2013-11-18T15:04:07.313" Score="3" ViewCount="218" Body="&lt;p&gt;do anyone know how to group all AS numbers for Germany (f.example). Do they have some specific attributes to build a regular expression or something like this, something like a filter for all AS numbers from Germany.&#xA;I have a list of, I think, all &lt;a href=&quot;http://bgp.he.net/country/DE&quot; rel=&quot;nofollow&quot;&gt;German ASs (via bgp.he.net)&lt;/a&gt; but I do not see any similarity in AS numbers to form a filter or regular expression.&lt;/p&gt;&#xA;" OwnerUserId="2665" LastEditorUserId="775" LastEditDate="2013-11-18T15:16:22.467" LastActivityDate="2013-11-18T16:00:55.940" Title="group AS number for specific country ex Germany" Tags="|routing|ipv4|bgp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5033" PostTypeId="2" ParentId="5032" CreationDate="2013-11-18T15:09:08.190" Score="4" Body="&lt;p&gt;There is no country group. Germany is in the RIPE region and hence RIPE assigns the next available AS to the next company that requests that sites in the RIPE region. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything yellow in the following image sits in the RIPE region: &lt;a href=&quot;http://en.wikipedia.org/wiki/File:Regional_Internet_Registries_world_map.svg&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/File:Regional_Internet_Registries_world_map.svg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-11-18T15:09:08.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5034" PostTypeId="2" ParentId="5032" CreationDate="2013-11-18T16:00:55.940" Score="3" Body="&lt;p&gt;Assuming you're happy with &lt;a href=&quot;http://bgp.he.net/country/DE&quot; rel=&quot;nofollow&quot; title=&quot;German AS numbers from bgp.he.net&quot;&gt;bgp.he.net's Germany AS list&lt;/a&gt;, you can write a script to add these AS numbers into a route-map (or leave it as an as-path list if you don't care as much about readability)...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip as-path access-list 42 permit _13237$&#xA;ip as-path access-list 42 permit _3257$&#xA;ip as-path access-list 42 permit _25220$&#xA;! ... add all entries from bgp.he.net/country/DE&#xA;!&#xA;route-map GERMANY_ASN permit 10&#xA; description All German ASNs, as found on http://bgp.he.net/country/DE&#xA; match as-path 42&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once you've done this, you just need to update the router's version of &lt;code&gt;as-path list 42&lt;/code&gt; periodically to ensure you catch everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether it's really useful to accept someone else's definition of German AS numbers is another interesting question, but I'll assume you're happy with he.net's list.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-11-18T16:00:55.940" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5038" PostTypeId="5" CreationDate="2013-11-18T18:41:56.250" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2013-11-18T18:41:56.250" LastActivityDate="2013-11-18T18:41:56.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5039" PostTypeId="4" CreationDate="2013-11-18T18:41:56.250" Score="0" Body="A tag for questions involving Juniper Networks Operating System (Junos) software." OwnerUserId="3191" LastEditorUserId="775" LastEditDate="2013-11-18T19:05:14.443" LastActivityDate="2013-11-18T19:05:14.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5040" PostTypeId="2" ParentId="5023" CreationDate="2013-11-19T01:01:52.537" Score="0" Body="&lt;p&gt;The switch keeps an arp cache like any host. One reason for having an arp cache and using it is when you have non routed subnets (like oracle RAC clusters) so you may not want to put an SVI on the L3 switch (I will run a direct connection between the two switches involved in the NIC team only allow the non routed vlans over it) and put SVIs in the switch for the address space so I can ping the heartbeat interfaces. Then look at the arp table then can find with switch port, easier then getting an ifconfig from the server. It is true that in general the SVI in a switch is just used for management so the only arp entry is for the default gateway, but in certain configurations using multiple SVIs and exploiting ARP can be a great help. &lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-11-19T01:01:52.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5044" PostTypeId="2" ParentId="5023" CreationDate="2013-11-19T05:08:51.107" Score="-1" Body="&lt;p&gt;ARP cache on switch is needed for local/remote management, send SNMP trap, and work other protocols.&lt;/p&gt;&#xA;" OwnerUserId="1315" LastEditorUserId="775" LastEditDate="2013-11-19T05:50:55.813" LastActivityDate="2013-11-19T05:50:55.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5045" PostTypeId="2" ParentId="4986" CreationDate="2013-11-19T05:16:51.573" Score="0" Body="&lt;p&gt;We can also use CDP to get IP address of directly connected device, for e.q from 2950 switch or workstation by sniffer. Sw2950&gt; sh cdp nei * detail.&lt;/p&gt;&#xA;" OwnerUserId="1315" LastActivityDate="2013-11-19T05:16:51.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5046" PostTypeId="5" CreationDate="2013-11-19T07:25:29.447" Score="0" Body="" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-11-19T07:25:29.447" LastActivityDate="2013-11-19T07:25:29.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5047" PostTypeId="4" CreationDate="2013-11-19T07:25:29.447" Score="0" Body="Use this tag for questions about the life of a packet *within a switch, router, or firewall chassis*.  Do not use this tag for questions about traceroute, or traffic engineering." OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-11-19T07:25:29.447" LastActivityDate="2013-11-19T07:25:29.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5049" PostTypeId="1" AcceptedAnswerId="5051" CreationDate="2013-11-19T14:32:13.360" Score="2" ViewCount="154" Body="&lt;p&gt;I have the Cisco Small Business RV180W and I need to setup a VPN on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to buy a VPN client or can I use any VPN client?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume I can use any VPN client since all I am doing is generating a PSK and connecting to the IP with a user/pass/key.&lt;/p&gt;&#xA;" OwnerUserId="3273" LastActivityDate="2013-11-19T16:16:45.130" Title="Cisco small business vpn firewall" Tags="|cisco|vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5051" PostTypeId="2" ParentId="5049" CreationDate="2013-11-19T16:16:45.130" Score="1" Body="&lt;p&gt;From the data sheet on that router it looks like it supports PPTP for remote vpn. Any PPTP client should work, Windows has one built in.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-11-19T16:16:45.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5052" PostTypeId="1" AcceptedAnswerId="5053" CreationDate="2013-11-19T16:20:28.263" Score="6" ViewCount="2874" Body="&lt;p&gt;Can please someone explain me on the below screenshot why host 192.168.1.200 on packet 9 sends an ACK for the packets 6 - 7 - 8? The total packet size does not correspond to the window size agreed. If I understood it correctly the window size is the amount o data that a device can send without acknowledging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/C9r7m.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3249" LastEditorUserId="775" LastEditDate="2013-11-20T02:04:34.027" LastActivityDate="2013-11-20T02:04:34.027" Title="Wireshark TCP and window size" Tags="|tcp|protocol-theory|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5053" PostTypeId="2" ParentId="5052" CreationDate="2013-11-19T16:37:00.313" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can please someone explain me on the below screenshot why host 192.168.1.200 on packet 9 sends an ACK for the packets 6 - 7 - 8? The total packet size does not correspond to the window size agreed. If I understood it correctly the window size is the amount o data that a device can send without acknowledging.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The window size is the &lt;em&gt;maximum&lt;/em&gt; amount of unacknowledged data that can be outstanding in a socket; however, there is no requirement to fill this window before ACK-ing.  In fact, most low-latency connections do not fill the window because stations acknowledge data so quickly.  What you are seeing is normal, there is no problem.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-11-19T16:37:00.313" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5054" PostTypeId="1" CreationDate="2013-11-19T16:41:57.850" Score="4" ViewCount="928" Body="&lt;p&gt;I have a cisco ME 3400 switch . And I have configured fa0/23 as trunk port and connected this to a router for carrying multiple vlan traffic. And i have created some vlans eg: 1500, 1501 etc and added each individual ports fa0/1 ,0/2 etc in to separate vlans as access port. Now I can communicate with the server..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now  I want to connect another switch to this cisco me 3400 . this is for carrying multiple vlan traffic which is created in the cisco me 3400 switch i.e traffic of vlan 1500 , 1501 etc  to another switch.  How to configure this?&lt;/p&gt;&#xA;" OwnerUserId="3274" LastEditorUserId="775" LastEditDate="2013-11-20T02:19:19.337" LastActivityDate="2013-11-23T21:56:53.623" Title="Creating multiple trunk ports on a Cisco ME3400" Tags="|cisco|switch|ethernet|vlan|cisco-commands|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5056" PostTypeId="1" AcceptedAnswerId="5060" CreationDate="2013-11-19T19:28:06.887" Score="0" ViewCount="890" Body="&lt;p&gt;I'm reading &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1144&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1144&lt;/a&gt; and I'm trying to figure out how the TCP/IP header compression works. As I understand it, the sender only sends a couple of fields that are likely to be changed.&lt;/p&gt;&#xA;&lt;p&gt;If the packet doesn't contain the IP of the sender, how does the receiver know which IP address it needs to respond to?&lt;/p&gt;&#xA;&lt;p&gt;Which packet headers does the receiver store to &amp;quot;rebuild&amp;quot; the packet?&lt;/p&gt;&#xA;&lt;p&gt;More Info :&lt;br /&gt;&#xA;Suppose i have a receiver lets call it R and two Senders S1 and S2 .&lt;br /&gt;&#xA;at first S1 and S2 sends SYN streams to R , so R stores in an array their headers (complete headers) , next S1 sends a compressed packet , how R knows according to which header it must rebuild the packet ?&lt;br /&gt;&#xA;note : we are talking about layer 3 (network) with no mac addresses and source ip .&lt;/p&gt;&#xA;" OwnerUserId="3279" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2018-12-27T01:12:10.563" Title="TCP/IP Header compression" Tags="|ip|ipv4|tcp|protocol-theory|rfc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5057" PostTypeId="1" AcceptedAnswerId="5059" CreationDate="2013-11-19T19:41:23.360" Score="37" ViewCount="101593" Body="&lt;p&gt;I think I might be getting confused with terminology surrounding MTU.&lt;/p&gt;&#xA;&lt;p&gt;This definition from Wendell Odom's CCNA book on MTU:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The IEEE 802.3 specification limits the data portion of the 802.3 frame to a minimum of 46 and a maximum of 1500 bytes. The term maximum&#xA;transmission unit (MTU) defines the maximum layer 3 packet that can be&#xA;sent over a medium. Because the layer 3 packet rests inside the data&#xA;portion of an Ethernet frame, 1500 bytes is the largest IP MTU allowed&#xA;over an Ethernet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;My understanding, is that an Ethernet frame is the last phase of encapsulation before it gets transmitted to the wire. When I look at a diagram of an Ethernet frame, its total size can equal a maximum of 1526 bytes.&lt;/p&gt;&#xA;&lt;p&gt;Am I right in saying that an Ethernet frame MTU is 1526 while the MTU at the IP layer is 1500? Does the MTU change at each phase of encapsulation, or is the term &amp;quot;MTU&amp;quot; only meant to define the maximum size of a packet at layer 3?&lt;/p&gt;&#xA;" OwnerUserId="3278" LastEditorUserId="78487" LastEditDate="2021-09-11T22:20:38.927" LastActivityDate="2021-09-11T22:20:38.927" Title="What is the actual size of an Ethernet MTU" Tags="|ethernet|protocol-theory|mtu|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="5059" PostTypeId="2" ParentId="5057" CreationDate="2013-11-19T21:30:49.013" Score="41" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Am I right in saying that an Ethernet frame MTU is 1526 while the MTU&#xA;  at the IP layer is 1500? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The Ethernet MTU is 1500 bytes, meaning the largest IP packet (or some other payload) an Ethernet frame can contain is 1500 bytes. Adding 26 bytes for the Ethernet header results in a &lt;strong&gt;maximum frame&lt;/strong&gt; (not the same as MTU) of 1526 bytes.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does the MTU change at each phase of encapsulation, or is the term &#xA;  &quot;MTU&quot; only meant to define the maximum size of a packet at layer 3?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The MTU is often considered a property of a network link, and will generally refer to the layer 2 MTU. The limits at layer 3 are far higher (see below) and cause no issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The length of an IP packet (layer 3) is limited by the maximum value of the 16 bit Total Length field in the IP header. For IPv4, this results in a maximum payload size of 65515 (= 2^16 - 1 - 20 bytes header). Because IPv6 has a 40 byte header, it allows for payloads up to 65495. And IIRC using the Jumbo Payload header extension, IPv6 could allow packets up to 4 GB...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When setting up a TCP connection, a Maximum Segment Size (MSS) is agreed upon. This could be considered an MTU at layer 4, but it is not fixed. It is often set to the largest payload that can be sent in a TCP segment without causing fragmentation, thus reflecting the lowest layer 2 MTU on the path. With an ethernet MTU of 1500, this MSS would be 1460 after subtracting 20 bytes for the IPv4 and TCP header.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="38816" LastEditDate="2017-08-04T13:19:26.447" LastActivityDate="2017-08-04T13:19:26.447" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5060" PostTypeId="2" ParentId="5056" CreationDate="2013-11-19T22:01:17.553" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If the packet doesn't contain the IP of the sender, how does the&#xA;  receiver know from where it got the packet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;TCP Syn-segments are always sent uncompressed. After each host has received a SYN-segment, they know the other side's IP address. They can then compress the following segments' headers, because the IP address is remembered and re-entered in the header by the decompressor.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...and according to which packet headers that it (receiver) &#xA;  stored it &quot;rebuilds&quot; the packet? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;According to the headers of the packets that were tranmitted uncompressed, at least the first two (SYN) segments of the connection, one in each direction.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2013-11-19T22:01:17.553" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5061" PostTypeId="1" AcceptedAnswerId="5062" CreationDate="2013-11-20T03:46:14.413" Score="1" ViewCount="177" Body="&lt;pre&gt;&lt;code&gt;        |------------1 same cost----|&#xA;Router 1|                           | Router 2&#xA;        |------------2 Same cost----|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we have a ecmp link between two routers using which interface a TCP connection will be formed, say be are trying to use loopback addresses as source and destination in both routers ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally TCP runs over interface level or system level ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastEditorUserId="44" LastEditDate="2013-11-20T14:17:44.473" LastActivityDate="2018-07-22T13:45:06.050" Title="Which interface will TCP choose for redudant connection between two routers?" Tags="|tcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5062" PostTypeId="2" ParentId="5061" CreationDate="2013-11-20T05:04:13.530" Score="5" Body="&lt;p&gt;TCP does not choose an interface to use. It is handled by IP layer while TCP is transport layer. TCP simply tosses packets to IP layer, and IP layer selects which route and consequently which interface it will use for the session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, ECMP is applied to a flow or a session level, in a given session, packets are always forwarded to the same path unless the link is broken.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A session is normally described as 5-tuple - src ip/dst ip/src mac/dst mac/tcp or udp port.&lt;/p&gt;&#xA;" OwnerUserId="3285" LastActivityDate="2013-11-20T05:04:13.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5063" PostTypeId="1" CreationDate="2013-11-20T12:02:08.207" Score="4" ViewCount="984" Body="&lt;p&gt;I am currently going through the Openflow 1.4 specification and I was wondering if anyone tried implementing it on a Mikrotik 750GL Routerboard.&lt;/p&gt;&#xA;" OwnerUserId="3286" LastEditorUserId="8499" LastEditDate="2018-02-14T16:27:19.153" LastActivityDate="2018-02-14T16:27:19.153" Title="Does Mikrotik 750GL support Openflow 1.4?" Tags="|router|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-08T15:12:42.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="5064" PostTypeId="1" CreationDate="2013-11-20T14:16:29.507" Score="17" ViewCount="60648" Body="&lt;p&gt;Can anyone explain which layer of the OSI model ARP belongs to and which socket it uses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I referred to lots of books before asking this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some books, Authors are saying that it belongs to the datalink layer, in some they say it belongs to the network layer.  Which is correct ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, BGP uses TCP socket, OSPF uses IP socket...&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="775" LastEditDate="2013-12-28T00:07:56.283" LastActivityDate="2014-03-18T13:50:17.700" Title="On which layer of the OSI Model does the arp protocol belong?" Tags="|ethernet|arp|" AnswerCount="3" CommentCount="0" ClosedDate="2014-03-18T14:25:13.793" ContentLicense="CC BY-SA 3.0" />
  <row Id="5065" PostTypeId="1" AcceptedAnswerId="5074" CreationDate="2013-11-20T14:39:46.863" Score="3" ViewCount="494" Body="&lt;p&gt;As I understand ICMP redirect message is sent to host to &quot;shorten&quot; the routing path of the packet .&lt;br&gt;&#xA;If i have the example &lt;a href=&quot;http://img843.imageshack.us/img843/9992/1uep.png&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; and the path from host in network 1 to network 3 is equal using both R2 and R3 .&lt;br&gt;&#xA;Questions :&lt;br&gt;&#xA;1 - which one would ICMP (from R1) message redirect to R2 or R3 ?&lt;br&gt;&#xA;2 - Is it possible that the traffic from network 1 to network 3 be split among R2 and R3&lt;br&gt;&#xA;using an ICMP message from R1 ?&lt;/p&gt;&#xA;" OwnerUserId="3279" LastEditorUserId="775" LastEditDate="2013-11-21T11:10:22.540" LastActivityDate="2013-11-21T11:10:22.540" Title="ICMP redirect message" Tags="|cisco|routing|icmp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5067" PostTypeId="2" ParentId="5064" CreationDate="2013-11-20T14:54:03.357" Score="25" Body="&lt;p&gt;ARP is layer 2.  The reason being is that a broadcast is sent on layer 2 (data link layer) and ARP will normally not traverse to layer 3 (network layer). However it can provide extra features to the layer 3 protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The truth is that not all protocols fit the OSI model exactly, because after all it's just a model. If you really want to push it into a spot I'd say ARP is a layer 2.5 protocol. It fits layer 2, but doesn't fit layer 3 completely. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same discussion is often held about ICMP and where it fits in: layer 3 or layer 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good explanation on these exceptions is: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Normally, a protocol from layer N+1 is encapsulated with the header of&#xA;  the protocol from Layer N, but protocols like arp, stp, cdp, icmp and igmp&#xA;  are exceptions because are encapsulated with a header of a protocol &#xA;  from the same layer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="29" LastEditorUserId="29" LastEditDate="2013-11-20T15:01:21.853" LastActivityDate="2013-11-20T15:01:21.853" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5068" PostTypeId="1" CreationDate="2013-11-20T15:16:53.357" Score="2" ViewCount="827" Body="&lt;p&gt;I'm wondering whether there exists a standard which network throughput could be judged upon. For example: a 100 Mbit/s link has an actual throughput of 80 Mbit/s that given point in time and with whatever set of protocols -- has any article or paper ever written: &quot;80% is a good percentage for actual throughput&quot; (or something to that effect)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've made my own measurements on some networks, but I'd like something to lean on other than my own opinion on what percentage is good or bad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this isn't too unclear; thanks!&lt;/p&gt;&#xA;" OwnerUserId="3289" LastEditorUserId="775" LastEditDate="2014-11-23T20:30:30.133" LastActivityDate="2014-11-23T20:30:30.133" Title="Quantify actual vs theoretical network throughput" Tags="|ethernet|throughput|speed|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5069" PostTypeId="2" ParentId="5068" CreationDate="2013-11-20T15:29:14.173" Score="3" Body="&lt;p&gt;Short answer: No, but 30% is good. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer: &lt;strong&gt;Everything&lt;/strong&gt; determines network throughput. I have done lots of stress testing on network equipment, primarily cisco. Results of my tests have shown some routers/switches with 100mbps interfaces that achieve around 25mbps in actual throughput, and I have seen 1gbps interfaces achieve speeds of up to around 987mbps. The performance will vary significantly based on characteristics of the traffic as well. If your throughput on a given interface exceeds 30% of the line rate, I would recommend upgrading the link/interface. &lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-11-20T15:29:14.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5074" PostTypeId="2" ParentId="5065" CreationDate="2013-11-20T18:58:31.173" Score="5" Body="&lt;p&gt;For the sake of this question, I'm assuming that R1 uses a passive-interface to N2, and forms routing protocol adjacencies to R2 and R3 via N1. Assume PCs on N1 default through R1, which then issues ICMP redirects for the routes it learns from R2 and R3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're trying to solve routing problems with ICMP redirects; however, ICMP redirects are the wrong way to solve routing problems.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;The right answer: &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html#wp1039725&quot; rel=&quot;nofollow&quot; title=&quot;Gateway Load Balancing Protocol&quot;&gt;GLBP&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I'm reading between the lines, but it looks like you're trying to load-balance outbound from N1 through multiple routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The right way to solve this problem is with &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html#wp1039725&quot; rel=&quot;nofollow&quot; title=&quot;Gateway Load Balancing Protocol&quot;&gt;GLBP&lt;/a&gt;.  &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html#wp1039725&quot; rel=&quot;nofollow&quot; title=&quot;Gateway Load Balancing Protocol&quot;&gt;GLBP&lt;/a&gt; is an improvement over &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a91.shtml&quot; rel=&quot;nofollow&quot; title=&quot;Hot Standby Router Protocol&quot;&gt;HSRP&lt;/a&gt; because it automatically load-balances hosts on a subnet.  Like &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080094a91.shtml&quot; rel=&quot;nofollow&quot; title=&quot;Hot Standby Router Protocol&quot;&gt;HSRP&lt;/a&gt;, &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html#wp1039725&quot; rel=&quot;nofollow&quot; title=&quot;Gateway Load Balancing Protocol&quot;&gt;GLBP&lt;/a&gt; takes over for unreachable gateways if one goes down.  There are also show commands directly on the router to understand which gateway is load-balancing a specific PC.  Incidentally, there is &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/ipv6/configuration/guide/ip6-fhrp.html#wp1054960&quot; rel=&quot;nofollow&quot; title=&quot;IPv6 GLBP&quot;&gt;GLBP for IPv6&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;The wrong answer: &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094702.shtml&quot; rel=&quot;nofollow&quot;&gt;ICMP Redirects&lt;/a&gt; to different gateways&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1 - which one would ICMP (from R1) message redirect to R2 or R3 ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The answer is implementation dependent, but relying on ICMP redirects to correct routing problems is asking for trouble, and is very unsupportable.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Think about what happens if either R2 or R3 goes down.  Now, you have clients that are black-holed until someone goes to each PC and clears the ICMP redirects from the cache.&lt;/li&gt;&#xA;&lt;li&gt;How do you troubleshoot problems by looking at show commands in the router?  It's impossible, because you can't know which router any given PC has cached a redirect for.  Furthermore, these entries will be cached &lt;em&gt;per destination IP address&lt;/em&gt; and will be a nightmare to support.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you design the network correctly, and you don't have to deal with these issues.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2 - Is it possible that the traffic from network 1 to network 3 be split among R2 and R3 using an ICMP message from R1?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is also implementation dependent.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-11-21T10:31:35.490" LastActivityDate="2013-11-21T10:31:35.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5080" PostTypeId="2" ParentId="4992" CreationDate="2013-11-21T02:43:11.743" Score="0" Body="&lt;p&gt;I did some research, and one solution to my problem is to use Parallel Redundant Protocol (see &lt;a href=&quot;http://wiki.wireshark.org/PRP&quot; rel=&quot;nofollow&quot;&gt;http://wiki.wireshark.org/PRP&lt;/a&gt;). This requires a dual-NIC node to participate in the network, but single-NIC can too by using a Redundancy Box or &quot;RedBox&quot;, which duplicates an incoming packet and sends it to the two parallel networks. There are commercial RedBox products (eg: &lt;a href=&quot;http://www.ruggedcom.com/pdfs/datasheets/rs950g_datasheet.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.ruggedcom.com/pdfs/datasheets/rs950g_datasheet.pdf&lt;/a&gt;), but they are unlikely to be &quot;cheap&quot;. I'd need RedBoxes for each participating single-NIC node. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The split-network solution suggested by Fizzle is also not as bad as I thought -- it handles all single-point failure modes. Also, if the FS104's are more reliable than the datalogger &amp;amp; processing nodes, the split network would also handle the 2-point failure mode in my last comment. All I have to do is to write the L3 apps to handle this type of failure. &lt;/p&gt;&#xA;" OwnerUserId="3236" LastActivityDate="2013-11-21T02:43:11.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5081" PostTypeId="1" AcceptedAnswerId="5082" CreationDate="2013-11-21T03:21:14.513" Score="2" ViewCount="3074" Body="&lt;p&gt;I just got this router, fresh out of the box. I turn it on and set it up and I get these weird IPs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Pinging 192.168.1.1 with 32 bytes of data:&#xA;Reply from 74.x.x.254: TTL expired in transit.&#xA;Reply from 74.x.x.254: TTL expired in transit.&#xA;Reply from 74.x.x.106: TTL expired in transit.&#xA;Reply from 74.x.x.254: TTL expired in transit.&#xA;&#xA;Ping statistics for 192.168.1.1:&#xA;    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Never seen this before. Is this a Cisco thing?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="2349" LastEditDate="2013-11-21T04:05:36.620" LastActivityDate="2013-11-21T06:09:46.970" Title="Weird ping back from Cisco Router" Tags="|cisco|ping|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5082" PostTypeId="2" ParentId="5081" CreationDate="2013-11-21T04:01:13.080" Score="6" Body="&lt;p&gt;My best guess here without more information is that you hooked up a WAN port to your existing network.  The new router got an IP from DHCP, along with a default gateway.  When you try to ping 192.168.1.1, the packet is routed to your default gateway.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For whatever reason, your network routes the packet out to the Internet, where it loops around in no-man's land until the 30-hop TTL expires.  A traceroute to the same IP should tell us more about what's going on in case my guess is incorrect. =)&lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2013-11-21T04:01:13.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5084" PostTypeId="2" ParentId="5081" CreationDate="2013-11-21T06:04:27.587" Score="4" Body="&lt;p&gt;This is a simple case of private addressing leaking into a public network. Trust me, this isn't reaching the internet; it may reach the edge of your provider's network, but that it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's common practice to block/filter/null route RFC1918 space at the edge of your network.  ISPs &lt;em&gt;should&lt;/em&gt; filter this crap on customer ingress links. (but best practices just aren't followed.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cisco-speak:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.0.0.0 255.0.0.0 Null0 254 permanent&#xA;ip route 172.16.0.0 255.240.0.0 Null0 254 permanent&#xA;ip route 192.168.0.0 255.255.0.0 Null0 254 permanent&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On linux (iproute2):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# blackhole RFC1918 private address space&#xA;ip route add prohibit 10.0.0.0/255.0.0.0&#xA;ip route add prohibit 172.16.0.0/255.240.0.0&#xA;ip route add prohibit 192.168.0.0/255.255.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(you might want to include RFC3927 [169.254/16], too)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-11-21T06:09:46.970" LastActivityDate="2013-11-21T06:09:46.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5088" PostTypeId="1" AcceptedAnswerId="5089" CreationDate="2013-11-21T13:18:31.160" Score="7" ViewCount="8834" Body="&lt;p&gt;So we just had our first IPv6 multicast flood in the network this morning.&#xA;We managed to stop the offending computer by blocking the mac address with:&#xA;&lt;code&gt;mac-address-table static x.x.x vlan x drop&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before we blocked the mac address we started a Wireshark capture so we could analyze the packets later on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After looking at the packets it seems the packets flooding the network was corrupt IPv6 DHCP requests contacting the IPv6 multicast address 33:33:00:01:00:02.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The impact of the flood was kind of weird, the only thing that seem affected was normal IPv4 DHCP requests, regular clients couldn't get a IP address, but those who already had one before the flooding started experienced no problems...&#xA;The CPU's on the switches also peaked to 95-100%, but did not seem to impact normal traffic switching/routing operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we need help to determine is how only 30mbps of IPv6 multicast traffic can push the CPU on a 6509 SUP720 to 100% and make normal IPv4 DHCP to stop working and how to protect ourselves against this should it happen again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each access/client port has the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switchport access vlan x&#xA; switchport mode access&#xA; switchport nonegotiate&#xA; switchport block multicast&#xA; switchport block unicast&#xA; switchport port-security maximum 2&#xA; switchport port-security&#xA; switchport port-security aging time 2&#xA; switchport port-security violation restrict&#xA; switchport port-security aging type inactivity&#xA; storm-control broadcast level 5.00 4.00&#xA; storm-control multicast level 5.00 4.00&#xA; spanning-tree portfast&#xA; spanning-tree bpduguard enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Isn't storm-control multicast applied to IPv6 multicast?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a extract from the Wireshark capture with the &lt;a href=&quot;https://www.dropbox.com/s/f86k957d1ruf3gv/malformed_ipv6_flood.zip&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;evil&quot; packets on Dropbox&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And a little collection of graphs to illustrate the impact:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ROQuB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ROQuB.png&quot; alt=&quot;CPU Spike Graph&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We also investigated the offending computer and could not find the reason or being able to reproduce the issue...&lt;/p&gt;&#xA;" OwnerUserId="318" LastEditorUserId="3191" LastEditDate="2014-05-12T15:35:23.477" LastActivityDate="2019-02-16T23:26:37.840" Title="Mitigating a IPv6 malformed packet multicast flood" Tags="|cisco|ipv6|cisco-ios|cisco-6500|multicast|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5089" PostTypeId="2" ParentId="5088" CreationDate="2013-11-21T15:09:06.473" Score="7" Body="&lt;h3&gt;Background&lt;/h3&gt;&#xA;&lt;p&gt;I am somewhere that blocks Dropbox downloads, so I can't see the captured traffic, but I'll go on the assumption these were 64-byte ethernet multicasts.&lt;/p&gt;&#xA;&lt;p&gt;Let's do some math to see how much traffic you're permitting...&lt;/p&gt;&#xA;&lt;p&gt;A 64-byte frame is 672 bits (including 8 bytes for Preamble/SFD, and 12 bytes for IFG)...&lt;/p&gt;&#xA;&lt;p&gt;8*(8 + 12 + 64) = 672 bits&lt;/p&gt;&#xA;&lt;p&gt;That means line rate Gigabit Ethernet 64-bytes frames is about 1.488Mpps...&lt;/p&gt;&#xA;&lt;p&gt;(1000000000 / 672.0) = 1488095.24 pps&lt;/p&gt;&#xA;&lt;p&gt;What does this mean to you?  Well your current storm-control configuration throttles traffic at 5% of line-rate, so you're allowing 74.4kpps of traffic to hit your switch before storm-control kicks in.  74.4kpps * 64-byte frames is 38Mbps, which is right at what your graphs show:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6QDdc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6QDdc.png&quot; alt=&quot;&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Answer&lt;/h3&gt;&#xA;&lt;p&gt;So, the bottom line is that you're allowing too much traffic to hit the switch CPU, which is why the CPU utilization was high.  74.4kpps is really too much to allow any switch CPU to process.&lt;/p&gt;&#xA;&lt;p&gt;Assuming these stations shouldn't be sending a lot of multicast or broadast, the simple answer is to throttle your traffic like this...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   ! Note that broadcast traffic has the ethernet I/G bit set&#xA;   ! which means it is also classified technically as a multicast&#xA;   ! for storm-control purposes.  Therefore set your broadcast limit&#xA;   ! a little lower than your multicast limit&#xA;   storm-control broadcast level 0.4 0.3&#xA;   storm-control multicast level 0.5 0.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now storm-control kicks in when a port sends 6kpps of broadcast (0.4% 1GE line rate) or 7.5kpps of combined multicast / broadcast (0.5% 1GE line rate).&lt;/p&gt;&#xA;&lt;p&gt;FYI, it is probably worth looking into &lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;CPP&quot;&gt;Control Plane Policing&lt;/a&gt;, which protects the switch CPU against several ports ganging up on it.  Keep in mind that CPP can be complicated to get right, so it's a good idea to test well before you roll it out in your environment.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2019-02-16T23:26:37.840" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="5093" PostTypeId="1" CreationDate="2013-11-21T17:36:13.207" Score="6" ViewCount="4231" Body="&lt;p&gt;I'm trying to understand what happens to the TCP Congestion Window (Cwnd) if the transfer rate is limited by the Receive Window (Rwnd). I know that the transfer rate is the minimum of Rwnd and Cwnd. I also know that Cwnd increases for each ACK received. Suppose the receive buffer is very small, so Rwnd always stays very low, but all the packets are received and ACKed. Does this mean that Cwnd just keeps increasing forever? Is there some limit to it?&lt;/p&gt;&#xA;" OwnerUserId="3304" LastEditorUserId="775" LastEditDate="2013-11-29T11:23:14.643" LastActivityDate="2013-11-29T11:23:14.643" Title="Does TCP Cwnd keep increasing if transfer is limited by Rwnd?" Tags="|tcp|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5094" PostTypeId="1" AcceptedAnswerId="5101" CreationDate="2013-11-21T18:10:18.910" Score="6" ViewCount="982" Body="&lt;p&gt;I am planning to mirror some traffic on an ASA 5510 running version 9.1. this traffic is mostly internet data which cannot exceed 30 Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what impact could this SPAN operation cost me on performance ? and is there any security concerns when trying this on a firewall ?&lt;/p&gt;&#xA;" OwnerUserId="2516" LastActivityDate="2013-11-22T02:29:37.200" Title="SPAN impact on ASA performance" Tags="|cisco|cisco-asa|mirror|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5095" PostTypeId="1" AcceptedAnswerId="5216" CreationDate="2013-11-21T19:40:27.827" Score="6" ViewCount="12191" Body="&lt;p&gt;We recently had a sporadic reboot of a distribution switch for an unknown reason. No recent hardware/software changes have been made. Our log files don't indicate anything leading up to the incident.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The system is a 6509-E running software version 15.1(1)SY on both active and backup supervisor modules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The system had a primary and backup supervisor card (SUP720) running in SSO. The system was actively functioning in Standby Hot, but the Backup RP never took over as the Active RP, which caused a complete system reboot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The backup RP eventually booted back up and came back online with the most recent configuration, but the primary supervisor card &lt;strong&gt;slot&lt;/strong&gt; won't boot any cards. We replaced the card with the same card model with no luck. The cards were all tested on a backup 6509 chassis, all of them booted without any issues; which eliminates the possibility of a faulty card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When trying to boot the cards on this chassis, this is as far as we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System Bootstrap, Version 8.4(2) Release&#xA;Copyright (c) 1994-2005 by cisco Systems, Inc.&#xA;Cat6k-Sup720/SP processor with 524288 Kbytes of main memory&#xA;&#xA;Autoboot executing command: &quot;boot disk0:s72033-adventerprisek9-mz.151-1.SY.bin&quot;&#xA;Loading image, please wait ...&#xA;&#xA;&#xA;Initializing ATA monitor library...&#xA;&#xA;Self extracting the image... [OK]&#xA;Self decompressing the image : ########################################################################################]&#xA;&#xA;Cisco IOS Software, s72033_sp Software (s72033_sp-ADVENTERPRISEK9-M), Version 15.1(1)SY, RELEASE SOFTWARE (fc2)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2012 by Cisco Systems, Inc.&#xA;Compiled Tue 09-Oct-12 15:21 by prod_rel_team&#xA;Image text-base: 0x40101778, data-base: 0x427F0760&#xA;&#xA;&#xA;*Nov 19 17:31:23.407: %SYS-3-LOGGER_FLUSHING: System pausing to ensure console debugging output.&#xA;&#xA;*Nov 19 17:31:23.407: %PFREDUN-6-STANDBY: Initializing as STANDBY processor for this switch&#xA;*Nov 19 17:31:30.179: %SYS-SPSTBY-3-LOGGER_FLUSHING: System pausing to ensure console debugging output.&#xA;&#xA;*Nov 19 17:31:23.607: %SYS-3-LOGGER_FLUSHED: System was paused for 00:00:00 to ensure console debugging output.&#xA;&#xA;&#xA;Firmware compiled 11-Sep-12 12:45 by integ Build [26624]&#xA;&#xA;&#xA;*Nov 19 17:31:30.179: %OIR-SPSTBY-6-CONSOLE: Changing console ownership to route processor&#xA;&#xA;&#xA;&#xA;System Bootstrap, Version 12.2(17r)S4, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 2005 by cisco Systems, Inc.&#xA;Cat6k-Sup720/RP platform with 524288 Kbytes of main memory&#xA;&#xA;Download Start&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;Download Completed! Booting the image.&#xA;Self decompressing the image : ########################################################################################]&#xA;&#xA;&amp;lt;...Output Truncated...&amp;gt;   &#xA;&#xA;Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9-M), Version 15.1(1)SY, RELEASE SOFTWARE (fc2)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2012 by Cisco Systems, Inc.&#xA;Compiled Tue 09-Oct-12 15:13 by prod_rel_team&#xA;Image text-base: 0x4010F6D8, data-base: 0x44F3E6C0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It doesn't get any further. When we check the active RP, it shows the card is attempting to come online but never fully boots.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show redundancy states&#xA;       my state = 13 -ACTIVE&#xA;     peer state = in progress to standby cold&#xA;           Mode = Duplex&#xA;           Unit = Secondary&#xA;        Unit ID = 6&#xA;&#xA;Redundancy Mode (Operational) = sso&#xA;Redundancy Mode (Configured)  = sso&#xA;Redundancy State              = sso&#xA;     Maintenance Mode = Disabled&#xA; Communications = Up&#xA;&#xA;   client count = 145&#xA; client_notification_TMR = 30000 milliseconds&#xA;          keep_alive TMR = 9000 milliseconds&#xA;        keep_alive count = 1&#xA;    keep_alive threshold = 19&#xA;           RF debug mask = 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any suggestions on how to fix this? Or is the chassis defective? &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show module&lt;/code&gt; reaffirms that the card isn't recognized by the system.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show module&#xA;Mod Ports Card Type                              Model              Serial No.&#xA;--- ----- -------------------------------------- ------------------ -----------&#xA;  1    4  CEF720 4 port 10-Gigabit Ethernet      WS-X6704-10GE      SAD10XXXXXX&#xA;  2    4  CEF720 4 port 10-Gigabit Ethernet      WS-X6704-10GE      SAD10XXXXXX&#xA;  3   48  CEF720 48 port 1000mb SFP              WS-X6748-SFP       SAL10XXXXXX&#xA;  4   48  CEF720 48 port 1000mb SFP              WS-X6748-SFP       SAL10XXXXXX&#xA;  5    0  Supervisor-Other                       Unknown            Unknown&#xA;  6    2  Supervisor Engine 720 (Active)         WS-SUP720-3B       SAL12XXXXXX&#xA;  7   48  CEF720 48 port 10/100/1000mb Ethernet  WS-X6748-GE-TX     SAD11XXXXXX&#xA;  8   48  CEF720 48 port 10/100/1000mb Ethernet  WS-X6748-GE-TX     SAL10XXXXXX&#xA;  9   48  CEF720 48 port 10/100/1000mb Ethernet  WS-X6748-GE-TX     SAL10XXXXXX&#xA;&#xA;Mod MAC addresses                       Hw    Fw           Sw           Status&#xA;--- ---------------------------------- ------ ------------ ------------ -------&#xA;  1  000a.b866.74da to 000a.b866.74dd   2.4   12.2(14r)S5  15.1(1)SY    Ok&#xA;  2  0018.b9a6.a888 to 0018.b9a6.a88b   2.4   12.2(14r)S5  15.1(1)SY    Ok&#xA;  3  000a.b8cf.01e8 to 000a.b8cf.0217   1.7   12.2(14r)S5  15.1(1)SY    Ok&#xA;  4  000a.b80f.8da0 to 000a.b80f.8dcf   1.7   12.2(14r)S5  15.1(1)SY    Ok&#xA;  5  0000.0000.0000 to 0000.0000.0000   0.0   Unknown      Unknown      Unknown&#xA;  6  000a.b86d.8df4 to 000a.b86d.8df7   5.7   8.5(2)       15.1(1)SY    Ok&#xA;  7  0007.0e0f.98ca to 0007.0e0f.98f9   2.6   12.2(14r)S5  15.1(1)SY    Ok&#xA;  8  0019.06a0.bb30 to 0019.06a0.bb5f   2.4   12.2(14r)S5  15.1(1)SY    Ok&#xA;  9  0019.2f2f.e280 to 0019.2f2f.e2af   2.4   12.2(14r)S5  15.1(1)SY    Ok&#xA;&#xA;Mod  Sub-Module                  Model              Serial       Hw     Status&#xA;---- --------------------------- ------------------ ----------- ------- -------&#xA;  1  Centralized Forwarding Card WS-F6700-CFC       SAD10XXXXXX  3.0    Ok&#xA;  2  Centralized Forwarding Card WS-F6700-CFC       SAD10XXXXXX  3.0    Ok&#xA;  3  Distributed Forwarding Card WS-F6700-DFC3A     SAL10XXXXXX  2.5    Ok&#xA;  4  Distributed Forwarding Card WS-F6700-DFC3A     SAL10XXXXXX  2.5    Ok&#xA;  5  Policy Feature Card 3       WS-F6K-PFC3B       SAD09XXXXXX  2.3    Other&#xA;  6  Policy Feature Card 3       WS-F6K-PFC3B       SAL12XXXXXX  2.4    Ok&#xA;  6  MSFC3 Daughterboard         WS-SUP720          SAL12XXXXXX  3.2    Ok&#xA;  7  Centralized Forwarding Card WS-F6700-CFC       SAD11XXXXXX  3.1    Ok&#xA;  8  Centralized Forwarding Card WS-F6700-CFC       SAL10XXXXXX  2.0    Ok&#xA;  9  Centralized Forwarding Card WS-F6700-CFC       SAL10XXXXXX  2.0    Ok&#xA;&#xA;Mod  Online Diag Status&#xA;---- -------------------&#xA;  1  Pass&#xA;  2  Pass&#xA;  3  Pass&#xA;  4  Pass&#xA;  5  Unknown&#xA;  6  Pass&#xA;  7  Pass&#xA;  8  Pass&#xA;  9  Pass&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running &lt;code&gt;show redundancy&lt;/code&gt; gives a more detailed output of &lt;code&gt;show redundancy states&lt;/code&gt;. Note that both active and backup are running the same software versions, 15.1(1)SY.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show redundancy&#xA;Redundant System Information :&#xA;------------------------------&#xA;       Available system uptime = 2 weeks, 4 days, 4 hours, 5 minutes&#xA;Switchovers system experienced = 0&#xA;              Standby failures = 508&#xA;        Last switchover reason = none&#xA;&#xA;                 Hardware Mode = Duplex&#xA;    Configured Redundancy Mode = sso&#xA;     Operating Redundancy Mode = sso&#xA;              Maintenance Mode = Disabled&#xA;                Communications = Up&#xA;&#xA;Current Processor Information :&#xA;-------------------------------&#xA;               Active Location = slot 6&#xA;        Current Software state = ACTIVE&#xA;       Uptime in current state = 2 weeks, 4 days, 4 hours, 3 minutes&#xA;                 Image Version = Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9-M), Version 15.1(1)SY, RELEASE SOFTWARE (fc2)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2012 by Cisco Systems, Inc.&#xA;Compiled Tue 09-Oct-12 15:13 by prod_rel_team&#xA;                          BOOT = disk0:s72033-adventerprisek9-mz.151-1.SY.bin,1;&#xA;                   CONFIG_FILE =&#xA;                       BOOTLDR =&#xA;        Configuration register = 0x2102&#xA;&#xA;Peer Processor Information :&#xA;----------------------------&#xA;              Standby Location = slot 5&#xA;        Current Software state = in progress to standby cold&#xA;       Uptime in current state = 3 minutes&#xA;                 Image Version = Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9-M), Version 15.1(1)SY, RELEASE SOFTWARE (fc2)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2012 by Cisco Systems, Inc.&#xA;Compiled Tue 09-Oct-12 15:13 by prod_rel_team&#xA;                          BOOT = disk0:s72033-adventerprisek9-mz.151-1.SY.bin,1;&#xA;                   CONFIG_FILE =&#xA;                       BOOTLDR =&#xA;        Configuration register = 0x2102&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2013-11-27T20:58:42.623" LastActivityDate="2013-11-29T09:40:53.230" Title="Cisco 6509 Supervisor Card Slot Boot Failure" Tags="|cisco|troubleshooting|cisco-6500|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5096" PostTypeId="2" ParentId="5094" CreationDate="2013-11-21T19:55:01.783" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;what impact could this SPAN operation cost me on performance ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you are referring to a possible performance penalty on your firewalls ability to process packets, then there shouldn't be any for this simple of an operation. The only time that would come into play is if you begin setting up multiple filters to inspect packet headers in real-time on multiple SPAN ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the sounds of it, you're only looking to SPAN traffic egressing your network onto a specific port.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;and is there any security concerns when trying this on a firewall ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The only real security concern is where that SPAN port's destination is (i.e. the server). Secure the server and you're good to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something to note, this is a fairly common method of intrusion detection.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2013-11-21T19:55:01.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5100" PostTypeId="2" ParentId="4992" CreationDate="2013-11-22T01:47:34.103" Score="0" Body="&lt;p&gt;if dual nics are possible, then the best solution might be to use an active/passive redundant NIC configuration on your nodes. In this configuraton, nodes use only the primary NIC but can perform tests to determine network availability on each and switch to the secondary if a failure is detected.&lt;/p&gt;&#xA;" OwnerUserId="3310" LastActivityDate="2013-11-22T01:47:34.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5101" PostTypeId="2" ParentId="5094" CreationDate="2013-11-22T02:29:37.200" Score="4" Body="&lt;p&gt;I'm pretty sure you can't SPAN on any ASA except 5505 since it has a real switch.&lt;/p&gt;&#xA;" OwnerUserId="3314" LastActivityDate="2013-11-22T02:29:37.200" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5104" PostTypeId="1" AcceptedAnswerId="5105" CreationDate="2013-11-22T07:17:27.033" Score="4" ViewCount="1212" Body="&lt;p&gt;I am hoping someone can help with configuring a Cisco 881 which does NAT for the vlan and has a handful of port forwards from the WAN interface to hosts on the vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've created an extended access-list named 'outbound-filter' with the following rules:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended outbound-filter&#xA;permit icmp any any&#xA;permit tcp any any eq 20&#xA;permit tcp any any eq 21&#xA;permit tcp any any eq 22&#xA;permit tcp host 172.16.1.12 any eq smtp&#xA;permit tcp any any eq 43&#xA;permit tcp any any eq 53&#xA;permit udp any any eq 53&#xA;permit tcp any any eq 80&#xA;permit tcp any any eq 110&#xA;permit tcp any any eq 143&#xA;permit tcp any any eq 443&#xA;permit tcp any any eq 993&#xA;permit tcp any any eq 995&#xA;permit tcp any any eq 3389&#xA;permit tcp any any eq 5060&#xA;permit udp any any eq 5060&#xA;permit tcp any any eq 5242&#xA;permit udp any any eq 5243&#xA;permit tcp any any eq 4244&#xA;permit tcp any any eq 7071&#xA;permit udp any any eq 9785&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is all that we want to allow out to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the Internet, we have the following ip nat inside rules:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list 1 interface FastEthernet4 overload&#xA;ip nat inside source static tcp 172.16.1.12 25 59.100.202.46 25 extendable&#xA;ip nat inside source static tcp 172.16.1.12 443 59.100.202.46 443 extendable&#xA;ip nat inside source static tcp 172.16.1.16 3389 59.100.202.46 3389 extendable&#xA;!&#xA;access-list 1 permit 172.16.0.0 0.0.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The filter works fine if I apply it to int vlan1 as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-group outbound-filter in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But once applied, the port forwards no longer work unless I add 'permit ip any any' to the 'outbound-filter' ACL which essentially defeats the purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need a separate ACL 'inbound-filter' and 'outbound-filter' any apply them separating to the WAN and vlan interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would appreciate anyone able to offer some guidance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks,&#xA;Trent.&lt;/p&gt;&#xA;" OwnerUserId="3316" LastActivityDate="2013-11-22T08:18:53.703" Title="Cisco IOS outbound filtering" Tags="|cisco|firewall|cisco-ios|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5105" PostTypeId="2" ParentId="5104" CreationDate="2013-11-22T08:18:53.703" Score="3" Body="&lt;p&gt;The reason why the port forwarding is not working with the access-list applied to the interface is quite simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's see what happens when the outside client requests the https webpage. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The destination port in the request packet is 443, while the source port is random. This request gets translated by nat at the router, then goes all the way to the server, server answers with the packet sourced from port 443 and destined to that client's random number port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet in its journey back to the client gets to your router, but router wouldn't let the packet leave, because the destination port (that random port) is not specified in the access-list you have created. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And that would be the reason you are looking for.&lt;/p&gt;&#xA;" OwnerUserId="1347" LastActivityDate="2013-11-22T08:18:53.703" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5109" PostTypeId="1" CreationDate="2013-11-22T15:32:55.440" Score="4" ViewCount="650" Body="&lt;p&gt;I have discovered weird routing from our ISP all related to BGP. Here is the scenario (real-one).&#xA;- there is a /19 prefix bought about 10 years ago, which was registered with ARIN authority.&#xA;- as bussiness grew each site got it /24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The trouble starts in APNIC region in ASIA. We export one /24 prefix the regular way using two local ISPs.&#xA;When trying to reach this prefix from different ASIA sites like India or China all traffic is sent to US West Coast then back to our site. Except additional hops, this also adds about 150ms latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I already tried:&#xA;- AS prepend each ISP at a time so the other left would be preffered for all inbound traffic&#xA;- both tests went similar as in both scenarios traffic hit US before reaching this trouble site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As there is no other local special config I can think of like communities, how can I explain this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are both local ISP taking in consideration the ARIN info and based on that send traffic to US?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="794" LastActivityDate="2014-02-21T21:50:44.357" Title="BGP routing based on ARIN info" Tags="|routing|bgp|arin|prefix|isp|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5110" PostTypeId="1" AcceptedAnswerId="5157" CreationDate="2013-11-22T15:42:39.480" Score="11" ViewCount="6114" Body="&lt;p&gt;I'm trying to set up double Auto NAT with DNS translation on Cisco ASA 9.0(3), and I'm having a few challenges with the DNS portion.  I got double NAT working correctly, such that I have a server in production and in the lab with the same IP address.  See b2masd1, nameif INSIDE (production) and masd1, nameif DMZ (lab).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you ping from DMZ 10.195.18.182 to 1.195.18.182, I see the translations happening correctly in both directions...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D:10.195.18.182      S:192.168.11.101       D:1.195.18.182   S:10.195.18.182&#xA;             &amp;lt;-----------                         &amp;lt;-----------&#xA;                                           1) echo-request to 1.195.18.182&#xA;                                           nat (INSIDE,DMZ) static 1.195.18.182 dns&#xA;&#xA;&#xA;&#xA;  S:10.195.18.182    D:192.168.11.101       S:1.195.18.182   D:10.195.18.182&#xA;              ------------&amp;gt;                        ------------&amp;gt;&#xA;      2) echo-reply to 192.168.11.101&#xA;      nat (DMZ,INSIDE) static 192.168.11.101 dns&#xA;&#xA;&#xA; b2masd1                   +-----------+              masd1&#xA; 10.195.18.182      INSIDE |           | DMZ          10.195.18.182&#xA; Mfg Server   -------------| Cisco ASA |------------  Devel Server&#xA;                           |           |&#xA;                           +-----------+&#xA;&#xA; Manufacturing                                        Development&#xA; Network                                              Network&#xA; Security: 100                                        Security: 50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is what I see on masd1...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;masd1$ /usr/sbin/ping 1.195.18.182&#xA;PING 1.195.18.182: 64 byte packets&#xA;64 bytes from 1.195.18.182: icmp_seq=0. time=0. ms&#xA;64 bytes from 1.195.18.182: icmp_seq=1. time=0. ms&#xA;&#xA;----1.195.18.182 PING Statistics----&#xA;2 packets transmitted, 2 packets received, 0% packet loss&#xA;round-trip (ms)  min/avg/max = 0/0/0&#xA;masd1$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that DNS queries from the DMZ to INSIDE are &lt;em&gt;not&lt;/em&gt; getting translated.  When I query for b2masd1 from the DMZ, I expect the nameserver on the INSIDE to respond with 10.195.18.182, and then the ASA should translate that to 1.195.18.182.  However, that is not happening; as you can see, the DNS entry is not translated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;masd1$ nslookup&#xA;Using /etc/hosts on:  masd1&#xA;&#xA;&amp;gt; a2mosd1&#xA;Using /etc/hosts on:  masd1&#xA;&#xA;looking up FILES&#xA;Trying DNS&#xA;Name:    b2masd1.domain.local&#xA;Address:  10.195.18.182&#xA;&#xA;&amp;gt; exit&#xA;masd1$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain what I need to do to get DNS queries correctly translated?  I need a query for b2masd1 in the DMZ to a nameserver on the INSIDE interface to return 1.195.18.182 (because the ASA translates the INSIDE A-Record 10.195.18.182 to DMZ addr 1.195.18.182).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have set up a &lt;a href=&quot;http://chat.stackexchange.com/rooms/11647/cisco-asa-double-nat-with-dns-translation&quot;&gt;chat room&lt;/a&gt; to assist with diagnosis&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;&lt;em&gt;Misc debugging information&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my config...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet0/0&#xA; nameif INSIDE&#xA; security-level 100&#xA; ip address 10.195.2.197 255.255.255.248 standby 10.195.2.198&#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif DMZ&#xA; security-level 50&#xA; ip address 10.195.2.201 255.255.255.248 standby 10.195.2.202&#xA;!&#xA;object network DMZ_NAT_masd1&#xA; host 10.195.18.182&#xA; description xlate masd1 NAT DMZ src 10.195.18.182 to INSIDE src 192.168.11.101&#xA;object network INSIDE_NAT_masd1&#xA; host 10.195.18.182&#xA; description xlate masd1 NAT INSIDE src 10.195.18.182 to DMZ src 1.195.18.182&#xA;!&#xA;object network DMZ_NAT_masd1&#xA; nat (DMZ,INSIDE) static 192.168.11.101 dns&#xA;object network INSIDE_NAT_masd1&#xA; nat (INSIDE,DMZ) static 1.195.18.182 dns&#xA;!&#xA;policy-map type inspect dns DNS_INSPECT_MAP&#xA; parameters&#xA;  message-length maximum 512&#xA;!&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns DNS_INSPECT_MAP&#xA;!&#xA;service-policy global_policy global&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Show xlate, in case this helps...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B2-DEV-FW1/DEVELOPMENT# sh xlate local 10.195.18.182&#xA;121 in use, 126 most used&#xA;Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,&#xA;       s - static, T - twice, N - net-to-net&#xA;NAT from DMZ:10.195.18.182 to INSIDE:192.168.11.101&#xA;    flags sD idle 0:00:01 timeout 0:00:00&#xA;NAT from INSIDE:10.195.18.182 to DMZ:1.195.18.182&#xA;    flags sD idle 0:03:55 timeout 0:00:00&#xA;B2-DEV-FW1/DEVELOPMENT#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Show service-policy inspect dns...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B2-DEV-FW1/DEVELOPMENT# sh service-policy inspect dns&#xA;&#xA;Global policy:&#xA;  Service-policy: global_policy&#xA;    Class-map: inspection_default&#xA;      Inspect: dns DNS_INSPECT_MAP, packet 15302, drop 0, reset-drop 0, v6-fail-close 0&#xA;        message-length maximum 512, drop 0&#xA;        dns-guard, count 7649&#xA;        protocol-enforcement, drop 0&#xA;        nat-rewrite, count 139&#xA;B2-DEV-FW1/DEVELOPMENT#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Captures showing queries from b2masd1 to the name server (10.195.18.201).  NOTE the double DNS queries sent on the INSIDE interface, but we don't seem to get those on the DMZ interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;B2-DEV-FW1/DEVELOPMENT# capture FOO interface DMZ real-time match udp host 10.195.18.182 host 10.195.18.201&#xA;&#xA;Warning: using this option with a slow console connection may&#xA;         result in an excessive amount of non-displayed packets&#xA;         due to performance limitations.&#xA;&#xA;Use ctrl-c to terminate real-time capture&#xA;&#xA;&#xA;   1: 09:54:35.994730       10.195.18.182.52639 &amp;gt; 10.195.18.201.53:  udp 45&#xA;   2: 09:54:35.995218       10.195.18.201.53 &amp;gt; 10.195.18.182.52639:  udp 83&#xA;   3: 09:54:47.875076       10.195.18.182.52644 &amp;gt; 10.195.18.201.53:  udp 53&#xA;   4: 09:54:47.875549       10.195.18.201.53 &amp;gt; 10.195.18.182.52644:  udp 136&#xA;   5: 09:54:47.875854       10.195.18.182.52645 &amp;gt; 10.195.18.201.53:  udp 51&#xA;   6: 09:54:47.876297       10.195.18.201.53 &amp;gt; 10.195.18.182.52645:  udp 138&#xA;   7: 09:54:47.876648       10.195.18.182.52646 &amp;gt; 10.195.18.201.53:  udp 35&#xA;   8: 09:54:47.877075       10.195.18.201.53 &amp;gt; 10.195.18.182.52646:  udp 35&#xA;&#xA;B2-DEV-FW1/DEVELOPMENT# capture FOO interface INSIDE real-time match udp host 192.168.11.101 host 10.195.18.201&#xA;&#xA;Warning: using this option with a slow console connection may&#xA;         result in an excessive amount of non-displayed packets&#xA;         due to performance limitations.&#xA;&#xA;Use ctrl-c to terminate real-time capture&#xA;&#xA;&#xA;   1: 09:56:27.282608       10.195.18.182.52742 &amp;gt; 10.195.18.201.53:  udp 43&#xA;   2: 09:56:27.282684       192.168.11.101.52742 &amp;gt; 10.195.18.201.53:  udp 43&#xA;   3: 09:56:27.283081       10.195.18.201.53 &amp;gt; 192.168.11.101.52742:  udp 59&#xA;   4: 09:56:27.283096       10.195.18.201.53 &amp;gt; 10.195.18.182.52742:  udp 59&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-11-25T21:26:27.380" LastActivityDate="2016-04-22T08:22:40.100" Title="Cisco ASA double NAT with DNS translation" Tags="|cisco|cisco-asa|firewall|nat|dns|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5113" PostTypeId="1" AcceptedAnswerId="5114" CreationDate="2013-11-22T17:18:17.420" Score="9" ViewCount="233" Body="&lt;p&gt;I just need to have a webcam and some equipment on a kite, running on Ethernet. But unfortunately the string will be more than 200 meters long so Ethernet will not work, (as far as I know). Transfer speed should be at least 10mbps. This is scientific project for Antarctic research station.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what technology do you guys suggest?&lt;/p&gt;&#xA;" OwnerUserId="3321" LastEditorUserId="775" LastEditDate="2013-11-22T19:42:21.530" LastActivityDate="2013-11-30T17:48:26.863" Title="Extra long ethernet, or similar technology, for kite" Tags="|ethernet|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5114" PostTypeId="2" ParentId="5113" CreationDate="2013-11-22T17:28:33.523" Score="6" Body="&lt;p&gt;Something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.veracityglobal.com/products/ethernet-and-poe-extension/outreach-lite.aspx&quot;&gt;http://www.veracityglobal.com/products/ethernet-and-poe-extension/outreach-lite.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many other devices that will use PoE as a power source (and still forward voltage) and can act as a passive repeater. I would only recommend it as a temporary solution though. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the weight your kite can support it may be a better idea to go with a P2P wireless bridge. You can achieve really good signal quality with homemade wireless antennas at distances up to 2 miles with simple pringles can builds. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;see also:&lt;br&gt;&#xA;&lt;a href=&quot;http://www.wikihow.com/Build-a-Low-Cost-WiFi-Antenna&quot;&gt;http://www.wikihow.com/Build-a-Low-Cost-WiFi-Antenna&lt;/a&gt;&#xA;&lt;a href=&quot;http://wireless.gumph.org/articles/homemadeomni.html&quot;&gt;http://wireless.gumph.org/articles/homemadeomni.html&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Cantenna&quot;&gt;http://en.wikipedia.org/wiki/Cantenna&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.makeuseof.com/tag/how-to-make-a-wifi-antenna-out-of-a-pringles-can-nb/&quot;&gt;http://www.makeuseof.com/tag/how-to-make-a-wifi-antenna-out-of-a-pringles-can-nb/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-11-22T17:28:33.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5117" PostTypeId="1" AcceptedAnswerId="5118" CreationDate="2013-11-22T20:01:07.167" Score="5" ViewCount="2105" Body="&lt;p&gt;VLANs are a layer 2 concept. We can all agree on that but why, then, do we use the 'interface vlanX' to allow routing on a switch. If we want to setup a default gateway for VLAN X on a Layer 3 switch would be be able to accomplish the same goal with an 'interface loopbackX' command as an 'interface vlanX' command? Aren't they both just virtual interfaces that can be used to hold IP addresses and thus route?&lt;/p&gt;&#xA;" OwnerUserId="889" LastEditorUserId="8499" LastEditDate="2018-12-21T05:01:28.563" LastActivityDate="2018-12-21T05:01:28.563" Title="'interface vlanX' or 'interface loopbackX'" Tags="|routing|switch|vlan|layer2|layer3|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5118" PostTypeId="2" ParentId="5117" CreationDate="2013-11-22T20:13:58.617" Score="11" Body="&lt;p&gt;When you create 'interface vlan x' you are creating a brand new logical interface that happens to be automagically associated with the corresponding L2 vlan. When you put an IP address on 'interface vlan x' then you are simply giving that logical interface an IP that is on the same  broadcast domain (or subnet or vlan or L2 domain or whatever terminology you wish to use). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A loopback interface is a virtual interface that has no such magical association. It is not associated with a vlan, nor is it associated with a physical interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing is a different function entirely though. My windows 7 computer has a few virtual IP addresses, but it is unable to route traffic thru them because I have not told it to do so. This same logic applies to network devices, you can have an IP address on 'interface vlan x' of a cisco 2960, but this is a layer 2 switch and will be unable to route traffic.&lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-11-22T20:13:58.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5119" PostTypeId="2" ParentId="5117" CreationDate="2013-11-22T20:16:44.757" Score="3" Body="&lt;p&gt;Although both of these are indeed virtual interfaces, they pursue totally different goals. Loopback is an interface that mostly is being used by other modules, like routing protocols or as the address holder for other interfaces, while SVI interface (vlan interface) that belongs to a corresponding vlan can be used for either management purposes in L2 infrastructure or it also can terminate (support) the vlan in L3 infrastructure in order to perform the intervlan routing.&lt;/p&gt;&#xA;" OwnerUserId="1347" LastEditorUserId="1347" LastEditDate="2013-11-23T11:31:03.533" LastActivityDate="2013-11-23T11:31:03.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5120" PostTypeId="1" AcceptedAnswerId="5148" CreationDate="2013-11-22T20:41:21.710" Score="2" ViewCount="1049" Body="&lt;p&gt;I am having an issue with an offsite location accessing a website that is hosted on 3 servers behind a Coyotoepoint Load-Balancer, at our Corporate Office.  We currently have well over 500 locations accessing this site with no issues, but this one location is causing problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All our locations terminate at a firewall at our Corporate Office over an IPsec VPN.  The website is served up by our Load-Balancer using a cluster IP.  The problem location can ping the cluster IP with no issue, but when they try to access the site it fails.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From packet captures I'm seeing a lot of TCP Out-Of-Order errors and a TCP Dup ACK.  On the working sites I don't see any of those.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;** Update **&#xA;Bellow is a ASCII Diagram of how my remote sites access my load-balancers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&#xA;+---------------------CORPORATE OFFICE----------------------------------------------------+&#xA;|                                                                                         |&#xA;|                            192.168.15.5/16 +--------------+ 192.168.11.1/30             |&#xA;|                            Inside Interface|  Cisco ASA   | DMZ Interface               |&#xA;|                                           ++--------------+&amp;lt;----------+                 |&#xA;|   +--------------------+&amp;lt;-----------------+                           +---------------+ |&#xA;|   |                    |                                              |  Meraki MX90  | |&#xA;|   |  Coyotepoint       |                                              |192.168.11.2/30| |&#xA;|   | 192.168.10.140/16  |                                              |Gateway: .1    | |&#xA;|   | Gateway: 40.2      |                                              +---------------+ |&#xA;|   |                    |    +------------------------------------+               ^      |&#xA;|   +--------------------+    |          Cisco Router              |               |      |&#xA;|                        |    |         192.168.40.2/16            |               |      |&#xA;|                        |    |Default Route to Remote Sites: .15.5|               |      |&#xA;|  +------------------+  |    +------------------------------------+               |      |&#xA;|  |      Web1        |  |                                                         |      |&#xA;|  |192.168.10.145/16 |  |                                                         |      |&#xA;|  |Gateway: 40.2     |  |                                                         |      |&#xA;|  +------------------+&amp;lt;-+   +-----------------------------------------------------|------+&#xA;|  +------------------+  |   |                                                     |&#xA;|  |      Web2        |  |   |                                                     |&#xA;|  |192.168.10.146/16 |  |   |                                                     |&#xA;|  |Gateway: 40.2     |  |   |                                                 IPsec VPN&#xA;|  +------------------+&amp;lt;-+   |                                                     |&#xA;|  +------------------+  |   |                                     +               |&#xA;|  |      Web3        |  |   |                                     +---------------+&#xA;|  |192.168.10.147/16 |  |   |                                     | Remote Sites  |&#xA;|  |Gateway: 40.2     |  |   |                                     +---------------+&#xA;|  +------------------+&amp;lt;-+   |&#xA;+----------------------------+&lt;/pre&gt;&#xA;" OwnerUserId="3322" LastEditorUserId="3322" LastEditDate="2013-11-26T03:44:45.770" LastActivityDate="2013-11-26T04:24:02.617" Title="Why am I having issues accessing a website hosted on servers behind a load-balancer?" Tags="|tcp|errors|load-balancer|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5121" PostTypeId="2" ParentId="5117" CreationDate="2013-11-22T20:41:52.470" Score="3" Body="&lt;p&gt;Int vlanX is simply the Cisco way of creating a layer3 interface on a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for Brocade Netirons you use interface ve while Junos uses vlan.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you bridge on a Cisco router you create a layer3 interface on a BVI interface. On Junos you can create an IRB interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end of the day it's simply a name. It's a routed interface that all the other ports on the same vlan/brocadcast domain is connected to. &lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-11-22T20:41:52.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5122" PostTypeId="1" AcceptedAnswerId="5124" CreationDate="2013-11-22T21:09:03.497" Score="4" ViewCount="3403" Body="&lt;p&gt;Our core router is a Cisco 7206VXR with NPE-G2 running 12.4(20)T1. It has numerous interfaces connected to WAN links (DS3, ATM DS3, 2xT1, onboard Gig0/1), and feeds into the LAN core with 2xGig EtherChannel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LAN side clearly has more bandwidth than any of the WAN links. We address this with a service-policy on the WAN side that allocates bandwidth to each &quot;interesting&quot; class of service, based on an ACL or DSCP markings. So far, so good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our problem is that we're seeing excessive tail drops for one particular class of traffic that leaves on a serial DS3 card:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Class-map: class-symposium-unicast-acl (match-all)&#xA;  1530 packets, 2153296 bytes&#xA;  30 second offered rate 336000 bps, drop rate 247000 bps&#xA;  Match: access-group name acl-symposium-ucast&#xA;  Queueing&#xA;  queue limit 64 packets&#xA;  (queue depth/total drops/no-buffer drops) 0/1056/0&#xA;  (pkts output/bytes output) 474/672266&#xA;  bandwidth remaining 10% (4421 kbps)&#xA;    Exp-weight-constant: 9 (1/512)&#xA;    Mean queue depth: 50 packets&#xA;    dscp     Transmitted   Random drop   Tail drop      Minimum   Maximum   Mark&#xA;              pkts/bytes   pkts/bytes    pkts/bytes     thresh    thresh    prob&#xA;&#xA;    af31       474/672266    22/31547    1034/1449483     32        40      1/10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is an abbreviated version of our configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all class-symposium-unicast-acl&#xA; match access-group name acl-symposium-ucast&#xA;!&#xA;policy-map WAN&#xA; class class-symposium-unicast-acl&#xA;  bandwidth remaining percent 10&#xA;   random-detect dscp-based&#xA; class class-default&#xA;!&#xA;interface Serial2/0&#xA; description PA-T3/E3-EC - 45 Mbps DS3&#xA; service-policy output WAN&#xA;!&#xA;ip access-list extended acl-symposium-ucast&#xA; permit udp host x.x.x.x any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Adjusting the &lt;code&gt;hold-queue&lt;/code&gt; on the serial interface, or &lt;code&gt;queue-limit&lt;/code&gt; within the policy-map have no apparent effect, and repeatedly checking &lt;code&gt;show int&lt;/code&gt; or &lt;code&gt;show policy-map&lt;/code&gt; does not show the output queue filling up. Bandwidth should not be an issue, because the interface is very lightly loaded (under 2 Mbps output on a 45 Mbps link), and the offered rate on the class-map is well below the bandwidth provisioned. Removing the &lt;code&gt;service-policy&lt;/code&gt; from the serial interface causes the drops to stop, but we need to be able to reserve bandwidth for certain applications, so this is not an acceptable long-term solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect the nature of the affected traffic has something to do with the drops we're seeing, because it's unlike anything else our network. UDP packets are emitted from a server at regular (7-second) intervals to one or more remote PCs that request it. Some of the packets are in excess of 15KB, so they have to be fragmented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could the excessive fragmentation be a contributing factor, and if so, would &lt;code&gt;ip virtual-reassembly&lt;/code&gt; on the ingress interface be of any benefit? Any other thoughts or suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Output of &quot;show int ser 2/0&quot; as requested:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Serial2/0 is up, line protocol is up&#xA;  Hardware is PA-T3/E3-EC&#xA;  Description: xxxxx&#xA;  Internet address is x.x.x.x/30&#xA;  MTU 4470 bytes, BW 44210 Kbit/sec, DLY 200 usec,&#xA;     reliability 255/255, txload 8/255, rxload 235/255&#xA;  Encapsulation PPP, LCP Open&#xA;  Open: IPCP, CDPCP, crc 16, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Restart-Delay is 0 secs&#xA;  Last input 00:00:22, output 00:00:00, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 1d00h&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 14291&#xA;  Queueing strategy: Class-based queueing&#xA;  Output queue: 0/1000/0 (size/max total/drops)&#xA;  30 second input rate 40774000 bits/sec, 3435 packets/sec&#xA;  30 second output rate 1442000 bits/sec, 1847 packets/sec&#xA;     274986144 packets input, 4019985342 bytes, 0 no buffer&#xA;     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles&#xA;              0 parity&#xA;     6 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 6 abort&#xA;     149374995 packets output, 1855187875 bytes, 0 underruns&#xA;     0 output errors, 0 applique, 3 interface resets&#xA;     0 unknown protocol drops&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;     0 carrier transitions no alarm present&#xA;  DSU mode 0, bandwidth 44210 Kbit, scramble 0, VC 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I realize the input rate is close to maximum in this copy/paste, but the problem occurs even when input is next to zero.&lt;/p&gt;&#xA;" OwnerUserId="1339" LastEditorUserId="1339" LastEditDate="2013-11-22T22:51:41.043" LastActivityDate="2013-11-23T03:54:15.527" Title="Output drops on serial interface when service-policy applied" Tags="|cisco|router|packet-loss|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5123" PostTypeId="2" ParentId="5122" CreationDate="2013-11-22T22:01:25.850" Score="-1" Body="&lt;p&gt;I'm not sure if this will help, but it looks like this user was having a similar issues.  I'm not sure if any of the suggestions offered solved the issue, but thought I'd pass it a long:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/thread/2031774&quot; rel=&quot;nofollow&quot;&gt;QoS tail drops on non-congested link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3322" LastActivityDate="2013-11-22T22:01:25.850" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5124" PostTypeId="2" ParentId="5122" CreationDate="2013-11-23T03:54:15.527" Score="3" Body="&lt;p&gt;In your &lt;code&gt;show policy-map&lt;/code&gt; output, notice how you have &lt;code&gt;Mean queue depth: 50 packets&lt;/code&gt; and the &lt;code&gt;Maximum Thresh&lt;/code&gt; is &lt;code&gt;40&lt;/code&gt;.  As your average queue depth is above the threshold you will begin tail dropping (&lt;a href=&quot;http://www.cisco.com/en/US/products/hw/routers/ps341/products_tech_note09186a0080af893d.shtml&quot; rel=&quot;nofollow&quot;&gt;reference&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this UDP traffic is the only thing in the class I don't think you gain anything by implementing WRED on the class.  I would recommend removing it (maybe consider using it under class-default instead).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to use WRED on the class then consider tuning the random-detect exponential weighting-constant to a higher value.  This will help WRED from too quickly reacting and starting to drop packets.  Given your description of the traffic pattern this could potentially solve the issue as well. (&lt;a href=&quot;http://communitystring.com/2008/08/weighted-random-early-detection-wred/&quot; rel=&quot;nofollow&quot;&gt;Reference&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2013-11-23T03:54:15.527" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5125" PostTypeId="1" CreationDate="2013-11-23T05:30:39.530" Score="0" ViewCount="1114" Body="&lt;p&gt;I have a question regarding multicast and broadcast frames on a network bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the bridge forward these frames from one network segment to another network segment ?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="8499" LastEditDate="2018-03-19T19:27:53.210" LastActivityDate="2023-04-26T17:03:50.563" Title="Can a Bridge forward frames with the destination as broadcast/multicast" Tags="|layer2|multicast|broadcast|bridge|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5126" PostTypeId="2" ParentId="5125" CreationDate="2013-11-23T06:02:43.687" Score="1" Body="&lt;p&gt;Yes. Assuming there is only a single VLAN configured, switches (aka transparent bridges) will forward L2 broadcasts to all other network segments, except the segment that originated the frame. Similarly, L2 multicast traffic is treated as &quot;unknown unicast&quot; and is also forwarded to all other network segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And while I hate to be that guy, you could have had the answer to this with 10 seconds of googling, so I downvoted the question.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-11-23T06:02:43.687" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5132" PostTypeId="1" CreationDate="2013-11-23T20:02:27.153" Score="10" ViewCount="2652" Body="&lt;p&gt;I'm getting &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5127/term-for-increased-latency-due-to-congestion-and-packet-loss-on-same-route&quot;&gt;increased latency and StDev due to route congestion and packet loss&lt;/a&gt;, but the forward and reverse paths go over distinct networks (e.g. one being init7.net, the other one being he.net), so, it's very difficult to understand which network or host is responsible for the congestion, packet loss, jitter and increased latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to narrow down the blame after forward and reverse &lt;code&gt;mtr&lt;/code&gt; fails to pinpoint the exact culprit, and the NOC@ contacts either don't respond, or claim to suffer no loss on the path in question?  (I'm using OpenBSD.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've even tried doing an &lt;code&gt;mtr&lt;/code&gt; directly to some customers of both of the two networks that might be experiencing the congestion, but couldn't really find any problems that way, especially since, for example, he.net has many POPs, and oftentimes distinct routes are taken between a given entry and exit POP, so when I try to &lt;code&gt;mtr&lt;/code&gt; their hosts (like the tserv) directly at the exit POP to which I might be losing packets in their network, a different he.net path is taken to reach the very same POP, and no packet loss occurs, which proves nothing of interest (other than a possible suggestion that they might indeed overload some routes, whilst ensuring others stay uncongested, all whilst ignoring NOC@ requests from non-customers).&lt;/p&gt;&#xA;" OwnerUserId="296" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2013-11-23T20:47:21.387" Title="measure one-way latency/jitter/packet-loss" Tags="|latency|packet-loss|mtr|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5133" PostTypeId="2" ParentId="5132" CreationDate="2013-11-23T20:47:21.387" Score="9" Body="&lt;p&gt;One way to do this is ICMP Timestamp, which is milliseconds from midnight UTC. It has the added benefit that you don't necessarily need to control both ends, as long as the far-end is not firewalled, there is good chance it'll work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, to have reliable one-way measurements, you need reliably same time in both ends. As ICMP timestamp only have precision of 1ms (which is not nearly enough for many applications, but sufficient for this) it's reasonably easy to find even non-cooperating hosts where ICMP timestamp will provide useful data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you control both ends, be sure that you are synchronizing NTP to only 1 server and same server. The absolute clock is not very important, it's just important that you experience as closely same time as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If ICMP timestamp is not sufficient, it's very easy to write 10 lines of ruby/perl/python or even C to do measurements when you control both ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't really suggest software for doing ICMP timestamp measurements unidirectionally, hping2 supports sending ICMP timestamp but for some reason does not output unidirectional values. I wrote &lt;a href=&quot;http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=651270&quot;&gt;patch&lt;/a&gt; for hping2 to display one way latencies.&lt;/p&gt;&#xA;" OwnerUserId="561" LastActivityDate="2013-11-23T20:47:21.387" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5135" PostTypeId="2" ParentId="5054" CreationDate="2013-11-23T21:56:53.623" Score="2" Body="&lt;p&gt;If you are looking for &quot;automatic&quot; propagation of your vlans to second switch - this is not possible with ME3400. ME3400 is a Metro Ethernet switch and so does not have &lt;em&gt;very enterprise-grade&lt;/em&gt; feature called VTP (Vlan Trunk Protocol). You still can connect two switches with the trunk, but you need to create vlans manually on both switches (and these have to match on both sides).&lt;/p&gt;&#xA;" OwnerUserId="3326" LastActivityDate="2013-11-23T21:56:53.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5136" PostTypeId="2" ParentId="519" CreationDate="2013-11-24T01:20:30.987" Score="1" Body="&lt;p&gt;Yes, time to switch is now.  A couple of often overlooked issues:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many IPv4 networks are often overloaded, congested and have asymmetric paths, so you don't even know &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5132/measure-one-way-latency-jitter-packet-loss&quot;&gt;which side is to blame&lt;/a&gt;; for an end-user, having a dual-stack IPv4/IPv6 means that it's much easier to switch routes if a given path is congested.  I use IPv6 all the time exactly for this reason; tunnelled IPv6 from he.net is usually of great help, especially since you know it won't be highly asymmetric (so there'd be no guessing which NOC@ to contact if anything goes wrong).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another benefit of IPv6, especially if you are a content-provider, is that it's much easier to do accounting and tracking, whereas with IPv4 a whole set of NAT'ed customers might all look alike.  Many providers of IPv6 even publish detailed info about their /64 and /48 customers in the public whois servers, whereas I've never even heard of a /32 IPv4 SWIP, even a /30 IPv4 SWIP is not something that's generally supported by anyone.&lt;/p&gt;&#xA;" OwnerUserId="296" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-11-24T01:20:30.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5137" PostTypeId="1" AcceptedAnswerId="5141" CreationDate="2013-11-24T13:44:37.820" Score="7" ViewCount="12944" Body="&lt;p&gt;I have two switches (Cisco 2960's) with a trunk between them (two ports in an ether-channel) and each has a trunk up to a separate router, all other switch ports are access ports to end devices;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1       R2&#xA;|        |&#xA;|        |&#xA;|        |&#xA;SW1 === SW2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to implement various STP options, port fast on all ports, BPDU filter and BPDU guard. I have read various Cisco documents and other reputable web site feeds, just a few are;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.ipexpert.com/2010/12/06/bpdu-filter-and-bpdu-guard/&quot; rel=&quot;nofollow&quot;&gt;BPDU Filter &amp;amp; BPDU Guard (IP Expert)&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst3560/software/release/12.2_55_se/configuration/guide/swstpopt.html#wp1095752&quot; rel=&quot;nofollow&quot;&gt;Cisco's BPDU Guard Docs&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4000/8.2glx/configuration/guide/stp_enha.html&quot; rel=&quot;nofollow&quot;&gt;More Cisco BPDU Guard Docs&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I wish to configured all access ports as follows, I already know and use these features and so there is no problems here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int gi0/10&#xA; description End Device Port&#xA; switchport mode access&#xA; switchport access vlan 10&#xA; spanning-tree portfast&#xA; spanning-tree bpdufilter enable&#xA; spanning-tree bpduguard enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wish to configured trunk ports between switches and up to routers as follows, again I already use this configuration and see no issues here;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int gi0/1&#xA; description Trunk to R1&#xA; switchport mode trunk&#xA; spanning-tree portfast trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I can't find any good documentation on is mixing BPDU filter and BPDU guard as global defaults with ports configured for &lt;code&gt;portfast trunk&lt;/code&gt;. To save my self configuring port-fast on every access port with BPDU guard and BPDU filter, I can simply enter these three global configuration commands;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree portfast default&#xA;spanning-tree portfast bpdufilter default&#xA;spanning-tree portfast bpduguard default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BPDU filter and BPDU guard will now become active on all portfast ports, but what about portfast ports that are configured as &lt;code&gt;portfast trunk&lt;/code&gt; such as between the switches, I want BPDU's being sent between switches. I can't find any documentation that says if or if not enabling BPDU guard/filter globally will also configure this on &lt;code&gt;portfast trunk&lt;/code&gt; ports, which could stop STP running between switches and potentially cause those trunk ports to &lt;code&gt;errdisable&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens when this situation is configured and are there any official online Cisco doc's to clarify?&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="775" LastEditDate="2013-11-25T11:42:45.937" LastActivityDate="2013-11-25T11:42:45.937" Title="Mixing Cisco STP Features: BPDU Guard, BPDU Filter, PortFast and PortFast Trunk" Tags="|cisco|switch|ethernet|spanning-tree|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5140" PostTypeId="2" ParentId="3326" CreationDate="2013-11-24T14:19:02.183" Score="2" Body="&lt;p&gt;Even in real hardware, the HWIC-4ESW and 16ESW modules do NOT support LACP/PAgP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to play with these sorts of tech you'll need a regular Cisco switch that support it or another vendor of course&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-11-24T14:19:02.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5141" PostTypeId="2" ParentId="5137" CreationDate="2013-11-24T20:01:08.120" Score="14" Body="&lt;p&gt;First, like the others have mentioned you have no bridging loop here due to running a Portchannel. That said, running STP is still fine. Let me clear some confusions on how these commands work on Cisco switches.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree portfast trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This command is supposed to be run on trunk ports towards non bridging devices, such as a server with multiple VLANs or a router. This command should not be run on trunks towards switches because the port will bypass the listening and learning phase which could potentially create a bridging loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have an interface configured like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface x/x&#xA;spanning-tree portfast&#xA;spanning-tree bpdufilter enable&#xA;spanning-tree bpduguard enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BPDU guard will never kick in because BPDU filter is filtering both the outgoing and incoming BPDUs. This also means that the port can never lose its Portfast status which it would normally do if BPDUs were received inbound. If you remove the filter then BPDU guard will kick in and shutdown the port if a BPDU is received. This is done before the port can lose its Portfast operatational state so basically the port will always operate in Porfast operational mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you apply the commands globally instead:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree portfast default&#xA;spanning-tree portfast bpdufilter default&#xA;spanning-tree portfast bpduguard default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first command enables Portfast on all access ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When BPDU filter is applied globally, the difference is that it sends out 11 BPDUs before going silent. Because normally one BPDU is sent out every 2 seconds and the default MaxAge is 20 seconds that means that if there is a device at the other end that can process BPDUs, at least one BPDU would be received when the old BPDU (if there was one) has expired.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a BPDU is received inbound when BPDU filter is applied globally then the port stops filtering and it will lose its Portfast status.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The BPDU guard default command will only apply to ports that are in a Portfast operational state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you combine these three commands together then what will happen is that when a BPDU is received the port loses its BPDU filter, BPDU guard can then kick in. The port will never lose its Portfast operational state because the port is shutdown before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you see when applied to the interface BPDU guard can never kick in but if you apply it globally it can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you run just Portfast globally and BPDU filter globally then if a BPDU comes in, the port loses the filter and loses the Portfast operational state and will operate as a normal port.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-11-24T20:01:08.120" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5146" PostTypeId="1" AcceptedAnswerId="5147" CreationDate="2013-11-25T11:33:41.267" Score="7" ViewCount="1974" Body="&lt;p&gt;&lt;strong&gt;A quick overview of the problem&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've been experiencing some issues with our bandwidth usage lately which I fear may be due to misuse (whether intentional or not) of our internet in the office. I want to be able to monitor the network traffic to see if a certain internal IP address is at fault. Our bandwidth should be more than sufficient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Our setup&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a 3Com Superstack 3 Switch connected to a Cisco PIX 501 firewall, which then connects into our ISP-provided router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I've tried&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that neither the switch or firewall have a Port Mirroring feature available, so I am not able to keep up a permanent trace. The PIX does offer a temporary trace into it's own memory buffer, however I am not too confident using this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also tried installing Wireshark on our (Windows 2000) DNS server, but the packet data here didn't help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Next steps&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions from you guys as to how monitor the traffic would be great. We're not in a position to replace the existing hardware just yet, though. I have looked into the cost of a Network Tap, which I could place between the switch and firewall (or firewall and router) and set up a machine to monitor the packets there. I've never taken this approach before, so wondered if it's really viable.&lt;/p&gt;&#xA;" OwnerUserId="3336" LastEditorUserId="775" LastEditDate="2013-11-25T11:56:51.570" LastActivityDate="2013-11-25T16:36:45.293" Title="Monitoring without Port Mirroring" Tags="|cisco|monitoring|wireshark|packet-analysis|pix|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5147" PostTypeId="2" ParentId="5146" CreationDate="2013-11-25T11:56:13.270" Score="9" Body="&lt;p&gt;Two possible choices... &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/412/why-do-network-taps-have-four-ports&quot;&gt;a packet capture tap&lt;/a&gt; (which is quite viable) or packet capture on the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not interested in buying a tap and inserting it inline, you shouldn't be afraid of capturing on your Cisco PIX.  To capture traffic on the PIX, first define an ACL... assume you're trying to capture traffic from a host inside the firewall at 10.10.10.1.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list CAPACL permit ip host 10.10.10.1 any&#xA;access-list CAPACL permit ip any host 10.10.10.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now start capturing the traffic that matches the ACL using a buffer large enough to find whether this host is legitimately a problem...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;capture inside_capture interface INSIDE buffer &amp;lt;some buffer size&amp;gt; access-list CAPACL packet-length 1500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can optionally download the capture using tftp...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy /pcap capture:inside_capture tftp: &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This Cisco doc has a lot of good information about capturing traffic on a PIX / Cisco ASA... &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-17345&quot; rel=&quot;nofollow noreferrer&quot;&gt;DOC 17345 Capturing PIX Traffic&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-11-25T11:56:13.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5148" PostTypeId="2" ParentId="5120" CreationDate="2013-11-25T14:25:41.660" Score="2" Body="&lt;p&gt;&lt;strong&gt;Updated Answer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Originally I thought it was upgrading the firmware of my load-balancers that fixed my issues.  That turns out to be coincidence. The actual problem involved a setting on the load-balancer itself.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Web servers in our cluster have to know the internal IP of the remote site in order to know what location is trying to access the page, then display information that pertains only to that site.  In order to do that I have to enable a setting call Spoofing on the Coyotepoint. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default Web servers in a load-balanced cluster only get requests from the load-balancer's cluster IP. When they are operating like that all traffic from the server going to the hosts and vice versa is going through the load-balancer. When Spoofing is turned on, the Web servers are seeing the Source Address as the remote site's internal IP. Instead of routing their response back through the load-balancer they just send the responses out their default gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Coyotepoint's best practices is to set the Web servers default-gateway to the cluster IP when spoofing is turned on.  I have changed all the default gateway of my web servers to the cluster ip, and everything is working.  Coyotepoint is convinced that is what was causing my TCP Out-Of-Order errors.  Also Coytoepoint stated there has been significant networking changes on their 10.2.0a code, but didn't give me anything specific.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Updated network diagram:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&#xA;+---------------------CORPORATE OFFICE----------------------------------------------------+&#xA;|                                                                                         |&#xA;|                            192.168.15.5/16 +--------------+ 192.168.11.1/30             |&#xA;|                            Inside Interface|  Cisco ASA   | DMZ Interface               |&#xA;|                                           ++--------------+&amp;lt;----------+                 |&#xA;|   +--------------------+&amp;lt;-----------------+                           +---------------+ |&#xA;|   |                    |                                              |  Meraki MX90  | |&#xA;|   |  Coyotepoint       |                                              |192.168.11.2/30| |&#xA;|   | 192.168.10.140/16  |                                              |Gateway: .1    | |&#xA;|   | Gateway: 40.2      |                                              +---------------+ |&#xA;|   |                    |    +------------------------------------+               ^      |&#xA;|   +--------------------+    |          Cisco Router              |               |      |&#xA;|                        |    |         192.168.40.2/16            |               |      |&#xA;|                        |    |Default Route to Remote Sites: .15.5|               |      |&#xA;|  +------------------+  |    +------------------------------------+               |      |&#xA;|  |      Web1        |  |                                                         |      |&#xA;|  |192.168.10.145/16 |  |                                                         |      |&#xA;|  |Gateway: 10.140   |  |                                                         |      |&#xA;|  +------------------+&amp;lt;-+   +-----------------------------------------------------|------+&#xA;|  +------------------+  |   |                                                     |&#xA;|  |      Web2        |  |   |                                                     |&#xA;|  |192.168.10.146/16 |  |   |                                                     |&#xA;|  |Gateway: 10.140   |  |   |                                                 IPsec VPN&#xA;|  +------------------+&amp;lt;-+   |                                                     |&#xA;|  +------------------+  |   |                                     +               |&#xA;|  |      Web3        |  |   |                                     +---------------+&#xA;|  |192.168.10.147/16 |  |   |                                     | Remote Sites  |&#xA;|  |Gateway: 10.140   |  |   |                                     +---------------+&#xA;|  +------------------+&amp;lt;-+   |&#xA;+----------------------------+&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original Answer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This issue was fixed by upgrading my Coytoepoint firmware version from 8.6.0i-patch1 to 10.2.0a.  The version I was running was the most up to date I could go to without reconfigurring my load-balancer from scratch. The configs don't transfer when you update from 8.6.0i-patch1 to v10.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This site seems to have some other issues that I will be looking into, but the original problem has been solved.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks everyone for your help and suggestions.&lt;/p&gt;&#xA;" OwnerUserId="3322" LastEditorUserId="3322" LastEditDate="2013-11-26T04:24:02.617" LastActivityDate="2013-11-26T04:24:02.617" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5149" PostTypeId="1" AcceptedAnswerId="5160" CreationDate="2013-11-25T16:10:43.127" Score="4" ViewCount="956" Body="&lt;p&gt;Can a Cisco router act as an IDS for LAN traffic that does not pass through it? Specifically, can traffic passing through a switch be port mirrored to an interface on the router with the router acting as an IDS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking for a way to use an ISR G2 router like Snort to monitor traffic between devices on a LAN.&lt;/p&gt;&#xA;" OwnerUserId="1911" LastActivityDate="2013-11-25T22:07:02.410" Title="Cisco router as IDS" Tags="|router|firewall|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5150" PostTypeId="2" ParentId="5149" CreationDate="2013-11-25T16:34:34.737" Score="-1" Body="&lt;p&gt;I think John Kennedy is right, there isn't anything out there that seems like it fits the bill on your questions; but I'll give a wag at it anyhow.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can a Cisco router act as an IDS for LAN traffic that does not pass&#xA;  through it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, although there are certain Cisco devices that can act as an IDS/IPS. Cisco has an &lt;a href=&quot;http://www.cisco.com/en/US/products/ps5729/Products_Sub_Category_Home.html&quot; rel=&quot;nofollow&quot;&gt;entire line&lt;/a&gt; of products specializing in this, specifically. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These will likely be massive overkill for your situation though.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Specifically, can traffic passing through a switch be port mirrored to&#xA;  an interface on the router with the router acting as an IDS?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This has always been possible with port-mirroring (&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/sw/5_x/nx-os/system_management/configuration/guide/sm_14span.html&quot; rel=&quot;nofollow&quot;&gt;SPAN ports&lt;/a&gt;). They functionally do exactly what you're looking for. They replicate traffic ingressing/egressing an interface/VLAN and spit it out on a pre-defined port/VLAN.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I am looking for a way to use an ISR G2 router like Snort to monitor&#xA;  traffic between devices on a LAN.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not so sure this model supports custom code (like snort) in the way you're expecting it to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although not as elegant, you could always set up a standalone machine to run your IDS applications on.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2013-11-25T22:07:02.410" LastActivityDate="2013-11-25T22:07:02.410" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5151" PostTypeId="2" ParentId="5146" CreationDate="2013-11-25T16:36:45.293" Score="1" Body="&lt;p&gt;You can pretty easily make your own ethernet tap.  It probably won't work on a gigabit interface, but will work on 10 or 100mbit.  I've made one before when I didn't want to wait for a premade one to ship.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://hackaday.com/2008/09/14/passive-networking-tap/&quot; rel=&quot;nofollow&quot;&gt;http://hackaday.com/2008/09/14/passive-networking-tap/&lt;/a&gt; has a little write up about them.  Basically all you need is a 4 cat5 jacks and a bit of cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two of the jacks sit in between the existing connection between the switch and firewall, or the firewall and ISP router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two tap jacks each have one signal direction connected.  You plug one into your laptop (or both, if you have a system with 2 NICs).  The transmit pins of your network card aren't connected at all, so the laptop can't accidentally transmit any data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Capturing just one direction is probably enough to tell where the excessive usage is coming from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would test the tap on some less important connection before unplugging the office's internet connection.  Once you know it works you can hook it up and leave wireshark running on a laptop for as long as you need to figure out the problem.&lt;/p&gt;&#xA;" OwnerUserId="3339" LastActivityDate="2013-11-25T16:36:45.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5152" PostTypeId="2" ParentId="5149" CreationDate="2013-11-25T16:46:00.937" Score="3" Body="&lt;p&gt;No, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what you CAN do is set up a box with SNORT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you can apply an access-list to your Span session port that is just &quot;permit ip any any log&quot; and that will log traffic source and destination addresses (along with TCP/UDP port info). Then if you can redirect these log messages to a syslog server you could export them in realtime to a CSV and have an application like SNORT alalyze the traffic flows. Or you can log them locally on the device and then extract/parse them manually to look for anomalous traffic flows. &lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-11-25T16:46:00.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5153" PostTypeId="1" CreationDate="2013-11-25T19:22:32.093" Score="8" ViewCount="1003" Body="&lt;p&gt;We have Juniper EX 4200 as core switch at two sites connected Cisco  2960s and Cisco 3560s (access layer switches). For even-numbered VLANs,  one Juniper switch is root bridge and for odd-numbered VLANs, other  Juniper switch is the root bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have Cox and Verizon Metro-E links connecting core switches (Juniper EX 4200 at both sites).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to do VLAN load sharing using VSTP but somehow it is not  working as expected. I want to pass some VLANs through COX and some  through Verizon. When there is any issue with Cox, all VLAN traffic pass  through Verizon and vice-versa. RSTP is also enabled on both Juniper  switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see MAC flapping in log messages on all Cisco access layer switches  when I bring up both Metro-E links together. When only Cox is  connected, everything works fine. When only Verizon is connected,  everything works fine. But when BOTH COX and Verizon are connected,  network gets disrupt and I see MAC flapping on all Cisco switches. All  cisco switches are running PVST.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anybody knows what is happening  and why VSTP is not working when both COX and VERIZON Metro-E links are active ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update (09-Dec-2013):=====&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on Juniper KBs: KB18291 and KB15138, I did the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I enabled a common native vlan 50 (and shutdown vlan 1) on all Juniper and Cisco switches and configure the trunk ports where Cisco switches connect to Juniper for native vlan. (This is because Spanning-tree BPDUs are exchanged via Native VLAN between Cisco and Juniper). By default, Cisco native vlan is vlan 1 and there is no native vlan on Juniper. So Juniper does not understand the BPDUs and treats them as broadcast traffic flooding them to the corresponding VLAN. Because of this STP between Cisco and Juniper does not converge.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Changed Cisco Spanning tree mode from PVST to Rapid-PVST (Juniper recommends changing Cisco spanning-tree mode from default - PVST to Rapid-PVST). Rapid-PVST converges well with Juniper spanning tree protocol “VSTP”.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Deleted RSTP protocol statements as per Juniper documentation&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Entered vstp interface priority command for VLANs and Native VLAN on Juniper switches&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now when Cox and Verizon links are up at the same time, I see that some Cisco switches that hang-off to juniper core switches at both sites go down. I also see in Juniper (using command &quot;show ethernet-switching interfaces&quot;) that some interfaces where Cisco switches are connected are blocked by STP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone figure out what is happening ?&lt;/p&gt;&#xA;" OwnerUserId="3342" LastEditorUserId="3342" LastEditDate="2013-12-09T15:30:55.647" LastActivityDate="2013-12-09T15:30:55.647" Title="VLAN load sharing on Metro-E links between two Juniper EX 4200" Tags="|cisco|juniper-ex|metro-ethernet|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5154" PostTypeId="2" ParentId="5153" CreationDate="2013-11-25T19:36:23.830" Score="2" Body="&lt;p&gt;Are the carriers passing your L2 control frames? Quite often you need to specifically ask them to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can verify by checking your BPDUs sent and received on both switches when they are both up&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-11-25T19:36:23.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5155" PostTypeId="1" CreationDate="2013-11-25T19:52:32.833" Score="3" ViewCount="1222" Body="&lt;p&gt;A little confused.. When trouble shooting excessive output drops on a 3750 i noticed that al switching is done by cpu instead of &quot;route cache&quot;. This 3750 has no ip routing enabled and no ip cef (ip cef is only for layer 3 i believe).. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why isnt this switch using fast switching? I always thought that the first packet was processed by cpu but then it should do switching out of the learned/cached table e.g. fast switching.. But when i issue the command sh interface x/x stats the output is telling me that all packets are forwarded by CPU and none by &quot;route cache&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;?       &lt;/p&gt;&#xA;" OwnerUserId="209" LastActivityDate="2013-11-25T20:03:02.227" Title="All switching on cisco 3750 done by cpu" Tags="|cisco|cisco-ios|switching|cef|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5156" PostTypeId="2" ParentId="5155" CreationDate="2013-11-25T20:03:02.227" Score="2" Body="&lt;p&gt;If &quot;IP routing&quot; is disabled then your frames are NOT getting forwarded by your CPU. I am familiar with the output that you are talking about though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;show interfaces &lt;em&gt;_&lt;/em&gt; X/X stats&quot; is a hidden command in IOS and as such it really isn't maintained the way most other show commands are. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do a &quot;show proc cpu sorted | in Input&quot; then you will see the &quot;IP Input&quot; process. That is the best way that you can see how much of a tax the forwarding plane is putting on your CPU.&lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-11-25T20:03:02.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5157" PostTypeId="2" ParentId="5110" CreationDate="2013-11-25T21:25:29.163" Score="8" Body="&lt;p&gt;Answering my own question to help future googlers.  I spent about 3 hours on the phone with TAC; we finally got to the root cause of the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution is to add a special NAT entry, which matches the IP address in the DNS A-Record when it arrives on the INSIDE interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network DNS_NAT_masd1&#xA; description xlate A-Record DMZ src 1.195.18.182 to INSIDE src 10.195.18.182&#xA; host 1.195.18.182&#xA; nat (DMZ,INSIDE) static 10.195.18.182&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I asked for a pointer to documentation that describes why DNS translation works this way, the TAC lead said that he didn't know of any that described this behavior.  The TAC lead also mentioned that with more code, the ASA would know to automatically translate the DNS A-Record without explicitly adding &lt;code&gt;object network DNS_NAT_masd1&lt;/code&gt;; however, that is not how the &lt;code&gt;dns&lt;/code&gt; keyword for ASA NAT works today.  For reasons that still are not completely clear yet, the ASA requires the DNS A-Record IP to match the &lt;code&gt;&amp;lt;proxy_addr&amp;gt;&lt;/code&gt; in the NAT statement, using syntax similar to this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network obj-EXAMPLE&#xA; description NAT object explicitly for translating DNS A-Records&#xA; host &amp;lt;proxy_addr&amp;gt;&#xA; nat (&amp;lt;REAL_INTF&amp;gt;,&amp;lt;PROXY_INTF&amp;gt;) static &amp;lt;real_addr&amp;gt; dns&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The difficulty is that this configuration is exactly backwards for what you need to do if you're going to nat regular &quot;data plane&quot; IP traffic through the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the whole configuration that works...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network DMZ_NAT_masd1&#xA; host 10.195.18.182&#xA; description xlate masd1 NAT DMZ src 10.195.18.182 to INSIDE src 192.168.11.101&#xA;object network INSIDE_NAT_masd1&#xA; host 10.195.18.182&#xA; description xlate masd1 NAT INSIDE src 10.195.18.182 to DMZ src 1.195.18.182&#xA;!!! DNS_NAT_masd1 is new&#xA;object network DNS_NAT_masd1&#xA; host 1.195.18.182&#xA; description xlate A-Record DMZ src 1.195.18.182 to INSIDE src 10.195.18.182&#xA;!&#xA;object network DMZ_NAT_masd1&#xA; nat (DMZ,INSIDE) static 192.168.11.101&#xA;object network INSIDE_NAT_masd1&#xA; nat (INSIDE,DMZ) static 1.195.18.182&#xA;!!! DNS_NAT_masd1 is new&#xA;object network DNS_NAT_masd1&#xA; nat (DMZ,INSIDE) static 10.195.18.182 dns&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-11-25T23:17:57.687" LastActivityDate="2013-11-25T23:17:57.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5158" PostTypeId="1" CreationDate="2013-11-25T21:48:21.233" Score="5" ViewCount="2736" Body="&lt;p&gt;I am about to implement a network at a remote office that will also be providing some bandwidth to a sub tenant. We have a 50 Mbps connection terminating to a VLAN on a 3750-X. Each company has an L2 handoff on the same VLAN. I want to shape traffic so that Client A is guaranteed around 30 Mbps, and Client B is guaranteed around 20 Mbps at maximum utilization. If, for example, Client A is using 1 Mbps, Client B should be able to use the rest of the available bandwidth until Client A needs more.&lt;/p&gt;&#xA;" OwnerUserId="3344" LastActivityDate="2013-11-27T12:56:25.967" Title="Minimum Bandwidth Guarantee 3750-X" Tags="|cisco-catalyst|qos|policing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5160" PostTypeId="2" ParentId="5149" CreationDate="2013-11-25T22:01:14.463" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am looking for a way to use an ISR G2 router like Snort [snip]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your entire question starts and stops right there. The IPS/IDS within IOS is not designed for out-of-band traffic inspection.  The router &lt;em&gt;must&lt;/em&gt; be &lt;em&gt;inline&lt;/em&gt; to inspect it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put simply, IOS is not SNORT. If you want SNORT, run SNORT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Also, the IPS/IDS within IOS is very slow -- being done entirely in the way under powered router CPU -- and often incomplete. You'll need a support contract to keep it remotely up to date.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-11-25T22:01:14.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5161" PostTypeId="2" ParentId="2598" CreationDate="2013-11-25T22:17:28.487" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The IEEE 802.3ac standard increased the maximum Ethernet frame size from 1518 bytes to 1522 bytes to accommodate the four-byte VLAN tag. Some network devices that do not support the larger frame size will process the frame successfully but may report them as a &quot;baby giant&quot; anomalies.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, if you device's support &quot;IEEE 802.3ac&quot;, IP MTU will not change.&lt;/p&gt;&#xA;" OwnerUserId="1315" LastActivityDate="2013-11-25T22:17:28.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5162" PostTypeId="2" ParentId="5158" CreationDate="2013-11-25T22:23:19.567" Score="3" Body="&lt;p&gt;Here is what you can do with a 3750:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all CLIENT1&#xA; match input-interface  GigabitEthernet1/0/1 (or match based off AN ACL for the client networks)&#xA;class-map match-all CLIENT2&#xA; match input-interface  GigabitEthernet1/0/2 (or match based off AN ACL for the client networks)&#xA;!&#xA;policy-map BW&#xA; class CLIENT1&#xA;  police 30000000 500000 exceed-action drop&#xA; class CLIENT2&#xA;  police 20000000 400000 exceed-action drop&#xA;!&#xA;interface GigabitEthernet 1/0/1&#xA; srr-queue bandwidth limit 3&#xA;!&#xA;interface GigabitEthernet 1/0/2&#xA; srr-queue bandwidth limit 2&#xA;!&#xA;!&#xA;interface whatever your outbound L3 interface is&#xA; service-policy input BW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This configuration gives you interface rate-limiting down to the desired bandwith (it is a percentage so 3= 30mbps on a GigE interface) and also checks the traffic being sent thru your outbound L3 interface to make sure that the traffic complies. By outbound L3 interface I am referring generically to whatever L3 gateway is shared by both clients whether it is an SVI (interface Vlan X) or your outbound physical interface.&lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-11-25T22:23:19.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5165" PostTypeId="2" ParentId="5153" CreationDate="2013-11-26T01:35:38.997" Score="5" Body="&lt;p&gt;&lt;em&gt;&lt;strong&gt;Rule #1:&lt;/strong&gt; in a mixed vendor environment, one avoids use of vendor proprietary protocols&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are (apparently) several complications attempting to use VSTP (a Juniper protocol) with PVST (RPVST actually, a Cisco protocol) -- while they both run a per-vlan RSTP instance, they don't do it exactly the same (something about tagged/untagged native vlans, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your best bet would be to use an open, documented standard with rules &lt;em&gt;everybody&lt;/em&gt; obeys.  That would be MST (802.1s, now part of 802.1q.) Of course, MST is a great deal more complicated to setup. (been there... complex hundreds of vlans across 4 vendors)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All this assumes the carriers aren't screwing with the traffic. If I'm following your description, the metro-e links are between juniper switches and the cisco's hang off the juniper's at each site. If that's true, there's only one path from a cisco to the other side, so mac flaps shouldn't be possible -- unless there's a &lt;em&gt;pair&lt;/em&gt; of junipers at each end round-robin'ing traffic between sites. (or there are etherchannels that aren't setup/running correctly)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-11-26T01:35:38.997" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5172" PostTypeId="1" AcceptedAnswerId="5174" CreationDate="2013-11-26T14:58:43.243" Score="4" ViewCount="411" Body="&lt;p&gt;I have a 45xx model and want to identify a specific IOS version for it.&#xA;Trouble is I cannot figure what Platform is from the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CAT4500-SUP2-PLUS&lt;/li&gt;&#xA;&lt;li&gt;CAT4500-SUP2-PLUS-TS&lt;/li&gt;&#xA;&lt;li&gt;CAT4500-SUP3&lt;/li&gt;&#xA;&lt;li&gt;CAT4500-SUP4&lt;/li&gt;&#xA;&lt;li&gt;CAT4500-SUP5 &lt;/li&gt;&#xA;&lt;li&gt;CAT4948&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both show version and show platform tell me that this is a 4507 still how can I guess from the options above?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show module           &#xA;Chassis Type : WS-C4507R&#xA;&#xA;Power consumed by backplane : 40 Watts&#xA;&#xA;Mod Ports Card Type                              Model              Serial No.&#xA;---+-----+--------------------------------------+------------------+-----------&#xA; 1     2  Supervisor IV 1000BaseX (GBIC)         WS-X4515           JAE09065N62 &#xA; 2     2  Supervisor IV 1000BaseX (GBIC)         WS-X4515           JAE10223LPP &#xA; 3    48  10/100BaseTX (RJ45)                    WS-X4148-RJ        JAE09044J58 &#xA; 4    48  10/100BaseTX (RJ45)                    WS-X4148-RJ        JAE08041PL0 &#xA; 5    48  10/100BaseTX (RJ45)V                   WS-X4148-RJ45V     JAE10254S3T &#xA; 6    48  10/100BaseTX (RJ45)                    WS-X4148-RJ        JAE08041QL8 &#xA; 7    48  10/100BaseTX (RJ45)V                   WS-X4148-RJ45V     JAE1003TZ0Q &#xA;&#xA; M MAC addresses                    Hw  Fw           Sw               Status&#xA;--+--------------------------------+---+------------+----------------+---------&#xA; 1 0012.daf6.c980 to 0012.daf6.c981 4.0 12.2(20r)EW1 12.2(25)EWA4     Ok       &#xA; 2 0012.daf6.c982 to 0012.daf6.c983 5.0 12.2(20r)EW1 12.2(25)EWA4,    Ok       &#xA; 3 0012.80c1.5a20 to 0012.80c1.5a4f 3.1                               Ok       &#xA; 4 000e.d718.5750 to 000e.d718.577f 3.1                               Ok       &#xA; 5 0018.180f.c800 to 0018.180f.c82f 3.0                               Ok       &#xA; 6 000e.d716.c4d0 to 000e.d716.c4ff 3.1                               Ok       &#xA; 7 0016.461d.29f0 to 0016.461d.2a1f 2.9                               Ok       &#xA;&#xA;Mod  Redundancy role     Redundancy mode     Redundancy status&#xA;----+-------------------+-------------------+-------------------&#xA; 1   Active Supervisor   SSO                 Active             &#xA; 2   Standby Supervisor  SSO                 Standby hot        &#xA;&#xA;Also show  version output:&#xA;&#xA;show ver&#xA;Cisco IOS Software, Catalyst 4000 L3 Switch Software (cat4000-I9S-M), Version 12.2(25)EWA4, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2005 by Cisco Systems, Inc.&#xA;Compiled Fri 23-Sep-05 13:31 by ssearch&#xA;Image text-base: 0x10000000, data-base: 0x114DFF08&#xA;&#xA;ROM: 12.2(20r)EW1&#xA;Dagobah Revision 95, Swamp Revision 29&#xA;&#xA;4507-01 uptime is 2 years, 19 weeks, 1 day, 8 hours, 57 minutes&#xA;Uptime for this control processor is 2 years, 19 weeks, 1 day, 9 hours, 25 minutes&#xA;System returned to ROM by power-on&#xA;System restarted at 09:08:10 EEST Sat Jul 16 2011&#xA;System image file is &quot;bootflash:cat4000-i9s-mz.122-25.EWA4.bin&quot;&#xA;&#xA;cisco WS-C4507R (MPC8245) processor (revision 7) with 524288K bytes of memory.&#xA;Processor board ID FOX090105QF&#xA;MPC8245 CPU at 333Mhz, Supervisor IV&#xA;Last reset from PowerUp&#xA;3 Virtual Ethernet interfaces&#xA;240 FastEthernet interfaces&#xA;4 Gigabit Ethernet interfaces&#xA;403K bytes of non-volatile configuration memory.&#xA;&#xA;Configuration register is 0x2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="794" LastEditorUserId="775" LastEditDate="2013-11-26T15:52:48.430" LastActivityDate="2013-11-26T15:52:48.430" Title="Identify a 4500 model" Tags="|cisco|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5174" PostTypeId="2" ParentId="5172" CreationDate="2013-11-26T15:12:45.990" Score="4" Body="&lt;p&gt;This is what you have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps4324/product_data_sheet0900aecd8035cf2b.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps4324/product_data_sheet0900aecd8035cf2b.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where you will download your IOS from:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://software.cisco.com/download/type.html?mdfid=277241602&amp;amp;flowid=2433&quot; rel=&quot;nofollow&quot;&gt;http://software.cisco.com/download/type.html?mdfid=277241602&amp;amp;flowid=2433&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-11-26T15:12:45.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5175" PostTypeId="1" AcceptedAnswerId="5184" CreationDate="2013-11-26T15:15:47.113" Score="1" ViewCount="771" Body="&lt;p&gt;I am aware of the following types of Vlan's.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Default VLAN: This is basically where ALL ports belongs to by default, this is technically VLAN 1 and it can't be deleted from the switch. &#xA;&#xA;Data VLAN: &#xA;&#xA;Native VLAN: The native VLAN is an 802.1Q only concept. &#xA;&#xA;Voice VLAN: The voice VLAN is where the QoS policies are applied in order to prioritize this traffic to send it through the LAN. &#xA;&#xA;Management VLAN: This is used on a LAN for management purporses. &#xA;&#xA;Special VLANs: These VLANs are basically used for special cases on your LAN. &#xA;&#xA;Reserved VLANs: There are some VLANs that are reserved internally on your switch in order to use them on other enviroments like FDDI, Token Ring.&#xA;&#xA;Private VLANs it's a technology that has some new concpets/category of VLANs.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But recently in a dell powerconnect switch i saw Vlan type as &lt;strong&gt;&lt;em&gt;permanent&lt;/em&gt;&lt;/strong&gt;. Can anybody please tell me what a permanent vlan type would mean.&lt;/p&gt;&#xA;" OwnerUserId="3353" LastEditorUserId="775" LastEditDate="2013-11-26T15:52:14.163" LastActivityDate="2013-11-27T03:20:54.833" Title="What is Dell's &quot;Permanent&quot; VLAN?" Tags="|vlan|dell|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5176" PostTypeId="2" ParentId="5175" CreationDate="2013-11-26T15:36:19.660" Score="-1" Body="&lt;p&gt;All of these terms arbitrary. A Vlan is a Vlan, some perform special functions though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I.E.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Private VLAN configuration&lt;br&gt;&#xA;RSPAN VLAN configuration&lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-11-26T15:36:19.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5177" PostTypeId="1" AcceptedAnswerId="5864" CreationDate="2013-11-26T15:51:49.870" Score="4" ViewCount="458" Body="&lt;p&gt;We are in the process of rolling out Cisco AnyConnect in our environment to replace the old IPSec client.  We are purposely avoiding this deployment to machines that already have the client installed (consultants, etc) in order to avoid any problems with their current installations.&#xA;I have received a report of someone who decided to go out and pull the software down from our software delivery catalog anyways.  It deleted his already existing connection profiles of external clients and it won't &quot;remember&quot; them now in the drop-down list of Cisco AnyConnect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any experiences with Cisco AnyConnect and dealing with connection profiles for outside customers?  Any experiences of this happening where a software installation deletes them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to find a way to mitigate this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Geoff&lt;/p&gt;&#xA;" OwnerUserId="26" LastActivityDate="2014-01-15T22:36:45.870" Title="Cisco AnyConnect connection profiles affected by upgrades?" Tags="|cisco-anyconnect|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5178" PostTypeId="2" ParentId="5175" CreationDate="2013-11-26T19:28:31.573" Score="2" Body="&lt;p&gt;I found this information on a Dell support forum: &lt;em&gt;If a packet arrives at the port from an end device carrying no VLAN tag, then the switch will add a VLAN tage which corresponds to the PVID, and then forward it within that VLAN; so the PVID mechanisim allows you to have traffic originating from a non-VLAN aware device to become an 802.1q packet, so that it can traverse to other switches and still be contained within the correct VLAN; so PVID is for non tagged packets arriving at a port on the switch.&lt;/em&gt;.&lt;br&gt;&#xA;I found this at: &lt;a href=&quot;http://en.community.dell.com/support-forums/servers/f/866/t/18619540.aspx&quot; rel=&quot;nofollow&quot;&gt;http://en.community.dell.com/support-forums/servers/f/866/t/18619540.aspx&lt;/a&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it appears to be a Dell proprietary item, which would partially explain its unfamiliarity to many of us. If you are tasked with maintaining or configuring this switch, I believe your best course is going to require becoming intimately familiar with the Dell way of thinking.&lt;/p&gt;&#xA;" OwnerUserId="2375" LastActivityDate="2013-11-26T19:28:31.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5182" PostTypeId="2" ParentId="5063" CreationDate="2013-11-26T19:48:04.730" Score="1" Body="&lt;p&gt;Mikrotik has a &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual%3aOpenFlow&quot; rel=&quot;nofollow&quot;&gt;wiki page about their Openflow support&lt;/a&gt;. Based on the current information on that page they only support Openflow 1.0.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2013-11-26T19:48:04.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5183" PostTypeId="1" CreationDate="2013-11-26T20:49:27.600" Score="6" ViewCount="3047" Body="&lt;p&gt;For branch offices with dual routers and WAN connections asymmetric routing causes issues with stateful packet inspection. Packets leaving through one router and returning through the other are dropped as the return router's stateful firewall knows nothing about them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to address asymmetric routing with dual stateful firewalls is to place the firewalls behind the routers with both firewalls in the same L2 (see figure below).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PmzeH.jpg&quot; alt=&quot;Dual Routers and Firewalls&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above solution requires more equipment at the branch offices (2x firewalls plus switches). To retain the benefits of a shared L2 between the routers and firewalls, I have tested the scenario below in GNS3. The router and stateful firewall (IOS Firewall) are combined in a single box using separate VRFs. The LAN-sides of the routers communicate with each other and the WAN-facing side of the firewalls over VLAN 666. Three HSRP groups are used: one for the router VRFs on their Fa0/0.666 interface, and two on the firewall VRFs, one for each interface. These HSRP groups ensure that packets will leave and return through the same firewall, though not necessarily the same WAN VRF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/FHfEI.jpg&quot; alt=&quot;VRF-separated Router and Firewall&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This being an unconventional solution I would appreciate feedback. I know it works in GNS3, and presumably in an actual setup, but because I have not seen such a solution online or in books I assume there may be drawbacks. Aside from increased complexity and perhaps a hit in throughput is there a reason to avoid such a design?&lt;/p&gt;&#xA;" OwnerUserId="1911" LastActivityDate="2013-12-31T22:30:33.667" Title="VRFs to address asymmetric routing with stateful inspection" Tags="|firewall|vrf|asymmetric-routing|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5184" PostTypeId="2" ParentId="5175" CreationDate="2013-11-27T03:20:54.833" Score="4" Body="&lt;p&gt;In &quot;Dell-speak,&quot; a permanent vlan means that the setting is saved to a file so that the VLAN is configured when the switch is booted up.  Otherwise rebooting the switch would delete the vlan configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's roughly the same as &quot;copy run start&quot; on a Cisco switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I agree with John -- the VLAN &quot;types&quot; are arbitrary and vendor-specific.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2013-11-27T03:20:54.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5186" PostTypeId="2" ParentId="5158" CreationDate="2013-11-27T05:16:42.593" Score="4" Body="&lt;p&gt;I don't have a spare 3750X to validate this with but I think I got it...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;John Kennedy gave a great answer if you want to give a hard limit to the amount of traffic that Client A and B can send but your question was how to guarantee a minimum amount of bandwidth and still allow bursting if BW is available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to accomplish this we will have a policer on each of the Client A and B ingress interfaces.  The set of policers will classify the traffic into 4-classes, Client-A conforming (the first 30Mb, set DSCP to AF31, decimal value 26), Client-A non-conforming (everything above 30Mb, set as DSCP AF32, decimal value 28), Client-B conforming (first 20Mb, DSCP AF21, 18), Client-B non-conforming (over 20Mb, set DSCP AF22, 20).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will then map each of these classes to a queue on egress and allocate the bandwidth in a manner that should allow each client the minimum required bandwidth but still have the ability to use more if it is available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;first let's map dscp values (in decimal) to egress queues&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mls qos srr-queue output dscp-map queue 1 threshold 1 26&#xA;mls qos srr-queue output dscp-map queue 2 threshold 1 18&#xA;mls qos srr-queue output dscp-map queue 3 threshold 1 28&#xA;mls qos srr-queue output dscp-map queue 4 threshold 1 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then we create the map to change af31 to af32 and af21 to af22 when it exceeds the guaranteed rate&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mls qos map policed-dscp 26 to 28&#xA;mls qos map policed-dscp 18 to 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;create a policy that sets the traffic to af31 for all traffic and if the traffic exceeds 30Mb then set to af32&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map reserve-30mb&#xA; class-default&#xA;  set dscp 26&#xA;  police 30000000 exceed-action policed-dscp-transmit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;create another policy that sets the traffic to af21 for all traffic and if the traffic exceeds 20Mb then set to af22&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map reserve-20mb&#xA; class-default&#xA;  set dscp 18&#xA;  police 20000000 exceed-action policed-dscp-transmit  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;apply the policy to the client A input interface&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet 1/0/1&#xA; service-policy input reserve-30mb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;apply the policy to the client B input interface&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet 1/0/2&#xA; service-policy input reserve-20mb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for the WAN interface we set the ratio to 60/40 on queue 1 &amp;amp; 2 (AF31 and AF21) and then set the overflow queues to small values so that they can share any remaining bandwidth&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet 1/0/3&#xA; srr-queue bandwidth share 60 40 1 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only task this does not accomplish is limit the WAN bandwidth to 50Mb.&#xA;&lt;code&gt;srr-queue bandwidth limit&lt;/code&gt; should do this, however the documentation says it only supports 10-90%.  If the link is FastEthernet you may be able to do this using &lt;code&gt;srr-queue bandwidth limit 50&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I pulled a lot of the configuration details from &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst3750x_3560x/software/release/12.2_55_se/configuration/guide/swqos.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="176" LastEditorUserId="176" LastEditDate="2013-11-27T12:56:25.967" LastActivityDate="2013-11-27T12:56:25.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5191" PostTypeId="1" AcceptedAnswerId="5192" CreationDate="2013-11-27T10:04:19.640" Score="5" ViewCount="8613" Body="&lt;p&gt;Can anyone clarify the question &quot;why we need checksum in both layer-2 and layer-3 of OSI layer&quot;, Layer-2 would encapsulate the rest of OSI layers into a single unit. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If Layer-2 has a checksum, shouldn't this validation be enough? &lt;/li&gt;&#xA;&lt;li&gt;Why we are having checksum validation in different OSI Layers ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="8499" LastEditDate="2018-03-21T01:12:37.890" LastActivityDate="2018-03-21T01:12:37.890" Title="Why are there checksums for different OSI layers?" Tags="|protocol-theory|layer2|layer3|osi|checksum|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5192" PostTypeId="2" ParentId="5191" CreationDate="2013-11-27T10:13:40.207" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;If Layer-2 has a checksum, shouldn't this validation be enough?&lt;/li&gt;&#xA;  &lt;li&gt;Why we are having checksum validation in different OSI Layers?&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Simply put, different layers of the OSI model have checksums so you can assign blame appropriately.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Suppose there is a webserver running on some system (assume TCP port 80, i.e. OSI Layer 4)&lt;/li&gt;&#xA;&lt;li&gt;Suppose there is a software error in the Operating System of that webserver that corrupts certain IP payloads. (IPv4 OSI Layer 3)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Case 1: Only use Ethernet checksums&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If we only rely on Ethernet (i.e. OSI Layer 2) checksums, then that error would go un-noticed until something crashes or throws an error, because the Ethernet NIC would simply transmit the (already corrupted) data that it received from the Operating System IP stack. For sake of argument, let's assume the TCP payload is corrupted, but the Ethernet checksum is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the IP stack on the other side receives the Ethernet frame, it unpacks the IP payload and delivers it to the webserver.  However, the TCP payload in this packet is corrupted.  When the web server crashes from data corruption, the developer has no way to isolate whether this was an IP-level failure or a TCP failure (or perhaps something else farther up the application stack).&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Case 2: Layered checksums&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;However, if TCP, IP and Ethernet all have checksums, we can isolate the layer where the error occurred, and notify the appropriate Operating System or application component of the error.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-11-27T10:39:24.170" LastActivityDate="2013-11-27T10:39:24.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5194" PostTypeId="1" CreationDate="2013-11-27T13:30:52.023" Score="2" ViewCount="77" Body="&lt;p&gt;I am trying to establish Modbus TCP/IP communication. Modbus Master and slave are around 500 mtr away from each other. We are using FO to Copper converter at both ends. Modbus slave end is having Siemens X308-2LH converter and Modbus Master is having Hirschmann 1TX\1FX-SM converter. In this case I am not able to establish communication but if I use Siemens X308-2LH converter at both end communication is estalished. Could anyone tell me the reason? &lt;/p&gt;&#xA;" OwnerUserId="3361" LastActivityDate="2013-11-27T14:13:23.210" Title="Different Media Converters at both ends for Modbus Communication" Tags="|fiber|" AnswerCount="1" CommentCount="1" ClosedDate="2018-04-23T02:28:11.420" ContentLicense="CC BY-SA 3.0" />
  <row Id="5195" PostTypeId="2" ParentId="5194" CreationDate="2013-11-27T14:10:09.737" Score="5" Body="&lt;p&gt;As you said the devices are 500m apart, I'll assume that's where all the fiber lives.  As such, you are attempting to plug LH into SM. That doesn't work because they use different frequencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See Also: &lt;a href=&quot;http://en.wikipedia.org/wiki/Gigabit_Ethernet&quot;&gt;GigabitEthernet&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="775" LastEditDate="2013-11-27T14:13:23.210" LastActivityDate="2013-11-27T14:13:23.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5196" PostTypeId="1" AcceptedAnswerId="5199" CreationDate="2013-11-27T15:10:42.910" Score="6" ViewCount="15114" Body="&lt;p&gt;I have a service object group of type 'tcp-udp'.  When creating an ACL based around this, I don't have the option of type 'tcp-udp'.  I'm trying to figure out what the point of tcp-udp groups are, if at the end of the day you still have to make two ACL's one for tcp and one for udp.  Is there a way to make one ACL for groups of this nature.. for instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list crypto_1 extended permit ip any any object-group APP_tcp_udp_group&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2013-11-27T18:41:08.420" LastActivityDate="2013-12-05T13:28:39.543" Title="How to use tcp-udp objects in a single ACL?" Tags="|cisco|cisco-asa|firewall|acl|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5198" PostTypeId="1" AcceptedAnswerId="5202" CreationDate="2013-11-27T16:27:16.007" Score="5" ViewCount="506" Body="&lt;p&gt;I would like that traffic between pppoe users passes through a traffic management device as showed below&lt;img src=&quot;https://i.stack.imgur.com/VcfwL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have evarything working, i mean, users have ppp session and they have internet access via a default route in the NAS. But traffic between them doesn't pass throught the traffic management device as they are in the same subnet. I tried to configure a PBR for traffic incoming the in-interface with no success&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 100 permit ip any any&#xA;!&#xA;route-map toallot permit 10&#xA; match ip address 100&#xA; set ip next-hop X.X.X.1&#xA;!&#xA;interface GigabitEthernet0/1.1000&#xA; description VLAN_PPPoE&#xA; encapsulation dot1Q 1000&#xA; pppoe enable group PPPOE_SERVER&#xA; ip policy route-map toallot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I implemented this on Imagestream Routers but never on Cisco. Is there any other way to achieve this or PBR is the only way ? Anyone could help me to discover what is going wrong with this pbr config?&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="775" LastEditDate="2013-11-27T18:42:30.520" LastActivityDate="2013-11-27T18:42:30.520" Title="Force fraffic between PPPoE users to pass through traffic management device" Tags="|cisco|routing|troubleshooting|pppoe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5199" PostTypeId="2" ParentId="5196" CreationDate="2013-11-27T16:36:06.823" Score="6" Body="&lt;p&gt;If you are using a Cisco PIX 6.2(2) and later or ASA 7.0 and later as your firewall you can do the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create an object-group service, but don't specify tcp-udp after you name it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you hit enter you will be able to use the service-object command to define what udp, tcp, or tcp-udp ports you want, as well as if it is a source or destination port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can use that object-group after your permit/deny command when you create your ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I setup in my lab:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group service LabTest&#xA;     service-object udp destination eq domain&#xA;     service-object tcp-udp destination eq www&#xA;&#xA;access-list TestACL extended permit object-group LabTest any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you do a &quot;show access-list TestACL&quot; the following will show:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list TestACL line 1 extended permit object-group LabTest any any (hitcnt=0) &#xA;access-list TestACL line 1 extended permit udp any any eq domain (hitcnt=0) &#xA;access-list TestACL line 1 extended permit tcp any any eq www (hitcnt=0) &#xA;access-list TestACL line 1 extended permit udp any any eq www (hitcnt=0) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;since my service-object for destination www was tcp-udp it created 2 lines in my ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used the following link to help create my lab:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800d641d.shtml&quot;&gt;Using and Configuring PIX/ASA/FWSM Object Groups&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3322" LastEditorUserId="3322" LastEditDate="2013-11-27T17:13:28.523" LastActivityDate="2013-11-27T17:13:28.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5200" PostTypeId="5" CreationDate="2013-11-27T16:48:43.577" Score="0" Body="&lt;p&gt;To be on-topic for the site, best practice questions &lt;em&gt;are strongly encouraged to include&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;A statement summarizing the business need&lt;/em&gt;: Networks cost money, and money comes from supporting a business.  If we understand something about the business traffic that the network carries, we get much closer to understanding the tradeoffs the OP might be facing&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;A description of what alternatives the OP has  considered and why the OP is stuck&lt;/em&gt;: If the OP hasn't done enough research to tell us at least one possible solution to some problem, I argue that the OP is not ready to crowd-source the question on Stack Exchange. [Stack Overflow] members frequently summarize this by asking &quot;What have you already tried?&quot;.  I think this is relevant to best practice questions because it gives us some idea of what the OP wants and doesn't want.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Best practice questions &lt;em&gt;should&lt;/em&gt; include (where relevant &amp;amp; possible):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Specific information about HW Models, Firmware levels&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Topology Diagram&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Device configuration excerpts&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="775" LastEditDate="2013-11-27T18:03:04.700" LastActivityDate="2013-11-27T18:03:04.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5201" PostTypeId="4" CreationDate="2013-11-27T16:48:43.577" Score="0" Body="For questions regarding industry methods or techniques that have shown superior results and are accepted as a de facto standard, or have been formally established." OwnerUserId="3191" LastEditorUserId="775" LastEditDate="2013-11-27T18:01:27.300" LastActivityDate="2013-11-27T18:01:27.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5202" PostTypeId="2" ParentId="5198" CreationDate="2013-11-27T17:06:38.557" Score="2" Body="&lt;p&gt;The policy has to be attached to the individual PPP interface(s), i.e. the virtual-template or dialer that's cloned for each virtual-access interface. G0/1.1000 has no IP protocol running on it, so the policy does nothing.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-11-27T17:06:38.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5203" PostTypeId="1" AcceptedAnswerId="5206" CreationDate="2013-11-27T17:33:47.250" Score="5" ViewCount="731" Body="&lt;p&gt;I am deploying a new Cisco WS-C4510R+E unit in an IDF. We have an existing C4510R+E in our main data center room (core switch), and I need to connect the new 4510 to the core one. I'd like to use the 10G interfaces on the sup's (both 4510's have Sup-7E's in them) but am guessing that I need to use a fiber pair in each sup for redundancy's sake, e.g.&lt;img src=&quot;https://i.stack.imgur.com/gHvbq.jpg&quot; alt=&quot;fiber pairs into sups&quot; /&gt; since the sup's are in SSO mode.&lt;/p&gt;&#xA;&lt;p&gt;My question is if this is an OK design, what are the possible pitfalls (say if a sup blows, how long before the link fails over) etc. I've never used the int's in a sup before to interconnect, so apologies for my ignorance...&lt;/p&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="85" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-08-23T20:40:05.300" Title="Cisco 4510R+E: Can I safely use SFP interfaces on the dual sup's to interconnect switches?" Tags="|cisco|switch|redundancy|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5205" PostTypeId="2" ParentId="5203" CreationDate="2013-11-27T19:43:46.863" Score="2" Body="&lt;p&gt;Yes, there is nothing wrong with your design and it will work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as your failover is concerned:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since your links are L2 your failover will operate as fast as you tune them to failover. I would recommend leveraging the &quot;backbonefast&quot; feature for your failover between the two switches. &lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-11-27T19:43:46.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5206" PostTypeId="2" ParentId="5203" CreationDate="2013-11-27T20:55:49.317" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is if this is an OK design, what are the possible pitfalls&#xA;  (say if a sup blows, how long before the link fails over)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This design seems fine if you don’t have any dedicated 10G uplink modules. You just need to remember that your supervisor cards will go down more than any other cards on your chassis for software upgrades. Those upgrades depend on your organization; so in most cases, this could not even be an issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As John Kennedy mentioned, STP with BackboneFast/UplinkFast (given your using PVST+) is a must if you want to use STP to reconverge the failure in a reasonable time-frame. This will effectively take a 50 second outage to less than 30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think a more elegant solution would be to put these links into an Etherchannel. Since you’re running SSO, all LACP/PAgP information will be synchronized across both supervisors in near realtime. This would also allow you to utilize a 20Gb path, as opposed to a single 10Gb with one in standby.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2013-11-27T20:55:49.317" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5209" PostTypeId="1" CreationDate="2013-11-28T03:33:06.203" Score="1" ViewCount="567" Body="&lt;p&gt;In BGP, TCP handles the checksum and BGP does not perform any checksum validation in the application level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can we believe TCP must forward the data without errors?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly in RIP with UDP case?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="775" LastEditDate="2013-11-28T12:10:24.927" LastActivityDate="2013-11-28T15:37:11.877" Title="Why do not we have checksum validation in the application Level (BGP , RIP)?" Tags="|bgp|tcp|protocol-theory|rip|checksum|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5211" PostTypeId="2" ParentId="362" CreationDate="2013-11-28T04:40:16.197" Score="-1" Body="&lt;p&gt;Use may use NOC, &lt;a href=&quot;http://nocproject.org&quot; rel=&quot;nofollow&quot;&gt;NOC Project&lt;/a&gt; it's the scalable, high-performance and open-source OSS system for ISP. You can easily add VLAN's through the entire network.&lt;/p&gt;&#xA;" OwnerUserId="1315" LastActivityDate="2013-11-28T04:40:16.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5212" PostTypeId="2" ParentId="5209" CreationDate="2013-11-28T05:43:16.167" Score="2" Body="&lt;p&gt;Allow me to quote Mr. Jeff Doyle&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Like EGP, BGP forms a unique, unicast-based connection to each of its BGP-speaking peers. To increase the reliability of the peer connection, BGP uses TCP (port 179) as its underlying delivery mechanism.  The update mechanisms of BGP are also somewhat simplified by allowing the TCP layer to handle such duties as acknowledgment, retransmission and sequencing.  Because BGP rides on TCP, a separate point to-point connection to each peer must be established.” Jeff Doyle - &lt;em&gt;Routing TCP/IP, Volume II&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;On the other hand, another routing protocol OSPF rides on IP (protocol #89). OSPF performs its own delivery mechanism utilizing features like LSAcks and a checksum in the packet header.&lt;/p&gt;&#xA;" OwnerUserId="2231" LastEditorUserId="762" LastEditDate="2013-11-28T15:37:11.877" LastActivityDate="2013-11-28T15:37:11.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5213" PostTypeId="1" CreationDate="2013-11-28T05:48:19.927" Score="3" ViewCount="914" Body="&lt;p&gt;Question about pages 17 and 18, of 49, at &lt;a href=&quot;http://www.nanog.org/meetings/nanog45/presentations/Sunday/RAS_traceroute_N45.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.nanog.org/meetings/nanog45/presentations/Sunday/RAS_traceroute_N45.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is mentioned that prefixes and numbers in DNS (when doing traceroute) are specific to each vendor of network equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example is given of making sense of &lt;code&gt;xe-11-1-0.edge1.NewYork1.Level3.net&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;XE-#/#/# is Juniper 10GE port. The device has at least 12 slots.&lt;/li&gt;&#xA;  &lt;li&gt;It’s at least a 40G/slot router since it has a 10GE PIC in slot 1&lt;/li&gt;&#xA;  &lt;li&gt;It must be Juniper MX960, no other device could fit this profile.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How exactly does this work?  Do vendors provide special tools for generating and managing DNS records?  Or what is this based upon?&lt;/p&gt;&#xA;" OwnerUserId="296" LastActivityDate="2013-11-28T06:30:50.687" Title="Router equipment and interface info in reverse DNS" Tags="|router|juniper|dns|interface|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5215" PostTypeId="2" ParentId="5213" CreationDate="2013-11-28T06:30:50.687" Score="4" Body="&lt;p&gt;Large networks typically have a configuration management database (CMDB) software which will automatically generate DNS entries based on the networking equipment in that database. Smaller networks will configure DNS by hand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are no rules on how DNS labels must be named, the scheme mentioned in the presentation is just one which is commonly used, but there are lots of variations on this and also networks which choose a completely different naming scheme.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-11-28T06:30:50.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5216" PostTypeId="2" ParentId="5095" CreationDate="2013-11-28T06:32:39.477" Score="2" Body="&lt;p&gt;Based on what you describe and tested I'd expect the slot on the chassis to be broken. &lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-11-28T06:32:39.477" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5217" PostTypeId="1" AcceptedAnswerId="5218" CreationDate="2013-11-28T11:03:21.943" Score="6" ViewCount="5495" Body="&lt;p&gt;I have an issue with an FWSM apparently killing RDP sessions after a random amount of time, and the log entry looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Teardown TCP connection 145379776990678860 for MS_LZ1:10.30.3.150/49924 to LZ1_MS:10.254.0.217/3389 duration 0:01:58 bytes 705828 TCP Reset-I&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand that &quot;TCP Reset-I&quot; means that a TCP Reset was received on the 'inside' interface, but in this particular firewall, both interfaces are security-level 0. Which one is the inside?&lt;/p&gt;&#xA;" OwnerUserId="2639" LastEditorUserId="775" LastEditDate="2013-11-28T12:05:45.510" LastActivityDate="2013-11-28T12:21:51.947" Title="Cisco ASA: which side is &quot;inside&quot; with same security-level?" Tags="|cisco|cisco-asa|firewall|acl|pix|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5218" PostTypeId="2" ParentId="5217" CreationDate="2013-11-28T12:05:21.930" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I understand that &quot;TCP Reset-I&quot; means that a TCP Reset was received on the 'inside' interface, but in this particular firewall, both interfaces are security-level 0. Which one is the inside?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I have been looking at the PIX and FWSM docs for the last 30 minutes.  I could not find a source that clearly stated how the PIX / FWSM behaves in this situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I don't think there is a way to know with 100% certainty without a &lt;a href=&quot;https://networkengineering.stackexchange.com/a/5147/775&quot; title=&quot;Capture on the PIX or FWSM&quot;&gt;packet capture&lt;/a&gt; to find the source of the reset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI, &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa71/command/reference/s2_711.html#wp1117924&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;TCP Reset-I: This reason is given for closing an outbound flow (from a low-security interface to a same- or high-security interface) when a TCP reset is received on the flow.&quot;&gt;Cisco ASA flow-drop rules&lt;/a&gt; say that &lt;code&gt;TCP Reset-I&lt;/code&gt; is used for same-security traffic; since the FWSM and ASA are so close, I think it's a strong possibility that the syslogs simply don't give you enough information in this case.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-11-28T12:21:51.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5219" PostTypeId="1" AcceptedAnswerId="5220" CreationDate="2013-11-28T12:26:43.187" Score="1" ViewCount="4094" Body="&lt;p&gt;The Cisco SG300-10 says its forwarding rate is 14.88Mpps with 64 byte packets. I estimated this to be ~ 7 Gb/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this mean that up to 7 computers can transfer data across VLANs at full 1 Gb/s wirespeed (assuming 64 byte) packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How will this vary with packet size? What kind of actual throughput can I expect when multiple computers are transferring files using SMB across VLANs?&lt;/p&gt;&#xA;" OwnerUserId="1807" LastEditorUserId="1807" LastEditDate="2016-11-03T07:21:24.760" LastActivityDate="2016-11-03T07:21:24.760" Title="Routing throughput of an L3 switch" Tags="|routing|switch|vlan|throughput|layer3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5220" PostTypeId="2" ParentId="5219" CreationDate="2013-11-28T12:42:35.663" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The Cisco SG300-10 says its forwarding rate is 14.88Mpps with 64 byte packets. I estimated this to be ~ 7 Gb/s.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Does this mean that up to 7 computers can transfer data across VLANs at full 1 Gb/s wirespeed (assuming 64 byte) packets?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Why would you ever send line-rate 64 byte packets in any scenario other than a switch drag-race?  That said, cisco's data sheet numbers indicate it can do unidirectional 64-byte line rate for at least seven computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming you understand that ethernet's IFG and SFD mean that you get nowhere near 1Gbps of real data @ 64 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using FTP, HTTP, CIFS/SMB, H.264 or any other protocol used for data transfer, then yes 7 computers can do bi-directional line-rate based on Cisco's quoted 14.88Mpps and 20Gbps of &quot;bandwidth&quot; in the &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps10898/data_sheet_c78-610061.html&quot; rel=&quot;nofollow&quot;&gt;data sheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How will this vary with packet size? What kind of actual throughput can I expect when multiple computers are transferring files using SMB across VLANs?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Under normal circumstances the SMB protocol is not limited by the network.  It's limited by how fast you can unspool data from your server's disk.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;does it do wirespeed intervlan routing? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes up to 14.88 Mpps&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-11-28T14:14:14.420" LastActivityDate="2013-11-28T14:14:14.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5224" PostTypeId="2" ParentId="5" CreationDate="2013-11-29T00:16:37.123" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to encrypt OSPF?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;OSPFv2 only supports &lt;strong&gt;authentication&lt;/strong&gt;. You can still see the LSAs payload even if you use authentication. The only thing authentication does is authenticate neighbors. There is &lt;strong&gt;no payload&lt;/strong&gt; encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;RFC 4552:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;OSPF (Open Shortest Path First) Version 2 defines the fields AuType and Authentication in its protocol header to provide security.&#xA;  In OSPF for IPv6 (OSPFv3), both of the authentication fields were removed from OSPF headers.  OSPFv3 relies on the IPv6 Authentication Header (AH) and IPv6 Encapsulating Security Payload (ESP) to provide integrity, authentication, and/or confidentiality.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, if &lt;strong&gt;OSPFv3&lt;/strong&gt; we can ecrypt entire packet by IPSec.&lt;/p&gt;&#xA;" OwnerUserId="1315" LastActivityDate="2013-11-29T00:16:37.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5227" PostTypeId="1" AcceptedAnswerId="5228" CreationDate="2013-11-29T04:56:03.233" Score="12" ViewCount="1779" Body="&lt;p&gt;I am having a small question regarding Ethernet Frame Header Length.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per my knowledge Ethernet Header size is 18 bytes without VLAN tag and 22 bytes if there is a VLAN tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in Wireshark capture I am getting only 14 bytes without VLAN tag and 18 bytes with VLAN tag . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that there was a missing &lt;code&gt;checksum&lt;/code&gt; field in my capture?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happened in this case?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="762" LastEditDate="2013-11-29T18:07:35.017" LastActivityDate="2013-11-29T18:10:55.750" Title="Why can't we find Ethernet checksum in Wireshark?" Tags="|ethernet|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5228" PostTypeId="2" ParentId="5227" CreationDate="2013-11-29T07:12:35.477" Score="16" Body="&lt;p&gt;On most hardware/platforms, the Ethernet checksum is handled by the NIC before it's passed up to Wireshark. There's no way (or really any reason) to pass this up to higher layers because of the fact that the NIC does this in hardware, unless you've coded the hardware/driver to behave this way. Refer to &lt;a href=&quot;http://wiki.wireshark.org/Ethernet&quot;&gt;the Ethernet wiki on wiki.wireshark.org&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-11-29T18:10:55.750" LastActivityDate="2013-11-29T18:10:55.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5230" PostTypeId="2" ParentId="5093" CreationDate="2013-11-29T08:48:13.300" Score="3" Body="&lt;p&gt;It depends to which mechanism you are using, and yes the Cwnd keep increasing till your first packet drop happens, you can read more about slow start and other mechanism in the links below. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Slow-start&quot; rel=&quot;nofollow&quot;&gt;Wikipedia: TCP Slow Start&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Basic slow-start[edit]&#xA;  The algorithm begins in the exponential growth phase initially with a Congestion Window Size (CWND) of 1, 2 or 10[2] segments and increases it by one Segment Size (SS) for each new ACK received. If the receiver sends an ACK for every segment, this behavior effectively doubles the window size each round trip of the network. If the receiver supports delayed ACKs, the rate of increase is lower, but still increases by a minimum of one MSS each round-trip time. &lt;strong&gt;This behavior continues until the congestion window size (CWND) reaches the size of the receiver's advertised window or until a loss occurs.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/TCP_congestion-avoidance_algorithm&quot; rel=&quot;nofollow&quot;&gt;Wikipedia: TCP Congestion Avoidance Algorithm&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3286" LastEditorUserId="3286" LastEditDate="2013-11-29T10:55:53.647" LastActivityDate="2013-11-29T10:55:53.647" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5231" PostTypeId="2" ParentId="5095" CreationDate="2013-11-29T09:40:53.230" Score="-1" Body="&lt;p&gt;Try swapping the Sup Cards and see which will come up. If the primary one works in the slot of the backup, then you will have to RMA the device.&lt;/p&gt;&#xA;" OwnerUserId="3377" LastActivityDate="2013-11-29T09:40:53.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5232" PostTypeId="2" ParentId="4988" CreationDate="2013-11-29T11:49:47.487" Score="5" Body="&lt;p&gt;This might answer you question.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When MU-MIMO becomes available, the antennas should be &#xA;  more relevant. While a single client with one or two antennas &#xA;  would not be able to fully utilize eight spatial streams offered &#xA;  by an 8x8:8 11ac AP, it’s possible for several Wi-Fi clients to &#xA;  share a larger pool of streams and antennas, so that overall &#xA;  aggregate throughput improves for the client population. &#xA;  Early demonstrations of a single-stream 11ac radio, mounted &#xA;  in smartphone prototypes, have delivered approximately &#xA;  220Mbps in a fairly challenging environment. The faster the &#xA;  handset can transmit its loads, the better its battery life, &#xA;  because faster devices spend less time transmitting and more &#xA;  time “sleeping.” &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Source &lt;a href=&quot;http://www.motorolasolutions.com/web/Business/_Documents/White%20Paper/_Static%20files/80211ac_White_Paper_0712-web.pdf&quot; rel=&quot;noreferrer&quot;&gt;WHAT YOU NEED &#xA;TO KNOW ABOUT &#xA;802.11AC&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3286" LastActivityDate="2013-11-29T11:49:47.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5236" PostTypeId="1" CreationDate="2013-11-29T19:16:53.537" Score="4" ViewCount="38661" Body="&lt;p&gt;I'm doing some experiments and I want to know if it is possible to connect two VLANs on a single switch by using just a cable between one group of ports and the other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to simulate (using only one physical switch) two independent switches connected together by a fiber cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using per-port based VLANs and my current setup is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 1: ports 1-24,49 &lt;/li&gt;&#xA;&lt;li&gt;VLAN 2: ports 25-48,50&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I want to connect these VLANs using a cable from port 49 to port 50. Both of these VLANs are supposed to be in the subnet 10.128.0.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connecting the cable didn't work. Googling for it I found some articles that told me I needed a router between the VLANs, but the examples showed VLANs on different subnets. If I really need a router, can I use the routing capabilities of my switch (it's an L3 switch)? If yes, how? I have no background on CLI programming, but have a basic understanding of networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[update]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry if I have not made myself clear. Some clarifications:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch is an Arista 7048T-A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I say it didn't work, I mean that a computer on VLAN 1 can't ping a computer on VLAN 2, even though those VLANs are connected to each other through a cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding was that creating VLANs would effectively separate the address learning of the ports, but according to mellowd's answer, I was wrong. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mentioned CLI because maybe there would be some obvious recipe to follow or some misconfiguration to fix, as obviously I'm not experienced with network equipment. Also, I was naive enough to think that CLI was kind of standardized between equipment, but again I was wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to do it because I want to make computer A send traffic to the switch (via 1G copper cable) and have this traffic pass through the fiber (10G) before being delivered to computer B (also 1G copper). Neither computer has an optical interface (yet). If I had two switches I could just connect them with a fiber and have a computer on each one. As I don't, I was looking for a way to do it with the switch that I have. I want to test the latency of the traffic going through the fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I may get the terminology wrong, but the main question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to have two separate VLANs on the same switch with the same address space and make them comunicate with one cable between them, as if they were two distinct switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following the question:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If yes, how?&lt;/li&gt;&#xA;&lt;li&gt;If no, why? Is the VLAN approach wrong? Is there another way to route the traffic as described?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3382" LastEditorUserId="3382" LastEditDate="2013-11-30T00:42:18.297" LastActivityDate="2015-08-06T01:20:28.500" Title="Connecting two VLANs together on a single switch" Tags="|vlan|" AnswerCount="6" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5237" PostTypeId="2" ParentId="5236" CreationDate="2013-11-29T19:42:08.543" Score="2" Body="&lt;p&gt;You could do this, but you run into all kinds of problems with spanning-tree. Your ports could go into err-disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You won't have two separate switches though. The single switch still learns MAC addresses on a port and vlan and that is switch-wide&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2013-11-29T19:42:08.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5238" PostTypeId="2" ParentId="5236" CreationDate="2013-11-29T19:43:32.347" Score="1" Body="&lt;p&gt;As others have commented above, having the vendor of your switch would be useful. In addition, the reasons why you're attempting to simulate two different switches with a single switch is unclear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your VLANs are representative of the same subnet, you'd need to use a trunk to interconnect the VLANs. This should be possible (although highly unlikely that it would actually work) with a single cable, and configuring each port that the cable connects to as a VLAN trunk (best practices typically dictate IEEE 802.1Q for this) will be required, in addition to allowing each VLAN across the trunk. Again, best practices would dictate, however, that you should have separate subnets that each VLAN would represent, and then configure Layer 3 interfaces for each VLAN.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-11-29T19:43:32.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5249" PostTypeId="1" AcceptedAnswerId="5256" CreationDate="2013-11-30T06:08:08.183" Score="0" ViewCount="893" Body="&lt;p&gt;NetBIOS can't be passed through VPNs at all correct? And you have to run a DNS or WINS server for name lookups and network discovery to work correct? Or does it depend on the VPN type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been doing some reading and I am trying to wrap my head around how Windows Machines see each other over networks whether its site-to-site or client-to-site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VPN operates on the same local network 192.168.50.x&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="2349" LastEditDate="2013-11-30T15:18:10.607" LastActivityDate="2013-11-30T18:38:08.417" Title="VPNs and NetBIOS" Tags="|cisco|vpn|ipsec|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5250" PostTypeId="2" ParentId="5249" CreationDate="2013-11-30T08:01:58.800" Score="0" Body="&lt;p&gt;It does depend on the VPN type, or more accurately the layer that the VPN operates at, and for NetBIOS how the networking is configured since NetBIOS doesn't cross broadcast domains.&lt;/p&gt;&#xA;" OwnerUserId="3387" LastActivityDate="2013-11-30T08:01:58.800" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5251" PostTypeId="2" ParentId="5236" CreationDate="2013-11-30T09:20:10.313" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm doing some experiments and I want to know if it is possible to&#xA;  connect two VLANs on a single switch by using just a cable between one&#xA;  group of ports and the other.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I suppose this is theoretically possible, although what you are trying to accomplish is exactly what VLAN separation sets out to resolve, layer 2 separation.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My goal is to simulate (using only one physical switch) two&#xA;  independent switches connected together by a fiber cable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In all reality, you’re probably better off getting another switch. One can be procured for a relatively cheap price. The route you’re trying to take doesn’t really make any sense. In a production environment, a VLAN on one switch that’s connected to another switch is going to look almost identical to what it looks like on the first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My biggest question would be “what are you trying to prove?”&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you’re just trying to figure out what VLANs will look like on a switch, then setup a switch and put a single VLAN on there.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to have two separate VLANs on the same switch with the&#xA;  same address space and make them comunicate with one cable between&#xA;  them, as if they were two distinct switches?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Again, while this is theoretically possible, you’re trying to sidestep VLAN separation to accomplish a test bed setup that will never reflect a &lt;strong&gt;real&lt;/strong&gt; network.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If no, why? Is the VLAN approach wrong? Is there another way to route&#xA;  the traffic as described?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think this approach is a little off. VLANs, in their simplest form, are simple to configure and associate with their respective ports. You mentioned that this is a L3 switch, configure some switched virtual interfaces (SVI), put the VLANs on different subnets, and route between the VLANs.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2013-11-30T09:20:10.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5253" PostTypeId="1" CreationDate="2013-11-30T18:11:08.867" Score="6" ViewCount="804" Body="&lt;p&gt;Does any standard IPv6 protocol has anything analogous to an ICMP timestamp message?&lt;/p&gt;&#xA;" OwnerUserId="296" LastActivityDate="2013-11-30T20:15:05.650" Title="IPv6 replacement for ICMP timestamp" Tags="|ipv6|icmp|icmpv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5256" PostTypeId="2" ParentId="5249" CreationDate="2013-11-30T18:38:08.417" Score="1" Body="&lt;p&gt;unless you have a very small network you have to run WINS anyway as NETBUI (the non IP NetBIOS is a L2 protocol only. You could extend this over a VPN by using (SRB) source route bridging (it puts the L2 protocol in a special tunnel) and then run it over a VPN. Or if you build your VPN by encrypting a GRE tunnel (DMVPN) does this, or use an GRE tunnel and IPSEC transport mode that will also work, based on your statement that the network is the same subnet GRE with IPSEC transport mode will work.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-11-30T18:38:08.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5257" PostTypeId="2" ParentId="5183" CreationDate="2013-11-30T19:42:03.997" Score="2" Body="&lt;p&gt;Complexity is reason enough to use a simpler option if one is available. In this case, I'd recommend connecting each firewall to only one router and one Internet connection. &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/ipapp_fhrp/configuration/12-4/fhp-glbp.html&quot; rel=&quot;nofollow&quot;&gt;GLBP&lt;/a&gt; would then be used for load balancing/fail-over. Tie GLBP to an &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4/ip_sla/configuration/guide/hsicmp.html&quot; rel=&quot;nofollow&quot;&gt;IP SLA monitor&lt;/a&gt; for the Internet connection the router provides access to and you're finished.&lt;/p&gt;&#xA;" OwnerUserId="1081" LastActivityDate="2013-11-30T19:42:03.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5258" PostTypeId="2" ParentId="5253" CreationDate="2013-11-30T20:15:05.650" Score="5" Body="&lt;p&gt;As far as I can read in the ICMP codes, there is no equivalent within ipv6. Below you can find &lt;a href=&quot;http://pic.dhe.ibm.com/infocenter/zos/v1r12/index.jsp?topic=/com.ibm.zos.r12.halu101/icmp.htm&quot; rel=&quot;noreferrer&quot;&gt;a table&lt;/a&gt; showing all possible ICMPv6 codes.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/pRt22.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-11-30T20:15:05.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5261" PostTypeId="1" AcceptedAnswerId="5262" CreationDate="2013-11-30T23:23:20.843" Score="3" ViewCount="699" Body="&lt;p&gt;I know that the frames having size greater than the MTU size should be dropped . i.e, The Ethernet frame &lt;code&gt;having size more than 1522&lt;/code&gt; should be dropped .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my doubt here is what is Jumbo Frame ?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastActivityDate="2013-12-01T00:08:00.180" Title="What is meant by Jumbo frame ? what happen when a frame size is greater than the MTU size?" Tags="|ethernet|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5262" PostTypeId="2" ParentId="5261" CreationDate="2013-12-01T00:08:00.180" Score="10" Body="&lt;p&gt;Jumbo means any frame with an MTU greater than the 802.3 spec of 1500.  There is no set, specified number. It is a generally accepted spec to support &quot;9000&quot;, but each manufacturer is free to call &quot;jumbo&quot; whatever they wish. (I've seen some as low as 5k (realtek) and others as high as 16k (broadcom))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IEEE refuses to add it because it breaks backwards compatibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there's no &quot;should&quot; about it.  A frame larger than the set max &lt;strong&gt;will&lt;/strong&gt; be dropped by the NIC -- it's an &lt;em&gt;error&lt;/em&gt;, and the OS will never know about it. (an oversized frame counter will click up, but that's all.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-01T00:08:00.180" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5263" PostTypeId="1" CreationDate="2013-12-01T06:55:04.540" Score="8" ViewCount="20121" Body="&lt;p&gt;Can anyone explain why the ethernet payload size is fixed between 46 and 1500 bytes ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read so many articles never get the clarification?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="775" LastEditDate="2019-04-08T00:22:22.607" LastActivityDate="2019-06-02T21:04:05.520" Title="Why is the ethernet payload fixed between 46 and 1500 bytes?" Tags="|ethernet|protocol-theory|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="5264" PostTypeId="2" ParentId="5263" CreationDate="2013-12-01T13:03:41.437" Score="11" Body="&lt;h3&gt;The reason for 46 byte payloads:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;According to paragraph 6.3.2.3 of the &lt;a href=&quot;http://www.pennington.net/archives/ethernet/Ethernet_Version_2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethernet V2 Spec&lt;/a&gt;, the minimum ethernet frame is based on the &lt;a href=&quot;http://en.wikipedia.org/wiki/Slot_time&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethernet Slot Time&lt;/a&gt;, which is 512 bit lengths (64 Bytes) for 10M ethernet.  Slot time governs both maximum cable length and minimum frame size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After subtracting 18 bytes for the ethernet header and CRC, you get 46 bytes of Ethernet payload as the minimum payload size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Slot time (and thus the minimum frame size) is also closely related to Ethernet collision detection.  Quoting &lt;a href=&quot;http://intronetworks.cs.luc.edu/1/html/ethernet.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;An Introduction to Computer Networks&lt;/a&gt;, paragraph 2.1.2:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;... a collision can be received, in principle, at any point up until the end of the slot time. As a result, Ethernet has a minimum packet size, equal to the slot time, ie 64 bytes (or 46 bytes in the data portion). A station transmitting a packet this size is assured that if a collision were to occur, the sender would detect it (and be able to apply the retransmission algorithm, below). Smaller packets might collide and yet the sender not know it, ultimately leading to greatly reduced throughput&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ethernet Slot Time was specified so CSMA/CD would correctly function.  The minimum size of a frame is defined to make sure that its transmission takes enough time so that even with a shortest valid frame, a possible collision can be reliably detected; if the frame size is too small (with respect to the maximum cable length), &lt;a href=&quot;https://community.cisco.com/t5/switching/slot-time-and-minimum-ethenet-fame-size/td-p/2797341&quot; rel=&quot;nofollow noreferrer&quot;&gt;deterministic collision detection would be impossible&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;1500 byte payloads:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;We have already discussed &lt;a href=&quot;https://networkengineering.stackexchange.com/q/2962/775&quot;&gt;the reason for 1500 byte MTUs&lt;/a&gt;; please refer to that question for specifics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: ytti's comment about the FCS limitation of ethernet is not the reason that 1500 bytes was chosen.  It was chosen due to issues with interpreting the Length field in 802.3 encap frames vs the Type field in Ethernet II frames.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2019-06-02T21:04:05.520" LastActivityDate="2019-06-02T21:04:05.520" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="5270" PostTypeId="1" AcceptedAnswerId="5296" CreationDate="2013-12-02T12:55:49.720" Score="5" ViewCount="2533" Body="&lt;p&gt;I have a Cisco ASA 5510 connecting our office via 2Mbit/s Internet. When Internet link fills up, latency to a well-connected host on Internet goes from 5-8 ms to 500-800 ms. With ping, it may look something like this (TCP performance seems to match this):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;64 bytes from X: icmp_req=242 ttl=59 time=450 ms&#xA;64 bytes from X: icmp_req=243 ttl=59 time=458 ms&#xA;64 bytes from X: icmp_req=244 ttl=59 time=495 ms&#xA;64 bytes from X: icmp_req=245 ttl=59 time=186 ms&#xA;64 bytes from X: icmp_req=246 ttl=59 time=103 ms&#xA;64 bytes from X: icmp_req=247 ttl=59 time=5.18 ms&#xA;64 bytes from X: icmp_req=248 ttl=59 time=4.94 ms&#xA;64 bytes from X: icmp_req=249 ttl=59 time=4.65 ms&#xA;64 bytes from X: icmp_req=250 ttl=59 time=4.85 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I assume this is because large send queues on the 2 Mbit link. Since this is mainly office IT (from &amp;lt; 20 ppl), lateny is more important than throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I measure how this latency is divided between outbound and inbound leg? If it turns out to be generated equally or mostly on inbound traffic, can I affect that (i.e. ingress throttling) or do I have to contact my ISP? How best to achieve this on ASA 8.2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: Short topolgy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ping node -[gbit]-&amp;gt;&#xA;  ProCurve dist -[gbit]-&amp;gt;&#xA;    ProCurve core -[gbit]-&amp;gt;&#xA;      ASA -[100 mbit]-&amp;gt;&#xA;        DSL -[copper]-&amp;gt;&#xA;          upstream&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASA interface upstream:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa# show interface Ethernet 0/3&#xA;Interface Ethernet0/3 &quot;outside&quot;, is up, line protocol is up&#xA;Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec&#xA;    Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)&#xA;    Input flow control is unsupported, output flow control is off&#xA;    Description: ### Upstream ###&#xA;    MAC address X, MTU 1500&#xA;    IP address X, subnet mask 255.255.255.252&#xA;    3480433364 packets input, 2625479988848 bytes, 0 no buffer&#xA;    Received 1010728 broadcasts, 0 runts, 11 giants&#xA;    11 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;    0 pause input, 0 resume input&#xA;    0 L2 decode drops&#xA;    3160567056 packets output, 1537515646562 bytes, 0 underruns&#xA;    0 pause output, 0 resume output&#xA;    0 output errors, 0 collisions, 15 interface resets&#xA;    0 late collisions, 0 deferred&#xA;    6 input reset drops, 0 output reset drops, 0 tx hangs&#xA;    input queue (blocks free curr/low): hardware (255/240)&#xA;    output queue (blocks free curr/low): hardware (255/109)&#xA;Traffic Statistics for &quot;outside&quot;:&#xA;    3487933998 packets input, 2561681053821 bytes&#xA;    3160334264 packets output, 1477359288037 bytes&#xA;    57746233 packets dropped&#xA;  1 minute input rate 193 pkts/sec,  209755 bytes/sec&#xA;  1 minute output rate 122 pkts/sec,  12734 bytes/sec&#xA;  1 minute drop rate, 1 pkts/sec&#xA;  5 minute input rate 177 pkts/sec,  174578 bytes/sec&#xA;  5 minute output rate 131 pkts/sec,  17600 bytes/sec&#xA;  5 minute drop rate, 2 pkts/sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3400" LastEditorUserId="775" LastEditDate="2013-12-03T12:55:08.503" LastActivityDate="2013-12-03T12:55:08.503" Title="How to reduce latency on ASA 5510 WAN link?" Tags="|cisco|ipv4|cisco-asa|latency|h-qos|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5271" PostTypeId="1" AcceptedAnswerId="5274" CreationDate="2013-12-02T13:04:24.547" Score="6" ViewCount="3382" Body="&lt;p&gt;I am trying to create a policy-statement to prepend the local AS number 5 times (assuming it is AS1234) before advertising local routes up to a new upstream transit provider (no inbound traffic is desired via this upstream). MED and communities are not available here (and out of the scope of this question). The policy I originally wrote looked like this;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  policy-statement PS-AS-Prepend-x5 {&#xA;     from {&#xA;         route-filter 0.0.0.0/0 orlonger;&#xA;     }&#xA;     to protocol bgp;&#xA;      then {&#xA;          as-path-prepend &quot;1234 1234 1234 1234 1234&quot;;&#xA;          accept;&#xA;      }&#xA;  }&#xA;&#xA;  protocols {&#xA;      bgp {&#xA;        group new-upstream {&#xA;        type external;&#xA;        export [ PS-AS-Prepend-x5 ];&#xA;      }&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The upstream has a looking glass on which I can see that when performing something akin to &quot;show ip bgp prefix/mask&quot; they are only seeing one AS in the path to this route (and all routes advertised). I changed the policy-statement as follows;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  policy-statement PS-AS-Prepend-x5 {&#xA;     to protocol bgp;&#xA;      then {&#xA;          as-path-prepend &quot;1234 1234 1234 1234 1234&quot;;&#xA;          accept;&#xA;      }&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After resetting the BGP session the same behaviour as before was still occuring, no prepends. My question is two fold;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Do you need a &quot;from&quot; clause in a policy-statement?&lt;/strong&gt; I used 0/0 in the original statement as only local prefixes are being advertised so rather than writing them all out I used 0/0 to match them all. I have been search on-line documentation but haven't found anything definitive. This is why removed the &quot;from&quot; clause to try and match all prefixes that way. I also tried &lt;code&gt;to protocol bgp&lt;/code&gt; but this too failed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I now suspect the syntax of the policy-statment is not the problem so my second question is &lt;strong&gt;Can you pre-pend your own AS on advertisements in JUNOS to eBGP peers?&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;me@r1# run show route advertising-protocol bgp 11.22.33.44 detail &#xA;&#xA;inet.0: 471821 destinations, 512598 routes (471815 active, 0 holddown, 12 hidden)&#xA;* 123.0.0.0/8 (3 entries, 1 announced)&#xA; BGP group new-upstream type Externa&#xA;     Nexthop: Self&#xA;     AS path: [1234] I&#xA;     Communities: 1234:1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2013-12-02T21:53:40.957" LastActivityDate="2013-12-02T21:53:40.957" Title="Junos: Policy-Statment and AS-Prepends" Tags="|bgp|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5272" PostTypeId="1" AcceptedAnswerId="5273" CreationDate="2013-12-02T13:11:48.877" Score="6" ViewCount="198" Body="&lt;p&gt;I recently took over managing my church's IT resources. Previously it was managed by nobody and so was subject to any random person or vendor's half-baked idea for building out the network. Right now we have a wired network and a wireless network on separate partitions; the wireless one is for public use and the wired is for our actual work network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The biggest problem right now is that anybody with an ethernet cable can plug in to any port and get instant access to our internet connection and any unsecured resources on the network, including printers, non-password-protected shares, domain directory listings, etc. I've tried to look up some information on this but apparently I don't know the right terminology and so haven't found much of anything helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are my options for locking down our wired network so that users who don't log in to the domain can't access any of these things? (If it's of relevance, our server is running Windows Server 2k3 and does contain an Active Directory controller; our network hardware consists of a set of Cisco switches and a Cisco 881 router, which pumps both the wired and wireless network.)&lt;/p&gt;&#xA;" OwnerUserId="3401" LastActivityDate="2013-12-02T22:39:23.767" Title="Help with basic network security issue" Tags="|security|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5273" PostTypeId="2" ParentId="5272" CreationDate="2013-12-02T13:55:07.183" Score="6" Body="&lt;p&gt;There are a couple of options for you, depending on how much money and time you want to invest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the complex/high end, you can configure 802.1x authentication so that only domain users can access the wired network.  This involves buying/building a radius server, tying that to your domain controller and configuring the switch to query the radius server whenever a port is connected.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming you have a small network with fewer than 30 users.  I also assume that your &quot;office&quot; users don't move around very much (i.e., their computers are on desks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, a simpler option would be to disable all the unused ports, or configure them for the &quot;guest&quot; network.  Either way, a visitor will not get access to your servers.  The downside, of course, is that when you have new users, or you move furniture around, you will have to reconfigure those ports.  For a small number of infrequent moves, this shouldn't be a burden.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I may move slightly off-topic, I'm willing to bet your biggest security concern isn't really unprotected ethernet ports. People who attack networks usually do so to steal money, so your efforts should be directed at protecting the church's financial assets.  Make sure your online banking is secure and  money can't be transferred out without some sort of verification.  You might also invest in some anti-malware/spam filtering to reduce the chance of inadvertently downloading software designed to steal bank info.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The case of a person plugging into your network in order to steal something isn't very likely to happen.  There are more important threats out there to worry about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for the digression.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2013-12-02T13:55:07.183" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5274" PostTypeId="2" ParentId="5271" CreationDate="2013-12-02T14:29:47.660" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Do you need a &quot;from&quot; clause in a policy-statement?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. You don't. Without a &quot;from&quot; class everything will match.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Can you pre-pend your own AS on advertisements in JUNOS to eBGP peers?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, of course you can, that's the typical way in which AS prepending is being done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the real question is: why doesn't this work? One thing which I'm not sure about is the &lt;code&gt;to protocol bgp&lt;/code&gt; statement, I've never used that in policies for prepending. The best thing to do is verify if you're actually prepending by checking what you're advertising: &lt;code&gt;show route advertising-protocol bgp aaa.bbb.ccc.ddd detail&lt;/code&gt;, where &lt;code&gt;aaa.bbb.ccc.ddd&lt;/code&gt; is the peer IP.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-12-02T14:29:47.660" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5276" PostTypeId="2" ParentId="5270" CreationDate="2013-12-02T15:16:23.897" Score="-1" Body="&lt;p&gt;Judging from your ASA statistics, it does appear that the majority of traffic is on the inbound path.  If you intend to do some sort of policing or shaping, you will have to do it on the far end (i.e., the output of the other side of the WAN). The ASA has no scheduling controls on the input queue, but even if it did, the queue would never fill up because the bottleneck is the WAN link, not your input queue.   &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2013-12-02T15:16:23.897" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5278" PostTypeId="1" AcceptedAnswerId="5281" CreationDate="2013-12-02T17:44:15.450" Score="7" ViewCount="250" Body="&lt;p&gt;In IPv4, newborn LIRs must seek approval from the RIPE NCC before assigning a prefix larger than a &lt;em&gt;certain size&lt;/em&gt; to end users. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As time goes (and RIPE see that you fill in the RIPE database correctly), this &lt;em&gt;certain size&lt;/em&gt; increases upon being big enough for the LIR to assign IP addresses as it wishes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;em&gt;certain size&lt;/em&gt; is called an &lt;strong&gt;assignment window&lt;/strong&gt; (AW) and is not a public information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to gain approval from the RIPE NCC, LIRs willing to assign a prefix bigger than the AW must fill in the appropriate form.&#xA;More information on AW can be &lt;a href=&quot;http://www.ripe.net/ripe/docs/ripe-592#Assignment-Window&quot; rel=&quot;nofollow&quot;&gt;found here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note also that trying to assign several small prefixes to overcome the AW will not work, as AW is valid over a 12 months period. (i.e. you can not assign more than a /XX to end user YYY in 12 months, without asking the RIPE first, neither in &quot;one shot&quot; nor via several smaller assignments.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual question now : while this is perfectly clear for IPv4, I cannot find explicit references to the AW in the &lt;a href=&quot;https://www.ripe.net/ripe/docs/ripe-589&quot; rel=&quot;nofollow&quot;&gt;IPv6 Assignment and Allocation policy&lt;/a&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this mean that there is no AW in IPv6, or that the system is left unchanged (in that case, I cannot find the appropriate form) ?&lt;/p&gt;&#xA;" OwnerUserId="564" LastEditorUserId="564" LastEditDate="2013-12-03T13:36:59.923" LastActivityDate="2013-12-03T13:36:59.923" Title="Is there an Assignment Window (AW) for IPv6 in the RIPE region?" Tags="|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5279" PostTypeId="1" AcceptedAnswerId="5280" CreationDate="2013-12-02T17:50:33.350" Score="5" ViewCount="1012" Body="&lt;p&gt;Host A wants to send something to Host B who is in a different network. Between them is Router 1. Host A sends an ARP broadcast but Router 1 is not answering it. Why is that so?&lt;/p&gt;&#xA;" OwnerUserId="3405" LastActivityDate="2013-12-02T18:05:49.847" Title="Why are routers not answering ARP Broadcasts?" Tags="|router|arp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5280" PostTypeId="2" ParentId="5279" CreationDate="2013-12-02T17:58:10.567" Score="8" Body="&lt;p&gt;The router will not do this by default, unless you enable &lt;a href=&quot;http://en.wikipedia.org/wiki/Proxy_ARP&quot;&gt;Proxy ARP&lt;/a&gt; on that router's interface(s), but best practices dictate Proxy ARP should be disabled wherever possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, host A should know by analyzing its own subnet mask (binary AND against its own subnet mask and Host B's address) that Host B is on a different network, and instead send the traffic to its default gateway (if one is configured), and if necessary, Host A will ARP for its default gateway's MAC address, which the router should respond to when appropriate.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-12-02T18:05:49.847" LastActivityDate="2013-12-02T18:05:49.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5281" PostTypeId="2" ParentId="5278" CreationDate="2013-12-02T18:46:26.383" Score="10" Body="&lt;p&gt;There is no assignment window for IPv6. You can give every end-site up to a /48 without having to ask for permission from the RIPE NCC. If a customer needs more than a /48 you need to explain why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice that the policy refers to an &quot;end site&quot;, not &quot;end user&quot;. If one customer has multiple sites then each site can get up to a /48.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IPv6 you just give every connection more address space than they need. Standardising on a /48 (= 65536 subnets) per customer is common practice. That keeps all the planning easy, customers don't have to beg for more addresses, no renumbering because someone needs more than the initial assignment etc. IPv6 should make network engineering life easier.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2013-12-02T18:46:26.383" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5286" PostTypeId="2" ParentId="5272" CreationDate="2013-12-02T22:39:23.767" Score="0" Body="&lt;p&gt;Besides the already mentioned .1x &amp;amp; port security features mentioned.  Another quick solution would be to assign all unused ports to a blackhole/dummy vlan &amp;amp; shut them down.&lt;/p&gt;&#xA;" OwnerUserId="3150" LastActivityDate="2013-12-02T22:39:23.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5288" PostTypeId="1" CreationDate="2013-12-03T00:48:24.520" Score="6" ViewCount="8639" Body="&lt;p&gt;What is &quot;&lt;em&gt;interarrival jitter&lt;/em&gt;&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've noticed it's available in mtr, but the calculated values don't make that much sense &amp;mdash; they seem to be much larger than even the max jitter value.  What would they be of use for?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Cns# mtr --report{,-cycles=100} --order &quot;SRL BAWV JMXI&quot; … ; date&#xA;HOST: Cns???????                    Snt   Rcv Loss%   Best   Avg  Wrst StDev  Jttr Javg Jmax Jint&#xA;  1.|-- cnst?????????????????????   100   100  0.0%    8.0   8.7  28.3   2.2   0.3  0.7 19.6  9.4&#xA;  2.|-- v320.core1.fra1.he.net      100   100  0.0%    5.3   9.2  22.9   4.5   0.4  4.8 17.6 73.4&#xA;  3.|-- 100ge5-2.core1.par2.he.ne   100   100  0.0%   15.0  18.7  41.0   4.6   7.3  4.2 26.0 47.8&#xA;  4.|-- 10ge15-1.core1.ash1.he.ne   100    99  1.0%   93.0  99.4 133.3   6.7   0.9  6.0 40.2 125.9&#xA;  5.|-- abilene-as11537.gigabitet   100   100  0.0%   93.7  98.0 159.5  11.7   0.0  7.8 65.7 149.4&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="296" LastActivityDate="2013-12-03T01:46:32.947" Title="What is &quot;interarrival jitter&quot; in mtr?" Tags="|mtr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5289" PostTypeId="2" ParentId="5288" CreationDate="2013-12-03T01:46:32.947" Score="4" Body="&lt;p&gt;(Fun fact: I used to work with the guy that originally wrote mtr in '97)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you check out the &lt;a href=&quot;https://github.com/traviscross/mtr&quot; rel=&quot;nofollow&quot;&gt;source on github&lt;/a&gt;, specifically in &lt;code&gt;net.c&lt;/code&gt;, there's this tidbit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int jinta;        /* estimated variance,? rfc1889's &quot;Interarrival Jitter&quot; */&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ietf.org/rfc/rfc1889.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 1889&lt;/a&gt; is the RFC for RTP, later superseded by &lt;a href=&quot;http://www.ietf.org/rfc/rfc3550.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 3550&lt;/a&gt;. Here's the excerpt detailing how interarrival jitter is calculated (taken from RFC 3550):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An estimate of the statistical variance of the RTP data packet&#xA;        interarrival time, measured in timestamp units and expressed as an&#xA;        unsigned integer.  The interarrival jitter J is defined to be the&#xA;        mean deviation (smoothed absolute value) of the difference D in&#xA;        packet spacing at the receiver compared to the sender for a pair&#xA;        of packets.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;As shown in the equation below, this is equivalent to&#xA;        the difference in the &quot;relative transit time&quot; for the two packets;&#xA;        the relative transit time is the difference between a packet's RTP&#xA;        timestamp and the receiver's clock at the time of arrival,&#xA;        measured in the same units.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If Si is the RTP timestamp from packet i, and Ri is the time of&#xA;        arrival in RTP timestamp units for packet i, then for two packets&#xA;        i and j, D may be expressed as&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;D(i,j) = (Rj - Ri) - (Sj - Si) = (Rj - Sj) - (Ri - Si)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The interarrival jitter SHOULD be calculated continuously as each&#xA;        data packet i is received from source SSRC_n, using this&#xA;        difference D for that packet and the previous packet i-1 in order&#xA;        of arrival (not necessarily in sequence), according to the formula&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;J(i) = J(i-1) + (|D(i-1,i)| - J(i-1))/16&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Whenever a reception report is issued, the current value of J is&#xA;        sampled.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The jitter calculation MUST conform to the formula specified here&#xA;        in order to allow profile-independent monitors to make valid&#xA;        interpretations of reports coming from different implementations.&#xA;        This algorithm is the optimal first-order estimator and the gain&#xA;        parameter 1/16 gives a good noise reduction ratio while&#xA;        maintaining a reasonable rate of convergence [22].  A sample&#xA;        implementation is shown in Appendix A.8.  See Section 6.4.4 for a&#xA;        discussion of the effects of varying packet duration and delay&#xA;        before transmission.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-12-03T01:46:32.947" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5290" PostTypeId="2" ParentId="3781" CreationDate="2013-12-03T02:45:02.600" Score="2" Body="&lt;p&gt;In addition: Type-2 LSA use only as &quot;virtual instance&quot; of a router in MA segment, this pseudonode has an adjacency to all attached routers (include DR/BDR) on the network and lists all attached routers (RID) to that segment. For transfer LSA they(DR/BDR) use Type-1 LSA as well.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1# sh ip ospf database&#xA;        OSPF Router with ID (1.1.1.1) (Process ID 1)&#xA;            Router Link States (Area 0)&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;1.1.1.1         1.1.1.1         708         0x80000003 0x008686 2&#xA;2.2.2.2         2.2.2.2         709         0x80000003 0x00CB0C 2&#xA;&#xA;            Net Link States (Area 0)&#xA;Link ID               ADV Router    Age         Seq#              Checksum&#xA;192.168.0.2     2.2.2.2         709         0x80000001 0x0014A6&#xA;&#xA;R1# sh ip ospf database network&#xA;        OSPF Router with ID (1.1.1.1) (Process ID 1)&#xA;            Net Link States (Area 0)&#xA;  Routing Bit Set on this LSA in topology Base with MTID 0&#xA;  LS age: 780&#xA;  Options: (No TOS-capability, DC)&#xA;  LS Type: Network Links&#xA;  Link State ID: 1.1.1.1 (address of Designated Router)&#xA;  Advertising Router: 1.1.1.1&#xA;  LS Seq Number: 80000001&#xA;  Checksum: 0x14A6&#xA;  Length: 32&#xA;  Network Mask: /24&#xA;    Attached Router: 2.2.2.2&#xA;    Attached Router: 1.1.1.1&#xA;&#xA;R1#sh ip ospf database router self-originate&#xA;        OSPF Router with ID (1.1.1.1) (Process ID 1)&#xA;            Router Link States (Area 0)&#xA;  LS age: 400&#xA;  Options: (No TOS-capability, DC)&#xA;  LS Type: Router Links&#xA;  Link State ID: 1.1.1.1&#xA;  Advertising Router: 1.1.1.1&#xA;  LS Seq Number: 80000002&#xA;  Checksum: 0x729C&#xA;  Length: 48&#xA;  Number of Links: 2&#xA;&#xA;Link connected to: a Stub Network&#xA; (Link ID) Network/subnet number: 11.11.11.11&#xA; (Link Data) Network Mask: 255.255.255.255&#xA;  Number of MTID metrics: 0&#xA;   TOS 0 Metrics: 1&#xA;&#xA;Link connected to: a Transit Network&#xA; (Link ID) Designated Router address: 192.168.0.1&#xA; (Link Data) Router Interface address: 192.168.0.1&#xA;  Number of MTID metrics: 0&#xA;   TOS 0 Metrics: 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1315" LastActivityDate="2013-12-03T02:45:02.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5291" PostTypeId="1" CreationDate="2013-12-03T04:00:12.390" Score="1" ViewCount="3114" Body="&lt;p&gt;Regarding &quot;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5279/why-are-routers-not-answering-arp-broadcasts&quot;&gt;Why are routers not answering ARP Broadcasts?&lt;/a&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per my knowledge if the target network is different subnet and there is no default gateway is configured the packet will not be constructed at that Host A itself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain this in detail?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does it broadcast the ARP request by asking the Router's MAC address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note : In my case I statically assigned an IP address to Host-A and I didn't configure the default gateway.&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2013-12-03T05:01:45.120" Title="How hosts will broadcast the arp to Router if there is no default gateway?" Tags="|router|arp|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5292" PostTypeId="2" ParentId="5291" CreationDate="2013-12-03T04:17:54.787" Score="3" Body="&lt;p&gt;Say Host A wants to talk to Host B, yet they're in different networks and neither has a route to the other (no specific route or default route.) This generates an immediate error (&quot;Destination Network Unreachable&quot;), with zero network traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're doing Proxy ARP, then you do have a default route; the destination is an interface instead of an address. (or your netmask is 0.0.0.0, but I don't think anybody allows that) In this case, an ARP is sent to the all-one's broadcast address (255.255.255.255) and then awaits an answer from &lt;em&gt;anyone&lt;/em&gt; on the wire. Presumably, a router on the wire will answer and forward traffic in the correct direction. If not, the request times out and error is generated.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-03T04:17:54.787" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5294" PostTypeId="1" AcceptedAnswerId="5295" CreationDate="2013-12-03T09:24:58.183" Score="-4" ViewCount="158" Body="&lt;p&gt;Can I assign an Autonomous System Number in other way than BGP?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="775" LastEditDate="2013-12-03T10:45:47.483" LastActivityDate="2013-12-03T10:45:47.483" Title="Can we assign Autonomous System Number in other way than BGP?" Tags="|routing|bgp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5295" PostTypeId="2" ParentId="5294" CreationDate="2013-12-03T09:49:46.720" Score="6" Body="&lt;p&gt;BGP is the only way to use an autonomous system number which is assigned to you.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-12-03T09:49:46.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5296" PostTypeId="2" ParentId="5270" CreationDate="2013-12-03T11:25:36.340" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How can I measure how this latency is divided between outbound and inbound leg?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can &lt;a href=&quot;https://stackoverflow.com/a/20186781/667301&quot; title=&quot;Use hping3 to find whether Tx or Rx is congested&quot;&gt;find the congested ping direction with hping on linux / cygwin&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If it turns out to be generated equally or mostly on inbound traffic, can I affect that (i.e. ingress throttling) or do I have to contact my ISP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can do it either way, but the ISP method is better since it won't transmit across the DSL before controlling the traffic.  However, there is nothing fundamentally wrong with controlling both directions on the ASA (as long as you implement it correctly).  I agree with you that &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5270/how-to-reduce-latency-on-asa-5510-wan-link#comment7716_5270&quot; title=&quot;iptables rule syntax is very unpleasant&quot;&gt;linux is not a good enterprise qos solution&lt;/a&gt;, since there are non-trivial supportability issues with anyone who has to maintain the &lt;code&gt;iptables&lt;/code&gt; policies.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How best to achieve this on ASA 8.2?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First be sure you know how much bandwidth you have in the Tx / Rx direction.  Note that DSL uses ATM, which can be a little tricky due to the &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk648/tk362/technologies_tech_note09186a0080093c9a.shtml#calculate_atm_over&quot; rel=&quot;nofollow noreferrer&quot;&gt;ATM cell tax&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, use hierarchical priority queueing (aka hierarchical QoS, or HQoS) on the ASA; this is a sample policy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map CLASS_VOICE&#xA; match dscp ef&#xA; exit&#xA;class-map CLASS_VOICE_SIGNAL&#xA; match dscp af31&#xA; exit&#xA;!&#xA;policy-map POLICY_PRIORITIZE_VOICE&#xA; ! Give VOICE and VOICE SIGNAL priority&#xA; class CLASS_VOICE&#xA;  priority&#xA; class CLASS_VOICE_SIGNAL&#xA;  priority&#xA; class class-default&#xA;policy-map POLICY_TRAFFIC_SHAPE_INSIDE&#xA; ! Shape all traffic to slightly less than the DSL modem's ingress bandwidth&#xA; ! I assume you have 2Mbps here, but please measure what you have&#xA; class class-default&#xA;  shape average 2000000 16000&#xA;  service-policy POLICY_PRIORITIZE_VOICE&#xA;!&#xA;policy-map POLICY_TRAFFIC_SHAPE_OUTSIDE&#xA; ! Shape all traffic to slightly less than the DSL modem's egress bandwidth&#xA; ! I assume you have 512Kbps here, but please measure what you have&#xA; class class-default&#xA;  shape average 512000&#xA;  service-policy POLICY_PRIORITIZE_VOICE&#xA;!&#xA;service-policy POLICY_TRAFFIC_SHAPE_INSIDE interface INSIDE&#xA;service-policy POLICY_TRAFFIC_SHAPE_OUTSIDE interface OUTSIDE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This example assumes you implement both Tx and Rx HQoS on the ASA (and that you only use two interfaces on your ASA).  It also assumes you have already marked your traffic correctly.  However, by the time you finish trying to mark traffic on your powerconnects, you might think it's easier to put a real Cisco router in-line to do the marking for you.  If you put a router inline, it's usually better to do the qos on the router.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2013-12-03T11:31:15.050" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5299" PostTypeId="2" ParentId="3318" CreationDate="2013-12-03T12:46:39.403" Score="1" Body="&lt;p&gt;Try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;broadcast-key vlan 1 change 60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for each of the vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Seen here: &lt;a href=&quot;http://www.blueboxmoon.com/wordpress/?p=832&quot; rel=&quot;nofollow&quot;&gt;http://www.blueboxmoon.com/wordpress/?p=832&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got similar issues also with cisco access points in standalone mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Cisco IOS Software, C3500 Software (AP3G1-K9W7-M), Version 15.3(3)JAB, RELEASE SOFTWARE (fc1)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Things seem to be much better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;dot11 activity-timeout unknown default 3600&#xA;dot11 activity-timeout client default 3600 maximum 3600&#xA;dot11 wpa handshake timeout 1000&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in the general section&lt;/p&gt;&#xA;" OwnerUserId="3397" LastEditorUserId="3397" LastEditDate="2014-11-25T11:34:34.993" LastActivityDate="2014-11-25T11:34:34.993" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5300" PostTypeId="1" CreationDate="2013-12-03T13:16:30.377" Score="17" ViewCount="28801" Body="&lt;p&gt;Can anyone explain to me what is the difference between Ethernet, Ethernet-II and 802.3 Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I referred to a lot of books, they are in high level language. Can anyone explain to me in a simple manner?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="630" LastEditDate="2013-12-04T07:08:07.350" LastActivityDate="2022-11-25T21:51:57.673" Title="What is the difference between Ethernet II and 802.3 Ethernet?" Tags="|ethernet|protocol-theory|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5302" PostTypeId="2" ParentId="5300" CreationDate="2013-12-03T13:40:03.397" Score="20" Body="&lt;p&gt;802.3 (which uses &lt;a href=&quot;http://www.princeton.edu/%7Eachaney/tmve/wiki100k/docs/IEEE_802.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.2 LLC&lt;/a&gt; format) has a Length field in the same place that Ethernet II has a Type field.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;IEEE 802.3 with &lt;a href=&quot;http://www.princeton.edu/%7Eachaney/tmve/wiki100k/docs/IEEE_802.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.2 LLC&lt;/a&gt; (used by Spanning-Tree, ISIS) use the highlighted bytes for a &lt;em&gt;Length&lt;/em&gt; field.  802.3 Upper-layer protocols are decoded via the &lt;a href=&quot;http://www.princeton.edu/%7Eachaney/tmve/wiki100k/docs/IEEE_802.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.2 LLC&lt;/a&gt; Header / &lt;a href=&quot;http://www.wildpackets.com/resources/compendium/ethernet/frame_snap_iee8023&quot; rel=&quot;nofollow noreferrer&quot;&gt;SNAP&lt;/a&gt; bytes.  The &lt;a href=&quot;http://www.wildpackets.com/resources/compendium/ethernet/frame_snap_iee8023&quot; rel=&quot;nofollow noreferrer&quot;&gt;SNAP&lt;/a&gt; bytes are used to decode protocols using traditional ethertype values; &lt;a href=&quot;http://www.wildpackets.com/resources/compendium/ethernet/frame_snap_iee8023&quot; rel=&quot;nofollow noreferrer&quot;&gt;SNAP&lt;/a&gt; is &lt;em&gt;only&lt;/em&gt; included when the &lt;a href=&quot;http://www.princeton.edu/%7Eachaney/tmve/wiki100k/docs/IEEE_802.2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.2 LLC&lt;/a&gt; DSAP / SSAP = 0xAAAA.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    +----+----+------+------+------+------+-----+&#xA;    | DA | SA | Len  | LLC  | SNAP | Data | FCS |&#xA;    +----+----+------+------+------+------+-----+&#xA;              ^^^^^^^^&#xA;&#xA;    DA      Destination MAC Address (6 bytes)&#xA;    SA      Source MAC Address      (6 bytes)&#xA;    Len     Length of Data field    (2 bytes: &amp;lt;= 0x05DC or 1500 decimal)  &amp;lt;---&#xA;    LLC     802.2 LLC Header        (3 bytes)&#xA;    SNAP                            (5 bytes)&#xA;    Data    Protocol Data           (46 - 1500 bytes)&#xA;    FCS     Frame Checksum          (4 bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc894&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 894&lt;/a&gt; (commonly known as Ethernet II frames) use these bytes for &lt;em&gt;Type&lt;/em&gt;.  Upper-layer protocols are decoded via the Type field&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    +----+----+------+------+-----+&#xA;    | DA | SA | Type | Data | FCS |&#xA;    +----+----+------+------+-----+&#xA;              ^^^^^^^^&#xA;&#xA;    DA      Destination MAC Address (6 bytes)&#xA;    SA      Source MAC Address      (6 bytes)&#xA;    Type    Protocol Type           (2 bytes: &amp;gt;= 0x0600 or 1536 decimal)  &amp;lt;---&#xA;    Data    Protocol Data           (46 - 1500 bytes)&#xA;    FCS     Frame Checksum          (4 bytes)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-12-03T17:23:17.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5305" PostTypeId="1" CreationDate="2013-12-03T17:14:47.757" Score="8" ViewCount="2088" Body="&lt;p&gt;We are looking to deploy a new data center build-out with Nexus 7ks and Nexus 2ks(FEX).  I know the Nexus 2ks come bundled with the Fabric Extenders to be used to uplink to the Nexus 7ks.  Our plan however is to put Gigamon fiber taps in-line of all of our uplinks back to our Nexus 7ks.  Based off what I understand the FET needs to connect on one end to a FET on the other end.  Would the SFP+ used on the in-line fiber taps cause a problem?  Does anyone have experience with this?  I'm considering just going with 10G SFP+ optics everywhere and not using the FETs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Geoff&lt;/p&gt;&#xA;" OwnerUserId="26" LastActivityDate="2014-06-04T08:04:45.383" Title="Cisco Nexus Fabric Extenders with 10G-SFP in path?" Tags="|fiber|cisco-nexus-2000|cisco-nexus-7k|tap|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5306" PostTypeId="2" ParentId="5305" CreationDate="2013-12-04T01:44:16.140" Score="0" Body="&lt;p&gt;FETs are not required to connect 2Ks, they are far cheaper than SFPs and for some odd reason (to me) you can only order them when you order 2ks. As Ricky said you are going to see a non standard Ethernet encapsulation but that is a matter of does wireshark support it. Cisco will be happy to take the extra $$s for SFP+&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-12-04T01:44:16.140" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5307" PostTypeId="2" ParentId="395" CreationDate="2013-12-04T02:56:32.100" Score="0" Body="&lt;p&gt;During loop, for a large number of broadcast traffic (eg ARP Request) at the end station may also increase the load on the CPU (for example if you are using cheap 100Mbit/s realtek card that calculate a checksum on CPU).&#xA;As physically possible to find a loop if the cable is disconnected, the link lost immediately on 2 ports.&lt;/p&gt;&#xA;" OwnerUserId="1315" LastActivityDate="2013-12-04T02:56:32.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5308" PostTypeId="1" CreationDate="2013-12-04T03:53:55.870" Score="6" ViewCount="10211" Body="&lt;p&gt;Why do DHCP servers (specifically Cisco) use &quot;Client-ID Options&quot;, not the CHADDR (client MAC) in the DHCP request, for static binding?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From: &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/ip/configuration/guide/1cfdhcp.html&quot; rel=&quot;nofollow&quot;&gt;Configuring DHCP&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;All DHCP clients send a client identifier (DHCP option 61) in the DHCP packet. To configure manual bindings, you must enter the client-identifier DHCP pool configuration command with the appropriate hexadecimal values identifying the DHCP client.&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Router(dhcp-config)# &lt;strong&gt;client-identifier&lt;/strong&gt; unique-identifier&lt;/li&gt;&#xA;  &lt;li&gt;Router(dhcp-config)# &lt;strong&gt;hardware-address&lt;/strong&gt; hardware-address type&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For DHCP Req.&lt;/li&gt;&#xA;&lt;li&gt;For &lt;strong&gt;BOOTP&lt;/strong&gt; Req.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1315" LastEditorUserId="619" LastEditDate="2013-12-04T07:00:43.337" LastActivityDate="2013-12-04T07:05:42.573" Title="Why do DHCP servers lease IP address based on Option-61 (Client-ID)?" Tags="|dhcp|cisco-ios|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5309" PostTypeId="2" ParentId="5308" CreationDate="2013-12-04T06:57:15.727" Score="4" Body="&lt;p&gt;Mostly because that's what the specs say you should use.  While the client-id will almost always include (or entirely &lt;em&gt;be&lt;/em&gt;) a MAC, it's a bad habit as NICs do sometimes get replaced (failures, upgrades, etc.) Most DHCP clients allow the user to specify an identifier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BOOTP has no choice, as it has no such option(s).  BOOTP predates DHCP, and is far, far, simpler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(consult the RFC's if you really want to know how it all works.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-12-04T07:05:42.573" LastActivityDate="2013-12-04T07:05:42.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5312" PostTypeId="1" AcceptedAnswerId="5314" CreationDate="2013-12-04T07:08:07.807" Score="12" ViewCount="3023" Body="&lt;p&gt;After a Tcp connection is established between two bgp peers. which peer will send the open message first ? the active peer(which is initiating outbound connection) or the passive peer?(peer which is accepting a inbound connection).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is it independent of this active passive state ? Can any of the peer send the first open message based on scheduling?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What will happen when a open mesage is received before the local router sends out a open message?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any good BGP Peer fsm diagram? RFC4271 doesn't have a fsm diagram :(&lt;/p&gt;&#xA;" OwnerUserId="3193" LastEditorUserId="775" LastEditDate="2013-12-04T08:33:46.657" LastActivityDate="2013-12-04T15:44:51.010" Title="After TCP is established which BGP peer will send open message first?" Tags="|routing|bgp|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5313" PostTypeId="2" ParentId="5305" CreationDate="2013-12-04T07:28:24.483" Score="4" Body="&lt;p&gt;Quote from &lt;a href=&quot;https://supportforums.cisco.com/people/cobeam&quot; rel=&quot;nofollow&quot;&gt;Colby Beam&lt;/a&gt; (Cisco TAC) &quot;&lt;a href=&quot;https://supportforums.cisco.com/thread/2231897&quot; rel=&quot;nofollow&quot;&gt;FET-10G vs. SFP-10G-SR&lt;/a&gt;&quot;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This shouldn't be an issue, as I've seen customers do it all the time and I've done it in the lab.  There is some limitation on distance with the FET-10G vs 10-SR. Also the FET can ONLY be used to connect a N2K to either a N5K or N7K&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-04T07:28:24.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5314" PostTypeId="2" ParentId="5312" CreationDate="2013-12-04T08:19:31.567" Score="16" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;which peer will send the open message first?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Normally, the speaker that opens the socket sends the first OPEN message. But it actually doesn't matter (ref the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4271#page-41&quot; rel=&quot;nofollow noreferrer&quot;&gt;DelayOpen timer&lt;/a&gt;), because BGP also provides a way to delay the OPEN message so the opposite peer can send first:&lt;/p&gt;&#xA;&lt;pre&gt;&#xA;    Option 1:     DelayOpen&#xA;&#xA;    Description: The DelayOpen optional session attribute allows&#xA;                 implementations to be configured to delay sending&#xA;                 an OPEN message for a specific time period&#xA;                 (DelayOpenTime).  The delay allows the remote BGP&#xA;                 Peer time to send the first OPEN message.&#xA;&#xA;         Value:       TRUE or FALSE&#xA;&lt;/pre&gt;&#xA;&lt;p&gt;In the event that both speakers open duplicate TCP sessions and send OPEN messages on each socket simultaneously, the BGP Identifier is used to resolve which socket should be closed.  See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4271#section-6.8&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4271, Section 6.8&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;6.8. BGP Connection Collision Detection&#xA;&#xA;If a pair of BGP speakers try to establish a BGP connection with each other &#xA;simultaneously, then two parallel connections well be formed. If the source IP address &#xA;used by one of these connections is the same as the destination IP address used by the &#xA;other, and the destination IP address used by the first connection is the same as the &#xA;source IP address used by the other, connection collision has occurred. In the event &#xA;of connection collision, one of the connections MUST be closed.&#xA;&#xA;Based on the value of the BGP Identifier, a convention is established for detecting &#xA;which BGP connection is to be preserved when a collision occurs. The convention is to &#xA;compare the BGP Identifiers of the peers involved in the collision and to retain only &#xA;the connection initiated by the BGP speaker with the higher-valued BGP Identifier. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Is there any good BGP Peer fsm diagram?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Wikipedia has this &lt;a href=&quot;http://upload.wikimedia.org/wikipedia/commons/a/a8/BGP_FSM.svg&quot; rel=&quot;nofollow noreferrer&quot;&gt;simplified BGP FSM&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-12-04T15:44:51.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5316" PostTypeId="1" AcceptedAnswerId="5318" CreationDate="2013-12-04T11:32:56.267" Score="10" ViewCount="8593" Body="&lt;p&gt;I'm trying to understand how QoS systems work and I'm not sure how exactly would WFQ and WRED interact. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first, I thought that WFQ is a queuing mechanism and that WRED is a congestion avoidance mechanism. WFQ should schedule packets in queues and WRED is there to drop them when queues are full. If I'm setting up QoS on for example an L3 switch, I'd set up a queuing mechanism and a congestion avoidance mechanism, so I could in theory have WFQ and WRD working together. For example, this document seems to imply that I they would be set up in such way. Some other Cisco documents mention that I could use them independently. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I wanted to learn more about how they worked and started searching the Internet. As a result, now I have no idea what they are and how they work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some sites (at least to my understanding of the content) claim that packet scheduling algorithms and congestion avoidance algorithms are basically the same. For example in &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_scheduler#Network_scheduling_algorithms&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; Wikipedia article, they are all placed in a same group. Some random articles mentioned that I could use WFQ XOR WRED. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I wanted to ask is how related are WFQ and WRED? When would I use one or another and when both, if that's even possible?&lt;/p&gt;&#xA;" OwnerUserId="677" LastEditorUserId="775" LastEditDate="2014-12-09T11:12:22.603" LastActivityDate="2014-12-09T11:12:22.603" Title="How are Weighted Fair Queuing and Weighted Random Early Detection related?" Tags="|cisco|qos|congestion|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5317" PostTypeId="2" ParentId="5316" CreationDate="2013-12-04T12:07:59.027" Score="-1" Body="&lt;p&gt;Here is an example of CBWFQ and WRED:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;policy-map OUT  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;class Voice&lt;br&gt;&#xA;  priority  percent 20 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;class Video&lt;br&gt;&#xA;  bandwidth  percent 30  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;class P1&lt;br&gt;&#xA;  bandwidth percent 10&lt;br&gt;&#xA;  random-detect dscp-based&lt;br&gt;&#xA;  random-detect dscp af31 26 40 10  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;class P2&lt;br&gt;&#xA;  bandwidth percent 15&lt;br&gt;&#xA;  random-detect dscp-based&lt;br&gt;&#xA;  random-detect dscp af21 24 40 10  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;class class-default&lt;br&gt;&#xA;  fair-queue&lt;br&gt;&#xA;  random-detect dscp-based  &lt;/p&gt;&#xA;" OwnerUserId="3421" LastActivityDate="2013-12-04T12:07:59.027" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5318" PostTypeId="2" ParentId="5316" CreationDate="2013-12-04T13:12:41.560" Score="10" Body="&lt;p&gt;Weighted Fair Queueing (WFQ) is as the name implies a queueing algorithm. Queueing is used when there is congestion on an interface. This is usually detected through that the Transmit Ring (TX-Ring) is full. This means that the interface is busy sending packets. Queuing does not take place unless there is congestion on the interface. In some cases the size of the TX-ring can be manipulated. A small TX-ring gives the software queue more power as to which packets get sent out first but it's not very effective. A too large TX-ring would make the software queue almost useless and lead to higher latency and jitter for important packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default queueing algorithm is usually First In First Out (FIFO). This means that packets are delivered in exactly the order as they arrive on the input of the interface. This is not usually desirable because some packets should be prioritized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is quite common that a customer buys a service from an Internet Service Provider (ISP) at subrate. That is, the customer buys a 50 Mbit/s service but the physical interface is running at 100 Mbit/s. In this case there will be no congestion but the ISP will be limiting the amount of traffic from the customer. To introduce artificial congestion in these cases a shaper can be applied. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now that there is congestion a queueing algorithm can be applied. Note that queueing algorithms don't provide any extra bandwidth, they just let us decide which packets are more important to us. WFQ is an algorithm that takes several parameters and makes a decision based on that. The algorithm is quite complex and uses weight (IP Precedence), packet size and scheduling time as parameters. There is a very detailed explanation from INE &lt;a href=&quot;http://s3.www.ine.com/downloads/IEWB-RS-VOL-I-V5.Section.10.QoS.teaser.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here.&lt;/a&gt; WFQ is a good choice if one does not want to fiddle too much with queueing as it provides adequate bandwidth to small size flows like SSH, Telnet, voice and that means that a file transfer won't steal all the bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Weighted Random Early Detection (WRED) is a congestion avoidance mechanism. WRED measures the size of the queues depending on the Precedence value and starts dropping packets when the queue is between the minimum threshold and the maximum threshold. Configuration will decide that 1 in every N packets are dropped. WRED helps to prevent TCP synchronization and TCP starvation. When TCP loses packets it will go into slow start and if all TCP sessions lose packets at the same time they could become synchronized which provides a graph like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/3vSFi.gif&quot; alt=&quot;TCP Synchronization&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As can be seen if WRED is not configured the graph goes full blast, then silent, then full blast and so on. WRED provides a more average transmit rate. It is important to note that UDP does not get affected by dropping packets because it has no acknowledgement mechanism and sliding window implemented like TCP. Therefore WRED should not be implemented on UDP based class like a class handling SNMP, DNS or other UDP based protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both WFQ and WRED can and should be deployed together.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="105" LastEditDate="2014-12-09T11:08:31.890" LastActivityDate="2014-12-09T11:08:31.890" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5319" PostTypeId="2" ParentId="5316" CreationDate="2013-12-04T13:42:30.197" Score="8" Body="&lt;p&gt;First of all, don't believe everything you read on the Internet ;-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes algorithms (or the way they are physically implemented) don't fit neatly into a theoretical category.  What you call it is less important than understanding what it does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole point of WFQ (or any other scheduling algorithm) is to share the limited link bandwidth among the various flows.  WFQ tries to allocate the bandwidth proportionally to each flow.  CBWFQ does the same to each &quot;class.&quot; In a perfect world, with unlimited queues and unlimited memory, that would be all you need -- you share the bandwidth and everyone is happy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But because devices don't have unlimited queues and memory, some &quot;shortcuts&quot; have to be made. Because a queue has a limited size, there is the danger that the queue will fill up, causing tail drops and traffic synchronization.  Essentially, if my queue is overflowing, I'm no longer controlling the bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To avoid my queues overflowing, I use Random Early Detection.  This algorithm randomly drops packets from the queue according to how full the queue is (depth) -- the fuller the queue, the more packets will be dropped.  The goal is to keep the queue from overflowing, so that the scheduling algorithm can work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then some bright Cisco engineer noticed that one could use fewer queues (simpler hardware) and randomly drop different kinds of traffic at different queue depths.  WRED drops traffic from the queue at different depths depending on the type of traffic.&#xA;Although you might call WRED a congestion avoidance mechanism, since the depth where traffic is dropped varies with the type of traffic, the &lt;em&gt;effect&lt;/em&gt; is that different types get less space in the queue and therefore less of the bandwidth.  So it also acts as a scheduling algorithm.&#xA;You say po-tay-to and I say po-tah-toe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more difference:  FQ and WFQ work on all types of traffic, since they essentially count bytes.  RED and WRED only work with TCP, becuase they depend on TCP's flow control mechanism to slow down the traffic and keep the queue from overflowing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note: for the sake of explanation, I'm ignoring priority queues and LLQ.  That's another answer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I agree with everything Mike said too.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2013-12-04T13:54:22.720" LastActivityDate="2013-12-04T13:54:22.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5320" PostTypeId="1" AcceptedAnswerId="5620" CreationDate="2013-12-04T16:48:31.137" Score="6" ViewCount="9054" Body="&lt;p&gt;I am having a puzzling issue with OSPF connectivity on one of my routers. The other routers in my network have formed an adjacency and are working correctly, but this last one is a case I've never seen before. All of the interfaces on the remaining router are up and functional and are connected to AREA 0 just as the other two routers are. However, a &lt;code&gt;show ip ospf&lt;/code&gt; command results in the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Area BACKBONE(0) (Inactive)&#xA;&#xA;        Number of interfaces in this area is 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additionally, I get nothing if I try to ping 224.0.0.5 or 224.0.0.6 from this router. I've tried restarting the OSPF process on the router as well as rebooting the router itself, but it makes no difference. When I turn debugging on, I can see the router isn't even sending OSPF hello messages. What could be the cause of something like this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router interfaces are configured as follows for the router in question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f0/0 - 111.1.0.2/8&#xA;f0/1 - 112.1.0.2/8&#xA;f0/2/0 - (Vlan5) 122.0.0.1/8&#xA;f0/2/3 - (Vlan88) 10.10.10.1/28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the entire router config along with OSPF process info and interface statuses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router_1#sh ip ospf &#xA; Routing Process &quot;ospf 10&quot; with ID 122.0.0.1&#xA; Start time: 00:00:19.304, Time elapsed: 18:57:25.596&#xA; Supports only single TOS(TOS0) routes&#xA; Supports opaque LSA&#xA; Supports Link-local Signaling (LLS)&#xA; Supports area transit capability&#xA; Router is not originating router-LSAs with maximum metric&#xA; Initial SPF schedule delay 5000 msecs&#xA; Minimum hold time between two consecutive SPFs 10000 msecs&#xA; Maximum wait time between two consecutive SPFs 10000 msecs&#xA; Incremental-SPF disabled&#xA; Minimum LSA interval 5 secs&#xA; Minimum LSA arrival 1000 msecs&#xA; LSA group pacing timer 240 secs&#xA; Interface flood pacing timer 33 msecs&#xA; Retransmission pacing timer 66 msecs&#xA; Number of external LSA 0. Checksum Sum 0x000000&#xA; Number of opaque AS LSA 0. Checksum Sum 0x000000&#xA; Number of DCbitless external and opaque AS LSA 0&#xA; Number of DoNotAge external and opaque AS LSA 0&#xA; Number of areas in this router is 1. 1 normal 0 stub 0 nssa&#xA; Number of areas transit capable is 0&#xA; External flood list length 0&#xA; IETF NSF helper support enabled&#xA; Cisco NSF helper support enabled&#xA;    Area BACKBONE(0) (Inactive)&#xA;    Number of interfaces in this area is 3&#xA;    Area has no authentication&#xA;    SPF algorithm last executed 01:36:13.484 ago&#xA;    SPF algorithm executed 3 times&#xA;    Area ranges are&#xA;    Number of LSA 1. Checksum Sum 0x00F9B7&#xA;    Number of opaque link LSA 0. Checksum Sum 0x000000&#xA;    Number of DCbitless LSA 0&#xA;    Number of indication LSA 0&#xA;    Number of DoNotAge LSA 0&#xA;    Flood list length 0&#xA;&#xA; router_1#sh ip int br&#xA;    Interface                  IP-Address      OK? Method Status                Protocol&#xA;    FastEthernet0/0            111.1.0.2       YES NVRAM  up                    up      &#xA;    FastEthernet0/1            112.1.0.2       YES NVRAM  up                    up      &#xA;    FastEthernet0/2/0          unassigned      YES unset  up                    up      &#xA;    FastEthernet0/2/1          unassigned      YES unset  administratively down down    &#xA;    FastEthernet0/2/2          unassigned      YES unset  administratively down down    &#xA;    FastEthernet0/2/3          unassigned      YES unset  up                    up      &#xA;    Vlan1                      unassigned      YES NVRAM  administratively down down    &#xA;    Vlan5                      122.0.0.1       YES NVRAM  up                    up      &#xA;    Vlan88                     10.10.10.1      YES NVRAM  up                    up      &#xA;&#xA;router_1#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 3904 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname router_1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$iXM1$Rcki3hrzpXULV8lCJXDqY1&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;ip cef&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;username thedoctor privilege 15 secret 5 $1$KUwA$VWYQeI/fm8LacwgysL7RK/&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;class-map match-all data-inmmediate&#xA; match ip dscp af13 &#xA;class-map match-all class-all&#xA; match any &#xA;class-map match-all data-priority&#xA; match ip dscp af23 &#xA;class-map match-all data-routine&#xA; match ip dscp default &#xA;class-map match-all data-flash&#xA; match ip dscp default &#xA; match ip dscp af33 &#xA;class-map match-all video&#xA; match ip dscp cs4  33  af41  35  af42 &#xA;class-map match-all data-flash-override&#xA; match ip dscp 31 &#xA;class-map match-all voice&#xA; match ip dscp cs5  41  42  43  44 &#xA;!&#xA;!&#xA;policy-map ecn-llq-enable&#xA; class voice&#xA;  priority 48&#xA; class video&#xA;  bandwidth percent 1&#xA;  random-detect dscp-based&#xA;  random-detect exponential-weighting-constant 1&#xA;  random-detect ecn&#xA;  random-detect dscp 32   8     16    16   &#xA;  random-detect dscp 33   16    24    16   &#xA;  random-detect dscp 34   24    32    16   &#xA;  random-detect dscp 35   32    40    16   &#xA;  random-detect dscp 36   40    48    16   &#xA; class data-flash-override&#xA;  bandwidth percent 35&#xA;  random-detect dscp-based&#xA;  random-detect exponential-weighting-constant 1&#xA;  random-detect ecn&#xA;  random-detect dscp 31   70    4000  2    &#xA; class data-flash&#xA;  bandwidth percent 1&#xA;  random-detect dscp-based&#xA;  random-detect exponential-weighting-constant 1&#xA;  random-detect ecn&#xA;  random-detect dscp 30   80    96    16   &#xA; class data-priority&#xA;  bandwidth percent 1&#xA;  random-detect dscp-based&#xA;  random-detect exponential-weighting-constant 1&#xA;  random-detect ecn&#xA;  random-detect dscp 22   96    112   12   &#xA; class data-inmmediate&#xA;  bandwidth percent 1&#xA;  random-detect dscp-based&#xA;  random-detect exponential-weighting-constant 1&#xA;  random-detect ecn&#xA;  random-detect dscp 14   112   128   8    &#xA; class data-routine&#xA;  bandwidth percent 25&#xA;  random-detect dscp-based&#xA;  random-detect exponential-weighting-constant 1&#xA;  random-detect ecn&#xA;  random-detect dscp 0   2     4000  2    &#xA;policy-map shape-all-ncw&#xA; class class-all&#xA;  shape average 128000&#xA;  service-policy ecn-llq-enable&#xA;policy-map shape-all-hnw&#xA; class class-all&#xA;  shape average 1000000&#xA;  service-policy ecn-llq-enable&#xA;!&#xA;!&#xA;!&#xA;!         &#xA;interface FastEthernet0/0&#xA; description Intermidiate_Router_GW&#xA; ip address 111.1.0.2 255.0.0.0&#xA; ip ospf cost 400&#xA; duplex auto&#xA; speed auto&#xA; service-policy output shape-all-hnw&#xA;!&#xA;interface FastEthernet0/1&#xA; description Router2&#xA; ip address 112.1.0.2 255.0.0.0&#xA; ip ospf cost 600&#xA; duplex auto&#xA; speed auto&#xA; service-policy output shape-all-hnw&#xA;!&#xA;interface FastEthernet0/2/0&#xA; description ENCRYPTION1&#xA; switchport access vlan 5&#xA;!&#xA;interface FastEthernet0/2/1&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/2/2&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/2/3&#xA; description AF_NM&#xA; switchport access vlan 88&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan5&#xA; description ENCRYPTION1&#xA; ip address 122.0.0.1 255.0.0.0&#xA;!&#xA;interface Vlan88&#xA; description AF_NM&#xA; ip address 10.10.10.1 255.255.255.248&#xA;!&#xA;router ospf 10&#xA; log-adjacency-changes&#xA; network 111.0.0.0 0.255.255.255 area 0&#xA; network 112.0.0.0 0.255.255.255 area 0&#xA; network 122.0.0.0 0.255.255.255 area 0&#xA;!&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 120.0.0.1&#xA;ip route 122.1.1.0 255.255.255.0 122.0.0.2&#xA;ip route 122.1.2.0 255.255.255.0 122.0.0.2&#xA;!         &#xA;!&#xA;ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;!&#xA;access-list 23 permit 10.10.10.0 0.0.0.7&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; login local&#xA;line aux 0&#xA;line vty 0 4&#xA; privilege level 15&#xA; login local&#xA; transport input telnet&#xA;line vty 5 15&#xA; privilege level 15&#xA; login local&#xA; transport input telnet&#xA;!&#xA;scheduler allocate 20000 1000&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1453" LastEditorUserId="1453" LastEditDate="2013-12-23T21:43:58.813" LastActivityDate="2018-04-02T15:53:52.460" Title="OSPF Area Backbone(0) is Inactive" Tags="|cisco|routing|router|ospf|" AnswerCount="3" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="5321" PostTypeId="2" ParentId="5320" CreationDate="2013-12-04T17:00:24.637" Score="0" Body="&lt;p&gt;The interfaces in Area 0 must be UP&lt;/p&gt;&#xA;" OwnerUserId="450" LastEditorUserId="775" LastEditDate="2013-12-04T17:03:46.503" LastActivityDate="2013-12-04T17:03:46.503" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5328" PostTypeId="2" ParentId="83" CreationDate="2013-12-05T08:37:04.427" Score="3" Body="&lt;pre&gt;&lt;code&gt;show configuration | compare rollback &amp;lt;rollback-number&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Command output would be as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;admin@NICFW1# run show configuration | compare rollback 2    &#xA;[edit applications application MORTIMERHARVEY]&#xA;     term WWW_TCP_2131 { ... }&#xA;+    term WWW_TCP_65000 protocol tcp destination-port 65000-65050;&#xA;&#xA;{primary:node0}[edit]&#xA;admin@NICFW1# run show configuration | compare rollback 3    &#xA;[edit security policies from-zone Internet to-zone Corporate policy InternetPortals match]&#xA;-      application [ junos-http junos-https ];&#xA;+      application [ junos-http junos-https MORTIMERHARVEY ];&#xA;[edit applications application MORTIMERHARVEY]&#xA;     term WWW_TCP_2131 { ... }&#xA;+    term WWW_TCP_65000 protocol tcp destination-port 65000-65050;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the above e.g. &lt;code&gt;+&lt;/code&gt; represents the config that has been added and &lt;code&gt;-&lt;/code&gt; represents the config that has been deleted. &lt;/p&gt;&#xA;" OwnerUserId="3436" LastEditorUserId="775" LastEditDate="2013-12-05T13:03:30.583" LastActivityDate="2013-12-05T13:03:30.583" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5334" PostTypeId="1" AcceptedAnswerId="5336" CreationDate="2013-12-06T01:23:27.597" Score="4" ViewCount="63851" Body="&lt;p&gt;This is my first time here, and if this isn't the right place for this question, my apologies. Please direct me to the right place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to get a wired LAN connection to a desktop computer and a printer using the one Ethernet jack available in that room (due to home wiring), I am interested in &quot;splitting&quot; the RJ45's cable into two different &quot;lines&quot; using &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B000Q5UMEI&quot; rel=&quot;nofollow&quot;&gt;this splitter on Amazon&lt;/a&gt;. Many people (and apparently the maker of this adapter) seem to believe you can functionally use only 4 wires inside a RJ45 cable to sustain a reliable LAN connection, which would allow you to use one RJ45 cable to be used as &quot;two&quot; cables using this adapter. My understanding is you use two Ethernet patch cables to go from two ports on a router into this adapter which uses 4 wires of the 8 wire total RJ45 cable for each connection, and then put the same adapter on the other end of the line and &quot;split&quot; the signals back out into two RJ45 jacks on the adapter so two Ethernet devices can plug in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or at least that's what I &lt;em&gt;think&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off, is my idealism &lt;em&gt;valid&lt;/em&gt;, or is this actually nothing but a signal combiner? Can you indeed establish an Ethernet LAN connection using 4 wires of a RJ45 cable instead of 8?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, if this is possible, how much network performance would the devices lose due to less copper as compared to a dedicated Ethernet cable? In my case, I am running a 50' run, which (I think) is a decent amount of cable, but isn't a &lt;em&gt;stretch&lt;/em&gt; to the 100 meter standard.&lt;/p&gt;&#xA;" OwnerUserId="3446" LastActivityDate="2013-12-06T02:26:18.037" Title="4 Wire (as compared to 8 wire) LAN connections and Bandwidth Loss when Splitting Ethernet?" Tags="|ethernet|power-over-ethernet|" AnswerCount="1" CommentCount="4" ClosedDate="2013-12-06T03:08:00.190" ContentLicense="CC BY-SA 3.0" />
  <row Id="5336" PostTypeId="2" ParentId="5334" CreationDate="2013-12-06T02:26:18.037" Score="3" Body="&lt;p&gt;10 and 100 need only 2 pairs (pins 1-2-3-6) Gig needs all 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This adapter brings 4-5-7-8 to the second port's 1-2-3-6.  This is, technically, a spec violation, but over short distances, it does work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(it's just like a line-1, line-2 phone splitter.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-06T02:26:18.037" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5337" PostTypeId="1" CreationDate="2013-12-06T06:11:07.187" Score="10" ViewCount="11721" Body="&lt;p&gt;Is there any particular reason why Ethernet switches don't change the MAC address of a packet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it for end host identification using the MAC address, or anything else?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="775" LastEditDate="2013-12-06T16:18:11.563" LastActivityDate="2016-03-07T19:01:34.873" Title="Why don't switches rewrite mac-addresses?" Tags="|ethernet|protocol-theory|mac-address|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5338" PostTypeId="1" AcceptedAnswerId="5342" CreationDate="2013-12-06T11:17:51.797" Score="2" ViewCount="4124" Body="&lt;p&gt;What is the recommended browser to use with Cisco products ? I have menu problems with Cisco Unified Communication Manager 9 after IE upgraded to V11 (versions 9 and 10 were fine), and I have noticed same problem with IE11, Google Chrome and Firefox when accessing Cisco Secure ACS v5.4, but there are no browser issues with Cisco Network Analysis Module - Traffic Analyzer v5.1 and Cisco Unity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hbr3d.png&quot; alt=&quot;ACS report problem with IE11&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just wonder if there is a browser that can work with all of the above no matter it's version.&lt;/p&gt;&#xA;" OwnerUserId="2516" LastActivityDate="2013-12-06T19:36:20.040" Title="Recommended browser with Cisco products" Tags="|cisco|" AnswerCount="2" CommentCount="2" ClosedDate="2018-03-25T01:30:05.947" ContentLicense="CC BY-SA 3.0" />
  <row Id="5339" PostTypeId="2" ParentId="5337" CreationDate="2013-12-06T12:12:23.363" Score="4" Body="&lt;p&gt;Rewrites of addresses of datagrams happens at layer 3 for example when gateways (router or firewall) running NAT rewrites IP addresses of hosts on the inside network so they all appear from one (or a few) external IP addresses on the gateway itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for something similar not happening at the layer 2 level (where we use MAC addresses to distinguish hosts and switches do the movement of datagrams, that is frames) is as said in comments above that there really is no need for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the layer three case with NAT, the NAT solves a number of problems:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IP addresses are used for global communication, and there is a limited pool of IP addresses available that has to be shared.  By using NAT, one makes sure that a larger number of internal hosts can share fewer (commonly just one) IP address that is visible on the public internet.&lt;/li&gt;&#xA;&lt;li&gt;The rewriting of IP addresses are considered by some but not everyone to add a layer of security by masquerading the IP addresses of the internal machines.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, if we stick with the NAT example, there is really no need for a layer two counterpart of NAT.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;MAC addresses are not used globally for addressing datagrams on the internet, they are used for sending frames to the right hosts on the local subnet.  As local subnets are relatively small, and the number of possible MAC addresses is very large, one does not &quot;run out of&quot; available MAC addresses at the layer 2 level. (The option to manually reconfigure the MAC addresses of NICs to an arbitrary value does not change this)&lt;/li&gt;&#xA;&lt;li&gt;And for the debatable security benefit of rewriting datagram addresses when forwarding: As MAC addresses are used within a local subnet only, one usually have, in relative terms, much better control from a security perspective over that subnet (physically as well as most of the involved devices) compared to the counterpart in the layer 3 case, which is the entire internet (which we as connected users and network engineers in practice have no security control over).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope this shed some light over why switches do not rewrite MAC addresses.  The only layer 3 case I came up with from the top of my head was NAT, others certainly can provide example of other layer 3 cases where IP rewrites are warranted (and why those technologies don't really make sense on the layer 2 level).&lt;/p&gt;&#xA;" OwnerUserId="3306" LastActivityDate="2013-12-06T12:12:23.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5341" PostTypeId="2" ParentId="5337" CreationDate="2013-12-06T14:54:12.603" Score="10" Body="&lt;p&gt;If a switch were to change MAC addresses, this would break networking entirely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MAC address is a unique identifier which is used by hosts on the local network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switch were to change the destination MAC, the frame would not get delivered to the appropriate host.  In the cases that it would, for example if the frame gets flooded, the destination host would drop it because it would no longer be destined for the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switch were to change the source MAC address, the destination host would use this MAC address for any responses (including updating any ARP entries with bad data).  This would result in the same situation I already described, just for all return traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This could further create problems with things like 802.1X and other mechanisms that use the MAC address to identify/classify the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could mechanisms be developed to do this?  I am sure they could.  But there is no reason to do so at this point and this would only complicate networking and add unnecessary processing.  We are not close to exhausting the available MAC address pool so there is no need for something like MAT (don't know if the concept of MAC address translation even exists anywhere so maybe I just coined a term?).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-12-06T14:54:12.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5342" PostTypeId="2" ParentId="5338" CreationDate="2013-12-06T14:58:17.323" Score="3" Body="&lt;p&gt;according to the &lt;a href=&quot;http://www.cisco.com/en/US/docs/voice_ip_comm/cucm/rel_notes/9_0_1/CUCM_BK_RF912712_00_cucm-release-notes-90_chapter_01.html#CUP0_RF_S1504705_00&quot; rel=&quot;nofollow&quot;&gt;UCM v9.0 Release Notes&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;Supported browsers&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Use the following Internet browsers to access the Unified Communications Manager and IM &gt;and Presence Service interfaces:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Microsoft Windows: Microsoft Internet Explorer Version 6.0 or later or &#xA;                    Mozilla Firefox Version 3.x, 4.x, or 10.x&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Mac: Safari 5.x or Mozilla Firefox Version 4.x or 10.x&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;The following Internet browsers are officially supported to access the Enterprise License Manager interface:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Firefox: Version 8, 9, 10&lt;/li&gt;&#xA;  &lt;li&gt;Internet Explorer: Version 8, 9&lt;/li&gt;&#xA;  &lt;li&gt;Google Chrome: Version 15, 16, 17&lt;/li&gt;&#xA;  &lt;li&gt;Safari: Version 5.1&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3450" LastEditorUserId="775" LastEditDate="2013-12-06T15:03:29.353" LastActivityDate="2013-12-06T15:03:29.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5343" PostTypeId="1" AcceptedAnswerId="7325" CreationDate="2013-12-06T15:02:22.510" Score="10" ViewCount="6688" Body="&lt;p&gt;I am working on trying to setup our network for multicast traffic. In the coming months we will be installing new equipment that sends out multicast traffic. In the past we have only had 1 VLAN so we just used IGMP querier and snooper and this met our needs. In the new office that we just moved into we have segregated the network into multiple VLANs. I understand that we will need to use PIM to accomplish what we want. After some research I understand that PIM Dense Mode will broadcast initially out to every user and then prune back the ports that do not want the multicast feed. This leads me to believe that PIM Sparse Mode is the better option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are currently a Dell PowerConnect shop with a pretty simple layout. (See below for our network topology diagram)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Should we setup on our core network switch OSPF with a router ID of 1.1.1.1 and then not set any OSPF settings on any other switch? &lt;/li&gt;&#xA;&lt;li&gt;Would PIM Sparse Mode only need to be enabled on the core switches or on all of the switches in the network?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;We are wanting to keep as much of the data from hitting our Cisco switch as that connects to our other branch offices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I attempted to setup PIM Sparse Mode I did not see any neighbors showing up which I believe is needed to have PIM work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I initially looked at this PDF for sample configurations but they use PIM Dense and following this paper didn't work at all.&#xA;&lt;a href=&quot;ftp://ftp.dell.com/Manuals/Common/powerconnect-m6220_White%20Papers48_en-us.pdf&quot; rel=&quot;noreferrer&quot;&gt;ftp://ftp.dell.com/Manuals/Common/powerconnect-m6220_White%20Papers48_en-us.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; I seemed to be able to get this working in my test environment but that used 2x 6224 switches. I have not been able to get this to work yet going through the 8132F switches yet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; Does IP PIM Sparse need to be enabled on each interface on the acting router? Have been testing with this just enabled on the VLAN not the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; Have been doing some more testing with VLC player trying to get this working. Have attached my configs for the switches. Any suggestions? After upgrading the 8132F to version 6 of the firmware it does remove the &quot;ip igmp&quot; command from the VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Core config&lt;/strong&gt; *Switch shows model of N4032F but this is indeed an 8132F&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;!Current Configuration:&#xA;!System Description &quot;Dell Networking N4032F, 6.0.0.8, Linux 2.6.32.9&quot;&#xA;!System Software Version 6.0.0.8&#xA;!Cut-through mode is configured as disabled&#xA;!&#xA;configure&#xA;vlan 9&#xA;name &quot;Metronet&quot;&#xA;exit&#xA;vlan 10&#xA;name &quot;Servers&quot;&#xA;exit&#xA;vlan 11&#xA;name &quot;Endpoints&quot;&#xA;exit&#xA;vlan 12&#xA;name &quot;Voice&quot;&#xA;exit&#xA;vlan 13&#xA;name &quot;Guest&quot;&#xA;exit&#xA;vlan 14&#xA;name &quot;Security Cameras&quot;&#xA;exit&#xA;vlan 15&#xA;name &quot;Mobile Media&quot;&#xA;exit&#xA;vlan 9-15&#xA;exit&#xA;snmp-server location &quot;MSH Rack 1 Slots 36-37&quot;&#xA;snmp-server contact &quot;Daniel&quot;&#xA;hostname &quot;Core&quot;&#xA;slot 1/0 3    ! Dell Networking N4032F&#xA;slot 1/1 6    ! Dell QSFP Card&#xA;slot 2/0 3    ! Dell Networking N4032F&#xA;slot 2/1 6    ! Dell QSFP Card&#xA;sntp unicast client enable&#xA;sntp server 10.10.10.242&#xA;clock timezone -5 minutes 0&#xA;stack&#xA;member 1 2    ! N4032F&#xA;member 2 2    ! N4032F&#xA;exit&#xA;interface out-of-band&#xA;ip address none&#xA;exit&#xA;ip access-list BlockGuest3&#xA;permit tcp 10.11.13.0 0.0.0.255 10.11.10.40 0.0.0.0&#xA;permit tcp 10.11.13.0 0.0.0.255 eq 67 10.11.10.12 0.0.0.0&#xA;permit ip 10.11.13.0 0.0.0.255 10.11.15.0 0.0.0.0&#xA;deny ip 10.11.13.0 0.0.0.255 10.10.0.0 0.0.0.255&#xA;deny ip 10.11.13.0 0.0.0.255 10.11.10.0 0.0.0.255&#xA;deny ip 10.11.13.0 0.0.0.255 10.11.11.0 0.0.0.255&#xA;deny ip 10.11.13.0 0.0.0.255 10.11.12.0 0.0.0.255&#xA;permit every&#xA;exit&#xA;ip routing&#xA;ip route 0.0.0.0 0.0.0.0 10.11.9.2&#xA;interface vlan 1&#xA;exit&#xA;interface vlan 9&#xA;ip address 10.11.9.1 255.255.255.252&#xA;exit&#xA;interface vlan 10&#xA;ip address 10.11.10.1 255.255.255.0&#xA;ip pim&#xA;exit&#xA;interface vlan 11&#xA;ip address 10.11.11.1 255.255.255.0&#xA;ip pim&#xA;exit&#xA;interface vlan 12&#xA;ip address 10.11.12.1 255.255.255.0&#xA;ip pim&#xA;exit&#xA;interface vlan 13&#xA;ip address 10.11.13.1 255.255.255.0&#xA;ip access-group BlockGuest3 in 1&#xA;exit&#xA;interface vlan 14&#xA;ip address 10.11.14.1 255.255.255.0&#xA;exit&#xA;interface vlan 15&#xA;ip address 10.11.15.1 255.255.255.0&#xA;ip pim&#xA;exit&#xA;username &quot;admin&quot; password password_removed privilege 15 encrypted&#xA;ip ssh server&#xA;ip multicast-routing&#xA;ip pim sparse-mode&#xA;ip pim rp-address 10.11.10.1 224.0.0.0 240.0.0.0&#xA;!&#xA;interface Te1/0/1&#xA;description &quot;Metronet&quot;&#xA;switchport access vlan 9&#xA;exit&#xA;!&#xA;interface Te1/0/3&#xA;channel-group 1 mode active&#xA;description &quot;MDF&quot;&#xA;switchport mode trunk&#xA;exit&#xA;!&#xA;interface Te1/0/4&#xA;channel-group 2 mode active&#xA;description &quot;IDF&quot;&#xA;switchport mode trunk&#xA;exit&#xA;!&#xA;interface Te2/0/3&#xA;channel-group 1 mode active&#xA;description &quot;MDF&quot;&#xA;switchport mode trunk&#xA;voice vlan dscp 1&#xA;exit&#xA;!&#xA;interface Te2/0/4&#xA;channel-group 2 mode active&#xA;description &quot;IDF&quot;&#xA;switchport mode trunk&#xA;voice vlan dscp 1&#xA;exit&#xA;!&#xA;interface port-channel 1&#xA;classofservice trust ip-dscp&#xA;switchport mode trunk&#xA;exit&#xA;!&#xA;interface port-channel 2&#xA;classofservice trust ip-dscp&#xA;switchport mode trunk&#xA;exit&#xA;!&#xA;snmp-server engineid local 800002a203d067e5d1a2e3&#xA;snmp-server community &quot;dev1&quot; ro ipaddress 10.10.10.169&#xA;snmp-server community &quot;nagios&quot; ro ipaddress 10.10.10.31&#xA;snmp-server host 10.10.10.31 traps version 2 &quot;nagios&quot;&#xA;enable password password_removed encrypted&#xA;exit&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MDF Config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;!Current Configuration:&#xA;!System Description &quot;PowerConnect 6248P, 3.3.8.2, VxWorks 6.5&quot;&#xA;!System Software Version 3.3.8.2&#xA;!Cut-through mode is configured as disabled&#xA;!&#xA;configure&#xA;vlan database&#xA;vlan 10-15&#xA;exit&#xA;hostname &quot;MDF&quot;&#xA;sntp unicast client enable&#xA;sntp server 10.10.10.242&#xA;clock timezone -5 minutes 0&#xA;stack&#xA;member 1 5&#xA;member 2 5&#xA;member 3 5&#xA;exit&#xA;ip address 10.11.10.31 255.255.255.0&#xA;ip default-gateway 10.11.10.1&#xA;ip address vlan 10&#xA;no ip helper enable&#xA;interface vlan 10&#xA;name &quot;Servers&quot;&#xA;exit&#xA;interface vlan 11&#xA;name &quot;Endpoint&quot;&#xA;exit&#xA;interface vlan 12&#xA;name &quot;Voice&quot;&#xA;exit&#xA;interface vlan 13&#xA;name &quot;Guest&quot;&#xA;exit&#xA;interface vlan 14&#xA;name &quot;Security Cameras&quot;&#xA;exit&#xA;username &quot;admin&quot; password password_removed level 15 encrypted&#xA;voice vlan&#xA;ip ssh server&#xA;bridge multicast filtering&#xA;ip igmp snooping&#xA;!&#xA;interface ethernet 2/g14&#xA;classofservice trust ip-dscp&#xA;switchport mode general&#xA;switchport general pvid 11&#xA;switchport general allowed vlan add 11&#xA;switchport general allowed vlan add 12 tagged&#xA;switchport general allowed vlan remove 1&#xA;voice vlan 12&#xA;exit&#xA;!&#xA;interface ethernet 3/g46&#xA;classofservice trust ip-dscp&#xA;switchport mode general&#xA;switchport general pvid 11&#xA;switchport general allowed vlan add 11&#xA;switchport general allowed vlan add 12 tagged&#xA;switchport general allowed vlan remove 1&#xA;voice vlan 12&#xA;exit&#xA;!&#xA;interface ethernet 3/xg3&#xA;channel-group 1 mode auto&#xA;switchport mode general&#xA;switchport general allowed vlan add 10-14&#xA;exit&#xA;!&#xA;interface port-channel 1&#xA;classofservice trust ip-dscp&#xA;switchport mode general&#xA;switchport general allowed vlan add 10-15 tagged&#xA;exit&#xA;snmp-server community daniel ro ipaddress 10.10.10.129&#xA;snmp-server community nagios ro ipaddress 10.10.10.31&#xA;snmp-server host 10.10.10.31 nagios traps v2&#xA;exit&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Puf9h.jpg&quot; alt=&quot;Current network layout&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3449" LastEditorUserId="3449" LastEditDate="2014-02-10T15:07:14.203" LastActivityDate="2014-04-15T23:48:34.357" Title="Setting up PIM Sparse mode" Tags="|vlan|multicast|dell|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5344" PostTypeId="1" AcceptedAnswerId="5345" CreationDate="2013-12-06T15:25:40.330" Score="6" ViewCount="5755" Body="&lt;p&gt;Within a typical service provider environment I can see how broadcast and multicast storm control can be useful. I am confused regarding unicast storm control though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading the Cisco docs online they give examples such as protecting against port flooding if the destination MAC of an incoming frame isn't in the CAM tables. This makes good sense to me. So does &lt;code&gt;storm-control unicast&lt;/code&gt; only measure the pps rate (or bps rate) of frames that are for destinations not in the CAM tables, or all destinations that aren't a broadcast or multicast address (so just the total number of unicast frames)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm worried that configuring such a feature could shut a port down that shouldn't be shut down simply because it has a high pps rate. An example of this is ports with voice services attached that have high frame rates but are low bpp rates of unicast frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this feature only measuring the frame/packet rate of unknown destination addresses or all unicast frames, what are the dangers here?&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2015-02-16T22:44:47.517" Title="Cisco: storm-control unicast" Tags="|cisco|security|layer2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5345" PostTypeId="2" ParentId="5344" CreationDate="2013-12-06T15:37:09.110" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So does storm-control unicast only measure the pps rate (or bps rate) of frames that are for destinations not in the CAM tables, or all destinations that aren't a broadcast or multicast address (so just the total number of unicast frames)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I have to confess that I mistakenly trusted the Nexus doc below which said only unknown unicast is rate-limited; however, that's definitely wrong for Cisco IOS.  The reality is (at least on IOS platforms) that unicast storm control affects &lt;em&gt;all unicast traffic&lt;/em&gt;; the Cisco Nexus doc I quoted said it only affected traffic that was unknown unicast.  I will endeavor to test on Nexus at a later date.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an effort to atone for my mistake, I built a quick screencast of what happens when I:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configure a Cisco IOS switch with unicast storm-control to throttle at 1Mbps.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;https://github.com/sivel/speedtest-cli&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;speedtest_cli.py&lt;/code&gt;&lt;/a&gt; to start a unicast download from speedtest.net&lt;/li&gt;&#xA;&lt;li&gt;Reconfigure the switch without unicast storm control&lt;/li&gt;&#xA;&lt;li&gt;Download from speedtest.net again...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Hit your refresh button to restart the screencast at the beginning&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/eToC8.gif&quot; alt=&quot;storm-control screencast&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Bottom line&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Unicast storm-control affects all unicast traffic in Cisco IOS&lt;/li&gt;&#xA;&lt;li&gt;Unicast storm-control is applied on traffic &lt;em&gt;inbound to the switchport&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;My Original quote from the Nexus docs, which I applied to the OP's Cisco 2960&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt;&#xA;Quoting the &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli_rel_4_0_1a/traffstorm.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Nexus Storm Control Docs&lt;/a&gt; (emphasis mine):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;You can use the traffic storm control feature to prevent disruptions on Layer 2 ports by a broadcast, multicast, or &lt;em&gt;unknown unicast traffic storm&lt;/em&gt; on physical interfaces. &quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Storm control operates the same way across Cisco platforms; if the destination-mac-address is not in the CAM table, then then the switch must flood it out all ports in the Vlan (except the one it came in on).  Suffient quantities of this kind of traffic would trigger your Unicast Storm Control thresholds.&lt;/strike&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-02-16T22:44:47.517" LastActivityDate="2015-02-16T22:44:47.517" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5346" PostTypeId="2" ParentId="5343" CreationDate="2013-12-06T15:37:15.720" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My questions are:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Should we setup on our core network switch OSPF with a router ID of 1.1.1.1 and then not set any OSPF settings on any other switch?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;OSPF is not necessary for this implementation. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would PIM Sparse Mode only need to be enabled on the core switches or on all of the switches in the network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Pim-SM needs to be enabled on each L3 interface on which you want to allow the multicast traffic. For example, if you wish to contain the traffic to Vlans 15 and 14, you would have to do the following on your core:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure&#xA;ip multicast&#xA;ip igmp&#xA;ip pim sparse&#xA;interface vlan 14&#xA;ip igmp&#xA;ip pim&#xA;interface vlan 15&#xA;ip igmp&#xA;ip pim&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want the traffic to traverse all Vlans, then you will need the appropriate interface configuration under each Vlan. Your L2 switches will need IGMP snooping turned on (ideally on all interfaces via the global configuration).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure&#xA;ip igmp snooping &#xA;bridge multicast filtering&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For a very basic multicast setup like this, these should be the only features that you would need.&lt;/p&gt;&#xA;" OwnerUserId="3210" LastEditorUserId="3210" LastEditDate="2013-12-06T19:06:56.133" LastActivityDate="2013-12-06T19:06:56.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5347" PostTypeId="2" ParentId="5343" CreationDate="2013-12-06T16:02:54.317" Score="1" Body="&lt;p&gt;You also need to set up a PIM RP since you only have 1 routing device you do not need to support auto-rp or bsr&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip pim rp-address rp-address [access-list]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the access-list has the multicast IP range so &#xA;access-list 10 239.192.0.0 0.0.255.255&#xA;would make the 4900m the RP for the private multicast address range&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-12-06T16:02:54.317" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5348" PostTypeId="1" CreationDate="2013-12-06T16:24:10.653" Score="5" ViewCount="500" Body="&lt;p&gt;I want to configure a Cisco 881W to deliver Corporate wired and wireless connectivity, plus Guest wireless connectivity on a second SSID, connected to the core by a site-site VPN. I was expecting to have to use VRFs to separate the Corporate and Guest traffic into their own routing domains, but that's out of my area of experience when running over a vpn backhaul. However, I have read some things about &quot;protected&quot; ports and believe that data ingressing from one protected port will not egress over another protected port. This could make my config much simpler and easier to maintain if my understanding is right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone out there got specific knowledge of the &quot;protected&quot; command, and are my assumptions above anywhere near the mark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a corollory, I was looking at &quot;protected&quot; because I wanted to set one port &quot;sticky&quot;, but the 881W doesn't have that command....or is it hidden? Do I REALLY have to go the hard way and use ACLs and stuff?&lt;/p&gt;&#xA;" OwnerUserId="3451" LastEditorUserId="775" LastEditDate="2013-12-06T18:13:54.703" LastActivityDate="2013-12-06T18:26:50.113" Title="&quot;Protected&quot; switchports on a Cisco 881W" Tags="|cisco|router|switch|cisco-commands|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5349" PostTypeId="1" AcceptedAnswerId="5352" CreationDate="2013-12-06T16:50:43.757" Score="9" ViewCount="2155" Body="&lt;p&gt;Preparing for CCNP, doing some lab work.  ZEUS is summarizing two loopbacks with &lt;code&gt;area 2 range 172.16.2.0 255.255.254.0&lt;/code&gt;, and the summary route is arriving on router 'WODAN' but the subordinate routes (2 /32's) are also still showing up in WODAN's ip routing table.  Why?  My understanding was that once the summarization occurred that the normal T3 LSA's would not be sent, instead a summary T3 would be sent by the ABR (zeus in this case)?  I can't understand why I still see /32's if the summary is received on WODAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the &lt;a href=&quot;https://i.stack.imgur.com/dl7Os.jpg&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;imgur diagram and screen captures&quot;&gt;topology and relevant command outputs&lt;/a&gt; for the two routers in question.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;a href=&quot;https://i.stack.imgur.com/ItHro.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Topology Diagram&lt;/a&gt;&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ItHro.png&quot; width=&quot;400&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;a href=&quot;https://i.stack.imgur.com/gRLy8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;ZEUS Configuration&lt;/a&gt;&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gRLy8.png&quot; width=&quot;600&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;a href=&quot;https://i.stack.imgur.com/gt6X9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;WODAN routing table&lt;/a&gt;&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gt6X9.png&quot; width=&quot;600&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2013-12-06T17:51:27.450" LastActivityDate="2013-12-06T18:00:21.757" Title="Summarized OSPF routes advertised?" Tags="|cisco|routing|router|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5351" PostTypeId="2" ParentId="5348" CreationDate="2013-12-06T17:13:07.117" Score="5" Body="&lt;p&gt;To answer your only question-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;switchport protected&quot; is kind of like PVLAN-lite. Under the interface configuration of a switchport you can issue the &quot;switchport protected&quot; command. This simply prevents that port from forwarding traffic to another protected switchport. The situation you are describing is common, you can have all of your downlinks configured as protected ports so that traffic from each port can only be forwarded out an uplink interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, 881's do no support this configuration because they don't have all the features available on Cisco's dedicated ethernet switches. &lt;/p&gt;&#xA;" OwnerUserId="3210" LastEditorUserId="775" LastEditDate="2013-12-06T18:26:50.113" LastActivityDate="2013-12-06T18:26:50.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5352" PostTypeId="2" ParentId="5349" CreationDate="2013-12-06T17:15:39.473" Score="9" Body="&lt;p&gt;The short answer is because ZEUS (which is summarizing) is summarizing for Area 2, but it also shares Area 2 with WODAN.  OSPF requires all routers in an area to have the same exact copy of the area's link-state database; OSPF ABRs run a separate SPF algorithm calculation for each area they participate in.&lt;/p&gt;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328 - Open Shortest Path First&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;...&lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;...&lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;...&lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;Functional Summary&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;A separate copy of OSPF's basic routing algorithm runs in each area.&#xA;Routers having interfaces to multiple areas run multiple copies of&#xA;the algorithm.&lt;/p&gt;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&lt;p&gt;12.2.  The link state database&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   A router has a separate link state database for every area to&#xA;   which it belongs. All routers belonging to the same area have&#xA;   identical link state databases for the area.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You can verify this with:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;WODAN# show ip ospf database | i ID|Area|Link|172.16.2&#xA;...&#xA;            OSPF Router with ID (2.2.2.2) (Process ID 1)&#xA;                Summary Net Link States (Area 0)&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;172.16.2.0      3.3.3.3         1721        0x80007657 0x006E08 1&#xA;...&#xA;            OSPF Router with ID (2.2.2.2) (Process ID 1)&#xA;                Router Link States (Area 2)&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;172.16.2.2      3.3.3.3         1721        0x80007657 0x00640F 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I mocked that output up from experience, but I expect you to see:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The Network Summary LSA for 172.16.2.0 in Area 0&lt;/li&gt;&#xA;&lt;li&gt;The Router LSA containing 172.16.2.2 in Area 2 (I made the assumption that 172.16.2.2 is the Router LSA's ID)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Since 172.16.2.2 still exists in the OSPF LSDB, OSPF installs a route for it.  Note that there is a difference between 172.16.2.2/32 and 172.16.2.0/23 in the output of &lt;code&gt;show ip route&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;172.16.2.0/23 is an &lt;code&gt;O IA&lt;/code&gt; route (&lt;code&gt;IA&lt;/code&gt; means Inter-Area, generated by a Type 3 Network Summary LSA)&lt;/li&gt;&#xA;&lt;li&gt;172.16.2.2/32 is an &lt;code&gt;O&lt;/code&gt; route, if there are no letters following the &lt;code&gt;O&lt;/code&gt;, then the route comes from a Router LSA, also called Type 1 LSA&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;A final side note that you didn't explicitly mention... you configured ZEUS'  Loopbacks with 24-bit masks; however, due to &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_q_and_a_item09186a0080094704.shtml#qone&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;OSPF advertises all loopbacks as /32 host routes&quot;&gt;the way OSPF handles loopbacks&lt;/a&gt;, those loopbacks are advertised as host routes.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2013-12-06T18:00:21.757" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5353" PostTypeId="2" ParentId="5338" CreationDate="2013-12-06T19:36:20.040" Score="0" Body="&lt;p&gt;For web management interfaces and the like, I have always found firefox to be the most compatible (least buggy) at interpreting HTML from various vendors and devices. However, I do not regularly use this browser personally, only professionally. &lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-12-06T19:36:20.040" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5354" PostTypeId="2" ParentId="2068" CreationDate="2013-12-06T23:11:08.507" Score="1" Body="&lt;p&gt;My experience has been that more than one SSID on a VLAN, each with a different type of encryption, is not possible on an autonomous AP (12.4(x)).  We do it all the time on WLC-controlled lightweight APs.  For instance, one SSID with WPA2-Enterprise with 802.1x PEAP-MSCHAPv2 and AES encryption, a second SSID with WPA pre-shared key with TKIP encryption, and a third SSID with WEP-128.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you can question the propriety of doing this on one VLAN, but it works.  One justification is that you must use some old devices along with modern devices.  Configure the old devices with the older auth and encryption methods and config the modern devices with the newest methods.  Once you get rid of the older devices you can delete the old SSIDs and your modern devices don't have to change.  Better than using WEP-128 as the lowest common denominator for everyone right from the start.&lt;/p&gt;&#xA;" OwnerUserId="3454" LastActivityDate="2013-12-06T23:11:08.507" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5355" PostTypeId="1" AcceptedAnswerId="5356" CreationDate="2013-12-07T00:36:09.297" Score="9" ViewCount="3887" Body="&lt;p&gt;My new BGP upstream has allocated a IPv4 /30 netblock as the glue block for connecting our routers. I however want to run two routers, and failover between them. If the netblock was larger (/29), I could easily run BGP sessions from both of my routers, with or without VRRP (they could run VRRP too).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a reasonable VRRP/keepalived failover configuration that I can implement without getting them to expand the glue block?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of my routers are running Linux (one Ubuntu, one Gentoo), with Quagga; the basic configuration works fine.&lt;/p&gt;&#xA;" OwnerUserId="3455" LastActivityDate="2013-12-07T16:25:36.193" Title="How to run redundant BGP via Quagga on /30 netblock?" Tags="|bgp|vrrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5356" PostTypeId="2" ParentId="5355" CreationDate="2013-12-07T01:41:58.207" Score="8" Body="&lt;p&gt;You have multiple Linux solutions for first hop redundancy out of your LAN to the two routers (Quagga itself doesn't support VRRP but you can use Quagga in conjunction with any of these without any issues):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.keepalived.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;keepalived&lt;/a&gt; (as you've already mentioned)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.pureftpd.org/project/ucarp&quot; rel=&quot;nofollow noreferrer&quot;&gt;uCARP&lt;/a&gt; - A Linux port of OpenBSD's CARP (Common Address Redundancy Protocol)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://off.net/%7Ejme/vrrpd/&quot; rel=&quot;nofollow noreferrer&quot;&gt;vrrpd&lt;/a&gt; - A sparsely documented and largely untested VRRP daemon, but an option nonetheless&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Note that none of these have anything to do with BGP redundancy, which I believe is the real problem you're trying to solve. However, it should be quite possible to run VRRP on the provider side of your two Quagga hosts and configure the VRRP virtual IP as &amp;quot;your side&amp;quot; of your ISP-assigned /30 and use that to peer with your ISP. The failover time would likely be close to the same (if not just a hair faster than) the solution with Linux-HA below. With that said, I'd personally believe that the Linux-HA solution would be cleaner and simpler, but this also may depend on the topology.&lt;/p&gt;&#xA;&lt;p&gt;As for your options with BGP, there is an &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-idr-bgp-multisession-07&quot; rel=&quot;nofollow noreferrer&quot;&gt;IETF draft for &amp;quot;multisesssion BGP&amp;quot;&lt;/a&gt; that introduces a new BGP capability code which aims to support multiple BGP sessions with the same peer over the same address, but this draft assumes that both of the sessions would be on the same device, however the draft is brand new and support for this is not likely to be in current revisions of Quagga.&lt;/p&gt;&#xA;&lt;p&gt;One other option is to use &lt;a href=&quot;http://www.linux-ha.org/doc/users-guide/users-guide.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Linux-HA&lt;/a&gt; to set up a heartbeat cluster between your two boxes, and configure it as such so that if the primary router fails, the heartbeat will recognize this and turn up Quagga/BGPd/etc on the standby router when that happens.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2013-12-07T16:25:36.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5357" PostTypeId="1" CreationDate="2013-12-07T14:18:23.687" Score="-1" ViewCount="916" Body="&lt;p&gt;I am always getting confused with the statement &quot;Rip protocol maximum diamter is 15&quot; i.e maximum mteric for a route is 15 and metric with 16 is considered as inavlid .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any reason for rip having maximum mteric is 15 ?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastActivityDate="2013-12-07T16:30:29.663" Title="Any reason for rip maximum metric is 15?" Tags="|protocol-theory|rip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5358" PostTypeId="2" ParentId="5357" CreationDate="2013-12-07T16:22:12.650" Score="4" Body="&lt;p&gt;There isn't what I'd call a &quot;hard reason&quot; - ie something specific relating to hardware/software limitations. Ultimately it was a judgment call made by the designers of the protocol, who made this judgment call based on the convergence behavior of the protocol (slow), the &quot;counting to infinity&quot; problem, and ultimately they didn't believe RIP would be &quot;practical&quot; for networks with a diameter larger than 15.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1.1. Limitations of the protocol&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This protocol does not solve every possible routing problem.  As&#xA;    mentioned above, it is primary intended for use as an IGP, in&#xA;    reasonably homogeneous networks of moderate size.  In addition, the&#xA;    following specific limitations should be mentioned:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; - The protocol is limited to networks whose longest path&#xA;   involves 15 hops.  The designers believe that the basic&#xA;   protocol design is inappropriate for larger networks.  Note&#xA;   that this statement of the limit assumes that a cost of 1&#xA;   is used for each network.  This is the way RIP is normally&#xA;   configured.  If the system administrator chooses to use&#xA;   larger costs, the upper bound of 15 can easily become a&#xA;   problem.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;br&gt;&#xA;   2. Distance Vector Algorithms&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;br&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;As we mentioned above, the purpose of routing is to find a way to get&#xA;    datagrams to their ultimate destinations.  Distance vector algorithms&#xA;    are based on a table giving the best route to every destination in&#xA;    the system.  Of course, in order to define which route is best, we&#xA;    have to have some way of measuring goodness.  This is referred to as&#xA;    the &quot;metric&quot;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In simple networks, it is common to use a metric that simply counts&#xA;    how many gateways a message must go through.  In more complex&#xA;    networks, a metric is chosen to represent the total amount of delay&#xA;    that the message suffers, the cost of sending it, or some other&#xA;    quantity which may be minimized.  The main requirement is that it&#xA;    must be possible to represent the metric as a sum of &quot;costs&quot; for&#xA;    individual hops.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that at the time of its conception, the protocol was designed to operate on small, homogeneously (read: very slow serial links) connected networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of this information is in the original RIP RFC, &lt;a href=&quot;http://tools.ietf.org/search/rfc1058&quot; rel=&quot;nofollow&quot;&gt;RFC 1058&lt;/a&gt;, which is readily available via a google search - it'd be great if you got the hint and started doing that instead of making this site the default go-to for these questions which have answers that are easily found with minimal research effort on your part.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="775" LastEditDate="2013-12-07T16:30:29.663" LastActivityDate="2013-12-07T16:30:29.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5364" PostTypeId="1" AcceptedAnswerId="5365" CreationDate="2013-12-09T00:14:14.573" Score="12" ViewCount="5425" Body="&lt;p&gt;&lt;strong&gt;The Problem&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A third party has implemented a small network and private BGP setup within one of our branches. We need to setup a eBGP peer relationship with this network. However we are both using the same private BGP AS number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Solution&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;em&gt;One of us changes our BGP AS number&lt;/em&gt; - This isn't out of the question, and even if there is another solution but its overly complex we may still do this. &lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;BGP Confederation&lt;/em&gt; - In my research it appears that setting up a BGP Confederation between the peers might be a work around. The basic idea would be to sub-divide the shared private AS number into multiple private AS numbers. I'm not entirely sure yet whether this would solve the problem properly.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Other solutions&lt;/em&gt;? It is here I'm looking for more advice on whether it is possible to work around this problem is an effective way.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2951" LastActivityDate="2013-12-09T07:32:38.417" Title="Is it possible to connect two private eBGP peers with the same AS number?" Tags="|cisco|routing|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5365" PostTypeId="2" ParentId="5364" CreationDate="2013-12-09T00:36:19.913" Score="14" Body="&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 1 is likely your best bet for simplicity's sake, but you &lt;em&gt;can&lt;/em&gt; use the confederation method if you don't want to change the ASN. You can also do &lt;code&gt;neighbor x.x.x.x local-as &amp;lt;as&amp;gt;&lt;/code&gt; in the BGP config but this prepends an ASN of your choosing onto the path, rather than replace the ASN in the path, so updates from one router to the other would be dropped anyway. Unless there's a &lt;em&gt;really&lt;/em&gt; good reason as to why you want to maintain the eBGP session, you can also migrate to an iBGP session vs eBGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @DanielDib has pointed out below, a third option (if you're running a version of IOS that supports it) is to use &lt;code&gt;local-as&lt;/code&gt; in conjunction with &lt;code&gt;replace-as&lt;/code&gt; and &lt;code&gt;no-prepend&lt;/code&gt; to strip your ASN from the AS_PATH and send a different one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp [your asn]&#xA;  neighbor x.x.x.x remote-as [peer-asn]&#xA;  neighbor x.x.x.x local-as [new asn] no-prepend replace-as&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-12-09T07:32:38.417" LastActivityDate="2013-12-09T07:32:38.417" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5366" PostTypeId="1" AcceptedAnswerId="5369" CreationDate="2013-12-09T06:44:41.370" Score="3" ViewCount="1797" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rmssi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am having a big question regarding Poison reverse concept .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here from the picture The Link between A and T is broken .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now A sends a Triggered update to B and E immediately , and B , E sends the route back to the A .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the question , B and E will send the poison route only to A or they will send the entire database  and how will be the communication between E ,D and B,C ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;If the Router C sends an update to B with metric 4 then B accepts it ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="2736" LastEditDate="2013-12-09T08:57:24.677" LastActivityDate="2013-12-09T10:23:38.457" Title="Regarding Route Poison in RIP protocol" Tags="|protocol-theory|rip|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5367" PostTypeId="2" ParentId="5366" CreationDate="2013-12-09T08:18:14.230" Score="3" Body="&lt;p&gt;Poison reverse is an extra add-on to the split horizon rule that overrides split horizon in cases exactly like you describe. The route with the infinite metric is sent from A to B and E, and from B and E to their connected neighbors, including A. The whole point is to get the entire network into a converged understanding that T and any networks behind it are no longer reachable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a quote from &lt;a href=&quot;http://en.wikipedia.org/wiki/Split_horizon_route_advertisement&quot; rel=&quot;nofollow&quot;&gt;the Wikipedia page for split horizon&lt;/a&gt; that took me less than 5 seconds to find with a Google search (still not getting the hint are we?):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Split-horizon routing with poison reverse is a variant of split-horizon route advertising in which a router actively advertises routes as unreachable over the interface over which they were learned by setting the route metric to infinite (16 for RIP). The effect of such an announcement is to immediately remove most looping routes before they can propagate through the network. The router is said to have poisoned the network by sending 'false' (infinite) metric values to other devices sharing such updates.&#xA;  The main disadvantage of poison reverse is that it can significantly increase the size of routing announcements in certain fairly common network topologies, but it allows for the improvement of the overall efficiency of the network in case of faults. Split horizon states that if a neighboring router sends a route to a router, the receiving router will not propagate this route back to the advertising router on the same interface.&#xA;  With route poisoning, when a router detects that one of its connected routes has failed, the router will poison the route by assigning an infinite metric to it and advertising it to neighbors. When a router advertises a poisoned route to its neighbors, its neighbors break the rule of split horizon and send back to the originator the same poisoned route, called a poison reverse. In order to give the router enough time to propagate the poisoned route and to ensure that no routing loops occur while propagation occurs, the routers implement a hold-down mechanism.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-12-09T08:26:20.307" LastActivityDate="2013-12-09T08:26:20.307" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5368" PostTypeId="1" AcceptedAnswerId="5717" CreationDate="2013-12-09T08:52:42.483" Score="4" ViewCount="1788" Body="&lt;p&gt;I have two sites. Site 1 has a router with a public IP &lt;code&gt;A.B.C.D&lt;/code&gt; as well as a private range &lt;code&gt;192.168.13.0/24&lt;/code&gt;. The router also occupies the private IP &lt;code&gt;192.168.13.1&lt;/code&gt;. Site 2 is a single host with a public IP &lt;code&gt;X.Y.Z.W&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that site 2 is behind a firewall not under my control. As a result, site 2 can access site 1 at &lt;code&gt;A.B.C.D&lt;/code&gt; but site 1 cannot access site 2 directly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To work around the limitation, I configured site 2 to connect to site 1's router over an OpenVPN tunnel, and using &lt;code&gt;iproute2&lt;/code&gt; source policy routing to redirect traffic from the private range (except the router itself) to &lt;code&gt;X.Y.Z.W&lt;/code&gt; to go through the tunnel. For example, I have to use the following command on the router at site 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip rule add from 192.168.13.32/27 to X.Y.Z.W lookup vpn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to redirect traffic from the block &lt;code&gt;192.168.13.32/27&lt;/code&gt; to &lt;code&gt;X.Y.Z.W&lt;/code&gt; to consult the routing table &lt;code&gt;vpn&lt;/code&gt; in which the default gate is the OpenVPN endpoint. I have to use source policy routing to exclude the router (which is at &lt;code&gt;192.168.13.1&lt;/code&gt;), otherwise the VPN traffic would not be routed back to &lt;code&gt;X.Y.Z.W&lt;/code&gt; correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far everything is working fine, but I'm not very happy with the source policy routing because it requires me to change the &lt;code&gt;ip rule&lt;/code&gt; every time private range &lt;code&gt;192.168.13.0/24&lt;/code&gt; is changed, or more sub-blocks is added. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering if there is any easier way to make &lt;code&gt;X.Y.Z.W&lt;/code&gt; available to site 1's private range without using source policy routing? &lt;/p&gt;&#xA;" OwnerUserId="3469" LastActivityDate="2014-01-07T10:43:40.373" Title="Routing to public IPs behind firewall with VPN" Tags="|routing|vpn|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5369" PostTypeId="2" ParentId="5366" CreationDate="2013-12-09T10:23:38.457" Score="8" Body="&lt;p&gt;I did a lab to test the behaviour with the same topology as yours. &lt;strong&gt;R1&lt;/strong&gt; is announcing three networks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.1.1.1/32&#xA;2.2.2.2/32&#xA;3.3.3.3/32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KB8CP.png&quot; alt=&quot;RIP lab&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1&lt;/strong&gt; is sending full updates towards R2. This is the final update before shutting down Lo0 which has the IP 1.1.1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JOfl4.png&quot; alt=&quot;RIP Capture1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1&lt;/strong&gt; then sends a triggered update:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:22:37.797: %LINK-5-CHANGED: Interface Loopback0, changed state to administratively down&#xA;Dec  9 10:22:37.809: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/0 (12.12.12.1)&#xA;Dec  9 10:22:37.809: RIP: build flash update entries&#xA;Dec  9 10:22:37.809:    1.1.1.1/32 via 0.0.0.0, metric 16, tag 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1&lt;/strong&gt; is just poisoning that route. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zXO87.png&quot; alt=&quot;R1 poisons route&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1&lt;/strong&gt; also receives the poisoned route back from &lt;strong&gt;R2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:22:39.853: RIP: received v2 update from 12.12.12.2 on FastEthernet0/0&#xA;Dec  9 10:22:39.853:      1.1.1.1/32 via 0.0.0.0 in 16 hops  (inaccessible)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1&lt;/strong&gt; sends a full update later at its regular interval (30 seconds).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:23:01.276: RIP: sending v2 update to 224.0.0.9 via FastEthernet0/0 (12.12.12.1)&#xA;Dec  9 10:23:01.276: RIP: build update entries&#xA;Dec  9 10:23:01.276:    1.1.1.1/32 via 0.0.0.0, metric 16, tag 0&#xA;Dec  9 10:23:01.280:    2.2.2.2/32 via 0.0.0.0, metric 1, tag 0&#xA;Dec  9 10:23:01.280:    3.3.3.3/32 via 0.0.0.0, metric 1, tag 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now to see what happens on the other routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R3&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:22:39.857: RIP: received v2 update from 23.23.23.2 on FastEthernet0/0&#xA;Dec  9 10:22:39.861:      1.1.1.1/32 via 0.0.0.0 in 16 hops  (inaccessible)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R3&lt;/strong&gt; then sends this towards &lt;strong&gt;R4&lt;/strong&gt; and &lt;strong&gt;R2&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:22:41.861: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/0 (23.23.23.3)&#xA;Dec  9 10:22:41.861: RIP: build flash update entries&#xA;Dec  9 10:22:41.861:    1.1.1.1/32 via 0.0.0.0, metric 16, tag 0&#xA;Dec  9 10:22:41.865: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/1 (34.34.34.3)&#xA;Dec  9 10:22:41.865: RIP: build flash update entries&#xA;Dec  9 10:22:41.865:    1.1.1.1/32 via 0.0.0.0, metric 16, tag 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R4&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:22:41.916: RIP: received v2 update from 34.34.34.3 on FastEthernet0/0&#xA;Dec  9 10:22:41.920:      1.1.1.1/32 via 0.0.0.0 in 16 hops  (inaccessible)&#xA;Dec  9 10:22:43.908: RIP: received v2 update from 45.45.45.5 on FastEthernet0/1&#xA;Dec  9 10:22:43.908:      1.1.1.1/32 via 0.0.0.0 in 16 hops  (inaccessible)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R4&lt;/strong&gt; sends it towards &lt;strong&gt;R5&lt;/strong&gt; and &lt;strong&gt;R3&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:22:43.920: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/0 (34.34.34.4)&#xA;Dec  9 10:22:43.920: RIP: build flash update entries&#xA;Dec  9 10:22:43.920:    1.1.1.1/32 via 0.0.0.0, metric 16, tag 0&#xA;Dec  9 10:22:43.924: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/1 (45.45.45.4)&#xA;Dec  9 10:22:43.924: RIP: build flash update entries&#xA;Dec  9 10:22:43.924:    1.1.1.1/32 via 0.0.0.0, metric 16, tag 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R5&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:22:41.888: RIP: received v2 update from 56.56.56.6 on FastEthernet0/1&#xA;Dec  9 10:22:41.888:      1.1.1.1/32 via 0.0.0.0 in 16 hops  (inaccessible)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R5&lt;/strong&gt; sends it towards &lt;strong&gt;R6&lt;/strong&gt; and &lt;strong&gt;R4&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:22:43.891: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/0 (45.45.45.5)&#xA;Dec  9 10:22:43.891: RIP: build flash update entries&#xA;Dec  9 10:22:43.891:    1.1.1.1/32 via 0.0.0.0, metric 16, tag 0&#xA;Dec  9 10:22:43.895: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/1 (56.56.56.5)&#xA;Dec  9 10:22:43.895: RIP: build flash update entries&#xA;Dec  9 10:22:43.895:    1.1.1.1/32 via 0.0.0.0, metric 16, tag 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R6&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:22:39.869: RIP: received v2 update from 26.26.26.2 on FastEthernet0/0&#xA;Dec  9 10:22:39.869:      1.1.1.1/32 via 0.0.0.0 in 16 hops  (inaccessible)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R6&lt;/strong&gt; sends it towards &lt;strong&gt;R2&lt;/strong&gt; and &lt;strong&gt;R5&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:22:41.873: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/0 (26.26.26.6)&#xA;Dec  9 10:22:41.873: RIP: build flash update entries&#xA;Dec  9 10:22:41.873:    1.1.1.1/32 via 0.0.0.0, metric 16, tag 0&#xA;Dec  9 10:22:41.877: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/1 (56.56.56.6)&#xA;Dec  9 10:22:41.877: RIP: build flash update entries&#xA;Dec  9 10:22:41.877:    1.1.1.1/32 via 0.0.0.0, metric 16, tag 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So as can be seen, the route is poisoned and sent as a flash update. This only contains the poisoned route. Later at the regular interval a full update is sent with the route included and a metric of 16.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens if another router sends the 1.1.1.1/32 network with a better metric?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R4&lt;/strong&gt; starts advertising the 1.1.1.1/32 network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4(config)#int lo0&#xA;R4(config-if)#ip add 1.1.1.1 255.255.255.255&#xA;R4(config-if)#router rip&#xA;R4(config-router)#net 1.0.0.0&#xA;&#xA;Dec  9 10:57:23.275: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up&#xA;&#xA;Dec  9 10:57:32.079: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/0 (34.34.34.4)&#xA;Dec  9 10:57:32.079: RIP: build flash update entries&#xA;Dec  9 10:57:32.079:    1.1.1.1/32 via 0.0.0.0, metric 1, tag 0&#xA;Dec  9 10:57:32.083: RIP: sending v2 flash update to 224.0.0.9 via FastEthernet0/1 (45.45.45.4)&#xA;Dec  9 10:57:32.083: RIP: build flash update entries&#xA;Dec  9 10:57:32.083:    1.1.1.1/32 via 0.0.0.0, metric 1, tag 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R5&lt;/strong&gt; installs this route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dec  9 10:57:16.771: RIP: received v2 update from 56.56.56.6 on FastEthernet0/1&#xA;Dec  9 10:57:16.771:      1.1.1.1/32 via 0.0.0.0 in 16 hops  (inaccessible)&#xA;Dec  9 10:57:16.775: RT: del 1.1.1.1/32 via 56.56.56.6, rip metric [120/3]&#xA;Dec  9 10:57:16.775: RT: delete subnet route to 1.1.1.1/32&#xA;Dec  9 10:57:16.775: RT: NET-RED 1.1.1.1/32&#xA;Dec  9 10:57:16.779: RT: delete network route to 1.0.0.0&#xA;Dec  9 10:57:16.779: RT: NET-RED 1.0.0.0/8&#xA;Dec  9 10:57:32.079: RIP: received v2 update from 45.45.45.4 on FastEthernet0/0&#xA;Dec  9 10:57:32.083:      1.1.1.1/32 via 0.0.0.0 in 1 hops&#xA;Dec  9 10:57:32.083: RT: add 1.1.1.1/32 via 45.45.45.4, rip metric [120/1]&#xA;Dec  9 10:57:32.083: RT: NET-RED 1.1.1.1/32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that this behavior is dependant on if the route has gone into hold down. To catch a route in hold down there has to be a passive failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2&lt;/strong&gt; applies an ACL towards &lt;strong&gt;R1&lt;/strong&gt; to filter out the RIP updates:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;R2(config)#ip access-list extended NO-RIP&#xA;R2(config-ext-nacl)#deny udp any any eq 520&#xA;R2(config-ext-nacl)#permit ip any any&#xA;R2(config-ext-nacl)#int f0/0&#xA;R2(config-if)#ip access-group NO-RIP in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It should take approximately 180 seconds before the route becomes invalid and goes into holddown. This output from &lt;strong&gt;R2&lt;/strong&gt; is the last one before it becomes invalid:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sh ip route 1.1.1.1&#xA;Routing entry for 1.1.1.1/32&#xA;  Known via &quot;rip&quot;, distance 120, metric 1&#xA;  Redistributing via rip&#xA;  Last update from 12.12.12.1 on FastEthernet0/0, 00:03:00 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 12.12.12.1, from 12.12.12.1, 00:03:00 ago, via FastEthernet0/0&#xA;      Route metric is 1, traffic share count is 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the holddown timer goes active:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sh ip route 1.1.1.1&#xA;Routing entry for 1.1.1.1/32&#xA;  Known via &quot;rip&quot;, distance 120, metric 4294967295 (inaccessible)&#xA;  Redistributing via rip&#xA;  Last update from 12.12.12.1 on FastEthernet0/0, 00:03:01 ago&#xA;  Hold down timer expires in 178 secs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the holddown has expired the route can be installed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sh ip route 1.1.1.1&#xA;Routing entry for 1.1.1.1/32&#xA;  Known via &quot;rip&quot;, distance 120, metric 1&#xA;  Redistributing via rip&#xA;  Last update from 23.23.23.3 on FastEthernet0/1, 00:00:07 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 23.23.23.3, from 23.23.23.3, 00:00:07 ago, via FastEthernet0/1&#xA;      Route metric is 1, traffic share count is 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion:&lt;/strong&gt; When an interface goes down, a triggered flash update is sent poisoning that route with a metric of 16. This update is sent out all RIP enabled interfaces. Because the route is poisoned, the routers are free to install other routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the route is not poisoned and instead relying on timers then the holddown timer of 180 seconds must expire first before other routes can be installed.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2013-12-09T10:23:38.457" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5370" PostTypeId="1" AcceptedAnswerId="5374" CreationDate="2013-12-09T12:58:41.587" Score="3" ViewCount="2464" Body="&lt;p&gt;Hi for a school project I have to build a network this is the current situation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/b44m5.png&quot; alt=&quot;Situation&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping between 172.16.0.0/19, 172.16.32.0/19 and 172.16.64.0/19. I &lt;em&gt;can&lt;/em&gt; ping from my router (172.16.128.15) to those 3 networks and I &lt;em&gt;can&lt;/em&gt; ping from 172.16.32.0 and 64.0 to the router on 172.16.128.15.  However, I &lt;em&gt;can't&lt;/em&gt; ping from 172.16.32.0/19 and 172.16.64/19 to the DMZ and internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rules on Firewall/Router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Static routes: &#xA;route 172.16.0.0/19 next-hop 172.16.128.101 &#xA;route 172.16.32.0/19 next-hop 172.16.128.101 &#xA;route 172.16.64.0/19 next-hop 172.16.128.101 &#xA;route 172.16.96.0/19 next-hop 172.16.96.1&#xA;route 172.16.128.0/19 next-hop 172.16.128.15 &#xA;route 172.16.160.0/19 next-hop 172.16.128.101&#xA;&#xA;nat rule: &#xA;outbound-interface eth0 source address 0.0.0.0 type masquerade&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following static routes I have on my router in 172.16.32.0/19 subnet&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172.16.0.0 mask 255.255.224.0 172.16.160.6&#xA;172.16.32.0 mask 255.255.224.0 172.16.32.3&#xA;172.16.64.0 mask 255.255.224.0 172.16.160.7&#xA;172.16.128.0 mask 255.255.224.0 172.160.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yes indeed router 2 and router 3 are missing 172.16.96.0 mask 255.255.224.0 172.16.128.15 and 0.0.0.0 mask 0.0.0.0 172.16.128.15. But when I add those it still doesn't work. So where can it go wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On DC1 and router1 everything works fine towards the outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I access the internet from subnet 172.16.32.0 and 172.16.64.0?&lt;/p&gt;&#xA;" OwnerUserId="3470" LastEditorUserId="775" LastEditDate="2013-12-09T13:31:50.327" LastActivityDate="2013-12-09T15:12:59.040" Title="Static routes between 3 windows routers and vyatta" Tags="|routing|router|linux|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5374" PostTypeId="2" ParentId="5370" CreationDate="2013-12-09T15:12:59.040" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Yes indeed router 2 and router 3 are missing 172.16.96.0 mask 255.255.224.0 172.16.128.15 and 0.0.0.0 mask 0.0.0.0 172.16.128.15. But when I add those it still doesn't work. So where can it go wrong?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The routes you proposed are incorrect according to the diagram you provided, the routes you need to configure on R2 and R3 are&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.0.0.0 0.0.0.0 172.16.160.6&#xA;172.16.96.0 255.255.224.0 172.16.160.6 (you don't need this route actually but I'm including it anyway).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason for this is that R2 and R3 do not have an interface connected to the 172.16.128.1/19 network, only R1 does. Since that network is not directly connected to R2 or R3, you cannot use it as a &quot;next hop&quot; for your static routes - it is not the next hop. R2 and R3 would have to forward traffic to R1 to reach the internet first, so it must be configured as the gateway for the default routes on R2 and R3. &lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-12-09T15:12:59.040" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5377" PostTypeId="1" AcceptedAnswerId="5378" CreationDate="2013-12-09T17:04:32.370" Score="1" ViewCount="775" Body="&lt;p&gt;We have been assigned a block of 64 IP's by ARIN (/26).  We have a private range that is a /22.  Every time we get a new block of public IP's we NAT them to the next available addresses in that range, so no new private subnets being made for this new /26 block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: how many will be usable by hosts?  Normally I'd say 61 (1 for network, 1 for gateway, 1 for broadcast) but with a public block not sure.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2013-12-09T17:36:00.127" LastActivityDate="2013-12-09T17:49:46.060" Title="Block of 64 public IP's, how many usable?" Tags="|nat|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5378" PostTypeId="2" ParentId="5377" CreationDate="2013-12-09T17:49:46.060" Score="4" Body="&lt;p&gt;IP addresses are IP addresses are IP addresses.  Until (and unless!) you end up with an assignment of IP addresses in an ethernet (or ethernet-like) network, there is no concept of &quot;network address&quot; &quot;broadcast address&quot; and the like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT functions are not &quot;an ethernet(-like) network&quot;, so all IP addresses in a block like that are usable in a NAT configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a very strong argument to be made for not setting NAT configurations up like that, though.  If you're just mapping one set of IP addresses up as 1-1 NAT mappings to another &quot;private&quot; (air-quotes intended) set of IP addresses, then why not just assign the public addresses directly onto the systems and eliminate the NAT altogether?&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2013-12-09T17:49:46.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5381" PostTypeId="1" AcceptedAnswerId="5382" CreationDate="2013-12-09T20:03:58.837" Score="3" ViewCount="4463" Body="&lt;p&gt;I can't achieve good transfer rate through scp and I wonder if the network configuration isn't tuned up correctly. I've noticed some differences when running iperf through tcp vs udp. &#xA;Are these results normal for two PC's in the same gigabit ethernet lan? &#xA;This is the output from the server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./iperf -s&#xA;------------------------------------------------------------&#xA;Server listening on TCP port 5001&#xA;TCP window size:  128 KByte (default)&#xA;------------------------------------------------------------&#xA;[  4] local 192.168.91.150 port 5001 connected with 192.168.91.164 port 50651&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  4]  0.0-10.0 sec   599 MBytes   501 Mbits/sec&#xA;&#xA;&#xA;./iperf -s -u -w 64K&#xA;------------------------------------------------------------&#xA;Server listening on UDP port 5001&#xA;Receiving 1470 byte datagrams&#xA;UDP buffer size: 64.0 KByte&#xA;------------------------------------------------------------&#xA;[  3] local 192.168.91.150 port 5001 connected with 192.168.91.164 port 39694&#xA;[ ID] Interval       Transfer     Bandwidth        Jitter   Lost/Total Datagrams&#xA;[  3]  0.0-30.0 sec   179 MBytes  50.0 Mbits/sec   0.386 ms    0/127660 (0%)&#xA;[  3]  0.0-30.0 sec  1 datagrams received out-of-order&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when transfering through scp:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;129MB   4.6MB/s   00:28  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Are these results coherent? Why is so much difference between UDP/TCP/SCP ( is scp supposed to go over tcp?) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3474" LastActivityDate="2016-07-15T18:07:59.353" Title="standard results for gigabit ethernet iperf" Tags="|ethernet|ipv4|performance|iperf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5382" PostTypeId="2" ParentId="5381" CreationDate="2013-12-09T21:36:07.010" Score="7" Body="&lt;p&gt;iperf testing over UDP requires the client to specify what bandwidth to send at (-b option).  So for your UDP test results listed, your iperf client was configured to push data to your server at a rate of 50 Mbits/sec.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;iperf testing over TCP sometimes requires that you adjust the TCP Window Size option (-w) to fully saturate a fast link.  Try using &quot;-w 256k&quot; on both the iPerf client and iPerf server and test again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;=-=-=-=&lt;/p&gt;&#xA;&#xA;&lt;p&gt;scp runs over TCP.  scp can be configured to encrypt and/or compress data before sending it.  Your bottleneck may be the CPU on one side of your link (do you have a way to check CPU utilization?).  You can try specifying a different encryption method or (if you trust your link) even disable encryption altogether.  You can also confirm that compression is disabled.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you trying to transfer many small files over scp?  If so, you may get better performance if you 'tar' up the small files into one big file before sending over scp.&lt;/p&gt;&#xA;" OwnerUserId="2722" LastActivityDate="2013-12-09T21:36:07.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5383" PostTypeId="2" ParentId="3290" CreationDate="2013-12-09T22:10:38.220" Score="3" Body="&lt;p&gt;You need to upgrade to the K.15 series. I also have a 3500yl-48G, and prior to K.15 I definitely saw bugs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sh mac-a&lt;/code&gt; never worked properly for me in K.14, but does in K.15.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HP-3500yl-48G# sh mac-address 46           &#xA;&#xA; Status and Counters - Port Address Table - 46&#xA;&#xA;  MAC Address   VLANs       &#xA;  ------------- ------------&#xA;  00005e-00010a 100         &#xA;  00005e-000201 100         &#xA;  00005e-000202 100         &#xA;  002283-f8dff0 100         &#xA;  f8c001-c56208 100         &#xA;&#xA;HP-3500yl-48G# sh mac-address 46 |inc 00005e-00010a&#xA; 00005e-00010a 100         &#xA;HP-3500yl-48G# sh mac-address 00005e-00010a | inc 46&#xA; 46       100 &#xA;&#xA;HP-3500yl-48G# sh version &#xA;Image stamp:    /ws/swbuildm/rel_knoxville_qaoff/code/build/btm(swbuildm_rel_knoxville_qaoff_rel_knoxville)&#xA;                Feb 28 2013 11:40:02&#xA;                K.15.12.0006&#xA;                639&#xA;Boot Image:     Secondary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3455" LastActivityDate="2013-12-09T22:10:38.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5386" PostTypeId="1" CreationDate="2013-12-10T09:45:09.670" Score="1" ViewCount="641" Body="&lt;p&gt;I have a Layer 2 RSTP network and it works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the RSTP root is on the other side of a switch which does not participate in the RSTP algorithm – and this switch has two physical connections to the RSTP root.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the non-participating switch forwards packets out on both physical connections to the RSTP root – how does the RSTP root deal with the duplicates?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Matt&lt;/p&gt;&#xA;" OwnerUserId="3482" LastEditorUserId="775" LastEditDate="2013-12-10T10:16:39.450" LastActivityDate="2015-11-21T11:33:26.767" Title="RSTP and non-participating switch" Tags="|spanning-tree|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5388" PostTypeId="1" AcceptedAnswerId="5389" CreationDate="2013-12-10T10:58:16.590" Score="7" ViewCount="7354" Body="&lt;p&gt;I have a network with Cisco switches, Cisco IP Phones and video traffic. I want to add QoS markers to my traffic but I don't want to do it manually. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally I want to use Cisco's auto QOS features but I'm not sure where I should add the commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My IP phones are on access switches and the traffic goes back to my core switch where it is routed towards several call manager servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is to do this : &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Enable QoS on all switches (access, distribution &amp;amp; core) with &quot;mls qos&quot;&lt;/li&gt;&#xA;&lt;li&gt;Enable auto QOS markings on interfaces connected to cisco ip phones with &quot;auto qos voip cisco-phone&quot;&lt;/li&gt;&#xA;&lt;li&gt;Enable auto QOS trust on network uplinks with &quot;auto qos voip trust&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is this right ? Is there anything else to do ? Should I put &quot;auto qos voip trust&quot; on network uplinks for both directions on traffic ? (forward and back) Will there be downtime to be aware of ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&#xA;Jeremy&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2013-12-10T11:23:31.967" Title="Auto-QOS configuration for Cisco network" Tags="|cisco|qos|cisco-7900-ip-phones|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5389" PostTypeId="2" ParentId="5388" CreationDate="2013-12-10T11:23:31.967" Score="9" Body="&lt;p&gt;For Cisco IP phones, you've definitely got the right configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;mls qos&#xA;!&#xA;interface UPLINK&#xA; ! Unconditionally trust all QoS markings&#xA; auto qos voip trust&#xA;!&#xA;interface ACCESS&#xA; ! Look for the Cisco Phone's CDP frames, and trust VoIP from the phone...&#xA; auto qos voip cisco-phone&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Should I put &quot;auto qos voip trust&quot; on network uplinks for both directions on traffic?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, &lt;code&gt;auto qos voip trust&lt;/code&gt; is required on both sides of any uplink for end-to-end QoS functionality (which is what you'd want, of course).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Will there be downtime to be aware of?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no downtime associated with QoS settings.  I have enabled qos (platform-wide, and on individual links) with no observable impact;  even on links that were heavily utilized, there was no perceivable downtime for transit traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more info, you can reference &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk543/tk759/technologies_white_paper09186a00801348bc.shtml#wp39463&quot;&gt;Cisco's Auto QoS Whitepaper&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2013-12-10T11:23:31.967" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5390" PostTypeId="1" CreationDate="2013-12-10T12:36:33.940" Score="3" ViewCount="235" Body="&lt;p&gt;I am using Dell switch and I looped it to itself. If I enable STP on 2 ports, what happen the port states?  I have attached the topology below.  Let me know, if you need clarification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jP5iV.png&quot; alt=&quot;https://i.stack.imgur.com/jP5iV.png&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2716" LastEditorUserId="8499" LastEditDate="2018-12-21T04:34:16.500" LastActivityDate="2018-12-21T04:34:16.500" Title="Consequences of an intra-switch Loopback cable" Tags="|switch|layer2|layer1|cable|loopback|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5391" PostTypeId="2" ParentId="5390" CreationDate="2013-12-10T13:06:17.447" Score="7" Body="&lt;p&gt;Because they have the same Bridge ID, the Port Priority will be used to determine which port to block, blocking the port with the higher Port Priority. In most STP implementations, the lower port, in this case port 1, will have a lower port priority unless port priorities are explicitly configured on the ports.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2013-12-10T13:06:17.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5392" PostTypeId="1" CreationDate="2013-12-10T14:33:49.837" Score="0" ViewCount="2002" Body="&lt;p&gt;I need to enable or disable the DHCP service on one or both of the Cisco APs in the title (well any Cisco AP if there is a standard method), running on running RHEL v15 or v16.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would very much prefer to be able to do this programmatically, or via commands; but as a last resort if necessary, it may be OK to do it interactively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hints, or pointers or, best of all, detailed instructions gratefully received. TIA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, is there a conventional sub-net IP address prefix generally used for air-side subnets, as opposed to wire-side? Or is it the usual 192.168.x.x ?&lt;/p&gt;&#xA;" OwnerUserId="3485" LastEditorUserId="3485" LastEditDate="2013-12-10T14:45:12.250" LastActivityDate="2014-03-17T16:44:22.133" Title="How do I enable a DHCP server on a Cisco Aironet 1250 series or 1260 series AP?" Tags="|cisco|cisco-commands|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5397" PostTypeId="5" CreationDate="2013-12-10T18:44:28.520" Score="0" Body="&lt;p&gt;From &lt;a href=&quot;https://www.juniper.net/us/en/products-services/switching/ex-series/&quot; rel=&quot;nofollow&quot;&gt;https://www.juniper.net/us/en/products-services/switching/ex-series/&lt;/a&gt; :&#xA;&quot;EX Series high-performance, highly available Ethernet switches are carrier-class solutions for converged enterprise branch offices, campuses, and data centers, as well as for service provider deployments.&quot;&lt;/p&gt;&#xA;" OwnerUserId="85" LastEditorUserId="85" LastEditDate="2013-12-10T19:06:03.720" LastActivityDate="2013-12-10T19:06:03.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5398" PostTypeId="4" CreationDate="2013-12-10T18:44:28.520" Score="0" Body="Juniper Networks line of Ethernet switches" OwnerUserId="85" LastEditorUserId="85" LastEditDate="2013-12-10T19:05:47.923" LastActivityDate="2013-12-10T19:05:47.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5400" PostTypeId="1" AcceptedAnswerId="5422" CreationDate="2013-12-10T18:50:01.923" Score="8" ViewCount="27186" Body="&lt;p&gt;I have a lab EX-2200 that has a config on it that I now want to replicate onto four more EX-2200's... I'm sure there's probably an easy way to do this, but couldn't find it on the Juniper KB or by (a minimum amount of) Googling. Anyone here know?&lt;/p&gt;&#xA;" OwnerUserId="85" LastEditorUserId="85" LastEditDate="2013-12-10T19:12:05.080" LastActivityDate="2016-09-14T13:58:06.493" Title="Juniper EX-series: How can I transfer a config from one switch to another?" Tags="|juniper|juniper-ex|" AnswerCount="7" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5401" PostTypeId="2" ParentId="5400" CreationDate="2013-12-10T20:10:04.500" Score="10" Body="&lt;p&gt;you can copy the configuration from the 'source' switch like this (assuming you've got a domestic software release supporting SSH):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show configuration | save user@otherswitch:myconfig&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then on 'otherswitch' in edit-mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;load replace myconfig&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2013-12-10T20:21:11.617" LastActivityDate="2013-12-10T20:21:11.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5406" PostTypeId="2" ParentId="5400" CreationDate="2013-12-11T06:53:22.373" Score="4" Body="&lt;p&gt;You can, of course, also in config mode just:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;save somefilename&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then you move that file to the other switch someway, usign ftp, sftp, scp WinSCP, etc., to the other switch, where you&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;load replace somefilename&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another option is to just view the config in the normal way&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then copy it in your client (clipboard).&#xA;Then on the new switch, type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;load patch terminal&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and paste in the config there. Once done, press  and .&lt;/p&gt;&#xA;" OwnerUserId="2697" LastActivityDate="2013-12-11T06:53:22.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5411" PostTypeId="1" CreationDate="2013-12-11T14:42:23.570" Score="6" ViewCount="50699" Body="&lt;p&gt;My company has a 100mbps Internet connection and we have recently experienced extreme slowness when using the Internet (our provider's speedtest page indicated .25 Mbps download speed).  When we contacted them about it, they said it's because our circuit is getting maxed out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We recently has a CCTV system installed and the DVR for that system is outside our firewall connected directly to the Internet with a public IP.  My suspicion is that this system is the cause of this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot disconnect this system for internal political reasons, so I am trying to determine how I can otherwise determine if this system is indeed the one using tons of bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is our network layout - from our provider we have fiber coming into a media converter, from the media converter we have ethernet to a Cisco 2800 series router (the router peers with our provider via BGP to announce our /24) and then from the router there is ethernet to a switch, and that switch then connects to the DVR as well as our firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to find a way to get info out of the Cisco router that will help me figure out if it's the DVR or our firewall that is using all of the available bandwidth.  Typically we only average around 15 Mbps, so I would expect to see that the DVR is constantly using 90-100 Mbps.  I just need to know how I can show that to someone in black and white so I can get them to let me unplug it.&lt;/p&gt;&#xA;" OwnerUserId="3501" LastActivityDate="2013-12-12T00:25:56.067" Title="How can I view bandwidth use by ip/host on a Cisco router?" Tags="|cisco-ios|bandwidth|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5413" PostTypeId="2" ParentId="5411" CreationDate="2013-12-11T16:02:49.613" Score="8" Body="&lt;p&gt;Traditional way to monitor usage by host is to use NetFlow.  Most enterprise Cisco gear supports exporting NetFlow records.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure your Cisco router to export flow data to a NetFlow Collector.  There are many different NetFlow Collector software packages out there ranging in cost from &quot;free&quot; to &quot;an arm and a leg&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PRTG is one such NetFlow Collector and its free version will accept NetFlow from up to 10 different routers/switches.   &lt;/p&gt;&#xA;" OwnerUserId="2722" LastActivityDate="2013-12-11T16:02:49.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5414" PostTypeId="2" ParentId="5411" CreationDate="2013-12-11T16:06:49.923" Score="0" Body="&lt;p&gt;You could also calculate how much bandwidth your CCTV camera is sending.  The manual for the camera most likely has this information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also found a calculator you can play with here:   &lt;a href=&quot;http://www.stardot.com/bandwidth-and-storage-calculator&quot; rel=&quot;nofollow&quot;&gt;http://www.stardot.com/bandwidth-and-storage-calculator&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;HD video takes up a LOT of bandwidth.  &lt;/p&gt;&#xA;" OwnerUserId="2722" LastActivityDate="2013-12-11T16:06:49.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5417" PostTypeId="2" ParentId="5411" CreationDate="2013-12-11T20:44:06.613" Score="2" Body="&lt;p&gt;If it's a managed switch (you didn't say anything about it), MRTG (etc.) can monitor the traffic counters for any/all ports.  Or you can look at the interface counters directly during any slow downs. (on a cisco switch, you may want to set the &lt;code&gt;load-interval&lt;/code&gt; to something low instead of the default 5 minutes.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the router itself, there's not much you can do to localize what's using all the bandwidth. If it's not doing NAT or IPS/IDS, then it's not normally maintaining any session state. Enabling netflow, even without export to a collector, will provide some idea of where traffic is going, but it's a lot of information to sift through. (eg. my home network with 2 computers and numerous gadgets (dvr, tv, etc.) currently has 4024 ACTIVE flows.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-11T20:44:06.613" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5418" PostTypeId="1" AcceptedAnswerId="5419" CreationDate="2013-12-11T20:59:41.463" Score="6" ViewCount="34687" Body="&lt;p&gt;Let's say there are two PCs, PC A and PC B.&#xA;PC A wants to communicate with PC B, such as sending a message.&#xA;I need to describe the arp packets for this task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Known details:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC A -&gt; SW 1 -&gt; Router -&gt; SW 2 -&gt; PC B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host A and host B are in a different network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC A : MAC Address a.a.a.a &#xA;       IP Address  1.1.1.1&#xA;       Default gateway 4.4.4.4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC B : MAC Address b.b.b.b&#xA;       IP Address  2.2.2.2&#xA;       Default gateway 5.5.5.5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I wonder how the router would react to the arp packet.&#xA;If PC A wants to send a message to PC B, it will first send an arp packet with its own MAC and IP addresses as source and PC B's IP address and zero value for the MAC address as destination.The ethernet packet would contain PC A's MAC and IP as source but then I don't know wheter the destination ip would be A's default gateway or it will be a broadcast like the MAC address?&#xA;I believe that default configuration routers has the proxy arp disable.&#xA;What would actually happen?&lt;/p&gt;&#xA;" OwnerUserId="3508" LastEditorUserId="3508" LastEditDate="2013-12-11T22:00:38.687" LastActivityDate="2017-05-06T14:54:09.233" Title="Understanding ARP and Routers" Tags="|router|switch|arp|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5419" PostTypeId="2" ParentId="5418" CreationDate="2013-12-11T22:28:26.873" Score="14" Body="&lt;p&gt;Your reasoning is the wrong way. TCP/IP handles the layers top down, not bottom up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC A will first do a lookup in the routing table and decide that the only way to reach PC B is via the router specified in that routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the MAC address of the router is unknown it will send an ARP request to figure out which MAC address corresponds to the gateway IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then the frame (containing the IP packet) will be sent to the MAC address of the router which will do a lookup in its routing table to see on which interface PC B is connected or via which next hop it should be routed. Assuming PC B is connected to another interface of the router the router will do a lookup (and if needed an ARP request) to figure out the MAC address of PC B and then forward the frame.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-12-11T22:28:26.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5420" PostTypeId="2" ParentId="5418" CreationDate="2013-12-11T23:45:00.607" Score="0" Body="&lt;p&gt;If in different networks then pc A will determine if pc B resides on the same subnet or not by doing a binary AND operation that compares its own address and subnet mask with that of the destination address.&lt;br&gt;&#xA;If not within the same subnet then pc A will send the frame to its default gateway which is the router in this case, which will in turn send it onwards to the destination host if it has a determined path to that address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router will reply to the arp with the mac address of the gateway. The router will strip off the source mac address and replace it with its own before exiting the egress interface.&lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2013-12-11T23:45:00.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5421" PostTypeId="2" ParentId="5411" CreationDate="2013-12-12T00:25:56.067" Score="5" Body="&lt;p&gt;In addition to Michael's answer, Cisco's top-talkers feature can use NetFlow data to quickly give you a list of the highest consuming devices on your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not already using NetFlow in some fashion, it may be the quickest and easiest way for you to examine the data, as it doesn't rely on third-party functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The summary will also show you the destination interface, so it's easy to differentiate internal from external traffic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP Bytes&#xA;Vl1           192.168.1.141   Di0           XXX.XXX.XXX.XXX 06 CF9A 2710   380K&#xA;Vl1           192.168.1.141   Null          XXX.XXX.XXX.XXX 11 EEE6 076C    84K&#xA;Vl1           192.168.1.140   Di0           XXX.XXX.XXX.XXX 06 CDE1 0D3D    28K&#xA;Vl1           192.168.1.140   Di0           XXX.XXX.XXX.XXX 2F 0000 0000    10K&#xA;Vl1           192.168.1.142   Di0           XXX.XXX.XXX.XXX 06 EB78 0D3D  9534&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Configuration&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You can configure it like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Configure top-talkers&#xA;ip flow-top-talkers&#xA; top 100&#xA; sort-by bytes&#xA;&#xA;! Configure NetFlow on the appropriate interface on the router&#xA;interface Vlan1&#xA; ip flow ingress&#xA; ip flow egress&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I answered a similar question here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3003/simple-question-does-high-bandwidth-usage-affect-speedtest-net-results/3004#3004&quot;&gt;Simple Question: Does High Bandwidth usage affect Speedtest.net Results?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="846" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-12-12T00:25:56.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5422" PostTypeId="2" ParentId="5400" CreationDate="2013-12-12T01:23:07.610" Score="3" Body="&lt;p&gt;I followed the directions in this Juniper document:&#xA;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB12022&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB12022&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Briefly, I backed up the configured switch's config file to a USB key, and then mounted the USB key on the new switch, and did a &lt;code&gt;load override /mnt/juniper.conf.gz&lt;/code&gt; as per the document's &quot;restore&quot; section. Worked like a champ!&lt;/p&gt;&#xA;" OwnerUserId="85" LastActivityDate="2013-12-12T01:23:07.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5423" PostTypeId="1" AcceptedAnswerId="5425" CreationDate="2013-12-12T03:34:44.973" Score="5" ViewCount="10228" Body="&lt;p&gt;I'm looking to implement a new network design with Juniper EX Series switches. Part of this involves implementing vPC between my core and ToR switches (and also between ToR and host).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is to be able to split 4x1GE links into 2x2GE port groups, each one split between my two core switches for redundancy, and still obtain near 4 Gbps bandwidth to each rack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vz6ov.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm fairly new to the concept of vPC but I don't seem to be able to find a Juniper equivalent for this technology - other than stacking the ToR switches with Virtual Chassis technology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll probably end up using Virtual Chassis if I can't do it any other way, but I'd like to try and keep the ToR switches un-stacked, if I can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only other option I know of is to use MSTP to balance traffic per VLAN - which is probably OK given that we use 1xVLAN per customer and each host can do 2 Gbps max, but a port channel seems much simpler to configure and maintain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="846" LastEditorUserId="846" LastEditDate="2013-12-12T05:07:57.053" LastActivityDate="2019-01-15T00:38:31.267" Title="Juniper equivalent to Cisco's vPC?" Tags="|juniper|vpc|ieee-802.1ax|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5425" PostTypeId="2" ParentId="5423" CreationDate="2013-12-12T07:05:14.180" Score="5" Body="&lt;p&gt;Geekman,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If talking in Cisco terms, the main difference between vPC and basic stacking (StackWise, FlexStack) is excluding of splitbrain situation, when both members become a master and continue to forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper EX series currently do not support any technology like vPC, so MLAG can be completed only with Virtual Chassis which can be splitbrained.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although Juniper have an analog of vPC, greatly works on MX series routers. They calling it directly &quot;MC-LAG&quot;, which additionally uses ICCP to communicating between MC-LAG nodes.&#xA;Those technologies well discribed in the book &quot;Juniper MX Series&quot; by Douglas Richard Hanks, Jr. and Harry Reynolds.&lt;/p&gt;&#xA;" OwnerUserId="3518" LastActivityDate="2013-12-12T07:05:14.180" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5427" PostTypeId="1" AcceptedAnswerId="5429" CreationDate="2013-12-12T08:29:13.553" Score="3" ViewCount="477" Body="&lt;p&gt;do anyone know if there is a SSH module, or any secure module that provides SSH for Cisco 6500 series of routers/switches?! &lt;/p&gt;&#xA;" OwnerUserId="3122" LastEditorUserId="3122" LastEditDate="2013-12-12T08:44:18.123" LastActivityDate="2013-12-16T03:09:17.077" Title="security module for SSH on Cisco 6500" Tags="|cisco|cisco-6500|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5429" PostTypeId="2" ParentId="5427" CreationDate="2013-12-12T08:57:11.470" Score="6" Body="&lt;p&gt;SSH on the 6500 series is a software feature, so the best thing to do is use the  &lt;a href=&quot;http://tools.cisco.com/ITDIT/CFN/&quot;&gt;Cisco Feature Navigator&lt;/a&gt; to select a software image with SSH support and install that.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-12-12T08:57:11.470" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5433" PostTypeId="1" AcceptedAnswerId="5434" CreationDate="2013-12-12T15:26:51.137" Score="14" ViewCount="17629" Body="&lt;p&gt;We have an outbound route-map on an eBGP peer that adds some communities to certain prefixes. Is there any way to prove that this is actually happening from the sender side in classic IOS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show ip bgp neighbor x.x.x.x advertised-routes&lt;/code&gt; does not show them&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even &lt;code&gt;debug ip bgp update out&lt;/code&gt; doesn't seem to!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In gns3 I can make the same config and see that it works from my fake upstream side, but I need to be able to verify in the production router from the local side...&lt;/p&gt;&#xA;" OwnerUserId="2639" LastEditorUserId="2639" LastEditDate="2017-11-13T12:29:41.180" LastActivityDate="2018-04-14T13:11:13.690" Title="Cisco BGP - see communities on advertised-routes?" Tags="|cisco|bgp|" AnswerCount="6" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5434" PostTypeId="2" ParentId="5433" CreationDate="2013-12-12T16:24:27.247" Score="8" Body="&lt;p&gt;Last time I checked/tried to do this, it wasn't possible in IOS. I'm not sure about NX-OS or IOS-XE/XR though. It doesn't help you, but this is possible to do on Juniper gear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your configuration - make sure you're using the &lt;code&gt;additive&lt;/code&gt; keyword in your route-maps to set the communities, otherwise you will not be adding communities to the list, but rather replacing any existing communities with the one you're setting in your route-maps.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2013-12-12T16:24:27.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5435" PostTypeId="2" ParentId="5427" CreationDate="2013-12-12T16:47:27.053" Score="0" Body="&lt;p&gt;SSH management is available on pretty much all IOS versions available for enterprise class switches.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generic setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;user foo password 0 foobar&#xA;hostname foo&#xA;!-- generate SSH key&#xA;crypto key generate rsa&#xA;!-- key length&#xA;1024&#xA;!-- specify SSH ver&#xA;ip ssh ver 2&#xA;!&#xA;line vty 0 4&#xA;transport input ssh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's all there is.  Then SSH to the management IP and login.&lt;/p&gt;&#xA;" OwnerUserId="3527" LastEditorUserId="3527" LastEditDate="2013-12-12T19:56:29.363" LastActivityDate="2013-12-12T19:56:29.363" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5437" PostTypeId="1" AcceptedAnswerId="5438" CreationDate="2013-12-12T19:34:21.863" Score="5" ViewCount="1005" Body="&lt;p&gt;In area 0 I have two loopbacks: 172.16.2.2 and 172.16.2.3 (both /24's).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to configure a summary to roll the two up.  Given the rest of the topology, I'm using &lt;code&gt;area X range&lt;/code&gt; command.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my input and the console's output.  What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ZEUS(config-router)#area 0 range 172.16.2.0 255.255.252.0&#xA;% OSPF: Inconsistent address/mask 172.16.2.0/22 for area range&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Wouldn't this summarize from 172.16.2.2 up to 172.16.3.255?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="44" LastEditDate="2013-12-13T00:58:03.763" LastActivityDate="2013-12-13T15:20:48.980" Title="OSPF: inconsistent mask for area range?" Tags="|cisco|ospf|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5438" PostTypeId="2" ParentId="5437" CreationDate="2013-12-12T19:55:41.147" Score="6" Body="&lt;p&gt;All loopbacks in OSPF are advertised with a 255.255.255.255 mask by default (see &quot;LOOPBACK&quot; network type), regardless of what you've configured the netmask as on the interface. If you want to announce your loopbacks with anything that's not a /32 you need to configure them as point-to-point (&lt;code&gt;ip ospf network point-to-point&lt;/code&gt; under the Loopback interface configuration).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Since you've stated you've already done this, my next observation is that you've given the wrong network address for the &lt;code&gt;area range&lt;/code&gt; command. If you want to announce the summary you'd need to announce it with the network address, ie &lt;code&gt;area 0 range 172.16.0.0 255.255.252.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also be aware that any traffic to 172.16.0.0/24 or 172.16.1.0/24 will be blackholed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT #2: @Christian's answer is also correct if you wanted to summarize &lt;strong&gt;just&lt;/strong&gt; those two /24's into a /23: &lt;code&gt;area 0 range 172.16.2.0 255.255.254.0&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-12-13T15:20:48.980" LastActivityDate="2013-12-13T15:20:48.980" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5439" PostTypeId="1" AcceptedAnswerId="5443" CreationDate="2013-12-12T21:39:39.760" Score="6" ViewCount="5249" Body="&lt;p&gt;Same protocol, different frequency. So why does 802.11 spec not take advantage of the higher frequency to obtain higher data rates?&lt;/p&gt;&#xA;" OwnerUserId="2360" LastEditorUserId="33" LastEditDate="2015-11-19T18:53:44.453" LastActivityDate="2015-11-19T18:53:44.453" Title="Why are 802.11n data rates for 5GHz not faster than 2.4GHz?" Tags="|wireless|ieee-802.11|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5440" PostTypeId="2" ParentId="5439" CreationDate="2013-12-12T21:45:58.407" Score="5" Body="&lt;p&gt;It's a question of the channel bandwidth in MHz (not the main frequency) which is the same for 2,4 and 5GHz and can be either 20MHz or 40MHz per standard. While AC standard can have up to 160MHz channel width and thus higher throughput rate per stream. &lt;/p&gt;&#xA;" OwnerDisplayName="user3525" LastActivityDate="2013-12-12T21:45:58.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5441" PostTypeId="2" ParentId="5437" CreationDate="2013-12-12T22:19:15.683" Score="3" Body="&lt;p&gt;172.16.2.0 255.255.252.0 = 172.16.0.0-172.16.3.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want .2.0 thru .3.255 specifically you'll need&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.16.2.0 255.255.254.0 = 172.16.2.0-172.16.3.255&lt;/p&gt;&#xA;" OwnerUserId="889" LastActivityDate="2013-12-12T22:19:15.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5443" PostTypeId="2" ParentId="5439" CreationDate="2013-12-12T23:40:37.210" Score="12" Body="&lt;p&gt;Keep in mind that a higher frequency doesn't translate to moving data faster, rather it is the modulation of the signal that determines that data rate.  The 802.11n standard either requires or makes optional the same set of major features and modulations in both frequency ranges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, that being said, there are a number of best or common practices that typically will make 5GHz faster than 2.4GHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, there is an option for channel width, either 20MHz or 40MHz.  In 2.4GHz, you only have room for one non-overlapping 40MHz channel (in most regions).  To reduce co-channel interference, you need at least three, so this option is generally not used in 2.4GHz.  In 5GHz where you have many more non-overlapping channels available, this isn't a concern and 40MHz channels are the norm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, is the guard interval.  802.11b/g used a longer guard interval than 802.11a.  802.11n makes the short guard interval an option in 2.4GHz, but this is still often left as the long guard interval since some older devices have issues with a shorter guard interval. Deployments in the last couple of years are more likely to enable a short guard interval on 2.4GHz, but this still seems to be in the minority. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two factors alone account for over twice the performance between the two frequency ranges in a normal deployment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, it is not at all uncommon for enterprises to turn off any legacy support in 5GHz and run it in a 802.11n only or Greenfield mode.  Not having to allow for older 802.11a devices can further increase performance.  The reasoning behind this decision usually follows that the majority non-802.11n devices did not support 802.11a (5GHz), for those that were dual band, the 2.4GHz band still exists for them to connect.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-12-12T23:40:37.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5446" PostTypeId="1" CreationDate="2013-12-13T13:12:48.270" Score="3" ViewCount="194" Body="&lt;p&gt;I am working with some colleges in another geographical location on connecting two satellite locations to a co-location facility.  We are going to be moving all our server infrastructure to the co-location facility.  They are talking about putting a &quot;transport connection&quot; in from my location is FL to the co-lo in PA.  They described the &quot;transport connection&quot; as essentially a really long ethernet cable to connect the sites.  My question is what is this technology that is being implemented and how does it work&lt;/p&gt;&#xA;" OwnerUserId="3541" LastActivityDate="2013-12-13T14:18:45.700" Title="Network Transport Connection" Tags="|network-core|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5447" PostTypeId="2" ParentId="5446" CreationDate="2013-12-13T13:53:00.863" Score="4" Body="&lt;p&gt;They have described the technology (&quot;a really long Ethernet cable&quot;) pretty accurately. Typically &lt;strong&gt;transport&lt;/strong&gt; in this case is referring to &quot;lit services&quot; by a provider. The technologies used will vary widely depending on a number of factors, including the provider, the geographic area, etc. but the most common instances I've seen are the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) The provider gives you an Ethernet handoff/presentation (typically fiber, but sometimes copper) and then they will carry your signal across their backbone by turning it into a *WDM (not necessarily the technology used, but it's probably the most common) signal on their network, and then they'll spit it back out to you as another Ethernet handoff at the other site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) If the two locations are geographically close enough, the provider may not bother with using *WDM and carry it across their metro Ethernet backbone either as a VLAN or pseudowire service such as a VLL - this is frequently used for peering if an exchange or entity is in one colocation and the entity wanting to peer is &lt;em&gt;not&lt;/em&gt; in that same colocation facility, but they &lt;em&gt;are&lt;/em&gt; in another one that's very geographically close.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Contrast this with &quot;unlit&quot; services (usually offered by a provider that has a lot of fiber in the ground already) where the responsibility to light the &quot;wave&quot;, as we call them in the industry, falls on you and you alone - these are commonly used in conjunction with WDM deployments because you get more for your money out of the dark fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the technology and how it works, CWDM and DWDM are just ways to multiplex multiple signals (called 'channels' or wavelengths) over a single fiber pair. You get more channels per pair out of DWDM vs. CWDM, but CWDM is always cheaper to build and deploy. WDM technologies are strictly layer 1 and are protocol agnostic, so it's entirely possible to carry Ethernet and SONET traffic on the same WDM metro ring.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2013-12-13T14:18:45.700" LastActivityDate="2013-12-13T14:18:45.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5451" PostTypeId="1" AcceptedAnswerId="5453" CreationDate="2013-12-13T19:31:02.600" Score="2" ViewCount="1383" Body="&lt;p&gt;I'm trying to setup a home lab to study for a Cisco certification. My problem is I'm tired of having to physically plug the console into a different device every single time I want to configure it by CLI. So what I've decided to do is setup 5 simultaneous telnet sessions to these devices. (4 switches, 1 router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is my topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC --&gt; Motorola Cable modem --&gt; R1 --&gt; S1 --&gt; S2&#xA;                                          --&gt; S3&#xA;                                          --&gt; S4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically my cable modem will be connected to both my PC and R1. I'm doing it like this so I don't have to connect my PC to R1 and thus lose internet whenever I need to study.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My PC's IP is dynamically from the Motorola cable modem and R1's IP is statically assigned in the same network. This is subnet 192.168.0.0/24. R1's IP is 192.168.0.155&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My PC is 192.168.0.2, the cable modem is 192.168.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1's interface that faces S1 is 192.168.254.254... S1 is 192.168.254.1... S2 is 192.168.254.2, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm able to telnet into R1 without any issues from my PC thus eliminating the need for a console cable AND I can still access the internet at the same time. From R1 I'm able to ping all the switches in the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the problem: I can't ping the switches from my PC. I just don't understand why that's possible. If I can ping R1 and R1 can ping the switches shouldn't R1 route to the LAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone please help me out with this. I'm stumped and I know I'm overlooking something simple. The object here is I want to eliminate the need for a console cable and be able to access the internet while simultaneous accessing my home lab.&lt;/p&gt;&#xA;" OwnerUserId="3551" LastActivityDate="2013-12-13T20:28:47.193" Title="Routing Issue - Can't access internet and home lab at the same time" Tags="|cisco|routing|subnet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5452" PostTypeId="2" ParentId="5451" CreationDate="2013-12-13T20:27:46.830" Score="0" Body="&lt;p&gt;Your cable modem is the problem, given the current topology. 192.168.254.0/24 is a different network than the one your PC is on (192.168.0.0/24). When you attempt to telnet to a switch, your request goes to your cable modem, as it's most likely set up as your PC's default gateway. Your cable modem has no knowledge of the 192.168.254.0/24 network, so it can't forward along to your router. Your router, however, has an interface on the 192.168.0.0/24 network, so that's why you can get to it just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a couple of solutions - you could add a route to your PC, routing 192.168.254.0/24 to next-hop 192.168.0.155. That's kind of janky, though. The better solution would probably be to add that route to your cable modem.&lt;/p&gt;&#xA;" OwnerUserId="271" LastActivityDate="2013-12-13T20:27:46.830" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5453" PostTypeId="2" ParentId="5451" CreationDate="2013-12-13T20:28:47.193" Score="1" Body="&lt;p&gt;What you're overlooking is that your PC still has the default gateway of the cable modem and not R1. So all packets being sent to a subnet that isn't within that PC's LAN get sent to the cable modem which has no idea how to get to 192.168.254.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you have two options if you want to also keep your internet access (thus, not change your default gateway):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set a static route on your cable modem to 192.168.254.0/24&lt;/li&gt;&#xA;&lt;li&gt;Set a static route on your PC to 192.168.254.0/24&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="889" LastActivityDate="2013-12-13T20:28:47.193" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5454" PostTypeId="1" CreationDate="2013-12-13T21:10:45.497" Score="4" ViewCount="555" Body="&lt;p&gt;I have configured a Cisco 2911 with an HWIC-1T card as a terminal server using the configuration below. I can telnet to port 2003 of the loopback address and establish a serial connection to a laptop connected to the HWIC-1T card.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface serial 0/0/0&#xA;  physical-layer async&#xA;  no ip address&#xA;  encapsulation slip&#xA;&#xA;line 0/0/0&#xA;  no exec&#xA;  transport input telnet&#xA;  transport output none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The stream of characters going from the serial connection to the telnet session works perfectly. However, the stream of characters going from the telnet session out to the serial connection to the laptop lags one character behind most of the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Meaning if I type &quot;1234&quot; into the telnet window, I will see just &quot;123&quot; come out the serial window. The last character isn't lost, just buffered in the router until I press the next key. Sometimes the router will buffer two characters and sometimes if I type two characters together in quick sessesion, both will be correctly displayed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the router is doing the buffering because I ran Wireshark and saw the TCP packet with the last character enter the router and not immediately get displayed.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/PDmIK.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong? Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="1911" LastActivityDate="2013-12-17T14:17:09.110" Title="Cisco Router as Terminal Server Buffering Issue" Tags="|cisco-ios|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5456" PostTypeId="1" AcceptedAnswerId="5480" CreationDate="2013-12-13T23:21:18.083" Score="5" ViewCount="5085" Body="&lt;p&gt;I have a main (active) Juniper Netscreen SSG firewall that I can access. I can't access the standby unit. I'd love to find out more about the standby unit from the main unit. Are there commands that would answer any of these questions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the IP of the standby unit?&#xA;Let's reboot the standby unit from the active.&#xA;What is the status of the standby unit? (get nsrp is very cryptic and not clear, how do I decipher that?)&#xA;When was the last failover and is there a reason why it happened?&#xA;Is the standby unit ok enough to fail back over to without it immediately failing back?&lt;/p&gt;&#xA;" OwnerUserId="949" LastActivityDate="2013-12-16T07:42:35.233" Title="Juniper netscreen: What failover/NSRP commands are available to troubleshoot?" Tags="|juniper|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5457" PostTypeId="1" AcceptedAnswerId="5458" CreationDate="2013-12-13T23:46:21.833" Score="16" ViewCount="20598" Body="&lt;p&gt;I'd like to make my Cisco router automatically do a copy run TFTP (and populate the fields automatically) every 1 minute. I'd also like it to be run in the background. Anyone know if this is possible/how to do it? I'd like to do this for the sake of viewing the running config of my routers in notepad++ (which updates realtime) instead of having to do a show run and hit spacebar 4 or 5 times before I get to what I need to see. I think this would be extraordinarily useful for complex labs. Also, macros don't work because of the TFTP server commands requiring input.&lt;/p&gt;&#xA;" OwnerUserId="889" LastEditorUserId="44" LastEditDate="2013-12-16T18:40:20.030" LastActivityDate="2022-03-18T18:10:52.793" Title="Automate configuration backup (every minute) in Cisco IOS" Tags="|cisco|router|automation|" AnswerCount="7" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5458" PostTypeId="2" ParentId="5457" CreationDate="2013-12-14T00:15:17.477" Score="19" Body="&lt;p&gt;You have several options to get this type of functionality on a Cisco device.  (Which one you use depends on your needs and sometimes on the device and IOS load.  Some older devices/IOS loads will have different capabilities.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; &lt;em&gt;You are asking about doing this every one minute, which as you found out in our chat about this question, will bog down your router. (Especially in GNS3.)  The below options are available to you for automating confirguation backup, however I would not recommend doing so every 1 minute.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could either:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Use Cisco's &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/cns/configuration/15-mt/cns-cmd-sched.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Kron functionality&lt;/a&gt; for command scheduling.    This will allow you to execute predefined commands on a scheduled basis.  As you pointed out, &lt;code&gt;copy run tftp&lt;/code&gt; requires file prompt confirmation. (Unless you've &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3315/copy-running-config-in-one-line?rq=1&quot;&gt;turned off file prompt confirmation&lt;/a&gt;, however I don't recommend it as a normal setting.)    Redirecting does not require confirmation.  So the command used in the scheduler is &lt;code&gt;show run | redirect tftp://$SERVERIP/$PATH/$FILE&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use Cisco's &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/fundamentals/configuration/guide/cf_config-rollback.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Archive functionality&lt;/a&gt; for configuration management.  Archive is a way to store multiple copies of the config in a sequential fashion and roll back configs if needed to a previous version.  Copying out with Kron overwrites the previous config, while Archive allows you to keep up to 14 different config versions in the specified location.  See &lt;a href=&quot;https://learningnetwork.cisco.com/blogs/vip-perspectives/2013/10/30/understanding-cisco-auto-archive-feature-to-backup-configuration-file&quot; rel=&quot;nofollow noreferrer&quot;&gt;this link on the Cisco Learning network&lt;/a&gt; for more useful info on Archive.  Specifically how to dynamically set the filename with the $h and $t tags.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In either of the below samples, you can adjust the times to your needs, these are just what I quickly pulled out of some production gear.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Sample config to have Kron write config and back it up to a tftp server once a week:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kron occurrence SaveConfig at 23:50 Mon recurring&#xA;policy-list SaveConfig&#xA;!&#xA;kron occurrence BackupRunningConfig at 23:55 Mon recurring&#xA;policy-list BackupRunningConfig&#xA;!&#xA;kron policy-list SaveConfig&#xA;cli write&#xA;!&#xA;kron policy-list BackupRunningConfig&#xA;cli show running-config | redirect tftp://10.10.10.10/configs/testswitch.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sample config to have Archive back up your config to a tftp server daily:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;archive&#xA; path tftp://10.10.10.10/configs/$h-$t&#xA; time-period 1440&#xA; maximum 14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2013-12-16T18:42:50.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5459" PostTypeId="1" CreationDate="2013-12-03T10:56:44.373" Score="11" ViewCount="1541" Body="&lt;p&gt;I have a quagga router with two transit neighbors and announcing my own IP space. I recently joined a public peering exchange (IXP) and so I'm part of their local network (/24), together with all other participants. So far everything works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for security I wonder if other participants could not simply route all their outgoing traffic through me? For example what happens if any other participant would point a default route to my IXP ip. If I understand correctly all outgoing traffic from that participant would then go to my router which would route it to the internet using my transit uplink, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I wonder if I have to take any measures against it. My ideas are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Setup firewall (iptables) rules so that only traffic with a destination of my own IP space is accepted from other IXP participant. Drop any other traffic from IXP participants.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Somehow make quagga use a different kernel routing table for each neighbor (or peer-group). The routing table for the IXP neighbors would not contain any entries except for my own IP space and so no routing using my ip transit uplinks would occur. Looking at the output of &lt;code&gt;ip rule show&lt;/code&gt; shows quagga is not doing this automatically?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Am I on the right track? Why is 2. not implemented in Quagga directly? How do hardware routers (cisco, juniper, ..) deal with this problem?&lt;/p&gt;&#xA;" OwnerUserId="3413" OwnerDisplayName="Alessandro" LastActivityDate="2014-07-18T06:02:06.740" Title="Quagga routing and security" Tags="|routing|bgp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5460" PostTypeId="2" ParentId="5459" CreationDate="2013-12-14T09:05:03.360" Score="8" Body="&lt;p&gt;You're right, if you don't take any measures this could happen. It's a violation of the acceptable use policy of most IXP's I know, but still you want to prevent it from happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your first solution is a good thing to do and will solve your problem. Just make sure you don't keep track of session state in iptables, that will probably kill performance or even your router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could consider to do outbound filtering as well in a similar way: do not allow packets to leave your network originating from unknown sources. This will prevent prevent hosts in your network from sending spoofed IP packets, which are commonly used in DDoS attacks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wouldn't implement the second solution. It's complicated and doesn't scale well if you have multiple routers handling your transits and peerings or if you have a large number of peering sessions (a couple of hunderds on an IXP isn't that uncommon).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On all the hardware router platforms I know this problem is solved in configuration by configuring RPF on the outbound interface and/or by writing filters.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2013-12-14T09:05:03.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5461" PostTypeId="1" CreationDate="2013-12-14T09:56:45.177" Score="3" ViewCount="6349" Body="&lt;p&gt;I have a Cloud Core Router with v6.1 RouterOs. It has defined a PPPoE client, add-default-route to yes and masquerade to out interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping the router from any device connected to the internet but when i ping from the Mikrotik console to my router connected to providers (Juniper M20), ping sometimes works and sometimes doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PPPoE server is a cisco 7206VXR router (previously an Imagestream). &#xA;The initial configuration that was working in the Mikrotik had two WAN connections, one for hotspot clients and the other one for the office. This worked for 2 weeks without problems but one day stopped working. I deleted one of the connection with this one and sometimes i have this problem .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the cause? Any suggestion?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a picture showing the network scheme&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ORIpx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ORIpx.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PPPoE session is always up, and the rest of the clients have normal behavior but the mikrotik router sometimes can ping to Router_2 and sometimes can't. We have changed the router for a new one and the problem persists. We have a radio link to the location where the mikrotik is and another PPPoE session with another router (Linksys) working without this issue at the same place... but the radio link has two ethernet interfaces acting as switch, one for each ppp client. So we suspect it could be the radio link if network configuration seems to be correct...&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="8499" LastEditDate="2018-02-14T16:27:30.827" LastActivityDate="2018-02-14T16:27:30.827" Title="Ping sometimes works and sometimes fails" Tags="|troubleshooting|" AnswerCount="1" CommentCount="4" ClosedDate="2017-08-10T00:00:00.967" ContentLicense="CC BY-SA 3.0" />
  <row Id="5462" PostTypeId="2" ParentId="5454" CreationDate="2013-12-14T12:52:39.210" Score="6" Body="&lt;p&gt;Disable the &lt;a href=&quot;http://en.wikipedia.org/wiki/Nagle_algorithm&quot; rel=&quot;nofollow&quot;&gt;Nagle algorithm&lt;/a&gt;, as that can introduce lag on telnet connections. In general, Nagle is A Good Thing(tm), but I recall it doing this on telnet connections.  (telnet? terminal server? ...I'm having flashbacks.) Something like &lt;code&gt;no service nagle&lt;/code&gt; in global config (if I recall correctly.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;update&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This turns out to not solve the OP's question; but it's still useful to keep here. I'm editing my answer so people who up-voted have the ability to undo their up-vote.&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2013-12-17T14:17:09.110" LastActivityDate="2013-12-17T14:17:09.110" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5463" PostTypeId="2" ParentId="5457" CreationDate="2013-12-14T15:36:48.767" Score="12" Body="&lt;p&gt;There is &lt;em&gt;actually&lt;/em&gt; another way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can trigger a TFTP copy using SNMP.  It's not &lt;em&gt;terribly&lt;/em&gt; straight forward, but is incredibly useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, you'll need a TFTP server (unsurprisingly).  You'll also need something that can send snmp requests.  I've done it effectively with Linux's snmp tools. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll want to set up a new community for SNMP that has limited write access, and probably lock it down even further with an IP ACL. Actually you only need to be able to write to the &lt;code&gt;ccCopyTable&lt;/code&gt; OID. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Linux side, you'll need the following MIBs (for readability, rather than functionality) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CISCO-CONFIG-COPY-MIB&#xA;CISCO-SMI&#xA;CISCO-ST-TC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the MIBs installed in the relevant location for your SNMP configuration on Linux, you should be able to test connectivity with snmptable thusly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmptable -v2c -c writeCommunity 192.168.1.1 ccCopyTable&#xA;CISCO-CONFIG-COPY-MIB::ccCopyTable: No entries&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You usually need to pre-create the file on the TFTP server for the router to copy into.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to trigger a TFTP copy, you need to insert a row into the &lt;code&gt;ccCopyTable&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;snmpset&lt;/code&gt;  allows you to do this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# snmpset -v2c -c writeCommunity 192.168.1.1 \&#xA;&amp;gt; ccCopyProtocol.23 i tftp \&#xA;&amp;gt; ccCopySourceFileType.23 i runningConfig \&#xA;&amp;gt; ccCopyDestFileType.23 i networkFile \&#xA;&amp;gt; ccCopyServerAddress.23 a 192.168.1.100 \&#xA;&amp;gt; ccCopyFileName.23 s router.conf&#xA;&#xA;CISCO-CONFIG-COPY-MIB::ccCopyProtocol.23 = INTEGER: tftp(1)&#xA;CISCO-CONFIG-COPY-MIB::ccCopySourceFileType.23 = INTEGER: runningConfig(4)&#xA;CISCO-CONFIG-COPY-MIB::ccCopyDestFileType.23 = INTEGER: networkFile(1)&#xA;CISCO-CONFIG-COPY-MIB::ccCopyServerAddress.23 = IpAddress: 192.168.1.100&#xA;CISCO-CONFIG-COPY-MIB::ccCopyFileName.23 = STRING: router.conf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once you've done that, you should be able to re-run the first command, and see the copy command in the ccCopyTable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmptable -v 2c -c writeCommunity 192.168.1.1 ccCopyTable&#xA;&#xA;SNMP table: CISCO-CONFIG-COPY-MIB::ccCopyTable&#xA;&#xA; index Protocol SourceFileType DestFileType ServerAddress    FileName UserName&#xA;    23     tftp  runningConfig  networkFile     192.168.1.100 router.conf        ?&#xA;&#xA;SNMP table CISCO-CONFIG-COPY-MIB::ccCopyTable, part 2&#xA;&#xA; index UserPassword NotificationOnCompletion State TimeStarted TimeCompleted&#xA;    23            ?                    false     ?           ?             ?&#xA;&#xA;SNMP table CISCO-CONFIG-COPY-MIB::ccCopyTable, part 3&#xA;&#xA; index FailCause EntryRowStatus ServerAddressType ServerAddressRev1&#xA;    23         ?              ?              ipv4       &quot;192.168.1.100&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nothing will happen until you set another column on ccCopyTable to activate the row. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; snmpset  -v2c -c writeCommunity 192.168.1.1 \&#xA;&amp;gt; ccCopyEntryRowStatus.23 i active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you check ccCopyTable again, you should see that State and TimeStarted have been updated to reflect that the file has been copied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's more details in the source links below, including how to empty ccCopyTable (if you'd like).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used the same method in a script from a Linux server to trigger a TFTP copy, then commit the file to git, and push it back to the repository, all in one swift process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sources: &lt;a href=&quot;http://www.ciscozine.com/2013/08/22/how-to-save-configurations-using-snmp/&quot;&gt;http://www.ciscozine.com/2013/08/22/how-to-save-configurations-using-snmp/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and &#xA;&lt;a href=&quot;http://bodgitandscarper.co.uk/networks/using-snmp-to-trigger-cisco-tftp-backups/&quot;&gt;http://bodgitandscarper.co.uk/networks/using-snmp-to-trigger-cisco-tftp-backups/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="546" LastActivityDate="2013-12-14T15:36:48.767" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5464" PostTypeId="2" ParentId="5400" CreationDate="2013-12-14T16:25:58.120" Score="3" Body="&lt;p&gt;You can use a script to share parts of the config quite easily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use the script &lt;a href=&quot;http://www.juniper.net/us/en/community/junos/script-automation/library/configuration/share-data/&quot; rel=&quot;nofollow&quot;&gt;share-data&lt;/a&gt;. You can create your config like this on the switch/router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;groups {&#xA;    juniper-distro {&#xA;        apply-macro share-data {&#xA;            device3;&#xA;            device2;&#xA;            device1;&#xA;        }&#xA;        system {&#xA;            domain-name mydomain.com;&#xA;            domain-search [ mydomain.com anotherdomain.com ];&#xA;...........................................&#xA;        }&#xA;    }&#xA;}&#xA;apply-groups [ juniper-distro ];&#xA;...........................................&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can then use the script to copy the group config to the other devices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;{master:1}&#xA;root@device1&gt; op share-data group juniper-distro ?&#xA;Possible completions:&#xA;              Execute this command&#xA;                 Argument name&#xA;  database             Database for configuration ('candidate' or 'committed')&#xA;  detail               Display detailed output&#xA;  target               Target for transfer (one or space-delimited list)&#xA;  |                    Pipe through a command&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This isn't very helpful for the initial config of the switch as you still need to be able to access it and be able to set the apply-group. The previous posters suggestion of scp the config file over would be my suggestion.&lt;/p&gt;&#xA;" OwnerUserId="3546" LastActivityDate="2013-12-14T16:25:58.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5465" PostTypeId="2" ParentId="5433" CreationDate="2013-12-15T00:46:40.483" Score="2" Body="&lt;p&gt;Set  up another BGP  peer  or  route-reflector   that  you  control with identical  policies .   Of  course,  make sure you're not blackholing  any traffic  toward this peer.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2013-12-15T00:46:40.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5472" PostTypeId="2" ParentId="5433" CreationDate="2013-12-15T14:44:06.577" Score="0" Body="&lt;p&gt;I've been able to successfully confirm BGP attributes are being applied by debugging BGP and then resetting the peer and then watching the debug messages - It is of course disruptive. After you did your debug ip bgp update-out, did you do a hard reset on the peer? I will lab this up and provide a screenshot.&lt;/p&gt;&#xA;" OwnerUserId="3568" LastActivityDate="2013-12-15T14:44:06.577" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5473" PostTypeId="1" AcceptedAnswerId="5474" CreationDate="2013-12-15T16:26:52.637" Score="5" ViewCount="587" Body="&lt;p&gt;we're supposed to do a presentation on AODV, and even having read all the official documentation and some additional sources, we're stumped by the question of how sequence numbers prevent loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine the following crude network:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IrhN3.jpg&quot; alt=&quot;AODV Network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aussuming that initially the link between C and D works and all nodes start out with a sequence number of 1. Now, the following happens:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;A sends a RREQ to get to D. A's sequence # increases to 2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;D receives the RREQ, increments its own #. D sends a RREP to A.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A's latest information on D's sequence # is 2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now, the link between C and D breaks.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;C still wants to send to D, sends a RREQ, with the last known destination sequence # for D, which should be 2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A receives the RREQ, remembers having a route to D with the same destination sequence # (2) as in the RREQ. A sends a RREP for the route to D, creating the loop.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Can anyone tell us where we're mistaken in this scenario? Wrong information, wrong assumptions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="3569" LastActivityDate="2013-12-15T19:15:15.867" Title="Loop Prevention in AODV" Tags="|routing|loop|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5474" PostTypeId="2" ParentId="5473" CreationDate="2013-12-15T18:57:58.503" Score="4" Body="&lt;p&gt;You say you've read &quot;the official documentation&quot;, but does that include the actual RFC, &lt;a href=&quot;http://www.ietf.org/rfc/rfc3561.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 3561&lt;/a&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe your concerns are addressed in Section 6.1, &lt;em&gt;Maintaining Sequence Numbers&lt;/em&gt;.  It says, in part:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The only other circumstance in which a node may change the&#xA;     destination sequence number in one of its route table entries is in&#xA;     response to a lost or expired link to the next hop towards that&#xA;     destination.  The node determines which destinations use a particular&#xA;     next hop by consulting its routing table.  In this case, for each&#xA;     destination that uses the next hop, the node increments the sequence&#xA;     number and marks the route as invalid (see also sections 6.11, 6.12).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This means that in your example, after Step 4, C knows that the link to D is down and increments the Sequence number appropriately.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, utilizing the RERR method described in section 6.11, C sends a message to the other routers letting them know that the route to D is bad.  Thus avoiding the loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(It has been many years since I've looked at AODV, I might be wrong/rusty...)&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-12-15T19:15:15.867" LastActivityDate="2013-12-15T19:15:15.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5476" PostTypeId="1" CreationDate="2013-12-16T05:55:03.740" Score="2" ViewCount="26877" Body="&lt;p&gt;For further clarification: I'm looking for some hardware way of factory-resetting a &lt;a href=&quot;http://support.dlink.com/emulators/dgs3224tgr/&quot; rel=&quot;nofollow&quot;&gt;D-Link DGS3224TGR switch&lt;/a&gt; (as any terminal access to this switch is restricted by password).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no &quot;reset&quot; button on it; the user manual doesn't say a thing, and a service manual is not to be found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;This is no sketchy activity, I assure you; the thing is, that the previous network admin who knew the password, well, died (and thus took the password with him).&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3573" LastEditorUserId="775" LastEditDate="2013-12-16T11:38:27.493" LastActivityDate="2022-03-23T22:02:23.933" Title="How to factory reset the D-Link DGS3224TGR switch?" Tags="|switch|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5477" PostTypeId="2" ParentId="5476" CreationDate="2013-12-16T06:38:56.800" Score="4" Body="&lt;p&gt;Try the following (quote from other D-link switch manuals)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For security reasons, the Password Recovery feature requires the user to physically access the device.Therefore this feature is only applicable when there is a direct connection to the console port of the device. It is necessary for the user needs to attach a terminal or PC with terminal emulation to the console port of the switch.&lt;/li&gt;&#xA;&lt;li&gt;Power on the switch. After the boot image is loaded to 100%, the Switch will allow 2 seconds for the user to press the hotkey (Shift + 6 ) to enter the &quot;Password Recovery Mode&quot;. Once the Switch enters the &quot;Password Recovery Mode&quot;, all ports on the Switch will be disabled.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the &quot;Password Recovery Mode&quot; only the following commands can be used.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;reset config&lt;/li&gt;&#xA;&lt;li&gt;reboot&lt;/li&gt;&#xA;&lt;li&gt;reset account&lt;/li&gt;&#xA;&lt;li&gt;reset password &lt;/li&gt;&#xA;&lt;li&gt;show account&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The reset config command resets the whole configuration back to the default values, with the exception of the account settings. The reboot command exits the Password Recovery Mode and restarts the switch. The reset account command deletes all of the created user accounts. The reset password command resets the password of the specified user. If a username is not specified, the password of all the users will be reset. The show account command displays all previously created accounts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if this doesn't work, contact D-Link. They know how to generate a password based on the MAC -- this you can learn from the notes on firmware 3.01.030:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Problems Resolved:&#xA;  Fix the security issues recently reported for unauthorized system access.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Enhancements:&#xA;  Limit the access by passwords generated by &quot;D-Link PWD calculator&quot;.&#xA;  Before, if customers forgot their configured passwords, D-Link could generate passwords based on the MAC addresses provided by customers via D-Link HQ maintained PWD calculator. Thus customers can use those &quot;backdoor&quot; passwords via telnet/ web/ console to logon to their switch again.&#xA;  Now the access of those passwords generated by &quot;D-Link PWD calculator&quot; will be limited to console access only.&#xA;  This is to minimize the security concern.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="942" LastEditorUserId="619" LastEditDate="2013-12-16T07:06:54.377" LastActivityDate="2013-12-16T07:06:54.377" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5478" PostTypeId="1" AcceptedAnswerId="5479" CreationDate="2013-12-16T06:48:05.103" Score="2" ViewCount="229" Body="&lt;pre&gt;&lt;code&gt;Cisco#sh interfaces   GigabitEthernet0/0&#xA;&#xA;GigabitEthernet0/0 is up, line protocol is up&#xA;  Hardware is CN Gigabit Ethernet, address is 6400.f13b.bec0 (bia 6400.f13b.bec0)&#xA;  Description: $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$&#xA;  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, **loopback not set**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Found 'loopback' statement under a port . Can anyone explain this why we require loopback under a port ?&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="44" LastEditDate="2013-12-18T04:08:20.897" LastActivityDate="2013-12-18T04:08:20.897" Title="What is loopback under certain port of a router?" Tags="|router|loopback|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5479" PostTypeId="2" ParentId="5478" CreationDate="2013-12-16T07:05:21.010" Score="8" Body="&lt;p&gt;Every interface supports &lt;em&gt;loopback&lt;/em&gt; for diagnostics.  It's rarely used on an ethernet interface, but it's supported there as well.  Loopback simply loops whatever it receives right back out -- usually without presenting it to the system.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-16T07:05:21.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5480" PostTypeId="2" ParentId="5456" CreationDate="2013-12-16T07:42:35.233" Score="5" Body="&lt;p&gt;The main commands you want to use is &lt;code&gt;get nsrp vsd-group all&lt;/code&gt;. That will show the current status. Note which units are master, primary back up and any secondary backups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the IP address of the stand by unit, it won't have one unless you set a manage-ip on the interface. The address on any interfaces are shared addresses by all devices in the vsd-group. The manage-ip on any interface is unique to that device. You should always set a manage-ip on devices on secure network interfaces (i.e., usually in the Trust zone or on the management interface) and generally not on unsecured networks (i.e., the Untrust zone). If you only have access to one over the network I suggest logging in on the serial console and setting a manage-ip for each device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way to know when the last failover was is to check the log (&lt;code&gt;get event&lt;/code&gt;). The reason why is almost always because a manual failover was initiated or a device went to ineligible state. Devices usually go to ineligible state if one of the monitor conditions (e.g., interface, ip-track).&lt;/p&gt;&#xA;" OwnerUserId="500" LastActivityDate="2013-12-16T07:42:35.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5481" PostTypeId="1" CreationDate="2013-12-16T09:51:08.690" Score="3" ViewCount="511" Body="&lt;p&gt;I have this configuration runnning :&#xA;&lt;img src=&quot;https://i.stack.imgur.com/IL9GH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;a href=&quot;https://i.stack.imgur.com/IL9GH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Larger image&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested the policy based routing int the lab using two linksys router acting as ppp clients of the Cisco 7206VXR and another linksys emulating the Juniper (forcing this router to send traffic always to the Cisco)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;traceroutes showed the traffic between the two PPPoE clients passing through the Linksys acting as Juniper (X.X.X.1 in VLAN 10) as i wanted because this traffic must pass the traffic shaper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The QinQ tunnel wasn't configured , I suppose it doesn't affect the the policy route performance...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So as it worked I put the Cisco in production but now the traceroutes in our PPPoE clients doesn't show the Juniper in the path when the destination is one subnet of the Cisco.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: A.B.C.D /23 and the networks in the picture have the first ip address A.B.C.1 in the Loopback interface as secondary, in a common PPPoE server configuration&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone can give me any idea about what could be the reason??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about the local client - PPPoE server subnet 10.10.0.0/16 not included in the object-group but as it is in production i would like some help first...&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="775" LastEditDate="2013-12-16T11:27:30.100" LastActivityDate="2013-12-16T11:27:30.100" Title="Policy Based Routing (not matching packets) - Virtual Template" Tags="|cisco|routing|juniper|troubleshooting|pppoe|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5482" PostTypeId="1" AcceptedAnswerId="5485" CreationDate="2013-12-16T10:11:29.287" Score="8" ViewCount="591" Body="&lt;p&gt;Is there any point in enabling QoS on a dedicated VOIP network that only has VOIP traffic?&lt;/p&gt;&#xA;" OwnerUserId="3575" LastActivityDate="2014-07-23T14:56:52.950" Title="QoS on a dedicated VOIP network" Tags="|qos|voip|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5483" PostTypeId="2" ParentId="5482" CreationDate="2013-12-16T10:28:50.347" Score="0" Body="&lt;p&gt;If you have dedicated switches for VoIP, or your switches have no significant load, then there's no reason to use qos.&lt;/p&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="619" LastEditDate="2013-12-16T10:32:45.017" LastActivityDate="2013-12-16T10:32:45.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5484" PostTypeId="2" ParentId="5457" CreationDate="2013-12-16T10:35:59.497" Score="2" Body="&lt;p&gt;You can use &lt;a href=&quot;http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-embedded-event-manager-eem/index.html&quot; rel=&quot;nofollow&quot;&gt;EEM&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;event manager applet dumpconfig&#xA; event timer {absolute time time-value | countdown time time-value | cron cron-entry cron-entry | watchdog time time-value} [name timer-name]&#xA; action 1.0 cli command &quot;enable&quot;&#xA; action 2.0 cli show running-config | redirect tftp://10.10.10.10/configs/testswitch.txt&#xA; action 998.0 cli command &quot;end&quot;&#xA; action 999.0 cli command &quot;exit&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="775" LastEditDate="2013-12-17T02:01:56.303" LastActivityDate="2013-12-17T02:01:56.303" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5485" PostTypeId="2" ParentId="5482" CreationDate="2013-12-16T10:43:12.983" Score="2" Body="&lt;p&gt;No, there is absolutely no reason why you would if you are on an isolated network. Quality of Service is simply a queueing mechanism that prioritize traffic based on predetermined requirements. If you enabled QoS on this network, you would effectively be saying &quot;guarantee 100% of my already 100% available bandwidth is guaranteed for VoIP&quot;.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2013-12-16T13:52:50.150" LastActivityDate="2013-12-16T13:52:50.150" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5489" PostTypeId="1" AcceptedAnswerId="5492" CreationDate="2013-12-16T15:40:13.103" Score="5" ViewCount="26569" Body="&lt;p&gt;We ran into a problem the other day when a member of our staff inadvertently doubly connected in a cheap switch (no STP) into another switch that had STP disabled.  (The second switch was connected to our main network.)  The resulting packet storm brought down our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If our simplified network topology looks something like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;.--.&#xA;|S1|&#xA;'--'&#xA;  |&#xA;.--. ___ .--.&#xA;|S2| ___ |S3|&#xA;'--'     '--'&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Sorry for the crude ascii art, I'm trying to illustrate that S2 and S3 are connected twice, creating a bridging loop)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;S1 is actually a rack of Cisco switches&#xA;&lt;li&gt;S2 is a Netgear smart switch with STP disabled&#xA;&lt;li&gt;S3 is an embedded switch with no STP&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This area isn't my forte, so I'm not even sure if this is possible, but if our network looks something like this, is there a way to protect S1 from the ensuing broadcast storm between S2/S3?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Update&lt;/b&gt; with a little more info:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Rack-mounted Cisco switches are a mix of SG200-50's, -26's, and -18's&#xA;&lt;li&gt;Netgear is a GS108Tv2 running firmware v5.0.5.7&#xA;&lt;li&gt;The more esoteric piece of equipment is a small embedded switch that goes in an industrial controller, link is here: https://www.phoenixcontact.com/online/portal/us?uri=pxc-oc-itemdetail:pid=2891001&amp;library=usen&amp;pcck=P-08-08-10-06-01&amp;tab=2.  The PDF (downloads tab) indicates something about a &quot;multi-address function&quot; but I don't think this is STP/RSTP.&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks for all the answers so far.  I really appreciate it.&lt;/p&gt;&#xA;" OwnerUserId="3581" LastEditorUserId="3581" LastEditDate="2013-12-16T18:13:37.143" LastActivityDate="2016-04-15T16:30:54.657" Title="Avoiding ARP broadcast storms" Tags="|switch|ethernet|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="5492" PostTypeId="2" ParentId="5489" CreationDate="2013-12-16T16:51:47.530" Score="4" Body="&lt;p&gt;Agree with both Ron and Mike Pennington here.  The entire point of Spanning Tree is to prevent broadcast storms from blowing up your network and you have just recently observed a practical lesson in how that happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Knowing the version of your Netgear switch would be helpful.  I'm looking at an older version of the ProSafe switch user manual for the GS748TS and the Spanning-Tree settings are quite granular, so you should be able to configure the switch to prevent such things from happening in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the older NetGear ProSafe switches I have used the default configuration is that STP is enabled in RSTP (rapid spanning tree) with BPDU flooded to all ports on the switch.  This is a good configuration for everyday use.  In order to help you more, we would need to know how many VLANs are on your network and so forth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But at the end of the day this is a hard lesson in the need for company policies that govern what can and cannot be connected to a production network.  At my employer (a large Fortune 500 manufacturing enterprise) our network policy is that all access ports on switches are configured with BPDUguard enabled such that when any unknown switching device is plugged into it the port becomes error disabled.  If you have SNMP monitoring on your switches, then you will get an alert.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a small price to be paid in user frustration but this is more than made up for in the fact that you will automatically have visibility and hopefully control over what gets connected and you won't have to deal with the network outages in the future.&lt;/p&gt;&#xA;" OwnerUserId="3527" LastActivityDate="2013-12-16T16:51:47.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5493" PostTypeId="2" ParentId="5482" CreationDate="2013-12-16T17:46:52.640" Score="6" Body="&lt;p&gt;Do you &lt;em&gt;need&lt;/em&gt; QOS on a dedicated VoIP network?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Possibly not, but you probably want it in place.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It really will depend on the network layout/capacity, the complexity of your phone system, the volume of voice traffic, and your business needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the most basic example I can think of:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If a link is so saturated with calls that call-control traffic can't get through, what happens?&lt;/strong&gt;  You should ideally still use QOS to give call-control traffic a guaranteed portion of each link.  If you do not, you could potentially wind up with all sorts of unexpected call behavior.  (Dropped calls, one way traffic, etc, etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another consideration is, do you control the entire network?  If this is multiple sites connected across some sort of MPLS service, you may need QOS to prioritize your traffic within the provider's network. (Which they'll gladly sell you at a cost.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bottom line is this: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Do you care about a specific portion of your network traffic reaching it's destination?  Then QOS is your friend.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-12-16T17:53:52.843" LastActivityDate="2013-12-16T17:53:52.843" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5495" PostTypeId="2" ParentId="5489" CreationDate="2013-12-16T18:47:07.647" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;another switch that had &lt;strong&gt;STP disabled&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't have to read any further than that. &quot;&lt;em&gt;Doctor, it hurts when I do X...&lt;/em&gt;&quot; Obviously, you shouldn't be disabling STP on anything that supports it, lest this very situation occur.  However, given your topology, STP should've partitioned off the S1-S2 link.  But seeing as those are LINKSYS switches with a Cisco badge on them, I don't expect them to handle this correctly.  Nor do I expect a Netgear GS108T -- a cheap, simple switch (I have a few) -- to have robust storm-control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Really the only thing that can be said is &quot;Don't do that.&quot; (where &quot;that&quot; equals (a) &quot;disable STP&quot; and (b) &quot;plug a switch into itself&quot;. I cannot make you do either of those things. And you cannot be sure someone else won't do (b).)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't want to sound like I'm pushing the more expensive Cisco switches, but I have the same type of situation pop up from time to time in our VMware lab when someone configures a virtual load balancer (alteon, if you care) with two interfaces in the same network. Our Cisco 2960S's immediately kill that port -- errdisable self-looped port.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="775" LastEditDate="2013-12-16T18:55:59.993" LastActivityDate="2013-12-16T18:55:59.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5497" PostTypeId="2" ParentId="5400" CreationDate="2013-12-17T01:28:28.493" Score="3" Body="&lt;p&gt;For four devices applying a default configuration by hand is a good option. However if you'd like to upgrade or downgrade and apply a default configuration to multiple devices then Zero Touch Provisioning (ZTP) might be a more convenient solution for Juniper hardware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB27327&quot; rel=&quot;nofollow&quot;&gt;KB27327&lt;/a&gt; has some good information regarding the process as well the &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.3/topics/task/configuration/software-image-and-configuration-automatic-provisioning-confguring.html&quot; rel=&quot;nofollow&quot;&gt;Configuring Zero Touch Provisioning&lt;/a&gt; article.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Requires;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DHCP server which provides the location of the software image and configuration files on the network&lt;/li&gt;&#xA;&lt;li&gt;Anonymous FTP, HTTP or TFTP server where the software image and configuration files are stored. &lt;/li&gt;&#xA;&lt;li&gt;DNS&lt;/li&gt;&#xA;&lt;li&gt;NTP (optional)&lt;/li&gt;&#xA;&lt;li&gt;Syslog (optional)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="824" LastActivityDate="2013-12-17T01:28:28.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5504" PostTypeId="1" CreationDate="2013-12-17T12:32:44.423" Score="8" ViewCount="7218" Body="&lt;p&gt;I have a ASA5510 to connect clients to my company. I use a site-to-site IPSec VPN with a variety of vendors on the other side (Cisco, Sonicwall, Zyxel, Checkpoint, etc...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For every remote LAN, I translate the network client in a single IP address; for instance:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Client1 192.168.1.0/24 Dynamic PAT (hide) a.b.c.1/24&lt;/li&gt;&#xA;&lt;li&gt;Client2 172.16.0.0/16 Dynamic PAT (hide) a.b.c.2/24&lt;/li&gt;&#xA;&lt;li&gt;Client3 172.17.4.0/26 Dynamic PAT (hide) a.b.c.3/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Everything is working fine with the current configuration, but now I have a new client (ClientN) with the same IP addressing as Client1.&#xA;I tried &quot;ClientN 192.168.1.0/24 Dynamic PAT (hide) a.b.c.n/24&quot;, but when I did it Client1 lost the connection and I had to remove ClientN's network...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have an idea to permit same remote IP addresses to use VPN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use ASDM to setup the ASA.&lt;/p&gt;&#xA;" OwnerUserId="3589" LastEditorUserId="44" LastEditDate="2014-02-06T15:30:00.330" LastActivityDate="2014-05-07T17:08:27.820" Title="NAT with VPN Site to Site and Remote LANs with same IP address" Tags="|cisco-asa|vpn|nat|ipsec|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5505" PostTypeId="2" ParentId="5392" CreationDate="2013-12-17T15:24:59.830" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/en/US/docs/wireless/access_point/1250/installation/guide/125h_f.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/wireless/access_point/1250/installation/guide/125h_f.html&lt;/a&gt; :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;ip dhcp pool &lt;i&gt;pool_name&lt;/i&gt; &#xA;network &lt;i&gt;IP_Network Netmask&lt;/i&gt; &#xA;default-router &lt;i&gt;Default_router_IP&lt;/i&gt; &#xA;dns-server &lt;i&gt;DNS_Server_IP&lt;/i&gt;&#xA;&#xA;Where:&#xA;&#xA;&lt;i&gt;pool_name&lt;/i&gt; is the name of the DHCP pool, such as AP1000 or AP1500&#xA;&lt;i&gt;IP_Network&lt;/i&gt; is the network IP address where the controller resides, such as 10.0.15.1&#xA;&lt;i&gt;Netmask&lt;/i&gt; is the subnet mask, such as 255.255.255.0&#xA;&lt;i&gt;Default_router_IP&lt;/i&gt; is the IP address of the default router, such as 10.0.0.1&#xA;&lt;i&gt;DNS_Server_IP&lt;/i&gt; is the IP address of the DNS server, such as 10.0.10.2&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also not sure how RHEL fits into your picture...&lt;/p&gt;&#xA;" OwnerUserId="85" LastActivityDate="2013-12-17T15:24:59.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5507" PostTypeId="1" AcceptedAnswerId="6866" CreationDate="2013-12-17T18:44:27.530" Score="5" ViewCount="1583" Body="&lt;p&gt;We have a handful of small business switches from cisco, model SF 302-08P.  I'm trying to configure them for full tacacs support, however it appears that the model only supports tacacs for authentication, not for accounting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the version info and relevant configuration that I have so far.  Any suggestions would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW version    1.1.2.0 ( date  12-Nov-2011 time  23:34:26 )&#xA;Boot version    1.1.0.6 ( date  11-May-2011 time  18:31:00 )&#xA;HW version    V02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication enable default tacacs enable&#xA;aaa authentication login default tacacs local&#xA;tacacs-server host 10.3.1.1 key redacted    priority 3&#xA;tacacs-server host 10.2.1.1 key redacted    priority 2&#xA;tacacs-server host 10.1.1.1 key redacted&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="154" LastActivityDate="2014-03-17T20:02:28.790" Title="Does the Cisco SF 302-08P Small Business Switch support accounting commands to tacacs?" Tags="|cisco|tacacs|accounting|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5508" PostTypeId="2" ParentId="5507" CreationDate="2013-12-17T18:46:39.020" Score="0" Body="&lt;p&gt;You forgot:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Try and see if that works.&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2013-12-17T18:46:39.020" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5510" PostTypeId="1" CreationDate="2013-12-17T20:13:14.823" Score="2" ViewCount="431" Body="&lt;p&gt;I'm using Cisco ASA 8.2 and am planning to upgrade to 8.4 or later. If you know NAT is totaly redisigned in the newer versions (as of 8.3 and up)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm first going to cleanup the excisting rules and have a question about NAT exemption.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (apple) 0 access-list nonat_a&#xA;access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 10.10.254.0 255.255.255.0&#xA;access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 10.10.50.0 255.255.255.0&#xA;access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 10.11.71.0 255.255.255.0&#xA;access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 host 10.11.67.11&#xA;access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 host 172.21.53.13&#xA;access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 10.11.65.0 255.255.255.0&#xA;access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 host 172.21.53.22&#xA;access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 10.11.66.0 255.255.255.0&#xA;access-list nonat_a extended permit ip 10.11.69.0 255.255.255.0 host 172.21.230.17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when this is my nat excemption configuration, and I don't have got any hits on them&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list nonat_a; 9 elements; name hash: 0x730fb5b7&#xA;access-list nonat_a line 1 extended permit ip 10.11.69.0 255.255.255.0 10.10.254.0 255.255.255.0 (hitcnt=0) 0x55398b19 &#xA;access-list nonat_a line 2 extended permit ip 10.11.69.0 255.255.255.0 10.10.50.0 255.255.255.0 (hitcnt=0) 0x973d918e &#xA;access-list nonat_a line 3 extended permit ip 10.11.69.0 255.255.255.0 10.11.71.0 255.255.255.0 (hitcnt=0) 0x8456bc46 &#xA;access-list nonat_a line 4 extended permit ip 10.11.69.0 255.255.255.0 host 10.11.67.11 (hitcnt=0) 0x32c44f8d &#xA;access-list nonat_a line 5 extended permit ip 10.11.69.0 255.255.255.0 host 172.21.53.13 (hitcnt=0) 0x718c853b &#xA;access-list nonat_a line 6 extended permit ip 10.11.69.0 255.255.255.0 10.11.65.0 255.255.255.0 (hitcnt=0) 0x2ee8036c &#xA;access-list nonat_a line 7 extended permit ip 10.11.69.0 255.255.255.0 host 172.21.53.22 (hitcnt=0) 0x6fa0837f &#xA;access-list nonat_a line 8 extended permit ip 10.11.69.0 255.255.255.0 10.11.66.0 255.255.255.0 (hitcnt=0) 0xd61e0f54 &#xA;access-list nonat_a line 9 extended permit ip 10.11.69.0 255.255.255.0 host 172.21.230.17 (hitcnt=0) 0x5f884523 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;May I then conclude that my nat exemptions are not being used? I also niticed that I can't trigger the nat excemption with the build in packettracer. Is that true or should I be aplle to test exemption with the packettrace as well?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards&#xA;S&lt;/p&gt;&#xA;" OwnerUserId="1013" LastActivityDate="2013-12-19T08:33:49.273" Title="Cisco ASA exempt" Tags="|cisco-asa|firewall|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5511" PostTypeId="2" ParentId="5504" CreationDate="2013-12-17T20:32:40.040" Score="-2" Body="&lt;p&gt;Bidirectional network address translation (twice nat).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use source nat together with destination nat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find a lot of info about it, for example: &lt;a href=&quot;http://www.youtube.com/watch?v=joiKul3SV5s&quot; rel=&quot;nofollow&quot;&gt;http://www.youtube.com/watch?v=joiKul3SV5s&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1013" LastEditorUserId="3662" LastEditDate="2013-12-29T19:33:13.767" LastActivityDate="2013-12-29T19:33:13.767" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5512" PostTypeId="2" ParentId="5510" CreationDate="2013-12-17T21:42:38.170" Score="2" Body="&lt;p&gt;The hit count shows how many times traffic was matched to that ACL. Before you remove them though I would look into why they were put in place in the first place. I've seen rules put in place that are used once a year for a couple of days and then not used for a looooong time. The hit count will only show matches since the last clearing of statistics or a reboot. Maybe those rules are used infrequently and haven't incremented for that reason. Just a thought. Perhaps somebody else can provide more insight.&lt;/p&gt;&#xA;" OwnerUserId="3505" LastActivityDate="2013-12-17T21:42:38.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5513" PostTypeId="1" AcceptedAnswerId="5514" CreationDate="2013-12-17T21:58:53.830" Score="1" ViewCount="1021" Body="&lt;p&gt;I have basic understanding of networking, switching, and routing and am trying to set up D-Link  DWL-3200AP with two SSIDs, each with its own data rate limit.  I have two SSIDs working however, can't seem to figure out how to add individual bandwidth limits.  Is this even possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASCII art diagram:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ Netgear CG3000DCR Cable Modem/Wired Router ] &amp;lt;====&amp;gt; [ D-Link DWL-3200AP ]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3594" LastEditorUserId="775" LastEditDate="2013-12-18T06:14:52.910" LastActivityDate="2013-12-18T06:14:52.910" Title="Bandwidth limits for different SSIDs" Tags="|router|wireless|" AnswerCount="1" CommentCount="1" ClosedDate="2019-04-27T00:30:43.280" ContentLicense="CC BY-SA 3.0" />
  <row Id="5514" PostTypeId="2" ParentId="5513" CreationDate="2013-12-17T23:15:02.453" Score="1" Body="&lt;p&gt;&lt;strong&gt;Short answer:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately with your current equipment you're out of luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Long answer:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I'm seeing on &lt;a href=&quot;http://www.dlink.com/uk/en/business-solutions/wireless/access-points/access-points/dwl-3200ap-wireless-poe-access-point&quot; rel=&quot;nofollow&quot;&gt;D-Link's website for the DWL-3200AP&lt;/a&gt;, this AP is pretty basic and does not support the type of QOS functionality you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also in looking at the Tech Specs on &lt;a href=&quot;http://www.netgear.com/service-providers/products/cable/gateways/cg3000dcr.aspx#tab-techspecs&quot; rel=&quot;nofollow&quot;&gt;Netgear's website for the CG3000DCR&lt;/a&gt;, you're utilizing a very basic combo Modem/Router.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As other folks on this site have pointed out, this type of equipment falls into the &lt;em&gt;&quot;Pro-sumer&quot;&lt;/em&gt; niche.  While these devices are on topic for this site, and are arguably more powerful/feature rich than normal consumer gear, they fall very short of &quot;Enterprise grade&quot;.  So as your needs increase for network segmentation, QOS, and any other dozen features, you will begin to feel the hurt from these devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is a feature your business needs, you may want to look into putting a more powerful/feature rich network and wireless solution in place.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2013-12-18T01:46:56.290" LastActivityDate="2013-12-18T01:46:56.290" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5515" PostTypeId="2" ParentId="5457" CreationDate="2013-12-18T00:09:42.217" Score="2" Body="&lt;p&gt;You could use &lt;a href=&quot;http://www.shrubbery.net/rancid/&quot; rel=&quot;nofollow&quot;&gt;RANCID&lt;/a&gt; to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You get a few other nice things such as version control of the configs, email diffs and other nice things (by default it takes a hardware inventory so if the hardware changes you get an alert with that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It works with every switch and router I have thrown at it so far (Cisco/Juniper/Dell) which is another plus.&lt;/p&gt;&#xA;" OwnerUserId="3546" LastActivityDate="2013-12-18T00:09:42.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5519" PostTypeId="1" AcceptedAnswerId="5558" CreationDate="2013-12-18T03:03:23.960" Score="2" ViewCount="947" Body="&lt;p&gt;I have a Cisco Catalyst 6500 with the 720 Supe card. I would like to get the upload and download utilization of a specific port. I would like it from SNMP, I have looked for the correct MIB but no luck. The port I am trying to see is gi2/23. &lt;/p&gt;&#xA;" OwnerUserId="2080" LastEditorUserId="2080" LastEditDate="2013-12-19T16:48:13.630" LastActivityDate="2013-12-19T18:56:01.363" Title="Bandwidth Speeds" Tags="|cisco|snmp|bandwidth|internet|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="5520" PostTypeId="2" ParentId="3657" CreationDate="2013-12-18T04:36:53.377" Score="5" Body="&lt;p&gt;We solved this with new cable runs using STP instead of UTP. No more issues with POE to the APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First time we've needed STP and we can't find anything that would cause the interference with the run.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-12-18T04:36:53.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5521" PostTypeId="1" AcceptedAnswerId="5522" CreationDate="2013-12-18T06:59:08.020" Score="1" ViewCount="23019" Body="&lt;p&gt;I was asked by an interviewer about the following question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any way to make routers to forward Broadcast traffic?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I said no for the above question as routers break the broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He said &quot;it is possible?&quot; I have gone through lot of books, but it was no use.&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="775" LastEditDate="2013-12-18T07:51:40.613" LastActivityDate="2013-12-18T08:01:07.840" Title="How can routers forward broadcast traffic?" Tags="|router|ipv4|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5522" PostTypeId="2" ParentId="5521" CreationDate="2013-12-18T07:17:46.547" Score="3" Body="&lt;p&gt;Depends on the system. Cisco's will forward certain broadcast traffic (hint: google &quot;ip helper-address&quot;)  Other protocols have specific mechanisms to forward (&quot;relay&quot;) their broadcast traffic -- for example DHCP, normally it would cease being broadcast when relayed, but many system can be configured to broadcast the relayed request. (I personally do that so the pxe server can see the requests as well, and answer boot requests.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-18T07:17:46.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5523" PostTypeId="2" ParentId="5521" CreationDate="2013-12-18T07:51:08.673" Score="4" Body="&lt;p&gt;You didn't specify a router vendor or network protocol, but let's assume it's a Cisco and IP (for the moment).&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Example of forwarding IP broadcasts from 10.0.1.0/24 to 192.0.2.0/24&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Assume IPv4 broadcast traffic enters the router like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  10.0.1.255            Gi0/0 +---------+              +---------+ Gi0/4&#xA;      ---&amp;gt;      10.0.1.254/24 | Router1 |---{ WAN }----| Router2 | 192.0.2.254/24&#xA; UDP port 55666               +---------+              +---------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This configuration would forward the UDP broadcast traffic on port 55666 from &lt;em&gt;Router1:Gi0/0&lt;/em&gt; to &lt;em&gt;Router2:Gi0/4&lt;/em&gt;.  The &lt;code&gt;ip helper-address 192.0.2.255&lt;/code&gt; command forwards the broadcast to 10.0.1.255 as 192.0.2.255 to &lt;em&gt;Router2:Gi0/4&lt;/em&gt;.  The broadcast would then exit &lt;em&gt;Router2:Gi0/4&lt;/em&gt; as an ethernet broadcast to IP address 192.0.2.255 (the IP subnet broadcast address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Router1's config&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;hostname Router1&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 10.0.1.254 255.255.255.0&#xA; !! if an IP broadcast matches the forward-protocol, send to 192.0.2.255&#xA; ip helper-address 192.0.2.255&#xA;!&#xA;!! allow helper-addresses to forward UDP/55666 broacasts&#xA;ip forward-protocol udp 55666&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Router2's config&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;hostname Router2&#xA;!&#xA;interface GigabitEthernet0/4&#xA; ip address 192.0.2.254 255.255.255.0&#xA; !! Allow directed broadcasts to exit as an ethernet mac-layer broadcast.&#xA; !!  This is the default setting, but is often turned off for security purposes&#xA; ip directed-broadcast&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Forwarding non-IP broadcasts across routers...&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;There are a few options... for instance:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use a router in &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk331/tk660/technologies_tech_note09186a0080094471.shtml&quot; rel=&quot;nofollow&quot;&gt;bridge mode&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Use something like &lt;a href=&quot;http://docwiki.cisco.com/wiki/Internetwork_Design_Guide_--_Designing_DLSw%2B_Internetworks#Figure%3a_Simple_Ethernet_DLSw.2B_configuration&quot; rel=&quot;nofollow&quot;&gt;DLSw&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-12-18T08:01:07.840" LastActivityDate="2013-12-18T08:01:07.840" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5524" PostTypeId="1" AcceptedAnswerId="20556" CreationDate="2013-12-18T08:35:15.977" Score="4" ViewCount="1548" Body="&lt;p&gt;I have thousands of switches where the company banner proudly flies in ASCII art made exclusively of #-marks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This, according to &lt;a href=&quot;http://www.shrubbery.net/rancid/FAQ&quot; rel=&quot;nofollow&quot;&gt;the rancid FAQ&lt;/a&gt;, is a show stopper:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Q. Are there any characters in the banner that rancid has problems with OR  &#xA; I changed the device's command prompt and now collection is failing?  &#xA;A. The trickiest part about clogin (et al) is recognizing the prompt  &#xA; correctly.  clogin looks for '&amp;gt;' and '#' to figure out if it is logged  &#xA; in or in enable mode.  So if you have a '&amp;gt;' or '#' in your login banner  &#xA; (or other motd), then clogin gets confused and will not be able to log  &#xA; in correctly, and thus rancid will fail.  &#xA;&#xA; Don't use '&amp;gt;' or '#', or whatever the termination character of the given  &#xA; device's prompt is, in your prompt or in your banner or other motd.  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously, I can't change all of the banners. Even if I could, I'd have used &lt;code&gt;clogin&lt;/code&gt;, soooo... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone hacked together a workaround for this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it helps, in my case there banner lines all start with at least three spaces.&lt;/p&gt;&#xA;" OwnerUserId="399" LastActivityDate="2015-08-11T13:23:11.540" Title="Getting rancid/clogin to work in spite of banners filled with #-marks?" Tags="|rancid|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5525" PostTypeId="1" AcceptedAnswerId="5550" CreationDate="2013-12-18T09:24:54.497" Score="5" ViewCount="10852" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4A4kB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having attempted to research this I’m still uncertain of where best to place firewalls in an existing network due to needing to retain a common vlan between 2 core sites.  The network has the following requirements:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Redundancy between 2 x corporate sites to allow network based&#xA;internet access with L2 adjacency for HSRP between the Cisco1921 routers so&#xA;that DMZ resources and Customer LAN hosts use the vip as their&#xA;default gateway &lt;/li&gt;&#xA;&lt;li&gt;All internet traffic to/from the Customer LAN should be processed&#xA;by the local ASA &lt;/li&gt;&#xA;&lt;li&gt;All traffic from the internet to the DMZ should be processed by the ASA&lt;/li&gt;&#xA;&lt;li&gt;Internet traffic and Corporate data will share the same WAN links&#xA;and need to retain a common vlan that trunks between SVIs on&#xA;the L3 switches&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is there a better way of achieving this instead of having to translate and explicitly send everything via the ASA firewalls between the internet access, dmz and lan users?&#xA;I would prefer to have the firewalls in the direct path between the routers and switches to simplify their configs but not sure how else I can retain the HSRP communication between sites if placed other than depicted in the diagram?&#xA;Does it actually matter where the ASA sits from a security perspective? &lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2013-12-19T18:41:56.087" Title="What is most effective placement for firewall devices ?" Tags="|cisco|cisco-asa|trunk|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5530" PostTypeId="1" AcceptedAnswerId="5565" CreationDate="2013-12-18T12:18:04.903" Score="2" ViewCount="321" Body="&lt;p&gt;In the lab I have some 7206VXRs (and 7301s, but lets concentrate on 7206 for now) which are acting as PE routers. I wish to test some basic QoS policies on these for customer facing VoIP services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the 7206VXR (with NPE-G1) for example I have two kinds of customers that need QoS'ing; PPP (ADSL) users received over L2TP via a wholesale provider and Ethernet customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PPP users are terminated on Virtual-Interfaces, and I can apply QoS policies to them by adding an AV pair to their RADIUS profiles (&lt;code&gt;cisco-avpair = &quot;sub-qos-policy-out=policy-name&quot;&lt;/code&gt;). No problems there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Ethernet subscribers, they are terminated on separate sub-interfaces as VLANs, and I can apply QoS on the sub-interfaces as follows;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int gi0/0.100&#xA; description Customer 1&#xA; encapsulation dot1q 100&#xA; ip addr 10.0.0.1/30&#xA; service-policy output customer-policy&#xA;&#xA;int gi0/0.101&#xA; description Customer 2&#xA; encapsulation dot1q 101&#xA; ip addr 10.0.0.5/30&#xA; service-policy output customer-policy&#xA;&#xA;and so on...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I haven't applied any QoS policies anywhere yet, I have simply shown above how and where I intend to enable them&lt;/em&gt;. What I want to know before I enable them though, is &lt;strong&gt;how can I monitor the 'strain' (computational and resource overhead) placed on the router after applying these policies?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding here is that as we add more subscribers to the router with QoS enabled (not all would need QoS if they don't have VoIP services) more memory resources (buffers) and CPU cycles are going to be required because our ADSL users are often congested (it probably won't be so bad for Ethernet customers as they typically have faster access circuits).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is two fold really; how can I monitoring buffer pool usage for QoS policies, and should I? Should I be measuring something else? I am already graphing CPU usage and total memory usage via SNMP (Cacti/Observium/etc), is that all I need, is just watching those figures sufficient? I don't want to pile on subscribers and QoS policies and then exhaust the routers resources and drop packets even though it still has plenty of bandwidth to spare.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2013-12-20T06:13:05.933" Title="Cisco: Can (and should) I monitor the processing and memory load of QoS on a router?" Tags="|cisco|qos|monitoring|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5531" PostTypeId="1" CreationDate="2013-12-18T12:42:22.567" Score="4" ViewCount="1049" Body="&lt;p&gt;Let's say I've got a 802.11n WiFi network in which all hosts are using 802.11n standard. If you start sniffing with an 802.11b/g card (using airodump for instance) will you be able to perform any malicious operation on my network?&lt;/p&gt;&#xA;" OwnerUserId="3601" LastEditorUserId="3210" LastEditDate="2013-12-18T18:01:40.760" LastActivityDate="2014-07-26T15:46:53.117" Title="Can a 802.11b/g wireless card sniff 802.11n traffic?" Tags="|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5532" PostTypeId="2" ParentId="5531" CreationDate="2013-12-18T12:45:52.043" Score="8" Body="&lt;p&gt;802.11 b/g cards can only sniff 802.11b/g traffic.  They cannot see 802.11n traffic.  See caveats A &amp;amp; B, below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Caveat A&lt;/strong&gt;: Many 802.11n APs are configured to allow b/g connections.  Once you have an IP connection, all kinds of things are possible, including ARP cache poisoning, mac-floods, MITM attacks, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt; for &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5531/can-a-802-11b-g-wireless-card-sniff-802-11n-traffic#comment8210_5532&quot;&gt;queston in the comments&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Caveat B&lt;/strong&gt;: Even if the sender / receiver have 802.11n radios, and the attacker only has 802.11b/g, it's &lt;em&gt;very possible&lt;/em&gt; to direct RF jamming signals towards an 802.11n sender / receiver and make them intentionally fall back to 802.11b/g data rates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/wireless/ps9391/ps9393/ps9394/prod_white_paper0900aecd807395a9.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's 20 Myths of Wi-Fi interference&lt;/a&gt; (emphasis mine):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;... non-802.11 types of interference typically don't work cooperatively with 802.11 devices, and can cause significant loss of throughput. In addition, they can cause secondary effects such as rate back-off, in which &lt;em&gt;retransmissions caused by interference trick the 802.11 devices into thinking that they should use lower data rates than appropriate&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When an 802.11n PHY falls back to 802.11b/g rates, it changes the physical layer signalling from 802.11n to 802.11b/g (per-client).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-07-26T15:46:53.117" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5534" PostTypeId="1" CreationDate="2013-12-18T15:42:26.237" Score="6" ViewCount="3796" Body="&lt;p&gt;So, I am getting deep into my CCIE study and I just read about the TX-ring-limit interface command. I have used QoS a bit to oversubscribe software buffers to prevent frame loss on switches and whatnot, can you use the &quot;TX-ring-limit&quot; in a similar manner to decrease the likelihood of frame loss during bursty traffic on a LAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally I understand the following:&lt;br&gt;&#xA;1) TX-ring-limit should be set to either a value of 1 or 2 for a low speed interface such as a T1 serial&lt;br&gt;&#xA;2) Higher values can be configured on higher speed interfaces&lt;br&gt;&#xA;3) Setting a high value can introduce jitter on a link because the software queue of a IOS device will send the packets to the hardware queue where they are simply FIFO&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone experimented with setting this to a higher value on ethernet LAN interfaces to allow the hardware queue to &quot;hold on to frames&quot; during a bursty traffic period, rather than drop them?&lt;/p&gt;&#xA;" OwnerUserId="3210" LastEditorUserId="775" LastEditDate="2013-12-18T15:47:34.010" LastActivityDate="2013-12-18T21:45:01.320" Title="TX-ring-limit Values" Tags="|cisco|router|qos|switch|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5535" PostTypeId="2" ParentId="5531" CreationDate="2013-12-18T18:51:31.943" Score="6" Body="&lt;p&gt;You will not be able to capture any traffic using the high throughput (MCS) data rates.  However, by default 802.11n devices will support and use legacy data rates depending on the situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as the AP and/or client are using legacy data rates, you should be able to capture their traffic.  This would include most (if not all) management and control frames which will typically use a lower/legacy data rate.  This is opposed to data frames which run at the best possible data rate, including the EAPOL exchange of keying material.  So you will miss that unless the AP and client both use a legacy data rate for this exchange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in answer, yes there are many malicious operations that can be carried out on an 802.11n network by a legacy client.  In particular anything that would exploit management and/or control frames, plus any data traffic that uses legacy data rates.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-12-18T18:51:31.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5536" PostTypeId="2" ParentId="5534" CreationDate="2013-12-18T21:45:01.320" Score="6" Body="&lt;p&gt;The TX-Ring is the hardware interface queue and is FIFO. QOS does NOT begin to operate in a router until the TX-Ring is full. The tradeoff is a small TX-Ring causes QoS to cut in quicker (good when you want to use LLQ for VoIP) at the cost of CPU, a large TX-Ring uses less cpu (don't need to service the queue as much) but will increase jitter (remember that the queue is Fifo) for voip applications. This is an important VoIP tuning knob on the older cisco routers for the above reasons. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does not impact drops because TX-Ring only exists in routers and when the tx ring is full traffic is queued in router memory.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-12-18T21:45:01.320" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5537" PostTypeId="1" AcceptedAnswerId="5541" CreationDate="2013-12-18T22:39:56.170" Score="8" ViewCount="2417" Body="&lt;p&gt;I am familiar with the arp cache being relative to the default age timer regardless of whether a packet has been seen or not and that the router should refresh entries by sending an update arp request before the default 240 mins have expired in Cisco, however...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a) Do the entries from host mac addresses always get flushed when physical cables are unplugged?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b) Is this platform dependent and does the behaviour vary amongst different vendors too?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c) Not sure if it is a bug/card issue or not but i am seeing an entry retained even when the line protocol is down, so would appreciate views on the expected behaviour?&lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2013-12-18T23:16:19.023" Title="What is the expected behaviour of the ARP cache?" Tags="|cisco|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5538" PostTypeId="1" AcceptedAnswerId="5540" CreationDate="2013-12-18T22:41:58.910" Score="8" ViewCount="2468" Body="&lt;p&gt;I have two Cisco Catalyst 4510R+E systems that I am interconnecting, using the interfaces on the sup's (both have dual Sup7-E's.) They are marked &lt;code&gt;1G/10G Uplinks (SFP/SFP+)&lt;/code&gt; on the sup above the interfaces. I have ordered 10G SFP+ modules, but in the meantime, I already have 1G SFP's available (GLC-SX-MM), and I have inserted one in one of the sup interfaces (Te5/1), and see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Switch#sh int status mod 5&#xA;&#xA;Port      Name               Status       Vlan       Duplex  Speed Type&#xA;Te5/1                        notconnect   1            full   auto 1000BaseSX&#xA;Te5/2                        notconnect   1            full   auto No XCVR&#xA;Te5/3                        inactive     1            full   auto No XCVR&#xA;Te5/4                        inactive     1            full   auto No XCVR&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, does this mean that the sup autosenses the module speed (in this case, 1G) and when I get the 10G modules, I can just replace the 1G mod's with the 10G mod's, and the links will come back up at 10G? (the infrastructure fiber as well as the patch cables are all OM-3 MM, so they're good to go for 10G...) Or, is there some command needed to set the interface to be 10G rather than 1G?&lt;/p&gt;&#xA;" OwnerUserId="85" LastActivityDate="2014-05-28T08:10:06.333" Title="Are the SFP/SFP+ int's on WS-X45-SUP7-E autosensing?" Tags="|cisco-catalyst|fiber|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5540" PostTypeId="2" ParentId="5538" CreationDate="2013-12-18T22:51:23.270" Score="7" Body="&lt;p&gt;In a word: YES.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you want to do something like force a 10G SFP+ to link at 1G, you don't have to do anything but plug it in.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-18T22:51:23.270" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5541" PostTypeId="2" ParentId="5537" CreationDate="2013-12-18T23:16:19.023" Score="10" Body="&lt;p&gt;Remember that your ARP table and your MAC address table (CAM) are two separate tables that are not tied together in any sense (at least on any platform I recall).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ARP table does not have any awareness of the port state, so removing a device from the network does not remove it from the ARP table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as the MAC address table, when a port on the local switch goes down, it will flush the MAC address entries for that port.  However, upstream switches will not have this awareness and will continue to have this entry in their MAC address tables until it ages out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to answer your specific questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;When a cable is unplugged, the MAC address for stations on that link are removed from the MAC address table, but the corresponding ARP entries are not removed from the ARP table.&lt;/li&gt;&#xA;&lt;li&gt;This behavior is largely consistent in my experience, however since I don't have experience with all vendors and every platform from each vendor, I cannot say this is true with all of them.&lt;/li&gt;&#xA;&lt;li&gt;Per #1 above, you will most likely continue to see ARP entries until they age out, even after the line protocol is down as only the MAC address table entries are removed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-12-18T23:16:19.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5545" PostTypeId="2" ParentId="5504" CreationDate="2013-12-19T08:26:54.340" Score="1" Body="&lt;p&gt;If your ASA supports multiple context you ca try that. This means you will virtualize your ASA. You can have some clients in a context and other in other context.&lt;/p&gt;&#xA;" OwnerUserId="3421" LastActivityDate="2013-12-19T08:26:54.340" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5546" PostTypeId="2" ParentId="5510" CreationDate="2013-12-19T08:33:49.273" Score="0" Body="&lt;p&gt;Those NAT exempts are for site-to-site(also Remote) tunnels, right?&#xA;So check your VPN tunnels. Check the ACL for the cryptomaps. &#xA;I think it is safe to remove statements that are not associated with any VPN.&lt;/p&gt;&#xA;" OwnerUserId="3421" LastActivityDate="2013-12-19T08:33:49.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5547" PostTypeId="1" AcceptedAnswerId="5548" CreationDate="2013-12-19T10:55:36.297" Score="12" ViewCount="1683" Body="&lt;p&gt;I have a pair of Cisco 6509 routers, which are monitored via SNMP (with &lt;a href=&quot;http://www.observium.org/wiki/Main_Page&quot;&gt;Observium&lt;/a&gt;, to be accurate).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today we spotted a peak of CPU usage for a Switching Processor. The peak can be correlated with a peak of inbound unicast on a port named &quot;NDE_vlan1014&quot; (and &quot;NDE_vlan1014&quot; on the other router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand from google that NDE refers to Netflow, but I can find nowhere an explanation on what is actually graphed for that interface. It is visible only via SNMP (not in a &lt;code&gt;sh ip int br&lt;/code&gt; ) and I have no vlan 1016 nor 1014.&#xA;I don't see any peak in my netflow analyzer (as-stats) either...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the question is : what is this &quot;NDE_vlan&quot; interface ?&lt;/p&gt;&#xA;" OwnerUserId="564" LastActivityDate="2013-12-19T11:23:35.947" Title="What is the &quot;NDE&quot; interface on a Cisco 6500?" Tags="|cisco|cisco-6500|netflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5548" PostTypeId="2" ParentId="5547" CreationDate="2013-12-19T11:18:32.287" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;... Today we spotted a peak of CPU usage for a Switching Processor. The peak can be correlated with a peak of inbound unicast on a port named &quot;NDE_vlan1014&quot; ...&lt;br&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;So the question is : what is this &quot;NDE_vlan&quot; interface ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;NDE_vlan&lt;/code&gt; is one of the Catalyst 6500's hidden vlans.  The 6500 allocates internal vlans for a lot of different functions, and those vlans cant be used for real user data after the 6500 snarfs it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see the internal vlans, use &lt;code&gt;show vlan internal usage&lt;/code&gt;... my particular 6500 doesn't run netflow export, but you can see it on your switch with that command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CORE01.PUB.SEA01#sh vlan internal usage&#xA;&#xA;VLAN Usage&#xA;---- --------------------&#xA;4081 Tunnel1&#xA;4082 GigabitEthernet3/1&#xA;4083 IPv6 Multicast Egress multicast&#xA;4084 Multicast VPN 0 QOS vlan&#xA;4085 Egress internal vlan&#xA;4086 L3 multicast partial shortcuts for VPN 0&#xA;4087 Control Plane Protection&#xA;4088 PM vlan process (trunk tagging)&#xA;4089 online diag vlan5&#xA;4090 online diag vlan4&#xA;4091 online diag vlan3&#xA;4092 online diag vlan2&#xA;4093 online diag vlan1&#xA;4094 online diag vlan0&#xA;&#xA;CORE01.PUB.SEA01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the 6500 exports flows to a collector, it uses the DFCs or the MSFC CPU to send the packets.  If you're seeing CPU spikes due to netflow export, you either should:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use linecards which have &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-21377#Distributed_Forwarding_Card_DFC&quot;&gt;DFCs&lt;/a&gt; (which may mean spending money)&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;http://blogs.manageengine.com/netflowanalyzer/2011/10/13/netflow-sampling-on-cisco-6500-7600-series-device.html&quot;&gt;Sampled netflow&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Informational: Sampled netflow&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Typically the syntax for sampled netflow on the 6500 is &lt;code&gt;mls sampling time-based 64&lt;/code&gt;; this samples one out of every 64 packets.  The values for sampled netflow are limited...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CORE01.PUB.SEA01(config)#mls sampling time-based ?&#xA;  64&#xA;  128&#xA;  256&#xA;  512&#xA;  1024&#xA;  2048&#xA;  4096&#xA;  8192&#xA;&#xA;CORE01.PUB.SEA01(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, if you sample your netflow, obviously you might miss some packets you care about, so it's really a judgment call as to whether it can solve your problem.  It all depends on why you're using netflow.  For security monitoring, you can't really afford to drop packets (thus netflow on a busy 6500 is the wrong answer).  If you're graphing application utilization, sampled netflow could be a useful tool (assuming you adjust your graphs for the sampling interval).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2013-12-19T11:23:35.947" LastActivityDate="2013-12-19T11:23:35.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5550" PostTypeId="2" ParentId="5525" CreationDate="2013-12-19T12:47:54.440" Score="4" Body="&lt;p&gt;Here is a description of one solution:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create 4 additional VLANs on the L2 trunk.  Place the firewalls between the router and L3 switches, and use  3 VLANS to connect the inside, outside and DMZ interfaces, turning the firewalls into a HA (failover) pair.  The 4th VLAN becomes the heartbeat link between the two firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default gateway for the outside interface is the HSRP address.  The firewalls are configured with two contexts with identical policies.  Context 1 will have the primary FW on the left side of the diagram, and context 2 will have the right FW as the primary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Users on the left side will set their default gw to contect1, and users on the right will use context 2.  This will keep traffic on the local FW and also provide redundancy if the local FW fails. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each context has a unique public address (and NAT configuration) so that inbound traffic always goes to the correct FW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The downside of this is that your DMZ devices will have two public addresses if they are located on both sides of the network.  You can either:&#xA;   1.  Decide that the DMZ devices will always use one context regardless of their physical location&#xA;   2.  Use a global load balancer to direct traffic to one or the other contexts.  That of course requires additional hardware and configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QRsTn.png&quot; alt=&quot;FW Diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2013-12-19T18:41:56.087" LastActivityDate="2013-12-19T18:41:56.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5551" PostTypeId="1" AcceptedAnswerId="5554" CreationDate="2013-12-19T14:06:16.203" Score="6" ViewCount="3662" Body="&lt;p&gt;We have a Cisco 2800 router in our company that also serves as a VPN server. We use the VPN Client to connect to our corporate network (pls don't laugh, I know that it is very obsolete but I haven't had the time lately to switch to SSL VPN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router has two WAN connections. One is the primary wan (&quot;&lt;em&gt;slow wan&lt;/em&gt;&quot; link with slower upload 10D/1U mbps) and it is used for the corporate workstations used by the employees. The other is our backup link. It has higher upload speed - 11D/11U mbps, (&lt;em&gt;fast wan&lt;/em&gt;), and thus we also use the high upload link for our webserver (I have done this using PBR just for the http traffic from the webserver). For numerous other reasons we can not use the &lt;code&gt;fast wan&lt;/code&gt; connection as our primary connection and it is used only as a failover in case the primary link fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;fast wan&lt;/code&gt; also has a static IP address and we use this static IP for the VPN Client configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the thing is that because of the failover, when we connect from the outside using the VPN Client, the traffic comes from the&lt;code&gt;fast wan&lt;/code&gt; interface, but exits from the &lt;code&gt;slow wan&lt;/code&gt; interface. And because the &lt;code&gt;slow wan&lt;/code&gt; has only 1mbps upload the vpn connection is slow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way for us to redirect the vpn traffic to always use the &lt;code&gt;fast wan&lt;/code&gt; interface and to take advantage of the 11mbps upload speed of that connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bellow is a sanitized config of our router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;crypto isakmp policy 1&#xA;encr 3des&#xA;authentication pre-share&#xA;group 2&#xA;!&#xA;crypto isakmp client configuration group dc&#xA;key ***&#xA;dns 192.168.5.7&#xA;domain corp.local&#xA;pool SDM_POOL_1&#xA;acl 101&#xA;max-users 3&#xA;netmask 255.255.255.0&#xA;crypto isakmp profile sdm-ike-profile-1&#xA;   match identity group dc&#xA;   isakmp authorization list sdm_vpn_group_ml_1&#xA;   client configuration address respond&#xA;   virtual-template 1&#xA;!&#xA;!&#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac&#xA;!&#xA;crypto ipsec profile SDM_Profile1&#xA;set security-association idle-time 3600&#xA;set transform-set ESP-3DES-SHA&#xA;set isakmp-profile sdm-ike-profile-1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA;ip address 10.10.10.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA;description *WAN*&#xA;no ip address&#xA;ip mtu 1396&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet0/0.3&#xA;description FAST-WAN-11D-11U&#xA;encapsulation dot1Q 3&#xA;ip address 88.XX.XX.75 255.255.255.248&#xA;ip load-sharing per-packet&#xA;ip nat outside&#xA;ip virtual-reassembly&#xA;!&#xA;interface FastEthernet0/0.4&#xA;description SLOW-WAN-10D-1U&#xA;encapsulation dot1Q 4&#xA;ip address dhcp&#xA;ip nat outside&#xA;ip virtual-reassembly&#xA;no cdp enable&#xA;!&#xA;interface FastEthernet0/1&#xA;description *LOCAL*&#xA;no ip address&#xA;ip virtual-reassembly&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet0/1.10&#xA;description VLAN 10 192-168-5-0&#xA;encapsulation dot1Q 10&#xA;ip address 192.168.5.1 255.255.255.0&#xA;ip nat inside&#xA;ip virtual-reassembly max-reassemblies 32&#xA;no cdp enable&#xA;!&#xA;interface FastEthernet0/1.20&#xA;description VLAN 20 10-10-0-0&#xA;encapsulation dot1Q 20&#xA;ip address 10.10.0.254 255.255.255.0&#xA;ip access-group PERMIT-MNG out&#xA;ip nat inside&#xA;ip virtual-reassembly&#xA;!&#xA;!!! NOTE: This route map is used to PBR the http traffic for our server&#xA;ip policy route-map REDIRECT-VIA-FAST-WAN&#xA;no cdp enable&#xA;!&#xA;interface Virtual-Template1 type tunnel&#xA;ip unnumbered Loopback0&#xA;tunnel mode ipsec ipv4&#xA;tunnel protection ipsec profile SDM_Profile1&#xA;!&#xA;interface Virtual-Template3&#xA;no ip address&#xA;!&#xA;interface Virtual-Template4&#xA;no ip address&#xA;!&#xA;!&#xA;ip local pool SDM_POOL_1 192.168.5.150 192.168.5.152&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;!&#xA;!!! SLOW-WAN NEXT HOP DEFAULT ADDRESS&#xA;ip route 0.0.0.0 0.0.0.0 89.XX.XX.1 5&#xA;!&#xA;!!! FAST-WAN NEXT HOP DEFAULT ADDRESS&#xA;ip route 0.0.0.0 0.0.0.0 88.XX.XX.73 10&#xA;!&#xA;!&#xA;!&#xA;ip nat inside source route-map FAST-WAN-NAT-RMAP interface FastEthernet0/0.3 overload&#xA;ip nat inside source route-map SLOW-WAN-NAT-RMAP interface FastEthernet0/0.4 overload&#xA;!&#xA;!&#xA;access-list 101 remark SDM_ACL Category=4&#xA;access-list 101 permit ip 192.168.5.0 0.0.0.255 any&#xA;access-list 101 permit ip 10.10.0.0 0.0.0.255 any&#xA;!&#xA;ip access-list extended FAST-WAN-NAT&#xA;permit tcp 192.168.5.0 0.0.0.255 range 1025 65535 any&#xA;permit udp 192.168.5.0 0.0.0.255 range 1025 65535 any&#xA;permit icmp 192.168.5.0 0.0.0.255 any&#xA;permit tcp 10.10.0.0 0.0.0.255 range 1025 65535 any&#xA;permit udp 10.10.0.0 0.0.0.255 range 1025 65535 any&#xA;permit icmp 10.10.0.0 0.0.0.255 any&#xA;ip access-list extended REDIRECT-VIA-FAST-WAN&#xA;deny   tcp host 10.10.0.43 eq 443 9675 192.168.5.0 0.0.0.255&#xA;permit tcp host 10.10.0.43 eq 443 9675 any&#xA;ip access-list extended SLOW-WAN-NAT&#xA;permit ip 192.168.5.0 0.0.0.255 any&#xA;permit ip 10.10.0.0 0.0.0.255 any&#xA;!&#xA;!&#xA;route-map FAST-WAN-NAT-RMAP permit 10&#xA;match ip address FAST-WAN-NAT&#xA;match interface FastEthernet0/0.3&#xA;!&#xA;route-map REDIRECT-VIA-FAST-WAN permit 10&#xA;match ip address REDIRECT-VIA-FAST-WAN&#xA;set ip next-hop 88.XX.XX.73&#xA;!&#xA;route-map SLOW-WAN-NAT-RMAP permit 10&#xA;match ip address SLOW-WAN-NAT&#xA;match interface FastEthernet0/0.4&#xA;!&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;P.S. Also feel free to suggest a better name (more descriptive name) for this post&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;UPDATE: 20.12.2013&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I did as John Kennedy suggested. However the traffic was still routed OUT the &lt;code&gt;slow-wan&lt;/code&gt; interface.&#xA;I created a separate &lt;code&gt;route-map&lt;/code&gt; for the other lan interface. This is the config and the &lt;code&gt;show&lt;/code&gt; output:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the time of executing this commands I am actually SSHed from the VPN. I also tried to disconnect and reconnect again just in case. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;You may notice bellow that when I execute a &lt;code&gt;show access-list&lt;/code&gt; command that there are no matched packets for the ESP or AHP protocols.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also for the newly created route map &lt;code&gt;REDIRECT-VIA-FAST-WAN2&lt;/code&gt; there are no matched packets yet my vpn assigned IP address is into the 192.168.5.0 subnet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# sh run inter fa0/1.10&#xA;!&#xA;interface FastEthernet0/1.10&#xA; description VLAN 10 192-168-5-0&#xA; encapsulation dot1Q 10&#xA; ip address 192.168.5.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly max-reassemblies 32&#xA; ip policy route-map REDIRECT-VIA-FAST-WAN2&#xA; no cdp enable&#xA;end&#xA;&#xA;Router#&#xA;Router#sh run inter fa0/1.20&#xA;Building configuration...&#xA;&#xA;Current configuration : 251 bytes&#xA;!&#xA;interface FastEthernet0/1.20&#xA; description VLAN 20 10-10-0-0&#xA; encapsulation dot1Q 20&#xA; ip address 10.10.0.254 255.255.255.0&#xA; ip access-group PERMIT-MNG out&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; ip policy route-map REDIRECT-VIA-FAST-WAN&#xA; no cdp enable&#xA;end&#xA;&#xA;Router#&#xA;Router#sh route-map&#xA;route-map REDIRECT-VIA-FAST-WAN2, permit, sequence 10&#xA;  Match clauses:&#xA;    ip address (access-lists): REDIRECT-VIA-FAST-WAN2&#xA;  Set clauses:&#xA;    ip next-hop 88.XX.XX.73&#xA;  Policy routing matches: 0 packets, 0 bytes&#xA;!&#xA;route-map REDIRECT-VIA-FAST-WAN, permit, sequence 10&#xA;  Match clauses:&#xA;    ip address (access-lists): REDIRECT-VIA-FAST-WAN&#xA;  Set clauses:&#xA;    ip next-hop 88.XX.XX.73&#xA;  Policy routing matches: 1948323 packets, 2212263065 bytes&#xA;!&#xA;Router#&#xA;Router#sh access-lists REDIRECT-VIA-FAST-WAN&#xA;Extended IP access list REDIRECT-VIA-FAST-WAN&#xA;    10 deny tcp host 10.10.0.43 eq 443 9675 192.168.5.0 0.0.0.255 (2068620 matches)&#xA;    20 permit tcp host 10.10.0.43 eq 443 9675 any (1948603 matches)&#xA;    30 permit esp any any&#xA;    40 permit ahp any any&#xA;    !&#xA;    !!! NOTE: FIRST I TRIED WITHOUT THESE. THEY WERE ADDED AFTERWARDS JUST IN CASE. &#xA;    !!! ALSO THE ROUTER ITSELF CORRECTED THE PORT NUMBERS INTO THE CORRESPONDING PROTOCOLS&#xA;    50 permit udp any any eq isakmp&#xA;    60 permit udp any any eq 10000&#xA;    !&#xA;    !!! I MAY ASSUME THAT THE CORRECTED ENTRY non500-isakmp ACTUALY MEANS &quot;THIS WILL NOT BE USED FOR ISAKMP&#xA;    70 permit udp any any eq non500-isakmp &#xA;    80 permit tcp any any eq 4500&#xA;Router#sh access-lists REDIRECT-VIA-FAST-WAN2&#xA;Extended IP access list REDIRECT-VIA-FAST-WAN2&#xA;    10 permit ahp any any&#xA;    20 permit esp any any&#xA;    30 permit udp any any eq isakmp&#xA;    40 permit udp any any eq 10000&#xA;    50 permit udp any any eq non500-isakmp&#xA;    60 permit tcp any any eq 4500&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3619" LastEditorUserId="3619" LastEditDate="2013-12-20T16:55:31.647" LastActivityDate="2013-12-20T17:36:25.927" Title="Policy Based Routing for VPN connections with VPN Client configuration" Tags="|cisco|vpn|cisco-ios|pbr|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5554" PostTypeId="2" ParentId="5551" CreationDate="2013-12-19T14:58:48.317" Score="4" Body="&lt;p&gt;You can simply append the ACL &quot;REDIRECT-VIA-FAST-WAN&quot; to route IPSEC traffic out your &quot;fast wan&quot; interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended REDIRECT-VIA-FAST-WAN&#xA;deny   tcp host 10.10.0.43 eq 443 9675 192.168.5.0 0.0.0.255&#xA;permit tcp host 10.10.0.43 eq 443 9675 any&#xA;permit ahp any any&#xA;permit esp any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or if your router does not have the &quot;ahp&quot; and &quot;esp&quot; options for an extended ACL, you can simply add in the specific ports that the ipsec client tunnels over, namely UDP ports 500, 10000, and 4500, and also TCP 4500 for good measure. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended REDIRECT-VIA-FAST-WAN&#xA;deny   tcp host 10.10.0.43 eq 443 9675 192.168.5.0 0.0.0.255&#xA;permit tcp host 10.10.0.43 eq 443 9675 any&#xA;permit udp any any eq 500&#xA;permit udp any any eq 10000&#xA;permit udp any any eq 4500&#xA;permit tcp any any eq 4500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may also have to append your &quot;PERMIT-MNG&quot; ACL to allow outbound IPSEC traffic (depending on what that ACL is configured to do) but you stripped it out of the running config so I can not fully comment on that.&lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-12-19T14:58:48.317" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5556" PostTypeId="1" AcceptedAnswerId="5559" CreationDate="2013-12-19T17:13:06.747" Score="8" ViewCount="501" Body="&lt;ol&gt;&#xA;&lt;li&gt;Whilst I understand that product recommendations are off topic can&#xA;anyone help by explaining what the critical factors are when looking&#xA;for SFPs that are going to be compatible with a new service?&lt;/li&gt;&#xA;&lt;li&gt;Is wavelength a defining factor that should be considered/matched or should&#xA;anything else be used to guide selection?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Sorry I am new to 10G BASE-SR and I can't seem to find a good resource that can confirm if an SFP supported in a Cisco Nexus 5548UP will be compatible with a new service&#xA;The new service is described as '10 Gigabit Ethernet LAN PHY IEEE 10G BASE-LR10.3125 Gbps  +/- 100 ppm 1310nm'&lt;br&gt;&#xA;Ultimately I need to understand if a 'cisco sfp-10g-sr' for which the transmitter wavelength spec is described as 850nm is usable.  &lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2014-05-27T07:27:34.170" Title="Factors that determine compatibility of SFPs with new fibre services?" Tags="|fiber|cisco-nexus-5k|10gbase|sfp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5558" PostTypeId="2" ParentId="5519" CreationDate="2013-12-19T18:56:01.363" Score="2" Body="&lt;p&gt;A quick-and-dirty way to get the current utilization would be to poll these OIDs from &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;step=2&amp;amp;mibName=OLD-CISCO-INTERFACES-MIB&quot; rel=&quot;nofollow&quot;&gt;OLD-CISCO-INTERFACES-MIB&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;locIfInBitsSec - 1.3.6.1.4.1.9.2.2.1.1.6.x&lt;/li&gt;&#xA;&lt;li&gt;locIfInPktsSec - 1.3.6.1.4.1.9.2.2.1.1.7.x&lt;/li&gt;&#xA;&lt;li&gt;locIfOutBitsSec - 1.3.6.1.4.1.9.2.2.1.1.8.x&lt;/li&gt;&#xA;&lt;li&gt;locIfOutPktsSec - 1.3.6.1.4.1.9.2.2.1.1.9.x&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These give you the same numbers as the &quot;input rate&quot; and &quot;output rate&quot; lines from the output of &lt;code&gt;show interface&lt;/code&gt;. Just replace the &quot;x&quot; with the interface index for Gig2/23 shown in &lt;code&gt;show snmp mib ifmib ifindex&lt;/code&gt;. The MIB states that it's the &quot;five minute exponentially-decayed moving average&quot;, but the actual rate matches whatever you've configured with &lt;code&gt;load-interval&lt;/code&gt; on the interface (which defaults to 5 minutes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These OIDs will give you a pretty good point-in-time measurement of the interface's utilization without requiring an external system to keep track of deltas between measurements. However, since it's an exponentially-decayed moving average, it may not be as accurate.&lt;/p&gt;&#xA;" OwnerUserId="1339" LastActivityDate="2013-12-19T18:56:01.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5559" PostTypeId="2" ParentId="5556" CreationDate="2013-12-19T20:09:45.643" Score="10" Body="&lt;p&gt;Wavelength and rate are the two big ones. As you're dealing with 10G ethernet, rate isn't in question. (if we were talking about fibre channel, or SONET, then it would matter.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your specific case, they are providing service through a 1310nm &quot;LR&quot; (long-reach) interface.  The &quot;SR&quot; (short-reach) optics &lt;em&gt;will not&lt;/em&gt; work -- wrong wavelength (850nm) and wrong mode (SR will be multimode (62.5 or 50 micron fiber) vs. singlemode (9 micron))&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-19T20:09:45.643" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5560" PostTypeId="1" AcceptedAnswerId="5562" CreationDate="2013-12-19T22:13:30.273" Score="4" ViewCount="3168" Body="&lt;p&gt;I'm trying to gain access to my business' Cisco 2811.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did the standard password reset following these procedures: &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/routers/ps259/products_password_recovery09186a0080094675.shtml&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/products/hw/routers/ps259/products_password_recovery09186a0080094675.shtml&lt;/a&gt;&#xA;I changed the passwords and rebooted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when the system booted back up all but three of the phones returned to their normal state. The other three simply sit at &lt;strong&gt;&quot;Configuring IP&quot;&lt;/strong&gt; and never come back online. I've tried erasing the configuration on one and that didn't help at all. The phones are all Cisco 7960s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've taken a couple Cisco CCNA exam prep classes but that was a &lt;em&gt;long&lt;/em&gt; time ago so some of this is coming back to me but some I'm having to google around to find the answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;br&gt;&#xA;&lt;strong&gt;How do I bring the other three phones back online?&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;How do I access the Cisco CME of the router to make changes to the quick buttons and directory on the other phones?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found out that the fa0/1 interface is trunked out to two VLANs, one VLAN operates the PC's (192.168.1.0/24) and the other VLAN operates the phones (10.10.10.0/24)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface fa0/0 is empty so I thought that maybe if I configured that port to access the 10.10.10.0 network and set it to assign IPs by DHCP I'd be able to open the browser on my computer (that is connected to this 10.10.10.0 network after getting an IP from DHCP) and navigate to the router 10.10.10.1 through my browser and access the CME. Is this correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Posted below is the current running config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: Entire config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 21515 bytes&#xA;!&#xA;! Last configuration change at 18:12:47 GMT Tue Dec 17 2013&#xA;! NVRAM config last updated at 10:05:30 GMT Sat Dec 14 2013&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router2811&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$lVWu$dwhlnh3hzJz9nLwt8RoDY/&#xA;enable password password&#xA;!&#xA;no aaa new-model&#xA;!&#xA;resource policy&#xA;!&#xA;clock timezone GMT -8&#xA;clock summer-time GMT recurring&#xA;!&#xA;!&#xA;ip cef&#xA;no ip dhcp use vrf connected&#xA;ip dhcp excluded-address 10.10.10.1 10.10.10.10&#xA;!&#xA;ip dhcp pool phone&#xA;   network 10.10.10.0 255.255.255.0&#xA;   default-router 10.10.10.1&#xA;   option 150 ip 10.10.10.1&#xA;!&#xA;!&#xA;ip ftp username username&#xA;ip ftp password password&#xA;ip name-server 64.2.21.107&#xA;ip name-server 64.2.21.213&#xA;!&#xA;!&#xA;!&#xA;voice-card 0&#xA; no dspfarm&#xA;!&#xA;!&#xA;!&#xA;voice service voip&#xA; allow-connections h323 to h323&#xA; allow-connections h323 to sip&#xA; allow-connections sip to h323&#xA; allow-connections sip to sip&#xA; supplementary-service h450.12&#xA; h323&#xA; sip&#xA;  registrar server expires max 3600 min 3600&#xA;!&#xA;!&#xA;voice class codec 1&#xA; codec preference 1 g711ulaw&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;voice translation-rule 9&#xA; rule 1 /^911$/ /911/&#xA; rule 2 /^9\(.*\)/ /\1/&#xA;!&#xA;!&#xA;!&#xA;!&#xA;username admin privilege 15 secret 5 $1$laKi$pfrWq3A4KxaXliCisHhkl0&#xA;!&#xA;!&#xA;class-map match-all L3-to-L2_VoIP-Cntrl&#xA; match ip dscp af31&#xA;class-map match-all L3-to-L2_VoIP-RTP&#xA; match ip dscp ef&#xA;class-map match-all SIP&#xA; match protocol sip&#xA;class-map match-all RTP&#xA; match protocol rtp&#xA;!&#xA;policy-map EthOut&#xA; class RTP&#xA;policy-map output-L3-to-L2&#xA; class L3-to-L2_VoIP-RTP&#xA;  set cos 5&#xA; class L3-to-L2_VoIP-Cntrl&#xA;  set cos 3&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 10.1.10.2 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; description ** DHCP Client mode **&#xA; ip address dhcp&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Service-Engine0/0&#xA; ip unnumbered Loopback0&#xA; service-module ip address 10.1.10.1 255.255.255.0&#xA; service-module ip default-gateway 10.1.10.2&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; no ip mroute-cache&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1.1&#xA; description ** Data VLAN **&#xA; encapsulation dot1Q 1 native&#xA; ip address 192.168.1.2 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;interface FastEthernet0/1.2&#xA; description ** Voice VLAN **&#xA; encapsulation dot1Q 2&#xA; ip address 10.10.10.1 255.255.255.0&#xA; service-policy output output-L3-to-L2&#xA;!&#xA;ip route 10.1.10.1 255.255.255.255 Service-Engine0/0&#xA;!&#xA;!&#xA;ip http server&#xA;ip http authentication local&#xA;no ip http secure-server&#xA;ip http path flash:&#xA;ip nat inside source list 1 interface FastEthernet0/0 overload&#xA;!&#xA;access-list 1 remark SDM_ACL Category=2&#xA;access-list 1 permit 192.168.10.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;tftp-server flash:P0030702T023.loads&#xA;tftp-server flash:P0030702T023.sb2&#xA;tftp-server flash:P0030702T023.sbn&#xA;tftp-server flash:P0030702T023.bin&#xA;tftp-server flash:CP7902080001SCCP051117A.sbin&#xA;tftp-server flash:Analog1.raw&#xA;tftp-server flash:Analog2.raw&#xA;tftp-server flash:AreYouThere.raw&#xA;tftp-server flash:AreYouThereF.raw&#xA;tftp-server flash:Bass.raw&#xA;tftp-server flash:CallBack.raw&#xA;tftp-server flash:Chime.raw&#xA;tftp-server flash:Classic1.raw&#xA;tftp-server flash:Classic2.raw&#xA;tftp-server flash:ClockShop.raw&#xA;tftp-server flash:DistinctiveRingList.xml&#xA;tftp-server flash:Drums1.raw&#xA;tftp-server flash:Drums2.raw&#xA;tftp-server flash:FilmScore.raw&#xA;tftp-server flash:HarpSynth.raw&#xA;tftp-server flash:Jamaica.raw&#xA;tftp-server flash:KotoEffect.raw&#xA;tftp-server flash:MusicBox.raw&#xA;tftp-server flash:Piano1.raw&#xA;tftp-server flash:Piano2.raw&#xA;tftp-server flash:Pop.raw&#xA;tftp-server flash:Ring1.raw&#xA;tftp-server flash:Ring2.raw&#xA;tftp-server flash:Ring3.raw&#xA;tftp-server flash:Ring4.raw&#xA;tftp-server flash:Ring5.raw&#xA;tftp-server flash:Ring6.raw&#xA;tftp-server flash:Ring7.raw&#xA;tftp-server flash:RingList.xml&#xA;tftp-server flash:Sax1.raw&#xA;tftp-server flash:Sax2.raw&#xA;tftp-server flash:Vibe.raw&#xA;tftp-server flash:Pulse1.raw&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;voice-port 0/0/0&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/1&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/2&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/3&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/1/0&#xA; auto-cut-through&#xA; operation 4-wire&#xA; type 5&#xA; signal immediate&#xA; description Overhead Paging Port 0&#xA;!&#xA;voice-port 0/1/1&#xA; auto-cut-through&#xA; operation 4-wire&#xA; type 5&#xA; signal immediate&#xA; description Overhead Paging Port 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;dial-peer cor custom&#xA; name internal&#xA; name local&#xA; name domestic&#xA; name international&#xA; name 900&#xA; name 976&#xA;!&#xA;!&#xA;dial-peer cor list call-internal&#xA; member internal&#xA;!&#xA;dial-peer cor list call-local&#xA; member local&#xA;!&#xA;dial-peer cor list call-domestic&#xA; member domestic&#xA;!&#xA;dial-peer cor list call-international&#xA; member international&#xA;!&#xA;dial-peer cor list call-900&#xA; member 900&#xA;!&#xA;dial-peer cor list call-976&#xA; member 976&#xA;!&#xA;dial-peer cor list user-internal&#xA; member internal&#xA;!&#xA;dial-peer cor list user-local&#xA; member internal&#xA; member local&#xA;!&#xA;dial-peer cor list user-domestic&#xA; member internal&#xA; member local&#xA; member domestic&#xA;!&#xA;dial-peer cor list user-international&#xA; member internal&#xA; member local&#xA; member domestic&#xA; member international&#xA;!&#xA;dial-peer cor list user900-internal&#xA; member internal&#xA; member 900&#xA; member 976&#xA;!&#xA;dial-peer cor list user900-local&#xA; member internal&#xA; member local&#xA; member 900&#xA; member 976&#xA;!&#xA;dial-peer cor list user900-domestic&#xA; member internal&#xA; member local&#xA; member domestic&#xA; member 900&#xA; member 976&#xA;!&#xA;dial-peer cor list user900-international&#xA; member internal&#xA; member local&#xA; member domestic&#xA; member international&#xA; member 900&#xA; member 976&#xA;!&#xA;!&#xA;dial-peer voice 1 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/0&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 2 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/1&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 3 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/2&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 4 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/3&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 5 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/0&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 6 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/0&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 7 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/0&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 8 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/0&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 9 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/0&#xA; prefix 011&#xA;!&#xA;dial-peer voice 10 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/0&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 11 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/0&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 12 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/1&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 13 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/1&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 14 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/1&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 15 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/1&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 16 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/1&#xA; prefix 011&#xA;!&#xA;dial-peer voice 17 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/1&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 18 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/1&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 19 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/2&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 20 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/2&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 21 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/2&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 22 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/2&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 23 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/2&#xA; prefix 011&#xA;!&#xA;dial-peer voice 24 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/2&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 25 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/2&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 26 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/3&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 27 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/3&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 28 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/3&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 29 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/3&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 30 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/3&#xA; prefix 011&#xA;!&#xA;dial-peer voice 31 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/3&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 32 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/3&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 33 voip&#xA; description ** cue voicemail pilot number **&#xA; translation-profile outgoing PSTN_CallForwarding&#xA; destination-pattern 6000&#xA; session protocol sipv2&#xA; session target ipv4:10.1.10.1&#xA; dtmf-relay sip-notify&#xA; codec g711ulaw&#xA; no vad&#xA;!&#xA;dial-peer voice 34 voip&#xA; description ** cue auto attendant number **&#xA; translation-profile outgoing PSTN_CallForwarding&#xA; destination-pattern 6001&#xA; session protocol sipv2&#xA; session target ipv4:10.1.10.1&#xA; dtmf-relay sip-notify&#xA; codec g711ulaw&#xA; no vad&#xA;!&#xA;dial-peer voice 40 pots&#xA; description E&amp;amp;M port 0 to overhead&#xA; destination-pattern 4000&#xA; port 0/1/0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;telephony-service&#xA; load 7960-7940 P0030702T023&#xA; load 7902 CP7902080001SCCP051117A&#xA; max-ephones 36&#xA; max-dn 108&#xA; ip source-address 10.10.10.1 port 2000&#xA; calling-number initiator&#xA; system message Duanes&#xA; time-zone 5&#xA; voicemail 6000&#xA; max-conferences 2 gain -6&#xA; call-forward pattern .T&#xA; call-forward system redirecting-expanded&#xA; moh MOH_LO.WAV&#xA; multicast moh 239.1.1.1 port 2000&#xA; web admin system name cisco secret 5 $1$YBdL$OzdL4acKoWcaLAvCI1OLW1&#xA; dn-webedit&#xA; time-webedit&#xA; transfer-system full-consult dss&#xA; transfer-pattern 9.T&#xA;!&#xA;!&#xA;ephone-template  1&#xA; softkeys idle  Redial Dnd Newcall Cfwdall Pickup&#xA; softkeys seized  Redial Endcall Cfwdall Pickup&#xA; softkeys alerting  Callback Endcall&#xA; softkeys connected  Hold Trnsfer Endcall Confrn Park&#xA;!&#xA;!&#xA;ephone-template  2&#xA; softkeys idle  Redial Dnd Newcall Pickup&#xA; softkeys seized  Redial Endcall Pickup&#xA; softkeys alerting  Callback Endcall&#xA; softkeys connected  Hold Trnsfer Endcall Confrn Park&#xA;!&#xA;!&#xA;ephone-dn  1  dual-line&#xA; number 2001&#xA; label 2001&#xA; description Erik-Line2&#xA; name Erik-Line2&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  2  dual-line&#xA; number 2002&#xA; label 2002&#xA; description Jane Doe-Line2&#xA; name Jane Doe-Line2&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user900-international&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  3  dual-line&#xA; number 2003&#xA; label 2003&#xA; description Audrey Wall&#xA; name Audrey Wall&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  4  dual-line&#xA; number 2000&#xA; label 2000&#xA; description Receptionist&#xA; name Receptionist&#xA; call-forward noan 2100 timeout 8&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  5  dual-line&#xA; number 2001&#xA; label 2001&#xA; description Stan&#xA; name Stan&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  6  dual-line&#xA; number 2002&#xA; label 2002&#xA; description Jane Doe&#xA; name Jane Doe&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  7  dual-line&#xA; number 2003&#xA; label 2003&#xA; description Audrey Wall&#xA; name Audrey Wall&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  8  dual-line&#xA; number 2004&#xA; label 2004&#xA; description Amber McInerney&#xA; name Amber McInerney&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user-international&#xA; huntstop channel&#xA;!&#xA;!&#xA;ephone-dn  9  dual-line&#xA; number 2005&#xA; label 2005&#xA; description Jose Conseco&#xA; name Jose Conseco&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  10  dual-line&#xA; number 2006&#xA; label 2006&#xA; description Matt Mullen&#xA; name Matt Mullen&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  11  dual-line&#xA; number 2007&#xA; label 2007&#xA; description Delivery Area&#xA; name Delivery Area&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  12  dual-line&#xA; number 2008&#xA; label 2008&#xA; description Brian Allen&#xA; name Brian Allen&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  13  dual-line&#xA; number 2009&#xA; label 2009&#xA; description Time Clock&#xA; name Time Clock&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  14  dual-line&#xA; number 2010&#xA; label 2010&#xA; description Empty Office&#xA; name Empty Office&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  15  dual-line&#xA; number 2011&#xA; label 2011&#xA; description Tony Davis&#xA; name Tony Davis&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  16&#xA; number 8000....&#xA; mwi on&#xA;!&#xA;!&#xA;ephone-dn  17&#xA; number 8001....&#xA; mwi off&#xA;!&#xA;!&#xA;ephone-dn  18&#xA; number 1000&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;!&#xA;ephone-dn  19&#xA; number 1001&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;!&#xA;ephone-dn  20&#xA; number 1002&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;!&#xA;ephone-dn  21&#xA; number 1003&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;!&#xA;ephone-dn  22  dual-line&#xA; number 2000&#xA; label 2000&#xA; description Receptionist-Line2&#xA; name Receptionist-Line2&#xA; preference 1&#xA; call-forward busy 2100&#xA; call-forward noan 2100 timeout 8&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  23  dual-line&#xA; number 2004&#xA; label 2004&#xA; description Amber Line 2&#xA; name Amber McInerney&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  24  dual-line&#xA; number 2100&#xA; label Main&#xA; call-forward noan 5000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  25  dual-line&#xA; number 2100&#xA; label Main&#xA; description MainLine Rollover2&#xA; preference 1&#xA; call-forward busy 5000&#xA; call-forward noan 5000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  26&#xA; number 5000&#xA; label GeneralVM&#xA; description GeneralVM&#xA; name GeneralVM&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 3&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  27  dual-line&#xA; number 2011&#xA; label 2011&#xA; description Tony Davis&#xA; name Tony Davis&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  28  dual-line&#xA; number 2009&#xA; label 2009&#xA; description test line&#xA; preference 1&#xA;!&#xA;!&#xA;ephone-dn  29  dual-line&#xA; number 2012&#xA; label 2012&#xA; description New User&#xA; name New User&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 12&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  30  dual-line&#xA; number 2006&#xA; label 2006&#xA; description Matt Line 2&#xA; name Matt Mullen&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  31  dual-line&#xA; number 2008&#xA; label 2008&#xA; description Brian Allen&#xA; name Brian Allen&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  32  dual-line&#xA; number 2005&#xA; label 2005&#xA; description Jose Conseco&#xA; name Jose Conseco&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  33  dual-line&#xA; number 2013&#xA; label 2013&#xA; description Ken Garton&#xA; name Ken Garton&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone  1&#xA; device-security-mode none&#xA; mac-address 0013.608F.98F3&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:4 2:22 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  2&#xA; device-security-mode none&#xA; mac-address 0007.8599.2E3F&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:8 2:23 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  3&#xA; device-security-mode none&#xA; mac-address 0013.C4AA.C42A&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:5 2:1 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  4&#xA; device-security-mode none&#xA; mac-address 0013.6039.8BFA&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:6 2:2 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  5&#xA; device-security-mode none&#xA; mac-address 0017.E013.41A9&#xA; ephone-template 1&#xA; username &quot;swall&quot;&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:7 2:3 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  6&#xA; device-security-mode none&#xA; mac-address 0017.E013.412F&#xA; ephone-template 2&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:10 2:30 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  7&#xA; device-security-mode none&#xA; mac-address 0015.62EA.6944&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:9 2:32 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  8&#xA; device-security-mode none&#xA; mac-address 0013.601C.1A23&#xA; ephone-template 2&#xA; type 7960&#xA; button  1:11&#xA;!&#xA;!&#xA;!&#xA;ephone  9&#xA; device-security-mode none&#xA; mac-address 0015.621B.2A9B&#xA; ephone-template 2&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:12 2:31 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  10&#xA; device-security-mode none&#xA; mac-address 0013.1AFF.302E&#xA; ephone-template 2&#xA; type 7960&#xA; button  1:13 2:28&#xA;!&#xA;!&#xA;!&#xA;ephone  11&#xA; device-security-mode none&#xA; mac-address 0015.62B5.FAE2&#xA; ephone-template 2&#xA; type 7960&#xA; button  1:14&#xA;!&#xA;!&#xA;!&#xA;ephone  12&#xA; device-security-mode none&#xA; mac-address 0017.955B.0A32&#xA; ephone-template 1&#xA; username &quot;jcoffinberry&quot;&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:15 2:27 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  13&#xA; device-security-mode none&#xA; mac-address 0017.E013.2BFC&#xA; ephone-template 2&#xA; username &quot;newuser&quot;&#xA; button  1:29&#xA;!&#xA;!&#xA;!&#xA;ephone  14&#xA; device-security-mode none&#xA; mac-address 000F.341F.FE6A&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:15 2:27 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  15&#xA; device-security-mode none&#xA; mac-address 0014.A981.86F5&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:33&#xA;!&#xA;!&#xA;alias exec cue service-module service-engine 0/0 session&#xA;!&#xA;line con 0&#xA; password !du@ne5&#xA; login&#xA;line aux 0&#xA;line 194&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport input all&#xA; transport output pad telnet rlogin lapb-ta mop udptn v120 ssh&#xA;line vty 0 4&#xA; password !du@ne5&#xA; login&#xA;!&#xA;scheduler allocate 20000 1000&#xA;ntp clock-period 17180231&#xA;ntp master&#xA;ntp server 64.2.21.49&#xA;ntp server 64.2.21.107&#xA;!&#xA;webvpn context Default_context&#xA; ssl authenticate verify all&#xA; !&#xA; no inservice&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: added the MACs of the three phones not receiving IPs.&lt;/strong&gt;&#xA;The three phones that are not receiving IPs have this in their status message.&lt;br&gt;&#xA;ephone 15 - mac address 00:14:A9:81:86:F5&lt;br&gt;&#xA;Status Message:&lt;br&gt;&#xA;SEP0014A98186F5.cnf.xml&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ephone 2 - mac address 00:07:85:99:2E:3F&lt;br&gt;&#xA;Status Message&lt;br&gt;&#xA;SEP000785992E3F.cnf.xml&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ephone 8 - mac address 00:13:60:1C:1A:23&lt;br&gt;&#xA;No status messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: Results of show ip dhcp binding&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bindings from all pools not associated with VRF:&#xA;IP address          Client-ID/              Lease expiration        Type&#xA;                    Hardware address/&#xA;                    User name&#xA;10.10.10.11         0100.0785.992e.3f       Dec 20 2013 03:52 PM    Automatic&#xA;10.10.10.15         0100.14a9.8186.f5       Dec 20 2013 03:52 PM    Automatic&#xA;10.10.10.18         0100.1360.1c1a.23       Dec 20 2013 03:52 PM    Automatic&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2584" LastEditorUserId="2584" LastEditDate="2013-12-19T23:43:53.250" LastActivityDate="2013-12-20T05:21:04.270" Title="Access Cisco Call Manager Express on 2811 Router" Tags="|cisco|router|vlan|voip|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5562" PostTypeId="2" ParentId="5560" CreationDate="2013-12-20T02:27:40.967" Score="3" Body="&lt;p&gt;The dhcp server shows they do actually have an address.  The status messages suggest they aren't able to find all the files they're looking for; the telephony-service should be creating those, but I don't see a &lt;code&gt;create cnf-files&lt;/code&gt; in your config.  &lt;code&gt;show telephony-service tftp-bindings&lt;/code&gt; will show what configs it's created and mapped.  The SCCP firmware requires option 66 (tftp server), not option 150 -- the phones will remember the last server if dhcp doesn't present one. (it can be manually configured as well.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(even without most of the files, it'll still boot and register with the CM. I was updating eBay'd 7960's that weren't known to my CM last night. They only needed to see: OS79XX.TXT, SEPDefault.cnf, and XMLDefault.cnf.xml, and the firmware files)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-20T02:27:40.967" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5563" PostTypeId="2" ParentId="5560" CreationDate="2013-12-20T05:21:04.270" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;How do I access the Cisco CME of the router to make changes to the quick buttons and directory on the other phones?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Enable the http server on the router. (&lt;code&gt;ip http server&lt;/code&gt;, which you have)&lt;/li&gt;&#xA;&lt;li&gt;Download the CME GUI files from &lt;a href=&quot;http://software.cisco.com/download/release.html?mdfid=277641082&amp;amp;softwareid=282786567&amp;amp;release=10.0&amp;amp;relind=AVAILABLE&amp;amp;rellifecycle=&amp;amp;reltype=latest&quot; rel=&quot;nofollow&quot;&gt;Cisco&lt;/a&gt; &lt;em&gt;that matches the version of IOS on the router&lt;/em&gt;. (CCO account and service contract required)&lt;/li&gt;&#xA;&lt;li&gt;Go to http://[router ip]/telephony_service.html&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I don't know the exact version you're running, so I cannot say what version you need.  Any serious configuration must be done from the CLI. (your config was not made by the GUI)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-20T05:21:04.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5565" PostTypeId="2" ParentId="5530" CreationDate="2013-12-20T06:13:05.933" Score="3" Body="&lt;p&gt;as usually, big(modullar) devices and switches have hardware accelerated QOS. &#xA;So you cant see load of CPU, because qos is implemented in ASIC. &#xA;Ofcource, it is limited, but limit is in packet per second(1mpps of cef switching npe g1, 2mpps of cef switching - npe g2) , not in bit per second&lt;br&gt;&#xA;    &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps341/product_data_sheet09186a0080116113.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/routers/ps341/product_data_sheet09186a0080116113.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps341/product_data_sheet0900aecd8047177b.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/routers/ps341/product_data_sheet0900aecd8047177b.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;about your second question, good question ;-) &#xA;I guess, you shouldnt to monitor qos directly, it is enough to monitor drops, and if you will have them, throubleshoot it - tune buffers\queues\thresholds etc&lt;/p&gt;&#xA;" OwnerUserId="3478" LastActivityDate="2013-12-20T06:13:05.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5566" PostTypeId="1" AcceptedAnswerId="5567" CreationDate="2013-12-20T14:24:10.883" Score="5" ViewCount="1963" Body="&lt;p&gt;We have a couple of ip cameras. The company who delivered those also made the UTP cables. They had them directly in the switch. I now changed it to go trough the patch pane, but i just can't get a few of them working. We use the T568B configuration. But after checking the utp cable at the camera i noticed that they made the utp cable like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;brown - brown/white - green - blue/white - blue - green/white - orange - orange/white&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How do i put them in our patch panel?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to reverse(Brown in blue/white in the patch panel etc.) them (since they did the cable the wrong way), but with no succes. I tested it with our cable tester and the LEDs just went from 6 to 3 etc.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Pvb3d.jpg&quot; alt=&quot;Example&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3630" LastEditorUserId="3630" LastEditDate="2013-12-20T15:23:55.067" LastActivityDate="2013-12-20T20:32:04.327" Title="Patch panel problem" Tags="|switch|patch-panel|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5567" PostTypeId="2" ParentId="5566" CreationDate="2013-12-20T16:54:22.180" Score="6" Body="&lt;p&gt;The correct answer is you don't &quot;fix&quot; it at the patch panel.  If you follow the code and it doesn't work, you need to fix the other side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the reasons people use T568A/B and not any straight through wiring pattern they want is that it makes troubleshooting and repairs much simpler, as you are finding out now.  If you don't fix the other end now, you will be in the same situation (or someone else will) 5 years from now while trying to fix the camera side of the cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also firmly believe that infrastructure cabling should be infrastructure cabling, not a &quot;long patch cord&quot; running through a building.  So I would terminate the camera end of the cables to a jack and use a patch cable to connect the cameras.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you &lt;em&gt;really must&lt;/em&gt; take the shortcut (for instance, it is more important to get the camera up ASAP), then you can do so, but put this on your priority list of things to fix ASAP.  Just &quot;reverse&quot; where you punch down, since brown is where white/orange should be on the far end, punch it down where white/orange should be.  White/brown to orange, green to white/green, and white/blue to blue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also recommend that you develop a cable standards document detailing how you expect cabling to be run for your organization and provide it to any contractor working at your site.  Then enforce the document before you allow them to get paid.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2013-12-20T17:02:15.097" LastActivityDate="2013-12-20T17:02:15.097" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5569" PostTypeId="2" ParentId="5551" CreationDate="2013-12-20T17:36:25.927" Score="1" Body="&lt;p&gt;We will redirect the traffic for your RAS VPN out of the preferred WAN interface by applying a route map to the Virtual-Template interface.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;ip access-list extended VPN-ACL&#xA;permit ip any 192.168.5.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;route-map VPN-MAP&#xA;match ip address VPN-ACL&#xA;set ip next-hop 88.XX.XX.73&#xA;!&#xA;!&#xA;interface virtual-template 1&#xA;ip policy route-map VPN-MAP&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This route-map should classify all traffic going back thru your RAS VPN (any source to a destination of your client ip subnet) and after the encapsulation/encryption it should route traffic out of your fast-wan interface. &lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2013-12-20T17:36:25.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5570" PostTypeId="1" AcceptedAnswerId="5573" CreationDate="2013-12-20T18:37:07.003" Score="5" ViewCount="3107" Body="&lt;p&gt;My goal is to put all guest network traffic from the Ubiquiti Unifi access points onto their own subnet using VLAN 20 on a series of HP Procurve 2610-48-PWR switches.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Unifi Access controller allows me to set the guest network to work with a given VLAN ID,  which I obviously set to 20.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want all guest traffic to be filtered to our secondary ISP on a separate firewall that will also issue DHCP addressing.  The ISP runs to a firewall that runs to a web filter, then to the central Procurve.  The Procurve then splits to the other two Procurves in the other wings of the campus.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Procurves, I configured each to use VLAN 20 over the designated subnet and tagged every port that has an access point plugged into it.  All three switches have IP addresses that are contained within the desired subnet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was under the impression that configuring a VLAN with the same ID on each connected switch, as well as supplying an IP address within the correct addressing scheme would allow them to communicate.  The switches can communicate with each other over the separate subnet, but they can't reach the filter or the firewall.  They also can't reach a client plugged into the switch with a statically assigned IP address in the correct subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been at this for a few hours and am running out of ideas.  Any advice would be much appreciated.  &lt;/p&gt;&#xA;" OwnerUserId="2670" LastActivityDate="2013-12-20T21:04:28.467" Title="Trying to configure HP Procurve VLANs to segment Unifi guest traffic to another network" Tags="|wireless|vlan|hp-procurve|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5571" PostTypeId="1" AcceptedAnswerId="5572" CreationDate="2013-12-20T19:48:40.820" Score="1" ViewCount="3783" Body="&lt;p&gt;Let's assume that A is connected to B, and A has received 100 bytes until now. So, the next packet he will receive should have a SEQ number of 100 or a little more if the packets don't reach A in order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens if he receives a significantly different value, for example, 800?&lt;/p&gt;&#xA;" OwnerUserId="3633" LastEditorUserId="42290" LastEditDate="2017-12-13T11:56:38.010" LastActivityDate="2017-12-13T11:56:38.010" Title="What happens when TCP Sequence Number is incorrect?" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5572" PostTypeId="2" ParentId="5571" CreationDate="2013-12-20T20:07:11.340" Score="8" Body="&lt;p&gt;Queue the traffic waiting for the rest of the traffic to arrive.  If that traffic doesn't appear within some hold-off period, it will re-ACK the last segment it received.  This is all &lt;em&gt;well documented&lt;/em&gt; TCP processing. (read: use any search engine, or visit a book store.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-20T20:07:11.340" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5573" PostTypeId="2" ParentId="5570" CreationDate="2013-12-20T20:16:00.233" Score="2" Body="&lt;p&gt;First off, the switches don't have to have an address in VLAN 20; in fact you absolutely &lt;em&gt;don't&lt;/em&gt; want that. (unless you want guests hacking into your switches)  VLAN 20 should exist on ports connected to (a) the APs, (b) the inter-switch links, and (c) the router infrastructure (firewall, etc.)  That will be &lt;em&gt;tagged&lt;/em&gt; everywhere but the access ports going to the router/firewall/etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Your switches aren't routers; they're just layer-2 switches.  The address they're assigned is for &lt;em&gt;management&lt;/em&gt;.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2013-12-20T21:04:28.467" LastActivityDate="2013-12-20T21:04:28.467" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5574" PostTypeId="2" ParentId="5566" CreationDate="2013-12-20T20:32:04.327" Score="1" Body="&lt;p&gt;It really doesn't matter how the patch panel is wired (A vs. B) as long as it's the same at both ends. (i.e. &quot;straight through&quot;) The same is true of the cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless your IP cameras have some Special Needs&amp;trade; (eg. cisco pre-standard power, ubiquiti non-48V poe, etc.), there shouldn't be any need for hacked up cables. You haven't said exactly what hardware we're dealing with (switches and cameras)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-20T20:32:04.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5576" PostTypeId="1" AcceptedAnswerId="5577" CreationDate="2013-12-21T16:47:09.557" Score="11" ViewCount="2444" Body="&lt;p&gt;Consider the following access-list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;access-list 25 remark city1&#xA;access-list 25 permit 10.1.120.0 0.0.0.255&#xA;access-list 25 remark city2&#xA;access-list 25 permit 10.2.120.0 0.0.0.255&#xA;access-list 25 remark city3&#xA;access-list 25 permit 10.3.120.0 0.0.0.255&#xA;access-list 25 remark city4&#xA;access-list 25 permit 10.4.120.0 0.0.0.255&#xA;access-list 25 remark city5&#xA;access-list 25 permit 10.5.120.0 0.0.0.255&#xA;access-list 25 remark mgt&#xA;access-list 25 permit 10.3.66.86&#xA;access-list 25 remark jumphosts&#xA;access-list 25 permit 10.3.1.37&#xA;access-list 25 permit 10.3.1.38&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I enter this directly into a router in the order above and then run &quot;show ip access-list 25&quot; the access-list is displayed in the following order:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Standard IP access list 25&#xA;    60 permit 10.3.66.86&#xA;    70 permit 10.3.1.37&#xA;    80 permit 10.3.1.38&#xA;    10 permit 10.1.120.0, wildcard bits 0.0.0.255&#xA;    20 permit 10.2.120.0, wildcard bits 0.0.0.255&#xA;    30 permit 10.3.120.0, wildcard bits 0.0.0.255&#xA;    40 permit 10.4.120.0, wildcard bits 0.0.0.255&#xA;    50 permit 10.5.120.0, wildcard bits 0.0.0.255&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I view the access list in the running-config it appears in this order:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;access-list 25 remark mgt&#xA;access-list 25 permit 10.3.66.86&#xA;access-list 25 remark jumphosts&#xA;access-list 25 permit 10.3.1.37&#xA;access-list 25 permit 10.3.1.38&#xA;access-list 25 remark city1&#xA;access-list 25 permit 10.1.120.0 0.0.0.255&#xA;access-list 25 remark city2&#xA;access-list 25 permit 10.2.120.0 0.0.0.255&#xA;access-list 25 remark city3&#xA;access-list 25 permit 10.3.120.0 0.0.0.255&#xA;access-list 25 remark city4&#xA;access-list 25 permit 10.4.120.0 0.0.0.255&#xA;access-list 25 remark city5&#xA;access-list 25 permit 10.5.120.0 0.0.0.255&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Why doesn't the access list appear in the order that it was entered?&lt;br&gt;&#xA;2) Even though it isn't displayed in the correct order in &quot;show ip access-lists&quot; output or in the running config, the sequence numbers are in order.  Is the ruleset parsed according to the sequence numbers or according to the order in which the entries are displayed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco IOS 15.1(4)M5&lt;/p&gt;&#xA;" OwnerUserId="86" LastActivityDate="2018-06-02T08:01:02.460" Title="Why does Cisco ios save and display access list entries out of order?" Tags="|cisco|cisco-ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5577" PostTypeId="2" ParentId="5576" CreationDate="2013-12-21T17:33:32.807" Score="15" Body="&lt;p&gt;From the Cisco documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The major difference in a standard access list is that the Cisco IOS adds an entry by descending order of the IP address, not on a sequence number.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can read more &lt;a href=&quot;http://www.cisco.com/en/US/products/sw/secursw/ps1018/products_tech_note09186a00800a5b9a.shtml&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2013-12-21T17:33:32.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5582" PostTypeId="1" CreationDate="2013-12-23T02:49:09.580" Score="5" ViewCount="2779" Body="&lt;p&gt;In a network of Cisco routers, all running RIP, is it possible to set the hop count of an interface (or network)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea is to use the (artificial/adminstrative) hop count as means to do simple traffic engineering. I want to make some routes with higher preference than others, even if they all have the same hop count. Setting a hop count higher than 1 would make RIP re-advertise that route longer than it really is and make it less preferable than others. &lt;/p&gt;&#xA;" OwnerUserId="3646" LastActivityDate="2013-12-23T07:02:44.027" Title="Cisco RIP - set metric for interface or network" Tags="|cisco|cisco-ios|rip|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5584" PostTypeId="2" ParentId="5582" CreationDate="2013-12-23T06:42:34.613" Score="4" Body="&lt;p&gt;As commented you are best using another IGP because of the limitation of RIPs infinite metric.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However you can configure individual ports to add more than one or alternatively configure offset lists to increase the advertised routes based on network address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RIP normally increases the cost by adding one to the route’s metric before storing the route so to alter this you can change the amount that an individual port adds to the metric of a Learned route, for example to increase port cost then use:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;interface FastEthernet0/1&lt;br&gt;&#xA;ip metric 5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively lookup using an offset list to use an access list to point to a specific network you wish to influence (and in which direction).  An example  resource is here: &lt;a href=&quot;http://cciejournry.blogspot.co.uk/2011/12/ripmetric-lab-on-offset-lists.html&quot; rel=&quot;nofollow&quot;&gt;offset list blog&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="109" LastEditorUserId="109" LastEditDate="2013-12-23T07:02:44.027" LastActivityDate="2013-12-23T07:02:44.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5585" PostTypeId="1" CreationDate="2013-12-23T08:58:20.930" Score="3" ViewCount="8002" Body="&lt;p&gt;Having a strange issue here.. I replaced a stack member (2 members in a stack of Cisco 3750x). Both switches have a 10Gb card and I had a perfectly working LAG/etherchannel between to 10Gb ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After replacing a stack member the portchannel can't bundle due to flow-control mismatch. It says that flow-control is of on the interface of the new member but in the config it is clearly on, consistent with the config on the other interface and the portchannel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The error:&#xA;&lt;code&gt;%EC-5-CANNOT_BUNDLE2: Te1/1/2 is not compatible with Te2/1/2 and will be suspended (flow control receive of Te1/1/2 is off, Te2/1/2 is on) (ISCSI-MER2-1)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sh run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface TenGigabitEthernet1/1/2&#xA; flowcontrol receive on&#xA; channel-protocol lacp&#xA; channel-group 1 mode active&#xA;end&#xA;&#xA;interface TenGigabitEthernet2/1/2&#xA; flowcontrol receive on&#xA; channel-protocol lacp&#xA; channel-group 1 mode active&#xA;end&#xA;&#xA;interface Port-channel1&#xA; flowcontrol receive on&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to try to add another port to the channel but not sure if this causes disruption on the portchannel? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could also try to disable flow control on the interfaces and on the port channel, but I need to now if this can be done during production?  &lt;/p&gt;&#xA;" OwnerUserId="209" LastEditorUserId="775" LastEditDate="2013-12-23T10:38:59.190" LastActivityDate="2014-03-26T11:50:24.073" Title="portchannel cant bundle flow control mismatch" Tags="|cisco|etherchannel|cisco-3750|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5587" PostTypeId="1" AcceptedAnswerId="5608" CreationDate="2013-12-23T12:09:30.917" Score="-2" ViewCount="14722" Body="&lt;p&gt;Got a doubt while studying about LLC layer. From Network layer I came to know that IP fragmentation will be done, For L4 TCP will segment the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, the question is Protocols starting from Layer-2 (For eg : STP , RSTP), who will fragment the data.&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="775" LastEditDate="2013-12-23T13:15:09.237" LastActivityDate="2022-12-15T00:20:44.327" Title="How Layer-2 data will be fragmented?" Tags="|ethernet|protocol-theory|spanning-tree|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5588" PostTypeId="2" ParentId="5587" CreationDate="2013-12-23T12:21:15.377" Score="8" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Layer-2 (For eg : STP , RSTP) , who will fragment the data .&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;STP,  RTSP, etc... are Ethernet payloads, and Ethernet does not support fragmentation.&lt;/p&gt;&#xA;&lt;p&gt;Offhand, the only common layer2 protocol I can come up with that does support fragmentation is &lt;a href=&quot;http://tools.ietf.org/search/rfc1990&quot; rel=&quot;nofollow noreferrer&quot;&gt;MLPPP&lt;/a&gt;; MLPPP fragmentation is commonly used to make L2 Frames small enough so voice traffic on E / T-carrier circuits doesn't see too much delay.&lt;/p&gt;&#xA;&lt;p&gt;You can see the &lt;a href=&quot;http://www.tcpipguide.com/free/t_PPPMultilinkProtocolMPFrameFormat-3.htm&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;MLPPP Frame Format, including fragmentation&quot;&gt;mlppp frame diagram at the tcpip guide&lt;/a&gt;.  A quick glance at those frames shows that MLPPP (a layer-2 protocol) supports fragmentation at Layer-2.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2022-12-15T00:20:44.327" LastActivityDate="2022-12-15T00:20:44.327" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="5589" PostTypeId="2" ParentId="5587" CreationDate="2013-12-23T13:12:01.063" Score="1" Body="&lt;p&gt;Every interface has an MTU(MAx Transmision unit).&#xA;For Ethernet it is 1500 bytes(usually).&#xA;So the payload needs to be fragmanted (at Layer 3 ) so that it can fit into this max 1500 bytes.&#xA;This 1500 bytes is the payload for the Layer 2.&lt;/p&gt;&#xA;" OwnerUserId="3421" LastActivityDate="2013-12-23T13:12:01.063" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5594" PostTypeId="1" AcceptedAnswerId="5603" CreationDate="2013-12-24T13:01:01.820" Score="8" ViewCount="5684" Body="&lt;p&gt;I have a network with resilient gateways whereby Customer sites use a default gateway to reach the internet edge routers and the primary route for traffic uses a lower metric.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ipsec tunnels are initiated from vpn concentrators behind the edge routers and are statically configured to the destination tunnel endpoints which are 3rd party data centers.  I am not able to use a dynamic routing protocol with the 3rd party.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/SJ1lK.jpg&quot; alt=&quot;Network Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the peering address range that the 3rd party is using periodically changes and brings down the primary tunnel and a manual switch to the secondary tunnel is being cumbersomely carried out.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Can how can I most efficiently failover between tunnels in this&#xA;scenario if the destination IPs are not reliable for the static&#xA;ipsec configuration? &lt;/li&gt;&#xA;&lt;li&gt;How would I pre-empt the primary tunnel once the endpoint becomes&#xA;available?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="109" LastActivityDate="2013-12-25T19:46:27.627" Title="How to failover static ipsec vpn tunnels?" Tags="|cisco|vpn|ipsec|failover|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5595" PostTypeId="1" CreationDate="2013-12-24T15:23:30.043" Score="5" ViewCount="28722" Body="&lt;p&gt;Can anyone explain me what is the difference between distance vector protocol and path vector protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why we are calling BGP as Path vector protocol . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Best path selection we use the AS_path length as 4th parameter ..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not a silly question ... I google it never find the exact answer ...&lt;/p&gt;&#xA;" OwnerUserId="2736" LastEditorUserId="762" LastEditDate="2013-12-24T18:04:12.337" LastActivityDate="2018-01-20T17:01:58.627" Title="What is the difference between distance vector protocol and path vector protocol" Tags="|bgp|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5596" PostTypeId="2" ParentId="5595" CreationDate="2013-12-24T15:56:16.373" Score="6" Body="&lt;p&gt;BGP's path vector routing information includes the 'path' of ASes that are used to reach the destination, BGP has a complex path selection process. AS-path length has nothing to do with the number and or speed of the links to reach the destination and so an AS-path length of 2 can take far more time than an AS-path length of 4 because you don't know the inside topology of those ASes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Distance vector will give you the actual number of link hops (RIP) or a metric of hops, and link speed (a simplified description of EIGRP). Distance vector does not give you information of what links you will use (the path you will take) BGP does tell you what ASes you will transit.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastEditorUserId="-1" LastEditDate="2014-01-22T11:46:40.663" LastActivityDate="2014-01-22T11:46:40.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5597" PostTypeId="1" AcceptedAnswerId="5604" CreationDate="2013-12-24T19:05:26.827" Score="5" ViewCount="817" Body="&lt;p&gt;So, I had a well-working switch-profile configuration that was synchronized between my core01 and core02 switches. Until profile-revision 66, that is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying to renumber a FEX (which wasn't in use yet) and things got very discombobulated, where core01 was on revision 69 and core02 was on revision 67.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some valiant fighting (which involved desyncing them, importing the interface, then resyncing), I now have switches that are in sync again. The only issue is that the revision numbers are different:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; core01# sh switch-profile status&#xA;&#xA; switch-profile  : core-shared&#xA; ----------------------------------------------------------&#xA;&#xA; Start-time: 875074 usecs after Tue Dec 24 18:47:14 2013&#xA; End-time: 171940 usecs after Tue Dec 24 18:47:17 2013&#xA;&#xA; Profile-Revision: 72     &#xA; Session-type: Commit&#xA; Session-subtype: -&#xA; Peer-triggered: Yes&#xA; Profile-status: Sync Success&#xA;&#xA; Local information:&#xA; ----------------&#xA; Status: Commit Success&#xA; Error(s): &#xA;&#xA; Peer information:&#xA; ----------------&#xA; IP-address: 129.10.X.Y&#xA; Sync-status: In sync&#xA; Status: Commit Success&#xA; Error(s): &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;core02(config-sync)# sh switch-profile status&#xA;&#xA; switch-profile  : core-shared&#xA; ----------------------------------------------------------&#xA;&#xA; Start-time: 658119 usecs after Tue Dec 24 18:47:14 2013&#xA; End-time:  43352 usecs after Tue Dec 24 18:47:17 2013&#xA;&#xA; Profile-Revision: 69&#xA; Session-type: Commit&#xA; Session-subtype: -&#xA; Peer-triggered: No&#xA; Profile-status: Sync Success&#xA;&#xA; Local information:&#xA; ----------------&#xA; Status: Commit Success&#xA; Error(s): &#xA;&#xA; Peer information:&#xA; ----------------&#xA; IP-address: 129.10.X.X&#xA; Sync-status: In sync&#xA; Status: Commit Success&#xA; Error(s): &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is, how bad is this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tested, and I can make changes and commit them and they are each capable of having changes made in 'config sync' which are replicated to the partner. It's just....it makes me feel icky. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this necessarily a bad thing? Should I do something to bring the numbers into sync?&lt;/p&gt;&#xA;" OwnerUserId="62" LastActivityDate="2013-12-25T21:16:14.193" Title="Is different profile-revision numbers alright with Cisco switch-profiles?" Tags="|cisco|cisco-nexus-5k|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5603" PostTypeId="2" ParentId="5594" CreationDate="2013-12-25T16:15:27.367" Score="5" Body="&lt;p&gt;One solution is to use Performance routing (PfR) on the gateway routers.  PfR can test connectivity to each data center and then route traffic to whichever one is responding.   So if a tunnel goes down, PfR will automatically route traffic through the other tunnel to the other data center.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PfR can do this by pinging (or using IP SLA) each of the data centers.  If the London tunnel fails, PfR will route traffic through the New York tunnel, and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to give you a configuration, but I need to see more details about your network.  In the meantime, you can look at a couple of things:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ine.com/2011/11/01/cisco-performance-routing-pfr-optimized-edge-routing-oer/&quot; rel=&quot;noreferrer&quot;&gt;http://blog.ine.com/2011/11/01/cisco-performance-routing-pfr-optimized-edge-routing-oer/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.netcraftsmen.net/archived-documents/c-mug-article-archive/7-20090922-cmug-understanding-performance-routing/file.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.netcraftsmen.net/archived-documents/c-mug-article-archive/7-20090922-cmug-understanding-performance-routing/file.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a video if you're more of a visual learner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/iosswrel/ps6537/ps6554/ps6599/ps8787/pfr_configure_video.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/prod/iosswrel/ps6537/ps6554/ps6599/ps8787/pfr_configure_video.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2013-12-25T19:46:27.627" LastActivityDate="2013-12-25T19:46:27.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5604" PostTypeId="2" ParentId="5597" CreationDate="2013-12-25T21:16:14.193" Score="6" Body="&lt;p&gt;I spoke with Cisco's TAC about this, and the answer that I got from them, after they inspected the 'show switch-profile status' on each of the switches, is that things are working exactly right. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The individual Profile-Revision numbers are local to the switches, and not a result of a shared version number, like many clustered products. &lt;/p&gt;&#xA;" OwnerUserId="62" LastActivityDate="2013-12-25T21:16:14.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5608" PostTypeId="2" ParentId="5587" CreationDate="2013-12-26T20:07:01.400" Score="6" Body="&lt;p&gt;Layer 2 does not do any fragmentation.  It is up to Layer 3 to pass data to Layer 2 in a packet/frame size that will already match Layer 2's MTU.  In fact, the reason Layer 3 does fragmentation in the first place is is because of the limitations of the Layer 2 Protocol.&lt;/p&gt;&#xA;&lt;p&gt;IP doesn't care if the packet size is 1500 bytes of 9999 bytes, it just knows what its underlying Layer 2 protocol can handle.  The &amp;quot;Packet Length&amp;quot; field in the IP header is a 16 bit value, which means IP can create a packet as big as 65535 bytes if necessary, but only if the underlying Layer 2 fabric can support it.&lt;/p&gt;&#xA;&lt;p&gt;Now specifically speaking for &amp;quot;Layer 2 protocols&amp;quot; like CDP, STP, VTP, (etc...), those by design send very small sized frames that should never need to be broken up into smaller frames.  So what you said is, in a way, correct, that the protocol itself handles the fragmentation (by means of not needing to send frames that would require any additional fragmentation).&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2022-12-14T05:42:05.560" LastActivityDate="2022-12-14T05:42:05.560" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="5611" PostTypeId="1" CreationDate="2013-12-26T20:49:19.787" Score="2" ViewCount="1099" Body="&lt;p&gt;I obtained some IOS images to play around with using GSN3. Some of them are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;c2600-i-mz.123-26.bin&#xA;c2600-ipbase-mz.123-26.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand that there are different firmware versions for different feature sets, but the difference between these two does not appear to be clearly apparent. Can someone describe the difference between these two images, as well as explain in detail the Cisco versioning methodology (as it pertains to different feature sets, not different build types/numbers)?&lt;/p&gt;&#xA;" OwnerUserId="3545" LastActivityDate="2013-12-26T21:19:29.877" Title="What is the difference between these IOS firmware versions?" Tags="|cisco-ios|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5612" PostTypeId="2" ParentId="5611" CreationDate="2013-12-26T20:57:22.623" Score="6" Body="&lt;p&gt;Use the &lt;a href=&quot;http://tools.cisco.com/ITDIT/CFN/&quot;&gt;Cisco Feature Navigator&lt;/a&gt; to compare the features of the two images.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-12-26T20:57:22.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5613" PostTypeId="2" ParentId="5611" CreationDate="2013-12-26T21:19:29.877" Score="3" Body="&lt;p&gt;I found some information &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/routers/ps259/prod_bulletin09186a0080161082.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, which details the IOS Mainline 12.3 release.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that &lt;code&gt;c2600-i-mz.123-26.bin&lt;/code&gt; is part of the &quot;Classic Feature Set&quot; family of images. Beginning with the 12.3 Mainline release, the various feature set combinations were rejiggered into a simpler, more streamlined set of images called the &quot;Cross-platform Feature Sets&quot;, of which &lt;code&gt;c2600-ipbase-mz.123-26.bin&lt;/code&gt; is part of. IOS 12.3 is available in either the Classic or Cross-platform version; however, the Classic images are being phased out, and Cisco recommends that images be upgraded to the newer Cross-platform versions. Beginning with the 12.3T train, images are only available in the Cross-platform version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from the changing of the naming scheme, these two images correspond with each other and are otherwise functionally identical, as far as I can discern. Other Classic images may not necessarily have exact corresponding images, as the feature sets differ.&lt;/p&gt;&#xA;" OwnerUserId="3545" LastActivityDate="2013-12-26T21:19:29.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5614" PostTypeId="1" AcceptedAnswerId="5619" CreationDate="2013-12-27T03:00:56.740" Score="3" ViewCount="1607" Body="&lt;p&gt;I have three layer 3 devices in a pretty simple topology:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC1 -&amp;gt; [Fe0/0] C2621 [Fe0/1] -&amp;gt; [Fe0/2] Modem [WAN] -&amp;gt; Internet&#xA;&#xA;&#xA;PC1:   192.168.254.100/24&#xA;&#xA;&#xA;C2621: Fe0/0: 192.168.254.254/24&#xA;       Fe0/1: 10.0.0.3/24&#xA;&#xA;&#xA;Modem: Fe0/2: 10.0.0.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From PC1 I'm able to ping the modem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ping statistics for 10.0.0.1:&#xA;Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),&#xA;Approximate round trip times in milli-seconds:&#xA;Minimum = 0ms, Maximum = 1ms, Average = 0ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The modem does not have any static routes assigned to it. How is it possible that the pings go through? I made the same topology in GNS3 with three routers with the exact same IP addresses and was not able to ping the modem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#ping 10.0.0.1&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.0.0.1, timeout is 2 seconds:&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This model of modem doesn't allow me to see the ARP table. Also, a traceroute shows that the ping goes to 10.1.1.1 and then 10.0.0.1. Just as it should IF the modem actually had a route back to the 10.1.1.0/24 network which it doesn't. I even tried disconnecting the cable from R1 to the modem to see if the pings would fail. They did.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It makes absolutely no sense for the modem to know where the 10.1.1.0/24 network is. How is this possible? The modem is a SBG6580 Cable Modem&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional information:&#xA;`&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C2621#show ip rou&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/24 is subnetted, 1 subnets&#xA;C       10.0.0.0 is directly connected, FastEthernet0/1&#xA;C    192.168.254.0/24 is directly connected, FastEthernet0/0.254&#xA;&#xA;&#xA;&#xA;&#xA;C2621#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1109 bytes&#xA;!&#xA;version 12.3&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname C2621&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$sc4H$NGsbRnN8X2zErueSVyaim/&#xA;!&#xA;no aaa new-model&#xA;ip subnet-zero&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!    &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/0.254&#xA; encapsulation dot1Q 1 native&#xA; ip address 192.168.254.254 255.255.255.0&#xA; no snmp trap link-status&#xA;!&#xA;interface Serial0/0&#xA; no ip address&#xA; shutdown&#xA; no fair-queue&#xA;!&#xA;interface FastEthernet0/1&#xA; description Test Description&#xA; ip address 10.0.0.3 255.255.255.0&#xA; no ip proxy-arp&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip classless&#xA;ip http server&#xA;!&#xA;!&#xA;!&#xA;voice-port 1/0/0&#xA;!&#xA;voice-port 1/0/1&#xA;!&#xA;voice-port 1/1/0&#xA;!&#xA;voice-port 1/1/1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;logging synchronous&#xA;line aux 0&#xA;line vty 0 1&#xA; exec-timeout 0 0&#xA; password cisco&#xA; login&#xA; transport input telnet&#xA;line vty 2 4&#xA; exec-timeout 0 0&#xA; password cisco&#xA; login&#xA;line vty 5&#xA; exec-timeout 0 0&#xA; password cisco&#xA; login&#xA;line vty 6 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;C2621#show ip arp&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  10.0.0.3                -   0001.9651.dea1  ARPA   FastEthernet0/1&#xA;Internet  10.0.0.1                2   94cc.b902.7976  ARPA   FastEthernet0/1&#xA;Internet  192.168.254.254         -   0001.9651.dea0  ARPA   FastEthernet0/0.254&#xA;Internet  192.168.254.4          11   0017.5a57.3480  ARPA   FastEthernet0/0.254&#xA;Internet  192.168.254.2          11   0011.bb6d.0300  ARPA   FastEthernet0/0.254&#xA;Internet  192.168.254.3          11   0015.f9f8.0900  ARPA   FastEthernet0/0.254&#xA;Internet  192.168.254.1          11   0017.59eb.3580  ARPA   FastEthernet0/0.254&#xA;Internet  192.168.254.100         2   e000.0000.129c  ARPA   FastEthernet0/0.254&#xA;&#xA;&#xA;C2621#show version&#xA;Cisco Internetwork Operating System Software&#xA;IOS (tm) C2600 Software (C2600-IPVOICE-M), Version 12.3(15), RELEASE SOFTWARE (fc3)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2005 by cisco Systems, Inc.&#xA;Compiled Tue 24-May-05 14:01 by ssearch&#xA;Image text-base: 0x80008098, data-base: 0x8183E8D4&#xA;&#xA;ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)&#xA;ROM: C2600 Software (C2600-IPVOICE-M), Version 12.3(15), RELEASE SOFTWARE (fc3)&#xA;&#xA;C2621 uptime is 3 hours, 29 minutes&#xA;System returned to ROM by power-on&#xA;System image file is &quot;flash:c2600-ipvoice-mz.123-15.bin&quot;&#xA;&#xA;cisco 2621 (MPC860) processor (revision 0x102) with 61440K/4096K bytes of memory.&#xA;Processor board ID JAB04130AL8 (912529492)&#xA;M860 processor: part number 0, mask 49&#xA;Bridging software.&#xA;X.25 software, Version 3.0.0.&#xA;2 FastEthernet/IEEE 802.3 interface(s)&#xA;1 Serial network interface(s)&#xA;2 Voice FXO interface(s)&#xA;2 Voice FXS interface(s)&#xA;32K bytes of non-volatile configuration memory.&#xA;16384K bytes of processor board System flash (Read/Write)&#xA;&#xA;Configuration register is 0x2102&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="889" LastEditorUserId="775" LastEditDate="2013-12-27T17:37:13.020" LastActivityDate="2013-12-27T17:53:17.663" Title="Cable modem ARP behavior" Tags="|routing|lab|cable|" AnswerCount="1" CommentCount="10" ClosedDate="2019-04-27T22:12:47.540" ContentLicense="CC BY-SA 3.0" />
  <row Id="5619" PostTypeId="2" ParentId="5614" CreationDate="2013-12-27T17:05:38.393" Score="2" Body="&lt;p&gt;The answer to your question, &quot;how is this possible?&quot; is simply the obvious: The modem is not acting in the way you would expect a network device (like a Cisco router) to function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Writing the code to route packets is harder than it looks, and many companies, especially with consumer-grade products, take shortcuts.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case it appears that your modem has a very simplistic routing algorithm, probably because it is not expecting multiple networks on the LAN side (it's a home router, after all).  So rather than a routing table and all the other data structures, it simplemindedly combines the arp and routing tables.  So the modem learns the MAC address of a packet on the LAN side without having to build a normal routing table.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also possible, as Mike suggests, that the modem is using classful networks, and the mask is /8, in spite of what you type.  I've seen similar behavior in other devices before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simpler software, cheaper product, works fine in most cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's my story and I'm sticking to it.  ;-p&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topic police:  As a side issue, if this is home networking, isn't this off-topic?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2013-12-27T17:53:17.663" LastActivityDate="2013-12-27T17:53:17.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5620" PostTypeId="2" ParentId="5320" CreationDate="2013-12-27T18:46:33.963" Score="6" Body="&lt;p&gt;Well, this is kinda funny. Firstly, I should mention that this is a project that I was recently asked to work on where everyone that previously worked on it has left the company and there is next to no documentation. All I had to go on was a grossly inaccurate network topology diagram which I am in the process of redrawing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, after investigating a million other things, I traced the tremendous mess of cables behind the server racks to look at the multiple ethernet cables from the segment that wasn't talking to the rest of the network. This is where I saw no link lights for the ethernet ports on the back of a server whereas the front panel showed several green lights. What I found out is that the front panel of the server will show those green lights even when it isn't turned on! Since it was off, there was no active connection from that particular server rack to the rest of the network. After turning it on, I checked the router again and AREA 0 is no longer inactive. It now has its OSPF neighbors and routes that it should have and the end devices are able to communicate properly. So, everything works now that the server has been turned on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, one needs to always ask the following two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Are you sure it's plugged in? &lt;/li&gt;&#xA;&lt;li&gt;Have you tried turning it off and on again?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1453" LastEditorUserId="1453" LastEditDate="2013-12-27T19:07:32.873" LastActivityDate="2013-12-27T19:07:32.873" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5622" PostTypeId="2" ParentId="5064" CreationDate="2013-12-27T20:06:33.840" Score="1" Body="&lt;p&gt;Since the ARP packet itself is encapsulated in an Ethernet frame, it cannot be exclusively a L2 protocol. However, ARP services a L2 issue for a L3 service (What interface accepts frames for a certain L3 address?) by use of L2 services (The FFFF.FFFF.FFFF broadcast address.). Therefore, ARP matches L2 + L3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, what services are touched by ARP at least once? &lt;strong&gt;L3 and L2&lt;/strong&gt;. This does not mean that ARP does not fit into the OSI model. The &lt;strong&gt;reference&lt;/strong&gt; model offers you a profile to match your observations. This does not imply you have to choose a single layer.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2013-12-27T20:06:33.840" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5624" PostTypeId="1" AcceptedAnswerId="5628" CreationDate="2013-12-28T08:04:10.107" Score="9" ViewCount="2091" Body="&lt;p&gt;I am aware of the ability to show the access VLAN assigned to an interface on a cisco switch. How about showing specifically the voice VLAN an interface is assigned?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show run int fa1/47&#xA;interface FastEthernet1/47&#xA; description Data&amp;amp;Voice&#xA; switchport access vlan 1&#xA; switchport mode access&#xA; switchport voice vlan 2&#xA;end&#xA;&#xA;#show int status module 1 | in Fa1/47&#xA;Port      Name             Status      Vlan    Duplex  Speed  Type&#xA;Fa1/47  Data&amp;amp;Voice  notconnect   1          full      100      10/100BaseTX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The show interface status command only shows the access VLAN, not the voice VLAN. Any suggestions for commands to specifically show the voice VLAN assigned to a switch port without using too much reg-ex or seeking through the running configuration?&lt;/p&gt;&#xA;" OwnerUserId="2477" LastEditorUserId="44" LastEditDate="2013-12-29T19:42:29.583" LastActivityDate="2013-12-29T19:42:29.583" Title="Voice VLAN information" Tags="|cisco|vlan|cisco-ios|voice|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5625" PostTypeId="2" ParentId="5624" CreationDate="2013-12-28T10:02:05.840" Score="6" Body="&lt;p&gt;&lt;code&gt;show interfaces &amp;lt;interface&amp;gt; switchport&lt;/code&gt; or &lt;code&gt;show interfaces &amp;lt;interface&amp;gt; switchport | i Voice&lt;/code&gt; would get you what you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch# show interfaces gigabitethernet0/1 switchport&#xA;Name: Gi0/1&#xA;Switchport: Enabled&#xA;Administrative Mode: dynamic auto&#xA;Operational Mode: static access&#xA;Administrative Trunking Encapsulation: negotiate&#xA;Operational Trunking Encapsulation: native&#xA;Negotiation of Trunking: On&#xA;Access Mode VLAN: 1 (default)&#xA;Trunking Native Mode VLAN: 1 (default)&#xA;Voice VLAN: none&#xA;Administrative private-vlan host-association:10 (VLAN0010) 502 (VLAN0502)&#xA;Administrative private-vlan mapping: none &#xA;Administrative private-vlan trunk native VLAN: none&#xA;Administrative private-vlan trunk encapsulation: dot1q&#xA;Administrative private-vlan trunk normal VLANs: none&#xA;Administrative private-vlan trunk private VLANs: none&#xA;Operational private-vlan: none&#xA;Trunking VLANs Enabled: ALL&#xA;Pruning VLANs Enabled: 2-1001&#xA;Capture Mode Disabled&#xA;Capture VLANs Allowed: ALL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch# show interfaces gigabitethernet0/1 switchport | i Voice&#xA;Voice VLAN: none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="267" LastActivityDate="2013-12-28T10:02:05.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5628" PostTypeId="2" ParentId="5624" CreationDate="2013-12-28T13:57:50.820" Score="9" Body="&lt;p&gt;&lt;em&gt;First, a caveat: I'm not sure why you specified the following (emphasis mine),&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Any suggestions for commands to specifically show the voice vlan assigned to a switch port &lt;strong&gt;without using too much reg-ex or seeking through the running configuration&lt;/strong&gt;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;However, even the lengthiest reg-ex command in a Cisco device can be shortened by the &lt;code&gt;alias&lt;/code&gt; command.  In fact one of my frequently used aliases is to show the exact information you're looking for.  Which I will include below.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now, there are several ways to get the information you're looking for, and it depends on what exactly you know, and what you're trying to find.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you know what the voice VLAN(s) is/are on that particular switch, and you're looking to find out what ports they're assigned to, you could simply issue the command:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show vlan id &amp;lt;voice-vlan-number&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would give you a list of all ports utilizing that VLAN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ATR4506-A1A-1#show vlan id 210 &#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;210  ATRIUM-IP-PHONES                 active    Gi2/2, Gi2/3, Gi2/4, Gi2/5, Gi2/6,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you know the port of interest (or want to see all ports) and just want to see which voice VLAN is in use on that port, you are looking for something like the following:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interfaces switchport | include Name|Voice&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I have this command aliased to &lt;code&gt;svv&lt;/code&gt; (for show voice vlan) like so:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;alias exec svv show interfaces switchport | include Name|Voice&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the command I most frequently use to gather this information, and it gives the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ATR4506-A1A-1#svv                                      &#xA;Name: Te1/1&#xA;Voice VLAN: none&#xA;Name: Te1/2&#xA;Voice VLAN: none&#xA;Name: Gi2/2&#xA;Voice VLAN: 210 (ATRIUM-IP-PHONES)&#xA;Name: Gi2/3&#xA;Voice VLAN: 210 (ATRIUM-IP-PHONES)&#xA;Name: Gi2/4&#xA;Voice VLAN: 210 (ATRIUM-IP-PHONES)&#xA;Name: Gi2/5&#xA;Voice VLAN: 210 (ATRIUM-IP-PHONES)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another alternative would be to filter the &lt;code&gt;show run&lt;/code&gt; output if you need the exact interface names and switchport info (for scripting purposes for example):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show running-config | include interface GigabitEthernet|switchport voice vlan&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This gives:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ATR4506-A1A-1#show running-config | include interface GigabitEthernet|switchport voice vlan &#xA;interface GigabitEthernet1/3&#xA;interface GigabitEthernet1/4&#xA;interface GigabitEthernet1/5&#xA;interface GigabitEthernet1/6&#xA;interface GigabitEthernet2/1&#xA;interface GigabitEthernet2/2&#xA; switchport voice vlan 210&#xA;interface GigabitEthernet2/3&#xA; switchport voice vlan 210&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastActivityDate="2013-12-28T13:57:50.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5632" PostTypeId="1" AcceptedAnswerId="5643" CreationDate="2013-12-28T19:14:03.293" Score="10" ViewCount="6221" Body="&lt;p&gt;I am familiar (high level) with how Ternary Content Addressable Memory operates but I remain confused as to how TCAM relates to ASICs and when these components possibly also combine with the CPU for greater switching performance... &lt;em&gt;(particularly when vendors often market the use of merchant/custom silicon, or custom ASICs for new products &amp;amp; features then it appears confusing)&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am familiar in Cisco IOS for example with the ability to partition more space for TCAM performance  for features like qos, acl and route lookups.  I also understand features like NAT will still rely on CPU processing, however i am specifically struggling with;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is TCAM part of the same hardware architecture, i.e. internal or&#xA;external to the ASIC itself?&lt;/li&gt;&#xA;&lt;li&gt;Are TCAMs scalable (for example can manufacturers just keep adding TCAMs to a platform for greater performance &amp;amp; custom features) or is there a limit based on things like power consumption?&lt;/li&gt;&#xA;&lt;li&gt;Do TCAM cycles and ASICs work in parallel with the CPU at all for features like&#xA;NAT or should I only think of them as independent things?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="109" LastEditorUserId="775" LastEditDate="2013-12-29T20:28:21.723" LastActivityDate="2013-12-30T18:22:14.263" Title="TCAM relationships in hardware-switching architecture" Tags="|memory|asics|cpu|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5634" PostTypeId="1" AcceptedAnswerId="5635" CreationDate="2013-12-29T17:44:54.793" Score="8" ViewCount="2596" Body="&lt;p&gt;How many sub interfaces can be created on a cisco router to route between vlans on a connected switch?&lt;/p&gt;&#xA;" OwnerUserId="3696" LastActivityDate="2013-12-29T21:36:59.787" Title="SubInterface on a router" Tags="|routing|vlan|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5635" PostTypeId="2" ParentId="5634" CreationDate="2013-12-29T18:03:46.820" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Maximum Number of Interfaces&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Every interface uses an IDB. Therefore, the IDB limit indicates the&#xA;  maximum number of interfaces a router can handle.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The IDB limit is, therefore, the answer to the common question &quot;How&#xA;  many (sub)interfaces can be configured on this platform?&quot;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Maximum Number of VLANs&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Each Virtual LAN (VLAN) requires one IDB. Any Cisco IOS software&#xA;  release can support up to 4096 VLANs (0-4095, where the number range&#xA;  is 1 to 4094 and in which 0, 4095 are reserved), if the platform&#xA;  supports at least 4000 IDBs&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;There is a limitation of 256 bridge groups in the Cisco IOS software&#xA;  release if you use VLAN bridging.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&quot;&lt;a href=&quot;http://www.cisco.com/en/US/products/sw/iosswrel/ps1835/products_tech_note09186a0080094322.shtml&quot;&gt;Maximum Number of Interfaces and Subinterfaces for Cisco IOS Routers: IDB Limits&lt;/a&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are alluding to a router on a stick scenario (?) then it will depend on how many IDBs the platform can handle. A SWIDB represents a logical sub-interface and you can use the IOS command 'show idb' for existing allocations and the memory consumed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each interface uses an IDB and the limit therefore indicates the maximum number of interfaces a router can handle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to know how many IDBs your particular platorm can configure (see above).  Commonly this can correlate to the max number of vlans configurable because each vlan will require 1 IDB (normally 4094 in cisco IOS).&lt;/p&gt;&#xA;" OwnerUserId="109" LastEditorUserId="619" LastEditDate="2013-12-29T21:36:59.787" LastActivityDate="2013-12-29T21:36:59.787" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5636" PostTypeId="2" ParentId="5632" CreationDate="2013-12-29T18:55:37.890" Score="4" Body="&lt;p&gt;ASIC can be thought of as a kind of chip. It is normally built in order to do something in hardware that otherwise would be done is software. So Cisco can build an ASIC for anything it wants. Depending on the model of the switch there is 1 or many ASICs. TCAM is a memory design since it is usually found on the chassis systems it is implemented as 1 of many asics. TCAM is used for particular lookup functions like routing (CEF) or ACLS, so if an ASIC does not need to do that kind of lookup it works separately from TCAM. On the other hand ASICs that handle QoS marking work hand in glove with TCAM. The presentation below on cisco live discusses some of the design tradeoffs, and a good place to look to get an understanding of what goes into switch design&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BRKARC-3466 -  Exploring the engineering behind the making of a switch (2013 Orlando) it contains lists of the asics and a lot of general switch design information&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-12-29T18:55:37.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5641" PostTypeId="1" CreationDate="2013-12-30T14:41:28.580" Score="4" ViewCount="6817" Body="&lt;p&gt;Why would someone use &lt;code&gt;authentication mac-move permit&lt;/code&gt; when dot1x authentication is not performed by the switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that there are APs attached to the switch, which are being authenticated by a WLC. &lt;/p&gt;&#xA;" OwnerUserId="3704" LastEditorUserId="33" LastEditDate="2015-07-07T03:01:52.457" LastActivityDate="2015-07-07T03:01:52.457" Title="authentication mac-move permit" Tags="|cisco|wireless|mac-address|authentication|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5643" PostTypeId="2" ParentId="5632" CreationDate="2013-12-30T17:52:20.973" Score="14" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Content-addressable_memory#Ternary_CAMs&quot;&gt;TCAM&lt;/a&gt; is a type of memory, which takes 10-12 transistors to store a single bit. By way of comparison, Static RAM (&lt;a href=&quot;http://en.wikipedia.org/wiki/Static_random-access_memory&quot;&gt;SRAM&lt;/a&gt;) only takes 6 transistors to store a single bit, and Dynamic RAM (&lt;a href=&quot;http://en.wikipedia.org/wiki/Dynamic_random-access_memory&quot;&gt;DRAM&lt;/a&gt;) takes one transistor and a capacitor.  All these different types of memories can either be internal or external to an ASIC. One reason to put all memories on a chip, is that they can be ran at higher clock rates than when external to a chip. Why choose one type of memory over another? This has to do with characteristics of the memory, &lt;a href=&quot;http://en.wikipedia.org/wiki/Static_random-access_memory&quot;&gt;SRAM&lt;/a&gt; can be accessed every clock, &lt;a href=&quot;http://en.wikipedia.org/wiki/Dynamic_random-access_memory&quot;&gt;DRAM&lt;/a&gt; requires periodic refresh, so can not be accessed every clock and &lt;a href=&quot;http://en.wikipedia.org/wiki/Content-addressable_memory#Ternary_CAMs&quot;&gt;TCAM&lt;/a&gt; gives you &lt;a href=&quot;http://en.wikipedia.org/wiki/Ternary_operation&quot;&gt;ternary capability&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Content-addressable_memory#Ternary_CAMs&quot;&gt;TCAM&lt;/a&gt;s are as scalable as long as you have space on a chip to instantiate them, or pins on package to connect to external ones. The issue with &lt;a href=&quot;http://en.wikipedia.org/wiki/Content-addressable_memory#Ternary_CAMs&quot;&gt;TCAM&lt;/a&gt; is they take 2x space of &lt;a href=&quot;http://en.wikipedia.org/wiki/Static_random-access_memory&quot;&gt;SRAM&lt;/a&gt;, and 12x space of &lt;a href=&quot;http://en.wikipedia.org/wiki/Dynamic_random-access_memory&quot;&gt;DRAM&lt;/a&gt;. It does not always make sense to use &lt;a href=&quot;http://en.wikipedia.org/wiki/Content-addressable_memory#Ternary_CAMs&quot;&gt;TCAM&lt;/a&gt; for the same operations that you can do them algorithmically (Hashes, *tries) with other memory types. It comes down to a tradeoff between utilization effectiveness of the algorithm and space on the chip on which one to choose. &lt;a href=&quot;http://en.wikipedia.org/wiki/Content-addressable_memory#Ternary_CAMs&quot;&gt;TCAM&lt;/a&gt;'s power utilization grows in linear proportion to size. The majority of large &lt;a href=&quot;http://en.wikipedia.org/wiki/Content-addressable_memory#Ternary_CAMs&quot;&gt;TCAM&lt;/a&gt;s (greater than 2M entries) now use algorithmic techniques so that power savings can be achieved. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT/PAT is complex feature, which generally needs a CPU or Network Processor (NPU) to handle fixups. The general packet flow for NAT is first packet goes to CPU/NPU, and a flow entry is installed in flow table or ACL table with the information on how to translate subsequent packets in the flow. There are multiple different forms of NAT/PAT, and just as many ways to optimize each one in a chip. The simplest NAT being rewrite the IPs, and don't worry if you break the addresses embedded in the payload, no fixups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is another version of BRKARC-3466 which was presented at CiscoLive 2013 in Melbourne that covers some of the high level ideas behind lookups, which is missing from the 2013 Orlando one. A good reference book on this area is &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0120884771&quot;&gt;Network Algorithmics: An Interdisciplinary Approach to Designing Fast Networked Devices&lt;/a&gt; by George Varghese.&lt;/p&gt;&#xA;" OwnerUserId="3697" LastEditorUserId="775" LastEditDate="2013-12-30T18:22:14.263" LastActivityDate="2013-12-30T18:22:14.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5644" PostTypeId="1" AcceptedAnswerId="5648" CreationDate="2013-12-30T18:37:51.363" Score="7" ViewCount="1948" Body="&lt;p&gt;We are trying to replace our existing router with a newly purchased&#xA;Cisco router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GigabitEthernet0/0: PPPoE&#xA;GigabitEthernet0/1: 192.168.2.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PPPoE is getting established perfectly, and I can ping&#xA;the outside from inside CLI however, the clients cannot&#xA;ping the outside world.&#xA;As mentioned, this is replace an existing router with the&#xA;same IP (ie, 192.168.2.1) therefore, the clients are all&#xA;setup and working fine when not using the Cisco router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My configuration is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Current configuration : 2698 bytes&#xA;!&#xA;version 15.1&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname r1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;enable secret 4 &amp;lt;secret&amp;gt;&#xA;!&#xA;aaa new-model&#xA;!&#xA;aaa session-id common&#xA;!&#xA;dot11 syslog&#xA;ip source-route&#xA;!&#xA;ip cef&#xA;!&#xA;ip domain name test.com&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;voice-card 0&#xA;!&#xA;crypto pki token default removal timeout 0&#xA;!&#xA;license udi pid CISCO3825 sn FTX1039A0AA&#xA;username admin privilege 15 secret 4 &amp;lt;secret&amp;gt;&#xA;!&#xA;redundancy&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; media-type rj45&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 1&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; media-type rj45&#xA;!&#xA;interface Dialer0&#xA; ip address negotiated&#xA; no ip redirects&#xA; no ip proxy-arp&#xA; ip mtu 1492&#xA; ip flow ingress&#xA; encapsulation ppp&#xA; ip route-cache policy&#xA; dialer pool 1&#xA; dialer-group 1&#xA; ppp authentication pap callin&#xA; ppp pap sent-username &amp;lt;username&amp;gt; password 0 &amp;lt;password&amp;gt;&#xA; ppp ipcp dns request accept&#xA; ppp ipcp route default&#xA; ppp ipcp address accept&#xA; no cdp enable&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip nat pool voip-rtp 192.168.2.5 192.168.2.5 netmask 255.255.255.0 type rotary&#xA;ip nat inside source list 1 interface GigabitEthernet0/1 overload&#xA;ip nat inside source static tcp 192.168.2.10 25 77.71.31.187 25 extendable&#xA;ip nat inside source static tcp 192.168.2.5 53 77.71.31.187 53 extendable&#xA;ip nat inside source static tcp 192.168.2.15 80 77.71.31.187 80 extendable&#xA;ip nat inside source static tcp 192.168.2.15 443 77.71.31.187 443 extendable&#xA;ip nat inside source static tcp 192.168.2.10 465 77.71.31.187 465 extendable&#xA;ip nat inside source static tcp 192.168.2.10 993 77.71.31.187 993 extendable&#xA;ip nat inside source static tcp 192.168.2.10 995 77.71.31.187 995 extendable&#xA;ip nat inside source static udp 192.168.2.5 5060 77.71.31.187 5060 extendable&#xA;ip nat inside source static udp 192.168.2.20 5080 77.71.31.187 5080 extendable&#xA;ip nat inside destination list 114 pool voip-rtp&#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0&#xA;ip route 64.230.11.5 255.255.255.255 GigabitEthernet0/0&#xA;!&#xA;access-list 1 permit 192.168.2.0 0.0.0.255&#xA;access-list 114 permit udp any any range 8000 65535&#xA;!&#xA;control-plane&#xA;!&#xA;mgcp profile default&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA; transport input ssh&#xA;!&#xA;scheduler allocate 20000 1000&#xA;end &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Things I tried:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Statically setting the IP route:&#xA;    ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0&#xA;    ip route 64.230.11.5 255.255.255.255 GigabitEthernet0/0&#xA;Although this is probably not needed for auto established PPPoE connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP NAT Trans Output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Pro Inside global         Inside local          Outside local         Outside global&#xA;tcp 77.71.31.187:53       192.168.2.5:53        ---                   ---&#xA;udp 77.71.31.187:5060     192.168.2.5:5060      &amp;lt;voip supplier's ip&amp;gt;:5060   &amp;lt;voip supplier's ip&amp;gt;:5060&#xA;udp 77.71.31.187:5060     192.168.2.5:5060      &amp;lt;voip supplier's ip&amp;gt;:5060   &amp;lt;voip supplier's ip&amp;gt;:5060&#xA;udp 77.71.31.187:5060     192.168.2.5:5060      ---                   ---&#xA;tcp 77.71.31.187:25       192.168.2.10:25       217.160.226.122:25    217.160.226.122:25&#xA;tcp 77.71.31.187:25       192.168.2.10:25       ---                   ---&#xA;tcp 77.71.31.187:465      192.168.2.10:465      ---                   ---&#xA;tcp 77.71.31.187:993      192.168.2.10:993      ---                   ---&#xA;tcp 77.71.31.187:995      192.168.2.10:995      ---                   ---&#xA;tcp 77.71.31.187:80       192.168.2.15:80       66.249.74.2:33795     66.249.74.2:33795&#xA;tcp 77.71.31.187:80       192.168.2.15:80       66.249.74.2:50496     66.249.74.2:50496&#xA;tcp 77.71.31.187:80       192.168.2.15:80       ---                   ---&#xA;tcp 77.71.31.187:443      192.168.2.15:443      ---                   ---&#xA;udp 77.71.31.187:5080     192.168.2.20:5080     ---                   ---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3706" LastEditorUserId="46207" LastEditDate="2019-01-17T16:12:09.867" LastActivityDate="2019-01-17T16:12:09.867" Title="PPPoE with NAT configuration broken" Tags="|cisco|nat|pppoe|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 4.0" />
  <row Id="5646" PostTypeId="2" ParentId="3678" CreationDate="2013-12-30T20:20:28.230" Score="2" Body="&lt;p&gt;Yes, what you suggest would work just fine, assuming that you have control over the existing default gateway/router for the subnet on each side.  Variations on this same theme can be used to provide VPN backups to a primary connectivity method (MPLS, point-to-point T1/T3, etc.) using route tracking, static routes with a higher AD 'underneath' a dynamically learned route on the primary connection, etc.&lt;/p&gt;&#xA;" OwnerUserId="3651" LastActivityDate="2013-12-30T20:20:28.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5647" PostTypeId="2" ParentId="5644" CreationDate="2013-12-30T21:04:02.430" Score="6" Body="&lt;p&gt;The NAT statement &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ip nat inside source list 1 interface GigabitEthernet0/1 overload&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;is incorrect.  You should specify the dialer0 interface instead.  Here's a helpful link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/access/800/850/software/configuration/guide/pppoenat.html#wp1235296&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/docs/routers/access/800/850/software/configuration/guide/pppoenat.html#wp1235296&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2013-12-30T21:04:02.430" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5648" PostTypeId="2" ParentId="5644" CreationDate="2013-12-30T21:13:40.020" Score="8" Body="&lt;p&gt;NAT is applied to g0/0, not di0 where it is required. (there's no IP running on g0/0, so none of the IP configuration matters there.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int di0&#xA; ip nat outside&#xA;!&#xA;no ip nat inside source list 1 interface GigabitEthernet0/1 overload&#xA;ip nat inside source list 1 interface di0 overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The two route statements are not necessary.  If you need something to trigger the dialer, the route would be &lt;code&gt;ip route 0.0.0.0 0.0.0.0 dialer0&lt;/code&gt;, but it should be triggered as long as g0/0 is up/up.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2013-12-30T21:13:40.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5649" PostTypeId="2" ParentId="147" CreationDate="2013-12-30T23:03:24.223" Score="1" Body="&lt;p&gt;I would suggest the right answer is it depends on the topology of the network. OSPF requires area boundaries to do summarization, if you are doing a green field network or your topology is condusive to drawing areas out then by all means use it. If your network requires spokes to connect to multiple hubs, then OSPF is harder to do, when I had this requirement on my frame relay network I migrated remote sites to BGP. I wanted to use EIGRP and stub routers but cisco mentioned that more resources were being spent on BGP-OSPF interoperability vs EIGRP-OSPF interoperability so I went BGP on that basis. Another way to put it is that EIGRP with its stub routers and the ability to summarize wherever you want will scale better in a 'messy' topology.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2013-12-30T23:03:24.223" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5650" PostTypeId="1" AcceptedAnswerId="5652" CreationDate="2013-12-30T23:24:56.210" Score="8" ViewCount="1701" Body="&lt;p&gt;I'm using a Juniper EX2200 as demarc/CPE device for a customer that has multiple handoff ports on the one switch. I need to make sure that, across all their ports, they don't use more bandwidth than they ordered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read the Juniper doc &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos11.4/topics/task/configuration/cos-schedulers-cli.html&quot;&gt;Defining CoS Schedulers&lt;/a&gt; and I'm still not sure if the egress shaper is applied per-interface or per-scheduler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My config snippit is below. Ports 0/1/0-3 are downstream to the customer and port 0/1/0 is upstream.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show class-of-service&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        scheduler-map all-cust;&#xA;    }&#xA;    ge-0/0/1 {&#xA;        scheduler-map all-cust;&#xA;    }&#xA;    ge-0/0/2 {&#xA;        scheduler-map all-cust;&#xA;    }&#xA;    ge-0/0/3 {&#xA;        scheduler-map all-cust;&#xA;    }&#xA;    ge-0/1/0 {&#xA;        shaping-rate 20971520;&#xA;    }&#xA;}&#xA;scheduler-maps {&#xA;    all-cust {&#xA;        forwarding-class best-effort scheduler all-cust;&#xA;    }&#xA;}&#xA;schedulers {&#xA;    all-cust {&#xA;        shaping-rate 31457280;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2013-12-31T08:55:06.763" Title="Is the shaping-rate on a CoS scheduler per-port or aggregate on a Juniper EX?" Tags="|juniper-junos|juniper-ex|cos|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5652" PostTypeId="2" ParentId="5650" CreationDate="2013-12-31T02:45:15.687" Score="6" Body="&lt;p&gt;Per port, not aggregate. Schedulers are not global, rather per interface queue. &lt;/p&gt;&#xA;" OwnerDisplayName="user3525" LastActivityDate="2013-12-31T02:45:15.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5653" PostTypeId="2" ParentId="5650" CreationDate="2013-12-31T08:55:06.763" Score="5" Body="&lt;p&gt;You should consider policing since your concern is that they don't get more bandwidth than they have been allotted. This will give you a hard limit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your shaping in this instance is just ensuring that 31457280 goes into the BE forwarding-class, not that they can't get more bandwidth than 31457280.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2013-12-31T08:55:06.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5657" PostTypeId="1" CreationDate="2013-12-31T17:56:26.077" Score="0" ViewCount="2281" Body="&lt;p&gt;I need to redistribute BGP to my client. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 transit providers, and my own AS with my own IP space. Now my client wants to advertise his own AS and IPs using us as his sole transit provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a single Mikrotik CCR Router. Is it possible to do this with my router? If so, can you give an example configuration?&lt;/p&gt;&#xA;" OwnerUserId="3714" LastEditorUserId="103" LastEditDate="2013-12-31T18:42:04.257" LastActivityDate="2014-01-31T17:19:04.303" Title="eBGP redistribution on Mikrotik CCR" Tags="|router|bgp|isp|" AnswerCount="1" CommentCount="3" ClosedDate="2017-08-08T15:57:16.267" ContentLicense="CC BY-SA 3.0" />
  <row Id="5658" PostTypeId="2" ParentId="328" CreationDate="2013-12-31T18:01:37.887" Score="0" Body="&lt;p&gt;You'll need two physical wireless interfaces in order to achieve true full-duplex. One thing to note, though, is that IEEE 802.11 doesn't support pure TX or pure RX on a single interface, so you wouldn't be able to use easily-obtainable Wi-Fi equipment. This, unfortunately, would also be a PtP solution, as you would still need to avoid collisions in PmP (as others here have also pointed out).&lt;/p&gt;&#xA;" OwnerUserId="3713" LastActivityDate="2013-12-31T18:01:37.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5660" PostTypeId="1" AcceptedAnswerId="5661" CreationDate="2013-12-31T20:29:16.900" Score="2" ViewCount="1360" Body="&lt;p&gt;When installing the SRE-V software on one of my SRE modules in a Cisco 2911, it keeps failing to download the final files after loading the Linux kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the interface configs from the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface SM1/0&#xA; ip address 192.168.201.1 255.255.255.0&#xA; service-module ip address 192.168.201.2 255.255.255.0&#xA; service-module ip default-gateway 192.168.201.1&#xA;interface SM1/1&#xA; description Internal switch interface connected to Service Module&#xA; switchport mode trunk&#xA; no ip address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is connected to my laptop running Python's SimpleHTTPServer via another 2911. Routing on both routers is setup so my local subnet can reach the SM1/0 IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router loads the installer and launches it without issue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#service-module sm1/0 install url http://172.21.49.155:8000/sre-v-k9-r.SPA.smv.2.0.1.pkg   &#xA;Proceed with installation? [no]: yes&#xA;Loading http://172.21.49.155:8000/sre-v-k9-r.SPA.smv.2.0.1.pkg.install.sre !&#xA;Service module installation&#xA;ios_version     15.2(4)M2,&#xA;ios_image   c2900-universalk9-mz&#xA;pkg_name    sre-v-k9-r.SPA.smv.2.0.1.pkg&#xA;key_file    sre-v-k9-r.SPA.smv.2.0.1.key&#xA;helper_file     sre-v-installer.SPA.smv.2.0.1&#xA;pid         SM-SRE-900-K9&#xA;&#xA;Check target platform capabilities&#xA;cpu      1865&#xA;Please select disk configuration (-1 = nonraid, 0 = raid0, 1 = raid1 ) [-1]: 1&#xA;Resource check completed successfully. Proceeding to Install ...&#xA;&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When monitoring the SRE session, it downloads and launches the kernel:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Initializing memory #1. Please wait...&#xA;&#xA;&#xA;&#xA;&#xA;Initializing memory #2. Please wait...&#xA;&#xA;&#xA;This may take a minute....&#xA;&#xA;&#xA; Serial ATA Port 0 : Hitachi HTE545050B9A300                 &#xA; Serial ATA Port 1 : Hitachi HTE545050B9A300                 &#xA;DDR Memory 8192 MB detected &#xA;Intel(R) Core(TM)2 Duo CPU     L9400  @ 1.86GHz&#xA;BIOS SM 3.52.8,  BIOS Build date: 02/08/2011&#xA;&#xA;Intel(R) Core(TM)2 Duo CPU     L9400  @ 1.86GHz&#xA;BIOS SM 3.52.8,  BIOS Build date: 02/08/2011&#xA;System now booting...&#xA;&#xA;&#xA;Please wait...  &#xA;&#xA;Please press P to select Primary Boot Loader ...   &#xA;          or S to select Secondary Boot Loader ...   &#xA;          or wait to boot from default configuration ...   &#xA;&#xA;.......................................................................................................&#xA;Now booting from primary boot loader (Default)....  &#xA;&#xA;&#xA;Authenticating boot loader....   &#xA;&#xA;&#xA;Primary Boot Loader Authenticated - booting....   &#xA;&#xA;boot params not set.&#xA;&#xA;Updating flash with bootloader configuration.&#xA;Please wait ................... done.&#xA;&#xA;&#xA;Please enter '***' to change boot configuration: &#xA;&#xA;Detect and Initialize network device&#xA;&#xA;&#xA;Backup current platform configurations....&#xA;&#xA;Updating flash with bootloader configuration.&#xA;Please wait ................... done.&#xA;&#xA;SRE step 1 - SM registration...&#xA;Finding (hd1,3)/296e03bc-3236-4a68-a178-688e56400a1e, failed&#xA;Local install not supported&#xA;&#xA;SRE step 2 - SM requests key file info...&#xA;&#xA;SRE step 3 - SM stores registration info... &#xA;&#xA;Updating flash with bootloader configuration.&#xA;Please wait ................... done.&#xA;&#xA;SRE step 4 - SM downloads key-file...&#xA;Writing keyfile to flash Size 916&#xA;writing complete.&#xA;&#xA;Updating flash with bootloader configuration.&#xA;Please wait ................... done.&#xA;&#xA;Erasing Post config Flash&#xA;&#xA;SRE step 5 - SM requests installer info...&#xA;&#xA;SRE step 6 - SM stores installer info...&#xA;&#xA;Updating flash with bootloader configuration.&#xA;Please wait ................... done.&#xA;&#xA;SRE step 7 - SM now downloads installer&#xA;| done.&#xA;&#xA;SRE step 8 - SM requests tcl header file info...&#xA;&#xA;SRE step 9 - SM now downloads the tcl header file&#xA;TCL header file downloaded completely size: 698&#xA;&#xA;SRE step 10 - SM requests tcl file info...&#xA;&#xA;SRE step 11 - SM now downloads the tcl file&#xA;TCL file downloaded completely size: 6520&#xA;&#xA;SRE step 12 - SM now boots Installer&#xA;Verifying ... done.&#xA;Starting Kernel.&#xA;&#xA;Platform: sm&#xA;INIT: version 2.86 booting&#xA;mounting proc fs ...&#xA;mounting sys fs ...&#xA;mounting /dev/shm tmpfs ...&#xA;kernel.sem = 1900 4000 32 100&#xA;vm.overcommit_memory = 1&#xA;&#xA;&#xA;        Welcome to Cisco Service Engine&#xA;&#xA;Setting the system time from hardware clock&#xA;&#xA;********** rc.aesop ****************&#xA;Populating resource values from /etc/sm_rsrc_file&#xA;Populating resource values from /etc/default_rsrc_file&#xA;Populating resource values from /usr/etc/products/galactica/default_rsrc_file&#xA;Populating resource values from /usr/etc/products/galactica/sm_rsrc_file&#xA;==&amp;gt; Management interface is eth0&#xA;==&amp;gt; Management interface is eth0&#xA;IOS IP Address Registration complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routing table is correct and I can ping the SM's IP on eth0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Kernel IP routing table&#xA;Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface&#xA;192.168.201.0   *               255.255.255.0   U         0 0          0 eth0&#xA;default         192.168.201.1   0.0.0.0         UG        0 0          0 eth0&#xA;SM-SRE-900-K9 is in IDE mode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the final download fails:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INIT: Entering runlevel: 2&#xA;********** rc.post_install ****************&#xA;&#xA;Changing owners and file permissions.&#xA;Change owners and permissions complete.&#xA;INIT: Switching to runlevel: 4&#xA;INIT: Sending processes the TERM signal&#xA;STARTED: dwnldr_startup.sh&#xA;sre_type=  1&#xA;    Welcome to Cisco Systems Service Engine Helper Software&#xA;userinput=  disk-cfg-mode=raid1&#xA;&#xA;Downloading http sre-v-k9-r.SPA.smv.2.0.1.pkg&#xA;&#xA;SM1/0 is reset due to &#xA; Can not download sre-v-k9-r.SPA.smv.2.0.1.pkg &#xA;error code 0 : error type 'couldn't connect to host'.&#xA;&#xA;&#xA;Error: Download error  &#xA; Can not download sre-v-k9-r.SPA.smv.2.0.1.pkg &#xA;error code 0 : error type 'couldn't connect to host'&#xA;Unable to install. Please try again.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried many different configurations to make this work but none of them would get past this final download after loading the kernel. I even tried loading the WLC software package using the exact same setup... and it loaded without a hitch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#service-module sm1/0 install url http://172.21.49.155:8000/AS_SMWLC_7_4_110_0.aes                                   &#xA;Proceed with installation? [no]: yes&#xA;Loading http://172.21.49.155:8000/AS_SMWLC_7_4_110_0.aes.install.sre Welcome to WLC installation checking resource requirements now&#xA;Resource check complete proceeding with installation&#xA;&#xA;Router#&#xA;[Resuming connection 1 to 192.168.201.1 ... ]&#xA;&#xA;Detect and Initialize network device&#xA;&#xA;&#xA;&#xA;&#xA;Initializing memory #1. Please wait...&#xA;&#xA;&#xA;&#xA;&#xA;Initializing memory #2. Please wait...&#xA;&#xA;&#xA;This may take a minute....&#xA;&#xA;&#xA; Serial ATA Port 0 : Hitachi HTE545050B9A300                 &#xA; Serial ATA Port 1 : Hitachi HTE545050B9A300                 &#xA;DDR Memory 8192 MB detected &#xA;Intel(R) Core(TM)2 Duo CPU     L9400  @ 1.86GHz&#xA;BIOS SM 3.52.8,  BIOS Build date: 02/08/2011&#xA;&#xA;Intel(R) Core(TM)2 Duo CPU     L9400  @ 1.86GHz&#xA;BIOS SM 3.52.8,  BIOS Build date: 02/08/2011&#xA;System now booting...&#xA;&#xA;&#xA;Please wait...  &#xA;&#xA;Please press P to select Primary Boot Loader ...   &#xA;          or S to select Secondary Boot Loader ...   &#xA;          or wait to boot from default configuration ...   &#xA;&#xA;.......................................................................................................&#xA;Now booting from primary boot loader....   &#xA;&#xA;&#xA;Authenticating boot loader....   &#xA;&#xA;&#xA;Primary Boot Loader Authenticated - booting....   &#xA;&#xA;&#xA;&#xA;Please enter '***' to change boot configuration: &#xA;&#xA;Detect and Initialize network device&#xA;&#xA;&#xA;Backup current platform configurations....&#xA;&#xA;SRE step 1 - SM registration...&#xA;Finding (hd1,3)/296e03bc-3236-4a68-a178-688e56400a1e, failed&#xA;Local install not supported&#xA;&#xA;SRE step 2 - SM requests key file info...&#xA;&#xA;SRE step 3 - SM stores registration info... &#xA;SRE configuration keeps the same. No flash update needed!&#xA;&#xA;SRE step 4 - SM downloads key-file...&#xA;Writing keyfile to flash Size 914&#xA;writing complete.&#xA;&#xA;Updating flash with bootloader configuration.&#xA;Please wait .................... done.&#xA;&#xA;Erasing Post config Flash&#xA;&#xA;SRE step 5 - SM requests installer info...&#xA;&#xA;SRE step 6 - SM stores installer info...&#xA;&#xA;Updating flash with bootloader configuration.&#xA;Please wait .................... done.&#xA;&#xA;SRE step 7 - SM now downloads installer&#xA;\ done.&#xA;&#xA;SRE step 8 - SM requests tcl header file info...&#xA;&#xA;SRE step 9 - SM now downloads the tcl header file&#xA;TCL header file downloaded completely size: 690&#xA;&#xA;SRE step 10 - SM requests tcl file info...&#xA;&#xA;SRE step 11 - SM now downloads the tcl file&#xA;TCL file downloaded completely size: 2819&#xA;&#xA;SRE step 12 - SM now boots Installer&#xA;&#xA;Verifying ... done.&#xA;Starting Kernel.&#xA;&#xA;Platform: sm&#xA;INIT: version 2.86 booting&#xA;mounting proc fs ...&#xA;mounting sys fs ...&#xA;mounting /dev/shm tmpfs ...&#xA;kernel.sem = 1900 4000 32 100&#xA;vm.overcommit_memory = 1&#xA;&#xA;&#xA;        Welcome to Cisco Service Engine&#xA;&#xA;Setting the system time from hardware clock&#xA;&#xA;********** rc.aesop ****************&#xA;Populating resource values from /etc/sm_rsrc_file&#xA;Populating resource values from /etc/default_rsrc_file&#xA;==&amp;gt; Management interface is eth0&#xA;==&amp;gt; Management interface is eth0&#xA;IOS IP Address Registration complete.&#xA;&#xA;&#xA;Kernel IP routing table&#xA;Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface&#xA;192.168.201.0   *               255.255.255.0   U         0 0          0 eth0&#xA;default         192.168.201.1   0.0.0.0         UG        0 0          0 eth0&#xA;Size of buff is: 65536&#xA;65536 bytes written&#xA;Valid License file not found: Using default values&#xA;INIT: Entering runlevel: 2&#xA;********** rc.post_install ****************&#xA;&#xA;Changing owners and file permissions.&#xA;Change owners and permissions complete.&#xA;INIT: Switching to runlevel: 4&#xA;INIT: Sending processes the TERM signal&#xA;STARTED: dwnldr_startup.sh&#xA;You are about to repartition your compact flash, which will destroy all&#xA;existing data on it.&#xA;&#xA;Do you want to Continue? [yn]:&#xA;Validating Flash Disk Geometry... &#xA;Disk has a Valid partition table!&#xA;TotalCylinders = 1960&#xA;BytesPerCylinder = 1048576 &#xA;SafetyZoneBytes = 123312537 &#xA;SafetyZoneCylinders = 118 &#xA;TotalCylinders (after safety zone reduction) = 1842&#xA;&#xA;WARNING:  About to repartition disk /dev/sdc as shown:&#xA;       /dev/sdc1    33 cylinders (33 Mb)&#xA;       /dev/sdc2*   9 cylinders (9 Mb)&#xA;       /dev/sdc3    1795 cylinders (1795 Mb)&#xA;       /dev/sdc4    5 cylinders (5 Mb)&#xA;Partitioning the flash disk... &#xA;Disk /dev/sdc: 1960 cylinders, 64 heads, 32 sectors/track&#xA;Old situation:&#xA;Units = cylinders of 1048576 bytes, blocks of 1024 bytes, counting from 0&#xA;&#xA;   Device Boot Start     End   #cyls    #blocks   Id  System&#xA;/dev/sdc1          4     899     896     917504    5  Extended&#xA;/dev/sdc2          0       -       0          0    0  Empty&#xA;/dev/sdc3          0       -       0          0    0  Empty&#xA;/dev/sdc4   *      0+      3       4-      4080   ef  EFI (FAT-12/16/32)&#xA;/dev/sdc5          4+    253     250-    255984    6  FAT16&#xA;/dev/sdc6        254+    503     250-    255984    6  FAT16&#xA;/dev/sdc7        504+    613     110-    112624   fc  Unknown&#xA;/dev/sdc8        614+    899     286-    292848    6  FAT16&#xA;New situation:&#xA;Units = cylinders of 1048576 bytes, blocks of 1024 bytes, counting from 0&#xA;&#xA;   Device Boot Start     End   #cyls    #blocks   Id  System&#xA;/dev/sdc1          0+     32      33-     33791+   c  W95 FAT32 (LBA)&#xA;/dev/sdc2   *     33      41       9       9216   83  Linux&#xA;/dev/sdc3         42    1836    1795    1838080   83  Linux&#xA;/dev/sdc4       1837    1841       5       5120   83  Linux&#xA;Successfully wrote the new partition table&#xA;&#xA;Re-reading the partition table ...&#xA;&#xA;Creating the filesystems... &#xA;  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current&#xA;                                 Dload  Upload   Total   Spent    Left  Speed&#xA;100  299k  100  299k    0     0  1524k      0 --:--:-- --:--:-- --:--:-- 5542k&#xA;Read 306504 bytes from sm_bl&#xA;&#xA;  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current&#xA;                                 Dload  Upload   Total   Spent    Left  Speed&#xA;  2  112M    2 3088k    0     0  3505k      0  0:00:32 --:--:--  0:00:32 3869k&#xA;100  112M  100  112M    0     0  8510k      0  0:00:13  0:00:13 --:--:-- 9247k.&#xA;Executing Product Check TLV.&#xA;Executing Version Built TLV.&#xA;Warning: Unknown TLV ignored.&#xA;Warning: Unknown TLV code 8 - ignored.&#xA;Executing init script.&#xA;Executing backup script.&#xA;&#xA;Executing install_bootloader script.&#xA;Writing new RTOS to flash disk.&#xA;Executing install_rtos script.&#xA;Writing new Code to flash disk.&#xA;Executing install_code script.&#xA;Writing new Emergency Bootloader to flash disk.&#xA;Writing new Emergency Bootloader RTOS to flash disk.&#xA;Writing new Emergency Version to flash disk.&#xA;Writing new AP Image Bundle to flash disk.&#xA;Executing fini script.&#xA;&#xA;Install successful on SM1/0. Please wait for module to reset before next operation.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It doesn't make sense to me that it cannot reach my laptop to download the final file after it has already downloaded the kernel and other files from my laptop successfully. On top of that, the WLC package works flawlessly.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2018-09-28T05:22:05.437" Title="Why does the Cisco SRE-V install fail to download the package file?" Tags="|cisco|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5661" PostTypeId="2" ParentId="5660" CreationDate="2013-12-31T20:29:16.900" Score="3" Body="&lt;p&gt;This is caused by the SRE-V 2.0.1 package scripts. The &lt;code&gt;dwnldr_startup.sh&lt;/code&gt; script in this package doesn't support using a different port for the download. While the same script from the WLC package does support using a different port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When switching the HTTP server hosting the files to port 80, the SRE-V 2.0.1 package will install fine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;STARTED: dwnldr_startup.sh&#xA;sre_type=  1&#xA;    Welcome to Cisco Systems Service Engine Helper Software&#xA;userinput=  disk-cfg-mode=raid1&#xA;&#xA;Downloading http sre-v-k9-r.SPA.smv.2.0.1.pkg&#xA;Bytes downloaded :  14001 &#xA;&#xA;Validating package signature ... done&#xA; - Parsing package manifest files... complete.&#xA;No installed manifests found.&#xA; - Checking Package dependencies... complete.&#xA; - Checking Manifest dependencies for subsystems in the install candidate list...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(removed excess output)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EXITED: dwnldr_startup.sh exit status 137&#xA;Process shutdown complete.&#xA;starting_phase:&#xA;install_files.sh /mnt/dwnld/.work_order&#xA;Remove: /mivmdk//dwnld/scripts&#xA;. rbcp_install_status_msg_for&#xA;Install successful on SM1/0. Please wait for module to reset before next operation.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2013-12-31T20:29:16.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5662" PostTypeId="1" AcceptedAnswerId="5663" CreationDate="2013-12-31T20:33:22.247" Score="5" ViewCount="5421" Body="&lt;p&gt;I'm aware that you can use the ASA's URL filtering to filter URLs being accessed with regular expressions, but I'm curious if there is a way to filter which URLs can be accessed from the Internet to an internal webserver if the traffic is encrypted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will want to be able to limit connections to our WepSphere server to specific URL requests. ie: www.websphereyl.com/lawson/myfile and not www.websphereyl.com/lawson/yourfiles etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example scenario would be someone hits our websphere server from the Internet, which has NAT/PAT setup on the ASA to allow it access via TCP port 443. Could we restrict the URLs that can be accessed with the ASA? I'm thinking that URL filtering will not work because it's SSL traffic, but wanted to see what you guys thought.&lt;/p&gt;&#xA;" OwnerUserId="2821" LastEditorUserId="775" LastEditDate="2013-12-31T22:51:50.400" LastActivityDate="2013-12-31T22:51:50.400" Title="https url filtering on Cisco ASA 5520" Tags="|cisco|cisco-asa|firewall|cisco-ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5663" PostTypeId="2" ParentId="5662" CreationDate="2013-12-31T21:22:27.547" Score="7" Body="&lt;p&gt;You are correct, if all the ASA sees is an HTTPS request, then the TCP payload is encrypted, which prevents the ASA's URL filtering (or any other TCP payload inspection).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, url filtering is done by an &lt;a href=&quot;http://en.wikipedia.org/wiki/Reverse_proxy&quot; rel=&quot;nofollow noreferrer&quot;&gt;http reverse-proxy&lt;/a&gt; or &lt;a href=&quot;http://en.wikipedia.org/wiki/Load_balancing_(computing)#Load_balancer_features&quot; rel=&quot;nofollow noreferrer&quot;&gt;load-balancer&lt;/a&gt; (like Cisco's ACE/CSM, F5 LTM, or Citrix Netscaler to name a few).  The devices I mentioned can also offload SSL encryption from your web server pool as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Offloading SSL before you perform payload scrubbing / inspection has some significant advantages.  By off-loading your encryption at a &lt;a href=&quot;http://en.wikipedia.org/wiki/Load_balancing_(computing)#Load_balancer_features&quot; rel=&quot;nofollow noreferrer&quot;&gt;load-balancer&lt;/a&gt;, the &lt;a href=&quot;http://en.wikipedia.org/wiki/Intrusion_detection_system&quot; rel=&quot;nofollow noreferrer&quot;&gt;IDS&lt;/a&gt; / &lt;a href=&quot;http://en.wikipedia.org/wiki/Intrusion_prevention_system&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPS&lt;/a&gt; / Firewall can also see the raw HTTP traffic, which means it can &lt;a href=&quot;https://security.stackexchange.com/q/10483/9185&quot;&gt;spot application-layer attacks&lt;/a&gt; and it generally gives you better protection, if that's a priority.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.953" LastActivityDate="2013-12-31T22:46:23.290" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5665" PostTypeId="2" ParentId="5183" CreationDate="2013-12-31T22:30:33.667" Score="1" Body="&lt;p&gt;Since you said in the comments that the traffic will come back to the firewall that was initially used to send the traffic out to the wan, therefore I assume the firewall is doing some kind of Source NAT, and that's why the traffic will return to the same firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I suggest to connect the two routers with a back-to-back L2 ethernet link, and static routes, and connect each Router to its Firewall directly, so that if traffic exiting to the WAN from Router R1 comes back via R2, then R2 will send the traffic over the back-to-back link to R1, and R1 will forward the return traffic to Firewall FW1, which was used by the traffic when exiting to the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if the firewall is not using NAT, and using dynamic routing protocol instead, then the same can be acheived by a Layer 3 back-to-back ethernte link, i.e. R1 and R2 will exchange routes over the link dynamically, and thus they will forward the returning traffic to the correct firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's how it should look :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WAN1 === R1 === FW1 ===\\&#xA;         ||            SWITCH&#xA;WAN2 === R2 === FW2 ===//&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3716" LastActivityDate="2013-12-31T22:30:33.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5668" PostTypeId="1" AcceptedAnswerId="5669" CreationDate="2014-01-01T13:54:47.477" Score="9" ViewCount="2342" Body="&lt;p&gt;Is it normal to see a path as such in my BGP update ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;12 34 33 2 2 45 331 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I can see from the path above, AS number &quot;2&quot; appears twice ! Is it normal ? Are they any scenarios that could have made this to happen ? Is it an anomaly ? If it's like that, how does routing occur after a packet has reached AS 2 ? will AS 2 forward the traffic to itself again prior sending to 45 ?&lt;/p&gt;&#xA;" OwnerUserId="3722" LastEditorUserId="775" LastEditDate="2014-01-01T15:28:40.950" LastActivityDate="2014-02-07T17:03:04.153" Title="BGP Autonomous System Path Duplicate AS" Tags="|routing|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5669" PostTypeId="2" ParentId="5668" CreationDate="2014-01-01T14:14:30.207" Score="17" Body="&lt;p&gt;Yes, this can be done by BGP and is called AS prepending. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The objective is to change the best route taken by BGP, since the shortest AS path is preferred by BGP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case there might be another path with one AS 2 only, thus BGP will select the other route, not this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example would be a site with 2 WAN links to the internet, if we prepend our AS on one of the links, then hosts from outside of our AS will prefer the other link when sending traffic to us because the see shorter AS path to 2nd link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic is routed normally to to next AS when it reaches AS 2.&lt;/p&gt;&#xA;" OwnerUserId="3716" LastActivityDate="2014-01-01T14:14:30.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5670" PostTypeId="2" ParentId="5657" CreationDate="2014-01-01T16:54:08.530" Score="2" Body="&lt;p&gt;I assume you already have eBGP up and running between you and your transit providers, and that you have only a default route, not the full internet BGP table. I assume also that you and your customer each have a public AS and a public subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I will mention only minimum needed config to enable you advertise your customer AS and subnet, which can apply also for your customer, noting the router model they are using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at  &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Routing/BGP&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Manual:Routing/BGP&lt;/a&gt; and set the following :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;remote-address a.b.c.d &amp;lt;== IP address of customer peer router running BGP with you&#xA;remote-as xxxxx &amp;lt;== customer public AS number&#xA;network x.y.z.0/24 &amp;lt;== any specific subnets from your AS that need to be advertised to your customer&#xA;default-originate always &amp;lt;== provide default route to your customer via BGP (your customer should not use this command on their end)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Again, note that this is a minimum config that will allow you to initiate BGP session with your customer and advertise their AS and subnets to your upstream providers, there are other elements that should be added, e.g. I prefer creating a VRF for the customer on your router, also, you could adjust local-preference or AS prepending in order to select which of your 2 transit providers would be primary preferred by BGP and which would be secondary, among other BGP features.&lt;/p&gt;&#xA;" OwnerUserId="3716" LastActivityDate="2014-01-01T16:54:08.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5675" PostTypeId="1" AcceptedAnswerId="5884" CreationDate="2014-01-02T01:26:47.827" Score="3" ViewCount="266" Body="&lt;p&gt;What is the maximum size &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos/topics/reference/command-summary/load.html&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;load set&lt;/code&gt;&lt;/a&gt; that a Juniper SRX3600, running Junos 11.4R7.5, can load and commit? I am attempting to add a 100,000+ line commit change and do not want to overwhelm the RE and cause node stability issues.&lt;/p&gt;&#xA;" OwnerUserId="3732" LastEditorUserId="3732" LastEditDate="2014-01-03T15:40:40.500" LastActivityDate="2014-01-17T00:00:39.477" Title="Juniper SRX3600 Maximum Load Set Size" Tags="|juniper|juniper-junos|juniper-srx|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5677" PostTypeId="1" CreationDate="2014-01-02T14:44:36.017" Score="2" ViewCount="4381" Body="&lt;p&gt;I have a fortigate 40C running with a PPTP configuration. My VPN works partly. I can connect to the office network, however I can't get the default gateway working. Can anyone help me with figuring out whats wrong with this configuration, please?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;config firewall address&#xA;edit &quot;all&quot;&#xA;next&#xA;edit &quot;Internal_Range&quot;&#xA;set subnet 192.168.6.0 255.255.255.0&#xA;next&#xA;edit &quot;PPTP&quot;&#xA;set associated-interface &quot;wan1&quot;&#xA;set type iprange&#xA;set end-ip 192.168.6.180&#xA;set start-ip 192.168.6.160&#xA;next&#xA;end&#xA;config firewall policy&#xA;edit 1&#xA;set srcintf &quot;internal&quot;&#xA;set dstintf &quot;wan1&quot;&#xA;set srcaddr &quot;all&quot;&#xA;set dstaddr &quot;all&quot;&#xA;set action accept&#xA;set schedule &quot;always&quot;&#xA;set service &quot;ANY&quot;&#xA;set nat enable&#xA;next&#xA;edit 50&#xA;set srcintf &quot;wan1&quot;&#xA;set dstintf &quot;internal&quot;&#xA;set srcaddr &quot;PPTP&quot;&#xA;set dstaddr &quot;all&quot;&#xA;set action accept&#xA;set schedule &quot;always&quot;&#xA;set service &quot;ANY&quot;&#xA;next&#xA;edit 4&#xA;set srcintf &quot;wan1&quot;&#xA;set dstintf &quot;wan1&quot;&#xA;set srcaddr &quot;PPTP&quot;&#xA;set dstaddr &quot;all&quot;&#xA;set action accept&#xA;set schedule &quot;always&quot;&#xA;set service &quot;ANY&quot;&#xA;set nat enable&#xA;next&#xA;end&#xA;config vpn pptp&#xA;set status enable&#xA;set eip 192.168.6.180&#xA;set sip 192.168.6.160&#xA;set usrgrp &quot;Wizard_users&quot;&#xA;end&#xA;config system dhcp server&#xA;edit 1&#xA;set default-gateway 192.168.6.1&#xA;set domain &quot;lan&quot;&#xA;set interface &quot;internal&quot;&#xA;config ip-range&#xA;edit 1&#xA;set end-ip 192.168.6.159&#xA;set start-ip 192.168.6.100&#xA;next&#xA;end&#xA;set lease-time 345600&#xA;set netmask 255.255.255.0&#xA;set dns-server1 192.168.6.1&#xA;next&#xA;end&#xA;config system interface&#xA;edit &quot;wan1&quot;&#xA;set vdom &quot;root&quot;&#xA;set mode pppoe&#xA;set allowaccess ping&#xA;set type physical&#xA;set alias &quot;FTTB Fixed IP&quot;&#xA;set username &quot;X@X&quot;&#xA;set password ENC X&#xA;set defaultgw enable&#xA;set dns-server-override disable&#xA;next&#xA;edit &quot;modem&quot;&#xA;set vdom &quot;root&quot;&#xA;set mode pppoe&#xA;set type physical&#xA;next&#xA;edit &quot;ssl.root&quot;&#xA;set vdom &quot;root&quot;&#xA;set type tunnel&#xA;next&#xA;edit &quot;internal&quot;&#xA;set vdom &quot;root&quot;&#xA;set ip 192.168.6.1 255.255.255.0&#xA;set allowaccess ping https ssh&#xA;set type physical&#xA;set alias &quot;LAN&quot;&#xA;next&#xA;end&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The internal IP range is 192.168.6.0/24. The Fortigate has the IP 192.168.6.1 and is also the DNS Server. The VPN range is 192.168.6.160-180&lt;/p&gt;&#xA;" OwnerUserId="3737" LastActivityDate="2014-01-02T14:44:36.017" Title="Fortigate PPTP default gateway configuration" Tags="|vpn|fortigate|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5678" PostTypeId="1" AcceptedAnswerId="5679" CreationDate="2014-01-02T16:50:05.633" Score="6" ViewCount="3945" Body="&lt;p&gt;I am running OSPF on 2 router in GNS simulation for practice. Adjacencies are ok. Router R2 has in the routing table all networks of R3 . But R3 fails to add R2 network in its routing table . The network that is not participating in ospf is the 172.16.100.0/24 as shown below Any idea why?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**R2**&#xA;Routing Protocol is &quot;ospf 1&quot;&#xA;  Outgoing update filter list for all interfaces is not set&#xA;  Incoming update filter list for all interfaces is not set&#xA;  Router ID 172.168.100.1&#xA;  It is an autonomous system boundary router&#xA;  Redistributing External Routes from,&#xA;    eigrp 1, includes subnets in redistribution&#xA;  Number of areas in this router is 2. 2 normal 0 stub 0 nssa&#xA;  Maximum path: 4&#xA;  Routing for Networks:&#xA;    172.16.23.0 0.0.0.255 area 0&#xA;    172.16.100.0 0.0.0.255 area 10&#xA; Reference bandwidth unit is 100 mbps&#xA;  Routing Information Sources:&#xA;    Gateway         Distance      Last Update&#xA;    192.168.40.1         110      00:14:35&#xA;  Distance: (default is 110)&#xA;&#xA;R2#show run | s ospf&#xA; ip ospf network point-to-point&#xA; redistribute ospf 1 metric 10000 100 255 1 1500&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; redistribute eigrp 1 subnets&#xA; network 172.16.23.0 0.0.0.255 area 0&#xA; network 172.16.100.0 0.0.0.255 area 10&#xA;&#xA;R2#show ip ospf interface&#xA;Serial0/1 is up, line protocol is up&#xA;  Internet Address 172.16.23.2/24, Area 0&#xA;  Process ID 1, Router ID 172.168.100.1, Network Type POINT_TO_POINT, Cost: 64&#xA;  Transmit Delay is 1 sec, State POINT_TO_POINT,&#xA;  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5&#xA;    oob-resync timeout 40&#xA;    Hello due in 00:00:07&#xA;  Supports Link-local Signaling (LLS)&#xA;  Index 1/1, flood queue length 0&#xA;  Next 0x0(0)/0x0(0)&#xA;  Last flood scan length is 1, maximum is 6&#xA;  Last flood scan time is 0 msec, maximum is 0 msec&#xA;  Neighbor Count is 1, Adjacent neighbor count is 1&#xA;    Adjacent with neighbor 192.168.40.1&#xA;  Suppress hello for 0 neighbor(s)&#xA;&#xA;R2#show ip int b&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;FastEthernet0/0            unassigned      YES NVRAM  administratively down down &#xA;Serial0/0                  172.16.12.2     YES NVRAM  up                    up   &#xA;FastEthernet0/1            unassigned      YES NVRAM  administratively down down &#xA;Serial0/1                  172.16.23.2     YES NVRAM  up                    up   &#xA;Loopback0                  172.16.2.1      YES NVRAM  up                    up   &#xA;Loopback100                172.168.100.1   YES manual up                    up&#xA;&#xA;R2#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     192.168.30.0/32 is subnetted, 1 subnets&#xA;O       192.168.30.1 [110/65] via 172.16.23.3, 00:36:47, Serial0/1&#xA;     192.168.25.0/32 is subnetted, 1 subnets&#xA;O       192.168.25.1 [110/65] via 172.16.23.3, 00:36:47, Serial0/1&#xA;     192.168.40.0/32 is subnetted, 1 subnets&#xA;O       192.168.40.1 [110/65] via 172.16.23.3, 00:36:47, Serial0/1&#xA;     172.168.0.0/24 is subnetted, 1 subnets&#xA;C       172.168.100.0 is directly connected, Loopback100&#xA;     172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks&#xA;C       172.16.23.0/24 is directly connected, Serial0/1&#xA;C       172.16.12.0/24 is directly connected, Serial0/0&#xA;D       172.16.1.0/24 [90/2297856] via 172.16.12.1, 01:06:07, Serial0/0&#xA;O       172.16.3.1/32 [110/65] via 172.16.23.3, 00:36:48, Serial0/1&#xA;C       172.16.2.0/24 is directly connected, Loopback0&#xA;     192.168.20.0/32 is subnetted, 1 subnets&#xA;O       192.168.20.1 [110/65] via 172.16.23.3, 00:36:49, Serial0/1&#xA;D    192.168.51.0/24 [90/2297856] via 172.16.12.1, 01:06:08, Serial0/0&#xA;D    192.168.50.0/24 [90/2297856] via 172.16.12.1, 01:06:08, Serial0/0&#xA;     192.168.35.0/32 is subnetted, 1 subnets&#xA;O       192.168.35.1 [110/65] via 172.16.23.3, 00:36:49, Serial0/1&#xA;D    192.168.70.0/24 [90/2297856] via 172.16.12.1, 01:06:08, Serial0/0&#xA;O IA 192.168.8.0/22 [110/65] via 172.16.23.3, 00:36:49, Serial0/1&#xA;D    192.168.48.0/23 [90/2297856] via 172.16.12.1, 01:06:08, Serial0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&quot;HERE the interface loopback 100 does not appear , i added it using network command&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**R3**&#xA;Routing Protocol is &quot;ospf 1&quot;&#xA;  Outgoing update filter list for all interfaces is not set&#xA;  Incoming update filter list for all interfaces is not set&#xA;  Router ID 192.168.40.1&#xA;  It is an area border router&#xA;  Number of areas in this router is 2. 2 normal 0 stub 0 nssa&#xA;  Maximum path: 4&#xA;  Routing for Networks:&#xA;    172.16.3.0 0.0.0.255 area 0&#xA;    172.16.23.0 0.0.0.255 area 0&#xA;    192.168.8.0 0.0.0.255 area 20&#xA;    192.168.9.0 0.0.0.255 area 20&#xA;    192.168.10.0 0.0.0.255 area 20&#xA;    192.168.11.0 0.0.0.255 area 20&#xA;    192.168.20.0 0.0.0.255 area 0&#xA;    192.168.25.0 0.0.0.255 area 0&#xA;    192.168.30.0 0.0.0.255 area 0&#xA;    192.168.35.0 0.0.0.255 area 0&#xA;    192.168.40.0 0.0.0.255 area 0&#xA; Reference bandwidth unit is 100 mbps&#xA;  Routing Information Sources:&#xA;    Gateway         Distance      Last Update&#xA;    (this router)        110      00:35:11&#xA;    Gateway         Distance      Last Update&#xA;    172.168.100.1        110      00:15:09&#xA;    172.16.2.1           110      02:03:26&#xA;  Distance: (default is 110)&#xA;&#xA;R3#show run | s ospf&#xA; ip ospf network point-to-point&#xA; ip ospf network point-to-point&#xA; ip ospf network point-to-point&#xA; ip ospf network point-to-point&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; area 20 range 192.168.8.0 255.255.252.0&#xA; network 172.16.3.0 0.0.0.255 area 0&#xA; network 172.16.23.0 0.0.0.255 area 0&#xA; network 192.168.8.0 0.0.0.255 area 20&#xA; network 192.168.9.0 0.0.0.255 area 20&#xA; network 192.168.10.0 0.0.0.255 area 20&#xA; network 192.168.11.0 0.0.0.255 area 20&#xA; network 192.168.20.0 0.0.0.255 area 0&#xA; network 192.168.25.0 0.0.0.255 area 0&#xA; network 192.168.30.0 0.0.0.255 area 0&#xA; network 192.168.35.0 0.0.0.255 area 0&#xA; network 192.168.40.0 0.0.0.255 area 0&#xA;&#xA;R3#show ip ospf interface&#xA;Loopback40 is up, line protocol is up&#xA;  Internet Address 192.168.40.1/24, Area 0&#xA;  Process ID 1, Router ID 192.168.40.1, Network Type LOOPBACK, Cost: 1&#xA;  Loopback interface is treated as a stub Host&#xA;Loopback35 is up, line protocol is up&#xA;  Internet Address 192.168.35.1/24, Area 0&#xA;  Process ID 1, Router ID 192.168.40.1, Network Type LOOPBACK, Cost: 1&#xA;  Loopback interface is treated as a stub Host&#xA;Loopback30 is up, line protocol is up&#xA;  Internet Address 192.168.30.1/24, Area 0&#xA;  Process ID 1, Router ID 192.168.40.1, Network Type LOOPBACK, Cost: 1&#xA;  Loopback interface is treated as a stub Host&#xA;Loopback25 is up, line protocol is up&#xA;  Internet Address 192.168.25.1/24, Area 0&#xA;  Process ID 1, Router ID 192.168.40.1, Network Type LOOPBACK, Cost: 1&#xA;  Loopback interface is treated as a stub Host&#xA;Loopback20 is up, line protocol is up&#xA;  Internet Address 192.168.20.1/24, Area 0&#xA;  Process ID 1, Router ID 192.168.40.1, Network Type LOOPBACK, Cost: 1&#xA;  Loopback interface is treated as a stub Host&#xA;&#xA;&#xA;R3#show ip int b&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;FastEthernet0/0            unassigned      YES NVRAM  administratively down down&#xA;Serial0/0                  172.16.23.3     YES NVRAM  up                    up&#xA;FastEthernet0/1            unassigned      YES NVRAM  administratively down down&#xA;Serial0/1                  unassigned      YES NVRAM  administratively down down&#xA;Loopback0                  172.16.3.1      YES NVRAM  up                    up&#xA;Loopback8                  192.168.8.1     YES manual up                    up&#xA;Loopback9                  192.168.9.1     YES manual up                    up&#xA;Loopback10                 192.168.10.1    YES manual up                    up&#xA;Loopback11                 192.168.11.1    YES manual up                    up&#xA;Loopback20                 192.168.20.1    YES NVRAM  up                    up&#xA;Loopback25                 192.168.25.1    YES NVRAM  up                    up&#xA;Loopback30                 192.168.30.1    YES NVRAM  up                    up&#xA;Loopback35                 192.168.35.1    YES NVRAM  up                    up&#xA;Loopback40                 192.168.40.1    YES NVRAM  up                    up&#xA;&#xA;R3#show ip route eigrp&#xA;&#xA;R3#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;C    192.168.30.0/24 is directly connected, Loopback30&#xA;C    192.168.8.0/24 is directly connected, Loopback8&#xA;C    192.168.25.0/24 is directly connected, Loopback25&#xA;C    192.168.9.0/24 is directly connected, Loopback9&#xA;C    192.168.10.0/24 is directly connected, Loopback10&#xA;C    192.168.40.0/24 is directly connected, Loopback40&#xA;     172.16.0.0/24 is subnetted, 5 subnets&#xA;C       172.16.23.0 is directly connected, Serial0/0&#xA;O E2    172.16.12.0 [110/20] via 172.16.23.2, 00:35:47, Serial0/0&#xA;O E2    172.16.1.0 [110/20] via 172.16.23.2, 00:35:49, Serial0/0&#xA;O E2    172.16.2.0 [110/20] via 172.16.23.2, 00:35:49, Serial0/0&#xA;C       172.16.3.0 is directly connected, Loopback0&#xA;C    192.168.11.0/24 is directly connected, Loopback11&#xA;C    192.168.20.0/24 is directly connected, Loopback20&#xA;O E2 192.168.51.0/24 [110/20] via 172.16.23.2, 00:35:50, Serial0/0&#xA;O E2 192.168.50.0/24 [110/20] via 172.16.23.2, 00:35:50, Serial0/0&#xA;C    192.168.35.0/24 is directly connected, Loopback35&#xA;O E2 192.168.70.0/24 [110/20] via 172.16.23.2, 00:35:50, Serial0/0&#xA;O    192.168.8.0/22 is a summary, 00:55:56, Null0&#xA;O E2 192.168.48.0/23 [110/20] via 172.16.23.2, 00:35:50, Serial0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3280" LastEditorUserId="3210" LastEditDate="2014-01-02T17:53:46.533" LastActivityDate="2014-01-02T18:00:49.310" Title="Network not participating in OSPF. Does not appear in the routing table" Tags="|cisco|routing|ospf|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="5679" PostTypeId="2" ParentId="5678" CreationDate="2014-01-02T17:41:25.173" Score="12" Body="&lt;p&gt;Your loopback 100 address is 172.168.100.0/24, but your network statement is 172.16.100.0/24, so Loopback 100 is not in the OSPF domain.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-02T17:41:25.173" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5682" PostTypeId="1" AcceptedAnswerId="8128" CreationDate="2014-01-02T21:10:54.110" Score="8" ViewCount="1376" Body="&lt;p&gt;We have several BX SFPs in my network and I love them.  We're limited on the amount of fiber we can get between buildings (each pair costs $250/month) so the mismatched laser solution gives us redundancy and extra bandwidth all at once.  For the uninitiated, the BX solution consists of one 1310nm laser on one end and a 1490nm laser on the other with a special mirror in the SFP that allows both frequencies to traverse one strand of fiber at a time enabling bidirectional communication on a single strand of fiber instead of the usual fiber pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that as our network grows, so do our bandwidth requirements, particularly for a couple of data centers that aren't at the core of our network.  Is there any reason why there aren't any BX 10Gig SFP+ modules around?  I can't seem to find any, at least.  Is there a downside to using BX-style single-strand connections?  I mean, at least you don't have to worry as much about UDLD, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a similar technology for 10Gig that I'm not aware of?&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-05-28T17:17:55.327" Title="10Gig over single strand fiber" Tags="|switch|fiber|redundancy|10gbase|sfp|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5683" PostTypeId="1" AcceptedAnswerId="5706" CreationDate="2014-01-02T21:57:36.593" Score="2" ViewCount="204" Body="&lt;p&gt;I'm attempting to &lt;a href=&quot;http://mbrownnyc.wordpress.com/2013/12/31/a-more-effective-monitoring-architecture/&quot; rel=&quot;nofollow&quot;&gt;utilize the flow probe &lt;code&gt;argus&lt;/code&gt; to determine &quot;node liveliness&quot;/reachability&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently working on handling ICMP status, but would like to derive a method to determine if a ping &quot;would be expected&quot; to timeout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question isn't relevant to &lt;code&gt;argus&lt;/code&gt; necessarily:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the circumstances where a node that &lt;code&gt;pings&lt;/code&gt; another node will receive no data back?  Is it only when a client &quot;timeout&quot; would be expected to occur?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware that ICMP messages will be sent without an ICMP message coming in to a node, if there are a variety of problems reaching the node.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Update]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By &quot;no data back&quot;, I mean 0 bytes returned, not just ICMP bytes.  No bytes at all.  And please discount the idea of throttling or firewall policies changing, as this would cause a timeout, and be a good &quot;bad response&quot; that I'm trying to detect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ra -S 127.0.0.1:561 -s ltime saddr daddr dport sport sbytes dbytes flgs state - icmp&lt;/code&gt; (&lt;a href=&quot;http://qosient.com/argus/man/man1/ra.1.pdf&quot; rel=&quot;nofollow&quot;&gt;man page&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;              LastTime            SrcAddr            DstAddr  Dport  Sport     SrcBytes     DstBytes      Flgs State&#xA;&#xA;2014-01-02 16:56:17.563848      192.168.1.31       192.168.2.22.0x21f9 0x0008           98            0  e          ECO&#xA;2014-01-02 16:56:18.624553      192.168.1.31      192.168.2.252.0x21e6 0x0008           98           98  e          ECO&#xA;2014-01-02 16:56:18.724784      192.168.1.31        192.168.2.1.0x21eb 0x0008           98           98  e          ECO&#xA;2014-01-02 16:56:18.482095      192.168.1.31       192.168.2.10.0x21ef 0x0008           98            0  e          ECO&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;192.168.1.31&lt;/code&gt; sent a ping with &lt;a href=&quot;https://github.com/tokkee/nagiosplug/blob/master/plugins/check_ping.c&quot; rel=&quot;nofollow&quot;&gt;check_ping.c&lt;/a&gt;, a nagios plugin.  &lt;code&gt;check-ping&lt;/code&gt; is used to send a single ICMP ECHO packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;192.168.2.22&lt;/code&gt; and &lt;code&gt;192.168.2.10&lt;/code&gt; replied with &lt;code&gt;0&lt;/code&gt; bytes.  This should never happen, and usually doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;check-ping&lt;/code&gt; is used to send a single ICMP ECHO packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to check for timeouts/unreachability of nodes, I am verifying that checking &lt;code&gt;dbytes&lt;/code&gt; for 0 length is my best condition.&lt;/p&gt;&#xA;" OwnerUserId="968" LastEditorUserId="968" LastEditDate="2014-01-03T15:11:18.983" LastActivityDate="2014-01-04T03:39:29.080" Title="Is there ever a scenario where there would be a 0 length response to an ECHO?" Tags="|netflow|icmp|ping|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5684" PostTypeId="2" ParentId="5682" CreationDate="2014-01-02T22:24:25.183" Score="12" Body="&lt;p&gt;Have you looked at using a separate external mux? I've run parts of our rings on pairings of ordinary (but colored) 10G optics and passive CWDM muxes with a single strand on each side. This let us also do multiple parallel links at the same time (we used 8 channel muxes).&lt;/p&gt;&#xA;" OwnerUserId="306" LastActivityDate="2014-01-02T22:24:25.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5690" PostTypeId="1" AcceptedAnswerId="5692" CreationDate="2014-01-03T08:48:37.343" Score="4" ViewCount="2483" Body="&lt;p&gt;I am currently studying for my CCNA exam and I am stuck at the concept of DLCIs in a network using frame relay encapsulation. This may be because I am a non native english speaker and misinterpret the material I have got. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the text in question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;VCs provide a bidirectional communication path from one device to&#xA;  another. VCs are identified by DLCIs, as shown in Figure 2. DLCI&#xA;  values typically are assigned by the Frame Relay service provider.&#xA;  Frame Relay DLCIs have local significance, which means that the values&#xA;  themselves are not unique in the Frame Relay WAN. A DLCI identifies a&#xA;  VC to the equipment at an endpoint. A DLCI has no significance beyond&#xA;  the single link. Two devices connected by a VC may use a different&#xA;  DLCI value to refer to the same connection.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Locally significant DLCIs have become the primary method of&#xA;  addressing, because the same address can be used in several different&#xA;  locations while still referring to different connections. Local&#xA;  addressing prevents a customer from running out of DLCIs as the&#xA;  network grows.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which has a picture for reference:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/HTKOb.jpg&quot; alt=&quot;frame relay&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VC (virtual circuit) spans from the Sending node (DLCI 102) to the receiving node (DLCI 201). It then states that DLCIs have 'local significance', and are not unique in the Frame Relay WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Since a DLCI is local, what device is meant by 'endpoint'?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Does a DLCI(102) define a link from &lt;code&gt;Sending Node&lt;/code&gt; to &lt;code&gt;Device A&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;li&gt;Does a DLCI(102) define the link from &lt;code&gt;Sending Node&lt;/code&gt; to &lt;code&gt;Receiving Node&lt;/code&gt; (SN -&gt; A -&gt; B -&gt; C-&gt; D -&gt; Receiving Node) ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In the end it boils down to: Is the single link mentioned in the text, the single physical line between the router and the switch or the line between the 2 ultimate endpoints?&lt;/p&gt;&#xA;" OwnerUserId="3746" LastEditorUserId="775" LastEditDate="2014-01-03T11:31:32.130" LastActivityDate="2014-01-03T20:29:02.817" Title="Frame Relay 'local significance' of a DLCI" Tags="|cisco|frame-relay|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5692" PostTypeId="2" ParentId="5690" CreationDate="2014-01-03T10:32:51.947" Score="2" Body="&lt;p&gt;Your first answer is the right one, DLCI (102) define a link from Sending Node to Device A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without local significance, then every customer FR PVC will need to have the same DLCI ID value at both endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, assume we are connecting a new customer, what if a DLCI is available on one switch, but the same DLCI is already taken on the 2nd switch by another customer ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without local significance, the provider will have to check all the available matching DLCI Pairs on both endpoint switches to connect any new customer, and might not even available matching DLCIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With local significance, the provider will just connect the PVC using any free DLCI on the the 1st switch, and any free DLCI on the 2nd switch, even if they do not match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note also that the DLCI ID is locally significant to each FR Port on the switch, i.e. DLCI 102 can be used on more than one FR Port on the same switch.&lt;/p&gt;&#xA;" OwnerUserId="3716" LastEditorUserId="3716" LastEditDate="2014-01-03T10:40:04.907" LastActivityDate="2014-01-03T10:40:04.907" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5699" PostTypeId="2" ParentId="5690" CreationDate="2014-01-03T20:21:00.670" Score="2" Body="&lt;p&gt;&quot;local significance&quot; simply means a DLCI (number) is only unique &lt;em&gt;per hop&lt;/em&gt;.  For example, DLCI 16 on my link is not the same DLCI 16 on your link, even from the same switch.  Put another way, DLCI 16 is not a global reference across the entire frame network, or even a single frame switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, DLCI 102 defines the link between SN and A.  Likewise 201 is only between RN and D.  How the VC traverses the Frame WAN &lt;em&gt;is our of scope&lt;/em&gt;. (unless you're building that WAN you don't need to know.)  From either end, the DLCI may not be 102 and 201. (imagine both ends being 16, from each end, the other is not 16.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-01-03T20:29:02.817" LastActivityDate="2014-01-03T20:29:02.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5700" PostTypeId="1" AcceptedAnswerId="5703" CreationDate="2014-01-03T20:58:54.063" Score="10" ViewCount="23475" Body="&lt;p&gt;For what purpose would one wish to send traceroute over TCP rather than UDP? What advantages/disadvantages are there in doing so? I know that traceroute normally uses UDP ICMP &quot;echo&quot; packets while traceroute with TCP uses &quot;SYN&quot; packets from its 3-way handshake, but I'm curious as to why one might be better than the other. If it depends on the situation, then what are those situations?&lt;/p&gt;&#xA;" OwnerUserId="1453" LastEditorUserId="775" LastEditDate="2014-01-03T21:39:08.933" LastActivityDate="2016-11-13T10:51:16.770" Title="Traceroute Over TCP vs UDP" Tags="|tcp|icmp|traceroute|udp|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5701" PostTypeId="2" ParentId="5641" CreationDate="2014-01-03T21:43:38.187" Score="1" Body="&lt;p&gt;If there is no 802.1x, port-security or other network access control configurations on this switch, then either someone did not understand the purpose of this command, or it was left over from a previous configuration.  I have often seen people replace/move/'borrow'/etc. switches in enterprise networks where they do not wipe out the old config and just apply the config from the switch that is being replaced.  In those scenarios you end up with all sorts of extra configuration, like have a bunch of 'switchport trunk' config on a port that was changed to an access port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also depending on the configuration of the APs and the WLC, the underlying switch never sees any client traffic, as it is all being encapsulated back to the controller.  So the only MAC addresses that the switch sees in that case are the MAC addresses of the APs and the WLC interface that they are tunneling the traffic to.&lt;/p&gt;&#xA;" OwnerUserId="3651" LastActivityDate="2014-01-03T21:43:38.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5702" PostTypeId="1" CreationDate="2014-01-03T21:44:18.820" Score="3" ViewCount="30542" Body="&lt;p&gt;I need to test an application which drops a user-specified percentage of packets. Right now, it will drop any packet type which I can easily verify by sending pings and observing the ICMP messages in Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to enhance it so the user can specify that they only want to drop 20% of UDP packets for example, but I don't know how to send a controlled amount of UDP packets so as to test this. I'm only asking to send UDP for now. There are no constraints on transmit rate. I already have other traffic coming from OSPF hello messages and can also use ICMP traffic from pings to see that only the entered percentage of the specified protocol is dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I use free tools to test UDP packet drops as-described above, using a Linux machine?&lt;/p&gt;&#xA;" OwnerUserId="1453" LastEditorUserId="509" LastEditDate="2014-01-08T20:17:48.973" LastActivityDate="2014-01-09T17:50:01.550" Title="Sending generic UDP traffic for Network Simulation" Tags="|tcp|testing|udp|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5703" PostTypeId="2" ParentId="5700" CreationDate="2014-01-03T22:01:14.997" Score="19" Body="&lt;p&gt;There's no such thing as &quot;&lt;em&gt;UDP ICMP &quot;echo&quot;&lt;/em&gt;&quot;.  traceroute sends a UDP &lt;em&gt;probe&lt;/em&gt; with an increasing TTL. That probe is a single datagram destined for a high port which is unlikely to be a listening service. As the datagram flows out across the network, the TTL decrements until it hits zero at which point an ICMP ERROR (&quot;time exceeded&quot;) is generated.  That ICMP message identifies a &quot;hop&quot;. When the TTL is enough to reach the target, as there's no listener on that port, an ICMP &quot;port unreachable&quot; error is generated, thus ending the trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of &lt;code&gt;tcptraceroute&lt;/code&gt; is to do the same sort of path check with a TCP connection.  It is most useful in diagnosing connection issues to a specific service. (eg. a web server) As the probes look like a normal TCP connection attempt, they'll go through NAT, firewalls, ACLs, rate-limits, etc. exactly as a connection from the intended application.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-01-03T22:01:14.997" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5704" PostTypeId="2" ParentId="3253" CreationDate="2014-01-03T22:33:53.663" Score="2" Body="&lt;p&gt;Without some level of administrative privilege, the short answer is that this is not possible with any degree of accuracy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you pointed out, using ping time and or packet loss is dubious at best.  You cannot account for where the latency/loss is being introduced, so it is at best a very shaky guess without having some knowledge of the network architecture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything else that has been suggested, looking at MAC forwarding tables, wireless associations, etc. all require privileges, i.e. administrative control of the device, and some of them are still subject to pitfalls (AP to controller tunneling, unmanaged switches/hubs, etc.) that require you to have additional information about the network to reliably interpret you results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 2 discovery protocols (LLDP, CDP, etc.) for the most part only broadcast information about themselves to the network, so you would still need some level of administrative control to be able to see the received LLDP information at a given point in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you best bet of walking into a completely uncontrolled environment and determining this would be sniffing the wireless communications, but you have ruled that out as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So no, without some special privileges, this is not possible.&lt;/p&gt;&#xA;" OwnerUserId="3651" LastActivityDate="2014-01-03T22:33:53.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5706" PostTypeId="2" ParentId="5683" CreationDate="2014-01-04T03:39:29.080" Score="4" Body="&lt;p&gt;If you send a echo request and get nothing back, there are three possible reasons:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Your echo request didn't reach the target, because of a network failure, congestion, filtering or some combination.  &lt;/li&gt;&#xA;&lt;li&gt;The request reached the target, but the target couldn't respond because of a failure or misconfiguration of the target itself.   &lt;/li&gt;&#xA;&lt;li&gt;The echo reply didn't get back to  you due to a network failure, congestion or filtering.  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To answer your question more directly, it is up to you, the sender, to decide what to call this condition.  You can call it a 'timeout,' 'polling failure,' 'Device down' or something else.  If you're looking for a diagnosis, you can't tell from just a lack of one ping response where the problem lies.  You will need more information.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-04T03:39:29.080" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5707" PostTypeId="1" AcceptedAnswerId="5708" CreationDate="2014-01-04T05:11:04.597" Score="4" ViewCount="9330" Body="&lt;p&gt;We just purchased a cisco 3825 router running IOS 15.1. The slice of the&#xA;topology in question is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            RTP (8000-20000)            RTP (8000-20000)&#xA;192.168.2.1 &amp;lt;--------------&amp;gt; 192.168.2.5 &amp;lt;----------&amp;gt; 192.168.2.10&#xA;   (Router)                  (SIP Proxy)             (Media Server)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What we are trying to accomplish is to have the UDP range 8000-20000 forwarded&#xA;from the net to our SIP proxy 192.168.2.5. Also, our SIP proxy forwards&#xA;RTP traffic in the same range to our media server 192.168.2.10. The links&#xA;between the different servers, and the outside world are bi-directional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scouring the net there are some mixed reports on whether UDP port&#xA;forwarding using a range is possible. Can we please have a definitive answer if the following will work in getting RTP traffic to 192.168.2.5:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat pool voip-rtp 192.168.2.5 192.168.2.5 netmask 255.255.255.0 type rotary&#xA;ip nat inside destination list 114 pool voip-rtp&#xA;ip route 0.0.0.0 0.0.0.0 Dialer0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, will we need another rule for the internal routing of RTP traffic (ie, 192.168.2.5&amp;lt;----&gt;192.168.2.10)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update - Working Route Map for SIP RTP UDP Range&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 130 permit udp any any range 8000 20000&#xA;route-map voip-rtp permit 1&#xA;match ip address 130&#xA;ip nat inside source static &amp;lt;private ip&amp;gt; &amp;lt;public ip&amp;gt; route-map voip-rtp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3706" LastEditorUserId="3706" LastEditDate="2014-01-06T15:03:05.003" LastActivityDate="2014-01-06T15:03:05.003" Title="UDP Port Forwarding Range" Tags="|cisco|nat|voip|udp|sip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5708" PostTypeId="2" ParentId="5707" CreationDate="2014-01-04T08:37:26.923" Score="2" Body="&lt;p&gt;Try using a route map in the nat statement instead of the extended access list 114.  The route map will match the extended access list 114.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Route-maps enable you to match traffic using source ip, destination ip, and tcp/udp ports, interfaces, etc ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You define your criteria in the extended access-list 114 (I see it's already configured in your question).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you configure :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map RR permit 10&#xA;match ip address 114&#xA;&#xA;ip nat inside destination route-map RR pool voip-rtp &amp;lt;&amp;lt; replace your nat with this&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More details and configuration examples for NAT with route-maps in : &#xA;&lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=174107&amp;amp;seqNum=5&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscopress.com/articles/article.asp?p=174107&amp;amp;seqNum=5&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3716" LastEditorUserId="3716" LastEditDate="2014-01-04T20:23:55.863" LastActivityDate="2014-01-04T20:23:55.863" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5710" PostTypeId="1" AcceptedAnswerId="5711" CreationDate="2014-01-04T09:54:14.000" Score="8" ViewCount="8085" Body="&lt;ul&gt;&#xA;&lt;li&gt;Topology: modem with router and Ethernet LAN bridge &amp;lt;---&gt; server having one NIC.&lt;/li&gt;&#xA;&lt;li&gt;Server network interface: It is capable of handling more than one IPv4 address. All addresses are within the same subnetwork.&lt;/li&gt;&#xA;&lt;li&gt;Modem: Does the routing service and nothing else. Itself has one address for both WAN and LAN, also within the subnetwork.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Will there be an address conflict or will the ARP table have more than one IP, but always the same MAC address? We did encounter packet loss or host unreachability. The modem's ARP table did contain all addresses apart from its own, all associated with the same MAC.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2014-01-05T00:46:51.900" Title="Is it possible to use single MAC address for multiple IPv4 addresses?" Tags="|ipv4|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5711" PostTypeId="2" ParentId="5710" CreationDate="2014-01-04T10:04:03.837" Score="17" Body="&lt;p&gt;Putting multiple IP addresses on a single interface (and thus a single MAC address) is quite common for servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: if a server has multiple roles and services running on it, it might be a good idea to give each role/service its own IP address. When you later want to move a role/service to a different machine you can do so without disrupting the other roles/services on the first server.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-01-04T10:04:03.837" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5717" PostTypeId="2" ParentId="5368" CreationDate="2014-01-04T21:35:18.567" Score="2" Body="&lt;p&gt;After Site 2 opens the VPN tunnel it should be assigned an IP, e.g. 10.10.10.2, and a route should appear on the router (acting as VPN Server) pointing to this IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use Destination NAT instead of policy routing, by matching all traffic whose destination is the public IP X.Y.Z.W, and that are incoming only from the router LAN Interface, and NATTing the destination to 10.10.10.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will route all traffic going to Site 2 through the VPN tunnel automatically, and it will hit the public host.&lt;/p&gt;&#xA;" OwnerUserId="3716" LastEditorUserId="3716" LastEditDate="2014-01-07T10:43:40.373" LastActivityDate="2014-01-07T10:43:40.373" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5720" PostTypeId="2" ParentId="5700" CreationDate="2014-01-05T12:43:15.827" Score="6" Body="&lt;p&gt;Tcp traceroutes could be used to test for access lists blocking a given protocol on routers, firewalls or intrusion prevention systems.  Both good guys and bad guys have an interest in such knowledge.  Tools such as tcptraceroute are common in a penetration testers toolbox and might be found on a savvy network administrators system.&lt;/p&gt;&#xA;" OwnerUserId="3756" LastActivityDate="2014-01-05T12:43:15.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5721" PostTypeId="2" ParentId="5682" CreationDate="2014-01-05T13:57:33.597" Score="6" Body="&lt;p&gt;A passive &lt;a href=&quot;http://en.wikipedia.org/wiki/Wavelength-division_multiplexing&quot;&gt;wavelength-division multiplexer&lt;/a&gt;, such as a CWDM or DWDM mux, would probably be your best bet; this is how Service providers supply fiber especially longer distances from their local Hub site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is probably a larger investment upfront but it would also allow you to get more out of your existing leased fibers.  This is also assuming that your lease fibers are on piece of glass and are not muxed already.&lt;/p&gt;&#xA;" OwnerUserId="3772" LastEditorUserId="775" LastEditDate="2014-01-05T14:05:31.440" LastActivityDate="2014-01-05T14:05:31.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5723" PostTypeId="1" CreationDate="2014-01-06T00:09:17.573" Score="2" ViewCount="1438" Body="&lt;p&gt;I am having a problem setting up OSPF between a Juniper Netscreen SSG5's &quot;Untrust&quot; zone and a Cisco router in a lab environment. The state does not transition past EXSTART until the Netscreen device's interface is placed into the &quot;Trust&quot; zone. The below configuration is exactly as entered after clearing all configuration on both devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GNS3 emulated Cisco 3640 with IOS 12.4(23)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure terminal&#xA;interface fastethernet0/0&#xA;ip address 172.16.1.1 255.255.255.252&#xA;no shutdown&#xA;router ospf 1&#xA;network 172.16.1.1 0.0.0.0 area 1&#xA;default-info originate always&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Juniper SSG5 with ScreenOS 6.2.0r5.0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interface ethernet0/0 ip 172.16.1.2 255.255.255.252&#xA;set vrouter trust-vr protocol ospf&#xA;set vrouter trust-vr protocol ospf enable&#xA;set vrouter trust-vr protocol ospf area 1&#xA;set interface ethernet0/0 protocol ospf area 1&#xA;set interface ethernet0/0 protocol ospf enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once these commands are entered, issuing this command on the Netscreen &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; get vrouter trust-vr protocol ospf neighbor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;results in&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            Neighbor(s) on interface ethernet0/0 (Area 0.0.0.1)&#xA;IpAddr/IfIndex  RouterId        Pri State    Opt  Up           StateChg&#xA;------------------------------------------------------------------------------&#xA;172.16.1.1      172.16.1.1        1 ExStart  E    00:01:26     (+4 -0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the Cisco&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip ospf neighbor&#xA;&#xA;Neighbor ID     Pri   State           Dead Time   Address         Interface&#xA;172.16.1.2        1   EXCHANGE/BDR    00:00:38    172.16.1.2      FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As soon as I enter the following command on the Netscreen, the state transitions to FULL&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interface ethernet0/0 zone Trust&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the debug output on the Cisco&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debug ip ospf adj&#xA;&#xA;*Mar  1 00:02:18.971: OSPF: 2 Way Communication to 172.16.1.2 on FastEthernet0/0, state 2WAY&#xA;*Mar  1 00:02:18.971: OSPF: Backup seen Event before WAIT timer on FastEthernet0/0&#xA;*Mar  1 00:02:18.971: OSPF: DR/BDR election on FastEthernet0/0&#xA;*Mar  1 00:02:18.971: OSPF: Elect BDR 172.16.1.1&#xA;*Mar  1 00:02:18.971: OSPF: Elect DR 172.16.1.2&#xA;*Mar  1 00:02:18.971: OSPF: Elect BDR 172.16.1.1&#xA;*Mar  1 00:02:18.971: OSPF: Elect DR 172.16.1.2&#xA;                             DR: 172.16.1.2 (Id)   BDR: 172.16.1.1 (Id)&#xA;*Mar  1 00:02:18.971: OSPF: Send DBD to 172.16.1.2 on FastEthernet0/0 seq 0x2212 opt 0x52 flag 0x7 len 32&#xA;*Mar  1 00:02:23.971: OSPF: Send DBD to 172.16.1.2 on FastEthernet0/0 seq 0x2212 opt 0x52 flag 0x7 len 32&#xA;*Mar  1 00:02:23.971: OSPF: Retransmitting DBD to 172.16.1.2 on FastEthernet0/0 [1]&#xA;*Mar  1 00:02:24.003: OSPF: Rcv DBD from 172.16.1.2 on FastEthernet0/0 seq 0x436 opt 0x2 flag 0x7 len 32  mtu 1500 state EXSTART&#xA;*Mar  1 00:02:24.003: OSPF: NBR Negotiation Done. We are the SLAVE&#xA;*Mar  1 00:02:24.003: OSPF: Send DBD to 172.16.1.2 on FastEthernet0/0 seq 0x436 opt 0x52 flag 0x2 len 72&#xA;*Mar  1 00:02:24.003: OSPF: Rcv DBD from 172.16.1.2 on FastEthernet0/0 seq 0x436 opt 0x2 flag 0x7 len 32  mtu 1500 state EXCHANGE&#xA;(last two lines repeat indefinitely)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't think it is an MTU mismatch, both devices are set to 1500. And, like I said, it works once the Netscreen interface is placed into the &quot;Trust&quot; zone. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entering the following on the Netscreen doesn't appear to change anything.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set policy default-permit-all &#xA;unset policy 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A Wireshark capture shows a flurry of ICMP TTL exceeded packets from the Netscreen to the Cisco when the Netscreen interface is in the &quot;Untrust&quot; zone. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what it's worth, iBGP works in the &quot;Untrust&quot; zone.&lt;/p&gt;&#xA;" OwnerUserId="3780" LastEditorUserId="3780" LastEditDate="2014-01-06T02:36:01.307" LastActivityDate="2014-04-06T22:07:11.117" Title="Juniper Netscreen: OSPF in Untrust zone" Tags="|ospf|screenos|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5724" PostTypeId="1" AcceptedAnswerId="5728" CreationDate="2014-01-06T02:42:33.237" Score="8" ViewCount="2719" Body="&lt;p&gt;We have been struggling with this for a few weeks now. CISCO 3825&#xA;(15.1 IOS) with properly established PPPoE (ie can ping the net&#xA;from inside the cli).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem we are having is that the client's cannot ping the outside&#xA;world. I have the client connected directly to the router, and am having&#xA;no luck getting to the net. The config:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Updated Config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; media-type rj45&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 1&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip broadcast-address 192.168.2.255&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; media-type rj45&#xA; no cdp enable&#xA;!&#xA;interface Dialer0&#xA; ip address negotiated&#xA; ip mtu 1492&#xA; ip flow ingress&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; encapsulation ppp&#xA; ip route-cache policy&#xA; dialer pool 1&#xA; ppp authentication pap callin&#xA; ppp pap sent-username nonya@domain.local password 0 foobarme&#xA; ppp ipcp dns request accept&#xA; ppp ipcp route default&#xA; ppp ipcp address accept&#xA; no cdp enable&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!         &#xA;ip nat inside source list 1 interface Dialer0 overload&#xA;ip route 0.0.0.0 0.0.0.0 Dialer0&#xA;!&#xA;no cdp run&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ppoe establishes perfectly. Both interfaces are up/up however, just&#xA;can't ping the internet using a directly connected client. No dhcp, the&#xA;clients have static ip addresses&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure this question has been answered, but nothing I have read has&#xA;been able to get me up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to note is that f0/1 has a bcast of 255.255.255.255. The client&#xA;interface is set to 192.168.2.255. Could this be the problem? I need to&#xA;minimize downtime as much as possible, and really appreciate your help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Brief&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface                  IP-Address      OK? Method Status                Protocol&#xA;GigabitEthernet0/0         unassigned      YES NVRAM  up                    up      &#xA;GigabitEthernet0/1         192.168.2.1     YES NVRAM  up                    up      &#xA;Dialer0                    &amp;lt;public ip&amp;gt;     YES IPCP   up                    up      &#xA;NVI0                       unassigned      YES unset  administratively down down    &#xA;Virtual-Access1            unassigned      YES unset  up                    up      &#xA;Virtual-Access2            unassigned      YES unset  up                    up &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Full&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;do show ip interface      &#xA;GigabitEthernet0/0 is up, line protocol is up&#xA;  Internet protocol processing disabled&#xA;GigabitEthernet0/1 is up, line protocol is up&#xA;  Internet address is 192.168.2.1/24&#xA;  Broadcast address is 192.168.2.255&#xA;  Address determined by non-volatile memory&#xA;  MTU is 1500 bytes&#xA;  Helper address is not set&#xA;  Directed broadcast forwarding is disabled&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;  Proxy ARP is enabled&#xA;  Local Proxy ARP is disabled&#xA;  Security level is default&#xA;  Split horizon is enabled&#xA;  ICMP redirects are always sent&#xA;  ICMP unreachables are always sent&#xA;  ICMP mask replies are never sent&#xA;  IP fast switching is enabled&#xA;  IP fast switching on the same interface is disabled&#xA;  IP Flow switching is disabled&#xA;  IP CEF switching is enabled&#xA;  IP CEF switching turbo vector&#xA;  IP multicast fast switching is enabled&#xA;  IP multicast distributed fast switching is disabled&#xA;  IP route-cache flags are Fast, CEF&#xA;  Router Discovery is disabled&#xA;  IP output packet accounting is disabled&#xA;  IP access violation accounting is disabled&#xA;  TCP/IP header compression is disabled&#xA;  RTP/IP header compression is disabled&#xA;  Policy routing is disabled&#xA;  Network address translation is enabled, interface in domain inside&#xA;  BGP Policy Mapping is disabled&#xA;  Input features: Stateful Inspection, Virtual Fragment Reassembly, Virtual Fragment Reassembly After IPSec Decryption, MCIk&#xA;  Output features: NAT Inside, Stateful Inspection, NAT ALG proxy, Post-Ingress-NetFlow&#xA;  WCCP Redirect outbound is disabled&#xA;  WCCP Redirect inbound is disabled&#xA;  WCCP Redirect exclude is disabled&#xA;Dialer0 is up, line protocol is up&#xA;  Internet address is &amp;lt;public ip&amp;gt;/32&#xA;  Broadcast address is 255.255.255.255&#xA;  Address determined by IPCP&#xA;  MTU is 1492 bytes&#xA;  Helper address is not set&#xA;  Directed broadcast forwarding is disabled&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;  Proxy ARP is enabled&#xA;  Local Proxy ARP is disabled&#xA;  Security level is default&#xA;  Split horizon is enabled&#xA;  ICMP redirects are always sent&#xA;  ICMP unreachables are always sent&#xA;  ICMP mask replies are never sent&#xA;  IP fast switching is enabled&#xA;  IP fast switching on the same interface is enabled&#xA;  IP Flow switching is disabled&#xA;  IP CEF switching is enabled&#xA;  IP CEF switching turbo vector&#xA;  IP Null turbo vector&#xA;  IP multicast fast switching is enabled&#xA;  IP multicast distributed fast switching is disabled&#xA;  IP route-cache flags are Fast, Policy, CEF&#xA;  Router Discovery is disabled&#xA;  IP output packet accounting is disabled&#xA;  IP access violation accounting is disabled&#xA;  TCP/IP header compression is disabled&#xA;  RTP/IP header compression is disabled&#xA;  Policy routing is disabled&#xA;  Network address translation is enabled, interface in domain outside&#xA;  BGP Policy Mapping is disabled&#xA;  Input features: Stateful Inspection, Dialer i/f override, Ingress-NetFlow, Virtual Fragment Reassembly, Virtual Fragment k&#xA;  Output features: Post-routing NAT Outside, Stateful Inspection, NAT ALG proxy, Post-Ingress-NetFlow, Dialer idle reset, Dt&#xA;  WCCP Redirect outbound is disabled&#xA;  WCCP Redirect inbound is disabled&#xA;  WCCP Redirect exclude is disabled&#xA;NVI0 is administratively down, line protocol is down&#xA;  Internet protocol processing disabled&#xA;Virtual-Access1 is up, line protocol is up&#xA;  Internet protocol processing disabled&#xA;Virtual-Access2 is up, line protocol is up&#xA;  Peer address is 64.230.11.5&#xA;  Dialer interface is Dialer0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As always, can ping within cli but not from directly connected client.&#xA;DNS on client set to 8.8.8.8, can ping the router etc.. It looks like&#xA;a gateway route issue for dia0?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update - Working mtu mss for Cisco Bell Canada&lt;/strong&gt;&#xA;ip mtu 1492&#xA;ip tcp adjust-mss 1452&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything is perfect now!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in Advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nick.&lt;/p&gt;&#xA;" OwnerUserId="3706" LastEditorUserId="3706" LastEditDate="2014-01-06T14:56:42.460" LastActivityDate="2014-01-06T14:56:42.460" Title="Broken PPPoE Config" Tags="|cisco|pppoe|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="5725" PostTypeId="2" ParentId="5724" CreationDate="2014-01-06T03:03:10.310" Score="7" Body="&lt;p&gt;*cough*&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Dialer0&#xA;  ip nat outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-01-06T03:03:10.310" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5726" PostTypeId="2" ParentId="5724" CreationDate="2014-01-06T03:04:32.397" Score="6" Body="&lt;p&gt;You are missing a critical NAT command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try adding &lt;code&gt;ip nat outside&lt;/code&gt; under the outbound dialer interface &lt;code&gt;interface Dialer 0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With your current configuration you've identified the interface Gig 0/1 as the &quot;Inside&quot; interface, so the router knows when to apply NAT rules to the incoming traffic on that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since the Dialer 0 interface does not have a NAT statement, the router doesn't know that it needs to translate the addressing and THEN try to route it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, your return traffic from the internet to a NATed host is presumably getting to your router and dying there.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I highly recommend checking out &lt;a href=&quot;http://blog.ine.com/2008/02/15/the-inside-and-outside-of-nat/&quot; rel=&quot;noreferrer&quot;&gt;this article over at INE&lt;/a&gt; that goes over the details of &quot;Inside&quot; vs &quot;Outside&quot; interfaces in Cisco NATing.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2014-01-06T03:04:32.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5728" PostTypeId="2" ParentId="5724" CreationDate="2014-01-06T05:51:17.383" Score="5" Body="&lt;p&gt;Adding to the other answers... the thing you lack now is an access-list to limit NAT to your inside addresses...  if you apply this configuration, I think this should get you going as long as there aren't other subnets routed by this router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip nat inside&#xA;&#xA;interface Dialer0&#xA; ip nat outside&#xA;!&#xA;!! You might not need to do this, but just in case...&#xA;do clear ip nat trans *&#xA;no ip nat inside source list 1 interface Dialer0 overload&#xA;!&#xA;access-list 1 permit 192.168.2.0 0.0.0.255&#xA;!&#xA;ip nat inside source list 1 interface Dialer0 overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I included pieces from Ricky and Brett's answers, which of course are also required.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-01-06T05:51:17.383" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5734" PostTypeId="1" AcceptedAnswerId="5736" CreationDate="2014-01-06T17:19:36.907" Score="8" ViewCount="4388" Body="&lt;p&gt;&lt;strong&gt;My current setup is as follows:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco 881 router (only 1 WAN interface) that has a pair of T1's coming in on the WAN interface, this currently provides internet access to two VLANs, 10 and 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What is changing:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are adding another pair of T1's, for a total of two Internet connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My thoughts on a solution:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The end goal is to have one pair of T1's be dedicated to VLAN 10 and the other pair to VLAN 20. My thought right now is to add another router that connects to the 881 router that acts as a gateway for the second T1 pair. So I'd have VLAN 10 route to the Internet via the 881 router, and VLAN 20 via a new router that connects to the second pair of T1's. Is this the best setup or would you go about it a different way?&lt;/p&gt;&#xA;" OwnerUserId="2821" LastActivityDate="2014-01-08T00:20:28.240" Title="Splitting two Internet connections between two VLANs" Tags="|cisco|router|cisco-ios|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5735" PostTypeId="2" ParentId="5734" CreationDate="2014-01-06T17:54:33.323" Score="2" Body="&lt;p&gt;For fixed configuration and not modular chassis (i.e. cannot add another WAN to the same chassis), then you need 2 routers for 2 WANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I know that the 881 has a 10/100 Mbps FastEthernet WAN Interface, not T1, right ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means if the WAN is Ethernet Acces, then you can have more than one WAN on the same chassis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st WAN Ethernet can be connected to the chassis WAN Interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And 2nd WAN Ethernet can be connected to one of the 4 ports of the integrated switch, you will need to configure a vlan with ip address in order for the switch port to accept the 2nd WAN, and you will lose QoS for the 2nd WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I still prefer 2 fixed config routers for 2 WANs.&lt;/p&gt;&#xA;" OwnerUserId="3716" LastActivityDate="2014-01-06T17:54:33.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5736" PostTypeId="2" ParentId="5734" CreationDate="2014-01-06T18:12:59.960" Score="10" Body="&lt;p&gt;Assuming you have the correct IOS and feature set (IOS &gt;=15.0(1)M7 &amp;amp; Adv IP Services license loaded), the simplest way to do this is by putting each internet link and Vlan in a different VRF (this is a &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2sb/12_2sba/feature/guide/vrflite.html&quot;&gt;VRF-lite config&lt;/a&gt;).  Assume you want to use:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ethernet1/0 uplink for Vlan10&lt;/li&gt;&#xA;&lt;li&gt;Ethernet2/0 uplink for Vlan20&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The configuration would look similar to this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf Inet_Vlan10&#xA; rd 65535:10&#xA; route-target 65535:10&#xA;!&#xA;ip vrf Inet_Vlan20&#xA; rd 65535:20&#xA; route-target 65535:20&#xA;!&#xA;interface Ethernet1/0&#xA; ip vrf forwarding Inet_Vlan10&#xA; ip address 192.0.2.2 255.255.255.252&#xA; ! insert nat, if required&#xA;interface Ethernet2/0&#xA; ip vrf forwarding Inet_Vlan20&#xA; ip address 192.0.2.6 255.255.255.252&#xA;  ! insert nat, if required&#xA;interface Vlan10&#xA; ! This assumes you're using the onboard switch in a C800 series&#xA; ip vrf forwarding Inet_Vlan10&#xA; ip address 10.0.1.254 255.255.255.0&#xA; ! insert nat, if required&#xA;interface Vlan20&#xA; ! This assumes you're using the onboard switch in a C800 series&#xA; ip vrf forwarding Inet_Vlan20&#xA; ip address 10.0.2.254 255.255.255.0&#xA; ! insert nat, if required&#xA;! Simple example of routing Vlan10 out Ethernet1/0&#xA;ip route vrf Inet_Vlan10 0.0.0.0 0.0.0.0 &amp;lt;ip_addr_in_192.0.2.0/30&amp;gt;&#xA;! Simple example of routing Vlan20 out Ethernet2/0&#xA;ip route vrf Inet_Vlan20 0.0.0.0 0.0.0.0 &amp;lt;ip_addr_in_192.0.2.4/30&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VRFs dedicate a different forwarding table for each VRF; thus you can have dedicate an internet access provider for each Vlan, exactly as you described in your question.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-01-06T18:12:59.960" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5737" PostTypeId="1" AcceptedAnswerId="5738" CreationDate="2014-01-06T19:40:27.480" Score="4" ViewCount="1204" Body="&lt;p&gt;We are running a few services in our internal network that we would like&#xA;to expose to the outside world. At first we were having trouble with email,&#xA;dns, and www. Not sure what happened but email and dns started working all&#xA;of a sudden.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In regards to www, we are forwarding the traffic to our apache server (192.168.2.15), with the following port forward rule:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static tcp 192.168.2.15 80 interface Dialer0 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For some reason it's getting routed to another server on the network.&#xA;We know this due to the firewall of that server burning the request.&#xA;Is there any way to make these static rules more enforced, and getting&#xA;the traffic to the right server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcp &amp;lt;public&amp;gt;:53       192.168.2.5:53        ---                   ---&#xA;tcp &amp;lt;public&amp;gt;:25       192.168.2.10:25       ---                   ---&#xA;tcp &amp;lt;public&amp;gt;:465      192.168.2.10:465      ---                   ---&#xA;tcp &amp;lt;public&amp;gt;:993      192.168.2.10:993      ---                   ---&#xA;--- &amp;lt;public&amp;gt;          192.168.2.5       ---                   ---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NAT Definitions&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip nat service sip udp port 5060&#xA;no ip nat service sip udp port 5080         &#xA;ip route 0.0.0.0 0.0.0.0 Dialer0&#xA;access-list 1 permit 192.168.2.0 0.0.0.255&#xA;ip nat inside source list 1 interface Dialer0 overload&#xA;ip nat inside source static tcp 192.168.2.5 53 interface Dialer0 53&#xA;ip nat inside source static tcp 192.168.2.15 80 interface Dialer0 80&#xA;ip nat inside source static tcp 192.168.2.10 25 interface Dialer0 25&#xA;ip nat inside source static tcp 192.168.2.10 465 interface Dialer0 465&#xA;ip nat inside source static tcp 192.168.2.10 993 interface Dialer0 993&#xA;ip nat inside source static tcp 192.168.2.10 995 interface Dialer0 995&#xA;ip nat inside source static tcp 192.168.2.15 443 interface Dialer0 443&#xA;ip nat inside source static udp 192.168.2.5 5060 interface Dialer0 5060&#xA;ip nat inside source static udp 192.168.2.20 5080 interface Dialer0 5080&#xA;access-list 130 permit udp any any range 8000 65535&#xA;route-map voip-rtp permit 1&#xA;match ip address 130&#xA;ip nat inside source static 192.168.2.5 &amp;lt;public ip&amp;gt; route-map voip-rtp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NAT Trans&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcp public-ip:53       192.168.2.5:53        ---                   ---&#xA;tcp public-ip:25       192.168.2.10:25       ---                   ---&#xA;tcp public-ip:465      192.168.2.10:465      ---                   ---&#xA;tcp public-ip:993      192.168.2.10:993      ---                   ---&#xA;--- public-ip          192.168.2.5           ---                   ---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in Advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nick from Toronto.&lt;/p&gt;&#xA;" OwnerUserId="3706" LastEditorUserId="3706" LastEditDate="2014-01-07T02:37:54.550" LastActivityDate="2014-01-07T02:37:54.550" Title="CISCO Port Forwarding Going to Wrong Machine" Tags="|cisco|nat|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5738" PostTypeId="2" ParentId="5737" CreationDate="2014-01-06T19:51:08.277" Score="4" Body="&lt;p&gt;Is there somehow a second port 80 rule? (shouldn't be possible, but I've seen it happen)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip nat translations | include ---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is the arp cache on the router somehow wrong -- i.e. it thinks 2.15 is at a different machine?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip arp &amp;lt;inside interface&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And lastly, IOS has, in the past, had significant issues with NAT and dynamic interface addresses.  On my cablemodem-feed router, I have to replace the NAT rules with full IP addresses (every time the address changes!) to make it work; the rules won't apply correctly if dhcp is setting the address, or if the address later changes with the interface up.  I've never used &quot;interface nat&quot; on the DSL line with a static address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[UPDATE]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip nat inside source static 192.168.2.5 &amp;lt;public ip&amp;gt; route-map voip-rtp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is what's causing the error.  As you can see in the firewall output, the DST is 2.5, not 2.15.  And there's no port 80 translation in the table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Further Update]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no way to make a Cisco IOS device NAT a UDP port range.  It'll work perfectly for TCP, but completely ignores UDP. (nice of Cisco to do that.)  If you attempt to use route-maps with an acl that specifies ports, it generates an error matching the acl. (turn on various debug's to see it)  Inside destination NAT ignores the UDP part.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-01-06T23:50:10.637" LastActivityDate="2014-01-06T23:50:10.637" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="5739" PostTypeId="2" ParentId="5723" CreationDate="2014-01-06T21:14:26.330" Score="1" Body="&lt;p&gt;This issue has been resolved. It appears to have been a transient problem at layer 1. I can no longer reproduce it after recabling. &lt;/p&gt;&#xA;" OwnerUserId="3780" LastActivityDate="2014-01-06T21:14:26.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5748" PostTypeId="1" AcceptedAnswerId="5750" CreationDate="2014-01-08T00:05:48.757" Score="9" ViewCount="21925" Body="&lt;p&gt;I have (in GNS3) three Cisco 3640s running 12.4(23) connected in series (R1 -&gt; R2 -&gt; R3).&#xA;R1 and R2 are eBGP peers, R2 and R3 are iBGP peers.&#xA;R1 advertises network 192.168.1.0/24. R2 receives this route, but does not advertise it to R3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shouldn't routes learned from eBGP be advertised to iBGP? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the full configuration as entered:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loop0(R1)s0/0 &amp;lt;--&amp;gt; s0/0(R2)s0/1 &amp;lt;--&amp;gt; s0/1(R3)&#xA;&#xA;R1:&#xA;configure terminal&#xA;interface s0/0&#xA;ip address 172.16.1.1 255.255.255.252&#xA;no shutdown&#xA;interface loopback0&#xA;ip address  192.168.1.1 255.255.255.0&#xA;router bgp 1&#xA;neighbor 172.16.1.2 remote-as 2&#xA;network 192.168.1.0 mask 255.255.255.0&#xA;&#xA;R2:&#xA;configure terminal&#xA;interface s0/0&#xA;ip address 172.16.1.2 255.255.255.252&#xA;no shutdown&#xA;interface s0/1&#xA;ip address 172.16.1.5 255.255.255.252&#xA;no shutdown&#xA;router bgp 2&#xA;neighbor 172.16.1.1 remote-as 1&#xA;neighbor 172.16.1.6 remote-as 2&#xA;&#xA;R3:&#xA;configure terminal&#xA;interface s0/1&#xA;ip address 172.16.1.6  255.255.255.252&#xA;no shutdown&#xA;router bgp 2&#xA;neighbor 172.16.1.5 remote-as 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3780" LastEditorUserId="775" LastEditDate="2014-01-11T11:18:00.293" LastActivityDate="2016-12-09T06:32:52.457" Title="Learned eBGP routes not distributed to iBGP neighbors" Tags="|cisco|routing|router|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5750" PostTypeId="2" ParentId="5748" CreationDate="2014-01-08T01:49:03.663" Score="14" Body="&lt;p&gt;Assuming you have no IGP configured (such as EIGRP / OSPF / ISIS / RIP), then the simplest explanation is that R3 hasn't got a route to 192.168.1.0/24's next-hop when the iBGP update arrives at R3.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;loop0(R1)s0/0 &amp;lt;-----------&amp;gt; s0/0(R2)s0/1 &amp;lt;-------------&amp;gt; s0/1(R3)&#xA;    AS 1                       AS 2                        AS 2&#xA;&#xA;              ---------&amp;gt;                  -----------&amp;gt;&#xA;              Prefix: 192.168.1.0/24      Prefix: 192.168.1.0/24&#xA;              AS-path: 1                  AS-path: 1&#xA;              Next-hop: 172.16.1.1        Next-hop: 172.16.1.1&#xA;              *via eBGP*                  *via iBGP*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since iBGP doesn't reset the next-hop when it receives the update from R1, 192.168.1.0/24's next-hop (172.16.1.1) has to be reachable (see &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a0080094431.shtml#background&quot;&gt;Why routers ignore BGP paths&lt;/a&gt; for more details).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most basic way to test this is to configure a static on R3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 172.16.1.0 0.0.0.3 172.16.1.5 name BAD_HACK_FOR_IBGP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's obviously the wrong solution, but it's a dead-simple test to illustrate why things are broken (keep in mind that you may need to wait a bit for the BGP next-hop scanner to run before 192.168.1.0/24's route is installed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two possible solutions that come to mind, but only one really makes sense in most networks...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Best solution&lt;/strong&gt;: Configure an IGP... pick any IGP you like, and advertise 172.16.1.0/30 throughout AS 2 in that IGP&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Optional solution&lt;/em&gt;: Configure the peering session between R2 and R3 to set &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/iproute_bgp/command/reference/irg_bgp3.html#wp1108213&quot;&gt;&lt;code&gt;next-hop-self&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Next-hop reachability is one of the most basic issues when understanding BGP; almost everyone runs into this issue when they're experimenting with the protocol.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-01-08T01:56:39.270" LastActivityDate="2014-01-08T01:56:39.270" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5753" PostTypeId="1" AcceptedAnswerId="5758" CreationDate="2014-01-08T13:03:02.510" Score="2" ViewCount="2969" Body="&lt;p&gt;Hey i am a bit confused about port forwarding and how is suppose to work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the lab , i set up VPN access to the outside interface and that works find. &#xA;Users contacting the outside interface of ASA with ip 10.177.5.40 are prompted to download cisco any connect etc. This is done when a user types the ip in the browser and automatically gets redirected to a https page. port 443&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now i want users from the outside to have access to my DMZ server services HTTP and FTP. Users by typing the http: //10.177.5.40 or ftp: //10.177.5.40 to get access to dmz services. Is it possible or i have to use another ip like 10.177.5.41 . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After watching tutorials for some hours now i have to admit i am more confused that before :)&lt;/p&gt;&#xA;" OwnerUserId="3280" LastActivityDate="2014-01-08T18:43:11.077" Title="VPN , DMZ services port forwarding ASA" Tags="|cisco|cisco-asa|nat|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5755" PostTypeId="1" AcceptedAnswerId="5756" CreationDate="2014-01-08T14:53:15.673" Score="1" ViewCount="3813" Body="&lt;p&gt;If I have got a list of MAC addresses, is there any possible way to differentiate MAC of an AP from that of a Client. I am asking whether there is any pattern of the characters in the MAC address by which we can identify it belongs to an Access Point? &lt;/p&gt;&#xA;" OwnerUserId="3817" LastEditorUserId="76" LastEditDate="2014-01-08T20:36:18.770" LastActivityDate="2014-01-13T01:08:55.913" Title="Is there any way to differentiate MAC address of an Access Point from that of a client?" Tags="|wireless|mac-address|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5756" PostTypeId="2" ParentId="5755" CreationDate="2014-01-08T17:50:53.900" Score="3" Body="&lt;p&gt;Short answer:  No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer:  You can narrow down your list to a few candidates.  The first 3 bytes of the MAC address is called the OUI (Organizationally Unique Identifier) and is assigned to manufacturers.  You can look up the manufacturer of a MAC address by using a tool like &lt;a href=&quot;http://www.wireshark.org/tools/oui-lookup.html&quot; rel=&quot;nofollow&quot;&gt;http://www.wireshark.org/tools/oui-lookup.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the manufacturer, you can get a pretty good idea of who is who.  If the manufacturer is &quot;Cisco,&quot; odds are it's an AP.  If the mfr is &quot;Dell,&quot; it's probably a PC.  This isn't perfect, but as you collect more data, you will able to be more certain of your results.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-01-08T20:47:25.407" LastActivityDate="2014-01-08T20:47:25.407" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5758" PostTypeId="2" ParentId="5753" CreationDate="2014-01-08T18:24:42.210" Score="3" Body="&lt;p&gt;Clients can download the software vpn client only if they access the ip via https port 443, i.e. &lt;code&gt;https://10.177.5.40&lt;/code&gt;, unless there is automatic redirection from http to https at the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore ports 80 http and ftp on the same ip address are free for you to use, take a look at the section: Single Address for FTP, HTTP, and SMTP (Static NAT-with-Port-Translation) in Cisco ASA Firewall configuration guide. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa91/asdm71/firewall/nat_objects.html#wpxref67001&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/security/asa/asa91/asdm71/firewall/nat_objects.html#wpxref67001&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3716" LastActivityDate="2014-01-08T18:24:42.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5760" PostTypeId="2" ParentId="5753" CreationDate="2014-01-08T18:43:11.077" Score="6" Body="&lt;p&gt;You can do a static PAT (Port Address Translation) to forward specific ports for an IP (including the ASA's interface IP) to different internal devices. You can do this for any port, but each port can only be forwarded to one internal device using a static PAT statement. For example, assuming you have something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/2&#xA; nameif dmz&#xA; ip address 192.168.99.0 255.255.255.0&#xA; security-level 50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you will create an object for your DMZ host and use a static &quot;nat&quot; statement with the service keyword to create a port-level static PAT for your object, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network DMZHOST&#xA; host 192.168.99.10&#xA; nat (dmz,outside) static interface service tcp ftp ftp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your DMZ host will now be accessible at ftp: //10.177.5.40. This is well documented in the &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa91/configuration/firewall/nat_objects.html#wp1106703&quot;&gt;Cisco ASA Configuration Guide&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using AnyConnect running on TCP 443 (the HTTPS) port, then you cannot static PAT that to another internal/DMZ host or else you'll break AnyConnect. In that case, you can run AnyConnect on a different port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;webvpn&#xA; port 8443&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this way, your AnyConnect would be accessible at https: //10.177.5.40:8443. Or you can NAT a different external port to port 443 on your internal host, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network DMZHOST&#xA; host 192.168.99.10&#xA; nat (dmz,outside) static interface service tcp 443 8443&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would make your DMZ host accessible at https: //10.177.5.40:8443, but your web server on the host itself would continue to run on port 443.&lt;/p&gt;&#xA;" OwnerUserId="1581" LastActivityDate="2014-01-08T18:43:11.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5761" PostTypeId="1" AcceptedAnswerId="5769" CreationDate="2014-01-08T19:15:14.247" Score="8" ViewCount="1386" Body="&lt;p&gt;Preface;&#xA;&lt;em&gt;In the below topology R1 and R6 are PEs, all others are P routers, all routers are running c7200-jk9s-mz.124-13b.bin. At this point IGP is fully converged (OSPF with all interfaces in area 0 for simplicity) and MPLS is enabled on all interfaces using LDP. No BGP configuration exists at this point.&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fU8xK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the MPLS forwarding table on R1;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show mpls forwarding-table &#xA;Local  Outgoing    Prefix            Bytes tag  Outgoing   Next Hop    &#xA;tag    tag or VC   or Tunnel Id      switched   interface              &#xA;16     Pop tag     10.0.0.2/32       0          Fa0/0      10.0.12.2    &#xA;17     Pop tag     10.0.0.3/32       0          Fa0/1      10.0.13.3    &#xA;18     Pop tag     10.0.24.0/24      0          Fa0/0      10.0.12.2    &#xA;19     Pop tag     10.0.35.0/24      0          Fa0/1      10.0.13.3    &#xA;20     20          10.0.57.0/24      0          Fa0/1      10.0.13.3    &#xA;21     20          10.0.46.0/24      0          Fa0/0      10.0.12.2    &#xA;22     21          10.0.76.0/24      0          Fa0/1      10.0.13.3    &#xA;       21          10.0.76.0/24      0          Fa0/0      10.0.12.2    &#xA;23     23          10.0.0.4/32       0          Fa0/0      10.0.12.2    &#xA;24     24          10.0.0.5/32       0          Fa0/1      10.0.13.3    &#xA;25     25          10.0.0.6/32       0          Fa0/0      10.0.12.2    &#xA;26     26          10.0.0.7/32       0          Fa0/1      10.0.13.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If my understanding is correct, R1 has generated labels for each FEC and R2 and R3 send R1 their LDP bindings (each MPLS label) for every MPLS FEC they have. Using this information R1 (for example) performs a lookup for traffic towards 10.0.0.6 and PUSHes the outgoing tag 25 before sending the the MPLS tagged packet towards 10.0.12.2 (R2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few questions arise here for me;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;After the initial convergence of the network, LSPs now exist between all FECs which are typically interfaces on LERs that connect to a subnet. R1 is a LER for an LSP towards R6 which is the other LER in that LSP. If R7 were also a PE router for example an LSP would exist between each R1 interface and each R7 interface and so more LSPs would exist then with R1 and R7 being the two LERs for those LSPs. Is that all correct?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Assuming that baseline is correct; How does R1 know it is an LER for an LSP that spans to R6 for example (and all other possible LSPs that exist in this topology where R1 is one end device of the LSP such as if we introduced R7 as a PE as before?). Is this because the IGP (OSPF in this case) has full visibility of the network so it (all the edges) can be calculated from the IGP database?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If 2 is correct, how did we get to that stage? Once the network is fully converged with IGP and LDP exchanges are completed, does a PE router then look through the FIB (or is it IGP RIB?) and work out all possible LDPs and which ones it would be an LER for, and who/what is the LER for the other end?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2017-03-22T21:45:16.283" LastActivityDate="2017-03-22T21:45:16.283" Title="How are the LERs determined in an MPLS LSP using LDP" Tags="|cisco|mpls|ldp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5762" PostTypeId="2" ParentId="5761" CreationDate="2014-01-08T20:26:27.167" Score="-2" Body="&lt;p&gt;Without BGP configured you do not have have PEs yet, it's a full mesh any-to-any MPLS Network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when you add MP-BGP on R1 and R6, both can be defined now as PEs, R1 and R6 will add another MPLS Label and will ask for penultimate hop popping from the penultimate P router, thus the PEs are now LERs for the LSPs between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P routers are not aware about the BGP routes, they forward labeled mpls traffic from the PEs based on best path. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, PseudoWires can be created instead of BGP for implementations like Ethernet over MPLS and AToM, and then the PW router endpoints will be LERs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a basic description, Check CiscoPress MPLS Fundamentals book.&lt;/p&gt;&#xA;" OwnerUserId="3716" LastEditorUserId="3716" LastEditDate="2014-01-08T20:43:41.880" LastActivityDate="2014-01-08T20:43:41.880" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5763" PostTypeId="2" ParentId="5702" CreationDate="2014-01-08T20:33:43.010" Score="8" Body="&lt;p&gt;Using &lt;a href=&quot;https://www.google.com/search?q=linux+ethernet+packet+generator&quot;&gt;a search for &quot;linux ethernet packet generator&quot;&lt;/a&gt; gives me &lt;a href=&quot;http://packeth.sourceforge.net/packeth/Home.html&quot;&gt;packeth&lt;/a&gt; as the first hit.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://packeth.sourceforge.net/packeth/Home.html&quot;&gt;packeth&lt;/a&gt; Solution:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Has both a GUI and CLI version&lt;/li&gt;&#xA;&lt;li&gt;Generates not only UDP, but many other protocols as well, including QinQ&lt;/li&gt;&#xA;&lt;li&gt;Is packaged for RedHat as an &lt;a href=&quot;http://rpmfind.net/linux/rpm2html/search.php?query=packETH&quot;&gt;rpm&lt;/a&gt;, or &lt;a href=&quot;http://packages.debian.org/search?keywords=packeth&quot;&gt;Debian package&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://netcat.sourceforge.net/&quot;&gt;netcat&lt;/a&gt; and &lt;a href=&quot;http://www.tcpdump.org/tcpdump_man.html&quot;&gt;tcpdump&lt;/a&gt; Solution:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If it was me, I would just do a quick-and-dirty &lt;em&gt;ten second &lt;a href=&quot;http://netcat.sourceforge.net/&quot;&gt;netcat&lt;/a&gt; test&lt;/em&gt;, because &lt;a href=&quot;http://netcat.sourceforge.net/&quot;&gt;netcat&lt;/a&gt; is already installed in most linux distros... this is an example of sending a linux file (or in my example, &lt;code&gt;/dev/urandom&lt;/code&gt;) via UDP...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First start &lt;a href=&quot;http://www.tcpdump.org/tcpdump_man.html&quot;&gt;tcpdump&lt;/a&gt; on both sides, and listen for a rare UDP port (use 65535/udp in this example).  I'm using &lt;code&gt;-s 1&lt;/code&gt; to reduce the amount of work &lt;code&gt;tcpdump&lt;/code&gt; has to do (which means it captures faster).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;tcpdump -s 1 -ni eth0 udp and port 65535&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Next, optionally start your receiver with a timed finish (backgrounding the &lt;a href=&quot;http://netcat.sourceforge.net/&quot;&gt;netcat&lt;/a&gt; portion in a subshell so it won't block).  This is not really necessary if you don't care about checksumming the received data.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(nc -q 1 -u -l -p 65535 &amp;gt; /dev/null &amp;amp;); sleep 10; fuser -k 65535/udp;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, start your Transmitter ... in this case, I show it pushing the output of &lt;code&gt;/dev/urandom&lt;/code&gt; to  on udp/65535.  Use a real file if you like...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(cat /dev/urandom | nc -u &amp;lt;DESTINATION_IP&amp;gt; 65535&amp;amp;); sleep 10; \&#xA;    fuser -n udp ,&amp;lt;DESTINATION_IP&amp;gt;,65535 -k&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;be sure you choose the timeout (I'm using &lt;code&gt;sleep 10&lt;/code&gt;, above) to be long enough to sequence the shell commands and finish the network transfer.  If you're transferring something other than &lt;code&gt;/dev/urandom&lt;/code&gt;, be sure you &lt;code&gt;sleep&lt;/code&gt; long enough to finish the file transfer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you're done, stop &lt;a href=&quot;http://www.tcpdump.org/tcpdump_man.html&quot;&gt;tcpdump&lt;/a&gt; on both sides.  When it exits, you'll get packet counts from &lt;a href=&quot;http://www.tcpdump.org/tcpdump_man.html&quot;&gt;tcpdump&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ sudo tcpdump -s 1 -ni eth0 udp and port 65535&#xA;14:18:55.563674 [|ether]&#xA;14:18:55.563688 [|ether]&#xA;&#xA;^C&#xA;2000 packets captured&#xA;2000 packets received by filter&#xA;0 packets dropped by kernel&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do the math of &lt;code&gt;sender_count&lt;/code&gt; - &lt;code&gt;receiver_count&lt;/code&gt;, and that's your packet loss.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-01-08T20:33:43.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5764" PostTypeId="2" ParentId="5702" CreationDate="2014-01-08T21:42:16.380" Score="10" Body="&lt;p&gt;I would take a look at &lt;a href=&quot;http://code.google.com/p/iperf/&quot;&gt;iperf&lt;/a&gt;.  You should be able to use built in reporting in &lt;a href=&quot;http://code.google.com/p/iperf/&quot;&gt;iperf&lt;/a&gt; to validate the amount of traffic dropped. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;iperf is typically ran across the network between two systems.  I have iperf3 installed on two CentOS machines, as you can see below, one is configured as the server and the other the client.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Install the &lt;a href=&quot;http://code.google.com/p/iperf/&quot;&gt;iperf&lt;/a&gt; rpm, start the server first, and then start the client.  Starting the &lt;a href=&quot;http://code.google.com/p/iperf/&quot;&gt;iperf&lt;/a&gt; server is as simple as running the following command:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Machine #1&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iperf3 -s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;-s&lt;/code&gt; option specifies to run &lt;a href=&quot;http://code.google.com/p/iperf/&quot;&gt;iperf&lt;/a&gt; in server (receiver) mode. Initially (by default) the server will listen on 5201/tcp which will be used as a control channel, this port is configurable.  Ensure your &lt;code&gt;iptables&lt;/code&gt; (or equivalent) is configured to accommodate both the initial control channel and any subsequent udp flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your client command and subsequent reporting after the transfer will look like this.  &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Machine #2&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Machine #2 (this command essentially says &quot;act as a client, connect to 192.168.2.202, use the udp protocol , send 1GB of data at a data rate of 100Mbps)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ iperf3 -c 192.168.2.202 -u -n 1G -b 100M &#xA;&#xA;Connecting to host 192.168.2.202, port 5201&#xA;&#xA;[  4] local 192.168.2.160 port 54356 connected to 192.168.2.202 port 5201&#xA;[ ID] Interval           Transfer     Bandwidth&#xA;&#xA;[  4]   0.00-82.00  sec  1.00 GBytes   105 Mbits/sec&#xA;[ ID] Interval           Transfer     Bandwidth       Jitter    Lost/Total Datagrams&#xA;[  4]   0.00-82.00  sec  1.00 GBytes   105 Mbits/sec  5.016 ms  12372/131072 (9.4%)&#xA;[  4] Sent 131072 datagrams&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's all you need to do with &lt;a href=&quot;http://code.google.com/p/iperf/&quot;&gt;iperf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3756" LastEditorUserId="775" LastEditDate="2014-01-08T22:37:15.557" LastActivityDate="2014-01-08T22:37:15.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5765" PostTypeId="1" AcceptedAnswerId="5767" CreationDate="2014-01-08T21:56:03.703" Score="9" ViewCount="13739" Body="&lt;p&gt;I have been doing firmware upgrades in HP switches. Two different models have been upgraded: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ProCurve Switch 5406zl Intelligent Edge (J8697A): upgraded from K.15.06.0008 to K.15.12.0012&lt;/li&gt;&#xA;&lt;li&gt;HP 2520-24G-PoE Switch (J9299A): upgraded from J.14.54 to J.15.09.0021&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Checking each switch right after booting the new image,  I have observed something:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Switches loaded the new firmware image without errors and connectivity was recovered as soon as the switch booted up. At this point CPU usage was low (under 10%)&lt;/li&gt;&#xA;&lt;li&gt;Few seconds later CPU usage raised up to 100% and stood there for several minutes. I could not detect any  issue at this point apart from CLI through SSH being a little bit sluggish: normal connectivity, no log messages...&lt;/li&gt;&#xA;&lt;li&gt;After five to ten minutes at 100%, CPU came back to normal without any change from my side. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Both models were having this behaviour. I rolled back one unit of each model to the previous firmware image and they did behave the same way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Despite this CPU spike right after boot caused no issue, I wonder if normal network behaviour could be the cause for this spike, but I do not think so. I have considered the following aspects:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Right after boot STP starts running, generating BPDUs and cycling all ports in the switch through the Bloking, Listening, Learning and Forwarding states. However, even with 802.1D this process takes no longer than 1 minute with default timers. Furthermore, I was checking the switches through SSH, so all STP computations were already done by the time I could connect to the switch. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Right after boot the MAC address table is empty and broadcast is needed for the first frames to be forwarded. But I doubt this broadcasting would take 100% CPU, much less for 5 minutes, in a 24 port switch. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;All switches acting as L2 devices, no L3 functionality enable, so I discard routing and other L3 processes. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Am I missing something &quot;normal&quot; in network operations that may explain this CPU usage for 5 minutes after reboot while keeping connectivity?  Maybe it is some kind of background process the  switch runs right after reboot? &lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="775" LastEditDate="2014-01-09T01:18:26.733" LastActivityDate="2014-01-09T01:18:26.733" Title="ProCurve CPU at 100% for several minutes after reboot" Tags="|troubleshooting|hp-procurve|hp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5767" PostTypeId="2" ParentId="5765" CreationDate="2014-01-08T22:38:53.163" Score="8" Body="&lt;p&gt;This took less than 2 seconds on Google:&#xA;&lt;a href=&quot;http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/public/kb/docDisplay?javax.portlet.begCacheTok=com.vignette.cachetoken&amp;amp;javax.portlet.endCacheTok=com.vignette.cachetoken&amp;amp;javax.portlet.prp_ba847bafb2a2d782fcbb0710b053ce01=wsrp-navigationalState=docId%253Demr_na-c01979056-1%257CdocLocale%253D%257CcalledBy%253D&amp;amp;javax.portlet.tpst=ba847bafb2a2d782fcbb0710b053ce01&amp;amp;sp4ts.oid=1827663&amp;amp;ac.admitted=1389220450064.876444892.492883150&quot;&gt;HP networking portal&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;HP ProCurve 5400zl Switch Series - High CPU Utilization (99-100%) after Startup&#xA;  Issue&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Right after the switch is started, high (99-100%) CPU utilization is&#xA;  observed. Solution&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When the switch boots, one of the initialization tasks is creation of&#xA;  encryption keys. Having the keys created in advance means that later,&#xA;  when a feature such as SSL or SSH that uses the keys is configured or&#xA;  used, there is minimal delay in the availability. This task takes a&#xA;  few seconds before it ramps up, depending on the switch model, the&#xA;  configuration being loaded, and the software revision. Even though the&#xA;  task consumes up to 100% of the CPU, it runs at a very low priority.&#xA;  Therefore, if another task requiring CPU cycles is started, this low&#xA;  priority task will back off. If this initialization/key generation&#xA;  task runs uninterrupted by higher priority tasks, it takes about 10&#xA;  minutes to complete. If the CPU is busy with other tasks, the&#xA;  completion time will be extended.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To verify that the elevated CPU being seen is in fact what has been&#xA;  described here and not something else that requires troubleshooting,&#xA;  please use the commands documented below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;task-monitor cpu (this command was introduced in K.13.04)&#xA;&#xA;show uptime&#xA;&#xA;show cpu&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The output will look like the following.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Switch# task-monitor cpu Switch# show uptime 0000:00:01:42.36 Switch#&#xA;  show cpu&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;99 percent busy, from 27 sec ago&#xA;1 sec ave: 100 percent busy&#xA;5 sec ave: 100 percent busy&#xA;1 min ave: 66 percent busy&#xA;&#xA;Task usage for last 5 sec&#xA; % CPU | Description&#xA;-------+--------------------------&#xA;   0.3 | Sessions &amp;amp; I/O&#xA;  99.7 | System Services&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-08T22:38:53.163" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5769" PostTypeId="2" ParentId="5761" CreationDate="2014-01-09T01:29:46.260" Score="9" Body="&lt;p&gt;First, I would recommend checking out &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk436/tk428/technologies_q_and_a_item09186a00800949e5.shtml&quot;&gt;Cisco's MPLS FAQ For Beginners&lt;/a&gt;, or the &lt;a href=&quot;http://www.nanog.org/meetings/nanog49/presentations/Sunday/mpls-nanog49.pdf&quot;&gt;NANOG Presentation &quot;MPLS for Dummies&quot;&lt;/a&gt; by Richard A Steenbergen.  They both have some really good information.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;With that said, let me address your questions one at a time.  (I have excerpted them in part below.) &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1: After the initial convergence of the network, LSPs now exist between all FECs which are typically interfaces on LERs that connect to a subnet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, LSP's exist towards all reachable FECs.  And an MPLS packet could now be switched across the network.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2: Assuming that baseline is correct; How does R1 know it is an LER for an LSP that spans to R6 for example&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;R1 has no clue that it is part of an LSP that spans to R6.  It only cares about the local/connected labels and FECs.  That is part of what makes MPLS Label Switching fast and effective.  It doesn't have to know the whole path.  The router just knows that to reach &lt;code&gt;FEC1&lt;/code&gt;, I apply label &lt;code&gt;1234&lt;/code&gt;, and exit interface &lt;code&gt;XYZ&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then later hops in the path utilize the same process, swapping in the appropriate next hop label and switching the packet on.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As for the bottom line question &lt;strong&gt;How are the LERs determined?&lt;/strong&gt;, a router itself doesn't really know or care if it's an LER.  It just knows that when it receives a packet destined for a local destination, with no tag, it delivers it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your output above, you can see that the first 4 outgoing FECs have &lt;code&gt;Pop tag&lt;/code&gt; listed as the Outgoing Tag.  A packet leaving R1 for one of the local subnets on R2 or R3 simply has it's tag popped and forwarded out the appropriate interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When R2 or R3 receive that packet, they see no label and process it via the normal routing process which delivers it to a local interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To quote the &lt;a href=&quot;http://en.wikipedia.org/wiki/Multiprotocol_Label_Switching&quot;&gt;Wikipedia article on MPLS&lt;/a&gt;: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;At the egress router, when the last label has been popped, only the payload remains. This can be an IP packet, or any of a number of other kinds of payload packet. The egress router must therefore have routing information for the packet's payload, since it must forward it without the help of label lookup tables. An MPLS transit router has no such requirement.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2014-01-09T04:14:25.263" LastActivityDate="2014-01-09T04:14:25.263" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="5774" PostTypeId="1" AcceptedAnswerId="5777" CreationDate="2014-01-09T10:50:55.003" Score="5" ViewCount="668" Body="&lt;p&gt;I know that MUX-UNI can only be configure on a 7600 running certain IOS version, SR and SX I believe. Does that not include SRE?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logged into a 7600 running 12.2(33)SRE9a, with the following configuration;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet8/3&#xA; description Link to a box&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet8/3.123&#xA; description L3 link to a box&#xA; encapsulation dot1Q 556&#xA; ip address 10.21.225.65 255.255.255.248&#xA;!&#xA;interface GigabitEthernet8/3.456&#xA; description PWE3 to a box&#xA; encapsulation dot1Q 920&#xA; xconnect 172.16.25.25 1026 encapsulation mpls&#xA;  mtu 1500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I try to reconfigure this as a MUX-UNI interface the following happens;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r1(config-if)#int gi8/3&#xA;r1(config-if)#switchport &#xA;Subinterfaces configured on this interface will not be available after mode change. To re-use reserved internal vlans, subinterfaces need to be deleted before changing the mode.&#xA;Proceed with the command? [confirm]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't find any Cisco doc's that say &quot;yes&quot; or &quot;no&quot; definitively on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The supervisor is a RSP720-3CXl-GE. The line card I was trying to configure is an old WS-X6516A-GBIC. But I thought this wasn't depending on the line card but the IOS. I configured another port on that line card and selected &quot;confirm&quot; and sure enough it shut down and removed the sub-interfaces. I tried to then configure the port as a switchport first and then add sub-interfaces but I couldn't assign an IP address to the sub-interface;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r1(config)#do show run | b 8/1&#xA;interface GigabitEthernet8/1&#xA; switchport&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 58,59&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet8/1.58&#xA;&#xA;r1(config)#int gi8/1.58&#xA;r1(config-subif)#ip ?&#xA;Interface IP configuration subcommands:&#xA;  access-group        Specify access control for packets&#xA;  admission           Apply Network Admission Control&#xA;  auth-proxy          Apply authenticaton proxy&#xA;  dhcp                Configure DHCP parameters for this interface&#xA;  header-compression  IPHC options&#xA;  rsvp                RSVP Interface Commands&#xA;  vrf                 VPN Routing/Forwarding parameters on the interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried the same configuration on a different line card, WS-X6748-GE-TX, same result, couldn't configure an IP address because the option is not given under the sub-interface configuration mode.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="775" LastEditDate="2014-01-09T15:11:43.173" LastActivityDate="2014-01-10T00:08:24.553" Title="Cisco 7600 MUX-UNI on SRE IOS?" Tags="|cisco|cisco-catalyst|mpls|cisco-6500|cisco-7600|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5777" PostTypeId="2" ParentId="5774" CreationDate="2014-01-09T15:11:15.877" Score="5" Body="&lt;h3&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/pfc3mpls.html#wp1407597&quot; rel=&quot;nofollow&quot;&gt;MUX-UNI&lt;/a&gt; support:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;It looks like you're trying to configure a &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/pfc3mpls.html#wp1407597&quot; rel=&quot;nofollow&quot;&gt;MUX-UNI&lt;/a&gt; with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A Layer3 interface on Vlan 556&lt;/li&gt;&#xA;&lt;li&gt;A Vlan-mode PW on Vlan 920&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The WS-X6516A is considered a Catalyst 6500 / Cisco 7600 LAN Card; LAN cards have some feature restrictions... one of the restrictions is how you configure a Layer3 interface on a LAN card with dot1q encapsulation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you're building a &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/pfc3mpls.html#wp1407597&quot; rel=&quot;nofollow&quot;&gt;MUX-UNI&lt;/a&gt; combination of Pseudo-Wire services, and Layer3 services on a dot1q-trunked Catalyst 6500 LAN card, you &lt;em&gt;must&lt;/em&gt; do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configure the Layer3 services on an SVI.  Direct Layer3 subinterface configuration on the LAN switchports is not supported on Sup720&lt;/li&gt;&#xA;&lt;li&gt;Configure the Pseudo-wire as a subinterface of the LAN card (omit the PW vlan from the dot1q trunk though.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'll use your example...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet8/1&#xA; switchport&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 556&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA;!&#xA;interface GigabitEthernet8/1.123&#xA; ! Configure PW-ID 1026 on Vlan 920, note that vlan-920 is *not* explicitly trunked on Gi8/1&#xA; encapsulation dot1q 920&#xA; xconnect 172.16.25.25 1026 encapsulation mpls&#xA;  mtu 1500&#xA;!&#xA;interface Vlan556&#xA; no shutdown&#xA; ! insert optional VRF configuration here&#xA; ip address 192.0.2.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you use this configuration as a template, &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/pfc3mpls.html#wp1407597&quot; rel=&quot;nofollow&quot;&gt;MUX-UNI&lt;/a&gt; will work for you.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;What was wrong with your configuration&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You tried to use a Layer3 IP subinterface directly on the switchport, which is not supported on 6500 / 7600-series LAN cards and Sup720&lt;/li&gt;&#xA;&lt;li&gt;The original &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/pfc3mpls.html#wp1407597&quot; rel=&quot;nofollow&quot;&gt;MUX-UNI&lt;/a&gt; configuration on Gi8/3 was not made a switchport first.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Catalyst6500 LAN Card IP subinterfaces&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Because Catalyst6500 Vlans have a global scope throughout the chassis, &lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/7600/ios/12.2SR/configuration/guide/layer3.html#wp1040486&quot; rel=&quot;nofollow&quot;&gt;LAN cards on Sup720 support a routed dot1q subinterface, as long as you have &lt;em&gt;not&lt;/em&gt; used that same vlan elsewhere&lt;/a&gt;... example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! ensure vlan 100 is unused, so we can use it on a Gi4/1 subinterface&#xA;no vlan 100&#xA;interface GigabitEthernet4/1&#xA; no switchport&#xA;interface GigabitEthernet4/1.100&#xA; encapsulation dot1q 100&#xA; ip address 192.0.2.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-01-10T00:08:24.553" LastActivityDate="2014-01-10T00:08:24.553" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5778" PostTypeId="2" ParentId="5702" CreationDate="2014-01-09T17:50:01.550" Score="2" Body="&lt;p&gt;By far the best packet and traffic generator I have come across for Linux is &lt;a href=&quot;http://packeth.sourceforge.net/packeth/Home.html&quot; rel=&quot;nofollow&quot;&gt;PacketETH&lt;/a&gt;;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use it via CLI or via GUI. It is for generating Ethernet frames but you can also specify higher protocols such as IPv4/6, and TCP/UDP etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's very powerful letting you customise pretty much all header options for protocols in layer 2, 3 and 4 (so Ethernet, IPv4/6, TCP/UDP) directly. You can send any higher layer protocol really though, not just the per-programmed ones as once you have created an Ethernet frame you can then write in the payload which of course could be the header and payload of any other higher layer protocol you like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use Linux you should have it, almost know one seems to know about it and it's so powerful!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also have features like saving the custom packet designs you create and re-loading them  at a later date. Also you can and send &quot;batches&quot; of them which is what you want in either a burst of 1000 packets (for example) or at a constant rate of 2Mbps (also as an example).&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2014-01-09T17:50:01.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5779" PostTypeId="1" AcceptedAnswerId="5781" CreationDate="2014-01-09T19:31:53.180" Score="3" ViewCount="1546" Body="&lt;p&gt;At work, we have a network with about 20 computers on it. We're about to add another 20, so we need to invest in a second switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a file server on the network, and generally this is the only machine which I care about clients having a high-speed connection to. So, I'm thinking of configuring the second switch like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     ----SW1----Clients&#xA;    /     |&#xA;SMB-      |&#xA;    \     |&#xA;     ----SW2----Clients&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The idea is, there are ~20 clients connected to each switch. The switches (assume both are Layer 2 Managed switches) are connected to each other, since I'm thinking of doing this in a single broadcast domain. The file server (denoted &quot;SMB&quot; in the illustration) is connected to BOTH switches, so as not to bottleneck traffic coming from either group of clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is simply, is this a reasonable way to do this? If not, how should this be done (keeping the goal of maintaining a fast connection to the file server in mind)?&lt;/p&gt;&#xA;" OwnerUserId="3830" LastActivityDate="2014-01-09T20:10:03.553" Title="Connecting multiple switches without losing performance" Tags="|switching|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5781" PostTypeId="2" ParentId="5779" CreationDate="2014-01-09T20:10:03.553" Score="4" Body="&lt;p&gt;You only need to keep in mind how clients are going to access the file server; I’m assuming this is done by direct IP.  If that is the case, and your only real objective is to get clients to connect to the file server by it’s shortest path, then your easiest setup is to setup an IP address on each interface and point clients to their closest connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this simple of a setup, I can’t imagine a scenario where your connection will be your bottleneck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you done any benchmarks or taken any baselines on how that connection is currently used?  Give that a go before you invest too much time into a solution that isn’t entirely necessary.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-01-09T20:10:03.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5783" PostTypeId="2" ParentId="5755" CreationDate="2014-01-10T01:45:36.973" Score="0" Body="&lt;p&gt;Well, by simply looking at it? Not exactly.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are obvious things you can do such as:&lt;br&gt;&#xA;1. Look at the OUI (First 3 bytes of MAC) and see who owns it and just assume which is MORE LIKELY to be AP.&lt;br&gt;&#xA;2. Look at a packet capture and see what information is going to/from the MAC.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just remember that spoofing a MAC address is very easy.&lt;/p&gt;&#xA;" OwnerUserId="3836" LastActivityDate="2014-01-10T01:45:36.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5784" PostTypeId="1" AcceptedAnswerId="6921" CreationDate="2014-01-10T02:32:35.690" Score="2" ViewCount="932" Body="&lt;p&gt;I've got a network, with a shared wireless link, I want to add the links identified by the &quot;+&quot;s. After reading up on spanning tree protocol I'm concerned the shared wireless link could be a problem.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;           A&#xA;           |&#xA;         (WAP)--&#xA;          /|\   \&#xA;        /  |  \    \&#xA;      /    |    \     \&#xA;   (WAP) (WAP) (WAP)    \&#xA;     |     |     |     (WAP)&#xA;     B+++++C+++++D+++    |&#xA;                     ++++E+&#xA;                    (WAP)  +&#xA;                      |    +&#xA;                      F++++&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have control over the brand of switch, but not the WAPs. &lt;strong&gt;*&lt;em&gt;WAP Info Added:&lt;/em&gt;*&lt;/strong&gt; The WAPs are a combination of Tranzeo TR-5a-Nf and UBiQUiTi NanoStation5; specifically the WAPs at A, E &amp;amp; F are TR-5aNf, and the WAPs at B, C &amp;amp; D are NanoStation5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The redundant links are standard Cat5E copper and connect as shown by the &quot;+&quot; lines in the diagram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any helpful suggestions or pointers would be greatly appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Backstory:&#xA;The current network is the diagram without the &quot;+&quot; links. B,C,D, etc. (there's actually five points) are on a farm spread out over about a 15,000 sqft area with about 1,000' between point A and the closest point and 2,000' between point A and the farthest point. Individual links go down occasionally (equipment blocks them, damaged, etc.) and we're trying to route around failed wireless links automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know all that much about spanning tree, but when I did some research it seemed to indicate that the redundant links had to be on separate ports and in this scenario they will all be connected to the same port on the root hub (A) by virtue of the multi-point wireless network.&lt;/p&gt;&#xA;" OwnerUserId="3837" LastEditorUserId="3837" LastEditDate="2014-01-17T19:46:30.443" LastActivityDate="2014-03-20T08:33:17.617" Title="Will spanning tree allow/support point the use of multi-point wireless links for redundancy" Tags="|wireless|spanning-tree|" AnswerCount="2" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="5792" PostTypeId="1" AcceptedAnswerId="5797" CreationDate="2014-01-10T13:55:01.153" Score="2" ViewCount="1474" Body="&lt;p&gt;VPN clients are trying to connect to the outside interface of the ASA (in the lab)&#xA;https:// 10.177.5.40 -&gt; the browser gets into an infinite loading state and suddenly after 10-20 min loads any connect client successfully. I doubt is browser/operating system issue since until yesterday war working fine. A ping -n 1000 does not indicate any issues with the connection. (all pings are &amp;lt;1ms).&lt;br&gt;&#xA;Things i tried: I reset all vpn configuration 3 times and did it from scratch. &#xA;I also tried the wizard&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ASA Version 8.4(2) &#xA;!&#xA;hostname Team4-RTR-01&#xA;domain-name Team4.com&#xA;enable password GqkDZRy1QiuwlSAZ encrypted&#xA;passwd 2KFQnbNIdI.2KYOU encrypted&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0 &#xA;!&#xA;interface Ethernet0/1&#xA; nameif DMZ&#xA; security-level 50&#xA; ip address 192.168.20.1 255.255.255.0 &#xA;!&#xA;interface Ethernet0/2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 10.177.5.40 255.255.255.0 &#xA;!&#xA;interface Ethernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management0/0&#xA; nameif management&#xA; security-level 100&#xA; ip address 192.168.10.1 255.255.255.0 &#xA; management-only&#xA;!&#xA;banner motd This is a secure device. Unothorized access users will be pursecutd to the full extend of law.&#xA;boot system disk0:/asa842-k8.bin&#xA;ftp mode passive&#xA;dns domain-lookup inside&#xA;dns domain-lookup DMZ&#xA;dns domain-lookup outside&#xA;dns domain-lookup management&#xA;dns server-group DefaultDNS&#xA; domain-name Team4.com&#xA;same-security-traffic permit intra-interface&#xA;object service FTP&#xA; service tcp destination eq ftp &#xA;object service FTPDATA&#xA; service tcp destination eq ftp-data &#xA;object service HTTP&#xA; service tcp destination eq www &#xA;object network DMZ_FTP&#xA; host 192.168.20.2&#xA;object network DMZ_FTP_DATA&#xA; host 192.168.20.2&#xA;object network DMZ_HTTP&#xA; host 192.168.20.2&#xA;object network INSIDE&#xA; subnet 192.168.1.0 255.255.255.0&#xA;object network DMZ&#xA; subnet 192.168.20.0 255.255.255.0&#xA;object network TEAM4SRV_FTP&#xA; host 192.168.20.2&#xA;object network TEAM4FTP_DATA&#xA; host 192.168.20.2&#xA;object network NETWORK_OBJ_192.168.1.0_24&#xA; subnet 192.168.1.0 255.255.255.0&#xA;object network TEAM4SRV&#xA; host 192.168.20.2&#xA;object-group service Server tcp&#xA; description ServerServices&#xA; port-object eq ftp&#xA; port-object eq ftp-data&#xA; port-object eq www&#xA; port-object eq https&#xA;object-group user DM_INLINE_USER_1&#xA; user LOCAL\kriss&#xA; user LOCAL\alberto&#xA; user LOCAL\user1&#xA;object-group service DMZ_SERVICES tcp&#xA; port-object eq ftp&#xA; port-object eq ftp-data&#xA; port-object eq www&#xA; port-object eq https&#xA;object-group icmp-type all&#xA; icmp-object alternate-address&#xA; icmp-object conversion-error&#xA; icmp-object echo&#xA; icmp-object echo-reply&#xA; icmp-object information-reply&#xA; icmp-object information-request&#xA; icmp-object mask-reply&#xA; icmp-object mask-request&#xA; icmp-object mobile-redirect&#xA; icmp-object parameter-problem&#xA; icmp-object redirect&#xA; icmp-object router-advertisement&#xA; icmp-object router-solicitation&#xA; icmp-object source-quench&#xA; icmp-object time-exceeded&#xA; icmp-object timestamp-reply&#xA; icmp-object timestamp-request&#xA; icmp-object traceroute&#xA; icmp-object unreachable&#xA;object-group service Radius udp&#xA; port-object eq 1812&#xA; port-object eq 1813&#xA;object-group service DM_INLINE_UDP_1 udp&#xA; group-object Radius&#xA; port-object eq radius&#xA; port-object eq radius-acct&#xA;object-group service DMZ_OUTS tcp&#xA; group-object DMZ_SERVICES&#xA;access-list inside_access_in extended permit udp any host 192.168.20.2 object-group DM_INLINE_UDP_1 &#xA;access-list inside_access_in extended permit tcp any any eq ssh &#xA;access-list inside_access_in extended permit icmp any interface outside object-group all &#xA;access-list inside_access_in extended permit icmp any any object-group all &#xA;access-list Vpnsplittunnel standard permit 192.168.1.0 255.255.255.0 &#xA;access-list outside_VPN extended permit ip object-group-user DM_INLINE_USER_1 any interface inside &#xA;access-list outside_access_in extended permit tcp 10.177.5.0 255.255.255.0 host 192.168.20.2 object-group DMZ_SERVICES &#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu DMZ 1500&#xA;mtu outside 1500&#xA;mtu management 1500&#xA;ip local pool VPNpool 192.168.1.100-192.168.1.200 mask 255.255.255.0&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;icmp permit 192.168.20.0 255.255.255.0 inside&#xA;icmp permit 192.168.1.0 255.255.255.0 inside&#xA;icmp permit 192.168.1.0 255.255.255.0 DMZ&#xA;icmp permit 192.168.20.0 255.255.255.0 DMZ&#xA;asdm history enable&#xA;arp timeout 14400&#xA;nat (inside,outside) source static INSIDE INSIDE destination static INSIDE INSIDE&#xA;!&#xA;object network INSIDE&#xA; nat (inside,outside) dynamic interface&#xA;object network DMZ&#xA; nat (DMZ,outside) dynamic interface&#xA;object network TEAM4SRV_FTP&#xA; nat (DMZ,outside) static interface service tcp ftp ftp &#xA;object network TEAM4FTP_DATA&#xA; nat (DMZ,outside) static interface service tcp ftp-data ftp-data &#xA;object network TEAM4SRV&#xA; nat (DMZ,outside) static interface service tcp www www &#xA;access-group inside_access_in in interface inside&#xA;access-group outside_access_in in interface outside&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;aaa-server RADIUSSERVICE protocol radius&#xA;aaa-server RADIUSSERVICE (DMZ) host 192.168.20.3&#xA; key 8 UEoeA/tsg6z2QuaAy0bsBrMUaJNBYq1o5DMu9+1GHw==&#xA; authentication-port 1812&#xA; accounting-port 1813&#xA;user-identity default-domain LOCAL&#xA;http server enable&#xA;http 192.168.10.0 255.255.255.0 management&#xA;http 192.168.1.0 255.255.255.0 inside&#xA;http 10.0.0.0 255.0.0.0 outside&#xA;http 192.168.20.0 255.255.255.0 DMZ&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec ikev2 ipsec-proposal DES&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES192&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1 md5&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map outside_map interface outside&#xA;crypto ca trustpoint ASDM_TrustPoint0&#xA; enrollment self&#xA; subject-name CN=Team4-RTR-01&#xA; keypair def2&#xA; proxy-ldc-issuer&#xA; crl configure&#xA;crypto ca certificate chain ASDM_TrustPoint0&#xA; certificate deadbeef01&#xA;    abcdefg&#xA;  quit&#xA;crypto ikev2 policy 1&#xA; encryption aes-256&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 10&#xA; encryption aes-192&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 20&#xA; encryption aes&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 30&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 40&#xA; encryption des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 enable outside client-services port 443&#xA;crypto ikev2 remote-access trustpoint ASDM_TrustPoint0&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 policy 10&#xA; authentication crack&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 20&#xA; authentication rsa-sig&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 30&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 40&#xA; authentication crack&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 50&#xA; authentication rsa-sig&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 60&#xA; authentication pre-share&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 70&#xA; authentication crack&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 80&#xA; authentication rsa-sig&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 90&#xA; authentication pre-share&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 100&#xA; authentication crack&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 110&#xA; authentication rsa-sig&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 120&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 130&#xA; authentication crack&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 140&#xA; authentication rsa-sig&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 150&#xA; authentication pre-share&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;management-access inside&#xA;dhcpd address 192.168.1.20-192.168.1.99 inside&#xA;dhcpd enable inside&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;tftp-server inside 192.168.1.10 anyconnect-win-3.1.00495-k9.pkg&#xA;ssl trust-point ASDM_TrustPoint0 outside&#xA;webvpn&#xA; enable outside&#xA; no anyconnect-essentials&#xA; csd image disk0:/csd_3.6.6249-k9.pkg&#xA; csd hostscan image disk0:/hostscan_3.1.04060-k9.pkg&#xA; csd enable&#xA; anyconnect image disk0:/anyconnect-win-3.1.00495-k9.pkg 1&#xA; anyconnect image disk0:/anyconnect-linux-3.1.00495-k9.pkg 2&#xA; anyconnect image disk0:/anyconnect-macosx-i386-3.1.00495-k9.pkg 3&#xA; anyconnect profiles Test_client_profile disk0:/Test_client_profile.xml&#xA; anyconnect profiles anyconnectprofile disk0:/anyconnectprofile.xml&#xA; anyconnect enable&#xA; tunnel-group-list enable&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless&#xA; default-domain value Team4.com&#xA;group-policy VPNTracking internal&#xA;group-policy VPNTracking attributes&#xA; vpn-tunnel-protocol ikev1 l2tp-ipsec &#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value Vpnsplittunnel&#xA; address-pools value VPNpool&#xA;username user1 password foobarme nt-encrypted&#xA;username user1 attributes&#xA; vpn-group-policy VPNTracking&#xA;tunnel-group DefaultWEBVPNGroup general-attributes&#xA; authentication-server-group RADIUSSERVICE LOCAL&#xA; secondary-authentication-server-group RADIUSSERVICE&#xA;tunnel-group DefaultWEBVPNGroup webvpn-attributes&#xA; group-alias DefualtWEBVpnAlias enable&#xA;tunnel-group VPNTracker type remote-access&#xA;tunnel-group VPNTracker general-attributes&#xA; default-group-policy VPNTracking&#xA;tunnel-group VPNTracker ipsec-attributes&#xA; ikev1 pre-shared-key 8 z0WDcMlMw7/+alToidyipWBfRUkb7fD6UsnoC6iu&#xA;!&#xA;class-map global-class&#xA; match port udp range 1812 1813&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; description Radius&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect icmp &#xA;  inspect icmp error &#xA; class global-class&#xA;  inspect ip-options &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;password encryption aes&#xA;hpm topN enable&#xA;Cryptochecksum:fce108bc42addd8ecca618ea1f6d8672&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Logs: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6|Aug 12 2013|11:59:46|725007|10.177.5.80|50673|||SSL session with client outside:10.177.5.80/50673 terminated.&#xA;6|Aug 12 2013|11:59:46|302014|10.177.5.80|50673|10.177.5.40|443|Teardown TCP connection 2288 for outside:10.177.5.80/50673 to identity:10.177.5.40/443 duration 0:00:08 bytes 12563 TCP Reset-O&#xA;6|Aug 12 2013|11:59:45|725002|10.177.5.80|50677|||Device completed SSL handshake with client outside:10.177.5.80/50677&#xA;6|Aug 12 2013|11:59:45|725001|10.177.5.80|50677|||Starting SSL handshake with client outside:10.177.5.80/50677 for TLSv1 session.&#xA;6|Aug 12 2013|11:59:45|302013|10.177.5.80|50677|10.177.5.40|443|Built inbound TCP connection 2295 for outside:10.177.5.80/50677 (10.177.5.80/50677) to identity:10.177.5.40/443 (10.177.5.40/443)&#xA;6|Aug 12 2013|11:59:45|106015|10.177.5.80|50676|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50676 to 10.177.5.40/443 flags FIN ACK  on interface outside&#xA;6|Aug 12 2013|11:59:45|302014|10.177.5.80|50676|10.177.5.40|443|Teardown TCP connection 2291 for outside:10.177.5.80/50676 to identity:10.177.5.40/443 duration 0:00:05 bytes 1251 TCP Reset-O&#xA;6|Aug 12 2013|11:59:45|725007|10.177.5.80|50676|||SSL session with client outside:10.177.5.80/50676 terminated.&#xA;6|Aug 12 2013|11:59:42|106015|10.177.5.80|50671|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50671 to 10.177.5.40/443 flags FIN PSH ACK  on interface outside&#xA;6|Aug 12 2013|11:59:40|106015|10.177.5.80|50671|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50671 to 10.177.5.40/443 flags FIN PSH ACK  on interface outside&#xA;6|Aug 12 2013|11:59:40|725002|10.177.5.80|50676|||Device completed SSL handshake with client outside:10.177.5.80/50676&#xA;6|Aug 12 2013|11:59:40|725001|10.177.5.80|50676|||Starting SSL handshake with client outside:10.177.5.80/50676 for TLSv1 session.&#xA;6|Aug 12 2013|11:59:40|302013|10.177.5.80|50676|10.177.5.40|443|Built inbound TCP connection 2291 for outside:10.177.5.80/50676 (10.177.5.80/50676) to identity:10.177.5.40/443 (10.177.5.40/443)&#xA;6|Aug 12 2013|11:59:39|106015|10.177.5.80|50671|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50671 to 10.177.5.40/443 flags FIN PSH ACK  on interface outside&#xA;6|Aug 12 2013|11:59:38|106015|10.177.5.80|50671|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50671 to 10.177.5.40/443 flags FIN PSH ACK  on interface outside&#xA;6|Aug 12 2013|11:59:38|725002|10.177.5.80|50673|||Device completed SSL handshake with client outside:10.177.5.80/50673&#xA;6|Aug 12 2013|11:59:38|725001|10.177.5.80|50673|||Starting SSL handshake with client outside:10.177.5.80/50673 for TLSv1 session.&#xA;6|Aug 12 2013|11:59:38|302013|10.177.5.80|50673|10.177.5.40|443|Built inbound TCP connection 2288 for outside:10.177.5.80/50673 (10.177.5.80/50673) to identity:10.177.5.40/443 (10.177.5.40/443)&#xA;6|Aug 12 2013|11:59:38|106015|10.177.5.80|50671|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50671 to 10.177.5.40/443 flags FIN ACK  on interface outside&#xA;6|Aug 12 2013|11:59:38|302014|10.177.5.80|50671|10.177.5.40|443|Teardown TCP connection 2285 for outside:10.177.5.80/50671 to identity:10.177.5.40/443 duration 0:00:01 bytes 8905 TCP Reset-O&#xA;6|Aug 12 2013|11:59:38|725007|10.177.5.80|50671|||SSL session with client outside:10.177.5.80/50671 terminated.&#xA;6|Aug 12 2013|11:59:37|725002|10.177.5.80|50671|||Device completed SSL handshake with client outside:10.177.5.80/50671&#xA;6|Aug 12 2013|11:59:37|725001|10.177.5.80|50671|||Starting SSL handshake with client outside:10.177.5.80/50671 for TLSv1 session.&#xA;6|Aug 12 2013|11:59:37|106015|10.177.5.80|50670|10.177.5.40|443|Deny TCP (no connection) from 10.177.5.80/50670 to 10.177.5.40/443 flags FIN ACK  on interface outside&#xA;6|Aug 12 2013|11:59:37|302013|10.177.5.80|50671|10.177.5.40|443|Built inbound TCP connection 2285 for outside:10.177.5.80/50671 (10.177.5.80/50671) to identity:10.177.5.40/443 (10.177.5.40/443)&#xA;6|Aug 12 2013|11:59:37|302014|10.177.5.80|50670|10.177.5.40|443|Teardown TCP connection 2284 for outside:10.177.5.80/50670 to identity:10.177.5.40/443 duration 0:00:05 bytes 1251 TCP Reset-O&#xA;6|Aug 12 2013|11:59:37|725007|10.177.5.80|50670|||SSL session with client outside:10.177.5.80/50670 terminated.&#xA;6|Aug 12 2013|11:59:35|302014|10.177.5.80|50664|10.177.5.40|443|Teardown TCP connection 2282 for outside:10.177.5.80/50664 to identity:10.177.5.40/443 duration 0:00:05 bytes 1109 TCP Reset-I&#xA;6|Aug 12 2013|11:59:35|725007|10.177.5.80|50664|||SSL session with client outside:10.177.5.80/50664 terminated.&#xA;6|Aug 12 2013|11:59:31|725007|10.177.5.80|50654|||SSL session with client outside:10.177.5.80/50654 terminated.&#xA;6|Aug 12 2013|11:59:31|302014|10.177.5.80|50654|10.177.5.40|443|Teardown TCP connection 2281 for outside:10.177.5.80/50654 to identity:10.177.5.40/443 duration 0:03:17 bytes 37709 TCP Reset-O&#xA;6|Aug 12 2013|11:59:31|725002|10.177.5.80|50670|||Device completed SSL handshake with client outside:10.177.5.80/50670&#xA;6|Aug 12 2013|11:59:31|725001|10.177.5.80|50670|||Starting SSL handshake with client outside:10.177.5.80/50670 for TLSv1 session.&#xA;6|Aug 12 2013|11:59:31|302013|10.177.5.80|50670|10.177.5.40|443|Built inbound TCP connection 2284 for outside:10.177.5.80/50670 (10.177.5.80/50670) to identity:10.177.5.40/443 (10.177.5.40/443)&#xA;6|Aug 12 2013|11:59:29|725002|10.177.5.80|50665|||Device completed SSL handshake with client outside:10.177.5.80/50665&#xA;6|Aug 12 2013|11:59:29|725002|10.177.5.80|50664|||Device completed SSL handshake with client outside:10.177.5.80/50664&#xA;6|Aug 12 2013|11:59:29|725001|10.177.5.80|50665|||Starting SSL handshake with client outside:10.177.5.80/50665 for TLSv1 session.&#xA;6|Aug 12 2013|11:59:29|725001|10.177.5.80|50664|||Starting SSL handshake with client outside:10.177.5.80/50664 for TLSv1 session.&#xA;6|Aug 12 2013|11:59:29|302013|10.177.5.80|50665|10.177.5.40|443|Built inbound TCP connection 2283 for outside:10.177.5.80/50665 (10.177.5.80/50665) to identity:10.177.5.40/443 (10.177.5.40/443)&#xA;6|Aug 12 2013|11:59:29|302013|10.177.5.80|50664|10.177.5.40|443|Built inbound TCP connection 2282 for outside:10.177.5.80/50664 (10.177.5.80/50664) to identity:10.177.5.40/443 (10.177.5.40/443)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;`&lt;/p&gt;&#xA;" OwnerUserId="3280" LastEditorUserId="775" LastEditDate="2014-01-10T14:25:19.650" LastActivityDate="2015-11-05T05:12:46.870" Title="VPN ASA issues loading from website" Tags="|cisco-asa|vpn|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5793" PostTypeId="1" CreationDate="2014-01-10T15:08:28.120" Score="3" ViewCount="1423" Body="&lt;p&gt;We're considering increasing the hold-queue size on an interface showing excessively high output drops from the default 40 to something like 100 or 200.  Will this command have any effect on a 6509-VSS running 12.2(33)SXI3?  We've exhausted all other options and tried to spread out our ASIC load as much as possible, but we think that sometimes congestion in other areas of the switch is contributing to microbursts.&lt;/p&gt;&#xA;" OwnerUserId="43" LastActivityDate="2014-01-10T22:54:10.087" Title="When experiencing high output drops on 6509 without QoS enabled, will hold-queue xxx out be respected?" Tags="|cisco-catalyst|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5794" PostTypeId="2" ParentId="2939" CreationDate="2014-01-10T15:56:41.383" Score="2" Body="&lt;p&gt;I use an SG300 at home as my core switch. Getting SSH set up is not too bad:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;crypto key generate rsa&#xA;ip ssh server&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That will generate the SSH key and enable the SSH server. If you question-mark your way along those command structures you will find some options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can view the public and private RSA SSH keys with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show crypto key rsa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've not done an SSL cert import myself, but looking through the CLI I'd take a stab at the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;crypto certificate 1 import&#xA;ip https certificate 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are two &quot;slots&quot; for certificates, so you can specify slot 1 or 2 for the import or a self-signed certificate generation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The import function does not seem to have an option to install a PKCS12 certificate, so you may need to import the private key separately with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;crypto key import rsa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not 100% sure on the SSL setup, but the SSH key setup above works.&lt;/p&gt;&#xA;" OwnerUserId="1581" LastActivityDate="2014-01-10T15:56:41.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5796" PostTypeId="2" ParentId="5755" CreationDate="2014-01-10T16:24:05.197" Score="1" Body="&lt;p&gt;I use &lt;a href=&quot;http://www.macvendorlookup.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.macvendorlookup.com/&lt;/a&gt; on an almost daily basis to aid in forensics. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I.e. If you have a mac address you can them obtain the manufacturer to guess at what the machine is. Then you can use only that mac address to find out other information&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MY-IDF-2960-241#sho mac address-table interface f0/25&#xA;          Mac Address Table&#xA;-------------------------------------------&#xA;Vlan    Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA;  48    0010.492b.dbcb    DYNAMIC     Fa0/25&#xA; 100    b8ca.3aa5.6f77    DYNAMIC     Fa0/25&#xA;Total Mac Addresses for this criterion: 2&#xA;MY-IDF-2960-241#&#xA;&#xA;MY-MDF-4500X-1#sho arp | in 6f77&#xA;Internet  10.220.103.1            0   b8ca.3aa5.6f77  ARPA   Vlan100&#xA;MY-MDF-4500X-1#&#xA;&#xA;C:\Users\superstar&amp;gt;ping -a 10.220.103.1&#xA;Pinging XXX-XXXX-WWK.supersecretdomainname.local [10.220.103.1] with 32 bytes&#xA;of data:&#xA;Reply from 10.220.103.1: bytes=32 time&amp;lt;1ms TTL=128&#xA;Reply from 10.220.103.1: bytes=32 time&amp;lt;1ms TTL=128&#xA;Reply from 10.220.103.1: bytes=32 time&amp;lt;1ms TTL=128&#xA;Reply from 10.220.103.1: bytes=32 time&amp;lt;1ms TTL=128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the above example I took the mac address off of a port, found its IP via arp entries on my core switch, then found the hostname via a &quot;ping -a&quot; from my workstation. &lt;a href=&quot;http://www.macvendorlookup.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.macvendorlookup.com/&lt;/a&gt; lets us know that the mac was made by Dell so at this point we can&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Logically locate the machine on the network&lt;br&gt;&#xA;2) Physically locate the machine on premises&lt;br&gt;&#xA;3) test further for open tcp ports to the host to guess what operating system is running&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may seem like a lengthy process but you can get quite fast at it and it definitely helps when you're mapping out the network of a new client. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. If you look up the other mac address from my post, you can probably determine something else about the network I pull this output from. &lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2014-01-10T16:24:05.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5797" PostTypeId="2" ParentId="5792" CreationDate="2014-01-10T18:08:49.060" Score="2" Body="&lt;p&gt;The issue was bad switch port/cable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though the ping indicated 2% loss over 1000 pings there were enouph to create the issue. &lt;/p&gt;&#xA;" OwnerUserId="3280" LastActivityDate="2014-01-10T18:08:49.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5800" PostTypeId="1" AcceptedAnswerId="5811" CreationDate="2014-01-10T19:07:58.790" Score="2" ViewCount="10630" Body="&lt;p&gt;I've successfully created a AnyConnect VPN configuration on my Cisco ASA and it authenticates to RSA secureID to use the token code. However what I'd like to do now is an AD lookup on the username and based on what group they are in, assign them the correct group-policy. I know this isn't possible using ACS. I'm not sure if RSA has this capabilities. Perhaps the ASA can do this using identity firewall?&lt;/p&gt;&#xA;" OwnerUserId="949" LastActivityDate="2016-07-18T03:21:57.153" Title="Cisco ASA AnyConnect - Authenticate using RSA token, Assign policy based on AD Group" Tags="|cisco-asa|cisco-anyconnect|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5801" PostTypeId="2" ParentId="5800" CreationDate="2014-01-10T21:02:40.950" Score="5" Body="&lt;p&gt;My understanding is that when using the SDI protocol for RSA integration, you cannot pass group/class info. However, if you reach the RSA server using RADIUS, then the RSA server can be configured to return a RADIUS Class attribute of the format &quot;OU=group-policy-name;&quot; which is then used to match a group-policy name in the ASA config. I've done it this way with another customer. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa-server RSA protocol radius&#xA;aaa-server RSA (inside) host 10.1.1.50&#xA; key *****&#xA; authentication-port 1812&#xA; accounting-port 1813&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, you would have a group-policy that fails closed (I usually call it &quot;NOACCESS&quot;) that sets &quot;vpn-simultaneous-logins&quot; to 0 which drops the connection, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;group-policy NOACCESS internal&#xA;group-policy NOACCESS attributes&#xA; vpn-simultaneous-logins 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You would then have one or more group-policies that describe your VPN users and override the &quot;vpn-simultaneous-logins&quot; value with a non-zero value (I usually set it back to the default value of 3), like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;group-policy Users internal&#xA;group-policy Users attributes&#xA; vpn-simultaneous-logins 3&#xA; &amp;lt;other VPN policy settings go here&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, your tunnel-group would be set to use the RSA server (via RADIUS) for the authentication server, and then the default group policy is set to the &quot;NOACCESS&quot; group to force the group to fail closed if the RADIUS Class value isn't returned:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tunnel-group RA-VPN type remote-access&#xA;tunnel-group RA-VPN general-attributes&#xA; authentication-server-group RSA&#xA; default-group-policy NOACCESS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The important notes with this solution are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The Class attribute returned by RADIUS must be (without quotes, note the very important semi-colon) &quot;OU=group-policy-name;&quot;&lt;/li&gt;&#xA;&lt;li&gt;The &quot;group-policy-name&quot; returned in the Class attribute must be an &lt;em&gt;exact&lt;/em&gt; match for the group-policy name configured in the ASA, including matching case.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The behavior is that the user's session will inherit the default group-policy value of &quot;NOACCESS&quot; and be assigned the attribute of &quot;vpn-simultaneous-logins 0&quot; if no matching RADIUS Class attribute is returned. If a Class attribute which matches the name of a group-policy in the ASA is returned, the user session is assigned &lt;em&gt;that&lt;/em&gt; group-policy instead, which then overrides the inherited default &quot;vpn-simultaneous-logins&quot; value and allows them to continue their login.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used this RADIUS configuration regularly for years, and a customer I worked with discovered the RSA requirement that RADIUS be used to pass the Class attribute for group assignment. Unfortunately I do not know the RSA setup to do the group mapping or return the attributes, but &lt;a href=&quot;http://supportforums.cisco.com/thread/215352&quot; rel=&quot;noreferrer&quot;&gt;this thread&lt;/a&gt; and &lt;a href=&quot;http://supportforums.cisco.com/thread/2056465&quot; rel=&quot;noreferrer&quot;&gt;this thread&lt;/a&gt; may prove helpful there.&lt;/p&gt;&#xA;" OwnerUserId="1581" LastActivityDate="2014-01-10T21:02:40.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5802" PostTypeId="2" ParentId="5793" CreationDate="2014-01-10T22:54:10.087" Score="2" Body="&lt;p&gt;Without knowing much about your topology, I'll give you two things to consider:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Are the output queue drops noticeable to whatever the higher level application is?  Often times we'll chase things in that we saw in our network management tool that look bad, but aren't really causing problems.  TCP is designed to behave like this - push the network to the limit and then back off.  So if you have a reasonable QoS policy in place to ensure that priority (generally real-time) packets aren't being dropped then output queue drops can just be par for the course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) If you are noticing issues related to the output queue drop then your options are limited.  There is fundamentally an oversubscription problem here - likely you're feeding multiple 1G down a single 1G pipe or perhaps a 10G is down-stepping to a 1G pipe.  IIRC the 6500 has something around 2Mb of buffer per port, and you're overrunning that continuously.  There isn't a software command that's going to fix this for you (assuming you are already prioritizing the appropriate traffic down this link) - its time to increase the bandwidth.  Again we don't know much about your environment, but look at moving from 1G to 10G, or to creating a port channel.  &lt;/p&gt;&#xA;" OwnerUserId="1104" LastActivityDate="2014-01-10T22:54:10.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5803" PostTypeId="1" AcceptedAnswerId="5804" CreationDate="2014-01-11T02:43:12.587" Score="5" ViewCount="624" Body="&lt;p&gt;What is the meaning of the new JunOS version numbers in the 12.1 line?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;12.1X44&lt;/li&gt;&#xA;&lt;li&gt;12.1X45&lt;/li&gt;&#xA;&lt;li&gt;12.1X46&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What does the XNN mean? How can I tell which one I want?&lt;/p&gt;&#xA;" OwnerUserId="500" LastActivityDate="2014-02-22T01:44:24.960" Title="Newer JunOS Versions numbers" Tags="|juniper|juniper-junos|srx|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5804" PostTypeId="2" ParentId="5803" CreationDate="2014-01-11T03:23:49.180" Score="6" Body="&lt;p&gt;X indicates that it is a aggressive feature train per &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB27144&quot;&gt;KB27144&lt;/a&gt; and &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=TSB16034&quot;&gt;TSB16034&lt;/a&gt;. The NN is a normal incremental version number. &lt;/p&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2014-01-11T03:23:49.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5805" PostTypeId="1" AcceptedAnswerId="5807" CreationDate="2014-01-11T05:52:44.597" Score="1" ViewCount="12186" Body="&lt;p&gt;Just purchased the MikroTik &quot;Cloud Router Switch&quot; (CRS125-24G-15-2HnD-IN) with the possible misunderstanding that I could define multiple networks within the router and assign various switch ports to the various networks.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is to support a small multi-node OpenStack lab and I wanted to divide the 24 ports into 3 different networks.  I've never used RouterOS before and can't figure out how to do this in &quot;WebFig&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible?  If so, how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="3851" LastEditorUserId="8499" LastEditDate="2018-02-14T16:37:56.503" LastActivityDate="2018-02-14T16:37:56.503" Title="Can I run multiple networks on this MikroTik L3 switch?" Tags="|lab|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-09T23:58:42.443" ContentLicense="CC BY-SA 3.0" />
  <row Id="5806" PostTypeId="1" CreationDate="2014-01-11T06:27:21.163" Score="7" ViewCount="6883" Body="&lt;p&gt;I'm looking at WLAN traffic captured from wireshark on monitor mode and notice that out of the 67,000 probe requests, 99.08% have the destination set to FF:FF:FF:FF:FF:FF (Broadcast). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is, it appears as though a substantial chunk of those 67K Probe Requests were directed to specific SSIDs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is, if a Probe Request is directed to a specific SSID, shouldn't the destination address be included?&lt;/strong&gt;  (and not the generic 'Broadcast' destination)&lt;/p&gt;&#xA;" OwnerUserId="3852" LastEditorUserId="775" LastEditDate="2018-04-30T12:37:35.617" LastActivityDate="2018-04-30T12:37:35.617" Title="Why Don’t Probe Requests for Specific SSIDs include BSSIDs" Tags="|wireless|wireshark|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5807" PostTypeId="2" ParentId="5805" CreationDate="2014-01-11T07:42:51.043" Score="6" Body="&lt;p&gt;Assuming you don't specifically need VLANs you'd pick one port to be the master port for each group and set it to be the master port for every other port in the group. Ports with the same master port are isolated from ports with a different master port. Then you set a IP address on the master port for routing (if necessary).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you assume three groups of three ports (2-4, 5-7, 8-10) you'd do the following (note that I'm using CLI terminology so if I write /interface ethernet set master-port=ether2 where name=ether3 and you are using webfig or winbox you'd click on interface, go to the ethernet tab, click on ether3, and change the master-port option):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface ethernet set ether3 master-port=ether2&#xA;/interface ethernet set ether4 master-port=ether2&#xA;/interface ethernet set ether6 master-port=ether5 &#xA;/interface ethernet set ether7 master-port=ether5&#xA;/interface ethernet set ether8 master-port=ether8&#xA;/interface ethernet set ether9 master-port=ether8&#xA;&#xA;/ip address add address=192.168.1.1/24 interface=ether2&#xA;/ip address add address=192.168.2.1/24 interface=ether5&#xA;/ip address add address=192.168.3.1/24 interface=ether8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Mikrotik's &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual%3aCRS_examples&quot;&gt;CRS example page&lt;/a&gt; has more examples along with a example if you need VLAN support.&#xA;If you need routing between switch groups or VLANs be aware that &lt;a href=&quot;http://i.mt.lv/routerboard/files/CRS125-131112144114.pdf&quot;&gt;per the block diagram&lt;/a&gt; there is only a single 1G connection between the routing engine and the switch chip.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastEditorUserId="1563" LastEditDate="2014-01-11T18:18:26.733" LastActivityDate="2014-01-11T18:18:26.733" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5808" PostTypeId="2" ParentId="5806" CreationDate="2014-01-11T10:06:36.287" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is, if a Probe Request is directed to a specific SSID, shouldn't the destination address be included?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, SSID probes are normally broadcast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probe requests are either broadast or unicast check to see whether an SSID is in range.  It's like the NIC is continuously asking &quot;is anybody there?&quot;, or &quot;is Bob there?&quot;.  Since many companies deploy multiple APs on the same SSID, it makes sense to broadcast SSID probes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Tangent&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that if you visit a restaurant / hotel and connect to their free wifi using your phone, that SSID is cached indefinitely and your phone will continuously broadcast that SSID to check whether the AP might be in range now.  By using a wireless sniffer, you can discover a lot about a person's habits just by watching the probe requests from their phone.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-01-11T10:06:36.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5809" PostTypeId="2" ParentId="1665" CreationDate="2014-01-11T21:08:10.707" Score="4" Body="&lt;p&gt;To complete this, here is what I have for the 1841 running 12.4(24)T8, which has a bug for HTTP inspection over IPv6, so a work-around ACL is provided.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 unicast-routing&#xA;ipv6 cef&#xA;ipv6 dhcp pool ComcastPool&#xA; prefix-delegation pool comcast-ipv6&#xA; dns-server &amp;lt;IPv6-IP&amp;gt;&#xA; domain-name internal.domain&#xA;ipv6 inspect name traffic ftp&#xA;ipv6 inspect name traffic udp&#xA;ipv6 inspect name traffic icmp&#xA;&#xA;interface FastEthernet0/0&#xA; ipv6 address dhcp&#xA; ipv6 address autoconfig default&#xA; ipv6 enable&#xA; ipv6 traffic-filter wan-in in&#xA; ipv6 traffic-filter wan-out out&#xA; ipv6 verify unicast reverse-path&#xA; ipv6 dhcp client pd comcast-ipv6&#xA; ipv6 inspect traffic out&#xA;&#xA;interface FastEthernet0/1&#xA; ipv6 address comcast-ipv6 ::1/64&#xA; ipv6 address autoconfig&#xA; ipv6 enable&#xA; ipv6 nd other-config-flag&#xA; ipv6 dhcp server ComcastPool&#xA;&#xA;ipv6 access-list wan-in&#xA; permit icmp any any&#xA; permit udp any any eq 546&#xA; permit tcp any any established&#xA; sequence 100 deny ipv6 any any&#xA;&#xA;ipv6 access-list wan-out&#xA; permit icmp any any&#xA; permit tcp any any&#xA; permit udp any any&#xA; sequence 100 deny ipv6 any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user1569" LastActivityDate="2014-01-11T21:08:10.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5810" PostTypeId="2" ParentId="5806" CreationDate="2014-01-11T23:18:06.830" Score="10" Body="&lt;p&gt;To understand the answer to this question, you need to understand some wireless terminology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;service set identifier&lt;/em&gt; or SSID is the logical (i.e. human readable) name used by a wireless network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;basic service set&lt;/em&gt; or BSS consists of a single access point (or virtual access point) and any stations associated to the AP (VAP).  Each WLAN that an AP provides service for will use a 48-bit address as the BSSID for the BSS, which is very similar to a MAC address (and may use the MAC address of the AP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;extended service set&lt;/em&gt; or ESS consists of one or more BSS connected to the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SSID is actually more related to the ESS than the BSS, and most client devices don't care which specific BSS they join, rather they look to join the ESS.  This is very advantageous in multiple AP environments as this allows the station to choose a better AP to connect (rather than a specific BSSID which may be further away with weaker signal/lower performance).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some clients (especially most *nix based clients) will actually allow you to optionally select a BSSID as well.  This can be more secure as it will prevent your client from connecting to a &quot;rogue&quot; access point that is broadcasting the same SSID as the network you expect to connect.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-01-14T04:21:50.997" LastActivityDate="2014-01-14T04:21:50.997" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5811" PostTypeId="2" ParentId="5800" CreationDate="2014-01-12T19:11:20.297" Score="4" Body="&lt;p&gt;I was able to figure this out within ACS. The missing piece was that I needed to create an identity store sequence. This allows me to authenticate to one place (RSA) and do an additional attribute lookup in another place (AD).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help though. You guys made me think of it differently which ultimately solved it!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information on this topic can be found at Cisco's website, &lt;a href=&quot;http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_system/5.2/user/guide/users_id_stores.html&quot; rel=&quot;nofollow&quot;&gt;Managing Users and Identity Stores&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="949" LastEditorUserId="3191" LastEditDate="2014-03-20T17:37:33.383" LastActivityDate="2014-03-20T17:37:33.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5812" PostTypeId="1" AcceptedAnswerId="5813" CreationDate="2014-01-12T21:47:47.017" Score="5" ViewCount="364" Body="&lt;p&gt;Let's consider a webfarm where each server has two interfaces: one bound to an internal-only, physically separated, network and the other cabled to the switch with the uplink to the public Internet. This second interface is used only when it is necessary to expose the server on public network, and is not connected otherwise (for example, on a database server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What kind of IPv6 addresses should be used on this internal-only network, considered that &quot;site-local&quot; addresses are gone? Are &quot;unique-local&quot; addresses established enough so that they won't be deprecated like the &quot;site-local&quot; ones?&lt;/p&gt;&#xA;" OwnerUserId="3861" LastEditorUserId="775" LastEditDate="2014-01-12T22:06:14.023" LastActivityDate="2014-01-12T23:40:47.270" Title="IPv6 unique-local addresses suitable for internal networks" Tags="|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5813" PostTypeId="2" ParentId="5812" CreationDate="2014-01-12T23:40:47.270" Score="14" Body="&lt;p&gt;Yes, ULA (Unique Local Addresses) are the way to go. The site-local addresses were deprecated because every site would use the same addresses, which would cause conflicts when setting up VPNs or when e.g. merging companies. ULA was designed to solve this and replace site-local.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-01-12T23:40:47.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5818" PostTypeId="1" AcceptedAnswerId="5819" CreationDate="2014-01-13T13:29:02.340" Score="8" ViewCount="7298" Body="&lt;p&gt;I have two Cisco Catalyst 2960-24TC-L switches and would like to connect them using fibre over a distance of 200Meters. According to cisco, the switches has two SFP ports, which I can clearly see on them but my issue is I do not know where or how to proceed knowing that I am not into networking at all. All I want to do is to make sure I am on the same page with the network engineer I will be contracting so they wont be here telling me what they want and not what we need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be highly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="3869" LastActivityDate="2016-12-10T05:50:47.247" Title="Connecting two different Cisco Switches using Fibre" Tags="|switch|cisco-catalyst|fiber|sfp|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5819" PostTypeId="2" ParentId="5818" CreationDate="2014-01-13T13:40:18.380" Score="11" Body="&lt;p&gt;You can use short range SFP optics for this.  The Cisco part number is GLC-SX-MM, and the cost is about $75-$100 each (you'll need two).  The person installing your fiber should use 50uM multimode fiber (62.5uM is also useable, but you're getting close to the maximum range) with LC type connectors.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-13T13:40:18.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5823" PostTypeId="1" AcceptedAnswerId="5833" CreationDate="2014-01-13T21:26:48.090" Score="5" ViewCount="9671" Body="&lt;p&gt;How to trace a MAC address on a switched LAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to be able to find out a switch port's MAC address.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;No device uses IP, therefore no address resolution and no SNMP.&lt;/li&gt;&#xA;&lt;li&gt;No device runs CDP, therefore no Cisco L2 traceroute.&lt;/li&gt;&#xA;&lt;li&gt;No fancy tools on my laptop available.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Topology: There are 10 switches. One is in the center. It is connected to four other switches. Each of those four switches is connected to another switch. Each switch in the third row has three end devices attached. All devices are connected via switching port, except end devices which use their NIC. I cannot change the topology. But I can hang on to whatever device I want and change its configuration as far as I do not assign an IP address to a switch or enable CDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firmware: Cisco Catalyst 2950-24 IOS C2950-I6Q4L2-M 12.1(22)EA4. That's the one Packet Tracer simulates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, I did read the question &lt;em&gt;Locate a host on Network&lt;/em&gt;. This question may be answered with a simple no.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="3163" LastEditDate="2014-01-13T23:22:09.303" LastActivityDate="2020-09-22T14:08:55.890" Title="How to trace a MAC address on a switched LAN?" Tags="|mac-address|layer2|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="5824" PostTypeId="2" ParentId="5818" CreationDate="2014-01-13T22:17:06.627" Score="5" Body="&lt;p&gt;You can check  &lt;a href=&quot;https://www.cisco.com/en/US/prod/collateral/modules/ps5455/ps6577/product_data_sheet0900aecd8033f885.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco SFP Modules for Gigabit Ethernet Applications Data Sheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There you can see that 1000Base-SX SFP (part-number GLC-SX-MM) using 62.5 um MMF reaches 220 or 270 meters (depending on modal bandwidth of the fiber). However, if switches are 200 meters apart it could be easy that cable runs are actually longer than 220 meters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, you can make sure you won't exceed distance limit by using 50 um OM2 MMF , which covers up to 550 m with 1000Base-SX SFP.&lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2014-01-13T22:17:06.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5825" PostTypeId="1" AcceptedAnswerId="5830" CreationDate="2014-01-13T22:28:29.123" Score="43" ViewCount="63093" Body="&lt;p&gt;The standard I've seen so far is to use 192.168.*.* IP addresses for devices on the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why this combination? If it were me, I would have chosen something simpler, like 1.0.*.*. What's the historical reason?&lt;/p&gt;&#xA;" OwnerDisplayName="user3878" LastEditorDisplayName="user3878" LastEditDate="2014-01-13T23:10:38.237" LastActivityDate="2017-08-18T08:08:10.690" Title="Why 192.168.*.* for local addresses?" Tags="|ipv4|" AnswerCount="3" CommentCount="5" ClosedDate="2019-01-23T21:20:36.477" ContentLicense="CC BY-SA 3.0" />
  <row Id="5827" PostTypeId="1" CreationDate="2014-01-13T22:31:32.150" Score="1" ViewCount="28985" Body="&lt;p&gt;I cant ping from Inside-&gt;Outside ,DMZ-&gt;Outside ,Inside-&gt;DMZ&#xA;Packet tracer in ASDM indicates access rule but i cannot see(click on the rule) , and i cannot create a reverse rule from Packet tracer. When i had a similar issue it was Nat issues. &#xA;Documentation and blogs are saying about how the Asa is using Xlate(Nat) rules to route traffic first prior to routing table and thus the failed to locate egress interface(cannot route traffic) if Nat fails.&lt;br&gt;&#xA;Moreover Inside-&gt;DMZ etc do not suppose to require any Nat or access rules to work. Just in case i tried allow all traffic rules but did not help. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/0&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.0.10.1 255.255.255.0 &#xA;!&#xA;interface Ethernet0/1&#xA; nameif DMZ&#xA; security-level 50&#xA; ip address 10.0.20.1 255.255.255.0 &#xA;!&#xA;interface Ethernet0/2&#xA; nameif Outside&#xA; security-level 0&#xA; ip address 10.0.50.1 255.255.255.0 &#xA;!&#xA;interface Ethernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management0/0&#xA; nameif management&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0 &#xA; management-only&#xA;!&#xA;ftp mode passive&#xA;dns domain-lookup inside&#xA;dns domain-lookup DMZ&#xA;dns domain-lookup Outside&#xA;same-security-traffic permit intra-interface&#xA;object network DMZtoOUT &#xA; subnet 10.0.20.0 255.255.255.0&#xA;object network DMZtoOUThttp &#xA; host 10.0.20.2&#xA;object network INStoOUTdyn &#xA; subnet 10.0.10.0 255.255.255.0&#xA;object network DMZtoOUTftp &#xA; host 10.0.20.2&#xA;object network INStoDMZ &#xA; subnet 192.168.1.0 255.255.255.0&#xA;object network InsideNetwork &#xA; subnet 10.0.10.0 255.255.255.0&#xA;object network TrustedUsers &#xA; subnet 10.0.50.0 255.255.255.128&#xA;object network UntrustedUsers &#xA; subnet 10.0.50.128 255.255.255.128&#xA;object network IntoOut &#xA; subnet 10.0.10.0 255.255.255.0&#xA;object network TEST &#xA; range 10.0.10.1 10.0.10.254&#xA;object network TEST2 &#xA; range 10.0.20.1 10.0.20.254&#xA;object network FUCK &#xA; range 10.0.20.1 10.0.20.254&#xA;object network Insidenet &#xA; subnet 10.0.10.0 255.255.255.0&#xA;object network INStoOut &#xA; subnet 10.0.10.0 255.255.255.0&#xA;object network ANY &#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network INtoOUT &#xA; subnet 10.0.10.0 255.255.255.0&#xA;object-group icmp-type ICMPALL&#xA; icmp-object alternate-address&#xA; icmp-object conversion-error&#xA; icmp-object echo&#xA; icmp-object echo-reply&#xA; icmp-object information-reply&#xA; icmp-object information-request&#xA; icmp-object mask-reply&#xA; icmp-object mask-request&#xA; icmp-object mobile-redirect&#xA; icmp-object parameter-problem&#xA; icmp-object redirect&#xA; icmp-object router-advertisement&#xA; icmp-object router-solicitation&#xA; icmp-object source-quench&#xA; icmp-object time-exceeded&#xA; icmp-object timestamp-reply&#xA; icmp-object timestamp-request&#xA; icmp-object traceroute&#xA; icmp-object unreachable&#xA;object-group service DMZservices&#xA; service-object tcp destination eq ftp &#xA; service-object tcp destination eq ftp-data &#xA; service-object tcp destination eq www &#xA; service-object tcp destination eq https &#xA;object-group network MAPPEDINDMZ&#xA; network-object object TEST&#xA; network-object object TEST2&#xA;access-list inside_access_in extended permit icmp any any &#xA;access-list Outside_access_in extended permit object-group DMZservices object TrustedUsers host 10.0.20.2 &#xA;access-list Outside_access_in extended permit tcp object UntrustedUsers host 10.0.20.2 eq www &#xA;access-list InsideNet standard permit 10.0.10.0 255.255.255.0 &#xA;access-list DMZ_access_in extended permit icmp any any object-group ICMPALL &#xA;access-list global_access extended permit icmp any any object-group ICMPALL &#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu DMZ 1500&#xA;mtu Outside 1500&#xA;mtu management 1500&#xA;ip local pool VPNpool 10.0.10.100-10.0.10.200 mask 255.255.255.0&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;icmp permit 10.0.20.0 255.255.255.0 inside&#xA;icmp permit 10.0.10.0 255.255.255.0 inside&#xA;icmp permit host 10.0.20.1 inside&#xA;icmp permit 10.0.10.0 255.255.255.0 DMZ&#xA;icmp permit 10.0.20.0 255.255.255.0 DMZ&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;nat (inside,Outside) source static InsideNetwork InsideNetwork destination static InsideNetwork InsideNetwork&#xA;!&#xA;object network DMZtoOUT&#xA; nat (DMZ,Outside) dynamic interface&#xA;object network DMZtoOUThttp&#xA; nat (DMZ,Outside) static interface service tcp www www &#xA;object network DMZtoOUTftp&#xA; nat (DMZ,Outside) static interface service tcp ftp ftp &#xA;object network INtoOUT&#xA; nat (inside,Outside) dynamic interface&#xA;access-group DMZ_access_in in interface DMZ&#xA;access-group Outside_access_in in interface Outside&#xA;access-group global_access global&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;aaa-server NewRad protocol radius&#xA;aaa-server NewRad (DMZ) host 10.0.20.3&#xA; timeout 5&#xA; key *****&#xA; authentication-port 1812&#xA; accounting-port 1813&#xA;http server enable&#xA;http 10.0.10.0 255.255.255.0 inside&#xA;dhcpd address 10.0.10.2-10.0.10.99 inside&#xA;dhcpd enable inside&#xA;!&#xA;dhcpd address 10.0.50.2-10.0.50.254 Outside&#xA;dhcpd enable Outside&#xA;!&#xA;dhcpd address 192.168.1.2-192.168.1.254 management&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3280" LastEditorUserId="619" LastEditDate="2014-01-13T22:39:41.110" LastActivityDate="2014-02-12T23:33:19.667" Title="ASA failed to locate egress interface and Nat? issues" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5828" PostTypeId="2" ParentId="5825" CreationDate="2014-01-13T23:05:25.480" Score="0" Body="&lt;p&gt;Please use 10.0.0.0 - 10.255.255.255, per &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6890&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6890&lt;/a&gt;, page 6.&lt;/p&gt;&#xA;&lt;p&gt;I used to think that answering historical questions was a good idea, but I would like to avoid doing this on a regular basis,  due to bad help vampire experiences.  It doesn't seem necessary in this case.  10.0.0.0/8 is simple enough.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-01-13T23:05:25.480" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5829" PostTypeId="2" ParentId="5827" CreationDate="2014-01-13T23:15:07.460" Score="2" Body="&lt;p&gt;On your identity NAT (nonat) add &quot;route-lookup&quot; at the end of the command to bypass the behavior of using the XLATE for the egress interface.&lt;/p&gt;&#xA;" OwnerUserId="3879" LastActivityDate="2014-01-13T23:15:07.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5830" PostTypeId="2" ParentId="5825" CreationDate="2014-01-14T00:33:09.043" Score="38" Body="&lt;p&gt;&lt;em&gt;&lt;em&gt;Note: Unless we can get one of the original authors of &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1918&lt;/a&gt;/&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1597&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1597&lt;/a&gt; or someone from InterNIC/RIPE NCC at that time (1994-1996) to comment&lt;/em&gt;, we may be left at taking guesses, and the answers to this question being mostly opinion based.&lt;/em&gt;*&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Per &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1918&lt;/a&gt;, the following three ranges are reserved for use on private networks:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.0        -   10.255.255.255  (10/8 prefix)&#xA;172.16.0.0      -   172.31.255.255  (172.16/12 prefix)&#xA;192.168.0.0     -   192.168.255.255 (192.168/16 prefix)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is why you would see them utilized for devices on the local network.&lt;/p&gt;&#xA;&lt;p&gt;The reasoning behind at least parts of each of these three &amp;quot;private&amp;quot; address ranges is fairly straightforward, but again outside of logic, these are guesses based upon my readings over the years.&lt;/p&gt;&#xA;&lt;p&gt;First consider that the classful networks are as follows (source &lt;a href=&quot;http://en.wikipedia.org/wiki/Classful_network&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia article on Classful Network&lt;/a&gt;):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Class A&#xA;  0.  0.  0.  0 = 00000000.00000000.00000000.00000000&#xA;127.255.255.255 = 01111111.11111111.11111111.11111111&#xA;                  0nnnnnnn.HHHHHHHH.HHHHHHHH.HHHHHHHH&#xA;&#xA;Class B&#xA;128.  0.  0.  0 = 10000000.00000000.00000000.00000000&#xA;191.255.255.255 = 10111111.11111111.11111111.11111111&#xA;                  10nnnnnn.nnnnnnnn.HHHHHHHH.HHHHHHHH&#xA;&#xA;Class C&#xA;192.  0.  0.  0 = 11000000.00000000.00000000.00000000&#xA;223.255.255.255 = 11011111.11111111.11111111.11111111&#xA;                  110nnnnn.nnnnnnnn.nnnnnnnn.HHHHHHHH&#xA;&#xA;Class D&#xA;224.  0.  0.  0 = 11100000.00000000.00000000.00000000&#xA;239.255.255.255 = 11101111.11111111.11111111.11111111&#xA;                  1110XXXX.XXXXXXXX.XXXXXXXX.XXXXXXXX&#xA;&#xA;Class E&#xA;240.  0.  0.  0 = 11110000.00000000.00000000.00000000&#xA;255.255.255.255 = 11111111.11111111.11111111.11111111&#xA;                  1111XXXX.XXXXXXXX.XXXXXXXX.XXXXXXXX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As you can see, each one of the three RFC1918 ranges cuts out a private block from one of the old &amp;quot;classful&amp;quot; network ranges. (Class A, Class B, and Class C in this case.)&lt;/p&gt;&#xA;&lt;p&gt;To quote &lt;a href=&quot;http://www.mugglenet.com/books/quotes/dumbledore.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dumbledore,&lt;/a&gt; &amp;quot;From this point forth, we shall be leaving the firm foundation of fact and journeying together through the murky marshes of memory into thickets of wildest guesswork.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.iana.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IANA&lt;/a&gt; had been assigning addresses for many years before the inception of &lt;s&gt;RFC 1918 (February 1996)&lt;/s&gt;. (Actually the private ranges were first put forth in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1597&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1597&lt;/a&gt; in March 1994.)  For example, if you conduct a &lt;code&gt;whois 8.0.0.0&lt;/code&gt; lookup, you can see that Level 3 had this block assigned on 1992-12-01.&lt;/p&gt;&#xA;&lt;p&gt;Therefore it can be assumed that the authors of RFC1918 had to work with the IANA/&lt;a href=&quot;http://en.wikipedia.org/wiki/Jon_Postel&quot; rel=&quot;nofollow noreferrer&quot;&gt;Jon Postel&lt;/a&gt; to find available ranges, giving us the private ranges listed above.&lt;/p&gt;&#xA;&lt;p&gt;But again, unless someone directly involved with the process* speaks up, this may remain guesswork.&lt;/p&gt;&#xA;&lt;p&gt;*&lt;sub&gt;Or just someone with better Google-foo than myself.  I was unable to find a good primary source for this information.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-01-14T04:37:36.213" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="5831" PostTypeId="1" CreationDate="2014-01-14T01:09:47.580" Score="3" ViewCount="1323" Body="&lt;p&gt;My issue is this:  I have a Cisco ASA which the &lt;code&gt;INSIDE&lt;/code&gt; interface is set to &lt;code&gt;DHCP&lt;/code&gt; lease IPs &lt;code&gt;10.1.10.104 - 254&lt;/code&gt;  ...  I have a few static servers using the &quot;lower&quot; IP range (i.e. &lt;code&gt;10.1.10.11&lt;/code&gt;).  The issue is that anything &quot;lower&quot; than &lt;code&gt;.104&lt;/code&gt; is blocked from accessing any network other than &lt;code&gt;10.1.10.0&lt;/code&gt;.  It is also blocked from NAT rules attempting to forward port traffic IE &lt;code&gt;PPTP&lt;/code&gt; through from the &lt;code&gt;OUTSIDE&lt;/code&gt; network.  I have included my running config below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result:&#xA;    input-interface: inside&#xA;    input-status: up&#xA;    input-line-status: up&#xA;    output-interface: outside&#xA;    output-status: up&#xA;    output-line-status: up&#xA;    Action: allow&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ASA Version 8.2(5) &#xA;!&#xA;&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.1.10.100 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 74.xx.xx.xx 255.255.255.248 &#xA;!&#xA;ftp mode passive&#xA;object-group network DM_INLINE_NETWORK_1&#xA; network-object 10.xx.xx.0 255.255.255.0&#xA; network-object 10.xx.xx.0 255.255.255.0&#xA;access-list outside_access_in extended permit icmp any any &#xA;access-list outside_1_cryptomap extended permit ip 10.1.10.0 255.255.255.0 object-group DM_INLINE_NETWORK_1 &#xA;access-list inside_nat0_outbound extended permit ip 10.1.10.0 255.255.255.0 10.xx.xx.0 255.255.255.0 &#xA;access-list inside_nat0_outbound extended permit ip 10.1.10.0 255.255.255.0 10.xx.xx.0 255.255.255.0 &#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 0 access-list inside_nat0_outbound&#xA;nat (inside) 1 10.1.10.0 255.255.255.0&#xA;route outside 0.0.0.0 0.0.0.0 74.xx.xx.xx 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;http server enable&#xA;http 10.1.10.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto map outside_map 1 match address outside_1_cryptomap&#xA;crypto map outside_map 1 set pfs group5&#xA;crypto map outside_map 1 set peer xx.xx.xx.xx&#xA;crypto map outside_map 1 set transform-set ESP-3DES-SHA&#xA;crypto map outside_map interface outside&#xA;crypto isakmp enable inside&#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 10&#xA; authentication crack&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 20&#xA; authentication rsa-sig&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 30&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 40&#xA; authentication crack&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 50&#xA; authentication rsa-sig&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 60&#xA; authentication pre-share&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 70&#xA; authentication crack&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 80&#xA; authentication rsa-sig&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 90&#xA; authentication pre-share&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 100&#xA; authentication crack&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 110&#xA; authentication rsa-sig&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 120&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 130&#xA; authentication crack&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 140&#xA; authentication rsa-sig&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 150&#xA; authentication pre-share&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 170&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 5&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;dhcpd dns 75.75.75.75 75.75.76.76&#xA;dhcpd auto_config outside&#xA;!&#xA;dhcpd address 10.1.10.104-10.1.10.254 inside&#xA;dhcpd enable inside&#xA;!&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA;tunnel-group xx.xx.xx.xx type ipsec-l2l&#xA;tunnel-group xx.xx.xx.xx ipsec-attributes&#xA; pre-shared-key xx&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect pptp &#xA;  inspect icmp &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there anything I am obviously missing?  I am a network noob, so please keep this in mind, and if more info is needed etc, please inform me as such ... For the sake of simplicity, lets use the single IP &lt;code&gt;10.1.10.11&lt;/code&gt; as the &quot;problem&quot; IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;#############EDIT############&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have added a &lt;code&gt;traceroute&lt;/code&gt; per a suggestion from the answer below.  Again I reiterate that I am a noob, so be gentle.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Result of the command: &quot;packet-tracer input inside tcp 10.1.10.11 80 75.75.75.75  80&quot;&#xA;&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: input&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   0.0.0.0         0.0.0.0         outside&#xA;&#xA;Phase: 2&#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 3&#xA;Type: VPN&#xA;Subtype: ipsec-tunnel-flow&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 4&#xA;Type: NAT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside) 1 10.1.10.0 255.255.255.0&#xA;  match ip inside 10.1.10.0 255.255.255.0 outside any&#xA;    dynamic translation to pool 1 (74.xx.xx.225 [Interface PAT])&#xA;    translate_hits = 841385, untranslate_hits = 182888&#xA;Additional Information:&#xA;Dynamic translate 10.1.10.11/80 to 74.xx.Xx.225/120 using netmask 255.255.255.255&#xA;&#xA;Phase: 5&#xA;Type: NAT&#xA;Subtype: host-limits&#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside) 1 10.1.10.0 255.255.255.0&#xA;  match ip inside 10.1.10.0 255.255.255.0 inside any&#xA;    dynamic translation to pool 1 (No matching global)&#xA;    translate_hits = 0, untranslate_hits = 0&#xA;Additional Information:&#xA;&#xA;Phase: 6&#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 7&#xA;Type: FLOW-CREATION&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;New flow created with id 1635639, packet dispatched to next module&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;HOWEVER&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This fails:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Result of the command: &quot;packet-tracer input outside icmp 75.75.75.75 0 0 10.1.10.11 detailed&quot;&#xA;&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: input&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   10.1.10.0       255.255.255.0   inside&#xA;&#xA;Phase: 2&#xA;Type: ACCESS-LIST&#xA;Subtype: &#xA;Result: DROP&#xA;Config:&#xA;Implicit Rule&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0xc95e4128, priority=0, domain=permit, deny=true&#xA;    hits=343309, user_data=0x9, cs_id=0x0, flags=0x1000, protocol=0&#xA;    src ip=0.0.0.0, mask=0.0.0.0, port=0&#xA;    dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0&#xA;&#xA;Result:&#xA;input-interface: outside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: inside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: drop&#xA;Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2758" LastEditorUserId="2758" LastEditDate="2014-01-15T00:59:33.837" LastActivityDate="2014-01-16T14:12:05.153" Title="IP addrs Outside of DHCP range blocked by Cisco ASA 5505" Tags="|cisco|cisco-asa|nat|acl|" AnswerCount="2" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="5832" PostTypeId="1" AcceptedAnswerId="5835" CreationDate="2014-01-14T04:47:35.417" Score="6" ViewCount="44503" Body="&lt;p&gt;I've tried to log in to this device by doing the following.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Default credentials&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username: admin&#xA;password: &amp;lt;none&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Maintainer credentials in the FortiExplorer console interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username: maintainer&#xA;password: bcpb + serial number&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Holding the reset button for varying lengths of time, and during boot.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Installing a newer firmware from &lt;a href=&quot;ftp://pftpintl:F0rt1intl@support.fortinet.com&quot; rel=&quot;nofollow&quot;&gt;ftp://pftpintl:F0rt1intl@support.fortinet.com&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I've gleaned this information from random blogs. I can't find an actual manual, just spec sheets and sales pamphlets.&lt;/p&gt;&#xA;" OwnerUserId="3882" LastEditorUserId="3191" LastEditDate="2014-08-02T20:16:10.287" LastActivityDate="2019-08-16T10:22:51.770" Title="Reset admin password on Fortinet FortiWiFi 60D" Tags="|router|wireless|fortinet|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5833" PostTypeId="2" ParentId="5823" CreationDate="2014-01-14T05:19:45.400" Score="9" Body="&lt;p&gt;If you have an &lt;a href=&quot;https://learningnetwork.cisco.com/thread/21137&quot; rel=&quot;nofollow noreferrer&quot;&gt;end-to-end vlan topology&lt;/a&gt;, where vlans are not terminated on switches, you can use somethink like this algorithm:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the root switch get the mac address table, use filter output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh mac add | i 8a06&#xA;&#xA;1    0015.5d02.8a06   dynamic ip,ipx,assigned,other TenGigabitEthernet4/5 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you know, that mac is behind interface TenGigabitEthernet4/5. Connect to the switch behind this interface, and repeat &lt;code&gt;sh mac add | i 8a06&lt;/code&gt;. You will find your host in the end.&lt;/p&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="20757" LastEditDate="2017-05-11T21:49:32.197" LastActivityDate="2017-05-11T21:49:32.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5834" PostTypeId="2" ParentId="5831" CreationDate="2014-01-14T08:44:08.887" Score="2" Body="&lt;p&gt;I see you have an access-list :access-list outside_access_in&#xA;But idon't see it applied on the interface.&#xA;I think you should have an Access-list for inside interface too, and applied to it.&#xA;Permit icmp, http,https from inside and any other protocol you need.&#xA;Then do a traceroute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also try this command: packet-tracer&#xA;see how to use it here:&#xA;&lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-5796&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/docs/DOC-5796&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This command can show you were your packets fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;&lt;em&gt;EDIT&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you need 2 ACL's , one for inside interface and one for outside. I see you already have one for outside but it is not applied to the interface. Like this :access-group outside_access_in in interface outside&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create an ACL for inside too, and apply it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is useless to test packet-tracet from outside to inside. like this :&quot;packet-tracer input outside icmp 75.75.75.75 0 0 10.1.10.11&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is because it will be always dropped becuae you don't have a static NAT mapping and an ACL entry perminting the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SO the first packet-tracer test is what we needed and it looks ok.&#xA;We want to see that traffic coming form inside is forming a flow.The fireweall will permit the returning flow. (This is a statefull firewall)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So create an apply ACL for inside and outside and see if it works.&lt;/p&gt;&#xA;" OwnerUserId="3421" LastEditorUserId="775" LastEditDate="2014-01-16T09:54:05.357" LastActivityDate="2014-01-16T09:54:05.357" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5835" PostTypeId="2" ParentId="5832" CreationDate="2014-01-14T10:11:18.807" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Reset Button: When enabled (default state), resets the unit to its factory default settings &lt;strong&gt;if pressed during the first 30 seconds after a reboot&lt;/strong&gt; -- &lt;a href=&quot;http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&amp;amp;docType=kc&amp;amp;externalId=FD33883&amp;amp;sliceId=1&amp;amp;docTypeID=DT_KCARTICLE_1_1&amp;amp;dialogID=56637278&amp;amp;stateId=0%200%2056639128&quot; rel=&quot;nofollow&quot;&gt;Fortinet KB&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs-legacy.fortinet.com/fgt/sysadmin/Resetting_a_lost_admin_password.pdf&quot; rel=&quot;nofollow&quot;&gt;Resetting a lost admin password - PDF&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="3191" LastEditDate="2014-08-02T20:13:10.543" LastActivityDate="2014-08-02T20:13:10.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5836" PostTypeId="1" AcceptedAnswerId="5837" CreationDate="2014-01-14T11:51:04.697" Score="3" ViewCount="772" Body="&lt;p&gt;So I've got the task of installing and setting up another router at work. I don't have much experience with routers and networking (I'm a web developer, still in college, working part time but I got the task since I didn't have anything better to do and everyone else being busy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have an airRouter HP connected to the internet. We have some 20 - 30 devices connected but it seems like the airRouter couldn't manage it since some of the devices kept losing internet on a regular basis, where suddenly stuff like DNS resolution would stop working (even with other DNS servers like googles). So my employer bought a Netgear WNDAP350 that I'm now trying my best at setting up and understanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the setup:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 airRouter HP&lt;/li&gt;&#xA;&lt;li&gt;1 Netgear WNDAP350&lt;/li&gt;&#xA;&lt;li&gt;~30 devices&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I was trying to setup the Netgear in Wireless Bridge mode but to no avail, I feel I don't have the understanding to get it to work even though I've tried my best at understanding the manual. I went to the wireless bridge mode, inputted the MAC address of the airrouter and it's network key but devices connected to the Netgear wont receive any internet connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connecting the Netgear with wire wont be possible as the Netgear will be placed in the other side of the house (but still where it gets good reception to the airRouter, though my employer doesn't want wires going everywhere).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The plan is to set it up so that half of the devices are connected to the airRouter and the other half to the Netgear. The computers also needs to be able to connect to each other locally since we have a couple of servers everyone needs access to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read that both the airRouter and the Netgear needs to be set into Wireless Bridge Mode. How would this affect the network? Will everyone be able to connect to each other and the internet? Trying to set the airRouter to bridge instead of SOHO mode seems to disable NAT which is required to be on (according to my employer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There doesn't seem to be anywhere where I could input the MAC address of the Netgear router in the airRouter without changing it's mode from AP to bridged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I set up DHCP? On the Netgear you can either have a DHCP client or a DHCP server but not both at the same time so I would assume I need to setup a static IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I assure that the routers are connected to each other? The Netgear router seems to lack any ability to test the network (which is weird because their home routers for $40 supports that just fine, you would assume that a $400 router would offer more features).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would you suggest? How would I set this up so that everyone can access each other and the internet?&lt;/p&gt;&#xA;" OwnerUserId="3883" LastActivityDate="2014-01-14T15:08:33.710" Title="Help with setting up several routers on same network" Tags="|router|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5837" PostTypeId="2" ParentId="5836" CreationDate="2014-01-14T15:08:33.710" Score="1" Body="&lt;p&gt;The HP can be either a bridge or AP, not both.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend that you do this: just replace the HP with the Netgear, since it can handle more clients than the HP.  If your wifi signal is good enough to cover the entire ares, that might be the simplest option. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also might consider using both: put the Netgear in the same location as the HP.  Connect the Netgear wired port to the HP.  Use the DHCP server on the HP.   Set the HP and Netgear to be on different channels (eg, 1 and 11).  You can either use the same SSID or differnt ones, but the idea is that half your clients will connect to the HP and half to the Netgear.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-14T15:08:33.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5838" PostTypeId="1" CreationDate="2014-01-14T15:20:02.070" Score="2" ViewCount="1493" Body="&lt;p&gt;We configure AAA on router for the Telnet/SSH access. We activate HTTP on our router to our provisioning tool. The provisioning tool needs to retrieve information and execute some command on the HTTP page. The HTTP authentication on the router is local (so the prov. tool have a local account), but to execute some commands, he needs to request the authorization to a TACACS server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the configurations for &lt;code&gt;aaa&lt;/code&gt; and &lt;code&gt;ip http server&lt;/code&gt;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;aaa authentication login default group tacacs+ local&#xA;aaa authentication enable default group tacacs+ enable&#xA;aaa authorization exec default group tacacs+ none &#xA;aaa authorization commands 15 default group tacacs+ none &#xA;aaa accounting exec default start-stop group tacacs+&#xA;aaa accounting commands 15 default start-stop group tacacs+ &#xA;!&#xA;!&#xA;username prov_tool privilege 15 password pwd&#xA;!&#xA;!&#xA;! http config. &#xA;ip http server&#xA;ip http access-class 2&#xA;ip http authentication local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to know if there is a way for the provision tool to be locally authenticated and authorized to execute any command.&lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="8499" LastEditDate="2016-03-30T00:50:08.970" LastActivityDate="2016-03-30T00:50:08.970" Title="AAA - IP HTTP server: local authentication and authorization" Tags="|router|aaa|authentication|tacacs|authorization|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5839" PostTypeId="1" AcceptedAnswerId="5843" CreationDate="2014-01-14T17:04:33.140" Score="4" ViewCount="2929" Body="&lt;p&gt;THIS IS NOT A DUPLICATE POST/SAME QUESTION! PLEASE READ FULLY!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're implementing a web-proxy service and in the tunnel config over to their service the provider requested a crypo ACL as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_30_crypto extended permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the test though we only want one machine's traffic to be pushed through this tunnel.  I was told there is a way to limit the tunnel traffic with an additional ACL, but I'm unclear as to how to achieve this and still allow all other traffic through the outside interface as usual.  &lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2014-01-14T17:10:16.523" LastActivityDate="2014-01-14T21:46:47.883" Title="Limiting VPN traffic with ACL" Tags="|cisco|cisco-asa|vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5840" PostTypeId="1" AcceptedAnswerId="5842" CreationDate="2014-01-14T17:10:07.023" Score="5" ViewCount="987" Body="&lt;p&gt;THIS IS NOT A DUPLICATE POST/SAME QUESTION! PLEASE READ FULLY!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hello All,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a recent project, a vendor we're setting up a VPN to, proposed our crypto ACL to their service be as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_30_crypto extended permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They suggested we use an additional ACL to limit the traffic going over this tunnel.  The reason they cited was because keeping the crypo ACL open like this and then limiting it with an ACL on the interface, you would cut down on the number of SA's built.  How does this cut down on the number of SA's and is this the most efficient way to design VPN's?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2014-01-14T21:41:13.930" Title="Efficient crypto ACL's?" Tags="|cisco|cisco-asa|vpn|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5841" PostTypeId="2" ParentId="5840" CreationDate="2014-01-14T19:05:49.003" Score="1" Body="&lt;p&gt;Per the following &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/sec_conn_vpnips/configuration/15-2mt/sec-cfg-vpn-ipsec.html&quot; rel=&quot;nofollow&quot;&gt;Cisco documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&quot;The permit any any statement is strongly discouraged because this causes all outbound traffic to be protected (and all protected traffic is sent to the peer specified in the corresponding crypto map entry) and requires protection for all inbound traffic. Then, all inbound packets that lack IPsec protection are silently dropped, including packets for routing protocols, the Network Time Protocol (NTP), echo, echo response, and so on.&#xA;You need to be sure that you define which packets to protect. If you must use the any keyword in a permit statement, you must preface that statement with a series of deny statements to filter out any traffic (that would otherwise fall within that permit statement) that you do not want to be protected&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe that adding those deny statements might be what they are talking about in terms of reducing the number of SA's. It makes sense to do so if you have traffic that you don't need to be protected for the sake of efficiency.&lt;/p&gt;&#xA;" OwnerUserId="1453" LastActivityDate="2014-01-14T19:05:49.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5842" PostTypeId="2" ParentId="5840" CreationDate="2014-01-14T21:41:13.930" Score="6" Body="&lt;p&gt;The ACL associated with a point to point VPN should always contain both source and destination information. To classify &quot;interesting traffic&quot;, that is the traffic to be protected and then sent to a remote endpoint, Cisco devices (routers and L3 swithces and ASAs oh my) will look at  both source and destination addresses. If you would like a singular host to be able to send traffic to an entire remote Class C, then your ACL would look like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit ip host 192.168.1.100 10.10.10.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If this is not specified and you just have&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then how will your router know that it is &lt;strong&gt;not&lt;/strong&gt; supposed to take traffic from another local sunbnet and encrypt it. Furthermore if you are running NAT on the same device, it adds further confusion. If your external IP on this VPN device is a public IP, then it also falls within the &quot;any&quot; statement of that ACL. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;The reason they cited was because keeping the crypo ACL open like this and then limiting it with an ACL on the interface, you would cut down on the number of SA's built. How does this cut down on the number of SA's and is this the most efficient way to design VPN's?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is technically incorrect, you will only have a singular SA (security association) between the devices for each tunnel, not for each individual TCP session or traffic flow. &lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2014-01-14T21:41:13.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5843" PostTypeId="2" ParentId="5839" CreationDate="2014-01-14T21:46:47.883" Score="3" Body="&lt;p&gt;I would not recommend putting an ACL on a VPN interface (physical or logical source)/tunnel interface(if you are using the newer transport mode configuration)  to restrict the traffic thru a VPN. You should modify your ACL for the VPN in a similar manner to what I have posted on your other question &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5840/efficient-crypto-acls/5842#5842&quot;&gt;Efficient crypto ACL&amp;#39;s?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish to send the traffic from just one host thru a VPN, your ACL should have that host's IP as the source address, and whatever remote resources you would like that host to access as the destination address/network. I.e. If your host is 192.168.1.100 and he will be sending traffic to Microsoft Azure cloud network with the LAN addressing being 172.16.0.0/16, you would need the ACL to look like the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit IP host 192.168.1.100 172.16.0.0 0.0.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3210" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-01-14T21:46:47.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5844" PostTypeId="1" AcceptedAnswerId="5845" CreationDate="2014-01-15T01:30:23.077" Score="9" ViewCount="2846" Body="&lt;p&gt;What are the primary differences and functions (or applications) of type codes 0800 and 0806? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Through my own research, I found the 0800 was related to the 0800 to the IP/Layer 3 of the OSI model. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also found the 0806 was related to the ARP protocol. To clarify, is ARP the protocol that makes an IP address into a MAC address in order for a switch to address a specific computer attached to a router? What layer of the OSI model is the 0806 ARP layer related to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am extremely new, so an in-depth explanation would be extremely appreciated.&lt;/p&gt;&#xA;" OwnerUserId="3890" LastEditorUserId="16668" LastEditDate="2015-07-17T16:00:27.073" LastActivityDate="2015-07-17T16:00:27.073" Title="Differences and functions of type codes 0800 and 0806" Tags="|router|ipv4|protocol-theory|mac-address|arp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5845" PostTypeId="2" ParentId="5844" CreationDate="2014-01-15T01:56:31.620" Score="8" Body="&lt;p&gt;ARP is the protocol that gives you the MAC address (layer 2) of a given IP address (layer 3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On ethernet all communication is done using MAC addresses. Switches and other layer 2 devices only look at the MAC addresses of the packets (on layer 2 usually called frames). They don't care about the content of the frames. That is the job of layer 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for example, when your router (let's assume 192.168.1.1) wants to send a packet to your PC (assume 192.168.1.123) over ethernet, it has to know your PC's ethernet MAC address. It broadcasts an ARP packet to all devices on the ethernet asking for the system with address 192.168.1.123 to reply. Your PC replies, and the router now knows the MAC address that it can use when sending packets to 192.168.1.123.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And when your PC wants to send a packet to the router it uses the same method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because your PC's configuration says that 192.168.1.1 is your default gateway it will also use the corresponding MAC address for all IP packets that have a destination outside your local network. So a packet for 172.16.2.3 will also be sent to the router's MAC address. When the router received such a packet on its ethernet interface it is assumed to know where to forward it to based on the IP address.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-01-15T01:56:31.620" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5846" PostTypeId="2" ParentId="5844" CreationDate="2014-01-15T03:13:44.380" Score="3" Body="&lt;p&gt;Since you are &quot;extremely new&quot; to networking, let me give you some pointers on the OSI model:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It's just a model -- that is, a mental construct&lt;/li&gt;&#xA;&lt;li&gt;It was developed by a committee&lt;/li&gt;&#xA;&lt;li&gt;No protocols (in use) actually follow it&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Many new networking students spend an inordinate amount of time trying to figure out &quot;which layer&quot; a protocol or function belongs to.  It is a fool's errand, because whatever protocol you are looking at was not designed with the OSI model in mind.  So you are forcing it to fit into an arbitrary model.   That's fine, I suppose for entertainment's sake, but it won't really help you understand networking any better.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many protocols straddle different layers of the OSI (and TCP/IP) model.  Is ICMP layer 3 or layer 4?  Is ARP layer 2 or layer 3?  Perhaps a little of each.  MPLS?  Don't get me started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The important thing about all models (here's one that things actually follow sometimes &lt;a href=&quot;http://www.sis.pitt.edu/~icucart/networking_basics/4LayersofTCPIPModel.html&quot; rel=&quot;nofollow&quot;&gt;http://www.sis.pitt.edu/~icucart/networking_basics/4LayersofTCPIPModel.html&lt;/a&gt; ) is that there &lt;em&gt;ARE&lt;/em&gt; layers.   And layers have interfaces to the ones above and below it.  So you can replace the functions of a layer with another, and as long as the interface between the other layers stays the same, everything works.  So, for example, you can replace one layer 3 protocol, IP version 4, with IP version 6, and everything else will continue to work exactly as before, because IPv6 communicates with layer 2 (below) and layer 4 above) in exactly the same way as IPv4.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other thing to remember about layers is that, for the sender, a layer encapsulates the data (technically, the protocol data unit, PDU) of the layer above it.  So layer 3 encapsulates the layer 4 data unit, layer 2 encapsulates the layer 3 unit, etc.  The receiver reverses the process, decapsulating the data and handing it off to the layer above it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sander's post about ARP, BTW is right on.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-01-15T03:51:47.997" LastActivityDate="2014-01-15T03:51:47.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5848" PostTypeId="1" AcceptedAnswerId="5968" CreationDate="2014-01-15T10:33:16.603" Score="7" ViewCount="3563" Body="&lt;p&gt;I'm trying to monitor my &lt;a href=&quot;http://openvswitch.org/&quot; rel=&quot;nofollow&quot; title=&quot;OpenVSwitch&quot;&gt;OpenVswitch&lt;/a&gt; via &lt;a href=&quot;http://en.wikipedia.org/wiki/IP_Flow_Information_Export&quot; rel=&quot;nofollow&quot;&gt;IPFix&lt;/a&gt;. But I'm banging my head against a brick wall for two days now :/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the &lt;a href=&quot;http://openvswitch.org/cgi-bin/ovsman.cgi?page=utilities/ovs-vsctl.8&quot; rel=&quot;nofollow&quot;&gt;ovs-vsctl manpage&lt;/a&gt; I need to add a new entry into the config-database, more precisely into the &quot;ipfix&quot;-table. That worked pretty well, and it looks like I got it right:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ovs-vsctl list ipfix&#xA;_uuid               : 2d54982b-6cc5-4a8c-845c-cc7ef701da01&#xA;external_ids        : {}&#xA;obs_domain_id       : 123&#xA;obs_point_id        : 456&#xA;sampling            : 64&#xA;targets             : [&quot;&amp;lt;collector-ip&amp;gt;:&amp;lt;port&amp;gt;&quot;]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then downloaded &lt;a href=&quot;http://libipfix.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;libIPFIX&lt;/a&gt; and started the example_collector. But nothing shows up. I don't receive any information. I confirmed it using wireshark ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some Google-Research brought up an &lt;a href=&quot;http://openvswitch.org/pipermail/dev/2013-January/024629.html&quot; rel=&quot;nofollow&quot;&gt;eMail&lt;/a&gt; from the Mailinglist, which states that one needs &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;OpenFlow actions to cause IPFIX to be sent to the collectors&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;According to this &lt;a href=&quot;http://openvswitch.org/pipermail/git/2013-April/003876.html&quot; rel=&quot;nofollow&quot;&gt;eMail&lt;/a&gt; there are new &quot;sample actions&quot;, but I couldn't find any further information how to add them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My best guess is that I'm missing these OpenFlow Sample-Actions. Can anybody provide me with information how to add those?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;/edit:&lt;/strong&gt;&#xA;I'm running OpenVswitch Version 1.11.0 on openSUSE 13.1 (x86_64).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get IPFix to work I tried the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ovs-vsctl -- set Bridge s1 ipfix=@i -- --id=@i create IPFIX targets=\&quot;10.0.0.1:4739\&quot; obs_domain_id=123 obs_point_id=456 sampling=64&#xA;2d54982b-6cc5-4a8c-845c-cc7ef701da01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To confirm that I did the ovs-vsctl list ipfix (see above)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A similar command worked as expected to get sFlow to work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ovs-vsctl -- set Bridge s1 sflow=@sflow -- --id=@sflow create sflow agent=eth0  target=\&quot;10.0.0.1:6343\&quot; header=128 sampling=32 polling=2&#xA;0df2b92b-8a83-4a63-acc4-fecf6f8f492f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Right after entering that line, I got sampling results send to my target computer. Unfortunately no luck with IPFix.&lt;/p&gt;&#xA;" OwnerUserId="3894" LastEditorUserId="3894" LastEditDate="2014-01-22T07:06:29.460" LastActivityDate="2018-06-18T12:16:16.073" Title="How to get ipfix working with openvswitch?" Tags="|monitoring|netflow|" AnswerCount="1" CommentCount="2" ClosedDate="2019-01-02T00:44:43.927" ContentLicense="CC BY-SA 3.0" />
  <row Id="5852" PostTypeId="1" AcceptedAnswerId="5858" CreationDate="2014-01-15T14:00:20.113" Score="1" ViewCount="767" Body="&lt;p&gt;I'm a little confused, couldn't flow control be performed just using the ACK field in the header? Why is there a FLOW bit as well?&lt;/p&gt;&#xA;" OwnerUserId="3898" LastActivityDate="2014-01-15T16:40:06.510" Title="Why does a Bluetooth header have both ACK and FLOW?" Tags="|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5853" PostTypeId="1" AcceptedAnswerId="5857" CreationDate="2014-01-15T15:06:44.813" Score="3" ViewCount="7213" Body="&lt;p&gt;Suppose that the message you are sending does not reach the destination, such as a ping. Is the content of that message protected?  How is a retransmission accomplished?&lt;/p&gt;&#xA;" OwnerUserId="3890" LastEditorUserId="775" LastEditDate="2014-01-15T15:39:43.090" LastActivityDate="2014-01-20T06:47:05.750" Title="When a ping is lost, what happens?" Tags="|routing|ipv4|ping|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5854" PostTypeId="2" ParentId="5853" CreationDate="2014-01-15T15:14:39.413" Score="3" Body="&lt;p&gt;The content of that message isn't any more protected as when you sent it out.  Unless you're using some sort of encryption mechanism to provide confidentiality, anyone along that path (presumably with malicious intent) can snoop in on your packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Retransmission is accomplished by &lt;a href=&quot;http://en.wikipedia.org/wiki/Transmission_Control_Protocol&quot; rel=&quot;nofollow&quot;&gt;TCP&lt;/a&gt;.  The same can't be said about &lt;a href=&quot;http://en.wikipedia.org/wiki/User_Datagram_Protocol&quot; rel=&quot;nofollow&quot;&gt;UDP&lt;/a&gt;, it just gets discarded since retransmission is often times not wanted (i.e. packets arrive out of sync).&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-01-16T09:16:34.443" LastActivityDate="2014-01-16T09:16:34.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5857" PostTypeId="2" ParentId="5853" CreationDate="2014-01-15T16:20:10.223" Score="13" Body="&lt;p&gt;IP protocol provides no guarantee that packets will arrive, arrive on time, or arrive in the proper order.  The only thing IP can verify is that the packet header is intact (due to the header checksum).    So if a ping is lost, it is...lost.   It is up to the sending program to detect that no corresponding reply was received.   If you want to guarantee delivery, you need to rely on layer 4 protocols, namely TCP.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-15T16:20:10.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5858" PostTypeId="2" ParentId="5852" CreationDate="2014-01-15T16:40:06.510" Score="3" Body="&lt;p&gt;The ARQN bit doesn't provide the sender with enough information to be used as flow control.  ACK only means &quot;I received the packet intact.&quot;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see how it could also be used for flow control.  If the receiver receives the packet, but wants the sender to stop, what could it do?  If it sends an ACK, the sender will keep on sending.  If it sends a NAK, or sends nothing, that tells the sender the packet was bad.  So the sender will retransmit it, making things worse.  The FLOW bit means &quot;I'm busy, please stop sending.&quot;  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-15T16:40:06.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5859" PostTypeId="2" ParentId="5853" CreationDate="2014-01-15T17:14:36.000" Score="1" Body="&lt;p&gt;Ping is ICMP.  While in transit if the TTL (Time to Live) expires the packet is dropped.&#xA;See &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3901" LastActivityDate="2014-01-15T17:14:36.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5860" PostTypeId="2" ParentId="5818" CreationDate="2014-01-15T17:36:37.970" Score="0" Body="&lt;p&gt;If this is a new installation I'd go ahead with OM-3 Horizontal cabling.  Works fine with LED transceivers (1GB as long as you use 50/125 patch cables) and will work 10G-40G if you upgrade in the future.&lt;/p&gt;&#xA;" OwnerUserId="3901" LastActivityDate="2014-01-15T17:36:37.970" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5862" PostTypeId="1" AcceptedAnswerId="6198" CreationDate="2014-01-15T20:00:53.323" Score="5" ViewCount="2678" Body="&lt;p&gt;I work at a school district that has about 1000 students that is split into two buildings.  In our junior high/high school building, we have about 300 student laptops with about 25 teachers that each have a laptop and most also have a desktop with a wireless connection.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our elementary building has about 200 student laptops and another 20 teacher laptops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is our problem.  All year we have had a seemingly sporadically slow network.  At certain periods of the day, things become very bogged down, people begin losing their connections often...it's a nightmare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We started with a Ubiquiti Unifi wireless system with full building coverage in both buildings and netgear GS748TPS, 748TP, and 724TPS switches.  The entire wireless system is built on a cat 6 infrastructure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a teacher laptop is connected to an access point, everything is fine.  When a jr high or high school student connects to an access point and tries to do anything over the network (pulling files from the file server, udp desktop monitoring traffic) except for http access, ping times for everybody on that access point, including teachers, skyrockets into the thousands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the elementary building, there is not a single problem with any connections or ping times.  If I ping from the high school to a laptop in the elementary school 8 miles away, I get an average of 1ms ping times.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have tried removing any software that could create an issue, we have tried removing all startup programs, we have replaced access points to see if it was a bad access point, we have replaced the POE adapters, we have replaced the ends on the cable runs, we have tried reverting everything from the netgear switches to our old HP Procurve 2810-48g switches and removing the netgears entirely, we have tried removing the Unifi access points and putting our HP Procurve wireless system back into production, we have tried any version of the wireless driver driver for that particular laptop that we can find.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of these issues happened at all last year, but it has been non stop this year and it is severely detrimental to any classroom activities.  We also have standardized testing coming up.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am pretty much at a loss as to what else could possibly be causing the problem and am very open to any and all suggestions and recommendations.  Please let me know if there are any resources that would help out.&lt;/p&gt;&#xA;" OwnerUserId="2670" LastEditorUserId="3191" LastEditDate="2014-12-08T20:20:19.313" LastActivityDate="2014-12-08T20:20:19.313" Title="massive ping times and a failing wireless sytem" Tags="|wireless|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="5863" PostTypeId="2" ParentId="3628" CreationDate="2014-01-15T20:30:53.167" Score="13" Body="&lt;p&gt;The difference in prefixes usually comes from the professional background of the people doing the counting.&lt;/p&gt;&#xA;&lt;p&gt;Electrical engineers's professional background is in physics which uses powers of ten. On the other hand, software professionals tend to count everything in powers of two since it makes more sense in their context.&lt;/p&gt;&#xA;&lt;p&gt;Because the standards for the bottom two OSI layers (Physical, Data-Link) are (mostly) written by electrical engineers ( e.g. IEEE / ITU-T), the standard units of measurements in these layers are usually powers of ten. This is why gigabit Ethernet works at a nominal rate of 1*10^9 bps, not 2^30bps.&lt;/p&gt;&#xA;&lt;p&gt;Higher layers are standardized by software people (e.g. IETF) who like to measure things in Bytes (2^3 bits). This is where powers of two start coming in.&lt;/p&gt;&#xA;&lt;p&gt;The same conversion problem happens in storage devices. Electrical engineers build storage devices that stores 1,000,000,000,000 bytes and call them Terabyte drives, while the operating system, written by software engineers, reports their capacity as only 931 Gigabytes.&lt;/p&gt;&#xA;&lt;p&gt;I hope this somewhat clears the picture.&lt;/p&gt;&#xA;&lt;p&gt;To avoid confusion, I recommend using &lt;a href=&quot;https://en.wikipedia.org/wiki/Binary_prefix&quot; rel=&quot;nofollow noreferrer&quot;&gt;binary prefixes&lt;/a&gt; for units that are power of two and not overloading the term &amp;quot;Kilo&amp;quot; to mean both 1000 and 1024, especially in contexts in which both meanings can appear.&lt;/p&gt;&#xA;" OwnerUserId="3905" LastEditorUserId="3905" LastEditDate="2023-03-23T18:27:35.430" LastActivityDate="2023-03-23T18:27:35.430" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="5864" PostTypeId="2" ParentId="5177" CreationDate="2014-01-15T22:36:45.870" Score="5" Body="&lt;p&gt;AnyConnect and the old IPSec client are totally different beasts. AnyConnect provides a VPN over SSL/TLS and the other client uses IPSec.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AnyConnect client does not leverage the same mechanism or any of the existing PCF files. So there should not have been any overwriting or deleting of config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the advantages of the AnyConnect client is that it pulls its configuration down from the ASA based on tunnel-group/group-profile and any associated configuration files stored on the ASA in flash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to have both clients installed simultaneously without any issues.&lt;/p&gt;&#xA;" OwnerUserId="2920" LastActivityDate="2014-01-15T22:36:45.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5868" PostTypeId="1" AcceptedAnswerId="5872" CreationDate="2014-01-16T13:28:35.690" Score="2" ViewCount="12115" Body="&lt;p&gt;&lt;strong&gt;Resolution:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running the &lt;kbd&gt;initialize&lt;/kbd&gt; command from the initial menu on the serial port was required to get this switch to work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had upgraded the software &amp;amp; tried various settings on the switch but something was set in a non-standard way as delivered. Also from my notes, I copied output from the serial port and noticed the prompt was initially &lt;code&gt;&amp;lt;HP V1910 Switch&amp;gt;&lt;/code&gt; and after the reset is &lt;code&gt;&amp;lt;HP&amp;gt;&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;Device -&amp;gt; Basic -&amp;gt; System Name&lt;/code&gt; value is what is in the serial prompt's brackets, as it now says &lt;em&gt;HP&lt;/em&gt;. I know I never would have set the system name as &lt;em&gt;HP V1910 Switch&lt;/em&gt; And I noticed in the Web UI on the initial page on the right info column under &quot;Product Information&quot; is &lt;em&gt;HP V1910 Switch&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'll never assume to get a piece of equipment that has been either factory reset or otherwise unaltered. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original Question:&lt;/strong&gt;&lt;br&gt;&#xA;&lt;sub&gt;was &lt;em&gt;&quot;Does hp ProCurve switch work without being configured?&quot;&lt;/em&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My office is replacing a 5+ year old Dell 2716 switch with a new hp ProCurve V1910-24G but when I hook it up the same as how the Dell was, there is no routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Does the ProCurve not work &quot;unmanaged&quot;?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network I'm improving upon has a &lt;a href=&quot;https://serverfault.com/questions/564410/improvements-for-small-business-network&quot;&gt;drawing in this SF question&lt;/a&gt;. As I transitioned to the new hp V1910-24G switch from my previous Dell 2716, it appears to not allow any connections between ports. I set the V1910's ip address and networked computers can see the V1910's webserver. I have set up the serial port on my server (via USB adapter) and &lt;a href=&quot;http://glazenbakje.wordpress.com/2012/08/21/hp-v1910-secret-commando-list-how-to-enable-it/&quot; rel=&quot;nofollow noreferrer&quot;&gt;found the advanced commands&lt;/a&gt;. The wireless router is running Tomato and I have a spreadsheet of MAC addresses and hosts as reported by its DHCP server, so I'm very much on top of what IPs are on which devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been digging through tutorials for the ProCurve and I figured eventually, I would set up a VLAN for the 2 VoIP boxes and then try to learn if or how its features could improve the windows computers talking to the raid server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this switch act as a router by default?&lt;br&gt;&#xA;Will it play nicely with Debian server running IP tables?&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is this switch overkill and I should go get a 24 port unmanaged switch?&lt;/strong&gt;&lt;br&gt;&#xA;I've spent so much time on the firewall server and network recabling that it's affecting the business's productivity. If I need to spend a day or two sorting out the hp, I'm inclined to not mess with it any more.&lt;/p&gt;&#xA;" OwnerUserId="3787" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2014-01-21T10:19:36.357" Title="Initial setup of hp ProCurve v1910 switch for Small Office?" Tags="|hp-procurve|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5869" PostTypeId="2" ParentId="5831" CreationDate="2014-01-16T14:12:05.153" Score="0" Body="&lt;p&gt;Lets go with the packet tracer 2 here, what are you trying to acheive? If someone is trying to access the webserver on the outside interface of the Firewall, it has to be a Public IP that you should checking the packet-tracer for. The firewall will drop the packet as it does not see a translation for the IP address that is present on the inside interface, hence the packet will be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, first you need create a Static NAT or Static PAT for the internal IP address that should resolve the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static NAT: static (inside,outside) 74.xx.xx.xx 10.1.10.11&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static PAT ( lets assume the server on the inside interface is running web services):&#xA;static (inside,outside) TCP 74.xx.xx.xx 80 10.1.10.11 80&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you would need to permit the traffic that you want come into this server on the inside, only the traffic that is initiated from the outside of the firewalls needs to be permitted, the traffic that is initiated from inside is termed secured and allowed to go from higher security zone to a lower security zone.&lt;/p&gt;&#xA;" OwnerUserId="3914" LastActivityDate="2014-01-16T14:12:05.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5870" PostTypeId="1" AcceptedAnswerId="5873" CreationDate="2014-01-16T14:52:38.127" Score="6" ViewCount="5643" Body="&lt;p&gt;I am trying to ping a host, let's say 10.1.1.1, from 20.1.1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have created the ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#access-list 1&#xA;R1(config)#Deny 20.1.1.1 &#xA;R1(config)#Permit any&#xA;R1(config)# int s0/0&#xA;R1(config-if)#ip access-group 1 in &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Never mind the configuration, I can deny the host 20.1.1.1 which tries to access 10.1.1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now when I try to ping 10.1.1.1 from 20.1.1.1, it returns &lt;code&gt;U.U.U&lt;/code&gt;.  This means destination host unreachable or it is blocked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't want a malicious person to know that I have used an access-list to block him. I want to change this ICMP Request to be done so that when it throws the error message, it should not return &lt;code&gt;U.U.U&lt;/code&gt;.  It should read Destination Host Unreachable or anything better than this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kindly Suggest to me how to do this...Thank You&lt;/p&gt;&#xA;" OwnerUserId="3915" LastEditorUserId="44" LastEditDate="2014-01-16T18:30:30.040" LastActivityDate="2015-03-19T00:26:30.900" Title="Change Ping Response for Traffic Blocked by Access Control List" Tags="|cisco|router|security|acl|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5871" PostTypeId="2" ParentId="5870" CreationDate="2014-01-16T16:12:53.387" Score="-1" Body="&lt;p&gt;Based on your question, it sounds like you're saying that someone has broken into your router to ping 10.1.1.1 in which case you obviously have bigger problems than the output of an ICMP request as I believe they would only get that type of reply to their ping if they are pinging from the Cisco CLI. If this so-called &quot;malicious person&quot; is attempting to ping from their local machine's terminal or command line, they won't see U.U.U as output. However, it is good to note that there are alternative ways they could still carry out penetration testing of your system. In particular, they could use something I recently learned about called &lt;code&gt;tcptraceroute&lt;/code&gt; which will act like a regular TCP connection and bypass your ACL or &lt;a href=&quot;http://www.hping.org/&quot; rel=&quot;nofollow&quot;&gt;hping&lt;/a&gt; which carries out pings using TCP or UDP rather than ICMP. &lt;/p&gt;&#xA;" OwnerUserId="1453" LastEditorUserId="1453" LastEditDate="2014-01-16T16:18:16.393" LastActivityDate="2014-01-16T16:18:16.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5872" PostTypeId="2" ParentId="5868" CreationDate="2014-01-16T16:15:09.173" Score="4" Body="&lt;p&gt;When you say &quot;unmanaged,&quot; I think you mean &quot;default configuration.&quot;  Yes, it works, but almost certainly not the way you would like it to.  By default, all the ports are up and in a single VLAN (vlan 1). There is no routing enabled. You can type &quot;show interfaces brief&quot; to see the status of all the ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You obviously have something more complex on your Dell switch.  If you can let us know how the Dell switch is configured, we can come up with an equivalent for the HP.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-16T16:15:09.173" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5873" PostTypeId="2" ParentId="5870" CreationDate="2014-01-16T16:28:29.323" Score="9" Body="&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#access-list 1&#xA;R1(config)#Deny 20.1.1.1 &#xA;R1(config)#Permit any&#xA;R1(config)# int s0/0&#xA;R1(config-if)#ip access-group 1 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When i try to ping 10.1.1.1 it returns &lt;code&gt;U.U.U&lt;/code&gt; -----&amp;gt; Which means destination host unreachable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The only thing you can do is add &lt;code&gt;no ip unreachables&lt;/code&gt; to Serial0/0.  This would make pings simply timeout instead of receiving an ICMP admin prohibited message when packets are denied on the serial interface.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;The following examples illustrate what happens:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When ROUTER1 pings ROUTER2:Gi0/0, and ROUTER2 denies ROUTER1 via acl 166; &lt;code&gt;ip unreachables&lt;/code&gt; is configured on Gi0/0&lt;/li&gt;&#xA;&lt;li&gt;When ROUTER1 pings ROUTER2:G0/0, and ROUTER2 denies ROUTER1 via acl 166; &lt;code&gt;no ip unreachables&lt;/code&gt; is configured on Gi0/0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;With &lt;code&gt;ip unreachables&lt;/code&gt; (which is the default) on the interface&lt;/h3&gt;&#xA;&lt;p&gt;On the router with the ACL...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER2#sh runn | i access-list 166&#xA;access-list 166 deny  ip host 192.0.2.111 any&#xA;access-list 166 permit ip any any&#xA;ROUTER2#sh runn int gi0/0&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 192.0.2.29 255.255.255.0&#xA; ip access-group 166 in&#xA; no ip redirects&#xA; no ip proxy-arp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And on the host being blocked...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER1#debug ip icmp&#xA;ROUTER1#ping 192.0.2.29 source lo0&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.0.2.29, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.0.2.111&#xA;U.U.U&#xA;Success rate is 0 percent (0/5)&#xA;ROUTER1#sh log | i administrat&#xA;Jan 16 11:02:29.251 CST: ICMP: dst (192.0.2.111) administratively &#xA; prohibited unreachable rcv from 192.0.2.29&#xA;Jan 16 11:02:31.255 CST: ICMP: dst (192.0.2.111) administratively &#xA; prohibited unreachable rcv from 192.0.2.29&#xA;Jan 16 11:02:33.263 CST: ICMP: dst (192.0.2.111) administratively &#xA; prohibited unreachable rcv from 192.0.2.29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;With &lt;code&gt;no ip unreachables&lt;/code&gt;&lt;/h3&gt;&#xA;&lt;p&gt;Adding &lt;code&gt;no ip unreachables&lt;/code&gt; on ROUTER2...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER2#conf t&#xA;ROUTER2(config)#int gi0/0&#xA;ROUTER2(config-if)#no ip unreach&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now the pings fail &lt;em&gt;silently&lt;/em&gt;...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER1#ping 192.0.2.29 source lo0&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.0.2.29, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.0.2.111&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;ROUTER1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-01-16T18:23:50.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5874" PostTypeId="1" CreationDate="2014-01-16T17:04:06.417" Score="2" ViewCount="1114" Body="&lt;p&gt;What is the reason that you cannot set the tunnel's other side as destination address? Is this because it is virtual only?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0/30 is the subnet I'm using and this is my configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tunnel1&#xA;ip add 192.168.1.1 255.255.255.252&#xA;tunnel source (doesn't matter)&#xA;tunnel dest 192.168.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;tunnel dest 192.168.1.2&lt;/strong&gt; -&gt; Why is this invalid?&lt;/p&gt;&#xA;" OwnerUserId="3916" LastEditorUserId="44" LastEditDate="2014-01-16T18:25:43.020" LastActivityDate="2014-01-16T22:08:17.150" Title="GRE Tunneling on Cisco IOS - Destination Address" Tags="|cisco-ios|tunnel|gre|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5876" PostTypeId="2" ParentId="5874" CreationDate="2014-01-16T17:18:09.443" Score="2" Body="&lt;p&gt;Yes, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tunnels IP addresses need to be on their own subnet. The tunnel source and destination identify the points on the network where routers should encapsulate or de-encapsulate the traffic that is sent thru the tunnels. Having a route to your tunnel destination is a requirement for a tunnel interface to show &quot;UP/UP&quot; so really the 192.168.1.0/30 subnet doesn't even exist on the network until your source and destinations are configured.&lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2014-01-16T17:18:09.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5878" PostTypeId="2" ParentId="5874" CreationDate="2014-01-16T20:35:30.117" Score="2" Body="&lt;p&gt;The tunnel destination can't be the subnet of the tunnel itself, which is what you have configured.  And tunnel source does matter.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-16T20:35:30.117" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5879" PostTypeId="2" ParentId="5874" CreationDate="2014-01-16T22:08:17.150" Score="0" Body="&lt;p&gt;For simple GRE tunnels:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The destination address used to build the tunnel should be the actual address of the device that you are trying to reach.  Also, while it is quick to use an interface name as the source for the tunnel, using the actual address will help when it comes to troubleshooting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order for the tunnel to work the destination address of the tunnel should be pingable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also need to configure the tunnel from the other device back to this one.  But if you used addresses for configuring the one end of the tunnel, the other end of the tunnel is simply switching the source and destination. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-2569&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/docs/DOC-2569&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3920" LastActivityDate="2014-01-16T22:08:17.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5884" PostTypeId="2" ParentId="5675" CreationDate="2014-01-17T00:00:39.477" Score="4" Body="&lt;p&gt;After opening a JTAC case I was told there is not a known &lt;code&gt;load set&lt;/code&gt; limit but that RE impact is to be expected. I can verify that I have been able to successfully load and commit a 250,000 line change on a Juniper SRX3600 running Junos 11.4R7.5 while under minimal load taking six minutes to verify and commit.&lt;/p&gt;&#xA;" OwnerUserId="3732" LastActivityDate="2014-01-17T00:00:39.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5887" PostTypeId="2" ParentId="5818" CreationDate="2014-01-17T03:13:45.897" Score="4" Body="&lt;p&gt;Multimode fiber has a bigger core and uses less precise optics than singlemode fiber.  This makes the transceivers (SFPs in your case) cheaper than their singlemode counterparts.  This also means they can't shoot over as long of a distance as singlemode can because the light gets scattered within the fiber and has poor long-range characteristics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OM3 is a manufacturing specification for multimode fiber.  This should probably work well for your needs.  Wikipedia has a good comparison of different multimode fiber specifications:&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Multi-mode_optical_fiber&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Multi-mode_optical_fiber&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need compatible (matching) SFPs on both ends of the fiber and they'll need to match the type of fiber (singlemode vs multimode).  Since the limiting factor for speed in this case would be the SFPs, you'd be fine to get OM3 cable installed and regular gigabit SFPs.  When you're ready to upgrade to a 10Gbps connection, you would need to upgrade your SFPs and possibly your switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll also need to take into consideration what sort of environment your fiber will be in.  If it's run inside a building, you'll be fine with regular fiber, but if it's run through the ground or in an area where it's susceptible to damage, you'd be better off with OSP (OutSide the Premises) fiber cable with sheathing.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-01-17T03:13:45.897" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5888" PostTypeId="1" AcceptedAnswerId="5924" CreationDate="2014-01-17T05:18:38.280" Score="6" ViewCount="5992" Body="&lt;p&gt;I need to connect to 15+ locations to run network scans weekly. All the locations have Fortigate firewalls over which I have full control. The current solution I have is to connect via IPSec VPN to each location one by one to run my scans. I have considered scripting the connection and scanning process but it seems like network connectivity to all locations simultaneously is a superior solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All locations have the same internal subnet (which I can't control) and many locations have dynamic IP addresses. Because of this I was thinking I would need some type of NAT for VPN to give each subnet a unique address on my end allowing me to reach them all. But I am not sure how this would work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering what the best solutions is, either hardware or through a VPN client, that would allow me to more easily gain access to these networks (preferably simultaneously). I've looked into StrongSwan as a VPN server and a Fortigate firewall on my side for form the mesh but don't have a solution yet.&lt;/p&gt;&#xA;" OwnerUserId="3923" LastActivityDate="2014-01-19T03:00:24.877" Title="VPN client to multiple locations simultaneously" Tags="|vpn|fortigate|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5891" PostTypeId="1" AcceptedAnswerId="5894" CreationDate="2014-01-17T09:59:15.143" Score="9" ViewCount="7661" Body="&lt;p&gt;I'm trying to connect from a Cisco 886VA to a Juniper EX2200 via SSH. The connection fails with the following messages on the Cisco:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Jan 17 09:51:20.823: SSH2 CLIENT 0: Server has chosen 2056 -bit dh keys&#xA;*Jan 17 09:51:20.823: %SSH-3-INV_MOD: Invalid modulus length&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way to make this work by changing some parameter on either the Juniper or Cisco device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IOS Version: &lt;code&gt;15.2(4)M5&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;JunOS Version: &lt;code&gt;12.3R3.4&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2017-05-17T09:17:37.043" Title="Cisco can't connect to Juniper device via SSH - Invalid modulus length" Tags="|cisco|juniper|ssh|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5892" PostTypeId="2" ParentId="5891" CreationDate="2014-01-17T10:03:41.523" Score="0" Body="&lt;p&gt;you need to generate new rsa key on cisco and specify larger modulus for the key&lt;/p&gt;&#xA;" OwnerUserId="3478" LastActivityDate="2014-01-17T10:03:41.523" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5893" PostTypeId="1" AcceptedAnswerId="5896" CreationDate="2014-01-17T10:11:37.130" Score="11" ViewCount="4746" Body="&lt;p&gt;Most of the references say &quot;RIP is not scalable&quot; hence can be used only in smaller networks. But none say &quot;WHY?&quot; What is that in RIP that actually preventing it from scaling to larger networks? And HOW OSPF overcomes the disadvantage of RIP?&lt;/p&gt;&#xA;" OwnerUserId="3928" LastEditorUserId="775" LastEditDate="2019-05-04T14:37:16.077" LastActivityDate="2019-05-05T14:16:29.220" Title="Why is RIP not scalable?" Tags="|routing|ospf|rip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5894" PostTypeId="2" ParentId="5891" CreationDate="2014-01-17T10:29:03.600" Score="9" Body="&lt;p&gt;This is definitely an issue with your DH key size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco886va(config)#ip ssh dh min size 4096&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="59" LastEditDate="2014-01-17T11:39:39.983" LastActivityDate="2014-01-17T11:39:39.983" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5895" PostTypeId="2" ParentId="3226" CreationDate="2014-01-17T10:43:15.157" Score="0" Body="&lt;p&gt;Perkins, in his original paper on AODV, actually gives a mathematical proof of how sequence numbers can prevent loops. For details, see A. Proof of the Loop-free Property in &lt;a href=&quot;http://www.cs.cornell.edu/people/egs/615/aodv.pdf&quot; rel=&quot;nofollow&quot;&gt;Ad-hoc On-Demand Distance Vector Routing&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3929" LastActivityDate="2014-01-17T10:43:15.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5896" PostTypeId="2" ParentId="5893" CreationDate="2014-01-17T10:55:10.623" Score="21" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Most of the references say &amp;quot;RIP is not scalable&amp;quot; hence can be used only in smaller networks. But none say &amp;quot;WHY?&amp;quot; What is that in RIP that actually preventing it from scaling to larger networks? And HOW OSPF overcomes the disadvantage of RIP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;Summary&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIPv1&lt;/a&gt; floods routes frequently (every 30 seconds), which introduces large CPU loads as the size of the routing table increases.  This is compounded by the reality that &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIP&lt;/a&gt; recalculates metrics for every route, every time it floods the route out a new interface (regardless of whether there was a topology change or not).  &lt;em&gt;As the number of routes increases, this is prevents &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIP&lt;/a&gt; from scaling as well as other protocols.&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIPv1&lt;/a&gt; is &lt;a href=&quot;http://en.wikipedia.org/wiki/Classful_network&quot; rel=&quot;nofollow noreferrer&quot;&gt;classful&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Open Shortest Path First&quot;&gt;OSPF&lt;/a&gt; floods routes infrequently.  If there is a topology change in the network, only the LSAs changed are flooded; metrics are calculated on these changes.  As such, &lt;em&gt;on-demand route calculations, on &lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_advertisement&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Link State Advertisements&quot;&gt;LSA&lt;/a&gt;s which are flooded infrequently, make &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Open Shortest Path First&quot;&gt;OSPF&lt;/a&gt; scale well.&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Open Shortest Path First&quot;&gt;OSPF&lt;/a&gt; is a classless protocol, which supports &lt;a href=&quot;http://en.wikipedia.org/wiki/Cidr&quot; rel=&quot;nofollow noreferrer&quot;&gt;CIDR&lt;/a&gt;, which also makes it a more scalable protocol than &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIPv1&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIPv1&lt;/a&gt; Details:&lt;/h3&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIP&lt;/a&gt; is a &lt;a href=&quot;http://en.wikipedia.org/wiki/Distance-vector_routing_protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;Distance Vector protocol&lt;/a&gt;; all &lt;a href=&quot;http://en.wikipedia.org/wiki/Distance-vector_routing_protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;Distance Vector protocol&lt;/a&gt;s run the &lt;a href=&quot;http://en.wikipedia.org/wiki/Bellman-Ford_algorithm#Applications_in_routing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bellman-Ford&lt;/a&gt; algorithm.  At a high level, this means:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All routes in the routing table are periodically announced through all interfaces.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIP&lt;/a&gt; floods routes out every &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIP&lt;/a&gt; interface every 30 seconds.  Since &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIP&lt;/a&gt; routes &lt;a href=&quot;http://jjrinehart.wordpress.com/2012/06/26/gossip-girlrouting-by-rumor-part-i/&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;RIP routes by rumor&quot;&gt;by rumor&lt;/a&gt;, this means every router in the topology must work in direct proportion to the size of the routing table every 30 seconds.  The CPU load and traffic jitter implications of this become scary as you approach thousands of routes (particularly on CPU-based routers with no hardware forwarding).&lt;/li&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIP&lt;/a&gt; protocol itself has a fixed maximum hop-count at 15 hops (which is small if you need to do any form of path-weighting).&lt;/li&gt;&#xA;&lt;li&gt;Protocols based on &lt;a href=&quot;http://en.wikipedia.org/wiki/Bellman-Ford_algorithm#Applications_in_routing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bellman-Ford&lt;/a&gt; algorithms are prone to &lt;a href=&quot;http://en.wikipedia.org/wiki/Routing_loop_problem&quot; rel=&quot;nofollow noreferrer&quot;&gt;routing loops&lt;/a&gt;, and &lt;a href=&quot;http://en.wikipedia.org/wiki/Distance-vector_routing_protocol#Count-to-infinity_problem&quot; rel=&quot;nofollow noreferrer&quot;&gt;count-to-infinity&lt;/a&gt; issues.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Open Shortest Path First&quot;&gt;OSPF&lt;/a&gt; Details:&lt;/h3&gt;&#xA;&lt;p&gt;By way of contrast, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Open Shortest Path First&quot;&gt;OSPF&lt;/a&gt; is a &lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_routing_protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;link-state protocol&lt;/a&gt; running &lt;a href=&quot;http://en.wikipedia.org/wiki/Dijkstra%27s_algorithm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dijkstra's algorithm&lt;/a&gt;.  As such:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Each router only announces its &lt;em&gt;directly connected and redistributed routes&lt;/em&gt; in routing updates (called &lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_advertisement&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Link State Advertisements&quot;&gt;LSA&lt;/a&gt;s).&lt;/li&gt;&#xA;&lt;li&gt;Each router floods their own &lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_advertisement&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Link State Advertisements&quot;&gt;LSA&lt;/a&gt; every 30 minutes by default (because the route refresh timer is 3600 seconds, or 1 hour)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_advertisement&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Link State Advertisements&quot;&gt;LSA&lt;/a&gt;s are also flooded when triggered by changes in the routing table&lt;/li&gt;&#xA;&lt;li&gt;Routers use &lt;a href=&quot;http://en.wikipedia.org/wiki/Dijkstra%27s_algorithm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Dijkstra's algorithm&lt;/a&gt; to perform distributed &lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_advertisement&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Link State Advertisements&quot;&gt;LSA&lt;/a&gt; path calculations only when necessary.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2019-05-05T14:16:29.220" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="5898" PostTypeId="2" ParentId="5893" CreationDate="2014-01-17T12:34:50.713" Score="7" Body="&lt;p&gt;Just to add to what Mike has already explained, RIP recalculates its routes and announces all of them every 30 secs.  In a network with thousands of routers and tens of thousands of routes, that's a LOT of routes being calculated -- the routers would be too busy to actually forward any traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you probably already learned, RIP's maximum metric is 15 hops.  That limits the size of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RIP has no hierarchy.  Imagine a world-wide network, and every time a link goes up and down in Singapore, the router in Iceland has to recalculate all its routes.  There's no way to isolate one region from another.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-17T12:34:50.713" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5899" PostTypeId="1" AcceptedAnswerId="5902" CreationDate="2014-01-17T13:33:44.327" Score="1" ViewCount="2291" Body="&lt;p&gt;I have a Draytek Vigor 2920, Juniper SRX 210 router, and Cisco SC300-10 switch. I am very confused; how can I set it up so that I have a public IP address on my Dell R310?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - My ISP, Telenet from Belgium, has given me 8 Public IPs to use in my Dell R310 server but their setup is very disturbing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to setup 213.x.x.254 on my WAN interface in my Draytek router. After that, I have to setup VLAN 1 to get the public IP of 82.x.x.17/29. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, I have to do a &lt;code&gt;ip route 0.0.0.0 0.0.0.0 213.x.x.253&lt;/code&gt; for my default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - I have completed the steps above, but the problem is following:&#xA;Dell R310 has network interface eth0 with IP 192.168.1.10 and in the router I have a DMZ from 84.x.x.1 to 192.168.1.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of my problems start from here, because when the SIP Protocol sends traffic, it uses 192.x.x.x, not 84.x.x.x; a result of NAT problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: How can I have my Dell R310 with a real public IP?&#xA;So that eth0 isn't configured like this: 192.168.1.10.&#xA;Rather, a static IP set as: 84.x.x.1 (I have NAT problems for this reason)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1gFNu.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Draytek Vigor 2920 series i have: setup the WAN IP but how can i assign the WAN Public IP to VLAN or Local interface 1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP wants me to keep this setup in my DrayTek: &lt;a href=&quot;http://fpaste.org/69305/13899673/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://fpaste.org/69305/13899673/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/neh8I.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/upkXS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;EDIT: FYI&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a) Thank you to the excellent answer after doing them correctly its working.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;b) DrayTek router is NOT consumer/residential routers/low quality router&#xA;they have been used in many many Enterprises, Telecom sectors, and many large enterprises.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c) DrayTek router was designed to make easy/quick configurations (compared to Cisco/Juniper complex)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following setup specially IP routed subnet module has resolved my problem, which is allowing me no NAT but straight public IP to my LAN interface without having any firewall/blockage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NuCZ6.png&quot; alt=&quot;Setup the Public IP WAN Tunnel&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/p0KGn.png&quot; alt=&quot;Setup DHCP server + wifi + Public IP for manually to setup&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/RD4QX.png&quot; alt=&quot;Setup Public IP&amp;#39;s without NAT&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Xrhfw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: Draytek supports reply (hope it helps others)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are not supposed to set the external IP address from your provider as the LAN address of the DrayTek.&#xA;To achieve this situation, you have to use a function called 'Public Routed Subnet'. We have a dutch manual available for using this function.&#xA;Please refer to the following manual: &lt;a href=&quot;http://www.draytek.nl/files/Public%20routed%20subnet_1.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.draytek.nl/files/Public%20routed%20subnet_1.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3931" LastEditorUserId="3931" LastEditDate="2014-01-20T09:04:51.667" LastActivityDate="2014-01-20T09:04:51.667" Title="How can i make Public IP of this ISP given information?" Tags="|cisco|ipv4|vlan|juniper|wan|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5902" PostTypeId="2" ParentId="5899" CreationDate="2014-01-17T14:34:32.280" Score="4" Body="&lt;p&gt;I’m trying to understand what you’re asking, and based on how you described the network setup, there isn’t any good reason to use private addressing; even if you need to use separate network for other functions.  The &lt;a href=&quot;https://www.draytek.com/index.php?option=com_k2&amp;amp;view=item&amp;amp;id=2465&amp;amp;Itemid=660&amp;amp;lang=en&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt; you provided in the comments advertises that it handle multiple subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would start with setting your Draytek Vigor up as a DHCP server that assigns the public address space (&lt;code&gt;84.x.x.*&lt;/code&gt;) you have been allotted. This will take away the NAT and allow inbound requests to your public addresses with relative ease.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to keep your private IP address space intact, then you would set up your server (&lt;code&gt;192.168.1.10&lt;/code&gt;) as the DMZ for your WAN address (&lt;code&gt;212.x.x.x&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-01-17T14:34:32.280" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5903" PostTypeId="2" ParentId="5899" CreationDate="2014-01-17T14:39:02.070" Score="5" Body="&lt;p&gt;You are probably better off with not using NAT for the server. I don't know how to configure the Draytek, but your Juniper SRX is certainly able to do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Your WAN address of the router/firewall is &lt;code&gt;213.x.x.254/30&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The default gateway of the router/firewall is &lt;code&gt;213.x.x.253&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Telenet will route &lt;code&gt;82.x.x.16/29&lt;/code&gt; to &lt;code&gt;213.x.x.254&lt;/code&gt;. From the &lt;code&gt;/29&lt;/code&gt; subnet you will be able to use addresses &lt;code&gt;82.x.x.17&lt;/code&gt; - &lt;code&gt;82.x.x.22&lt;/code&gt;. I'm using the first available address as the router/firewall address. That leaves &lt;code&gt;82.x.x.18&lt;/code&gt; to &lt;code&gt;82.x.x.22&lt;/code&gt; for other devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because you probably have both devices that have to be reachable from the internet with their own public address and devices that don't need that it is useful to create two internal networks: a DMZ and a LAN. The public addresses are routed to the DMZ and the rest of the devices (your office?) is connected to the LAN. The LAN uses NAT to save IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First the DMZ:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Your DMZ address of the router/firewall is &lt;code&gt;82.x.x.17/29&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Your server's address can be anything from &lt;code&gt;82.x.x.18&lt;/code&gt; to &lt;code&gt;82.x.x.22&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Your server's default gateway is &lt;code&gt;82.x.x.17&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;You configure all of this this statically&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And the LAN:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Your LAN address of the router/firewall is (for example) &lt;code&gt;192.168.1.1/24&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Your devices use &lt;code&gt;192.168.1.1&lt;/code&gt; as their default gateway&lt;/li&gt;&#xA;&lt;li&gt;The router/firewall runs a DHCP server to supply all necessary information to connected devices&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You now have to configure a firewall policy on the router/firewall that allows all the traffic. An example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Allow everything from the DMZ to the internet without NAT&lt;/li&gt;&#xA;&lt;li&gt;Allow everything from the LAN to the internet using NAT&lt;/li&gt;&#xA;&lt;li&gt;Allow everything from the LAN to the DMZ without NAT&lt;/li&gt;&#xA;&lt;li&gt;Allow nothing from the internet to the LAN&lt;/li&gt;&#xA;&lt;li&gt;Allow (almost?) nothing from the DMZ to the LAN&lt;/li&gt;&#xA;&lt;li&gt;Allow only the publicly available services from the internet to the DMZ&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the DMZ and LAN you can use either physically different ethernet ports and ethernet switches, or you can use VLANs to be able to implement it on a single switch. You could even make the DMZ and LAN one network, but then you cannot protect the LAN from the server (in case someone breaks in or finds an exploitable bug).&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-01-17T14:39:02.070" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5904" PostTypeId="1" CreationDate="2014-01-17T17:54:41.833" Score="4" ViewCount="1236" Body="&lt;p&gt;I have a Cisco ASA and cannot seem to control bandwith from the Internet to the device that  well.  The ASA supports Shaping, but only on outbound traffic which works great. My question is how to protect voice and video applications from FTP application, if the traffic is coming from the internet to my firewall . This would be download traffic, regarding upload traffic, the shaper works well for this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried policing, but that just drops traffic, forcing a retransmit, so it just doubles the mount of traffic going over the WAN, which does not seem like a good solution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have clients who move a lot of data and from time to time it stomps on the inbound voice and video traffic.&lt;/p&gt;&#xA;" OwnerUserId="1352" LastEditorUserId="775" LastEditDate="2014-01-17T18:05:16.217" LastActivityDate="2014-01-17T18:48:26.793" Title="How do you control WAN Download Bandwith on an ASA?" Tags="|cisco|cisco-asa|qos|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5905" PostTypeId="2" ParentId="5904" CreationDate="2014-01-17T18:11:52.720" Score="4" Body="&lt;p&gt;If you think about it for a moment, you'll realize that the congestion is happening at the far end of your WAN circuit (i.e., at your provider).  Their interface is not prioritizing real-time traffic, so you are seeing poor audio and video performance. It is as if you are at the finish line of an auto race, but your team can't get out of their driveway because of all the big trucks on the highway.  Unfortunately, this means that there is not a lot you can do from your end. The traffic has already been delayed by the time it gets to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One possibility is to use a packet shaping appliance.  This will control your FTP traffic by modifying the window size in the ACK packets your ftp server sends back.  If the window size is reduced, the sender will have to slow down.  This of course means buying another appliance, which you may not be able to do.  But there isn't much you can do on the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also talk with your provider -- perhaps they would be willing to add some QoS on their side (doubtful, but worth asking).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-01-17T18:48:26.793" LastActivityDate="2014-01-17T18:48:26.793" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5909" PostTypeId="2" ParentId="2594" CreationDate="2014-01-17T23:59:33.903" Score="2" Body="&lt;p&gt;For the sake of completeness: Serial links are not solely used for gateway-WAN connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, there are companies which host your network equipment and link your device via serial link to their infrastructure. Although your device is online with a public address, it still is not a DTE-like topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another even more LAN-related serial link may be used on a daily basis by yourself and your colleagues: USB. Since USB does not only connect an end device to a storage device, but is also hosts to networks. An example for a host-to-LAN connection would be a tablet user currently being dislocated from a WAP. Because tablets usually do not have an Ethernet interface, a work-around is necessary. An example for a host-to-WAN connection would be field personnel accessing mobile broadband services via a pluggable antenna.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2014-01-17T23:59:33.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5910" PostTypeId="1" AcceptedAnswerId="5912" CreationDate="2014-01-18T00:51:49.083" Score="3" ViewCount="10725" Body="&lt;p&gt;I have a massive ACL that i'm dealing with and I can't seem to find what line is blocking me. Is there a way for packet-tracer to help me figure out more specifically where i'm getting blocked at?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;packet-tracer input AAAA tcp 10.A.B.1 5555 10.C.D.80 PORT# d&#xA;&#xA;Phase: 3&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: input&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   0.0.0.0         0.0.0.0         AAAA&#xA;&#xA;Phase: 4&#xA;Type: ACCESS-LIST&#xA;Subtype: &#xA;Result: DROP&#xA;Config:&#xA;Implicit Rule&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x7ffd9a7f9e40, priority=111, domain=permit, deny=true&#xA;        hits=28704780, user_data=0x0, cs_id=0x0, flags=0x4000, protocol=0&#xA;        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0 dscp=0x0&#xA;        input_ifc=AAAA, output_ifc=AAAA&#xA;&#xA;Result:&#xA;input-interface: AAAA&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: AAAA&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: drop&#xA;Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some clues that I have gathered (not sure if they are correct though)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The drop reason indicates that a configured line is dropping the packet and not the default deny at the end&lt;/li&gt;&#xA;&lt;li&gt;The packet is getting denied at the output ACL on interface AAAA&lt;/li&gt;&#xA;&lt;li&gt;There is a id string and a hit counter but I don't know how to match that up with anything&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="108" LastActivityDate="2015-09-14T21:20:18.940" Title="How to decipher dropped packet from packet-tracer output?" Tags="|cisco-asa|acl|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5911" PostTypeId="2" ParentId="2774" CreationDate="2014-01-18T00:56:44.177" Score="4" Body="&lt;p&gt;Run this command on the ap:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh controllers dot11 0 | inc dBm&#xA;sh controllers dot11 1 | inc dBm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Exactly as typed, the case matter in the piped command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen hundreds of these AP's in autonomous mode that don't have their power levels set properly. this command will reveal it. Output will look like this obviously without the bullets....&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BCDE-MDF-AP01#sh controllers dot11 0 | inc dBm&#xA;Configured TxPower:             22 dBm (Level Index 1)&#xA;Allowed Power Levels:           22 19 16 13 10  7  dBm&#xA;Allowed Client Power Levels:    22 19 16 13 10  7  dBm&#xA;Data Rate Sensitivity (rate, SNR dB, Contention dBm)&#xA;     Active Level              22 dBm (OFDM 22 dBm) &#xA;     Metric unit               dBm&#xA;     HAL Per antenna Tx Power (in dBm)&#xA;     1.0 to m7t4  , 2  dBm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you see (1.0 to m7t4  , 2  dBm)  thats your issue&lt;/p&gt;&#xA;&#xA;&lt;p&gt;go to the each radio interface and enter the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;int dot11 0&#xA;power local max&#xA;power client max&#xA;int dot11 1&#xA;power local max&#xA;power client max&#xA;end&#xA;wr mem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now  check the interface again and you will see and you see much higher rates:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ABCDE-MDF-AP01#show controllers dot11 0 | i dBm&#xA;Configured TxPower:             22 dBm (Level Index 1)&#xA;Allowed Power Levels:           22 19 16 13 10  7  dBm&#xA;Allowed Client Power Levels:    22 19 16 13 10  7  dBm&#xA;Data Rate Sensitivity (rate, SNR dB, Contention dBm)&#xA;        Active Level              22 dBm (OFDM 22 dBm) &#xA;        Metric unit               dBm&#xA;        HAL Per antenna Tx Power (in dBm)&#xA;     1.0 to m6-2  , 17  dBm&#xA;    m7-2 to m7-2  , 15  dBm&#xA;    m8-2 to m13-2 , 17  dBm&#xA;   m14-2 to m14-2 , 16  dBm&#xA;   m15-2 to m15-2 , 15  dBm&#xA;   m16-2 to m21-2 , 17  dBm&#xA;   m22-2 to m22-2 , 15  dBm&#xA;   m23-2 to m23-2 , 14  dBm&#xA;    m0-4 to m6-4  , 17  dBm&#xA;  Output suppressed...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3942" LastEditorUserId="619" LastEditDate="2014-01-18T07:50:47.737" LastActivityDate="2014-01-18T07:50:47.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5912" PostTypeId="2" ParentId="5910" CreationDate="2014-01-18T01:14:42.100" Score="4" Body="&lt;p&gt;&lt;code&gt;Implicit Rule&lt;/code&gt; and &lt;code&gt;AAAA&lt;/code&gt; being the in and out interface... That's called &lt;em&gt;hair-pinning&lt;/em&gt;, and it's generally not allowed.  It works on my asa, but I have the following enabled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-01-18T01:14:42.100" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5914" PostTypeId="1" AcceptedAnswerId="5916" CreationDate="2014-01-18T16:01:23.597" Score="14" ViewCount="10981" Body="&lt;p&gt;For example, a &lt;strong&gt;Whois&lt;/strong&gt; query for &lt;strong&gt;4.4.4.0&lt;/strong&gt; says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Does the owner simply declare the block or a subnet are not up for sale? Or does non-portable have a deeper, technical meaning?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the relevant section from the Whois query:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NetRange:       4.0.0.0 - 4.255.255.255&#xA;CIDR:           4.0.0.0/8&#xA;OriginAS:       &#xA;NetName:        LVLT-ORG-4-8&#xA;NetHandle:      NET-4-0-0-0-1&#xA;Parent:         &#xA;NetType:        Direct Allocation&#xA;RegDate:        1992-12-01&#xA;Updated:        2012-02-24&#xA;Ref:            http:// whois.arin.net/rest/net/NET-4-0-0-0-1&#xA;&#xA;OrgName:        Level 3 Communications, Inc.&#xA;OrgId:          LVLT&#xA;Address:        1025 Eldorado Blvd.&#xA;City:           Broomfield&#xA;StateProv:      CO&#xA;PostalCode:     80021&#xA;Country:        US&#xA;RegDate:        1998-05-22&#xA;Updated:        2012-01-30&#xA;Comment:        ADDRESSES WITHIN THIS BLOCK ARE NON-PORTABLE&#xA;Ref:            http:// whois.arin.net/rest/org/LVLT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="-1" LastEditDate="2014-01-18T20:34:13.950" LastActivityDate="2014-01-18T21:47:00.097" Title="What is a non-portable IPv4 address block?" Tags="|routing|ipv4|arin|routing-registry|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5916" PostTypeId="2" ParentId="5914" CreationDate="2014-01-18T18:01:15.610" Score="18" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Does the owner simply declare the block or a subnet are not up for sale? Or does non-portable have a deeper, technical meaning?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Non-portablility isn't about sales... it's a technical term.&lt;/p&gt;&#xA;&lt;h3&gt;Address Portability&lt;/h3&gt;&#xA;&lt;p&gt;Non-portable IP addresses belong to a certain organization, and an end-user of the non-portable IP address is &lt;strike&gt;&lt;em&gt;not&lt;/em&gt; permitted to&lt;/strike&gt; discouraged from announcing those IP addresses to another organization without the owing organization &lt;a href=&quot;https://www.arin.net/resources/request/reassignments.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SWIP&lt;/a&gt;ing the addresses to the end-user.&lt;/p&gt;&#xA;&lt;p&gt;The concept of portability comes from the &lt;a href=&quot;https://www.arin.net/policy/nrpm.html#four11&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARIN Number Resource Policy Manual 2014.1, Section on IPv4&lt;/a&gt; (&lt;em&gt;emphasis mine&lt;/em&gt;)...&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;4. IPv4&#xA;&#xA; 4.1. General Principles&#xA;&#xA;  4.1.1. Routability&#xA;&#xA;  Provider independent (*portable*) addresses issued directly from ARIN &#xA;  or other Regional Registries are not guaranteed to be globally routable.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The reason the RIRs don't guarantee that portable addresses are globally routable is because the RIRs can't influence route filtering policies of providers.&lt;/p&gt;&#xA;&lt;h3&gt;Why some blocks are non-portable&lt;/h3&gt;&#xA;&lt;p&gt;Addresses are either &lt;em&gt;allocated&lt;/em&gt; or &lt;em&gt;assigned&lt;/em&gt;.  If an address block is &lt;em&gt;assigned&lt;/em&gt; to the ISP, then that ISP cannot sub-assign the addresses.  Quoting &lt;a href=&quot;https://www.arin.net/policy/nrpm.html#two5&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;assigned addresses cannot be sub-assigned&quot;&gt;ARIN Number Resource Policy Manual 2014.1, Section on 2.5&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; 2.5. Allocate and Assign&#xA;&#xA; A distinction is made between address allocation and address assignment, &#xA; i.e., ISPs are &amp;quot;allocated&amp;quot; address space as described herein, while end-&#xA; users are &amp;quot;assigned&amp;quot; address space.&#xA;&#xA; &amp;gt; Allocate - To allocate means to distribute address space to IRs for &#xA; the purpose of subsequent distribution by them.&#xA;&#xA; &amp;gt; Assign - To assign means to delegate address space to an ISP or &#xA; end-user, for specific use within the Internet infrastructure &#xA; they operate. Assignments must only be made for specific purposes &#xA; documented by specific organizations and are not to be sub-assigned to &#xA; other parties.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;References&lt;/h3&gt;&#xA;&lt;p&gt;Registries operate in accordance with &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7020&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7020&lt;/a&gt;, which replaced &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2050&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2050&lt;/a&gt;.  Arguably, much of the structure around these restrictions comes from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7020#section-2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7020 Section 2, Goals&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Hierarchical Allocation: Given current routing technology, the&#xA;distribution of IP addresses in a hierarchical manner increases&#xA;the likelihood of continued scaling of the Internet's routing&#xA;system.  As such, it is currently a goal to allocate IP addresses&#xA;in such a way that permits aggregation of these addresses into a&#xA;minimum number of routing announcements.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;End Note&lt;/h3&gt;&#xA;&lt;p&gt;You asked about &amp;quot;the block or a subnet&amp;quot;; however, ARIN deals with allocations of &lt;em&gt;individual IP addresses&lt;/em&gt;, &lt;a href=&quot;http://lists.arin.net/pipermail/arin-ppml/2001-August/000312.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Scott Richard Slater: ARIN deems their IP addresses portable.&quot;&gt;not subnets or blocks of addresses&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-01-18T21:47:00.097" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5917" PostTypeId="1" CreationDate="2014-01-18T18:09:37.113" Score="4" ViewCount="803" Body="&lt;p&gt;&lt;br&gt;&#xA;My topology is working perfectly fine and is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CE1 &amp;lt;-&amp;gt; PE1 &amp;lt;-&amp;gt; P1 &amp;lt;-&amp;gt; P2 &amp;lt;-&amp;gt; PE2 &amp;lt;-&amp;gt; CE2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;CE1 &amp;lt;-&amp;gt; PE1&lt;/code&gt; and &lt;code&gt;CE2 &amp;lt;-&amp;gt; PE2&lt;/code&gt; are having OSPFv3 with address-family ipv4 and ipv6 both.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;PE1 &amp;lt;-&amp;gt; PE2&lt;/code&gt; is running MP-iBGP with dual-stack support&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Redistribution of OSPF in MP-iBGP is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Config snippet in PE1 &amp;amp; PE2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address-family ipv6 vrf custA&#xA;redistribute connected&#xA;redistribute ospf 6&#xA;no sync&#xA;&#xA;address-family ipv4 vrf custA&#xA;redistribute connected&#xA;redistribute ospfv3 6&#xA;no sync&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;CE1 &amp;amp; CE2 are able to reach the IPv4 and IPv6 subnets of each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the difference in these two highlighted commands:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;code&gt;ipv6 address-family&lt;/code&gt; it should be &lt;code&gt;redistribute ospf 6&lt;/code&gt; command while in &lt;code&gt;ipv4 address-family&lt;/code&gt; it should always be &lt;code&gt;redistribute ospfv3 6&lt;/code&gt;.  If I interchange these commands within the address-families, both IPv4 &amp;amp; IPv6 networks of CE1 &amp;amp; CE2 become unreachable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems to be a mystery to me. Pl let  me know if any other details are required. Any clarification is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="3950" LastEditorUserId="775" LastEditDate="2014-01-18T18:23:18.363" LastActivityDate="2016-03-16T18:11:47.930" Title="Dual stack OSPF redistribution in MP-BGP" Tags="|cisco|routing|bgp|ospf|ipv6|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5919" PostTypeId="2" ParentId="5914" CreationDate="2014-01-18T20:19:19.200" Score="4" Body="&lt;p&gt;I am not a specialist in ARIN procedure, but here is how it works in RIPE-land:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Provider Aggregated (&quot;PA&quot;, &quot;non-portable&quot;) resources are blocks &lt;em&gt;allocated&lt;/em&gt; to a Local Internet Registry (LIR) - normally the end-users ISP - parts of which the LIR &lt;em&gt;assigns&lt;/em&gt; to its end-users. The resources thus assigned remain under the management of the LIR and stay assigned to the end-user while the assignment criteria are valid and the end-user maintains a contractual relationship with the LIR. If the end-user ceases its business relationship with the LIR, the assigned resources &lt;em&gt;must&lt;/em&gt; be returned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For historical reference Provider Independent (PI) resources are no longer available from RIPE (due to IPv4 exhaustion); PI (&quot;portable&quot;) resources are &lt;em&gt;assigned&lt;/em&gt; to the end user via a LIR, or directly from the RIPE NCC. They are not managed by the LIR and can be moved between ISPs as the end-user sees fit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Policy for IPv6 is similar and I've disregarded &quot;IPv4 free market&quot; policies for shortness' sake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ripe.net/ripe/docs/ripe-599&quot; rel=&quot;nofollow&quot;&gt;RIPE-599, &quot;IPv4 Address Allocation and Assignment Policies&quot;&lt;/a&gt; has the entire policy text for ipv4.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorUserId="775" LastEditDate="2014-01-18T20:24:43.227" LastActivityDate="2014-01-18T20:24:43.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5923" PostTypeId="2" ParentId="5784" CreationDate="2014-01-19T02:55:08.967" Score="2" Body="&lt;p&gt;My answer is platform-independent. Your model can be achieved. You want the wireless and wireline to back each other up (likely the wireless as primary network path with wireline).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spanning Tree interfaces will carry a cost that the network will use to calculate a loop-free topology; any remaining loops will have their interfaces turned down. Two things to mitigate this are choosing the interfaces to 'normally' be down by adjusting their cost to make them appear less appealing in the topology calculation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also limit the interfaces that give out Spanning Tree packets, or how they announce them (are they an end-link, a trunk/uplink, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find the capabilities of your gear network-wide, and likely find another provider that has worked out a similar solution in their environment. Perhaps you will need to break down the L2 flat network into L3 sections joined by an IGP like OSPF or simple static routes, etc.&lt;/p&gt;&#xA;" OwnerUserId="3958" LastActivityDate="2014-01-19T02:55:08.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5924" PostTypeId="2" ParentId="5888" CreationDate="2014-01-19T03:00:24.877" Score="2" Body="&lt;p&gt;I think you need a hub-n-spoke VPN where one location acts as the main termination point for all of the other locations, and then routes between them for connectivity for them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortinet devices definitely support this. And I don't think they will have a problem with the same LAN topology on each local network; you're correct in that you will likely have to do some NAT to achieve that, but that will actually help you keep the traffic 'straight' in your head anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the link for the hub-and-spoke VPN solution:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/hub-and-spoke.096.02.html&quot; rel=&quot;nofollow&quot;&gt;http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/hub-and-spoke.096.02.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3958" LastActivityDate="2014-01-19T03:00:24.877" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5925" PostTypeId="2" ParentId="5917" CreationDate="2014-01-19T03:07:12.313" Score="4" Body="&lt;p&gt;Only OSPFv3 supports IPv6 (not OSPFv2), so in IPv6 address-family I believe they assume that 'redistribute ospf 6' means you would by default only want OSPFv3 protocol-garnered routes, because that's the only source of them and you're in the family that deals with those routes already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Contrastly, in IPv4 address family, 'redistribute ospfv3 6' specifically says that the protocol ospfv3 should have it's ipv6 routes redistributed. It's like a reminder that you can only get them from OSPFv3, and not OSPFv2 (though you can get ipv4 routes from OSPFv3, as it was intended to not only support ipv6, but also ipv4 so it could replace OSPFv2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's my 'educated guess' anyway :)&lt;/p&gt;&#xA;" OwnerUserId="3958" LastActivityDate="2014-01-19T03:07:12.313" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5927" PostTypeId="1" CreationDate="2014-01-19T06:28:01.057" Score="2" ViewCount="1167" Body="&lt;p&gt;Can the destination address be changed by using outside NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing protocols cannot be changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my network:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/CtZ9o.jpg&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3950" LastEditorUserId="3191" LastEditDate="2014-03-23T21:20:29.707" LastActivityDate="2014-03-23T21:20:29.707" Title="Destination NAT based IP SLA Trigger" Tags="|routing|router|nat|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5928" PostTypeId="1" AcceptedAnswerId="5929" CreationDate="2014-01-19T13:03:33.507" Score="4" ViewCount="1223" Body="&lt;p&gt;I'm reading about IP at the moment and one thing I haven't been able to comprehend very well, is the retransmit situation for IP packets with DF set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this situation, I assume the following happens between PC's direct router/gateway agrees on MTU but not the next router in the path. So let's assume the following diagram PC -&gt; R1 -&gt; R2. When R2 rejects the packet because the datagram is larger than its MTU, it drops the packet and sends an ICMP message with &quot;Packet is too big&quot; plus the IP header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Who is responsible for retransmitting the message? is it the previous router or the source (PC) ? and if so, how does the PC know which datagram to resend? are datagrams kept for a while in memory after they've been sent or retransmission is only feasible for tcp-ip packets? &lt;/p&gt;&#xA;" OwnerUserId="2314" LastEditorUserId="775" LastEditDate="2014-01-19T14:02:41.590" LastActivityDate="2014-01-20T21:57:22.567" Title="Path MTU discovery and retransmission" Tags="|routing|ipv4|mtu|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5929" PostTypeId="2" ParentId="5928" CreationDate="2014-01-19T13:55:18.093" Score="6" Body="&lt;p&gt;If a PC receives an ICMP Fragmentation required message, the PC must resend any traffic.  Normally only TCP handles retransmission (including loss from MTU issues); TCP also includes support for &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1191&quot; rel=&quot;nofollow noreferrer&quot;&gt;Path MTU discovery&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;In case of non-TCP applications which are written to support PMTU discovery and retransmission, the PC could know which packets to resend because ICMP errors include the context of the packet which generated the error... this is a dump from &lt;code&gt;tshark -Vi eth0 icmp&lt;/code&gt;... Look below &lt;code&gt;MTU of next hop&lt;/code&gt;, it shows that this ICMP message was received in response to a UDP packet to 172.16.255.1 (with DF set), which was too large.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Internet Protocol, Src: 172.16.1.1 (172.16.1.1), Dst: 172.16.1.5 (172.16.1.5)&#xA;    Version: 4&#xA;    Header length: 20 bytes&#xA;    Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00)&#xA;        1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30)&#xA;        .... ..0. = ECN-Capable Transport (ECT): 0&#xA;        .... ...0 = ECN-CE: 0&#xA;    Total Length: 56&#xA;    Identification: 0x6297 (25239)&#xA;    Flags: 0x00&#xA;        0.. = Reserved bit: Not Set&#xA;        .0. = Don't fragment: Not Set&#xA;        ..0 = More fragments: Not Set&#xA;    Fragment offset: 0&#xA;    Time to live: 255&#xA;    Protocol: ICMP (0x01)&#xA;    Header checksum: 0xfe46 [correct]&#xA;        [Good: True]&#xA;        [Bad : False]&#xA;    Source: 172.16.1.1 (172.16.1.1)&#xA;    Destination: 172.16.1.5 (172.16.1.5)&#xA;Internet Control Message Protocol&#xA;    Type: 3 (Destination unreachable)&#xA;    Code: 4 (Fragmentation needed)&#xA;    Checksum: 0x8813 [correct]&#xA;    MTU of next hop: 1420&#xA;    Internet Protocol, Src: 172.16.1.5 (172.16.1.5), Dst: 172.16.255.1 (172.16.255.1)&#xA;        Version: 4&#xA;        Header length: 20 bytes&#xA;        Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)&#xA;            0000 00.. = Differentiated Services Codepoint: Default (0x00)&#xA;            .... ..0. = ECN-Capable Transport (ECT): 0&#xA;            .... ...0 = ECN-CE: 0&#xA;        Total Length: 1500&#xA;        Identification: 0x3aff (15103)&#xA;        Flags: 0x02 (Don't Fragment)&#xA;            0.. = Reserved bit: Not Set&#xA;            .1. = Don't fragment: Set&#xA;            ..0 = More fragments: Not Set&#xA;        Fragment offset: 0&#xA;        Time to live: 1&#xA;            [Expert Info (Note/Sequence): &amp;quot;Time To Live&amp;quot; only 1]&#xA;                [Message: &amp;quot;Time To Live&amp;quot; only 1]&#xA;                [Severity level: Note]&#xA;                [Group: Sequence]&#xA;        Protocol: UDP (0x11)&#xA;        Header checksum: 0xe0ea [correct]&#xA;            [Good: True]&#xA;            [Bad : False]&#xA;        Source: 172.16.1.5 (172.16.1.5)&#xA;        Destination: 172.16.255.1 (172.16.255.1)&#xA;    User Datagram Protocol, Src Port: 60742 (60742), Dst Port: 33437 (33437)&#xA;        Source port: 60742 (60742)&#xA;        Destination port: 33437 (33437)&#xA;        Length: 1480&#xA;        Checksum: 0xf73f [unchecked, not all data available]&#xA;            [Good Checksum: False]&#xA;            [Bad Checksum: False]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-01-20T21:57:22.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5931" PostTypeId="1" AcceptedAnswerId="5942" CreationDate="2014-01-19T18:09:55.443" Score="4" ViewCount="500" Body="&lt;p&gt;For 10GBASE-T / IEEE 802.3ae the Physical Coding Sublayer is extended with a low-density parity-check (LDPC) code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IEEE 802.3™-2012 55.1.3.1 Physical Coding Sublayer (PCS):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The 3259 bits are divided into 3 × 512 bits and 1723 bits. The 3 × 512 bits [...] remain uncoded. The 1723 bits are encoded by a systematic LDPC(1723,2048) encoder [...]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Using a Forward Error Correction (FEC) code increases the reliability, because transmission errors could be corrected by the receiver. Two drawbacks of FEC are the increased message size and additional encoding and decoding implementations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the bit rate of LDPC codes increases with the message length and the encoding and decoding operations scale (almost) linearly&lt;sup&gt;1&lt;/sup&gt; to the message length.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the benefit of sending some data uncoded, especially as the encoding and decoding of LDPC is already used for the remaining data?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;End Notes&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt;&lt;sub&gt;the encoding of ldpc scales (depending of the implementation) between O(N^2) and O(N+g^2)&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3963" LastEditorUserId="8499" LastEditDate="2016-11-29T03:38:11.610" LastActivityDate="2020-02-08T01:14:32.720" Title="What is the benefit of sending some data uncoded in a 10GBASE-T PHY frame?" Tags="|ethernet|protocol-theory|layer1|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5933" PostTypeId="2" ParentId="5928" CreationDate="2014-01-20T01:04:57.023" Score="5" Body="&lt;p&gt;Note: This only works for TCP.  As per spec, the originator of the traffic must keep all traffic until it has been acknowledged by the receiver.  If a packet is lost in transit, it can be resent.  If a packet must be smaller, it can be resent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;em&gt;can&lt;/em&gt; be done with UDP, but it requires the application do it. (i.e. replicate TCP's reliable transport, at which point there's no reason not to use TCP.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-01-20T01:04:57.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5935" PostTypeId="1" AcceptedAnswerId="5938" CreationDate="2014-01-20T06:06:33.603" Score="2" ViewCount="6896" Body="&lt;p&gt;I have a specific static routes that require advertising into EIGRP and eventually into BGP for remote offices.  My goal is to cut down on the configuration updates required for updating not only the static routes for new additions, but the route-map ACL for EIGRP, and the policy-route ACL to the next hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've learned that route tags may be an option for routing traffic with less configuration.  Basically I can tag a static route with a number, (such as 20).  Then I can create a route-map that matches on tag 20, and sets tag 20 and configure this within EIGRP to match and advertise that tag again.  On the receiving router I should be able to perform this same step for BGP in a similar manner (EIGRP-to-BGP route-map that retags), however, I still have a policy route that doesn't quite fit with this tagging method (ACL has a source/destination - whereas a prefix list does not).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal here is to create specific static routes with tags, and have those tags carry through and advertise properly (including a policy route-map or equivalent ) without me having to update 3 other ACLs everytime.  Policy-map doesn't play well with the redistribution - any one come up with other ideas for something similar?&lt;/p&gt;&#xA;" OwnerUserId="1989" LastActivityDate="2017-02-24T20:44:59.507" Title="route tags and policy routing alternatives - traffic engineering question" Tags="|cisco|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5936" PostTypeId="2" ParentId="5853" CreationDate="2014-01-20T06:47:05.750" Score="2" Body="&lt;p&gt;When an ICMP Echo message is lost, it is lost indefinitely.  The message will not be retransmitted because ICMP rides on top of IP, which does not provide reliability.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think about issuing a ping over a path that may have packet loss.  Some pings will be lost, while others may receive a reply.  If ICMP provided reliability and was able to retransmit, you would never see a ping fail over a degraded path, although the default timeout of most ping utilities is 2 seconds.&lt;/p&gt;&#xA;" OwnerUserId="121" LastActivityDate="2014-01-20T06:47:05.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5938" PostTypeId="2" ParentId="5935" CreationDate="2014-01-20T07:34:55.733" Score="3" Body="&lt;p&gt;I am not 100% sure whether tags are carried in BGP updates but here is what I put together pretty quick:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KvHWn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router &quot;Static&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 172.16.1.1 255.255.255.0&#xA;!&#xA;interface Loopback1&#xA; ip address 172.16.2.1 255.255.255.0&#xA;&#xA;interface Ethernet0/1&#xA; ip address 172.16.0.1 255.255.255.0&#xA; half-duplex&#xA;&#xA;ip route 0.0.0.0 0.0.0.0 172.16.0.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/0&#xA; ip address 10.0.0.1 255.255.255.252&#xA; half-duplex&#xA;&#xA;interface Ethernet0/1&#xA; ip address 172.16.0.2 255.255.255.0&#xA; half-duplex&#xA;&#xA;ip route 172.16.1.0 255.255.255.0 172.16.0.1 tag 20&#xA;ip route 172.16.2.0 255.255.255.0 172.16.0.1 tag 20&#xA;&#xA;router eigrp 100&#xA; redistribute static route-map MyRouteMap&#xA; network 10.0.0.0 0.0.0.3&#xA; no auto-summary&#xA;&#xA;route-map MyRouteMap permit 10&#xA; match tag 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/0&#xA; ip address 10.0.0.2 255.255.255.252&#xA; half-duplex&#xA;&#xA;interface Ethernet0/1&#xA; ip address 10.0.0.5 255.255.255.252&#xA; half-duplex&#xA;&#xA;router eigrp 100&#xA; network 10.0.0.0 0.0.0.3&#xA; no auto-summary&#xA;&#xA;router bgp 65000&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; redistribute eigrp 100 route-map MyRouteMap&#xA; neighbor 10.0.0.6 remote-as 65000&#xA; neighbor 10.0.0.6 next-hop-self&#xA; no auto-summary&#xA;&#xA;route-map MyRouteMap permit 10&#xA; match tag 20&#xA;&#xA;R2#show ip route 172.16.1.0&#xA;Routing entry for 172.16.1.0/24&#xA;  Known via &quot;eigrp 100&quot;, distance 170, metric 307200&#xA;  Tag 20, type external&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router R3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/1&#xA; ip address 10.0.0.6 255.255.255.252&#xA; half-duplex&#xA;&#xA;router bgp 65000&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; neighbor 10.0.0.5 remote-as 65000&#xA; no auto-summary&#xA;&#xA;R3#show ip bgp 172.16.1.0&#xA;BGP routing table entry for 172.16.1.0/24, version 3&#xA;Paths: (1 available, best #1, table Default-IP-Routing-Table)&#xA;  Not advertised to any peer&#xA;  Local&#xA;    10.0.0.5 from 10.0.0.5 (10.0.0.2)&#xA;      Origin incomplete, metric 307200, localpref 100, valid, internal, best&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope this is what you were asking for.&lt;/p&gt;&#xA;" OwnerUserId="121" LastActivityDate="2014-01-20T07:34:55.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5939" PostTypeId="1" CreationDate="2014-01-20T13:40:32.883" Score="9" ViewCount="3335" Body="&lt;p&gt;Facebook is very clever with their IPv6 address scheme, but it got me thinking about ACLs and Is it possible to write a Cisco IOS IPv6 ACL that matches ? In IPv4 you could match a middle octet such as 10.xxx.10.xxx in order to hit any 'x' with 'don't care'. I don't think this is possible in IPv6, at least not as of IOS 15.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of my example, since Facebook has been clever, it makes it easy to just match on FACE:B00C if you could. In a way this simplifies because without looking up what block was assigned, I can just match on that range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2A03:2880:F000:[0000-FFFF]:FACE:B00C::/96&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The obvious and normal way is to match on 2A03:2880:F000::/48 but unfortunately, I'm not sure at a glance if FB has a larger range ( probably does ). So in this particular case, if I could match on just the FACE:B00C part, I could match everything they are using, assuming they don't move on to FACE:B00D&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I can't enter a wildcard mask in IOS for and IPv6 ACL, I don't think you can do this, but I'm curious if someone has an interesting workaround. I think it would be useful to know this because at some point I may need to filter a sub block only because of DDoS or aggressive traffic while not wanting to block an entire /32 for some large provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, this could allow for policy based traffic redirection or prioritization. If I realize the advertisements are in a different block, I could QoS them differently for example, a nice feature for low bandwidth, congested satellite links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: To clarify a bit. There may be cases where I need to block or permit certain ranges within a large block like a /32. These may be slightly contiguous and rather than hundreds of entries, a wildcard might match large portions of them. This could also be used for traffic engineering in the way I could route all 10.x.10.0 blocks where if x is odd, it goes one route vs even to another route. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example is a DDoS where the IPv6 source IP is being spoof with a pattern that spells the hackers' group name. This will happen at least once, it would be nice to be able to filter on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A compact ACL is cleaner but not always more manageable. These things may be good or bad ideas/practice, not here to argue that, just trying to get a handle on what tools I have vs what tools I may have to create.&lt;/p&gt;&#xA;" OwnerUserId="3946" LastEditorUserId="3946" LastEditDate="2014-01-21T03:12:25.500" LastActivityDate="2014-01-26T13:33:28.010" Title="Are IPv6 Wildcard Matches in Cisco IOS Possible?" Tags="|security|ipv6|cisco-ios|acl|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5940" PostTypeId="2" ParentId="5939" CreationDate="2014-01-20T14:32:39.030" Score="6" Body="&lt;p&gt;Unfortunately, Cisco did away with wildcard masks in IPv6.  That is mostly a good thing, EXCEPT in this particular case.   For your idea to work however, you have to rely on Facebook being both &quot;clever&quot; and consistent, which is probably more than one can hope for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you want to process Facebook's traffic differently than other traffic, you can simply filter on their assigned address block.   The one you mention in your question is actually assigned to Facebook Ireland:  2a03:2880::/32. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it is just as easy to look up others in the registries.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-20T14:32:39.030" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5942" PostTypeId="2" ParentId="5931" CreationDate="2014-01-20T19:53:11.637" Score="7" Body="&lt;p&gt;I asked a friend of mine, who manufactures 10G chipsets.  This is what he said:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;As I understand the 10GBASE-T standard, the option of not using the LDPC code is not permitted.  In order to achieve the target BER, the data must undergo FEC – which has been standardized in the 802.3an as LDPC.&lt;/p&gt;&#xA;&lt;p&gt;Compliant 10GBASE-T transceivers will automatically add the LDPC code to the egress data and remove it in the receiver while using any information it provides to correct errant bits.&lt;/p&gt;&#xA;&lt;p&gt;The utilization of LDPC makes the latency of 10GBASE-T a bit longer than 802.3ae optical devices. But that latency is still just a fraction of what is typically incurred by the switch silicon.&lt;/p&gt;&#xA;&lt;p&gt;In very latency sensitive applications (high frequency stock trading, for example) 10GBASE-T is not recommended.  But for most transaction processing, web search, and computational applications, the extra latency of 10GBASE-T is inconsequential and the other benefits of the technology (lower cost, the ability to use existing cabling, backwards compatibility with 1000BASE-T, etc.) outweigh this shortcoming.&lt;/p&gt;&#xA;&lt;p&gt;The IEEE Standards body did not feel it right to place a FEC code on every bit, because the coding overhead increases either the required baud rate or the number of analog voltage levels in the line code.&lt;/p&gt;&#xA;&lt;p&gt;So they came up with a compromise.&lt;/p&gt;&#xA;&lt;p&gt;It turns out that certain points in the line code constellation used by 10GBASE-T (called DSQ 128) have more protection margin than other points. So instead of applying FEC to every bit, 10GBASE-T uses set partitioning of its DSQ (double square) symbol constellation such that the equivalent coding gain of the uncoded bits is the same or higher than the other ones protected by LDPC.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-01-21T17:41:47.950" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5944" PostTypeId="2" ParentId="5927" CreationDate="2014-01-20T23:39:17.380" Score="2" Body="&lt;p&gt;I'm not sure this will work.  I don't have a lab to try it, but it works great on paper ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example, host will connect to 40.0.0.1, which is a natted address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 10 permit 10.0.0.1&#xA;access-list 20 permit 20.0.0.1&#xA;&#xA;route-map CRI-1 permit 10&#xA;match ip address 10&#xA;&#xA;route-map CRI-2 permit 10&#xA;match ip address 20&#xA;&#xA;ip nat outside source static 10.0.0.1 40.0.0.1 route-map CRI-1&#xA;ip nat outside source static 20.0.0.1 40.0.0.1 route-map CRI-2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-20T23:39:17.380" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5946" PostTypeId="1" CreationDate="2014-01-21T10:56:24.303" Score="4" ViewCount="2621" Body="&lt;p&gt;Generally a router id will be set to highest loopback address if present or the highest ip address of physical interface. But most vendors provide a way to configure a specific value example:- &quot; ip router-id 55.1.1.1&quot;.&#xA;My question here is is there any restrictions for value of router-id that can be configured? any RFC recommendations ? Can i configure &quot;255.255.255.255&quot; as my ip router-id ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastActivityDate="2017-06-13T00:36:48.683" Title="Is there any recommended range for ip router id" Tags="|cisco|router|ipv4|juniper|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5947" PostTypeId="2" ParentId="5946" CreationDate="2014-01-21T11:15:32.523" Score="3" Body="&lt;p&gt;Most routing protocols will use the router ID for various means but you should avoid thinking of this as an IP address.  The router ID is actually an arbitrary 32-bit number so yes you can assign anything you wish to as long as you avoid duplicate IDs between devices.&lt;/p&gt;&#xA;" OwnerUserId="109" LastEditorUserId="109" LastEditDate="2014-01-21T16:48:21.607" LastActivityDate="2014-01-21T16:48:21.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5948" PostTypeId="2" ParentId="5946" CreationDate="2014-01-21T12:02:12.673" Score="4" Body="&lt;p&gt;I manually set my router-ids as the management IP address I use to get into the router.  To me, it just makes sense and makes getting into a neighbor seamless.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Over at &lt;a href=&quot;http://www.cciezone.com/?p=67&quot; rel=&quot;nofollow&quot;&gt;CCIEZone&lt;/a&gt;, they have a really thorough way of distinguishing routers on a network.  I wish I would have discovered this sooner.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Octet 1: organization (1 = parent organization, 2+ = child organizations)&lt;/li&gt;&#xA;  &lt;li&gt;Octet 2: site id (would have to be defined and be organization-specific) &lt;/li&gt;&#xA;  &lt;li&gt;Octet 3: building-id or other useful identifier&lt;/li&gt;&#xA;  &lt;li&gt;Octet 4: actual router designation&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Courtesy of cciezone.com&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My question here is is there any restrictions for value of router-id&#xA;  that can be configured?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no restriction to what the router-id is, so &lt;code&gt;255.255.255.255&lt;/code&gt; should work just fine.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-01-21T12:02:12.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5949" PostTypeId="2" ParentId="5946" CreationDate="2014-01-21T13:07:34.670" Score="5" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Generally a router id will be set to highest loopback address if present or the highest ip address of physical interface. But most vendors provide a way to configure a specific value example:- &amp;quot; ip router-id 55.1.1.1&amp;quot;. My question here is is there any restrictions for value of router-id that can be configured? any RFC recommendations ? Can i configure &amp;quot;255.255.255.255&amp;quot; as my ip router-id?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;Summary&lt;/h3&gt;&#xA;&lt;p&gt;You didn't specify a protocol, so the answer is &amp;quot;it depends&amp;quot;.  If you're not using MPLS TE anywhere, the value of the Router ID doesn't seem to matter for OSPF, OSPFv3, BGP, ISIS or LDP.  Technically in these cases, you can assign &amp;quot;255.255.255.255&amp;quot; as the 32-bit portion of the Router ID.&lt;/p&gt;&#xA;&lt;p&gt;While these protocols are not strictly considered a routing protocol, you cannot divorce underlying IGP choices from your ability to deploy &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/TE_1208S.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;MPLS Traffic Engineering&quot;&gt;MPLS TE&lt;/a&gt;.  Therefore, if you are using &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_0s/feature/guide/TE_1208S.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;MPLS Traffic Engineering&quot;&gt;MPLS TE&lt;/a&gt; with &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3630&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSPF TE Extensions&lt;/a&gt;, CR-LDP, etc... then it's &lt;em&gt;recommended&lt;/em&gt; to assign your Router IDs as an address on the same router.&lt;/p&gt;&#xA;&lt;h3&gt;Overall Guidance: Keep it simple for your coworkers and future service deployments&lt;/h3&gt;&#xA;&lt;p&gt;While IGPs allow you to chose any value for Router IDs, &lt;em&gt;you shouldn't make life harder than necessary&lt;/em&gt;.  While you could theoretically assign Router-1's Router ID to be a Loopback address on Router 2, don't do that unless you already plan to make a bad reputation for yourself.&lt;/p&gt;&#xA;&lt;p&gt;Anyone who has to support the infrastructure after you will hate the aforementioned decision.  Furthermore, you'd be making implementation of some MPLS TE services &lt;em&gt;much&lt;/em&gt; harder, because people would have to reassign the Router IDs to get several of the MPLS TE services up.&lt;/p&gt;&#xA;&lt;hr&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1142&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1142, (ISIS)&lt;/a&gt; - A variable length field, from 1 to 8 octets&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;ID      System identifier  a variable length field from 1 to&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;  8 octets (inclusive). Each routeing domain employ&#xA;  ing this protocol shall select a single size for the ID&#xA;  field and all Intermediate systems in the routeing do&#xA;  main shall use this length for the system IDs of all&#xA;  systems in the routeing domain.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr&gt;&#xA;### [RFC 2328, Section 5 (OSPF)] - A 32-bit number&#xA;&lt;p&gt;Only defines the Router ID as a 32-bit number, thus &lt;em&gt;any&lt;/em&gt; 32-bit number can be used:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Router ID&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;    A 32-bit number that uniquely identifies this router in the AS.&#xA;    One possible implementation strategy would be to use the&#xA;    smallest IP interface address belonging to the router. If a&#xA;    router's OSPF Router ID is changed, the router's OSPF software&#xA;    should be restarted before the new Router ID takes effect.  In&#xA;    this case the router should flush its self-originated LSAs from&#xA;    the routing domain (see Section 14.1) before restarting, or they&#xA;    will persist for up to MaxAge minutes.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4271#section-4.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4271, Section 4.2 (BGP)&lt;/a&gt; - A 4-octet unsigned integer representing a valid unicast IP host address&lt;/h3&gt;&#xA;&lt;p&gt;The BGP ID is defined as a &amp;quot;&lt;em&gt;4-octet unsigned integer&lt;/em&gt;&amp;quot; in the OPEN message.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; BGP Identifier:&#xA;&#xA;    This 4-octet unsigned integer indicates the BGP Identifier of&#xA;    the sender.  A given BGP speaker sets the value of its BGP&#xA;    Identifier to an IP address that is assigned to that BGP&#xA;    speaker.  The value of the BGP Identifier is determined upon&#xA;    startup and is the same for every local interface and BGP peer.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Nevertheless, in order to be syntactically correct it must be &amp;quot;&lt;em&gt;a valid unicast IP host address&lt;/em&gt;&amp;quot;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; 6.2.  OPEN Message Error Handling&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;  ...&#xA;  If the BGP Identifier field of the OPEN message is syntactically&#xA;  incorrect, then the Error Subcode MUST be set to Bad BGP Identifier.&#xA;  Syntactic correctness means that the BGP Identifier field represents&#xA;  a valid unicast IP host address.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2740#section-2.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2740, Section 2.2 (OSPFv3)&lt;/a&gt; - A 32-bit number&lt;/h3&gt;&#xA;&lt;p&gt;Explicitly disallows any relationship between the addresses in the protocol (IPv6) and the Router ID, which is only a 32-bit number.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;2.2.  Removal of addressing semantics&#xA; ...&#xA; o   OSPF Router IDs, Area IDs and LSA Link State IDs remain at&#xA;     the IPv4 size of 32-bits. They can no longer be assigned as&#xA;     (IPv6) addresses.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4577#section-4.2.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4577, Section 4.2.2 (OSPF for BGP/MPLS IP VPNs)&lt;/a&gt; - A 32-bit number (valid OSPF RID)&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;4.2.2.  Router ID&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;    If a PE and a CE are communicating via OSPF, the PE will have an OSPF&#xA;    Router ID that is valid (i.e., unique) within the OSPF domain.  More&#xA;    precisely, each OSPF instance has a Router ID.  Different OSPF &#xA;    instances may have different Router IDs.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5036#section-3.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5036, Section 3.1 (LDP)&lt;/a&gt; - 6 bytes, 4 of the bytes should be a valid IGP Router ID&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;LDP Identifier&#xA;  Six octet field that uniquely identifies the label space of the&#xA;  sending LSR for which this PDU applies.  The first four octets&#xA;  identify the LSR and MUST be a globally unique value.  It SHOULD&#xA;  be a 32-bit router Id assigned to the LSR and also used to&#xA;  identify it in Loop Detection Path Vectors.  The last two octets&#xA;  identify a label space within the LSR.  For a platform-wide label&#xA;  space, these SHOULD both be zero.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3480#section-2&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Constraint-Routing Label Distribution Protocol&quot;&gt;RFC 3480, Section 2 (CR-LDP)&lt;/a&gt; - A stable IP address that is always reachable&lt;/h3&gt;&#xA;&lt;p&gt;Defines a Router ID as &amp;quot;a stable &lt;em&gt;IP address of an LSR that is always reachable&lt;/em&gt; if there is any connectivity to the LSR.&amp;quot;  &lt;strong&gt;Thus it pretty much has to be a loopback address&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;     In the context of this document, the term &amp;quot;Router ID&amp;quot; means a stable&#xA;     IP address of an LSR that is always reachable if there is any&#xA;     connectivity to the LSR.  This is typically implemented as a&#xA;     &amp;quot;loopback address&amp;quot;; the key attribute is that the address does not&#xA;     become unusable if an interface on the LSR is down.  In some cases,&#xA;     this value will need to be configured.  If one is using OSPF or ISIS&#xA;     as the IGP in support of traffic engineering, then it is RECOMMENDED&#xA;     for the Router ID to be set to the &amp;quot;Router Address&amp;quot; as defined in&#xA;     [OSPF-TE], or &amp;quot;Traffic Engineering Router ID&amp;quot; as defined in [ISIS-&#xA;     TE].&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3630#section-2.4.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3630, Section 2.4.1 (OSPF-TE)&lt;/a&gt; - A stable IP address of the advertising router&lt;/h3&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3630#section-2.4.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3630, Section 2.4.1 (OSPF-TE)&lt;/a&gt;, requires a &amp;quot;stable IP address of the advertising router&amp;quot;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; 2.4.1.  Router Address TLV&#xA;&#xA;  The Router Address TLV specifies a stable IP address of the&#xA;  advertising router that is always reachable if there is any&#xA;  connectivity to it; this is typically implemented as a &amp;quot;loopback&#xA;  address&amp;quot;.  The key attribute is that the address does not become&#xA;  unusable if an interface is down.  In other protocols, this is known&#xA;  as the &amp;quot;router ID,&amp;quot; but for obvious reasons this nomenclature is&#xA;  avoided here.  If a router advertises BGP routes with the BGP next&#xA;  hop attribute set to the BGP router ID, then the Router Address&#xA;  SHOULD be the same as the BGP router ID.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2017-06-13T00:36:48.683" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5954" PostTypeId="1" AcceptedAnswerId="5959" CreationDate="2014-01-21T19:51:01.987" Score="22" ViewCount="72112" Body="&lt;p&gt;It seems like AirPlay works out-of-the-box, vaguely speaking, only within a LAN.  It's not clear to me exactly why, but it looks like at least discovery relies on broadcasts.  Wikipedia states that &lt;a href=&quot;https://en.wikipedia.org/wiki/AirPlay&quot;&gt;Airplay is a proprietary protocol&lt;/a&gt; which probably explains why the only documentation I've found is unofficial like &lt;a href=&quot;http://nto.github.io/AirPlay.html&quot;&gt;this spec at github&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Can a network be configured such that Airplay works across VLANs?&lt;/li&gt;&#xA;&lt;li&gt;If so, what, exactly, must be allowed to pass between the VLANs to make this work?&lt;/li&gt;&#xA;&lt;li&gt;Is this a bad idea in a production environment given the unavailability of official protocol documentation?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2662" LastActivityDate="2015-12-23T18:48:23.437" Title="What, exactly, is required to make Airplay work across VLANs?" Tags="|vlan|layer2|layer3|" AnswerCount="6" CommentCount="8" ClosedDate="2018-04-25T03:03:17.060" ContentLicense="CC BY-SA 3.0" />
  <row Id="5955" PostTypeId="2" ParentId="5954" CreationDate="2014-01-21T20:07:15.313" Score="1" Body="&lt;p&gt;Airplay travels over IP, so normal routing applies.   You need a router to route traffic from one VLAN to another. Unless you start messing with Multicast, Bonjour will stay on the local VLAN, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a bad idea?  It depends ;-).  You have to tell us a lot more about your production environment to make an educated guess.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-21T20:07:15.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5956" PostTypeId="2" ParentId="5954" CreationDate="2014-01-21T20:09:26.340" Score="3" Body="&lt;p&gt;It doesn't work because it's a broadcast (&lt;em&gt;multicast&lt;/em&gt;) technology. (see also: Bonjour)  Crossing a broadcast domain (i.e. VLAN) requires a proxy.  I'm not a Mac person, but I've seen such a proxy setup before -- so iDevices could get to a printer where wireless and wired were different lans.  I don't remember the program that was used, but it was not free.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-01-23T19:46:17.233" LastActivityDate="2014-01-23T19:46:17.233" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5959" PostTypeId="2" ParentId="5954" CreationDate="2014-01-21T21:27:27.027" Score="9" Body="&lt;p&gt;There is two different things in term &quot;Airplay&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first one is about service discovery and it's the way how devices capable of receiving Airplay streams announce to the network &quot;Hey! I can receive Airplay!&quot;. It's done normally via service called Bonjour (at least Apple calls it so) or &lt;a href=&quot;https://en.wikipedia.org/wiki/Zero-configuration_networking#DNS-based_service_discovery&quot; rel=&quot;nofollow&quot;&gt;DNS-SD&lt;/a&gt;. It's using multicast and that's the point if someone is telling to you that &quot;Airplay is for local LAN only&quot; or something. The streaming itself is &quot;normal&quot; UDP unicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the main problem is how you get the info about Airplay receiver to the potential senders in another network. There is two theoretical options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You can forward multicast. It might be tricky though, but there are routers/firewalls capable of this. RTFM how exactly, but the idea is that you have to forward multicast traffic with destination address &lt;a href=&quot;https://en.wikipedia.org/wiki/Multicast_address#IPv4&quot; rel=&quot;nofollow&quot;&gt;224.0.0.251&lt;/a&gt; to another network and you have to do it without decrementing TTL.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another option is to use unicast DNS-SD. You can use normal DNS to announce the very same info normally distributed automatically via multicast DNS-SD and you can use a little help from dns-sd(1) utility on your MacOSX to get an info what exactly to write into your DNS zone file. Execute this command in the LAN with Airplay receiver and this should give to you all the info you need:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ dns-sd -Z _airplay._tcp&#xA;Browsing for _airplay._tcp&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There is also DNS-SD proxies (for example avahi can be used as such).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, I said &quot;theoretically&quot;, because I haven't tested it and whatever you do with protocols, forwarding and so on, there MIGHT be some roadblocks beyond your control - it's the Apple after all. You could get all info correctly to the potential sender, but iOS/MacOSX might still reject it because it just doesn't like it for some reason and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is one more (again theoretical though ;) brute force option - create a DNS-SD entry for your router address as an Airplay receiver for the network with Airplay senders and forward (NAT) the UDP stream to the real Airplay receiver. But even with this there are some possibilities (for Apple engineers) to break it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go on, test it and let us know about your results.&lt;/p&gt;&#xA;" OwnerUserId="3388" LastEditorUserId="2662" LastEditDate="2014-01-25T03:34:28.467" LastActivityDate="2014-01-25T03:34:28.467" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5961" PostTypeId="2" ParentId="5954" CreationDate="2014-01-22T02:36:53.030" Score="6" Body="&lt;p&gt;This is a common problem in educational environments.  Apple has done an excellent job of selling iPads and Macs to students/staff and they want to utilize Airplay/Airprint/other Bonjour functionality.  However, as you pointed out, these features rely upon a single broadcast domain for service discovery.  Enterprise/educational networks just aren't structured that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is so prevalent that many educational institution IT staff got together a few years ago, and &lt;a href=&quot;http://www.cultofmac.com/182919/education-it-pros-petition-apple-to-fix-bonjour/&quot; rel=&quot;noreferrer&quot;&gt;petitioned Apple to fix Bonjour&lt;/a&gt; to work better in these environments.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To directly address your questions, it will usually require very specialized configurations to accomplish the spanning of Airplay services across your network.  And the specific configuraition will depend heavily on your current wireless solution (Cisco, Aerohive, Ubiquity, etc).  In general, if you search for your wireless vendor and Bonjour, you should find documentation to at least point you in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have had mixed success deploying &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/wireless/ps4570/products_tech_note09186a0080bb1d7c.shtml&quot; rel=&quot;noreferrer&quot;&gt;Cisco's Avahi Bonjour gateway solution&lt;/a&gt;, and wouldn't recommend looking into it unless you absolutely have to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bottom line to me is, as you pointed out in your third question, you'll always be at Apple's mercy because this is a closed, proprietary, undocumented service* intended for home network environments.  So, unless Apple decides to change that, I would avoid implementing it in an Enterprise network wherever possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;*The underlying code for mDNSResponder is open, non-proprietary, and available under the Apache license.  However, Apple's implementations of this internal to their iDevices and MacOS are all outside your control and could change at anytime.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2014-01-22T02:58:19.643" LastActivityDate="2014-01-22T02:58:19.643" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="5962" PostTypeId="1" CreationDate="2014-01-22T05:12:07.220" Score="2" ViewCount="2623" Body="&lt;p&gt;Hi and thanks for taking the time to read this.  I have some understanding of networking but am looking for help designing the best solution for an environment.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It consists of approx ~30 users with computers and IP phones.  We have a Cisco ASA5505 for firewall, VPN and internet gateway, two HP V1910 24-port PoE switches for the LAN (and powering the phones) and two more regular HP V1910 24-port switches where hosts and storage reside for virtual infrastructure (ESX) and other network appliances.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best practices for linking these all together?  I've sketched a rough diagram below on how it looks currently.  Currently, links between switches are untagged on the data VLAN and tagged on other VLANs to allow traffic on those to pass between switches.  Could this be improved in any way?  Please ask anything if needed to clarify.  Thank you.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PoE SW 1------PoE SW 2------ASA5505&#xA;   |              |&#xA;   |              |&#xA;  SW 1----------SW 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3993" LastEditorUserId="3191" LastEditDate="2014-12-08T20:21:20.753" LastActivityDate="2014-12-08T20:21:20.753" Title="What would be an optimal design for linking multiple switches?" Tags="|switch|design|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5964" PostTypeId="2" ParentId="5962" CreationDate="2014-01-22T06:47:59.757" Score="0" Body="&lt;p&gt;With your switches(&lt;a href=&quot;http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c03941555-2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c03941555-2.pdf&lt;/a&gt;), you can terminate access vlans on them (local vlan topology), a-la:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/W1TKs.jpg&quot; alt=&quot;local vlan topology&quot;&gt;&#xA;local vlan topology, imho the best way:&#xA;no loops (you dont need stp)&#xA;no vtp&#xA;simple debugging &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this topology, has one significant minus - expensive(in comparsion with l2) Layer 3 switches(you have them)&lt;/p&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="3478" LastEditDate="2014-01-22T07:36:04.097" LastActivityDate="2014-01-22T07:36:04.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5968" PostTypeId="2" ParentId="5848" CreationDate="2014-01-22T09:37:12.077" Score="5" Body="&lt;p&gt;The verbiage you're using to setup IPFix is definately right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what you have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ovs-vsctl -- set Bridge s1 ipfix=@i -- --id=@i create IPFIX targets=\&quot;10.0.0.1:4739\&quot; obs_domain_id=123 obs_point_id=456 sampling=64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And pretty much the same &lt;a href=&quot;http://openvswitch.org/cgi-bin/ovsman.cgi?page=utilities%2Fovs-vsctl.8&quot; rel=&quot;noreferrer&quot;&gt;example&lt;/a&gt; is outlined in the ovs-vsctl man file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IPFIX&#xA;&#xA;Configure bridge br0 to send one IPFIX flow record per packet sample to UDP port 4739 on host 192.168.0.34, with Observation Domain ID 123 and Observation Point ID 456:&#xA;&#xA;ovs−vsctl −− set Bridge br0 ipfix=@i −− −−id=@i create IPFIX targets=\&quot;192.168.0.34:4739\&quot; obs_domain_id=123 obs_point_id=456&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on your log file in the comments section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2014-01-22T10:09:04Z|1017630|collectors|WARN|sending to collector failed: Connection refused&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think it would be resonable to assume the collector (&lt;code&gt;10.0.0.1&lt;/code&gt;) is misconfigured or something is preventing connections inbound to it.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-01-22T09:37:12.077" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="5970" PostTypeId="1" AcceptedAnswerId="6489" CreationDate="2014-01-22T14:27:02.833" Score="3" ViewCount="6339" Body="&lt;p&gt;I'm trying to configure an ASA as transparent DNS proxy. This means that the ASA has to redirect all the DNS queries that violets a certain policy to a DNS server.&#xA;For example in this way it is possible to avoid that a client uses a self-configured DNS server redirecting his traffic to a trusted DNS server. &lt;/p&gt;&#xA;" OwnerUserId="2663" LastActivityDate="2014-02-25T15:48:47.470" Title="ASA as DNS transparent proxy" Tags="|cisco-asa|dns|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5971" PostTypeId="1" AcceptedAnswerId="5977" CreationDate="2014-01-22T14:47:26.937" Score="2" ViewCount="980" Body="&lt;p&gt;We currently have a bunch of Tripp Lite UPS that we’re preparing to deploy emergency power off capabilities to throughout our network. I have been provided Normally Closed tail circuits to connect to our UPS equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the diagram displaying the wire order from the voltage source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rvjMk.png&quot; alt=&quot;EPO Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Courtesy of &lt;a href=&quot;http://www.tripplite.com/shared/techdoc/Owners-Manual/932486.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tripp Lite&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what the connection should look like with all of the components involved.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;------+                                          +------&#xA;      |   5                                      |&#xA;      |-----------------_                        |&#xA;      |   4              &amp;gt;-----------------------|&#xA;      |-----------------¯                        |&#xA;      |   3                                      |&#xA;      |-----------------===----------------------|&#xA;      |   2                                      |&#xA;      |-------X                                  +------&#xA;      |   1                                        EPO&#xA;      |-------X                                   SOURCE&#xA;      |&#xA;      |&#xA;------+&#xA; RJ-11&#xA; PLUG&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br/&gt;&#xA;I’ve been trying to come up with an graceful way of connecting these points.&lt;br&gt;&#xA;How do I make this a reliable connection and look professional?&lt;br&gt;&#xA;What have others done?&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2021-04-26T11:30:43.730" Title="Normally Closed Emergency Power Off UPS Wiring" Tags="|cabling|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="5972" PostTypeId="1" CreationDate="2014-01-22T15:20:05.697" Score="4" ViewCount="630" Body="&lt;p&gt;Reflexive ACLs can monitor outbound traffic and create a temporary ACL that mirrors this traffic by swapping the source/destination addresses and port #s:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OUTBOUND:              192.168.1.2:1234 -&amp;gt; 11.0.0.1:80&#xA;TEMPORARY RETURN ACL:  permit 11.0.0.1:80 -&amp;gt; 192.168.1.2:1234&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reflexive ACLs have the limitation of not supporting protocols that change their port numbers after the first packet is sent. The common example of this is FTP, which uses a separate control channel to configure the data channel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What other common protocols do not play nice with reflexive ACLs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from this limitation, are there reasons to steer clear of reflexive ACLs?&lt;/p&gt;&#xA;" OwnerUserId="1911" LastEditorUserId="3191" LastEditDate="2014-02-21T22:31:20.127" LastActivityDate="2014-06-22T00:10:19.513" Title="Reflexive ACL Limitations" Tags="|acl|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5973" PostTypeId="2" ParentId="5970" CreationDate="2014-01-22T16:20:42.877" Score="2" Body="&lt;p&gt;The easiest way to achieve DNS query restrictions is to implement an external interface ACL that blocks port 53 outbound.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 110 deny udp any any eq 53&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Short, sweet, and to the point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With regard to your OP, “&lt;a href=&quot;https://serverfault.com/questions/365352/redirect-all-dns-request-with-asa5505-to-one-specific-dns-server&quot;&gt;Redirect all DNS request with ASA5505 to one specific DNS server&lt;/a&gt;” at ServerFault suggests that policy based routing capabilities don't exist in ASAs but recommends policy NAT, instead. I'm not familiar enough with that function to give examples, though.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2014-01-22T16:35:53.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5974" PostTypeId="2" ParentId="5972" CreationDate="2014-01-22T16:55:39.477" Score="2" Body="&lt;p&gt;Reflexive ACLs were the first way to define directional traffic initiation and dynamically open up security for return traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router logic on this below &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FTP inside --&amp;gt; outside &#xA;&#xA;then I must allow &#xA;&#xA;FTP outside --&amp;gt; inside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we use Zone-Based firewalls (or whatever other catchphrase you want to use for the same technology) that pretty much do the same thing, but they can also adapt based on traffic inspection &lt;/p&gt;&#xA;" OwnerUserId="3210" LastActivityDate="2014-01-22T16:55:39.477" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="5977" PostTypeId="2" ParentId="5971" CreationDate="2014-01-22T18:04:19.673" Score="2" Body="&lt;p&gt;I would be tempted to make an RJ-11 pig tail, and then solder or twist the wires to the EPO cable.  Heat shrink tubing over the whole thing to make it look &quot;professional.&quot;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-22T18:04:19.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5980" PostTypeId="1" AcceptedAnswerId="5981" CreationDate="2014-01-22T18:42:10.570" Score="3" ViewCount="6891" Body="&lt;p&gt;We recently purchased some HP Procurve 2920 switches and in setting them up I noticed multiple options for port groups. I wanted to see if anyone can clarify functional differences between setting up a port group as a 'Trunk' vs an active LACP group. Can't seem to find definitive documentation on the function of the 'Trunk' option or what protocols it uses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="4006" LastActivityDate="2014-01-22T18:57:18.743" Title="hp procurve trunk port group operation vs active lacp port group" Tags="|best-practices|hp-procurve|trunk|ieee-802.1ax|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5981" PostTypeId="2" ParentId="5980" CreationDate="2014-01-22T18:57:18.743" Score="4" Body="&lt;p&gt;The switch has a built-in help function: &lt;code&gt;?&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xa-eng(config)# trunk 1-2 trk17 &#xA; trunk                 Do not use any protocol to create or maintain the trunk.&#xA; lacp                  Use IEEE 802.1ad Link Aggregation protocol.&#xA; &amp;lt;cr&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-01-22T18:57:18.743" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5983" PostTypeId="2" ParentId="5962" CreationDate="2014-01-22T20:19:14.087" Score="4" Body="&lt;p&gt;In my opinion, pyatka's solution looks like overkill.  I like the hub-and-spoke topology though.  Your initial topology is redundant, but leaves you highly dependent on Spanning Tree being configured and working properly in order to prevent network loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think you need IP's on the inter-switch links.  Simply uplink each access switch  (PoE SW1, PoE SW2, and SW3 in the graphic) with your new &quot;core,&quot; SW 4, with trunk ports with the default VLAN allow settings which allow all VLAN traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of the switches can have a port-by-port vlan assignment based on need.  All the vlan routing is done on SW4.  This means that SW4 will be the default gateway for each VLAN.  For example on the user VLAN 20, your hosts will be configured with default gateway of 10.1.1.254 and then on SW2:&#xA;(this is how on a Cisco IOS switch, check you HP documentation for exact syntax):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW4# vlan 20&#xA;description users&#xA;ip address 10.1.1.254 255.255.255.0&#xA;ip helper-address X.X.X.X &amp;lt;- DHCP server, if present&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SW4 will also then have a default route for 0.0.0.0 that sends outbound traffic out G1/1/4 to the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use copper (or fiber if &gt;100M) GBICs for your trunk ports from the access switches to SW4.  Then you can still have 24 Ethernet ports on SW4 for end devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, you manage the switches on a dedicated management VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this is a setup that gives you the most flexibility and ease of management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chime in if you need more details on switch configuration options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/l78Oy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3527" LastActivityDate="2014-01-22T20:19:14.087" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="5990" PostTypeId="1" AcceptedAnswerId="5991" CreationDate="2014-01-23T11:08:54.013" Score="5" ViewCount="17381" Body="&lt;p&gt;As with my last question, I am learning for my CCNA exam and currently I am bashing my head against the wall, while trying to solve &quot;7.2.2.4 Troubleshooting GRE&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll explain the topology in a second. First let me document, which steps I have taken so far:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;RA's Ip addresses on t0 and G0/0 were switched. I corrected them&lt;/li&gt;&#xA;&lt;li&gt;RA's tunnel 0 interface had the wrong source and destination addresses. I set them to s:172.31.0.1 d: 192.168.1.1&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, on RB theres this message: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel0, changed state to up&#xA; %ADJ-5-PARENT: Midchain parent maintenance for IP midchain out of 0 65E900C0 - looped chain attempting to stack&#xA; %TUN-5-RECURDOWN: 0 temporarily disabled due to recursive routing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Jclpz.jpg&quot; alt=&quot;GRE topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every IP address/network address as shown on the image is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is &lt;code&gt;show interface tunnel 0&lt;/code&gt; on RA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tunnel0 is up, line protocol is up (connected)&#xA;  Hardware is Tunnel&#xA;  Internet address is 192.168.1.1/30&#xA;  MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation TUNNEL, loopback not set&#xA;  Keepalive not set&#xA;  Tunnel source 172.31.0.1 (GigabitEthernet0/0), destination 192.168.1.2&#xA;  Tunnel protocol/transport GRE/IP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Show interface tunnel 0&lt;/code&gt; on RB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tunnel0 is up, line protocol is up (connected)&#xA;  Hardware is Tunnel&#xA;  Internet address is 192.168.1.1/30&#xA;  MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation TUNNEL, loopback not set&#xA;  Keepalive not set&#xA;  Tunnel source 172.31.0.1 (GigabitEthernet0/0), destination 192.168.1.2&#xA;  Tunnel protocol/transport GRE/IP&#xA;    Key disabled, sequencing disabled&#xA;    Checksumming of packets disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Show ip route&lt;/code&gt; on RA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is 0.0.0.0 to network 0.0.0.0&#xA;&#xA;     172.31.0.0/16 is variably subnetted, 2 subnets, 2 masks&#xA;C       172.31.0.0/24 is directly connected, GigabitEthernet0/0&#xA;L       172.31.0.1/32 is directly connected, GigabitEthernet0/0&#xA;     192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C       192.168.1.0/30 is directly connected, Tunnel0&#xA;L       192.168.1.1/32 is directly connected, Tunnel0&#xA;     209.165.122.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C       209.165.122.0/30 is directly connected, Serial0/0/0&#xA;L       209.165.122.2/32 is directly connected, Serial0/0/0&#xA;S*   0.0.0.0/0 is directly connected, Serial0/0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Show ip route&lt;/code&gt; on RB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is 0.0.0.0 to network 0.0.0.0&#xA;&#xA;     64.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;C       64.103.211.0/30 is directly connected, Serial0/0/0&#xA;L       64.103.211.2/32 is directly connected, Serial0/0/0&#xA;     172.31.0.0/16 is variably subnetted, 2 subnets, 2 masks&#xA;C       172.31.1.0/24 is directly connected, GigabitEthernet0/0&#xA;L       172.31.1.1/32 is directly connected, GigabitEthernet0/0&#xA;     192.168.1.0/32 is subnetted, 1 subnets&#xA;L       192.168.1.2/32 is directly connected, Tunnel0&#xA;S*   0.0.0.0/0 is directly connected, Serial0/0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please help me understand this error by explaining what I am missing here and how to resolve this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;**//EDIT: ** The task which needs to be fullfilled is that traffic from the 172.31.x.x networks on both sides needs to be tunneled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;//EDIT2: As it turns out Iw as talking Bullsh**. Here are the steps taken so far:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;RA's Ip addresses on t0 and G0/0 were switched. I corrected them&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;RA's tunnel 0 interface had the wrong source and destination addresses. I set them to s:172.31.0.1 d: 192.168.1.1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Changed Source address of tunnel 0 on RA to &lt;code&gt;172.31.0.1&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Changed Destination address of tunnel 0 on RB to &lt;code&gt;209.165.122.2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;copy run start&lt;/code&gt; on RB and then &lt;code&gt;reload&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Tunnel 0 on RB is now  up and connected.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;//EDIT3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I finally worked it out. I went back in my curriculum to an earlier task, which did guide me through the whole configuration task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source on both routers for the tunnel is the &lt;code&gt;S0/0/0&lt;/code&gt; interface and the destination is the other routers &lt;code&gt;S0/0/0&lt;/code&gt; interface IP address.&#xA;This is highly counter intuitive, since in my head I was under the impression, the source is the traffic form the local LANs (the 172 interfaces), since the traffic from there needs to be tunneled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just for good measure I added 2 static routes for both routers, to make sure the packets get routed this way in case OSPF / EIGRP or RIP think otherwise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have upvoted both answers, but accepted Ron's, since he answered first with a correct set up.&lt;/p&gt;&#xA;" OwnerUserId="3746" LastEditorUserId="3746" LastEditDate="2014-01-23T16:09:51.947" LastActivityDate="2016-02-16T10:40:53.520" Title="Stuck at GRE troubleshooting with recursive route" Tags="|cisco|routing|tunnel|gre|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="5991" PostTypeId="2" ParentId="5990" CreationDate="2014-01-23T12:00:35.213" Score="5" Body="&lt;p&gt;Serv,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your tunnel source and destination addresses are wrong.  They should be 209.165.122.2 and 64.103.211.2 on RA and the opposite on RB. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many different ways to explain this, but essentially, the route to the tunnel endpoint cannot be through the tunnel.  In your case, in order to send a packet (from RA) to 192.168.1.2, RA has to encapsulate it in a GRE packet and then send it to the tunnel destination.  But the route to the tunnel destination is through the tunnel itself.  that is not allowed because you would be infinitely encapsulating the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another explanation (metaphor):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of a bridge being built across a river. the bridge engineers need to know where on each side of the river to put the bridge. Once they have built the bridge, you can route people to use the bridge to get to the other side. But that is separate from where the bridge has to be built.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bridge (tunnel) is built from RA's s0/0/0 interface to RB s0/0/0. Once the tunnel is up, you can then route traffic from 172.31.x.x through the tunnel.&#xA;In other words, building the tunnel is separate from routing traffic through the tunnel.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-01-23T16:47:51.443" LastActivityDate="2014-01-23T16:47:51.443" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="5992" PostTypeId="2" ParentId="5990" CreationDate="2014-01-23T12:05:52.973" Score="2" Body="&lt;p&gt;You can't have a destination to a GRE tunnel that hasn't been established yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tunnel0 is up, line protocol is up (connected)&#xA;  Hardware is Tunnel&#xA;  Internet address is 192.168.1.1/30&#xA;  ! Can't have the same IP on the GRE tunnel on both ends&#xA;  MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation TUNNEL, loopback not set&#xA;  Keepalive not set&#xA;  Tunnel source 209.165.122.2 (Serial0/0/0), destination 64.103.211.2&#xA;  ! Assuming S0/0/0 is 209.165.122.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;RB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tunnel0 is up, line protocol is up (connected)&#xA;  Hardware is Tunnel&#xA;  Internet address is 192.168.1.2/30&#xA;  ! Can't have the same IP on the GRE tunnel on both ends&#xA;  MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation TUNNEL, loopback not set&#xA;  Keepalive not set&#xA;  Tunnel source 64.103.211.2 (Serial0/0/0), destination 209.165.122.2 &#xA;  ! Assuming S0/0/0 is 64.103.211.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Edit&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Let me break down how this works a little better.&#xA;Your goal is to tunnel the 172.31.x.x networks through a tunnel you’ve established between &lt;em&gt;RA&lt;/em&gt; and &lt;em&gt;RB&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;RA has no knowledge of &lt;code&gt;172.31.1.0/24&lt;/code&gt; ; hence, you don’t see it in the RIB. RB has no knowledge of &lt;code&gt;172.31.0.0/24&lt;/code&gt;; which you can also see in his RIB. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If RA attempts to contact anything in 172.31.1.0/24, the packet will be sent to its default router (which we’ll assume is &lt;code&gt;S0/0/0&lt;/code&gt;).  Once the cloud gets that address, he will drop it since he doesn’t have any knowledge of any networks except &lt;code&gt;209.165.122.0/30&lt;/code&gt; and &lt;code&gt;64.103.211.1/30&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A GRE tunnel needs a valid destination to build a tunnel and this tunnel will traverse the WAN.  Your RA tunnel will be from Source &lt;code&gt;209.165.122.2&lt;/code&gt; to destination &lt;code&gt;64.103.211.2&lt;/code&gt; with a virtual IP of &lt;code&gt;192.168.1.1&lt;/code&gt;. Your RB will have source &lt;code&gt;64.103.211.2&lt;/code&gt; and destination &lt;code&gt;209.165.122.2&lt;/code&gt; with a virtual IP of &lt;code&gt;192.168.1.2&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then set a default route in RA that effective says &lt;code&gt;172.31.1.0/24 via 192.168.1.2&lt;/code&gt;.&lt;br&gt;&#xA;You can then set a default route in RB that effective says &lt;code&gt;172.31.0.0/24 via 192.168.1.1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These default routes will force their respective traffic through the GRE tunnel to reach their end-points. &lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-01-23T14:16:16.140" LastActivityDate="2014-01-23T14:16:16.140" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="5995" PostTypeId="2" ParentId="2533" CreationDate="2014-01-23T16:48:36.723" Score="1" Body="&lt;p&gt;I was messing with this earlier and found a pretty straighforward regex that should give you what you want.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;sho ip int | inc ^[A-Z]|access list &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The list is needed to ignore access violations line.  &lt;/p&gt;&#xA;" OwnerUserId="4022" LastActivityDate="2014-01-23T16:48:36.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="5996" PostTypeId="1" CreationDate="2014-01-23T17:03:30.807" Score="4" ViewCount="331" Body="&lt;p&gt;I have a very typical scenario where I would like to protect IP phones traffic from high RTT, packet delay variation and packet loss on congested links. I fully understand, that QoS would help only in case of very short congestion. To make matters worse, my ISP does not support QoS so there is no way I can prioritize certain traffic from end-to-end. Overall topology can be seen here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/pKsqW.png&quot; alt=&quot;network topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Usually) the short traffic congestion happens in ISP PE router where the traffic policers are. I tried Priority Queuing(VoIP traffic has known bandwidth so it's safe to use) in Cisco 2801 routers where IP phones traffic was set to &quot;high&quot; queue both in Fa0/0 and Fa0/1 in egress direction, but this did not have a noticeable affect. On the other hand, it was somewhat expected as I configured queuing before the congested link(policer in PE router)? Is there any technique which helps to protect the traffic between two IP phones in case of short-term traffic bursts other than increasing the policer in PE routers?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2014-05-24T01:23:19.127" Title="protect sensitive traffic if end-to-end QoS is not possible" Tags="|qos|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="5998" PostTypeId="2" ParentId="5996" CreationDate="2014-01-24T00:31:30.830" Score="1" Body="&lt;p&gt;The only place you have control of is up to the output queue where you transmit the packet to the provider. If you are using policing here, you need to convert it to Hierarchical Queuing Framework (&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/qos/configuration/guide/qos_frhqf_support.html&quot; rel=&quot;nofollow&quot;&gt;HQF&lt;/a&gt;) or whatever name they have given it now. Inside of this you can set policing values, but your VoIP would be put into the &lt;em&gt;Priority&lt;/em&gt; queue to receive low latency transmit priority for packets that match that class (RTP/SIP/SCCP or whatever you define, an ACL perhaps). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will make sure the voice traffic is transmitted before any other queues and will help on short congestion. Indeed if you convert your policing to traffic shaping, you may see an overall performance increase for everyone, but for sure get that voice in the priority queue. (&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk543/tk545/technologies_tech_note09186a00800a3a25.shtml&quot; rel=&quot;nofollow&quot;&gt;Shaping vs Policing&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will only help if your output queue is lightly congested and will have no effect on any internet transport in the middle. If this is where your problem exists, investigate alternative providers or a small dedicated point to point circuit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: ps set your shaping on CE egress just smaller than the PE ingress with shaping and priority that way you control what gets dropped first.&lt;/p&gt;&#xA;" OwnerUserId="3946" LastActivityDate="2014-01-24T00:31:30.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6007" PostTypeId="1" CreationDate="2014-01-24T18:58:53.723" Score="10" ViewCount="6800" Body="&lt;p&gt;I know that in Internet Protocol Stack there are actually three layer. They are Application, Internet and Transport. Let's say HTTP in Application layer will be converted to TCP in Transport layer and TCP will be converted to IP in Internet layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But practically when I tried to capture a network traffic from internet, I can only understand the HTTP layer and I can't understand what is in TCP and IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using wireshark for capturing network traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please explain the process or provide a simple example for this.&lt;/p&gt;&#xA;" OwnerUserId="4041" LastEditorUserId="775" LastEditDate="2014-01-24T19:25:27.843" LastActivityDate="2014-01-24T20:14:59.870" Title="How HTTP is converted to TCP and then how TCP converted to IP?" Tags="|ipv4|tcp|ipv6|internet|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6008" PostTypeId="2" ParentId="6007" CreationDate="2014-01-24T20:05:55.577" Score="10" Body="&lt;p&gt;I think your confusion starts with thinking about 'converting'. No such things happens...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP packets are basic transport units. They have things like a source address and a destination address, and some other bookkeeping stuff, but not much else. And a packet payload of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP or TCP is the next layer. It is in the IP payload. Both UDP and TCP contain a source port and destination port. TCP also contains sequence numbers, acknowledgements etc. And again a payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take HTTP as an example. HTTP is transmitted as payload of TCP. A client sends a request to a server, the server answers etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So: no conversion anywhere. Just HTTP as payload of TCP, as payload of IP.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-01-24T20:05:55.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6009" PostTypeId="2" ParentId="6007" CreationDate="2014-01-24T20:08:33.067" Score="6" Body="&lt;p&gt;There's no &quot;conversion&quot;.  It's a protocol stack; or better word would be &quot;&lt;em&gt;encapsulation&lt;/em&gt;&quot;. Starting with an IP packet, it's payload is a TCP packet, who's payload is an HTTP transaction, which is usually more than one packet.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-01-24T20:08:33.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6010" PostTypeId="2" ParentId="6007" CreationDate="2014-01-24T20:14:59.870" Score="13" Body="&lt;p&gt;There is no conversion, what you have is Encapsulation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex: you use wireshark on your local PC to capture your HTTP session.  Basically, what you end up with looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Ethernet Frame [IP Packet [TCP Segment [HTTP Request]]]]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The Ethernet frame has the EtherType field of 0x0800 that gives us the encapsulated protocols as IP&lt;/li&gt;&#xA;&lt;li&gt;The IP Packet has the Protocol Field of &quot;6&quot; that tells us the next level is TCP (ICMP is Protocol &quot;1&quot;)&lt;/li&gt;&#xA;&lt;li&gt;TCP has the Destination port of 80, on which normally a Web Server is listening to&lt;/li&gt;&#xA;&lt;li&gt;HTTP is what is actually understood by a Web Server&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-01-24T20:14:59.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6012" PostTypeId="1" CreationDate="2014-01-25T11:20:05.013" Score="3" ViewCount="356" Body="&lt;p&gt;I am trying to run IPSec GRE over a MetroE circuit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER---------metroe----------ROUTER&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routers are set up to route all traffic over the ipsec tunnel; however, when I check the routers I see traffic on both the tunnel and the physical interface.  Why is that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the traffic to only go through the tunnel interface.&lt;/p&gt;&#xA;" OwnerUserId="3916" LastEditorUserId="3191" LastEditDate="2014-01-25T13:45:18.343" LastActivityDate="2014-01-25T13:45:18.343" Title="IPSec/GRE over Metro-E traffic question" Tags="|ipsec|metro-ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6013" PostTypeId="2" ParentId="6012" CreationDate="2014-01-25T11:44:04.090" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I see traffic on both the tunnel and the physical interface. Why is&#xA;  that?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The tunnel is virtual between two routers, but it is still leaving a physical interface; that means the counters on the physical interface will increase.   The IPSec/GRE tunnel has to go somewhere.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-01-25T13:26:56.707" LastActivityDate="2014-01-25T13:26:56.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6014" PostTypeId="1" AcceptedAnswerId="6015" CreationDate="2014-01-25T12:12:33.507" Score="10" ViewCount="19430" Body="&lt;p&gt;I am trying to learn networking (currently Link - Physical Layer); this is self-study. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am very confused about one particular thing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I want to send a data on the wire something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;01010101, where it will look some thing like this as a Signal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;__|‾‾|__|‾‾|__|‾‾|__|‾‾&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well the data to be sent must be represented by a signal, and the signal in this situation is the &quot;change in the voltage&quot; on the link / wire (assume we are using cables, not wireless link).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So Fourier proved that with enough frequencies a signal can be represented pretty well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like: &lt;img src=&quot;https://i.stack.imgur.com/6xNwZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I still don't understanding the relationship between a signal on the wire, and the Frequencies. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The definition of frequency is: &lt;strong&gt;the number of occurrences of a repeating event per unit time.&lt;/strong&gt; So what is repeating in the wire per unit time? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also for example on a DSL line, for Frequency Division Multiplexing, because multiple users will be allocated less frequency, there will be less bandwidth per user on a given link / wire. What does it mean to allocate less frequency on a wire? Less repeating of what?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there many frequencies available on the wire? If there are ( lets say from 0 to 1 Mega Hertz ) can I represent the above using the range between 0 to 100 OR 100 to 200 OR 500 to 1000 ? Why do I have more bandwidth if I use more frequencies?   &lt;/p&gt;&#xA;" OwnerUserId="4048" LastEditorUserId="775" LastEditDate="2014-01-25T12:45:18.827" LastActivityDate="2014-08-22T13:54:35.860" Title="What is the relationship between the bandwith on a wire and the frequency?" Tags="|bandwidth|layer2|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6015" PostTypeId="2" ParentId="6014" CreationDate="2014-01-25T13:14:19.840" Score="17" Body="&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Modulation&quot; rel=&quot;noreferrer&quot; title=&quot;Decoding voltage patterns into data bits&quot;&gt;Modulation&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Symbol_rate#Symbols&quot; rel=&quot;noreferrer&quot;&gt;symbol&lt;/a&gt;s&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;the number of occurrences of a repeating event per unit time. So what is repeating in the wire per unit time?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The voltage patterns on the wire repeat.&lt;/p&gt;&#xA;&lt;p&gt;In extremely simple communication systems, you might cycle the line's DC voltage above or below a threshold, as shown in your ASCII-art... &lt;code&gt;__|‾‾|__|‾‾|__|‾‾|__|‾‾&lt;/code&gt;.  Suppose your thresholds are +5v and -5vdc; &lt;a href=&quot;http://en.wikipedia.org/wiki/Modulation&quot; rel=&quot;noreferrer&quot; title=&quot;Decoding voltage patterns into data bits&quot;&gt;modulating&lt;/a&gt; binary data through two DC voltages would only yield one bit per voltage level (each voltage transition is called a &lt;a href=&quot;http://en.wikipedia.org/wiki/Symbol_rate#Symbols&quot; rel=&quot;noreferrer&quot;&gt;symbol&lt;/a&gt; in the industry).&lt;/p&gt;&#xA;&lt;p&gt;DC voltage transitions are not the only way to represent data on the wire, as you mentioned, you can modulate the voltage of a signal on a given frequency, or shift between two frequencies to modulate data.  This picture illustrates how the same &lt;code&gt;__|‾‾|__|‾‾|__|‾‾|__|‾‾&lt;/code&gt; transitions are represented via Amplitude Modulation (AM) and Frequency Modulation (FM).&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/RGT12.gif&quot; alt=&quot;FM vs AM modulation&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;More complex systems that are transmitted over longer distances use more complex &lt;a href=&quot;http://en.wikipedia.org/wiki/Modulation&quot; rel=&quot;noreferrer&quot; title=&quot;Decoding voltage patterns into data bits&quot;&gt;modulation&lt;/a&gt; schemes, such as &lt;a href=&quot;http://en.wikipedia.org/wiki/Frequency-division_multiplexing&quot; rel=&quot;noreferrer&quot; title=&quot;Frequency Division Multiplexing&quot;&gt;FDM&lt;/a&gt; or &lt;a href=&quot;http://en.wikipedia.org/wiki/Phase-shift_keying#Quadrature_phase-shift_keying_.28QPSK.29&quot; rel=&quot;noreferrer&quot; title=&quot;Quadrature Phase-Shift Keying&quot;&gt;QPSK&lt;/a&gt;, to pack more data into a given bandwidth on the wire.&lt;/p&gt;&#xA;&lt;p&gt;Generally speaking, you can modulate using combinations of:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Amplitude&quot; rel=&quot;noreferrer&quot;&gt;Amplitude&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Frequency&quot; rel=&quot;noreferrer&quot;&gt;Frequency&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Phase_%28waves%29&quot; rel=&quot;noreferrer&quot;&gt;Phase offset&lt;/a&gt; (with respect to a reference carrier, or clock).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Bit_rate&quot; rel=&quot;noreferrer&quot; title=&quot;this is the data bandwidth&quot;&gt;Bit rate&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Spectral_efficiency&quot; rel=&quot;noreferrer&quot;&gt;spectral efficiency&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Are there many frequencies available on the wire? If there are (lets say from 0 to 1 Mega Hertz ) can I represent the above using the range between 0 to 100 OR 100 to 200 OR 500 to 1000 ? Why do I have more bandwidth if I use more frequencies?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Let's just consider an Frequency Modulation system, which has two states on the wire...&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The 0 &lt;a href=&quot;http://en.wikipedia.org/wiki/Symbol_rate#Symbols&quot; rel=&quot;noreferrer&quot;&gt;symbol&lt;/a&gt; is represented by 1KHz&lt;/li&gt;&#xA;&lt;li&gt;The 1 &lt;a href=&quot;http://en.wikipedia.org/wiki/Symbol_rate#Symbols&quot; rel=&quot;noreferrer&quot;&gt;symbol&lt;/a&gt; is represented by 2.5KHz&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;This &lt;em&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Modulation&quot; rel=&quot;noreferrer&quot; title=&quot;Decoding voltage patterns into data bits&quot;&gt;modulation&lt;/a&gt; scheme requires 1.5KHz of bandwidth&lt;/em&gt; on the wire.  However, that tells you nothing about the &lt;a href=&quot;http://en.wikipedia.org/wiki/Bit_rate&quot; rel=&quot;noreferrer&quot;&gt;bit rate&lt;/a&gt; transmitted (which confusingly, is also known as 'bandwidth', but let's not use an overloaded term).&lt;/p&gt;&#xA;&lt;p&gt;One reason that an FM system might space 0 and 1 &lt;a href=&quot;http://en.wikipedia.org/wiki/Symbol_rate#Symbols&quot; rel=&quot;noreferrer&quot;&gt;symbol&lt;/a&gt;s 1.5KHz apart is because there are limits to how well, how quickly, and how economically the &lt;a href=&quot;http://en.wikipedia.org/wiki/Modem&quot; rel=&quot;noreferrer&quot;&gt;modem&lt;/a&gt; can measure the frequency changes on the wire.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How well the &lt;a href=&quot;http://en.wikipedia.org/wiki/Modem&quot; rel=&quot;noreferrer&quot;&gt;modem&lt;/a&gt; can measure frequency changes is one factor that drives how much bandwidth is required on the wire&lt;/li&gt;&#xA;&lt;li&gt;How quickly the &lt;a href=&quot;http://en.wikipedia.org/wiki/Modem&quot; rel=&quot;noreferrer&quot;&gt;modem&lt;/a&gt; can measure frequency (or other &lt;a href=&quot;http://en.wikipedia.org/wiki/Symbol_rate#Symbols&quot; rel=&quot;noreferrer&quot;&gt;symbol&lt;/a&gt;) changes drives how high the &lt;a href=&quot;http://en.wikipedia.org/wiki/Modem&quot; rel=&quot;noreferrer&quot;&gt;modem&lt;/a&gt;'s &lt;a href=&quot;http://en.wikipedia.org/wiki/Bit_rate&quot; rel=&quot;noreferrer&quot; title=&quot;this is the data bandwidth&quot;&gt;bit rate&lt;/a&gt; will be&lt;/li&gt;&#xA;&lt;li&gt;Economics play a big role, because you might be able to build a system that has extremely high &lt;a href=&quot;http://en.wikipedia.org/wiki/Spectral_efficiency&quot; rel=&quot;noreferrer&quot;&gt;spectral efficiency&lt;/a&gt;, but if nobody can afford it then it's not really a feasible solution.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;As a general rule, you can build faster and cheaper &lt;a href=&quot;http://en.wikipedia.org/wiki/Modem&quot; rel=&quot;noreferrer&quot;&gt;modem&lt;/a&gt;s if you have more bandwidth available to you.&lt;/p&gt;&#xA;&lt;h3&gt;Edit: comment response&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I have studied your response, but I am still confused about some things. I can only send 1 and 0s over a wire as far as I understand. So if 1.5 KHz is enough for this, why would I use more bandwidth?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I addressed the question in the last section, but let's continue with the FM modulation example.  Real systems have to account for receiver sensitivity, and factors such as how well a &lt;a href=&quot;http://en.wikipedia.org/wiki/Band-pass_filter&quot; rel=&quot;noreferrer&quot;&gt;band-pass filter&lt;/a&gt; can be implemented.&lt;/p&gt;&#xA;&lt;p&gt;Suppose the 1.5KHz bandwidth available to the modem only yields 9600 baud, and that's not fast enough; however, you might build a 20KHz modem that is fast enough (maybe you need 56K baud).&lt;/p&gt;&#xA;&lt;p&gt;Why is 20KHz better?  Due to the realities and imperfect slopes on &lt;a href=&quot;http://en.wikipedia.org/wiki/Band-pass_filter&quot; rel=&quot;noreferrer&quot;&gt;band-pass filter&lt;/a&gt;s and other components, you may need that much bandwidth to implement the correct &lt;a href=&quot;http://en.wikipedia.org/wiki/Modulation&quot; rel=&quot;noreferrer&quot; title=&quot;Decoding voltage patterns into data bits&quot;&gt;modulation&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Line_code&quot; rel=&quot;noreferrer&quot; title=&quot;Line encoding helps receiver synchronization and clock recovery&quot;&gt;line code&lt;/a&gt;.  Maybe with 20Khz, you could implement &lt;a href=&quot;http://en.wikipedia.org/wiki/Quadrature_amplitude_modulation&quot; rel=&quot;noreferrer&quot;&gt;QAM&lt;/a&gt; scheme, which gave you 3 bits per &lt;a href=&quot;http://en.wikipedia.org/wiki/Symbol_rate#Symbols&quot; rel=&quot;noreferrer&quot;&gt;symbol&lt;/a&gt;, resulting in a maximum &lt;a href=&quot;http://en.wikipedia.org/wiki/Bit_rate&quot; rel=&quot;noreferrer&quot; title=&quot;this is the data bandwidth&quot;&gt;bit rate&lt;/a&gt; of &amp;quot;9600*8&amp;quot;, or 76.8 Kbaud (note: 2**3 = 8)&lt;/p&gt;&#xA;&lt;p&gt;You're asking good questions, but it's very hard to explain this without getting into the guts of a real design.  If you read some electronics books about receiver design, or take some electrical engineering courses this material is covered.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-01-25T20:10:46.053" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6016" PostTypeId="2" ParentId="1988" CreationDate="2014-01-25T15:09:02.387" Score="0" Body="&lt;p&gt;Three step process:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reset AP to factory defaults&#xA;Connect to AP using Physical cable and change it's IP address to one of the existing being issued by main router&#xA;Disable DHCP of AP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this, treat AP like normal wireless hub and configure (said and wep key etc). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck&lt;/p&gt;&#xA;" OwnerUserId="4050" LastActivityDate="2014-01-25T15:09:02.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6020" PostTypeId="1" CreationDate="2014-01-26T08:05:17.480" Score="2" ViewCount="2973" Body="&lt;p&gt;We have been searching for so long, we know and understand all of the timers in STP and RSTP. We aren't sure how much time the process of choosing a root bridge takes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How long does the root bridge election process take?&lt;/p&gt;&#xA;" OwnerUserId="4055" LastEditorUserId="3191" LastEditDate="2014-01-26T11:27:04.000" LastActivityDate="2014-01-26T17:07:00.897" Title="How long does it take to Elect a Root Bridge in STP?" Tags="|spanning-tree|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6021" PostTypeId="2" ParentId="6020" CreationDate="2014-01-26T09:15:31.823" Score="7" Body="&lt;p&gt;I don't think it's possible to give a definitive answer on this because it will depend on the switch architecture, CPU power, the distance between the switches, the topology, the speed of the links and so on. I assume the delay would be something like this if we have three switches daisy chained:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------+           +----------+           +----------+&#xA;|          |           |          |           |          |&#xA;|   SW1    +-----------+  SW2     +-----------+  SW3     |&#xA;|          |           |          |           |          |&#xA;+----------+           +----------+           +----------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assume that SW1 has the best BID so that it should be elected root. Also assume that all switches have just been booted up, the way STP works all will claim to be root until they have heard a better BPDU. All links are Gigabit.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;STP process runs and generates BPDU&lt;/li&gt;&#xA;&lt;li&gt;BPDU must be serialized on to the link (serialization delay)&lt;/li&gt;&#xA;&lt;li&gt;BPDU must be propagated between switches (propagation delay)&lt;/li&gt;&#xA;&lt;li&gt;Act on BPDU received, change port roles&lt;/li&gt;&#xA;&lt;li&gt;Send out BPDU on designated ports&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All in all it should be in the millisecond range. It will be variable based on the speed and distance of links between switches and how fast they can process BPDUs. STP is fast to act on things where links go down, the issue is if you have unidirectional links or &quot;passive&quot; failures like a converter that won't give link down.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="1083" LastEditDate="2014-01-26T17:07:00.897" LastActivityDate="2014-01-26T17:07:00.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6022" PostTypeId="2" ParentId="6020" CreationDate="2014-01-26T10:18:43.883" Score="3" Body="&lt;p&gt;I'll piggyback off what Daniel Dib said, it is entirely dependent on how your network is setup.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Image this network setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                    ISP&#xA;                     |&#xA;                     |&#xA;+---------+     +---------+     +---------+&#xA;|         |     |         |     |         |&#xA;|   SW1   |-----|   CR1   |-----|   SW2   | &#xA;|         |     |         |     |         |&#xA;+---------+     +---------+     +---------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a completely viable network buildout.  In this instance, the STP election process would be drastically reduced because most of the processing has been pushed to &lt;code&gt;CR1&lt;/code&gt;, thus, almost completely eliminating &lt;a href=&quot;http://www.wildpackets.com/resources/compendium/ethernet/propagation_delay&quot; rel=&quot;nofollow&quot;&gt;propagation delay&lt;/a&gt; and requiring the bare minimum amount of BPDUs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine again a more sophisticated network topology by simply extending the first:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                    ISP&#xA;                     |&#xA;                     |&#xA;+---------+     +---------+     +---------+     +---------+     +---------+&#xA;|         |     |         |     |         |     |         |     |         |&#xA;|   SW1   |-----|   CR1   |-----|   SW2   |-----|   SW3   |     |   SW7   |&#xA;|         |     |         |     |         |     |         |     |         |&#xA;+---------+     +---------+     +---------+     +---------+     +---------+&#xA;                                     |               |               |&#xA;                                     |               |               |&#xA;                                +---------+     +---------+     +---------+&#xA;                                |         |     |         |     |         |&#xA;                                |   SW4   |-----|   SW5   |-----|   SW6   |&#xA;                                |         |     |         |     |         |&#xA;                                +---------+     +---------+     +---------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, in the second instance, significantly more BPDUs are sent and loop prevention port roles need to be turned on to make sure loops don't occur.  While I can agree with Daniel Dib, most of this does happen in milliseconds, but it really all depends on your network architecture.  If you have a gigantic switched network with 100 nodes, it might take a little while (i.e. greater than a few seconds).&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-01-26T10:18:43.883" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6024" PostTypeId="2" ParentId="5939" CreationDate="2014-01-26T13:01:54.833" Score="5" Body="&lt;p&gt;I was doing some playing with &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/12_4t4/ht_fpm.html#wp1053704&quot; rel=&quot;nofollow&quot; title=&quot;Flexible Packet Matching&quot;&gt;FPM&lt;/a&gt; and I think it may do what you're looking for:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;load protocol system:fpm/phdf/ether.phdf&#xA;load protocol flash:/fpm/phdf/ipv6.phdf&#xA;!&#xA;class-map type stack match-all cm-ipv6&#xA; match field ETHER type eq 0x86DD next IPV6&#xA;class-map type access-control match-all cm-ipv6-facebook&#xA; match start IPV6 dest-addr offset 9 size 4 eq 0xFACEB00C&#xA;!&#xA;policy-map type access-control pm-ipv6-facebook&#xA; class cm-ipv6-facebook&#xA;   drop&#xA;policy-map type access-control pm-filter&#xA; class cm-ipv6&#xA;   log&#xA;  service-policy pm-ipv6-facebook&#xA;!&#xA;interface FastEthernet0/1&#xA; service-policy type access-control input pm-filter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I had to roll my own ipv6.phdf file for this one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;phdf&amp;gt;&#xA; &amp;lt;version&amp;gt;1&amp;lt;/version&amp;gt;&#xA; &amp;lt;protocol name=&quot;ipv6&quot; description=&quot;Definition-for-the-IPv6-protocol&quot;&amp;gt;&#xA; &amp;lt;field name=&quot;version&quot; description=&quot;IP version&quot;&amp;gt;&#xA;  &amp;lt;offset type=&quot;fixed-offset&quot; units=&quot;bits&quot;&amp;gt;0&amp;lt;/offset&amp;gt;&#xA;  &amp;lt;length type=&quot;fixed&quot; units=&quot;bits&quot;&amp;gt;4&amp;lt;/length&amp;gt;&#xA; &amp;lt;/field&amp;gt;&#xA; &amp;lt;field name=&quot;tc&quot; description=&quot;IPv6-Traffic-Class&quot;&amp;gt;&#xA;  &amp;lt;offset type=&quot;fixed-offset&quot; units=&quot;bits&quot;&amp;gt;4&amp;lt;/offset&amp;gt;&#xA;  &amp;lt;length type=&quot;fixed&quot; units=&quot;bits&quot;&amp;gt;8&amp;lt;/length&amp;gt;&#xA; &amp;lt;/field&amp;gt;&#xA;  &amp;lt;field name=&quot;fl&quot; description=&quot;IPv6-Flow-Label&quot;&amp;gt;&#xA;  &amp;lt;offset type=&quot;fixed-offset&quot; units=&quot;bits&quot;&amp;gt;12&amp;lt;/offset&amp;gt;&#xA;  &amp;lt;length type=&quot;fixed&quot; units=&quot;bits&quot;&amp;gt;20&amp;lt;/length&amp;gt;&#xA; &amp;lt;/field&amp;gt;&#xA; &amp;lt;field name=&quot;length&quot; description=&quot;IPv6-Payload-Length&quot;&amp;gt;&#xA;  &amp;lt;offset type=&quot;fixed-offset&quot; units=&quot;bits&quot;&amp;gt;32&amp;lt;/offset&amp;gt;&#xA;  &amp;lt;length type=&quot;fixed&quot; units=&quot;bits&quot;&amp;gt;16&amp;lt;/length&amp;gt;&#xA; &amp;lt;/field&amp;gt;&#xA; &amp;lt;field name=&quot;nh&quot; description=&quot;IPv6-Next-Header&quot;&amp;gt;&#xA;  &amp;lt;offset type=&quot;fixed-offset&quot; units=&quot;bits&quot;&amp;gt;48&amp;lt;/offset&amp;gt;&#xA;  &amp;lt;length type=&quot;fixed&quot; units=&quot;bits&quot;&amp;gt;8&amp;lt;/length&amp;gt;&#xA; &amp;lt;/field&amp;gt;&#xA; &amp;lt;field name=&quot;hl&quot; description=&quot;IPv6-Hop-Limit&quot;&amp;gt;&#xA;  &amp;lt;offset type=&quot;fixed-offset&quot; units=&quot;bits&quot;&amp;gt;56&amp;lt;/offset&amp;gt;&#xA;  &amp;lt;length type=&quot;fixed&quot; units=&quot;bits&quot;&amp;gt;8&amp;lt;/length&amp;gt;&#xA; &amp;lt;/field&amp;gt;&#xA; &amp;lt;field name=&quot;source-addr&quot; description=&quot;IPv6-Source-Address&quot;&amp;gt;&#xA;  &amp;lt;offset type=&quot;fixed-offset&quot; units=&quot;bits&quot;&amp;gt;64&amp;lt;/offset&amp;gt;&#xA;  &amp;lt;length type=&quot;fixed&quot; units=&quot;bits&quot;&amp;gt;128&amp;lt;/length&amp;gt;&#xA; &amp;lt;/field&amp;gt;&#xA; &amp;lt;field name=&quot;dest-addr&quot; description=&quot;IPv6-Destination-Address&quot;&amp;gt;&#xA;  &amp;lt;offset type=&quot;fixed-offset&quot; units=&quot;bits&quot;&amp;gt;192&amp;lt;/offset&amp;gt;&#xA;  &amp;lt;length type=&quot;fixed&quot; units=&quot;bits&quot;&amp;gt;128&amp;lt;/length&amp;gt;&#xA; &amp;lt;/field&amp;gt;&#xA; &amp;lt;field name=&quot;payload-start&quot; description=&quot;IPv6-Payload-Start&quot;&amp;gt;&#xA;  &amp;lt;offset type=&quot;fixed-offset&quot; units=&quot;bits&quot;&amp;gt;320&amp;lt;/offset&amp;gt;&#xA;  &amp;lt;length type=&quot;fixed&quot; units=&quot;bits&quot;&amp;gt;0&amp;lt;/length&amp;gt;&#xA; &amp;lt;/field&amp;gt;&#xA; &amp;lt;headerlength type=&quot;fixed&quot; value=&quot;320&quot;&amp;gt;&amp;lt;/headerlength&amp;gt;&#xA; &amp;lt;constraint field=&quot;version&quot; value=&quot;6&quot; operator=&quot;eq&quot;&amp;gt;&amp;lt;/constraint&amp;gt;&#xA;&amp;lt;/protocol&amp;gt;&#xA;&amp;lt;/phdf&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, when I do a &quot;show policy-map type access-control interface fa0/1&quot;, I get no matches on the ethertype:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/1 &#xA;&#xA;  Service-policy access-control input: pm-filter&#xA;&#xA;    Class-map: cm-ipv6 (match-all)&#xA;      0 packets, 0 bytes&#xA;      5 minute offered rate 0 bps, drop rate 0 bps&#xA;      Match: field ETHER type eq 0x86DD next IPV6&#xA;      log&#xA;&#xA;      Service-policy access-control : pm-ipv6-facebook&#xA;&#xA;        Class-map: cm-ipv6-facebook (match-all)&#xA;          0 packets, 0 bytes&#xA;          5 minute offered rate 0 bps&#xA;          Match: start IPV6 dest-addr offset 9 size 4 eq 0xFACEB00C&#xA;      drop&#xA;&#xA;        Class-map: class-default (match-any)&#xA;          0 packets, 0 bytes&#xA;          5 minute offered rate 0 bps, drop rate 0 bps&#xA;          Match: any &#xA;&#xA;    Class-map: class-default (match-any)&#xA;      10000 packets, 1863618 bytes&#xA;      5 minute offered rate 14000 bps, drop rate 0 bps&#xA;      Match: any &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suspect that my pings to Facebook's IPv6 address aren't running through CEF properly (the &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6586/ps6723/prod_qas0900aecd804b915e.html&quot; rel=&quot;nofollow&quot;&gt;FPM FAQ&lt;/a&gt; says it is required) or I'm missing something. Still, I'm putting this out for anyone who wants to chew on it.&lt;/p&gt;&#xA;" OwnerUserId="4057" LastEditorUserId="775" LastEditDate="2014-01-26T13:33:28.010" LastActivityDate="2014-01-26T13:33:28.010" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6025" PostTypeId="2" ParentId="6020" CreationDate="2014-01-26T13:46:18.747" Score="1" Body="&lt;p&gt;Here you have some examples of how to calculate this by yourself&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a0080094954.shtml&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/tech/tk389/tk621/technologies_tech_note09186a0080094954.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say there is no definite answer to your question&#xA;It all depends on what are the settings of the devices involved&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone said that it it virtually possible to build networks consisting in hundred of switches. That is not exactly so. Take a look at what is called network diameter. You want to make sure that once the root switch is elected the downstream switches have enough time to receive TCNs and react to them without discarding the BPDUs because they are expired. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could adjust the timers for bigger networks but it all has to make sense from practical point of view. To make a larger network work you might need to use timer values that make  STP slow beyond any decent limit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since we speak about TCNs you did not mention what flavor of STP you are looking at. &#xA;I presume MSTP root election will be a lot longer than 802.1d/w. &lt;/p&gt;&#xA;" OwnerUserId="1647" LastActivityDate="2014-01-26T13:46:18.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6026" PostTypeId="1" AcceptedAnswerId="6027" CreationDate="2014-01-26T13:56:14.700" Score="1" ViewCount="400" Body="&lt;p&gt;Below I will translate from decimal to binary just for the second octet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The theory says the IP range is:&#xA;172.16.0.0/12  with addresses ranging between &lt;strong&gt;172.16.0.0-172.31.255.2555&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that translates to:&lt;br&gt;&#xA;172.00001110.0.0      with mask on the next line&lt;br&gt;&#xA;255.11110000.0.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the base address for this range is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.00000000.0.0      &lt;strong&gt;which is 172.0.0.0 and not 172.16.0.0&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where is the mistake here ? ☺&lt;/p&gt;&#xA;" OwnerUserId="1647" LastActivityDate="2014-01-26T16:53:02.677" Title="Basic question about private IP addressing -Class B" Tags="|ipv4|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6027" PostTypeId="2" ParentId="6026" CreationDate="2014-01-26T14:08:24.790" Score="8" Body="&lt;p&gt;You didn't convert correct from decimal to binary. 172.16 = 10101100.00010000&lt;/p&gt;&#xA;" OwnerUserId="2866" LastEditorUserId="-1" LastEditDate="2014-01-26T16:53:02.677" LastActivityDate="2014-01-26T16:53:02.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6032" PostTypeId="1" CreationDate="2014-01-26T20:50:44.603" Score="7" ViewCount="3064" Body="&lt;p&gt;I was adding a new policy to both import and export list for BGP. Then I observed a bgp session reset. Can anyone explain this for me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only change I made was to prepend a new policy to reject everything advertised from the neighbor and advertise nothing to the neighbor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g:&#xA;old config: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols bgp group ext import policy-A&#xA;set protocols bgp group ext export policy-B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;New config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols bgp group ext import nothing policy-A&#xA;set protocols bgp group ext export nothing policy-B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18" LastEditorUserId="18" LastEditDate="2014-01-26T21:59:27.213" LastActivityDate="2016-02-08T20:41:17.960" Title="Why does export/import policy addition/removal cause a BGP session reset?" Tags="|bgp|juniper|juniper-junos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6033" PostTypeId="1" CreationDate="2014-01-26T23:41:30.797" Score="1" ViewCount="6833" Body="&lt;p&gt;I am currently researching ARP packets using Wireshark and have found that when I ping a new computer asking for the MAC address that corresponds with the known IP address, my target IP address in my request ARP packet is always my default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this?&lt;/p&gt;&#xA;" OwnerUserId="3890" LastEditorUserId="-1" LastEditDate="2014-01-27T05:42:46.147" LastActivityDate="2014-01-27T05:42:46.147" Title="Why is the target IP address always my default gateway?" Tags="|routing|router|ipv4|arp|mac-address|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6034" PostTypeId="2" ParentId="6033" CreationDate="2014-01-27T00:07:35.970" Score="4" Body="&lt;p&gt;ARP is used to find an ethernet MAC address belonging to an IPv4 address on your local LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are sending packets to something that is not on your local LAN (according to the information that your PC has) your PC will send it to the default gateway, who is assumed to know what to do with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if you send something to an non-LAN destination your PC needs the MAC address of the default gateway, which it will send an ARP request for if it doesn't have it cached yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not possible to see MAC addresses of machines not on your local LAN.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-01-27T00:07:35.970" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6035" PostTypeId="2" ParentId="6033" CreationDate="2014-01-27T03:52:30.390" Score="0" Body="&lt;p&gt;If the ping destination IP(Y) is within the same subnet with your source IP(X), you'll see your expected result, which is Y in the ARP reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the ping destination IP is in different subnet from your LAN, you'll see the gateway IP in in the ARP reply.&lt;/p&gt;&#xA;" OwnerUserId="18" LastActivityDate="2014-01-27T03:52:30.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6040" PostTypeId="2" ParentId="6032" CreationDate="2014-01-27T07:09:31.010" Score="2" Body="&lt;p&gt;Well, there are 3 ways to update policy (apply a policy to our Adj-RIB-In):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;hard reset&lt;/strong&gt; - cause a full reset of session with a neighbor and apply policies to recieving routes;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;soft reset&lt;/strong&gt; - neighbors should support Route Refresh feature [ https://www.rfc-editor.org/rfc/rfc2918 ]. This feature uses special Refresh message which request to send a full neighbor's Adj-RIB-Out to us. This feature do not interrupt a forwarding plane;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;soft reconfiguration&lt;/strong&gt; - our router always stores full neighbor's Adj-RIB-Out in its Adj-RIB-In, so if we update a policies we don't even sending any request to neighbor and applies in on our Adj-RIB-In. This feature do not interrupt a forwarding plane. This feature enabled by default in Juniper Junos OS and works autimatically when we commit a configuration.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;If we consider all of the above it was the soft reset which not interrupt router's forwarding plane or it was if one of neighbors don't supports Route Refresh and &amp;quot;soft reconfiguration&amp;quot; feature is disabled with &amp;quot;keep none&amp;quot; keyword.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Recently i wrote a small article about those features, but in russian language - &lt;a href=&quot;http://sk1f3r.ru/bgp-softreset&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://sk1f3r.ru/bgp-softreset&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3518" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-01-27T07:09:31.010" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6042" PostTypeId="1" AcceptedAnswerId="6056" CreationDate="2014-01-27T10:43:23.347" Score="5" ViewCount="2669" Body="&lt;p&gt;I have read that SIP-400 and SPA are compatible with 6509 series switch. These SIP and SPA are used to terminate PPP sessions on 7600 routers. If I installed this SIP and SPA (SPA-5X1GE-V2 for example) on my 6509 chassis, could I configure the switch to terminate PPPoE sessions as a &lt;a href=&quot;http://en.wikipedia.org/wiki/Broadband_Remote_Access_Server&quot; rel=&quot;nofollow&quot;&gt;BRAS&lt;/a&gt;? In that case, which IOS would support this feature?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch has SUP720-PFC3BXL supervisors.&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="775" LastEditDate="2014-01-30T10:52:08.657" LastActivityDate="2014-01-30T10:52:08.657" Title="Cisco 6509 as PPPoE BRAS" Tags="|cisco|cisco-6500|layer2|pppoe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6043" PostTypeId="2" ParentId="6014" CreationDate="2014-01-27T13:42:18.203" Score="13" Body="&lt;p&gt;Mike offered an excellent answer but not exactly to what you were asking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Bandwidth&lt;/em&gt;, by definition, is a range of frequencies, measured in Hz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you've said, the signal &lt;code&gt;__|‾‾|__|‾‾|__|‾‾|__|‾‾&lt;/code&gt; can be broken down (using Fourier) into a bunch of frequencies. Let's say that we've broken it down, and saw that our signal is (mostly) made up of frequencies 1Mhz, 1.1Mhz,1.2Mhz,1.3Mhz... up to 2Mhz. That means that our signal has a &lt;strong&gt;bandwidth of 1Mhz&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, we want to send it through a channel, such as a copper wire, or an optical fiber. So first, let's talk a little bit about channels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When talking about bandwidth in channels, we actually talk about &lt;strong&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Bandwidth_%28signal_processing%29&quot; rel=&quot;nofollow noreferrer&quot;&gt;passband bandwidth&lt;/a&gt;&lt;/strong&gt; which describes the range of frequencies a channel can carry with little distortion. Say I have a channel that can only pass signals whose frequency is between f1 and f2. Its frequency response function (the channel's reaction to signals of different frequencies) might be something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UnrQL.png&quot; alt=&quot;bandwidth&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bandwidth of a channel depends on the physical properties of the channel, so a copper wire will have a different bandwidth from a wireless channel and from an optical fiber. &lt;a href=&quot;https://en.wikipedia.org/wiki/Twisted_pair#Most_common_twisted-pair_cables&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt;, for example, is a table from wikipedia, specifying the bandwidths of different twisted pair cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If our example channel has a bandwidth of 1Mhz, then we can fairly easily use it to send a signal whose bandwidth is 1Mhz or less. Signals with a wider bandwidth will be distorted when passing through, possibly making them unintelligible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's get back to our example signal &lt;code&gt;__|‾‾|__|‾‾|__|‾‾|__|‾‾&lt;/code&gt;. If we were to perform a Fourier analysis on it, we would discover that &lt;strong&gt;increasing the data rate (by making the bits shorter and closer to each other), increases the signal's bandwidth&lt;/strong&gt;. The increase would be linear, so a two fold increase in the rate of bits, will mean a two fold increase in the bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exact relation between bit rate and bandwidth depends on the data being sent as well as the modulation used (such as &lt;a href=&quot;https://en.wikipedia.org/wiki/Non-return-to-zero&quot; rel=&quot;nofollow noreferrer&quot;&gt;NRZ&lt;/a&gt;, &lt;a href=&quot;https://en.wikipedia.org/wiki/Phase-shift_keying&quot; rel=&quot;nofollow noreferrer&quot;&gt;QAM&lt;/a&gt;, &lt;a href=&quot;https://en.wikipedia.org/wiki/Manchester_code&quot; rel=&quot;nofollow noreferrer&quot;&gt;Manchseter&lt;/a&gt;, and others). The classic way in which people draw bits: &lt;code&gt;__|‾‾|__|‾‾|__|‾‾|__|‾‾&lt;/code&gt; is what &lt;a href=&quot;https://en.wikipedia.org/wiki/Non-return-to-zero&quot; rel=&quot;nofollow noreferrer&quot;&gt;NRZ&lt;/a&gt; looks like, but other modulation techniques will encode zeroes and ones into different shapes, affecting their bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the exact bandwidth of a binary signal depends on several factors, its useful to look at the theoretical upper bound for &lt;strong&gt;any&lt;/strong&gt; data signal over a given channel. This upper bound is given by the &lt;a href=&quot;https://en.wikipedia.org/wiki/Shannon%E2%80%93Hartley_theorem&quot; rel=&quot;nofollow noreferrer&quot;&gt;Shannon–Hartley theorem&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7JLmU.png&quot; alt=&quot;Shannon–Hartley theorem&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;C&lt;/strong&gt; is the channel capacity in bits per second;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;B&lt;/strong&gt; is the bandwidth of the channel in hertz (passband bandwidth in case&#xA;  of a modulated signal)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;S&lt;/strong&gt; is the average received signal power over the bandwidth (in case of&#xA;  a modulated signal, often denoted C, i.e. modulated carrier), measured&#xA;  in watts (or volts squared)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;N&lt;/strong&gt; is the average noise or interference power over the bandwidth,&#xA;  measured in watts (or volts squared)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;S/N&lt;/strong&gt; is the signal-to-noise ratio (SNR) or the carrier-to-noise ratio&#xA;  (CNR) of the communication signal to the Gaussian noise interference&#xA;  expressed as a linear power ratio (not as logarithmic decibels).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;One important thing to note however, is that the Shannon-Hartley theorem assumes a specific type of noise - &lt;a href=&quot;https://en.wikipedia.org/wiki/Additive_white_Gaussian_noise&quot; rel=&quot;nofollow noreferrer&quot;&gt;additive white Gaussian noise&lt;/a&gt;. The upper bound will be lower for other, more complex, types of noise.&lt;/p&gt;&#xA;" OwnerUserId="3905" LastEditorUserId="3905" LastEditDate="2014-08-22T13:54:35.860" LastActivityDate="2014-08-22T13:54:35.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6047" PostTypeId="1" AcceptedAnswerId="10286" CreationDate="2014-01-27T18:48:16.427" Score="4" ViewCount="367" Body="&lt;p&gt;I have a Juniper SSG320M running ScreenOS 6.2 (actually 2 of them in an HA active/passive).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to measure the bandwidth consumed on one of the interfaces, and throw an alarm if that exceeds a certain threshold (e.g. &gt;1Mbit/sec).  Is there some way to do this with the native functionality in ScreenOS?  I searched for this, but could not find an answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I am interested in both ingress and egress bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:  Any type of alarm will do.  It can simply be a message in the log that I can grep for later.  &lt;/p&gt;&#xA;" OwnerUserId="3989" LastEditorUserId="3989" LastEditDate="2014-01-28T19:37:31.830" LastActivityDate="2014-08-04T19:07:37.757" Title="ScreenOS: See Peak bandwidth on an Interface and Alarm if it crosses a threshold" Tags="|juniper|monitoring|screenos|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6048" PostTypeId="1" CreationDate="2014-01-27T19:11:20.817" Score="2" ViewCount="11753" Body="&lt;p&gt;I'm setting up a network with the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;48 port gigabit L2 switch (Cisco Catalyst 2948G)&lt;/li&gt;&#xA;&lt;li&gt;Linux or OpenBSD router on a stick (1 gigabit NIC)&lt;/li&gt;&#xA;&lt;li&gt;Cable modem&lt;/li&gt;&#xA;&lt;li&gt;My network is small, I only need one vlan (as far as I know), 10.0.0.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I just need to know how to configure the switchport that the modem is attached to. (I'm plugging it into the 48 port L2 switch) Do I do a separate VLAN for the modem? Or do I just put everything on one vlan?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help!&lt;/p&gt;&#xA;" OwnerUserId="3957" LastEditorUserId="509" LastEditDate="2014-01-27T21:27:40.607" LastActivityDate="2014-01-28T22:32:58.313" Title="How to configure a switchport for uplink" Tags="|router|switch|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6049" PostTypeId="1" AcceptedAnswerId="6063" CreationDate="2014-01-27T19:48:08.767" Score="6" ViewCount="3975" Body="&lt;p&gt;I have a Juniper EX2200 switch running JunOS 10.4R4.5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under Configure -&gt; System Properties -&gt; Management Access, I can configure which interface allow management access.  There is a mystery interface call jsrv.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/tARp4.png&quot; alt=&quot;EX2200 Screen Shot&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;jsrv.1 is not listed in the configuration anywhere.  It does not show up on &lt;a href=&quot;http://www.x83.net/juniper-interfaces-names&quot; rel=&quot;nofollow noreferrer&quot;&gt;this list of Juniper interface names&lt;/a&gt;.  I cannot find an explicit mention of what this interface is used for online, although I see it in other people's show interfaces output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is this interface and what is it used for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;  We upgraded the EX2200 switches to JunOS 12.3R3.4 and the Jsrv.1 interface is gone now.  There is only &quot;me&quot; and &quot;lo&quot; now.&lt;/p&gt;&#xA;" OwnerUserId="3989" LastEditorUserId="3989" LastEditDate="2014-02-14T14:31:15.160" LastActivityDate="2014-02-14T14:31:15.160" Title="What is the jsrv.1 interface for?" Tags="|juniper|juniper-junos|juniper-ex|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6050" PostTypeId="2" ParentId="6048" CreationDate="2014-01-27T19:50:14.687" Score="1" Body="&lt;p&gt;Since your Cable modem's internal and your Linux/OpenBSD Router's External interface will need to communicate (e.g. your router will need to obtain a DHCP address from the provider via the modem), both of these interfaces should be connected to a different VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, since you only need to use one VLAN, all users AND the Router's internal interface can be on VLAN 1, while the router's External interface and the Cable Modem's Internal interface can be on VLAN 2.&lt;/p&gt;&#xA;" OwnerUserId="121" LastActivityDate="2014-01-27T19:50:14.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6051" PostTypeId="2" ParentId="6048" CreationDate="2014-01-27T20:07:39.423" Score="4" Body="&lt;p&gt;Yes, you'd use two VLANs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;EXTERNAL : cablemodem&lt;/li&gt;&#xA;&lt;li&gt;INTERNAL : LAN (10.0.0./24)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The TRUNK port to the Linux router will carry both VLANs (tagging one or both.)  The linux router would then have a physical interface (eth0) and one or two vlan interfaces (eth0.X and eth0.Y -- depending on the numbers you choose for your vlans)  I &lt;em&gt;suggest&lt;/em&gt; two tagged VLANs to avoid any confusion between eth0 (untagged) and eth0.#.  From there, networking is the same as having multiple physical interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(NOTE: if you use wireshark/tcdump, there are many buggy nic drivers that continue to eat vlan tags in promisc mode. As a result, capturing eth0 may not include any dot1q tags making the traffic look like it's all on the same network. Also, some management adapters will remove tags, even if the system management board isn't there. Broadcom is well known for this.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-01-27T20:07:39.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6052" PostTypeId="2" ParentId="6048" CreationDate="2014-01-27T21:28:01.600" Score="3" Body="&lt;p&gt;To answer your question directly, the port your modem is plugged into would be an access port.   So a simple configuration might be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gigabit 0/1&#xA;switchport mode access&#xA;switchport access vlan 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that these are the default values.  I'm showing them for clarity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The port for your BSD router should be a trunk port, because presumably you will be routing between networks, but your question doesn't make that clear.  If you provide a little more info, we can provide more help.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-27T21:28:01.600" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6053" PostTypeId="2" ParentId="3894" CreationDate="2014-01-28T01:43:44.510" Score="2" Body="&lt;p&gt;I have the exact same setup as you (ZyXEL ZyWALL USG 100 and GS1910 switch).&#xA;I had similar settings as you, but I did not create any static routes and my Network -&gt; Interface -&gt; VLAN page looked a bit different (not sure which of ours is more correct).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, I had the same problem with not being able to get out to the WAN from a VLAN. I was getting an IP address but traffic was not getting to the internet. Then it dawned on me... A FIREWALL RULE!  I added a rule to allow traffic from the VLAN to the WAN and voila! (Note: All those other firewall rules in my screenshot are stock; they came pre-configured).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I'm not sure what the &quot;Policy Route&quot; is used for.  I disabled it, and everything is still working fine.  Here are a couple screenshots from my environment that differ from the ones in your original question; hopefully it will help others in the future that try to &lt;em&gt;setup a VLAN on Zyxel USG firewall routers&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;FW1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network -&gt; Interface -&gt; VLAN&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UHDQQ.png&quot; alt=&quot;VLAN&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Firewall&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QC3Zw.png&quot; alt=&quot;Firewall&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration -&gt; Network --&gt; Routing --&gt; Policy Route&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;: I originally had this activated but I later deactivated it, as&#xA;  show in the screenshot, and everything continues to work fine as far&#xA;  as I can tell...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/g0Tut.png&quot; alt=&quot;Policy Route&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration -&gt; Network --&gt; Routing --&gt; Static Route&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Le7Ep.png&quot; alt=&quot;Static Route&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4064" LastActivityDate="2014-01-28T01:43:44.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6054" PostTypeId="1" AcceptedAnswerId="6059" CreationDate="2014-01-28T08:44:06.177" Score="5" ViewCount="1845" Body="&lt;p&gt;What does this error and how can I fix?&lt;img src=&quot;https://i.stack.imgur.com/kmgsO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4070" LastActivityDate="2014-01-28T14:43:52.810" Title="Hp procurve HP-5406zl log" Tags="|switch|hp-procurve|" AnswerCount="2" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6055" PostTypeId="2" ParentId="6054" CreationDate="2014-01-28T09:49:18.170" Score="2" Body="&lt;p&gt;I observed this behaviour when I connected an (A-Series) HP 5800 to a procurve 5400 with a tagged interface carrying 3 VLANs.&#xA;Is this a tagged Port? One way to solve it is to transmit one of the VLANs without Tag. PVID on both sides needs to be the same in this case.&#xA;If it is untagged, PVID must match anyways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do not want to transmit any untagged VLAN (as I did) you can turn out the log message on the procurve with the command:&#xA;setmib 1.3.6.1.2.1.16.9.1.1.3.828 –i 1&lt;/p&gt;&#xA;" OwnerUserId="4084" LastActivityDate="2014-01-28T09:49:18.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6056" PostTypeId="2" ParentId="6042" CreationDate="2014-01-28T10:40:36.337" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I have read that SIP-400 and SPA are compatible with 6509 series switch. These SIP and SPA are used to terminate PPP sessions on 7600 routers. If i installed this SIP and SPA (SPA-5X1GE-V2 for example) on my 6509 chassis, could i configure the switch to terminate PPPoE sessions? In that case, which IOS would support this feature?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The switch has SUP720-PFC3BXL supervisors.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I have some good news, and bad news:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good news, the &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/bbdsl/configuration/12-4t/bba-pppoe-baa.html#GUID-86B54017-934C-44DA-9B60-B96A8CF0D603&quot; rel=&quot;nofollow&quot;&gt;Cisco 7600 supports PPPoE on 7600-SIP-400&lt;/a&gt;, see the &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/bbdsl/configuration/12-4t/bba-pppoe-baa.html#GUID-86B54017-934C-44DA-9B60-B96A8CF0D603&quot; rel=&quot;nofollow&quot; title=&quot;PPPoE on 7600-SIP-400&quot;&gt;SIP-400 PPPoE configuration guide&lt;/a&gt;.  However, starting in IOS 15.2(4)S, the 7600 does &lt;em&gt;not&lt;/em&gt; support PPPoE.&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bad news, PPPoE on SIP-400 requires 12.2SR, and the &lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/7600/Hardware/12.2SR_supported_hw/7600_hwd.html#wp1030645&quot; rel=&quot;nofollow&quot; title=&quot;I'm sorry, I know it sucks&quot;&gt;Sup720-3CXL is &lt;em&gt;not&lt;/em&gt; supported in 12.2SR&lt;/a&gt;.&lt;sup&gt;2&lt;/sup&gt;; however, Sup720-3B / 3BXL &lt;em&gt;are&lt;/em&gt; supported in 12.2SR (see the &lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/7600/Hardware/12.2SR_supported_hw/7600_hwd.html&quot; rel=&quot;nofollow&quot;&gt;List of 12.2SR supported hardware&lt;/a&gt; for more details).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PPPoE on &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps368/product_data_sheet0900aecd8027c9e6.html&quot; rel=&quot;nofollow&quot;&gt;SIP-400&lt;/a&gt; Requirements:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/routers/ps368/product_data_sheet0900aecd8057f3b6.html&quot; rel=&quot;nofollow&quot;&gt;RSP720&lt;/a&gt;, Sup720-3B, or Sup720-3BXL&lt;/li&gt;&#xA;&lt;li&gt;When using 7600-SIP-400, &lt;a href=&quot;https://supportforums.cisco.com/thread/246912&quot; rel=&quot;nofollow&quot;&gt;Load at least IOS 12.2(33)SRC&lt;/a&gt; (or later 12.2SR) on the system&lt;/li&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;https://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6970/ps1838/prod_bulletin0900aecd805ddce3.pdf&quot; rel=&quot;nofollow&quot;&gt;7600 ES+ Series supports PPPoE starting in 12.2(33)SRE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Restrictions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Customers are discouraged from loading 12.2SR on a Catalyst 6500 branded chassis for PPPoE functionality.  Please contact your Cisco account manager if you want to do this.&lt;/li&gt;&#xA;&lt;li&gt;Sup720-3C is not supported, only Sup720-3B, Sup720-3BXL and RSP720 are supported&lt;/li&gt;&#xA;&lt;li&gt;Up to 8000 PPPoE sessions per SIP-400, maximum 32000 PPPoE sessions per chassis (across multple linecards)&lt;/li&gt;&#xA;&lt;li&gt;PBR is not supported on Virtual Template interfaces&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;&lt;sup&gt;1&lt;/sup&gt; &lt;sub&gt;After Feb 2012, Cisco encourages customers to use the ASR9K for PPPoE termination.&lt;/sub&gt;&lt;br&gt;&#xA;&lt;sup&gt;2&lt;/sup&gt; &lt;sub&gt;The 6500 and 7600 used to share a lot of hardware and software (sometimes on different SW releases), but &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/iosswrel/ps8802/ps6970/ps6017/ps9673/product_bulletin_c25-503086.html&quot; rel=&quot;nofollow&quot;&gt;that sharing has decreased&lt;/a&gt; after the release of 12.2(33)SR / 12.2(33)SX.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-01-30T10:49:12.767" LastActivityDate="2014-01-30T10:49:12.767" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6059" PostTypeId="2" ParentId="6054" CreationDate="2014-01-28T14:43:52.810" Score="5" Body="&lt;p&gt;This isn't necessarily a misconfiguration, but likely is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LLDP carries primary vlan id in one of its attributes to help switches identify mismatches like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a number of cases were VLAN ids are only locally significant in our equipment and on completely untagged ports, with lldp enabled, the procurves will log these messages periodically because the ports have different VLAN ids on the two switches.  It doesn't matter, though because the vlan id numbers are only locally significant on each switch.  I wish I could turn off this message in these situations, but alas, I'm stuck with the noise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the typical case, where VLAN ids are more than just locally significant, this likely does represent a misconfiguration where traffic could jump from one VLAN to another if the primary VLAN on a port is sent untagged (while other VLANs are tagged).&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2014-01-28T14:43:52.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6060" PostTypeId="2" ParentId="2262" CreationDate="2014-01-28T14:50:58.617" Score="2" Body="&lt;p&gt;Actually I think most of what you are trying to achieve is answered in that document:&#xA;&lt;a href=&quot;http://www.juniper.net/us/en/local/pdf/app-notes/3500192-en.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/us/en/local/pdf/app-notes/3500192-en.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this kind of setup requires two routing instances (one flow based and another packet based) you should be able to use a local &quot;LAN&quot; IP on both sides of the SRX as long as you use two different interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SRXes you need to use must be of &quot;HighMemory&quot; type IE: SRX100H (not SRX100B) to be able to support GRE fragmentation.&lt;/p&gt;&#xA;" OwnerUserId="298" LastActivityDate="2014-01-28T14:50:58.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6063" PostTypeId="2" ParentId="6049" CreationDate="2014-01-28T19:46:41.653" Score="6" Body="&lt;p&gt;Interface &lt;code&gt;jsrv.1&lt;/code&gt; is always associated to IP address &lt;code&gt;128.0.0.127&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jsrv                    up    up&#xA;jsrv.1                  up    up   inet     128.0.0.127/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An archive at &lt;a href=&quot;http://sourceforge.net/mailarchive/forum.php?thread_name=50CF09B9.8020403%40users.sourceforge.net&amp;amp;forum_name=nfdump-discuss&quot; rel=&quot;noreferrer&quot;&gt;SourceForge&lt;/a&gt; has the below command output snippet that shows a connection between &lt;code&gt;128.0.0.127&lt;/code&gt; and port &lt;code&gt;6343&lt;/code&gt; (&lt;a href=&quot;https://en.wikipedia.org/wiki/SFlow&quot; rel=&quot;noreferrer&quot;&gt;sFlow&lt;/a&gt; port)&lt;sup&gt;1&lt;/sup&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -v udp port 6343  -s 1500:&#xA;11:52:07.624977 IP (tos 0x0, ttl 254, id 5728, offset 0, flags [none],&#xA; proto UDP (17), length 1484)&#xA;   10.1.1.1.60578 &amp;gt; collector.6343: sFlowv5, IPv4 agent 128.0.0.127,&#xA; agent-id 17, seqnum 38496, uptime 1963373233, samples 8, length 1456&#xA;    flow sample (1), length 196,&#xA;&amp;lt;...snipped...&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is a &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB15490&quot; rel=&quot;noreferrer&quot;&gt;Juniper Knowledge Center&lt;/a&gt; (&lt;a href=&quot;http://webcache.googleusercontent.com/search?q=cache:2wc5g1xRijgJ%3akb.juniper.net/InfoCenter/index%3Fpage%3Dcontent%26id%3DKB15490+&amp;amp;cd=3&amp;amp;hl=en&amp;amp;ct=clnk&quot; rel=&quot;noreferrer&quot;&gt;cached google link&lt;/a&gt;) article that indicates there are 2 separate programs supporting the sFlow function, an agent and a collector.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The sFlow monitoring system consists of an sFlow agent embedded in the&#xA;  EX Switch and has a centralized collector. The sFlow agent’s two main&#xA;  activities are random sampling and statistics gathering. It combines&#xA;  interface counters and flow samples and sends them across the network&#xA;  to the sFlow collector.  The sFlow collector uses the sFlow agent’s IP&#xA;  address to determine the source of the sFlow data. This KB article&#xA;  explains how the EX Switch assigns the IP address to the sFlow agent.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;jsrv&lt;/code&gt; interface appears to be a built-in Juniper sFlow sub-system that allows communication between the internal collector and agent.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt;&lt;sub&gt;Note, this is the &lt;strong&gt;only&lt;/strong&gt; connection to 128.0.0.127 I've been able to locate.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-01-28T21:36:43.253" LastActivityDate="2014-01-28T21:36:43.253" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6064" PostTypeId="1" AcceptedAnswerId="6065" CreationDate="2014-01-28T20:32:36.627" Score="7" ViewCount="4360" Body="&lt;p&gt;While trying to create a new VLAN on a switch stack (that has many VLANs and many interconnected switches) I get an error about the switch not being the primary server for VLAN database.  When running the exec command &quot;show VTP status&quot; the switch shows up as 'VTP Operating Mode: Server' and all other switches that I can access show up as client.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First question is:&lt;/strong&gt;  If there is a switch elsewhere in the network that I can't see that is also a server, will I break or screw up the VTP or VLAN database if I set this switch to 'Primary?'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I've been reading the documentation, all of the switches in the network default to &quot;Server Secondary&quot; and in order to make configuration changes to the VTP or VLAN database, one of those switches needs to be temporarily set to &quot;Server Primary&quot; via the EXEC command &quot;VTP Primary.&quot;  After making the configuration changes (i.e. adding a VLAN) the system will eventually reset that primary server back to secondary status.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second question is:&lt;/strong&gt; Is my understanding of the functionality described in the above paragraph accurate?&lt;/p&gt;&#xA;" OwnerUserId="4081" LastActivityDate="2014-01-28T21:49:20.677" Title="VTP V3 Cisco Switch Error when creating new VLAN" Tags="|vlan|vtp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6065" PostTypeId="2" ParentId="6064" CreationDate="2014-01-28T21:49:20.677" Score="10" Body="&lt;p&gt;You can see the primary server (if any) in the output of &lt;code&gt;show vtp status&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Primary ID                        : 0011.2233.4455&#xA;Primary Description               : primary-switch-name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the Primary ID is &lt;code&gt;0000.0000.0000&lt;/code&gt;, then your current switch does not recognize any primary server, including itself. To answer your questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When you try to promote a switch to the VTP primary server role, VTP performs a sanity check to make sure no other switch on the network if already the primary, and will warn you if one is found. Either way, IOS will prompt you to proceed, so you can still back out if you're unsure. This is important, because the new primary server will cause all other VTP clients and servers to overwrite their existing VTP configuration with that of the new server. However, only switches in the same VTP domain and with the same password would be affected, and you would be able to see those with &lt;code&gt;show vtp devices&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I think you have it mostly correct. The one part I would comment on is that the only time a primary server demotes itself to secondary status is when it rejoins the VTP domain after a reload. During normal operation, a primary server will remain the primary server unless you run &lt;code&gt;vtp primary&lt;/code&gt; on another server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you have only one switch configured as the VTP server, and it is not primary, I would conclude that it was rebooted at some point, which would have caused it to demote itself. It should be safe to promote it back to primary. If you're ever unsure, back up your VLAN database (typically &lt;code&gt;flash:vlan.dat&lt;/code&gt; on smaller platforms) before making changes, so you can switch to transparent mode and restore your VLANs quickly if you need to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a comprehensive document on &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps5718/ps708/solution_guide_c78_508010.html&quot;&gt;VTP Version 3&lt;/a&gt; that goes over all of this and more.&lt;/p&gt;&#xA;" OwnerUserId="1339" LastActivityDate="2014-01-28T21:49:20.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6066" PostTypeId="2" ParentId="6048" CreationDate="2014-01-28T22:32:58.313" Score="0" Body="&lt;p&gt;You will need two VLANs, an external one between your modem and router, and an internal one between your router and 10.0.0.0/24 network. It's been years since I used a 2948G, but I believe it enumerates the GBIC ports as though they were in slot 1 of a Cat4000 chassis (e.g. 1/1, 1/2, ...), and the 48 copper ports as though they're in slot 2 (e.g. 2/1, 2/2, ...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we assume VLAN 1 for your internal network and VLAN 2 for the modem, your switch configuration would look like this (ignore lines starting with &lt;code&gt;#&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# create VLAN 2 and give it a name&#xA;set vlan 2 name Cable_Modem&#xA;&#xA;# set descriptive names for the ports to use&#xA;set port name 2/1 Cable Modem&#xA;set port name 2/2 Router on a stick&#xA;&#xA;# assign the cable modem to VLAN 2, untagged&#xA;set vlan 2 2/1&#xA;&#xA;# make the router port a trunk port;&#xA;# by default, VLAN 1 is untagged, and all other VLANs are tagged&#xA;set trunk 2/2 on dot1q&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On your router, you will need to configure the lone interface to do 802.1q VLAN trunking. I don't know how this is done on OpenBSD, but on Linux, you could do it on the CLI like this (as root, or with &lt;code&gt;sudo&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# load the 802.1q kernel module&#xA;modprobe 8021q&#xA;&#xA;# enable trunking and add VLAN 2 to eth0&#xA;vconfig add eth0 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll end up with two interfaces to configure:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;eth0 - the parent interface for untagged frames; this will handle VLAN 1 from your internal network&lt;/li&gt;&#xA;&lt;li&gt;eth0.2 - the subinterface for frames tagged for VLAN 2, which will talk to the cable modem&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1339" LastActivityDate="2014-01-28T22:32:58.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6067" PostTypeId="1" AcceptedAnswerId="6908" CreationDate="2014-01-29T00:38:53.553" Score="5" ViewCount="14403" Body="&lt;p&gt;We have a Sonicwall NSA 2400 that has been in service for some years now.  We've never had an issue with any routing until we &quot;upgraded&quot; to a new NSA 2600 device.  Below is a rough idea of the configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NSA 2600 interfaces:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x0 - LAN IP x.x.10.223  x1 - WAN ISP #1   x2 - WAN ISP #2    x3 - WAN ISP #3 and x4 - LAN IP y.y.16.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;x0 and x4 are plugged into an HP Procurve 2920-48G-PoE+ switch and the server is on another HP Procurve 2920-24G switch plugged directly into the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main server we are seeing routing issues with is an IBM AS400 with multiple IPs configured through virtual interfaces on its NIC.  The IP addresses are on the LAN segments and are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x.x.10.4   x.x.10.6   y.y.16.22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This configuration was setup by a vendor for the AS400 and the y.y.16.0 subnet is for replication to be routed out of the &lt;code&gt;x2 ISP #2&lt;/code&gt; interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The behavior we are seeing has stumped Dell/Sonicwall engineers and so I will describe it as best as I can here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upon plugging in all the interfaces, the ARP table starts filling up with the devices on the LAN segments.  &lt;code&gt;y.y.16.22, x.x.10.4&lt;/code&gt; and &lt;code&gt;x.x.10.6&lt;/code&gt; do not show up.  We have tried adding static ARP entries for them and the pings perform abnormally in that they will respond for a period of time then start dropping off one IP at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if we leave the x4 (second LAN interface) unplugged then the &lt;code&gt;x.x.10.4&lt;/code&gt; and &lt;code&gt;x.x.10.6&lt;/code&gt; will appear in the ARP entries initially.  We have run packet captures and find that ping requests from the Sonicwall NSA 2600 are 'generated' then 'consumed' but sometimes not forwarded. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have cleared the ARP cache on the AS400, this is the second NSA 2600 device as the first was RMA'ed after being factory reset 3 times and even testing the settings imported from the 2400.  We also tried setting the interface MAC addresses on the NSA 2600 to the same as the 2400.  Oh, and we started this ordeal with Dell Powerconnect switches and were told they were an issue (by Sonicwall) so we bought HPs :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts, advice or even a direction to look into would be appreciated as we have beat our heads on keyboards for a while, and spent hours on the phone with Dell/Sonicwall &quot;support&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT for RON:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) correct.  with static ARP entries it may ping for a few minutes then drop completely from the firewall but from other PCs on the network it still responds.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) on packet captures for the NSA 2400 (old device) the ping trace from the firewall to AS400 goes 1-packet Generated by source 2-packet Consumed (by firewall) 3-packet Forwarded to AS400  so in the packet capture on the 2600 it is not forwarding the packets on the NSA 2600.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) The AS400 has a single NIC with virtual interfaces configured so it is technically a single interface.  Other machines on the network can ping the AS400 directly on the x.x.10.0 network and I've added the y.y.16.0 network to a machine and the pings never drop to any of those addresses.  This issue seems to only be with the NSA 2600 device, which we've replaced...  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks Ron.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT # 2:&#xA;Packet captures show that ARP packets are going out but responses are not received when the x4 interface is plugged in.  If the x4 interface is unplugged, the ARP responses are received.  Same goes for unplugging the x0 interface for the x4 subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT # 3:&#xA;Found out the AS400 is using what is called a Proxy ARP configuration.  The physical NIC is used as a console for the system and also acts as a proxy for the virtual interfaces configured inside the AS400.  The proxy responds to all ARP requests with the physical MAC address and then handles routing internally to the virtual interfaces.  I've attached a drawing to clarify the setup as follows.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still no headway on what is causing this behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/svPmX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/svPmX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4006" LastEditorUserId="52517" LastEditDate="2019-06-25T13:29:53.020" LastActivityDate="2019-06-25T13:29:53.020" Title="Sonicwall NSA 2600 routing issues with multiple LAN interfaces configured" Tags="|routing|arp|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="6070" PostTypeId="1" AcceptedAnswerId="6071" CreationDate="2014-01-29T11:15:19.753" Score="12" ViewCount="4464" Body="&lt;p&gt;How do I do community string Indexing for other switches like &lt;strong&gt;D link DES 3526&lt;/strong&gt; and &lt;strong&gt;Brocade Fastiron SX800&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am running a java program to poll a specific vlan on a &lt;strong&gt;Brocade sx 800&lt;/strong&gt; l3 switch.  The program throws a &quot;Time out error&quot;. I then checked the switch log , which says &lt;strong&gt;community string invalid&lt;/strong&gt;. I'm having trouble with the syntax &quot;community@vlanid&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Displaying all Vlans and their names:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IH232.jpg&quot; alt=&quot;Displaying all Vlans and their names&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone please tell me the community string indexing for switches other than Cisco?&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;EDIT&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I tried the commands in CLI with Net-SNMP: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Poll sysDescr:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpwalk -v 2c -c public 10.21.200.4 1.3.6.1.2.1.1.1&#xA;SNMPv2-MIB::sysDescr.0 = STRING: DES-3526 Fast-Ethernet Switch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Poll dot1dTpFdbAddress (default Vlan):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpbulkwalk -v 2c -c public 10.21.200.4 1.3.6.1.2.1.17.4.3.1.1&#xA;SNMPv2-SMI::mib-2.17.4.3.1.1.0.27.17.189.90.220 = Hex-STRING: 00 1B 11 BD 5A DC&#xA;SNMPv2-SMI::mib-2.17.4.3.1.1.4.254.127.149.86.136 = Hex-STRING: 04 FE 7F 95 56 88&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Poll dot1dTpFdbAddress (default Vlan4):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpbulkwalk -v 2c -c public@4 10.21.200.4 .1.3.6.1.2.1.17.4.3.1.1&#xA;Timeout: No Response from 10.21.200.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Netdisco listing all ports and corresponding MAC addresses&#xA;&lt;img src=&quot;https://i.stack.imgur.com/XXr1q.jpg&quot; alt=&quot;Netdisco listing all ports and corresponding MAC addresses&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to retrieve all MAC addresses from individual ports. The &lt;strong&gt;Q-Bridge MIB&lt;/strong&gt; shows all the ports on the switch but unfortunately the MAC address OID is not accessible. On the other hand, using the &lt;strong&gt;Bridge MIB&lt;/strong&gt; lists only MAC addresses from the default Vlan.&#xA;P.S: the community string indexing ( coommstring@vlanid ) to access other vlans only works with CISCO switches.&lt;/p&gt;&#xA;" OwnerUserId="4094" LastEditorUserId="775" LastEditDate="2014-02-12T10:35:43.157" LastActivityDate="2015-03-26T09:27:43.640" Title="Mac / CAM entries from non-Cisco switches with Q-BRIDGE-MIB" Tags="|cisco|switch|snmp|brocade|foundry|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6071" PostTypeId="2" ParentId="6070" CreationDate="2014-01-29T12:21:40.663" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Could someone please tell me the community string indexing for switches other than Cisco?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Edit:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This is how to poll Q-BRIDGE-MIB for mac-addresses from the only non-Cisco I have, a DLink DGS-3200.  I'm &lt;em&gt;not&lt;/em&gt; using [community@vlan] for non-Cisco switches.  You're correct that this indexing only applies to Ciscos.  I expect any non-Cisco switch, which supports Q-BRIDGE-MIB to work the same way.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Polling &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=sysDescr&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot;&gt;sysDescr&lt;/a&gt; to document the switch under test&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ # Demo from a DLink DGS-3200 switch&#xA;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public -OXsq 172.16.1.2 sysdescr&#xA;sysDescr.0 &quot;DGS-3200-10 Gigabit Ethernet Switch&quot;&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Walking &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qVlanStaticName&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot;&gt;dot1qVlanStaticName&lt;/a&gt;: List Vlans and their text names&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$&#xA;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public 172.16.1.2 .1.3.6.1.2.1.17.7.1.4.3.1.1&#xA;BRIDGE-MIB::dot1dBridge.7.1.4.3.1.1.1 = STRING: &quot;default&quot;&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qFdbDynamicCount&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot;&gt;dot1qFdbDynamicCount&lt;/a&gt;: Number of mac addresses known&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ &#xA;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public  172.16.1.2 .1.3.6.1.2.1.17.7.1.2.1.1.2&#xA;BRIDGE-MIB::dot1dBridge.7.1.2.1.1.2.1 = Counter32: 17&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qVlanCurrentEgressPorts&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot;&gt;dot1qVlanCurrentEgressPorts&lt;/a&gt;: bitmap of ports in the vlan&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ &#xA;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public 172.16.1.2 .1.3.6.1.2.1.17.7.1.4.2.1.4&#xA;BRIDGE-MIB::dot1dBridge.7.1.4.2.1.4.2562.1 = Hex-STRING: FF C0 00 00&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot; title=&quot;dot1qTpFdbPort&quot;&gt;dot1qTpFdbPort&lt;/a&gt;: All MAC Addresses learned&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The mac-addresses show up as a string of six decimal digits in the indexes to &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot; title=&quot;dot1qTpFdbPort&quot;&gt;dot1qTpFdbPort&lt;/a&gt;.  Note that I have a downstream switch connected to this switch on port &lt;code&gt;1/5&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ &#xA;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public 172.16.1.2 .1.3.6.1.2.1.17.7.1.2.2.1.2&#xA;BRIDGE-MIB::dot1dBridge.7.1.2.2.1.2.1.0.13.101.22.202.65 = INTEGER: 5&#xA;BRIDGE-MIB::dot1dBridge.7.1.2.2.1.2.1.0.13.189.7.134.128 = INTEGER: 5&#xA;BRIDGE-MIB::dot1dBridge.7.1.2.2.1.2.1.0.13.189.7.134.129 = INTEGER: 5&#xA;BRIDGE-MIB::dot1dBridge.7.1.2.2.1.2.1.0.29.161.205.83.70 = INTEGER: 9&#xA;BRIDGE-MIB::dot1dBridge.7.1.2.2.1.2.1.0.48.27.188.167.215 = INTEGER: 2&#xA;BRIDGE-MIB::dot1dBridge.7.1.2.2.1.2.1.0.192.183.110.158.29 = INTEGER: 3&#xA;&#xA;... more entries here&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1dBasePortIfIndex&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot; title=&quot;dot1dBasePortIfIndex&quot;&gt;dot1dBasePortIfIndex&lt;/a&gt;: Map values from &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot; title=&quot;dot1qTpFdbPort&quot;&gt;dot1qTpFdbPort&lt;/a&gt; to an &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ifIndex&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot; title=&quot;ifIndex&quot;&gt;ifIndex&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public -OXsq 172.16.1.26 .1.3.6.1.2.1.17.1.4.1.2&#xA;dot1dBasePortIfIndex[1] 1&#xA;dot1dBasePortIfIndex[2] 2&#xA;dot1dBasePortIfIndex[3] 3&#xA;dot1dBasePortIfIndex[4] 4&#xA;dot1dBasePortIfIndex[5] 5&#xA;dot1dBasePortIfIndex[6] 6&#xA;dot1dBasePortIfIndex[7] 7&#xA;dot1dBasePortIfIndex[8] 8&#xA;dot1dBasePortIfIndex[9] 9&#xA;dot1dBasePortIfIndex[10] 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ifName&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot; title=&quot;ifName&quot;&gt;ifName&lt;/a&gt;: Map values from &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ifIndex&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot; title=&quot;ifIndex&quot;&gt;ifIndex&lt;/a&gt; to an &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ifName&amp;amp;translate=Translate&quot; rel=&quot;noreferrer&quot; title=&quot;ifName&quot;&gt;ifName&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ snmpbulkwalk -v 2c -c public -OXsq 172.16.1.26 ifName&#xA;ifName[1] 1/1&#xA;ifName[2] 1/2&#xA;ifName[3] 1/3&#xA;ifName[4] 1/4&#xA;ifName[5] 1/5&#xA;ifName[6] 1/6&#xA;ifName[7] 1/7&#xA;ifName[8] 1/8&#xA;ifName[9] 1/9&#xA;ifName[10] 1/10&#xA;ifName[5121] System&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;ORIGINAL:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;There is a mistake in your OID, you're using &lt;code&gt;1.3.6.2.3.1.17.4.3.1.1&lt;/code&gt;; however, &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=dot1dTpFdbAddress&quot; rel=&quot;noreferrer&quot;&gt;dot1dTpFdbAddress&lt;/a&gt; is &lt;code&gt;1.3.6.1.2.1.17.4.3.1.1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference is changing some octets, below...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OID Incorrect: 1.3.6.2.3.1.17.4.3.1.1   &amp;lt;--- Not this&#xA;OID Corrected: 1.3.6.1.2.1.17.4.3.1.1   &amp;lt;--- Use this&#xA;                     ^ ^&#xA;                     | |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-02-12T10:30:35.907" LastActivityDate="2014-02-12T10:30:35.907" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6073" PostTypeId="2" ParentId="5954" CreationDate="2014-01-29T13:23:56.157" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://avahi.org/&quot; rel=&quot;nofollow&quot;&gt;Avahi&lt;/a&gt; can help you here. There are lots of options but this &lt;em&gt;should&lt;/em&gt; get the traffic across the subnets. You should be able to get it on a ddwrt box or use a Raspberry Pi and dot1q interfaces.       &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; enable-reflector= Takes a boolean value (&quot;yes&quot;  or  &quot;no&quot;).  If  set  to&#xA;       &quot;yes&quot;  avahi-daemon  will  reflect  incoming mDNS requests to all local&#xA;       network interfaces, effectively allowing clients to browse  mDNS/DNS-SD&#xA;       services  on  all  networks  connected  to  the gateway. The gateway is&#xA;       somewhat intelligent and should work with all kinds  of  mDNS  traffic,&#xA;       though  some functionality is lost (specifically the unicast reply bit,&#xA;       which is used rarely anyway). Make sure to not run multiple  reflectors&#xA;       between the same networks, this might cause them to play Ping Pong with&#xA;       mDNS packets. Defaults to &quot;no&quot;.&#xA;&#xA; reflect-ipv= Takes a boolean value (&quot;yes&quot; or &quot;no&quot;). If set to &quot;yes&quot; and&#xA;       enable-reflector  is  enabled,  avahi-daemon  will forward mDNS traffic&#xA;       between IPv4 and IPv6, which is usually not  recommended.  Defaults  to&#xA;       &quot;no&quot;.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4095" LastEditorUserId="775" LastEditDate="2014-01-29T13:33:05.843" LastActivityDate="2014-01-29T13:33:05.843" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6075" PostTypeId="1" AcceptedAnswerId="6084" CreationDate="2014-01-29T18:16:33.717" Score="3" ViewCount="11907" Body="&lt;p&gt;On an ASA I administer there is a policy-map in place which implements &quot;inspect ESMTP&quot;.  I've reviewed what this does, and in my (rather uninformed) opinion at first blush it looks to be a good thing to implement.  It is however impacting the ability to send mass emails from lists with over 50 recipients according to our domain admins.  They want to remove this inspection to alleviate the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is ESMTP inspection a solid control to leave and place, or is removal safe?  If I don't want to remove it, is there a way to see what in the control is preventing mail from being sent and possibly alter that one element of it rather than removing it altogether?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2014-01-29T18:34:56.113" LastActivityDate="2014-09-12T00:43:16.223" Title="To Inspect ESMTP on ASA or not?" Tags="|cisco|cisco-asa|security|firewall|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6076" PostTypeId="1" AcceptedAnswerId="6081" CreationDate="2014-01-29T18:22:50.153" Score="1" ViewCount="234" Body="&lt;p&gt;I have heard that this new certification track, Cisco Data Center, is going to be the future, and Cisco UCS technology will replace traditional routers and switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is the UCS different from traditional network systems?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw a blog in which there were posts that VMware NSX can be integrated with Cisco UCS to push the limits of these systems. Does using NSX mean that &lt;a href=&quot;https://en.wikipedia.org/wiki/VMware_vSphere&quot; rel=&quot;nofollow&quot;&gt;vSphere&lt;/a&gt; runs on top of UCS, and NSX runs on top of vSphere?&lt;/p&gt;&#xA;" OwnerUserId="4099" LastEditorUserId="3232" LastEditDate="2016-08-23T22:09:14.137" LastActivityDate="2016-08-24T02:13:35.593" Title="Cisco Data Center or Cisco UCS" Tags="|cisco|vmware|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6077" PostTypeId="1" CreationDate="2014-01-29T19:04:19.487" Score="5" ViewCount="235" Body="&lt;p&gt;Academic question (at the moment):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to advertise BGP routes to a given prefix (IPv6 and/or IPv4) from multiple different physical data centers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess this is multi-homing, but different. Conventional multi-homing means a single data center with multiple links. This would be multiple different geographically distributed data centers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The desired behavior would be this: if a user in Asia accesses one of these IPs, their packets will probably end up at the Asian data center. Meanwhile if a user in the USA sends a packet to one of these IPs, their packet will instead be routed to a USA data center. And so on. Same IP, but the network should tend to route packets to the closest site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible on the current Internet? Is it possible with IPv6, IPv4, or both? (I suspect you'd have to own your own block and advertise your own BGP routes or contract with a chain of data centers to do this...)&lt;/p&gt;&#xA;" OwnerUserId="4100" LastActivityDate="2016-01-04T16:28:33.853" Title="Locating a single IPv6 or IPv4 routable prefix at multiple data centers" Tags="|routing|ipv4|bgp|ipv6|bgp-ipv6|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6078" PostTypeId="2" ParentId="6077" CreationDate="2014-01-29T19:34:19.390" Score="7" Body="&lt;p&gt;What you describe is called anycast, and common when deploying services like DNS. Because routing can change it is a bad idea for things that use longer sessions, but for short things a DNS query it is used a lot.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-01-29T19:34:19.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6081" PostTypeId="2" ParentId="6076" CreationDate="2014-01-29T21:23:25.793" Score="5" Body="&lt;p&gt;Well,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a lot of questions and some misconceptions. Let me clarify few things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, Cisco DC certification track is like any other - has it's junior, senior and expert levels. Cisco UCS is on it's basic level an integrated computing system, and the Cisco Unified Fabric solution integrates computing (UCS), networking (Nexus) and application-awareness (ACI/APIC).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea for computing resources to fully replace routers &amp;amp; switches is promoted mostly by OpenFlow &quot;believers&quot;, and while theoretically possible (look for definitions of SDN), it's currently feasible only to limited extent in software-defined environments, like fully integrated DC. You will see more and more physical boxes virtualized as software elements, but this has it's pros and cons, and there's no easy answer or direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for NSX - it's networking virtualization solution, and can run on different hypervisors, doesn't have to be put on top of VMWare vSphere. And obviously, hypervisor needs an hardware to run on, so Cisco UCS can be the hardware. NSX is not the only solution for networking virtualization, or NfV (Networking functions Virtualization), it's just VMWare take at it.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-01-29T21:23:25.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6082" PostTypeId="1" AcceptedAnswerId="6088" CreationDate="2014-01-29T22:11:43.480" Score="3" ViewCount="830" Body="&lt;p&gt;I work for a very small company with an akward shaped building.  As a result we have 3 Netgear WNDAP350 Dual Band Simultaneous Access Points to cover everywhere.  They've been setup and running for about a year now maybe without any issues.  The 2.4Ghz and the 5Ghz SSIDs are different names but each of the three access points are setup identically otherwise so that no matter where you are in the building you only see the two SSIDs so everyone is happy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing I wonder though is if it is possible to assign a different subnet to each of the two different SSID's?  Right now they both assign IP addresses from our DHCP server from just the 10.10.xxx.xxx scope.  DHCP is NOT being handled on the Netgear Access Points.  What I would like to setup if possible is something like the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SSID2.4ghz - 10.10.xxx.xxx&#xA;SSID5ghz - 10.11.xxx.xxx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both subnets already exist; I'm just not educated enough yet to know how(if possible) to set it so that the two different SSIDs run on the different subnets.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="4104" LastActivityDate="2014-01-30T09:37:12.377" Title="When two SSIDs are created on Netgear WNDAP350 can they each have their own subnet?" Tags="|wireless|dhcp|subnet|netgear-prosafe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6083" PostTypeId="1" AcceptedAnswerId="6093" CreationDate="2014-01-29T22:56:25.110" Score="4" ViewCount="4118" Body="&lt;p&gt;I am unable to ping from R1 to R2. &lt;code&gt;debug ip packet detail&lt;/code&gt; returns &lt;code&gt;IP: s=172.16.12.1 (local), d=172.16.12.2 (FastEthernet0/0.12), len 100, encapsulation failed&lt;/code&gt;. I understand this means it can't resolve an arp address. I am looking for some guidance on what could be causing this.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using GNS3 to test some configurations. I have three 3725 routers. One acting as a switch (R1, R2, SW1). &lt;code&gt;ip cef&lt;/code&gt; is enabled on all three devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1&lt;/code&gt; and &lt;code&gt;R2&lt;/code&gt; connect to &lt;code&gt;SW1&lt;/code&gt;, from their &lt;code&gt;f0/0&lt;/code&gt; to &lt;code&gt;f1/1&lt;/code&gt; &amp;amp; &lt;code&gt;F1/2&lt;/code&gt; respectively. &lt;code&gt;R1&lt;/code&gt; &amp;amp; &lt;code&gt;R2&lt;/code&gt; have subinterfaces enabled on &lt;code&gt;f0/0.12&lt;/code&gt; VLAN 12. &lt;code&gt;SW1 f1/1&lt;/code&gt; &amp;amp; &lt;code&gt;f1/2&lt;/code&gt; are both assigned to &lt;code&gt;vlan 12&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a feature on &lt;code&gt;SW1&lt;/code&gt; I need to disable/enable? What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1&lt;/code&gt; config  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0.12  &#xA; encapsulation dot1Q 12  &#xA; ip address 172.16.12.1 255.255.255.0  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R2&lt;/code&gt; config  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0.12  &#xA; encapsulation dot1Q 12  &#xA; ip address 172.16.12.2 255.255.255.0  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SW1&lt;/code&gt; config  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet1/1  &#xA; switchport access vlan 12  &#xA; switchport mode trunk  &#xA; duplex full  &#xA; speed 100  &#xA;!  &#xA;interface FastEthernet1/2  &#xA; switchport access vlan 12  &#xA; switchport mode trunk  &#xA; duplex full  &#xA; speed 100  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4105" LastEditorUserId="3191" LastEditDate="2014-01-30T09:26:20.690" LastActivityDate="2014-01-30T16:17:13.390" Title="Cisco 3725 - ping encapsulation failed" Tags="|cisco|ping|trunk|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6084" PostTypeId="2" ParentId="6075" CreationDate="2014-01-29T22:58:59.033" Score="3" Body="&lt;p&gt;It only &lt;em&gt;looks&lt;/em&gt; harmless. :-)  In reality, Cisco has a long history of botching the STMP and ESMTP inspection.  And honestly, it won't provide any protection from current evolving threats; it doesn't use a dynamic set of rules that can be updated regularly.  Email filtering and inspection is best done by a dedicated appliance that's up-to-date.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my knowledge, there are no knobs on &lt;code&gt;inspect esmtp&lt;/code&gt;.  And &lt;strong&gt;&lt;a href=&quot;http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080bab912.shtml&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;&lt;/strong&gt; is enough of a reason to never turn it on:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For example, Telnet sends each character individually in a different&#xA;  packet on the wire, but actual email clients and servers send the&#xA;  entire command in one packet. If you use Telnet and you type &lt;strong&gt;H&lt;/strong&gt;, the&#xA;  Telnet client sends an &lt;strong&gt;H&lt;/strong&gt; to the email server. Since ESMTP and SMTP&#xA;  inspection do not recognize &lt;strong&gt;H&lt;/strong&gt; as a valid command, the ASA replaces the&#xA;  &lt;strong&gt;H&lt;/strong&gt; with an &lt;strong&gt;X&lt;/strong&gt; and passes it along.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-01-29T22:58:59.033" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6087" PostTypeId="1" CreationDate="2014-01-30T08:57:20.540" Score="4" ViewCount="2092" Body="&lt;p&gt;I have a pfsense box (Call this BOX1) that has LANs and a WAN which connects to the internet and is used to create a VPN connection to a client: This has pfsense version 2.0.2-RELEASE (i386)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a another pfsense box (Call this BOX2) with an Internet Connection. Behind it is several LANs (LANx): This has pfsense version 2.1-RELEASE (i386)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also a Point to Point Connection between BOX1 and BOX2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BOX2 uses BOX1 as its default gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means BOX1 is the default gateway for its own LAN and also the default gateway for BOX2 and the networks behind BOX2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internet of BOX2 is normally used only when BOX1's WAN is unreachable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BOX1 has got a site to site VPN to a client who use that VPN to connect to an IP 192.168.2.5 (Call it SRV1) which sits in the LAN behind BOX1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the WAN on BOX2, I want to setup a backup VPN to the client so that they can connect to SRV1 via the Point to Point that connects BOX2 and BOX1. The client's computer is on IP: 172.16.2.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, if the WAN supporting the VPN on the PfSense BOX1 is down, I want the clients themselves to switch to VPN2 which will connect via the Point to Point link to BOX1 and thus find SRV1 which sits behind BOX1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you guide me on how to do this kind of setup?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VsP8N.jpg&quot; alt=&quot;http://postimg.org/image/95ha0l0x1/&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, I have tried but haven't succeeded. On BOX2, am getting the errors:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: [Unknown Gateway/Dynamic]: ERROR: such policy&#xA;  already exists. anyway replace it: 172.16.2.10/24[0] 10.10.11.3/32[0]&#xA;  proto=any dir=in&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: [Unknown Gateway/Dynamic]: DEBUG: db&#xA;  :0x28501288: 172.16.2.10/24[0] 10.10.11.3/32[0] proto=any dir=in&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: [Unknown Gateway/Dynamic]: DEBUG:&#xA;  sub:0xbfbfe724: 172.16.2.10/24[0] 10.10.11.3/32[0] proto=any dir=in&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: got pfkey X_SPDADD message&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: pk_recv: retry[0] recv()&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: [Unknown Gateway/Dynamic]: ERROR: such policy&#xA;  already exists. anyway replace it: 192.168.2.5/32[0] 172.16.2.10/24[0]&#xA;  proto=any dir=out&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: [Unknown Gateway/Dynamic]: DEBUG: db&#xA;  :0x28501508: 192.168.2.5/32[0] 172.16.2.10/24[0] proto=any dir=out&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: [Unknown Gateway/Dynamic]: DEBUG:&#xA;  sub:0xbfbfe724: 192.168.2.5/32[0] 172.16.2.10/24[0] proto=any dir=out&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: [Unknown Gateway/Dynamic]: DEBUG: db&#xA;  :0x28501288: 172.16.2.10/24[0] 10.10.11.3/32[0] proto=any dir=in&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: [Unknown Gateway/Dynamic]: DEBUG:&#xA;  sub:0xbfbfe724: 192.168.2.5/32[0] 172.16.2.10/24[0] proto=any dir=out&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: got pfkey X_SPDADD message&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: pk_recv: retry[0] recv()&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: INFO: unsupported PF_KEY message REGISTER&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: got pfkey REGISTER message&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: pk_recv: retry[0] recv()&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: getsainfo params: loc='192.168.2.5'&#xA;  rmt='172.16.2.10/24' peer='NULL' client='NULL' id=1&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: no check of compression algorithm; not&#xA;  supported in sadb message.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: hmac(modp1536)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: reading config file&#xA;  /var/etc/ipsec/racoon.conf&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: pk_recv: retry&lt;a href=&quot;https://forum.pfsense.org/index.php/topic,72062.msg393198.html#msg393198&quot; rel=&quot;nofollow noreferrer&quot;&gt;2&lt;/a&gt; recv()&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: pk_recv: retry&lt;a href=&quot;https://i.stack.imgur.com/VsP8N.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt; recv()&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: pk_recv: retry[0] recv()&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: [Unknown Gateway/Dynamic]: DEBUG: db&#xA;  :0x28501288: 172.16.2.10/24[0] 10.10.11.3/32[0] proto=any dir=in&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: [Unknown Gateway/Dynamic]: DEBUG:&#xA;  sub:0xbfbfe704: 192.168.2.5/32[0] 172.16.2.10/24[0] proto=any dir=out&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: got pfkey X_SPDDUMP message&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: pk_recv: retry[0] recv()&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: got pfkey X_SPDDUMP message&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: pk_recv: retry[0] recv()&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: INFO: unsupported PF_KEY message REGISTER&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: got pfkey REGISTER message&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Jan 30 10:32:04   racoon: DEBUG: pk_recv: retry[0] recv()&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'd posted &lt;a href=&quot;https://forum.pfsense.org/index.php/topic,72062.msg393198.html#msg393198&quot; rel=&quot;nofollow noreferrer&quot;&gt;this question&lt;/a&gt; on pfsense forums but shortly after I remembered am an active SE member so I came looking for a network forum. Hope that doesn't break any rules&lt;/p&gt;&#xA;" OwnerUserId="4111" LastEditorUserId="4111" LastEditDate="2014-01-30T09:03:31.530" LastActivityDate="2020-12-16T18:53:07.220" Title="Setup IPSec VPN to a node behind another Pfsense Box" Tags="|ipsec|pfsense|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6088" PostTypeId="2" ParentId="6082" CreationDate="2014-01-30T09:37:12.377" Score="1" Body="&lt;p&gt;You should use &lt;a href=&quot;http://en.wikipedia.org/wiki/VLAN&quot; rel=&quot;nofollow&quot;&gt;VLAN&lt;/a&gt;  and Trunking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short you do have to trunk the interface that links the switch and the AP, and the interface that links the switch with the DHCP server. In this way you will have somethink like ethx.y (in a Linux fashion) or Ethernetx.y (in a Cisco fashion) where x is the identifier of the interface and y is the VLAN tag. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the access point you need to &quot;bridge&quot; every SSID with the sub-interface according to the chosen VLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the DHCP server you have to define a specific pool according to the sub-interface from where the request comes from, and therefore the VLAN from where it comes from.&lt;/p&gt;&#xA;" OwnerUserId="2663" LastActivityDate="2014-01-30T09:37:12.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6091" PostTypeId="1" AcceptedAnswerId="6095" CreationDate="2014-01-30T13:00:20.580" Score="5" ViewCount="698" Body="&lt;p&gt;We're designing a new WAN connection with backup connections to every branch office. Each branch office needs to connect to servers in the main office, but may not connect to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is a best practice in such case? Can I create GRE tunnels to the branch offices and configure the failover with HSRP? And use access-lists so the branch offices can't reach each other? Or is perhaps a better way to configure VRF-lite between the main office and the branches?&lt;br&gt;&#xA;Or is there an other way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The blue routers are the main lines and the green lines are backups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hUbXy.jpg&quot; alt=&quot;the drawing&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1013" LastEditorUserId="3191" LastEditDate="2014-02-03T04:48:36.253" LastActivityDate="2014-09-09T11:32:33.590" Title="Design question - branch offices with failover" Tags="|design|wan|vrf-lite|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6093" PostTypeId="2" ParentId="6083" CreationDate="2014-01-30T16:17:13.390" Score="4" Body="&lt;p&gt;Before you can forward traffic on a VLAN, you have to create it in the switch's VLAN database.  For older switches, there is a separate configuration mode for VLANs.  From privileged (enable) mode type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch# vlan database&#xA;switch(vlan)# vlan 12&#xA;switch(vlan)# exit&#xA;switch#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-30T16:17:13.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6094" PostTypeId="1" AcceptedAnswerId="6101" CreationDate="2014-01-30T17:53:30.693" Score="2" ViewCount="220" Body="&lt;p&gt;As I understand it, NAPT takes one outer IP address and, by coupling it with a port, translates it to some fixed number of internal/non-routable IP addresses for clients that require internet access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose, an outer NAPT, NAPTa, connects to an ISP via one IP address.  NAPTa would give all of its clients that need an internet connection an address:port mapping.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could another NAPT, NAPTb, act as one of NAPTa's clients and take, as its one outer IP address, a port on NAPTa, and create something like an address:porta:portb mapping to all of NAPTb's clients?&lt;/p&gt;&#xA;" OwnerUserId="4115" LastActivityDate="2014-01-30T22:09:03.223" Title="Would NAPT work behind another NAPT?" Tags="|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6095" PostTypeId="2" ParentId="6091" CreationDate="2014-01-30T18:41:33.407" Score="7" Body="&lt;p&gt;If you are using the same provider for your primary and backup MPLS connections, it is almost a certainty that they are the same network.  Even if you were to use a different technology for your backup links (e.g, frame relay), the provider would likely provision that over their MPLS network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know you want a simple answer, but your question is pretty broad. Since you asked about best practice, here is how I would go about creating a design, rather than just saying “it depends”:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would take a step back and look at the overall picture of your network.  You have to pay attention to each of the components between the branch user and the main office server, to decide which ones you will want to make redundant.  Here is a (partial) list:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Branch user PC &lt;/li&gt;&#xA;&lt;li&gt;Local switch &lt;/li&gt;&#xA;&lt;li&gt;Branch router &lt;/li&gt;&#xA;&lt;li&gt;Local loop circuit&lt;/li&gt;&#xA;&lt;li&gt;Provider edge switch&lt;/li&gt;&#xA;&lt;li&gt;Provider network&lt;/li&gt;&#xA;&lt;li&gt;Provider edge switch at main office location&lt;/li&gt;&#xA;&lt;li&gt;Local loop to main office&lt;/li&gt;&#xA;&lt;li&gt;Main office router&lt;/li&gt;&#xA;&lt;li&gt;Main office switch(es)&lt;/li&gt;&#xA;&lt;li&gt;Server&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Think of these items as links in a chain -- If any of these items fail, the chain will be broken and your user will not be able to communicate with the server.  If you only think about the network components (routers and WAN circuits), you could still have a network failure (and then you have to explain to your boss why he spent all that money but the users still can't access the server).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When deciding which components to make redundant, you have to analyze the likelihood of a failure, the impact if the item fails, the cost of a redundant item and the complexity to install, operate and troubleshoot it.  In other words, you have to analyze the risks to see where it makes most sense to add redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend you create a table with the list of items as rows and the analysis factors as columns.  As you fill in the data, you will begin to see where it makes most sense to add redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your analysis will have to take into account specifics of the application use as well as failure characteristics of each item.   Here are a few things to consider:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The impact of a single user PC failing is relatively low, but if the server fails, then everyone is affected.   &lt;/li&gt;&#xA;&lt;li&gt;How tolerant are you of downtime?  Are your users making split-second stock trades, or are they researching information for literary reports?&lt;/li&gt;&#xA;&lt;li&gt;You can add a second local loop for redundancy, but given how local loop circuits are usually wired, a fault that affects one circuit may easily affect the other, so you don’t actually gain much redundancy.&lt;/li&gt;&#xA;&lt;li&gt;Adding redundancy adds complexity, and this can actually reduce availability.  In your question, you ask about VRF-lite.  Configuring VRF-lite, HSRP, GRE, etc. makes you network more complex, and when it comes time to troubleshoot it or modify it (at 3 in the morning), it will take you longer to fix.  That doesn’t mean you shouldn’t do it, but it’s a factor to keep in mind.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The answer to all these questions will show you where it makes most sense to add redundancy.  You may find that it is not cost-effective to add a second WAN circuit, even if it were a different provider. Or, it may be important to have redundant servers than redundant routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the short answer to your question is, “best practice” says you should carefully analyze where redundancy makes most sense.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-01-30T20:27:17.357" LastActivityDate="2014-01-30T20:27:17.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6096" PostTypeId="1" AcceptedAnswerId="6100" CreationDate="2014-01-30T20:00:32.527" Score="1" ViewCount="1315" Body="&lt;p&gt;How Many Routes Can be carried by a RIP Version 1 &amp;amp; RIP Version 2 Update Packets ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I Know Both RIP Version 1 &amp;amp; 2 Using the Metric of Hop Count and Maximum Hop Count is 16.&lt;/p&gt;&#xA;" OwnerUserId="3915" LastActivityDate="2014-02-03T06:08:13.253" Title="RIP Update Packets" Tags="|routing|rip|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6097" PostTypeId="1" AcceptedAnswerId="6110" CreationDate="2014-01-30T20:10:44.330" Score="2" ViewCount="197" Body="&lt;p&gt;I believe I am missing something obvious. I am using GNS3 to lab out having two paths to a CORE network. See picture. The configuration works as I imagined, I can ping from each Switch every other Switch within VLAN212. I can also ping the loopbacks of the CORE switch from the other switches in the VLAN212 domain. Spanning tree has put SW-C f/15 in block mode which is good since this group of switches is a Layer 2 loop. The issue is, if I remove any of the links in the loop, the topology cannot recover. I thought Spanning Tree would only take 30 seconds to recalculate, but something else is preventing each switch to ping each other...Even in the localized VLAN 212.  What I mean is if I remove the link from SW-A --&gt; SW-C. I can no longer ping from SW-C any of the switches or even the CORE switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps I am going about this the wrong way. If there is a better way to get a secondary path to a group of non-stackable switches let me know. I am trying to get away from the fact that these non-stackable switches are daisy chained, with only 1 switch having a path to the core.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any, I appreciate your help. Thank you!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Picture.&lt;img src=&quot;https://i.stack.imgur.com/yZuXG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spanning Tree output SW-C with link intact:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-C#show spanning-tree brief&#xA;&#xA;VLAN212&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    32768&#xA;             Address     c801.2308.0001&#xA;             Cost        19&#xA;             Port        55 (FastEthernet1/14)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32768&#xA;             Address     c802.2308.0000&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface                                   Designated&#xA;Name                 Port ID Prio Cost  Sts Cost  Bridge ID            Port ID&#xA;-------------------- ------- ---- ----- --- ----- -------------------- -------&#xA;FastEthernet1/14     128.55   128    19 FWD     0 32768 c801.2308.0001 128.56&#xA;FastEthernet1/15     128.56   128    19 FWD    19 32768 c802.2308.0000 128.56&#xA;&#xA;SW-C#ping 1.1.1.1&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 20/45/84 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;REmove link from SW-A to SW-C&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-C#show spanning-tree bri&#xA;&#xA;VLAN212&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    32768&#xA;             Address     c801.2308.0001&#xA;             Cost        19&#xA;             Port        55 (FastEthernet1/14)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32768&#xA;             Address     c802.2308.0000&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface                                   Designated&#xA;Name                 Port ID Prio Cost  Sts Cost  Bridge ID            Port ID&#xA;-------------------- ------- ---- ----- --- ----- -------------------- -------&#xA;FastEthernet1/14     128.55   128    19 FWD     0 32768 c801.2308.0001 128.56&#xA;FastEthernet1/15     128.56   128    19 FWD    19 32768 c802.2308.0000 128.56&#xA;&#xA;SW-C#&#xA;*Mar  1 00:09:52.311: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.0.11 (Vla                                                                             n212) is down: holding time expired&#xA;SW-C#&#xA;*Mar  1 00:09:55.903: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.0.2 (Vlan                                                                             212) is down: holding time expired&#xA;SW-C#ping 1.1.1.1&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ADDING SW RUNNING_CONFIGS&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CORE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname CORE&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 15&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 1.1.1.1 255.255.255.0&#xA;!&#xA;interface Loopback1&#xA; ip address 2.2.2.2 255.255.255.0&#xA;!&#xA;interface Loopback2&#xA; ip address 3.3.3.3 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA;!&#xA;interface FastEthernet1/1&#xA; switchport access vlan 295&#xA;!&#xA;interface FastEthernet1/2&#xA; switchport access vlan 296&#xA;!&#xA;interface FastEthernet1/3&#xA;!&#xA;interface FastEthernet1/4&#xA;!&#xA;interface FastEthernet1/5&#xA;!&#xA;interface FastEthernet1/6&#xA;!&#xA;interface FastEthernet1/7&#xA;!&#xA;interface FastEthernet1/8&#xA;!&#xA;interface FastEthernet1/9&#xA;!&#xA;interface FastEthernet1/10&#xA;!&#xA;interface FastEthernet1/11&#xA;!&#xA;interface FastEthernet1/12&#xA;!&#xA;interface FastEthernet1/13&#xA;!&#xA;interface FastEthernet1/14&#xA;!&#xA;interface FastEthernet1/15&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan295&#xA; ip address 172.16.0.1 255.255.255.0&#xA; ip summary-address eigrp 1 0.0.0.0 0.0.0.0&#xA;!&#xA;interface Vlan296&#xA; ip address 172.16.1.1 255.255.255.0&#xA; ip summary-address eigrp 1 0.0.0.0 0.0.0.0&#xA;!&#xA;router eigrp 1&#xA; network 172.16.0.0 0.0.0.255&#xA; network 172.16.1.0 0.0.0.255&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SW-A&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SW-A&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 15&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA;!&#xA;interface FastEthernet1/1&#xA; switchport access vlan 295&#xA;!&#xA;interface FastEthernet1/2&#xA;!&#xA;interface FastEthernet1/3&#xA;!&#xA;interface FastEthernet1/4&#xA;!&#xA;interface FastEthernet1/5&#xA;!&#xA;interface FastEthernet1/6&#xA;!&#xA;interface FastEthernet1/7&#xA;!&#xA;interface FastEthernet1/8&#xA;!&#xA;interface FastEthernet1/9&#xA;!&#xA;interface FastEthernet1/10&#xA;!&#xA;interface FastEthernet1/11&#xA;!&#xA;interface FastEthernet1/12&#xA;!&#xA;interface FastEthernet1/13&#xA;!&#xA;interface FastEthernet1/14&#xA; switchport access vlan 212&#xA;!&#xA;interface FastEthernet1/15&#xA; switchport access vlan 212&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan212&#xA; ip address 10.0.0.1 255.255.255.0&#xA;!&#xA;interface Vlan295&#xA; ip address 172.16.0.2 255.255.255.0&#xA;!&#xA;router eigrp 1&#xA; network 0.0.0.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SW-B&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SW-B&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 15&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA;!&#xA;interface FastEthernet1/1&#xA; switchport access vlan 296&#xA;!&#xA;interface FastEthernet1/2&#xA;!&#xA;interface FastEthernet1/3&#xA;!&#xA;interface FastEthernet1/4&#xA;!&#xA;interface FastEthernet1/5&#xA;!&#xA;interface FastEthernet1/6&#xA;!&#xA;interface FastEthernet1/7&#xA;!&#xA;interface FastEthernet1/8&#xA;!&#xA;interface FastEthernet1/9&#xA;!&#xA;interface FastEthernet1/10&#xA;!&#xA;interface FastEthernet1/11&#xA;!&#xA;interface FastEthernet1/12&#xA;!&#xA;interface FastEthernet1/13&#xA;!&#xA;interface FastEthernet1/14&#xA; switchport access vlan 212&#xA;!&#xA;interface FastEthernet1/15&#xA; switchport access vlan 212&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan212&#xA; ip address 10.0.0.2 255.255.255.0&#xA;!&#xA;interface Vlan296&#xA; ip address 172.16.1.2 255.255.255.0&#xA;!&#xA;router eigrp 1&#xA; network 0.0.0.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;mac-address-table static c809.094c.0000 interface FastEthernet1/14 vlan 1&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SW-C&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SW-C&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 15&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA;!&#xA;interface FastEthernet1/1&#xA;!&#xA;interface FastEthernet1/2&#xA;!&#xA;interface FastEthernet1/3&#xA;!&#xA;interface FastEthernet1/4&#xA;!&#xA;interface FastEthernet1/5&#xA;!&#xA;interface FastEthernet1/6&#xA;!&#xA;interface FastEthernet1/7&#xA;!&#xA;interface FastEthernet1/8&#xA;!&#xA;interface FastEthernet1/9&#xA;!&#xA;interface FastEthernet1/10&#xA;!&#xA;interface FastEthernet1/11&#xA;!&#xA;interface FastEthernet1/12&#xA;!&#xA;interface FastEthernet1/13&#xA;!&#xA;interface FastEthernet1/14&#xA; switchport access vlan 212&#xA;!&#xA;interface FastEthernet1/15&#xA; switchport access vlan 212&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan212&#xA; ip address 10.0.0.10 255.255.255.0&#xA;!&#xA;router eigrp 1&#xA; network 0.0.0.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;mac-address-table static c80a.094c.0000 interface FastEthernet1/15 vlan 212&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SW-D&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SW-D&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 15&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA;!&#xA;interface FastEthernet1/1&#xA;!&#xA;interface FastEthernet1/2&#xA;!&#xA;interface FastEthernet1/3&#xA;!&#xA;interface FastEthernet1/4&#xA;!&#xA;interface FastEthernet1/5&#xA;!&#xA;interface FastEthernet1/6&#xA;!&#xA;interface FastEthernet1/7&#xA;!&#xA;interface FastEthernet1/8&#xA;!&#xA;interface FastEthernet1/9&#xA;!&#xA;interface FastEthernet1/10&#xA;!&#xA;interface FastEthernet1/11&#xA;!&#xA;interface FastEthernet1/12&#xA;!&#xA;interface FastEthernet1/13&#xA;!&#xA;interface FastEthernet1/14&#xA; switchport access vlan 212&#xA;!&#xA;interface FastEthernet1/15&#xA; switchport access vlan 212&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan212&#xA; ip address 10.0.0.11 255.255.255.0&#xA;!&#xA;router eigrp 1&#xA; network 0.0.0.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HERE IS AN EXAMPLE OF REMOVE THE LINK BETWEEN SW C and B, and then readding the link.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-C#ping 1.1.1.1 repeat 100000&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 100000, 100-byte ICMP Echos to 1.1.1.1, timeout is 2 seconds:&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!.!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!........&#xA;*Mar  1 00:32:23.183: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.0.2 (Vlan212) is down: holding time expired................!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;*Mar  1 00:32:55.739: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 10.0.0.2 (Vlan212) is up: new adjacency!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!..........................................&#xA;.........................................................&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For some reason it never recovers....&lt;/p&gt;&#xA;" OwnerUserId="3528" LastEditorUserId="3528" LastEditDate="2014-01-31T14:38:31.403" LastActivityDate="2014-01-31T17:50:03.030" Title="Adding a secondary route non-stackable switch group" Tags="|routing|switch|vlan|spanning-tree|redundancy|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6099" PostTypeId="2" ParentId="6097" CreationDate="2014-01-30T21:03:16.180" Score="3" Body="&lt;p&gt;The first thing that jumps out at me is you say you removed the link from A to C, but fa 1/14 is still in the forwarding state.  That means the port is still up.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second thing I notice is that the root port is also 1/14, which means it's up and hearing BPDUs from sw A.  So I would guess you didn't really remove the link from A to C, but blocked traffic in some other way.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-30T21:03:16.180" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6100" PostTypeId="2" ParentId="6096" CreationDate="2014-01-30T21:07:42.417" Score="2" Body="&lt;p&gt;25 Routes can be carried by a RIP Update Packet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference : &lt;a href=&quot;http://www.cisco.com/cpress/cc/td/cpress/fund/ith2nd/it2444.htm&quot; rel=&quot;nofollow&quot;&gt;Cisco Press&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3915" LastEditorUserId="3191" LastEditDate="2014-02-03T06:08:13.253" LastActivityDate="2014-02-03T06:08:13.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6101" PostTypeId="2" ParentId="6094" CreationDate="2014-01-30T22:03:20.983" Score="1" Body="&lt;p&gt;This is fully doable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume you have an internet address lets pretend it is... 8.8.8.8, just to have something.  (I know, it is actually google's address...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can have a NAT router A which have this 8.8.8.8 address as its only external address and an inside network 10.0.0.0/8 that use NAT to reach the internet via the external 8.8.8.8 interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On that 10.0.0.0/8 network, you can have a NAT router B with an external IP address in that 10.0.0.0/8 network (say, 10.1.1.1) and an internal subnet of 192.168.1.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A client PC connected to that 192.168.1.0 subnet (e.g with IP 192.168.1.33) can communicate through both NAT routers to connect to sites on the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When creating virtual machines on a host server, one option for network connectivity for them is to let them (the virtual machines) connect to the local network (and the rest of the world) using the virtualization host server as a NAT router.  In this case, the VMs never communicate directly with the network outside of their host server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the physical server itself that hosts the VMs is located inside a NATed network which access the internet via a NAT router, then the virtual machines hosted on that server are effectively talking with the internet via two NAT routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then of course, with many clients behind multiple layers of NAT routers, you will eventually run out of ports on the internet-connected NAT router.  But that is another story.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I don't have time right now, but I got a NAT router connected to the internet and some more routers to play around with, so I should within the next week actually try this out myself, only to see it in action :-) ).&lt;/p&gt;&#xA;" OwnerUserId="3306" LastEditorUserId="3306" LastEditDate="2014-01-30T22:09:03.223" LastActivityDate="2014-01-30T22:09:03.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6104" PostTypeId="1" AcceptedAnswerId="6121" CreationDate="2014-01-31T02:39:01.267" Score="13" ViewCount="10868" Body="&lt;p&gt;What are the advantages and disadvantages of using 10GBase-T vs. SFP+ Direct Attach to interconnect devices where distance is not a determining factor?&lt;/p&gt;&#xA;" OwnerUserId="2881" LastActivityDate="2014-06-04T07:58:51.727" Title="10GBase-T vs. SFP+ Direct Attach" Tags="|cisco|ethernet|cabling|10gbase|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6105" PostTypeId="1" AcceptedAnswerId="6120" CreationDate="2014-01-31T10:58:15.207" Score="7" ViewCount="14556" Body="&lt;p&gt;I'm pretty sure I know the answer to this but I don't  know how to implement it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to setup an ipsec vpn from a Cisco 2811 to a linux box running openswan.  So far I can get phase 1 up but phase 2 is having an issue.  Its 100% a configuration issue.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm trying to do is push web and some other traffic out the vpn using the internet connection on the other end of that as its gateway to the net.  I'm getting cryptomap errors.  Here's the setup.  1.1.1.1 being the Cisco. The 2.2.2.2 address is the linux server which only has a single nic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.x.x/24 ----- 1.1.1.1 --  INTERNET 2.2.2.2 ----&gt;&gt;&gt; Internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand why it can't form the phase 2 tunnel, it can't agree on the map.   But I have no idea what the map should be in this case. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been testing it with just ICMP for now.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I excluded ICMP from NAT :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended NAT&#xA;deny   icmp 192.168.30.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the &quot;interesting traffic&quot; for the vpn is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 153 permit icmp 192.168.30.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the openswan side I'm using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;left=2.2.2.2&#xA;right=1.1.1.1&#xA;rightsubnet=192.168.30.3/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well the cisco immediately starts throwing out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2d11h: map_db_find_best did not find matching map&#xA;2d11h: IPSEC(validate_transform_proposal): no IPSEC cryptomap exists for local address 1.1.1.1&#xA;2d11h: ISAKMP:(0:26:SW:1): IPSec policy invalidated proposal&#xA;2d11h: ISAKMP:(0:26:SW:1): phase 2 SA policy not acceptable! (local 1.1.1.1 remote 2.2.2.2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know what I want it to do but I don't know how to set it up. If this were just a simple internal subnet to internal subnet vpn no problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any direction here would be really helpful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;service timestamps debug uptime&#xA;service timestamps log datetime&#xA;service password-encryption&#xA;!&#xA;hostname Hex-2811&#xA;!&#xA;boot-start-marker&#xA;boot system flash c2800nm-advsecurityk9-mz.124-24.T5.bin&#xA;boot-end-marker&#xA;!&#xA;no logging buffered&#xA;aaa new-model&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring&#xA;no ip source-route&#xA;!&#xA;!&#xA;ip cef&#xA;!&#xA;!&#xA;no ip bootp server&#xA;ip domain name hexhome.int&#xA;ip name-server 192.168.30.8&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;!&#xA;ipv6 unicast-routing&#xA;crypto isakmp policy 1&#xA;encr aes 192&#xA;authentication pre-share&#xA;group 5&#xA;lifetime 43200&#xA;crypto isakmp key ********** address 2.2.2.2&#xA;!&#xA;!&#xA;crypto ipsec transform-set IOFSET2 esp-aes 192 esp-sha-hmac &#xA;!&#xA;!&#xA;crypto map IOFVPN 1 ipsec-isakmp &#xA;description Isle Of Man&#xA;set peer 2.2.2.2&#xA;set transform-set IOFSET2 &#xA;match address 153&#xA;!&#xA;! &#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA;description Internal 192 Network&#xA;ip address 192.168.30.1 255.255.255.0&#xA;no ip proxy-arp&#xA;ip nat inside&#xA;ip virtual-reassembly&#xA;ip route-cache flow&#xA;duplex full&#xA;speed 100&#xA;!&#xA;interface FastEthernet0/1&#xA;ip address dhcp&#xA;ip access-group 112 in&#xA;no ip redirects&#xA;no ip unreachables&#xA;ip accounting access-violations&#xA;ip nbar protocol-discovery&#xA;ip nat outside&#xA;ip virtual-reassembly&#xA;no ip route-cache cef&#xA;no ip mroute-cache&#xA;duplex auto&#xA;speed auto&#xA;no cdp enable&#xA;no mop enabled&#xA;&#xA;crypto map IOFVPN&#xA;!&#xA;&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 174.59.28.1&#xA;!&#xA;ip flow-export source FastEthernet0/0&#xA;ip flow-export version 5&#xA;ip flow-export destination 192.168.30.45 3001&#xA;no ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;no ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;&#xA;ip nat inside source route-map POLICY-NAT interface FastEthernet0/1 overload&#xA;&#xA;ip access-list extended NAT&#xA;deny   icmp 192.168.30.0 0.0.0.255 any&#xA;permit ip any any&#xA;&#xA;access-list 153 permit icmp 192.168.30.0 0.0.0.255 any&#xA;&#xA;route-map POLICY-NAT permit 10&#xA;match ip address NAT&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UPDATE:  Fixed the ACL: access-list 153 permit ip 192.168.30.0 0.0.0.255 host 2.2.2.2 and the tunnel comes right up and I can ping through as expected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to get web traffic through now.. Policy routing not working.  I added &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map VPN_WEB permit 1&#xA;match ip address 155&#xA;set ip next-hop 2.2.2.2&#xA;&#xA;access-list 155 permit tcp any any eq www&#xA;&#xA;interface FastEthernet0/1&#xA;ip address dhcp&#xA;ip access-group 112 in&#xA;no ip redirects&#xA;no ip unreachables&#xA;ip accounting access-violations&#xA;ip nbar protocol-discovery&#xA;ip nat outside&#xA;ip virtual-reassembly&#xA;no ip route-cache cef&#xA;ip policy route-map VPN_WEB&#xA;no ip mroute-cache&#xA;duplex auto&#xA;speed auto&#xA;no cdp enable&#xA;no mop enabled&#xA;crypto map IOFVPN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see the route-map match on www traffic but it's not being passed through the tunnel. &lt;/p&gt;&#xA;" OwnerUserId="4122" LastEditorUserId="4122" LastEditDate="2014-01-31T15:28:50.460" LastActivityDate="2014-02-01T09:55:50.287" Title="Ipsec vpn, phase 2 unable to come up" Tags="|cisco|vpn|ipsec|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6106" PostTypeId="1" AcceptedAnswerId="6129" CreationDate="2014-01-31T13:51:40.407" Score="3" ViewCount="260" Body="&lt;p&gt;I want to design a very simple, efficient protocol layer, point-to-point, that uses a UART on a low-end 8-bit microprocessor. It has extremely limited RAM, and only the most simple arithmetic operations. The UART handles framing of bytes, and it can be assumed that this layer can rely on this fact. (error detection will be done on a higher level).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The protocol would work as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Server and client are &lt;strong&gt;indistinguishable&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Receiving and transmission are done completely &lt;strong&gt;independently&lt;/strong&gt; (so only one-way need be considered)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Connectionless and unreliable&lt;/strong&gt; (a frame/packet will be sent-and-forgotten)&lt;/li&gt;&#xA;&lt;li&gt;A frame/packet will be &lt;strong&gt;delimited with a start&lt;/strong&gt;, so requiring as little RAM as possible (in the order of a few bytes) while detecting the start of a frame.&lt;/li&gt;&#xA;&lt;li&gt;A frame/packet will be &lt;strong&gt;delimited with an end&lt;/strong&gt;, to distinguish between 1. a delay in reception of the next byte and 2. the end of the frame/packet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My first idea was as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The start of a frame consists of a byte: &lt;code&gt;00xxxxxx&lt;/code&gt; (where &lt;code&gt;x&lt;/code&gt; can be used for specifying the type of frame for the higher level)&lt;/li&gt;&#xA;&lt;li&gt;The end of a frame consists of a byte: &lt;code&gt;11xxxxxx&lt;/code&gt; (where &lt;code&gt;x&lt;/code&gt; is discarded)&lt;/li&gt;&#xA;&lt;li&gt;The frame contains any number of content bytes: &lt;code&gt;01xxxxxx&lt;/code&gt; (where &lt;code&gt;x&lt;/code&gt; is content)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This would mean the microprocessor literally doesn't need any RAM whatsoever while waiting for the start of a frame; it only has to check each byte as it's received to see if it matches &lt;code&gt;00xxxxxx&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The problem&lt;/strong&gt; with this idea is obviously it's wasteful of bandwidth: 2 of every 8 bits (plus the whole of the end-delimiting byte).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My second, flawed idea&lt;/strong&gt; was to do something similar with, say, two bytes instead of one. For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The start of a frame consists of one byte as above: &lt;code&gt;00xxxxxx&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The end of a frame would also be one byte also as above: &lt;code&gt;11xxxxxx&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The content would be in pairs of bytes: &lt;code&gt;01xxxxxx&lt;/code&gt;, &lt;code&gt;xxxxxxxx&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But this is &lt;strong&gt;flawed&lt;/strong&gt; because the second byte of a content byte-pair could be confused with either a start or an end delimiter. The UARTs could be disconnected and reconnected at any time without warning, so there needs to be a way for this layer to find the beginning of a packet through the values of bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My logic is failing - I can't see a way of improving on my first version. I've been reading up on loads of different protocols and I can't find any that I could adapt, let alone use as-is. Is my second idea fatally flawed? Or have I just not realised how a start delimiter could be distinguished from that of the second content byte, without storing too much in RAM?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas welcome, including protocols that I could adapt or adopt, or changes to the above ideas.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Response to comments&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;UDP seems very much like overkill, and is too high level. I certainly don't need addressing (ports or otherwise). I don't think the OSI model can be applied to my requirements, but I need something more at the data link layer rather than transport later (UDP). It will be (a part of a re-usable stack) for communication between a host (usually a PC) and a microprocessor (PIC, Atmel) via a virtual COM (serial) port (Using bluetooth-UART or USB-UART hardware bridges). It will by no means be a one-size-fits-all protocol, but just something which suits very limited hardware capabilities for tasks such as sending key+value pairs, or command+parameters etc, where the values/parameters will be of variable length, anywhere from 0 to over 2^16 (but could be split up). Some protocols that come close but are also overkill:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/High-Level_Data_Link_Control&quot; rel=&quot;nofollow&quot;&gt;High-Level Data Link Control&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://amp-protocol.net/&quot; rel=&quot;nofollow&quot;&gt;AMP - Asynchronous Messaging Protocol&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The greatest priority is low computational requirements and resources, followed by bandwidth efficiency. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The microprocessors will invariably either use data as it's being received, or send data as it's acquired, which is why they won't have much RAM. They might also do real-time processing so the less they need to manipulate data for transmission/reception, the better. The reason low end microprocessors are being used is because there will be a lot of them, and costs will need to be kept down.&lt;/p&gt;&#xA;" OwnerUserId="4124" LastEditorUserId="3191" LastEditDate="2014-03-03T19:48:19.000" LastActivityDate="2016-09-21T17:14:56.563" Title="Improving design of a point-to-point layer on top of a byte-oriented protocol" Tags="|design|point-to-point|" AnswerCount="2" CommentCount="3" ClosedDate="2019-02-23T22:24:40.027" ContentLicense="CC BY-SA 3.0" />
  <row Id="6107" PostTypeId="2" ParentId="6104" CreationDate="2014-01-31T14:28:28.287" Score="5" Body="&lt;p&gt;One advantage is the added flexibility of SFP+ cages. If you ever need fibre connections, all you need is change optics. With fixed 10GBase-T ports, that is what you're stuck with...&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2014-01-31T14:28:28.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6109" PostTypeId="1" AcceptedAnswerId="6140" CreationDate="2014-01-31T16:38:35.483" Score="6" ViewCount="6033" Body="&lt;p&gt;This is sort of an offshoot of my previous question &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6105/ipsec-vpn-phase-2-unable-to-come-up&quot;&gt;Ipsec vpn, phase 2 unable to come up&lt;/a&gt;.  The VPN is up and working but now I'm having an issue with getting the right traffic across it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I want to go across it is port 80 traffic.  I was looking at the Cisco doc Configuring Tunnel Default Gateway Implementations and was working off of that.  I removed the traffic from NAT, that part works.  I created a route-map to see that traffic and set a next hop of the remote vpn endpoint. I can see the route-map being hit so it's seeing the traffic.  I must be missing something though. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto isakmp policy 1&#xA; encr aes 192&#xA; authentication pre-share&#xA; group 2&#xA; lifetime 43200&#xA;crypto isakmp key ******** address 2.2.2.2&#xA;!&#xA;!&#xA;crypto ipsec transform-set IOFSET2 esp-aes 192 esp-sha-hmac &#xA;!&#xA;!&#xA;crypto map IOFVPN 1 ipsec-isakmp &#xA; description Isle Of Man&#xA; set peer 2.2.2.2&#xA; set transform-set IOFSET2 &#xA; match address 154&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; description Internal 192 Network&#xA; ip address 192.168.30.1 255.255.255.0&#xA; no ip proxy-arp&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; ip route-cache flow&#xA; duplex full&#xA; speed 100&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address dhcp&#xA; ip access-group 112 in&#xA; no ip redirects&#xA; no ip unreachables&#xA; ip accounting access-violations&#xA; ip nbar protocol-discovery&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; no ip route-cache cef&#xA; ip policy route-map VPN_WEB&#xA; no ip mroute-cache&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA; no mop enabled&#xA; crypto map IOFVPN&#xA;!&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 174.59.28.1&#xA;no ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;no ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;ip nat inside source static tcp 192.168.30.200 9443 interface FastEthernet0/1 9443&#xA;ip nat inside source static tcp 192.168.30.105 5901 interface FastEthernet0/1 5901&#xA;ip nat inside source static udp 192.168.30.25 44394 interface FastEthernet0/1 44394&#xA;ip nat inside source static udp 192.168.30.12 32400 interface FastEthernet0/1 32400&#xA;ip nat inside source static tcp 192.168.30.12 32400 interface FastEthernet0/1 32400&#xA;ip nat inside source static tcp 192.168.30.13 22 interface FastEthernet0/1 22&#xA;ip nat inside source static tcp 192.168.30.25 44394 interface FastEthernet0/1 44394&#xA;ip nat inside source static tcp 192.168.30.13 80 interface FastEthernet0/1 80&#xA;ip nat inside source route-map POLICY-NAT interface FastEthernet0/1 overload&#xA;ip nat inside source static tcp 192.168.30.20 21 interface FastEthernet0/1 21&#xA;ip nat inside source static tcp 192.168.30.60 443 interface FastEthernet0/1 443&#xA;!&#xA;ip access-list extended NAT&#xA; deny   tcp 192.168.30.0 0.0.0.255 any eq www log&#xA; deny   ip 192.168.30.0 0.0.0.255 192.168.1.0 0.0.0.255&#xA; permit ip any any&#xA;!&#xA;&#xA;access-list 112 remark Explicit accept and deny&#xA;access-list 112 deny   udp any any eq snmp&#xA;access-list 112 deny   ip host 50.17.67.227 any&#xA;access-list 112 deny   ip host 1.93.27.33 any&#xA;access-list 112 deny   tcp any any eq telnet&#xA;access-list 112 permit tcp host 37.235.50.117 any eq ftp log&#xA;access-list 112 permit tcp host 5.255.80.84 any eq ftp log&#xA;access-list 112 permit tcp host 66.228.62.226 any eq ftp log&#xA;access-list 112 permit tcp host 72.25.5.126 any eq 5901 log&#xA;access-list 112 permit tcp host 72.25.5.126 any eq 11111 log&#xA;access-list 112 permit tcp host 72.25.5.126 any eq 8000 log&#xA;access-list 112 deny   tcp any any eq ftp log&#xA;access-list 112 deny   tcp any any eq 3389 log&#xA;access-list 112 deny   tcp any any eq 5901 log&#xA;access-list 112 deny   tcp any any eq 11111&#xA;access-list 112 deny   tcp any any eq 8000&#xA;access-list 112 permit ip any any&#xA;&#xA;access-list 154 permit ip 192.168.30.0 0.0.0.255 host 2.2.2.2&#xA;access-list 155 permit tcp any any eq www&#xA;&#xA;snmp-server community public RO&#xA;no cdp run&#xA;!&#xA;route-map VPN_WEB permit 1&#xA; match ip address 155&#xA; set ip next-hop 2.2.2.2&#xA;!&#xA;route-map POLICY-NAT permit 10&#xA; match ip address NAT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In my mind the route-map sees it, changes the next hop, which should then trigger the crypto-map, but that's not happening. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:  I changed some things around to try to make this easier on myself. On the linux box I added a eth0:0 of 192.168.10.1 and turned on NAT.  I realized if I was passing traffic there something had to do the natting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read that the ip next-hop falls back to the default route when there is no specific route. So I added:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;reverse-route static&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now it shows a route of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S    192.168.10.0/24 [1/0] via 2.2.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Access lists were changed to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 154 permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255&#xA;access-list 155 permit tcp 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I changed the route map to point next hop to 192.168.10.1. Still web traffic refuses to go through. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My NAT reads like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended NAT&#xA;deny   ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255&#xA;permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SO if the route-map was actually adding in the next hop of 192.168.10.1 then it should NOT be natted and be pushed over the VPN. Not happening. It goes straight out to the internet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing here. ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: Current config.   Tunnels are up. Can ping between subnets. www traffic is still going out local gateway.  No www traffic at all if without removing the nat line for www traffic.  ( I'm saying www traffic is not passing through the vpn because the encap is staying at 0 ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;v&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ersion 12.4&#xA;service timestamps debug uptime&#xA;service timestamps log datetime&#xA;service password-encryption&#xA;!&#xA;hostname Hex-2811&#xA;!&#xA;boot-start-marker&#xA;boot system flash c2800nm-advsecurityk9-mz.124-24.T5.bin&#xA;boot-end-marker&#xA;!&#xA;no logging buffered&#xA;aaa new-model&#xA;aaa session-id common&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring&#xA;no ip source-route&#xA;!&#xA;!&#xA;ip cef&#xA;!&#xA;no ip bootp server&#xA;ip domain name hexhome.int&#xA;ip name-server 192.168.30.8&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;!&#xA;ipv6 unicast-routing&#xA;!&#xA;voice-card 0&#xA; no dspfarm&#xA;!         &#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;ip ssh version 2&#xA;! &#xA;!&#xA;crypto isakmp policy 1&#xA; encr aes 192&#xA; authentication pre-share&#xA; group 2&#xA; lifetime 43200&#xA;crypto isakmp key ******* address 2.2.2.2&#xA;!&#xA;!&#xA;crypto ipsec transform-set IOFSET2 esp-aes 192 esp-sha-hmac &#xA;!&#xA;crypto map IOFVPN 1 ipsec-isakmp &#xA; description IOM&#xA; set peer 2.2.2.2&#xA; set transform-set IOFSET2 &#xA; match address 160&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; description Internal 192 Network&#xA; ip address 192.168.30.1 255.255.255.0&#xA; no ip proxy-arp&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; ip route-cache flow&#xA; duplex full&#xA; speed 100&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address dhcp&#xA; ip access-group 112 in&#xA; no ip redirects&#xA; no ip unreachables&#xA; ip accounting access-violations&#xA; ip nbar protocol-discovery&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; no ip route-cache cef&#xA; no ip mroute-cache&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA; no mop enabled&#xA; crypto map IOFVPN&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip flow-export source FastEthernet0/0&#xA;ip flow-export version 5&#xA;ip flow-export destination 192.168.30.45 3001&#xA;!&#xA;no ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;no ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;ip nat inside source static tcp 192.168.30.60 443 interface FastEthernet0/1 443&#xA;ip nat inside source static tcp 192.168.30.20 21 interface FastEthernet0/1 21&#xA;ip nat inside source route-map POLICY-NAT interface FastEthernet0/1 overload&#xA;ip nat inside source static tcp 192.168.30.13 80 interface FastEthernet0/1 80&#xA;ip nat inside source static tcp 192.168.30.25 44394 interface FastEthernet0/1 44394&#xA;ip nat inside source static tcp 192.168.30.13 22 interface FastEthernet0/1 22&#xA;ip nat inside source static tcp 192.168.30.12 32400 interface FastEthernet0/1 32400&#xA;ip nat inside source static udp 192.168.30.12 32400 interface FastEthernet0/1 32400&#xA;ip nat inside source static udp 192.168.30.25 44394 interface FastEthernet0/1 44394&#xA;ip nat inside source static tcp 192.168.30.105 5901 interface FastEthernet0/1 5901&#xA;ip nat inside source static tcp 192.168.30.200 9443 interface FastEthernet0/1 9443&#xA;!&#xA;ip access-list extended NAT&#xA; deny   tcp 192.168.30.0 0.0.0.255 any eq www&#xA; deny   ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255&#xA; permit ip any any&#xA;!&#xA;access-list 112 remark Explicit accept and deny&#xA;access-list 112 deny   udp any any eq snmp&#xA;access-list 112 deny   ip host 50.17.67.227 any&#xA;access-list 112 deny   ip host 1.93.27.33 any&#xA;access-list 112 deny   tcp any any eq telnet&#xA;access-list 112 permit tcp host 37.235.50.117 any eq ftp log&#xA;access-list 112 permit tcp host 5.255.80.84 any eq ftp log&#xA;access-list 112 permit tcp host 66.228.62.226 any eq ftp log&#xA;access-list 112 permit tcp host 72.25.5.126 any eq 5901 log&#xA;access-list 112 permit tcp host 72.25.5.126 any eq 11111 log&#xA;access-list 112 permit tcp host 72.25.5.126 any eq 8000 log&#xA;access-list 112 deny   tcp any any eq ftp log&#xA;access-list 112 deny   tcp any any eq 3389 log&#xA;access-list 112 deny   tcp any any eq 5901 log&#xA;access-list 112 deny   tcp any any eq 11111&#xA;access-list 112 deny   tcp any any eq 8000&#xA;access-list 112 permit ip any any&#xA;access-list 153 permit tcp 192.168.30.0 0.0.0.255 any eq www&#xA;access-list 154 permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255&#xA;access-list 155 permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255&#xA;access-list 160 permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255&#xA;access-list 160 permit tcp 192.168.30.0 0.0.0.255 any eq www&#xA;access-list 160 permit tcp 192.168.30.0 0.0.0.255 any eq 443&#xA;snmp-server community public RO&#xA;no cdp run&#xA;!&#xA;route-map VPN_WEB permit 1&#xA; match ip address 153&#xA; set ip next-hop 192.168.10.1&#xA;!&#xA;route-map POLICY-NAT permit 10&#xA; match ip address NAT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4122" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-09-01T11:15:14.260" Title="Traffic from route-map to crypto-map" Tags="|cisco|routing|vpn|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="6110" PostTypeId="2" ParentId="6097" CreationDate="2014-01-31T17:50:03.030" Score="2" Body="&lt;p&gt;This is an issue with GNS3. If you try to right-click and remove the link, GNS3 still reports to each switch that the link is still there. Use &quot;shutdown&quot; command to turn off the interfaces involved in the link.&lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2014-01-31T17:50:03.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6111" PostTypeId="1" CreationDate="2014-01-31T18:15:45.200" Score="11" ViewCount="960" Body="&lt;p&gt;I am familiar with CLI on managed Ethernet switches. However, recently I came across a term 'transaction based CLI' on switches. I am not exactly sure what is that and purpose of having it in switches. Is it similar to database transactions where you can unroll the entire commands before committing them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As requested: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ruggedcom.com/products/integrated_router_and_switch/RX5000/&quot; rel=&quot;noreferrer&quot;&gt;RX5000 Data Sheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://sc1.checkpoint.com/documents/R76/CP_R76_Gaia_WebAdmin/75697.htm&quot; rel=&quot;noreferrer&quot;&gt;Checkpoint CLI transactions&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3282" LastEditorUserId="762" LastEditDate="2014-02-01T18:16:46.633" LastActivityDate="2014-02-09T01:55:10.883" Title="Transaction based CLI on Ethernet Switches" Tags="|cisco|switch|cisco-ios|management|cli|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6113" PostTypeId="1" CreationDate="2014-01-31T19:02:04.050" Score="2" ViewCount="716" Body="&lt;p&gt;I am dealing with a really weird problem.  Currently we have the following setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TransitA --&amp;gt; RouterA&#xA;TransitB --&amp;gt; RouterB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;iBGP running btw RouterA &amp;amp; RouterB as well as OSPf in Area 0.  We have setup a customer in Area 1 as an NSSA area on both RouterA &amp;amp; RouterB with identical OSPF configs like below. (I'm only including the relevant customer ospf config):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA;area 0.0.0.1 nssa default-information-originate&#xA;redistribute connected metric-type 1 subnets&#xA;redistribute statis metric-type 1 subnets&#xA;network 1.1.1.1 0.0.0.7 area 0.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, we are advertising the customer /24's over both transit providers and the problem is that over TransitA provider, we are unable to reach the customer gear.  Pings/traceroutes all stop after it hits our interface ip on RouterA while everything works perfectly fine over TransitB provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other piece of information is that from the customer servers, traceroutes, etc work fine when going out over TransitA so it seems the only problem is incoming traffic being dropped over TransitA.  The TransitA provider says that nothing is wrong on their end and we can't find anything wrong on our end either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea where the problem may be?  Is it the ospf config, bgp, etc?  If you need more info, pls let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT***&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routerA#sh ip route x.x.x.x&#xA;Routing entry for x.x.x.x/32&#xA;  Known via &quot;ospf 1&quot;, distance 110, metric 0, type extern 2, forward&#xA;metric 1&#xA;  Last update from x.x.x.x on Vlan8, 7w0d ago&#xA;  Routing Descriptor Blocks:&#xA;  * f.f.f.f, from y.y.y.y, 7w0d ago, via Vlan8&#xA;      Route metric is 0, traffic share count is 1&#xA;&#xA;routerB#sh ip route x.x.x.x&#xA;Routing entry for x.x.x.x/32&#xA;  Known via &quot;ospf 1&quot;, distance 110, metric 0, type NSSA extern 2,&#xA;forward metric 2&#xA;  Last update from f.f.f.f on Vlan9, 7w0d ago&#xA;  Routing Descriptor Blocks:&#xA;  * f.f.f.f, from z.z.z.z, 7w0d ago, via Vlan9&#xA;      Route metric is 0, traffic share count is 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT*&lt;em&gt;More info&lt;/em&gt;*&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterA#sh ip route ospf | i x.x.x.x&#xA;O E2    x.x.x.0/24 [110/0] via x.x.x.20, 1d00h, Vlan8&#xA;RouterA#traceroute x.x.x.c&#xA;&#xA;Type escape sequence to abort.&#xA;Tracing the route to x.x.x.c&#xA;&#xA;  1 hostname.here.com (x.x.x.20) 4 msec 0 msec 0 msec&#xA;  2 x.x.x.c 0 msec 0 msec 0 msec&#xA;&#xA;&#xA;RouterB#sh ip route ospf | i x.x.x.x&#xA;O N2    x.x.x.0/24 [110/0] via x.x.x.28, 1d00h, Vlan9&#xA;RouterB#traceroute x.x.x.c&#xA;&#xA;Type escape sequence to abort.&#xA;Tracing the route to x.x.x.c&#xA;&#xA;  1 hostname.here.com (x.x.x.28) 0 msec 0 msec 0 msec&#xA;  2 x.x.x.c 0 msec 0 msec 0 msec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So traceroutes work from both routers to the end user ip however from the internet outside, it times out over TransitA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT-PING&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterA#ping f.f.f.f source u.u.u.u&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to f.f.f.f, timeout is 2 seconds:&#xA;Packet sent with a source address of u.u.u.u&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;u.u.u.u is our interface ip that TransitA assigned to us which we have configured on one of the ports.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TransitA#traceroute x.x.x.c source y.y.y.y&#xA;&#xA;Type Control-c to abort&#xA;Sending DNS Query to 8.8.4.4&#xA;&#xA;Type Control-c to abort&#xA;Tracing the route to IP node www.domain.com(x.x.x.c) from 1 to 30&#xA;hops&#xA;&#xA;  1    &amp;lt;1 ms   &amp;lt;1 ms   &amp;lt;1 ms host.x.com[z.z.z.z]&#xA;  2    &amp;lt;1 ms   &amp;lt;1 ms   &amp;lt;1 ms srx.com [f.f.f.f]&#xA;  3    &amp;lt;1 ms   &amp;lt;1 ms   &amp;lt;1 ms www.domain.com [x.x.x.c]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="864" LastEditorUserId="864" LastEditDate="2014-01-31T20:28:32.040" LastActivityDate="2014-02-10T09:17:45.297" Title="Odd OSPF/BGP issue" Tags="|bgp|ospf|" AnswerCount="2" CommentCount="19" ContentLicense="CC BY-SA 3.0" />
  <row Id="6116" PostTypeId="2" ParentId="6111" CreationDate="2014-01-31T19:24:05.520" Score="1" Body="&lt;p&gt;Your assumption is correct.  In both these cases, you can rollback configuration commands to a known point if they don't work as expected.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-01-31T19:24:05.520" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6117" PostTypeId="2" ParentId="6111" CreationDate="2014-01-31T19:40:04.000" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am familiar with CLI on managed Ethernet switches. However, recently I came across a term 'transaction based CLI' on switches. I am not exactly sure what is that and purpose of having it in switches. Is it similar to database transactions where you can unroll the entire commands before committing them?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;http://www.ruggedcom.com/products/integrated_router_and_switch/RX5000/&quot; rel=&quot;nofollow&quot;&gt;RX5000&lt;/a&gt; is speaking of the ability to revert changes incrementally, like you can in a database.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;https://sc1.checkpoint.com/documents/R76/CP_R76_Gaia_WebAdmin/75697.htm&quot; rel=&quot;nofollow&quot;&gt;Checkpoint&lt;/a&gt; link you mentioned alludes to the same thing, but they specify that discrete configuration commands can be grouped together into a single &quot;commit&quot; action.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Cisco CLI transactions with config archive, and rollback&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;These capabilities are very similar to what you find elsewhere in the industry... for instance on a Cisco router, you can commit changes in reversible transactions, if you have &lt;code&gt;archive&lt;/code&gt; enabled in the Cisco's running configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#sh runn | b archive&#xA;archive&#xA; path bootflash:$h_config&#xA;!&#xA;SW1#term exec prompt time&#xA;SW1#archive config&#xA;&#xA;SW1#dir bootflash:&#xA;Directory of bootflash:/&#xA;&#xA;   21  -rw-       52770   Nov 3 2013 12:48:04 -06:00  SW1_config-Nov--3-12-48-02-CST-1&#xA;   20  -rw-       52770   Nov 3 2013 12:45:02 -06:00  SW1_config-Nov--3-12-45-00-CST-0&#xA;   22  -rw-       52762   Nov 3 2013 12:52:22 -06:00  SW1_config-Nov--3-12-52-20-CST-0&#xA;   23  -rw-       52762   Nov 3 2013 14:38:44 -06:00  SW1_config-Nov--3-14-38-41-CST-1&#xA;   26  -rw-       66622  Jan 31 2014 13:17:46 -06:00  SW1_configJan-31-13-17-42-CST-2  &amp;lt;---&#xA;&#xA;131436544 bytes total (95956992 bytes free)&#xA;SW1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There isn't a Loopback100 configured right now...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#sh runn int lo100&#xA;                  ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;SW1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Example CLI transaction configure and confirm&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Let's configure &lt;code&gt;Loopback100&lt;/code&gt; with a 10-minute rollback timer, look at our changes since the config snapshot, confirm the changes, and then roll back.  If the rollback timer expires without confirming the config, it will &lt;em&gt;automatically&lt;/em&gt; revert to our last &lt;code&gt;config archive&lt;/code&gt; (which also happens when you perform &lt;code&gt;config terminal revert&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These transactions are valuable, because if you completely hose your router's config to the point that it's unreachable, it will automatically roll back to your saved snapshot...&#xA;it also helps if you can manage the router but need to rollback to a known-good config in a hurry.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#configure terminal revert timer 10&#xA;Rollback Confirmed Change: Backing up current running config &#xA; to bootflash:SW1_configJan-31-13-20-21-CST-3&#xA;&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;SW1(config)#&#xA;SW1(config)#int loopback 100&#xA;SW1(config-if)#ip address 1.2.3.4 255.255.255.255&#xA;SW1(config-if)#end&#xA;SW1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see that &lt;em&gt;Looback100 exists&lt;/em&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#sh runn int lo100&#xA;Load for five secs: 28%/0%; one minute: 24%; five minutes: 24%&#xA;Time source is NTP, 13:21:25.243 CST Fri Jan 31 2014&#xA;&#xA;Building configuration...&#xA;&#xA;Current configuration : 65 bytes&#xA;!&#xA;interface Loopback100&#xA; ip address 1.2.3.4 255.255.255.255&#xA;end&#xA;&#xA;SW1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see the &lt;em&gt;diffs&lt;/em&gt; required to rollback to the last config archive...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#sh archive config differences bootflash:SW1_configJan-31-13-17-42-CST-2&#xA;Load for five secs: 17%/0%; one minute: 24%; five minutes: 23%&#xA;Time source is NTP, 13:25:55.832 CST Fri Jan 31 2014&#xA;!&#xA;!Contextual Config Diffs:&#xA;-interface Loopback100&#xA; -ip address 1.2.3.4 255.255.255.255&#xA;&#xA;SW1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we can confirm the commit...  this means we don't automatically rollback if the 10-minute timer expires.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#configure confirm&#xA;SW1#sh runn int loo100&#xA;Load for five secs: 25%/0%; one minute: 25%; five minutes: 24%&#xA;Time source is NTP, 13:30:17.269 CST Fri Jan 31 2014&#xA;&#xA;Building configuration...&#xA;&#xA;Current configuration : 65 bytes&#xA;!&#xA;interface Loopback100&#xA; ip address 1.2.3.4 255.255.255.255&#xA;end&#xA;&#xA;SW1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;CLI Transaction Rollback&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Suppose we find a problem after &lt;code&gt;config confirm&lt;/code&gt;.  Let's rollback to the old config we archived...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#configure replace bootflash:SW1_configJan-31-13-17-42-CST-2&#xA;This will apply all necessary additions and deletions&#xA;to replace the current running configuration with the&#xA;contents of the specified configuration file, which is&#xA;assumed to be a complete configuration, not a partial&#xA;configuration. Enter Y if you are sure you want to proceed. ? [no]: yes&#xA;Total number of passes: 1&#xA;Rollback Done&#xA;&#xA;SW1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now Loopback100 doesn't exist in the running configuration.  The configuration is exactly the way it was when we took our first snapshot.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#sh runn int lo100&#xA;                  ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;SW1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When a rollback occurs, the configuration is locked from any other config activity.  In case of a bug, or some unpredictable event it's a good idea to have &lt;code&gt;configuration mode exclusive auto expire [timeout-in-seconds]&lt;/code&gt; in your config when using this feature.  I like the max timeout value of 600 seconds... this means the maximum time the configuration can be locked is 10 minutes.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Historical note&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Originally, Juniper was the first major vendor to deploy config rollback features.  I worked for Cisco at the time, and our sales accounts were screaming for this feature in Cisco IOS.  I still remember internal edicts from significant players in the company, who said &quot;it's impossible in Cisco IOS&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, with enough persistence (and a couple of years in the middle) we have it in IOS... the point is, don't assume the first &quot;no, we can't do that&quot; really is correct.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-02-09T01:55:10.883" LastActivityDate="2014-02-09T01:55:10.883" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6120" PostTypeId="2" ParentId="6105" CreationDate="2014-02-01T09:55:50.287" Score="1" Body="&lt;p&gt;I changed the original acl of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 153 permit icmp 192.168.30.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 153 permit icmp 192.168.30.0 0.0.0.255 2.2.2.2 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As soon as that was changed the maps matched on both ends and the tunnels came up.  I've since added an eth0:0 on the openswan side with an address in the 192.168.10.0 range changing the acl to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 153 permit 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tunnel came right up, this just made some things a little easier, now if follows the standard &quot;lan-to-lan&quot; model. &lt;/p&gt;&#xA;" OwnerUserId="4122" LastActivityDate="2014-02-01T09:55:50.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6121" PostTypeId="2" ParentId="6104" CreationDate="2014-02-01T11:33:03.877" Score="12" Body="&lt;p&gt;You'll find discussion of this elsewhere - see &lt;a href=&quot;https://serverfault.com/questions/195111/why-would-i-choose-copper-over-sfp-for-10gbe&quot;&gt;'Why would I choose Copper over SFP+ for 10GbE?'&lt;/a&gt; - but broadly speaking SFP+ DA is, ignoring distance:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cheaper at the adapter side.&lt;/li&gt;&#xA;&lt;li&gt;Lower power and latency.&lt;/li&gt;&#xA;&lt;li&gt;Gives added flexibility if you need to move to fibre later.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;10GBase-T on the other hand is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cheaper at the connector side - patch leads being cheaper than SFP+ DA cables&lt;/li&gt;&#xA;&lt;li&gt;Somewhat easier to work with physically - SFP+ DA cables tend to be a bit thick, bulky and can be a pain to route through cable management in my experience, though to an extent this depends on type (passive vs. active) and manufacturer.&lt;/li&gt;&#xA;&lt;li&gt;More flexible in that the same cable plant can be used for 10/100/1000.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've been watching the field for a while, and it doesn't seem like there's consensus on the &quot;best&quot; option yet - networking, server and adapter vendors seem to be hedging their bets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what it's worth, we went with SFP+ DA in a top-of-rack configuration, largely due to the ability to mix copper/fibre on the same device. Whether this is applicable for your environment will depend on the number of ports and nature of the network you're building.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One final point: if you do some reading on this, finding objective, unbiased opinion is hard - a lot of the commentary and claims are by people with vested financial interest in encouraging one or other option. As an example, compare and contrast:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Further Reading:&lt;br&gt;&#xA;&lt;a href=&quot;http://www.eetimes.com/document.asp?doc_id=1278743&quot; rel=&quot;nofollow noreferrer&quot;&gt;Face off: 10GBase-T and SFP+ Direct Attach&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.datacenterknowledge.com/archives/2012/11/27/data-center-infrastructure-benefits-of-deploying-sfp-fiber-vs-10gbase-t/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Benefits of Deploying SFP+ Fiber vs. 10GBase-T&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4134" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2014-05-30T07:50:20.367" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6122" PostTypeId="1" AcceptedAnswerId="6127" CreationDate="2014-02-01T12:21:27.247" Score="13" ViewCount="4322" Body="&lt;p&gt;A user had issues with download speed from the Internet. The connection to the Internet is 100 Mbit/s. The user got around 7 Mbit/s downstream and around 80 Mbit/s upstream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested from my computer and it got around 70 Mbit/s downstream and 80 Mbit/s upstream. Obviously the users PC was to blame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked the switch which is a Catalyst 3560 and there it was as I expected, the port was in half duplex. The user had hard coded his PC to 100/full and the port was using auto. The speed is detected by the Fast Link Pulses (FLP) but the duplex must be assumed to be half so the port was using 100/half. With show controller I could see collisions and late collisions as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bandwidth was tested via the swedish site www.bredbandskollen.se. It uses TCP to test the latency at first. Then it opens a socket via Flash and does several HTTP GET (TCP) and measures the downstream bandwith for about 10 seconds. After that it does four HTTP posts to the server and sends traffic for 10 seconds and calculates the upstream bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that these kind of sites are not 100% accurate but usually they can at least give some kind of indication if you are close to receiving the kind of bandwidth that you should and it was an easy test to run to make sure it was the user and not the network at fault here.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why was only downstream affected and not upstream?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are these real collisions? Since cable has separate transmit and receive pairs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="105" LastEditorUserId="105" LastEditDate="2014-02-01T13:32:12.753" LastActivityDate="2016-04-14T00:00:57.777" Title="Switchport in half duplex - Download speed suffering but upload was fine" Tags="|cisco|switch|ethernet|half-duplex|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6123" PostTypeId="1" AcceptedAnswerId="6125" CreationDate="2014-02-01T12:52:32.913" Score="2" ViewCount="151" Body="&lt;p&gt;The CCNA book seems to imply only 2 levels possible under OSPF and IS-IS; I am curious as to if that was all you could do or if you could have further sublevels. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can link state routing protocols support more than a 2 level hierarchy? Can an area connected to the backbone have its own subordinate area? &lt;/p&gt;&#xA;" OwnerUserId="4136" LastEditorUserId="775" LastEditDate="2014-02-01T13:39:11.153" LastActivityDate="2014-02-01T13:52:54.593" Title="Can link state routing protocols have more than 2 levels?" Tags="|cisco|routing|ospf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6124" PostTypeId="2" ParentId="6109" CreationDate="2014-02-01T13:48:24.493" Score="0" Body="&lt;p&gt;There are a couple of things not readily clear. First of all, in the 'update' session, you're noting some changes - please post complete, current config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, policy-maps work at INPUT, not at output. In other words, on your outside interface (fa0/1) you're trying to match for incoming traffic, which doesn't make any sense - the private IPs are coming in from internal network, so you should attach the route-map to internal interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next part which isn't clear is what's the VPN for - is it only for WWW traffic, or for all traffic matched by ACL 154 that defines traffic interesting for crypto as being all IP from 192.168.30.0/24 to 192.168.10.0/24? Decide, then configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To clear this mess up, I'd setup a Tunnel0 vpn interface that will separate routing from interface configuration and work in this mode, here's example of that kind of conifg:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd8029d629_ps6635_Products_White_Paper.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd8029d629_ps6635_Products_White_Paper.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-02-01T13:48:24.493" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6125" PostTypeId="2" ParentId="6123" CreationDate="2014-02-01T13:52:54.593" Score="1" Body="&lt;p&gt;Well, both OSPF and IS-IS use two-level hierarchy and that's it (for single process) - you have backbone area (Level 2 in IS-IS, Area 0 in OSPF), and &quot;leafs&quot; - Level 1 in IS-IS and Areas !0 for OSPF. All areas connected to leafs need to somehow connect to area 0 also to avoid routing loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this design/configuration question or just theoretical question? You can have multi-level hierarchy by (for example) putting different instances on different levels of hierarchy and do redistribution between them.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-02-01T13:52:54.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6126" PostTypeId="2" ParentId="6122" CreationDate="2014-02-01T14:26:45.077" Score="3" Body="&lt;p&gt;If the TCP was tested, there are a lot of things you can't control or even to imagine. The difference in downstream/upstream could be easily caused by NIC internal priority settings, buffers for RX/TX and essentially low-level settings that dictate how to handle RX and TX traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;'sh controllers' should report any simultaneous RX and TX condition as collision if working in half-duplex mode.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-02-01T14:26:45.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6127" PostTypeId="2" ParentId="6122" CreationDate="2014-02-01T16:25:28.520" Score="14" Body="&lt;p&gt;This is entirely normal behaviour with a duplex mismatch.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why was only downstream affected and not upstream?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since the computer is operating in full duplex mode, it isn't utilizing CSMA-CD.  This means it doesn't check if the medium is idle before it transmits, nor will it perceive any data it receives while transmitting as a collision.  As such, the upload from the computer would remain largely unaffected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conversely, the switch is utilizing CSMA-CD and will wait for the medium to be idle before it transmits.  In addition, when the switch detects a collision, it immediately stops transmitting the frame and follows the CSMA-CD collision detect procedure.  This has a significant performance impact on the traffic sent to the computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the traffic is TCP, the negative effect will be multiplied as any lost TCP ACK's going to the computer will cause a TCP retransmission.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are these real collisions? Since cable has separate transmit and receive pairs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, they are real collisions; even in a full half duplex environment (i.e. hubs) there are separate transmit and receive pairs.  The reason is that in a half duplex environment the hubs will repeat the signal received on one port out all other ports.  If two stations were to try to transmit at the same time, the signal that gets repeated will not be usable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the switch is operating in half duplex mode, it operates like it is in such an environment and can only transmit or receive at any given time.  Any time the switch is sending a frame and detects other traffic on the medium (i.e. the computer, which isn't checking for an idle medium), this is treated as a collision and the switch will follow the collision detection procedure (which includes a wait or back off period of time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the computer is not operating this way (i.e. it starts transmitting automatically when there is data to send), you end up with many more collisions than you would get in a environment that was entirely made up of half duplex devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; I did come across a reference to these this weekend while searching an unrelated matter where they were referred to as &lt;em&gt;false collisions&lt;/em&gt;.  I would disagree with this viewpoint since the switch clearly sees them as a collision and handles them as such.  Rather, I would think of them as &lt;em&gt;unnecessary collisions&lt;/em&gt; in that they should not exist in a switched network.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As an aside, this is the most often reported type of duplex mismatch (where the switch is set to auto and the computer to full duplex).  Most people download much more than they upload, they tend to notice this condition more easily to report it.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-02-10T19:49:21.773" LastActivityDate="2014-02-10T19:49:21.773" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6129" PostTypeId="2" ParentId="6106" CreationDate="2014-02-01T18:24:43.320" Score="2" Body="&lt;h2&gt;Idea 1: ASCII&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://stackoverflow.com/questions/39622105/ascii-control-characters-soh-dle-stx-etx-how-to-escape-binary-data-over-a-u&quot;&gt;this question on SE for using ASCII control characters&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Idea 2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;That article on HLDC gave me this simple idea which uses one byte for start delimiting, one for end delimiting, and one for escaping data within the packet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Start byte: &lt;code&gt;0x00&lt;/code&gt; (8-bit hex notation)&lt;/li&gt;&#xA;&lt;li&gt;Escape byte: &lt;code&gt;0x01&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;End byte: &lt;code&gt;0x02&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So a packet will always start with &lt;code&gt;0x00&lt;/code&gt; and end with &lt;code&gt;0x02&lt;/code&gt;. Bytes within that will only be escaped if they match &lt;code&gt;0x00&lt;/code&gt;, &lt;code&gt;0x02&lt;/code&gt; or &lt;code&gt;0x03&lt;/code&gt;. Escaping is done by preceding that byte with &lt;code&gt;0x01&lt;/code&gt;. For randomly distributed values of data, this means the protocol's overhead in bytes, per frame, is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1 + 3n/256 + 1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where n is the number of data bytes. (This is more attractive than the first example in my question which had waste of 1/4 + n/4 + 1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If processed in the same way as the first idea in my question, the amount of RAM bytes required would be just 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also considered doing something similar but with two bytes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start: &lt;code&gt;0x0000&lt;/code&gt;&#xA;Escape: &lt;code&gt;0x0101&lt;/code&gt;&#xA;End: &lt;code&gt;0x0202&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RAM required would be 3 bytes, and the protocol overhead would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2 + 6n/2^16 + 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One last idea was to deal with sequences of nibbles (4 bits) but it was barely more bandwidth-efficient than the first example in my question, and quite a bit higher in computations, so not worth mentioning.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So between those two options I now have a lot of versatility (I will be choosing the one-byte version if anyone cares!). I've ordered some books on Data-Link layers so will add any further ideas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd still appreciate any other ideas anyone comes up with&lt;/p&gt;&#xA;" OwnerUserId="4124" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2016-09-21T17:14:56.563" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6130" PostTypeId="1" CreationDate="2014-02-01T22:15:54.837" Score="5" ViewCount="8930" Body="&lt;p&gt;I am playing around with pfsense and have an issue with it connecting properly to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has the 1 WAN port by default but I also want to run 2 other networks 192.168.3.0 and 192.168.4.0 on 2 seperate network nics. (server has 3 total).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does my default WAN port need to connect to a WAN port? I assume routers in order to connect to each other requires a WAN to WAN connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I was to achieve is this:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/8gKNr.png&quot; alt=&quot;enter image description here&quot;&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to do is have all 3 networks connected to each other.&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="2349" LastEditDate="2014-02-03T22:21:31.713" LastActivityDate="2014-07-06T19:40:02.327" Title="Pfsense and two networks" Tags="|wan|pfsense|lan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6132" PostTypeId="2" ParentId="6130" CreationDate="2014-02-02T11:27:57.603" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does my default WAN port need to connect to a WAN port?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, you don’t need to.  WAN, in this sense, is just blocking inbound requests by default. I’ll assume the reason you’re using pfSense is to perform routing functions between those 2 networks (?).  If you aren’t using it for any real firewall functions, then you would be alright to, technically, just use multiple LAN interfaces.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I assume routers in order to connect to each other requires a WAN to WAN connection?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I’m not entirely sure what you mean.  If you are talking about needing to connect pfSense to your ISP connection, then no.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember one persons WAN is anthers LAN.  In this sense, your Cisco Firewall’s WAN is the ISP, and it’s LAN is everything behind it.  Your pfSense’s WAN is the Cisco Firewall, and it’s LAN is all networks residing behind it.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-02T11:27:57.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6136" PostTypeId="1" AcceptedAnswerId="6137" CreationDate="2014-02-02T22:36:53.323" Score="8" ViewCount="6794" Body="&lt;p&gt;I've just lodged a request with upstream to clarify some specifics of their recommended BGP configuration. Currently, I will be dual-homing with my upstream via PI addresses. Advertising via BGP with my own AS, and have requested they pass me a default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Their recommended configuration is to have two cross-connects, one from each of my primary/secondary router, connecting to their primary/secondary router, respectively. My primary would their peer with their primary, and my secondary with theirs. This is all fine (aside from the potential no-connectivity scenario if my primary is down, and their secondary is down).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my confusion is this: &lt;strong&gt;My provider is suggesting that by taking only a default, I am going to have an active/standy configuration, and that I need a full set of routes for active/active.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding was that if I'm only homed via a single ISP, then a full-feed becomes effectively pointless, since all traffic is going the same path either way. What am I missing that would cause this to be an active/standy configuration? Surely the secondary router, if traffic hits it, is going to prefer to send out it's local default gateway, as opposed to first sending traffic to the primary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking it from another perspective, I can't see how full routes is going to change the behavior (ignoring possible traffic engineering scenarios), since both routers would have the same set of routes from upstream.&lt;/p&gt;&#xA;" OwnerUserId="846" LastEditorUserId="846" LastEditDate="2014-02-02T22:45:15.923" LastActivityDate="2014-02-04T01:15:10.493" Title="Active / Active BGP with Default routes" Tags="|bgp|dual-homed|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6137" PostTypeId="2" ParentId="6136" CreationDate="2014-02-02T22:56:20.327" Score="4" Body="&lt;p&gt;Absent any non-standard configuration, it is how you say. For outbound traffic, which uplink is used depends on which router the traffic hits. For inbound traffic, it should work the same way but that depends largely on your upstream's configuration. Full routes are really only required if you intend to peer with another upstream.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2014-02-02T22:56:20.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6140" PostTypeId="2" ParentId="6109" CreationDate="2014-02-03T10:25:53.257" Score="5" Body="&lt;p&gt;I have to give credit to @ron for this answer.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The policy map was never going to work the way it was previously. @ron suggested a gre tunnel, then protect that with ipsec. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel0&#xA;ip address 10.10.10.2 255.255.255.252&#xA;ip mtu 1420&#xA;tunnel source 1.1.1.1&#xA;tunnel destination 2.2.2.2&#xA;crypto map IOFVPN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and a route to point to the internal subnet on the remote side with a gateway of the remote side. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S    192.168.10.0/24 [1/0] via 10.10.10.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've never used gre before but I will now. Getting the tunnel up was pretty basic both on the cisco and linux ( openswan ) side.  Once that was up and running I tested without ipsec. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On my fa0/0 interface, my internal I put:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip policy route-map PROXY-REDIRECT&#xA;&#xA;route-map proxy-redirect permit 100&#xA; match ip address PROXY-REDIRECT&#xA; set ip next-hop recursive 192.168.10.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The matching ACL is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended proxy-redirect&#xA; deny   tcp host 192.168.30.13 any eq www&#xA; permit tcp 192.168.30.0 0.0.0.255 any eq www&#xA; permit tcp 192.168.30.0 0.0.0.255 any eq 443&#xA; permit tcp 192.168.30.0 0.0.0.255 any eq irc&#xA; permit tcp 192.168.30.0 0.0.0.255 any eq 6667&#xA; deny   tcp 192.168.30.0 0.0.0.255 any eq 5938&#xA; deny   tcp any any&#xA; deny   udp any any&#xA; deny   ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As soon as I added that my traffic started passing the way I wanted it.  I'll note here that this ACL could be shrunk.  I added the implicit deny's because I was having the odd traffic pass over the link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once was verified working then I just needed to wrap it in ipsec.  Configuring the Cisco side was easy. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto isakmp policy 1&#xA; encr aes 192&#xA; authentication pre-share&#xA; group 2&#xA; lifetime 43200&#xA;crypto isakmp key *********** address 2.2.2.2&#xA;!&#xA;!&#xA;crypto ipsec transform-set IOFSET2 esp-aes 192 esp-sha-hmac &#xA; mode transport&#xA;!&#xA;crypto map IOFVPN 1 ipsec-isakmp &#xA; description IOM&#xA; set peer 2.2.2.2&#xA; set transform-set IOFSET2 &#xA; match address IPSEC-GRE-IOF&#xA;&#xA;ip access-list extended IPSEC-GRE-IOF&#xA; permit gre host 1.1.1.1 host 2.2.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;** Must use transport mode. It took me a bit to figure that one out.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apply that crypto map to both f0/1 and tun0 and you have a tunnel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The openswan side is what gave me trouble though this whole thing.  Their config is a bit odd and it just took some getting used to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end of the day all traffic that I want is peeled off and routed through an ipsec protected gre tunnel to a remote endpoint. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enjoy. &lt;/p&gt;&#xA;" OwnerUserId="4122" LastActivityDate="2014-02-03T10:25:53.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6143" PostTypeId="1" AcceptedAnswerId="6149" CreationDate="2014-02-03T20:19:32.123" Score="5" ViewCount="161" Body="&lt;p&gt;I have a workstation in a branch office, there is a WAP about 10 feet overhead and down one row he should be connecting to.  Unfortunately, his workstation is repeatedly connecting to another WAP in another wing of the building.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does one do in this situation to ensure his workstation is joining the most optimal WAP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Equipment involved are Cisco AIR-1142's functioning autonomously w/ no WLC.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2014-02-03T21:48:06.287" Title="Forcing a workstation to use nearest WAP?" Tags="|cisco|wireless|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6144" PostTypeId="1" AcceptedAnswerId="6146" CreationDate="2014-02-03T20:32:56.850" Score="4" ViewCount="1141" Body="&lt;p&gt;I've seen this done before, but not sure how.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking for a way to have a centralized database of authorized MAC addresses and each switch to take the port-security status from this central database.  basically we want to put all allowed MAC addresses in a DB and then have each switch lookup the connected hardware before placing in the CAM table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does Cisco even call that technology?&lt;/p&gt;&#xA;" OwnerUserId="142" LastActivityDate="2014-02-03T20:48:14.430" Title="Centralized MAC address database for Cisco switches" Tags="|cisco|switch|security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6145" PostTypeId="2" ParentId="6143" CreationDate="2014-02-03T20:47:41.840" Score="3" Body="&lt;p&gt;Assuming the SSIDs are the same and there are no authentication issues, it is up to the client to decide which WAP to associate with. You might see if there's an updated driver for your workstation.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-03T20:47:41.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6146" PostTypeId="2" ParentId="6144" CreationDate="2014-02-03T20:48:14.430" Score="4" Body="&lt;p&gt;I'm pretty sure you're thinking of &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst3550/software/release/12.2_25_see/configuration/guide/sw8021x.html&quot; rel=&quot;nofollow&quot;&gt;802.1x&lt;/a&gt;. You can use that to permit hosts based on MAC addresses.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This isn't the most secure way to authenticate hosts since &lt;a href=&quot;http://www.techrepublic.com/blog/it-security/how-to-spoof-a-mac-address/&quot; rel=&quot;nofollow&quot;&gt;spoofing a MAC address&lt;/a&gt; is fairly trivial and can be achieved with a single command, in most cases.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-03T20:48:14.430" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6148" PostTypeId="2" ParentId="6136" CreationDate="2014-02-03T21:39:44.747" Score="5" Body="&lt;p&gt;With only a single prefix (0.0.0.0/0) received on your end, you cannot distinguish between their uplink.  Maybe what you requested (dual homing) implies for them to have redundancy (POP/Link/Upstream router) and that with a default route you pay for something you don't use???&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As one of their router could have a better AS-Path to some prefix, you &lt;em&gt;could&lt;/em&gt; have seen one link with better routes than the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your provider has two different path to their routers in your site (ie: they're connected to different network location in their own network) and that you only want a default route, you will not see any difference between one link or another as you would if receiving their whole prefix table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full Route is useful if you plan to fiddle with attributes to do some decision yourself (LocalPref for outgoing traffic, AS-Path Prepend to attract incomming traffic and other fun BGP stuff)&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-02-03T21:39:44.747" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6149" PostTypeId="2" ParentId="6143" CreationDate="2014-02-03T21:48:06.287" Score="3" Body="&lt;p&gt;Typically, you enter the WAP &lt;em&gt;Radio MAC&lt;/em&gt; (not the LAN/Wired MAC) in the client's configuration (if available, the option depends on the drivers)&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-02-03T21:48:06.287" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6150" PostTypeId="2" ParentId="6136" CreationDate="2014-02-04T01:15:10.493" Score="0" Body="&lt;p&gt;If you take the default routes inject them into your IGP and you have a L3 switch between your firewalls and your ISP routers then you will CEF load balance (src-dest-port). If you don't have an L3 switch then running GLBP if your routers are on the same subnet with your firewalls will distribute your outbound traffic. If you cant do that (or only have 1 firewall) then you have to content yourself that most of the time, inbound traffic is heaver than outbound traffic. Now as to inbound since it seems you said you have a single provider it is likely that they will use only 1 link for inbound because at some point BGP only passes 1 path (bestpath). Taking in the full routing table can help you with outbound as you will take the best path out BUT, since its the same ISP, I don't think you will see a lot of difference in the routes each side sends you. &lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2014-02-04T01:15:10.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6154" PostTypeId="1" AcceptedAnswerId="6156" CreationDate="2014-02-04T16:21:59.483" Score="4" ViewCount="2075" Body="&lt;p&gt;I am configuring IPv6 between a Juniper MX80 and Cisco 7206VXR which already happily run IPv4 over ISIS and iBGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISIS is carrying IPv6 routes between the two devices but I have what I believe is a problem. If we imagine a network like the following;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A 3rd Router -- MX80 -- 7206&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ISIS is of course only carrying loop back addresses and core interface addresses, the rest is in iBGP. Now on my 7206 I look at the route to the loopback interface of a random 3rd router attached to the other side of the MX80;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7206#show ipv6 route 2a01:xxx::yyy:yyy:yyy:133&#xA;Routing entry for 2A01:xxx::yyy:yyy:yyy:133/128&#xA;  Known via &quot;isis&quot;, distance 115, metric 10, type level-2&#xA;  Route count is 1/1, share count 0&#xA;  Routing paths:&#xA;    FE80::5E5E:AB00:300:D1C0, GigabitEthernet0/2&#xA;      Last updated 3w1d ago&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My problem here is that it lists the next hop as the link-local address and not the configured public routable address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a native behavior of ISIS here or have I missed a configuration command somewhere? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7206#show run int gi0/2&#xA;Building configuration...&#xA;&#xA;Current configuration : 336 bytes&#xA;!&#xA;interface GigabitEthernet0/2&#xA; mtu 1540&#xA; ip address xxxx&#xA; ip router isis &#xA; media-type rj45&#xA; speed auto&#xA; duplex auto&#xA; negotiation auto&#xA; ipv6 address 2A01:xxx:xxx:xxx:yyy:yyy:yyy:yyy/64&#xA; ipv6 nd ra suppress&#xA; ipv6 router isis &#xA; mpls ip&#xA; isis metric 10&#xA; isis ipv6 metric 10&#xA;end&#xA;&#xA;mx80# show interfaces ae0.3 &#xA;description &quot;xxxx&quot;;&#xA;vlan-id 3;&#xA;family inet {&#xA;    address x.x.x.x/30;&#xA;}&#xA;family iso;&#xA;family inet6 {&#xA;    address 2A01:xxx:xxx:xxx:yyy:yyy:yyy:yyy/64;&#xA;}&#xA;family mpls;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looking on the 7206 ISIS sees the MX80 as that Link-Local address for it's IPv6 address, which ties in with the above output, but why? ;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7206#show isis neighbors detail &#xA;&#xA;System Id      Type Interface   IP Address      State Holdtime Circuit Id&#xA;mx80           L2   Gi0/2       89.21.224.1     UP    7        mx80.03     &#xA;  Area Address(es): 49.1234.5678&#xA;  SNPA: 5c5e.ab00.d1c0      &#xA;  IPv6 Address(es): FE80::5E5E:AB00:300:D1C0&#xA;  State Changed: 3w1d&#xA;  LAN Priority: 64&#xA;  Format: Phase V&#xA;  Remote TID: 0, 2&#xA;  Local TID:  0, 2&#xA;  Interface name: GigabitEthernet0/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="253" LastActivityDate="2014-02-04T17:22:14.567" Title="Cisco &amp; Juniper: IPv6 link-local addresses used between ISIS neighbours" Tags="|ipv6|is-is|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6155" PostTypeId="1" AcceptedAnswerId="6191" CreationDate="2014-02-04T16:51:33.453" Score="3" ViewCount="146" Body="&lt;p&gt;Transceivers for various 10-gigabit PON technologies (10GEPON, 10GPON, XGPON) have begun to hit the market, but OLT modules have so far only been available in the XFP form factor. Does the smaller power budget available in SFP+ prevent 10 gigabit PON OLT modules from making their way eventually to the smaller form factor?&lt;/p&gt;&#xA;" OwnerUserId="2063" LastEditorUserId="2063" LastEditDate="2014-02-04T17:18:03.333" LastActivityDate="2014-05-23T08:18:19.717" Title="Does SFP+ supply too little power for 10 gigabit PON?" Tags="|sfp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6156" PostTypeId="2" ParentId="6154" CreationDate="2014-02-04T17:22:14.567" Score="4" Body="&lt;p&gt;Most IPv6 routing protocols use the link-local address of the next hop. Remember that the only purpose of the next hop address is to determine the MAC address of that next hop (on ethernet at least. Other media use similar mechanisms). Except for this lookup the address itself is never used. So it doesn't matter that you only see the link-local address. It is enough for routing purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And that also means that if you want you can build your whole core network using only link-locals and loopbacks. Mught be a bit harder to debug though :)&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-02-04T17:22:14.567" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6158" PostTypeId="1" AcceptedAnswerId="6161" CreationDate="2014-02-04T20:15:47.107" Score="5" ViewCount="5009" Body="&lt;p&gt;I'm not sure this can be done, but figure I'd ask the Gurus here ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a 2511 router acting as a terminal server for my lab. All the current equipment I have connected to it have serial port baud rates of 9600bps, but now I have a new piece of equipment that has its serial port baud rate set to 115200. For various reasons, i don't want to change this piece of equipment. Is there any way to set the one reverse telnet connection to run at 115200?&lt;/p&gt;&#xA;" OwnerUserId="85" LastActivityDate="2014-02-04T23:07:26.220" Title="Cisco 2511 term svr - change baud rate on one reverse telnet connection?" Tags="|cisco|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6161" PostTypeId="2" ParentId="6158" CreationDate="2014-02-04T22:00:06.663" Score="6" Body="&lt;p&gt;Based on my testing, you would just have to edit the existing &lt;code&gt;line&lt;/code&gt; configuration to specify the speed you want on Line 8, for example if that is where you connected your new device.  &lt;em&gt;I tested this on a Cisco 2611 with the NM-16A async module.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Existing configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line 1 16&#xA; no exec&#xA; exec-timeout 0 0&#xA; password 7 xxxxxxxxxxxxxxxxx&#xA; login&#xA; transport input all&#xA; stopbits 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configuration for device on Line 8 to connect at 115200 bps instead of the default 9600 bps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line 1 7&#xA; no exec&#xA; exec-timeout 0 0&#xA; password 7 xxxxxxxxxxxxxxxxx&#xA; login&#xA; transport input all&#xA; stopbits 1&#xA;line 8&#xA; no exec&#xA; exec-timeout 0 0&#xA; password 7 xxxxxxxxxxxxxxxxx&#xA; login&#xA; transport input all&#xA; speed 115200&#xA; stopbits 1&#xA;line 9 16&#xA; no exec&#xA; exec-timeout 0 0&#xA; password 7 xxxxxxxxxxxxxxxxx&#xA; login&#xA; transport input all&#xA; stopbits 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2014-02-04T23:07:26.220" LastActivityDate="2014-02-04T23:07:26.220" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6162" PostTypeId="1" AcceptedAnswerId="6164" CreationDate="2014-02-04T23:39:49.657" Score="3" ViewCount="3168" Body="&lt;p&gt;Let's say I have an office where each RJ45 jack needs to support 4 computers. Each of those RJ45 jacks is connected to one port on a 24 port managed switch in the networking closet. However, we also need to use 5 port switches between the wall jack and the 4 computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which of the following options is the best way to implement 802.1x?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Option A) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Buy a 24 port managed switch with 802.1x support. Find some managed 5 port switches, where they can both authenticate to the parent switch, as well as authenticating their own ports with clients. I don't know if this kind of 802.1x daisy-chaining is possible, so please let me know. But this way, no-one could plug in a hub between the wall jack and the 5 port switch to get unauthenticated access to the network.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Option B)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Buy a managed, 48 port switch, and lock it in the networking closet. Re-wire the office so that we have groups of 4 wall jacks instead of 1, and remove the intermediate 5 port switches. This way, each port will be authenticated with 802.1x, and someone would have to break into the networking closet to gain access to the internal network.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Option C)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Keep the 24 port unmanaged switch that we're currently using in the network closet, but buy managed 5 port switches that support 802.1x. Remove the wall jacks and plug the cables directly into the managed switches, plug each of the computers into the switches, and then lock the switches inside tamper-proof boxes. This way, no-one can easily gain access to the unauthenticated ethernet connection, at least without cutting into network cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In each of these cases we will have ARP spoofing protection, and will shut down the port if it detects suspicious activity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know which option you think is best, or if you can think of an even better solution. We've just rolled out 802.1x for wifi, but our current network topology makes wired 802.1x quite difficult to implement.&lt;/p&gt;&#xA;" OwnerUserId="4178" LastEditorUserId="3191" LastEditDate="2014-12-08T20:23:38.577" LastActivityDate="2017-05-14T00:45:38.850" Title="How can I implement 802.1x when I need to use intermediate switches?" Tags="|security|design|authentication|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6163" PostTypeId="1" CreationDate="2014-02-05T01:35:51.197" Score="3" ViewCount="1202" Body="&lt;p&gt;Is it possible to get a traffic from a multicast address with specific destination port using IGMP? For example, I have some multicast flows like 239.192.7.1:5000, 239.192.7.1:5001 to 239.192.7.1:5009. Is there any way that I can request only the traffic from a specific port -  for example only from 239.192.7.1:5000 ?&lt;/p&gt;&#xA;" OwnerUserId="4179" LastActivityDate="2014-02-05T11:37:03.427" Title="Can we do destination port filtering in IGMP V2 or V3?" Tags="|router|multicast|igmp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6164" PostTypeId="2" ParentId="6162" CreationDate="2014-02-05T03:12:34.430" Score="2" Body="&lt;p&gt;I don't know of any switches that are 802.1x supplicants, so Option A is probably out.  So between Options B and C, the primary difference is cost. I imagine rewiring your office is both expensive and disruptive, vs the cost and the hassle of managing all those new switches.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real question you should be asking is, what threat am I defending against, and what is the real risk?  Are you really worried that someone might sneak into your building (I have no idea what kind of office you're in or where it is) and plug in an unknown device? Why would they do that? The question should not be &quot;is it possible,&quot; but &quot;is it a significant risk worth the cost of rewiring or buying new switches?&quot;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, in the office I'm currently working (a quasi-government agency), we do not have 802.1x.  In theory, anyone can plug a device into the network.  But in order to do so, you first have to get by the guards at the entrance, and you would need a badge with a card key.  If you are an employee, you would know that there is a policy prohibiting unauthorized devices on the network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly, if you really, really wanted to, you could bypass all these controls.  But management has decided that these controls are sufficient, given the risk to the network.  Frankly, if you really wanted something on our network, it would be easier to pwn a machine and steal it remotely.  That way, you could take your time and avoid the risk of detection and arrest.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My point is: just because you have a shiny new 802.1x system for wifi, it doesn't mean you need it for your wired network.  Or if you do decide to use it, tamper-proof boxes, etc, may not be necessary.  You (and management) need to weigh the risk against the cost of new switches, wiring, maintenance and reliability (what happens if your RADIUS server crashes?  Does that block all network access?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe you work in a high-security environment where all these controls are necessary.  But I'm guessing you have a solution looking for a problem.  Best to weigh the risk vs cost.  That analysis will allow you to justify the costs (monetary and operational) to management. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-05T03:12:34.430" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6166" PostTypeId="2" ParentId="6113" CreationDate="2014-02-05T06:26:35.153" Score="1" Body="&lt;p&gt;This could be TransitA is not advertising the customer prefix to the internet. Check looking glass of other major transit provider (not TransitA or B), after removing advertisement to the TransitB, and wait up to a hour. The /24 prefix should show in the looking glass. if not, TransitA is problem. &lt;/p&gt;&#xA;" OwnerUserId="3941" LastActivityDate="2014-02-05T06:26:35.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6167" PostTypeId="2" ParentId="6163" CreationDate="2014-02-05T11:29:22.070" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to get a traffic from a multicast address with specific destination port using IGMP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Short Answer:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You have three decent choices:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ask some senders / listeners to change their group&lt;/li&gt;&#xA;&lt;li&gt;Deploy IGMPv3 with PIM-SSM&lt;/li&gt;&#xA;&lt;li&gt;Deny certain UDP ports with an extended ACL (example: the Catalyst 4500 calls this a &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/31sga/configuration/guide/secure.html#wp1109665&quot; rel=&quot;nofollow&quot;&gt;Port ACL&lt;/a&gt;... since it requires manual intervention for each host, this is not very scalable, and switch port ACLs are only supported on certain switching platforms)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Details:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Strictly speaking, no an IGMPv2 or IGMPv3 listener cannot specify a port to listen for.  Let's assume you have the following situation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source at 172.16.1.50 sends to 239.192.7.1:5000&lt;/li&gt;&#xA;&lt;li&gt;Source at 172.16.1.51 sends to 239.192.7.1:5001&lt;/li&gt;&#xA;&lt;li&gt;Source at 172.16.1.59 sends to 239.192.7.1:5009&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/ip/configuration/guide/1cfssm.html#wp1000922&quot; rel=&quot;nofollow&quot; title=&quot;Use IGMPv3 with PIM-SSM to exclude an unwanted source&quot;&gt;PIM SSM / IGMPv3&lt;/a&gt; include the ability to EXCLUDE certain source IP addresses.  This means an IGMPv3 listener can exclude one or more of the source IPs; for instance, a IGMPv3 listener can exclude listening for 172.16.1.59.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speaking practically, this is a design problem.  When someone allocated 239.192.7.1 for multicast (presumably using IGMPv2 and PIM-SPARSE or PIM-DENSE) in your network, they should not have given that same group address to multiple applications.   The simplest way around this problem is to change the group for one application and continue using IGMPv2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have someone coordinating multicast addresses, then consider this a good reason to start doing so.  There are ways to control who sends what multicast between subnets (&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/ipmulti/command/reference/1rfmult2.html#wp1019380&quot; rel=&quot;nofollow&quot; title=&quot;Use ip pim accept-rp ACL to filter what joins are accepted for any address&quot;&gt;at least in Cisco IOS&lt;/a&gt;).  As organizations expand their use of multicast, controlling who sends what is pretty important.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-02-05T11:37:03.427" LastActivityDate="2014-02-05T11:37:03.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6169" PostTypeId="1" AcceptedAnswerId="6173" CreationDate="2014-02-05T15:30:19.433" Score="3" ViewCount="2016" Body="&lt;p&gt;We're experiencing complaints about drops and spotty performance that improves as users go home and it got me thinking since these are lower end AP's that it could be the number of people connected to them.  This week we have training customers in , so our average of ~20 people connected on all WAP's has moved up to about ~60 per WAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The environment contains 6 Autonomous WAP's (Cisco 1142's), 3 on each end of the building, with enough overlap to allow seamless roaming between all 6.  We have two SSID's an internal and an external / public facing one.  The training customers are using the public SSID, the users complaining about performance are on the internal one.  The common line here is that the bulk of the training traffic is on 'WAP-5', and the internal users complaining, their stations associate with 'WAP-5'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is:&#xA;What can I do, to assess a situation like this to determine if the issue at hand is saturation on the WAP and not other external factors like interference / configuration issues / client side issues.  I want to clear this off of my list before I dig further into other issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDITED: Reworded question, gave more detail per YLearn's comment.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2014-02-05T16:53:35.313" LastActivityDate="2014-02-05T20:38:51.757" Title="How to assess practical limit of connections on a WAP (Cisco 1142)?" Tags="|cisco|wireless|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6170" PostTypeId="2" ParentId="6169" CreationDate="2014-02-05T16:51:07.867" Score="2" Body="&lt;p&gt;You can take a look at the CVDs for Mobility:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/netsol/ns820/networking_solutions_program_home.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/netsol/ns820/networking_solutions_program_home.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wouldn't put 200 people on one AP. Try to keep the number low (~30 maximum), and in general with different use charateristics of various WLAN clients, you should get good performance.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-02-05T16:51:07.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6171" PostTypeId="1" CreationDate="2014-02-05T17:42:25.167" Score="5" ViewCount="7568" Body="&lt;p&gt;I have a Force10 S25 switch in each of my two buildings.  One building uses VLAN 200 to work with 10.2.0.0 /16 traffic, the other building uses VLAN 400 for 10.4.0.0 /16 traffic.  Our wireless guest network in the VLAN 200 building is segmented off onto VLAN 20 on the network 172.16.20.0 /23. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to add this VLAN to the Force10 switches in order to allow VLAN 20 to pass guest network traffic from the VLAN 400 building as well, since our ISP connection is located in the VLAN 200 building.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been given a lot of conflicting information between tagged and untagged functions of the VLANs.  Force10 told me to set all ports that are NOT trunk ports to untagged, and trunk ports to tagged.  ProCurves, however, are the opposite, as well as Netgear switches.  Having the ports set as untagged for the host connections and tagged for the trunk ports works, but should I switch that setup? Or is Force10 just backwards?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as the Guest VLAN goes, if I go to tag the host ports necessary, I get a &quot;Tagged flag mis-matched gig 0/23&quot; message.  If I try to untag the ports, it tells me it is already untagged on another VLAN, which makes sense. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also read that the port needs to be in hybrid mode in order to tag multiple VLANs on it.  If I try to put a host port in hybrid mode, it says it can't because it is a layer 2 port.  If I try to put a trunk port in hybrid mode, it says it can't because it is a layer 3 port. That leaves no port mode available to enter hybrid mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is my current setup truly backwards?  And if so, is it causing the issues with trying to tag multiple VLANs on a port and preventing me from entering hybrid mode on any other ports?&lt;/p&gt;&#xA;" OwnerUserId="2670" LastEditorUserId="3191" LastEditDate="2014-05-15T08:17:37.970" LastActivityDate="2018-01-19T08:55:09.603" Title="Trying to pass VLAN between Force10 S25 switches" Tags="|switch|vlan|force10|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6172" PostTypeId="2" ParentId="5891" CreationDate="2014-02-05T20:29:05.070" Score="8" Body="&lt;p&gt;Junos's /etc/ssh/primes file had an off by 8 bug. That is, moduli in that file advertized to be 2048bits, were in fact 2056 bits long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco SSH client is very strict in this regard, and hence refuses to proceed. As a work around, delete /etc/ssh/primes file from your Junos device. This will cause Junos to use Group14 moduli.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="4185" LastActivityDate="2014-02-05T20:29:05.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6173" PostTypeId="2" ParentId="6169" CreationDate="2014-02-05T20:38:51.757" Score="5" Body="&lt;p&gt;The AP can easily handle 60 clients, but the Wifi channel can't.  You have 60 users competing for airtime on a single channel and that's where your interference is happening.  Remember 802.11 is a shared medium, so everyone is trying to get their slice of airtime.  When clients connect especially at at low speeds, they take longer to send and receive, taking up more of the  channel. While one client is sending at a low data rate, everyone else has to wait until they're done&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can lessen the impact by disabling low speeds on your AP.  You should disable all speeds below 12M, and possibly all below 22Mb.   That will disable 11b clients, which will improve performance.  It will also force clients to get on and off the channel much more quickly, improving the channel utilization.  The downside is you will reduce the range between clients and the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also configure the 1142 to push clients up to 5GHz.  that will help a little, but iPhones and most Andriods are only 2.4GHz, so that's of limited value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are tools to measure channel utilization, but they can be a little pricey.  Fluke and Airmagnet make wifi analyzers that will do that.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-05T20:38:51.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6174" PostTypeId="1" AcceptedAnswerId="6188" CreationDate="2014-02-05T21:52:09.957" Score="1" ViewCount="1042" Body="&lt;p&gt;I'm in charge of setting up a basic network for some colocation needs. Here is our objective with a fairly limited budget / network hardware available (although if there is something else required to achieve this that's an option).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently we have the following hardware:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2x Vyatta routers (6x SFP/ea)&lt;/li&gt;&#xA;&lt;li&gt;2x Juniper EX2200 (4x SFP/ea)&lt;/li&gt;&#xA;&lt;li&gt;2x Juniper EX3300 (4x SFP/ea)&lt;/li&gt;&#xA;&lt;li&gt;2x Brocade 648FCX (4x SFP/ea)&lt;/li&gt;&#xA;&lt;li&gt;2-3x Cabinets&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now we're looking for an &quot;optimal&quot; setup given the situation. We're mixing the edge/core on the Vyatta routers right now however we believe this is really going to limit us and we'll need get a proper core sooner than later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now we have two transit providers who we'll be peering with (we have our ASN / IP's from ARIN already). This isn't a problem however trying to figure out the best way to layout the network is given our limited assets. So here are some pressing questions I'm uncertain about:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Would it be best to have both of the BGP sessions off of one of the Vyatta routers or would it be better to have 1 BGP session per Vyatta router and have those routers talk to each other via some IGP?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This pains me to ask but when announcing a network via eBGP to your neighbours (say 1.2.3.0/24) would you announce it to both peers or only one? I'd imagine it's up to you ultimately but announcing to both would allow inbound traffic to come in over either link (depending on the path and what not)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the situation of having two routers one with a BGP session to each ISP is where things starting to get really fuzzy for me. Each switch on the cabinet can have an uplink to each router - what's the best situation here? Would you want to do something like ECMP to both routers? Would you want an IGP between the switches / routers?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If announcing a single /24 on both routers would it be possible to use that IP space across cabinets? I imagine this would require core switches which would be trunked accordingly? Could someone clarify this for me?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time / humouring these mundane questions that undoubtely sprout up more times than not. My Google-fu hasn't led me to conclusive answers.&lt;/p&gt;&#xA;" OwnerUserId="4186" LastEditorUserId="3191" LastEditDate="2014-12-08T20:27:15.793" LastActivityDate="2014-12-08T20:27:15.793" Title="Basic network setup for colocation / several cabinets and related questions" Tags="|bgp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6177" PostTypeId="1" CreationDate="2014-02-06T09:27:48.630" Score="2" ViewCount="909" Body="&lt;p&gt;My knowledge of QoS on Cisco is new as of yesterday and I have been trying to get a few different configurations on stack exchange that I found to work but the traffic only ever seems to match the default class and not my prioritised class. I may be missing something really obvious so would appreciate someone quickly checking over my configuration below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is on a Cisco 877 router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any RDP&#xA;  match access-group 145&#xA;&#xA;policy-map RDP&#xA;  class RDP&#xA;  priority percent 70&#xA;  class class-default&#xA;  fair-queue&#xA;policy-map parent-policy&#xA;  class class-default&#xA;  shape average 458752&#xA;  service-policy RDP&#xA;&#xA;int FastEthernet 0&#xA;  description WAN&#xA;  service-policy output parent-policy&#xA;&#xA;int FastEthernet 1&#xA;  description LAN&#xA;&#xA;access-list 145 permit ip any host XXX.XXX.XXX.XXX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4193" LastActivityDate="2014-02-06T10:59:25.410" Title="QoS not matching traffic" Tags="|cisco|router|qos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6181" PostTypeId="2" ParentId="6177" CreationDate="2014-02-06T10:59:25.410" Score="2" Body="&lt;p&gt;If it's 877 you need to put QoS configuration on the VLAN interface (SVI), not physical FE ports. Also SVI doesn't support HQoS, so you'll need to simplify it for SVI.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-02-06T10:59:25.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6182" PostTypeId="1" AcceptedAnswerId="6184" CreationDate="2014-02-06T13:13:29.630" Score="4" ViewCount="20983" Body="&lt;p&gt;I have access with level 1 privilege on a Cisco switch.  But, I want to see all configurations and interfaces, while being able to modify nothing. I searched the internet for the proper level of privilege but found nothing. Can someone explain each level and say which level is appropriate for seeing everything but modify nothing?&lt;/p&gt;&#xA;" OwnerUserId="4197" LastEditorUserId="44" LastEditDate="2014-02-06T15:17:23.593" LastActivityDate="2014-02-06T15:23:06.083" Title="Cisco IOS privilege level explained" Tags="|cisco|switch|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6184" PostTypeId="2" ParentId="6182" CreationDate="2014-02-06T13:47:39.793" Score="10" Body="&lt;p&gt;There are 16 privilege levels. Usermode is level one. The highest is 15, sometimes referred to as privileged mode. There's also a level 0, which has even fewer options that usermode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get into level 15, where you can view configurations and modify them, type &lt;code&gt;enable&lt;/code&gt; in usermode. Provided that you have the password, your prompt will change from &lt;code&gt;&amp;gt;&lt;/code&gt; to &lt;code&gt;#&lt;/code&gt;. You can then enter commands such as &lt;code&gt;show running-config&lt;/code&gt;, &lt;code&gt;show startup-config&lt;/code&gt;, &lt;code&gt;debug&lt;/code&gt;, and &lt;code&gt;configure terminal&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other levels (2-14) are used for custom access. For instance, if I have a junior admin that I want to be able to have access to the command &lt;code&gt;show run&lt;/code&gt;, but not &lt;code&gt;config t&lt;/code&gt;, I can configure these specific rules to be associated with a particular level. Whatever level you are, you get access to everything in your level, plus all of the commands found with the lower levels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username junioradmin privilege 2 password bingo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[This creates a login that when used will be placed in level 2 instead of the default level 1]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;privilege exec level 2 show running-config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[This says to allow any level 2 user to have the ability to enter &lt;code&gt;show run&lt;/code&gt;. But remember, they can also enter any command from a lower level, so all usermode commands are also included.]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line con 0&#xA;login local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[This will prompt for the username. It says to the device, &quot;Use the local database for logging in.&quot;]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do this configuration, login, and then enter the &lt;code&gt;show run&lt;/code&gt; command, it will work. Then enter &lt;code&gt;show start&lt;/code&gt;; this will not work because &lt;code&gt;show start&lt;/code&gt; is a level 15 command.&lt;/p&gt;&#xA;" OwnerUserId="4199" LastEditorUserId="44" LastEditDate="2014-02-06T15:23:06.083" LastActivityDate="2014-02-06T15:23:06.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6185" PostTypeId="1" CreationDate="2014-02-06T16:16:42.797" Score="1" ViewCount="532" Body="&lt;p&gt;Does an HSRP VIP factor into the PIM designated router and IGMP querier election on a segment? Should they be located on the same interface or device? What would be the effects of having them separate? &lt;/p&gt;&#xA;" OwnerUserId="446" LastActivityDate="2014-02-06T21:51:57.183" Title="Multicast and HSRP" Tags="|cisco|multicast|hsrp|pim|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6186" PostTypeId="1" CreationDate="2014-02-06T16:27:57.290" Score="2" ViewCount="141" Body="&lt;p&gt;What is the best PIM mode for a campus video network? There are several relevant factors:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;All video is local to the campus.&lt;/li&gt;&#xA;&lt;li&gt;Click to view needs to be fast as possible (Life safety issues)&lt;/li&gt;&#xA;&lt;li&gt;Sources are intermittent.&lt;/li&gt;&#xA;&lt;li&gt;Bandwidth is not a concern in the selection as the campus is overbuilt in this regard. (shared tree is not required).&lt;/li&gt;&#xA;&lt;li&gt;Source and receiver are often on the same VLAN.&lt;/li&gt;&#xA;&lt;li&gt;Equipment can handle as many (S,G) entries as needed. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="446" LastActivityDate="2014-02-06T20:56:06.680" Title="PIM mode for low latency video" Tags="|cisco|multicast|pim|video|" AnswerCount="1" CommentCount="3" ClosedDate="2019-05-01T00:04:02.637" ContentLicense="CC BY-SA 3.0" />
  <row Id="6187" PostTypeId="2" ParentId="6113" CreationDate="2014-02-06T18:20:47.773" Score="2" Body="&lt;p&gt;Based on your output.  The sh ip route on routerA shows the ospf type as E2 instead of N2&#xA;But the router ospf command area 0.0.0.1 nssa default-information-originate Is only going to originate the default route to the NSSA area.  Can you verify the default route is getting to the customer &amp;amp; why on routerA its showing as E2??&lt;/p&gt;&#xA;" OwnerUserId="3150" LastActivityDate="2014-02-06T18:20:47.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6188" PostTypeId="2" ParentId="6174" CreationDate="2014-02-06T20:41:50.740" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;“Best” is in the eye of the beholder, but if you use one router for both providers, that becomes a single point of failure.  With a router for each provider, you are protected if one router fails.&lt;/li&gt;&#xA;&lt;li&gt;Yes, I’d announce your network to both peers.  Otherwise, what’s the point of having two peers?&lt;/li&gt;&#xA;&lt;li&gt;Lots of options here.   To keep things simple, you can have your two routers run VRRP on their inside interfaces on a single VLAN.  All your servers will also be on that VLAN with the VRRP address as their default gateway.  The routers also peer with each other.  So if a router fails, or a link fails, you still have connectivity.   There are other ways to go depending on how complex your servers are.   You haven’t mentioned any security concerns.  Do you plan to have firewalls, ACLs etc?&lt;/li&gt;&#xA;&lt;li&gt;Yes.  Your switches will connect your VLAN(s) via a trunk.  Logically, all your switches will have all VLANs.  The Juniper switches will also allow you to manage all the switches as a single logical entity.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I’m basing this “design” only on the information you’ve provided.  If I were doing a real design (and charging for it), I would have a lot more questions for you about your applications, data flows, security, availability requirements, potential expansion, etc.  But this ought to get you going on the right path.    &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-06T20:41:50.740" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6189" PostTypeId="2" ParentId="6186" CreationDate="2014-02-06T20:56:06.680" Score="1" Body="&lt;p&gt;I’ve recently experienced a large network meltdown because of #6 using sparse mode, so maybe I’m a little gun-shy, but I wouldn’t recommend it for the number of cameras and the type of core routers you have.  The problem occurred because lots of multicast sources (actually, first hop routers) were sending register packets to the rendezvous point, and the core processor couldn’t handle it all.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would use SSM if your application will support it, or else use Bi-dir multicast. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-06T20:56:06.680" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6190" PostTypeId="2" ParentId="6185" CreationDate="2014-02-06T21:51:57.183" Score="3" Body="&lt;p&gt;They really have nothing to do with each other.  The client workstation will send unicast data to the VIP, but multicast will be sent to the group address.  The DR will then forward the data up the tree.  By default, if there are two multicast routers on a segment, one will be the DR and the other will be the IGMP querier.  IGMP joins and membership query/reports are all multicast.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-06T21:51:57.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6191" PostTypeId="2" ParentId="6155" CreationDate="2014-02-06T23:16:06.070" Score="3" Body="&lt;p&gt;SFP+ power budgets are typically in the 1 - 1.5W range as a function of the density deployed (i.e. 48p in a 1U form factor) and the ability to dissipate heat in such a small package.  10G PON SFP's exist but likely are pulling power outside what's usually appropriate for SFP+'s typical use case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment the maximum SFP+ power I've heard of in common use is a 40km capable 10GB-ZR, and even that isn't universally supported on all platforms.  I would imagine that further DSP development will drive power requirements down - which may make it both cheaper and more practical for the smaller form factors.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2014-02-06T23:16:06.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6192" PostTypeId="1" AcceptedAnswerId="6196" CreationDate="2014-02-06T23:34:51.933" Score="5" ViewCount="1196" Body="&lt;p&gt;I'm trying to do destination based CoS on Juniper MX basing on destination ASN.&#xA;I've tried config below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set policy-options as-path BGP-PATH-TO-MARK-COS &quot;65512 .*&#xA;&#xA;set policy-options policy-statement MARK-POLICY-1 term term-1 to as-path BGP-PATH-TO-MARK-COS&#xA;set policy-options policy-statement MARK-POLICY-1 term term-1 then forwarding-class network-control&#xA;set routing-options forwarding-table export MARK-POLICY-1&#xA;&#xA;set class-of-service interfaces ge-7/2/2 unit 0 rewrite-rules inet-precedence default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I expect traffic to AS65512 destinations to be marked as network-control, however tcpdump shows 0x0 tos filed.&#xA;Looks like term-1 condition is right, since if I change 'then forwarding-class network-control' to 'then reject' traffic towards AS65512 is indeed rejected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's ignore for a moment 'network-control' it's here only to see that marking is indeed happens (which is not the case).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be wrong with my config?&lt;/p&gt;&#xA;" OwnerDisplayName="user3525" LastActivityDate="2014-02-07T08:44:45.390" Title="Juniper destination based CoS" Tags="|qos|juniper|cos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6195" PostTypeId="2" ParentId="2533" CreationDate="2014-02-07T08:10:44.457" Score="0" Body="&lt;p&gt;sh run | in ^inter|access-gr&lt;/p&gt;&#xA;&#xA;&lt;p&gt;gives output from the running-config&lt;/p&gt;&#xA;" OwnerUserId="4208" LastActivityDate="2014-02-07T08:10:44.457" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6196" PostTypeId="2" ParentId="6192" CreationDate="2014-02-07T08:35:54.793" Score="2" Body="&lt;p&gt;Packet classification occurs when the packet enters the router. You're trying to apply it on the forwarding table. That's not supported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Juniper documentation shows the packet flow in the router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.3/topics/concept/packet-flow-mx-series-cos-config-guide.html&quot; rel=&quot;nofollow&quot; title=&quot;Packet flow on MX routers&quot;&gt;Packet flow in MX Routers&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So try to apply the policy on the input interface like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces ge-x/x/x.x family inet policer input MARK-POLICY-1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another way to update a packet in the forwarding-table is to use the classification-override feature:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junos12.3/topics/usage-guidelines/cos-overriding-the-input-classification.html&quot; rel=&quot;nofollow&quot;&gt;Overriding the Input Classification&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set class-of-service forwarding-policy class POLICY-1 classification-override forwarding-class network-control&#xA;set policy-options policy-statement MARK-POLICY-1 term term-1 to as-path BGP-PATH-TO-MARK-COS&#xA;set policy-options policy-statement MARK-POLICY-1 term term-1 then class POLICY-1&#xA;set policy-options policy-statement MARK-POLICY-1 term term-2 then accept&#xA;set routing-options forwarding-table export MARK-POLICY-1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2014-02-07T08:44:45.390" LastActivityDate="2014-02-07T08:44:45.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6197" PostTypeId="2" ParentId="3505" CreationDate="2014-02-07T13:15:02.150" Score="0" Body="&lt;p&gt;BGP is used for external and Internal routing between &quot;internetworks&quot;, BGP is commonly used by ISPs and large organizations to route throught the internet using ASN (autonomous system number). External BGP is used by ISPs to communicate to another ISP or any organization that has a &quot;Backbone&quot;. These types of routing occur outside the LAN, instead these routes materializes in a WAN or which is the internet.&lt;/p&gt;&#xA;" OwnerUserId="4211" LastActivityDate="2014-02-07T13:15:02.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6198" PostTypeId="2" ParentId="5862" CreationDate="2014-02-07T13:19:54.437" Score="6" Body="&lt;p&gt;The &lt;em&gt;actual&lt;/em&gt; solution is to change a few settings of the wireless NIC in windows.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Three things needed to be changed in the card's settings in order to fix this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Change the 802.11n channel width from the default (20) to auto&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Turn off bluetooth in the card's properties&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Set the Roaming aggressiveness to High&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Immediately after, we were getting 100 Mbps downloads over the LAN when we were previously getting 500 Kbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;The originally accepted solution below is no longer valid.  Unifi products are not, in fact, the cause of the issue.&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After extensive testing and multiple situations, it appears that the Intel Centrino 2230 Wireless NIC is simply incompatible with Ubiquiti Unifi access points.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Replacing the NIC with a 1x1 WLAN NIC from previous machines completely alleviated the problem.  Connecting to the access points of three other brands worked fine as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We attempted to connect them to a Unifi AC access point, as well.  Nothing changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither updating nor backdating drivers on the chipset and WLAN didn't work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears to just be totally incompatible between the Centrino 2230 WLAN NIC and Ubiquiti Unifi access points.&lt;/p&gt;&#xA;" OwnerUserId="2670" LastEditorUserId="2670" LastEditDate="2014-03-03T14:00:19.737" LastActivityDate="2014-03-03T14:00:19.737" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6200" PostTypeId="1" AcceptedAnswerId="6201" CreationDate="2014-02-07T16:12:25.003" Score="2" ViewCount="696" Body="&lt;p&gt;The top level DNS-servers use geographic anycast. Is it possible to set up geographic anycast on your own (DNS) servers on the Internet?  The top level DNS-servers use geographic anycast. Is this set up in the routing tables in all internet &quot;nodes&quot;? Is it possible to implement anycast to do geographic load balancing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, if you own an IP-address, you can set up for example nginx on this server to do load balancing on a local server farm. Then nginx does all the communication with the client. However, what if you want to have multiple data centers located around the world? I want to set up servers at multiple locations to minimize latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also set up a DNS-server returning IPs based on the requester's location. This would enable geographic load balancing. However, what happens if this DNS-server is slowed down because of much traffic? Is it possible to load balance these DNS servers?&lt;/p&gt;&#xA;" OwnerUserId="4212" LastEditorUserId="8499" LastEditDate="2018-02-15T05:22:43.523" LastActivityDate="2018-02-15T05:22:43.523" Title="Is it possible to set up (geographic) anycast on the Internet?" Tags="|multicast|dns|anycast|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6201" PostTypeId="2" ParentId="6200" CreationDate="2014-02-07T16:51:47.887" Score="6" Body="&lt;p&gt;Yes, it's possible.  But you would have to advertise a /24 network (or larger), based on current Internet routing policies.  So if your name server IP was 1.2.3.4, you would have to advertise 1.2.3.0/24 from each of your locations.  The rest of the addresses in that subnet would be, practically speaking, wasted.  You also would have to have your own provider-independent address space, which is not easy to come by, especially on IPv4.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-02-07T17:04:56.187" LastActivityDate="2014-02-07T17:04:56.187" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6202" PostTypeId="2" ParentId="5668" CreationDate="2014-02-07T17:03:04.153" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;This is called AS path prepending. This is generally done using route maps. For designating one path as bestpath, other paths to the same destinations is augmented with AS numbers, thus  incrementing their AS path length.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When some route with this AS path (12 34 33 2 2 45 331 ) reaches AS 2, AS 2 will see a routing loop and will not add it in its Loc-RIB. Hence this route will not be forwarded to its neighbours.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4213" LastActivityDate="2014-02-07T17:03:04.153" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6204" PostTypeId="1" AcceptedAnswerId="6207" CreationDate="2014-02-07T18:46:34.123" Score="4" ViewCount="3680" Body="&lt;p&gt;Does anyone know how, if at all supported, to setup site-to-site IKE/IPSec VPN end-point on a Juniper MX80 router? The other side is SRX640, so not a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper online documentation is very confusing in this regard. Looks like I either need additional hardware on the router (which?), or I am completely missing something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MX80 runs Junos 11.2R3.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would appreciate any pointers.&lt;/p&gt;&#xA;" OwnerUserId="4217" LastActivityDate="2015-12-30T11:36:22.180" Title="IPSec VPN on Juniper MX80" Tags="|vpn|juniper-mx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6207" PostTypeId="2" ParentId="6204" CreationDate="2014-02-08T02:13:43.383" Score="3" Body="&lt;p&gt;As you said, the Junos documentation for IPSec is pretty confusing; it took a while to find a definitive reference for how to get IPSec in HW on the MX80.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you're looking for site-to-site VPN support, this means higher throughput and certainly you don't want to do this on a CPU.  As such, you should use the &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.2/topics/concept/ms-mic-and-mpc-overview.html&quot; rel=&quot;nofollow&quot;&gt;MS-MIC-16G&lt;/a&gt;, which started supporting IPSec VPN in Junos 13.2.  According to the &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.2/information-products/topic-collections/release-notes/13.2/index.html?topic-76116.html&quot; rel=&quot;nofollow&quot;&gt;Junos 13.2 Release Notes&lt;/a&gt;, only IPv4 is supported at this time.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-02-08T08:44:57.963" LastActivityDate="2014-02-08T08:44:57.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6209" PostTypeId="1" AcceptedAnswerId="6210" CreationDate="2014-02-08T11:33:23.577" Score="10" ViewCount="3542" Body="&lt;p&gt;How can ISPs on one continent connect to ISPs on another continent? From a physical layer standpoint? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say one ISP is located in Asia and another one in Europe how would they connect their fiber optic cable to exchange traffic? Also how would they connect physically through IXP (&lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_Internet_exchange_points_by_size&quot; rel=&quot;nofollow&quot;&gt;Internet Exchange Points&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do they have to drag their fiber optics cable all the way to these locations?&lt;/p&gt;&#xA;" OwnerUserId="4211" LastEditorDisplayName="user16355" LastEditDate="2016-01-15T06:09:06.693" LastActivityDate="2021-01-31T10:43:51.710" Title="How can ISPs on one continent connect to ISPs on another continent?" Tags="|routing|fiber|isp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6210" PostTypeId="2" ParentId="6209" CreationDate="2014-02-08T12:14:45.577" Score="22" Body="&lt;p&gt;There are a number of things ISP's do:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;drag bundles of fibers across continents. Since this is very costly, only a small number of very large companies do this and many ISP's rent fiber-pairs from these companies&lt;/li&gt;&#xA;&lt;li&gt;rent capacity (a wavelength, VLAN, MPLS circuit, etc) between to an IXP from a company who owns (or rents) fibers. Since the capacity of fibers is shared, this usually is less costly&lt;/li&gt;&#xA;&lt;li&gt;buy IP &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_transit&quot; rel=&quot;nofollow noreferrer&quot;&gt;transit&lt;/a&gt; from a transit provider. These transit providers typically have their own global connectivity. Transit providers can offer ISP's routes to the entire internet, so an ISP does not have to be present on every IXP to connect to every other ISP on the planet. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The last option is most common. There is only a limited number of transit providers who don't buy transit from another ISP, they're usually called &lt;a href=&quot;https://en.wikipedia.org/wiki/Tier_1_network&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tier 1&lt;/a&gt;. Most ISP's combine IXP connectivity and IP transit for their global connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;Here's a real-world example: I used &lt;a href=&quot;http://ring.nlnog.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;NLNOG Ring's&lt;/a&gt; &lt;code&gt;ring-trace&lt;/code&gt; to create a graph of how networks around the world reach Facebook's network.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/gGkZ8.jpg&quot; alt=&quot;ring-trace to www.facebook.com&quot;&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see from this example, a lot of networks reach Facebook via DE-CIX (the IXP in Frankfurt, Germany, one of the largest in the world), but there are also a large number of networks which use Telia (AS1299) and NTT (AS2914) to reach Facebook. Telia and NTT are tier 1 transit providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 2:&lt;/strong&gt;&#xA;Since the image is downscaled it's hard to read. &lt;a href=&quot;http://teun.tv/stuff/facebook.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; is a full size version.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="30070" LastEditDate="2018-09-12T17:58:56.793" LastActivityDate="2018-09-12T17:58:56.793" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="6212" PostTypeId="1" AcceptedAnswerId="43136" CreationDate="2014-02-08T14:55:33.913" Score="10" ViewCount="6056" Body="&lt;h1&gt;Update&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Finally got upgraded to 9.1.4. I got everything configured, reenabled VPN, and was still having the same problem. So, I cleared all VPN config information and started from scratch. Below is my current config. I am able to connect and access resources on the internal network. I am not, however, able to access the internet through the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&lt;pre&gt;&#xA;xlate per-session deny tcp any4 any4&#xA;xlate per-session deny tcp any4 any6&#xA;xlate per-session deny tcp any6 any4&#xA;xlate per-session deny tcp any6 any6&#xA;xlate per-session deny udp any4 any4 eq domain&#xA;xlate per-session deny udp any4 any6 eq domain&#xA;xlate per-session deny udp any6 any4 eq domain&#xA;xlate per-session deny udp any6 any6 eq domain&#xA;ip local pool VPNPool 192.168.3.1-192.168.3.30&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/2&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; description Private-Interface&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.3.3.1 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; description Public-Interface&#xA; nameif outside&#xA; security-level 0&#xA; ip address xx.xx.xx.xx 255.255.255.248 &#xA;!&#xA;boot system disk0:/asa914-k8.bin&#xA;object network obj-10.3.3.0&#xA; subnet 10.3.3.0 255.255.255.0&#xA;object network vpn_nat&#xA; subnet 192.168.3.0 255.255.255.0&#xA;object-group service Internet-udp udp&#xA; description UDP Standard Internet Services&#xA; port-object eq domain&#xA; port-object eq ntp&#xA;object-group service Internet-tcp tcp&#xA; description TCP Standard Internet Services&#xA; port-object eq www&#xA; port-object eq https&#xA; port-object eq smtp&#xA; port-object eq 465&#xA; port-object eq pop3&#xA; port-object eq 995&#xA; port-object eq ftp&#xA; port-object eq ftp-data&#xA; port-object eq domain&#xA; port-object eq ssh&#xA;object-group network Internal-Subnet&#xA;object-group network obj-vpnpool&#xA;access-list inside-in remark -=[Access Lists for Outgoing Packets from Inside interface]=-&#xA;access-list inside-in extended permit udp 10.3.3.0 255.255.255.0 any4 object-group Internet-udp &#xA;access-list inside-in extended permit tcp 10.3.3.0 255.255.255.0 any4 object-group Internet-tcp &#xA;access-list inside-in extended permit icmp 10.3.3.0 255.255.255.0 any4 &#xA;access-list outside-in remark -=[Access Lists for Incoming Packets on OUTSIDE interface]=-&#xA;access-list outside-in extended permit icmp any4 any4 echo-reply &#xA;access-list outside-in extended permit icmp any4 any4 echo &#xA;access-list vpn_splitTunnelAcl standard permit 10.3.3.0 255.255.255.0 &#xA;nat (inside,outside) source static obj-10.3.3.0 obj-10.3.3.0 destination static vpn_nat vpn_nat no-proxy-arp route-lookup&#xA;object network obj-10.3.3.0&#xA; nat (inside,outside) dynamic interface&#xA;access-group inside-in in interface inside&#xA;access-group outside-in in interface outside&#xA;route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1 &#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication telnet console LOCAL &#xA;aaa authentication http console LOCAL &#xA;aaa authentication ssh console LOCAL &#xA;http server enable&#xA;http 10.3.3.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec ikev1 transform-set vpn-transform-set-ikev1 esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set vpn-transform-set-ikev1 mode transport&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto dynamic-map dyno 10 set ikev1 transform-set vpn-transform-set-ikev1&#xA;crypto map vpn 20 ipsec-isakmp dynamic dyno&#xA;crypto map vpn interface outside&#xA;crypto ca trustpool policy&#xA;crypto isakmp nat-traversal 3600&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 policy 10&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh 10.3.3.0 255.255.255.0 inside&#xA;ssh timeout 20&#xA;ssh version 2&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;dhcpd address 10.3.3.100-10.3.3.150 inside&#xA;dhcpd dns xx.xx.xx.xx xx.xx.xx.xx interface inside&#xA;dhcpd enable inside&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics host number-of-rate 2&#xA;threat-detection statistics port number-of-rate 2&#xA;threat-detection statistics protocol number-of-rate 2&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;group-policy vpn_policy internal&#xA;group-policy vpn_policy attributes&#xA; vpn-tunnel-protocol l2tp-ipsec &#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value vpn_splitTunnelAcl&#xA;username mike password x&#xA;username mike attributes&#xA; vpn-tunnel-protocol l2tp-ipsec &#xA;username admin password x encrypted privilege 15&#xA;tunnel-group DefaultRAGroup general-attributes&#xA; address-pool VPNPool&#xA; default-group-policy vpn_policy&#xA;tunnel-group DefaultRAGroup ipsec-attributes&#xA; ikev1 pre-shared-key &lt;strong&gt;*&lt;/strong&gt;&#xA;tunnel-group DefaultRAGroup ppp-attributes&#xA; authentication ms-chap-v2&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect ip-options &#xA;  inspect netbios &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect skinny&lt;br&gt;&#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect sunrpc &#xA;  inspect tftp &#xA;  inspect sip&lt;br&gt;&#xA;  inspect xdmcp &#xA; class class-default&#xA;  user-statistics accounting&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http &lt;a href=&quot;https://tools.cisco.com/its/service/oddce/services/DDCEService&quot; rel=&quot;noreferrer&quot;&gt;https://tools.cisco.com/its/service/oddce/services/DDCEService&lt;/a&gt;&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;: end&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Old Stuff&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I'm trying to set up an L2TP over IPSec remote access VPN on an ASA 5505, version 8.2(5). I'm able to authenticate and a connection is established. I am not, however, able to access resources on the internal network or access the internet. Furthermore, the ASA is not able to ping connected clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the connected client I can ping the ASA's external IP. When I do that, I even see the encrypted and decrypted packet count go up on the ASA with &lt;code&gt;show crypto ipsec sa&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried doing a few things with NAT and with the routes, but just can't get it working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My internal network is 10.3.3.0/24 and my VPN pool is 192.168.3.0/24. Below I've copied the relevant portions of the config.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;object-group service Internet-udp udp&#xA; description UDP Standard Internet Services&#xA; port-object eq domain&#xA; port-object eq ntp&#xA;object-group service Internet-tcp tcp&#xA; description TCP Standard Internet Services&#xA; port-object eq www&#xA; port-object eq https&#xA; port-object eq smtp&#xA; port-object eq 465&#xA; port-object eq pop3&#xA; port-object eq 995&#xA; port-object eq ftp&#xA; port-object eq ftp-data&#xA; port-object eq domain&#xA; port-object eq ssh&#xA; port-object eq 993&#xA;object-group network Internal-Subnet&#xA;object-group network obj-vpnpool&#xA;access-list inside-in remark -=[Access Lists for Outgoing Packets from Inside interface]=-&#xA;access-list inside-in extended permit udp 10.3.3.0 255.255.255.0 any object-group Internet-udp&#xA;access-list inside-in extended permit tcp 10.3.3.0 255.255.255.0 any object-group Internet-tcp&#xA;access-list inside-in extended permit icmp 10.3.3.0 255.255.255.0 any&#xA;access-list outside-in remark -=[Access Lists for Incoming Packets on OUTSIDE interface]=-&#xA;access-list outside-in extended permit icmp any any echo-reply&#xA;access-list DefaultRAGroup_splitTunnelAcl standard permit 10.3.3.0 255.255.255.0&#xA;access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.3.96 255.255.255.224&#xA;access-list inside_nat0_outbound extended permit ip 10.3.3.0 255.255.255.0 192.168.3.0 255.255.255.0&#xA;&#xA;ip local pool VPNPool 192.168.3.100-192.168.3.120 mask 255.255.255.0&#xA;&#xA;nat (inside) 0 access-list inside_nat0_outbound&#xA;nat (inside) 1 10.3.3.0 255.255.255.0&#xA;access-group inside-in in interface inside&#xA;access-group outside-in in interface outside&#xA;route outside 0.0.0.0 0.0.0.0 **.**.**.** 1&#xA;&#xA;group-policy DefaultRAGroup internal&#xA;group-policy DefaultRAGroup attributes&#xA; dns-server value **.**.**.** **.**.**.**&#xA; vpn-tunnel-protocol l2tp-ipsec&#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value DefaultRAGroup_splitTunnelAcl&#xA;&#xA;crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac &#xA;crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set TRANS_ESP_3DES_SHA ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map outside_map interface outside&#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 10&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha     &#xA; group 2&#xA; lifetime 86400&#xA;&lt;/code&gt;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Update 1&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I took Ron's suggestion and learned how the &lt;code&gt;packet-tracer&lt;/code&gt; commands function. Here are some things I found after issuing &lt;code&gt;packet-tracer input inside icmp 10.3.3.100 8 0 192.168.3.100&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&lt;code&gt;&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: input&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   192.168.3.100   255.255.255.255 outside&#xA;&#xA;Phase: 2&#xA;Type: ACCESS-LIST&#xA;Subtype: log&#xA;Result: ALLOW&#xA;Config:&#xA;access-group inside-in in interface inside&#xA;access-list inside-in extended permit icmp 10.3.3.0 255.255.255.0 any &#xA;Additional Information:&#xA;&#xA;Phase: 3&#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 4      &#xA;Type: INSPECT &#xA;Subtype: np-inspect&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 5&#xA;Type: NAT-EXEMPT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;  match ip inside 10.3.3.0 255.255.255.0 outside 192.168.3.0 255.255.255.0&#xA;    NAT exempt&#xA;    translate_hits = 16, untranslate_hits = 2&#xA;Additional Information:&#xA;&#xA;Phase: 6&#xA;Type: NAT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside) 1 10.3.3.0 255.255.255.0&#xA;  match ip inside 10.3.3.0 255.255.255.0 outside any&#xA;    dynamic translation to pool 1 (**.**.**.** [Interface PAT])&#xA;    translate_hits = 21582, untranslate_hits = 2392&#xA;Additional Information:&#xA;&#xA;Phase: 7&#xA;Type: NAT&#xA;Subtype: host-limits&#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside) 1 10.3.3.0 255.255.255.0&#xA;  match ip inside 10.3.3.0 255.255.255.0 inside any&#xA;    dynamic translation to pool 1 (No matching global)&#xA;    translate_hits = 0, untranslate_hits = 0&#xA;Additional Information:&#xA;&#xA;Phase: 8&#xA;Type: HOST-LIMIT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 9&#xA;Type: L2TP-PPP&#xA;Subtype: &#xA;Result: ALLOW &#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 10&#xA;Type: PPP&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 11&#xA;Type: FLOW-CREATION&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;New flow created with id 23037, packet dispatched to next module&#xA;&#xA;Result:&#xA;input-interface: inside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: outside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: allow&#xA;&lt;/code&gt;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Phase 6 shows a NAT translation. I then check the echo-reply with &lt;code&gt;packet-tracer input outside icmp 192.168.3.100 0 0 10.3.3.100&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&lt;code&gt;&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: input&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   10.3.3.0        255.255.255.0   inside&#xA;&#xA;Phase: 2&#xA;Type: ACCESS-LIST&#xA;Subtype: log&#xA;Result: ALLOW&#xA;Config:&#xA;access-group outside-in in interface outside&#xA;access-list outside-in extended permit icmp any any echo-reply &#xA;Additional Information:&#xA;&#xA;Phase: 3&#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 4      &#xA;Type: CP-PUNT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 5&#xA;Type: L2TP-PPP&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 6&#xA;Type: INSPECT&#xA;Subtype: np-inspect&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 7&#xA;Type: VPN&#xA;Subtype: ipsec-tunnel-flow&#xA;Result: ALLOW &#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 8&#xA;Type: NAT-EXEMPT&#xA;Subtype: rpf-check&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 9&#xA;Type: HOST-LIMIT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 10&#xA;Type: NAT&#xA;Subtype: rpf-check&#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside) 1 10.3.3.0 255.255.255.0&#xA;  match ip inside 10.3.3.0 255.255.255.0 outside any&#xA;    dynamic translation to pool 1 (**.**.**.** [Interface PAT])&#xA;    translate_hits = 21589, untranslate_hits = 2392&#xA;Additional Information:&#xA;&#xA;Phase: 11&#xA;Type: FLOW-CREATION&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;New flow created with id 23079, packet dispatched to next module&#xA;&#xA;Result:&#xA;input-interface: outside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: inside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: allow&#xA;&lt;/code&gt;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Phase 8 shows &lt;code&gt;NAT-EXEMPT&lt;/code&gt; but Phase 10 shows a NAT translation. That would be problematic.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Update 2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Currently &lt;code&gt;show vpn-sessiondb detail remote filter protocol L2TPOverIPSec&lt;/code&gt; returns nothing while a client is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand &lt;code&gt;show vpn-sessiondb detail remote filter protocol L2TPOverIPSecOverNatT&lt;/code&gt; shows the connected client. While trying to do things on the client, the Bytes Rx and Pkts Rx increase. Bytes Tx and Pkts Tx do not increase (Pkts Tx stays at 17). Pkts Tx Drop and Pkts Rx Drop are both 0. If I ping 192.168.3.100 (the vpn client), then Pkts Tx increases for each ping.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Update 3&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I enabled logging on the ASA and established a connection. Here are some interesting log messages I'm seeing&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;%ASA-6-737026: IPAA: Client assigned 192.168.3.100 from local pool&#xA;ppp_virtual_interface_id is 1, client_dynamic_ip is 192.168.3.100&#xA;%ASA-7-609001: Built local-host outside:192.168.3.100&#xA;%ASA-2-106001: Inbound TCP connection denied from 192.168.3.100/57013 to **.**.**.**/443 flags SYN  on interface outside&#xA;%ASA-2-106001: Inbound TCP connection denied from 192.168.3.100/57013 to **.**.**.**/443 flags SYN  on interface outside&#xA;%ASA-2-106001: Inbound TCP connection denied from 192.168.3.100/57013 to **.**.**.**/443 flags SYN  on interface outside&#xA;%ASA-2-106007: Deny inbound UDP from 192.168.3.100/9562 to **.**.**.**/53 due to DNS Query&#xA;%ASA-2-106007: Deny inbound UDP from 192.168.3.100/61529 to **.**.**.**/53 due to DNS Query&#xA;%ASA-2-106007: Deny inbound UDP from 192.168.3.100/38824 to **.**.**.**/53 due to DNS Query&#xA;&#xA;%ASA-3-713042: IKE Initiator unable to find policy: Intf inside, Src: 10.3.3.100, Dst: 192.168.3.100&#xA;%ASA-3-713042: IKE Initiator unable to find policy: Intf inside, Src: 10.3.3.100, Dst: 192.168.3.100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4224" LastEditorUserId="4224" LastEditDate="2014-03-21T18:37:54.080" LastActivityDate="2017-08-10T11:52:48.380" Title="ASA 5505 remote access VPN - Connection established, but no internet/access to internal subnet" Tags="|cisco-asa|vpn|" AnswerCount="4" CommentCount="18" ContentLicense="CC BY-SA 3.0" />
  <row Id="6213" PostTypeId="2" ParentId="483" CreationDate="2014-02-08T16:03:21.387" Score="-2" Body="&lt;p&gt;My experience of redistribution of statics with eigrp tells me that using the network statement will not inject the network, only the redistribute static works, however unless for also specify a metric be it default or on the redistribute statement it will not work. So use redistribution for statics with a metric and it will work&lt;/p&gt;&#xA;" OwnerUserId="4225" LastActivityDate="2014-02-08T16:03:21.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6216" PostTypeId="2" ParentId="58" CreationDate="2014-02-08T23:21:42.310" Score="4" Body="&lt;p&gt;Could be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CSCub92666&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA:Old connections tear down IPSEC vpn tunnel on switchover&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Symptom:&#xA;In IPsec vpn tunnel fail over configuration on ASA,fail over from primary to backup link works. But after second fail over from backup to primary link vpn tunnel start flapping in few minutes and remains unstable. The behavior is observed because of old leftover connection still pointing to backup isp.&lt;/p&gt;&#xA;" OwnerUserId="4231" LastActivityDate="2014-02-08T23:21:42.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6218" PostTypeId="1" AcceptedAnswerId="6220" CreationDate="2014-02-09T23:45:46.600" Score="6" ViewCount="667" Body="&lt;p&gt;I have 4 Cisco routers, connected one to another like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**R1**(s1/0)--(s1/0)**R2**(s1/1)--(s1/0)**R3**(s1/1)--(s1/0)**R4**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All of them have an IP address assigned on their interfaces. There is a route between R1 and R2, and a route between R3 and R4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want R2 and R3 to be an MPLS network, which I configure like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip cef&#xA;int s1/1&#xA;mpls label protocol ldp&#xA;mpls ip&#xA;mpls mtu 1512&#xA;ip route-cache cef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip cef&#xA;int s1/0&#xA;mpls label protocol ldp&#xA;mpls ip&#xA;mpls mtu 1512&#xA;ip route-cache cef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, R1 cannot ping anything except R2 and Traceroute gives &quot;!H&quot; after R2. If I use EIGRP as a routing protocol wrapped in MPLS it works, but my question is why should I need to configure the routes between R2 and R3? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;MPLS features rerouting, can it not just create the routes by itself?&lt;/p&gt;&#xA;" OwnerUserId="4249" OwnerDisplayName="Vulpo" LastEditorUserId="775" LastEditDate="2014-02-10T00:54:53.053" LastActivityDate="2014-02-10T01:04:58.867" Title="MPLS can reroute, but can it route?" Tags="|cisco|routing|router|mpls|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6219" PostTypeId="2" ParentId="6218" CreationDate="2014-02-10T00:53:35.203" Score="8" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;MPLS features rerouting, can it not just create the routes by itself?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You've enabled LDP; however, as an MPLS label distribution protocol LDP, only maps IGP routes to MPLS labels; in your case the IGP is EIGRP...&lt;/p&gt;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3031#page-8&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3031 - MPLS Architecture, page 8&lt;/a&gt; (emphasis mine):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; MPLS node                  a node which is running MPLS.  An MPLS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;                            node will be aware of MPLS control&#xA;                            protocols, will **operate one or more L3&#xA;                            routing protocols**, and will be capable&#xA;                            of forwarding packets based on labels.&#xA;                            An MPLS node may optionally be also&#xA;                            capable of forwarding native L3 packets.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The RFC doesn't leave this open to interpretation.  You cannot use LDP without a routing protocol.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-02-10T00:53:35.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6220" PostTypeId="2" ParentId="6218" CreationDate="2014-02-10T01:04:58.867" Score="7" Body="&lt;p&gt;&lt;strong&gt;Short answer: MPLS is not a Layer 3 Routing protocol, however, it requires one to establish it's paths.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;--&lt;/p&gt;&#xA;&lt;p&gt;Per &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3031&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3031&lt;/a&gt; &lt;em&gt;Multiprotocol Label Switching Architecture&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;An MPLS node will be aware of MPLS control protocols, will operate one or more L3 routing protocols, and will be capable of forwarding packets based on labels.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;What this means is that an MPLS node can make forwarding decisions based on labels, not on L3 routing information, but it will still require an L3 routing protocol for creating the path.&lt;/p&gt;&#xA;&lt;p&gt;MPLS cannot create IP routes where none exist.  (Nor can it re-route traffic to where no previous IP routes exist.)&lt;/p&gt;&#xA;&lt;p&gt;The key to answering this question is in understanding what MPLS is and how it functions.  I would recommend checking out &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk436/tk428/technologies_q_and_a_item09186a00800949e5.shtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's MPLS FAQ For Beginners&lt;/a&gt; and then for more in-depth reading, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3031&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3031&lt;/a&gt;.  These cover your question (and others) in some depth.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-02-10T01:04:58.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6222" PostTypeId="1" AcceptedAnswerId="6233" CreationDate="2014-02-10T04:15:35.390" Score="2" ViewCount="20126" Body="&lt;p&gt;I've inherited a Sonicwall TZ-210 (SonicOS Enhanced 5.5.20-3o) firewall running a multiple interface config:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st Interface: Running LAN (data network)&#xA;2nd Interface: Running PBX network (voice network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've disabled some NAT settings for the PBX server, and now the server (on X5) cannot communicate with the internet, nor is it reachable from X1. I've tried re-enabling the NAT policies and restarting the server, however there is still no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, there is no status for the voice network (X5) as indicated in the screenshot below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/W1pyU.png&quot; alt=&quot;Sonicwall Interface setup, why is there no status for X5?&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: How can I allow internet and access from X1 (WAN) to all of X5 interface or just the PBX server running on X5?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the NAT policies:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/6JKK7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;..and here are the Routing policies:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/CaZ98.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="4243" LastEditorUserId="4243" LastEditDate="2014-02-11T21:41:31.213" LastActivityDate="2014-02-12T13:55:42.807" Title="Sonicwall: Allow WAN access to device on separate interface" Tags="|firewall|nat|sonicwall|" AnswerCount="1" CommentCount="23" ContentLicense="CC BY-SA 3.0" />
  <row Id="6223" PostTypeId="1" AcceptedAnswerId="6227" CreationDate="2014-02-10T08:46:59.847" Score="5" ViewCount="1754" Body="&lt;p&gt;I was wondering when a device spec says that it supports WiFi bitrate of 300 Mbps, is this rate symmetric, i.e. is it the same rate in transmit (device to access point) and in receive (access point to device)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I have a fast access point that supports up to 600 Mbps, does that mean the downlink transmission will be also up to 600 Mbps, or will it be capped by the device maximum bitrate?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I replaced the words &quot;uplink&quot; vs &quot;downlink&quot; rate with &quot;Tx&quot; vs &quot;Rx&quot; rate, I think it says better what I really wanted to know.&lt;/p&gt;&#xA;" OwnerUserId="4248" LastEditorUserId="33" LastEditDate="2015-11-19T18:52:45.693" LastActivityDate="2015-11-19T18:52:45.693" Title="Is 802.11 bitrate symmetric?" Tags="|wireless|ieee-802.11|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6225" PostTypeId="2" ParentId="6223" CreationDate="2014-02-10T10:05:46.333" Score="-3" Body="&lt;p&gt;It will be capped by the device in use, if your network card only supports 300Mbps per second then you will never get faster than that to that device.&#xA;Wireless transfer rates are symmetric and will always negotiate to the highest rate supported by both devices.&lt;/p&gt;&#xA;" OwnerUserId="3824" LastActivityDate="2014-02-10T10:05:46.333" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6227" PostTypeId="2" ParentId="6223" CreationDate="2014-02-10T14:07:49.507" Score="11" Body="&lt;p&gt;This entirely depends on the chipset in your device, as not all of them have equal capabilities on Tx/Rx rates.  I personally have found no better resources than &lt;a href=&quot;https://wikidevi.com/wiki/Main_Page&quot;&gt;wikidevi.com&lt;/a&gt; for looking up the capabilities of wireless network adapters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand wireless that is 802.11n or newer, you need to understand the shorthand often used in their technical capabilities, namely AxB:C. A represents the number of Tx radio chains are available to the device, B represents the number of Rx radio chains, and C represents the number of spatial streams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A device will need to have a number of antennas equal to the highest of either A or B to make use of its capabilities (i.e. I have seen a 3x3:3 adapter in a laptop with only two antennas and in such a case it will operate no better than a 2x2:2 device).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can never have more spatial streams than you have either Tx or Rx radio chains (i.e. you need at least one radio chain to make use of a spatial stream).  You can however have more radio chains than spatial streams, and in these cases they can provide other benefits (resistance to interference, extended range, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To your specific question, I know of several Intel wireless chipsets that do not have equal capabilities on Tx and Rx.  The &lt;a href=&quot;https://wikidevi.com/wiki/Intel_WiFi_Link_5100_%28abgn,_full_size%29&quot;&gt;Intel 5100&lt;/a&gt; is an example of a 1x2:2 network adapter. This device can transmit up to 150Mbps and receive data up to 300Mbps.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(&lt;strong&gt;Edit&lt;/strong&gt;: I was mistaken in the second device as I thought it was a 2x3:3, but when I looked at it again, it is a 2x3:2 so correcting that here.) The &lt;a href=&quot;https://wikidevi.com/wiki/Intel_Wireless_WiFi_Link_4965AGN&quot;&gt;Intel 4965AGN&lt;/a&gt; is an example of a 2x3:2 device.  While this device can transmit and receive up to 300Mbps, its actual Rx performance will tend to be better than the Tx due to the added capabilities the extra Rx radio chain provide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also believe I have seen other vendors with this type of lopsided Tx/Rx configuration as well, I just don't remember example chipsets off hand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your second question, the data rate used by Tx on the device and Tx on the AP can never exceed the capabilities of either device.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-02-10T14:44:19.003" LastActivityDate="2014-02-10T14:44:19.003" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6231" PostTypeId="1" CreationDate="2014-02-10T18:48:24.703" Score="8" ViewCount="9075" Body="&lt;p&gt;I understand the basic use of SNMP where you manage and monitor switch, routers,etc. features using IP network. I also understand there are MIBs for SNMP based on RFCs like 2981, 3289, 3376, etc. However, recently I heard from couple of customers talking about private MIBs and it seemed like they were really interested in it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question(s):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Can somebody explain to me what are private MIBs? Why would somebody be interested in it?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are there private MIBs equivalent for MIBs based on RFCs? For example, is there something like a private MIB for RFC 2981 MIB?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3282" LastActivityDate="2014-02-14T05:07:59.080" Title="What are private MIBs and how they are different from RFC based MIBs" Tags="|snmp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6232" PostTypeId="2" ParentId="6231" CreationDate="2014-02-10T19:05:15.817" Score="10" Body="&lt;p&gt;Private MIBs are usually vendor specific. They contain additional information for their specific equiment which cannot be provided through RFC-defined MIBs. This way the vendor can provide more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your second question: sometimes vendors provide both: the RFC-defined MIB contains all that can be contained there (so most software using these MIBs can use it) and the private MIB contains the additional data (and sometimes the RFC-defined data as well). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically it's all up to the vendor to put in the MIB what he deems useful, but it's very useful to use the RFC-defined MIBs where possible so many tools can use it out of the box.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-02-10T19:05:15.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6233" PostTypeId="2" ParentId="6222" CreationDate="2014-02-10T20:07:06.643" Score="1" Body="&lt;p&gt;With the Sonicwall Enhanced OS you can define Address Objects and Service objects to make management much simpler.  First, make sure your host or server is listed as an Address Object under Network -&gt; Address Objects.  Then move on to Network -&gt; Services to add your services you wish to route.  Note that you can add individual services and put them into groups.  This makes it simpler to route items based on individual ports or port groups.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once your Address Object and Services are ready, go to the Firewall-&gt;Access Rules and make sure you Allow the service(s) you wish to route from the WAN to LAN zones.  Now that you've allowed the traffic you can go to Network -&gt; NAT policies and click Add at the top.  Here you will use the Address Object and Service/Service group that you created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GnCNi.png&quot; alt=&quot;Sample NAT Policy&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above you see that the source is ANY allowing all external IPs, the Translated Source keeps the original information, the Original destination is your WAN IP of your WAN interface, the Translated Destination is your target host, and the Original Service is the ports you wish to map to that target server.  You can translate the services if you like, for instance routing port 3390 to 3389 for RDP on a machine to avoid registry hacks but ensure you have a reverse rule enabled for the outbound path.  You can also define which interfaces this policy is bound to if you like, so for your example the Inbound would be x1 and Outbound x5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should allow you to point to your external IP for these services via x.x.x.x:port and route to the target server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the internal routing under Network--&gt;Zones choose LAN and check the box for Allow Interface Trust. This should allow traffic to flow between interfaces. Keep in mind this does open all LAN interfaces to share traffic so any segmentation that is currently configured may be broken. If you do not wish for all traffic to be trusted between interfaces then do not use this option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For specific LAN routing you can manually add a route from x5 subnet to x0 subnet over any service with the local gateway (0.0.0.0) and use the x0 interface.  If you wish to route directly to an individual host then select it as your Destination instead of the x5 Subnet.  Make sure that there is a converse rule to allow traffic from that host to the x0 subnet as well.&lt;/p&gt;&#xA;" OwnerUserId="4006" LastEditorUserId="4006" LastEditDate="2014-02-12T13:55:42.807" LastActivityDate="2014-02-12T13:55:42.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6237" PostTypeId="1" AcceptedAnswerId="6249" CreationDate="2014-02-11T09:15:53.180" Score="7" ViewCount="13135" Body="&lt;p&gt;I have a customer that for various reasons has a Cisco router sitting behind a NATed ADSL connection. They want to create a VPN to one of our points of presence and the only options we offer are site to site or L2TP dial in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to configure their Cisco (3925) to connect via L2TP to our PoP? The L2TP server is a pair of Fortigate 100Ds and the configuration allows iPads, laptops, etc to dial in no problem, protected by IPSEC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm testing this in my office with a 1921, the few references I've found indicate using a pseudowire setup is necessary, but I'm having trouble with getting that up, and where IPSEC fits into it.&lt;/p&gt;&#xA;" OwnerUserId="2341" LastEditorUserId="619" LastEditDate="2014-02-11T20:46:18.947" LastActivityDate="2014-02-12T05:13:55.763" Title="Using a Cisco router as an L2TP client?" Tags="|cisco|vpn|cisco-ios|ipsec|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6238" PostTypeId="1" CreationDate="2014-02-11T11:56:31.087" Score="4" ViewCount="256" Body="&lt;p&gt;Consider the topology below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;---&amp;gt; traffic flow direction ---&amp;gt; &#xA;---&amp;gt; PE-1-----P1-----P2-----PE-2 ---&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here PE-1 is the ingress LER and PE-2 is the egress LER. P1 and P2 are LSRs. Now say PHP, (&lt;a href=&quot;http://en.wikipedia.org/wiki/Penultimate_hop_popping&quot; rel=&quot;nofollow&quot;&gt;Penultimate Hop Popping&lt;/a&gt;) is enabled in these routers. P2 is Pen-Ultimate-Hop here; hence P2 pops the last label (assumming Label-Stack depth is only 1) and sends an IP-Packet to PE-2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can PE-2 distinguish between traffic arriving via MPLS-LSP and traffic which is not coming via MPLS-LSP?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="3193" LastEditorUserId="3191" LastEditDate="2014-02-14T15:03:22.307" LastActivityDate="2014-02-14T15:03:22.307" Title="If PHP is enabled, can Egress LER distinguish if a packet has arrived via MPLS-LSP or not?" Tags="|mpls|php|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6239" PostTypeId="1" CreationDate="2014-02-11T12:09:05.397" Score="9" ViewCount="6398" Body="&lt;p&gt;I have a certain number of packets dropped on my 10gb/s interface, on Cisco 6500 with Sup 720.  You can see underneath the number of dropped packet within a minute, after I cleared the counters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We don't see any performance degradation, and none of our customers complained.&#xA;Is this going to be a serious problem in future?  I've never seen a single packet in the queue.  I'm considering changing the input queue size to 1024 because it is 75 packet in the queue by default, but I'm wondering why packets don't enter in the queue at all before being dropped.  On 1gb/s interfaces I don't see any dropped packets at all and everything is fine.  Please help me resolve the problem with queue drops.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh int TenGigabitEthernet1/1&#xA;&#xA; Hardware is C6k 10000Mb 802.3, address is 000f.3589.ac00 (bia 000f.3589.ac00)&#xA;  Description: transit &#xA;  Internet address is 192.0.2.1/24&#xA;  MTU 1500 bytes, BW 10000000 Kbit, DLY 10 usec,&#xA;     reliability 255/255, txload 84/255, rxload 3/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not set&#xA;  Full-duplex, 10Gb/s&#xA;  input flow-control is off, output flow-control is off&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:00, output 00:00:01, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 00:00:40&#xA;  Input queue: 0/75/8097/0 (size/max/drops/flushes); Total output drops: 0  &amp;lt;-----&#xA;                    ^^^^&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 138646000 bits/sec, 99380 packets/sec&#xA;  5 minute output rate 3321988000 bits/sec, 329345 packets/sec&#xA;  L2 Switched: ucast: 158 pkt, 51401 bytes - mcast: 0 pkt, 0 bytes&#xA;  L3 in Switched: ucast: 4120795 pkt, 695621509 bytes - mcast: 0 pkt, 0 bytes mcast&#xA;  L3 out Switched: ucast: 13774697 pkt, 17424995312 bytes mcast: 0 pkt, 0 bytes&#xA;     3484933 packets input, 608041136 bytes, 0 no buffer&#xA;     Received 0 broadcasts (0 IP multicasts)&#xA;     0 runts, 40 giants, 0 throttles&#xA;     8097 input errors, 7120 CRC, 894 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     11742838 packets output, 14837984934 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4262" LastEditorUserId="775" LastEditDate="2014-02-11T12:19:31.790" LastActivityDate="2014-02-13T01:22:57.430" Title="packet drop on 10gb/s interface" Tags="|cisco|cisco-6500|packet-loss|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6240" PostTypeId="2" ParentId="6239" CreationDate="2014-02-11T12:33:04.343" Score="4" Body="&lt;p&gt;I see this in your output: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8097 input errors, 7120 CRC, 894 frame, 0 overrun, 0 ignored&#xA;^^^^               ^^^^      ^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means you could have a faulty network interface card (NIC), cable, or driver.&lt;/p&gt;&#xA;" OwnerUserId="3421" LastEditorUserId="775" LastEditDate="2014-02-12T11:11:50.210" LastActivityDate="2014-02-12T11:11:50.210" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6242" PostTypeId="5" CreationDate="2014-02-11T14:57:32.740" Score="0" Body="&lt;p&gt;Penultimate Hop Popping.  Use this tag for issues centered on Penultimate-Hop-Popping in an MPLS network.  Do not merely tag a question with PHP because MPLS is involved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This tag should not to be confused with the more famous &lt;a href=&quot;http://en.wikipedia.org/wiki/PHP&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;PHP Language&quot;&gt;PHP programming language&lt;/a&gt;. Programming questions about this language are off-topic, but might be asked on our sister site &lt;a href=&quot;https://stackoverflow.com&quot;&gt;Stack Overflow&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="31801" LastEditDate="2018-11-17T10:31:27.750" LastActivityDate="2018-11-17T10:31:27.750" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6243" PostTypeId="4" CreationDate="2014-02-11T14:57:32.740" Score="0" Body="Penultimate Hop Popping.  Use this tag for issues centered on Penultimate-Hop-Popping in an MPLS network.  Do not merely tag a question with PHP because MPLS is involved. Programming questions about the (unrelated) PHP language are off-topic but might be asked on Stack Overflow." OwnerUserId="49" LastEditorUserId="31801" LastEditDate="2018-11-17T10:31:32.583" LastActivityDate="2018-11-17T10:31:32.583" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6246" PostTypeId="2" ParentId="6239" CreationDate="2014-02-11T20:42:52.637" Score="11" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm wondering why packets don't enter in the queue at all before being dropped.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because they were errors: &lt;code&gt;8097 input errors, 7120 CRC, 894 frame&lt;/code&gt;  It will not queue a packet that wasn't received properly -- or wasn't received completely (input queue is in software, you can still overrun the hardware queue, which you cannot change)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-02-11T20:42:52.637" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6248" PostTypeId="2" ParentId="6238" CreationDate="2014-02-11T22:48:40.757" Score="-2" Body="&lt;p&gt;Yes. First, the packet will arrive in an L2 PDU that does have a label or does not have a label. Second, the egress LSR will also know what labels it has distributed for what LSPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: For completeness and to further clarify for this particular example, the egress LSR would assign a null label for that particular LSP signalling to the penultimate node to pop that label and forward it to the egress LSR. If for some reason it received a packet with a label when it had signalled an implicit null (misconfig, forging of the PDU, etc.), like in this PHP example, in most cases it would forward it for an LSP corresponding to that label if it had that label. If it did not assign an LSP corresponding to that label, it would drop it.&lt;/p&gt;&#xA;" OwnerUserId="4276" LastEditorUserId="4276" LastEditDate="2014-02-11T22:59:54.257" LastActivityDate="2014-02-11T22:59:54.257" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6249" PostTypeId="2" ParentId="6237" CreationDate="2014-02-12T05:13:55.763" Score="8" Body="&lt;p&gt;Sure, it's certainly possible. Basically, you'll need to setup a crypto map to catch and encrypt the L2TP traffic. The psuedowire\L2TP config can be attached to a Virtual-PPP interface. Here's a config snippet that should get you going. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Basic ISAKMP\IPSec configuration, tweak as needed. &#xA;!&#xA;crypto isakmp policy 10&#xA; encr 3des&#xA; authentication pre-share&#xA; group 2&#xA; lifetime 4000&#xA;!&#xA;crypto isakmp key *preshared key* address 1.2.3.4&#xA;!&#xA;crypto ipsec transform-set ESP-AES256-SHA1 esp-aes 256 esp-sha-hmac&#xA; mode transport&#xA;!&#xA;! Crypto map that will catch our L2TP Traffic defined in the L2TP_TRAFFIC ACL.&#xA;!&#xA;crypto map L2TP_VPN 10 ipsec-isakmp&#xA; set peer 1.2.3.4&#xA; set transform-set ESP-AES256-SHA1&#xA; match address L2TP_TRAFFIC&#xA;!&#xA;! Match the L2TP traffic.&#xA;!&#xA;ip access-list extended L2TP_TRAFFIC&#xA; permit udp host *Outbound IP* eq 1701 host 1.2.3.4 eq 1701&#xA;!&#xA;! Apply the crypto map to the outbound\internet facing interface. &#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.1.2 255.255.255.0&#xA; crypto map L2TP_VPN&#xA;!&#xA;! Define the psuedowire class that will speak L2TP and the source interface. &#xA;!&#xA;pseudowire-class L2TP_PW&#xA; encapsulation l2tpv2&#xA; ip local interface FastEthernet0/0&#xA;!&#xA;! Create Virtual-PPP interface to bind the psuedowire class to. &#xA;!&#xA;interface Virtual-PPP1&#xA; description L2TP Tunnel&#xA; ip address negotiated&#xA; ppp chap hostname *User Name*&#xA; ppp chap password *Password*&#xA; ppp ipcp address accept&#xA; pseudowire 1.2.3.4 1 pw-class L2TP_PW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll also need to add in relevant NAT and\or routing for your scenario. &lt;/p&gt;&#xA;" OwnerUserId="4180" LastActivityDate="2014-02-12T05:13:55.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6251" PostTypeId="1" AcceptedAnswerId="6253" CreationDate="2014-02-12T09:22:25.667" Score="1" ViewCount="235" Body="&lt;p&gt;In a typical enterprise network, the NAT router has inside and outside interfaces, the inside interface is connected to the LAN and the outside interface is connected to the ISP. Is the NAT router connected directly to the ISP router or it is connected to a T1 ISP circuit before it reaches the ISP backbone/core network?&lt;/p&gt;&#xA;" OwnerUserId="4211" LastActivityDate="2014-02-12T12:25:18.123" Title="Where does the NAT router connect to?" Tags="|cisco|nat|isp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6252" PostTypeId="2" ParentId="6251" CreationDate="2014-02-12T09:26:05.857" Score="0" Body="&lt;p&gt;Depends on your ISP or what kind of Internet connection you have. Mostly it can be you are connected to a switch -&gt; ISP router.&lt;/p&gt;&#xA;" OwnerUserId="2866" LastActivityDate="2014-02-12T09:26:05.857" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6253" PostTypeId="2" ParentId="6251" CreationDate="2014-02-12T12:25:18.123" Score="5" Body="&lt;p&gt;Routers are layer-3 devices. They communicate with other layer-3 devices (routers, NAT devices, layer-3 firewalls etc.) over layer-2 infrastructure (T1, ethernet etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP networks can be quite complex. Here in The Netherlands we have many DSL connections like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Customer edge router (can be a NAT device) connects using PPPoA (over ATM/ADSL) to a DSLAM&lt;/li&gt;&#xA;&lt;li&gt;The DSLAM converts PPPoA (over ATM/DSL) to PPPoE (over Ethernet)&lt;/li&gt;&#xA;&lt;li&gt;The traffic probably travels over several ethernet switches to the ISP's edge&lt;/li&gt;&#xA;&lt;li&gt;A BRAS (Broadband Remote Access Server) at the ISP terminates the PPP connection and routes the traffic to the ISP's core network&lt;/li&gt;&#xA;&lt;li&gt;The core network brings the traffic to the transit and peering routers of the ISP&lt;/li&gt;&#xA;&lt;li&gt;These routers speak BGP to arrange routing with other ISPs and networks&lt;/li&gt;&#xA;&lt;li&gt;Etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But for enterprise networks it is also common to connect directly over ethernet to the ISP. Maybe speaking BGP between the ISP and the enterprise.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-02-12T12:25:18.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6254" PostTypeId="1" AcceptedAnswerId="6257" CreationDate="2014-02-12T14:51:52.110" Score="2" ViewCount="2167" Body="&lt;p&gt;I have a tz 205 wireless - n running Sonic Enhanced 5.8.1.9-38o&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to set it up so that it broadcasts an additional SSID that I can use for guests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've followed step by step the instructions listed in the &lt;a href=&quot;http://www.sonicwall.com/us/en/support/2213.html?fuzeurl=http://www.fuzeqna.com/sonicwallkb/ext/kbdetail.aspx?kbid=5798&quot; rel=&quot;nofollow&quot;&gt;Sonicwall KB5798 article&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When completed I was expecting it to broadcast the SSID Intern and I've tested and cannot any devices to recognize the new SSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, When I look at the Wireless &gt; Status, Wireless Guest Services is listed as disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure where I am going wrong.&lt;/p&gt;&#xA;" OwnerUserId="4282" LastEditorUserId="775" LastEditDate="2014-02-12T18:48:53.527" LastActivityDate="2014-02-12T19:28:33.183" Title="Sonicwall TZ 205W - setup guest wireless network / alternate wireless SSID" Tags="|wireless|sonicwall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6257" PostTypeId="2" ParentId="6254" CreationDate="2014-02-12T18:38:51.990" Score="1" Body="&lt;p&gt;I am still not sure why it did't work, but after messing up my primary WLAN, I reset my sonicwall back to factory, went through the wizard and &quot;added another wireless network&quot; after my primary and I've accomplished my goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now have my primary WLAN for employees and an alternate SSID to give to guests that we can change as needed.&lt;/p&gt;&#xA;" OwnerUserId="4282" LastEditorUserId="4282" LastEditDate="2014-02-12T19:28:33.183" LastActivityDate="2014-02-12T19:28:33.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6258" PostTypeId="1" AcceptedAnswerId="6259" CreationDate="2014-02-12T19:57:56.643" Score="5" ViewCount="5395" Body="&lt;h3&gt;Background&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I recently upgraded a pair of Catalyst4500s from Sup6E to Sup7E.  Before the upgrade, I pre-loaded IOS-XE 3.4.1SG on the Sup7Es, and loaded the migration configurations into &lt;code&gt;bootflash:&lt;/code&gt; on the new sups.  We needed to perform the upgrade as quickly as possible; and I had only a few hours between the time I cut the tape on the shipping boxes and putting the new Sup7Es into production.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After pulling the old Sup6s out, I started maintenance with one Sup7E in each chassis running 3.4.1SG (which I had pre-loaded); the other two Sup7Es were left on 3.2.2SG to conserve time while I prepared for maintenance.  I manually copied 3.4.1SG to &lt;code&gt;slavebootflash:&lt;/code&gt; and reloaded when I inserted the standby supervisors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FWIW, copying IOS to &lt;code&gt;slavebootflash:&lt;/code&gt; is much faster than copying with tftp on these Sup7Es.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Maintenance window results&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I had a strange result by the end of the maintenance window:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Both Sup7E OOB mgmt interfaces on &lt;code&gt;sw1&lt;/code&gt; operated in &lt;code&gt;mgmtVrf&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;One Sup7E OOB mgmt interface on &lt;code&gt;sw2&lt;/code&gt; operated in &lt;code&gt;Mgmt-vrf&lt;/code&gt; (this one was ACTIVE)&lt;/li&gt;&#xA;&lt;li&gt;The other Sup7E OOB mgmt interface on &lt;code&gt;sw2&lt;/code&gt; operated in &lt;code&gt;mgmtVrf&lt;/code&gt; (this one was STANDBY)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Somehow three out of the four new Sup7Es came up with &lt;code&gt;mgmtVrf&lt;/code&gt; on the OOB FastEthernet1 interface, but one was stuck with &lt;code&gt;Mgmt-vrf&lt;/code&gt;.  I could not find a way to change &lt;code&gt;Mgmt-vrf&lt;/code&gt; -&gt; &lt;code&gt;mgmtVrf&lt;/code&gt;, or &lt;code&gt;mgmtVrf&lt;/code&gt; to &lt;code&gt;Mgmt-vrf&lt;/code&gt;.  During my attempts to get consistent management VRFs inside my maintenance window, one of the supervisors went lights-out and crashed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end of maintenance, I was: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Running out of time&lt;/li&gt;&#xA;&lt;li&gt;Hesitant to keep putting time into this, because it took over five minutes each time I booted IOS-XE on Sup7E&lt;/li&gt;&#xA;&lt;li&gt;Unwilling to risk a config mismatch between Sup7E ACTIVE / STANDBY oob FastEthernet1 (every time I saw this during the maintenance window, I could not successfully fail from ACTIVE -&gt; STANDBY, and still ping FastEthernet1).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Lab work&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Thus, I decided to take sw2 STANDBY Sup7E to our lab to try to fix it, hoping that I'd be able to replicate how I managed to get the others into &lt;code&gt;mgmtVrf&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my attempts to get sw2 STANDBY FastEth1 into &lt;code&gt;Mgmt-vrf&lt;/code&gt; in IOS-XE 3.4.1SG, I've had no luck with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Copying a new config with &lt;code&gt;Mgmt-vrf&lt;/code&gt; from &lt;code&gt;bootflash:&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;tftping a new startup-config with &lt;code&gt;Mgmt-vrf&lt;/code&gt; into &lt;code&gt;nvram:&lt;/code&gt; and reloading&lt;/li&gt;&#xA;&lt;li&gt;tftping a new running-config with &lt;code&gt;Mgmt-vrf&lt;/code&gt; into the sup&lt;/li&gt;&#xA;&lt;li&gt;Changing the config to use &lt;code&gt;Mgmt-vrf&lt;/code&gt; while the switch is running&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Question&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;How can I reconfigure this supervisor to use &lt;code&gt;Mgmt-vrf&lt;/code&gt;, or reconfigure the other supervisor to use &lt;code&gt;mgmtVrf&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Console log from sw2&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This is what I see when I boot 3.4.1SG on the misbehaving supervisor.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% Use 'vrf definition mgmtVrf' command&#xA;% Management interface VRF can not be changed.&#xA;&#xA;... more console output here&#xA;&#xA;Interface FastEthernet1's vrf mgmtVrf does not match with cfg vrf Mgmt-vrf     &#xA;&#xA;&#xA;Press RETURN to get started!&#xA;&#xA;sw2#show mod | i SUP7&#xA; 3     4  Sup 7-E 10GE (SFP+), 1000BaseX (SFP)   WS-X45-SUP7-E      CAT12345678&#xA;sw2#&#xA;sw2#sh ver | i Software                                                 &#xA;Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software &#xA;(cat4500e-UNIVERSALK9-M), Version 03.04.01.SG RELEASE SOFTWARE (fc3)&#xA;sw2#&#xA;sw2# &#xA;sw2#sh ip vrf                                                           &#xA;  Name                             Default RD          Interfaces        &#xA;  Liin-vrf                         &amp;lt;not set&amp;gt;                                   &#xA;  Mgmt-vrf                         &amp;lt;not set&amp;gt;                                                    &#xA;  mgmtVrf                          &amp;lt;not set&amp;gt;           Fa1    &amp;lt;---------&#xA;sw2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-02-12T19:57:56.643" Title="Catalyst4500 Sup7E &quot;mgmtVrf&quot; vs &quot;Mgmt-vrf&quot;" Tags="|cisco|switch|cisco-catalyst|management|vrf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6259" PostTypeId="2" ParentId="6258" CreationDate="2014-02-12T19:57:56.643" Score="5" Body="&lt;p&gt;Documenting to help future googlers, since I could find no information about &lt;code&gt;Mgmt-vrf&lt;/code&gt; online...  I managed to find the solution while I was typing the question above.  I remembered that the Sup7Es had IOS-XE 3.2.2 loaded when I pulled them out of the boxes; the other important fact was that 3.2.2 would not turn up the OOB interface on FastEthernet1 while I was staging / licensing the supervisors.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Solution&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;First I loaded 3.2.2 on the switch again, and booted into it.  Then I did a &lt;code&gt;wr erase&lt;/code&gt; to zero &lt;code&gt;nvram&lt;/code&gt; and reloaded.  When the switch rebooted &lt;code&gt;mgmtVrf&lt;/code&gt; was gone :-).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh ip vrf                                                               &#xA;  Name                             Default RD          Interfaces              &#xA;  Liin-vrf                         &amp;lt;not set&amp;gt;                                   &#xA;  Mgmt-vrf                         &amp;lt;not set&amp;gt;           Fa1                     &#xA;Switch#sh ver | i Software                                                     &#xA;Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software &#xA;(cat4500e-UNIVERSAL-M), Version 03.02.02.SG RELEASE SOFTWARE (fc3)                      &#xA;Switch#&#xA;Switch#sh bootflash: | i SG                                                    &#xA;  1   87674776 Feb 12 2014 18:56:05 +00:00 cat4500e-universal.SPA.03.02.02.SG.1&#xA;50-2.SG2.bin                                                                   &#xA;  2  125216116 Feb 06 2014 17:13:26 +00:00 cat4500e-universalk9.SPA.03.04.01.SG&#xA;.151-2.SG1.bin                                                                 &#xA;Switch#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I did a second &lt;code&gt;wr e&lt;/code&gt; just to be sure, and loaded 3.4.1SG again to check which VRFs came up by default in 3.4.1SG.  As one might suspect, some crazy person at Cisco renamed the management interfaces between IOS releases (probably because they were scolded for using a non-standard oob vrf name, since every other Cisco I can think of uses &lt;code&gt;mgmtVrf&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh ver | i Software                                                     &#xA;Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch Software (cat4500e&#xA;-UNIVERSALK9-M), Version 03.04.01.SG RELEASE SOFTWARE (fc3)                    &#xA;Switch#sh ip vrf                                                               &#xA;  Name                             Default RD          Interfaces              &#xA;  Liin-vrf                         &amp;lt;not set&amp;gt;                                   &#xA;  mgmtVrf                          &amp;lt;not set&amp;gt;           Fa1                     &#xA;Switch# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now the path to fixing this is clear.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-02-12T19:57:56.643" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6260" PostTypeId="1" AcceptedAnswerId="29248" CreationDate="2014-02-12T21:04:28.897" Score="0" ViewCount="1060" Body="&lt;p&gt;I'm giving you a high-level overview of my problem, no tech details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to know how to solve this problem.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem Effect #1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We got a Netapp replacing another NAS. The Netapp is connected to our Enterasys/Extreme network gear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since we have the Netapp we have managed to create trouble in the network several times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Meaning: When performing the following kind of transfers to or from the Netapp:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;lots of data&lt;/li&gt;&#xA;&lt;li&gt;transfer not necessarily fast (sometimes only 10MB/s = 100Mb/s)&lt;/li&gt;&#xA;&lt;li&gt;NFS or Networker (backup/restore) traffic&lt;/li&gt;&#xA;&lt;li&gt;potentially lots of small files (NFS) but also large binary streams (NDMP)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;it seems to have had an effect on our firewalls (VRRP cluster) such that they start failing over because VRRP HELLO packets are getting lost, potentially on every VLAN, not only on the ones where the Netapp is connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even when keeping the Netapp &amp;lt;-&gt; backup/whatever traffic to the same L2 segment this happens. What could still be involved at that layer? &lt;strong&gt;It does not happen always or often, but often enough to indicate a problemm.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking about the buffering of the switches maybe posing problems? Can that even be? What would happen in those cases, would packets really get lost or would everything just be slower?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I solve this problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem Effect #2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FDB on the switches gets messed up: After a quick MASTER/BACKUP flap of the firewalls, the VRRP MAC is seen as indicated by the red arrows on the attached diagram (for some VLANs). So it's sending packets for that address in a loop I guess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I then issue a manual spanning tree flap by disconnecting one of the redundant links (the dotted lines leaving the datacenter switches) everything goes back to normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that in the meantime the setup is even simpler, the Netapp and test server connected to the same switch, still same effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MRoqH.png&quot; alt=&quot;network diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In general&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I said there are no routing protocols because we don't use much routing, it's reasonable to do so here. We also don't use gvrp and such. Putting wrong vlans on one end of the link and then have it automagically appear on the other end is no automatism I desire.&#xA;But that is another discussion. We may chat about it, sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I had errors to show you I would. But then I would probably be able to fix it myself. Since I have nothing so far, I am asking. I can merely notice the effect of something and am looking for potential causes. Switch CPU is already nice and next time I will take a live look. What about the buffering inside the switches? Can that be a factor?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you done some research before asking the question?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Yes, to no avail, that's why am here. I sniffed, I analysed the config, I re-read the operating manuals. Nothing.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you explained what you've already tried to solve your problem?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As I said we found that there has never been a problem as long as the new NAS wasn't there. Sure, this invites speculation. &lt;strong&gt;But good system administrators often operate by their guts in order to localize problems.&lt;/strong&gt; I don't think I'm a bad admin, but my guts don't lead me anywhere here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I have set up a lab with one of our core switches isolated with only the NAS and a server on one VLAN and two PC pinging each other on another VLAN while the server and the NAS happily copy files to each other. Tomorrow I will see if there was packet loss on the PCs. However this is by far no simulation of a larger network.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you explained why this question is important for you to resolve?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Well, having the network firewalls down is not nice.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you provided some relevant context about the needs of the business environment and/or software applications that you're supporting?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When someone performs a major transfer to or from the NAS, that should have no impact on the rest of the network. Those transfers need not be &quot;major&quot; by the way to cause problem, as I explained.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you included a diagram of the problem (especially if it involves more than two devices)?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you insist I can do that, but the whole network is quite complicated. But it's a standard enterprise network, with core, distribution and edge. Some spanning tree, some routers, some firewalls. No routing protocols whatsoever. We prefer to remain in control. ;-)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are you sure you've provided enough details such as operating systems, addresses, protocols, link types, link speeds, or interface names?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Probably not. The NAS has a 10G card. However the problem also arises when it is connected with the 1GbE interface only.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you included information about what manuals or reference material you consulted when trying to resolve your question?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;No, because aside from the install and config manuals of the items involved I currently wouldn't know where to look, as I pointed out.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you specified which hardware you're using, including firmware version numbers?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It's a Netapp FAS2240 with Release 8.2P3 7-Mode. The switches are Enterasys G-Series.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If your question includes a configuration, have you checked that it's correctly formatted?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;No config for now.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you included relevant details about timing, syslog, or application log entries?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When the firewalls flap we can't rely on anything pretty much anymore. But as I said the local firewall logs as well as local tcpdump clearly show VRRP HELLOs missing.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If your configuration results in an error, have you included the exact error, as well as any tracebacks?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Yes, the VRRP HELLOs get missing on VLANs independent from the NAS' VLAN therefore causing trouble with the firewalls.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If your question doesn't include a configuration, are you sure the configurations are not required? Hint: most people will want to see configurations even if you think they aren't necessary&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What part would you like to see?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If your configuration produces different results to what you expected, have you stated what you expected, why you expected it, and the actual results?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What configuration would be required? The NAS, the firewalls, the whole network?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you checked that your question looks reasonable in terms of formatting?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have and it is.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you checked the spelling and grammar to the best of your ability?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you read the whole question to yourself carefully, to make sure it makes sense and contains enough information for someone coming to it without any of the context that you already know?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm sorry if it seems to broad but I need a few shots in the dark here as I said.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="2329" LastEditDate="2014-02-13T13:22:14.603" LastActivityDate="2016-04-02T21:17:28.927" Title="Switch: packets lost with certain? traffic" Tags="|troubleshooting|packet-loss|san|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6261" PostTypeId="2" ParentId="6239" CreationDate="2014-02-13T01:22:57.430" Score="4" Body="&lt;p&gt;CRC errors tend to indicate a problem with the signal as it crosses the medium between devices.  Where 1G was often much more resilient to minor issues, 10G can be very particular about the medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For copper connections, this could indicate some sort of interference bleeding into the wire if you are not using shielded cable, or a problem with ground in shielded cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For fiber, I have come across errors a number of times, and the most common cause in my experience is that no one had or used a proper fiber kit to clean the fiber (transceivers, cables, and infrastructure) when making connections.  This is true even with brand new cables (and sometimes more so).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A fiber scope can be very useful for this process, as it will allow you to verify that the surfaces are clean and free of any defect (scratches, etc) prior to making the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As has been indicated in other answers and comments, check that your Rx signal is well within acceptable margins (not too strong or too weak) if your hardware supports it.  If nothing else suggested fixes it, then look at swapping out the transceivers and cables if possible (remember to clean again if you do so).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-02-13T01:22:57.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6262" PostTypeId="1" AcceptedAnswerId="6281" CreationDate="2014-02-13T06:56:47.657" Score="3" ViewCount="8288" Body="&lt;p&gt;If an organization in a city (perhaps New York) has multiple offices within that city, how would they interconnect their LANs? I already understand that they will connect to an ISP, but my question is: Does a MAN travel across the internet to connect their networks where they have routers running eBGP?&lt;/p&gt;&#xA;" OwnerUserId="4211" LastEditorUserId="8499" LastEditDate="2018-03-22T17:34:43.547" LastActivityDate="2021-01-31T10:05:35.013" Title="How do Metropolitan Area Networks (MAN) interconnect?" Tags="|cisco|routing|bgp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6263" PostTypeId="2" ParentId="6262" CreationDate="2014-02-13T07:30:01.153" Score="-2" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/lccMt.jpg&quot; alt=&quot;enter image description here&quot;&gt;From techopedia - It does establish it connection through an ISP so it travels the internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Metropolitan Area Network (MAN)&#xA;Definition - What does Metropolitan Area Network (MAN) mean?&#xA;A metropolitan area network (MAN) is similar to a local area network (LAN) but spans an entire city or campus. MANs are formed by connecting multiple LANs. Thus, MANs are larger than LANs but smaller than wide area networks (WAN). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;MANs are extremely efficient and provide fast communication via high-speed carriers, such as fiber optic cables.&lt;/p&gt;&#xA;" OwnerUserId="4211" LastEditorUserId="4211" LastEditDate="2014-02-13T13:39:12.740" LastActivityDate="2014-02-13T13:39:12.740" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6265" PostTypeId="1" CreationDate="2014-02-13T09:55:09.360" Score="3" ViewCount="1393" Body="&lt;p&gt;What does Local mean in this output?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4#show ip bgp 10.6.0.0/24  &#xA;BGP routing table entry for 10.6.0.0/24, version 19  &#xA;Paths: (1 available, best #1, table Default-IP-Routing-Table)  &#xA;  Advertised to update-groups:  &#xA;        2  &#xA;  **Local**    192.168.0.6 (metric 156160) from 192.168.0.5 (192.168.0.5)  &#xA;      Origin IGP, metric 0, localpref 100, valid, internal, best  &#xA;      Originator: 192.168.0.6, Cluster list: 192.168.0.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4291" LastEditorUserId="49" LastEditDate="2014-02-13T12:06:35.043" LastActivityDate="2016-10-11T17:16:02.203" Title="Local in show ip bgp output" Tags="|cisco|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6266" PostTypeId="1" AcceptedAnswerId="6290" CreationDate="2014-02-13T10:32:08.847" Score="8" ViewCount="1066" Body="&lt;p&gt;We have several embedded pcs on farms in the UK and US.  Among other connections these talk to our server sending a small packet of data (100 - 600 bytes) every 20 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Over DSL this is fine.  Over satellite connections, we lose most of the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're using TCP, and tcpdump on the client shows the sequence:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-&amp;gt; syn                   (send)&#xA;&amp;lt;- syn ack               (receive)&#xA;-&amp;gt; ack&#xA;-&amp;gt; push ack&#xA;&amp;lt;- ack                   (spoofed?)&#xA;-&amp;gt; fin ack&#xA;&amp;lt;- ack                   (spoofed?)&#xA;&amp;lt;- fin ack&#xA;-&amp;gt; ack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The server, however, sees:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;- syn                   (receive)&#xA;-&amp;gt; syn ack               (send)&#xA;&amp;lt;- ack&#xA;&amp;lt;- fin ack&#xA;-&amp;gt; fin ack&#xA;&amp;lt;- ack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think I'm correct in saying the extra acks the client receives are spoofed by the satellite end point in order to speed up the connection&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have ~100 DSL sites and 3 satellites.  The DSL are all fine, and the satellites are all broken in the same way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's happening to the data?  It gets through maybe one time in 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;&#xA;I can ping the server from the client in question. The clients all have a reverse ssh tunnel to the server which is working fine.  We can ssh in, and also download data.  It's just this upload that has problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DSL connection - successful&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@mini2440:~ tcpdump port 1080 -vv&#xA;tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes&#xA;14:55:20.126968 IP (tos 0x0, ttl 64, id 29228, offset 0, flags [DF], proto TCP (6), length 60)&#xA;    client &amp;gt; server: Flags [S], cksum 0x1877 (incorrect -&amp;gt; 0x5ebd), seq 21640692, win 14600, options [mss 1460,sackOK,TS val 1485260760 ecr 0,nop,wscale 1], length 0&#xA;14:55:20.194124 IP (tos 0x0, ttl 51, id 0, offset 0, flags [DF], proto TCP (6), length 60)&#xA;    server &amp;gt; client: Flags [S.], cksum 0xf10a (correct), seq 4087778233, ack 21640693, win 14480, options [mss 1452,sackOK,TS val 43969567 ecr 1485260760,nop,wscale 4], length 0&#xA;14:55:20.194465 IP (tos 0x0, ttl 64, id 29229, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    client &amp;gt; server: Flags [.], cksum 0x186f (incorrect -&amp;gt; 0x3bcb), seq 1, ack 1, win 7300, options [nop,nop,TS val 1485260773 ecr 43969567], length 0&#xA;14:55:20.197225 IP (tos 0x0, ttl 64, id 29230, offset 0, flags [DF], proto TCP (6), length 403)&#xA;    client &amp;gt; server: Flags [P.], cksum 0x39c5 (correct), seq 1:352, ack 1, win 7300, options [nop,nop,TS val 1485260774 ecr 43969567], length 351&#xA;14:55:20.197564 IP (tos 0x0, ttl 64, id 29231, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    client &amp;gt; server: Flags [F.], cksum 0x186f (incorrect -&amp;gt; 0x3a6a), seq 352, ack 1, win 7300, options [nop,nop,TS val 1485260774 ecr 43969567], length 0&#xA;14:55:20.267543 IP (tos 0x0, ttl 52, id 26507, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    server &amp;gt; client: Flags [.], cksum 0x530f (correct), seq 1, ack 352, win 972, options [nop,nop,TS val 43969587 ecr 1485260774], length 0&#xA;14:55:20.271456 IP (tos 0x0, ttl 52, id 26508, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    server &amp;gt; client: Flags [F.], cksum 0x530d (correct), seq 1, ack 353, win 972, options [nop,nop,TS val 43969587 ecr 1485260774], length 0&#xA;14:55:20.271771 IP (tos 0x0, ttl 64, id 29232, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    client &amp;gt; server: Flags [.], cksum 0x186f (incorrect -&amp;gt; 0x3a46), seq 353, ack 2, win 7300, options [nop,nop,TS val 1485260789 ecr 43969587], length 0&#xA;8 packets captured&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Satellite connection - unsuccessful&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@mini2440:~ tcpdump port 1080 -vv&#xA;tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes&#xA;15:14:50.027783 IP (tos 0x0, ttl 64, id 13618, offset 0, flags [DF], proto TCP (6), length 60)&#xA;    client &amp;gt; server: Flags [S], cksum 0x1884 (incorrect -&amp;gt; 0x1b8a), seq 2040495825, win 14600, options [mss 1460,sackOK,TS val 16534499 ecr 0,nop,wscale 1], length 0&#xA;15:14:50.029731 IP (tos 0x0, ttl 63, id 0, offset 0, flags [DF], proto TCP (6), length 60)&#xA;    server &amp;gt; client: Flags [S.], cksum 0x3451 (correct), seq 51102354, ack 2040495826, win 5792, options [mss 1460,sackOK,TS val 67452903 ecr 16534499,nop,wscale 7], length 0&#xA;15:14:50.034910 IP (tos 0x0, ttl 64, id 13619, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    client &amp;gt; server: Flags [.], cksum 0x187c (incorrect -&amp;gt; 0x5d38), seq 1, ack 1, win 7300, options [nop,nop,TS val 16534500 ecr 67452903], length 0&#xA;15:14:50.036082 IP (tos 0x0, ttl 64, id 13620, offset 0, flags [DF], proto TCP (6), length 173)&#xA;    client &amp;gt; server: Flags [P.], cksum 0x8d87 (correct), seq 1:122, ack 1, win 7300, options [nop,nop,TS val 16534500 ecr 67452903], length 121&#xA;15:14:50.036351 IP (tos 0x0, ttl 64, id 13621, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    client &amp;gt; server: Flags [F.], cksum 0x187c (incorrect -&amp;gt; 0x5cbe), seq 122, ack 1, win 7300, options [nop,nop,TS val 16534500 ecr 67452903], length 0&#xA;15:14:50.037547 IP (tos 0x0, ttl 63, id 64893, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    server &amp;gt; client: Flags [.], cksum 0x790d (correct), seq 1, ack 122, win 46, options [nop,nop,TS val 67452911 ecr 16534500], length 0&#xA;15:14:50.076479 IP (tos 0x0, ttl 63, id 64894, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    server &amp;gt; client: Flags [.], cksum 0x78e4 (correct), seq 1, ack 123, win 46, options [nop,nop,TS val 67452951 ecr 16534500], length 0&#xA;15:14:51.076273 IP (tos 0x0, ttl 63, id 64895, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    server &amp;gt; client: Flags [F.], cksum 0x74e4 (correct), seq 1, ack 123, win 46, options [nop,nop,TS val 67453974 ecr 16534500], length 0&#xA;15:14:51.076482 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 52)&#xA;    client &amp;gt; server: Flags [.], cksum 0x57be (correct), seq 123, ack 2, win 7300, options [nop,nop,TS val 16534708 ecr 67453974], length 0&#xA;9 packets captured&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There was no ICMP traffic in either case.&lt;/p&gt;&#xA;" OwnerUserId="4292" LastEditorUserId="4292" LastEditDate="2014-02-13T15:22:37.403" LastActivityDate="2014-02-14T19:57:19.003" Title="Dropped data packet on satellite connection" Tags="|tcp|packet-loss|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6267" PostTypeId="2" ParentId="6265" CreationDate="2014-02-13T11:17:23.597" Score="6" Body="&lt;p&gt;The &lt;code&gt;Local&lt;/code&gt; keyword highlighted in your question means the prefix is sourced locally in that router's AS (i.e. there is no AS path).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider two configurations, where the routers have a BGP session with each other, and &lt;code&gt;DEN-EDGE-01&lt;/code&gt; is announcing 10.204.1.1/32.   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Announce:10.204.1.1/32&#xA;DEN-EDGE-01----------------DEN-EDGE-02&#xA;172.16.1.203               172.16.1.204&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Peering within the same ASN: &lt;code&gt;Local&lt;/code&gt; keyword shown&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;DEN-EDGE-01&lt;/code&gt; in AS100 is configured to send 10.204.1.1...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; network 10.204.1.1 mask 255.255.255.255&#xA; ! Send 10.204.1.1 to DEN-EDGE-02&#xA; neighbor 172.16.2.204 remote-as 100&#xA; no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;DEN-EDGE-02&lt;/code&gt; in AS100 is configured with...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; ! Just receive routes from DEN-EDGE-01&#xA; neighbor 172.16.2.203 remote-as 100&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I receive 10.204.1.1 on &lt;code&gt;DEN-EDGE-02&lt;/code&gt;, there is no AS-path, only &lt;strong&gt;&lt;code&gt;Local&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DEN-EDGE-02#sh ip bgp 10.204.1.1&#xA;BGP routing table entry for 10.204.1.1/32, version 2&#xA;Paths: (1 available, best #1, table Default-IP-Routing-Table)&#xA;Flag: 0x820&#xA;  Not advertised to any peer&#xA;  Local   &amp;lt;------------&#xA;    172.16.2.203 from 172.16.2.203 (172.16.2.203)&#xA;      Origin IGP, metric 0, localpref 100, valid, internal, best&#xA;DEN-EDGE-02#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Peering with a different ASN: AS path shown&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Now we reconfigure both routers... one in AS100 and the other in AS200.  &lt;code&gt;DEN-EDGE-01&lt;/code&gt; in AS100 is configured to send 10.204.1.1...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; network 10.204.1.1 mask 255.255.255.255&#xA; ! Send 10.204.1.1 to DEN-EDGE-02&#xA; neighbor 172.16.2.204 remote-as 200&#xA; no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;DEN-EDGE-02&lt;/code&gt; in AS200 is configured with...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 200&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; ! Just receive routes from DEN-EDGE-01&#xA; neighbor 172.16.2.203 remote-as 100&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I receive 10.204.1.1 on &lt;code&gt;DEN-EDGE-02&lt;/code&gt;, now we see a real AS-path, because &lt;code&gt;DEN-EDGE-01&lt;/code&gt; is in a different AS.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DEN-EDGE-02#sh ip bgp 10.204.1.1&#xA;BGP routing table entry for 10.204.1.1/32, version 2&#xA;Paths: (1 available, best #1, table Default-IP-Routing-Table)&#xA;Flag: 0x820&#xA;  Not advertised to any peer&#xA;  100   &amp;lt;------------&#xA;    172.16.2.203 from 172.16.2.203 (172.16.2.203)&#xA;      Origin IGP, metric 0, localpref 100, valid, external, best&#xA;DEN-EDGE-02#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-02-13T11:36:18.613" LastActivityDate="2014-02-13T11:36:18.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6268" PostTypeId="1" CreationDate="2014-02-13T16:12:55.400" Score="3" ViewCount="409" Body="&lt;p&gt;I have a growing demand for access to internal LAN services from the internet. Up until recently the only service provided via the web was access to email(Exchange-OWA). Now we have a vendor supplied web app that provides access to our main records system. I use a Sonicwall NSA 2400 at my edge with a single public IP address on the WAN interface. The primary LAN interface connects to our switch core. The secondary LAN interface connects to a simple 24 port switch and acts as a DMZ, though it hasn't been used(much) until now. All my servers are virtualized(VMware ESXi) and have the possibility to connect to either the primary LAN or the DMZ. Access to OWA was facilitated in the sonicwall by a NAT policy that allowed the port 443 traffic to be redirected to our mail server internally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the new webapp I attempted to set up a new NAT policy that used a non-standard port number to carry https traffic to the new server, rather than having the default 443 traffic get forwarded to the mail server. The vendor configured the server accordingly. What we found(obviously now) was that a long url with the non-standard port number has to be used to avoid a forwarding conflict with the mail server. So we started thinking about how to do redirection. Well, that is what brings me to the question of what is the best overall strategy for allowing different incoming requests to our public ip to be routed securely and reliably to the correct inside server/services. Should I continue relying solely on my firewall nat and port forwarding? Is a better plan to build a portal of some kind? We do anticipate have even more servers/services that need access from the internet using web browsers and other applications. Any good ideas?&lt;/p&gt;&#xA;" OwnerUserId="4294" LastActivityDate="2016-09-06T12:54:05.643" Title="What topology/strategy for providing external web access to multiple internal services?" Tags="|nat|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6269" PostTypeId="2" ParentId="6268" CreationDate="2014-02-13T16:51:35.950" Score="2" Body="&lt;p&gt;Do you have three router interfaces? (or can you expand and add a third?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can have the tiny LAN outside your router as-is. (e.g. with public mail server NAT'd inward to the real server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add a new network of public numbers on the third interface. Firewall to just the ports you need 80/443 so the public can go directly to that third LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can add rules to allow the web systems in the third LAN (really a DMZ) to cross over to your true internal LAN through the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That way you can always change f/w rules to allow whatever you want to that third LAN (the new DMZ). Without exposing what's over on the true internal LAN.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2014-02-13T16:51:35.950" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6270" PostTypeId="1" AcceptedAnswerId="6272" CreationDate="2014-02-13T22:04:50.517" Score="4" ViewCount="1633" Body="&lt;p&gt;I am trying to set up a new WLAN. Cisco 5508 controller. W2K8R2 for DHCP.&lt;br&gt;&#xA;Why would VLAN 600 not appear as active in management domain?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an AP (Aironet 1041) assigned to VLAN 600. I am unable to pull a DHCP address over WiFi, although it works fine over ethernet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AP is connected to a switch, trunked to another switch, trunked to the 5508. All VLANs are allowed on all trunks.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/w9Jtq6xX&quot; rel=&quot;nofollow&quot;&gt;Pastebin link to WAC config&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the switch connected to the AP: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Port        Vlans allowed on trunk  &#xA;Gi0/16      1-4094  &#xA;Gi0/23      1-4094  &#xA;Port        Vlans allowed and active in management domain  &#xA;Gi0/16      1,20,80,100,500  &#xA;Gi0/23      1,20,80,100,500 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Gi0/16&lt;/code&gt; is connected to the AP. &lt;code&gt;Gi0/23&lt;/code&gt; is the trunk port to the next switch.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switchport config for AP device:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S03#sh int g0/16 switchport  &#xA;Name: Gi0/16  &#xA;Switchport: Enabled  &#xA;Administrative Mode: trunk  &#xA;Operational Mode: trunk  &#xA;Administrative Trunking Encapsulation: dot1q  &#xA;Operational Trunking Encapsulation: dot1q  &#xA;Negotiation of Trunking: Off  &#xA;Access Mode VLAN: 1 (default)  &#xA;Trunking Native Mode VLAN: 1 (default)  &#xA;Administrative Native VLAN tagging: enabled  &#xA;Voice VLAN: none  &#xA;Administrative private-vlan host-association: none  &#xA;Administrative private-vlan mapping: none  &#xA;Administrative private-vlan trunk native VLAN: none  &#xA;Administrative private-vlan trunk Native VLAN tagging: enabled  &#xA;Administrative private-vlan trunk encapsulation: dot1q  &#xA;Administrative private-vlan trunk normal VLANs: none  &#xA;Administrative private-vlan trunk associations: none  &#xA;Administrative private-vlan trunk mappings: none  &#xA;Operational private-vlan: none  &#xA;Trunking VLANs Enabled: ALL  &#xA;Pruning VLANs Enabled: 2-1001  &#xA;Capture Mode Disabled  &#xA;Capture VLANs Allowed: ALL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4105" LastEditorUserId="3191" LastEditDate="2014-02-14T08:36:20.740" LastActivityDate="2020-09-21T17:07:49.847" Title="VLANs allowed vs VLANs active -- cannot pull DHCP over WiFi" Tags="|dhcp|cisco-wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6272" PostTypeId="2" ParentId="6270" CreationDate="2014-02-13T23:43:52.733" Score="6" Body="&lt;p&gt;Check the output of &lt;em&gt;show vlan&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a VLAN doesn't show up as active in the management domain, it will almost always be because the VLAN doesn't exist on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch may have a configuration problem with VTP or it may be configured to operate in transparent mode.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-02-13T23:43:52.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6275" PostTypeId="1" AcceptedAnswerId="6278" CreationDate="2014-02-14T01:47:51.593" Score="10" ViewCount="5207" Body="&lt;p&gt;Came across a situation where DHCP snooping was enabled on a Cisco switch, but only for certain VLANs.  However, all access ports had a &lt;em&gt;ip dhcp snooping limit rate 15&lt;/em&gt; applied whether or not DHCP snooping was configured for the assigned access VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My instinct is that if DHCP snooping is not enabled for that VLAN, then this statement isn't doing anything at all on those ports.  I would prefer to remove the unnecessary configuration if this is the case, however I couldn't find anything definitive in a quick search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know of a reference that addresses this?  Or alternatively tested this use case and can provide any data one way or another?&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-07-02T02:05:32.303" Title="Does Cisco *ip dhcp snooping limit rate* apply if DHCP snooping is not configured for the access VLAN?" Tags="|cisco|dhcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6276" PostTypeId="1" CreationDate="2014-02-14T04:26:44.643" Score="5" ViewCount="878" Body="&lt;p&gt;&lt;strong&gt;Background&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a cisco 4506-E with a sup 7L-E running IOS-XE 03.04.03.SG.  The switch is connected to a 150 Mbps circuit via 1 Gbps ethernet port.  The port is configured as a switched access port.  There is a policy-map applied to shape the port to 150 Mbps as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;policy-map foo&lt;br&gt;&#xA;&amp;nbsp;&amp;nbsp;class class-default&lt;br&gt;&#xA;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;shape average 150000000&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is voip and video running over the circuit.  In addition to shaping i'd like to make use of hardware output queues, especially the priority queue for voip.  The ideal case would be to apply the &quot;auto qos trust&quot; settings in addition to the shaping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to configure both shaping and queueing on a switched port such that the shaping happens first and then the queueing?  Please provide a simple example policy-map.&lt;/p&gt;&#xA;" OwnerUserId="86" LastActivityDate="2014-12-24T00:22:47.697" Title="Is it possible to shape and queue on a switched port in a cisco 4506-E?" Tags="|cisco|qos|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6277" PostTypeId="2" ParentId="6231" CreationDate="2014-02-14T05:07:59.080" Score="7" Body="&lt;p&gt;Private MIBs refer to MIBs associated with a specific Private Enterprise Number which starts at the following prefix: iso.org.dod.internet.private.enterprise (1.3.6.1.4.1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These numbers are assigned by &lt;a href=&quot;http://pen.iana.org/pen/PenApplication.page&quot;&gt;IANA&lt;/a&gt; and are a namespace for an organization to store their custom OIDs/MIBs. You can see the full list of PENs &lt;a href=&quot;http://www.iana.org/assignments/enterprise-numbers/enterprise-numbers&quot;&gt;here&lt;/a&gt;. For example, all of Cicso's proprietary OIDs would be under 1.3.6.1.4.1.9.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While private is in the name, they're not, but could be, private. It's just a namespace. If you're going to be creating your own OIDs you should register a PEN to avoid collisions with another vendor.&lt;/p&gt;&#xA;" OwnerUserId="3979" LastActivityDate="2014-02-14T05:07:59.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6278" PostTypeId="2" ParentId="6275" CreationDate="2014-02-14T05:23:09.523" Score="9" Body="&lt;p&gt;It appears the answer is that it is unnecessary configuration.  If DHCP snooping is not running on that VLAN, then this configuration has no effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I still couldn't find documentation that clearly states this, so I decided to test this myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Started off with DHCP snooping enabled for all VLANs and a rate limit of one (1) DHCP packet per second (assuming that the client will send the DISCOVER and REQUEST in one second if the DHCP server responds quickly enough):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show ip dhcp snoop&#xA;Switch DHCP snooping is enabled&#xA;DHCP snooping is configured on following VLANs:&#xA;1-4094&#xA;Insertion of option 82 is disabled&#xA;Interface                    Trusted     Rate limit (pps)&#xA;------------------------     -------     ----------------&#xA;FastEthernet0/8              no          1         &#xA;router#show run int fa 0/8&#xA;Building configuration...&#xA;&#xA;Current configuration : 230 bytes&#xA;!&#xA;interface FastEthernet0/8&#xA; switchport access vlan 841&#xA; switchport mode access&#xA; ip dhcp snooping limit rate 1&#xA; shutdown&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Time for the control test, which should err-disable the port, which is exactly what occurs in about a second after the port transitions to up/up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#term mon&#xA;router#config t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;router(config)#int fa 0/8&#xA;router(config-if)#no shut&#xA;router(config-if)#&#xA;Feb 13 22:57:04.589 CST: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down&#xA;Feb 13 22:57:07.701 CST: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up&#xA;Feb 13 22:57:08.553 CST: %PM-4-ERR_DISABLE: dhcp-rate-limit error detected on Fa0/8, putting Fa0/8 in err-disable state&#xA;Feb 13 22:57:08.561 CST: %DHCP_SNOOPING-4-DHCP_SNOOPING_RATE_LIMIT_EXCEEDED: The interface Fa0/8 is receiving more than the threshold set&#xA;Feb 13 22:57:10.561 CST: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down&#xA;router(config-if)#shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the control worked as expected, I now remove VLAN 841 from the DHCP snooping configuration and enable the port again.  One minute later, I shut the port (to show the timestamp):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-if)#no ip dhcp snooping vlan 841&#xA;router(config)#do sh ip dhcp snoop&#xA;Switch DHCP snooping is enabled&#xA;DHCP snooping is configured on following VLANs:&#xA;1-840,842-4094&#xA;Insertion of option 82 is disabled&#xA;Interface                    Trusted     Rate limit (pps)&#xA;------------------------     -------     ----------------&#xA;FastEthernet0/8              no          1         &#xA;router(config)#int fa   0/8&#xA;router(config-if)#no shut&#xA;router(config-if)#&#xA;Feb 13 22:58:49.150 CST: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down&#xA;Feb 13 22:58:52.290 CST: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up&#xA;Feb 13 22:58:53.290 CST: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up&#xA;router(config-if)#shut&#xA;Feb 13 22:59:55.119 CST: %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down&#xA;Feb 13 22:59:56.119 CST: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Repeated multiple times with the same results using the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Three different client devices&lt;/li&gt;&#xA;&lt;li&gt;2950 running 12.1(22)EA14&lt;/li&gt;&#xA;&lt;li&gt;3750 running 12.2(55)SE8&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Would still love for someone to find documentation for this though.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-02-14T05:23:09.523" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6279" PostTypeId="2" ParentId="6276" CreationDate="2014-02-14T07:13:34.840" Score="3" Body="&lt;p&gt;This should be possible by using Hierarchical Queueing Framework (HQF). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The parent policy-map will do the shaping and the child policy-map will do the queueing. Configuration would look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map CM_VOICE&#xA; match dscp ef&#xA;!&#xA;class CM_VIDEO&#xA; match dscp cs4&#xA;!&#xA;policy-map PM_CHILD&#xA; class CM_VOICE&#xA;  priority&#xA;  police percent 30&#xA; !&#xA; class CM_VIDEO&#xA;  bandwidth percent 50&#xA;!&#xA;policy-map PM_PARENT&#xA; class class-default&#xA;  shape average 150000000&#xA;  service-policy PM_CHILD&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously replace matching with your own values, ACLs etc.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="775" LastEditDate="2014-02-14T09:27:21.950" LastActivityDate="2014-02-14T09:27:21.950" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6281" PostTypeId="2" ParentId="6262" CreationDate="2014-02-14T09:46:52.877" Score="5" Body="&lt;p&gt;There are quite a few possibilites. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;They can get a dark fiber from an ISP and interconnect their network equipment, in this case they &quot;own&quot; the whole network and they are fully responsible for routing between different offices.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;They also can get plain Internet access in each location and build a secure overlay network, like DMVPN. The branch offices of course can run BGP with ISPs. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another option is to get some sort of L2/L3 VPN from an ISP. In case of L2VPN the offices will be directly connected in L2. In case of L3 VPN, the company's equipment usually will have to run some sort of routing protocol with ISP, who will &quot;own&quot; company's core network. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="970" LastActivityDate="2014-02-14T09:46:52.877" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6285" PostTypeId="2" ParentId="6238" CreationDate="2014-02-14T14:12:35.637" Score="3" Body="&lt;p&gt;The LER will be unable to distinguish this packet from any other packet as it will arrive unlabelled (as you said this is only true if the label stack has only a depth of ONE (the transport label)).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could somehow mark packets (CoS) that are transported trough MPLS. This might differentiate them from packets that are not transported via MPLS but would require additional configuration and highly depends on the used gear.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2014-02-14T14:21:30.187" LastActivityDate="2014-02-14T14:21:30.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6290" PostTypeId="2" ParentId="6266" CreationDate="2014-02-14T19:57:19.003" Score="2" Body="&lt;p&gt;The timestamps on your satellite pcap entries do imply tcp acknowledgement spoofing.  Most devices that perform acknowledgement spoofing can be configured to bypass acceleration based on some combination of source/ destination IP address, source/ destination port; standard ACL concepts.  This could be a feature that is configurable in the satellite modems (or nearby device) at your hub and spoke locaitons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wide area optimization or acceleration solutions are also common in such network architectures.  Again, these solutions should provide a method to bypass your traffic that's having problems.  Devices such as Riverbed Steelhead, Cisco WAAS, Bluecoat, and Citrix Cloudbridge/ Wanscaler are examples of technologies that might impact your application.  A discussion with your provider (or network guy) should reveal if such technologies are in use on your network; if so, request bypassing your affected traffic in these devices to see if behavior changes. Best of luck.&lt;/p&gt;&#xA;" OwnerUserId="3756" LastActivityDate="2014-02-14T19:57:19.003" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6294" PostTypeId="2" ParentId="2279" CreationDate="2014-02-15T01:04:04.000" Score="1" Body="&lt;p&gt;just had the same issues...and if you run portfast on all your access ports it will not send TCN messages and you do not receive the TCN message and it is not sent to all the switches....if you do not enable portfast on all your access ports and a device is down/up it will send a TCN message and flush arp on all your switches they will have to learn the MACS all over again....&lt;/p&gt;&#xA;" OwnerUserId="4316" LastActivityDate="2014-02-15T01:04:04.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6295" PostTypeId="1" AcceptedAnswerId="6298" CreationDate="2014-02-15T07:41:08.350" Score="4" ViewCount="1705" Body="&lt;p&gt;What is the purpose of a domain name to create SSH keys?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before enabling SSH on firewall/router, we need to create domain name. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is it necessary to do that? What does a domain name do and how is it related to SSH? What role does it play in enabling SSH?&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="3191" LastEditDate="2014-02-15T12:15:49.013" LastActivityDate="2014-02-15T12:24:52.577" Title="Domain name for SSH" Tags="|router|security|firewall|ssh|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6296" PostTypeId="2" ParentId="6295" CreationDate="2014-02-15T07:49:30.160" Score="-1" Body="&lt;p&gt;IP domain-name command is used to complete the &quot;crypto key generate rsa command&quot;. Check out a couple of these &lt;a href=&quot;https://serverfault.com/questions/298656/why-does-cisco-ios-require-domain-name-to-be-set-before-ssh-keys-can-be-generate&quot;&gt;links&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4211" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2014-02-15T07:49:30.160" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6298" PostTypeId="2" ParentId="6295" CreationDate="2014-02-15T12:24:52.577" Score="6" Body="&lt;p&gt;It isn't necessary to create a domain name to create SSH keys.  The below syntax will allow you to generate RSA keys for SSH use without one.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#crypto key generate rsa general-keys label RSAKEY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-15T12:24:52.577" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6299" PostTypeId="1" AcceptedAnswerId="6302" CreationDate="2014-02-15T13:15:44.220" Score="1" ViewCount="147" Body="&lt;p&gt;In a NS3 network simulation, I'm trying to transmit packets from 40 echo clients to a central echo server using OLSR routing on 802.11 simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, only eight of these packets are consistently received by the server. (&lt;a href=&quot;https://i.stack.imgur.com/sYGes.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Imgur Link&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, however, I try to serve the packets individually at an interval of 0.1s from each station, it seems to work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a protocol limit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry, I'm kind of new to networking but I tried to explain it as well as I could.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Please wait, populating routing tables (30s)....&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32s client sent 1024 bytes to 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32.0029s server received 1024 bytes from 10.1.3.3 port 49153&lt;br&gt;&#xA;  At time 32.0029s server sent 1024 bytes to 10.1.3.3 port 49153&lt;br&gt;&#xA;  At time 32.0089s server received 1024 bytes from 10.1.3.5 port 49153&lt;br&gt;&#xA;  At time 32.0089s server sent 1024 bytes to 10.1.3.5 port 49153&lt;br&gt;&#xA;  At time 32.0108s server received 1024 bytes from 10.1.3.12 port 49153&lt;br&gt;&#xA;  At time 32.0108s server sent 1024 bytes to 10.1.3.12 port 49153&lt;br&gt;&#xA;  At time 32.0299s server received 1024 bytes from 10.1.3.13 port 49153&lt;br&gt;&#xA;  At time 32.0299s server sent 1024 bytes to 10.1.3.13 port 49153&lt;br&gt;&#xA;  At time 32.0317s client received 1024 bytes from 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32.0631s client received 1024 bytes from 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 32.0651s client received 1024 bytes from 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 33.0049s client received 1024 bytes from 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 33.0158s server received 1024 bytes from 10.1.3.25 port 49153&lt;br&gt;&#xA;  At time 33.0158s server sent 1024 bytes to 10.1.3.25 port 49153&lt;br&gt;&#xA;  At time 33.0294s server received 1024 bytes from 10.1.3.18 port 49153&lt;br&gt;&#xA;  At time 33.0294s server sent 1024 bytes to 10.1.3.18 port 49153&lt;br&gt;&#xA;  At time 33.038s server received 1024 bytes from 10.1.3.28 port 49153&lt;br&gt;&#xA;  At time 33.038s server sent 1024 bytes to 10.1.3.28 port 49153&lt;br&gt;&#xA;  At time 33.0495s client received 1024 bytes from 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 33.0611s client received 1024 bytes from 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 33.068s client received 1024 bytes from 10.1.3.1 port 9&lt;br&gt;&#xA;  At time 34.0066s server received 1024 bytes from 10.1.3.41 port 49153&lt;br&gt;&#xA;  At time 34.0066s server sent 1024 bytes to 10.1.3.41 port 49153&lt;br&gt;&#xA;  At time 34.0153s client received 1024 bytes from 10.1.3.1 port 9  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4320" LastEditorUserId="4320" LastEditDate="2014-02-15T13:26:51.807" LastActivityDate="2014-02-15T22:49:37.230" Title="Simultaneous transmission on ad hoc wifi" Tags="|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6301" PostTypeId="1" AcceptedAnswerId="19688" CreationDate="2014-02-15T21:50:32.223" Score="5" ViewCount="1066" Body="&lt;p&gt;Let's take a look at the network topology below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GiZs9.jpg&quot; alt=&quot;network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It shows two datacenters (DC 1 &amp;amp; 2) as well as two offices A &amp;amp; B (example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each office uses mainly two VLANs (PCs &amp;amp; printers), as well as a few more for special services like time accounting devices or cameras. The firewalling is done at the DC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing is done at 2 levels&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;from office VLAN to DC transit VLAN (at the respective office)&lt;/li&gt;&#xA;&lt;li&gt;from DC transit to firewall/servers (at the DC)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also there are quite some VLANs used for firewalling special servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which brings me closer and closer to the question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We see that most VLANs are indeed only needed on the DC switches since they have complete physical redundancy independent of the &quot;ring&quot; across the offices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no real need having all the VLANs at the offices, except for some exceptions noted above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For those which are not needed near the edge it may be (?) advantageous not to define them at all. This would create two (M)STP regions: one for the DC switches, one for the rest of the world, maybe even one for each office because they would need their redundant connections of their &quot;private&quot; VLANs protected too?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the correct way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(If you don't plan to distribute VLANs across different redundant links, would you need MSTP at all? If yes, would it hurt to simply use MSTI0 for all VLANs inside the region then?)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Answering your questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Where are your routed / switched boundaries on the diagram (maybe use a different color for routed links?)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I found drawing can be difficult without overloading the diagram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In essence, routing is between sites (the diagram shows four sites: offices A&amp;amp;B, DCs 1&amp;amp;2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;However&lt;/strong&gt;, some VLANs need to be firewalled AND present at the edge, meaning you would have to egress them from the DC up to the edge. (like the examples with the camera VLAN that I gave)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Where are your spanning-tree roots&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I feel that's part of the question. Obviously, the CIST root is at the Prod-DC. Depending on the presence of regions the CIST regional roots probably would be the distribution switches at the respective site.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is your routing protocol? Where are the area boundaries (if link-state)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Static routing only.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Informational, but still useful: what kind of distances for each of those links? If you uniquely numbered the links, it would help those who are answering.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Distance can be up to 20km for the links DC/office or office/office respectively. On the local site they will be no more than 50m.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;(This is Enterasys gear.)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is it really necessary to have a &quot;transit&quot; vlan connecting all your sites? It would seem that you could break it up into layer 3 segments.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In principle yes. But that would be a major undertaking. I'd like to get the best out of the current situation and at least do the L2 stuff properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But &lt;strong&gt;remember&lt;/strong&gt; the exceptions I pointed out, like needing a separate (e.g. camera) (V)LAN at the edge that is protected by the DC-firewall.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Do the data centers need VLANs between them, or is it possible to use L3 links?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That's a philosophical question that we may tackle in chat ;-)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;link aggregation for the links between the data centers? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you have switches A, B, C and D and connect A to C and B to D, I believe link aggregation is not possible. You would then have to connect e.g. A to C via two links, and if either A or C fails, you have a problem.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Generally speaking, it is better to limit vlans to a single location. Having them spread across locations greatly increases the chance of an &quot;event&quot; causing network-wide problems&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Yeah that's a part of my question too. As I understand it, even separating STP into regions will still have network-wide impact in case of recomputations.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="2329" LastEditDate="2014-02-15T22:51:54.813" LastActivityDate="2019-04-03T03:24:03.240" Title="Spanning Tree design considerations: MSTP and regions" Tags="|spanning-tree|design|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6302" PostTypeId="2" ParentId="6299" CreationDate="2014-02-15T22:49:37.230" Score="2" Body="&lt;p&gt;802.11 is CSMA/CA, so there is no &quot;simultaneous transmission.&quot;  Stations wait until the channel is clear and then begin transmitting.  So only one station transmits at a time.  My guess is some of your stations never see an idle channel.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-15T22:49:37.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6307" PostTypeId="1" AcceptedAnswerId="6322" CreationDate="2014-02-16T16:46:57.247" Score="3" ViewCount="8324" Body="&lt;p&gt;First some information: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In virtual circuit model ( which is in the Network Layer ) there are three phases: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Connection establishment =&gt; In this step a path is chosen. Let's simply say, use routers with id 4,9,12 to get to the destination. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Data transfer =&gt; In this step the packets ( IP packets ) are forwarded. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Connection tear down =&gt; Circuit information is removed from the routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in this model, the packets only need to know what circuit they are on. So they do not need full addresses. If a packet only carries the information that it is on circuit 9454, the routers will be able to know where to forward the packets to, because a connection was established, and routers hold the necessary information...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now lets move up one level, to the Transport Layer.. TCP ( Transmission Control Protocol ) uses connections! Does that mean TCP uses Virtual Circuit Model in the Network Layer? &#xA;Or is still Datagram Model used in Network Layer, and TCP makes its own connection in the Transport Layer? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is also valid for UDP in Transport Layer and Datagram Model in Network Layer. Can we say that a UDP connection will always use Datagram Model in the Network Layer? &lt;/p&gt;&#xA;" OwnerUserId="4048" LastEditorUserId="8499" LastEditDate="2016-12-22T05:43:55.407" LastActivityDate="2016-12-22T05:43:55.407" Title="Does TCP use Virtual Circuit Model?" Tags="|tcp|udp|transport-protocol|layer4|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6308" PostTypeId="2" ParentId="6307" CreationDate="2014-02-16T17:04:04.440" Score="3" Body="&lt;p&gt;TCP uses the underlying IP layer to make create connections on top of the datagram layer. It is not a circuit model.&lt;/p&gt;&#xA;" OwnerUserId="4063" LastActivityDate="2014-02-16T17:04:04.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6309" PostTypeId="1" AcceptedAnswerId="6312" CreationDate="2014-02-17T05:51:16.007" Score="3" ViewCount="4208" Body="&lt;p&gt;Most of explanations on internet contend by saying &quot;lan&quot; is over smaller distance, while &quot;Wan&quot; covers wider geography. To make question more clear ?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If two computers are on the same &quot;LAN&quot; what is it that they share in common to be on that &lt;code&gt;single LAN&lt;/code&gt; they belong to ? Is it that they share a common router/switch/subnet ? Technically what is that that unifies under a LAN ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If two computers are on the same &quot;WAN&quot; what is it that they share in common to be on that &lt;code&gt;same WAN&lt;/code&gt; they belong to ? Is it that they share a common router/ subnet ? Technically what is that that unifies under a WAN ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is single datacenter considered a &lt;code&gt;Lan&lt;/code&gt; ? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4339" LastActivityDate="2018-08-01T09:02:08.897" Title="What is the &quot;technical&quot; definition of LAN and WAN" Tags="|wan|lan|" AnswerCount="8" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6311" PostTypeId="2" ParentId="6309" CreationDate="2014-02-17T06:10:21.450" Score="0" Body="&lt;p&gt;LAN:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Single LAN for Eg: group of device like pc,printer.. connected to switch i.e Single LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet is by far the most commonly used LAN technology&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if u want to create multiple lan in single switch ,that is the concept of VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Internet can be considered a WAN as well, and is used by businesses, governments, organizations, and individuals for almost any purpose imaginable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WANs are used to connect LANs and other types of networks together, so that users and computers in one location can communicate with users and computers in other locations.&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="4289" LastEditDate="2014-02-17T07:17:08.097" LastActivityDate="2014-02-17T07:17:08.097" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6312" PostTypeId="2" ParentId="6309" CreationDate="2014-02-17T07:03:45.433" Score="6" Body="&lt;p&gt;Wikipedia is your friend:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN:&#xA;A local area network (LAN) is a computer network that user interconnects computers in a limited area such as a home, school, computer laboratory, or office building using network media.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In simple words, what unifies devices on one LAN: they are situated in the same area. Most commonly, one LAN is behind one router (not talking about backup routers and redundancy routers). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN:&#xA;A wide area network (WAN) is a network that covers a broad area (i.e., any telecommunications network that links across metropolitan, regional, or national boundaries) using private or public network transports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, in simple words: a WAN connection is connecting LAN's over a bigger area. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: LAN + internet/network + LAN = WAN (when talking about bigger area's)&lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="623" LastEditDate="2014-02-17T07:09:36.393" LastActivityDate="2014-02-17T07:09:36.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6315" PostTypeId="2" ParentId="6309" CreationDate="2014-02-17T11:24:13.070" Score="5" Body="&lt;p&gt;There is no 'technical' difference.  Traditionally they used quite different networking technologies although that is becominging less and less the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The vague distinctions are that a LAN is in one local area, with lower latency, always connected, generally controlled by a single body, a WAN is spread over a distance and expected to have higher latency connections which need to be established (eg. vpn tunnels, dialup, etc.)&lt;/p&gt;&#xA;" OwnerUserId="1768" LastActivityDate="2014-02-17T11:24:13.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6316" PostTypeId="2" ParentId="6307" CreationDate="2014-02-17T13:13:57.453" Score="4" Body="&lt;p&gt;TCP uses IP as network layer. The IP header contains the information where the packet is coming from (Source IP) and where the packet is going to (Destination IP). IP delivers the packets to the destination and does not care about circuits or anything else. It's a purely packet-based protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP itself is a connection-oriented protocol. It's not a virtual-circuit either. (It does not reservere bandwidth and neither does it provide or promise a constant bit rate or latency.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP is a connection-less protocol. It's fire-and-forget. The application has to make sure the data arrives. (if it does care about that at all).&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-02-17T13:13:57.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6317" PostTypeId="1" AcceptedAnswerId="6318" CreationDate="2014-02-17T13:15:53.210" Score="6" ViewCount="61412" Body="&lt;p&gt;Is there any way to show a total count of interfaces that are in status &quot;up&quot; on a cisco router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose is to let a script go through all routers and show a summarization count of &quot;up&quot; interfaces.&lt;/p&gt;&#xA;" OwnerUserId="623" LastEditorUserId="59" LastEditDate="2014-02-17T13:19:58.443" LastActivityDate="2014-02-19T23:07:43.623" Title="Show connected (up) interfaces on cisco devices" Tags="|cisco|cisco-commands|cli|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6318" PostTypeId="2" ParentId="6317" CreationDate="2014-02-17T13:19:13.503" Score="6" Body="&lt;p&gt;You can show all interfaces that are up by:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interfaces status | include connected&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then your script can count them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;show interfaces status&lt;/code&gt; cli command shows you all interfaces. The interfaces that are &quot;up&quot; are in the &lt;code&gt;connected&lt;/code&gt; state. The &lt;code&gt;| include connected&lt;/code&gt; shows only the lines of the output that contain the word &quot;connected&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/configuration/guide/15_1s/cf_15_1s_book/feat_show_cmd_redrct.html&quot; rel=&quot;noreferrer&quot;&gt;Newer Cisco IOS contain a &lt;code&gt;count&lt;/code&gt; parameter&lt;/a&gt; that can count lines which match a regex. This is not available on all IOS versions.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2014-02-17T13:41:37.263" LastActivityDate="2014-02-17T13:41:37.263" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6319" PostTypeId="2" ParentId="6309" CreationDate="2014-02-17T13:25:26.780" Score="-1" Body="&lt;p&gt;There are three types of networks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Enterprise Networks - Enterprise networks basically are the most basic and common networks that exist, these networks have a simple topology, mainly consist of network switches, and router facing the internet connected to the ISP. The switches may vary from layer 2 or layer 3 switches and VLAN configured.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Data Centers - Data Center networks are the second most complex networks, most big internet startups have their own data centers, i.e Google, Facebook. Data Centers have high end switches and routers for optimal speed and performance. In addition technologies such as VMWARE data center virtualization helps in maximizing performance and limiting the physical devices that runs in this network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ISP Networks - ISP networks are the most complex networks that exist, these networks operates in the WAN or the &quot;internet&quot;. It is important to note that the largest WAN is the &quot;internet&quot; and it is a network of networks that is decentralized.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In conclusion, think of a LAN as your home network, a WAN as your ISP.&lt;/p&gt;&#xA;" OwnerUserId="4211" LastEditorUserId="4211" LastEditDate="2014-02-17T13:30:44.580" LastActivityDate="2014-02-17T13:30:44.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6322" PostTypeId="2" ParentId="6307" CreationDate="2014-02-17T15:14:51.610" Score="7" Body="&lt;p&gt;I would give an answer of &quot;no, but it is remarkably similar.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's some history and a largely complete explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Circuits 101&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Information networks can route traffic, basically, in terms of circuit switching or in terms of packet switching.  Circuit switching offers many more guarantees than packet switching, but this comes at a cost, and so circuit switched networks can't degrade gracefully.  The classic circuit-switched network is the PSTN, and a virtual circuit would be something like a DS0 on the PSTN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A DS0 basically works as part of a bundle of connections, usually in a DS1.  In a DS1, you will have a bundle of DS0's which are transmitted together, frame-by frame in time-division manner, so each DS0 is guaranteed a specific bandwidth, timeliness, etc. by the underlying network transport.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to look at this is that a physical circuit would be something like a cat6 cable running between two terminals.  You can send data back and forth over the wires at guaranteed speeds, and no other communications are going to interfere with that.  Indeed the early telephone networks worked by connecting physical circuits (that is copper wires) using manual or electromechanical switches.  As this was computerized, the circuits were virtualized and digital (as opposed to analog) information was sent down wires on a time division basis again with a circuit reserving a slot in the time division schedule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What this means is that circuit switching is more about bandwidth reservation than it is about routing.  The former leads to the latter.  I.e. a circuit &lt;em&gt;reserves bandwidth for the entire connection.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why TCP Connections are not Virtual Circuits&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP/IP is fully packet-switched.  It makes no provisions for virtual circuits.  This is why things like QoS are often necessary when trunking VOIP (a virtual circuit has built-in QoS guarantees).  You have no guarantee that all packets will be routed alike.  They may not come through in the same order.  They may not come through in a timely manner (from a connection-oriented perspective).  So you can't really build virtual circuits per se on top of a packet switched protocol like IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP comes somewhat close and in fact can work as a somewhat imperfect substitute.  It offers as many of the guarantees as it can. This is why, when implemented on TCP/IP, H.323 uses TCP connections instead of the virtual circuits the protocol prefers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But TCP connections still aren't circuits, because they don't reserve bandwidth during connection on every switch between the two nodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course TCP connections are more than just datagrams.  They include routing information (as does UDP) but they also include the accounting information necessary to reconstruct the stream on the other side in order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Answer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both TCP and UDP are datagram protocols.  They send a packet of data with routing information to routers with none of the guarantees of that a circuit offers.  TCP offers a subset of guarantees on the end points of what a circuit would offer by adding accounting information to allow the end points to handle errors and a series of data in order, but it is only a subset.  Of datagram protocols, TCP is the closest thing one will find to a virtual circuit but it is still conceptually and operationally very different.&lt;/p&gt;&#xA;" OwnerUserId="174" LastEditorUserId="174" LastEditDate="2014-02-20T02:45:36.000" LastActivityDate="2014-02-20T02:45:36.000" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6328" PostTypeId="2" ParentId="6317" CreationDate="2014-02-18T06:38:17.240" Score="1" Body="&lt;p&gt;You may also use these commands:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sh ip int bri | include up&lt;br /&gt;&#xA;sh int des | include up&lt;/p&gt;&#xA;" OwnerUserId="4211" LastActivityDate="2014-02-18T06:38:17.240" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6329" PostTypeId="1" AcceptedAnswerId="6333" CreationDate="2014-02-18T08:13:42.433" Score="25" ViewCount="75594" Body="&lt;p&gt;&lt;em&gt;This question is a literal repost of the same &lt;a href=&quot;https://supportforums.cisco.com/discussion/11246526/why-area-0-backbone-area-ospfneed-complete-answer&quot;&gt;question&lt;/a&gt; asked on &lt;a href=&quot;https://supportforums.cisco.com/discussion/11246526/why-area-0-backbone-area-ospfneed-complete-answer&quot;&gt;The Cisco Support Community&lt;/a&gt;.  Answers are unique to Stack Exchange.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;Why is area 0 the backbone area in OSPF? Why must all other areas connect to it?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been searching for the right reason why all the areas must be connected to area 0 in OSPF. I have a small idea, but I am not clear with the whole concept.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If 2 areas aren't connected through area 0 (discontiguous), how does OSPF behaving as a link state protocol increase the possibility of routing loops?&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="33" LastEditDate="2014-06-23T22:31:24.013" LastActivityDate="2021-03-17T07:28:17.347" Title="Why must all areas connect to an Area 0 backbone in OSPF?" Tags="|routing|ospf|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6330" PostTypeId="1" CreationDate="2014-02-18T08:24:10.077" Score="2" ViewCount="14015" Body="&lt;p&gt;At which OSI layer does the RIP protocol operate in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to analyze all dynamic protocols in terms of OSI Layers, and I found RIP is at the application layer; however, I don't understand what the need is for RIP is to reach the application layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need more clarity on what the application name which RIP uses is. Perhaps in the application layer or something.&lt;/p&gt;&#xA;" OwnerUserId="3915" LastEditorUserId="2624" LastEditDate="2014-02-18T23:01:42.683" LastActivityDate="2017-12-08T21:20:30.497" Title="At which OSI Layer does RIP work?" Tags="|router|rip|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6331" PostTypeId="2" ParentId="6330" CreationDate="2014-02-18T08:31:04.947" Score="1" Body="&lt;p&gt;Ripv2 &amp;amp; RIPng are layer 3 protocols and these protocols generate and multicast(224.0.0.9) updates every 30 seconds by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These update packets are carried by the transport layer protocol UDP and use UDP port 521.&lt;/p&gt;&#xA;" OwnerUserId="4289" LastActivityDate="2014-02-18T08:31:04.947" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6332" PostTypeId="2" ParentId="6329" CreationDate="2014-02-18T09:41:57.590" Score="19" Body="&lt;p&gt;Area 0 was chosen to be the backbone, the number 0 or 0.0.0.0 is just a number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because OSPF is link state the LSDB must be identical within an area. This is to ensure that the SPF calculation is consistent and to prevent routing loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If running single area OSPF any area can be used, there is no requirement to have area 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When running multi area OSPF, an ABR must be used. An ABR is a router with adjacency in area 0 and at least one other area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ABRs take type 1 and 2 LSAs and announce them as type 3 summary LSAs in other areas. This is not a summarization of the prefixes, it's a summary of topological information. This is in fact distance vector behaviour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because other areas don't have full information about each other all inter area traffic must pass through area 0. Otherwise there could be routing loops because not having the full topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to this design OSPF does not have to run full SPF when links go up/down in other areas. This increases scalability.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-02-18T09:41:57.590" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6333" PostTypeId="2" ParentId="6329" CreationDate="2014-02-18T09:44:52.880" Score="41" Body="&lt;h2&gt;OSPF Backbone&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is area 0 the backbone area in OSPF? Why must all other areas connect to it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is explained very well in &lt;a href=&quot;http://tools.ietf.org/search/rfc3509#section-1.2&quot; rel=&quot;noreferrer&quot;&gt;RFC 3509, Section 1.2&lt;/a&gt;&lt;sup&gt;1&lt;/sup&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;1.2 Motivation&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In OSPF domains the area topology is restricted so that there must be&#xA;  a backbone area (area 0) and all other areas must have either physical&#xA;  or virtual connections to the backbone. The reason for this star-like&#xA;  topology is that OSPF inter-area routing uses the distance-vector&#xA;  approach and a strict area hierarchy permits avoidance of the&#xA;  &quot;counting to infinity&quot; problem. OSPF prevents inter-area routing loops&#xA;  by implementing a split-horizon mechanism, allowing ABRs to inject&#xA;  into the backbone only Summary-LSAs derived from the intra-area&#xA;  routes, and limiting ABRs' SPF calculation to consider only&#xA;  Summary-LSAs in the backbone area's link-state database.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;OSPF is usually considered a &lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_routing_protocol&quot; rel=&quot;noreferrer&quot;&gt;link-state protocol&lt;/a&gt;.  What some people miss is that OSPF uses &lt;em&gt;both&lt;/em&gt; &lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_routing_protocol&quot; rel=&quot;noreferrer&quot;&gt;link-state protocol&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Distance-vector_routing_protocol&quot; rel=&quot;noreferrer&quot;&gt;distance-vector protocol&lt;/a&gt; algorithms.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Routes within the backbone, or a non-backbone area are computed as a &lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_routing_protocol&quot; rel=&quot;noreferrer&quot;&gt;link-state protocol&lt;/a&gt; does (ref &lt;a href=&quot;http://en.wikipedia.org/wiki/Dijkstra&amp;#39;s_algorithm&quot; rel=&quot;noreferrer&quot;&gt;Dijkstra's algorithm&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;li&gt;When OSPF must carry non-backbone routes through the backbone, it uses some distance-vector behavior (i.e. parts of the &lt;a href=&quot;http://en.wikipedia.org/wiki/Bellman%E2%80%93Ford_algorithm&quot; rel=&quot;noreferrer&quot;&gt;Bellman Ford algorithm&lt;/a&gt;) to propagate Type3 LSA metrics into non-backbone areas.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Simple example of OSPF's &lt;a href=&quot;http://en.wikipedia.org/wiki/Distance-vector_routing_protocol&quot; rel=&quot;noreferrer&quot;&gt;distance-vector&lt;/a&gt; behavior:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;-- Area 5 --&amp;gt;&amp;lt;-- Area 0 --&amp;gt;&amp;lt;--           Area 4           --&amp;gt;&#xA;&#xA;R5-----------R1-----------R2------------R3---------------------R4&#xA;     Cost 3      Cost 5        Cost 7            Cost 12&#xA;&#xA;               LSA--&amp;gt;          LSA--&amp;gt;&#xA;               Type3 LSA       Type3 LSA&#xA;               {From R1}       {From R2}&#xA;               R5 cost is 3    R5 cost is 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Consider what happens to a /32 Loopback route for R5.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;R5 sends a Type1 LSA containing the /32 Loopback&lt;/li&gt;&#xA;&lt;li&gt;R1 (Area 5 ABR), is connected to Area 0; it translates the Type1 LSA into a Type3 LSA with a cost of 3.&lt;/li&gt;&#xA;&lt;li&gt;R2 (Area 4 ABR) receives R1's Type3 LSA (metric 3) and &lt;em&gt;changes the metric to R5's Loopback, based on R2's cost to R1&lt;/em&gt;.  Now R2's Type3 LSA for R5 has a cost of 8.  This is the &lt;a href=&quot;http://en.wikipedia.org/wiki/Distance-vector_routing_protocol&quot; rel=&quot;noreferrer&quot;&gt;distance-vector&lt;/a&gt; behavior I mentioned above.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Requiring all non-backbone routes to go through the backbone is a loop-prevention mechanism.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Connecting non-backbone OSPF areas at an ABR&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If 2 areas aren't connected through area 0 (discontiguous), how does OSPF behaving as a link state protocol increase the possibility of routing loops?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As we saw above, OSPF uses &lt;a href=&quot;http://en.wikipedia.org/wiki/Distance-vector_routing_protocol&quot; rel=&quot;noreferrer&quot;&gt;distance-vector&lt;/a&gt; behavior to send routes through the Area 0 backbone.  Distance-vector protocols have well-known limits, such as the &lt;a href=&quot;http://en.wikipedia.org/wiki/Distance-vector_routing_protocol#Count-to-infinity_problem&quot; rel=&quot;noreferrer&quot;&gt;count-to-infinity problem&lt;/a&gt;.  OSPF would be vulnerable to the same issues, if we didn't have boundaries on its behavior.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt;&lt;sub&gt;RFC 3509 describes Cisco IOS's ABR behavior&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="8499" LastEditDate="2016-03-19T05:15:10.560" LastActivityDate="2016-03-19T05:15:10.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6336" PostTypeId="2" ParentId="6330" CreationDate="2014-02-18T14:59:22.753" Score="0" Body="&lt;p&gt;All IGP (Interior gateway protocols) routing protocols works at layer 3. External BGP works at layer 4, while internal works at layer 3.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Physical Layer - Deals with hardware network devices, i.e laptops, mobile phones, desktops. Layer 1 is known to be a collision domain, Layer 1 PDU (protocol data unit is bits).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Data/link layer - This layer concerns with layer 2 switches, broadcast domains, VLANS, STP, VTP. The protocol data unit of this layer is called frames.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Network Layer - This is when routing occurs, most routing protocols works at this layer. This is also known as the IP layer, where VLANS communicate. The PDU for this layer is known as packets.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Transport layer - Transport layer deals with TCP and UDP ports, these is where the packets from layers 3 are sent to their destination ports. It is important to remember that TCP is a connection-oriented protocol while UDP is connection-less oriented protocol (non guranteed delivery of data). The PDU for this layer is datagrams.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Session layer - Session layer is where the packets are encapsulated from being decapsulated from layer 3. This layer deals with multiple server side programming languages where you can create software-based applications and convert them into -&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The Presentation layer - This layer is about the client-side codes you see on your web browser, or when you do a right-click and view the source, these are mainly HTM/CSS/Javascript codes that allows you to view your -&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The Application layer - This is where the GUI (Graphical user interface) translates the HTML/CSS codes from layer 6 to this layer. What you see on your web browser is the front end  GUI. Layer 5,6,7 PDU is called message.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I hope these answer all OSI-related questions.&lt;/p&gt;&#xA;" OwnerUserId="4211" LastEditorUserId="4211" LastEditDate="2014-02-19T06:29:02.160" LastActivityDate="2014-02-19T06:29:02.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6339" PostTypeId="2" ParentId="6330" CreationDate="2014-02-18T18:37:19.397" Score="4" Body="&lt;p&gt;I think you're getting confused on how the OSI model plays into the routing. It's just a model, nothing more, nothing less.  RIP works at layer 3 and sends routing information across the network.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I found RIP is at the application layer, however I don't understand&#xA;  what the need for RIP is to reach the application layer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;RIP isn't at the application layer because no application can use it (within reason) and the application layer needs it to find the route to the proper device.  RIPs only function is to distribute routing updates.  It only tells neighboring routers about routes it knows about.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I need more clarity on what the application name which RIP uses is.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;RIP, in and of itself, is an application, but it supports the network layer of the OSI model.  There are daemons you can download on your computer, like &lt;a href=&quot;http://gsp.com/cgi-bin/man.cgi?section=8&amp;amp;topic=routed&quot; rel=&quot;nofollow&quot;&gt;routed&lt;/a&gt;, that allow servers to talk to other RIP processes.  Just try to understand the theory that each application/daemon supports a different purpose (or layer) of the OSI model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this doesn't add anymore confusion...&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-18T18:37:19.397" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6340" PostTypeId="1" CreationDate="2014-02-18T19:18:39.503" Score="2" ViewCount="758" Body="&lt;p&gt;I have one doubt about the speed of packets capture in monitor mode. If i have a 300mbps usb wifi adapter in monitor mode, what is the max speed of packet capture?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 300mbps of my adapter is associated with the 802.11n network, if i connect in 802.11g network, the speed gonna be lower, but in monitor mode, how this works!?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a idea that isn't related to Mbps but to pps (packets per second). Just want to clear things in my mind.&lt;/p&gt;&#xA;" OwnerUserId="4367" LastEditorUserId="775" LastEditDate="2014-02-18T22:47:00.483" LastActivityDate="2014-02-18T22:47:00.483" Title="Speed of capture packets in monitor mode" Tags="|wireless|wireshark|speed|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6342" PostTypeId="2" ParentId="6340" CreationDate="2014-02-18T21:49:36.717" Score="5" Body="&lt;p&gt;When you are using a wifi adapter in monitor mode, you are not associated to an access point.  It will simply listen on the configured channel(s) and capture any traffic it understands whether that is 802.11b, 802.11g, or 802.11n.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are associated to an access point, then you are running in promiscuous mode, and then you are generally only going to capture traffic to/from your station plus any broadcast/multicast/management frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the flip side is that you need to be fairly close to the source of any traffic running at 300Mbps to be able to capture it.  The further you get away from the source, the slower the data rate of any usable data you will capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is one of the &quot;tricks&quot; in analyzing any wireless data and when using wireless tools.  You need to understand that the data is presented as it is seen from the current location at the current time.  I have used tools that indicate there were hundreds of 802.11b clients around me, but that is because the software tool was only capturing traffic from those clients when they were transmitting at 1/2Mbps and not at higher speeds due to distance/obstructions/interference/noise.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-02-18T21:49:36.717" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6352" PostTypeId="5" CreationDate="2014-02-19T08:33:31.547" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-02-19T08:33:31.547" LastActivityDate="2014-02-19T08:33:31.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6353" PostTypeId="4" CreationDate="2014-02-19T08:33:31.547" Score="0" Body="Questions relating to IP subnetting, including planning, calculation and best practices." OwnerUserId="1392" LastEditorUserId="1392" LastEditDate="2016-11-23T15:21:55.130" LastActivityDate="2016-11-23T15:21:55.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6359" PostTypeId="1" AcceptedAnswerId="6486" CreationDate="2014-02-19T13:53:51.890" Score="7" ViewCount="748" Body="&lt;p&gt;We have set up OSPF between our 2 ASA 5540 running in Active/Passive and our Internet provider's Juniper routers. We would like to advertise routes based on the content of an ACL through a route-map : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA;router-id X.X.X.A&#xA;network X.X.X.B 255.255.255.248 area 0&#xA;area 0 authentication message-digest&#xA;log-adj-changes&#xA;redistribute static metric 10 subnets route-map annonce_ospf_isp&#xA;&#xA;route-map annonce_ospf_isp permit 1&#xA;match ip address redistribute_isp&#xA;&#xA;access-list redistribute_isp standard permit Y.Y.Y.C 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I advertise a /30, no problem : it shows up in the ospf database and the route is inserted in other routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if I advertise a /32 then nothing happens: it's not in the database, it's not advertised : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list redistribute_neo standard permit host Y.Y.Y.D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the problem?&lt;/p&gt;&#xA;" OwnerUserId="4388" LastEditorUserId="775" LastEditDate="2014-02-20T03:52:02.347" LastActivityDate="2014-02-28T17:28:55.493" Title="OSPF on ASA 8.2 not advertising /32" Tags="|cisco|cisco-asa|ospf|juniper|troubleshooting|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6361" PostTypeId="1" AcceptedAnswerId="6365" CreationDate="2014-02-19T14:14:14.877" Score="8" ViewCount="3450" Body="&lt;p&gt;First some background information on what I already know:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An IPv4 address is a 32 bit address that identifies a node in a network. An IP address will have an IP prefix which determines the &quot;Network&quot; part of the IP address and the rest will determine the &quot;Host&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;128.208.0.0/24 will tell me that the first 24 bits is the &quot;Network&quot; part of the IP address, and the remaining 8 bits will be for the host in the given Network. Also, 128.208.0.0. will be the lowest IP address that is available in the given network..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now Tannenbaum states in his book:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Since the prefix length cannot be inferred from the IP address alone,&#xA;  routing protocols must carry the prefixes to routers. Sometimes&#xA;  prefixes are simply de- scribed by their length, as in a ‘‘/16’’ which&#xA;  is pronounced ‘‘slash 16.’’ The length of the prefix corresponds to a&#xA;  binary mask of 1s in the network portion. When written out this way,&#xA;  it is called a subnet mask. It can be ANDed with the IP ad- dress to&#xA;  extract only the network portion. For our example, the subnet mask is&#xA;  255.255.255.0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) How do routing protocols carry the prefixes? Where is the &quot;slash&quot; part stored? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) What does this mean at all: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It can be ANDed with the IP address to&#xA;  extract only the network portion. For our example, the subnet mask is&#xA;  255.255.255.0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="4048" LastActivityDate="2014-02-19T15:28:35.530" Title="How is the IP prefix passed to the router?" Tags="|ipv4|prefix|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6362" PostTypeId="2" ParentId="3832" CreationDate="2014-02-19T14:22:51.353" Score="3" Body="&lt;p&gt;Your config is possibly safe (if you care about them you should consider rancid or make manual backups) as it's on a different partition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you place the install image on a FAT32 formatted USB key you can reinstall JunOS from there, however you may need to use the reformat option which will wipe any config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper doc:&#xA;&lt;a href=&quot;http://www.trapezenetworks.com/techpubs/en_US/junos12.2/topics/task/installation/security-junos-os-boot-loader-usb-storage-device-srx-series-device-installing.html&quot; rel=&quot;nofollow&quot;&gt;http://www.trapezenetworks.com/techpubs/en_US/junos12.2/topics/task/installation/security-junos-os-boot-loader-usb-storage-device-srx-series-device-installing.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="348" LastActivityDate="2014-02-19T14:22:51.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6363" PostTypeId="2" ParentId="6361" CreationDate="2014-02-19T14:27:16.610" Score="6" Body="&lt;p&gt;It depends on the routing protocol.  Old protocols like RIP v1 assume a classful mask and do not advertise a mask, but newer ones like RIP v2, OSPF, ISIS, BGP, etc do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer to the second part of your question:  To determine the network part of the address, or to test if a given address is part of a particular network, you perform a bitwise logical AND with the subnet mask.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, to get the network address of 172.16.24.5/24, you AND each bit of the 32 bit address and the Mask, like this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;10101100 00010000 00011000 00000101  &amp;lt;- 172.16.24.5&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;11111111 11111111 11111111 00000000  &amp;lt;- 255.255.255.0&lt;/p&gt;&#xA;  &#xA;  &lt;hr&gt;&#xA;  &#xA;  &lt;p&gt;10101100 00010000 00011000 00000000   &amp;lt;- Result: 172.16.24.0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The result is the network portion of the IP address (also called the network number). This is exactly what your router and PC do to determine which network to use to transmit the packet.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-19T14:27:16.610" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6365" PostTypeId="2" ParentId="6361" CreationDate="2014-02-19T15:28:35.530" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;How do routing protocols carry the prefixes? Where is the &quot;slash&quot;&#xA;  part stored?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'll answer this as direct as possible with OSPF.  Below is a Type 1 Hello packet sent out all interfaces to form an adjacency.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0                   1                   2                   3&#xA;    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |   Version #   |       1       |         Packet length         |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                          Router ID                            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                           Area ID                             |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |           Checksum            |             AuType            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                       Authentication                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                       Authentication                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                        Network Mask                           |    &amp;lt;------&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |         HelloInterval         |    Options    |    Rtr Pri    |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                     RouterDeadInterval                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                      Designated Router                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                   Backup Designated Router                    |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                          Neighbor                             |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                              ...                              |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://www.ietf.org/rfc/rfc2328.txt&quot;&gt;RFC 2328, A.3.2 The Hello packet&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;Network Mask&lt;/code&gt; field is populated with the subnet mask you're using with that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation&quot;&gt;CIDR Notation&lt;/a&gt; is nothing more than a shorter version of your subnet mask for the sake of brevity. And for that matter, subnet masks are just a condensed version of bit positions. Imagine having to write in decimal every time you wanted to configure a port.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111.11111111.11111111.00000000    &amp;lt;---- This would be painstaking&#xA;255.255.255.0                          &amp;lt;---- Better, but not optimal&#xA;0xffffff00                             &amp;lt;---- Shorter still, but still not optimal&#xA;/24                                    &amp;lt;---- Best-case scenario&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything comes out to the same thing in the end.  So having these shorthand ways of representing the same data just makes sense.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-19T15:28:35.530" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6369" PostTypeId="1" AcceptedAnswerId="6370" CreationDate="2014-02-19T18:57:07.433" Score="19" ViewCount="21281" Body="&lt;p&gt;In IPv4 we use /30 to conserve addresses. So why do some people recommend using /64 on P2P links instead of /126? I get using a /64 on regular subnets but isn't using a /64 when there will only ever be two addresses in use on P2P links tremendous waste of addresses?&lt;/p&gt;&#xA;" OwnerUserId="500" LastActivityDate="2019-04-01T21:58:52.720" Title="IPv6: Why not use /126 on P2P links for IPv6?" Tags="|ipv6|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6370" PostTypeId="2" ParentId="6369" CreationDate="2014-02-19T18:57:07.433" Score="5" Body="&lt;p&gt;Because IPv6 always recommends using /64 for all links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the second part of the question, is it a waste?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A /64 has &lt;strong&gt;18,446,744,073,709,551,615&lt;/strong&gt;, or 18 quintillion addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most IPv4 subnets are less than 255 hosts. Assume that you have a network with 255 hosts on it and they're given a /64 prefix. That means that 255 hosts are assigned a v6 address, leaving 18,446,744,073,709,551,360 addresses unused. That's over 99.99%. To be more accurate, that's sixteen 9's, or effectively 100% &quot;waste&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you had a subnet with 1,000,000 hosts on it, that's 18,446,744,073,708,551,616 wasted addresses, or still over 99.99%. Only thirteen 9's this time, but still effectively 100% &quot;waste&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the percentage difference between using one million addresses or two addresses on a single link is negligible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And just so you can see what these numbers look like.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;* Two hosts is 99.9999999999999999891579782751449556599254719913005828857422% unused.&#xA;* 255 hosts is 99.9999999999999986176422300809818466404976788908243179321289% unused.&#xA;* 1M  hosts is 99.99999999999457898913757247782996273599565029144287109375% unused.&#xA;* 4B  hosts is 99.999999976716935634613037109375% unused.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Even the entire IPv4 Internet placed on a single /64 link would leave effectively 100% of the addresses unused. When you look at the numbers like this, using anything other than a /64 on a link is just silly.&lt;/p&gt;&#xA;" OwnerUserId="500" LastActivityDate="2014-02-19T18:57:07.433" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6372" PostTypeId="2" ParentId="6369" CreationDate="2014-02-19T20:09:39.030" Score="17" Body="&lt;p&gt;Many of us do use /126's on PTP links.  I personally like being able to identify something as a network infrastructure PTP link just based on the first 64 bits of the address, so I reserve a /64 to pull the /126's from.  Different people have different opinions on what's important, so...&lt;em&gt;shrug&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Incidentally (#1), because IPv6 doesn't have the concept of a broadcast address or a network address on an IP network, you could actually use /127's instead of /126's.  Beware that, although /127's netmasks are perfectly valid, some vendor gear has (wrongly) not allowed them,  considering /127's netmasks &quot;invalid&quot;, which means you may run into some vendor support issues if you decide to try using them. This is why I use /126's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Incidentally (#2), if your links are &lt;strong&gt;truly&lt;/strong&gt; defined as PTP links, you should be able to use any IP addresses without them having to be in a common IP network at all.&lt;/p&gt;&#xA;" OwnerUserId="97" LastEditorUserId="36473" LastEditDate="2017-05-03T14:21:37.490" LastActivityDate="2017-05-03T14:21:37.490" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6374" PostTypeId="1" AcceptedAnswerId="6390" CreationDate="2014-02-19T20:53:38.167" Score="1" ViewCount="2355" Body="&lt;p&gt;My company will be attending a trade show in March, and the wi-fi could be spotty especially under peak loads. We don't really need Internet, we just need our Android tablets to be able to hit a laptop we'll have there. The laptop will be running a web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to use a wireless router or something to enable the tablet to connect to the laptop by IP address, even with no Internet available? Please explain conceptually how to build / set this up.&lt;/p&gt;&#xA;" OwnerUserId="4400" LastEditorUserId="775" LastEditDate="2014-02-19T22:08:55.847" LastActivityDate="2014-02-20T12:55:23.533" Title="How to create a small LAN with no Internet?" Tags="|router|wireless|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6376" PostTypeId="1" CreationDate="2014-02-19T22:56:08.530" Score="1" ViewCount="1385" Body="&lt;p&gt;I know this has been discussed multiple times but still wanted to renew this discussion- I for one can definitely use some valuable suggestions and clarifications. &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Scenario :-&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I have the following equipment: &#xA; - 2*2900 &#xA; - 2*ASA5510&#xA; - 1*/24-IPV4 Scope&#xA; - 1*AS-BGP_PUBLIC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to set up a BGP multihome to my single /24 using 2*2900 {4GB RAM } only defaults in. &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Configuration assistance requested:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Setting up iBGP + OSPF0 between 2*2900's is simple and pretty straightforward. In fact I was also thinking of setting up AS_PATH Prepend on one of the ISP's to prefer that ISP and then of course local_pref for a preferred way out of my AS. Running static EBGP to the peer ISPs A and B for the same /24 . Thing to note here is that there is only one /24 and 1 link per a 2900 router to 1 ISP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{ ISPA---1link--routerA &amp;amp; ISPb---1link---routerB }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The issue arises with the ASA's though would you suggest I run a different OSPF area on them like say OSPF1 or HSRP to connect them to the 2900. { Note :- All devices need to be behind the firewall stack and the firewalls are behind the 2900's }.  At a later date i will like to add more Firewall stacks and running HSRP would just make everything too messy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is all a Single Datacenter setup - same location. Also by firewall stack I mean - Firewalls being deployed in a pair  - ACTIVE/STANDBY mode and having more that 1 pair. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TvhYx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TvhYx.jpg&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So would you suggest running a separate ospf process on the ASA and then redistribute defaults to the backbone OSPF0 Routers or just running HSRP with defaults to the routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should I configure this?&lt;/p&gt;&#xA;" OwnerUserId="4397" LastEditorUserId="775" LastEditDate="2014-02-21T14:44:51.110" LastActivityDate="2015-06-13T05:27:31.203" Title="BGP Multihoming with 2900's - one /24 and 2 ASA 5510's" Tags="|cisco|cisco-asa|bgp|ospf|isp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6380" PostTypeId="1" AcceptedAnswerId="6381" CreationDate="2014-02-20T03:06:39.187" Score="40" ViewCount="17438" Body="&lt;p&gt;When most networking students first learn about the OSI model, they spend a great deal of time trying to figure out which layer of the model a particular protocol fits into.  We get a lot of questions about OSI layers on this forum, and they are usually like:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Which OSI layer does IS-IS operate at? &lt;/li&gt;&#xA;  &lt;li&gt;Is HTML a presentation or    application protocol? &lt;/li&gt;&#xA;  &lt;li&gt;Are VPN tunnels layer 2 or 3?&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How should a student (or professional for that matter) understand the relationship between the OSI model and protocols he/she works with?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="3191" LastEditDate="2014-02-20T08:00:11.277" LastActivityDate="2022-06-05T00:25:51.947" Title="OSI Model and Networking Protocols Relationship" Tags="|osi|" AnswerCount="7" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6381" PostTypeId="2" ParentId="6380" CreationDate="2014-02-20T03:06:39.187" Score="49" Body="&lt;p&gt;There are two important facts about the OSI model to remember:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It is a conceptual model.  That means it describes an idealized, abstract, theoretical group of networking functions.  It does not describe anything that someone actually built (at least nothing that is in use today).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It is not the only model.  There are other models, most notably the TCP/IP protocol suite (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC-1122&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1123&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC-1123&lt;/a&gt;), which is much closer to what is currently in use.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;A bit of history:  You’ve probably all heard about the early days of packet networking, including ARPANET, the Internet’s predecessor.  In addition to the U.S. Defense Department’s efforts to create networking protocols, several other groups and companies were involved as well. Each group was developing their own protocols in the brand new field of packet switching.  IBM and the telephone companies were developing their own standards.  In France, researchers were working on their own networking project called Cyclades.&lt;/p&gt;&#xA;&lt;p&gt;Work on the OSI model began in the late 1970s, mostly as a reaction to the growing influence of big companies like IBM, NCR, Burroughs, Honeywell (and others) and their proprietary protocols and hardware.  The idea behind it was to create an open standard that would provide interoperability between different manufacturers.  But because the OSI model was international in scope, it had many competing political, cultural, and technical interests. It took well over six years to come to consensus and publish the standards.&lt;/p&gt;&#xA;&lt;p&gt;In the meanwhile, the TCP/IP model was also developed.  It was simple, easy to implement, and most importantly, it was free.  You had to purchase the OSI standard specifications to create software for it.  All the attention and development efforts gravitated to TCP/IP.  As a result, the OSI model was never commercially successful as a set of protocols, and TCP/IP became the standard for the Internet.&lt;/p&gt;&#xA;&lt;p&gt;The point is, all of the protocols in use today, the TCP/IP suite; routing protocols like RIP, OSPF and BGP; and host OS protocols like Windows SMB and Unix RPC, were developed without the OSI model in mind.  They sometimes bear some resemblance to it, but the OSI standards were never followed during their development.  So it’s a fools errand to try to fit these protocols into OSI.  They just don’t exactly fit.&lt;/p&gt;&#xA;&lt;p&gt;That doesn’t mean the model has no value; it is still a good idea to study it so you can understand the general concepts. The concept of the OSI layers is so woven into network terminology, that we talk about layer 1, 2 and 3 in everyday networking speech. The definition of layers 1, 2 and 3 are, if you squint a bit, fairly well agreed upon.  For that reason alone, it’s worth knowing.&lt;/p&gt;&#xA;&lt;p&gt;The most important things to understand about the OSI (or any other) model are:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;We can divide up the protocols into layers&lt;/li&gt;&#xA;&lt;li&gt;Layers provide encapsulation&lt;/li&gt;&#xA;&lt;li&gt;Layers provide abstraction&lt;/li&gt;&#xA;&lt;li&gt;Layers decouple functions from others&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Dividing the protocols into layers allows us to talk about their different aspects separately.  It makes the protocols easier to understand and easier to troubleshoot.  We can isolate specific functions easily, and group them with similar functions of other protocols.&lt;/p&gt;&#xA;&lt;p&gt;Each “function” (broadly speaking) encapsulates the layer(s) above it.  The network layer encapsulates the layers above it.  The data link layer encapsulates the network layer, and so on.&lt;/p&gt;&#xA;&lt;p&gt;Layers abstract the layers below it.  Your web browser doesn’t need to know whether you’re using TCP/IP or something else at at the network layer (as if there were something else).  To your browser, the lower layers just provide a stream of data. How that stream manages to show up is hidden from the browser. TCP/IP doesn’t know (or care) if you’re using Ethernet, a cable modem, a T1 line, or satellite. It just processes packets.  Imagine how hard it would be to design an application that would have to deal with all of that.  The layers abstract lower layers so software design and operation becomes much simpler.&lt;/p&gt;&#xA;&lt;p&gt;Decoupling: In theory, you can substitute one specific technology for another at the same layer.  As long as the layer communicates with the one above and the one below in the same way, it shouldn’t matter how it’s implemented.  For example, we can remove the very well-known layer 3 protocol, IP version 4, and replace it with IP version 6.  Everything else should work exactly the same.  To your browser or your cable modem, it should make no difference.&lt;/p&gt;&#xA;&lt;p&gt;The TCP/IP model is what TCP/IP protocol suite was based on (surprise!).  It only has four layers, and everything above transport is just “application.”  It is simpler to understand, and prevents endless questions like “Is this session layer or presentation layer?”  But it too is just a model, and some things don’t fit well into it either, like tunneling protocols (GRE, MPLS, IPSec to name a few).&lt;/p&gt;&#xA;&lt;p&gt;Ultimately, the models are a way of representing invisible abstract ideas like addresses and packets and bits.  As long as you keep that in mind, the OSI or TCP/IP model can be useful in understanding networking.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="43734" LastEditDate="2022-06-05T00:25:51.947" LastActivityDate="2022-06-05T00:25:51.947" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="6383" PostTypeId="2" ParentId="6380" CreationDate="2014-02-20T05:48:03.813" Score="1" Body="&lt;p&gt;All IGP (Interior gateway protocols) routing protocols works at layer 3. External BGP works at layer 4, while internal works at layer 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Physical Layer - Deals with hardware network devices, i.e laptops, mobile phones, desktops. Layer 1 is known to be a collision domain, Layer 1 PDU (protocol data unit is bits).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data/link layer - This layer concerns with layer 2 switches, broadcast domains, VLANS, STP, VTP. The protocol data unit of this layer is called frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network Layer - This is when routing occurs, most routing protocols works at this layer. This is also known as the IP layer, where VLANS communicate. The PDU for this layer is known as packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transport layer - Transport layer deals with TCP and UDP ports, these is where the packets from layers 3 are sent to their destination ports. It is important to remember that TCP is a connection-oriented protocol while UDP is connection-less oriented protocol (non guranteed delivery of data). The PDU for this layer is datagrams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Session layer - Session layer is where the packets are encapsulated from being decapsulated from layer 3. This layer deals with multiple server side programming languages where you can create software-based applications and convert them into -&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Presentation layer - This layer is about the client-side codes you see on your web browser, or when you do a right-click and view the source, these are mainly HTM/CSS/Javascript codes that allows you to view your -&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Application layer - This is where the GUI (Graphical user interface) translates the HTML/CSS codes from layer 6 to this layer. What you see on your web browser is the front end GUI. Layer 5,6,7 PDU is called message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope these answer all OSI-related questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which OSI layer does IS-IS operate at? - Layer 3 &lt;br /&gt;&#xA;Is HTML a presentation or application protocol? - Presentation  &lt;br /&gt;&#xA;Are VPN tunnels layer 2 or 3? -&gt; L2TP is layer 2 -&gt; VPN tunnels typically works at layer3 such as IPSEC.&lt;/p&gt;&#xA;" OwnerUserId="4211" LastEditorUserId="4211" LastEditDate="2014-02-20T08:34:15.083" LastActivityDate="2014-02-20T08:34:15.083" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="6389" PostTypeId="1" AcceptedAnswerId="6391" CreationDate="2014-02-20T12:35:54.353" Score="13" ViewCount="13941" Body="&lt;p&gt;As far as I know we are using routing protocols to achieve Layer 3 connectivity, I am confused with the fact that BGP works over TCP which is L4. How can L4/TCP be established without prior L3 connectivity? &lt;/p&gt;&#xA;" OwnerUserId="3280" LastEditorUserId="8499" LastEditDate="2018-03-21T01:15:50.160" LastActivityDate="2018-11-07T16:50:52.727" Title="How does BGP work over TCP?" Tags="|tcp|bgp|internet|layer3|layer4|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6390" PostTypeId="2" ParentId="6374" CreationDate="2014-02-20T12:55:23.533" Score="7" Body="&lt;p&gt;Conceptually, it's quite simple:  You set up a wireless router and all your devices connect to it, creating a wireless LAN.  You don't need anything else.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few things to note:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You can use most any wireless router, including &quot;home&quot; versions.&lt;/li&gt;&#xA;&lt;li&gt;If the router also has LAN ports, plug your laptop into it.  That will greatly improve performance.&lt;/li&gt;&#xA;&lt;li&gt;If your Android devices support it, get a wireless router that operates in the 5GHz band.  In a trade show, there will be lots of wireless interference which will slow you down.  But there are more channels in the 5 GHz band so you are less likely to have interference.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-20T12:55:23.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6391" PostTypeId="2" ParentId="6389" CreationDate="2014-02-20T12:58:58.583" Score="17" Body="&lt;p&gt;TCP/IP sockets establish an end-to-end connection through the network, between two specifically addressed end points. BGP uses TCP/IP to communicate between routers (any devices exchanging routing information.) The information exchanged is used by the BGP peers, to better choose the way they choose where to send, (aka, next-hop) packets that they need to transmit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the very edges of the Internet, things are easy; &quot;everything is this way,&quot; towards your Internet provider. More in the middle, a router might have multiple choices. So it uses TCP/IP to move BGP traffic amongst its routing neighbors. The BGP information then tells the router which paths to prefer when there are multiple ways for a packet to get where it's going.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The end points (e.g. web browsers) and the routers are &lt;em&gt;speaking&lt;/em&gt; TCP/IP. But the routers are &lt;em&gt;using&lt;/em&gt; TCP/IP, (BGP communications composed of TCP/IP packets) to talk about what to do with the other TCP/IP packets they need to route.&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="-1" LastEditDate="2016-09-19T13:40:38.623" LastActivityDate="2016-09-19T13:40:38.623" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6392" PostTypeId="2" ParentId="6389" CreationDate="2014-02-20T13:01:17.377" Score="14" Body="&lt;p&gt;Routing protocols do not &quot;achieve&quot; L3 connectivity.  They populate the routing (forwarding) table of the router with information learned from other routers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP is an &quot;application&quot; that runs over TCP/IP.  In other words a BGP router uses TCP/IP to communicate with other BGP routers to exchange routing information.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order for BGP to work, you must already have L3 connectivity between the routers.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-20T13:01:17.377" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6394" PostTypeId="1" CreationDate="2014-02-20T14:05:08.390" Score="3" ViewCount="3380" Body="&lt;p&gt;I have configured a Cisco WLC 5508 to use the internal DHCP server and a windows NPS server. So far, all is working fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I want to use EAP authentication with an external DHCP server.  How can I achieve that, while still maintaining the internal DHCP server on the WLC for specific clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help&lt;/p&gt;&#xA;" OwnerUserId="4410" LastEditorUserId="44" LastEditDate="2014-02-20T14:33:39.723" LastActivityDate="2014-02-20T14:33:39.723" Title="Configure Cisco 5508 WLC with Internal DHCP and external DHCP" Tags="|cisco|wlc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6395" PostTypeId="2" ParentId="6394" CreationDate="2014-02-20T14:27:51.840" Score="4" Body="&lt;p&gt;The easiest way to achieve this would be to separate the clients into different SSIDs/WLANs.   Place the clients who need addresses from the Built-In DHCP server in one, and the clients who need addresses from the External DHCP server into another.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way, you could point the Proxy DHCP server IP address wherever you need it to go depeding on which client is requesting an address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(In my current environment at $DAYJOB, we're utilizing a similar configuration.  We're actually sending the proxy DHCP request to 3 different locations depending on the SSID.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could change the destination for the DHCP requests either on the Interface corresponding to the WLAN or on the Advanced tab of the WLAN itself.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2014-02-20T14:27:51.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6396" PostTypeId="1" AcceptedAnswerId="6399" CreationDate="2014-02-20T14:28:12.670" Score="4" ViewCount="10499" Body="&lt;p&gt;This is from the book: &quot;Computer Networking - A Top Down Approach&quot; :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;One subtle difference between a TCP socket and a UDP socket is that a&#xA;  TCP socket is identified by a four-tuple: (source IP address, source&#xA;  port number, destination IP address, destination port number). Thus,&#xA;  when a TCP segment arrives from the network to a host, the host uses&#xA;  all four values to direct (demultiplex) the segment to the appropriate&#xA;  socket.&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So when I look at TCP headers, such as the one below, I do not see any IP parts in the header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/r4oTN.gif&quot; alt=&quot;TCP Header&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How does TCP use IP information when passing the data to the correct socket?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt;&lt;sub&gt;Kurose, J. F., &amp;amp; Ross, K. W. (2013). &lt;em&gt;Computer networking: A top-down approach.&lt;/em&gt; Boston, Mass: Pearson.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="4048" LastEditorUserId="3191" LastEditDate="2014-02-20T16:00:30.280" LastActivityDate="2017-07-25T15:59:20.600" Title="How can a TCP socket be identified by IP address?" Tags="|tcp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6397" PostTypeId="2" ParentId="6389" CreationDate="2014-02-20T14:43:06.270" Score="5" Body="&lt;p&gt;The link has static addresses and associated routing entries configured, which are used for establishing the BGP session. Using BGP, the routing table is then extended with the entries pointing to other networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As BGP is only used between direct peers, no routes other than that pointing to the other end are required at this point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. if we wanted to peer, we'd agree on a /30 or /31 subnet, assign one address to each end of the network, and create a network route for that subnet to this link, then we'd configure the other as BGP peer, at which point I get additional routing entries for all networks you announce to be sent via your router (which in turn is part of the local statically configured network route).&lt;/p&gt;&#xA;" OwnerUserId="2069" LastActivityDate="2014-02-20T14:43:06.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6398" PostTypeId="2" ParentId="6389" CreationDate="2014-02-20T15:20:31.727" Score="0" Body="&lt;pre&gt;&lt;code&gt;                    ---        ---          ---          ---&#xA;                   | D |------| A |--------| B |--------| C |&#xA;                    ---        ---          ---          ---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Suppose A and B are routers(in different or same AS) and D and C are hosts. Now A and B are connected to each other and can communicate. But how would D be know C's position so that it can communicate to C. Same is true for C when it wants to communicate to D. Now if we run BGP protocol between A and B, they exchange the layer 3 connectivity information to each other. In simple terms, A will tell B that D is connected to it. Then either B can convey this to C or if B is default gateway for C, in either way C can know D's position.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in this case layer 3 connectivity information is passed between A and B, given A and B run BGP protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So prior BGP connection is needed between two systems in order to exchange layer 3 routing information. I have just shown a simple example to answer your query. In practical scenario, many more amount of routing data is exchanged between BGP peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP runs over TCP protocol. So a TCP socket must be opened between them, only then they can exchange routing data.&lt;/p&gt;&#xA;" OwnerUserId="4213" LastActivityDate="2014-02-20T15:20:31.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6399" PostTypeId="2" ParentId="6396" CreationDate="2014-02-20T15:52:43.547" Score="8" Body="&lt;p&gt;TCP header is located after the IP header, so the TCP/IP stack knows all four (and many more) values. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those four values are used to form a unique connection ID (&quot;socket&quot;), which is used to recieve and send packets to/from the remote host.&lt;/p&gt;&#xA;" OwnerUserId="1220" LastActivityDate="2014-02-20T15:52:43.547" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6400" PostTypeId="2" ParentId="6396" CreationDate="2014-02-20T15:53:25.063" Score="1" Body="&lt;p&gt;In IPv4, the protocols are added onto each other. So the IP datagram header you've linked contains just, (among other things not related to this discussion) the IP addresses of the sender and receiver. TCP and UDP build &quot;on top of&quot; IP by adding more header information after the IP header; in that extra information lies the port numbers, (and more) for the two endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick google for &quot;tcp packet header&quot; will show you what the TCP layer adds on after the IP header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(And the short answer to you Q &quot;how can a TCP socket be identified by IP address?&quot;, is that it cannot be.)&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2014-02-20T15:53:25.063" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6403" PostTypeId="1" AcceptedAnswerId="6409" CreationDate="2014-02-20T18:21:25.147" Score="4" ViewCount="3517" Body="&lt;p&gt;I'm trying to upgrade the code on a fresh, out of the box Cisco ASA 5510. However, whenever I transfer the code via TFTP I get the following message -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Writing file disk0:asa847-k8.bin...&#xA;&#xA;%Error writing disk0:asa847-k8.bin (I/O error)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run the dir command -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Directory of disk0:/&#xA;&#xA;4      drwx  4096        00:03:28 Jan 01 2003  .private&#xA;104    -rwx  15390720    06:13:14 Apr 29 2013  asa825-k8.bin&#xA;105    -rwx  16280544    08:07:02 Apr 29 2013  asdm-645.bin&#xA;106    -rwx  28672       00:00:00 Jan 01 1980  FSCK0000.REC&#xA;3      drwx  4096        00:02:54 Jan 01 2003  log&#xA;10     drwx  4096        00:03:06 Jan 01 2003  crypto_archive&#xA;11     drwx  4096        00:03:10 Jan 01 2003  coredumpinfo&#xA;107    drwx  4096        08:07:12 Apr 29 2013  boot&#xA;108    -rwx  4096        00:00:00 Jan 01 1980  FSCK0001.REC&#xA;109    -rwx  12998641    08:03:26 Apr 29 2013  csd_3.5.2008-k9.pkg&#xA;2      drwx  4096        08:04:16 Apr 29 2013  csco_config&#xA;110    drwx  4096        08:03:28 Apr 29 2013  sdesktop&#xA;111    -rwx  6487517     08:04:04 Apr 29 2013  anyconnect-macosx-i386-2.5.2014-k9.pkg&#xA;112    -rwx  6689498     08:04:12 Apr 29 2013  anyconnect-linux-2.5.2014-k9.pkg&#xA;113    -rwx  4678691     08:04:16 Apr 29 2013  anyconnect-win-2.5.2014-k9.pkg&#xA;115    -rwx  6326        10:02:44 Feb 20 2014  oldconfig_2014Feb20_1725.cfg&#xA;&#xA;No space information available&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;No space information available&lt;/code&gt; is kind of concerning. Is it possible the disk is bad? Anyone experience this issue before? Any tips or troubleshooting steps to get around this?&lt;/p&gt;&#xA;" OwnerUserId="4414" LastEditorUserId="3191" LastEditDate="2014-02-20T21:24:29.153" LastActivityDate="2014-02-21T07:46:10.577" Title="Can't Upload New ASA Image (I/O Error)" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6404" PostTypeId="1" CreationDate="2014-02-20T18:23:07.000" Score="3" ViewCount="8320" Body="&lt;p&gt;Good evening,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have setup Cisco Prime Infrastructure 2.0 and,  though I have added manually my 4 network cores as devices without any  problem, I can't get a single trap or a single SNMP information to be  pushed into my Cisco Prime Infra.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my SNMP config on my core :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server user *edited* *edited* v3&#xA;snmp-server  group *edited* v3 noauth notify *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF0F&#xA;snmp-server community *edited* RO&#xA;snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart&#xA;snmp-server enable traps flowmon&#xA;snmp-server enable traps transceiver all&#xA;snmp-server enable traps call-home message-send-fail server-fail&#xA;snmp-server enable traps tty&#xA;snmp-server enable traps rf&#xA;snmp-server enable traps memory&#xA;snmp-server enable traps cpu_threshold&#xA;snmp-server enable traps eigrp&#xA;snmp-server enable traps ospf state-change&#xA;snmp-server enable traps ospf errors&#xA;snmp-server enable traps ospf retransmit&#xA;snmp-server enable traps ospf lsa&#xA;snmp-server enable traps ospf cisco-specific state-change nssa-trans-change&#xA;snmp-server enable traps ospf cisco-specific state-change shamlink interface&#xA;snmp-server enable traps ospf cisco-specific state-change shamlink neighbor&#xA;snmp-server enable traps ospf cisco-specific errors&#xA;snmp-server enable traps ospf cisco-specific retransmit&#xA;snmp-server enable traps ospf cisco-specific lsa&#xA;snmp-server enable traps flex-links status&#xA;snmp-server enable traps fru-ctrl&#xA;snmp-server enable traps entity&#xA;snmp-server enable traps ethernet cfm cc mep-up mep-down cross-connect loop config&#xA;snmp-server enable traps ethernet cfm crosscheck mep-missing mep-unknown service-up&#xA;snmp-server enable traps ether-oam&#xA;snmp-server enable traps aaa_server&#xA;snmp-server enable traps flash insertion removal&#xA;snmp-server enable traps l2tc threshold sys-threshold&#xA;snmp-server enable traps power-ethernet police&#xA;snmp-server enable traps rep&#xA;snmp-server enable traps vswitch dual-active vsl&#xA;snmp-server enable traps udld link-fail-rpt status-change&#xA;snmp-server enable traps vtp&#xA;snmp-server enable traps vlancreate&#xA;snmp-server enable traps vlandelete&#xA;snmp-server enable traps auth-framework sec-violation&#xA;snmp-server enable traps dot1x auth-fail-vlan guest-vlan no-auth-fail-vlan no-guest-vlan&#xA;snmp-server enable traps envmon fan shutdown supply temperature status&#xA;snmp-server enable traps entity-diag boot-up-fail hm-test-recover hm-thresh-reached scheduled-test-fail&#xA;snmp-server enable traps port-security&#xA;snmp-server enable traps ethernet evc status create delete&#xA;snmp-server enable traps energywise&#xA;snmp-server enable traps ipsla&#xA;snmp-server enable traps vstack&#xA;snmp-server enable traps bfd&#xA;snmp-server enable traps bgp&#xA;snmp-server enable traps bulkstat collection transfer&#xA;snmp-server enable traps cef resource-failure peer-state-change peer-fib-state-change inconsistency&#xA;snmp-server enable traps config-copy&#xA;snmp-server enable traps config&#xA;snmp-server enable traps config-ctid&#xA;snmp-server enable traps event-manager&#xA;snmp-server enable traps hsrp&#xA;snmp-server enable traps ipmulticast&#xA;snmp-server enable traps isis&#xA;snmp-server enable traps msdp&#xA;snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message&#xA;snmp-server enable traps bridge newroot topologychange&#xA;snmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistency&#xA;snmp-server enable traps syslog&#xA;snmp-server enable traps isakmp policy add&#xA;snmp-server enable traps isakmp policy delete&#xA;snmp-server enable traps isakmp tunnel start&#xA;snmp-server enable traps isakmp tunnel stop&#xA;snmp-server enable traps ipsec cryptomap add&#xA;snmp-server enable traps ipsec cryptomap delete&#xA;snmp-server enable traps ipsec cryptomap attach&#xA;snmp-server enable traps ipsec cryptomap detach&#xA;snmp-server enable traps ipsec tunnel start&#xA;snmp-server enable traps ipsec tunnel stop&#xA;snmp-server enable traps ipsec too-many-sas&#xA;snmp-server enable traps errdisable&#xA;snmp-server enable traps ethernet cfm alarm&#xA;snmp-server enable traps vlan-membership&#xA;snmp-server enable traps mac-notification change move threshold&#xA;snmp-server enable traps vrfmib vrf-up vrf-down vnet-trunk-up vnet-trunk-down&#xA;snmp-server host *ip-address-edited* version 3 noauth *edited*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically all traps are enabled but absolutely nothing is showing up in my Prime Infra except that my 4 devices are &quot;Reachable&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a show snmp on the same device :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh snmp&#xA;&#xA;Chassis: *S/N Edited*&#xA;38554534 SNMP packets input&#xA;    0 Bad SNMP version errors&#xA;    14 Unknown community name&#xA;    0 Illegal operation for community name supplied&#xA;    0 Encoding errors&#xA;&#xA;38453185 Number of requested variables&#xA;&#xA;0 Number of altered variables&#xA;&#xA;17790703 Get-request PDUs&#xA;&#xA;20583581 Get-next PDUs&#xA;&#xA;0 Set-request PDUs&#xA;&#xA;0 Input queue packet drops (Maximum queue size 1000)&#xA;&#xA;38490708 SNMP packets output&#xA;&#xA;0 Too big errors (Maximum packet size 1500)&#xA;&#xA;0 No such name errors&#xA;&#xA;0 Bad values errors&#xA;&#xA;0 General errors&#xA;&#xA;38371069 Response PDUs&#xA;&#xA;13 Trap PDUs&#xA;&#xA;SNMP global trap: enabled&#xA;&#xA;SNMP agent enabled&#xA;&#xA;&#xA;&#xA;SNMP logging: enabled&#xA;&#xA;Logging to *edited*, 0/10, 13 sent, 0 dropped.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone point out what is wrong or missing in my configuration? I can't seem to single it out myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jeremy&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2018-03-08T14:36:09.210" Title="Cisco Prime Infrastructure 2.0 not pulling any SNMP data" Tags="|cisco|snmp|" AnswerCount="2" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6408" PostTypeId="2" ParentId="6403" CreationDate="2014-02-20T20:10:24.350" Score="2" Body="&lt;p&gt;Either the CF card is damaged or the filesystem is corrupt.  Note, the 5510 has &lt;em&gt;two&lt;/em&gt; CF cards; one external, and one internal.  The internal one is where the platform license information is stored, so if you erase it, make sure you have your activation key. (the asa will not show you those files, btw)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They're both FAT formatted, so any windows (or DOS) machine should be able to read them.  I'd suggest pulling them to make a backup before attempting to erase them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, some CF cards have a little switch to write-protect them. Check that it isn't in the WP mode.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-02-20T20:10:24.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6409" PostTypeId="2" ParentId="6403" CreationDate="2014-02-20T20:15:52.547" Score="4" Body="&lt;p&gt;As mentioned in the comments; The &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/81884-asa5500-disk0-error.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Support Forums&lt;/a&gt; suggest there might be something corrupt with disk0.  Since this is a new setup, (optionally) backup the contents, and reformat:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA(config)#format disk0:&#xA;Format operation may take a while. Continue? [confirm] y &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then upload your new image (e.g. TFTP):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA(config)#copy tftp disk0:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-02-21T07:46:10.577" LastActivityDate="2014-02-21T07:46:10.577" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6410" PostTypeId="1" AcceptedAnswerId="6412" CreationDate="2014-02-20T21:54:17.723" Score="5" ViewCount="5755" Body="&lt;p&gt;I have a Juniper EX2200 with JunOS 10.3R1.9 in a remote location, making it impossible for me to test. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be on-site for one day and while there, I would like to login through the console port using a serial to RJ45 cable. I need to know which accounts can login through that interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, I have an admin account (username: admin) which I'm able to use to login over SSH. Will I be able to use this account or does it have to be the &quot;root&quot; user? If it has to be root, how can I get/reset the password?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help.&lt;/p&gt;&#xA;" OwnerUserId="4420" LastActivityDate="2014-02-22T08:52:11.407" Title="Logging in to console port on Juniper EX2200" Tags="|switch|juniper|juniper-junos|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6412" PostTypeId="2" ParentId="6410" CreationDate="2014-02-21T00:01:51.573" Score="4" Body="&lt;p&gt;You can use your admin account.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-21T00:01:51.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6414" PostTypeId="1" AcceptedAnswerId="6415" CreationDate="2014-02-21T00:47:22.937" Score="5" ViewCount="7240" Body="&lt;p&gt;I have the following config on a brocade icx with the premium license for L3 features:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stack unit 1&#xA;  module 1 icx6450-24p-poe-port-management-module&#xA;  module 2 icx6450-sfp-plus-4port-40g-module&#xA;!&#xA;global-stp&#xA;!&#xA;!&#xA;!&#xA;vlan 10 by port&#xA; untagged ethe 1/1/1 to 1/1/24 ethe 1/2/1 &#xA; router-interface ve 10&#xA; spanning-tree 802-1w&#xA;!&#xA;vlan 50 name DEFAULT-VLAN by port&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!                                                                 &#xA;!&#xA;!&#xA;optical-monitor 1&#xA;boot sys fl sec&#xA;enable telnet password .....&#xA;enable super-user-password .....&#xA;ip dhcp-server enable&#xA;!&#xA;ip dhcp-server pool noc&#xA; dhcp-default-router 10.10.10.1 &#xA; dns-server 208.67.222.222 &#xA; domain-name noc.com&#xA; excluded-address 10.10.10.1 10.10.10.10&#xA; lease 1 0 0&#xA; network 10.10.10.0 255.255.255.0&#xA; deploy&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 x.x.x.137&#xA;!&#xA;fdp run&#xA;&#xA;!&#xA;!&#xA;interface ethernet 1/2/1&#xA; port-name To_9/11&#xA; speed-duplex 1000-full-master&#xA;!&#xA;interface ve 10&#xA; ip address x.x.x.140 255.255.255.248&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a PC plugged into a random port 17 but it's not able to get a lease from this switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The logs show this when the PC tries to renew its ip:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0d03h52m09s:A:DHCPS: unable to find an address pool for rx port 10, dropping DHCPOFFER message&#xA;0d03h52m09s:A:DHCPS: Exhausts all allocation methods, no address pool found from received port 10 &#xA;0d03h51m53s:A:DHCPS: unable to find an address pool for rx port 10, dropping DHCPOFFER message&#xA;0d03h51m53s:A:DHCPS: Exhausts all allocation methods, no address pool found from received port 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyone know how I can get this to work properly and so that once the PC's get a lease, they will be able to browse the internet, etc?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made the following changes and now the PC is able to get a lease.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;added a new vlan and put port 17 into it along with creating a new ve instance&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; vlan 20 by port&#xA;     untagged ethe 1/1/17 &#xA;     router-interface ve 20&#xA;    spanning-tree 802-1w&#xA;&#xA;&#xA;interface ve 20&#xA; ip address 10.10.10.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I got this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0d04h19m04s:I:DHCPS: sending ACK message to client 10.10.10.11    &#xA;0d04h19m04s:I:DHCPS: verified client requested address 10.10.10.11 in lease binding, updating entry&#xA;0d04h19m04s:I:DHCPS: No ARP-PING reply from client 10.10.10.11&#xA;&#xA;Bindings from all pools:&#xA;    IP Address    Client-ID/        Lease expiration Type&#xA;                  Hardware address&#xA;&#xA;   10.10.10.11    0013.72d1.c847   000d:23h:49m:43s   Automatic&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now just need to make sure I can browse the internet from the PC tomorrow and I'm all good!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though I figured it out on my own...hope this helps someone and thanks everyone :)&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="412" LastEditDate="2014-02-21T17:44:27.527" LastActivityDate="2018-12-17T22:38:01.817" Title="DHCP with Brocade" Tags="|dhcp|brocade|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6415" PostTypeId="2" ParentId="6414" CreationDate="2014-02-21T02:00:30.747" Score="5" Body="&lt;pre&gt;&lt;code&gt;interface ve 10&#xA; ip address x.x.x.140 255.255.255.248&#xA;&#xA;ip dhcp-server pool noc&#xA; network 10.10.10.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It doesn't work because &lt;code&gt;ve 10&lt;/code&gt; (the L3 interface) isn't within the &lt;code&gt;noc&lt;/code&gt; dhcp pool (10.10.10.0/24)  Your updated &lt;code&gt;ve 20&lt;/code&gt; is, but unless you have something upstream of here doing NAT, there won't be any internet access.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-02-21T02:00:30.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6421" PostTypeId="2" ParentId="6410" CreationDate="2014-02-21T07:58:14.680" Score="7" Body="&lt;p&gt;Your Juniper EX2200 console connections will use the same connection you use when logging in remotely.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting &lt;code&gt;root&lt;/code&gt; is completely dependent on your setup.  The following syntax would prevent root login:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root-authentication {&#xA;    encrypted-password ****disabled****; ## SECRET-DATA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This makes it impossible to login via the root account.  If you absolutely needed to get into this account, you would have to perform a &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.3/topics/task/configuration/authentication-root-password-recovering.html&quot; rel=&quot;noreferrer&quot;&gt;Juniper Password Recovery&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-21T07:58:14.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6426" PostTypeId="1" AcceptedAnswerId="6431" CreationDate="2014-02-21T10:56:50.477" Score="3" ViewCount="7656" Body="&lt;p&gt;I was browsing through the web about WAN technologies, and came across &lt;a href=&quot;https://peering.google.com/about/delivery_ecosystem.html&quot; rel=&quot;nofollow&quot;&gt;Google Peering&lt;/a&gt;, It seems they have rolled out their backbone across the globe, and have multiple peering locations globally. I have a couple questions to ask:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What is an Edge Points of Presence (POP)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is Google now considered a Tier1 network? Do they no longer have to buy IP transit from tier 1 networks and can peer directly with them?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4211" LastEditorUserId="775" LastEditDate="2014-02-21T13:56:44.033" LastActivityDate="2014-02-21T14:16:44.350" Title="What is an Edge Points of Presence (POPs)" Tags="|service-provider|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6430" PostTypeId="1" AcceptedAnswerId="6432" CreationDate="2014-02-21T13:10:25.750" Score="1" ViewCount="229" Body="&lt;p&gt;I am trying to find out the description of a particular interface in a 2950 Cisco switch, the interface has no description and I am trying to find out what device is connected to it.&#xA;I've ran a couple of commands such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;sh arp&lt;/li&gt;&#xA;&lt;li&gt;sh mac address-table&lt;/li&gt;&#xA;&lt;li&gt;sh cdp nei&lt;/li&gt;&#xA;&lt;li&gt;sh cdp nei fa0/2 detail&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;but it does not show which device is connected to this interface. &lt;/p&gt;&#xA;" OwnerUserId="4211" LastEditorUserId="4211" LastEditDate="2014-02-21T13:16:40.230" LastActivityDate="2014-02-21T13:40:57.810" Title="Determine description of switch interface that is not labeled" Tags="|cisco|" AnswerCount="1" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6431" PostTypeId="2" ParentId="6426" CreationDate="2014-02-21T13:11:50.553" Score="4" Body="&lt;p&gt;The answer to your first question is on the page you mentioned: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Google has 70+ Edge POPs in 32 countries, interconnected via Google's backbone network. This is where we interconnect via peering with other network operators who then deliver Google traffic to users. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So Edge POPs are locations where Google interconnects with other networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure, but I don't think Google is Tier1 (yet?). It's not mentioned on the &lt;a href=&quot;http://en.wikipedia.org/wiki/Tier_1_network#List_of_tier_1_networks&quot; rel=&quot;nofollow&quot;&gt;list of Tier1's&lt;/a&gt; on Wikipedia at least, but I can't tell for sure based on the routing tables I checked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third question is impossible to answer, it's too broad. It all depends on the length and location of those fibers, if you want to buy existing ones or place them yourself, etc. But you can be sure it isn't cheap.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-02-21T13:11:50.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6432" PostTypeId="2" ParentId="6430" CreationDate="2014-02-21T13:40:57.810" Score="2" Body="&lt;p&gt;&lt;strong&gt;show arp&lt;/strong&gt; should not help you as this device is a layer2 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show cdp neigh&lt;/strong&gt; should help you only if CDP is running on both this device and the other end&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show mac address-table&lt;/strong&gt; should help you, giving you at least one mac address seen on the other side of this link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By trial and error you should be able to find the MAC address of the other side of the link in the mac address-table of this device. To get the mac address of an interface, use show interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While doing this, please document all the links, by doing a documentation you will never have to do this again. Easiest way is to track the cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Side note: I supposed the port is up/up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another trick you can use it to put the port in 10MBps and check the other switches for a 10MBps port. Or half duplex can be used also.&lt;/p&gt;&#xA;" OwnerUserId="4436" LastActivityDate="2014-02-21T13:40:57.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6433" PostTypeId="1" AcceptedAnswerId="6438" CreationDate="2014-02-21T13:53:40.010" Score="3" ViewCount="3312" Body="&lt;p&gt;We have an application server that our company's branches connect to. Right now, they can connect because the E.R.P app developer configured our main router for port forwarding. They connect by typing &lt;code&gt;1.1.1.1:9001/forms/servlet&lt;/code&gt; into a web browser. 1.1.1.1 is the router's interface connected to the ISP (1.1.1.1 made up).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our internal subnet is on the 192.168.1.0/24 subnet, the server in question is 192.168.1.25. We have 2 ISPs connected to 2 different routers, one is for backup in case the primary goes down. I want to configure the backup router (Cisco RV042) for port forwarding but I am a bit confused regarding which ports and addresses to use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume 2.2.2.2 is the IP address of the second router's interface connected to the ISP. How would I forward this to my application server?&lt;/p&gt;&#xA;" OwnerUserId="4439" LastEditorUserId="3191" LastEditDate="2014-02-22T07:36:10.307" LastActivityDate="2014-02-22T07:36:10.307" Title="Cisco RV042 Port Forwarding" Tags="|cisco|router|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6435" PostTypeId="1" AcceptedAnswerId="6439" CreationDate="2014-02-21T14:14:27.400" Score="5" ViewCount="2584" Body="&lt;p&gt;Let's assume there are two firewalls (ASA) clustered together and two routers (1800 and 2900) each with it's own WAN link. The two routers are managed from the same ISP (it's just link redundancy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is my setup.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ASA    ASA&#xA;   |\    /|   &#xA;   | \  / |&#xA;   |  \/  |&#xA;   |  /\  |&#xA;   | /  \ |&#xA;   |/    \|&#xA;   R1    R2 &#xA;   |      |&#xA;(Cloud) (Cloud)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to have the redundant WAN connection take over in case of a failure? If so, how? &lt;/p&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="3191" LastEditDate="2014-02-21T14:51:39.523" LastActivityDate="2014-02-23T20:39:08.800" Title="Clustered ASA with Dual WAN Redundancy" Tags="|redundancy|wan|isp|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6436" PostTypeId="2" ParentId="6426" CreationDate="2014-02-21T14:16:44.350" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Do they no longer have to buy IP transit from tier 1 networks and can&#xA;  peer directly with them?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can't imagine any Tier 1 provider, in their right mind, would peer with Google for no monetary value. Ever.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google (i.e. Youtube) is a source of a large percentage of global internet traffic, &lt;a href=&quot;http://techcrunch.com/2011/05/17/netflix-largest-internet-traffic/&quot; rel=&quot;nofollow&quot;&gt;11% back in 2011&lt;/a&gt;.  The premise behind a peering agreement is that 2 providers transmit an equal amount of each others traffic for a few reasons. But most notably, redundancy and performance.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have one peer in this agreement making up an unbalanced source of internet traffic, you begin to get ugly disputes, like the one between &lt;a href=&quot;http://www.fiercetelecom.com/story/verizon-blames-cogent-unbalanced-peering-netflix-dispute/2013-06-20&quot; rel=&quot;nofollow&quot;&gt;Cogent (Netflix's ISP) and Verizon&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-21T14:16:44.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6437" PostTypeId="2" ParentId="526" CreationDate="2014-02-21T15:47:18.690" Score="1" Body="&lt;p&gt;I've tried this before. Let me show you what've done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I have created the SDPs as GRE.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;far-end 10.1.0.6&#xA;signaling off&#xA;keep-alive&#xA; shutdown&#xA;exit&#xA;no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then create your IES service. Now, when creating the spoke-spd and as signaling is off (since you are using GRE), then you need to manually establish ingress and egress vc-labels.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ies 100 customer 1 create&#xA; interface &quot;to_SARA_2&quot; create&#xA;  address 192.168.0.1/30&#xA;  spoke-sdp 12:100 create&#xA;   ingress&#xA;    vc-label 2048&#xA;   exit&#xA;   egress&#xA;    vc-label 2048&#xA;   exit&#xA;  exit&#xA; exit&#xA; no shutdown&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This last thing does the trick and you can then forward traffic using GRE instead of MPLS ...&lt;/p&gt;&#xA;" OwnerUserId="4441" LastEditorUserId="3191" LastEditDate="2014-02-21T16:06:19.160" LastActivityDate="2014-02-21T16:06:19.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6438" PostTypeId="2" ParentId="6433" CreationDate="2014-02-21T16:01:06.563" Score="3" Body="&lt;p&gt;It doesn't look like you're doing any complex port forwarding with this setup.  All you need to do is specify a private IP address for inbound requests to port 9001 to head to.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  2.2.2.2:9001 --------&amp;gt; 192.168.1.25:9001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can access the port forwarding options on the RV042, under Setup &gt; Forwarding&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out the full &lt;a href=&quot;http://s3.amazonaws.com/szmanuals/5890c9cc77fda234e2a0d7c5efb8f877&quot; rel=&quot;nofollow&quot;&gt;RV042 Manual&lt;/a&gt; for more information, page 14 has more info on Port Forwarding.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-21T16:01:06.563" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="6439" PostTypeId="2" ParentId="6435" CreationDate="2014-02-21T16:16:53.883" Score="2" Body="&lt;p&gt;Here is a high level view of one solution:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connect the LAN side of the routers and the outside of the ASA in a single VLAN.  You will need an additional switch if your routers do not have multiple Ethernet ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure HSRP on your routers, and make the VIP address the default gateway of the ASAs.  The router's static route to the inside is the ASA primary address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure HSRP to track the interface of each WAN link.  So if the WAN link goes down, the HSRP priority is reduced, causing the other router to become the active peer.  In this way, only the router with an &quot;up&quot; WAN link will be the HSRP active router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to get fancy, you can set up IP SLA to ping the ISP to verify reachability, not just interface status, and let HSRP track that.   Or, you can run BGP with your provider (default route only) to verify reachability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know which way you want to go, and I can come up with some sample configs if needed.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-21T16:16:53.883" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6441" PostTypeId="1" AcceptedAnswerId="6443" CreationDate="2014-02-21T20:02:39.570" Score="3" ViewCount="34828" Body="&lt;p&gt;I have a LACP bonded trunk link between 2 switches, the bond contains 4 interfaces; all interfaces work fine except one. Cisco says you have to have matching configurations on all interfaces.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The speed on the suspended interface was operating to auto-100, however, the bonded interfaces are operating at auto-1000. If I override this value with &lt;code&gt;speed 1000&lt;/code&gt;, the link goes &lt;code&gt;not connected&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Switch 1&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NON WORKING INTERFACE:&#xA;GigabitEthernet0/1 is up, line protocol is down (SUSPENDED)&#xA;  Hardware is Gigabit Ethernet, address is XXXX.XXXX.XXXX (bia XXX.XXXX.XXXX)&#xA;  MTU 9000 bytes, BW 100000 Kbit, DLY 100 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 100Mb/s, media type is 10/100/1000BaseTX&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 1d03h, output 1d04h, output hang never&#xA;&#xA;WORKING INTERFACE ON SWITCH 1:&#xA;GigabitEthernet0/2 is up, line protocol is up (connected)&#xA;  Hardware is Gigabit Ethernet, address is XXXX.XXXX.XXXX (bia XXXX.XXXX.XXXX)&#xA;  MTU 9000 bytes, BW 1000000 Kbit, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:11, output 00:00:08, output hang never&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4444" LastEditorUserId="3191" LastEditDate="2014-02-21T23:15:06.673" LastActivityDate="2017-09-26T15:20:40.937" Title="LACP Suspended Trunk Link" Tags="|switch|trunk|ieee-802.1ax|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6443" PostTypeId="2" ParentId="6441" CreationDate="2014-02-21T20:36:04.093" Score="2" Body="&lt;p&gt;Assuming the other side of Gi 0/1 is also a GigabitEthernet, the most likely cause is a bad cable.  You need a cable with all four pairs connected.  100M will work with only two pairs.   That is probably why you negotiate to 100M. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more info on how GE uses all four pairs, see: &lt;a href=&quot;http://goo.gl/DMYkSM&quot; rel=&quot;nofollow&quot;&gt;http://goo.gl/DMYkSM&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-21T20:36:04.093" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6444" PostTypeId="2" ParentId="6389" CreationDate="2014-02-21T21:28:48.317" Score="6" Body="&lt;p&gt;The OSI network model and its layering is useful for understanding end-to-end communication between hosts, but it is not really intended to explain how the network control plane functions.  There is a bootstrapping problem inherent in establishing full BGP connectivity, but the way that this bootstrapping takes place is well understood and does not have any circular dependencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of BGP, the way that adjacencies are formed and information is exchanged depends on the type of session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simplest is eBGP.  Typically eBGP runs on a TCP session between two directly connected routers.  In this case each peer knows how to talk to the other because both of them have an interface on the same subnet, so there is no need to use an external routing protocol to form the adjacency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With iBGP things are slightly complicated.  In the simplest configuration all routers within an autonomous system will be configured as part of a full mesh, with iBGP sessions with all other routers in the network.  Within the autonomous system an interior gateway protocol such as OSPF or ISIS in order to build up the internal routing topology.   When the IGP has done it's job, all routers will have a routing table populated with routes to all the iBGP neighbours allowing the TCP session to form with no circular dependency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where things get a little more interesting is in situations where not all routers within the autonomous system run with a full BGP table. If the iBGP mesh is not complete you can get situations where a router in the middle of the network has a different view of the table that its direct neighbours.  This will cause sub-optimal routing, and in some cases routing loops that will lead to traffic bouncing between devices until the TTL expires.&lt;/p&gt;&#xA;" OwnerUserId="4440" LastActivityDate="2014-02-21T21:28:48.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6445" PostTypeId="2" ParentId="5109" CreationDate="2014-02-21T21:50:44.357" Score="3" Body="&lt;p&gt;I guess I should start by saying that IP prefixes are not technically bought.  When an IP prefix is allocated to a provider from an RIR like ARIN, there is no transfer of ownership.  The IP range is always allocated to the RIR, and the allocation to the provider is only valid so long as the original terms of the allocation are upheld.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the routing part of the question, it is hard to give a specific answer without details on the actual prefixes used; however the most likely explanation is that some providers have policies in place which are not accepting the more specific /24 announcements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume that the site in the US is announcing the entire /19 range, so any ISP that does not carry the specific /24 prefix will instead route towards the covering /19.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for why some of the ISPs are not accepting the specific /24 announcements, this can have a number of reasons, and to be honest you are only going to be able to get a definitive answer from the ISP doing the filtering; however there are a few things you can try to improve your chances of the announcements being accepted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some ISPs will build their policies dynamically from information in routing registries.  My experience is strongest in the RIPE service region, where routing policy can be registered using RPSL syntax in the RIPE database.  ARIN also have a routing registry, but for the ARIN service region it is more common to register policy with the Merit RADb at ra.net.  &lt;a href=&quot;http://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure&quot; rel=&quot;nofollow&quot;&gt;RPKI&lt;/a&gt;  is still in it's early days and not many people are using RPKI in their policies; however it is an area to consider for the future which may allow for more reliable route distribution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you have seen, if the route is not in the table of these other ISPs then you are not going to be able to influence their routing by means of attributes on your announcements (i.e. as path length, communities, etc).  You are only going to fix things by getting them to accept your announcement.&lt;/p&gt;&#xA;" OwnerUserId="4440" LastActivityDate="2014-02-21T21:50:44.357" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6446" PostTypeId="2" ParentId="6441" CreationDate="2014-02-21T23:09:42.693" Score="4" Body="&lt;p&gt;The issue is that the link speed of the suspended interface is not the same as the rest of the interfaces in the bundle.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your working interfaces are operating at&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BW 1000000 Kbit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whereas, your suspended interfaces are working at&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BW 100000 Kbit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The most common problem for interfaces that refuse to come up to auto-1000 are damaged cables.  This assumption alone shouldn't disqualify the possibility of a configuration error, though.  Verify both sides of the interface are set to autonegotiate the link speed to make sure that isn't why your link hasn't come up to 1Gb.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-21T23:09:42.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6448" PostTypeId="2" ParentId="5803" CreationDate="2014-02-22T01:44:24.960" Score="0" Body="&lt;p&gt;NN in 12.1XNN means. Its a special branch version. The code has been specifically modified for a particular customer or for a particular fix. :)&lt;/p&gt;&#xA;" OwnerUserId="4447" LastActivityDate="2014-02-22T01:44:24.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6449" PostTypeId="1" CreationDate="2014-02-22T01:46:27.387" Score="5" ViewCount="1149" Body="&lt;p&gt;I have the following design:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MPLS PE --- CE --- L2 SW --- CE --- PE MPLS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CEs are connected to a regular L3VPN MPLS network (same provider) and they use private ASN. There is one single L2 switch connected via access ports to a router. These links are design to be active-active with load-sharing. The routers are running GLBP with each other for FHRP and tracking the CE-PE link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the advantages/pros and what are the disadvantages/cons or running iBGP between the CE routers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully someone will provide some insight on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="1426" LastActivityDate="2014-03-27T03:15:53.363" Title="To iBGP or not to iBGP?" Tags="|bgp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6453" PostTypeId="2" ParentId="6410" CreationDate="2014-02-22T08:11:35.983" Score="4" Body="&lt;p&gt;On the subject of setting the password for the root account, if your admin account has super-user access then you will not need to go through the full password recovery process.  While logged in with your admin account you can set the password directly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;admin@host&amp;gt; edit system&#xA;[system]&#xA;admin@host# set root-authentication plain-text-password&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then follow the prompts to set the password and commit the resulting changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see the permissions associated with the account use &lt;code&gt;show configuration system login&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user admin {&#xA;    class super-user;                   &#xA;    authentication {&#xA;        encrypted-password &quot;$1$t6aUxua2$dhxaXHtnsjn6xluapjx0C0&quot;; ## SECRET-DATA&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4440" LastEditorUserId="3191" LastEditDate="2014-02-22T08:52:11.407" LastActivityDate="2014-02-22T08:52:11.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6454" PostTypeId="1" AcceptedAnswerId="6455" CreationDate="2014-02-22T08:46:45.270" Score="4" ViewCount="740" Body="&lt;p&gt;I would like to know more about EIGRP MD5 authentication in the following situation:&#xA;an attacker captured the MD5 hashed key and send to the target router to fake the authentication, is it possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thx for any comment.&lt;/p&gt;&#xA;" OwnerUserId="4450" LastActivityDate="2014-02-22T10:36:43.973" Title="EIGRP MD5 authentication" Tags="|cisco|security|eigrp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6455" PostTypeId="2" ParentId="6454" CreationDate="2014-02-22T10:36:43.973" Score="4" Body="&lt;p&gt;No, that isn't possible unless they know (or obtain) the shared secret.  &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_eigrp/configuration/xe-3s/ire-xe-3s-book/ire-sha-256.html&quot; rel=&quot;nofollow&quot;&gt;Cisco&lt;/a&gt; outlines how the authentication takes place.&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The device sending a packet calculates the hash to be sent based on&#xA;  the following:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Key part 1—the configured shared secret.&lt;/li&gt;&#xA;  &lt;li&gt;Key part 2—the local interface address from which the packet will be sent.&lt;/li&gt;&#xA;  &lt;li&gt;Data—the EIGRP packet to be sent (prior to the addition of the IP header).&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The instance you're talking about is called &lt;a href=&quot;http://en.wikipedia.org/wiki/Pass_the_hash&quot; rel=&quot;nofollow&quot;&gt;Pass the hash&lt;/a&gt;, which involves sniffing a hash, and then sending it back with the rest of the modified data without any actual knowledge of what was used to generate the hash. EIGRP would be vulnerable to this if if didn't use the local interface and the data inside the packet to generate its hashes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So no, an attacked really couldn't perform any of this unless he had prior knowledge of the shared secret.  He could, however, capture a hello packet between neighbors, and then attempt to crack it.  If you're key-length and complexity are high, though, you won't have much to worry about.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt;&lt;sub&gt;Note: this is based on HMAC-SHA-256 authentication, but the same process should still be true with MD5.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-22T10:36:43.973" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6456" PostTypeId="1" AcceptedAnswerId="6469" CreationDate="2014-02-22T11:28:57.043" Score="4" ViewCount="1499" Body="&lt;p&gt;hello to all my friends...&#xA;i configured this scenario &lt;strong&gt;but&lt;/strong&gt; R1 only traces until 10.10.13.3 (R3) !&lt;br&gt;&#xA;plz help me...  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All routers have a loopback &lt;code&gt;0&lt;/code&gt; interface &lt;code&gt;X.X.X.X/32&lt;/code&gt; where &lt;code&gt;X&lt;/code&gt; is the number of the router.&lt;/li&gt;&#xA;&lt;li&gt;Configure OSPF on R1, R2, R3 and advertise &lt;code&gt;10.10.12.0/24, 10.10.13.0/24&lt;/code&gt; and loopback &lt;code&gt;0&lt;/code&gt; subnets&lt;/li&gt;&#xA;&lt;li&gt;Configure OSPF on R4, R5 and advertise &lt;code&gt;150.45.45.0/26&lt;/code&gt; and loopback 0 subnets&lt;/li&gt;&#xA;&lt;li&gt;Configure full iBGP mesh in AS 123, use loopback 0 interface for peering&lt;/li&gt;&#xA;&lt;li&gt;Configure iBGP in AS 45, use loopback 0 interface for peering&lt;/li&gt;&#xA;&lt;li&gt;Configure eBGP between AS 123 and AS 45&lt;/li&gt;&#xA;&lt;li&gt;Advertise R1 loopback 0 and &lt;code&gt;150.45.45.0/26&lt;/code&gt; in BGP&lt;/li&gt;&#xA;&lt;li&gt;Ensure AS 123 will use the link between R3-R5 towards network &lt;code&gt;150.45.45.0/26&lt;/code&gt;. Use MED attribute only.&lt;/li&gt;&#xA;&lt;li&gt;Ensure AS 45 will use the link between R3-R5 towards network 1.1.1.1/32. Use MED attribute only.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fR9eE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;all configs&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R6&#xA;    router ospf 10&#xA;     log-adjacency-changes&#xA;     network 1.1.1.1 0.0.0.0 area 0&#xA;     network 10.10.12.0 0.0.0.255 area 0&#xA;     network 10.10.13.0 0.0.0.255 area 0&#xA;    !&#xA;    router bgp 123&#xA;     no synchronization&#xA;     bgp log-neighbor-changes&#xA;     network 1.1.1.1 mask 255.255.255.255&#xA;     neighbor 2.2.2.2 remote-as 123&#xA;     neighbor 2.2.2.2 update-source Loopback0&#xA;     neighbor 3.3.3.3 remote-as 123&#xA;     neighbor 3.3.3.3 update-source Loopback0&#xA;     no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 10&#xA; log-adjacency-changes&#xA; network 2.2.2.2 0.0.0.0 area 0&#xA; network 10.10.12.0 0.0.0.255 area 0&#xA;!&#xA;router bgp 123&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; neighbor 1.1.1.1 remote-as 123&#xA; neighbor 1.1.1.1 update-source Loopback0&#xA; neighbor 1.1.1.1 next-hop-self&#xA; neighbor 3.3.3.3 remote-as 123&#xA; neighbor 3.3.3.3 update-source Loopback0&#xA; neighbor 3.3.3.3 next-hop-self&#xA; neighbor 24.0.0.2 remote-as 45&#xA; neighbor 24.0.0.2 route-map RM-SET-MED out&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip prefix-list NET-1 seq 5 permit 1.1.1.1/32&#xA;!&#xA;!&#xA;!&#xA;route-map RM-SET-MED permit 10&#xA; match ip address prefix-list NET-1&#xA; set metric 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 10&#xA; log-adjacency-changes&#xA; network 3.3.3.3 0.0.0.0 area 0&#xA; network 10.10.13.0 0.0.0.255 area 0&#xA;!&#xA;router bgp 123&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; neighbor 1.1.1.1 remote-as 123&#xA; neighbor 1.1.1.1 update-source Loopback0&#xA; neighbor 1.1.1.1 next-hop-self&#xA; neighbor 2.2.2.2 remote-as 123&#xA; neighbor 2.2.2.2 update-source Loopback0&#xA; neighbor 2.2.2.2 next-hop-self&#xA; neighbor 35.0.0.2 remote-as 45&#xA; neighbor 35.0.0.2 route-map RM-SET-MED out&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip prefix-list NET-1 seq 5 permit 1.1.1.1/32&#xA;!&#xA;!&#xA;!&#xA;route-map RM-SET-MED permit 10&#xA; match ip address prefix-list NET-1&#xA; set metric 10&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R4 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 100&#xA; log-adjacency-changes&#xA; network 4.4.4.4 0.0.0.0 area 0&#xA; network 150.45.45.4 0.0.0.0 area 0&#xA;!&#xA;router bgp 45&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; network 150.45.45.0 mask 255.255.255.192&#xA; neighbor 5.5.5.5 remote-as 45&#xA; neighbor 5.5.5.5 update-source Loopback0&#xA; neighbor 5.5.5.5 next-hop-self&#xA; neighbor 24.0.0.1 remote-as 123&#xA; neighbor 24.0.0.1 route-map RM-SET-MED out&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip prefix-list NET-150 seq 5 permit 150.45.45.0/26&#xA;!&#xA;!&#xA;!&#xA;route-map RM-SET-MED permit 10&#xA; match ip address prefix-list NET-150&#xA; set metric 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R5 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 100&#xA; log-adjacency-changes&#xA; network 5.5.5.5 0.0.0.0 area 0&#xA; network 150.45.45.5 0.0.0.0 area 0&#xA;!&#xA;router bgp 45&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; network 150.45.45.0 mask 255.255.255.192&#xA; neighbor 4.4.4.4 remote-as 45&#xA; neighbor 4.4.4.4 update-source Loopback0&#xA; neighbor 4.4.4.4 next-hop-self&#xA; neighbor 35.0.0.1 remote-as 123&#xA; neighbor 35.0.0.1 route-map RM-SET-MED out&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip prefix-list NET-150 seq 5 permit 150.45.45.0/26&#xA;!&#xA;!&#xA;!&#xA;route-map RM-SET-MED permit 10&#xA; match ip address prefix-list NET-150&#xA; set metric 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3985" LastEditorUserId="775" LastEditDate="2014-02-22T12:59:40.650" LastActivityDate="2014-02-24T06:28:56.010" Title="OSPF/BGP/Route-Map issue" Tags="|cisco|routing|bgp|ospf|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6459" PostTypeId="1" CreationDate="2014-02-22T16:29:24.180" Score="2" ViewCount="4498" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1pyfb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to connect the printer to 2 vlans at the switch I would need to trunk that port to the two vlans?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image is the network that I am planning to build. &lt;/p&gt;&#xA;" OwnerUserId="4117" LastActivityDate="2014-02-25T11:37:59.987" Title="Printer being shared on two VLans" Tags="|vlan|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-08T16:03:11.947" ContentLicense="CC BY-SA 3.0" />
  <row Id="6460" PostTypeId="2" ParentId="6459" CreationDate="2014-02-22T16:44:52.047" Score="2" Body="&lt;p&gt;Getting a printer on 2 VLANs at the same time isn't practical.  Unless there is some limitation between the VLANs (i.e. ACL), your easiest option is to just put the printer on one VLAN, and then get the people in the neighboring VLAN to communicate with it through the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PfSense can certainly route between VLANs, so you shouldn't have any issues.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-22T16:44:52.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6467" PostTypeId="2" ParentId="6435" CreationDate="2014-02-23T20:39:08.800" Score="2" Body="&lt;p&gt;I'll piggy-back what Ron said; HSRP with an IP SLA is the way to go.  This will allow you to fallback on your alternate ISP if your primary link goes down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a reference to work off of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip sla monitor 1&#xA; type echo protocol ipIcmpEcho 1.1.1.1&#xA; timeout 1000&#xA; frequency 3&#xA;!&#xA;ip sla monitor schedule 1 life forever start-time now&#xA;!&#xA;track 1 rtr 1&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 10.1.1.1 255.255.255.0&#xA; standby ip 10.1.1.254&#xA; standby priority 120&#xA; standby preempt&#xA; standby track 1 decrement 40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip sla monitor 1&#xA; type echo protocol ipIcmpEcho 2.2.2.2&#xA; timeout 1000&#xA; frequency 3&#xA;!&#xA;ip sla monitor schedule 1 life forever start-time now&#xA;!&#xA;track 1 rtr 1&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 10.1.1.2 255.255.255.0&#xA; standby ip 10.1.1.254&#xA; standby priority 100&#xA; standby preempt&#xA; standby track 1 decrement 40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-23T20:39:08.800" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6469" PostTypeId="2" ParentId="6456" CreationDate="2014-02-24T06:28:56.010" Score="5" Body="&lt;p&gt;Have you used command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute 150.45.45.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute 150.45.45.5 source l0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that R4 and R5 have only route to 1.1.1.1/32 in AS 123 and that if you do traceroute 150.45.45.5 from R1, it will by default IP of outgoing interface as a source IP (in this case 10.10.13.1), to which R4 and R5 don't have a route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Always consider not only if your side have a route to the destination but also if the remote side has a route back to you.&lt;/p&gt;&#xA;" OwnerUserId="75" LastActivityDate="2014-02-24T06:28:56.010" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6471" PostTypeId="1" CreationDate="2014-02-24T15:28:49.093" Score="5" ViewCount="13264" Body="&lt;p&gt;From the documentation on the AP it looks like it can broadcast 2 BSSIDs with the same SSID.  One on 2.4 Ghz and one on 5 GHz. Devices see one SSID and those that can connect on 5 are connected on 5 (a/n) and devices that can only connect on 2.4 (b/g/n) fail-over to 2.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find instructions to do this.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is my understanding of the documentation correct?&lt;/li&gt;&#xA;&lt;li&gt;If so, how do I set this up?&lt;/li&gt;&#xA;&lt;li&gt;Any downsides I should be aware of? (interference, etc)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1331" LastActivityDate="2015-05-15T10:21:01.143" Title="Setup Cisco AP 1602 to broadcast 2.4 &amp; 5Ghz on the same SSID" Tags="|cisco|wireless|aironet|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6477" PostTypeId="2" ParentId="6449" CreationDate="2014-02-24T23:12:06.927" Score="3" Body="&lt;p&gt;From routing point of view for this particular setup I don't think there is any problem apart from discontiguous AS, but that's just a cosmetic thing here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, you will lose traffic engineering ability for upstream traffic, which may or may not be an issue and it will create asymetric routing and may cause unbalanced use of inter-AS links. While with iBGP you'd have outgoing traffic engineering possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that validity of this design is dependent on if you have some kind of stateful device (firewall, ...) which would break under asymetric routing and from troubleshooting point of view it would be harder to troubleshoot any issue if you have asymetry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the same setup as if you'd have a single AS which would become discontiguous, in such case forwarding between parts of now-discontiguous AS and rest of the world would still work, but forwarding between the now-discontiguous parts themselves wouldn't work, but that is not an issue in this particular scenario because you have only one downstream subnet for each router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'd have multiple subnets (multiple vlans or overlapping subnets) and for example 2 switches in daisy-chain topology then a single link failure could cause traffic drops between the now-discontiguous ASes, because the subnets themselves would become discontiguous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For iBGP disadvantages: I would say that minor added configuration complexity (for more complex networks I would suggest peering using IGP-advertised loopbacks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my knowledge in this setup the advantages of using iBGP would outweigh its disadvantages.&lt;/p&gt;&#xA;" OwnerUserId="75" LastActivityDate="2014-02-24T23:12:06.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6478" PostTypeId="1" AcceptedAnswerId="6552" CreationDate="2014-02-25T00:34:19.147" Score="3" ViewCount="165" Body="&lt;p&gt;The &lt;strong&gt;Cisco Configuration Professional 2.5 User Guide&lt;/strong&gt; &lt;a href=&quot;http://tools.cisco.com/search/results/display?url=http%3a%2f%2fwww.cisco.com%2fc%2fdam%2fen%2fus%2ftd%2fdocs%2fnet_mgmt%2fcisco_configuration_professional%2fv2_5%2folh%2fccp.pdf&amp;amp;pos=2&amp;amp;query=ccp+user+guide&quot; rel=&quot;nofollow&quot;&gt;PDF&lt;/a&gt; doesn't say much about the Configuration Editor tool except, &lt;em&gt;&quot;For information about how to use Cisco CP to work with the Configuration Editor utility, see the &lt;a href=&quot;http://www.cisco.com/c/dam/en/us/td/docs/net_mgmt/cisco_configuration_professional/scrcst/ConfigEditor/ConfigEditorScreenCast.swf&quot; rel=&quot;nofollow&quot;&gt;screencast&lt;/a&gt;...&quot;.&lt;/em&gt; This Flash screen cast only shows an example of a Global Configuration Mode command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does this tool apply edits, such as when a command needs to be nested into a Command Mode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm guessing the Configuration Editor edits the &lt;code&gt;running-config&lt;/code&gt; output, not interactively with the router, but similar to text editor that can make patch-like edits? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if I want to add a command to a subinterface I would need to provide the whole text block? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dot11 ssid TooterTurtle&#xA;   vlan 2&#xA;   authentication open&#xA;   authentication key-management wpa&#xA;   wpa-psk ascii 0 [My Passphrase]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...then the editor can determine where my new command should go?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dot11 ssid TooterTurtle&#xA;   vlan 2&#xA;   guest-mode                 // ADDED COMMAND&#xA;   authentication open&#xA;   authentication key-management wpa&#xA;   wpa-psk ascii 0 [My Passphrase]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4478" LastActivityDate="2014-03-29T14:21:08.320" Title="How are edits applied to a `running-conf` when using Cisco CP's &quot;Configuration Editor&quot;?" Tags="|cisco|cisco-ios-12|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6479" PostTypeId="2" ParentId="6449" CreationDate="2014-02-25T02:45:07.110" Score="2" Body="&lt;p&gt;Here is a different perspective:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you are connected to a single provider, there is no need for “upstream traffic engineering,” since it all goes to the same provider.  In fact, there is no need to receive anything but a default route from your provider.  IBGP really offers you no advantage in that case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Asymmetric routing can be a issue with firewalls as @Kveri says , but there are many ways to control that.  For example, you can advertise different subnets out each connection with differing metrics.  If you have no firewalls (!), then this is not an issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can still run eBGP with your provider to track reachability to them (not just the link status).  You can also use IP SLA to accomplish the same thing.  It’s your choice, depending on your comfort level with the configurations.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-02-25T02:45:07.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6483" PostTypeId="1" AcceptedAnswerId="6485" CreationDate="2014-02-25T09:07:51.200" Score="86" ViewCount="426299" Body="&lt;p&gt;I hear about VLAN tagging, but I don’t quite understand the concept.   I know a trunk cannot accept untagged packets without configuring a native VLAN, and that access ports only accept untagged packets.  But I don’t understand why packets need to be tagged or untagged.  What purpose does it serve?&lt;/p&gt;&#xA;" OwnerUserId="4483" LastEditorUserId="775" LastEditDate="2015-01-31T16:30:01.447" LastActivityDate="2015-11-12T21:09:55.437" Title="Why and how are Ethernet Vlans tagged?" Tags="|vlan|ethernet|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6484" PostTypeId="2" ParentId="6483" CreationDate="2014-02-25T09:44:24.643" Score="8" Body="&lt;p&gt;The defacto VLAN encapsulation protocol is &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1Q&quot; rel=&quot;noreferrer&quot;&gt;802.1Q (dot1.q)&lt;/a&gt;.  Its most basic function is to retain VLANs across switches.  Since VLANs are locally significant to the switch, you have to &lt;em&gt;tag&lt;/em&gt; a frame going to near-by switches to let them know what logical grouping that frame belongs to.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-25T09:44:24.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6485" PostTypeId="2" ParentId="6483" CreationDate="2014-02-25T10:28:31.060" Score="122" Body="&lt;p&gt;If you have more than one VLAN on a port (a &quot;trunk port&quot;), you need some way to tell which packet belongs to which VLAN on the other end. To do this you are &quot;tagging&quot; a packet with a VLAN tag (or VLAN header if you like). In reality a VLAN tag is inserted in the Ethernet frame like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/kXT9j.png&quot; alt=&quot;VLAN Header&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 802.1Q (dot1q, VLAN) tag contains a VLAN-ID and other things explained in the &lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.1Q-2011.pdf&quot;&gt;802.1Q Standard&lt;/a&gt;. The first 16 bits contain the &quot;Tag Protocol Identifier&quot; (TPID) which is 8100. This also doubles as the EtherType 0x8100 for devices that don't understand VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So a &quot;tagged&quot; packet contains the VLAN information in the Ethernet frame while an &quot;untagged&quot; packet doesn't. A typical use case would be if you have one port from a router to a switch which multiple customers are attached to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/O9OF2.png&quot; alt=&quot;VLAN Trunking&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example customer &quot;Green&quot; has VLAN 10 and Customer &quot;Blue&quot; has VLAN 20. The ports between switch and customers are &quot;untagged&quot; meaning for the customer the arriving packet is just a normal Ethernet packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The port between router and switch is configured as a trunk port so that both router and switch know which packet belongs to which customer VLAN. On that port the Ethernet frames are tagged with the 802.1Q tag.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-02-25T10:28:31.060" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6486" PostTypeId="2" ParentId="6359" CreationDate="2014-02-25T11:05:43.900" Score="2" Body="&lt;p&gt;You should have a static /32 route in your routing table &lt;strike&gt;towards&lt;/strike&gt; for Y.Y.Y.D in order to be able to redistribute it from static to OSPF.&lt;/p&gt;&#xA;" OwnerUserId="4487" LastEditorUserId="4487" LastEditDate="2014-02-25T13:33:11.473" LastActivityDate="2014-02-25T13:33:11.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6487" PostTypeId="2" ParentId="6483" CreationDate="2014-02-25T11:18:49.440" Score="2" Body="&lt;p&gt;By default the Native VLAN is the default VLAN, a trunk port can carry multiple VLANs to route traffic to the router or a switch. VLAN is a layer 2 protocol and it segments a layer 2 network, they can only communicate in a Layer 3 device such as a router or a layer 3 switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Native VLAN is used so untagged frames can communicate without the need of a router. It is best security practice to change default/native VLAN to another VLAN using this command: switchport trunk native vlan . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco switches supports IEEE 802.1Q encapsulation, and ISL.&lt;/p&gt;&#xA;" OwnerUserId="4211" LastActivityDate="2014-02-25T11:18:49.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6489" PostTypeId="2" ParentId="5970" CreationDate="2014-02-25T11:43:41.557" Score="3" Body="&lt;p&gt;A transparent proxy is a device that operating on the network layer is able to redirect the traffic to a proxy server without any configuration on the client side. The following configuration will address the problem of how to configure the ASA (version 8.4) as DNS transparent proxy. With very little effort it is possible to configure the ASA as HTTP transparent proxy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before configure a transparent proxy ensure that your clients know and understand the security policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This kind of problem (and many others) would be solved with policy based route using the &quot;set ip next hop&quot; IOS's command and some form of &quot;transparency&quot; on the local proxy server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA does not support policy based routing (PBR) but it's still possible to achieve some degree of PBR (at least to solve the question) using NAT and the egress interface selection process. More info &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/nat_overview.html#wpxref17243&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume this schema:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(inside)----ASA----(outside)&#xA;             |&#xA;             |&#xA;           (dmz)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the following network addresses:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;inside 192.168.1.0/24&lt;/li&gt;&#xA;&lt;li&gt;dmz 10.0.0.0/24&lt;/li&gt;&#xA;&lt;li&gt;outside 1.1.1.0/30 &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Suppose there is a DNS server on the dmz with 10.0.0.2 as IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the network objects and the service objects have been properly configured the following NAT statement (known as Policy NAT) will do the trick:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside,dmz) source static obj-inside obj-inside destination static obj-any obj-DNS-Serv service obj-DNS obj-DNS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For a reference on how to configure the objects refer to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network obj-inside&#xA; subnet 192.168.1.0 255.255.255.0&#xA;object network obj-DNS-Serv&#xA; host 10.0.0.2&#xA;object network obj-any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object service obj-DNS&#xA; service udp destination eq domain&#xA; service tcp destination eq domain&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pay attention that you have to properly define network objects according to your envirorment.&lt;/p&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="2663" LastEditDate="2014-02-25T15:48:47.470" LastActivityDate="2014-02-25T15:48:47.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6491" PostTypeId="1" AcceptedAnswerId="6502" CreationDate="2014-02-25T15:25:25.860" Score="17" ViewCount="72825" Body="&lt;p&gt;I'm studying IPv4 addresses and came across this whole thing about classful addressing. I get the idea behind it, bit there is something I find confusing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;There are two &quot;ABC&quot; ranges:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;First one:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;A: 1.0.0.0 to 126.0.0.0       with /8 &lt;br&gt;&#xA;B: 128.0.0.0 to 191.255.0.0   with /16 &lt;br&gt;&#xA;C: 192.0.0.0 to 223.255.255.0 with /24&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Second one:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;A: 10.0.0.0 to 10.255.255.255     with /8 &lt;br&gt;&#xA;B: 172.16.0.0 to 172.31.255.255   with /12 &lt;br&gt;&#xA;C: 192.168.0.0 to 192.168.255.255 with /16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are both of these using the names A, B and C? They are not even using the same sets of subnet-masks! Is the first one only for public addresses? Because the second one is only private addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help appreciated!&lt;/p&gt;&#xA;" OwnerUserId="4491" LastActivityDate="2017-09-04T11:41:08.380" Title="Confusing A, B, C network classes" Tags="|cisco|ipv4|subnet|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6492" PostTypeId="2" ParentId="6491" CreationDate="2014-02-25T15:33:32.877" Score="18" Body="&lt;p&gt;While the idea behind classful addressing is now obsolete as &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4632&quot; rel=&quot;nofollow noreferrer&quot;&gt;classless interdomain routing&lt;/a&gt; (CIDR) has been in use for decades(the original &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1519&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1519&lt;/a&gt; was published in 1993), your first answer is the historically correct one.&lt;/p&gt;&#xA;&lt;p&gt;The second set of networks you list are from RFC1918, and define private use address ranges.  There is a single /8 network within the former class A space (giving a single class A network), a /12 within the former class B space (giving 16 class B networks), and a /16 within the former class C space (giving 256 class C networks).&lt;/p&gt;&#xA;&lt;p&gt;There is no contradiction.&lt;/p&gt;&#xA;" OwnerUserId="4440" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2014-02-25T15:38:51.933" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6493" PostTypeId="2" ParentId="6491" CreationDate="2014-02-25T15:42:14.877" Score="1" Body="&lt;p&gt;The class, &quot;A&quot;, &quot;B&quot; and &quot;C&quot;, tells you the size of the network mask. (e.g., a class &quot;C&quot; has a 24 bit network mask.) The class is not a proper name specifying a specific network.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2014-02-25T15:42:14.877" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6494" PostTypeId="2" ParentId="6471" CreationDate="2014-02-25T15:45:08.627" Score="8" Body="&lt;p&gt;This is how you would set up dual-band 2.4Ghz / 5Ghz on a Cisco autonomous AP for Open auth...  Basically just associate the SSID with &lt;code&gt;Dot11Radio0&lt;/code&gt; and &lt;code&gt;Dot11Radio1&lt;/code&gt;; Substitute &lt;a href=&quot;https://supportforums.cisco.com/thread/2082615&quot;&gt;these WPA PSK configs&lt;/a&gt; if you want WPA PSK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can add PEAP or other EAP methods after I get home, but I haven't got access to my EAP notes right now.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 15.2&#xA;no service pad&#xA;service tcp-keepalives-in&#xA;service tcp-keepalives-out&#xA;service timestamps debug datetime localtime show-timezone&#xA;service timestamps log datetime localtime show-timezone&#xA;service password-encryption&#xA;!&#xA;hostname Cisco_AP&#xA;!&#xA;!&#xA;logging rate-limit console 9&#xA;enable secret cisco&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login default local&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;clock timezone CST -6 0&#xA;clock summer-time CDT recurring&#xA;no ip source-route&#xA;no ip routing&#xA;no ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;login on-failure log&#xA;login on-success log&#xA;dot11 syslog&#xA;!&#xA;dot11 ssid OUR_SSID&#xA;   vlan 1&#xA;   max-associations 50&#xA;   authentication open&#xA;   mbssid guest-mode&#xA;!&#xA;!&#xA;dot11 guest&#xA;!&#xA;!&#xA;!&#xA;username Cisco password Cisco&#xA;!&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; ssid OUR_SSID&#xA; !&#xA; antenna gain 0&#xA; stbc&#xA; mbssid&#xA; station-role root&#xA; world-mode dot11d country-code US indoor&#xA;!&#xA;interface Dot11Radio0.1&#xA; encapsulation dot1Q 1 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; ssid OUR_SSID&#xA; !&#xA; antenna gain 0&#xA; peakdetect&#xA; dfs band 3 block&#xA; stbc&#xA; mbssid&#xA; channel dfs&#xA; station-role root&#xA; world-mode dot11d country-code US indoor&#xA;!&#xA;interface Dot11Radio1.1&#xA; encapsulation dot1Q 1 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; no ip route-cache&#xA; duplex auto&#xA; speed auto&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; no bridge-group 1 source-learning&#xA;!&#xA;interface BVI1&#xA; ip address 192.0.2.10 255.255.255.0&#xA; no ip route-cache&#xA; ipv6 address dhcp&#xA; ipv6 address autoconfig&#xA; ipv6 enable&#xA;!&#xA;ip forward-protocol nd&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;bridge 1 route ip&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; transport input all&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-02-25T15:45:08.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6501" PostTypeId="2" ParentId="6268" CreationDate="2014-02-25T16:27:10.300" Score="2" Body="&lt;p&gt;There's a fair chance this answer won't be applicable in your situation, but I feel I have to say it anyway:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can implement IPv6 and obtain more than enough addresses so every service can run on its own address on the ports you want them to run on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, this requires every visitor to have a working IPv6 connection so it will probably not be a real option at this point in time, but it certainly is one of the best ways to solve NAT problem.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-02-25T16:27:10.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6502" PostTypeId="2" ParentId="6491" CreationDate="2014-02-25T16:51:51.157" Score="33" Body="&lt;p&gt;It's likely that the subnet masks are throwing you off. As long as you keep in mind that the below rules no longer apply, you should be fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately classful addressing came down to the most significant (or &quot;leading&quot;) bits in the address. Nothing more, nothing less.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class A: Most significant bits starts with &lt;code&gt;0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Class B: Most significant bits start with &lt;code&gt;10&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Class C: Most significant bits start with &lt;code&gt;110&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The &quot;classes&quot; came from the way they split up the address space for use between &quot;host&quot; and &quot;network&quot;. Keep in mind that back then (way way back, from the days of ARPANET), &lt;strong&gt;&lt;em&gt;subnet masks did not exist&lt;/em&gt;&lt;/strong&gt;, and the network was intended to be inferred from the address itself. So, with the above in mind, this is what they came up with (this is intended to be binary representation - each &lt;code&gt;N&lt;/code&gt; or &lt;code&gt;H&lt;/code&gt; represents a single bit in the 32-bit address):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class A: &lt;code&gt;NNNNNNNN.HHHHHHHH.HHHHHHHH.HHHHHHHH&lt;/code&gt; (less networks, more hosts)&lt;/li&gt;&#xA;&lt;li&gt;Class B: &lt;code&gt;NNNNNNNN.NNNNNNNN.HHHHHHHH.HHHHHHHH&lt;/code&gt; (more networks, less hosts)&lt;/li&gt;&#xA;&lt;li&gt;Class C: &lt;code&gt;NNNNNNNN.NNNNNNNN.NNNNNNNN.HHHHHHHH&lt;/code&gt; (even more networks, even less hosts)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here the &lt;code&gt;N&lt;/code&gt; is representative of the network portion of the address, and the &lt;code&gt;H&lt;/code&gt; is representative of the host portion of the address, or as they called it back in the day, the &quot;rest field.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Combining that with what was said earlier about the most-significant bits, we have the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class A: 0.0.0.0 - 127.255.255.255&lt;/li&gt;&#xA;&lt;li&gt;Class B: 128.0.0.0 - 191.255.255.255&lt;/li&gt;&#xA;&lt;li&gt;Class C: 192.0.0.0 - 223.255.255.255&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Converting those ranges to binary may make this more clear:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Class A&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.0.0.0&#xA;-----------&#xA;[0]0000000.00000000.00000000.00000000&#xA;&#xA;127.255.255.255&#xA;-----------&#xA;[0]1111111.11111111.11111111.11111111&#xA; ^&#xA; most significant bit = 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Class B&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.0.0.0&#xA;-----------&#xA;[10]000000.00000000.00000000.00000000&#xA;&#xA;191.255.255.255&#xA;-----------&#xA;[10]111111.11111111.11111111.11111111&#xA; ^&#xA; most significant bits = 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Class C&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.0.0.0&#xA;-----------&#xA;[110]00000.00000000.00000000.00000000&#xA;&#xA;223.255.255.255&#xA;-----------&#xA;[110]11111.11111111.11111111.11111111&#xA; ^&#xA; most significant bits = 110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Every single address within those ranges will share a common leading bit(s). The moral of the story is, if you can remember what the leading bits are supposed to be (0 for class A, 10 for class B, 110 for class C) it's extremely simple to determine what &quot;class&quot; an address would have otherwise belonged in. Or, if decimal is easier:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class A: First octet in address is between 0 and 127, inclusive&lt;/li&gt;&#xA;&lt;li&gt;Class B: First octet in address is between 128 and 191, inclusive&lt;/li&gt;&#xA;&lt;li&gt;Class C: First octet in address is between 192 and 223, inclusive&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The easiest way to mess someone up on &quot;classful addressing&quot; either on a test, or exam, or whatever, is to use misdirection by way of a subnet mask. Again, remember that the subnet mask does not apply for determining the class of an address. This is easy to forget because as others have said, classless addressing and routing have been around for over two decades now, and the subnet mask and CIDR notation have become ubiquitous in the industry.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2014-02-25T20:26:04.113" LastActivityDate="2014-02-25T20:26:04.113" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6503" PostTypeId="1" CreationDate="2014-02-25T17:52:38.973" Score="8" ViewCount="798" Body="&lt;p&gt;As the ttl is 255 maximum for ipv4 on cisco routers, will ping work if there are 500 routers between pc1 and pc2?&lt;/p&gt;&#xA;" OwnerUserId="4494" LastEditorUserId="509" LastEditDate="2014-02-25T18:41:31.380" LastActivityDate="2014-02-25T18:41:31.380" Title="will ping work if there are 500 routers between pc1 and pc2?" Tags="|ipv4|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6504" PostTypeId="2" ParentId="6503" CreationDate="2014-02-25T18:18:01.233" Score="13" Body="&lt;p&gt;The TTL field itself in the IPv4 header is 1 byte, which leaves a maximum decimal value of 255 regardless of the vendor of the router.&lt;/p&gt;&#xA;&lt;p&gt;Pursuant to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1812&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1812&lt;/a&gt;, the answer to your question is no. Every router is required to decrement the TTL value by 1 whenever it receives an IPv4 packet. You would receive ICMP &amp;quot;Time Exceeded&amp;quot; messages on the source host from which you are running the ping. More information on the TTL field can be found in the RFC.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-02-25T18:18:01.233" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6505" PostTypeId="1" AcceptedAnswerId="6506" CreationDate="2014-02-25T18:48:55.167" Score="14" ViewCount="32768" Body="&lt;p&gt;&lt;strong&gt;When do you use link-local or unique local in IPv6 networks?&lt;/strong&gt; (Cisco doesn't manage to explain it properly in their online material.)&lt;/p&gt;&#xA;" OwnerUserId="4491" LastEditorUserId="3191" LastEditDate="2014-12-08T20:23:46.747" LastActivityDate="2014-12-08T20:23:46.747" Title="IPv6 link-local vs unique local" Tags="|ipv6|lan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6506" PostTypeId="2" ParentId="6505" CreationDate="2014-02-25T18:53:56.240" Score="14" Body="&lt;p&gt;Link local addresses are used in one single network segment, they can't be routed. Unique local addresses can be routed, but only within one routing domain. So an ISP can choose to use ULA for services which can't be publicly accessible. &lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-02-25T18:53:56.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6507" PostTypeId="2" ParentId="6505" CreationDate="2014-02-25T20:24:11.753" Score="9" Body="&lt;p&gt;The answer to the question &quot;When do you use link local addresses&quot; the answer is &quot;always&quot;.  Link local addresses are present on all interfaces and are used for many essential link protocols such as neighbor discovery, duplicate address detection and router advertisement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unique local addresses are the replacement for the deprecated site local address scope.  ULA addresses are similar in use to RFC1918 addresses in the IPv4 world, and allow an enterprise to number internal resources within their administrative domain with addresses that are unique, but not tied to routing policy, easing the pain if a change of ISP means that renumbering is required.  Remember that with IPv6 there is no NAT, so you cannot simply rewrite at the border onto your ISPs address space.&lt;/p&gt;&#xA;" OwnerUserId="4440" LastActivityDate="2014-02-25T20:24:11.753" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6512" PostTypeId="1" AcceptedAnswerId="6528" CreationDate="2014-02-25T22:09:25.247" Score="4" ViewCount="6240" Body="&lt;p&gt;I might need to implement a change where an existing in production ASA 5585-X pair (single fail-over) would need to transition to multiple context mode to allow the addition of a new context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what I understand the running-config gets split into a system context config and an admin context config. I then can create a new context to do the work that I need done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i'm unsure about is if there will need to be other config changes needed to transition into a multiple context mode? Since this ASA pair is in production I was hoping for a direct migration to multiple context mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Side question: Would it be possible to do this migration in stages on the ASA pair to avoid needing to reboot both at the same time?&lt;/p&gt;&#xA;" OwnerUserId="108" LastEditorUserId="108" LastEditDate="2014-02-25T23:14:53.997" LastActivityDate="2014-02-26T10:25:50.163" Title="Switching to multiple context mode on a Cisco ASA 5585-X; what happens to running config?" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6521" PostTypeId="1" AcceptedAnswerId="6527" CreationDate="2014-02-26T07:21:03.243" Score="2" ViewCount="599" Body="&lt;p&gt;I created a vlan in Juniper qfx3600 switch by specifying just VLAN name. When I tried to commit the configuration I got an error saying &quot;need L2domain configured&quot;. I asked with  my collegue, he said you must provide vlan id, when I specified VLAN-id to the created vlan the commit was successful. But the documentations I read says VLAN automatically will be assosciated with VLAN ID if one is not provided by the user. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got confused by all of these, can anyone please tell me which is right and why the commit was successfull after I provided VLAN ID but not before that.&lt;/p&gt;&#xA;" OwnerUserId="4483" LastActivityDate="2014-02-28T03:26:10.770" Title="vlan creation with just vlan name" Tags="|vlan|juniper|switching|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6522" PostTypeId="2" ParentId="6521" CreationDate="2014-02-26T07:57:05.083" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But the documentations I read says VLAN automatically will be&#xA;  assosciated with VLAN ID if one is not provided by the user.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Juniper would never be able to automatically associate a VLAN name to a VLAN tag by default. If you just specify a VLAN by name, there isn't any way to figure out what VLAN that traffic belongs to. &lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-26T07:57:05.083" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6527" PostTypeId="2" ParentId="6521" CreationDate="2014-02-26T10:25:03.733" Score="3" Body="&lt;p&gt;The documentation for the Juniper EX series switches indeed mentions the possibility of creating a VLAN without specifying a VLAN id (&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.3/topics/task/configuration/bridging-vlans-ex-series-cli.html&quot; rel=&quot;nofollow&quot;&gt;1&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When you assign just a VLAN name, an ID is generated by Junos OS.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2 Configure the VLAN tag ID or VLAN ID range for the VLAN. (If you assigned a VLAN name, you do not have to do this, because a VLAN ID is assigned automatically, thereby associating the name of the VLAN to an ID number. However, if you want to control the ID numbers, you can assign both a name and an ID.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, you are using a QFX3500, and I cannot find a similar statement in the QFX range documentation. Here, Juniper states (&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.2/topics/task/configuration/bridging-vlans-qfx-series-cli.html&quot; rel=&quot;nofollow&quot;&gt;2&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Configure the VLAN tag ID or VLAN ID range for the VLAN&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;without the remark about automatic VLAN id assignnment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only have EX devices so I cannot verify this.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-02-26T10:25:03.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6528" PostTypeId="2" ParentId="6512" CreationDate="2014-02-26T10:25:50.163" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What i'm unsure about is if there will need to be other config changes needed to transition into a multiple context mode? Since this ASA pair is in production I was hoping for a direct migration to multiple context mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;Config summary&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I have made the transition from single context to multiple context mode several times on running firewall pairs.  You are correct that multiple context mode creates the following contexts by default:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;system context&lt;/li&gt;&#xA;&lt;li&gt;admin context&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After you configure &lt;code&gt;mode multiple&lt;/code&gt; in single-context mode, the running configuration is saved as &lt;code&gt;old_running.cfg&lt;/code&gt; on the flash disk (ref &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa70/configuration/guide/config/contexts.html#wp1081764&quot; rel=&quot;nofollow noreferrer&quot;&gt;this CCO doc&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Features / Licensing:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If you can't test the exact changes on the same model of ASA ahead of time, the safest thing to do is asking for a maintenance window; &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_contexts.html#wp1382237&quot; rel=&quot;nofollow noreferrer&quot;&gt;feature support changes&lt;/a&gt; when you go into multiple context mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, depending on how many contexts you create, you may run into &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_contexts.html#wp1188797&quot; rel=&quot;nofollow noreferrer&quot;&gt;licensing issues&lt;/a&gt;.  I had to convert a &lt;a href=&quot;https://networkengineering.stackexchange.com/q/2257/775&quot;&gt;single layer2 firewall into multiple contexts&lt;/a&gt; (per-Vlan firewalls); this meant buying another 10-context license from Cisco because you don't get many licenses by default.  Also, vlan mapping was a big issue to work around... ymmv.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Side question: Would it be possible to do this migration in stages on the ASA pair to avoid needing to reboot both at the same time?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;Breaking a redundant pair&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Yes, but as Ricky said you should just take half the pair down.  Disconnect uplinks from the standby, and remove the redundancy config; then, migrate the standby unit first.  When the standby comes up in multiple context mode, switch to the system context (&lt;code&gt;changeto system&lt;/code&gt;) and:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;create a new context in system context config mode: &lt;code&gt;context FOO&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;assign a dedicated config location: &lt;code&gt;config-url disk0:FOO.cfg&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;assign interfaces to the context: i.e. &lt;code&gt;allocate GigabitEthernet0/1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now &lt;code&gt;changeto context FOO&lt;/code&gt; to start configuring.  It is best to be on the console when you migrate.  If interface names don't change between single and multiple context mode, you can copy / paste the config directly into the new context... be aware that some things (i.e. ssh timeout settings) go into the admin context and still others in the system context.  It's not hard to work out after you get started... context-sensitive &lt;code&gt;?&lt;/code&gt; help alerts you to which pieces need to be in a given context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you have the former standby turned up, you cut services over to it and migrate the former primary.  Redundancy still works in multiple context mode, but you &lt;em&gt;must&lt;/em&gt; configure the state synchronization link(s) in the system context.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-02-26T10:25:50.163" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6533" PostTypeId="1" CreationDate="2014-02-26T14:13:45.090" Score="2" ViewCount="353" Body="&lt;p&gt;I hope I can get some help as I've been wracking my brain to figure out the best way to get a new MPLS connection set up between our main site and our DR site. I'll first give a description of what I have today and what I need to achieve. I'm also throwing in our CE interface configs to show what we have. I changed our PE ip address’ to protect the innocent.&#xA;(I tried to get formatting correct for the interface info below but it's not playing nice)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now we have a DR site/rack in a co-location facility. The DR site has an internal gateway set exactly as the main gateway at our main site. The reason for the &quot;duplicate&quot; internal gateway address being the same is if we have a major meltdown at the main site (fire, etc), we can easily bring up replicated VM's at the DR site, switch over DNS at our DNS provider for our domain names and our websites can be running and available within a short amount of time (DNS replication withstanding).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now these 2 sites connect over the internet with a site-to-site VPN through Cisco ASA's and each side is hidden behind NATs through the site-to-site so these 2 duplicate gateways can exist and we can replicate data between sites by sending traffic to the NAT'd address' and then on to the servers behind the firewall at DR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We just had an MPLS network installed by an ISP directly connecting each site and that's where I'm stumped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really need to have the easy access that we have today of all servers sitting at DR running on that duplicated gateway address because like I mentioned, in case of emergency I can just fire up VM's on a Quorum OnQ device and have a dup of my infrastructure up and running in less than an hour. But I obviously can't have the duplicated gateways running there AND here without a conflict.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would someone suggest to look at to have these 2 sites up and running across MPLS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(everything is /24 for sub netting)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Main site and DR site internal gateway:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.10.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Main site 2951 interface configs:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; no ip address&#xA; duplex full&#xA; speed 100&#xA;&#xA;interface GigabitEthernet0/0.1&#xA; encapsulation dot1Q 1801&#xA; ip address 21.21.21.21 255.255.255.252&#xA;&#xA;interface GigabitEthernet0/0.2&#xA; encapsulation dot1Q 1800&#xA; ip address 24.24.24.24 255.255.255.252&#xA;&#xA;interface GigabitEthernet0/2&#xA; ip address 192.168.10.251 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;&#xA;router bgp 7000&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; redistribute connected&#xA; redistribute static&#xA; neighbor 24.24.24.23 remote-as 2500&#xA; no auto-summary&#xA;&#xA;ip default-gateway 21.21.21.20&#xA;ip forward-protocol nd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DR site 2951 interface configs:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/2&#xA; ip address 192.168.10.250 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;&#xA;interface GigabitEthernet0/0/0&#xA; no ip address&#xA; duplex full&#xA; speed 100&#xA; media-type sfp&#xA;&#xA;interface GigabitEthernet0/0/0.1&#xA; encapsulation dot1Q 1901&#xA; ip address 22.22.22.22 255.255.255.252&#xA;&#xA;interface GigabitEthernet0/0/0.2&#xA; encapsulation dot1Q 1900&#xA; ip address 23.23.23.23 255.255.255.252&#xA;&#xA;router bgp 7000&#xA; bgp log-neighbor-changes&#xA; redistribute connected&#xA; redistribute static&#xA; neighbor 23.23.23.22 remote-as 2500&#xA;&#xA;ip default-gateway 22.22.22.21&#xA;ip forward-protocol nd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When we first set up the DR site, I &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1682/setting-the-same-gateway-address-at-a-dr-site-as-our-main-site&quot;&gt;posted a question&lt;/a&gt; last year on here about concerns I had with the site-to site VPN and the NATs, and it turns out because of NAT I can have the 2 gateways running simultaneously. That was great. Now, things are changing and i'm not sure of the best way to get this to work moving forward.&lt;/p&gt;&#xA;" OwnerUserId="1575" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-06-09T07:27:42.813" Title="Help with bringing DR site in to general network" Tags="|cisco|routing|mpls|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6534" PostTypeId="1" AcceptedAnswerId="6535" CreationDate="2014-02-26T14:49:19.653" Score="4" ViewCount="4755" Body="&lt;p&gt;I'm sure a lot of AP or WiFi modem/router can perform an autoscan to select the best channel to be used during the boot. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the channel selection also performed in other situations (other than device boot)?&lt;/p&gt;&#xA;" OwnerUserId="4524" LastActivityDate="2014-02-27T09:01:22.027" Title="Does WiFi Router/AP change the working channel automatically during the normal use?" Tags="|wireless|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6535" PostTypeId="2" ParentId="6534" CreationDate="2014-02-26T15:29:34.083" Score="8" Body="&lt;p&gt;This is not a general truth, but some WiFi Routers/ AP's do change the channel without rebooting. Some reasons include, but not limit to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Noisy environment on specific channel&lt;/li&gt;&#xA;&lt;li&gt;Lots of other AP's on the same channel&lt;/li&gt;&#xA;&lt;li&gt;Interference with Bluetooth and/or other RF Communication&lt;/li&gt;&#xA;&lt;li&gt;Intrusion Prevention/Detection Systems trigger such as routers sensing that the WPS PIN is being bruteforced by Reaver or other tools&lt;/li&gt;&#xA;&lt;li&gt;Another AP with the same ESSID (name) on that channel&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Please note that this behavior is very manufacturer specific / firmware specific, for example some Open Source Firmware such as OpenWRT or DD-WRT can be configured to hop channels based on user defined conditions&lt;/p&gt;&#xA;" OwnerUserId="4525" LastActivityDate="2014-02-26T15:29:34.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6540" PostTypeId="1" AcceptedAnswerId="6541" CreationDate="2014-02-26T20:19:54.130" Score="5" ViewCount="1221" Body="&lt;p&gt;I'm aiming to build the following network (might need to open image in new tab due to width):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/N0yIi.jpg&quot; alt=&quot;sample network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Assume those BGP links are different ISPs&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Same ASN is advertised to both ISPs&lt;/li&gt;&#xA;&lt;li&gt;Sites are interconnected via private line&lt;/li&gt;&#xA;&lt;li&gt;BGP default routes only&lt;/li&gt;&#xA;&lt;li&gt;We have a /24 (public address space)&lt;/li&gt;&#xA;&lt;li&gt;EDIT: I should add that we're already advertising this /24 with BGP at siteA. So I'm essentially looking to add SiteB&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Server 1 is accessible on the internet via NAT&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My Question: I'm hoping to expose Server 1 via the same public IP regardless of which ISP a client comes in through. So therefore, I'm assuming the accepted method is to have the same NAT rules on both routers? Is this possible? What are the downsides to this?&lt;/p&gt;&#xA;" OwnerUserId="4532" LastEditorUserId="4532" LastEditDate="2014-02-26T21:38:14.247" LastActivityDate="2014-02-26T21:43:18.647" Title="Multihomed BGP and NAT" Tags="|bgp|nat|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6541" PostTypeId="2" ParentId="6540" CreationDate="2014-02-26T20:24:30.980" Score="4" Body="&lt;p&gt;This won't work the way you describe it. Each connection has its own public IP belonging to your ISPs. You'll need public IP space (typically called PI space - provider indepentent) which you can advertise via BGP to both your ISP's at the same time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup you describes doesn't have a shared public address between the two connections and your ISPs won't route eachothers addresses, so what you're describing is a server which is reachable through two networks on two different IP addresses. NAT rules can't solve this for you.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-02-26T20:24:30.980" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6543" PostTypeId="2" ParentId="6540" CreationDate="2014-02-26T21:43:18.647" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The provider owns the /24. We're already using the space at our existing location &quot;site 1&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There isn't a good way around your problem without rights to announce the IP block you have to two different upstreams.  You either need:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Provider independent IPv4 address space (almost impossible to get these days)&lt;/li&gt;&#xA;&lt;li&gt;IPv4 Addresses SWIP'd to you&lt;/li&gt;&#xA;&lt;li&gt;Work exclusively with IPv6 (probably not an option)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would ask the owner of the /24 addresses to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5914/what-is-a-non-portable-ipv4-address-block/5916#comment9037_5916&quot;&gt;SWIP them to you&lt;/a&gt;.  Many providers are happy to do this because they have the potential to off-load some of their backbone traffic to another provider, while still charging you the same rate for your access circuit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the provider SWIPs addresses to you and you have your own ASN, you're perfectly in your rights to announce this same block of addresses to another upstream.  As I mentioned in the hyperlinked comment, this arrangement tends to work better when you get addresses from a large provider, and you're dual-homing through a smaller provider.  The large provider is happy to off-load traffic, and the small provider is happy to have the extra business.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're announcing that same /24 block of addresses to different ISPs, I don't see the point in NAT.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-02-26T21:43:18.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6545" PostTypeId="2" ParentId="6533" CreationDate="2014-02-26T22:37:20.703" Score="1" Body="&lt;p&gt;You either have to give up your MPLS connection, or give up having the same IP addresses in both places -- you can't have both without some nasty NAT translations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fundamentally, you have to change the way you set up your DR servers. They can't have the same addresses as your production servers. There are other ways to accomplish what you want -- everyone has the same problem you do.  But I confess my VMWare knowledge is a bit thin. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="775" LastEditDate="2014-02-28T19:28:36.070" LastActivityDate="2014-02-28T19:28:36.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6548" PostTypeId="2" ParentId="6534" CreationDate="2014-02-27T09:01:22.027" Score="4" Body="&lt;p&gt;If your AP want to use a 5 GHz channel which is also used by radars, it NEED to support Dynamic Frequency Selection (DFS for short).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case, it may perform a survey on the target 5 GHz channel to check the presence of radar pulses, then may start using it, while still checking for radars.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a radar pulse is detected after the AP has started, it sends a Channel Switch Announcement telling the stations that the AP will change channel after the next X beacons.  The stations must obey or they will be disconnected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the channel switch mechanism may also be used for other purpose than to switch away from a radar channel.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2014-02-27T09:01:22.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6552" PostTypeId="2" ParentId="6478" CreationDate="2014-02-27T14:06:53.973" Score="2" Body="&lt;p&gt;Cisco CP will make edits exactly the same way as you would if you were editing manually, it just batch scripts the process.  So in your example in order to achieve what you want to do Cisco CP would issue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dot11 ssid TooterTurtle&#xA; guest-mode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you were later to decide to remove guest mode using Cisco CP it would issue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dot11 ssid TooterTurtle&#xA; no guest-mode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's literally just a front end to provide a graphical user interface for users who are not familiar with the CLI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I remember of Cisco CP, before you apply a change I think it pops up and gives you a window with all the config changes it is about to make.&lt;/p&gt;&#xA;" OwnerUserId="4545" LastActivityDate="2014-02-27T14:06:53.973" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6553" PostTypeId="1" AcceptedAnswerId="6559" CreationDate="2014-02-27T18:49:29.467" Score="6" ViewCount="842" Body="&lt;p&gt;I'm setting up a second site for redundancy and DR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goals are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ISP fault-tolerance from either site: HostA, for example, can reach the internet in the event that ISP-A(primary) and ISP-B go down.&lt;/li&gt;&#xA;&lt;li&gt;Similarly, servers will continue to be accessible from the internet in the event that 1 or 2 connections are lost.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Notes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;We already have Router-A connected via BGP among two ISPs. Either ISP can go down and we can continue to function, so assume that the initial BGP/ARIN steps are completed.&lt;/li&gt;&#xA;&lt;li&gt;EDIT: sites interconnected via 1 or more 1gbps private lines&lt;/li&gt;&#xA;&lt;li&gt;EDIT: Routers are also firewalls in this case&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How do I handle the default gateway situation?&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Do I point clients in their respective sites at their respective router? What if that router loses connectivity?&lt;/li&gt;&#xA;&lt;li&gt;What about asynchronous routing? Say ISP-A is our primary and traffic comes in destined for a server on Site B (who is pointed at Router-B for default GW), won't that cause issues? Ideally we wouldn't have such a situation even if it means designating one router as default GW for all and have it route to the second router in the event it loses it's ISP connectivity.&lt;/li&gt;&#xA;&lt;li&gt;I was thinking I needed something like OSPF to propagate the awareness of ISP link failures, but I'm not clear on what it would help.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/3WV8t.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4532" LastEditorUserId="4532" LastEditDate="2014-02-28T14:49:17.080" LastActivityDate="2014-02-28T14:49:17.080" Title="BGP, multipathing, and possibly OSPF" Tags="|routing|bgp|asymmetric-routing|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6554" PostTypeId="1" CreationDate="2014-02-27T18:59:17.067" Score="3" ViewCount="1828" Body="&lt;p&gt;We have two wan data links (with two different telecom providers) going from our central office to a remote location.  Each data link currently transfers data from different equipment that are in two distinct subnets. We would like the data links to be redundant and have load balancing. I am thinking of using a Cisco RV042 Dual-WAN router at both the local and the remote site to achieve this.  So far, I have been searching online for a similar usage scenario with the Cisco RV042, but all I can find are case scenarios when the two WAN links are for ISPs. Is it ok to use two  Cisco RV042s and/or is there a better way?&lt;/p&gt;&#xA;" OwnerUserId="4547" LastActivityDate="2014-05-02T08:11:31.380" Title="How to achieve Redundancy/Failover for two WAN links (not ISPs) ?" Tags="|cisco|redundancy|wan|failover|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6556" PostTypeId="1" AcceptedAnswerId="8271" CreationDate="2014-02-27T19:34:48.520" Score="7" ViewCount="4520" Body="&lt;p&gt;We have 2 Juniper EX 3300 switches operating in a stack. It is running Junos 12.3R3.4. The switches have 4 SFP/SFP+ Ports. On FPC 1, PIC 1, Xcvr 0 you see a description of &quot;SFP-FC8G-SW.&quot; However, the transceiver is a Juniper branded 10GE SFP+ SR (see image below). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interface is up/down. On the client side the physical media indicates that it is connected but there seems to be no link layer connectivity. No traffic passes on the interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the output of &quot;show chassis hardware&quot; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@juniper&amp;gt; show chassis hardware &#xA;Hardware inventory:&#xA;Item             Version  Part number  Serial number     Description&#xA;Chassis                                GA021XXXXXXX      Virtual Chassis&#xA;Routing Engine 0 REV 10   750-034247   GA021XXXXXXX      EX3300 48-Port&#xA;Routing Engine 1 REV 10   750-034247   GA021XXXXXXX      EX3300 48-Port&#xA;FPC 0            REV 10   750-034247   GA021XXXXXXX      EX3300 48-Port&#xA;  CPU                     BUILTIN      BUILTIN           FPC CPU&#xA;  PIC 0                   BUILTIN      BUILTIN           48x 10/100/1000 Base-T&#xA;  PIC 1          REV 10   750-034247   GA021XXXXXXX      4x GE/XE SFP+&#xA;    Xcvr 0                NON-JNPR     TED1728B11R       SFP+-10G-CU3M&#xA;    Xcvr 1       REV 01   740-021308   ALE0GT1           SFP+-10G-SR&#xA;    Xcvr 2       !        NON-JNPR     PRO3M110          SFP+-10G-CU1M&#xA;    Xcvr 3       !        NON-JNPR     PRO3M102          SFP+-10G-CU1M&#xA;  Power Supply 0                                         PS 100W AC&#xA;  Fan Tray                                               Fan Tray&#xA;FPC 1            REV 10   750-034247   GA021XXXXXXX      EX3300 48-Port&#xA;  CPU                     BUILTIN      BUILTIN           FPC CPU&#xA;  PIC 0                   BUILTIN      BUILTIN           48x 10/100/1000 Base-T&#xA;  PIC 1          REV 10   750-034247   GA021XXXXXXX      4x GE/XE SFP+&#xA;    Xcvr 0                NON-JNPR     PNN32WL           SFP-FC8G-SW&#xA;    Xcvr 1                NON-JNPR     TED1729BEKS       SFP+-10G-CU3M&#xA;    Xcvr 2       !        NON-JNPR     PRO3M103          SFP+-10G-CU1M&#xA;    Xcvr 3       !        NON-JNPR     PRO3M111          SFP+-10G-CU1M&#xA;  Power Supply 0                                         PS 100W AC&#xA;  Fan Tray                                               Fan Tray&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QWzf3.jpg&quot; alt=&quot;SFP+ Transceiver Module&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2881" LastActivityDate="2014-06-06T20:34:51.673" Title="Juniper EX 3300 Incorrectly Identifies SFP+ Transceiver Module" Tags="|juniper|juniper-junos|juniper-ex|sfp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6559" PostTypeId="2" ParentId="6553" CreationDate="2014-02-28T02:04:02.783" Score="2" Body="&lt;p&gt;This might be a bit long winded, but I'll try to address most of your issues in one go.  Wish me luck!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can have your upstream service providers advertise a default route (0.0.0.0) through BGP to your routers.  When you configure OSPF on your BGP routers, you can use the command &quot;default-information originate.&quot;  As long as you're getting the default route from your ISP (which only happens when you have connectivity to that ISP), you'll advertise the default route into OSPF.  As soon as you lose that default route from your ISP, you'll lose the OSPF default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need to establish BGP peering between all of your internet routers (the ones connected to your ISPs).  This is an internal BGP or iBGP relationship and needs to be a full mesh.  Per your diagram, you only have two internet routers, so a full mesh is simple.  There are no tricky steps to peer on iBGP versus eBGP; just a simple neighbor statement.  When BGP sees that your neighbor has the same AS number, it forms an iBGP relationship instead of an eBGP one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Preferring one route over another is a bit tricky, particularly where BGP is concerned.  Load balancing is done using route maps and traditionally with as-path prepending.  There are a few ways to do this.  I'd like to add a caveat that if you aren't filtering outgoing route advertisements, you'll end up advertising ISP A's routes to ISP B and C and so forth which will turn you into a transit AS and you'll end up piping some A &amp;lt;-&gt; B, A &amp;lt;-&gt; C, and B &amp;lt;-&gt; C traffic through your network which is probably not what you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's one go at your load balancing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Set an IP access list that matches your BGP-advertised network&#xA;&#xA;ip access-list standard 1 permit a.b.c.d mask a.b.c.d&#xA;&#xA;! Set an IP as-path access list to only allow advertising of YOUR network&#xA;&#xA;ip as-path access-list 1 permit ^$&#xA;&#xA;! Make a route-map for ISP C, match the as-path and access-list above, then make it look&#xA;! less appealing than going through ISP A/B&#xA;&#xA;route-map ISP_C 10&#xA;match ip address 1&#xA;match as-path 1&#xA;set as-path prepend &amp;lt;Your AS&amp;gt; &amp;lt;Your AS&amp;gt; &amp;lt;Your AS&amp;gt;&#xA;&#xA;! The more times you prepend your AS to a route, the less desirable it looks, so traffic&#xA;! will be more likely to come in via ISP A/B than C.  The last step is to add it to your&#xA;! ISP C neighbor statement in BGP&#xA;&#xA;router bgp &amp;lt;Your AS&amp;gt;&#xA;neighbor &amp;lt;ISP C&amp;gt; route-map ISP_C out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you have more than one subnet, you can even things out a little more and use router B for site B and router A for site A by selectively prepending your AS path to individual subnets.  Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router A:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list standard 1&#xA;permit &amp;lt;site B subnets&amp;gt;&#xA;&#xA;ip as-path 1 permit ^$&#xA;&#xA;route-map ISP_AB 10&#xA;match ip address 1&#xA;match as-path 1&#xA;set as-path prepend &amp;lt;Your AS&amp;gt; &amp;lt;Your AS&amp;gt;&#xA;route-map ISP AB 20&#xA;match as-path 1&#xA;&#xA;router bgp &amp;lt;Your AS&amp;gt;&#xA;neighbor &amp;lt;ISP A&amp;gt; route-map ISP_AB out&#xA;neighbor &amp;lt;ISP B&amp;gt; route-map ISP_AB out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list standard 1&#xA;permit &amp;lt;site A subnets&amp;gt;&#xA;&#xA;ip as-path 1 permit ^$&#xA;&#xA;route-map ISP_C 10&#xA;match ip address 1&#xA;match as-path 1&#xA;set as-path prepend &amp;lt;Your AS&amp;gt; &amp;lt;Your AS&amp;gt;&#xA;route-map ISP C 20&#xA;match as-path 1&#xA;&#xA;router bgp &amp;lt;Your AS&amp;gt;&#xA;neighbor &amp;lt;ISP C&amp;gt; route-map ISP_C out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What you've effectively done is make site B's subnets look less appealing coming from Router A than they do from ISP C and make site A's subnets look less appealing coming from Router B than they do from ISP A/B.  You might have to play around with your AS path prepending some to get the right amount of prepending in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps!  BGP is a bit of a monster, but once you understand the parts, it's fun to play with.  I highly recommend the CBT Nuggets series on BGP if you feel a bit shaky on the subject and I always use GNS3 as a testbed to verify big network changes before I implement them.&lt;/p&gt;&#xA;" OwnerUserId="74" LastEditorUserId="775" LastEditDate="2014-02-28T02:12:49.943" LastActivityDate="2014-02-28T02:12:49.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6561" PostTypeId="2" ParentId="6521" CreationDate="2014-02-28T03:26:10.770" Score="1" Body="&lt;p&gt;802.1Q tracks VLANs based on ID (number) not name, so this would be an awkward way to program a switch.  Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Customer A is plugged into VLAN 10 named &quot;Clients&quot; on Switch A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch A and Switch B are connected together and share all VLAN traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Customer B is plugged into VLAN 20 named &quot;Clients&quot; on Switch B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Customer C is plugged into VLAN 10 named &quot;Soap&quot; on Switch B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the 802.1Q tag is number based, Customer A and Customer C would be able to communicate while Customer B would not be able to talk to either other customer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure about the Juniper method of assigning VLAN tags but I hope this helps clear up why you shouldn't rely on autoconfiguration for that.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-02-28T03:26:10.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6562" PostTypeId="1" AcceptedAnswerId="6564" CreationDate="2014-02-28T04:30:04.773" Score="2" ViewCount="5212" Body="&lt;p&gt;I am taking about the 5 layer model. It is well documented that TCP is a reliable service and IP is best-effort delivery and hence unreliable (ref &lt;a href=&quot;http://www.ietf.org/rfc/rfc792.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 792 - TCP&lt;/a&gt;).  Also, the data link layer is 'reliable' because of its ARQ mechanism guaranteeing sequential delivery of packets (&lt;a href=&quot;http://web.cs.wpi.edu/~cs4514/b98/week3-dll/week3-dll.html&quot; rel=&quot;nofollow&quot;&gt;ref&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot make sense of sending packets of reliable service (TCP) on a lower unreliable service (IP) which in turn sends packets on a layer which provides reliability (Link Layer). Why can't we do away with reliability at link layer as IP is unreliable?&lt;/p&gt;&#xA;" OwnerUserId="4554" LastEditorUserId="8499" LastEditDate="2018-12-27T00:54:28.997" LastActivityDate="2018-12-27T00:54:28.997" Title="Reliablity vs unreliable service at IP and Link Layer" Tags="|ipv4|tcp|protocol-theory|rfc|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6563" PostTypeId="2" ParentId="6562" CreationDate="2014-02-28T04:55:33.733" Score="4" Body="&lt;p&gt;If you look at the class notes, you'll see that #4 says, &quot;perhaps.&quot;  Some data link technologies are reliable, most are not.  The reasons are mostly historical, as many technologies were created for voice and then re-purposed for data.    The reason we leave guaranteed delivery to higher layers is that many applications don't require it, and to put it in a lower level adds overhead where it isn't useful.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-02-28T10:18:25.953" LastActivityDate="2014-02-28T10:18:25.953" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6564" PostTypeId="2" ParentId="6562" CreationDate="2014-02-28T05:01:51.647" Score="7" Body="&lt;p&gt;The issue is that you're operating under the notion that each layer is in and of itself a separate, autonomous entity. Understand that IP is not the only packet delivery protocol in existence, it just happens to be the most common one. Also understand that these &quot;layers&quot; are simply abstraction tools - the take away is that each &quot;layer&quot; is dependent on the one beneath it for some functions, and the layers further down the stack can hand off certain duties (ie reliable data transmission) to the layers above them when appropriate to keep overhead low and performance high. Each lower layer encapsulates data sent from the layers above it on its way down to the wire, and the lower layers decapsulate the data on the way back up the stack to the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The paper you linked about the data link layer even states that while its delivery mechanisms are &lt;em&gt;intended&lt;/em&gt; to be reliable, they are &lt;em&gt;still best effort&lt;/em&gt;, and there is an assumption made that higher layer protocols (ie TCP) will handle retransmission if necessary.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2014-02-28T05:01:51.647" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6565" PostTypeId="1" AcceptedAnswerId="6604" CreationDate="2014-02-28T06:40:28.970" Score="5" ViewCount="546" Body="&lt;p&gt;We have an mail server and its private address is translated to public on a Cisco router. We've mapped it one-to-one using this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static 192.168.7.7 198.51.100.7 route-map Deny_on_VPN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Deny_on_VPN&lt;/strong&gt; route-map has no set clauses, but only blocks traffic from being NAT'ted when being sent to remote locations on VPN, nothing fancy there. Also on outside interface ACL we have permitted incoming traffic to ports needed for mail to function (IMAP,POP3,SMTP,Web Client).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The kind of odd thing is happening during translation. I had a look at &lt;code&gt;show ip nat translations | include 192.168.7.7&lt;/code&gt;. The incoming traffic ports translate just fine, like &lt;code&gt;198.51.100.7:25 to 192.168.7.7:25&lt;/code&gt;. But the outgoing traffic with a random source port is being translated something like this: &lt;code&gt;192.168.7.7:58634 to 198.51.100.7:80&lt;/code&gt;, and always the 80th port. It does the same thing with TCP and UDP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't understand why would such thing happen. Maybe any of you network guys can help me out. Please tell me if you need any additional info.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Update:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Port address translation config (for users):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat pool ovrld 198.51.100.30 198.51.100.31 prefix-length 27&#xA;ip nat inside source list 107 pool ovrld overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;PAT source list ACL (Mail Server is blocked on the first line from being PAT'ted):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show access-lists 107&#xA;Extended IP access list 107&#xA;    10 deny ip host 192.168.7.7 any (2922102 matches)&#xA;    --- Omitted as it is irrelevant ---&#xA;    9999 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Relevant lines from inbound ACL on outside interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show access-lists FILTER_IN&#xA;Extended IP access list FILTER_IN&#xA;    110 permit tcp any host 198.51.100.7 eq pop3 (3197667 matches)&#xA;    120 permit tcp any host 198.51.100.7 eq smtp (4812814 matches)&#xA;    130 permit tcp any host 198.51.100.7 eq 143 (299804 matches)&#xA;    140 permit tcp any eq domain host 198.51.100.7 (9 matches)&#xA;    150 permit udp any eq domain host 198.51.100.7 (120634 matches)&#xA;    160 permit tcp any eq www host 198.51.100.7 (271241 matches)&#xA;    170 permit tcp any eq smtp host 198.51.100.7 (1033371 matches)&#xA;    180 permit icmp any host 198.51.100.7 (18075 matches)&#xA;    190 permit tcp any host 198.51.100.7 eq www&#xA;    200 deny ip any host 198.51.100.7 (17811 matches)&#xA;    210 permit ip any any (4259977862 matches)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;VPN_Deny&lt;/code&gt; route-map blocks traffic from internal network to branch office subnets from being NAT'ted. No set-clauses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Translation of mail server address on an overloaded pool is denied in an ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; &lt;code&gt;198.51.100.0/24&lt;/code&gt; is from &lt;code&gt;TEST-NET-2&lt;/code&gt; range.&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="3191" LastEditDate="2014-02-28T08:07:58.197" LastActivityDate="2014-03-03T11:53:26.547" Title="NAT translation mystery" Tags="|router|ipv4|vpn|nat|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6568" PostTypeId="2" ParentId="6554" CreationDate="2014-02-28T09:25:25.347" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it ok to use two Cisco RV042s &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can't imagine you'll have any issues with using the RV042.  Using the built-in load-balancing methods automatically set up a WRR scheduling profile for you.  Check out the &lt;a href=&quot;http://www.connect802.com/download/cisco/VPN_Router_RV042_OperationsGuide.pdf&quot; rel=&quot;nofollow&quot;&gt;RV042 User Manual&lt;/a&gt; for more information on how to set that up and a snippet of what's happening under the hood.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is there a better way?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is &lt;strong&gt;always&lt;/strong&gt; a better way, but given the equipment you are using, I think this is your best option without investing too much money and effort into redesigning your network for such a small gain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion, this is a good option.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-02-28T09:25:25.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6569" PostTypeId="1" AcceptedAnswerId="6570" CreationDate="2014-02-28T10:27:45.057" Score="3" ViewCount="1123" Body="&lt;p&gt;Good morning,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to move one SUP7203bXL from a 6509 chassis to a 7609. Now the SUP has the IOS: &#xA;s72033-adventerprisek9_wan-mz.122-33.SXJ.bin&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have the IOS: c7600s72033-advipservicesk9-mz.122-33.SRE1.bin running on the 7609 router. Is this IOS compatible with 6509, so I can update the IOS on the 6509 and then move the SUP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another question, does the IOS s72033-adventerprisek9_wan-mz.122-33.SXJ.bin allow mac access-lists? I can create them but can't apply it to an interface ... Should I take into account something else?&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="775" LastEditDate="2014-02-28T10:42:54.573" LastActivityDate="2014-02-28T10:47:13.427" Title="IOS for Cisco 6509/7609" Tags="|cisco|cisco-ios|cisco-6500|cisco-7600|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6570" PostTypeId="2" ParentId="6569" CreationDate="2014-02-28T10:41:49.770" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I would like to have the IOS: c7600s72033-advipservicesk9-mz.122-33.SRE1.bin running on the 7609 router. Is this IOS compatible with 6509, so I can update the IOS on the 6509 and then move the SUP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're speaking about a subject which is very confusing, and I apologize.  For years, you could mostly get away with saying the biggest difference between a Catalyst 6500 chassis and Cisco 7600 chassis was the paint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Times changed, starting in IOS 12.2SRB.  Now, you are strongly discouraged from running IOS 12.2SRB (or after) on a Catalyst 6500 chassis, because &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/7600-series-routers/prod_bulletin0900aecd805df25d.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco split support for Catalyst 6500 and Cisco 7600 chassis&lt;/a&gt; into different software images and business units.  There were business reasons for splitting support for Catalyst 6500 and Cisco 7600 branded systems.  If you feel that you must run 7600 12.2SRB or later on a Catalyst 6500, please speak with your Cisco account manager; he should be able to contact the 7600 BU and get discussions going.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;does the IOS s72033-adventerprisek9_wan-mz.122-33.SXJ.bin allow mac access-lists? I can create them but can't apply it to an interface ... Should I take into account something else?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It should, with some linecard limitations.  Quoting the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/lanswitch/command/reference/lsw_book/lsw_m1.pdf&quot; rel=&quot;noreferrer&quot;&gt;LAN Switching command reference&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;For the Cisco 7600 series platform when ES20 or ES40 line cards are used, only the &lt;code&gt;{permit | deny} {src-mac mask | any} {dest-mac mask | any}&lt;/code&gt; part of the command syntax applies. If an extended MAC Access Control List is created using the &lt;code&gt;[protocol [vlan vlan] [cos value]]&lt;/code&gt; options, these options are ignored.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These options apply to LAN cards.  If you were using an OSM or other &quot;WAN&quot; card, the issues are different.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-02-28T10:47:13.427" LastActivityDate="2014-02-28T10:47:13.427" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6572" PostTypeId="1" AcceptedAnswerId="6592" CreationDate="2014-02-28T16:07:29.860" Score="8" ViewCount="2611" Body="&lt;p&gt;We have an MPLS set up between two subnets.  Everything (that is, I have RDP both directions as well as file-sharing) seems to be working correctly except for two things, which may be related. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows computers do not populate the &quot;Network&quot; with devices from the other subnet.&lt;/li&gt;&#xA;&lt;li&gt;From the remote computer, we cannot load our internal website located on the host network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://social.technet.microsoft.com/Forums/windowsserver/en-US/f337a90e-36a9-456e-bf9f-7216958d6c3a/mpls-setup-on-windows-servers?forum=winserverNIS&quot; rel=&quot;nofollow noreferrer&quot;&gt;WINS is enabled and working&lt;/a&gt;, and both computers know who is the DNS server and who is the WINS server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The webserver is at &lt;code&gt;192.168.1.20&lt;/code&gt; (Windows Server 2003) and the computer (Windows 7) in the remote subnet is at &lt;code&gt;192.168.2.249&lt;/code&gt;.  File-sharing and RDP work both ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the host subnet is &lt;code&gt;192.168.0.0/23&lt;/code&gt; and the remote subnet is &lt;code&gt;192.168.2.0/23&lt;/code&gt;. Each of the Windstream routers have two ports - one for MPLS and one for internet.  Right now, the internet port at the remote is not connected.  The internet port on the host router runs through our firewall router before entering the host network, but the MPLS port at the host plugs directly into the switch-trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two Windstream Routers each have an MPLS port:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;192.168.1.2&lt;/code&gt; = Host MPLS&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;192.168.2.2&lt;/code&gt; = Remote MPLS&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Windstream routers also each have an open internet port to which I have attached a Firewall Router for filtering the internet, making the internet gateways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;192.168.1.1&lt;/code&gt; = Host Gateway&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;192.168.2.1&lt;/code&gt; = Remote Gateway&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://technet.microsoft.com/en-us/library/cc782048%28v=ws.10%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;I read here&lt;/a&gt; that I needed to list the subnets in Active Directory Sites and Services, so I've created the two subnets as members of the one site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For my testing, the firewalls are turned off on both computers plus the webserver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP (Windstream) confirms that MTU is set to 1500, and in their testing, their pings are always sent with a size of 1500.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what can I try to get these two issues solved?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a map:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/uV4RQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[update]&lt;/strong&gt;&#xA;When I run Wireshark on the webserver and watch the request for the webpage, I see alot of retransmissions on the http calls.  Here is the report:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/yS8FS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like http traffic from the remote to the host is what is getting retransmissions.  But I've got no equipment that can block it.  The firewalls are all off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I can telnet to the webserver from a machine on the same subnet, but I can't telnet to it from a machine on the remote subnet - it reports:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;c:\&amp;gt;telnet 192.168.1.20 80&#xA;Connecting To 192.168.1.20...Could not open connection to the host, on port 80: Connect failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Trace-Route from the webserver to the remote computer:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/XLwBM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trace-Route from the remote computer to the webserver:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/7F0oR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[update]&lt;/strong&gt;&#xA;I enabled IIS on the remote laptop, and I &lt;em&gt;am&lt;/em&gt; able to pull that webpage from a computer at the host location.  This has always been the case, however, in my tests.  The http traffic, therefore, is only one way.&lt;/p&gt;&#xA;" OwnerUserId="4453" LastEditorUserId="775" LastEditDate="2014-03-02T06:18:10.053" LastActivityDate="2014-03-02T06:18:10.053" Title="Cannot Load Internal Website over MPLS" Tags="|routing|firewall|mpls|lan|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6573" PostTypeId="2" ParentId="6533" CreationDate="2014-02-28T16:14:25.797" Score="1" Body="&lt;p&gt;You could have your MPLS provider configure a L2VPN for you across the MPLS network.  This allows you to have the same VLANs at both ends and actually communicate on a frame-by-frame rather than packet-by-packet basis.  Once you have that up and running, you can configure a First Hop Redundancy Protocol (FHRP) like VRRP.  This would leave your interface IP addresses at your primary site until the site went down (or the link between the two went down) at which point the router at your DR site would start answering ARP requests for those IP addresses.  The problem you want to make sure you avoid at that point is split brain where the link between the sites goes down and then both sites think they're active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just one possible fix.  You might also want to look at load balancing (active/active sites) or using DNS for failover.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-02-28T16:14:25.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6576" PostTypeId="1" CreationDate="2014-02-28T16:50:11.407" Score="6" ViewCount="2721" Body="&lt;p&gt;I have an NTP configured through out our in a hierarchy. 100% reliable with regards to providing time for Cisco devices. At one of our sites we allow cameras, servers, and workstations to utilize our Catalyst 4500s as their time source. Access layer switches have no problems drawing time from the 4500s. The cameras and servers however fail. The servers may turn out to be user error in configuring the Windows time service. A debug on the 4500s does show that the NTP process receives the request from the cameras, but the NTP process does not respond. My NTP configuration on the core is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 23 permit 10.1X.2X.1&#xA;access-list 24 permit 10.1X.0.0 0.0.255.255 log&#xA;access-list 24 permit 10.2X.0.0 0.0.255.255 log&#xA;access-list 24 deny   any log&#xA;&#xA;ntp logging&#xA;ntp authentication-key 30 md5 XXXX 7&#xA;ntp authenticate&#xA;ntp trusted-key 3X&#xA;ntp source Vlan1&#xA;ntp access-group peer 23&#xA;ntp access-group serve 24&#xA;ntp update-calendar&#xA;ntp server 10.1X.2X.1 key 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Camera requests (results in no reply)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb 26 13:20:34.327 pst: NTP recv pkt on v4 socket, pak = 0x83195238.&#xA;Feb 26 13:20:34.327 pst: NTP message received from 10.2X.0.215 on interface 'Vlan1' (10.X.X.2):&#xA;Feb 26 13:20:34.327 pst: &#xA; NTP Header:&#xA;   Leap = 11, Version = 4, Mode = 3,&#xA;   Stratum = 0,&#xA;   Poll Interval = 4,&#xA;   Precision = -6,&#xA;   Root Delay = 1.0,&#xA;   Root Dispersion = 1.0,&#xA;   refid = 0.0.0.0,&#xA;   Last update reftime = 0.0,&#xA;   Originated time = 0.0,&#xA;   Received time = 0.0,&#xA;   Transmit time = 3602438434.1847076455.&#xA; Hexadecimal equivalent (length = 48):&#xA;   0000: E3 00 04 FA 00 01 00 00&#xA;   0008: 00 01 00 00 00 00 00 00&#xA;   0010: 00 00 00 00 00 00 00 00&#xA;   0018: 00 00 00 00 00 00 00 00&#xA;   0020: 00 00 00 00 00 00 00 00&#xA;   0028: D6 B8 D9 22 6E 18 26 67&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Cat 4500 is running NTPv4 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show ntp associations detail &#xA;10.1X.2X.1 configured, ipv4, authenticated, our_master, sane, valid, stratum 3 &#xA;ref ID 10.X.X.X, time D6BB4F9D.6151EB70 (10:10:37.380 pst Fri Feb 28 2014)&#xA;our mode client, peer mode server, our poll intvl 1024, peer poll intvl 1024&#xA;root delay 61.55 msec, root disp 38.98, reach 377, sync dist 87.17&#xA;delay 1.78 msec, offset 1.7177 msec, dispersion 1.14, jitter 1.45 msec&#xA;precision 2**24, version 4&#xA;assoc id 13634, assoc name 10.1X.2X.1&#xA;assoc in packets 7068, assoc out packets 7069, assoc error packets 0&#xA;org time 00000000.00000000 (16:00:00.000 pst Wed Dec 31 1899)&#xA;rec time D6BB5203.C83AE4D7 (10:20:51.782 pst Fri Feb 28 2014)&#xA;xmt time D6BB5203.C83AE4D7 (10:20:51.782 pst Fri Feb 28 2014)&#xA;filtdelay =     4.85    4.86    3.85    3.83    3.85    1.83    3.83    1.78&#xA;filtoffset =   -0.30   -0.32    0.22    0.62    0.38    1.88    0.57    1.71&#xA;filterror =     0.97    1.00    1.03    1.06    1.09    1.12    1.15    1.18&#xA;minpoll = 6, maxpoll = 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="446" LastEditorUserId="446" LastEditDate="2014-02-28T18:55:08.323" LastActivityDate="2018-09-21T09:17:54.040" Title="Cisco NTP server does not respond to queries" Tags="|cisco|cisco-catalyst|cisco-4500|ntp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6577" PostTypeId="1" AcceptedAnswerId="6586" CreationDate="2014-02-28T17:09:40.433" Score="6" ViewCount="1260" Body="&lt;p&gt;I've tried building a network tap with only three ports: the two communicating parties and a tap side. I knew this would force the communicating sides to use at most half-duplex 100mbps, but detection is not an issue (I'm tapping my own hardware to better learn how it works under the hood). I've made 4-port taps before, but was still only able to tap one side at a time because my laptop has only one network port and I don't have a USB NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that my attempt at the 3-port tap doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used one normal cat5e cable connecting the two communicating parties and half a cable (with only one RJ45 connector) as tap. I connected TX+ and TX- (pins 3 and 6) from the main cable to RX+ and RX- (pins 1 and 2) on the tap cable like with a normal 4-port tap. This worked. (Except I never knew which side's traffic I was tapping because auto-MDIX automatically selects which side uses pins 1 and 2 to transmit and which uses 3 and 6 (unless connected to a switch), but that was expected.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I connected pins 1 and 2 of the main cable to pins 1 and 2 on the tap cable as well. This causes pins 1 &amp;amp; 3 and 2 &amp;amp; 6 to suddenly be in the same collision domain, so when one starts sending the other side will receive it on both the receive and transmit pins, and will not be able to transmit during that time (or if it accidentally does, CSMA/CD kicks in).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least that was the theory. Autonegotiation should detect the shared collision domain and switch the sides to 100mbps half-duplex ethernet. Except this never worked... both parties just became to be unable to transmit any data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this? My logic of building a network tap like this is probably faulty somewhere, but I can't really figure out why. If this doesn't work, why does the term &quot;half-duplex ethernet&quot; exist at all? What other situation can you have where you have a half-duplex ethernet connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, is there any way I can tell my NIC that it should treat both pins 1&amp;amp;2 and 3&amp;amp;6 as receiving? I'm using Linux, but I'm afraid I'll have to go beyond tooling and modify the driver, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry if I'm making some stupid and obvious mistake in my build, but I can't really figure out a way to make this work. I've also looked at a similar question about &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/412/why-do-network-taps-have-four-ports&quot;&gt;why network taps have 4 ports&lt;/a&gt;, but the answer there is that the tap side would need 200mbps to receive both ends at the same time (which is not a standard, thus needing 1gbps, thus needing more than two receiving pins). With half-duplex though, only one side can be sending at the same time, so the bit rate is still 100mbps and the speed can't be the issue.&lt;/p&gt;&#xA;" OwnerUserId="895" LastActivityDate="2014-02-28T20:26:51.793" Title="Building a 3 port network tap (100mbps half-duplex)" Tags="|ethernet|packet-analysis|hardware|tap|autonegotiation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6578" PostTypeId="5" CreationDate="2014-02-28T17:13:09.403" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-02-28T17:13:09.403" LastActivityDate="2014-02-28T17:13:09.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6579" PostTypeId="4" CreationDate="2014-02-28T17:13:09.403" Score="0" Body="The act of passively monitoring network traffic by way of a specialized device directly connected to the network medium. The term can also be used to describe the device itself." OwnerUserId="895" LastEditorUserId="762" LastEditDate="2014-02-28T17:24:20.970" LastActivityDate="2014-02-28T17:24:20.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6580" PostTypeId="2" ParentId="6576" CreationDate="2014-02-28T17:14:07.377" Score="5" Body="&lt;p&gt;Your 4500 is most likely running NTP v3.  This is the default on many recent IOS versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As shown in your debug &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Leap = 11, &lt;strong&gt;Version = 4&lt;/strong&gt;, Mode = 3&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;your server is looking for NTP v4.&lt;/p&gt;&#xA;" OwnerUserId="176" LastActivityDate="2014-02-28T17:14:07.377" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6581" PostTypeId="2" ParentId="6359" CreationDate="2014-02-28T17:28:55.493" Score="0" Body="&lt;p&gt;Try add a host static route. doing so it would add the route in the routing table. See if your initial redistribute command works after that.&lt;/p&gt;&#xA;" OwnerUserId="4552" LastActivityDate="2014-02-28T17:28:55.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6582" PostTypeId="2" ParentId="6577" CreationDate="2014-02-28T17:31:34.740" Score="4" Body="&lt;p&gt;Because it's only for your own use, I guess that a simple hack will work. &#xA;You can build a regular 4 way tap and bridge the listening ports using an old 100mbps Hub to your laptop. &lt;/p&gt;&#xA;" OwnerUserId="4106" LastActivityDate="2014-02-28T17:31:34.740" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6585" PostTypeId="1" AcceptedAnswerId="6598" CreationDate="2014-02-28T19:51:36.687" Score="4" ViewCount="1291" Body="&lt;p&gt;I am a volunteer teacher trying to get my students fired up by learning Broadband. Accordingly I am building a small scale DSL/PPPoE Broadband network that they can touch, deconstruct and put back together themselves with a little help. Issue is, we have very little budget (I am paying for it personally). It needs to be physical to inspire them (we've tried simulation  but the eyes glaze over)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far we have a DSL modem (a DLink flashed with DD-WRT) and an IP DSLAM (&lt;a href=&quot;http://www.aliexpress.com/store/product/Original-ZTE-ZXDSL-9806H-access-DSLAM-ADSL-access-switch-Multi-Media-Service-DSLAM-9806H-chassis-with/227451_1460515767.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ZTE ZXDSL 9806H&lt;/a&gt;) connected with a 50 pin amphenol connector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we now need is an upstream BRAS and a PPPoE Server. Given budget constraint I was hoping it might be possible to use a ERICSSON T720G MDU ONU (link removed because reputation too low) as the BRAS (doubling as a OLT for a future FTTx demo) for upstream traffic by connecting to the DSLAM on the upstream GPON interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would give us the following 'Broadband' architecture as shown in the picture:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/qKiy4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will this architecture work? Or do I need to shell out for some more equipment? &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;[EDIT]&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;There is an error in the diagram. All traffic needs to go via the PPPoE server (Linux or not) &lt;/p&gt;&#xA;" OwnerUserId="4564" LastEditorUserId="4564" LastEditDate="2014-03-03T11:12:40.563" LastActivityDate="2014-03-03T11:12:40.563" Title="Will an ERICSSON T720G GPON ONU &amp; a Linux box work as an upstream PPPoE BRAS in our demo setup?" Tags="|architecture|pppoe|ppp|adsl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6586" PostTypeId="2" ParentId="6577" CreationDate="2014-02-28T20:26:51.793" Score="6" Body="&lt;p&gt;Your thought process is based on faulty assumptions.  By splicing 1 to 3 and 2 to 6 (which is what you have done), this does not put them in the same collision domain.  Nor does this cause the devices to autonegotiate into half-duplex mode.  Connect only one side of your main cable to one device and what you have now created is basically a &quot;loopback.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at a hubbed 10BaseT or 100BaseTX environment.  While they are in the same collision domain, they still have separate TX and RX pairs, they don't transmit in both directions on the same pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for the collision domain is that a hub is ultimately a repeating device, which takes a signal in one port and repeats it out all other ports.  If it receives traffic on two ports and repeats it out the other ports, the signal that is repeated will be a &quot;collision&quot; of the two signals creating an unusable signal.  Thus the need for CSMA/CD and half-duplex operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By having three devices all spliced together in this fashion, you have merely created an environment that won't work.  If you want to do this, simply put a hub between your two devices and connect a &quot;listening&quot; device to it.  No need for a tap.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-02-28T20:26:51.793" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6587" PostTypeId="1" AcceptedAnswerId="7501" CreationDate="2014-02-28T20:55:49.493" Score="4" ViewCount="1969" Body="&lt;p&gt;Do any Cisco IOS/XE/XR systems support the updated TCP security option TCP-AO (option kind 29)?   It'd be nice to be able to use it.&lt;/p&gt;&#xA;&lt;p&gt;It's defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5925&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5925&lt;/a&gt;, and is meant to obsolete &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2385&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2385, &amp;quot;Protection of BGP Sessions via the TCP MD5 Signature Option&amp;quot;&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I can't find any good references for it.  Even descriptions of BGP md5 authentication (tcp option kind 19) tend to gloss over details.&lt;/p&gt;&#xA;&lt;p&gt;Is there a method to authenticate with AO instead of md5? Does Cisco even recognize it anywhere?&lt;/p&gt;&#xA;" OwnerUserId="2624" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2019-06-01T02:08:23.023" Title="Implementing the TCP Authentication Option (TCP-AO)" Tags="|tcp|protocol-theory|transport-protocol|authentication|rfc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6588" PostTypeId="2" ParentId="6562" CreationDate="2014-02-28T21:39:20.653" Score="1" Body="&lt;p&gt;TCP uses special rules to make IP Reliable, even though it would otherwise be unreliable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems you're looking for more of a conceptual understanding, so I'm going to give an example without actually referring to the true inner workings of TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say you and I were chatting on a Two-way Radio (or Walkie Talkie).  I can hit the transmit button and say something, but I have no way to make sure you received anything.  In this example, the Walkie-Talkie is &quot;IP&quot; -- an unreliable protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say you and I decided to do something above and beyond IP, and employed the following rules when using our Two-way Radios:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Whenever I finish speaking, I say &quot;over&quot;&lt;/li&gt;&#xA;&lt;li&gt;Whenever you hear me say &quot;over&quot;, You repeat back to me the first word and the last word I said (before &quot;over&quot;)&lt;/li&gt;&#xA;&lt;li&gt;Whenever I hear you acknowledge my first and last words, I will say &quot;acknowledgement received&quot;&lt;/li&gt;&#xA;&lt;li&gt;Once you hear &quot;acknowledgement received&quot;, you are then free to speak on the radio.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If at anytime, one of us does the above but doesn't hear the expected response after 5 seconds, we repeat the last thing we said.&#xA;&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These &quot;set of rules&quot; are effectively what TCP calls for.  In following these rules, we can make what would otherwise be an unreliable communication medium (Two-Way Radio / IP), a reliable communication method (TCP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So as others have said, the &quot;unreliability&quot; of IP does not negate the &quot;reliability&quot; of TCP.  TCP simply uses IP with smart acknowledgements to make communication using TCP/IP reliable.  TCP by itself can not handle sending packets from one host to another, all it can do is apply certain rules to an 'end to end' delivery scheme (like IP), to make that delivery scheme more reliable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-02-28T21:39:20.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6589" PostTypeId="1" CreationDate="2014-03-01T10:59:46.857" Score="3" ViewCount="3040" Body="&lt;p&gt;It seems like a strange idea to transfer files using a connectionless protocol - so in what situation would you not care about if the entire file is delivered or not? I read somewhere that TFTP is used for upgrading the firmware of routers, but why would you do that with TFTP? Wouldn't that mean that you can't be sure that all the data (the entire update) has arrived at the destination?&lt;/p&gt;&#xA;" OwnerUserId="4491" LastEditorUserId="775" LastEditDate="2014-03-01T13:11:57.087" LastActivityDate="2014-03-01T13:42:38.643" Title="When is TFTP used?" Tags="|router|management|udp|" AnswerCount="2" CommentCount="1" ClosedDate="2018-04-26T03:46:49.713" ContentLicense="CC BY-SA 3.0" />
  <row Id="6590" PostTypeId="2" ParentId="6589" CreationDate="2014-03-01T12:12:24.307" Score="4" Body="&lt;p&gt;TFTP uses UDP for the transfer, which as you indicate is a connectionless protocol.  FTP, SCP, HTTP or other methods of transfer typically use TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP requires less overhead and is generally faster than TCP.  There is no TCP acknowledgements nor the TCP window to account for during the transfer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are generally other methods to verify the data once it has arrived, typically by comparing a calculated hash to a known value.  Since the transfer typically takes place over your own network under your control, which hopefully is reliable, they generally turn out fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, many devices will allow you to set a primary and a backup image to boot from, so you can configure the device to boot from the backup if the primary image fails to load for some reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using an unreliable network, another option is typically available to use such as FTP.  However you will still probably want to use any verification methods you have available to ensure data integrity.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-03-01T12:12:24.307" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6591" PostTypeId="2" ParentId="6589" CreationDate="2014-03-01T13:42:38.643" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;It seems like a strange idea to transfer files using a connectionless protocol - so in what situation would you not care about if the entire file is delivered or not?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm going to add a bit to YLearn's excellent answer... You always want the entire file delivered.  Asserting that one doesn't want the whole file transferred because of &lt;a href=&quot;http://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol&quot;&gt;TFTP&lt;/a&gt; is a faulty understanding of &lt;a href=&quot;http://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol&quot;&gt;TFTP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I read somewhere that TFTP is used for upgrading the firmware of routers, but why would you do that with TFTP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is a very simple, but still reliable protocol. There are times you may get stuck at the Cisco IOS &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/rommon/configuration/guide/rm41crs/rm41over.html&quot;&gt;rommon&lt;/a&gt; prompt (either for debugging, or because of an error).  Rommon is a tiny environment itself; &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/rommon/configuration/guide/rm41crs/rm41over.html&quot;&gt;rommon&lt;/a&gt; images are typically around 500KB.  Sometimes you wind up transferring files from within &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/rommon/configuration/guide/rm41crs/rm41over.html&quot;&gt;rommon&lt;/a&gt;; thus you need a small file transfer protocol like &lt;a href=&quot;http://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol&quot;&gt;TFTP&lt;/a&gt; if you want the protocol to fit inside &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/rommon/configuration/guide/rm41crs/rm41over.html&quot;&gt;rommon&lt;/a&gt;.  By using tftp, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-1/rommon/configuration/guide/rm41crs/rm41over.html&quot;&gt;rommon&lt;/a&gt; can use a much smaller IP stack (UDP and IP, without TCP).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I read somewhere that TFTP is used for upgrading the firmware of routers, but why would you do that with TFTP? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No authentication is primarily the reason I do it; it is less typing and a very easy way to transfer images.  You certainly can use scp or ftp.  There is no reason to bother with that... so what if someone sniffs my IOS image?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Wouldn't that mean that you can't be sure that all the data (the entire update) has arrived at the destination?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is an incorrect understanding of &lt;a href=&quot;http://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol&quot;&gt;TFTP&lt;/a&gt;.  &lt;a href=&quot;http://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol&quot;&gt;TFTP&lt;/a&gt; is a reliable transfer protocol, by default &lt;a href=&quot;http://en.wikipedia.org/wiki/Trivial_File_Transfer_Protocol#Protocol_walkthrough&quot;&gt;each tftp packet must be acknowledged&lt;/a&gt;, which means it's slower, especially over a WAN (because there are no TCP windowing dynamics).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the image is on the router, you should &lt;em&gt;always&lt;/em&gt; verify the IOS checksums against those posted on Cisco's website...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S01#verify /md5 flash:c3560-ipservicesk9-mz.122-58.SE2.bin&#xA;........................................................................................&#xA;........................................................................................&#xA;...........................................................&#xA;verify /md5 (flash:c3560-ipservicesk9-mz.122-58.SE2.bin) = bbddf83e7ee1023619630110b6b3a998&#xA;&#xA;S01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-03-01T13:42:38.643" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6592" PostTypeId="2" ParentId="6572" CreationDate="2014-03-01T17:05:45.173" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The two Windstream Routers each have an MPLS port:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;code&gt;192.168.1.2&lt;/code&gt; = Host MPLS &lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;192.168.2.2&lt;/code&gt; = Remote MPLS&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;The Windstream routers also each have an open internet port to which I have attached a Firewall Router for filtering the internet, making the internet gateways:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;code&gt;192.168.1.1&lt;/code&gt; = Host Gateway &lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;192.168.2.1&lt;/code&gt; = Remote Gateway&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Problem Summary&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Your problem is that you've got multiple routers on the same subnet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The Internet gateway at 192.168.1.1&lt;/li&gt;&#xA;&lt;li&gt;The Windstream MPLS router at 192.168.1.2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is a faulty design; I completely understand that it &quot;seems like&quot; there is nothing &#xA;wrong with this, but as you're discovering, this is a hard way to build the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following up on our chat discussion, the exact problem is that SAINTJOSEPH's TCP SYN packets are delivered correctly; however, stateful inspection on your PaloAlto firewall drops SAINTSERVIUS' TCP SYN-ACK response, due to asymmetric routing in your environment.  This is illustrated in the two following diagrams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;TCP SYN from SAINTJOSEPH to SAINTSERVIUS&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/chc6T.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/chc6T.png&quot; alt=&quot;sspx_Before02&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Your PaloAlto firewall drops the TCP SYN-ACK from SAINTSERVIUS to SAINTJOSEPH&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YVns8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YVns8.png&quot; alt=&quot;sspx_Before03&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;code&gt;tracert&lt;/code&gt; makes it very clear that SAINTSERVIUS defaults through 192.168.1.1 (the PaloAlto firewall):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XLwBM.png&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Long Term Solutions&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You should only have a &lt;em&gt;single router next-hop for every subnet&lt;/em&gt;; however, you currently have two.  This results in the drops shown in your wireshark screen capture (which indicates that TCP SYN-ACK packets never reach Windstream's MPLS network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are two long-term solutions which we discussed... I'm also including the quick hack we did to validate that the problem is stateful packet drops on the PaloAltos.   I am assuming you are using multiple interfaces on the PaloAlto.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Option A: Keep the PaloAlto firewalls inline with your interoffice connections (more maintenance)&lt;/li&gt;&#xA;&lt;li&gt;Option B: Move the PaloAlto firewalls in front of the internet connections (less maintenance, but also less comfortable)&lt;/li&gt;&#xA;&lt;li&gt;Option C: Quick Windows static routing hack&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Better Design, Option A (MPLS re-addressing required)&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This is a another way to lay out the subnet for SAINTSERVIUS (retaining your numbering scheme with /23 subnets, although it's not required...).  This option keeps interoffice routing on the PaloAlto firewalls, which feels more familiar to you right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uRjIa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uRjIa.png&quot; alt=&quot;sspx_After01&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a long-term solution.  You would have to work with Windstream to readdress your infrastructure.  This is a lot of work.  In my opinion, keeping the firewalls in the middle of your interoffice traffic is less preferable.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Better Design, Option B (MPLS re-addressing required)&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This is a another way to lay out the subnet for SAINTSERVIUS (retaining your numbering scheme with /23 subnets, although it's not required...).  This option offloads interoffice LAN routing to your PowerConnect switches, and relies on the PaloAlto firewalls to protect against internet threats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eEnxs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eEnxs.png&quot; alt=&quot;sspx_After02&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a long-term solution.  You would have to work with Windstream to readdress your infrastructure.  This is a lot of work, but it offers the advantage of not having to deal with firewalls for your interoffice communication.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Suboptimal Workaround, Option C (what you used after our chat)&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Open a &lt;code&gt;cmd.exe&lt;/code&gt; window and add this route on SAINTSERVIUS as the Administrator:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;route ADD 192.168.2.0 MASK 255.255.254.0  192.168.1.2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Closing remarks&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I should mention that you are one of the few people who followed through with sufficient details about your question  When you started, we didn't have enough details to answer the question.  Now, the issues are very clear; thank you for putting the time / effort into documenting the problem well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personal note: If you would like an electronic copies of the diagrams as SVG / &lt;a href=&quot;http://www.inkscape.org/en/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Inkscape&lt;/a&gt; format, please feel free to contact me at my personal email (listed in my &lt;a href=&quot;https://networkengineering.stackexchange.com/users/775/mike-pennington&quot;&gt;user profile&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-03-02T02:45:15.670" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6597" PostTypeId="2" ParentId="3329" CreationDate="2014-03-02T02:02:30.543" Score="3" Body="&lt;p&gt;To start with, this is a very good question, which touches upon the basic network foundations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bottom line to your question is, we don't really need a MAC address in order to achieve connectivity. Theoretically, a network could be built implementing IP addresses alone! &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;However, some practical difficulties may arise out of using such a scheme. If you expect to manually assign an IP address to each network device, then you may avoid the major pitfalls. However, if you need to automatically assign IP addresses, as when there are too many network nodes to manually administer, then there is no way to make sure each node is allocated exactly a single IP address, or a predetermined number of them, because you cannot tell one from the other, unless the address distribution entity can uniquely and unequivocally identify the requesting device, e.g. by its MAC address, which is assumed to be unique for any device in a LAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such an unidentifiable device may repeatedly ask for additional IP addresses and, eventually, wreak havoc on the network viability. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back to the topic, all you need to establish an IP-only network, is to let network interface adapter's Data Link Layer pass through any data frame it receives, directly to the Network Layer, regardless of any MAC comparable address type, where it can be filtered according to its destination IP address, instead of being filtered at the Data Layer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to illustrate the concept, assume a network is established by interconnecting RS-232 UART ports: UART devices don't have MAC addresses, or any other unique identifier, for that matter, yet you could construct a local network using UARTs and IP addresses alone, providing you install the proper UART drivers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this passage gave you some insights on the subject.&lt;/p&gt;&#xA;" OwnerUserId="4577" LastEditorUserId="68599" LastEditDate="2020-05-22T09:32:57.237" LastActivityDate="2020-05-22T09:32:57.237" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6598" PostTypeId="2" ParentId="6585" CreationDate="2014-03-02T06:18:42.760" Score="5" Body="&lt;p&gt;I'd remove the Ericsson box. It isn't a BRAS. From your diagram it looks like you'd be using it as a aggregation switch and the Linux PPP Server would be your BRAS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, for lab purposes I'd also remove the Linux PPP Server and hook the DSLAM up to a Cisco 3825 or 7200 configured as a BRAS. If you really want the Linux element set up a FreeRADIUS server to do AAA for the PPP sessions.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2014-03-02T06:18:42.760" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6603" PostTypeId="2" ParentId="6554" CreationDate="2014-03-03T07:26:59.720" Score="0" Body="&lt;p&gt;If you haven't actually committed to purchasing the Cisco devices, one solution I can think of is to put in a pair of Fortigate devices, then configure them to build a pair of tunnels and perform load balancing between the two tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With suitable models (the ones with internal storage), you'd even get WAN Optimization feature.&lt;/p&gt;&#xA;" OwnerUserId="2538" LastActivityDate="2014-03-03T07:26:59.720" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6604" PostTypeId="2" ParentId="6565" CreationDate="2014-03-03T07:36:03.233" Score="4" Body="&lt;p&gt;This doesn't really answer my question why did NAT always use the 80th port as source port for outgoing traffic, but at least I figured out how to fix the problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created an access list to match traffic from the mail server and also created a pool of one public address for it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended 109&#xA; !!! Restrict NAT for branch office destinations&#xA; deny ip host 192.168.7.7. 192.168.0.0 0.0.255.255&#xA; permit ip host 192.168.7.7 any&#xA;ip nat pool MAIL 198.51.100.7 198.51.100.7 prefix-length 27&#xA;ip nat inside source list 109 pool MAIL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And...Voilà! It now preserves the source port number as it sends traffic. And our mail is no longer blocked by some external MTA mail servers.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Update:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;So now I tried reverting back to: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat source static 192.168.7.7 198.51.100.7 route-map Deny_On_VPN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it actually started to translate addresses and ports as expected - one to one. I don't really understand what the deal was with it, maybe a bug? Hopefully it will keep running like this from now on. I guess, I'll have a look at IOS release notes&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="3191" LastEditDate="2014-03-03T11:53:26.547" LastActivityDate="2014-03-03T11:53:26.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6607" PostTypeId="1" AcceptedAnswerId="6608" CreationDate="2014-03-03T10:28:34.250" Score="2" ViewCount="154" Body="&lt;p&gt;A TCP server has IP address 10.0.7.2 and a TCP client has IP address 10.0.7.3. The TCP server is waiting on port number 3333 for a connection request. The client connects to the server and transmits 2000 bytes to the server, which are sent as 4 write operations of 500 bytes each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I was wondering if were to write out this command for the receiver would this be correct?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ttcp -ts -l500 -n4 -p3333 -D 10.0.7.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or would it be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ttcp -ts -l2000 -n4 -p3333 -D 10.0.7.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm assuming that it would be the first option but am not confident.  &lt;/p&gt;&#xA;" OwnerUserId="4598" LastEditorUserId="775" LastEditDate="2014-04-03T13:42:34.987" LastActivityDate="2014-04-03T13:42:34.987" Title="Ttcp specific question" Tags="|tcp|testing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6608" PostTypeId="2" ParentId="6607" CreationDate="2014-03-03T11:03:05.153" Score="2" Body="&lt;p&gt;You need to have the server in Receive mode (i.e. &lt;code&gt;-r&lt;/code&gt; option).  Try the below command syntax.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ttcp -r -s -p 3333 -D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Check out the &lt;a href=&quot;http://linux.die.net/man/1/ttcp&quot; rel=&quot;nofollow&quot;&gt;ttcp man page&lt;/a&gt; for more details.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Further reading&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In order to make this a viable setup, you need a sender and receiver.  The sender effectively establishes all of the prameters the tcp session will be benchmarked on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Transmit&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ttcp -t [-u] [-s] [-p port] [-l buflen] [-b size] [-n numbufs] [-A align] [-O offset] [-f format] [-D] [-v] host [&amp;lt;in]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Receive&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ttcp -r [-u] [-s] [-p port] [-l buflen] [-b size] [-A align] [-O offset] [-f format] [-B] [-T] [-v] [&amp;gt;out]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Take notice that the receiver is only modifying parameters the sender is specifying.  Initially, you were trying to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-t Transmit mode.&#xA;-s stdout.&#xA;-l length &#xA;-n number of source buffers&#xA;-p port&#xA;-D Do not buffer data when sending&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As a receiver, you aren't allowed to use, or shouldn't be using, options &lt;code&gt;-t&lt;/code&gt;, &lt;code&gt;-n&lt;/code&gt;, or &lt;code&gt;-D&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-03-04T11:22:54.437" LastActivityDate="2014-03-04T11:22:54.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6610" PostTypeId="1" AcceptedAnswerId="6614" CreationDate="2014-03-03T11:59:54.983" Score="3" ViewCount="1343" Body="&lt;p&gt;I don't know that much in detail how full-duplex works and I wonder if collisions can occur in them. Take a UTP cable for an example - are some cables within it reserved for data going one way and the other wires for data going the &lt;em&gt;other&lt;/em&gt; way? Can two frames going in the &lt;em&gt;same&lt;/em&gt; direction crash with each other?&lt;/p&gt;&#xA;" OwnerUserId="4491" LastEditorUserId="775" LastEditDate="2014-03-03T14:13:02.380" LastActivityDate="2016-04-21T00:07:55.637" Title="Full-duplex collisions in wires" Tags="|transport-protocol|duplex|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6614" PostTypeId="2" ParentId="6610" CreationDate="2014-03-03T15:39:46.740" Score="7" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Duplex_(telecommunications)#Full-duplex&quot; rel=&quot;noreferrer&quot;&gt;Full-duplex&lt;/a&gt; basically means communication can happen both ways, negating the possibility of a collision.  The below diagram should make it a little more clear. One pair is designated a transmit pair, and the other a receive pair.  In most environments now, it isn't even necessary to match up transmit/receive pairs, as &lt;a href=&quot;http://en.wikipedia.org/wiki/Medium_Dependent_Interface#Auto-MDIX&quot; rel=&quot;noreferrer&quot;&gt;MDIX&lt;/a&gt; handles that for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QrMWA.gif&quot; alt=&quot;Straight-Through Cable Pinout&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This doesn't eliminate the possibility of collisions on one side as a result of a configuration mistake, such as half-duplex on one side and full-duplex on the other.  That's fairly common.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can two frames going in the same direction crash with each other?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, frames wait in a buffer until they can be transmitted across a link. One by one.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-03-03T15:39:46.740" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6615" PostTypeId="1" AcceptedAnswerId="6980" CreationDate="2014-03-03T14:49:47.973" Score="9" ViewCount="1354" Body="&lt;p&gt;Bit of 'belt and braces' configuration planning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Background:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a successful site-to-site VPN link to our remote datacenter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The remote 'protected' network is also the IP network range that is opened up through the firewall as Internet facing endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Thus&lt;/em&gt;: We use the VPN so we can access non-public endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem Statement&lt;/strong&gt;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the VPN link is down, the ASA drops the traffic, even though the Internet endpoints should still be available through the remote firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I configure the VPN to 'pass' the traffic as regular outgoing traffic, when the VPN is down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the pertinent segments of the config.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto map vpn-crypto-map 20 match address remdc-vpn-acl&#xA;crypto map vpn-crypto-map 20 set peer a.b.c.d &#xA;crypto map vpn-crypto-map 20 set transform-set remdc-ipsec-proposal-set&#xA;crypto map vpn-crypto-map interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ACL for matching traffic is very primitive: it specifies the two networks, private and remote, expressed as network objects.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list remdc-vpn-acl extended permit ip object &amp;lt;private&amp;gt; object &amp;lt;remote&amp;gt; log &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And a primitive diagram.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                     INTERNET&#xA;                                                x&#xA;                                                x&#xA;REM DC 203.000.113.000/24                      xx                       HQ 192.168.001.000/24&#xA;                                               x&#xA;           +---------------+                  x               +-----------+&#xA;           | REMOTE DC     |                 xx               |           |&#xA;           | ASA           e               xxx                | ASA 5505  |&#xA;+----------+               |              xx                  |           +-----------------+&#xA;   ^       |               e&amp;lt;-------------------------------------+       |&#xA;   |       |               |              xxxx                |           |&#xA;   |       |               e                 xxxx             |     ~     |&#xA;   |       |               |                    xx            |     |     |&#xA;   |       |               |                     xx           +----vpn----+&#xA;   |       |               |                      x                 |&#xA;   \-------vpn-------------vpn--------------------------------------/&#xA;           |               |                   xxx&#xA;           +---------------+                  xx&#xA;                                           xxx&#xA;                                          xx&#xA;                                       xxxx&#xA;    e = public Internet                x&#xA;        server endpoint&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rob&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 01&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more precise ACL has been discussed in the comments below (with thanks)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can envisage two ACLS. (A) which permits ALL to the remote net, and then denies endpoints that are already available over the Internet. and (B) which opens up just the management/instrumentation as required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with (B) is that expressesing endpoints such as WMI &amp;amp; Windows RPC is impractical without tweaking standard server conf) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, maybe (A) is the best approach which becomes an inverse of the remote &lt;em&gt;firewall&lt;/em&gt; config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 02&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mike has asked to see more of the ASA's ios configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;What follows is for the HQ ASA which is at the HQ site. The remote DC one is under the control of the data center provider, and so I can't comment on exactly how that may be configured.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, there isn't much to show:  There is one default route to the Internet gateway, and no other specific routes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route outside 0.0.0.0 0.0.0.0 HQInetGateway 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interfaces are very basic. Only basic IPv4 config and vlans to split the group into 1 outside interface and 1 inside interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.30.2.5 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 194.28.139.162 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cheers, Rob&lt;/p&gt;&#xA;" OwnerUserId="4604" OwnerDisplayName="Rob Shepherd" LastEditorUserId="4604" LastEditDate="2014-03-04T14:11:43.657" LastActivityDate="2014-03-24T22:56:31.773" Title="Cisco IPSec Site-to-site VPN. Permit traffic if VPN is down" Tags="|vpn|ipsec|cisco|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6616" PostTypeId="1" CreationDate="2014-03-03T17:49:50.340" Score="4" ViewCount="21745" Body="&lt;p&gt;My office network is &lt;code&gt;10.25.0.0/16&lt;/code&gt;.  I have a VPC in Amazon that's &lt;code&gt;10.100.0.0/16&lt;/code&gt;, and I have a VPN established between the office and the VPC using Amazon's Virtual Private gateway.  This connection works as expected - traffic to 10.100.0.0 connects fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a separate VPC (legacy stuff) in &lt;code&gt;10.30.0.0/16&lt;/code&gt;, and I've setup openswan between &lt;code&gt;10.100.0.0&lt;/code&gt; and &lt;code&gt;10.30.0.0&lt;/code&gt; so they can speak to each other, and that works (I can ssh between the two networks).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that I want to connect from the &lt;code&gt;10.25.0.0&lt;/code&gt; network to &lt;code&gt;10.30.0.0&lt;/code&gt; network THROUGH the &lt;code&gt;10.100&lt;/code&gt; network.  I've set all the appropriate routing rules in the office firewall (SonicWall NSA2400, SonicOS 5.9) but as far as I can tell traffic isn't leaving the SonicWall.  When I do a packet capture on the sonicwall, packets destined for &lt;code&gt;10.30.x.x&lt;/code&gt; show as &quot;Consumed&quot; or &quot;dropped&quot; with zero &quot;forwarded.&quot;  I don't understand what &quot;consumed&quot; is either, but that's a separate issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried everything I can think of  - there are no ACLs or Firewall rules blocking traffic.  Traffic to 10.100 and 10.33 are routed the exact same way (over the VPN interfaces) but traffic to 10.100 gets forwarded while traffic to 10.33 doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what a packet capture for an SSH attempt to 10.100 shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--File Index : 1.--&#xA;&#xA;--241 packets captured.--&#xA;&#xA;-----Statistics------------&#xA;Number Of Bytes Failed To Report:        0&#xA;Number Of Packets Forwarded     :        53&#xA;Number Of Packets Generated     :        0&#xA;Number Of Packets Consumed      :        137&#xA;Number Of Packets DROPPED       :        51&#xA;Number Of Packets Status Unknown:        0&#xA;&#xA;*Packet number: 1*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's what I get when I SSH to 10.33:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--58 packets captured.--&#xA;&#xA;-----Statistics------------&#xA;Number Of Bytes Failed To Report:        0&#xA;Number Of Packets Forwarded     :        0&#xA;Number Of Packets Generated     :        0&#xA;Number Of Packets Consumed      :        13&#xA;Number Of Packets DROPPED       :        45&#xA;Number Of Packets Status Unknown:        0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I missing to allow it to forward traffic to 10.33.0.0 over the Office-AmazonVPC tunnel?  According to everything I've read this should work but I appear to be missing something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit #2: I followed this exact guide.  As I said, it works for the 10.100 network but not the 10.30 network through the same interface: &lt;a href=&quot;http://www.sonicwall.com/app/projects/file_downloader/document_lib.php?t=TN&amp;amp;id=339&amp;amp;dl=1&quot; rel=&quot;nofollow&quot;&gt;http://www.sonicwall.com/app/projects/file_downloader/document_lib.php?t=TN&amp;amp;id=339&amp;amp;dl=1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit #3: Traffic within the VPC is routing correctly, so if there's some magic incantation you need to do to let it route traffic from our office LAN I'd love to know what it is. We have a static route inside the VPC to tell it that the 10.25.0.0/16 traffic should go over the VPGW, and all the other routes for 10.30.0.0/16 are correctly forwarding to the OpenVPN instances.&lt;/p&gt;&#xA;" OwnerUserId="4606" LastEditorUserId="775" LastEditDate="2014-04-11T01:59:04.847" LastActivityDate="2015-05-30T08:47:13.447" Title="Sonicwall not fowarding VPN traffic over tunnel" Tags="|vpn|ipsec|tunnel|sonicwall|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="6617" PostTypeId="1" AcceptedAnswerId="10952" CreationDate="2014-03-03T19:46:21.940" Score="2" ViewCount="7575" Body="&lt;p&gt;We have a network with a bunch of 3560 switches setup and desktops/laptops and some Rockwell Automation equipment connected to them. We had to add a new switch, a 3560X to the network recently to add capacity. After adding this switch, a bunch of the Rockwell Automation devices detect duplicate IPs from the MAC of the new switch. This does not occur with any desktops/laptops/printers/etc. The issue happens to Rockwell equipment plugged into 3 different switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All wired ports use vlan 101. It is on subnet:&#xA;10.2.30.0/23&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All network devices are on vlan 2 for management. Subnet:&#xA;10.32.2.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The new switch did have an interface on vlan 101 without an IP assigned (mistake) which I removed recently but the issue persisted. I am rebooting the switch now as at least on the routers, the interface persists in a deleted state until a reboot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am going to be setting up an RSPAN for the ports with equipment having the issue next if this persists after the reboot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would cause end user devices to think a switch has the same IP as them? We have not had this issue at any other site with the same setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch layout:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch-stack1 -G1/0/10----G0/1-&amp;gt; switch2 -G0/2----G0/1 -&amp;gt; switch3&#xA;                                 switch2 -G0/3----G0/1 -&amp;gt; switch4&#xA;&#xA;switch-stack1 -Gi1/0/6----G0/1-&amp;gt; switch5&#xA;&#xA;switch-stack1 -Gi1/0/5----G0/1-&amp;gt; switch6 -G0/3--G1/0/1 -&amp;gt; switch7&#xA;&#xA;switch-stack1 -Gi1/0/4--G1/0/1-&amp;gt; New switch causing problem&#xA;&#xA;switch-stack1 -Gi1/0/1----G0/1-&amp;gt; switch8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="775" LastEditDate="2014-03-04T10:10:33.837" LastActivityDate="2016-08-03T14:03:04.783" Title="Cisco 3560X Switch MAC reported with same IP as other equipment" Tags="|cisco|switch|troubleshooting|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6618" PostTypeId="1" AcceptedAnswerId="6658" CreationDate="2014-03-03T20:00:52.010" Score="0" ViewCount="325" Body="&lt;p&gt;Configuration that I need to replace is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco 1841 (Connected to the internet via ISP (ethernet), Point to point via 2 T1 to another location, backup vpn to another 1841 if PTP fails, Eigrp routing, firewall features, Router on the stick)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Core switch Cisco 2960 (Data, Voice, Mgmt vlans, connected to the rest of the network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We upgraded ISP to 100Mb/s and it looks like Cisco 1841 can't handle it. I am getting 35 Mb/s download.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What will be best way to replace this? I am thinking to have some decent firewall connected to the internet which will be connected to the core layer 3 switch (for Vlan routing) and then have router connected to the core switch to provide PTP connection and VPN if PTP fails.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know what do you think,&#xA;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="4608" LastActivityDate="2014-03-05T21:16:38.993" Title="Replace router on the stick" Tags="|router|" AnswerCount="1" CommentCount="3" ClosedDate="2019-12-05T18:07:32.597" ContentLicense="CC BY-SA 3.0" />
  <row Id="6620" PostTypeId="1" AcceptedAnswerId="6623" CreationDate="2014-03-03T23:54:00.937" Score="5" ViewCount="364" Body="&lt;p&gt;We're about to purchase a pair of Cisco 7201s for our edge routers, and some Juniper EX4200s for core. And I'm looking for implement bandwidth accounting for our hosted servers on this hardware (most likely the 7201s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that RADIUS is typically used for bandwidth accounting for tails, but what's typically used to track data use of customer servers, in terms of GB / month? Currently each customer is assigned their own VLAN for all servers, so for billing purposes per VLAN counters would suffice. Though, for informational purposes, would probably want per-IP counters so that we can show BW per server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm coming from an environment where we currently use a Linux router on a stick. Right now, I've configured IPTables to store counters based on src/dst IP addresses per customer, and put together a perl script to collect those counters every 5 minutes. The data are then parsed and then stored in a database. This works well, and my tests have shown it to be accurate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently our edge transit is &amp;lt; 50 Mbps, but I'm looking to scale to around 300 Mbps, so I'd want to ensure I can implement this without overloading the routers (as we'll using them for a fair bit - LNS, MPLS, Static NAT, 10~ Mbps AES IPSec).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I be looking at NetFlow to accomplish, or perhaps port mirroring, or something else entirely?&lt;/p&gt;&#xA;" OwnerUserId="846" LastEditorUserId="775" LastEditDate="2014-03-05T11:05:33.153" LastActivityDate="2014-03-05T11:05:33.153" Title="Mechanisn for performing bandwidth accounting on Cisco routers" Tags="|cisco|bandwidth|netflow|accounting|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6622" PostTypeId="1" AcceptedAnswerId="6628" CreationDate="2014-03-04T08:43:47.050" Score="14" ViewCount="52208" Body="&lt;p&gt;I always get confused about security association lifetime configuration on Cisco IOS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On most web-managed hardware it is clear which SA lifetime is for Phase I and which is for Phase II. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco however you got this &lt;code&gt;crypto isakmp policy &amp;lt;NUM&amp;gt;&lt;/code&gt; section where you specify SA lifetime as &lt;code&gt;lifetime &amp;lt;NUM&amp;gt;&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also have to set SA lifetime in &lt;code&gt;crypto map &amp;lt;NAME&amp;gt; &amp;lt;NUM&amp;gt; IPsec-isakmp&lt;/code&gt; section like &lt;code&gt;set security-association lifetime seconds &amp;lt;NUM&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you, guys, enlighten me please and end my confusion at last, please? Which one is Phase I and which one is Phase II?&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="3191" LastEditDate="2014-12-08T20:18:54.247" LastActivityDate="2014-12-08T20:18:54.247" Title="Getting Cisco ISAKMP and IPSec SA lifetime confused" Tags="|vpn|ipsec|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6623" PostTypeId="2" ParentId="6620" CreationDate="2014-03-04T09:40:08.363" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Should I be looking at NetFlow to accomplish, or perhaps port mirroring, or something else entirely?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/NetFlow&quot; rel=&quot;noreferrer&quot;&gt;NetFlow&lt;/a&gt; is certainly the most common for this type of bandwidth accounting.  That’s exactly what it was designed to do.  It will give you an accurate view on what an interface is doing, which is why it’s most ideal at the boundary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port-mirroring isn’t something I would use for customer traffic accounting.  I implemented something with port-mirroring a while back because we removed our &lt;a href=&quot;http://www.netscout.com/products/enterprise/ngenius_data_sources/Pages/nGenius_InfiniStream_Appliances.aspx&quot; rel=&quot;noreferrer&quot;&gt;InfiniStreams&lt;/a&gt; and wanted to retain that functionality, and I found that it’s only good if you want to do full packet capture (FPC) just to have it in case you’re having issues external to your site.  If you intend on scaling to 300Mbps, you’ll need a pretty elegant setup that’s capable of sustaining writes up to 300Mbps, sufficient storage, and enough CPU/RAM that can make sense of all of that data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you absolutely must go with a SPAN style solution, I would, at a minimum, just log the first few bytes of each packet to keep server utilization down.  If you don't &lt;strong&gt;need&lt;/strong&gt; FPC, then don't implement FPC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My setup has been turned into a &lt;em&gt;‘Forensics Tractability Server’&lt;/em&gt;, or more realistically, a traffic dump location in case someone with malicious intent decides to break in.  If the Feds come asking &lt;em&gt;&quot;who/what/where/when/how/why&quot;&lt;/em&gt;, I’ll be in a position to answer (...sort of).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for analytics, just get hooked up with some open-source tools that can visualize NetFlow data.  &lt;a href=&quot;http://www.ntop.org/&quot; rel=&quot;noreferrer&quot;&gt;Ntop&lt;/a&gt;/&lt;a href=&quot;http://www.ntop.org/products/ntop/&quot; rel=&quot;noreferrer&quot;&gt;ntopng&lt;/a&gt;&lt;sup&gt;1&lt;/sup&gt; is the first thing that comes to mind as an all-in-one solution, but there are tons out there.  Wikipedia has a &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_traffic_measurement#Some_available_tools&quot; rel=&quot;noreferrer&quot;&gt;small listing&lt;/a&gt; of some of the bigger names (most free/open-source).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm coming from an environment where we currently use a Linux router on a stick. Right now, I've configured IPTables to store counters based on src/dst IP addresses per customer, and put together a perl script to collect those counters every 5 minutes. The data are then parsed and then stored in a database.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your Linux-foo is commendable. Unfortunately, this isn’t the most ideal solution, as you can probably tell, and pigeon-holes you into continuously developing your own applications.  You’re obviously on the right track; you’ve come here to figure out a more scalable solution. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt;&lt;sub&gt;Although ntop is still available in every Linux repo, development has ceased and continued with ntopng.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-03-04T09:40:08.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6625" PostTypeId="1" AcceptedAnswerId="6626" CreationDate="2014-03-04T12:38:58.930" Score="6" ViewCount="3923" Body="&lt;p&gt;I see the object description of &lt;strong&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ipNetToMediaPhysAddress&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot; rel=&quot;noreferrer&quot;&gt;ipNetToMediaPhysAddress&lt;/a&gt;&lt;/strong&gt; from ipNetToMediaTable as the &lt;strong&gt;&quot;The media-dependent `physical' address&quot;&lt;/strong&gt;. Putting it simple, does it mean it returns the MAC addresses of all the directly connected nodes/devices?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For example,&#xA;&lt;strong&gt;snmpbulkwalk  -v 2c -c public 10.21.200.201 1.3.6.1.2.1.4.22.1.2&lt;/strong&gt;&#xA;Polling this OID (1.3.6.1.2.1.4.22.1.2) on a L3 switch-(Ip:10.21.200.201) (Brocade FastIron Sx 800) returns me approximately 1800 entries which is a mixture of both &lt;strong&gt;L2/L3 devices&lt;/strong&gt; and &lt;strong&gt;some PCs&lt;/strong&gt;. But polling the same OID on an &lt;strong&gt;L2 switch&lt;/strong&gt; returns me only four entries: 2 broadcast entries,the previous L3 switch's MAC address and the L2 switch's self MAC address. There are PCs attached to this L2 switch(DLINK DES 3526 model). &lt;strong&gt;Why can't I see MAC addresses of the attached PCs on polling the OID for the above switch?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also can someone throw light on the fine differences between the MAC addresses learned from &lt;strong&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot; rel=&quot;noreferrer&quot;&gt;dot1qTpFdbPort&lt;/a&gt;&lt;/strong&gt; and  &lt;strong&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ipNetToMediaPhysAddress&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot; rel=&quot;noreferrer&quot;&gt;ipNetToMediaPhysAddress&lt;/a&gt;&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="4094" LastEditorUserId="775" LastEditDate="2014-03-04T14:12:14.750" LastActivityDate="2014-03-04T14:23:21.527" Title="What is the difference between ipNetToMediaPhysAddress and dot1qTpFdbPort?" Tags="|switch|snmp|management|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6626" PostTypeId="2" ParentId="6625" CreationDate="2014-03-04T12:54:12.170" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why can't I see MAC addresses of the attached PCs on polling the OID for the above switch?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you poll &lt;code&gt;1.3.6.1.2.1.4.22.1.2&lt;/code&gt;, you're polling &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ipNetToMediaPhysAddress&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;ipNetToMediaPhysAddress&lt;/a&gt;, which is the ARP table of the switch.  Pure Layer2 switches do not have a large ARP table because they are merely switching instead of routing.  Switching does &lt;em&gt;not&lt;/em&gt; require an ARP table.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also can someone throw light on the fine differences between the MAC addresses learned from dot1qTpFdbPort and ipNetToMediaPhysAddress?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;dot1qTpFdbPort&lt;/a&gt; maps the Layer2 mac-address recently learned by the switch to a physical port on the switch.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ipNetToMediaPhysAddress&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;ipNetToMediaPhysAddress&lt;/a&gt; polls the ARP table of something.  The only things that show up in the ARP table are things which had recent, direct IP-layer communication with the thing being polled.  IP-layer communication occurs when packets are routed, or for instance if you ssh directly to a Layer2 switch's management IP.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you poll &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ipNetToMediaPhysAddress&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;ipNetToMediaPhysAddress&lt;/a&gt; on a &lt;em&gt;router&lt;/em&gt; attached to the Brocade / DLink Layer2 switches, you will see the same &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;dot1qTpFdbPort&lt;/a&gt; mac-addresses from the Layer2 switches in that router's ARP table (assuming you did a recent ping sweep of the relevant subnets through the router in question).  Also note that if VRRP / HSRP / GLBP are used on the subnet, you should poll &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ipNetToMediaPhysAddress&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;ipNetToMediaPhysAddress&lt;/a&gt; both &lt;a href=&quot;http://en.wikipedia.org/wiki/First_Hop_Redundancy_Protocols&quot;&gt;FHRP&lt;/a&gt; peers, due to potential asymmetric routing.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;ARP / Mac Polling Technique&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I have to do a lot of polling like this where I map mac addresses / ports found in &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;dot1qTpFdbPort&lt;/a&gt; to IP addresses from &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=ipNetToMediaPhysAddress&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;ipNetToMediaPhysAddress&lt;/a&gt;.  I always ping sweep (with a tool like &lt;a href=&quot;http://nmap.org/&quot;&gt;&lt;code&gt;nmap&lt;/code&gt;&lt;/a&gt;... &lt;code&gt;nmap -sP 192.0.2.0/24&lt;/code&gt;) through the subnet just before I poll the router / downstream switches with snmp.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;[Edit Questions in Comments]&lt;/h3&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So polling the dot1qTpFdbPort on an L2 switch guarantees that the resulting MAC addresses/ports are the ones directly connected to the L2 switch?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not quite true... polling &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;dot1qTpFdbPort&lt;/a&gt; guarantees that these are the mac addresses learned by the switch, or statically configured on the switch. A few notable exceptions to your statement:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you chain Layer2 switches together (including most &lt;a href=&quot;http://en.wikipedia.org/wiki/First_Hop_Redundancy_Protocols&quot;&gt;FHRP&lt;/a&gt; topologies), you'll see mac addresses learned from downstream switches.  By definition, macs learned from downstream switches are not directly connected.  If you have Cisco switces, &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.23.1.2.1&quot;&gt;cdpCacheTable&lt;/a&gt; is very useful for untangling relationships between switches.&lt;/li&gt;&#xA;&lt;li&gt;Some mac-addresses in &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;dot1qTpFdbPort&lt;/a&gt; could be owned by the switch itself, instead of being directly connected to it.&lt;/li&gt;&#xA;&lt;li&gt;If you have LACP aggregates in your topology, the vendor might do things like associate mac-addresses with a physical port in that LACP aggregate, instead of learning the mac through the LACP aggregate.  Somewhere in the standards I saw discussion about this, but I can't remember where offhand.&lt;/li&gt;&#xA;&lt;li&gt;Some switches have vendor-specific features (often they are security features) which completely remove visibility of mac-addresses from &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;dot1qTpFdbPort&lt;/a&gt;.  YMMV&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All the above means you cannot 100% guarantee that the mac returned by &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot;&gt;dot1qTpFdbPort&lt;/a&gt; is &lt;em&gt;directly connected&lt;/em&gt; to the switch.  If you take care of these kind of issues in your code, then you shouldn't have problems.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PS: I haven't tried ICMP sweep (ping sweep).Is it really necessary to do ping sweep so as to obtain the complete topology of the network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ping sweeps mitigate these two issues:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switch mac-table aging timers vary, but they can be quite low (i.e. 5 minutes).  It's not uncommon to see mismatched router ARP and switch mac table timers in a network.  Sometimes the ARP and switch mac tables get out of sync.  You stand the best chance of matching switch mac table to router ARP table if you ping sweep just before your polls.&lt;/li&gt;&#xA;&lt;li&gt;Some end-points may only receive unidirectional traffic (i.e. a multicast stream).  If someone is passively watching or listening to a unidirectional stream, their PC might not refresh the switch mac-address table very often.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-03-04T14:23:21.527" LastActivityDate="2014-03-04T14:23:21.527" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6628" PostTypeId="2" ParentId="6622" CreationDate="2014-03-04T13:43:51.937" Score="17" Body="&lt;p&gt;I have been confused by this in the past, so I've tried to break it out for you below.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Phase I Lifetime:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Phase I lifetime on Cisco IOS routers is managed by the global ISAKMP Policy.  However this is not a mandatory field, if you do not enter a value, the router will default to 86400 seconds.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto isakmp policy 1&#xA;  lifetime &amp;lt;value&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To verify the lifetime of a specific policy, you can issue the command &lt;code&gt;show crypto isakmp policy&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TEST-1861#show crypto isakmp policy&#xA;&#xA;Global IKE policy&#xA;Protection suite of priority 1&#xA;        encryption algorithm:   AES - Advanced Encryption Standard (256 bit keys).&#xA;        hash algorithm:         Secure Hash Standard&#xA;        authentication method:  Pre-Shared Key&#xA;        Diffie-Hellman group:   #5 (1536 bit)&#xA;        lifetime:               86400 seconds, no volume limit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Per Cisco in regards to that show command, (this is only for the isakmp lifetime): &quot;Note that although the output shows &quot;no volume limit&quot; for the lifetimes, you can configure only a time lifetime (such as 86,400 seconds); volume-limit lifetimes are not configurable&quot;.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Phase II Lifetime:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Phase II Lifetime can be managed on a Cisco IOS router in two ways: globally &lt;strong&gt;or&lt;/strong&gt; locally on the crypto map itself.  As with the ISAKMP lifetime, neither of these are mandatory fields.  If you do not configure them, the router defaults the IPSec lifetime to 4608000 kilobytes/3600 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Global configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec security-association lifetime [seconds|kilobytes] &amp;lt;value&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This changes the setting for all IPSec SAs on that router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To verify the global IPSec lifetime, issue the &lt;code&gt;show crypto ipsec security-association lifetime&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TEST-1861#show crypto ipsec security-association lifetime&#xA;Security association lifetime: 4608000 kilobytes/3600 seconds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Crypto Map configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to change the IPSec lifetime for one connection, but not for all others on the router, you can configure the lifetime on the Crypto Map entry:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto map &amp;lt;map-name&amp;gt; &amp;lt;sequence-number&amp;gt; ipsec-isakmp&#xA;  set security-association lifetime [seconds|kilobytes] &amp;lt;value&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To verify this individual Crypto Map lifetime value, use the &lt;code&gt;show cyrpto map&lt;/code&gt; command (output sniped for clarity):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TEST-1861#show crypto map &#xA;Crypto Map &quot;test-map&quot; 1 ipsec-isakmp&#xA;        Peer = 67.221.X.X&#xA;        Extended IP access list Crypto-list&#xA;            access-list Crypto-list permit ip 172.20.0.0 0.0.0.255 10.0.0.0 0.255.255.255&#xA;            access-list Crypto-list permit ip 172.20.0.0 0.0.0.255 192.168.0.0 0.0.255.255&#xA;        Current peer: 67.221.X.X&#xA;        Security association lifetime: 4608000 kilobytes/3600 seconds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;(If you want more info, the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfipsec.html&quot;&gt;Cisco IOS Security Configuration Guide&lt;/a&gt;, specifically the sections on &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfipsec.html&quot;&gt;Configuring IPSec Network Security&lt;/a&gt; and &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfike.html&quot;&gt;Configuring Internet Key Exchange Security Protocol&lt;/a&gt;, go into more detail on the relevant commands.)&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2014-03-04T13:51:23.607" LastActivityDate="2014-03-04T13:51:23.607" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6631" PostTypeId="1" AcceptedAnswerId="6633" CreationDate="2014-03-04T15:21:43.290" Score="6" ViewCount="4054" Body="&lt;p&gt;Let's suppose we have a line like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication login default group radius group tacacs+ local &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;According to the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfathen.html#wp1000924&quot; rel=&quot;noreferrer&quot;&gt;IOS 12.2 documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If R1 authenticates the user, it issues a PASS response to the network access server and the user is allowed to access the network. If R1 returns a FAIL response, the user is denied access and the session is terminated. &lt;strong&gt;If R1 does not respond&lt;/strong&gt;, then the network access server processes that as an &lt;strong&gt;ERROR&lt;/strong&gt; and queries R2 for authentication information&lt;/p&gt;&#xA;&lt;p&gt;It is important to remember that a FAIL response is significantly different from an ERROR. A FAIL means that the user has not met the criteria contained in the applicable authentication database to be successfully authenticated. Authentication ends with a FAIL response. An ERROR means that the security server has not responded to an authentication query. Because of this, no authentication has been attempted. Only when an ERROR is detected will AAA select the next authentication method defined in the authentication method list.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;My question is: How does a Cisco device exactly perform the check on an authentication server? Is it possible to modify/extend this method?&lt;/p&gt;&#xA;&lt;p&gt;The motivation behind this question is to ensure that the reachability creteria meet some specific L7 methods rather than L3/L4.&lt;/p&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-03-04T17:41:34.697" Title="How does Cisco perform authentication server reachability on aaa?" Tags="|aaa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6632" PostTypeId="1" AcceptedAnswerId="6635" CreationDate="2014-03-04T16:07:31.923" Score="9" ViewCount="8773" Body="&lt;p&gt;We have an old Cisco 850 Series router hanging around here and happen to have a need for it temporarily until we get our new Palo-Alto into place.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, after I reset it and try to pull up the configuration page at &lt;code&gt;10.10.10.1&lt;/code&gt; as you would normally in order to configure it, I run into a few problems.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The configurator does not recognize Internet Explorer 11 as even being Internet Explorer at all - thinks it is Netscape.  So I am forced to use an older version or Firefox (preferabal anyway, I'm just mentioning the issue)&lt;/li&gt;&#xA;&lt;li&gt;The configuratior allows you to sign into the web page, and then launches Java where you sign in a second time.  After that it just stops working.  I've tried this in several browsers old and new.  I still have to try downgrading Java (&lt;a href=&quot;http://www.dslreports.com/forum/r22054550-&quot; rel=&quot;nofollow&quot;&gt;as proposed here&lt;/a&gt;) and seeing if I can get into it that way.  Apparently, this is the usual case with Cisco - check out &lt;a href=&quot;http://www.dslreports.com/forum/r22256671-&quot; rel=&quot;nofollow&quot;&gt;this quote&lt;/a&gt;:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Just a silly anecdote...Cisco has a terrible history of causing a&#xA;  necessity for old JREs and it makes it almost impossible to manage&#xA;  several different pieces of equipment at different software versions.&#xA;  They really need to work on this.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It looks like JRE 6 update 11 may do for that (only x86; the x64 isn't reported to work).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Okay, so, even if I can get the configurator running, I don't want to have to normally run an ancient version of Java just to access the router config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I can get into the router config once, is there a way to get this router running with some firmware that doesn't depend on Java?  I've flashed TP-Links with DD-WRT successfully, but DD-WRT doesn't seem to run on a Cisco 850.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[conclusions]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although I have marked an answer for this question, I just wanted to share some of my final thoughts, just in case it helps anyone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We ended up configuring the router via console cable + Putty.  This allowed us to do the work without worrying about SDM or Java at all.  And my plan is to be able to remotely administer the router via SSH (again through Putty, or a lovely tabbed application called &lt;a href=&quot;http://www.mremoteng.org/home&quot; rel=&quot;nofollow&quot;&gt;mRemoteNG&lt;/a&gt;), again avoiding the Java issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I also found another nice little tidbit.  I have an old Dell running Windows XP laying around that has a console port.  I decided to keep it just for configuring devices.  It also has Windows 7.  I also found the old Cisco disc that came with the router and it allowed me to install SDM on the computer itself, and also installed Java 5.  With that, now I have access to the router via console, SSH as well as SDM all on a machine which never needs to be updated. So I can just plug in this box and not have to worry about messing with the configuration of my regular workstation.&lt;/p&gt;&#xA;" OwnerUserId="4453" LastEditorUserId="4453" LastEditDate="2014-03-06T16:48:58.020" LastActivityDate="2014-03-06T16:48:58.020" Title="Cisco Router config alternatives to Cisco SDM (i.e. no Java required)" Tags="|cisco|router|management|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6633" PostTypeId="2" ParentId="6631" CreationDate="2014-03-04T16:16:04.153" Score="6" Body="&lt;p&gt;The router sends the initial request, and simply waits for a well-formed answer from the Radius/TACACS server.  There are no active &quot;keepalive&quot; style health checks; the router doesn't ping the server and look at response-times or anything like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What the router does next, depends on your configured criteria.  In general, once the timeout expires (default is 5 seconds), or if a malformed response is received, the router will try the secondary server or fail down to the next configured authentication method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Radius, unlike TACACS, can also mark a server as &quot;dead&quot; and cease to try authentications against it for a preconfigured amount of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the following settings to tweak this behavior:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Timeout Configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TEST-1861(config)#tacacs-server timeout ?&#xA;  &amp;lt;1-1000&amp;gt;  Wait time (default 5 seconds)&#xA;&#xA;TEST-1861(config)#radius-server timeout ?&#xA;  &amp;lt;1-1000&amp;gt;  Wait time (default 5 seconds)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Radius Dead-timer configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TEST-1861(config)#radius-server deadtime ?&#xA;  &amp;lt;1-1440&amp;gt;  time in minutes&#xA;&#xA;TEST-1861(config)#radius-server dead-criteria ?&#xA;  time   The time during which no properly formed &#xA;         response must be recieved from the RADIUS server&#xA;  tries  The number of times the router must fail &#xA;         to receive a response from the radius server&#xA;         to mark it as dead&#xA;&#xA;TEST-1861(config)#radius-server dead-criteria time ?&#xA;  &amp;lt;1-120&amp;gt;  Time in seconds during which no response must&#xA;  be received from the RADIUS server in order to consider it dead&#xA;&#xA;TEST-1861(config)#radius-server dead-criteria tries ?&#xA;  &amp;lt;1-100&amp;gt;  Number of transmits to radius server without &#xA;  responses before marking server as dead&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2014-03-04T17:41:34.697" LastActivityDate="2014-03-04T17:41:34.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6635" PostTypeId="2" ParentId="6632" CreationDate="2014-03-04T16:32:07.363" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The configuratior allows you to sign into the web page, and then launches Java where you sign in a second time. After that it just stops working.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you're running into java problems, it sounds like you're trying to use &lt;a href=&quot;http://www.cisco.com/c/en/us/products/cloud-systems-management/router-security-device-manager/index.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco SDM&lt;/a&gt; to manage your Cisco 850.  &lt;a href=&quot;http://www.cisco.com/c/en/us/products/cloud-systems-management/router-security-device-manager/index.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco SDM&lt;/a&gt; is EOL, and you should use &lt;a href=&quot;http://www.cisco.com/c/en/us/products/cloud-systems-management/configuration-professional/index.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco Configuration Professional&lt;/a&gt; instead of SDM.  &lt;a href=&quot;http://www.cisco.com/c/en/us/products/cloud-systems-management/configuration-professional/index.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco Configuration Professional&lt;/a&gt; &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_configuration_professional_express/v2_7/rlsnts/ccp_express_rel_notes.html#wp300705&quot; rel=&quot;noreferrer&quot;&gt;supports the 850 series routers&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If I can get into the router config once, is there a way to get this router running with some firmware that doesn't depend on Java? I've flashed TP-Links with DD-WRT successfully, but DD-WRT doesn't seem to run on a Cisco 850.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're in luck!  You don't need Java to access a Cisco router.  All you need is telnet or  a &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/7000-series-routers/12223-14.html#topic15&quot; rel=&quot;noreferrer&quot;&gt;serial cable&lt;/a&gt;... they commonly look like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nS7XA.jpg&quot; alt=&quot;cisco serial cable&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You could try to telnet to the router's IP address, although that depends on whether someone previously had telnet configured on the router.&lt;/li&gt;&#xA;&lt;li&gt;If you can telnet to the router, but don't know the password, then you'll have to perform &lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/access/800/850/software/configuration/guide/trouble.html#wp1038210&quot; rel=&quot;noreferrer&quot;&gt;password recovery&lt;/a&gt;; this is a handy mapping of &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/10000-series-routers/12818-61.html?referring_site=bodynav&quot; rel=&quot;noreferrer&quot;&gt;break sequences&lt;/a&gt; for various serial terminal emulators.  This method is also useful if you can't telnet to the router.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-03-04T16:32:07.363" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6636" PostTypeId="1" AcceptedAnswerId="6637" CreationDate="2014-03-04T16:58:14.727" Score="9" ViewCount="634" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5pzAJ.png&quot; alt=&quot;T1 Failover Network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have inherited a small, insular, dedicated network which is essentially trouble-free, so naturally I want to improve it :-)  I lowered my network knowledge and savvy to somewhere around a 2 to 3 on a scale of 1-10 after reading networking posts here. I have only included the pertinent routers in my diagram for clarity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently there's a mix of roughly 6-8 Cisco 2800 and 2900 at each campus with voice cards for a dedicated homegrown application, using static routes to get packets between the 2 campuses. They are running c2801-spservicesk9-mz.124-3g on R1 and R2, and c2800nm-adventerprisek9-mz.124-15.t3 on R3 and R4. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a fixed, unchanging network that serves only this dedicated application. No desktops nor laptops coming and going, just the Cisco routers connected via third party fiber muxes in a ring topology on each campus with a couple server machines connected (part of the &quot;other nodes&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometime along the way the customer decided it would be a great idea to install a second T1 between R2 and R3 for redundancy. Based on my tests the static routing has no way of employing that second T1. Even with AD/metric on a secondary route to the new T1 only the router whose T1 has failed knows this, but the other routers on that campus do not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was considering using ip tracking objects after reading such solutions here to keep things simple and minimize upset to the network. Then I read where EIGRP is the preferred way to handle this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if dynamic routing is the way to go it must be implemented in a way that does not disrupt service. This is all remote to me and would require me to arrange a local technician to be standing by in case I lose connectivity during reconfiguration. Hopefully with such a small, unchanging network this disruption could be minimized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So should I be researching how to employ ip tracking objects or EIGRP to accomplish this T1 failover routing? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Here are the currently configured routes for R4. I'm pretty confident that there is some cruft here, but I tried exactly one time to simplify it and backed off when I made one tiny mistake and lost connectivity to Campus B. Outages are a big no-no. I decided to leave well enough alone until I devised a better approach.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.0.0.0 255.0.0.0 10.1.1.8&#xA;ip route 10.1.1.8 255.255.255.252 Serial0/3/0&#xA;ip route 192.168.30.0 255.255.255.0 Serial0/3/0&#xA;ip route 192.168.6.0 255.255.255.0 Serial0/3/0&#xA;ip route 192.168.8.0 255.255.255.0 FastEthernet0/0&#xA;ip route 10.0.2.128 255.255.255.192 192.168.31.2&#xA;ip route 10.2.160.0 255.255.255.0 192.168.31.2&#xA;ip route 192.168.254.0 255.255.255.0 192.168.31.2&#xA;ip route 192.168.6.0 255.255.255.0 192.168.8.11 110 name fallback&#xA;ip route 0.0.0.0 0.0.0.0 10.1.1.9&#xA;ip route 0.0.0.0 0.0.0.0 192.168.8.11 110 name fallback&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The route configuration for R3 is simple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.8.15&#xA;ip route 0.0.0.0 0.0.0.0 10.1.1.5 110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="4569" LastEditorUserId="4569" LastEditDate="2014-03-04T17:08:32.460" LastActivityDate="2014-03-04T18:05:20.683" Title="How to provide failover for space-diversity T1" Tags="|cisco|routing|failover|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6637" PostTypeId="2" ParentId="6636" CreationDate="2014-03-04T18:05:20.683" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;This is a fixed, unchanging network that serves only this dedicated application.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think you’re finding that this is rarely the norm with networking, even with unchanging networks; hence, why you’re here asking how to automate this.  Eventually, another link comes online that requires you to reengineer all of your previous efforts.  This is, by definition, what the purpose of a routing protocol is.  It’s to make sure you don’t have to use static routes everywhere!&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Based on my tests the static routing has no way of employing that second T1.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can setup a sort of &lt;a href=&quot;http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-ip-service-level-agreements-slas/index.html&quot;&gt;IP SLA&lt;/a&gt; that can keep your system running how it is while still allowing for failover in case your &lt;code&gt;Old T1&lt;/code&gt; goes down. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of this type of configuration for R4 would be something like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4(config)# ip sla 1&#xA;R4(config)# icmp-echo 10.1.1.9 source-interface Serial0/3/0&#xA;R4(config)# timeout 1000&#xA;R4(config)# threshold 2&#xA;R4(config)# frequency 3&#xA;R4(config)# ip sla schedule 1 life forever start-time now&#xA;R4(config)# track 1 ip sla 1 reachability&#xA;R4(config)# ip route 0.0.0.0 0.0.0.0 10.1.1.9 track 1&#xA;R4(config)# ip route 0.0.0.0 0.0.0.0 192.168.8.11 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;&lt;em&gt;modified version of &lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/813-cisco-router-ipsla-basic.html&quot;&gt;firewall.cx&lt;/a&gt; sample configuration.&lt;/em&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, as you’re quickly finding out, is the less than ideal way of doing this.  Automating this with EIGRP is probably your best bet since you have all Cisco hardware.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But if dynamic routing is the way to go it must be implemented in a way that does not disrupt service. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you setup EIGRP in conjunction with your static routes. EIGRP neighbor relationships will be built and your routing tables will be populated with routes to the different locations.  No outage should really occur, because your routers will have a fully populated routing table with knowledge of how to get to the other subnets.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just remember, once everything is setup and running smoothly with both EIGRP and static routing, your still going to use your static routes until you remove them.  Done properly, you shouldn’t even notice a blip in traffic flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compare your previous configurations with an example EIGRP configuration for R4.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4(config)#router eigrp 1&#xA;R4(config-router)#no auto-summary&#xA;R4(config-router)#network 10.1.1.8&#xA;R4(config-router)#network 192.168.8.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It’s usually &lt;strong&gt;that&lt;/strong&gt; simple for such a small network.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-03-04T18:05:20.683" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6638" PostTypeId="1" AcceptedAnswerId="6640" CreationDate="2014-03-04T21:15:17.393" Score="4" ViewCount="1083" Body="&lt;p&gt;I am trying to find out performance of my Wireless Sensor Network interms of RSSI and Throughput. I want to know whether there is any relationship between RSSI or throughput measurement with encryption? I mean will RSSI or throughput show different result if I change the encryption method or key size of the encryption I am using in this WSN?&lt;/p&gt;&#xA;" OwnerUserId="4548" LastEditorUserId="3191" LastEditDate="2014-12-08T20:22:21.587" LastActivityDate="2014-12-08T20:22:21.587" Title="Relationship between RSSI or throughput with encryption" Tags="|wireless|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6640" PostTypeId="2" ParentId="6638" CreationDate="2014-03-05T04:51:28.630" Score="2" Body="&lt;p&gt;RSSI is a measure of relative signal strength at the receiver.  The transmitter power does not change with the encryption method, so RSSI should not change. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Virtually all Wifi devices manufactured in the last several years employ hardware encryption, so there's no throughput impact, assuming you're using WEP, WPA or WPA2.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;RSSI and throughout are related, in the sense that low RSSI values mean low signal levels, which in turn increase transmission errors and therefore retransmits, that lower overall throughput.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-03-05T05:07:58.983" LastActivityDate="2014-03-05T05:07:58.983" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6649" PostTypeId="2" ParentId="6632" CreationDate="2014-03-05T15:51:51.573" Score="2" Body="&lt;p&gt;I've answered a similar question here: &lt;a href=&quot;https://security.stackexchange.com/questions/52724/cisco-asa5505-asdm-access-issues/52725#52725&quot;&gt;https://security.stackexchange.com/questions/52724/cisco-asa5505-asdm-access-issues/52725#52725&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The problem you're describing lies with the Java settings of your&#xA;  Windows machine, not the ASA appliance. Change the Java security&#xA;  permissions (under Configure Java &gt; Security) and make an exception to&#xA;  the IP address of the ASA port which was configured to accept the&#xA;  HTTPS connections from the ASDM. Assign a static address to the&#xA;  Windows machine - don't use DHCP - and allow it to access the ASA.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Although the answer referred here was regarding an ASA 55xx appliance (not a newer NGFW), the answer may still be applicable to your device.&lt;/p&gt;&#xA;" OwnerUserId="4631" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.953" LastActivityDate="2014-03-05T15:51:51.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6650" PostTypeId="1" CreationDate="2014-03-05T16:19:27.227" Score="2" ViewCount="33" Body="&lt;p&gt;I wanted to bounce an idea off of the community regarding the security of VRFs. I am looking to deploy 3 routers with switches modules built into them at three different physical locations. These locations are maintained by a single third party who is advising their network team to create a VRF lite domain to link these routers together. My question is we are looking at having this third party use VRF to maintain a routing domain for use to link our equipment together at these 3 physical location, while utilizing their existing network routing infrastructure. From my understanding VRF will be able to do this no problem, however I am concerned with securing my data as it traverse the VRF built by the third party. What is preventing them from eaves dropping on our traffic? Should I be IPSEC'ing the traffic on each of my 3 routers &quot;VRF&quot;-edge interface? Are there any other security practices applicable to this type of scenarios?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks all!&lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2014-03-05T16:19:27.227" Title="IPSEC over VRF lite?" Tags="|routing|vpn|ipsec|vrf-lite|" AnswerCount="0" CommentCount="0" ClosedDate="2014-03-05T17:44:00.240" ContentLicense="CC BY-SA 3.0" />
  <row Id="6651" PostTypeId="1" CreationDate="2014-03-05T16:23:28.170" Score="3" ViewCount="1946" Body="&lt;p&gt;I have set up a VPN between my company and a customer. Packet captures show that the customer receives a packet and then sends an ACK back as it hits our internet firewall, this is as far as the connection will go. The process then repeats itself a few times with the same results. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet capture shows all of this on the egress filter, is this normal? I see nothing on the ingress filter. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.10.10.10.56638 &amp;gt; 56.132.112.29.3205: S 74549533:74549533(0) win 5840 &amp;lt;mss 1380,sackOK,timestamp 2566921403 0,nop,wscale7&amp;gt;&#xA;&#xA;56.132.112.29.3205 &amp;gt; 10.10.10.10.56638: S712870551(0) ack 74549534 win 16384 &amp;lt;mss 1380,nop,wscale 0, nop,nop,timestamp 0 0,nop,nop,sackOK&amp;gt;&#xA;&#xA;56.132.112.29.3205 &amp;gt; 10.10.10.10.56638: S712870551(0) ack 74549534 win 16384 &amp;lt;mss 1380,nop,wscale 0, nop,nop,timestamp 0 0,nop,nop,sackOK&amp;gt;&#xA;&#xA;10.10.10.10.56638 &amp;gt; 56.132.112.29.3205: S 74549533:74549533(0) win 5840 &amp;lt;mss 1380,sackOK,timestamp 2566921403 0,nop,wscale7&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I decided to capture on the next firewall and found results that I do not understand:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ingress:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.10.10.10.55640 &amp;gt; 56.132.112.29.3205: S 155629610:155629610(0) win 5840 &amp;lt;mss 1380, sackOK, timestamp 2568128672 0, nop, wscale 7&amp;gt;&#xA;&#xA;10.10.10.10.55640 &amp;gt; 56.132.112.29.3205: S 155629610:155629610(0) win 5840 &amp;lt;mss 1380, sackOK, timestamp 2568128672 0, nop, wscale 7&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;egress:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.10.10.10.55640 &amp;gt; 56.132.112.29.3205: S 3671255214:3671255214(0) win 5840 &amp;lt;mss 1460, sackOK, timestamp 2568128672 0, nop, wscale 7&amp;gt;&#xA;&#xA;10.10.10.10.55640 &amp;gt; 56.132.112.29.3205: S 3671255214:3671255214(0) win 5840 &amp;lt;mss 1460, sackOK, timestamp 2568128672 0, nop, wscale 7&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So of course the egress is fine, these are the packets leaving our network to the internet firewall. What does the ingress filter mean? To me it says that a packet has arrived at my internetdmz and matches the packet that left with regards to the source and destination IP. This does not make sense to me. Can anyone explain why this is?&lt;/p&gt;&#xA;" OwnerUserId="4632" LastActivityDate="2015-02-17T02:39:19.970" Title="VPN cisco ASA tcp connection issue -pcap inside" Tags="|cisco|cisco-asa|tcp|packet-analysis|" AnswerCount="2" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6652" PostTypeId="2" ParentId="6638" CreationDate="2014-03-05T18:32:21.333" Score="2" Body="&lt;p&gt;Encryption with RSN adds a overhead of ~16 bytes per frame.  This is negligible in a ~1500 byte frame, and is even more negligible considering that with current 802.11 modulations, the coordination function (CSMA/CA) becomes a major overhead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most encryption is done in hardware directly on the wireless module (most CPU would have trouble running AES at 300 mbps) so enabling encryption should have no other bottleneck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, enabling WEP disables 802.11n, so reduces the throughput.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2014-03-05T18:32:21.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6655" PostTypeId="1" AcceptedAnswerId="10302" CreationDate="2014-03-05T19:49:21.233" Score="4" ViewCount="2148" Body="&lt;p&gt;tell me please how to translate the following Screenos  to Junos...&#xA;Do I understand correctly that the path to route 80.70.128.142/32 is via vrouter &quot;UntrustGi-vr&quot;  ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Screenos command:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vrouter &quot;trust-vr&quot;&#xA;set route 80.70.128.142/32 vrouter &quot;UntrustGi-vr&quot; preference 20 metric 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;my Junos attempt:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe such interpretation in Junos???&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-instances trust-vr instance-type virtual-router&#xA;&#xA;set routing-instances trust-vr routing options static route 80.70.128.142/32 next-table UntrustGi-vr.inet.0 preference 20 metric 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4635" LastEditorUserId="4635" LastEditDate="2014-03-07T15:17:43.067" LastActivityDate="2014-08-05T10:14:47.997" Title="Screen to Junos &quot;Set route ....&quot; command" Tags="|routing|router|juniper-junos|screenos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6658" PostTypeId="2" ParentId="6618" CreationDate="2014-03-05T21:16:38.993" Score="2" Body="&lt;p&gt;From the information you provided we can only make a wild guess...&#xA;How many users in your site?&#xA;You may want to replace the 1841 according to this &lt;a href=&quot;https://supportforums.cisco.com/thread/2014551&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/thread/2014551&lt;/a&gt;&#xA;There are tables on the Cisco website that are publicly available for sizing up better routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest replacing the 2960 with a 3750x (preferable) or 3560 switch and enable ip routing on the new switch. &#xA;Remove the 2960, then move all of your vlans, acls and management configs to the new switch.&#xA;Create a point to point between the new switch and your router, enable a routing protocol (i.e. ospf) between your router and the new switch.&#xA;Your new router can now dedicate more cpu cycles to routing ip traffic, QoS, vpn and other services you would like to enable.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2014-03-05T21:16:38.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6660" PostTypeId="1" AcceptedAnswerId="6663" CreationDate="2014-03-05T21:44:36.987" Score="2" ViewCount="10333" Body="&lt;p&gt;For Cisco routers/switches, I use the &lt;code&gt;no service conifg&lt;/code&gt; in production.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the impact for the production system if I use the &lt;code&gt;service config&lt;/code&gt; command when I have the configuration already loaded in my devices?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%Error opening tftp://255.255.255.255/cisconet.cfg (Timed out)&#xA;%Error opening tftp://255.255.255.255/cbrvbc01-tgobc02-confg (Timed out)&#xA;%Error opening tftp://255.255.255.255/cbrvbc01.cfg (Timed out)&#xA;%Error opening tftp://255.255.255.255/network-confg (Timed out)&#xA;%Error opening tftp://255.255.255.255/cisconet.cfg (Timed out)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Security? Network traffic? Others?&lt;/p&gt;&#xA;" OwnerUserId="4641" LastEditorUserId="3191" LastEditDate="2014-03-05T22:02:47.257" LastActivityDate="2014-03-05T22:13:00.913" Title="Cisco IOS: Service Config" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6663" PostTypeId="2" ParentId="6660" CreationDate="2014-03-05T22:13:00.913" Score="2" Body="&lt;p&gt;The &lt;code&gt;service config&lt;/code&gt; command is used to load configuration files on boot.  It should have no impact to your current configuration unless you reboot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's worth noting that even Cisco considers configuration autoloading an &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=99029&amp;amp;seqNum=2&quot; rel=&quot;nofollow&quot;&gt;unneeded vulnerability&lt;/a&gt;.  It's &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/command/reference/ffun_r/frf007.html#wp1017913&quot; rel=&quot;nofollow&quot;&gt;default is off&lt;/a&gt;, and probably for good reason.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-03-05T22:13:00.913" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="6664" PostTypeId="1" AcceptedAnswerId="6666" CreationDate="2014-03-05T22:18:14.337" Score="4" ViewCount="4157" Body="&lt;p&gt;I'm trying to set up a WiMAX and would like to know if I can use wifi usb's on the devices I plan to test with. If not what WiMax options are available that work via USB. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I do not plan to have connection to the internet. You can consider this a closed network of sorts.&lt;/p&gt;&#xA;" OwnerUserId="4642" LastEditorUserId="4642" LastEditDate="2014-03-05T22:27:47.137" LastActivityDate="2014-08-15T07:50:41.160" Title="Can regular wifi adapters communicate with WiMax access points?" Tags="|wireless|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6665" PostTypeId="2" ParentId="6664" CreationDate="2014-03-05T22:22:10.133" Score="6" Body="&lt;p&gt;Wifi (802.11) and WiMax (802.16) are &lt;em&gt;not&lt;/em&gt; the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Availability of WiMax USB devices will depend on the network operator.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-03-05T22:22:10.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6666" PostTypeId="2" ParentId="6664" CreationDate="2014-03-05T22:58:05.737" Score="8" Body="&lt;p&gt;802.11 wireless (WiFi) works in different frequency ranges than 802.16 (WiMax).  Generally speaking the radios in the hardware will be limited to the frequencies in use by their technology, so you can't mix the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since WiMax can operate in a number of different frequency ranges, the hardware designed to operate in one frequency range may not be able to work with equipment designed for another frequency.  Some will be able to operate in all of them, so you will need to research your hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the major differences, is that WiFi operates entirely within unlicensed areas of the RF spectrum.  Many WiMax solutions (Clear/Sprint for example) operate in licensed RF spectrum.  If the equipment is designed to operate in one of these licensed frequencies, you can only operate the equipment if you have a license to do so or are authorized to do so by a license holder as part of their service (i.e. you are paying them for service).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So even with the closed network, make sure you are not operating in any licensed spectrum to avoid potential legal issues and fines.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-03-05T23:09:19.237" LastActivityDate="2014-03-05T23:09:19.237" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6667" PostTypeId="1" AcceptedAnswerId="7393" CreationDate="2014-03-06T01:30:45.227" Score="3" ViewCount="138" Body="&lt;p&gt;I am looking in to getting a 6509 with supervisor 2 module.  I noticed that there was a fxs card avaiable and started to wonder if you had to use the unified software on a pc or if it would be possible to have the fxs card have a astrisk or other non cisco pbx handle the call processing.  I have an astrisk server handling all the digital voip traffic and was going to get a pci card to handle the few analog lines i need to incorporate eventually.  I would much prefer to be able to stick the analog card in the switch and leave the pbx vm free to switch hosts as needed for fallover and such. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been reading through the cisco site and get conflicting answers including that it does and does not support being used on ios.  Having some one who has dealt with these before would be of great assistance. &lt;/p&gt;&#xA;" OwnerUserId="4646" LastEditorUserId="4646" LastEditDate="2014-04-14T02:37:20.990" LastActivityDate="2014-04-16T02:22:53.527" Title="catalyst 6509 using fxs card to convert analog to sip for an external pbx?" Tags="|cisco-catalyst|voip|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6668" PostTypeId="2" ParentId="6664" CreationDate="2014-03-06T02:09:03.627" Score="3" Body="&lt;p&gt;As others have mentioned WiFi (802.11) and WiMAX (802.16) are different technologies and generally different devices are used to connect to networks of these types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;USB WiMAX subscriber devices are available for purchase though typically you are limited to purchasing these through channels established by your WiMAX service provider such as Clear or AT&amp;amp;T as Ricky has indicated. Purchasing through these channels is meant to ensure compatibility with the network deployed and maintained by that service provider. Note that WiMAX deployments by service providers may vary and a subscriber device meant for one provider and region may well not be able to even see the network of another provider or in a different region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a laptop equipped with an Intel half mini PCI-e WiFi adapter which also includes a USB WiMAX subscriber device on the same card (the Intel ProSet Centrino Advanced-N + WiMAX 6250 half mini PCI-e card). This WiMAX subscriber station and the Windows drivers provided by the laptop vendor for it are pre-loaded with profiles to connect to various national WiMAX service providers through some collaboration between the hardware vendor (Intel), the OEM system integrator (Dell), and the WiMAX service providers. You may be able to find a USB device that combines WiMAX and WiFi like this but I have not seen one to date.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One additional consideration for you ff you are connecting to a closed WiMAX network is to be sure to coordinate your selection of WiMAX subscriber station device, which is the WiMAX equivalent of a WiFi adapter on your computer, with your selection of WiMAX base station, which is the WiMAX equivalent of a WiFi access point, to ensure compatibility based on operational frequency and various other WiMAX network parameters.&lt;/p&gt;&#xA;" OwnerUserId="4647" LastActivityDate="2014-03-06T02:09:03.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6669" PostTypeId="1" AcceptedAnswerId="6829" CreationDate="2014-03-06T04:46:05.710" Score="10" ViewCount="2157" Body="&lt;p&gt;I'm testing several functions on emulated Cisco 7200 routers, in GNS3, prior to actual purchase.&lt;/p&gt;&#xA;&lt;p&gt;One of the functions I've been testing out is LNS functionality. I've been primarily following &lt;a href=&quot;http://ccieblog.co.uk/dsl/configuring-dsl&quot; rel=&quot;noreferrer&quot;&gt;this blog post&lt;/a&gt; in terms of my topology and configuration, though IP addresses and names have changed as I've adapted my existing topology.&lt;/p&gt;&#xA;&lt;p&gt;I'm trying to figure out why the dropouts are occurring, or at least what I more I could be looking at to diagnose the issue. Connectivity between CPE and my LNS is otherwise fine, aside from the regular disconnects.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Before I go further:&lt;/strong&gt; I should mention that I've seen random drop outs with GNS3 when the host CPU is maxed out. In this case, the CPU is high, but not entirely maxed out, and seems to be running OK. I'm still suspicious it's a GNS3 specific issue, but I'm not sure.&lt;/p&gt;&#xA;&lt;p&gt;In my topology:&lt;/p&gt;&#xA;&lt;p&gt;All routers (CPE, LAC, LNS) are:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Cisco IOS Software, 7200 Software (C7200-ADVIPSERVICESK9-M), Version 15.0(1)M, RELEASE SOFTWARE (fc2)&lt;/p&gt;&#xA;&lt;p&gt;Cisco 7206VXR (NPE400) processor (revision A) with 245760K/16384K bytes of memory.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;EDGE01&lt;/strong&gt; is my LNS.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;CPE-A&lt;/strong&gt; is the customer router.&lt;/li&gt;&#xA;&lt;li&gt;I do have my lab's upstream router acting as an LAC, but I'm not focusing on that, as I want to simulate solving the issue as I would if our LNS were in production - so I wouldn't typically have LAC logs readily available.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Everything seems to be working fine, although I have noticed that the CPE device seems to disconnect and reconnect, every few minutes. Though the timeouts are always similar, they aren't exactly the same:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;EDGE01#sh logging | inc Foreign Host Close&#xA;*Mar  6 13:34:34.000: VPDN Vi2.1 disconnect (AAA) IETF: 8/port-error &#xA; Ascend: 41/TCP Foreign Host Close&#xA;*Mar  6 13:36:40.340: VPDN Vi2.1 disconnect (AAA) IETF: 8/port-error &#xA; Ascend: 41/TCP Foreign Host Close&#xA;*Mar  6 13:39:38.107: VPDN Vi2.1 disconnect (AAA) IETF: 8/port-error &#xA; Ascend: 41/TCP Foreign Host Close&#xA;*Mar  6 13:41:33.003: VPDN Vi2.1 disconnect (AAA) IETF: 8/port-error &#xA; Ascend: 41/TCP Foreign Host Close&#xA;EDGE01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here's some log samples of what's happening. I may not be reading them correctly, but it seems like both the CPE and the LNS are saying, &amp;quot;The other guy disconnected the session, not me.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CPE Disconnecting&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;*Mar  6 13:30:35.378: Vi1 LCP: I TERMREQ [Open] id 1 len 4&#xA;*Mar  6 13:30:35.394: Vi1 IPCP: Event[DOWN] State[Open to Starting]&#xA;*Mar  6 13:30:35.394: Vi1 IPCP: Event[CLOSE] State[Starting to Initial]&#xA;*Mar  6 13:30:35.398: Vi1 LCP: O TERMACK [Open] id 1 len 4&#xA;*Mar  6 13:30:35.398: Vi1 LCP: Event[Receive TermReq] State[Open to &#xA; Stopping]&#xA;*Mar  6 13:30:35.398: Vi1 PPP DISC: Received LCP TERMREQ from peer&#xA;*Mar  6 13:30:35.402: Vi1 PPP: Phase is TERMINATING&#xA;*Mar  6 13:30:35.426: Di1 IPCP: Remove route to 172.16.2.1&#xA;*Mar  6 13:30:35.650: PPPoE 1544: I PADT  R:ca03.0fa0.0008 &#xA; L:ca0a.13a4.0008 Fa0/0&#xA;*Mar  6 13:30:35.650:  PPPoE : Shutting down client session&#xA;*Mar  6 13:30:35.650: [0]PPPoE 1544: O PADT  R:ca03.0fa0.0008 &#xA; L:ca0a.13a4.0008 Fa0/0&#xA;*Mar  6 13:30:35.650: PPPoE: Failed to add PPPoE switching subblock&#xA;*Mar  6 13:30:35.650: %DIALER-6-UNBIND: Interface Vi1 unbound from &#xA; profile Di1&#xA;*Mar  6 13:30:35.650: Vi1 PPP: Block vaccess from being freed [0x10]&#xA;*Mar  6 13:30:35.650: Vi1&#xA;CPE-A#&#xA;LCP: Event[DOWN] State[Stopping to Starting]&#xA;*Mar  6 13:30:35.650: Vi1 PPP: Unlocked by [0x10] Still Locked by [0x0]&#xA;*Mar  6 13:30:35.650: Vi1 PPP: Free previously blocked vaccess&#xA;*Mar  6 13:30:35.650: Vi1 PPP: Phase is DOWN&#xA;*Mar  6 13:30:35.654: %LINK-3-UPDOWN: Interface Virtual-Access1, changed &#xA; state to down&#xA;*Mar  6 13:30:35.658: %LINEPROTO-5-UPDOWN: Line protocol on Interface &#xA; Virtual-Access1, changed state to down&#xA;*Mar  6 13:30:35.682: PPPoE: Unexpected Event!. PPPoE switching &#xA; Subblockdestroy called&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;LNS Disconnecting&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;EDGE01#&#xA;L2X_ADJ: Vi2.1:adj notify change, event 4&#xA;L2X_ADJ: Vi2.1:midchain unstacking IP 0.0.0.0&#xA;L2X_ADJ: Vi2.1:adj notify change, event 8&#xA;*Mar  6 14:39:33.227: VPDN Vi2.1 disconnect (AAA) IETF: 8/port-error &#xA; Ascend: 41/TCP Foreign Host Close&#xA;*Mar  6 14:39:33.235: VPDN Vi2.1 vpdn shutdown session, result=2, error=6, &#xA; vendor_err=0, syslog_error_code=23, syslog_key_type=1&#xA;*Mar  6 14:39:33.243: VPDN Vi2.1 VPDN/AAA: accounting stop sent&#xA;*Mar  6 14:39:33.255: VPDN Vi2.1 Unbinding session from idb&#xA;*Mar  6 14:39:33.263: Vi2.1 VPDN: Resetting interface&#xA;L2X_ADJ: Vi2.1:midchain unstacking IP 0.0.0.0&#xA;L2X_ADJ: Vi2.1:removed ctx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;LNS Re-Connecting&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;*Mar  6 13:30:58.604: VPDN Received L2TUN socket message &amp;lt;xCRQ - Session &#xA; Incoming&amp;gt;&#xA;*Mar  6 13:30:58.608: VPDN Tnl/Sn 41793 56421 L2TUN socket session accept &#xA; requested&#xA;*Mar  6 13:30:58.612: VPDN Tnl/Sn 41793 56421 Setting up dataplane for &#xA; L2-L2, no idb&#xA;*Mar  6 13:30:58.880: VPDN Received L2TUN socket message &amp;lt;xCCN - Session &#xA; Connected&amp;gt;&#xA;*Mar  6 13:30:58.892: VPDN uid:330 VPDN session up&#xA;L2X_ADJ: Vi2.1:midchain adj reqd for ip 0.0.0.0, cid 0&#xA;L2X_ADJ: Vi2.1:midchain adj reqd for ip 0.0.0.0, cid 0&#xA;*Mar  6 13:30:59.112: VPDN uid:330 Virtual interface created for &#xA; cpe-a@isp.com&#xA;bandwidth 100000 Kbps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;CPE Re-Connecting&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;*Mar  6 13:30:55.674:  Sending PADI: Interface = FastEthernet0/0&#xA;*Mar  6 13:30:55.686: PPPoE 0: I PADO  R:ca03.0fa0.0008 L:ca0a.13a4.0008 &#xA; Fa0/0&#xA;CPE-A#&#xA;*Mar  6 13:30:57.722:  PPPOE: we've got our pado and the pado timer went off&#xA;*Mar  6 13:30:57.722: OUT PADR from PPPoE Session&#xA;*Mar  6 13:30:57.822: PPPoE 1545: I PADS  R:ca03.0fa0.0008 L:ca0a.13a4.0008&#xA; Fa0/0&#xA;*Mar  6 13:30:57.822: IN PADS from PPPoE Session&#xA;*Mar  6 13:30:57.838: %DIALER-6-BIND: Interface Vi1 bound to profile Di1&#xA;*Mar  6 13:30:57.842: PPPoE: Virtual Access interface obtained.&#xA;*Mar  6 13:30:57.842: PPPoE : encap string prepared&#xA;*Mar  6 13:30:57.842: [0]PPPoE 1545: data path set to PPPoE Client&#xA;*Mar  6 13:30:57.854: %LINK-3-UPDOWN: Interface Virtual-Access1, changed &#xA; state to up&#xA;*Mar  6 13:30:57.854: Vi1 PPP: Sending cstate UP notification&#xA;*Mar  6 13:30:57.858: Vi1 PPP: Processing CstateUp message&#xA;*Mar  6 13:30:57.906: PPP: Alloc Context [66CDB580]&#xA;*Mar  6 13:30:57.906: ppp622 PPP: Phase is ESTABLISHING&#xA;*Mar  6 13:30:57.910: Vi1 PPP: Using dialer call direction&#xA;*Mar  6 13:30:57.910: Vi1 PPP: Treating connection as a callout&#xA;*Mar  6 13:30:57.910: Vi1 PPP:&#xA;CPE-A#&#xA;Session handle[F400069A] Session id[622]&#xA;*Mar  6 13:30:57.914: Vi1 LCP: Event[OPEN] State[Initial to Starting]&#xA;*Mar  6 13:30:57.914: Vi1 PPP: No remote authentication for call-out&#xA;*Mar  6 13:30:57.918: Vi1 LCP: O CONFREQ [Starting] id 1 len 10&#xA;*Mar  6 13:30:57.918: Vi1 LCP:    MagicNumber 0x191D3E68 (0x0506191D3E68)&#xA;*Mar  6 13:30:57.922: Vi1 LCP: Event[UP] State[Starting to REQsent]&#xA;*Mar  6 13:30:58.042: Vi1 LCP: I CONFREQ [REQsent] id 1 len 18&#xA;*Mar  6 13:30:58.046: Vi1 LCP:    MRU 1492 (0x010405D4)&#xA;*Mar  6 13:30:58.046: Vi1 LCP:    AuthProto PAP (0x0304C023)&#xA;*Mar  6 13:30:58.046: Vi1 LCP:    MagicNumber 0x2686484A (0x05062686484A)&#xA;*Mar  6 13:30:58.050: Vi1 LCP: O CONFNAK [REQsent] id 1 len 8&#xA;*Mar  6 13:30:58.050: Vi1 LCP:    MRU 1500 (0x010405DC)&#xA;*Mar  6 13:30:58.050: Vi1 LCP: Event[Receive ConfReq-] State[REQsent to &#xA; REQsent]&#xA;*Mar  6 13:30:58.106: Vi1 LCP: I CONFACK [REQsent] id 1 len 10&#xA;*Mar  6 13:30:58.106: Vi1 LCP:    MagicNumber 0x191D3E68 (0x0506191D3E68)&#xA;*Mar  6&#xA;CPE-A#13:30:58.106: Vi1 LCP: Event[Receive ConfAck] State[REQsent to &#xA; ACKrcvd]&#xA;*Mar  6 13:30:58.110: Vi1 LCP: I CONFREQ [ACKrcvd] id 2 len 18&#xA;*Mar  6 13:30:58.110: Vi1 LCP:    MRU 1500 (0x010405DC)&#xA;*Mar  6 13:30:58.110: Vi1 LCP:    AuthProto PAP (0x0304C023)&#xA;*Mar  6 13:30:58.110: Vi1 LCP:    MagicNumber 0x2686484A (0x05062686484A)&#xA;*Mar  6 13:30:58.114: Vi1 LCP: O CONFACK [ACKrcvd] id 2 len 18&#xA;*Mar  6 13:30:58.114: Vi1 LCP:    MRU 1500 (0x010405DC)&#xA;*Mar  6 13:30:58.114: Vi1 LCP:    AuthProto PAP (0x0304C023)&#xA;*Mar  6 13:30:58.114: Vi1 LCP:    MagicNumber 0x2686484A (0x05062686484A)&#xA;*Mar  6 13:30:58.118: Vi1 LCP: Event[Receive ConfReq+] State[ACKrcvd to &#xA; Open]&#xA;*Mar  6 13:30:58.122: Vi1 PPP: No authorization without authentication&#xA;*Mar  6 13:30:58.126: Vi1 PPP: Phase is AUTHENTICATING, by the peer&#xA;*Mar  6 13:30:58.126: Vi1 PAP: Using hostname from interface PAP&#xA;*Mar  6 13:30:58.126: Vi1 PAP: Using password from interface PAP&#xA;*Mar  6 13:30:58.126: Vi1 PAP: O AUTH-REQ id 1 len 26 from&#xA;CPE-A# &amp;quot;cpe-a@isp.com&amp;quot;&#xA;*Mar  6 13:30:58.130: Vi1 LCP: State is Open&#xA;*Mar  6 13:30:59.390: Vi1 PAP: I AUTH-ACK id 1 len 5&#xA;*Mar  6 13:30:59.394: Vi1 PPP: Phase is FORWARDING, Attempting Forward&#xA;*Mar  6 13:30:59.394: Vi1 PPP: Queue IPCP code[1] id[1]&#xA;*Mar  6 13:30:59.422: Vi1 PPP: Phase is ESTABLISHING, Finish LCP&#xA;*Mar  6 13:30:59.426: Vi1 PPP: Phase is UP&#xA;*Mar  6 13:30:59.426: Vi1 IPCP: Protocol configured, start CP. &#xA; state[Initial]&#xA;*Mar  6 13:30:59.426: Vi1 IPCP: Event[OPEN] State[Initial to Starting]&#xA;*Mar  6 13:30:59.430: Vi1 IPCP: O CONFREQ [Starting] id 1 len 10&#xA;*Mar  6 13:30:59.430: Vi1 IPCP:    Address 0.0.0.0 (0x030600000000)&#xA;*Mar  6 13:30:59.434: Vi1 IPCP: Event[UP] State[Starting to REQsent]&#xA;*Mar  6 13:30:59.434: Vi1 PPP: Process pending ncp packets&#xA;*Mar  6 13:30:59.434: Vi1 IPCP: Redirect packet to Vi1&#xA;*Mar  6 13:30:59.434: Vi1 IPCP: I CONFREQ [REQsent] id 1 len 10&#xA;*Mar  6 13:30:59.438: Vi1 IPCP:    Address 172.16.2.1 (0x0306AC100201)&#xA;*Mar  6 13:30:59.442: Vi1 IPCP:&#xA;CPE-A# O CONFACK [REQsent] id 1 len 10&#xA;*Mar  6 13:30:59.442: Vi1 IPCP:    Address 172.16.2.1 (0x0306AC100201)&#xA;*Mar  6 13:30:59.442: Vi1 IPCP: Event[Receive ConfReq+] State[REQsent to &#xA; ACKsent]&#xA;*Mar  6 13:30:59.446: %LINEPROTO-5-UPDOWN: Line protocol on Interface &#xA; Virtual-Access1, changed state to up&#xA;*Mar  6 13:30:59.602: Vi1 IPCP: I CONFNAK [ACKsent] id 1 len 10&#xA;*Mar  6 13:30:59.602: Vi1 IPCP:    Address 172.16.2.19 (0x0306AC100213)&#xA;*Mar  6 13:30:59.606: Vi1 IPCP: O CONFREQ [ACKsent] id 2 len 10&#xA;*Mar  6 13:30:59.606: Vi1 IPCP:    Address 172.16.2.19 (0x0306AC100213)&#xA;*Mar  6 13:30:59.606: Vi1 IPCP: Event[Receive ConfNak/Rej] State[ACKsent to&#xA; ACKsent]&#xA;*Mar  6 13:30:59.826: Vi1 IPCP: I CONFACK [ACKsent] id 2 len 10&#xA;*Mar  6 13:30:59.826: Vi1 IPCP:    Address 172.16.2.19 (0x0306AC100213)&#xA;*Mar  6 13:30:59.826: Vi1 IPCP: Event[Receive ConfAck] State[ACKsent to &#xA; Open]&#xA;*Mar  6 13:30:59.842: Vi1 IPCP: State is Open&#xA;*Mar  6 13:30:59.846: Di1 IPCP: Install negotiated IP interface address &#xA; 172.16.2.19&#xA;*Mar  6 13:30:59.854: Di1 IPCP: Install route to 172.16.2.1&#xA;CPE-A#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Relevant configs...&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;The LAC:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;no aaa new-model&#xA;!&#xA;ip source-route&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;no ip domain lookup&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;vpdn enable&#xA;vpdn search-order domain&#xA;!&#xA;vpdn-group PPP-Customers&#xA; request-dialin&#xA;  protocol l2tp&#xA;  domain isp.com&#xA; initiate-to ip 10.27.200.2&#xA; local name LAC&#xA; l2tp tunnel password 0 tunnel123&#xA;!&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;bba-group pppoe isp&#xA; virtual-template 1&#xA;!&#xA;!&#xA;interface Loopback0&#xA; description Management Loopback&#xA; ip address 10.27.100.1 255.255.255.255&#xA; !&#xA;!&#xA;interface FastEthernet0/0&#xA; description PtP to CPE&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; pppoe enable group isp&#xA; !&#xA;!&#xA;!&#xA;interface FastEthernet1/0&#xA; description PtP LAC-EDGE01&#xA; ip address 10.27.200.1 255.255.255.252&#xA; duplex full&#xA; speed 100&#xA; !&#xA;!&#xA;interface Virtual-Template1&#xA; ip unnumbered Loopback0&#xA; ppp authentication pap chap&#xA; !&#xA;!&#xA;router bgp 100&#xA; no synchronization&#xA; bgp router-id 10.27.100.1&#xA; bgp log-neighbor-changes&#xA; neighbor 10.27.200.2 remote-as 165535&#xA; neighbor 10.27.200.2 password BGP123&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;The LNS:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;EDGE01#sh debug&lt;/p&gt;&#xA;&lt;p&gt;VPN:&lt;/p&gt;&#xA;&lt;p&gt;VPDN events debugging is on&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication ppp default local&#xA;aaa authentication ppp PPPNetBlock local&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;!&#xA;!&#xA;!&#xA;ip source-route&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;vpdn enable&#xA;!&#xA;vpdn-group PPP-Customers&#xA; accept-dialin&#xA;  protocol l2tp&#xA;  virtual-template 1&#xA; terminate-from hostname LAC&#xA; local name LNS&#xA; no l2tp tunnel authentication&#xA; l2tp tunnel password 0 tunnel123&#xA; l2tp tunnel timeout no-session 15&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;username cpe-a@isp.com password 0 cpe123&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;interface Loopback0&#xA; description Management Loopback&#xA; ip address 172.16.3.1 255.255.255.255&#xA; !&#xA; !&#xA;interface Loopback1&#xA; description PPP Customers GW Loopback&#xA; ip address 172.16.2.1 255.255.255.255&#xA; !&#xA;!&#xA;interface FastEthernet0/0&#xA; description PtP EDGE01-LAC&#xA; ip address 10.27.200.2 255.255.255.252&#xA; duplex full&#xA; speed 100&#xA; !&#xA;!&#xA;interface Virtual-Template1&#xA; description PPP Customers Template&#xA; ip unnumbered Loopback1&#xA; peer default ip address pool PPPNetBlock&#xA; ppp authentication pap chap&#xA; !&#xA;!&#xA;! For this lab, I am redistributing CPE IPs into OSPF instead of BGP.&#xA;router ospf 1&#xA; router-id 172.16.3.1&#xA; log-adjacency-changes&#xA; auto-cost reference-bandwidth 512000&#xA; redistribute connected subnets&#xA; network 172.16.3.0 0.0.0.255 area 0&#xA; default-information originate&#xA;!&#xA;! BGP with upstream router, which is also the LAC.&#xA;! BGP session is kind of irrelevant, though.&#xA;router bgp 165535&#xA; no synchronization&#xA; bgp router-id 10.27.200.2&#xA; bgp log-neighbor-changes&#xA; neighbor 10.27.200.1 remote-as 100&#xA; neighbor 10.27.200.1 password BGP123&#xA; no auto-summary&#xA;!&#xA;ip local pool PPPNetBlock 172.16.2.2 172.16.2.254&#xA;ip forward-protocol nd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;The CPE:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;CPE-A#sh debug&lt;/p&gt;&#xA;&lt;p&gt;PPP:&lt;/p&gt;&#xA;&lt;p&gt;PPP authentication debugging is on&lt;/p&gt;&#xA;&lt;p&gt;PPP protocol errors debugging is on&lt;/p&gt;&#xA;&lt;p&gt;PPP protocol negotiation debugging is on&lt;/p&gt;&#xA;&lt;p&gt;PPPoE:&lt;/p&gt;&#xA;&lt;p&gt;PPPoE protocol events debugging is on&lt;/p&gt;&#xA;&lt;p&gt;PPPoE protocol errors debugging is on&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;no aaa new-model&#xA;!&#xA;ip source-route&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;interface FastEthernet0/0&#xA; description DSL&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; pppoe enable&#xA; pppoe-client dial-pool-number 1&#xA; !&#xA;!&#xA;interface Dialer1&#xA; description DSL Dialer&#xA; ip address negotiated&#xA; ip mtu 1492&#xA; encapsulation ppp&#xA; ip tcp adjust-mss 1452&#xA; dialer pool 1&#xA; ppp authentication chap callin&#xA; ppp chap hostname cpe-a@isp.com&#xA; ppp chap password 0 cpe123&#xA; ppp pap sent-username cpe-a@isp.com password 0 cpe123&#xA; no cdp enable&#xA;!&#xA;!&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 Dialer1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="846" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-03-14T23:11:57.843" Title="Strange drop-outs in Cisco 7200 LNS lab" Tags="|cisco|troubleshooting|cisco-ios-15|pppoe|l2tp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6670" PostTypeId="2" ParentId="6632" CreationDate="2014-03-06T05:23:36.697" Score="1" Body="&lt;p&gt;If you're looking to upgrade the device's firmware you'll want to telnet into the device or use a console cable as shown above. In most telnet programs you can use zmodem or xmodem in order to facilitate file transfer. The easiest way to transfer to the router is using a TFTP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a cisco knowledge base article on how to facilitate this with ROMmon (Most telnet programs will perform similarly):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/2600-series-multiservice-platforms/15085-xmodem-generic.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/routers/2600-series-multiservice-platforms/15085-xmodem-generic.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2014-03-06T05:23:36.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6672" PostTypeId="1" AcceptedAnswerId="6684" CreationDate="2014-03-06T09:27:14.880" Score="3" ViewCount="2578" Body="&lt;p&gt;I have cisco 7200 with 4 interfaces. Gi0/1 is my WAN where the ISP is sending me untagged and tagged traffic. Gi0/3 is my LAN interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have vlan ID &lt;code&gt;2402&lt;/code&gt;. This vlan come from Gi0/1 and I want to resend it to Gi0/3. How can I do this?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1.1&#xA; no shutdown&#xA; encapsulation dot1Q 2402&#xA;!  &#xA;interface GigabitEthernet0/3.1&#xA; no shutdown&#xA; encapsulation dot1Q 2402&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How I connect these interfaces ? There is no &lt;code&gt;switchport&lt;/code&gt; command....&lt;/p&gt;&#xA;" OwnerUserId="4653" LastEditorUserId="3191" LastEditDate="2014-03-06T10:45:31.973" LastActivityDate="2014-03-06T18:49:49.103" Title="cisco 7200 vlan" Tags="|cisco|vlan|cisco-7200|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6673" PostTypeId="1" CreationDate="2014-03-06T10:47:38.353" Score="7" ViewCount="17722" Body="&lt;p&gt;I'm trying to block users from configuring a Cisco IOS device if they have entered incorrect passwords a number of times. This is the command I'm using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# login block-for 120 attempts 3 within 60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which should block login attempts for 120 seconds in case incorrect passwords have been entered three times within 60 seconds. I've tried this in Packet Tracer and it doesn't seem to work: If you try getting access to the Router's user EXEC mode and use incorrect passwords you are not blocked after 3 attempts, the only thing that happens is that it says &quot;bad passwords&quot; and then you can keep trying. Which types of login is this command supposed to block? user EXEC, privileged EXEC, console port?&lt;/p&gt;&#xA;" OwnerUserId="4491" LastActivityDate="2015-11-24T13:13:10.703" Title="Securing Cisco device from brute force attacks" Tags="|cisco|security|cisco-ios|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6675" PostTypeId="2" ParentId="6673" CreationDate="2014-03-06T12:04:10.090" Score="7" Body="&lt;p&gt;Based on your comments, the default &lt;code&gt;sl_def_acl&lt;/code&gt; ACL didn't load into your configuration, for whatever reason. The behavior for the &lt;code&gt;login-block&lt;/code&gt; feature is to use a quiet mode after certain parameters have been violated.  In your case, after 3 failed attempts within 60 seconds will apply a quiet period ACL for 120 seconds.  If you haven't explicitly defined a quiet mode, it will default to the below ACL.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show access-lists sl_def_acl&#xA;&#xA; Extended IP access list sl_def_acl&#xA;     10 deny tcp any any eq telnet&#xA;     20 deny tcp any any eq www&#xA;     30 deny tcp any any eq 22&#xA;     40 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Default &lt;code&gt;sl_def_acl&lt;/code&gt; ACL sample curtesy of &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_login_enhance.html#wp1054160&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;Cisco IOS Login Enhancements (Login Block)&lt;/em&gt;&lt;/a&gt;.&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Manually defining your own ACL for these parameters is ideal.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;login quiet-mode access-class {acl-name | acl-number}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want additional information on how this function works, pop on over to the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_login_enhance.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco Documentation&lt;/a&gt; that covers this for more detail.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-03-06T12:04:10.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6676" PostTypeId="2" ParentId="6673" CreationDate="2014-03-06T12:12:35.027" Score="7" Body="&lt;p&gt;Perhaps there is a misunderstanding of how the feature works... this is my base configuration... no explicit ACL is required for the basic functionality to work&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Baseline configuration before configuring the &lt;code&gt;login block-for&lt;/code&gt; feature&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xconnect01#sh runn | i username|aaa|access-list&#xA;username cisco privilege 15 password 7 13061E010803&#xA;aaa new-model&#xA;aaa authentication login default local-case&#xA;aaa authentication enable default enable&#xA;aaa session-id common&#xA;xconnect01#&#xA;xconnect01#sh runn | b line vty&#xA;line vty 0 4&#xA; password 7 070C285F4D06&#xA;!&#xA;ntp clock-period 17180450&#xA;ntp server vrf mgmtVrf 172.16.1.5&#xA;end&#xA;&#xA;xconnect01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Configuring the feature&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Now I configure the basic &lt;code&gt;login block-for&lt;/code&gt; feature...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xconnect01#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;xconnect01(config)# login block-for 120 attempts 3 within 60&#xA;xconnect01(config)#end&#xA;xconnect01#quit&#xA;Connection closed by foreign host.&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Demonstrating failures&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Entering some wrong logins to intentionally block myself.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ date; telnet 172.16.1.240&#xA;Thu Mar  6 06:05:20 CST 2014&#xA;Trying 172.16.1.240...&#xA;Connected to 172.16.1.240.&#xA;Escape character is '^]'.&#xA;&#xA;&#xA;User Access Verification&#xA;&#xA;Username: foobarme&#xA;Password:&#xA;&#xA;% Authentication failed&#xA;&#xA;Username: foobarme&#xA;Password:&#xA;&#xA;% Authentication failed&#xA;&#xA;Username: foobarme&#xA;Password:&#xA;&#xA;% Authentication failed&#xA;Connection closed by foreign host.&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Demonstrating the blocks for 120 seconds&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Notice the date commands just before my &lt;code&gt;telnet&lt;/code&gt;; these document exactly when I telnet to the lab router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ date; telnet 172.16.1.240&#xA;Thu Mar  6 06:05:37 CST 2014&#xA;Trying 172.16.1.240...&#xA;telnet: Unable to connect to remote host: Connection refused&#xA;[mpenning@tsunami ~]$&#xA;[mpenning@tsunami ~]$ date; telnet 172.16.1.240&#xA;Thu Mar  6 06:06:51 CST 2014&#xA;Trying 172.16.1.240...&#xA;telnet: Unable to connect to remote host: Connection refused&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Demonstrating a successful login after the 120-second quiet period&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Two minutes after being blocked, I can login again...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ date; telnet 172.16.1.240&#xA;Thu Mar  6 06:07:56 CST 2014&#xA;Trying 172.16.1.240...&#xA;Connected to 172.16.1.240.&#xA;Escape character is '^]'.&#xA;&#xA;&#xA;User Access Verification&#xA;&#xA;Username: cisco&#xA;Password:&#xA;&#xA;xconnect01&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-03-06T12:12:35.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6677" PostTypeId="1" CreationDate="2014-03-06T12:57:17.340" Score="1" ViewCount="98" Body="&lt;p&gt;I am following this guide &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/44800-mactoport44800.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/44800-mactoport44800.html&lt;/a&gt; but it is not working for me. I have set this up on one network already and works fine using netgear switches. I am trying to set it up on a separate network of switches but i am getting no results. the command &lt;code&gt;snmpwalk -c public -v1 netgearpt03 .1.3.6.1.2.1.17.4.3.1&lt;/code&gt; is returning nothing. On the switch that does work returns&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SNMPv2-SMI::mib-2.17.4.3.1.1.20.254.181.217.110.102 = Hex-STRING: 14 FE B5 D9 6E 66 &#xA;SNMPv2-SMI::mib-2.17.4.3.1.1.20.254.181.217.110.138 = Hex-STRING: 14 FE B5 D9 6E 8A &#xA;SNMPv2-SMI::mib-2.17.4.3.1.1.24.3.115.42.20.204 = Hex-STRING: 18 03 73 2A 14 CC &#xA;SNMPv2-SMI::mib-2.17.4.3.1.1.24.3.115.45.252.24 = Hex-STRING: 18 03 73 2D FC 18 &#xA;SNMPv2-SMI::mib-2.17.4.3.1.1.24.3.115.45.252.125 = Hex-STRING: 18 03 73 2D FC 7D &#xA;SNMPv2-SMI::mib-2.17.4.3.1.1.24.3.115.45.253.23 = Hex-STRING: 18 03 73 2D FD 17 &#xA;SNMPv2-SMI::mib-2.17.4.3.1.1.24.3.115.45.253.99 = Hex-STRING: 18 03 73 2D FD 63 &#xA;SNMPv2-SMI::mib-2.17.4.3.1.1.24.3.115.45.254.105 = Hex-STRING: 18 03 73 2D FE 69 &#xA;SNMPv2-SMI::mib-2.17.4.3.1.1.24.3.115.45.255.139 = Hex-STRING: 18 03 73 2D FF 8B &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the none working netgear switch models are GS752TXS. is there any option to turn on dynamic cam tables?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the working netgear switch models are GSM7328S&lt;/p&gt;&#xA;" OwnerUserId="4660" LastEditorUserId="775" LastEditDate="2014-03-06T14:18:52.423" LastActivityDate="2014-03-06T14:18:52.423" Title="Using SNMP to Find a Switch Port Number from a MAC Address" Tags="|snmp|management|mac-address|" AnswerCount="0" CommentCount="0" FavoriteCount="0" ClosedDate="2014-03-06T13:05:03.243" ContentLicense="CC BY-SA 3.0" />
  <row Id="6679" PostTypeId="1" AcceptedAnswerId="6683" CreationDate="2014-03-06T14:11:32.863" Score="2" ViewCount="6409" Body="&lt;p&gt;In literature, I see UDP &lt;a href=&quot;https://en.wikipedia.org/wiki/Datagram&quot; rel=&quot;nofollow noreferrer&quot;&gt;datagram&lt;/a&gt; format as following:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ptiIA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot understand why it does not include source and destination IP addresses?&lt;/p&gt;&#xA;" OwnerUserId="2445" LastEditorUserId="50130" LastEditDate="2020-04-15T20:42:09.663" LastActivityDate="2020-04-15T20:42:09.663" Title="Why No Source and Destination IPs in UDP Datagram?" Tags="|udp|layer4|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="6680" PostTypeId="2" ParentId="6679" CreationDate="2014-03-06T15:29:35.530" Score="2" Body="&lt;p&gt;At transmission the psuedoheader is added for the destination and source IP addresses. &lt;a href=&quot;http://medusa.sdsu.edu/network/CS576/Lectures/ch11_UDP.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; might clarify the process a bit more:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By itself, the UDP packet header only contains the source port and destination port of the client/target as well as a checksum and length. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a &lt;a href=&quot;https://stackoverflow.com/questions/359045/what-is-the-significance-of-pseudo-header-used-in-udp-tcp&quot;&gt;related question&lt;/a&gt; asked on StackOverflow: &lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2014-03-06T18:01:59.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6681" PostTypeId="1" AcceptedAnswerId="6682" CreationDate="2014-03-06T15:48:07.033" Score="1" ViewCount="375" Body="&lt;p&gt;The culture at one of our main branch offices is very open and loose.  Historically when people have needed more ports in their space they could just grab a switch from someone with access to our equipment room and this was OK with management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not OK to me.  I have about 30 small desktop class switches of various flavors which connect up through patch panels to primary access level gear like Cisco 3750's.  I want to centralize distribution of small switches and prevent undocumented sprawl, but need advice on the best way to approach this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I considered going into each desktop switch, shutting down all not-in-use ports and then restricting the in-use ports to a single MAC.  The problem is not all of the desktop flavors support this as readily as port-security on cisco enterprise devices.  I considered doing the port-security upstream at the 3750's but overall I wonder how larger offices handle this kind of problem and if there's an easier way to track if a new switch has been plugged in somewhere without proper authorization?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2014-03-06T19:17:32.860" Title="How to track un-authorized devices being connected to a private network?" Tags="|access-control|port-security|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6682" PostTypeId="2" ParentId="6681" CreationDate="2014-03-06T17:17:42.720" Score="5" Body="&lt;p&gt;Social engineering is one of the greatest risks associated with network security. Your first goal would be to present the ease of access to network resources and devices as a security risk. Depending on what kind of data your company deals with, you can schedule a PCI audit OR you can sell the idea of one to the higher-ups as a benefit to your company's customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your second task should be to unify all the switch/router architecture and adopt a rolling password implementation. By this I mean, every so often someone needs to go into all the Cisco equipment and change the password to enter config mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enable port security! Without port security, you are running the risk of someone causing a loop, plugging in non-authorized devices, and setting up servers on the inside that could easily span or smurf traffic! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Clear mac-table dyn&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Clear port-security all&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then let the mac-add-table populate. Confirm what ports have dual mac addresses and enable switchport port-security max at a number suitable for the macs on a port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then force the switch to send out traps to your SNMP program of choice using : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;snmp-server enable traps port-security trap-rate&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for switches. &#xA;Here's more information for you : &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/20ewa/configuration/guide/conf/port_sec.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/20ewa/configuration/guide/conf/port_sec.html&lt;/a&gt;&#xA;Note that the doc is for a catalyst 4500. You'll have to look up the commands specifically for the switch you'd be dealing with.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="4634" LastEditDate="2014-03-06T18:32:10.410" LastActivityDate="2014-03-06T18:32:10.410" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6683" PostTypeId="2" ParentId="6679" CreationDate="2014-03-06T18:39:11.693" Score="18" Body="&lt;p&gt;Because you're looking at the &lt;em&gt;UDP Datagram&lt;/em&gt;, which is the payload in an &lt;em&gt;IP Datagram&lt;/em&gt;.  The &lt;em&gt;IP Header&lt;/em&gt; has the src/dst IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-03-06T18:39:11.693" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6684" PostTypeId="2" ParentId="6672" CreationDate="2014-03-06T18:49:49.103" Score="3" Body="&lt;p&gt;What you are looking for is best done with a &lt;em&gt;bridge&lt;/em&gt;.  Add the vlan tagged subinterface and the internal LAN interface to a bridge group, and it should work the way you want. (I've not done this for a long time. You're building an ethernet switch out of routed interfaces. This is the same thing done on a Cat-2948G-L3 -- I've seen CCIE's stumped by it until they get that it's a 48 port &lt;em&gt;router&lt;/em&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another path would be policy routing. But I'm assuming the tagged traffic is not something that would be easily routed. (say, multicast IPTV traffic.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-03-06T18:49:49.103" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6685" PostTypeId="2" ParentId="6681" CreationDate="2014-03-06T19:17:32.860" Score="1" Body="&lt;p&gt;If your environment uses Active Directory for domain authentication, you could investigate setting up a test bed to implement dot1x and freenac.&#xA;See &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://freenac.net/en/solutions&quot; rel=&quot;nofollow&quot;&gt;http://freenac.net/en/solutions&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://freenac.net/en/book/export/html/339&quot; rel=&quot;nofollow&quot;&gt;http://freenac.net/en/book/export/html/339&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2014-03-06T19:17:32.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6686" PostTypeId="1" CreationDate="2014-03-06T20:46:08.790" Score="6" ViewCount="2047" Body="&lt;p&gt;On a production Nexus 5K, I noticed the following piece of config: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA;  mac-address 0000.0000.0000 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the entire Vlan1 stanza. What does this accomplish?  &lt;/p&gt;&#xA;" OwnerUserId="2624" LastActivityDate="2015-06-11T07:26:53.687" Title="What's the purpose of &quot;mac-address 0000.0000.0000&quot; in NX-OS?" Tags="|cisco-nx-os|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6689" PostTypeId="2" ParentId="1411" CreationDate="2014-03-06T22:40:07.463" Score="0" Body="&lt;p&gt;The easy answer is that, for a one-to-one mapping from IOS to NX-OS, it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IOS&lt;/strong&gt;: &lt;code&gt;show run | inc (interface Vlan)|(ip address)&lt;/code&gt; &lt;br&gt;&#xA;&lt;strong&gt;NX-OS&lt;/strong&gt;:  &lt;code&gt;show run | inc 'interface Vlan|ip address'&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this makes more sense when you leave out the extra parens in the original:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show run | inc (interface Vlan|ip address)&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key in this example is that for NX-OS, the parens are replaced by quote marks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also use double quotes, i.e. &lt;code&gt;&quot;&quot;&lt;/code&gt;  . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;NX-OS is Linux-based&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/nexus-7000-series-switches/white_paper_c11-622511.html&quot; rel=&quot;nofollow&quot;&gt;[1]&lt;/a&gt;, and uses a *nix-like regular expression engine. The commands are odd comprises between English wording and standard regex idioms.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, what would be &lt;code&gt;egrep -v&lt;/code&gt; in bash would look like &lt;code&gt;egrep ignore-case&lt;/code&gt;&lt;br&gt;&#xA;On the command line this would look something like&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show run | egrep ignore-case vpc&lt;/code&gt;&lt;br&gt;&#xA; &lt;em&gt;or&lt;/em&gt;&#xA;&lt;br&gt;&lt;code&gt;show run | inc ignore-case vpc&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of the verbosity (and strength) of the new regex features:&lt;br&gt;&#xA;&lt;code&gt;show run | egrep ignore-case  vpc  | egrep invert-match ignore-case peer&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would be equivalent to a bash-shell &lt;code&gt;egrep -i vpc &amp;lt;input&amp;gt; | egrep -vi peer&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, there is considerably more power and flexibility here than in current IOS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic Cisco documentation is &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5500/sw/fundamentals/7x/b_5500_Fund_Config_7x/b_5500_Fund_Config_7x_chapter_0101.html#con_1237003&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;*, but your command-line &lt;code&gt;?&lt;/code&gt; feature gives you quick reminders:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5k# show run | ?&#xA;  cut      Print selected parts of lines.&#xA;  diff     Show difference between current and previous invocation (creates temp files: remove them&#xA;           with 'diff-clean' command and dont use it on commands with big outputs, like 'show &#xA;           tech'!) &#xA;  egrep    Egrep - print lines matching a pattern&#xA;  grep     Grep - print lines matching a pattern&#xA;  head     Display first lines&#xA;  human    Output in human format&#xA;  last     Display last lines&#xA;  less     Filter for paging&#xA;  no-more  Turn-off pagination for command output&#xA;  section  Show lines that include the pattern as well as the subsequent lines that are more&#xA;           indented than matching line &#xA;  sort     Stream Sorter&#xA;  tr       Translate, squeeze, and/or delete characters&#xA;  uniq     Discard all but one of successive identical lines&#xA;  vsh      The shell that understands cli command&#xA;  wc       Count words, lines, characters&#xA;  xml      Output in xml format (according to .xsd definitions)&#xA;  begin    Begin with the line that matches&#xA;  count    Count number of lines&#xA;  end      End with the line that matches&#xA;  exclude  Exclude lines that match&#xA;  include  Include lines that match&#xA;&#xA;5k# show run | inc ?&#xA;  WORD         Search for the expression&#xA;  ignore-case  Ignore case difference when comparing strings&#xA;  line-exp     Print only lines where the match is a whole line&#xA;&#xA;5k# show run | egrep ?&#xA;  WORD          Search for the expression&#xA;  count         Print a total count of matching lines only&#xA;  ignore-case   Ignore case difference when comparing strings&#xA;  invert-match  Print only lines that contain no matches for &amp;lt;expr&amp;gt;&#xA;  line-exp      Print only lines where the match is a whole line&#xA;  line-number   Print each match preceded by its line number&#xA;  next          Print &amp;lt;num&amp;gt; lines of context after every matching line&#xA;  prev          Print &amp;lt;num&amp;gt; lines of context before every matching line&#xA;  word-exp      Print only lines where the match is a complete word&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Note&lt;/em&gt; that the docs may be version and platform dependent.&lt;br&gt;&#xA;Here is the top-level for the Nexus 7K:&lt;br&gt;&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/switches/nexus-7000-series-switches/products-installation-and-configuration-guides-list.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Nexus 7000 Series Switches Configuration Guides&lt;/a&gt;&lt;br&gt;&#xA;For the 5K:&lt;br&gt;&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/switches/nexus-5000-series-switches/products-installation-and-configuration-guides-list.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Nexus 5000 Series Switches Configuration Guides&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You'll then want to search &quot;fun&quot; (what else?) to find the &lt;em&gt;Fundamentals Configuration Guide&lt;/em&gt; (which contains the Regular Expression section in the &lt;em&gt;Understanding the Command-Line Interface&lt;/em&gt; chapter).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Easter egg? Chapter numbers are in binary for this doc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you walk through the docs, you'll find a lot more *nix-like command-line tools, including &lt;code&gt;cut&lt;/code&gt;, &lt;code&gt;tr&lt;/code&gt;, and on the 7K, &lt;code&gt;sed&lt;/code&gt; and some other goodies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, don't overlook the &lt;code&gt;prev&lt;/code&gt; and &lt;code&gt;next&lt;/code&gt; modifiers for 'include' matches.  &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will grab lines containing foo, as well as three lines before and two lines after for context:&lt;br&gt;&#xA;&lt;code&gt;show run | inc foo prev 3 next 2&lt;/code&gt; &lt;/p&gt;&#xA;" OwnerUserId="2624" LastActivityDate="2014-03-06T22:40:07.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6690" PostTypeId="1" AcceptedAnswerId="6692" CreationDate="2014-03-06T23:29:44.553" Score="7" ViewCount="27214" Body="&lt;p&gt;I'll start by pointig out that networking issues have always left me scratching my head. There is something about routing especially that I just haven't had that &quot;Oh I get it&quot; moment yet, so it's likely this is a very basic misconfiguration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to set up a Cisco ASA 5505 to be connected with a public IP address on one interface, and to have the second interface connect to our internal network. Right now our internal network is on 192.168.1.0/24, and the public IP we have from the ISP is in the 125.x.x.x range. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have set up 3 interfaces on the ASA,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Inside &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 192.168.1.3&#xA;Mask: 255.255.255.0&#xA;Ports 1-6&#xA;Sec Level 100&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Outside&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 125.x.x.x&#xA;Mask: 255.0.0.0&#xA;Port 0&#xA;Sec Level 0&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Management&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 10.0.0.1&#xA;Mask: 255.255.255.0&#xA;Port 7&#xA;Restricted to management&#xA;Restrict flow to Outside (had to do this for licensing reasons)&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have an access rule on the firewall that allows IP traffic from any source on the inside network to any less secure network (there is one for both IPv4 and 6).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the internet-facing router connected to port 0, I connect a computer to port 1 with IP &lt;code&gt;192.168.1.20&lt;/code&gt;, Mask &lt;code&gt;255.255.255.0&lt;/code&gt; and gateway &lt;code&gt;192.168.1.3&lt;/code&gt;. Using this PC I can ping &lt;code&gt;192.168.1.3&lt;/code&gt; but no further - I cannot ping the public IP address or &lt;code&gt;8.8.8.8&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I connect the same PC directly to the router and assign it the public IP address directly I can access the internet no problem. I believe that the issue here is that I need to add some static routes to show the path from inside&amp;lt;-&gt;outside, but I just do not grok them well enough to know how to structure them. Any help or suggestions would be very much appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: See below the running config, with some redactions.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;:&#xA;ASA Version 8.2(1) &#xA;!&#xA;hostname AUS-FW-01&#xA;domain-name =============.com.au&#xA;enable password ============= encrypted&#xA;passwd ============= encrypted&#xA;names&#xA;name 10.61.76.0 CNC-network&#xA;name 10.61.73.0 LAN-network&#xA;name 192.168.1.0 LEGACY-network&#xA;name 10.61.75.0 RANDD-network&#xA;name 10.61.74.0 WIRELESS-network&#xA;name 10.61.73.5 InternalGateway&#xA;name 192.168.1.200 DCServer&#xA;name 192.168.1.214 MUVS-TP description Trueform Print Server&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.1.3 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 125.x.x.10 255.255.255.252 &#xA;!&#xA;interface Vlan12&#xA; no forward interface Vlan2&#xA; nameif Management&#xA; security-level 0&#xA; ip address 10.0.0.1 255.255.255.0 &#xA; management-only&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA; switchport access vlan 12&#xA;!&#xA;ftp mode passive&#xA;clock timezone EST 10&#xA;dns domain-lookup outside&#xA;dns server-group DefaultDNS&#xA; name-server =============&#xA; name-server =============&#xA; domain-name =============.com.au&#xA;same-security-traffic permit intra-interface&#xA;access-list outside_access_in remark Email access&#xA;access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq smtp &#xA;access-list outside_access_in remark ActiveSync Email Access&#xA;access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq https &#xA;access-list outside_access_in remark Pronto Trueform Printing&#xA;access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq lpd &#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;mtu Management 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;static (inside,outside) tcp interface smtp DCServer smtp netmask 255.255.255.255 &#xA;static (inside,outside) tcp interface https DCServer https netmask 255.255.255.255 &#xA;static (inside,outside) tcp interface lpd MUVS-TP lpd netmask 255.255.255.255 &#xA;access-group outside_access_in in interface outside&#xA;route inside LAN-network 255.255.255.0 10.61.79.2 1&#xA;route inside LEGACY-network 255.255.255.0 InternalGateway 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;http server enable&#xA;http 10.61.79.0 255.255.255.0 inside&#xA;http LAN-network 255.255.255.0 inside&#xA;http 10.0.0.0 255.255.255.0 Management&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;vpdn username ============= password ============= store-local&#xA;dhcpd auto_config outside&#xA;!&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics port&#xA;threat-detection statistics protocol&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;Cryptochecksum:=============&#xA;: end&#xA;asdm location LAN-network 255.255.255.0 inside&#xA;asdm location WIRELESS-network 255.255.255.0 inside&#xA;asdm location RANDD-network 255.255.255.0 inside&#xA;asdm location CNC-network 255.255.255.0 inside&#xA;asdm location LEGACY-network 255.255.255.0 inside&#xA;asdm location InternalGateway 255.255.255.255 inside&#xA;asdm location DCServer 255.255.255.255 inside&#xA;asdm location MUVS-TP 255.255.255.255 inside&#xA;no asdm history enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;PS: I wasn't sure if this was a better fit here or on SF. I have no problem with it being moved.&lt;/p&gt;&#xA;" OwnerUserId="4666" LastEditorUserId="3191" LastEditDate="2014-03-07T08:01:51.110" LastActivityDate="2014-03-07T08:01:51.110" Title="Configuring a Cisco ASA 5505 for routing" Tags="|cisco|routing|cisco-asa|troubleshooting|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6691" PostTypeId="1" CreationDate="2014-03-07T00:46:20.787" Score="1" ViewCount="849" Body="&lt;p&gt;I can't for the life of me to get any egress queue prioritization to happen on an SRX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a single label switched path out of the SRX, and a couple of ethernet-ccc's. One ccc is entirely expedited forwarding, and the other is entirely best effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have input filters on the interface stanzas to set the forwarding classes of the two ccc's. I can then apply a policing filter on the label-switched-path to rate limit the respective circuits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point, if I set the policing so the BE traffic is limited to 9Mb, and the EF traffic to 1Mb, everything works as I desire. However.... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd would to only police the EF circuit on the label switched path, and run the BE circuit wide open, but ensure that the EF traffic can take priority up to its policed limit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been toying with forwarding classes all day, to no avail. Starting to think that's not where I should be looking?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here's my attempt at forwarding classes here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 11.4R10.3;&#xA;&#xA;interfaces {&#xA;    ge-0/0/0 {                          &#xA;        speed 100m;&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.1.2.3/31;&#xA;            }&#xA;            family mpls;&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {                        &#xA;            family inet {&#xA;                address 10.1.2.5/31;&#xA;            }&#xA;            family mpls;&#xA;        }&#xA;    }&#xA;&#xA;    ge-0/0/6 {&#xA;        encapsulation ethernet-ccc;&#xA;        unit 0 {&#xA;            family ccc {&#xA;                filter {&#xA;                    input ef_classifier;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/7 {&#xA;        encapsulation ethernet-ccc;     &#xA;        unit 0 {&#xA;            family ccc {&#xA;                filter {&#xA;                    input be_classifier;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;}&#xA;&#xA;protocols {&#xA;    rsvp {&#xA;        interface ge-0/0/0.0 {&#xA;            bandwidth 200m;             &#xA;            link-protection;&#xA;        }&#xA;        interface ge-0/0/1.0 {&#xA;            bandwidth 2m;&#xA;            link-protection;&#xA;        }&#xA;    }&#xA;    mpls {&#xA;        label-switched-path met_pr_pr {&#xA;            to 10.1.1.1;&#xA;            ldp-tunneling;&#xA;            primary rad_primary {&#xA;                preference 1;&#xA;            }&#xA;            secondary rad_secondary {&#xA;                preference 10;&#xA;                standby;&#xA;            }&#xA;            policing filter p-cos;&#xA;        }                               &#xA;        interface ge-0/0/0.0;&#xA;        interface lo0.0;&#xA;        interface ge-0/0/1.0;&#xA;    }&#xA;    l2circuit {&#xA;        neighbor 10.1.1.1 {&#xA;            interface ge-0/0/7.0 {&#xA;                virtual-circuit-id 1;&#xA;                encapsulation-type ethernet;&#xA;            }&#xA;            interface ge-0/0/6.0 {&#xA;                virtual-circuit-id 2;&#xA;                encapsulation-type ethernet;&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;}&#xA;class-of-service {    &#xA;    forwarding-classes {&#xA;        queue 0 best-effort priority low;&#xA;        queue 2 expedited-forwarding priority high;&#xA;        queue 1 assured-forwarding priority high;&#xA;    }&#xA;    interfaces {&#xA;        all {&#xA;            scheduler-map default;&#xA;        }&#xA;    }&#xA;    scheduler-maps {&#xA;        default {&#xA;            forwarding-class best-effort scheduler be-sched;&#xA;            forwarding-class expedited-forwarding scheduler ef-sched;&#xA;        }&#xA;    }&#xA;    schedulers {&#xA;        be-sched {&#xA;            transmit-rate percent 1;&#xA;            buffer-size percent 1;&#xA;            priority low;&#xA;        }&#xA;        ef-sched {&#xA;            transmit-rate percent 25;&#xA;            buffer-size percent 25;&#xA;            priority strict-high;&#xA;        }&#xA;        af-sched {&#xA;            transmit-rate percent 25;&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;firewall {&#xA;    family ccc {&#xA;        filter ef_classifier {&#xA;            term ef {&#xA;                then forwarding-class expedited-forwarding;&#xA;            }&#xA;        }&#xA;        filter be_classifier {          &#xA;            term be {&#xA;                then forwarding-class best-effort;&#xA;            }&#xA;        }&#xA;    }&#xA;    family any {&#xA;        filter p-cos {&#xA;            term ct2 {&#xA;                from {&#xA;                    forwarding-class expedited-forwarding;&#xA;                }&#xA;                then {&#xA;                    policer p-ef;&#xA;                    loss-priority low;&#xA;                }&#xA;            }&#xA;            term ct0 {&#xA;                from {&#xA;                    forwarding-class best-effort;&#xA;                }&#xA;                then loss-priority high;&#xA;            }&#xA;        }                               &#xA;    }&#xA;    policer p-ef {&#xA;        if-exceeding {&#xA;            bandwidth-limit 200k;&#xA;            burst-size-limit 1500;&#xA;        }&#xA;        then discard;&#xA;    }&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4668" LastEditorUserId="775" LastEditDate="2014-03-10T22:00:54.293" LastActivityDate="2014-03-10T22:00:54.293" Title="Juniper SRX MPLS Egress Prioritization" Tags="|juniper|qos|mpls|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6692" PostTypeId="2" ParentId="6690" CreationDate="2014-03-07T01:28:38.783" Score="7" Body="&lt;p&gt;OK, after looking at your configuration, you are missing one statement:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route outside 0.0.0.0 0.0.0.0 125.x.x.9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This tells the firewall to forward all Internet traffic to the ISP's router at 125.x.x.9&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-07T01:28:38.783" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6693" PostTypeId="1" CreationDate="2014-03-07T08:34:55.160" Score="2" ViewCount="2828" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IuTfz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;tell me please why continues to execute the command ping...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#ping vrf vrf-trust 50.50.50.50 sou 2.2.2.2&#xA;&#xA;Type escape sequence to abort.&#xA;ending 5, 100-byte ICMP Echos to 50.50.50.50, timeout is 2 seconds:&#xA;Packet sent with a source address of 2.2.2.2 &#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;while there is no specify route back to 2.2.2.2 in Routing table .&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UntrustGi-vr.inet.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.10.10.0/24      *[Static/5] 21:31:56&#xA;                &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;14.0.64.0/24       *[Direct/0] 1d 09:03:47&#xA;                &amp;gt; via ge-0/0/1.0&#xA;14.0.64.2/32       *[Local/0] 1d 09:40:15&#xA;                  Local via ge-0/0/1.0&#xA;20.20.20.0/24      *[Static/5] 21:31:56&#xA;                &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;30.30.30.0/24      *[Static/5] 21:31:56&#xA;                &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;40.40.40.0/24      *[OSPF/10] 1d 09:00:35, metric 2&#xA;                &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;50.50.50.0/24      *[OSPF/10] 21:37:17, metric 2&#xA;                &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;60.60.60.0/24      *[OSPF/10] 1d 09:00:35, metric 2&#xA;                &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;224.0.0.5/32       *[OSPF/10] 2d 00:06:40, metric 1&#xA;                  MultiRecv&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but recently, this route was. But now I deleted it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe it's because SRX remembered session. but I entered command &lt;em&gt;clear security flow session all&lt;/em&gt; but ping continues...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit routing-instances UntrustGi-vr]&#xA;admin# run show route &#xA;&#xA;inet.0: 2 destinations, 2 routes (1 active, 0 holddown, 1 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;224.0.0.5/32       *[OSPF/10] 3d 00:31:23, metric 1&#xA;                      MultiRecv&#xA;&#xA;Trust-vr.inet.0: 10 destinations, 10 routes (10 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;0.0.0.0/0          *[Static/5] 1d 04:08:21&#xA;                      to table UntrustGi-vr.inet.0&#xA;1.1.1.0/24         *[Static/5] 1d 12:31:58&#xA;                    &amp;gt; to 7.7.7.1 via ge-0/0/0.0&#xA;2.2.2.0/24         *[Static/5] 1d 12:30:19&#xA;                    &amp;gt; to 7.7.7.1 via ge-0/0/0.0&#xA;3.3.3.0/24         *[Static/5] 1d 12:30:19&#xA;                    &amp;gt; to 7.7.7.1 via ge-0/0/0.0&#xA;4.4.4.0/24         *[OSPF/10] 1d 12:50:53, metric 2&#xA;                    &amp;gt; to 7.7.7.1 via ge-0/0/0.0&#xA;5.5.5.0/24         *[OSPF/10] 1d 12:45:48, metric 2&#xA;                    &amp;gt; to 7.7.7.1 via ge-0/0/0.0&#xA;6.6.6.0/24         *[OSPF/10] 1d 12:50:53, metric 2&#xA;                    &amp;gt; to 7.7.7.1 via ge-0/0/0.0&#xA;7.7.7.0/24         *[Direct/0] 1d 12:54:13&#xA;                    &amp;gt; via ge-0/0/0.0&#xA;7.7.7.2/32         *[Local/0] 1d 13:30:28&#xA;                      Local via ge-0/0/0.0&#xA;224.0.0.5/32       *[OSPF/10] 2d 04:41:34, metric 1&#xA;                      MultiRecv&#xA;&#xA;UntrustGi-vr.inet.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.10.10.0/24      *[Static/5] 1d 01:22:09&#xA;                    &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;14.0.64.0/24       *[Direct/0] 1d 12:54:00&#xA;                    &amp;gt; via ge-0/0/1.0&#xA;14.0.64.2/32       *[Local/0] 1d 13:30:28&#xA;                      Local via ge-0/0/1.0&#xA;20.20.20.0/24      *[Static/5] 1d 01:22:09&#xA;                    &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;30.30.30.0/24      *[Static/5] 1d 01:22:09&#xA;                    &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;40.40.40.0/24      *[OSPF/10] 1d 12:50:48, metric 2&#xA;                    &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;50.50.50.0/24      *[OSPF/10] 1d 01:27:30, metric 2&#xA;                    &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;60.60.60.0/24      *[OSPF/10] 1d 12:50:48, metric 2&#xA;                    &amp;gt; to 14.0.64.1 via ge-0/0/1.0&#xA;224.0.0.5/32       *[OSPF/10] 2d 03:56:53, metric 1&#xA;                      MultiRecv&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4635" LastEditorUserId="8499" LastEditDate="2018-12-21T05:24:07.587" LastActivityDate="2018-12-21T05:24:07.587" Title="continues to execute the command ping" Tags="|juniper-junos|ping|troubleshooting|juniper-srx|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6695" PostTypeId="1" AcceptedAnswerId="6696" CreationDate="2014-03-07T11:58:47.740" Score="8" ViewCount="386" Body="&lt;p&gt;I am a programmer working in a software for the sales dept. I would like to know if a feature I want to implement is possible or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The user has an application where he can see information about a customer, including the phone number. &lt;strong&gt;My question is:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is it possible, to &lt;em&gt;send&lt;/em&gt; the phone number to a Cisco CallManager which after receiving the request would call the user's phone and after picking up the phone it would automatically dial the customer's phone number.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I checked the API docs, but honestly, I do not know what I should be looking for, if there is any technical term that describes what I want. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I apologize for the sort of confusing post, but I do not have much knowledge of the technical jargon in this field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="4669" LastActivityDate="2014-03-07T14:21:44.053" Title="Cisco callmanager SIP features" Tags="|cisco|voip|sip|cisco-voip|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6696" PostTypeId="2" ParentId="6695" CreationDate="2014-03-07T12:16:07.100" Score="10" Body="&lt;p&gt;The term you are looking for to describe this behavior, is an Outbound Campaign.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no built in functionality in Cisco Call Manager (CUCM) itself to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, both of Cisco's Contact Center products do have this ability.  Unified Contact Center Express (UCCX) has a more limited capability for performing a Campaign, but is a much cheaper, much simpler solution to implement.  It is still not cheap or simple though!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more complicated out dialing ability, you'd want to look into Unified Contact Center Enterprise.  At that point, due to the cost and complexity of UCCE, I'd recommend involving a Cisco Partner to design and implement the system for you.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;With all of that said, if you were controlling a phone via one of the phone control APIs that Cisco provides, you may be able to rig something up yourself to do this.  It just won't be as neat or integrated as the Cisco solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might work something like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;UserA&lt;/strong&gt; indicates to your software that they're ready to make an outbound call to a customer.&lt;/li&gt;&#xA;&lt;li&gt;Your software consults the list of customers to call, and sees that &lt;strong&gt;CustomerB&lt;/strong&gt; is up next.&lt;/li&gt;&#xA;&lt;li&gt;Your software looks up the relevant info of &lt;strong&gt;CustomerB&lt;/strong&gt; in it's database (phone number, account number, etc).&lt;/li&gt;&#xA;&lt;li&gt;Then, utilizing a Cisco TAPI configuration, your software takes control of &lt;strong&gt;UserA&lt;/strong&gt;'s phone.&lt;/li&gt;&#xA;&lt;li&gt;Your software makes &lt;strong&gt;UserA&lt;/strong&gt;'s phone go off-hook, and initiate a call to the retrieved customer number.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;UserA&lt;/strong&gt; hears ringback on their headset and is now on a call to &lt;strong&gt;CustomerB&lt;/strong&gt;, with all of their account info displayed on the screen via your software.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are many other ways you could go about it, that's just one possibility.  This doesn't give you supervisory ability to only connect the call if a customer answers, but that's part of what the UCCX and UCCE solutions provide.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2014-03-07T14:21:44.053" LastActivityDate="2014-03-07T14:21:44.053" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6697" PostTypeId="2" ParentId="6693" CreationDate="2014-03-07T12:58:01.863" Score="3" Body="&lt;p&gt;Based on your comments, everything looks correct. Althought 50.50.50.50 may not have a direct/learned route to 2.2.2.2, he does have a default-gateway set to 14.0.64.2. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show ip route vrf vrf-untrustgi &#xA;  S* 0.0.0.0/0 [1/0] via 14.0.64.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you didn't have an interface locally that was available to respond to ping, you wouldn't be able to use it. The functionality might exist in a an ASA to use a random addresses, presumably for security auditing reasons.  It would look similar to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#ping 8.8.8.8 source 2.2.2.2&#xA;% Invalid source address- IP address not on any of our up interfaces&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-03-07T12:58:01.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6698" PostTypeId="1" AcceptedAnswerId="6754" CreationDate="2014-03-07T13:26:17.640" Score="2" ViewCount="1918" Body="&lt;p&gt;I am unable to identify the 3GPP specification that gives me message structure in ASN format for MT-LR and MO-LR. Please let me know about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I browsed through many RRLP, RRC, LTE, LPP documents in the  but failed to find the needful in &lt;a href=&quot;http://www.3gpp.org/specifications/79-specification-numbering&quot; rel=&quot;nofollow&quot;&gt;3GPP website&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4522" LastEditorUserId="775" LastEditDate="2014-03-11T10:15:52.857" LastActivityDate="2014-03-11T10:20:28.423" Title="Location Request (MT-LR and MO-LR) ASN.1 messages" Tags="|protocol-theory|snmp|mobile|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6699" PostTypeId="1" AcceptedAnswerId="6701" CreationDate="2014-03-07T19:16:18.687" Score="4" ViewCount="1876" Body="&lt;p&gt;Couldn't better receive sensitivity of an AP's radio possibly impact performance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say you have an AP and Wi-Fi client communicating at a relatively strong -30dBm RSSI. And the environment is filled with other 802.11 traffic, but their signals are weak (approx. -80dBm). If the AP is sensitive enough to receive down to -90dBm, then the router will spend unnecessary time processing all that background traffic, and thus decreasing the potential throughput of the client-to-AP connection, right?&lt;/p&gt;&#xA;" OwnerUserId="2360" LastActivityDate="2014-03-30T15:39:36.453" Title="Is better wireless receive sensitivity for a router/access point a good or bad thing?" Tags="|wireless|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6700" PostTypeId="1" AcceptedAnswerId="6708" CreationDate="2014-03-07T21:18:27.680" Score="3" ViewCount="443" Body="&lt;p&gt;I was reading pages 18-21 in &lt;a href=&quot;http://www.ietf.org/rfc/rfc791.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 791&lt;/a&gt; about the Internet Protocol and in the sections on Loose Source and Record Route (LSRR), and Strict Source and Record Route (SSRR), and Record Route (RR) it says that the smallest value for the pointer is 4.  To confirm my understanding of how this pointer works - is it really 1-indexed?&lt;/p&gt;&#xA;" OwnerUserId="4675" LastEditorUserId="8499" LastEditDate="2018-12-26T04:18:28.097" LastActivityDate="2018-12-26T04:18:28.097" Title="Internet Protocol. Source Routing. RFC 791. Are the addresses in the Source Routing option 1-indexed?" Tags="|routing|ip|ipv4|protocol-theory|rfc|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6701" PostTypeId="2" ParentId="6699" CreationDate="2014-03-07T22:08:28.013" Score="6" Body="&lt;p&gt;It’s not so much a matter of spending time processing unwanted signal, but that unwanted traffic is “noise” that reduces your signal to noise ratio.   Signal to noise ratio (SNR) is more important than absolute received power, and really determines the maximum transmission rate that you can reliably decode signal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The unwanted traffic (i.e. noise) causes errors in the decoding of your desired signal, causing retransmissions.  So your throughput drops off, not because your receiver is “too busy” decoding the unwanted noise (you can only decode one signal at a time), but because the noise causes decoding errors. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory, a lower sensitivity will reduce noise, but at the cost of not being able to decode weaker signals.  But even if your receiver isn’t activated by the noise, the noise can still cause distortion and errors in the received signal, especially when the signal is marginal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since 802.11 uses collision avoidance, at a certain noise threshold, the AP or station won’t transmit because it considers the channel “in use.” It will wait until the channel is idle before transmitting.  So this also reduces throughput, much like not being able to say something with a group of friends because one person won’t stop talking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also remember that the receiver’s sensitivity is measured at the center of the channel, and drops off as you move higher or lower.  So the receiver is less sensitive to interference as you move away from the center of the channel.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-07T22:08:28.013" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6708" PostTypeId="2" ParentId="6700" CreationDate="2014-03-08T07:49:22.587" Score="6" Body="&lt;p&gt;Converting my comment to an answer, as requested :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the information in &lt;a href=&quot;http://www.masterraghu.com/subjects/np/introduction/unix_network_programming_v1.3/ch27lev1sec3.html&quot; rel=&quot;noreferrer&quot;&gt;UNIX® Network Programming Volume 1, Third Edition: The Sockets Networking API, section 27.3&lt;/a&gt;  it certainly seems it is. I haven't verified this though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1cKSP.gif&quot; alt=&quot;Example diagram of a source routing header&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on this diagram and this part of the description: &quot;ptr is a pointer which contains the offset of the next IP address to be processed in the route, and we initialize it to 4, which points to the first IP address.&quot;, the &lt;code&gt;ptr&lt;/code&gt; field does indeed seem to be 1-indexed. Note that the NOP option isn't counted. The option, and therefore the counting, starts from &lt;code&gt;code&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="632" LastEditDate="2014-03-09T08:50:10.217" LastActivityDate="2014-03-09T08:50:10.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6711" PostTypeId="1" AcceptedAnswerId="6713" CreationDate="2014-03-08T16:50:39.163" Score="0" ViewCount="2158" Body="&lt;p&gt;i don't know if i have duplicated a questions..but then i still want to ask which one is more risky to be deploy in networking will it be PAT or NAT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PAT will make it risky for routing as it will redirect all traffic to the host but what if they use reverse connection..only certain ip will connect back to destination via certain port..so what will be the best solution for this issue&lt;/p&gt;&#xA;&#xA;&lt;p&gt;p/s sorry if my question is not specific enough&lt;/p&gt;&#xA;" OwnerUserId="4427" LastEditorUserId="3191" LastEditDate="2014-12-08T20:20:55.837" LastActivityDate="2014-12-08T20:20:55.837" Title="NAT vs PAT Security" Tags="|nat|security|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6713" PostTypeId="2" ParentId="6711" CreationDate="2014-03-08T22:01:06.917" Score="8" Body="&lt;p&gt;For all practical purposes, NAT and PAT provide no network security, and should not be relied on for that purpose.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, because PAT often is used with a pool of temporary addresses, a host only has a public address for as long as it is actually sending data to the Internet.  If it stops, the translation expires, and the host is no longer reachable from the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have static 1:1 translations, e.g., for a web server, there is no similar benefit.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-08T22:01:06.917" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6720" PostTypeId="1" AcceptedAnswerId="36468" CreationDate="2014-03-09T16:54:05.520" Score="2" ViewCount="401" Body="&lt;p&gt;Is it possible to use Nat/Pat to convert a full subnet of 192.168.1.0 /24 as the inside addresses to a single address of 192.168.1.1 as the outside address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would require having the same subnet on two interfaces I think?&lt;/p&gt;&#xA;" OwnerUserId="4466" LastActivityDate="2016-11-11T10:25:07.010" Title="Use nat/pat to convert a subnet to a single address in that same subnet" Tags="|nat|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6721" PostTypeId="1" CreationDate="2014-03-09T17:28:53.657" Score="1" ViewCount="127" Body="&lt;p&gt;Does NAT affect other networks on the router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have two subnets on a router and I want to access the non-natted network through natted interface.  Will it have any affect at all?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I.e.will I have any trouble accessing the normal non-natted network from r1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;r1&lt;br&gt;&#xA;|&lt;br&gt;&#xA;nat outside  network&lt;br&gt;&#xA;|&lt;br&gt;&#xA;r2-----------------------(normal network non-natted)&lt;br&gt;&#xA;|&lt;br&gt;&#xA;|&lt;br&gt;&#xA;nat inside network&lt;/p&gt;&#xA;" OwnerUserId="4466" LastActivityDate="2014-03-09T18:09:48.500" Title="Does NAT affect the other networks on the router?" Tags="|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6722" PostTypeId="2" ParentId="6721" CreationDate="2014-03-09T18:09:48.500" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; r1&#xA; |&#xA; nat outside network&#xA; |&#xA; r2-----------------------(normal network non-natted)&#xA; |&#xA; |&#xA; nat inside network&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;... will I have any trouble accessing the normal non-natted network from r1?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Assuming you are routing on all devices correctly, R1 &lt;em&gt;can access&lt;/em&gt; the &lt;code&gt;normal network non-natted&lt;/code&gt;.  To be explicit...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;nat outside network&lt;/code&gt; is 198.51.100.0/24&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;(normal network non-natted)&lt;/code&gt; is 203.0.113.0/24&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;nat inside network&lt;/code&gt; is 10.1.1.0/24&lt;/li&gt;&#xA;&lt;li&gt;R1 has a route to 203.0.113.0/24&lt;/li&gt;&#xA;&lt;li&gt;R2 has a routes to anything on or behind R1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Packet flow&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If R1 receives a packet for 203.0.113.50, it will forward the packet to R2.  R2 has a connected interface for 203.0.113.0/24, so it looks up the layer2 adjacency information for 203.0.113.50&lt;sup&gt;1&lt;/sup&gt; and forwards R1's packet to &lt;code&gt;normal network non-natted&lt;/code&gt;.  As long as 203.0.113.50 has a default pointing to R2, and R2 can reach the IP subnet which originally sourced the traffic behind R1, then there are no problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, NAT is a local operation between two interfaces on the same router / firewall.  NAT does not affect the reach-ability of interfaces that are not participating in NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;&lt;sup&gt;1&lt;/sup&gt;&lt;sub&gt;using ARP tables, if &lt;code&gt;normal network non-natted&lt;/code&gt; is Ethernet.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-03-09T18:09:48.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6723" PostTypeId="1" CreationDate="2014-03-10T00:01:30.193" Score="3" ViewCount="1731" Body="&lt;p&gt;Help me to understand such situation. It is necessary translate a little of config from Screenos to Junos.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Screenos issue:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vrouter &quot;trust-vr&quot;&#xA;set route 217.118.52.149/32 vrouter &quot;TrustGi-vr&quot; preference 20&#xA;&#xA;set vrouter &quot;TrustGi-vr&quot;&#xA;set route 172.30.2.8/29 vrouter &quot;trust-vr&quot; preference 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would translate as here.&#xA;&lt;strong&gt;Junos issue:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-instances trust-vr instance-type virtual-router&#xA;set routing-instances trust-vr routing-options static route 217.118.52.149/32 next-table TrustGi-vr.inet.0&#xA;&#xA;&#xA;set routing-instances TrustGi-vr instance-type virtual-router&#xA;set routing-instances TrustGi-vr routing-options static route 172.30.2.8/29 next-table trust-vr.inet.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it seems that everything is logical and correct, but the error appears:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit routing-instances vrf-trust routing-options static]&#xA;root# commit check &#xA;error: [rib vrf-trust.inet.0 routing-options static]&#xA;next-table may loop&#xA;error: configuration check-out failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Chance of loops in screenos nobody cared. but in Junos felt that this possibility should be avoided.&#xA;Tell me how to translate this preferably using Policy-Statements ( not rib-groups). &lt;/p&gt;&#xA;" OwnerUserId="4635" LastActivityDate="2019-12-19T03:02:00.343" Title="next-table may loop" Tags="|juniper-junos|screenos|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6729" PostTypeId="2" ParentId="6711" CreationDate="2014-03-10T11:53:37.087" Score="0" Body="&lt;p&gt;It is well known that a server is a system that offers a service.&#xA;It is also well known that a server to offer a publicly available service needs a way to be reached from the outside network (the Internet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the modern netwrok scenario having a public IP has a cost. Techniques like NAT and PAT have been introduced to make less urgent the need of a public IP address allowing a server with a private IP to be accessed from a public network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When dealing with security you are always facing with the usability. If increasing security means decreasing usability, probably, it will translate into decreasing security &lt;a href=&quot;https://security.stackexchange.com/questions/6095/xkcd-936-short-complex-password-or-long-dictionary-passphrase&quot;&gt;[reference here]&lt;/a&gt; (I'm refering to comments where you are proposing some kind of reverse tunneling).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So essentially NAT and PAT are not inherent secure or insecure. They are just means for a service to be accessed from a public net. If you are concerned with security focun on the security of the infrastructure (with a firewall for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ironically you coul see a security issue even in electricity.&lt;/p&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.953" LastActivityDate="2014-03-10T11:53:37.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6730" PostTypeId="2" ParentId="3329" CreationDate="2014-03-10T13:46:27.947" Score="2" Body="&lt;p&gt;To be as simple as possible:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;Mac Address&lt;/strong&gt; is the physical or virtual address of your NIC card or network interface. From a computer on a network's standpoint, it is the physical address of that computer's NIC card. It is used to bring information to that computer on Layer 2 of the OSI model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;IP address&lt;/strong&gt; is required on layer 3. You require it to communicate with computers on different subnets and devices.The &lt;strong&gt;IP Address&lt;/strong&gt; verifies &quot;where&quot; the device is located within a network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;IP addresses&lt;/strong&gt; and &lt;strong&gt;Mac Addresses&lt;/strong&gt; are used in tandem. &lt;strong&gt;Address Resolution Protocol&lt;/strong&gt; is used to link the two together by resolving  &lt;strong&gt;IP Addresses&lt;/strong&gt; to &lt;strong&gt;Mac Addresses&lt;/strong&gt; within the Link Layer within a single network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might want to also check &lt;a href=&quot;https://superuser.com/questions/623511/what-is-the-exact-use-of-a-mac-address&quot;&gt;here&lt;/a&gt; for a more in-depth explanation. &lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2014-03-10T15:23:09.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6732" PostTypeId="1" AcceptedAnswerId="9446" CreationDate="2014-03-10T15:06:57.383" Score="5" ViewCount="242" Body="&lt;p&gt;I am using Cisco 1921 routers.  I would like to configure them so as to limit the rate at which outbound data can flow.  The kicker is that I want this rate limit to be quite low, say 1000 bytes per &lt;i&gt;day&lt;/i&gt;.  Is there any way to do this?  Or, if not, does anyone know of a stand-alone appliance I could insert that would achieve this effect?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To clarify what I am trying to accomplish here:  The users in my shop do a lot of downloading of data, so I want no limits on incoming data.  However, I want severe limits on outgoing data so as to prevent any significant leaks of the extremely valuable information residing on my servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To clarify further: the path through the router is used exclusively for downloading.  There is no surfing going on, just cronned scripts using sftp and ftp (legacy code!).  So the outbound traffic is just whatever it takes to support the file-transfer protocol.  The 1000 bytes is not a hard limit - in fact, at this point, I'm not sure what the limit ought to be.&lt;/p&gt;&#xA;" OwnerUserId="1652" LastEditorUserId="1652" LastEditDate="2014-03-11T19:29:30.953" LastActivityDate="2014-07-18T11:22:18.237" Title="Limiting rate of traffic to a really low level" Tags="|cisco|cisco-ios|throughput|" AnswerCount="2" CommentCount="7" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6735" PostTypeId="1" AcceptedAnswerId="6774" CreationDate="2014-03-10T17:48:00.653" Score="3" ViewCount="2163" Body="&lt;p&gt;Cisco IOS provides this hidden BGP command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp &amp;lt;ASN&amp;gt;&#xA;  bgp bestpath as-path multipath-relax&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It allows the router to install multiple BGP prefixes with distinct as-path'es (but requiring same as-path length).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://blog.alwaysthenetwork.com/tutorials/bgp-multipath-relax/&quot; rel=&quot;nofollow&quot;&gt;http://blog.alwaysthenetwork.com/tutorials/bgp-multipath-relax/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does JunOS provide a similar feature?&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="59" LastEditDate="2014-03-12T09:43:31.510" LastActivityDate="2014-03-12T09:43:31.510" Title="Junos feature to accept multiple BGP paths from multiple peer AS" Tags="|cisco|bgp|juniper|cisco-ios|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6737" PostTypeId="1" AcceptedAnswerId="6738" CreationDate="2014-03-10T18:00:50.283" Score="3" ViewCount="1481" Body="&lt;p&gt;I'm confused as to how the asa handles vlans.  Currently we're running a 5520 with 4 physical ports.&lt;br&gt;&#xA;    1 inet&#xA;    1 backup inet&#xA;    1 internal&#xA;    1 dmz&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are in a position where we need to further segment the network.  Instead of buying a new asa with more physical ports we're just going to break it out by vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I've seen the only way to do this is with sub-interfaces. That works great if all my traffic comes in over 1 physical port but that's not how it will be.  We'll have hosts from multiple vlans, connected to 2 different core switches each with an uplink to the asa.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short, if I create vlan 200, 300, 400, and 500 on sub-interfaces under physical interface g0/1 then how do I deal with hosts in those vlans that will come in on say g0/2 ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or do I just have to rearrange things physically so this is all aggregated through another switch and it all hits the asa in a single physical uplink. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that makes sense. &lt;/p&gt;&#xA;" OwnerUserId="4122" LastActivityDate="2014-03-10T18:11:57.227" Title="ASA vlans on multiple physical interfaces." Tags="|cisco|cisco-asa|vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6738" PostTypeId="2" ParentId="6737" CreationDate="2014-03-10T18:11:57.227" Score="4" Body="&lt;p&gt;The ASA 5520 doesn't have the 'built-in switch' like the ASA 5505 does.  To answer your question, you would need to rearrange things...but not necessarily physically.  You don't state how the uplink is setup, but if it's switched instead of routed, you should be able to have both core switches reach the ASA without moving cables.  Alternatively, or in addition to that, I'd recommend adding a second 5520 and using active/active failover between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a related side note, you don't typically want WAN/Internet connected directly to the core anyway (following the &quot;modular network design&quot;).&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-03-10T18:11:57.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6740" PostTypeId="1" AcceptedAnswerId="6742" CreationDate="2014-03-10T18:27:45.933" Score="4" ViewCount="676" Body="&lt;p&gt;In another question, &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6733/how-will-affect-mtu-through-different-hosts#comment10956_6733&quot;&gt;Mike Pennington said&lt;/a&gt; that IP MTU should not exceed 1500 bytes when you sent packets through the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then, why there are jumbo frames? It is my understanding that 1500 was designed when ethernet networks share the same coaxial cable. But now, we can expect switches and full duplex everywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why IP MTU must not exceed 1500 bytes?&lt;/p&gt;&#xA;" OwnerUserId="4698" LastEditorUserId="36720" LastEditDate="2020-12-18T12:17:17.997" LastActivityDate="2020-12-18T12:17:17.997" Title="Internet IP MTU must not exceed 1500 bytes" Tags="|ethernet|mtu|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="6742" PostTypeId="2" ParentId="6740" CreationDate="2014-03-10T18:49:08.363" Score="9" Body="&lt;p&gt;There is a very important distinction between the Internet, and your own LAN, (or even WAN circuits.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Internet, 1500 is the max MTU. (End of discussion.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On your own LAN, (or in some cases WAN too) you can do whatever you want. As technologies expanded, 1500 MTU was no longer needed. So things like jumbo frames came into use.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2014-03-10T18:49:08.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6743" PostTypeId="1" CreationDate="2014-03-10T19:59:33.820" Score="1" ViewCount="1728" Body="&lt;p&gt;I have such topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7TWS4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to make a VPN connection from client in subnet 192.x.x.x to my OpenVPN server. But still getting such messages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mon Mar 10 16:24:00 2014 Initialization Sequence Completed&#xA;Mon Mar 10 16:26:00 2014 [OpenVPNServerTEST] Inactivity timeout (--ping-restart), restarting&#xA;Mon Mar 10 16:26:00 2014 TCP/UDP: Closing socket&#xA;Mon Mar 10 16:26:00 2014 SIGUSR1[soft,ping-restart] received, process restarting&#xA;Mon Mar 10 16:26:00 2014 Restart pause, 2 second(s)&#xA;Mon Mar 10 16:26:02 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.&#xA;Mon Mar 10 16:26:02 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables&#xA;Mon Mar 10 16:26:02 2014 Re-using SSL/TLS context&#xA;Mon Mar 10 16:26:02 2014 LZO compression initialized&#xA;Mon Mar 10 16:26:02 2014 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]&#xA;Mon Mar 10 16:26:02 2014 Socket Buffers: R=[229376-&amp;gt;131072] S=[229376-&amp;gt;131072]&#xA;Mon Mar 10 16:26:02 2014 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]&#xA;Mon Mar 10 16:26:02 2014 Local Options hash (VER=V4): '9e7066d2'&#xA;Mon Mar 10 16:26:02 2014 Expected Remote Options hash (VER=V4): '162b04de'&#xA;Mon Mar 10 16:26:02 2014 UDPv4 link local: [undef]&#xA;Mon Mar 10 16:26:02 2014 UDPv4 link remote: [AF_INET]172.16.1.111:1194&#xA;Mon Mar 10 16:27:02 2014 TLS Error: TLS key negotiation failed to occur within 60 seconds (check your network connectivity)&#xA;Mon Mar 10 16:27:02 2014 TLS Error: TLS handshake failed&#xA;Mon Mar 10 16:27:02 2014 TCP/UDP: Closing socket&#xA;Mon Mar 10 16:27:02 2014 SIGUSR1[soft,tls-error] received, process restarting&#xA;Mon Mar 10 16:27:02 2014 Restart pause, 2 second(s)&#xA;Mon Mar 10 16:27:04 2014 WARNING: No server certificate verification method has been enabled.  See http://openvpn.net/howto.html#mitm for more info.&#xA;Mon Mar 10 16:27:04 2014 NOTE: OpenVPN 2.1 requires '--script-security 2' or higher to call user-defined scripts or executables&#xA;Mon Mar 10 16:27:04 2014 Re-using SSL/TLS context&#xA;Mon Mar 10 16:27:04 2014 LZO compression initialized&#xA;Mon Mar 10 16:27:04 2014 Control Channel MTU parms [ L:1558 D:166 EF:66 EB:0 ET:0 EL:0 ]&#xA;Mon Mar 10 16:27:04 2014 Socket Buffers: R=[229376-&amp;gt;131072] S=[229376-&amp;gt;131072]&#xA;Mon Mar 10 16:27:04 2014 Data Channel MTU parms [ L:1558 D:1450 EF:58 EB:135 ET:0 EL:0 AF:3/1 ]&#xA;Mon Mar 10 16:27:04 2014 Local Options hash (VER=V4): '9e7066d2'&#xA;Mon Mar 10 16:27:04 2014 Expected Remote Options hash (VER=V4): '162b04de'&#xA;Mon Mar 10 16:27:04 2014 UDPv4 link local: [undef]&#xA;Mon Mar 10 16:27:04 2014 UDPv4 link remote: [AF_INET]172.16.1.111:1194&#xA;^C (CTRL+C)&#xA;Mon Mar 10 16:27:20 2014 event_wait : Interrupted system call (code=4)&#xA;Mon Mar 10 16:27:20 2014 TCP/UDP: Closing socket&#xA;Mon Mar 10 16:27:20 2014 /sbin/route del -net 10.8.0.1 netmask 255.255.255.255&#xA;Mon Mar 10 16:27:20 2014 /sbin/route del -net 172.16.1.0 netmask 255.255.255.0&#xA;Mon Mar 10 16:27:20 2014 /sbin/route del -net 172.16.254.0 netmask 255.255.255.0&#xA;Mon Mar 10 16:27:20 2014 Closing TUN/TAP interface&#xA;Mon Mar 10 16:27:20 2014 /sbin/ifconfig tun0 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My clients (all of them) are Xubuntu 13.10 with &lt;strong&gt;iptables rules:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Chain INPUT (policy ACCEPT)&#xA;target     prot opt source               destination       &#xA;ACCEPT     udp  --  anywhere             anywhere             state NEW udp dpt:openvpn&#xA;ACCEPT     all  --  anywhere             anywhere           &#xA;&#xA;Chain FORWARD (policy ACCEPT)&#xA;target     prot opt source               destination       &#xA;ACCEPT     all  --  anywhere             anywhere           &#xA;ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED&#xA;ACCEPT     all  --  anywhere             anywhere             state RELATED,ESTABLISHED&#xA;&#xA;Chain OUTPUT (policy ACCEPT)&#xA;target     prot opt source               destination       &#xA;ACCEPT     all  --  anywhere             anywhere&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;My client from the subnet 192.x.x.x is client3 - it cant connect to&#xA;vpn server&lt;/li&gt;&#xA;&lt;li&gt;Clients from subnet 172.x.x.x are client1 and client2 - they can&#xA;connect with OpenVPN server with no problems.&lt;/li&gt;&#xA;&lt;li&gt;My router is JSRX 210 H with out of the box configuration - without&#xA;VPN client3 (192.x.x.x) can ping client1, client2 and server&#xA;    from subnet 172.x.x.x. (everyone can ping everyone without vpn =&#xA;    full connectivity)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My client3 (192.x.x.x) config file:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;client&#xA;dev tun0&#xA;proto udp&#xA;remote 172.16.1.111 1194&#xA;resolv-retry infinite&#xA;nobind&#xA;# Downgrade privileges after initialization (non-Windows only)&#xA;;user nobody&#xA;;group nobody&#xA;persist-key&#xA;persist-tun&#xA;ca /etc/openvpn/ca.crt&#xA;cert /etc/openvpn/client3test.crt&#xA;key /etc/openvpn/client3test.key&#xA;tls-auth /etc/openvpn/ta.key 1&#xA;cipher AES-256-CBC&#xA;keepalive 10 120&#xA;comp-lzo&#xA;verb 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Config files for client1 and client2 are the same (despite the tun, client1 uses tun0, client2 uses tun1), my every client uses its own key and certificate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My server config file:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;port 1194&#xA;proto udp&#xA;dev tun0&#xA;ca ca.crt&#xA;cert OpenVPNServerTEST.crt&#xA;key OpenVPNServerTEST.key &#xA;dh dh.pem&#xA;server 10.8.0.0 255.255.255.0&#xA;ifconfig-pool-persist ipp.txt&#xA;push &quot;route 172.16.254.0 255.255.255.0&quot;&#xA;push &quot;route 172.16.1.0 255.255.255.0&quot;&#xA;keepalive 10 120&#xA;tls-auth ta.key 0&#xA;cipher AES-256-CBC   # AES&#xA;comp-lzo&#xA;;user nobody&#xA;;group nobody&#xA;persist-key&#xA;persist-tun&#xA;status openvpn-status.log&#xA;log         openvpn.log&#xA;log-append  openvpn.log&#xA;verb 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;JSRX config file:&lt;/strong&gt; &lt;a href=&quot;http://pastie.org/private/gcnclsztzwnbglzvcalhla&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pastie.org/private/gcnclsztzwnbglzvcalhla&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4703" LastEditorUserId="3191" LastEditDate="2014-12-08T20:28:40.063" LastActivityDate="2014-12-08T20:28:40.063" Title="Connect to client behind the router - Inactivity timeout [OpenVPN, Juniper SRX210H]" Tags="|vpn|juniper-srx|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6744" PostTypeId="1" CreationDate="2014-03-10T20:24:33.127" Score="3" ViewCount="1134" Body="&lt;p&gt;I am using a managed switch (e.g. 12 port) which consists of a switch engine + MIPS CPU all on one single chip. I came across a sentence while reading the switch documentation which said to get packets in and out of CPU use the FDMA driver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a layman's perspective what does it mean getting packets in and out of CPU? Does that mean all packets that ingress/egress a switch typically don't go through the CPU? If true, then what are some of the cases where you need to send the packet to a CPU?&lt;/p&gt;&#xA;" OwnerUserId="3282" LastActivityDate="2014-03-10T22:57:01.960" Title="What does getting packet in and out of CPU means from a switch standpoint" Tags="|switch|packet-path|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6745" PostTypeId="2" ParentId="6744" CreationDate="2014-03-10T21:35:19.667" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does that mean all packets that ingress/egress a switch typically don't go through the CPU?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is correct.  The point of the &lt;em&gt;switch engine&lt;/em&gt; is to move packets, at line rate, between the necessary ports.  The CPU is only used for things the switch cannot handle, or isn't setup to handle. (IGMP join/leave, spanning tree, port aggregation, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you are programming the system, you don't need to worry about any of that.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-03-10T21:35:19.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6746" PostTypeId="1" CreationDate="2014-03-10T22:03:02.103" Score="5" ViewCount="2126" Body="&lt;p&gt;I have 2 brocade switches running vrrp-extended for a specific vlan.  Connected to these 2 is an access switch with the default route set to the vrrp-extended virtual ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that I can't ping the gateway when both vrid are enabled but if I disable one of them, then the ip becomes pingable, I can ping remote ip's, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some configs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Brocade1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interface ve 510&#xA; ip address 1.1.1.2 255.255.255.240&#xA; ip vrrp-extended vrid 1&#xA;  backup&#xA;  advertise backup&#xA;  ip-address 1.1.1.1&#xA;  enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Brocade2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface ve 510&#xA; ip address 1.1.1.3 255.255.255.240&#xA; ip vrrp-extended vrid 1&#xA;  backup priority 255&#xA;  advertise backup&#xA;  ip-address 1.1.1.1&#xA;  enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyone know if I need to change anything to get it to work properly?  Keep in mind this is not regular vrrp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have both vrid's enabled but disable one of the interfaces, then things work again.  Not sure if it's related to spanning tree but it might be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The brocade switches are running 802.1w and the access switch is a cisco running rapid-pvst.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is some output with the interface on &lt;strong&gt;Brocade1&lt;/strong&gt; disabled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--- VLAN 510 [ STP Instance owned by VLAN 510 ] ----------------------------&#xA;&#xA;Bridge IEEE 802.1W Parameters:&#xA;&#xA;Bridge           Bridge Bridge Bridge Force    tx   &#xA;Identifier       MaxAge Hello  FwdDly Version  Hold &#xA;hex              sec    sec    sec             cnt  &#xA;10000012f21e8818 20     2      15     Default  3    &#xA;&#xA;RootBridge       RootPath  DesignatedBri-   Root  Max Fwd Hel &#xA;Identifier       Cost      dge Identifier   Port  Age Dly lo  &#xA;hex                        hex                    sec sec sec &#xA;10000012f21e8818 0         10000012f21e8818 Root  20  15  2   &#xA;&#xA;Port IEEE 802.1W Parameters:&#xA;&#xA;       &amp;lt;--- Config Params --&amp;gt;&amp;lt;-------------- Current state -----------------&amp;gt; &#xA;Port   Pri PortPath P2P Edge Role       State       Designa-  Designated       &#xA;Num        Cost     Mac Port                        ted cost  bridge           &#xA;2/1    128 0        F   F    DISABLED   DISABLED    0         0000000000000000 &#xA;8/21   128 20000    T   F    DESIGNATED FORWARDING  0         10000012f21e8818 &#xA;8/22   128 20000    T   F    DESIGNATED FORWARDING  0         10000012f21e8818&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ports 8/21 to 8/22 are interswitch trunk ports btw the brocade1/2 devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Brocade2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--- VLAN 510 [ STP Instance owned by VLAN 510 ] ----------------------------&#xA;&#xA;Bridge IEEE 802.1W Parameters:&#xA;&#xA;Bridge           Bridge Bridge Bridge Force    tx   &#xA;Identifier       MaxAge Hello  FwdDly Version  Hold &#xA;hex              sec    sec    sec             cnt  &#xA;8000000cdba0d219 20     2      15     Default  3    &#xA;&#xA;RootBridge       RootPath  DesignatedBri-   Root  Max Fwd Hel &#xA;Identifier       Cost      dge Identifier   Port  Age Dly lo  &#xA;hex                        hex                    sec sec sec &#xA;10000012f21e8818 20000     10000012f21e8818 5/1   20  15  2   &#xA;&#xA;Port IEEE 802.1W Parameters:&#xA;&#xA;      &amp;lt;--- Config Params --&amp;gt;|&amp;lt;------------- Current state -------------------&amp;gt;&#xA;Port  Pri PortPath  P2P Edge Role       State       Designa-  Designated       &#xA;Num       Cost      Mac Port                        ted cost  bridge           &#xA;2/2   128 200000    T   F    DESIGNATED FORWARDING  20000     8000000cdba0d219 &#xA;5/1   128 20000     T   F    ROOT       FORWARDING  0         10000012f21e8818 &#xA;5/2   128 20000     T   F    ROOT       FORWARDING  0         10000012f21e8818&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ports 5/1 to 5/2 are interswitch trunk ports btw brocade1/2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the access switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN0510&#xA;  Spanning tree enabled protocol rstp&#xA;  Root ID    Priority    4096&#xA;             Address     0012.f21e.8818&#xA;             Cost        20019&#xA;             Port        48 (FastEthernet0/48)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    61950  (priority 61440 sys-id-ext 510)&#xA;             Address     0013.80fa.0480&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;Fa0/48              Root FWD 19        128.48   P2p &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Port f0/47 is not up bc it's disabled on brocade1.&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="864" LastEditDate="2014-03-11T01:27:40.780" LastActivityDate="2014-03-11T13:34:24.017" Title="VRRP-Extended - can't ping" Tags="|ipv4|brocade|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6748" PostTypeId="2" ParentId="6744" CreationDate="2014-03-10T22:57:01.960" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;From a layman's perspective what does it mean getting packets in and out of CPU?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A switches primary function is to efficiently switch frames as fast as possible. In order to do that, they use &lt;a href=&quot;http://en.wikipedia.org/wiki/Forwarding_information_base&quot; rel=&quot;noreferrer&quot;&gt;FIB&lt;/a&gt;s to sustain a high, low latency throughput rate. This is generally achieved by using &lt;a href=&quot;http://en.wikipedia.org/wiki/Content_addressable_memory&quot; rel=&quot;noreferrer&quot;&gt;CAM&lt;/a&gt; that operates in an ASIC (i.e. hardware).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does that mean all packets that ingress/egress a switch typically don't go through the CPU? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most of the time, this is accurate.  But not always. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are packets that don’t just pass through a switch, but are destined for the switch. This requires processing.  SSH, SVI’s, STP, etc. all require some sort of CPU processing by the switch.  Whenever a switch is tasked with scrutinizing a packet further, it’s bound to take up resources that could be used elsewhere.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;what are some of the cases where you need to send the packet to a CPU?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is highly dependent on your platform.  But if it’s destined for your switch, then it’s going to require CPU processing.  Routing protocols (EIGRP/OSPF), spanning-tree protocols(RSTP/MSTP), management protocols(SNMP), remote access protocols(SSH) and discovery protocols(CDP/LLDP) are a few that initially come to mind.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-03-10T22:57:01.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6750" PostTypeId="1" AcceptedAnswerId="6751" CreationDate="2014-03-11T01:46:38.697" Score="5" ViewCount="5721" Body="&lt;p&gt;In the scenario of 802.11n 2.4GHz routers, and assuming a very simplified example of only channels 6 and 11:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Us in Building A: router on channel 6&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;-- next door --&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Building B: router on channel 6&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;-- far away --&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Building C: router on channel 11&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For best performance for us working in Building A,&#xA;will the routers share the channel 6 frequency proactively, and therefore less likely to have collisions,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OR&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it better to pick channel 11 as the router using that is far away and less likely to interfere?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially do wireless routers engage in a primitive form of TDMA (time-division multiple access) or similar?&lt;/p&gt;&#xA;" OwnerUserId="4707" LastActivityDate="2014-03-11T05:32:28.547" Title="Do wireless routers on the same channel share frequencies actively or simply collide?" Tags="|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6751" PostTypeId="2" ParentId="6750" CreationDate="2014-03-11T02:47:49.183" Score="8" Body="&lt;p&gt;If those are your only two choices, building A should be on 11 for best performance.   Access points use CSMA/CA, not TDMA.  The CA stands for collision avoidance, so they listen first before transmitting.  If they hear someone else talking (over a certain threshold), they will wait until the channel is clear before transmitting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use Ch 11, then you will not have any channel contention, since the other AP signal (bldg C) will be very low (I am assuming no other APs than what you've described).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you put bldg A on channel 6, then it will compete with bldg B for channel time, reducing throughput for both buildings.  If the signal from the adjacent building is low enough, it won't cause channel contention, but it can still lower your SNR (signal to noise ratio) and lower your throughput due to errors and retransmissions.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-11T02:47:49.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6752" PostTypeId="2" ParentId="6750" CreationDate="2014-03-11T05:32:28.547" Score="2" Body="&lt;p&gt;Since Wi-Fi uses &lt;strong&gt;CSMA/CA&lt;/strong&gt;, the bandwidth in every channel is shared, mostly with the same but also with the adjacent overlapping ones, that's why you should stick to channels 1, 6 and 11 as possible. You can easily see the impact in performance by setting up a wireless network and enabling WDS bridge in it, since it's a shared medium, max throughput will be cut in half (Theoretically, could be less).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gotta add that 802.11n standard employs &lt;strong&gt;40 Mhz&lt;/strong&gt; width channels, that means that the AP using the channel 1, could also be using the channel 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a few words, the more APs you have in the same channel, the less throughput you will have available and the error rate will be higher. &lt;/p&gt;&#xA;" OwnerUserId="4708" LastActivityDate="2014-03-11T05:32:28.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6753" PostTypeId="1" CreationDate="2014-03-11T09:11:39.707" Score="5" ViewCount="1719" Body="&lt;p&gt;In a pair of Nexus 5000, the show vpc consistency-parameters command&#xA;displays VTP trunk status on only one Nexus Enabled. The config is&#xA;identical, what is the reason for the discrepancy?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# sh vpc consistency-parameters vpc 10&#xA;&#xA;    Legend:&#xA;        Type 1 : vPC will be suspended in case of mismatch&#xA;&#xA;Name                        Type  Local Value            Peer Value&#xA;-------------               ----  ---------------------- -----------------------&#xA;Shut Lan                    1     No                     No&#xA;STP Port Type               1     Default                Default&#xA;STP Port Guard              1     None                   None&#xA;STP MST Simulate PVST       1     Default                Default&#xA;lag-id                      1     [(7f9b,                [(7f9b,&#xA;                                  0-23-4-ee-be-a, 8081,  0-23-4-ee-be-a, 8081,&#xA;                                  0, 0), (8000,          0, 0), (8000,&#xA;                                  e4-1f-13-d8-44-ea,     e4-1f-13-d8-44-ea,&#xA;                                  beef, 0, 0)]           beef, 0, 0)]&#xA;mode                        1     active                 active&#xA;Speed                       1     10 Gb/s                10 Gb/s&#xA;Duplex                      1     full                   full&#xA;Port Mode                   1     trunk                  trunk&#xA;Native Vlan                 1     1                      1&#xA;MTU                         1     1500                   1500&#xA;Admin port mode             1&#xA;VTP trunk status            2     -                      Enabled&#xA;Allowed VLANs               -     100,201                100,201&#xA;Local suspended VLANs       -     -                      -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4711" LastEditorUserId="3191" LastEditDate="2014-03-11T17:37:38.327" LastActivityDate="2015-04-17T06:05:22.037" Title="Cisco Nexus 5000 VTP trunk status in vPC consistency-parameter" Tags="|cisco|cisco-nexus-5k|vpc|cisco-nx-os|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6754" PostTypeId="2" ParentId="6698" CreationDate="2014-03-11T09:47:48.963" Score="1" Body="&lt;p&gt;The MIB below (from an older version of the 3GPP spec) includes &lt;a href=&quot;http://www.3gpp.org/ftp/specs/archive/24_series/24.080/&quot; rel=&quot;nofollow&quot;&gt;3GPP 24.080&lt;/a&gt; Mobile Terminating Location Request (MT-LR) and Mobile Originated Location Request (MO-LR) MIB objects; since SNMP uses &lt;a href=&quot;http://en.wikipedia.org/wiki/Abstract_Syntax_Notation_One&quot; rel=&quot;nofollow&quot;&gt;ASN.1&lt;/a&gt; syntax, I believe this answers your question.  This was the best non-PDF copy of the MIB that I could find...&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;!-- source: http://static.askapache.com/wireshark-1.1.3/asn1/gsmmap/SS-DataTypes.asn --&amp;gt;&#xA;&#xA;-- $Id: SS-DataTypes.asn 25094 2008-04-17 07:47:02Z stig $&#xA;-- 3GPP TS 24.080 V7.4.0 (2007-09)&#xA;-- 4.4.2    ASN.1 data types&#xA;SS-DataTypes {&#xA;   itu-t identified-organization (4) etsi (0) mobileDomain (0) gsm-Access (2) modules (3)&#xA;   ss-DataTypes (2) version10 (10)}&#xA;&#xA;DEFINITIONS&#xA;&#xA;IMPLICIT TAGS ::=&#xA;&#xA;BEGIN&#xA;&#xA;-- exports all data types defined in this module&#xA;&#xA;IMPORTS&#xA;&#xA;SS-Code&#xA;FROM MAP-SS-Code {&#xA;   itu-t identified-organization (4) etsi (0) mobileDomain (0) gsm-Network (1) modules (3)&#xA;   map-SS-Code (15) version10 (10)}&#xA;&#xA;-- imports MAP-SS-DataTypes&#xA;SS-Status, USSD-DataCodingScheme, USSD-String, CCBS-Feature&#xA;-- USSD-DataCodingScheme, USSD-String were introduced because of CNAP.&#xA;FROM MAP-SS-DataTypes {&#xA;   itu-t identified-organization (4) etsi (0) mobileDomain (0) gsm-Network (1) modules (3)&#xA;   map-SS-DataTypes (14) version10 (10)}&#xA;&#xA;GSN-Address,&#xA;CUG-Index,&#xA;NotificationToMSUser&#xA;FROM MAP-MS-DataTypes {&#xA;   itu-t identified-organization (4) etsi (0) mobileDomain (0) gsm-Network (1) modules (3)&#xA;   map-MS-DataTypes (11) version10 (10)}&#xA;&#xA;maxSignalInfoLength,&#xA;ISDN-AddressString,&#xA;ISDN-SubaddressString,&#xA;AlertingPattern,&#xA;IMSI,&#xA;LCSClientExternalID,&#xA;AddressString,&#xA;LCSServiceTypeID,&#xA;AgeOfLocationInformation&#xA;FROM MAP-CommonDataTypes {&#xA;   itu-t identified-organization (4) etsi (0) mobileDomain (0) gsm-Network (1) modules (3)&#xA;   map-CommonDataTypes (18) version10 (10)}&#xA;&#xA;LocationType,&#xA;DeferredLocationEventType,&#xA;LCSClientName,&#xA;LCS-QoS,&#xA;Horizontal-Accuracy,&#xA;ResponseTime,&#xA;Ext-GeographicalInformation, &#xA;VelocityEstimate,&#xA;SupportedGADShapes,&#xA;Add-GeographicalInformation,&#xA;LCSRequestorID,&#xA;LCS-ReferenceNumber,&#xA;LCSCodeword,&#xA;AreaEventInfo,&#xA;ReportingPLMNList,&#xA;PeriodicLDRInfo,&#xA;SequenceNumber&#xA;&#xA;FROM MAP-LCS-DataTypes {&#xA;   itu-t identified-organization (4) etsi (0) mobileDomain (0)&#xA;   gsm-Network (1) modules (3) map-LCS-DataTypes (25) version10 (10)}&#xA;&#xA;;&#xA;&#xA;-- data types definition&#xA;&#xA;SS-UserData ::= IA5String (SIZE (1.. maxSignalInfoLength))&#xA;&#xA;NotifySS-Arg ::= SEQUENCE{&#xA;    ss-Code                     [1]     SS-Code OPTIONAL,&#xA;    ss-Status                   [4]     SS-Status OPTIONAL,&#xA;    ss-Notification             [5]     SS-Notification OPTIONAL,&#xA;    callIsWaiting-Indicator     [14]    NULL OPTIONAL,&#xA;    callOnHold-Indicator        [15]    CallOnHold-Indicator OPTIONAL,&#xA;    mpty-Indicator              [16]    NULL OPTIONAL,&#xA;    cug-Index                   [17]    CUG-Index OPTIONAL,&#xA;    clirSuppressionRejected     [18]    NULL OPTIONAL,&#xA;    ... ,&#xA;    ect-Indicator               [19]    ECT-Indicator OPTIONAL,&#xA;    nameIndicator               [20]    NameIndicator OPTIONAL,&#xA;    ccbs-Feature                [21]    CCBS-Feature OPTIONAL,&#xA;    alertingPattern             [22]    AlertingPattern OPTIONAL,&#xA;    multicall-Indicator         [23]    Multicall-Indicator OPTIONAL}&#xA;&#xA;&#xA;BeginSubscriberActivityArg ::= SEQUENCE {&#xA;    imsi            IMSI,&#xA;    originatingEntityNumber ISDN-AddressString,&#xA;    msisdn                  [PRIVATE 28] AddressString OPTIONAL,&#xA;    ... }&#xA;&#xA;--  The nameIndicator is defined because of CNAP.&#xA;&#xA;Multicall-Indicator ::= ENUMERATED {&#xA;        nbr-SNexceeded (0),&#xA;        nbr-Userexceeded (1)}&#xA;&#xA;ForwardChargeAdviceArg ::= SEQUENCE{&#xA;    ss-Code                     [0]     SS-Code,&#xA;    chargingInformation         [1]     ChargingInformation,&#xA;    ...}&#xA;&#xA;SS-Notification ::= OCTET STRING (SIZE (1))&#xA;&#xA;--    Bit 8 7 6 5 4 00000 (Unused)&#xA;&#xA;--  Bit 3   Call is forwarded indication to A-subscriber&#xA;--      (calling subscriber)&#xA;--  0   No information content&#xA;--  1   Outgoing call has been forwarded to C&#xA;&#xA;--  Bit 2   Call is forwarded indication to B-subscriber&#xA;--      (forwarding subscriber)&#xA;--  0   No information content&#xA;--  1   Incoming call has been forwarded to C&#xA;&#xA;--  Bit 1   Call is forwarded indication to C-subscriber&#xA;--      (forwarded-to subscriber)&#xA;--  0   No information content&#xA;--  1   Incoming call is a forwarded call&#xA;&#xA;ChargingInformation ::= SEQUENCE{&#xA;    e1  [1] E1 OPTIONAL,&#xA;    e2  [2] E2 OPTIONAL,&#xA;    e3  [3] E3 OPTIONAL,&#xA;    e4  [4] E4 OPTIONAL,&#xA;    e5  [5] E5 OPTIONAL,&#xA;    e6  [6] E6 OPTIONAL,&#xA;    e7  [7] E7 OPTIONAL,&#xA;    ...}&#xA;&#xA;E1 ::= INTEGER (0..max10TimesUnitsPerTime)&#xA;max10TimesUnitsPerTime INTEGER ::= 8191&#xA;&#xA;E2 ::= INTEGER (0..max10TimesTimeInterval)&#xA;max10TimesTimeInterval INTEGER ::= 8191&#xA;&#xA;E3 ::= INTEGER (0..max100TimesScalingFactor)&#xA;max100TimesScalingFactor INTEGER ::= 8191&#xA;&#xA;E4 ::= INTEGER (0..max10TimesIncrement)&#xA;max10TimesIncrement INTEGER ::= 8191&#xA;&#xA;E5 ::= INTEGER (0..max10TimesIncrementPerDataInterval)&#xA;max10TimesIncrementPerDataInterval INTEGER ::= 8191&#xA;&#xA;E6 ::= INTEGER (0..maxNumberOfSegmentsPerDataInterval)&#xA;maxNumberOfSegmentsPerDataInterval INTEGER ::= 8191&#xA;&#xA;E7 ::= INTEGER (0..max10TimesInitialTime)&#xA;max10TimesInitialTime INTEGER ::= 8191&#xA;&#xA;CallOnHold-Indicator    ::= ENUMERATED {&#xA;            callRetrieved (0),&#xA;            callOnHold (1)}&#xA;&#xA;ForwardCUG-InfoArg ::= SEQUENCE {&#xA;    cug-Index           [0] CUG-Index OPTIONAL,&#xA;    suppressPrefCUG     [1] NULL OPTIONAL,&#xA;    suppressOA          [2] NULL OPTIONAL,&#xA;    ...}&#xA;&#xA;ECT-Indicator   ::= SEQUENCE {&#xA;    ect-CallState       [0] ECT-CallState,&#xA;    rdn [1] RDN OPTIONAL,&#xA;    ...}&#xA;&#xA;ECT-CallState   ::= ENUMERATED {&#xA;        alerting (0),&#xA;        active (1)}&#xA;&#xA;    NameIndicator ::= SEQUENCE {&#xA;        callingName     [0] Name OPTIONAL,&#xA;        ...}&#xA;&#xA;    Name ::= CHOICE {&#xA;        namePresentationAllowed     [0] NameSet,&#xA;        presentationRestricted      [1] NULL,&#xA;        nameUnavailable             [2] NULL,&#xA;        namePresentationRestricted  [3] NameSet}&#xA;&#xA;    NameSet ::= SEQUENCE {&#xA;        dataCodingScheme        [0] USSD-DataCodingScheme,&#xA;        lengthInCharacters      [1] INTEGER,&#xA;        nameString              [2] USSD-String,&#xA;        ...}&#xA;&#xA;-- NameIndicator, Name and NameSet are defined because of CNAP.&#xA;-- The USSD-DataCodingScheme shall indicate use of the default alphabet through the&#xA;-- following encoding:&#xA;--    bit  7   6   5   4   3   2   1   0&#xA;--       | 0   0   0   0 | 1   1   1   1|&#xA;&#xA;RDN ::= CHOICE {&#xA;    presentationAllowedAddress              [0] RemotePartyNumber,&#xA;    presentationRestricted                  [1] NULL,&#xA;    numberNotAvailableDueToInterworking     [2] NULL,&#xA;    presentationRestrictedAddress           [3] RemotePartyNumber}&#xA;&#xA;RemotePartyNumber   ::= SEQUENCE {&#xA;    partyNumber             [0] ISDN-AddressString,&#xA;    partyNumberSubaddress   [1] ISDN-SubaddressString OPTIONAL,&#xA;    ...}&#xA;&#xA;AccessRegisterCCEntryArg    ::= SEQUENCE {&#xA;    ...}&#xA;&#xA;CallDeflectionArg   ::= SEQUENCE {&#xA;    deflectedToNumber       [0] AddressString,&#xA;    deflectedToSubaddress   [1] ISDN-SubaddressString OPTIONAL,&#xA;    ...}&#xA;&#xA;UserUserServiceArg ::= SEQUENCE {&#xA;    uUS-Service     [0] UUS-Service,&#xA;    uUS-Required    [1] BOOLEAN,&#xA;    ... }&#xA;&#xA;UUS-Service ::= ENUMERATED {&#xA;    uUS1 (1),&#xA;    uUS2 (2),&#xA;    uUS3 (3),&#xA;    ... }&#xA;&#xA;-- exception handling:&#xA;-- In case of UUS-Service with any other value, indicated as &quot;UUS required&quot;,&#xA;-- but not understood by the MS, the call will be cleared.&#xA;&#xA;LocationNotificationArg ::= SEQUENCE {&#xA;    notificationType    [0] NotificationToMSUser,&#xA;    locationType        [1] LocationType,&#xA;    lcsClientExternalID [2] LCSClientExternalID     OPTIONAL,&#xA;    lcsClientName       [3] LCSClientName           OPTIONAL,&#xA;    ... ,&#xA;    lcsRequestorID      [4] LCSRequestorID          OPTIONAL,&#xA;    lcsCodeword         [5] LCSCodeword             OPTIONAL,&#xA;    lcsServiceTypeID    [6] LCSServiceTypeID        OPTIONAL }&#xA;&#xA;-- The notificationType may only be set to notifyLocationAllowed, &#xA;-- notifyAndVerify-LocationAllowedIfNoResponse, &#xA;-- or notifyAndVerify-LocationNotAllowedIfNoResponse.&#xA;-- The locationEstimateType field of the locationType may only be set to &#xA;-- currentLocation, currentOrLastKnownLocation, &#xA;-- notificationVerificationOnly, or activateDeferredLocation.&#xA;-- The deferredLocationEventType field of the locationType may only be set to &#xA;-- enteringIntoArea, and/or leavingFromArea, and/or beingInsideArea, &#xA;-- and/or periodicLDR.&#xA;-- For LCS location notification of MT-LR for current location, the &#xA;-- locationEstimateType field of the locationType shall be set to currentLocation.&#xA;-- For LCS location notification of MT-LR for current or last known location, the &#xA;-- locationEstimateType field of the locationType shall be set to currentOrLastKnownLocation.&#xA;-- For the LCS location notification for the LDR of MS available event, &#xA;-- the locationEstimateType field of the locationType shall be set to currentLocation.&#xA;-- For LCS location notification for the LDR of change of area event, &#xA;-- the locationEstimateType field of the locationType shall be set to&#xA;-- activateDeferredLocation, and the deferredLocationEventType shall be &#xA;-- set to enteringIntoArea, and/or leavingFromArea, and/or beingInsideArea.&#xA;-- For the post positioning LCS location notification, the locationEstimateType &#xA;-- field of the locationType shall be set to notificationVerificationOnly.&#xA;-- For LCS location notification for the LDR of periodic location event, &#xA;-- the locationEstimateType field of the locationType shall be set to&#xA;-- activateDeferredLocation, and the &#xA;-- deferredLocationEventType shall be set to periodicLDR.&#xA;&#xA;-- exception handling:&#xA;-- At reception of an unrecognised notificationType value the receiver shall reject the &#xA;-- operation with a return error cause of unexpected data value.&#xA;-- At reception of an unrecognised locationType value the receiver shall reject the&#xA;-- operation with a return error cause of unexpected data value. &#xA;-- At reception of an unallowed notificationType value the receiver shall either ignore the&#xA;-- received operation or reject the operation with a return error cause of unexpected &#xA;-- data value.&#xA;-- At reception of an unallowed locationType value the receiver shall either ignore the&#xA;-- received operation or reject the operation with a return error cause of unexpected &#xA;-- data value.&#xA;&#xA;&#xA;&#xA;LocationNotificationRes ::= SEQUENCE {&#xA;    verificationResponse        [0] VerificationResponse OPTIONAL,&#xA;    ...}&#xA;&#xA;VerificationResponse::= ENUMERATED {&#xA;    permissionDenied    (0),&#xA;    permissionGranted   (1),&#xA;    ... }&#xA;&#xA;-- exception handling:&#xA;-- an unrecognized value shall be treated the same as value 0 (permissionDenied)&#xA;&#xA;LCS-MOLRArg ::= SEQUENCE {&#xA;    molr-Type           [0] MOLR-Type,&#xA;    locationMethod      [1] LocationMethod          OPTIONAL,&#xA;    lcs-QoS             [2] LCS-QoS                 OPTIONAL,&#xA;    lcsClientExternalID [3] LCSClientExternalID     OPTIONAL,&#xA;    mlc-Number          [4] ISDN-AddressString      OPTIONAL,&#xA;    gpsAssistanceData   [5] GPSAssistanceData       OPTIONAL,&#xA;    ...,&#xA;    supportedGADShapes  [6] SupportedGADShapes      OPTIONAL,&#xA;    lcsServiceTypeID    [7] LCSServiceTypeID        OPTIONAL,&#xA;    ageOfLocationInfo   [8] AgeOfLocationInformation    OPTIONAL,&#xA;    locationType        [9] LocationType            OPTIONAL,&#xA;    pseudonymIndicator  [10]    NULL                    OPTIONAL,&#xA;    h-gmlc-address      [11] GSN-Address            OPTIONAL,&#xA;    locationEstimate    [12] Ext-GeographicalInformation        OPTIONAL,&#xA;    velocityEstimate    [13] VelocityEstimate       OPTIONAL,&#xA;    referenceNumber     [14] LCS-ReferenceNumber    OPTIONAL,&#xA;    periodicLDRInfo     [15] PeriodicLDRInfo        OPTIONAL,&#xA;    locationUpdateRequest   [16]    NULL                OPTIONAL,&#xA;    sequenceNumber      [17] SequenceNumber         OPTIONAL,&#xA;    terminationCause    [18] TerminationCause       OPTIONAL,&#xA;    mo-lrShortCircuit   [19]    NULL                OPTIONAL,&#xA;    ganssAssistanceData [20] GANSSAssistanceData    OPTIONAL }&#xA;-- The parameter locationMethod shall be included if and only if the molr-Type is set to value &#xA;-- deCipheringKeys or assistanceData.&#xA;-- The parameter gpsAssistanceData shall be included if and only if the molr-Type is set to value &#xA;-- assistanceData and locationMethod is set to value assistedGPS or assistedGPSandGANSS.&#xA;-- The parameter ganssAssistanceData shall be included if and only if the molr-Type is set to value &#xA;-- assistanceData and locationMethod is set to value assistedGANSS or assistedGPSandGANSS.&#xA;-- supportedGADShapes shall not be included for deferred MO-LR initiation or deferred MO-LR or MT-LR&#xA;-- responses &#xA;&#xA;MOLR-Type::= ENUMERATED {&#xA;    locationEstimate            (0),&#xA;    assistanceData              (1),&#xA;    deCipheringKeys             (2),&#xA;    ... ,&#xA;    deferredMo-lrTTTPInitiation (3),&#xA;    deferredMo-lrSelfLocationInitiation (4),&#xA;    deferredMt-lrOrmo-lrTTTPLocationEstimate (5),&#xA;    deferredMt-lrOrmo-lrCancellation (6)}&#xA;-- exception handling:&#xA;-- an unrecognized value shall be rejected by the receiver with a return error cause of&#xA;-- unexpected data value.&#xA;&#xA;LocationMethod::= ENUMERATED {&#xA;    msBasedEOTD         (0),&#xA;    msAssistedEOTD      (1),&#xA;    assistedGPS         (2),&#xA;    ...,&#xA;    msBasedOTDOA        (3),&#xA;    assistedGANSS       (4),&#xA;    assistedGPSandGANSS (5)&#xA;    }&#xA;-- exception handling:&#xA;-- When this parameter is received with value msBasedEOTD or msAssistedEOTD and the MS &#xA;-- is camped on an UMTS Service Area then the receiver shall reject it &#xA;-- with a return error cause of unexpected data value.&#xA;-- When this parameter is received with value msBasedOTDOA and the MS &#xA;-- is camped on a GSM Cell then the receiver shall reject it with a return error cause of&#xA;-- unexpected data value.&#xA;-- an unrecognized value shall be rejected by the receiver with a return error cause of&#xA;-- unexpected data value.&#xA;&#xA;GPSAssistanceData::= OCTET STRING (SIZE (1..38))&#xA;-- Octets 1 to 38 are coded in the same way as the octets 3 to 7+2n of Requested GPS Data IE&#xA;-- in 3GPP TS 49.031 [14].&#xA;&#xA;GANSSAssistanceData::= OCTET STRING (SIZE (1..40))&#xA;-- Octets 1 to 40 are coded in the same way as the octets 3 to 9+2n of Requested GANSS Data IE&#xA;-- in 3GPP TS 49.031 [14] .&#xA;&#xA;TerminationCause ::= ENUMERATED {&#xA;    subscriberTermination  (0),&#xA;    uETermination     (1),&#xA;    ...} &#xA;&#xA;&#xA;LCS-MOLRRes::= SEQUENCE {&#xA;    locationEstimate        [0] Ext-GeographicalInformation     OPTIONAL,&#xA;    decipheringKeys         [1] DecipheringKeys                 OPTIONAL,&#xA;    ...,&#xA;    add-LocationEstimate    [2] Add-GeographicalInformation         OPTIONAL,&#xA;    velocityEstimate        [3] VelocityEstimate        OPTIONAL,&#xA;    referenceNumber         [4] LCS-ReferenceNumber     OPTIONAL,&#xA;    h-gmlc-address          [5] GSN-Address             OPTIONAL,&#xA;    mo-lrShortCircuit       [6] NULL                    OPTIONAL,&#xA;    reportingPLMNList       [7] ReportingPLMNList       OPTIONAL&#xA;     }&#xA;-- Parameters locationEstimate or add-LocationEstimate (one but not both) &#xA;-- shall be included if and only if the &#xA;-- molr-Type in LocationRequestArg was set to value locationEstimate.&#xA;-- Parameter add-LocationEstimate shall not be included if the supportedGADShapes &#xA;-- parameter was not received in the LCS-MOLRArg.&#xA;-- The locationEstimate and the add-locationEstimate parameters shall not be sent if&#xA;-- the supportedGADShapes parameter has been received in LCS-MOLRArg&#xA;-- and the shape encoded in locationEstimate or add-LocationEstimate is not marked&#xA;-- as supported in supportedGADShapes. In such a case LCS-MOLRArg&#xA;-- shall be rejected with error FacilityNotSupported with additional indication&#xA;-- shapeOfLocationEstimateNotSupported.&#xA;-- Parameter decipheringKeys shall be included if and only if the molr-Type&#xA;-- in LocationRequestArg was set to value deCipheringKeys.&#xA;-- Parameter velocityEstimate may only be included if the lcs-QoS in LCS-MOLRarg includes&#xA;-- velocityRequest&#xA;&#xA;&#xA;DecipheringKeys::= OCTET STRING (SIZE (15))&#xA;-- Octets in DecipheringKeys are coded in the same way as the octets 3 to 17 of Deciphering Key IE&#xA;-- in 3GPP TS 49.031 [14]. I.e. these octets contain Current Deciphering Key, Next Deciphering Key and &#xA;-- Ciphering Key Flag.&#xA;LCS-AreaEventRequestArg ::= SEQUENCE {&#xA;    referenceNumber             [0] LCS-ReferenceNumber,&#xA;    h-gmlc-address              [1] GSN-Address,&#xA;    deferredLocationEventType   [3] DeferredLocationEventType,&#xA;    areaEventInfo               [4] AreaEventInfo,&#xA;    ... }&#xA;&#xA;-- the msAvailableValue in the DeferredLocationEventType is not applicable for this procedure &#xA;&#xA;LCS-AreaEventReportArg  ::= SEQUENCE {&#xA;    referenceNumber             [0] LCS-ReferenceNumber,&#xA;    h-gmlc-address              [1] GSN-Address,&#xA;    ... }&#xA;&#xA;LCS-AreaEventCancellationArg    ::= SEQUENCE {&#xA;    referenceNumber             [0] LCS-ReferenceNumber,&#xA;    h-gmlc-address              [1] GSN-Address,&#xA;    ... }&#xA;&#xA;&#xA;LCS-PeriodicLocationRequestArg  ::= SEQUENCE {&#xA;    referenceNumber     [0] LCS-ReferenceNumber,&#xA;    periodicLDRInfo     [1] PeriodicLDRInfo,&#xA;    lcsClientExternalID [2] LCSClientExternalID,&#xA;    qoS                 [3] LCS-QoS                 OPTIONAL,&#xA;    h-gmlc-address      [4] GSN-Address             OPTIONAL,&#xA;    mo-lrShortCircuit   [5] NULL                    OPTIONAL,&#xA;    reportingPLMNList   [6] ReportingPLMNList       OPTIONAL,&#xA;    ... }&#xA;&#xA;&#xA;LCS-PeriodicLocationRequestRes  ::= SEQUENCE {&#xA;    mo-lrShortCircuit   [0] NULL                    OPTIONAL,&#xA;    ... }&#xA;&#xA;&#xA;LCS-LocationUpdateArg   ::= SEQUENCE {&#xA;    referenceNumber     [0] LCS-ReferenceNumber     OPTIONAL,&#xA;    add-LocationEstimate[1] Add-GeographicalInformation         OPTIONAL,&#xA;    velocityEstimate    [2] VelocityEstimate        OPTIONAL,&#xA;    sequenceNumber      [3] SequenceNumber          OPTIONAL,&#xA;    ... }&#xA;-- add-LocationEstimate shall be included if and only if a location estimate was successfully&#xA;-- transferred towards an External LCS Client or was successfully obtained for UE self location&#xA;-- velocityEstimate may only be included if add-LocationEstimate is included&#xA;&#xA;LCS-LocationUpdateRes   ::= SEQUENCE {&#xA;    terminationCause    [0] TerminationCause        OPTIONAL,&#xA;    ... }&#xA;&#xA;LCS-PeriodicLocationCancellationArg ::= SEQUENCE {&#xA;    referenceNumber     [0] LCS-ReferenceNumber,&#xA;    h-gmlc-address      [1] GSN-Address             OPTIONAL,&#xA;    ... }&#xA;&#xA;&#xA;END&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-03-11T10:20:28.423" LastActivityDate="2014-03-11T10:20:28.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6755" PostTypeId="1" AcceptedAnswerId="31971" CreationDate="2014-03-11T11:31:15.697" Score="8" ViewCount="4329" Body="&lt;p&gt;When upgrading Arista switches which are part of an MLAG cluster, is it necessary to start with the secondary switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &quot;Arista Warrior&quot;, from Gary A. Donahue, he specifies on page 123 to start by upgrading the secondary switch. But there is nothing like that on the official documentation, page 710 (for version 4.13.2F).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, is there a way (even if it's not necessary) to force one of the members to become primary? I found the command &lt;code&gt;primary-priority&lt;/code&gt; &lt;a href=&quot;https://eos.aristanetworks.com/2011/06/mlag-advanced-configuration/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;, but the command does not exist on my switch.&lt;/p&gt;&#xA;" OwnerUserId="564" LastEditorUserId="5848" LastEditDate="2015-07-10T19:35:02.590" LastActivityDate="2017-10-05T14:52:56.080" Title="Arista MLAG ISSU upgrade - primary/secondary switch?" Tags="|arista|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6757" PostTypeId="2" ParentId="6746" CreationDate="2014-03-11T13:34:24.017" Score="3" Body="&lt;p&gt;Here is what I had to do to get it to work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had to disable 802.1w on the trunk ports specifically (2/1 and 2/2) under the default vlan on both brocade switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So spanning-tree is enabled for the actual vlan 510 and the default vlan 50 is disabled on the two ports that go to the cisco switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then everything started to work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now I have this in the configs on the brocades:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 50 name DEFAULT-VLAN by port&#xA; spanning-tree 802-1w&#xA; spanning-tree 802-1w ethe 2/1 disable&#xA;&#xA;vlan 50 name DEFAULT-VLAN by port&#xA; spanning-tree 802-1w&#xA; spanning-tree 802-1w ethe 2/2 disable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not sure if this is recommended or not though.&lt;/p&gt;&#xA;" OwnerUserId="864" LastActivityDate="2014-03-11T13:34:24.017" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6759" PostTypeId="2" ParentId="3830" CreationDate="2014-03-11T16:22:57.980" Score="2" Body="&lt;p&gt;These are &lt;a href=&quot;http://en.wikipedia.org/wiki/Bridge_Protocol_Data_Units_%28EN%29&quot; rel=&quot;nofollow&quot;&gt;BPDU&lt;/a&gt;s sent from the switch to detect another device that's also transmitting BPDUs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't want your switch transmitting these and you have a cisco device, place this configuration on any applicable switchports.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/1&#xA; description NO_BPDU_PORT&#xA; switchport mode access&#xA; spanning-tree portfast&#xA; spanning-tree bpdufilter enable&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just understand that if a device is plugged into one of those ports, your switch won't allow it to participate in STP and will likely wreak havoc on your network.  Check out the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4000/8-2glx/configuration/guide/stp_enha.html&quot; rel=&quot;nofollow&quot;&gt;Cisco docs&lt;/a&gt; for additional information.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-03-11T16:22:57.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6762" PostTypeId="1" AcceptedAnswerId="6763" CreationDate="2014-03-11T19:09:43.257" Score="5" ViewCount="3308" Body="&lt;p&gt;First, do 'Octets' in &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=ifInOctets&quot; rel=&quot;nofollow&quot;&gt;ifInOctets&lt;/a&gt;  and &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.2.2.1.16#oidContent&quot; rel=&quot;nofollow&quot;&gt;ifOutOctets&lt;/a&gt; actually refer to packets?  Can someone explain in detail? Also, if I want to measure the traffic flowing between certain set of nodes, how do I achieve it using SNMP? I saw a few links leading to MIB II and RMON. Is there some other way too? Can I measure the traffic delay, number of dropped packets, bandwidth of the network, load balancing parameters and related parameters using SNMP MIBs? &lt;/p&gt;&#xA;" OwnerUserId="4094" LastEditorUserId="3191" LastEditDate="2014-12-08T20:21:11.227" LastActivityDate="2014-12-08T20:21:11.227" Title="Measurement of Traffic Parameters using SNMP" Tags="|snmp|management|load-balancer|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6763" PostTypeId="2" ParentId="6762" CreationDate="2014-03-11T19:43:49.283" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;First, do 'Octets' in ifInOctets and ifOutOctets actually refer to packets? Can someone explain in detail?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ifInOctets&lt;/code&gt; and &lt;code&gt;ifOutOctets&lt;/code&gt; refer to &lt;em&gt;bytes&lt;/em&gt; received and transmitted (respectively) by the interfaces indexed to &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.2.2.1.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;ifIndex&lt;/a&gt; / &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.31.1.1.1.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;ifName&lt;/a&gt;; &lt;code&gt;ifInOctets&lt;/code&gt; and &lt;code&gt;ifOutOctets&lt;/code&gt; use 32 bit wide values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you're polling interfaces at 100Mbps or lower, I'd strongly recommending using &lt;em&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=ifHCInOctets&quot; rel=&quot;nofollow noreferrer&quot;&gt;ifHCInOctets&lt;/a&gt;&lt;/em&gt; and &lt;em&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=ifHCOutOctets&quot; rel=&quot;nofollow noreferrer&quot;&gt;ifHCOutOctets&lt;/a&gt;&lt;/em&gt;, which are 64-bit values.  The difference is important... for instance a 1GE interface at full TX rate will wrap the 32-bit &lt;code&gt;ifOutOctets&lt;/code&gt; counters in &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/26007-faq-snmpcounter.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;34 seconds&lt;/a&gt;; that's faster than most people will poll them.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;32 bit counters @ 10Mbps wrap in 57 minutes&lt;/li&gt;&#xA;&lt;li&gt;32 bit counters @ 100Mbps wrap in 5 minutes, 42 seconds&lt;/li&gt;&#xA;&lt;li&gt;32 bit counters @ 1000Mbps wrap in &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/26007-faq-snmpcounter.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;34 seconds&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you want to count packets, use &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.31.1.1.1.7#oidContent&quot; rel=&quot;nofollow noreferrer&quot;&gt;ifHCInUcastPkts&lt;/a&gt; and &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=true&amp;amp;objectInput=ifHCOutUcastPkts&quot; rel=&quot;nofollow noreferrer&quot;&gt;ifHCOutUcastPkts&lt;/a&gt;.  &lt;code&gt;HC&lt;/code&gt; means they are 64-bits wide... not all SNMP objects need this much space, but high-speed interfaces do.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, if I want to measure the traffic flowing between certain set of nodes, how do I achieve it using SNMP? I saw a few links leading to MIB II and RMON. Is there some other way too? Can I measure the traffic delay, number of dropped packets, bandwidth of the network, load balancing parameters and related parameters using SNMP MIBs? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can't measure traffic between two servers with SNMP unless there is &lt;em&gt;nothing&lt;/em&gt; else transmitting to the same servers (i.e. very unlikely).  The best options for measuring between endpoints are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ntop.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ntop&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;netflow&lt;/a&gt; / &lt;a href=&quot;http://www.sflow.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;sflow&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;wireshark&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Delay / average packet loss over time is best measured from the hosts with &lt;a href=&quot;http://www.bitwizard.nl/mtr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;mtr&lt;/a&gt; or &lt;a href=&quot;http://winmtr.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;winmtr&lt;/a&gt;.  It's pretty hard to measure exact packet loss for individual streams unless you post-process files from &lt;a href=&quot;http://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;wireshark&lt;/a&gt; with a script (and you'll have to code that by hand).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you ask about load-balancing parameters, I'm not sure what you mean.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Passive available bandwidth measurement can be done with &lt;a href=&quot;https://stackoverflow.com/a/6209852/667301&quot;&gt;yaz&lt;/a&gt;.  Active measurement isn't a likely use-case given your requests, but use &lt;a href=&quot;http://iperf.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;iperf2&lt;/a&gt;, or &lt;a href=&quot;https://github.com/esnet/iperf&quot; rel=&quot;nofollow noreferrer&quot;&gt;iperf3&lt;/a&gt; for that.  As of a year ago when I last tried it, &lt;a href=&quot;https://github.com/esnet/iperf&quot; rel=&quot;nofollow noreferrer&quot;&gt;iperf3&lt;/a&gt; was still a bit rough around the edges in my experience... I still like &lt;a href=&quot;http://iperf.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;iperf2&lt;/a&gt;, but if I don't mention it someone will complain.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2014-03-11T19:49:27.947" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6765" PostTypeId="1" CreationDate="2014-03-11T21:07:32.480" Score="1" ViewCount="130" Body="&lt;p&gt;One of the most notable feature of &lt;a href=&quot;http://www.net-snmp.org/&quot; rel=&quot;nofollow&quot;&gt;NetSnmp&lt;/a&gt; is the possibility to extend an OID tree running aribtrary commands using the extend and the pass persist &lt;a href=&quot;http://www.net-snmp.org/wiki/index.php/Tut%3aExtending_snmpd_using_shell_scripts&quot; rel=&quot;nofollow&quot;&gt;methods&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if there is such a fuature also in Cisco devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example is possible to answer with the hitcout of an ACL? Is so, how to choose the OID? To my knowledge there is not a private branch for custom OIDs.&lt;/p&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="2663" LastEditDate="2014-03-12T14:50:11.380" LastActivityDate="2014-03-12T14:50:11.380" Title="Is it possible to extend Cisco's MIB tree?" Tags="|cisco|monitoring|snmp|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6767" PostTypeId="1" CreationDate="2014-03-11T22:55:54.460" Score="1" ViewCount="884" Body="&lt;p&gt;I have 2 branch offices connecting together via a metro-e and I'm running an ipsec gre tunnel between the 2 sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;routerA=branch1&#xA;routerB=branch2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN-------routerA----------|metroe|------------routerB----device&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device is marked as AF41 and its going out via the WAN connection. The service policy only exist on the routerA. What I want to achieve is to dscp trust the link between routerA and routerB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure how to do this whether should I set qos-preclassify command under the tunnel interface or under the crypto map it will act as the same way as mls qos trust dscp or what would be the easiest way to do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="3916" LastActivityDate="2018-07-18T17:58:54.793" Title="DSCP trust over IPSec GRE" Tags="|qos|ipsec|gre|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6768" PostTypeId="1" CreationDate="2014-03-12T05:33:29.240" Score="5" ViewCount="3136" Body="&lt;p&gt;I have a single /24 IP network. I want to make a VLAN (or something) and distribute a single IP and gateway per client. Each client should not be able to talk to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using MikroTik router and a Cisco 2950 layer 2 switch.&lt;/p&gt;&#xA;" OwnerUserId="3714" LastEditorUserId="3191" LastEditDate="2014-12-08T20:19:42.067" LastActivityDate="2014-12-08T20:19:42.067" Title="Single client per VLAN in /24 network" Tags="|vlan|private-vlan|" AnswerCount="4" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6772" PostTypeId="2" ParentId="5825" CreationDate="2014-03-12T06:40:44.177" Score="4" Body="&lt;p&gt;As others have pointed out, &lt;strong&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt;&lt;/strong&gt; defines 3 private IP ranges. In 1996, there was still legacy equipment around that didn't support &lt;a href=&quot;https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing&quot; rel=&quot;nofollow noreferrer&quot;&gt;CIDR&lt;/a&gt;, so one range was created for each class. Class B addresses start at 128.0.0.0, and class C addresses start at 192.0.0.0; 168 was chosen just because it was unallocated.&lt;/p&gt;&#xA;&lt;p&gt;But this raises another question — why was a class C range required? Since the only difference between classes A, B and C is the network size, why not just use 10.0.0.0/8? According to RFC1918:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If a suitable subnetting scheme can be designed and is supported by the equipment concerned, it is advisable to use the 24-bit block (class A network) of private address space and make an addressing plan with a good growth path. If subnetting is a problem, the 16-bit block (class C networks), or the 20-bit block (class B networks) of private address space can be used.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I'm not sure exactly what kind of &amp;quot;problems&amp;quot; with subnetting the authors were thinking of. Perhaps some pre-CIDR hardware didn't support Class A networks due to memory constraints (though you would think it's the number of hosts, not the number of &lt;em&gt;potential&lt;/em&gt; hosts, that matters).&lt;/p&gt;&#xA;&lt;p&gt;Also, class C networks are /24s, even though 192.168.x.x is a /16 — so in classful networking 192.168.x.x actually contains 256 subnets. This may have been useful for large organisations that wanted to run private subnets on pre-CIDR hardware.&lt;/p&gt;&#xA;" OwnerUserId="4726" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2014-03-12T06:54:05.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6773" PostTypeId="1" AcceptedAnswerId="6815" CreationDate="2014-03-12T08:42:20.917" Score="14" ViewCount="21547" Body="&lt;p&gt;I have knowledge terminating CAT5 UTP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, for an installation in a remote office, the cable will be routed near a power source which we already know causes a substantial amount of 'noise' on standard telecom cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have purchased some CAT5e STP cable (screened) for this particular run. It will be running from the patch cabinet, past the power source (industrial equipment) and out of the building (a run of a few feet) to a 'porta cabin' (where the power feed also goes to).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the same power source will be powering both ends of the installation, I understand we won't have problems with earth differential.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As our 'porta cabin' only has 2 PC's, we are not planning to put a patch cabinet in there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I terminate the STP cable to a socket and run a standard patch cable that side to a small switch (and then cables to the PC's) would I need some way to earth it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The patch cabinet side would also be terminated to a socket (with patch cable going to main switch (with fibre link to our main office)). I have no STP RJ45 terminations (only standard UTP). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I was to run an earth wire from the STP shield/screen to the patch cabinet would that be enough (cabinet grounded through equipment connected to a UPS)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also look to use ferrite chokes on the cable (to negate any outside RF interference it would pick up) if we found problems.&lt;/p&gt;&#xA;" OwnerUserId="4714" LastEditorUserId="453" LastEditDate="2018-05-11T00:08:28.523" LastActivityDate="2018-05-11T00:08:28.523" Title="Shielded Twisted Pair (STP) termination and grounding" Tags="|ethernet|cabling|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="6774" PostTypeId="2" ParentId="6735" CreationDate="2014-03-12T09:37:57.880" Score="4" Body="&lt;p&gt;Yes, &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos11.4/topics/reference/configuration-statement/multipath-edit-protocols-bgp.html&quot; rel=&quot;nofollow&quot;&gt;it is possible&lt;/a&gt;. Use the &lt;code&gt;multiple-as&lt;/code&gt; option for the &lt;code&gt;multipath&lt;/code&gt; setting like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols bgp group MY-PEERS multipath multiple-as&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-03-12T09:37:57.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6775" PostTypeId="2" ParentId="6768" CreationDate="2014-03-12T13:01:19.693" Score="5" Body="&lt;p&gt;Cisco Catalyst switches have the concept of private vlans which should accomplish what you are trying to do.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In some situations, you need to prevent Layer 2 (L2) connectivity&#xA;  between end devices on a switch without the placement of the devices&#xA;  in different IP subnets. This setup prevents the waste of IP&#xA;  addresses. Private VLANs (PVLANs) allow the isolation at Layer 2 of&#xA;  devices in the same IP subnet. You can restrict some ports on the&#xA;  switch to reach only specific ports [snip].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This document should work for 2960 model switches as well:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/private-vlans-pvlans-promiscuous-isolated-community/40781-194.html&quot; rel=&quot;nofollow&quot;&gt;Configuring Isolated Private VLANs on Catalyst Switches&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="266" LastEditorUserId="266" LastEditDate="2014-03-13T14:31:56.257" LastActivityDate="2014-03-13T14:31:56.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6782" PostTypeId="1" AcceptedAnswerId="6792" CreationDate="2014-03-12T18:46:58.847" Score="5" ViewCount="18074" Body="&lt;p&gt;I am well aware of Ethernet DIX format.  But, the role of SSAP (Source Service Access Point) and DSAP (Destination Service Access Point) in IEEE802.3 Ethernet frame  is confusing and always expressed in high profile.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do these actually help?&lt;/p&gt;&#xA;" OwnerUserId="442" LastEditorUserId="775" LastEditDate="2019-04-08T10:39:27.710" LastActivityDate="2019-04-08T10:39:27.710" Title="Role of SSAP and DSAP in Ethernet DIX frame format" Tags="|ethernet|protocol-theory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="6783" PostTypeId="1" AcceptedAnswerId="6821" CreationDate="2014-03-12T19:53:02.520" Score="2" ViewCount="166" Body="&lt;p&gt;My problem is the firewall is only recording DNS requests from my local DNS server instead of the source computer. I would like to keep using my local DNS server with External DNS servers being the backup but i also need the firewall to collect stats correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It collects correctly when external DNS servers are used but i can't use local names then for shares and such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thoughts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Windows DNS Server 2012&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sonicwall 240 (Firewall)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;clients are all windows 7 machines.&lt;/p&gt;&#xA;" OwnerUserId="4742" LastEditorUserId="4742" LastEditDate="2014-03-12T20:13:03.410" LastActivityDate="2014-04-13T19:27:39.820" Title="Local DNS server + Firewall for reporting Setup" Tags="|firewall|dns|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6784" PostTypeId="1" AcceptedAnswerId="6786" CreationDate="2014-03-12T20:25:11.533" Score="8" ViewCount="7373" Body="&lt;p&gt;My goal is to write a service check that pulls the status of a Cisco track list that is performing a &lt;code&gt;Boolean OR&lt;/code&gt;. I have a screen scraper in place currently, but that is really not ideal in terms of scaling this type of service check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The track object below simply pulls out the tracked static route if &lt;code&gt;object 10&lt;/code&gt; and &lt;code&gt;object 20&lt;/code&gt; are both unreachable, allowing a BGP learned default route to be installed, that is otherwise in RIB-failure status.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration Example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;track 10 ip sla 1 reachability&#xA;!&#xA;track 20 ip sla 2 reachability&#xA;!&#xA;track 30 list boolean or&#xA; object 10&#xA; object 20&#xA;!&#xA;ip sla 1&#xA; icmp-echo 8.8.8.8 source-ip 10.10.10.10&#xA;ip sla schedule 1 life forever start-time now&#xA;ip sla 2&#xA; icmp-echo 4.2.2.2 source-ip 10.10.10.10&#xA;ip sla schedule 2 life forever start-time now&#xA;&#xA;ip route 0.0.0.0 0.0.0.0 10.10.10.1 track 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It would be ideal to pull either the number of changes or the &lt;code&gt;Boolean OR&lt;/code&gt; status (up or down) from an OID.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HOSTNAME#show track 30&#xA;Track 30&#xA;  List boolean or&#xA;  Boolean OR is Up&#xA;    14716 changes, last change 02:18:47&#xA;    object 10 Up&#xA;    object 20 Up&#xA;  Tracked by:&#xA;    STATIC-IP-ROUTINGTrack-list 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've been digging through the Google machine, forums and the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do&quot; rel=&quot;noreferrer&quot;&gt;Cisco SNMP Object Navigator&lt;/a&gt; to no avail.&lt;/p&gt;&#xA;" OwnerUserId="2476" LastEditorUserId="775" LastEditDate="2014-03-12T23:48:45.340" LastActivityDate="2015-01-04T16:15:18.347" Title="Is there an SNMP MIB for Cisco Track Objects" Tags="|routing|snmp|management|failover|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6785" PostTypeId="1" AcceptedAnswerId="20777" CreationDate="2014-03-12T21:41:06.620" Score="6" ViewCount="3808" Body="&lt;p&gt;OK, this one may technically be off-topic since I'm actually doing this at home, but I could easily see the exact same scenario arises in a small enterprise type of setup...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using an SRX210 to be a router for a Time Warner Cable connection (using a DOCSIS mini-pim on the SRX, but I don't think that's actually relevant to this).  Running 12.1X46-D10.2.  Trying to get IPv6 working on the cable setup (confirmed that TWC is providing IPv6 via DHCPv6 in our area).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I've got in relevant config sections (if you want to see any other parts of the config, feel free to ask, but I think I've gotten everything relevant):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    cm-1/0/0 {                          &#xA;        unit 0 {                        &#xA;            family inet {               &#xA;                dhcp-client;            &#xA;            }                           &#xA;            family inet6 {              &#xA;                dad-disable;            &#xA;                dhcpv6-client {         &#xA;                    client-type statefull;&#xA;                    client-ia-type ia-na;&#xA;                    client-ia-type ia-pd;&#xA;                    rapid-commit;       &#xA;                    client-identifier duid-type duid-llt;&#xA;                    req-option dns-server;&#xA;                    req-option fqdn;    &#xA;                    retransmission-attempt 9;&#xA;                }                       &#xA;            }                           &#xA;        }                               &#xA;    }&#xA;}&#xA;&#xA;security {                              &#xA;    forwarding-options {                &#xA;        family {                        &#xA;            inet6 {                     &#xA;                mode flow-based;        &#xA;            }                           &#xA;        }                               &#xA;    }&#xA;    zones {                                                           &#xA;        security-zone untrust {         &#xA;            interfaces {                &#xA;                cm-1/0/0.0 {            &#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            dhcp;       &#xA;                            dns;        &#xA;                            ntp;        &#xA;                            ping;       &#xA;                            ssh;        &#xA;                            traceroute; &#xA;                            dhcpv6;     &#xA;                            bootp;      &#xA;                        }               &#xA;                        protocols {     &#xA;                            router-discovery;&#xA;                        }               &#xA;                    }                   &#xA;                }                       &#xA;            }                           &#xA;        }                               &#xA;    }                                   &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&quot;show dhcpv6 client statistics&quot; shows DHCPV6_SOLICIT messages being sent, but absolutely nothing else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know dhcpv6 client support in the SRXen is very new, but does anyone else have any experience troubleshooting this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One hypothesis that I'm trying to check is that it apparently is sending the DHCP request with an IAID (whether for the IA-NA or IA-PD) of 0x00000000.  Perhaps TWCs DHCPv6 server doesn't like that value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any ideas?&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2016-10-21T18:15:29.583" Title="DHCPv6 (with PD) client on Juniper SRX" Tags="|ipv6|juniper-srx|srx|dhcpv6|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6786" PostTypeId="2" ParentId="6784" CreationDate="2014-03-12T23:35:35.807" Score="8" Body="&lt;p&gt;I don't believe there is a way to directly poll the results of the &lt;code&gt;OR&lt;/code&gt; via SNMP, but you can certainly poll for the IP SLA results and calculate it yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.42&quot;&gt;CISCO-RTTMON-MIB&lt;/a&gt; (1.3.6.1.4.1.9.9.42), you can check the timeout value of your reachability checks, take the true/false value it returns and do the &lt;code&gt;OR&lt;/code&gt; in whatever scripting language you're using to poll via SNMP.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For example, I setup a similar test to yours above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;track 10 ip sla 1 reachability&#xA;!&#xA;track 20 ip sla 2 reachability&#xA;!&#xA;track 30 list boolean or&#xA; object 10&#xA; object 20&#xA;!&#xA;ip sla 1&#xA; icmp-echo 8.8.8.8 source-ip 10.129.10.62&#xA;ip sla schedule 1 life forever start-time now&#xA;ip sla 2&#xA; icmp-echo 4.2.2.2 source-ip 10.129.10.62&#xA;ip sla schedule 2 life forever start-time now&#xA;!&#xA;ip route 10.171.20.0 255.255.255.252 10.129.10.61 track 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I verified the output in IOS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R-VOIPLAB#show track 30&#xA;Track 30&#xA;  List boolean or&#xA;  Boolean OR is Up&#xA;    2 changes, last change 00:01:21&#xA;    object 10 Up&#xA;    object 20 Up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Next, with the IP SLA tracking in place, I installed the CISCO-RTTMON-MIB on my monitoring server, and walked the value of &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.42.1.2.9.1.6#oidContent&quot;&gt;rttMonCtrlOperTimeoutOccurred&lt;/a&gt; (1.3.6.1.4.1.9.9.42.1.2.9.1.6) for it's True/False output. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key item to note is that since we are polling whether a timeout occurred or not, that &lt;strong&gt;False means that the destination is reachable&lt;/strong&gt;, and &lt;strong&gt;True means that it is not reachable and a timeout has occurred&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpwalk -v3 -a SHA -A SNMP-AUTH-PASS -l authNoPriv -u SNMPUSER r-voiplab rttMonCtrlOperTimeoutOccurred&#xA;CISCO-RTTMON-MIB::rttMonCtrlOperTimeoutOccurred.1 = INTEGER: false(2)&#xA;CISCO-RTTMON-MIB::rttMonCtrlOperTimeoutOccurred.2 = INTEGER: false(2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, I blackholed traffic to 8.8.8.8 from that box, and checked the Track results in IOS again:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R-VOIPLAB(config)#ip route 8.8.8.8 255.255.255.255 null 0&#xA;R-VOIPLAB(config)#end&#xA;R-VOIPLAB#show track 30&#xA;Track 30&#xA;  List boolean or&#xA;  Boolean OR is Up&#xA;    2 changes, last change 00:21:18&#xA;    object 10 Down&#xA;    object 20 Up&#xA;  Tracked by:&#xA;    STATIC-IP-ROUTING 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now that we have one of the test objects in a &lt;code&gt;Down&lt;/code&gt; state, let us see the results of polling rttMonCtrlOperTimeoutOccurred again:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpwalk -v3 -a SHA -A SNMP-AUTH-PASS -l authNoPriv -u SNMPUSER r-voiplab rttMonCtrlOperTimeoutOccurred&#xA;CISCO-RTTMON-MIB::rttMonCtrlOperTimeoutOccurred.1 = INTEGER: true(1)&#xA;CISCO-RTTMON-MIB::rttMonCtrlOperTimeoutOccurred.2 = INTEGER: false(2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now, as I stated above, you would just have to poll those values and use them however you need to in your script.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2014-03-12T23:46:06.347" LastActivityDate="2014-03-12T23:46:06.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6789" PostTypeId="2" ParentId="6768" CreationDate="2014-03-13T01:29:06.783" Score="2" Body="&lt;p&gt;We have a similar setup, with a single /24 public range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the time, I was not aware that the 2950 switches could support PVLANs (which coincidentally is what we've also been running). Instead, to conserve IP space, I used the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Router on a stick - each client is assigned their own VLAN and their own &lt;strong&gt;private&lt;/strong&gt; IP range. Eg. 10.1.2.0/28 - or whatever size makes sense.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From that point, terminate each VLAN on the router, so it becomes responsible for inter-VLAN routing. This allows you to run ACLs to prevent unwanted communication between customer subnets. &lt;em&gt;I have no evidence for this&lt;/em&gt; but I would suggest that, given the 2950 hardware is dated, depending on the model of your MikroTik router, you will be able to run more ACLs on the MikroTik.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(As an aside, we're currently using a Linux router - 8 cores + 8 GB RAM, and it handles just under 1000 individual IPTables rules without breaking a sweat - though the throughput is &amp;lt; 50 Mbps).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Perform 1:1 static NAT on the MikroTik router, this allows you to use only a single public IP address per server/client. You could choose to route segments of your public space directly to a VLAN, as needed, as well.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We've found this to be a pretty flexible configuration. As long as you're not planning to scale to a much larger size, I think it works well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not saying that this would necessarily be a better solution over PVLANs, but simply offering it as an alternative that has worked for us so far. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be honest with you, though, if I had've realised at the time I could get a PVLAN configuration working on the 2950s, then I probably would have done that instead.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit - Virtual Machines&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Again, I'm not entirely sure how this might compare with PVLANs, but one of the major benefits we've experienced in our setup, is that it works seamlessly on our virtual platform. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For each virtual server host, it is configured with a trunk port, and we simply define virtual networks per VLAN, which each VM can belong to, as needed. This means that we can have customers with multiple physical servers, and VMs across multiple hosts, and span their specific VLAN across all of them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Meaning they can talk to all of their servers/VMs &quot;locally&quot; but still remain isolated from all other customers on our infrastructure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would consider this a major benefit of our configuration. I'm not sure you'd be able to bring PVLANs down to your ESX/Xen/Virtual Hosts, which would limit your options.&lt;/p&gt;&#xA;" OwnerUserId="846" LastEditorUserId="846" LastEditDate="2014-03-15T14:25:37.427" LastActivityDate="2014-03-15T14:25:37.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6790" PostTypeId="1" AcceptedAnswerId="6806" CreationDate="2014-03-13T01:55:22.940" Score="4" ViewCount="12505" Body="&lt;p&gt;Split DNS ostensibly allows a remote device accessing a LAN using VPN to direct DNS queries for internal domain names to internal DNS servers while queries for public domain names are directed to public DNS servers local to the remote device.  For Cisco ASA, the operative command that claims to achieve this is &lt;code&gt;split-dns&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you establish a remote access VPN connection using a Windows machine, the VPN connection shows itself as a separate network adapter (at least for the Cisco clients I have experience with).  &lt;a href=&quot;https://serverfault.com/a/84293/115232&quot;&gt;The method that Windows uses to decide which network adapter and DNS server to use&lt;/a&gt; cannot &lt;em&gt;by itself&lt;/em&gt; enforce that all internal DNS queries are sent to the the VPN adapter and that all public DNS queries are sent to the physical adapter.  In fact, Windows will attempt the same DNS query on a different adapter if it doesn't receive a response from the first one within one second.  Furthermore, it seems that Windows might even choose to send a DNS query for an internal domain to the physical adapter which only has public DNS servers associated with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if Windows opts to send DNS queries for internal domains to adapters other than the VPN adapter, how can the VPN client ensure &lt;em&gt;all&lt;/em&gt; DNS queries for internal domains are tunneled to the internal DNS servers?  Am I missing something here?  Is there something fancy going on that somehow allows the VPN client to intercept DNS queries that Windows sends to the wrong adapter?  If so, how, exactly, does that work?&lt;/p&gt;&#xA;" OwnerUserId="2662" LastEditorUserId="775" LastEditDate="2014-03-14T09:59:11.030" LastActivityDate="2014-03-14T15:46:30.077" Title="Cisco ASA VPN with split-dns on a Windows VPN client" Tags="|cisco|cisco-asa|vpn|dns|split-tunneling|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6792" PostTypeId="2" ParentId="6782" CreationDate="2014-03-13T07:01:13.817" Score="9" Body="&lt;p&gt;Identifying the Data Inside an Ethernet Frame&lt;br&gt;&#xA;Each data-link header has a field in its header with a code that defines the type of protocol header that follows.&#xA;For example, the Destination Service Access Point (DSAP) field has a value of E0, which means that the next header is a Novell IPX header. Why is that? Well, when the IEEE created 802.2, it saw the need for a protocol type field that identified what was inside the field called &quot;data&quot; in an IEEE Ethernet frame.&lt;br&gt;&#xA;The IEEE called its Type field the destination service access point (DSAP). When the IEEE first created the 802.2 standard, anyone with a little cash could register favorite protocols with the IEEE and receive a reserved value with which to identify those favorite protocols in the DSAP field. For instance, Novell registered IPX and was assigned hex E0 by the IEEE.&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/u7vjq.jpg&quot; alt=&quot;Ethernet Frame Format&quot;&gt;&lt;br&gt;&#xA;However, the IEEE did not plan for a large number of protocols - and it was wrong. As it turns out, the 1-byte-long DSAP field is not big enough to number all the protocols.&lt;br&gt;&#xA;To accommodate more protocols, the IEEE allowed the use of an extra header, called a SubNetwork Access Protocol (SNAP) header. The DSAP field of 0xAA, which implies that a SNAP header follows the 802.2 header, and the SNAP header includes a 2-byte protocol type field. The SNAP protocol type field is used for the same purpose as the DSAP field, but because it is 2 bytes long, all the possible protocols can be identified. For instance, the SNAP type field has a value of 0800, signifying that the next header is an IP header. RFC 1700, &quot;Assigned Numbers&quot; (&lt;a href=&quot;http://www.isi.edu/in-notes/rfc1700.txt&quot; rel=&quot;noreferrer&quot;&gt;RFC 1700&lt;/a&gt;), lists the SAP and SNAP Type field values and the protocol types that they imply.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See more: &lt;a href=&quot;http://www.wildpackets.com/resources/compendium/reference/sap_numbers&quot; rel=&quot;noreferrer&quot;&gt;SAP Numbers&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1315" LastActivityDate="2014-03-13T07:01:13.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6797" PostTypeId="2" ParentId="6768" CreationDate="2014-03-13T11:10:00.680" Score="1" Body="&lt;p&gt;On 2950 switches you can use assign VLANs on a /24 network, you would have to use inter-VLAN routing to route these VLANs from layer 2 to Layer 3 but I am not familiar with  MikroTik router. You will have to create sub-interfaces on your router to distribute the IP addresses range to each vlan using the 802.1q encapsulation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just remember, on Cisco switches native VLAN is set to default &lt;code&gt;Vlan 1&lt;/code&gt; it is best security practice to change it to an unused vlan. Native VLANs should be configured on both ends of the trunk interface and if you have multiple switches, it is recommended to use VTP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN10 192.168.10.1&lt;br&gt;&#xA;VLAN20 192.168.20.1&lt;br&gt;&#xA;VLAN30 192.168.30.1&lt;br&gt;&#xA;VLAN40 192.168.50.1 -&gt; native vlan  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;create vlans&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1&amp;gt;en&#xA;SW1#conf t&#xA;SW1(config)vlan 10&#xA;SW1(config-vlan)name (vlan name)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;assign switchports to vlans&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1&amp;gt;int fa0/1&#xA;SW1&amp;gt;int range fa0/1 - fa0/10&#xA;SW1&amp;gt;switchport mode access&#xA;SW1&amp;gt;switchport access vlan 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;set default-gateway&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1&amp;gt;ip default-gateway 192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On a 7500 router you can do these codes/commads to use &quot;router on a stick&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)#int fa0/0&#xA;Router(config-if)#no shut&#xA;Router(config-if)#&#xA;%LINK-5-CHANGED: Interface FastEthernet0/0, changed state to up&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to up&#xA;Router(config-if)#int fa0/0.10&#xA;Router(config-subif)#&#xA;%LINK-5-CHANGED: Interface FastEthernet0/0.10, changed state to up&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.10, changed state to up&#xA;Router(config-subif)#encap ?&#xA;  dot1Q  IEEE 802.1Q Virtual LAN&#xA;Router(config-subif)#encap &#xA;Router(config-subif)#encap dot1Q  ?&#xA;  &amp;lt;1-1005&amp;gt;  IEEE 802.1Q VLAN ID&#xA;Router(config-subif)#encap dot1Q 10&#xA;Router(config-subif)#ip address 192.168.10.1 255.255.255.0&#xA;Router(config-subif)#int fa0/0.20&#xA;Router(config-subif)#&#xA;%LINK-5-CHANGED: Interface FastEthernet0/0.20, changed state to up&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.20, changed state to up&#xA;Router(config-subif)#encap dot1Q 20&#xA;Router(config-subif)#ip address 192.168.20.1 255.255.255.0&#xA;Router(config-subif)#int fa0/0.30&#xA;Router(config-subif)#&#xA;%LINK-5-CHANGED: Interface FastEthernet0/0.30, changed state to up&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.30, changed state to up&#xA;Router(config-subif)#encap dot1Q 30&#xA;Router(config-subif)#ip address 192.168.30.1 255.255.255.0&#xA;Router(config-subif)#int fa0/0.55&#xA;Router(config-subif)#&#xA;%LINK-5-CHANGED: Interface FastEthernet0/0.55, changed state to up&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.55, changed state to up&#xA;Router(config-subif)#encap dot1Q 55 ?&#xA;  native  Make this as native vlan&#xA;  &amp;lt;cr&amp;gt;&#xA;Router(config-subif)#encap dot1Q 55 native&#xA;Router(config-subif)#ip address 192.168.55.1 255.255.255.0&#xA;Router(config-subif)#int fa0/0.77&#xA;Router(config-subif)#&#xA;%LINK-5-CHANGED: Interface FastEthernet0/0.77, changed state to up&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0.77, changed state to up&#xA;Router(config-subif)#encap dot1Q 77&#xA;Router(config-subif)#ip address 192.168.77.1 255.255.255.0&#xA;Router(config-subif)#&#xA;Router(config-subif)#^Z&#xA;Router#&#xA;%SYS-5-CONFIG_I: Configured from console by console&#xA;Router#&#xA;Router#wr&#xA;Building configuration...&#xA;[OK]&#xA;Router#&#xA;Router#copy run start&#xA;Destination filename [startup-config]?&#xA;Building configuration...&#xA;[OK]&#xA;Router#sh ip route&#xA;Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area&#xA;       * - candidate default, U - per-user static route, o - ODR&#xA;       P - periodic downloaded static route&#xA;Gateway of last resort is not set&#xA;C    192.168.10.0/24 is directly connected, FastEthernet0/0.10&#xA;C    192.168.20.0/24 is directly connected, FastEthernet0/0.20&#xA;C    192.168.30.0/24 is directly connected, FastEthernet0/0.30&#xA;C    192.168.55.0/24 is directly connected, FastEthernet0/0.55&#xA;C    192.168.77.0/24 is directly connected, FastEthernet0/0.77&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4211" LastEditorUserId="3191" LastEditDate="2014-03-13T14:50:11.733" LastActivityDate="2014-03-13T14:50:11.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6799" PostTypeId="2" ParentId="6753" CreationDate="2014-03-13T14:18:48.487" Score="3" Body="&lt;p&gt;The &lt;code&gt;-&lt;/code&gt; character indicates VTP is disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Fizzle says, &lt;code&gt;show vtp status&lt;/code&gt; should reveal the discrepancy.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a &lt;a href=&quot;https://tools.cisco.com/bugsearch/bug/CSCuj31678&quot; rel=&quot;nofollow&quot;&gt;bug on the N3K&lt;/a&gt; that causes this behavior even if they're currently set the same if you have ever enabled VTP the box still thinks its on.   Perhaps that bug also exists on N5K if show vpc status shows the same state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case since its a type 2 inconsistency it doesn't affect traffic flow.&lt;/p&gt;&#xA;" OwnerUserId="1104" LastEditorUserId="3191" LastEditDate="2014-03-13T14:30:19.910" LastActivityDate="2014-03-13T14:30:19.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6800" PostTypeId="1" AcceptedAnswerId="7685" CreationDate="2014-03-13T16:04:24.213" Score="6" ViewCount="686" Body="&lt;p&gt;When running &lt;code&gt;show pfe statistics error&lt;/code&gt; on a a couple of MX platforms, I see the &lt;code&gt;EOPE Drop Pkt Cnt&lt;/code&gt; counter incrementing on 6 MX's out of 22. I believe these are &quot;End-Of-Packet errors&quot;, but can't find any details about it at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas? If not, I'll log a JTAC case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1ECzV.png&quot; alt=&quot;show pfe statistics error&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="3191" LastEditDate="2014-03-13T21:27:30.610" LastActivityDate="2014-05-01T08:41:24.717" Title="Juniper MX-5 EOPE Drop Pkt Cnt Incrementing" Tags="|juniper|juniper-junos|juniper-mx|errors|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6801" PostTypeId="1" CreationDate="2014-03-13T16:27:46.547" Score="3" ViewCount="1067" Body="&lt;p&gt;I have a brocade icx 6450 with the following config.  The pc's are connected directly to the phones.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have port 1/1/48 going into another switch which is has the dhcp server for the data network and port 1/2/1 going to another switch which has the dhcp server for the voip network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the pc's get the dhcp requests fine but the phones do not work.  PLease tell me what I am doing wrong.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global-stp&#xA;!&#xA;!&#xA;!&#xA;vlan 1 name DEFAULT-VLAN by port&#xA;!&#xA;vlan 100 name DATA_VLAN by port&#xA; tagged ethe 1/1/1 to 1/1/45 ethe 1/1/47&#xA; untagged ethe 1/1/48&#xA; router-interface ve 100&#xA; spanning-tree 802-1w&#xA;!&#xA;vlan 150 name VOIP_VLAN by port&#xA; tagged ethe 1/1/1 to 1/1/45 ethe 1/1/47 ethe 1/2/1&#xA; untagged ethe 1/1/46&#xA; router-interface ve 150&#xA; spanning-tree 802-1w&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;boot sys fl sec&#xA;enable telnet password .....&#xA;enable super-user-password .....&#xA;no ip forward-protocol udp dns&#xA;&#xA;!&#xA;!&#xA;interface ethernet 1/1/1&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/2&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/3&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/4&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/5&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/6&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/7&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/8&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/9&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/10&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/11&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/12&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/13&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/14&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/15&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/16&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/17&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/18&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/19&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/20&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/21&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/22&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/23&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/24&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/25&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/26&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/27&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/28&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/29&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/30&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/31&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/32&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/33&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/34&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/35&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/36&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/37&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/38&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/39&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/40&#xA; dual-mode  100&#xA;   spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/41&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/42&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; inline power&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/43&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/44&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/45&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/46&#xA; spanning-tree 802-1w admin-edge-port&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/47&#xA; dual-mode  100&#xA; spanning-tree 802-1w admin-edge-port&#xA; voice-vlan 150&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/1/48&#xA; spanning-tree 802-1w admin-edge-port&#xA; trust dscp&#xA;!&#xA;interface ethernet 1/2/1&#xA; speed-duplex 1000-full-master&#xA; spanning-tree 802-1w admin-pt2pt-mac&#xA; trust dscp&#xA;!&#xA;interface ve 100&#xA; ip helper-address 1 192.168.16.205&#xA;!&#xA;interface ve 150&#xA; ip helper-address 1 10.50.1.1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea?&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="619" LastEditDate="2014-03-13T19:22:00.940" LastActivityDate="2014-07-25T08:48:28.260" Title="VoIP switch setup trouble" Tags="|voip|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6802" PostTypeId="2" ParentId="6785" CreationDate="2014-03-13T17:09:27.390" Score="3" Body="&lt;p&gt;Not related to your specific problem, but you'll need to permit ICMPv6 to come back to you (Echo Reply, Echo Request and Packet too big at least) because IPv6 doesn't support fragmentation and Packet Too Big messages is the only way you (your SRX, PC etc) will know to send smaller packet.&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-03-13T17:09:27.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6803" PostTypeId="2" ParentId="6801" CreationDate="2014-03-13T17:25:29.427" Score="1" Body="&lt;p&gt;I don't know Brocade's device specifically, but the config seems pretty straightfoward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you using Trunking (802.1Q) to have multiple VLANs between your switches? You seem to have more than one VLAN on the swich (150 + default) but only the default VLAN on your uplink port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that's the case and the Brocade automagically puts phones on VLAN 150 (Voice VLAN), their DHCP request will never be able to reach the other switch unless you're using IP Helpers, in which case, you seem to be missing IP addresses on your vlan interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if you're switching to the DHCP Server, there are VLANs issues (802.1q missing) while if routing to the DHCP server, there is no IP addresses on any interfaces, meaning it has no way to send/receive IP packets (no IP interfaces, no IP communication)&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-03-13T17:25:29.427" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6805" PostTypeId="2" ParentId="6790" CreationDate="2014-03-13T19:30:52.703" Score="2" Body="&lt;p&gt;If you pay &lt;em&gt;close&lt;/em&gt; attention to what the VPN software installs, you'll find a shim high up in the network stack that allows the software to intercept DNS lookups long before any routing has taken place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(In linux it can be done by inserting an additional NSS module. But I've not used the cisco or juniper linux clients in decades.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-03-13T19:30:52.703" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6806" PostTypeId="2" ParentId="6790" CreationDate="2014-03-13T21:39:58.987" Score="7" Body="&lt;h2&gt;Experiment&lt;/h2&gt;&#xA;&lt;p&gt;There is a lot of conflicting information about what actually happens on a Windows client when using &lt;code&gt;split-dns&lt;/code&gt;.  So much that I decided to gather some evidence and see where it points.  I set up a &lt;em&gt;simultaneous&lt;/em&gt; packet capture on both the VPN-connected Windows client and the ASA to which that client is connected.  Here is a diagram of the test setup:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/F5J0X.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/F5J0Xm.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;With the packet captures running, I initiated DNS resolution on the client.  To do so, I pressed enter on &lt;code&gt;srv1.internal.example.com&lt;/code&gt; in Google Chrome.  Here are the resulting packet captures adjusted to sync their clocks and merged together.&lt;/p&gt;&#xA;&lt;p&gt;Packets with IDs starting with &amp;quot;C&amp;quot; are from the Windows [C]lient.&lt;br /&gt;&#xA;Packets starting with &amp;quot;A&amp;quot; are from the [A]SA.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vgUk1.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Analysis&lt;/h2&gt;&#xA;&lt;p&gt;In orange, we can see four separate DNS queries that are trying to be made by Windows/Chrome:  The destinations of the four DNS queries are as follows:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;8.8.8.8 - the DNS Server associated with the Wifi Adapter (packet &lt;code&gt;C69&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;10.10.10.3 - the first DNS Server associated with the VPN Adapter (packet &lt;code&gt;C70&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;8.8.8.8 - the DNS Server associated with the Wifi Adapter (packet &lt;code&gt;C78&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;10.10.10.4 - the second DNS Server associated with the VPN Adapter (packet &lt;code&gt;C81&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;What is most revealing is that the two DNS queries apparently sent to 8.8.8.8 appear at the ASA in packets &lt;code&gt;A95&lt;/code&gt; and &lt;code&gt;A105&lt;/code&gt; with source and destination IPs translated from external addresses to internal addresses.  The responses from the DNS server for those translated queries are in &lt;code&gt;A97&lt;/code&gt; and &lt;code&gt;A106&lt;/code&gt; which are themselves then translated to external addresses again in packets &lt;code&gt;C74&lt;/code&gt; and &lt;code&gt;C84&lt;/code&gt;, respectively.  These DNS queries ultimately succeed.&lt;/p&gt;&#xA;&lt;h2&gt;Answers to the original questions&lt;/h2&gt;&#xA;&lt;p&gt;&lt;em&gt;If Windows opts to send DNS queries for internal domains to adapters other than the VPN adapter, how can the VPN client ensure all DNS queries for internal domains are tunneled to the internal DNS servers?&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;Based on the above evidence, the VPN client seems to intercept DNS queries that match the domain configured using the &lt;code&gt;split-dns value&lt;/code&gt; command on &lt;em&gt;non-VPN&lt;/em&gt; adapters.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Am I missing something here? Is there something fancy going on that somehow allows the VPN client to intercept DNS queries that Windows sends to the wrong adapter?&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;The &lt;em&gt;fancy&lt;/em&gt; part that was missing is that the VPN client performs a sort of network address translation to make it appear to Windows that DNS queries for the internal domain are being serviced by the &lt;em&gt;public&lt;/em&gt; DNS server to which Windows sent its request.  In fact those requests are serviced by the internal DNS server.&lt;/p&gt;&#xA;&lt;p&gt;I'm not sure exactly how this is accomplished, and there doesn't seem to be any documentation from Cisco that speaks to this.  I accept that there is some amount of sorcery that the VPN client performs on the Windows end to achieve a functioning split DNS.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Notes on Adapter Binding Order&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;I tinkered with the oft-cited adapter binding order.  Here is what I found.  The adapter order seems to have no impact on the efficacy of the VPN Client's ability to intercept and translate DNS queries for internal domains.&lt;/p&gt;&#xA;&lt;p&gt;Putting the VPN adapter highest in the binding order seems to result in Windows sending DNS requests &lt;em&gt;only&lt;/em&gt; to the DNS servers on the VPN adapter initially.  Those requests seem to be dropped entirely by the VPN Client (presumably because they don't match the internal domain).  This then results in a Windows timeout (or a series of them) until, eventually, Windows attempts DNS resolution using the non-VPN adapter.  This creates a noticeable and irritating delay when browsing.&lt;/p&gt;&#xA;&lt;p&gt;Based on this, it seems that in split DNS configurations the VPN adapter should &lt;em&gt;not&lt;/em&gt; be the highest priority.&lt;/p&gt;&#xA;" OwnerUserId="2662" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-03-14T15:46:30.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6807" PostTypeId="1" AcceptedAnswerId="6811" CreationDate="2014-03-14T02:31:24.117" Score="5" ViewCount="7088" Body="&lt;p&gt;unable to advertise a route to ebgp peer and modify next-hop address. on receive router this can be resolved by configuring a import policy that matches on community and sets next hop to proper address; however, curious what i'm overlooking.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@juniper.mx5# show logical-systems arouter protocols bgp       &#xA;accept-remote-nexthop;&#xA;local-address 10.10.200.46;&#xA;group external-65534 {&#xA;    traceoptions {&#xA;        file arouter-bgp-update;&#xA;        flag update;&#xA;        flag route;&#xA;        flag packets;&#xA;    }&#xA;    description root-ls;&#xA;    export internal-rtbh;&#xA;    peer-as 65534;&#xA;    neighbor 10.10.200.45;&#xA;}&#xA;&#xA;group external-65422 {&#xA;    description arouter-ls;&#xA;    accept-remote-nexthop;&#xA;    local-address 10.10.200.45;&#xA;    peer-as 65422;&#xA;    neighbor 10.10.200.46;&#xA;}&#xA;&#xA;root@juniper.mx5# show logical-systems arouter routing-options static | find 172.16.22.100 &#xA;route 172.16.22.100/32 {&#xA;    discard;&#xA;    tag 65422;&#xA;}&#xA;&#xA;&#xA;root@juniper.mx5# show logical-systems arouter policy-options policy-statement internal-rtbh &#xA;from {&#xA;    protocol static;&#xA;    tag 65422;&#xA;}&#xA;then {&#xA;    local-preference 400;&#xA;    origin igp;&#xA;    community add no-export;&#xA;    next-hop 192.0.2.13;&#xA;    accept;&#xA;}&#xA;&#xA;&#xA;root@juniper.mx5# run show route logical-system arouter advertising-protocol bgp 10.10.200.45 extensive &#xA;&#xA;inet.0: 26 destinations, 26 routes (26 active, 0 holddown, 0 hidden)&#xA;* 172.16.22.100/32 (1 entry, 1 announced)&#xA; BGP group external-65534 type External&#xA;     Nexthop: Self&#xA;     Flags: Nexthop Change&#xA;     AS path: [65422] I&#xA;     Communities: no-export&#xA;&#xA;&#xA;root@juniper.mx5# run show route logical-system brouter receive-protocol bgp 10.10.200.46 extensive &#xA;&#xA;inet.0: 40 destinations, 40 routes (40 active, 0 holddown, 0 hidden)&#xA;* 172.16.22.100/32 (1 entry, 1 announced)&#xA;     Accepted&#xA;     Nexthop: 10.10.200.46&#xA;     AS path: 65422 I&#xA;     Communities: no-export&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4762" LastEditorUserId="59" LastEditDate="2014-03-14T08:11:30.330" LastActivityDate="2014-03-14T08:22:36.887" Title="Juniper - eBGP change next-hop on advertised routes" Tags="|routing|bgp|juniper|juniper-mx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6808" PostTypeId="1" CreationDate="2014-03-14T05:26:15.803" Score="6" ViewCount="978" Body="&lt;p&gt;I am trying to configure a 7609 router with a SUP7203BXL, SIP-400 and SPA5xGE as BRAS. The configuration is at the bottom of the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sessions are created, but the clients can't reach Internet. (The 7609 itself can reach internet.) I have a 7206VXR working with the same configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see a difference between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Virtual-Interfaces in the 7200 appear with the public IP address that Radius gives them, but the Virtual-Interfaces in the 7609 have the local pool which I configured for the template.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine that the 7609 works in a different way so that the configuration running on the 7200 had to be changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I solve this problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;&lt;em&gt;Configuration&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.2&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;service counters max age 10&#xA;!&#xA;hostname R7609&#xA;!&#xA;boot-start-marker&#xA;boot system disk0:c7600s72033-advipservicesk9-mz.122-33.SRE1.bin&#xA;boot-end-marker&#xA;!&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login default local&#xA;aaa authentication enable default none&#xA;aaa authentication ppp default group radius&#xA;aaa accounting network default&#xA; action-type start-stop&#xA; group radius&#xA;!&#xA;!&#xA;aaa session-id common&#xA;!&#xA;ip source-route&#xA;!&#xA;!&#xA;ip domain name 7609PPP.com&#xA;ip name-server Y.Y.Y.40&#xA;ip name-server Y.Y.Y.20&#xA;!&#xA;!&#xA;!&#xA;vtp mode transparent&#xA;mls flow ip interface-full&#xA;no mls flow ipv6&#xA;no mls acl tcam share-global&#xA;mls cef error action freeze&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;spanning-tree mode rapid-pvst&#xA;no spanning-tree optimize bpdu transmission&#xA;spanning-tree extend system-id&#xA;!&#xA;diagnostic bootup level complete&#xA;diagnostic cns publish cisco.cns.device.diag_results&#xA;diagnostic cns subscribe cisco.cns.device.diag_commands&#xA;!&#xA;redundancy&#xA; main-cpu&#xA;  auto-sync running-config&#xA; mode sso&#xA;!&#xA;vlan internal allocation policy ascending&#xA;vlan access-log ratelimit 2000&#xA;!&#xA;!&#xA;!&#xA;bba-group pppoe Servidor_PPPoE&#xA; virtual-template 1&#xA; sessions per-mac limit 1&#xA; sessions per-vlan limit 6000&#xA;!         &#xA;!&#xA;!&#xA;interface Loopback1&#xA; ip address X.X.X.X 255.255.255.0 secondary&#xA; ip address 10.10.0.1 255.255.0.0&#xA; no ip redirects&#xA;!&#xA;interface GigabitEthernet5/1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet5/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet8/0/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet8/0/1&#xA; description PPPOE_IN&#xA; no ip address&#xA; negotiation auto&#xA; pppoe enable group Servidor_PPPoE&#xA;!&#xA;interface GigabitEthernet8/0/1.100&#xA; description VLAN_PPPOE&#xA; encapsulation dot1Q 100&#xA; pppoe enable group Servidor_PPPoE&#xA;!&#xA;interface GigabitEthernet8/0/2&#xA; no ip address&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet8/0/2.10&#xA; description PPPOE_Out&#xA; encapsulation dot1Q 10&#xA; ip address Y.Y.Y.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet8/0/3&#xA; no ip address&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet8/0/3.55&#xA; description To_Radius&#xA; encapsulation dot1Q b&#xA; ip address 172.20.3.7 255.255.255.192&#xA;!&#xA;interface GigabitEthernet8/0/4&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Virtual-Template1&#xA; description Template_PPPoE&#xA; ip unnumbered Loopback1&#xA; ip policy route-map toallot&#xA; peer default ip address pool PPPoE_pool&#xA; ppp authentication pap&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;ip local pool PPPoE_pool 10.10.0.10 10.10.255.254&#xA;!&#xA;route-map toallot permit 10&#xA; match ip address 100&#xA; set ip next-hop Z.Z.Z.1&#xA;!&#xA;access-list 100 permit ip any any&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip route 0.0.0.0 0.0.0.0 Z.Z.Z.1&#xA;ip route 192.168.50.0 255.255.255.248 172.20.3.1&#xA;radius-server attribute nas-port format d&#xA;radius-server attribute 31 mac format unformatted&#xA;radius-server attribute 31 send nas-port-detail mac-only&#xA;radius-server host 172.20.3.12 auth-port 1812 acct-port 1813 key --------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="8499" LastEditDate="2016-03-29T01:57:24.603" LastActivityDate="2017-04-14T18:43:04.283" Title="7609 + SIP-400 PPPoE: cannot route to the Internet" Tags="|cisco|troubleshooting|pppoe|cisco-7600|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6811" PostTypeId="2" ParentId="6807" CreationDate="2014-03-14T07:48:45.023" Score="6" Body="&lt;p&gt;The way eBGP works is that it will always set the next-hop to the directly connected address of the sending router (except for multihop sessions or when the original next-hop is in the same subnet). As you can see in your output the router is sending the route with &lt;code&gt;Nexthop: Self&lt;/code&gt;, not with the nexthop you have configured. You can find the decision tree for next-hop generation in the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4271#section-5.1.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP RFC4271&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As a workaround you could change the session to use eBGP multihop, which has a &lt;code&gt;no-nexthop-change&lt;/code&gt; &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/reference/configuration-statement/no-nexthop-change-protocols-bgp-multihop.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;option&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;set protocols bgp group external-65534 multihop no-nexthop-change&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Using &lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junos11.4/topics/concept/bgp-multihop-understanding.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;eBGP multihop&lt;/a&gt; has other drawbacks like no fast external failover.&lt;/p&gt;&#xA;&lt;p&gt;Normally you would just leave the next-hop unchanged and set a BGP community. The receiver would then set the correct next-hop by matching the community. That's how &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5635&quot; rel=&quot;nofollow noreferrer&quot;&gt;remote triggered blackholing (RTBH)&lt;/a&gt; works between eBGP peers.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-03-14T08:22:36.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6812" PostTypeId="1" AcceptedAnswerId="6813" CreationDate="2014-03-14T07:53:21.120" Score="9" ViewCount="3572" Body="&lt;p&gt;it is necessary to join two srx650 in chassis cluster (Passive/Active) via two switches EX4200 . I need to choose one from three examples.&#xA;Please , help to define correct choice and describe what the settings should be on Srx650 and switch ex4200.&#xA;Also important moment- is it possible connect swithes via fiber-optic ?&#xA;Three Diagrams below outlines the logical configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Option 1&lt;/em&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MOMRR.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MOMRR.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Option 2&lt;/em&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/daGUZ.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/daGUZ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Option 3&lt;/em&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/vhWg7.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vhWg7.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4635" LastEditorUserId="59" LastEditDate="2014-03-19T16:40:38.240" LastActivityDate="2014-03-19T18:02:17.930" Title="Juniper SRX HA links passing through switch" Tags="|firewall|juniper|redundancy|juniper-srx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6813" PostTypeId="2" ParentId="6812" CreationDate="2014-03-14T09:52:06.793" Score="11" Body="&lt;p&gt;Things you should be aware of: SRX HA links communicate using &lt;strong&gt;jumbo frames&lt;/strong&gt; and &lt;strong&gt;multicast addresses&lt;/strong&gt;. So to make this work you need at least the following changes on the EX switches:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure a jumbo MTU on the HA links and the links between the EX switches. This will enable jumbo frames to go trough the switch infrastructure.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interface x mtu 9216&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Deactivate igmp-snooping for the HA VLAN or if not needed delete it completely. If you leave it enabled the switch will not forward the multicast frames because there are no IGMP messages to tell the switch which port is listening for these frames.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols igmp-snooping vlan HA-VLAN disable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;delete protocols igmp-snooping&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Over which media you connect the switches with each other is not important, you can use copper or fiber as you wish. I would use an &lt;code&gt;ae&lt;/code&gt; bundle interface with two or more links to reduce the chance of one link failure killing the whole connection between the switches. &lt;strong&gt;Don't forget to enable LACP on the ae bundle.&lt;/strong&gt; If possible have the two links take different routes to prevent someone cutting both fibers at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This being said, &lt;strong&gt;if possible I would always suggest directly connecting the HA links&lt;/strong&gt; of any firewall device. This reduces the risk that a problem on the switch (hardware failure, software bug, human error) will cause you a split-brain situation (both firewalls become master) which will certainly ruin your day (BTDT).&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="3191" LastEditDate="2014-03-19T18:02:17.930" LastActivityDate="2014-03-19T18:02:17.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6815" PostTypeId="2" ParentId="6773" CreationDate="2014-03-14T10:57:51.743" Score="13" Body="&lt;h3&gt;Reasons to use shielded cabling&lt;/h3&gt;&#xA;&lt;p&gt;You asked about using &lt;a href=&quot;http://en.wikipedia.org/wiki/Shielded_cable#Signal_cables&quot; rel=&quot;noreferrer&quot;&gt;shielded cabling&lt;/a&gt; to protect ethernet from interference from heavy power currents.   We mentioned above that &lt;a href=&quot;http://en.wikipedia.org/wiki/Shielded_cable#Signal_cables&quot; rel=&quot;noreferrer&quot;&gt;shielded cabling&lt;/a&gt; isn't required in this case, but there are a few valid use cases for it:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you run cabling where there truly is a high potential for interference, such as ethernet cabling that runs near aircraft radar transmitters.&lt;/li&gt;&#xA;&lt;li&gt;If you find that you're at the 100m distance limit for standard ethernet runs, it's not unheard of to squeeze a few more feet beyond the 100m limit of a Cat5e run by using shielded cabling.  That said, the 100m distance limit is there for more than just cross-talk and noise limits, but some people still get away with doing this.  It helps if you're in bind, but it's much better to lay out your IDFs correctly; you shouldn't do this intentionally.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;It obviously won't hurt to use &lt;a href=&quot;http://en.wikipedia.org/wiki/Shielded_cable#Signal_cables&quot; rel=&quot;noreferrer&quot;&gt;shielded cabling&lt;/a&gt; in your case, but it doesn't sound like you really need it.&lt;/p&gt;&#xA;&lt;h3&gt;Grounding Shielded Cabling - one side, or both sides?&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;As our 'porta cabin' only has 2 PC's we are not planning to put a patch cabinet in there, so my question is - if I terminate the STP cable to a socket and run a standard patch cable that side to a small switch (and then cables to the PC's) would I need some way to earth it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Terminating one side of &lt;a href=&quot;http://en.wikipedia.org/wiki/Shielded_cable#Signal_cables&quot; rel=&quot;noreferrer&quot;&gt;shielded cabling&lt;/a&gt; is sufficient and industry practice; I am assuming the &lt;a href=&quot;http://en.wikipedia.org/wiki/Shielded_cable#Signal_cables&quot; rel=&quot;noreferrer&quot;&gt;shielded cabling&lt;/a&gt; is terminated correctly.   Grounding shielded cabling is also discussed in &lt;a href=&quot;http://www.pennington.net/archives/cabling/BICSI_Mythbusting_Shielded_Cabling.pdf&quot; rel=&quot;noreferrer&quot; title=&quot;BICSI Mythbusting takes on Shielded cable, Herb Congdon and Brian Davis&quot;&gt;BICSI Mythbusting: Shielded cabling&lt;/a&gt;, which I thought was a great presentation.  If you only ground one side, you're eliminating the possibility of &lt;a href=&quot;https://electronics.stackexchange.com/questions/26597/shielding-and-ground-loops&quot;&gt;ground loops&lt;/a&gt; on the cabling itself.  Ground loops tend to form at power-cycle frequencies, &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6773/stp-termination-and-grounding#comment11030_6773&quot;&gt;which don't interfere with ethernet&lt;/a&gt;; however, it's best to avoid &lt;a href=&quot;https://electronics.stackexchange.com/questions/26597/shielding-and-ground-loops&quot;&gt;ground loops&lt;/a&gt; altogether.&lt;/p&gt;&#xA;&lt;h3&gt;Terminating shielded cabling to a patch panel&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The patch cabinet side would also be terminated to a socket (with patch cable going to main switch (with fibre link to our main office)). I have no STP RJ45 terminations (only standard UTP).&lt;/p&gt;&#xA;&lt;p&gt;If I was to run an earth wire from the STP shield/screen to the patch cabinet would that be enough (cabinet grounded through equipment connected to a UPS)? I would also look to use ferrite chokes on the cable (to negate any outside RF interference it would pick up) if we found problems.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This is a little unclear without a diagram, but let's cut to the essentials:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ground one side of your shielded cabling&lt;/li&gt;&#xA;&lt;li&gt;If you terminate into a patch panel, use patch panels / modular inserts designed for shielded cabling because the mod plug (shown below) terminates to the shield inside the cable, and that all should be grounded.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;em&gt;Shielded mod plug&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/FCtVM.jpg&quot; alt=&quot;Shielded mod plug&quot; /&gt;&lt;/p&gt;&#xA;&lt;h3&gt;Avoiding &lt;a href=&quot;https://electronics.stackexchange.com/questions/26597/shielding-and-ground-loops&quot;&gt;ground loops&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;As the same power source will be powering both ends of the installation I understand we won't have problems with earth differential.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This isn't in the critical path of your main questions, but it's worthy of discussion.  Everything depends on whether the buildings are grounded individually, or whether the power cabling to your 'porta cabin' carries the ground conductor with the hot and neutral.  If the buildings indeed have different ground rods, you &lt;em&gt;could&lt;/em&gt; see a difference in ground potential between the buildings.  Please see &lt;a href=&quot;http://www.pennington.net/archives/cabling/BICSI_Mythbusting_Shielded_Cabling.pdf&quot; rel=&quot;noreferrer&quot; title=&quot;BICSI Mythbusting takes on Shielded cable, Herb Congdon and Brian Davis&quot;&gt;BICSI Mythbusting: Shielded cabling&lt;/a&gt;, which discusses why this shouldn't be a problem for your shielded twisted pair termination, but it's a point worth mentioning in case you run into other equipment grounding concerns; you should not intentionally form &lt;a href=&quot;https://electronics.stackexchange.com/questions/26597/shielding-and-ground-loops&quot;&gt;ground loops&lt;/a&gt;, if possible.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-03-14T11:04:12.003" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="6816" PostTypeId="1" AcceptedAnswerId="7188" CreationDate="2014-03-14T11:07:08.730" Score="3" ViewCount="7661" Body="&lt;p&gt;I need to open this port in Fortigate:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;443   PSOM/TLS    Outbound    Data sharing sessions&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But i dont know where I can open. I created a Custom Service, chose the option of TCP, but do not know if it's the right thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how can I open this port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="4755" LastActivityDate="2014-04-03T16:52:05.793" Title="Fortigate Open Ports" Tags="|firewall|fortigate|fortinet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6818" PostTypeId="2" ParentId="3329" CreationDate="2014-03-14T15:05:17.533" Score="17" Body="&lt;p&gt;The IP address and MAC address serve different (but crucial) purposes:&lt;/p&gt;&#xA;&lt;p&gt;The MAC address gets a frame from one NIC to the next.  The IP address gets a packet from one Computer to the Server&lt;/p&gt;&#xA;&lt;p&gt;So given the following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Source Computer  &amp;lt;---&amp;gt;  RouterA  &amp;lt;---&amp;gt;  RouterB  &amp;lt;---&amp;gt;  Destination Server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What directs the packet from the &amp;quot;Source&amp;quot; to the &amp;quot;Destination&amp;quot; is the IP address.  But what gets the packet from the Source Computer to RouterA, and then from RouterA to RouterB, and then from RouterB to Destination is the MAC addresses.&lt;/p&gt;&#xA;&lt;p&gt;You can see the relationship in &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/osi-model/#osi-layer-23&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; illustration:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hPM19.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hPM19.gif&quot; alt=&quot;Packet Traveling - How Packets move through the Internet - pracnet.net/pt&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="80166" LastEditDate="2021-09-25T14:45:19.680" LastActivityDate="2021-09-25T14:45:19.680" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="6819" PostTypeId="2" ParentId="6768" CreationDate="2014-03-14T15:16:42.847" Score="3" Body="&lt;p&gt;A better solution (and more simple than private vlans) would be using &lt;strong&gt;switchport protected&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Switchport Protected&lt;/code&gt; is a command you can apply on a per-interface basis.  The way it works, is if two interfaces are marked protected, they are unable to speak to each other.  Here is a picture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bZceD.png&quot; alt=&quot;Switchport Protected&quot;&gt;&#xA;&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the picture above, both hostA and hostB are connected to the same switch, and in the same VLAN.  Additionally, both switch ports that they are connected to (fa0/1 and fa0/4 in this case) have been configured with &lt;strong&gt;switchport protected&lt;/strong&gt;.  The Router, which is acting as their default gateway, is connected to fa0/12, and is &lt;em&gt;NOT&lt;/em&gt; configured with switchport protected.  Therefore, HostA and HostB can each speak to the Router, but HostA and HostB are unable to speak to each other, since they are both configured as protected ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Protected ports can not speak to protected ports&lt;BR&gt;&#xA;Protected ports &lt;em&gt;CAN&lt;/em&gt; speak to unprotected ports&lt;BR&gt;&#xA;Unprotected ports have always been able to speak to unprotected ports (given same VLAN, et al).&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using this, you can configure all your hosts in the same VLAN, with the same IP Network, and the Router can act as the DHCP server (if necessary) for just that single VLAN.  But with all the ports configured with &lt;code&gt;switchport protected&lt;/code&gt; (except the uplink to the router, of course), none of the Hosts will see each other, but they will all be able to see the Router and speak out to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration for the setup above would be something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA;  switchport access vlan 10&#xA;  switchport mode access&#xA;  switchport protected&#xA;!&#xA;interface FastEthernet0/4&#xA;  switchport access vlan 10&#xA;  switchport mode access&#xA;  switchport protected&#xA;!&#xA;interface FastEthernet0/12&#xA;  switchport trunk encapsulation dot1q&#xA;  switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3191" LastEditDate="2014-03-14T15:44:20.293" LastActivityDate="2014-03-14T15:44:20.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6820" PostTypeId="1" AcceptedAnswerId="6837" CreationDate="2014-03-14T18:22:54.693" Score="8" ViewCount="1241" Body="&lt;p&gt;Can I use FQDN's in crypto maps when setting a peer (where I'd normally use an IP), and can I use FQDN's when defining an LDAP Server or any other AAA Server in a server group?  In both cases the FQDN's would have to be resolved by calls to an external DNS server (FQDN objects).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the answer is yes, please provide a quick example of how to do that.&#xA;I already know how to use FQDN's in ACL's, setup external DNS and validate the ASA is resolving those properly.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2014-03-17T14:06:23.210" LastActivityDate="2014-03-17T14:07:32.633" Title="FQDN's in crypto maps and AAA servers possible with dynamic DNS resolution? Cisco ASA" Tags="|cisco|cisco-asa|firewall|aaa|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6821" PostTypeId="2" ParentId="6783" CreationDate="2014-03-14T19:14:35.790" Score="2" Body="&lt;p&gt;Gerben is correct--DNS requests from your Windows 7 clients will not traverse the Sonicwall firewall to reach your Windows Server.  If you really wanted to do this, you would need to use one of the available ports on your firewall and create a DMZ network.  You will need to move (change the IP address and move the port) your Windows server to this new DMZ network.  You will need to setup the access lists between the internal network and the DMZ server network in the same way you setup the access lists to the internet.&lt;/p&gt;&#xA;" OwnerUserId="4700" LastActivityDate="2014-03-14T19:14:35.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6823" PostTypeId="1" AcceptedAnswerId="6852" CreationDate="2014-03-14T19:41:24.570" Score="6" ViewCount="8533" Body="&lt;p&gt;I need to configure Cisco 2901 router to route between interconnect block and usable ip block. Circuit is fiber 30Mb/s&#xA;I got this info from ISP provider:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP space:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interconnect block - 50.204.xxx.80/30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Netmask: 255.255.255.248&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP Internet gateway: 50.204.xxx.81&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Customer Layer 3 device WAN interface: 50.204.xxx.82&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interconnect usable IP's: 50.204.xxx.83 thru 50.204.xxx.86&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Primary DNS: x.x.x.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondary DNS: x.x.x.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Customer useable IP block - 50.204.xxx.88/29&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Netmask: 255.255.255.248&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usable IPs: 50.204.xxx.89 thru 50.204.xxx.94&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The /29 of usable IP space is statically routed by ISP to 50.204.xxx.82&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Customer device connected to the ISP, ISP recommends the&#xA;following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Speed hardcoded to 100 Mbps* (No auto-negotiation) *Except 1G or&#xA;  larger circuits * Duplex hardcoded to Full (No auto-negotiation) *&#xA;  Traffic Shaping/Policing -- limit output rate at or below the&#xA;  bandwidth usage subscribed for that connection ISP is a layer 2&#xA;  transport service which only allows for complete content transmission.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I was thinking about configuring this way. Please let me know if there is better way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setup &quot;wan&quot; interface (e.g gig0/0) with 50.204.xxx.82 /30. Hard code duplex and speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setup &quot;lan&quot; interface (e.g gig 0/1) with 50.204.xxx.89 /29&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setup traffic shaping:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any SHAPE&#xA; match any&#xA;&#xA;policy-map SHAPE&#xA; class SHAPE&#xA;  shape average 30000000&#xA;&#xA;interface GigabitEthernet0/1&#xA; service-policy output SHAPE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Setup default route &lt;code&gt;ip route 0.0.0.0 0.0.0.0 50.204.xxx.81&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Would it be better to setup traffic policing?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Would it be better to setup traffic shaping/policing on outside interface (gig 0/0)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I am confused with ISP giving me 50.204.xxx.80/30 address for interconnect block and then saying that I can use 50.204.xxx.83 thru 50.204.xxx.86?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4608" LastEditorUserId="3191" LastEditDate="2014-03-17T19:09:37.287" LastActivityDate="2014-03-17T19:09:37.287" Title="ISP edge router configuration" Tags="|cisco|routing|router|qos|isp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6824" PostTypeId="2" ParentId="6823" CreationDate="2014-03-14T20:25:52.217" Score="3" Body="&lt;p&gt;You do not NEED to set up traffic policing but as this is a public IP, you would want to send this traffic through a firewall of some sort, normally.  I would hope the ISP would gracefully adjust your utilization on their equipment rather than depending on you to handle it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were going to perform traffic shaping or policing, yes, you should implement it on your /30 IP's interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The /30 has only two IP's available, one unusable IP for identifying the network, and one IP for identifying broadcast traffic.  The ISP puts a router on their side and takes one IP.  You put a layer 3 device on your side and take the second usable IP.  This is standard practice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The /29 is your usable public IP space.  Since your layer 3 device is on the /30, your router does not take up one of these assignments.  This is also pretty standard practice for $ISP.&lt;/p&gt;&#xA;" OwnerUserId="4772" LastActivityDate="2014-03-14T20:25:52.217" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6826" PostTypeId="1" AcceptedAnswerId="6828" CreationDate="2014-03-14T20:55:46.487" Score="1" ViewCount="3372" Body="&lt;p&gt;I hope this is an appropriate place to ask this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm confused because it's a broadcast at Layer 2 but it's UDP inside a VLAN with a destination to a unicast address (Y.Y.Y.Y).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was just wondering if someone could tell me in what scenario one might see such a specimen.  I see &quot;virtual desktop&quot; and &quot;vmware&quot; so my best guess is it's a broadcast being sent out by one of the virtual machines using a virtual adapter and therefore encapsulated in VLAN 1101.  I also see port 5002, radio free ethernet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Frame 1: 348 bytes on wire (2784 bits), 348 bytes captured (2784 bits)&#xA;Encapsulation type: Ethernet (1)&#xA;Arrival Time: Mar 14, 2014 09:56:22.074016230 EDT&#xA;[Time shift for this packet: 0.000000000 seconds]&#xA;Epoch Time: 1394805382.074016230 seconds&#xA;[Time delta from previous captured frame: 0.000000000 seconds]&#xA;[Time delta from previous displayed frame: 0.000000000 seconds]&#xA;[Time since reference or first frame: 0.000000000 seconds]&#xA;Frame Number: 1&#xA;Frame Length: 348 bytes (2784 bits)&#xA;Capture Length: 348 bytes (2784 bits)&#xA;[Frame is marked: False]&#xA;[Frame is ignored: False]&#xA;[Protocols in frame: eth:vlan:ip:udp:data]&#xA;Ethernet II, Src: Vmware_80:39:6f (00:50:56:80:39:6f), Dst: Broadcast (ff:ff:ff:ff:ff:ff)&#xA;Destination: Broadcast (ff:ff:ff:ff:ff:ff)&#xA;    Address: Broadcast (ff:ff:ff:ff:ff:ff)&#xA;    .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)&#xA;    .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)&#xA;Source: Vmware_80:39:6f (00:50:56:80:39:6f)&#xA;    Address: Vmware_80:39:6f (00:50:56:80:39:6f)&#xA;    .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)&#xA;    .... ...0 .... .... .... .... = IG bit: Individual address (unicast)&#xA;Type: 802.1Q Virtual LAN (0x8100)&#xA;802.1Q Virtual LAN, PRI: 0, CFI: 0, ID: 1101&#xA;000. .... .... .... = Priority: Best Effort (default) (0)&#xA;...0 .... .... .... = CFI: Canonical (0)&#xA;.... 0100 0100 1101 = ID: 1101&#xA;Type: IP (0x0800)&#xA;Internet Protocol Version 4, Src: X.X.X.X (X.X.X.X), Dst: Y.Y.Y.Y (Y.Y.Y.Y)&#xA;Version: 4&#xA;Header length: 20 bytes&#xA;Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))&#xA;    0000 00.. = Differentiated Services Codepoint: Default (0x00)&#xA;    .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)&#xA;Total Length: 334&#xA;Identification: 0x58f0 (22768)&#xA;Flags: 0x00&#xA;    0... .... = Reserved bit: Not set&#xA;    .0.. .... = Don't fragment: Not set&#xA;    ..0. .... = More fragments: Not set&#xA;Fragment offset: 0&#xA;Time to live: 128&#xA;Protocol: UDP (17)&#xA;Header checksum: 0x0ed6 [correct]&#xA;    [Good: True]&#xA;    [Bad: False]&#xA;Source: X.X.X.X (X.X.X.X)&#xA;Destination: Y.Y.Y.Y (Y.Y.Y.Y)&#xA;[Source GeoIP: Unknown]&#xA;[Destination GeoIP: Unknown]&#xA;User Datagram Protocol, Src Port: 57787 (57787), Dst Port: rfe (5002)&#xA;Source port: 57787 (57787)&#xA;Destination port: rfe (5002)&#xA;Length: 314 (bogus, payload length 310)&#xA;    [Expert Info (Error/Malformed): Bad length value 314 &amp;gt; IP payload length]&#xA;        [Message: Bad length value 314 &amp;gt; IP payload length]&#xA;        [Severity level: Error]&#xA;        [Group: Malformed]&#xA;Checksum: 0x507f [unchecked, not all data available]&#xA;    [Good Checksum: False]&#xA;    [Bad Checksum: False]&#xA;Data (302 bytes)&#xA;&#xA;0000  44 52 49 4e 45 54 54 4d d1 de 97 0c c6 b9 00 00   DRINETTM........&#xA;0010  00 1e 9b 74 1c 1a 78 da fe ff ff ff 22 15 99 74   ...t..x.....&quot;..t&#xA;0020  50 99 b4 77 00 00 99 74 02 00 00 00 00 00 00 00   P..w...t........&#xA;0030  01 00 69 71 6e 2e 31 39 39 31 2d 30 35 2e 63 6f   ..iqn.1991-05.co&#xA;0040  6d 2e 6d 69 63 72 6f 73 6f 66 74 3a 64 65 73 6b   m.microsoft:desk&#xA;0050  74 6f 70 30 30 32 2e 63 6f 72 70 2e 76 69 72 74   top002.corp.virt&#xA;0060  75 61 70 72 69 73 65 2e 63 6f 6d 00 00 00 00 00   uaprise.com.....&#xA;0070  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;0080  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;0090  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;00a0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;00b0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;00c0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;00d0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;00e0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;00f0  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;0100  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;0110  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   ................&#xA;0120  00 00 00 00 00 00 00 00 00 00 00 00 00 00         ..............&#xA;Data: 4452494e4554544dd1de970cc6b90000001e9b741c1a78da...&#xA;[Length: 302]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1370" LastEditorUserId="775" LastEditDate="2014-03-14T22:26:46.417" LastActivityDate="2014-03-14T22:26:46.417" Title="What is this UDP 5002 broadcast?" Tags="|ipv4|ethernet|vlan|pcap|broadcast|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6828" PostTypeId="2" ParentId="6826" CreationDate="2014-03-14T21:48:50.063" Score="5" Body="&lt;p&gt;You appear to have a VMware guest running &lt;a href=&quot;http://support.drobo.com/app/answers/detail/a_id/257/~/which-tcp%2Fudp-ports-need-to-be-open-on-a-firewall-for-my-drobo-fs-or-droboshare%3F&quot; rel=&quot;noreferrer&quot;&gt;Drobo Dashboard&lt;/a&gt;, and it's looking for a Drobo NAS for an iSCSI volume called iqn.1991-05.com.microsoft:desktop002.corp.virtuaprise.com. Port 5002 in this case is just a random port chosen by Drobo for this session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The global broadcast MAC address is just your switch flooding the frame to all ports because the Drobo's MAC address is not in (or has expired out of) its CAM table. Once the switch observes a response from the Drobo, it will update its CAM table with the destination's MAC address, so subsequent frames can be properly directed to it.&lt;/p&gt;&#xA;" OwnerUserId="1339" LastActivityDate="2014-03-14T21:48:50.063" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6829" PostTypeId="2" ParentId="6669" CreationDate="2014-03-14T23:11:57.843" Score="5" Body="&lt;p&gt;Testing that kind of features using GNS3 is simply waste of time. You're emulating at run-time complex software, and on top of that, you're adding complex features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's no sense in 'trying' 7200 as 7200 are long EoS:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/7200-series-routers/end_of_life_c51-681414.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/routers/7200-series-routers/end_of_life_c51-681414.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Download CSR 1000v and test in on some decent hypervisor, you may get better luck, but on IOS-XE you'll have different configuration templates.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-03-14T23:11:57.843" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6831" PostTypeId="1" AcceptedAnswerId="6833" CreationDate="2014-03-15T17:23:41.767" Score="2" ViewCount="948" Body="&lt;p&gt;I have reachability to a certain /25 prefix at two different sites. These sites advertise the /25 via EBGP into a L3 IPVPN (MPLS). I am AS-path prepending one of these sites' advertisements to make it a &quot;backup&quot; path for the /25. However, remote sites participating in this L3 IPVPN only ever learn one of the routes/paths via EBGP. How can I get both of these routes/paths installed into the routing tables of my remote sites?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've performed a test where I advertise 2.2.2.2/32 from both of these sites, and get the same results.  When I remove the advertisement from one of the sites, the route remains in the routing table. It only disappears from the remote site routing table when I stop advertising it from both sites. The duration of the route being learned doesn't change when one of the sites stops advertising, indicating that my provider seems to let the other site's advertisement come through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are Juniper devices running 12.1 code. &lt;/p&gt;&#xA;" OwnerUserId="4784" LastActivityDate="2015-06-12T07:24:01.260" Title="Advertising the same prefix twice via BGP into an IPVPN" Tags="|bgp|juniper-junos|mpls-vpn|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6832" PostTypeId="1" CreationDate="2014-03-15T19:25:41.007" Score="2" ViewCount="2234" Body="&lt;p&gt;I need to setup a chassis cluster between two SRX650s over a layer 2 network. I have found &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB23995&amp;amp;actp=search&amp;amp;viewlocale=en_US&amp;amp;searchid=1394904965936&quot; rel=&quot;nofollow&quot;&gt;an article&lt;/a&gt; which is applicable to my situation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I do not understand some portions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Please explain the logical scheme. Where are the interfaces located ( &lt;code&gt;ge-0/0/0&lt;/code&gt;, &lt;code&gt;ge-0/0/1&lt;/code&gt;, &lt;code&gt;ge-0/1/0&lt;/code&gt;) which are mentioned in the configuration below (which side of the switch?)?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces ge-0/0/0 mtu 9014&#xA;set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode trunk&#xA;set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members 4094&#xA;set interfaces ge-0/0/1 mtu 9014&#xA;set interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode trunk&#xA;set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members 4094&#xA;set interfaces ge-0/1/0 mtu 9014&#xA;set interfaces ge-0/1/0 unit 0 family ethernet-switching port-mode trunk&#xA;set interfaces ge-0/1/0 unit 0 family ethernet-switching vlan members 4094&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SRX240--------EX2200-------EX2200------SRX240&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do I understand correctly, that the &lt;em&gt;Trunk&lt;/em&gt; should be only between the two EX2200 switches? Between the SRX and switch should be two separated links (from interface &lt;code&gt;ge-0/0/1&lt;/code&gt; (fxp1) and from any &lt;code&gt;ge-0/0/x&lt;/code&gt; (fab), correct?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4635" LastEditorUserId="3191" LastEditDate="2014-03-15T22:21:43.597" LastActivityDate="2014-03-16T07:36:59.143" Title="SRX chassis cluster over layer 2 network" Tags="|juniper|redundancy|juniper-srx|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6833" PostTypeId="2" ParentId="6831" CreationDate="2014-03-15T19:33:35.210" Score="4" Body="&lt;p&gt;BGP only selects one path to put into the routing table.  It sounds like your MPLS is actually working as you planned.  You have the primary site in the routing table.  When it goes down, BGP will insert the backup site into the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show route protocol bgp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;at a remote site, you should see both routes in the BGP table.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-15T19:33:35.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6836" PostTypeId="2" ParentId="6832" CreationDate="2014-03-15T22:13:54.767" Score="3" Body="&lt;p&gt;The article you're referring to is simply setting up a trunk between 2 switches. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Please explain the logical scheme. Where are the interfaces located (&#xA;  ge-0/0/0, ge-0/0/1, ge-0/1/0) which are mentioned in the configuration&#xA;  below (which side of the switch?)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The configuration samples in your question are placed on the interface connecting the two switches. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Do I understand correctly, that the Trunk should be only between the&#xA;  two EX2200 switches? Between the SRX and switch should be two&#xA;  separated links (from interface ge-0/0/1 (fxp1) and from any ge-0/0/x&#xA;  (fab), correct?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your understanding is correct. Below is a slightly modified diagram. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SRX240--------EX2200=======EX2200------SRX240&#xA;          ^            ^            ^&#xA;          |            |            |&#xA;        Access       Trunk        Access&#xA;         Port         Port         Port&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-03-15T22:22:50.607" LastActivityDate="2014-03-15T22:22:50.607" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6837" PostTypeId="2" ParentId="6820" CreationDate="2014-03-16T03:58:29.880" Score="4" Body="&lt;p&gt;Yes, according to &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/98634-asa-ldap-group-pol.html#cli&quot; rel=&quot;nofollow&quot;&gt;the Cisco documentation (v8.4)&lt;/a&gt;, you can use a hostname most places you use an IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example lifted from the documentation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ne-asa(config)#aaa-server LDAP_SRV_GRP (inside) host myserver.networkegineering.stackexchage.com&#xA;ne-asa(config-aaa-server-host)#ldap-attribute-map ne-MAP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="3191" LastEditDate="2014-03-16T12:34:35.177" LastActivityDate="2014-03-16T12:34:35.177" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6838" PostTypeId="1" CreationDate="2014-03-16T04:33:17.577" Score="4" ViewCount="774" Body="&lt;p&gt;In mobile networks, there is this thing called PGW, which acts as the gateway between the internet and the internal network of the operator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(From the user's perspective, this could be seen as the name of the locality in the first non-local hop when doing a traceroute from the device, or the last hop when doing the traceroute towards the device, e.g. &lt;code&gt;T-MOBILE-US.car1.Sacramento1.Level3.net&lt;/code&gt; for Sacramento, California.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does this mean in the case of an MVNO on a UMTS/LTE network?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Do they run their own PGWs?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Do they share PGWs between different carriers, e.g. someone like StraightTalk that operates on all 4 major carriers in the US, all as separate offerings, without roaming on one another?&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Or is the actual operator that runs the physical UMTS/LTE network is running the PGW, too?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If so, do they they physically share their own PGWs and MVNO's PGWs?  Or do they only have a limited number of dedicated MVNO PGWs?&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="296" LastActivityDate="2014-07-20T10:32:46.073" Title="Do MVNOs have their own PGWs?" Tags="|routing|router|mobile|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6840" PostTypeId="2" ParentId="6832" CreationDate="2014-03-16T07:36:59.143" Score="3" Body="&lt;p&gt;When I completed SRX clustering across the EX's switches, I found the specific Juniper AppNote below quite insightful in gaining understanding of all the various requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/myxT0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kb.juniper.net/library/CUSTOMERSERVICE/GLOBAL_JTAC/technotes/3500165-EN.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;SRX Series Servicer Gateways cluster &#xA;Deployment across layer 2 networks&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1092" LastActivityDate="2014-03-16T07:36:59.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6842" PostTypeId="1" CreationDate="2014-03-16T16:05:01.223" Score="2" ViewCount="129" Body="&lt;p&gt;What command is used to check down log on ME 3400. I am trying to see if there was any bounce on the interfaces. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help me out.&lt;/p&gt;&#xA;" OwnerUserId="4793" LastActivityDate="2014-03-17T21:34:01.773" Title="Down log on ME 3400" Tags="|cisco-catalyst|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6843" PostTypeId="1" AcceptedAnswerId="7769" CreationDate="2014-03-16T18:48:33.663" Score="6" ViewCount="62409" Body="&lt;p&gt;I need to be able to emulate a Juniper Router (JunOS) on GNS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen that this is available as on option in the 'Node Types' list on GNS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Bvi0a.png&quot; alt=&quot;Juniper Router Node in GNS3&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to use this to add a Juniper Router to the simulation using the above Node Type, I get an error message:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/94v08.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know how I could configure this. Detailed steps to configure this would be really helpful.&lt;/p&gt;&#xA;" OwnerUserId="4795" LastEditorUserId="4795" LastEditDate="2014-03-16T20:16:38.890" LastActivityDate="2014-05-07T07:41:28.040" Title="GNS3: Configuring/Emulating a Juniper Router on GNS3" Tags="|router|juniper|juniper-junos|gns3|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6844" PostTypeId="1" AcceptedAnswerId="6846" CreationDate="2014-03-16T19:04:20.460" Score="5" ViewCount="22385" Body="&lt;p&gt;I have been configuring and using SNMP v2c on Cisco routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to the obvious advantages in SNMP v3, I am planning on enabling SNMP v3 on SNMP v3 supported devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone let me know:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The commands used to configure SNMP v3 on an Cisco IOS?&lt;/li&gt;&#xA;&lt;li&gt;The configuration required on the SNMP v3 agent?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4795" LastActivityDate="2022-09-19T11:10:29.880" Title="SNMP: Configuring/Enabling SNMPv3 on Cisco IOS and SNMP Agent" Tags="|cisco|cisco-ios|snmp|cisco-ios-12|cisco-ios-15|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6845" PostTypeId="1" AcceptedAnswerId="6847" CreationDate="2014-03-16T19:13:42.603" Score="11" ViewCount="3931" Body="&lt;p&gt;I usually hear about SNMP v2c. But recently I came across v2u when configuring an SNMP agent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the differences between the SNMP v2 flavors v2c and v2u? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And which is the more recent version among these two?&lt;/p&gt;&#xA;" OwnerUserId="4795" LastEditorUserId="3191" LastEditDate="2014-12-08T20:19:03.317" LastActivityDate="2016-03-27T18:33:25.507" Title="SNMP v2: What is the difference between SNMP v2c and SNMP v2u" Tags="|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6846" PostTypeId="2" ParentId="6844" CreationDate="2014-03-16T19:23:46.917" Score="5" Body="&lt;p&gt;They have a pretty simple writeup over at &lt;a href=&quot;http://networklessons.com/network-management/how-to-configure-snmpv3-on-cisco-ios-router/&quot; rel=&quot;noreferrer&quot;&gt;Networklessons&lt;/a&gt;, but in-depth information on how it works are on &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3se/3850/snmp-xe-3se-3850-book/nm-snmp-snmpv3.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco's site&lt;/a&gt;. It can be as complicated and secure as you want it. Your 2 questions are one and the same.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A barebones config would be like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Create a group&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#snmp-server group MYGROUP v3 priv&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Attach a user to a group&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#snmp-server user MYUSER MYGROUP v3 auth md5 MYPASS123 priv aes128 MYKEY123&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you aren't looking to restrict access to specific MIBs, then this is all you really need.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-03-16T19:23:46.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6847" PostTypeId="2" ParentId="6845" CreationDate="2014-03-16T19:39:15.850" Score="15" Body="&lt;ul&gt;&#xA;&lt;li&gt;SNMPv2u is a user-based security model, as specified in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1909&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1909&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1910&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1910&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;SNMPv2c is a common community-based security model.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;SNMP 2u offers per-user authentication, similar to SNMPv3.  SNMPv2u never really took off in the wild; anyone who wants per-user authentication uses SNMPv3.  For more details (and there are a lot), consider this article in &lt;a href=&quot;http://www.simple-times.org/pub/simple-times/usec/v2compare.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;the Simple Times&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;That said, I'm not even sure how many agents support SNMPv2u; however it isn't many if they do.  &lt;a href=&quot;http://www.net-snmp.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;NET-SNMP&lt;/a&gt; doesn't even have an option for &lt;code&gt;-v2u&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2016-03-27T18:33:25.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6848" PostTypeId="2" ParentId="6843" CreationDate="2014-03-16T19:56:32.657" Score="4" Body="&lt;p&gt;Haven't used it for quite some time but last time this tutorial worked for me:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.gns3.net/2009/10/olive-juniper/&quot; rel=&quot;noreferrer&quot;&gt;http://blog.gns3.net/2009/10/olive-juniper/&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also take a look at &lt;a href=&quot;http://www.juniper.net/de/de/dm/firefly/&quot; rel=&quot;noreferrer&quot;&gt;http://www.juniper.net/de/de/dm/firefly/&lt;/a&gt; You can download a virtual Juniper SRX (for VMWARE, Linux KVM, Virtualbox) which you can connect to GNS3 via the &quot;cloud&quot; symbol.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-03-16T19:56:32.657" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6851" PostTypeId="1" CreationDate="2014-03-17T12:33:00.507" Score="6" ViewCount="34514" Body="&lt;p&gt;If I sent an ARP request to the target machine, which is in over Internet and has 2 routers between, what will the target IP address on my request (0001) packet be? Will it be the Router IP address, which is my gateway, or will it be the target machine address? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: Lets say I want to do an ARP request from &lt;code&gt;Computer A&lt;/code&gt; to &lt;code&gt;Computer C&lt;/code&gt;, and the scheme is below.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1 =&amp;gt; Internet =&amp;gt; Router2 =&amp;gt; Computer C &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What would be the target IP address, &lt;code&gt;Router1&lt;/code&gt; or &lt;code&gt;Computer C&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help me with this. I am kind of confused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="4808" LastEditorUserId="3191" LastEditDate="2014-03-17T15:36:46.587" LastActivityDate="2017-08-05T15:13:38.687" Title="ARP request outside of LAN; Target machine or router response?" Tags="|arp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6852" PostTypeId="2" ParentId="6823" CreationDate="2014-03-17T12:50:42.890" Score="8" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;1.Would it be better to setup traffic policing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You're using shaping, which is better in this case.  The important thing is to buffer your traffic before sending it to your internet provider.   Consider this:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Your ISP asks you to set your physical interface to 100Mbps&lt;/li&gt;&#xA;&lt;li&gt;Your service from the ISP is 30Mbps&lt;/li&gt;&#xA;&lt;li&gt;What happens if you're already sending 30Mbps of traffic, and you need to send a ping?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;By default, your Cisco 2901 router's interface will buffer based on the physical transmit rate (100Mbps) you are configuring.  If you do not add traffic shaping, that ping has a decent chance of being dropped because the ISP is almost certainly policing ingress to 30Mbps on the other end.  Traffic shaping allows you to buffer your instantaneous traffic in excess of 30Mbps, so it has a chance of making it past your ISP's ingress policing; otherwise your router won't even think about buffering traffic until it reaches the physical interface transmit rate (100Mbps).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Setup traffic shaping:&#xA;class-map match-any SHAPE match any&lt;br&gt;&#xA;policy-map SHAPE&lt;br&gt;&#xA;class SHAPE&lt;br&gt;&#xA;shape average 30000000&lt;br&gt;&#xA;interface GigabitEthernet0/1&lt;br&gt;&#xA;service-policy output SHAPE&lt;br&gt;&#xA;...&lt;br&gt;&#xA;Would it be better to setup traffic shaping/policing on outside interface (gig 0/0)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You should definitely set up egress shaping on Gi0/0; consider qos, and / or &lt;a href=&quot;https://networkengineering.stackexchange.com/a/5318/775&quot;&gt;wred&lt;/a&gt; as well.&lt;/p&gt;&#xA;&lt;p&gt;Since Gi0/1 is a LAN-facing interface, egress shaping doesn't help much unless you need to prioritize certain traffic, or use &lt;a href=&quot;https://networkengineering.stackexchange.com/a/5318/775&quot;&gt;wred&lt;/a&gt; on the queue (which wouldn't be a bad idea, if you set it up right).&lt;/p&gt;&#xA;&lt;p&gt;When you configure your QoS policies, I recommend you do it in this order:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Test ping loss from Gi0/0 to 50.204.xxx.81 for at least 20 minutes &lt;em&gt;without qos&lt;/em&gt; on either interface; if you don't have a clean baseline, then you'll spend a lot of time chasing the wrong packet loss in the next steps.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/a/1370/775&quot; title=&quot;Use iperf or nuttcp to measure interface throughput&quot;&gt;Test&lt;/a&gt; egress shaping rates on your Gi0/0 interface at about 200-300 byte IP packets (i.e. somewhere at or below &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Mix&quot; rel=&quot;noreferrer&quot;&gt;imix&lt;/a&gt; sizes), and adjust the rates until you don't drop traffic to them (see below).  You might need to ask them to temporarily colo some of your test equipment in their network.  Failing that, you can rent a server on the internet to test with; however, that gets fairly complicated since there would likely be several additional congestion points.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/a/1370/775&quot; title=&quot;Use iperf or nuttcp to measure interface throughput&quot;&gt;Test&lt;/a&gt; egress shaping rates on your Gi0/1 interface, in the same way you did above.&lt;/li&gt;&#xA;&lt;li&gt;Add &lt;a href=&quot;https://networkengineering.stackexchange.com/a/5318/775&quot;&gt;wred&lt;/a&gt; (if you plan to do so).  &lt;a href=&quot;https://networkengineering.stackexchange.com/a/1370/775&quot; title=&quot;Use iperf or nuttcp to measure interface throughput&quot;&gt;Test&lt;/a&gt; again with 3 parallel TCP streams in each traffic direction.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;em&gt;Test strategy&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;p&gt;I strongly recommend that you perform a UDP &lt;a href=&quot;https://networkengineering.stackexchange.com/a/1370/775&quot;&gt;non-drop transmit rate test&lt;/a&gt; with whatever qos settings you choose because it's possible that your shaping rate could be slightly higher than your ISP's rate.  If so, then you need to lower your shaping parameters until you don't drop traffic when you send it to them.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;I am confused with ISP giving me 50.204.xxx.80/30 address for interconnect block and then saying that I can use 50.204.xxx.83 thru 50.204.xxx.86?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;That definitely is confusing, as far as I can tell, that sentence can be safely ignored; however, please double check with them to be sure.  The reason I say this:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;They said &amp;quot;ISP Internet gateway: 50.204.xxx.81&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;They said &amp;quot;Customer Layer 3 device WAN interface: 50.204.xxx.82&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;They said &amp;quot;The /29 of usable IP space is statically routed by ISP to 50.204.xxx.82&amp;quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Regarding your &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6823/isp-edge-router-configuration#comment11127_6824&quot;&gt;question in the comments&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The routes shown in this diagram are adequate.  You only need a default route to the provider, unless you plan to turn up other networks besides 50.204.xxx.88/29.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/M8mmE.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M8mmE.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h3&gt;Side notes&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I normally don't recommend hard-coding speed and duplex on ethernet interfaces, but this practice is entrenched in many ISP procedures, so there is no point in fighting it.&lt;/li&gt;&#xA;&lt;li&gt;You should adequately protect your network with a firewall as well, as &lt;a href=&quot;https://networkengineering.stackexchange.com/a/6824/775&quot;&gt;Kit suggested&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-03-17T12:50:42.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6854" PostTypeId="2" ParentId="6851" CreationDate="2014-03-17T13:09:43.780" Score="10" Body="&lt;p&gt;Using your original diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PgdhT.png&quot; alt=&quot;OP&amp;#39;s original diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Computer A tries to communicate with Computer C, the following steps resolve Router 1's software-assigned address to its hardware-assigned media access control address:&#xA;Based on the contents of the routing table on Computer A, IP determines that the forwarding IP address to be used to reach Computer C is through Router 1, the IP address of its default gateway. Host A then checks its own local ARP cache for a matching hardware address for Router 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If Computer A finds no mapping in the cache, it broadcasts an ARP request frame to all hosts on the local network with the question &quot;What is the hardware address for Router 1?&quot; Both hardware and software addresses for the source, Host A, are included in the ARP request. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each host on the local network receives the ARP request and checks for a match to its own IP address. If a host does not find a match, it discards the ARP request. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 1 determines that the IP address in the ARP request matches its own IP address and adds a hardware/software address mapping for Host A to its local ARP cache. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 1 then sends an ARP reply message containing its hardware address directly back to Host A. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Host A receives the ARP reply message from the router, it updates its ARP cache with a hardware/software address mapping for Router 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the media access control address for Router interface 1 has been determined, Host A can send IP traffic to Router 1 by addressing it to the Router interface 1 media access control address. The router then forwards the traffic to Host C through the same ARP process as discussed in this section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was updated from a &lt;a href=&quot;http://technet.microsoft.com/en-us/library/cc758357(v=ws.10).aspx&quot; rel=&quot;noreferrer&quot;&gt;Microsoft Technet&lt;/a&gt; article to match your example.  Another reference with a good example is &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junose13.1/information-products/topic-collections/swconfig-ip-ipv6/index.html?topic-65026.html&quot; rel=&quot;noreferrer&quot;&gt;Juniper networks&lt;/a&gt; description.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a nutshell Host A when communicating with external IP addresses/hosts will look to its default gateway for external IP resolution and assume traffic to Host C will be forwarded by this gateway.&lt;/p&gt;&#xA;" OwnerUserId="4006" LastEditorUserId="775" LastEditDate="2014-03-17T13:14:58.407" LastActivityDate="2014-03-17T13:14:58.407" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6855" PostTypeId="1" CreationDate="2014-03-17T13:32:51.317" Score="9" ViewCount="64732" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qDXvv.png&quot; alt=&quot;IPv4 Header&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I know the IP header length is a minimum of 20 bytes and a maximum of 60 bytes. But why? Why is the IP header length limited to 60 bytes? Is there anybody here that can explain it to me? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="4808" LastEditorUserId="3191" LastEditDate="2014-03-18T09:58:11.563" LastActivityDate="2021-03-14T15:17:54.760" Title="Maximum IPv4 header size" Tags="|ipv4|protocol-theory|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6857" PostTypeId="2" ParentId="6855" CreationDate="2014-03-17T13:51:00.570" Score="3" Body="&lt;p&gt;Per &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791&lt;/a&gt; where it is defined, see page 12 where it discusses datagrams:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Total Length is the length of the datagram, measured in octets,&#xA;including internet header and data.  This field allows the length of&#xA;a datagram to be up to 65,535 octets.  Such long datagrams are&#xA;impractical for most hosts and networks.  All hosts must be prepared&#xA;to accept datagrams of up to 576 octets (whether they arrive whole&#xA;or in fragments).  It is recommended that hosts only send datagrams&#xA;larger than 576 octets if they have assurance that the destination&#xA;is prepared to accept the larger datagrams.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The number 576 is selected to allow a reasonable sized data block to&#xA;be transmitted in addition to the required header information.  For&#xA;example, this size allows a data block of 512 octets plus 64 header&#xA;octets to fit in a datagram.  The maximal internet header is 60&#xA;octets, and a typical internet header is 20 octets, allowing a&#xA;margin for headers of higher level protocols.&amp;quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Basically the length was defined between 20 and 60 to allow for different protocol uses and to fit in the recommended datagram size.&lt;/p&gt;&#xA;" OwnerUserId="4006" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-03-17T13:51:00.570" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6858" PostTypeId="2" ParentId="6855" CreationDate="2014-03-17T14:23:02.280" Score="16" Body="&lt;p&gt;The &lt;em&gt;Internet Protocol&lt;/em&gt; (IP) is defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791&lt;/a&gt;. The RFC specifies the format of the IP header. In the header there is the &lt;strong&gt;IHL&lt;/strong&gt; (&lt;em&gt;Internet Header Length&lt;/em&gt;) field which is &lt;strong&gt;4&lt;/strong&gt; bits long and specifies the header length in &lt;em&gt;32 bit words&lt;/em&gt;. The IHL field can hold values from 0 (Binary 0000) to 15 (Binary 1111).&lt;/p&gt;&#xA;&lt;p&gt;So the longest &lt;em&gt;Internet Header&lt;/em&gt; (IP header) size can be 15*32 Bits = 480 Bits = &lt;strong&gt;60 Bytes&lt;/strong&gt;. This is why the header has a maximum size of 60 Bytes.&lt;/p&gt;&#xA;&lt;p&gt;The shortest header size is 20 bytes, where the IHL field has the value 5 (0101). This is because all the required fields in the header need 20 Bytes of space. So while in theory you could set the IHL to a value &amp;lt; 5 this would always be an incorrect value and thus an invalid packet header.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-03-18T08:46:35.513" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6860" PostTypeId="5" CreationDate="2014-03-17T15:54:06.993" Score="0" Body="&lt;p&gt;For questions about Cisco RANCID Network management application released under a BSD-style license. RANCID uses Expect to connect to the routers, send some commands and put the results in files.&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2018-02-16T19:29:31.560" LastActivityDate="2018-02-16T19:29:31.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6861" PostTypeId="4" CreationDate="2014-03-17T15:54:06.993" Score="0" Body="For questions about Cisco RANCID Network management application released under a BSD-style license. RANCID uses Expect to connect to the routers, send some commands and put the results in files." OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2018-02-16T19:29:34.490" LastActivityDate="2018-02-16T19:29:34.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6866" PostTypeId="2" ParentId="5507" CreationDate="2014-03-17T20:02:28.790" Score="3" Body="&lt;p&gt;Answering, so &lt;a href=&quot;https://networkengineering.stackexchange.com/users/-1/community&quot;&gt;community&lt;/a&gt; will quit bumping this active...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We have a handful of small business switches from cisco, model SF 302-08P. I'm trying to configure them for full tacacs support, however it appears that the model only supports tacacs for authentication, not for accounting.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As of &lt;a href=&quot;http://www.cisco.com/c/en/us/support/switches/sg300-10mp-10-port-gigabit-max-poe-managed-switch/model.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;firmware version 1.3.7.18&lt;/a&gt;, you can configure tacacs accounting for login / logout; however, there is no support for per-command accounting listed in the user manual (ref: &lt;a href=&quot;http://www.cisco.com/c/dam/en/us/td/docs/switches/lan/csbms/sf30x_sg30x/administration_guide/AG_Cisco_Sx300_1_3_7_en.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Sx300 Series Administration Guide, Version 1.3.7&lt;/a&gt;, chapter 21, pages 402-403).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-03-17T20:02:28.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6868" PostTypeId="2" ParentId="6842" CreationDate="2014-03-17T21:32:35.790" Score="4" Body="&lt;p&gt;The quickest/easiest way is to use the &lt;code&gt;show logging&lt;/code&gt; &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_s2.html#wp1565683&quot; rel=&quot;nofollow noreferrer&quot;&gt;command&lt;/a&gt;.  It would produce an output similar to below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#&#xA;00:00:46: %LINK-3-UPDOWN: Interface Port-channel1, changed state to up&#xA;00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to up&#xA;00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/2, changed state to up&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's worth noting that this buffer can fill up quickly if you have a lot of traffic going through your router, such as ACL log entries. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speaking from personal experience, we generally have explicit ACL &lt;code&gt;deny any&lt;/code&gt; entries at the end of all of our ACLs for better code readability. One of those &lt;code&gt;deny any&lt;/code&gt; policies was also set to log on a distribution switch. &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5095/cisco-6509-supervisor-card-slot-boot-failure&quot;&gt;Once we had an failure that required those log files&lt;/a&gt;, we had found our buffer was filling up and clearing out the oldest entires. We had external logging facilities (&lt;a href=&quot;http://man7.org/linux/man-pages/man8/rsyslogd.8.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;rsyslog&lt;/a&gt; on linux), but if your organization doesn't incorporate that and relies on the internal buffer, you'll need to remember that it might not be there when you need it.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-03-17T21:34:01.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6869" PostTypeId="2" ParentId="6851" CreationDate="2014-03-17T22:34:39.153" Score="4" Body="&lt;p&gt;It all depends on how the subnet masks of A and R1-1 are set, and if the configuration of R1 include the proxy-arp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a canonical configuration A and R1-1 must share a same subnet mask and their address must both match the same subnet. &#xA;When this happens, C in known to A as &quot;not belonging to the same (sub)network&quot;, so a router must be found in A routing table matching the C address. In the most common case R1-1 is know as the default gateway, so if the MAC of R1-1 is not yet known and ARP is sent to discover it. The details are in &lt;a href=&quot;https://networkengineering.stackexchange.com/a/6854/4672&quot;&gt;this answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But It is also possible a different scenario:&#xA;If A's subnet-mask is so short that even C's IP matches it (and R1 interfaces are properly configured with mask that properly partition the networks), then A believes C is on the same LAN, and tries to send an ARP to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 see the ARP and knows that such a frame will never reach C that he knows (because of its more proper subnet masks) to be behind him, and hence he will reply as C, but giving R1-1 MAC address.&#xA;This reply (known as &quot;proxy ARP&quot;) in fact fools A, that now believes C is on his own network having R1-1 MAC address. So it will talk to C by sending packet with C IP and R1-1 MAC just like it will result from normal routing process.&lt;/p&gt;&#xA;" OwnerUserId="4672" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-03-18T13:52:19.303" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6871" PostTypeId="1" CreationDate="2014-03-18T01:07:13.393" Score="4" ViewCount="2807" Body="&lt;p&gt;I'm trying to understand packet flow within a Palo Alto firewall.  Our firewall has one &quot;inbound&quot; leg and three &quot;outbound&quot; legs corresponding to different exterior VLANs.  The exterior VLANs are used for differing purposes (think multiple DMZs with a transit interface).  We want traffic to arrive at the inbound interface of a firewall (INSIDE), get NAT to an IP on one zone (ZONE2), then be routed to a third zone (ZONE1).  A recent attempt at this configuration failed, but we were unable to obtain a packet capture before we had to return the firewall to normal operation.  For those of you experienced with Palo Alto firewalls, what is the anticipated packet flow in an environment like this and can you answer the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Should I be able to achieve this with a single VR or will I need to define a different VR on a per-zone basis and/or define PBF behaviors?&lt;/li&gt;&#xA;&lt;li&gt;Will a rule be required for transit from the &quot;ZONE2&quot; zone to the &quot;ZONE1&quot; zone?&lt;/li&gt;&#xA;&lt;li&gt;Will the firewall drop the return traffic by default because the flow may seem asymmetric?  (The router directly will forward traffic to the Palo Alto's &quot;ZONE2&quot; interface) - If so, how do I disable this behavior when a zone protection profile is set to the &quot;global&quot; rule under asymmetric drop?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Diagram:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JM1Fg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JM1Fg.png&quot; alt=&quot;topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="43" LastEditorUserId="3191" LastEditDate="2014-04-19T18:52:54.327" LastActivityDate="2014-07-18T21:23:44.147" Title="Does normal packet flow within a virtual router in a PA firewall require a rule?" Tags="|routing|firewall|palo-alto|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6874" PostTypeId="1" CreationDate="2014-03-18T06:21:32.093" Score="3" ViewCount="226" Body="&lt;p&gt;Good morning,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured a pbr to apply it to a virtual-template &#xA;here is my route-map definition :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map to_virtual_template permit 10&#xA;&#xA; match ip address 101&#xA;&#xA; set ip next-hop X.X.X.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Access-List is defined as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I apply here to the Virtual-Template interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Virtual-Template1&#xA; description Template_1&#xA; ip policy route-map to_virtual_template&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The pbr is not being applied and i wonder if had to be with the SIP-400 card, if ACLs are only allowed on access subinterfaces... Or I have to take something more into account?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SUP is a SUP7203BXL and IOS 12.2(33) SRE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!!&lt;/p&gt;&#xA;" OwnerUserId="2028" LastActivityDate="2014-03-18T07:06:50.517" Title="Apply an extended ACL on Cisco 7609 SIP-400" Tags="|cisco|troubleshooting|acl|pbr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6875" PostTypeId="2" ParentId="6874" CreationDate="2014-03-18T07:06:50.517" Score="2" Body="&lt;p&gt;Based on &lt;a href=&quot;https://supportforums.cisco.com/discussion/10599211/pppoe-7600&quot; rel=&quot;nofollow&quot;&gt;documentation on Cisco Support Forums&lt;/a&gt;, PBR isn't supported on Virtual-Template interfaces (at least with SIP-400):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Yasir Ashfaque 4 years ago&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Well 2*Gbe must work, you must confirm it from CISCO TAC, beside that i dont see any issue, make sure you will use IOS greater than 12.2SRC and note it that policy-routing doesnt work on virtual-access interface. beside that it works gr8&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-03-18T07:06:50.517" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6876" PostTypeId="1" AcceptedAnswerId="6902" CreationDate="2014-03-18T12:24:46.380" Score="6" ViewCount="2156" Body="&lt;p&gt;I'm currently using a Cisco 881G2 Router which has a Cellular interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sending Text messages from the router is as simple as typing the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cellular 0 gsm sms send &amp;lt;telephonenumber&amp;gt; &amp;lt;message&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sending messages containing plain text works just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the &lt;a href=&quot;http://en.wikipedia.org/wiki/GSM_03.38&quot; rel=&quot;nofollow noreferrer&quot;&gt;GSM 03.38 standard&lt;/a&gt;, there are 128 characters in the Basic Character Set.  Several of these chracters however, require the use of an 8-bit ASCII character set, which is not the default in Cisco IOS.  Thanks to &lt;a href=&quot;https://networkengineering.stackexchange.com/a/6877/3191&quot;&gt;Brett Lykins' answer below&lt;/a&gt;, I have been able to configure my router to accept 8 bit ASCII characters, including some of the Scandinavian characters like æ, ø, å and the capitilized versions of these.  Using Telnet doesn't give me the option to send special characters, but both Putty and SecureCRT over ssh does allow me to send these special characters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regretfully, even after making these very helpful modifications, the text messages being do not arrive correctly.  The two tests I did are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cellular 0 gsm sms send 00474792xxxx Hålla!&#xA;cellular 0 gsm sms send 00474792xxxx Greetings æ, ø, å&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My mobile phone received the messages &quot;Hemla!&quot; and &quot;Greetings f- x- e&quot;, rather than what was sent.  I have for security reasons obfuscated my mobile number above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is - how does one send a text message which contains these types of characters?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/access/1800/1861/software/feature/guide/mrwls_hspa.html#wp1600033&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuration Guide&lt;/a&gt; provides no clues on how to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router runs C880 Software (C880DATA-UNIVERSALK9-M), Version 15.2(3)T2&#xA;I have tried with Putty, and with SecureCRT 7.0.3 on Windows using VT100 emulation.&lt;/p&gt;&#xA;" OwnerUserId="4822" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-03-19T10:40:13.683" Title="How does one send non-ascii characters through Cisco GSM SMS?" Tags="|cisco|router|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6877" PostTypeId="2" ParentId="6876" CreationDate="2014-03-18T13:25:16.533" Score="9" Body="&lt;p&gt;This one has flummoxed me in the past.  The commands you're looking for relate to turning on  the 8-Bit character set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, this may still not allow the cellular modem to send the characters via SMS (I do not have a card to test this with), however this is the only command that I know of that may help you out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/configuration/guide/ffun_c/fcf003.html&quot;&gt;Configuring Operating Characteristics for Terminals&lt;/a&gt; guide from Cisco (specifically the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/configuration/guide/ffun_c/fcf003.html#wp1003286&quot;&gt;section on Specifying an International Character Display&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The classic U.S. ASCII character set is limited to 7 bits (128&#xA;  characters), which adequately represents most displays in the U.S.&#xA;  Most defaults on the modem router work best on a 7-bit path. However,&#xA;  international character sets and special symbol display can require an&#xA;  8-bit wide path and other handling.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can use a 7-bit character set (such as ASCII), or you can enable a&#xA;  full 8-bit international character set (such as ISO 8859). This allows&#xA;  special graphical and international characters for use in banners and&#xA;  prompts, and adds special characters such as software flow control.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The commands to enable 8 bit character set are:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;default-value special-character-bits 8&#xA;default-value exec-character-bits 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To test, I tried to type æ into my lab router with the following results: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R-VOIPLAB#&#xA;R-VOIPLAB#&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since I have the default 7-bit character lengths turned on, it interpreted the æ as angle brackets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I turned on 8 bit character sets and logged out of my session and back in (the logout is necessary to begin using the new terminal settings we just configured):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R-VOIPLAB#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;R-VOIPLAB(config)#default-value exec-character-bits 8&#xA;R-VOIPLAB(config)#default-value special-character-bits 8&#xA;R-VOIPLAB(config)#exit&#xA;R-VOIPLAB#exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After logging back in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R-VOIPLAB#&#xA;R-VOIPLAB#æ&#xA;R-VOIPLAB#æ, ø, å&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Notes:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This testing was done with the following configuration, so your milage might vary with a different terminal emulator, different router, etc:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Test computer: Mac OSX 10.9.2 &lt;/li&gt;&#xA;&lt;li&gt;Terminal program: SecureCRT for Mac, Version 7.2.0&lt;/li&gt;&#xA;&lt;li&gt;Terminal emulation type: VT100&lt;/li&gt;&#xA;&lt;li&gt;Connection type: SSH&lt;/li&gt;&#xA;&lt;li&gt;Router: 2821&lt;/li&gt;&#xA;&lt;li&gt;IOS: 15.1(4)M6&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2014-03-18T13:31:12.817" LastActivityDate="2014-03-18T13:31:12.817" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6879" PostTypeId="1" AcceptedAnswerId="6883" CreationDate="2014-03-18T13:38:42.410" Score="2" ViewCount="919" Body="&lt;p&gt;The command syntax format of a standard ACL is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;access-list access-list-number {permit|deny} {host|source source-wildcard|any}&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an example of the use of a standard ACL in order to block all traffic except that from source 10.1.1.x.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/0 &#xA;ip address 10.1.1.1 255.255.255.0 &#xA;ip access-group 1 in&#xA;access-list 1 permit 10.1.1.0 0.0.0.255 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a question: If the Standard ACLs are applied on interfaces closer to the destination, I suppose they are always applied in the outbound direction. Am I wrong or in which situations can they be applied in the inbound direction?&lt;/p&gt;&#xA;" OwnerUserId="4824" LastActivityDate="2014-03-18T14:21:11.977" Title="Standard IP ACL inbound direction" Tags="|cisco|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6881" PostTypeId="2" ParentId="5064" CreationDate="2014-03-18T13:50:17.700" Score="6" Body="&lt;p&gt;The IETF protocol suite is not defined in term of the OSI model, hence the mapping between IETF and OSI protocol is much more a convention then else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are -in fact- good reasons to consider it a Layer 2 (it is defined as an ethertype inside an Ethernet-V2 frame, and it is not forwarded by standard IP routers) as a layer 3 (it has to inter-operate with the layer 3-to-2 mapping process of an host: something a pure layer2 node does not have)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, literature considering it a layer2 protocol is much wider, and is commonly accepted as &quot;layer 2&quot; instead of &quot;layer 3&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But don't make it a dogma: speaking in term of layer 3 is not completely heretic: The same process held into IPV6 (without ARP anymore) is often defined as &quot;layer 3&quot; but it is the exact conceptual process.&lt;/p&gt;&#xA;" OwnerUserId="4672" LastActivityDate="2014-03-18T13:50:17.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6882" PostTypeId="2" ParentId="3540" CreationDate="2014-03-18T14:04:32.867" Score="2" Body="&lt;p&gt;In order for &lt;code&gt;dhcp-snooping&lt;/code&gt; to function correctly, the snooping device needs to be setup as just a layer 2 device (i.e. not performing DHCP functions &lt;strong&gt;at all&lt;/strong&gt;).  There are a few gotcha’s from 3Com's documentation, &lt;a href=&quot;http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02579469-1.pdf&quot; rel=&quot;nofollow&quot;&gt;3Com® Switch 4500G Family Configuration Guide (p. 405)&lt;/a&gt;, which should still be applicable to your platform.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;The DHCP Snooping supports no link aggregation. If an Ethernet port is added into an  aggregation group, DHCP Snooping configuration on it&#xA;  will not take effect. When the  port is removed from the group, DHCP&#xA;  Snooping can take effect.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you have aggregated uplink ports (&lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1AX&quot; rel=&quot;nofollow&quot;&gt;802.3ax&lt;/a&gt;), the link won’t be snooped on. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;The DHCP snooping enabled device does not work if it is between the DHCP relay  agent and DHCP server, and it can work when it is between&#xA;  the DHCP client and relay  agent or between the DHCP client and&#xA;  server.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In your test bed scenario, you basically had a client and a server connected into 2 different access ports; one a &lt;strong&gt;&lt;em&gt;trusted&lt;/em&gt;&lt;/strong&gt; DHCP port.  This is the simplest way to setup DHCP-snooping.  Had this of gone wrong, I would suspect there is another, underlying issue/configuration mistake.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;The DHCP Snooping enabled device cannot be a DHCP server, DHCP relay agent,  DHCP client, or BOOTP client. Therefore, DHCP Snooping must be&#xA;  disabled on a DHCP  server, relay agent, DHCP relay agent, DHCP&#xA;  client, and BOOTP client.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What this final bit means is that you really can’t have your switch performing &lt;strong&gt;any&lt;/strong&gt; DHCP functions, aside from DHCP-snooping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the comments, you stated &lt;em&gt;”it is just L2 device”&lt;/em&gt;. I would check over your configurations more thoroughly, because you are attempting to implement that absolute basic configurations needed for DHCP snooping to function. You tested it on your test network, and it worked fine.  Now your production network, with seemingly identical configurations, isn't working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are basic configuration procedures from the &lt;a href=&quot;http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02579469-1.pdf&quot; rel=&quot;nofollow&quot;&gt;3Com documentation&lt;/a&gt;; if these don't work, I would certainly be looking elsewhere.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1  Enable DHCP snooping.&#xA;   &amp;lt;Sysname&amp;gt; system-view&#xA;   [Sysname] dhcp-snooping&#xA;2  Specify GigabitEthernet1/0/1 as trusted.&#xA;   [Sysname] interface GigabitEthernet1/0/1&#xA;   [Sysname-GigabitEthernet1/0/1] dhcp-snooping trust&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-03-18T14:40:32.163" LastActivityDate="2014-03-18T14:40:32.163" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6883" PostTypeId="2" ParentId="6879" CreationDate="2014-03-18T14:21:11.977" Score="5" Body="&lt;p&gt;The direction is always in reference to the router itself.  In your example, you have applied the ACL inbound on E0/0.  So the ACL applies to traffic from the source entering the router on E0/0.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which direction you apply the ACL depends on what you are trying to do.  But generally, it is better to filter as close to the source as possible.  There's no  point to allowing traffic to flow through the network, just to end up dropping it at the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exception is where traffic is allowed to one destination, but not another.  If, in your  example, the source was connected to E0/0, and you had two destinations on E0/1 and E0/2, where the source can talk to E0/1, but not E0/2.  In this case, you would put the ACL outbound on E0/2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could use an extended ACL inbound on E0/0 that blocks the destination on E0/2.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-18T14:21:11.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6884" PostTypeId="1" CreationDate="2014-03-18T14:29:07.327" Score="4" ViewCount="2891" Body="&lt;p&gt;What will happen if, &lt;code&gt;SW1&lt;/code&gt;, &lt;code&gt;SW2&lt;/code&gt;, &lt;code&gt;SW3&lt;/code&gt; are managed RSTP ring switches. And I add unmanaged &lt;code&gt;SW4&lt;/code&gt; and &lt;code&gt;SW5&lt;/code&gt;  the ring (both &lt;code&gt;SW4&lt;/code&gt; and &lt;code&gt;SW5&lt;/code&gt; are connected together) like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0UuRO.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0UuRO.jpg&quot; alt=&quot;digram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This project is currently at early stage. We are just trying to figure out if the hardware-specific client demand is feasible. Going with the unmanaged switches solution would reduce costs significantly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sel-2730M configurations will use BPDU Guard.&#xA;The &quot;unmanaged&quot; portion (blue portion in the diagram) of the network wont have any loops.&lt;/p&gt;&#xA;" OwnerUserId="4825" LastEditorUserId="14347" LastEditDate="2015-03-13T10:56:33.837" LastActivityDate="2015-03-13T10:56:33.837" Title="Unmanaged Switches Effect on RSTP Ring?" Tags="|spanning-tree|switching|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6885" PostTypeId="1" CreationDate="2014-03-18T15:11:21.067" Score="1" ViewCount="841" Body="&lt;p&gt;I have a Cisco Prime Infrastructure server which has fully discovered all my devices on my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I go to the &quot;Clients &amp;amp; Users&quot; tab (the new name of the old &quot;User Tracking&quot; feature), a lot of information is missing. &#xA;All the clients are correctly discovered by their MAC Address (my switches are configured with MAC notification traps) but their IP addresses/Hostnames are not pulled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only devices that push IP address information are 2960X (newish), so I am thinking that maybe the Prime Infrastructure does not poll correctly the MIB on my old devices (3750s &amp;amp; 2950s) but polls correctly the more &quot;recent&quot; MIB of the 2960X... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone encountered the same issue ? Any workarounds ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jeremy&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2014-04-17T09:15:58.557" Title="Cisco Prime Infrastructure 2.0 : IP Type - Not Detected" Tags="|cisco|ipv4|snmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6886" PostTypeId="2" ParentId="6884" CreationDate="2014-03-18T16:27:56.933" Score="4" Body="&lt;p&gt;If the unmanaged switches do not support RSTP, they should forward the BPDUs as any other L2 multicast and simply flood them out the VLAN. If they do, things will work fine since the managed switches will receive the BPDUs. The unmanagad switches would basically be transparent to the managed switches from a STP perspective.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Worst case the switches would consume the BPDUs but not act on them and create a bridging loop. I've never seen this myself but heard of such stories from others.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-03-18T16:27:56.933" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6887" PostTypeId="1" AcceptedAnswerId="6890" CreationDate="2014-03-18T17:52:08.183" Score="3" ViewCount="538" Body="&lt;p&gt;The DOWN state of an OSPF neighbor is defined as a state when no hellos are seen in the last &lt;em&gt;routerdeadinteraval&lt;/em&gt; time. The INIT state of an OSPF neighbor is defined as state attained when the first hellos are heard in &lt;em&gt;interval&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for the transition from DOWN to INIT, a hello must be heard on the down interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But contradicting this, &lt;a href=&quot;http://www.ciscopress.com/authors/bio.asp?a=32681690-097e-442f-96c7-aebb150c30af&quot; rel=&quot;nofollow&quot;&gt;Jeff Doyle&lt;/a&gt; insists that hellos are not sent to down interfaces on broadcast networks. The exception is NBMA, which will send hellos in &lt;em&gt;polltimeinteraval&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is confusing. If down interfaces are not sent a hello, how can they hear hellos and transform to INIT on broadcast multiaccess networks?&lt;/p&gt;&#xA;" OwnerUserId="442" LastEditorUserId="3191" LastEditDate="2014-03-18T18:17:03.430" LastActivityDate="2014-03-18T18:51:27.803" Title="OSPF Neighbor INIT State on Broadcast Multiaccess Network" Tags="|ospf|" AnswerCount="1" CommentCount="6" ClosedDate="2014-03-18T20:48:18.920" ContentLicense="CC BY-SA 3.0" />
  <row Id="6888" PostTypeId="1" AcceptedAnswerId="6889" CreationDate="2014-03-18T18:01:08.390" Score="0" ViewCount="198" Body="&lt;p&gt;This is a follow up to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6503/will-ping-work-if-there-are-500-routers-between-pc1-and-pc2&quot;&gt;question&lt;/a&gt;., please bear with me., i dont have enough privilege to comment on there.,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am new to Networking., the Answer is really confusing., If i ping to google or facebook., it only passes nearly 18 routers (traceroute) ., but are there more routers connected in between.? how will they manage to connect any point to point in the world with just less than 255 routers ?&#xA;so the Edge routers alone count ?&#xA;Please elaborate.&lt;/p&gt;&#xA;" OwnerUserId="442" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-03-18T19:08:17.657" Title="Explanation on less than 255 routers inbetween any any two hosts in world (TTL)" Tags="|internet|" AnswerCount="2" CommentCount="0" ClosedDate="2014-03-18T20:41:16.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="6889" PostTypeId="2" ParentId="6888" CreationDate="2014-03-18T18:14:38.940" Score="4" Body="&lt;p&gt;This is a question which I think the professional network engineers find very basic. But when asked to explain exactly and clearly why we don't need 255 intermediate hops/routers... well, it's rather hard to explain in simple terms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best explanation I've ever come up with is to consider the town or city in which you live: Consider a starting point (at some address in the city) and a desired ending point (also in the city.) Next, select a path (a set of directions) to get from the start to the end. (This is NOT how the Internet works.) How many steps are there in your instructions from start to end? ...4, 5, maybe even 8. But you simply will not need 255 steps to get from one place to another. Next, repeat the exercise from your home address to some place (like a famous museum) on the other side of your country. Again, you will find a surprisingly small number of steps are actually needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This result comes from concepts in (if I recall correctly) graph theory from mathematics. It is simply the nature of a connected graph where you have nodes and &quot;edges&quot; (the connections between nodes) passing information (packets on the Internet in our case.) Because the Internet is intentionally designed and built so that you can go to a nearby node (router) which then makes a good decision about where to go next, you effectively go &quot;up&quot; just a few hops and soon find your packet on it's way quickly &quot;over&quot; and then a few hops &quot;down&quot; to the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wikipedia has a great introduction to &lt;a href=&quot;http://en.wikipedia.org/wiki/Graph_theory&quot; rel=&quot;nofollow&quot;&gt;Graph Theory&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2014-03-18T18:14:38.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6890" PostTypeId="2" ParentId="6887" CreationDate="2014-03-18T18:51:27.803" Score="4" Body="&lt;p&gt;I'm very reluctant to criticize someone like Jeff Doyle, but I'm reading that very same paragraph you mention, and I think he could have chosen his words better. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that an OSPF router maintains the state of each its neighbors from its own point of view.   So from R1's point of view, R2 transitions to INIT when R1 hears a hello from R2, not when R1 sends a hello to R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quoting from RFC 2328:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On broadcast networks, each router advertises itself by periodically&#xA;  multicasting Hello Packets. This allows neighbors to be discovered dynamically. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So even if R1's neighbor is down, R1 is still sending hellos on that broadcast network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example from GNS3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar 18 14:36:55.615: %OSPF-5-ADJCHG: Process 1, Nbr 10.4.1.1 on Ethernet1/1 from FULL to DOWN, Neighbor Down: Dead timer expired&#xA;R1#debug ip ospf hello&#xA;OSPF hello events debugging is on&#xA;R1#&#xA;*Mar 18 14:37:53.255: OSPF: Rcv hello from 10.4.1.1 area 0 from Ethernet1/1 10.1.2.2&#xA;*Mar 18 14:37:53.255: OSPF: Mismatched hello parameters from 10.1.2.2&#xA;*Mar 18 14:37:53.259: OSPF: Dead R 48 C 40, Hello R 12 C 10  Mask R 255.255.255.0 C 255.255.255.0&#xA;R1#&#xA;*Mar 18 14:37:55.603: OSPF: Send hello to 224.0.0.5 area 0 on Ethernet1/0 from 10.1.1.1&#xA;*Mar 18 14:37:55.607: OSPF: Send hello to 224.0.0.5 area 0 on Ethernet1/1 from 10.1.2.1&#xA;*Mar 18 14:37:55.715: OSPF: Rcv hello from 2.2.2.2 area 0 from Ethernet1/0 10.1.1.2&#xA;*Mar 18 14:37:55.719: OSPF: End of hello processing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, even though R1's neighbor is down (due to hello timer mismatch), R1 is still sending hellos on that interface.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-18T18:51:27.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6892" PostTypeId="2" ParentId="6888" CreationDate="2014-03-18T19:08:17.657" Score="3" Body="&lt;p&gt;I think it is helpful to picture the Internet as not a giant mesh of networks, but more like a tree, with the large, Tier 1 providers acting as the root (or roots) of the tree.  So it is only a handful of hops from anywhere to a Tier 1 provider, and then a handful of hops through the provider (or to another provider), and then back down the  tree.  The largest number of hops I can remember seeing is about 30 from Washington DC to Mongolia.  It really is a connected world.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-18T19:08:17.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6894" PostTypeId="1" AcceptedAnswerId="6901" CreationDate="2014-03-19T00:09:59.063" Score="8" ViewCount="255" Body="&lt;p&gt;The context of this question is for a customer WiFi installation at retail locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to achieve is that when a user connects to the network for the first time, a webpage is opened on their device asking them to log in with account (i.e. email or loyalty program). &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is the name of this feature so I can make sure the routers we purchase have this feature?&lt;/li&gt;&#xA;&lt;li&gt;Can this webpage send a result (acceptance) to the router so the device is added to a white list?&lt;/li&gt;&#xA;&lt;li&gt;Is this only available for WiFi or can it also be done with Ethernet?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4820" LastEditorUserId="4820" LastEditDate="2014-03-19T01:09:39.973" LastActivityDate="2016-09-13T07:41:10.943" Title="What is the name of the feature of a Router that prompts a user with a webpage when connecting to network?" Tags="|router|wireless|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6895" PostTypeId="1" CreationDate="2014-03-19T00:36:44.850" Score="1" ViewCount="81" Body="&lt;p&gt;We are installing customer WiFi for our retail locations and want to run analytics on customer usage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Information we would like to know:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How often a customer visits a location?&lt;/li&gt;&#xA;&lt;li&gt;What locations a customer visits?&lt;/li&gt;&#xA;&lt;li&gt;How long a user is in a location?&lt;/li&gt;&#xA;&lt;li&gt;How much data a user consumes/uploads while on our network?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have experience in programming and database systems, but not with high level network engineering. So with raw usage data (i.e. csv, tab, mer files), I could get all this data within our program, although I'm imagine some routers come with reports built in or third party software that integrates and reports... I'm trying to get educated on as many aspects as I can so we can role out this network successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What specifications should I look for in a router so I can obtain usage information from it to run analytics on?&lt;/p&gt;&#xA;" OwnerUserId="4820" LastEditorUserId="775" LastEditDate="2014-03-19T01:18:32.857" LastActivityDate="2014-03-19T09:32:44.517" Title="Choosing components of a wifi customer tracking system" Tags="|wireless|management|logging|" AnswerCount="1" CommentCount="1" ClosedDate="2019-05-04T11:28:20.580" ContentLicense="CC BY-SA 3.0" />
  <row Id="6897" PostTypeId="2" ParentId="6894" CreationDate="2014-03-19T00:47:47.863" Score="5" Body="&lt;p&gt;&quot;Captive Portal&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(you may find it listed in marketing material under other names.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-03-19T00:47:47.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6900" PostTypeId="2" ParentId="6895" CreationDate="2014-03-19T08:25:07.507" Score="2" Body="&lt;p&gt;The really first step is to look for &lt;a href=&quot;http://en.wikipedia.org/wiki/RADIUS&quot; rel=&quot;nofollow&quot;&gt;Radius&lt;/a&gt; support. With Radius support you are able to manage the authentication authorization and accounting (aaa).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case you are not concerned with authentication and authorization since you are, essentially, asking for accounting. Accounting is the process by which a network device (called NAS - Network Access Server in the Radius world) periodically sends accounting messages to the RADIUS server (the aaa server) about the activity of its clients (the supplicants). For example an accounting message could transport information about how many bytes are beeing transmitted by the client during a session and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The really general idea is to have this schema:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     Client         -&amp;gt;       AP          -&amp;gt;       Radius &#xA;(Radius supplicant)    (Radius Client)       (Radius Server)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to achieve a more granular specification you could even think using &lt;a href=&quot;http://en.wikipedia.org/wiki/Netflow&quot; rel=&quot;nofollow&quot;&gt;NetFlow&lt;/a&gt; but this represents a more complex scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need suggestions about products please use the &lt;a href=&quot;http://chat.stackexchange.com/rooms/11177/general-network-engineering-recommendations&quot;&gt;chat&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="2663" LastEditDate="2014-03-19T09:32:44.517" LastActivityDate="2014-03-19T09:32:44.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6901" PostTypeId="2" ParentId="6894" CreationDate="2014-03-19T09:33:52.377" Score="7" Body="&lt;p&gt;Most of the time it is called &lt;strong&gt;Captive Portal&lt;/strong&gt;. Many WiFi access points or centralized WiFi controller setups support this feature (it may be called differently though).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For ethernet switches there are vendors that support this kind of authentication for example Juniper supports &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos10.4/topics/concept/authentication-understanding-ex-series-switches.html#jd0e99&quot;&gt;Captive Portal Authentication&lt;/a&gt; together with 802.1X and MAC RADIUS authentication on their EX switches.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-03-19T09:33:52.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6902" PostTypeId="2" ParentId="6876" CreationDate="2014-03-19T10:27:36.980" Score="6" Body="&lt;p&gt;I have found a solution!  I sent my router a text message from my phone with some Scandanavian characters, and viewing them on the router revealed this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SMSNOSKIRT01#cellular 0 gsm sms view 2&#xA;SMS ID: 2&#xA;TIME: 14/03/19 11:03:07&#xA;FROM: 474792xxxx&#xA;SIZE: 13&#xA;Test as ^] ^L ^O&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I recognised the characters as Control character keystrokes, so I did a Google search &quot;cisco control sequence&quot;, and stumbled upon a &lt;a href=&quot;http://code.google.com/p/hackerskeyboard/issues/detail?id=286&quot;&gt;Cisco Ctrl-^ Escape Sequence&lt;/a&gt; thread which refers to something which looks like &quot;\x1E&quot; - which I recongised as an escape sequence containing a hexadecimal value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I referenced the &lt;a href=&quot;http://en.wikipedia.org/wiki/GSM_03.38&quot;&gt;Basic Character Set&lt;/a&gt; again, and compiled a message which I sent like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cellular 0 gsm sms send 00474792xxxx Greetings \x0F, \x0C, \x1D, \x17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and my phone received &quot;Greetings å, ø, æ, Ψ&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Success!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it turns out it doesn't look like it is necessary to convert the Cisco router to 8 bit ASCII to be able to send messages containing these special characters, but I still thank Brett Lykins for his participation.&lt;/p&gt;&#xA;" OwnerUserId="4822" LastActivityDate="2014-03-19T10:27:36.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6903" PostTypeId="1" AcceptedAnswerId="6984" CreationDate="2014-03-19T11:11:02.203" Score="5" ViewCount="237" Body="&lt;p&gt;I have a network design with two NSA firewall clustered in HA mode and two SRA appliance also clustered in HA. My first approach for network design was this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NSA1-HA-NSA2&#xA; |       |   &#xA; |       |&#xA; |       |&#xA; |       |&#xA; |       |&#xA; |       |&#xA;SRA1-HA-SRA2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This design fails. Supposing NSA1 and SRA1 as active in cluster. If NSA1 fails and NSA2 gets as Active, SRA1 doesn't notice and it keeps as Active in SRA Cluster. (I tried setting a monitor interface in SRA cluster. In this case, if NSA1 is down, SRA cluster detects it but it doesn't start fail over mechanism).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My second approach is going to be to connect all four devices into a switch. I think in this scenario, all 4 devices see each other and I can obtain redudancy working OK in the network.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NSA1-HA-NSA2&#xA; |       |   &#xA; |       |&#xA; _________&#xA; _Switch__&#xA; |       |&#xA; |       |&#xA; |       |&#xA;SRA1-HA-SRA2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question: Is first design correct, second or none of them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastEditorUserId="3191" LastEditDate="2014-12-08T20:20:10.123" LastActivityDate="2014-12-08T20:20:10.123" Title="Connecting a firewall cluster to other appliance cluster" Tags="|firewall|design|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6908" PostTypeId="2" ParentId="6067" CreationDate="2014-03-19T15:31:39.323" Score="3" Body="&lt;p&gt;fter a long series of testing and support calls, Sonicwall produced a 'hotfixed' firmware that seems to fix this issue by adding a check box in the interface configuration to allow duplicate MAC addresses for devices that have multiple IP addresses on a single interface. So far this has proved to resolve the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hotfix # 142099&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No word yet on if this will be released into the next production firmware but the tracking ID for this is the same as the hotfix # and should be referenced in release notes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had previously answered this but the answer was deleted...&lt;/p&gt;&#xA;" OwnerUserId="4006" LastEditorUserId="4006" LastEditDate="2015-01-27T13:07:03.013" LastActivityDate="2015-01-27T13:07:03.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6909" PostTypeId="1" AcceptedAnswerId="6910" CreationDate="2014-03-19T16:08:58.643" Score="6" ViewCount="2778" Body="&lt;p&gt;I've read everywhere that wireless access points interfere with each other and should be put on distant channels. This even applies to access points on the same wired network with the same &lt;a href=&quot;https://en.wikipedia.org/wiki/Service_set_%28802.11_network%29#Service_set_identification_.28SSID.29&quot; rel=&quot;nofollow&quot;&gt;SSID&lt;/a&gt; from what I've read.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doesn't that imply that wireless clients, especially higher-powered ones, will also interfere with each other on nearby channels - or the same channel? Even when they are connecting to the same access point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this client-to-client interference exists, are there any rules of thumb for when it becomes a problem?&lt;/p&gt;&#xA;" OwnerUserId="4846" LastEditorUserId="3232" LastEditDate="2014-03-20T00:28:58.907" LastActivityDate="2014-03-20T00:28:58.907" Title="Do Wi-Fi clients interfere with each other?" Tags="|wireless|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6910" PostTypeId="2" ParentId="6909" CreationDate="2014-03-19T16:28:43.983" Score="6" Body="&lt;p&gt;You may be somewhat misinterpreting what you've read.  Most (recent) wifi radios are good at rejecting adjacent channel interference, so your concern shouldn't be with radios on different channels. An AP on channel 1 will not cause much interference with another on ch 6, for example.  The same goes for clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When two workstations are associated with the same AP, the AP coordinates their transmissions using CSMA/CA.  So they don't interfere so much as they &lt;em&gt;compete&lt;/em&gt; for available time slots.  The more clients you have, the more competition there is for  airtime and throughput decreases.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Co-channel interference can occur when there are two nearby APs on the same channel.  In this case, the APs are not in sync, so clients associated with AP1 are not in sync with clients associated to AP2. The clients will interfere with each other and the other AP, causing deferred transmissions, retransmissions, &lt;em&gt;etc&lt;/em&gt;, all taking a big bite out of your throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using nonstandard frequencies (like channel 7) is just wrong and will cause everyone problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, +1 to everything @RickyBeam said.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-03-19T22:15:01.740" LastActivityDate="2014-03-19T22:15:01.740" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="6911" PostTypeId="1" AcceptedAnswerId="7013" CreationDate="2014-03-19T19:59:03.787" Score="-2" ViewCount="411" Body="&lt;p&gt;Our company just installed a Netgear UTM9S and I've been trying to get our server visible to the outside world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've gone into firewall settings and set up a new rule that states all incoming HTTP traffic be forwarded onto 192.168.1.82, port 8881.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a while the server is visible when visiting the building IP address from both on and off the network, but for some reason our internet will cut off after about 10 minutes and the firewall admin panel is not available. The only thing that can be done is to power cycle the firewall and delete the rule. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty new to networking in general, so any advice would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="4850" LastEditorUserId="3191" LastEditDate="2014-12-08T20:31:21.310" LastActivityDate="2014-12-08T20:31:21.310" Title="Netgear UTM9S port forwarding causing drop off" Tags="|firewall|troubleshooting|internet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6912" PostTypeId="2" ParentId="6909" CreationDate="2014-03-19T21:20:50.853" Score="6" Body="&lt;p&gt;Two clients connected to the same AP... aren't &lt;em&gt;supposed&lt;/em&gt; to interfere -- it's the AP's job to coordinate things (RTS/CTS handshake.) The collision avoidance system checks for an active transmitter (which might not be associated with the same AP) before transmitting. But as with all things in the Real World(TM), there are cases where it can still happen because the radios are spaced far enough apart to not be able to hear each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Co-channel interference from the inherent overlap of 2.4G channels does cause problems. The stronger the signal the worse it will be.  802.11N in the 2.4G band will almost &lt;em&gt;never&lt;/em&gt; be able to use a wide channel, as it's required to drop to a narrow channel if it detects &lt;em&gt;anything&lt;/em&gt; in the side channels -- bluetooth, cordless phone, baby monitor, &lt;em&gt;any thing&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-03-19T21:20:50.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6913" PostTypeId="1" AcceptedAnswerId="6943" CreationDate="2014-03-19T22:17:01.883" Score="3" ViewCount="13265" Body="&lt;p&gt;I am trying to test the ability for an embedded system to create DNS requests and process their replies, but I'm having problems getting those replies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Physically, my embedded system &lt;code&gt;(192.168.1.50)&lt;/code&gt; is connected to a switch, which is connected to a router &lt;code&gt;(192.168.1.1)&lt;/code&gt;. I have another computer, &lt;code&gt;(192.168.1.31)&lt;/code&gt; connected to the same switch, on which I have Wireshark running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to send a DNS request to Google's public DNS server &lt;code&gt;(8.8.8.8:53)&lt;/code&gt; from my embedded system. Having done a bit of reading, I'm not surprised that this request is repackaged as an ARP request to the router - Wireshark reports a &lt;code&gt;who has 192.168.1.1? tell 192.168.1.50&lt;/code&gt; message - but I receive no ARP reply from the router with its MAC address, which I think is what I'm expecting before the actual DNS request can be sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, why is the router not replying?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm no network expert, so any simple help will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="4853" LastActivityDate="2014-03-21T12:59:24.943" Title="Why does my router not reply to ARP requests?" Tags="|dns|arp|" AnswerCount="1" CommentCount="10" ClosedDate="2019-05-05T01:11:43.940" ContentLicense="CC BY-SA 3.0" />
  <row Id="6914" PostTypeId="2" ParentId="6871" CreationDate="2014-03-19T23:28:28.607" Score="2" Body="&lt;p&gt;In simple case:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You need only one VR. Multiple VR are needed when you want separate routing tables for different groups of interfaces (i.e. for different clients).&lt;/li&gt;&#xA;&lt;li&gt;If you can select destination for packet using only destination IP (and as I understand - you can),&#xA;then you not need PBF. PBF is needed if you want to send packets with same&#xA;destination IP to different next hops based on source IP/port and/or&#xA;destination port.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And with your specific question:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Based on &lt;a href=&quot;https://live.paloaltonetworks.com/docs/DOC-4991&quot; rel=&quot;nofollow&quot;&gt;Palo Knowledge Base&lt;/a&gt; you can have asymmetric routing between zones if you use:&lt;br&gt;&lt;code&gt;set deviceconfig setting session tcp-reject-non-syn no&lt;/code&gt;&lt;br&gt;&lt;code&gt;set deviceconfig setting tcp asymmetric-path bypass&lt;/code&gt;&lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;But maybe you should rethink merging ZONE1, ZONE2 and ZONE3 into one zone because &lt;a href=&quot;https://live.paloaltonetworks.com/docs/DOC-1731&quot; rel=&quot;nofollow&quot;&gt;another article&lt;/a&gt; suggest that these commands effectively disable higher level scanning for asymmetric traffic. You probably can bypass this with adding artificial VR and scanning traffic between VR (where it will be symmetric), but this in effect will be same as merging zones - just more complicated.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="150" LastActivityDate="2014-03-19T23:28:28.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6915" PostTypeId="1" AcceptedAnswerId="6916" CreationDate="2014-03-20T01:04:22.150" Score="23" ViewCount="56194" Body="&lt;p&gt;Personally I don't even feel that there is a need for ACK. It's faster if we just send NACK(n) for the lost packets instead of sending an ACK for each received packet. So when/which situations would one use ACK over NACK and viceversa?&lt;/p&gt;&#xA;" OwnerUserId="4855" LastEditorUserId="4855" LastEditDate="2016-01-12T09:31:16.063" LastActivityDate="2017-08-24T12:28:59.147" Title="NACK vs. ACK? When to use one over the other one?" Tags="|protocol-theory|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6916" PostTypeId="2" ParentId="6915" CreationDate="2014-03-20T01:14:25.903" Score="33" Body="&lt;p&gt;The reason for the ACK is that a NACK is simply not sufficient.  Let's say I send you a data stream of X segments (let's say 10 for simplicity).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are on a bad connection, and only receive segments 1, 2, 4, and 5.  Your computer sends the NACK for segment 3, but doesn't realize there should be segments 6-10 and does not NACK those.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I resend segment 3, but then my computer falsely believes the data is successfully sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ACKs provide some assurance that the segment has arrived at the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want the application to deal with order of data and retransmissions, you can simply choose to utilize a protocol like UDP (for instance, like TFTP does).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-03-20T01:14:25.903" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6918" PostTypeId="1" AcceptedAnswerId="6922" CreationDate="2014-03-20T02:51:07.843" Score="4" ViewCount="4618" Body="&lt;p&gt;I have a network of routers with two clients at both ends, as shown in the Figure below. All the routers use OSPF routing protocol over IP, and the three routers inside the &quot;MPLS backbone&quot; subnetwork use OSPF over MPLS over IP, and is supposed to load-balance the traffic from jperf-c to jperf-s. The clients are configured for normal ip routing (just a default gateway to the nearest router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1gPiK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1gPiK.png&quot; alt=&quot;OSPF over MPLS network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that in practice, the load balancing is useless in this case. But this is for an exercise, not a real network. The load balancing works when I replace the MPLS by ATM switches. However with MPLS routers, all the TCP and UDP traffic goes through R3 and R5, even if there is congestion, and as a consequence R4 and R6 are never used. The weirdest thing is that when I traceroute R7 from R1, the packet go through R4 and R6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I load-balance the traffic when risks of congestion occur? I have read that OSPF is supposed to do it by default, but in my case it does not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the links have a cost of 64 and my configuration for router 2, supposed to redirect to R2 and R4 by load-balancing, is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config t&#xA;!&#xA;ip cef&#xA;!&#xA;interface Serial2/0&#xA; ip address 192.168.0.2 255.255.255.252&#xA; no shutdown&#xA;!&#xA;interface Serial2/1&#xA; ip address 192.168.0.5 255.255.255.252&#xA; no shutdown&#xA; mpls label protocol ldp&#xA; mpls ip&#xA; mpls mtu 1512&#xA; ip route-cache cef&#xA;!&#xA;interface Serial2/2&#xA; ip address 192.168.0.9 255.255.255.252&#xA; no shutdown&#xA; mpls label protocol ldp&#xA; mpls ip&#xA; mpls mtu 1512&#xA; ip route-cache cef&#xA;!&#xA;router ospf 1&#xA; network 192.168.0.0 0.0.0.3 area 0&#xA; network 192.168.0.4 0.0.0.3 area 0&#xA; network 192.168.0.8 0.0.0.3 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4249" LastEditorUserId="775" LastEditDate="2014-03-20T12:02:51.310" LastActivityDate="2015-01-16T12:28:38.083" Title="load-balancing on congestion, OSPF over MPLS" Tags="|cisco|ospf|cisco-ios|mpls|ecmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6921" PostTypeId="2" ParentId="5784" CreationDate="2014-03-20T08:33:17.617" Score="3" Body="&lt;p&gt;After you have added your links, you will end up with something with the same issue as a mesh network: You have several wireless path toward a destination and you need to use the &quot;best&quot; and forget about the others.  &quot;best&quot; being defined by some metric (capacity, loss rate, latency/jitter ...) which&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;is not trivial to retrieve&lt;/li&gt;&#xA;&lt;li&gt;is invasive, you need traffic to get them&lt;/li&gt;&#xA;&lt;li&gt;can change dramatically over time.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This kind of problem require a very specific solution.  Your best bet would be to use something like 802.11s or another mesh routing protocol that support mixing wireless and wired links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using a wireless-unaware protocol like STP is asking for trouble. If a wireless link degrades but remain usable enough for STP, you will have horrible performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, if your hardware does not support any mesh technology and you are not willing to change it, i would set A as a 4addr wireless client, so it can try roaming to the 'best' AP.  But i admit i haven't understood the situation with E and F.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2014-03-20T08:33:17.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6922" PostTypeId="2" ParentId="6918" CreationDate="2014-03-20T10:31:17.727" Score="11" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;... The load balancing works when I replace the MPLS by ATM switches. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This doesn't sound like a parallel comparison, because routers don't care whether you're forwarding through an ATM PVC or an MPLS LSP, they will load-balance in the same way, assuming the routers have the same configuration.  Perhaps you've done something unusual with your ATM VCs, but that isn't the focus of this question.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;However with MPLS routers, all the TCP and UDP traffic goes through R3 and R5, even if there is congestion, and as a consequence R4 and R6 are never used.  The weirest thing is that when I traceroute R7 from R1, the packet go through R4 and R6.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This actually is not weird, this is how routing works.  Routing happens on a per-hop basis; routers have no forward-looking wisdom to predict congestion along subsequent hops of a particular path.  Routing protocols don't carry information about load in their metric calculations (except for &lt;a href=&quot;http://blog.ipspace.net/2009/06/eigrp-load-and-reliability-metrics.html&quot; rel=&quot;nofollow&quot;&gt;EIGRP if you play games with the K values&lt;/a&gt;, but that could  result in path instability when you do that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, you can use a different algorithm and force load-balancing in this case, use &lt;code&gt;ip load-sharing per-packet&lt;/code&gt; on R2 (serial2/1 &amp;amp; serial 2/2) as well as R7 (serial 2/0 &amp;amp; 2/1):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial2/1&#xA; ip address 192.168.0.5 255.255.255.252&#xA; no shutdown&#xA; mpls label protocol ldp&#xA; mpls ip&#xA; mpls mtu 1512&#xA; ip route-cache cef&#xA; ip load-sharing per-packet&#xA;!&#xA;interface Serial2/2&#xA; ip address 192.168.0.9 255.255.255.252&#xA; no shutdown&#xA; mpls label protocol ldp&#xA; mpls ip&#xA; mpls mtu 1512&#xA; ip route-cache cef&#xA; ip load-sharing per-packet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ipspace.net/2014/03/per-packet-load-balancing-interferes.html&quot; rel=&quot;nofollow&quot;&gt;Per-packet load-balancing&lt;/a&gt; forces the router to round-robin traffic between destinations.  You should &lt;em&gt;never use this is a production network without considering the consequences&lt;/em&gt; (most often, reordering packets... which makes VoIP / video, and sometimes TCP unhappy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ipspace.net/2014/03/per-packet-load-balancing-interferes.html&quot; rel=&quot;nofollow&quot;&gt;Per-packet load-balancing&lt;/a&gt; is great in the lab, and usually unwise in production, unless you're in a very specific situation and know what you're doing.  Per-packet load-balancing also has very spotty platform support... some Cisco routers (such as the Catalyst 6500 Sup720) simply won't use per-packet load-balancing.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How do I do for the MPLS backbone to load-balance the traffic when risks of congestion occur? I have read that OSPF is supposed to do it by default, but in my case it does not?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I mentioned above, you're misunderstanding how routing works... this is a huge topic, but I'll just summarize the most relevant info here...&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;How Cisco IOS load-balancing works by default&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;By default &lt;a href=&quot;http://www.netcraftsmen.net/blogs/entry/cisco-express-forwarding-cef-with-parallel-paths.html&quot; rel=&quot;nofollow&quot;&gt;Cisco routers use &lt;em&gt;per-source / per-destination&lt;/em&gt; hashes of IP addresses&lt;/a&gt; at the ingress Label Edge Router (LER) to decide which path to take.  You can see this in action by performing &lt;code&gt;show ip cef exact-route [src-ip] [dst-ip]&lt;/code&gt;... notice the &lt;code&gt;label [FOO] TAG adj&lt;/code&gt; output below, which indicates the MPLS label allocated by LDP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE4#sh ip cef exact-route 192.168.4.1 192.168.0.5&#xA;&#xA;192.168.4.1 -&amp;gt; 192.168.0.5 =&amp;gt; label 154 TAG adj out of GigabitEthernet1/0/0, &#xA; addr 10.10.1.189&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I choose a different source or destination address, it's possible to see a different path chosen...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE4#sh ip cef exact-route 192.168.4.1 192.168.0.12&#xA;&#xA;192.168.4.1 -&amp;gt; 192.168.0.12 =&amp;gt; label 152 TAG adj out of GigabitEthernet1/0/1, &#xA; addr 10.10.1.193&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to see the general load-balancing configuration on the router, use &lt;code&gt;show ip cef [dst] internal&lt;/code&gt; (borrowing output from &lt;a href=&quot;http://rekrowten.wordpress.com/2013/08/12/is-load-balancing-in-mpls-happening/&quot; rel=&quot;nofollow&quot;&gt;this blog&lt;/a&gt;)... also note the chosen load-balance algorithm (&lt;code&gt;per-destination sharing&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ip cef 10.200.4.1 internal &#xA;10.200.4.1/32, epoch 0, flags rib only nolabel, rib defined all labels, RIB[B], refcount 5, &#xA; per-destination sharing&#xA;  sources: RIB &#xA;  feature space:&#xA;   IPRM: 0x00018000&#xA;  ifnums:&#xA;   FastEthernet1/1(5): 192.168.23.3&#xA;   FastEthernet2/0(6): 172.16.23.3&#xA;  path 6896722C, path list 68991DF0, share 1/1, type recursive, for IPv4&#xA;  recursive via 10.4.4.4[IPv4:Default], fib 6894F9B0, 1 terminal fib, v4:Default:10.4.4.4/32&#xA;    path 689672A4, path list 68991E3C, share 0/1, type attached nexthop, for IPv4&#xA;      MPLS short path extensions: MOI flags = 0x0 label 19&#xA;    nexthop 172.16.23.3 FastEthernet2/0 label 19, adjacency IP adj out of FastEthernet2/0, &#xA;     addr 172.16.23.3 686FC0A0&#xA;    path 6896731C, path list 68991E3C, share 1/1, type attached nexthop, for IPv4&#xA;      MPLS short path extensions: MOI flags = 0x0 label 19&#xA;    nexthop 192.168.23.3 FastEthernet1/1 label 19, adjacency IP adj out of FastEthernet1/1, &#xA;     addr 192.168.23.3 686FC360&#xA;  output chain:&#xA;    loadinfo 689C4DA0, per-session, 2 choices, flags 0003, 6 locks&#xA;    flags: Per-session, for-rx-IPv4&#xA;    16 hash buckets&#xA;      &amp;lt; 0 &amp;gt; label 19 TAG adj out of FastEthernet2/0, addr 172.16.23.3 686FBF40&#xA;      &amp;lt; 1 &amp;gt; label 19 TAG adj out of FastEthernet1/1, addr 192.168.23.3 686FC200&#xA;      &amp;lt; 2 &amp;gt; label 19 TAG adj out of FastEthernet2/0, addr 172.16.23.3 686FBF40&#xA;      &amp;lt; 3 &amp;gt; label 19 TAG adj out of FastEthernet1/1, addr 192.168.23.3 686FC200&#xA;      &amp;lt; 4 &amp;gt; label 19 TAG adj out of FastEthernet2/0, addr 172.16.23.3 686FBF40&#xA;      &amp;lt; 5 &amp;gt; label 19 TAG adj out of FastEthernet1/1, addr 192.168.23.3 686FC200&#xA;      &amp;lt; 6 &amp;gt; label 19 TAG adj out of FastEthernet2/0, addr 172.16.23.3 686FBF40&#xA;      &amp;lt; 7 &amp;gt; label 19 TAG adj out of FastEthernet1/1, addr 192.168.23.3 686FC200&#xA;      &amp;lt; 8 &amp;gt; label 19 TAG adj out of FastEthernet2/0, addr 172.16.23.3 686FBF40&#xA;      &amp;lt; 9 &amp;gt; label 19 TAG adj out of FastEthernet1/1, addr 192.168.23.3 686FC200&#xA;      &amp;lt;10 &amp;gt; label 19 TAG adj out of FastEthernet2/0, addr 172.16.23.3 686FBF40&#xA;      &amp;lt;11 &amp;gt; label 19 TAG adj out of FastEthernet1/1, addr 192.168.23.3 686FC200&#xA;      &amp;lt;12 &amp;gt; label 19 TAG adj out of FastEthernet2/0, addr 172.16.23.3 686FBF40&#xA;      &amp;lt;13 &amp;gt; label 19 TAG adj out of FastEthernet1/1, addr 192.168.23.3 686FC200&#xA;      &amp;lt;14 &amp;gt; label 19 TAG adj out of FastEthernet2/0, addr 172.16.23.3 686FBF40&#xA;      &amp;lt;15 &amp;gt; label 19 TAG adj out of FastEthernet1/1, addr 192.168.23.3 686FC200&#xA;    Subblocks:&#xA;     None&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Cisco IOS with CEF Load-balancing, hashed on L4 ports...&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;In IOS 12.4, Cisco introduced another algorithm to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/ipswitch/configuration/guide/12_4/isw_12_4_book/cef_load_balancng.html#wp1063014&quot; rel=&quot;nofollow&quot;&gt;load-balance traffic based on L4 ports&lt;/a&gt;... use &lt;code&gt;ip cef load-sharing algorithm include-ports source destination&lt;/code&gt; at the global configuration level.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Load-balancing with &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/TE_1208S.html&quot; rel=&quot;nofollow&quot;&gt;MPLS TE&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;MPLS TE introduces yet another twist into load-balancing, including the potential for offline optimization of paths; typically you buy an application to perform offline load optimization among various MPLS TE tunnels in the network.  This too, is a very deep subject... I mention it only because you're asking about load-balancing with MPLS &quot;automatically&quot;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-03-27T17:26:37.670" LastActivityDate="2014-03-27T17:26:37.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6923" PostTypeId="1" AcceptedAnswerId="6940" CreationDate="2014-03-20T11:19:21.457" Score="2" ViewCount="5264" Body="&lt;p&gt;From what I can tell, best practice for setting up WLANs in the 2.4GHz spectrum has been to limit channel selection to 1, 6, and 11.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Channelfly does away with that meaning any channel can be used if the algorithm thinks it is less congested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone had experience with this in practice? I have seen a few reports that it is not very effective.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion, it also makes it harder for other techs such as 802.15.4 to co-exist in a friendly way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How effective is channelfly in reality?&lt;/p&gt;&#xA;" OwnerUserId="4861" LastActivityDate="2015-09-15T17:31:58.747" Title="How effective is Channelfly from Ruckus?" Tags="|wireless|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="6925" PostTypeId="2" ParentId="6915" CreationDate="2014-03-20T11:39:25.037" Score="4" Body="&lt;p&gt;It all boils down to the loss probability distribution and traffic pattern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take for example a typical wireless link, with a steady 10-30% loss rate. If you ack each received frame (like 802.11abg), you will quickly detect when a frame has been lost, so you will not loose time to wait for a timeout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were to NAK instead, you will become dependent on the traffic pattern:&#xA;- If you send a single request packet and expect an answer, and that request is lost, you will have to have a timeout that expires if you do not get an answer.&#xA;- If you are just sending a stream of packet to a mostly mute recipient, then it is acceptable to only receive a NAK when the recipient receives the next packet or so. But this mean that the recipient has to reorder packets and that the sender must keep track of a large backlog of messages that it has sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(guess what solution 802.11n choose ? both.  The receiver sends a variable-length bitmap of frames that it has received)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now take a typical Internet network: You have close to 0% packet loss, until something bad happens, and you have a close to 100% packet loss for a certain time following some exponential distribution law, from a 200ms interruption to a minute and a half.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Acking each packet would seem pointless in a non-lossy network, until you consider the case when the link is severed: you will not receive ACK or NACK for a possibly extended amount of time, and the receiver will typically not send anything until the link is restored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use ACK, the sender will stop sending and keep its backlog until the link is restored. If you use NACK instead, then the receiver may eventually tell you that it has not received the packet that fell off the sender's backlog since a long time, and the connection is essentially unrecoverable.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2014-03-20T11:39:25.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6928" PostTypeId="1" AcceptedAnswerId="6930" CreationDate="2014-03-20T16:09:22.427" Score="1" ViewCount="113" Body="&lt;p&gt;Since wireless radios are half duplex, do they divide their time up evenly 50/50 in Tx mode and Rx mode? If so, wouldn't that halve the effective throughput? And yet we are able to achieve throughput greater than 50% of the theoretical link rate.&lt;/p&gt;&#xA;" OwnerUserId="2360" LastEditorUserId="2360" LastEditDate="2014-03-20T16:33:20.310" LastActivityDate="2014-03-20T16:48:28.793" Title="How can we achieve throughput greater than 50% of the link rate if wireless radios are half-duplex?" Tags="|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6930" PostTypeId="2" ParentId="6928" CreationDate="2014-03-20T16:48:28.793" Score="5" Body="&lt;p&gt;Half duplex implies that there is a shared medium (in this case the radio spectrum) that is capable to transport one data flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually when an host wants to transmit over a shared medium has to run an algorithm to ensure he is the only one that is transmitting to avoid collisions. In the wi-fi world the alghoritm is the &lt;a href=&quot;http://en.wikipedia.org/wiki/CSMA/CA&quot; rel=&quot;noreferrer&quot;&gt;CSMA/CA&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When an host &quot;wins&quot; the channel he transmits at the full bandwidth of the channel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you've described better fits in the Time division multiplexing (&lt;a href=&quot;http://en.wikipedia.org/wiki/Time-division_multiplexing&quot; rel=&quot;noreferrer&quot;&gt;TDM&lt;/a&gt;) that is not really an access method but is a multiplexing one.&lt;/p&gt;&#xA;" OwnerUserId="2663" LastActivityDate="2014-03-20T16:48:28.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6931" PostTypeId="1" AcceptedAnswerId="10389" CreationDate="2014-03-20T18:13:18.730" Score="4" ViewCount="330" Body="&lt;p&gt;I know from previous experience that having servers in DMZ 1 accessing the public NATed IPs of servers in DMZ 2 on the same ASA (aka &quot;hairpinning&quot;) is a tricky business in a single-context ASA. But is this still an issue with a multi-context firewall?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We currently have a physical web server that will be virtualised onto the same firewall as some (but not all) of its users, in a different DMZ. This would normally cause issues, as above, and DNS re-writing isn't an option, as not all of the web services have DNS names. With multi-context, and the web server in its own context with a shared internet interface, is that enough separation that my request packets make it all the way outside before hitting the external NAT address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is with 8.3.x software.&lt;/p&gt;&#xA;" OwnerUserId="2639" LastEditorDisplayName="user36472" LastEditDate="2018-02-14T16:39:31.653" LastActivityDate="2018-02-14T16:39:31.653" Title="Is hairpinning still a problem with multi-context ASA?" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6934" PostTypeId="1" AcceptedAnswerId="6935" CreationDate="2014-03-20T20:33:07.550" Score="7" ViewCount="4473" Body="&lt;p&gt;Can a Cisco switch be configured to have a management interface (or SVI, or VLAN interface) become a DHCP client, therefore obtaining its own IP address on the respective network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is out of curiousity, as I have not been able to come across the correct options in the CLI. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may not be possible due to the same MAC address of the virtual interface being used in various transmissions on the switch, but please let me know!&lt;/p&gt;&#xA;" OwnerUserId="2477" LastEditorUserId="33" LastEditDate="2015-07-06T19:29:06.733" LastActivityDate="2015-07-06T19:29:06.733" Title="SVI as a DHCP client" Tags="|switch|vlan|dhcp|mac-address|interface|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6935" PostTypeId="2" ParentId="6934" CreationDate="2014-03-20T21:02:11.350" Score="15" Body="&lt;p&gt;You can configure an SVI as a dhcp client by using the following command within the SVI.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address dhcp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same command is used on physical interfaces as well.&lt;/p&gt;&#xA;" OwnerUserId="2231" LastActivityDate="2014-03-20T21:02:11.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6938" PostTypeId="1" AcceptedAnswerId="6939" CreationDate="2014-03-21T02:00:21.057" Score="26" ViewCount="88818" Body="&lt;p&gt;It seems that everything I read about wifi says there are only three usable channels in the 2.4 GHz band; however, there are eleven 2.4Ghz wifi channels allowed in the US.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If everyone is using 1, 6 or 11, wouldn’t it make sense to use an unused channel, say, channel 3 for my wifi infrastructure?  Or to put the question differently, why can’t I use channels other than 1, 6 and 11?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="775" LastEditDate="2014-03-21T02:12:34.893" LastActivityDate="2022-10-10T19:22:19.997" Title="Is it safe to use any wifi channel in the 2.4GHz band?" Tags="|wireless|" AnswerCount="6" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6939" PostTypeId="2" ParentId="6938" CreationDate="2014-03-21T02:00:21.057" Score="33" Body="&lt;p&gt;The 2.4GHz band is one of many portions of radio spectrum, called the Industrial, Scientific and Medical (ISM) bands that are allocated for unlicensed use.  As long as you operate within the power and antenna limits, you can pretty much do what you want.  So the short answer is, you can.  But there are very good reasons why you shouldn’t.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part of the confusion regarding wifi channels comes from the allocation of the frequency spectrum.  The ISM band was first allocated in 1958, before most of us were born and well before anyone even imagined wireless networking.  The channel definitions were made before wifi was invented, and they assumed 5 MHz spacing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11b and g transmissions require 22MHz bandwidth. Because they’re 22MHz wide, the signal covers two channels above and below the center frequency. So if you use channel 6, your signal spreads across channels 4-8. There is only room in the entire band for three 22MHz wide signals (in the US) without overlapping if they center on channels 1, 6 and 11. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you transmit your wifi signal between two of these channels, say centered on channel 3, two things happen: your signal interferes with other wifi users on 1 and 6, and their signals interfere with you.  This will greatly increase the number of data errors, which in turn will cause retransmissions and significantly reduce your throughput. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It’s as if there are a number of parallel bicycle lanes, and you try to drive a bus down one of them.  Although you drive down one lane, your bus will occupy several of the adjacent lanes. If someone happens to be driving their bus in one of those adjacent lanes when your bus goes by, well…it won’t be pretty. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you only want to use one access point in a remote area with no other wifi signals, then you can probably get a away with using a different channel.   But in most urban commercial environments, the 2.4GHz band is pretty crowded. If you use an overlapping channel, you are likely to experience (and cause) interference. If your wireless system is large with many access points, then you will need all three non-overlapping channels to get good coverage.   Using something other than 1, 6 or 11 will limit the density of your access points, further reducing throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, it’s good practice to use 1, 6 and 11 to get the maximum use of the radio spectrum with a minimum of interference.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-21T02:00:21.057" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="6940" PostTypeId="2" ParentId="6923" CreationDate="2014-03-21T02:33:06.760" Score="2" Body="&lt;p&gt;Channelfly, and similar features from other manufacturers (e.g., Cisco Clean Air) attempt to improve wifi performance by directing an AP to change to a different channel when it detects interference.  The idea is that the AP can switch to another channel to avoid the interference, for example, from a microwave oven or even an overly crowded channel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While this sounds good in theory, there are a couple of factors that limit its effectiveness.  First, there are only 3 usable channels in the 2.4GHz band.  Because the entire band is often crowded and shares the spectrum with non-wifi devices (microwave ovens, garage door openers, wireless video cameras, &lt;em&gt;etc.&lt;/em&gt;), its is often the case that if one channel is being interfered with, so are the other two.  Microwave ovens operate approximately on channel 9, where they interfere with both 6 an 11.  That leaves just channel 1 as a possible substitute.  There is no guarantee that it has less interference or lower channel utilization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, in a large wireless system, there is usually a central controller that controls and coordinates the channel of every access point.  The controller tries to adjust each APs channel so that no two adjacent APs are on the same channel (reducing co-channel interference).  If one AP has to change channels to avoid interference, then its surrounding APs also have to change channels to avoid co-channel interference.  That in turn causes other APs to change, cascading the channel change throughout the network.  You might end up reducing interference in one location, only to increase it somewhere else.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-21T02:33:06.760" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6943" PostTypeId="2" ParentId="6913" CreationDate="2014-03-21T10:23:33.997" Score="-1" Body="&lt;p&gt;I have solved the issue. In fact, the reason that I was not able to receive ARP replies into my embedded system was because the switch was squashing them (I think this was because it was of a certain type). The solution was to place a downstream router of the switch and disable its firewall, thus creating another network within my LAN. I then requested the DNS server provided by the upstream router, through the downstream one. The downstream router does not squash ARP replies. To illustrate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;| NETWORK 1 -----------------------| NETWORK 2 --------------------|&#xA;| 192.168.1.50 --&amp;gt; 192.168.1.11   -|--&amp;gt; SWITCH --&amp;gt; 192.168.1.1    -|--&amp;gt;&#xA;| E.SYSTEM     --&amp;gt; DSTREAM ROUTER -|--&amp;gt; SWITCH --&amp;gt; USTREAM ROUTER -|--&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The upstream router knows a primary DNS server at &lt;code&gt;192.104.4.10&lt;/code&gt;, so the request was formulated from the embedded system with these IP addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP:      192.168.1.50&#xA;Gateway: 192.168.1.11&#xA;Subnet:  255.255.255.0&#xA;DNS:     192.104.4.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you for the comments, they helped me to debug this.&lt;/p&gt;&#xA;" OwnerUserId="4853" LastActivityDate="2014-03-21T10:23:33.997" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6945" PostTypeId="1" AcceptedAnswerId="6951" CreationDate="2014-03-21T10:39:50.110" Score="1" ViewCount="835" Body="&lt;p&gt;I'm not familiar the the ASA Firewall devices but can i have 3 different networks on one device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Three different ip ranges and be able to route different information on certain ports between them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6Ay9t.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither Wifi lan must be able to see each other, BYOD AND Public Wi-Fi routed to internet only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clinical services to it respective connection Only.&lt;/p&gt;&#xA;" OwnerUserId="4880" LastEditorUserId="4880" LastEditDate="2014-03-21T12:29:22.530" LastActivityDate="2015-04-12T03:35:45.750" Title="Asa Firewall Handle multiple Networks?" Tags="|cisco-asa|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6946" PostTypeId="2" ParentId="6945" CreationDate="2014-03-21T12:35:05.743" Score="-4" Body="&lt;p&gt;I'm not that great with firewalls but I do know the ASA's allow you to create multiple contexts which I believe is more equivalent to a VLAN or VRF. How many contexts I'm not sure but it can be done.&lt;/p&gt;&#xA;" OwnerUserId="4881" LastActivityDate="2014-03-21T12:35:05.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6947" PostTypeId="2" ParentId="6945" CreationDate="2014-03-21T12:35:57.077" Score="1" Body="&lt;p&gt;Yes, the ASA can easily do this.  You have your choice of using physical interfaces for each of your networks, or you can save some money by using VLANs on a single interface.  You can also do some combination of the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can create policies to restrict traffic any way you want.  Based on your diagram, though, you might have to do a little re-addressing.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-21T12:35:57.077" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="6948" PostTypeId="1" AcceptedAnswerId="6949" CreationDate="2014-03-21T14:31:15.353" Score="11" ViewCount="29646" Body="&lt;p&gt;I recently came across an issue while setting up a stack to replace an older M switch setup. I stacked 3 switches - 2 Cisco 2960's and 1 C2960 PoE using SFP cables to their backplane.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My plan was to use the SFP modules on the front end of the switches to uplink straight to the core rather than to a bottom M and a Top M that were uplinked to Core1 and Core2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We purchased non-cisco SFP's (Cisco's are much more expensive) and installed them. What I noticed via Termmon, was that each SFP was going down as soon as it was plugged in.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000016: *Feb 28 22:35:32.507 EST: %PHY-4-SFP_NOT_SUPPORTED: The SFP in Gi2/0/50 &#xA; is not supported (B2-FL1-Stack-2)&#xA;000017: *Feb 28 22:35:32.507 EST: %PM-4-ERR_DISABLE: gbic-invalid error detected&#xA; on Gi2/0/50, putting Gi2/0/50 in err-disable state (B2-FL1-Stack-2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's outputting that they are not compatible which is confusing considering the SFP is an international standard.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="3191" LastEditDate="2014-03-21T15:00:39.060" LastActivityDate="2017-09-12T16:40:50.043" Title="Non-Cisco SFP's defaulting to an err-disable state in 2960s and 2960 PoE Switch" Tags="|cisco|switch|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6949" PostTypeId="2" ParentId="6948" CreationDate="2014-03-21T14:31:15.353" Score="14" Body="&lt;p&gt;After some research I determined that Cisco automatically disables non cisco branded SFPs. In order to prevent them from defaulting to &lt;code&gt;err-disable&lt;/code&gt; I had to enter the following commands in config mode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)#service internal&#xA;Router(config)#no errdisable detect cause gbic-invalid&#xA;Router(config)#service unsupported-transceiver&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then configured the SFP interface to a management vlan, connected a laptop to it by changing the laptop's IP address and confirmed that the SFP does indeed take traffic. Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="775" LastEditDate="2014-03-21T15:19:25.890" LastActivityDate="2014-03-21T15:19:25.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6950" PostTypeId="1" AcceptedAnswerId="7005" CreationDate="2014-03-21T15:58:57.663" Score="7" ViewCount="11496" Body="&lt;p&gt;Is it possible to stack HP 2920 switches via ethernet connections (without add-in stacking modules)? I've consulted several of the docs on HPs site but can't find a definitive answer. I have older switches that are stacked this way.&lt;/p&gt;&#xA;" OwnerUserId="4532" LastActivityDate="2015-06-18T05:34:14.093" Title="HP 2920 - Can stack without stacking module?" Tags="|switch|hp-procurve|stacking|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6951" PostTypeId="2" ParentId="6945" CreationDate="2014-03-21T18:45:37.727" Score="2" Body="&lt;p&gt;The most simple answer to your question is &quot;yes&quot;. Almost all of your diagram is fairly straightforward. The only possible catch is your &quot;Clinical Services&quot; setup. You can only have one route to 0.0.0.0/0 in a typical ASA configuration, so if Clinical Services is supposed to have a separate internet connection from the other networks, then you can't do that with one ASA unless you have an ASA that does virtual firewalls (I think that's the 5515 and up but you might have to go to the 5525). It might be more cost effective to just use two 5505s if you don't have a huge number of devices. Also, the virtual firewall configuration creates all kinds of caveats and different behavior on the ASA line. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you set this up, you will have to manually configure dynamic NAT for all inside VLANs past the first.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastEditorUserId="4889" LastEditDate="2015-04-12T03:35:45.750" LastActivityDate="2015-04-12T03:35:45.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6952" PostTypeId="1" CreationDate="2014-03-21T20:33:41.953" Score="2" ViewCount="850" Body="&lt;p&gt;Do routers verify the actual IP packet size with that mentioned in the packet? &lt;/p&gt;&#xA;" OwnerUserId="4890" LastEditorUserId="775" LastEditDate="2014-03-21T22:19:35.613" LastActivityDate="2014-03-21T22:25:48.857" Title="Do routers validate the IP packet length?" Tags="|routing|ipv4|security|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6954" PostTypeId="2" ParentId="6952" CreationDate="2014-03-21T22:25:48.857" Score="3" Body="&lt;p&gt;Routers &lt;em&gt;should&lt;/em&gt; check the IP length, but are not required to.  If they check, they are required to drop mismatches between the value in the IP header and the actual packet length.  Routers should depend on link-layer payload detection, and compare with the IP header per RFC 1812.&lt;/p&gt;&#xA;&lt;p&gt;This is covered in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1812#section-5.2.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1812 - Requirements for IPv4 Routers, Section 5.2.2: &lt;em&gt;IP Header Validation&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;  Additionally, the router SHOULD verify that the packet length&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;  reported by the Link Layer is at least as large as the IP total&#xA;  length recorded in the packet's IP header.  If it appears that the&#xA;  packet has been truncated, the packet MUST be discarded, the error&#xA;  SHOULD be logged, and the router SHOULD respond with an ICMP&#xA;  Parameter Problem message whose pointer points at the IP total length&#xA;  field.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;DISCUSSION&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;  Because any higher layer protocol that concerns itself with data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;  corruption will detect truncation of the packet data when it&#xA;  reaches its final destination, it is not absolutely necessary for&#xA;  routers to perform the check suggested above to maintain protocol&#xA;  correctness.  However, by making this check a router can simplify&#xA;  considerably the task of determining which hop in the path is&#xA;  truncating the packets.  It will also reduce the expenditure of&#xA;  resources down-stream from the router in that down-stream systems&#xA;  will not need to deal with the packet.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-03-21T22:25:48.857" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6955" PostTypeId="1" CreationDate="2014-03-22T00:59:44.587" Score="5" ViewCount="728" Body="&lt;p&gt;With two route servers, one of them for redundancy, making peering for ISP's Do I have to make peering between the route servers? Despite of each route server would have all the prefixes for each ISP's.&lt;/p&gt;&#xA;" OwnerUserId="4891" LastActivityDate="2014-03-28T06:56:41.443" Title="How to design IXP with redundancy?" Tags="|router|bgp|design|redundancy|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6956" PostTypeId="2" ParentId="6950" CreationDate="2014-03-22T04:04:32.090" Score="1" Body="&lt;p&gt;The short answer is yes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The long answer is search the HP site for the 2920 series switches, support documents, setup and install documents, and download the Advanced Traffic Management Guide.  You will want to pay attention to Chapter 6.  Chapter 7 deals with the stacking modules.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a &lt;a href=&quot;http://h20566.www2.hp.com/portal/site/hpsc/template.BINARYPORTLET/public/kb/docDisplay/resource.process/?spf_p.tpst=kbDocDisplay_ws_BI&amp;amp;spf_p.rid_kbDocDisplay=docDisplayResURL&amp;amp;javax.portlet.begCacheTok=com.vignette.cachetoken&amp;amp;spf_p.rst_kbDocDisplay=wsrp-resourceState%3DdocId%253Demr_na-c03673784-2%257CdocLocale%253Den_US&amp;amp;javax.portlet.endCacheTok=com.vignette.cachetoken&quot; rel=&quot;nofollow&quot; title=&quot;HP Switch documentation&quot;&gt;link to the doc&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4893" LastEditorUserId="775" LastEditDate="2014-03-25T21:19:18.277" LastActivityDate="2014-03-25T21:19:18.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6958" PostTypeId="2" ParentId="6838" CreationDate="2014-03-22T09:32:15.053" Score="3" Body="&lt;p&gt;It depends - sometimes the MNO will simply hand off at layer 3 from its own PGW to the MVNO's PDN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes the MVNO is completely virtual and has no physical network of its own. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other instances the MVNO might have its own UMTS/LTE network, in which case the MNO will hand off from its SGW to the MVNO's PGW (if I'm remembering my LTE architecture correctly).&lt;/p&gt;&#xA;" OwnerUserId="527" LastActivityDate="2014-03-22T09:32:15.053" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6969" PostTypeId="1" CreationDate="2014-03-23T15:06:17.003" Score="4" ViewCount="2444" Body="&lt;p&gt;I'm trying to examine a simple OpenFlow ryu switch, and get out of it the destination and source addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using Mininet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example for the next commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;h1 python -m SimpleHTTPServer 80 &amp;amp;&#xA;h2 wget -O - h3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The destination is h3 and the source is h2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the simple switch which I'm using (I'm using Ryu):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    # Copyright (C) 2011 Nippon Telegraph and Telephone Corporation.&#xA;#&#xA;# Licensed under the Apache License, Version 2.0 (the &quot;License&quot;);&#xA;# you may not use this file except in compliance with the License.&#xA;# You may obtain a copy of the License at&#xA;#&#xA;#    http://www.apache.org/licenses/LICENSE-2.0&#xA;#&#xA;# Unless required by applicable law or agreed to in writing, software&#xA;# distributed under the License is distributed on an &quot;AS IS&quot; BASIS,&#xA;# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or&#xA;# implied.&#xA;# See the License for the specific language governing permissions and&#xA;# limitations under the License.&#xA;&#xA;import logging&#xA;import struct&#xA;from ryu.base import app_manager&#xA;from ryu.controller import mac_to_port&#xA;from ryu.controller import ofp_event&#xA;from ryu.controller.handler import MAIN_DISPATCHER&#xA;from ryu.controller.handler import set_ev_cls&#xA;from ryu.ofproto import ofproto_v1_0&#xA;from ryu.lib.mac import haddr_to_str&#xA;&#xA;&#xA;&#xA;&#xA;class SimpleSwitch(app_manager.RyuApp):&#xA;    OFP_VERSIONS = [ofproto_v1_0.OFP_VERSION]&#xA;&#xA;    def __init__(self, *args, **kwargs):&#xA;        super(SimpleSwitch, self).__init__(*args, **kwargs)&#xA;        self.mac_to_port = {}&#xA;&#xA;    def add_flow(self, datapath, in_port, dst, actions):&#xA;        ofproto = datapath.ofproto&#xA;&#xA;        wildcards = ofproto_v1_0.OFPFW_ALL&#xA;        wildcards &amp;amp;= ~ofproto_v1_0.OFPFW_IN_PORT&#xA;        wildcards &amp;amp;= ~ofproto_v1_0.OFPFW_DL_DST&#xA;&#xA;        match = datapath.ofproto_parser.OFPMatch(&#xA;            wildcards, in_port, 0, dst,&#xA;            0, 0, 0, 0, 0, 0, 0, 0, 0)&#xA;&#xA;        mod = datapath.ofproto_parser.OFPFlowMod(&#xA;            datapath=datapath, match=match, cookie=0,&#xA;            command=ofproto.OFPFC_ADD, idle_timeout=0, hard_timeout=0,&#xA;            priority=ofproto.OFP_DEFAULT_PRIORITY,&#xA;            flags=ofproto.OFPFF_SEND_FLOW_REM, actions=actions)&#xA;        datapath.send_msg(mod)&#xA;&#xA;    @set_ev_cls(ofp_event.EventOFPPacketIn, MAIN_DISPATCHER)&#xA;    def _packet_in_handler(self, ev):&#xA;        msg = ev.msg&#xA;        datapath = msg.datapath&#xA;        ofproto = datapath.ofproto&#xA;&#xA;        dst, src, _eth_type = struct.unpack_from('!6s6sH', buffer(msg.data), 0)&#xA;&#xA;        dpid = datapath.id&#xA;        self.mac_to_port.setdefault(dpid, {})&#xA;&#xA;        self.logger.info(&quot;packet in %s %s %s %s&quot;,&#xA;                         dpid, haddr_to_str(src), haddr_to_str(dst),&#xA;                         msg.in_port)&#xA;&#xA;        # learn a mac address to avoid FLOOD next time.&#xA;        self.mac_to_port[dpid][src] = msg.in_port&#xA;&#xA;        if dst in self.mac_to_port[dpid]:&#xA;            out_port = self.mac_to_port[dpid][dst]&#xA;        else:&#xA;            out_port = ofproto.OFPP_FLOOD&#xA;&#xA;        actions = [datapath.ofproto_parser.OFPActionOutput(out_port)]&#xA;&#xA;        # install a flow to avoid packet_in next time&#xA;        if out_port != ofproto.OFPP_FLOOD:&#xA;            self.add_flow(datapath, msg.in_port, dst, actions)&#xA;&#xA;        out = datapath.ofproto_parser.OFPPacketOut(&#xA;            datapath=datapath, buffer_id=msg.buffer_id, in_port=msg.in_port,&#xA;            actions=actions)&#xA;        datapath.send_msg(out)&#xA;&#xA;    @set_ev_cls(ofp_event.EventOFPPortStatus, MAIN_DISPATCHER)&#xA;    def _port_status_handler(self, ev):&#xA;        msg = ev.msg&#xA;        reason = msg.reason&#xA;        port_no = msg.desc.port_no&#xA;&#xA;        ofproto = msg.datapath.ofproto&#xA;        if reason == ofproto.OFPPR_ADD:&#xA;            self.logger.info(&quot;port added %s&quot;, port_no)&#xA;        elif reason == ofproto.OFPPR_DELETE:&#xA;            self.logger.info(&quot;port deleted %s&quot;, port_no)&#xA;        elif reason == ofproto.OFPPR_MODIFY:&#xA;            self.logger.info(&quot;port modified %s&quot;, port_no)&#xA;        else:&#xA;            self.logger.info(&quot;Illeagal port state %s %s&quot;, port_no, reason)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to print haddr_to_str(src), haddr_to_str(dst) and got 00:00:00:00:00:03 and ff:ff:ff:ff:ff:ff which is not what I expected. I wanted to get 2 as source and 3 as dest.&lt;/p&gt;&#xA;" OwnerUserId="4913" LastEditorUserId="775" LastEditDate="2014-03-28T10:36:29.883" LastActivityDate="2014-03-28T11:24:47.720" Title="Decoding packets in an OpenFlow ryu switch" Tags="|packet-analysis|linux|openflow|mininet|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6972" PostTypeId="1" AcceptedAnswerId="6973" CreationDate="2014-03-24T06:30:18.547" Score="4" ViewCount="6814" Body="&lt;p&gt;I came across terms like IFL IFD and IFA 's recently when studying some articles related to my project, I dont clearly understand what they are and the difference between them. I know they are related to interfaces within networking devices. I came across these terms when studying article on Juniper network's website.&lt;/p&gt;&#xA;" OwnerUserId="4483" LastEditorUserId="775" LastEditDate="2014-03-24T08:01:16.140" LastActivityDate="2014-03-24T08:01:16.140" Title="what are IFL IFD and IFA" Tags="|vlan|juniper|interface|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6973" PostTypeId="2" ParentId="6972" CreationDate="2014-03-24T07:57:14.530" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://www.gossamer-threads.com/lists/nsp/juniper/23778#23778&quot; rel=&quot;nofollow&quot;&gt;This juniper-nsp email&lt;/a&gt; explains them pretty clearly...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We try to avoid the terms &quot;ifd&quot; and &quot;ifl&quot; completely in our docs,&#xA;  but these internal terms have slipped out in a few places. The&#xA;  relationship is fairly simple: &quot;ifd&quot; is the physical interface&#xA;  device, where &quot;ifl&quot; is the logical interface (aka unit). Logical&#xA;  interfaces are arranged as children of a physical interface... As an example, [interfaces so-1/2/3] would be a physical interface and [interfaces so-1/2/3 unit 0] would be a logical unit. The organization hierarchy continues down with address families (iff) as [... family inet] and addresses (ifa) as [... address 10.1.2.3/24].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In summary:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ifd: A Junos Physical Interface&lt;/li&gt;&#xA;&lt;li&gt;ifl: A &lt;a href=&quot;http://forums.juniper.net/t5/Junos/Juniper-logical-interface-concept/td-p/163660&quot; rel=&quot;nofollow&quot;&gt;Junos Logical Interface&lt;/a&gt; (how individual vlans on a physical interface are distinguished)&lt;/li&gt;&#xA;&lt;li&gt;ifa: A Junos interface address&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-03-24T07:57:14.530" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6975" PostTypeId="2" ParentId="3281" CreationDate="2014-03-24T08:27:15.863" Score="0" Body="&lt;p&gt;One single device (Sonicpoint) is enough for the configuration you're seeking. If you need 2 wireless networks you'll have to create 2 virtual interfaces (and 2 different zones).&#xA;Client isolation is also possible.&lt;/p&gt;&#xA;" OwnerUserId="4920" LastActivityDate="2014-03-24T08:27:15.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6976" PostTypeId="1" AcceptedAnswerId="6977" CreationDate="2014-03-24T08:44:36.677" Score="6" ViewCount="3371" Body="&lt;p&gt;I have two routers: Cisco ISR 2921 with IOS version &lt;code&gt;15.0(1r)M9&lt;/code&gt; and a Cisco C2600 which is an old guy with IOS &lt;code&gt;12.0(7)XK1&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this set up on a FreeRADIUS server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router-admin   MD5-Password := &quot;&amp;lt;MD5-Digested-Password&amp;gt;&quot;&#xA;               Service-Type = NAS-Prompt-User,&#xA;               Cisco-AVPair += &quot;shell:priv-lvl=15&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have set up the following config on both of the routers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;aaa authentication login default group radius local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ISR 2921, when you authenticate, gives you 15th level of privilege (# shell) at once, but the C2600 gives a user mode (&gt; shell). Why would this happen? Maybe the IOS doesn't support that option yet or do I have to do some additional configuration?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Update:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Actually one more thing that's different is C2600 runs telnet (because it doesn't support SSH) and 2921 runs SSH.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VTY section from 2921:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line vty 0 4&#xA; access-class 50 in&#xA; exec-timeout 5 0&#xA; logging synchronous&#xA; length 0&#xA; transport input ssh&#xA;line vty 5 30&#xA; access-class 50 in&#xA; exec-timeout 5 0&#xA; logging synchronous&#xA; transport input ssh&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;AAA section from 2921:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;aaa authentication login default group radius local&#xA;aaa authentication login IPSEC-USERS group radius&#xA;aaa authorization exec default group radius local&#xA;aaa authorization network IPSEC-USERS group radius&#xA;aaa accounting delay-start&#xA;aaa accounting update periodic 10&#xA;aaa accounting exec default&#xA; group radius&#xA;aaa accounting network IPSEC-USERS&#xA; group radius&#xA;aaa accounting system default&#xA; group radius&#xA;aaa session-id unique&#xA;radius-server host 192.168.5.55 auth-port 1812 acct-port 1813&#xA;radius-server key 7 &amp;lt;KEY&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VTY section from C2600:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line vty 0 4&#xA; password 7 &amp;lt;pw&amp;gt;&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;AAA section from C2600:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;aaa authentication login default group radius local&#xA;aaa authorization network default group radius local&#xA;aaa accounting exec default start-stop group radius&#xA;aaa accounting commands 15 default stop-only group radius&#xA;aaa accounting network default start-stop group radius&#xA;aaa accounting system default start-stop group radius&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="-1" LastEditDate="2014-03-24T18:13:14.020" LastActivityDate="2014-03-24T18:13:14.020" Title="Cisco + FreeRADIUS: Exec 15 level privilege mode" Tags="|cisco|troubleshooting|aaa|authentication|radius|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6977" PostTypeId="2" ParentId="6976" CreationDate="2014-03-24T09:32:38.523" Score="8" Body="&lt;p&gt;It seems that this line is missing from the c2600...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authorization exec default group radius local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Exec authorization is what gives a login session the ability to pay attention to priv information from the RADIUS server.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-03-24T09:32:38.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6980" PostTypeId="2" ParentId="6615" CreationDate="2014-03-24T12:13:12.207" Score="2" Body="&lt;p&gt;I'm now of the opinion that this isn't practical; at least in our particular scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The scheme is further complicated by the fact that traffic &quot;to tunnel&quot; is selected by ACL between HQ and RemoteDC, (and so we can make it as complicated as we want), but on the reverse &quot;path&quot; (so to speak) the  VPN concentrator at the remote end is selecting the whole HQ network as the protected network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The upshot is that these don't balance and it appears that the forward and reverse xlates don't match.  Similar to having forward and reverse routes that cause traffic to fail because NAT is at play at some point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially - this is being scrapped as &quot;too high technical risk&quot; and requires much more evaluation and possibly more control over the remote end before it becomes a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to all who looked over this.&lt;/p&gt;&#xA;" OwnerUserId="4604" LastActivityDate="2014-03-24T12:13:12.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6982" PostTypeId="2" ParentId="6950" CreationDate="2014-03-24T15:02:02.230" Score="1" Body="&lt;p&gt;Yes but its only going to be for management via a single IP.  If you want the actual backplane stacking for performance and redundancy, you are going to need the modules.  The 2920s and 3800s are the only switches in the ProCurve line that can do this, and it is similar to IRF on the Comware line.&lt;/p&gt;&#xA;" OwnerUserId="4924" LastActivityDate="2014-03-24T15:02:02.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6984" PostTypeId="2" ParentId="6903" CreationDate="2014-03-24T15:59:58.360" Score="4" Body="&lt;p&gt;Finally, I did some lab testing and get the answer. Correct design is the second one. In first design, there are some cases where failover never occurrs. In second design all devices see each other at layer 2 in the switch (remember to isolate them in a vlan) and all cases are covered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adittionally, in this case I just use link monitor. If you use some ip monitor you maybe have some weird behavior because cache in ARP tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, to connect two clusters in HA you should use a switch to connect all devices at layer 2.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastEditorUserId="3191" LastEditDate="2014-03-24T17:55:58.657" LastActivityDate="2014-03-24T17:55:58.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6985" PostTypeId="1" AcceptedAnswerId="6986" CreationDate="2014-03-24T17:22:33.287" Score="1" ViewCount="284" Body="&lt;p&gt;I have a friend working in wireless communications research. He told me that we can transmit more than one symbol in a given slot using one frequency (of course we can decode them at the receiver).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The technique as he said uses a new modulation scheme. Therefore if one transmitting node transmits to one receiving node over a wireless channel and using one antenna at each node, the technique can transmit two symbols at one slot over one frequency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not asking about this technique and I do not know whether it is correct or not but I want to know if one can do this or not? Is this even possible? Can the Shannon limit be broken? Can we prove the impossibility of such technique mathematically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other thing I want to know, if this technique is correct what are the consequences? For example what would such technique imply for the famous open problem of the interference channel? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please cite references, if possible.&lt;/p&gt;&#xA;" OwnerUserId="4928" LastEditorUserId="3191" LastEditDate="2014-12-08T20:30:55.090" LastActivityDate="2014-12-08T20:30:55.090" Title="Can we break the Shannon capacity?" Tags="|wireless|protocol-theory|ad-hoc-wireless|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6986" PostTypeId="2" ParentId="6985" CreationDate="2014-03-24T17:27:07.893" Score="4" Body="&lt;p&gt;No, we can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we can do, with better modulation, is approach the shannon limit more closely. Otherwise, if you need more bandwidth (in megabits), either increase the bandwidth (in (mega)Hertz), or increase the signal/lower the nose to get better SNR. &lt;/p&gt;&#xA;" OwnerUserId="1220" LastActivityDate="2014-03-24T17:27:07.893" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6987" PostTypeId="1" CreationDate="2014-03-24T17:34:36.953" Score="4" ViewCount="3869" Body="&lt;p&gt;I have a set up with back to back connection with EIGRP over frame-relay, mention below the device connection setup using GNS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem is: I am configuring EIGRP over frame-relay, but its not showing EIGRP neighbors under &lt;code&gt;show ip route&lt;/code&gt; command output. Please help me on it..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the configuration on routers between &lt;code&gt;R1&lt;/code&gt; and &lt;code&gt;R2&lt;/code&gt;; I removed keepalives and am using the same DLCI in frame-relay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;int se0/0&#xA;ip add 131.1.12.1 255.255.255.0&#xA;encapsulation frame-relay&#xA;no keepavlive&#xA;frame-relay map ip 131.1.12.2 100&#xA;no sh&#xA;&#xA;router eigrp 100&#xA;network 131.1.12.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;int se0/0&#xA;ip add 131.1.12.2 255.255.255.0&#xA;encapsulation frame-relay&#xA;no keepavlive&#xA;frame-relay map ip 131.1.12.1 100&#xA;&#xA;int fa1/0&#xA;ip add 131.1.23.2 255.255.255.0&#xA;no sh&#xA;&#xA;router eigrp 100&#xA;net 131.1.12.0 0.0.0.255&#xA;net 131.1.23.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fw5H5.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update after one.time's answer&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I had done the configuration as per your guidelines, now its working fine. But the problem is i cant able to ping the any of the routers own interfaces from the router itself and from the same rotuer i can able to ping other neighbors. mentioned the one router config and ping results below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2:-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 2.2.2.2 255.0.0.0&#xA;!&#xA;interface Serial0/0&#xA; ip address 131.1.12.2 255.255.255.0&#xA; encapsulation frame-relay&#xA; serial restart-delay 0&#xA; frame-relay map ip 131.1.12.1 100 broadcast&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 131.1.23.2 255.255.255.0&#xA; duplex auto speed auto&#xA;!&#xA;router eigrp 100&#xA; network 2.0.0.0 0.0.0.0&#xA; network 2.0.0.0&#xA; network 131.1.12.0 0.0.0.255&#xA; network 131.1.23.0 0.0.0.255&#xA; no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ping results :-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#ping 131.1.23.1&#xA;&#xA;Type escape sequence to abort.Sending 5, 100-byte ICMP Echos to 131.1.23.1, timeout is 2 seconds:&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;R2#ping 131.1.23.2&#xA;&#xA;Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 131.1.23.2, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms&#xA;R2#&#xA;R2#&#xA;R2#ping 131.1.12.2&#xA;&#xA;Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 131.1.12.2, timeout is 2 seconds:&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;R2#&#xA;R2#ping 131.1.12.1&#xA;&#xA;Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 131.1.12.1, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 16/36/56 ms&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) i want to setup my devices like:- -R2 and R3's interface should be confiugred to be in vlan 23. -R1 and R2,R3 and R4 should be configured in a frame-relay multipoint manner but do not use a sub-interface to accomplish this task.&lt;/p&gt;&#xA;" OwnerUserId="4927" LastEditorUserId="775" LastEditDate="2014-03-25T09:10:22.317" LastActivityDate="2014-03-25T09:10:22.317" Title="eigrp configuration problem over frame-relay" Tags="|routing|router|eigrp|frame-relay|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="6988" PostTypeId="1" CreationDate="2014-03-24T18:06:09.483" Score="5" ViewCount="923" Body="&lt;p&gt;I have a Cisco3900 called router A (192.168.100.1), which is interconnected to another router B (192.168.100.2).  I want to access my server C 220.221.x.x (which is on internet).&lt;/p&gt;&#xA;&lt;p&gt;Router A (192.168.100.1) is configured with:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip route 220.221.x.x 255.255.255.255 192.168.100.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Pinging 220.221.x.x from router A 192.168.100.1 works, all ssh,telnet, works.&lt;/p&gt;&#xA;&lt;p&gt;I want to open a port at 192.168.100.1 like 192.168.100.1:8080&#xA;forwarding traffic to 220.221.x.x:80&lt;/p&gt;&#xA;&lt;p&gt;For example, when I visit 192.168.100.1:8080, it should show 220.221.x.x:80 data.&lt;/p&gt;&#xA;&lt;p&gt;How can I configure Router A to forward port 8080 requests to 220.221.x.x:80?&lt;/p&gt;&#xA;&lt;p&gt;I tried: &lt;code&gt;ip nat inside source static tcp 220.221.x.x 80 192.168.100.1 8080&lt;/code&gt;&#xA;but when i try to load 192.168.100.1:8080, it hangs up and nothing like 220.221.x.x:80 opens. I want it to load 220.221.x.x:80 website.&lt;/p&gt;&#xA;&lt;p&gt;Diagram&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ocZ7C.jpg&quot; alt=&quot;diagram&quot; /&gt;&lt;/p&gt;&#xA;" OwnerUserId="4929" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-08-05T11:23:35.353" Title="Remote Port Forwarding Cisco" Tags="|cisco|ipv4|nat|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="6989" PostTypeId="2" ParentId="6987" CreationDate="2014-03-24T19:26:29.917" Score="3" Body="&lt;p&gt;There are a few ways to accomplish a back-to-back frame-relay connection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick search returns the following options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wan/frame-relay/14193-frbacktoback.html&quot; rel=&quot;nofollow&quot;&gt;Back-to-Back Frame-Relay using sub-interfaces&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wan/frame-relay/14194-frbacktoback-hybrid.html&quot; rel=&quot;nofollow&quot;&gt;Back-to-Back Frame-Relay Hybrid Switching&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Your configuration is closer to hybrid switching, however, you're missing a few key elements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Frame-Relay&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either R1 or R2 will need to have &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/wan/configuration/guide/fwan_c/wcffrely.html#wp1055633&quot; rel=&quot;nofollow&quot;&gt;frame-relay switching&lt;/a&gt; enabled to act as the frame-relay switch. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#frame-relay switching&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The newly designated frame switch's Serial0/0 interface needs to be changed to the frame-relay interface type dce in order to provide LMI.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#int s0/0&#xA;R1(config-if)#frame-relay intf-type dce&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally you don't need to include the &lt;code&gt;no keepavlive&lt;/code&gt; syntax when performing hybrid switching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EIGRP&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your matching(required) static &lt;code&gt;frame-relay map&lt;/code&gt; statements may include the &lt;code&gt;broadcast&lt;/code&gt; statement in order for EIGRP to establish a neighbor adjacency. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#int s0/0&#xA;R1(config-if)# frame-relay map ip 131.1.12.2 100 broadcast&#xA;&#xA;R2(config)#int s0/0&#xA;R2(config-if)# frame-relay map ip 131.1.12.1 100 broadcast&#xA;&#xA;IP: s=131.1.12.1 (local), d=224.0.0.10 (Serial0/0), len 60, sending broad/multicast&#xA;Serial0/0(o): dlci 100(0x1841), pkt type 0x800(IP), datagramsize 64&#xA;Serial0/0(o):Pkt sent on dlci 100(0x1841), pkt type 0x800(IP), datagramsize 64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Without the &lt;code&gt;broadcast&lt;/code&gt; statement, EIGRP messages sent to the multicast address 224.0.0.10 will fail to be encapsulated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: s=131.1.12.1 (local), d=224.0.0.10 (Serial0/0), len 60, sending broad/multicast&#xA;Serial0/0: broadcast search&#xA;Serial0/0:encaps failed on broadcast for link 7(IP)&#xA;IP: s=131.1.12.1 (local), d=224.0.0.10 (Serial0/0), len 60, encapsulation failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Unicast EIGRP&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, instead of using the &lt;code&gt;broadcast&lt;/code&gt; keyword with your static &lt;code&gt;frame-relay map&lt;/code&gt; statements to avoid encapsulation failures, you can specify EIGRP unicast neighbors under EIGRP process 100 and your adjacency should form.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config-if)#router eigrp 100&#xA;R1(config-router)#neighbor 131.1.12.2 s0/0&#xA;%DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 131.1.12.2 (Serial0/0) is down: Static peer configured&#xA;%DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 131.1.12.2 (Serial0/0) is up: new adjacency&#xA;&#xA;R2(config-if)#router eigrp 100&#xA;R2(config-router)#neighbor 131.1.12.1 s0/0&#xA;%DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 131.1.12.1 (Serial0/0) is down: Static peer configured&#xA;%DUAL-5-NBRCHANGE: IP-EIGRP(0) 100: Neighbor 131.1.12.1 (Serial0/0) is up: new adjacency&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2476" LastActivityDate="2014-03-24T19:26:29.917" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="6992" PostTypeId="2" ParentId="6615" CreationDate="2014-03-24T22:56:31.773" Score="0" Body="&lt;p&gt;If you have  or can install a router on the inside of each ASA you could create an encrypted GRE tunnel and either use routing or a floating static to fail to the Internet.&lt;/p&gt;&#xA;" OwnerUserId="2933" LastActivityDate="2014-03-24T22:56:31.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6996" PostTypeId="1" CreationDate="2014-03-25T16:03:33.087" Score="1" ViewCount="163" Body="&lt;p&gt;Many times I've come across that there is an &lt;em&gt;&quot;X&quot;&lt;/em&gt; added to the end of network-related names on equipment, like how copper cables have wires in them called &lt;em&gt;TX&lt;/em&gt; and &lt;em&gt;RX&lt;/em&gt;, and ports on switches can have names like &lt;em&gt;&quot;100BASE-FX&quot;&lt;/em&gt;. &lt;strong&gt;Why is the X there? Does it mean anything?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="4491" LastEditorUserId="775" LastEditDate="2014-03-25T16:48:12.187" LastActivityDate="2014-03-26T11:29:02.427" Title="Mysterious &quot;X&quot; in network terminology" Tags="|terminology|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6997" PostTypeId="2" ParentId="6996" CreationDate="2014-03-25T16:13:08.037" Score="8" Body="&lt;p&gt;&lt;a href=&quot;http://www.brocade.com/downloads/documents/technical_briefs/Ethernet_Nomenclature_GA-TB-357.pdf&quot; rel=&quot;nofollow&quot;&gt;Source: Ethernet_Nomenclature_GA-TB-357.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;100BASE-FX&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Optical link that uses short wavelength (850 nm) lasers over two FDDI&#xA;  grade multimode optical Fibers, with eXternal sourced coding. Supports&#xA;  up to at least 2 km.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, F=fiber, X=external sourced coding&lt;/p&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="165" LastEditDate="2014-03-26T11:29:02.427" LastActivityDate="2014-03-26T11:29:02.427" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="6998" PostTypeId="5" CreationDate="2014-03-25T16:52:33.523" Score="0" Body="&lt;p&gt;The terminology tag is for questions that are primarily about words / abbreviations specific to networking or network engineering.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-03-25T16:52:33.523" LastActivityDate="2014-03-25T16:52:33.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="6999" PostTypeId="4" CreationDate="2014-03-25T16:52:33.523" Score="0" Body="For questions that are primarily about words / abbreviations specific to networking or network engineering.  Do not use this tag as a catch-all for other questions." OwnerUserId="775" LastEditorUserId="8499" LastEditDate="2016-11-29T21:47:31.550" LastActivityDate="2016-11-29T21:47:31.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7003" PostTypeId="1" CreationDate="2014-03-25T19:38:10.313" Score="1" ViewCount="5537" Body="&lt;p&gt;Here's my network topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WWe9y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WWe9y.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;WHAT I WANT OT ACHIEVE:&lt;/strong&gt; access virtual machines from remote network, be able to manage them through vCenter Server, run them, and see vms consoles (what's happening inside every vm, as I can see this in my local network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;WHAT I HAVE SO FAR:&lt;/strong&gt; at the moment Im able to successfully connect from my computer in the remote network to vCenter Server, which is a virtual machine on one of my ESXi hosts. vCenter Server is the VM on ESXi 1, its IP address is 172.16.254.112/24. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;WHAT I DID:&lt;/strong&gt; I forwarded some ports on my JSRX router, forwarded 1.1.1.2:443 to 172.16.254.112:443, used this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;edit security&#xA;set zones security-zone trust address-book address accessvsphere 172.16.254.112/32&#xA;exit&#xA;&#xA;edit security policies from-zone untrust to-zone trust&#xA;set policy vspherepolicy match source-address any destination-address [ accessvsphere ] application any&#xA;set policy vspherepolicy then permit&#xA;exit&#xA;&#xA;edit security nat destination&#xA;set pool dst-nat-pool-vsphere address 172.16.254.112 port 443&#xA;set rule-set rs1 from zone untrust&#xA;set rule-set rs1 rule myrule1 match destination-address 1.1.1.2&#xA;set rule-set rs1 rule myrule1 match destination-port 443&#xA;set rule-set rs1 rule myrule1 then destination-nat pool dst-nat-pool-vsphere&#xA;exit&#xA;&#xA;edit security nat&#xA;set proxy-arp interface ge-0/0/0.0 address 1.1.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it works great, I can connect to vCenter Server, but then I try to launch virtual machine, I see only black screen and the message: &lt;code&gt;Unable to connect to the MKS: Failed to connect to server 172.16.254.11:902&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read that vCenter Server need also port 902 and 903 for full connectivity but have no idea how to do this further. Which ports I need to forward, and - how?&lt;/p&gt;&#xA;" OwnerUserId="4947" LastEditorUserId="8499" LastEditDate="2017-07-26T14:04:25.027" LastActivityDate="2017-07-26T14:04:25.027" Title="Connecting to vCenter Server, Unable to connect to the MKS: Failed to connect to server xxx.xxx.xxx.xxx:902" Tags="|nat|juniper-srx|vmware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7004" PostTypeId="2" ParentId="7003" CreationDate="2014-03-25T19:55:01.227" Score="3" Body="&lt;p&gt;You cannot do this through NAT.  When you connect to the VM console, the traffic goes to the server running the VM, not vCenter.  And it's going to get the &quot;inside&quot; address relative to vCenter, not the &quot;outside&quot; address you need.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-03-25T19:55:01.227" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7005" PostTypeId="2" ParentId="6950" CreationDate="2014-03-25T20:56:58.897" Score="7" Body="&lt;p&gt;I attempted to stack the switches referencing the guides provided, but the commands were invalid, seemingly not applying to this device. I upgraded to the latest firmware to be sure it wasn't from having an old version. No luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I contacted HP support which told me this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The stacking on this switch is different than the other procurve switches. There needs to be a stacking module attached to the switch to enable stacking. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it appears that &lt;strong&gt;a stacking module is required to stack the 2920&lt;/strong&gt;. Thanks for all the help. I'm going to buy stack modules now. I'm not sure how this will interact with other procurve switches in a stack. I wish the guides were more clear about all this up-front but maybe this posting will help others.&lt;/p&gt;&#xA;" OwnerUserId="4532" LastActivityDate="2014-03-25T20:56:58.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7006" PostTypeId="2" ParentId="5585" CreationDate="2014-03-25T21:00:47.530" Score="0" Body="&lt;p&gt;You might also try to disable flow control on t2/1/2 and then interface range t1/1/2, t2/1/2 and re-add the flowcontrol statement. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I might be stating the obvious, but I didn't see it in your steps.&lt;/p&gt;&#xA;" OwnerUserId="4948" LastActivityDate="2014-03-25T21:00:47.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7007" PostTypeId="1" CreationDate="2014-03-26T01:23:56.803" Score="6" ViewCount="407" Body="&lt;p&gt;I have 2 foundry devices running 802.1w which are both connected to an access switch which also runs 802.1w.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2 foundry's are connected to each as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the vlan configured on each of the devices to participate in spanning tree however when I add the tag/trunk ports to the vlan, the end devices configured on the access switch lose connectivity.  As soon as I remove the tagged ports from the vlan either on switchA or switchB, the connectivity gets restored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not making much sense to me why it doesn't work when the tagged ports are added to the vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SwitchA vlan config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 16 by port                                       &#xA; tagged ethe 2/1 ethe 8/21 to 8/22                                &#xA; router-interface ve 16                                           &#xA; spanning-tree 802-1w                                             &#xA; spanning-tree 802-1w priority 4096&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SwitchB vlan config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 16 by port&#xA; tagged ethe 2/2 ethe 5/1 to 5/2&#xA; router-interface ve 16&#xA; spanning-tree 802-1w&#xA; spanning-tree 802-1w priority 8192&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the output from SwitchA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port IEEE 802.1W Parameters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       &amp;lt;--- Config Params --&amp;gt;&amp;lt;-------------- Current state -----------------&amp;gt; &#xA;Port   Pri PortPath P2P Edge Role       State       Designa-  Designated       &#xA;Num        Cost     Mac Port                        ted cost  bridge           &#xA;2/1    128 200000   F   F    DESIGNATED FORWARDING  0         10000012f21e880f &#xA;8/21   128 20000    T   F    DESIGNATED FORWARDING  0         10000012f21e880f &#xA;8/22   128 20000    T   F    DESIGNATED FORWARDING  0         10000012f21e880f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the output from SwitchB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      &amp;lt;--- Config Params --&amp;gt;|&amp;lt;------------- Current state -------------------&amp;gt;&#xA;Port  Pri PortPath  P2P Edge Role       State       Designa-  Designated       &#xA;Num       Cost      Mac Port                        ted cost  bridge           &#xA;2/2   128 200000    F   F    ALTERNATE       DISCARDING  19        f010001380fa0480 &#xA;5/1   128 20000    T   F    DESIGNATED FORWARDING  0         f010001380fa0480 &#xA;5/2   128 20000    T   F    DESIGNATED FORWARDING  0         f010001380fa0480&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now with the config like this, connectivity is lost.  When I remove either the 5/1-5/2 or the 8/21-8/22 from either switch, connectivity gets restored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The access switch down below has the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface           Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;Fa0/18              Desg FWD 19        128.18   P2p &#xA;Fa0/46              Desg FWD 19        128.46   P2p &#xA;Fa0/47              Root FWD 19        128.47   P2p &#xA;Fa0/48              Desg FWD 19        128.48   P2p &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ports 47+48 are the uplinks ports going to the foundry's and 18+46 are going to end user equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This doesn't make sense to me why this happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have an explanation or a fix for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;More info&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From SwitchA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--- VLAN 16 [ STP Instance owned by VLAN 16 ] ----------------------------&#xA;&#xA;Bridge IEEE 802.1W Parameters:&#xA;&#xA;Bridge           Bridge Bridge Bridge Force    tx   &#xA;Identifier       MaxAge Hello  FwdDly Version  Hold &#xA;hex              sec    sec    sec             cnt  &#xA;10000012f21e880f 20     2      15     Default  3    &#xA;&#xA;RootBridge       RootPath  DesignatedBri-   Root  Max Fwd Hel &#xA;Identifier       Cost      dge Identifier   Port  Age Dly lo  &#xA;hex                        hex                    sec sec sec &#xA;10000012f21e880f 0         10000012f21e880f Root  20  15  2   &#xA;&#xA;Port IEEE 802.1W Parameters:&#xA;&#xA;       &amp;lt;--- Config Params --&amp;gt;&amp;lt;-------------- Current state -----------------&amp;gt; &#xA;Port   Pri PortPath P2P Edge Role       State       Designa-  Designated       &#xA;Num        Cost     Mac Port                        ted cost  bridge           &#xA;2/1    128 200000   F   F    DESIGNATED FORWARDING  0         10000012f21e880f &#xA;8/21   128 20000    F   F    DESIGNATED FORWARDING  0         10000012f21e880f &#xA;8/22   128 20000    F   F    DESIGNATED FORWARDING  0         10000012f21e880f &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From SwitchB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--- VLAN 16 [ STP Instance owned by VLAN 16 ] ----------------------------&#xA;&#xA;Bridge IEEE 802.1W Parameters:&#xA;&#xA;Bridge           Bridge Bridge Bridge Force    tx   &#xA;Identifier       MaxAge Hello  FwdDly Version  Hold &#xA;hex              sec    sec    sec             cnt  &#xA;2000000cdba0d20f 20     2      15     Default  3    &#xA;&#xA;RootBridge       RootPath  DesignatedBri-   Root  Max Fwd Hel &#xA;Identifier       Cost      dge Identifier   Port  Age Dly lo  &#xA;hex                        hex                    sec sec sec &#xA;10000012f21e880f 200019    f010001380fa0480 2/2   20  15  2   &#xA;&#xA;          &amp;lt;--- Config Params --&amp;gt;|&amp;lt;------------- Current state -------------------&amp;gt;&#xA;    Port  Pri PortPath  P2P Edge Role       State       Designa-  Designated       &#xA;    Num       Cost      Mac Port                        ted cost  bridge           &#xA;    2/2   128 200000    F   F    ALTERNATE       DISCARDING  19        f010001380fa0480 &#xA;    5/1   128 20000    T   F    DESIGNATED FORWARDING  0         f010001380fa0480 &#xA;    5/2   128 20000    T   F    DESIGNATED FORWARDING  0         f010001380fa0480&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;REDID CONFIG and NOW GET THE FOLLOWING&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SwitchA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--- VLAN 16 [ STP Instance owned by VLAN 16 ] ----------------------------&#xA;&#xA;Bridge IEEE 802.1W Parameters:&#xA;&#xA;Bridge           Bridge Bridge Bridge Force    tx   &#xA;Identifier       MaxAge Hello  FwdDly Version  Hold &#xA;hex              sec    sec    sec             cnt  &#xA;10000012f21e880f 20     2      15     Default  3    &#xA;&#xA;RootBridge       RootPath  DesignatedBri-   Root  Max Fwd Hel &#xA;Identifier       Cost      dge Identifier   Port  Age Dly lo  &#xA;hex                        hex                    sec sec sec &#xA;10000012f21e880f 0         10000012f21e880f Root  20  15  2   &#xA;&#xA;Port IEEE 802.1W Parameters:&#xA;&#xA;       &amp;lt;--- Config Params --&amp;gt;&amp;lt;-------------- Current state -----------------&amp;gt; &#xA;Port   Pri PortPath P2P Edge Role       State       Designa-  Designated       &#xA;Num        Cost     Mac Port                        ted cost  bridge           &#xA;2/1    0   200000   F   F    DESIGNATED FORWARDING  0         10000012f21e880f &#xA;8/21   128 20000    F   F    DESIGNATED FORWARDING  0         10000012f21e880f &#xA;8/22   128 20000    F   F    DESIGNATED FORWARDING  0         10000012f21e880f &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SwitchB:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--- VLAN 16 [ STP Instance owned by VLAN 16 ] ----------------------------&#xA;&#xA;Bridge IEEE 802.1W Parameters:&#xA;&#xA;Bridge           Bridge Bridge Bridge Force    tx   &#xA;Identifier       MaxAge Hello  FwdDly Version  Hold &#xA;hex              sec    sec    sec             cnt  &#xA;2000000cdba0d20f 20     2      15     Default  3    &#xA;&#xA;RootBridge       RootPath  DesignatedBri-   Root  Max Fwd Hel &#xA;Identifier       Cost      dge Identifier   Port  Age Dly lo  &#xA;hex                        hex                    sec sec sec &#xA;10000012f21e880f 20000     10000012f21e880f 5/1   20  15  2   &#xA;&#xA;Port IEEE 802.1W Parameters:&#xA;&#xA;      &amp;lt;--- Config Params --&amp;gt;|&amp;lt;------------- Current state -------------------&amp;gt;&#xA;Port  Pri PortPath  P2P Edge Role       State       Designa-  Designated       &#xA;Num       Cost      Mac Port                        ted cost  bridge           &#xA;2/2   128 200000    F   F    ALTERNATE  DISCARDING  19        f010001380fa0480 &#xA;5/1   128 20000     F   F    ROOT       FORWARDING  0         10000012f21e880f &#xA;5/2   128 20000     F   F    ROOT       FORWARDING  0         10000012f21e880f &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="864" LastEditorUserId="775" LastEditDate="2014-03-26T09:19:25.260" LastActivityDate="2015-02-20T00:21:55.707" Title="Odd stp issue on foundrys" Tags="|troubleshooting|spanning-tree|foundry|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="7008" PostTypeId="2" ParentId="7007" CreationDate="2014-03-26T03:10:57.817" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;5/1 &amp;amp; 5/2 are connected to 8/21 &amp;amp; 8/22 for the foundrys. They are running LACP. Port 47 goes to SwitchA and port 48 goes to SwitchB from the access switch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Then what you are seeing is &lt;em&gt;exactly what you should see&lt;/em&gt;... STP killing the loop.  Switch A &amp;amp; B are connected via their LACP trunk.  And then an access switch is connected to &lt;strong&gt;BOTH&lt;/strong&gt; Switch A and B.  One of those two links will be (MUST BE) blocked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be a disconnect between the access and main switches, as the access switch is in the &lt;code&gt;FWD&lt;/code&gt; state on all ports.  I've never seen a stack do that.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-03-26T19:30:57.827" LastActivityDate="2014-03-26T19:30:57.827" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7010" PostTypeId="1" AcceptedAnswerId="7016" CreationDate="2014-03-26T06:36:32.573" Score="6" ViewCount="3174" Body="&lt;p&gt;Can I stick an SFP transceiver module in a SFP+ port in a Cisco Nexus 5K for example if I need to connect a fast ethernet switch with a 1 Gbps SFP uplink port? I saw this Nexus's ports are 1/10 Gbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it depend on a switch module or is there a general rule, that they should be compatible? &lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="2093" LastEditDate="2014-03-26T09:41:08.933" LastActivityDate="2014-06-04T07:28:26.870" Title="Is SFP+ backwards compatible with SFP?" Tags="|cisco|cisco-nexus-5k|sfp|transceiver|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7012" PostTypeId="1" AcceptedAnswerId="7019" CreationDate="2014-03-26T08:12:47.630" Score="1" ViewCount="208" Body="&lt;p&gt;tell me please, who Knows is there xml output of config in screenos.  In Junos it achieve by command-- show | display xml . &lt;/p&gt;&#xA;" OwnerUserId="4635" LastActivityDate="2014-03-26T11:40:18.547" Title="Report XML of screenos-config" Tags="|screenos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7013" PostTypeId="2" ParentId="6911" CreationDate="2014-03-26T08:59:23.570" Score="1" Body="&lt;p&gt;Because you provided no further explanation, I will take a shot in the wild: your router has it's own administrative interface on the same port you are trying to redirect/forward. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally when someone on the internet types into his/her browser your address, e.g. &lt;code&gt;youraddress.org&lt;/code&gt; he or she would be directed at your UTM appliance's administrative interface (which may even be blocked from the WAN ports, so they would see nothing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are forwarding :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;WAN port 8881 to LAN address 192.168.1.82 port 8881&lt;/li&gt;&#xA;&lt;li&gt;or WAN port 8881 to LAN address 192.168.1.82 port 80&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;then you are doing the right thing, but internet users should type in their browsers &lt;code&gt;youraddress.org:8881&lt;/code&gt;. In this case I can't help you any further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If by any chance you are forwarding WAN port 80 to LAN 192.168.1.82 port 8881 then this won't work. Your UTM might even get stuck from this, as you are saying it does, I don't know. You would first have to make your UTM's administrative interface to listen on some other port than 80. Unfortunately I could not find any option in UTM9S user's manual that would allow to do that.&lt;/p&gt;&#xA;" OwnerUserId="4955" LastActivityDate="2014-03-26T08:59:23.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7014" PostTypeId="1" AcceptedAnswerId="7018" CreationDate="2014-03-26T09:01:44.303" Score="7" ViewCount="6504" Body="&lt;p&gt;I have a Cisco Router 1941 Series and I want to make some changes to the access-list on the router. I got to know I will have to delete one of the list and then re-add everything again with my additional ones included while stating the deny ones at the end of it. On removing, it went well but on adding, it hangs after the first statement. And whenever I try pasting the code at once, it hangs too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried copying the file to tftp, make some edits and then bring it back, I got some errors with the certificate signing side of it making some complaints..  How can I solve the problem with the ACL?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Edit]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the present, this is what I have,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description ### WAN INTERFACE ###&#xA; ip address xxx.xxx.xxx.xxx 255.xxx.xxx.xxx&#xA; ip flow ingress&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex full&#xA; speed 100&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description ### LAN INTERFACE ###&#xA; no ip address&#xA; ip flow ingress&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1.1&#xA; description ### 1st FLR NETWORK ###&#xA; encapsulation dot1Q 1 native&#xA; ip address 192.168.1.1 255.255.255.0&#xA; ip access-group 110 in&#xA; ip accounting output-packets&#xA; ip flow ingress&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;interface GigabitEthernet0/1.2&#xA; description ### GROUND FLR NETWORK ###&#xA; encapsulation dot1Q 2&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip access-group 110 in&#xA; ip accounting output-packets&#xA; ip flow ingress&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;ip flow-export source GigabitEthernet0/1&#xA;ip flow-export version 9&#xA;ip flow-export destination 192.168.1.120 9996&#xA;ip flow-top-talkers&#xA; top 10&#xA; sort-by bytes&#xA;!&#xA;ip nat source static 192.168.1.19 interface Loopback100&#xA;ip nat inside source list NAT interface GigabitEthernet0/0 overload&#xA;ip route 0.0.0.0 0.0.0.0 xxx.vvv.vvv.vvv&#xA;!&#xA;ip access-list standard NAT&#xA; permit 192.168.1.0 0.0.0.255&#xA; permit 192.168.2.0 0.0.0.255&#xA;!&#xA;access-list 110 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44&#xA;access-list 110 permit ip host 192.168.2.44 192.168.1.0 0.0.0.255&#xA;access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.18&#xA;access-list 110 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255&#xA;access-list 110 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255&#xA;access-list 110 permit udp any any&#xA;access-list 110 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I would like to add additional ones to it... like this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.120&#xA;access-list 110 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255&#xA;access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.222&#xA;access-list 110 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3869" LastEditorUserId="775" LastEditDate="2014-03-26T10:43:46.320" LastActivityDate="2015-06-19T01:41:47.753" Title="Edit Cisco IOS ACL without hanging the router" Tags="|cisco|router|cisco-ios|troubleshooting|acl|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7016" PostTypeId="2" ParentId="7010" CreationDate="2014-03-26T09:22:33.480" Score="3" Body="&lt;p&gt;&lt;em&gt;EDIT&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GigabitEthernet SFP transceivers are supported in 1/10G SFP+ Nexus 5k slots.  Please see the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/nexus-5000-series-switches/data_sheet_c78-618603.html&quot; rel=&quot;nofollow&quot;&gt;Nexus 5k Datasheet&lt;/a&gt; (see Table 2) for details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Original Answer&lt;/em&gt;:&lt;br&gt;&#xA;&lt;strike&gt;No &lt;a href=&quot;http://www.cisco.com/c/en/us/products/interfaces-modules/fast-ethernet-sfp-modules/index.html&quot; rel=&quot;nofollow&quot;&gt;FastEthernet SFP&lt;/a&gt;s are listed in the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/nexus-5000-series-switches/data_sheet_c78-618603.html&quot; rel=&quot;nofollow&quot;&gt;Nexus 5k Datasheet&lt;/a&gt; (see Table 2); as such, you're out of luck.  FastEthernet SFPs are not supported on the Nexus 5k; however, many FastEthernet switches have GigabitEthernet uplinks.  If that FE switch has a GE uplink, then use that GE port on the FE switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The old GBIC transceiver format was pretty generic and you could ignore branding on them. SFPs are a different animal, vendors qualify individual part numbers for support; you can even see different transceiver part number support between different switches from the same vendor.&lt;/strike&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-03-26T09:42:55.063" LastActivityDate="2014-03-26T09:42:55.063" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7018" PostTypeId="2" ParentId="7014" CreationDate="2014-03-26T10:42:09.107" Score="16" Body="&lt;p&gt;The reason your router hangs is because you're editing the ACL through the same interface that it's applied to.  Usually what happens is you wind up blocking yourself accidentally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I make a suggestion for reorganizing your ACLs at the bottom of this answer, although most people will be interested in this first section (the easiest way to change ACLs).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;The easiest way to change Cisco IOS ACLs&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Newer Cisco IOS images (such as the image on your Cisco 1941) support &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2s/feature/guide/fsaclseq.html&quot;&gt;IP access-list line numbering&lt;/a&gt;, which means you can modify your ACL without removing it...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will use the example of your original ACL 110, although as I mentioned you should really consider reorganizing your ACLs into two different ACLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Step 1, ACL 110 already on the router&lt;/em&gt;&lt;/strong&gt;:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LAB_RTR#sh access-list 110&#xA;Extended IP access list 110&#xA;    10 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44&#xA;    20 permit ip host 192.168.2.44 192.168.1.0 0.0.0.255&#xA;    30 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.18&#xA;    40 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255&#xA;    50 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255&#xA;    60 permit udp any any&#xA;    70 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Take note of the line numbers that Cisco automatically added to ACL 110. Remember that you need to add your ACL entries before line 50, due to the deny statement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Step 2, Modify ACL 110 in place with new entries, starting after line 40&lt;/em&gt;&lt;/strong&gt;:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LAB_RTR#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;LAB_RTR(config)#ip access-list extended 110&#xA;LAB_RTR(config-ext-nacl)#41 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.120&#xA;LAB_RTR(config-ext-nacl)#42 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255&#xA;LAB_RTR(config-ext-nacl)#43 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.222&#xA;LAB_RTR(config-ext-nacl)#44 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255&#xA;LAB_RTR(config-ext-nacl)#end&#xA;LAB_RTR#&#xA;LAB_RTR#&#xA;LAB_RTR#&#xA;LAB_RTR#sh access-list 110&#xA;Extended IP access list 110&#xA;    10 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44&#xA;    20 permit ip host 192.168.2.44 192.168.1.0 0.0.0.255&#xA;    30 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.18&#xA;    40 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255&#xA;    41 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.120&#xA;    42 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255&#xA;    43 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.222&#xA;    44 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255&#xA;    50 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255&#xA;    60 permit udp any any&#xA;    70 permit ip any any&#xA;LAB_RTR#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Step 3, Renumber the ACL, automatically&lt;/em&gt;&lt;/strong&gt;:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The automatic line numbers are nice, because Cisco also gives you a way to renumber the config...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LAB_RTR#conf t&#xA;LAB_RTR(config)#! Renumber ACL 110, from line 10... increment in steps of 10&#xA;LAB_RTR(config)#ip access-list resequence 110 10 10&#xA;LAB_RTR(config)#end&#xA;LAB_RTR#&#xA;&#xA;LAB_RTR#sh access-list 110&#xA;Extended IP access list 110&#xA;    10 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44&#xA;    20 permit ip host 192.168.2.44 192.168.1.0 0.0.0.255&#xA;    30 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.18&#xA;    40 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255&#xA;    50 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.120&#xA;    60 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255&#xA;    70 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.222&#xA;    80 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255&#xA;    90 deny ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255&#xA;    100 permit udp any any&#xA;    110 permit ip any any&#xA;LAB_RTR#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;Original way to change Cisco IOS ACLs&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Originally, the safest way to change your ACL was by removing it from the interfaces in question (this prevented problems if you were changing the ACL via the same interface it was applied to).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use this technique if your IOS doesn't support &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2s/feature/guide/fsaclseq.html&quot;&gt;IP access-list line numbering&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1.1&#xA; no ip access-group 110 in&#xA;!&#xA;interface GigabitEthernet0/1.2&#xA; no ip access-group 110 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you can add the new ACL lines, but do it before the other permit any entries...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Reset the ACL&#xA;no access-list 110&#xA;!&#xA;access-list 110 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44&#xA;access-list 110 permit ip host 192.168.2.44 192.168.1.0 0.0.0.255&#xA;access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.18&#xA;access-list 110 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255&#xA;!! New ACL lines before the deny statement&#xA;access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.120&#xA;access-list 110 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255&#xA;access-list 110 permit ip 192.168.2.0 0.0.0.255 host 192.168.1.222&#xA;access-list 110 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255&#xA;!! Deny statement&#xA;access-list 110 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255&#xA;access-list 110 permit udp any any&#xA;access-list 110 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, reapply the ACL to the switch...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1.1&#xA; ip access-group 110 in&#xA;!&#xA;interface GigabitEthernet0/1.2&#xA; ip access-group 110 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;ACL Reorganization&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;You should really consider using two different ACLs for Gigabit0/1.1 and GigabitEthernet0/1.2... this is a guess at what you're trying to do, but it's unclear that I'm interpreting things correctly...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 111 permit ip 192.168.1.0 0.0.0.255 host 192.168.2.44&#xA;access-list 111 permit ip host 192.168.1.18 192.168.2.0 0.0.0.255&#xA;access-list 111 permit ip host 192.168.1.120 192.168.2.0 0.0.0.255&#xA;access-list 111 permit ip host 192.168.1.222 192.168.2.0 0.0.0.255&#xA;access-list 111 deny   ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255&#xA;access-list 111 permit udp any any&#xA;access-list 111 permit ip any any&#xA;!&#xA;interface GigabitEthernet0/1.1&#xA; no ip access-group 110 in&#xA; ip access-group 111 in&#xA;!&#xA;interface GigabitEthernet0/1.2&#xA; no ip access-group 110 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-03-26T11:24:07.463" LastActivityDate="2014-03-26T11:24:07.463" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7019" PostTypeId="2" ParentId="7012" CreationDate="2014-03-26T11:40:18.547" Score="3" Body="&lt;p&gt;There is no XML output for Juniper ScreenOS devices. Only Junos devices have XML configuration output as the underlying management system on those devices uses XML.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-03-26T11:40:18.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7020" PostTypeId="2" ParentId="5585" CreationDate="2014-03-26T11:50:24.073" Score="3" Body="&lt;p&gt;Sadly portchannels on Cisco are a pain when adding new interfaces. Sometimes the only way to &quot;recover&quot; a Port-Channel is to completeley deconfigure and reconfigure it. Steps to do so:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Reset all channel interface members to their default config&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;default interface TenGigabitEthernet1/1/2&#xA;default interface TenGigabitEthernet2/1/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Remove the channel interface&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no interface Port-channel1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Add interfaces to Channel&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface TenGigabitEthernet1/1/2&#xA; channel-group 1 mode active&#xA;&#xA;interface TenGigabitEthernet2/1/2&#xA; channel-group 1 mode active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Configure all interface parameters on channel&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-Channel1&#xA; flow-control receive on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is important to configure all interface-relevant information on the Port-Channel (except stuff that only works on physical interfaces like &lt;code&gt;cdp&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-03-26T11:50:24.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7021" PostTypeId="1" AcceptedAnswerId="7025" CreationDate="2014-03-26T13:03:28.927" Score="2" ViewCount="3063" Body="&lt;p&gt;If you are running eBGP with several transit providers, what is best practice for redistributing into ospf?  Would we want to redistribute the connected/static subnets into ospf?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, what is the benefit of doing that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, what is the reason for not doing it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="864" LastActivityDate="2014-03-26T17:32:16.723" Title="Redistribute connected/static interfaces into ospf?" Tags="|bgp|ospf|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="7022" PostTypeId="1" AcceptedAnswerId="7026" CreationDate="2014-03-26T14:29:37.853" Score="4" ViewCount="5904" Body="&lt;p&gt;We're adding two SonicWALL NSA 2600 firewalls to our current setup. We currently get two WAN connections from two separate Cisco routers running on the same external subnet with what I believe is HSRP. Right now we run these two connections into two Cisco switches, and all of our computers then plug into both switches with NIC teaming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the new setup, we'd like to create a 3-port VLAN on each switch, one port for the WAN connection from the Internet and two ports for each NSA 2600. I've got the WAN port setup from one switch to each SonicWALL in HA mode. If I add the second switch connections to X2, I can't figure out how get the bridged in the Network section. If I choose the WAN zone, I just get Static, Wire Mode, and Tap Mode. Static doesn't make much sense, since I'd need to pick a new IP address. Wire Mode will only let me choose unused interfaces (X4 and X5), and Tap Mode looks totally useless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any tips on how to make this work or where to learn more about getting something like this working (and maintains full redundancy)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case a diagram might help someone understand what I'm trying to do:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MnAkG.png&quot; alt=&quot;Network Setup Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what it looked like pre-firewall:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6dfrB.png&quot; alt=&quot;Old Network Setup Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are pictures of what I'm seeing on my LAN side:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4FgK9.png&quot; alt=&quot;LAN bridge&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nothing like that seems to exist on the WAN side:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sIwFL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4958" LastEditorUserId="4958" LastEditDate="2014-03-26T14:47:43.963" LastActivityDate="2016-04-08T12:27:14.700" Title="SonicWALL HA w/ Dual WAN HSRP from two redundant switches" Tags="|redundancy|wan|sonicwall|hsrp|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7024" PostTypeId="1" CreationDate="2014-03-26T16:14:57.557" Score="6" ViewCount="1078" Body="&lt;p&gt;I have port security configured as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA; switchport access vlan 196&#xA; switchport mode access&#xA; switchport port-security&#xA; switchport port-security aging time 3&#xA; switchport port-security violation restrict&#xA; switchport port-security aging type inactivity&#xA; switchport port-security mac-address sticky&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And on the jack is a Dell Computer. Twice this week the user has called the Help Desk complaining that they don't have network access and both times I discovered that sticky had learned her mac address as &quot;vlan voice&quot; (no voice vlan is configured) as shown:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA; switchport port-security mac-address sticky xxxx.xxxx.xxxx vlan voice&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I simply clear sticky on this port it relearns it as &quot;vlan access&quot; and everything is fine (at least for a day or so). Any idea why this is happening?&lt;/p&gt;&#xA;" OwnerUserId="4959" LastActivityDate="2014-05-12T19:45:07.890" Title="Sticky mac learning PC mac as vlan voice on Cisco 3750v2" Tags="|cisco|port-security|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7025" PostTypeId="2" ParentId="7021" CreationDate="2014-03-26T17:32:16.723" Score="7" Body="&lt;h2&gt;Adding BGP next-hops to OSPF&lt;/h2&gt;&#xA;&lt;p&gt;Promoting my comments to an answer...&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If you are running eBGP with several transit providers, what is best practice for redistributing into ospf? Would we want to redistribute the connected/static subnets into ospf?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You should only redistribute your routes to connected BGP next-hops into OSPF as a last resort.   Whenever you redistribute routes in OSPF:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You're &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7021/redistribute-connected-static-interfaces-into-ospf#comment11493_7021&quot;&gt;requiring yet another Type4 LSA for every OSPF ASBR&lt;/a&gt; (if you're in a multiple-OSPF-area scenario)&lt;/li&gt;&#xA;&lt;li&gt;You're &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7021/redistribute-connected-static-interfaces-into-ospf#comment11498_7021&quot;&gt;building bad OSPF configuration habits&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;One of OSPF's scaling points is based on the number of LSAs carried in the AS (&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7039-1.html#t34a&quot; rel=&quot;noreferrer&quot;&gt;especially external LSAs&lt;/a&gt;).  You should generally try to avoid unnecessary LSA generation, because these additional LSAs incrementally slow down convergence during topology changes, due to flooding requirements.&lt;/p&gt;&#xA;&lt;p&gt;Furthermore, since &lt;code&gt;redistribute connected&lt;/code&gt; creates OSPF external routes; these external routes can only be summarized at the originating &lt;a href=&quot;http://en.wikipedia.org/wiki/Open_Shortest_Path_First#Autonomous_system_boundary_router&quot; rel=&quot;noreferrer&quot;&gt;OSPF ASBR&lt;/a&gt; or &lt;a href=&quot;http://en.wikipedia.org/wiki/Open_Shortest_Path_First#Not-so-stubby_area&quot; rel=&quot;noreferrer&quot;&gt;NSSA&lt;/a&gt; ABR.  External routes limit your ability to aggregate address space (and laying out address space such that you can &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7039-1.html#t29&quot; rel=&quot;noreferrer&quot;&gt;summarize&lt;/a&gt; at &lt;a href=&quot;http://en.wikipedia.org/wiki/Open_Shortest_Path_First#Area_border_router&quot; rel=&quot;noreferrer&quot;&gt;OSPF ABR&lt;/a&gt;s is a key principle of good IGP/OSPF design).&lt;/p&gt;&#xA;&lt;p&gt;In short: always prefer internal OSPF routes, if possible.  There are valid use-cases for external routes, but needlessly spamming OSPF E1 or E2 routes throughout the AS with &lt;code&gt;redistribute connected&lt;/code&gt; could eventually cause you more pain than necessary... sometimes a lot of pain.&lt;/p&gt;&#xA;&lt;h2&gt;eBGP Next-Hop resolution&lt;/h2&gt;&#xA;&lt;p&gt;One of BGP's decision points is whether the eBGP next-hop is reachable for a prefix.  If the eBGP next-hop is not reachable (perhaps you didn't include it in your OSPF table), then the route is rejected as a candidate best-path.&lt;/p&gt;&#xA;&lt;p&gt;There are a few ways that you can ensure that the eBGP next-hop always resolves... I'm listing them in order or preference.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;When using direct BGP peering, ensure your &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7021/redistribute-connected-static-interfaces-into-ospf#comment11493_7021&quot;&gt;BGP peering interfaces are included in your IGP&lt;/a&gt; (in this case, OSPF)&lt;/li&gt;&#xA;&lt;li&gt;When using indirect (i.e. &lt;a href=&quot;http://wiki.nil.com/EBGP_load_balancing_with_EBGP_session_between_loopback_interfaces&quot; rel=&quot;noreferrer&quot; title=&quot;Load balance with eBGP Multihop&quot;&gt;eBGP multi-hop&lt;/a&gt;), redistribute your static routes to the BGP peer's next-hop.&lt;/li&gt;&#xA;&lt;li&gt;Use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp3.html#wp1108213&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;next-hop self&lt;/code&gt;&lt;/a&gt; on iBGP sessions (which generally means you won't need to worry about next-hop resolution, but comes at the expense of knowing IGP costs to the next-hop)&lt;/li&gt;&#xA;&lt;li&gt;Use a default route, as was &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7021/redistribute-connected-static-interfaces-into-ospf#comment11496_7021&quot;&gt;suggested above&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The key take-away is that your BGP route will be rejected if the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html#background&quot; rel=&quot;noreferrer&quot;&gt;eBGP next-hop IP address does not resolve through an IGP route&lt;/a&gt; (ref: &lt;em&gt;Paths for which the NEXT_HOP is inaccessible&lt;/em&gt;).&lt;/p&gt;&#xA;&lt;p&gt;Even so, the four options listed above are not equal, because BGP also considers the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html#bestpath&quot; rel=&quot;noreferrer&quot;&gt;IGP cost to the next-hop&lt;/a&gt; as a path discriminator.  If one relies on a default route to resolve next-hops, you have:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Removed this as a decision point, making your BGP path selection less accurate (by default)&lt;/li&gt;&#xA;&lt;li&gt;Made eBGP outbound load-distribution less granular (in other words, you wind up sending all BGP traffic through the default, unless you have an explicit next-hop in the IGP)&lt;/li&gt;&#xA;&lt;li&gt;Created a potential black-hole if the default route doesn't cover all possible next-hop routers.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The aforementioned disadvantages go away if you simply add your BGP next-hop interfaces into OSPF.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-03-26T17:32:16.723" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7026" PostTypeId="2" ParentId="7022" CreationDate="2014-03-26T17:58:23.813" Score="4" Body="&lt;p&gt;One option is to connect both switches together and create two vlans that span across both switches.  Connect the routers and the WAN side of the FW to VLAN 1.  Connect the LAN side and the servers to VLAN 2.  If you run HSRP on the routers, that is your default gatewway for the firewall.  Here is a logical diagram.  Let me know if you need help configuring trunking on the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PJotn.jpg&quot; alt=&quot;HA Logical diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-26T17:58:23.813" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="7028" PostTypeId="1" AcceptedAnswerId="7113" CreationDate="2014-03-26T19:50:11.197" Score="7" ViewCount="2769" Body="&lt;p&gt;I have a single Cisco ASA 5510 in production.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ASA version &lt;code&gt;8.0(2)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;ASDM version &lt;code&gt;6.0(2)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;1GB RAM (upgraded recently from 256MB)&lt;/li&gt;&#xA;&lt;li&gt;64MB Flash&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have backed up the flash and the configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We need to upgrade the ASA version to &lt;code&gt;9.1(4)&lt;/code&gt; and ASDM version to &lt;code&gt;7.1(5)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following queries:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Do I need to upgrade the Flash from 64MB to a larger one for the software upgrade?&lt;/li&gt;&#xA;&lt;li&gt;What is the recommended upgrade path from &lt;code&gt;8.0(2)&lt;/code&gt; to &lt;code&gt;9.1(4)&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;li&gt;Do I need to manually update the start-up configuration due to changes in NAT syntax etc between these versions or will this be done automatically if I follow a recomended upgrade path?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks for your time!&lt;/p&gt;&#xA;" OwnerUserId="4795" LastEditorDisplayName="user36472" LastEditDate="2018-02-14T16:39:21.680" LastActivityDate="2018-02-14T16:39:21.680" Title="Upgrading ASA and ASDM on a ASA5510" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7029" PostTypeId="1" AcceptedAnswerId="7033" CreationDate="2014-03-26T20:25:02.130" Score="5" ViewCount="8273" Body="&lt;p&gt;For &lt;strong&gt;IOS-XE&lt;/strong&gt; and &lt;strong&gt;Junos&lt;/strong&gt;, I wanted to know the command that displays the routes advertised by BGP to neighbors. On IOS-XR, this command is 'show bgp advertised'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know on XE, per neighbor based advertised routes can be checked. But I want advertised routes to all the neighbors combined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE: Confirmed with Cisco TAC - for Cisco IOS-XE, there is no such command to view routes to ALL the neighbors. It can only be per neighbor based.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="4962" LastEditorUserId="4962" LastEditDate="2014-03-27T16:07:31.970" LastActivityDate="2014-03-27T16:07:31.970" Title="Checking advertised routes - BGP" Tags="|cisco|bgp|juniper-junos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7031" PostTypeId="2" ParentId="6955" CreationDate="2014-03-26T20:30:03.670" Score="-1" Body="&lt;p&gt;It would be preferable to peer your two routers using ibgp. &#xA;That way, your left hand is in sync with the right hand :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your question doesn't specify if you have two different ISPs connected to your two routers or just one ISP that is connecting you. I would recommend using route filtering so as not to configure your routers to become a transit AS (unless you want to).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common configuration would see your primary router advertising your AS normally and your backup router advertising your AS using prepending. That is to influence the return path towards packets that have left your network amongst other things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other configurations advertises your network to your primary ISP using the longest match while your backup router advertises your network as normal to the other ISP.&#xA;For example RouterA is your primary connecting to ISP-A and your backup is Router-B connecting to ISP-B. Your network is 192.168.0.0/16.&#xA;RouterA advertises 192.168.0.0/17 and 192.168.128.0/17 to ISP-A;&#xA;RouterB advertises 192.168.0.0/16 to ISP-B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Truly there are many ways to manipulate how you advertise your networks and filter/manipulate the routes leaving/entering your network.&#xA;Here is a good link towards prepending for your perusal: &lt;a href=&quot;http://networklessons.com/bgp/how-to-configure-bgp-as-path-prepending/&quot; rel=&quot;nofollow&quot;&gt;http://networklessons.com/bgp/how-to-configure-bgp-as-path-prepending/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't forget to test your configuration in a simulator like GNS3 first before implementing it on your production systems :-)&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2014-03-26T20:30:03.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7032" PostTypeId="2" ParentId="6955" CreationDate="2014-03-26T20:58:36.347" Score="4" Body="&lt;p&gt;A common solution is to run two separate route servers and mandate all peers to peer with both of them simultaneously, announcing the same set of prefixes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.ams-ix.net/technical/specifications-descriptions/ams-ix-route-servers&quot; rel=&quot;nofollow&quot;&gt;the AMS-IX documentation&lt;/a&gt; for an example. They run two redundant route servers:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When peering with the route servers we mandate that routers are set up to connect to both route servers and advertise the same amount and length of prefixes for resilience. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1734" LastEditorUserId="1734" LastEditDate="2014-03-26T22:54:48.153" LastActivityDate="2014-03-26T22:54:48.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7033" PostTypeId="2" ParentId="7029" CreationDate="2014-03-26T21:16:48.470" Score="5" Body="&lt;p&gt;For Junos, the command is &quot;show route advertising-protocol bgp 'neighbor'&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the XE &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/command/iproute_bgp-xe-3se-3850-cr-book/iproute_bgp-xe-3se-3850-cr-book_chapter_0100.html#wp3502759178&quot; rel=&quot;noreferrer&quot;&gt;command reference&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show ip bgp neighbors 'neighbor' advertised-routes &lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorDisplayName="user661" LastEditDate="2014-03-26T21:30:17.680" LastActivityDate="2014-03-26T21:30:17.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7034" PostTypeId="1" AcceptedAnswerId="7035" CreationDate="2014-03-26T21:39:16.990" Score="3" ViewCount="304" Body="&lt;p&gt;I am new to HP networking and have a question about the correct Syntax for static trunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 x E3800 switches Mesh stacked, connected to those are 24 x E2530 layer 2 switches. Each 2530 has two links back to the 3800s i.e. Switch 1 interface 22 is connected to 1/1 and 23 is connected to 2/1 and i want to aggregate those links using a static aggregated link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment I have configured trunks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;trunk 23-24 trk23 lacp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and on the 3800:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;trunk 1/1, 2/1 trk1 lacp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After doing a bit of reading i think that's actually creating a Dynamic trunk?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should i be using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;trunk 23-24 trk23 trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dave.&lt;/p&gt;&#xA;" OwnerUserId="4965" LastEditorUserId="619" LastEditDate="2014-03-26T22:02:06.583" LastActivityDate="2014-03-26T22:02:48.403" Title="HP E3800 Static Trunks" Tags="|ieee-802.1ax|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7035" PostTypeId="2" ParentId="7034" CreationDate="2014-03-26T22:02:48.403" Score="2" Body="&lt;p&gt;You are correct.  &lt;code&gt;LACP&lt;/code&gt; creates a dynamic trunk. &lt;code&gt;trunk&lt;/code&gt; makes a static (no protocol) trunk.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-03-26T22:02:48.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7036" PostTypeId="2" ParentId="7014" CreationDate="2014-03-26T22:40:44.413" Score="-1" Body="&lt;p&gt;ACLs should be tuned in after implementation to save processor cycles. The router has to process each line of an ACL until it gets a match on one of the conditions, or otherwise will always match the implicit 'deny any' at the end of all ACLS. Use a show command to see the hits on each ACL statement. Reorder the statements so that the most hit lines are higher in the ACL.&#xA;Use notepad to rewrite your ACL.&lt;/p&gt;&#xA;" OwnerUserId="4966" LastActivityDate="2014-03-26T22:40:44.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7037" PostTypeId="1" CreationDate="2014-03-26T21:13:17.440" Score="5" ViewCount="20133" Body="&lt;p&gt;I have a Fortigate 1240B with a vlan interface with IP 172.22.0.27/16. When a host directly connected try to ping my IP, I got the messages below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;id=36871 trace_id=2 func=resolve_ip_tuple_fast line=3788 msg=&quot;vd-root received a packet(proto=1, 172.22.0.3:49-&gt;172.22.0.27:8) from port30.&quot;&#xA;id=36871 trace_id=2 func=resolve_ip_tuple line=3928 msg=&quot;allocate a new session-01450d77&quot;&#xA;id=36871 trace_id=2 func=ip_route_input_slow line=1277 msg=&quot;reverse path check fail, drop&quot;&#xA;id=36871 trace_id=2 func=ip_session_handle_no_dst line=3964 msg=&quot;trace&quot;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ping is enable on the interface and I already tried to enable asymroute.&lt;/p&gt;&#xA;" OwnerUserId="15844" OwnerDisplayName="Hábner Costa" LastEditorUserId="775" LastEditDate="2014-03-26T23:13:53.797" LastActivityDate="2016-02-01T16:26:47.133" Title="Fortigate reverse path check fail" Tags="|firewall|fortigate|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7040" PostTypeId="2" ParentId="3391" CreationDate="2014-03-27T06:36:12.193" Score="0" Body="&lt;p&gt;The ip address can not be reserved but they can be excluded from the dhcp pool which has been defined in a network. excluded ip addresses can be used for a particular nework device in the same subnet.&lt;/p&gt;&#xA;" OwnerUserId="4971" LastActivityDate="2014-03-27T06:36:12.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7041" PostTypeId="2" ParentId="789" CreationDate="2014-03-27T07:03:45.947" Score="-3" Body="&lt;p&gt;Access list is for traffic filtering &amp;amp; prefix list is for route filtering&lt;/p&gt;&#xA;" OwnerUserId="4972" LastActivityDate="2014-03-27T07:03:45.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7042" PostTypeId="1" CreationDate="2014-03-27T08:01:39.117" Score="5" ViewCount="4094" Body="&lt;p&gt;With these two captures in mind (both illustrating the problem) we are experiencing a problem with TCP flow when we have some specific packet loss.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cloudshark.org/captures/a1a050d95269&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cloudshark.org/captures/a1a050d95269&lt;/a&gt; (initial capture from linux 3.2)&#xA;&lt;a href=&quot;https://www.cloudshark.org/captures/7e5b91e67a64&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cloudshark.org/captures/7e5b91e67a64&lt;/a&gt; (after upgrading to linux 3.8)&lt;/p&gt;&#xA;&lt;p&gt;Basically, the TCP connection is hanging.&lt;/p&gt;&#xA;&lt;p&gt;In between packet 4 and 6 GH (.128) actually sent us back a reply to the SSL hello - 3 packets that didn't make it to us.&#xA;In those 3 packets they would have ACKed our initial 136 bytes and sent 3741 of their own (which can be inferred from the ACK=137 and Seq=3742 in packet 6)&lt;/p&gt;&#xA;&lt;p&gt;Packet 6 finally makes it to us indicating they ACK 137 bytes &lt;em&gt;and&lt;/em&gt; have already sent 3741 bytes to us in this stream. Which means they've sent at least 3 packets which didn't make it. &lt;strong&gt;Strange to lose 3 packets in a row like that.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;My interpretation is that our reaction to packet 6 &lt;em&gt;should&lt;/em&gt; be sending back an LEN=0 ACK=1 packet to .128 saying that we haven't seen any traffic from them, triggering a retransmission of their initial 3741 byte response.&lt;/p&gt;&#xA;&lt;p&gt;That's what's causing the connection to hang, notwithstanding the initial packet loss.&lt;/p&gt;&#xA;&lt;p&gt;I have captures taken from our end (&lt;code&gt;64.71.148.3&lt;/code&gt;) while replicating the problem (hang while attempting to do a git pull from github).&lt;/p&gt;&#xA;&lt;p&gt;The &lt;em&gt;main questions&lt;/em&gt; here are:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;is my analysis of the TCP flow correct?&lt;/li&gt;&#xA;&lt;li&gt;Does the ultimate responsibility here lie on Linux at our end to request the retransmit?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Also:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is this a bug in the Linux TCP/IP stack?&lt;/li&gt;&#xA;&lt;li&gt;Is there something I can change to make it behave better?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dnEoU.png&quot; alt=&quot;TCP flow graph&quot; /&gt;&lt;/p&gt;&#xA;&lt;h3&gt;Notes&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is not an HTTPS-specific problem; I can replicate it by cloning over SSH&lt;/li&gt;&#xA;&lt;li&gt;Yes, there's packet loss, but that's what TCP is supposed to handle&lt;/li&gt;&#xA;&lt;li&gt;Problem initially found on with gateway at kernel 3.2. Have upgraded to 3.8.0-37-generic (ubuntu 12.04)&lt;/li&gt;&#xA;&lt;li&gt;Tested behind the (PAT) gateway as well as on the gateway itself&lt;/li&gt;&#xA;&lt;li&gt;Tested on the &lt;em&gt;other&lt;/em&gt; gateway with &amp;quot;identical&amp;quot; configuration - no change&lt;/li&gt;&#xA;&lt;li&gt;Can reproduce quickly by running &lt;code&gt;git clone -v https://github.com/SamSaffron/pups.git; rm -rf pups&lt;/code&gt; a few iterations will usually trigger it.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="573" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-04-07T08:54:31.713" Title="TCP connection stalling" Tags="|tcp|linux|" AnswerCount="1" CommentCount="4" ClosedDate="2017-08-08T16:41:21.607" ContentLicense="CC BY-SA 3.0" />
  <row Id="7045" PostTypeId="1" AcceptedAnswerId="7046" CreationDate="2014-03-27T12:25:02.643" Score="5" ViewCount="1228" Body="&lt;p&gt;In OSPF over NBMA, why do you choose the Hub as DR in a hub &amp;amp; spoke topology? Also, why do you set the priority to 0 on the spoke routers that do not join them in elections?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any reason?&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="3191" LastEditDate="2014-03-28T12:55:25.060" LastActivityDate="2014-03-28T12:55:25.060" Title="Hub &amp; Spoke OSPF DR &amp; BDR" Tags="|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7046" PostTypeId="2" ParentId="7045" CreationDate="2014-03-27T12:44:01.633" Score="8" Body="&lt;p&gt;In a nutshell, the designated router is the one responsible for synchronizing the LS databases of all routers on the network and flooding LS updates to all other routers.  If one of the spokes is the designated router, then all database synchronization and LS update traffic must flow down the spoke link to the DR and then back to the hub and then to the other spoke routers.  This is very inefficient and will likely overload the spoke link.  In addition, often spoke routers are small with limited memory and processing ability, and may not be able to process all the LS traffic.  We set the spokes' priority to 0 to prevent them from accidentally becoming the DR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend you read &lt;em&gt;OSPF and IS-IS&lt;/em&gt; by Jeff Doyle.  He goes into much more detail on the role of designated routers and their operation.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-03-27T13:34:44.433" LastActivityDate="2014-03-27T13:34:44.433" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7048" PostTypeId="1" CreationDate="2014-03-27T14:28:35.073" Score="0" ViewCount="3122" Body="&lt;p&gt;On Catalyst 4500, there is the command show int link which outputs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Fa1/1    UPS               00 secs&#xA;    Fa1/2    Data &amp;amp; Voice      00 secs&#xA;    Fa1/3    Data &amp;amp; Voice      00 secs&#xA;    Fa1/4    Data &amp;amp; Voice      00 secs&#xA;&#xA;&amp;lt;output continues&amp;gt;....&#xA;    Fa3/18   Data &amp;amp; Voice      13 hours, 13 minutes 58 secs      13:47:23  Tue Mar 25 2014&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I try this command on a 3560 i get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show int link&#xA;                 ^&#xA;% Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there an equivalent on the 3560 or 3750 switch for finding such information as the last time the port was active?&#xA;My goal is to find which switchports have not been active for a long time and can have their cable disconnected from the switchport to save room for other devices to use in the future.&lt;/p&gt;&#xA;" OwnerUserId="2477" LastActivityDate="2014-03-27T14:32:29.980" Title="Show interfaces link equivalent" Tags="|cisco|switch|cisco-commands|" AnswerCount="1" CommentCount="1" ClosedDate="2014-03-27T16:49:57.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="7049" PostTypeId="2" ParentId="7048" CreationDate="2014-03-27T14:32:29.980" Score="1" Body="&lt;p&gt;You could try &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show int | i Ethernet|Last input&#xA;&#xA;GigabitEthernet6/1 is up, line protocol is up (connected)&#xA;  Last input 00:00:03, output 00:00:52, output hang never&#xA;GigabitEthernet6/2 is up, line protocol is up (connected)&#xA;  Last input 00:00:26, output 00:00:00, output hang never&#xA;GigabitEthernet6/3 is up, line protocol is up (connected)&#xA;  Last input 00:00:08, output 00:00:08, output hang never&#xA;GigabitEthernet6/4 is up, line protocol is up (connected)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-27T14:32:29.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7051" PostTypeId="1" AcceptedAnswerId="7053" CreationDate="2014-03-27T15:55:06.133" Score="10" ViewCount="1861" Body="&lt;p&gt;You have a data center standardized on 10GE connections.   With, say, Nexus 7000s in the core, Nexus 5000s at the aggregation, and some fabric extenders for the edge to the servers (I use Cisco gear as examples because this is what's in my specific lab).  There are some ACE 4710 load balancers hanging off your Nexus 5000s, but these only have 1GE interfaces. All of your switch connections are 10GE, needed for the massive east-west (VM-to-VM) traffic in modern virtualized data centers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do the load balancers not become a bottleneck in certain traffic conditions? I can see how some local east-west traffic does not need to even reach the load balancer, but there are other situations where you need to traverse the core, and possibly even a data center interconnect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, I know the load balancers are used in client-server (north-south) traffic, and things like HTTP GET do not need 10GE, but are there situations in which your 1GE load balancer can get in the way of an otherwise all-10GE traffic path and cause problems for things like vMotion (for example)?&lt;/p&gt;&#xA;" OwnerUserId="4983" LastEditorUserId="44" LastEditDate="2014-03-27T16:57:32.213" LastActivityDate="2014-03-30T00:06:31.023" Title="How do load balancers fit in to a data center with much higher throughput than they can handle?" Tags="|load-balancer|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7053" PostTypeId="2" ParentId="7051" CreationDate="2014-03-27T17:45:26.727" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Do the load balancers not become a bottleneck in certain traffic conditions?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Certainly, but this is generally not the case in a well engineered network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to design your network in a way that would allow the majority of your internal server-to-server traffic (&quot;east-west&quot; as you put it) even if it does need to cross your core or between data centers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While often the load balancer is the default gateway for the servers behind it, I have seen setups where a routing protocol (i.e. OSPF or RIP) is run to allow the &quot;east-west&quot; traffic to circumvent the load balancer, or in smaller deployments where static routes were used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the load balancers are going to be a bottleneck even in with a good design (i.e. the volume of traffic is just that high), then there are ways of load balancing across multiple load balancers as well.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-03-27T17:45:26.727" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7060" PostTypeId="1" AcceptedAnswerId="7061" CreationDate="2014-03-28T03:22:40.607" Score="2" ViewCount="383" Body="&lt;p&gt;I have 2 &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/security/pix-525-security-appliance/product_data_sheet09186a0080091b09.html&quot; rel=&quot;nofollow&quot;&gt;Cisco PIX 525 Firewalls&lt;/a&gt; and I don't have any &lt;em&gt;router&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are running version 7.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can i use that as a Layer 3 router and use its interfaces for different subnets?&lt;/p&gt;&#xA;" OwnerUserId="4968" LastEditorUserId="619" LastEditDate="2014-03-28T04:16:04.530" LastActivityDate="2014-03-28T04:22:08.943" Title="Can a Cisco PIX Fiewall be used as a router?" Tags="|cisco|router|firewall|pix|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7061" PostTypeId="2" ParentId="7060" CreationDate="2014-03-28T04:22:08.943" Score="7" Body="&lt;p&gt;In the immortal words of Cisco (circa 1999), &quot;&lt;em&gt;the PIX is a firewall, not a router&lt;/em&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, it can be used as a router. But you're better off using &lt;em&gt;anything&lt;/em&gt; else, as it's firewall nature is going to be a pain in the ass. (I used to do it with a PIX 520, and I hated it for all time.) If it's what you have, then it's all you have, but I cannot over emphasize how much better off you'll be with an actual &lt;em&gt;router&lt;/em&gt;. (buy one, &lt;em&gt;build one&lt;/em&gt;, whatever it takes.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-03-28T04:22:08.943" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7063" PostTypeId="2" ParentId="6955" CreationDate="2014-03-28T06:56:41.443" Score="5" Body="&lt;p&gt;From a design standpoint, specifically referring to the route servers, the answer is &lt;strong&gt;&lt;em&gt;no&lt;/em&gt;&lt;/strong&gt;, they should &lt;strong&gt;&lt;em&gt;not&lt;/em&gt;&lt;/strong&gt; peer with each other via an iBGP session [disclaimer: I've never personally attempted to do this, but I might now for fun]. The reason why is because route servers behave &lt;em&gt;similary&lt;/em&gt; to route reflectors, only it's eBGP rather than iBGP. The most important part to remember though, is that a route server is &lt;strong&gt;not a router&lt;/strong&gt;, it is a &quot;BGP message broker&quot;. This means that to all of its route server clients, it does not participate in any routing decisions. Because of this, route server clients will configure their sessions to the IXP's route servers as a standard eBGP session, &lt;strong&gt;however&lt;/strong&gt;, because the route server does not insert its ASN onto the AS_PATH of NLRI received from its clients before it advertises to its other clients, the client configuring the eBGP session will have to ensure that its eBGP config on whatever device they're configuring allows for a way to disable enforcing the first ASN in a path from an eBGP neighbor &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/s_befasp.html&quot;&gt;(see Cisco IOS implementation notes)&lt;/a&gt;, otherwise (depending on the vendor of course) the session will not come up, or will come up but no NLRI is exchanged, etc. Keeping that in mind, by creating an iBGP session between the two route servers, every route server client will have to drop an NLRI update message from itself, that was received from one route server, forwarded to the other via iBGP, and then re-forwarded to the route server client that (presumably) has an eBGP session up with both route servers. This will basically cause unneeded headache (in the form of possible CPU and/or memory churn) for the route servers and all of their clients. With that said, yes, it is BCP to operate two route servers (without iBGP between them), and mandate that the route server clients peer with both of them if they're going to peer with them at all, as Leon Weber has already mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, it should be noted that &lt;strong&gt;&lt;em&gt;designing&lt;/em&gt;&lt;/strong&gt; an IXP &quot;with redundancy&quot; does not simply mean &quot;running two route servers.&quot; Using AMS-IX as an example again, I suggest taking a look at their design documentation (specifically for 10G customers) for a good example of redundancy in an IXP. Again, just to provide a single example - a discussion on designing for redundancy within an IXP is beyond the scope of the format of this site.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2014-03-28T06:56:41.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7064" PostTypeId="2" ParentId="6969" CreationDate="2014-03-28T10:35:47.347" Score="4" Body="&lt;p&gt;Apologies, it took a while to figure out &lt;a href=&quot;http://mininet.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;mininet&lt;/a&gt; and the OpenFlow &lt;a href=&quot;https://github.com/osrg/ryu&quot; rel=&quot;nofollow noreferrer&quot;&gt;ryu controller&lt;/a&gt;, but I finally got it...&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I tried to print haddr_to_str(src), haddr_to_str(dst) and got 00:00:00:00:00:03 and ff:ff:ff:ff:ff:ff which is not what I expected. I wanted to get 2 as source and 3 as dest.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The short story is that you're decoding the destination mac address correctly... However, IP must ARP to resolve mac addresses, which is why you see &lt;code&gt;ff:ff:ff:ff:ff:ff&lt;/code&gt;... those are just the ARP frames in the &lt;a href=&quot;https://github.com/osrg/ryu&quot; rel=&quot;nofollow noreferrer&quot;&gt;ryu controller&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;This is a complete controller which works and decodes up to the IPv4 layer...&lt;/p&gt;&#xA;&lt;h2&gt;Updated ryu switch packet decoder&lt;/h2&gt;&#xA;&lt;p&gt;You've been decoding raw &lt;code&gt;structs&lt;/code&gt;, but it's much easier to use the &lt;a href=&quot;http://ryu.readthedocs.org/en/latest/library_packet.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ryu Packet library&lt;/a&gt; instead of unpacking a raw &lt;code&gt;struct&lt;/code&gt; of the packet.  This is my very quick replacement of &lt;code&gt;_packet_in_handler()&lt;/code&gt;, which just prints out the source and destination mac addresses, as well as the upper layer protocols...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ryu.lib.packet import packet, ethernet, arp, ipv4&#xA;import array&#xA;&#xA;@set_ev_cls(ofp_event.EventOFPPacketIn, MAIN_DISPATCHER)&#xA;def _packet_in_handler(self, ev):&#xA;&#xA;    ### Mike Pennington's logging modifications&#xA;    ## Set up to receive the ethernet src / dst addresses&#xA;    pkt = packet.Packet(array.array('B', ev.msg.data))&#xA;    eth_pkt = pkt.get_protocol(ethernet.ethernet)&#xA;    arp_pkt = pkt.get_protocol(arp.arp)&#xA;    ip4_pkt = pkt.get_protocol(ipv4.ipv4)&#xA;    if arp_pkt:&#xA;        pak = arp_pkt&#xA;    elif ip4_pkt:&#xA;        pak = ip4_pkt&#xA;    else:&#xA;        pak = eth_pkt&#xA;    self.logger.info('  _packet_in_handler: src_mac -&amp;gt; %s' % eth_pkt.src)&#xA;    self.logger.info('  _packet_in_handler: dst_mac -&amp;gt; %s' % eth_pkt.dst)&#xA;    self.logger.info('  _packet_in_handler: %s' % pak)&#xA;    self.logger.info('  ------')&#xA;    src = eth_pkt.src  # Set up the src and dst variables so you can use them&#xA;    dst = eth_pkt.dst&#xA;    ## Mike Pennington's modifications end here&#xA;&#xA;    &#xA;    msg = ev.msg&#xA;    datapath = msg.datapath&#xA;    ofproto = datapath.ofproto&#xA;&#xA;    dpid = datapath.id&#xA;    self.mac_to_port.setdefault(dpid, {})&#xA;&#xA;    # learn a mac address to avoid FLOOD next time.&#xA;    self.mac_to_port[dpid][src] = msg.in_port&#xA;&#xA;    if dst in self.mac_to_port[dpid]:&#xA;        out_port = self.mac_to_port[dpid][dst]&#xA;    else:&#xA;        out_port = ofproto.OFPP_FLOOD&#xA;&#xA;    actions = [datapath.ofproto_parser.OFPActionOutput(out_port)]&#xA;&#xA;    # install a flow to avoid packet_in next time&#xA;    if out_port != ofproto.OFPP_FLOOD:&#xA;        self.add_flow(datapath, msg.in_port, dst, actions)&#xA;&#xA;    out = datapath.ofproto_parser.OFPPacketOut(&#xA;        datapath=datapath, buffer_id=msg.buffer_id, in_port=msg.in_port,&#xA;        actions=actions)&#xA;    datapath.send_msg(out)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now, whenever an ethernet packet is sent, you'll see this inside your mininet session...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:03&#xA;  _packet_in_handler: dst_mac -&amp;gt; 33:33:00:00:00:02&#xA;  _packet_in_handler: ethernet(dst='33:33:00:00:00:02',ethertype=34525,src='00:00:00:00:00:03')&#xA;  ------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;ARP packets look like this...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: dst_mac -&amp;gt; ff:ff:ff:ff:ff:ff&#xA;  _packet_in_handler: arp(dst_ip='10.0.0.2',dst_mac='00:00:00:00:00:00',hlen=6,hwtype=1,opcode=1,plen=4,proto=2048,src_ip='10.0.0.1',src_mac='00:00:00:00:00:01')&#xA;  ------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;Demo&lt;/h2&gt;&#xA;&lt;p&gt;Assume I saved the modified code above (including other parts of your source) as &lt;code&gt;ne_question.py&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First I set up the &lt;a href=&quot;https://github.com/osrg/ryu&quot; rel=&quot;nofollow noreferrer&quot;&gt;ryu controller&lt;/a&gt; in &lt;a href=&quot;http://mininet.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;mininet&lt;/a&gt;:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@mininet-vm:/home/mininet# ryu-manager ne_question.py &amp;amp;&#xA;                 [1] 14073&#xA;loading app ne_question.py&#xA;loading app ryu.controller.ofp_handler&#xA;instantiating app ryu.controller.ofp_handler of OFPHandler&#xA;instantiating app ne_question.py of SimpleSwitch&#xA;&#xA;root@mininet-vm:/home/mininet#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Next I build the switch topology, as you mentioned in your comment&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@mininet-vm:/home/mininet# mn --topo single,3 --mac --switch ovsk --controller remote&#xA;*** Creating network&#xA;*** Adding controller&#xA;*** Adding hosts:&#xA;h1 h2 h3&#xA;*** Adding switches:&#xA;s1&#xA;*** Adding links:&#xA;(h1, s1) (h2, s1) (h3, s1)&#xA;*** Configuring hosts&#xA;h1 h2 h3&#xA;*** Starting controller&#xA;*** Starting 1 switches&#xA;s1&#xA;*** Starting CLI:&#xA;mininet&amp;gt;   _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: dst_mac -&amp;gt; 33:33:00:00:00:02&#xA;  _packet_in_handler: ethernet(dst='33:33:00:00:00:02',ethertype=34525,src='00:00:00:00:00:02')&#xA;  ------&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: dst_mac -&amp;gt; 33:33:00:00:00:02&#xA;  _packet_in_handler: ethernet(dst='33:33:00:00:00:02',ethertype=34525,src='00:00:00:00:00:01')&#xA;  ------&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:03&#xA;  _packet_in_handler: dst_mac -&amp;gt; 33:33:00:00:00:02&#xA;  _packet_in_handler: ethernet(dst='33:33:00:00:00:02',ethertype=34525,src='00:00:00:00:00:03')&#xA;  ------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Finally, I run the web server, and try to pull a page... notice that ARPs are sent to resolve the destination address of the http GET.  The destination address of the ARPs are &lt;code&gt;ff:ff:ff:ff:ff:ff&lt;/code&gt;.  BTW, if you change the &lt;code&gt;wget&lt;/code&gt; to &lt;code&gt;h2 wget h1&lt;/code&gt;, everything works correctly...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mininet&amp;gt; h1 python -m SimpleHTTPServer 80 &amp;amp;&#xA;mininet&amp;gt; h2 wget -O - h1&#xA;--2014-03-28 04:22:25--  http://10.0.0.1/&#xA;Connecting to 10.0.0.1:80...   _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: dst_mac -&amp;gt; ff:ff:ff:ff:ff:ff&#xA;  _packet_in_handler: arp(dst_ip='10.0.0.1',dst_mac='00:00:00:00:00:00',hlen=6,hwtype=1,opcode=1,plen=4,proto=2048,src_ip='10.0.0.2',src_mac='00:00:00:00:00:02')&#xA;  ------&#xA;--2014-03-28 04:00:58--  http://10.0.0.1/&#xA;Connecting to 10.0.0.1:80...   _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: ipv4(csum=33886,dst='10.0.0.1',flags=2,header_length=5,identification=41563,offset=0,option=None,proto=6,src='10.0.0.2',tos=0,total_length=60,ttl=64,version=4)&#xA;  ------&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: ipv4(csum=9914,dst='10.0.0.2',flags=2,header_length=5,identification=0,offset=0,option=None,proto=6,src='10.0.0.1',tos=0,total_length=60,ttl=64,version=4)&#xA;  ------&#xA;connected.&#xA;HTTP request sent, awaiting response...   _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: ipv4(csum=33893,dst='10.0.0.1',flags=2,header_length=5,identification=41564,offset=0,option=None,proto=6,src='10.0.0.2',tos=0,total_length=52,ttl=64,version=4)&#xA;  ------&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: ipv4(csum=33784,dst='10.0.0.1',flags=2,header_length=5,identification=41565,offset=0,option=None,proto=6,src='10.0.0.2',tos=0,total_length=160,ttl=64,version=4)&#xA;  ------&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: ipv4(csum=61034,dst='10.0.0.2',flags=2,header_length=5,identification=14423,offset=0,option=None,proto=6,src='10.0.0.1',tos=0,total_length=52,ttl=64,version=4)&#xA;  ------&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: ipv4(csum=61016,dst='10.0.0.2',flags=2,header_length=5,identification=14424,offset=0,option=None,proto=6,src='10.0.0.1',tos=0,total_length=69,ttl=64,version=4)&#xA;  ------&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: ipv4(csum=60037,dst='10.0.0.2',flags=2,header_length=5,identification=14425,offset=0,option=None,proto=6,src='10.0.0.1',tos=0,total_length=1047,ttl=64,version=4)&#xA;  ------&#xA;200 OK&#xA;Length: 858 [text/html]&#xA;Saving to: `STDOUT'&#xA;&amp;lt;!DOCTYPE html PUBLIC &amp;quot;-//W3C//DTD HTML 3.2 Final//EN&amp;quot;&amp;gt;&amp;lt;html&amp;gt;&#xA;&amp;lt;title&amp;gt;Directory listing for /&amp;lt;/title&amp;gt;&#xA;&amp;lt;body&amp;gt;&#xA;&amp;lt;h2&amp;gt;Directory listing for /&amp;lt;/h2&amp;gt;&#xA;&amp;lt;hr&amp;gt;&#xA;&amp;lt;ul&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;.bash_history&amp;quot;&amp;gt;.bash_history&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;.bash_logout&amp;quot;&amp;gt;.bash_logout&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;.bashrc&amp;quot;&amp;gt;.bashrc&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;.cache/&amp;quot;&amp;gt;.cache/&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;.gitconfig&amp;quot;&amp;gt;.gitconfig&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;.profile&amp;quot;&amp;gt;.profile&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;.rnd&amp;quot;&amp;gt;.rnd&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;.wireshark/&amp;quot;&amp;gt;.wireshark/&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;install-mininet-vm.sh&amp;quot;&amp;gt;install-mininet-vm.sh&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;mininet/&amp;quot;&amp;gt;mininet/&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;ne_question.py&amp;quot;&amp;gt;ne_question.py&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;ne_question.pyc&amp;quot;&amp;gt;ne_question.pyc&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;of-dissector/&amp;quot;&amp;gt;of-dissector/&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;oflops/&amp;quot;&amp;gt;oflops/&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;oftest/&amp;quot;&amp;gt;oftest/&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;openflow/&amp;quot;&amp;gt;openflow/&amp;lt;/a&amp;gt;&#xA;&amp;lt;li&amp;gt;&amp;lt;a href=&amp;quot;pox/&amp;quot;&amp;gt;pox/&amp;lt;/a&amp;gt;&#xA;&amp;lt;/ul&amp;gt;&#xA;&amp;lt;hr&amp;gt;&#xA;&amp;lt;/body&amp;gt;&#xA;&amp;lt;/html&amp;gt;&#xA;&#xA;     0K                                                       100%  161M=0s&#xA;&#xA;2014-03-28 04:00:58 (161 MB/s) - written to stdout [858/858]&#xA;&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:02&#xA;mininet&amp;gt;   _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: ipv4(csum=33891,dst='10.0.0.1',flags=2,header_length=5,identification=41566,offset=0,option=None,proto=6,src='10.0.0.2',tos=0,total_length=52,ttl=64,version=4)&#xA;  ------&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: ipv4(csum=33890,dst='10.0.0.1',flags=2,header_length=5,identification=41567,offset=0,option=None,proto=6,src='10.0.0.2',tos=0,total_length=52,ttl=64,version=4)&#xA;  ------&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: ipv4(csum=33889,dst='10.0.0.1',flags=2,header_length=5,identification=41568,offset=0,option=None,proto=6,src='10.0.0.2',tos=0,total_length=52,ttl=64,version=4)&#xA;  ------&#xA;  _packet_in_handler: src_mac -&amp;gt; 00:00:00:00:00:01&#xA;  _packet_in_handler: dst_mac -&amp;gt; 00:00:00:00:00:02&#xA;  _packet_in_handler: ipv4(csum=9922,dst='10.0.0.2',flags=2,header_length=5,identification=0,offset=0,option=None,proto=6,src='10.0.0.1',tos=0,total_length=52,ttl=64,version=4)&#xA;  ------&#xA;&#xA;mininet&amp;gt;&#xA;mininet&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-03-28T11:24:47.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7065" PostTypeId="1" AcceptedAnswerId="7072" CreationDate="2014-03-28T15:26:03.657" Score="5" ViewCount="1164" Body="&lt;p&gt;We are an ISP and I would like to implement ACL to protect our core network (Infrastructure) and implement some filtering on public subnet inside. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As border device we have a cisco WS-C4500X-32 4500x in VSS Cluster. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The peak traffic on downstream is 3Gbps.&#xA;I follow the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/access-lists/43920-iacl.html&quot; rel=&quot;noreferrer&quot;&gt;guidelines&lt;/a&gt; and I've already define the ACL, just left implement them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My doubt now is how will be the throughput performance, if it's expected some degradation or the cpu will rise. &#xA;Will the device can handle such traffic amount with filtering ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have the experience to implement ACL on so high throughput device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;[edit.1]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample of ACL : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended iACL &#xA; permit ip any 8.8.40.0 0.0.7.255&#xA; permit ip any 8.8.48.0 0.0.15.255&#xA; permit ip any 10.10.0.0 0.0.15.255&#xA; permit ip any 9.9.248.0 0.0.3.255 &#xA; ! External IP needing full access to our network&#xA; permit ip 7.7.176.0 0.0.31.255 any &#xA; permit ip 6.6.32.0 0.0.31.255 any&#xA; permit ip 5.5.160.0 0.0.31.255 any&#xA; permit ip 4.4.128.0 0.0.31.255 any &#xA; deny ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Device : cisco WS-C4500X-32 (MPC8572) processor (revision 4) with 4194304K/20480K bytes of memory.&#xA;MPC8572 CPU at 1.5GHz, Cisco Catalyst 4500X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IOS : cat4500e-universalk9.SPA.03.04.00.SG.151-2.SG (ROM: 15.0(1r)SG6)&lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2014-03-28T18:40:12.567" LastActivityDate="2014-03-28T18:51:50.873" Title="ACL on entry of Core Switch - Performance doubt" Tags="|cisco|switch|acl|performance|cisco-4500|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7066" PostTypeId="1" CreationDate="2014-03-28T15:30:50.693" Score="3" ViewCount="3376" Body="&lt;p&gt;I am having an issue with my site to site VPN.  I have a bit of an odd setup but for a short time.  At our central location I have a 2911 router, and behind that I have my 5515X.  The router just has a 1:1 nat rule for the ASA outside interface.  We are only using the ASA to terminate the site to site VPN connections right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My tunnel comes up, from my default vlan at central I can access everything at the remote site.  I can access everything at central from my remote location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is I have another vlan (everything in 192.168.50.0) at central, I cannot access anything at the remote site from it.  If at the remote site I send traffic to that vlan at central I can then access everything  as normal.  Example below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On host 192.168.0.2 I can ping 192.168.11.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On host 192.168.11.2 I can ping 192.168.0.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On host 192.168.50.2 I cannot ping 192.168.11.2 unless I first do the reverse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This only seems to be an issue at locations that have dynamic crypto maps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configs below.  Any help would be appreciated.  Thanks.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Central Config&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;:&#xA;ASA Version 8.6(1)2 &#xA;!&#xA;hostname ASA&#xA;enable password ****** encrypted&#xA;passwd ****** encrypted&#xA;names&#xA;!&#xA;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address ****** ******&#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.0.203 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/2&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/4&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/5&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management0/0&#xA; nameif management&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0 &#xA; management-only&#xA;!&#xA;ftp mode passive&#xA;dns domain-lookup outside&#xA;dns domain-lookup inside&#xA;dns domain-lookup management&#xA;dns server-group DefaultDNS&#xA; name-server 192.168.0.1&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network inside_network&#xA; subnet 192.168.0.0 255.255.255.0&#xA;object network REMOTEASA&#xA; subnet 192.168.11.0 255.255.255.0&#xA;object network video_inside&#xA; subnet 192.168.50.0 255.255.255.0&#xA;object-group network Trusted-Networks&#xA; network-object object inside_network&#xA; network-object object video_inside&#xA;access-list outside_cryptomap_30 extended permit ip object-group Trused-Networks object Dustin &#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;mtu management 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;nat (inside,outside) source static Trusted-Networks Trusted-Networks destination static REMOTEASA REMOTEASA&#xA;nat (inside,outside) source dynamic any interface&#xA;access-group outside_access_in in interface outside&#xA;access-group inside_access_in in interface inside&#xA;route outside 0.0.0.0 0.0.0.0 ****** 1&#xA;route inside 192.168.50.0 255.255.255.0 192.168.0.254 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;http 192.168.0.0 255.255.255.0 inside&#xA;http redirect outside 80&#xA;sysopt noproxyarp inside&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set FirstSet esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set vpn-transform-set esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set TRANS_ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set TRANS_ESP-3DES-SHA mode transport&#xA;crypto ipsec ikev2 ipsec-proposal DES&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES192&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1 md5&#xA;crypto dynamic-map REMOTEASA 31 match address outside_cryptomap_30&#xA;crypto dynamic-map REMOTEASA 31 set ikev1 transform-set ESP-AES-128-SHA&#xA;crypto map outside_map 31 ipsec-isakmp dynamic REMOTEASA&#xA;crypto map outside_map interface outside&#xA;crypto ikev2 policy 1&#xA; encryption aes-256&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 10&#xA; encryption aes-192&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 20&#xA; encryption aes&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 30&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 40&#xA; encryption des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;tunnel-group DefaultL2LGroup general-attributes&#xA; default-group-policy GroupPolicy1&#xA;tunnel-group DefaultL2LGroup ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; peer-id-validate nocheck&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;call-home reporting anonymous&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Remote Config&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;:&#xA;ASA Version 8.2(5) &#xA;!&#xA;hostname ASA&#xA;enable password ******** encrypted&#xA;passwd ******** encrypted&#xA;names&#xA;name 192.168.0.0 CML-Subnet&#xA;name 192.168.50.0 CML-Video&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA; shutdown&#xA;!&#xA;interface Ethernet0/6&#xA; shutdown&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.11.1 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address dhcp setroute &#xA;!&#xA;ftp mode passive &#xA;object-group network Trusted-Networks&#xA; network-object CML-Subnet 255.255.255.0&#xA; network-object CML-Video 255.255.255.0&#xA;object-group network DM_INLINE_NETWORK_1&#xA; network-object CML-Subnet 255.255.255.0&#xA; network-object CML-Video 255.255.255.0&#xA;access-list outside_cryptomap extended permit ip 192.168.11.0 255.255.255.0 object-group DM_INLINE_NETWORK_1 &#xA;access-list inside_nat0_outbound extended permit ip 192.168.11.0 255.255.255.0 object-group Trusted-Networks &#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 0 access-list inside_nat0_outbound&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;http server enable&#xA;http 192.168.11.0 255.255.255.0 inside&#xA;http CML-Subnet 255.255.255.0 inside&#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto map outside_map0 1 match address outside_cryptomap&#xA;crypto map outside_map0 1 set peer ****** &#xA;crypto map outside_map0 1 set transform-set ESP-AES-128-SHA&#xA;crypto map outside_map0 1 set reverse-route&#xA;crypto map outside_map0 interface outside&#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 10&#xA; authentication pre-share&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh CML-Subnet 255.255.255.0 inside&#xA;ssh timeout 5&#xA;console timeout 0&#xA;management-access inside&#xA;dhcp-client client-id interface outside&#xA;dhcpd dns 192.168.0.1 208.67.220.220&#xA;dhcpd auto_config outside&#xA;!&#xA;dhcpd address 192.168.11.100-192.168.11.150 inside&#xA;dhcpd dns 192.168.0.1 208.67.220.220 interface inside&#xA;dhcpd enable inside&#xA;!&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA;group-policy GroupPolicy1 internal&#xA;group-policy GroupPolicy1 attributes&#xA; vpn-tunnel-protocol IPSec &#xA;username tempadmin password ****** encrypted privilege 15&#xA;username admin password ****** encrypted privilege 15&#xA;username rouser password ****** encrypted privilege 5&#xA;tunnel-group ****** type ipsec-l2l&#xA;tunnel-group ******* general-attributes&#xA; default-group-policy GroupPolicy1&#xA;tunnel-group ****** ipsec-attributes&#xA; pre-shared-key *****&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4999" LastEditorUserId="3191" LastEditDate="2014-04-08T15:26:35.950" LastActivityDate="2014-04-08T15:26:35.950" Title="Site to Site VPN with no access to second vlan" Tags="|cisco-asa|vlan|vpn|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7069" PostTypeId="1" AcceptedAnswerId="7070" CreationDate="2014-03-28T18:22:23.500" Score="9" ViewCount="6709" Body="&lt;p&gt;I have a network with three links (ISPA, 3MB, ISPB, 1.5MB, ISPC, 50MB). I have three different speeds, and as such, ISPs A and B are primarily used for redundancy. I'm currently receiving routes from all three providers, but filtering a number of them on the backup links. As I would look to route traffic out the larger pipe near exclusively, I feel as though  I do not need to retrieve a full routing table from all the ISPs, and could merely synchronize default routes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this the case? Is there a way to limit BGP to only synchronizing next-hop or local routes? I'm worried about enabling full synchronization, as I'm running with older routers, and I'm working with limited amounts of RAM. &lt;/p&gt;&#xA;" OwnerUserId="5001" LastActivityDate="2014-03-28T18:58:59.270" Title="Should I use default routes or full BGP table?" Tags="|routing|bgp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7070" PostTypeId="2" ParentId="7069" CreationDate="2014-03-28T18:37:44.287" Score="7" Body="&lt;p&gt;You could accept a full table from your main neighbour and ask the others to send you local routes + default route only. In that case, the full table routes would win over the default and your transit traffic would use the &quot;full table&quot; neighbour. traffic to the secondary neighbours should still use their uplinks as the ASPATH would be shorter.&#xA;This only applies to outbound traffic though, if most of your traffic is inbound, you need to de-prioritise the routes advertised &lt;em&gt;to&lt;/em&gt; the secondary neighbours (via AS-prepends, etc).&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2014-03-28T18:37:44.287" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7071" PostTypeId="2" ParentId="7069" CreationDate="2014-03-28T18:43:30.367" Score="6" Body="&lt;p&gt;Unless you want to choose which ISP to use based on address, there is no reason to receive anything more than a default route. You can use the LOCAL-PREFERENCE attribute on the route received from ISP C to select it.   Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list standard DEFAULT-ONLY permit 0.0.0.0&#xA;!&#xA;route-map PREFERr-C permit 10&#xA; match ip address DEFAULT-ONLY&#xA; set local-preference 200&#xA;route-map PREFER-C permit 20&#xA;!&#xA;router bgp 9999&#xA;neighbor &amp;lt;isp c&amp;gt; route-map PREFER-C in&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;When I read synchronizing routes, I realized your BGP routers were speaking to each other.  In that case, you'll use local preference.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-03-28T18:58:59.270" LastActivityDate="2014-03-28T18:58:59.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7072" PostTypeId="2" ParentId="7065" CreationDate="2014-03-28T18:51:50.873" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The peak traffic on downstream is 3Gbps. I follow the guidelines and I've already define the ACL, just left implement them.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;My doubt now is how will be the throughput performance, if it's expected some degradation or the cpu will rise. Will the device can handle such traffic amount with filtering ? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The 4500X uses a similar forwarding engine / TCAM to the Catalyst 4500 Supervisor7 (see Cisco Live 2013 BRKARC-3445 page 101 and afterwards for more info); this forwarding engine handles ACLs at 250Mpps as long as you don't punt packets to the CPU.  Obviously permit or deny log entries will punt packets to the CPU for logging; however, long ACE port number expansions (such as &lt;code&gt;permit tcp any any le 1024&lt;/code&gt;) also can force ACL CPU processing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your ACL example, you won't have a problem.  You can apply these to your high capacity interfaces with no worries...  I'm including an informational link to the official docs about &lt;em&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/3-1-1SG/configuration/guide/config/secure.html#wp1050566&quot;&gt;How Catalyst4500 ACLs impact CPU&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-03-28T18:51:50.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7079" PostTypeId="1" CreationDate="2014-03-29T06:30:16.893" Score="2" ViewCount="960" Body="&lt;p&gt;I have this scenario in my home lab&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JKIdF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My cisco 2600 router has only 1 physical interface so i have divided into 3 sub interfaces&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;E0/0.1 for vlan 10&lt;/li&gt;&#xA;&lt;li&gt;E0/0.2 FOR vlan 20&lt;/li&gt;&#xA;&lt;li&gt;E0/0.3 for vlan 1 which is in same subnet as my mian netgear router which is dhcp server&lt;/li&gt;&#xA;&lt;li&gt;The cisco switch is Layer 2 switch&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;First i want to know that is this setup possible or need router two 2 interfaces&lt;/li&gt;&#xA;&lt;li&gt;i have setup default gateway to be 192.168.0.1 but i can't ping to it from router.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Internet on Laptop is working fine via ethernet cable and its getting valid ip from netgear router&lt;/p&gt;&#xA;" OwnerUserId="4968" LastEditorUserId="4968" LastEditDate="2014-03-29T08:17:30.540" LastActivityDate="2014-06-04T13:37:39.020" Title="How to configure router on stick with cisco router" Tags="|cisco|router|switch|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7081" PostTypeId="2" ParentId="7079" CreationDate="2014-03-29T12:46:21.337" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, it is possible.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You are doing something wrong, most likely tagging frames on the router but the trunk has VLAN 1 as native.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To confirm what your trunking settings are use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interfaces trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I like to keep the subinterface IDs matching the VLAN number although it is not required. Use a configuration like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Switch&#xA;! Port to Laptop&#xA;interface Fax/x&#xA;switchport mode access&#xA;switchport access vlan 1&#xA;spanning-tree portfast&#xA;description Port to PC&#xA;! Port to Netgear&#xA;interface Fax/x&#xA;switchport mode access&#xA;switchport access vlan 1&#xA;spanning-tree portfast&#xA;description Port to Netgear&#xA;! Port to Cisco router&#xA;interface Fax/x&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;spanning-tree portfast trunk&#xA;description port to Cisco router&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Router&#xA;! Port to switch&#xA;interface E0/0.1&#xA;encapsulation dot1q 1 native&#xA;ip add 192.168.0.70 255.255.255.0&#xA;description VLAN1 to Netgear&#xA;interface E0/0.10&#xA;encapsulation dot1q 10&#xA;ip add 192.168.10.70 255.255.255.0&#xA;description VLAN10&#xA;interface E0/0.20&#xA;encapsulation dot1q 20&#xA;ip add 192.168.20.70 255.255.255.0&#xA;description VLAN20&#xA;ip routing&#xA;ip route 0.0.0.0 0.0.0.0 192.168.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously replace IP with your desired IP in the subnet.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-03-29T12:46:21.337" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="7089" PostTypeId="2" ParentId="7051" CreationDate="2014-03-30T00:06:31.023" Score="2" Body="&lt;p&gt;This is indeed a bottleneck and will limit your throughput to the &quot;weakest link in the chain&quot; which is your LBs. However, you can get around it. If you use something known as &quot;switchback&quot; or &quot;direct server return&quot; you can do async traffic flows. The way it works is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a) client makes a http request to 2.2.2.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b) LB answers on 2.2.2.2 and passes the incoming request to a server -- since the LB and server are on the same LAN, this is done at layer 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c) The server accepts this incoming connection as the IP 2.2.2.2 is on an aliased loopback interface (otherwise it'd drop a packet that didn't match an interface).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;d) The server responds directly to the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The request is a few bytes. The content served can be of any size. The outgoing traffic doesn't go through the LB so you can handle WAY more traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--tc&lt;/p&gt;&#xA;" OwnerUserId="118" LastActivityDate="2014-03-30T00:06:31.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7090" PostTypeId="1" AcceptedAnswerId="7093" CreationDate="2014-03-30T00:21:03.253" Score="2" ViewCount="1215" Body="&lt;p&gt;I have Cisco 2610 and it has version 12.0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to upgrade to 12.3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DRAM is 32MB and Flash is 2 slots of 8MB and 8MB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which IOS to get that fits in 8MB with 12.3?&lt;/p&gt;&#xA;" OwnerUserId="4968" LastEditorDisplayName="user10222" LastEditDate="2015-06-01T05:53:03.667" LastActivityDate="2015-06-01T05:53:03.667" Title="How to upgrade the IOS on Cisco 2610 with 12.3" Tags="|cisco|routing|router|cisco-ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7091" PostTypeId="1" AcceptedAnswerId="7094" CreationDate="2014-03-30T01:28:29.787" Score="2" ViewCount="1111" Body="&lt;p&gt;nowadays most of the LAN networks use NAT to link all the computers to the internet using only one External IP address. what if have only one computer and i want it to use that external ip address directly on it's interface without using NAT, PAT and PortForwarding as it's nowadays done for global IPV6 adddresses ??? how it can be technically done ??? is there additional devices that should be present to implement this solution or should the router be replaced by another equipment ??? &lt;/p&gt;&#xA;" OwnerUserId="5020" LastActivityDate="2014-03-30T11:51:02.517" Title="how to implement a network that communicates with the internet without NAT?" Tags="|nat|lan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7092" PostTypeId="2" ParentId="7090" CreationDate="2014-03-30T10:28:11.743" Score="2" Body="&lt;p&gt;A more generic answer first:  Check which downloads are available for your device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On &lt;a href=&quot;http://software.cisco.com/download/navigator.html&quot; rel=&quot;nofollow&quot;&gt;http://software.cisco.com/download/navigator.html&lt;/a&gt; you can search for your device and see which downloads are available and how much Flash/RAM they need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't need a login or special access rights to access these pages. And yes the web site is sometimes confusing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just did for the 2610 and 12.3 is only listed under &quot;Deferred Releases&quot;. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-03-30T10:28:11.743" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7093" PostTypeId="2" ParentId="7090" CreationDate="2014-03-30T10:52:41.733" Score="6" Body="&lt;p&gt;If you can't find 12.3 image that fits in the 8MB flash partition, you'll need to repartition the flash with &lt;code&gt;no partition flash&lt;/code&gt; in the configuration mode. Then format it as one big partition, which should give you 16MB of space, and finally put some 12.3 IOS image on it which should then work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ah, and BTW, the IOSes tend to reserve some space, and if you're fighting with pushing every available bit to use, erase the flash in this manner:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;erase /no-squeeze-reserve-space flash:&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-03-30T10:52:41.733" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7094" PostTypeId="2" ParentId="7091" CreationDate="2014-03-30T11:51:02.517" Score="8" Body="&lt;p&gt;IPv4 or IPv6 doesn't matter, except for the availability of addresses.  These are examples using IPv4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology A is what most people do.  Topology B is what Mike Pennington said.  Topology C is what you can do if you get a few addresses from your ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fUI4D.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5025" LastActivityDate="2014-03-30T11:51:02.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7095" PostTypeId="1" AcceptedAnswerId="7100" CreationDate="2014-03-30T13:55:23.970" Score="3" ViewCount="12928" Body="&lt;p&gt;What does Trailer field stand for in Ethernet II frame? Can you explain this on following cases (length of ARP packet is 28 bytes)?&lt;/p&gt;&#xA;&lt;p&gt;Case #1:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Ethernet II&#xA;Destination: Broadcast (ff:ff:ff:ff:ff:ff)&#xA;Source: c4:46:19:1d:05:f6 (c4:46:19:1d:05:f6)&#xA;Type: ARP (0x0806)&#xA;Trailer: D01CCF9087084E0A00000000000000000000&#xA;&#xA;Address Resolution Protocol (reply)&#xA;Hardware type: Ethernet (0x0001)&#xA;Protocol type: IP (0x0800)&#xA;Hardware size: 6&#xA;Protocol size: 4&#xA;Opcode: reply (0x0002)&#xA;[Is gratuitous: False]&#xA;Sender MAC address: c4:46:19:1d:05:f6&#xA;Sender IP address: 88.200.89.1&#xA;Target MAC address: ff:ff:ff:ff:ff:ff&#xA;Target IP address: 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Case #2:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Ethernet II&#xA;Destination: Broadcast (ff:ff:ff:ff:ff:ff)&#xA;Source: Cisco_f6:16:c7 (00:16:9d:f6:16:c7)&#xA;Type: ARP (0x0806)&#xA;Trailer: 000000000000000000000000000000000000&#xA;&#xA;[Duplicate IP address detected for 88.200.89.1]&#xA;&#xA;Address Resolution Protocol (reply/gratuitous)&#xA;Hardware type: Ethernet (0x0001)&#xA;Protocol type: IP (0x0800)&#xA;Hardware size: 6&#xA;Protocol size: 4&#xA;Opcode: reply (0x0002)&#xA;[Is gratuitous: True]&#xA;Sender MAC address: Cisco_f6:16:c7&#xA;Sender IP address: 88.200.89.1&#xA;Target MAC address: Cisco_f6:16:c7&#xA;Target IP address: 88.200.89.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="5027" LastEditorUserId="36720" LastEditDate="2023-12-21T23:13:01.540" LastActivityDate="2023-12-21T23:13:01.540" Title="Wireshark Ethernet II trailer field?" Tags="|ethernet|arp|packet-analysis|wireshark|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="7096" PostTypeId="1" CreationDate="2014-03-30T14:24:30.040" Score="0" ViewCount="1970" Body="&lt;p&gt;i want to know what is multipoint line configuration and according to that is in ring network topology the link between two devices considered point to point or multipoint configuration ?&lt;/p&gt;&#xA;" OwnerUserId="4926" LastEditorUserId="3191" LastEditDate="2014-12-08T20:31:04.347" LastActivityDate="2020-11-04T22:29:40.320" Title="what is multipoint line configuration?" Tags="|ethernet|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7098" PostTypeId="2" ParentId="6699" CreationDate="2014-03-30T15:39:36.453" Score="2" Body="&lt;p&gt;If you want to 'game the system' and maximize your link performance (to the detriment of others) then you should maximize your transmit power and deafen the receiver (attenuate the RX inputs) so that the -80dBm stuff is not being detected. Or, start off with a deaf receiver. This assumes you have a massive carrier to interference advantage to begin with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit like a shouting conversation between to hard-of hearing people in a restaurant, they don't hear anyone  except each other because they are shouting that compensates their deafness. Everyone else shuts up and leaves. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way your AP/client will effectively cripple CSMA/CD protocol and transmit over the top of everyone else, and because you have sufficient CIR then the other interference won't badly affect you. You will likely force them to silence their TX more too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most APS have combined RX and TX ports so it isn't usually possible to attenuate the RX path like this. Perhaps for this very reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If everyone did it nothing would work in the presence of a few other APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(but I wish I could - I can 'see' 170+ APs in front room and a different 180 APs out back)&lt;/p&gt;&#xA;" OwnerUserId="5028" LastActivityDate="2014-03-30T15:39:36.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7100" PostTypeId="2" ParentId="7095" CreationDate="2014-03-30T18:41:06.900" Score="4" Body="&lt;p&gt;Ethernet imposes a 60-byte (64-byte, if you include the CRC at the end of the packet) minimum on packet sizes (a requirement imposed by the CSMA/CD mechanism used in Ethernet).  The trailer is the padding added to short packets to satisfy that requirement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark infers the length of the trailer from what information is available in the packet.  In packets in which the type/length field in the Ethernet header is a length field, the length field can be used to determine the length of the trailer; however, in packets in which it's a type field, the length has to be indicated by something in the payload, so that the implementation of the protocol running on top of Ethernet knows what's data and what's padding - for example, IPv4 and IPv6 have fields in the header from which the total length of the IP datagram can be determined.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2014-03-30T18:41:06.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7101" PostTypeId="1" AcceptedAnswerId="7587" CreationDate="2014-03-30T20:40:30.853" Score="6" ViewCount="1324" Body="&lt;p&gt;I'm trying to connect one end of a L2VPN tunnel to a VPLS instance on a Juniper MX router. The L2VPN should act like a local interface in the VPLS instance. Is this possible at all? I can't find any information about how this could be done.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-04-25T13:05:20.683" Title="Is it possible to stitch a L2VPN connection into a VPLS domain on Juniper MX" Tags="|juniper|mpls|vpls|l2vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7103" PostTypeId="1" AcceptedAnswerId="50018" CreationDate="2014-03-30T22:42:49.820" Score="5" ViewCount="1259" Body="&lt;p&gt;We are experiencing an issue with a GLC-T SFP in a F2e Line card on a Nexus 7000. No matter what is tried we can it will not go up/up. This connection will go from one Nex7k to another and is intended to be for vPC keep alive. We are running current code 6.2.2a. We also have a Sup2 in the switch. Other SFPs in teh line card work properly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have tried&#xA;- Different ports on the same line card on different port groups&#xA;- Connecting to other devices such as a laptop&#xA;- replacing cables&#xA;- Hard setting speed and duplex&#xA;- Tested the SFP in other devices. (that came out of a ASR1k)&#xA;- tested in both switchport and routed modes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas out there?&lt;/p&gt;&#xA;" OwnerUserId="414" LastActivityDate="2018-04-20T13:24:29.620" Title="Issue with GLC-T on in a Nexus 7000 F2e line card" Tags="|cisco|cisco-nx-os|cisco-nexus-7k|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7105" PostTypeId="1" AcceptedAnswerId="7111" CreationDate="2014-03-31T01:02:16.173" Score="8" ViewCount="23787" Body="&lt;p&gt;Vague Question:&#xA;If one access point can do the job adequately is there still an advantage to using more than one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario:&#xA;1 access point at the center of your network required coverage area should adequately cover the area. There will always be less than 50 wireless clients and 0 wired clients. Most of the clients will move throughout the required coverage area while in use and some would like to go just beyond the perimeter; but don't have to. A gigabit backbone is available for access points to be placed anywhere. There are neighboring wifi networks, but only horizontally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specific Question:&#xA;In this scenario is there an advantage to using multiple (say 2 ~ 4) access points and placing them near the perimeter of your required coverage area?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My 2 Hypotheses:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hypothesis 1: With 1 access point at the center of the required coverage area broadcasting on dual bands with 1 channel each it will be easier to find clear channels. Clients will not have to migrate from access point to access point as they move throughout the covered area; possibly dropping the connection momentarily, or just failing to migrate at all. By maintaing a smaller perimeter there is less chance of interference from other neighboring wifi networks and equipment operating in the same band.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hypothesis 2: With multiple access points near the perimeter of the coverage area more channels should be used; 1 channel for each access point (or should 1 be used for all since it is the same network?) possibly limiting it to 3 non-overlapping channels and 3 access points. Clients may migrate well from access point to access point while moving. They can leave the required perimeter somewhat. Everyone has a stronger signal, a lower chance of dropped packets, etc. Interference may be a bigger problem, especially with neighboring wifi networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTES: They will all have the same SSID and WPA2 Passphrase, SSID will be hidden and MAC filtering will be used, 802.11n or 802.11ac will be used. I have a clear understanding of networking and I'm not asking how to do this. I'm asking which is better based on scientific evidence. I don't have the budget to a-b test this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe this is really a question of how well will the clients migrate on their own, or maybe it it's more than that.&lt;/p&gt;&#xA;" OwnerUserId="5033" LastActivityDate="2014-03-31T02:49:57.760" Title="Single Access Point vs. Multiple Access Points" Tags="|wireless|best-practices|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7106" PostTypeId="1" AcceptedAnswerId="7117" CreationDate="2014-03-31T01:06:08.070" Score="137" ViewCount="864039" Body="&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP: 128.42.5.4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In binary: 10000000 00101010 00000101 00000100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnet: 255.255.248.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could you determine the prefix, network, subnet, and host numbers?&lt;/p&gt;&#xA;" OwnerUserId="5032" LastEditorUserId="8499" LastEditDate="2018-10-17T15:32:51.967" LastActivityDate="2022-03-06T23:11:51.460" Title="How do you calculate the prefix, network, subnet, and host numbers?" Tags="|ip|ipv4|subnet|ip-address|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7107" PostTypeId="1" CreationDate="2014-03-31T01:13:42.127" Score="1" ViewCount="634" Body="&lt;p&gt;I have cisco 2610 router but it has only one ethernet interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to add more Fastethernet interface on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But i don't know which network module is for that router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;can anyone please guide me&lt;/p&gt;&#xA;" OwnerUserId="4968" LastEditorUserId="3191" LastEditDate="2014-12-08T20:27:07.113" LastActivityDate="2014-12-08T20:27:07.113" Title="Which network module i can use with cisco 2610 router" Tags="|cisco|router|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7108" PostTypeId="2" ParentId="7096" CreationDate="2014-03-31T01:21:29.357" Score="3" Body="&lt;p&gt;You are correct that in a ring topology, the links between devices are point to point.  In a multipoint configuration, each device can directly communicate with another without an intermediary device.  In your question, when pc-1 sends data to pc-3, it must go through pc-2.  So it is not a multipoint connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes these terms can have multiple meanings, depending on the context.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-31T01:21:29.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7109" PostTypeId="2" ParentId="7105" CreationDate="2014-03-31T01:37:03.380" Score="2" Body="&lt;p&gt;There are two interrelated issues here:  coverage area and channel bandwidth/utilization.  Multiple access points will extend the coverage area and improve throughput, because signals will be stronger and therefore your clients can operate at higher speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if your coverage is perfectly adequate with one AP, having multiple APs allow you to use multiple channels, and this will reduce channel contention and increase throughput.  With one AP, all your clients are competing for airtime on one channel; with 3 APs on different channels, for instance, you have three times the channel capacity, and your clients will have greater throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a modern wireless network with a central controller, it can influence how and when your clients chose a particular AP.  Ultimately though, the client makes the decision which AP to associate with, and when to roam.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-03-31T01:37:03.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7111" PostTypeId="2" ParentId="7105" CreationDate="2014-03-31T02:37:59.807" Score="5" Body="&lt;p&gt;In the scenario you describe, you should definitely be looking at multiple access points, preferrably dual band APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While coverage may be sufficient, coverage alone is no longer the primary consideration when deploying a wirelss network.  Client capacity, channel utilization, signal quality, and reliability are much more important and multiple access points will help with all of these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By using 3 (or more) APs on multiple channels (1, 6, and 11), you will in effect triple the amount of airtime (bandwidth) available on your wireless network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, proper placement of the APs will provide clients a closer AP with stronger signal, which will be more resistant to noise in the RF environment.  This will allow better signal-to-noise (SNR) ratios which will translate to the use of higher data rates and this results in more data transmitted per &quot;timeslot&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend placing them 2/3 to 3/4 of the way from the center to the perimeter, spaced roughly evenly.  Try to get them in or as close to the highest user denisity locations as possible (i.e. conference rooms, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the additional access points will provide increased reliability.  With a single access point, if it were to fail or reboot for any reason, this would create a disruption in service.  Having multiple access points should allow for coverage to overlap, allowing service to remain (if degraded) when you have an access point down.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-03-31T02:49:57.760" LastActivityDate="2014-03-31T02:49:57.760" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7113" PostTypeId="2" ParentId="7028" CreationDate="2014-03-31T03:53:29.060" Score="6" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It is recommended you upgrade the flash to at least the current shipping default of 256mb in the fine print (number 11) of the 8.3 memory upgrade guide. (&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/hw/maintenance/guide/asa_hw/overview.html#pgfId-1054519&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/hw/maintenance/guide/asa_hw/overview.html#pgfId-1054519&lt;/a&gt;). The same would apply for 9.1. The concern would come with loading the ASA code it self, along with ASDM and AnyConnect.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As for the upgrade path you can find the recommended path in the release notes for 9.1&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;You cannot upgrade directly to 9.0 or later. You must first upgrade to Version 8.3 or 8.4 for a successful migration.&quot; &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/release/notes/asarn91.html&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/release/notes/asarn91.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There are provisions to migrate the old NAT config to the new NAT config however we have seen in the past they may not be the most accurate, however your mileage may vary depending on the complexity of your configuration. This would occur the 8.3 to 8.4 portion of the upgrade.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="414" LastActivityDate="2014-03-31T03:53:29.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7117" PostTypeId="2" ParentId="7106" CreationDate="2014-03-31T10:38:08.013" Score="209" Body="&lt;h2&gt;Calculating the Netmask Length (also called a prefix):&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Convert the dotted-decimal representation of the netmask to binary.  Then,  count the number of contiguous 1 bits, starting at the most significant bit in the first octet (i.e. the left-hand-side of the binary number).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;255.255.248.0   in binary: 11111111 11111111 11111000 00000000&#xA;                           -----------------------------------&#xA;                           I counted twenty-one 1s             -------&amp;gt; /21&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The prefix of 128.42.5.4 with a 255.255.248.0 netmask is /21.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Calculating the Network Address:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The network address is the logical AND of the respective bits in the binary representation of the IP address and network mask.  Align the bits in both addresses, and perform a logical AND on each pair of the respective bits.  Then convert the individual octets of the result back to decimal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logical AND truth table:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/e5tIQ.png&quot; alt=&quot;Logical AND&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.42.5.4      in binary: 10000000 00101010 00000101 00000100&#xA;255.255.248.0   in binary: 11111111 11111111 11111000 00000000&#xA;                           ----------------------------------- [Logical AND]&#xA;                           10000000 00101010 00000000 00000000 ------&amp;gt; 128.42.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the network address of 128.42.5.4/21 is 128.42.0.0&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Calculating the Broadcast Address:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The broadcast address converts all host bits to 1s...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that our IP address in decimal is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.42.5.4      in binary: 10000000 00101010 00000101 00000100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The network mask is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;255.255.248.0   in binary: 11111111 11111111 11111000 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means our host bits are the last 11 bits of the IP address, because we find the host mask by inverting the network mask:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Host bit mask            : 00000000 00000000 00000hhh hhhhhhhh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To calculate the broadcast address, we force all host bits to be 1s:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.42.5.4      in binary: 10000000 00101010 00000101 00000100&#xA;Host bit mask            : 00000000 00000000 00000hhh hhhhhhhh&#xA;                           ----------------------------------- [Force host bits]&#xA;                           10000000 00101010 00000111 11111111 ----&amp;gt; 128.42.7.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Calculating subnets:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You haven't given enough information to calculate subnets for this network; as a general rule you build subnets by reallocating some of the host bits as network bits for each subnet.  Many times there isn't one right way to subnet a block... depending on your constraints, there could be several valid ways to subnet a block of addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume we will break 128.42.0.0/21 into 4 subnets that must hold at least 100 hosts each...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wHlF8.png&quot; alt=&quot;subnetting&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example, we know that you need at least a /25 prefix to contain 100 hosts; I chose a /24 because it falls on an octet boundary.  Notice that the network address for each subnet borrows host bits from the parent network block.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Finding the required subnet masklength or netmask:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;How did I know that I need at least a /25 masklength for 100 hosts?  Calculate the prefix by backing into the number of host bits required to contain 100 hosts.  One needs 7 host bits to contain 100 hosts.  Officially this is calculated with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Host bits&lt;/em&gt; = Log&lt;sub&gt;2&lt;/sub&gt;(Number-of-hosts) = Log&lt;sub&gt;2&lt;/sub&gt;(100) = 6.643&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since IPv4 addresses are 32 bits wide, and we are using the host bits (i.e. least significant bits), simply subtract 7 from 32 to calculate the minimum subnet prefix for each subnet... 32 - 7 = 25.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;The lazy way to break 128.42.0.0/21 into four equal subnets:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Since we only want four subnets from the whole 128.42.0.0/21 block, we could use /23 subnets.  I chose /23 because we need 4 subnets... i.e. an extra two bits added to the netmask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an equally-valid answer to the constraint, using /23 subnets of 128.42.0.0/21...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nKRVg.png&quot; alt=&quot;subnetting, 2nd option&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Calculating the host number:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This is what we've already done above... just reuse the host mask from the work we did when we calculated the broadcast address of 128.42.5.4/21...  This time I'll use 1s instead of &lt;code&gt;h&lt;/code&gt;, because we need to perform a logical AND on the network address again.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.42.5.4      in binary: 10000000 00101010 00000101 00000100&#xA;Host bit mask            : 00000000 00000000 00000111 11111111&#xA;                           ----------------------------------- [Logical AND]&#xA;                           00000000 00000000 00000101 00000100 -----&amp;gt; 0.0.5.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Calculating the maximum possible number of hosts in a subnet:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To find the maximum number of hosts, look at the number of binary bits in the host number above.  The easiest way to do this is to subtract the netmask length from 32 (number of bits in an IPv4 address).  This gives you the number of host bits in the address.  At that point...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Maximum Number of hosts&lt;/em&gt; = 2**(32 - netmask_length) - 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason we subtract 2 above is because the all-ones and all-zeros host numbers are reserved.  The all-zeros host number is the network number; the all-ones host number is the broadcast address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the example subnet of 128.42.0.0/21 above, the number of hosts is...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Maximum Number of hosts&lt;/em&gt; = 2**(32 - 21) - 2 = 2048 - 2 = 2046&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Finding the maximum netmask (minimum hostmask) which contains two IP addresses:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Suppose someone gives us two IP addresses and expects us to find the longest netmask which contains both of them; for example, what if we had:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;128.42.5.17&lt;/li&gt;&#xA;&lt;li&gt;128.42.5.67&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The easiest thing to do is to convert both to binary and look for the longest string of network-bits from the left-hand side of the address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.42.5.17     in binary: 10000000 00101010 00000101 00010001&#xA;128.42.5.67     in binary: 10000000 00101010 00000101 01000011&#xA;                           ^                           ^     ^&#xA;                           |                           |     |&#xA;                           +--------- Network ---------+Host-+&#xA;                             (All bits are the same)    Bits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case the maximum netmask (minimum hostmask) would be /25&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: If you try starting from the right-hand side, don't get tricked just because you find one matching column of bits; there could be unmatched bits beyond those matching bits.  Honestly, the safest thing to do is to start from the left-hand side.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="8499" LastEditDate="2018-09-06T22:25:39.960" LastActivityDate="2018-09-06T22:25:39.960" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="7123" PostTypeId="1" CreationDate="2014-03-31T13:36:06.867" Score="3" ViewCount="130" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6qLh2.png&quot; alt=&quot;enter image description here&quot;&gt;is the link between two hubs or (communication nodes)connected together is considered multipoint and each hub connected to many devices as the data of many users are shared either spatially or temporally on this link ? &lt;/p&gt;&#xA;" OwnerUserId="4926" LastEditorUserId="3191" LastEditDate="2014-12-08T20:22:10.443" LastActivityDate="2014-12-08T20:22:10.443" Title="is the shared link between two hubs (communication node) considered multipoint?" Tags="|ethernet|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7124" PostTypeId="1" AcceptedAnswerId="7133" CreationDate="2014-03-31T15:00:47.583" Score="4" ViewCount="2155" Body="&lt;p&gt;in terms of CPU consumption and possible traffic disruption, what should I generally expect when I run the command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Switch#debug ip packet&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on a Cisco device in a large ISP network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco devices in question:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Catalyst 3750 Series&lt;/li&gt;&#xA;&lt;li&gt;Catalyst 6500 Series&lt;/li&gt;&#xA;&lt;li&gt;Catalyst 4500 series&lt;/li&gt;&#xA;&lt;li&gt;Cisco 7600 Series Routers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These device are usually processing no less than 8 Gbps of traffic.&lt;/p&gt;&#xA;" OwnerDisplayName="user5029" LastEditorUserId="775" LastEditDate="2014-04-01T10:57:57.423" LastActivityDate="2014-04-02T19:29:31.903" Title="CPU Impact of &quot;debug ip packet&quot; on Cisco Switches" Tags="|cisco|switch|ipv4|ethernet|troubleshooting|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7127" PostTypeId="2" ParentId="7107" CreationDate="2014-03-31T17:55:19.657" Score="2" Body="&lt;p&gt;There are no FastEthernet WICs (only HWICs), and none of the 10/100 network modules are officially supported for the &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/routers/ps274/products_data_sheet09186a0080091b89.html&quot; rel=&quot;nofollow&quot;&gt;2600 series&lt;/a&gt; (except the 2691 in some cases). While at least &lt;a href=&quot;https://supportforums.cisco.com/discussion/10228056/does-nm-1fe-tx-works-2610xm&quot; rel=&quot;nofollow&quot;&gt;one person&lt;/a&gt; has reported getting an NM-1FE-TX working in a 2620, the bigger problem you have is that the &lt;a href=&quot;http://www.cisco.com/web/partners/downloads/765/tools/quickreference/routerperformance.pdf&quot; rel=&quot;nofollow&quot;&gt;2610 has limited throughput capacity&lt;/a&gt;, and the benefit you'll see with a 100 Mbps interface over 10 Mbps will depend greatly on your configuration and the type of traffic you push through it. You may be better off looking for an NM-1E or NM-4E 10 Mbps card, both of which are definitely supported on the 2600 series.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, bear in mind that this platform and these modules are well past EOL, so you'll likely need to source parts from the used/refurb market.&lt;/p&gt;&#xA;" OwnerUserId="1339" LastEditorUserId="1339" LastEditDate="2014-03-31T21:25:37.273" LastActivityDate="2014-03-31T21:25:37.273" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7129" PostTypeId="2" ParentId="7124" CreationDate="2014-03-31T23:14:07.430" Score="1" Body="&lt;p&gt;When Cisco says &quot;these commands may adversely affect device performance&quot;, they aren't kidding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the types of devices with the traffic load you describe, this command will likely result in 100% CPU consumption, halting of device functionality and major disruption of your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't do it.&lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2014-03-31T23:14:07.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7130" PostTypeId="2" ParentId="7123" CreationDate="2014-04-01T01:39:45.583" Score="3" Body="&lt;p&gt;This is mostly a semantic problem. From a physical point of view, most connections you will see are point to point -- there are very few physical multipoint media types (I would propose they are all obsolete).  From a logical point of view, however, many technologies act a a multipoint networks, where any endpoint can directly address another at the data link level.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-04-01T01:39:45.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7133" PostTypeId="2" ParentId="7124" CreationDate="2014-04-01T05:02:32.700" Score="5" Body="&lt;p&gt;The platforms you mention are all hardware forwarding devices. What debug ip packet does is to show packets going to / from the switch's CPU (either punted, locally-sourced, or control-plane).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should only see control plane packets here or packets being punted due to a feature being misconfigured or not supported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;People sometimes turn off CEF to debug but this is not recommended and not even supported on some of the platforms such as 3750.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The impact depends on how much traffic you have going to the CPU but it's a risky command to run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do you want to run it? What are you looking for? Have you considered using other methods such as Netflow, SPAN, ERSPAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to debug then log to a buffer, turn off terminal monitoring and combine debug ip packet with an ACL to define which traffic you are interested in. Do so at your own risk though.&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="775" LastEditDate="2014-04-01T11:05:49.323" LastActivityDate="2014-04-01T11:05:49.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7134" PostTypeId="2" ParentId="7124" CreationDate="2014-04-01T06:48:47.517" Score="0" Body="&lt;p&gt;Use the &lt;code&gt;debug ip packet&lt;/code&gt; command to monitor packets that are processed by the routers routing engine and are not fast switched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This command generates an output for every single packet, therefore it should be used with great caution.&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="-1" LastEditDate="2014-04-01T13:08:24.470" LastActivityDate="2014-04-01T13:08:24.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7135" PostTypeId="1" AcceptedAnswerId="7137" CreationDate="2014-04-01T07:16:17.570" Score="12" ViewCount="23798" Body="&lt;p&gt;I'm a software developer that sometimes has to do some easy network  tasks but knows almost nothing about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having some problems with a vps I rent ( ENJOY VPS: Unmanaged VPS - Medium VPS) and they insist that their server is running ok, but I keep having this problem, My server keeps getting down everyday, It's less than 15 minutes, but it's everyday (sometime twice a day) and I think that's not acceptable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well. here is my traceroute:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is almost all the hops goes to the same ip, that is my provider ip (but not my server ip) ¿is that ok?  I config my own DNS server (bind9) might that be the problem?&#xA;When my server is down  ping doesn't respond either and I can't access either via ENJOY VPS console.  (it doesn't let me stop or restart the server) (so, basically I can do nothing)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&#xA;traceroute to 74.117.153.110 (..HIDDEN..), 64 hops max, 52 byte packets&#xA; 1  dsldevice (192.168.1.254)  1.759 ms  1.281 ms  1.627 ms&#xA; 2  dsl-servicio-l200.uninet.net.mx (200.38.193.226)  18.611 ms  17.414 ms  26.365 ms&#xA; 3  bb-dallas-stemmons-5-pos0-14-0-0.uninet.net.mx (201.125.50.122)  60.559 ms  63.272 ms  72.120 ms&#xA; 4  xe-0-3-0-1.r01.dllstx04.us.bb.gin.ntt.net (157.238.225.45)  81.813 ms  81.872 ms  80.888 ms&#xA; 5  ae-9.r07.dllstx09.us.bb.gin.ntt.net (129.250.2.208)  83.735 ms  84.919 ms  89.175 ms&#xA; 6  xe-0-0-0-15.r07.dllstx09.us.ce.gin.ntt.net (129.250.195.118)  80.686 ms  81.170 ms  84.883 ms&#xA; 7  cust-108-60-193-226.corexchange.com (108.60.193.226)  94.542 ms  86.652 ms  85.616 ms&#xA; 8  74.117.154.4 (74.117.154.4)  82.222 ms  81.909 ms  80.970 ms&#xA; 9  74.117.154.1 (74.117.154.1)  83.212 ms  83.725 ms  81.852 ms&#xA;10  74.117.154.4 (74.117.154.4)  97.692 ms  81.136 ms *&#xA;11  74.117.154.1 (74.117.154.1)  83.025 ms  82.698 ms  88.137 ms&#xA;12  * * *&#xA;13  74.117.154.1 (74.117.154.1)  82.197 ms  83.792 ms  83.093 ms&#xA;14  * * *&#xA;15  74.117.154.1 (74.117.154.1)  83.534 ms  130.318 ms  83.675 ms&#xA;16  * * *&#xA;17  74.117.154.1 (74.117.154.1)  84.012 ms  84.844 ms  102.515 ms&#xA;18  * * *&#xA;19  74.117.154.1 (74.117.154.1)  83.032 ms  94.277 ms  86.625 ms&#xA;20  * * *&#xA;21  74.117.154.1 (74.117.154.1)  240.106 ms  119.049 ms  82.273 ms&#xA;22  * * *&#xA;23  74.117.154.1 (74.117.154.1)  84.167 ms  82.956 ms  84.310 ms&#xA;24  * * *&#xA;25  74.117.154.1 (74.117.154.1)  83.955 ms  83.636 ms  83.214 ms&#xA;26  * * 74.117.154.4 (74.117.154.4)  83.097 ms&#xA;27  74.117.154.1 (74.117.154.1)  83.860 ms  111.847 ms  86.387 ms&#xA;28  * * *&#xA;29  74.117.154.1 (74.117.154.1)  83.518 ms  83.944 ms  86.903 ms&#xA;30  * * *&#xA;31  74.117.154.1 (74.117.154.1)  271.557 ms  83.194 ms  103.277 ms&#xA;32  * * *&#xA;33  74.117.154.1 (74.117.154.1)  85.195 ms  83.311 ms  83.589 ms&#xA;34  * * *&#xA;35  74.117.154.1 (74.117.154.1)  87.368 ms  100.705 ms  84.437 ms&#xA;36  * * *&#xA;37  74.117.154.1 (74.117.154.1)  91.463 ms  120.895 ms  84.287 ms&#xA;38  74.117.154.4 (74.117.154.4)  82.238 ms *  82.750 ms&#xA;39  74.117.154.1 (74.117.154.1)  83.506 ms  83.911 ms  83.995 ms&#xA;40  * * *&#xA;41  74.117.154.1 (74.117.154.1)  84.081 ms  85.222 ms  84.120 ms&#xA;42  * * *&#xA;43  74.117.154.1 (74.117.154.1)  84.200 ms  84.603 ms  98.450 ms&#xA;44  * * *&#xA;45  74.117.154.1 (74.117.154.1)  85.244 ms  84.741 ms  103.672 ms&#xA;46  * * *&#xA;47  74.117.154.1 (74.117.154.1)  83.717 ms  84.648 ms  87.149 ms&#xA;48  * * *&#xA;49  74.117.154.1 (74.117.154.1)  88.051 ms  86.047 ms  84.800 ms&#xA;50  * * *&#xA;51  74.117.154.1 (74.117.154.1)  201.409 ms  170.421 ms  146.111 ms&#xA;52  * * *&#xA;53  74.117.154.1 (74.117.154.1)  84.987 ms  84.247 ms  87.167 ms&#xA;54  * * *&#xA;55  74.117.154.1 (74.117.154.1)  111.967 ms  133.665 ms  88.217 ms&#xA;56  74.117.154.4 (74.117.154.4)  109.692 ms *  83.531 ms&#xA;57  74.117.154.1 (74.117.154.1)  85.115 ms  86.417 ms  85.426 ms&#xA;58  * * *&#xA;59  74.117.154.1 (74.117.154.1)  84.038 ms  85.114 ms  122.035 ms&#xA;60  * * *&#xA;61  74.117.154.1 (74.117.154.1)  125.063 ms  84.423 ms  84.824 ms&#xA;62  74.117.154.4 (74.117.154.4)  82.987 ms *  133.977 ms&#xA;63  74.117.154.1 (74.117.154.1)  159.238 ms  163.869 ms  164.372 ms&#xA;64  * * *&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="5048" LastEditorUserId="3191" LastEditDate="2014-12-08T20:19:14.523" LastActivityDate="2018-12-21T22:53:42.307" Title="traceroute many hops with the same ip" Tags="|ping|traceroute|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7136" PostTypeId="1" AcceptedAnswerId="7138" CreationDate="2014-04-01T08:11:16.870" Score="8" ViewCount="9015" Body="&lt;p&gt;I have been informed by certain networking professionals that ARP replies can and sometimes actually are broadcast packets instead of unicast. If and when would you use a broadcast ARP reply?&lt;/p&gt;&#xA;" OwnerUserId="5049" LastEditorUserId="775" LastEditDate="2014-04-01T11:31:15.573" LastActivityDate="2014-04-01T13:08:50.093" Title="ARP Replies can they be Broadcast" Tags="|ethernet|protocol-theory|arp|broadcast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7137" PostTypeId="2" ParentId="7135" CreationDate="2014-04-01T08:51:43.413" Score="17" Body="&lt;p&gt;That is a routing loop. The router with IP address 74.117.154.1 keeps sending your packets to another router (74.117.154.4), which keeps sending them back to 74.117.154.1. They keep doing this until the TTL of the packet reaches zero, and the packet is discarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This cannot be caused by your bind9 setup, something is wrong with the configuration of the routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should contact the people running that network. If you are sure that is in the VPS provider's network, contact them. You can also do an IP whois lookup to see to whom the IP address is assigned.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-04-01T08:51:43.413" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7138" PostTypeId="2" ParentId="7136" CreationDate="2014-04-01T09:00:26.523" Score="4" Body="&lt;p&gt;According to the RFC826 (An Ethernet Address Resolution Protocol) the sender has to:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;put the local hardware and protocol addresses in the sender fields&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But as you pointed out why an host would use the broadcast address in an ARP reply? Maybe because this could seem clever: using the L2 broadcast address all the hosts in the LAN would immediately know a new (IP,MAC) pair saving time. Actually this method is not desired by the RFC (even if they refer to periodic broadcasting):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Periodic broadcasting is definitely not desired.  Imagine 100&#xA;  workstations on a single Ethernet, each broadcasting address&#xA;  resolution information once per 10 minutes (as one possible set&#xA;  of parameters).  This is one packet every 6 seconds.  This is&#xA;  almost reasonable, but what use is it?  The workstations aren't&#xA;  generally going to be talking to each other (and therefore have&#xA;  100 useless entries in a table);&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It also depends on the host's OS to add in the ARP table a tuple learned by a broadcasted message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: As stated in the comments the RFC 5227 updates the RFC 826 and it says&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In some applications of IPv4 Address Conflict Detection (ACD), it may be advantageous to deliver ARP Replies using broadcast instead of unicast because this allows address conflicts to be detected sooner than might otherwise happen&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="2663" LastEditDate="2014-04-01T09:52:33.040" LastActivityDate="2014-04-01T09:52:33.040" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7141" PostTypeId="2" ParentId="7136" CreationDate="2014-04-01T13:08:50.093" Score="3" Body="&lt;p&gt;One of the uses of broadcast ARP is the gratuitous ARP replies sent by some clustering or link aggregation (i.e. teaming) solutions.  This is the process they will typically use when they want to move traffic from one interface to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This process will update all hosts on the local subnet (including the gateway) as well as causing the L2 switches to update their MAC address tables.  The result is that all the traffic should switch over to the new interface smoothly and quickly.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-04-01T13:08:50.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7142" PostTypeId="2" ParentId="483" CreationDate="2014-04-01T13:09:18.987" Score="-6" Body="&lt;p&gt;Add &quot;redistribute eigrp&quot; to your router bgp XXXXX. That should do it for you.&lt;/p&gt;&#xA;" OwnerUserId="5054" LastActivityDate="2014-04-01T13:09:18.987" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7148" PostTypeId="1" CreationDate="2014-04-02T02:57:17.677" Score="4" ViewCount="445" Body="&lt;p&gt;How would I go about mapping a prefix to an organization?  I know I can use whois to map a given IP address to its AS and organization, but what about a prefix (as in, IP and some netmask)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say provider A owns the prefix 192.1.0.0/16 and sells 192.1.0.0/24 to company B. Now if I lookup the IP 192.1.0.x I will get company B. But what If I specifically want to find out who owns 192.1.0.0/16? &#xA;So far all the services I've found only map IP's to organizations, but not prefixes. &#xA;Is there any way to get this information?&lt;/p&gt;&#xA;" OwnerUserId="5069" LastEditorUserId="775" LastEditDate="2014-04-02T08:44:36.597" LastActivityDate="2014-04-02T12:07:16.787" Title="Mapping IP prefix to Organization" Tags="|ipv4|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7149" PostTypeId="2" ParentId="7148" CreationDate="2014-04-02T03:43:32.000" Score="2" Body="&lt;p&gt;You can check your RIR's whois database.  For example, if you go to www.Arin.net and enter an IP to search in their who-is, the record should provide a link to the parent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look here for more info: &lt;a href=&quot;https://www.arin.net/resources/whoisrws/index.html&quot; rel=&quot;nofollow&quot;&gt;https://www.arin.net/resources/whoisrws/index.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5070" LastActivityDate="2014-04-02T03:43:32.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7150" PostTypeId="1" AcceptedAnswerId="7151" CreationDate="2014-04-02T04:22:40.047" Score="9" ViewCount="6836" Body="&lt;p&gt;After a search on configuration guide and documentation, I didn't any evidence of a limitation on &lt;code&gt;ip address secondary&lt;/code&gt;configuration on a certain VLAN on 450x SUP6E. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone know where I can found such information or confirm if is there any ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By my perception, there is no limitation on secondary IP possible to configure on a SVI or interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2014-04-02T12:43:30.303" LastActivityDate="2014-04-02T12:43:30.303" Title="Is there any limitation of Secondary IP address number on a SVI or interface on 450x?" Tags="|cisco|cisco-4500|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7151" PostTypeId="2" ParentId="7150" CreationDate="2014-04-02T05:55:31.760" Score="10" Body="&lt;p&gt;There is no defined maximum limit for the amount of secondary IP addresses. However using a lot of secondary IPs usually points to a poor network design. What is your need for these secondary addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a quote from Ivan Pepelnjak:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;… and pasted the results into the console window. No problem, a router&#xA;  accepted at least 250 secondary addresses. Chris repeated the process&#xA;  on his Catalyst switch and reported that he stopped the test after&#xA;  approximately 150 addresses (obviously way more than what he needed).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ipspace.net/2009/04/secondary-subnets-limitation.html&quot;&gt;Ivan IOS hints maximum secondary IP&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also from Cisco's FAQ:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q. What are the maximum number of secondary IP addesses that can be&#xA;  configured on a router interface?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A. There are no limits on configuring secondary IP addresses on a&#xA;  router interface. For more information, refer to Configuring IP&#xA;  Addressing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/28745-44.html#q21&quot;&gt;Cisco FAQ&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to find out then you could test it with a script generating configuration and then pasting it in. My guess is you will get bored before you run into any limit though.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-04-02T05:55:31.760" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7154" PostTypeId="1" AcceptedAnswerId="7159" CreationDate="2014-04-02T12:02:35.027" Score="11" ViewCount="3619" Body="&lt;p&gt;I am setting up a testing environment for &lt;strong&gt;dualstack&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I currently have a server (Windows 2008 R2), 2 switches and a router installed and configured. The server is the Primary Domain Controller and it has the DHCP role installed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using &lt;strong&gt;VLANs&lt;/strong&gt; to separate the computers from each other. Now I am stuck on a problem and I can't seem to figure it out, so I really hope you guys can help me! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created both &lt;strong&gt;IPv4&lt;/strong&gt; and &lt;strong&gt;IPv6&lt;/strong&gt; Scopes on the server. On the router I have my sub-interfaces for the use of the VLANs and IPv4 works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I seem to be having a problem with IPv6. I gave my NIC a static IPv6 address, in this case &lt;strong&gt;2001:db8:a:1::10&lt;/strong&gt;. I also created multiple scopes (to use the VLANs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration of two interfaces on my router is: &#xA;&lt;img src=&quot;https://i.stack.imgur.com/iJWw0.png&quot; alt=&quot;Configuration Router&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IP's that are given to the computers who are connected on the default VLAN (DEFAULT) receive the IPv6 addresses from the DHCP server. But the ones that are connected with the other VLANs &lt;strong&gt;receive an IP address from the router without me creating a DHCP pool&lt;/strong&gt; (NOTE: they receive an IP address in the range of the IP that I gave to the sub-interfaces).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want this &lt;strong&gt;not&lt;/strong&gt; to happen and make it that they get the IP addresses from the Scope on the DHCP server (and so they show up in the lease).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be &lt;em&gt;greatly appreciated&lt;/em&gt;!&lt;/p&gt;&#xA;" OwnerUserId="5074" LastActivityDate="2014-04-02T22:34:33.853" Title="IPv6 DHCP Server vs Router" Tags="|vlan|ipv6|dhcp|dhcpv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7155" PostTypeId="2" ParentId="7148" CreationDate="2014-04-02T12:07:16.787" Score="3" Body="&lt;p&gt;Every whois service provides different option to specify which information you want. I have most experience with the RIPE database. There is a &lt;a href=&quot;https://apps.db.ripe.net/search/query.html&quot; rel=&quot;nofollow&quot;&gt;web interface&lt;/a&gt; available, but the most direct way to access the information is using the command line. You can request help using this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ whois -h whois.ripe.net -- -h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There you can see the option that you need:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%     -L, --all-less &amp;lt;ip-lookup&amp;gt;&#xA;%           Returns all level less specific inetnum, inet6num or route(6)&#xA;%           objects, including exact matches.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I request information about my own address (yes, I am my own ISP):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ whois -h whois.ripe.net -- '--all-less 37.77.56.75'&#xA;[...]&#xA;inetnum:        0.0.0.0 - 255.255.255.255&#xA;netname:        IANA-BLK&#xA;descr:          The whole IPv4 address space&#xA;[...]&#xA;inetnum:        37.0.0.0 - 37.255.255.255&#xA;netname:        EU-ZZ-37&#xA;descr:          RIPE NCC&#xA;descr:          European Regional Registry&#xA;[...]&#xA;inetnum:        37.77.56.0 - 37.77.63.255&#xA;netname:        NL-STEFFANN-20120201&#xA;descr:          S.J.M. Steffann&#xA;[...]&#xA;inetnum:        37.77.56.64 - 37.77.56.127&#xA;netname:        STEFFANN-OFFICE1&#xA;descr:          S.J.M. Steffann Office&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you can see the whole hierarchy. The web interface shows exactly &lt;a href=&quot;https://apps.db.ripe.net/search/query.html?searchtext=37.77.56.75&amp;amp;hierarchyFlag=all-less&amp;amp;rflag=true&amp;amp;source=RIPE#resultsAnchor&quot; rel=&quot;nofollow&quot;&gt;the same information&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-04-02T12:07:16.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7157" PostTypeId="1" AcceptedAnswerId="7158" CreationDate="2014-04-02T12:33:33.963" Score="12" ViewCount="14137" Body="&lt;p&gt;Many people new to networking wonder what the technical differences between a broadcast domain and a collision domain are.  Specifically:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What criteria is used to know the boundaries of a collision domain?&lt;/li&gt;&#xA;&lt;li&gt;Why does an ethernet switch break up a collision domain? &lt;/li&gt;&#xA;&lt;li&gt;Are broadcast domains and collision domains mutually exclusive?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastActivityDate="2016-04-22T18:00:58.923" Title="Technical difference between a Collision and Broadcast Domain" Tags="|ethernet|protocol-theory|duplex|broadcast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7158" PostTypeId="2" ParentId="7157" CreationDate="2014-04-02T12:34:31.083" Score="15" Body="&lt;h3&gt;Theory&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;By convention, a &lt;a href=&quot;http://en.wikipedia.org/wiki/Collision_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Collision Domain: a half-duplex network entity, which commonly uses CSMA/CD for access&quot;&gt;collision domain&lt;/a&gt; is a contiguous wired and / or wireless &lt;a href=&quot;http://en.wikipedia.org/wiki/Duplex_%28telecommunications%29#Half-duplex&quot; rel=&quot;noreferrer&quot;&gt;half-duplex&lt;/a&gt; segment (typically using &lt;a href=&quot;http://en.wikipedia.org/wiki/Carrier_sense_multiple_access_with_collision_detection&quot; rel=&quot;noreferrer&quot;&gt;CSMA/CD&lt;/a&gt;), which is a subset of the &lt;a href=&quot;http://en.wikipedia.org/wiki/Subnetwork&quot; rel=&quot;noreferrer&quot;&gt;subnet&lt;/a&gt; or &lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_LAN&quot; rel=&quot;noreferrer&quot;&gt;vlan&lt;/a&gt;'s &lt;a href=&quot;http://en.wikipedia.org/wiki/Broadcast_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Broadcast Domain&quot;&gt;broadcast domain&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Collision_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Collision Domain: a half-duplex network entity, which commonly uses CSMA/CD for access&quot;&gt;Collision domain&lt;/a&gt;s are invariably a &lt;a href=&quot;http://en.wikipedia.org/wiki/Duplex_%28telecommunications%29#Half-duplex&quot; rel=&quot;noreferrer&quot;&gt;half-duplex&lt;/a&gt; segment, or a series of connected &lt;a href=&quot;http://en.wikipedia.org/wiki/Duplex_%28telecommunications%29#Half-duplex&quot; rel=&quot;noreferrer&quot;&gt;half-duplex&lt;/a&gt; segments.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Ethernet_hub&quot; rel=&quot;noreferrer&quot;&gt;Ethernet hub&lt;/a&gt;s / &lt;a href=&quot;http://en.wikipedia.org/wiki/Wireless_access_point&quot; rel=&quot;noreferrer&quot;&gt;Wifi Access Points&lt;/a&gt; (within the same RF-channel width) start or continue a &lt;a href=&quot;http://en.wikipedia.org/wiki/Collision_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Collision Domain: a half-duplex network entity, which commonly uses CSMA/CD for access&quot;&gt;collision domain&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Network_switch&quot; rel=&quot;noreferrer&quot;&gt;Ethernet switch&lt;/a&gt;es, &lt;a href=&quot;http://en.wikipedia.org/wiki/Router_%28computing%29&quot; rel=&quot;noreferrer&quot;&gt;router&lt;/a&gt;s, &lt;a href=&quot;http://en.wikipedia.org/wiki/Firewall_%28computing%29&quot; rel=&quot;noreferrer&quot;&gt;firewall&lt;/a&gt;s all form a boundary on a &lt;a href=&quot;http://en.wikipedia.org/wiki/Collision_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Collision Domain: a half-duplex network entity, which commonly uses CSMA/CD for access&quot;&gt;collision domain&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Broadcast_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Broadcast Domain&quot;&gt;Broadcast domain&lt;/a&gt;s could have multiple &lt;a href=&quot;http://en.wikipedia.org/wiki/Duplex_%28telecommunications%29#Half-duplex&quot; rel=&quot;noreferrer&quot;&gt;half-duplex&lt;/a&gt; segments inside them.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;How Ethernet switches control Collision Domains&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Network_switch&quot; rel=&quot;noreferrer&quot;&gt;Ethernet switch&lt;/a&gt;es control &lt;a href=&quot;http://en.wikipedia.org/wiki/Collision_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Collision Domain: a half-duplex network entity, which commonly uses CSMA/CD for access&quot;&gt;collision domain&lt;/a&gt;s because they can join &lt;a href=&quot;http://en.wikipedia.org/wiki/Duplex_%28telecommunications%29#Half-duplex&quot; rel=&quot;noreferrer&quot;&gt;half-duplex&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Duplex_%28telecommunications%29#Full-duplex&quot; rel=&quot;noreferrer&quot;&gt;full-duplex&lt;/a&gt; links within the same &lt;a href=&quot;http://en.wikipedia.org/wiki/Broadcast_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Broadcast Domain&quot;&gt;broadcast domain&lt;/a&gt;; &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_switch&quot; rel=&quot;noreferrer&quot;&gt;Ethernet switch&lt;/a&gt;es &lt;a href=&quot;http://en.wikipedia.org/wiki/Data_buffer#Telecommunication_buffer&quot; rel=&quot;noreferrer&quot;&gt;buffer&lt;/a&gt; frames to assist the transition between &lt;a href=&quot;http://en.wikipedia.org/wiki/Duplex_%28telecommunications%29#Half-duplex&quot; rel=&quot;noreferrer&quot;&gt;half-duplex&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Duplex_%28telecommunications%29#Full-duplex&quot; rel=&quot;noreferrer&quot;&gt;full-duplex&lt;/a&gt; links.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Example:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;This shows a strange network which illustrates how &lt;a href=&quot;http://en.wikipedia.org/wiki/Collision_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Collision Domain: a half-duplex network entity, which commonly uses CSMA/CD for access&quot;&gt;collision domain&lt;/a&gt;s are a contained within a &lt;a href=&quot;http://en.wikipedia.org/wiki/Broadcast_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Broadcast Domain&quot;&gt;broadcast domain&lt;/a&gt;, and how devices form boundaries for each one.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Yellow areas are the span of the &lt;a href=&quot;http://en.wikipedia.org/wiki/Broadcast_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Broadcast Domain&quot;&gt;broadcast domain&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Grey area are the span of the &lt;a href=&quot;http://en.wikipedia.org/wiki/Collision_domain&quot; rel=&quot;noreferrer&quot; title=&quot;Collision Domain: a half-duplex network entity, which commonly uses CSMA/CD for access&quot;&gt;collision domain&lt;/a&gt;s&lt;/li&gt;&#xA;&lt;li&gt;Firewalls and routers are assumed in routed mode (i.e. not bridged mode)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/n9xZr.png&quot; alt=&quot;Illustration&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VdXG9.png&quot; alt=&quot;CollisionDomain vs BroadcastDomain&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-03-01T19:26:24.580" LastActivityDate="2015-03-01T19:26:24.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7159" PostTypeId="2" ParentId="7154" CreationDate="2014-04-02T12:38:58.230" Score="11" Body="&lt;p&gt;IPv6 has more options for configuring addresses than IPv4. The process works as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A new client joins the network and sends a Router Solicitation (RS)&lt;/li&gt;&#xA;&lt;li&gt;Each router (can be multiple) sends a Router Advertisement (RA)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This happens both on request (when receiving an RS) as well as periodically&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;The RA contains a lot of information on how the network is run:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the router sending the RA can be a default gateway, and for how long&lt;/li&gt;&#xA;&lt;li&gt;Telling clients if there is a stateless (not giving out addresses, only providing extra information like DNS settings) DHCPv6 server on the network (the O=other flag)&lt;/li&gt;&#xA;&lt;li&gt;Telling clients if there is a stateful (like in IPv4) DHCPv6 server on the network (the M=managed flag)&lt;/li&gt;&#xA;&lt;li&gt;Telling clients about the prefixes in use on the network&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For each prefix: tell the clients if they can auto-configure an address by themselves  (the A=autoconf flag)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;And possibly lots of other stuff&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you want to run a fully managed network where the DHCPv6 server manages all the addresses (and please think why you want this before choosing it, if you don't use the information in the DHCPv6 server then letting clients configure their own addresses is much easier) then the router has to turn off the A (autoconf) flag for every prefix it announces and turn on the M (managed) flag so that clients know that they are not allowed to choose their own addresses but that there is a DHCPv6 server available to help them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how to do that on a Cisco router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; Go to the interface configuration&#xA;interface FastEthernet0/0&#xA;  ; Tell clients that auto configuration is not allowed&#xA;  ; This changes the default parameters.&#xA;  ; You have to specify the timers, so I use the standard values&#xA;  ipv6 nd prefix default 2592000 604800 no-autoconfig&#xA;  ;&#xA;  ; Tell the clients that there is a stateful DHCPv6 server available&#xA;  ipv6 nd managed-config-flag&#xA;&#xA;; Repeat this for every (sub)interface where you want to force clients to use DHCPv6.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also note: You need those RA packets. DHCPv6 only provides information, and optionally addresses. It does not provide a default gateway. That is done using RA. The idea here is that routers usually have better information on routing and gateways than DHCP servers, with the added benefit that you can have multiple routers on one subnet acting as default gateways with clients load balancing between them etc.&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="632" LastEditDate="2014-04-02T22:34:33.853" LastActivityDate="2014-04-02T22:34:33.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7160" PostTypeId="2" ParentId="7154" CreationDate="2014-04-02T12:55:19.507" Score="0" Body="&lt;p&gt;There is (was?) a bug in the Windows 2008 R2 DHCPv6 Server when using DHCP Relays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://support.microsoft.com/kb/972962&quot; rel=&quot;nofollow&quot; title=&quot;A DHCPv6 server that is running Windows Server 2008 may drop the DHCP relay-forwarded packets if these packets contain some unknown optionsA DHCPv6 server that is running Windows Server 2008 may drop the DHCP relay-forwarded packets if these packets contain some unknown optionsA DHCPv6 server that is running Windows Server 2008 may drop the DHCP relay-forwarded packets if these packets contain some unknown optionsA DHCPv6 server that is running Windows Server 2008 may drop the DHCP relay-forwarded packets if these packets contain some unknown options&quot;&gt;this Microsoft link&lt;/a&gt; for details (and a hotfix).&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="775" LastEditDate="2014-04-02T13:09:06.330" LastActivityDate="2014-04-02T13:09:06.330" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7161" PostTypeId="1" CreationDate="2014-04-02T15:49:41.930" Score="4" ViewCount="1646" Body="&lt;p&gt;I believe only way to configure VTP domain is by CLI.,&#xA;Anyway i heard when we configure trunk from a switch A(which is in VTP domain (say cisco))&#xA;to another switch B which dont belong to any VTP domain., the second switch automatically assigned to switch A (VTP domain)., is that so ? i cant find anywhere this.,&lt;/p&gt;&#xA;" OwnerUserId="5076" LastActivityDate="2014-04-02T21:37:39.730" Title="VTP domain name configuration" Tags="|vtp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7162" PostTypeId="2" ParentId="7161" CreationDate="2014-04-02T18:50:05.147" Score="9" Body="&lt;p&gt;This is correct!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Cisco implemented VTP, they left a &quot;null&quot; value for exactly this reason. If a VTP client or server with a null domain receives a VTP message with the domain populated, it will assume the domain of the received message and add applicable VLANs to its database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more information here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SXF/native/configuration/guide/swcg/vtp.pdf&quot;&gt;Catalyst 6500 Series Switch Cisco IOS Software Configuration Guide - Configuring VTP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5079" LastActivityDate="2014-04-02T18:50:05.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7163" PostTypeId="2" ParentId="7161" CreationDate="2014-04-02T18:51:29.910" Score="2" Body="&lt;p&gt;Its true. The 2nd switch will be assigned the domain from 1st switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick test to prove it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quick output: running-configs do not have the vtp configurations.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;Switch#show run&#xA;Building configuration...&#xA;.&#xA;.&#xA;.&#xA;hostname Switch&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;.&#xA;.&#xA;.&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;&#xA;Switch#show vtp status&#xA;VTP Version                     : 2&#xA;Configuration Revision          : 0&#xA;Maximum VLANs supported locally : 255&#xA;Number of existing VLANs        : 5&#xA;VTP Operating Mode              : Server&#xA;***VTP Domain Name                 : HK***&#xA;VTP Pruning Mode                : Disabled&#xA;VTP V2 Mode                     : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;MD5 digest                      : 0xC2 0x79 0x35 0xAE 0x48 0x96 0xB9 0xE0 &#xA;Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00&#xA;Local updater ID is 0.0.0.0 (no valid interface found)&#xA;Switch#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4962" LastEditorUserId="509" LastEditDate="2014-04-02T21:37:39.730" LastActivityDate="2014-04-02T21:37:39.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7164" PostTypeId="2" ParentId="7124" CreationDate="2014-04-02T19:29:31.903" Score="1" Body="&lt;p&gt;Had to do this troubleshooting just a few days ago on a 6500 that is in a remote part of the country. To drive there would have taken 3 days...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do it safely without further issues and crashing the router:&#xA;1. create an access list that specifies what you want to troubleshoot (i.e icmp) &#xA; conf t&#xA; access-list 101 permit icmp host a.b.c.d any&#xA; exit&#xA;2. in exec mode&#xA; debug ip packet 101 detail&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't forget to check your router&#xA; sh ip access-list 101&#xA; sh proc cpu history&#xA; sh proc cpu sorted 1m&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information on this page 388 out of the &quot;Troubleshooting IP Routing Protocols&quot; book:&#xA;&lt;a href=&quot;http://books.google.com.au/books?id=acUH-XvDFKMC&amp;amp;pg=PA388&amp;amp;lpg=PA388&amp;amp;dq=debug+ip+packet+101&amp;amp;source=bl&amp;amp;ots=9wwu2yf0Bv&amp;amp;sig=yDpMcEcTgkszQD5GuxGCtQDDD-s&amp;amp;hl=en&amp;amp;sa=X&amp;amp;ei=ymE8U-LVMJHMlAWC8YG4CA&amp;amp;ved=0CG8Q6AEwCQ#v=onepage&amp;amp;q=debug%20ip%20packet%20101&amp;amp;f=false&quot; rel=&quot;nofollow&quot;&gt;http://books.google.com.au/books?id=acUH-XvDFKMC&amp;amp;pg=PA388&amp;amp;lpg=PA388&amp;amp;dq=debug+ip+packet+101&amp;amp;source=bl&amp;amp;ots=9wwu2yf0Bv&amp;amp;sig=yDpMcEcTgkszQD5GuxGCtQDDD-s&amp;amp;hl=en&amp;amp;sa=X&amp;amp;ei=ymE8U-LVMJHMlAWC8YG4CA&amp;amp;ved=0CG8Q6AEwCQ#v=onepage&amp;amp;q=debug%20ip%20packet%20101&amp;amp;f=false&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2014-04-02T19:29:31.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7165" PostTypeId="1" AcceptedAnswerId="7169" CreationDate="2014-04-02T21:47:49.320" Score="8" ViewCount="2522" Body="&lt;p&gt;I am looking at upgrading our wireless infrastructure from 60+ SOHO access points to an Enterprise level solution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are currently testing &lt;code&gt;Ubiquity&lt;/code&gt; (have 12 in our most dense areas) and it seems to be doing exactly what we need it to do, but from all the research I have seen, people are suggesting controller based solutions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the main advantages for going controller based (such as &lt;code&gt;Aruba&lt;/code&gt;) versus non-controller/software based (such as &lt;code&gt;Ubiquity&lt;/code&gt;)? If all we need is one configuration file for the entire network, would the &lt;code&gt;Ubiquity&lt;/code&gt; access points be adequate or would we see a huge performance drop over something like &lt;code&gt;Aruba&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="5081" LastEditorUserId="630" LastEditDate="2014-04-30T16:38:09.140" LastActivityDate="2015-02-20T01:20:37.430" Title="Wireless Controller based vs Non-controller based" Tags="|wireless|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7166" PostTypeId="2" ParentId="7165" CreationDate="2014-04-02T22:27:02.340" Score="4" Body="&lt;p&gt;The often heard reason for wireless controllers is central management and accounting -- and the ability to inspect the traffic (read: enforce policy.) Ubiquity does something close to that with their UniFi system, but it's not a controller but more a management engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all you need are a fleet of &quot;zombie&quot; APs -- all clones that no one need mess with, then there's no reason to go with a controller based system. This is made even more true by the cost difference.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-04-02T22:27:02.340" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7169" PostTypeId="2" ParentId="7165" CreationDate="2014-04-03T03:30:14.483" Score="7" Body="&lt;p&gt;While controller appliances are still sold, there are a number of trends that are becoming popular, among these cloud based solutions and virtualized solutions.  While this is a bit off topic, there are also enterprise vendors looking at implementing SDN concepts in wireless...but that is another discussion and we have yet to see how that will play out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, vendors are pushing more of what has been controller based &quot;intelligence&quot; to the access point, including roaming and policy enforcement decisions.  This is largely a factor due to concerns about the potential bandwidth needs necessary to tunnel all the traffic from 802.11ac access points back to the controller.  While the implementation is specific to vendors, this typically takes the form of a &quot;control connection&quot; between the controller and AP, while the data is dropped off directly from the AP to the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even so, there will continue to be a need for some sort of &quot;controller&quot; functionality in some form.  For example, something to act as the NAS for 802.1X authentications.  It simply doesn't make sense to configure each access point as a RADIUS client on your RADIUS server to function as a NAS individually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No matter how the industry develops, no good enterprise class wireless system will exist without a management platform that will manage configurations, provide AP updates, and collect data to provide reporting and troubleshooting, so these aspects of controllers will also remain in some form.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You mention Aruba, but they also have non-controller based solutions, namely their &quot;Instant Access Point&quot; solution.  While a newer offering, this is an example of a move away from the controller appliance model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has acquired the Meraki cloud based solution to add to their product line.  Aerohive runs either in the cloud or as a virtual appliance (also sold as a hardware appliance if you like).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ubiquiti's solution provides a low entry point financially, but as with many things this comes at a cost even if it isn't in capital.  The software they provide does take care of a number of these important factors, but only to a degree as they are not as fully featured as other vendors products and doesn't have as many configuration options (which can be important in a deployment).  It also isn't nearly as polished a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not my intent to knock Ubiquiti, it is a decent product.  I have deployed it at several client sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, you need to look at the features and performance you need/want to find the solution that fits your needs and budget best.  There are many wireless vendors and only you can decide what is &quot;right&quot; for your organization.  I would recommend calling and talking to several vendors as they will be happy to demonstrate their features and even let you evaluate their products.  Keep in mind that they will all &quot;market&quot; their product as the best, so you will have to do some independent research to figure out which of their carefully selected feature highlights are mostly smoke and mirrors.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2015-02-20T01:20:37.430" LastActivityDate="2015-02-20T01:20:37.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7171" PostTypeId="1" AcceptedAnswerId="7179" CreationDate="2014-04-03T05:04:50.027" Score="6" ViewCount="25424" Body="&lt;p&gt;The HUB is managed at a data center with external IP 200.200.200.200.&#xA;There are 10 remote offices.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Office 9                                    HUB&#xA;10.1.9.0 - 100.100.100.100 -&amp;gt;&amp;gt;  VPN   &amp;lt;&amp;lt;- 200.200.200.200 - 10.1.1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In office 9 only,&#xA;after upgrading from ADSL to EFM and replaced Cisco 887 with Cisco 1812 (both running IOS 12.4).&#xA;Copied the config, replaced internet connection details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure if relevant, but there is also a router in bridge mode the EFM provider installed the 1812 connects through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the ISAKMP is connected&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MYCISCO#show crypto isakmp sa&#xA;IPv4 Crypto ISAKMP SA&#xA;dst              src              state          conn-id slot status&#xA;100.100.100.100  200.200.200.200  MM_NO_STATE       2262    0 ACTIVE (deleted)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But Phase 2 IPSEC SA will not come up. the logs produce errors:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;transform proposal not supported for identity&lt;/li&gt;&#xA;&lt;li&gt;IPSec policy invalidated proposal with error 256&lt;/li&gt;&#xA;&lt;li&gt;phase 2 SA policy not acceptable!&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;From show log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Apr  2 21:44:09.198: ISAKMP:(2125):Old State = IKE_QM_READY  New State = IKE_QM_READY&#xA;*Apr  2 21:44:12.246: ISAKMP (0:2125): received packet from 200.200.200.200 dport 500 sport 500 Global (I) QM_IDLE&#xA;*Apr  2 21:44:12.246: ISAKMP: set new node -505694825 to QM_IDLE&#xA;*Apr  2 21:44:12.246: crypto_engine: Decrypt IKE packet&#xA;*Apr  2 21:44:12.246: crypto_engine: Generate IKE hash&#xA;*Apr  2 21:44:12.246: ISAKMP:(2125): processing HASH payload. message ID = -505694825&#xA;*Apr  2 21:44:12.246: ISAKMP:(2125): processing SA payload. message ID = -505694825&#xA;*Apr  2 21:44:12.246: ISAKMP:(2125):Checking IPSec proposal 0&#xA;*Apr  2 21:44:12.246: ISAKMP: transform 0, ESP_AES&#xA;*Apr  2 21:44:12.246: ISAKMP:   attributes in transform:&#xA;*Apr  2 21:44:12.246: ISAKMP:      group is 5&#xA;*Apr  2 21:44:12.246: ISAKMP:      encaps is 1 (Tunnel)&#xA;*Apr  2 21:44:12.246: ISAKMP:      SA life type in seconds&#xA;*Apr  2 21:44:12.246: ISAKMP:      SA life duration (basic) of 28800&#xA;*Apr  2 21:44:12.246: ISAKMP:      authenticator is HMAC-SHA&#xA;*Apr  2 21:44:12.246: ISAKMP:      key length is 128&#xA;*Apr  2 21:44:12.246: CryptoEngine0: validate proposal&#xA;*Apr  2 21:44:12.246: ISAKMP:(2125):atts are acceptable.&#xA;*Apr  2 21:44:12.246: IPSEC(validate_proposal_request): proposal part #1&#xA;*Apr  2 21:44:12.246: IPSEC(validate_proposal_request): proposal part #1,&#xA;  (key eng. msg.) INBOUND local= 100.100.100.100, remote= 200.200.200.200,&#xA;    local_proxy= 10.1.9.0/255.255.255.0/0/0 (type=4),&#xA;    remote_proxy= 10.1.1.0/255.255.255.0/0/0 (type=4),&#xA;    protocol= ESP, transform= esp-aes esp-sha-hmac  (Tunnel),&#xA;    lifedur= 0s and 0kb,&#xA;    spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0&#xA;*Apr  2 21:44:12.246: Crypto mapdb : proxy_match&#xA;        src addr     : 10.1.9.0&#xA;        dst addr     : 10.1.1.0&#xA;        protocol     : 0&#xA;        src port     : 0&#xA;        dst port     : 0&#xA;*Apr  2 21:44:12.246: IPSEC(crypto_ipsec_process_proposal): transform proposal not supported for identity:&#xA;    {esp-aes esp-sha-hmac }&#xA;*Apr  2 21:44:12.246: ISAKMP:(2125): IPSec policy invalidated proposal with error 256&#xA;*Apr  2 21:44:12.246: ISAKMP:(2125): phase 2 SA policy not acceptable! (local 100.100.100.100 remote 200.200.200.200)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My Configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 12.4&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname MYCISCO&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;logging buffered 4096 debugging&#xA;no logging console&#xA;enable secret 5 XXXXXXXXXXXXXXXXXXXXXXXXXX&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login userauthen local&#xA;aaa authorization network groupauthor local&#xA;!&#xA;aaa session-id common&#xA;!&#xA;resource policy&#xA;!&#xA;clock timezone AEST 10&#xA;clock summer-time BST recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;no ip source-route&#xA;no ip gratuitous-arps&#xA;!&#xA;!&#xA;ip cef&#xA;no ip dhcp use vrf connected&#xA;ip dhcp excluded-address 10.1.9.1 10.1.9.99&#xA;!&#xA;ip dhcp pool VLAN1&#xA;   import all&#xA;   network 10.1.9.0 255.255.255.0&#xA;   default-router 10.1.9.254&#xA;   domain-name MYDOMAIN.COM&#xA;   dns-server 8.8.8.8&#xA;!&#xA;!&#xA;ip tcp path-mtu-discovery&#xA;no ip bootp server&#xA;no ip domain lookup&#xA;ip domain name MYDOMAIN.COM&#xA;ip name-server 8.8.8.8&#xA;!&#xA;password encryption aes&#xA;crypto pki token default removal timeout 0&#xA;!&#xA;!&#xA;!&#xA;no spanning-tree vlan 1&#xA;no spanning-tree vlan 2&#xA;username ADMINUSERNAME password 0 ADMINPASSWORD&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;crypto isakmp policy 3&#xA; encr aes&#xA; authentication pre-share&#xA; group 5&#xA; lifetime 3600&#xA;crypto isakmp key PRESHAREDKEY address 200.200.200.200 no-xauth&#xA;!&#xA;!&#xA;crypto ipsec transform-set myset esp-des esp-md5-hmac&#xA;crypto ipsec transform-set myset1 esp-des esp-md5-hmac&#xA;crypto ipsec transform-set myset2 esp-3des esp-md5-hmac&#xA;crypto ipsec transform-set myset3 esp-aes 256&#xA;crypto ipsec transform-set myset4 esp-aes 256 esp-md5-hmac&#xA;crypto ipsec transform-set myset5 esp-3des esp-sha-hmac&#xA;mode transport&#xA;!&#xA;crypto dynamic-map dynmap 10&#xA; set transform-set myset&#xA; reverse-route&#xA;!&#xA;!&#xA;crypto map clientmap client authentication list userauthen&#xA;crypto map clientmap isakmp authorization list groupauthor&#xA;crypto map clientmap client configuration address respond&#xA;crypto map clientmap 1 ipsec-isakmp&#xA; set peer 200.200.200.200&#xA; set security-association lifetime seconds 28800&#xA; set transform-set myset myset1 myset2 myset3 myset4 myset5&#xA; match address 110&#xA;crypto map clientmap 10 ipsec-isakmp dynamic dynmap&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 1&#xA; no shutdown&#xA;!&#xA;interface FastEthernet1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface BRI0&#xA; no ip address&#xA; encapsulation hdlc&#xA; shutdown&#xA;!&#xA;interface FastEthernet2&#xA;!&#xA;interface FastEthernet3&#xA;!&#xA;interface FastEthernet4&#xA;!&#xA;interface FastEthernet5&#xA;!&#xA;interface FastEthernet6&#xA;!&#xA;interface FastEthernet7&#xA;!&#xA;interface FastEthernet8&#xA;!&#xA;interface FastEthernet9&#xA;!&#xA;interface Vlan1&#xA; description Internal Network&#xA; ip address 10.1.9.254 255.255.255.0&#xA; ip verify unicast reverse-path&#xA; no ip redirects&#xA; no ip proxy-arp&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; load-interval 30&#xA;!&#xA;&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip mtu 1492&#xA; ip flow ingress&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA;&#xA;interface Dialer0&#xA;no ip redirects&#xA;no ip unreachables&#xA;no ip proxy-arp&#xA;&#xA; ip address negotiated&#xA; ip mtu 1492&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; encapsulation ppp&#xA; ip tcp adjust-mss 1452&#xA; dialer pool 1&#xA; ppp chap hostname CHAP@HOST.COM&#xA; ppp chap password 0 CHAPPASSWORD&#xA; ppp pap sent-username PAP@HOST.COM password 0 PAPPASSWORD&#xA; ppp ipcp dns request accept&#xA; crypto map clientmap&#xA;!&#xA;&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip nat inside source list 102 interface Dialer0 overload&#xA;ip route 0.0.0.0 0.0.0.0 Dialer0&#xA;!&#xA;access-list 1 remark IP Addresses Permitted to login via ssh and telnet&#xA;access-list 1 permit 200.200.200.200&#xA;access-list 1 permit 10.1.9.0 0.0.0.255&#xA;access-list 1 permit 10.1.1.0 0.0.0.255&#xA;access-list 1 deny   any&#xA;access-list 3 remark NTP Server addresses&#xA;access-list 3 permit X.X.X.X&#xA;access-list 4 remark Deny All&#xA;access-list 4 deny   any&#xA;access-list 102 remark NAT&#xA;access-list 102 deny   ip 10.1.9.0 0.0.0.255 10.1.1.0 0.0.0.255&#xA;access-list 102 permit ip 10.1.9.0 0.0.0.255 any&#xA;&#xA;access-list 110 remark VPN &#xA;access-list 110 permit ip 10.1.9.0 0.0.0.255 10.1.1.0 0.0.0.255&#xA;dialer-list 1 protocol ip permit&#xA;no cdp run&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; password CONPASSWORD&#xA;line aux 0&#xA; access-class 4 in&#xA;line vty 0 4&#xA; access-class 1 in&#xA; exec-timeout 500 0&#xA; privilege level 3&#xA; password VTYPASSWORD&#xA; transport input telnet ssh&#xA;!&#xA;scheduler max-task-time 5000&#xA;scheduler interval 500&#xA;ntp access-group peer 3&#xA;ntp access-group serve 4&#xA;ntp master&#xA;ntp server X.X.X.X&#xA;!&#xA;webvpn context Default_context&#xA; ssl authenticate verify all&#xA; !&#xA; no inservice&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm suspecting the Access List settings, but again this is identical to 9 other offices, and  the network support team who are providing the HUB end have taken a look and the settings are all correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your comments!&lt;/p&gt;&#xA;" OwnerUserId="5087" LastActivityDate="2014-04-03T11:58:54.720" Title="Cisco IPSEC VPN fail Stage 2" Tags="|cisco|vpn|ipsec|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7175" PostTypeId="1" AcceptedAnswerId="7177" CreationDate="2014-04-03T08:46:17.017" Score="5" ViewCount="41490" Body="&lt;p&gt;I have a cisco 1941 router just configured but no matter how I go about configuring the telnet, it seems not to work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has interfaces already set up and systems can browse through it in the office. It has two interfaces WAN and LAN configured with Ip Addresses and the LAN interface with other sub interfaces with IP address configured on them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried setting up the terminal with the command as stated below but it is not working.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)#line vty 0 ?&#xA;&amp;lt;1-1370&amp;gt; Last Line Number&#xA;Router(config-line)#line vty 0 1370&#xA;Router(config-line)# password P@$$W)RD&#xA;Router(config-line)# login&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I even tried using the following configuration but yet not working&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)#line vty 0 4&#xA;Router(config-line)# password P@$$W)RD&#xA;Router(config-line)# login&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everytime I try to connect to the any of the subinterfaces through telnet or the WAN address through telnet, I get the error message&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MacBook-Pro:~ User$ telnet x.x.x.x&#xA;Trying x.x.x.x...&#xA;telnet: connect to address x.x.x.1x Connection refused&#xA;telnet: Unable to connect to remote host&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please what am I getting wrong here?&lt;/p&gt;&#xA;" OwnerUserId="3869" LastActivityDate="2023-12-01T10:38:49.637" Title="Cisco Router Telnet Connection Refused" Tags="|cisco|router|cisco-ios|cisco-commands|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7177" PostTypeId="2" ParentId="7175" CreationDate="2014-04-03T10:25:28.043" Score="8" Body="&lt;p&gt;The issue has been resolved. When I checked the running configuration on the router, I noticed I have the line below under the line vty 0 4&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list class 23 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All I had to do was to negate the command and everything went back to normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks all for your support.&lt;/p&gt;&#xA;" OwnerUserId="3869" LastActivityDate="2014-04-03T10:25:28.043" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7179" PostTypeId="2" ParentId="7171" CreationDate="2014-04-03T11:58:54.720" Score="6" Body="&lt;p&gt;Access lists aren't a problem here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output from show cypro isakmp sa tells you that the key negotiation is failing (MM_NO_STATE).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The log entry says that the hub wants to use a transform set (esp-aes, esp-sha-hmac) that you don't support.  None of the transform sets on your router include esp-aes, esp-sha-hmac.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest you add that to your list of transforms.  While you're at it, unless you really need the others (myset1-5), you might as well take them out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your new set will be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec transform-set mynewset esp-aes esp-sha-hmac&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-04-03T11:58:54.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7181" PostTypeId="1" AcceptedAnswerId="7183" CreationDate="2014-04-03T12:48:52.340" Score="10" ViewCount="41070" Body="&lt;p&gt;This question is a repost of the &lt;a href=&quot;https://learningnetwork.cisco.com/thread/7265&quot; rel=&quot;noreferrer&quot;&gt;same question&lt;/a&gt; in &lt;a href=&quot;https://learningnetwork.cisco.com/&quot; rel=&quot;noreferrer&quot;&gt;The Cisco Learning Network&lt;/a&gt;; however, the answers are unique to Stack Exchange.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I have always accepted that the defualt priority value of STP (802.1d) is 32768 (32768 + sys-id-ext x) as show in &quot;show spanning-tree&quot; below -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW3#show spanning-tree &#xA;VLAN0001&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    24577&#xA;             Address     00D0.D3E6.9838&#xA;             Cost        19&#xA;             Port        1(FastEthernet0/1)&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)&#xA;             Address     00D0.BCB5.B556&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  20&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Fa0/8            Desg FWD 19        128.8    P2p&#xA;Fa0/1            Root FWD 19        128.1    P2p&#xA;Fa0/24           Altn BLK 19        128.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SW3#&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when I want to configure priority I don't undertand WHY the priority must be in increments of 4096 ?&#xA;Is there a specific reason for the default value of both of these numbers?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW3(config)#spanning-tree vlan 1 priority ?&#xA;  &amp;lt;0-61440&amp;gt;  bridge priority in increments of 4096&#xA;SW3(config)#spanning-tree vlan 1 priority&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="775" LastEditDate="2014-06-15T02:59:07.103" LastActivityDate="2014-06-15T02:59:07.103" Title="Spanning tree Default Priority Values" Tags="|switch|spanning-tree|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7182" PostTypeId="2" ParentId="7181" CreationDate="2014-04-03T13:18:01.903" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://communitystring.com/2008/07/why-the-stp-bridge-priority-must-be-a-multiple-of-4096/&quot; rel=&quot;nofollow&quot;&gt;This article&lt;/a&gt; provides some good information regarding this.  Basically this is due the extended vLAN headers length; 12 bits allowing support for 4096 vLANS and only 4 bits for the priority.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The 12 bits of extra VLAN information allows support for 4096 VLANs, so there is full support for extended range VLANs. Therefore because of the use of the Extended System ID in the Bridge ID, there is only the first 4 bits of the original 2 byte number to be used for the bridge priority so it only allows multiplies of 4096.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4006" LastActivityDate="2014-04-03T13:18:01.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7183" PostTypeId="2" ParentId="7181" CreationDate="2014-04-03T13:25:17.280" Score="17" Body="&lt;p&gt;In the spanning tree algorithm the process of determining the root bridge is based on the bridge priority (BID).&lt;/p&gt;&#xA;&lt;p&gt;When there were no VLANs (meaning that switches had to deal with only one broadcast domain) the BID was equal to:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Bridge priority - MAC Address&#xA;   &amp;lt;2 bytes&amp;gt;       &amp;lt;6 bytes&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As Network administrators we can modify the &lt;strong&gt;bridge priority&lt;/strong&gt; value.&lt;/p&gt;&#xA;&lt;p&gt;When VLANs were introduced the needing of differentiating the STP protocol raised (Per VLAN Spanning Tree - PVST).&lt;/p&gt;&#xA;&lt;p&gt;To accomplish this the bridge priority value was modified as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Bridge priority - Exstended system ID (VLAN ID)&#xA;     4 bit      -           12 bit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;We are still able to modify the bridge priority but this means to operate to the 4th most significative bit over 16 bits.&lt;/p&gt;&#xA;&lt;p&gt;To put it simple:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Legend : C= changeable ; U= unchangeable&lt;/p&gt;&#xA;&lt;p&gt;CCCCUUUUUUUUUUUU 16 bits&lt;/p&gt;&#xA;&lt;p&gt;0001UUUUUUUUUUUU 1*2^12 = 4096&lt;/p&gt;&#xA;&lt;p&gt;0111UUUUUUUUUUUU Default: 32768&lt;/p&gt;&#xA;&lt;p&gt;0111000000000001 Default for VLAN 1: 32769&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-04-06T10:42:58.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7187" PostTypeId="1" AcceptedAnswerId="19597" CreationDate="2014-04-03T16:20:39.477" Score="4" ViewCount="11486" Body="&lt;p&gt;Will lowering the carrier-delay on an interface configuration interfere with using BFD on the same interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I configure &lt;code&gt;carrier-delay msec 0&lt;/code&gt; on an Ethernet interface the RIB is automatically notified of the physical link down event. In a scenario where the physical link doesn't go down but communications are not traversing the link (3rd party DWDM lamda for example) BFD would detect this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there dangers to using a low carrier delay value with BFD, or is it recommended? Or will one simply superseed the other from a configuration perspective?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would be using them in conjunction with interaface dampening and &lt;code&gt;ip routing protocol purge interface&lt;/code&gt; in global configuration.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2014-04-07T09:51:21.593" LastActivityDate="2015-07-01T09:28:25.190" Title="Cisco: Using carrier-delay with BFD on the same interface" Tags="|cisco|bfd|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="7188" PostTypeId="2" ParentId="6816" CreationDate="2014-04-03T16:52:05.793" Score="3" Body="&lt;p&gt;The FortiGate doesn't care which protocol is running over the port 443, so you just need to create a policy and select the corresponding interfaces/addresses and as service you can select HTTPS. If it's a policy from internal network to WAN, be sure to select NAT also&lt;/p&gt;&#xA;" OwnerUserId="30816" LastActivityDate="2014-04-03T16:52:05.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7190" PostTypeId="1" AcceptedAnswerId="7192" CreationDate="2014-04-03T19:20:05.257" Score="2" ViewCount="412" Body="&lt;p&gt;I am trying to understand this behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an EIGRP router that receives eigrp external route (redistributed from BGP). Lets says 192.168.100.0/24. This route gets advertised further to other eigrp neighbors. However, if I add a static route entry for the same destination, there is no more an advertisement to its neighbors via eigrp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One possible explanation is that EIGRP behaves as a distant vector as well. is this the distance vector behavior i.e., it builds the routing table and than forwards the advertisement based on the route in the routing table? I thought only RIP did that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="4962" LastActivityDate="2014-04-03T21:26:17.020" Title="EIGRP advertisement suppressed with static entry" Tags="|cisco|routing|eigrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7192" PostTypeId="2" ParentId="7190" CreationDate="2014-04-03T21:26:17.020" Score="3" Body="&lt;p&gt;EIGRP is a distance vector routing protocol. It has some advanced features but at the end of the day it's still distance vector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While you may have multiple routes in the RIB only the best one gets advertised to your neighbors. EIGRP only advertises routes that are in the RIB as EIGRP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you add the static route, it has better AD than the EIGRP route so EIGRP stops advertising the route. You could of course redistribute the static into EIGRP if you want to.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-04-03T21:26:17.020" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7193" PostTypeId="2" ParentId="7181" CreationDate="2014-04-03T21:35:09.183" Score="9" Body="&lt;p&gt;The bridge ID is an 8-Byte (64 bit) value composed of the following elements:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The bridge priority value and the system ID extension together make up a 16 bit (2-byte) value. The bridge priority value, making up the left most bits, is a value of 0 to 61440. The extended system ID is a value of 1 to 4095 corresponding to the respective VLAN participating in STP. The bridge priority value increments in blocks of 4096 to allow the system ID extension to squeeze in between each increment. By default, Cisco’s Per-VLAN Spanning-Tree plus (PVST+) adds this system ID extension (sys-id-ext) to the bridge priority.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8SAiE.png&quot; alt=&quot;bridge priority and sys-id-ext&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The 48 bit (6-byte) MAC address of a switch is used in conjunction with the bridge priority value and the system ID extension as criteria for the root bridge election. If the bridge priority value and the system ID extension are identical on two or more switches, the lowest 48-bit MAC address is then used as a tie breaker.&#xA;These values together make up the cohesive Bridge Identifier used to elect the root bridge. The following Wireshark packet capture of a BPDU illustrates these values. The bridge priority and system ID extension are the 16-bit hexadecimal value 80 01 (to the left of the MAC address) below representing the bridge priority value of 32768 and a system ID extension of 1 (VLAN 1).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yjaDw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This and the basics of the STP root election process can be found on my &lt;a href=&quot;http://networkincluded.com/2013/03/26/spanning-trees-root-bridge-election/&quot; rel=&quot;noreferrer&quot;&gt;blog&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2476" LastActivityDate="2014-04-03T21:35:09.183" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7194" PostTypeId="1" AcceptedAnswerId="7195" CreationDate="2014-04-03T22:52:53.333" Score="5" ViewCount="989" Body="&lt;p&gt;We have a redundant path for some of our communications through &#xA;a.) a Metro-E provider and&#xA;b.) two routers forming an L2TPV3 tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have Cisco 2960 switches at both ends running RSTP to prevent switching loops and prefer (through costing) our L2TPV3 link over the Metro-E link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Twice now we've experienced switching loops that took down the network until one link was unplugged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will a switch bring an RSTP alt port back up if it quits receiving BPDUs on that port without seeing a physical link change on either port?  Our logs reflect no physical link loss on any ports.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-04-03T23:28:16.160" Title="What happens when you stop receiving BPDUs with no L1 loss?" Tags="|spanning-tree|switching|metro-ethernet|loop|l2tp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7195" PostTypeId="2" ParentId="7194" CreationDate="2014-04-03T23:28:16.160" Score="5" Body="&lt;p&gt;You should turn loop guard on those ports... if rstp blocks a port and looses bpdus, it will unblock and form an unmanaged loop unless stp loopguard is on the port.   If an rstp port looses bpdus on a loopguard port, the port will disable in a loop  inconsistent state until it starts receiving bpdus again.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-04-03T23:28:16.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7201" PostTypeId="1" AcceptedAnswerId="7205" CreationDate="2014-04-04T15:12:39.180" Score="7" ViewCount="1322" Body="&lt;p&gt;&lt;strong&gt;When running BFD on interfaces between two directly connected iBGP and IGP neighbours, is it more stable/reliable to use BFD for fast IGP reaction times and BGP Next Hop Tracking for faster BGP reaction times (rather than BFD for both)?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I ask this is that if BFD is used for IGP and BGP link failure notification, an interface that goes down causes the BGP session to be torn down the IGP to run SPF. If the IGP runs SPF and completes in 200ms for example using a tuned IGP deployment, reachability to that iBGP neighbour may be restored and so the iBGP session could have remained.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm suggesting the following (because this is how I am interpeting the Cisco docs);&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a link goes down BFD signals this to the IGP and the IGP will recompute a new path to the iBGP neighbour (assuming no ECMP or Un-ECMP or IP Fast Re-Route becasue in those scenarios a link failure will not disrupt the iBGP session I believe?). In this scenario when a new path is computed by the IGP the iBGP peering continues without interuption. When it can't be computed (no other path is available) setting a lower NHT value like &lt;code&gt;bgp nexthop trigger delay 1&lt;/code&gt; to match the fast IGP convergence would trigger the BGP session to be torn down now that there is definately no path to the iBGP neighbour. So does it make sense to not use BFD for iBGP neigbors and use BGP NHT instead?&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2014-04-07T10:17:44.350" LastActivityDate="2014-04-07T10:17:44.350" Title="Cisco: Reliable fast BGP failover when mixing BGP NHT and BFD" Tags="|cisco|bgp|bfd|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7203" PostTypeId="1" CreationDate="2014-04-04T17:28:34.943" Score="2" ViewCount="23270" Body="&lt;p&gt;I have One Mikrotik router running router OS v6.1. I have One ISP connected to it but i recently got another ISP as backup. I want to connect the second ISP to the router in such a way that if the first ISP fails, the second one will kick in immediately. The link from both ISPs are ethernet links&gt; Does anybody have any idea how to do this ?.&lt;/p&gt;&#xA;" OwnerUserId="4439" LastEditorUserId="8499" LastEditDate="2018-02-14T16:38:05.440" LastActivityDate="2018-02-14T16:38:05.440" Title="How to Setup two ISPs on One Mikrotik Router" Tags="|isp|" AnswerCount="2" CommentCount="3" ClosedDate="2017-08-09T23:58:26.500" ContentLicense="CC BY-SA 3.0" />
  <row Id="7205" PostTypeId="2" ParentId="7201" CreationDate="2014-04-04T23:24:32.397" Score="7" Body="&lt;p&gt;Well, actually BGP NHT &lt;strong&gt;can&lt;/strong&gt; use BFD to speed up neighbor problems detection, and it's usually the best scaling mechanism, because BFD is often offloaded in hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running BFD for both IGP and BGP may be good idea, depending on the scaling capabilities of your gear and hardware acceleration/offload. It's the configuration that has to make sense from logical standpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, your decision boils down to this: if you wish to tune both IGP and EGP protocols to try tu run at the same time (&lt;code&gt;bgp nexthop trigger delay 0&lt;/code&gt; and BGP BFD NHT), which may lead to problems, oscillations and so on, or you'd like to focus on achieving fast IGP convergence and with presence of multiple forwarding paths, let BGP linger a moment longer just to make sure your IGP converges (&lt;code&gt;bgp nexthop trigger delay 1&lt;/code&gt; with or without BGP BFD NHT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That last approach usually makes more sense, and that's why NHT delay by default is set to 5 seconds. If your IGP converges in 200ms (or generally, under second) tuning BGP NHT to 1 second may make sense. &lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-04-04T23:24:32.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7207" PostTypeId="1" AcceptedAnswerId="7209" CreationDate="2014-04-05T07:58:52.257" Score="14" ViewCount="2291" Body="&lt;p&gt;BGP doesn't use TCP keepalive, it uses its own keepalive mechanism. My question is why can't bgp turn-on the SO_KEEPaLIVE of TCP and live happily? why does it not use tcp keepalive and implement its own keepalive ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastActivityDate="2014-04-05T10:49:59.637" Title="Why BGP implements its own keepalive instead of using tcp keepalive?" Tags="|bgp|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7208" PostTypeId="1" AcceptedAnswerId="7216" CreationDate="2014-04-05T08:14:57.053" Score="7" ViewCount="2716" Body="&lt;p&gt;BGP message length in of 2 bytes. So why can't the max bgp message size be 65535 ? why is it 4096 ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastActivityDate="2018-03-15T13:10:31.773" Title="Why BGP max message size is choosen as 4096 ? why not 2^16?" Tags="|bgp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7209" PostTypeId="2" ParentId="7207" CreationDate="2014-04-05T08:34:46.327" Score="19" Body="&lt;p&gt;TCP &amp;quot;keepalive&amp;quot; is a feature that is not present on all operating systems. It is not in the TCP standard itself and it's not reliable. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122&quot; rel=&quot;nofollow noreferrer&quot;&gt;RC1122&lt;/a&gt; specifes it, but explicitly states:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Implementors MAY include &amp;quot;keep-alives&amp;quot; in their TCP&#xA;implementations, although this practice is not universally&#xA;accepted.  If keep-alives are included, the application MUST&#xA;be able to turn them on or off for each TCP connection, and&#xA;they MUST default to off.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Even more important:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;It is extremely important to remember that ACK segments that&#xA;contain no data are not reliably transmitted by TCP.&#xA;Consequently, if a keep-alive mechanism is implemented it&#xA;MUST NOT interpret failure to respond to any specific probe&#xA;as a dead connection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;TCP keepalive uses the TCP protocol in a special way, sending a duplicate ACK with no data attached to it. Thing is: You can't count on it being available. Also some firewalls filter TCP keepalives.&lt;/p&gt;&#xA;&lt;p&gt;For BGP to function correctly you need a way to implement specific timers for keepalive (how often do we send a message) and hold (after which time do we declare a peer to be non-responsive) that are &lt;strong&gt;reliably&lt;/strong&gt; sent. So BGP is using it's own keepalive message which is not a lot of overhead (19 bytes) compared to TCP keepalive.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-04-05T10:49:59.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7210" PostTypeId="1" CreationDate="2014-04-05T10:40:36.783" Score="6" ViewCount="3817" Body="&lt;p&gt;Why are OSPF neighbors manually configured on NBMA networks even when you enabled it with the &lt;code&gt;broadcast&lt;/code&gt; keyword in frame map statements?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example is NBMA point-to-multipoint access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="5115" LastEditorUserId="3191" LastEditDate="2014-04-05T11:06:13.803" LastActivityDate="2014-04-05T14:29:20.160" Title="OSPF manual neighbor configuration requirement on NBMA network" Tags="|routing|ospf|frame-relay|broadcast|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7211" PostTypeId="2" ParentId="7210" CreationDate="2014-04-05T10:58:10.983" Score="7" Body="&lt;p&gt;Frame relay does not support real broadcast, it uses pseudo broadcast, meaning that it replicates incoming multicast/broadcast to all DLCIs that have the broadcast keyword on the frame-relay map statements. DLCIs learned via inverse ARP will always have broadcast enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you choose the network type you tell OSPF how to behave, is DR/BDR used and is multicast used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With non-broadcast or point-to-multipoint non-broadcast (Cisco specific) you need to define neighbor statements. The reason being that you have told OSPF that you have no broadcast capability so you want to use unicast for the control plane traffic. OSPF therefore expects that you configure neighbor statements before it starts sending hellos.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've had a few facepalm moments in the past studying for the CCIE where I did enable non-broadcast and no adjacencies were coming up. Debugs showed no hellos going out which is usually a sign you forgot a neighbor statement or are running passive-interface.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-04-05T10:58:10.983" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7212" PostTypeId="1" AcceptedAnswerId="7270" CreationDate="2014-04-05T14:28:25.773" Score="5" ViewCount="2810" Body="&lt;p&gt;We are thinking about redesigning our network. The topology is a star and is comprised of several similar POPs. The entire network is based on Cisco devices. The core router is a Cisco 7600 and two 4900 distribution switches. On each POP, we have an access switch, which is a ME3400 (L3 capable) and CMTS 7200 with a NPE-G2 Processor Card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/z4fwO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z4fwO.png&quot; alt=&quot;Network Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 7200s are connected by trunks to the core router (don't like it) and Load-balance is done in L3 by OSPF (one area). I can't implement multiple area OSPF because the CPE public subnets are too difficult to summarize and the public range is split over several POPs without hierarchy, so this would be inefficient. The actual design was done several years ago when EtherChannel was uncommon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, I've been thinking:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Implementation of EtherChannel between the access switches and CMTS.   &lt;/li&gt;&#xA;&lt;li&gt;Implementation of a L3 boundary between core network and POP. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've not found a solution for the redundancy on the core beside L3 OSPF. Suggestion are welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also been thinking about changing the public interconnection IP to private ones, due to security concern.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit 1 - Additional Info&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There are 8 PoPs and we don't plan to expand any further than 15. &lt;/li&gt;&#xA;&lt;li&gt;We have split a public subnet range of /19 over the PoPs without caring about summarization or hierarchy. Our criteria to split and provide subnet is the number of end-CPE. For example, if a PoP is estimated with 1500 CPE connected we allocate 2048 public address. Due to the growth, we didn't make contiguous distribution so we have several small ranges over the PoP. Some PoPs have a 700 CPE and we provide 4 range non-contiguous subnets. Smooth migration is a hot-topic because we are on production so the change of one PoP shouldn't affect the other.&lt;/li&gt;&#xA;&lt;li&gt;No firewall filtering is planned on the feed - we reach 3Gb of traffic but some ACL to restrict access to our internal infrastructure is on analysis.&lt;/li&gt;&#xA;&lt;li&gt;We are connected through BGP to our ISP and we have a fail-over link with a partner. Here the change/modification are only intend to our core network, I'm not focused to perform any change on this part.  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Edit 2 - IOS on device&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Core Router : Cisco CISCO7604 - c7600rsp72043_rp Software (c7600rsp72043_rp-IPSERVICESK9-M), Version 12.2(33)SRE3   &lt;/li&gt;&#xA;&lt;li&gt;Distribuition Switch :  cisco WS-C4900M - Catalyst 4500 L3 Switch Software (cat4500e-IPBASEK9-M), Version 15.0(2)SG2&lt;/li&gt;&#xA;&lt;li&gt;Access Switch : cisco ME-3400G-12CS-A - ME340x Software (ME340x-METROIPACCESSK9-M), Version 12.2(60)EZ3&lt;/li&gt;&#xA;&lt;li&gt;CMTS 7200 NPE-G2 : cisco uBR7225VXR - 7200 Software (UBR7200P-JK9SU2-M), Version 12.2(33)SCG5 (soon to be upgraded to SCG6)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Edit 3 - Improve Topology Picture&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I change the picture to improve the understanding of our network. We have a joint venture with a company where we provide each other Core Redundancy as showed in the image. In normal operation, we have only 1 ISP but if our core router go down we have the redundant feed through our partner. I add on picture the type of subnet and distribution, we can find on CPE side.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your suggestions and advice. &lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="775" LastEditDate="2014-04-08T09:52:44.677" LastActivityDate="2014-04-11T11:22:44.493" Title="Network Design Improvement Advice" Tags="|cisco|ospf|spanning-tree|design|service-provider|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="7213" PostTypeId="2" ParentId="7210" CreationDate="2014-04-05T14:29:20.160" Score="0" Body="&lt;p&gt;This network type is used on networks that have no broadcast/multicast capability, such as frame-relay, ATM, SMDS, &amp;amp; X.25. The key point is that these layer 2 protocols are unable to send broadcasts/multicasts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key thing to remember is that the neighbor command is restricted to the DR &amp;amp; BDR only . The neighbor command allows the router to send hello’s to those specific neighbors. Those messages are sent as unicast messages. The reason the neighbor command is only required on one side between neighbors, is because hello’s are sent if hellos are received. Hello’s are sent every 30 seconds by default, on this network type, or upon receiving an hello packet. So therefore, hello’s will be able to be exchanged between the two neighbors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quick Facts&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;All OSPF packets are sent unicast to each neighbor&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Default timers are Hello 30 secs, Dead 120 secs&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DR/BDR election occurs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DR/BDR must be connected to all other routers&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Neighbor statements must be manually configured on the DR/BDR routers&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Typical in a full mesh network, although it can be used in a hub and spoke design&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4289" LastActivityDate="2014-04-05T14:29:20.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7214" PostTypeId="1" AcceptedAnswerId="7218" CreationDate="2014-04-05T17:18:27.530" Score="3" ViewCount="188" Body="&lt;p&gt;A node which uses an on-demand routing protocol in a mobile ad hoc network when requires to send a packet to another node which is not in the radio coverage range, would do it by initiating a route request flooding process. Route Request flooding is the process of broadcasting a route request packet to all the neighbor nodes. The neighbor nodes in turn rebroadcast to their neighbors unless they have a fresh route to the destination node or they have already seen the packet before. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My doubt is when any node which possesses a valid route to the destination replies with a route reply packet to the source, how would the other nodes get informed that the source has got the route and the broadcast of route request packet can be stopped. &lt;/p&gt;&#xA;" OwnerUserId="5118" LastActivityDate="2016-01-30T05:55:25.477" Title="How to inform nodes in MANET during route discovery process regarding the receivng of route reply packet by the source" Tags="|ad-hoc-wireless|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7215" PostTypeId="2" ParentId="7208" CreationDate="2014-04-05T19:09:46.120" Score="0" Body="&lt;p&gt;Because &lt;a href=&quot;http://www.ietf.org/rfc/rfc4271.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4271&lt;/a&gt; says so? The limit was present in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1267&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP 3&lt;/a&gt; as well. Given the small internet at the time when BGP was created on legendary napkin, I'd say it was choosen exactly the way number of bits in IPv4 was.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2014-04-05T19:09:46.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7216" PostTypeId="2" ParentId="7208" CreationDate="2014-04-05T19:10:03.080" Score="14" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;BGP message length in of 2 bytes. So why can't the max bgp message size be 65535? why is it 4096?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;Official Answer&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ietf.org/mail-archive/web/idr/current/msg02404.html&quot; rel=&quot;noreferrer&quot;&gt;Quoting Tony Li&lt;/a&gt; when he responded to this question on the &lt;a href=&quot;http://www.ietf.org/mail-archive/web/idr/current/maillist.html&quot; rel=&quot;noreferrer&quot;&gt;IDR List&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1a) Having a fixed size is good because it makes the protocol implementations easy. There is no point to having complexity in an implementation if it provides no benefit. Large messages don't provide a wonderful benefit, as they need to be large enough to carry the path attributes and associated prefixes. For this purpose 4k is probably adequate to date.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;1b) Historically, 4k was considered a bit wasteful. Of course, it was wonderfully simple compared to EGP which used fragmented packets. Care to parse a 16k jumbo-gram? Care to debug that? Trust me, it's not fun.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2) The 4k message size is &lt;em&gt;completely independent&lt;/em&gt; of the TCP window size. An implementation is perfectly free to compose any number of messages, each of which is within the 4k limit. The implementation can then cram any number of messages into its TCP socket, up to the buffering limits of that TCP.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2a) Thus, the message size is &lt;em&gt;NOT&lt;/em&gt; performance limiting, except when an implementation could actually overfill a message. Folks maintaining current implementations might chime in here as to whether or not they see this.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;So, in summary, yes, a 4k message size limit is a fine situation &lt;em&gt;for BGP&lt;/em&gt;, for the way that it behaves and the job that it does. This does &lt;em&gt;NOT&lt;/em&gt; necessarily generalize to other protocols, (e.g. OSPF) where 4k exceeds the most common MTUs. In those cases, you'd end up with fragmentation, and that's bad.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;Other thoughts&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;65536 / 4096 = 16&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do we really want BGP's transient RAM requirements to multiply by 16?  Remember that under the covers, many BGP implementations are written in C, which means BGP could need to &lt;a href=&quot;http://man7.org/linux/man-pages/man3/malloc.3.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;malloc&lt;/code&gt;&lt;/a&gt; space for every message to the maximum message size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obligatory rhetorical questions...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why do we have any variable size limits in software?&lt;/li&gt;&#xA;&lt;li&gt;Why isn't every C integer a &lt;a href=&quot;https://stackoverflow.com/questions/2127473/what-kind-of-data-type-is-long-long#comment2066192_2127478&quot;&gt;&lt;code&gt;long long&lt;/code&gt;&lt;/a&gt;?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Let's assume we have 100,000 BGP prefixes with 15,000 unique attribute combinations; let's also assume our BGP implementation packs the prefixes into &lt;code&gt;BGP UPDATE&lt;/code&gt; messages with 100% efficiency.  Therefore we need 15,000 &lt;code&gt;BGP UPDATE&lt;/code&gt; messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;15000 messages * 4096 bytes/message = 58MB of aggregate BGP message buffering used&lt;/p&gt;&#xA;&#xA;&lt;p&gt;15000 messages * 65536 bytes/message = 937MB of aggregate BGP message buffering used&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2018-03-15T13:10:31.773" LastActivityDate="2018-03-15T13:10:31.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7218" PostTypeId="2" ParentId="7214" CreationDate="2014-04-05T21:41:26.917" Score="1" Body="&lt;p&gt;From &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-manet-dsr-00#section-4.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Dynamic Source Routing Protocol for Mobile Ad Hoc Networks&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;As a node overhears routes being used by others, either by&lt;br /&gt;&#xA;promiscuously snooping on them or when forwarding packets, the node&lt;br /&gt;&#xA;MAY insert those routes into its Route Cache, leveraging the Route&lt;br /&gt;&#xA;Discovery operations of the other nodes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2014-04-05T21:41:26.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7219" PostTypeId="1" AcceptedAnswerId="7222" CreationDate="2014-04-06T05:07:29.930" Score="4" ViewCount="4579" Body="&lt;p&gt;I have an Cisco AP 1242AG autonomous AP connected to L2 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I have 100 wired devices each sending 2 broadcast UDP packets per second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously these packets will reach the Access Point switch port, but will the AP actually send these packets (200 pps) into the air?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="5123" LastActivityDate="2014-04-06T09:14:20.030" Title="How does an Access Point handle broadcast packets from the wired side?" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7220" PostTypeId="1" AcceptedAnswerId="7221" CreationDate="2014-04-06T08:06:25.140" Score="9" ViewCount="6611" Body="&lt;p&gt;I'm reviewing old Cisco modules, and in CCNA 2, Module 2.5.1.2, it states,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Under certain conditions, the network administrator will not want to configure the static route with an exit interface but with the next-hop IP address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Why would you prefer routes with a next-hop IP address instead of an exit interface?&lt;/p&gt;&#xA;" OwnerDisplayName="user3046" LastEditorDisplayName="user3046" LastEditDate="2016-03-17T00:09:54.160" LastActivityDate="2016-03-17T00:09:54.160" Title="Static routes: numerical next-hop vs interface" Tags="|cisco|routing|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7221" PostTypeId="2" ParentId="7220" CreationDate="2014-04-06T08:12:24.910" Score="10" Body="&lt;p&gt;If you point a static route to a broadcast interface, the route is inserted into the routing table only when the broadcast interface is up. This configuration is not recommended because when the next hop of a static route points to an interface, the router considers each of the hosts within the range of the route to be directly connected through that interface. For example, &lt;code&gt;ip route 0.0.0.0 0.0.0.0 Ethernet0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this type of configuration, a router performs Address Resolution Protocol (ARP) on the Ethernet for every destination the router finds through the default route because the router considers all of these destinations as directly connected to Ethernet 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This kind of default route, especially if it is used by a lot of packets to many different destination subnets, can cause high processor utilization and a very large ARP cache (along with attendant memory allocation failures).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifying a numerical next hop on a directly connected interface prevents the router from performing ARP or each destination address. However, if the interface with the next hop goes down and the numerical next hop is reachable through a recursive route, you should specify both the next hop IP address and the interface through which the next hop should be found. For example, &lt;code&gt;ip route 0.0.0.0 0.0.0.0 Serial 3/3 192.168.20.1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Excerpt from &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/27082-ip-static-routes.html&quot;&gt;Specifying a Next Hop IP Address for Static Routes&lt;/a&gt; at cisco.com&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2014-04-06T08:12:24.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7222" PostTypeId="2" ParentId="7219" CreationDate="2014-04-06T09:14:20.030" Score="6" Body="&lt;p&gt;(non-cisco specific answer)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, unless you disable it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The broadcast frames will be sent at the multicast base rate, which is typically low (1 Mbps most of the time), and only every DTIM * beacom interval if there are powersaving stations. And the packet loss rate for those will be quite high.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if there are no clients associated to the AP, then the AP will typically be smart and not send them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;200 broadcast packets per second, assuming a 8192 bit packet size and a 1 mbps multicast rate, will just Not Work, since the multicast traffic will be more than 1 mbps, and the AP will typically allocate much less capacity and buffers for broadcast, so the limit is actually much less than 1 mbps.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Anyway, broadcast is so 1990, if you can use multicast instead, and enable MLD/IGMP snooping on the AP, then the AP may be smarter and only deliver the multicast frames if clients actually subscribe to the multicast address. And depending on the client capabilities and the AP configuration, the multicast frames may even be sent as unicast, at higher data rates and with less packet loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 has no broadcast anyway.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2014-04-06T09:14:20.030" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7224" PostTypeId="1" AcceptedAnswerId="7225" CreationDate="2014-04-06T11:52:13.763" Score="1" ViewCount="2236" Body="&lt;p&gt;I am studying about ICMP procotol and the ping program that uses ICMP messages. But I am not sure which ICMP messages are exactly used by the ping program&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo reply&#xA;echo request&#xA;time exceeded - TTL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I am not sure if &lt;code&gt;destination unreachable&lt;/code&gt; is used, or any other ICMP message&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="5128" LastActivityDate="2014-04-06T12:34:51.960" Title="ICMP messages used by ping" Tags="|ping|icmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7225" PostTypeId="2" ParentId="7224" CreationDate="2014-04-06T12:34:51.960" Score="2" Body="&lt;p&gt;If issuing the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping 8.8.8.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the local device generates an ICMP Echo (Type 8, code 0) which is sent outbound. The device then waits to receive an ICMP Echo Reply (Type 0, code 0).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the packets TTL expires before reaching its destination, then an ICMP Time Exceeded (Type 11, code 0) packet is sent to the originator of the ICMP Echo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using Traceroute and the ICMP packet reaches the final destination, normally a ICMP Port Unreachable (Type 3, code 3) will be sent back towards the source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a device in the forwarding path does not know how to route towards the destination it will send an ICMP Net Unreachable (Type 3, code 0). This is true no matter what kind of packet was sent from the beginning, ICMP or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that many administrators filter ICMP (often on lacking knowledge) so that ICMP packets may not be received back.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-04-06T12:34:51.960" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7230" PostTypeId="1" AcceptedAnswerId="7232" CreationDate="2014-04-06T19:23:31.803" Score="5" ViewCount="5761" Body="&lt;p&gt;Again, I'm continuing a review of previous Cisco modules. In CCNA 2, Chapter 2.9.1.4, it states,&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Discard Route&lt;/p&gt;&#xA;&lt;p&gt;A common configuration in many networks is to have a static default route on the edge router forwarding packets to the ISP. The ISP router then has a static route pointing to the customer's network.&lt;/p&gt;&#xA;&lt;p&gt;For example, Customer A has the network address of 172.16.0.0/16, which is subnetted into several /24 subnets. The edge router of Customer A has a static default route forwarding all other traffic to the ISP router:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 serial 0/0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The ISP router has a static default route for forwarding traffic to Customer A's network:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip route 172.16.0.0 255.255.0.0 serial 0/0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is 172.16.0.0 255.255.0.0 really a static default route? I know it is a static route, but a static &lt;strong&gt;default&lt;/strong&gt; route? I thought all static &lt;strong&gt;default&lt;/strong&gt; routes had an IP and subnet mask of &lt;strong&gt;0.0.0.0 0.0.0.0&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerDisplayName="user3046" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-04-09T16:33:59.400" Title="IP Address and Subnet Mask of Static Default Route" Tags="|cisco|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7231" PostTypeId="2" ParentId="7230" CreationDate="2014-04-06T19:31:46.520" Score="3" Body="&lt;p&gt;You are correct, ISP has static routes for the customer subnets and a default route for upstream provider (provided they aren't  using BGP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the description just before the example it clearly states &quot;The ISP router then has a static route pointing to the customer's network.&quot; which is the typical operation for ISP networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though the example is poorly written, I believe the point is to introduce the idea of a discard route. This is a practice used by ISP's to prevent routing loops by creating a &quot;static default route&quot; for the entire ip block used for customers to an interface such as null0.&lt;/p&gt;&#xA;" OwnerUserId="4337" LastEditorUserId="4337" LastEditDate="2014-04-06T19:42:58.183" LastActivityDate="2014-04-06T19:42:58.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7232" PostTypeId="2" ParentId="7230" CreationDate="2014-04-06T19:35:35.153" Score="4" Body="&lt;p&gt;I think you're getting your verbiage off, but not wrong.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A common configuration in many networks is to have a static default&#xA;  route on the edge router forwarding packets to the ISP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A LAN that has no other exits will have a default route (i.e. static route) that points all unknown traffic to the edge.  Since routers match on the &lt;a href=&quot;http://en.wikipedia.org/wiki/Longest_prefix_match&quot; rel=&quot;nofollow&quot;&gt;longest prefix&lt;/a&gt; matching the destination address, this is your gateway of last resort.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ISP router then has a static route pointing to the customer's&#xA;  network.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;An ISP will never have a default route pointing to a customer network.  They will have a static route for the networks they service.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is 172.16.0.0 255.255.0.0 really a static default route?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is not a default route.  You were right in your assumption below.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I thought all static &lt;strong&gt;default&lt;/strong&gt; routes had an IP and subnet mask of&#xA;  &lt;strong&gt;0.0.0.0 0.0.0.0&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-04-06T19:35:35.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7234" PostTypeId="1" CreationDate="2014-04-06T20:39:08.350" Score="6" ViewCount="23322" Body="&lt;p&gt;Novice networker here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't seem to find any straightforward answers online.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  IP             SUBNET           NEXT HOP&#xA;&amp;gt; 129.10.112.0   255.255.255.0    R1&#xA;&amp;gt; 129.10.80.0    255.255.255.0    R1&#xA;&amp;gt; 129.10.0.0     255.255.0.0      R2&#xA;&amp;gt; 129.10.63.0    255.255.255.0    R4&#xA;&amp;gt; 129.10.63.0    255.255.255.0    R4&#xA;&amp;gt; 129.10.64.0    255.255.192.0    R3&#xA;&amp;gt; 129.10.65.0    255.255.255.0    R4&#xA;&amp;gt; 129.10.66.0    255.255.255.0    R4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the proper method to aggregate these entries into the minimum number of entries?&lt;/p&gt;&#xA;" OwnerUserId="5032" LastEditorUserId="5032" LastEditDate="2014-04-06T21:04:51.557" LastActivityDate="2024-02-01T14:05:09.597" Title="How to aggregate a routing table given IP addresses and their subnet masks" Tags="|routing|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7238" PostTypeId="2" ParentId="7234" CreationDate="2014-04-07T01:26:53.197" Score="11" Body="&lt;p&gt;First, separate the entries by next hop.  You have to summarize them separately:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP             SUBNET           NEXT HOP&#xA;129.10.112.0   255.255.255.0    R1&#xA;129.10.80.0    255.255.255.0    R1&#xA;&#xA;129.10.0.0     255.255.0.0      R2&#xA;&#xA;129.10.64.0    255.255.192.0    R3&#xA;&#xA;129.10.63.0    255.255.255.0    R4&#xA;129.10.63.0    255.255.255.0    R4&#xA;129.10.65.0    255.255.255.0    R4&#xA;129.10.66.0    255.255.255.0    R4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then for each next next hop, convert all the network addresses to binary.  Here is just the first one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10000001.00001010.01110000.00000000 = 129.10.112.0 &#xA;10000001.00001010.01010000.00000000 = 129.10.80.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now find all the identical digits, starting from the left.  In this case, the digits are all the same up to the 18th position.&#xA;So your new mask is /18.  Now, using  either address and the /18 mask, find the network address by ANDing the address and the mask:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10000001.00001010.01110000.00000000 = 129.10.112.0&#xA;11111111.11111111.11000000.00000000 = /18 (255.255.192.0)&#xA;-------------------------------------&#xA;10000001.00001010.01000000.00000000 = 129.10.64.0 /18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the best summarization of the first two routes is 129.10.64.0/18.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(the rest is left as a exercise for the reader)&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-04-07T01:49:24.023" LastActivityDate="2014-04-07T01:49:24.023" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7241" PostTypeId="2" ParentId="7042" CreationDate="2014-04-07T08:54:31.713" Score="3" Body="&lt;p&gt;This smells like an MTU issue - a symptom of MTU problems is packets with payload being consistently dropped while the rest pass through unmolested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try manually setting the MTU of the appropriate interface at your end to something lower than the default.  If this makes the problem go away, then you have a path MTU discovery issue.  This is usually caused by a firewall along the path unwisely dropping the ICMP packets that facilitate path MTU discovery.&lt;/p&gt;&#xA;" OwnerUserId="5140" LastActivityDate="2014-04-07T08:54:31.713" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7246" PostTypeId="1" CreationDate="2014-04-07T16:07:37.003" Score="7" ViewCount="1112" Body="&lt;p&gt;I heard routers alone do fragmentation.  When a host is connected to the network with ethernet cable, how does it keep the MTU size as 1500?  Will the host itself fragment and send only 1500 byte payloads in the ethernet cable?&lt;/p&gt;&#xA;" OwnerUserId="5145" LastEditorUserId="775" LastEditDate="2014-04-07T17:08:22.670" LastActivityDate="2014-04-07T17:08:22.670" Title="Will hosts do IP Fragmentation?" Tags="|ethernet|ipv4|ipv6|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7248" PostTypeId="2" ParentId="7246" CreationDate="2014-04-07T17:03:57.403" Score="8" Body="&lt;h3&gt;IPv6 Fragmentation&lt;/h3&gt;&#xA;&lt;p&gt;Only IPv6 hosts can fragment (ref &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2460#section-4.5&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2460 - IPv6 Specification, Section 4.5&lt;/a&gt;):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;4.5 Fragment Header&#xA;&#xA;&#xA;   The Fragment header is used by an IPv6 source to send a packet larger&#xA;   than would fit in the path MTU to its destination.  (Note: unlike&#xA;   IPv4, fragmentation in IPv6 is performed only by source nodes, not by&#xA;   routers along a packet's delivery path -- see section 5.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;IPv4 Fragmentation&lt;/h3&gt;&#xA;&lt;p&gt;IPv4 hosts optionally &lt;em&gt;may&lt;/em&gt; fragment (ref &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122#section-3.3.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1122 - Internet Host requirements, Section 3.3.3&lt;/a&gt;), and IPv4 routers &lt;em&gt;must&lt;/em&gt; perform fragmentation.&lt;/p&gt;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122#section-3.3.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1122 - Internet Host requirements, Section 3.3.3&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;3.3.3  Fragmentation&#xA;&#xA;         Optionally, the IP layer MAY implement a mechanism to fragment&#xA;         outgoing datagrams intentionally.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122#section-4.2.2.7&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1812 - IP Router Requirements, Section 4.2.2.7&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;4.2.2.7 Fragmentation: RFC 791 Section 3.2&#xA;&#xA;&#xA;   Fragmentation, as described in [INTERNET:1], MUST be supported by a&#xA;   router.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Example&lt;/strong&gt;&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;p&gt;It's fairly easy to illustrate how hosts fragment... for instance ping an internet host with a very large ping size (&amp;gt;1500 bytes)...&lt;/p&gt;&#xA;&lt;p&gt;In terminal 1:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@Bucksnort ~]$  ping -c 1 -s 65507 4.2.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In terminal 2:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@Bucksnort ~]$ sudo tshark -n -i eth0 icmp&#xA;  1   0.000000 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=0)&#xA;  2   0.000058 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=1480)&#xA;  3   0.000071 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=2960)&#xA;  4   0.000081 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=4440)&#xA;  5   0.000094 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=5920)&#xA;  6   0.000105 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=7400)&#xA;  7   0.000116 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=8880)&#xA;  8   0.000124 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=10360)&#xA;  9   0.000133 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=11840)&#xA; 10   0.000143 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=13320)&#xA; 11   0.000152 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=14800)&#xA; 12   0.000162 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=16280)&#xA; 13   0.000172 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=17760)&#xA; 14   0.000181 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=19240)&#xA; 15   0.000191 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=20720)&#xA; 16   0.000201 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=22200)&#xA; 17   0.000211 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=23680)&#xA; 18   0.000221 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=25160)&#xA; 19   0.000230 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=26640)&#xA; 20   0.000240 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=28120)&#xA; 21   0.000250 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=29600)&#xA; 22   0.000259 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=31080)&#xA; 23   0.000269 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=32560)&#xA; 24   0.000278 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=34040)&#xA; 25   0.000288 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=35520)&#xA; 26   0.000298 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=37000)&#xA; 27   0.000308 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=38480)&#xA; 28   0.000318 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=39960)&#xA; 29   0.000327 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=41440)&#xA; 30   0.000337 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=42920)&#xA; 31   0.000352 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=44400)&#xA; 32   0.000361 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=45880)&#xA; 33   0.000372 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=47360)&#xA; 34   0.000384 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=48840)&#xA; 35   0.000394 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=50320)&#xA; 36   0.000403 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=51800)&#xA; 37   0.000411 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=53280)&#xA; 38   0.000419 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=54760)&#xA; 39   0.000428 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=56240)&#xA; 40   0.000437 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=57720)&#xA; 41   0.000446 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=59200)&#xA; 42   0.000455 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=60680)&#xA; 43   0.000466 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=62160)&#xA; 44   0.000477 192.0.2.3 -&amp;gt; 4.2.2.2 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=63640)&#xA; 45   0.000486 192.0.2.3 -&amp;gt; 4.2.2.2 ICMP Echo (ping) request&#xA; 46   0.044402 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=0)&#xA; 47   0.044439 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=1480)&#xA; 48   0.044899 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=2960)&#xA; 49   0.044910 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=4440)&#xA; 50   0.044916 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=5920)&#xA; 51   0.045149 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=7400)&#xA; 52   0.045399 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=8880)&#xA; 53   0.045409 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=10360)&#xA; 54   0.045415 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=11840)&#xA; 55   0.045649 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=13320)&#xA; 56   0.045899 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=14800)&#xA; 57   0.045908 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=16280)&#xA; 58   0.045915 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=17760)&#xA; 59   0.046148 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=19240)&#xA; 60   0.046163 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=20720)&#xA; 61   0.046402 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=22200)&#xA; 62   0.046421 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=23680)&#xA; 63   0.046650 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=25160)&#xA; 64   0.046668 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=26640)&#xA; 65   0.046901 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=28120)&#xA; 66   0.046918 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=29600)&#xA; 67   0.047151 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=31080)&#xA; 68   0.047171 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=32560)&#xA; 69   0.047399 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=34040)&#xA; 70   0.047418 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=35520)&#xA; 71   0.047424 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=37000)&#xA; 72   0.047650 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=38480)&#xA; 73   0.047900 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=39960)&#xA; 74   0.048149 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=41440)&#xA; 75   0.048165 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=42920)&#xA; 76   0.048172 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=44400)&#xA; 77   0.048178 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=45880)&#xA; 78   0.048398 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=47360)&#xA; 79   0.048650 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=48840)&#xA; 80   0.048667 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=50320)&#xA; 81   0.048674 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=51800)&#xA; 82   0.048900 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=53280)&#xA; 83   0.048922 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=54760)&#xA; 84   0.049150 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=56240)&#xA; 85   0.049174 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=57720)&#xA; 86   0.049398 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=59200)&#xA; 87   0.049649 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=60680)&#xA; 88   0.049671 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=62160)&#xA; 89   0.049677 4.2.2.2 -&amp;gt; 192.0.2.3 IP Fragmented IP protocol (proto=ICMP 0x01, &#xA;   off=63640)&#xA; 90   0.049683 4.2.2.2 -&amp;gt; 192.0.2.3 ICMP Echo (ping) reply&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-04-07T17:03:57.403" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7250" PostTypeId="1" CreationDate="2014-04-07T20:30:05.847" Score="2" ViewCount="802" Body="&lt;p&gt;Recently I heard a term IPAM i.e IP Address management. Theoretically I got the definition from Wikipedia, but couldn't understand its actual need. Since for that we have DHCP then What is the need for seperate IP management service or hardware.  &lt;/p&gt;&#xA;" OwnerUserId="5149" LastEditorUserId="775" LastEditDate="2014-04-07T21:34:18.040" LastActivityDate="2014-04-18T19:31:08.550" Title="What is IP address management ? Why its needed ? How does the vendors like Bluecat Networks and Infoblox solves the IPAM problem?" Tags="|ipv4|ipv6|management|" AnswerCount="3" CommentCount="1" ClosedDate="2017-08-08T17:55:19.733" ContentLicense="CC BY-SA 3.0" />
  <row Id="7251" PostTypeId="2" ParentId="7250" CreationDate="2014-04-07T21:04:29.840" Score="1" Body="&lt;p&gt;We use Solarwinds' free IPAM for managing several aspects of our network. It's easier to assign our HVAC damper (and other devices) controllers IP addresses manually than to have DHCP running. IPAM allows us to all work in the same management database, reserve addresses, make notes about addresses, detect nodes that are offline for a while, and several other cool things. We also use it to manage the server network. The whole 192.168.169.0/24 network is assigned to our server network, and we seperate devices by scope, where active directory starts at 192.168.169.10, ans exchange starts at 192.168.169.25. This is all entered in the database for managing IP addresses, and reservations, comments, and other basic information. I'm not sure about Bluecar or Infoblox specifically, but those are just a few of the benefits and uses for IPAM suites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know several people that use them in network connected manufacturing robots as well as other industrial applications. I believe some software suites will tie into CRM and Monitoring solutions as well. &lt;/p&gt;&#xA;" OwnerUserId="5135" LastActivityDate="2014-04-07T21:04:29.840" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7252" PostTypeId="1" AcceptedAnswerId="7255" CreationDate="2014-04-07T21:05:23.207" Score="3" ViewCount="3286" Body="&lt;p&gt;I'd like to see if somebody here can help me with an in-principle answer on which direction take.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have an office LAN (192.168.100.0/24) connected to a production data centre (10.100.0.0/16) via a VPN. The office firewall is an ASA 5505. In addition, we have people connecting to the office firewall from home via IPSec client access.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Home       Production&#xA;|          |&#xA;|          |&#xA;------|-----         &#xA;      |&#xA;      | outside&#xA;------------&#xA;| ASA 5505 |&#xA;|-----------&#xA;      | inside&#xA;      |&#xA;      | Office LAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Our problem is that when connecting from home, it's not possible to connect to the production network at all, i.e. can't ping from 192.168.1.2 (my home PC) to 10.100.34.3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that there may be some restrictions here because both the home endpoint and the production endpoint go into the &quot;outer&quot; interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it possible to even set up this topology using a Cisco ASA 5505? If so, what do you do to make traffic flow from one VPN connection to another?&lt;/li&gt;&#xA;&lt;li&gt;If not possible, how do you make it possible? Put a L3 switch behind the ASA and put routing logic in place there?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is bugging us a lot because we keep having to go through jump hosts and SSH forwarding in the office when working outside, which is really time consuming and doesn't work for everything.&lt;/p&gt;&#xA;" OwnerUserId="5150" LastActivityDate="2014-04-09T15:37:59.920" Title="Routing from home VPN to other VPN (ASA 5505)" Tags="|cisco-asa|vpn|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7253" PostTypeId="2" ParentId="7250" CreationDate="2014-04-07T21:17:14.697" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/prime-network-registrar/white_paper_c11-728639.html&quot; rel=&quot;nofollow&quot;&gt;IPAM&lt;/a&gt; is the solution to using notepad to manage thousands (sometimes millions) of IP addresses. If you have a large enough IP space to manage, it's necessity will become immediately understood.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DHCP would be great if all hosts &lt;strong&gt;always&lt;/strong&gt; got their addresses from the server, but that isn't always the case. If you were a provider that had a downstream network, it wouldn't be common to service their IP space.  Maybe someone deploying assets at your site wants to hardcode the addresses.  There is an infinite amount of 'what-ifs' when it comes to thousands of devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most modern IPAM solutions provide additional features that you just can't be offered by DHCP, such as&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Automated subnet polling&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IP usage logging&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Subnet usage statistics&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DNS lookups&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is by no means an extensive list, just a listing of some of the common features most people look for. If you want more detail on some tools that are fairly popular, check out &lt;a href=&quot;http://iptrack.sourceforge.net/#current_functionality&quot; rel=&quot;nofollow&quot;&gt;IPplan&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-04-07T21:17:14.697" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7255" PostTypeId="2" ParentId="7252" CreationDate="2014-04-07T22:06:27.063" Score="3" Body="&lt;p&gt;Yes, this configuration is possible using a Cisco 5505. It's referred to as a VPN hairpin because traffic from the outside interface is coming inbound and then routing back outbound through the same outside interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three key components to this configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Allow communication in/out of the same interface&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;same-security-traffic permit intra-interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) Add the RAS VPN pool IP space to the interesting traffic for the site to site VPN.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; access-list (vpn-acl-name) extended permit ip object Vpn-Pool ip object Data-Centre-IPs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) Add a no-nat entry for the relevant traffic from outside to outside&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (outside,outside) source static Vpn-Pool Vpn-Pool destination static Data-Centre-IPs Data-Centre-IPs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is assuming you're on a post 8.3 code.&lt;/p&gt;&#xA;" OwnerUserId="2231" LastActivityDate="2014-04-07T22:06:27.063" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="7257" PostTypeId="1" AcceptedAnswerId="7258" CreationDate="2014-04-07T22:19:17.710" Score="-2" ViewCount="2268" Body="&lt;p&gt;I have two routers: Router A and Router B. Router A is my &quot;primary&quot; router (it serves my internet connection directly). I want to cascade or daisy-chain Router B as a secondary router of A, but the catch is, I want it to be dedicated to a VPN connection; I want everything connected to Router B to flow through a VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible to do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for reading&lt;/p&gt;&#xA;" OwnerUserId="5154" LastActivityDate="2014-04-07T23:02:05.387" Title="Cascading routers - secondary router as VPN?" Tags="|router|vpn|" AnswerCount="1" CommentCount="5" ClosedDate="2019-11-17T17:44:38.680" ContentLicense="CC BY-SA 3.0" />
  <row Id="7258" PostTypeId="2" ParentId="7257" CreationDate="2014-04-07T22:56:36.080" Score="3" Body="&lt;p&gt;Yes, this will work. These types of setups are common for when you have a group of computers that need to be connected through a VPN, and another group of computers to be connected directly to the Internet. In your question you didn't specify if you needed split VPN. (the computers on router B needing to access the Internet) However in this situation I would probably use 1 router with 2 VLAN's for the 2 groups.&lt;/p&gt;&#xA;" OwnerUserId="4337" LastEditorUserId="4337" LastEditDate="2014-04-07T23:02:05.387" LastActivityDate="2014-04-07T23:02:05.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7260" PostTypeId="1" AcceptedAnswerId="7285" CreationDate="2014-04-08T02:01:48.557" Score="8" ViewCount="6323" Body="&lt;p&gt;Recently &lt;a href=&quot;https://superuser.com/questions/655253/windows-7-doesnt-request-mtu-from-dhcp-server-what-is-it-thinking&quot;&gt;i've been dealing with MTU issues&lt;/a&gt;. And it all seems to stem from the fact that the ethernet adapter on newer computers default of a frame size of 1504 bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;netsh interface ipv4 show subinterfaces&#xA;&#xA;   MTU  MediaSenseState   Bytes In  Bytes Out  Interface&#xA;------  ---------------  ---------  ---------  -------------&#xA;  1504                1  3954161316  804790885  Local Area Connection&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, according to a random person on &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5261/what-is-meant-by-jumbo-frame-what-happen-when-a-frame-size-is-greater-than-the?rq=1&quot;&gt;NetworkEngineering.stackexchange.com&lt;/a&gt;, any packet that is too large will be dropped by any receiving Network Interface Card (NIC), as the ethernet packet is too large:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...any frame with an MTU greater than the 802.3 spec of 1500&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A frame larger than the set max &lt;strong&gt;will&lt;/strong&gt; be dropped by the NIC -- it's an error, and the OS will never know about it. (an oversized frame counter will click up, but that's all.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which causes problems when the computer tries to send packets to the gateway machine. Ideally i would be relying on &lt;strong&gt;Path MTU&lt;/strong&gt; discovery. But since the ethernet packets being generated are too large for any other machine to receive, there is &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3524/mtu-and-fragmentation?newreg=1b653a9e55294b6d810a357eb97c9c10&quot;&gt;no opportunity for IP &lt;em&gt;Packet too big&lt;/em&gt; fragmentation messages&lt;/a&gt; to be returned:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;There will be no &quot;fragmentation&quot; at all. Layer-2 (ethernet) has no means if indicating &quot;fragmentation needed&quot;. This is figured out at Layer-3 (IP) by routers sending an ICMP message when it has to drop the packet because it won't fit on the next-hop interface.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which brings me to my second question first:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why is there a spec that intentionally creates invalid ethernet frames? What is the intended behaviour here? Given that other network interface cards cannot receive these new default-sized packets, what were they expecting to happen.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This then brings me to my first question second. And this is something that has been asked before - a lot. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is the 4-byte QinQ tag part of the ethernet frame header, or part of the ethernet payload? If it's part of the header, why did the payload body increase by 4-bytes? If it's part of the ethernet payload, why the the payload MTU increase by 4 bytes (when we know that increasing it by 4 bytes makes it an invalid packet)?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;The larger question is...&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;If we step back for a moment, we have the larger question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What are we supposed to do?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There must have been people who designed this standard. What was it they expected people to do with devices that generate these &lt;em&gt;too large&lt;/em&gt; packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm really asking. I assume we weren't meant to go to every hardware device and undo the increase of the MTU 1504 and revert it to 1500:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;netsh interface ipv4&amp;gt;set subinterface &quot;Local Area Connection&quot; mtu=1500 store=persistent&#xA;Ok.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that would be (and is being) a configuration nightmare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the idea perhaps to turn off VLAN tagging? Aside from the configuration nightmare, it simply doesn't work:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Step 1: disable VLAN tagging&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/AnxGT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Step 2: observe that it doesn't work:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;netsh interface ipv4 show subinterfaces&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; MTU  MediaSenseState   Bytes In  Bytes Out  Interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1504                1     238125     245855  Local Area Connection&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If the solution to this is to manually force all network cards back to an MTU of 1500, then why did they bump it up to 1504 bytes, and create invalid packets, in the first place?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a piece of the puzzle i am missing.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Bonus Chatter&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Without 802.1Q tagging        Without 802.1Q tagging   &#xA;+------------------------+    +------------------------+&#xA;|Destination MAC: 6 bytes|    |Destination MAC: 6 bytes|&#xA;|Source MAC: 6 bytes     |    |Source MAC: 6 bytes     |&#xA;|Ethertype: 2 bytes      |    |802.1Q tag: 4 bytes     |&#xA;+------------------------+    |Ethertype: 2 bytes      |&#xA;|                        |    +------------------------+&#xA;|                        |    |                        |&#xA;/ Payload: 1500 bytes    /    / Payload: 1500 bytes    /&#xA;|                        |    |                        |&#xA;|                        |    |                        |&#xA;+------------------------+    |                        |&#xA;| Frame Check Sequence:  |    +------------------------+&#xA;|                 4 bytes|    | Frame Check Sequence:  |&#xA;+------------------------+    |                 4 bytes|&#xA;                              +------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Network Diagram&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+------------------+      +----------------+     +------------------+&#xA;| Realtek PCIe GBe |      | NetGear 10/100 |     | Realtek 10/100   |&#xA;|       (on-board) |      |     Switch     |     |     (on-board)   |&#xA;|                  |      +----------------+     |                  |&#xA;| Windows 7        |           ^    ^            |                  |&#xA;|                  |           |    |            |                  |&#xA;| 192.168.1.98/24  |-----------+    +------------| 192.168.1.10/24  |&#xA;| MTU = 1504 bytes |                             | MTU = 1500 bytes |&#xA;+------------------+                             +------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could also substitute any configuration you like, generating packets larger than the maximum allowed &lt;code&gt;1500&lt;/code&gt; bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+------------------+      +----------------+     +------------------+&#xA;| Realtek PCIe GBe |      | NetGear 10/100 |     | Realtek 10/100   |&#xA;|       (on-board) |      |     Switch     |     |     (on-board)   |&#xA;|                  |      +----------------+     |                  |&#xA;| Windows 7        |           ^    ^            | MTU = 1500 bytes |&#xA;| MTU = 16384bytes |           |    |            |                  |&#xA;|                  |-----------+    +------------|                  |&#xA;+------------------+                             +------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm trying to find a site that might be able to address my technical, conceptual, logical, fundamental, theoretical problem of how Ethernet can work when some devices intentionally generate invalid packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The concern comes when i try to send an invalid Ethernet packet to another Ethernet device:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;computer generates Ethernet packet&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source MAC:      xx-xx-xx-xx-xx-xx&#xA;Destination MAC: yy-yy-yy-yy-yy-yy&#xA;Ethertype:       0x0800&#xA;Payload:         ...1504 bytes...  (or could be ...16384 bytes, anything larger than 1500...)&#xA;CRC:             4 bytes                &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This packet is invalid because it is too large to be received by the target 802.3u device. Because the target's host operating system never sees the packet, and because Ethernet has no functionality to report invalid packets back to the sender, the &lt;em&gt;&quot;large&quot;&lt;/em&gt; packet is lost. &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Bonus Chatter&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/8021q/17056-741-4.html#frame2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's Inter-Switch Link and IEEE 802.1Q Frame Format&lt;/a&gt;: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Frame Size&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The default maximum transmission unit (MTU) of an interface is 1500 bytes. With an outer VLAN tag attached to an Ethernet frame, the packet size increases by 4 bytes. Therefore, it is advisable that you appropriately increase the MTU of each interface on the provider network. The recommended minimum MTU is 1504 bytes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Meanwhile:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The IEEE 802.3 Ethernet standard only mandates support for 1500-byte MTU frames.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="5159" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-04-09T11:04:40.817" Title="How is IEEE 802.1ad (aka VLAN Tagging, QinQ) valid, when the packets are too large?" Tags="|ethernet|vlan|mtu|qinq|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="7261" PostTypeId="2" ParentId="7066" CreationDate="2014-04-08T02:41:48.287" Score="3" Body="&lt;p&gt;The problem you are seeing is normal behavior.  When you use object groups to define the tunnel traffic, the ACL gets expanded to a regular ACL with multiple entries.  For example, this ACL&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_cryptomap extended permit ip 192.168.11.0 255.255.255.0 object-group DM_INLINE_NETWORK_1  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;becomes &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_cryptomap extended permit ip 192.168.11.0 255.255.255.0 192.168.0.0 255.255.255.0&#xA;access-list outside_cryptomap extended permit ip 192.168.11.0 255.255.255.0 192.168.50.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each line in the ACL creates a Securty Association (SA) for the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because you are using dynamic VPNs, the SA doesn’t get created until the remote router sees traffic that matches the ACL entry.  You apparently have devices on the 192.168.0.0 network that are talking to the 192.168.11.0 network, and this creates the SA for that entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you don’t have any devices on the 192.168.50.0 network talking to 192.168.11.0, so the SA never gets built.  With no SA, you can’t send traffic from 192.168.11.0 to 192.168.50 0.  Once you ping from 192.168.50.0 to 192.168.11.0, the SA is created and you can send traffic in either direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make this work the way you want, you have three choices:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Go back to static VPNs.  The SAs are always up.&lt;/li&gt;&#xA;&lt;li&gt;Find some way to generate traffic on the 192.168.50.0 network. &#xA;Anything will do.&lt;/li&gt;&#xA;&lt;li&gt;Readdress your networks so that you have one ACL entry that covers&#xA;both networks at the remote end.  You will have only one SA, which&#xA;will be created as soon as traffic flows.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-04-08T02:41:48.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7267" PostTypeId="1" AcceptedAnswerId="7271" CreationDate="2014-04-08T12:41:16.303" Score="4" ViewCount="4814" Body="&lt;p&gt;I am confused with master and slave relationship in OSPF? Why ospf need the election for master and slave relationship to exchange DBD?&lt;/p&gt;&#xA;" OwnerUserId="5167" LastEditorUserId="775" LastEditDate="2014-04-08T16:43:54.157" LastActivityDate="2019-07-31T09:42:27.227" Title="Why do we need master/slave relationship to exchange DBD in OSPF?" Tags="|routing|ospf|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7269" PostTypeId="2" ParentId="2995" CreationDate="2014-04-08T13:32:23.893" Score="5" Body="&lt;p&gt;I like to add one thing that is.&#xA;- Actual switches do have separated FDB tables per VLAN.&#xA;- Older switches can have one common FDB table for all VLAN's.&#xA;In the second scenario one MAC address can only be learned once.&lt;/p&gt;&#xA;" OwnerUserId="5168" LastActivityDate="2014-04-08T13:32:23.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7270" PostTypeId="2" ParentId="7212" CreationDate="2014-04-08T13:37:35.217" Score="3" Body="&lt;p&gt;You have an elegant physical setup, but logically, it’s deficient in a lot of ways.  You’re relying on layer 2 for all of your connections, which doesn’t provide any real failover your setup &lt;strong&gt;should&lt;/strong&gt; provide.  Luckily, you aren’t wasting any bandwidth with STP because you don’t have any redundant links; &lt;code&gt;VLAN 100&lt;/code&gt; and &lt;code&gt;VLAN 200&lt;/code&gt; only have a single way out, if I’m reading this correctly.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I can't implement multiple area OSPF because the CPE public subnets&#xA;  are too difficult to summarize and the public range is split over&#xA;  several POPs without hierarchy, so this would be inefficient.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don’t even think you need to go as far as setting up multiple areas, the segment your concerned with is fairly small.  &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=1763921&amp;amp;seqNum=6&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco recommends&lt;/a&gt; you stay under 50 routers per area, though, most will agree that you can exceed that amount by quite a significant margin and still be considered healthy. I have about 80 routers per area with no issues; &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7212/network-design-improvement-advice/7270#comment11932_7270&quot;&gt;Ron has even more than that&lt;/a&gt; without any hiccups. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Implementation of EtherChannel between the access switches and CMTS.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This all hinges off what happens higher up in your network.  If you’re significantly oversubscribing your distribution to core links, then you may not see any real benefit in increasing your bandwidth at the access layer.  The same holds true if you’re doing this with your access to distribution.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, as most have mentioned in the comments, implementing OSPF would be pretty easy. If you were utilizing a layer 3 protocol, you would share that load across equal/unequal cost links, too. Perhaps a redundant link between your distribution switches would allow each access switch a redundant path out.  As it stands, if one of your access links goes down, you lose an entire subnet (&lt;code&gt;VLAN 100&lt;/code&gt; or &lt;code&gt;VLAN 200&lt;/code&gt;). &lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-04-11T11:22:44.493" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7271" PostTypeId="2" ParentId="7267" CreationDate="2014-04-08T14:02:53.820" Score="6" Body="&lt;p&gt;This is explained in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#page-103&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328 - OSPF Version 2, Section 10.8&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;   Master&#xA;     Database Description packets are sent when either a) the slave acknowledges &#xA;     the previous Database Description packet by echoing the DD sequence number &#xA;     or b) RxmtInterval seconds elapse without an acknowledgment, in which case &#xA;     the previous Database Description packet is retransmitted.&#xA;&#xA;   Slave&#xA;     Database Description packets are sent only in response to Database &#xA;     Description packets received from the master. If the Database Description &#xA;     packet received from the master is new, a new Database Description packet &#xA;     is sent, otherwise the previous Database Description packet is resent.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In short, only one DBD sequence number can be unacknowledged at any given time.   The Master is in charge of ensuring that DBD sequence numbers are correctly acknowledged.  Two cooks in the kitchen doesn't work... one must have control over sequence numbers (the master) and one must acknowledge (the slave).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-04-08T14:13:04.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7272" PostTypeId="1" AcceptedAnswerId="43100" CreationDate="2014-04-08T16:40:40.730" Score="3" ViewCount="1974" Body="&lt;p&gt;I am attempting to setup Microsoft LDAP authentication, &lt;strong&gt;for SSH only&lt;/strong&gt;, for a specific security group on a Cisco ASA 5585 version 8.2(5) using the ASDM. The lookup and authentication is working, however &lt;strong&gt;all users&lt;/strong&gt; are authenticated regardless of security group membership.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AAA Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa-server LDAP_mybusinessda (web) host 10.100.21.6&#xA; server-port 636&#xA; ldap-base-dn OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org&#xA; ldap-naming-attribute sAMAccountName&#xA; ldap-login-password *****&#xA; ldap-login-dn CN=LDAPLookup,CN=Users,DC=mybusinessda,DC=org&#xA; ldap-over-ssl enable&#xA; ldap-attribute-map LDAP_memberOf_ServiceType&#xA;aaa authentication enable console LDAP_mybusinessda LOCAL&#xA;aaa authentication ssh console LDAP_mybusinessda LOCAL&#xA;ldap attribute-map LDAP_memberOf_ServiceType&#xA;  map-name  memberOf IETF-Radius-Service-Type&#xA;  map-value memberOf CN=CiscoASAManagement,OU=Security,OU=Groups,OU=mybusiness,DC=mybusinessda,DC=org 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I connect with a user who is a member of the group, the LDAP debug shows (only pasting relevant portion:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[3185] Creating LDAP context with uri=ldaps://10.100.21.6:636&#xA;[3185] Connect to LDAP server: ldaps://10.100.21.6:636, status = Successful&#xA;[3185] supportedLDAPVersion: value = 3&#xA;[3185] supportedLDAPVersion: value = 2&#xA;[3185] Binding as LDAPLookup&#xA;[3185] Performing Simple authentication for LDAPLookup to 10.100.21.6&#xA;[3185] LDAP Search:&#xA;        Base DN = [OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org]&#xA;        Filter  = [sAMAccountName=test_allowed_user]&#xA;        Scope   = [ONE LEVEL]&#xA;[3185] User DN = [CN=TestAllowedUser,OU=Staff Users,OU=mybusiness,DC=mybusinessda,DC=org]&#xA;[3185] Talking to Active Directory server 10.100.21.6&#xA;[3185] Binding as test_allowed_user&#xA;[3185] Performing Simple authentication for test_allowed_user to 10.100.21.6&#xA;[3185] Processing LDAP response for user test_allowed_user&#xA;[3185] Message (test_allowed_user):&#xA;[3185] Authentication successful for test_allowed_user to 10.100.21.6&#xA;[3185] Retrieved User Attributes:&#xA;[3185]  memberOf: value = CN=CiscoASAManagement,OU=Security,OU=Groups,OU=mybusiness,DC=mybusinessda,DC=org&#xA;[3185]          mapped to IETF-Radius-Service-Type: value = 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Even if I remove the &lt;code&gt;ldap-attribute-map&lt;/code&gt; from the &lt;code&gt;aaa-server&lt;/code&gt;, all users are still authenticated, and the debug simply doesn't show the &lt;code&gt;mapped to IETF-Radius-Service-Type&lt;/code&gt;.  What is wrong here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I can't tag this LDAP because of my rep. Unfortunate.&#xA;&lt;hr&gt;&#xA;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;br&gt;&#xA;I may end up doing this with RADIUS, as the rest of the Cisco devices support RADIUS auth and it would unify all my Cisco devices. It appears this method of LDAP auth may only work for VPN also.&lt;/p&gt;&#xA;" OwnerUserId="5170" LastEditorUserId="5170" LastEditDate="2014-04-09T14:45:43.850" LastActivityDate="2020-02-26T12:36:15.933" Title="Cisco ASA 5585 SSH LDAP Authentication" Tags="|cisco-asa|ssh|aaa|authentication|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7276" PostTypeId="1" CreationDate="2014-04-08T19:16:58.163" Score="0" ViewCount="422" Body="&lt;p&gt;How do i test network connection for UDP-Lite protocol (along with checksum coverage) instead of UDP with &quot;IPerf&quot; tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for udp we use following command-&gt; &#xA; iperf -s -u -i 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what command should i use for udp-lite protocol.&lt;/p&gt;&#xA;" OwnerUserId="4056" LastEditorUserId="3191" LastEditDate="2014-12-08T20:25:15.850" LastActivityDate="2014-12-08T20:25:15.850" Title="Tuning UDP-lite protocol instead of UDP with &quot;IPERF&quot; tool" Tags="|iperf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7278" PostTypeId="1" CreationDate="2014-04-08T20:16:19.760" Score="5" ViewCount="15959" Body="&lt;p&gt;I am setting up a ISPEC tunnel between a Linux System running Openswan and a Cisco ASA 5505. The strange thing is, the tunnel comes up I believe (based on the screenshots below), but I can't get traffic to traverse. I am wondering if it is an issue with the LAN being a Looopback interface on the Openswan system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary ASA side(2.2.2.2) has LAN 192.168.0.0/24 and Openswan side(1.1.1.1) has LAN 172.16.255.1/32 which is a loopback interface on the Openwan system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am getting the following error and am fairly confident it has something to do with this line:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;&quot;L2L-IPSEC&quot; #1: cannot respond to IPsec SA request because no connection is known for 172.16.255.1/32===1.1.1.1&amp;lt;1.1.1.1&amp;gt;[+S=C]:1/0...2.2.2.2&amp;lt;2.2.2.2&amp;gt;[+S=C]:1/0===192.168.0.0/24&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Openswan output&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;L2L-IPSEC&quot; #1: initiating Main Mode&#xA;&quot;L2L-IPSEC&quot; #1: received Vendor ID payload [RFC 3947] method set to=109&#xA;&quot;L2L-IPSEC&quot; #1: ignoring Vendor ID payload [Cisco IKE Fragmentation]&#xA;&quot;L2L-IPSEC&quot; #1: enabling possible NAT-traversal with method 4&#xA;&quot;L2L-IPSEC&quot; #1: transition from state STATE_MAIN_I1 to state STATE_MAIN_I2&#xA;&quot;L2L-IPSEC&quot; #1: STATE_MAIN_I2: sent MI2, expecting MR2&#xA;&quot;L2L-IPSEC&quot; #1: received Vendor ID payload [Cisco-Unity]&#xA;&quot;L2L-IPSEC&quot; #1: received Vendor ID payload [XAUTH]&#xA;&quot;L2L-IPSEC&quot; #1: ignoring unknown Vendor ID payload [4fbc775ddcc5a56a715d9fb1a2c92d6a]&#xA;&quot;L2L-IPSEC&quot; #1: ignoring Vendor ID payload [Cisco VPN 3000 Series]&#xA;&quot;L2L-IPSEC&quot; #1: NAT-Traversal: Result using RFC 3947 (NAT-Traversal): no NAT detected&#xA;&quot;L2L-IPSEC&quot; #1: transition from state STATE_MAIN_I2 to state STATE_MAIN_I3&#xA;&quot;L2L-IPSEC&quot; #1: STATE_MAIN_I3: sent MI3, expecting MR3&#xA;&quot;L2L-IPSEC&quot; #1: received Vendor ID payload [Dead Peer Detection]&#xA;| protocol/port in Phase 1 ID Payload is 17/0. accepted with port_floating NAT-T&#xA;&quot;L2L-IPSEC&quot; #1: Main mode peer ID is ID_IPV4_ADDR: '68.99.157.15'&#xA;&quot;L2L-IPSEC&quot; #1: transition from state STATE_MAIN_I3 to state STATE_MAIN_I4&#xA;&quot;L2L-IPSEC&quot; #1: STATE_MAIN_I4: ISAKMP SA established {auth=OAKLEY_PRESHARED_KEY cipher=oakley_3des_cbc_192 prf=oakley_md5 group=modp1024}&#xA;&quot;L2L-IPSEC&quot; #2: initiating Quick Mode PSK+ENCRYPT+TUNNEL+UP+IKEv2ALLOW+SAREFTRACK {using isakmp#1 msgid:58792b0d proposal=AES(12)_256-SHA1(2)_160 pfsgroup=no-pfs}&#xA;&quot;L2L-IPSEC&quot; #2: ignoring informational payload, type IPSEC_RESPONDER_LIFETIME msgid=58792b0d&#xA;&quot;L2L-IPSEC&quot; #2: transition from state STATE_QUICK_I1 to state STATE_QUICK_I2&#xA;&quot;L2L-IPSEC&quot; #2: STATE_QUICK_I2: sent QI2, IPsec SA established tunnel mode {ESP=&amp;gt;0x6b58a97a &amp;lt;0x359aa18e xfrm=AES_256-HMAC_SHA1 NATOA=none NATD=none DPD=none}&#xA;&quot;L2L-IPSEC&quot; #1: the peer proposed: 172.16.255.1/32:0/0 -&amp;gt; 192.168.0.0/24:0/0&#xA;&quot;L2L-IPSEC&quot; #1: cannot respond to IPsec SA request because no connection is known for 172.16.255.1/32===1.1.1.1&amp;lt;1.1.1.1&amp;gt;[+S=C]:1/0...2.2.2.2&amp;lt;2.2.2.2&amp;gt;[+S=C]:1/0===192.168.0.0/24&#xA;&quot;L2L-IPSEC&quot; #1: sending encrypted notification INVALID_ID_INFORMATION to 2.2.2.2:500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cisco output:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Apr 08 2014 09:02:25: %ASA-3-713902: Group = 1.1.1.1, IP = 1.1.1.1, QM FSM error (P2 struct &amp;amp;0xcc6e8cf8, mess id 0xd6971887)!&#xA;Apr 08 2014 09:02:25: %ASA-3-713902: Group = 1.1.1.1, IP = 1.1.1.1, Removing peer from correlator table failed, no match!&#xA;Apr 08 2014 09:02:25: %ASA-3-752015: Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions failed to establish the tunnel. Map Tag= outside-cmap.  Map Sequence Number = 40.&#xA;&#xA;asa# show crypto ikev1 sa&#xA;&#xA;IKEv1 SAs:&#xA;&#xA;   Active SA: 1&#xA;    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)&#xA;Total IKE SA: 1&#xA;&#xA;1   IKE Peer: 1.1.1.1&#xA;    Type    : L2L             Role    : initiator&#xA;    Rekey   : no              State   : MM_ACTIVE&#xA;&#xA;asa# show crypto ipsec sa&#xA;interface: outside&#xA;    Crypto map tag: outside-cmap, seq num: 40, local addr: 2.2.2.2&#xA;&#xA;      access-list VPN-TRAFFIC-VPS1 extended permit ip 192.168.0.0 255.255.255.0 host 172.16.255.1&#xA;      local ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)&#xA;      remote ident (addr/mask/prot/port): (172.16.255.1/255.255.255.255/0/0)&#xA;      current_peer: 1.1.1.1&#xA;&#xA;      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0&#xA;      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0&#xA;      #pkts compressed: 0, #pkts decompressed: 0&#xA;      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0&#xA;      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0&#xA;      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0&#xA;      #TFC rcvd: 0, #TFC sent: 0&#xA;      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0&#xA;      #send errors: 0, #recv errors: 0&#xA;&#xA;      local crypto endpt.: 2.2.2.2/0, remote crypto endpt.: 1.1.1.1/0&#xA;      path mtu 1500, ipsec overhead 74(44), media mtu 1500&#xA;      PMTU time remaining (sec): 0, DF policy: copy-df&#xA;      ICMP error validation: disabled, TFC packets: disabled&#xA;      current outbound spi: 529934CE&#xA;      current inbound spi : CFD6928B&#xA;&#xA;    inbound esp sas:&#xA;      spi: 0xCFD6928B (3486945931)&#xA;         transform: esp-aes-256 esp-sha-hmac no compression&#xA;         in use settings ={L2L, Tunnel, IKEv1, }&#xA;         slot: 0, conn_id: 917504, crypto-map: outside-cmap&#xA;         sa timing: remaining key lifetime (kB/sec): (4374000/28735)&#xA;         IV size: 16 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap:&#xA;          0x00000000 0x00000001&#xA;    outbound esp sas:&#xA;      spi: 0x529934CE (1385772238)&#xA;         transform: esp-aes-256 esp-sha-hmac no compression&#xA;         in use settings ={L2L, Tunnel, IKEv1, }&#xA;         slot: 0, conn_id: 917504, crypto-map: outside-cmap&#xA;         sa timing: remaining key lifetime (kB/sec): (4374000/28735)&#xA;         IV size: 16 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap:&#xA;          0x00000000 0x00000001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Openswan /etc/network/interfaces:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; auto lo&#xA;  iface lo inet loopback&#xA;&#xA; auto lo:1&#xA;  iface lo:1 inet static&#xA;    address 172.16.255.1&#xA;    netmask 255.255.255.255&#xA;&#xA; auto eth0&#xA;  iface eth0 inet static&#xA;   address 1.1.1.1&#xA;   gateway 1.1.1.254&#xA;   netmask 255.255.255.0&#xA;   dns-nameservers 8.8.8.8 8.8.4.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Openswan Config:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config setup&#xA;        listen=1.1.1.1&#xA;        dumpdir=/var/run/pluto&#xA;        nat_traversal=yes #pretty sure this isn't needed&#xA;        virtual_private=%v4:192.168.0.0/24&#xA;        oe=off&#xA;        protostack=netkey&#xA;&#xA;conn L2L-IPSEC&#xA;        authby=secret #use shared secret&#xA;        auto=start #automatically start if detected&#xA;        type=tunnel #tunnel mode/not transport&#xA;&#xA;        ###THIS SIDE###&#xA;        left=1.1.1.1&#xA;        leftsubnet=172.16.255.1/32&#xA;        leftsourceip=172.16.255.1&#xA;&#xA;        ###PEER SIDE###&#xA;        right=2.2.2.2&#xA;        rightsubnet=192.168.0.0/24&#xA;&#xA;        #phase 1 encryption-integrity-diffhellman&#xA;        keyexchange=ike&#xA;        ike=3des-md5-modp1024,aes256-sha1-modp1024&#xA;        ikelifetime=86400s&#xA;&#xA;        #phase 2 encryption-pfsgroup&#xA;        phase2=esp #esp for encryption | ah for authentication only&#xA;        phase2alg=aes256-sha1;modp1024&#xA;        pfs=no&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cisco ASA Config:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec ikev1 transform-set vps1TS esp-aes-256 esp-sha-hmac&#xA;&#xA;crypto map outside-cmap 40 match address VPN-TRAFFIC-VPS1&#xA;crypto map outside-cmap 40 set peer 1.1.1.1&#xA;crypto map outside-cmap 40 set ikev1 transform-set vps1TS&#xA;crypto map outside-cmap interface outside&#xA;&#xA;crypto ikev1 policy 1&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash md5&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 2&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;&#xA; access-list VPN-TRAFFIC-VPS1; 2 elements; name hash: 0xa6c3fa81&#xA;access-list VPN-TRAFFIC-VPS1 line 1 extended permit icmp object inside-network object vps1-network (hitcnt=3183) 0xed457442&#xA;  access-list VPN-TRAFFIC-VPS1 line 1 extended permit icmp 192.168.0.0 255.255.255.0 host 172.16.255.1 (hitcnt=3183) 0xed457442&#xA;access-list VPN-TRAFFIC-VPS1 line 2 extended permit ip object inside-network object vps1-network (hitcnt=88) 0xbddc26cf&#xA;  access-list VPN-TRAFFIC-VPS1 line 2 extended permit ip 192.168.0.0 255.255.255.0 host 172.16.255.1 (hitcnt=88) 0xbddc26cf&#xA;&#xA;&#xA;object network inside-network&#xA; subnet 192.168.0.0 255.255.255.0&#xA;&#xA;object network vps1-network&#xA; subnet 172.16.255.1 255.255.255.255&#xA;&#xA;nat (inside,outside) source static inside-network inside-network destination static vps1-network vps1-network&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2014-05-15T15:34:15.383" Title="Openswan Site-to-site VPN -- cannot respond to IPsec SA request because no connection is known" Tags="|cisco-asa|vpn|ipsec|tunnel|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7280" PostTypeId="2" ParentId="7272" CreationDate="2014-04-08T22:06:25.017" Score="1" Body="&lt;p&gt;EDIT:  Oops, I just re-read your question and I believe you are hoping to limit who can SSH to your ASA using the &quot;ldap-attribute-map&quot;.  As far as I know, the LDAP Attribute Map feature is only used for modifying VPN access, not management access to the ASA itself.  I'll leave my original answer below in case you (or anyone else) finds it helpful)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The LDAP attribute map allows you to 'override' policies that are inherited from the &quot;default-group-policy&quot; command in the tunnel group for this particular VPN.  So in essence, what you need to do is have it so the default-group-policy allows no access, but group-policy &lt;strong&gt;6&lt;/strong&gt; allows full access (or whatever access you desire).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without seeing the rest of your configuration, its hard to give you exact configurations you will need, but here is an effective summary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tunnel-group TG-SVC-VPN type remote-access&#xA;tunnel-group TG-SVC-VPN general-attributes&#xA;  authentication-server-group LDAP_mybusinessda&#xA;  default-group-policy GP-SVC-NO-ACCESS&#xA;tunnel-group TG-SVC-VPN webvpn-attributes&#xA;  group-alias Default enable&#xA;&#xA;group-policy GP-SVC-NO-ACCESS internal&#xA;group-policy GP-SVC-NO-ACCESS attributes&#xA;  vpn-simultaneous-logins 0&#xA;&#xA;group-policy 6 internal&#xA;group-policy 6 attributes&#xA;  vpn-simultaneous-logins 1&#xA;  [vpn-filter ...]&#xA;  [ip pool ...]&#xA;  [etc]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will make it so that anyone that authenticates against your tunnel group is not allowed to connect... EXCEPT if they match your LDAP attribute map which overrides the &quot;simultaneous logins&quot; setting from 0 to 1.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2014-04-08T22:16:27.460" LastActivityDate="2014-04-08T22:16:27.460" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7283" PostTypeId="2" ParentId="7260" CreationDate="2014-04-09T00:38:55.817" Score="3" Body="&lt;p&gt;I can attempt to answer your conceptual question.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find an actual quote, but it seems pretty clear that .1ad and .1q were never intended to be processed by PCs or other end-hosts. They are (usually) processed by infrastructure equipment only.   I don't know what was in the designers minds, but it's hard to imagine QinQ packets going to a PC in a real-life scenario.  Ethernet interfaces on infrastructure equipment (routes, switches, etc), can handle larger packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the packets are only invalid for PCs, which in theory should never see them. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-04-09T00:38:55.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7284" PostTypeId="2" ParentId="7276" CreationDate="2014-04-09T01:26:18.603" Score="3" Body="&lt;p&gt;You can use &lt;a href=&quot;http://www.erg.abdn.ac.uk/~gerrit/udp-lite/&quot; rel=&quot;nofollow&quot;&gt;patched IPERF &lt;/a&gt; compile, and then run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;# iperf -s --udplite 0&#xA;------------------------------------------------------------&#xA;Server listening on UDP-Lite port 5001&#xA;Receiving 1470 byte datagrams&#xA;UDP-Lite datagram buffer size:  160 KByte (default)&#xA;------------------------------------------------------------&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From help:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;  -u, --udp                use UDP      as transport; no argument may follow&#xA;  -u  --udplite   #        use UDP-Lite as transport; arg: cscov (0=full coverage)&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="1315" LastActivityDate="2014-04-09T01:26:18.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7285" PostTypeId="2" ParentId="7260" CreationDate="2014-04-09T03:50:52.420" Score="7" Body="&lt;p&gt;Responding to individual concerns in the post...&lt;/p&gt;&#xA;&lt;h3&gt;Regarding Path MTU Discovery&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Ideally i would be relying on Path MTU discovery. But since the ethernet packets being generated are too large for any other machine to receive, there is no opportunity for IP Packet too big fragmentation messages to be returned&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Based on your diagram, I agree that &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1191&quot; rel=&quot;nofollow noreferrer&quot;&gt;PMTUD&lt;/a&gt; cannot function between two different PCs in the same LAN segment; PCs do not generate ICMP Error messages required by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1191&quot; rel=&quot;nofollow noreferrer&quot;&gt;PMTUD&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;h3&gt;Jumbo frames&lt;/h3&gt;&#xA;&lt;p&gt;Some vendors (such as Cisco) have switch models which support ethernet payloads larger than 1500 bytes.  Officially &lt;a href=&quot;http://staff.psc.edu/mathis/MTU/arguments.html#ieee&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE does not endorse this configuration&lt;/a&gt;, but the industry has valid needs to judiciously deviate from the original 1500 byte MTU.  I have storage LAN / backup networks which leverage jumbo frame for good reason; however, I made sure that all MTUs matched inside the same vlan when I deployed jumbo frames.&lt;/p&gt;&#xA;&lt;h3&gt;Mismatched MTUs within a broadcast domain&lt;/h3&gt;&#xA;&lt;p&gt;The bottom line is that you should never have mismatched ethernet MTUs inside the same ethernet broadcast domain; if you do, it's a bug or configuration error.  Regardless of bug or error, you have to solve these problems, sometimes manually.&lt;/p&gt;&#xA;&lt;p&gt;All that discussion leads to the next question...&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Why is there a spec that intentionally creates invalid ethernet frames?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I'm not sure that I agree... I don't see how the IEEE 802.3 series, or &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc894&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 894&lt;/a&gt; create invalid frames.  Host implementations or host misconfigurations create invalid frames.  To understand whether your implementation is following the spec, we need a lot more evidence...&lt;/p&gt;&#xA;&lt;p&gt;This diagram is at least prima facie evidence that your MTUs are mismatched inside a broadcast domain...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;+------------------+      +----------------+     +------------------+&#xA;| Realtek PCIe GBe |      | NetGear 10/100 |     | Realtek 10/100   |&#xA;|       (on-board) |      |     Switch     |     |     (on-board)   |&#xA;|                  |      +----------------+     |                  |&#xA;| Windows 7        |           ^    ^            |                  |&#xA;|                  |           |    |            |                  |&#xA;| 192.168.1.98/24  |-----------+    +------------| 192.168.1.10/24  |&#xA;| MTU = 1504 bytes |                             | MTU = 1500 bytes |&#xA;+------------------+                             +------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;How should an 802.3-compliant implementation respond to MTU mismatches?&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What was it they [the writers of 'the spec'] expected people to do with devices that generate these too large packets?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;MTU 1504 and MTU 1500 within the same broadcast domain is simply a misconfiguration; it should never be expected to work any more than mismatched IP netmasks, or mismatched IP subnets can be expected to work.  Your company will have to knuckle-down and fix the root-cause of the MTU mismatches... at this time it's hard to say whether the root cause is user error, an implementation bug, or some combination of the above.&lt;/p&gt;&#xA;&lt;p&gt;If the affected Windows machines are successfully logging into to an Active Directory Domain, one could write Windows login scripts to automatically fix MTU issues based on some well-constructed tests inside the domain login scripts (assuming the Domain Controller isn't part of the MTU issues).&lt;/p&gt;&#xA;&lt;p&gt;If the machines are not logging into a domain, manual labor is another option.&lt;/p&gt;&#xA;&lt;h3&gt;Other possibilities to contain the damage&lt;/h3&gt;&#xA;&lt;p&gt;Use a layer3 switch&lt;sup&gt;Note 1&lt;/sup&gt; to build a custom vlan for anything that has broken MTUs and set the layer3 switch's ethernet MTU to match the broken machines; this relies on &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1191&quot; rel=&quot;nofollow noreferrer&quot;&gt;PMTUD&lt;/a&gt; to resolve MTU issues at the IP layer. Layer3 switches generate the ICMP errors required by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1191&quot; rel=&quot;nofollow noreferrer&quot;&gt;PMTUD&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;This option works best if you can re-address the broken machines with DHCP; and you can identify the broken machines by mac-address.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;... why did they bump it up to 1504 bytes, and create invalid packets, in the first place?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Hard to say at this point&lt;/p&gt;&#xA;&lt;h3&gt;802.1ad vs 802.1q&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;How is IEEE 802.1ad (aka VLAN Tagging, QinQ) valid, when the packets are too large?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I haven't seen evidence so far that you're using &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1Q#Double_tagging&quot; rel=&quot;nofollow noreferrer&quot;&gt;QinQ&lt;/a&gt;; from the limited evidence I have seen so far, you're using simple &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1Q#Frame_format&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.1q&lt;/a&gt; encapsulation, which &lt;em&gt;should&lt;/em&gt; work correctly in Windows, assuming the NIC driver supports &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1Q#Frame_format&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.1q&lt;/a&gt; encap.&lt;/p&gt;&#xA;&lt;hr&gt;&#xA;&lt;p&gt;&lt;strong&gt;End Notes&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;sup&gt;Note 1&lt;/sup&gt;&lt;sub&gt;Any layer 3 switch should do... Cisco, Juniper, and Brocades all could perform this kind of function.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-04-09T11:04:40.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7287" PostTypeId="1" CreationDate="2014-04-09T08:25:46.880" Score="2" ViewCount="1622" Body="&lt;p&gt;I have a scenario to discuss. There are three nodes that I am talking about. lets give those sites the name A, B and C. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site A and C has vendors routers installed. Vendor has no reachability for these sites A, B and C so it has asked me (service provider) to serve its customer. Now to provide services to vendor's customer we have installed our switches and Media converters at site A, B and C. &#xA;If the links gets down at site C. we started trouble shooting fall from site A to site C. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A---------B (fiber) -------&amp;gt; A has vendor router and my switch.&#xA;B---------C1 (E1 circuit)--&amp;gt; B has only my switch to provide connection to C1.&#xA;C1--------C (Radio) -------&amp;gt; C1 is my office site where my equipment is placed&#xA;                               and C is my vendor's router.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I need to see the connectivity. The IP at A is .129 at B is .130 and at C is .56&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Checking A----B I shut my port at B and bind IP .56 at B switch... Ping stats for .129 and .56 were shared (No change was made at site C - because port was shut at my end)&lt;/li&gt;&#xA;&lt;li&gt;Checking B---C because it was a VLAN traffic from Fiber, I shut the end at my switch and bind IP .159 at B. No change done at A again.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Also note that vendor is using HSRP protocol at its routers on site A and C so it keeps updating IP and MAC Addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As soon as I am done with my troubleshooting after 4 hours, I reverted back those IPs to their respective locations. Means vendor should now receive correct information of MAC addresses that was originially assigned because of this HSRP Protocol..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is, why do i need to tell me vendor to clear its ARP Cache to get the sites working back other wise sites will remain down???? When HSRP keeps updating its neighbor routers information of ip against MAC.. why they need to clear it?&lt;/p&gt;&#xA;" OwnerUserId="5177" LastEditorUserId="3191" LastEditDate="2014-04-09T11:10:31.607" LastActivityDate="2014-04-09T18:44:15.907" Title="Why ARP Cache clear when HSRP is already running" Tags="|cisco|mac-address|hsrp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7291" PostTypeId="1" CreationDate="2014-04-09T13:31:05.187" Score="3" ViewCount="2261" Body="&lt;p&gt;Can anyone recommend a good way of setting up monitoring of IPsec tunnels via SNMP for example? VTI-tunnels are very easy to monitor since there are no difference from any other virtual interface, but with IPsec tunnels I haven't found a good way yet. Usually what I do is monitor some equipment at the other side, through the tunnel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards, &#xA;Andreas&lt;/p&gt;&#xA;" OwnerUserId="2067" LastActivityDate="2014-04-18T19:02:10.587" Title="A way to monitor IPsec tunnels?" Tags="|monitoring|ipsec|" AnswerCount="2" CommentCount="2" ClosedDate="2017-08-08T17:55:48.807" ContentLicense="CC BY-SA 3.0" />
  <row Id="7292" PostTypeId="2" ParentId="7252" CreationDate="2014-04-09T15:37:59.920" Score="1" Body="&lt;p&gt;You need a route for the 10/8 network on the VPN client workstations, pointing at the VPN gateway address or interface. (the client probably thinks that 10/8 is over the default gateway) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may be configurable in the VPN client application, but it can also be done in a simple batch file run after the VPN connection comes up. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some VPN implementations allow the server side to pass this information to the client.  It just depends on what you are using. You don't need active routing to fix this problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should also look at your ACLs on the VPN server private interface, as they may be restricting traffic as well. &lt;/p&gt;&#xA;" OwnerUserId="5182" LastActivityDate="2014-04-09T15:37:59.920" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7293" PostTypeId="2" ParentId="7230" CreationDate="2014-04-09T16:33:59.400" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;ip route 172.16.0.0 255.255.0.0 serial 0/0/1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This says: 172.16/16 goes in the outbound que of  S0/0/1 &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ip route 0.0.0.0 0.0.0.0 serial 0/0/0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This says: everything goes in the outbound que of S0/0/0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first is an example of ENTERING a static route. &#xA;The second is an example of ENTERING a static default route. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A route that exists in the table may have many states. It may be static or dynamic, held down, etc. &quot;default route&quot; refers only to the fact that it points at everything: (0.0.0.0/0). &quot;static route&quot; refers only to the method by which it was entered into the routing table. They are independent concepts.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A default route, may be static. A static route may be a default route. Neither is required of the other. &lt;/p&gt;&#xA;" OwnerUserId="5182" LastActivityDate="2014-04-09T16:33:59.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7294" PostTypeId="1" CreationDate="2014-04-09T17:11:32.043" Score="1" ViewCount="117" Body="&lt;p&gt;I'm having problems understanding the concept of how ACS is supposed to work.  Today, we have routers that use aaa (ACS) to authenticate users trying to telnet into the box.  However, anyone w/ a valid LDAP account can authenticate.  How exactly do I narrow which LDAP users can authenticate?  How do I make it so some users can access some devices, but not others?&lt;/p&gt;&#xA;" OwnerUserId="5171" LastActivityDate="2014-04-09T17:37:06.077" Title="SecureACS - and LDAP" Tags="|aaa|authentication|tacacs|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7295" PostTypeId="2" ParentId="7294" CreationDate="2014-04-09T17:37:06.077" Score="2" Body="&lt;p&gt;The most common way is to segregate access based on group membership. Within ACS there is/should be an &quot;Access Policies&quot; menu - I won't go into every detail of configuring ACS here, because that's why there's a manual, but you can essentially define your policies of which groups members can log in (and which group members have access to run which commands) there. In addition, there's also a way to define hierarchy in your actual network devices themselves (via hostnames, &quot;Locations&quot;, etc) that can provide further criteria on network device access. ACS is a decent product if you need point-and-click AAA, but there are far cheaper ways to do the same thing if you have staff that know what they're doing (see &lt;a href=&quot;http://www.shrubbery.net/tac_plus/&quot; rel=&quot;nofollow&quot;&gt;tac_plus&lt;/a&gt; or &lt;a href=&quot;http://freeradius.org/&quot; rel=&quot;nofollow&quot;&gt;FreeRADIUS&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking some care in defining and laying out elements in your Network Resources/Network Device Groups in ACS will make your life easier when it comes to defining new access policies and allowed command sets.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2014-04-09T17:37:06.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7296" PostTypeId="2" ParentId="7287" CreationDate="2014-04-09T18:44:15.907" Score="1" Body="&lt;p&gt;When HSRP triggers a failover, it also issues Gratuitous ARPs to update all the ARP caches and Switchport MAC Address tables that the default gateway is now being served by a new interface/router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its not terribly clear from your question, but as far as I understand, you are not actually running HSRP with your vendor, but instead are shutting and manually configuring what would have been the HSRP VIP IP address on different Routers.  Given that you are doing this Manually and not within the HSRP protocol, the gratuitous ARP is not being sent to update everything, so a manual clearing of the ARP cache is necessary.  This allows each device to &quot;re-learn&quot; the MAC address of its default-gateway, as well as the switched-path to get there.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-04-09T18:44:15.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7297" PostTypeId="1" CreationDate="2014-04-09T19:01:40.000" Score="6" ViewCount="21433" Body="&lt;p&gt;I am unable to set the bandwidth on both sides using the Iperf tool. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I use the command &lt;code&gt;iperf -c 192.168.1.15  -b 10m -l 32k -w 128k&lt;/code&gt; I get this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--iperf: ignoring extra argument -- 10m&#xA;&#xA;--Can't use packet-oriented mode with these settings.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why am I getting this error?&lt;/p&gt;&#xA;" OwnerUserId="4056" LastEditorUserId="3191" LastEditDate="2015-01-08T10:30:30.910" LastActivityDate="2016-07-15T18:01:31.930" Title="Iperf 'set bandwidth' command issues" Tags="|testing|iperf|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7299" PostTypeId="1" AcceptedAnswerId="7306" CreationDate="2014-04-09T19:27:59.180" Score="2" ViewCount="326" Body="&lt;p&gt;I have a Cisco ASA 5510 on 8.2(5).&#xA;NATing works fine but where my issues is that it seems the only way to get traffic through from outside--&gt;inside is through a &quot;any any ip&quot; rule which I don't want.  I have the other respective rules setup for smtp to exchange server etc but the only rule that will allow traffic is the any any rule.  I am not sure what I am missing here.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="5188" LastActivityDate="2014-04-10T08:14:24.630" Title="Access Control Cisco ASA 5510" Tags="|cisco-asa|acl|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7300" PostTypeId="1" CreationDate="2014-04-09T19:35:42.037" Score="6" ViewCount="1016" Body="&lt;p&gt;Ive got 2 sites with an IPSEC connection between them. Each site has a 2921 on the edge.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Site A 2921 (gi0/1) ---&amp;gt; &amp;lt;--- (gi0/1) 2921 Site B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am adding a second WAN connection to site A via the third interface on the 2921 (gi0/2).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.12.x.x Site A 2921 (gi0/1) ---&amp;gt; &amp;lt;--- (gi0/1) 2921 Site B 10.4.x.x&#xA;          Site A 2921 (gi0/2) ---&amp;gt;  0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ideally I would like to use PBR to send users behind Site A's 2921 out the gi0/2 interface unless they are destined for an address in Site B. I am also hosting a mail server from Site A on the gi0/1 interface's IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done PBR before, but the VPN (I think) is throwing in some complexities for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I set the interface overload commands and apply the route map to the interface, it just stops working. If I just remove the PBR and set gi0/1 back to the default route, everything works just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help!&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Site A Configuration&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description Inside&#xA; ip address 10.12.x.x 255.255.255.0&#xA; no ip redirects&#xA; no ip proxy-arp&#xA; ip policy route-map internet&#xA; ip nbar protocol-discovery&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; no mop enabled&#xA;&#xA;interface GigabitEthernet0/1&#xA; description TO SITE B&#xA; ip address a.a.a.a 255.255.255.0&#xA; no ip redirects&#xA; no ip proxy-arp&#xA; ip accounting access-violations&#xA; ip verify unicast source reachable-via rx allow-default 100&#xA; ip nbar protocol-discovery&#xA; ip flow ingress&#xA; ip nat outside&#xA; ip inspect OutsideFirewall out&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA; no mop enabled&#xA; crypto map S2S_VPN&#xA;&#xA;interface GigabitEthernet0/2&#xA; description TO 0.0.0.0&#xA; ip address dhcp&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip accounting access-violations&#xA; ip verify unicast source reachable-via rx allow-default 100&#xA; ip nbar protocol-discovery&#xA; ip flow ingress&#xA; ip nat outside&#xA; ip inspect OutsideFirewall out&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA; no mop enabled&#xA;&#xA;ip nat inside source route-map NAT interface GigabitEthernet0/1 overload&#xA;ip nat inside source static tcp 10.12.x.10 80 interface GigabitEthernet0/1 80&#xA;ip nat inside source static tcp 10.12.x.10 995 interface GigabitEthernet0/1 995&#xA;ip nat inside source static tcp 10.12.x.10 25 interface GigabitEthernet0/1 25&#xA;ip nat inside source static tcp 10.12.x.10 443 interface GigabitEthernet0/1 443&#xA;ip nat inside source list NAT interface GigabitEthernet0/2 overload&#xA;ip route 0.0.0.0 0.0.0.0 192.x.x.x      (gi0/2 gateway)&#xA;&#xA;ip access-list extended NAT&#xA; deny   ip any 10.4.x.x 0.0.0.255&#xA; permit ip any any&#xA;&#xA;ip access-list extended to_gi01&#xA; permit ip 10.12.x.10 0.0.0.0 any&#xA; permit ip 10.12.x.x 0.0.0.255 10.4.x.x 0.0.0.255 &#xA; deny   ip any any&#xA;&#xA;route-map internet permit 10&#xA; match ip address to_gi01&#xA; set ip next-hop a.a.a.a           (gi0/1 gateway)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Site A Crypto Section&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto isakmp policy 10&#xA; encr 3des&#xA; hash md5&#xA; authentication pre-share&#xA; group 2&#xA;&#xA;crypto ipsec transform-set S2S_SET esp-3des esp-md5-hmac &#xA; mode tunnel&#xA;&#xA;crypto isakmp key blahblah address x.siteB.x.x&#xA;&#xA;crypto map S2S_VPN 1 ipsec-isakmp &#xA; description S2S VPN&#xA; set peer x.siteB.x.x&#xA; set transform-set S2S_SET &#xA; set pfs group1&#xA; match address siteB_ACL&#xA;&#xA;ip access-list extended siteB_ACL&#xA; permit ip 10.12.x.0 0.0.0.255 10.4.x.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Simple Network Drawing&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5970l.png&quot; alt=&quot;network diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5187" LastEditorUserId="3191" LastEditDate="2014-04-21T18:27:27.950" LastActivityDate="2014-05-08T17:56:51.647" Title="Cisco PBR Question" Tags="|cisco|nat|pbr|" AnswerCount="2" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="7302" PostTypeId="2" ParentId="7297" CreationDate="2014-04-10T01:08:58.590" Score="1" Body="&lt;p&gt;You can use iperf3, or v2 only in UDP mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;# iperf -v&#xA;iperf version 2.0.5 (08 Jul 2010) pthreads&#xA;# iperf -h&#xA;  -b, --bandwidth #[KM]    for UDP, bandwidth to send at in bits/sec&#xA;                           (default 1 Mbit/sec, &lt;b&gt;implies -u&lt;/b&gt;)&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;V3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;# iperf3 -h&#xA;  -b, --bandwidth #[KMG][/#] target bandwidth in bits/sec&#xA;                            (default 1 Mbit/sec for UDP, unlimited for &lt;b&gt;TCP&lt;/b&gt;)&#xA;                            (optional slash and packet count for burst mode)&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="1315" LastActivityDate="2014-04-10T01:08:58.590" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7304" PostTypeId="1" AcceptedAnswerId="7305" CreationDate="2014-04-10T07:25:51.250" Score="14" ViewCount="2404" Body="&lt;p&gt;On 09/04/2014 the &lt;a href=&quot;http://heartbleed.com/&quot;&gt;The Heartbleed vulerability&lt;/a&gt; was &lt;a href=&quot;https://www.openssl.org/news/secadv_20140407.txt&quot;&gt;disclosed by the OpenSSL team&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakness allows stealing the information protected, under normal conditions, by the SSL/TLS encryption used to secure the Internet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Can we build a list of enterprise networking devices that are vulnerable to &lt;a href=&quot;https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0160&quot;&gt;heartbleed&lt;/a&gt;?&lt;/p&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="775" LastEditDate="2014-04-15T08:48:02.040" LastActivityDate="2014-04-15T12:44:17.707" Title="Enterprise Network Equipment vulnerable to heartbleed" Tags="|security|" AnswerCount="1" CommentCount="2" CommunityOwnedDate="2014-04-10T08:07:29.637" ContentLicense="CC BY-SA 3.0" />
  <row Id="7305" PostTypeId="2" ParentId="7304" CreationDate="2014-04-10T07:54:59.357" Score="13" Body="&lt;p&gt;As with any new vulnerability, it's impacts are far-reaching.  Infrastructure devices are no different.  Most of them do incorporate vulnerable OpenSSL packages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's nearly impossible to compile a listing of every vulnerable product&lt;sup&gt;&lt;strong&gt;1&lt;/strong&gt;&lt;/sup&gt;, since it affects anything that included OpenSSL libraries built with the original &lt;a href=&quot;https://github.com/openssl/openssl/commit/4817504d069b4c5082161b02a22116ad75f822b1&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Committed on Dec 31, 2011&quot;&gt;OpenSSL TLS heartbeat implementation&lt;/a&gt; until the heartbleed patch &lt;a href=&quot;https://github.com/openssl/openssl/commit/731f431497f463f3a2a97236fe0187b11c44aead&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Committed April 2014&quot;&gt;was committed to OpenSSL stable branch&lt;/a&gt;; however, we can list the major vendors' products here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;This is a community wiki, feel free to contribute.&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Aruba&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;ArubaOS 6.3.x, 6.4.x&lt;/li&gt;&#xA;  &lt;li&gt;ClearPass 6.1.x, 6.2.x, 6.3.x&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Previous versions&lt;/strong&gt; of these products used an earlier version of OpenSSL &#xA;  that is &lt;strong&gt;not vulnerable&lt;/strong&gt;.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://www.arubanetworks.com/support/alerts/aid-040814.asc&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenSSL 1.0.1 library (Heartbleed) vulnerability.&lt;/a&gt; &lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Checkpoint Networks&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;amp;solutionid=sk100173&amp;amp;js_peid=P-114a7bc3b09-10006&amp;amp;partition=General&amp;amp;product=Security&quot; rel=&quot;nofollow noreferrer&quot;&gt;SK 100173&lt;/a&gt; asserts that Checkpoint products are not vulnerable.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Cisco&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The following Cisco products are affected by this vulnerability:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Cisco AnyConnect Secure Mobility Client for iOS [CSCuo17488]&lt;/li&gt;&#xA;  &lt;li&gt;Cisco Desktop Collaboration Experience DX650&lt;/li&gt;&#xA;  &lt;li&gt;Cisco Unified 7800 series IP Phones&lt;/li&gt;&#xA;  &lt;li&gt;Cisco Unified 8961 IP Phone&lt;/li&gt;&#xA;  &lt;li&gt;Cisco Unified 9951 IP Phone&lt;/li&gt;&#xA;  &lt;li&gt;Cisco Unified 9971 IP Phone&lt;/li&gt;&#xA;  &lt;li&gt;Cisco IOS XE [CSCuo19730]&lt;/li&gt;&#xA;  &lt;li&gt;Cisco Unified Communications Manager (UCM) 10.0&lt;/li&gt;&#xA;  &lt;li&gt;Cisco Universal Small Cell 5000 Series running V3.4.2.x software&lt;/li&gt;&#xA;  &lt;li&gt;Cisco Universal Small Cell 7000 Series running V3.4.2.x software&lt;/li&gt;&#xA;  &lt;li&gt;Small Cell factory recovery root filesystem V2.99.4 or later&lt;/li&gt;&#xA;  &lt;li&gt;Cisco MS200X Ethernet Access Switch&lt;/li&gt;&#xA;  &lt;li&gt;Cisco Mobility Service Engine (MSE)&lt;/li&gt;&#xA;  &lt;li&gt;Cisco TelePresence Video Communication Server (VCS) [CSCuo16472]&lt;/li&gt;&#xA;  &lt;li&gt;Cisco TelePresence Conductor&lt;/li&gt;&#xA;  &lt;li&gt;Cisco TelePresence Supervisor MSE 8050&lt;/li&gt;&#xA;  &lt;li&gt;Cisco TelePresence Server 8710, 7010&lt;/li&gt;&#xA;  &lt;li&gt;Cisco TelePresence Server on Multiparty Media 310, 320&lt;/li&gt;&#xA;  &lt;li&gt;Cisco TelePresence Server on Virtual Machine&lt;/li&gt;&#xA;  &lt;li&gt;Cisco TelePresence ISDN Gateway 8321 and 3201 Series&lt;/li&gt;&#xA;  &lt;li&gt;Cisco TelePresence Serial Gateway Series&lt;/li&gt;&#xA;  &lt;li&gt;Cisco TelePresence IP Gateway Series&lt;/li&gt;&#xA;  &lt;li&gt;Cisco WebEx Meetings Server versions 2.x [CSCuo17528]&lt;/li&gt;&#xA;  &lt;li&gt;Cisco Security Manager [CSCuo19265]&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20140409-heartbleed&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Security Advisory - OpenSSL Heartbeat Extension Vulnerability in Multiple Cisco Products&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;D-Link&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As of April 15, 2014 D-Link has no vulnerable products.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://securityadvisories.dlink.com/security/publication.aspx?name=SAP10022&quot; rel=&quot;nofollow noreferrer&quot;&gt;Security Incident Response for D-Link Devices and Services&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Fortigate&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;FortiGate (FortiOS) 5.x&lt;/li&gt;&#xA;  &lt;li&gt;FortiAuthenticator 3.x&lt;/li&gt;&#xA;  &lt;li&gt;FortiMail 5.x&lt;/li&gt;&#xA;  &lt;li&gt;FortiVoice&lt;/li&gt;&#xA;  &lt;li&gt;FortiRecorder&lt;/li&gt;&#xA;  &lt;li&gt;FortiADC D-Series models 1500D, 2000D and 4000D&lt;/li&gt;&#xA;  &lt;li&gt;FortiADC E-Series 3.x&lt;/li&gt;&#xA;  &lt;li&gt;Coyote Point Equalizer GX / LX 10.x&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://www.fortiguard.com/advisory/FG-IR-14-011/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Information Disclosure Vulnerability in OpenSSL&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;F5&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As of April 10, 2014 the following F5 Products / Releases are known to be vulnerable&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;BigIP LTM Versions 11.5.0 - 11.5.1 (Mgmt Interface, compat SSL ciphers)&lt;/li&gt;&#xA;  &lt;li&gt;BigIP AAM Versions 11.5.0 - 11.5.1 (Mgmt Interface, compat SSL ciphers)&lt;/li&gt;&#xA;  &lt;li&gt;BigIP AFM Versions 11.5.0 - 11.5.1 (Mgmt Interface, compat SSL ciphers)&lt;/li&gt;&#xA;  &lt;li&gt;BigIP Analytics Versions 11.5.0 - 11.5.1 (Mgmt Interface, compat SSL ciphers)&lt;/li&gt;&#xA;  &lt;li&gt;BigIP APM Versions 11.5.0 - 11.5.1 (Mgmt Interface, compat SSL ciphers)&lt;/li&gt;&#xA;  &lt;li&gt;BigIP ASM Versions 11.5.0 - 11.5.1 (Mgmt Interface, compat SSL ciphers)&lt;/li&gt;&#xA;  &lt;li&gt;BigIP GTM Versions 11.5.0 - 11.5.1 (Mgmt Interface, compat SSL ciphers)&lt;/li&gt;&#xA;  &lt;li&gt;BigIP Link Controller Versions 11.5.0 - 11.5.1 (Mgmt Interface, compat SSL ciphers)&lt;/li&gt;&#xA;  &lt;li&gt;BigIP PEM Versions 11.5.0 - 11.5.1 (Mgmt Interface, compat SSL ciphers)&lt;/li&gt;&#xA;  &lt;li&gt;BigIP PSM Versions 11.5.0 - 11.5.1 (Mgmt Interface, compat SSL ciphers)&lt;/li&gt;&#xA;  &lt;li&gt;BIG-IP Edge Clients for Apple iOS Versions 1.0.5, 2.0.0 - 2.0.1 (VPN)&lt;/li&gt;&#xA;  &lt;li&gt;BIG-IP Edge Clients for Linux Versions 6035 - 7101 (VPN)&lt;/li&gt;&#xA;  &lt;li&gt;BIG-IP Edge Clients for Mac OSX Versions 6035 - 7101 (VPN)&lt;/li&gt;&#xA;  &lt;li&gt;BIG-IP Edge Clients for Windows Versions 6035 - 7101 (VPN)&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://support.f5.com/kb/en-us/solutions/public/15000/100/sol15159.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;F5 Networks SOL 15159 OpenSSL Vulnerability CVE-2014-0160&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;HP&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As of April 10&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;We have determined the products we have investigated are not vulnerable due to either using a version of OpenSSL that is not vulnerable or are not using OpenSSL.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://h17007.www1.hp.com/docs/advisories/HPNetworkingSecurityAdvisory-OpenSSL-HeartbleedVulnerability.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;HP Networking Communication: OpenSSL HeartBleed Vulnerability&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Huawei&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As of April 14&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The investigation has been completed and it is confirmed that some Huawei products are affected. Huawei has prepared a fixing plan and started the development and test of fixed versions. Huawei will release an SA as soon as possible. Please stay tuned.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://www.huawei.com/en/security/psirt/security-bulletins/security-notices/hw-331856.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Security Notice-Statement on OpenSSL Heartbeat Extension Vulnerability&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Juniper&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Vulnerable Products&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Junos OS 13.3R1&lt;/li&gt;&#xA;  &lt;li&gt;Odyssey client 5.6r5 and later&lt;/li&gt;&#xA;  &lt;li&gt;SSL VPN (IVEOS) 7.4r1 and later, and SSL VPN (IVEOS) 8.0r1 and later (Fixed code is listed in the &quot;Solution&quot; section)&lt;/li&gt;&#xA;  &lt;li&gt;UAC 4.4r1 and later, and UAC 5.0r1 and later (Fixed code is listed in the &quot;Solution&quot; section)&lt;/li&gt;&#xA;  &lt;li&gt;Junos Pulse (Desktop) 5.0r1 and later, and Junos Pulse (Desktop) 4.0r5 and later&lt;/li&gt;&#xA;  &lt;li&gt;Network Connect (windows only) version 7.4R5 to 7.4R9.1 &amp;amp; 8.0R1 to 8.0R3.1. (This client is only impacted when used in FIPS mode.)&lt;/li&gt;&#xA;  &lt;li&gt;Junos Pulse (Mobile) on Android version 4.2R1 and higher.&lt;/li&gt;&#xA;  &lt;li&gt;Junos Pulse (Mobile) on iOS version 4.2R1 and higher. (This client is only impacted when used in FIPS mode.)&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=JSA10623&quot; rel=&quot;nofollow noreferrer&quot;&gt;Juniper Knowledge Center - 2014-04 Out of Cycle Security Bulletin: Multiple products affected by OpenSSL &quot;Heartbleed&quot; issue (CVE-2014-0160)&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Palo Alto Networks&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://researchcenter.paloaltonetworks.com/2014/04/palo-alto-networks-addresses-heartbleed-vulnerability-cve-2014-0160/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PAN-OS was not affected by heartbleed&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h1&gt;Workarounds&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Disable resources that utilize SSL, if you can, and rely on SSH which, as &lt;a href=&quot;https://superuser.com/a/739350/77053&quot;&gt;Mike Pennington commented&lt;/a&gt; is not vulnerable.  &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt;&lt;sub&gt;This listing was taken on 10 April 2014, vendors may still have their products under investigation. This listing is &lt;strong&gt;not&lt;/strong&gt; a vulnerability guideline, and only serves to give the original poster an understanding of the scope of impact on networking equipment.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2014-04-15T07:46:12.683" CommentCount="4" CommunityOwnedDate="2014-04-10T08:07:29.637" ContentLicense="CC BY-SA 3.0" />
  <row Id="7306" PostTypeId="2" ParentId="7299" CreationDate="2014-04-10T08:05:58.513" Score="2" Body="&lt;p&gt;ACLs, NAT and routing are pretty much the only thing that will stop this traffic from getting through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because you said if you put a permit ip any any on your outside ACL then I believe NAT and routing are working fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Place an ACL to permit from anywhere to your MAPPED or NAT'd IP. This is probably the public IP and not the private IP of your exchange server. In ASA 8.2(5) and below the ACLs use the NAT'd IP. In ASA 8.3 and above the ACLs use the real IP. Make sure that ACL is above any other denies. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turn logging on and make sure your denies are getting logged. Watch the logs to find out what rule you're getting denied by.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As another person said, try using the packet tracer command/wizard to simulate the packet coming in through the outside interface and take note of where it gets stopped.&lt;/p&gt;&#xA;" OwnerUserId="949" LastEditorUserId="949" LastEditDate="2014-04-10T08:14:24.630" LastActivityDate="2014-04-10T08:14:24.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7308" PostTypeId="1" AcceptedAnswerId="7309" CreationDate="2014-04-10T12:01:57.483" Score="5" ViewCount="1526" Body="&lt;p&gt;I understand that connecting to a wireless network using a WEP/WPA key is also encrypting the data you send over the network, hiding it from potential sniffers in range of the network (please correct me if I am wrong here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is an unsecured wireless network (that is not secured with a WEP or WPA key), but relying on web authentication via a &lt;a href=&quot;http://en.wikipedia.org/wiki/Captive_portal&quot; rel=&quot;nofollow&quot;&gt;Captive Portal&lt;/a&gt; a safe network? Is data that I am transferring (after authentication) over such a network transparent to the outside world? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How about users also authenticated over the &lt;a href=&quot;http://en.wikipedia.org/wiki/Captive_portal&quot; rel=&quot;nofollow&quot;&gt;Captive Portal&lt;/a&gt; web authentication page? Can someone sniff the &lt;a href=&quot;http://en.wikipedia.org/wiki/Captive_portal&quot; rel=&quot;nofollow&quot;&gt;Captive Portal&lt;/a&gt; traffic and get hold of the data?&lt;/p&gt;&#xA;" OwnerUserId="5196" LastEditorUserId="5196" LastEditDate="2014-04-11T12:52:15.480" LastActivityDate="2014-04-11T12:52:15.480" Title="Are users of Captive Portal wifi (web authentication) vulnerable to sniffing?" Tags="|wireless|security|authentication|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7309" PostTypeId="2" ParentId="7308" CreationDate="2014-04-10T12:57:37.680" Score="4" Body="&lt;p&gt;Putting aside the question of how one would define a &quot;safe network,&quot; web authentication is typically used to restrict access by wireless users to a resource, such as a corporate network, or Internet access.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without using some form of encryption, anyone within range can sniff traffic and eavesdrop on the data being sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, using web authentication alone provides &lt;strong&gt;no&lt;/strong&gt; confidentiality.  Your data is accessible for anyone interested in it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-04-10T12:57:37.680" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7311" PostTypeId="2" ParentId="7278" CreationDate="2014-04-10T19:37:56.067" Score="1" Body="&lt;p&gt;It does indeed seem that the problem is on your Openswan server.  These lines from the output of your ASA indicates the Firewall has never received any packets through the VPN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0&#xA;  #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(from the command &quot;show ipsec sa&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry, I don't know Openswan very well (or at all), so I'm unable to provide any suggestions to that regards.  :(&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-04-10T19:37:56.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7312" PostTypeId="2" ParentId="7291" CreationDate="2014-04-10T20:57:05.643" Score="1" Body="&lt;p&gt;Have you considered making a loopback interface on the distant end router/firewall (whatever the other end tunnel device is) and monitoring that?  You could make it an RFC 1918 address and only accessible via the VPN tunnel.  That should give you something to monitor that isn't affected by equipment/network instability at the distant end.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-04-10T20:57:05.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7313" PostTypeId="2" ParentId="6616" CreationDate="2014-04-10T21:11:07.070" Score="2" Body="&lt;p&gt;I had this problem but after trial/error finally fixed it.  Before I start, let me just say that sonicwall documentation and support has gotten so much worse since the acquisition by Dell that I am moving away from sonicwall to almost any other solution (hi cisco + pan) when our support contract is up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I followed the rev b document 'configuring sonicos for amazon vpc' also.  I configured it with dynamic tunnels with bgp (just because) and it came up.  Not that the config document helped because the cli commands don't match with the reality of sonicwall firmware 5.9 on an nsa3500.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After getting the tunnels up and running and the bgp routes advertised, I could not route traffic from our lan (192.168.0.0/16) to the subnet of our vpc on amazon (10.23.0.0/16).  I was convinced it was firewall rules until I took another look at the sonicwall routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, I had to create in the gui rules that should have been declared in the bgp cli config, and were not at all mentioned in the rev b config doc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rules I created were&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;source: any&#xA;destination : amazon vpc subnet 10.23.0.0/16&#xA;service: any&#xA;tos: any&#xA;gateway: 0.0.0.0&#xA;interface: ti2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did another rule exactly the same for the ti3 tunnel interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suddenly I was able to ssh into the ec2 instances instead of just being able to ping them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm so upset with at sonicwall / dell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps somebody. Conversely, if there are any thoughts on how to improve this I'm all ears.&lt;/p&gt;&#xA;" OwnerUserId="5206" LastEditorUserId="775" LastEditDate="2015-05-30T08:47:13.447" LastActivityDate="2015-05-30T08:47:13.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7316" PostTypeId="1" AcceptedAnswerId="7318" CreationDate="2014-04-11T02:31:09.757" Score="4" ViewCount="2096" Body="&lt;p&gt;I do not understand when will the core layer is needed. All the materials that I have read in general say that core layer should switch traffic quickly and no filtering. None say when or in what situations the core layer is implemented.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2014-04-12T21:44:39.247" Title="Network hierarchy model - Situation to implement core layer" Tags="|design|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7318" PostTypeId="2" ParentId="7316" CreationDate="2014-04-11T04:46:25.403" Score="7" Body="&lt;p&gt;For smaller deployments a Collapsed Core is usually fine. Collapsed Core means that some devices perform both Distribution and Core layer duties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With just a few Access switches there's no need to build a large Core.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a large network then you will have many Access switches. Let's say that you have 20 Distribution switches. Connecting all the Distribution switches would be a huge waste of ports and fiber and you would also need a lot of routing peerings. For everytime you add a new  Distribution switch there would be a lot of work connecting it to the others and putting in new routing statements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For those situations it makes sense to use a Core, you would then only add maybe two connections from each Distribution switch to the Core. The number of peerings on the Distribution layer switches would be a lot less as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main factor is scalability but other things could affect as well like speeds and feeds, the distance your network is covering, external connections and factors like that.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-04-11T04:46:25.403" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="7321" PostTypeId="1" AcceptedAnswerId="7326" CreationDate="2014-04-11T10:32:12.573" Score="2" ViewCount="192" Body="&lt;p&gt;Assume I need ping from R1 to R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX1 is Primary. All necessary zones,security policies are assigned. Also two interfaces are placed into different routing-instances called VR1 and VR2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the ping command from R1 to R2 will allow ! IS NOT IT ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If SRX1  become disable, then SRX2 become primary. In that case traffic must follow via trunk between of switches (Ex2200).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I right ???&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/39o09.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/39o09.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4635" LastEditorUserId="775" LastEditDate="2014-04-11T10:36:19.507" LastActivityDate="2014-04-11T15:43:15.323" Title="Behavior while chasis clustering between SRX650" Tags="|juniper-srx|switch|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7322" PostTypeId="1" CreationDate="2014-04-11T12:37:02.503" Score="5" ViewCount="1754" Body="&lt;p&gt;I'm thinking about doing a routed access layer datacenter design with OSPF.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;couple TORs switches from every rack connect to a pair of core switches via l3 links&lt;/li&gt;&#xA;&lt;li&gt;every rack is it's own totally stubby area. About 200 racks, total about 400 switches. TORs are either 4948s or nexus 3k&lt;/li&gt;&#xA;&lt;li&gt;Core Acts as ABRs. Cores are chassis bases high end boxes (nexus 7k, or juniper 9200 etc)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The idea is to just have a default on the TORs and keep the LSA database small, hence unique area per rack. Should i be concerned about ABRs (cores) generating that many type 3 LSA for different areas?&lt;/p&gt;&#xA;" OwnerUserId="5217" LastEditorUserId="775" LastEditDate="2014-04-11T14:22:06.063" LastActivityDate="2014-04-24T16:18:43.117" Title="OSPF Data Center Design" Tags="|cisco|ospf|design|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="7325" PostTypeId="2" ParentId="5343" CreationDate="2014-04-11T15:27:23.653" Score="1" Body="&lt;p&gt;I believe the answer from John Kennedy is the correct way to do things for other model of switches. However after being in correspondence with Dell there is a limitation in the PowerConnect 6248 firmware currently and the topology we are running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will have to wait for future released firmware.&lt;/p&gt;&#xA;" OwnerUserId="3449" LastEditorUserId="343" LastEditDate="2014-04-15T23:48:34.357" LastActivityDate="2014-04-15T23:48:34.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7326" PostTypeId="2" ParentId="7321" CreationDate="2014-04-11T15:43:15.323" Score="2" Body="&lt;p&gt;If I understand your question correctly, you are at least partially right.  For HA failover, you'll need the same ports to have access to the same VLANs.  You'll need to trunk VLANs 172 and 192 between your two EX2200 switches and you'll need to make sure both VLANs are available to SRX-1 and SRX-2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For pings from R1 to R2, it sounds like you're trying to use VRFs which should actually keep them from talking to each other.  If you want them to talk, they should be in the same routing instance.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-04-11T15:43:15.323" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7328" PostTypeId="1" AcceptedAnswerId="7329" CreationDate="2014-04-11T17:01:28.060" Score="1" ViewCount="115" Body="&lt;p&gt;I am attempting to get a decent understanding of simple networking as I am opening a new business alongside an existing and attempt to do the IT work myself, seeing as we don't have a great demand in that department. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My existing network is below as &lt;em&gt;Network 1&lt;/em&gt; and I want to ensure our new network at a different location is completely separate so that when we eventually introduce a VPN there won't be any issues with regards to it. Can someone confirm that the below are totally separate and don't interfere with each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway: 192.168.100.1&#xA;Range: 192.168.100.1 - 192.168.100.255&#xA;Subnet: 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway: 192.168.101.1&#xA;Range: 192.168.101.1 - 192.168.101.255&#xA;Subnet: 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="5222" LastEditorUserId="3191" LastEditDate="2014-12-08T20:22:02.853" LastActivityDate="2014-12-08T20:22:02.853" Title="A simple networking question, but not for me!" Tags="|subnet|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7329" PostTypeId="2" ParentId="7328" CreationDate="2014-04-11T17:43:35.000" Score="3" Body="&lt;p&gt;Since the &lt;code&gt;192.168.100.0/24&lt;/code&gt; and &lt;code&gt;192.168.101.0/24&lt;/code&gt; ranges are on different networks, you won't have any issues when you do decide to setup a connection between the two.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="2142" LastEditDate="2014-04-11T17:45:26.037" LastActivityDate="2014-04-11T17:45:26.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7331" PostTypeId="1" AcceptedAnswerId="26616" CreationDate="2014-04-11T18:38:31.780" Score="5" ViewCount="1568" Body="&lt;p&gt;*&lt;em&gt;edited to be more specific&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two mobile trailers and two retail stores.  The trailers travel around the country as a mobile retail store.  Each location is running a IP scheme as 192.168.1.xxx, 192.168.2.xxx, 192.168.3.xxx, 192.168.4.xxx respectively.  99% of the traffic is internal since all the web and database servers, POS systems, etc are on board.  Using a CradlePoint MBR1400 wireless router access the internet via mobile broadband.  But the internet is mainly for just checking email, and music.  No VPN or anything else is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every once in a while, to expand the number of POS systems and the number of customers we can process, two trailers or a trailer and a retail store need to work together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being that each location can operate independently they run their own databases.  So when we bring them together we only run one database server, one web server.  on the &quot;master&quot; trailer (say the one running 192.168.1.xxx).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the POS system is all web based, the slave trailer would simply point to the master web server 192.168.1.3.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I simply need to know how to setup routes, so on the slave (192.168.2.x) I can type in 192.168.1.3 and reach the master web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know CradlePoint allows RIP, OSPF, BGP, and static routes.  Is there any way I can get these two networks talking to each other?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="5216" LastEditorUserId="5216" LastEditDate="2014-04-13T17:55:27.337" LastActivityDate="2016-02-07T21:03:19.267" Title="Routing 101 help with two CradlePoint Routers" Tags="|routing|router|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7336" PostTypeId="2" ParentId="7203" CreationDate="2014-04-12T08:55:59.800" Score="4" Body="&lt;p&gt;It wasnt that difficult to figure out once i went into the Mikrotik router. I just configured 2 static routes pointing towards the ISPs with different administrative distances. The main ISP with a lower administrative distance and a ping check on it so that once it goes down, the second ISP kicks in. To this, i logged into the Mikrotik router with winbox and went to IP tab. I chose routes from the drop down menu. The rest was self explanatory. After configuring it, i pulled the cable from ISP1 and PCs on the LAN were still able to surf the internet. I ran a tracert 4.2.2.2 which returned the backup ISP's router. I plugged the cable from ISP1 back into the router and immediately ran a tracer 4.2.2.2 which returned ISP1's router. Thanks  everybody for your help. &lt;/p&gt;&#xA;" OwnerUserId="4439" LastEditorUserId="4439" LastEditDate="2014-04-12T09:09:45.343" LastActivityDate="2014-04-12T09:09:45.343" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7340" PostTypeId="2" ParentId="7316" CreationDate="2014-04-12T21:44:39.247" Score="4" Body="&lt;p&gt;Totally agree with Daniel Dib's response towards scalability and other good points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the main issues we experienced towards implementing a layered access -&gt;distribution/core solution is spanning-tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say you implement an access-&gt; distribution/core solution and you have many buildings/floors/departments with many access switches. What we have seen is when someone introduces (accidentally) a spanning-tree loop the cpu on your core goes through the roof (nearly). ALL of the users cannot use their computers, internet, file servers, etc... and the whole infrastructure suffers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To alleviate this issue, I would recommend to implement an access/distribution -&gt; core solution for your zones/buildings. Keep your vlans and the spanning-tree root roles for these vlans on the distribution switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say you have 4 distribution switches connected to your core(s) and a routing protocol taking care of your internal routing between the distribution and the core switches, should one of the distribution switches suffer from a spanning tree loop, only that zone is affected and your other three zones/buildings continue to function unaffected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That makes troubleshooting somewhat easier :-)&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2014-04-12T21:44:39.247" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7342" PostTypeId="1" AcceptedAnswerId="7344" CreationDate="2014-04-13T05:49:38.717" Score="4" ViewCount="396" Body="&lt;p&gt;It is said that MSTP is used to group VLANs for different logical topologies. Can it be used to group individual VLANs (one VLAN per group) to imitate the behavior of Cisco's Rapid PVST (unique logical topology per VLAN)?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="775" LastEditDate="2014-04-13T10:47:08.773" LastActivityDate="2014-04-14T19:11:34.403" Title="Can MSTP (802.1s) be used to emulate Rapid-PVST?" Tags="|vlan|spanning-tree|ieee-802.1s|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7343" PostTypeId="1" AcceptedAnswerId="7346" CreationDate="2014-04-13T06:13:47.910" Score="5" ViewCount="315" Body="&lt;p&gt;Based on &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/HA_campus_DG/hacampusdg.html#wp1107706&quot; rel=&quot;nofollow noreferrer&quot;&gt;network design model proposed by Cisco&lt;/a&gt;, the firewall is for traffic to/from internet and there is no dedicated firewall for traffic to/from intranet. Is firewall on distribution switch is great enough e.g. Cisco catalyst 3560 switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on figure below. Assume that the in-switch firewall of 3560 is not enough. Let's say there is no VLAN and there are 2 departments, finance and marketing, separated by their access switch on the same distribution switch. Both departments contain sensitive information both in user computers and servers. However, users from both department have to communicate with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VW2dC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Allowing users to communicate with each other in different department has opened attacking opportunity. For example, users in finance department can send malicious program to users in marketing department and vice versa if they communicate with each other by using chat program, for example Skype.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where should a dedicated firewall to be placed if traffic between these two departments has to be inspected?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update 1: Added picture and details.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="5014" LastEditDate="2014-04-13T11:13:06.343" LastActivityDate="2014-04-13T11:38:24.860" Title="Where to put dedicated firewall for two departments separated by their own access switches and connected through a same distribution switch?" Tags="|switch|firewall|design|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7344" PostTypeId="2" ParentId="7342" CreationDate="2014-04-13T08:25:22.123" Score="4" Body="&lt;p&gt;Yes it can. In this case, you'll need to create an MSTP instance (in all the switches invloved) and include only one VLAN in that instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample configuration on a cisco Catalyst switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree mode mst&#xA;spanning-tree mst configuration&#xA; name NAME&#xA; revision 2&#xA; instance 1 vlan 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: This will work as long as the number of VLAN's for which you are creating separate topologies is less than or equal to the maximum number of MSTP instances you can creat on a switch. This maximum is in turn determined by the switch model, software version and/or license level.&lt;/p&gt;&#xA;" OwnerDisplayName="user5029" LastEditorDisplayName="user5029" LastEditDate="2014-04-14T19:11:34.403" LastActivityDate="2014-04-14T19:11:34.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7345" PostTypeId="2" ParentId="7331" CreationDate="2014-04-13T09:10:15.200" Score="0" Body="&lt;p&gt;Because you have only two internal networks connected over Ethernet, the easiest way is to configure one static route on every router for the remote internal LAN.&#xA;On router 1: 192.168.2.0/24 with next-hop (gateway) IP address of second router&#xA;On router 2: 192.168.1.0/24 with next-hop (gateway) IP address of first router &lt;/p&gt;&#xA;" OwnerUserId="5234" LastActivityDate="2014-04-13T09:10:15.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7346" PostTypeId="2" ParentId="7343" CreationDate="2014-04-13T11:32:15.750" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Where should a dedicated firewall to be placed if traffic between these two departments has to be inspected?Where should a dedicated firewall to be placed if traffic between these two departments has to be inspected?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Replace the c3560 with a firewall and IPS module; I operate a topology similar to this at work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're merely concerned about 3rd party chat programs like Skype;  the best option is blocking all skype traffic going to the internet altogether.  That way, nobody will even be able to connect to the skype service and find other parties.  It isn't worth firewalling departments if skype is the only problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No matter what you also need endpoint security solutions which scan for viruses and account for authorized/unauthorized applications.  Consider the reality that files are shared with usb sticks as well.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-04-13T11:38:24.860" LastActivityDate="2014-04-13T11:38:24.860" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7350" PostTypeId="1" AcceptedAnswerId="18895" CreationDate="2014-04-13T13:36:57.677" Score="4" ViewCount="850" Body="&lt;p&gt;I want to run a PBX behind a firewall behind a DOCSIS modem. Our ISP does not want to deploy a TA / gateway at our site. Our ISP only uses the modem for analog telephony and nothing else. QoS for voice on DOCSIS lines is achieved by having two MACs for each modem. One address for access, one address for voice. Because of that it seems to me that an ISP cannot deliver QoS for voice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, we want to have a PBX. There are cable companies which provide my desired service. I suspect the reason for not providing a SIP trunk is that there is no direct routing to the customer's site. Is it possible to run a SIP trunk under these circumstances?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;WAN ---&gt; DOCSIS 3 ---&gt; modem as bridge ---&gt; service IP by DHCP ---&gt; customer's own device. Subnet routed via service IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The customer's router is connected to a DOCSIS modem in bridge mode. By requesting an IP via DHCP on the WAN interface, a varying service IP is assigned which is the last hop to the customer's booked subnet. The subnet is statically routed via a service address. Therefore, no public IP can be assigned to a WAN interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually, a VoIP solution independent from the ISP requires the reservation of an IP within the customer's network at the SBC for billing and QoS - as it is common practice via DSL lines. Considering the indirect routing and DOCSIS in between, is a SIP trunk possible?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Parties involved: ISP running the WAN and the SBC. Customer running the router and the PBX.&lt;/li&gt;&#xA;&lt;li&gt;200.0.8.0/28 is a public network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BwoTu.png&quot; alt=&quot;Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router's LAN interface and the PBX share the same network permanently routed routed via the service IP by the ISP. PBX's address is supposed to be listed by ISP's SBC to allow VoIP.&lt;/li&gt;&#xA;&lt;li&gt;Router requests an address via DHCP and is assigned the service address which basically is the same one but may change due to technicalities, meaning it is not a static public IP in the narrow sense of the word.&lt;/li&gt;&#xA;&lt;li&gt;Modem is invisible to the Internet and inaccessible to Router.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="3163" LastEditDate="2014-04-15T07:09:51.303" LastActivityDate="2015-06-02T02:10:04.580" Title="QoS for IP PBX behind DOCSIS modem (SIP trunk without direct routing by ISP)" Tags="|trunk|sip|cable|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="7353" PostTypeId="1" AcceptedAnswerId="7363" CreationDate="2014-04-13T22:09:01.993" Score="5" ViewCount="10031" Body="&lt;p&gt;I am confused on the definition of Packet Loss Rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it the number of packets lost per unit of time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is is the number of packets lost per number of packets sent?&lt;/p&gt;&#xA;" OwnerUserId="5241" LastEditorUserId="25248" LastEditDate="2016-05-10T14:21:33.060" LastActivityDate="2016-05-10T19:56:05.457" Title="What is Packet Loss Rate?" Tags="|packet-loss|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7358" PostTypeId="1" AcceptedAnswerId="7398" CreationDate="2014-04-14T09:50:52.807" Score="4" ViewCount="4022" Body="&lt;p&gt;I need to view POST details on Cisco 1841 Routers and Cisco 2950 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried &lt;code&gt;show post&lt;/code&gt; and &lt;code&gt;show diagnostics post&lt;/code&gt;. However, both these commands are not available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the command that needs to be used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time!&lt;/p&gt;&#xA;" OwnerUserId="4795" LastActivityDate="2014-04-16T13:29:02.403" Title="View Power On Self Test (POST) details on Cisco 1841 Routers and Cisco 2950 switches" Tags="|cisco|cisco-ios|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7360" PostTypeId="1" CreationDate="2014-04-14T11:32:15.927" Score="4" ViewCount="2087" Body="&lt;p&gt;I am trying to modify aodv protocol to implement a flooding attack prevention scheme in MANET in NS-3 for my first assignment from an already published paper. The method is to prevent a malicious node from forwarding excessive RREQ packets by its neighbors. The neighbors of the intruder node record its behavior and check its trust by a trust function. Once the fixed threshold for the RREQ limit is reached, nodes deny any RREQ from the malicious node. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am just in an initial stage of learning NS-3 as in how to edit a protocol and make the changes into effect. It is my first experience with a simulator tool like NS-3. I am really not able to find a helpful resource material to learn the basics of NS-3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Initially while learning to run a .cc file from my newly created folder in &lt;code&gt;ns-3/ns-allinone-3.19/ns-3.19/src&lt;/code&gt; I tried the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;copied the aodv folder in the location &lt;code&gt;ns-3/ns-allinone-3.19/ns-3.19/src&lt;/code&gt; and renamed the folder as &lt;code&gt;test&lt;/code&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then I renamed the &lt;code&gt;aodv.cc&lt;/code&gt; file in &lt;code&gt;ns-3/ns-allinone-3.19/ns-3.19/src/test/examples&lt;/code&gt; to &lt;code&gt;aodv1.cc&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;-Next I replaced for all occurrences of &lt;code&gt;aodv.cc&lt;/code&gt; with &lt;code&gt;aodv1.cc&lt;/code&gt; in &lt;code&gt;wscript&lt;/code&gt; file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Next I tried to run &lt;code&gt;aodv1.cc&lt;/code&gt; using the command &lt;code&gt;./waf --run aodv1.cc&lt;/code&gt;; I get the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Waf: Entering directory `.../ns-3/ns-allinone-3.19/ns-3.19/build'&#xA; Could not find a task generator for the name 'ns3-test'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone please help with the basic steps to be followed to modify a protocol in NS-3 especially related to what are the changes to be made in other file in NS-3 while renaming and editing a file say &lt;code&gt;aodv.cc&lt;/code&gt;. I am really messing up even with learning these basics of NS-3.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Screenshot&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;....:~/ns-3/ns-allinone-3.19/ns-3.19$ ./waf distclean&#xA;'distclean' finished successfully (0.198s)&#xA;....:~/ns-3/ns-allinone-3.19/ns-3.19$ ./waf configure &#xA;Setting top to                           : ..../ns-3/ns-allinone-3.19/ns-3.19 &#xA;Setting out to                           : ..../ns-3/ns-allinone-3.19/ns-3.19/build &#xA;Checking for 'gcc' (c compiler)          : /usr/bin/gcc &#xA;Checking for cc version                  : 4.7.3 &#xA;Checking for 'g++' (c++ compiler)        : /usr/bin/g++ &#xA;Checking for compilation flag -Wl,--soname=foo... support : ok &#xA;Checking for program python                               : /usr/bin/python &#xA;Checking for python version                               : (2, 7, 4, 'final', 0) &#xA;Checking for library python2.7 in LIBDIR                  : yes &#xA;Checking for program /usr/bin/python-config,python2.7-config,python-config-2.7,python2.7m-config : /usr/bin/python-config &#xA;Checking for header Python.h                                                                     : yes &#xA;Checking for compilation flag -fvisibility=hidden... support                                     : ok &#xA;Checking for compilation flag -Wno-array-bounds... support                                       : ok &#xA;Checking for pybindgen location                                                                  : ../pybindgen-0.16.0.834 (guessed) &#xA;Python module pybindgen                                                                          : ok &#xA;Checking for pybindgen version                                                                   : 0.16.0.834 &#xA;Checking for types uint64_t and unsigned long equivalence                                        : yes &#xA;Checking for types uint64_t and unsigned long long equivalence                                   : no &#xA;Checking for the apidefs that can be used for Python bindings                                    : gcc-LP64 &#xA;Checking for internal GCC cxxabi                                                                 : complete &#xA;Python module pygccxml                                                                           : not found &#xA;Checking boost includes                                                                          : 1_49 &#xA;Checking boost libs                                                                              : ok &#xA;Checking for boost linkage                                                                       : ok &#xA;Checking for click location                                                                      : not found &#xA;Checking for program pkg-config                                                                  : /usr/bin/pkg-config &#xA;Checking for 'gtk+-2.0' &amp;gt;= 2.12                                                                  : yes &#xA;Checking for 'libxml-2.0' &amp;gt;= 2.7                                                                 : yes &#xA;Checking for type uint128_t                                                                      : not found &#xA;Checking for type __uint128_t                                                                    : yes &#xA;Checking high precision time implementation                                                      : 128-bit integer &#xA;Checking for header stdint.h                                                                     : yes &#xA;Checking for header inttypes.h                                                                   : yes &#xA;Checking for header sys/inttypes.h                                                               : not found &#xA;Checking for header sys/types.h                                                                  : yes &#xA;Checking for header sys/stat.h                                                                   : yes &#xA;Checking for header dirent.h                                                                     : yes &#xA;Checking for header stdlib.h                                                                     : yes &#xA;Checking for header signal.h                                                                     : yes &#xA;Checking for header pthread.h                                                                    : yes &#xA;Checking for header stdint.h                                                                     : yes &#xA;Checking for header inttypes.h                                                                   : yes &#xA;Checking for header sys/inttypes.h                                                               : not found &#xA;Checking for library rt                                                                          : yes &#xA;Checking for header netpacket/packet.h                                                           : yes &#xA;Checking for header sys/ioctl.h                                                                  : yes &#xA;Checking for header net/if.h                                                                     : yes &#xA;Checking for header net/ethernet.h                                                               : yes &#xA;Checking for header linux/if_tun.h                                                               : yes &#xA;Checking for header netpacket/packet.h                                                           : yes &#xA;Checking for NSC location                                                                        : not found &#xA;Checking for OpenFlow location                                                                   : ../openflow (guessed) &#xA;Checking for library dl                                                                          : yes &#xA;Checking for library xml2                                                                        : yes &#xA;Checking for library openflow                                                                    : yes &#xA;Checking for 'sqlite3'                                                                           : yes &#xA;Checking for header linux/if_tun.h                                                               : yes &#xA;Python module gtk                                                                                : ok &#xA;Python module goocanvas                                                                          : not found &#xA;Python module pygraphviz                                                                         : not found &#xA;Checking for program sudo                                                                        : /usr/bin/sudo &#xA;Checking for program valgrind                                                                    : /usr/bin/valgrind &#xA;Checking for 'gsl'                                                                               : yes &#xA;Checking for compilation flag -Wno-error=deprecated-d... support                                 : ok &#xA;Checking for compilation flag -Wno-error=deprecated-d... support                                 : ok &#xA;Checking for compilation flag -fstrict-aliasing... support                                       : ok &#xA;Checking for compilation flag -fstrict-aliasing... support                                       : ok &#xA;Checking for compilation flag -Wstrict-aliasing... support                                       : ok &#xA;Checking for compilation flag -Wstrict-aliasing... support                                       : ok &#xA;Checking for program doxygen                                                                     : /usr/bin/doxygen &#xA;---- Summary of optional NS-3 features:&#xA;Python Bindings               : enabled&#xA;Python API Scanning Support   : not enabled (Missing 'pygccxml' Python module)&#xA;BRITE Integration             : not enabled (BRITE not enabled (see option --with-brite))&#xA;NS-3 Click Integration        : not enabled (nsclick not enabled (see option --with-nsclick))&#xA;GtkConfigStore                : enabled&#xA;XmlIo                         : enabled&#xA;Threading Primitives          : enabled&#xA;Real Time Simulator           : enabled&#xA;Emulated Net Device           : enabled&#xA;File descriptor NetDevice     : enabled&#xA;Tap FdNetDevice               : enabled&#xA;Emulation FdNetDevice         : enabled&#xA;PlanetLab FdNetDevice         : not enabled (PlanetLab operating system not detected (see option --force-planetlab))&#xA;Network Simulation Cradle     : not enabled (NSC not found (see option --with-nsc))&#xA;MPI Support                   : not enabled (option --enable-mpi not selected)&#xA;NS-3 OpenFlow Integration     : enabled&#xA;SQlite stats data output      : enabled&#xA;Tap Bridge                    : enabled&#xA;PyViz visualizer              : not enabled (Missing python modules: goocanvas, pygraphviz)&#xA;Use sudo to set suid bit      : not enabled (option --enable-sudo not selected)&#xA;Build tests                   : not enabled (defaults to disabled)&#xA;Build examples                : not enabled (defaults to disabled)&#xA;GNU Scientific Library (GSL)  : enabled&#xA;'configure' finished successfully (10.951s)&#xA;...:~/ns-3/ns-allinone-3.19/ns-3.19$ ./waf&#xA;Waf: Entering directory `..../ns-3/ns-allinone-3.19/ns-3.19/build'&#xA;Could not find a task generator for the name 'ns3-test'&#xA;....:~/ns-3/ns-allinone-3.19/ns-3.19$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5118" LastEditorUserId="775" LastEditDate="2014-04-17T02:55:48.223" LastActivityDate="2014-04-17T02:55:48.223" Title="Modification of aodv protocol in ns-3" Tags="|ad-hoc-wireless|" AnswerCount="0" CommentCount="0" ClosedDate="2019-05-07T15:02:22.173" ContentLicense="CC BY-SA 3.0" />
  <row Id="7363" PostTypeId="2" ParentId="7353" CreationDate="2014-04-14T15:42:24.817" Score="6" Body="&lt;p&gt;Both are possible. If no units are mentioned, I would assume it means&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(# packets lost)/(# packet sent)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often, this ratio will be given as a percentage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When 'packet loss rate' is meant as a rate per unit of time, that unit of time should be specified.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-04-14T15:42:24.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7365" PostTypeId="1" CreationDate="2014-04-14T17:30:05.917" Score="2" ViewCount="402" Body="&lt;p&gt;I have a router Cisco 1812 (P/N CISCO1812/K9).&#xA;My question is if it possible to run Call Manager Express into its IOS and which version.&lt;/p&gt;&#xA;" OwnerUserId="5248" LastEditorUserId="775" LastEditDate="2014-04-14T19:22:28.597" LastActivityDate="2014-04-14T19:22:28.597" Title="Is it possible to run CME in a Cisco 1812" Tags="|cisco|voip|cisco-voip|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7367" PostTypeId="1" AcceptedAnswerId="7368" CreationDate="2014-04-14T18:03:23.693" Score="3" ViewCount="5339" Body="&lt;p&gt;I have seen spanning tree being configured on switches to prevent switching loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently noticed that &lt;code&gt;show spanning tree&lt;/code&gt; command works on a Cisco 1841 router as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what reasons would we want to configure spanning-tree on router. Any examples?&lt;/p&gt;&#xA;" OwnerUserId="4795" LastActivityDate="2014-04-15T19:27:01.310" Title="Configure spanning-tree on Cisco router" Tags="|cisco|cisco-ios|spanning-tree|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7368" PostTypeId="2" ParentId="7367" CreationDate="2014-04-14T18:36:38.657" Score="6" Body="&lt;p&gt;&lt;strong&gt;On a general note&lt;/strong&gt;: not everything that is present in parser, will actually work on given platform, or even makes sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that particular case, you can enable spanning tree if you have either IRB (integrated routing &amp;amp; bridging) configured on ethernet ports, or you insert the integrated switching module (WIC-4ESW) into the router. Then, those ports are L2 by default and actually it makes sense to run STP on them to avoid loops.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-04-14T18:36:38.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7369" PostTypeId="2" ParentId="7365" CreationDate="2014-04-14T18:47:05.790" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp&quot; rel=&quot;nofollow&quot;&gt;http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/1800-series-integrated-services-routers-isr/index.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/routers/1800-series-integrated-services-routers-isr/index.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doesn't look like it.  The only 1800-series Cisco router that supports CME is the 1861.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-04-14T18:47:05.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7370" PostTypeId="2" ParentId="7365" CreationDate="2014-04-14T18:52:32.443" Score="3" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/c/en/us/support/unified-communications/unified-communications-manager-express/products-device-support-tables-list.html&quot; rel=&quot;nofollow&quot;&gt;CUCME compatibility information&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1861 can run CUCME 7.X and CUCME 8.X up to 8.6 &lt;/li&gt;&#xA;&lt;li&gt;1861E can run CUCME 8.8, 9.X and 10.0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;No mentions to 1812 even in earlier versions of CUCME. So looks like you can not run CUCME in 1812.  &lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2014-04-14T18:52:32.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7371" PostTypeId="1" CreationDate="2014-04-14T19:37:18.480" Score="4" ViewCount="1128" Body="&lt;p&gt;Virtual Router: I have 1 ASR router that already has a multi-homed EBGP setup on AS#XXXXX, and I need an isolated BGP process that is also multi-homed (separate circuits) with a completely different AS#YYYYY, with complete route isolation (VRFs).  I've seen techniques such as per-vrf BGP router-id and local-as, replace-as.  My question is whether this is a safe technique for a long-term deployment.  I absolutely cannot have any bleed-over between the two AS#s.  They are treated as completely different entities.&lt;/p&gt;&#xA;" OwnerUserId="5251" LastActivityDate="2014-04-14T20:48:20.233" Title="Cisco ASR Multiple BGP processes" Tags="|cisco|bgp|vrf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7372" PostTypeId="2" ParentId="7371" CreationDate="2014-04-14T20:48:20.233" Score="4" Body="&lt;p&gt;This would be a good fit for a VDC but looking it up I dont see the ASR supports VDCs, unless Im missing something. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VRFs are going to give you route table separation and should do the job quite well as long as you insure routes do not bleed between VRFs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is a virtual ASR could you not stand up a second and have it dedicated to the second AS? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a thought.&lt;/p&gt;&#xA;" OwnerUserId="1433" LastActivityDate="2014-04-14T20:48:20.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7373" PostTypeId="1" CreationDate="2014-04-14T21:01:26.930" Score="4" ViewCount="235" Body="&lt;p&gt;I need to erase all the settings on our old Cisco switches. I have already logged into (&lt;code&gt;enable-mode&lt;/code&gt; after password reset). Now I'm not sure what exactly I need to erase in the (dir) I noticed there is the config.text/vlan.dat files....Do I need to remove those? When I &quot;more&quot; command the config.text file it shows a lot of ip,vlan,etc data that looks like it should be removed before we get rid of these.&lt;/p&gt;&#xA;" OwnerUserId="5252" LastEditorUserId="52517" LastEditDate="2019-06-10T12:52:21.877" LastActivityDate="2019-06-10T13:03:04.657" Title="Cisco Switch 3500 Default settings" Tags="|cisco|switch|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="7374" PostTypeId="2" ParentId="3198" CreationDate="2014-04-14T21:40:10.517" Score="2" Body="&lt;p&gt;The definition of &lt;strong&gt;two factor&lt;/strong&gt; authentication is having a variety of methods.  These are the methods:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What you know, like a login account's username and password&lt;/li&gt;&#xA;&lt;li&gt;What you have, like an RSA keyfob that generates numbers or a certificate file&lt;/li&gt;&#xA;&lt;li&gt;What you are, like retinal scans and fingerprint scanners&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Two factor authentication is &lt;em&gt;not&lt;/em&gt; having two different login accounts, as in two different sets of usernames and passwords, from two different sources because they are both &quot;what you know&quot;.  An example of two factor authenticating is inserting a smartcard into a laptop (what you have) and then swiping a fingerprint scanner (what you are).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like you have a Microsoft Server, if I understand your use of LDAP.  Why not enable the Microsoft Certificate Authority service on the nearest Microsoft Windows Server, which is included with the operating system, and enable &lt;em&gt;user&lt;/em&gt; certificate enrollment?  The ASA, with the CA's root certificate, can validate accounts, which it refers to as XAUTH, and then authenticate user certificates which Windows, Linux, and MacOS can use.&lt;/p&gt;&#xA;" OwnerUserId="5253" LastActivityDate="2014-04-14T21:40:10.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7376" PostTypeId="2" ParentId="7373" CreationDate="2014-04-14T23:40:14.993" Score="2" Body="&lt;p&gt;Have you tried the command &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Erase start-upconfig&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The command returns all your settings to the factory default (in your startup-config). The only thing you have to do after that is a reload. Then when the reload is complete you'll have the default settings.&lt;/p&gt;&#xA;" OwnerUserId="5074" LastActivityDate="2014-04-14T23:40:14.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7381" PostTypeId="1" AcceptedAnswerId="7382" CreationDate="2014-04-15T13:54:50.203" Score="1" ViewCount="523" Body="&lt;p&gt;We are wanting to add a second PE router for an MPLS customer via HSRP. Unfortunately the CE router's connection to the PE router was configured as a /30. There are no IP addresses on the subnet to use as the physical IP addresses of the HSRP routers and re-IP'ing the customer's network is not an option. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;HSRP will not run without a physical, in addition to virtual, IP address on the interface. If I place the physical address on a different subnet, I get similar behavorior to what is described in the Packet Life link below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;show standby&quot; lists the state as &quot;Init (virtual IP in wrong subnet)&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://packetlife.net/blog/2008/may/24/dont-cheat-on-hsrp-addressing/&quot; rel=&quot;nofollow&quot;&gt;http://packetlife.net/blog/2008/may/24/dont-cheat-on-hsrp-addressing/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to use HSRP on an interface that has a /30 subnet?&lt;/p&gt;&#xA;" OwnerUserId="1911" LastActivityDate="2014-04-15T14:36:39.583" Title="HSRP interface addresses" Tags="|hsrp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7382" PostTypeId="2" ParentId="7381" CreationDate="2014-04-15T14:36:39.583" Score="-1" Body="&lt;p&gt;No way to do HSRP.&#xA;I can think of one way to do it though. (never seen in production, just for the sake of answering your question)&#xA;Solution:&#xA;Use private subnet(at least /29) on the PE and CE interfaces, use your /30 on an GRE tunnel interfaces.&#xA;GRE between PE interface IP and CE HSRP IP.&lt;/p&gt;&#xA;" OwnerUserId="5262" LastActivityDate="2014-04-15T14:36:39.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7383" PostTypeId="2" ParentId="7373" CreationDate="2014-04-15T14:48:50.093" Score="5" Body="&lt;p&gt;Also, be sure to delete the &lt;code&gt;vlan.dat&lt;/code&gt; file on the switch and reload before placing on a live, critical network. Keeping this old file will cause some serious network outages :)&lt;/p&gt;&#xA;" OwnerUserId="5263" LastEditorUserId="775" LastEditDate="2019-06-10T13:03:04.657" LastActivityDate="2019-06-10T13:03:04.657" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="7384" PostTypeId="2" ParentId="7358" CreationDate="2014-04-15T15:04:37.327" Score="-1" Body="&lt;p&gt;&quot;show diagnostic post&quot;&#xA;should work on the switch, not sure about 1841.&lt;/p&gt;&#xA;" OwnerUserId="5262" LastActivityDate="2014-04-15T15:04:37.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7389" PostTypeId="2" ParentId="7367" CreationDate="2014-04-15T19:27:01.310" Score="0" Body="&lt;p&gt;If you have&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no split-horizon&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you should have spanning tree enabled. but that command is nearly never used.&lt;/p&gt;&#xA;" OwnerUserId="5268" LastActivityDate="2014-04-15T19:27:01.310" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7393" PostTypeId="2" ParentId="6667" CreationDate="2014-04-16T02:22:53.527" Score="4" Body="&lt;p&gt;WS-SVC-CMM-24FXS can be set in the CMM to use a non cisco sip proxy which will allow any PBX capible of working with a sip proxy to manage the calls.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also looked through the release notes of the 12.2 IOS release and it DOES list the FXS card as compatible.  &lt;/p&gt;&#xA;" OwnerUserId="4646" LastActivityDate="2014-04-16T02:22:53.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7395" PostTypeId="1" AcceptedAnswerId="7396" CreationDate="2014-04-16T10:00:07.550" Score="8" ViewCount="27586" Body="&lt;p&gt;I'm getting some mixed signals when configuring a trunk on a Cisco switch and I'd like to know which VLANs are actually being allowed on it. The way I want it to be is that only VLANs 1,10,20,30,99 should be allowed. Have a look at the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S1(config-if)#do show int tru&#xA;Port        Mode         Encapsulation  Status        Native vlan&#xA;Gig1/1      on           802.1q         trunking      99&#xA;Gig1/2      on           802.1q         trunking      99&#xA;&#xA;Port        Vlans allowed on trunk //What is this?&#xA;Gig1/1      1-1005&#xA;Gig1/2      1-1005&#xA;&#xA;Port        Vlans allowed and active in management domain //What is this?&#xA;Gig1/1      1,10,20,30,99&#xA;Gig1/2      1,10,20,30,99&#xA;&#xA;Port        Vlans in spanning tree forwarding state and not pruned //What is this?&#xA;Gig1/1      none&#xA;Gig1/2      1,10,20,30,99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What confuses me is that first it states that all VLANs in range 1-1005 are allowed and then it says 1,10,20,30,99 are &quot;allowed and active in management domain&quot; - what is that supposed to mean? What do the different headings mean?&lt;/p&gt;&#xA;" OwnerUserId="4491" LastActivityDate="2016-09-13T03:09:27.813" Title="Which VLANs are allowed on this trunk?" Tags="|cisco|vlan|trunk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7396" PostTypeId="2" ParentId="7395" CreationDate="2014-04-16T10:17:29.137" Score="15" Body="&lt;p&gt;When you configure a trunk link with the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-if)#switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;all&lt;/strong&gt; the vlans will be allowed in the trunk link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to control which VLANs are allowed in a trunk link use the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-if)#switchport trunk allowed vlan&#xA;  WORD    VLAN IDs of the allowed VLANs when this port is in trunking mode&#xA;  add     add VLANs to the current list&#xA;  all     all VLANs&#xA;  except  all VLANs except the following&#xA;  none    no VLANs&#xA;  remove  remove VLANs from the current list&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For example if you want to allow VLANs 1,10,20,30,99 in a trunk link you have to type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-if)#switchport trunk allowed vlan 1,10,20,30,99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pay attention that if you want to add a vlan on a trunk link (for example VLAN 100) you have to use the &lt;strong&gt;add&lt;/strong&gt; statement (this is really a commond mistake), for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-if)#switchport trunk allowed vlan add 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you read &quot;Vlans allowed and active&quot; it simply means that just the active VLANs (the ones you have defined) are allowed in that trunk link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference here: &lt;a href=&quot;https://supportforums.cisco.com/document/11836/how-define-vlans-allowed-trunk-link&quot;&gt;How to define the VLANs allowed on a trunk link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: Analyzing the output of the &lt;code&gt;show interface trunk&lt;/code&gt; command it's easy to see that it is organized in 4 sections; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The first one is a list of all the trunk interfaces togheter with the encapsulation and the native VLAN.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For what concern the second and the third lines the important point to clarify is the difference between &lt;strong&gt;allowed&lt;/strong&gt; and &lt;strong&gt;active&lt;/strong&gt;. Allowed simply stays for &quot;It is allowed to pass&quot; meanwhile active means &quot;this VLAN is up and running in the swtich&quot;. Note that active does not simply mean &quot;it is present in the database&quot; since you can shutdown a vlan with &lt;code&gt;(config-vlan)#shutdown&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The last one deserves a little note; when dealing with PVST (Per-VLAN Spanning Tree) the switch creates a loop-free topology for each L2 broadcast domain (VLAN). Since it is not said that each VLAN share the same phisical topology there could be the case in which, even if a vlan is active and allowed, that vlan will not be forwarded across the trunk interface. This is because that interface it is not in the Forwarding state for that particular PVST process. Is it also possible that a VLAN is not forwarded across a trunk if it has been pruned by the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/vtp/10558-21.html#vtp_pruning&quot;&gt;VTP pruning&lt;/a&gt; process.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="2663" LastEditDate="2014-04-16T14:12:06.553" LastActivityDate="2014-04-16T14:12:06.553" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7397" PostTypeId="1" AcceptedAnswerId="7403" CreationDate="2014-04-16T11:46:05.757" Score="1" ViewCount="3630" Body="&lt;p&gt;I have recently added a dell sonicwall TZ 215 wireless-N to my network and have found that I can no longer RDP onto any of my windows 2012 servers. If I run a cable directly from my router to my machine I can connect, but not via the sonicwall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 12 servers to test this issue on and the behaviour is very consistent... all server 2008 machines work, all server 2012 do not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="5281" LastEditorUserId="3191" LastEditDate="2014-12-08T20:27:54.863" LastActivityDate="2014-12-08T20:27:54.863" Title="Sonicwall blocking RDP to server 2012, but not server 2008" Tags="|sonicwall|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="7398" PostTypeId="2" ParentId="7358" CreationDate="2014-04-16T13:18:51.630" Score="3" Body="&lt;p&gt;&lt;code&gt;show post&lt;/code&gt; should work on the Catalyst 2950, maybe you need to upgrade to a newer version of IOS?&#xA;Even if it works, it won't display more than &quot;Pass&quot; or &quot;Fail&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the 1841, I don't think there is a command to show post information.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For Cisco IOS, the equivalent command is show diagnostic which was&#xA;  introduced in 12.1(11b)E for the Catalyst 6000 series and show&#xA;  diagnostics(with an s) which was introduced in for the Catalyst 4000&#xA;  Series. Both commands display Power-On Self Test (POST) results. For&#xA;  Cisco IOS on the 2900/3500XL, &lt;strong&gt;2950/2955&lt;/strong&gt;, 3550, 2970 and 3750 series&#xA;  switches, the &lt;strong&gt;equivalent command is show post&lt;/strong&gt; which displays the&#xA;  results of the switch POST.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: For Catalyst 3750, 3550, 2970 , 2950/2955, and 2900/3500XL&#xA;  Series switches use the show post command, which indicates &lt;strong&gt;a simple&#xA;  pass or fail for the hw status&lt;/strong&gt;. Use the LEDs on these switches to help&#xA;  you understand the POST results.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4823" LastEditorUserId="4823" LastEditDate="2014-04-16T13:29:02.403" LastActivityDate="2014-04-16T13:29:02.403" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7400" PostTypeId="1" CreationDate="2014-04-16T15:44:27.937" Score="4" ViewCount="1809" Body="&lt;p&gt;Why do we have to set up the switch in transparent mode when dealing with private VLANs?&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="4289" LastEditDate="2014-04-16T15:58:45.693" LastActivityDate="2016-09-13T02:58:59.207" Title="Private VLAN in transparent mode" Tags="|switch|vlan|private-vlan|vtp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7402" PostTypeId="2" ParentId="7400" CreationDate="2014-04-16T16:09:04.177" Score="5" Body="&lt;p&gt;Cisco says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You must configure VTP to transparent mode before you can create a private VLAN. Private VLANs are configured in the context of a single switch and cannot have members on other switches. Private VLANs also carry TLVs that are not known to all types of Cisco switches.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=29803&amp;amp;seqNum=6&quot; rel=&quot;nofollow&quot;&gt;Private VLANs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually if you have a look at the structure of a &lt;strong&gt;Subset Advertisements&lt;/strong&gt; packet in VTP v2 (used to annouce the VLANs) you won't find any option to announce a &quot;private&quot; VLAN. So it seems more an unsupported feature rather than a design choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/vtp/10558-21.html&quot; rel=&quot;nofollow&quot;&gt;Understanding VLAN Trunk Protocol (VTP)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end it seems that this feature is avaible with VTP v3&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Key Benefits of VTP Version 3 &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;...&lt;/li&gt;&#xA;  &lt;li&gt;In addition to supporting the concept of normal VLANs, VTP version 3 can transfer information regarding Private VLAN (PVLAN) structures.&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/solution_guide_c78_508010.html&quot; rel=&quot;nofollow&quot;&gt;VTP Version 3&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another quote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Because VTP versions 1 and 2 do not support private VLANs, you must manually configure private VLANs on all switches in the Layer 2 network. If you do not configure the primary and secondary VLAN association in some switches in the network, the Layer 2 databases in these switches are not merged. This situation can result in unnecessary flooding of private VLAN traffic on those switches.&#xA;  VTP version 3 does support private VLANs, so you do not need to manually configure private VLANs on all switches in the Layer 2 network. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/pvlans.html#wp1131412&quot; rel=&quot;nofollow&quot;&gt;Private VLANs Across Multiple Switches&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="2663" LastEditDate="2014-04-16T16:22:26.487" LastActivityDate="2014-04-16T16:22:26.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7403" PostTypeId="2" ParentId="7397" CreationDate="2014-04-16T16:52:45.757" Score="1" Body="&lt;p&gt;Just an idea: Is there some kind of protocol inspection for RDP enabled on the firewall? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If seen this with other vendors as well. Most (un)famous Cisco Pix and SMTP, but also CheckPoint with MS-SQL.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The exact &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7397/sonicwall-blocking-rdp-to-server-2012-but-not-server-2008#comment12197_7397&quot;&gt;changes&lt;/a&gt; Greg made were:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have disabled the Local Appflow monitor. The setting can be found under Appflow &gt; Flow Reporting &gt; Settings Tab: I unchecked the following: Enable Real-Time Data Collection, Enable Aggregate AppFlow Report Data Collection, Enable AppFlow To Local Collector. I rebooted the firewall after these changes&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-04-16T22:09:41.930" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7406" PostTypeId="1" CreationDate="2014-04-16T21:24:13.257" Score="3" ViewCount="1731" Body="&lt;p&gt;On a Cisco 3750G switch I have a number (30-ish) of video processors in a vLAN providing multicast streams to clients via a router.  Because all of the machines are in the same vLAN they see each other's output, this is causing issues because of the high volume of traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to isolate the multicast traffic so it isn't sent to all of the peer servers, and just the upstream (yet allow them to be in the same vLAN and see unicast traffic)?  I was thinking that a private vLAN for each server/switch-port would do the trick.  What would be the side-effects of this?  Or can I use multicast blocking? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the network diagram we have unicast video sources to each server on vLAN 1 (green).  The encoders process the video and provide multicast streams (unique per encoder) to clients via vLAN 2 (red) and router 1.  IGMP snooping is enabled on switch 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the very high volume of traffic on the red vLAN is causing issues.  A previous Network Engineer tried to resolve this at one location by splitting the red vLAN into multiple vLANs.  This seemed to help, but didn't really solve the issue.  I would like to know if we make all of the encoder ports in the red network into isolated ports in a private vLAN, so they don't see each other's traffic, would this solve this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7OgaX.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch config is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show running-config&#xA;&#xA;version 12.2&#xA;[...]&#xA;!&#xA;hostname swtch02&#xA;!&#xA;[...]&#xA;system mtu routing 1500&#xA;ip routing&#xA;!&#xA;ip multicast-routing distributed&#xA;!&#xA;!&#xA;port-channel load-balance src-dst-ip&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;vlan 2&#xA; name video_out&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description encoder-1&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; description encoder-2&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA; description encoder-3&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA; description encoder-4&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;[...]&#xA;!&#xA;interface Vlan2&#xA; ip address 192.168.1.254 255.255.255.0&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 x.x.x.x&#xA;[...]&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2684" LastEditorUserId="2684" LastEditDate="2014-04-17T20:57:19.347" LastActivityDate="2014-04-17T21:05:25.430" Title="Private vLAN useful to isolate multicast sources?" Tags="|cisco|switch|multicast|private-vlan|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="7408" PostTypeId="2" ParentId="7406" CreationDate="2014-04-17T00:35:51.557" Score="2" Body="&lt;p&gt;Are the sources using the same multicast address. If not make sure IGMP snooping is enabled on the switch. Private Vlans would prevent the servers from seeing each other even for unicast.&#xA;If all the sources are using the same multicast address IGMP snooping would still work as long as the servers only transmit, but I am fuzzy.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2014-04-17T00:35:51.557" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7409" PostTypeId="1" AcceptedAnswerId="41807" CreationDate="2014-04-17T03:26:13.223" Score="1" ViewCount="1961" Body="&lt;p&gt;Could you give an example for both of these mechanisms? I understand what vlan/vxlan is but am really confused when mobility kicks in. A vivid example is more than welcome.&lt;/p&gt;&#xA;" OwnerUserId="5295" LastEditorUserId="2663" LastEditDate="2014-04-17T13:15:19.837" LastActivityDate="2017-06-12T13:35:13.657" Title="How vlan and vxlan achieves virtual machine mobility" Tags="|vlan|vxlan|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7411" PostTypeId="1" CreationDate="2014-04-17T08:27:52.140" Score="4" ViewCount="2864" Body="&lt;p&gt;I've recently installed a new 6807XL Chassis in VSS in my datacenter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After 3 weeks, I keep seeing the CPU usage around 25% (per second, per minute or per five minutes). Looking at the historical graphs I can see this has been the case since starting up the VSS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to see which process is consuming the most I can see &lt;code&gt;slcp process&lt;/code&gt; at 4% - this is the highest. Next I get Spanning-tree at 2%...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't run much on the VSS, just static routes, a bit of OSPF, and the VSL link of course.  I have around 10 000 clients connected on this VSS core which does the routing &amp;amp; switching.  I also have 3000 lines of IP Access lists which all log matches &amp;amp; denies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IOS version is &lt;code&gt;15.1.2.SY1&lt;/code&gt; (ipservices)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Should I be worried about this kind of percentage? To my knowledge, the correct values are usually down to 5%&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit 1&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My CPU Historical Graph:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; C6807XL-VSS#sh processes cpu history&#xA;&#xA;    2222222222222222222222222222222222222333332222111111111122&#xA;    2244444444441111144444111118888833333111110000999996666666&#xA;100&#xA; 90&#xA; 80&#xA; 70&#xA; 60&#xA; 50&#xA; 40&#xA; 30                            *****     *****              **&#xA; 20 **********************************************************&#xA; 10 **********************************************************&#xA;   0....5....1....1....2....2....3....3....4....4....5....5....&#xA;             0    5    0    5    0    5    0    5    0    5&#xA;               CPU% per second (last 60 seconds)&#xA;&#xA;    3422233233322849923322333224333573266433373354325244247744&#xA;    1098420831256725241569234573112169569008255000763746619972&#xA;100                *&#xA; 90              * **&#xA; 80              * **               *        *            **&#xA; 70              * **               *  **    *            **&#xA; 60              * **               *  **    *            **&#xA; 50              * **              **  **    *  *   *  *  *#*&#xA; 40  *           ****  *       *   *#* *** * #* *** * ** *##**&#xA; 30 **** ********#*## *********#**####*###*#*##*###***#***###*&#xA; 20 ##########################################################&#xA; 10 ##########################################################&#xA;   0....5....1....1....2....2....3....3....4....4....5....5....&#xA;             0    5    0    5    0    5    0    5    0    5&#xA;               CPU% per minute (last 60 minutes)&#xA;              * = maximum CPU%   # = average CPU%&#xA;&#xA;    7544443444498577696877374645464538498648877789864645674549987888787878&#xA;    9132939110527897235108828159076475618796321950899129812884364035733681&#xA;100&#xA; 90            **    *               * **  *    ***          ***   *   *&#xA; 80 *          ** ** * * *           * **  **  ****          *** ***** ***&#xA; 70 *          ** ** ***** *     *   * *** *********    **   *************&#xA; 60 *          *********** * * * *   * *** ********* * *** * *************&#xA; 50 **  *     ************ ***** *** ***************** *** ***************&#xA; 40 **********************************************************************&#xA; 30 #**************************************#****####****************##***#&#xA; 20 ######################################################################&#xA; 10 ######################################################################&#xA;   0....5....1....1....2....2....3....3....4....4....5....5....6....6....7.&#xA;             0    5    0    5    0    5    0    5    0    5    0    5    0&#xA;                   CPU% per hour (last 72 hours)&#xA;                  * = maximum CPU%   # = average CPU%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit 2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CPU consumption:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://pastebin.com/kvQjtWYY&quot; rel=&quot;nofollow&quot;&gt;Peak&lt;/a&gt;:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU utilization for five seconds: 48%/29%; one minute: 27%; five minutes: 24%&#xA; PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process&#xA; 302    37851048   3231408      11713  3.43%  2.23%  2.10%   0 SEA write CF pro&#xA; 685    37324288  36021905       1036  2.79%  2.22%  2.11%   0 Spanning Tree&#xA;  16    11694012 124309950         94  1.67%  0.97%  0.92%   0 ARP Input&#xA; 171    25299104   2761699       9160  1.59%  1.34%  1.35%   0 OIR Process&#xA; 188    71498212 166026936        430  1.43%  3.87%  3.97%   0 slcp process&#xA;  74     2099116    167699      12517  1.43%  0.17%  0.11%   0 Per-minute Jobs&#xA; 679     9251792 125616676         73  1.11%  0.90%  0.89%   0 IP Input&#xA; 937     7254584  80249801         90  0.87%  0.44%  0.42%   0 Port manager per&#xA; 922      453432     99151       4573  0.87%  0.07%  0.01%   0 CM hw consistenc&#xA; 699     3728624   5213752        715  0.63%  0.40%  0.37%   0 mDNS&#xA; &amp;lt;...output truncated...&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://pastebin.com/uaHeqwzC&quot; rel=&quot;nofollow&quot;&gt;Low&lt;/a&gt;:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU utilization for five seconds: 29%/9%; one minute: 26%; five minutes: 24%&#xA; PID Runtime(ms)   Invoked      uSecs   5Sec   1Min   5Min TTY Process&#xA; 188    71499092 166028826        430  5.51%  3.94%  3.98%   0 slcp process&#xA; 302    37851672   3231454      11713  2.63%  2.22%  2.11%   0 SEA write CF pro&#xA; 685    37324828  36022200       1036  2.39%  2.30%  2.14%   0 Spanning Tree&#xA; 171    25299392   2761729       9160  1.59%  1.35%  1.35%   0 OIR Process&#xA; 679     9251960 125618970         73  1.19%  0.87%  0.89%   0 IP Input&#xA;  16    11694192 124312162         94  1.11%  0.94%  0.91%   0 ARP Input&#xA; 907     8811320   2294505       3840  0.95%  0.48%  0.47%   0 Env Poll&#xA; 937     7254672  80250797         90  0.63%  0.43%  0.42%   0 Port manager per&#xA; 699     3728724   5213875        715  0.47%  0.42%  0.38%   0 mDNS&#xA; 744     7597964   8291508        916  0.39%  0.44%  0.42%   0 XDR receive&#xA; &amp;lt;...output truncated...&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3484" LastEditorUserId="3191" LastEditDate="2014-04-17T19:19:08.277" LastActivityDate="2018-11-06T18:29:15.587" Title="6807XL CPU process stuck at 25 / 30 %" Tags="|cisco|vss|cpu|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="7412" PostTypeId="2" ParentId="6885" CreationDate="2014-04-17T09:15:58.557" Score="3" Body="&lt;p&gt;For those interested : the problem was resolved by migrating the core network from an old C6006 to a brand-new Catalyst 6807XL.&#xA;I guess the polling of ARP information was failing on the old cores. Since migrating every IP for every client has been pulled up, without changing anything to the Prime Infrastructure config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jeremy&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2014-04-17T09:15:58.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7423" PostTypeId="1" CreationDate="2014-04-18T01:09:31.200" Score="2" ViewCount="1265" Body="&lt;p&gt;I am trying to connect 150 smartphones (Samsung Galaxy S5) to a single wifi network, so that I can access streams from them on a computer on the LAN. What should my (multiple) access point (AP) setup be like to get the best access speed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to access a file/stream from each phone whose address would be &quot;&lt;a href=&quot;http://192.168.1.X:8080/link&quot; rel=&quot;nofollow&quot;&gt;http://192.168.1.X:8080/link&lt;/a&gt;&quot; (x changes for each phone). And I cannot connect all my phones to the same wifi AP without tanking my access speeds. In what way should I configure 3 APs so my computer (also on the same network) can just see all the device ip addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this Windows Phone video wall (&lt;a href=&quot;http://www.youtube.com/watch?v=mcSd2xH_vS4&quot; rel=&quot;nofollow&quot;&gt;http://www.youtube.com/watch?v=mcSd2xH_vS4&lt;/a&gt;) where they have a 14 x 14 grid of phones connected to a media server through 3 wifi APs. My use case is similar to this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I just daisy chain 3 APs with the first one as a master with DHCP enabled and the other two with static ips and they all have identical SSIDs, how can I control which Phone connects to which AP? (All the devices are in close proximity, and all three APs sit together about 5 feet from the installation, so its unlikely that a device is only in range of one AP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, I want each AP connecting to a different set of 50-ish phones and I want to maintain decent enough access speeds, so that I can stream data in realtime to the computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for looking into my question! :)&lt;/p&gt;&#xA;" OwnerUserId="5306" LastEditorUserId="2663" LastEditDate="2014-04-18T09:35:37.673" LastActivityDate="2014-11-15T16:20:02.280" Title="Multi access point setup for connecting ~150 devices(smartphones) to the same wifi local network" Tags="|wireless|design|lan|streaming|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7425" PostTypeId="1" AcceptedAnswerId="7430" CreationDate="2014-04-18T10:22:07.360" Score="4" ViewCount="2192" Body="&lt;p&gt;I am configuring RADIUS authentication on my switches but it does not work and I don't know why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My configuration is pretty straightforward : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;aaa group server radius RADIUS-ACTIF&#xA;  server x.x.x.x auth-port 1812 acct-port 1813&#xA;  server y.y.y.y auth-port 1812 acct-port 1813&#xA;  ip radius source-interface Vlan10&#xA;  deadtime 1&#xA;aaa authentication attempts login 5&#xA;aaa authentication password-prompt Secured-Password:&#xA;aaa authentication username-prompt Secured-Username:&#xA;aaa authentication login default local&#xA;aaa authentication login RADIUS-ACTIF group RADIUS-ACTIF local&#xA;aaa authentication enable default enable&#xA;aaa authorization exec default group RADIUS-ACTIF local&#xA;aaa session-id common&#xA;&#xA;line vty 0 4&#xA;    login authentication RADIUS-ACTIF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The thing is : I can't see anything happening on the &quot;Failed Attempts&quot; on my ACS Server. There are no logs of my attempts at authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ACS server is reachable via ping from my switches.&#xA;I have tried to test the RADIUS access with the &lt;strong&gt;test&lt;/strong&gt; command : I get the &lt;strong&gt;User rejected&lt;/strong&gt; feedback after less than 2/3 seconds, so I am thinking that I can access the RADIUS but I get blocked even before submitting my credentials. It's a very strange behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody has an idea as to why this would happen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should also say that the exact same configuration is working on one switch (on a different IP plan though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2014-04-18T14:09:22.747" Title="RADIUS authentication" Tags="|cisco|authentication|radius|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7427" PostTypeId="1" AcceptedAnswerId="7428" CreationDate="2014-04-07T06:01:08.753" Score="4" ViewCount="46862" Body="&lt;p&gt;A subnet of an IP network has a range of IP host address from&#xA; &lt;strong&gt;172.19.40.1&lt;/strong&gt; to &lt;strong&gt;172.19.47.254&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is the &lt;strong&gt;maximum number of host addresses&lt;/strong&gt; that can exist on this subnetwork?&#xA;I'm googling but not found a clear answer. how should we &lt;strong&gt;compute&lt;/strong&gt; maximum number of host addresses?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="40024" OwnerDisplayName="user3184352" LastEditorUserId="775" LastEditDate="2014-04-18T11:00:17.207" LastActivityDate="2017-02-18T05:51:56.323" Title="Finding the network and host address, and maximum number of host addresses" Tags="|ipv4|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7428" PostTypeId="2" ParentId="7427" CreationDate="2014-04-08T09:41:45.797" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;A subnet of an IP network has a range of IP host address from 172.19.40.1 to 172.19.47.254.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;What is the maximum number of host addresses that can exist on this subnetwork? I'm &#xA;   googling but not found a clear answer. how should we compute maximum number of host addresses?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;Method 1&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Let's use a simple method to find this...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addresses contain four 8-bit integers; 8-bit integers have a maximum value of 255.  Think of it like this... if we merely build a sequence of third-octets from 40 to 47 and account for the hosts, we'll find the answer with minimal math...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;172.19.40.1 through 172.19.40.255 = 255 hosts&lt;/li&gt;&#xA;&lt;li&gt;172.19.41.0 through 172.19.41.255 = 256 hosts&lt;/li&gt;&#xA;&lt;li&gt;172.19.42.0 through 172.19.42.255 = 256 hosts&lt;/li&gt;&#xA;&lt;li&gt;172.19.43.0 through 172.19.43.255 = 256 hosts&lt;/li&gt;&#xA;&lt;li&gt;172.19.44.0 through 172.19.44.255 = 256 hosts&lt;/li&gt;&#xA;&lt;li&gt;172.19.45.0 through 172.19.45.255 = 256 hosts&lt;/li&gt;&#xA;&lt;li&gt;172.19.46.0 through 172.19.46.255 = 256 hosts&lt;/li&gt;&#xA;&lt;li&gt;172.19.47.0 through 172.19.47.254 = 255 hosts&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Number of hosts = 2*255 + 6*256 = 2046 hosts&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Method 2&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Use this method to find the number of hosts between two arbitrary IP addresses... convert the two 32-bit IP addresses to integers and subtract...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;172.19.40.1 =&gt; 2886936577&lt;/li&gt;&#xA;&lt;li&gt;172.19.47.254 =&gt; 2886938622&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;2886938622 - 2886936577 + 1 = 2046 hosts&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I added an extra host in the subtraction, since you're including the first host in the list of available hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As someone mentioned below you can also use the host bits of the netmask, if you're merely calculating the number of hosts in an IP CIDR block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;How to convert an IPv4 addess to decimal&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172*256**3 + 19*256**2 + 40*256**1 + 1*256**0 = 2886936577&lt;/p&gt;&#xA;" OwnerUserId="775" OwnerDisplayName="Mike Pennington" LastEditorUserId="775" LastEditDate="2014-04-18T19:08:03.440" LastActivityDate="2014-04-18T19:08:03.440" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7429" PostTypeId="1" AcceptedAnswerId="7495" CreationDate="2014-04-18T11:17:54.807" Score="6" ViewCount="2110" Body="&lt;p&gt;We have a bunch of ISR 2800s on 12.4(25b) that basically are in production until they die.  There are no plans to invest money in SmartNET or purchase replacement fans. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are getting a ton of fan service syslog messages and it is a nuisance with the tens of thousands of messages received daily. I see you can rate limit the number of syslog messages per second but need something more along the lines of allowing one syslog message of a particular type per day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any commands on the router or other external methods that would accomplish something like that?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Apr 17 14:52:09.292: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended&#xA;Apr 17 14:52:09.292: %ENVMON-4-FAN_LOW_RPM: Fan 2 service recommended&#xA;Apr 17 14:52:09.292: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended&#xA;Apr 17 14:52:39.292: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended&#xA;Apr 17 14:52:39.292: %ENVMON-4-FAN_LOW_RPM: Fan 2 service recommended&#xA;Apr 17 14:52:39.292: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended&#xA;Apr 17 14:53:09.293: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended&#xA;Apr 17 14:53:09.293: %ENVMON-4-FAN_LOW_RPM: Fan 2 service recommended&#xA;Apr 17 14:53:09.293: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended&#xA;Apr 17 14:53:39.293: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended&#xA;Apr 17 14:53:39.293: %ENVMON-4-FAN_LOW_RPM: Fan 2 service recommended&#xA;Apr 17 14:53:39.293: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended&#xA;Apr 17 14:54:09.293: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended&#xA;Apr 17 14:54:09.293: %ENVMON-4-FAN_LOW_RPM: Fan 2 service recommended&#xA;Apr 17 14:54:09.293: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended&#xA;Apr 17 14:54:39.294: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended&#xA;Apr 17 14:54:39.294: %ENVMON-4-FAN_LOW_RPM: Fan 2 service recommended&#xA;Apr 17 14:54:39.294: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended&#xA;Apr 17 14:55:09.294: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended&#xA;Apr 17 14:55:09.294: %ENVMON-4-FAN_LOW_RPM: Fan 2 service recommended&#xA;Apr 17 14:55:09.294: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended&#xA;Apr 17 14:55:39.295: %ENVMON-4-FAN_LOW_RPM: Fan 1 service recommended&#xA;Apr 17 14:55:39.295: %ENVMON-4-FAN_LOW_RPM: Fan 2 service recommended&#xA;Apr 17 14:55:39.295: %ENVMON-4-FAN_LOW_RPM: Fan 3 service recommended&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="267" LastActivityDate="2014-04-21T12:14:39.693" Title="Rate limit specific Cisco ISR syslog messages" Tags="|cisco|router|cisco-ios-12|syslog|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7430" PostTypeId="2" ParentId="7425" CreationDate="2014-04-18T14:09:22.747" Score="5" Body="&lt;p&gt;According to my experience the two most common issues when dealing with AAA and Radius are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Misspelled/Absent pre-shared key on the RADIUS server or on the NAC (Radius client)&lt;/li&gt;&#xA;&lt;li&gt;The Radius server misses the configuration to allow requests from a client.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Doing troubleshooting with comments it turned out that the pre-shared key was missing on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To add this just type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config)#radius-server host x.x.x.x auth-port 1812 acct-port 1813 key ***&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or (to define a default key):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config)#radius-server key ***&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you are interested in a more general method for troubleshooting refere here: &lt;a href=&quot;http://www.cisco.com/en/US/products/ps5989/prod_troubleshooting_guide_chapter09186a0080679eb2.html#wp36461&quot; rel=&quot;noreferrer&quot;&gt;Troubleshooting RADIUS and TACACS+&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2663" LastActivityDate="2014-04-18T14:09:22.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7431" PostTypeId="1" AcceptedAnswerId="7432" CreationDate="2014-04-18T14:20:38.743" Score="3" ViewCount="3961" Body="&lt;p&gt;I'm trying to draw the packets in a network that uses an IPSec tunnel for security. More specifically: a laptop user using a public access point wants to query Google through an IPSec tunnel to a home PC. I'm trying to draw the packet between the laptop and the public access point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand it correctly the packets will have the following layout:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MacTo - MacFrom - IPSource - IPDestination - SourcePort - DestinationPort - [Encrypted source IP - Encrypted destination IP - Encrypted source port - Encrypted destination port - data] &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in which the encrypted packet is placed between the brackets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering how to fill in the ports in this setting. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SourcePort: I assume just a random port of the laptop.&lt;/li&gt;&#xA;&lt;li&gt;DestinationPort: I assume this is the port of the IPSec gateway service.&lt;/li&gt;&#xA;&lt;li&gt;Encrypted source port: Is this the same as SourcePort? Is this port modified by the IPSec gateway before the packet is forwarded to Google? &lt;/li&gt;&#xA;&lt;li&gt;Encrypted destination port: 80 (http for the Google request)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Can anyone confirm if my assumptions are correct or indicate how I should fill in &quot;Encrypted source port&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="5312" LastActivityDate="2014-04-21T19:11:33.217" Title="Ports in IPSec tunnel" Tags="|ipsec|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7432" PostTypeId="2" ParentId="7431" CreationDate="2014-04-18T14:56:59.873" Score="3" Body="&lt;p&gt;IPSEC has no ports. In IPv4 IPSEC, or to be more precise AH (authentication header) and ESP (encapsulation security payload), are two IP protocols just like TCP and UDP. In IPv6 IPSEC is part of the protocol are there are two extension headers one for authentication and one for encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing that has something to do with ports is IKE (Internet Key Exchange) protocol which uses UDP 500 or 4500.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="500" LastEditDate="2014-04-21T19:11:33.217" LastActivityDate="2014-04-21T19:11:33.217" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7436" PostTypeId="2" ParentId="7423" CreationDate="2014-04-18T17:42:58.147" Score="0" Body="&lt;p&gt;Seems to me that you can get the maximum speed of each phone which on my S3 is less than 10 mbps which will give you about 15 phones per wireless access point. So we are talking some 10 access points on the same DHCP. Ambitious but doable. Some AP's have 300 Mbps so less gear. Good luck. &#xA;Aimed&lt;/p&gt;&#xA;" OwnerUserId="5314" LastActivityDate="2014-04-18T17:42:58.147" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7437" PostTypeId="2" ParentId="7427" CreationDate="2014-04-18T18:45:43.533" Score="-3" Body="&lt;p&gt;If you are just wanting to know the number of hosts in any IP_Range/X:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2^(32-X))-2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything is binary, so we take the number of zeros in the subnet mask (32-X), raise 2 to that power, and then subtract the network identifier and broadcast address from the result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want to know how many IP addresses (not quite the same thing as hosts) are in the range, don't bother subtracting 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, you get nonsensical information when you use /31 (answer of 0) or /32 (-1), but asking for the number of hosts in a /31 or /32 isn't something you normally ask. Everyone 'knows' that you don't use /31 networks unless you do some sneaky stuff to avoid the net ID and broadcast addresses and /32 indicates a single host address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are talking about IPv6, you just update the formula for the 128 bit mask, instead of the 32 bit mask of IPv4.&lt;/p&gt;&#xA;" OwnerUserId="5315" LastActivityDate="2014-04-18T18:45:43.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7438" PostTypeId="2" ParentId="7409" CreationDate="2014-04-18T18:49:33.157" Score="4" Body="&lt;p&gt;VXLAN by itself doesn't solve the problem of moving the active VM over the internet to different location - it may be possible given specific setup, but it may also be impossible. In that sense it's just like a VLAN - a transport feature (or for VXLAN - overlay protocol).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the VM is connected to VXLAN, then purely from transport perspective, it doesn't matter where it is connected - to the same segment, different segment or completely different location, as long as those can communicate over IP and transport Ethernet traffic encapsulated using it through VTEP gateways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can work on seamless migration capabilities by designing your DC/core network that facilitates IP movement (dynamically reannouncing IP blocks, down to /32 or /128, or deciding for design that pulls traffic to one VTEP gateway [originally announcing entire block of IPs] and then transports traffic to moved out VM over VXLAN encapsulation to other gateway currently hosting VM).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From lack of other sources, please take a look here for explanation how VXLAN works: &lt;a href=&quot;http://blogs.vmware.com/vsphere/2013/04/vxlan-series-different-components-part-1.html&quot; rel=&quot;nofollow&quot;&gt;http://blogs.vmware.com/vsphere/2013/04/vxlan-series-different-components-part-1.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-04-18T18:49:33.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7439" PostTypeId="2" ParentId="7291" CreationDate="2014-04-18T19:02:10.587" Score="0" Body="&lt;p&gt;From my experience, depends on the equipment that creates the IPSec tunnel and if it is route or policy based.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For route based IPSec tunnels, equipment normally adds it as another interface and you can monitor that directly in MIB2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For policy based... monitoring something on the far side, like the internal IP of the far end, is probably best. A loopback can work to avoid the false positive of the far end network dropping but the device still up, but in policy based tunnels it is probably more work to create than not and the tunnel is really only useful if there are things talking over it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd just go ahead and monitor the far side. Simple and, if the far side is down in monitoring, you know that the tunnel isn't working (either tunnel down or far side equipment problem; either way the tunnel is not passing traffic).&lt;/p&gt;&#xA;" OwnerUserId="5315" LastActivityDate="2014-04-18T19:02:10.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7441" PostTypeId="2" ParentId="7250" CreationDate="2014-04-18T19:31:08.550" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Recently I heard a term IPAM i.e IP Address management. Theoretically I got the definition from Wikipedia, but couldn't understand its actual need. Since for that we have DHCP then What is the need for seperate IP management service or hardware.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;DHCP is just address assignment, usually just for users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most networking isn't &lt;em&gt;just&lt;/em&gt; assigning user space addresses. Got to keep track of router-router connections, the DHCP server itself (it can't get DHCP from itself), those devices that you just want to static (set and forget type stuff) without setting up DHCP to assign static, and then you have to deal with equipment that must always work, no matter if DHCP is there or not. Then there are the networks that you just don't put a DHCP server -- either because it's a pain, a bother, faster than DHCP, or really not needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPAM is just to keep track of all IP address assignments, not just the user space. Most are better than a spreadsheet and anything is better than reading the routing tables when managing networks. Smaller networks, especially home networks, would never need IPAM. The software only really becomes useful after a certain scale; before then too expensive to justify, after then just another network tool.&lt;/p&gt;&#xA;" OwnerUserId="5315" LastActivityDate="2014-04-18T19:31:08.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7444" PostTypeId="2" ParentId="7423" CreationDate="2014-04-18T20:33:25.500" Score="1" Body="&lt;p&gt;A common miscomprehension when dealing with streaming is the relation between bitrate and throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Meanwhile your throughput is higher than the bitrate of the stream you are, generally, OK. (ever heard about the &lt;a href=&quot;http://en.wikipedia.org/wiki/Nyquist%E2%80%93Shannon_sampling_theorem&quot; rel=&quot;nofollow&quot;&gt;Nyquist–Shannon sampling theorem&lt;/a&gt;)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore you should first of all try to stimate the bitrate of the stream and than do your estimation based on this and not on the maximum throughput of your devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider also that the worst enemy of real-time video is the &lt;a href=&quot;http://en.wikipedia.org/wiki/Jitter&quot; rel=&quot;nofollow&quot;&gt;jitter&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what concern the problem of the association this is not a problem at all since each AP can broadcast an arbitrary SSID (even hidden) while referring to the same VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course go for the 5GHz spectrum since you will need to use, a lot, of non-overlapping channels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry but with my limited knowledge I can't suggest you more than this.&lt;/p&gt;&#xA;" OwnerUserId="2663" LastEditorUserId="2663" LastEditDate="2014-04-18T23:12:32.900" LastActivityDate="2014-04-18T23:12:32.900" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7445" PostTypeId="2" ParentId="7123" CreationDate="2014-04-18T20:39:43.053" Score="2" Body="&lt;p&gt;It is a point-to-point link. As &lt;strong&gt;Ron&lt;/strong&gt; pointed out, logically it is a semantic problem and physically a media issue which does turn out to be a logical issue in the case of a bus network, as explained by &lt;strong&gt;Mike Pennington♦&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, point-to-point and point-to-multipoint are not obsolete terms when it comes to telephony. P2P connects the gateway to a single telephony system and P2MP to one or many phones. Why do I mention this? Because a gateway having more than one voice port logically acts as a hub, if it is set to forward inbound calls to each port (hunt group / ring call). Physically it does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With regards to your comment at &lt;em&gt;Mar 31 at 15:48&lt;/em&gt;, yes, the link is not dedicated to a single device connected to a hub. But this is not a criterion for calling the link P2P or P2MP. A hub regenerates the incoming signal on each port, one incoming signal at a time. There is no multiple signaling at a time on the same link. In short, it's P2P, both physically and logically.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2014-04-18T20:39:43.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7449" PostTypeId="1" AcceptedAnswerId="7450" CreationDate="2014-04-18T22:30:19.217" Score="2" ViewCount="253" Body="&lt;p&gt;I'm a networking noob with three computers (Mac Minis running OS X Mavericks) on a wired LAN (Cisco 5 port fast ethernet switch). IPv4 in the network panel of each computer is configured manually with static IPs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup is an interactive experience in a retail setting, and the primary machine serves a local Node.js socket server for three separate JavaScript apps on the network to communicate. It's set up this way because the corporate IT policy prohibits creation of in-store wireless networks for fear of passers-by hacking machines wirelessly and exploiting displayed experiences.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I want the application on the primary machine to give off some sort of &quot;heartbeat&quot; that I can remotely monitor. I was thinking I'd like to have a fourth machine that's wi-fi enabled to the LAN, have it communicate with the primary machine of the other three, and report the heartbeat to a remote server over wi-fi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to provide wireless Internet access (from, say, a public wi-fi) to an individual computer on the wired LAN, without 1) extending it to others, and without 2) providing a path whereby someone who wirelessly hacks into the single machine with wi-fi could gain access to the other machines on the wired LAN?&lt;/p&gt;&#xA;" OwnerUserId="5318" LastEditorUserId="5318" LastEditDate="2014-04-19T19:51:28.130" LastActivityDate="2014-04-19T19:51:28.130" Title="On a wired LAN of 2+ computers, can you securely provide wireless Internet to one and not the others?" Tags="|wireless|ethernet|security|lan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7450" PostTypeId="2" ParentId="7449" CreationDate="2014-04-18T23:05:18.997" Score="2" Body="&lt;p&gt;1) Yes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can connect a computer to two networks.  The practices is commonly called &quot;Dual-homing&quot; and requires a bit of a trick to make it work.  Your computer that's on both the wired and wireless networks will need to know which network to use a default gateway on.  In your case, since your wired network uses statically assigned IP addresses, it's pretty simple; don't put a default gateway in when you're typing in the IP address for the wired NIC.  The computer won't pass information from one network to another (providing wifi access to the wired computers) without some additional configuration, so you shouldn't need to worry about that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) No, but the risks can be mitigated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once an attacker gets into one computer on a network, they'll be able to access the rest.  This would mean they would need to gain control of the dual-homed computer before they could talk to the rest, but once that step is done, they're home free.  You can mitigate this risk by installing a host-based Intrusion Prevention System (IPS) on the dual-homed computer, by installing a software firewall on the dual-homed computer, by using strong security on your wifi connection, by protecting your wifi with IPS and/or firewall, or by protecting the wired networked computers with IPS and/or firewall, but without an air gap, there's always the possibility of compromise&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-04-18T23:05:18.997" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="7451" PostTypeId="1" CreationDate="2014-04-19T00:06:08.537" Score="4" ViewCount="10884" Body="&lt;p&gt;If I understand correctly, TCP is a full-duplex birectional protocol. However, Ethernet is half-duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this mean that eventhough TCP supports full-duplex, it only operates in half-duplex mode when on Ethernet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="5319" LastEditorUserId="3163" LastEditDate="2014-04-19T08:51:28.690" LastActivityDate="2015-09-19T18:50:55.857" Title="How is TCP duplex if Ethernet is half-duplex?" Tags="|ethernet|tcp|duplex|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7452" PostTypeId="2" ParentId="7451" CreationDate="2014-04-19T00:30:30.987" Score="5" Body="&lt;p&gt;Actually, TCP and Ethernet are examples of different layers of the OSI model. TCP works in layer 4 (transport layer), which is used for making connections between nodes on a network. TCP is indeed bidirectional, and it's sometimes referred to as connection-oriented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet is a layer 2 (data link layer) protocol, which dictates how  signals are to be interpreted in the physical layer (layer 1). There are many sublayers to layer 2, but in general, Ethernet is the most popular.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If Ethernet is run in half-duplex, then the node cannot transmit and receive at the same time. But this doesn't mean that the node cannot use TCP. TCP still runs on &lt;strong&gt;top&lt;/strong&gt; of Ethernet, and additionally, on top of IP (Layer 3) to create the bidirectional connection that TCP needs to communicate. So when talking about Ethernet and TCP, they operate as different layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP still makes the bidirectional connection even though the Ethernet NIC cannot receive and send at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good reference to how this works is the classic Stevens book: &lt;a href=&quot;http://books.google.com/books/about/TCP_IP_Illustrated_Volume_1.html?id=a23OAn5i8R0C&quot; rel=&quot;noreferrer&quot;&gt;http://books.google.com/books/about/TCP_IP_Illustrated_Volume_1.html?id=a23OAn5i8R0C&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4887" LastActivityDate="2014-04-19T00:30:30.987" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7453" PostTypeId="1" AcceptedAnswerId="7476" CreationDate="2014-04-19T01:06:03.567" Score="6" ViewCount="7780" Body="&lt;p&gt;In IPv4, if I want to send a magic packet to a workstation in another VLAN, I enable directed broadcasts in the remote VLAN and send it to the VLAN's broadcast address.  This works great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IPv6, I can use FF02::1 to send a WoL frame to workstations inside the same VLAN, but without broadcasts, how would I send it to a workstation in a different VLAN?&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-04-20T09:58:15.147" Title="Wake on LAN across VLANs in IPv6 network" Tags="|vlan|ipv6|multicast|broadcast|wake-on-lan|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7455" PostTypeId="2" ParentId="7453" CreationDate="2014-04-19T05:53:00.973" Score="0" Body="&lt;p&gt;WOL has nothing to do with any IP version. The magic packet is send to an &lt;strong&gt;Ethernet&lt;/strong&gt; broadcast address which is the same for IPv4, IPv6 and other protocols.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-04-19T05:53:00.973" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7456" PostTypeId="1" AcceptedAnswerId="7463" CreationDate="2014-04-19T06:44:05.107" Score="7" ViewCount="23754" Body="&lt;p&gt;In which case is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.1.0.0 255.255.255.0 null0 used?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This question is a repost of the &lt;a href=&quot;https://learningnetwork.cisco.com/thread/62096&quot; rel=&quot;nofollow&quot;&gt;same question&lt;/a&gt; in &lt;a href=&quot;https://learningnetwork.cisco.com/&quot; rel=&quot;nofollow&quot;&gt;The Cisco Learning Network&lt;/a&gt;; however, the answers are unique to Stack Exchange.&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="775" LastEditDate="2014-06-15T03:03:09.793" LastActivityDate="2017-03-15T09:51:17.683" Title="What is Null 0 interface?" Tags="|routing|ipv4|ospf|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7457" PostTypeId="2" ParentId="7456" CreationDate="2014-04-19T08:26:01.437" Score="9" Body="&lt;p&gt;It drops all the traffic that doesn't have a more specific route. It is used to prevent routing loops and to put routes in the routing table permanently so they can be announced with BGP.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-04-19T08:26:01.437" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7459" PostTypeId="2" ParentId="2420" CreationDate="2014-04-19T09:27:11.470" Score="0" Body="&lt;p&gt;It is always misconfiguration because duplex mode is a L1 configuration issue. If there are L1 issues despite matching DM and a flawless cable, at least one NIC is broken. I suggest you consider two facts about auto-configuration: Neither does every device support auto-configuration, nor is there certainty that both interfaces will running in full-duplex mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering power outage, that would be a cause of misconfiguration. The interfaces would have to negotiate once again. Either the manufacturer properly documents its devices or you can only guess how the NIC prioritizes duplex and data rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gigabit Ethernet mandates full duplex operation, yet still allows half-duplex. However, duplex mode is a factor whenever Fast Ethernet or less are available. There are still devices in use which do not need more than 100 Mbps because it links to a line which will never deliver more speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there are devices without a Web interface or CLI. These use tiny DIP switches for HD and FD. A method which probably causes confusion among users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there are devices by the same manufacturer which are out of line with the rest of the series. For example, all devices mandate AN, except for one device. Maybe no one would expect that. So to say - never dismiss misconfiguration.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2014-04-19T09:27:11.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7460" PostTypeId="1" CreationDate="2014-04-19T09:28:17.297" Score="1" ViewCount="1045" Body="&lt;p&gt;I need to create a &quot;Guest&quot; WLAN network in an existing network. What I need is a Wi-Fi subnet which can only surf the internet and things like that but I won't discuss this here. What I need to know is how can I implement a new &quot;virtual&quot; subnet into an existing network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say that I have my &quot;main&quot; network which is &lt;code&gt;192.168.1.0/24&lt;/code&gt; and I'd like to create a new range of IPs on &lt;code&gt;192.168.2.0/24&lt;/code&gt;.&#xA;My router is &lt;code&gt;192.168.1.1&lt;/code&gt; and my Wi-Fi AP is at &lt;code&gt;192.168.1.2&lt;/code&gt;; Wi-Fi clients would obviously go on the &lt;code&gt;192.168.2.0/24&lt;/code&gt; subnet. I thought that I could make my AP a DHCP server for the &lt;code&gt;192.168.2.0/24&lt;/code&gt; subnet and then doing a NETMAP (1:1) from the &lt;code&gt;192.168.2.0/24&lt;/code&gt; to the &lt;code&gt;192.168.1.0/24&lt;/code&gt; addresses and a virtual interface on my router to make it act as a bridge between the &lt;code&gt;192.168.1.0/24&lt;/code&gt; and the &lt;code&gt;192.168.2.0/24&lt;/code&gt; net but this is a very very rough solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas? What about &lt;code&gt;VLANs&lt;/code&gt;? (I never used one)&lt;/p&gt;&#xA;" OwnerUserId="5321" LastEditorUserId="3191" LastEditDate="2014-12-08T20:22:49.257" LastActivityDate="2014-12-08T20:22:49.257" Title="Creating a subnet in an existing network" Tags="|wireless|vlan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7463" PostTypeId="2" ParentId="7456" CreationDate="2014-04-19T12:33:16.757" Score="10" Body="&lt;p&gt;&lt;code&gt;Null 0&lt;/code&gt; is a virtual interface that’s used to guarantee routes make it into the RIB; remember, routes &lt;strong&gt;must&lt;/strong&gt; have a next-hop in order to make it into the RIB.  When a packet arrives at a device that has a route to &lt;code&gt;Null 0&lt;/code&gt; and nowhere else, it will discard it similar to how an ACL would.  Think of this as the virtual interface where packets go to die efficiently. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most routing protocols, such as EIGRP, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfeigrp.html#wp1001069&quot;&gt;automatically generate a Null 0 route when summarizing addresses&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-04-19T12:33:16.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7466" PostTypeId="2" ParentId="7453" CreationDate="2014-04-19T16:00:10.987" Score="1" Body="&lt;p&gt;There are no subnet directed broadcasts in IPv6 because there are no broadcasts in IPv6 at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One option is to send the packet directly to the IPv6 address of the host (which you of course will have to know in advance, just like the MAC address) and hope that the switch still remembers which port the host is connected to. This seems quite iffy to me and is probably not going to be reliable in all environments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long-term the workstations should probably be waking themselves up on a schedule, or not sleeping at all.&lt;/p&gt;&#xA;" OwnerUserId="645" LastActivityDate="2014-04-19T16:00:10.987" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7468" PostTypeId="2" ParentId="7427" CreationDate="2014-04-19T19:14:48.720" Score="1" Body="&lt;p&gt;If you take &lt;code&gt;172.19.40.1&lt;/code&gt; for a second and convert it to binary, then you get &lt;code&gt;10101100.00010011.00101000.00000001&lt;/code&gt;. So if you ignore the 172.19 part and just concentrate on the 40 part for a minute, you can see that in 00101000, the last three binary digits are 000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you cycle through the binary bits you'll see that you get the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;40 = 00101000&#xA;41 = 00101001&#xA;42 = 00101010&#xA;43 = 00101011&#xA;44 = 00101100&#xA;45 = 00101101&#xA;46 = 00101110&#xA;47 = 00101111&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cool, so that means that the last three binary digits encompass every IP address from 172.19.40.xxx through 172.19.47.xxx, where xxx encompasses 0-255. Now since each number in an IP address is 2**8 hosts, another 3 binary digits makes it 2**11, which means that there are 2048 hosts. But since the first and last hosts in a subnet are broadcast addresses, it's 2**11 - 2, which is 2046.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Incidentally, that range from 172.19.40.1 through 172.19.47.254 can be represented as 172.19.40.0/21, which means the first 21 bits of a subnet mask are 1s, or network bits. so there are 11 bits left that are host bits, or 0s. Same calculation: 2**11 - 2 = 2046.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't want to do the manual calculations yourself, you can find a boat load of subnet calculators that will tell you exactly how many hosts in a particular subnet.&lt;/p&gt;&#xA;" OwnerUserId="4887" LastActivityDate="2014-04-19T19:14:48.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7469" PostTypeId="2" ParentId="7460" CreationDate="2014-04-19T19:26:39.057" Score="2" Body="&lt;p&gt;If the ZyWall USG 20 can support multiple virtual interfaces on a specific LAN, you can probably do this like you said where a virtual interface is the gateway for the 192.168.2.0/24 subnet. However, what's to stop a client from configuring an IP address on 192.168.1.0/24 and getting whatever the first subnet gets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My suggestion is that if your AP can put clients on different VLANs depending on the SSID, then that's much better. So SSID1 will be on VLAN 1, and SSID2 will be on VLAN 2. Put a virtual interface of the router on VLAN 1 for 192.168.1.0/24 and another virtual interface of the router on VLAN 2 for 192.168.2.0/24, then you can do whatever you need to control the traffic. I am not sure if the Digicom AP can do that, but that's probably the best option.&lt;/p&gt;&#xA;" OwnerUserId="4887" LastActivityDate="2014-04-19T19:26:39.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7471" PostTypeId="1" AcceptedAnswerId="7474" CreationDate="2014-04-20T08:10:56.230" Score="3" ViewCount="523" Body="&lt;p&gt;When a LSA is re-advertised (flooded) to another router will the readvertising router modify the &quot;Advertising Router-id&quot; field to its own router id ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routerzero---NetworkA---RouterA-----RtrB-----RtrC------RtrD&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say in above topology RouterA originated a LSA with NetworkA information in its Router-LSA and this is advertised to RtrB. Now when RtrB re-advertises this LSA to RtrC will it modify the &quot;Advertising Router-id&quot; field in the LSA to its own(RtrB 's router-id) and send to RtrC?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastEditorUserId="775" LastEditDate="2015-04-17T11:41:54.880" LastActivityDate="2015-04-17T11:41:54.880" Title="Will Ospf advertising router id be modified during flooding?" Tags="|ospf|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7472" PostTypeId="1" AcceptedAnswerId="7473" CreationDate="2014-04-20T08:29:04.610" Score="1" ViewCount="554" Body="&lt;p&gt;in RFC 2328(for ospf) i see that Link-State-Id and Advertising-Router-Id are same for Router-LSAs(type1).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; For router-LSAs, this field is identical to the&#xA;        Link State ID field.  Network-LSAs are originated by the&#xA;      network's Designated Router.  Summary-LSAs originated by&#xA;        area border routers.  AS-external-LSAs are originated by AS&#xA;        boundary routers.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But in my understanding both fields will have same value even for Type-2(Network LSAs). is my understanding right?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastEditorUserId="8499" LastEditDate="2018-12-26T05:11:27.117" LastActivityDate="2018-12-26T05:11:27.117" Title="Ospf Link-State-Id and Advertising-RouterId are same for type1 and type 2 LSAs?" Tags="|ospf|protocol-theory|rfc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7473" PostTypeId="2" ParentId="7472" CreationDate="2014-04-20T08:31:54.830" Score="3" Body="&lt;p&gt;For network LSA Link-State-Id will have the interface address which is acting as DR in that network, while Advertising Router-Id field will have the Router-Id of the router having the interface acting as Designated-Router for that network. RouterId can be different(some loopback) while the interface Ip address can be something else.&lt;/p&gt;&#xA;" OwnerUserId="3193" LastActivityDate="2014-04-20T08:31:54.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7474" PostTypeId="2" ParentId="7471" CreationDate="2014-04-20T09:40:28.407" Score="6" Body="&lt;h3&gt;Router ID must not be modified inside the same area&lt;/h3&gt;&#xA;&lt;p&gt;RtrB must not modify the Advertising RouterID in RouterA's LSA.&lt;/p&gt;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#page-119&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328 - OSPFv2: Section 12.1.5 &amp;quot;Advertising Router&amp;quot;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;12.1.5.  Advertising Router&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;        This field specifies the OSPF Router ID of the LSA's&#xA;        originator.  For router-LSAs, this field is identical to the&#xA;        Link State ID field.  Network-LSAs are originated by the&#xA;        network's Designated Router.  Summary-LSAs originated by&#xA;        area border routers.  AS-external-LSAs are originated by AS&#xA;        boundary routers.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Specifically, &lt;em&gt;For router-LSAs, this field is identical to the Link State ID field&lt;/em&gt; forbids modification of RouterA's LSA.&lt;/p&gt;&#xA;&lt;h3&gt;Detecting Self-originated LSAs&lt;/h3&gt;&#xA;&lt;p&gt;The fact that LSA Router-IDs must be unchanged when flooded is reinforced in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#page-151&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section 13.4: Receiving Self-Originated LSAs&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;13.4.  Receiving self-originated LSAs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;    It is a common occurrence for a router to receive self-&#xA;    originated LSAs via the flooding procedure. A self-originated&#xA;    LSA is detected when either 1) the LSA's Advertising Router is&#xA;    equal to the router's own Router ID or 2) the LSA is a network-&#xA;    LSA and its Link State ID is equal to one of the router's own IP&#xA;    interface addresses.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;A router knows it received a copy of its own LSAs when the Router ID inside the LSA is the same as its own Router ID; detecting self-originated LSAs within the same area would be impossible if Router IDs were modified in-transit.&lt;/p&gt;&#xA;&lt;h3&gt;Router ID may change at the Area Border Router&lt;/h3&gt;&#xA;&lt;p&gt;Your diagram doesn't mention a different area, and it implies this problem is within the same area when it mentions that RtrB re-advertises RouterA's LSA.  However, if RtrB was an ABR, and RtrC was in a different area than RouterA, then the Router ID for NetworkA &lt;em&gt;must&lt;/em&gt; have a different Router ID, because the ABR (RtrB) must originate a Type 3 Summary LSA for NetworkA when it sees RouterA's Type 1 Router LSA.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-04-20T10:21:19.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7475" PostTypeId="1" CreationDate="2014-04-20T09:45:53.763" Score="3" ViewCount="1354" Body="&lt;p&gt;We are trying to rebuild a few cisco show commands with SNMP OID information. Right now i'm working on MPLS and i'm trying to get the In/Out label info. I keep running into the same problem, the information I need is help by indexes that are marked &quot;not-accessible&quot;. For example the &lt;code&gt;MplsInSegmentLabel&lt;/code&gt; and &lt;code&gt;MplsInSegmentIfIndex&lt;/code&gt;. Is there a way I can view the information on these OIDs and indexes? I know my understanding of SNMP might not be complete enough but I would appreciate any help or even a push in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="5329" LastEditorUserId="3191" LastEditDate="2014-04-20T09:49:40.377" LastActivityDate="2014-04-22T19:07:01.730" Title="How can I view not-accessible SNMP indexes? MPLS implementation" Tags="|cisco|snmp|mpls|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7476" PostTypeId="2" ParentId="7453" CreationDate="2014-04-20T09:58:15.147" Score="4" Body="&lt;p&gt;On any router or firewall where you can put in static ARP or ND entries you might try to bind an address to MAC &lt;code&gt;ff:ff:ff:ff:ff:ff&lt;/code&gt; and then send the Wake-on-LAN packet to that address. If the router/firewall sends the packet onto the ethernet segment with destination &lt;code&gt;ff:ff:ff:ff:ff:ff&lt;/code&gt; then you'll have a broadcast packet...&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-04-20T09:58:15.147" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7477" PostTypeId="1" AcceptedAnswerId="42658" CreationDate="2014-04-20T11:55:21.673" Score="8" ViewCount="10131" Body="&lt;p&gt;In &lt;a href=&quot;http://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328&lt;/a&gt; it mentions that link-state information of all Loopback interfaces and all interfaces with network mask as /32 (host ip addresses) are advertised as stub network type. Now what about the cases where a interface with /24 mask is connected to a network and this is the only router interface connected to that network. Technically these are also stub networks right? So how does OSPF determine these /24 interface links as stub or not? Will it look for a OSPF neighbor-ship via that /24 interface and decide if that is a stub network? If that is the case what will be the decision for cases where there is another router connected the same network but doesn't run OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope the question is clear hence have not added any diagrams in case anyone needs some clarification please let me know i'll add diagrams to explain my question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Making long question short:- While generating Router LSAs how does OSPF decide to choose the link-type(p2p, stub, transit, Virtual-link) ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastEditorUserId="8499" LastEditDate="2018-12-27T01:35:58.143" LastActivityDate="2018-12-27T01:35:58.143" Title="How OSPF decides a network to be a stub network?" Tags="|ospf|protocol-theory|rfc|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7478" PostTypeId="2" ParentId="7477" CreationDate="2014-04-20T13:57:00.690" Score="1" Body="&lt;p&gt;&lt;strong&gt;Edit after Mike &amp;amp; Saran comment&lt;/strong&gt;: Stub network LSA (Router ID LSA with Type 3) is added to router LSA for loopback interfaces and any p2p or multipoint interfaces which don't have OSPF neighbors. Additionally, stub network LSAs are added to Router ID for p2p interfaces (links) even when there's existing neighbor to describe the links. Mask on the interface doesn't matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, OSPF cares only about OSPF neighbors, it can't detect non-OSPF neighbor and then decide it's actually non-stub - OSPF looks at the world from it's own point of view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(my old answer dealt with stub areas, which was not the actual question - sorry for that!)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="286" LastEditDate="2014-04-21T11:07:35.747" LastActivityDate="2014-04-21T11:07:35.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7480" PostTypeId="1" AcceptedAnswerId="7481" CreationDate="2014-04-20T15:48:55.717" Score="7" ViewCount="26508" Body="&lt;p&gt;I was playing with Wireshark and noticed two filters: &lt;code&gt;tcp.len&lt;/code&gt; and &lt;code&gt;tcp.data&lt;/code&gt;. What is the difference between the two? As far as I know, the &lt;code&gt;tcp.len&lt;/code&gt; (length) field tells how many bytes of data travel within a segment, correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks in advance :)&lt;/p&gt;&#xA;" OwnerUserId="5027" LastEditorUserId="3191" LastEditDate="2014-04-20T18:49:18.217" LastActivityDate="2014-04-20T18:49:18.217" Title="tcp.length and tcp.data wireshark filters" Tags="|tcp|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7481" PostTypeId="2" ParentId="7480" CreationDate="2014-04-20T16:45:39.707" Score="10" Body="&lt;p&gt;Simply put, &lt;code&gt;tcp.len&lt;/code&gt; filters the length of TCP segment data in bytes, while &lt;code&gt;tcp.data&lt;/code&gt; (or &lt;code&gt;tcp.segment_data&lt;/code&gt; in newer versions of Wireshark) filters for the actual data (sequence of bytes) within the TCP segment data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;tcp.len == 1&lt;/code&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Filters for TCP segment data that is exactly 1 byte in length &#xA;&lt;br&gt;&#xA;&lt;br&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;tcp.segment_data contains 49:27:6d:20:64:61:74:61&lt;/code&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Filters for TCP segment data that contains the hexadecimal sequence of 49:27:6d:20:64:61:74:61&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.wireshark.org/docs/dfref/t/tcp.html&quot;&gt;Quick reference for TCP filters&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2476" LastActivityDate="2014-04-20T16:45:39.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7483" PostTypeId="1" AcceptedAnswerId="7508" CreationDate="2014-04-20T20:22:36.913" Score="23" ViewCount="74647" Body="&lt;p&gt;I have heard from a few people that cables less than 1 meter are prone to transmission problems. Is there any minimum copper cabling length? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please explain if this is true or not and share any available RFCs or standard documents. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="5115" LastEditorUserId="8499" LastEditDate="2018-12-21T03:40:42.553" LastActivityDate="2020-11-02T10:28:16.050" Title="Minimum Ethernet Cable Length?" Tags="|ethernet|layer1|cable|cabling|" AnswerCount="7" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7484" PostTypeId="1" AcceptedAnswerId="7487" CreationDate="2014-04-20T21:11:50.190" Score="4" ViewCount="2629" Body="&lt;p&gt;Network guy working on Security problems -- hoping for some guidance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a subnet that I am using as a NAT block for one of my inside subnets.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NAT from inside-&amp;gt;outside : Convert source 10.0.0.0/23 to 10.100.0.0/23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am doing EIGRP with the outside.  I need to originate 10.100.0.0/23 and advertise it to the outside EIGRP neighbor.  However, the ASA won't originate the block because its not in the routing table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CiscoASA#show route | inc 10.100.0.0&#xA;CiscoASA#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried doing an interface-level summary to override this behavior.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel21 (outside interface)&#xA; summary-address eigrp 10 10.100.0.0 255.255.254.0&#xA;&#xA;CiscoASA#show route | inc 10.100.0.0|Null0&#xA;CiscoASA#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the route still isn't in the table, no Null0 route gets generated, and the neighbor doesn't see the summary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I can tell, there is no static null route or loopback interface functionality in the code I'm using (9.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the correct way to get a NAT block into the routing table, and then into EIGRP?&lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2015-01-09T14:27:54.687" Title="Cisco ASA Dynamic Routing - Originating a NAT Block" Tags="|cisco|routing|cisco-asa|eigrp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7485" PostTypeId="2" ParentId="7483" CreationDate="2014-04-20T22:41:43.980" Score="10" Body="&lt;p&gt;There is no minimum cable length when talking about standard copper-cables.&#xA;When it comes to fiber, there is a minimum length depending on technology, diodes and so on. &lt;/p&gt;&#xA;" OwnerUserId="5337" LastActivityDate="2014-04-20T22:41:43.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7486" PostTypeId="2" ParentId="7456" CreationDate="2014-04-20T22:49:02.913" Score="5" Body="&lt;p&gt;The &lt;code&gt;null 0&lt;/code&gt; interface can be seen as the same bitbucket as a &lt;code&gt;/dev/null&lt;/code&gt; device in UNIX/Linux. Everything that ends up there will just be dropped.&lt;/p&gt;&#xA;" OwnerUserId="5337" LastEditorUserId="3191" LastEditDate="2014-04-21T09:20:53.830" LastActivityDate="2014-04-21T09:20:53.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7487" PostTypeId="2" ParentId="7484" CreationDate="2014-04-21T01:10:52.243" Score="5" Body="&lt;p&gt;Creating a static route for &quot;10.100.00.0/23&quot; and redistributing it to EIGRP should do the trick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The static route would lift it into the routing table and the redistribution of static routs will announce the route to the EIGRP neighbors.&lt;/p&gt;&#xA;" OwnerUserId="5337" LastActivityDate="2014-04-21T01:10:52.243" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7488" PostTypeId="1" CreationDate="2014-04-21T01:45:23.133" Score="9" ViewCount="522" Body="&lt;p&gt;I have 2 Control Center Sites each with 2 N7Ks in a full mesh design and 2 Nexus 5548UP’s as Internal Server Farm Aggregation and 2 ASA Firewalls hanging off each N5K Agg. Both Sites have a mirror image design. We have users that need direct access to the Internal Server Farm Applications and we also need a security boundary for outbound connection requests from the Internal Server Applications. In addition, I need to host private DMZ’s within the Agg to isolate inbound connection requests from what we classify as lower security zones ( the N7K CORE will using vrf: Global for routes to lower security network subnets).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically the user would be considered lower secure zones but this design is for hosting a control system for a large power grid. With this in mind I also do not want to connect the users directly to the N5K Agg to allow SITE1 Server Farm Agg the ability to go down allowing SITE 2 to host the applications (currently we connect users to the same physical switch as the applications). I would like to provide a classic Data Center design where the Users route to the Server Farm from the HA L3 CORE (4 x N7K Full Mesh). However, as they are considered the same security level as the “Internal Servers”, I want to isolate them into a private VPN Cloud hosted on the N7K CORE. As N7K’s support MPLS, this would be the most logical, however, my current design has the L2/L3 boundary for the Internal Servers at the Nexus 5548 Aggregation since the firewalls are also connected there. Nexus 5K’s don’t support MPLS but they do support VRF Lite. The N5Ks are also connected in a full mesh to the local N7K’s at each site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To utilize all 4 links between the N5K’s and N7K’s I either need to configure pt to pt L3 links which pigeon holes the idea of isolating Internal User traffic from the Core from traffic needing to forwarded out the firewall, or I can utilize FabricPath between the 5K’s and 7K’s and use vrf lite where the only FabricPath vlans would be the interface SVI’s between the 4 nodes and the Firewall’s Outside vlan for connecting the N7K’s vrf: Global Routing table. This is probably overkill since these have to be licensed, but we have unique security requirements so cost tends to be a small issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Routing, I would install a default route in the firewall to point to N7K vrf: Global which would run OSPF or EIGRP and learning routes to other lower security networks. For the High Secure Zone, I would install a vrf: Internal on all N5K’s and N7K’s and most likey would run BGP since MPLS at the N7K’s requires the use of MP-BGP. This would only learn routes for the SITE2 Internal Server Farm and the Internal Users (our applications need L3 between Sites to prevent split brain). I also have to take great care in not allowing vrf: Global from exchanging routes with vrf: Internal as this would create an assymetric nightmare with Stateful Firewalls providing L3 connection between the 2 vrf’s. A simple default route at the local Site N5K and Firewall and a summary route in the N7K pointing to the Internal Server Subnets will prevent that problem.&#xA;Due to my being new to Nexus gear and especially FabricPath, I am not certain I should implement in this fashion since Fabricpath is really meant for scaling L2 for VMotion and Server to Server traffic, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternativly, I considered building another VDC off the N7K to provide FHRP and move the firewalls to the VDC. The N5K would only be using FabricPath and no L3 of any sort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being this is most likely not a typical design, I would appreciate any feedback on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Uli70.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Uli70.gif&quot; alt=&quot;q&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5338" LastEditorUserId="775" LastEditDate="2014-04-28T14:53:30.800" LastActivityDate="2015-05-31T16:16:59.623" Title="How to connect private users to applications within a trusted network without direct connection to the Server Switch" Tags="|design|cisco-nexus-5k|cisco-nexus-7k|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7494" PostTypeId="1" CreationDate="2014-04-21T10:58:06.837" Score="1" ViewCount="468" Body="&lt;p&gt;I have started my first job and apart from designing a network (which I have done) I'm to decide about back up solutions. I use Visio for diagramming but I have no idea whether a data back up should be in the diagram or not and how to do it.&#xA;I have a database servers and I assume there should be something to show their back up storage.&#xA;Any help greatly appreciated&lt;/p&gt;&#xA;" OwnerUserId="5343" LastEditorUserId="3191" LastEditDate="2014-12-08T20:21:02.923" LastActivityDate="2014-12-08T20:21:02.923" Title="Are data back up solutions shown on the network diagram?" Tags="|design|backups|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7495" PostTypeId="2" ParentId="7429" CreationDate="2014-04-21T11:15:35.980" Score="6" Body="&lt;h3&gt;Summary&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;You should use Cisco's &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/xe-3se/3650/esm-xe-3se-3650-book.html&quot; rel=&quot;noreferrer&quot;&gt;Embedded Syslog Manager&lt;/a&gt;. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/xe-3se/3650/esm-xe-3se-3650-book.html&quot; rel=&quot;noreferrer&quot;&gt;ESM&lt;/a&gt; can dynamically modify or throttle syslog messages when they are generated on the router.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/xe-3se/3650/esm-xe-3se-3650-book.html&quot; rel=&quot;noreferrer&quot;&gt;ESM&lt;/a&gt; Demo&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I built an example (see bottom of answer) of how to rate-limit configuration messages within a test time window; for the purposes of this demo, I substituted &lt;code&gt;[regexp {CONFIG} $::orig_msg]&lt;/code&gt; instead of &lt;code&gt;[regexp {FAN_LOW_RPM} $::orig_msg]&lt;/code&gt; so I could illustrate rate-limiting messages like &lt;code&gt;%SYS-5-CONFIG_I: Configured from console by vty0&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I edited the tcl script at the bottom of the answer with &lt;code&gt;[regexp {CONFIG} $::orig_msg]&lt;/code&gt;, and tftp'd the script into flash...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DEN-EDGE-02#copy tftp://172.16.1.5/filterSyslog.tcl flash:&#xA;Destination filename [filterSyslog.tcl]?&#xA;%Warning:There is a file already existing with this name&#xA;Do you want to over write? [confirm]&#xA;Accessing tftp://172.16.1.5/filterSyslog.tcl...&#xA;Loading filterSyslog.tcl from 172.16.1.5: !&#xA;[OK - 684 bytes]&#xA;&#xA;684 bytes copied in 0.104 secs (6577 bytes/sec)&#xA;DEN-EDGE-02#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I configured my router with the name of the script, and the syslog server's address (172.16.1.5).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging filter flash:filterSyslog.tcl&#xA;logging trap debugging&#xA;logging host 172.16.1.5 vrf mgmtVrf filtered&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now when you go into configuration mode on the router, the syslog messages are rate-limited.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami tftpboot]$ sudo tshark -ni eth0 udp and host 172.16.1.204&#xA;Running as user &quot;root&quot; and group &quot;root&quot;. This could be dangerous.&#xA;Capturing on eth0&#xA;  3.472614 172.16.1.204 -&amp;gt; 172.16.1.5   Syslog 177 LOCAL7.NOTICE: 278: Apr 21 05:37:58.189&#xA;   CDT: %SYS-5-CONFIG_I: Configured from console by vty0 (172.16.1.5) - This message was&#xA;   rate-limited by ESM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;How it works&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/xe-3se/3650/esm-xe-3se-3650-book.html&quot; rel=&quot;noreferrer&quot;&gt;ESM&lt;/a&gt; script at the bottom of the answer rate-limits &lt;code&gt;FAN_LOW_RPM&lt;/code&gt; messages.  The example leverages the fact that &lt;code&gt;NVMON-4-FAN_LOW_RPM&lt;/code&gt; messages are sent every 30 seconds.  For simplicity, I use an absolute 30-second window between 23:59:30 and 23:59:59 to rate-limit the messages.  This script assumes the syslogs are sent at a constant rate, and are &lt;em&gt;not&lt;/em&gt; intermittent.   In the attached script, I use timestamps in &lt;code&gt;HHMMSS&lt;/code&gt; (24-hour) format so they would map easily to integers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a syslog message is ready to be sent, IOS stores it in &lt;code&gt;$::orig_msg&lt;/code&gt;.  I just built a quick series of &lt;code&gt;if .. else&lt;/code&gt; clauses to detect whether the syslog message:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Matches the regular expression (in this case, &lt;code&gt;FAN_LOW_RPM&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Occurs in the 30-second window between 23:59:30 and 23:59:59 (inclusive)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If the message contains &lt;code&gt;FAN_LOW_RPM&lt;/code&gt; and is within the time window, the script sends the message.  Other messages containing &lt;code&gt;FAN_LOW_RPM&lt;/code&gt; messages are not sent.   All other syslogs are sent (because we only want to silence the noisy messages).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI, for simplicity I intentionally avoided persisting timestamp values between the last &lt;code&gt;NVMON-4-FAN_LOW_RPM&lt;/code&gt; syslog message seen, although someone could do that too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;&lt;em&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/xe-3se/3650/esm-xe-3se-3650-book.html&quot; rel=&quot;noreferrer&quot;&gt;ESM&lt;/a&gt; syslog rate-limit script&lt;/em&gt;:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Save this file in flash as &lt;code&gt;flash:filterSyslog.tcl&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;## Filename: filterSyslog.tcl&#xA;proc forceInteger { x } {&#xA;    set count [scan $x %d%s n rest]&#xA;    if { $count &amp;lt;= 0 || ( $count == 2 &amp;amp;&amp;amp; ![string is space $rest] ) } {&#xA;        # This is an error&#xA;        return &quot;-1&quot;&#xA;    }&#xA;    return $n&#xA;}&#xA;set time_start 235900&#xA;set time_end 235959&#xA;# See http://wiki.tcl.tk/498 for information about TCL's strange number-handling&#xA;set timestamp [forceInteger [clock format [clock seconds] -format %H%M%S]]&#xA;&#xA;### Modify the regexp below and use any message you want to rate-limit...&#xA;if { [regexp {FAN_LOW_RPM} $::orig_msg] } {&#xA;    if {($time_start &amp;lt;= $timestamp) &amp;amp;&amp;amp; ($timestamp &amp;lt;= $time_end)} {&#xA;        # Send syslog messages inside the $time_start and $time_end&#xA;        return &quot;$::orig_msg - This message was rate-limited by ESM&quot;&#xA;    } else {&#xA;        # Drop syslog messages outside $time_start to $time_end&#xA;        return &quot;&quot;&#xA;    }&#xA;} else {&#xA;    # Return all other syslog messages as usual&#xA;    return $::orig_msg&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-04-21T12:14:39.693" LastActivityDate="2014-04-21T12:14:39.693" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7496" PostTypeId="2" ParentId="7494" CreationDate="2014-04-21T11:22:25.873" Score="4" Body="&lt;p&gt;I would approach this by thinking of the conceptual layers: &quot;backups&quot; are an application that uses the network. So if you're going to include a representation of backups, then you should have all(most?) network using applications shown. So if that's what the diagram is about, then yes, include backups. If it is, for example, a physical wiring diagram, then there'd be no applications shown.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2014-04-21T11:22:25.873" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7501" PostTypeId="2" ParentId="6587" CreationDate="2014-04-21T16:21:43.890" Score="1" Body="&lt;p&gt;Currently no for all three, and I don't think there is support in the popular gear in general.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-04-21T16:21:43.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7504" PostTypeId="2" ParentId="653" CreationDate="2014-04-21T18:04:46.323" Score="2" Body="&lt;p&gt;OK. Something that works on all switches starting from 2900 (don't have older to test) and shows only down ports.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh int | i is down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd love to use &lt;code&gt;sh int status&lt;/code&gt; but after that the result is &lt;code&gt;connected&lt;/code&gt; and &lt;code&gt;notconnected&lt;/code&gt;, so exclude or include don't do any good because the word connected is part of both, so you get the story.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case on a 3524 I get that below with both commands in order to make clear it works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SD-LIB-C3524#sh int status&#xA;&#xA;Port    Name               Status       Vlan     Duplex Speed   Type&#xA;------- ------------------ ------------ -------- ------ ------- ----&#xA;Fa0/1                      notconnect   10         Auto    Auto 100BaseTX/FX&#xA;Fa0/2                      notconnect   10         Auto    Auto 100BaseTX/FX&#xA;Fa0/3                      connected    10       A-Full   A-100 100BaseTX/FX&#xA;Fa0/4                      notconnect   10         Auto    Auto 100BaseTX/FX&#xA;Fa0/5                      notconnect   10         Auto    Auto 100BaseTX/FX&#xA;Fa0/6                      notconnect   10         Auto    Auto 100BaseTX/FX&#xA;Fa0/7                      notconnect   10         Auto    Auto 100BaseTX/FX&#xA;Fa0/8                      notconnect   10         Auto    Auto 100BaseTX/FX&#xA;Fa0/9                      connected    10       A-Full   A-100 100BaseTX/FX&#xA;Fa0/10                     notconnect   10         Auto    Auto 100BaseTX/FX&#xA;Fa0/11                     connected    10       A-Full   A-100 100BaseTX/FX&#xA;Fa0/12                     connected    10       A-Full   A-100 100BaseTX/FX&#xA;Fa0/13  WiFi SD-LIB-15     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/14  WiFi SD-LIB-22     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/15  WiFi SD-LIB-16     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/16  WiFi SD-LIB-23     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/17  WiFi SD-LIB-17     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/18  WiFi SD-LIB-24     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/19  WiFi SD-LIB-18     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/20  WiFi SD-LIB-14     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/21  WiFi SD-LIB-19     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/22  WiFi SD-LIB-21     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/23  WiFi SD-LIB-20     connected    40       A-Full   A-100 100BaseTX/FX&#xA;Fa0/24  SD-LIB-3C4500-50P  connected    trunk    A-Full   A-100 100BaseTX/FX&#xA;Gi0/1                      notconnect   trunk      Auto    1000 Missing&#xA;Gi0/2                      notconnect   10         Auto    1000 Missing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SD-LIB-C3524#sh int | i is down&#xA;VLAN1 is up, line protocol is down&#xA;FastEthernet0/1 is down, line protocol is down&#xA;FastEthernet0/2 is down, line protocol is down&#xA;FastEthernet0/4 is down, line protocol is down&#xA;FastEthernet0/5 is down, line protocol is down&#xA;FastEthernet0/6 is down, line protocol is down&#xA;FastEthernet0/7 is down, line protocol is down&#xA;FastEthernet0/8 is down, line protocol is down&#xA;FastEthernet0/10 is down, line protocol is down&#xA;GigabitEthernet0/1 is down, line protocol is down&#xA;GigabitEthernet0/2 is down, line protocol is down&#xA;SD-LIB-C3524#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5349" LastEditorUserId="3191" LastEditDate="2014-04-21T18:29:28.640" LastActivityDate="2014-04-21T18:29:28.640" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7506" PostTypeId="2" ParentId="7483" CreationDate="2014-04-21T19:39:14.327" Score="6" Body="&lt;p&gt;I'm not sure if the minimum cable length was ever listed in an RFC. Whatever the minimum is depends on several factors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A basic description of the problem caused by cables being too short is that the electrical signal, when transmitted will bounce off the end of the wire and reflect back in the other direction. Just like throwing a ball at a wall if you're close enough to the wall when the ball bounces back it may reach you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a networking signal, if the signal bounces back and is strong enough to reach the sender, then the sender has to figure out if the signal is new, or a reflection of its own transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many factors that go into whether or not bounce back will happen; transmission signal strength, wire resistance, cable length, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, whatever the minimum is, it's long enough to not receive bounce back. In the early days of Ethernet networking, for twisted pair it was one meter. Today equipment is usually manufactured with a number of counter measures to reduce or eliminate the effects of bounce back. I've reliably used cables as small as one foot without problems. But again, that will depend on whether the rest of the physical equipment and software can compensate adequately for the short length.&lt;/p&gt;&#xA;" OwnerUserId="500" LastActivityDate="2014-04-21T19:39:14.327" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7508" PostTypeId="2" ParentId="7483" CreationDate="2014-04-21T19:59:47.250" Score="9" Body="&lt;p&gt;I once made a crossover adaptor using a coupler and 2 tips butted almost against one another with probably less than an inch of cable between each connector point. Worked great!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point is, you won't find any standard spec on a short cable length. All you have to go off of here is user experience. There are tons of threads where people say their 6&quot; patches are fine. Some report dropped packets. Some people like me have used 4&quot; ones for trunks between switches without issues. Others have replaced short cables with long ones and resolved network issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do what works for you in this regard. If you implement short cable lengths, you would be wise to watch the port for errors to ensure the operation, but after it's fine for a while, I would figure it would be fine in general.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's another thread with a link that was considered uncreditable here. &lt;a href=&quot;https://serverfault.com/questions/108480/what-is-the-minimum-ethernet-cable-length-for-a-cat6-gigabit-connection&quot;&gt;https://serverfault.com/questions/108480/what-is-the-minimum-ethernet-cable-length-for-a-cat6-gigabit-connection&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5135" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2014-04-22T03:22:32.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7509" PostTypeId="2" ParentId="7477" CreationDate="2014-04-21T21:28:19.657" Score="-1" Body="&lt;p&gt;OSPF uses the E-Bit or flag in hello packets to show an area as stub. &lt;/p&gt;&#xA;" OwnerUserId="1433" LastActivityDate="2014-04-21T21:28:19.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7511" PostTypeId="2" ParentId="7494" CreationDate="2014-04-22T02:16:32.360" Score="3" Body="&lt;p&gt;I create several different layers of diagrams. This is required to completely document a network. I keep application specific information off of physical diagram. My physical diagram usually includes IP addresses as well, and some basic info about the devices themselves (Make, model, firmware, etc). I then make logical network diagrams that include applications, like Exchange, SQL, Backups, etc. Finally, I'll usually include a logical application diagram that explains rules for services, open ports, how clients connect, etc (For those applications listed above, like Exchange RPC/HTTP, Autodiscover, SMTP, etc). And I also have a logical application diagram for the backup server, saying what is backed up, when (schedules), how (agent, local or remote, xcopy, rsync, etc).&lt;/p&gt;&#xA;" OwnerUserId="5135" LastActivityDate="2014-04-22T02:16:32.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7512" PostTypeId="2" ParentId="7477" CreationDate="2014-04-22T04:29:45.637" Score="12" Body="&lt;h2&gt;A Tale of Three Stubs...&lt;/h2&gt;&#xA;&lt;p&gt;When using Cisco equipment, OSPF calls several things a &amp;quot;stub&amp;quot;... it gets a bit confusing....&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Stub Host&lt;/li&gt;&#xA;&lt;li&gt;Stub Network&lt;/li&gt;&#xA;&lt;li&gt;Stub Area&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The meanings are very different for each term; even more confusing is the reality that you can potentially apply multiple stub terms to a single OSPF interface.  I'll elaborate more below.&lt;/p&gt;&#xA;&lt;h3&gt;Background&lt;/h3&gt;&#xA;&lt;p&gt;Let's clear up some terminology... The question starts off asking about what Cisco is calling a &amp;quot;Stub Host&amp;quot;... OSPF automatically assigns Loopback interfaces to this category...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CORE01.PUB.DAL02#sh ip ospf interface lo0&#xA;Loopback0 is up, line protocol is up&#xA;  Internet Address 128.66.62.5/32, Area 0.0.0.0&#xA;  Process ID 100, Router ID 128.66.62.5, Network Type LOOPBACK, Cost: 1&#xA;  Loopback interface is treated as a stub Host&#xA;                                     ^^^^^^^^^&#xA;CORE01.PUB.DAL02#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;All this is not to be confused with what OSPF refers to as &amp;quot;Stub Network&amp;quot;... which merely means a network without an OSPF neighbor&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CORE01.PUB.DAL02#sh ip ospf data router internal&#xA;    ...&#xA;    Link connected to: a Transit Network                &amp;lt;-------  Broadcast Intf w/ Neighbor&#xA;     (Link ID) Designated Router address: 128.66.62.75  &amp;lt;-------&#xA;     (Link Data) Router Interface address: 128.66.62.75&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 10&#xA;    ...&#xA;    Link connected to: a Stub Network                 &amp;lt;------  Broadcast Intf w/o Neighbor&#xA;     (Link ID) Network/subnet number: 128.66.62.32    &amp;lt;------&#xA;     (Link Data) Network Mask: 255.255.255.248&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 1&#xA;&#xA;    Link connected to: a Stub Network                 &amp;lt;------ Loopback interface&#xA;     (Link ID) Network/subnet number: 128.66.62.5&#xA;     (Link Data) Network Mask: 255.255.255.255&#xA;      Number of TOS metrics: 0&#xA;       TOS 0 Metrics: 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Then, of course, we have an &lt;a href=&quot;http://packetlife.net/blog/2008/jun/24/ospf-area-types/&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSPF Stub Area&lt;/a&gt;.  Let's consider where all this comes from...&lt;/p&gt;&#xA;&lt;h3&gt;OSPF Stub Network vs OSPF Transit Network&lt;/h3&gt;&#xA;&lt;p&gt;Transit and Stub networks are discussed in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#page-13&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328: OSPFv2 - Section 2.1&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;2.  The Link-state Database: organization and calculations&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;      The following subsections describe the organization of OSPF's link-&#xA;      state database, and the routing calculations that are performed on&#xA;      the database in order to produce a router's routing table.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;      2.1.  Representation of routers and networks&#xA;&#xA;                                    ... Networks can be either transit or&#xA;            stub networks. Transit networks are those capable of carrying&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;            data traffic that is neither locally originated nor locally&#xA;            destined. A transit network is represented by a graph vertex&#xA;            having both incoming and outgoing edges. A stub network's vertex&#xA;            has only incoming edges.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The whole point of this distinction between &lt;em&gt;Transit Network&lt;/em&gt; and &lt;em&gt;Stub Network&lt;/em&gt; is to save resources in the router.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Transit Networks&lt;/em&gt; must maintain additional memory for neighbor information&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Stub Networks&lt;/em&gt; save memory on the router because no neighbors need to be assigned&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;When we start scaling to potentially thousands of LSAs, even small memory savings are important.  Note that OSPF hellos are still sent on a stub networks, and they are capable of forming neighbors / transitioning to a transit network unless the interface has been administratively marked as a passive interface.&lt;/p&gt;&#xA;&lt;h3&gt;OSPF Host Routes - Cisco's &amp;quot;Stub Host&amp;quot;&lt;/h3&gt;&#xA;&lt;p&gt;So now we still have the original discussion about the &lt;em&gt;Stub Host&lt;/em&gt;, which also happens to be an OSPF &lt;em&gt;Stub Network&lt;/em&gt;.  This concept comes from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#page-67&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328: OSPFv2 - Section 9.1&lt;/a&gt;, where it discusses various interface states...&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;9.1.  Interface states&#xA;&#xA;      The various states that router interfaces may attain is&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;      documented in this section.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;      Down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;      ...&#xA;      Loopback&#xA;              ... For this reason, IP packets may&#xA;        still be addressed to an interface in Loopback state.  To&#xA;        facilitate this, such interfaces are advertised in router-&#xA;        LSAs as single host routes, whose destination is the IP&#xA;        interface address.[4]&#xA;      ...&#xA;      Waiting&#xA;      ...&#xA;      Point-to-point&#xA;      ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The RFC requires Loopback network types to be advertised as a /32 host route.  What Cisco calls a &lt;em&gt;Stub Host&lt;/em&gt; in &lt;code&gt;show ip ospf interface&lt;/code&gt; output is really just the Loopback interface type, which OSPF allocates automatically as a &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/9237-9.html#qone&quot; rel=&quot;nofollow noreferrer&quot;&gt;/32 host route within OSPF&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;h3&gt;OSPF Stub Area&lt;/h3&gt;&#xA;&lt;p&gt;Stub areas are covered in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#page-37&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328: OSPFv2 - Section 3.6&lt;/a&gt;.  There are several categories of OSPF stub areas...&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Stub Area&lt;/em&gt;: No Type-5 External LSAs are allowed in this area, which means no route redistribution inside the area.  A Type-3 Network LSA is originated at the ABR so no connectivity is lost from Type 5 LSAs which are blocked by the stub feature.  OSPF has a E-bit field in Hello packets (E-bit = &lt;code&gt;ExternalRoutingCapability&lt;/code&gt;), which is cleared when an area is configured as a Stub Area&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Totally Stubby Area&lt;/em&gt;: No Type-5 External LSAs, and only the Type-3 Network LSA default route is permitted.  This is a vendor-specific feature, which is not covered in RFC 2328.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Not So Stubby Area&lt;/em&gt;: No Type-5 External LSAs are allowed, but redistribution is permitted via a special Type-7 LSA.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;Summary&lt;/h3&gt;&#xA;&lt;p&gt;In summary, we talked about...&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Stub Host&lt;/em&gt;: A loopback network-type, which is always advertised as a /32 host route; Cisco calls this a stub host.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Stub Network&lt;/em&gt;: An OSPF network, which does not have a neighbor attached to it&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Stub Area&lt;/em&gt;: An OSPF area, which does not permit Type-5 External LSAs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;If you really want to wrap your mind around all this, consider an OSPF router, which has a loopback interface; this router is completely contained in a single OSPF stub area.  Technically, you could apply all three of the OSPF &amp;quot;stub&amp;quot; terms to this Loopback (Stub Host, Stub Network, Stub Area).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-04-22T12:11:06.087" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7513" PostTypeId="1" AcceptedAnswerId="43135" CreationDate="2014-04-22T07:46:44.780" Score="7" ViewCount="1747" Body="&lt;p&gt;One of my BGP transit customers has asked me for a solution to make it easier for him to blackhole traffic within our network when he's suffering from DDoS attacks. Usually, BGP blackholing is done by blackholing the &lt;em&gt;target&lt;/em&gt;, however, my customer is looking for a solution to blackhole based on the &lt;em&gt;source address&lt;/em&gt; so the target of the attack won't be taken offline. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Building a blackhole solution based on the target address isn't that hard: just have the customer announce the target as a more specific route via a seperate BGP session or have him tag it with a specific community, then use a routing policy to set the next-hop to some discard interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Building a blackhole solution where sources of the attack (which are not within the customer's IP-space) are blackholed seems to be a bit harder. If I'd use the same solution as for filtering destinations my problem is that I only want to discard traffic from specific sources towards this specific customer, so inserting discard routes into my routing table isn't acceptable anymore since it would affect other customers as well. So I need some way to create a filter which only applies to this specific customer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first solution I was thinking about was to use BGPFlowspec. Unfortunately, this won't work for this specific customer since his equipment doesn't support it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I've been looking for is a way to create a dynamic firewall filter based on some routing property, most likely a community set either by our customer or by us when receiving a specific route via a dedicated BGP blackhole session. This filter then can be applied on the customer's interfaces to block unwanted traffic. Unfortunately, I haven't found an easy way to create a firewall filter (or prefix-list) this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did find &lt;a href=&quot;http://thomas.mangin.com/posts/bgp-firewall.html&quot; rel=&quot;nofollow&quot;&gt;http://thomas.mangin.com/posts/bgp-firewall.html&lt;/a&gt;, which 'misuses' SCU/DCU to more or less achieve what I'm looking for, but it does sound like a bit of a hack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the other solutions I can think of is to create some static filter on our routes and build an interface which allows our customer to modify the prefix-list used by this filter. However, pushing configuration changes on my routers every time the customer wants to add a blackhole isn't really what I want. Some solution using BGP would be preferred.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On our side routing is done on Juniper, for a solution I'd prefer to have something which can be used on a variety of platforms, so it basically should just us BGP via a separate session or tagging routes via a specific community. This way I can use it for other customers as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm really interested if anyone has a nice solution for this (other than the SCU/DCU one).&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2015-06-24T05:03:20.243" LastActivityDate="2017-09-08T17:39:37.877" Title="Creating a JunOS firewall filter based on dynamic routing properties" Tags="|routing|bgp|firewall|juniper-junos|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="7514" PostTypeId="1" AcceptedAnswerId="7518" CreationDate="2014-04-22T10:36:58.317" Score="9" ViewCount="2391" Body="&lt;p&gt;In the JNCIA study guide, it is stated that there are currently 120k routes on the internet and that Juniper supported up to 450k. How did they arrive at the 120k? If I wanted to know how many exact routes, how could I find that by myself?&lt;/p&gt;&#xA;" OwnerUserId="2314" LastEditorUserId="509" LastEditDate="2014-04-22T21:43:09.133" LastActivityDate="2014-04-25T13:01:47.743" Title="How can I calculate the number of internet routes myself?" Tags="|routing|bgp|internet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7516" PostTypeId="1" CreationDate="2014-04-22T11:09:52.283" Score="4" ViewCount="156" Body="&lt;p&gt;Does anyone know if it is possible to upgrade a Cisco2921-SEC/K9 to Cisco2921-AX/K9 (WAAS)? I mean is it the same hardware and all I need is to upgrade the licence? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;/Andreas&lt;/p&gt;&#xA;" OwnerUserId="2067" LastActivityDate="2014-04-23T13:28:53.660" Title="Cisco 2921 SEC upgradable to WAAS?" Tags="|cisco|cisco-ios|waas|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7517" PostTypeId="2" ParentId="7514" CreationDate="2014-04-22T11:42:13.987" Score="17" Body="&lt;p&gt;I think your study guide is a little outdated. Currently we are at about 500k routes on the Internet. Geoff Huston is collecting stats weekly. You can find his reports &lt;a href=&quot;http://bgp.potaroo.net/&quot;&gt;here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see for yourself goto &lt;a href=&quot;http://www.routeviews.org/&quot;&gt;http://www.routeviews.org/&lt;/a&gt; and get access to some real systems on the internet. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorDisplayName="user2084" LastEditDate="2014-04-22T13:08:44.207" LastActivityDate="2014-04-22T13:08:44.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7518" PostTypeId="2" ParentId="7514" CreationDate="2014-04-22T11:42:41.547" Score="8" Body="&lt;p&gt;The  backbone routers of ISPs (to be precise, Tier-1 ISPs) constitute what is known as the &quot;default-free zone.&quot;  In this zone, there are no default routes -- every route that is announced on the Internet is carried in the router's route table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's simply a matter of counting the table entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to count yourself, you have to arrange a BGP peering session with your ISP and have them send you all routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Happy counting! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. the exact number is constantly changing as new networks come on-line or get disconnected.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-04-25T13:01:47.743" LastActivityDate="2014-04-25T13:01:47.743" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7519" PostTypeId="1" CreationDate="2014-04-22T12:55:18.833" Score="9" ViewCount="845" Body="&lt;p&gt;I'm looking to install ethernet ports in a small business. There are 7-8 groups of cubicles each with 4 desks. Ideally I'd like to run a cable to each desk but if my math is correct I'm looking at nearly 6,000+ feet of cable to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw something about multi-pair cables but I'm pretty sure thats just for voice. Is there such a thing as a Cat5e or even Cat6 cable that would run something like 32(4x8) wires that can be split and terminated into a wall outlet rather than 4 individual ethernet cable drops?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, besides adding a switch, what could I do to accomplish the goal &quot;professionally&quot;?&lt;/p&gt;&#xA;" OwnerUserId="5356" LastEditorUserId="8499" LastEditDate="2018-03-20T23:48:45.610" LastActivityDate="2018-03-20T23:48:45.610" Title="Multi-drop Cat5e/6 Cable?" Tags="|ethernet|layer1|cable|cabling|utp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7520" PostTypeId="2" ParentId="7514" CreationDate="2014-04-22T13:04:19.463" Score="9" Body="&lt;p&gt;In addition to the good answers already given by Jens Link and Ron: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's no absolute, objective answer how many routes are active on the internet. The number constantly changes due to networks connecting and disconnecting, routers having outages, etc. Some prefixes are announced only to specific other networks (e.g. using a no-export community) and are meant to be seen only in specific parts of the internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to that, there's filtering: not every network filters routes it receives the same way. Some don't at all, some filter so that small prefix (/24 upto /32 in IPv4, /48 upto /128 in IPv6) won't be accepted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every network has its own view of the internet. And more prefixes in a routing table isn't always better, it can also mean bad filtering, accepting a lot of deaggregated routes, etc.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-04-22T13:04:19.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7521" PostTypeId="2" ParentId="7519" CreationDate="2014-04-22T14:17:39.457" Score="4" Body="&lt;p&gt;6,000+ feet... so? Cable is CHEAP compared to the labor to install it. If you're constrained by budget, skip the terminations (the patch panels back at the 'core' and the jacks at the 'ends'.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Figure out what you really need, (the number and type of cable needed to serve the existing users/systems). And then install MORE; I'd suggest install TWICE what you currently need. But if you're pulling into those little columns in the cube corners, maybe just leave the extra cables up in the ceiling (labeled!), or only pull two extras per current four... or something like that.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2014-04-22T14:17:39.457" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7522" PostTypeId="1" CreationDate="2014-04-22T14:41:18.577" Score="2" ViewCount="545" Body="&lt;p&gt;I currently have fiber vlan trunks between all of our buildings. We are adding another ip camera server and am looking to segregate traffic. I am thinking of dedicating a fiber link and putting it on the specific ip camera vlan so traffic for the cameras in those buildings would only use that fiber and not the fiber trunk back to the main office. I have attached a a drawing of the current layout plus additional links to be added. What is the best way to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RpeYt.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RpeYt.jpg&quot; alt=&quot;proposed network layout&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5359" LastEditorUserId="3191" LastEditDate="2014-04-22T14:49:05.377" LastActivityDate="2014-04-22T17:06:24.150" Title="VLAN links for IP Cameras" Tags="|vlan|spanning-tree|trunk|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7523" PostTypeId="2" ParentId="7522" CreationDate="2014-04-22T17:06:24.150" Score="7" Body="&lt;p&gt;The short answer is, your proposed additional fiber in the diagram will not gain you any real advantage for VLAN 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All traffic from Packaging or Fiberglass, destined to the server in Shipping on VLAN 3, will still traverse the Core.  (Presuming that you have already properly tuned your Spanning Tree settings to make the Core switch stack the root bridge.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is due to the &lt;a href=&quot;http://i.dell.com/sites/doccontent/shared-content/data-sheets/en/Documents/powerconnect-5500-series-spec.pdf&quot;&gt;Dell 5500 series switches&lt;/a&gt; only supporting &lt;a href=&quot;http://en.wikipedia.org/wiki/Spanning_Tree_Protocol&quot;&gt;regular 802.1D Spanning Tree&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Spanning_Tree_Protocol#Rapid_Spanning_Tree_Protocol&quot;&gt;802.1w Rapid Spanning Tree&lt;/a&gt;.  What this means, is that in your entire switched domain in the diagram, there is only one Spanning Tree for all VLANs.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you are set on adding additional links, and dealing with VLAN 3 in this way, you have several alternatives (viable or not, depending on your circumstances):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Install switches capable of running &lt;a href=&quot;http://en.wikipedia.org/wiki/Spanning_Tree_Protocol#Multiple_Spanning_Tree_Protocol&quot;&gt;MST (Multiple Spanning Tree)&lt;/a&gt;&lt;/strong&gt;, which allows you to create VLAN to Spanning Tree mappings.  (Your core switches (Dell 7048P) &lt;a href=&quot;http://i.dell.com/sites/doccontent/shared-content/data-sheets/en/Documents/Dell_PowerConnect_7000_Series.pdf&quot;&gt;DO support MST&lt;/a&gt;, but the 5548P switches do not.) You could assign all other VLANS to MST Instance 1, and then assign VLAN 3 to MST Instance 3 (instance numberings are just for example).  Then you would tune the settings so that the root bridge for MST Instance 1 is your core stack, and root bridge for MST Instance 3 is the Shipping switch.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Install another vendor's switches which are capable of creating a Spanning Tree instance for each VLAN.&lt;/strong&gt;  It is called different things by different vendors, &lt;a href=&quot;http://en.wikipedia.org/wiki/Spanning_Tree_Protocol#Per-VLAN_Spanning_Tree_and_Per-VLAN_Spanning_Tree_Plus&quot;&gt;PVST+ in Cisco&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Spanning_Tree_Protocol#VLAN_Spanning_Tree_Protocol&quot;&gt;VLAN Spanning Tree&lt;/a&gt; in Juniper, etc.  Similar to MST, tune the Per VLAN Spanning Tree instance for VLAN 3 to make the Shipping switch the root bridge for that instance.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;With all of that said, there are still one main concern in my mind. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why locate the server in the building with the Shipping switch?&lt;/strong&gt;  You would be better served by placing it in the main location with your Core switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it &lt;strong&gt;MUST&lt;/strong&gt; be attached to the Shipping switch, and you can't make changes to the switches to get a more robust Spanning Tree configuration, you still have a few options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could increase your bandwidth to each switch in order to handle the hair-pining of VLAN 3 traffic through the core.  All of your Dell switches support LACP link aggregation, this would allow you to gain bandwidth easily between the switches to support the IP-Cameras.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2014-04-22T17:06:24.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7524" PostTypeId="1" CreationDate="2014-04-22T18:19:36.650" Score="1" ViewCount="367" Body="&lt;p&gt;I'm implementing SNMP and i've been digging through MIBs for the past few days. I have managed to extract the equivalent of the show command 'show mpls forwarding-table' through the 'MplsLsrMib', but this show command does not contain the labels of associated with routes learned through BGP - only the locally generated labels. I've been digging through the VPN MIBs and all of the MPLS and BGP MIBs and so far i've come up with nothing. &#xA;According the the &quot;MIBs and RFCs&quot; section of the documantations linked below i'm beggining to think that this information doesn't exist through SNMP on any MIB.&#xA;If anyone could shed some light on this I'd appriciate it immensely.&#xA;Thanks!&#xA;Docs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/fscsc22.html#wp1015347&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/fscsc22.html#wp1015347&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2s/feature/guide/fsiaslbl.html#wp1032445&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2s/feature/guide/fsiaslbl.html#wp1032445&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;EDIT: Thanks for the the comment, i'm using IOS 15.1(4)M2 and 12.4&lt;/p&gt;&#xA;" OwnerUserId="5329" LastEditorUserId="5329" LastEditDate="2014-04-23T06:28:44.233" LastActivityDate="2024-01-22T07:08:35.027" Title="Where can I find MPLS/BGP VPNv4 labels through SNMP (cisco IOS router)?" Tags="|cisco|snmp|mpls|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7525" PostTypeId="2" ParentId="7475" CreationDate="2014-04-22T19:07:01.730" Score="4" Body="&lt;p&gt;It may happen that the OID`s you are querying are not implemented on the device. It may happen that either those are not supported or not implemented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just in case for your verification you can use &quot;-Cc&quot; option of snmpwalk which will give you the whole MIB.&lt;/p&gt;&#xA;" OwnerUserId="5361" LastActivityDate="2014-04-22T19:07:01.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7527" PostTypeId="1" CreationDate="2014-04-22T19:13:18.247" Score="2" ViewCount="7465" Body="&lt;p&gt;I've the next Lab with GNS3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two autonomous systems(100,200), when the AS 100 run a OSPF with two areas, &lt;code&gt;0&lt;/code&gt; and &lt;code&gt;1&lt;/code&gt;. The AS 200 has only a router and computer, so easy. But I don't know how to setup the BGP protocol between the AS 100 and as 200.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How should I setup R7 and R8 to work with BGP?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eAz6c.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eAz6c.png&quot; alt=&quot;network overview&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AS100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BZRUH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BZRUH.png&quot; alt=&quot;network diagram, autonomous system 100&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AS200&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uF48M.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uF48M.png&quot; alt=&quot;network diagram, autonomous system 200&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;OSPF Setup&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#enable&#xA;R1#configure terminal&#xA;R1(config)#router ospf 1&#xA;R1(config-router)#Router-id 1.1.1.1&#xA;R1(config-router)#network 192.168.0.0  0.0.0.255 area 0&#xA;R1(config-router)#network 10.0.0.0  0.0.0.3 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#enable&#xA;R1#configure terminal&#xA;R1(config)#router ospf 1&#xA;R1(config-router)#Router-id 2.2.2.2&#xA;R1(config-router)#network 10.0.0.0  0.0.0.3 area 0&#xA;R1(config-router)#network 10.0.0.4  0.0.0.3 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R3:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#enable&#xA;R1#configure terminal&#xA;R1(config)#router ospf 1&#xA;R1(config-router)#Router-id 3.3.3.3&#xA;R1(config-router)#network 10.0.0.4  0.0.0.3 area 0&#xA;R1(config-router)#network 10.0.0.8  0.0.0.3 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R4:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#enable&#xA;R1#configure terminal&#xA;R1(config)#router ospf 1&#xA;R1(config-router)#Router-id 4.4.4.4&#xA;R1(config-router)#network 172.16.0.0 0.0.0.255 area 1&#xA;R1(config-router)#network 11.0.0.0  0.0.0.3 area 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R5:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#enable&#xA;R1#configure terminal&#xA;R1(config)#router ospf 1&#xA;R1(config-router)#Router-id 5.5.5.5&#xA;R1(config-router)#network 11.0.0.0  0.0.0.3 area 1&#xA;R1(config-router)#network 11.0.0.4  0.0.0.3 area 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R6:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#enable&#xA;R1#configure terminal&#xA;R1(config)#router ospf 1&#xA;R1(config-router)#Router-id 6.6.6.6&#xA;R1(config-router)#network 11.0.0.4  0.0.0.3 area 1&#xA;R1(config-router)#network 11.0.0.8  0.0.0.3 area 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R7:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#enable&#xA;R1#configure terminal&#xA;R1(config)#router ospf 1&#xA;R1(config-router)#Router-id 7.7.7.7&#xA;R1(config-router)#network 10.0.0.8  0.0.0.3 area 0&#xA;R1(config-router)#network 11.0.0.8  0.0.0.3 area 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;BGP Setup&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R7:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R7#en&#xA;R7#conf t&#xA;R7(config)# router bgp 100&#xA;R7(config-router)#neighbor 190.0.0.2 remote-as 200&#xA;R7(config-router)#network 190.0.0.0 mask 255.255.255.252&#xA;R7(config-router)#network 10.0.0.8 mask 255.255.255.252&#xA;R7(config-router)#network 11.0.0.0 mask 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R8:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R8#en&#xA;R8#conf t&#xA;R8(config)# router bgp 200&#xA;R8(config-router)#neighbor 190.0.0.1 remote-as 100&#xA;R8(config-router)#network 190.0.0.0 mask 255.255.255.252&#xA;R8(config-router)#network 173.31.0.0 mask 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R7 routing table:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PzTn5.png&quot; alt=&quot;R7 RIB&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R8 routing table:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0Tahw.png&quot; alt=&quot;R8 RIB&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Setup the vpcs&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VPCS[1]&amp;gt; ip 192.168.0.2 24 192.168.0.1&#xA;VPCS[1]&amp;gt; 2&#xA;VPCS[2]&amp;gt; ip 172.16.0.2 24 172.16.0.1&#xA;VPCS[2]&amp;gt; 3&#xA;VPCS[3]&amp;gt; ip 172.31.0.2 24 172.31.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that when I try to do a ping from computer c3 to f0/0 or f0/01 in the router R7 not works only come until to s0/0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How should setup the router R7 and R8, to work with BGP?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your answers.&lt;/p&gt;&#xA;" OwnerDisplayName="user5362" LastEditorUserId="3191" LastEditDate="2014-04-23T07:20:39.540" LastActivityDate="2018-08-22T19:50:05.970" Title="Setup the BGP + ospf network" Tags="|routing|bgp|ospf|gns3|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7531" PostTypeId="2" ParentId="7483" CreationDate="2014-04-22T21:20:02.337" Score="12" Body="&lt;p&gt;As I currently do not have the full standards available to me, the best answer I have seen on this topic is from the &lt;a href=&quot;http://forums.bicsi.org/&quot; rel=&quot;noreferrer&quot;&gt;forums&lt;/a&gt; at the &lt;a href=&quot;https://www.bicsi.org/default.aspx&quot; rel=&quot;noreferrer&quot;&gt;BICSI website&lt;/a&gt;. Based on &lt;a href=&quot;http://forums.bicsi.org/Topic2210-4-1.aspx#bm2215&quot; rel=&quot;noreferrer&quot;&gt;this post&lt;/a&gt; by an employee of &lt;a href=&quot;http://www.flukenetworks.com/&quot; rel=&quot;noreferrer&quot;&gt;Fluke Networks&lt;/a&gt; (manufacturer of a number of popular cabling test units), there appears to be no minimum length in the standard.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there are both an implied minimum length and recommendations for minimum lengths when using minimally compliant components for Cat5e/6 and Cat6A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the applicable quote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For Category 5e and 6, there is no minimum length requirement. ANSI/TIA/EIA-568-B.2-1 in Annex K does give a warning about reflected FEXT on shorter links with minimally compliant components. The obvious solution is not to purchase minimally compliant components. In the early days of Cat 6 when vendors were struggling to do better than marginally compliant, short links were an issue. Today, this is not an issue if you stay with a main stream vendor.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Within this same standard, there is also advice on distance when using a consolidation point. It advises a minimum distance of 5 m between the CP and TO. In ISO/IEC they are a little more clearer is specifying 15 m between the DP and CP. This is all for Category 6/Class E.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With regards to Category 6A, there is a minimum length requirement - kind of. In Annex J of ANSI/TIA-568-B.2-10 is describes worst case modeling using a 10 m link. The suggestion therefore is that you should not go less than 10 m. But again, that is with minimally compliant components. As with Category 6 stated above, there are now components available that will give you passing field tests below 10 m. HOWEVER, even vendors with good components may still have a minimum length requirement in their design specifications. The only way to know where you stand is to talk to the vendor AND test it to see.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If you are talking specifically about patch cords, then 0.5 m is the implied minimum length in ANSI/TIA/EIA-568-B.2-1 for a certified patch cord. That's because the math for the limit lines really does not work below this. Infact, getting a certified patch cord of 0.5 is going to be tricky. Many vendors only offer a certified patch cord of 1.0 m or longer. I suspect that this may be the most useful information with regards to your question.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In addition, you need to keep in mind the capabilities of the tools you have on hand.  There are field testers that may not support cables under a minimum length, but this is a limitation of the tester and not based on the standard.  Obviously if you are testing with a unit that has a minimum length of 1 meter, you would want to avoid cables less than 1 meter as you would not be able to get accurate results.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-04-22T21:20:02.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7533" PostTypeId="2" ParentId="7516" CreationDate="2014-04-23T00:32:26.993" Score="3" Body="&lt;p&gt;Yes it should be; I believe you need this license:  FL-C2921-WAASX&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, there is also an minimum RAM increase requirement to run WAAS. Make sure you consult this Cisco &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/wide-area-application-services-waas-express/datasheet_c78-611644.html&quot; rel=&quot;nofollow&quot;&gt;data sheet for WAAS Express&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="343" LastEditDate="2014-04-23T13:28:53.660" LastActivityDate="2014-04-23T13:28:53.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7534" PostTypeId="2" ParentId="7519" CreationDate="2014-04-23T01:00:22.347" Score="3" Body="&lt;p&gt;For some large-scale temporary locations that I've worked at. The business ran 25-pair with amphenol ends on both sides. This allowed them to just remove the patch panel and breakout boxes when they left....leaving the very expensive 25 pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways,&#xA;They had an amphenol patch panel which had short patches to all the switch ports.&#xA;The had an amphenol break-out box where all the users in that area would patch to. This gave them 6 ports per &quot;drop&quot;.&#xA;I'll see if I can find a picture or part number of the breakout box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Careful when purchasing 25 pair though as it may not conform to cat5/6 standards.&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="343" LastEditDate="2014-04-23T01:42:01.770" LastActivityDate="2014-04-23T01:42:01.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7536" PostTypeId="1" AcceptedAnswerId="9522" CreationDate="2014-04-23T04:25:30.760" Score="6" ViewCount="1357" Body="&lt;p&gt;My boss asked me to create a lobby administration for user authentication in a certain Virtual LAN. So I googled for it, and I found out that RADIUS server will work for this. And I've reached this step of configuring the RADIUS Authentication, and I'm stuck:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/68HIg.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;So I found out that I need to configure (activate?) the RADIUS server first in order to be able to do this. I googled again. There are two options I can understand:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I create my own RADIUS server using &lt;a href=&quot;http://freeradius.org/&quot; rel=&quot;noreferrer&quot;&gt;FreeRadius&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Configure it on Cisco 5500 Series Wireless Controller. I'm not sure about this but my colleague told me that Cisco has provided RADIUS server for its users.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;So I prefer the second option. The problem now is that I don't know how to configure the RADIUS server (to get the IP address and so on). I googled again, and all I found is the tutorial to do it using Command Line Interface (telnet, windows). Because I'm new at this stuff, my boss asked me to use only GUI. But I clicked everywhere in the web-browser interface I found nothing to get it.&lt;/p&gt;&#xA;&lt;p&gt;So am I doing this wrong? Or Cisco doesn't support RADIUS server at all (so I have to choose the first option)?&lt;/p&gt;&#xA;" OwnerUserId="5371" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-06-22T15:44:45.820" Title="Configure radius server via GUI in Cisco WLC" Tags="|cisco|vlan|wlc|radius|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7538" PostTypeId="2" ParentId="7536" CreationDate="2014-04-23T06:04:15.907" Score="0" Body="&lt;p&gt;The feature you are most likely looking for is known as local authentication. This is implemented using Lightweight EAP, or &quot;LEAP.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially you create a local database of users on the controller, and this database is queried directly when authenticating clients. Instead of configuring another type of EAP such as EAP-TLS or PEAP and specifying a RADIUS server, you configure the SSID to use LEAP. The specifics of this vary between controllers, but with the above information, finding more specific configuration instructions should be much easier.&lt;/p&gt;&#xA;" OwnerUserId="213" LastActivityDate="2014-04-23T06:04:15.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7539" PostTypeId="1" AcceptedAnswerId="14701" CreationDate="2014-04-23T09:02:56.517" Score="6" ViewCount="3090" Body="&lt;p&gt;I'm trying to grasp the private VLAN configuration on Juniper EX switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand it right now:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Access ports in the primary VLAN (VLAN with &lt;code&gt;no-local-switching&lt;/code&gt; configured) are implicitly isolated ports&lt;/li&gt;&#xA;&lt;li&gt;Trunk ports in the primary VLAN with &lt;code&gt;pvlan-trunk&lt;/code&gt; set are PVLAN trunk interfaces&lt;/li&gt;&#xA;&lt;li&gt;All other trunk ports in the primary VLAN are promiscuous ports&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is there any way to configure a trunk port to be a isolated port in a PVLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Background: A host has a NIC with multiple VLANs configured. On the switch this is a trunk port accordingly. I want the switchport to be an isolated port in the private VLAN.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-12-18T05:19:59.267" Title="Juniper Private VLAN isolated port on a trunk" Tags="|vlan|juniper|private-vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7541" PostTypeId="1" CreationDate="2014-04-23T11:15:05.547" Score="5" ViewCount="2178" Body="&lt;p&gt;I have a &quot;Tun0&quot; interface over which I speak EIGRP.  On this same router I have a &quot;Vlan1&quot; interface.  What i'd like to do is speak only of the interfaces that pass a route-map, e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map foo permit 10&#xA;  match interface Vlan1&#xA;router eigrp 100&#xA;  distribute-list route-map foo out&#xA;  eigrp stub connected summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, this doesn't work.  A debug shows that 'Vlan1' is being denied by the route-map rather than permitted by it.  'sh ip eigrp top' on the prefix in question suggests that the next-hop for this route is 0.0.0.0.  The behavior appears to be the same with or without the EIGRP stub processing and the other stub processing features are desirable in this case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I only include routes sourced from this interface in EIGRP?&lt;/p&gt;&#xA;" OwnerUserId="43" LastActivityDate="2014-04-24T04:47:10.063" Title="Controlling route-map distribution with 'match interface' in EIGRP" Tags="|routing|cisco-ios|eigrp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7542" PostTypeId="2" ParentId="7541" CreationDate="2014-04-23T11:27:33.187" Score="3" Body="&lt;p&gt;if you want to enable eigrp on selected interfaces only, you can use passive interface feature, and if you want to reditribute routes you can use leakmap(and\or redistribution), a-la:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router eigrp 10050&#xA; network 10.192.0.0 0.0.255.255&#xA; redistribute static route-map rmap_leak_to_10050 &#xA; passive-interface default&#xA; no passive-interface Vlan816&#xA; no passive-interface Vlan916&#xA; eigrp router-id 10.192.127.218&#xA; eigrp stub connected static leak-map rmap_leak_to_10050&#xA;&#xA; ip access-list standard leak_to_10050&#xA; permit 10.192.0.0 0.0.255.255&#xA; permit 192.168.0.0 0.0.255.255&#xA; permit 10.10.10.0 0.0.0.255&#xA;&#xA; route-map rmap_leak_to_10050 permit 10&#xA; match ip address leak_to_10050&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;added:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; router eigrp 123&#xA; redistribute connected route-map rm_connected&#xA;&#xA;route-map rm_connected permit 10&#xA; match interface g0/0.123 g0/0.321 g0/0.231&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;added:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco3750x: Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9NPE-M), Version 15.0(2)SE, RELEASE SOFTWARE (fc1)&#xA;&#xA;sw1&#xA;interface Loopback100&#xA; ip address 172.16.10.1 255.255.255.0&#xA;&#xA;interface GigabitEthernet1/0/48&#xA; switchport access vlan 100&#xA; switchport mode access&#xA;&#xA;interface Vlan100&#xA; ip address 10.0.0.1 255.255.255.252&#xA;&#xA;router eigrp 100&#xA; network 10.0.0.0&#xA; redistribute connected route-map rm_con&#xA; eigrp stub connected summary&#xA;&#xA;route-map rm_con permit 10&#xA; match interface Loopback100&#xA;&#xA;&#xA;sw2&#xA;interface Loopback100&#xA; ip address 172.16.20.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet1/0/48&#xA; switchport access vlan 100&#xA; switchport mode access&#xA;&#xA;interface Vlan100&#xA; ip address 10.0.0.2 255.255.255.252&#xA;&#xA;router eigrp 100&#xA; network 10.0.0.0&#xA; redistribute connected route-map rm_con&#xA; eigrp stub connected summary&#xA;&#xA;route-map rm_con permit 10&#xA; match interface Loopback100&#xA;&#xA;sh ip route on sw1:&#xA;      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;C        10.0.0.0/30 is directly connected, Vlan100&#xA;L        10.0.0.2/32 is directly connected, Vlan100&#xA;      172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks&#xA;C        172.16.10.0/24 is directly connected, Loopback100&#xA;L        172.16.10.1/32 is directly connected, Loopback100&#xA;D EX     172.16.20.0/24 [170/130816] via 10.0.0.1, 00:02:31, Vlan100&#xA;&#xA;sh ip route on sw2:&#xA;      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;C        10.0.0.0/30 is directly connected, Vlan100&#xA;L        10.0.0.1/32 is directly connected, Vlan100&#xA;      172.16.0.0/16 is variably subnetted, 3 subnets, 2 masks&#xA;D EX     172.16.10.0/24 [170/130816] via 10.0.0.2, 00:02:52, Vlan100&#xA;C        172.16.20.0/24 is directly connected, Loopback100&#xA;L        172.16.20.1/32 is directly connected, Loopback100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;added(sw1 config is the same, only sw2 was changed):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw2 config:&#xA;&#xA;interface Loopback100&#xA; ip address 172.16.20.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet1/0/48&#xA; switchport access vlan 100&#xA; switchport mode access&#xA;!&#xA;interface Vlan1&#xA; ip address 172.16.200.1 255.255.255.0&#xA;!&#xA;interface Vlan100&#xA; ip address 10.0.0.2 255.255.255.252&#xA;!&#xA;router eigrp 100&#xA; network 10.0.0.0&#xA; redistribute connected route-map rm_con&#xA; eigrp stub connected summary&#xA;!&#xA;route-map rm_con permit 10&#xA; match interface Loopback100 Vlan1&#xA;&#xA;sw2:&#xA;      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;C        10.0.0.0/30 is directly connected, Vlan100&#xA;L        10.0.0.2/32 is directly connected, Vlan100&#xA;      172.16.0.0/16 is variably subnetted, 5 subnets, 2 masks&#xA;C        172.16.20.0/24 is directly connected, Loopback100&#xA;L        172.16.20.1/32 is directly connected, Loopback100&#xA;D EX     172.16.10.0/24 [170/130816] via 10.0.0.1, 00:05:44, Vlan100&#xA;C        172.16.200.0/24 is directly connected, Vlan1&#xA;L        172.16.200.1/32 is directly connected, Vlan1&#xA;&#xA;&#xA;&#xA;sw1:&#xA;      10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;C        10.0.0.0/30 is directly connected, Vlan100&#xA;L        10.0.0.1/32 is directly connected, Vlan100&#xA;      172.16.0.0/16 is variably subnetted, 4 subnets, 2 masks&#xA;D EX     172.16.20.0/24 [170/130816] via 10.0.0.2, 00:06:09, Vlan100&#xA;C        172.16.10.0/24 is directly connected, Loopback100&#xA;L        172.16.10.1/32 is directly connected, Loopback100&#xA;D EX     172.16.200.0/24 [170/3072] via 10.0.0.2, 00:04:29, Vlan100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="3478" LastEditDate="2014-04-24T04:47:10.063" LastActivityDate="2014-04-24T04:47:10.063" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7543" PostTypeId="1" CreationDate="2014-04-23T11:52:45.140" Score="2" ViewCount="504" Body="&lt;p&gt;Using a Cisco or Juniper routers you can see the size of the output queue value by showing the bgp summary.  This information is also available when showing the detailed neighbor information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;russell@juniper&amp;gt; show bgp summary&#xA;Peer                     AS      InPkt     OutPkt    OutQ   Flaps Last Up/Dwn State|#Active/Received/Accepted/Damped...&#xA;192.0.2.4             64496     112631     112606       0       1      5w1d9h Establ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco&amp;gt; show ip bgp nei 192.0.2.4&#xA;&amp;lt;snip&amp;gt;&#xA;Message statistics:&#xA;    InQ depth is 0&#xA;    OutQ depth is 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This information can be extremely useful when tracking down convergence issues; however I cannot find any way to get at it using the bird routing daemon.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bird&amp;gt; show protocols all R64496x1&#xA;name     proto    table    state  since       info&#xA;R64496x1  BGP      T64496    up     Mar14       Established   &#xA;  Preference:     100&#xA;  Input filter:   ACCEPT&#xA;  Output filter:  ACCEPT&#xA;  Import limit:   15000&#xA;    Action:       restart&#xA;  Routes:         350 imported, 73881 exported, 133519 preferred&#xA;  Route change stats:     received   rejected   filtered    ignored   accepted&#xA;    Import updates:            375          0          0          0        375&#xA;    Import withdraws:           13          0        ---          0         13&#xA;    Export updates:        2627756        400          0        ---    2627356&#xA;    Export withdraws:      1640917        ---        ---        ---    1640945&#xA;  BGP state:          Established&#xA;    Neighbor address: 192.0.2.95&#xA;    Neighbor AS:      64496&#xA;    Neighbor ID:      192.0.2.95&#xA;    Neighbor caps:    refresh AS4&#xA;    Session:          external route-server AS4&#xA;    Source address:   192.0.2.254&#xA;    Route limit:      350/15000&#xA;    Hold timer:       82/90&#xA;    Keepalive timer:  16/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to get at this information when using bird?&lt;/p&gt;&#xA;" OwnerUserId="4440" LastEditorUserId="4440" LastEditDate="2014-04-23T12:34:34.333" LastActivityDate="2014-04-23T12:34:34.333" Title="Is there any way to view the current queue size for a BGP neighbor in the Bird routing daemon?" Tags="|routing|bgp|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7545" PostTypeId="1" AcceptedAnswerId="7556" CreationDate="2014-04-23T12:11:45.660" Score="5" ViewCount="8987" Body="&lt;p&gt;I'm trying to understand how a receiver knows that the received packet is a VXLAN-encapsulated.&lt;/p&gt;&#xA;&lt;p&gt;Looking at the &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-mahalingam-dutt-dcops-vxlan-00#section-5&quot; rel=&quot;nofollow noreferrer&quot;&gt;VXLAN RFC&lt;/a&gt;, I can't see anything specific that defines that the packet contains VXLAN header.&#xA;I see (parsing the packet from the beginning):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;outer MAC (L2) header&lt;/li&gt;&#xA;&lt;li&gt;outer IP (L3) header&lt;/li&gt;&#xA;&lt;li&gt;outer UDP (L4) header&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;VXLAN header&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;inner MAC header&lt;/li&gt;&#xA;&lt;li&gt;inner ... etc&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;But I don't see anything specific in the outer UDP header that says that the next header is VXLAN.&lt;/p&gt;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="5378" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2021-02-21T14:18:52.663" Title="VXLAN: how receiver knows that the received packet is VXLAN-encapsulated?" Tags="|vlan|protocol-theory|udp|rfc|vxlan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7547" PostTypeId="1" AcceptedAnswerId="7640" CreationDate="2014-04-23T16:31:15.357" Score="6" ViewCount="1576" Body="&lt;p&gt;I am configuring static routes using xml, and I had a question regarding the structure of the xml.  Both of these ways work, and I want to know if there is any differences between them, or do they both do the same thing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Method 1: Using the xml schema&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;Request MajorVersion=&quot;1&quot; MinorVersion=&quot;0&quot;&amp;gt;&#xA;  &amp;lt;Set&amp;gt;&#xA;    &amp;lt;Configuration&amp;gt;&#xA;      &amp;lt;RouterStatic MajorVersion=&quot;3&quot; MinorVersion=&quot;2&quot;&amp;gt;&#xA;    &amp;lt;DefaultVRF&amp;gt;&#xA;      &amp;lt;AddressFamily&amp;gt;&#xA;        &amp;lt;VRFIPV4&amp;gt;&#xA;          &amp;lt;VRFUnicast&amp;gt;&#xA;        &amp;lt;VRFPrefixTable&amp;gt;&#xA;          &amp;lt;VRFPrefix&amp;gt;&#xA;            &amp;lt;Naming&amp;gt;&#xA;              &amp;lt;Prefix&amp;gt;&#xA;            &amp;lt;IPV4Address&amp;gt;200.0.0.0&amp;lt;/IPV4Address&amp;gt;&#xA;              &amp;lt;/Prefix&amp;gt;&#xA;              &amp;lt;PrefixLength&amp;gt;8&amp;lt;/PrefixLength&amp;gt;&#xA;            &amp;lt;/Naming&amp;gt;&#xA;            &amp;lt;VRFRoute&amp;gt;&#xA;              &amp;lt;VRFNextHopTable&amp;gt;&#xA;            &amp;lt;VRFNextHop&amp;gt;&#xA;              &amp;lt;Naming&amp;gt;&#xA;                &amp;lt;NextHopAddress&amp;gt;&#xA;                  &amp;lt;IPV4Address&amp;gt;192.168.1.2&amp;lt;/IPV4Address&amp;gt;&#xA;                &amp;lt;/NextHopAddress&amp;gt;&#xA;              &amp;lt;/Naming&amp;gt;&#xA;            &amp;lt;/VRFNextHop&amp;gt;&#xA;              &amp;lt;/VRFNextHopTable&amp;gt;&#xA;            &amp;lt;/VRFRoute&amp;gt;&#xA;          &amp;lt;/VRFPrefix&amp;gt;&#xA;        &amp;lt;/VRFPrefixTable&amp;gt;&#xA;          &amp;lt;/VRFUnicast&amp;gt;&#xA;        &amp;lt;/VRFIPV4&amp;gt;&#xA;      &amp;lt;/AddressFamily&amp;gt;&#xA;    &amp;lt;/DefaultVRF&amp;gt;&#xA;      &amp;lt;/RouterStatic&amp;gt;&#xA;    &amp;lt;/Configuration&amp;gt;&#xA;  &amp;lt;/Set&amp;gt;&#xA;  &amp;lt;Commit Mode=&quot;Atomic&quot; Label=&quot;IPV4_Static_Routes&quot; Comment=&quot;IPV4 Static routes config updates&quot;/&amp;gt;&#xA;&amp;lt;/Request&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Method 2: Using the CLI encapsulation tags&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;Request MajorVersion=&quot;1&quot; MinorVersion=&quot;0&quot;&amp;gt;&#xA;    &amp;lt;CLI&amp;gt;&#xA;        &amp;lt;Configuration&amp;gt;&#xA;                router static&#xA;                address-family ipv4 unicast&#xA;                200.0.0.0/8 192.168.1.2 &#xA;            &amp;lt;/Configuration&amp;gt;&#xA;    &amp;lt;/CLI&amp;gt;  &#xA;    &amp;lt;Commit/&amp;gt;&#xA;&amp;lt;/Request&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On another note, is there a tool out there, that takes CLI commands and translates them into xml schema, like in method 1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="5381" LastActivityDate="2014-04-29T04:28:30.760" Title="Configuring ASR9K using xml" Tags="|cisco|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7548" PostTypeId="1" CreationDate="2014-04-23T17:32:51.737" Score="6" ViewCount="1334" Body="&lt;p&gt;I've got a SonicWall TZ210 which connects to the WAN via PPPoE on the X1 interface. I've got a /29 subnet routed into the box, and everything is running fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I need to route one of the WAN IP addresses directly to an internal machine without any NAT being performed on the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've set up a test network in which I assign an interface as part of the DMZ zone and set the interface to Transparent IP Mode, set the WAN IP up on a test Ubunutu box connected to that interface, and everything is running fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I come to replicate this on the live TZ210, which has PPPoE on the WAN interface, it gives me an error &lt;code&gt;Error: Index of the interface.: Bridged-to interface must have static IP assignment&lt;/code&gt;, meaning this configuration won't work because of PPPoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the best route forwards with this?&lt;/p&gt;&#xA;" OwnerUserId="5382" LastEditorUserId="775" LastEditDate="2014-04-23T17:39:34.557" LastActivityDate="2024-01-14T21:09:01.063" Title="SonicWall TZ210 PPPoE on WAN interface, need transparent bridging to DMZ" Tags="|firewall|pppoe|sonicwall|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7549" PostTypeId="1" CreationDate="2014-04-23T18:05:17.787" Score="3" ViewCount="448" Body="&lt;p&gt;I am new to the 5505 and configuring them. I have several books and the web as research tools however I haven't wrapped my head around the whole thing. I am better at reverse engineering then initial config. I am trying to terminate remote access PPTP VPN connection on my internal Win 2012 RRAS server. I know I need to allow GRE and PPTP 1723 thru as well as port forward 1723 to the Win 2012 internal IP. Precisely how this is done in config is where I lose it, sadly. Below is my config and if there's someone that can really spell it out for me I'd be ever appreciative. Thanks in advance. Please note that I'd gone thru the IPSec and AnyConnect wizards on the ASDM and there's config in there for that, however it didn't function, and I'd prefer to use the Win 2012 RRAS server for PPTP as client workstation are already configure for it. Additionally I am limited to one public IP by ISP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 8.2(5)&#xA;&#xA;hostname ciscoasa&#xA;&#xA;enable password uXZJvr7TNDFcspD4 encrypted&#xA;&#xA;passwd uXZJvr7TNDFcspD4 encrypted&#xA;&#xA;names&#xA;&#xA;interface Ethernet0/0&#xA;&#xA; switchport access vlan 2&#xA;&#xA;interface Ethernet0/1&#xA;&#xA;interface Ethernet0/7&#xA;&#xA; switchport access vlan 5&#xA;&#xA;interface Vlan1&#xA;&#xA; nameif inside&#xA;&#xA; security-level 100&#xA;&#xA; ip address 192.168.1.1 255.255.255.0&#xA;&#xA;interface Vlan2&#xA;&#xA; nameif outside&#xA;&#xA; security-level 0&#xA;&#xA; ip address 1.outside.ip.1 255.255.255.0&#xA;&#xA;interface Vlan5&#xA;&#xA; nameif dmz&#xA;&#xA; security-level 50&#xA;&#xA; ip address 192.168.2.1 255.255.255.0&#xA;&#xA;ftp mode passive&#xA;&#xA;clock timezone EST -5&#xA;&#xA;clock summer-time EDT recurring&#xA;&#xA;access-list domainVPN_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0&#xA;&#xA;access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 192.168.1.224 &#xA;255.255.255.248&#xA;&#xA;pager lines 24&#xA;&#xA;logging asdm informational&#xA;&#xA;mtu outside 1500&#xA;&#xA;mtu inside 1500&#xA;&#xA;mtu dmz 1500&#xA;&#xA;ip local pool VPN_IP_Pool 192.168.1.225-192.168.1.230 mask 255.255.255.0&#xA;&#xA;no failover&#xA;&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;&#xA;no asdm history enable&#xA;&#xA;arp timeout 14400&#xA;&#xA;global (outside) 1 interface&#xA;&#xA;nat (inside) 0 access-list inside_nat0_outbound&#xA;&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;&#xA;route outside 0.0.0.0 0.0.0.0 1.outside.gateway.ip.1 1&#xA;&#xA;timeout xlate 3:00:00&#xA;&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;&#xA;timeout floating-conn 0:00:00&#xA;&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;&#xA;http server enable&#xA;&#xA;http 192.168.1.0 255.255.255.0 inside&#xA;&#xA;no snmp-server location&#xA;&#xA;no snmp-server contact&#xA;&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;&#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac&#xA;&#xA;crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac&#xA;&#xA;crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac&#xA;&#xA;crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac&#xA;&#xA;crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac&#xA;&#xA;crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac&#xA;&#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac&#xA;&#xA;crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac&#xA;&#xA;crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac&#xA;&#xA;crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac&#xA;&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1&#xA;&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-&#xA;AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA &#xA;ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;&#xA;crypto map outside_map interface outside&#xA;&#xA;crypto ca trustpoint _SmartCallHome_ServerCA&#xA;&#xA; crl configure&#xA;&#xA;crypto ca certificate chain _SmartCallHome_ServerCA&#xA;&#xA; certificate ca 6ecc7aa5a7032009b8cebcf4e952d491&#xA;&#xA;    308205ec 308204d4 a0030201 0202106e cc7aa5a7 032009b8 cebcf4e9 52d49130&#xA;&#xA;crypto isakmp enable outside&#xA;&#xA;crypto isakmp policy 10&#xA;&#xA; authentication pre-share&#xA;&#xA; encryption 3des&#xA;&#xA; hash sha&#xA;&#xA; group 2&#xA;&#xA; lifetime 86400&#xA;&#xA;telnet 192.168.1.0 255.255.255.0 inside&#xA;&#xA;telnet timeout 10&#xA;&#xA;ssh 192.168.1.0 255.255.255.0 inside&#xA;&#xA;ssh timeout 5&#xA;&#xA;console timeout 0&#xA;&#xA;dhcpd auto_config outside&#xA;&#xA;dhcpd address 192.168.1.5-192.168.1.254 inside&#xA;&#xA;threat-detection basic-threat&#xA;&#xA;threat-detection statistics access-list&#xA;&#xA;no threat-detection statistics tcp-intercept&#xA;&#xA;webvpn&#xA;&#xA; enable outside&#xA;&#xA; svc enable&#xA;&#xA;group-policy domainVPN internal&#xA;&#xA;group-policy domainVPN attributes&#xA;&#xA; wins-server value 1.inside.dc.ip.1 1.inside.dc2.1&#xA;&#xA; dns-server value 1.inside.dc.ip.1 1.inside.dc2.1&#xA;&#xA; vpn-tunnel-protocol IPSec&#xA;&#xA; split-tunnel-policy tunnelspecified&#xA;&#xA; split-tunnel-network-list value domainVPN_splitTunnelAcl&#xA;&#xA; default-domain value domain.local&#xA;&#xA;group-policy DfltGrpPolicy attributes&#xA;&#xA; vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn&#xA;&#xA;username username password 6phXKPxOcSDjp7J7 encrypted privilege 0&#xA;&#xA;username username attributes&#xA;&#xA; vpn-group-policy domainVPN&#xA;&#xA;tunnel-group domainVPN type remote-access&#xA;&#xA;tunnel-group domainVPN general-attributes&#xA;&#xA; address-pool VPN_IP_Pool&#xA;&#xA; default-group-policy domainVPN&#xA;&#xA;tunnel-group domainVPN ipsec-attributes&#xA;&#xA; pre-shared-key *****&#xA;&#xA;tunnel-group AnyConnect type remote-access&#xA;&#xA;tunnel-group AnyConnect general-attributes&#xA;&#xA; address-pool VPN_IP_Pool&#xA;&#xA;class-map inspection_default&#xA;&#xA; match default-inspection-traffic&#xA;&#xA;policy-map type inspect dns preset_dns_map&#xA;&#xA; parameters&#xA;&#xA;  message-length maximum client auto&#xA;&#xA;  message-length maximum 512&#xA;&#xA;policy-map global_policy&#xA;&#xA; class inspection_default&#xA;&#xA;  inspect dns preset_dns_map&#xA;&#xA;  inspect ftp&#xA;&#xA;  inspect h323 h225&#xA;&#xA;  inspect h323 ras&#xA;&#xA;  inspect rsh&#xA;&#xA;  inspect rtsp&#xA;&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc&#xA;  inspect xdmcp&#xA;  inspect sip&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect ip-options&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5383" LastEditorUserId="2142" LastEditDate="2014-04-23T21:05:28.423" LastActivityDate="2023-12-13T22:06:50.863" Title="Cisco 5505 PPTP Passthru Config Help" Tags="|cisco-asa|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7550" PostTypeId="1" AcceptedAnswerId="7904" CreationDate="2014-04-23T18:38:47.397" Score="4" ViewCount="2169" Body="&lt;p&gt;Thanks in advance for reading this post.  I have five HP V1910 switches, three for office LAN, one for the server rack and the last was purchased for redundancy in the server rack.  The first of the three for the office LAN has links to each of the other switches (hub and spoke topology from what someone else told me), and it is connected to the router that provides internet connectivity.  This should mean that any device should only have one hop to get out to the internet and there should be no STP involved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The redundant switch is now setup in the rack and it has a link to the main switch which connects everything together.  The problem occurs when I try to link the two server rack switches together.  This additional link between the two is specifically set for the storage VLAN which is a different VLAN than the office VLAN but as soon as it is connected, I lose connectivity to this switch (eg a continuous ping to this switch starts timing out).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on what I'm reading on this forum, it appears to be related to STP since that is now introduced with me linking these switches together.  In the switch GUI, it has a section called MSTP and lists the following global settings:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enable STP Globally: Enabled&lt;br&gt;&#xA;BPDU Protection: Disabled&lt;br&gt;&#xA;Mode: RSTP&lt;br&gt;&#xA;Max Hops: 20&lt;br&gt;&#xA;Path Cost Standard: Legacy&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it the mode of STP that is being used that is causing this issue?  I thought that since it was a different VLAN that it wouldn't have a problem with me adding a link between the switches.  Or perhaps I shouldn't be even linking the two switches together?  The thought was that since each physical host and storage has two links, we could separate the two links between the two switches and if one switch dies, then the environment still keeps running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate any feedback.  Thanks!&lt;/p&gt;&#xA;" OwnerUserId="5384" LastActivityDate="2016-06-25T11:30:41.090" Title="Connecting multiple links between switches" Tags="|switch|spanning-tree|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7553" PostTypeId="1" AcceptedAnswerId="7554" CreationDate="2014-04-24T00:32:29.617" Score="1" ViewCount="467" Body="&lt;p&gt;I'm trying to choose a router for a WiFi hotspot for a small business. What I'm looking to do is run a DD-WRT / OpenWRT system with a simple captive portal. I'm unsure of the hardware requirements for a wireless access point used by more than 4-5 people simultaneously. What are some of the potential bottlenecks or general variables to consider when buying a router for a simple hotspot? Are consumer grade routers sufficient for this sort of load?&lt;/p&gt;&#xA;" OwnerUserId="5390" LastActivityDate="2014-04-24T02:33:54.087" Title="Router hardware considerations for small business WiFi hotspots" Tags="|router|wireless|" AnswerCount="1" CommentCount="3" ClosedDate="2018-03-15T01:17:06.797" ContentLicense="CC BY-SA 3.0" />
  <row Id="7554" PostTypeId="2" ParentId="7553" CreationDate="2014-04-24T02:24:12.097" Score="1" Body="&lt;p&gt;I like DD-WRT/Tomato as much as the next guy, but depending on the environment, you're going to want something a little easier to manage that ties into your router or cloud managed server in the long run. I advise against these types of solutions, though I do understand the occasional need for something lower cost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, a question about consumer equipment is better placed in the DD-WRT forums than here. Another is Linksysinfo.org, for tomato support. I would recommend &lt;a href=&quot;https://meraki.cisco.com/products/wireless&quot; rel=&quot;nofollow&quot;&gt;Meraki APs&lt;/a&gt;, as they tie into the cloud management portal, have great features, and integrate into all the other equipment they would want very easily. We deploy TONS of these to small businesses, and they just work well. Additionally, you can get your client(/employer) in on Meraki firewalls and switches, eventually making network management of their little LAN extremely easy as well as increasing your visibility of their network. Finally, the Meraki site (And several other business class wireless providers' sites) are very realistic and up front on their datasheets about supported clients, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I forgot to mention, free trials. May as well give it a try. We've never had a client send back the trial equipment, every single site we deploy a trial too ends up loving it.&lt;/p&gt;&#xA;" OwnerUserId="5135" LastEditorUserId="5135" LastEditDate="2014-04-24T02:33:54.087" LastActivityDate="2014-04-24T02:33:54.087" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7555" PostTypeId="1" AcceptedAnswerId="7557" CreationDate="2014-04-24T08:17:26.563" Score="2" ViewCount="3367" Body="&lt;p&gt;AFAIK 802.1Q tag is optional in the FRame header. So it may or not be present in the header right? SO how does the Packet processing ASIC or processor identifies or parses to interpret the frame header as vlan tag present or not present ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastActivityDate="2014-04-24T08:28:59.017" Title="How a packet processor detects if vlan tag is present in Ethernet header or not?" Tags="|vlan|packet-analysis|asics|" AnswerCount="1" CommentCount="1" ClosedDate="2014-05-05T09:08:07.167" ContentLicense="CC BY-SA 3.0" />
  <row Id="7556" PostTypeId="2" ParentId="7545" CreationDate="2014-04-24T08:23:10.897" Score="9" Body="&lt;p&gt;The destination UDP port in the outer UDP header is specified in the &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-mahalingam-dutt-dcops-vxlan-09#section-5&quot; rel=&quot;nofollow noreferrer&quot;&gt;VXLAN specification&lt;/a&gt; (Port 4789). This means it is a well-known service. So an UDP packet that arrives on Port 4789 is expected to be a VXLAN packet¹ in the same way that a TCP packet that arrives on Port 80 is expected to be a HTTP packet¹.&lt;/p&gt;&#xA;&lt;p&gt;The draft you linked to is outdated and is missing this port number (although it mentions that the port number is to be obtained from IANA).&lt;/p&gt;&#xA;&lt;p&gt;¹) When I talk about VXLAN/HTTP packets I mean of course the respective UDP/TCP packets with VXLAN/HTTP header/protocol inside.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2014-04-25T08:16:34.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7557" PostTypeId="2" ParentId="7555" CreationDate="2014-04-24T08:28:59.017" Score="0" Body="&lt;p&gt;With 802.1q payload in the packet unique ethertype value is used in the header of Ethernet frame. Normal IPv4 packets use 0x0800, normal IPv6 packets use 0x86DD, 802.1q packets use 0x8100 etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/EtherType&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/EtherType&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3388" LastActivityDate="2014-04-24T08:28:59.017" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7558" PostTypeId="1" AcceptedAnswerId="7559" CreationDate="2014-04-24T10:29:15.850" Score="4" ViewCount="717" Body="&lt;p&gt;I am new to networking and currently I have been learning about three layer model from Cisco. All sources say that Core layer is the one providing high speed switching and it is at the top  of the hierarchy. But does it mean there is nothing about core layer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I designed a network where there are two switches below the IPS and routing and I think core layer is just these two switches..or is it everything above that as well?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GycEC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GycEC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5343" LastEditorUserId="3191" LastEditDate="2014-12-08T20:20:00.407" LastActivityDate="2014-12-08T20:20:00.407" Title="Is this the core layer?" Tags="|design|network-core|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7559" PostTypeId="2" ParentId="7558" CreationDate="2014-04-24T11:02:49.820" Score="5" Body="&lt;p&gt;The layer you labeled in your diagram is considered the &lt;a href=&quot;http://en.m.wikipedia.org/wiki/Core_network&quot; rel=&quot;noreferrer&quot;&gt;core&lt;/a&gt; (also called the backbone).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firewalls in your diagram form a boundary on the core layer, since they transition to another network.  Core networks are local to your company or autonomous system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep your core layer as stable as possible.   That typically means keeping changes to a minimum,  as well as not homing servers or users directly in the core layer.   Typically you put your fastest elements in the core; over time the core devices may be repurposed to the edge of the network as the former core devices loose capacity to handle evolving loads. &lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-04-24T11:02:49.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7560" PostTypeId="5" CreationDate="2014-04-24T11:39:28.260" Score="0" Body="&lt;p&gt;Cisco IOS it is an operating system used on the Cisco systems network devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the &lt;code&gt;cisco-ios&lt;/code&gt; tag for questions that primarily involve Cisco IOS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions about Cisco IOS should include information about hardware platform and IOS version. The good practice is to show output of the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="40371" LastEditDate="2018-11-01T14:17:14.647" LastActivityDate="2018-11-01T14:17:14.647" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="7561" PostTypeId="4" CreationDate="2014-04-24T11:39:28.260" Score="0" Body="For discussion about Cisco's Internetwork Operating System - Cisco IOS" OwnerUserId="3478" LastEditorUserId="40371" LastEditDate="2018-11-01T14:17:09.717" LastActivityDate="2018-11-01T14:17:09.717" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="7567" PostTypeId="2" ParentId="7322" CreationDate="2014-04-24T16:18:43.117" Score="5" Body="&lt;p&gt;I would strongly recommend moving to an OSPF/iBGP design for something of this scale, with the core switches acting as BGP route reflectors.  BGP has so many more administrative handles for tinkering with routes over OSPF, allowing better scale and filtering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you scale to the point that you have more networks than your ToR switches can program into CAM (unlikely if each is a different stub), you run into issues.  Each additional zone is more CPU load on your ABRs (core switches) as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have one OSPF area 0, with all loopbacks and router-to-router links in it.  Then setup iBGP sessions between your cores and ToR, advertising default-only to ToR, and redistribute connected/static routes on ToR into BGP.&lt;/p&gt;&#xA;" OwnerUserId="141" LastActivityDate="2014-04-24T16:18:43.117" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7568" PostTypeId="1" AcceptedAnswerId="7569" CreationDate="2014-04-24T17:44:34.600" Score="5" ViewCount="5492" Body="&lt;p&gt;I'm working on re-allocating interfaces that are on a N7K-M132XP-12L (32 port 10 Gig module) in a Nexus 7k.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ports are currently configured as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vdc router_VDC_2 id 2&#xA;allocate interface Ethernet1/1-24 &#xA;vdc router_VDC_3 id 3&#xA;allocate interface Ethernet1/25-32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to move 8 interfaces from VDC_2 to VDC_1. The 8 I would like to move is 1/16-24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I go about moving the interfaces without causing any kind of outage on VDC 2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would the following work?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vdc router_VDC_1 id 1&#xA;allocate interface Ethernet1/16-24 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="108" LastActivityDate="2014-04-24T22:26:15.833" Title="How to best re-allocate interfaces to move to a different VDC" Tags="|cisco-nexus-7k|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7569" PostTypeId="2" ParentId="7568" CreationDate="2014-04-24T22:20:48.077" Score="4" Body="&lt;p&gt;Assuming that these ports are just access ports and are not participating in any routing or VLAN trunking which would cause a STP re-convergence or a routing re-convergence. It should be safe to move them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should not have to specify the id field.&#xA;This command should simply work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vdc router_VDC_1&#xA;allocate interface Ethernet1/16-24&#xA;!now exit, switchto vdc and begin configuring the interfaces&#xA;switchto vdc router_VDC_1&#xA;int e1/16&#xA;  no shut&#xA;  ....etc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only outage you'll see when moving ports between VDCs is on the ports themselves.&#xA;By default - the config they are populated with on the new VDC is simply shutdown. So the devices attached will have their links drop until you configure and unshut the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; I didn't notice that you mentioned that since this is a N7K-M132XP-12L card - the port assignments work in 4's due the way the ASICS are configured. You would not be allowed to move port 16. If you did, it would cause ports 11, 12, &amp;amp; 13 to move with it. You could move e1/17-24 without any problems.&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="343" LastEditDate="2014-04-24T22:26:15.833" LastActivityDate="2014-04-24T22:26:15.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7571" PostTypeId="1" CreationDate="2014-04-25T01:01:56.937" Score="0" ViewCount="1439" Body="&lt;p&gt;I know how to subnet but I'm a bit confused when it comes to how VLAN's work within a network. Say i have 3 different groups of users, split on 2 different levels of a building.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ground floor = 5 students, 5 teachers&#xA;First floor = 5 students, 5 teachers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logic tells me the ground floor would be on it's own subnet, same with the first floor. But I also want the students to be on their own VLAN, and the teachers on their own. How does this work if the ground and first floors have their own subnet? ie whole first floor = 10.1.1.2-12 and ground floor 10/1/2/2-12&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any explanation or if I'm heading in the wrong direction&lt;/p&gt;&#xA;" OwnerUserId="5408" LastEditorUserId="3191" LastEditDate="2014-12-08T20:26:46.463" LastActivityDate="2014-12-08T20:26:46.463" Title="How do VLAN's work with subnets?" Tags="|vlan|subnet|" AnswerCount="2" CommentCount="3" ClosedDate="2014-04-28T00:29:11.037" ContentLicense="CC BY-SA 3.0" />
  <row Id="7574" PostTypeId="5" CreationDate="2014-04-25T06:07:36.417" Score="0" Body="&lt;p&gt;The EIGRP is a routing protocol, which was designed by Cisco Systems; EIGRP uses the &lt;a href=&quot;http://en.wikipedia.org/wiki/Diffusing_update_algorithm&quot; rel=&quot;nofollow&quot;&gt;DUAL&lt;/a&gt; algorithm invented by J.J. Garcia-Luna-Aceves. In 2013, Cisco published EIGRP as an &lt;a href=&quot;http://tools.ietf.org/html/draft-savage-eigrp-00&quot; rel=&quot;nofollow&quot;&gt;Informational RFC&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="775" LastEditDate="2014-04-25T10:20:41.163" LastActivityDate="2014-04-25T10:20:41.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7575" PostTypeId="4" CreationDate="2014-04-25T06:07:36.417" Score="0" Body="Use this tag for questions about Cisco's EIGRP - Enhanced Interior Gateway Routing Protocol." OwnerUserId="3478" LastEditorUserId="775" LastEditDate="2014-04-25T10:21:11.417" LastActivityDate="2014-04-25T10:21:11.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7580" PostTypeId="1" CreationDate="2014-04-25T10:42:39.673" Score="3" ViewCount="338" Body="&lt;p&gt;I have two routers (A and B), both are Juniper j2320s. Each one has 3 BGP peers, a primary to one preferred AS (call them AS 1) and two to a secondary (AS 2), as well as an IBGP session between them. A is the preferred route for traffic in/out of the network behind them, comprising a small public IP space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently, the interface for AS 1's BGP session on B started flapping, then after it stopped after a few days, I started having intermittent problems where the servers behind the routers are having problems reaching hosts on the internet with their public IPs as the source address - if I don't specify a source address, it works fine and shows as the configured gateway's IP. If I disable the BGP peering for AS 1 on router B, the problem disappears; when I enable it again then it recurs, but only for specific prefixes, and rarely the same ones from one instance to the next. A traceroute with the source specified stops at router A. I have also tried disabling B's session with AS 2 and leaving 1 up, but the problem still occurs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My other thought was whether they are just getting too old to handle all the routing table size they need to, but they don't seem unresponsive or heavily loaded, and there are no problems when B's session with AS 1 is disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tested this many times, and each time, any network that is affected by this is still directly reachable from A or B. I can perform diagnostics this evening, but not during the day as when the problem is active, it prevents normal usage of some systems in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I was doing more testing this morning. As soon as I bring the peering up on B, A loses the ability to route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before enabling AS 1 on B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A&amp;gt; traceroute 208.67.220.220 source 2.3.4.5&#xA; 1  router1.as1.net (1.2.3.4)  4.526 ms  1.773 ms  1.562 ms&#xA; 2. router2.as1.net (1.2.3.5)  4.770 ms  12.540 ms  2.402 ms&#xA;...&#xA; 7  resolver2.opendns.com (208.67.220.220)  2.862 ms  2.681 ms  4.673 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Immediately after:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A&amp;gt; traceroute 208.67.220.220 source 2.3.4.5&#xA;traceroute to 208.67.220.220 (208.67.220.220) from 193.19.98.1, 30 hops max, 40 byte packets&#xA; 1  * * *&#xA; 2  * * *&#xA;...&#xA; 30 * * *&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#router A&#xA;protocols {&#xA;    bgp {&#xA;        group internal {&#xA;            type internal;&#xA;            description iBGP;&#xA;            neighbor h.j.k.m {&#xA;                export next-hop-self;&#xA;            }&#xA;        }&#xA;        group as1 {&#xA;            type external;&#xA;            description as1;&#xA;            import default_bgp_import;&#xA;            export default_bgp_export;&#xA;            peer-as 1;&#xA;            neighbor w.x.y.z;&#xA;        }&#xA;        group as2 {&#xA;            type external;&#xA;            description as2;&#xA;            import default_bgp_import;&#xA;            export default_bgp_export;&#xA;            peer-as 2;&#xA;            neighbor a.b.c.d;&#xA;            neighbor a.b.c.e;&#xA;        }&#xA;    }&#xA;&#xA;#router B&#xA;protocols {&#xA;    bgp {&#xA;        group internal {&#xA;            type internal;&#xA;            description iBGP;&#xA;            neighbor h.j.k.l {&#xA;                export next-hop-self;&#xA;            }&#xA;        }&#xA;        inactive: group as1 {&#xA;            type external;&#xA;            description as1;&#xA;            import default_bgp_import;&#xA;            export default_bgp_export;&#xA;            peer-as 1;&#xA;            neighbor w.x.y.v;&#xA;        }&#xA;        group as2 {&#xA;            type external;&#xA;            description as2;&#xA;            import default_bgp_import;&#xA;            export default_bgp_export;&#xA;            peer-as 2;&#xA;            neighbor a.b.c.f;&#xA;            neighbor a.b.c.g;&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5416" LastEditorUserId="5416" LastEditDate="2014-04-30T08:54:03.217" LastActivityDate="2014-08-04T00:27:51.707" Title="BGP - source routing breaking for some routes" Tags="|bgp|juniper|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7581" PostTypeId="1" CreationDate="2014-04-25T10:54:55.430" Score="3" ViewCount="2735" Body="&lt;p&gt;I have mac table list of router, now I am trying to get a Ip address for each mac address in mac table list. So i tried to use ARP, unfortunately ARP is missing some of the mac addresses mapping which are listed under mac table. How to get all mac-IP address mappings. Is there any way to get these mappings? Will it be possible by updating ARP table, if so how to update it? &lt;/p&gt;&#xA;" OwnerUserId="5417" LastEditorUserId="509" LastEditDate="2014-04-26T06:46:33.127" LastActivityDate="2014-04-26T06:46:33.127" Title="How to update the ARP table of a router or switch? could it be possible through broadcasting?" Tags="|snmp|mac-address|arp|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7583" PostTypeId="1" AcceptedAnswerId="7586" CreationDate="2014-04-25T12:22:56.823" Score="5" ViewCount="1264" Body="&lt;p&gt;When RIP router sends update to routers, why it is limited to use only &lt;code&gt;512 bytes&lt;/code&gt; of UDP data. Why not more than that, even when it has a 1500 byte MTU. How is the maximum of 512 bytes determined? &lt;/p&gt;&#xA;" OwnerUserId="3415" LastEditorUserId="3191" LastEditDate="2014-12-08T20:19:50.567" LastActivityDate="2014-12-08T20:19:50.567" Title="why RIP sending only maximum of 512 bytes of data" Tags="|routing|protocol-theory|udp|rip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7585" PostTypeId="1" AcceptedAnswerId="7595" CreationDate="2014-04-25T12:56:01.247" Score="6" ViewCount="951" Body="&lt;p&gt;&lt;em&gt;Does EIGRP use AS number/process number as it's PORT NUMBER between routers in the same AS/group?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I know that EIGRP does NOT use TCP/UDP; I know that that EIGRP uses RTP as a mechanism to establish a layer-4-like function to keep EIGRP packets ordered and sequenced.  I also know that there is an AS number in the payload.  So please don't state the obvious, and just talk straight to the point.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;a href=&quot;https://supportforums.cisco.com/discussion/9805551/eigrp-port-number&quot; rel=&quot;nofollow&quot;&gt;this post on the Cisco Support Forums&lt;/a&gt; there is an answer which seems a little weird.  The question is about the EIGRP port number, and someone answers that &lt;strong&gt;&quot;The port number is the EIGRP AS.&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I Googled all over the internet, but could not find a single clue about that statement!  Is that really true, I mean DOES EIGRP USE THE AS NUMBER as it's PORT NUMBER?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(By the way, there's a link under the mentioned post, but it doesn't load.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How EIGRP neighbors know not to form a neighbor relationship with adjacent routers that aren't in their AS?  The routers get the packets, disassemble it and check the payload to see that the AS# is not matched and then drop it? Or something else is going on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry to ask this kind of question, but the guy’s name, who has posted this stuff is Russ White, CCIE No. 2635.  With all due respect to him, I couldn’t find a single clue to back up his theory of EIGRP using AS# number as port number.  Or to back up his statement, “That's how EIGRP neighbors know not to form a neighbor relationship with adjacent routers that aren't in their AS--they won't even receive the packets sent by a router in another AS!”&lt;/p&gt;&#xA;" OwnerUserId="5420" LastEditorUserId="44" LastEditDate="2014-05-01T17:45:46.790" LastActivityDate="2014-05-01T17:45:46.790" Title="Does EIGRP use AS number/process number as it's PORT NUMBER between routers in the same AS/group?" Tags="|cisco|routing|eigrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7586" PostTypeId="2" ParentId="7583" CreationDate="2014-04-25T13:02:38.580" Score="4" Body="&lt;p&gt;You can find this on Page 19 of &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058#page-19&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1058: RIP&lt;/a&gt;, the maximum UDP payload of a RIP update is 512 bytes:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;   The maximum datagram size is 512 octets.  This includes only the&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;   portions of the datagram described above.  It does not count the IP&#xA;   or UDP headers.  The commands that involve network information allow&#xA;   information to be split across several datagrams.  No special&#xA;   provisions are needed for continuations, since correct results will&#xA;   occur if the datagrams are processed individually.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This means RIP can carry a &lt;a href=&quot;http://www.cisco.com/cpress/cc/td/cpress/fund/ith2nd/it2444.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;maximum of 25 routes in a RIP update packet&lt;/a&gt;.  When RIP was conceived, &lt;a href=&quot;https://stackoverflow.com/questions/1098897/what-is-the-largest-safe-udp-packet-size-on-the-internet&quot;&gt;512 bytes was a reasonable maximum&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2014-04-25T13:47:25.037" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7587" PostTypeId="2" ParentId="7101" CreationDate="2014-04-25T13:05:20.683" Score="7" Body="&lt;p&gt;So it seems the way to go is to use a logical tunnel interface on MX. Just put one end of the lt Interface in the VPLS instance and the other end in the L2VPN instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lt-1/2/0 {&#xA;        mtu 1514;&#xA;        unit 0 {&#xA;            encapsulation ethernet-ccc;&#xA;            peer-unit 1;&#xA;            family ccc;&#xA;        }&#xA;        unit 1 {&#xA;            encapsulation ethernet-vpls;&#xA;            peer-unit 0;&#xA;        }&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will stitch the L2VPN to the VPLS instance.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-04-25T13:05:20.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7588" PostTypeId="2" ParentId="7581" CreationDate="2014-04-25T13:52:58.347" Score="2" Body="&lt;p&gt;Use a tool like NMAP with the &lt;code&gt;-sP&lt;/code&gt; option (ping scan) against all subnets configured on interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nmap -sP [subnet IP]/[bitmask]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[repeat as needed for all connected subnets on router]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then collect your SNMP information prior to the ARP timeout.   If you still have MAC addresses in your CAM table that you can't correlate to an IP, they don't have one configured.&lt;/p&gt;&#xA;" OwnerUserId="141" LastEditorUserId="3191" LastEditDate="2014-04-25T21:01:30.803" LastActivityDate="2014-04-25T21:01:30.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7590" PostTypeId="1" CreationDate="2014-04-25T16:06:58.293" Score="1" ViewCount="2641" Body="&lt;p&gt;I have some questions. First off my understanding on networks is minimal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to understand how zeroconfig works in a situation where not all devices are on a single network, but they are all connected to a centralized PC. Its essentially embedded arm devices running linux with g_ether. So the central device is a host Windows desktop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine that each device connected to the PC will have it's own network interface, and broadcasting from one, will not reach a second device. Will the host PC properly negotiate a new IP address for a device on the second network if it requests an IP address used by a device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, we are using avahi on the device. Windows uses... w/e windows uses. Is zeroconf a standard protocol or do all of them have separate implementations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if this isn't going to work, is there some other standard we should use? The requirement for us is to be able to connect 40 to a single pc... which is a ridiculous amount of usb hubs but that's what they want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 more question considering the answer I got.&#xA;If its not possible to gurantee each device gets their own IP address, Does that mean the routing won't work? Consider a PC connected to two Networks with a device that has the same IP address.&#xA;Would it be possible to talk to a single device using that IP address. I imagine at least in C++ we might have to specify a network adapter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any other solutions other than bridging all of the devices. This will be used in manufacturing, so automation is more important than ease to set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe my understanding of the RNDIS usb driver works is wrong as well. Each device gets its own network interface. I'm assuming like all other network interfaces that they are independent networks. Is it possible to tell RNDIS to load a single network interface for multiple devices?&lt;/p&gt;&#xA;" OwnerUserId="5422" LastEditorUserId="3191" LastEditDate="2014-12-08T20:26:38.197" LastActivityDate="2014-12-08T20:26:38.197" Title="Zeroconfig with multiple interfaces" Tags="|linux|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7591" PostTypeId="2" ParentId="7571" CreationDate="2014-04-25T17:35:37.187" Score="0" Body="&lt;p&gt;There are exceptions, but generally speaking, there is a one-to-one match between VLANs and subnets.  In other words, for every VLAN, you have a subnet, and vice versa.  So you would have two subnets (and two vlans) on each floor -- one for students and one for teachers.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-04-25T17:35:37.187" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7594" PostTypeId="2" ParentId="7590" CreationDate="2014-04-25T19:09:21.917" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm trying to understand how zeroconfig works in a situation where not all devices are on a single network, but they are all connected to a centralized PC.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Zeroconf is not designed to work in this situation, so don't expect things to work out of the box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Zeroconf has three component: IPv4LL, mDNS and DNS-SD.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;IPv4LL allows a device to configure an address that does not conflict with another device on the same link, without relying on any kind of server. If you have one link per device, then each device will choose an IP address independently.  There is no guarantee that all devices have a different IP address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;mDNS uses Link-Local multicast, so it will typically only work on one link. Your central machine will see all devices, but devices will not see each other.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DNS-SD is network independent since it relies on a higher-level protocol: DNS.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you want Zeroconf to work across your devices, the simplest thing to do is to have your central host bridge all its network interfaces.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is zeroconf a standard protocol or do all of them have separate implementations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This question does not make sense.  Being a standard protocol and having different implementation are two completely orthogonal things. Yes, Zeroconf (or rather, each of its components) is specified in RFCs.  Yes, there are several implementation of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, Windows does not completely implement Zeroconf natively. It only implements IPv4LL. Apple has an implementation of mDNS and DNS-SD for windows. But Windows mainly rely on a competing technology, called UPnP, which is not designed for the same purpose.&lt;/p&gt;&#xA;" OwnerUserId="670" LastActivityDate="2014-04-25T19:09:21.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7595" PostTypeId="2" ParentId="7585" CreationDate="2014-04-25T19:12:06.990" Score="7" Body="&lt;p&gt;I emailed Russ White (ex-Cisco employee / EIGRP specialist from the routing protocols deployment team), and this was his answer:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If you think about the way a TCP stack works, you have some sort of switching process that accepts packets, and stuffs them onto a &amp;quot;forme&amp;quot; queue. That queue is processed by IP -- but how does IP know what process to hand the packet to? That would be the protocol number. IP sticks a protocol number into the right argument in a function call, and out pops a pointer to a function to pass the packet to for that process (or more likely a pointer to a work queue that process monitors).&lt;/p&gt;&#xA;&lt;p&gt;In the case of EIGRP, it's a work queue, and the process that monitors it is the EIGRP transport process (you should see a separate process for EIGRP and EIGRP transport in the processes running on a cisco box). Once this transport process is handed a slice of CPU, and it pulls a packet off the work queue. If there are several EIGRP processes running on the box, which one does it hand the packet to?&lt;/p&gt;&#xA;&lt;p&gt;It treats the AS number in the packet as a selector, just like TCP treats the socket as a selector among the various processes consuming packets (HTTP/80, ident, FTP, etc). So, from an IOS perspective, the AS number in EIGRP provides the same information as a TCP socket does -- hence it's a &amp;quot;socket.&amp;quot; Each EIGRP process &amp;quot;listens&amp;quot; to a &amp;quot;socket&amp;quot; or &amp;quot;port&amp;quot; equal to the AS number.&lt;/p&gt;&#xA;&lt;p&gt;From the design and process perspective, each EIGRP AS looks like a different database/best path set/etc. From the protocol perspective, the AS number looks like a process selector, or a &amp;quot;port number,&amp;quot; or a &amp;quot;socket,&amp;quot; depending on your point of view.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-04-25T19:20:39.833" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7597" PostTypeId="2" ParentId="7571" CreationDate="2014-04-25T19:26:02.450" Score="1" Body="&lt;p&gt;Depending on where you are in your University classes, there are three options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have already covered &quot;Layer 3 Switching&quot;, you could set up an SVI for the Students, and an SVI for the Teachers.  Then the first floor and ground floor would only need a Layer2 path (aka through switches) to your Layer 3 switch.  Then you could have these two VLANs existing at two different locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you haven't already covered &quot;Layer 3 Switching&quot;, and you are purely in a &quot;Router L3&quot; and &quot;Switch L2&quot; world, then unless you do something special (see below) you will probably need to use four different VLANs and four different IP Subnets:  &lt;strong&gt;A&lt;/strong&gt; Students 1st Floor, &lt;strong&gt;B&lt;/strong&gt; Students Ground Floor, &lt;strong&gt;C&lt;/strong&gt; Teachers 1st Floor, &lt;strong&gt;D&lt;/strong&gt; Teachers Ground Floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could get around that and (in a way) do a manual &quot;L3 switch&quot; by connecting your central router to a switch, and then that switch has a trunk to each of your &quot;Floor&quot; switches.  You could then have one VLAN/IP Subnet for Teachers, and another for Students, and they could exist in two different locations.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-04-25T19:26:02.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7599" PostTypeId="2" ParentId="7581" CreationDate="2014-04-25T21:22:18.570" Score="2" Body="&lt;p&gt;There isn't any good way to do this other than a crude nmap ping sweep of the entire subnet. You'll at least be able to resolve all of the addresses on the subnet to usable hardware addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the commonly used verbiage.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nmap -sn -n 10.0.0.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-sn (No port scan) .&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This option tells Nmap not to do a port scan after host discovery, and&#xA;  only print out the available hosts that responded to the scan. This is&#xA;  often known as a &quot;ping scan&quot;, but you can also request that traceroute&#xA;  and NSE host scripts be run. This is by default one step more&#xA;  intrusive than the list scan, and can often be used for the same&#xA;  purposes. It allows light reconnaissance of a target network without&#xA;  attracting much attention. Knowing how many hosts are up is more&#xA;  valuable to attackers than the list provided by list scan of every&#xA;  single IP and host name.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Systems administrators often find this option valuable as well. It can&#xA;  easily be used to count available machines on a network or monitor&#xA;  server availability. This is often called a ping sweep, and is more&#xA;  reliable than pinging the broadcast address because many hosts do not&#xA;  reply to broadcast queries.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;-n/-R: Never do DNS resolution/Always resolve [default: sometimes]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://linux.die.net/man/1/nmap&quot; rel=&quot;nofollow&quot;&gt;nmap(1) - Linux man page&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-04-25T21:22:18.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7605" PostTypeId="1" AcceptedAnswerId="7612" CreationDate="2014-04-26T11:34:56.853" Score="3" ViewCount="3639" Body="&lt;p&gt;If I have a subnet that contains approx 40 hosts. If I am to have 2 servers max, that are strictly for the use of this subnet, should I have them on a seperate VLAN in the subnet so that they do not receive any unnecessary broadcasts etc. and to keep the traffic low, or should I leave them on the same VLAN as the workstations so that they will have slightly quicker access to the servers? &lt;/p&gt;&#xA;" OwnerUserId="5429" LastActivityDate="2014-04-26T15:30:54.990" Title="Should a server have it's own VLAN?" Tags="|vlan|subnet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7606" PostTypeId="1" CreationDate="2014-04-26T11:45:16.587" Score="2" ViewCount="344" Body="&lt;p&gt;I did packet capture on my system, where i did packet capture on wireless adapter. i seen some frame size below than 64 bytes like 54 bytes and other frame size as well. I seen some document frame size should be minimum of 64 bytes for etherent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then how am seeing 54 bytes of frame size on on my wireless adapter. Is that because of wireless adapter?&lt;/p&gt;&#xA;" OwnerUserId="3415" LastEditorUserId="3191" LastEditDate="2014-12-08T20:21:33.877" LastActivityDate="2014-12-08T20:21:33.877" Title="How the frame size getting below 64 bytes" Tags="|ethernet|wireshark|tcpdump|ieee-802.3x|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7607" PostTypeId="1" CreationDate="2014-04-26T12:06:59.813" Score="4" ViewCount="920" Body="&lt;p&gt;I have one example scenario, let consider i am sending 1500 bytes of frame over the internet. which is passing through 576 bytes MTU capable router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, Is that router will do the fragmentation and send to receiving host or it will send ICMP(code3 type4) to sending device by PMTU for fragmentation. How this thing is happening in real time in the world. Sometime in real world scenario router will block ICMP message by administrator , how they are overcoming this issue.&lt;/p&gt;&#xA;" OwnerUserId="3415" LastActivityDate="2014-04-27T09:04:48.130" Title="How fragmentation works in real world" Tags="|ethernet|ipv4|protocol-theory|mtu|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7609" PostTypeId="2" ParentId="7607" CreationDate="2014-04-26T12:43:21.720" Score="4" Body="&lt;p&gt;Router will respond with ICMP and drop the packet if it can't fragment the packet further, or it's prohibited to do so with the Don't Fragment bit set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And yes, as you pointed out, PMTUD often breaks in real world, as people do filter ICMP messages - either in transit, or at their internet edges, shooting themselves in the foot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a great writeup on PMTUD and fragmentation for your reference:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-04-26T12:43:21.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7611" PostTypeId="2" ParentId="7607" CreationDate="2014-04-26T14:09:40.220" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Sometime in real world scenario router will block ICMP message by administrator , how they are overcoming this issue.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Simple. Fire that dumb*** admin -- I've known many. If they have no understanding of why ICMP exists, they have no place &lt;em&gt;saying&lt;/em&gt; firewall, much less managing one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(But otherwise, yes, ICMP messages can end up lost just like any other packet. When that happens, other mechanisms have to kick in to generate any error(s) -- most often a connection timeout after a long delay.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-04-26T14:09:40.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7612" PostTypeId="2" ParentId="7605" CreationDate="2014-04-26T15:30:54.990" Score="8" Body="&lt;p&gt;In general, having multiple VLANs provides these benefits:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;They limit broadcasts by breaking up broadcasts domains&lt;/li&gt;&#xA;&lt;li&gt;They limit L2 failure domains, caused by misbehaving NIC cards&lt;/li&gt;&#xA;&lt;li&gt;They provide a convenient handle to apply various policies such as security, QoS, etc.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;45 hosts are not likely going to generate excessive broadcasts, nor are they likely to cause L2 problems (unless you have multiple switches, redundant connections, etc). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you mention applying a security policy, that would be a good reason for a separate VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, there isn't much advantage to multiple VLANs in a network this small.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-04-26T15:30:54.990" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7616" PostTypeId="2" ParentId="7606" CreationDate="2014-04-27T07:52:59.757" Score="4" Body="&lt;p&gt;First of all, capturing traffic on WLAN interfaces is tricky. I assume you're doing this with wireshark, so take a look here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.wireshark.org/faq.html#q7.10&quot; rel=&quot;nofollow&quot;&gt;http://www.wireshark.org/faq.html#q7.10&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, 802.11 header is a little bit different than 802.3, take a look at standard:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.11-2007.pdf&quot; rel=&quot;nofollow&quot;&gt;http://standards.ieee.org/getieee802/download/802.11-2007.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-04-27T07:52:59.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7618" PostTypeId="2" ParentId="7607" CreationDate="2014-04-27T09:04:48.130" Score="2" Body="&lt;p&gt;IPv4 fragments are allowed to be fragmented by routers unless the Don't Fragment bit is set. IPv6 always behaves as if the DF bit is set (the bit doesn't exist anymore) so routers never fragment.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-04-27T09:04:48.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7619" PostTypeId="1" CreationDate="2014-04-27T17:34:30.130" Score="0" ViewCount="19733" Body="&lt;p&gt;Does iperf support VOIP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes! then please tell me what are the commands for testing voip and video streaming. &lt;/p&gt;&#xA;" OwnerUserId="4056" LastEditorUserId="3191" LastEditDate="2014-12-08T20:23:55.693" LastActivityDate="2020-10-30T19:46:14.807" Title="VOIP testing with IPERF tool" Tags="|iperf|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7620" PostTypeId="2" ParentId="7619" CreationDate="2014-04-27T19:50:20.490" Score="5" Body="&lt;p&gt;iperf can be used to test transportation protocols like TCP and UDP. VOIP is an application protocol. This is another layer of the &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_protocol_suite&quot; rel=&quot;noreferrer&quot;&gt;Internet Procol Suite&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the answer is: no, you cannot test VOIP, but you can test the transportation protocols (typically UDP) used for VOIP calls. &lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-04-27T19:50:20.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7621" PostTypeId="2" ParentId="7619" CreationDate="2014-04-27T19:51:12.463" Score="6" Body="&lt;p&gt;I think you're confused about what Iperf is, and what purpose it serves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the Iperf Man Page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;iperf is a tool for performing network throughput measurements.  It&#xA;  can test either TCP or UDP throughput.  To perform an iperf test the&#xA;  user must&#xA;         establish both a server (to discard traffic) and a client (to generate traffic).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Iperf simply tests throughput by sending a stream TCP/UDP packets of a set size, over a set time, and then calculating the throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, Iperf could certainly be utilized to simulate the underlying UDP flow of an RTP stream from a voice/video call.  However, there would be nothing in the test that makes it any different from any other UDP flow or makes it VoIP specific.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2014-04-27T19:51:12.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7623" PostTypeId="2" ParentId="7619" CreationDate="2014-04-28T04:57:16.937" Score="0" Body="&lt;p&gt;If you are talking about measurement of QOS specific parameters (analyze VOIP protocols in depth), than no, &lt;code&gt;iperf&lt;/code&gt; does not support those features. But you can use DSCP/TOS-field in packets (with &lt;code&gt;iperf&lt;/code&gt; v3):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can now set the DSCP/TOS bit vector using the &lt;code&gt;-S &amp;lt;hexadecimal/decimal/octal number&amp;gt;&lt;/code&gt; client option. The option is exchanged with the server, so there is no need to set &lt;code&gt;-S&lt;/code&gt; for the server. &lt;a href=&quot;https://code.google.com/p/iperf/issues/detail?id=22&quot; rel=&quot;nofollow noreferrer&quot;&gt;code.google.com&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and &lt;a href=&quot;http://iperf.fr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;jitter&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS the network devices are can have built-in QOS measurment, for example &lt;a href=&quot;http://blogs.cisco.com/enterprise/mediatrace/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco mediatrace&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="40371" LastEditDate="2018-11-30T15:02:56.457" LastActivityDate="2018-11-30T15:02:56.457" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="7624" PostTypeId="1" CreationDate="2014-04-28T06:18:40.433" Score="3" ViewCount="4630" Body="&lt;p&gt;I am trying to use Wireshark to find the root cause of a particularly slow network, and started by examining Broadcast traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not only does Broadcast traffic represent over 25% of total traffic (at around 66 packets per second),  but also some  servers repeatedly query the same host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This diagram below shows one host repeatedly sending broadcast traffic to query one host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5o0Um.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5o0Um.png&quot; alt=&quot;wireshark capture&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea what might cause this?&lt;/p&gt;&#xA;" OwnerUserId="5449" LastEditorUserId="3191" LastEditDate="2014-04-28T09:46:26.160" LastActivityDate="2015-11-02T09:43:24.723" Title="Why should one server repeatedly ARP for the same host?" Tags="|arp|wireshark|broadcast|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7625" PostTypeId="2" ParentId="7624" CreationDate="2014-04-28T06:22:00.897" Score="3" Body="&lt;p&gt;It seems the destination IP address (172.20.13.122) is not answering the ARP requests. The source IP (172.20.0.31) is trying to reach that address for some reason and thus is continuing sending ARP requests until it gets an answer or it gives up on reaching the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason could be that the destination host is offline or unreachable, or that the source host has a wrong subnet mask so that it is sending ARP requests instead of sending the packets to the gateway.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2014-04-28T09:26:51.827" LastActivityDate="2014-04-28T09:26:51.827" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7626" PostTypeId="1" CreationDate="2014-04-28T06:36:12.223" Score="3" ViewCount="163" Body="&lt;p&gt;&lt;p&gt;I have a router (cisco 1841 modular router) and in the router's guide.  They guide says that the c1841 is a data-only mode, even the VWIC cards is data only. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to add a Polycom group series 500 to my network and apply the QOS on the router and the switches.   Will the c1841 support traffic for my video conference system?&lt;/p&gt;&#xA;" OwnerUserId="5450" LastEditorUserId="775" LastEditDate="2014-05-03T11:38:37.193" LastActivityDate="2014-05-03T21:57:59.177" Title="what is a data only mode card" Tags="|cisco|router|voip|video|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7627" PostTypeId="1" CreationDate="2014-04-28T07:35:38.257" Score="5" ViewCount="4957" Body="&lt;p&gt;Is it possible to change the Cisco Prime Infrastructure platform's IP address after PI has been installed ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/prime_infrastructure/2-0/command/reference/cli20/cli20_appendix_011.html#wp8796098100&quot; rel=&quot;nofollow&quot;&gt;reference in the docs&lt;/a&gt; seems to indicate that you can. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ncs/admin(config)# interface GigabitEthernet 1&#xA;ncs/admin(config-GigabitEthernet)# ip address 209.165.200.227 255.255.255.224&#xA;Changing the hostname or IP may result in undesired side effects,&#xA;such as installed application(s) being restarted.&#xA;........&#xA;To verify that NCS processes are running, use the&#xA;'show application status ncs' command.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Personnally, I would proceed by first shutting down the NCS services, then modify the IP, and then restart the NCS services. I think it can be done that way with minimal damage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point of my asking is : What would happen to the PI configuration and the polling of the data, when I change the ip of the NCS server?&lt;/p&gt;&#xA;" OwnerUserId="3484" LastEditorUserId="775" LastEditDate="2014-04-28T10:17:16.417" LastActivityDate="2014-04-28T10:17:16.417" Title="Change IP address in Cisco Prime infrastructure" Tags="|cisco|management|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7629" PostTypeId="1" CreationDate="2014-04-28T15:50:54.560" Score="6" ViewCount="757" Body="&lt;p&gt;I often hear people saying that each VLAN is a subnet (or is associated with a subnet) but is that really true?&#xA;Assume I have 10 big offices. I will have a subnet for each office but only 2 VLANs grouping some computers, e.g. finance workers to be separated. Is that correct or I really should have subnets and VLANs in 1:1?&lt;/p&gt;&#xA;" OwnerUserId="5343" LastEditorUserId="3191" LastEditDate="2014-12-08T20:22:41.577" LastActivityDate="2015-07-03T14:19:48.887" Title="VLAN-Subnets 1:1?" Tags="|routing|ipv4|vlan|subnet|" AnswerCount="2" CommentCount="20" ContentLicense="CC BY-SA 3.0" />
  <row Id="7631" PostTypeId="1" CreationDate="2014-04-28T18:52:15.393" Score="1" ViewCount="131" Body="&lt;p&gt;We have 2 vlans&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vlan 20 &amp;amp; vlan 30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;they are both currently able to contact each other but we don't want them to be able to. We have 2 switches too, with these vlans on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They should not be able to contact each other on the same switch or going through another switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would we have to set up an ACL to stop this or are there commnads we can use to set up such paramiters when we set up VLAN's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: trunking is enable on both switches&lt;/p&gt;&#xA;" OwnerUserId="5457" LastActivityDate="2014-04-28T21:52:18.037" Title="Our vlans can contact each other, we wan't them to not be able to" Tags="|cisco|routing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7632" PostTypeId="2" ParentId="119" CreationDate="2014-04-28T19:49:37.327" Score="5" Body="&lt;p&gt;Some network device architectures assume that most of your prefixes will be /64's.  Check &lt;a href=&quot;http://blog.ipspace.net/2012/12/ipv6-prefixes-longer-than-64-might-be.html&quot; rel=&quot;noreferrer&quot;&gt;this column in Ivan Pepelnjak's blog&lt;/a&gt; for more info.&lt;/p&gt;&#xA;" OwnerUserId="5456" LastActivityDate="2014-04-28T19:49:37.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7633" PostTypeId="1" AcceptedAnswerId="7636" CreationDate="2014-04-28T19:53:32.533" Score="1" ViewCount="268" Body="&lt;p&gt;Is there a way to send out a packet such that its path is predetermined? Basically, I want to attach an &quot;IP map&quot; of how I want it to travel. If so, what are the steps? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="5451" LastActivityDate="2014-04-29T17:42:54.693" Title="Is there any way to send out an IP directed packet?" Tags="|routing|monitoring|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7634" PostTypeId="2" ParentId="7629" CreationDate="2014-04-28T20:11:05.663" Score="6" Body="&lt;p&gt;There is generally a 1:1 mapping between subnets and VLANs because there isn't a very good reason not to.  You &lt;em&gt;could&lt;/em&gt; have a big network with 1 VLAN, but why have a huge broadcast domain where all hosts see every broadcast when you can just separate each subnet with a VLAN? It's a waste of resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnets/VLANs are, more often than not, focused around similar uses (i.e. printer VLANs, workstation VLANs, etc.) and allowing for a single entry/exit point makes policy much easier to enforce on the VLAN/subnet as a whole. There are also &lt;a href=&quot;http://en.wikipedia.org/wiki/Man-in-the-middle_attack&quot; rel=&quot;noreferrer&quot;&gt;security implications&lt;/a&gt; that sprout up in shared layer 2 domains, so you would stand to benefit from segmenting traffic as much as possible.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-04-28T20:11:05.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7635" PostTypeId="1" AcceptedAnswerId="7661" CreationDate="2014-04-28T20:15:43.930" Score="1" ViewCount="3144" Body="&lt;p&gt;I have a Sonicwall NSA 3500 firewall. I have a primary block of public IP addresses that are working fine but I need to utilize a second block of IPs that are routing over the primary from the telco side.  Does anyone know how to configure this on a sonic wall? I am not finding much info on it.&#xA;I have done the NATing and firewall rules etc but I don't see a place to configure the gateway on the firewall for the 2nd block of IPs. &lt;/p&gt;&#xA;" OwnerUserId="5188" LastActivityDate="2015-01-21T18:16:11.973" Title="Add secondary public IP to Sonicwall NSA 3500" Tags="|firewall|sonicwall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7636" PostTypeId="2" ParentId="7633" CreationDate="2014-04-28T21:47:12.230" Score="6" Body="&lt;p&gt;What you are describing is &lt;em&gt;IP Source Route&lt;/em&gt;. However, any network with even a hint of security will have source-route disabled. But if you want to try it anyway, keep in mind there's a limit to the size of an IP header, and thus, a limit to the number of hops you can specify.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-04-28T21:47:12.230" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7637" PostTypeId="2" ParentId="7631" CreationDate="2014-04-28T21:52:18.037" Score="6" Body="&lt;p&gt;A VLAN is a layer-2 concept. If there's IP (layer-3) connectivity between them, then there's a router somewhere routing between VLANs. It will naturally &lt;em&gt;route&lt;/em&gt; between them until you actively prevent it, most often with an ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(a more complex setup could be done with VRF.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-04-28T21:52:18.037" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7638" PostTypeId="2" ParentId="7626" CreationDate="2014-04-28T22:15:51.683" Score="3" Body="&lt;p&gt;If you're talking about Cisco tech... there's the WIC - data only, VIC - voice only, and VWIC - voice and data cards. Each depends on the router as to what functions are supported/supportable based on the IOS software and the slot in which the card is loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, a 1750 (or 1751) has 2 WIC and 1 VIC slots. The VIC slot is keyed so a WIC won't seat in it -- and if you force it in there anyway, &lt;em&gt;it won't work&lt;/em&gt;. A VIC will physically fit in a WIC slot, but will not function there. A VWIC can go in either slot, and will function based on the type of slot -- data only in a WIC slot, voice only in a VIC slot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A 1760 has 2 VIC/WIC slots and 2 VIC slots. A VWIC in the first two slots can be configured for either voice or data operation.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-04-28T22:15:51.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7639" PostTypeId="1" CreationDate="2014-04-28T22:45:38.887" Score="7" ViewCount="8385" Body="&lt;ol&gt;&#xA;&lt;li&gt;Log into a Cisco IOS device with TACACS Authorization enabled&lt;/li&gt;&#xA;&lt;li&gt;Do a command that causes the device to lose access to the TACACS server&lt;/li&gt;&#xA;&lt;li&gt;Enter a command that requires TACACS Authorization&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;By default, the timeout appears to be about 30 seconds before the devices comes back with &quot;Command Authorization Failed.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried this command to fix...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tacacs-server timeout &amp;lt;seconds&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, that only affects the authentication portion, not authorization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do you adjust the timeout to communicate with a TACACS server for authorization purposes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: &#xA;Relevant config pasted below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I am fine with the user getting a &quot;Command Authorization Failed&quot; message if the TACACS server goes down.  I just don't want them to have to wait 30 seconds between each command for the server to timeout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My concern is that if someone pastes 75 lines into the router, and line 3 breaks connectivity to the TACACS server, the remaining 72 lines will be in buffer.  By my understanding, even if you close the SSH session to the router it will STILL process the commands in the buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore what happens if the router is rejecting commands at the rate of 2 per minute (Command Authorization Failed), and you fix the problem after 5 minutes?  62 lines suddenly paste in and are immediately applied, and you just did a partial deployment of your change!  How do you explain THAT to management?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, I'd like to setup a 3 second timeout for authorizations with the TACACS server.  At least then the chances of the above disaster scenario are greatly reduced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tacacs-server host xx.xx.xx.27&#xA;tacacs-server host xx.xx.xx.28&#xA;tacacs-server key xxxxx&#xA;!&#xA;aaa new-model&#xA;!&#xA;aaa group server tacacs+ ACS1 &#xA; server xx.xx.xx.27&#xA; server xx.xx.xx.28&#xA;!&#xA;aaa authentication login default group ACS1 line local          &#xA;!&#xA;aaa authorization config-commands&#xA;aaa authorization exec default group ACS1 local &#xA;aaa authorization commands 15 default group ACS1 local&#xA;!&#xA;aaa accounting commands 0 default start-stop group ACS1 &#xA;aaa accounting commands 15 default start-stop group ACS1&#xA;aaa accounting connection default start-stop group ACS1&#xA;!&#xA;aaa authentication login console-authc none                 &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="155" LastEditorUserId="155" LastEditDate="2014-04-29T16:39:10.367" LastActivityDate="2017-07-27T09:16:02.543" Title="AAA Authorization Timeout" Tags="|cisco-ios|aaa|tacacs|authorization|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7640" PostTypeId="2" ParentId="7547" CreationDate="2014-04-29T04:22:42.360" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Both of these ways work, and I want to know if there is any differences between them, or do they both do the same thing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They're both XML documents, and both have schemas. The &lt;code&gt;CLI&lt;/code&gt; elements are just treated differently internally to the device in some form or another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios_xr_sw/iosxr_r4-1/xml/programming/guide/xl41apidoc.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;IOS-XR XML API documentation&lt;/a&gt; calls out the important part. The difference between the two is that using method 2 is basically &quot;passing through&quot; commands (except for those not supported via the CLI directives) to the CLI interpreter, and the XML agent on the device will return the response from the CLI which is again wrapped in an XML document. Aside from the downsides noted in the API manual, this would be pretty inefficient if you were doing something that you needed to write a script to do - for this, you'd definitely want method 1. Ultimately though, they both do the same thing. One is more explicit with using elements based on a schema (easier for data serialization/parsing/storage/retrieval etc) and the other is just passing stuff to the CLI that you expect a response from in a non-serialized format (maybe something like a specific &lt;code&gt;show&lt;/code&gt; command with some crazy regex because of an odd edge case requirement).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is there a tool out there, that takes CLI commands and translates them into xml schema, like in method 1?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What problem are you trying to solve?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's &lt;a href=&quot;https://stackoverflow.com/questions/1191031/cisco-ios-show-conf-to-xml&quot;&gt;this StackOverflow question&lt;/a&gt; that features a python library that could be used for this (written by the same guy that wrote &lt;a href=&quot;https://github.com/knipknap/exscript/wiki&quot; rel=&quot;nofollow noreferrer&quot;&gt;exscript&lt;/a&gt; - a solid library) but IOS-XR may have the ability to generate output from &quot;show run&quot; to XML (try &lt;code&gt;show run | format&lt;/code&gt;), but frankly the API guide linked shows better/more ideal operational examples which would apply more readily to creating automation (if that is the end goal here).&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2014-04-29T04:28:30.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7643" PostTypeId="5" CreationDate="2014-04-29T10:01:27.360" Score="0" Body="&lt;p&gt;The most common and widely deployed southbound interface towards SDN (Software Defined Networking) devices is known as the OpenFlow (OF) protocol. This protocol were originally developed at Stanford university during the Ethane project, but has become a de facto industry standard. In later years, the protocol has come under control and development from the Open Networking Foundation (ONF).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A secure socket layer (SSL) (or TSL) connection is set up between an SDN controller and the OF device. Then the OF protocol is used to push OF rules to the flow tables of that device. These rules will have match fields, and action fields. New packets that arrive will be checked towards the flow tables and if a match is found, the corresponding action to that match will be implmented (e.g. outputport, drop, decrement ttl, pop tag etc). If the packet doesn't match any of the flow tables (which could be multiple in a pipeline fashion), it will be encapsulated and sent to the controller. The packet will be processed at the controller and will then be returned to the switch together with a new flow rule. New flow rules will also be sent to other devices in the network that the SDN controller controls. This way a 'path' will be created for the flow all the way through the network. Later revisions of the OF protocol also implments support for group tables and meter tables. &lt;/p&gt;&#xA;" OwnerUserId="5388" LastEditorUserId="5388" LastEditDate="2014-04-29T17:04:15.960" LastActivityDate="2014-04-29T17:04:15.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7644" PostTypeId="4" CreationDate="2014-04-29T10:01:27.360" Score="0" Body="A protocol for communication between controllers and network elements in a software-defined network." OwnerUserId="16691" LastEditorUserId="16691" LastEditDate="2015-07-20T05:46:07.507" LastActivityDate="2015-07-20T05:46:07.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7646" PostTypeId="1" CreationDate="2014-04-29T11:40:11.093" Score="2" ViewCount="876" Body="&lt;p&gt;Why VLAN interface can be created on router? Is this, by any chance, for router that supports switch module?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: This is not about subinterface. On the router, VLAN can be created like in switch.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2014-04-29T19:11:08.537" Title="VLAN interface on router (not subinterface)" Tags="|router|vlan|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="7647" PostTypeId="1" CreationDate="2014-04-29T11:43:15.573" Score="1" ViewCount="19224" Body="&lt;p&gt;I have a block of IPs a /24 which i have subnetted into 2 /25s. In the first block one of my clients is requesting I give him 3 x /28 and 1 x /30. Subnetting is not an issue. My concern is how do I tell those blocks of IP's that I will subnet to him to use the x.x.x.1 as their default gateway when they are in different subnets to the default gateway. The setup is 1 router with a cable running to a 48 port switch and all servers and users are supposed to connect to that switch.&lt;/p&gt;&#xA;" OwnerUserId="5462" LastActivityDate="2014-04-29T13:48:15.860" Title="How to make 2 subnets share 1 default gateway" Tags="|cisco|subnet|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7648" PostTypeId="2" ParentId="2351" CreationDate="2014-04-29T12:31:49.260" Score="1" Body="&lt;p&gt;I am not sure I understood your question, but if you want to visualize your rulebase, you can use CPUploader (&lt;a href=&quot;http://wormnet.nl/&quot; rel=&quot;nofollow&quot;&gt;http://wormnet.nl/&lt;/a&gt;). You copy the relevant files to the tools directory and it creates an HTML file with the complete Rulebase for you. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The site is very old, this is still working though (last version I did it with was R76 I think).&lt;/p&gt;&#xA;" OwnerUserId="1558" LastActivityDate="2014-04-29T12:31:49.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7649" PostTypeId="1" AcceptedAnswerId="7651" CreationDate="2014-04-29T13:00:39.430" Score="1" ViewCount="947" Body="&lt;p&gt;This &lt;a href=&quot;http://packetlife.net/blog/2009/jan/17/rtp-eigrp/&quot; rel=&quot;nofollow&quot;&gt;blog post&lt;/a&gt; discusses the RTP in EIGRP. My question is how seq number is chosen and why in sending new packet the device should mention the seq number of last packet? for example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A-----seq:23 ack:0 ----&amp;gt;B&#xA;A&amp;lt;----seq:23 ack:23---- B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No problem so far, it says actually I have received the seq:23 and I acknowledge 23.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A-----seq:24 ack:23----&amp;gt;B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First problem is here, why should A put ack:23 in its packet? I mean it should be zero because A have not received ack for seq:24?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A&amp;lt;----seq:24  ack:24-----B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and now B acknowledges A seq:24 with ack:24? Please refer to the above link, I'm a bit confused.&lt;/p&gt;&#xA;" OwnerUserId="5420" LastEditorDisplayName="user10222" LastEditDate="2015-06-04T13:46:33.593" LastActivityDate="2015-06-04T13:46:33.593" Title="EIGRP RTP seq/ack Number" Tags="|cisco|eigrp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7651" PostTypeId="2" ParentId="7649" CreationDate="2014-04-29T13:25:47.423" Score="4" Body="&lt;p&gt;Нi!&#xA;Look at 61 page of &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1889&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1889&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;about your question:&#xA;&amp;quot;is how seq number is chosen&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;when device sending first RTP packet of the session, seq number must be random, to make known-plaintext attacks on encryption more difficult , in next packets seq is just increment&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;B first problem is here&amp;quot;, there is no problem, A tell to B, that A has recieved ack of the last B packet(which was seq 23)&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;and now B acknowledge A seq:24 with ack:24???&amp;quot;, yes ;-), B acknowledge to A, that seq 24 was recieved, by sending ack 24&lt;/p&gt;&#xA;&lt;p&gt;added:&lt;/p&gt;&#xA;&lt;p&gt;there is last version of &lt;a href=&quot;http://datatracker.ietf.org/doc/draft-savage-eigrp/?include_text=1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Enhanced Interior Gateway Routing Protocol&#xA;draft-savage-eigrp-02&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; The following sequence number rules must be met for the reliable&#xA; EIGRP protocol to work correctly:&#xA;&#xA;     o A sender of a packet includes its global sequence number&#xA;       in the sequence number field of the fixed header. The&#xA;       sender includes the receivers sequence number in the&#xA;       acknowledgment number field of the fixed header.&#xA;     o Any packets that do not require acknowledgment must be&#xA;       sent with a sequence number of 0.&#xA;     o Any packet that has an acknowledgment number of zero (0)&#xA;       indicates that sender is not expecting to explicitly&#xA;       acknowledging delivery. Otherwise, it is acknowledging&#xA;       a single packet.&#xA;     o Packets that are network layer multicast must contain&#xA;       acknowledgment number of 0.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But, in the rfc, there is no info about first seq number, so i`ve tested this on hardware. And as i see, seq number is starting from 1(not random, like in RTP). And it is intresting, looks like, that the seq number will be increment, until we will reboot device or restart eigrp process(&amp;quot;no router eigrp&amp;quot;). &amp;quot;clear ip eigrp nei&amp;quot; wasnt drop seq num to zero, hm&lt;/p&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-04-30T06:07:27.950" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7652" PostTypeId="2" ParentId="7647" CreationDate="2014-04-29T13:46:05.533" Score="3" Body="&lt;p&gt;Have you considered using &lt;strong&gt;VLANs&lt;/strong&gt; and &lt;strong&gt;sub-interfaces&lt;/strong&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sub-interface is an interface that uses your physical interface for moving data. That way you can create &lt;em&gt;&quot;multiple networks&quot;&lt;/em&gt; in your network by creating the amount of sub-interfaces.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface fa 0/0&#xA;encapsulation dot1q 10&#xA;ip address 192.168.0.1 255.255.255.0&#xA;no shutdown&#xA;&#xA;interface fa0/0.1&#xA;encapsulation dot1q 20&#xA;ip address 192.168.1.1 255.255.255.0&#xA;no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;'encapsulation dot1q [number]'&lt;/strong&gt; is to tell your interface to which VLAN it should be listening. In this case either VLAN 10 or 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way you would have 2 VLANs which would seperate your network; but they would be able to use the same &lt;strong&gt;physical&lt;/strong&gt; default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope I understood your question correctly!  &lt;/p&gt;&#xA;" OwnerUserId="5074" LastActivityDate="2014-04-29T13:46:05.533" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7654" PostTypeId="2" ParentId="7647" CreationDate="2014-04-29T13:46:37.977" Score="2" Body="&lt;p&gt;AFAIK, i don't think you can do that.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The gateway IP tells the system how to get to another subnet, and&#xA;  without it, packets won't leave the current subnet.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A computer only knows how to talk to the other computers that are&#xA;  directly connected on the same subnet. A gateway is a &quot;default route&quot;&#xA;  which specifies where packets should be sent by default if they are&#xA;  not destined for somewhere on the local subnet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://superuser.com/questions/490005/can-i-use-a-gateway-address-on-another-subnet&quot;&gt;Here :&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4305" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2014-04-29T13:46:37.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7655" PostTypeId="2" ParentId="7647" CreationDate="2014-04-29T13:48:15.860" Score="1" Body="&lt;p&gt;You can't do this.  The gateway is an interface which is on the same subnet as the interface a packet is forwarded on.  When a host wants to forward a packet, it will look at the destination address and use the netmask to determine if the destination is on the same subnet or a different one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination subnet is the same, the sending host will forward the packet to the destination at layer 2. If the destination subnet is different, it will forward the packet to the gateway at layer 2.  Either the destination host must be local or a local gateway must be known.  You can't have a non-local gateway.&lt;/p&gt;&#xA;" OwnerUserId="5464" LastActivityDate="2014-04-29T13:48:15.860" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7659" PostTypeId="2" ParentId="7635" CreationDate="2014-04-29T15:41:13.160" Score="-1" Body="&lt;p&gt;Needed to add a static arp entry and static route for 2nd set of public IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="5188" LastActivityDate="2014-04-29T15:41:13.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7661" PostTypeId="2" ParentId="7635" CreationDate="2014-04-29T17:19:39.637" Score="3" Body="&lt;p&gt;See &lt;a href=&quot;https://support.software.dell.com/kb/sw7621&quot; rel=&quot;nofollow&quot;&gt;this knowledge base article&lt;/a&gt; for details, but basically:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create a Static ARP entry for the new network.&lt;/li&gt;&#xA;&lt;li&gt;Create a Static Route&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3624" LastEditorUserId="3624" LastEditDate="2015-01-21T18:16:11.973" LastActivityDate="2015-01-21T18:16:11.973" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7662" PostTypeId="2" ParentId="7633" CreationDate="2014-04-29T17:42:54.693" Score="2" Body="&lt;p&gt;You can use ping with the -j (loose source) or -k (strict source) option to send such a packet. Just keep in mind that this feature is normally disabled on routers for security reasons.&lt;/p&gt;&#xA;" OwnerUserId="5469" LastActivityDate="2014-04-29T17:42:54.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7663" PostTypeId="2" ParentId="7646" CreationDate="2014-04-29T19:11:08.537" Score="3" Body="&lt;p&gt;A vlan interface in a router is used with the switch modules, or HWIC.  Once you create the SVI (vlan interface), you can create an access port on one of the switchports, and the vlan will be created, or if using a trunked switchport, you have to manually add the vlan.&lt;/p&gt;&#xA;" OwnerUserId="5471" LastActivityDate="2014-04-29T19:11:08.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7664" PostTypeId="1" CreationDate="2014-04-29T19:29:30.033" Score="2" ViewCount="2344" Body="&lt;p&gt;I have a Twice NAT routing question. How do I forward an IP packet based on the pre-translated destination? Right now I have conflicting subnets between two sites which is why I am doing the Twice NAT. However, I believe the Cisco ASA is routing based on the post-translated address and therefore not forwarding the packet in the correct direction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.10.201.1 255.255.255.0&#xA;interface GigabitEthernet3&#xA; nameif outside&#xA; security-level 0&#xA; ip address 10.255.255.1 255.255.255.252&#xA;&#xA;object network SideA-PC_real&#xA; host 10.10.17.55&#xA;object network SideA-PC_map&#xA; host 10.252.28.55&#xA;object network SideB-PC_real&#xA; host 10.10.17.155&#xA;object network SideB-PC_map&#xA; host 10.251.4.155&#xA;&#xA;route outside 10.10.1.0 255.255.255.0 10.255.255.2 1&#xA;route inside 10.10.17.0 255.255.255.0 10.10.201.2 1&#xA;route outside 10.251.4.0 255.255.255.0 10.255.255.2 1&#xA;&#xA;nat (inside,outside) source static SideA-PC_real SideA-PC_nat destination static SideB-PC_nat SideB-PC_real&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The debug logs show the translation happening exactly as I want, however a tcpdump from SideB shows it never gets forward there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pings only work if i add&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route outside 10.10.17.155 255.255.255.255 10.255.255.2 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to the ASA. Which I believe is because it is more specific than the 10.10.17.0 inside route.&lt;/p&gt;&#xA;" OwnerUserId="3528" LastEditorUserId="3528" LastEditDate="2014-04-29T20:08:34.270" LastActivityDate="2014-04-30T18:34:28.083" Title="Twice NAT destination routing on pre-translated address for Cisco ASA 8.4" Tags="|cisco|routing|cisco-asa|nat|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7666" PostTypeId="2" ParentId="7484" CreationDate="2014-04-29T20:21:04.867" Score="1" Body="&lt;p&gt;Looks like you CAN do static null0 routes in ASA 9.2(1).  You would then redistribute the static into EIGRP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/route-static.html#pgfId-1241233&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/general/asa-general-cli/route-static.html#pgfId-1241233&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route null0 192.168.2.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="155" LastActivityDate="2014-04-29T20:21:04.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7669" PostTypeId="1" AcceptedAnswerId="7677" CreationDate="2014-04-30T06:21:33.870" Score="3" ViewCount="2220" Body="&lt;p&gt;What protocol(s) can be used to programatically &quot;push&quot; configuration settings to Cisco/HP switches, over a network? Of course, I could write a program which would imitate what a human does when logging in by telnet/SSH, and then issue command-line commands. But I'm hoping there is a nicer way to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I'm sure I could find the answer through Google... if I just knew the right search keywords to try!)&lt;/p&gt;&#xA;" OwnerUserId="5478" LastActivityDate="2014-07-28T18:27:41.267" Title="Protocol to push config to Cisco/HP switches?" Tags="|cisco|switch|hp|" AnswerCount="5" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7670" PostTypeId="2" ParentId="7669" CreationDate="2014-04-30T06:35:14.993" Score="1" Body="&lt;p&gt;try to use &lt;a href=&quot;http://www.shrubbery.net/rancid/&quot; rel=&quot;nofollow&quot;&gt;rancid&lt;/a&gt;. techically its use ssh\telnet, to dump configs to the database, where you can see diffs of your configs, and one of the rancid modules is can be used to send commands to multiple devices:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cisco: &#xA;./clogin -c command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hp:&#xA;./hlogin -c command&lt;/p&gt;&#xA;" OwnerUserId="3478" LastActivityDate="2014-04-30T06:35:14.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7672" PostTypeId="2" ParentId="7669" CreationDate="2014-04-30T07:31:25.660" Score="6" Body="&lt;p&gt;If your devices are not to old &lt;a href=&quot;http://en.wikipedia.org/wiki/NETCONF&quot;&gt;netconf&lt;/a&gt; is the generic way to do this.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-04-30T07:31:25.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7677" PostTypeId="2" ParentId="7669" CreationDate="2014-04-30T11:44:10.827" Score="7" Body="&lt;p&gt;Ciscocmd is another option like RANCID which has already been mentioned; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://sourceforge.net/projects/cosi-nms/files/ciscocmd/&quot;&gt;http://sourceforge.net/projects/cosi-nms/files/ciscocmd/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively you could use SNMP. You can send an SNMP write to the device with the location of a config server using an TFTP URL or HTTP URL and setting the &quot;Pull config&quot; option via SNMP;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/15217-copy-configs-snmp.html#copying_startup&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/15217-copy-configs-snmp.html#copying_startup&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/11025771/push-configuration-snmp&quot;&gt;https://supportforums.cisco.com/discussion/11025771/push-configuration-snmp&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2014-04-30T11:44:10.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7678" PostTypeId="1" AcceptedAnswerId="7682" CreationDate="2014-04-30T14:25:31.310" Score="4" ViewCount="181" Body="&lt;p&gt;We have a Cisco 4700 ACE Router/Load Balancer which sits on the outside of our DMZ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition we have that forward network traffic in round-robin mode to 2 IIS servers. We have opened up SSL port 443 to the router from outside and set-up a SSL certificate on both IIS servers with the correct bindings to the certificates. The certificate is valid and the Root certificate is also trusted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever when we connect to the router, we receive TCP packets on 443 on the server receiving the request, but then the connection stops and in the web browser get &quot;No data received&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it even possible to have SSL working on servers behind the router or does the SSL need to be terminated at the point the request comes in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the current set-up is ok, what is the issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to give some extra information, when we trace the packets into the IIS server, the last packet before no packets are sent is a HTTPS RST, ACK packet.&lt;/p&gt;&#xA;" OwnerUserId="5485" LastEditorUserId="8499" LastEditDate="2018-02-16T04:27:49.867" LastActivityDate="2018-02-16T04:27:49.867" Title="Using SSL with Cisco Network Load balancer" Tags="|cisco|router|load-balancer|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7679" PostTypeId="1" AcceptedAnswerId="7681" CreationDate="2014-04-30T15:52:53.607" Score="3" ViewCount="2718" Body="&lt;p&gt;I have a lab with a palo alto device in a deployment with a host and a server. I set up a mail server in a machine and finally I got all scenarios working fine. The most problematic connection has been when a LAN user in trust zone connect to mail server throught the public IP in untrust zone. Mail server is also in trust zone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could fix this scenario when reading this link &lt;a href=&quot;https://live.paloaltonetworks.com/docs/DOC-1678&quot; rel=&quot;nofollow&quot;&gt;https://live.paloaltonetworks.com/docs/DOC-1678&lt;/a&gt; from palo alto. My problem was that I wasn't applying the source translation in the NAT rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to understand how NAT works, my question is, Why do you need to translate source address in U-Turn NAT scenario?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2014-04-30T16:35:46.303" Title="Why using Dynamic ip and port when using U-Turn NAT" Tags="|firewall|nat|palo-alto|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7681" PostTypeId="2" ParentId="7679" CreationDate="2014-04-30T16:35:46.303" Score="3" Body="&lt;p&gt;Because they're in the same zone -- and thus the same subnet, the source must be rewritten to get the replies to pass back through NAT instead of being a direct reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a local lan client attempts to connect to the public server address, the traffic will flow to the firewall. The firewall will rewrite the destination and forward the traffic to the local lan server address. If the firewall doesn't change the source as well, the server will see the source as being on the local lan, and it's replies will be sent direct to the local lan client using the local lan server address. Without it passing back through the firewall, the traffic will not make sense to the client (wrong tcp sequence numbers, and wrong IP address.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-04-30T16:35:46.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7682" PostTypeId="2" ParentId="7678" CreationDate="2014-04-30T16:45:52.003" Score="3" Body="&lt;p&gt;Load balancing SSL is tricky. (I and several coworkers hold a patent on how to do it without decoding the traffic.)  If you have a 1:1 NAT, there should be no problems... everything always goes to the same place.  If you have connections bouncing between hosts, problems will start to pop up unless the SSL servers have a shared SSL session cache -- I don't think IIS can. Without a shared cache, session resumes will not be possible when a connection is sent to a different server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most common (patent unencumbered) way to do this is, as you mentioned, by handling SSL at a single point and then load balancing from there to internal SSL or non-SSL servers.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-04-30T16:45:52.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7683" PostTypeId="2" ParentId="7664" CreationDate="2014-04-30T18:34:28.083" Score="3" Body="&lt;p&gt;I got it to work &lt;strong&gt;without&lt;/strong&gt; putting the /32 routes in for each host, by issuing &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route outside 0.0.0.0 0.0.0.0 10.255.255.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to issue a &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route outside 10.10.17.0 255.255.255.0 10.255.255.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However cisco complains the route already exists, even though it is for the &lt;strong&gt;outside&lt;/strong&gt; interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really don't like doing it this way, however I can't seem to find a way to have the Cisco ASA forward the packet based on the pre-nat destination.&lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2014-04-30T18:34:28.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7684" PostTypeId="1" AcceptedAnswerId="18133" CreationDate="2014-04-30T19:04:32.747" Score="9" ViewCount="692" Body="&lt;p&gt;We are looking at Cisco ME3600 to provide connectivity between our datacenter fabrics for some software defined networking.  Due to the platform having a higher limitation on EoMPLS xconnects than VRFs (512 vs 128), we are considering the approach of allocating a vLAN in each DC to a software router, and using EoMPLS to connect these two software routers together to route Layer 3 traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For redundancy, we want to have 2 PWs for each connection between a pair of software routers, and I'm curious how best to have this, given the interactions between various spanning tree implementations.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of our datacenters has MSTP deployed as a single region, odds in instance 1, evens in instance 2, CIST in instance 0.  The other datacenter still operates R-PVST.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current plan is to create a trunk from the switch fabric into the ME3600, and use a EFP for specific vLANs and assign them to a xconnect.  I'm curious how the switch fabric on each end will handle this -- will I have to setup a vLAN 1 EFP on both sides, and pass PVST traffic?  Will this be enough to set root/block/alternate on both sides?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Diagram below of the physical layout, and the logical idea behind connecting two software routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/n1YVj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="141" LastActivityDate="2016-02-05T14:35:27.440" Title="EoMPLS, MSTP, and RPVST" Tags="|mpls|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7685" PostTypeId="2" ParentId="6800" CreationDate="2014-04-30T20:59:36.443" Score="6" Body="&lt;p&gt;Just to provide an answer for anyone else experiencing similar issues, this was a cosmetic bug that was fixed from JUNOS 12.3 onwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actual update from TAC&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;There is an issue with the stats collection command where the HW counter was not getting cleared. Thus the stats reporting was continuously incrementing it's counter even though no actual EOPE errors were occurring.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This is a cosmetic issue and doesn't have any impact on the production traffic.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Junos 11.4 is an Extended End of Life release. The next release for JUNOS 11.4 is 11.4R12. &#xA;  If your customer wishes I can open a scope for it and the fix to go in to the following releases: 12.3R7 13.2R5 13.3R3 14.1R1. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="1092" LastEditDate="2014-05-01T08:41:24.717" LastActivityDate="2014-05-01T08:41:24.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7696" PostTypeId="1" AcceptedAnswerId="7697" CreationDate="2014-05-01T13:42:59.647" Score="2" ViewCount="100" Body="&lt;p&gt;I was studying OSPF and this came up from a training material,in which the instructor says: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;in turn a loopback interface's higher level of stability and availability results in fewer SPF recalculations. which results in a more stable network overall.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there's no doubt about the higher level of stability and availability over physical interfaces, I mean for the sake of kinda connectivity and to make sure the device/router is up and running, physical interfaces could go bad easily and could make us some problem,but for loopback it's a different story,the only way for loopback int to be unavailable is for it to be manually deleted or for the entire router to go down. but how possibly using or not using loopback could affect SPF calculation??&lt;/p&gt;&#xA;" OwnerUserId="5420" LastActivityDate="2014-05-01T14:40:13.693" Title="loopback interface's results in fewer SPF recalculations?" Tags="|cisco|ospf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7697" PostTypeId="2" ParentId="7696" CreationDate="2014-05-01T14:29:43.223" Score="3" Body="&lt;p&gt;Loopbacks are considered host addresses in OSPF. If there are no interfaces that are UP/UP when OSPF performs its check, it will use the configured loopback. Without the loopback and an UP/UP physical interface, you will instead receive an error: &quot;cannot allocate router id&quot;. The SPF calculation in an environment with an available loopback starts at the loopback itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/9237-9.html#qone&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/9237-9.html#qone&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow&quot;&gt;RCF2328&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ex. Say you are in a situation where you have two interfaces on a router with a loopback and two interfaces on a router without a loopback. The router A, with two interfaces and a loopback set as the router ID will lose one of its two links. In this case, because the loopback is set as the router ID, the protocol will continue running as there is a physical link still up for traffic to traverse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In router B, you have g1/0/1 set as your router ID and it goes down for whatever reason...you now have no way into that router despite having g1/0/2 open. &lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="4634" LastEditDate="2014-05-01T14:40:13.693" LastActivityDate="2014-05-01T14:40:13.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7699" PostTypeId="1" AcceptedAnswerId="7705" CreationDate="2014-05-01T16:53:35.327" Score="3" ViewCount="330" Body="&lt;p&gt;Imagine this scenario: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1-------R2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1&lt;/code&gt;'s serial 1 is connected to &lt;code&gt;R2&lt;/code&gt;'s serial 1, it's a simple p2p link. Quite simple, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I changed the network type on the both sides to non-broadcast, for any unreasonable reason, the adjacency dropped and everything collapsed :) I know about OSPF network types and am also well aware of the troubleshooting process. I issued almost any show/debug command; everything mostly matches on both sides: timers, area, etc. But it doesn't work, why? How do I get it working?&lt;/p&gt;&#xA;" OwnerUserId="5420" LastEditorUserId="3191" LastEditDate="2014-05-01T20:43:52.877" LastActivityDate="2014-05-01T20:43:52.877" Title="OSPF p2p Network type" Tags="|cisco|routing|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7700" PostTypeId="1" AcceptedAnswerId="7702" CreationDate="2014-05-01T17:33:39.153" Score="5" ViewCount="251" Body="&lt;p&gt;While preparing for CCNA exam, I found this recommendation in a book:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Place extended ACLs as close as possible to the source of the packets that will be filtered. Filtering close to the source of the packets saves some bandwidth &lt;sup&gt;[1]&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The question: Why does placing the ACL close to the packets' source save bandwidth?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;[1]&lt;/sup&gt; &lt;sub&gt;Source: &lt;em&gt;Cisco CCNA Routing and Switching 200-120 Official Cert Guide Library&lt;/em&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user5029" LastEditorUserId="3191" LastEditDate="2014-05-01T20:24:21.467" LastActivityDate="2014-05-01T20:24:21.467" Title="Extended ACL bandwidth consumption" Tags="|cisco|acl|bandwidth|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7702" PostTypeId="2" ParentId="7700" CreationDate="2014-05-01T17:48:31.580" Score="6" Body="&lt;p&gt;The reason for placing Extended ACL's as close to the source as possible is to prevent unnecessary traffic from traversing the network. The ACL will catch the packet before it routes it and therefore less routers have to process the packet and route it through the network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the reason this is suggested only with extended ACL's and not standard ACL's is that an Extended ACL is more refined, where as the standard ACL can catch traffic not intended to be filtered.&lt;/p&gt;&#xA;" OwnerUserId="4946" LastActivityDate="2014-05-01T17:48:31.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7705" PostTypeId="2" ParentId="7699" CreationDate="2014-05-01T19:12:32.087" Score="5" Body="&lt;p&gt;When you change the type to non-broadcast, you prevent the routers from multicasting their hellos (and everything else).  Since they can't send hellos to each other, the adjacency drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a troubleshooting hint, you should have seen that in the debugs -- OSPF was not sending hellos out that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can fix this by explicitly defining the neighbors using the neighbor statement under ospf&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA;neighbor 1.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hellos and LSAs will be unicast to the defined neighbor.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-05-01T19:26:49.780" LastActivityDate="2014-05-01T19:26:49.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7706" PostTypeId="2" ParentId="7700" CreationDate="2014-05-01T20:21:22.717" Score="3" Body="&lt;p&gt;To kill it as soon as possible.  If you drop packets furthest down the path, you'll be wasting bandwidth (perhaps valuable), that could have otherwise been dropped sooner with no ill effects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a heads up, this mentality isn't just limited to extended ACLs, it applies to &lt;strong&gt;all&lt;/strong&gt; ACLs.  There isn't any good reason in waiting to drop traffic.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-05-01T20:21:22.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7707" PostTypeId="1" AcceptedAnswerId="7710" CreationDate="2014-05-01T23:00:46.970" Score="10" ViewCount="5591" Body="&lt;p&gt;Something on my Ethernet LAN is occasionally sending out spurious duplicate packets and I need to track it down. The culprit is likely a switch or other bridge (such as a Wi-Fi AP) and not an endpoint, because the packets that get duplicated are not always from the same source MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking of getting a manageable switch that supports port mirroring, and using it with a sniffer to sniff traffic going into and out of a port, but I need to know which direction each captured packet was sent, so I can tell which direction the original and the duplicate came from. If I can find a place on my network where the original and duplicate came from different directions, I'll know that the culprit must be on the side where the duplicate came from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is, the port-mirroring switches I've worked with in the past have only allowed me to mirror &quot;both directions&quot; (both transmit and receive) from a given port, to the mirror port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone suggest a solution that would allow me to mirror just one direction? I'm thinking of hooking up two sniffers, one for the &quot;Tx&quot; direction, and one for the &quot;Rx&quot; direction, so I can tell which way the packets were going. I don't mind buying a new manageable switch or tap to achieve this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm open to any other ideas for tracking down the source of spurious packet duplication, but beware that my current switches on this network aren't terribly manageable, so solutions that assume manageable switches (like &quot;enable such-and-such packet tracing&quot;, or &quot;pull stats from all your switches via SNMP and crunch the data in &amp;lt;app&gt;&quot;) aren't likely to be practical in my situation.&lt;/p&gt;&#xA;" OwnerUserId="3347" LastActivityDate="2017-05-11T21:49:23.913" Title="Port mirroring just the Rx (or Tx) direction of a port?" Tags="|switch|packet-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7709" PostTypeId="1" CreationDate="2014-05-01T23:32:48.760" Score="4" ViewCount="1047" Body="&lt;p&gt;I don't think it is a standardized term in the industry and hence different people have different interpretation. When folks in Ethernet Switch world refer to packet slicing, what do they really mean? Deep Packet Inspection?&lt;/p&gt;&#xA;" OwnerUserId="3282" LastActivityDate="2014-05-02T01:07:47.400" Title="What is Packet Slicing when it comes to Ethernet Switches" Tags="|ethernet|packet-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7710" PostTypeId="2" ParentId="7707" CreationDate="2014-05-02T00:39:31.323" Score="13" Body="&lt;p&gt;On Cisco switches, you can configure whether you mirror rx, tx or both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;monitor session 1 source interface gi0/1 rx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For receive only:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;monitor session 1 source interface gi0/1 tx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For transmit only:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;monitor session 1 source interface gi0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you don't specify, you mirror both tx and rx.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="20757" LastEditDate="2017-05-11T21:49:23.913" LastActivityDate="2017-05-11T21:49:23.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7711" PostTypeId="2" ParentId="7709" CreationDate="2014-05-02T01:07:47.400" Score="5" Body="&lt;p&gt;In the context of packet capture, or sniffing, packet slicing means saving only a portion of the captured packet.  Rather than saving the entire captured packet, usually just the header is saved.  This reduces the amount of storage and processing needed to inspect packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For forensic analysis, it is helpful to have the entire packet (for example, to see what the payload is).  Some organizations capture every packet that leaves or enters their network.  In this way, they can analyze a network attack and see exactly what happened.  Of course, this takes a lot more storage space.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-05-02T01:07:47.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7712" PostTypeId="2" ParentId="7707" CreationDate="2014-05-02T05:29:19.653" Score="2" Body="&lt;p&gt;There's also the option of {building,buying} a hardware network tap - here are some options for building half-duplex taps:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://hackaday.com/2008/09/14/passive-networking-tap/&quot; rel=&quot;nofollow&quot;&gt;Passive network tap&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://vcabbage.com/2010/07/17/building-a-passive-network-tap/&quot; rel=&quot;nofollow&quot;&gt;Building a Passive Network Tap&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="5507" LastActivityDate="2014-05-02T05:29:19.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7713" PostTypeId="1" AcceptedAnswerId="7716" CreationDate="2014-05-02T06:00:20.827" Score="41" ViewCount="125765" Body="&lt;p&gt;Does gratuitous ARP work like a normal ARP request?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is gratuitous ARP used for HSRP?&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="775" LastEditDate="2014-12-08T12:35:13.130" LastActivityDate="2019-03-28T17:30:39.730" Title="How does gratuitous ARP work?" Tags="|ethernet|arp|hsrp|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7716" PostTypeId="2" ParentId="7713" CreationDate="2014-05-02T08:17:00.693" Score="48" Body="&lt;p&gt;Gratuitous ARP is a sort of &amp;quot;advance notification&amp;quot;, it updates the ARP cache of other systems before they ask for it (no ARP request) or to update outdated information.&lt;/p&gt;&#xA;&lt;p&gt;When talking about gratuitous ARP, the packets are actually special ARP request packets, not ARP reply packets as one would perhaps expect. Some reasons for this are explained in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5227#section-3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5227&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The gratuitous ARP packet has the following characteristics:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Both source and destination IP in the packet are the IP of the host issuing the gratuitous ARP&lt;/li&gt;&#xA;&lt;li&gt;The destination MAC address is the broadcast MAC address (&lt;code&gt;ff:ff:ff:ff:ff:ff&lt;/code&gt;)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This means the packet will be flooded to all ports on a switch&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;No reply is expected&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Gratuitous ARP is used for some reasons:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Update ARP tables after a MAC address for an IP changes (failover, new NIC, etc.)&lt;/li&gt;&#xA;&lt;li&gt;Update MAC address tables on L2 devices (switches) that a MAC address is now on a different port&lt;/li&gt;&#xA;&lt;li&gt;Send gratuitous ARP when interface goes up to notify other hosts about new MAC/IP bindings in advance so that they don't have to use ARP requests to find out&lt;/li&gt;&#xA;&lt;li&gt;When a reply to a gratuitous ARP request is received you know that you have an IP address conflict in your network&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;As for the second part of your question, &lt;strong&gt;HSRP&lt;/strong&gt;, &lt;strong&gt;VRRP&lt;/strong&gt; etc. use gratuitous ARP to update the MAC address tables on L2 devices (switches). Also there is the option to use the burned-in MAC address for HSRP instead of the &amp;quot;virtual&amp;quot;one. In that case the gratuitous ARP would also update the ARP tables on L3 devices/hosts.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-05-02T10:46:47.397" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="7727" PostTypeId="1" AcceptedAnswerId="7729" CreationDate="2014-05-03T08:23:39.253" Score="3" ViewCount="1300" Body="&lt;p&gt;When it comes to packet switching, it does not create a permanent physical path like Circuit switching. It uses packets and they use different paths to reach the destination. Also packet switching maintains a VC (virtual circuit). Has two parts, PVC and SVC. PVC provides a permanent path to forward the data and eliminates the need of call setup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is, if packet switching has no permanent paths like circuit switching, then what happens in PVC ? What kind of Permanent Virtual Circuit is that? If packet switching uses many paths to send data, why it uses a &lt;strong&gt;Permanent&lt;/strong&gt; Virtual Circuit ?&lt;/p&gt;&#xA;" OwnerUserId="5418" LastActivityDate="2014-05-03T19:07:56.383" Title="How PVC works in frame relay?" Tags="|frame-relay|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7729" PostTypeId="2" ParentId="7727" CreationDate="2014-05-03T19:02:44.780" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Also packet switching maintains a VC (virtual circuit). Has two parts, PVC and SVC. PVC provides a permanent path to forward the data and eliminates the need of call setup.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To be clear: packet switching does not maintain a virtual circuit. There are certain packet switching technologies, or technologies designed for packet switching that do (ie Frame Relay, MPLS, TCP), but as a whole, this isn't how packet switching works. Circuits were required in circuit-switched networks. Since circuits (used in this context) are not relevant anymore, but the technology used that relied on them (the phone system) is, we now have the need to emulate them in packet switched networks, hence &quot;virtual circuits.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In relation to Frame Relay (actually not just Frame Relay - this is relevant in ATM and X.25), SVC and PVC are two different types of virtual circuits. Virtual circuits are paths that are determined through a Frame Relay or ATM/X.25 network (although not many of these exist anymore, aside from some DSL ISPs). PVC is predetermined and configured explicitly (hence &quot;permanent&quot;) and SVC is set up &quot;on the fly&quot; in a more dynamic fashion (as-needed basis). IIRC there wasn't much support for SVC's in Frame Relay and from an operational perspective PVC's were more desirable because there were less moving parts (things to troubleshoot/go wrong).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_circuit#Permanent_and_switched_virtual_circuits_in_ATM.2C_frame_relay.2C_and_X.25&quot; rel=&quot;nofollow&quot;&gt;This Wikipedia snippet&lt;/a&gt; on virtual circuits in the context of Frame Relay and ATM goes into detail on what &quot;virtual circuit&quot; actually means.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If packet switching uses many paths to send data, why it uses a Permanent Virtual Circuit?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Packet switching &lt;strong&gt;&lt;em&gt;can&lt;/em&gt;&lt;/strong&gt; use many paths to send data, but some network layer protocols that run on top of the packet switched network (ie MPLS, ATM, Frame Relay, etc) have a requirement that data is &lt;strong&gt;&lt;em&gt;always sent over the same path&lt;/em&gt;&lt;/strong&gt; - the path is the virtual circuit. In MPLS it's called an LSP. In Frame Relay (and ATM) it's called a PVC.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2014-05-03T19:07:56.383" LastActivityDate="2014-05-03T19:07:56.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7731" PostTypeId="2" ParentId="7626" CreationDate="2014-05-03T21:57:59.177" Score="1" Body="&lt;p&gt;Well, QoS can work on L2/L3/L4 information, and as soon as your voice equipment - be it Polycom - packs the voice data into payload of IP packets, 1841 can apply QoS features on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;voice&quot; support on Cisco routers generally means ability to terminate voice input, or ability to output voice in digital or analog form. If that function is already embedded into voice terminal you're using, all 1841 will deal with is IP traffic.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-05-03T21:57:59.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7732" PostTypeId="1" CreationDate="2014-05-03T23:11:28.453" Score="1" ViewCount="179" Body="&lt;p&gt;can OSPF LSR packet carry multiple LSA bodies for link efficiency?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that &quot;an OSPF LSU packet can carry multiple LSA bodies for link efficiency up to interface MTU (including IP and OSPF headers)&quot; is that true about the LSR too? how could I check that?&lt;/p&gt;&#xA;" OwnerUserId="5420" LastActivityDate="2014-06-27T18:20:13.450" Title="can OSPF LSR packet carry multiple LSA bodies for link efficiency?" Tags="|cisco|ospf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7733" PostTypeId="1" AcceptedAnswerId="7744" CreationDate="2014-05-03T23:31:17.047" Score="5" ViewCount="14081" Body="&lt;p&gt;What is the OSPF Opaque LSA Option, exactly? In what case scenarios would someone use that? I just skimmed &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5250&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5250&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2370&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2370&lt;/a&gt; but could not get the real world usage and how to set up.&lt;/p&gt;&#xA;" OwnerUserId="5420" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2018-12-26T04:23:08.100" Title="How is the OSPF Opaque LSA Option used?" Tags="|ospf|protocol-theory|rfc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7744" PostTypeId="2" ParentId="7733" CreationDate="2014-05-05T06:03:48.763" Score="9" Body="&lt;p&gt;Opaque LSA's are used to extend the capabilities of OSPF, and to allow for transmission of arbitrary data that OSPF does not necessarily need to care about. For example, if you were writing an application and you decided you wanted to use OSPF to transport the application's data but you did not want OSPF to use this data for its own purposes, ie route calculations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three types of Opaque LSA's (in context of the subtype of the Opaque LSA, similar to other LSA types), which determine the scope of flooding of those LSA's:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Type 9&lt;/strong&gt; - link-local scope&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Type 10&lt;/strong&gt; - area-local scope&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Type 11&lt;/strong&gt; - AS scope&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Opaque LSA has 32 bits allocated for the Opaque Type (8 bits) and the Opaque ID (24 bits). There are (AFAIK) currently four Opaque types that have been allocated by the IANA:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Traffic Engineering LSA - used for MPLS-TE&lt;/li&gt;&#xA;&lt;li&gt;Sycamore Optical Topology Descriptions - likely proprietary. I wasn't able to find much info on this, other than the fact that John Moy works for Sycamore.&lt;/li&gt;&#xA;&lt;li&gt;Grace LSA - used for OSPF graceful restart&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.ietf.org/rfc/rfc4970.txt&quot;&gt;Router Information LSA&lt;/a&gt; - Intended (but not yet implemented AFAIK) to supplement the options field to allow for communication of optional capabilities between neighbors. Currently the options field is only 8 bits and there is only a single bit that can be used that just determines if a neighbor supports Opaque LSA's. This RI LSA would provide TLV values to signal support of up to 32 different capabilities between neighbors without needing to add more bits to the options field in the LSA.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In regards to practical application of the Opaque LSA, likely the most common implementation you'll see of this in the wild is in MPLS traffic engineering. In OSPF extensions for MPLS traffic engineering, Opaque LSA's are used to communicate traffic engineering interface parameters (such as maximum bandwidth, maximum reservable bandwidth, unreserved bandwidth, etc) throughout an area in order to populate the traffic engineering databases of the routers within the area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for &quot;how to use it&quot; - you shouldn't have to, unless you're writing code that you would need to use it. In terms of practical application on a routing platform, on platforms I have experience with, there's not a specific knob you need to turn that &quot;enables&quot; Opaque LSAs. These should be implicitly enabled if you implement something that has dependencies on them, such as MPLS.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2014-05-05T06:03:48.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7756" PostTypeId="1" AcceptedAnswerId="7761" CreationDate="2014-05-06T01:41:00.687" Score="3" ViewCount="1850" Body="&lt;p&gt;I have an Avaya IP Office PBX phone system.  There is a T1 coming in for the trunk.  There were 6 numbers associated tot he trunk.  4 of the numbers were taken off by Telco provider and converted to POTS lines and brought into another office off premises from where the PBX is located.  In the new office the lines work fine for both incoming and outgoing calls on the analog POTS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This issue that we are having is that when dialing any of those 4 numbers internally on the AVAYA system it just rings right back into local system.  i.e.: 96363345 will ring right back into the phone system.  I have gone though IP Office Manager and I cannot see any references to those 4 numbers anywhere.  I am suspecting its the telco but wanted to see if maybe I am missing something on the PBX.&lt;/p&gt;&#xA;" OwnerUserId="5188" LastEditorDisplayName="user36472" LastEditDate="2019-02-25T11:54:27.550" LastActivityDate="2019-02-25T11:54:27.550" Title="Outgoing call routing issue Avaya IP Office PBX" Tags="|voip|avaya|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7758" PostTypeId="1" CreationDate="2014-05-06T06:14:02.350" Score="7" ViewCount="15748" Body="&lt;p&gt;The conditions under which a switch will discard outbound packets on particular ports are fairly well established in many basic training materials, including those for CCNA.  However, input discards are typically less well-documented.  Some reasons I've found include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://forums.networkinfrastructure.info/nortel-ethernet-switching/packet-discards/&quot; rel=&quot;noreferrer&quot;&gt;Mismatched VLANs&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/12027-53.html&quot; rel=&quot;noreferrer&quot;&gt;Frame did not need to be switched&lt;/a&gt; because the MAC was already on that port, or because it is the only port in the VLAN &lt;/li&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;http://www.alvestrand.no/objectid/1.3.6.1.2.1.2.2.1.13.html&quot; rel=&quot;noreferrer&quot;&gt;ifInDiscard SNMP MIBs&lt;/a&gt; seem to indicate that buffer space can also be a reason&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Are there any other common reasons?  How would one decide between these possibilities?&lt;/p&gt;&#xA;" OwnerUserId="225" LastEditorUserId="225" LastEditDate="2014-05-07T01:29:42.767" LastActivityDate="2014-11-05T08:10:03.463" Title="What do input discards on switch ports indicate and how can one track down their cause?" Tags="|switch|snmp|switching|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7759" PostTypeId="1" CreationDate="2014-05-06T07:00:04.807" Score="1" ViewCount="4837" Body="&lt;p&gt;Point 1- &#xA;Currently we have 1 ISP which is terminated on Router 2951 and now we are planning to add 1 more Router 2951 and 2nd ISP link.&#xA;Need to achieve Failover and load balancing between these TWO Router,&#xA;please suggest how can i achieve this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point 2 -&#xA;Also if possible - can redirect FTP Traffic to Separate link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have 2 Router 2951, both having 50mbps Link terminated on each router.&#xA;Achievement - we have to do equal load balancing,at a time both wan link should be used and WAN Link Failover,&#xA;Example - At a time both link should be used and if 1 link fails the other link should take over, i.e. all traffic will pass through ISP 2 if ISP 1 fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this we want to achieve with IP SLA on 3750x switch &#xA;Attached is the network diagram for reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/HcTV0.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5479" LastEditorUserId="775" LastEditDate="2014-06-16T10:58:22.080" LastActivityDate="2014-06-16T17:28:08.343" Title="Load Balancing and failover on 2 Router 2951" Tags="|cisco|routing|router|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7760" PostTypeId="2" ParentId="7758" CreationDate="2014-05-06T08:03:27.747" Score="4" Body="&lt;p&gt;Unknown VLANs are the primary cause of Input Discards (&lt;code&gt;ifInDiscards&lt;/code&gt;) in my environment; usually from inappropriate VLANs spanning a trunk port.  Depending on the services active in the VLAN in question, those counters can increase exponentially over short periods of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that Input Discards are the result of valid frames being dropped due to an internal forwarding issue.  Another thing to note: Input Discards encompass a drastically smaller amount of issues, most everything else results in an interface &lt;strong&gt;&lt;em&gt;error&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-05-06T18:59:04.483" LastActivityDate="2014-05-06T18:59:04.483" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7761" PostTypeId="2" ParentId="7756" CreationDate="2014-05-06T08:14:06.260" Score="3" Body="&lt;p&gt;The Telco still has the numbers associated with your PRI trunk group. Calls from other locations will be routed to analog lines, however when you call out on your PRI the 5ESS switch bounces the call back down the trunk group as a DID. The Telco needs to remove the numbers from the DID list on their switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This type of thing is very common actually. C/O techs have to change the number in 3 different places and don't see the point in removing the numbers from the trunk group when the switch routing will send the call to the correct place regardless of the DID list on a trunk group. The problem with that is it creates routing loop problems like yours.&lt;/p&gt;&#xA;" OwnerUserId="4337" LastEditorUserId="4337" LastEditDate="2014-05-06T08:23:05.590" LastActivityDate="2014-05-06T08:23:05.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7762" PostTypeId="1" AcceptedAnswerId="19173" CreationDate="2014-05-06T08:51:31.643" Score="3" ViewCount="629" Body="&lt;p&gt;I would like to know what manufacturers support trill and on what platforms specific. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am especially interested in Cisco platforms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find to much information on the internet about it other than the fact that nexus series are capable of running trill.&lt;/p&gt;&#xA;" OwnerUserId="4584" LastEditorUserId="775" LastEditDate="2014-05-06T08:58:42.783" LastActivityDate="2015-06-12T17:51:58.950" Title="What vendor supports the trill protocol?" Tags="|cisco|router|switch|ethernet|" AnswerCount="1" CommentCount="3" CommunityOwnedDate="2014-05-06T08:58:42.783" ContentLicense="CC BY-SA 3.0" />
  <row Id="7765" PostTypeId="1" CreationDate="2014-05-06T16:12:42.160" Score="6" ViewCount="1711" Body="&lt;p&gt;Cisco documentation states the following on forming channels:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;SW1               SW2&#xA;----------------------------------------&#xA;On                 On              = Yes&#xA;Auto/Desirable     Desirable       = Yes&#xA;On/auto/desirable  Not configured  = No&#xA;On                 Desirable       = No&#xA;Auto/On            Auto            = No&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is to my understanding that Auto only responds to PAgP, but does not initiate the PAgP negotiation. But for some reason when testing both sides with Auto, the port channel comes up anyways.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;SW1#show etherchannel summary &#xA;Flags:  D - down        P - in port-channel&#xA;        I - stand-alone s - suspended&#xA;        H - Hot-standby (LACP only)&#xA;        R - Layer3      S - Layer2&#xA;        U - in use      f - failed to allocate aggregator&#xA;        u - unsuitable for bundling&#xA;        w - waiting to be aggregated&#xA;        d - default port&#xA;&#xA;&#xA;Number of channel-groups in use: 1&#xA;Number of aggregators:           1&#xA;&#xA;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+----------------------------------------------&#xA;&#xA;1      Po1(SU)           PAgP   Fa0/1(P) Fa0/2(P) &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is, shouldn't an &lt;code&gt;Auto&lt;/code&gt; - &lt;code&gt;Auto&lt;/code&gt; configuration fail? Why does this work?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Both switch configs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Building configuration...&#xA;&#xA;Current configuration : 1131 bytes&#xA;!&#xA;version 12.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SW1&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; channel-group 1 mode auto&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/2&#xA; channel-group 1 mode auto&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA;!&#xA;interface Port-channel 1&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.1.1 255.255.255.0&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Current configuration : 1134 bytes&#xA;!&#xA;version 12.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SW2&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; channel-group 1 mode auto&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/2&#xA; channel-group 1 mode auto&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA;!&#xA;interface Port-channel 1&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.1.2 255.255.255.0&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="4603" LastEditorUserId="3191" LastEditDate="2014-05-06T20:01:35.333" LastActivityDate="2015-02-19T10:19:41.943" Title="Successful Auto/Auto PAgP Port Channel?" Tags="|switch|switching|etherchannel|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="7766" PostTypeId="2" ParentId="7759" CreationDate="2014-05-06T17:43:37.003" Score="2" Body="&lt;p&gt;Are you running BGP with ISPs? Or just defaults towards Internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should propably configure HSRP on the internal side between routers to have single default gateway for your network - or multiple default gateways if the inside will be segmented in VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're running BGP and you do have PI space, announce it on both links, then try to tune using the BGP traffic engineering features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have BGP, you can try to use Performance Routing coupled with NAT, because you'll need to match outgoing traffic with properly selected source IP addresses (your ISPs should do uRPF and check what source addresses you're using on links they provide you).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Mike stated, topology drawing would benefit the discussion.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-05-06T17:43:37.003" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7767" PostTypeId="1" AcceptedAnswerId="7768" CreationDate="2014-05-06T19:04:15.000" Score="3" ViewCount="861" Body="&lt;p&gt;&quot;Debug ip eigrp&quot; command, output interpretation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as you see in this output, it's a line from &quot;Show ip eigrp&quot; command, output&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP-EIGRP(Default-IP-Routing-Table:90): Int 172.30.7.0/24 M 2297856 - 1657856 640000 SM 128256 - 256 128000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what is SM (I think it's source metric or AD, not sure!)? what is M (it must be FD, but not sure again!)?what are those numbers in front of them?&lt;/p&gt;&#xA;" OwnerUserId="5420" LastActivityDate="2014-05-07T01:57:16.523" Title="&quot;Debug ip eigrp&quot; command, output interpretation?" Tags="|cisco|eigrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7768" PostTypeId="2" ParentId="7767" CreationDate="2014-05-07T01:57:16.523" Score="3" Body="&lt;p&gt;This is an EIGRP received route advertisement and can be broken down as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;IP-EIGRP(90): Int 172.30.7.0/24 M 2297856 - 1657856 640000 SM 128256 - 256 128000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Route type and advertised IP Prefix:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;Int (Internal) 172.30.7.0/24&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Metric (&lt;code&gt;M&lt;/code&gt;) is the FD:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;M 2297856(FD) - 1657856(bandwidth) + 640000(delay)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Source Metric (&lt;code&gt;SM&lt;/code&gt;) is the AD:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;SM 128256(AD) - 256(bandwidth) + 128000(delay)&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2476" LastActivityDate="2014-05-07T01:57:16.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7769" PostTypeId="2" ParentId="6843" CreationDate="2014-05-07T07:03:40.623" Score="5" Body="&lt;p&gt;This can be configured using &lt;code&gt;VirtualBox&lt;/code&gt; or using &lt;code&gt;Qemu&lt;/code&gt;. These are the steps required to setup JunOS on GNS3 using &lt;strong&gt;Qemu&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Acquire an image of JUNOS. The image file should be with the extension &lt;code&gt;.img&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Open GNS3 and go to &lt;code&gt;Edit&lt;/code&gt; -&gt; &lt;code&gt;Preferences&lt;/code&gt; -&gt; &lt;code&gt;Qemu&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure the settings in the &lt;code&gt;General Settings&lt;/code&gt; section are correct. Below is a screenshot of what the Qemu settings should look like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/eiCHP.png&quot; alt=&quot;QMenu Settings&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click on &lt;code&gt;Test Settings&lt;/code&gt; to check if your settings are correct&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click on the &lt;code&gt;JunOS&lt;/code&gt; tab on the same &lt;code&gt;Preferences&lt;/code&gt; window&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Enter any name for the identifier name&lt;/li&gt;&#xA;&lt;li&gt;For the binary image, select the image you acquired in step 1&lt;/li&gt;&#xA;&lt;li&gt;Select a value for the RAM. The minimum I have seen for this is 256MB. You may also leave this blank and GNS3 will assign this for you.&lt;/li&gt;&#xA;&lt;li&gt;Enter the number of NICs that you want on the Juniper Router (default is 6)&lt;/li&gt;&#xA;&lt;li&gt;Select the model of the NICs you want on the Juniper Router (default is e1000)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Sample Settings for &lt;code&gt;JunOS&lt;/code&gt; settings section:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/klIM6.png&quot; alt=&quot;JunOS Settings&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click &lt;code&gt;Save&lt;/code&gt; to save the JunOS image. Close the Preferences window by clicking &lt;code&gt;Apply&lt;/code&gt;. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now you are able drag the Juniper Router from the left panel and drop them to the topology.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; If you want ta add multiple Juniper routers to your topology, you have to make multiple copies of the image acquired in step 1. Then from the GNS3 program right click on every Juniper router -&gt; &lt;code&gt;Configure&lt;/code&gt; -&gt; In the &lt;code&gt;JunOS Image:&lt;/code&gt; setting, specify the path of a different image file for each instance. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Helpful Links:&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://nil.uniza.sk/network-simulation-and-modelling/gns3/how-run-junos-inside-gns3-step-step&quot; rel=&quot;noreferrer&quot;&gt;NiL - How to run JunOS inside of GNS3&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://thewaleedkhan.wordpress.com/2013/11/26/junos-on-gns3-through-qemu/&quot; rel=&quot;noreferrer&quot;&gt;Waleed Khan - JUNOS on GNS3 through Qemu&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4795" LastEditorUserId="3191" LastEditDate="2014-05-07T07:41:28.040" LastActivityDate="2014-05-07T07:41:28.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7770" PostTypeId="1" AcceptedAnswerId="7784" CreationDate="2014-05-07T07:42:30.540" Score="3" ViewCount="5017" Body="&lt;p&gt;When a router is configured on GNS3 and started, it is possible to access the console output of the router by right clicking a router -&gt; and then clicking &lt;code&gt;Console&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to be able to map this output to a virtual COM port (serial port) on the physical workstation. So that I can use terminal emulation software such as &lt;code&gt;HyperTerminal&lt;/code&gt; to connect to the router as if it were plugged into a COM port of the workstation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to be able to do this as a part of a project I am doing so that I don't need physical routers to demonstrate my project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appriciate any suggestions on how I could do this. Thank you for your time!&lt;/p&gt;&#xA;" OwnerUserId="4795" LastEditorUserId="4795" LastEditDate="2014-05-07T16:10:53.700" LastActivityDate="2014-05-08T00:58:14.613" Title="GNS3: Map the console output of a router on GNS3 to a COM Port (Serial Port)" Tags="|router|gns3|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7773" PostTypeId="2" ParentId="2024" CreationDate="2014-05-07T09:27:06.750" Score="0" Body="&lt;p&gt;switchport mode access - This command puts the interface (access port) into permanent nontrunking mode. &#xA;The interface will generate DTP frames, negotiating with the neighboring interface to convert the link into a &#xA;nontrunk link. The interface becomes a nontrunk interface even if the neighboring interface does not agree to &#xA;the change. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;switchport mode dynamic desirable - This command makes the interface actively attempt to convert the link &#xA;to a trunk link. The interface becomes a trunk interface if the neighboring interface is set to trunk, desirable, or &#xA;auto mode. This is the default mode for all Ethernet interfaces. If the neighboring interface is set to the access &#xA;or non-negotiate mode, the link will become a non-trunking link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;switchport mode dynamic auto – This command makes the interface willing to convert the link to a trunk link if &#xA;the neighboring interface is set to trunk or desirable mode. Otherwise, the link will become a non-trunking link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;switchport mode trunk – This command puts the interface into permanent trunking mode and negotiates to &#xA;convert the link into a trunk link. The interface becomes a trunk interface even if the neighboring interface does &#xA;not agree to the change. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;switchport nonegotiate – Prevents the interface from generating DTP frames. You can use this command only &#xA;when the interface switchport mode is access or trunk. You must manually configure the neighboring interface &#xA;as a trunk interface to establish a trunk link, otherwise the link will be a non-trunking link. &lt;/p&gt;&#xA;" OwnerUserId="4289" LastActivityDate="2014-05-07T09:27:06.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7776" PostTypeId="1" AcceptedAnswerId="7802" CreationDate="2014-05-07T10:48:21.440" Score="1" ViewCount="2427" Body="&lt;p&gt;In these two figures, why the 173.239.151.99(clientB) and the STUN server both know the clientA(192.168.0.1)'s public IP, why clientB can't reach clientA but STUN server can? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or to put my question this way: why we need STUN server after all? Say when clientA send request to clientB, there will be a binding between clientA's IP&amp;amp;port and NAT device's public IP&amp;amp;port in translation table, this &quot; &lt;strong&gt;mapping is created when a TCP SYN packet is &#xA;sent from inside the NAT or when a first UDP packet is &#xA;sent.&lt;/strong&gt;&quot;, so when clientB sends response back, the translation table will help it to reach clientA. Then why on earth we need STUN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://orm-chimera-prod.s3.amazonaws.com/1230000000545/images/hpbn_0304.png&quot; alt=&quot;figure&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KzfSV.png&quot; alt=&quot;figure2&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5567" LastEditorUserId="-1" LastEditDate="2017-03-10T09:42:46.927" LastActivityDate="2014-05-08T14:08:44.280" Title="Why can the STUN server reach the client behind NAT?" Tags="|routing|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7777" PostTypeId="2" ParentId="7758" CreationDate="2014-05-07T11:07:54.503" Score="0" Body="&lt;p&gt;One other reason is that STP topology changes frequently. This usually happens when you have a  flapping link (up and down) somewhere in a Layer 2 switched network that has either RSTP or MSTP enables, or any other Version of SP with &lt;em&gt;&quot;portfast&quot;&lt;/em&gt; configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens that, whenever the flapping link goes down, a BPDU is sent to update all the switches in the network about the new event, which basically leads to a topology change. When this occurs, it could cause some switches to discard a few packets. If the link is coming up and down repeatedly, a lot of frames will be discarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I had this issue many times with switches that were non-Cisco made. I never had this problem with Cisco devices.&lt;/p&gt;&#xA;" OwnerDisplayName="user5029" LastActivityDate="2014-05-07T11:07:54.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7781" PostTypeId="1" AcceptedAnswerId="7803" CreationDate="2014-05-07T14:21:55.840" Score="10" ViewCount="12814" Body="&lt;p&gt;I read this line from &lt;a href=&quot;http://en.wikipedia.org/wiki/STUN#Limitations&quot; rel=&quot;noreferrer&quot;&gt;wikipedia&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;&lt;strong&gt;&lt;em&gt;STUN does work with three types of NAT: full cone NAT, restricted&#xA;  cone NAT, and port restricted cone NAT&lt;/strong&gt;. In the cases of restricted&#xA;  cone or port restricted cone NATs, the client must send out a packet&#xA;  to the endpoint before the NAT will allow packets from the endpoint&#xA;  through to the client. &lt;strong&gt;STUN does not work with symmetric NAT&lt;/em&gt;&lt;/strong&gt;&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain why?&lt;/p&gt;&#xA;" OwnerUserId="5567" LastEditorUserId="3191" LastEditDate="2014-05-08T14:25:16.780" LastActivityDate="2015-02-10T12:41:35.803" Title="why STUN doesn't work with symmetric NAT?" Tags="|nat|asymmetric-routing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7782" PostTypeId="2" ParentId="7300" CreationDate="2014-05-07T14:41:20.937" Score="0" Body="&lt;p&gt;Policy-based routing is primarily used for routing packets using something &lt;strong&gt;other&lt;/strong&gt; than destination IP. If you configure a static route pointing your mail server's IP address towards the WAN, the router will find a longer netmask match for the mail server and not send it according to the default route. Depending on your requirements, Cisco can even track to make sure the WAN is still there before inserting the route into the route table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PBR would be used if you wanted to route based on something non-standard, such as by &lt;strong&gt;source&lt;/strong&gt; IP instead. I've used that when I want one source IP to use one link and another source IP to go somewhere else. But in this case, I think traditional methods should work better.&lt;/p&gt;&#xA;" OwnerUserId="4887" LastActivityDate="2014-05-07T14:41:20.937" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7784" PostTypeId="2" ParentId="7770" CreationDate="2014-05-07T16:30:38.890" Score="5" Body="&lt;p&gt;I was able to do this by redirecting the localhost: of the GNS router to a virtual COM port using the following software:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.eterlogic.com/Products.VSPE.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Virtual Serial Ports Emulator&lt;/a&gt; - Freeware (32 Bit version is&#xA;freeware. When installed on 64 Bit workstation, it asks for&#xA;registration)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.eltima.com/products/serial-over-ethernet/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Eltima Serial to Ethernet Connector&lt;/a&gt; - Commercial with a 14 day trial&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Find out the console port that the GNS router is accessible on: Right click the router and click on &lt;code&gt;Change console port&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Find out if you can telnet to it using Windows Telnet Client or Putty or similar. Use &lt;code&gt;127.0.0.1&lt;/code&gt; (or &lt;code&gt;localhost&lt;/code&gt;) and the port number found in step 1 above.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Install one of the software mentioned above.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use the software to map the TCP/Telnet session accessed in step 2 above to a virtual COM port.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Screenshots of configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Virtual Serial Ports Emulator&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ipegu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ipegu.png&quot; alt=&quot;Virtual Serial Ports Emulator&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Eltima Serial to Ethernet Connector&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/UpKKT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UpKKT.png&quot; alt=&quot;Eltima Serial to Ethernet Connector&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4795" LastEditorUserId="4795" LastEditDate="2014-05-08T00:58:14.613" LastActivityDate="2014-05-08T00:58:14.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7785" PostTypeId="1" AcceptedAnswerId="7794" CreationDate="2014-05-07T19:00:00.947" Score="4" ViewCount="8418" Body="&lt;p&gt;If I have a crypto map with a line as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can I change that simply by typing the following in conf t:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or do additional steps need to be taken beforehand?  What about afterwards??&#xA;Running a Cisco ASA 5510, software version 8.3(2)&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="3191" LastEditDate="2014-05-08T10:44:16.073" LastActivityDate="2014-05-08T10:44:16.073" Title="Can we change peer IP of IPSec VPN tunnel in one line?" Tags="|cisco|cisco-asa|vpn|ipsec|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7787" PostTypeId="2" ParentId="3577" CreationDate="2014-05-07T20:13:54.100" Score="3" Body="&lt;p&gt;In circuit switched connection:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a connection is always established from end to end before transferring data. &lt;/li&gt;&#xA;&lt;li&gt;in the general case the connection has fixed capacity for the whole duration of the connection even if you don't transmit any useful data and at the same time other connections can;t use your capacity&lt;/li&gt;&#xA;&lt;li&gt;the whole capacity is guaranteed&lt;/li&gt;&#xA;&lt;li&gt;the speed of the connection is constant&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In packet switched connection:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the connection may not be established from end to end before start of data transmission&lt;/li&gt;&#xA;&lt;li&gt;the capacity of connection may be variable, different connections share the same physical link&lt;/li&gt;&#xA;&lt;li&gt;the connection capacity is not guaranteed &lt;/li&gt;&#xA;&lt;li&gt;the connection speed may be variable &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Today the networks are a very complex mix of CS and PS connections. PS networks use many protocols for resource reservation, QoS, traffic prioritization. PS networks try to combine the advantages of both PS and CS connections.&lt;/p&gt;&#xA;" OwnerUserId="5576" LastActivityDate="2014-05-07T20:13:54.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7789" PostTypeId="1" AcceptedAnswerId="7792" CreationDate="2014-05-08T00:15:11.270" Score="3" ViewCount="9383" Body="&lt;p&gt;I am trying to setup simple RDP rule from outside TEST_IPs to inside server 192.168.1.5 LLDHH-ADC. I configured nat and access list but I am not able to RDP to the server. I am new to ASA world and any help will be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is part of my config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network LLDHH-ADC&#xA; host 192.168.1.5&#xA;&#xA;object network LLDHH-ADC&#xA; nat (inside,outside) static interface service tcp 3389 3389&#xA;&#xA;nat (any,outside) after-auto source dynamic any interface&#xA;&#xA;access-list outside_access extended permit object RDP object-group TEST_IPs object LLDHH-ADC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On the server while trying to RDP I am getting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\Administrator&amp;gt;netstat -an | find &quot;:3389&quot;&#xA;  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING&#xA;&#xA;  TCP    192.168.1.5:3389       38.122.xx.xx:2763     ESTABLISHED&#xA;&#xA;  TCP    [::]:3389              [::]:0                 LISTENING&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the ASA I am getting the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6    May 07 2014    19:56:52    302013    38.122.xx.xx    2763    192.168.1.5 3389 &#xA;  Built inbound TCP connection 8341440 for outside:38.122.xx.xx/2763 &#xA;  (38.122.xx.xx/2763) to inside:192.168.1.5/3389 (50.204.xx.xx/3389)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and after RDP fails:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6    May 07 2014    19:57:52    302014    38.122.xx.xx    2763    192.168.1.5 3389&#xA;  Teardown TCP connection 8341440 for outside:38.122.xx.xx/2763 to &#xA;  inside:192.168.1.5/3389 duration 0:01:00 bytes 19 TCP Reset-I&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4608" LastEditorUserId="775" LastEditDate="2014-05-08T00:26:31.567" LastActivityDate="2014-05-08T05:24:33.710" Title="TCP Reset-I on Cisco ASA 5512x version 9.1" Tags="|cisco-asa|firewall|troubleshooting|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7790" PostTypeId="1" AcceptedAnswerId="7813" CreationDate="2014-05-08T02:27:33.917" Score="2" ViewCount="312" Body="&lt;p&gt;I inherited a Cisco Catalyst with the below modules.  I am trying to find out if I have the latest firmware for the various modules.  Cisco's site is not being help full as the sup2 is eol.  If any one knows of a site that lists that info or knows off the top of their head I would appriciate it. the rp is close enough but the sp doesnt have any image in it and i have no idea if 7.1 is the latest base rommon. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;supervisor 2 (Active)    WS-X6K-SUP2-2GE Fw 7.1 Sw 12.2(18)SXF1 / WS-F6K-PFC2  Hw3.2 /WS-F6K-MSFC2 Hw2.5 /&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MSFC2 is running c6msfc2-rm2.srec.122-17r.S1 (s5 I believe is latest.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;rtr2#show rom-monitor slot 1 sp&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Region F1: INVALID&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Region F2: INVALID&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently running ROMMON from S (Gold) region&lt;/p&gt;&#xA;" OwnerUserId="4646" LastActivityDate="2014-05-08T22:27:59.683" Title="Inherited Cisco Catalyst 6509 Supervisor 2 engine" Tags="|cisco-catalyst|cisco-6500|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7792" PostTypeId="2" ParentId="7789" CreationDate="2014-05-08T05:24:33.710" Score="3" Body="&lt;p&gt;If you only have a single subnet behind the firewall, I would try something like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network inside-net&#xA;subnet 192.168.1.0 255.255.255.0&#xA;nat(inside,outside) dynamic interface dns&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You would then be able to remove this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (any,outside) after-auto source dynamic any interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I prefer to be explicit with the PAT rule.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of this ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_access extended permit object RDP object-group TEST_IPs object LLDHH-ADC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_access extended permit tcp object-group TEST_IPs object LLDHH-ADC eq 3389&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This NAT rule looks good.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network LLDHH-ADC&#xA; nat (inside,outside) static interface service tcp 3389 3389&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2231" LastActivityDate="2014-05-08T05:24:33.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7793" PostTypeId="1" CreationDate="2014-05-08T06:01:56.153" Score="1" ViewCount="2837" Body="&lt;p&gt;Our office seems to have started experiencing an issue where every 2-3 days our AIR-SAP2602 reboots then returns to normal function within ~2mins. I've checked the power source, made sure it's all stable, and all seems OK. Issue being once it reboots we lose the logs of course so I'm not able to see any errors it has thrown before the issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently attempting to set up SNMP (probably should have it already) to see if I can catch some messages before it reboots but I'm concerned that it might never send the messages since the period between it becoming unresponsive and rebooting is seemingly nonexistent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've followed through &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/2600-series-multiservice-platforms/16138-hwts-2600-16138.html#reboot&quot; rel=&quot;nofollow&quot;&gt;Hardware Troubleshooting for the Cisco 2600 series&lt;/a&gt; but haven't been able to find anything. &lt;code&gt;show version&lt;/code&gt; states system returned to ROM by power-on so no hints there, and there doesn't seem to be any bus errors either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone seen this before and might know what to look for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Set syslog trap to 5 and then waited until it rebooted, nothing came through on the syslog server but then ran &lt;strong&gt;sh logging&lt;/strong&gt; as soon as it brought the interfaces back up and got the below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Log Buffer (1048576 bytes):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;*Mar  1 00:00:09.975: %IFMGR-7-NO_IFINDEX_FILE: Unable to open nvram:/ifIndex-table No such file or directory&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 00:00:10.059: %SOAP_FIPS-2-SELF_TEST_IOS_SUCCESS: IOS crypto FIPS self test passed&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 00:00:17.127: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 0&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 00:00:23.383: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 1&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 00:00:25.535: %LINK-6-UPDOWN: Interface GigabitEthernet0, changed state to up&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:25: %SYS-6-CLOCKUPDATE: System clock has been updated from 00:00:25 UTC Mon Mar 1 1993 to 11:00:25 +1100 Mon Mar 1 1993, configured from console by console.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:25: %SYS-5-CONFIG_I: Configured from memory by console&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 00:00:25.815: Starting Ethernet promiscuous mode&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:25: %SYS-5-RESTART: System restarted --&#xA;  Cisco IOS Software, C3600 Software (AP3G2-K9W7-M), Version 15.2(2)JA, RELEASE SOFTWARE (fc1)&#xA;  Technical Support: &lt;a href=&quot;http://www.cisco.com/techsupport&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/techsupport&lt;/a&gt;&#xA;  Copyright (c) 1986-2012 by Cisco Systems, Inc.&#xA;  Compiled Thu 23-Aug-12 02:59 by prod_rel_team&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:25: %SNMP-5-COLDSTART: SNMP agent on host AP1 is undergoing a cold start&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:25: %CDP_PD-4-POWER_OK: Full power - HIGH_POWER inline power source&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:25: %SYS-6-LOGGINGHOST_STARTSTOP: Logging to host 192.168.0.48 port 514 started - CLI initiated&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:25: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:25: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:26: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to down&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:26: %LINEPROTO-5-UPDOWN: Line protocol on Interface Loopback0, changed state to up&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:26: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:26: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:26: %DOT11-6-FREQ_SCAN: Interface Dot11Radio0, Scanning frequencies for 16 seconds&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:27: %LINK-6-UPDOWN: Interface BVI1, changed state to down&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:27: %DOT11-4-NO_HT: Interface Dot11Radio1, Mcs rates disabled on vlan 20 due to not using AES encryption or encryption is not disabled&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:28: %SOAP_FIPS-2-SELF_TEST_HW_SUCCESS: HW crypto FIPS self test passed&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 00:00:28.815: DPAA Initialization Complete&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:28: %SYS-3-HARIKARI: Process DPAA INIT top-level routine exited&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*Mar  1 11:00:29: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4258" LastEditorUserId="4258" LastEditDate="2014-05-09T02:02:52.237" LastActivityDate="2014-12-02T14:04:15.737" Title="Cisco AIR-SAP2600 series AP random reboot" Tags="|cisco|troubleshooting|aironet|cisco-wireless|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="7794" PostTypeId="2" ParentId="7785" CreationDate="2014-05-08T06:08:18.590" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I change that simply by typing the following in conf t:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In your example, issuing &lt;code&gt;crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3&lt;/code&gt; will append &lt;code&gt;0.9.8.7 6.5.4.3&lt;/code&gt; to your existing peer list for &lt;code&gt;Outside_map&lt;/code&gt;'s sequence number 10. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/A-H/cmdref1/c6.html#pgfId-2478203&quot;&gt;The peer list can hold up to ten addresses&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA3(config)# show run crypto | i peer&#xA;crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8 &#xA;&#xA;ASA3(config)# crypto map Outside_map 10 set peer 0.9.8.7 6.5.4.3&#xA;ASA3(config)# show run crypto | i peer&#xA;crypto map Outside_map 10 set peer 1.2.3.4 5.6.7.8 0.9.8.7 6.5.4.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll need to negate the entries for &lt;code&gt;1.2.3.4 5.6.7.8&lt;/code&gt; if you intend to simply swap the two for two.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;..do additional steps need to be taken beforehand? What about&#xA;  afterwards?...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ensuring the new VPN peer(s) have compatible IKE phase I and phase II configurations, reflexive ACLs, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/configuration/guide/config/vpngrp.html#wp1113843&quot;&gt;tunnel-group configuration&lt;/a&gt; for the new peer addresses and a roll-back plan may help with making this change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/configuration/guide/config/site2sit.html#wp1055829&quot;&gt;ASA 8.3 L2L VPN Configuration Reference&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example Output:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following example shows changing an ASA's remote peer IP address from 2.2.2.2 to 4.4.4.4.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa1(config)# show run crypto &#xA;crypto map Outside_map 1 set peer 2.2.2.2&#xA;&#xA;asa1(config)# tunnel-group 4.4.4.4 type ipsec-l2l&#xA;asa1(config)# tunnel-group 4.4.4.4 general-attributes&#xA;asa1(config-tunnel-general)# tunnel-group 4.4.4.4 ipsec-attributes&#xA;asa1(config-tunnel-ipsec)#  ikev1 pre-shared-key C1sc0123&#xA;&#xA;asa1(config)# show crypto isa sa&#xA;&#xA;1   IKE Peer: 2.2.2.2&#xA;    Type    : L2L             Role    : initiator &#xA;    Rekey   : no              State   : MM_ACTIVE &#xA;&#xA;asa1(config)# show crypto ipsec sa&#xA;interface: outside&#xA;Crypto map tag: Outside_map, seq num: 1, local addr: 3.3.3.3&#xA;&#xA;  access-list VPN_ALLOWED_ACCESS extended permit ip 1.1.1.0 255.255.255.0 1.1.2.0 255.255.255.0 &#xA;  local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)&#xA;  remote ident (addr/mask/prot/port): (1.1.2.0/255.255.255.0/0/0)&#xA;  current_peer: 2.2.2.2&#xA;&#xA;  #pkts encaps: 60, #pkts encrypt: 60, #pkts digest: 60&#xA;  #pkts decaps: 60, #pkts decrypt: 60, #pkts verify: 60 &#xA;&#xA;&#xA;asa1(config)# no crypto map Outside_map 1 set peer 2.2.2.2 &#xA;WARNING: The crypto map entry will be incomplete!&#xA;asa1(config)# crypto map Outside_map 1 set peer 4.4.4.4 &#xA;asa1(config)# show run crypto | include peer&#xA;crypto map Outside_map 1 set peer 4.4.4.4 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After making the change a new SA should be built to the new peer address(es).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#ping vrf ASA4 10.10.10.2 rep 50 &#xA;&#xA;Type escape sequence to abort.&#xA;Sending 50, 100-byte ICMP Echos to 1.1.2.2, timeout is 2 seconds:&#xA;!!!!!!!!!!!!!!!!!!!!..!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;Success rate is 96 percent (48/50), round-trip min/avg/max = 96/109/200 ms&#xA;&#xA;asa1(config)# show crypto isa sa&#xA;&#xA;1   IKE Peer: 4.4.4.4&#xA;    Type    : L2L             Role    : initiator &#xA;    Rekey   : no              State   : MM_ACTIVE &#xA;&#xA;&#xA;asa1(config)# show crypto ipsec sa&#xA;interface: outside&#xA;    Crypto map tag: Outside_map, seq num: 1, local addr: 3.3.3.3&#xA;&#xA;    access-list VPN_ALLOWED_ACCESS extended permit ip 1.1.1.0 255.255.255.0 1.1.2.0 255.255.255.0 &#xA;    local ident (addr/mask/prot/port): (1.1.1.0/255.255.255.0/0/0)&#xA;    remote ident (addr/mask/prot/port): (1.1.2.0/255.255.255.0/0/0)&#xA;    current_peer: 4.4.4.4&#xA;&#xA;    #pkts encaps: 172, #pkts encrypt: 172, #pkts digest: 172&#xA;    #pkts decaps: 172, #pkts decrypt: 172, #pkts verify: 172&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2476" LastActivityDate="2014-05-08T06:08:18.590" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7795" PostTypeId="1" AcceptedAnswerId="7797" CreationDate="2014-05-08T06:08:56.567" Score="2" ViewCount="813" Body="&lt;p&gt;&lt;em&gt;This question is a literal repost of the same &lt;a href=&quot;https://learningnetwork.cisco.com/thread/48830&quot; rel=&quot;nofollow&quot;&gt;question&lt;/a&gt; asked on &lt;a href=&quot;https://learningnetwork.cisco.com/thread/48830&quot; rel=&quot;nofollow&quot;&gt;The Cisco Learning Network&lt;/a&gt;.  Answers are unique to Stack Exchange.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;hr&gt;&#xA;Why does VTP pruning require the switch to be in server mode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to understand why a client switch can't run vtp pruning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;any insight would be helpful..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="33" LastEditDate="2014-06-23T18:45:06.040" LastActivityDate="2014-06-23T18:45:06.040" Title="VTP Pruning in Server Mode?" Tags="|switch|vlan|vtp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7796" PostTypeId="2" ParentId="7795" CreationDate="2014-05-08T06:53:58.307" Score="6" Body="&lt;p&gt;&lt;code&gt;VTP pruning&lt;/code&gt; is enabled on the server because the server decides if pruning is used in the domain or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For pruning to be effective it needs to be enabled in the entire domain. If a client was to enable pruning then it would only have effect locally. This would not have any positive effect in the domain except for the device that you had configured it on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the point of using VTP is to have a single/few points of administration where you send the VLANs. Enabling pruning on all devices individually would go against the idea of VTP.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-05-08T06:53:58.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7797" PostTypeId="2" ParentId="7795" CreationDate="2014-05-08T07:18:29.013" Score="7" Body="&lt;p&gt;That’s because VTP functions on a client/server model, not a distributed model.  The server effectively controls everything that happens inside the VTP domain. When a switches directly connected port/downstream port, it sends a VTP Join message indicating participation in that VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted something similar to a distributed model that supports VLAN pruning across links, you would be looking at something similar to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4000/8-2glx/configuration/guide/confg/gvrp.html&quot; rel=&quot;noreferrer&quot;&gt;GVRP&lt;/a&gt;, which is pretty difficult to come by in the Cisco world these days (aside from CatOS). I would assume this is because they’re trying to push VTP a lot harder.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I am trying to understand why a client switch can't run vtp pruning.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that every switch running VTP (client or server) will prune if told to do so.  This is not default behaviour, VTP comes disabled.  Otherwise, scenarios like below would not function as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/lmKcN.gif&quot; alt=&quot;Cisco VTP Pruning Scenario&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;Switch 4&lt;/code&gt; was the only device pruning, all other downstream switches would be needlessly spammed when expected not to.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-05-08T07:28:41.943" LastActivityDate="2014-05-08T07:28:41.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7801" PostTypeId="1" CreationDate="2014-05-08T13:54:12.510" Score="2" ViewCount="526" Body="&lt;p&gt;As said that SIP can locate the user IP with the user's SIP address, then why we need STUN or TURN?&lt;/p&gt;&#xA;" OwnerUserId="5567" LastActivityDate="2015-09-01T10:07:52.673" Title="If SIP(Session Initiation protocol) can get the user IP then why need STUN or TURN?" Tags="|sip|" AnswerCount="2" CommentCount="1" ClosedDate="2018-03-17T01:15:15.250" ContentLicense="CC BY-SA 3.0" />
  <row Id="7802" PostTypeId="2" ParentId="7776" CreationDate="2014-05-08T14:08:44.280" Score="2" Body="&lt;p&gt;syntethic task ;-)&lt;/p&gt;&#xA;&lt;p&gt;STUN can be used only with &amp;quot;full cone NAT, restricted cone NAT, and port restricted cone NAT&amp;quot;… but not with symmetric NAT. STUN is the protocol for clients, but clients, as usually, in real world are using symmetric NAT(unique port for any connection, dynamic translation)! In the real world servers are using full-cone NAT(static translation), and servers, as usually, gets connections from clients, which are already know ip:port…&lt;/p&gt;&#xA;&lt;p&gt;However, formal answer: most &amp;quot;frequent&amp;quot; using of STUN it is &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-sip-outbound-20#section-3.5.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;sip client to server keepalive(udp)&lt;/a&gt;, but there are also other usages:&#xA;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5389#section-14&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc5389#section-14&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;14.  STUN Usages&#xA;   At the time of writing, three STUN usages are defined: Interactive&#xA;   Connectivity Establishment (ICE) [MMUSIC-ICE], Client-initiated&#xA;   connections for SIP [SIP-OUTBOUND], and NAT Behavior Discovery&#xA;   [BEHAVE-NAT].  Other STUN usages may be defined in the future.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2014-05-08T14:08:44.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7803" PostTypeId="2" ParentId="7781" CreationDate="2014-05-08T14:18:37.027" Score="6" Body="&lt;p&gt;Because STUN(external server), cant know which port will be given to the client by NAT-device. In symmetric NAT, client gets unique port(ip:port in pool situation) on each connection&lt;/p&gt;&#xA;" OwnerUserId="3478" LastActivityDate="2014-05-08T14:18:37.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7804" PostTypeId="2" ParentId="7781" CreationDate="2014-05-08T14:36:13.013" Score="21" Body="&lt;p&gt;Let's say we have a STUN server at address &lt;code&gt;stun_addr&lt;/code&gt; and a server at address &lt;code&gt;srv_addr&lt;/code&gt;. Using STUN typically goes something like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Client connects to the STUN server at &lt;code&gt;stun_addr&lt;/code&gt; through NAT device. The NAT device translates the source address to &lt;code&gt;natted_addr_1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;STUN server tells client the address from which it received the connection, which is &lt;code&gt;natted_addr_1&lt;/code&gt; &lt;/li&gt;&#xA;&lt;li&gt;Client contacts the server at &lt;code&gt;srv_addr&lt;/code&gt; through the NAT device, and tells the external system to use &lt;code&gt;natted_addr_1&lt;/code&gt; if it wants to reach the client&lt;/li&gt;&#xA;&lt;li&gt;External system sends something to the client using &lt;code&gt;natted_addr_1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This will only work if the NAT device uses &lt;code&gt;natted_addr_1&lt;/code&gt; for both the communication to the STUN server and the other external system. More specifically, it only works if the NAT device will deliver the packets which arrive in step 4 to the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A symmetrical NAT device will use a different translation in steps 1 and 3 because the destination address of the traffic is different. In step 3, the source address in the packets to the server is translated to some other address &lt;code&gt;natted_addr_2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NAT device only knows about these combinations of source and destination addresses and will only allow these back in:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;From &lt;code&gt;stun_addr&lt;/code&gt; to &lt;code&gt;natted_addr_1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;From &lt;code&gt;srv_addr&lt;/code&gt; to &lt;code&gt;natted_addr_2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the server has been told to use &lt;code&gt;natted_addr_1&lt;/code&gt; but packets from &lt;code&gt;srv_addr&lt;/code&gt; destined to &lt;code&gt;natted_addr_1&lt;/code&gt; will be rejected by the NAT device because of the NAT Address:Port restriction in-place. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be more correct, 'address' should be replaced by 'address/port' in this answer, because NAT devices will work with the combination of IP address and port numbers.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="13726" LastEditDate="2015-02-10T12:41:35.803" LastActivityDate="2015-02-10T12:41:35.803" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7805" PostTypeId="1" AcceptedAnswerId="7806" CreationDate="2014-05-08T16:13:47.730" Score="2" ViewCount="181" Body="&lt;p&gt;We are setting up a new network at work, when the building was comprised mostly of desktops, life was simple -static IPs for everyone. As the company moved to wireless laptops, they began keeping a DHCP reservation list. For a few dozen laptops this solution, while bulky, was effective. But as we move from a few dozen to a few hundred, this solution becomes even more difficult to manage. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My boss's concern is that he wants &lt;strong&gt;only&lt;/strong&gt; company owned devices authenticated on the internal network, and all the rest to use the 'guest' network (including tablets, mobiles, etc).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the best practice for maintaining this type of constraint?&lt;/p&gt;&#xA;" OwnerUserId="5586" LastEditorUserId="3191" LastEditDate="2014-05-08T16:40:44.557" LastActivityDate="2014-05-08T16:50:25.223" Title="Best Authentication Practice" Tags="|wireless|security|dhcp|best-practices|authentication|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7806" PostTypeId="2" ParentId="7805" CreationDate="2014-05-08T16:47:21.207" Score="3" Body="&lt;p&gt;First of all I don't think that static MAC-IP bindings have anything to do with security. MAC addresses can be easily faked and guessing a valid but unused IP for your network and manually assigning that to an interface is not rocket science. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are looking for is most probably 802.1x. With 802.1x each client gets a certificate and only those clients with valid certificates are allowed on your network. Other will simply have no access or will be moved to special guest network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.1x requires client support (some printers, embedded system, ... might not support it.), a RADIUS Server, network equipment that supports it and a Certificate Authority (CA). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your needs and hardware you can even &quot;download&quot; access-list to your network equipment and restrict clients even further. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One big warning: Implementing 802.1x is a lot of work, administration and is quite time consuming. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another solution I've seen is to use no authentication / encryption on your wireless network and then use IPSEC VPNs. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="3191" LastEditDate="2014-05-08T16:50:25.223" LastActivityDate="2014-05-08T16:50:25.223" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7808" PostTypeId="2" ParentId="7300" CreationDate="2014-05-08T17:56:51.647" Score="3" Body="&lt;p&gt;So I found my solution.&#xA;It has to do with the NAT statements.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;I am using this in the above example:&#xA;ip nat inside source route-map NAT interface GigabitEthernet0/1 overload&#xA;ip nat inside source list NAT interface GigabitEthernet0/2 overload&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To resolve the problem, I set this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;ip nat inside source route-map Gi02 interface GigabitEthernet0/1 overload&#xA;ip nat inside source route-map Gi02 interface GigabitEthernet0/2 overload&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with these NAT ACL's:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;ip access-list extended Gi01_NAT&#xA; deny ip any 10.4.x.0 0.0.0.255&#xA; permit ip any any&#xA;ip access-list extended Gi02_NAT&#xA; permit ip any any&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once I set those NAT statements properly it worked. Apparently the device didn't like me mixing the route-map NAT with the source list NAT statements- although I could find no documentation saying that I cant mix these.&lt;/p&gt;&#xA;" OwnerUserId="5187" LastActivityDate="2014-05-08T17:56:51.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7809" PostTypeId="1" AcceptedAnswerId="23992" CreationDate="2014-05-08T20:21:26.770" Score="1" ViewCount="5591" Body="&lt;p&gt;I was wondering what the preferred method is for 'butt'splicing together two pieces of &amp;lt;100m UTP cable - or if that is discouraged in general.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relaying the cable is not possible, but it does need to be redirected from a certain point on. I know that for other cables IDC gel crimps are useful, but they usually only seem to exist for up to four wires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can crimp some 8P8C ends on both sides and use a two-way block connector, but that hardly seems ideal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks so much in advance.&lt;/p&gt;&#xA;" OwnerUserId="5589" LastEditorUserId="8499" LastEditDate="2016-10-01T04:16:54.660" LastActivityDate="2016-11-30T14:43:05.067" Title="Preferred method splicing together UTP cable" Tags="|cabling|cable|layer1|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7810" PostTypeId="1" AcceptedAnswerId="7915" CreationDate="2014-05-08T20:43:26.760" Score="7" ViewCount="3788" Body="&lt;p&gt;I'm trying to back up a Cisco ISE server (version 1.2.0.899 patch 4) via sftp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configuered a repo via the web gui. I added the hostkey (for the backup server) via the command line. I make sure the path exsites on the backup server. I then start a backup via the web gui using the repo that I just set up. The back up jumps to %20, %45, %60, and then %100. I then see the status saying the backup was a success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that no backup actually happens. I don't see the files in the web gui under &quot;History for Repository&quot;. I also don't see the backups on the backup server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Via the ISE console I use the command &lt;code&gt;sh repository &quot;rep name&quot;&lt;/code&gt; I just get a message saying that it's empty. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I run the command &lt;code&gt;show backup status&lt;/code&gt; I get the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%% Configuration backup status&#xA;%% ----------------------------&#xA;%      backup name: test5&#xA;%       repository: test&#xA;%       start date: Thu May 08 &#xA;%        scheduled: no&#xA;%   triggered from: Admin web UI&#xA;%             host: ISESERVER.xxx.yyy&#xA;%           status: backup test5-CFG-140508-1317.tar.gpg to repository test: success&#xA;&#xA;%% Operation backup status&#xA;%% ------------------------&#xA;%  No data found. Try 'show backup history' or ISE operation audit report&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the back up server I'm not seeing a connection from the ISE server even attempted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how to move forward with this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked the backup servers SSH logs and it looks like the ISE service account is able to login but then the session is immediately closed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;May 12 10:51:18 BACKUPSERVER sshd[5190]: Accepted password for SERVICE_ACCOUNT from 1.1.1.1 port 47558 ssh2&#xA;May 12 10:51:18 BACKUPSERVER sshd[5190]: pam_unix(sshd:session): session opened for user SERVICE_ACCOUNT by (uid=0)&#xA;May 12 10:51:18 BACKUPSERVER sshd[5190]: pam_unix(sshd:session): session closed for user SERVICE_ACCOUNT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="108" LastEditorUserId="108" LastEditDate="2014-05-12T18:14:55.757" LastActivityDate="2014-05-15T22:41:57.300" Title="Cisco ISE backup shows as success but no data was written to backup server" Tags="|cisco|troubleshooting|backups|cisco-ise|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7811" PostTypeId="2" ParentId="7809" CreationDate="2014-05-08T20:46:52.027" Score="1" Body="&lt;p&gt;Generally discouraged for ethernet, but not unheard of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd use the usual telco gel blocks (eg. &lt;a href=&quot;http://www.cableorganizer.com/platinum-tools/telcom-splicing-connectors-and-tool.html&quot; rel=&quot;nofollow&quot;&gt;Platinum Tools Telcom Gel-filled Splicing Connectors&lt;/a&gt;) or the &quot;dolphin&quot; crimps (&lt;a href=&quot;http://cablesupply.com/b-connectors/249-dolphin-b-connectors-with-sealant.html&quot; rel=&quot;nofollow&quot;&gt;Dolphin B Connectors with Sealant&lt;/a&gt;) If it's somewhere that a 66-block could be placed, that would also be doable.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-05-08T22:16:20.530" LastActivityDate="2014-05-08T22:16:20.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7812" PostTypeId="2" ParentId="493" CreationDate="2014-05-08T22:10:18.233" Score="0" Body="&lt;p&gt;From physical point of view the dispersion is one of the main reasons for lower speed for multimode fibers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At longer distances dispersion makes the optical pulses broader, more blurred, noisy, not clear, distinguishable. And dispersion is higher for multimode fibers compared to single mode fibers. There are &lt;a href=&quot;http://www.invocom.et.put.poznan.pl/~invocom/C/P1-9/swiatlowody_en/p1-1_3_4.htm&quot; rel=&quot;nofollow&quot;&gt;different kind of dispersion&lt;/a&gt;. Single mode fibers also have dispersion but much lower.&lt;/p&gt;&#xA;" OwnerUserId="5576" LastActivityDate="2014-05-08T22:10:18.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7813" PostTypeId="2" ParentId="7790" CreationDate="2014-05-08T22:27:59.683" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://software.cisco.com/download/type.html?mdfid=280829673&amp;amp;flowid=20128&quot; rel=&quot;nofollow&quot;&gt;Cisco Catalyst 6500 Series Supervisor Engine 2 / MSFC2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Latest CatOS ROMMON: 7.1.1&lt;br&gt;&#xA;Latest IOS ROMMON: 12.2.17r(S5)&lt;br&gt;&#xA;Latest IOS: 12.2.18-SXF17b&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All require a valid smartnet contract to access. (even for EOL crap.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-05-08T22:27:59.683" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7814" PostTypeId="2" ParentId="7809" CreationDate="2014-05-09T03:22:53.360" Score="2" Body="&lt;p&gt;Whenever I need to cross-connect cables I tend to use a 110 block whenever possible. However, If you have no plans to patch more cables in that location you can use a &lt;a href=&quot;http://www.sfcable.com/1020-SF-07.html&quot; rel=&quot;nofollow&quot;&gt;CAT6 Junction Box&lt;/a&gt;. I have used this particular product and I can personally recommend it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I prefer the use of Solid UTP over Stranded (mainly a preference from the old days installing T1's), it's just easier to work with. With that said Stranded will work just fine with more modern 110 style punch down gear such as the product I recommended.&lt;/p&gt;&#xA;" OwnerUserId="4337" LastActivityDate="2014-05-09T03:22:53.360" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7817" PostTypeId="2" ParentId="792" CreationDate="2014-05-09T06:42:56.193" Score="0" Body="&lt;ul&gt;&#xA;&lt;li&gt;HSRP was created by Cisco in 1994 for Cisco only, but VRRP is open source.&lt;/li&gt;&#xA;&lt;li&gt;HSRP default hello timer is 3 sec and hold timer is 10 sec. VRRP default hello timer is 1 sec. and hold timer is 3 sec.&lt;/li&gt;&#xA;&lt;li&gt;Both are used to maintain redundancy &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="5594" LastEditorUserId="3191" LastEditDate="2014-05-09T07:13:02.010" LastActivityDate="2014-05-09T07:13:02.010" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7821" PostTypeId="1" AcceptedAnswerId="7823" CreationDate="2014-05-09T10:52:31.470" Score="5" ViewCount="5839" Body="&lt;p&gt;We have two Cisco ISE servers (ISE-3355-K9) running 1.2.  When we ordered these from our reseller, the reseller's engineer (who was a wireless CCIE) insisted that we only needed one copy of the &lt;code&gt;L-ISE-BSE-500&lt;/code&gt; license for both servers, since they would be a redundant pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the mean time, that engineer left the reseller, and nobody there understands what he was thinking; however, we spent our entire budget on this order.  We don't have extra money to purchase more licenses, but we could have asked for more money if we needed it for the order.  The budget cycle is over for this project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand how to build these servers as a redundant pair and only one license.  Can someone explain how this works?&lt;/p&gt;&#xA;" OwnerUserId="5598" LastActivityDate="2014-05-11T18:51:38.417" Title="Licensing for two Cisco ISE servers" Tags="|cisco|cisco-ise|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7823" PostTypeId="2" ParentId="7821" CreationDate="2014-05-09T12:56:47.933" Score="6" Body="&lt;p&gt;One license is all you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume since you have the licensing, you also ought to have TAC support along with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, the docs on Cisco.com will really help in pointing you in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a good place to start: &lt;a href=&quot;http://www.cisco.com/en/US/docs/security/ise/1.0/user_guide/ise10_dis_deploy.html#wp1128454&quot; rel=&quot;nofollow&quot;&gt;ISE HA Docs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here's another helpful link: &lt;a href=&quot;https://supportforums.cisco.com/discussion/12112441/cisco-ise-generate-license-high-availability-primarysecondary-nodes&quot; rel=&quot;nofollow&quot;&gt;support forums question&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5601" LastEditorUserId="775" LastEditDate="2014-05-11T06:14:48.520" LastActivityDate="2014-05-11T06:14:48.520" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7824" PostTypeId="2" ParentId="7821" CreationDate="2014-05-09T12:57:17.007" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Cisco ISE licenses are specific to a deployment and not to individual&#xA;  appliances in the deployment.&quot;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;-From the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/security/identity-services-engine/guide_c07-656177.html&quot; rel=&quot;nofollow&quot;&gt;Cisco ISE Ordering Guide&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For example, if you had five Cisco ISE nodes in a distributed deployment between two datacenters, one license would need to be applied to the primary admin node and all registered devices will operate under that license.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had two standalone Cisco ISE nodes that were deployed completely separate from each other, each primary/standalone node would require a license before the 90-day Evaluation license expires.&lt;/p&gt;&#xA;" OwnerUserId="2476" LastEditorUserId="2476" LastEditDate="2014-05-11T18:51:38.417" LastActivityDate="2014-05-11T18:51:38.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7826" PostTypeId="1" CreationDate="2014-05-09T19:52:30.270" Score="4" ViewCount="6655" Body="&lt;p&gt;I’ve been searching on this issue and can’t seem to find info about it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’ve inherited an older ASA5510 (8.2(1)) and unfortunately I’m pretty new to them.  I have a set of overloaded NAT statements that will stop working seemingly at random.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 extended permit tcp x.x.x.88 255.255.255.248 host x.x.x.121 eq 3389&#xA;access-list 101 extended permit tcp x.x.x.88 255.255.255.248 host x.x.x.121 eq www&#xA;access-list 101 extended permit tcp x.x.x.88 255.255.255.248 host x.x.x.121 eq https&#xA;access-list 101 extended permit tcp any host x.x.x.121 eq 222&#xA;static (inside,outside) tcp x.x.x.121 www 10.15.60.43 www netmask 255.255.255.255&#xA;static (inside,outside) tcp x.x.x.121 https 10.15.60.43 https netmask 255.255.255.255&#xA;static (inside,outside) tcp x.x.x.121 3389 10.15.60.2 3389 netmask 255.255.255.255&#xA;static (inside,outside) tcp x.x.x.121 222 10.15.60.42 ssh netmask 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I &lt;code&gt;clear xlate&lt;/code&gt; it doesn’t come back. If I &lt;code&gt;show xlate&lt;/code&gt;  for  x.x.x.121 it shows them as still in there.  However, if I remove the portions of the config listed above and add just &lt;code&gt;static (inside,outside) x.x.x.121 10.15.60.2&lt;/code&gt; then &lt;code&gt;clear xlate&lt;/code&gt; then I’m able to connect to the server again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I then put the original config back in everything works fine  for a day or two. Any thoughts or diagnostic commands that I should be running would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Per Ricky Beam's suggestion I checked the number of users in &lt;code&gt;sh ver&lt;/code&gt;. &lt;code&gt;Maximum Physical Interfaces&lt;/code&gt; set to Unlimited. &lt;code&gt;Inside Hosts&lt;/code&gt; also set to Unlimited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show local-host | inc host limit&lt;/code&gt; returns no results. I'm guessing since hosts are Unlimited.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I came in this morning and it was not allowing connections to that IP again. I did a &lt;code&gt;show conn count&lt;/code&gt; while it wasn't allowing connections and it shows 298 in use, 782 most used. I did a &lt;code&gt;clear xlate&lt;/code&gt; then a &lt;code&gt;clear conn all&lt;/code&gt; and it didn't start allowing connections. However, removing the &lt;code&gt;static (inside,outside)&lt;/code&gt; statements and adding &lt;code&gt;static (inside,outside) x.x.x.121 10.15.60.2&lt;/code&gt; brought the connection up right away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We did add a new building about 1 week before this started happening but has far as I can tell the asa is not actually running out of connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does show Built dynamic UDP translation and Built outbound UDP connection in the log while it was not working though. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Was down again. Verified that the other devices that are overloaded on that IP are down as well. I can ping 10.15.60.2 using the &lt;code&gt;ping 10.15.60.2&lt;/code&gt; command but I can't while sourced from the outside.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa# ping  &#xA;Interface: outside  &#xA;Target IP address: 10.15.60.2  &#xA;Extended commands [n]:  &#xA;Sweep range of sizes [n]:  &#xA;Type escape sequence to abort.  &#xA;Sending 5, 100-byte ICMP Echos to 10.15.60.2, timeout is 2 seconds:  &#xA;?????  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ran the following show commands while it wasn't working.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa# sh conn | include x.x.x.121  &#xA;asa# sh xlate | include x.x.x.121  &#xA;PAT Global x.x.x.121(80) Local 10.15.60.43(80)  &#xA;PAT Global x.x.x.121(443) Local 10.15.60.43(443)  &#xA;PAT Global x.x.x.121(3389) Local 10.15.60.2(3389)  &#xA;PAT Global x.x.x.121(222) Local 10.15.60.42(22)  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ASA is now logging to a syslog server at informational level. Hopefully that will show what is going on.&lt;/p&gt;&#xA;" OwnerUserId="5604" LastEditorUserId="3191" LastEditDate="2014-05-13T16:31:52.310" LastActivityDate="2014-05-13T16:31:52.310" Title="ASA 5510 NAT stops working" Tags="|cisco-asa|nat|troubleshooting|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="7830" PostTypeId="2" ParentId="792" CreationDate="2014-05-09T21:34:50.967" Score="10" Body="&lt;p&gt;&lt;strong&gt;HSRP&lt;/strong&gt;&lt;br&gt;&#xA;1) Cisco propriteray&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) 1 Active &amp;amp; 1 standby router &amp;amp; 1 or more listening routers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) use virtual ip add as gateway&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) hello 3 sec &amp;amp; holddown timer 10 sec&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5) we can enable preempt manually (standby 1 preempt)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6) multicast at:224.0.0.2 (ver1), multicast at:224.0.0.102 (ver2). Both versions use udp port 1985&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;VRRP&lt;/strong&gt;&lt;br&gt;&#xA;1) open standard (ietf)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) 1 master &amp;amp; 1 or more backup routers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) real ip address can be used (highest ip address of interface)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) 1 sec &amp;amp; hold-down timer 3 sec&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5) By default preempt is enabled&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6) multicast at:224.0.0.18 – IP 112&lt;/p&gt;&#xA;" OwnerUserId="5609" LastEditorUserId="619" LastEditDate="2014-05-09T21:59:54.387" LastActivityDate="2014-05-09T21:59:54.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7831" PostTypeId="2" ParentId="7826" CreationDate="2014-05-10T00:47:00.277" Score="2" Body="&lt;p&gt;Looking through the &quot;fixed&quot; bugs (&lt;a href=&quot;http://www.cisco.com/web/software/280775065/45357/ASA-825-Interim-Release-Notes.html&quot; rel=&quot;nofollow&quot;&gt;8.2.5 Interim Release Notes&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CSCti62667 Connections stay open w/ 'sysopt connection timewait' &amp;amp; NetFlow&#xA;CSCtl06156 NAT Xlate idle timer doesn't reset with Conn.&#xA;CSCtr94429 ASA: Local-host and all conns are torn down when client hits conn limit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You've confirmed the system is not &quot;Restricted(R)&quot; -- unlimited interfaces and users. That's the most common reason for the failure mode you've described. (It stops allowing new connections.) Threat-detection could also result in new connections being dropped.  Neither of these should cause traffic to stop for &lt;em&gt;existing&lt;/em&gt; xlates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;clear xlate&lt;/code&gt; needs a follow up &lt;code&gt;clear conn all&lt;/code&gt; to completely clear everything. If it's not clearing them, then there's something else wrong. (or they're being recreated instantly.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco &lt;a href=&quot;http://www.cisco.com/c/en/us/products/security/asa-5500-series-next-generation-firewalls/models-comparison.html&quot; rel=&quot;nofollow&quot;&gt;documents&lt;/a&gt; the 5510 as supporting up to 50k (130k for a secplus license) concurrent connections. I'd be very surprised if you've hit that wall. (&lt;code&gt;show conn count&lt;/code&gt; and look at the &quot;most used&quot;. &lt;code&gt;%ASA-5-321001&lt;/code&gt; would be logged if you did.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond that, if it's not logging any reason(s) for dropping/refusing connections, I'm at a loss where else to look.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-05-10T00:47:00.277" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7836" PostTypeId="1" AcceptedAnswerId="33840" CreationDate="2014-05-10T16:46:00.550" Score="5" ViewCount="672" Body="&lt;p&gt;I've been working for weeks to enable sending traps for FIB changes on our Cisco 2600 router. I finally found this command is responsible for that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server enable traps cef peer-fib-state-change&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it seemed Cisco 2600 does not accept the &lt;code&gt;cef&lt;/code&gt; command. After retrieving the whole trap options that can be enabled, we found the following list is all traps which are supported. We found none of them is actually directly enabling FIB changes, however some of them looked relevant, such as entity. Is there any ways to infer FIB changes on any of these options?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  atm          Enable SNMP atm traps&#xA;  bgp          Enable BGP state change traps&#xA;  bstun        Enable SNMP BSTUN traps&#xA;  cnpd         Enable NBAR Protocol Discovery traps&#xA;  config       Enable SNMP config traps&#xA;  config-copy  Enable SNMP config-copy traps&#xA;  dial         Enable SNMP dial control traps&#xA;  dlsw         Enable SNMP dlsw traps&#xA;  dnis         Enable SNMP DNIS traps&#xA;  dsp          Enable SNMP dsp traps&#xA;  entity       Enable SNMP entity traps&#xA;  envmon       Enable SNMP environmental monitor traps&#xA;  frame-relay  Enable SNMP frame-relay traps&#xA;  hsrp         Enable SNMP HSRP traps&#xA;  ipmobile     Enable SNMP ipmobile traps&#xA;  ipmulticast  Enable SNMP ipmulticast traps&#xA;  ipsec        Enable IPsec traps&#xA;  isakmp       Enable ISAKMP traps traps&#xA;  isdn         Enable SNMP isdn traps&#xA;  msdp         Enable SNMP MSDP traps&#xA;  pim          Enable SNMP PIM traps&#xA;  pppoe        Enable SNMP pppoe traps&#xA;  rsvp         Enable RSVP flow change traps&#xA;  rtr          Enable SNMP Response Time Reporter traps&#xA;  snmp         Enable SNMP traps&#xA;  stun         Enable SNMP STUN traps&#xA;  syslog       Enable SNMP syslog traps&#xA;  tty          Enable TCP connection traps&#xA;  voice        Enable SNMP voice traps&#xA;  vtp          Enable SNMP VTP traps&#xA;  xgcp         Enable XGCP protocol traps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5617" LastEditorUserId="3191" LastEditDate="2014-05-10T17:33:59.743" LastActivityDate="2016-08-08T14:00:27.813" Title="Enable traps on FIB (Forwarding Table) changes" Tags="|cisco|router|cisco-ios|snmp|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7839" PostTypeId="1" CreationDate="2014-05-10T18:21:24.613" Score="14" ViewCount="24931" Body="&lt;p&gt;This is a general question not related to specific hardware. If we have the following configuration of daisy chained switches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;internet ---- core network ----- switch 1 ----- switch 2 ----- switch 3 ----- switch 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do you think the users connected to &lt;em&gt;switch 4&lt;/em&gt; are going to have significant increase of latency  compared to users connected to &lt;em&gt;switch 1&lt;/em&gt;. In both cases the users access an application in the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do  you have any example for real case?&lt;/p&gt;&#xA;" OwnerUserId="5576" LastEditorUserId="105" LastEditDate="2014-05-10T18:38:10.320" LastActivityDate="2021-09-22T20:05:52.947" Title="Is daisy chaining switches increasing latency?" Tags="|switch|latency|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7840" PostTypeId="2" ParentId="7839" CreationDate="2014-05-10T18:45:10.210" Score="16" Body="&lt;p&gt;No, they won't for typical internet connectivity. You won't even be able to measure it using typical tools.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For DC environments, we're fighting for every microsecond, but for typical ethernet switches, you get from 5-7 microseconds to 30-50 microseconds per hop (switch).   Even 30-50 microseconds is too low to notice; typically latency is problematic for applications or humans as it reaches the tens/hundreds of milliseconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/nexus-5020-switch/white_paper_c11-465436.html&quot;&gt;at this Cisco whitepaper&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="775" LastEditDate="2014-05-13T06:29:00.993" LastActivityDate="2014-05-13T06:29:00.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7841" PostTypeId="2" ParentId="7839" CreationDate="2014-05-10T18:47:25.063" Score="8" Body="&lt;p&gt;The question mentions that this is not hardware specific, however different platforms have different switching latencies and switching modes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Cut through&lt;/code&gt; switching is the fastest but lets through fragments.&#xA;&lt;code&gt;Fragment free&lt;/code&gt; is the second fastest and makes sure that frames are at least 64 bytes meaning they are not runts which is one of the signs of collisions.&#xA;&lt;code&gt;Store and forward&lt;/code&gt; is the slowest but does not send frames onward that contain errors such as CRC errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your questions contains nothing on distances. If there is a significant distance between &lt;code&gt;switch 1&lt;/code&gt; and &lt;code&gt;switch 4&lt;/code&gt;that would have to be accounted for. If they are right next to each other, each switch should not add much latency since they generally forward frames immediately without them getting stuck in large buffers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Latency is subjective, for a high speed trading firm, 2ms could make a huge difference. For most of us 2ms is not enough to worry about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would not worry about latency in this case unless I had a very specific use case. &lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="33" LastEditDate="2014-05-13T19:43:22.210" LastActivityDate="2014-05-13T19:43:22.210" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7848" PostTypeId="1" CreationDate="2014-05-11T12:49:14.703" Score="1" ViewCount="1115" Body="&lt;p&gt;Please Help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Cisco Catalyst 4507R+E and UTM Firewall Fortigate and I Created VLANS on Catalyst and the main VLAN port Which Play IP Route between All VLANs can not connectet to the UTM Firewall unless create No Switch Port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the Difference between Switch port mode &amp;amp; No Switch Port .&lt;/p&gt;&#xA;" OwnerUserId="5624" LastEditorUserId="8499" LastEditDate="2018-03-21T01:05:43.187" LastActivityDate="2018-03-21T01:05:43.187" Title="Routing Between Cisco 4507R+E Layer 3 Switch &amp; UTM Firewall Fortigate" Tags="|routing|switch|firewall|layer3|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7849" PostTypeId="2" ParentId="7848" CreationDate="2014-05-11T12:52:35.913" Score="3" Body="&lt;p&gt;&lt;code&gt;switchport&lt;/code&gt; means the interface is in layer 2 mode, forwarding frames as a switch. &lt;code&gt;no switchport&lt;/code&gt; means the interface is in layer 3 mode, routing packets.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-05-11T12:52:35.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7850" PostTypeId="2" ParentId="7848" CreationDate="2014-05-11T13:09:31.217" Score="4" Body="&lt;p&gt;As said above switchport set the port to be layer 2, you assign a vlan to it and then need an SVI to configure L3 for ip connnectivity. If you do no switchport the port is layer 3 and you place an IP address directly on the port. I am guessing you want a static default route between the switch and the firewall. Dont forget you need routes in the firewall pointing back to the subnets you have configured in the switch&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2014-05-11T13:09:31.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7851" PostTypeId="1" AcceptedAnswerId="7868" CreationDate="2014-05-11T13:43:49.470" Score="6" ViewCount="3606" Body="&lt;p&gt;What is the difference between &lt;code&gt;tcp.len&lt;/code&gt; and &lt;code&gt;data.len&lt;/code&gt; filters? I thought that both mean data size traveling in the segment (not including &lt;code&gt;TCP header&lt;/code&gt;). I have a problem related to &lt;code&gt;MTU&lt;/code&gt; issue and I'm trying to figure if data size from application layer is greater than the &lt;code&gt;MSS&lt;/code&gt; announced by the server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The capture shows some TCP packets encapsulating 1434 Bytes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/uWykw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the TCP layer analysis displays the same TCP packets with &lt;code&gt;len = 1448&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jrnnx.png&quot; alt=&quot;enter image description here&quot;&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that this TCP segment is encapsulating 1448 Bytes. 1448B plus 32B of TCP header (some TCP options are enabled) plus 20B of IP Header = 1500 Bytes as it is displayed in the analysis of the IP layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have a question related to this one about &lt;code&gt;MSS clamping&lt;/code&gt;. LAN clients are connected to the router using &lt;code&gt;Ethernet&lt;/code&gt; with MTU = 1500 Bytes and router is connected to the Internet using &lt;code&gt;PPPoE&lt;/code&gt; with MTU = 1492 Bytes. The router is manipulating &lt;code&gt;MSS&lt;/code&gt; field in every TCP packet with &lt;code&gt;SYN flag&lt;/code&gt; enabled in both directions, this is known as &lt;code&gt;MSS clamping&lt;/code&gt;. This way LAN clients receive MSS = 1452 from servers on the Internet and the servers receive MSS = 1452 from the LAN clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what happens if server announces MSS &amp;lt; 1452? LAN clients will receive MSS = 1452 from the server so only &lt;code&gt;PMTUD&lt;/code&gt; can work here?  &lt;/p&gt;&#xA;" OwnerUserId="1600" LastEditorUserId="42290" LastEditDate="2017-12-13T10:58:10.963" LastActivityDate="2017-12-13T10:58:10.963" Title="Wireshark tcp.len and data.len missmatch" Tags="|tcp|wireshark|mtu|pcap|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7852" PostTypeId="1" CreationDate="2014-05-11T15:25:19.180" Score="3" ViewCount="5279" Body="&lt;p&gt;What is the maximum distance for blowing optical fiber cable  with compressed air through pipes? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The method known also as Cable jetting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking into consideration no lubricant is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am asking for the existence of a general rule or recommendation which is used by telecoms or if someone of you have personal experience in this field what is the distance for which there will be no problems with cable stuck in the middle of the pipe between two ducts. I am asking because I want to know at what distance will be placed the ducts.&lt;/p&gt;&#xA;" OwnerUserId="5576" LastEditorUserId="8499" LastEditDate="2018-12-21T04:34:42.903" LastActivityDate="2021-01-08T19:53:09.480" Title="What is the maximum distance for blowing optical cable through pipes?" Tags="|layer1|cable|fiber|cabling|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7853" PostTypeId="1" AcceptedAnswerId="7858" CreationDate="2014-05-11T15:54:45.633" Score="4" ViewCount="33417" Body="&lt;p&gt;I've been experimenting with the ping utility on Linux. I set a mtu of 500 bytes on my router. Now, when I ping to an external host, I get the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping -c 3 -s 1300 10.0.2.1        &#xA;PING 10.0.2.1 (10.0.2.1) 1300(1328) bytes of data. &#xA;From 10.0.1.254 icmp_seq=1 Frag needed and DF set (mtu = 500)&#xA;1308 bytes from 10.0.2.1: icmp_seq=2 ttl=62 time=1.12 ms &#xA;1308 bytes from 10.0.2.1: icmp_seq=3 ttl=62 time=1.14 ms&#xA;&#xA;--- 10.0.2.1 ping statistics --- 3 packets transmitted, 2 received, +1 errors, 33% packet loss, time 2000ms rtt min/avg/max/mdev = 1.123/1.134/1.146/0.035 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, the first message is discarded by the router, because the mtu of the interface was exceeded. That was expected, because the DF flag is set by default. Therefore, he can't fragment and the error occurs, so far so good. But what happened to the other two packets? Why did they get through? I can imagine that the ping tool, after getting the ICMP error, doesn't set the DF flag in further packets, so that they can be fragmented. Is that right? Where can I find the &quot;official&quot; explanation of this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SOLUTION: It is part of the PMTUD protocol.&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html#t4&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html#t4&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5625" LastEditorUserId="35913" LastEditDate="2018-10-19T23:44:20.100" LastActivityDate="2019-10-12T00:26:59.790" Title="linux ping mtu and fragmentation" Tags="|ping|linux|mtu|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7854" PostTypeId="5" CreationDate="2014-05-11T16:03:45.367" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-05-11T16:03:45.367" LastActivityDate="2014-05-11T16:03:45.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7855" PostTypeId="4" CreationDate="2014-05-11T16:03:45.367" Score="0" Body="For questions requiring troubleshooting assistance with persistent/unresolved problems." OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-05-11T18:46:00.310" LastActivityDate="2014-05-11T18:46:00.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7856" PostTypeId="5" CreationDate="2014-05-11T16:10:29.767" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-05-11T16:10:29.767" LastActivityDate="2014-05-11T16:10:29.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7857" PostTypeId="4" CreationDate="2014-05-11T16:10:29.767" Score="0" Body="For questions relating to fiber-optic connectors and transceivers." OwnerUserId="3191" LastEditorUserId="762" LastEditDate="2014-05-12T08:38:30.850" LastActivityDate="2014-05-12T08:38:30.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7858" PostTypeId="2" ParentId="7853" CreationDate="2014-05-11T16:20:13.190" Score="6" Body="&lt;p&gt;When a router should fragment but it receives the IP datagram with DF flag set, it sends ICMP (type should fragment but DF is set) to the source. Then the source adjust the MTU and it send again the datagram. This is how PMTUD works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens here is that after you receives the ICMP from the router adjust the MTU to 500 for the path so the following Ping Requests you are sending have the DF flag set, but they are fragmented at source (meaning that your machine is sending the Ping Request fragmented in several datagrams). &lt;/p&gt;&#xA;" OwnerUserId="1600" LastEditorUserId="1600" LastEditDate="2014-05-11T19:26:40.757" LastActivityDate="2014-05-11T19:26:40.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7863" PostTypeId="1" AcceptedAnswerId="7865" CreationDate="2014-05-12T06:12:19.490" Score="2" ViewCount="1060" Body="&lt;p&gt;HTTP uses TCP for its transport protocol. Hence, a three-way handshake is performed before a connection is established. What if there are parallel HTTP connections? Must a three-way handshake must be performed for each connection or will one suffice?&lt;/p&gt;&#xA;" OwnerUserId="5629" LastActivityDate="2014-05-12T07:20:32.467" Title="How many handshakes for parallel http connection?" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7865" PostTypeId="2" ParentId="7863" CreationDate="2014-05-12T07:20:32.467" Score="3" Body="&lt;p&gt;Yes, parallel HTTP connections requires separate three-way handshakes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multiple HTTP requests can be handled in one TCP connection. This can happen sequentially, but since HTTP/1.1, the concept of pipelining allows sending multiple HTTP requests in one TCP connection without waiting for the responses. This results in a seemingly parallel handling of HTTP requests, but note HTTP/1.1 requires the server to send the responses sequentially and in the same order as it received the corresponding requests.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-05-12T07:20:32.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7868" PostTypeId="2" ParentId="7851" CreationDate="2014-05-12T10:13:00.267" Score="2" Body="&lt;p&gt;When the server's MSS is less than 1452, the router should not touch the MSS. The client will see the correct value sent by the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tcp.len&lt;/code&gt; and &lt;code&gt;data.len&lt;/code&gt; will match if Wireshark does not interpret the data in the TCP stream. If wireshark can make sense of the data, it can update &lt;code&gt;data.len&lt;/code&gt;. They don't have to match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in the case of HTTP, &lt;code&gt;data.len&lt;/code&gt; can contain the total length of an HTTP POST request reassembled from which is spread over multiple TCP segments.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-05-12T10:13:00.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7874" PostTypeId="1" AcceptedAnswerId="7929" CreationDate="2014-05-12T16:26:10.273" Score="2" ViewCount="486" Body="&lt;p&gt;I'm working on a project and I need to make the clients authenticate themselves by using 802.1x, I'm using RADIUS as an Authentication Server, my question is what is the best choice as a back-end Database for RADIUS, is it openLDAP or Active Directory?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the pros and cons of both implementations?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="4777" LastActivityDate="2014-05-15T15:21:01.187" Title="OpenLDAP VS Active Directory as a back-end DB?" Tags="|radius|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7875" PostTypeId="1" AcceptedAnswerId="8064" CreationDate="2014-05-12T16:47:24.780" Score="4" ViewCount="10935" Body="&lt;p&gt;I am creating a network diagram for my local LAN. I would like to include a patch panel diagramming what physical location (office) each port goes to, as well as the devices in that office. I have attached what I have created below, but I am unsure that this is the best way to do this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the correct way to diagram physical locations that a patch panel goes to within a Network Diagram?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CPkK3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CPkK3.png&quot; alt=&quot;Patch Panel&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5284" LastEditorUserId="3191" LastEditDate="2014-05-12T17:16:06.883" LastActivityDate="2014-05-23T21:03:12.377" Title="What is the correct way to diagram a Patch Panel?" Tags="|cabling|patch-panel|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7879" PostTypeId="2" ParentId="7024" CreationDate="2014-05-12T19:15:49.850" Score="1" Body="&lt;p&gt;I have seen this happen before, I think it was on a soft phone.  Anyways the fix was disabling cdp on the port.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-if)#no cdp enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3427" LastEditorUserId="3191" LastEditDate="2014-05-12T19:45:07.890" LastActivityDate="2014-05-12T19:45:07.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7881" PostTypeId="1" CreationDate="2014-05-12T20:30:21.400" Score="3" ViewCount="1719" Body="&lt;p&gt;I have two servers with two Ethernet ports each. I also have two managed Cisco switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it remotely possible to have each server connect to each switch in a way to make the switches automatically handle one of the switches dying?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know very little of networking, but it seems to me like there would be a way to do something like LAGG across both switches and have the switches communicate with each other in a master/slave failover way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not looking for the best way to handle this necessarily, more just wanting to know if a method exists and a possible light description of it and how it COULD work.&lt;/p&gt;&#xA;" OwnerUserId="5651" LastActivityDate="2014-05-13T01:02:15.280" Title="Switch Failover" Tags="|cisco|switch|failover|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7884" PostTypeId="2" ParentId="7881" CreationDate="2014-05-12T20:43:05.673" Score="3" Body="&lt;p&gt;What models are those Cisco switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can stack them, then yes - You can connect them in stack and aggregate ports from both of them to the servers, and connections will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can't stack them, but you can connect them together, you can still connect the servers to both of them, but you won't be able (propably) aggregate ports from both of them, as this requires features like VSS and/or mLACP. Still - rather higher-end gear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the worst possible case, you connect server to two different switches and pray Spanning Tree will work correctly, closing one of the connections for forwarding the traffic. Otherwise, you may end up with loop in the network, or periodic loop, and they're hard to troubleshoot or nail down in non-trivial topologies given limited instrumentation on the host with two NICs (this assumes NIC driver can actually participate in the SPT, some of them can't and you'll end up with two separate links to both switches - which will work also, but isn't what you've asked for).&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="286" LastEditDate="2014-05-12T21:55:51.690" LastActivityDate="2014-05-12T21:55:51.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7885" PostTypeId="1" AcceptedAnswerId="32413" CreationDate="2014-05-12T21:12:19.250" Score="5" ViewCount="1549" Body="&lt;p&gt;I am currently trying to encrypt traffic in an IPSEC tunnel with a simple lab architecture. The architecture looks like this : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZfBTh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZfBTh.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to mount an IPSEC tunnel between Router A &amp;amp; Router B, with a L3 switch in the middle to simulate an ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without the IPSEC tunnel I could ping everything without any problems. As soon as I started building the tunnel, the pings stopped getting through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the configurations :&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;RouterA&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto isakmp policy 2&#xA; authentication pre-share&#xA;crypto isakmp key cisco123 address 172.17.1.1&#xA;!&#xA;crypto ipsec transform-set Router-IPSEC esp-des esp-sha-hmac&#xA; mode tunnel&#xA;!&#xA;crypto map SDM_CMAP_1 1 ipsec-isakmp&#xA; description Tunnel to172.17.1.1&#xA; set peer 172.17.1.1&#xA; set transform-set Router-IPSEC&#xA; match address 100&#xA;!&#xA;interface FastEthernet4&#xA; switchport access vlan 10&#xA; no ip address&#xA; spanning-tree portfast&#xA;&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0.1&#xA; encapsulation dot1Q 100&#xA; ip address 172.16.1.1 255.255.255.0&#xA; crypto map SDM_CMAP_1&#xA;!&#xA;interface Vlan10&#xA; ip address 10.10.10.1 255.255.255.0&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 172.16.1.2&#xA;!&#xA;access-list 100 permit ip 10.10.10.0 0.0.0.255 10.20.10.0 0.0.0.255 log&#xA;access-list 110 deny   ip 10.10.10.0 0.0.0.255 10.20.10.0 0.0.0.255 log&#xA;access-list 110 permit ip 10.10.10.0 0.0.0.255 any log&#xA;!&#xA;route-map nonat permit 10&#xA; match ip address 110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;RouterB&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;crypto isakmp policy 2&#xA; authentication pre-share&#xA;crypto isakmp key cisco123 address 172.16.1.1&#xA;!&#xA;crypto ipsec transform-set Router-IPSEC esp-des esp-sha-hmac&#xA; mode tunnel&#xA;!&#xA;crypto map SDM_CMAP_1 1 ipsec-isakmp&#xA; description Tunnel to172.16.1.1&#xA; set peer 172.16.1.1&#xA; set transform-set Router-IPSEC&#xA; match address 100&#xA;!&#xA;interface FastEthernet4&#xA; switchport access vlan 20&#xA; no ip address&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0.1&#xA; encapsulation dot1Q 200&#xA; ip address 172.17.1.1 255.255.255.0&#xA; crypto map SDM_CMAP_1&#xA;!&#xA;interface Vlan20&#xA; ip address 10.20.10.1 255.255.255.0&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 172.17.1.2    &#xA;!&#xA;access-list 100 permit ip 10.20.10.0 0.0.0.255 10.10.10.0 0.0.0.255 log&#xA;access-list 110 deny   ip 10.20.10.0 0.0.0.255 10.10.10.0 0.0.0.255 log&#xA;access-list 110 permit ip 10.20.10.0 0.0.0.255 any log&#xA;!&#xA;route-map nonat permit 10&#xA; match ip address 110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;L3 Switch&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;system mtu routing 1500&#xA;ip subnet-zero&#xA;ip routing&#xA;!&#xA;interface FastEthernet1/0/1&#xA; description *** Interco L2L ***&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 100&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet1/0/2&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 200&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan100&#xA; ip address 172.16.1.2 255.255.255.0&#xA;!&#xA;interface Vlan200&#xA; ip address 172.17.1.2 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I try checking the IKE security associations, I find that no SA is made.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterB# show crypto isakmp sa&#xA;&#xA;dst             src             state          conn-id slot status&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However I can see IPSEC Security Associations...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterB# show crypto ipsec sa&#xA;    interface: FastEthernet0&#xA;Crypto map tag: SDM_CMAP_1, local addr 172.17.1.1&#xA;&#xA;   protected vrf: (none)&#xA;   local  ident (addr/mask/prot/port): (10.20.10.0/255.255.255.0/0/0)&#xA;   remote ident (addr/mask/prot/port): (10.10.10.0/255.255.255.0/0/0)&#xA;   current_peer 172.16.1.1 port 500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, the ACL 100 &amp;amp; 110 show no matches even when I tring pinging one of the remote hosts from the local host.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the issue? The fact that the ACL are not getting any hits seem strange to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jeremy&lt;/p&gt;&#xA;" OwnerUserId="3484" LastEditorUserId="3191" LastEditDate="2014-05-13T11:40:03.430" LastActivityDate="2016-06-20T19:08:22.877" Title="Deploying an IPSEC secure-channel - isakmp SA empty" Tags="|cisco|vpn|ipsec|ike|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7886" PostTypeId="2" ParentId="7187" CreationDate="2014-05-12T22:03:22.283" Score="4" Body="&lt;p&gt;It won't interfere per se, but question is - what you're trying to achieve?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, it's hardware dependent - you may be silently ignored using this command on software platforms. Essentially, you should drill down to supported/unsupported notes for your gear to check if it's available and working. Some platforms can tune up/down delays separately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're trying to achieve fast convergence, use one protocol - by approaching the problem with the KISS principle. BFD seems to be best fit in case multiple protocols are used and they need information about the neighbor loss ASAP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, &lt;code&gt;carrier-delay&lt;/code&gt; will only work on interfaces, that will signal up/down situation properly. Connections to shared media (like Ethernet switch) or to media that doesn't properly propagate up/down signal (some SDH/SONET/ATM gear) will cause problems anyway, so you should fall back to something that YOU control.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-05-12T22:03:22.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7888" PostTypeId="2" ParentId="7881" CreationDate="2014-05-13T01:02:15.280" Score="3" Body="&lt;p&gt;You want to implement NIC teaming on the server. Depending on the server and OS there are drivers assoicated with the NICs, or if you run windows 2012 that feature is built into the OS. There may be other OSes that support NIC teaming (I know esx does) but I am not familiar with ,NIX.  Or you can try to 'dual home' the server that is give each NIC its own IP address and have the default gateway point out both switches.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2014-05-13T01:02:15.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7889" PostTypeId="1" AcceptedAnswerId="9465" CreationDate="2014-05-13T06:33:07.943" Score="7" ViewCount="747" Body="&lt;p&gt;On a company main switch (Cisco 3750) I have connected a simple Windows XP physical PC on a switchport (switchport mode access, switchport access vlan 30). NO monitor sessions exists on the 3750. Also, the PC has a single IP address on a single NIC.&#xA;However, when I start a Wireshark promiscuous capture on the WinXP PC, several foreign conversations appear, either LAN-to-LAN or WAN-to-LAN (that is src IP and dst IP does not match the PC's IP address). This traffic is NOT broadcast (neither L2 broadcast nor L3 broadcast). The switch's configuration is a simple layer 3 and layer 2 configuration. Nothing fancy (ommited for cluttering the reasons)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have checked the switch's MAC and ARP table and all seems normal: the PC's switchport shows only 1 MAC address and the other foreign MAC and IP addresses resolve to their normal ports (using &quot;show ip arp&quot; and &quot;show mac-addr&quot; etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole capturing idea was initiated because we want to troubleshoot frequent application lags (according to other captures, many TCP retransmissions are the possible culprit).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;======================&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT &#xA;after an IOS research it seems that there is a pretty big chance that my IOS version (12.2(25)SEB4) may have serious bugs about CAM tables and such. I will upgrade next week and revisit to update.&lt;/p&gt;&#xA;" OwnerUserId="5249" LastEditorUserId="5249" LastEditDate="2014-05-15T12:57:13.943" LastActivityDate="2014-06-18T21:11:02.907" Title="Why wireshark captures foreign / non relevant traffic on my plain access switchport?" Tags="|cisco|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7890" PostTypeId="1" AcceptedAnswerId="7917" CreationDate="2014-05-13T08:46:34.207" Score="1" ViewCount="284" Body="&lt;p&gt;I am analyzing certain BGP update messages and normally, an average BGP message(withdrawal) could contain 2-3 prefixes. During my analyses, i noticed that there are some few withdrawal updates that contain up to about 500 prefixes. Is it normal to have such size of prefixes withdrawn in one message ? And could this intuitively mean something ?&lt;/p&gt;&#xA;" OwnerUserId="4305" LastEditorUserId="59" LastEditDate="2014-05-15T06:59:19.057" LastActivityDate="2014-05-15T06:59:19.057" Title="BGP update message burst" Tags="|routing|bgp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7892" PostTypeId="1" CreationDate="2014-05-13T10:49:49.307" Score="3" ViewCount="1130" Body="&lt;p&gt;You can enable flow on the physical bearer and it will automatically add the flow configuration to any subsequent sub-interfaces using &lt;code&gt;ip route-cache flow&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to disable/enable CDP on the physical interface and it automatically cascades to the sub-interfaces? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to enable CDP on 350 devices for the LAN facing ports only via a script, the WAN interface is always g0/0 but sites have a variety of VRFs/sub-interfaces.&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="453" LastEditDate="2018-05-20T05:08:18.820" LastActivityDate="2018-06-19T05:34:18.337" Title="How to disable CDP on multiple sub-interfaces from physical bearer?" Tags="|cisco-commands|cdp|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="7895" PostTypeId="1" CreationDate="2014-05-13T14:48:40.237" Score="5" ViewCount="2600" Body="&lt;p&gt;I want to take a bunch of VLANs from an interface, trunk them through my network, and spit them out on another end. Sounds like simple Q-in-Q to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem is one end is a 3600X, and the other is a 4900M. The 4900M is simple. The problem I have is with the 3600X and the EVC. Let's say I want to take VLAN 10 from a customer, and carry it on my network as VLAN 100. I will take them from a port on my 3600X and then carry VLAN 100 along with another bunch of unrelated VLANs through my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I configure a service instance on the customer facing port encapsulating their VLANs (let's say VLAN 10 for this example), then carry the internal VLAN (100) through on my trunks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example, 3600X:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA;&#xA;description FACING CUSTOMER NETWORK&#xA; switchport trunk allowed vlan none&#xA; switchport mode trunk&#xA; service instance 1 ethernet&#xA;  encapsulation dot1q 10&#xA;  bridge-domain 100&#xA;&#xA;&#xA;&#xA;interface GigabitEthernet0/2&#xA;&#xA;description FACING SERVICE PROVIDER CLOUD&#xA; switchport trunk allowed vlan 100&#xA; switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the 4900M will be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA;&#xA;description FACING CUSTOMER NETWORK&#xA;&#xA;switchport access vlan 100&#xA;&#xA;switchport mode dot1q-tunnel&#xA;&#xA;&#xA;&#xA;interface GigabitEthernet0/2&#xA;&#xA;description FACING SERVICE PROVIDER CLOUD&#xA;&#xA;switchport trunk allowed vlan 100&#xA;&#xA;switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This doesn't work. I've tried various configs on the 3600 but can't get it working. I am not sure how to config the EVC properly - on the 3600X I suspect I also have to configure a service instance on the trunk facing into the cloud? This unfortunately isn't preferable as I want this to function as a basic, normal trunk (it has about 50 other VLANs on it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers for any help!&lt;/p&gt;&#xA;" OwnerUserId="5661" LastEditorUserId="5661" LastEditDate="2014-05-13T15:54:25.700" LastActivityDate="2015-04-17T22:32:14.180" Title="cisco 3600X - q-in-q on an evc/service instance" Tags="|cisco|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7899" PostTypeId="2" ParentId="7890" CreationDate="2014-05-13T19:17:02.900" Score="2" Body="&lt;p&gt;If a AS has a single peering point with another customer ASN, learning 500 prefixes from that customer, and that session goes down, it could trigger a mass withdrawl.&lt;/p&gt;&#xA;" OwnerUserId="141" LastActivityDate="2014-05-13T19:17:02.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7903" PostTypeId="1" CreationDate="2014-05-13T23:52:11.300" Score="2" ViewCount="860" Body="&lt;p&gt;So I am trying to run a simulation using the MPTCP protocol in a data center but rtProto DV is not working; produces an error, I am guessing the implementations doesn't have support for it and I can't figure out what to change so it works. For anyone interested that might have an idea this is the error I get and how I might fix it or where to look&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ns: _o344 recv-update 0 0: can't read &quot;class::&quot;: no such variable&#xA;    while executing&#xA;&quot;error &quot;$class::$proc update $peerAddr:$msg:$count from unknown peer&quot;&quot;&#xA;    (procedure &quot;_o344&quot; line 36)&#xA;    (Agent/rtProto/DV recv-update line 36)&#xA;    invoked from within&#xA;&quot;_o344 recv-update 0 0&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So now I am trying to make it so the simulation uses all paths. I am using a k-tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/pR995.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking of maybe using add-routes and enabling multiPath_ that it might work but the problem is I am not sure how to use add-routes in my case.&#xA;The topology is k-tree with the k=4 so basically I want to add the additional choices in the pods and core level. How would I go about it? Would I for every node inside each pod add for every possible server all the following nodes that are possible?&#xA;For example in the image from source to destination in the first round node it encounters;&#xA;would I do a for-loop on that node and for every host (black square nodes) I would add as next hop both round nodes on the upper level of the pod and enable multiPath_? and so on for all the nodes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone has any other idea of how I would solve this, or maybe even what to look into changing so DV works?&lt;/p&gt;&#xA;" OwnerUserId="4390" LastActivityDate="2014-07-02T14:36:24.620" Title="Enabling multipath in ns2 with no rtproto DV" Tags="|routing|" AnswerCount="0" CommentCount="2" ClosedDate="2019-12-20T00:37:52.677" ContentLicense="CC BY-SA 3.0" />
  <row Id="7904" PostTypeId="2" ParentId="7550" CreationDate="2014-05-14T01:17:31.603" Score="3" Body="&lt;p&gt;It appears the issue is with the setup using RSTP and that is causing it to drop packets on the link with the primary VLAN. Since it's not a huge concern, the link between the switches will be removed for now until I learn more about MSTP.&lt;/p&gt;&#xA;" OwnerUserId="5384" LastEditorUserId="21048" LastEditDate="2016-06-25T11:30:41.090" LastActivityDate="2016-06-25T11:30:41.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7906" PostTypeId="1" AcceptedAnswerId="7907" CreationDate="2014-05-14T07:01:06.347" Score="4" ViewCount="2917" Body="&lt;p&gt;I'm trying to find the best way to add comments into my access-lists. For the moment, the only manner I found is the following one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#conf t&#xA;switch(config)#ip access-list extended VLAN-TEST3&#xA;switch(config-ext-nacl)#remark first remark&#xA;switch(config-ext-nacl)#10 permit ip any any&#xA;switch(config-ext-nacl)#remark second remark&#xA;switch(config-ext-nacl)#20 deny ip any any&#xA;switch(config-ext-nacl)#remark third remark&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But by using this, I'm unable to see the comments with the command &lt;code&gt;sh ip access-list VLAN-TEST3&lt;/code&gt; they appear only when I do a &lt;code&gt;sh run&lt;/code&gt; (which isn't the most practical to see an ACL). I also cannot specify a number of lines for the remark and I can't modify/delete them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way to do that? I'm using a Cisco 3750&lt;/p&gt;&#xA;" OwnerUserId="5670" LastEditorUserId="3191" LastEditDate="2014-05-14T08:20:32.830" LastActivityDate="2014-05-15T12:07:29.397" Title="How can I add ACL entry comments on a Cisco 3750?" Tags="|cisco|cisco-catalyst|acl|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7907" PostTypeId="2" ParentId="7906" CreationDate="2014-05-14T07:21:11.097" Score="4" Body="&lt;p&gt;Cisco does not provide any other way see view access lists remarks besides viewing them from the running configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lines containing remark statements are not numbered so they are ignored when running &lt;strong&gt;show ip access-list&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can filter the running config output and display only the section regarding to access-lists like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show running-config | section ip access-list&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3615" LastActivityDate="2014-05-14T07:21:11.097" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7910" PostTypeId="1" CreationDate="2014-05-14T12:51:41.233" Score="8" ViewCount="7484" Body="&lt;p&gt;Yesterday a laptop crashed the network because the IP address of the computer was the same as the router. Computers in the network were reaching the laptop instead of the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway to prevent this from happening?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We currently have a D-Link DFL860.&lt;/p&gt;&#xA;" OwnerUserId="5673" LastEditorUserId="8499" LastEditDate="2018-03-10T04:28:00.693" LastActivityDate="2018-03-10T04:28:00.693" Title="Duplicate IP Address Prevention?" Tags="|router|ipv4|ip|ip-address|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7911" PostTypeId="2" ParentId="7910" CreationDate="2014-05-14T13:14:25.230" Score="1" Body="&lt;p&gt;You can log on into the router web interface and setup a static DHCP assigment based on MAC address&#xA;Follow this procedure for your router model:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. Go to: System &amp;gt; DHCP &amp;gt; DHCP Servers &amp;gt; DHCPServer1 &amp;gt; Static Hosts &amp;gt; Add &amp;gt; Static Host Entry&#xA;2. Now enter:&#xA;• Host:192.168.1.1 (enter the host IP address here)&#xA;• MAC: 00-01-02-03-04-05 (enter the host MAC address here)&#xA;3. Click OK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now your host every time boot up will receive same IP address. To get your host IP and MAC address on Windows open a cmd windows type &lt;strong&gt;ipconfig /all&lt;/strong&gt; and check the &lt;strong&gt;IPv4 Address&lt;/strong&gt; and &lt;strong&gt;Physical address&lt;/strong&gt; lines for your network interface&lt;/p&gt;&#xA;" OwnerUserId="3615" LastEditorUserId="3615" LastEditDate="2014-05-14T13:19:37.693" LastActivityDate="2014-05-14T13:19:37.693" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7912" PostTypeId="2" ParentId="7910" CreationDate="2014-05-14T14:25:59.140" Score="9" Body="&lt;p&gt;On a normal Ethernet there is nothing that can prevent devices on the network to interfere with each other. Tools like DHCP can assist in preventing accidental conflicts if used correctly, but malicious or misconfigured hosts can still cause problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some things that are common:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Conflicting addresses (two or more MAC addresses that claim to have the same IP address in ARP or ND)&lt;/li&gt;&#xA;&lt;li&gt;ARP or ND spoofing (someone intentionally pretending to be someone else)&lt;/li&gt;&#xA;&lt;li&gt;Rogue RAs (someone sending IPv6 Router Advertisements when they shouldn't)&lt;/li&gt;&#xA;&lt;li&gt;Rogue DHCPv4 or DHCPv6 servers (DHCP servers that shouldn't be there)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As ethernet is a broadcast medium everybody can broadcast anything they want, unless special actions are taken. For such special actions you need equipment that can implement them. This means you need enterprise-grade ethernet switches, wireless access points etc. The measures they can take are e.g. to filter out unwanted RA and DHCP packets, make sure that a system only sends packets with a source address that has been assigned by DHCP (this requires DHCP snooping on the switch) and protections against ARP and ND highjacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such security features are only available on professional equipment, so don't expect them on consumer or SME devices or low-budget enterprise gear.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-05-14T14:25:59.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7915" PostTypeId="2" ParentId="7810" CreationDate="2014-05-14T20:01:08.387" Score="4" Body="&lt;p&gt;The problem ended up being a permission issue on the backup server. This didn't seem to be a problem since ISE was able to read the backup folder. I also thought this was an issue on ISE's side since it was reporting the backup successful when it wasn't. It seems that ISE reports the backup is successful if it can login to the remote server and pool the backup data locally. Even if that data doesn't reach the server it will still show as successful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The permission issue is that the service account that I used only had read access to the backup location and no write. &lt;/p&gt;&#xA;" OwnerUserId="108" LastEditorUserId="108" LastEditDate="2014-05-15T22:41:57.300" LastActivityDate="2014-05-15T22:41:57.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7917" PostTypeId="2" ParentId="7890" CreationDate="2014-05-15T06:59:06.613" Score="2" Body="&lt;p&gt;There are many reasons for a lot of withdrawals. All you can guess from such an event is: &quot;Somewhere upstream an event caused some change in the BGP routing.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could be a peer disconnecting/dropping a BGP session, an IXP (Internet Exchange Point) going down, or a lot of other things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't forget that BGP is spanning the whole globe. 500 withdrawals are not such a big thing compared to the whole internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know what happened you would have to look at the individual withdrawals and look for patterns (all from the same origin AS, all coming over the same upstream/IXP, etc.). Even then the exact reason(s) might still be unclear.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-05-15T06:59:06.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7918" PostTypeId="2" ParentId="6171" CreationDate="2014-05-15T07:27:14.973" Score="-2" Body="&lt;p&gt;This is what worked for me&lt;/p&gt;&#xA;&#xA;&lt;p&gt;do no switchport in the physical interface&#xA;put it in hybrid mode&#xA;again do a switchport in the physical interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;H2H...&lt;/p&gt;&#xA;" OwnerUserId="5683" LastActivityDate="2014-05-15T07:27:14.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7920" PostTypeId="1" AcceptedAnswerId="7984" CreationDate="2014-05-15T08:23:47.370" Score="4" ViewCount="8313" Body="&lt;p&gt;I'm looking to add security on a LAN to LAN link that we have in my network.&#xA;This LAN to LAN link is used to extend vlans over 2 sites (local &amp;amp; remote).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now, the diagram is this one : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HqBp3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HqBp3.jpg&quot; alt=&quot;diagram-l2l&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to add the security features with 2 Cisco 891 routers (this is not a choice but a constraint).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking to change the network architecture following this diagram :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zhNXT.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zhNXT.jpg&quot; alt=&quot;l2tp ipsec&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the idea here is to add a 891 router between my L3 switch and the ISP's equipment, and to do this on both sites of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, I will have to create L3 connectivity between my 2 routers using the lan to lan link.&#xA;This way I can encrypt the packets using IPSEC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But to be as transparent as possible for the network, I will have to encapsulate the L2 datagrams coming from my network into L2TP packets, which will then be encrypted via IPSEC and sent over the LAN to LAN link to the remote router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct in these assumptions ? Is this something that is technically possible ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't really know how I can interconnect my 891 router with the ISP's equipment, for starters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help&#xA;Jeremy&lt;/p&gt;&#xA;" OwnerUserId="3484" LastEditorUserId="3191" LastEditDate="2014-05-19T14:44:40.207" LastActivityDate="2015-11-01T20:25:13.097" Title="L2TP over IPSEC with a LAN to LAN link" Tags="|cisco|ipsec|l2tp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7924" PostTypeId="1" AcceptedAnswerId="7937" CreationDate="2014-05-15T14:05:04.370" Score="46" ViewCount="4402" Body="&lt;p&gt;In &lt;a href=&quot;http://www.npr.org/blogs/alltechconsidered/2014/05/15/312666733/fcc-to-unveil-proposed-rules-to-govern-internet-traffic&quot; rel=&quot;noreferrer&quot;&gt;this NPR article&lt;/a&gt; there is mentioned &lt;em&gt;'network neutrality'&lt;/em&gt; with very little details on what it actually is or &lt;strong&gt;how&lt;/strong&gt; it actually works. I tried researching it on my own but I get a lot of non-technical explanations of what it is fighting against (essentially metering internet traffic speeds) but I am very confused as to &lt;strong&gt;how&lt;/strong&gt; this works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding of the internet (broadly) is that user &lt;em&gt;Joe&lt;/em&gt; opens up a connection with website &lt;em&gt;npr.com&lt;/em&gt; via the HTTP protocol (after some DNS work) which sends and receives data to and from &lt;em&gt;NPR's&lt;/em&gt; server utilizing both &lt;em&gt;NPR's&lt;/em&gt; and &lt;em&gt;Joe's&lt;/em&gt; upload and download speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Where is the throttling occurring?&lt;/strong&gt; Am I missing a crucial step? Is the &lt;em&gt;'traffic'&lt;/em&gt; being throttled &lt;em&gt;'on the way'&lt;/em&gt; to the client/server somewhat like a tollbooth at the ISP level?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NPR article brings up the example of how one website could pay to have their traffic go to the user faster. I just don't understand this because isn't all my incoming traffic maxed out at whatever my download speed is? Further, isn't the server maxed out at whatever their upload speed is? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if I try to send 1MB of data from a server (www.mysimplesite.com) with an upload speed of 1MB/s to a client (joe) who has a download speed of 1mb/s would this transfer not happen in the same [theoretical] time as a server (www.thesuperubersite.com) with an upload speed of 2MB/s? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I fail to see how any server can pay to have their content &lt;em&gt;'reach the user faster'&lt;/em&gt; if it is the client who generally is the speed limitation. From a &lt;strong&gt;technical perspective&lt;/strong&gt;,  &lt;strong&gt;how&lt;/strong&gt; would this work?  I'm also not looking for an analogy or opinions.&lt;/p&gt;&#xA;" OwnerUserId="5692" LastEditorUserId="42290" LastEditDate="2017-12-13T11:55:59.210" LastActivityDate="2017-12-13T11:55:59.210" Title="Network Neutrality, how does it actually work, technically speaking?" Tags="|routing|" AnswerCount="8" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7926" PostTypeId="1" AcceptedAnswerId="7933" CreationDate="2014-05-15T14:54:32.490" Score="3" ViewCount="1149" Body="&lt;p&gt;I have a standalone ISE node, which is being stubborn about an upgrade...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/ise/1-2/upgrade_guide/b_ise_upgrade_guide/b_ise_upgrade_guide_chapter_01.html#ID203&quot; rel=&quot;nofollow&quot;&gt;docs&lt;/a&gt; say this should work, but I'm getting an error...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISE-01/admin# application upgrade ise-upgradebundle-1.1.x-to-1.2.0.899.i386.tar.gz disk&#xA;&#xA;Save the current ADE-OS running configuration? (yes/no) [yes] ? yes&#xA;Generating configuration...&#xA;Saved the ADE-OS running configuration to startup successfully&#xA;Initiating Application Upgrade...&#xA;&#xA;% Repository not found&#xA;ISE-01/admin#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;What CLI do I need to use to successfully upgrade ISE 1.1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A directory listing for &lt;code&gt;disk:&lt;/code&gt; and show version follows...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISE-01/admin# dir disk:/&#xA;&#xA;Directory of disk:/&#xA; 3976667523 May 15 2014 09:40:44  ise-upgradebundle-1.1.x-to-1.2.0.899.i386.tar.gz&#xA;      16384 Jun 04 2013 09:50:51  lost+found/&#xA;&#xA;           Usage for disk: filesystem&#xA;                 4153323520 bytes total used&#xA;                10294484992 bytes free&#xA;                15234142208 bytes available&#xA;ISE-01/admin#&#xA;ISE-01/admin# sh ver&#xA;&#xA;Cisco Application Deployment Engine OS Release: 2.0&#xA;ADE-OS Build Version: 2.0.4.018&#xA;ADE-OS System Architecture: i386&#xA;&#xA;Copyright (c) 2005-2011 by Cisco Systems, Inc.&#xA;All rights reserved.&#xA;Hostname: ISE-01&#xA;&#xA;&#xA;Version information of installed applications&#xA;---------------------------------------------&#xA;&#xA;Cisco Identity Services Engine&#xA;---------------------------------------------&#xA;Version      : 1.1.1.268&#xA;Build Date   : Mon Jun 25 00:49:23 2012&#xA;Install Date : Tue Apr 29 10:49:41 2014&#xA;&#xA;ISE-01/admin#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-05-15T16:08:07.907" Title="Upgrading Cisco ISE to 1.2" Tags="|cisco|cisco-ise|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7927" PostTypeId="2" ParentId="7924" CreationDate="2014-05-15T15:13:55.933" Score="1" Body="&lt;p&gt;Netflix and other providers often put servers within an ISP's area so that it reduces the amount of traffic traversing the networks.  So a New York netflix user does not need to cross all the networks between it and Sanfran where the main netflix servers are (hypothetically)&#xA;Allegedly some of the ISPs are not allowing the servers within their network to deliberately cause a traffic problem and say it needs to be paid for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So even though Netflix etc don't have servers in the ISPs area they will still have to pay to access the customers. If the netflix server was at the end of your street it would not have to block loads of switches and routers in between. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example your simplesite.com can currently send unlimited amounts of traffic to anybody and you don't need to pay the ISPs inbetween. They all allow each others traffic to move across the networks. What the ISPs are looking to to is double charge both your website and the customer. &lt;/p&gt;&#xA;" OwnerUserId="5688" LastEditorUserId="5688" LastEditDate="2014-05-15T15:19:12.553" LastActivityDate="2014-05-15T15:19:12.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7928" PostTypeId="1" AcceptedAnswerId="7974" CreationDate="2014-05-15T15:16:36.530" Score="34" ViewCount="10431" Body="&lt;p&gt;Many moons ago, when I was just a &lt;em&gt;&lt;a href=&quot;http://www.oxforddictionaries.com/definition/english/wee&quot; rel=&quot;noreferrer&quot;&gt;wee&lt;/a&gt; &lt;a href=&quot;http://www.oxforddictionaries.com/definition/english/bairn&quot; rel=&quot;noreferrer&quot;&gt;bairn&lt;/a&gt;&lt;/em&gt; commencing my career, I had a job interview for a low-level developer role.  Having at that time just learned how CIDR was implemented, I was keen to show off my knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly, that tactic didn't work out too well for me.  I recall being completely floored by the very first question that was asked (and, then ruffled, it all went downhill).  The question was:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;Why&lt;/em&gt; are IPv4 addresses 32-bit?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I readily admitted that I didn't &lt;em&gt;know&lt;/em&gt; the answer, but I &lt;em&gt;did&lt;/em&gt; know that the original protocol design divided the address space into an 8-bit network number and a 24-bit host identifier&amp;mdash;so I tried to rationalise it on the grounds that the protocol designers imagined an Internet of a few networks (after all, it was originally intended to link together a &lt;em&gt;specific&lt;/em&gt; few) each comprising many hosts and, for simplicity of programming, kept everything aligned to byte boundaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recall the interviewer being unsatisfied with my answer and suggesting to me that the &lt;em&gt;real&lt;/em&gt; reason is that it's guaranteed to fit inside a &lt;code&gt;long int&lt;/code&gt; in C, so simplifies implementation details.  Being young and green at the time, I accepted that as a reasonable answer and (before today) hadn't thought any more of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason that conversation has just returned to me and, now that I reflect upon it, it doesn't seem entirely plausible:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Under the original addressing scheme comprising fixed-size network and host fields, it's unlikely that a developer would have &lt;em&gt;wanted&lt;/em&gt; to assign the concatenation of the two fields to a single variable (I don't have access to any early IP implementations to verify what they actually did in practice); and&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;At the time that works on TCP/IP began, C was neither standardized nor the &lt;em&gt;de facto&lt;/em&gt; &quot;lingua franca&quot; of low-level software development that it has become today.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Was the interviewer's suggestion actually founded in fact?  If not, what &lt;em&gt;were&lt;/em&gt; the real reasons that the protocol designers chose 32-bit addressing?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="4911" LastEditorUserId="42290" LastEditDate="2017-12-13T10:57:59.590" LastActivityDate="2017-12-13T10:57:59.590" Title="Why are IPv4 addresses 32-bit?" Tags="|ipv4|protocol-theory|memory|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7929" PostTypeId="2" ParentId="7874" CreationDate="2014-05-15T15:21:01.187" Score="2" Body="&lt;p&gt;I have found a useful PDF which answer this question and which explain in details the advantages of openLDAP over Active Directrory&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://symas.com/documents/Adam-Eval1-0.pdf&quot; rel=&quot;nofollow&quot;&gt;http://symas.com/documents/Adam-Eval1-0.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4777" LastActivityDate="2014-05-15T15:21:01.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7930" PostTypeId="2" ParentId="7928" CreationDate="2014-05-15T15:25:40.607" Score="34" Body="&lt;p&gt;Easy answer: &lt;strong&gt;because Vint Cerf decided so&lt;/strong&gt;.  He thought that he was designing an experimental protocol and considered 32-bits to be more than sufficient for that purpose; he did not expect IPv4 to be used in production systems and so no greater thought was given to the size of the address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the Google IPv6 Conference 2008, he hosted a panel discussion titled &lt;em&gt;What will the IPv6 Internet look like?&lt;/em&gt; during which &lt;a href=&quot;http://youtu.be/mZo69JQoLb8?t=13m36s&quot;&gt;he recounted&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The decision to put a 32-bit address space on there was the result of a year’s battle among a bunch of engineers who couldn’t make up their minds about 32, 128 or variable length. And after a year of fighting I said — I’m now at ARPA, I’m running the program, I’m paying for this stuff and using American tax dollars — and I wanted some progress because we didn’t know if this is going to work. So I said 32 bits, it is enough for an experiment, it is 4.3 billion terminations — even the defense department doesn’t need 4.3 billion of anything and it couldn’t afford to buy 4.3 billion edge devices to do a test anyway. So at the time I thought we were doing a experiment to prove the technology and that if it worked we’d have an opportunity to do a production version of it. Well — [laughter] — it just escaped! — it got out and people started to use it and then it became a commercial thing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://dltj.org/article/vint-cerf-ip-addressing/&quot;&gt;Transcript&lt;/a&gt; by &lt;a href=&quot;http://dltj.org/about/&quot;&gt;Peter E. Murray&lt;/a&gt;.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="4911" LastEditDate="2014-05-15T17:31:34.533" LastActivityDate="2014-05-15T17:31:34.533" CommentCount="16" ContentLicense="CC BY-SA 3.0" />
  <row Id="7931" PostTypeId="2" ParentId="7278" CreationDate="2014-05-15T15:34:15.383" Score="0" Body="&lt;p&gt;It seems you added more debug output since I last viewed this.  I don't know if this is still an issue, but if so, the problem is identified here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;L2L-IPSEC&quot; #1: the peer proposed: 172.16.255.1/32:0/0 -&amp;gt; 192.168.0.0/24:0/0&#xA;&quot;L2L-IPSEC&quot; #1: cannot respond to IPsec SA request because no connection is known for 172.16.255.1/32===1.1.1.1&amp;lt;1.1.1.1&amp;gt;[+S=C]:1/0...2.2.2.2&amp;lt;2.2.2.2&amp;gt;[+S=C]:1/0===192.168.0.0/24&#xA;&quot;L2L-IPSEC&quot; #1: sending encrypted notification INVALID_ID_INFORMATION to 2.2.2.2:500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is from your Opanswan output.  This is telling you that you have a mismatch in the &quot;Encryption Domain&quot; (or &quot;Interesting Traffic&quot;, or other such terminology) of the configuration.  One side is proposing one set of networks, and the other side is expecting another set of networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could also be an issue in the &quot;identity&quot; portion of both peers.  I am not sure how to check it in Openswan (or rather, how to check the configuration for the &quot;identity&quot; portion), but on the ASA you'll want to look for a line that looks like &quot;crypto isakmp identity&quot; or potentially &quot;crypto ikev1 identity&quot; if you are running 8.4+.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-05-15T15:34:15.383" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7932" PostTypeId="2" ParentId="7924" CreationDate="2014-05-15T16:07:19.573" Score="4" Body="&lt;p&gt;The internet is not far from becoming just like any other utility (water, power, etc) -- something you assume everyone needs and has a right to have.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Net Neutrality would make it so the ISP (Internet Service Providers) can only provide you with a link to the Internet.  Nothing more.  Which is a GOOD thing.  Just like your power and water company, they provide you with power and water.  They don't care whether you use a refrigerator from Kenmore, or Sears, or GE, or Whirlpool, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current bill would allow ISP to charge premiums for faster access to certain services/websites.  Something like a faster download rate when browsing youtube, or watching videos on netflix, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best comparison is to continue comparing the Internet to a utility service.  What if your power company could charge you more to ensure a better power stream when you are using (for example) General Electric devices (your fridge, your toaster, etc).  But, what if you own a Kenmore refrigerate, are you out of luck?  Left to accept just the bare minimum your power company will give you in so far as power.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;People would be outraged if the Power Company all of a sudden imposed fees to power certain company's devices, while trying to avoid blame by stating that you always have the option to not pay the fees for a lesser service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Replace the &quot;power company&quot; with &quot;your local ISP&quot; and replace &quot;a company's electronic devices&quot; with various online businesses (ebay, netflix, youtube, amazon VoD, etc).  The problem is, once they start &quot;charging a premium for certain sites&quot;, its only a matter of time before all the remaining sites end up having terrible service.  Which takes your choice away, as the consumer, because you will be forced to choose (and pay more for) the service that your ISP happens to support.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-05-15T16:07:19.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7933" PostTypeId="2" ParentId="7926" CreationDate="2014-05-15T16:08:07.907" Score="2" Body="&lt;p&gt;This solves the problem...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISE-01/admin# conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;ISE-01/admin(config)#&#xA;ISE-01/admin(config)# repository LOCAL&#xA;ISE-01/admin(config-Repository)# url disk:/&#xA;ISE-01/admin(config-Repository)# end&#xA;ISE-01/admin# end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now the upgrade works...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISE-01/admin#  application upgrade ise-upgradebundle-1.1.x-to-1.2.0.899.i386.tar.gz LOCAL&#xA;Save the current ADE-OS running configuration? (yes/no) [yes] ?&#xA;Generating configuration...&#xA;Saved the ADE-OS running configuration to startup successfully&#xA;Initiating Application Upgrade...&#xA;% Warning: Do not use Ctrl-C or close this terminal window until upgrade completes.&#xA;STEP 1: Stopping ISE application...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-05-15T16:08:07.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7935" PostTypeId="1" CreationDate="2014-05-15T17:35:16.937" Score="5" ViewCount="1164" Body="&lt;p&gt;I have 5 2960 switches configured in my network. The issue I am facing is that while telnetting to the switches (eg: A) sometimes abruptly the telnet connection gets closed and repeated attempts sees the Telnet connection being refused. What I then do is telnet to another switch (B), and from there telnet to the original switch (A). That never fails. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches are all on one Default VLAN (192.168.1.0) and I am on a Management VLAN (192.168.40.0). Is there any correlation between different subnets and telnet? There shouldn't be as the issue is only intermittent and random.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please advise. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the Line config looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line vty 0 1&#xA; password 7 AAAAAAAAAAAAAAAAAAAAA&#xA; login&#xA;line vty 2 4&#xA; password 7 BBBBBBBBBBBBBBBB&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5350" LastActivityDate="2016-07-19T07:18:16.073" Title="Cisco 2960 Switches denying Telnet connections randomly" Tags="|cisco|switch|cisco-catalyst|cisco-2960|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="7936" PostTypeId="1" CreationDate="2014-05-15T17:58:48.657" Score="3" ViewCount="10006" Body="&lt;p&gt;I'm working on an ASA 5510 fw running 8.2(5) and I'm having the following problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm logged into a server behind the firewall and trying to ping the public ip of a website hosted on a different server behind the same firewall.  The ping is failing and I'm seeing entries like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src inside:192.168.1.122 dst outside:1.1.1.227 (type 8, code 0) denied due to NAT reverse path failure&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am running static nat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current nat config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;&#xA;static (inside,outside) 1.1.1.227 192.168.1.120 netmask 255.255.255.255 &#xA;static (inside,outside) 1.1.1.228 192.168.1.122 netmask 255.255.255.255 &#xA;static (outside,inside) 192.168.1.120 1.1.1.227 netmask 255.255.255.255 &#xA;static (outside,inside) 192.168.1.122 1.1.1.228 netmask 255.255.255.255 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am able to ping out to any other website as well browse on the internet from within the server behind the firewall.  I'm just not able to reach any website configured on an internal ip which is an ip being nat'ed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone know what can be wrong?  I tried searching a bit online but the solutions mentioned haven't been working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help point me in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="864" LastEditDate="2014-05-15T18:17:45.700" LastActivityDate="2014-05-15T22:10:47.507" Title="Asymmetric NAT rules matched for forward and reverse flows" Tags="|nat|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7937" PostTypeId="2" ParentId="7924" CreationDate="2014-05-15T18:07:18.763" Score="33" Body="&lt;p&gt;Network neutrality effectively governs how providers can handle traffic. It's a broad concept in theory, with potential upsides and downsides in practice. Consensus seems to be &lt;a href=&quot;http://www.slate.com/blogs/future_tense/2014/04/24/fcc_s_new_net_neutrality_proposal_is_even_worse_than_you_think.html&quot; rel=&quot;noreferrer&quot;&gt;the downsides might be fairly harmful to consumers and startups&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the absence of net neutrality, internet service providers and the big businesses with the budget to support them would win – with consumers and internet startups losing. In theory, abolishing net neutrality would allow ISPs like Verizon to decide for themselves whether or not they want to provide VoIP traffic, or any other traffic type, to traverse their networks. Other Tier 1 providers would be free to do the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be fair, internet in the US isn't currently operated under perfect net neutrality rules. Information freedom is increasingly eroding around the edges of the law, with an egregious, perhaps extortive agreement taking place earlier this year between &lt;a href=&quot;http://arstechnica.com/business/2014/02/comcast-gets-paid-by-netflix-and-might-still-want-money-from-cogent/&quot; rel=&quot;noreferrer&quot;&gt;Netflix and Comcast&lt;/a&gt;. Comcast makes up a significant portion of Netflix’s customer base; the video streaming service was all but forced to pay up. This eventually caused &lt;a href=&quot;http://www.forbes.com/sites/greatspeculations/2014/05/15/the-impact-of-netflixs-price-rise/&quot; rel=&quot;noreferrer&quot;&gt;Netflix to raise its prices&lt;/a&gt; (however slightly), thus, altering their business model and harming consumers. If net neutrality is to fail completely, then expect more deals like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Where is the throttling occurring? Am I missing a crucial step? Is the&#xA;  'traffic' being throttled 'on the way' to the client/server somewhat&#xA;  like a tollbooth at the ISP level?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you think of throttling, think of quality of service.  Most points of the internet work on the principle of oversubscription, which makes more effective use of infrastructure.  So even if you have a 1Gb/s internet connection, you probably won't be getting 1Gb/s service. That's because Tier 1 internet providers' backbones aren’t capable of sustaining 1Gb/s for millions of customers.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I fail to see how any server can pay to have their content 'reach the&#xA;  user faster' if it is the client who generally is the speed&#xA;  limitation. From a technical perspective, how would this work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A provider has the ability to service packets as they see fit.  At micro-scale, imagine you have 2 users connected via a 100Mb connection to separate providers with each provider peering through a 100Mb connection to one another. If either provider decides those users are less important than any other customer they have, they can shape that traffic to be &lt;em&gt;lower priority&lt;/em&gt; than anything else, meaning they have the capability of being dropped &lt;em&gt;first&lt;/em&gt; if there isn’t enough bandwidth to support them.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also important to point out that those packets may not make it to the consumer at all.  It is entirely possible to drop packets altogether if they fall outside the threshold those providers provisioned.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="10827" LastEditDate="2017-07-12T21:33:17.600" LastActivityDate="2017-07-12T21:33:17.600" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="7938" PostTypeId="2" ParentId="7924" CreationDate="2014-05-15T18:09:10.550" Score="5" Body="&lt;p&gt;Each ISP can control the end-to-end experience (the speed, latency) by selectively applying Quality of service (QOS) and routing decisions based on the traffic source/destinatoin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So an ISP could provide premium (higher QOS, over higher cost/faster/fewer-hops links) service to/from service providers that pay a premium. So if Netflix pays, and gets the premium, but (for example) Hulu didn't... customers would start thinking &quot;Hulu sucks. Netflix if fast!&quot; when in reality, the invisible-to-the-user ISP service is affecting performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The big issue people have (I think) is that it means that (for example) the big players (e.g. Netflix) can spend big money for premium ISP through-carry and make it hard/impossible for small players (netflix startup competitor that might come some day) to get the same level of service to the end users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To date, the Internet has been one big level playing field &quot;in the middle&quot;; A &quot;neutral network.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(...and see Ryan Foley's answer which has more technical clarity than my attempt.)&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2014-05-15T18:09:10.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7941" PostTypeId="2" ParentId="7936" CreationDate="2014-05-15T22:10:47.507" Score="2" Body="&lt;p&gt;You don't need both inside-&gt;outside &lt;em&gt;and&lt;/em&gt; outside-&gt;inside rules. Just the &lt;em&gt;(inside,outside)&lt;/em&gt; rules will do what I think you intend??? (they apply in both directions)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;different server behind the same firewall&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's hair-pinning. No Cisco device will allow that. For it to work, the packet must &lt;em&gt;leave&lt;/em&gt; the ASA (actually be put on a wire) and come back to it, or it won't follow the required NAT logic.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-05-15T22:10:47.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7942" PostTypeId="2" ParentId="7924" CreationDate="2014-05-15T22:42:03.033" Score="6" Body="&lt;p&gt;Network neutrality is the principle that an ISP must treat all network traffic equally, regardless of source or destination.  This means that, for instance, if your ISP provides a VoIP telephone service, or a cable TV service, they can't prioritize their own offerings over third party service.&#xA;If they are allowed to prioritize their own services, then they can basically force their customers into their own non-internet offerings, simply by degrading the performance of their competitors.&#xA;The flip side of this, which is what happened to Netflix, is that, with network neutrality, the John Smith pays their ISP, and Netflix pays their ISP, and that's it.  Without net neutrality, John Smith's ISP can demand payment from Netflix in order for Netflix to be able to provide their service to John Smith.  Basically, John Smith's ISP gets paid by both John Smith and Netflix, even though Netflix is already paying their own ISP bill.&#xA;The ultimate extreme of the collapse of net neutrality is that an ISP customer in the US with relatives in England would have to pay both their US ISP, and the ISP in the UK, and the English relatives would have to pay both the US and UK ISPs, also.  Add in the ISP of every other person or company in the world that you might want to communicate with, and you'd be paying hundreds of bills every month, just to be able to use the &quot;global&quot; internet.&#xA;Basically, the ISPs want to take the internet back to the late 80s, where you had Compuserve, AOL, and a bunch of other &quot;online services&quot; that didn't actually connect to each other.  So, Compuserve customers could only access Compuserve services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The technical part of doing this is actually remarkably easy.  ISPs can prioritize traffic right now, for various reasons.  For example, VoIP traffic could be prioritized above email traffic, since VoIP requires much lower latency connections to prevent dropouts.  This is perfectly valid and legal, even with net neutrality.  It's basically just setting a rule in a router, that, say, 50% of bandwidth should be used for VoIP, 40% for web browsing, and 10% for email. But, this prioritization can also be done based on source or destination.  This is what the ISPs want to do.  So, traffic from Netflix could be set to only use 10% of Comcast's bandwidth, unless Netflix pays Comcast money, despite the fact that Netflix is not a customer of Comcast.  Meanwhile, Comcast's streaming video service could be set to use 90% of bandwidth, basically killing Netflix on Comcast's network.&lt;/p&gt;&#xA;" OwnerUserId="5705" LastActivityDate="2014-05-15T22:42:03.033" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7944" PostTypeId="2" ParentId="7924" CreationDate="2014-05-16T00:30:02.373" Score="22" Body="&lt;p&gt;This is a large issue with many nuances, and one that has valid concerns on both sides of the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get to the heart of this matter, you need to understand that the Internet is not a single entity.  It is made up of a large number of individual networks that are inter-connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A consumer pays an ISP to connect their personal network to the ISP's network.  The ISP may be paying another service provider (often more than one) to connect to their network or the ISP could be a major carrier themselves (i.e. providing large bandwidth connectivity over large geographic areas).  These larger carriers interconnect (or peer) with each other at multiple peering points (data centers where they each have a presence). The services to which the consumer wants access are either consumers themselves or may operate large networks of their own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other concept to understand is that the internet was largely built on an &quot;over-subscription&quot; model to keep costs low.  What this means is that if a ISP/carrier had a certain amount of network capacity, they might sell 10-30 times this amount of bandwidth to customers, knowing that customers don't use all the capacity they pay for 100% of the time.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With &quot;always on&quot; internet and consumers using their bandwidth more (both total and average), this ability to over subscribe has been significantly diminished. Since ISPs/carriers are looking to expand their network capacity  and don't want to increase costs to customers (who may choose to move elsewhere if they do), they are looking at other ways to increase revenues to offset the additional costs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the ways that parties are looking to increase revenues involves treating traffic differently based on the source and/or destination of the traffic.  The intent of net neutrality policies would be to prevent providers from treating traffic differently, no matter where it is sourced or destined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So let's use an example to illustrate some of the issues. To get information from a service such as Netflix a request goes from the consumer's network, to their ISP's network, possibly to one or more carrier networks (for this example, let's say A and then B), and finally to the Netflix network.  For simplicity, we will assume the reverse path is the same.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Consumer &amp;lt;--&amp;gt; ISP &amp;lt;--&amp;gt; Carrier A &amp;lt;--&amp;gt; Carrier B &amp;lt;--&amp;gt; Netflix&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If both the consumer and Netflix were connected to the same ISP/carrier, there would be no issue as the ISP/carrier would be getting paid by both parties.  However in the example I provided, the ISP is paid by the consumer and Carrier B is paid by Netflix.  Carrier A isn't compensated directly by either the consumer or Netflix, even though it may carry the data further geographically than anyone else along the path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's look at a few potential cases that already have their seeds in real world practices:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1-Carrier A&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Carrier A is passing a lot of data that isn't originated or destined for someone on their network.  They are not getting paid by either party directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Carrier A feels that since there is a large amount of data from Netflix passing through it's network (neither sourced or destined for their network), it feels that they should be further compensated for this, and wants Netflix (or possibly Carrier B) to pay them for this traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Netflix doesn't see a need to pay Carrier A, so Carrier A looks at some of the things it can do (to reduce costs for running their network, make their network better for their customers, and/or make it more desirable for Netflix to pay them):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;They can slow down Netflix's traffic unless they pay.&lt;/li&gt;&#xA;&lt;li&gt;They may choose to prioritize their traffic and anyone else's that chooses to pay them, leaving Netflix and other traffic to suffer (mainly during peak times when excess capacity may be low).&lt;/li&gt;&#xA;&lt;li&gt;They may route Netflix traffic over older/slower infrastructure to leave newer/faster infrastructure for those who paid them for it.&lt;/li&gt;&#xA;&lt;li&gt;They may refuse to carry any Netflix data, making it traverse over a longer route (i.e. instead of Carrier A data now must pass through Carrier C, Carrier, D and Carrier E before getting to the ISP).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;2-ISP with Netflix&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP on the other hand, while getting paid by the consumer notices that the vast majority of the traffic is coming from outside it's network and going to the consumer. The increased bandwidth usage means they need to expand the capacity of their network, but they don't want to increase prices to consumers, and believe Netflix should compensate them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This results in the same situation as above, with the ISP thinking along the same lines as Carrier A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3-ISP with Consumer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP decides to offer a &quot;premium&quot; service to consumers, if they want to pay more.  This would give the premium consumers' traffic priority during peak times when the ISP's network might be short on capacity.  Non-premium customers may notice increased latency and lower speeds during these times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my mind, this is an artificially created revenue stream, much like some ISPs that charged a premium for &quot;always on&quot; DSL/cable service.  They are creating a perceived need that isn't really necessary so their customers feel better about paying more for the service.  Basically, it allows them to raise their rates in a way where the consumer feels better about what they are paying for rather than getting upset.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-05-16T00:30:02.373" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="7945" PostTypeId="1" CreationDate="2014-05-16T03:31:34.293" Score="1" ViewCount="1637" Body="&lt;p&gt;I have a Ubiquiti UniFi camera and am trying to setup a NAT policy to allow external RTSP access. I can see that the policy is getting Tx packets but nothing for Rx and the video player doesn't connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The URL I'm using to access is rtsp://OUR_PUBLIC_IP:554/live/ch02_0 but no luck. When I view the active connections on the SonicWALL I see my connection come in but the source port seems to always change (in the 59000 range) so I wonder if that's messing up the translation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JKPFg.jpg&quot; alt=&quot;This is what I see in the Active Connections Monitor&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a shot of the actual policy. You'll notice #2 and #3 are similar but only #3 is enabled - this is just from various testing. the Video Camera - Lobby service maps to the internal IP of the camera; Video Camera Port - Standard maps to TCP port 554 (same as RTSP service object below it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dADLg.jpg&quot; alt=&quot;NAT Policy View&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions would be great appreciated.&lt;/p&gt;&#xA;" OwnerUserId="5711" LastActivityDate="2014-05-16T18:09:11.287" Title="Setup NAT Policy for RTSP on SonicWALL TZ105" Tags="|firewall|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7946" PostTypeId="1" CreationDate="2014-05-16T13:28:52.787" Score="0" ViewCount="241" Body="&lt;p&gt;how can I find Net mask address in the rage: 192.16.128.0 to 192.16.135.255 &#xA;Note: I want to use Classless Inter-Domain Routing so net mask should not be multiple of 8. what should we calculate it for &lt;strong&gt;every different range&lt;/strong&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="5716" LastEditorUserId="3191" LastEditDate="2014-12-08T20:31:12.127" LastActivityDate="2014-12-08T20:31:12.127" Title="Calculating Netmask address in specified range" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="0" ClosedDate="2014-05-16T16:48:42.543" ContentLicense="CC BY-SA 3.0" />
  <row Id="7947" PostTypeId="2" ParentId="7946" CreationDate="2014-05-16T13:34:06.057" Score="0" Body="&lt;p&gt;If you write those addresses in binary, you get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11000000 00010000 10000000 00000000 = 192.16.128.0&#xA;11000000 00010000 10000111 11111111&#xA;| ----- 21 bits ----- |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the addresses have the same first 21 bits, the mask is then /21 (255.255.248.0) .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise you can do it in the head for simple case: x.x.x.0-255 is /24, two of those networks (starting on an even number) are /23, 4 are /22, 8 are /21 (135-128=8). &lt;/p&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="1220" LastEditDate="2014-05-16T17:22:19.140" LastActivityDate="2014-05-16T17:22:19.140" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7948" PostTypeId="1" CreationDate="2014-05-16T14:12:33.260" Score="3" ViewCount="2074" Body="&lt;p&gt;To facilitate WAN optimization Cisco has several options available.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One option is to deploy 2 (or more) WAAS capable routers e.g. 1941 with WAAS software (and the maximum RAM) talking to each other.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then there is also a WAE option. This is a storage box with a harddisk, cpu and RAM.&lt;br&gt;&#xA;I'm not sure what the WAE provides on top of just the router with WAAS software.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: what is the difference between the two.&lt;br&gt;&#xA;Do I need both options if I want WAAS to work in my WAN, or is the WAE an optional extension?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so what extra does it provide?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I've had a look at the Cisco documentation available, but it just confuses me.  They don't clearly differentiate the difference between the options and whether something is optional or required.&lt;/em&gt; &lt;/p&gt;&#xA;" OwnerUserId="5718" LastActivityDate="2014-05-17T14:00:02.740" Title="What's the difference between Cisco WAAS en WAE" Tags="|cisco|waas|wan-optimizer|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7949" PostTypeId="1" AcceptedAnswerId="7952" CreationDate="2014-05-16T14:20:09.513" Score="8" ViewCount="60830" Body="&lt;p&gt;Googling around to see if this setup on one port is correct (it doesn't look right to me), I'm not really seeing a straightforward answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an interface with the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet1/0/3&#xA; description Uplink to Server Room&#xA; switchport access vlan 100&#xA; switchport mode trunk&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's been like that for some time, and no issues that I know of. The question is, if the port is in trunk mode as opposed to access mode, then does the &lt;code&gt;switchport access vlan&lt;/code&gt; do anything at all?? Can it be safely removed without screwing up something else? What possible reason could those two commands be there in the first place for??&lt;/p&gt;&#xA;" OwnerUserId="5006" LastActivityDate="2021-05-16T13:15:46.670" Title="Switchport mode access VLAN &amp; switchport mode trunk on one interface" Tags="|cisco|switch|vlan|cisco-ios|trunk|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7950" PostTypeId="2" ParentId="7949" CreationDate="2014-05-16T14:31:39.607" Score="6" Body="&lt;p&gt;If you use the port as trunk you can safely remove the switchport access vlan 100 line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you set the &quot;mode trunk&quot; in fact the port act as a trunk, the &quot;switchport access vlan 100&quot; still in the configuration doesn't affect the operational mode of the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To view details on the operational mode of your port try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interfaces GigabitEthernet 1/0/3 switchport&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3615" LastActivityDate="2014-05-16T14:31:39.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7951" PostTypeId="2" ParentId="7949" CreationDate="2014-05-16T14:49:57.697" Score="2" Body="&lt;p&gt;Trunk ports pass all vlan data unless otherwise specified within the &lt;strong&gt;Switchport Mode Trunk&lt;/strong&gt;&#xA;command. So at this point, the switchport access command does nothing. If the user who configured this switch had the intention of limiting the data that passed through this trunk to only 1 vlan, he or she should have used &lt;strong&gt;Switchport Trunk Allowed Vlan 100&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2014-05-16T14:49:57.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7952" PostTypeId="2" ParentId="7949" CreationDate="2014-05-16T15:04:12.287" Score="17" Body="&lt;p&gt;No this isn't doing anything.  When the port is in trunk mode, then any &quot;switchport access&quot; statements are not used.  The same is true with a port in access mode with any &quot;switchport trunk&quot; statements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, you should be able to safely remove it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose for this is usually in the use of DTP (dynamic trunking protocol).  So you &lt;em&gt;could&lt;/em&gt; configure a port as both a trunk (with &quot;switchport trunk&quot; statements) and an access port (with &quot;switchport access&quot; statements).  When the link negotiates as a trunk, it will have the correct trunk configuration and if it doesn't negotiate as a trunk, it will have the correct access configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When DTP is not used, there is little point to it.  I personally have this configured on some of my lab ports, so I can just switch the switchport mode depending on what I am conneting on the ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often in the wild, I have found this type of configuration where devices are staged using access ports and then never cleaned up when it is configured to use a trunk port when deployed.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-05-16T15:04:12.287" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="7955" PostTypeId="1" CreationDate="2014-05-16T16:08:02.563" Score="1" ViewCount="243" Body="&lt;p&gt;I am trying to find the MIBs given by IETF(through RFCs) or maintained by private access point manufacturers, which support Wifi 802.11 client associations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example my Institute uses Airespace access points with a central controller from Cisco, and hence supports &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.14179.2.6.3.53#oidContent&quot; rel=&quot;nofollow&quot;&gt;bsnDot11StationAssociate&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which other enterprise MIBs from among Ericsson, Netgear, LinkSys or Cisco offer a similar object? ( giving the OID, or relevant subtrees of the MIBs)&lt;/p&gt;&#xA;" OwnerUserId="5593" LastEditorUserId="5593" LastEditDate="2014-05-16T16:36:14.430" LastActivityDate="2014-05-16T16:44:39.380" Title="Which MIBs support objects for 802.11 Client Associations with Client MAC addresses?" Tags="|wireless|snmp|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7956" PostTypeId="2" ParentId="7945" CreationDate="2014-05-16T18:09:11.287" Score="2" Body="&lt;p&gt;Your NAT policy has some problems.  Currently you're translating source traffic to your WAN IP, and then translating any destination traffic to the camera.  It kinda works, but it's not correct.  This is what the setup should look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Original Source: Any&#xA;TranslatedSource : Original&#xA;Original Destination: WAN Primary IP&#xA;Translated Destination: Video Camera - Lobby&#xA;Original Service: Video Camera/RTSP (whatever you call it)&#xA;Translated Service: Original.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Try that and let us know.  Make sure there's a firewall rule allowing the RTSP traffic to the WAN Primary IP.&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2014-05-16T18:09:11.287" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="7957" PostTypeId="1" CreationDate="2014-05-16T19:24:26.613" Score="2" ViewCount="65" Body="&lt;p&gt;I have two sites that are connected using a pair of Motorola Canopy 5.7 Ghz backhaul units.  They have been working for years without a problem but this morning we had a power outage for a few hours and now when we brought everything back online I cannot get the point to point connect to re-establish.  What's odd is Site A (Master) cannot see either Canopy unit at all, but Site B (Slave) can see both Canopy units but cannot see any other device at Site A.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've checked to make sure there isn't an IP conflict on the network, changed plugs on the switch to make sure it wasn't bad, even ran a new ethernet cable to the switch from the Canopy unit.  Any ideas on what might be going on?&lt;/p&gt;&#xA;" OwnerUserId="5729" LastActivityDate="2014-05-20T13:19:29.147" Title="What could cause a previously working point to point to be accessible from only one side?" Tags="|routing|troubleshooting|management|point-to-point|" AnswerCount="1" CommentCount="4" ClosedDate="2019-05-11T00:26:27.327" ContentLicense="CC BY-SA 3.0" />
  <row Id="7958" PostTypeId="1" CreationDate="2014-05-16T19:44:39.067" Score="3" ViewCount="245" Body="&lt;p&gt;Here's the scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I replaced 2 core switches (3550 catalysts - 12G) on Wednesday. I have configured the VTP and added the VLANs to the database. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My core and ethernet switches can ping to the DHCP server. However, (most) of the end users are not receiving IP addresses. I have verified that the FastEthernet ports are correctly configured for the appropriate VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help!&lt;/p&gt;&#xA;" OwnerUserId="5730" LastActivityDate="2014-05-16T21:09:53.367" Title="No Access to DHCP Server" Tags="|switch|vlan|dhcp|fiber|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7959" PostTypeId="2" ParentId="7958" CreationDate="2014-05-16T20:40:10.197" Score="2" Body="&lt;p&gt;Ensure &lt;em&gt;dhcp snooping&lt;/em&gt; and &lt;em&gt;dhcp snooping trust&lt;/em&gt; isn't interfering with the server answers. If the switch(es) are acting as the inter-vlan router, they also need to be handling dhcp relay duty -- which will add &lt;em&gt;giaddr&lt;/em&gt; (gateway) to requests so the server knows how to answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg. from my lab switches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp snooping vlan ...&#xA;ip dhcp snooping&#xA;interface Port-channel1&#xA; switchport trunk allowed vlan ...&#xA; switchport mode trunk&#xA; ip dhcp snooping trust&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(upstream of this cisco is a nortel switch, then an hp switch, and the dhcp server)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-05-16T20:40:10.197" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7960" PostTypeId="2" ParentId="7958" CreationDate="2014-05-16T21:09:53.367" Score="3" Body="&lt;p&gt;Assuming your DHCP server is on a different VLAN than your users, check that you have your ip helper correctly configured.  On the SVI (Vlan interface) of your user vlans you should have&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip helper-address a.b.c.d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where a.b.c.d is the IP address of your DHCP server&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-05-16T21:09:53.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7964" PostTypeId="2" ParentId="7948" CreationDate="2014-05-17T14:00:02.740" Score="3" Body="&lt;p&gt;Yes, generally you need at least one WAE device for the head-end or Core. For a very simple point to point scenario it is possible to use two routers running Express, but the optimization will be relatively low since DRE won't be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I recall the software version in the 1941 is only WAAS Express, which does not save the data to disk. This has major limitations because a feature like DRE which is deduplication needs quite large disk space to work most efficiently. Due to memory limitations, DRE is disabled on the 1921, which further limits the efficiency of the optimization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The WAE/WAVE appliances are the real deal that provide the full feature set. A while ago Cisco had a few small WAE modules for the first generation ISR's like the 2800. These modules had a CPU and laptop hard drive which provided the required resources for the advanced features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a minimal and simple Wan Optimization solution, then the WAAS Express could be an option. If the requirement is to reduce network traffic volumes, look for something that stores the deduplication data on disk.&lt;/p&gt;&#xA;" OwnerUserId="3308" LastActivityDate="2014-05-17T14:00:02.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7965" PostTypeId="1" AcceptedAnswerId="7966" CreationDate="2014-05-17T17:50:28.520" Score="3" ViewCount="6883" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UDHvb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in this diagram we have same ABR and ASBR,this router functions as an ABR between area 1 and zero,plus it works as an ASBR and redistribute external routes from some other routing domain to OSPF domain, so the question is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;why do we need to have an NSSA in here? I mean this router has got one interface in Area 0 and one in Area 1,and one in some other routing domain,it does not belong to a particular area(does not have all its interfaces in one single,individual area)so waht's the reason to have a NSSA in here?and if we are supposed to have NSSA which area will be that?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;refereed to this document &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/6208-nssa.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/6208-nssa.html&lt;/a&gt; in which talks about &quot;Bit P&quot; and it says &quot;This happens when NSSA ASBR is also an NSSA ABR.&quot; so why on the earth in this case do we need to have NSSA? it's so confusing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you&lt;/p&gt;&#xA;" OwnerUserId="5420" LastActivityDate="2018-05-31T14:03:35.150" Title="if ABR and ASBR both are the same in OSPF,what might be reason to use NSSA?" Tags="|cisco|ospf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7966" PostTypeId="2" ParentId="7965" CreationDate="2014-05-17T18:54:29.967" Score="3" Body="&lt;p&gt;You don't need area 1 to be NSSA if it is not a stub area.  In that case, the external routes are flooded into both area 1 and 0.  But if you want area 1 to be stubby, meaning that it doesn't receive any external LSAs from other areas, then it must be NSSA, because it is injecting external routes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The external routes are flooded in both areas. But if area 1 is a stub, the routers don't forward type 5 LSAs  The only external routes that can be flooded in a stub area are type 7, which by definition makes it a NSSA area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason the P bit is not set is because the router is already injecting type 5 LSAs into area 0, so there's no need for translating type 7 to type 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, area 0 is never a stub or nssa.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-05-17T18:54:29.967" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7973" PostTypeId="1" CreationDate="2014-05-18T20:39:47.490" Score="3" ViewCount="1294" Body="&lt;p&gt;I have Area 0 and Area 1, Area 1 is configured as NSSA and there is this router R3 in this area that works as ASBR and redistributing/injecting some external routes from some other routing domain into Area 1, I know Type 7 LSA allows injection of external routes through Not-so-Stubby-Areas (NSSA), and I know since type 5 LSA  are not allowed inside any stub area, Type 7 LSA is used, to trick OSPF. Type 7 LSA is generated by NSSA ASBR and is translated into type 5 LSA as it leaves the area by NSSA ABR, which is then propagated throughout the network as type 5 LSA, so please do not state the obvious.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is it possible to summarize routes that come from other routing domain through NSSA ASBR in mentioned scenario?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I got these static routes on my NSSA ASBR and I want to summarize them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.0/24&#xA;192.168.2.0/24&#xA;192.168.3.0/24&#xA;192.168.4.0/24&#xA;192.168.5.0/24&#xA;192.168.6.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to summarize them to one single route like &lt;code&gt;192.168.0.0/21&lt;/code&gt;, and then inject them to ospf routing domain, through NSSA ASBR, is that possible to do on a Cisco router? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've already tried summary-address command on NSSA ASBR, but it didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you&lt;/p&gt;&#xA;" OwnerUserId="5420" LastEditorUserId="3191" LastEditDate="2014-05-18T21:23:01.810" LastActivityDate="2014-07-13T00:32:24.300" Title="How to Summarize LSA Type 7/NSSA ASBR External routes?" Tags="|cisco|routing|router|ospf|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="7974" PostTypeId="2" ParentId="7928" CreationDate="2014-05-19T03:26:52.070" Score="23" Body="&lt;p&gt;Here's a link to a &lt;a href=&quot;https://www.youtube.com/watch?v=17GtmwyvmWE&amp;amp;feature=share&amp;amp;t=26m18s&quot; rel=&quot;noreferrer&quot;&gt;Hangout with Vint Cerf&lt;/a&gt; (Apr. 2014) where he explains how he thought that this internet was supposed to be an experiment only:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As we were thinking about the Internet (thinking well, this is going to be some arbitrary number of networks all interconnected &amp;mdash; we don't know how many and we don't know how they'll be connected), but &lt;em&gt;national&lt;/em&gt; scale networks we thought &quot;&lt;strong&gt;well, maybe there'll be two per country&lt;/strong&gt;&quot; (because it was expensive: at this point Ethernet had been invented but it wasn't proliferating everywhere, as it did do a few years later).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Then we said &quot;&lt;strong&gt;how many countries are there?&lt;/strong&gt;&quot; (two networks per country, how many networks?) and we didn't have Google to ask, so &lt;strong&gt;we guessed at 128&lt;/strong&gt; and that would be 2 times 128 is 256 networks (that's 8 bits) and then we said &quot;&lt;strong&gt;how many computers will there be on each network?&lt;/strong&gt;&quot; and we said &quot;&lt;strong&gt;how about 16 million?&lt;/strong&gt;&quot; (that's another 24 bits) so we had a 32-bit address which allowed 4.3 &lt;em&gt;billion&lt;/em&gt; terminations &amp;mdash; which I thought in 1974/3 was enough to do the experiment!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I had already posted this as a comment to Jens Link's answer, but I felt it shoud surface a bit more.&lt;/p&gt;&#xA;" OwnerUserId="3390" LastEditorUserId="33369" LastEditDate="2017-01-08T16:04:34.503" LastActivityDate="2017-01-08T16:04:34.503" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="7975" PostTypeId="1" CreationDate="2014-05-19T07:41:17.387" Score="5" ViewCount="5335" Body="&lt;p&gt;If I have a configuration on a Cisco switch;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   int Gi 0/48&#xA;    switchport mode trunk&#xA;    switchport trunk native vlan 100&#xA;    switchport trunk allowed vlan 101-110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configuration on a Zyxel Switch is abit more complicated as the port has to be a member of the vlans it will Tag and untag. but the PVID is set to only one VLAN ID. Tx_tag is set to Untag_PVID on the trunk port facing the cisco switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However this does not work,&#xA;My question is in Zyxel is the PVID the native vlan of the switch port? &lt;/p&gt;&#xA;" OwnerUserId="3539" LastActivityDate="2014-12-26T13:51:32.980" Title="Native VLAN on Trunk port of Zyxel GS1910" Tags="|cisco|switch|vlan|trunk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7976" PostTypeId="1" AcceptedAnswerId="12986" CreationDate="2014-05-19T12:03:00.490" Score="2" ViewCount="3319" Body="&lt;p&gt;&lt;em&gt;Disclaimer:&lt;/em&gt; I am not a network engineer but a software engineer so I may muddle my terminology, feel free to correct me where I go wrong!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My understanding of our set-up is:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a Netscaler (lets say F5) with valid (signed/trusted CA) SSL Certificates installed that are returned to clients. The Netscaler in turn communicates with our back-end servers running Windows 2008R2 and IIS 7 etc. These serve up websites/services via HTTPS (443) with their own certificates... However, these certificates may &lt;strong&gt;NOT&lt;/strong&gt; be valid/trusted/signed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my world of &quot;direct&quot; communications I know that I would expect to see an error/warning saying that the certificate cannot be trusted. However, I am unsure how Netscaler would handle this condition. Would it return an error to the client or simply relay the data with Netscalers valid certificate? Would it throw some kind of error? Is this configurable etc?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much.&lt;/p&gt;&#xA;" OwnerUserId="5752" LastEditorUserId="8499" LastEditDate="2018-02-16T04:28:14.723" LastActivityDate="2018-02-16T04:28:14.723" Title="Does Netscaler authenticate the back-end server's certificate?" Tags="|routing|load-balancer|f5|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7978" PostTypeId="1" AcceptedAnswerId="7980" CreationDate="2014-05-19T12:52:01.387" Score="4" ViewCount="717" Body="&lt;p&gt;This seems fairly straight forward, though I'm having trouble finding a solution on Google and in the Cisco documentation. I think I'm perhaps just not looking for the correct thing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially I want to block all outgoing SMTP traffic except for our mail server, currently only the DHCP range is blocked, but I wanted to narrow that down to just the mail server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 107 deny   tcp 10.1.3.0 0.0.0.255 any eq smtp&#xA;access-list 107 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried (but completely locked out all network connections and required a power cycle):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 107 deny   tcp any any eq smtp&#xA;access-list 107 permit tcp host 10.1.1.20 any eq smtp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I wish to block SMTP outgoing for all hosts except 10.1.1.20, how can this be done? What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="2858" LastEditorUserId="775" LastEditDate="2014-05-19T13:09:20.320" LastActivityDate="2014-05-19T15:26:44.070" Title="Block port with single exception on Cisco 803" Tags="|cisco|router|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7980" PostTypeId="2" ParentId="7978" CreationDate="2014-05-19T14:08:07.397" Score="4" Body="&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 107 permit tcp host 10.1.1.20 any eq smtp&#xA;access-list 107 deny   tcp any any eq smtp&#xA;access-list 107 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Keep in mind, the order you &lt;strong&gt;insert&lt;/strong&gt; a standard ACL in Cisco routers is the order in which the directives are matched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;First allow your server &lt;code&gt;10.1.1.20&lt;/code&gt; to connect to &lt;code&gt;smtp&lt;/code&gt; port&lt;/li&gt;&#xA;&lt;li&gt;Then &lt;strong&gt;disallow&lt;/strong&gt; any other host to connect to &lt;code&gt;smtp&lt;/code&gt; port&lt;/li&gt;&#xA;&lt;li&gt;Finally, allow any other IP communication&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1035" LastEditorUserId="3191" LastEditDate="2014-05-19T15:26:44.070" LastActivityDate="2014-05-19T15:26:44.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7982" PostTypeId="1" AcceptedAnswerId="8019" CreationDate="2014-05-19T16:29:03.650" Score="3" ViewCount="951" Body="&lt;p&gt;When we configure OSPF routers with MD5 authentication, a message digest is created, which is the combination of a pre-defined &lt;em&gt;message-digest-key&lt;/em&gt; which has been run through the &lt;em&gt;MD5 algorithm&lt;/em&gt;; that must be the same between routers of an area, for example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;message-digest-key = cisco&lt;/li&gt;&#xA;&lt;li&gt;md5(&quot;cisco&quot;) = &quot;dfeaf10390e560aea745ccba53e044ed&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;My Question&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What part of the packet is checksummed by this MD5 hash?&lt;/li&gt;&#xA;&lt;li&gt;Does OSPF check the whole packet? or what exactly?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Please include your references.&lt;/p&gt;&#xA;" OwnerUserId="5420" LastEditorUserId="775" LastEditDate="2014-05-19T18:32:34.000" LastActivityDate="2018-03-07T10:08:34.487" Title="Does OSPF use a packet checksum using MD5?" Tags="|cisco|routing|ospf|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7983" PostTypeId="2" ParentId="7982" CreationDate="2014-05-19T16:35:50.567" Score="5" Body="&lt;p&gt;From the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;            (c) The MD5 authentication algorithm is run over the&#xA;                concatenation of the OSPF packet, secret key, pad&#xA;                and length fields, producing a 16 byte message&#xA;                digest (see [Ref17]).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-05-19T16:35:50.567" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7984" PostTypeId="2" ParentId="7920" CreationDate="2014-05-19T18:58:26.850" Score="3" Body="&lt;p&gt;Well, You can extend the LANs with L2TPv3 and protect the setup with IPsec.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's example configuration:&#xA;&lt;a href=&quot;https://www.softether.org/index.php?title=4-docs/2-howto/L2TP//IPsec_Setup_Guide_for_SoftEther_VPN_Server/Cisco_IOS_L2TPv3//IPsec_Edge-VPN_Router_Setup&quot; rel=&quot;nofollow&quot;&gt;https://www.softether.org/index.php?title=4-docs/2-howto/L2TP//IPsec_Setup_Guide_for_SoftEther_VPN_Server/Cisco_IOS_L2TPv3//IPsec_Edge-VPN_Router_Setup&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here's another one, modern, using FlexVPN - unfortunately, depending on your IOS version, you may not be able to use it:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/flexvpn/116207-configure-l2tpv3-00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security/flexvpn/116207-configure-l2tpv3-00.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some testing for that kind of setups, bear in mind transporting all the L2 traffic over IP will cost you bandwidth. If you need any help in setup/troubleshooting, let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for more obvious problem - connecting 891's to ISPs - just point default network to them as gateway. From this setup the routing itself is typical in terms of configuration.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="286" LastEditDate="2014-05-19T19:04:06.753" LastActivityDate="2014-05-19T19:04:06.753" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="7985" PostTypeId="1" CreationDate="2014-05-19T20:16:30.003" Score="5" ViewCount="2843" Body="&lt;p&gt;Due to the fact we've gotten a tremendous internet upgrade, I have attempted to setup a traffic policing rule at our local ASA.  Currently one of our offices has a 1GB internet uplink which saturates some of the lower speed offices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm attempting to blanket-rate-limit all esp traffic out of that site with the below configuration.  My understanding of this rule would be that &quot;all esp protocol traffic traversing NYHQ-OUTSIDE_COGENT would be rate limited to 8kb/sec&quot; however both sending and receiving through that interface runs at a blistering 60 megabytes per second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone point out where I am making a mistake?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: This is the sh inv for the ASA in question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;NYHQ-ASA# sh inv&#xA;Name: &quot;Chassis&quot;, DESCR: &quot;ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC&quot;&#xA;PID: ASA5515&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&lt;code&gt;&#xA;access-list NYHQ-OUTSIDE_COGENT_mpc extended permit esp any any&#xA;&#xA;class-map Cogent-Class&#xA; match access-list NYHQ-OUTSIDE_COGENT_mpc&#xA;&#xA;policy-map Cogent-Policy&#xA; class Cogent-Class&#xA;  police input 8000&#xA;  police output 8000&#xA;!&#xA;service-policy Cogent-Policy interface NYHQ-OUTSIDE_COGENT&#xA;&lt;/code&gt;&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="154" LastEditorUserId="154" LastEditDate="2014-05-19T20:43:52.520" LastActivityDate="2014-06-06T09:21:26.203" Title="How do I implement Traffic Policing between two ASAs for IPSec traffic?" Tags="|cisco-asa|policing|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="7989" PostTypeId="1" AcceptedAnswerId="7992" CreationDate="2014-05-19T22:07:59.247" Score="9" ViewCount="7020" Body="&lt;p&gt;Is anyone familiar with an approach to generate a list of subnets on a particular switch (let's pick a more popular one - Cisco) using SNMP? How about a list of VLANs? If so, can you point me to the MIBs / OIDs involved? (network newbie here)&lt;/p&gt;&#xA;" OwnerUserId="5758" LastActivityDate="2016-05-03T14:13:55.323" Title="Generate list of subnets on switch using SNMP?" Tags="|cisco|switch|snmp|subnet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7990" PostTypeId="2" ParentId="7989" CreationDate="2014-05-19T22:46:02.103" Score="0" Body="&lt;p&gt;Switchmap will do all of this for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://sourceforge.net/projects/switchmap/&quot; rel=&quot;nofollow&quot;&gt;http://sourceforge.net/projects/switchmap/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5759" LastActivityDate="2014-05-19T22:46:02.103" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="7992" PostTypeId="2" ParentId="7989" CreationDate="2014-05-20T03:16:19.903" Score="8" Body="&lt;h2&gt; &lt;strong&gt;Interfaces/IP Addressing:&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you're looking to poll a device's IP address, subnet mask and corresponding interface you can use the following OIDs from the &lt;a href=&quot;http://www.net-snmp.org/docs/mibs/ip.html&quot;&gt;IP-MIB&lt;/a&gt; and &lt;a href=&quot;http://www.net-snmp.org/docs/mibs/interfaces.html&quot;&gt;IF-MIB&lt;/a&gt; MIBs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;.1.3.6.1.2.1.4.20.1.1&lt;/code&gt; - The IP address can be found at this OID&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~]$ snmptranslate .1.3.6.1.2.1.4.20.1.1&#xA;IP-MIB::ipAdEntAddr&#xA;&#xA;~]$ snmpwalk -v2c -c cisco 10.30.46.1 .1.3.6.1.2.1.4.20.1.1&#xA;IP-MIB::ipAdEntAddr.10.30.46.1 = IpAddress: 10.30.46.1&#xA;IP-MIB::ipAdEntAddr.25.255.25.254 = IpAddress: 25.255.25.254&#xA;IP-MIB::ipAdEntAddr.55.44.33.22 = IpAddress: 55.44.33.22&#xA;IP-MIB::ipAdEntAddr.172.31.10.10 = IpAddress: 172.31.10.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;.1.3.6.1.2.1.4.20.1.3&lt;/code&gt; - The subnet mask cane be found at this OID&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~]$ snmptranslate .1.3.6.1.2.1.4.20.1.3&#xA;IP-MIB::ipAdEntNetMask&#xA;&#xA;~]$ snmpwalk -v2c -c cisco 10.30.46.1 .1.3.6.1.2.1.4.20.1.3&#xA;IP-MIB::ipAdEntNetMask.10.30.46.1 = IpAddress: 255.255.255.0&#xA;IP-MIB::ipAdEntNetMask.25.255.25.254 = IpAddress: 255.255.255.0&#xA;IP-MIB::ipAdEntNetMask.55.44.33.22 = IpAddress: 255.255.255.0&#xA;IP-MIB::ipAdEntNetMask.172.31.10.10 = IpAddress: 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;.1.3.6.1.2.1.4.20.1.2&lt;/code&gt; - The interface index (&lt;a href=&quot;http://www.net-snmp.org/docs/mibs/interfaces.html#ifTable&quot;&gt;ifTable Indexes&lt;/a&gt;) are unique integers for each interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~]$ snmptranslate .1.3.6.1.2.1.4.20.1.2&#xA;IP-MIB::ipAdEntIfIndex&#xA;&#xA;~]$ snmpwalk -v2c -c cisco 10.30.46.1 .1.3.6.1.2.1.4.20.1.2&#xA;IP-MIB::ipAdEntIfIndex.10.30.46.1 = INTEGER: 1&#xA;IP-MIB::ipAdEntIfIndex.25.255.25.254 = INTEGER: 5&#xA;IP-MIB::ipAdEntIfIndex.55.44.33.22 = INTEGER: 6&#xA;IP-MIB::ipAdEntIfIndex.172.31.10.10 = INTEGER: 7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;.1.3.6.1.2.1.2.2.1.2&lt;/code&gt; - The interface friendly name can be found at this OID and the ifTable index is appended (eg. &lt;code&gt;...2.1.2.[INDEX]&lt;/code&gt;) for each interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~]$ snmptranslate .1.3.6.1.2.1.2.2.1.2&#xA;IF-MIB::ifDescr&#xA;&#xA;~]$ snmpwalk -v2c -c cisco 10.30.46.1 .1.3.6.1.2.1.2.2.1.2&#xA;IF-MIB::ifDescr.1 = STRING: FastEthernet0/0&#xA;IF-MIB::ifDescr.2 = STRING: FastEthernet0/1&#xA;IF-MIB::ifDescr.4 = STRING: Null0&#xA;IF-MIB::ifDescr.5 = STRING: Loopback0&#xA;IF-MIB::ifDescr.6 = STRING: Tunnel10&#xA;IF-MIB::ifDescr.7 = STRING: Dialer1&#xA;IF-MIB::ifDescr.8 = STRING: Virtual-Access1&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can walk these OIDs manually, script something out in the language of your choice, or use much smarter programs/scripts similar to what's mentioned in Tim Peck's answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a quick (and dirty) shell example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/bash&#xA;# duct taped by one.time&#xA;# Basic interface information collector&#xA;&#xA;##&#xA;# Set usage var and getoptions&#xA;usage=&quot;Usage: interface-info.sh -H &amp;lt;IP Address&amp;gt; -C &amp;lt;snmp community string&amp;gt;&#xA;&#xA;OPTIONS:&#xA;  -H Hostname          set IP address or hostname&#xA;  -h Help              prints usage options&#xA;&#xA;SNMPv2 OPTIONS:&#xA;  -C Community         set SNMPv2 community string&#xA;&quot;&#xA;&#xA;while getopts H:C:h option;&#xA;do&#xA;        case $option in&#xA;                H) ipaddress=$OPTARG;;&#xA;                C) community=$OPTARG;;&#xA;                h) echo &quot;$usage&quot;&#xA;                exit $invalid_result;;&#xA;        esac&#xA;done&#xA;&#xA;##&#xA;# Prevent blank argvars&#xA;if [[ -z $ipaddress || -z $community ]]; then&#xA;  echo &quot;$usage&quot;&#xA;  exit 0&#xA;fi&#xA;&#xA;## &#xA;# Set field separator to new line&#xA;IFS=$'\n'&#xA;&#xA;##&#xA;# Store our IP-MIB info in arrays&#xA;ipAdEntAddr=( $(snmpbulkwalk -v2c -c $community  $ipaddress .1.3.6.1.2.1.4.20.1.1 | awk -F &quot;: &quot; '{print $2}') )&#xA;ipAdEntNetMask=( $(snmpbulkwalk -v2c -c $community $ipaddress .1.3.6.1.2.1.4.20.1.3 | awk -F &quot;: &quot; '{print $2}') )&#xA;ipAdEntIfIndex=( $(snmpbulkwalk -v2c -c $community $ipaddress .1.3.6.1.2.1.4.20.1.2 | awk -F &quot;: &quot; '{print $2}') )&#xA;&#xA;for ((i=0; i&amp;lt;${#ipAdEntAddr[@]}; i++)); do&#xA;  ifDescr[$i]=$(snmpwalk -v2c -c $community $ipaddress .1.3.6.1.2.1.2.2.1.2.${ipAdEntIfIndex[$i]} | awk -F &quot;: &quot; '{print $2}')&#xA;  echo &quot;${ifDescr[$i]}: ${ipAdEntAddr[$i]} ${ipAdEntNetMask[$i]}&quot;&#xA;done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~]$ ./interface-info.sh -H 10.30.46.1 -C cisco&#xA;FastEthernet0/0: 10.30.46.1 255.255.255.0&#xA;Loopback0: 25.255.25.254 255.255.255.0&#xA;Tunnel10: 55.44.33.22 255.255.255.0&#xA;Dialer1: 172.31.10.10 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;VLANs:&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you're looking for the VLAN IDs and VLAN names you can use the following OID:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;.1.3.6.1.4.1.9.9.46.1.3.1.1.4.1&lt;/code&gt; The &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.46.1.3.1.1.4&quot;&gt;vtpVlanName&lt;/a&gt; can be found (on Cisco devices) at this OID and the VLAN-ID can be found appended, e.g.: &lt;code&gt;...1.4.1.[VLAN-ID]&lt;/code&gt; (similar to the ifIndex and ifDescr example above). &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~]$ snmptranslate  .1.3.6.1.4.1.9.9.46.1.3.1.1.4.1&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1&#xA;&#xA;~]$ snmpwalk -v2c -c cisco 192.168.0.8 SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1.1 = STRING: &quot;default&quot;&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1.10 = STRING: &quot;VLAN0010&quot;&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1.21 = STRING: &quot;VLAN0021&quot;&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1.100 = STRING: &quot;VLAN0100&quot;&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1.344 = STRING: &quot;VLAN0344&quot;&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1.456 = STRING: &quot;iSCSI-TRAFFIC&quot;&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1.1002 = STRING: &quot;fddi-default&quot;&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1.1003 = STRING: &quot;token-ring-default&quot;&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1.1004 = STRING: &quot;fddinet-default&quot;&#xA;SNMPv2-SMI::enterprises.9.9.46.1.3.1.1.4.1.1005 = STRING: &quot;trnet-default&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Manual example of scraping the VLAN IDs:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ~]$ snmpbulkwalk -v2c -c cisco 192.168.0.8 1.3.6.1.4.1.9.9.46.1.3.1.1.4 | sed -e 's/.*4.1.\(.*\) =.*/\1/'&#xA;    1&#xA;    10&#xA;    21&#xA;    100&#xA;    344&#xA;    456&#xA;    1002&#xA;    1003&#xA;    1004&#xA;    1005&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2476" LastEditorUserId="2476" LastEditDate="2014-05-20T04:14:50.553" LastActivityDate="2014-05-20T04:14:50.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="7999" PostTypeId="1" AcceptedAnswerId="8005" CreationDate="2014-05-20T12:11:00.617" Score="6" ViewCount="17539" Body="&lt;p&gt;A beginner question: Why we need to assign IP addresses on LAN if switches are not able to read them? Because of ARP (Address Resolution Protocol)? But Switches can't send ARP requests (switches can't read ipv ), right? Who sends the ARP request then? &lt;/p&gt;&#xA;" OwnerUserId="5766" LastEditorUserId="8499" LastEditDate="2018-03-19T18:15:41.447" LastActivityDate="2018-03-19T18:15:41.447" Title="Why we need IP address on LAN if switches can't read IP addresses" Tags="|switch|ipv4|lan|ip-address|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8001" PostTypeId="2" ParentId="7957" CreationDate="2014-05-20T13:19:29.147" Score="1" Body="&lt;p&gt;When a power outage occurs, any unsaved configurations will be dropped by your devices. In this case, your port configuration reverted to an older version. &lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2014-05-20T13:19:29.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8004" PostTypeId="1" AcceptedAnswerId="8009" CreationDate="2014-05-20T15:43:42.197" Score="3" ViewCount="1495" Body="&lt;p&gt;we have several cisco 7225 vxr deployed on our network and we have an issue on SNMP access. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On last new deployment, we can't reach the last router implemented through SNMP. Comparing two router with similar config (change only IP address) rest it's the same, we can't reach on SNMP the last deployed Router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From our monitoring server, we can ping both machine 10.30.0.12 and 10.30.0.40. &#xA;And we reach over SNMP 10.30.0.12 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output server :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MON # ping 10.30.0.12&#xA;PING 10.30.0.12 (10.30.0.12): 56 data bytes&#xA;64 bytes from 10.30.0.12: icmp_seq=0 ttl=254 time=1.288 ms&#xA;64 bytes from 10.30.0.12: icmp_seq=1 ttl=254 time=1.270 ms&#xA;^C&#xA;--- 10.30.0.12 ping statistics ---&#xA;2 packets transmitted, 2 packets received, 0.0% packet loss&#xA;round-trip min/avg/max/stddev = 1.270/1.279/1.288/0.009 ms&#xA;MON # snmpwalk -v 2c -c comm3 10.30.0.12&#xA;^C&#xA;MON # snmpwalk -v 2c -c comm3 10.30.0.12&#xA;SNMPv2-MIB::sysDescr.0 = STRING: Cisco IOS Software, 7200 Software (UBR7200P-JK9SU2-M), Version 12.2(33)SCG6, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2013 by Cisco Systems, Inc.&#xA;Compiled Thu 31-Oct-13 13:45 by prod_rel_team&#xA;SNMPv2-MIB::sysObjectID.0 = OID: CISCO-DOCS-EXT-MIB::cisco.1.827&#xA;&#xA;MON # ping 10.30.0.40&#xA;PING 10.30.0.40 (10.30.0.40): 56 data bytes&#xA;64 bytes from 10.30.0.40: icmp_seq=0 ttl=254 time=1.034 ms&#xA;64 bytes from 10.30.0.40: icmp_seq=1 ttl=254 time=0.945 ms&#xA;^C&#xA;--- 10.30.0.40 ping statistics ---&#xA;2 packets transmitted, 2 packets received, 0.0% packet loss&#xA;round-trip min/avg/max/stddev = 0.945/0.990/1.034/0.044 ms&#xA;MON # snmpwalk -v 2c -c comm3 10.30.0.40&#xA;Timeout: No Response from 10.30.0.40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SNMP configuration (output from &lt;code&gt;show run all&lt;/code&gt;) same on both router : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server group ADM v3 auth match exact read v1default write CFGCOPY access 8&#xA;snmp-server view *ilmi system included&#xA;snmp-server view *ilmi atmForumUni included&#xA;snmp-server view CFGCOPY ccCopyTable.* included&#xA;snmp-server view v1default iso included&#xA;snmp-server view v1default internet included&#xA;snmp-server view v1default snmpMPDMIB excluded&#xA;snmp-server view v1default snmpTargetMIB excluded&#xA;snmp-server view v1default snmpNotificationMIB excluded&#xA;snmp-server view v1default snmpUsmMIB excluded&#xA;snmp-server view v1default snmpVacmMIB excluded&#xA;snmp-server view v1default snmpCommunityMIB excluded&#xA;snmp-server view v1default ciscoIpTapMIB excluded&#xA;snmp-server view v1default cisco802TapMIB excluded&#xA;snmp-server view v1default ciscoTap2MIB excluded&#xA;snmp-server view v1default ciscoUserConnectionTapMIB excluded&#xA;snmp-server view *tv.00000000.00000010.00000080.000000007F iso.2.840.10036 included&#xA;snmp-server view *tv.00000000.00000010.00000080.000000007F internet included&#xA;snmp-server view *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF7F iso.2.840.10036 included&#xA;snmp-server view *tv.FFFFFFFF.FFFFFFFF.FFFFFFFF.FFFFFFFF7F internet included&#xA;snmp-server community comm1default RO 1&#xA;snmp-server community comm2default RO 2&#xA;snmp-server community comm3default RW 3&#xA;snmp-server community comm4default RO 51&#xA;snmp-server priority normal&#xA;no snmp-server trap link ietf&#xA;no snmp-server trap link switchover&#xA;snmp-server trap authentication vrf&#xA;snmp-server trap authentication acl-failure&#xA;snmp-server trap retry 3&#xA;snmp-server trap-source Loopback1&#xA;snmp-server packetsize 1500&#xA;snmp-server trap timeout 30&#xA;snmp-server queue-length 10&#xA;snmp-server location Hub&#xA;snmp-server contact 0461523&#xA;snmp-server chassis-id SN&#xA;snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart&#xA;snmp-server enable traps tty&#xA;snmp-server enable traps config&#xA;snmp-server enable traps entity&#xA;snmp-server enable traps envmon fan shutdown supply temperature&#xA;snmp-server enable traps cable&#xA;snmp-server enable traps rtr&#xA;snmp-server host 10.10.254.10 traps version 1 comm1 udp-port 162 &#xA;snmp-server host 10.10.10.253 traps version 1 comm1 udp-port 162 &#xA;snmp-server host 10.11.161.11 traps version 1 comm1 udp-port 162 &#xA;snmp-server host 10.11.168.240 traps version 1 comm1 udp-port 162 &#xA;snmp-server host 10.11.126.96 traps version 2c comm1 udp-port 162 &#xA;snmp-server host 10.11.167.5 traps version 1 public udp-port 162  comm1 docsis-cmts&#xA;snmp-server manager session-timeout 600&#xA;snmp-server manager&#xA;snmp-server inform retries 3 timeout 15 pending 25&#xA;snmp ifmib ifindex persist&#xA;snmp mib notification-log globalsize 500&#xA;snmp mib notification-log globalageout 15&#xA;snmp mib community-map  comm1 engineid 800000090300A44C11809A1B&#xA;snmp mib community-map  comm2 engineid 800000090300A44C11809A1B&#xA;snmp mib community-map  comm3 engineid 800000090300A44C11809A1B&#xA;snmp mib community-map  comm4 engineid 800000090300A44C11809A1B&#xA;snmp mib community-map  comm5 engineid 80000009030024E9B301AC1B&#xA;snmp mib community-map  comm6 engineid 800000090300A44C11809A1B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit1:&lt;br&gt;&#xA;Solution :&lt;br&gt;&#xA;- Removing the &lt;code&gt;snmp mib community-map&lt;/code&gt; command solve the issue and I get access to router through SNMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the purpose of such command ? Why on this router isn't working and on the others it is. &lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2014-05-20T16:29:16.517" LastActivityDate="2014-05-20T18:19:17.277" Title="Troubleshoot SNMP - NPEG2 - Purpose of snmp mib community-map &lt;community&gt; engineid command" Tags="|router|cisco-ios|snmp|cisco-7200|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8005" PostTypeId="2" ParentId="7999" CreationDate="2014-05-20T16:08:10.800" Score="11" Body="&lt;p&gt;An IP address on a true layer 2 only switch is used for management (accessing the CLI remotely, sending SNMP traps, logging, TACACS/RADIUS, etc.).  The IP address on the switch is in no way required for the switch to actually do its job, which is to switch frames.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2014-05-20T16:08:10.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8007" PostTypeId="1" AcceptedAnswerId="11022" CreationDate="2014-05-20T17:31:13.210" Score="6" ViewCount="2808" Body="&lt;p&gt;I've been reading and googling for the past week trying to wrap my head around the Cisco IP Phone TFTP upgrade process. The effort has been to try and make a Cisco 7941G work with Asterisk. This process has been documentended well in many places and I've followed several guides. The issue I am having is the Phone in questino never seems to ask or make  TFTP connection even though it is getting the correct information from the DHCP option 150.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Doing a Wireshark,&lt;/strong&gt; I see the Cisco phone ask for a DHCP information, I see the DHCP return an Offer and the Phone accept it. I then see the Phone issue a few ARP requests for the location of the TFTP server, but after that. Nada. One thing that is alarming or I've notice is ICMPv6 Router Solicitation datagrams seem to show up and then are immediately followed by the Phone rebooting again and again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Other notes:&lt;/strong&gt;&#xA;I've verified the TFTP server is working and logging via a TFTP client attached to the same Subnet.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I've verified the phone can be upgrade. Via a know working&#xA;environment using Cisco Call Manager, the Phone pulled down the&#xA;firmware correctly.&lt;/li&gt;&#xA;&lt;li&gt;I've tried doing the Soft reset &lt;strong&gt;# 123456789*0#&lt;/strong&gt; and the Hard reset to&#xA;format the flash &lt;strong&gt;# 3491672850*#&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;I never see anything in the TFTP server logs, even though I've used a&#xA;TFTP client to verify the verbose level&lt;/li&gt;&#xA;&lt;li&gt;Is CDP or LLDP involded at all with the phone upgrade process? I see&#xA;a lot of those messages, even when running it through a hub and not a&#xA;switch.&lt;/li&gt;&#xA;&lt;li&gt;Weird thing is, I plug in a Cisco 7945G phone and it accepts the&#xA;option 150 and pulls down the firmware files and configs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Screenshot of Capture:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/df09V.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/df09V.png&quot; alt=&quot;Wireshark Capture&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3528" LastEditorUserId="3528" LastEditDate="2014-05-21T13:16:53.300" LastActivityDate="2014-09-16T20:42:51.850" Title="Cisco IP Phone 7941 Never Asks for TFTP files?" Tags="|cisco|voip|cisco-7900-ip-phones|tftp|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="8008" PostTypeId="2" ParentId="8007" CreationDate="2014-05-20T18:06:31.137" Score="2" Body="&lt;p&gt;Option 66 is &quot;boot server&quot;, and has worked on every cisco ipphone I've plugged in. As you only have one server, 150 isn't necessary unless there are other &quot;network boot&quot; services... (everything listens to 66, cisco's listen to 150)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I've always dealt with this is to have a dedicated, isolated network for setting up phones.  The DHCP server provides IP setting for this network and a tftp server via option 66. Reset the phone &lt;em&gt;and clear network setting&lt;/em&gt;. It then restarts and goes through the whole shebang. The only phone that was ever a problem had been locked to a call manager -- with an unknown to us password. (extra steps were required to clear it. if it had be &quot;secured&quot;, it would've been trash -- see also: CTL files, and encrypted configs.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not familiar with the 41G, but the 40 has a diag serial port on it. It &lt;em&gt;might&lt;/em&gt; emit an error message -- but it's been a while since I messed with that diag port.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-05-20T18:06:31.137" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8009" PostTypeId="2" ParentId="8004" CreationDate="2014-05-20T18:19:17.277" Score="4" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;snmp mib community-map&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;To associate a Simple Network Management Protocol (SNMP) community&#xA;with an SNMP context, engine ID, or security name, use the snmp mib&#xA;community-map command in global configuration mode. To change an SNMP&#xA;community mapping to its default mapping, use the no form of this&#xA;command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/netmgmt/command/reference/nm_book/nm_16.html#wp1024742&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IOS Network Management Command Reference&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This fails when copying configs between routers because each will have a unique engineid. On the clone router, you've associated all your communities with a non-existent engineid.  I'm not sure there's a way to force IOS to use the same (user supplied) engineid.&lt;/p&gt;&#xA;&lt;p&gt;[&lt;strong&gt;UPDATE&lt;/strong&gt;]&#xA;So you can... &lt;code&gt;snmp-server engineID local 800000090300A44C11809A1B&lt;/code&gt; (I don't recommend doing that, 'tho)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-05-20T18:19:17.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8010" PostTypeId="1" CreationDate="2014-05-20T18:52:21.107" Score="5" ViewCount="1177" Body="&lt;p&gt;I have 3 Cisco switches. Should I use standard switch ports or SFP ports for spanning tree? What are the benefits to using the SFP ports?&lt;/p&gt;&#xA;" OwnerUserId="5770" LastEditorUserId="3191" LastEditDate="2014-05-28T06:59:54.883" LastActivityDate="2014-05-28T08:02:20.550" Title="When connecting 3 switch in Spanning tree, Should I use Switch port or SFP ports?" Tags="|cisco|switch|spanning-tree|sfp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8011" PostTypeId="2" ParentId="8010" CreationDate="2014-05-20T21:01:39.103" Score="7" Body="&lt;p&gt;Spanning-tree is spanning-tree no matter which ports you use.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-05-20T21:01:39.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8012" PostTypeId="2" ParentId="7999" CreationDate="2014-05-20T21:10:28.850" Score="2" Body="&lt;p&gt;If i read your question as &quot;why do I have to assign IP addresses to my clients&quot; the answer is: You don't have to. There are other protocols then IP (I guess you mean IPv4 because you are mentioning ARP). You can use IPv6, IPX, Appletalk, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need some protocol on Layer-3 (like IPv4, IPv6, IPX, ...) so that your hosts can talk to each other and to other parts of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As mentioned by others: On a Layer-2 switch IPv4 is only used for management. A pure Layer-2 switch should not care about protocols above layer-2 for switching packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note: There where / are some older chips used in switches which can't do Ethernet multicast and can't be used in (most) IPv6 environments.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-05-20T21:10:28.850" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8013" PostTypeId="1" AcceptedAnswerId="8015" CreationDate="2014-05-20T21:36:10.257" Score="1" ViewCount="2203" Body="&lt;p&gt;I've been given the job of wiring up a small office network, and been given F/UTP CAT6 cable to work with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is a patch panel describing itself as &quot;STP&quot; compatible with this cable? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand it, STP means a braided shield around unshielded twisted pairs, and F/UTP has a solid shield around unshielded twisted pairs, so to my mind they can be patched on the same equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The panel under consideration is a &lt;a href=&quot;http://www.lindy-international.com/0-5U-19-CAT6A-24-Port-RJ-45-Patch-Panel-Shielded.htm?websale8=ld0101.ld020102&amp;amp;pi=25882&amp;amp;ci=4003&quot; rel=&quot;nofollow&quot;&gt;Lindy 25882&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance. Apologies if this is not the best stack exchange forum - corrections gratefully received.&lt;/p&gt;&#xA;" OwnerUserId="5772" LastEditorUserId="8499" LastEditDate="2018-12-21T03:54:39.867" LastActivityDate="2018-12-21T03:54:39.867" Title="Is F/UTP cabling compatible with an STP patch panel?" Tags="|layer1|cable|cabling|patch-panel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8014" PostTypeId="1" AcceptedAnswerId="8037" CreationDate="2014-05-21T00:08:04.803" Score="1" ViewCount="2975" Body="&lt;p&gt;Due to some local needs, we need to have a maximum of 50 work stations per WAN. We would like to avoid having one SonicWall for each 50 PCs, as X0 is LAN and X1 is WAN. Is it possible to set X2 and X4 as LAN and X3, X5 as WAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea is to have something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                 LAN   WAN&#xA;PC  1 to 50    -&amp;gt; X0 -&amp;gt; X1     &#xA;&#xA;PC 51 to 100   -&amp;gt; X2 -&amp;gt; X3     &#xA;&#xA;PC 101 to 150  -&amp;gt; X4 -&amp;gt; X5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ALl PCs are in the same LAN and see each other, but each group is directed to its respective gateway (X0 ip, X2 ip, X4 IP) and then it goes to its respective WAN, as we need an external server to detect PCs coming from different external IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can it be done?&lt;/p&gt;&#xA;" OwnerUserId="5774" LastEditorUserId="16668" LastEditDate="2015-07-17T18:23:03.343" LastActivityDate="2015-07-17T18:23:03.343" Title="SonicWall tz 215 with three LAN and three WAN" Tags="|lan|sonicwall|wan|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8015" PostTypeId="2" ParentId="8013" CreationDate="2014-05-21T00:47:57.510" Score="2" Body="&lt;p&gt;What they call &quot;STP&quot; is &quot;Fully Shielded&quot; -- a per pair shield and an outer sheath shield.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Compatible&quot; is open to debate.  If you want to maintain the panel &lt;em&gt;and&lt;/em&gt; cable shielded specs, then no -- as the panel calls for shielded pairs.  But just the cable, maybe. You'd have to look at the specs for the cable as those tend to require bonding to a shielded crimp. (or a patch panel that shields each port.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-05-21T00:47:57.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8016" PostTypeId="1" CreationDate="2014-05-21T04:35:54.230" Score="4" ViewCount="335" Body="&lt;p&gt;I have enabled xml agent on ASR9k:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show run xml agent ssl&#xA;Tue May 20 22:19:11.791 UTC&#xA;xml agent ssl&#xA; iteration off&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I try to connect to port 38752 it gets disconnected with connection reset&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# openssl s_client -connect 10.104.56.84:38752 &#xA;CONNECTED(00000003)&#xA;write:errno=104&#xA;---&#xA;no peer certificate available&#xA;---&#xA;No client certificate CA names sent&#xA;---&#xA;SSL handshake has read 0 bytes and written 225 bytes&#xA;---&#xA;New, (NONE), Cipher is (NONE)&#xA;Secure Renegotiation IS NOT supported&#xA;Compression: NONE&#xA;Expansion: NONE&#xA;---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I connect to the XML agent with SSL?&lt;/p&gt;&#xA;" OwnerUserId="5776" LastActivityDate="2016-08-02T01:52:22.757" Title="IOS-XR XML agent ssl" Tags="|cisco-ios-xr|cisco-asr|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8018" PostTypeId="2" ParentId="8010" CreationDate="2014-05-21T06:14:12.167" Score="2" Body="&lt;p&gt;spanning-tree is used in all ports in switch but if you use the SFP port, don't need to configure again and again if there is a fault in the sfp port u simply change the SFP module ( FIBER or COPPER).This Is the benefit u gain from SFP Port.  &lt;/p&gt;&#xA;" OwnerUserId="4973" LastActivityDate="2014-05-21T06:14:12.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8019" PostTypeId="2" ParentId="7982" CreationDate="2014-05-21T06:53:28.423" Score="2" Body="&lt;p&gt;With many thanks to my Dear friend Kev Santillan form Cisco learning network&lt;/p&gt;&#xA;&lt;p&gt;here's OSPF standard header&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |   Version #   |     Type      |         Packet length         |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                          Router ID                            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                           Area ID                             |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |           Checksum            |             AuType            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                       Authentication                          |&#xA;&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                       Authentication                          |&#xA;&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;as described in RFC &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#appendix-A.3.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC2328 Section A.3.1&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;And Here is the modified packet using MD5 from &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-ospf-md5-02#section-2.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC2328 Section 2.2&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; |   Version #   |     type      |        Packet Length          |&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; |                          Router ID                            |&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; |                           Area ID                             |&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; |   Reserved - Must be Zero     | AuType=Keyed Message Digest Fn|&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&#xA; |   Reserved - Must be Zero     |    Key ID    | Auth Data Len  |&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; |               Sequence Number (non-decreasing)                |&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; |                                                               |&#xA; /           (OSPF Data Length-24) bytes Data                    /&#xA; |                                                               |&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; / Authentication Data  (var. length; 16 bytes when MD5 is used) /&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;As shown, the Checksum is set to zero and the Authentication Type field is set to keyed message digest (Type 2). The 64-bit Authentication field was redefined into three parts namely: Key ID, Auth Data Len and the cryptographic Seq Number fields.The appended trailer which consists of the Authentication Data is the output of the message digest algorithm.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="5420" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2014-05-21T06:53:28.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8024" PostTypeId="1" AcceptedAnswerId="8026" CreationDate="2014-05-21T23:30:24.993" Score="5" ViewCount="6719" Body="&lt;p&gt;I'm trying to add tacacs info to a switch.  However, I'm unable to use the new tacacs commands, even though the switch tells me to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;WS-C2960-24PC-L - Version 15.0(2)SE5&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config)#tacacs-server host 10.1.1.1&#xA;Warning: The cli will be deprecated soon&#xA;'tacacs-server host 10.1.1.1'&#xA;Please move to 'tacacs server &amp;lt;name&amp;gt;' CLI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ok, so I'll use it that way...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wtc2b1asw01(config)#tacacs server ABC&#xA;                          ^&#xA;% Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Guess I can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on what I'm missing?&lt;/p&gt;&#xA;" OwnerUserId="108" LastEditorUserId="44" LastEditDate="2014-05-21T23:48:41.513" LastActivityDate="2014-05-22T00:47:05.397" Title="Cisco 2960 switch will not recognize new TACACS+ commands" Tags="|cisco|switch|cisco-ios|tacacs|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8025" PostTypeId="1" CreationDate="2014-05-21T23:38:26.773" Score="-2" ViewCount="2464" Body="&lt;p&gt;How do you determine the network class of an IP address? For example, I have the IP address 127.0.0.1&lt;/p&gt;&#xA;" OwnerUserId="5786" LastEditorUserId="775" LastEditDate="2014-05-22T12:28:20.157" LastActivityDate="2014-05-22T12:28:20.157" Title="Determining the network class of an IP address" Tags="|ipv4|" AnswerCount="3" CommentCount="1" ClosedDate="2014-05-23T13:45:47.790" ContentLicense="CC BY-SA 3.0" />
  <row Id="8026" PostTypeId="2" ParentId="8024" CreationDate="2014-05-21T23:51:39.040" Score="11" Body="&lt;pre&gt;&lt;code&gt;sw-R2-3#show ver | i Software&#xA;Cisco IOS Software, C2960S Software (C2960S-UNIVERSALK9-M), Version 15.0(2)SE3, RELEASE SOFTWARE (fc1)&#xA;sw-R2-3#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;sw-R2-3(config)#tacacs?&#xA;tacacs  tacacs-server  &#xA;&#xA;sw-R2-3(config)#tacacs ?&#xA;  server  Server configuration&#xA;&#xA;sw-R2-3(config)#tacacs server ?&#xA;  WORD  Name for the tacacs server configuration&#xA;&#xA;sw-R2-3(config)#tacacs server foo &#xA;sw-R2-3(config-server-tacacs)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;aaa new-model&lt;/code&gt; maybe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[back story]&lt;br&gt;&#xA;This is one of many of my Cisco peavs... When I was first starting out with IOS (back when IOS 10 was new), I sat down with the ~1000 page documentation on authentication configuration. After a day of &quot;&lt;em&gt;why the f*** doesn't any of this work&lt;/em&gt;&quot;, I got to page 958-ish, where, as a &lt;em&gt;complete&lt;/em&gt; after thought, the authors finally mention, &quot;&lt;em&gt;and you have to enter&lt;/em&gt; aaa new-model &lt;em&gt;to turn any of this on.&lt;/em&gt;&quot; I think I actually burned that handbook. (and was never allowed to go to NANOG, because I might &quot;do something&quot; to that author.) F'ing CCIEs!&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-05-22T00:47:05.397" LastActivityDate="2014-05-22T00:47:05.397" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8027" PostTypeId="2" ParentId="8025" CreationDate="2014-05-22T02:24:27.893" Score="2" Body="&lt;pre&gt;&lt;code&gt;Class Ranges: First octet&#xA;-----------------------------&#xA;Class A     1 - 127 &#xA;&#xA;Class B   128 - 191&#xA;&#xA;Class C   192 - 223&#xA;-----------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Though 127.0.0.1 is class A, it's reserved for loopback/testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.tcpipguide.com/free/t_IPReservedPrivateandLoopbackAddresses-3.htm&quot; rel=&quot;nofollow&quot; title=&quot;Source&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4603" LastEditorUserId="-1" LastEditDate="2014-05-22T12:20:34.947" LastActivityDate="2014-05-22T12:20:34.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8028" PostTypeId="2" ParentId="8025" CreationDate="2014-05-22T04:54:39.253" Score="0" Body="&lt;p&gt;The following are the classes of IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Class A The first octet denotes the network address, and the last three octets are the host portion.Any IP address whose first octet is between 1 and 126 is a Class A address. Note that 0 is reserved as a part of the default address, and 127 is reserved for internal loopback testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Class B The first two octets denote the network address, and the last two octets are the host portion.Any address whose first octet is in the range 128 to 191 is a Class B address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Class C The first three octets denote the network address, and the last octet is the host portion. The first octet range of 192 to 223 is a Class C address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Class D Used for multicast. Multicast IP addresses have their first octets in the range 224 to 239.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Class E Reserved for future use and includes the range of addresses with a first octet from 240 to 255&lt;/p&gt;&#xA;" OwnerUserId="4973" LastActivityDate="2014-05-22T04:54:39.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8030" PostTypeId="2" ParentId="8025" CreationDate="2014-05-22T07:22:52.793" Score="2" Body="&lt;p&gt;Network classes are deprecated. As a attempt to cope with IP address exhaustion, the concept of network classes has been dropped in 1992. Before that, for a company with a need for 300 IP addresses, a class C network with 255 addresses would not suffice and it therefore received a class B address space with 65535 addresses, thus wasting 65535-300=65235 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_class&quot; rel=&quot;nofollow&quot;&gt;Wikipedia article on network classes&lt;/a&gt; for further info.&lt;/p&gt;&#xA;" OwnerUserId="5787" LastActivityDate="2014-05-22T07:22:52.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8032" PostTypeId="1" CreationDate="2014-05-22T09:25:47.037" Score="1" ViewCount="1406" Body="&lt;p&gt;I need to access the configuration of a Nortel 8310. Previous administrator left without leave passwords....and the IT manager wasn't aware of this... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that I can access the switch via Telnet with rwa default account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the command to modify RW and RO passwords?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't figure out from documentation, it appears that if I issue &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch# config cli password ro test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to provide the old password before i can set a new one... what is the correct method to regain access to the switch? I cannot reset nor reboot because, guess what? , no backup and yes, it's a core switch...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can i create a totally new rw user, say roberto,  with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switch# config cli password rw roberto &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance&lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2018-10-12T16:23:14.143" Title="How to reset password to a Nortel 8310" Tags="|switch|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8033" PostTypeId="1" CreationDate="2014-05-22T13:24:03.123" Score="2" ViewCount="238" Body="&lt;p&gt;I would like to know if my approach is correct. I have an ISP-&gt;Router and to router 2 servers are connected (Windows and VPN) and a switch with local computers.&#xA;People from outside should connect and use my local computers using VPN, is that correctly shown? Also what I mean, when they reach the VPN server, will be able to use the LAN as if they were there - I hope.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/lWax7.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5788" LastEditorUserId="3191" LastEditDate="2014-12-08T20:22:32.527" LastActivityDate="2014-12-08T20:22:32.527" Title="VPN to my small network, correct approach?" Tags="|vpn|design|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8037" PostTypeId="2" ParentId="8014" CreationDate="2014-05-22T17:24:15.123" Score="0" Body="&lt;p&gt;Since you're doing static DHCP leases in the same subnet based on MAC I would recommend the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the X0 interface for your LAN and setup the DHCP server with the static leases.  To do this look under Network-&gt;DHCP Server and select 'Add Static' to set each lease.  Use X1, X2 and X3 as your WAN interfaces.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under Network-&gt;Address Objects setup 3 objects as ranges for the IPs you wish to group. Such as X.X.X.1 to X.X.X.51 as IP Group 1.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under Network-&gt;Routing setup static routes for outbound traffic for each range to use the desired gateway.  As an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SOURCE: IP Group 1 (address object for first IP group)&#xA;Destination:  All WAN IP&#xA;SERVICE: ANY&#xA;GATEWAY: X1 Default Gateway (This is the first ISP connection)&#xA;INTERFACE: X1&#xA;METRIC: 2&#xA;COMMENT: IP GROUP 1 TO ISP 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also recommend checking 'Disable Route when the interface is disconnected' to allow for low-level failover if the interface gets unplugged.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will allow you to use 1 LAN interface to accomplish what you wanted to setup.&lt;/p&gt;&#xA;" OwnerUserId="4006" LastActivityDate="2014-05-22T17:24:15.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8038" PostTypeId="2" ParentId="6651" CreationDate="2014-05-22T18:03:51.430" Score="0" Body="&lt;p&gt;Could be a policy mismatch, I would like to see the configuration of both endpoints, including the policies (read: interesting traffic access-lists).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I would check if packets are being encapsulated and decapsulated on both ends:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show crypto ipsec sa peer 1.2.3.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And/or:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show crypto ipsec sa peer 1.2.3.4 | inc pkts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could also have a look at what the packet-tracer tells you (ASA built-in command line tool):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# packet-tracer input INSIDE tcp 10.10.10.10 55640 56.132.112.29 3205&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But beware, when troubleshooting VPN's, packet-tracer only generates reliable results if the VPN tunnel is up at that moment. If the tunnel is not fully functional or isn't configured correctly when using packet-tracer, you might get unrealiable results.&lt;/p&gt;&#xA;" OwnerUserId="5376" LastActivityDate="2014-05-22T18:03:51.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8039" PostTypeId="2" ParentId="8032" CreationDate="2014-05-22T19:16:41.797" Score="1" Body="&lt;p&gt;Unfortunately, the only way to reset the password is to reboot the switch.   You will have to schedule some downtime to do that.  With the default account, you should be able to reconstruct the majority of the configuration, so that if you lose it during reboot, you can out it back in, or at least have a running head start.   But as @rickybeam suggests, locating the former admin might be your best bet.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-05-22T19:16:41.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8040" PostTypeId="1" AcceptedAnswerId="8099" CreationDate="2014-05-22T21:45:50.303" Score="2" ViewCount="495" Body="&lt;p&gt;I would like to put my router in a listen-only mode for CDP i.e. it should allow CDP packets to only arrive while not advertising so that I can glimpse into physical topology while remaining hidden to other nodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently neither I am unable to filter CDP packets per interface in egress direction with an access list as CDP runs on data link layer AFAIK nor suppress advertisements with a specific CDP command syntax.&lt;/p&gt;&#xA;" OwnerUserId="1393" LastActivityDate="2020-01-12T19:34:44.760" Title="Listen-only (stealth) CDP on IOS" Tags="|cisco|security|cisco-ios|cisco-commands|cdp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8041" PostTypeId="1" CreationDate="2014-05-23T02:23:04.290" Score="1" ViewCount="50" Body="&lt;p&gt;I am currently studying UMTS where Beam-forming antenna release(?) beam for low-bit users and high-bit users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Who are those low bit and high bit users? As I understand it, the low and high bit devices, always sniff or find signal that matches their bit requirements? Correct my understanding.&lt;/p&gt;&#xA;" OwnerUserId="5796" LastActivityDate="2014-05-23T02:23:04.290" Title="Who are the low-bit and high-bit users?" Tags="|wireless|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8042" PostTypeId="2" ParentId="8032" CreationDate="2014-05-23T06:25:51.300" Score="2" Body="&lt;p&gt;If you don't have any password for rw and ro User, there is no other chance than to reboot, get into boot monitor via an Enter when it is asked for, and reformat the flash (dos-format /flash/ I think, may depend on the SW version)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be aware that there can be other users also, l1, l2, l3, ....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only user with privilege to change any user's password is rwa! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;bset regards&#xA;SImon&lt;/p&gt;&#xA;" OwnerUserId="5798" LastActivityDate="2014-05-23T06:25:51.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8043" PostTypeId="1" AcceptedAnswerId="8052" CreationDate="2014-05-23T06:28:05.647" Score="1" ViewCount="384" Body="&lt;p&gt;I opened up Packet tracer and configured SSH on a switch (2960) and logged to that switch from a PC. SSH was working. But when I see the running config, no ssh or crypto key configurations could be found in the running config. All the user name + passwords, domain name, Host name could be found. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that a problem only in packet tracer? If we configured SSH on a real switch / router, could we be able to view SSH configurations on running - Config ? &lt;/p&gt;&#xA;" OwnerUserId="5418" LastActivityDate="2014-05-23T09:35:17.503" Title="SSH configuration is not found in Running-config in packet tracer" Tags="|cisco|switching|ssh|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8044" PostTypeId="1" AcceptedAnswerId="14891" CreationDate="2014-05-23T07:27:55.183" Score="4" ViewCount="6324" Body="&lt;p&gt;In &lt;a href=&quot;http://en.wikipedia.org/wiki/Link-state_routing_protocol&quot; rel=&quot;nofollow&quot;&gt;Link-state routing protocol&lt;/a&gt; &lt;strong&gt;Dijkstra's algorithm&lt;/strong&gt; is used. In &lt;a href=&quot;http://en.wikipedia.org/wiki/Distance-vector_routing_protocol&quot; rel=&quot;nofollow&quot;&gt;Distance-vector routing protocol&lt;/a&gt; &lt;strong&gt;Bellman-Ford algorithm&lt;/strong&gt; is used. My question is why we use two different algorithm. Why not only one algorithm?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dijkstra's Algorithm can't work on negative edge, but in routing there can't be any negative edge. OK but in matter of debate let's say there &lt;em&gt;can&lt;/em&gt; be any negative edge in case of malfunctioning. Then why not use Bellman-Ford in both protocol?&lt;/p&gt;&#xA;" OwnerUserId="4415" LastActivityDate="2014-12-30T16:33:12.060" Title="Link-state routing Vs Distance-vector routing algorithm used confusion" Tags="|routing|protocol-theory|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8045" PostTypeId="2" ParentId="8033" CreationDate="2014-05-23T07:45:02.480" Score="2" Body="&lt;p&gt;In this drawing, all your network is behind your FW so you just have to allow traffic from external clients to VPN server in port 443 (or whatever). When an external client get a local IP, it's in your interal network. Since you have a router from VPN server to local computers, be sure about routing between VPN IP pool and local clientes network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tip: A more secure approach it's to connect your VPN to the FW and create two zones. A DMZ zone for VPN server and trust zone por internal clients. Read a manual from major vendors looking for typical deployment scenarios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2014-05-23T07:45:02.480" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8047" PostTypeId="1" CreationDate="2014-05-23T08:19:45.550" Score="0" ViewCount="5564" Body="&lt;p&gt;I want to allow a specific VLAN to a specific server. LAN users should be able to access every server, but VPN users should able to only access a specific server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose User A (VPN user) comes onto the internal network for a specific server, he should able to access to that server only; no other servers should be accessible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN users should have access to all servers in the LAN. &lt;/p&gt;&#xA;" OwnerUserId="5479" LastEditorUserId="3191" LastEditDate="2014-05-24T16:48:10.507" LastActivityDate="2014-05-24T16:48:10.507" Title="Restricted Server Access to Specific VLAN via ACL" Tags="|acl|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-08T20:51:59.983" ContentLicense="CC BY-SA 3.0" />
  <row Id="8052" PostTypeId="2" ParentId="8043" CreationDate="2014-05-23T09:35:17.503" Score="1" Body="&lt;p&gt;Yes, I can't confirm if it's a problem in packet tracer but in my real 2960 running-config  I have all the information needed.&lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2014-05-23T09:35:17.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8054" PostTypeId="2" ParentId="8047" CreationDate="2014-05-23T11:46:48.707" Score="2" Body="&lt;p&gt;You seem to be confusing a VLAN with a subnet. While in most cases, VLANs and subnets are mapped one-to-one, they are not the same. I will answer your question assuming the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LAN subnet, server subnet and VPN subnet are different, for these purposes I will use:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10.1.0.0/24 for servers (VLAN 10) with the special server 10.1.0.100&lt;/li&gt;&#xA;&lt;li&gt;192.168.1.0/24 for computers (VLAN 192)&lt;/li&gt;&#xA;&lt;li&gt;172.16.1.0/24 for VPN  (VLAN 172)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To start of, some information that is important to know about access rules, so this will make it easier for you to expand your rules later.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;First you must identify your traffic:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is the direction of the traffic? (Which side starts the connection?)&lt;/li&gt;&#xA;&lt;li&gt;What port and protocol is used for that traffic?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You must also identify if your network devices automatically does reflexive ACLs or not. A reflexive ACL will allow traffic to return, once a connection has started up, without you needing to specify a rule for that. Most often: A firewall has reflexive rules, a switch/router doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To identify the direction of the traffic:&#xA;Example: A computer requests a website from a server. It will normally do this with Destination IP the webserver-IP, source IP the computer-IP. Source port will be 'random'(TCP, greater than 1024) destination port will be TCP 80.&#xA;The direction fo the ACL depends on where you apply the ACL. Just remember that in and out are from the point of view of the network device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; |-----------|    IN |---------|OUT     |-----------|&#xA; |           |    --&amp;gt;|         |--&amp;gt;     |           |&#xA; | Computer  |       | router  |        | Webserver |&#xA; |           |    &amp;lt;--|         |&amp;lt;--     |           |&#xA; |-----------|    OUT|---------|IN      |-----------|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Best practice is to apply the access list as close as possible to the source, so in this case IN on the computers side. So the rule would be:&#xA;Allow tcp connections from computer-ip port random to connect to webserver port 80. So, if we would want to allow the computer network to allow to access a webpage, we could make this access list on a cisco router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended ComputerLAN&#xA; permit tcp 192.168.1.0 0.0.0.255 gt 1023 host 10.1.0.100 eq 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Two points:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Cisco uses a wildcard mask here, instead of a subnet mask, look up&#xA;your wildcard mask on a subnet calculator if you are unsure. &lt;/li&gt;&#xA;&lt;li&gt;At the end of every access list will be an unspoken &quot;deny everything&quot;. So&#xA;this access list will deny all other traffic.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now put it on the VLAN interface in the &quot;IN&quot; direction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface VLAN 192&#xA; ip access-group ComputerLAN in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we want the server network to only return traffic that has been set up from the computers, you could put down the following. Here the word &lt;code&gt;established&lt;/code&gt; means: Only traffic that has already started in the opposite direction.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended Servers&#xA; permit tcp host 10.1.0.100 eq 80 192.168.1.0 0.0.0.255 gt 1023 established&#xA;interface VLAN 10&#xA; ip access-group Servers in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In your case, if you want to only restrict VPN to one server, and allow everything else, you could do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended VPN&#xA; permit ip 172.16.1.0 0.0.0.255 host 10.1.0.100&#xA;interface VLAN 172&#xA; ip access-group ComputerLAN in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, since we have not defined any access lists on the other VLAN interfaces, all other traffic is allowed. Oftentimes, you can already define in your VPN setup which traffic is allowed through your VPN, so you wouldn't even need this ACL.&lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2014-05-23T11:46:48.707" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8055" PostTypeId="2" ParentId="8044" CreationDate="2014-05-23T12:32:21.553" Score="5" Body="&lt;p&gt;Link-state and distance vector aren't actual routing protocols, but &lt;em&gt;types&lt;/em&gt; of routing protocol. Since different environments have different requirements, there are different routing protocols. The protocol internet routing works on (BGP) is a distance vector protocol, because it is extremely scalable. Also, you don't want to be dependant on the link state information from other companies to route your traffic. You basically only want to know if they can get the traffic towards the destination and if they are closer to the destination than yourself and the other systems you are connected to.&lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2014-05-23T12:32:21.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8057" PostTypeId="1" AcceptedAnswerId="8062" CreationDate="2014-05-23T13:55:38.933" Score="3" ViewCount="158" Body="&lt;p&gt;recently we had a lecture in network engineering about the STP/RSTP and learned the basics, but a friend of mine and me asked us what would happen if one would make the mistake to connect Port 1 and Port2 of a Bridge - which Roles would the Ports have? I tried to find some information on the topic but i couldn't end up finding something that was related to the question.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/7StqK.png&quot; alt=&quot;2 ports of a Bridge connected&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the Cisco docs on STP Porrt Roles say:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Backup—This is a special case when two or more ports of the same bridge (switch) are connected together, directly or through shared media. In this case, one port is designated, and the remaining ports block. The role for this port is backup. from &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10596-84.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco STP Doc&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I am not 100% sure which port does what - is it lowest port number first or am i misunderstanding this explanation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your input!&lt;/p&gt;&#xA;" OwnerUserId="5808" LastActivityDate="2014-05-23T16:58:16.813" Title="RSTP - 2 Ports of one Bridge connected" Tags="|spanning-tree|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8062" PostTypeId="2" ParentId="8057" CreationDate="2014-05-23T16:58:16.813" Score="2" Body="&lt;p&gt;You are on the right track.  The port with the lowest port ID (port 1) will become the designated port, and the other port will be an alternate, and therefore will be discarding.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-05-23T16:58:16.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8064" PostTypeId="2" ParentId="7875" CreationDate="2014-05-23T21:03:12.377" Score="5" Body="&lt;p&gt;Typically you diagram network connections, and then make good use of labeling the physical patch panel and cables. The reason for this is patch panels are only a physical pass through, If you are troubleshooting at that point, then you should be looking at it in person.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a good link for some network diagrams &lt;a href=&quot;http://www.ratemynetworkdiagram.com/toplist.php?ut=8&quot; rel=&quot;noreferrer&quot;&gt;link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would diagram out the network from a layer2/3 perspective and go through the patch panels and physically label everything including the patch panel and the cables. &lt;/p&gt;&#xA;" OwnerUserId="5814" LastActivityDate="2014-05-23T21:03:12.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8067" PostTypeId="1" AcceptedAnswerId="8070" CreationDate="2014-05-24T04:07:49.423" Score="4" ViewCount="2634" Body="&lt;p&gt;I was recently graced with a new job opportunity in a large higher ed NE department. This is my first job working with a large network of several thousand users.&lt;br&gt;&#xA;Throughout my education, I followed the idea that &lt;strong&gt;static IP's are useful from time to time in certain applications and historically used more in smaller networks&lt;/strong&gt;. To this point, it has been my belief up to this point that &lt;strong&gt;DHCP is much more useful in larger settings&lt;/strong&gt;. For this reason, I was shocked to learn that &lt;strong&gt;each of our near 3000 networking devices have painstakingly been allocated static management IP addresses&lt;/strong&gt;. It was explained that this was easier to handle that DHCP.&lt;br&gt;&#xA;I will admit, the scheme for the addressing is nifty. The &lt;strong&gt;second octet is the device-class/network identifier&lt;/strong&gt;, the &lt;strong&gt;third octet is the building identifier&lt;/strong&gt; (we have some odd 200 buildings on campus), and the &lt;strong&gt;fourth is the device identifier&lt;/strong&gt;.&lt;br&gt;&#xA;So the scheme is understandable, but still seems like a lot of numbers to remember; imagine I am looking for a Xirrus array in say the Cafeteria on St. Phillip's Street. Yes DNS could solve this, but the IP's do sometimes get changed and that could result in a nightmare if one is changed and not the other.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution to me seems a DHCP/DNS combo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to sum up the question, &lt;strong&gt;from a management standpoint, why is it a good idea to use Static or DHCP addressing on equipment?&lt;/strong&gt; &lt;/p&gt;&#xA;" OwnerUserId="5785" LastEditorUserId="40033" LastEditDate="2018-04-05T20:01:16.550" LastActivityDate="2018-04-05T20:01:16.550" Title="Static IP's vs DHCP from management standpoint" Tags="|ipv4|dhcp|management|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8068" PostTypeId="2" ParentId="8067" CreationDate="2014-05-24T11:31:09.737" Score="1" Body="&lt;p&gt;The answer to your question is mostly opinion, which is frowned upon on this forum.  But I'm willing to bet real money that the majority of people here will agree with me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose that for some people, spending lots of time with Excel spreadsheets, keeping track of multiple spreadsheet versions, and the intellectual challenge of troubleshooting duplicate address problems are all enjoyable, but that's really no way to manage a network.  I won't speculate on why DHCP was never implemented (&lt;em&gt;cough&lt;/em&gt; fear *cough), but DHCP will help you manage your network more effectively by freeing you up from doing a lot of mundane tasks that can and should be automated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should point out that not everything will use DHCP.  Your routers, switches, firewalls, some servers, will need static addresses.  But the majority of devices, especially end user PCs, wireless devices, printers, etc. should use DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you really need is an IP address management application, or IPAM.  There are commercial products as well as freeware that manage both DHCP scopes and static addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't have to give up your nifty addressing scheme either.  You can create DHCP &quot;scopes&quot; for each of your locations and device types.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Certain devices that need stable addresses (like printers) can use DHCP reservations, so you can manage their addresses from a single application.  That saves a lot of &quot;running around&quot; time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, you can use dynamic DNS, that syncs DHCP and DNS so that when an address is leased, a DNS entry is automatically created.   Your Xirrus AP will always have the same name no matter where it is.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-05-24T11:31:09.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8070" PostTypeId="2" ParentId="8067" CreationDate="2014-05-24T13:33:35.743" Score="2" Body="&lt;p&gt;I’ll keep this post about your situation specifically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First and foremost, managing over 3,000 devices with static IP addresses is just plain foolish.  DHCP is a well-known and established protocol that solves the tedious task of manually assigning and fixing manual IP addresses.  If they are that concerned about making sure they have control over &lt;strong&gt;every&lt;/strong&gt; IP address on their network, set them as DHCP reservations.  Even from a security standpoint, you don’t stand to benefit &lt;em&gt;that&lt;/em&gt; much from eliminating DHCP servers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By sticking with this route, you will lose:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Change management capabilities&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Customer insight&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The big hitter on this list is change management capabilities.  If you need to swap IPs around, you really don’t have a good way to do this; and that makes (or will make) your life arduous. If your teammates aren't on board with it and want to stick with their old ways, try to rope in your management and inform them of what a colossal waste of time it is. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your nifty IP scheme; you will still be able to maintain that; If anything, to a greater degree. &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7250/what-is-ip-address-management-why-its-needed-how-does-the-vendors-like-bluec/7253#7253&quot;&gt;IPAM&lt;/a&gt; gives you the capability to drill down into smaller and smaller subnet ranges, making it seemingly easy to implement in your case.  This will allow you to cascade further and further down into the building/device class you desire.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-05-24T13:33:35.743" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8072" PostTypeId="1" CreationDate="2014-05-24T14:13:33.570" Score="0" ViewCount="6827" Body="&lt;p&gt;&lt;em&gt;Cisco in its documentation says:&lt;/em&gt; (Emphasis mine)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;After a default of 30 minutes the router that originated the entry resends the LSA, with a higher sequence number, in a link-state update&#xA;  (LSU), to verify that the link is still active.&#xA;  If the LSA were to reach its maximum age (max age) of &lt;em&gt;60 minutes&lt;/em&gt;, it would be discarded&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;in OSPF: Anatomy of an Internet Routing Protocol - Page 160&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When an LSA reaches the age of &lt;em&gt;MaxAge (60 minutes)&lt;/em&gt;, it is removed from consideration by the OSPF routing calculation. ..&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;In CCNP Authorized Self-Study Guide: Implementing Cisco IP Routing (ROUTE)&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;in one paragraph it says the same thing as 60 minute and somewhere else it points 4 LSDB refresh timer which equals to 120 minutes is the max age timer`&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;In for Dummies it says:&lt;/em&gt;  &lt;a href=&quot;http://www.dummies.com/how-to/content/working-with-open-shortest-path-first-ospf-routing.html&quot; rel=&quot;nofollow&quot;&gt;For Dummies&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Because a router expects to receive updates every 30 minutes, you may be wondering what happens if an update does not show up on schedule. If an update is not received within four intervals (120 minutes), the router is aged out of the topology database. This might happen if something unexpected happens to the router, such as a power supply failure or becoming unplugged.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which one is true??? Is OSPF MaxAge 60 minutes or 120 minutes??&lt;/p&gt;&#xA;" OwnerUserId="5420" LastEditorUserId="775" LastEditDate="2014-05-24T14:28:19.480" LastActivityDate="2014-05-24T14:28:19.480" Title="OSPF LSA maximum age (max age) default value" Tags="|cisco|ospf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8073" PostTypeId="2" ParentId="8072" CreationDate="2014-05-24T14:25:18.483" Score="3" Body="&lt;p&gt;OSPF &lt;code&gt;MAXAGE&lt;/code&gt; is &lt;a href=&quot;https://supportforums.cisco.com/discussion/10608661/max-age-ospf-lsas&quot; rel=&quot;nofollow noreferrer&quot;&gt;3600 seconds (1 hour)&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Quoting from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#appendix-B&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328 - OSPFv2; Appendix B &amp;quot;Architectural Constants&amp;quot;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;MaxAge&#xA;    The maximum age that an LSA can attain. When an LSA's LS age&#xA;    field reaches MaxAge, it is reflooded in an attempt to flush the&#xA;    LSA from the routing domain (See Section 14). LSAs of age MaxAge&#xA;    are not used in the routing table calculation.  The value of&#xA;    MaxAge is set to 1 hour.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Finally, a useful google query in case you're interested in how I found the first link... &lt;a href=&quot;https://www.google.com/search?q=ospf+lsa+maxage&amp;amp;oq=ospf+lsa+maxage&quot; rel=&quot;nofollow noreferrer&quot;&gt;ospf lsa maxage&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-05-24T14:25:18.483" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8074" PostTypeId="2" ParentId="8067" CreationDate="2014-05-24T16:17:11.040" Score="3" Body="&lt;p&gt;I suppose it boils down to what you mean by &lt;em&gt;networking devices&lt;/em&gt;. Routers, switches, firewalls, access points, etc., etc. do need to have fixed, known locations. It's a bad idea to rely on DHCP and DNS -- even where &quot;sticky&quot; addresses are used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One network fault is all it takes to learn how bad an idea that is... say your network is broken &lt;em&gt;somewhere&lt;/em&gt;. You (in fact, the entire engineering department) happen to be on the side that cannot reach DNS, and probably DHCP too. If all of your gear has random, unknown DHCP assigned addresses, you'll have no map, and no access to create one. If your workstation is portable, off, etc. &lt;em&gt;you&lt;/em&gt; may not have an address from which to work. Various networking devices may start dropping off the network as their leases expire, other devices (like your laptop) coming online for the day won't have an address, rebooted equipment won't have addresses...  A failure of the DHCP server will net a similar effect. A failure of the DNS server(s) will leave a mess of old, invalid registrations, and a bunch of holes where new registrations didn't happen -- nothing I know of will retry.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-05-24T16:17:11.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8075" PostTypeId="2" ParentId="362" CreationDate="2014-05-24T18:24:56.173" Score="0" Body="&lt;p&gt;if you use the same constructor(Cisco for example) for your network devices, SecureCRT is your best choice. it is an SSH client that give you the possibility to send commands at multiple terminals at the sale time:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hU1WC.png&quot; alt=&quot;secrureCRT&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to set that up:&#xA;1. connect to all your devices in different tabs&#xA;2. go to view&#xA;3. check &quot;chat window&quot; option&#xA;4. right click on the window -&gt; check &quot;send chat to all tabs&quot; &lt;/p&gt;&#xA;" OwnerUserId="5020" LastActivityDate="2014-05-24T18:24:56.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8079" PostTypeId="2" ParentId="8044" CreationDate="2014-05-25T17:41:17.123" Score="5" Body="&lt;p&gt;The fact that Dijkstra's algorithm cannot handle negative edges is not an issue in routing. Because Dijkstra's is a greedy algorithm, it needs to know about all nodes to be able to calculate path costs. In link state routing protocols, every router has a full map of the network on which it can executes Dijkstra's algorithm to populate its routing table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike Dijkstra's, the distributed version of Bellman-Ford used in distance-vector routing protocols can handle the gradual increase of available information in the incoming advertisements.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-05-25T17:41:17.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8085" PostTypeId="1" CreationDate="2014-05-26T08:36:10.790" Score="1" ViewCount="51" Body="&lt;p&gt;Good morning,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to apply an ACL in a 7609 SIP-400 Card used to allow PPPoE on the 7609 (with a SPA-5X1G). A Pbr doesn't work when applied to the virtual-template (as it does on a 7200 Router). I have been reading &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/15-02SG/configuration/guide/config/vrf.html#wp1079187&quot; rel=&quot;nofollow&quot;&gt;Configuring IP Subscriber Awareness over Ethernet&lt;/a&gt;, but am not skilled with containers, VRF and so on...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone could tell me some link/info or something to improve my knowledge about this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!!&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="3191" LastEditDate="2014-05-26T12:23:15.130" LastActivityDate="2014-05-26T12:23:15.130" Title="Applying ACLs in a SIP-400 Card (Configuring IP Subscriber Awareness over Ethernet )" Tags="|cisco|cisco-7600|vrf|" AnswerCount="0" CommentCount="0" ClosedDate="2019-11-16T17:15:06.697" ContentLicense="CC BY-SA 3.0" />
  <row Id="8087" PostTypeId="1" AcceptedAnswerId="8089" CreationDate="2014-05-26T11:41:46.747" Score="3" ViewCount="1634" Body="&lt;p&gt;Is it possible to deploy VSS configuration between Catalyst 4503-E and Catalyst 4507+RE ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I am trying to do, but at VSL establishment I get the following error messages : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*May 26 04:35:16.443: %C4K_REDUNDANCY-6-DUPLEX_MODE: The peer Supervisor has been detected&#xA;*May 26 04:35:35.770: %SW_LEVEL-6-RESULT: Operational redundancy mode is UNKNOWN, due to software license-level mismatch at ACTIVE and STANDBY. Software Level on     Active: entservices; on Standby: entservices.&#xA;*May 26 04:35:45.785: %ISSU-3-PEER_IMAGE_INCOMPATIBLE: Peer image (cat4500e-UNIVERSALK9-M), version (03.04.03.SG) on peer uid (11) is incompatible&#xA;*May 26 04:35:45.785: %ISSU-3-PEER_IMAGE_INCOMPATIBLE: Peer image (cat4500e-UNIVERSALK9-M), version (03.04.03.SG) on peer uid (11) is incompatible&#xA;*May 26 04:35:55.194: %C4K_REDUNDANCY-2-IOS_VERSION_CHECK_FAIL: IOS version mismatch. Active supervisor version is 15.1(2)SG3 (cat4500e-UNIVERSALK9-M). Standby supervisor version is 15.1(2)SG3 (cat4500e-UNIVERSALK9-M). Redundancy feature may not work as expected.&#xA;*May 26 04:35:55.198: %C4K_REDUNDANCY-6-MODE: ACTIVE supervisor initializing for rpr mode&#xA;*May 26 04:35:55.462: %C4K_REDUNDANCY-3-COMMUNICATION: Communication with the peer Supervisor has been established&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this error message, the redundancy mode on the VSS Standby goes to RPR instead of SSO and it reloads indefinitely because this redundancy mode is not accepted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked my IOS versions on both chassis &amp;amp; they are the same : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROM: 15.0(1r)SG10&#xA;System image file is &quot;bootflash:cat4500e-universalk9.SPA.03.04.03.SG.151-2.SG3.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am running license level entservices for both chassis&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Module Name     Role           Current Level     Reboot Level&#xA;--------------------------------------------------------------------&#xA;WS-X45-SUP7L-E  Active         entservices       entservices&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My 2 chassis are also configured with redundancy SSO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a caveat I am not aware of ?&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2020-01-12T09:42:27.380" Title="VSS between 4503-E &amp; 4507+E" Tags="|cisco|vss|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8089" PostTypeId="2" ParentId="8087" CreationDate="2014-05-26T12:28:42.220" Score="2" Body="&lt;p&gt;The two chassis must have the same number of slots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refer to: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/15-1-2/XE_340/configuration/guide/config/vss.html#wp1053946&quot; rel=&quot;nofollow&quot;&gt;Cisco: Configuring VSS - Chassis and Modules&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="267" LastEditorUserId="3191" LastEditDate="2014-05-26T21:23:21.353" LastActivityDate="2014-05-26T21:23:21.353" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8092" PostTypeId="1" AcceptedAnswerId="10945" CreationDate="2014-05-26T19:00:09.297" Score="1" ViewCount="210" Body="&lt;p&gt;How can you tell a CAT6 cable is externally rated? It is a requirement for a project I'm working on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks,&#xA;Vlad&lt;/p&gt;&#xA;" OwnerDisplayName="user2559" LastEditorUserId="8499" LastEditDate="2018-03-20T23:23:52.547" LastActivityDate="2018-03-20T23:23:52.547" Title="Externally Rated - CAT Cables - how to tell" Tags="|layer1|cabling|cable|utp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8094" PostTypeId="2" ParentId="8087" CreationDate="2014-05-26T20:01:25.673" Score="2" Body="&lt;p&gt;In fact I found out it is possible with IOS XE &gt; 03.05.00 SG. This was not possible before, on IOS XE train 03.04.xx SG&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried myself with IOS XE 03.05.02 SG and did not encounter any issues with a 4503-E on one side and a 4507+RE on the other side, the two of them having Sup7-LE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is reference on this &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/XE3-5-0E/15-21E/configuration/guide/config/vss.html#37306&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2014-05-26T20:01:25.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8095" PostTypeId="1" AcceptedAnswerId="8108" CreationDate="2014-05-26T20:15:18.057" Score="4" ViewCount="956" Body="&lt;p&gt;How do you configure spanning tree port fast bpdu root guard on cisco 3560 switch? Can anyone tell me if there's any difference in the configuration of stp port fast bpdu root guard in cisco 3560 and 2960 switches? &lt;/p&gt;&#xA;" OwnerUserId="5501" LastActivityDate="2014-05-29T06:57:27.307" Title="Configuring stp port fast bpdu root guard" Tags="|spanning-tree|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8099" PostTypeId="2" ParentId="8040" CreationDate="2014-05-27T05:29:00.643" Score="3" Body="&lt;p&gt;you can't do this on router level, if your device are Cisco switch you can apply mac access-list which will drop outgoing CDP packets, and because CDP use ARPA code (EtherType) 0x2000, mac access-list will contain: &#xA;access-list 10 deny 0x2000&lt;/p&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="36720" LastEditDate="2020-01-12T19:34:44.760" LastActivityDate="2020-01-12T19:34:44.760" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="8108" PostTypeId="2" ParentId="8095" CreationDate="2014-05-27T11:27:38.800" Score="3" Body="&lt;p&gt;Use &lt;code&gt;spanning-tree portfast&lt;/code&gt;, and &lt;code&gt;spanning-tree bpduguard enable&lt;/code&gt; on each switchport.  Root guard is unnecessary on ports with this configuration, because bpduguard will err-disable the port when you receive any bpdus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use root guard on links to other switches, which are not planned for the primary or secondary stp root role.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-05-27T11:27:38.800" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8117" PostTypeId="2" ParentId="8010" CreationDate="2014-05-28T05:48:17.797" Score="2" Body="&lt;p&gt;The first question has been answered, but I'd like to elaborate on the second.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the benefits of using SFP port?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no benefit to using an SFP port for spanning tree.  Spanning tree protocol runs over ethernet there is no difference (to the switch) between the ethernet of the copper 1000base-T and fibre-optic 1000base-SX (or LX) connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if you're doing a run that's over 100m to the next switch you'll need to use the SFP slot and make the connection over fibre but spanning tree will act the same that way as it would if the next switch is connected with a 10m cat-5e cable.&lt;/p&gt;&#xA;" OwnerUserId="5870" LastActivityDate="2014-05-28T05:48:17.797" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8123" PostTypeId="1" CreationDate="2014-05-28T08:40:03.773" Score="2" ViewCount="971" Body="&lt;p&gt;Some random ports led turns off for less than a second &lt;a href=&quot;https://www.youtube.com/watch?v=eUl4ifveh74&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=eUl4ifveh74&lt;/a&gt; &#xA;Right in that time i have 2 timeouts in one or more ports which turned off .&#xA;why is it doing that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;firmware is up to date . ports are ok and tried with other ports . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;show log&#xA;Note: The changed states are by hand and normal&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00:41:31: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/23, changed state to down&#xA;00:41:33: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/23, changed state to up&#xA;00:41:50: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/23, changed state to down&#xA;00:41:52: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/23, changed state to up&#xA;00:42:00: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to down&#xA;00:42:02: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to up&#xA;00:42:05: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to down&#xA;00:42:07: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to up&#xA;00:42:22: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to down&#xA;00:42:24: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/22, changed state to up&#xA;1d03h: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/11, changed state to down&#xA;1d03h: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/17, changed state to down&#xA;1d03h: %LINK-3-UPDOWN: Interface FastEthernet0/11, changed state to down&#xA;1d03h: %LINK-3-UPDOWN: Interface FastEthernet0/17, changed state to down&#xA;1d03h: %LINK-3-UPDOWN: Interface FastEthernet0/17, changed state to up&#xA;1d03h: %LINK-3-UPDOWN: Interface FastEthernet0/11, changed state to up&#xA;1d03h: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/17, changed state to up&#xA;1d03h: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/11, changed state to up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;show interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://paste.ubuntu.com/7541959/&quot; rel=&quot;nofollow&quot;&gt;http://paste.ubuntu.com/7541959/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more thing . Pinging the switch is abnormal . I am far from switch and normal ping should be less than ~10ms . But as you can see the ping goes high decussate&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Reply from x.x.x.x: bytes=32 time=8ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=28ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=181ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=14ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=195ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=6ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=215ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=11ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=226ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=10ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=242ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=16ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=255ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=16ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=273ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=19ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=285ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=21ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=298ms TTL=255&#xA;Reply from x.x.x.x: bytes=32 time=40ms TTL=255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5874" LastEditorUserId="5874" LastEditDate="2014-05-29T06:49:29.037" LastActivityDate="2014-09-27T20:36:45.103" Title="Cisco 2950 switch LED off timeout" Tags="|cisco|switch|packet-loss|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="8124" PostTypeId="1" AcceptedAnswerId="8129" CreationDate="2014-05-28T09:43:11.107" Score="5" ViewCount="26865" Body="&lt;p&gt;I am new to networking terms like this. Can somebody explain the difference between Linecards and FPCs? Are they the same or different? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been hearing these in multiple contexts and sometimes interchangeably. &lt;/p&gt;&#xA;" OwnerUserId="4483" LastEditorUserId="775" LastEditDate="2014-05-28T11:54:03.513" LastActivityDate="2014-05-28T20:36:55.950" Title="What are FPC and Linecards?" Tags="|juniper|switching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8125" PostTypeId="2" ParentId="8123" CreationDate="2014-05-28T10:33:47.443" Score="1" Body="&lt;p&gt;you have to check the connected cables to your switch:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;you need to check it for poor termination from Both ends &lt;/li&gt;&#xA;&lt;li&gt;you need to check how long is your cables and to which category they belong and if they are passing close to electricity cables &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="3191" LastEditDate="2014-05-28T10:43:38.463" LastActivityDate="2014-05-28T10:43:38.463" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8126" PostTypeId="1" AcceptedAnswerId="8132" CreationDate="2014-05-28T14:01:05.807" Score="1" ViewCount="5062" Body="&lt;p&gt;Where are global Ethernet multicast MAC addresses assigned?  Is this by Organizationally Unique Identifier (OUI), and if so, is there a homepage that shows all the assigned global Ethernet MAC multicast address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples of currently assigned multicast MAC addresses are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;01-00-5E-??-??-?? : &lt;a href=&quot;https://en.wikipedia.org/wiki/IP_multicast#Layer_2_delivery&quot; rel=&quot;nofollow&quot;&gt;IPv4 Multicast&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;01-80-C2-00-00-0? : &lt;a href=&quot;https://en.wikipedia.org/wiki/Spanning_tree_protocol&quot; rel=&quot;nofollow&quot;&gt;Spanning Tree Protocol&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="5751" LastEditorUserId="5751" LastEditDate="2014-05-29T08:19:20.427" LastActivityDate="2016-03-19T17:34:07.380" Title="List over assigned global Ethernet MAC multicast address" Tags="|ethernet|mac-address|multicast|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8127" PostTypeId="2" ParentId="7732" CreationDate="2014-05-28T16:56:52.187" Score="2" Body="&lt;p&gt;yes, LSR can also carry multiple LSA bodies, in this case LSA summaries.&#xA;use &lt;strong&gt;debug ip ospf packet &lt;em&gt;detail&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="5764" LastActivityDate="2014-05-28T16:56:52.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8128" PostTypeId="2" ParentId="5682" CreationDate="2014-05-28T17:17:55.327" Score="3" Body="&lt;p&gt;10G BX SFPs do exist!  I don't know if you can get Cisco branded ones (if you're using cisco switches) but I have found generic ones before.  Just google for &quot;SFP-10G-BXU-10km&quot; (or SFP-10G-BXD-10km) and you should find several suppliers.  The supplier I got a quote from makes them &quot;cisco compatible&quot; and &quot;hp compatible&quot; so you should have no problem having them recognized by your switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="5870" LastActivityDate="2014-05-28T17:17:55.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8129" PostTypeId="2" ParentId="8124" CreationDate="2014-05-28T20:01:00.787" Score="10" Body="&lt;p&gt;FPC's are similar to Linecards. When dealing with Juniper you will hear FPC more often. FPC's (Flexible PIC Concentrator) houses multiple PICs (Physical Interface Cards) which connect to the physical medium. Linecards are similar in that both FPCs and Linecards are inserted into a chassis device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cisco, Linecards are just that. It's a card that's slotted into a chassis and provides a set of services to the chassis. For more info on FPCs, PICs, and Linecards see below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/hardware/m40/m40-hwguide/html/overview-hardware6.html&quot; rel=&quot;noreferrer&quot;&gt;FPC&lt;/a&gt;, &lt;a href=&quot;http://www.juniper.net/techpubs/hardware/m40/m40-hwguide/html/overview-hardware5.html#1035509&quot; rel=&quot;noreferrer&quot;&gt;PIC&lt;/a&gt;, &lt;a href=&quot;http://cisconokia.com/c/en/us/products/interfaces-modules/line-cards/index.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco Line Cards&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2073" LastEditorUserId="619" LastEditDate="2014-05-28T20:36:55.950" LastActivityDate="2014-05-28T20:36:55.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8130" PostTypeId="2" ParentId="8095" CreationDate="2014-05-28T20:10:49.997" Score="0" Body="&lt;p&gt;As an aside and since I cannot leave comments yet, I prefer to use &lt;code&gt;switchport host&lt;/code&gt; when setting up access ports. The &lt;code&gt;switchport host&lt;/code&gt; command is a macro on all Cisco switches. it sets the port up as an accessport, spanning-tree portfast, and disables etherchannel capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you've used the &lt;code&gt;switchport host&lt;/code&gt; command your can then run whatever additional commands are needed such as &lt;code&gt;spanning-tree bpduguard enable&lt;/code&gt; or &lt;code&gt;spanning-tree bpduguard enable&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2073" LastEditorUserId="3191" LastEditDate="2014-05-29T06:57:27.307" LastActivityDate="2014-05-29T06:57:27.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8131" PostTypeId="2" ParentId="8126" CreationDate="2014-05-28T20:19:55.207" Score="2" Body="&lt;p&gt;Wireshark provides &lt;a href=&quot;https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob_plain;f=manuf&quot; rel=&quot;nofollow&quot;&gt;a list&lt;/a&gt; but I think you have to filter out the multicast addresses by yourself. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-05-28T20:19:55.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8132" PostTypeId="2" ParentId="8126" CreationDate="2014-05-28T20:34:29.373" Score="3" Body="&lt;p&gt;01-00-5E-??-??-?? : &lt;a href=&quot;http://www.iana.org/assignments/ethernet-numbers/ethernet-numbers.xhtml#ethernet-numbers-3&quot; rel=&quot;nofollow&quot;&gt;IANA Ethernet Numbers&lt;/a&gt;&lt;br&gt;&#xA;01-80-C2-00-00-0? : &lt;a href=&quot;http://standards.ieee.org/develop/regauth/grpmac/public.html&quot; rel=&quot;nofollow&quot;&gt;IEEE Standards Group Listings&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That covers the two OUI's you listed.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a homepage which shows all assigned global Ethernet MAC multicast address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no &lt;em&gt;single&lt;/em&gt; source, because each organization controls the use of their OUI. (IANA and IEEE in the above examples.) Any mac address is converted to multicast by &lt;a href=&quot;http://en.wikipedia.org/wiki/Multicast_address#Ethernet&quot; rel=&quot;nofollow&quot;&gt;changing a single bit&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-05-29T18:50:58.527" LastActivityDate="2014-05-29T18:50:58.527" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8134" PostTypeId="2" ParentId="8126" CreationDate="2014-05-29T08:21:36.600" Score="0" Body="&lt;p&gt;The IEEE controlled list of assigned addresses at &lt;a href=&quot;http://standards.ieee.org/develop/regauth/oui/public.html&quot; rel=&quot;nofollow&quot;&gt;MA-L PUBLIC LISTING&lt;/a&gt; shows the assigned addresses as blocks in unicast address format, thus with cleared LSB of first byte, e.g. 0x00.  Any vendor with a vendor block, can use that to create a unique multicast address block, simply by setting the LSB of first byte, e.g. 0x01.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;01-00-5E-??-??-?? : Based on the 00-00-5E vendor block given to &quot;ICANN, IANA Department&quot;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;01-80-C2-00-00-0? : Based on the 00-80-C2 vendor block given to &quot;IEEE 802.1 COMMITTEE&quot;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="5751" LastActivityDate="2014-05-29T08:21:36.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8135" PostTypeId="1" CreationDate="2014-05-29T09:50:36.877" Score="3" ViewCount="1374" Body="&lt;p&gt;I'm new to all Cisco stuff and I need to configure nettalk VOIP. I have Cisco 871 device with two ISP - one via PPP (public IP 666.666.666.666) and one via eth (public IP 999.999.999.999).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Main ISP is the one via PPP, eth ISP is used for WWW/mail/VOIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nettalk device uses following ports:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port 69: Used for updates (not necessary for phone calls).&#xA;Port 5060: Standard SIP port for provisioning to the netTALK network.&#xA;Port 10,000 - 20,000: Used for Voice transmission. If your router does not allow you to put in a range of ports then select port 12000.&#xA;Protocol: UDP. TCP is NOT used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For VOIP I only need 5060 and 10000-20000 (or 12000 if it is not possible to forward port range).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Device IP is 192.168.1.6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've created permit rules inside &quot;webmailvoip&quot; access-list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit tcp host 192.168.1.6 any eq 5060&#xA;permit udp host 192.168.1.6 any eq 5060&#xA;permit udp host 192.168.1.6 any range 10000 20000&#xA;permit tcp any eq 5060 host 192.168.1.6&#xA;permit udp any eq 5060 host 192.168.1.6&#xA;permit udp any range 10000 20000 host 192.168.1.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it seems that this is not working - I can only hear buzz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas which rules are wrong, what else should I configure?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you, best regards!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. My current config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname gw&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;logging buffered 128000&#xA;logging console warnings&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;dot11 syslog&#xA;ip cef&#xA;!&#xA;no ip domain lookup&#xA;ip domain name blablabla&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;!&#xA;multilink bundle-name authenticated&#xA;vpdn enable&#xA;!&#xA;vpdn-group 1&#xA; request-dialin&#xA;  protocol pppoe&#xA;!&#xA;!&#xA;!&#xA;username admin privilege 15 password 0 blablabla&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  logging enable&#xA;  hidekeys&#xA;!&#xA;!&#xA;ip ssh version 2&#xA;!&#xA;track 1 rtr 1&#xA;!&#xA;track 2 rtr 2&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 1.1.1.1 255.255.255.252&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; no ip route-cache cef&#xA; no ip route-cache&#xA; ip policy route-map loop&#xA;!&#xA;interface Loopback1&#xA; ip address 1.1.1.5 255.255.255.252&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; no ip route-cache cef&#xA; no ip route-cache&#xA; ip policy route-map loop1&#xA;!&#xA;interface FastEthernet0&#xA; switchport access vlan 2&#xA;!&#xA;interface FastEthernet1&#xA; switchport access vlan 2&#xA;!&#xA;interface FastEthernet2&#xA; switchport access vlan 2&#xA;!&#xA;interface FastEthernet3&#xA; switchport access vlan 3&#xA;!&#xA;interface FastEthernet4&#xA; mac-address b055.5555.0775&#xA; ip address dhcp&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan2&#xA; ip address 192.168.1.252 255.255.255.0 secondary&#xA; ip address 192.168.1.1 255.255.255.0&#xA; no ip redirects&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; no ip route-cache cef&#xA; no ip route-cache&#xA; ip policy route-map webmailvoip&#xA;!&#xA;interface Vlan3&#xA; no ip address&#xA; ip virtual-reassembly&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 1&#xA;!&#xA;interface Dialer0&#xA; ip address negotiated&#xA; ip mtu 1492&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; encapsulation ppp&#xA; ip tcp adjust-mss 1450&#xA; dialer pool 1&#xA; dialer-group 1&#xA; ppp authentication chap callin&#xA; ppp chap hostname blablabla&#xA; ppp chap password 0 blablabla&#xA; ppp ipcp dns request&#xA; ppp ipcp address accept&#xA;!&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 Dialer0 track 1&#xA;ip route 0.0.0.0 0.0.0.0 999.999.999.001 100 track 2&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip nat pool POOL 1.1.1.2 1.1.1.2 netmask 255.255.255.0&#xA;ip nat inside source static tcp 192.168.1.5 80 interface Dialer0 80&#xA;ip nat inside source static tcp 192.168.1.7 10000 interface Dialer0 10000&#xA;ip nat inside source static udp 192.168.1.7 10000 interface Dialer0 10000&#xA;ip nat inside source static esp 192.168.1.7 interface Dialer0&#xA;ip nat inside source route-map rmap-dial interface Dialer0 overload&#xA;ip nat inside source route-map rmap-f4 interface FastEthernet4 overload&#xA;ip nat outside source list publicip pool POOL&#xA;!&#xA;ip access-list extended inside&#xA; permit ip 192.168.1.0 0.0.0.255 any&#xA;ip access-list extended publicip&#xA; permit ip 192.168.1.0 0.0.0.255 host 999.999.999.999&#xA; permit ip 192.168.1.0 0.0.0.255 host 666.666.666.666&#xA; permit ip host 666.666.666.666 192.168.1.0 0.0.0.255&#xA; permit ip host 999.999.999.999 192.168.1.0 0.0.0.255&#xA;ip access-list extended webmailvoip&#xA; deny   ip host 192.168.1.25 any&#xA; permit tcp 192.168.1.0 0.0.0.255 any eq www&#xA; permit tcp 192.168.1.0 0.0.0.255 any eq 443&#xA; permit tcp 192.168.1.0 0.0.0.255 any eq 143&#xA; permit tcp 192.168.1.0 0.0.0.255 any eq 993&#xA; permit tcp 192.168.1.0 0.0.0.255 any eq 587&#xA; permit tcp 192.168.1.0 0.0.0.255 any eq 465&#xA; permit tcp 192.168.1.0 0.0.0.255 any eq pop3&#xA; permit tcp 192.168.1.0 0.0.0.255 any eq 995&#xA; permit tcp 192.168.1.0 0.0.0.255 any eq 22&#xA; permit tcp host 192.168.1.6 any eq 5060&#xA; permit udp host 192.168.1.6 any eq 5060&#xA; permit udp host 192.168.1.6 any range 10000 20000&#xA; permit tcp any eq 5060 host 192.168.1.6&#xA; permit udp any eq 5060 host 192.168.1.6&#xA; permit udp any range 10000 20000 host 192.168.1.6&#xA;!&#xA;ip sla 1&#xA; icmp-echo 666.666.666.001 source-interface Dialer0&#xA; timeout 3000&#xA; frequency 3&#xA;ip sla schedule 1 life forever start-time now&#xA;ip sla 2&#xA; icmp-echo 999.999.999.001 source-interface FastEthernet4&#xA; timeout 3000&#xA; frequency 3&#xA;ip sla schedule 2 life forever start-time now&#xA;access-list 115 permit ip host 192.168.1.35 any log&#xA;access-list 115 permit ip any host 192.168.1.35 log&#xA;access-list 115 permit ip any any&#xA;access-list 117 permit ip 192.168.1.0 0.0.0.255 host 999.999.999.999&#xA;access-list 117 permit ip 192.168.1.0 0.0.0.255 host 666.666.666.666&#xA;access-list 117 permit ip host 666.666.666.666 192.168.1.0 0.0.0.255 log&#xA;access-list 117 permit ip host 999.999.999.999 192.168.1.0 0.0.0.255 log&#xA;dialer-list 1 protocol ip permit&#xA;no cdp run&#xA;!&#xA;route-map webmailvoip permit 10&#xA; match ip address webmailvoip&#xA; set ip next-hop verify-availability 999.999.999.001 1 track 2&#xA; set ip next-hop verify-availability&#xA;!&#xA;route-map loop permit 10&#xA; set ip next-hop 1.1.1.6&#xA;!&#xA;route-map loop1 permit 10&#xA; set interface Vlan2&#xA;!&#xA;route-map rmap-dial permit 10&#xA; match interface Dialer0&#xA;!&#xA;route-map rmap-f4 permit 10&#xA; match interface FastEthernet4&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA; no modem enable&#xA;line aux 0&#xA;line vty 0 4&#xA; exec-timeout 30 0&#xA; privilege level 15&#xA; login local&#xA; transport input telnet ssh&#xA;!&#xA;scheduler max-task-time 5000&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5887" LastActivityDate="2019-03-22T19:31:31.120" Title="Cisco 871, NAT, port formwarding and VOIP configuration - phone speaker buzz" Tags="|cisco|nat|voip|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8136" PostTypeId="1" CreationDate="2014-05-29T10:13:07.157" Score="2" ViewCount="14366" Body="&lt;p&gt;In a Class E IP address , in the first octet,255 is reserved and used as a local broadcast.What does the term &quot;local&quot; signify here?How does it differ from a directed broadcast?&lt;/p&gt;&#xA;" OwnerUserId="2604" LastActivityDate="2014-05-29T11:25:48.990" Title="Difference between local broadcast and directed broadcast" Tags="|broadcast|" AnswerCount="1" CommentCount="0" ClosedDate="2014-05-29T11:58:48.607" ContentLicense="CC BY-SA 3.0" />
  <row Id="8137" PostTypeId="2" ParentId="8136" CreationDate="2014-05-29T11:25:48.990" Score="2" Body="&lt;p&gt;Local(255.255.255.255) means that a router will not forward the packet (in some cases like DHCP the router will convert it to a unicast packet and forward it). Directed broadcast addresses have just the host part of the address as all 1s and routers will forward so if I have a subnet 10.10.10.0/24 I can ping from elsewhere in the network 10.10.10.255 and I would get an answer from all hosts. However there are a number of attack that exploit and you can configure your routers to not forward directed broadcasts.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2014-05-29T11:25:48.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8141" PostTypeId="1" AcceptedAnswerId="8144" CreationDate="2014-05-29T15:46:06.040" Score="2" ViewCount="961" Body="&lt;p&gt;Is there a way to connect routers via virtual-link between two different OSPF area?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sBU6F.jpg&quot; alt=&quot;topology&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5893" LastEditorUserId="3191" LastEditDate="2014-05-29T19:10:40.010" LastActivityDate="2019-03-04T13:12:18.337" Title="How to virtual-link between two different OSPF areas" Tags="|cisco|routing|ospf|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8142" PostTypeId="1" AcceptedAnswerId="8149" CreationDate="2014-05-29T15:50:17.873" Score="4" ViewCount="2607" Body="&lt;p&gt;Assumption for flow:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Ethernet connection between two nodes through switches/bridges only&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Either of:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;No VLAN (802.1Q) header&lt;/li&gt;&#xA;&lt;li&gt;VLAN having same ID and priority (same PCP, DEI, and VID)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;May frame reordering (misordering) then occur, or is it safe to assume that frames for the flow are received in same order as transmitted?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Background for question:&lt;/strong&gt;  I am implementing a hardware module that handles Ethernet frames at L2 level, and I consider whether I can safely assume that frames are not reordered when going from the source to destination through switches/bridges.  The network is assumed to be a star topology, thus without loops, so based on this I assume that the comment in &quot;K.3 Frame misordering&quot; below does not apply, since there is no possibility for change of topology through e.g. &lt;a href=&quot;https://en.wikipedia.org/wiki/Spanning_Tree_Protocol&quot; rel=&quot;nofollow&quot;&gt;STP/RSTP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Standard information:&lt;/strong&gt; From &quot;802.1D-2004 Media Access Control (MAC) Bridges&quot;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;6.3.3 Frame misordering&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The MAC Service (9.2 of ISO/IEC 15802-1) permits a negligible rate &#xA;  of reordering of frames with a given user priority for a given &#xA;  combination of destination address and source address.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;K.3 Frame misordering&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A change in the active topology between two communicating end &#xA;  stations can result in frame misordering, as a frame sent after &#xA;  reconfiguration can experience a lower transit delay, being &#xA;  queued at fewer Bridge Ports or for less time.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="5892" LastEditorUserId="5892" LastEditDate="2014-05-30T15:22:07.523" LastActivityDate="2014-06-03T01:29:07.540" Title="May frame reordering occur on Ethernet connection through switches/bridges?" Tags="|switch|ethernet|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="8143" PostTypeId="1" AcceptedAnswerId="8145" CreationDate="2014-05-29T18:10:52.247" Score="6" ViewCount="3909" Body="&lt;p&gt;I have a DMVPN hub with 2 ISPs. I have two tunnels setup between the spokes, one for each ISP. I would like to dedicate one of the ISP links to voice traffic and failover. I'm having trouble achieving both. In my current config, voice travels where I want it, but I can't get failover working. The limitation seems to be because there's no verify-availability when using set interface under the route-map and the tunnel interface doesn't go down when connectivity is lost. Is there another way to accomplish what I'm looking for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the relevent config sections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;track 89 ip sla 89 reachability&#xA;!&#xA;track 245 ip sla 245 reachability&#xA;&#xA;interface Tunnel0&#xA; ip address 10.10.255.1 255.255.255.192&#xA; ip nhrp map multicast dynamic&#xA; ip nhrp network-id 1&#xA; tunnel source GigabitEthernet0/1.245&#xA; tunnel mode gre multipoint&#xA; tunnel key 0&#xA; tunnel route-via GigabitEthernet0/1.245 mandatory&#xA; tunnel protection ipsec profile IPSec-Profile1&#xA;!&#xA;interface Tunnel1&#xA; ip address 10.10.255.65 255.255.255.192&#xA; ip nhrp map multicast dynamic&#xA; ip nhrp network-id 2&#xA; tunnel source GigabitEthernet0/1.89&#xA; tunnel mode gre multipoint&#xA; tunnel key 64&#xA; tunnel route-via GigabitEthernet0/1.89 mandatory&#xA; tunnel protection ipsec profile IPSec-Profile2&#xA;&#xA;ip route 0.0.0.0 0.0.0.0 1.1.1.1 200 track 89&#xA;ip route 0.0.0.0 0.0.0.0 2.2.2.2 200 track 245&#xA;&#xA;ip access-list extended VoIP&#xA; permit ip any any dscp ef&#xA;&#xA;ip sla 89&#xA; icmp-echo 1.1.1.1 source-interface GigabitEthernet0/1.89&#xA;ip sla schedule 89 life forever start-time now&#xA;ip sla 245&#xA; icmp-echo 2.2.2.2 source-interface GigabitEthernet0/1.245&#xA;ip sla schedule 245 life forever start-time now&#xA;&#xA;route-map policyRouting permit 10&#xA; match ip address VoIP&#xA; set interface Tunnel1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UPDATE: Looks like the behavior changed in IOS. In older versions, if no corresponding routes in the routing table are found matching the set interface in the route map, the policy will reject the packet and proceed with normal forwarding. On new versions, it policy routes the packet to the next hop IP found in the routing table, but through the interface specified in the route-map. In my case, this results in the packet being routed through tunnel 1 to tunnel 0's IP. This causes it to fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Debug from the spoke - older IOS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    *Jun  3 16:39:18.279: IP: route map policyRouting, item 10, permit&#xA;    *Jun  3 16:39:18.279: IP: s=10.10.17.2 (FastEthernet0/0), d=10.1.4.2 (Tunnel0), len 1228, policy rejected -- normal forwarding&#xA;    *Jun  3 16:39:18.279: IP: s=10.10.17.2 (FastEthernet0/0), d=10.1.4.2, len 1228, policy match&#xA;    *Jun  3 16:39:18.279: IP: route map policyRouting, item 10, permit&#xA;    *Jun  3 16:39:18.279: IP: s=10.10.17.2 (FastEthernet0/0), d=10.1.4.2 (Tunnel0), len 1228, policy rejected -- normal forwarding&#xA;    *Jun  3 16:39:18.279: IP: s=10.10.17.2 (FastEthernet0/0), d=10.1.4.2, len 1228, policy match&#xA;    *Jun  3 16:39:18.279: IP: route map policyRouting, item 10, permit&#xA;    *Jun  3 16:39:18.279: IP: s=10.10.17.2 (FastEthernet0/0), d=10.1.4.2 (Tunnel0), len 1228, policy rejected -- normal forwarding&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debug from the spoke - newer IOS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    *Jun  3 16:10:15.807: IP: route map policyRouting, item 10, permit&#xA;    *Jun  3 16:10:15.807: IP: s=10.10.17.2 (FastEthernet0/0), d=10.1.4.2 (Tunnel1), len 1228, policy routed&#xA;    *Jun  3 16:10:15.807: IP: FastEthernet0/0 to Tunnel1 10.10.255.1&#xA;    *Jun  3 16:10:15.807: IP: s=10.10.17.2 (FastEthernet0/0), d=10.1.4.2, len 1228, policy match&#xA;    *Jun  3 16:10:15.807: IP: route map policyRouting, item 10, permit&#xA;    *Jun  3 16:10:15.807: IP: s=10.10.17.2 (FastEthernet0/0), d=10.1.4.2 (Tunnel1), len 1228, policy routed&#xA;    *Jun  3 16:10:15.807: IP: FastEthernet0/0 to Tunnel1 10.10.255.1&#xA;    *Jun  3 16:10:15.807: IP: s=10.10.17.2 (FastEthernet0/0), d=10.1.4.2, len 1228, policy match&#xA;    *Jun  3 16:10:15.807: IP: route map policyRouting, item 10, permit&#xA;    *Jun  3 16:10:15.807: IP: s=10.10.17.2 (FastEthernet0/0), d=10.1.4.2 (Tunnel1), len 1228, policy routed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5894" LastEditorUserId="5894" LastEditDate="2014-06-03T17:23:19.000" LastActivityDate="2014-07-09T13:25:21.770" Title="Cisco PBR with DMVPN and Dual ISP" Tags="|vpn|pbr|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="8144" PostTypeId="2" ParentId="8141" CreationDate="2014-05-29T19:07:10.580" Score="3" Body="&lt;p&gt;You need to configure virtual link on both end point routers of the virtual link. Command in router ospf configuration is: &lt;code&gt;area &amp;lt;AREA_ID&amp;gt; virtual-link &amp;lt;ROUTER_ID&amp;gt;&lt;/code&gt; where &lt;code&gt;&amp;lt;AREA_ID&amp;gt;&lt;/code&gt; is transit OSPF area and &lt;code&gt;&amp;lt;ROUTER_ID&amp;gt;&lt;/code&gt; is IP address (Loopback) of the other interconnecting router. Virtual links are considered to be an indicator of bad network design, so if you really need to use them maybe you should consider revising your network structure.&lt;/p&gt;&#xA;" OwnerUserId="2358" LastEditorUserId="2358" LastEditDate="2014-05-29T19:13:37.273" LastActivityDate="2014-05-29T19:13:37.273" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8145" PostTypeId="2" ParentId="8143" CreationDate="2014-05-29T19:28:10.697" Score="4" Body="&lt;p&gt;Here's what I came up with until I find a better way.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    event manager environment downInterface t1&#xA;    event manager environment upInterface t1&#xA;    event manager applet ShutInterface&#xA;     event track 89 state down&#xA;     action 0 cli command &quot;enable&quot;&#xA;     action 1 cli command &quot;conf t&quot;&#xA;     action 2 cli command &quot;interface $downInterface&quot;&#xA;     action 3 cli command &quot;shut&quot;&#xA;     action 4 cli command &quot;end&quot;&#xA;     action 5 syslog priority errors msg &quot;Shutting down $downInterface&quot;&#xA;    event manager applet NoshutInterface&#xA;     event track 89 state up&#xA;     action 0 cli command &quot;enable&quot;&#xA;     action 1 cli command &quot;conf t&quot;&#xA;     action 2 cli command &quot;interface $upInterface&quot;&#xA;     action 3 cli command &quot;no shut&quot;&#xA;     action 4 cli command &quot;end&quot;&#xA;     action 5 syslog priority informational msg &quot;Enabling $upInterface&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5894" LastActivityDate="2014-05-29T19:28:10.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8146" PostTypeId="2" ParentId="8142" CreationDate="2014-05-29T20:25:02.763" Score="6" Body="&lt;p&gt;It sounds like you are trying to put some boundaries on code you are writing for packets through a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reordering should not happen on the switched LAN that you mentioned in your original question.   Reordering could happen if you transit any kind of MPLS  pseudowire, since MPLS is a fundamentally routed technology; routing introduces new forms of multi-path which don't exist in  a traditional bridged LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All that said, packet loss could be equally destructive to assumptions about &quot;no reordering&quot;.  Plan on packet loss through ethernet.  If you are building your own packet transport layer, the SIMPLEST way around the insanity of building your own layer is to use the one that's been tested for more than 20 years: TCP over IP.&lt;/p&gt;&#xA;" OwnerUserId="5025" LastEditorUserId="5025" LastEditDate="2014-05-30T14:17:36.243" LastActivityDate="2014-05-30T14:17:36.243" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8147" PostTypeId="1" AcceptedAnswerId="8151" CreationDate="2014-05-29T20:52:41.797" Score="2" ViewCount="37211" Body="&lt;p&gt;Well, i'm studying to a test, based on the following layers: link, internet, transport and application (Architecture TCP-IP) i would like to know which layer or layers &quot;routers&quot; work and why it can't work in another layers.&lt;/p&gt;&#xA;" OwnerUserId="5898" LastActivityDate="2014-05-29T21:31:30.990" Title="At wich layer &quot;routers&quot; work in architecture TCP-IP" Tags="|router|" AnswerCount="2" CommentCount="2" ClosedDate="2014-05-30T10:08:38.033" ContentLicense="CC BY-SA 3.0" />
  <row Id="8148" PostTypeId="2" ParentId="8147" CreationDate="2014-05-29T21:03:16.107" Score="0" Body="&lt;p&gt;&lt;strong&gt;Routers&lt;/strong&gt; operate on the Internet layer of the TCP-IP model. The &lt;strong&gt;Internet&lt;/strong&gt; layer is synonymous with the &lt;strong&gt;Network&lt;/strong&gt; layer of the OSI model. &lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2014-05-29T21:03:16.107" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8149" PostTypeId="2" ParentId="8142" CreationDate="2014-05-29T21:19:23.820" Score="7" Body="&lt;p&gt;Sequential delivery of frames is considered a hard invariant.  This means that in any properly working network, the frames should always be delivered in the order they are received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you get above L2, this is not always the case as packets can be received out of order.  However if you do tunnel L2 traffic over L3, then the process ideally &lt;em&gt;should&lt;/em&gt; account for making sure that sequential delivery of the frames is enforced even if the packets are received out of order. In practice this is often not the case.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-06-03T01:29:07.540" LastActivityDate="2014-06-03T01:29:07.540" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8151" PostTypeId="2" ParentId="8147" CreationDate="2014-05-29T21:31:30.990" Score="6" Body="&lt;p&gt;Generally speaking, routers utilize the IP protocol (i.e. IP addresses) to make decisions while directing traffic and do not care about the transport protocol.  The IP protocol would map to the internet layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TCP or UDP protocols would operate at the transport layer.  Typically a device that would direct traffic based on transport layer protocols (or application layer) would include proxies, load balancers, or shaping devices depending on its exact function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices that operate at the link layer (most often Ethernet today) would include switches or bridges.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-05-29T21:31:30.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8153" PostTypeId="1" AcceptedAnswerId="8154" CreationDate="2014-05-29T21:59:16.817" Score="5" ViewCount="11371" Body="&lt;p&gt;First time posting in this part of stack exchange and I'm a novice regarding advanced network configuration - plug &amp;amp; play switch installation I can handle ;o)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got myself a HP V1910-48G (former 3com 2900 series) switch and I want to make some VLANs on my network to insure scalability for the future. The choice is based on price and from what I read in the specs HP sells this model as a light layer 3 capable switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network diagram:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/azFBe.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/azFBe.png&quot; alt=&quot;Network diagram of a firewall connected to a HP V1910-48G switch - VLANs&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to achieve the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Small boardcast domains. &lt;/li&gt;&#xA;&lt;li&gt;Separation of concern regarding ip addresses.&lt;/li&gt;&#xA;&lt;li&gt;Scalability.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I've started with the basics to insure that I could make it work but with no succes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN_1 is configured on the switch on all ports - except for port 11&#xA;&amp;amp; 12. &lt;/li&gt;&#xA;&lt;li&gt;The Cisco ASA is connected to port 2 using a manual configured&#xA;IP address - 10.203.5.1/24. &lt;/li&gt;&#xA;&lt;li&gt;The VLAN_1 interface is assigned the IP address 10.203.5.2/24.&lt;/li&gt;&#xA;&lt;li&gt;VLAN_10 is configured on the switch on ports&#xA;11 &amp;amp; 12. &lt;/li&gt;&#xA;&lt;li&gt;A VLAN interface is created on the switch and assigned the IP address 10.203.10.1/24 handling the VLAN_10.&lt;/li&gt;&#xA;&lt;li&gt;The server (serverA) is connected to port 11 and configured&#xA;with a manual IP address 10.203.10.11/24 and running a DHCP scope for&#xA;the 10.203.10.0/24 network. Scope options is pointing Default Gateway to 10.203.10.1.&lt;/li&gt;&#xA;&lt;li&gt;A test client (clientA) is connected to&#xA;port 3 configured manually with the IP address 10.203.5.20/24.  &lt;/li&gt;&#xA;&lt;li&gt;A test client (clientB) is connected to port 12 and is receiving a IP&#xA;address (10.203.10.100) from the DHCP service running on the serverA.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Test scenarios and results.&lt;/strong&gt;&#xA;&lt;br/&gt;&lt;em&gt;Positive:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;clientA can ping VLAN_1 interface &amp;amp; Cisco ASA and also connect to the&#xA;internet. &lt;/li&gt;&#xA;&lt;li&gt;clientB can ping serverA, VLAN_10 interface &amp;amp; VLAN_1 interface. &lt;/li&gt;&#xA;&lt;li&gt;serverA can ping VLAN_10 interface &amp;amp; VLAN_1 interface.&lt;/li&gt;&#xA;&lt;li&gt;switch can ping 8.8.8.8 from the web management interface. &lt;strong&gt;(added)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Negative:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;clientA can't ping clientB. &lt;/li&gt;&#xA;&lt;li&gt;clientA can't ping serverA. &lt;/li&gt;&#xA;&lt;li&gt;clientB can't ping clientA. &lt;/li&gt;&#xA;&lt;li&gt;clientB can't ping Cisco ASA. &lt;/li&gt;&#xA;&lt;li&gt;clientB can't connect to the internet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've been searching all day for clues on the internet and I can see I'm not the only one have issues with this model and the VLAN routing. I have managed to open telnet and SSH so I'm able to use the CLI. I know about the &lt;a href=&quot;http://glazenbakje.wordpress.com/2012/08/21/hp-v1910-secret-commando-list-how-to-enable-it/&quot; rel=&quot;noreferrer&quot;&gt;secret command list&lt;/a&gt; , the code: 512900 and system-view command. From my knowledge the OS/CLI inside is based on Comware 5 or a subset derived from that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did find a few post out there saying something about that the switch isn't shipped with routing enabled and lots of commands trying to enable ip routing. I've have tried them all but most of the wasn't able to run at all. I know the switch i a 3com 2900 and some of the post I'm finding might confuse the search engines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read all relevant posts on &lt;a href=&quot;http://vmfocus.com/?s=v1910&amp;amp;submit=Search&quot; rel=&quot;noreferrer&quot;&gt;www.vmfocus.com&lt;/a&gt; where he post a great deal of blog entries target toward the HP V1910. But I can't get my head around the ACL or the need of that, to handle ip routing from VLAN_10 to VLAN_1. Maybe my problems start here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm no expert and I'm trying to make a decent solution, but my skills (or the product) couldn't bring me any further than this. I hope some of you can guide me in the correct direction so I can use the full potential of my HP V1910. If my network design is flawed with obvious mistakes please bare with me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just need to make VLAN_10 work in the first place after that works I think I will be able to configure the remaining VLANs by myself.&lt;/p&gt;&#xA;" OwnerUserId="5899" LastEditorUserId="3191" LastEditDate="2014-05-29T22:03:40.650" LastActivityDate="2014-05-29T22:55:47.483" Title="HP V1910, VLAN routing - what did I miss?" Tags="|routing|vlan|acl|hp|cli|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8154" PostTypeId="2" ParentId="8153" CreationDate="2014-05-29T22:55:47.483" Score="5" Body="&lt;p&gt;Your problem is, indeed, with routing. Things in VLAN 1 are using 5.1 as the gateway, right? 5.1 doesn't know about any other internal networks. (i.e. VLAN 10) Likewise, the hosts in VLAN 1 don't know about VLAN 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When clientA tries to ping serverA, the packets go to the ASA and die as it doesn't know where to send them. (it's default route would send them to the internet!) When serverA tries to ping clientA, the packets go to the switch and then to clientA, but then the replies, as before, go away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this reason, it's common to keep the &quot;routing hardware&quot; and &quot;hosts&quot; in different networks. VLAN 1 being just the ASA and Switch. And then VLANs 10 and 11 for the two internal networks. The switch would then be the gateway for VLAN 10&amp;amp;11, with it's default being the ASA.  The ASA would have to have static routes added telling it about the internal networks -- routed to the switch.  &lt;strong&gt;Without&lt;/strong&gt; this, either the ASA has to &quot;hairpin&quot; traffic back to the switch to reach VLAN 10, or every host in VLAN 1 needs its own route to VLAN 10 (via the switch.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-05-29T22:55:47.483" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8155" PostTypeId="1" CreationDate="2014-05-30T02:40:56.457" Score="1" ViewCount="78" Body="&lt;p&gt;I took information from several images and compiled it into one and am wondering if it's correct. Looking at the smallest components of the packet -&gt; fragments -&gt; frame would this diagrammatically/logically be correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wUMpL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5606" LastActivityDate="2014-05-30T02:40:56.457" Title="Is this a Proper WLAN Fragmentation Diagram I made?" Tags="|packet-analysis|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8162" PostTypeId="1" AcceptedAnswerId="8163" CreationDate="2014-05-30T12:44:43.390" Score="9" ViewCount="2870" Body="&lt;p&gt;Let me explain, we have a two analogue lines (something like 16 pair each, the standard cable that's put into buildings) that come into our building but they pass through the building next door. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two cables were cut  in two places (and i mean straight through its now 3 cables), the engineers then twisted each individual cable back together and used insulation tape to keep it together. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to know is what side effects should I be getting from the damaged cables.&#xA;I have been pinging an outside IP address all day in CMD and every 16 ping's or so I get 1-2 timeouts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this is the correct place to put this on stack exchange? if its not sorry :)&lt;/p&gt;&#xA;" OwnerUserId="5904" LastEditorUserId="8499" LastEditDate="2018-12-21T04:33:20.400" LastActivityDate="2018-12-21T04:33:20.400" Title="Internet Cable Has Been cut in two and taped back together" Tags="|internet|layer1|cable|cabling|speed|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8163" PostTypeId="2" ParentId="8162" CreationDate="2014-05-30T13:54:55.560" Score="19" Body="&lt;p&gt;This can introduce a number of problems, like additional attenuation or cross talk.  Splicing is to be avoided whenever possible, but I have seen this work in a pinch although I would &lt;strong&gt;never&lt;/strong&gt; recommend it.  They key is to use a cable certification tester (not just a continuity tester) to make sure it still passes your required standard (Cat5/5E/6) after splicing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also be concerned about the manner of the splice.  Twisting and electrical tape are not a reliable splicing method.  Even if it is working properly initially, there is too much chance of problems to occur over time as the cables move slightly (temp changes, building vibrations, large vehicles driving by, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The very first type of problem you can experience would be the inability to connect over the cable.  Since it appears you can do so, then the next problem would be frame loss, often from corrupted frames that will get dropped when they fail a consistency check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have real equipment on both sides of this link, you should be able to view the interface statistics and see how many frames are being dropped as well as the reasons.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-05-30T13:54:55.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8166" PostTypeId="1" AcceptedAnswerId="8167" CreationDate="2014-05-30T16:08:38.443" Score="6" ViewCount="13505" Body="&lt;p&gt;I have a long run of Cat5e which is broken at about 20' from one end. Replacing the entire cable isn't an option, as it's fairly long and is going through walls and such. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching this on google produced nothing but silly results, one of which recommended a splice box, but I'm concerned about signal attenuation, as well as the voltage from the POE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thoughts were to re-run a cable from the shorter end (again, about 20') and terminate the ends. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a best practice for how they should connect?  Should they be terminated as male ends and connected using a female-to-female coupler? or as female ends and connected using a short patch cable?&lt;/p&gt;&#xA;" OwnerUserId="5908" LastEditorUserId="8499" LastEditDate="2018-03-20T23:34:34.077" LastActivityDate="2023-05-19T20:47:06.600" Title="How to repair a break in a long Cat-5e cable run" Tags="|layer1|cabling|cable|utp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8167" PostTypeId="2" ParentId="8166" CreationDate="2014-05-30T16:23:47.923" Score="14" Body="&lt;p&gt;&lt;em&gt;Anything&lt;/em&gt; you choose to do will increase attenuation and potentially shorten the distance you can run PoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no best practice answer to this as the best practice is to re-run the cable.  Since you can't (or aren't willing to do this) then I would do one of two things, although I would still highly recommend running a new cable (you can use the old cable to pull the new cable through walls, etc).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use a quality mechanical splice solution maintaining the characteristics of the cable as much as possible (i.e. don't untwist or remove more jacket than needed).  This may include the splice box you found or may simply be the use of IDC splice connectors (although these are more of a voice solution).&lt;/li&gt;&#xA;&lt;li&gt;Run a 20-30' cable to the break.  Terminate one side to a surface mount jack and the other to a male end. This still increases the terminations by two but will eliminate the coupler.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;No matter what you choose to do, after you are done make sure you re-certify the cable with a tester to make sure it meets your standard (Cat5E from your post).&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-05-30T16:31:26.207" LastActivityDate="2014-05-30T16:31:26.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8168" PostTypeId="1" AcceptedAnswerId="8169" CreationDate="2014-05-30T22:19:51.443" Score="0" ViewCount="1210" Body="&lt;p&gt;I'm a student of electronics and get lessons in networking as well. But on one of my tests I got the question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What subnet mask is indicated by the network address 172.16.4.8/18?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the answer is 255.255.192.0 but I don't understand why the answer must be 255.255.192.0 and how to calculate the subnet mask? Also what does the /18 mean?&lt;/p&gt;&#xA;" OwnerUserId="5913" LastActivityDate="2014-05-30T22:26:39.767" Title="Calculate subnet mask" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="0" ClosedDate="2014-05-30T22:30:11.253" ContentLicense="CC BY-SA 3.0" />
  <row Id="8169" PostTypeId="2" ParentId="8168" CreationDate="2014-05-30T22:26:39.767" Score="1" Body="&lt;p&gt;You must read a subnet mask in binary. Since your IP address ends with /18 it means the first 18 bits are high and the others are low. Getting a binary code of 11111111.11111111.11000000.0000. Put it back to decimals and you'll get 255.255.192.0 &lt;/p&gt;&#xA;" OwnerUserId="5915" LastActivityDate="2014-05-30T22:26:39.767" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8172" PostTypeId="1" AcceptedAnswerId="10595" CreationDate="2014-05-31T15:00:58.927" Score="3" ViewCount="338" Body="&lt;p&gt;Cisco SG500X-24P Switch.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Goal&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Only admin tagged frames, discard untagged frames (ingress &amp;amp; egress)&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Is the following configuration correct:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port VLAN Mode: &lt;strong&gt;General&lt;/strong&gt;&lt;br&gt;&#xA;VLANs: &lt;strong&gt;100T, 200T, 4095P&lt;/strong&gt;&lt;br&gt;&#xA;Ingress filtering &lt;strong&gt;enabled&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;Admit Tagged Only&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything else that I should configure to discard untagged traffic?&lt;/p&gt;&#xA;" OwnerUserId="5273" LastActivityDate="2015-09-18T16:20:20.233" Title="Cisco SG500x-24P - Discard untagged" Tags="|cisco|vlan|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8175" PostTypeId="1" AcceptedAnswerId="8177" CreationDate="2014-06-01T08:41:21.827" Score="2" ViewCount="573" Body="&lt;p&gt;I hope my question is fine for this group, and if not, I'll remove it as soon as required.&#xA;Hereis a shot description of our problem:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Our system has many clients (about 500) that should be updated via WiFi 802.11b through the same ftp server. &lt;/li&gt;&#xA;&lt;li&gt;We can't modify the network setup (i.e. we can't use 802.11g/n client) but we can update firmware on the peers.&lt;/li&gt;&#xA;&lt;li&gt;The size of the update is 200 MB and the clients access.&lt;/li&gt;&#xA;&lt;li&gt;the clients can't be updated in different slice time, since they wake up and shutdown almost at the same time.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since ftp unicast connections are a bottleneck, we are evaluating a multicast over WiFi approach. (something similar to the way TV producer use DTV channel to transmit firmware updates)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I didn't find, on the web, many information about this idea on WiFi. &#xA;I found something about broadcast video streaming, but nothing more. Is there someone that can provide me an idea, a well documented protocol in order to implement such a system?&#xA;Furthermore, is there someone that, if so, can explain where our approach is wrong?&#xA;Thanks a lot&#xA;Giovanni&lt;/p&gt;&#xA;" OwnerUserId="5925" LastActivityDate="2014-06-01T19:59:50.837" Title="Multicast update on wifi network" Tags="|wireless|multicast|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8177" PostTypeId="2" ParentId="8175" CreationDate="2014-06-01T19:59:50.837" Score="2" Body="&lt;p&gt;mtftp would be what you're looking for. &lt;strong&gt;HOWEVER&lt;/strong&gt;, you are very quickly going to learn wireless (esp. old 802.11b hardware) and multicast do not play well together.  Outside Uverse circles, it's hard to tell what wireless APs can deal with multicast -- Uverse has wireless receivers fed from an isolated AP, but the limit of &lt;em&gt;2&lt;/em&gt; STBs suggests they don't work so well either.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-01T19:59:50.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8180" PostTypeId="1" CreationDate="2014-06-02T01:31:34.937" Score="0" ViewCount="1887" Body="&lt;p&gt;Which one is the most common high availability techniques? It seems that I can't distinguis the different between the two concept.&lt;/p&gt;&#xA;" OwnerUserId="5930" LastEditorUserId="3191" LastEditDate="2014-12-08T20:25:03.143" LastActivityDate="2014-12-08T20:25:03.143" Title="Load balancing vs hardware clustering" Tags="|load-balancer|" AnswerCount="1" CommentCount="2" ClosedDate="2019-05-31T01:51:50.857" ContentLicense="CC BY-SA 3.0" />
  <row Id="8181" PostTypeId="1" AcceptedAnswerId="8183" CreationDate="2014-06-02T05:05:33.630" Score="10" ViewCount="3732" Body="&lt;p&gt;I think it's a very classical question, but, thought I've have some background, I don't have enough vocabulary anymore to search and understand correctly in the Web.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I have a home network with 192.168.0.1 (IP.1) and 192.168.0.2 (IP.2) and we are both playing to Counter Strike hitting exactly the same outside server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How my home router know wich packet will goes to IP.1 ? I often read stuff with NAT and xxx.xxx/y adresses. **Where is written the /y part in the TCP/IP stack ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do we need absolutely NAT for that ? What I have understood from Wikipedia article is that NAT is made to optimize IP addresses, when some computers are turned off. Does it also allow to connect 5 devices with only 1 public IP ?&lt;/p&gt;&#xA;" OwnerUserId="5931" LastEditorUserId="775" LastEditDate="2014-06-02T10:03:44.873" LastActivityDate="2014-06-02T10:03:44.873" Title="How does NAT share one public IPv4 address across multiple private IPv4 addresses" Tags="|routing|ipv4|nat|" AnswerCount="1" CommentCount="1" ClosedDate="2014-06-02T15:10:40.920" ContentLicense="CC BY-SA 3.0" />
  <row Id="8183" PostTypeId="2" ParentId="8181" CreationDate="2014-06-02T09:28:49.613" Score="15" Body="&lt;p&gt;(For the following I will ignore any DNS lookups or layer two action, since that isn't the relevant part for the NAT story.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any TCP connection is a tuple of four parts:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;source IP&amp;gt; &amp;lt;source port&amp;gt; &amp;lt;destination IP&amp;gt; &amp;lt;destination port&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In short: the destination IP is used to get the packet to the correct machine, the destination port is used to get the packet on that machine to the correct program/session&#xA;The source IP is used to know where to send any replies. Same goes for source port. When a reply is sent, the source and destination are simply swapped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's start with two computers without any NAT:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The computer has IP &lt;code&gt;1.1.1.1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The webserver has IP &lt;code&gt;3.3.3.3&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The standard port for HTTP is &lt;code&gt;80&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When a computer asks for a webpage, it wil first select a random unused portnumber from the random range (1024-65535). Let's pick &lt;code&gt;2345&lt;/code&gt;. Then the following sequence will happen:&#xA;Computer send it's packet with: source IP &lt;code&gt;1.1.1.1&lt;/code&gt;, source port &lt;code&gt;2345&lt;/code&gt;, destination IP &lt;code&gt;3.3.3.3&lt;/code&gt;, destination port &lt;code&gt;80&lt;/code&gt;. The packets arrive at the webserver, it sees it's own IP and port &lt;code&gt;80&lt;/code&gt;, so it knows this is a request for a webpage. &#xA;The webserver then sends the webpage back in packets with Source IP &lt;code&gt;3.3.3.3&lt;/code&gt;, Source port 80, destination IP &lt;code&gt;1.1.1.1&lt;/code&gt;, destination port &lt;code&gt;2345&lt;/code&gt;. The computer recieves these packets, and knows wich requested webpage it was, because of the portnumber &lt;code&gt;2345&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These port combinations are often written as such: &lt;code&gt;1.1.1.1:2345&lt;/code&gt; and &lt;code&gt;3.3.3.3:80&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the number of computers on the internet far outnumbers the number of IPv4 addresses available. To preserve address space, a set of private address ranges was introduced, that can be freely used for address sharing. These rangese are referred to as RFC1918 and are the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.0.0 - 192.168.255.255&lt;/li&gt;&#xA;&lt;li&gt;172.16.0.0 - 172.31.255.255&lt;/li&gt;&#xA;&lt;li&gt;10.0.0.0 - 10.255.255.255&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These addresses are nowhere in the internet routing tables, so if you would send a packet with a destination in these ranges on the backbone of the internet, they will simply get dropped. This is because millions of people use the same addresses. These addresses need to be translated to something useful for the internet. This is where Network Address Translation comes in:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have two computers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A: &lt;code&gt;192.168.0.1&lt;/code&gt; and B: &lt;code&gt;192.168.0.2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Their gateway has a public IP of &lt;code&gt;1.1.1.1&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;We keep the same webserver.&lt;/li&gt;&#xA;&lt;li&gt;Both computers want the same webpage from the same server.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;First both computers select a random port: let's say: &lt;code&gt;192.168.0.1:2345&lt;/code&gt; and &lt;code&gt;192.168.0.2:5432&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer A send it's packet with source &lt;code&gt;192.168.0.1:2345&lt;/code&gt; and destination &lt;code&gt;3.3.3.3:80&lt;/code&gt;. The gateway translates this packet to source &lt;code&gt;1.1.1.1:2345&lt;/code&gt; destination &lt;code&gt;3.3.3.3:80&lt;/code&gt; and remembers that any replies to this combination goes to &lt;code&gt;192.168.0.1&lt;/code&gt;. So, when it recieves a reply with source &lt;code&gt;3.3.3.3:80&lt;/code&gt; and destination &lt;code&gt;1.1.1.1:2345&lt;/code&gt;, it will translate it to source &lt;code&gt;3.3.3.3:80&lt;/code&gt; and destination &lt;code&gt;192.168.0.1:2345&lt;/code&gt; and send the packet on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer B send it's packet with source &lt;code&gt;192.168.0.2:5432&lt;/code&gt; and destination &lt;code&gt;3.3.3.3:80&lt;/code&gt;. The gateway translates this packet to source &lt;code&gt;1.1.1.1:5432&lt;/code&gt; destination &lt;code&gt;3.3.3.3:80&lt;/code&gt; and remembers that any replies to this combination goes to &lt;code&gt;192.168.0.2&lt;/code&gt;. So, when it recieves a reply with source &lt;code&gt;3.3.3.3:80&lt;/code&gt; and destination &lt;code&gt;1.1.1.1:5432&lt;/code&gt;, it will translate it to source &lt;code&gt;3.3.3.3:80&lt;/code&gt; and destination &lt;code&gt;192.168.0.2:5432&lt;/code&gt; and send the packet on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If both computers happen to select the same source port number, the gateway will simply pick another free random source port number, and remember to translate the port number as well. This is sometimes refered to as PAT (Port Address Translation). This is basically a subset of NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several implementations to this all. The gateway might simply only remember &quot;Computer X used source port Y&quot; and forward anything with port Y to computer X. It might remember that Computer X used source port Y and destination Z&quot; and only forward anything from port Z to port Y back to computer X. Or there is the option that it remembers the entire tuple and only send traffic to computer X that match the entire source/destination ip and port.&lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2014-06-02T09:28:49.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8185" PostTypeId="1" AcceptedAnswerId="43344" CreationDate="2014-06-02T13:30:09.877" Score="1" ViewCount="235" Body="&lt;p&gt;From a Windows 7 box, connected to what should be a private network, what is the best / most foolproof approach to detecting a connected router? The end-goal is to prevent the private network from ever being connected to any other network and so, upon detecting a connected router, the workstations will be shut down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about using ICMP router discovery, but that imposes a reliance on ICMP being enabled on the routers (don't admins generally disable ICMP to prevent attacks?). Thought about maybe just doing a tracert to 8.8.8.8 and parse the output. I don't yet have a test setup so am just researching at this point, trying to come up with a design. Dr Google has not come up with much beyond the usual &quot;how do I find my router's IP&quot; responses.&lt;/p&gt;&#xA;" OwnerUserId="5934" LastEditorUserId="3191" LastEditDate="2014-12-08T20:25:24.100" LastActivityDate="2017-08-17T14:49:16.147" Title="How to detect router from Windows 7?" Tags="|router|monitoring|" AnswerCount="4" CommentCount="8" ClosedDate="2018-03-03T16:36:21.920" ContentLicense="CC BY-SA 3.0" />
  <row Id="8186" PostTypeId="1" AcceptedAnswerId="8195" CreationDate="2014-06-02T13:42:40.327" Score="2" ViewCount="211" Body="&lt;p&gt;So I got to thinking today, as I was working on a task, that systems need to know a gateway to which to forward packets which are destined for non-local networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I recalled that, in a former life, we use to statically assign our workstation IP's and set the default gateway to also be that same IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And that's what got me wondering... why did that work?&lt;/p&gt;&#xA;" OwnerUserId="5934" LastEditorUserId="3191" LastEditDate="2014-12-08T20:21:27.007" LastActivityDate="2021-01-26T10:33:46.067" Title="Setting Default GW to Local IP" Tags="|routing|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="8187" PostTypeId="2" ParentId="8185" CreationDate="2014-06-02T17:25:15.760" Score="1" Body="&lt;p&gt;Using a sniffer to identify traffic normally generated by routers (OSPF,RIP,VRRP,etc) could help with this task. As you mention, looking for ICMP router advertisements would not hurt either.&#xA;Also you can configure the switches to send traps when a port comes up. Then you can check the MAC address learned on that port and have an idea of what type of device was connected to the network.&lt;/p&gt;&#xA;" OwnerUserId="5469" LastActivityDate="2014-06-02T17:25:15.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8188" PostTypeId="2" ParentId="8186" CreationDate="2014-06-02T20:31:57.967" Score="0" Body="&lt;p&gt;It only worked because you didn't really need a gateway, since you were communicating with other systems on the same local subnet. If you had tried to reach an outside system, it should have failed.&lt;/p&gt;&#xA;" OwnerUserId="1672" LastActivityDate="2014-06-02T20:31:57.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8189" PostTypeId="1" AcceptedAnswerId="8193" CreationDate="2014-06-02T20:34:57.447" Score="4" ViewCount="7247" Body="&lt;p&gt;What exactly is the difference between ICMP type 3 code 1 and code 7 messages? By reading their descriptions they seem to be used for the same purpose. I am trying to understand when a router will choose to send one or the other.&lt;/p&gt;&#xA;" OwnerUserId="5469" LastActivityDate="2014-06-03T00:56:11.843" Title="ICMP type 3 code 1 and 7, what is the diference?" Tags="|protocol-theory|icmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8190" PostTypeId="2" ParentId="8185" CreationDate="2014-06-02T20:47:16.590" Score="0" Body="&lt;p&gt;Have the system request (but not accept) a new IP address via DHCP every few minutes, and if it gets an offer from an unfamiliar source, that's your rogue router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to look at using &lt;a href=&quot;http://www.secdev.org/projects/scapy/doc/installation.html#windows&quot; rel=&quot;nofollow&quot;&gt;Scapy&lt;/a&gt; to generate and process the &quot;fake&quot; DHCP packets.&lt;/p&gt;&#xA;" OwnerUserId="1672" LastActivityDate="2014-06-02T20:47:16.590" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8191" PostTypeId="2" ParentId="8180" CreationDate="2014-06-02T21:41:47.423" Score="2" Body="&lt;p&gt;Load balancing spreads incoming requests across a pool of servers, each of which is a mostly independent system. Clustering creates one big server out of a pool of hardware boxes, which are tightly linked. Load balancing is generally easier to manage and maintain, so it is becoming the preferred solution for many applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes the servers are load balanced, but the application is clustered - this is a built-in feature of most large-scale database software, to ensure that separate copies of the database can't get out of sync.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Web server systems are often built with one load balancing server (to distribute incoming requests), a pool of web servers (to serve the requests), and a pool of database servers running a clustered database (so everyone sees the same data).&lt;/p&gt;&#xA;" OwnerUserId="1672" LastActivityDate="2014-06-02T21:41:47.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8193" PostTypeId="2" ParentId="8189" CreationDate="2014-06-03T00:56:11.843" Score="4" Body="&lt;p&gt;The differences are explained in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1812#page-81&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1812 IPv4 Router Requirements, page 81&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;1 = Host Unreachable - generated by a router if a forwarding path&#xA;(route) to the destination host on a directly connected network&#xA;is not available (does not respond to ARP);&lt;/p&gt;&#xA;&lt;p&gt;7 = Destination Host Unknown - generated only when a router can&#xA;determine (from link layer advice) that the destination host&#xA;does not exist;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Later in the RFC, it requires routers not to send a &amp;quot;Network Unreachable&amp;quot; instead of Type 3 Codes 1 or 7 when other hosts on the subnet &lt;em&gt;are&lt;/em&gt; reachable...&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Routers MUST use Host Unreachable or Destination Host Unknown codes&#xA;whenever other hosts on the same destination network might be&#xA;reachable; otherwise, the source host may erroneously conclude that&#xA;all hosts on the network are unreachable, and that may not be the&#xA;case.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Speaking practically, I haven't seen a router implement Type 3 Code 7 (Destination Host Unknown), normally I see Type 3 Code 1 (Host Unreachable).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-06-03T00:56:11.843" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8194" PostTypeId="2" ParentId="8143" CreationDate="2014-06-03T01:48:55.813" Score="2" Body="&lt;p&gt;I think you need to add to your route-map.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;set ip next-hop YOUR_IP_ADDRESS&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Where YOUR_IP_ADDRESS is the next hop router you want to route to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eg)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map policyRouting permit 10&#xA; match ip address VoIP&#xA; set ip next-hop x.y.z.w&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should be able to keep the set interface command however the router should automatically select the interface which matches its routing table.&#xA;Without the set ip next-hop command, the router will forward the packet based on its routing table - regardless of the interface required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 12.2 based code - take a look at &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html#wp1001052&quot; rel=&quot;nofollow&quot;&gt;Cisco's documentation&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="343" LastActivityDate="2014-06-03T01:48:55.813" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8195" PostTypeId="2" ParentId="8186" CreationDate="2014-06-03T02:24:49.780" Score="6" Body="&lt;p&gt;In a word: &lt;em&gt;proxy-arp&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a Bad Word&amp;trade; in networking today, but in years long past it's the way things were done before &quot;default gateways&quot; were used -- back when &lt;em&gt;The Internet&lt;/em&gt; was much smaller and no one worried about &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3243/something-is-filling-my-force10-arp-table&quot;&gt;ARP tables growing to thousands of entries&lt;/a&gt;. Machines would &lt;em&gt;ARP&lt;/em&gt; for any address as if it were connected to the local LAN. The (&quot;any&quot;) router on the LAN with a path to the host would respond with it's address. It still works today... if you overlook the massive security hole. (who ever answers first wins and is now receiving traffic for whatever. aka instant &lt;em&gt;man-in-the-middle&lt;/em&gt; attack.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[I'm actually doing this in our OpenStack test lab.  It allows the (/24) network to be sub-divided behind each stack. Because each host will proxy-arp for that stub, machines in the main network will still be able to get there without any explicit routes.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-06-03T02:40:29.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8196" PostTypeId="2" ParentId="8186" CreationDate="2014-06-03T03:50:27.467" Score="1" Body="&lt;p&gt;The default gateway is only used by a device if there are no &lt;em&gt;better&lt;/em&gt; routes to the destination network in the routing table.  If the device doesn't communicate to networks that aren't in the routing table, then the default gateway will never be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing tables can be updated on a device by making static changes or through the use of a dynamic routing protocol.  Static entries don't scale well and can be problematic to maintain so most often a dynamic routing protocol is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers acting as gateways to a network can advertise the networks (possibly including the &quot;default&quot; network of 0.0.0.0/0) to which they have access.  Client devices that are configured to listen to these advertisements can learn about these networks and update their routing tables accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not knowing more about the specific environment you mentioned, I would suspect Ricky's answer about proxy-arp is far more likely, but I figured I would add this as a possibility as well.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-06-03T03:50:27.467" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8200" PostTypeId="1" AcceptedAnswerId="8237" CreationDate="2014-06-03T14:48:50.537" Score="3" ViewCount="945" Body="&lt;p&gt;O.P.&#xA;Hi ,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to configure a Cisco LNS with VRF per Customer.&#xA;Each customer that dial (PPPoE) to the LNS will bond to the appropiate VRF.&#xA;The VRF will be assign according to the RADIUS AV-PAIR.&#xA;I have already configured the RADIUS and the Cisco Router but for some reason it did not work. ( the L2TP tunnel shuts immediately ).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;I will be thankful for any help or suggestion !!&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;My configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;( Cisco 3845 , IOS -advipservicesk9-mz.151-4.M8 )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link : &lt;a href=&quot;http://1drv.ms/1kuWjgM&quot; rel=&quot;nofollow&quot;&gt;http://1drv.ms/1kuWjgM&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5942" LastEditorUserId="5942" LastEditDate="2014-06-03T21:48:53.223" LastActivityDate="2014-06-05T08:22:57.057" Title="Cisco LNS and per Customer VRF" Tags="|cisco|isp|vrf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8201" PostTypeId="1" CreationDate="2014-06-03T14:55:32.397" Score="4" ViewCount="5388" Body="&lt;p&gt;I have just installed Kiwi Syslog Server and is trying to capture Syslog messages from my Cisco 2960 Switches. Based on the docs online I have created following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging 192.168.1.5&#xA;logging trap 7&#xA;logging facility local7&#xA;service timestamps debug datetime localtime msec year &#xA;service sequence-numbers &#xA;archive&#xA;    log config&#xA;        logging enable&#xA;        logging size 1000&#xA;        exit&#xA;    exit&#xA;clock timezone IST +5 30 &#xA;logging source-interface vlan 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I dont see all the logs being sent to the Server. Here is the result of Show logging:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;G01#sh logging &#xA;Syslog logging: enabled (0 messages dropped, 0 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)&#xA;&#xA;No Active Message Discriminator.&#xA;&#xA;&#xA;&#xA;No Inactive Message Discriminator.&#xA;&#xA;&#xA;    Console logging: level debugging, 1228 messages logged, xml disabled,&#xA;                     filtering disabled&#xA;    Monitor logging: level debugging, 0 messages logged, xml disabled,&#xA;                     filtering disabled&#xA;    Buffer logging:  level debugging, 1228 messages logged, xml disabled,&#xA;                     filtering disabled&#xA;    Exception Logging: size (4096 bytes)&#xA;    Count and timestamp logging messages: disabled&#xA;    File logging: disabled&#xA;    Persistent logging: disabled&#xA;&#xA;No active filter modules.&#xA;&#xA;    Trap logging: level debugging, 1232 message lines logged&#xA;        Logging to 192.168.1.5  (udp port 514,  audit disabled,&#xA;              authentication disabled, encryption disabled, link up),&#xA;              14 message lines logged, &#xA;              0 message lines rate-limited, &#xA;              0 message lines dropped-by-MD, &#xA;              xml disabled, sequence number disabled&#xA;              filtering disabled&#xA;&#xA;Log Buffer (4096 bytes):&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could someone please tell me why even though 1232 message lines are logged by the trap only 14 are sent to the server itself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My key goals are to ensure that any interface up/down, any kind of debug information any kind of configuration changes are all logged and sent to Syslog server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please advice,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="5350" LastActivityDate="2014-06-03T18:04:53.443" Title="Cisco 2960 Syslog - All logs not sent to Server" Tags="|cisco|cisco-2960|syslog|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8203" PostTypeId="1" CreationDate="2014-06-03T16:52:04.853" Score="2" ViewCount="2734" Body="&lt;p&gt;why do we need different vlans with same subnet on cisco asa firewall. can't we have same vlan on all interfaces with different ip addresses from same subnet on it? &lt;/p&gt;&#xA;" OwnerUserId="5115" LastActivityDate="2014-06-03T17:14:31.560" Title="why do we need different vlans but same subnet on ASA transparent mode firewall?" Tags="|cisco|cisco-asa|firewall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8204" PostTypeId="2" ParentId="8203" CreationDate="2014-06-03T17:07:19.073" Score="4" Body="&lt;p&gt;The ASA uses bridge groups for transparent firewall configurations.  Bridge groups require distinct interfaces, which includes the vlan tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you dont want multiple firewall contexts to share the same physical interface on the ASA, you can simply put two physical interfaces (using their untagged native vlan) in the same bridge group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need dot1q trunks on the firewall with multiple transparent firewall contexts sharing the same physical interface, then you're stuck with bridging two different vlans.  The good news is that many Cisco switches have &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2257/configure-cisco-asa-in-transparent-mode-layer2-dmz-w-vlan-translation&quot;&gt;vlan translation capabilities&lt;/a&gt; (also called &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/15-1/XE_330SG/configuration/guide/config/tunnel.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;vlan mapping&lt;/a&gt;);  see the question I linked for one example of how I worked around the problem by retranslating one of the dot1q trunks with vlan mapping.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-06-03T17:14:31.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8205" PostTypeId="2" ParentId="8201" CreationDate="2014-06-03T18:04:19.547" Score="3" Body="&lt;p&gt;When logging to an external or syslog server, only new log entries are sent to the server.  Old log entries will not be sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably only have 14 log messages because that is all that have been generated since you installed the syslog server.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-06-03T18:04:19.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8206" PostTypeId="2" ParentId="8201" CreationDate="2014-06-03T18:04:53.443" Score="6" Body="&lt;p&gt;Is this output from after a reboot?  You may have 1232 lines since you rebooted the device, but only 14 messages since you setup the syslog server.  The switch won't send any old messages, just newly-generated ones.&lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2014-06-03T18:04:53.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8208" PostTypeId="1" CreationDate="2014-06-03T19:10:09.180" Score="1" ViewCount="125" Body="&lt;p&gt;I've been looking around in manuals and Cisco Books, but nowhere have I found how long an entry lives in the IPv6 Neighbour table. If that depends on the implementation, what is it for Cisco?&lt;/p&gt;&#xA;" OwnerUserId="5948" LastEditorUserId="619" LastEditDate="2014-06-03T22:22:13.987" LastActivityDate="2014-06-03T22:26:05.467" Title="How long does an IPv6 neighbour table entry last?" Tags="|cisco|ipv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8209" PostTypeId="1" AcceptedAnswerId="8215" CreationDate="2014-06-03T20:11:43.223" Score="6" ViewCount="6756" Body="&lt;p&gt;I'm trying to open some ports in my ASA 5505 Firewall with the 9.0(1) software. I've being using another ASA with a lower software version. As you can imagine I'm quite confused and have been reading all CLI guides from Cisco and looking at different blogs for help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to open some external ports and trying to map them into my inside servers. I would like to use different ports on the onside and translate them to the original port on the inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;outside = 77.77.77.77&lt;br&gt;&#xA;inside = 10.203.5.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to open for port 10001 and send that into my network while translating it into port 3389. So I'm basically trying to open for multiple servers via RDP but I only got 1 public IP address to work with. I would like to keep the port 3389 on all servers, so when on the inside LAN people can connect to the server without worrying about custom ports. When they are on the outside the have to use 77.77.77.77:10001 to connect to the server through the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand the commands have changed quiet a bit since I last did the above configuration and that is I'm feeling stuck. I've tried following the examples on this &lt;a href=&quot;http://www.vionblog.com/cisco-asa-nat-migration/&quot; rel=&quot;noreferrer&quot;&gt;link&lt;/a&gt; but without getting lucky. I think i read somewhere that I need 2 objects to do a correct NAT with a PAT configuration or am I way of here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate it if any one could point me in some direction because where I'm now I can't the ASA to do what I believe it is built to do :o)  &lt;/p&gt;&#xA;" OwnerUserId="5899" LastActivityDate="2014-06-04T16:56:09.993" Title="Cisco ASA 9.0(1) - NAT / PAT" Tags="|cisco|cisco-asa|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8210" PostTypeId="1" CreationDate="2014-06-03T20:23:37.917" Score="3" ViewCount="344" Body="&lt;p&gt;I have a cisco 4510R+E switch.  I know how to configure uplinks on other switches via the hw-module commands.  I am not seeing any options under hw-module to configure from 10gig to 1gig.  Hoping someone might know how to convert the uplinks on this switch from 10 gig to 1 gig? The IOS version is 03.05.00.E  15.0(1r)SG5.&lt;/p&gt;&#xA;" OwnerUserId="5188" LastActivityDate="2014-06-04T15:36:11.133" Title="Convert 10gig to Gig on Cisco 4510R+E switch" Tags="|cisco|switch|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8211" PostTypeId="1" AcceptedAnswerId="8212" CreationDate="2014-06-03T21:55:33.547" Score="4" ViewCount="317" Body="&lt;p&gt;I'm trying to isolate SQL commands sent from another PC on the same subnet using WireShark. I know the PC's local IP address (first three numbers are the same as my PC's) but when I start the capture and perform a function on the app that sends and receives data from the Oracle server, zero packets are captured for that PC. No packets appear even when I just browse the web on that PC. I see packets from other PCs I'm not interested in. Any idea why the PC I'm interested in is invisible to WireShark?  Thanks!&lt;/p&gt;&#xA;" OwnerUserId="5949" LastActivityDate="2014-06-05T20:44:16.893" Title="Why are there no packets for PC on the same network in Wireshark?" Tags="|wireshark|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8212" PostTypeId="2" ParentId="8211" CreationDate="2014-06-03T22:15:45.480" Score="9" Body="&lt;p&gt;Simple... because switches don't put packets on links where they don't belong / aren't needed. You are neither the server nor the PC, so you won't see either packets.  This is where &lt;em&gt;port mirroring&lt;/em&gt; comes in -- if your switch supports it.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-03T22:15:45.480" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8213" PostTypeId="2" ParentId="8208" CreationDate="2014-06-03T22:26:05.467" Score="2" Body="&lt;p&gt;For Cisco IOS the default cache timeout is &quot;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/ipv6/command/reference/ipv6_book/ipv6_07.html#wp2374068&quot; rel=&quot;nofollow&quot;&gt;14,400 seconds (4 hours)&lt;/a&gt;&quot;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-03T22:26:05.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8215" PostTypeId="2" ParentId="8209" CreationDate="2014-06-04T00:04:46.127" Score="8" Body="&lt;p&gt;Here's an example configuration for what you're looking to accomplish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First create an object for you server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network SRV1&#xA;host 10.203.5.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, create the PAT rule that uses your outside interface IP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network SRV1&#xA;nat (inside,outside) static interface service tcp 3389 10001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The packet processing order of operations on 8.2 code and below is ACL --&gt; NAT.  Post 8.3 code is NAT --&gt; ACL, so your ACL will have a permit to the inside network IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, create your ACL rule:(assuming your access list name is outside_access_in)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_access_in extended permit tcp any object SRV1 eq 3389&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Rinse and repeat.&lt;/p&gt;&#xA;" OwnerUserId="2231" LastEditorUserId="2231" LastEditDate="2014-06-04T16:56:09.993" LastActivityDate="2014-06-04T16:56:09.993" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8223" PostTypeId="2" ParentId="7079" CreationDate="2014-06-04T13:37:39.020" Score="0" Body="&lt;p&gt;It seems like there is a tagging issue on the switch on the port connecting to the default gateway. Have you specified the allowed vlans in the port? Try adding the command &lt;code&gt;switchport trunk allowed vlan 1,10,20&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="5571" LastActivityDate="2014-06-04T13:37:39.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8224" PostTypeId="1" CreationDate="2014-06-04T13:48:04.060" Score="3" ViewCount="2550" Body="&lt;p&gt;Is there any way to change the console speed globally in GNS3. If you have seen GNS3VAULT videos the terminal speed is so fast but I could not find anywhere how to change the speed on GNS3 to get a faster speed. It get really frustrating when you type fast and the console output is not fast enough. I know that in actual Cisco devices you can change the baud rate when you are connecting via console port or change the line speed but this did not work on GNS3. Any help is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="539" LastActivityDate="2018-03-30T13:31:10.770" Title="GNS3 console speed" Tags="|cisco|gns3|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8225" PostTypeId="1" CreationDate="2014-06-04T15:19:10.457" Score="2" ViewCount="529" Body="&lt;p&gt;Background: I am interning at a company with an existing network setup. They are currently using a SonicWall tz100 for their hardware firewall. They are also using the Windows firewall. They want remote access to files on servers. My solution was to setup OpenVPN. I got this to work while inside the network (LAN to LAN). I used the packet monitoring and saw that the packets were being &quot;FORWARDED&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that once I leave the network (in reality I just moved outside the firewall and connected straight to the modem), the packets are no longer &quot;FORWARDING&quot;, instead they are &quot;Received&quot;. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I created the service for UDP on port 1194.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Svo8U.png&quot; alt=&quot;Service Object&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I created address objects for the server's public IP&#xA;&lt;img src=&quot;https://i.stack.imgur.com/k9jJz.png&quot; alt=&quot;Address Object for public IP&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I created address objects for the local IP&#xA;&lt;img src=&quot;https://i.stack.imgur.com/nSHVA.png&quot; alt=&quot;Address Object for local IP&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I created the opening in the firewall for: &#xA;&lt;img src=&quot;https://i.stack.imgur.com/GwSkx.png&quot; alt=&quot;Firewall Access Rule&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I created the NAT:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/MdHg4.png&quot; alt=&quot;Network NAT Policy&quot;&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I can post screenshots of the setup if you need.&#xA;Any help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="5958" LastEditorUserId="253" LastEditDate="2014-06-24T12:28:40.040" LastActivityDate="2014-06-24T12:28:40.040" Title="SonicWall tz100 WAN to LAN &quot;Received&quot;" Tags="|vpn|firewall|sonicwall|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="8226" PostTypeId="2" ParentId="8210" CreationDate="2014-06-04T15:36:11.133" Score="3" Body="&lt;p&gt;Found that the newer switches actually auto negotiate based on the GBIC rather than having to manually convert the 10gig interface to gig as the older switches did.&lt;/p&gt;&#xA;" OwnerUserId="5188" LastActivityDate="2014-06-04T15:36:11.133" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8229" PostTypeId="1" AcceptedAnswerId="8231" CreationDate="2014-06-04T19:23:33.223" Score="6" ViewCount="3197" Body="&lt;p&gt;I'm trying to connect a Cisco Catalyst 3750 12-port SFP switch to a RuggedCom RSG2100 with fiber ports.  The Cisco has a third-party SFP (GLC-LH-SM) that shows in &quot;show interface&quot; as 1000Base-LX, and the CLI gives me no options to set the speed and duplex of this port.  The RuggedCom switch shows the port to be 100Base-FX.  The Cisco is down/down when connected, and the RuggedCom blinks repeatedly until fast link detection fails, the whole time reporting that the port is down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will I need some 100Base-FX Cisco SFP for these to talk?  I've tried trunking both ports to no avail.  Thanks.&lt;/p&gt;&#xA;" OwnerUserId="5960" LastActivityDate="2014-06-04T20:03:18.473" Title="1000 Base-LX compatible with 100 Base-FX" Tags="|cisco|fiber|sfp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8231" PostTypeId="2" ParentId="8229" CreationDate="2014-06-04T19:55:20.157" Score="4" Body="&lt;p&gt;&lt;i&gt;1000&lt;/i&gt;base-LX and &lt;a href=&quot;http://en.wikipedia.org/wiki/Fast_Ethernet#100BASE-FX&quot; rel=&quot;nofollow&quot;&gt;&lt;i&gt;100&lt;/i&gt;base-FX&lt;/a&gt; are very different beasts. The GLC-LH-SM will not operate at 100Mbps. Surprisingly, Cisco does make a &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/fast-ethernet-sfp-modules/product_data_sheet0900aecd801f931c.html&quot; rel=&quot;nofollow&quot;&gt;GLC-FE-100FX and GLC-GE-100FX&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Consult the &lt;a href=&quot;http://www.cisco.com/en/US/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL632702.pdf&quot; rel=&quot;nofollow&quot;&gt;interop guide&lt;/a&gt; for which one you need.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-06-04T20:03:18.473" LastActivityDate="2014-06-04T20:03:18.473" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8233" PostTypeId="1" CreationDate="2014-06-05T02:07:31.010" Score="1" ViewCount="1117" Body="&lt;p&gt;Network Diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/kcM6j.png&quot; alt=&quot;network diagram&quot;&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got 3 vlans&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1st Management&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Required hosts: 15&#xA;&#xA;Network ID: 192.168.100.0/27&#xA;Range : 192.168.100.0/27 - 192.168.100.31/27&#xA;Highest IP default-gateway: 192.168.100.30/27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2nd USER&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Required hosts: 70&#xA;&#xA;Network ID: 192.168.100.32/25&#xA;Range : 192.168.100.32/25 - 192.168.100.159/25&#xA;Highest IP default-gateway: 192.168.100.158/25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3rd Guest&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Required hosts: 10&#xA;&#xA;Network ID: 192.168.100.160/28&#xA;Range : 192.168.100.160/28 - 192.168.100.176/28&#xA;Highest IP default-gateway: 192.168.100.174/28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in Level 1 switch I put &lt;code&gt;IP default-gateway: 192.168.100.30&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in Level 2 switch I put &lt;code&gt;IP default-gateway: 192.168.100.30&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f0/1.99 IP : 192.168.100.30/27&#xA;&#xA;f0/1.10 IP : 192.168.100.158/25&#xA;&#xA;f0/1.20 IP : 192.168.100.174/28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It doesnt work. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;error: 192.168.100.160 overlaps with FastEthernet0/1.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So what I am doing wrong ?&lt;/p&gt;&#xA;" OwnerUserId="5962" LastEditorUserId="3191" LastEditDate="2014-06-05T07:43:33.960" LastActivityDate="2014-06-05T07:43:33.960" Title="assigning Highest IP on each subnet is the default gateway to cooresponding VLAN" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8234" PostTypeId="2" ParentId="8233" CreationDate="2014-06-05T02:52:00.323" Score="6" Body="&lt;p&gt;You have overlapping subnets. You can't assign the subnet ID at random, it's a function of the mask. Valid subnet ID's for 192.168.100.X/25 are either 192.168.100.0 or 192.168.100.128&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IP Address 192.168.100.158/25 is part of the 192.168.100.128/25 subnet with valid IP addresses from 192.168.100.129-254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To avoid overlap, use these subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.100.0/25&#xA;192.168.100.128/27&#xA;192.168.100.160/28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5963" LastActivityDate="2014-06-05T02:52:00.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8237" PostTypeId="2" ParentId="8200" CreationDate="2014-06-05T08:22:57.057" Score="2" Body="&lt;p&gt;Have you checked the debug outputs for l2x, ppp, radius?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing I see is that you should set &lt;code&gt;ip unnumbered&lt;/code&gt; on your Virtual-Template. &lt;code&gt;ip address negotiated&lt;/code&gt; means your end will try to get an address from the client, when you should be offering one to them (via the Framed-IP-Address and Framed-IP-Netmask attributes in the RADIUS Access-Accept)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First create a loopback interface (or if you want you can use g0/0 but loopback is best practice) and give it a /32 address, then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Virtual-Template1&#xA; ip unnumbered Loopback0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5969" LastActivityDate="2014-06-05T08:22:57.057" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8238" PostTypeId="2" ParentId="7985" CreationDate="2014-06-05T08:41:34.437" Score="2" Body="&lt;p&gt;I also had a similar requirement some time back please see this post which details limiting from the tunnel-group which will catch anything going via that specific VPN, &lt;a href=&quot;http://www.techietek.com/2012/05/20/cisco-asa-rate-limit-vpn-tunnel/&quot; rel=&quot;nofollow&quot;&gt;cisco-asa-rate-limit-vpn-tunnel&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps, any questions let me know. Please see more details:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tunnel group should already be in place as per the usual config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;tunnel-group 85.205.255.6 type ipsec-l2l&#xA;tunnel-group 85.205.255.6 ipsec-attributes&#xA; pre-shared-key *&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;1) Create a class map to define the traffic which should be matched, in our case we will be matching any traffic which pass the tunnel-group:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;class-map VF-VPN-Class&#xA; match tunnel-group 85.205.255.6&#xA; match flow ip destination-address&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) Create a policy map, associate the class map against it, and define an action for matched traffic, below the data is in bps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;policy-map outside-policy&#xA; class VF-VPN-Class&#xA;  police output 75000000 37500&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) Activate the policy map by assigning it to the external interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;service-policy outside-policy interface outside &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4) Verify that the policy has taken effect by pinging across the tunnel from a server behind the firewall:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;(asa)# sh service-policy&#xA;Interface outside:&#xA;  Service-policy: outside-policy&#xA;    Class-map: VF-VPN-Class&#xA;      Output police Interface outside:&#xA;        cir 75000000 bps, bc 37500 bytes&#xA;        conformed 4 packets, 440 bytes; actions:  transmit&#xA;        exceeded 0 packets, 0 bytes; actions:  drop&#xA;        conformed 200 bps, exceed 0 bps&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="5955" LastEditorUserId="5955" LastEditDate="2014-06-06T09:21:26.203" LastActivityDate="2014-06-06T09:21:26.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8241" PostTypeId="1" AcceptedAnswerId="8274" CreationDate="2014-06-05T14:34:33.617" Score="4" ViewCount="12432" Body="&lt;p&gt;I am having a problem with my core network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I have a DELL PowerConnect 5524 which has a SFP+ (10Gbe) Module connected to another 5524 (Same transceiver on both) which is also stacked with a Powerconnect 5548 (via HDMI)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like this:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/xr6zu.png&quot; alt=&quot;Network Layout&quot;&gt;&#xA;However, I was recently doing some investigation into why our transatlantic IPSEC VPN so performing so badly and started doing some Wireshark packet captures and tcpdumps from the Watchguard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed huge amounts of TCP Re-transmissions and Duplicate ACKs (which after the 4th ACK triggers a re-transmit (SACKs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I connected my laptop directly to the 5524 on the left and SSH'd into the device, whilst running a packet capture. Still getting lots of the above errors. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me? or tell me why the think that even after connecting directly to the switch and talking to the switch itself would give me these results?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've turned off practically all Layer 3 features on the port my laptop is using and still the errors remain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;UPDATE&lt;/em&gt; Example PacketCap Uploaded Here: &lt;a href=&quot;https://www.cloudshark.org/captures/882b8189541d&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cloudshark.org/captures/882b8189541d&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5973" LastEditorUserId="5973" LastEditDate="2014-06-05T19:40:29.633" LastActivityDate="2014-06-07T00:09:42.147" Title="TCP Retransmission and duplicate ACKs" Tags="|switch|packet-analysis|dell|powerconnect|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8244" PostTypeId="2" ParentId="8211" CreationDate="2014-06-05T19:50:18.350" Score="2" Body="&lt;p&gt;Insert a hub between the PC you want to capture the packets of and also connect yourself to that hub. A hub causes packets to be broadcast to all ports.&#xA;But beware the wrath of your NetAdmin. &#xA;In other words you really shouldn't be doing this without their consent/help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or get a PC with two network cards and bridge them together. Plug one end to the PC and the other to the server, Make sure you set Wireshark to promiscuous mode.&lt;/p&gt;&#xA;" OwnerUserId="5973" LastEditorUserId="5973" LastEditDate="2014-06-05T20:44:16.893" LastActivityDate="2014-06-05T20:44:16.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8246" PostTypeId="1" AcceptedAnswerId="8257" CreationDate="2014-06-05T20:42:08.680" Score="2" ViewCount="679" Body="&lt;p&gt;We currently have the following.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3Com 2900 series switches.&#xA;Network range 192.168.10.0&#xA;Netgear WAG102 Access points&#xA;Default VLAN of vlan1 on the switches (essentially not configured - default setup)&#xA;Also some un-managed switches at the edges of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are now in a position where we need to do the following.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Enable a public access network for wifi throughout the building to exit&lt;/li&gt;&#xA;&lt;li&gt;In the future, move our IP based phones to their own network&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All ports in the switch(s) were by default untagged vlan 1 - this is how everything currently operates (essentially no VLAN)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've attempted to do:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To keep everything that is currently running on the network (nearly 200 devices) running without changing their configs I have made VLAN 20 on the switch for the wifi network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the WAG102 set the management VLAN to be VLAN 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;reboot the AP to make this take effect - can no longer reach the AP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have attempted to TAG the port the AP is plugged into as VLAN1 TAGGED , but get the error that VLAN 1 cannot be changed.&#xA;I have tagged the port as VLAN20 and left it as untagged VLAN 1 but still no joy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose my question is - how can I leave all my current devices on VLAN 1 (default) and use it as the management VLAN whilst introducing VLAN 20 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry if my question isn't articulated particularly well. I'm only attempting to make the VLAN on one switch to begin with (the AP and router are all plugged into this)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="5980" LastActivityDate="2014-06-06T13:03:53.210" Title="VLAN configuration" Tags="|vlan|switch|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8248" PostTypeId="2" ParentId="748" CreationDate="2014-06-05T21:24:37.617" Score="2" Body="&lt;p&gt;Yes you can make ring topology for IRF &#xA;For instance:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sw1: &#xA;irf-port 1/1 &#xA;          Port group (interface 1) mode normal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Irf-port 1/2&#xA;          Port group ( interface 2) mode normal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sw2: &#xA;irf-port 2/1 &#xA;          Port group (interface 1) mode normal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Irf-port 2/2&#xA;          Port group ( interface 2) mode normal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sw3: &#xA;irf-port 3/1 &#xA;          Port group (interface 1) mode normal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Irf-port 3/2&#xA;          Port group ( interface 2) mode normal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then connect every irf-port x/1 to x/2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And from irf-port 3/1 to irf-port 1/2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ring topology is great because it provides full redundancy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="5981" LastActivityDate="2014-06-05T21:24:37.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8252" PostTypeId="1" CreationDate="2014-06-06T09:57:30.293" Score="2" ViewCount="2984" Body="&lt;p&gt;I have service I need to make VPN connections to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this working perfectly fine in windows, setup was quick, easy and straightforward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am now trying to achieve the same connection in Linux using OpenSWAN but my connection is failing with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;117 &quot;MyConnection&quot; #115: STATE_QUICK_I1: initiate&#xA;010 &quot;MyConnection&quot; #115: STATE_QUICK_I1: retransmission; will wait 20s for response&#xA;010 &quot;MyConnection&quot; #115: STATE_QUICK_I1: retransmission; will wait 40s for response&#xA;031 &quot;MyConnection&quot; #115: max number of retransmissions (2) reached STATE_QUICK_I1.  No &#xA;  acceptable response to our first Quick Mode message: perhaps peer likes no proposal&#xA;000 &quot;MyConnection&quot; #115: starting keying attempt 2 of an unlimited number, but releasing &#xA;  whack&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not exactly sure what this means, though have Googled a lot though I'm guessing I have some configuration parameters wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In windows I have the following configuration defined (everything else is default)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Username and password &lt;/p&gt;&#xA;&#xA;&lt;p&gt;L2TP/IPSec selected&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PSK defined in advanced options of the L2TP/IPSec connection&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Require Encryption turned on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unencrypted password (PAP) checked&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And it all just works - unfortunately I'm not sure how to translate these settings fully to relevant ipsec.conf parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VPN I'm connecting to is a Cisco meraki MX appliance if that helps...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess if anyone has a sample config for an openSWAN connection to Cisco meraki MX appliance that would be a helpful starting point, but more specifically if someone can translate the windows VPN settings to ipsec.conf options that would be the most useful thing&lt;/p&gt;&#xA;" OwnerUserId="5987" LastEditorUserId="3191" LastEditDate="2014-11-22T16:10:24.553" LastActivityDate="2017-07-18T18:45:17.600" Title="OpenSWAN IPSec Connection to Cisco Meraki MX appliance" Tags="|cisco|vpn|ipsec|linux|" AnswerCount="1" CommentCount="3" ClosedDate="2017-07-18T18:55:21.650" ContentLicense="CC BY-SA 3.0" />
  <row Id="8256" PostTypeId="1" AcceptedAnswerId="8262" CreationDate="2014-06-06T12:43:59.853" Score="3" ViewCount="2507" Body="&lt;p&gt;In my network I use L3-3650x as core switch to route internal network. I have 2 internet gateways, one for local internet [192.168.2.1] and the other for Japan connection [172.17.138.1]. Both routers provide internet connection but I want to separate internet usage in network by source address like if come from network 172.17.138.0/24 or 172.17.160.0/24 connect internet via router 172.17.138.1 and if come from 192.168.2.0/24 network connect via 192.168.2.1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Click image for larger version&lt;/em&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EpYKk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EpYKk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to setting like this ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea will be much appreciate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is show version command result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Apologize for my bad English]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SEPT_L3#show version&#xA;Cisco IOS Software, C3560E Software (C3560E-UNIVERSALK9-M), Version 12.2(55)SE3,                                                                                  RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2011 by Cisco Systems, Inc.&#xA;Compiled Thu 05-May-11 15:57 by prod_rel_team&#xA;Image text-base: 0x00003000, data-base: 0x02800000&#xA;&#xA;ROM: Bootstrap program is C3560E boot loader&#xA;BOOTLDR: C3560E Boot Loader (C3560X-HBOOT-M) Version 12.2(53r)SE2, RELEASE     SOFTW                                                                             ARE (fc1)&#xA;&#xA;SEPT_L3 uptime is 4 weeks, 2 days, 1 hour, 51 minutes&#xA;System returned to ROM by power-on&#xA;System image file is &quot;flash:/c3560e-universalk9-mz.122-55.SE3/c3560e-universalk9         -mz.122-55.SE3.bin&quot;&#xA;&#xA;&#xA;This product contains cryptographic features and is subject to United&#xA;States and local country laws governing import, export, transfer and&#xA;use. Delivery of Cisco cryptographic products does not imply&#xA;third-party authority to import, export, distribute or use encryption.&#xA;Importers, exporters, distributors and users are responsible for&#xA;compliance with U.S. and local country laws. By using this product you&#xA;agree to comply with applicable laws and regulations. If you are unable&#xA;to comply with U.S. and local laws, return this product immediately.&#xA;&#xA;A summary of U.S. laws governing Cisco cryptographic products may be found at:&#xA;http://www.cisco.com/wwl/export/crypto/tool/stqrg.html&#xA;&#xA;If you require further assistance please contact us by sending email to&#xA;export@cisco.com.&#xA;&#xA;License Level: ipbase&#xA;License Type: Permanent&#xA;Next reload license Level: ipbase&#xA;&#xA;cisco WS-C3560X-24 (PowerPC405) processor (revision A0) with 262144K bytes of memory.&#xA;Processor board ID FDO1629P186&#xA;Last reset from power-on&#xA;4 Virtual Ethernet interfaces&#xA;1 FastEthernet interface&#xA;28 Gigabit Ethernet interfaces&#xA;2 Ten Gigabit Ethernet interfaces&#xA;The password-recovery mechanism is enabled.&#xA;&#xA;512K bytes of flash-simulated non-volatile configuration memory.&#xA;Base ethernet MAC Address       : 60:73:5C:00:78:00&#xA;Motherboard assembly number     : 73-12554-06&#xA;Motherboard serial number       : FDO162911ZG&#xA;Model revision number           : A0&#xA;Motherboard revision number     : A0&#xA;Model number                    : WS-C3560X-24T-S&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5989" LastEditorUserId="775" LastEditDate="2014-12-08T12:58:51.633" LastActivityDate="2014-12-08T12:58:51.633" Title="L3 Switch Static Route for 2 gateway" Tags="|cisco|routing|ipv4|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8257" PostTypeId="2" ParentId="8246" CreationDate="2014-06-06T13:03:53.210" Score="2" Body="&lt;p&gt;Assuming you will use VL20 as your guest network, do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Every switch that has guest devices on it should have VL 20 on it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure the security profile on the WAG102 to use VL 20 for the guest SSID (check &quot;enable 802.1 VLAN&quot;).  For the management profile, uncheck the  Enable 802.1q VLAN box.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make the AP ports on the switches VLAN 20 tagged and VL 1 untagged.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make the port for the  BT router VL 20 &lt;em&gt;untagged&lt;/em&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you have switch to switch connections, those ports should be  set to VLAN 1 untagged and VL 20 tagged.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Everything else (your internal devices, management interface, etc) should be on VL 1 untagged ports.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-06-06T13:03:53.210" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="8258" PostTypeId="1" CreationDate="2014-06-06T13:19:17.487" Score="3" ViewCount="726" Body="&lt;p&gt;I have a Cisco Catalyst 3750 and 2960. I created VTP server in 3750 and deleted all useless vlans. When I connect 2960 (VTP status: Client) to 3750 VTP transferred all vlans which I deleted before. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's wrong? Who can help?&lt;/p&gt;&#xA;" OwnerUserId="5991" LastEditorUserId="3191" LastEditDate="2014-06-06T18:40:30.140" LastActivityDate="2014-06-06T18:40:30.140" Title="VTP transfer deleted VLANs" Tags="|vtp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8262" PostTypeId="2" ParentId="8256" CreationDate="2014-06-06T15:12:07.507" Score="8" Body="&lt;p&gt;What you like to perform is &lt;strong&gt;Policy Based Routing&lt;/strong&gt;. By default, the L3 device define the next-hop based on destination IP. On cisco router, PBR allow you to route packet based on policy through Route-map. So you can create a Route-map and match traffic with an ACL and set a next-hop, after you have to apply in which interface the policy should be active.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately on Packet Tracer, this features is not available so you can't implement that on you scenario.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have the opportunity to implement your scenario in a real equipment lab, here are the commands to configure PBR following your topology.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map ISP-Outside permit 10&#xA;match ip address INTERNET-ACCESS_192&#xA;set ip next-hop 192.168.2.1 &#xA;route-map ISP-Outside permit 20&#xA;match ip address INTERNET-ACCESS_172&#xA;set ip next-hop 172.17.138.1&#xA;&#xA;interface GigabitEthernet0/1 ! in all interface you want to implement this policy &#xA;ip policy route-map ISP-Outside&#xA;&#xA;ip access-list extended INTERNET-ACCESS_192&#xA;permit ip 192.168.2.0 0.0.0.255 any&#xA;deny ip any any&#xA;&#xA;ip access-list extended INTERNET-ACCESS_172&#xA;permit ip 172.17.0.0 0.0.255.255 any&#xA;deny ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also see &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html&quot; rel=&quot;nofollow&quot;&gt;Policy-Based Routing&lt;/a&gt; on Cisco's documentation site.&lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="775" LastEditDate="2014-06-07T20:47:55.630" LastActivityDate="2014-06-07T20:47:55.630" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="8263" PostTypeId="1" AcceptedAnswerId="12589" CreationDate="2014-06-06T15:35:39.300" Score="6" ViewCount="4248" Body="&lt;p&gt;I am not a network guru by any means but need to setup our router/switch to use SNMPv3.  I am installing What's Up Gold on our system and configured the settings (changed for this post) as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Username: testusername&#xA;Authentication&#xA;Protocol: sha&#xA;Password: testpassword&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On my router, I have ran the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server view TESTVIEW mib-2 included &#xA;&#xA;snmp-server group TESTGROUP v3 auth read TESTVIEW &#xA;&#xA;snmp-server user ALL TESTGROUP v3 auth sha testpassword &#xA;&#xA;snmp-server host 192.168.12.2 version 3 auth testusername &#xA;&#xA;snmp-server host 192.168.12.2 informs version 3 auth testusername&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After inserting these commands, I go back to the SNMP software and attempt to discover the seed address 192.168.12.254, the gateway, but cannot receive a valid connection.  I turned debugging on the router but receive nothing in &lt;code&gt;show log&lt;/code&gt;.  I setup SNMPv2 to test and see if it could even see that and it worked just fine...I am guessing I am missing something in my router configuration...any ideas?&lt;/p&gt;&#xA;" OwnerUserId="5994" LastActivityDate="2015-01-19T21:33:49.953" Title="SNMPv3 Setup - Cisco 3750" Tags="|cisco|snmp|cisco-commands|cisco-3750|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8264" PostTypeId="1" AcceptedAnswerId="8268" CreationDate="2014-06-06T16:23:24.280" Score="7" ViewCount="6610" Body="&lt;p&gt;I'm having an issue with an ACL on a VLAN interface. I've followed HP's documentation here: &#xA;&lt;a href=&quot;http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02609963-3.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02609963-3.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to do the following: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 101 should only be able to communicate to VLAN 50 - no other VLANs, no internet access. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Initially, I tried the following access list: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended &quot;SecureContent&quot;&#xA;    10 permit ip 192.168.50.0 0.0.0.255 192.168.101.0 0.0.0.255&#xA;    20 remark &quot;SecurityVLAN&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I applied this ACL to VLAN 101 &quot;in&quot; with the following command: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  vlan 101&#xA;    ip access-group &quot;SecureContent&quot; in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This configuration results in zero communication on that VLAN: The IP of 192.168.101.2 on port A1 cannot ping 192.168.101.1, the switch VLAN IP. If I change the access list to: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10 permit ip 192.168.101.1 0.0.0.255 192.168.101.1 0.0.0.255 &#xA;20 permit ip 192.168.50.1 0.0.0.255 192.168.101.1 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...this results in clients on the VLAN being able to ping their default gateway, but not the 50.1 gateway. That doesn't make any sense to me - the VLAN 101 IP interface should be considered logically &quot;inside&quot; that VLAN 101, correct? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried various versions of this access list, even going so far as to do just a standard access list blocking a single IP yet permitting everything else with a &quot;permit ip any any&quot; statement - and this still results in zero inter or intra-vlan traffic - the host on that VLAN can't even ping its own gateway if I apply the list in the inbound direction (I also tried a variant in the outbound direction - exactly the same result!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the switch configuration: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Running configuration:&#xA;&#xA;; J8697A Configuration Editor; Created on release #K.15.09.0012&#xA;; Ver #03:01.1f.ef:f2&#xA;hostname &quot;HP-5406zl&quot;&#xA;module 1 type j8702a&#xA;module 2 type j8708a&#xA;module 3 type j9546a&#xA;module 4 type j8708a&#xA;power-over-ethernet pre-std-detect&#xA;ip access-list extended &quot;SecureContent&quot;&#xA;     10 permit ip 192.168.101.1 0.0.0.255 192.168.101.1 0.0.0.255&#xA;     20 permit ip 192.168.50.1 0.0.0.255 192.168.101.1 0.0.0.255&#xA;   exit&#xA;ip route 0.0.0.0 0.0.0.0 172.16.0.1&#xA;ip routing&#xA;snmp-server community &quot;public&quot; unrestricted&#xA;snmp-server contact &quot;Person&quot; location &quot;Place&quot;&#xA;vlan 1&#xA;   name &quot;DEFAULT_VLAN&quot;&#xA;   no untagged A1-A20,A23-A24,B1-B4,C1-C8,D1-D4&#xA;   untagged A21-A22&#xA;   ip address 192.168.1.10 255.255.255.0&#xA;   jumbo&#xA;   exit&#xA;vlan 50&#xA;   name &quot;Editors&quot;&#xA;   untagged A2-A19,B1-B3,C1-C8,D1-D4&#xA;   tagged A23-A24&#xA;   ip address 192.168.50.1 255.255.255.0&#xA;   jumbo&#xA;   exit&#xA;vlan 100&#xA;   name &quot;IO&quot;&#xA;   tagged A23-A24&#xA;   ip address 192.168.100.1 255.255.255.0&#xA;   exit&#xA;vlan 101&#xA;   name &quot;SecureContent&quot;&#xA;   untagged A1&#xA;   ip address 192.168.101.1 255.255.255.0&#xA;   ip access-group “SecureContent” in&#xA;   exit&#xA;vlan 200&#xA;   name &quot;Corp&quot;&#xA;   tagged A23-A24&#xA;   ip address 192.168.200.1 255.255.255.0&#xA;   ip helper-address 192.168.50.2&#xA;   exit&#xA;vlan 800&#xA;   name &quot;IT&quot;&#xA;   untagged A23-A24&#xA;   ip address 172.17.0.1 255.255.255.0&#xA;   exit&#xA;vlan 899&#xA;   name &quot;DMZ&quot;&#xA;   untagged B4&#xA;   tagged A23-A24&#xA;   ip address 172.18.0.1 255.255.255.0&#xA;   jumbo&#xA;   exit&#xA;vlan 900&#xA;   name &quot;Routed&quot;&#xA;   untagged A20&#xA;   tagged A23-A24&#xA;   ip address 172.16.0.2 255.255.255.252&#xA;   exit&#xA;vlan 999&#xA;   name &quot;VLAN999&quot;&#xA;   no ip address&#xA;   exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDITED to add relevant chassis information: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Software revision  : K.15.09.0012         Base MAC Addr      : 002561-f80000&#xA;  ROM Version        : K.15.30              Serial Number      : XXXXXXXX&#xA;  Allow V1 Modules   : Yes     &#xA;&#xA;         Opacity Shields    : Not Installed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for your help!&lt;/p&gt;&#xA;" OwnerUserId="2912" LastEditorUserId="2912" LastEditDate="2014-06-06T16:55:30.077" LastActivityDate="2016-09-14T10:06:58.207" Title="HP Procurve 5406zl - ACL issue" Tags="|acl|hp-procurve|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8265" PostTypeId="2" ParentId="8258" CreationDate="2014-06-06T16:49:34.340" Score="1" Body="&lt;p&gt;The normal range of vlans is stored in the vlan.dat file in flash, deleting the vlans, the switch’s running config and even reloading doesn't get rid of those vlans. To permanently delete them try and erase the vlan.dat file from flash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the command &lt;code&gt;delete flash:vlan.dat&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/vtp/98155-tshoot-vlan.html&quot; rel=&quot;nofollow&quot;&gt;Source/further reading&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4603" LastActivityDate="2014-06-06T16:49:34.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8266" PostTypeId="2" ParentId="8264" CreationDate="2014-06-06T17:36:48.613" Score="2" Body="&lt;p&gt;It looks like this problem is due to the way that HP's networking gear handles ACLs versus Cisco (which is my networking background).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to this document, HP ACLs are stateless, and must contain bidirectional traffic entries (for originating traffic and return traffic): &lt;a href=&quot;http://tinyurl.com/qbfemk6&quot; rel=&quot;nofollow&quot;&gt;http://tinyurl.com/qbfemk6&lt;/a&gt; (Link to PDF on HP's site). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is in contrast to the Advanced Traffic Management guide above, which displays configuration examples that do not implement or account for this &quot;quirk&quot;: the examples contain no such return traffic entries. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lessons Learned: Do not trust manufacturer documentation to be consistent and accurate.&lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2014-06-06T17:36:48.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8267" PostTypeId="1" CreationDate="2014-06-06T17:47:40.387" Score="4" ViewCount="4148" Body="&lt;p&gt;We are currently having issues with our WebService being intermittently inaccessible to clients.   During diagnosis with the NOC and with some internal testing we believe we have a router dropping packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our system has 4 Windows Server 2003 machines connected via a switch on one port (internal communication) and a router (Cisco RV082) on the second port (web traffic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From our WebServer, if we WinMTR to the Router, managed switch or over the internal network (5.x) we get a 0% packet loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when we run the same WinMTR tool to our gateway, we receive a 0% packet loss on the gateway, but as of last test a 9% packet loss on the router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|------------------------------------------------------------------------------------------&#xA;&#xA;|                                      WinMTR statistics   &#xA;&#xA;|                       Host              -   %  | Sent | Recv | Best | Avrg | Wrst | Last |&#xA;|------------------------------------------------|------|------|------|------|------|------&#xA;&#xA;|&#xA;|                             192.168.1.1 -    9 | 1986 | 1818 |    0 |    0 |    1 |    0&#xA;&#xA;|      static-xxx-xx-x-xxx.xxx.xxxxxx.xxx -    0 | 3667 | 3667 |    0 |    0 |   76 |    0 &#xA;&#xA;|________________________________________________|______|______|______|______|______|______&#xA;&#xA;   WinMTR v0.92 GPL V2 by Appnor MSP &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not entirely sure how to process this information.  Does this imply that there is a break between the router and the gateway as the router seems fine on it's own?  Or is it a problem with the router not responding properly when we go to the WAN port.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The existing problem server goes from &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Server -&amp;gt; Router -&amp;gt; dumb switch -&amp;gt; gateway&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We have another server in the same cabinet that goes &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Server -&amp;gt; different router -&amp;gt; dumb switch -&amp;gt; gateway&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="5996" LastEditorUserId="3191" LastEditDate="2014-06-07T19:49:40.440" LastActivityDate="2023-12-04T16:00:31.003" Title="MTR packet Loss at intermediate hop" Tags="|cisco|ipv4|troubleshooting|packet-loss|mtr|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8268" PostTypeId="2" ParentId="8264" CreationDate="2014-06-06T18:19:58.147" Score="7" Body="&lt;p&gt;According to the Access Security Guide for your device, the first address and mask of an ACE  is source and the second address and mask is the destination. (Just in case, an ACE is an Access Control Entry; that is any line an access-list is made of) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ACE 20 of your ACL states source 192.168.50.0/24 and destination 192.168.101.0/24, then you apply the ACL at VLAN 101 input; however, your VLAN 101 is 192.168.101.0/24, so any input traffic at VLAN 101 would have source address in 192.168.101.0/24. So ACE 20 in your ACL is wrong,  you need an ACE with action permit, source 192.168.101.0/24 and destination 192.168.50.0/24. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended &quot;SecureContent&quot;&#xA;    10 permit ip 192.168.101.0 0.0.0.255 192.168.50.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Regarding the way back for this traffic, it will cross VLAN 101 outbound, so ACL should not be applied to this traffic and it should be allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If traffic back is not allowed then you need to add the way back in your ACL.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended &quot;SecureContent&quot;&#xA;    10 permit ip 192.168.101.0 0.0.0.255 192.168.50.0 0.0.0.255&#xA;    20 permit ip 192.168.50.0 0.0.0.255 192.168.101.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDITED to change the line above to reflect proper ACL structure of numbered entries. (10, 20, etc).&lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="775" LastEditDate="2014-06-11T03:34:33.043" LastActivityDate="2014-06-11T03:34:33.043" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="8269" PostTypeId="2" ParentId="8258" CreationDate="2014-06-06T18:34:28.280" Score="8" Body="&lt;p&gt;Neither Native VLAN or VTP domain mismatch will cause this, as it normally impedes VTP propagation which you obviously do not have a problem with (your 3750 received and applied the VTP information from the 2960)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check for VTP database version.  If the 2960 had a higher version than the 3750, then it will be the one used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the most likely thing to have happened... fiddling with your 3750 VTP config you might have reset it to Version 0, and not having touched the 2960 it has retained whichever version it had, resulting in the 3750 accepting the &quot;more current&quot; version of VTP config sent by the 2960.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also be aware that &quot;VTP Client&quot; doesn't mean that it won't send VTP config, only that you cannot configure it directly.  It can still send out VTP config that will replace your network if it's a higher version.  VTP Transparent will not send out VTP config (will let pass through VTP info received though, just won't send its own info).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to clear all vlans, now that they're synched, just delete them on the 3750 and the change should be propagated between both.&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-06-06T18:34:28.280" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8271" PostTypeId="2" ParentId="6556" CreationDate="2014-06-06T19:10:54.073" Score="4" Body="&lt;p&gt;Quick test: Swap the SFPs with a known working ones on the switch (if possible) and see if the condition stays with the ports or follow the SFPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the other SFP works in the current &quot;problematic SFP ports&quot; there is less possibility of this being the switch's problem (I still could be, but just unlikely).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try to plug it in the other switch's too... if it's problematic there, it's almost guaranteed to be the SFP, unless you got the One-In-A-Million chance of having two switches with exactly the same freaking bug - extremely unlikely&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If after all that JTAC still insist for RMA on both switches, just escalate the issue to get someone more reasonable at their end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I've just seen that it was a mislabeling issue, you might want to mark this question as answered. :)&lt;/p&gt;&#xA;" OwnerUserId="1645" LastEditorUserId="1645" LastEditDate="2014-06-06T20:34:51.673" LastActivityDate="2014-06-06T20:34:51.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8272" PostTypeId="1" AcceptedAnswerId="8275" CreationDate="2014-06-06T20:13:55.023" Score="4" ViewCount="613" Body="&lt;p&gt;So I recently purchased some media converters to take our T1 lines, that currently run over copper stretch far past it's limits, over some new fiber we had installed. They didn't work. I am a novice with T1 connections so I'm not sure what the issue is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some research it looks like there are special media converters that I need to use for the T1 lines. Is this accurate? Is there no way for me to get these media converters to work? Maybe a switch with VLAN ports? Any ideas are welcome.&lt;/p&gt;&#xA;" OwnerUserId="5999" LastEditorUserId="775" LastEditDate="2014-12-08T12:58:20.357" LastActivityDate="2015-07-03T06:08:05.520" Title="Point-to-point T1 over fiber using media converters" Tags="|cisco|point-to-point|media-conversion|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8274" PostTypeId="2" ParentId="8241" CreationDate="2014-06-06T20:32:31.293" Score="2" Body="&lt;p&gt;You're (192.168.0.164 ) directly connected to the switch (10.168.0.106) you're SSH'in into and you get dup ACK and retransmit... There is something not right , seems that the Network Gremlins are hungry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does the switches error counters say?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that some devices puts traffic to/from the control plane at a lower priority than the data plane.  SSH directly to the switch might not reveal the problem you think it's revealing.  What about connecting to something else on the switch, do you see the same symptoms?&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-06-06T20:32:31.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8275" PostTypeId="2" ParentId="8272" CreationDate="2014-06-06T20:54:47.493" Score="8" Body="&lt;p&gt;Unless the media converter you've bought are specifically marketed as T1 Fiber Extender/Converter, it won't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;T1 isn't Ethernet even if it's using RJ-45.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regular media converter are for Copper Ethernet to Fiber Ethernet, not T1 signals&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick google search with &quot;t1 fiber copper converter&quot; will yield various manufacturers that are making the bona fide converter you need.&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-06-06T20:54:47.493" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="8276" PostTypeId="2" ParentId="8267" CreationDate="2014-06-06T21:13:51.027" Score="0" Body="&lt;p&gt;The only way to determine what is happening exactly is to get a packet capture of the traffic so you can see what the router is actually doing.  Most modern routers will de prioritise icmp traffic in favour of forwarding actual traffic if they are under load.  As others have pointed out this particular router is a fairly low level device so this could be the case.  I have seen this exact issue with a (fairly powerful) router reporting packet loss when testing with MTR when in fact no loss existed.&lt;/p&gt;&#xA;" OwnerUserId="248" LastActivityDate="2014-06-06T21:13:51.027" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8277" PostTypeId="2" ParentId="8241" CreationDate="2014-06-07T00:09:42.147" Score="0" Body="&lt;p&gt;I would probably post this as a comment, but this is my first post on stackexchange and it won't let me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ssh isn't the best application to test performance due to its interactive nature. Unless you're saying that you see delay for the characters being echoed back to you. Without knowing more about what you were doing with ssh, the things I noticed are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In general, the number of retransmissions doesn't bother me. However, the fact that this is your laptop plugged directly into the switch with no router or other devices to drop packets does present a potential problem.&lt;/li&gt;&#xA;&lt;li&gt;The retransmissions are strange. Every one marked as a retransmission that I looked at had the original TCP segment present in the capture i.e. the data wasn't dropped. In some cases your laptop ACKs the segment but the switch retransmits anyway. Maybe the ACK from your laptop got dropped. In other cases the switch sends a segment, say 50 bytes, then within 10 or so milliseconds sends it again but with more data in the payload e.g. 100 bytes. This is repacketization and is fine. But your laptop hadn't ACKed yet and it's extremely doubtful the switch has a retransmission timeout of ~10ms.&lt;/li&gt;&#xA;&lt;li&gt;At first, I thought your switch was extremely busy due to the large difference in IP IDs between the original segment and the retransmission. You can sometimes tell how busy a machine is by looking at the difference in IP IDs of consecutive packets it sends. Your laptop, for example, is using sequential IP IDs e.g. 1234, 1235, 1236. But the switch's IP IDs vary so wildly, I imagine it's using IP ID randomization. So it might not be crazy busy.&lt;/li&gt;&#xA;&lt;li&gt;A few ACKs from the switch have ethernet checksum errors according to wireshark. I'm not well versed in ethernet so I don't know when it has checksums in use and when it doesn't because clearly not every frame has one when I inspect it in Wireshark. The ones with the error are 0x00000000. So it's wrong in the sense that it's using a checksum but not calculating it. However, if it was really incorrect checksums, you wouldn't see that frame in the capture unless you're capturing on the wire between the two endpoints.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So none of that is likely a root cause, they're just things I noticed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going forward, I recommend:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Clarifying exactly what the performance issue is with ssh. Since it's an interactive application, delays are expected.&lt;/li&gt;&#xA;&lt;li&gt;Test with some other protocol/application and get captures.&lt;/li&gt;&#xA;&lt;li&gt;Inspect the switch for physical layer issues on that interface.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="5983" LastActivityDate="2014-06-07T00:09:42.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8281" PostTypeId="1" CreationDate="2014-06-07T13:26:40.670" Score="3" ViewCount="9389" Body="&lt;p&gt;I need to get configuration file from my hp 5500 switches. When I connect to it with ssh I need to enter a login and password and then &lt;code&gt;super&lt;/code&gt; command to execute &lt;code&gt;display current-configuration&lt;/code&gt;. I need to execute this command without the &lt;code&gt;super&lt;/code&gt; command. I found &lt;code&gt;command-privilege&lt;/code&gt; with it I can set privilege level of command &lt;code&gt;display current-configuration&lt;/code&gt; to &lt;code&gt;0&lt;/code&gt; and &lt;code&gt;super&lt;/code&gt; command becomes unnecessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other way to do &lt;code&gt;display current-configuration&lt;/code&gt; without &lt;code&gt;super&lt;/code&gt; when using ssh?&lt;/p&gt;&#xA;" OwnerUserId="6005" LastEditorUserId="3191" LastEditDate="2014-06-07T14:05:52.637" LastActivityDate="2014-08-23T23:34:17.887" Title="HP 5500 'display current-configuration' without 'super' permissions" Tags="|switching|hp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8282" PostTypeId="1" AcceptedAnswerId="9315" CreationDate="2014-06-07T13:45:41.177" Score="3" ViewCount="1392" Body="&lt;p&gt;I have a &lt;strong&gt;cisco ASA 5550&lt;/strong&gt; firewall. I lost my image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to boot from &lt;strong&gt;tftp&lt;/strong&gt; using &lt;strong&gt;rommon&lt;/strong&gt; to upload new image but it doesn't work, now i want to get back to &lt;strong&gt;boot from flash&lt;/strong&gt; but i'm stuck with the tftp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i change the confreg it restarts immediately, it doesn't wait for &lt;strong&gt;sync&lt;/strong&gt; command that saves the configuration to the &lt;em&gt;nv-ram&lt;/em&gt;, so all changes are lost ad it starts again in tftp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can cause this this problem, what should i try?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how i proceed :  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rommon #0&amp;gt; confreg&#xA;&#xA;Current Configuration Register: 0x00000010&#xA;Configuration Summary:&#xA;  boot TFTP image&#xA;&#xA;Do you wish to change this configuration? y/n [n]: y&#xA;enable boot to ROMMON prompt? y/n [n]:&#xA;enable TFTP netboot? y/n [n]:&#xA;enable Flash boot? y/n [n]: y&#xA;select specific Flash image index? y/n [n]: y/n [n]:&#xA;go to ROMMON prompt if netboot fails? y/n [n]:&#xA;enable passing NVRAM file specs in auto-boot mode? y/n [n]:&#xA;disable display of BREAK or ESC key prompt during auto-boot? y/n [n]:&#xA;&#xA;Current Configuration Register: 0x00000001&#xA;Configuration Summary:&#xA;  boot default image from Flash&#xA;&#xA;Update Config Regist&#xA;&#xA;Booting system, please wait...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2534" LastEditorUserId="2534" LastEditDate="2014-06-09T17:00:23.437" LastActivityDate="2014-06-09T17:05:33.820" Title="Cisco ASA 5550 stuck on boot from tftp" Tags="|cisco|cisco-asa|cisco-ios|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8283" PostTypeId="1" CreationDate="2014-06-07T14:39:57.230" Score="6" ViewCount="448" Body="&lt;p&gt;My company asked me to set up a network with 60 devices (all have MAC addresses and use IPs, but they are not all computers), there is a 3rd party company that will maintain the network.  They are also responsible for their internet access.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I received an email from the ISP with our network info: the LAN IP space we have is 60.140.130.192/29 (255.255.255.248) with a gateway of 60.140.139.193.  Using the ISP's information, I'm not sure if all 60 devices can be on the network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to have 60 hosts on a 255.255.255.248 network?&lt;/p&gt;&#xA;" OwnerUserId="6007" LastEditorUserId="775" LastEditDate="2014-12-08T12:57:38.230" LastActivityDate="2014-12-08T23:51:52.137" Title="60 devices on a /29 network" Tags="|ipv4|nat|subnet|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="8284" PostTypeId="2" ParentId="8283" CreationDate="2014-06-07T16:25:40.780" Score="1" Body="&lt;p&gt;255.255.255.248 = 11111111.11111111.11111111.11111000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking the off bits which are 3. 2^3 = 8(-2), with one network being for identification and one for broadcast you have &lt;strong&gt;6 hosts&lt;/strong&gt; per subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And your range is &lt;strong&gt;60.140.130.193 - 60.140.130.198&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to fit 60 devices you need a /26 which is 255.255.255.192&lt;/p&gt;&#xA;" OwnerUserId="4603" LastActivityDate="2014-06-07T16:25:40.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8285" PostTypeId="2" ParentId="8267" CreationDate="2014-06-07T19:37:40.507" Score="7" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;However, when we run the same WinMTR tool to our gateway, we receive a 0% packet loss on the gateway, but as of last test a 9% packet loss on the router... &lt;br&gt;&#xA;[snip]&lt;br&gt;&#xA;... I'm not entirely sure how to process this information...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You've misunderstood how &lt;a href=&quot;http://winmtr.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;WinMTR&lt;/a&gt; should be used; this is a common problem.  The first line you should look at in any mtr output is the last line; you got back all 3667 packets that you sent.&lt;/p&gt;&#xA;&lt;h3&gt;Summary&lt;/h3&gt;&#xA;&lt;p&gt;You are seeing some transit packet loss.&lt;/p&gt;&#xA;&lt;p&gt;However, there &lt;em&gt;is no packet loss to your gateway endpoint&lt;/em&gt;.&#xA; &lt;/p&gt;&#xA;&lt;h3&gt;Why would some transit traffic be dropped with no endpoint loss?&lt;/h3&gt;&#xA;&lt;p&gt;It's not uncommon for transit devices to randomly drop some fraction of traceroute traffic.  There are several reasons why it may happen... among them:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ICMP error messages have been rate-limited by the OS on the Cisco RV082&lt;/li&gt;&#xA;&lt;li&gt;The RV082 is busy doing other things and isn't bothering to respond to some of the mtr queries&lt;/li&gt;&#xA;&lt;li&gt;There is a bug&lt;/li&gt;&#xA;&lt;li&gt;Some combination of the above&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;Rhetorical question&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Q: What should you do if you have no packet loss to your server?&lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;A: Other priorities; there is nothing to see here, move on.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2023-12-04T16:00:31.003" LastActivityDate="2023-12-04T16:00:31.003" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="8286" PostTypeId="1" AcceptedAnswerId="9365" CreationDate="2014-06-08T01:44:44.620" Score="10" ViewCount="8172" Body="&lt;p&gt;I can set a router to authenticate via a ssh public-key with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip ssh pubkey-chain&#xA; username admin&#xA;  key-string&#xA;   &amp;lt;ssh-pub-key&amp;gt;&#xA;  exit&#xA; exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to do something similar with Cisco ACS, to enable a public key to be trusted for ssh across a whole set of devices that are already configured for TACACS+?&lt;/p&gt;&#xA;" OwnerUserId="3071" LastActivityDate="2014-06-19T06:36:31.697" Title="Authenticate ssh key via Cisco ACS (TACACS+)" Tags="|ssh|tacacs|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="8287" PostTypeId="2" ParentId="8283" CreationDate="2014-06-08T03:46:38.493" Score="9" Body="&lt;p&gt;Are you absolutely positive that all 60 devices need to have their own public WAN IP address?&#xA;The ISP is giving you the globally reachable IP addresses for internet connectivity.  You can have well over 100 devices use just 1 WAN IP from your ISP.  Using NAT (network address translation) the 60 (Inside - 192.168.1.x /24) devices can share the 1 WAN (outside) IP address.&lt;/p&gt;&#xA;" OwnerUserId="3150" LastActivityDate="2014-06-08T03:46:38.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="8288" PostTypeId="1" AcceptedAnswerId="8292" CreationDate="2014-06-08T04:30:45.857" Score="47" ViewCount="130591" Body="&lt;p&gt;I'm confused as to the difference between maximum segment size and a maximum transmission unit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please explain in relation to layers 2 and 3?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I had a packet of 800 bytes in the payload. Would it be correct to say that the MSS would be 800 bytes (If I set it to be that) and the MTU would be 840? TCP 20 and IP 20 bytes. Would it be any different if I was doing PPPoE?&lt;/p&gt;&#xA;" OwnerUserId="5622" LastEditorUserId="8499" LastEditDate="2018-10-26T19:15:48.163" LastActivityDate="2021-04-21T06:15:57.020" Title="What is the difference between MSS and MTU?" Tags="|tcp|layer3|layer4|mtu|pppoe|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="8290" PostTypeId="1" AcceptedAnswerId="9314" CreationDate="2014-06-08T11:37:05.897" Score="3" ViewCount="341" Body="&lt;p&gt;I'm currently in a process of NATed and mainly L2 based network migration to a proper routed design and got a little confused reading lots of documentation on the net for what I really need. Bellow I attached a figure to better understand what I seek - basically to know what to do in the cloud with question mark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A working BGP provider edge with failover;&lt;/li&gt;&#xA;&lt;li&gt;An aggregation switch that has a couple dozen remote switches connected to it;&lt;/li&gt;&#xA;&lt;li&gt;~900 clients that are ordinary people with SOHO routers.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I know that I want to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Assign public IPs to end clients from 1.0.0.0/21 via DHCP;&lt;/li&gt;&#xA;&lt;li&gt;Rationally use my public IP subnet (1.0.0.0/21);&lt;/li&gt;&#xA;&lt;li&gt;Probably have every remote switch in a separate vlan;&lt;/li&gt;&#xA;&lt;li&gt;Do rate limiting and firewalling for clients;&lt;/li&gt;&#xA;&lt;li&gt;Have some sort of redundancy only for failed hardware (dual links to remote switches are not possible).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I do not want to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use PPPoE for authentication.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm aware that there's an easy way: to put a firewalled bridge between aggregation switch and a BGP router, assign few IP addresses and use it as a gateway for clients, but I think that would be stupid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only need a design advice and/or some insights.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/HBCaC.png&quot; alt=&quot;Demonstration figure&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5566" LastEditorUserId="775" LastEditDate="2015-04-17T05:17:29.500" LastActivityDate="2015-04-17T05:17:29.500" Title="Network distribution/core design advice" Tags="|router|bgp|design|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="8292" PostTypeId="2" ParentId="8288" CreationDate="2014-06-08T14:30:00.560" Score="27" Body="&lt;p&gt;In addition, &lt;strong&gt;MSS&lt;/strong&gt; value is derived from the &lt;strong&gt;MTU&lt;/strong&gt;. Consider that you have data of 2260 bytes to be sent to a remote device. If MTU is 1500, and we consider IP header + TCP header to be 40 bytes, then only 1460 bytes of data can be sent in the first IP packet. The remaining 800 bytes will be sent in the second IP packet. So, for MSS = 800, the MTU should be at least 840.&lt;/p&gt;&#xA;&lt;p&gt;As PPPoE overhead is 8 bytes, and therefore MTU = 1492 bytes, and MSS = 1492-40 = 1452 bytes.&lt;/p&gt;&#xA;" OwnerUserId="1315" LastEditorUserId="62965" LastEditDate="2021-04-21T06:15:57.020" LastActivityDate="2021-04-21T06:15:57.020" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="8293" PostTypeId="2" ParentId="8288" CreationDate="2014-06-08T15:39:42.410" Score="39" Body="&lt;p&gt;The MTU is the Maximum IP packet size for a given link.  Packets bigger than the MTU is fragmented at the point where the lower MTU is found and reassembled further down the chain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If no fragmentation is wanted, either you have to check the MTU at each hop or use a helper protocol for that (&lt;a href=&quot;https://en.wikipedia.org/wiki/Path_MTU_Discovery&quot; rel=&quot;noreferrer&quot;&gt;Path MTU Discovery&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that IPv6 does &lt;em&gt;NOT&lt;/em&gt; support packet fragmentation by routers, hence PMTUD with ICMPv6 is mandatory if you don't want to lose a packet somewhere because of small MTU.  Endpoints can fragment, but not routers  Also, IPv6 has a much higher MINIMUM MTU. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;MSS is Maximum TCP segment Size.  Unlike MTU, packet exceeding MSS aren't fragmented, they're simply discarded. MSS is normally decided in the TCP three-way handshake, but some setup might yield path where the decided upon MSS is still too big, leading to dropped packets.  The MSS isn't negotiated packet per packet, but for a complete TCP session, nor does it take into account TCP/IP headers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using PPPoE, all the overhead means you needs to reduce the MSS on the way, normally by specifying it on the router where the chokepoint is found, which will then replace the MSS of passing threeway handshake by the correct lower value if it's higher.  PPPoE is simply adding 8 bytes (6 bytes PPPoE + 2 bytes PPP) on top of everything (IP+TCP) and is meant to be run over Ethernet at 1500 bytes MTU, hence the 1492 MSS normally configured to make it go through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your IP stack will chop off data to be sent up to the MSS, put it in a TCP segment, then put it in one or more IP packets (depending if it's bigger than local MTU settings) before sending it.  Intermediate router could chop it down further if they have lower MTU, but they're only affecting the IP Packet itself, not playing into the TCP segment/header.&lt;/p&gt;&#xA;" OwnerUserId="1645" LastEditorUserId="59106" LastEditDate="2019-06-12T20:42:28.813" LastActivityDate="2019-06-12T20:42:28.813" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="9292" PostTypeId="1" AcceptedAnswerId="9293" CreationDate="2014-06-08T20:20:52.857" Score="18" ViewCount="2862" Body="&lt;p&gt;I was recently troubleshooting a network connectivity meta-problem, in that I knew a given destination was reachable, but I was not able to demonstrate that with &lt;code&gt;traceroute&lt;/code&gt; because the path went cold after a certain number of hops. Given that the last observed hop was just upstream from the node of interest, I sniffed the traffic, expecting to confirm that the probes were reaching it and to learn which filter rule was blocking them. Sure enough, I learned that the probes were UDP datagrams destined for a high (and varying) port that I had, of course, blocked to inbound traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This surprises me, because I assumed that all &lt;code&gt;traceroute&lt;/code&gt; probes would default to ICMP, since the responses are ICMP. I did a documentation survey and found that different implementations make different choices, and some do not allow the user to make a non-default selection.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;UDP&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-121-mainline/12778-ping-traceroute.html#traceroute&quot;&gt;Cisco&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://linux.die.net/man/8/traceroute&quot;&gt;Linux&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.freebsd.org/cgi/man.cgi?query=traceroute&quot;&gt;FreeBSD&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;ICMP&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.3/topics/concept/j-web-traceroute.html&quot;&gt;Juniper&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.brocade.com/downloads/documents/html_product_manuals/NI_05600_ADMIN/OAM.08.11.html&quot;&gt;Brocade&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://support.microsoft.com/kb/162326&quot;&gt;Windows&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The abstract of &lt;a href=&quot;http://dl.acm.org/citation.cfm?id=1452557&quot;&gt;&lt;em&gt;Traceroute probe method and forward IP path inference&lt;/em&gt;&lt;/a&gt; supports my intuition that ICMP probes will more often succeed in reaching the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Allowing different probe methods seems like a great idea, but defaulting to something other than ICMP seems like a bad idea. Could somebody describe the rationale behind why it is better to use UDP by default?&lt;/p&gt;&#xA;" OwnerUserId="47" LastEditorUserId="47" LastEditDate="2014-06-08T23:10:56.933" LastActivityDate="2014-06-09T05:50:05.450" Title="Why do some common traceroute implementations default to using UDP probes?" Tags="|icmp|traceroute|icmpv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9293" PostTypeId="2" ParentId="9292" CreationDate="2014-06-09T03:28:30.213" Score="20" Body="&lt;p&gt;The first version of &lt;code&gt;traceroute&lt;/code&gt; was written by Van Jacobson and it used ICMP but it didn't work very well. The vendor interpretation of ICMP in RFC792 was that routers should not send an ICMP error message in response to an ICMP packet (see edit notes below). Therefore most routers would not send a &quot;time exceeded&quot; message in response to an echo request with a TTL of 1 or 0. So he changed it to use UDP and lo and behold it worked great and there was much rejoicing (and adoption). The &lt;code&gt;traceroute&lt;/code&gt; tool on Linux and FreeBSD (and I assume Cisco) is based on Van Jacobson's work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The spec was later changed to &quot;in response to an ICMP &lt;em&gt;error&lt;/em&gt; packet.&quot; The world progressed, vendors made changes to their stacks allowing ICMP error messages in response to echo requests, and with the rise of firewalls and ACLs, stray UDP packets sometimes get blocked, but ICMP echo request could get through. Of course, your success on that today varies wildly. I would expect the &lt;code&gt;tracert&lt;/code&gt; and other tools were written at a time when using ICMP echo responses wasn't so problematic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days you can't really say UDP is better than ICMP. Or that either of those is better than TCP. It completely depends on the path you are traversing and the security policies in place. You may need to try one, both, or all three implementations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sources:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ftp.arl.army.mil/~mike/ping.html&quot;&gt;http://ftp.arl.army.mil/~mike/ping.html&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.inetdaemon.com/tutorials/troubleshooting/tools/traceroute/definition.shtml&quot;&gt;http://www.inetdaemon.com/tutorials/troubleshooting/tools/traceroute/definition.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changed RFC from IP (RFC791) to ICMP (RFC792) that says in the intro:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To avoid the infinite regress of messages about messages etc., no ICMP&#xA;  messages are sent about ICMP messages.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's the bit that caused vendors to not send &quot;Time Exceeded&quot; errors for echo requests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RFC1122, Requirements for Internet Hosts, in section 3.2.2. is the update that says hosts shouldn't respond to ICMP &lt;em&gt;error&lt;/em&gt; messages.&lt;/p&gt;&#xA;" OwnerUserId="5983" LastEditorUserId="5983" LastEditDate="2014-06-09T05:50:05.450" LastActivityDate="2014-06-09T05:50:05.450" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9301" PostTypeId="1" CreationDate="2014-06-09T10:41:59.063" Score="13" ViewCount="346643" Body="&lt;p&gt;I have Cisco catalyst switch, with many VLANs and address ranges. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I find IP addresses connected to the switch that are not Cisco devices?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastEditorUserId="3191" LastEditDate="2014-06-09T15:26:42.580" LastActivityDate="2019-04-18T11:55:04.547" Title="Finding Non-Cisco End Device IP Addresses Connected to Cisco Switch" Tags="|cisco|switch|mac-address|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9302" PostTypeId="2" ParentId="9301" CreationDate="2014-06-09T10:51:03.183" Score="16" Body="&lt;p&gt;Perform a &lt;code&gt;show mac address-table interface &amp;lt;switchport&amp;gt;&lt;/code&gt; on the switch that has the device(s) connected to it. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#show mac address-table int gi1/0/34&#xA;          Mac Address Table&#xA;-------------------------------------------&#xA;&#xA;Vlan    Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA; 132    001b.78d5.a2d7    DYNAMIC     Gi1/0/34&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then go to the router for the VLAN specified in the previous command and perform a &lt;code&gt;show ip arp vlan &amp;lt;vlan#&amp;gt; | include &amp;lt;mac-address&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show ip arp vlan 132 | include 001b.78d5.a2d7&#xA;Internet  192.168.132.234        62   001b.78d5.a2d7  ARPA   Vlan132&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That will give you the IP address for the device.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2014-06-09T10:51:03.183" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9304" PostTypeId="2" ParentId="9301" CreationDate="2014-06-09T13:05:14.500" Score="0" Body="&lt;p&gt;Though this is not exactly a solution, you can try &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show ip arp inspection log&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which will output the contents of the log buffer before the buffer was flashed. If the end device triggered some sort of log event, for instance a DHCP reject, it will be identifiable by looking the log data since the output will display interface, MAC address, and IP address on the same output line. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once again, this is not a real solution, so be mindful that it may as well not work at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: sample output from Cisco Catalyst command index pages:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;`&lt;br&gt;&#xA;     Switch# show ip arp inspection log&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Total Log Buffer Size : 32&#xA;&#xA; Syslog rate : 10 entries per 300 seconds.&#xA;&#xA; Interface   Vlan  Sender MAC      Sender IP        Num Pkts   Reason       Time&#xA; ----------  ----  --------------  ---------------  ---------  -----------  ----&#xA; Gi1/0/1       5     0003.0000.d673  192.2.10.4               5  DHCP Deny    19:39:01 UTC Mon Mar 1 1993&#xA; Gi1/0/1       5     0001.0000.d774  128.1.9.25               6  DHCP Deny    19:39:02 UTC Mon Mar 1 1993&#xA; Gi1/0/1       5     0001.c940.1111  10.10.10.1               7  DHCP Deny    19:39:03 UTC Mon Mar 1 1993&#xA; Gi1/0/1       5     0001.c940.1112  10.10.10.2               8  DHCP Deny    19:39:04 UTC Mon Mar 1 1993&#xA; Gi1/0/1       5     0001.c940.1114  173.1.1.1               10  DHCP Deny    19:39:06 UTC Mon Mar 1 1993&#xA; Gi1/0/1       5     0001.c940.1115  173.1.1.2               11  DHCP Deny    19:39:07 UTC Mon Mar 1 1993&#xA; Gi1/0/1       5     0001.c940.1116  173.1.1.3               12  DHCP Deny    19:39:08 UTC Mon Mar 1 1993&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6022" LastActivityDate="2014-06-09T13:05:14.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9311" PostTypeId="2" ParentId="9301" CreationDate="2014-06-09T15:30:48.387" Score="6" Body="&lt;p&gt;If you do not have any Layer 3 interface on the actual VLAN, you won't really be able to see any IPs going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way would be to do port miroring and sniff the packet to see what IP's going through, but it might not give you a complete picture either&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-06-09T15:30:48.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9313" PostTypeId="2" ParentId="9301" CreationDate="2014-06-09T16:00:07.673" Score="-1" Body="&lt;p&gt;The IP Device tracking feature will enable your switch to snoop arp packets, once enabled the command: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;show ip device tracking all&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;will contain a list of all learned devices and the associated IP addresses&lt;/p&gt;&#xA;" OwnerUserId="4946" LastActivityDate="2014-06-09T16:00:07.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9314" PostTypeId="2" ParentId="8290" CreationDate="2014-06-09T16:23:34.560" Score="3" Body="&lt;p&gt;One solution is to use two L3 switches as your aggregation layer. To lessen the impact of a failure, two L3 switches are used; half of the remote switches connect to one, half to the other.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The remote switches are trunked to the agg switches, and two vlans are created for each switch: a user vlan and a management vlan.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also create a VLAN with a L3 interface on each switch to connect your Internet routers.  Optionally, you can place a firewall between the routers and your switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can go into more detail if you need it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-06-09T16:23:34.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9315" PostTypeId="2" ParentId="8282" CreationDate="2014-06-09T17:05:33.820" Score="5" Body="&lt;p&gt;I found the problem!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firewall has 4 rams (each of 1gb). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I started with two rams inserted and changed the configuration and it worked, the firewall did not restart. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there is one failing ram. Now we ordered new one to replace it.&lt;/p&gt;&#xA;" OwnerUserId="2534" LastActivityDate="2014-06-09T17:05:33.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9316" PostTypeId="1" CreationDate="2014-06-09T17:37:02.907" Score="2" ViewCount="253" Body="&lt;p&gt;I know OSPF router-id is just name for identification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BUT,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why  OSPF router ID should be hardcoded ,is there any reason for that ?&lt;/p&gt;&#xA;" OwnerUserId="4289" LastActivityDate="2014-06-10T04:51:00.857" Title="OPEN SHORTEST PATH FIRST(OSPF) ROUTER-ID" Tags="|ospf|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9317" PostTypeId="2" ParentId="9316" CreationDate="2014-06-09T18:05:08.963" Score="3" Body="&lt;p&gt;So you know what it is.  Otherwise, you have to figure out what is the highest loopback IP address.  If you have lots of routers, that could be a lot of unnecessary work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't matter much in a lab configuration, but if you have hundreds or thousands of routers, it becomes a big deal to keep track of them all.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-06-09T18:05:08.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9318" PostTypeId="2" ParentId="9316" CreationDate="2014-06-09T18:14:21.080" Score="7" Body="&lt;p&gt;By default, the highest ip address in the router loopbacks is chosen as the router id.  It's smarter to force the router to choose a router id that I want instead of letting it choose for me.  OSPF router id is part of the DR / BDR election criteria,  as well as the DBD exchange master selection criteria.  Also consider that duplicate router ids are very bad; if you control the router id, the only person to blame for duplication is yourself.&lt;/p&gt;&#xA;" OwnerUserId="5025" LastActivityDate="2014-06-09T18:14:21.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9319" PostTypeId="2" ParentId="7924" CreationDate="2014-06-09T23:29:26.913" Score="3" Body="&lt;p&gt;The throttling most oftens happens at the carrier that is near the client, but can potentially occur within any transit carrier or non-transit carrier. Throttling actions can occur on a particular pattern of traffic from Layer 3 to Layer 7, and can occur in many ways, whether it is lowering the priority of the traffic in queue, imposing absolute bandwidth limitations, reducing the share of overall bandwidth that the traffic has available to use, or outright blocking the traffic altogether. Throttling most often occurs when the service integrity of a carrier is threatened by a particular pattern of overwhelming usage. First, the overwhelming traffic pattern that threatens overall user experience is identified, then the best manner of throttling is determined that does not further threaten the service of the overall customer base. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Patterns of overwhelming usage is a common concern of any service provider, and many businesses maintain a policy based on the likelihood of the event. For example, rolling brownouts and customer notifications when power usage spikes during peak hours, or lane closures and traffic redirection during large attendance at entertainment venues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client experiences throttling by receiving a particular service at a lower speed than they expected, but may still have the total speed available for any other service. For example, a client may have a 16Mbps download speed, and require 16Mbps to receive a 1080p stream at 30fps from a movie streaming service. Unfortunately, a large number of other users, although a small percentage of the user base, request the same, which saturates the ISP's link into Level3, forcing redirects to route around, and threaten saturation of the ISP's other link into Hurricane Electric. This saturation event threatens the entire service level of the ISP, and the traffic is singled out as the primary culprit as 4% of the user base are consuming 85% of the bandwidth. The ISP then rate-limits the particular pattern of the stream by hard-limiting the total bandwidth availabe to that traffic across the link to Level3. The streaming player detects the rate-limit that 16Mbps is no longer available, and downgrades the connection from 1080p to 480p @ 30fps, reducing the overall traffic request of the client to 3Mbps. The ISP no longer experiences the link saturation event, but maintains the hard rate-limit to mitigate the risk of a repeat event based on the same traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP then contacts the movie streaming service and proposes adding a new peer link to Level3 or providing a caching host connection internal to the ISP's network to avoid repeated saturation issues. Due to the costs of adding the additional peer link on account of a single service overwhelming the ISP's network, the ISP proposes to share the costs of additional infrastructure with the movie streaming service.&lt;/p&gt;&#xA;" OwnerUserId="6032" LastActivityDate="2014-06-09T23:29:26.913" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9321" PostTypeId="2" ParentId="653" CreationDate="2014-06-09T23:59:24.703" Score="4" Body="&lt;pre&gt;&lt;code&gt; sh int | in is down|input never, output never&#xA;&#xA;FastEthernet0 is administratively down, line protocol is down &#xA;  Last input never, output never, output hang never&#xA;GigabitEthernet1/0/2 is down, line protocol is down (notconnect) &#xA;GigabitEthernet1/0/4 is down, line protocol is down (notconnect) &#xA;  Last input never, output never, output hang never&#xA;GigabitEthernet1/0/13 is down, line protocol is down (notconnect) &#xA;  Last input never, output never, output hang never&#xA;GigabitEthernet1/0/24 is down, line protocol is down (notconnect) &#xA;  Last input never, output never, output hang never&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6033" LastEditorUserId="6033" LastEditDate="2014-06-10T00:38:27.633" LastActivityDate="2014-06-10T00:38:27.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9323" PostTypeId="2" ParentId="9316" CreationDate="2014-06-10T04:51:00.857" Score="0" Body="&lt;p&gt;Also you can use the &lt;code&gt;ip ospf name-lookup&lt;/code&gt; command to perform a reverse DNS lookup on the router-id. If your DNS is set up correctly this can help you quickly identify the router.&lt;/p&gt;&#xA;" OwnerUserId="1682" LastActivityDate="2014-06-10T04:51:00.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9324" PostTypeId="1" CreationDate="2014-06-10T15:24:03.630" Score="3" ViewCount="1330" Body="&lt;p&gt;I have a site-2-site vpn tunnel between a Pix 506e 6.3(3) and an ASA 5510 running 9.0(3)6. I can control both sides of the config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This tunnel worked fine until we did a firmware update on the ASA which was originally running 8.4(2).  I have 3 tunnels which terminate at our ASA with peer Ips that are on device  pix 506e models having issues and I cant figure out why. I will focus on one tunnel in particular in hopes that someone can help me fix it and I can try to apply the fix to the other two acting up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The symptoms are as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tunnel will come up with Phase 1 and Phase 2. Everything will work fine for a variable amount of time then the tunnel will drop. I see this over and over again in the logs of the ASA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tunnel Manager has failed to establish an L2L SA. All configured IKE versions failed to establish the tunnel&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I go into the ASA and I remove the crypto map and then re-add it. The tunnel comes back up and remains active for a variable amount of time once again. And when I say variable I mean it can stay up and working for as long as a half a day or as little as 15 min .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the outage if I do a show isakmp sa on the pix I get the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pix# show isakmp sa&#xA;&#xA;Total     : 6&#xA;Embryonic : 0&#xA;        dst               src        state     pending     created&#xA;   2.2.2.2   1.1.1.1    QM_IDLE         0         115&#xA;   2.2.2.2   1.1.1.1    QM_IDLE         0         254&#xA;   2.2.2.2   1.1.1.1    QM_IDLE         0         123&#xA;   2.2.2.2   1.1.1.1    QM_IDLE         0         108&#xA;   2.2.2.2   1.1.1.1    QM_IDLE         0         224&#xA;   2.2.2.2   1.1.1.1    QM_IDLE         0         129&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the ASA doing the same cmd will get me&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IKE Peer: 2.2.2.2&#xA;    Type    : L2L             Role    : initiator&#xA;    Rekey   : no              State   : MM_WAIT_MSG2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I want to bring the tunnel back up right away, I can remove the crypto map from the ASA and then re-add it and everything will work again for a bit. What should I be checking?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some kind of difference I should now be aware of between the isakmp config on pix and ikev1 on ASA? It was all working before when the ASA was on 8.4(2) and this is ONLY happening to my tunnels that are terminating on the PIX 506 e devices running 6.3(3) . Thats a clue I know, I just don't understand what I should be looking at to figure out how to fix it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PRODUCTION-NET in this example config would be 192.168.11.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ASA 5520&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network POGO&#xA; network-object host 172.232.x.x&#xA;&#xA;access-list POGO extended permit ip object PRODUCTION-NET object-group POGO &#xA;&#xA;nat (inside,outside) source static PRODUCTION-NET PRODUCTION-NET destination static POGO POGO&#xA;&#xA;crypto map vpn-tunnel 320 match address POGO&#xA;crypto map vpn-tunnel 320 set peer 2.2.2.2&#xA;crypto map vpn-tunnel 320 set ikev1 transform-set ESP-AES-128-MD5&#xA;&#xA;tunnel-group 2.2.2.2 type ipsec-l2l&#xA;tunnel-group 2.2.2.2 general-attributes&#xA; default-group-policy VPN-TUNNEL-POLICY&#xA;tunnel-group 2.2.2.2 ipsec-attributes&#xA; ikev1 pre-shared-key cisco123&#xA; isakmp keepalive threshold 30 retry 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Pix 506e&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network POGO_VPN &#xA;  network-object host 172.232.x.x&#xA;&#xA;access-list DSW permit ip object-group POGO_VPN 192.168.11.0 255.255.255.0&#xA;&#xA;crypto ipsec transform-set AES128 esp-aes esp-md5-hmac &#xA;crypto map pcmap 320 ipsec-isakmp&#xA;crypto map pcmap 320 match address POGO&#xA;crypto map pcmap 320 set peer 1.1.1.1&#xA;crypto map pcmap 320 set transform-set AES128&#xA;crypto map pcmap client configuration address initiate&#xA;crypto map pcmap client configuration address respond&#xA;crypto map pcmap interface outside&#xA;isakmp enable outside&#xA;isakmp key ******** address 1.1.1.1 netmask 255.255.255.255 no-xauth no-config-mode &#xA;isakmp identity address&#xA;isakmp keepalive 30 10&#xA;isakmp nat-traversal 20&#xA;isakmp policy 1 authentication pre-share&#xA;isakmp policy 1 encryption aes&#xA;isakmp policy 1 hash md5&#xA;isakmp policy 1 group 2&#xA;isakmp policy 1 lifetime 86400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on the debug crypto isakmp I see this going on while the outage occurs on the ASA side. On the remote pix side it does not show any logs just   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ASA isakmp Debug&lt;/strong&gt;&#xA;    J&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;un 18 12:31:23 [IKEv1]IP = 2.2.2.2, IKE Initiator: New Phase 1, Intf inside, IKE Peer 2.2.2.2  local Proxy Address 192.168.11.0, remote Proxy Address 172.233.240.226,  Crypto map (vpn-tunnel)&#xA;    Jun 18 12:31:23 [IKEv1 DEBUG]IP = 2.2.2.2, constructing ISAKMP SA payload&#xA;    Jun 18 12:31:23 [IKEv1 DEBUG]IP = 2.2.2.2, constructing NAT-Traversal VID ver 02 payload&#xA;    Jun 18 12:31:23 [IKEv1 DEBUG]IP = 2.2.2.2, constructing NAT-Traversal VID ver 03 payload&#xA;    Jun 18 12:31:23 [IKEv1 DEBUG]IP = 2.2.2.2, constructing NAT-Traversal VID ver RFC payload&#xA;    Jun 18 12:31:23 [IKEv1 DEBUG]IP = 2.2.2.2, constructing Fragmentation VID + extended capabilities payload&#xA;    Jun 18 12:31:23 [IKEv1]IP = 2.2.2.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 672&#xA;    Jun 18 12:31:30 [IKEv1]IP = 2.2.2.2, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.&#xA;    Jun 18 12:31:30 [IKEv1]IP = 2.2.2.2, Queuing KEY-ACQUIRE messages to be processed when P1 SA is complete.&#xA;    Jun 18 12:31:31 [IKEv1]IP = 2.2.2.2, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 672&#xA;    Jun 18 12:31:39 [IKEv1]IP = 2.2.2.2, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 672&#xA;    Jun 18 12:31:47 [IKEv1]IP = 2.2.2.2, IKE_DECODE RESENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 672&#xA;    Jun 18 12:31:55 [IKEv1 DEBUG]IP = 2.2.2.2, IKE MM Initiator FSM error history (struct &amp;amp;0x74d097c8)  &amp;lt;state&amp;gt;, &amp;lt;event&amp;gt;:  MM_DONE, EV_ERROR--&amp;gt;MM_WAIT_MSG2, EV_RETRY--&amp;gt;MM_WAIT_MSG2, EV_TIMEOUT--&amp;gt;MM_WAIT_MSG2, NullEvent--&amp;gt;MM_SND_MSG1, EV_SND_MSG--&amp;gt;MM_SND_MSG1, EV_START_TMR--&amp;gt;MM_SND_MSG1, EV_RESEND_MSG--&amp;gt;MM_WAIT_MSG2, EV_RETRY&#xA;    Jun 18 12:31:55 [IKEv1 DEBUG]IP = 2.2.2.2, IKE SA MM:e7fa4a37 terminating:  flags 0x01000022, refcnt 0, tuncnt 0&#xA;    Jun 18 12:31:55 [IKEv1 DEBUG]IP = 2.2.2.2, sending delete/delete with reason message&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;debug isakmp on the PIX&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PEER_REAPER_TIMERshow isakmp sa         &#xA;Total     : 2&#xA;Embryonic : 0&#xA;        dst               src        state     pending     created&#xA;   2.2.2.2   1.1.1.1    QM_IDLE         0           6&#xA;   2.2.2.2   1.1.1.1    QM_IDLE         0         117&#xA;dswpix(config)# &#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;REAPER_TIMER&#xA;ISADB: reaper checking SA 0x10232bc, conn_id = 0&#xA;ISADB: reaper checking SA 0xfe9a44, conn_id = 0&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;REAPER_TIMER&#xA;ISADB: reaper checking SA 0x10232bc, conn_id = 0&#xA;ISADB: reaper checking SA 0xfe9a44, conn_id = 0&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;PEER_REAPER_TIMER&#xA;REAPER_TIMER&#xA;ISADB: reaper checking SA 0x10232bc, conn_id = 0&#xA;ISADB: reaper checking SA 0xfe9a44, conn_id = 0debug crypto ipsec 200 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6038" LastEditorUserId="6038" LastEditDate="2014-06-18T18:48:39.617" LastActivityDate="2014-06-18T18:48:39.617" Title="L2L VPN issues Pix 506e and ASA5520" Tags="|cisco-asa|vpn|l2vpn|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="9327" PostTypeId="1" AcceptedAnswerId="9340" CreationDate="2014-06-10T18:33:07.547" Score="1" ViewCount="824" Body="&lt;p&gt;On a simple network of about 10 computers setup with static IPs in the 192.168.1.x range, the ISP's DSL router occupies 192.168.1.1. All computers and the router physically connect to a simple network switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to achieve is to put a mikrotik in the middle of the DSL and the computers, that is to plug the DSL router in one port of a mikrotik's 750GL and the switch to another port and have mikrotik bridge the traffic while at the same time appear as 192.168.1.1 for the computers in the network. It has to be done without changing the IP of the DSL router or any of the computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to do it if the router and the computers are in a different network, but I don't know if it is possible in the same network and IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My final goal is to use the mikrotik as a transparent proxy to block access to certain sites. But this will be in a remote location where I won't be able to physically set it up, only prepare and sent the mikrotik. Additionally if something goes wrong at any point, I would like to be able to instruct someone to just take the plugs out to remove the mikrotik and connect them back to the switch in order to return to the previous working configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to add that I tried to research this but I couldn't come up with the proper keywords or no such answer exists :)&lt;/p&gt;&#xA;" OwnerUserId="6041" LastEditorUserId="8499" LastEditDate="2018-02-14T16:38:16.230" LastActivityDate="2018-02-14T16:38:16.230" Title="Can a mikrotik 750GL have the same IP as the DSL router connected in a different port?" Tags="|router|bridge|" AnswerCount="3" CommentCount="0" ClosedDate="2017-08-09T23:58:12.127" ContentLicense="CC BY-SA 3.0" />
  <row Id="9328" PostTypeId="2" ParentId="9327" CreationDate="2014-06-10T18:46:02.907" Score="1" Body="&lt;p&gt;No, you cannot have two devices with the same IP address in one broadcast domain.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-06-10T18:46:02.907" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9333" PostTypeId="1" CreationDate="2014-06-10T22:06:05.880" Score="7" ViewCount="3438" Body="&lt;p&gt;Hi I was practicing creating vlans and assigning them to ports however I cannot remove the names.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CCNA-SWITCH1#show vlan&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                          active    Fa0/1, Fa0/2, Fa0/3, Fa0/4&#xA;                                                Fa0/5, Fa0/6, Fa0/7, Fa0/8&#xA;                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12&#xA;                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16&#xA;                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20&#xA;                                                Fa0/21, Fa0/22, Fa0/23, Fa0/24&#xA;                                                Gi0/1, Gi0/2&#xA;1002 fddi-default                     act/unsup&#xA;1003 trcrf-default                    act/unsup&#xA;1004 fddinet-default                  act/unsup&#xA;1005 trbrf-default                    act/unsup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CCNA-SWITCH1#show ip interface brief&#xA;Interface              IP-Address      OK? Method Status                Protocol&#xA;Vlan1                  unassigned      YES manual administratively down down&#xA;Vlan2                  unassigned      YES manual up                    down&#xA;Vlan3                  unassigned      YES manual up                    down&#xA;FastEthernet0/1        unassigned      YES unset  down                  down&#xA;FastEthernet0/2        unassigned      YES unset  down                  down&#xA;FastEthernet0/3        unassigned      YES unset  down                  down&#xA;FastEthernet0/4        unassigned      YES unset  down                  down&#xA;FastEthernet0/5        unassigned      YES unset  down                  down&#xA;FastEthernet0/6        unassigned      YES unset  down                  down&#xA; --More--&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to remove vlan 2 and 3 &#xA;i used the command no vlan 2 etc.. but they still showing &lt;/p&gt;&#xA;" OwnerUserId="6046" LastEditorUserId="33" LastEditDate="2014-06-12T12:18:13.857" LastActivityDate="2015-10-01T01:10:00.717" Title="cannot remove vlan names" Tags="|cisco|vlan|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9334" PostTypeId="2" ParentId="9333" CreationDate="2014-06-10T22:49:34.273" Score="5" Body="&lt;p&gt;Try &lt;code&gt;no interface vlan 2&lt;/code&gt; and &lt;code&gt;no interface vlan 3&lt;/code&gt; in global config mode.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2014-06-10T22:49:34.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9335" PostTypeId="2" ParentId="9333" CreationDate="2014-06-10T23:33:28.253" Score="7" Body="&lt;p&gt;It appears you created both the VLANs and the SVI (virtual interfaces).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While the &lt;code&gt;no vlan 2&lt;/code&gt; would (and did according to your &lt;code&gt;show vlan&lt;/code&gt; output) remove the VLAN, it won't remove the SVI (which show up when you show the interfaces with &lt;code&gt;show ip interface brief&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To remove the SVI, you need to issue the &lt;code&gt;no interface vlan 2&lt;/code&gt; command as well.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="76" LastEditDate="2014-06-11T21:57:31.993" LastActivityDate="2014-06-11T21:57:31.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9337" PostTypeId="1" AcceptedAnswerId="9350" CreationDate="2014-06-11T05:39:30.187" Score="8" ViewCount="1019" Body="&lt;p&gt;For Cisco Hardware dCEF, based on some documents published on Cisco website, at the ingress line card/interface, conceptually it looks up the FIB with dst IP address, and gets a pointer to an adjacency table entry, where L2 rewrite information is stored, e.g. nexthop mac, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what confuses me is, doesn't the L2 rewrite happen on egress line card/interface? If so, then why this adjacency table is stored on ingress? Or where is the adjacency table look up happening? ingress or egress? If this is on ingress, are the L2 rewrite information carried over from ingress card to egress line card? Wouldn't that be a waste of fabric bandwidth?&lt;/p&gt;&#xA;" OwnerUserId="6048" LastActivityDate="2014-06-12T11:18:42.360" Title="Where is Cisco Hardware dCEF's adjacency table stored?" Tags="|cisco|cef|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9338" PostTypeId="2" ParentId="7924" CreationDate="2014-06-11T10:09:35.580" Score="1" Body="&lt;p&gt;&lt;strong&gt;Split traffic based on users&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have three sons in their teens who game like idiots. They use so much bandwidth that you decide to take a second high speed cable connection. You buy a nice Draytek router that can handle two internet connections into one network, and which can decide which computer connects to what network, based on a set of rules. Now you have the following situation: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You, your wife and 8 year old daughter use an 8mbps ADLS connection. This keeps it safe for your daughter, and you can limit her access. &lt;/li&gt;&#xA;&lt;li&gt;Your sons have their own computers, which use a 50mbit cable connection via the same router. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Split traffic based on type of usage&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far nothing new, and this is comparable with two different households, one of them with a fast connection. But now you change the setup of the router, and based on the kind of traffic or the kind of websites that are used, you decide to use ADSL or cable. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Gaming, Youtube, Netflix go through fast cable&lt;/li&gt;&#xA;&lt;li&gt;Facebook, general netbrowsing, gmail go through ADSL&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Given enough users, ADSL will feel &quot;throttled&quot;. In fact it is not throttled, it's just a slower channel. Given enough speed, cable will never feel throttled. So traffic is not throttled, it's just directed through a channel that cannot handle the speed that you would expect, compared to using cable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why is this bad&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may think that this is not such a bad thing. In my example I'm talking about Facebook and Gmail going through the slow connection. That will not happen. Facebook will pay for speed, just like Google and Microsoft. They have the money. Small firms and sites don't have that money. They will not pay, visitors get annoyed with the slow connection, and stay away. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I google for something like sneakers, I will click several links. Some will take 20-30 seconds to open and before that the page is blank. Many times I close the tab and choose another link. This will get worse. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Facebook has its own server farms that serve superfast. I use a cheapass 10 euro a year provider and just one wordpress page can take 30 seconds depending on other traffic on that server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be honest I still don't see how this is different, and I don't know what the side effects will be. So I can't tell you why this will be more problematic than using (and paying for) a fast or slow server. &lt;/p&gt;&#xA;" OwnerUserId="5563" LastActivityDate="2014-06-11T10:09:35.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9339" PostTypeId="1" AcceptedAnswerId="24038" CreationDate="2014-06-11T13:40:45.950" Score="3" ViewCount="329" Body="&lt;p&gt;The &lt;a href=&quot;http://en.wiktionary.org/wiki/isochronous&quot; rel=&quot;nofollow&quot;&gt;definition page on Wiktionary&lt;/a&gt; for &quot;Isochronous&quot; offers this example of the word in a sentence:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Their entire national telephone network is isochronous, with a clock&#xA;  distribution tree radiating from a single, protected cesium reference&#xA;  clock.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I know it's just an example but is it true that the telephone network is isochronous? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was always under the impression that it's non-isochronous since telephone conversations happen in live time at any time - and they can't be constrained to any particular clock. If the Wiktionary article is correct, why is this?&lt;/p&gt;&#xA;" OwnerUserId="6026" LastEditorUserId="775" LastEditDate="2014-12-08T12:57:14.727" LastActivityDate="2015-11-03T10:02:41.283" Title="Why is the telephone network isochronous?" Tags="|terminology|telephony|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9340" PostTypeId="2" ParentId="9327" CreationDate="2014-06-11T14:09:19.517" Score="1" Body="&lt;p&gt;No, you can't have the same ip on two different interfaces, but using the mikrotik as a bridge/transparent firewall could help you accomplish your goal. you can set this under the bridge options. I have not worked with mikrotiks for a long time but if I remember correctly you can go to '/interface bridge settings' and set 'use-ip-firewall' to 'yes'. Probably you can also use bridge filters for this task.&lt;/p&gt;&#xA;" OwnerUserId="5469" LastActivityDate="2014-06-11T14:09:19.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9344" PostTypeId="2" ParentId="8283" CreationDate="2014-06-11T20:56:49.223" Score="5" Body="&lt;p&gt;NAT/PAT can be used to solve your problem, 60 host on few IP Address. For your deployment and if you don't need 1:1 translation, that's mean, many address can be translated in many address AKA many-to-many translation this could be a solution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you want to deploy such scenario, here the commands for a Cisco Device.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! internal subnet to match &#xA;(config)# access-list 1 permit 192.168.0.0 0.0.0.255 &#xA;! Public Pool where the private will be translated &#xA;(config) # ip nat pool POOL 60.140.130.193 60.140.130.198 netmask 255.255.255.248&#xA;!&#xA;! List 1 will be translated on POOL &#xA;(config) # ip nat inside source list 1 pool POOL&#xA;!&#xA;! LAN Interface &#xA;(config) # interface FastEthernet 0/1&#xA;(config-if) # ip nat inside&#xA;! WAN Interface&#xA;(config-if) # interface FastEthernet 0/0&#xA;(config-if) # ip nat outside&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the outside point of view, your 60 host will fit on the public subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suggestion : since public IPv4 are a limited resource, the best would be to NAT/PAT the 60 Host on only one IP and leave some free Public IPs, in case of need. Well this suggestion don't take in account the limitations of NAT/PAT, like how much host can be translate over one 1 Public IP.  &lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2014-06-12T05:23:25.550" LastActivityDate="2014-06-12T05:23:25.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9345" PostTypeId="2" ParentId="9337" CreationDate="2014-06-11T21:54:14.430" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;When distributed Cisco Express Forwarding is enabled, line cards, such as the VIP line cards or the Cisco 12000 Series Internet Router line cards, maintain an identical copy of the FIB and adjacency tables. The line cards perform express forwarding between port adapters, thus relieving the RP of involvement in the switching operation. distributed Cisco Express Forwarding uses an interprocess communication (IPC) mechanism to ensure synchronization of FIB tables and adjacency tables on the RP and line cards. -- &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/ipswitch/configuration/guide/12_4/isw_12_4_book/cef_enable_disable.html#wp1058530&quot; rel=&quot;nofollow&quot;&gt;Cisco&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The RP (running various routing protocol processes) builds the FIB and publishes it to all linecards. There's &lt;em&gt;one&lt;/em&gt; FIB, but it's replicated on every linecard. (yes, sometimes they get out of sync.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-11T21:54:14.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9347" PostTypeId="1" AcceptedAnswerId="9355" CreationDate="2014-06-12T01:44:04.033" Score="4" ViewCount="865" Body="&lt;p&gt;I was able to pick up a pix515e for my home network, I've got it running Version 8.0(4)28 and Device manager version 6.1(3) which I think are the latest that it will support with its 64Ram/16Flash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network is configured as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP gateway is 192.168.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the outside as 192.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the dmz as 172.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the inside as 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the problem i'm having is from the inside I cant do DNS lookkups.  I can get to external hosts.  I can ping 8.8.8.8 however dns doesn't work,  nslookups to the same address time out. (commands work from the outside network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when I do a show service-policy&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Global policy:&#xA;  Service-policy: global_policy&#xA;    Class-map: inspection_default&#xA;      Inspect: dns preset_dns_map, packet 135, drop 0, reset-drop 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It doesn't show any drops, though I'm not sure that's relevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is the full configuration:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PIX Version 8.0(4)28&#xA;!&#xA;hostname pix515e&#xA;domain-name MyDomain.com&#xA;enable password fTSmleTIquYwO4vv encrypted&#xA;passwd 2KFNnbNIdI.4KYOU encrypted&#xA;names&#xA;!&#xA;interface Ethernet0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 192.168.0.2 255.255.255.0&#xA;!&#xA;interface Ethernet1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.0.0.1 255.0.0.0&#xA;!&#xA;interface Ethernet2&#xA; nameif dmz&#xA; security-level 50&#xA; ip address 172.16.0.1 255.255.0.0&#xA;!&#xA;ftp mode passive&#xA;dns server-group DefaultDNS&#xA; domain-name MyDomain.com&#xA;access-list outside-in-acl remark Allow ICMP Type 11 for Windows tracert&#xA;access-list outside-in-acl extended permit icmp any any time-exceeded&#xA;access-list 101 extended permit icmp any any echo-reply&#xA;access-list 101 extended permit icmp any any source-quench&#xA;access-list 101 extended permit icmp any any unreachable&#xA;access-list 101 extended permit icmp any any time-exceeded&#xA;access-list 101 extended permit icmp any any echo&#xA;pager lines 24&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;mtu dmz 1500&#xA;icmp unreachable rate-limit 10 burst-size 5&#xA;asdm image flash:/asdm-613.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;access-group 101 in interface inside&#xA;access-group 101 in interface outside&#xA;access-group 101 in interface dmz&#xA;route outside 0.0.0.0 0.0.0.0 192.168.0.1 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;http server enable&#xA;http 10.0.0.11 255.255.255.255 inside&#xA;http 0.0.0.0 0.0.0.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect netbios&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect skinny&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect sunrpc&#xA;  inspect tftp&#xA;  inspect sip&#xA;  inspect xdmcp&#xA;  inspect icmp&#xA; class class-default&#xA;  set connection decrement-ttl&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;Cryptochecksum:1ddc4bf11598117083299f0bfb98004d&#xA;pix515e(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I haven't messed around with a PIX in years, so I've ive made other errors besides the dns configuration please point them out :)&lt;/p&gt;&#xA;" OwnerUserId="6063" LastActivityDate="2014-06-12T16:56:09.493" Title="DNS/domain not working on cisco pix 515e" Tags="|cisco-asa|dns|pix|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9348" PostTypeId="2" ParentId="9347" CreationDate="2014-06-12T05:47:22.927" Score="-1" Body="&lt;pre&gt;&lt;code&gt;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum 512&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's a very stupid default on Cisco's part, and has long been the source of many headaches. I'd strongly recommend removing that policy. (the instant a query/answer exceeds 512 bytes, you'll wish you did.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map global_policy&#xA; class inspection_default&#xA;  no inspect dns preset_dns_map&#xA;no policy-map type inspect dns preset_dns_map&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(that's the equiv of &lt;code&gt;no fixup dns&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-06-12T14:50:10.183" LastActivityDate="2014-06-12T14:50:10.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9350" PostTypeId="2" ParentId="9337" CreationDate="2014-06-12T11:18:42.360" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But what confuses me is, doesn't the L2 rewrite happen on egress line card/interface?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not really, the forward / drop decision, L2 adjacency lookup, decrement TTL, IP Checksum calculation, etc... all happen on the &lt;em&gt;ingress&lt;/em&gt; linecard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conceptually, you can break the information flow into a control-plane and data plane, even within the router chassis.  It seems that most of your confusion revolves around how the control plane works... this is a quick diagram I hacked up to illustrate...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/uMVPg.png&quot; alt=&quot;IPC and CEF&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The Route Processor builds the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/12000-series-routers/47321-ciscoef.html&quot; rel=&quot;noreferrer&quot;&gt;CEF table&lt;/a&gt; from layer-2 adjacency information (including ethernet, ppp, sonet, etc...) as well as all preferred routes&lt;/li&gt;&#xA;&lt;li&gt;The entire CEF and adjacency table information is packed into IPC messages, which are sent between the Route Processor and all linecards.  Individual CEF entries are rendered as XDRs within the IPC message.  An XDR is just a Cisco-specific way of writing CEF entries into an IPC message.&lt;/li&gt;&#xA;&lt;li&gt;Individual linecards unpack the XDRs from the IPC messages and build (what should be) an exact copy of the Route Processor's CEF and adjacency table on the linecard.&lt;/li&gt;&#xA;&lt;li&gt;After the linecard completes revisions to the CEF and adjacency tables, a platform-specific process runs on the linecard to compute the data structures required for the platform's hardware to forward and rewrite packets on the linecard itself.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Synchronized IPC is pretty critical to dCEF's operation; if you don't keep messages synchronized between all linecards, you can wind up with &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/express-forwarding-cef/14540-cefincon.html&quot; rel=&quot;noreferrer&quot;&gt;prefix inconsistencies&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mechanics of how the router does this is platform-specific, so I'll reference the platform I know best which is Catalyst 6500 with Supervisor720 / Supervisor2T.  The forwarding &amp;amp; rewrite engine on a Catalyst 6500 dCEF linecard is actually a miniature copy of the Supervisor itself; so the whole IP forwarding and switching process executes just like it does as if the packet was centrally forwarded on the supervisor.  The ingress dCEF linecard looks up the required information in the CAM / CEF table, and then builds a header which it attaches to the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The egress linecard looks at the header and uses the adjacency information inside it to write the packet onto the wire.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why this adjacency table is stored on ingress? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So you can make the entire forwarding decision on ingress.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If this is on ingress, are the L2 rewrite information carried over from ingress card to egress line card?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Wouldn't that be a waste of fabric bandwidth?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't think so, but then again I could be biased :-)&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-06-12T11:18:42.360" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9351" PostTypeId="1" CreationDate="2014-06-12T12:45:26.077" Score="3" ViewCount="787" Body="&lt;p&gt;I intend to perform a Firewall Benchmark. I have reviewed related research papers and RFCs to create a suitable methodology. I have also examined open-source tools useful for the project (iperf, netperf, hping, tcpreply etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many sources, such as RFC3511, recommend to use the maximum number of concurrent TCP connection, as one of the metrics. I was wondering if anybody knows how to obtain the metrics? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks, Luke&lt;/p&gt;&#xA;" OwnerUserId="6066" LastEditorUserId="3191" LastEditDate="2014-09-08T09:52:36.697" LastActivityDate="2014-09-08T09:52:36.697" Title="Firewall Benchmark- Concurrent connection metrics" Tags="|firewall|testing|performance|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9352" PostTypeId="1" AcceptedAnswerId="9354" CreationDate="2014-06-12T14:55:03.177" Score="3" ViewCount="403" Body="&lt;p&gt;We use static NAT for servers in a LAN. But using dynamic NAT doesn't have any effect, then why is it a standard? Is it because of the overhead faced by the server, to map each connection/request to it's local ip and vice-versa. Please help.&lt;/p&gt;&#xA;" OwnerUserId="6070" LastEditorUserId="775" LastEditDate="2014-12-08T12:56:52.413" LastActivityDate="2014-12-08T12:56:52.413" Title="Why can't you use dynamic nat on server?" Tags="|nat|ip|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9354" PostTypeId="2" ParentId="9352" CreationDate="2014-06-12T15:17:25.553" Score="7" Body="&lt;p&gt;I think you're confused about the usual uses of static- and dynamic NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Static&lt;/strong&gt; is used on the outside router/firewall to expose a server/service located inward which wouldn't normally be reachable from the outside. (static: nailed in place, permanently mapped inward.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dynamic&lt;/strong&gt; is used to enable inward transportation of return traffic for outgoing connections; so a web browser on a system with a private IP is dynamically mapped to a public address as the packets egress, and then the return traffic is mapped back for ingress. (dynamic: the inside end points change so the mappings are changing too.)&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2014-06-12T15:17:25.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9355" PostTypeId="2" ParentId="9347" CreationDate="2014-06-12T16:56:09.493" Score="1" Body="&lt;p&gt;Promoting my comment to an answer so the Community user won't perpetually bump the question.  Please configure acl 101 to permit dns.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-06-12T16:56:09.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9356" PostTypeId="1" AcceptedAnswerId="9357" CreationDate="2014-06-12T17:17:57.203" Score="6" ViewCount="2315" Body="&lt;p&gt;I'm in an A+ course and was just working on wiring Ethernet cables. I was wondering, will an Ethernet cable function if the wires are reversed? Say instead of wiring 568B like striped orange, orange, striped green, blue, striped blue, green, striped brown, brown. Would it be possible for them to work when they're wired brown, striped brown, green, striped blue, and so on?&lt;/p&gt;&#xA;" OwnerUserId="6071" LastEditorUserId="8499" LastEditDate="2018-03-21T00:14:38.997" LastActivityDate="2018-03-21T00:14:38.997" Title="Ethernet Cable Orientation" Tags="|ethernet|layer1|cable|cabling|utp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9357" PostTypeId="2" ParentId="9356" CreationDate="2014-06-12T17:29:30.457" Score="16" Body="&lt;p&gt;When you use TIA/EIA-568B on both sides this is a straight through cable.  The colors of the inner jackets don't &lt;em&gt;really&lt;/em&gt; matter, much the same as it makes no difference to the operation of the network if you use a network cable with a black or yellow outer jacket.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the standard is in place for a real reason, and that is that the cabling system should be implemented in a standard way so that anyone who works on it will intuitively understand what they are working on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, imagine if someone used your reversed wiring in a real environment, left, and you were now troubleshooting a cabling issue at that site.  On inspection, you determine the cable is damaged and it need to be re-terminated on one side and did so with the standard TIA/EIA-568B.  After doing so, the cable still will not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It isn't because your termination is bad, but because the cable is now a rolled cable.  You may waste additional time/resources on trying to re-terminate the cable additional times.  Unless you use a cable tester, you may not easily figure out that the cable is now a rolled cabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, this potentially causes more problems/downtime and isn't really justifiable by any possible reason the original person may have had to not follow the standard.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Old answer (thinking the OP was talking about using TIA/EIA-568B on one side and the reverse on the other):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are describing is what is often referred to as a &quot;rolled&quot; or &quot;rollover&quot; cable.  Pin 1 connects to pin 8 on the other side, pin 2 to pin 7, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This type of cable would not work for network communications, but is used by many vendors for serial communication, such as console port access.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-06-12T17:59:30.253" LastActivityDate="2014-06-12T17:59:30.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9358" PostTypeId="2" ParentId="9356" CreationDate="2014-06-12T18:22:13.960" Score="5" Body="&lt;p&gt;Simply addressing the connectivity of Ethernet cable, for short one as long as you use the same pairs at the same position it's OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For longer ones, you &lt;em&gt;might&lt;/em&gt; have some crosstalk issue if you do it &quot;however you want as long as it's the same pairs at both ends&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIA/EIA-568A &amp;amp; B are only conventions to help everyone work together with less headache, there are no UTP-Police that will check your setup.  Sure, they're supposed to be optimized (alternating signal/ground strands in the connector, centering Pair 1 to be able to use it for telephony if needs be, etc) but it's not like each pairs will refuse a signal if it's not at the right position in the connector. Also, if you follow the standard, it's quite easy to differentiate Straight/Roll-Over/Cross-Over cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's the same thing as the Jacket color (In UTP structured cabling. Fiber jacket color actually &lt;em&gt;means&lt;/em&gt; something).  Even if the cables are Blue, Red, White or Black, they're still an Ethernet Cable (barring rolled-over or crossed-over ones), meaning you can use whichever colors you like, but it's still a good idea to be able to see their function by using different colors (as long as you stick to it!)&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-06-12T18:22:13.960" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9360" PostTypeId="1" CreationDate="2014-06-12T19:39:23.877" Score="1" ViewCount="113" Body="&lt;p&gt;I'm not sure why this is happening, but I have a Cisco ASA peering with a Forigate to create  VPN Site-to-Site Tunnel. The odd thing is I see this in ASDM, the Cisco ASA is creating two(2) identical tunnel IDs? Furthermore, bringing up the Tunnel will only work if a host on the Cisco ASA network initiates a connection through the Tunnel, not the other way around.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/vmsiZ.png&quot; alt=&quot;Cisco ASDM Identical Tunnel IDs?&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Basic Info is 2 networks with ACLs allowing ICMP and IP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cisco ASA hosts -- 10.10.0.0/255.255.224.0&lt;/li&gt;&#xA;&lt;li&gt;Forigate hosts -- 10.255.255.0/255.255.255.0&lt;/li&gt;&#xA;&lt;li&gt;Phase 1 and Phase 2 show complete on both Cisco ASA and Fortigate.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Has anyone come accross this before with the identical Tunnel IDs?&lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2014-06-12T19:51:38.570" Title="Cisco ASA creating two identicial Tunnel IDs?" Tags="|cisco-asa|tunnel|fortigate|fortinet|l2vpn|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9362" PostTypeId="2" ParentId="9360" CreationDate="2014-06-12T19:51:38.570" Score="2" Body="&lt;p&gt;For starters, they aren't identical: 1718.1, 1718.2, 1718.3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will be one security association (&quot;tunnel&quot;) per ACL rule.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-12T19:51:38.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9363" PostTypeId="1" AcceptedAnswerId="9376" CreationDate="2014-06-12T19:55:50.217" Score="2" ViewCount="646" Body="&lt;p&gt;I have some ME3800's running 15.3(3)S which aggregate layer 2 circuits from customers. They all have a similar configuration of an incoming trunk on Gi0/1 and then Gi0/23 &amp;amp; Gi0/24 are layer 3 p-t-p links to neighbouring ME3x00 switches;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gi0/23--SW1---gi0/23     gi0/24---SW2---gi0/23     gi0/24---SW3---gi0/23     &#xA;         |                         |                         |&#xA;         |                         |                         |&#xA;       gi0/1                    gi0/1                      gi0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to apply some QoS on this network. I can apply my policies to the L3 interfacings linking the switches together but I can't apply the same QoS policy to the L2 trunks.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#show run int gi0/1&#xA;Building configuration...&#xA;&#xA;Current configuration : 93 bytes&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description ****ACCESS-UPLINK****&#xA; switchport mode trunk&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason is because the QoS policies are written for layer 3 interfaces, when I try to apply them to this trunk interface I get the following error;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1(config-if)#service-policy input PE-QOS-OUT &#xA;QoS: Configuration failed. 'match qos-group' not allowed in an input policy-map&#xA;QoS: Configuration failed. 'match qos-group' not allowed in an input policy-map&#xA;QoS: Configuration errors for policymap PE-QOS-OUT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am wondering how I can write a policy for layer 2 trunk interfaces; I could apply the layer 3 policy map to each SVI on this switch that terminates each VLAN being trunked up but surely the QoS policy on an SVI doesn't look at the ingress/egress interface of a frame and examine the congestion for that interface? How coule the SVI policy manage the layer 2 turnk?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Short question:&lt;/strong&gt;&#xA;To QoS a layer 2 interface is the only (best?) way to break it down into service instances?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Long question:&lt;/strong&gt;&#xA;Would I have to convert those interfaces to use service instances and then add a service instance for each VLAN being trunked in; Then I could apply a parent policy to the interface which has various classes defined, each class matches one of the VLANs/service instances being trunked in and then apply the same child policy to each VLAN/service instace which would be the layer 3 one I originally tied to apply?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A snippest of the layer 3 policy I am using;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any NC&#xA; match mpls experimental topmost 6&#xA; match mpls experimental topmost 7&#xA; match dscp cs6&#xA; match dscp cs7&#xA; match cos 6&#xA; match cos 7&#xA;class-map match-any REALTIME&#xA; match mpls experimental topmost 5&#xA; match dscp ef&#xA; match dscp cs5&#xA; match cos 5&#xA;&#xA;class-map match-any NC-QG&#xA; match qos-group 6&#xA; match dscp cs6&#xA; match dscp cs7&#xA;class-map match-any REALTIME-QG&#xA; match qos-group 5&#xA;&#xA;policy-map PE-QOS-IN&#xA; class NC&#xA;  set qos-group 6&#xA; class REALTIME&#xA;  set qos-group 5&#xA;&#xA;policy-map PE-QOS-OUT&#xA; class NC-QG&#xA;  bandwidth percent 2&#xA;  queue-limit 1024000 bytes&#xA; class REALTIME-QG&#xA;  police cir percent 10&#xA;   conform-action transmit&#xA;   exceed-action drop&#xA;  priority&#xA;  queue-limit 1024000 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="253" LastEditorUserId="8499" LastEditDate="2018-03-21T01:03:28.750" LastActivityDate="2018-03-21T01:03:28.750" Title="Cisco ME3x00 - QoS for layer 2 trunks" Tags="|cisco|switch|layer2|qos|trunk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9364" PostTypeId="2" ParentId="9339" CreationDate="2014-06-12T20:04:39.623" Score="1" Body="&lt;p&gt;Answer: It isn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The closest we can get to this is that many providers use GPS for NTP stratum 1 sources. Since many providers are moving to VoIP we do emulate TDM circuts over IP to interconnect with the PSTN and comply with standards, and codecs rely on this. Everyone is keeping their own time though, if you understand my meaning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have worked with various networks that have poor time keeping; Due to humans being lazy and prone to mistakes the concept of the telephone network being isochronous is in fact almost imposible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have encountered on several occasions other SIP carriers when tourbleshooting issues between us they are running packet captures are specific times of day and missing the VoIP traffic we want to capture and test or measure because their clocks on their gateways aren't accurate!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe this was true 50 years ago (although I failt to see how?) but it certainly is not true today, especially with the rise of VoIP where everyone has their own timing mechanisms (I'm thinking NTP sources as I write that).&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2014-06-12T20:04:39.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9365" PostTypeId="2" ParentId="8286" CreationDate="2014-06-12T22:58:32.280" Score="9" Body="&lt;p&gt;It looks like, &quot;No&quot;.  There's nothing specific in TACACS+ to transport a certificate exchange, however an ASCII data payload &lt;em&gt;could&lt;/em&gt; suffice. (the RFC is a decade old) The real question is if ACS has any method to handle it? And that also appears to be &quot;no&quot;. The only mention I can find to PKI or certificate based authentication is for EAP-TLS, which is not what you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a single reference in &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-2/security/configuration/guide/b_syssec_cg42crs/b_syssec_cg42crs_chapter_01001.html#con_1095059&quot; rel=&quot;noreferrer&quot;&gt;IOS-XR documents&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt; The preferred method of authentication would be as stated in the SSH RFC. The RSA based authentication support is only for local authentication, and not for TACACS/RADIUS servers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-06-19T06:36:31.697" LastActivityDate="2014-06-19T06:36:31.697" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9367" PostTypeId="1" AcceptedAnswerId="9370" CreationDate="2014-06-13T08:44:25.203" Score="5" ViewCount="4239" Body="&lt;p&gt;What would be the correct way to force a client on an access port to use a dynamically assigned IP address ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, using the Cisco access layer switch, I would like to prevent the client's ability to set up a static IP address + gateway and bypass the DHCP completely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible using features such as DHCP Snooping ?&lt;/p&gt;&#xA;" OwnerUserId="3484" LastEditorUserId="8499" LastEditDate="2019-12-26T20:36:18.493" LastActivityDate="2019-12-26T20:36:18.493" Title="How to force the use of a DHCP-issued IP on Cisco switch" Tags="|cisco|switch|dhcp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9368" PostTypeId="1" AcceptedAnswerId="9377" CreationDate="2014-06-13T10:54:58.810" Score="0" ViewCount="1850" Body="&lt;p&gt;Networking is definitely not my strong point and I have a tendency to waffle on so forgive me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am trying to establish is what effect the host and router wireless adapter have on your internet speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently went to a location where the internet speed was reaching 50Mbps download and 50Mbps upload (via ethernet) as according to ookla speedtest.net. When disconnecting from the Ethernet and using wireless (2m from the router) on my laptop (Wireless Adapter 150Mbps) I receive the same speed give or take a few Mb. However, on my iPhone 4s I received say 34Mbps download from speedtest.net. On another mobile they were receiving 15Mbps, I am not 100% of the make of this phone, but needless to say it was no iphone or samsung galaxy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please can someone confirm whether the speed of the adapter on the host and on the router impact on the speed received and if so how would I calculate the likely speed.&lt;/p&gt;&#xA;" OwnerUserId="6081" LastEditorUserId="775" LastEditDate="2014-12-08T12:56:15.637" LastActivityDate="2014-12-08T12:56:15.637" Title="Wireless Adapter Speed effect on Internet Speed" Tags="|router|internet|speed|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9369" PostTypeId="2" ParentId="9367" CreationDate="2014-06-13T11:10:24.813" Score="1" Body="&lt;p&gt;I don't think that this is possible. At least not using a switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only way I see to solve the problem: Only allow device on your network that are under your control. So no admin privileges for users, no bring your own devices, ... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using something like 802.1x might help to enforce the policy. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-06-13T11:10:24.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9370" PostTypeId="2" ParentId="9367" CreationDate="2014-06-13T11:26:40.993" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What would be the correct way to force a client on an access port to&#xA;  use a dynamically assigned IP address ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can't &quot;impose&quot; an IP configuration mode to an host from the switch (or any other device). You can prevent the communication between the host if he doesn't have an IP from the DHCP server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;In other words, using the Cisco access layer switch, I would like to prevent the client's ability to set up a static IP address + gateway and bypass the DHCP completely.&#xA;Is this possible using features such as DHCP Snooping ?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need is the feature &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swdhcp82.html#wp1328394&quot; rel=&quot;noreferrer&quot;&gt;IP Source Guard&lt;/a&gt;, which uses the DHCP Snooping binding database to determine the legitimacy of source IP addresses. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This feature is enabled on a DHCP snooping untrusted Layer 2 port.&#xA;  Initially, all IP traffic on the port is blocked except for DHCP&#xA;  packets that are captured by the DHCP snooping process. When a client&#xA;  receives a valid IP address from the DHCP server, or when a static IP&#xA;  source binding is configured by the user, a per-port and VLAN Access&#xA;  Control List (PVACL) is installed on the port. This process restricts&#xA;  the client IP traffic to those source IP addresses configured in the&#xA;  binding; any IP traffic with a source IP address other than that in&#xA;  the IP source binding is filtered out.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;https://books.google.com/books?id=x33i7TwBhHQC&amp;amp;lpg=PA533&amp;amp;ots=Te5m9JK4xY&amp;amp;dq=blocked%20except%20for%20DHCP%20packets%20that%20are%20captured&amp;amp;pg=PA533#v=onepage&amp;amp;q&amp;amp;f=false&quot; rel=&quot;noreferrer&quot;&gt;&quot;Chapter 14 - Switch Security&quot; In &lt;em&gt;Cisco Network Professional's Advanced Internetworking Guide (CCNP Series)&lt;/em&gt;, 533 - 534.&lt;/a&gt;&#xA;&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="3191" LastEditDate="2015-07-11T19:50:33.520" LastActivityDate="2015-07-11T19:50:33.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9373" PostTypeId="1" AcceptedAnswerId="9403" CreationDate="2014-06-13T12:28:46.633" Score="7" ViewCount="685" Body="&lt;p&gt;If a device has a dhcp pool defined:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool DATA&#xA;  network 192.0.2.0 255.255.255.0&#xA;  default-router 192.0.2.1&#xA;  domain-name test.net&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it also has a DHCP helper setup on the interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA;  ip address 192.0.2.1 255.255.255.0&#xA;  ip helper-address 198.51.100.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then what is the result? Is the DHCP addresses given from the helper? or from the local pool?&lt;/p&gt;&#xA;" OwnerUserId="3071" LastActivityDate="2014-06-15T08:02:03.817" Title="What behavior results from both ip dhcp pool and ip helper-address?" Tags="|cisco|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9375" PostTypeId="1" AcceptedAnswerId="9402" CreationDate="2014-06-13T14:27:59.067" Score="0" ViewCount="1354" Body="&lt;p&gt;I have a question regarding if a switch or router is the way to go in my situation. We have a modem through Comcast that only has one available port on it right now and we are getting a VOIP system through RingCentral. We are receiving 5 phones that support PoE, most routers I am finding either don't support PoE or they only have 4 ports on them. Can I plug the Switch into the open port on the Modem and have all of them work like they should?&lt;/p&gt;&#xA;" OwnerUserId="5701" LastActivityDate="2014-06-15T07:27:11.217" Title="Use a Switch or Router for PoE on VOIP system" Tags="|router|switch|voip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9376" PostTypeId="2" ParentId="9363" CreationDate="2014-06-13T14:52:08.427" Score="2" Body="&lt;p&gt;It seems I knew the answer to my own question already essentially;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To aggregate layer 2 links and QoS them I must define the service insances to match each VLAN (rather than one VLAN per cusomer the same set of VLANs are being trunked down to all customers so they all fall under one class-map);&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any tripple-play&#xA; match service instance ethernet  10&#xA; match service instance ethernet  20&#xA; match service instance ethernet  30&#xA;&#xA;&#xA;policy-map PE-QOS-CPE-OUT-PARENT&#xA; class tripple-play&#xA; service-policy PE-QOS-CPE-OUT&#xA;&#xA;&#xA;&#xA;interface gi0/1&#xA; switchport trunk allowed vlan none&#xA; switchport mode trunk&#xA; service-policy input PE-QOS-CPE-IN&#xA; service-policy output PE-QOS-CPE-OUT-PARENT&#xA;&#xA; service instance 10 ethernet&#xA;   description voice&#xA;   encapsulation dot1q 10&#xA;   rewrite ingress tag pop 1 symmetric&#xA;   bridge-domain 10&#xA;&#xA; service instance 20 ethernet&#xA;   description video&#xA;   encapsulation dot1q 20&#xA;   rewrite ingress tag pop 1 symmetric&#xA;   bridge-domain 20&#xA;&#xA; service instance 30 ethernet&#xA;   description data&#xA;   encapsulation dot1q 30&#xA;   rewrite ingress tag pop 1 symmetric&#xA;   bridge-domain 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="253" LastActivityDate="2014-06-13T14:52:08.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9377" PostTypeId="2" ParentId="9368" CreationDate="2014-06-13T15:16:30.570" Score="3" Body="&lt;p&gt;Your question seems to break up into two parts, which I will restate in my own words and answer.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does the speed of the wireless adapter on the client and access point impact the actual throughput?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, this is most certainly a major factor.  A 802.11n 3x3:3 dual band adapter and access point will have far better throughput than an 802.11n 1x1:1 single band adapter.  In this specific example, you may be looking at over six times the throughput (factoring in the spatial streams, guard interval and bonded channels in 5GHz only).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How would I calculate the expected throughput?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is much more difficult as there are a large number of factors that will impact the performance.  Here is a non-exhaustive list to consider apart from the speed of client/access point:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Signal strength between access point and client (impacted by distance, obstructions, etc)&lt;/li&gt;&#xA;&lt;li&gt;Sources of interference&lt;/li&gt;&#xA;&lt;li&gt;Number of clients on the wireless network&lt;/li&gt;&#xA;&lt;li&gt;Amount and types of traffic being carried by the wireless network&lt;/li&gt;&#xA;&lt;li&gt;Capabilities of the access point (airtime fairness features, etc)&lt;/li&gt;&#xA;&lt;li&gt;Security features of the access point (rogue detection, etc)&lt;/li&gt;&#xA;&lt;li&gt;Number of BSSIDs (aka SSIDs, WLANs or wireless networks) being broadcast by the access point&lt;/li&gt;&#xA;&lt;li&gt;Number of other wireless networks in the area&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-06-13T15:16:30.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9378" PostTypeId="1" AcceptedAnswerId="9391" CreationDate="2014-06-13T15:24:18.887" Score="2" ViewCount="1305" Body="&lt;p&gt;I have a Cisco 1941 Router that has just two ports for Gigabit connection but wanted more so I got a four port Cisco EH-WIC Card and connected it to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been trying to assign IP address to the port GigabitEtnernet 0/0/0 because I have a cable already connected to it whose device I want it facing the router directly because I dont want to NAT its address. I want to assign the physical address on the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kinldy help if you understand what I am saying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="3869" LastActivityDate="2014-06-14T08:14:24.783" Title="Configuring an EH-WIC Card on Cisco 1941 Router" Tags="|cisco|router|cisco-ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9381" PostTypeId="1" AcceptedAnswerId="12745" CreationDate="2014-06-13T17:56:04.903" Score="11" ViewCount="3596" Body="&lt;p&gt;I'm in the process of over-hauling our network, the issue I keep coming back to is: trying to bring layer 3 to the core, while still having a centralised firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main issue I have here is that the &quot;mini core&quot; switches I've been looking at always have low in-hardware ACL limits, which even at our current size we could quickly hit. I'm currently about to (hopefully) purchase a pair of EX4300-32Fs for the core, but I've looked at other models, and other options from Juniper and Brocade's ICX range. They all seem to have the same low ACL limits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes perfect sense as the core switches need to be able to maintain the wire-speed routing, so don't want to sacrifice too much through ACL processing. So I can't do all my firewalling on the core switches themselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, we do mostly fully managed servers, and having a centralised (stateful) firewall helps a lot with that management - as we can't have customers talking directly to each other. I'd like to keep it that way if we can, but I feel as though most ISP networks would not do this kind of thing, hence why in most cases it would be straight-forward to do the routing in the core.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, here is the topology I would ideally like to do (but not sure where to fit the FW obviously).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mRfCr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mRfCr.jpg&quot; alt=&quot;network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Curent Solution&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Right now, we have a router-on-a-stick configuration. This enables us to do NAT, stateful firewalling and VLAN routing all in the one spot. Very simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could continue on with (roughly) the same solution by extending L2 all the way to the &quot;top&quot; of our network - the border routers. But then I lose all the benefits of the wire-speed routing that the core can offer me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IIRC the core switches can do 464 Gbps of routing while my border routers will be able to offer maybe 10 or 20 Gbps if I'm lucky. This isn't technically a problem right now, but more an issue of growth. I feel as though if we don't design the architecture to leverage core routing capacity now, it's going to be painful to redo everything when we're larger and need to leverage that capacity. I'd rather get it right the first time.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Possible Solutions&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;Layer 3 to Access&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I thought that perhaps I could extend L3 to the access switches, and thus break up the firewall rules into smaller segments that would then fit on the hardware limits of the access switch ACLs. But:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;As far as I know, these would not be stateful ACLs&lt;/li&gt;&#xA;&lt;li&gt;L3 to Access, to me, seems much more inflexible. Server moves or VM migrations to other cabinets would be more painful.&lt;/li&gt;&#xA;&lt;li&gt;If I'm going to be managing a firewall at the top of each rack (only six of them), I probably want automation anyway. So at that point it's not much of a leap to automate management of firewalls at the host level. Thus avoiding the entire issue.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Bridged/transparent firewalls on each uplink between access/core&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This would have to involve multiple firewall boxes, and significantly increase the required hardware. And could end up more expensive than buying larger core routers, even using plain old Linux boxes as firewalls.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Giant core routers&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Could buy a larger device that can do the firewalling I need and has a much larger routing capacity. But really don't have the budget for it, and if I'm trying to make a device do something it's not designed for, I'll probably have to go to a much higher spec. than I would otherwise.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;No Centralised firewall&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Since I'm jumping through hoops, maybe this isn't worth the effort. It's always been a nice thing to have, and at times a selling point for customers who want a &quot;hardware&quot; firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it seems that having a centralised firewall for your &quot;entire&quot; network is infeasible. I'm wondering, then, how larger ISPs can offer hardware firewall solutions to customers with dedicated servers, when they have hundreds or even thousands of hosts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone think of a way of solving this issue? Either something I've missed entirely, or a variation on one of the ideas above?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 2014-06-16:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on @Ron's suggestion, I stumbled on this article which explains pretty well the issue I'm facing, and a good way to solve the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless there's other suggestions, I would say this now is a product recommendation type of problem, so I suppose that's the end of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://it20.info/2011/03/the-93-000-firewall-rules-problem-and-why-cloud-is-not-just-orchestration/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://it20.info/2011/03/the-93-000-firewall-rules-problem-and-why-cloud-is-not-just-orchestration/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="846" LastEditorUserId="846" LastEditDate="2014-06-19T15:03:19.647" LastActivityDate="2014-10-30T12:14:14.030" Title="Trying to fit centralised firewall into network topology" Tags="|routing|firewall|design|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="9382" PostTypeId="1" CreationDate="2014-06-13T18:21:19.873" Score="3" ViewCount="8413" Body="&lt;p&gt;I am having a bit of a brain freeze. I would like to know the command that displays the link status when a network cable is unplugged from the switch port. What is the command name?&lt;/p&gt;&#xA;" OwnerUserId="6086" LastEditorUserId="3191" LastEditDate="2014-06-14T11:45:10.613" LastActivityDate="2014-06-14T11:45:10.613" Title="Cisco Command to display link status" Tags="|cisco|switch|cisco-ios|cli|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9385" PostTypeId="2" ParentId="9382" CreationDate="2014-06-13T18:46:09.270" Score="4" Body="&lt;p&gt;&lt;strong&gt;sho ip int brief&lt;/strong&gt; will give you a list of all the interfaces and their status as well as protocol. It will not show you if a cable is &quot;unplugged&quot; but will tell you if something is plugged into the interface and sending frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sho int&lt;/strong&gt; Will allow you to see if an interface is UP and whether or not protocol is also UP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are just looking to monitor status changes on the terminal, &lt;strong&gt;term monitor&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2014-06-13T18:46:09.270" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9387" PostTypeId="1" AcceptedAnswerId="9390" CreationDate="2014-06-13T23:34:51.813" Score="10" ViewCount="1421" Body="&lt;p&gt;Today I read that &lt;a href=&quot;http://redmondmag.com/articles/2014/06/12/ipv4-address-shortage.aspx&quot;&gt;Microsoft has no more IPv4 addresses for its Azure cloud&lt;/a&gt;. Earlier this week I read that &lt;a href=&quot;http://www.theregister.co.uk/2014/06/11/ipv4_addresses_depleted_in_latin_america_and_the_caribbean/&quot;&gt;Latin America is out of IPv4 addresses&lt;/a&gt; as well. These are real - not predicted - IPv4 address shortages. I remember we had IPv6 day two years ago, but since then I haven't heard much about IPv6 in the news. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have a good understanding of what the change to IPv6 really means, and where we can expect problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Current situation&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I guess all modern operating systems are IPv6 ready: OSX, Windows, Linux, Android, iOS (no problem to be expected for most people).&lt;/li&gt;&#xA;&lt;li&gt;Internet providers: your connection to the internet, whether it's mobile or via cable or ADSL (my provider says it's completely IPv6 ready, but it's the only one this far in my country).&lt;/li&gt;&#xA;&lt;li&gt;Routers/modems may be a problem (and as my provider says it's completely IPv6 ready, I suppose the router works too).&lt;/li&gt;&#xA;&lt;li&gt;Hosting: I use a hosting provider for some websites that is not IPv6 ready. They promise to have this working this year. I guess many providers haven't got this working yet.&lt;/li&gt;&#xA;&lt;li&gt;Home devices: digital tv recorders, tv with wifi, thermostats, wireless loudspeakers etc - I have no idea if they are IPv6 ready.&lt;/li&gt;&#xA;&lt;li&gt;The internet at large: big websites like Google, Facebook - I guess they have this working.&lt;/li&gt;&#xA;&lt;li&gt;Internet exchanges like AIX - this should work.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Some questions&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Home network: if my router is IPv6 ready, will it translate to IPv4 for devices that don't understand IPv6?&lt;/li&gt;&#xA;&lt;li&gt;Can these home devices still use IPv4 when the rest of the home network is IPv4?&lt;/li&gt;&#xA;&lt;li&gt;For sites that are still IPv4 only, will my computer or router switch automatically?&lt;/li&gt;&#xA;&lt;li&gt;When I open whatismyip.com, I see an IPv4 address. I believe I can ask my provider to change to IPv6, but I guess that will disable large parts of the internet for me - will it? Can I still send mail, will DNS work?&lt;/li&gt;&#xA;&lt;li&gt;When my provider changes to IPv6, will I still have an IPv4 address?&lt;/li&gt;&#xA;&lt;li&gt;Does this have consequenses for TLS certificates?&lt;/li&gt;&#xA;&lt;li&gt;With IPv6 NAT is obsolete I understand. Will this mean my wifi enabled tv is directly accessible from the outside? I guess the router firewall is still working, but now we can use a direct address from the outside?&lt;/li&gt;&#xA;&lt;li&gt;I don't live in Latin America and don't use Azure. But what if I go to Brasil right now. Will I notice it?&lt;/li&gt;&#xA;&lt;li&gt;Is there an easy way to test what works and what not without messing up the home network?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;These are several situations and questions I can think of now. There are probably many more. What I want is a good picture of where we're standing now, and what we can expect to happen when this shortage becomes worldwide.&lt;/p&gt;&#xA;" OwnerUserId="5563" LastActivityDate="2022-12-09T16:15:07.320" Title="IPv4 shortage is now becoming a reality - what is needed for IPv6 to work?" Tags="|ipv4|ipv6|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9388" PostTypeId="2" ParentId="9387" CreationDate="2014-06-14T01:59:34.240" Score="4" Body="&lt;p&gt;To answer the fundamental question &quot;&lt;strong&gt;What is needed for IPv6 to work?&lt;/strong&gt;&quot;  Before anything else, you need an internet provider who can (and &lt;em&gt;does&lt;/em&gt;) provide IPv6 connectivity. In the US, that's still very much a bad joke on consumers -- esp. for &lt;em&gt;business&lt;/em&gt; ISPs. Then &lt;em&gt;your&lt;/em&gt; network has to support IPv6: router, computers, game consoles, etc. I am unaware of any &quot;home networking&quot; gear capable of &quot;NAT64&quot; -- a proxy between the two networks. In fact, many small business routers lack that capability.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-14T01:59:34.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9389" PostTypeId="1" AcceptedAnswerId="18361" CreationDate="2014-06-14T05:42:48.033" Score="7" ViewCount="14618" Body="&lt;p&gt;I'm working on a project where I need to make a network for all PCs in the site.&#xA;I need about 8 Ethernet sockets in each office of the site.&#xA;I found that there's already two Ethernet sockets in each office but they are connected to VoIP phones (Siemens openstage 15) .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I bought d-link switches (des 1008a) for each office and decided to expand the network inside each office by connecting one of the already existing sockets to the dlink switch and then connect the PCs and phones to the new switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem arose when I connected the VoIP phone to the dlink switch, it didn't boot up.&#xA;I discovered that the phone is powered through Power Over Ethernet and when connected to the normal non-PoE dlink switch it doesn't work even though the main cable entering to the DLink switch is coming from a POE switch. The phone works only when connected to the cable coming from the POE switch.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/tKQxk.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I searched for the power specs of this specific phone model (Siemens Openstage 15) I found these specs ..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/vqYNS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I solve this situation without expanding new cables from the main POE switch?&lt;/p&gt;&#xA;" OwnerUserId="6093" LastActivityDate="2017-05-15T08:25:25.467" Title="Connect a POE VoIP phone to a non-POE Switch" Tags="|voip|power-over-ethernet|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9390" PostTypeId="2" ParentId="9387" CreationDate="2014-06-14T08:07:26.930" Score="11" Body="&lt;p&gt;Answers to your questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;No, just because device supports IPv6 it doesn't mean it support IPv4&amp;lt;&gt;IPv6 transition mechanisms - they're not part of IPv6 protocol specification. So, it may support translating traffic from IPv4 to IPv6 and vice versa but it needs to support mechansism like NAT64.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Nodes communicate with the protocol of their choice, depending on the higher layer calls. If your browser points to a name, and the name resolves to IPv4 only, IPv4 will be called in to service it. If it resolves to both IPv6 and IPv4, IPv6 should take precedence, but a lot was done in recent years to make both calls simultaneusly and check which one is faster.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You need to have node that is dual-stacked, so supports both IPv4 and IPv6 or have support of translating between protocols somewhere along the way. If your router supports it - fine, if your ISP supports it - it's also fine.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You should see IPv6 as it should take precedence. If not, your IPv6 connectivity, at least to this specific site is broken. If you can use only IPv6 (you are not dual stacked) you can only reach around 4-5k prefixes around the internet, which is very small percent (out of 500k for IPv4). Normally, hosts are dual-stacked however, so you should be fine - using IPv6 for IPv6-enabled services, and IPv4 for all the rest.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;That depends on the type of the service your ISP provides. You may have private IPv4 assigned to your internet interface, and it gets translated somewhere at the ISP edge. You may have public IPv4.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For SSL/TLS you're using names, not IPs directly. You should be fine.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, while there are still works to provide NAT services for IPv6, general idea about IPv6 was to stop doing NAT, and provide global connectivity. It means that with IPv6 assignment, your entire internal network may be directly reachable from other parts of the internet, if you're using IPv6 addresses from the Global Unicast space. For IPv6 you can use other types, like for example Link Local only, which would provide internal connectivity, but block ability to access from remote locations. Generally, you should filter the traffic at the edge of your network if you don't want the internet to access your resources/nodes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Unfortunately, I don't understand the question. Cloud services are usually OK with IPv6, Amazon at least is.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Start from here: &lt;a href=&quot;http://test-ipv6.com/&quot;&gt;http://test-ipv6.com/&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-06-14T08:07:26.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9391" PostTypeId="2" ParentId="9378" CreationDate="2014-06-14T08:14:24.783" Score="3" Body="&lt;p&gt;That card doesn't provide routed IP interfaces - it is a switch. You can assign IPs to specific physical interfaces of this card by assigning the port to VLAN, and then defining IPs on the VLAN interface (also called SVI - Switched Virtual Interface).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's list of what you can do on normal, routed interfaces and on SVIs:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/1800-series-integrated-services-routers-isr/prod_white_paper0900aecd8064c9f4.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/routers/1800-series-integrated-services-routers-isr/prod_white_paper0900aecd8064c9f4.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you need to do something like that (assuming GE0/0/0 is the first port of the switch card):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int ge0/0/0&#xA; switchport mode access&#xA; switchport access vlan 100&#xA; no shut&#xA;&#xA;interface vlan 100&#xA; ip address 1.2.3.254 255.255.255.0&#xA; no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-06-14T08:14:24.783" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9393" PostTypeId="2" ParentId="9389" CreationDate="2014-06-14T08:59:03.843" Score="6" Body="&lt;p&gt;They need to be powered either by PoE or a power adapter. PoE is going to be either a PoE switch or an inline PoE injector. The PoE injector still requires a wall outlet like the power adapter will.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2014-06-14T08:59:03.843" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9396" PostTypeId="2" ParentId="9382" CreationDate="2014-06-14T11:26:40.570" Score="6" Body="&lt;p&gt;The easiest way on Cisco switches is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show int status&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will show you the link status for all ports &#xA;The 45xx line has also some additional useful commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show int link&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which will show you the last time the link was active.&#xA;Also you can use (it is disruptive for the port):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test cable-diagnostics tdr interface xx/yy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show cable-diagnostics tdr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will give you an approximation of the length of the attached cable&lt;/p&gt;&#xA;" OwnerUserId="5828" LastActivityDate="2014-06-14T11:26:40.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9398" PostTypeId="2" ParentId="9389" CreationDate="2014-06-14T18:38:19.933" Score="0" Body="&lt;p&gt;In place of a power over ethernet switch, you can use a device called a PoE injector. It plugs into a mains power outlet and energizes the ethernet cable like a PoE switch would. Alternatively, some phones also have the ability to use a separate power adapter. Either way, you'll need to plug something in to mains power. &lt;/p&gt;&#xA;" OwnerUserId="2063" LastActivityDate="2014-06-14T18:38:19.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9399" PostTypeId="1" CreationDate="2014-06-14T21:17:29.403" Score="2" ViewCount="3516" Body="&lt;p&gt;I'm refining a Juniper SRX 210 UTM IDP implementation in a small business. I'm new to Junos, so I'm hoping someone will be able to point me in the best-practices direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The customer initially reported that tests using things like Speakeasy bandwidth test shows OK download speeds, but the upload speeds are cut in half; With a 50mbps synchronous connection, they're getting 50mbps down, but only 25mbps up. I'm hazarding a guess that this is because the SRX is inspecting these traffic types in detail as they exit the device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SRX 210 data sheet says it is capable of 65mbps IPS performance, but I'm not seeing that. Additionally, the log displays the following messages whenever I run a &quot;speed test&quot;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PERF_MON: RTPERF_CPU_THRESHOLD_EXCEEDED: FPC 0 PIC 0 CPU utilization exceeds threshold, current value=97&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm guessing that the UTM package is somehow putting a strain on the SRX, but I don't know enough about the SRX platform to troubleshoot this properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suggestions appreciated.&lt;/p&gt;&#xA;" OwnerUserId="2912" LastEditorUserId="2912" LastEditDate="2014-06-14T21:48:23.467" LastActivityDate="2014-06-14T23:17:18.063" Title="Juniper SRX 210: Slow upload performance after enabling UTM IDP" Tags="|security|juniper-srx|intrusion-prevention|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9400" PostTypeId="2" ParentId="9399" CreationDate="2014-06-14T23:17:18.063" Score="3" Body="&lt;p&gt;Per a JNCIE who offered help: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This behavior is expected on branch-devices which lack dedicated&#xA;  processing for UTM and IDP functionality.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The fix is to granularly apply an IDP policy which applies only to traffic you care a lot about and judiciously choose your applied signatures based upon needs versus performance impact.&lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2014-06-14T23:17:18.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9402" PostTypeId="2" ParentId="9375" CreationDate="2014-06-15T07:27:11.217" Score="3" Body="&lt;p&gt;Switches are where you typically find PoE especially in enterprise-grade equipment.  &lt;strong&gt;You should have no issue extending your LAN with a switch on an available port on your cable modem, but you really should have a router/firewall function sitting between your LAN and the WAN from your modem to protect your network.&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can confirm that you are directly connecting your LAN to the modem by the presence of public IP addresses which is a good way to get hacked.  A firewall provides a baseline of protection that you seem to be lacking now.  Be aware that the firewall (on your router) will be providing a NAT function that doesn't always play nicely with SIP packets from your VoIP.  You may need a firewall capable of handling SIP properly or a VoIP system that can support STUN.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2014-06-15T07:27:11.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9403" PostTypeId="2" ParentId="9373" CreationDate="2014-06-15T08:02:03.817" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the DHCP addresses given from the helper? or from the local pool?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;You would get two possible DHCPOffer's from the device's internal DHCP pool and the DHCP server defined by the helper-address, but it's up to the client to decide which DHCPOffer to accept and to then unicast a DHCPRequest to the DHCP server of choice.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often clients choose the DHCP server with the fastest DHCPOffer.  Unless your device's CPU is bogged down, I would expect typical clients to select the DHCP pool more often than not.  You'd expect a little less latency in a L2 operation vs L3 which is required to get to the DHCP server via the helper-address.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2014-06-15T08:02:03.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9404" PostTypeId="1" CreationDate="2014-06-15T08:16:33.837" Score="9" ViewCount="5642" Body="&lt;p&gt;Does increasing the bandwidth on a link from, let's say, 1mb to 30mb reduce the RTT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found one answer saying no. Can someone please explain?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what are the best mechanisms to reduce RTT?&lt;/p&gt;&#xA;" OwnerUserId="5622" LastEditorUserId="34807" LastEditDate="2017-03-05T22:07:08.260" LastActivityDate="2017-03-05T22:52:47.780" Title="Can you reduce RTT by increasing the bandwidth on a link?" Tags="|protocol-theory|latency|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9405" PostTypeId="2" ParentId="9404" CreationDate="2014-06-15T09:09:59.293" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does increasing the bandwidth on a link from lets say 1mb to 30mb reduce the RTT?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, increasing the bandwidth does not reduce RTT strictly speaking. I say &quot;strictly speaking&quot; because it depends on what your are measuring!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenario 1: The physical layer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the following simple topology which is easy to follow, a copper Ethernet connection running at 1Mbps with an MTU of 1500 bytes between two devices with a 10 meter cable, this has the same RTT (the time it would take for an ICMP echo request packet to travel from device 1 to device 2 and the ICMP echo reply message to travel from device 2 back to device 1) as a 10/30/50/100mbps copper Ethernet connection between them with a 1500 byte MTU on the same 10 meter cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is because the &quot;delay&quot; of the signal down the copper cable is related to its &lt;a href=&quot;http://en.wikipedia.org/wiki/Dielectric&quot; rel=&quot;nofollow noreferrer&quot;&gt;dialectic constant&lt;/a&gt; (&lt;a href=&quot;http://en.wikipedia.org/wiki/Relative_permittivity&quot; rel=&quot;nofollow noreferrer&quot;&gt;relative permittivity&lt;/a&gt;). See those two Wikipedia pages for additional information on the physics which are out of scope here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially the &quot;flight time&quot; of the electrical signals down the copper cable is the same speed for a 10Mbps and a 1000Mbps connection when using the same length and grade Cat5e cable. The difference is that with a 10Mbps connection data is encoded on to the wire less frequently then a 100Mbps connection, so there are smaller gaps between the bits of data as they are placed on to the wire (this is called &lt;a href=&quot;https://serverfault.com/questions/438858/what-is-serialisation-delay-why-does-10gb-ethernet-help-reduce-it&quot;&gt;serialisation delay&lt;/a&gt;). These two wikipedia articles expand these concepts further: &lt;a href=&quot;http://en.wikipedia.org/wiki/Bit_time&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bit time&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Slot_time&quot; rel=&quot;nofollow noreferrer&quot;&gt;Slot time&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenario 2: Layer 4 and above (TCP example)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the following example topology, a copper Ethernet connection running at 1Mbps with an MTU of 1500 bytes between two devices with a 10 meter cable. If you have X amount of data which we shall pretend is 100 Megabytes of data to transport between device 1 and device 2, this will take longer than it would with an 30 or 100Mbps copper Ethernet connection with an MTU of 1500 bytes on a 10 meter copper cable between the same two devices. This is because it takes longer to encode and transmit the data on the wire and the receiving NIC will be equally as slow at receiving and decoding the signals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the RTT of &quot;actual data&quot; that is perhaps a single 100MB file will take longer because with the higher level protocols introduced you not only have to transfer the data but also may SYNs, ACKs and PUSH's packets exchanged here using additional bit times, before at the application layer a message can be sent from device 2 to device 1 saying &quot;I have received all the data now&quot;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, what is the best mechanisms to reduce RTT.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Short answer: not much&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To bring this into a real life example expanding on the examples above; If you are &quot;pinging&quot; between two devices that are connected together via several intermediary routers and/or switches the RTT is a product of the physical distance and the time it takes for the signals to travel that far and back through all those devices (basically). If &lt;a href=&quot;http://en.wikipedia.org/wiki/Quality_of_service&quot; rel=&quot;nofollow noreferrer&quot;&gt;QoS&lt;/a&gt; is configured on these devices that can increase the end-to-end delay too and complicate the model further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There isn't much you can do here apart from (in a purely hypothetical situation where money is no object and politics don't matter etc); Install a fibre connection that runs directly from device 1 to device 2 cutting out all the switches and routers in between. That would be an ideal scenario. Realistically you could upgrade any copper or wireless links to fibre (not that fibre is hugely faster [&lt;em&gt;i&lt;/em&gt;], [&lt;em&gt;ii&lt;/em&gt;]) and try to make the connection path as direct as possible so that data passes through the least amount of intermediary devices and different physical connections. QoS tuning and &lt;a href=&quot;http://en.wikipedia.org/wiki/Teletraffic_engineering&quot; rel=&quot;nofollow noreferrer&quot;&gt;traffic engineering&lt;/a&gt; (constraint based routing) can also help over larger distances with many hops in between.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are wanting to transfer data between to points with what you consider to have &quot;too high an RTT&quot; you can look at technologies like &lt;a href=&quot;http://packetlife.net/blog/2010/jun/17/tcp-selective-acknowledgments-sack/&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP SACK&lt;/a&gt; which is in use in many places already, but if you read up on that it will give you a starting point as there are other similar technologies you can then look into. This includes technologies such as WAN accelerators and compressors, although that would be digressing out of the scope of this topic. You must consider with data transfer over a link with a high RTT the &lt;a href=&quot;http://en.wikipedia.org/wiki/Bandwidth-delay_product&quot; rel=&quot;nofollow noreferrer&quot;&gt;BDP&lt;/a&gt; (Bandwidth Delay Product, [&lt;em&gt;iii&lt;/em&gt;]) - when using something like TCP this will always hold you back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[i]   The &quot;flight&quot; time over a copper dielectric medium is very similar to a fibre waveguide&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[ii]  This could change though, new research and technologies will hopefully bring the speed of light in a fibre up from the average of 0.6*c to near 1.0*c, &lt;a href=&quot;http://www.orc.soton.ac.uk/speedoflight.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.orc.soton.ac.uk/speedoflight.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[iii] &lt;a href=&quot;http://www.kehlet.cx/articles/99.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.kehlet.cx/articles/99.html&lt;/a&gt; - BDP example&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2014-06-16T23:19:36.200" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9406" PostTypeId="1" CreationDate="2014-06-15T16:25:37.367" Score="3" ViewCount="8558" Body="&lt;p&gt;We recently got 2 new Cisco SG500 Series Switches (1x 24p &amp;amp; 1x 48p in a Stack) for a location. The plan was to have the SG500X do the routing between VLANs. So we went through and got these configured how we thought they should be, but it isn't quite working right. Everything seems to be in order except the link to the Sonicwall isn't passing traffic through correctly. Communication works fine from the Switches but End Devices aren't getting passed to the Sonicwall. There is a default route set to the Sonicwall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read a couple things that don't match up with our setup that confused me:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;SG500 comes default in 'L2 Mode' &amp; must be set to 'L3 Mode' via &lt;code&gt;#set system mode router&lt;/code&gt;&lt;br&gt;&#xA;      - Our switch has no such command, the only 'mode' to set is &quot;4-Queue or 8-Queue&quot;&#xA;&lt;li&gt;IP Routing must be enabled via &lt;code&gt;#ip routing&lt;/code&gt;, and will show in run-config after enabled&lt;br&gt;&#xA;      - In the Web UI, It said enabled, but I enabled via CLI anyway, but it doesn't show this anywhere in the run-config&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So the setup is: Modem --&gt; Sonicwall --&gt; SG500X --&gt; End Devices&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 1 ~ Administration&lt;br&gt;&#xA;VLAN 10 ~ Data (All End Devices)&lt;br&gt;&#xA;VLAN 12 ~ Voice (Cisco IP Phones)&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the running configuration, there's gotta be something we just missed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;v1.3.0.62 / R750_NIK_1_3_647_260     #I've actually upgraded to the latest firmware 1.3.7  &#xA;CLI v1.0  &#xA;set system queues-mode 4          &#xA;&#xA;vlan database  &#xA;default-vlan vlan 10  &#xA;exit  &#xA;vlan database  &#xA;vlan 1,12   &#xA;exit  &#xA;voice vlan id 12   &#xA;&#xA;interface vlan 1  &#xA; ip address 192.168.1.1 255.255.255.0   &#xA; no ip address dhcp   &#xA;!  &#xA;interface vlan 10  &#xA; name Data   &#xA; ip address 192.168.10.1 255.255.255.0   &#xA;!  &#xA;interface vlan 12  &#xA; name Voice   &#xA; ip address 192.168.12.1 255.255.255.0   &#xA;!  &#xA;interface gigabitethernet1/1/1  &#xA; channel-group 1 mode auto   &#xA;!  &#xA;interface gigabitethernet1/1/2  &#xA; channel-group 1 mode auto   &#xA;!  &#xA;interface gigabitethernet1/1/3  &#xA; channel-group 1 mode auto   &#xA;!  &#xA;interface gigabitethernet1/1/4  &#xA; channel-group 1 mode auto   &#xA;!  &#xA;interface gigabitethernet1/1/24  &#xA; flowcontrol auto   &#xA; description &quot;Sonicwall X0&quot;  &#xA; ip address 192.168.11.1 255.255.255.0   &#xA; switchport mode general   &#xA; switchport general allowed vlan add 1,12 tagged   &#xA;!  &#xA;interface tengigabitethernet1/1/1  &#xA; switchport trunk allowed vlan add 12   &#xA; switchport default-vlan tagged   &#xA;!  &#xA;interface tengigabitethernet1/1/2  &#xA; switchport trunk allowed vlan add 12   &#xA; switchport default-vlan tagged   &#xA;!  &#xA;interface Port-channel1  &#xA; description VSCSERVER1  &#xA; switchport mode general   &#xA;!  &#xA;exit  &#xA;ip default-gateway 192.168.11.2   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hopefully someone can help us out with this, if you need more information just let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;######### EDIT&#xA;&#xA;&lt;p&gt;SG500X#show ip route&lt;br&gt;&#xA;Maximum Parallel Paths: 1 (1 after reset)&lt;br&gt;&#xA;IP Forwarding: enabled&lt;br&gt;&#xA;Codes: &gt; - best, C - connected, S - static,&#xA;       R - RIP  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;S   0.0.0.0/0 [1/1] via 192.168.12.1, 00:28:36, gi1/1/24&lt;br&gt;&#xA;C   192.168.1.0/24 is directly connected, gi1/1/1&lt;br&gt;&#xA;C   192.168.10.0/24 is directly connected, gi1/1/1&lt;br&gt;&#xA;C   192.168.12.0/24 is directly connected, gi1/1/1  &lt;/p&gt;&#xA;&#xA;#&#xA;" OwnerUserId="3513" LastEditorUserId="3513" LastEditDate="2014-06-17T18:58:16.547" LastActivityDate="2014-06-18T13:55:58.787" Title="Cisco SG500X InterVLAN Routing Issue" Tags="|cisco|routing|vlan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9408" PostTypeId="2" ParentId="9404" CreationDate="2014-06-15T17:36:39.530" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does increasing the bandwidth on a link from lets say 1mb to 30mb reduce the RTT?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In short, yes; you are changing &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/voice/voice-quality/5125-delay-details.html#serializationdelay&quot;&gt;serialization delay&lt;/a&gt;; at 1Mbps the serialization delay is non-trivial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compare the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/voice/voice-quality/5125-delay-details.html#serializationdelay&quot;&gt;serialization delay&lt;/a&gt; for a 1500 Byte packet at 1Mbps and 30Mbps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1500 Bytes * 8 bits/Byte / 1,000,000 bits/second    = 12 milliseconds (at 1Mbps)&#xA;1500 Bytes * 8 bits/Byte / 30,000,000 bits/second   = 0.4 milliseconds (at 30Mbps)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remember also that those are unidirectional numbers; you should double them when considering RTT.  Whether you care about 11.6 milliseconds difference in each direction at 1500 bytes is another question, but strictly speaking you can influence RTT with link speed.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-06-15T17:36:39.530" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9409" PostTypeId="2" ParentId="9404" CreationDate="2014-06-15T19:05:03.607" Score="4" Body="&lt;p&gt;The thing most directly affecting RTT is signalling speed. Look at the progression of ethernet over the eons: 10M, 100M, 1G, 10G, 40G, and 100G. Each following version (except 40G) is 10x faster than the previous; the time to transmit a single bit is 1/10th as long. The time to transmit a full (1500B) frame drops by a factor of 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the answer to your question depends on the link layer. If the change in bandwidth has no corresponding change in link speed, then it will have minimal effect on RTT -- because traffic policing isn't done &lt;em&gt;per bit&lt;/em&gt;. For example, my office metro-e connection is physically 1G, but it's shaped to 100M at both ends. &lt;em&gt;Bits&lt;/em&gt; flow at 1G speeds; ethernet &lt;em&gt;frames&lt;/em&gt; will be delayed as necessary to keep the average (over 1s, 10s, etc.) at or below 100M. In simple terms, a single frame transmits at link speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're talking about DSL, then the change in bandwidth is most likely also a change in link speed. &lt;em&gt;But not always.&lt;/em&gt; The sync speed will normally be higher than the profile rate. My DSL line syncs at 8M down, 1M up, but the profile limits it to 6/512k. I've seen Uverse lines sync as high as 60M but still have a 25M profile.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-15T19:05:03.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9412" PostTypeId="2" ParentId="9404" CreationDate="2014-06-16T09:14:12.173" Score="3" Body="&lt;p&gt;No one mentioned the link loading.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On otherwise empty links then not much difference between 1Mb and 30Mb - sure the encoding can be done in 1/30th the time but this is negligible if the distance is the dominating factor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if the 1Mb link is heavily loaded (overloaded?) then you will see increased (and fluctuating) ping times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same traffic load on a 30Mb link represents only a few % of its capacity and so ping times will be faster and more consistent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Two-Way Active Measurement Protocol (TWAMP) defines a flexible method for measuring round-trip IP performance among any two devices in a network that support the standard.&lt;/p&gt;&#xA;" OwnerUserId="5028" LastEditorUserId="5028" LastEditDate="2014-06-16T09:19:15.063" LastActivityDate="2014-06-16T09:19:15.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9413" PostTypeId="2" ParentId="9387" CreationDate="2014-06-16T09:55:28.940" Score="7" Body="&lt;p&gt;What will happen (and is happening now) is that most of the users (eg. home users) will be put behind carrier-grade NAT. There is pretty-much enough IPv4 addresses for those who really need them (globally looking, not saying company XYZ has enough of them). This means you will pay X money for an internet connection, and you will have to pay Y more money, to get a public IPv4 address (where you can get one at all). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means most home users will still have a working (but NAT-ted) connection, and people needing a public IPv4 address will be able to buy/rent it. This will free alot of addresses in some places. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 will be (and currently is, depending on the country, ISP,..) deployed in parallel  to current IPv4 infrastructure. Depending on access type, this may need just a click in a dashboard, software update, or a hardware upgrade too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your questions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Home network: if my router is IPv6 ready, will it translate to IPv4&#xA;  for devices that don't understand IPv6?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Mostly, no. Most home routers don't support such translations. But this won't be a problem due to carrier grade NAT (so you still get IPv4 connectivity).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can these home devices still use IPv4 when the rest of the home&#xA;  network is IPv6?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you have IPv4 connectivity (through NAT or some kind of translation mechanism on your router), then yes. Otherwise, no.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For sites that are still IPv4 only, will my computer or router&#xA;  switch automatically?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you have IPv4 connectivity, or some kind of translation mechanism, then yes, your computer will use IPv4. Otherwise no. But you shouldn't worry about this much... when there are alot of IPv6 only-people, and those sites start losing visitors/customers, they'll switch to IPv6.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When I open whatismyip.com, I see an IPv4 address. I believe I can&#xA;  ask my provider to change to IPv6, but I guess that will disable large&#xA;  parts of the internet for me - will it? Can I still send mail, will DNS&#xA;  work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Usually, most ISPs will give you dual-stack connectivity, so you'll have IPv4 and IPv6 addresses/connectivity. You may have to ask your ISPs helpdesk for more info.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When my provider changes to IPv6, will I still have an IPv4 address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I have said before, this is not just a simple turn-off/turn-on switch. Most likely you will have both addresses (connectivity via both) for some time (even if IPv4 is using NAT).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does this have consequenses for TLS certificates?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not really. &quot;Names&quot; are used for TLS. You might have problems if you use ancient software which doesnt support IPv6 at all, but this is not TLS specific.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;With IPv6 NAT is obsolete I understand. Will this mean my wifi&#xA;  enabled tv is directly accessible from the outside? I guess the router&#xA;  firewall is still working, but now we can use a direct address from the&#xA;  outside?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it will be accessible (that's the point!), but it will probably be firewalled by default on your router. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I don't live in Latin America and don't use Azure. But what if I go&#xA;  to Brasil right now. Will I notice it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not really. If you signed up for an internet connection, you'd probably get put behind NAT or be dual-stacked, but most users wouldn't notice that (they usually have no idea about IPs, addresses, etc... alot of people called my ISPs helpdesk when Facebook was down for ~30 minutes, complaining that their internet doesn't work)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there an easy way to test what works and what not without messing&#xA;  up the home network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, as mentioned in a previous post, try &lt;a href=&quot;http://test-ipv6.com/&quot; rel=&quot;noreferrer&quot;&gt;http://test-ipv6.com/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1220" LastActivityDate="2014-06-16T09:55:28.940" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9416" PostTypeId="1" AcceptedAnswerId="9417" CreationDate="2014-06-16T14:15:13.570" Score="6" ViewCount="1155" Body="&lt;p&gt;&lt;strong&gt;Introduction&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41860-howto-L3-intervlanrouting.html&quot; rel=&quot;noreferrer&quot;&gt;The steps described in this manual&lt;/a&gt; have been applied in order to enable the connection between multiple VLANs which reside on the same switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two VLANs have been configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;VLAN 1:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address 10.1.2.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;VLAN 2:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address 10.1.3.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Ports:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; switchport access vlan 1&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport access vlan 1&#xA;!&#xA;interface GigabitEthernet0/3&#xA; switchport access vlan 2&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Network Adapter System 1:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;10.30.50.71/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Network Adapter System 2:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;10.30.50.72/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both systems are able to access each other if the ethernet cables are connected to ports which reside to &lt;code&gt;VLAN 1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If one of the ethernet cables has been moved to a port which belongs to &lt;code&gt;VLAN 2&lt;/code&gt;, the systems are not able to access each other any more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will interVLAN solve this issue? What kind of commands are available to facilitate troubleshooting this issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to connect Multiple VLANs which reside on the same L3 Switch?&lt;/p&gt;&#xA;" OwnerUserId="5282" LastEditorUserId="5282" LastEditDate="2014-06-16T16:15:38.230" LastActivityDate="2014-06-16T16:15:38.230" Title="Connect Multiple VLANs which reside on same L3 Switch" Tags="|cisco|switch|vlan|layer3|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9417" PostTypeId="2" ParentId="9416" CreationDate="2014-06-16T15:09:23.637" Score="4" Body="&lt;p&gt;The default gateway on your systems is incorrect.  The systems on VLAN 1 must have their default gateway set to 10.1.2.1, the address of the VLAN 1 interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Likewise, the systems on VLAN 2 should have their default gateway set to 10.1.3.1, the interface for VLAN 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is nothing you need to change on the switch.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-06-16T15:09:23.637" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9418" PostTypeId="1" AcceptedAnswerId="9419" CreationDate="2014-06-16T16:46:43.053" Score="1" ViewCount="99" Body="&lt;p&gt;&lt;strong&gt;Introduction&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If VLANs are configured on one switch (Switch1) and this switch is subsequently connected to another switch (Switch2) using a port channel, the VLANs configured on Switch1 are visible as well if the console cable is plugged to Switch2. However, the ports assigned to VLANs by Switch1 are not visible, while viewing the configuration of Switch2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to view the configuration of the ports of all switches in the network by plugging the console cable to one switch like this is the case for VLANs?&lt;/p&gt;&#xA;" OwnerUserId="5282" LastActivityDate="2014-06-16T20:39:04.033" Title="Configure all ports located on other switches from one switch" Tags="|cisco|switch|vlan|etherchannel|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9419" PostTypeId="2" ParentId="9418" CreationDate="2014-06-16T17:10:56.283" Score="4" Body="&lt;p&gt;No it isn't. The reason why you can see VLANs on both switches is VTP &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/vtp/10558-21.html&quot; rel=&quot;nofollow&quot;&gt;(VLAN Trunk Protocol)&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="619" LastEditDate="2014-06-16T20:39:04.033" LastActivityDate="2014-06-16T20:39:04.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9420" PostTypeId="2" ParentId="9418" CreationDate="2014-06-16T17:11:33.403" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to view the configuration of the ports of all switches in the network by plugging the console cable to one switch&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As they are independent, free-standing switches, &lt;em&gt;No&lt;/em&gt;. If they were in a stack or cluster, then the answer most likely would be yes -- they'd all appear as one switch.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-16T17:11:33.403" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9421" PostTypeId="2" ParentId="7759" CreationDate="2014-06-16T17:19:25.370" Score="1" Body="&lt;p&gt;Here's a few ideas&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inbound Load Balancing:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Via BGP (If you have your own AS): announce on both link, as @Lukasz said, but won't be able to force FTP traffic to a specific link.&lt;/li&gt;&#xA;&lt;li&gt;No BGP (No public AS, two different Public IPs - once per ISP): DNS load balancing - have your DNS give out each IPs to requests, on a round robin basis.  You can have a specific hostname for your FTP server that points to the desired link&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For Outgoing connections:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have your L3 switch do &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5212-46.html&quot; rel=&quot;nofollow&quot;&gt;routing load balancing&lt;/a&gt; (not exclusive to BGP) by having two routes to the internet announced by your two ISP routers:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the router receives and installs multiple paths with the same&#xA;  administrative distance and cost to a destination, load-balancing can occur.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5212-46.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5212-46.html&lt;/a&gt; )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you control the announcement by your ISRs to your L3 switch with IP SLA Monitor on the 2951 to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp/configuration/15-s/iap-15-s-book/iap-eot.html&quot; rel=&quot;nofollow&quot;&gt;track&lt;/a&gt; some public IPs and modify the announced route, so that if one cannot reach the Internet (router/link is UP but ISP has routing problems) you'll stop advertising internally the bad link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp/configuration/15-s/iap-15-s-book/iap-eot.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp/configuration/15-s/iap-15-s-book/iap-eot.html&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your FTP, you can use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html&quot; rel=&quot;nofollow&quot;&gt;Policy Based Routing&lt;/a&gt; on your L3 switch to bypass routing and force FTP traffic to use all outgoing FTP traffic on a single link&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're ever looking for a hardware solution that does pretty much all this, take a look at Radware's &lt;a href=&quot;http://www.radware.com/Products/LinkProof-Features/&quot; rel=&quot;nofollow&quot;&gt;Linkproofs&lt;/a&gt;, at least id did a few years ago.&lt;/p&gt;&#xA;" OwnerUserId="1645" LastEditorUserId="1645" LastEditDate="2014-06-16T17:28:08.343" LastActivityDate="2014-06-16T17:28:08.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9428" PostTypeId="2" ParentId="2219" CreationDate="2014-06-17T01:09:10.917" Score="1" Body="&lt;p&gt;From what I gather thus far if the MACsec endpoint where to C-tag/ then add the sec header then the s-tag and the PBN forwarded the frame based on the s-tag that the MACsec endpoint created it should work. The fuzziness comes in where the PBN adds the s-tag to the frame which changes the FCS and possibly alerts the other endpoint that the frame has been tampered with/modified and therefore the integrity cannot be validated. I'm not 100% on this but that is what I think keeps end to end MACsec from working.&lt;/p&gt;&#xA;" OwnerUserId="6121" LastActivityDate="2014-06-17T01:09:10.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9429" PostTypeId="1" AcceptedAnswerId="9431" CreationDate="2014-06-17T06:47:15.350" Score="39" ViewCount="26615" Body="&lt;p&gt;What is the proper term for (example) hostname.tld:433 (hostname:portnumber)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not just hostname, and it is not really a URL either :) same goes for 10.0.0.1:3306 etc.&lt;/p&gt;&#xA;" OwnerUserId="6123" LastActivityDate="2021-10-16T15:43:29.327" Title="What is the proper term for ipaddress/hostname:port" Tags="|ipv4|ipv6|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9431" PostTypeId="2" ParentId="9429" CreationDate="2014-06-17T08:28:50.930" Score="35" Body="&lt;p&gt;IP address and port pair is called, &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_socket&quot;&gt;Socket Address&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pair of socket addresses (10.0.0.1:123, 192.168.0.1:123) may also be called 4-tuple or 5-tuple if the protocol is specified as well (10.0.0.1:123, 192.168.0.1:123 UDP)&lt;/p&gt;&#xA;" OwnerUserId="5385" LastActivityDate="2014-06-17T08:28:50.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9432" PostTypeId="1" CreationDate="2014-06-17T13:29:10.473" Score="3" ViewCount="4969" Body="&lt;p&gt;I'm looking to use auto-negotiation and send Ethernet pause frames across a connection between an Intel X520 NIC and a Stratix IV FPGA using a 10G direct attach copper SFP. Ethtool is telling me that these functions are not supported, and when I try to set them with 'ethtool -A eth2 autoneg on rx on tx on', nothing changes. Intel's webpage says that these functions should be supported for the X520 family. The network driver is ixgbe 3.9.15-k, which supports auto-negotiation and flow control by default. Also, I thought auto-negotiation had to be supported for any 1G/10G connections, as an IEEE standard. Is the problem a compatibility issue, or is there a configuration I'm missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output from ethtool eth2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Settings for eth2:&#xA;        Supported ports: [ FIBRE ]&#xA;        Supported link modes:   10000baseT/Full&#xA;        Supported pause frame use: No&#xA;        Supports auto-negotiation: No&#xA;        Advertised link modes:  10000baseT/Full&#xA;        Advertised pause frame use: No&#xA;        Advertised auto-negotiation: No&#xA;        Speed: 10000Mb/s&#xA;        Duplex: Full&#xA;        Port: Direct Attach Copper&#xA;        PHYAD: 0&#xA;        Transceiver: external&#xA;        Auto-negotiation: off&#xA;        Supports Wake-on: d&#xA;        Wake-on: d&#xA;        Current message level: 0x00000007 (7)&#xA;                               drv probe link&#xA;        Link detected: yes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output from end of dmesg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ixgbe 0000:04:00.0: eth2: detected SFP+: 3&#xA;ixgbe 0000:04:00.0: eth2: NIC Link is Up 10 Gbps, Flow Control: RX/TX&#xA;ADDRCONF(NETDEV_CHANGE): eth2: link becomes ready&#xA;eth2: no IPv6 routers present&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6127" LastActivityDate="2014-10-17T17:50:54.510" Title="No auto-negotiation for X520 with 10G direct attach cable?" Tags="|ethernet|sfp|autonegotiation|10gbase|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9435" PostTypeId="2" ParentId="9429" CreationDate="2014-06-17T15:48:34.803" Score="11" Body="&lt;p&gt;I've been writing a lot of network code over the years, and the word &quot;&lt;strong&gt;endpoint&lt;/strong&gt;&quot; seems to be the term for &quot;a specific port on a specific IP address&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look at the Boost documentation as well as the Microsoft documentation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.boost.org/doc/libs/1_38_0/doc/html/boost_asio/reference/ip__tcp/endpoint.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.boost.org/doc/libs/1_38_0/doc/html/boost_asio/reference/ip__tcp/endpoint.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://msdn.microsoft.com/en-us/library/bbx2eya8%28v=vs.110%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;http://msdn.microsoft.com/en-us/library/bbx2eya8(v=vs.110).aspx&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6133" LastActivityDate="2014-06-17T15:48:34.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9438" PostTypeId="1" AcceptedAnswerId="9462" CreationDate="2014-06-17T17:26:02.083" Score="1" ViewCount="112" Body="&lt;p&gt;Please see the below two images.  I want to enable BOTH sides to initiate connections to each other and communicate successfully.  Both remote ends are connected via a separate VPN tunnel to the central site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which one is correct?  We're working with Cisco ASA's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first one&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IG6GW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IG6GW.png&quot; alt=&quot;First Image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or .. the second one&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tFMlW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tFMlW.png&quot; alt=&quot;Second Image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="3191" LastEditDate="2014-06-18T19:02:06.957" LastActivityDate="2014-06-18T19:02:06.957" Title="Which configuration allows both sides to communicate? (see diagrams)" Tags="|cisco|cisco-asa|vpn|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9439" PostTypeId="1" AcceptedAnswerId="9442" CreationDate="2014-06-17T19:49:48.717" Score="6" ViewCount="5050" Body="&lt;p&gt;A client has the following configuration: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The entire network is on VLAN1, with the subnet 172.16.0.0/16 - performing a redesign of their network is not an option at this point, as they're a 24/7 facility that cannot currently afford downtime (yeah, I know).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client wishes to trunk two switches together: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: Cisco 6509 running IOS 12.3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2: Dell F10 S48-10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco 6509 module 8 is equipped with 10gbps links - the client wants to use four of those links to trunk to the Force10. The problem that I have run into is that the Force10 does not allow tagged traffic on VLAN1, and spanning-tree pvst on the S48-10 rejects the untagged BPDU on VLAN1 from the 6509. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried this configuration with the following settings - the LACP link works, but the Force10 rejects the BPDU from VLAN1 of the Cisco switch saying &quot;Rejected untagged BPDU on VLAN1&quot;, and subsequently shuts the port down. Attempting to tag VLAN1 fails on the Force10 - that functionality is not allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Force 10 Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;protocol spanning-tree pvst&#xA;no disable&#xA;!&#xA;!&#xA;interface range Te0/40 - 43&#xA; description Port Channel 2 Member&#xA; no ip address&#xA;!  &#xA; port-channel-protocol LACP &#xA;  port-channel 2 mode active &#xA; no shutdown&#xA;!&#xA;&#xA;interface Port-channel 2&#xA; description TenGig Uplink to Cisco 6509&#xA; no ip address&#xA; switchport&#xA; no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cisco 6509 configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface range TenGigabitEthernet8/1 - 4&#xA; switchport&#xA; switchport mode trunk&#xA; channel-protocol lacp&#xA; channel-group 2 mode active&#xA;!&#xA;interface port-channel2&#xA; no ip address&#xA; switchport&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk &#xA; no shutdown&#xA;! &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I feel that either I'm missing something very simple, or this may need to be fully converted off VLAN1 before the configuration will function. I was able to try every variant of this configuration that I could, except for forcing &quot;trunk native vlan 1&quot; on the Cisco side. I have not been able to obtain equipment to sandbox this configuration yet. :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thoughts?&lt;/p&gt;&#xA;" OwnerUserId="2912" LastEditorUserId="775" LastEditDate="2014-06-18T02:38:24.937" LastActivityDate="2014-10-17T11:41:00.150" Title="LACP from Cisco 6509 to Force10 S48-10 - in default VLAN1" Tags="|cisco|vlan|spanning-tree|ieee-802.1ax|force10|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9440" PostTypeId="2" ParentId="9439" CreationDate="2014-06-17T20:38:20.640" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_25_see/command/reference/cr/cli3.html#wp2745865&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;vlan dot1q tag native&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, support for it varies from platform to platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if you want to enable/disable native tagging per port (after flipping the above switch): &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/dot1qtnl.html#wp1006255&quot; rel=&quot;nofollow&quot;&gt;Cat6500 IEEE 802.1Q Tunneling&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-06-17T20:47:06.267" LastActivityDate="2014-06-17T20:47:06.267" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9442" PostTypeId="2" ParentId="9439" CreationDate="2014-06-18T02:36:34.033" Score="6" Body="&lt;p&gt;Configure your Force10 with &lt;code&gt;portmode hybrid&lt;/code&gt; and &lt;code&gt;no spanning-tree pvst err-disable cause invalid-pvst-bpdu&lt;/code&gt; on the interface which faces the Cisco 6500... Reference: &lt;em&gt;&lt;a href=&quot;http://en.community.dell.com/techcenter/extras/m/white_papers/20404373.aspx&quot;&gt;Force10 - Cisco STP Interoperability paper&lt;/a&gt;&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the complete configuration for your Port-channel (however, see the warning below)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel 2&#xA; portmode hybrid&#xA; switchport&#xA; no spanning-tree pvst err-disable cause invalid-pvst-bpdu&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As described in the aforementioned white paper, the Force10 &quot;Hybrid Mode&quot; is required for an untagged Vlan1 on the trunk port.  Note that hybrid mode accepts both tagged and untagged frames; however, it will err-disable when it sees the PVST+ BPDU from the Catalyst 6500.  Thus, I recommended that you also use &lt;code&gt;no spanning-tree pvst err-disable cause invalid-pvst-bpdu&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Warning:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to at least one blog I found, hybrid mode &lt;a href=&quot;http://humairahmed.com/blog/?p=4520&amp;amp;cpage=1#comment-3092&quot;&gt;must be configured before any switchport command&lt;/a&gt;; this means you might need to unbundle Port-channel 2 and add it again with &lt;code&gt;portmode hybrid&lt;/code&gt;.  Sadly, I can't confirm this myself since I don't have a Force10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that the Force10 needs manual configuration for each Vlan which gets tagged; I'm assuming you've already tagged your Force10 Vlans.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-06-18T02:36:34.033" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9444" PostTypeId="1" AcceptedAnswerId="9445" CreationDate="2014-06-18T08:14:21.410" Score="2" ViewCount="568" Body="&lt;p&gt;We have an old old guy from year 2000 or so, named Cisco 2611 and he is going nuts lately. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It hangs every three days and about 10 - 20 hours. I wasn't believing my &lt;code&gt;Observium&lt;/code&gt; monitoring system at first, here's the diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MSCfe.png&quot; alt=&quot;Observium - Cisco 2611 memory&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the peak happens to be exactly when it hangs. After that I did telnet to it and ran &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco-router#show memory summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here's the top portion of the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco-router#show memory summary&#xA;               Head   Total(b)    Used(b)    Free(b)  Lowest(b) Largest(b)&#xA;Processor  80D02AA0   15717728    7384968    8332760    8322064    8325568&#xA;      I/O   1C00000    4194304    1832344    2361960    2344108    2361916&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after few seconds...:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco-router#show memory summary&#xA;               Head   Total(b)    Used(b)    Free(b)  Lowest(b) Largest(b)&#xA;Processor  80D02AA0   15717728    7386864    8330864    8322064    8325568&#xA;      I/O   1C00000    4194304    1832344    2361960    2344108    2361916&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and after five minutes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco-router#show memory free&#xA;               Head   Total(b)    Used(b)    Free(b)  Lowest(b) Largest(b)&#xA;Processor  80D02AA0   15717728    7397072    8320656    8312776    8318048&#xA;      I/O   1C00000    4194304    1832344    2361960    2344108    2361916&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The CPU load is stable and is under 5% always and interfaces are very lightly loaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Processor memory gets eaten up like crazy. I don't exactly understand what's happening, but I see something bad is happening. It even wiped out config few times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did any of you have similar issues? How can I troubleshoot further and how to understand the further output of my submitted command, I think I can find a villain there?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. almost forgot&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco-router#show version&#xA;Cisco Internetwork Operating System Software&#xA;IOS (tm) C2600 Software (C2600-IO3-M), Version 12.0(7)XK1, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)&#xA;TAC:Home:SW:IOS:Specials for info&#xA;Copyright (c) 1986-2000 by cisco Systems, Inc.&#xA;Compiled Wed 15-Mar-00 05:51 by phanguye&#xA;Image text-base: 0x80008088, data-base: 0x80877DA8&#xA;&#xA;ROM: System Bootstrap, Version 11.3(2)XA4, RELEASE SOFTWARE (fc1)&#xA;ROM: C2600 Software (C2600-IO3-M), Version 12.0(7)XK1, EARLY DEPLOYMENT RELEASE SOFTWARE (fc1)&#xA;&#xA;cisco-router uptime is 11 hours, 3 minutes&#xA;System returned to ROM by power-on at 13:24:01 EET Thu Jan 27 2011&#xA;System restarted at 00:03:27 WET Wed Jun 18 2014&#xA;System image file is &quot;flash:aaa1313.bin&quot;&#xA;&#xA;cisco 2611 (MPC860) processor (revision 0x203) with 28672K/4096K bytes of memory.&#xA;Processor board ID JAD04210DI1 (1380643539)&#xA;M860 processor: part number 0, mask 49&#xA;Bridging software.&#xA;X.25 software, Version 3.0.0.&#xA;2 Ethernet/IEEE 802.3 interface(s)&#xA;8 Low-speed serial(sync/async) network interface(s)&#xA;32K bytes of non-volatile configuration memory.&#xA;8192K bytes of processor board System flash (Read/Write)&#xA;&#xA;Configuration register is 0x2102&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Update:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Went further and looked at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco-router#show processes memory&#xA;Total: 15717728, Used: 7445296, Free: 8272432&#xA;&amp;lt;unrelated&amp;gt;&#xA; PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process&#xA;  58   0  395438908  394183536    1268100          0          0 IP SNMP&#xA;&amp;lt;unrelated&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;Holding&lt;/code&gt; value is constantly growing. What's up with that? Could &lt;code&gt;Observium&lt;/code&gt; do something nasty to it using SNMP?&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="2093" LastEditDate="2014-06-18T08:24:27.297" LastActivityDate="2014-06-18T10:13:43.513" Title="Cisco 2611 router memory use-up" Tags="|cisco|router|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9445" PostTypeId="2" ParentId="9444" CreationDate="2014-06-18T10:13:43.513" Score="8" Body="&lt;p&gt;You're using 12.0(7)XK1 which was released somewhere between creation of the Universe and dinosaurs. I can list at least 5 or 6 bugs connected with processing of the traffic on the interfaces and SNMP or telnet/SSH access that could have catastrophic effect on the stability of the box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe 12.3 is the last line supported for the old non-XM 2600, you should try to upgrade to something like that before wasting time on troubleshooting this old code.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-06-18T10:13:43.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9446" PostTypeId="2" ParentId="6732" CreationDate="2014-06-18T10:40:12.343" Score="2" Body="&lt;p&gt;I don't think you want to hear this, but no, you don't want to do rate-limiting like you have specified in your question. It's not a good solution to prevent leaking information out. On this topic, see &lt;a href=&quot;https://meta.stackexchange.com/questions/66377/what-is-the-xy-problem&quot;&gt;XY Problem&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all 1000 bytes per day cap will be used up very quickly just on ACKs sent for the legitimate transfers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @MikePennington mentions on the comments you'd be better off using proxies to enforce desired policies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore one suggestion to address your problems might be:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set up a DMZ with proxy server. &#xA;&lt;li&gt;Restrict the access from internal network only to proxy servers.&#xA;&lt;li&gt;Set up and enforce the desired policy on the proxy servers.&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Proxy servers could easily be used to prevent files from being uploaded while it'd still allow downloads. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your environment it might make sense to move the whole server to DMZ and only leave the clients into protected network. Whether this is feasible and beneficial it highly depending on how the server is being accessed, what's running on it and how it is being used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some further questions that might help you assess the situation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Where do you have the assets that you want to protect? Are they on clients or on the server?&#xA;&lt;li&gt;Do you consider the clients connected network to be 'trusted' or 'hostile'? &#xA;&lt;li&gt;Do you consider the users using clients 'trusted' or 'hostile'?&#xA;&lt;li&gt;Do you think the server can be compromised?&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This list isn't exhaustive by any means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you should review your overall architecture rather than plug in bits and pieces to prevent information from leaking out. There are no drop-in solutions to address security issues.&lt;/p&gt;&#xA;" OwnerUserId="5385" LastEditorUserId="-1" LastEditDate="2017-03-20T10:31:55.373" LastActivityDate="2014-06-18T10:40:12.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9447" PostTypeId="2" ParentId="6732" CreationDate="2014-06-18T10:43:43.347" Score="0" Body="&lt;p&gt;There are specific solutions (usually proxies) both commercial and open source that can address this and are specialized to fight with data leakage prevention. On the protocol level, limiting traffic to some artificial values (be it 1000 or 10000 bytes per day) doesn't make sense as it will break TCP or any other higher-level protocols.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-06-18T10:43:43.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9450" PostTypeId="1" AcceptedAnswerId="9457" CreationDate="2014-06-18T12:54:05.483" Score="1" ViewCount="294" Body="&lt;p&gt;Here is the network topology that I have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Private network 1 --&gt; IPFire Firewall 1 &amp;lt;---&gt; IPFire Firewall 2 &amp;lt;-- Private network 2 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping from private network 1 to private network 2, that is after creating an IPsec tunnel between the two IPFire devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to do is to have a middle device between the two IPFire devices, the network topology is like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Private network 1 --&gt; IPFire Firewall 1 &amp;lt;-- middle device --&gt; IPFire Firewall 2 &amp;lt;-- Private network 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to use this middle device as a packet sniffer for the packets flawing between IPFire 1 and 2. What I don't know is how transfer the connection from one interface of the middle device to the second, the IPsec tunnel uses private IPs, so I don't know who the middle device will affect the tunnel establishment.&lt;/p&gt;&#xA;" OwnerUserId="4629" LastActivityDate="2014-06-18T16:50:23.960" Title="Putting a middle host between two firewall devices" Tags="|ipsec|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9451" PostTypeId="2" ParentId="9406" CreationDate="2014-06-18T13:55:58.787" Score="2" Body="&lt;p&gt;Couple of things I see off-hand that need to be addressed. Your routing table doesn't include the 192.168.11.x network, thus your router doesn't know where to send the data, unless you omitted it from the text. It should be automatically included as a &quot;connected&quot; 'C' route as your others are. Part of the problem may lie in the fact that you are using port 1/1/24 in switchport mode, instead of routed mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the text you included, it looks like your voice network is the default static route for all of your traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine you can ping the 192.168.11.1 interface? Can you ping the 192.168.11.2 interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a quick fix to try... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;config t# int gi1/1/24 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;config t-if# no ip address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;config t# int vlan 11&lt;/p&gt;&#xA;&#xA;&lt;p&gt;config t-if# ip address 192.168.11.1 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;config t-if# int gi1/1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;config t-if# switchport mode acce&lt;/p&gt;&#xA;&#xA;&lt;p&gt;config t-if# switchport acc vlan 11&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Verify the 192.168.11.0/24 network is in the routing table and rerun the ip default gateway command if needed. Check for connectivity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also try changing int gi1/1/24 into a routed port with the &quot;no switchport&quot; command. That should also solve your problem. &lt;/p&gt;&#xA;" OwnerUserId="6148" LastActivityDate="2014-06-18T13:55:58.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9452" PostTypeId="2" ParentId="8185" CreationDate="2014-06-18T13:59:37.457" Score="1" Body="&lt;p&gt;802.1x-2004 supports EAP Mutual Authentication. Clients could be configured to block the network access if authentication fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be used to prevent your clients from connecting to unwanted network but also helps keeping unwanted visitors out of you network as well.&lt;/p&gt;&#xA;" OwnerUserId="5385" LastActivityDate="2014-06-18T13:59:37.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9454" PostTypeId="2" ParentId="9450" CreationDate="2014-06-18T14:26:50.737" Score="0" Body="&lt;p&gt;I've never done this exactly, but my understanding is that you would want some sort of physical splitter in between to capture traffic to a 3rd (middle) device.  Would depend on the type of physical layer1 connection.  See link for an example of network tap solutions&#xA;&lt;a href=&quot;http://www.flukenetworks.com/enterprise-network/network-monitoring/Tap-Solutions&quot; rel=&quot;nofollow&quot;&gt;http://www.flukenetworks.com/enterprise-network/network-monitoring/Tap-Solutions&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3150" LastActivityDate="2014-06-18T14:26:50.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9455" PostTypeId="1" AcceptedAnswerId="9456" CreationDate="2014-06-18T14:28:23.070" Score="3" ViewCount="14254" Body="&lt;p&gt;I have been learning ICND1 through CBTNuggets.com course online, &#xA;I have recently started a video where the instructor is guiding on how to use Wireshark to trace the communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He first used DNS to show how User Datagram Protocol is shown in the Wireshark when i do &#xA;&lt;code&gt;nslookup&lt;/code&gt; of any website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then he started the Wire Shark Capture and visited a website CBTNuggets.com and suddenly his Wireshark window started to show protocols like TCP, HTTP etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I tried the same process, and visited google.com or any other website while my Wireshark capture is on, All i could see is &lt;code&gt;SSDP&lt;/code&gt; protocol in my wireshark window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the difference between UDP and TCP, and that TCP is a reliable communication and HTTP is TCP based protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why my Wireshark is not showing any TCP protocol when I visit any website ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S: I am use Wireless Network Device&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/t2mPE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3821" LastActivityDate="2017-04-26T02:46:04.883" Title="Wireshark shows SSDP protocol for HTTP request, and not TCP protocol" Tags="|wireshark|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9456" PostTypeId="2" ParentId="9455" CreationDate="2014-06-18T14:45:03.013" Score="4" Body="&lt;p&gt;Clear the expression ip.addr==192.168.0.1 filter.  This is probably whats filtering out what you want to see.  You can tell by the very first column in WireShark, Look at the No. jumps at DNS No.94 to SSDP No. 680 ---   So about 500 entries you arent seeing.  You can also turn off the ssdp discovery service in windows to eliminate that ssdp mess.&lt;/p&gt;&#xA;" OwnerUserId="3150" LastActivityDate="2014-06-18T14:45:03.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9457" PostTypeId="2" ParentId="9450" CreationDate="2014-06-18T14:46:43.210" Score="2" Body="&lt;p&gt;To easily see the traffic in it's encrypted state between the two firewalls which you own and manage.  I suggest a hub.  It requires no configuration, you simply plug in both firewall's outside interfaces and then plug in your laptop with monitoring tools (may need to adjust NIC settings/promiscuous etc) to see all the traffic flowing between the two devices.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2014-06-18T16:50:23.960" LastActivityDate="2014-06-18T16:50:23.960" CommentCount="19" ContentLicense="CC BY-SA 3.0" />
  <row Id="9458" PostTypeId="2" ParentId="9450" CreationDate="2014-06-18T14:59:50.740" Score="0" Body="&lt;p&gt;You could also put a switch in the middle and connect the sniffer to a mirror port. This will add another device to your setup but no special configuration will be needed on the sniffer.&lt;/p&gt;&#xA;" OwnerUserId="5469" LastActivityDate="2014-06-18T14:59:50.740" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9462" PostTypeId="2" ParentId="9438" CreationDate="2014-06-18T16:53:20.283" Score="3" Body="&lt;p&gt;The answer (verified by Cisco VPN specialist) is Number 2.  The crypto ACL's and NAT are bi-directional by default assuming your outside interfaces are static.  &lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2014-06-18T16:53:20.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9464" PostTypeId="2" ParentId="7975" CreationDate="2014-06-18T21:09:55.033" Score="5" Body="&lt;p&gt;Depending on the model - it may not support both tagged and untagged traffic on the same switchport. The GS1910 is one such model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either tag all or tag none.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just got off the phone with Tech Support to be told what I had already figured out...&#xA;Good Luck&lt;/p&gt;&#xA;" OwnerUserId="6155" LastActivityDate="2014-06-18T21:09:55.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9465" PostTypeId="2" ParentId="7889" CreationDate="2014-06-18T21:11:02.907" Score="2" Body="&lt;p&gt;[Sorry for being late to the party, but came across this when looking for something else]&#xA;When you say &quot;several foreign conversations appear&quot;, do you mean multiple packets in both directions, or just the occasional packet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is full conversations, then you definitely have a problem with your switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is occasional packets, then I'd blame spanning tree changes.  Recall that a switch remembers MAC addresses for 300 seconds by default.  So if your switch had NOT seen a frame from a particular device for 300 seconds, and frames were sent to that MAC address, they would be forwarded to all other ports, including your WinXP/Wireshark monitor.  This would continue until the owner of the MAC address sent a frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For devices running modern operating systems, the chances of a device NOT sending a frame for 300 seconds is pretty slim, although other more passive devices may be silent for that kind of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back to spanning tree.  If there is a spanning tree topology change (such as a device connecting/disconnecting to a switch port), a &lt;strong&gt;Topology Change Notification&lt;/strong&gt; event is sent to the root bridge.  The root bridge then sets the TCN bit on all BPDUs for the next FWD_DELAY period (15 seconds).  When bridges see BPDUs with the TCN bit set, they reduce the ageing timers for the MAC address table to FWD_DELAY (15 seconds). [This is one reason why you should always enter the global configuration command &lt;strong&gt;&lt;em&gt;spanning-tree portfast default&lt;/em&gt;&lt;/strong&gt; - to stop the creation of TCNs whenever a switch port is activated/de activated]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So IF there are spanning tree changes, you are more likely to see occasional packets to MAC addresses other than your own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You do not specifically say if any of the packets you see were from another subnet (= another VLAN if your design is correct).  BUT if you ARE seeing packets from another subnet/VLAN, then I would suggest that you look very carefully at your inter-switch cabling, and check the &lt;strong&gt;native vlan&lt;/strong&gt; configuration and &lt;strong&gt;Trunk port&lt;/strong&gt; status of all these links.  If there is any &quot;subnet/VLAN&quot; leakage, then it could create multiple topology changes which in turn could keep the ageing timer to 15 seconds leading to many more unexpected frames arriving on your Wireshark capture.&lt;/p&gt;&#xA;" OwnerUserId="6154" LastActivityDate="2014-06-18T21:11:02.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9466" PostTypeId="1" AcceptedAnswerId="10051" CreationDate="2014-06-19T05:32:02.887" Score="7" ViewCount="6206" Body="&lt;p&gt;I am trying to login ASR9001 router using ssh public key authentication.&#xA;I tried to import my ssh public key to the router but no success.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;RP/0/RSP0/CPU0:ASR9K-1#crypto key import authentication rsa disk0:/test.pem&#xA;Cannot execute the command : Invalid argument&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does any one know how to do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="3285" LastActivityDate="2021-08-11T18:19:33.730" Title="Does anyone know how to import ssh public key to ASR9K (IOS-XR)?" Tags="|ssh|authentication|cisco-ios-xr|cisco-asr|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9467" PostTypeId="2" ParentId="9466" CreationDate="2014-06-19T06:02:36.967" Score="0" Body="&lt;pre&gt;&lt;code&gt;ip ssh pubkey-chain&#xA;  username ...&#xA;    key-string&#xA;    ...&#xA;    exit&#xA;  exit&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IOS-XR on the ASR9k appears to be poorly documented on the subject (other than saying it supports it.) &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r5-1/security/configuration/guide/b_syssec_cg51xasr9k/b_syssec_cg51xasr9k_chapter_011.html#task_1104725&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;crypto key import authentication rsa general-keys&lt;/code&gt;&lt;/a&gt; would appear to be the command, but there's no example of using it to import a &lt;em&gt;user&lt;/em&gt; key, vs. the router's own identity.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-06-19T07:21:52.237" LastActivityDate="2014-06-19T07:21:52.237" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9470" PostTypeId="1" AcceptedAnswerId="9479" CreationDate="2014-06-19T09:51:14.720" Score="2" ViewCount="5592" Body="&lt;p&gt;I've got a setup in my house as a test to try and figure this stuff out, but i've hit a bit of an end point. Here is a picture of my network setup.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/mKVBU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i have my internet provided by Virgin Media, which comes through into a 16 port unmanaged switch, our of that into a Desktop PC which uses DHCP to pick up an address from the Virgin router. I also have another cable going down to the garage which has a managed Dell Switch and a managed Cisco router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my Desktop PC, i can ping 192.168.1.253 (dell) and 192.168.1.254 (cisco) and the gateway of the Desktop PC is 192.168.1.1 (virgin). If i was to change my gateway to 192.168.1.254 (cisco) then i can now ping 192.168.200.254 (VLAN 200) as well as the rest of the network. Which is great, so i know i can get across the subnet which is exactly what i'm after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem then starts if i want to have a machine on the 200 VLAN. So, i change my IP Config of the Desktop to...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP: 192.168.200.50&#xA;Sub: 255.255.255.0&#xA;GW: 192.168.200.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now can't ping a thing, getting destination host unreachable across the board. So that leads me to think it isn't working!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the configs for the Switch and the Router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dell Switch&#xA;&lt;a href=&quot;http://pastebin.com/iun8WKne&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pastebin.com/iun8WKne&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Router&#xA;&lt;a href=&quot;http://pastebin.com/6VE8yQ4r&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pastebin.com/6VE8yQ4r&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think i've covered everything here...&lt;/p&gt;&#xA;" OwnerUserId="6159" LastActivityDate="2014-06-19T17:27:28.697" Title="VLAN with Mixture of Managed/Unmanaged Switches" Tags="|cisco|vlan|subnet|dell|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9471" PostTypeId="1" AcceptedAnswerId="9474" CreationDate="2014-06-19T10:29:33.317" Score="1" ViewCount="2193" Body="&lt;p&gt;I currently have a small network which contains an FTP server that I'd like to be able to access from the Internet at home.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This network has a firewall with 2 interfaces - 192.168.0.75 - Facing the internal network &amp;amp; 192.168.1.1  going to my router at 192.168.1.254. I need to be able to forward ports from the router's subnet, through the firewall on to my internal subnet and to the FTP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if static routes are the most ideal way to achieve this, or exactly how it should be set. With static routes am I correct in the assumption I'd need a route going from the router to the firewall with its gateway set as 192.168.1.1, with destination IP 192.168.0.75, and setup port forwarding on the firewall to the FTP server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please advise, I also attach a simplified diagram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z6rxD.jpg&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/oWZ3E.jpg&quot; alt=&quot;Routes view from Router&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="6160" LastEditorUserId="775" LastEditDate="2014-12-08T12:55:58.863" LastActivityDate="2014-12-08T12:55:58.863" Title="Routing through a Firewall to FTP server" Tags="|routing|firewall|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="9473" PostTypeId="1" CreationDate="2014-06-19T11:29:42.163" Score="-1" ViewCount="99" Body="&lt;p&gt;A lot simplier question related to my first question here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qoiDZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a network set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 router, 1 switch, 4 PCs (with several NICs)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A can ping B and C (reverse also true)&#xA;C can ping A, B, and D (reverse also true)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I configure so that A and B can ping D and D can ping A and B? I cannot change any IP and not touching the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My logical idea would be to set up a route. How do I do this on A and B?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you &lt;/p&gt;&#xA;" OwnerUserId="6161" LastActivityDate="2015-01-10T02:03:09.967" Title="Configuring some routes on some PCs" Tags="|ping|" AnswerCount="1" CommentCount="7" ClosedDate="2019-06-04T00:37:14.107" ContentLicense="CC BY-SA 3.0" />
  <row Id="9474" PostTypeId="2" ParentId="9471" CreationDate="2014-06-19T11:37:18.953" Score="3" Body="&lt;p&gt;Static routes are just fine. In this case your default gateway should always point towards internet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;FTP server should have default gateway 192.168.0.75&#xA;&lt;li&gt;Firewall's default route (0.0.0.0/0) should have next hop 192.168.1.254.&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Firewall shouldn't need any other routes. 192.168.0.0/24 and 192.168.1.0/24 are already connected so they should be in the routing table already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your router (192.168.1.254) should have static route for 192.168.0.0/24 via 192.168.1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port forwarding must be done at least on a device with public IP address - router in your case. In this case you don't need to perform NAT nor port forwarding on the firewall it'll just run the firewall rules. Port forwarding on the router should set 192.168.0.162 as new destination address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You &lt;em&gt;could&lt;/em&gt; do port forwarding on both firewall and router but I that's probably counter productive. You &lt;em&gt;cannot&lt;/em&gt; perform port forwarding and NAT on firewall only as it isn't reachable from the Internet due to private IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="5385" LastActivityDate="2014-06-19T11:37:18.953" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9476" PostTypeId="2" ParentId="9470" CreationDate="2014-06-19T15:26:09.730" Score="0" Body="&lt;p&gt;When your computer is 192.168.200.50 and you ping the Dell switch for example, what is the default gateway configured on the Dell switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the Dell switch's default gateway isn't the Cisco router, it won't know how to contact hosts in the 192.168.200.0/24 subnet because it has no return path. It will be able to respond to ping requests coming from hosts in it's own subnet (1921.168.1.x/24) becasue it is directly attached to that network, but it won't know a route to 192.168.200.x/24 unless it default gateway has a route to that network or it has an interface in that network already.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2014-06-19T15:26:09.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9477" PostTypeId="2" ParentId="9432" CreationDate="2014-06-19T15:36:12.923" Score="3" Body="&lt;p&gt;I'm not sure about the IEEE standard, but Avaya switches only support autonegotiation for 10/100/1000 Mpbs.  Autonegotiation isn't supported for 10 Gig connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This guy breaks it down a little bit.&#xA;&lt;a href=&quot;http://networkn3rd.wordpress.com/2013/04/15/10g-auto-negotiation/&quot; rel=&quot;nofollow&quot;&gt;http://networkn3rd.wordpress.com/2013/04/15/10g-auto-negotiation/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-06-19T15:36:12.923" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9479" PostTypeId="2" ParentId="9470" CreationDate="2014-06-19T17:27:28.697" Score="5" Body="&lt;p&gt;The reason that this doesn't work is that your desktop isn't actually &lt;em&gt;in&lt;/em&gt; vlan 200. You changed the IP address of the desktop to be on the 192.168.200.0/24 &lt;em&gt;subnet&lt;/em&gt; but that's at layer 3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the layer 2 topology, your PC is connected to a dumb switch which is hooked into a vlan 1 port on the managed switch. Because of this, regardless of what your IP address is the traffic coming from your desktop is hitting the switch on vlan 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going back to layer 3 a bit, your default gateway 192.168.200.254 isn't in vlan 1 it's in vlan 200 because it's assigned to a router sub-interface which is watching for traffic tagged vlan 200. Therefore the PC's default gateway is unreachable at layer 2 and you get the infamous &quot;Destination host unreachable&quot; error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For you to add a host in vlan 200, you need to plug it into a totally new port on the Dell managed switch and assign that port to vlan 200, as well as giving it an IP address in the 192.168.200.0/24 subnet.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On a related note, if you want traffic from vlan 200 to reach the outside internet you will need to create static routes on both the virgin media router and the Cisco router telling them about the other networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Cisco router you need to add &lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.1.1&lt;/code&gt; to tell it to forward any traffic with a destination network it doesn't know about to virgin media. On the virgin media router you need the equivalent of &lt;code&gt;ip route 192.168.200.0 255.255.255.0 192.168.1.254&lt;/code&gt; so that the virgin media router knows where to send traffic coming back from the internet destined for vlan 200.&lt;/p&gt;&#xA;" OwnerUserId="5613" LastActivityDate="2014-06-19T17:27:28.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9485" PostTypeId="1" CreationDate="2014-06-20T06:01:40.170" Score="3" ViewCount="704" Body="&lt;p&gt;I have a doubt about multicast.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Topology diagram&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Multicast SEVER -- R1 -- R2 -- R3 -- PC1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Above diagram , suppose PIM-SM is enabled on all the Routers and let us assume that R2 will be the RP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If Multicast server sends a stream to 224.0.0.3 group , Then how does PC1 aware that it should join to that particular group .&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Observations&lt;/h1&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For Example , If Multicast server sends &quot;youtube&quot; stream with some&#xA;  video-1 , so when I type the same URL in my PC1 , how it can able to&#xA;  covert that URL (youtube/video-1) to perticular multicast address ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Who will do this conversions ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone clarify this ?&lt;/p&gt;&#xA;" OwnerUserId="5835" LastEditorUserId="775" LastEditDate="2014-06-20T07:25:39.307" LastActivityDate="2014-06-20T07:25:39.307" Title="PIM : How does a client discover multicast streams" Tags="|multicast|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9486" PostTypeId="2" ParentId="9485" CreationDate="2014-06-20T06:53:00.120" Score="2" Body="&lt;p&gt;The host queries a multicast catalog service to find a multicast stream (youtube video, iptv video, stocks notification service, whatever) which is mapped to that specific multicast group. The multicast catalog service is either hard-coded in the application itself, or selectable via application (say - browser) interface.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="775" LastEditDate="2014-06-20T07:23:29.963" LastActivityDate="2014-06-20T07:23:29.963" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9488" PostTypeId="1" AcceptedAnswerId="9491" CreationDate="2014-06-20T10:35:57.120" Score="9" ViewCount="2094" Body="&lt;p&gt;I need to measure the latency, jitter and packet-loss &lt;strong&gt;per link&lt;/strong&gt; in a network, &lt;strong&gt;as opposed to end-to-end,&lt;/strong&gt; e.g. like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;s1-eth0 &amp;lt;--&gt; s2-eth0&lt;/strong&gt; (~ 20µs avg. latency, standard derivation 10µs, 57 % packet loss /last sec)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;s2-eth1 &amp;lt;--&gt; s3-eth0&lt;/strong&gt; (~ 25µs avg. latency, standard derivation 5µs, 21 % packet loss / last sec)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;...&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All solutions i was able to find were either academic proposals or involve using dedicated hardware for active probing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a summary what according to my research does no work out:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;NetFlow:&lt;/strong&gt; No latency information, only end-to-end&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Active Probing:&lt;/strong&gt; It's Not possible for me to change the configuration of the network&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Measure Roundtrip-Time:&lt;/strong&gt; does not provide per-link-statistics&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there any network protocol, measurement tool or other functionality providing all or at least some of the above statistics?&lt;/strong&gt; &lt;/p&gt;&#xA;" OwnerUserId="6173" LastActivityDate="2019-04-18T08:43:34.147" Title="Measuring per-link latency/jitter/packet-loss" Tags="|router|switch|monitoring|latency|packet-loss|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9490" PostTypeId="1" AcceptedAnswerId="9499" CreationDate="2014-06-20T12:42:01.687" Score="1" ViewCount="4741" Body="&lt;p&gt;I just installed a TZ-205 on our company network and I can not seem to find where I would add to a DNS table. On our Linksys LRT224 there is a option to add a domain name and an associated IP. Does this function even exist in the Sonic Wall? I want to be able to type in &quot;example.com&quot; and have it point that domain name at my server IP address at home. I know I can edit the hosts file but I use my server at home for development sites I have 5 of them currently on one server so to go to every employees computer and update the hosts file will be time consuming. Thanks&lt;/p&gt;&#xA;" OwnerUserId="5701" LastActivityDate="2016-02-17T15:23:21.513" Title="Configure DNS Table on Sonic Wall TZ205" Tags="|routing|router|dns|ip-forwarding-table|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9491" PostTypeId="2" ParentId="9488" CreationDate="2014-06-20T13:05:08.447" Score="12" Body="&lt;p&gt;On Cisco devices, you can use Cisco IP SLA. You need to first configure and enable it, and then monitor the results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. ip sla monitor operation-number&#xA;&#xA;2. type echo protocol ipIcmpEcho {destination-ip-address | destination-hostname} [source-ipaddr {ip-address | hostname} | source-interface interface-name]&#xA;&#xA;3. frequency seconds&#xA;&#xA;4. ip sla monitor schedule operation-number [life {forever | seconds}] [start-time {hh:mm[:ss] [month day | day month] | pending | now | after hh:mm:ss] [ageout seconds] [recurring]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Configuration example took from &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_4/ip_sla/configuration/guide/hsla_c/hsicmp.html&quot;&gt;Cisco: IP SLAs--Analyzing IP Service Levels Using the ICMP Echo Operation&lt;/a&gt;.&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router&amp;gt; enable&#xA;Router# configure terminal&#xA;Router(config)# ip sla monitor 10&#xA;Router(config-sla-monitor)# type echo protocol ipIcmpEcho 172.29.139.134&#xA;Router(config-sla-monitor-echo)# frequency 300&#xA;Router(config-sla-monitor-echo)# exit&#xA;Router(config)# ip sla monitor schedule 10 start-time now life forever&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To monitor:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip sla monitor statistics&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6022" LastEditorUserId="3191" LastEditDate="2014-06-26T14:29:14.030" LastActivityDate="2014-06-26T14:29:14.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9492" PostTypeId="2" ParentId="9488" CreationDate="2014-06-20T13:05:08.760" Score="6" Body="&lt;p&gt;On juniper hardware you can use the RPM service to get those measurements. The service can be configured to monitor specific interfaces which will help with the 'per-link' requirement.&lt;/p&gt;&#xA;" OwnerUserId="5469" LastActivityDate="2014-06-20T13:05:08.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9494" PostTypeId="1" AcceptedAnswerId="9823" CreationDate="2014-06-20T13:58:00.890" Score="6" ViewCount="646" Body="&lt;p&gt;I'm trying to understand how I should act on a trap I'm receiving from our WLC&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WIPS Alert: Reason &quot;NoProfile&quot; detected on AP MAC: 00:1a:30:00:00:00, AP Name: West128_c3602i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My searches for the meaning of this message have not turned up anything useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;WLC5508, Version 7.4.121.0&lt;/li&gt;&#xA;&lt;li&gt;APs in &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/technology/wips/deployment/guide/WiPS_deployment_guide.html#wp43469&quot;&gt;monitor mode&lt;/a&gt;, WIPS sub-mode&lt;/li&gt;&#xA;&lt;li&gt;AP model is c3602i&lt;/li&gt;&#xA;&lt;li&gt;This is a new deployment, so NCS Prime / MSE are not operational yet&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The AP in question are joined to the default &quot;WLAN AP Group&quot;; however, other &quot;local&quot; mode APs are in a dedicated group.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why is the WLC alarming on this condition?  Is there a real problem or is this just noise?&lt;/li&gt;&#xA;&lt;li&gt;How should I resolve the issue?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-08-06T15:58:44.883" Title="WIPS Alert: Reason &quot;NoProfile&quot; detected on AP" Tags="|cisco|wireless|troubleshooting|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9497" PostTypeId="1" CreationDate="2014-06-20T14:55:16.047" Score="4" ViewCount="149" Body="&lt;p&gt;I'm just now starting to get into the network side of things and I'm trying to learn how OSPF routing is setup on Cisco. If I configure a static route on a device that is part of an OSPF neighborhood will that route then be advertised to its neighbors? Or do I need to setup the static route on each device to point to the next hop?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize this is likely a very basic question and apologize for that in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help you folks can provide.&lt;/p&gt;&#xA;" OwnerUserId="6181" LastActivityDate="2014-06-20T18:03:16.157" Title="How do I setup OSPF routes on a Cisco infrastructure?" Tags="|cisco|ospf|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9498" PostTypeId="2" ParentId="9497" CreationDate="2014-06-20T17:01:04.567" Score="4" Body="&lt;p&gt;Static routes will not be advertised unless you redistribute them into the OSPF process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic command is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf x&#xA;redistribute static subnets metric y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BUT,&#xA;there are a lot of things to consider about when and how you are redistributing.  More details about your  network would help with a more complete answer.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-06-20T17:01:04.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9499" PostTypeId="2" ParentId="9490" CreationDate="2014-06-20T17:23:22.897" Score="2" Body="&lt;p&gt;The sonicwall can point to one of your own internal DNS servers (running on another device in your network), but it doesn't include a DNS server itself.  You can set your server up to do DNS and point the sonicwall at it, then all DHCP clients will use that server for name lookups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have multiple websites and multiple employee workstations, it's worth it to set up your own DNS server.  It will save a lot of trouble, especially as you grow.&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2014-06-20T17:23:22.897" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9500" PostTypeId="2" ParentId="9497" CreationDate="2014-06-20T18:03:16.157" Score="3" Body="&lt;p&gt;In the most basic scenario; you just enable OSPF, give it the networks to distribute, and that's it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router&amp;gt;enable&#xA;Router#conf t&#xA;Router(config)router ospf 1&#xA;Router(config-router) network x.x.x.x y.y.y.y area 0&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, x.x.x.x is the network address and y.y.y.y is the wild card mask. A wild card mask appears just like subnet mask, only bitwise negated. For instance, if your subnet mask is 255.255.255.0, corresponding wildcard is 0.0.0.255. You can think it like this; if you add each byte of the subnet mask and the wildcard individually, you will always get 255.255.255.255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For local networking, just leave the number after the &quot;area&quot; 0. Also, the number after &quot;router ospf&quot; is related to the workings of the ios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, or before that, order is not important, you can add your static routes without any special effort. But remember that there is an option just to redistribute the default route. You can do this by issueing&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config-router)default-information originate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;command.&lt;/p&gt;&#xA;" OwnerUserId="6022" LastActivityDate="2014-06-20T18:03:16.157" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9501" PostTypeId="1" CreationDate="2014-06-21T13:25:37.863" Score="0" ViewCount="186" Body="&lt;p&gt;I am trying to get my grips around bandwidth and latency. I have read Stuart Cheshire's essay, however, there are a couple of paragraphs that I cannot understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Paraphrasing: Assume we are to compare two data link connections, 64Kbps ISDN and 1/150 share of a 10Mbps Ethernet. Then, say we have a game server that is transmitting 40K of data every 10 seconds or 32kb/sec. He states that this is only 50% capacity of the ISDN line.He goes on to say &quot;150 users doing this on an Ethernet is only half the capacity of the Ethernet&quot;. How did he get that? That is, 150 users is 50% capacity of the Ethernet? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;He then says that on the ethernet, the player receives the data  in about 32 ms (320kb / 10Mb/sec). &quot;If the server is not the only machine sending packets on the ethernet, then there could be a contention for the shared medium, &lt;strong&gt;but even in that case the average delay before the player receives the data is only 64ms&lt;/strong&gt;&quot; How did he get that? the 64ms?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, wondering if someone can explain the 2nd paragraph of page 8/11 (link below)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The link to the article is here (pg 8/11): &lt;a href=&quot;http://rescomp.stanford.edu/~cheshire/rants/Latency.html&quot; rel=&quot;nofollow&quot;&gt;http://rescomp.stanford.edu/~cheshire/rants/Latency.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6188" LastActivityDate="2014-06-21T17:37:07.733" Title="bandwidth vs latency - question on stuart cheshire paper" Tags="|latency|bandwidth|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9502" PostTypeId="1" AcceptedAnswerId="9504" CreationDate="2014-06-21T13:55:52.900" Score="5" ViewCount="5231" Body="&lt;p&gt;I just want to whether their is any difference between the command no shut or no shutdown.&lt;/p&gt;&#xA;" OwnerUserId="6190" LastActivityDate="2014-06-21T15:12:50.183" Title="Cisco packet tracer no shut or no shutdown" Tags="|cisco|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9504" PostTypeId="2" ParentId="9502" CreationDate="2014-06-21T15:12:50.183" Score="8" Body="&lt;p&gt;There is no difference between those two commands in Cisco IOS. &lt;code&gt;no shut&lt;/code&gt; is just a shortened form of &lt;code&gt;no shutdown&lt;/code&gt;. If you were to type &lt;code&gt;no shut&lt;/code&gt; at the CLI and press the TAB key you will see that it will complete the command as &lt;code&gt;no shutdown&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2014-06-21T15:12:50.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9505" PostTypeId="2" ParentId="9501" CreationDate="2014-06-21T17:37:07.733" Score="1" Body="&lt;p&gt;The logic seems to be if there is not contention I will get the data at line rate (32ms) 150 users woudl consume 150*40000*8 = 49,152,000 which is 50 % of 10 meg. If the link is contended and hence policed to 50 meg it will take twice as long as only 50% of the BW is usable&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2014-06-21T17:37:07.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9506" PostTypeId="1" AcceptedAnswerId="9507" CreationDate="2014-06-22T00:53:30.610" Score="5" ViewCount="3780" Body="&lt;p&gt;Well, some days ago I had a interview for a IT networking job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the questions was about switching, and says the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a computer A connected to a switch configured in VLAN2, and computer B connected to other switch configured with VLAN3. Considering the link between switches as access mode, has the computers A and B connection trough ping?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/T0XGx.png&quot; alt=&quot;Connection&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I think the answer is NO, because if we are using dot1Q we need at least one router to join different VLANs (VLAN2 VLAN3). Am I wrong?&lt;/p&gt;&#xA;" OwnerUserId="6193" LastActivityDate="2019-08-29T13:23:36.937" Title="&quot;simple&quot; question about VLAN switching" Tags="|vlan|switching|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9507" PostTypeId="2" ParentId="9506" CreationDate="2014-06-22T03:12:11.390" Score="8" Body="&lt;p&gt;In this case, you are wrong.  Since the link between the two switches is an access port, there is no VLAN tagging involved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of it this way, switch two is a unconfigured switch (i.e. operating like a dumb switch) so all ports are in VLAN 1.  This would still provide connectivity as well.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-06-22T03:12:11.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9508" PostTypeId="2" ParentId="9506" CreationDate="2014-06-22T03:29:37.640" Score="5" Body="&lt;p&gt;Your answer of NO would be correct if the hosts were in different IP subnets as then they would rely on inter-vlan routing to communicate with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First question I would have asked was... Are they in the same IP subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a flat topology with access mode ports and all hosts in the same broadcast network the two hosts WOULD be able to talk to each other as the VLAN is local to the switch. No tagging would be carried across the link connecting the two switches due to the access port configuration. The frame would simply be passed along to the interested port or flooded to all ports in that vlan except the one it was received on if the destination mac address is unknown. Remember the tag is only passed along in a frame when it traverses a trunked port\interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in this scenario:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Let's assume the MAC tables are populated on both switches so we don't need to flood frames here &lt;/li&gt;&#xA;&lt;li&gt;Host on vlan 3 sends frame to host on vlan 2.&lt;/li&gt;&#xA;&lt;li&gt;vlan 3 switch receives, inspects destination mac and sends frame out of it's vlan 3 access port across to vlan 2 access port of opposite switch as the MAC table directs.&lt;/li&gt;&#xA;&lt;li&gt;vlan 2 switch inspects destination mac and looks up mac table which directs to vlan 2 port of host.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;HTH.&lt;/p&gt;&#xA;" OwnerUserId="168" LastEditorUserId="3191" LastEditDate="2014-06-22T06:28:10.927" LastActivityDate="2014-06-22T06:28:10.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9514" PostTypeId="1" CreationDate="2014-06-22T08:28:33.977" Score="5" ViewCount="564" Body="&lt;p&gt;I'm trying to formulate a way to send Ipv6 address to users in my network &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm doing a project where I need to mitigate an attack: The scenario is a user is using SLAAC to genarate its adress but the user is being attack by a DOS on DAD so that it would not use the generated IP Address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a approach to detect but do not have a way to mitigate the attack, a way I can give the user Ipv6 Adress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first theory is using DHCPv6 packet which I will craft and inject in the network, but I'm not sure if it is possible for a client to accept the packet because it does not have any DHCP Server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from that I do not have any leads or clue on how can I approach the problem&lt;/p&gt;&#xA;" OwnerUserId="6198" LastActivityDate="2014-06-24T08:36:20.617" Title="Is it possible to force DHCPv6 to configure address of a client without DHCP Server?" Tags="|ipv6|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9516" PostTypeId="2" ParentId="9514" CreationDate="2014-06-22T08:53:13.590" Score="2" Body="&lt;p&gt;No, I don't think this is possible. You always need a client and a server for DHCP(v6). And DHCPv6 should do DAD as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Monitoring DAD traffic and talking to the user (or ban him from your network, fire him, ...)   sending it.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorDisplayName="user2084" LastEditDate="2014-06-22T09:03:32.043" LastActivityDate="2014-06-22T09:03:32.043" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9519" PostTypeId="1" AcceptedAnswerId="9532" CreationDate="2014-06-22T09:42:18.143" Score="10" ViewCount="938" Body="&lt;p&gt;Studying IPv6 addressing I haven't understood IPv6 aggregable global unicast addresses, I mean on  &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291&lt;/a&gt; there is a generic scheme:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|         n bits         |   m bits  |       128-n-m bits         |&#xA;+------------------------+-----------+----------------------------+&#xA;| global routing prefix  | subnet ID |       interface ID         |&#xA;+------------------------+-----------+----------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But looking for formats used I see in my book(Halsall) the format used is this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|  3  | 5  |  8   |    32          |       16      |          64                    |&#xA;+-----+----+------+----------------+---------------+--------------------------------+&#xA;| 010 | reg| TLA  |  NLA           |  SLA          |  interface ID                  |&#xA;+-----+----+------+----------------+---------------+--------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and in the web, for example on the &lt;a href=&quot;http://msdn.microsoft.com/en-us/library/ee494848.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;microsoft site&lt;/a&gt;, the format used is this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|  3  |     13    |     8    |       24      |    16     |      64                  |&#xA;+-----+----+------+----------+---------------+-----------+--------------------------+&#xA;| 001 |    TLA    | reserved |    NLA        |    SLA    |        interface ID      |&#xA;+-----+----+------+----------+---------------+-----------+--------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;why is there more than one format of aggregatable global unicast addresses?&lt;/li&gt;&#xA;&lt;li&gt;Are there other formats or these 2 are the only 2 defined?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="4269" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2018-12-26T05:24:17.837" Title="ipv6 Aggregatable global unicast addresses" Tags="|ip|ipv6|rfc|route-summarization|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9521" PostTypeId="2" ParentId="9519" CreationDate="2014-06-22T14:37:40.600" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2450&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2450 - Proposed TLA and NLA Assignment Rules&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Microsoft's is in line with the proposed IETF RFC 2450.  Since it's still proposed, it isn't finalized, but it's the likely end format.&lt;/p&gt;&#xA;" OwnerUserId="74" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-06-22T20:27:33.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9522" PostTypeId="2" ParentId="7536" CreationDate="2014-06-22T15:44:45.820" Score="3" Body="&lt;p&gt;WLCs are &lt;em&gt;NOT&lt;/em&gt; Radius Servers, you need an external Radius server and then point the WLCs to it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The page you are on right now is to configure credentials to actually be able to query the external radius server: IP Address &amp;amp; Ports, Shared Secret, and other connectivity options. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Radius servers are called ACS (secure Access Control System) and to TACACS as well&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-06-22T15:44:45.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9526" PostTypeId="1" AcceptedAnswerId="9533" CreationDate="2014-06-23T06:01:39.383" Score="4" ViewCount="5678" Body="&lt;p&gt;I have this simple topology -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[S1][p1]----[p2][S2]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Port p1 of switch S1 is connected to port p2 of S2. And port p2 on S2 is tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My doubt is if an LLDP packet is sent from p1 to p2, considering p2 is tagged, will the LLDP packet be processed at CPU of S2? Or will it be dropped at hardware level? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We know untagged packets which don't have 802.1Q tag in Ethernet frames are dropped on tagged ports. I wanted to know what's the behavior if the packet is LLDP.&lt;/p&gt;&#xA;" OwnerUserId="6205" LastActivityDate="2014-06-23T11:16:11.913" Title="Behavior of LLDP packets through tagged port" Tags="|ethernet|lldp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9532" PostTypeId="2" ParentId="9519" CreationDate="2014-06-23T10:25:42.797" Score="8" Body="&lt;h3&gt;TLA/NLA structure for IPv6 addresses&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The TLA/NLA allocation structure has been deprecated in &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=3587&quot; rel=&quot;noreferrer&quot;&gt;RFC 3587&lt;/a&gt;, August 2003:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2.  TLA/NLA Made Historic&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The TLA/NLA scheme has been replaced by a coordinated allocation policy &#xA;      defined by the Regional Internet Registries (RIRs) [&lt;a href=&quot;http://www.ripe.net/ripe/docs/ipv6policy.html&quot; rel=&quot;noreferrer&quot;&gt;IPV6RIR&lt;/a&gt;].&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Part of the motivation for obsoleting the TLA/NLA structure is&#xA;      technical; for instance, there is concern that TLA/NLA is not the&#xA;      technically best approach at this stage of the deployment of IPv6.&#xA;      Moreover, the allocation of IPv6 addresses is related to policy and&#xA;      to the stewardship of the IP address space and routing table size,&#xA;      which the RIRs have been managing for IPv4.  It is likely that the&#xA;      RIRs' policy will evolve as IPv6 deployment proceeds.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The IETF has provided technical input to the RIRs (for example,&#xA;      [&lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=3177&quot; rel=&quot;noreferrer&quot;&gt;RFC3177&lt;/a&gt;]), which the RIRs have taken into account when defining&#xA;      their address allocation policy.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=2374&quot; rel=&quot;noreferrer&quot;&gt;RFC 2374&lt;/a&gt; was the definition of addresses for Format Prefix 001&#xA;      (2000::/3) which is formally made historic by this document.  Even&#xA;      though currently only 2000::/3 is being delegated by the IANA,&#xA;      implementations should not make any assumptions about 2000::/3 being&#xA;      special.  In the future, the IANA might be directed to delegate&#xA;      currently unassigned portions of the IPv6 address space for the&#xA;      purpose of Global Unicast as well.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Subnet Local Aggregator (SLA) field in &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=2374&quot; rel=&quot;noreferrer&quot;&gt;RFC 2374&lt;/a&gt; remains in&#xA;      function but with a different name in [&lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=3513&quot; rel=&quot;noreferrer&quot;&gt;ARCH&lt;/a&gt;].  Its new name is&#xA;      &quot;subnet ID&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As can be seen in the last paragraph, the &lt;strong&gt;SLA&lt;/strong&gt; has survived from the three, now being called &lt;strong&gt;subnet ID&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think they should have obsoleted &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=2450&quot; rel=&quot;noreferrer&quot;&gt;RFC 2450&lt;/a&gt; together with &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=2374&quot; rel=&quot;noreferrer&quot;&gt;RFC 2374&lt;/a&gt; in &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=3587&quot; rel=&quot;noreferrer&quot;&gt;RFC 3587&lt;/a&gt;. It does not make sense anymore, but it was only informational anyway.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Global Unicast prefixes&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Your book is certainly wrong on the prefix. A bit prefix of &lt;code&gt;010&lt;/code&gt; would mean the address space of &lt;code&gt;4000::/3&lt;/code&gt;, which &lt;em&gt;is&lt;/em&gt; indeed Global Unicast as to &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=4291&quot; rel=&quot;noreferrer&quot;&gt;RFC 4291&lt;/a&gt;, but does not identify the &lt;em&gt;whole&lt;/em&gt; Global Unicast range, and is not even the one currently assigned by IANA, which is only &lt;code&gt;2000::/3&lt;/code&gt; (i.e. address bits starting with &lt;code&gt;001&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, almost all addresses before &lt;code&gt;fc00::/128&lt;/code&gt; (which starts the Unique Local Unicast address range) are Global Unicast, with the exceptions of the unspecified address &lt;code&gt;::&lt;/code&gt; and the loopback address &lt;code&gt;::1&lt;/code&gt;. There are some special ranges starting with the bits &lt;code&gt;000&lt;/code&gt;, like &lt;code&gt;::ffff:0:0/96&lt;/code&gt; (IPv4-mapped IPv6 addresses) or &lt;code&gt;64:ff9b::/96&lt;/code&gt; (for IPv4/IPv6 address translation, see &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=6052&quot; rel=&quot;noreferrer&quot;&gt;RFC 6052&lt;/a&gt;). They allow Interface Identifiers with less than 64 bits. But all addresses starting with &lt;code&gt;001&lt;/code&gt; have a 64 bit Interface Identifier (see &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=4291#section-2.5.4&quot; rel=&quot;noreferrer&quot;&gt;RFC 4291, section 2.5.4&lt;/a&gt;, right from where you cited).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I can see, the definition of the address structure from &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=4291&quot; rel=&quot;noreferrer&quot;&gt;RFC 4291&lt;/a&gt; is the most current one. There are three RFCs updating 4291 (&lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=5952&quot; rel=&quot;noreferrer&quot;&gt;RFC 5952&lt;/a&gt;, &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=6052&quot; rel=&quot;noreferrer&quot;&gt;RFC 6052&lt;/a&gt;, &lt;a href=&quot;https://tools.ietf.org/rfcmarkup?doc=7136&quot; rel=&quot;noreferrer&quot;&gt;RFC 7136&lt;/a&gt;), but none of them changes this structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that the [&lt;a href=&quot;http://www.ripe.net/ripe/docs/ipv6policy.html&quot; rel=&quot;noreferrer&quot;&gt;IPV6RIR&lt;/a&gt;] reference points to the IPv6 registry policies, currently being &lt;a href=&quot;http://www.ripe.net/ripe/docs/ripe-589&quot; rel=&quot;noreferrer&quot;&gt;ripe-589&lt;/a&gt; which is &quot;developed through joint discussions among the APNIC, ARIN and RIPE communities.&quot;&lt;/p&gt;&#xA;" OwnerUserId="2076" LastEditorUserId="2076" LastEditDate="2014-06-23T10:52:32.137" LastActivityDate="2014-06-23T10:52:32.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9533" PostTypeId="2" ParentId="9526" CreationDate="2014-06-23T11:16:11.913" Score="3" Body="&lt;p&gt;It depends on the hardware involved. Juniper for example will &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB23996&quot; rel=&quot;nofollow&quot;&gt;drop the LLDP packets&lt;/a&gt; when there is no native VLAN configured (a VLAN in which all untagged traffic will be forwarded in).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco for example will always send the LLDP tagged in VLAN 1. Juniper itself sends the LLDP untagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it highly depends on your gear.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-06-23T11:16:11.913" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9534" PostTypeId="2" ParentId="8283" CreationDate="2014-06-23T11:23:44.077" Score="1" Body="&lt;p&gt;Lets start with your stated question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to have 60 hosts on a 255.255.255.248 network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you may have expected, the answer is no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@null's answer &lt;strong&gt;to the question you asked&lt;/strong&gt; is correct and I do not understand why it was downvoted. With a /29 you have (32-29=) 3 bits for your own local networking. That is 2&lt;sup&gt;3&lt;/sup&gt; addresses.  You want one of those as broadcast adress, one as network adress &lt;sup&gt;*1&lt;/sup&gt; and one for your gateway. That leaves you with 5 IPs which can communicate directly with the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The keyword here is &lt;strong&gt;directly&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a perfect world you would have more than enough IP addresses to give each device their own IP. And you would use on of them for a firewall which you would put between the gateway and your internal network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly it is not a perfect world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Free IP v4 addresses are getting scarce. There are two ways around that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Do not use IP v4 but switch to IP v6&lt;/li&gt;&#xA;&lt;li&gt;Use an ugly hack called NAT/PAT.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The latter is probably the easiest way to get all your 60 devices connected to a local LAN with non-public IPs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR&gt;&lt;HR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;*1&lt;/sup&gt;: You might get away with not using the last. But it might break compatability with a lot of devices and it will give you headache when people assume that both .0 and .255 (or rather, in your case .192 and .199) are used in the traditional way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;*2&lt;/sup&gt;Please make sure you use non public IPs. E.g. 172.16.130.x. See RFC1918 for more information on these IPs. And pick a range which is not commonly used. That will prevent problems later on when people start trying different NAT area's to one &lt;/p&gt;&#xA;" OwnerUserId="560" LastEditorUserId="560" LastEditDate="2014-12-08T23:51:52.137" LastActivityDate="2014-12-08T23:51:52.137" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9535" PostTypeId="1" AcceptedAnswerId="9545" CreationDate="2014-06-23T13:14:11.500" Score="8" ViewCount="1839" Body="&lt;p&gt;I have a &lt;a href=&quot;http://www.avagotech.com/pages/en/fiber_optics/parallel_optics/4-channel_transceivers/afbr-79eidz/&quot;&gt;40GBASE-SR4 QSFP transceiver&lt;/a&gt; which can be used for 4x10G SFP+ communications using a 40G QSFP+ to 4x10G SFP+ multi-mode optical spliter. I am looking for an LR (single-mode) equivalent of this SR transceiver, but can't find any.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I fear that fundamentally 40GBASE-LR4 cannot be used for 4x10G because the data is delivered as four wavelengths over the same fiber, whereas 40GBASE-SR4 can be used for 4x10G because the data is delivered over four parallel fiber lanes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can 40GBASE-LR4 be used for 4x10G?&lt;/p&gt;&#xA;" OwnerUserId="6208" LastEditorUserId="6208" LastEditDate="2014-06-23T14:01:56.987" LastActivityDate="2017-06-05T14:54:25.933" Title="Can 40GBASE-LR4 be used for 4x10G?" Tags="|10gbase|transceiver|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9537" PostTypeId="1" AcceptedAnswerId="9541" CreationDate="2014-06-23T14:40:17.313" Score="6" ViewCount="34012" Body="&lt;p&gt;I have three Cisco 2960G switches that I pulled from a working environment. All three of them are experiencing the same problem, so I have a hard time believing they have all simply failed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I plug in the power, all the ports lights flash once and the SYST, RPS, STAT, DUPLX and SPEED lights come on for a second. Then all the lights turn off, except for the SYST light which stays green. Nothing ever appears on the serial console. Holding the Mode button while applying power does nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I really have 3 switches that all died at the same time?&lt;/p&gt;&#xA;" OwnerUserId="2128" LastActivityDate="2019-06-07T19:32:20.617" Title="cisco 2960G won't boot and no console output" Tags="|cisco-catalyst|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9538" PostTypeId="1" CreationDate="2014-06-23T14:49:09.093" Score="10" ViewCount="7451" Body="&lt;p&gt;I am trying to understand how the architecture works in case of NIC Bonding. The scenario is: There are 2 NICs on the same system. Both are bonded to support failover and load balancing. Hence the IP of the bond driver(virtual) is the IP to which traffic comes when target to any of the NICs. Each NIC is connected to a different switch. Now because these NIC are bonded the switches will have the same IP address pointing to different MAC address. So how will a router decide which switch to forward an incoming request to which is intended for that IP? Will there be 2 entries in the routing table for the same IP address? Will the router broadcast to all switches? Will there be more than one router?&lt;/p&gt;&#xA;" OwnerUserId="6211" LastEditorUserId="775" LastEditDate="2014-06-23T17:16:37.297" LastActivityDate="2014-06-23T17:16:37.297" Title="If two NICs are bonded and connected to different switches how does a router decide which switch to forward the packets to?" Tags="|router|switch|ipv4|ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9539" PostTypeId="2" ParentId="9538" CreationDate="2014-06-23T14:55:03.393" Score="14" Body="&lt;p&gt;It depends on how the interfaces are bonded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to do this is that only one NIC is really active. If one of the links goes down, then the other NIC starts using the MAC address of the first NIC, or the system issues a gratuitous ARP with its MAC address to get everyone to update their ARP tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A close second to this method is that both NICs are used to send, but only one is used to receive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other configuration requires the cooperation of the switches or the sending parties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that unless the switch and the end device agree on a configuration, you could get some bad behavior. For example, the switch might not know which port actually has which MAC and will instead flood ALL traffic for that MAC. Or you could get a non-functional link.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Since you are using Adaptive Load Balancing, I will explain this mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Outgoing packets are split based on load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Incoming packets are a bit trickier. When an ARP request is received, the MAC sent back is based on the requester's IP address. For example, if client A send an ARP request for your IP, it will get the MAC of NIC 1. Later when client B sends an ARP request, it will get the MAC of NIC 2. That way clients are split among the available NIC's.&lt;/p&gt;&#xA;" OwnerUserId="2128" LastEditorUserId="2128" LastEditDate="2014-06-23T15:50:29.170" LastActivityDate="2014-06-23T15:50:29.170" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9541" PostTypeId="2" ParentId="9537" CreationDate="2014-06-23T17:47:20.373" Score="7" Body="&lt;p&gt;Open a TAC case as these may be affected by this &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/field-notices/637/fn63744.html&quot;&gt;Field Notice&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This revolves around a known memory issue by parts from a particular supplier that have a high failure rate.  These parts have been included in many different platforms including many models of the 2960 line.  You can find the main page discussing this issue and providing a number of field notices &lt;a href=&quot;http://www.cisco.com/web/about/doing_business/memory.html&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, the failure can occur during normal operation, but won't interrupt service.  It is only after the devices have been power cycled that they fail to boot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically to your issue, would be this excerpt:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The failure symptom is observed when the switch fails to boot up with&#xA;  no console response (no characters are written to the console).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-06-23T17:47:20.373" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9542" PostTypeId="1" AcceptedAnswerId="9706" CreationDate="2014-06-23T18:31:47.360" Score="6" ViewCount="848" Body="&lt;p&gt;I need a little bit of help to understand what Information the ipNetToPhysicalEntry OID 1.3.6.1.2.1.4.35.1 exactly includes. I thought its a combination between the Neighbor Cache and the ARP Cache, but when i read this OID over, lets say snmpwalk, i don´t get everything whats inside my Routers Neighbor Cache and ARP Cache. What are the criteria which information is inside and which not? And where can I see the definition for that ?&lt;/p&gt;&#xA;" OwnerUserId="6214" LastEditorUserId="6214" LastEditDate="2014-06-23T18:38:42.093" LastActivityDate="2014-07-01T18:55:18.400" Title="Need help to understand whats transmited over SNMP when i use the ipNetToPhysicalEntry OID" Tags="|cisco|snmp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9545" PostTypeId="2" ParentId="9535" CreationDate="2014-06-23T21:47:31.380" Score="8" Body="&lt;p&gt;You are correct. SR4 works because it's four fibres. LR4 doesn't because it's four lambdas. Even if you break out each one -- good luck finding 10G-LR optics at the exact wavelengths LR4 requires, the module itself doesn't support operating at 4x10G -- the data rate on most is 40G only.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-23T21:47:31.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9546" PostTypeId="1" AcceptedAnswerId="10258" CreationDate="2014-06-24T00:09:02.970" Score="2" ViewCount="571" Body="&lt;p&gt;The Cisco 2811 at work employs approximately 10~12 phones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of the phones are displaying caller id though every line is configured for it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;voice-port 0/0/0&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/1&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/2&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/3&#xA; connection plar opx 2000&#xA; caller-id enable &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everyone is also experiencing dropped calls, where the line will immediately terminate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This isn't a live &lt;code&gt;show config&lt;/code&gt; of the router. It's a previous config that was taken when everything was functional. I'll double check the config in the morning but does anyone have any idea why this would begin to happen out of the blue? The router is on a backup power supply but even if it did restart shouldn't it load from the &lt;code&gt;startup-config&lt;/code&gt; which I copied from the running config.&lt;/p&gt;&#xA;" OwnerUserId="2584" LastActivityDate="2014-08-02T18:05:32.080" Title="Calls Dropping, Phone Line Missing, Caller ID Not Functional on Cisco 2811 CME" Tags="|cisco|router|cisco-7900-ip-phones|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9547" PostTypeId="1" AcceptedAnswerId="9550" CreationDate="2014-06-24T05:54:06.417" Score="5" ViewCount="1703" Body="&lt;p&gt;So recently I discovered DHCPv6 needed Duplicate Address Detection but why is that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a hard time researching on this topic, most answers is that because it needs first to check but I can't see why. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also if you guys have a wireshark file that contains the DAD of DHCPv6, can I have a copy? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My team needs to disect it and learn what is the difference between the message from SLAAC&#xA;we are planning to make a DHCPv6 SetUp but it will take too long because we do not have the right equipment right now.&lt;/p&gt;&#xA;" OwnerUserId="6198" LastEditorUserId="5129" LastEditDate="2014-06-24T12:45:21.703" LastActivityDate="2015-01-08T11:08:31.583" Title="Can someone prove me why DHCPv6 needs DAD?" Tags="|ipv6|dhcpv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9550" PostTypeId="2" ParentId="9547" CreationDate="2014-06-24T06:58:31.953" Score="7" Body="&lt;p&gt;DAD checks if the IPv6 address you try to use is already taken by another device. It works over the Neighbor Discovery Protocol, exactly over the Neighbor Advertisement Portion of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DAD of DHCPv6 is the same than the DAD of SLAAC. Inside DHCPv6 you use the DAD 2 times. First for your link-local address before you start DHCPv6 and than with the address you try to use over DHCPv6.&lt;/p&gt;&#xA;" OwnerUserId="6214" LastActivityDate="2014-06-24T06:58:31.953" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="9551" PostTypeId="2" ParentId="9514" CreationDate="2014-06-24T08:36:20.617" Score="0" Body="&lt;p&gt;Why do you not use Secure Neighbor Discovery ? I did not used it until know, but I think you can DAD over the SNDP ? And you can send the SLAAC Router Advertisements over SNDP ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or am I wrong ?&lt;/p&gt;&#xA;" OwnerUserId="6214" LastActivityDate="2014-06-24T08:36:20.617" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9553" PostTypeId="2" ParentId="9547" CreationDate="2014-06-24T09:57:43.633" Score="8" Body="&lt;p&gt;Every time a system starts to use a new IPv6 address (doesn't matter whether it is the link-local address, generated by SLAAC, provisioned using DHCPv6 or in some other way) it does Duplicate Address Detection, DAD, to check if the new address does not conflict with another device on the same link. There are usually settings on a system to disable DAD, but then you risk having addressing conflicts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exception are addresses configured as anycast addresses, because those are supposed to be configured on multiple devices at the same time. &lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="632" LastEditDate="2015-01-08T11:08:31.583" LastActivityDate="2015-01-08T11:08:31.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9557" PostTypeId="1" AcceptedAnswerId="9642" CreationDate="2014-06-24T11:28:05.160" Score="7" ViewCount="1059" Body="&lt;p&gt;The topology diagram below shows multiple CPE devices, each has multiple WAN sub-interface that are dot1q tagged as VLAN 10 and 20 in this example. The PE ME3600 devices has an SVI with an IP address in a /24 range in VLAN 20 and each CPE has a WAN interface encapsualted in VLAN 20 within the same /24. This topology is all configured an working just fine. A CPE can ping .1 and the PE can ping .10 for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer 2 aggregation device adds a QinQ outer tag to each CPE connection so that at the PE device each layer 2 connection can be differenciated between despite trunking the same VLANs to each CPE with their IPs being in a /24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/x4qGP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The config the ME3600 port is as follows;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; switchport trunk allowed vlan none&#xA; switchport mode trunk&#xA; service instance 11 ethernet&#xA;  description cust1-LAN&#xA;  encapsulation dot1q 101 second-dot1q 10&#xA;  rewrite ingress tag pop 2 symmetric&#xA;  bridge-domain 10&#xA; !&#xA; service instance 101 ethernet&#xA;  description cust1-MGMT&#xA;  encapsulation dot1q 101 second-dot1q 20&#xA;  rewrite ingress tag pop 2 symmetric&#xA;  bridge-domain 20&#xA; !&#xA; service instance 12 ethernet&#xA;  description cust2-LAN&#xA;  encapsulation dot1q 102 second-dot1q 10&#xA;  rewrite ingress tag pop 2 symmetric&#xA;  bridge-domain 10&#xA; !&#xA; service instance 102 ethernet&#xA;  description cust21-MGMT&#xA;  encapsulation dot1q 102 second-dot1q 20&#xA;  rewrite ingress tag pop 2 symmetric&#xA;  bridge-domain 20&#xA; !&#xA;interface Vlan20&#xA; ip address 10.10.10.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I want to know is&lt;/strong&gt;;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I see the outer tag the ME3600 will apply to frames sent out towards one of the CPEs, lets say 10.10.10.10? Something like &lt;code&gt;show ip cef exact-route&lt;/code&gt; or &lt;code&gt;show ip arp&lt;/code&gt; that shows the path the traffic will take through the EFPs and EVC back towards the CPE?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The test scenario is that I want to see what outer tag will be applied by the PE device when sending taffic to 10.10.10.15, the 2nd CPE (which allows me to verify that 10.10.10.15 came in on VLAN 102 and was correctly encapsulated from the downstream layer 2 aggregation device which is not Cisco and out of the scope of this question - I'm looking solely at the ME3600)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I look at the ARP entry for the CPE 10.10.10.10 for example I get output like the following;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip arp 10.10.10.10&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  10.10.10.10             4   0001.1111.1111  ARPA   Vlan20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the QinQ scenario above the sevice instance under gi0/1 strips off outer VLAN 100 and inner VLAN 20 then bridges to SVI 20. The 3600 must have recorded the way that traffic came in through the EVC to send it back, where can I see that?&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2014-06-24T11:51:04.763" LastActivityDate="2014-06-27T10:37:20.170" Title="Cisco: Is it possible to see an EFP path within an EVC?" Tags="|cisco|layer2|evc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9558" PostTypeId="2" ParentId="9535" CreationDate="2014-06-24T11:54:24.883" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://www.flexoptix.net/en/qsfp-plus-parallel-lr4-transceiver-40-gigabit-sm-1310nm-10km-7db-ddm-dom.html&quot; rel=&quot;nofollow&quot;&gt;This transceiver&lt;/a&gt; can do both 40G-LR4 and 4x40G LR.&lt;/p&gt;&#xA;" OwnerUserId="6208" LastActivityDate="2014-06-24T11:54:24.883" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9559" PostTypeId="5" CreationDate="2014-06-24T12:25:33.563" Score="0" Body="&lt;p&gt;An Ethernet Virtual Connection (EVC) is defined by the Metro-Ethernet Forum (MEF) as an association between two or more user network interfaces that identifies a point-to-point or multipoint-to-multipoint path within the service provider network. An EVC is a conceptual service pipe within the service provider network. A bridge domain is a local broadcast domain that is VLAN-ID-agnostic. An Ethernet flow point (EFP) service instance is a logical  nterface that connects a bridge domain to a physical port or to an EtherChannel group in a switch. An EVC broadcast domain is determined by a bridge domain and the EFPs that are connected to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/configuration/guide/sy_swcg/ethernet_virtual_connection.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/configuration/guide/sy_swcg/ethernet_virtual_connection.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="7495" LastEditDate="2014-07-15T11:46:29.203" LastActivityDate="2014-07-15T11:46:29.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9560" PostTypeId="4" CreationDate="2014-06-24T12:25:33.563" Score="0" Body="Ethernet virtual circuits (EVCs) define a Layer 2 bridging architecture that supports Ethernet services." OwnerUserId="7495" LastEditorUserId="7495" LastEditDate="2014-07-15T11:46:42.707" LastActivityDate="2014-07-15T11:46:42.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9568" PostTypeId="2" ParentId="6329" CreationDate="2014-06-24T18:05:55.410" Score="9" Body="&lt;p&gt;From &quot;OSPF: Anatomy of a Routing Protocol&quot; by John Moy, who wrote much of the OSPF specification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exchange of routing information between areas is essentially Distance Vector.  With Distance Vector, the larger number of redundant paths you have the worse your convergence properties get.  OSPF requires all areas to attach directly to the backbone so it limits the topology to a simple hub and spoke topology.  This eliminates redundant paths and prevents it from being subjected to 'count to infinity' problems. &lt;/p&gt;&#xA;" OwnerUserId="6238" LastEditorUserId="4077" LastEditDate="2018-08-21T01:53:54.770" LastActivityDate="2018-08-21T01:53:54.770" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="9571" PostTypeId="1" AcceptedAnswerId="9575" CreationDate="2014-06-24T21:04:45.383" Score="19" ViewCount="10832" Body="&lt;p&gt;I am preparing for ICND1 exams and recently started to learn about different Cisco devices.&#xA;I have just come to know how the packet is generated to be transmitted over a network, or outside the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example,&#xA;When the packet is generated, it adds source IP address, Destination IP address, Source Mac address, destination mac address, and other data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since Switch is a layer 2 device, and it uses MAC addresses to interact with other Hosts within the Network, then why do we use IP addresses within our local networks ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if someone do not need to connect to any host or network outside its own network, Why do he still needs to have an IP address, isn't MAC address is enough ?&lt;/p&gt;&#xA;" OwnerUserId="3821" LastEditorUserId="775" LastEditDate="2014-06-25T01:14:52.993" LastActivityDate="2020-02-14T01:04:32.117" Title="Why use IP if we already have a MAC address?" Tags="|ipv4|ethernet|" AnswerCount="6" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9572" PostTypeId="2" ParentId="9571" CreationDate="2014-06-24T21:14:50.913" Score="10" Body="&lt;p&gt;(not this again)&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Layer 2 vs. Layer 3&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;IP works at layer 3. It is carried over ethernet (layer 2) which uses MACs to identify nodes. Use a different layer 2 (say, ATM) and you won’t have MACs. (Or use a different layer 3, say IPX, and you won’t have IP.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="1532" LastEditDate="2014-07-21T11:57:16.867" LastActivityDate="2014-07-21T11:57:16.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9574" PostTypeId="1" CreationDate="2014-06-24T22:54:31.473" Score="3" ViewCount="1296" Body="&lt;p&gt;I'm trying to setup a Site-to-Site VPN between a Cisco device and a Juniper SSG device. I have the Juniper setup in L3 mode with routed interfaces. For some reason it is not getting past phase 1. I can ping the public IP of the other side fine. Here is one possible reason that phase 1 isn't getting established:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  **** pak processing end.&#xA;## 2014-06-25 01:58:36 : IKE&amp;lt;y.y.y.y&amp;gt; re-trans timer expired, msg retry (6) (0001/0)&#xA;## 2014-06-25 01:58:36 : IKE&amp;lt;y.y.y.y&amp;gt; Initiator sending IPv4 IP y.y.y.y/port 500&#xA;## 2014-06-25 01:58:36 : IKE&amp;lt;y.y.y.y&amp;gt; Send Phase 1 packet (len=160)&#xA;****** 22134.0: &amp;lt;Self/self&amp;gt; packet received [188]******&#xA;  ipid = 58582(e4d6), @03c2ada4&#xA;flow_self_vector2: send pack with current vid =0, enc_size:0&#xA;  handle raw/no_session packet.&#xA;  send no session packet&#xA;  flow_if_ip_send_fwd: switch vectors: packet src x.x.x.x, dst  y.y.y.y&#xA;&#xA;**** jump to packet:x.x.x.x-&amp;gt;y.y.y.y&#xA;  skipping pre-frag &#xA;  no more encapping needed&#xA;  send out through normal path.&#xA;  flow_ip_send: e4d6:x.x.x.x-&amp;gt;y.y.y.y,17 =&amp;gt; ethernet0/9(188) flag 0x8000890, vlan 0&#xA;  no l2info for packet.&#xA;  no route for packet&#xA;  search route to (null, 0.0.0.0-&amp;gt;y.y.y.y) in vr trust-vr for vsd-0/flag-2000/ifp-ethernet0/9&#xA;  [ Dest] 7.route y.y.y.y-&amp;gt;x.x.x.gw, to ethernet0/9&#xA;  route to x.x.x.gw&#xA;  arp entry found for x.x.x.gw mac 00000c07ac00&#xA;  packet send out to 00000c07ac00 through ethernet0/9&#xA;  **** pak processing end.&#xA;****** 22136.0: &amp;lt;Self/self&amp;gt; packet received [44]******&#xA;  ipid = 58585(e4d9), @03bb8814&#xA;flow_self_vector2: send pack with current vid =0, enc_size:0&#xA;  handle raw/no_session packet.&#xA;  send no session packet&#xA;  flow_if_ip_send_fwd: switch vectors: packet src x.x.x.x, dst  y.y.y.y&#xA;&#xA;**** jump to packet:x.x.x.x-&amp;gt;y.y.y.y&#xA;  skipping pre-frag &#xA;  going into tunnel 40000003.&#xA;  flow_encrypt: pipeline.&#xA;enqueue to IKE: timems 22128004, Q 1, saidx 1: spi:0 too soon&#xA;  packet dropped, SA inactive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;x.x.x.x is the interface IP of the Juniper and y.y.y.y is the Cisco interface IP. x.x.x.gw is the gateway address that the default route on the device is pointing to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the output of the command &lt;code&gt;get ike cookie&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SSG140-&amp;gt; get ike cookie&#xA;&#xA;IKEv1 SA -- Active: 0, Dead: 0, Total 1&#xA;&#xA;0001/0000, x.x.x.x:500-&amp;gt;y.y.y.y:500, NONE/grp0/NULL/NULL, xchg(2) (vpn_gateway/grp-1/usr-1)&#xA;resent-tmr 39 lifetime 28800 lt-recv 0 nxt_rekey 28790 cert-expire 0&#xA;initiator, err cnt 2, send dir 0, cond 0x0&#xA;nat-traversal map not available&#xA;ike heartbeat              : disabled&#xA;ike heartbeat last rcv time: 0&#xA;ike heartbeat last snd time: 0&#xA;XAUTH status: 0&#xA;DPD seq local 0, peer 0&#xA;&#xA;p2_tasks:&#xA;&#xA;task_type = 0x3&#xA;p2 sa id = 0x3 (index 0x1)&#xA;app_sa_flags = 0x5000a0&#xA;p2 spi = 0x0&#xA;&#xA;&#xA;IKEv2 SA -- Active: 0, Dead: 0, Total 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Cisco TAC rep said that their device is sending packets fine but are not receiving any from the Juniper device.  From the output above, it looks like the packets from the Juniper to the Cisco are being dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the Cisco config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;name c.c.c.c MAP_110_SIAS_PEER&#xA; crypto isakmp policy 110&#xA; authentication pre-share&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA; crypto isakmp enable OUTSIDE&#xA;tunnel-group c.c.c.c type ipsec-l2l&#xA;tunnel-group c.c.c.c ipsec-attributes&#xA;pre-shared-key xxxxxxx&#xA; access-list MAP_110_TRU_SIAS extended permit ip 162.137.0.0 255.255.0.0 10.1.19.0 255.255.255.0 &#xA;access-list MAP_110_TRU_SIAS extended permit ip 10.0.0.0 255.0.0.0 10.1.19.0 255.255.255.0 &#xA;access-list MAP_110_TRU_SIAS extended permit ip 206.70.0.0 255.255.192.0 10.1.19.0 255.255.255.0&#xA; crypto ipsec transform-set ESP-AES128-SHA esp-aes esp-sha-hmac&#xA; crypto map MAP-OUTSIDE 110 set peer MAP_110_TRU_SIAS&#xA; crypto map MAP-OUTSIDE 110 match address MAP_110_TRU_SIAS&#xA; crypto map MAP-OUTSIDE 110 set transform-set AES-SHA&#xA; crypto map MAP-OUTSIDE 110 set security-association lifetime kilobytes 10000&#xA; crypto map MAP-OUTSIDE interface OUTSIDE&#xA; route outside 10.1.19.0 255.255.255.192 MAP_110_SIAS_PEER&#xA;route outside MAP_110_SIAS_PEER 255.255.255.255 d.d.d.d &#xA; access-list ACL-INSIDE-NONAT extended permit ip 10.0.0.0 255.0.0.0 10.1.19.0 255.255.255.0 &#xA;access-list ACL-INSIDE-NONAT extended permit ip 206.70.0.0 255.255.192.0 10.1.19.0 255.255.255.0&#xA;access-list ACL-INSIDE-NONAT extended permit ip 162.137.0.0 255.255.0.0 10.1.19.0 255.255.255.0 &#xA;  nat (INSIDE) 0 access-list ACL-INSIDE-NONAT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Relevant Juniper config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set ike gateway &quot;vpn_gateway&quot; address t.t.t.t Main outgoing-interface &quot;ethernet0/9&quot; preshare &quot;xxxxxxxx&quot; proposal &quot;pre-g2-aes128-sha&quot; &quot;pre-g2-aes128-md5&quot; &quot;rsa-g2-aes128-sha&quot; &quot;dsa-g2-aes128-sha&quot;&#xA;&#xA;set vpn &quot;vpn&quot; gateway &quot;vpn_gateway&quot; no-replay tunnel idletime 0 proposal &quot;g2-esp-aes128-sha&quot; &#xA;&#xA;set policy id 8 from &quot;Untrust&quot; to &quot;Trust&quot;  &quot;10.0.0.0/8&quot; &quot;10.1.19.0/24&quot; &quot;ANY&quot; tunnel vpn &quot;vpn&quot; id 0x3 pair-policy 7 &#xA;set policy id 8&#xA;exit         &#xA;set policy id 7 from &quot;Trust&quot; to &quot;Untrust&quot;  &quot;10.1.19.0/24&quot; &quot;10.0.0.0/8&quot; &quot;ANY&quot; tunnel vpn &quot;vpn&quot; id 0x3 pair-policy 8 &#xA;set policy id 7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me out?&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="453" LastEditDate="2017-09-15T02:58:31.183" LastActivityDate="2017-10-15T03:01:02.833" Title="Juniper to Cisco IPSec Policy Based VPN" Tags="|vpn|juniper|ipsec|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9575" PostTypeId="2" ParentId="9571" CreationDate="2014-06-25T01:45:37.193" Score="23" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Since Switch is a layer 2 device, and it uses MAC addresses to interact with other Hosts within the Network, then why do we use IP addresses within our local networks?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Well let's start with what traffic you're sending.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;If&lt;/em&gt; you use a strictly layer-2 protocol inside your own LAN with no &lt;a href=&quot;http://en.wikipedia.org/wiki/Hypertext_Transfer_Protocol&quot; rel=&quot;noreferrer&quot;&gt;HTTP&lt;/a&gt;, SSL, &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_File_System&quot; rel=&quot;noreferrer&quot;&gt;NFS&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Server_Message_Block&quot; rel=&quot;noreferrer&quot;&gt;CIFS&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/ISCSI&quot; rel=&quot;noreferrer&quot;&gt;iSCSI&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/H.323&quot; rel=&quot;noreferrer&quot;&gt;H.323&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Session_Initiation_Protocol&quot; rel=&quot;noreferrer&quot;&gt;SIP&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Domain_Name_System&quot; rel=&quot;noreferrer&quot;&gt;DNS&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol&quot; rel=&quot;noreferrer&quot;&gt;ICMP&lt;/a&gt;, databases, or websockets, &lt;em&gt;then&lt;/em&gt; your proposal works just fine.  In fact, &lt;a href=&quot;http://en.wikipedia.org/wiki/Fibre_Channel_over_Ethernet&quot; rel=&quot;noreferrer&quot;&gt;FCoE&lt;/a&gt; does not rely on an IP layer... so if that's what you want, knock yourself out :-)&lt;/p&gt;&#xA;&lt;p&gt;The problem is that you just crippled 95% of the utility of most networks by removing those IP-based services.  Networks exist to share information; all operating systems on the planet share information by binding services to, and encapsulating inside IP.  That information is usually wrapped inside TCP as well.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Rhetorical question&lt;/em&gt;: Could a bunch of determined people implement TCP and UDP services directly on top of ethernet in all the major operating systems?&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Pedantic Answer&lt;/em&gt;: Yes, but that's a collosal waste of time and resources for insignificant gain.  Let's start with the basics... there is no &lt;a href=&quot;http://en.wikipedia.org/wiki/Domain_Name_System&quot; rel=&quot;noreferrer&quot;&gt;DNS&lt;/a&gt; name-service for ethernet mac-addresses.  That means unless you build it, how would you resolve URLs without IP addresses?  I doubt that anyone really wants to type &lt;code&gt;http://00c0.9b4a.fb2c/&lt;/code&gt; just so they can avoid 20 extra bytes in each packet.  This is just an example of the work required.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What if someone do not need to connect to any host or network outside its own network, Why do he still needs to have an IP address, isn't MAC address is enough?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Technically, yes.  In the real world... it's a pretty boring network without IP.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-06-25T12:56:44.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9576" PostTypeId="1" CreationDate="2014-06-25T09:17:03.787" Score="1" ViewCount="455" Body="&lt;p&gt;I have three EX2200c switches.  I want use one of them as a core switch and the other two as access layer switches.  I created VLANs on all switches, set uplink ports as trunk-mode and all others as access ports.  I also set an IP address on all VLANs on the core switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also set up DHCP on the core switch, but I can't get an IP address when computers connect to either access switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even when I manually set the IP address on the computer I can't ping hosts within the same vlan. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what did I miss ? :)&lt;/p&gt;&#xA;" OwnerUserId="6242" LastEditorUserId="1392" LastEditDate="2017-01-18T07:34:00.227" LastActivityDate="2017-01-18T07:34:00.227" Title="Juniper ex2200c" Tags="|juniper|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9577" PostTypeId="1" AcceptedAnswerId="9582" CreationDate="2014-06-25T10:59:16.433" Score="5" ViewCount="570" Body="&lt;p&gt;I am working on a small project that creates a map of your local network and I need to be able to determine if X.X.X.X is a router or a device connected to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My original strategy was to use nmap and using the result of &lt;code&gt;Device type&lt;/code&gt; to determine if the device was a router or a computer connected to the network but when I ran this at home using my router as the target IP it returns &lt;code&gt;general purpose&lt;/code&gt; rather than &lt;code&gt;router&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any accurate ways to remotely determine if X.X.X.X is a router or not?&lt;br&gt;&#xA;Could I be using nmap better? I used &lt;code&gt;nmap -O -v X.X.X.X&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="6245" LastEditorUserId="3191" LastEditDate="2014-06-26T06:58:44.457" LastActivityDate="2014-06-26T06:58:44.457" Title="Is there a way to find out if a specific device is a router?" Tags="|router|ipv4|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9578" PostTypeId="2" ParentId="9577" CreationDate="2014-06-25T11:05:58.173" Score="2" Body="&lt;p&gt;If you ever worked with SNMP you could try the sysObjectID &#xA;OID 1.3.6.1.2.1.1.2 to get Information about your device. But I´m not sure if your home Router is able to speak SNMP or not.&lt;/p&gt;&#xA;" OwnerUserId="6214" LastActivityDate="2014-06-25T11:05:58.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9581" PostTypeId="2" ParentId="9577" CreationDate="2014-06-25T12:59:35.023" Score="2" Body="&lt;p&gt;There's no accurate way, but you can infer it from other things. In addition to Eragon and Jens' ideas, you could sniff traffic on the local network and look for non-local addresses. The destination MAC is the MAC of the router.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-06-25T12:59:35.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9582" PostTypeId="2" ParentId="9577" CreationDate="2014-06-25T13:40:35.567" Score="3" Body="&lt;p&gt;This may be a bit &quot;heavy handed&quot; but sometimes the simplest solutions are best.  Simply test to see if it works like a router. (Obviously, Jens Link's solution would be best for IPv6 but for IPv4 this wouldn't be as reliable.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Change the default gateway on your computer to each discovered IP address and do a traceroute to www.google.com.  Even if it routes to another IP on the same network, it is still processing traffic as a router.  Non-router devices should just drop/reject/error the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend scripting this though, as it would be quite tedious to do manually.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-06-25T13:40:35.567" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9583" PostTypeId="1" CreationDate="2014-06-25T13:47:57.353" Score="1" ViewCount="248" Body="&lt;p&gt;I was trying to set default terminal width to 0 (or longer than 80) on ASR9K router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But as seen below, once I logout and login terminal width is changed to 80.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please advise me what is wrong with me.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;RP/0/RSP0/CPU0:ASR9K(config)#line default width 0&#xA;RP/0/RSP0/CPU0:ASR9K(config)#commit&#xA;RP/0/RSP0/CPU0:ASR9K(config)#end&#xA;RP/0/RSP0/CPU0:ASR9K#sh terminal&#xA;Wed Jun 25 13:33:33.209 UTC&#xA;Line &quot;vty0&quot;, Location &quot;xxx.xxx.xxx.xxx&quot;, Type &quot;VTY&quot;&#xA;Length: 25 lines, Width: 0 columns&#xA;Baud rate (TX/RX) is 0, &quot;Empty&quot; Parity, 0 stopbits, 0 databits&#xA;Template: default&#xA;Capabilities: Timestamp Enabled&#xA;Allowed transports are telnet ssh.&#xA;RP/0/RSP0/CPU0:ASR9K#exit&#xA;Connection to ASR9K closed.&#xA;[root@server ~]# ssh ASR9K -l admin&#xA;admin@ASR9K's password:&#xA;RP/0/RSP0/CPU0:ASR9K#sh terminal&#xA;Wed Jun 25 13:34:37.904 UTC&#xA;Line &quot;vty0&quot;, Location &quot;xxx.xxx.xxx.xxx&quot;, Type &quot;VTY&quot;&#xA;Length: 25 lines, Width: 80 columns&#xA;Baud rate (TX/RX) is 0, &quot;Empty&quot; Parity, 0 stopbits, 0 databits&#xA;Template: default&#xA;Capabilities: Timestamp Enabled&#xA;Allowed transports are telnet ssh.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3285" LastActivityDate="2014-06-25T13:47:57.353" Title="ASR9K line default width 0 does not work. Any idea?" Tags="|cisco-asr|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9586" PostTypeId="2" ParentId="9577" CreationDate="2014-06-25T14:51:48.303" Score="4" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;ping the router Multicast address (IPv4: 224.0.0.2, IPv6: FF02::2). For IPv6 capable routers this is mandatory, I'm not sure about IPv4 (at least my Fritbox at home doesn't answer to 224.0.0.2). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If your devices support CDP and / or LLDP (or another network layer discovery protocol) you should see routing capability in the information provided by the protocol (note this only means that the device can act as a router, not necessarily is a router). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Scan your network via SNMP and parse the information you are getting. This may include CDP and LLDP information. There are several tools for this.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user2084" LastEditorDisplayName="user2084" LastEditDate="2014-06-25T16:06:21.510" LastActivityDate="2014-06-25T16:06:21.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9589" PostTypeId="1" AcceptedAnswerId="9593" CreationDate="2014-06-25T17:12:45.043" Score="-1" ViewCount="679" Body="&lt;p&gt;The question &quot;What is MAC for?&quot;, &quot;What is IP for?&quot;, and even &quot;What is the difference between MAC and IP?&quot; have been asked many times, even on these forums. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, there is STILL no clear explanation, of &lt;strong&gt;Why do we need both?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question has two facets:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Every device - or more specifically every network card - has a MAC address. If I want to send a message from Device A with MAC address &lt;code&gt;101&lt;/code&gt; to Device B with MAC address &lt;code&gt;102&lt;/code&gt;, why do I need to add more address systems? What does IP tell me that MAC doesn't? It's clearly not more unique than MAC. It doesn't seem to add anything special.&lt;/li&gt;&#xA;&lt;li&gt;Every device on the network has an IP address. Pretty much exactly like the above question, if we can find devices using their IP address, why do we need to add another address system like MAC address? Why isn't IP enough?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What does each one bring to the table and why do we need them both?&#xA;&lt;strong&gt;I'm looking for a clear explanation and example of why MAC alone would not work and why IP alone would not work.&lt;/strong&gt; &lt;/p&gt;&#xA;" OwnerUserId="6026" LastEditorUserId="775" LastEditDate="2014-12-08T12:55:11.003" LastActivityDate="2014-12-08T12:55:11.003" Title="Aren't MAC and IP doing the same job?" Tags="|ipv4|ethernet|mac-address|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9590" PostTypeId="2" ParentId="9577" CreationDate="2014-06-25T17:33:51.177" Score="0" Body="&lt;p&gt;One very, very inefficient way can be tracerouting all the host addresses on the network and traversing the resulting nodes into a tree structure, and then looking for your &quot;device&quot;'s position in the resulting tree. If it has leafs, you can more or less assume it does some sort of &quot;routing&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this is a sloppy approach. The device may have been configured to not respond traceroutes or any ICMP packets. Or it may just be idling there without nothing else connected to it(There can be several - needless to say; bad - reasons for this; there may be installation and cabling going on, someone may have unintentionally unplugged cables, rookies are fiddling with the network consistency, integrity, and security - that one is me.). Your traffic may hit a road block, like a firewall. Ports, hosts, protocols, devices may not be available at the moment. Moreover, topology changes in a sufficiently large network is not that uncommon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, I would &quot;reinforce&quot; my tree building algorithm. Some SNMP, LLDP, and/or CDP integration would help a lot. I would revisit each host periodically, and &quot;test&quot; it over and over to try to figure out multiple paths. Sniffing out local wireless and port mapping each host can also provide information of interest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet, at best, this will be an estimation. It will generate a lot of traffic, and may degrade network. This much traffic may also cause your end to be flagged as suspicious activity and you may - if it were a network I was managing, you would definitely - be &quot;cut&quot; from the network at the first sign of port scanning.&lt;/p&gt;&#xA;" OwnerUserId="6022" LastActivityDate="2014-06-25T17:33:51.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9591" PostTypeId="2" ParentId="9589" CreationDate="2014-06-25T17:38:50.927" Score="1" Body="&lt;p&gt;First of all, not all topologies, protocols, and devices make use of/require/have a MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second of all, there is no service for MAC addresses equivalent of DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third of all, networking is layered. MAC addresses are only meaningful on layer 2 (of OSI model) using a protocol, most likely ethernet. That is; your MAC address is only locally significant. When you leave your local, you need something else to identify yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also look into how to derive unique address using MAC address in IPv6. Not exactly &quot;one or the other&quot; kind of answer to your question, but more of an &quot;amalgamation of both&quot;.&lt;/p&gt;&#xA;" OwnerUserId="6022" LastEditorUserId="6022" LastEditDate="2014-06-25T17:44:49.690" LastActivityDate="2014-06-25T17:44:49.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9592" PostTypeId="1" CreationDate="2014-06-25T17:42:21.823" Score="3" ViewCount="10005" Body="&lt;p&gt;I understand the concept of logical address, and physical address when it comes to computer memory. That is, physical is the actual address and logical address is what the applications think the address is. The operating system that lives between the applications and the physical memory translates between the programs memory and physical memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the equivalent of this when it comes to networks? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I've read, IP addresses are Logical, and MAC addresses are Physical. What does this mean exactly? When I send something to an IP address, I'm really sending to some translator who figures out which MAC address I want to send to? Does this mean that at any given time, every MAC online is assigned to one, and only one IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you please clarify and explain, preferably with an example.&lt;/p&gt;&#xA;" OwnerUserId="6026" LastEditorUserId="775" LastEditDate="2014-12-08T12:54:45.420" LastActivityDate="2016-07-24T09:41:09.870" Title="When it comes to Computer Networks, what is a logical address and physical address?" Tags="|ipv4|ipv6|mac-address|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9593" PostTypeId="2" ParentId="9589" CreationDate="2014-06-25T17:42:21.957" Score="4" Body="&lt;p&gt;Why not MAC alone?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IP routing&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A MAC address has no information about routing contained as part of the address.  There is no grouping of systems.  Every device/router in the world would have to know about every network and single computer in the world.  That is each router would have to to keep the mac address of billions of other computers.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Because some things do not have mac addresses.  My old PPP or SLIP connection had no mac address at all.  Encapsulated PPP links between routers have no mac addresses.  VPN end points have no mac addresses.  Basically all point-to-point link technologies completely lack any unique identification.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Why not IP alone?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Because other protocols exist, and some people need to use them (i.e IPv6, IPX, etc).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="302" LastEditorUserId="6350" LastEditDate="2014-07-02T00:56:19.420" LastActivityDate="2014-07-02T00:56:19.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9594" PostTypeId="2" ParentId="9592" CreationDate="2014-06-25T18:49:40.090" Score="8" Body="&lt;p&gt;Do not try to compare networking to computer hardware.  While in some cases this could help, it is comparing apples to oranges and clearly in this case it is causing some confusion.  I think it may be best to just give a simple example to show how they are used differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say your computer (192.168.10.1) wants to talk to a host (10.1.1.10).  In this case, 10.1.1.10 is the logical destination or address you are attempting to send traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your computer however has no idea about the MAC or physical address of this server, nor does it know how to get to the logical address.  However it does have a default gateway and knows 10.1.1.10 is not on the local subnet.  So it sends the traffic to the gateway router with the logical destination of 10.1.1.10 and the physical destination of the gateway router's interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This router, will see that the logical address of the traffic is bound for another host, and will look up where it needs to send this traffic which indicates router2 is the next hop.  It then changes the physical destination to router2's interface and forwards the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router2 is directly connected to the server using IP address 10.1.1.10, so it changes the physical destination to the MAC address of the server and again forwards the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There can be number of additional routers on the path, but all through the process the logical destination address stays the same while the physical destination changes.  This is also true for source logical/physical addresses along the route.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-06-25T18:49:40.090" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9595" PostTypeId="1" AcceptedAnswerId="9814" CreationDate="2014-06-25T19:41:21.827" Score="0" ViewCount="253" Body="&lt;p&gt;I'm not a network guy, but a system administrator by background. I find myself, now, the sole IT guy at a growing business.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(This turned into a long explanation to setup the question, which is at the bottom of the post.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have four hosts in a colocation rack, two Synology NAS devices.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each host is running 2012 R2 Hyper-V.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each host has four NICs: 3 1gb and 1 10gb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We talk to the hosts via a PAN firewall/VPN, which fronts a juniper switch, using http, https, RDP, SSL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the plan for deployment was written, by a now-departed admin, we ran up a proof of concept using Debian and ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 10gb NICs were VLAN/Internal, reserved for internal use only: between the guest VMs, and to the NAS devices.  The IPs here were assigned to 10.10.1.x block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 3 1gb NICs were teamed in VLAN/External, and were used exclusively for internet traffic.  The hosts on this network were assigned IPs in our public /26 block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since then we've scaled back the number of hypervisors, switched from Debian to Server 2012 R2, added the PAN firewall/VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure the VLAN idea makes any sense, if it ever did.  We've added the Firewall at the top of the rack, and we can now NAT the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And every time I describe this setup to network pros, they sort of look funny, like it's all needlessly complicated.  I'd like to simplify this, if possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My idea is to give all hosts IPs in the same subnet, using a single VLAN.  My sticky point is this;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to continue to have each hypervisor (and each guest vm) use the 10gb NIC to talk amongst themselves, and to the NAS devices, while sending 'external' traffic (web, RDP) on the 1gb nics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will let us do the data crunching and file writing as quickly as possible, which is the whole reason for the exercise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I do that?  Use routing on the hypervisor?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By request: from my whiteboard, to tiff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0cxBs.png&quot; alt=&quot;as is and to be&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="6251" LastEditorUserId="6251" LastEditDate="2014-06-25T21:28:06.480" LastActivityDate="2014-07-07T15:16:16.300" Title="A possibly weird problem" Tags="|routing|juniper|palo-alto|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="9601" PostTypeId="2" ParentId="9589" CreationDate="2014-06-26T03:03:49.573" Score="2" Body="&lt;p&gt;1 - MAC Collision: Many manufacturers simply roll-over their MAC once they're they assign the last one.  You're never guaranteed to have a Unique MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - The Internet routing table would be Humongus (it's already &lt;em&gt;Huge&lt;/em&gt;) as you wouldn't have any ways to have &quot;bigger networks&quot; in the routing table, as each MAC is given by the Manufacturer and not the user.  It can be overwritten on some devices, but it's a pain to do network wide, and good luck to have a global addressing scheme&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 - That's not how the Protocol Stack operates.  MAC addresses are for Layer 2 communication, that is Device-to-Device (PC-2-switch, switch-2-router, PC-2-router, PC-2-WIFI) etc.  IP Addresses are for NETWORK communications (Host-2-Host, Client-2-Server, etc).  That doesn't mean that you cannot use IP to communicate on your own LAN, but just that it's not necessary for you to do so.  On the other hand, you HAVE to use a Network Protocol to go outside (IP, IPX, Appletalk, Banyan Vines, etc).  Each layer is encapsulated in the one below it: TCP Segments are in IP Packets running on Ethernet Frames (or ATM Cells, OC-x Timeslots, Token Ring Frames, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's the way things were designed before Ethernet and TCP/IP became the de-facto standard, for LAN &amp;amp; Network.  There were is &lt;em&gt;NO&lt;/em&gt; guarantee that any devices would use L2 Addresses: Point-to-Point serial links do not have MAC Addresses and there were multi-points serial technologies that didn't use MAC addresses either - some used polling with 8 bit addresses (HDLC), way shorter than a MAC address&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-06-26T03:03:49.573" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9602" PostTypeId="2" ParentId="9576" CreationDate="2014-06-26T03:20:58.103" Score="2" Body="&lt;p&gt;Here's a sample config pulled from my own home setup.  It's the DHCP, VLAN &amp;amp; Interface part of the config, you can use it as a starting point&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;system {&#xA;    services {&#xA;        dhcp {&#xA;            domain-name [put your domain];&#xA;            name-server {&#xA;                [ns1 ip];&#xA;                [ns2 ip];&#xA;            }&#xA;            pool 192.168.1.0/24 {&#xA;                address-range low 192.168.1.100 high 192.168.1.200;&#xA;                router {&#xA;                    192.168.1.1;&#xA;                }&#xA;            }&#xA;            pool 192.168.2.0/24 {&#xA;                address-range low 192.168.2.100 high 192.168.2.200;&#xA;                router {&#xA;                    192.168.2.1;&#xA;                }&#xA;            }&#xA;            pool 192.168.3.0/24 {&#xA;                address-range low 192.168.3.100 high 192.168.3.200;&#xA;                router {&#xA;                    192.168.3.1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        description &quot;Access Switch 1&quot;;&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members [ VLAN1 VLAN2 VLAN3 ];&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        description &quot;Access Switch 2&quot;;&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members [ VLAN1 VLAN2 VLAN3 ];&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 1 {&#xA;            family inet {&#xA;                address 192.168.1.1/24;&#xA;            }&#xA;        }&#xA;        unit 2 {&#xA;            family inet {&#xA;                address 192.168.2.1/24;&#xA;            }&#xA;        }&#xA;        unit 3 {&#xA;            family inet {&#xA;                address 192.168.3.2/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;vlans {&#xA;    VLAN1 {&#xA;        vlan-id 1;&#xA;        l3-interface vlan.1;&#xA;    }&#xA;    VLAN2 {&#xA;        vlan-id 2;&#xA;        l3-interface vlan.2;&#xA;    }&#xA;    VLAN3 {&#xA;        vlan-id 3;&#xA;        l3-interface vlan.3;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-06-26T03:20:58.103" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9604" PostTypeId="1" AcceptedAnswerId="9608" CreationDate="2014-06-26T06:02:34.500" Score="1" ViewCount="3607" Body="&lt;p&gt;I was assigned to capture the packets which are used in CSMA/CD protocol over the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have googled around for more than a day but haven't found any solution or related work that negotiate how to set up the environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to simulate by using 3 computers connected to the same router by wired (Airport Extreme) I called them station A, B, and C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I install and used the wireshark on these stations to capture the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I let the station A and B ping to C for about 2 minutes after that I stopped and saved the traces from all stations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have analyzed the packet by using the error, retransmission, and broadcast filter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I haven't seen any collisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did I do something wrong ? Is there any other suggestion for setting up the environment to simulate the CSMA/CD ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. Sorry for my english.&lt;/p&gt;&#xA;" OwnerUserId="6256" LastActivityDate="2014-06-26T07:52:17.663" Title="How to use wireshark to capture CSMA/CD?" Tags="|packet-analysis|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9605" PostTypeId="1" AcceptedAnswerId="9616" CreationDate="2014-06-26T06:07:33.897" Score="4" ViewCount="19858" Body="&lt;p&gt;I am using Shrew Client 2.2.2 to use a VPN connection with split tunneling. How can I check or where can I see, that the split tunnel is working properly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&#xA;Dirk&lt;/p&gt;&#xA;" OwnerUserId="6257" LastActivityDate="2020-11-05T03:56:21.410" Title="Check split tunnel" Tags="|vpn|split-tunneling|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9607" PostTypeId="2" ParentId="9604" CreationDate="2014-06-26T07:37:58.207" Score="2" Body="&lt;p&gt;Your problem is that you are trying to capture CSMA/CD behavior in a full duplex environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to capture this behavior, you need to connect your devices to a hub, not a switch. &lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-06-26T07:37:58.207" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9608" PostTypeId="2" ParentId="9604" CreationDate="2014-06-26T07:52:17.663" Score="3" Body="&lt;p&gt;Well, your assignment alone leaves room for interpretation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ethernet (at least up to GBit-Ethernet) is defined by it use of CSMA/CD, &#xA;it might be enough to capture just Ethernet frames. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As YLearn noted you wont see any collisions in a switched network (unless something is terribly broken). Even in an environment using Hubs (good luck finding some) or a shared Media like good old 10Base-T you may not see these packets. These packets are most likely filtered out by your network interface. To capture them you have to used specialized Network interfaces. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you should see is a counter for collision, e.g. with ifconfig on Linux or show interface on Cisco IOS&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-06-26T07:52:17.663" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9609" PostTypeId="1" AcceptedAnswerId="9625" CreationDate="2014-06-25T05:44:22.697" Score="6" ViewCount="1350" Body="&lt;p&gt;I have two IP addresses. They share an IP address to the nth byte. Is there a word that effectively says that they have the same IP address up to the nth byte? Are there different words depending on how many successive bytes they have in common?&lt;/p&gt;&#xA;" OwnerUserId="6261" OwnerDisplayName="Adam Jensen" LastEditorUserId="775" LastEditDate="2014-06-26T09:27:49.653" LastActivityDate="2014-07-01T08:20:31.393" Title="In networking, is there a word for the first n bytes of an IP address?" Tags="|ipv4|ipv6|terminology|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9610" PostTypeId="2" ParentId="9609" CreationDate="2014-06-25T06:43:35.850" Score="3" Body="&lt;p&gt;The word you are looking for is probably &lt;strong&gt;network prefix&lt;/strong&gt; or &lt;strong&gt;subnet mask&lt;/strong&gt;.&#xA;It is used in conjuntion with an address mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.0.0 / 24 or 192.168.0.0 / 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&quot;24&quot; in means that the 24 most significant bits (3 bytes) of the ip address are the network prefix, the rest is available for addressing (without the .0 which is the subnet address and 192.168.0.255 which is a broadcast address for the network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More on that topic on wikipedia: &lt;a href=&quot;http://en.wikipedia.org/wiki/Subnetwork&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Subnetwork&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="mikewolf78" LastEditorUserId="500" LastEditDate="2014-07-01T08:20:31.393" LastActivityDate="2014-07-01T08:20:31.393" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9611" PostTypeId="2" ParentId="9609" CreationDate="2014-06-25T18:24:48.940" Score="-3" Body="&lt;p&gt;The term &lt;strong&gt;class N Network&lt;/strong&gt; defines IP addresses that have the first bytes common.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Class A - only first byte common&#xA;Class B - first and second common&#xA;Class C - first to third common.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="Oldcat" LastActivityDate="2014-06-25T18:24:48.940" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9612" PostTypeId="1" AcceptedAnswerId="9613" CreationDate="2014-06-26T09:52:12.810" Score="18" ViewCount="35206" Body="&lt;p&gt;I've been reading about the differences between MAC and IP addresses, and why we need both of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To summarize, MAC addresses are physical unchangeable unique IDs for every single device while IP addresses are assigned, changeable and virtual. To analogize, MAC addresses are like people who have permanent names, and IP addresses are where they currently live. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the real world, we link addresses and names with the help of a phonebook. What mechanism links IP addresses to MAC addresses and where is this mechanism located in the network?&lt;/p&gt;&#xA;" OwnerUserId="6026" LastEditorUserId="775" LastEditDate="2014-08-01T00:57:28.843" LastActivityDate="2020-04-26T11:55:23.113" Title="How are IP addresses mapped to MAC addresses?" Tags="|ipv4|ethernet|ipv6|mac-address|arp|" AnswerCount="6" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9613" PostTypeId="2" ParentId="9612" CreationDate="2014-06-26T09:59:16.970" Score="22" Body="&lt;p&gt;The mechanism is called &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_Resolution_Protocol&quot;&gt;Address Resolution Protocol (ARP)&lt;/a&gt;.  Every ethernet IPv4 device ARPs to resolve ethernet mac addresses for target IPs.  IP to mac mappings are stored in each device's ARP table (the phone book in your analogy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To simplify: In most cases, to resolve the MAC address associated with an IP address, you send a broadcast ARP packet (to all devices in the network), asking who has that IP address.   The device with that IP address replies to the ARP (with its MAC address).&lt;/p&gt;&#xA;" OwnerUserId="1220" LastEditorUserId="775" LastEditDate="2014-08-01T01:01:28.100" LastActivityDate="2014-08-01T01:01:28.100" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9614" PostTypeId="2" ParentId="9612" CreationDate="2014-06-26T09:59:21.663" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;MAC addresses can be change. On Linux use ip or ifconfig for most Windows look at the driver settings of your network interface. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You don't convert anything. MAC addresses are on Layer-2, IP on Layer-3 of the OSI model. For IPv4 ARP is used to find out which MAC (Layer-2) address belongs to a certain IP (Layer-3) address. For IPv6 ICMPv6 (Neighbor Discovery) is used.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-06-26T09:59:21.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9615" PostTypeId="2" ParentId="9488" CreationDate="2014-06-26T11:52:52.800" Score="4" Body="&lt;p&gt;Check out Y.1731 protocol (or &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1ag&quot; rel=&quot;nofollow&quot;&gt;IEEE 802.1ag&lt;/a&gt;, or OAM). It's fairly easy to implement in software (I'm guessing that's what you're aiming at), and it's supported by all the physical network elements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a very naive &#xA;&lt;a href=&quot;http://www.cs.helsinki.fi/u/sklvarjo/y1731/&quot; rel=&quot;nofollow&quot;&gt;open-source Y.1731 implementation in C&lt;/a&gt;, which you can look at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that Y.1731 is not designed to cross physical network boundary (i.e. requires that MAC addresses of both MEPs are known), so if you need to go through IP routing, you would want to encapsulate your Y.1731 frames within some tunneling protocol, like VXLAN or GRE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="6264" LastActivityDate="2014-06-26T11:52:52.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9616" PostTypeId="2" ParentId="9605" CreationDate="2014-06-26T12:12:58.680" Score="5" Body="&lt;p&gt;Traceroute will show you the path your traffic is following. With split tunneling, a traceroute to an internet IP should not pass your VPN gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to make sure traffic to the internet is not going through the tunnel is by visiting a website which shows your IP address (eg. &lt;a href=&quot;http://www.whatismyip.com&quot; rel=&quot;noreferrer&quot;&gt;whatismyip.com&lt;/a&gt; or &lt;a href=&quot;http://ifconfig.me&quot; rel=&quot;noreferrer&quot;&gt;ifconfig.me&lt;/a&gt;). If your IP address is from your local provider and not from the network your tunnel is connected to, the packets were routed to the website directly, not through the tunnel.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-06-26T12:12:58.680" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9618" PostTypeId="1" CreationDate="2014-06-26T13:30:41.767" Score="6" ViewCount="303" Body="&lt;p&gt;To give you an idea of what is happening, I've two eBGP peers with no routes advertised.  The capabilities are zero and there is no NLRI.  The BGP is established between the eBGP peers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, I ask one of the peers to advertise IPv4 routes by adding the routes.  Immediately, this BGP router goes from ESTABLISHED -&gt; ACTIVE -&gt; ESTABLISHED.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it necessary to tear down the TCP session and start again with the new capabilities in the OPEN message?  I see the same in the pcap.  Can we not have the UPDATE message notify the other peer about the new capabilities? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="6267" LastActivityDate="2015-06-12T17:13:42.420" Title="Why does BGP goes to Active states once we enable new routes?" Tags="|bgp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9620" PostTypeId="1" AcceptedAnswerId="9796" CreationDate="2014-06-26T14:06:49.137" Score="6" ViewCount="6308" Body="&lt;p&gt;I have a Cisco VPN (not sure exactly which hardware) whose logs are forwarded to our Splunk server. It appears the username is redacted. All I see are asterisks. Is this something that can be changed on the VPN and how? Hopefully there is enough consistency between devices that the question can be answered. Thanks! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Snip below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP  xx.xx.xx.xx&#xA;_raw    Jun 26 10:23:31 xx.xx.xx.xx %ASA-6-113005: AAA user authentication Rejected : reason = Invalid password : server = xx.xx.xx.xx : user = ***** : user IP = xx.xx.xx.xx   &#xA;_time   2014-06-26T10:23:31.000-0400    &#xA;app     &#xA;date_hour   10  &#xA;date_mday   26  &#xA;date_minute 23  &#xA;date_month  june    &#xA;date_second 31  &#xA;date_wday   thursday    &#xA;date_year   2014    &#xA;date_zone   local   &#xA;eventtype       &#xA;host    xx.xx.xx.xx &#xA;ids_type        &#xA;index   main    &#xA;linecount   1   &#xA;pid     &#xA;process %ASA-6-113005   &#xA;product     &#xA;punct   __::_..._%--:_____:__=___:__=_..._:__=_*****_:___=  &#xA;reason  Invalid &#xA;server  xx.xx.xx.xx &#xA;source  syslog  &#xA;sourcetype  syslog  &#xA;splunk_server   xx.xx.xx    &#xA;tag::eventtype      &#xA;timeendpos  15  &#xA;timestartpos    0   &#xA;user    *****   &#xA;vendor      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6270" LastEditorUserId="3191" LastEditDate="2014-06-26T18:28:17.103" LastActivityDate="2015-09-01T16:34:36.983" Title="Cisco VPN Logs Do Not Show The Username" Tags="|cisco|vpn|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9621" PostTypeId="2" ParentId="2533" CreationDate="2014-06-26T17:33:41.650" Score="2" Body="&lt;p&gt;I remember it this way. Easiest and shortest to remember for me.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh ip int | i line|list&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6273" LastActivityDate="2014-06-26T17:33:41.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9625" PostTypeId="2" ParentId="9609" CreationDate="2014-06-26T20:39:52.560" Score="7" Body="&lt;p&gt;First, an IP address is specified in bits, not bytes. Since humans tend to have a difficult time with binary, it is often converted into dotted decimal or bytes. This is an important distinction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, two hosts share the same network of 10.10.10.0/23, they could have IP addresses of 10.10.10.3 and 10.10.11.3.  They share the same 23 bits, but they only share the first two bytes, however the first two bytes will also include hosts that are not part of the network such as 10.10.255.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to what the shared bits are called, this can be a number of things. Typically it will be &lt;strong&gt;network&lt;/strong&gt; or &lt;strong&gt;net&lt;/strong&gt; or &lt;strong&gt;subnetwork&lt;/strong&gt; or &lt;strong&gt;subnet&lt;/strong&gt; with or without &lt;strong&gt;ID&lt;/strong&gt; or &lt;strong&gt;prefix&lt;/strong&gt; appended (for example &lt;strong&gt;network ID&lt;/strong&gt; or &lt;strong&gt;subnet prefix&lt;/strong&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure I have probably seen it called other things as well, but those combinations seem to provide everything I can think of at the moment.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-06-26T20:39:52.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9626" PostTypeId="1" AcceptedAnswerId="9630" CreationDate="2014-06-26T20:43:12.330" Score="3" ViewCount="4608" Body="&lt;p&gt;Is there an address renew after the lease-time or after the half of the lease-time in DHCPv6 ?&#xA;I´m not sure about, and I didn´t find that answer inside the RFC of DHCPv6.&lt;/p&gt;&#xA;" OwnerUserId="6214" LastEditorUserId="8499" LastEditDate="2018-12-26T04:33:21.313" LastActivityDate="2018-12-26T04:33:21.313" Title="Is there an renew after the lease-time or after the half of the lease-time in DHCPv6?" Tags="|ipv6|protocol-theory|rfc|dhcpv6|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9627" PostTypeId="2" ParentId="9626" CreationDate="2014-06-26T21:45:26.237" Score="2" Body="&lt;p&gt;Lease time indicates the amount of time the IP will be leased to that particular client. Most of the time, DHCP client makes a renew attempt when the half duration of lease time passes, and will cut the waiting time to half after each unsuccessful attempt(goes like: waits 50% of lease time, then waits 25% of lease time). If it cannot make a renew, it will attempt a rebind after the 87.5% of the lease time passes. I haven't seen any different DHCPv6 behavior yet, then again; I haven't seen much DHCPv6 traffic yet.&lt;/p&gt;&#xA;" OwnerUserId="6022" LastActivityDate="2014-06-26T21:45:26.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9629" PostTypeId="1" CreationDate="2014-06-26T23:47:56.890" Score="5" ViewCount="1763" Body="&lt;p&gt;I have a Cisco ASA 5505 running 8.3.1 software. I've setup my VLANs, and I have a block of static IP addresses. One IP address is set as the 'outside' interface IP address, and I have a static route for internet access. I also have NAT between the inside and outside interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that I have a DMZ VLAN which I want to use, and have all servers on that VLAN use a different IP address for both inbound and outbound traffic. I followed the instructions on this post from the Cisco forums, but I cannot route traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/11687031/cisco-asa-5505-multiple-outside-statics-ip&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/11687031/cisco-asa-5505-multiple-outside-statics-ip&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network dmz&#xA;subnet 192.168.1.0 255.255.255.0&#xA;nat (guest,outside) dynamic 155.1.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After running this command, and checking the NAT rules on ASDM, it creates the same NAT rule as the 'inside' interface, except the translated source is the secondary IP address. The problem is it does not route traffic to the Internet. If I change the translated source to 'outside', it routes, but the outgoing IP address is the same as all other VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I may need to add another static route or some type of double NAT rule; I'm not sure. Any help would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My entire configuration is below, and here are some areas that I've been playing around with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I think I may need a static route here, using the secondary IP&#xA;address, but I can only create routes for an interface. The x.x.x.x&#xA;is the gateway for my static IP address block.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route outside 0.0.0.0 0.0.0.0 x.x.x.x 1&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When I followed the instructions in the link above, it created&#xA;another object (just noticed). I think the duplicate object (overlap)&#xA;may be causing an issue.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network dmz&#xA; nat (dmz,outside) dynamic x.x.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;:&#xA;ASA Version 8.3(1) &#xA;!&#xA;hostname xxxxxxxxxx&#xA;enable password xxxxxxxxxx encrypted&#xA;passwd xxxxxxxxxx encrypted&#xA;names&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address x.x.x.x 255.255.255.0 &#xA;!&#xA;interface Vlan3&#xA; nameif dmz&#xA; security-level 100&#xA; ip address 192.168.2.1 255.255.255.0 &#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA; switchport access vlan 3&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;boot system disk0:/asa831-k8.bin&#xA;ftp mode passive&#xA;dns domain-lookup inside&#xA;dns server-group DefaultDNS&#xA; name-server 8.8.8.8&#xA; name-server 8.8.4.4&#xA;same-security-traffic permit inter-interface&#xA;object network obj-192.168.1.0 &#xA; subnet 192.168.1.0 255.255.255.0&#xA;object network obj_any &#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network obj-192.168.2.0 &#xA; subnet 192.168.2.0 255.255.255.0&#xA;object network dmz&#xA; subnet 192.168.2.0 255.255.255.0&#xA;access-list inside_access_in extended permit ip any any &#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;mtu dmz 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-645.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;!&#xA;object network obj-192.168.1.0&#xA; nat (inside,outside) dynamic interface&#xA;object network dmz&#xA; nat (dmz,outside) dynamic x.x.x.x&#xA;access-group inside_access_in in interface inside control-plane&#xA;route outside 0.0.0.0 0.0.0.0 x.x.x.x 1&#xA;dhcpd auto_config outside&#xA;!&#xA;dhcpd address 192.168.1.5-192.168.1.10 inside&#xA;dhcpd enable inside&#xA;!&#xA;dhcpd address 192.168.2.10-192.168.2.20 dmz&#xA;dhcpd dns 8.8.8.8 interface dmz&#xA;dhcpd enable dmz&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6278" LastEditorUserId="8499" LastEditDate="2016-04-07T16:28:39.907" LastActivityDate="2017-08-31T06:11:43.733" Title="ASA 5505 Assign Outbound IP to VLAN" Tags="|ipv4|vlan|cisco-asa|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9630" PostTypeId="2" ParentId="9626" CreationDate="2014-06-26T23:55:19.437" Score="5" Body="&lt;p&gt;DHCPv6 makes use of T1 and T2 timers.  T1 timer is usually 50% of the preferred lifetime value.  T2 is 80% of the preferred lifetime.  When T1 timer expires, the DHCPv6 client sends a RENEW message.  On receiving no response from the server, it waits until T2 expires and then sends a REBIND message. &lt;/p&gt;&#xA;" OwnerUserId="6267" LastActivityDate="2014-06-26T23:55:19.437" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9632" PostTypeId="1" AcceptedAnswerId="9674" CreationDate="2014-06-27T02:56:05.800" Score="4" ViewCount="206" Body="&lt;p&gt;Consider this network diagram&#xA;&lt;img src=&quot;https://i.stack.imgur.com/zgpsD.png&quot; alt=&quot;BGP network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Routers A and B belong to the same AS&lt;/li&gt;&#xA;&lt;li&gt;Networks 10.0.10.0/24 and 10.0.20.0/24 are routable via AS200 and AS300&lt;/li&gt;&#xA;&lt;li&gt;Network 10.0.10.0/24 is accessible via Router A and pass through Router C&lt;/li&gt;&#xA;&lt;li&gt;Network 10.0.20.0/24 is accessible via Router B and pass through Router D&lt;/li&gt;&#xA;&lt;li&gt;Routers C and D are ISP routers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Network scenarios:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When link between routers A and C is down, traffic should pass through router B via D&lt;/li&gt;&#xA;&lt;li&gt;When link between routers B and D is down, traffic should pass through router A via C&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here's the rough config:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router A&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA; network 10.0.10.0/24&#xA; network 10.0.20.0/24&#xA; neighbor 10.0.21.1 remote-as 100&#xA; neighbor 10.0.21.1 next-hop-self&#xA; neighbor 11.0.0.1 remote-as 200&#xA; no synchronization&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router B&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA; network 10.0.10.0/24&#xA; network 10.0.20.0/24&#xA; neighbor 10.0.10.1 remote-as 100&#xA; neighbor 10.0.10.1 next-hop-self&#xA; neighbor 12.0.0.1 remote-as 300&#xA; no synchronization&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Am I correct to assume that I have to announce both networks (10.0.10.0/24 and 10.0.20.0/24) to each eBGP peer?&lt;/li&gt;&#xA;&lt;li&gt;What is the best way of doing this?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="6280" LastActivityDate="2014-06-29T05:54:19.207" Title="Help with BGP configuration" Tags="|bgp|network-core|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9633" PostTypeId="2" ParentId="3208" CreationDate="2014-06-27T05:28:59.520" Score="0" Body="&lt;p&gt;l2VPN allows different layer 2 encapsulation options like frame relay, ATM, ethernet while mpls only works with Ethernet. l2vpn is a point to point connection while vpls works as a big switch providing a whole view of the path including MAC's as a normal layer 2 switch. &lt;/p&gt;&#xA;" OwnerUserId="6284" LastActivityDate="2014-06-27T05:28:59.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9634" PostTypeId="1" CreationDate="2014-06-27T05:38:50.473" Score="4" ViewCount="1521" Body="&lt;p&gt;Here are some real-world issues:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Certain client devices struggle to hop across APs in &amp;lt;2.5 seconds, even while awake and in an unsecured network.&lt;/li&gt;&#xA;&lt;li&gt;Many applications don't function with hiccups due to roaming (e.g. VoIP).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here's my ideal solution:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;As you connect to an AP, other APs nearby will also transmit/receive the same mirrored packets using the same MAC address.&lt;/li&gt;&#xA;&lt;li&gt;Client operating systems will have no technical capacity to discern when a hop occurs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thoughts? What is the closest we can get to that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; Perhaps I wasn't explicit enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of a cell phone. The phone will have a shortlist of multiple connected towers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you make a phone call, it uses the strongest connection. When connection to said tower degrades, the call is transferred over to the next available tower with &amp;lt;1ms of Layer 7 hiccup. I want that end result over Wi-Fi.&lt;/p&gt;&#xA;" OwnerUserId="6283" LastEditorUserId="6283" LastEditDate="2014-06-27T20:03:40.483" LastActivityDate="2014-09-03T15:34:08.677" Title="Is it possible to avoid the traditional handoff when using Wi-Fi?" Tags="|wireless|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9636" PostTypeId="1" AcceptedAnswerId="9637" CreationDate="2014-06-27T06:31:49.583" Score="10" ViewCount="7725" Body="&lt;p&gt;why TTL value 1 in IGMP protocol and what are the different values possible in TTL section for Multicasting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I got from the google is that if TTL value is 1 then it won't leave the LAN, but if it won't leave the LAN how the msg will be broadcasted ?&lt;/p&gt;&#xA;" OwnerUserId="6218" LastEditorUserId="8499" LastEditDate="2018-03-19T15:47:06.567" LastActivityDate="2018-03-19T15:47:06.567" Title="why TTL value 1 in IGMP" Tags="|ipv4|multicast|igmp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9637" PostTypeId="2" ParentId="9636" CreationDate="2014-06-27T07:11:36.370" Score="11" Body="&lt;p&gt;The reason that it doesn't have to leave the LAN is that IGMP (or MLD if you use IPv6) only talks to the multicast router on the LAN. The multicast router will take care of the routing.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-06-27T07:11:36.370" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9638" PostTypeId="2" ParentId="9592" CreationDate="2014-06-27T08:46:40.817" Score="6" Body="&lt;p&gt;You need to remember that MAC addresses don't travel beyond a router, while IP addresses do. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;During each hop on the way to the final destination, the MAC address is stripped and replaced with the devices own MAC address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a couple basic steps that most devices will take to determine how to handle the data:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The device looks at the destination IP address and compares it with its own IP address and subnet mask to determine whether the IP is local or remote.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the address is local, the system queries its ARP table for that IP's MAC address. If the IP is remote, it queries its ARP table for the default gateway's (router) MAC address. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If there is no entry in the ARP table, then it sends a hardware broadcast requesting the MAC address from the owner of the IP. &quot;Who owns 192.168.0.100?&quot; (local) or &quot;Who owns 192.168.0.1?&quot; (default gateway).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Once the MAC address of next hop is determined, the device sends the packet to that MAC address. i.e: 8.8.8.8 is Remote, so packet stays labelled as 8.8.8.8 but is sent to 192.168.0.1's MAC address to be routed to the internet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;These steps are repeated at every hop on the way to the final destination up until the final router determines that the IP address is local. This means the routers ARP table/broadcast has a MAC address mapped to that IP, so it doesn't need to keep routing it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;This has been slightly simplified to convey the idea better.&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To address some of the specific points of your question:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;There is no need for a 1:1 map of MAC:IP. A single MAC address can have as many IP's as it wants. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The 'translator' is either your own computer if local, or the router closest to the destination (local to them). See &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_Resolution_Protocol&quot; rel=&quot;noreferrer&quot;&gt;Address Resolution Protocol&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;While MAC addresses should be unique, they are only required to be unique to the Layer 2 segment. Every computer on the internet could have the same MAC address in theory, provided that they were all on separate networks. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I hope you are less confused after reading this. &lt;/p&gt;&#xA;" OwnerUserId="274" LastActivityDate="2014-06-27T08:46:40.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9640" PostTypeId="2" ParentId="9634" CreationDate="2014-06-27T10:04:09.023" Score="2" Body="&lt;p&gt;Roaming is mostly a client side behaviour. The clients make the decision to roam to a new AP considering various parameters. You can change a few settings on the WLAN card. OS/ NIC knows when to roam to the next AP. For example, If the power from the new AP is better than the older one the NIC/OS will roam to the new AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The APs should also have a good percentage of overlap as suggested by the vendor. Any coverage hole will cause the client to drop off. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also more the number of clients the APs serve, the more is the contention for the medium.  This could also cause such problems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It takes a bit of playing around with the configuration to have the optimal setting and with which VoIP could work well with roaming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how the wireless works on telecom side. I believe it works on various frequency bands and could be full duplex. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But WLAN is half duplex. Clients contend to gain access to the medium using CSMA/CA. The WLAN APs need to be placed in the right places and make sure there is very less interference and APs are not overloaded with too many clients. If all this is considered and correctly implemented with QOS, then yes there will be minimal loss/delay, otherwise you'll have drops/delay.  &lt;/p&gt;&#xA;" OwnerUserId="6267" LastEditorUserId="6267" LastEditDate="2014-06-27T20:26:16.497" LastActivityDate="2014-06-27T20:26:16.497" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9642" PostTypeId="2" ParentId="9557" CreationDate="2014-06-27T10:37:20.170" Score="10" Body="&lt;p&gt;As soon as I offer a bounty I find the answer, typical!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The magic commaned I needed is &lt;code&gt;show mac-address-table bridge-domain 20&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ME3600#show mac-address-table bridge-domain 20&#xA;          Mac Address Table&#xA;-------------------------------------------&#xA;&#xA;BD      Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA;20      1111.2222.96e2    DYNAMIC     Gi0/1+Efp101&#xA;20      1111.2222.3c8e    DYNAMIC     Gi0/1+Efp20&#xA;20      1111.2222.4b59    DYNAMIC     Gi0/1+Efp102&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Here we can see the first MAC is learnt from customer one via service instance 101 (buy looking at service instance 101 on gi0/1 I can see&#xA;the outer tag will be VLAN ID 101).&lt;/li&gt;&#xA;&lt;li&gt;The second MAC is learnt from a native VLAN 20 on the interface without QinQ&lt;/li&gt;&#xA;&lt;li&gt;The last MAC is learnt from customer 2 via service instance 102 (again by looking at service instance 102 on gi0/1 I see the outer tag will be VLAN ID 102).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="253" LastActivityDate="2014-06-27T10:37:20.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9646" PostTypeId="2" ParentId="9634" CreationDate="2014-06-27T12:38:43.560" Score="1" Body="&lt;p&gt;No matter how the APs are configured, there will still be a delay, or hickup, present. You can experience the same thing with the cell phone carriers - especially - I don't know why - if you are moving fast enough, like in a bullet train, when the switch happens, there will be a momentary loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a device is roaming, it goes through three phases:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Scanning: As the device roams and starts to get away from the AP, the Received Signal Strenth Indicator(RSSI) starts to flactuate and go under predefined levels. When this starts to happen the device seeks for alternate APs. After discovering the APs, the device selects the appropriate AP based on the criteria defined on the device itself.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Authentintication: At this stage, your device sends authentication request to it selected in the scanning stage, and waits for either an approval or rejection.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Reassociation: When the new AP authenticates the device, the device sends an reassociation request to newly selected AP. After (if) the new AP approves the request, your device sends a disassociation request to the old AP, so that it is removed from the old AP's tables.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The whole process is known as handoff. Typically, it takes less than half a second. The reason behind the losses longer than half a second is due to the client device's decision mechanic to decide when to drop one AP and switch to another. Some devices have more comprehensive methods to decide when to &quot;roam&quot;, others may just stick to RSSI levels dropping below some predefined value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, if you are having hickups longer than half a second, I would advise referring to your device's manual or consulting with the manifacturer to see whether the culprid is actually your device. In that case, I would suggest exploring different vendors.&lt;/p&gt;&#xA;" OwnerUserId="6022" LastActivityDate="2014-06-27T12:38:43.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9647" PostTypeId="2" ParentId="9634" CreationDate="2014-06-27T14:57:11.230" Score="4" Body="&lt;p&gt;It is mostly possible, by using solutions which speed-up association/authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those are often controller-based, where the central controller is what you're authenticated against, not the individual APs.  It manages the APs and global authentication, so it knows you're already authenticated and that you're roaming, letting you associate with its APs much more quickly than if you were using stand-alone APs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many vendors have such setup, but I'm only familiar with Cisco's and Aruba's&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/wireless/wireless-lan-controller/index.html?&quot; rel=&quot;nofollow&quot;&gt;Cisco's WLC (Wireless Lan Controller&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.arubanetworks.com/products/mobility-controllers/&quot; rel=&quot;nofollow&quot;&gt;Aruba's Mobility Controller&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Aruba has a nice solution for small offices/networks, with their Instant AP, where a Stand-Alone AP can be used as a (limited) Controller for 15 other APs&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-06-27T14:57:11.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9648" PostTypeId="2" ParentId="9632" CreationDate="2014-06-27T16:13:39.387" Score="4" Body="&lt;p&gt;You should announce both networks to each eBGP peer and work with a route-map to prepend your AS path for influencing the incoming traffic on both routers. (of your EBGP have maybe a BGP community?)&lt;/p&gt;&#xA;" OwnerUserId="6290" LastActivityDate="2014-06-27T16:13:39.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9649" PostTypeId="1" AcceptedAnswerId="9652" CreationDate="2014-06-27T16:40:24.147" Score="0" ViewCount="57" Body="&lt;p&gt;I have been working on this project and I have come to a point where I need to block the user in the network(At most in the CISCO switch) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can send port shut via telnet session with a premade command but my problem is getting the users port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have only his IP Address for identification, is it possible to dump or get all the addresses in that switch? via telnet or? &lt;/p&gt;&#xA;" OwnerUserId="6198" LastActivityDate="2014-06-27T18:07:36.793" Title="Methods on getting the client details on the switch" Tags="|switch|ipv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9651" PostTypeId="2" ParentId="9649" CreationDate="2014-06-27T17:45:45.053" Score="0" Body="&lt;p&gt;You can try ARP'ing for the MAC address and find out which machine it belongs to.  Checking the ARP table on the switch can also help.&lt;/p&gt;&#xA;" OwnerUserId="6267" LastActivityDate="2014-06-27T17:45:45.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9652" PostTypeId="2" ParentId="9649" CreationDate="2014-06-27T17:53:55.963" Score="3" Body="&lt;p&gt;Go to the router for that subnet and find the MAC for that IP -- if they're generating traffic, the router will have the MAC.  Then go to each switch with access ports for that subnet (could be a single switch, could be dozens) and look for the MAC in the mac-address-table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;-- Example --&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have forgotten the port for the management interface of my iSCSI SAN switch, but I know the IP. From a machine in the same LAN, I ping it and then look in the ARP table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root:pts/5{4}]machine:~/[01:53 PM]:arp -a | grep IP&#xA;? (IP) at d0:7e:28:d1:42:01 [ether] on eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I first login to &lt;code&gt;sw-r2-3&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw-R2-3#show mac address-table address d07e.28d1.4201&#xA;          Mac Address Table&#xA;-------------------------------------------&#xA;&#xA;Vlan    Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA;  55    d07e.28d1.4201    DYNAMIC     Po1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know &lt;code&gt;Po1&lt;/code&gt; (&lt;em&gt;port-channel 1&lt;/em&gt;) is the uplink for that switch, so I go to &lt;code&gt;sw-r2-2&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw-R2-2#show mac address-table address d07e.28d1.4201           &#xA;          Mac Address Table&#xA;-------------------------------------------&#xA;&#xA;Vlan    Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA;  55    d07e.28d1.4201    DYNAMIC     Gi1/0/43&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know G1/0/43 is an access port -- &lt;code&gt;show run int g1/0/43&lt;/code&gt; -- so that's where it's connected.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-06-27T18:07:36.793" LastActivityDate="2014-06-27T18:07:36.793" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9653" PostTypeId="2" ParentId="9636" CreationDate="2014-06-27T18:20:02.890" Score="6" Body="&lt;p&gt;TTL == 1 means &lt;em&gt;stay on this network&lt;/em&gt;; it will not be forwarded by any router. This is true of multicast and unicast. The purpose for doing this with multicast is to limit how far the message can spread. For example, 224.0.0.1 (&lt;em&gt;All Systems on this Subnet&lt;/em&gt;) is required to have a TTL of 1 to keep it &quot;on this subnet&quot;. 224.0.1.1 (&lt;em&gt;NTP&lt;/em&gt;) can have as high a TTL as you like to reach as far across your network as you need.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-27T18:20:02.890" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9656" PostTypeId="2" ParentId="1720" CreationDate="2014-06-27T20:36:07.940" Score="2" Body="&lt;p&gt;I had the same problem and found a solution: enable DHCP relay agent on the AP and it works. Replace x.x.x.x with the IP address from your DHCP server (typically the Internet router located on the same network / broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface BVI1&#xA;  ip dhcp relay information trusted&#xA;  ip address dhcp client-id GigabitEthernet0&#xA;  ip helper-address x.x.x.x&#xA;  no ip route-cache&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6294" LastActivityDate="2014-06-27T20:36:07.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9659" PostTypeId="1" CreationDate="2014-06-28T02:05:15.527" Score="7" ViewCount="299" Body="&lt;p&gt;I have iBGP configured between two devices.  After the bgp session comes up, the # of routes sent to RouterA from RouterB initially increases to roughly 100k, but then for some reason, it drops down to only 160.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a reason why this would be happening?  It's just a simply ibgp configuration on both of the routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Starts out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Neighbor Address  AS#   State   Time     Rt:Accepted Filtered Sent   ToSend&#xA;  e.e.e.e         xxxxx ESTAB   1h34m48s    493723   0        1      0     &#xA;  i.i.i.i          xxxx ESTAB   0h 0m19s    301708   0        120998 71776 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ends with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Neighbor Address  AS#   State   Time     Rt:Accepted Filtered Sent   ToSend&#xA;  e.e.e.e          xxxxx ESTAB   1h35m 4s    493722   0        1      0     &#xA;  i.i.i.i           xxxx ESTAB   0h 0m35s    494878   0        150    0  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;e.e.e.e are the ebgp neigh and i.i.i.i is the ibgp neighbors.  As you can see, once the session comes up, the # of routes sent from this router to routerA initially goes high but then drops to ~150.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need specific information, please let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="775" LastEditDate="2014-06-28T02:38:29.683" LastActivityDate="2015-03-04T17:26:45.607" Title="# of bgp routes sent to neighbor drops after session reset" Tags="|routing|bgp|brocade|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9661" PostTypeId="1" AcceptedAnswerId="9663" CreationDate="2014-06-28T04:39:59.293" Score="3" ViewCount="106" Body="&lt;p&gt;Is it possible to get an identification like Mac Address in the packet of a DAD attempt that is succesfull? &#xA;or in the NA Message? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to narrow down how can I know the client who is replying on the DAD on our network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example Scenario: PC1 generated an address and uses DAD protocol, which PC2 then reply but in this case he is attacking PC1 by replying to all NA. My problem is It is possible to get the IPv6 or Mac Address of PC2?&lt;/p&gt;&#xA;" OwnerUserId="6198" LastActivityDate="2014-06-28T06:01:12.510" Title="Is it possible to know the mac address or any identification from the user request in DAD?" Tags="|switch|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9663" PostTypeId="2" ParentId="9661" CreationDate="2014-06-28T06:01:12.510" Score="7" Body="&lt;p&gt;Only if he isn't lying about (spoofing) his own src address.  Capture the network traffic to see the claimed source (MAC) of the frame, then hunt down where that MAC lives on your switches. (switches will learn MACs based on ingress traffic.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-28T06:01:12.510" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9669" PostTypeId="1" CreationDate="2014-06-28T15:11:58.980" Score="1" ViewCount="1244" Body="&lt;p&gt;By default what DSCP values are used when initiating HTTP traffic? If I wanted to match HTTP traffic to a DSCP value, what should it be?&lt;/p&gt;&#xA;" OwnerUserId="3916" LastEditorUserId="3191" LastEditDate="2014-07-10T19:55:57.523" LastActivityDate="2014-07-11T14:05:54.070" Title="Using QoS for HTTP" Tags="|qos|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9674" PostTypeId="2" ParentId="9632" CreationDate="2014-06-29T05:54:19.207" Score="3" Body="&lt;p&gt;A will learn C's routes directly through eBGP.&lt;br&gt;&#xA;A will learn D's routes through B using iBGP.&lt;br&gt;&#xA;A will prefer C's routes because they were learned through eBGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B will learn D's routes directly through eBGP.&lt;br&gt;&#xA;B will learn C's routes through A using iBGP.&lt;br&gt;&#xA;B will prefer D's routes because they were learned through eBGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make sure return traffic goes the way you want it to go, you need to do a couple of things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A needs to advertise all routes to C and B needs to advertise all routes to D.&lt;br&gt;&#xA;You need to make sure you aren't advertising C's routes to D or vise versa through your network.&lt;br&gt;&#xA;When A advertises B's routes to C, A needs to prepend AS100 once or twice to make it look like a less desirable path.&lt;br&gt;&#xA;Similarly, when B advertises A's routes to D, B needs to prepend AS100 once or twice to make it look like a less desirable path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is all done using route maps.&#xA;On A:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ip access-list standard BRoutes&lt;br&gt;&#xA;  10 permit 10.0.20.0 0.0.0.255&lt;br&gt;&lt;br&gt;&#xA;  ip access-list standard ARoutes&lt;br&gt;&#xA;  10 permit 10.0.10.0 0.0.0.255&lt;br&gt;&lt;br&gt;&#xA;  route-map OutToC permit 10&lt;br&gt;&#xA;  match ip address BRoutes&lt;br&gt;&#xA;  set as-path prepend 100 100&lt;br&gt;&#xA;  route-map OutToC permit 20&lt;br&gt;&#xA;  match ip address ARoutes&lt;br&gt;&lt;br&gt;&#xA;  router bgp 100&#xA;  neighbor 11.0.0.1 route-map OutToC out&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This hides D's routes from C so you don't become a transit AS and makes B's routes look an extra couple of AS hops away (even though the AS number is the same).  You'd need a mirror configuration on B.&lt;br&gt;&lt;br&gt;&#xA;Key search terms for future reference:&lt;br&gt;&#xA;Route map&lt;br&gt;&#xA;AS Path&lt;br&gt;&#xA;BGP Metric&lt;br&gt;&#xA;AS Path prepending&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-06-29T05:54:19.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9675" PostTypeId="1" AcceptedAnswerId="9684" CreationDate="2014-06-29T08:05:24.600" Score="5" ViewCount="2638" Body="&lt;p&gt;Since IEEE 802.11ac is a new thing heavily marketed by Intel, I wonder if it supports Wi-Fi Direct? My question is about standards overlap: is Wi-Fi Direct a subset of IEEE 802.11ac?&lt;/p&gt;&#xA;" OwnerUserId="6312" LastEditorUserId="775" LastEditDate="2014-06-29T23:09:33.060" LastActivityDate="2014-09-01T15:58:58.390" Title="Does IEEE 802.11ac imply Wi-Fi Direct compatibility?" Tags="|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9677" PostTypeId="1" AcceptedAnswerId="9681" CreationDate="2014-06-29T15:14:14.947" Score="9" ViewCount="40132" Body="&lt;p&gt;I am learning for the ICND1 exam through CBTNuggets video courses.&#xA;In one of their videos they used a command,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport port-security maximum&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is what the cisco help says about it,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;To set the maximum number of secure MAC addresses on a port&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tested this command myself on Cisco Packet Tracer, and this command allows to set this value to up to 132.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under what circumstances would I connect 132 hosts to a single Switch port ?&#xA;Doesn't one port only support one MAC address at a time ?&lt;/p&gt;&#xA;" OwnerUserId="3821" LastEditorUserId="509" LastEditDate="2017-01-23T06:13:56.850" LastActivityDate="2019-12-01T14:49:26.570" Title="How can there be more than one MAC address on single switch port?" Tags="|cisco|mac-address|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9679" PostTypeId="2" ParentId="9677" CreationDate="2014-06-29T16:58:04.980" Score="6" Body="&lt;p&gt;You can have more than one MAC on a switchport, for example a big Server with 20 VMs on it, so it needs to acces the switchport with 21 MAC addresses.&lt;/p&gt;&#xA;" OwnerUserId="6214" LastActivityDate="2014-06-29T16:58:04.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9681" PostTypeId="2" ParentId="9677" CreationDate="2014-06-29T17:50:02.390" Score="19" Body="&lt;p&gt;You can have more than one MAC address on a switch port if:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You have a switch connected to it. Could be another managed switch (like a Cisco) or an unmanaged switch (like a consumer Netgear or Linksys switch).&lt;/li&gt;&#xA;&lt;li&gt;You have a virtual server host attached to it with multiple virtual machines sharing the NIC.&lt;/li&gt;&#xA;&lt;li&gt;You're using a VoIP phone to carry data for a computer.  In this case, you'll have a trunk  running to the phone from the switch and a second ethernet cable running from the phone to a computer.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="74" LastEditorUserId="55273" LastEditDate="2019-12-01T14:49:26.570" LastActivityDate="2019-12-01T14:49:26.570" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="9682" PostTypeId="2" ParentId="8123" CreationDate="2014-06-29T18:16:05.073" Score="2" Body="&lt;p&gt;Looks like a hardware fault.  This is not standard nor accepted behavior.  I'd agree with Mr. Lock and test your cables.  Beyond that, try re-loading the IOS image on the switch.  If all of that fails, you might need to replace the switch.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-06-29T18:16:05.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9684" PostTypeId="2" ParentId="9675" CreationDate="2014-06-29T23:38:26.147" Score="6" Body="&lt;p&gt;The answer is no, the two are separate technologies. 802.11ac is the next generation of wifi, one step passed 802.11n. WiFi-Direct is just an on-demand autonegotiated ad-hoc wireless network. It could, in theory, be conducted over 802.11a, b, g, n, or ac.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-06-29T23:38:26.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9686" PostTypeId="1" AcceptedAnswerId="9690" CreationDate="2014-06-30T06:35:38.580" Score="5" ViewCount="509" Body="&lt;p&gt;I'm trying to use wccp (Web Cache Communication Protocol) on 3550 cisco switch, the problem is that I can't find &lt;code&gt;wccp&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't do this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config)#ip wccp ....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#sh ip wccp &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it seems that wccp is not defined, Why? and How can I define it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen a tutorial that tells:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In order to enable WCCP redirection in the Catalyst switch, you need&#xA;  to issue the sdm prefer extended-match command (and reboot the&#xA;  switch). By issuing the show sdm prefer command, you are able to see&#xA;  the actual configuration of the TCAM/ASIC Hardware in the switch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;so I did the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)# sdm prefer routing extended-match&#xA;Switch(config)# exit&#xA;Switch# reload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but nothing worked!&lt;/p&gt;&#xA;" OwnerUserId="4777" LastEditorUserId="2128" LastEditDate="2014-06-30T19:14:47.437" LastActivityDate="2014-06-30T19:14:47.437" Title="Why can't we find wccp on 3550 cisco L3 switch?" Tags="|cisco|cisco-ios|switch|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9689" PostTypeId="1" AcceptedAnswerId="9697" CreationDate="2014-06-30T09:34:20.197" Score="3" ViewCount="2060" Body="&lt;p&gt;Consider server S with some public ip and client C behind NAT N. Now C sends some messages on a UDP channel to S. Client C declares the port to which S should connect the RTP stream. &#xA;As you might have noticed its a standard voip problem where we can use ICE(STUN/TURN). However I am not clear about the flow. The problem is S can form a rtp stream with nat but then what port should it connect to? The only option is the port sent by C. But then does the client reserves that port on nat? Please also discuss symmetric nat case.&lt;/p&gt;&#xA;" OwnerUserId="6325" LastActivityDate="2014-07-23T14:46:46.970" Title="rtp connection with nat" Tags="|nat|voip|transport-protocol|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9690" PostTypeId="2" ParentId="9686" CreationDate="2014-06-30T11:09:00.423" Score="6" Body="&lt;p&gt;According to Feature Navigator you can use IOS image c3550-i5k2l2q3-mz.121-19.EA1.bin or c3550-i5q3l2-mz.121-19.EA1.bin for WCCPv2 on the 3550.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NjT0L.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NjT0L.jpg&quot; alt=&quot;Cisco Feature Navigator - WCCPv2 / 3550&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="267" LastEditorUserId="3191" LastEditDate="2014-06-30T12:32:44.717" LastActivityDate="2014-06-30T12:32:44.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9691" PostTypeId="2" ParentId="9542" CreationDate="2014-06-30T22:12:56.537" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The IP Address Translation table used for mapping from IP addresses to physical addresses.&lt;br&gt;&lt;br&gt;The Address Translation tables contain the IP address to 'physical' address equivalences.  Some interfaces do not use translation tables for determining address equivalences (e.g., DDN-X.25 has an algorithmic method); if all interfaces are of this type, then the Address Translation table is empty, i.e., has zero entries.&lt;br&gt;&lt;br&gt;&#xA;  While many protocols may be used to populate this table, ARP and Neighbor Discovery are the most likely options.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;step=2&amp;amp;mibName=IP-MIB-V1SMI&quot; rel=&quot;nofollow&quot;&gt;Cisco IP-MIB-V1SMI.my&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(testing with c1811 @ 15.1.4-M7)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;snmpwalk&lt;/code&gt; (or &lt;code&gt;snmpbulkwalk&lt;/code&gt;) shows 20 elements. And that's exactly correct: 19 IPv4 and 1 IPv6. &lt;code&gt;snmptable&lt;/code&gt;, however, fails to populate correctly unless it's told to use bulk requests.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rtr1811#show arp&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  10.xx.xx.1              -   0023.5ee6.1d38  ARPA   Vlan1&#xA;Internet  10.xx.xx.201          205   001b.243e.1226  ARPA   Vlan1&#xA;Internet  10.xx.xx.202            0   001b.245d.686a  ARPA   Vlan1&#xA;Internet  10.xx.xx.252           65   0009.3d10.c3c7  ARPA   Vlan1&#xA;Internet  72.xxx.xxx.1            0   00a0.c8a7.5f19  ARPA   FastEthernet0&#xA;Internet  72.xxx.xxx.11           -   0023.5ee6.1d38  ARPA   FastEthernet0&#xA;Internet  72.xxx.xxx.14           0   00d0.b780.a68f  ARPA   FastEthernet0&#xA;Internet  192.168.xx.1           12   0004.23c6.a4ec  ARPA   FastEthernet1&#xA;Internet  192.168.xx.5           69   001c.581d.0d1b  ARPA   FastEthernet1&#xA;Internet  192.168.xx.8            -   0023.5ee6.1d39  ARPA   FastEthernet1&#xA;Internet  192.168.xx.9           40   0013.807a.7773  ARPA   FastEthernet1&#xA;Internet  192.168.xx.25          10   0009.3d10.c3c6  ARPA   FastEthernet1&#xA;Internet  192.168.xx.42           8   0021.2875.9eb6  ARPA   FastEthernet1&#xA;Internet  192.168.xx.100          1   0014.2232.d375  ARPA   FastEthernet1&#xA;Internet  192.168.xx.103          0   4061.860d.aa18  ARPA   FastEthernet1&#xA;Internet  192.168.xx.113          0   4061.860d.aa2e  ARPA   FastEthernet1&#xA;Internet  192.168.xx.171          0   0009.3d12.d8a1  ARPA   FastEthernet1&#xA;Internet  192.168.xx.172          0   0009.3d12.e10a  ARPA   FastEthernet1&#xA;Internet  192.168.xx.249         10   d07e.28d1.4201  ARPA   FastEthernet1&#xA;rtr1811#show ipv6 neighbors &#xA;IPv6 Address                              Age Link-layer Addr State Interface&#xA;...:021B:24FF:FE3E:1226           0 001b.243e.1226  REACH Vl1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[bulk request]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root:pts/5{4}]spork:~/[05:52 PM]:snmptable -CB -v 2c -c [] -m ALL 192.168.xx.8 ipNetToPhysicalTable&#xA;SNMP table: IP-MIB::ipNetToPhysicalTable&#xA;&#xA; ipNetToPhysicalPhysAddress ipNetToPhysicalLastUpdated ipNetToPhysicalType ipNetToPhysicalState ipNetToPhysicalRowStatus&#xA;       &quot;00 A0 C8 A7 5F 19 &quot;               0:0:00:45.10             dynamic              unknown                   active&#xA;       &quot;00 23 5E E6 1D 38 &quot;               0:0:00:45.10              static              unknown                   active&#xA;       &quot;00 D0 B7 80 A6 8F &quot;               0:0:00:45.10             dynamic              unknown                   active&#xA;       &quot;00 04 23 C6 A4 EC &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 1C 58 1D 0D 1B &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 23 5E E6 1D 39 &quot;               0:0:00:45.14              static              unknown                   active&#xA;       &quot;00 13 80 7A 77 73 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 09 3D 10 C3 C6 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 21 28 75 9E B6 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 14 22 32 D3 75 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;40 61 86 0D AA 18 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;40 61 86 0D AA 2E &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 09 3D 12 D8 A1 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 09 3D 12 E1 0A &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;D0 7E 28 D1 42 01 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 23 5E E6 1D 38 &quot;               0:0:00:45.22              static              unknown                   active&#xA;       &quot;00 1B 24 3E 12 26 &quot;               0:0:00:45.22             dynamic              unknown                   active&#xA;       &quot;00 1B 24 5D 68 6A &quot;               0:0:00:45.22             dynamic              unknown                   active&#xA;       &quot;00 09 3D 10 C3 C7 &quot;               0:0:00:45.22             dynamic              unknown                   active&#xA;       &quot;00 1B 24 3E 12 26 &quot;             45:17:36:28.75             dynamic                stale                   active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[non-bulk]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root:pts/5{4}]spork:~/[05:53 PM]:snmptable -v 2c -c [] -m ALL 192.168.xx.8 ipNetToPhysicalTable&#xA;SNMP table: IP-MIB::ipNetToPhysicalTable&#xA;&#xA; ipNetToPhysicalPhysAddress ipNetToPhysicalLastUpdated ipNetToPhysicalType ipNetToPhysicalState ipNetToPhysicalRowStatus&#xA;       &quot;00 D0 B7 80 A6 8F &quot;               0:0:00:45.10             dynamic              unknown                   active&#xA;       &quot;D0 7E 28 D1 42 01 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 21 28 75 9E B6 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 14 22 32 D3 75 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;40 61 86 0D AA 18 &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;40 61 86 0D AA 2E &quot;               0:0:00:45.14             dynamic              unknown                   active&#xA;       &quot;00 09 3D 10 C3 C7 &quot;               0:0:00:45.22             dynamic              unknown                   active&#xA;       &quot;00 1B 24 3E 12 26 &quot;             45:17:41:29.78             dynamic                stale                   active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-06-30T22:12:56.537" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9692" PostTypeId="1" AcceptedAnswerId="13252" CreationDate="2014-06-30T22:53:16.017" Score="3" ViewCount="1193" Body="&lt;p&gt;I have a task where I need to be able to use EZVPN with split tunnel but still have access to an external server from the corporate network as the external server will only accept connections from the corporate public IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have not only included the corporate C class in the interesting traffic but also the IP address of the external server.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So all good so far, traffic for the corporate network goes down the tunnel as well as the IP address for the external server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now comes the problem, I am trying to send the public IP traffic for the external server out of the corporate network into the public internet but it just drops and does not get back out the same interface into the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked out this procedure and it did not help as the route map counters do not increase with my attempt to reach the external router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/vpn-client/71461-router-vpnclient-pi-stick.html&quot; rel=&quot;nofollow&quot;&gt;Solution using Route Map to set Next Hop to Loopback&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And to just test the process, I removed the split tunnel and just have everything going down the tunnel so I can test with any web site.  I can access a server on the corporate network but alas it will not allow me to access any site on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its a cisco 870 router and here is the config&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be much appreciated, and I have put the ip policy statement on both the ATM and Dialer out of desperation but I suspect it should just go on the Dialer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 4617 bytes&#xA;!&#xA;version 12.4&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;logging message-counter syslog&#xA;enable secret 5 *************************&#xA;enable password *************************&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login default local&#xA;aaa authentication login ciscocp_vpn_xauth_ml_1 local&#xA;aaa authorization exec default local &#xA;aaa authorization network ciscocp_vpn_group_ml_1 local &#xA;!&#xA;!&#xA;aaa session-id common&#xA;!&#xA;!&#xA;dot11 syslog&#xA;ip source-route&#xA;ip dhcp excluded-address 192.168.1.1&#xA;ip dhcp excluded-address 192.168.1.2&#xA;ip dhcp excluded-address 192.168.1.3&#xA;ip dhcp excluded-address 192.168.1.4&#xA;ip dhcp excluded-address 192.168.1.5&#xA;ip dhcp excluded-address 192.168.1.6&#xA;ip dhcp excluded-address 192.168.1.7&#xA;ip dhcp excluded-address 192.168.1.8&#xA;ip dhcp excluded-address 192.168.1.9&#xA;ip dhcp excluded-address 192.168.1.111&#xA;!&#xA;ip dhcp pool myDhcp&#xA;   network 192.168.1.0 255.255.255.0&#xA;   dns-server 139.130.4.4 &#xA;   default-router 192.168.1.1 &#xA;!&#xA;!&#xA;ip cef&#xA;ip inspect name myfw http&#xA;ip inspect name myfw https&#xA;ip inspect name myfw pop3&#xA;ip inspect name myfw esmtp&#xA;ip inspect name myfw imap&#xA;ip inspect name myfw ssh&#xA;ip inspect name myfw dns&#xA;ip inspect name myfw ftp&#xA;ip inspect name myfw icmp&#xA;ip inspect name myfw h323&#xA;ip inspect name myfw udp&#xA;ip inspect name myfw realaudio&#xA;ip inspect name myfw tftp&#xA;ip inspect name myfw vdolive&#xA;ip inspect name myfw streamworks&#xA;ip inspect name myfw rcmd&#xA;ip inspect name myfw isakmp&#xA;ip inspect name myfw tcp&#xA;ip name-server 139.130.4.4&#xA;!&#xA;!&#xA;!&#xA;!&#xA;username ************************* privilege 15 password 0 *************************&#xA;! &#xA;!&#xA;crypto isakmp policy 1&#xA; encr 3des&#xA; authentication pre-share&#xA; group 2&#xA;!&#xA;crypto isakmp client configuration group HomeFull&#xA; key *************************&#xA; dns 8.8.8.8 8.8.8.4&#xA; pool SDM_POOL_1&#xA; include-local-lan&#xA; netmask 255.255.255.0&#xA;crypto isakmp profile ciscocp-ike-profile-1&#xA;   match identity group HomeFull&#xA;   client authentication list ciscocp_vpn_xauth_ml_1&#xA;   isakmp authorization list ciscocp_vpn_group_ml_1&#xA;   client configuration address respond&#xA;   virtual-template 3&#xA;!&#xA;!&#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;!&#xA;crypto ipsec profile CiscoCP_Profile1&#xA; set security-association idle-time 1740&#xA; set transform-set ESP-3DES-SHA &#xA; set isakmp-profile ciscocp-ike-profile-1&#xA;!&#xA;!&#xA;crypto ctcp port 10000 &#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback10&#xA; ip address 10.0.0.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;interface ATM0&#xA; no ip address&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip flow ingress&#xA; no atm ilmi-keepalive&#xA;!&#xA;interface ATM0.1 point-to-point&#xA; description TimsInternet&#xA; ip flow ingress&#xA; ip policy route-map VPN-Client&#xA; pvc 8/35 &#xA;  encapsulation aal5mux ppp dialer&#xA;  dialer pool-member 3&#xA; !&#xA;!&#xA;interface FastEthernet0&#xA;!&#xA;interface FastEthernet1&#xA;!&#xA;interface FastEthernet2&#xA;!&#xA;interface FastEthernet3&#xA;!&#xA;interface Virtual-Template3 type tunnel&#xA; ip unnumbered Dialer3&#xA; tunnel mode ipsec ipv4&#xA; tunnel protection ipsec profile CiscoCP_Profile1&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.1.1 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip inspect myfw in&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; no ip route-cache cef&#xA; no ip route-cache&#xA; ip tcp adjust-mss 1372&#xA; no ip mroute-cache&#xA; hold-queue 100 out&#xA;!&#xA;interface Dialer0&#xA; no ip address&#xA;!&#xA;interface Dialer3&#xA; ip address negotiated&#xA; ip access-group blockall in&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip mtu 1492&#xA; ip flow ingress&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; encapsulation ppp&#xA; ip tcp header-compression&#xA; ip policy route-map VPN-Client&#xA; no ip mroute-cache&#xA; dialer pool 3&#xA; dialer-group 1&#xA; no cdp enable&#xA; ppp chap hostname *************************@direct.telstra.net&#xA; ppp chap password 0 *************************&#xA;!&#xA;ip local pool SDM_POOL_1 10.0.0.10 10.0.0.100&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 Dialer3&#xA;ip http server&#xA;ip http authentication local&#xA;no ip http secure-server&#xA;!&#xA;ip nat inside source list 101 interface Dialer3 overload&#xA;!&#xA;ip access-list extended VPN-OUT&#xA; permit ip 10.0.0.0 0.0.0.255 any&#xA;ip access-list extended blockall&#xA; remark CCP_ACL Category=17&#xA; permit udp any any eq non500-isakmp&#xA; permit udp any any eq isakmp&#xA; permit esp any any&#xA; permit ahp any any&#xA; permit tcp any any eq 10000&#xA; deny   ip any any&#xA;!&#xA;access-list 101 permit ip 192.168.1.0 0.0.0.255 any&#xA;access-list 101 permit ip 10.0.0.0 0.0.0.255 any&#xA;dialer-list 1 protocol ip permit&#xA;!&#xA;!&#xA;!&#xA;route-map VPN-Client permit 10&#xA; match ip address VPN-OUT&#xA; set ip next-hop 10.0.0.2&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; no modem enable&#xA;line aux 0&#xA;line vty 0 4&#xA; password cisco&#xA;!&#xA;scheduler max-task-time 5000&#xA;end&#xA;&#xA;Router#exit&#xA;Connection closed by foreign host.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6332" LastEditorUserId="6332" LastEditDate="2014-06-30T23:29:51.243" LastActivityDate="2014-11-26T23:58:54.433" Title="EZVPN accessing public internet through tunnel not working - hair pinning!" Tags="|cisco|vpn|nat|cisco-ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9693" PostTypeId="1" CreationDate="2014-06-30T22:54:52.903" Score="3" ViewCount="1080" Body="&lt;p&gt;On Cisco Works LMS we were able to receive notifications whenever one of our ports became err-disabled, however I am unable to configure this with Cisco Prime Infrastructure 2.1.  We are currently getting other messages from prime about our devices, so I know SNMP is configured correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I raised the severity setting for &quot;Security violation on an Interface&quot; in system settings, but I still get nothing.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="6333" LastActivityDate="2014-11-22T00:58:06.893" Title="Cisco Prime Infrastructure 2.1 err-disabled notifications" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9695" PostTypeId="1" AcceptedAnswerId="9747" CreationDate="2014-07-01T06:22:12.340" Score="1" ViewCount="492" Body="&lt;p&gt;I am a computer programmer and having knowledge about networking but not an expert. I have a project in which I have to set up the network infrastructure for a school. The school will have it's own website, in-house web server, also a school portal and a dozen other applications online.I know about the DMZ approach to make the security of the network. But is there any other better approach, or something modern or new that is also cost effective and much more secure than using DMZ server. Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="6335" LastEditorUserId="775" LastEditDate="2014-12-08T12:54:31.827" LastActivityDate="2014-12-08T12:54:31.827" Title="Network architecture for a school" Tags="|firewall|security|design|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9696" PostTypeId="2" ParentId="9626" CreationDate="2014-07-01T07:54:19.767" Score="3" Body="&lt;p&gt;First of all, in IPv6 there is no longer one single 'lease time', but now two values determine an address/prefix lifetime. This is used in both &lt;code&gt;SLAAC&lt;/code&gt; and &lt;code&gt;DHCPv6&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The &lt;strong&gt;preferred&lt;/strong&gt; lifetime, during which you can use an address as you like.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;strong&gt;valid&lt;/strong&gt; lifetime, during which you should no longer use the address for new connections (e.g. when creating a socket), but can keep using it for existing connections. This provides some kind of graceful address deprecation.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The preferred lifetime gets closest to the IPv4 lease time from client perspective as this determines how long you can really use an IPv6 address as you want. But the valid lifetime comes closest to the IPv4 lease time from server perspective as only then the address may be returned to the pool and reassigned to another client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On to &lt;code&gt;DHCPv6&lt;/code&gt;, this protocol can actually manage multiple addresses, which are bundled in so called Identity Associations (&lt;code&gt;IA&lt;/code&gt;). Currently there are 3 types of &lt;code&gt;IA&lt;/code&gt;'s: the &lt;code&gt;IA_PD&lt;/code&gt; for assigning complete prefixes, &lt;code&gt;IA_NA&lt;/code&gt; for assigning non-temporary &lt;code&gt;/128&lt;/code&gt; addresses and &lt;code&gt;IA_TA&lt;/code&gt; for assigning temporary &lt;code&gt;/128&lt;/code&gt; addresses. It is on the &lt;code&gt;IA&lt;/code&gt; level that the &lt;code&gt;T1&lt;/code&gt; (renew) and &lt;code&gt;T2&lt;/code&gt; (rebind) timers are specified as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;IA_PD&lt;/code&gt;: &lt;code&gt;T1&lt;/code&gt; and &lt;code&gt;T2&lt;/code&gt; are by default respectively &lt;code&gt;.5&lt;/code&gt; and &lt;code&gt;.8&lt;/code&gt; times the shortest prefered lifetime signaled in this IA. Other values can be sent to the client.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;IA_NA&lt;/code&gt;: &lt;code&gt;T1&lt;/code&gt; and &lt;code&gt;T2&lt;/code&gt; are by default respectively &lt;code&gt;.5&lt;/code&gt; and &lt;code&gt;.8&lt;/code&gt; times the shortest prefered lifetime signaled in this IA. Other values can be sent to the client.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;IA_TA&lt;/code&gt;: No &lt;code&gt;T1&lt;/code&gt; and &lt;code&gt;T2&lt;/code&gt; are used, as temporary addresses should be short-lived. The client can initiate a renew itself if it would need an address longer than the valid-lifetime, for example for some long-living connection like chat.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As T1 and T2 are specified on IA level, the renew and rebind should happen for all addresses in that IA at once. So if you have an &lt;code&gt;IA_NA&lt;/code&gt; with 9 addresses with a preferred-lifetime of 1 day and one address with a preferred-lifetime of 5 minutes, you'll still renew every 2.5 minutes for all 10 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another consequence is that you might be retrying rebinds for quite some time, as you actually should retry from T2 until the last valid lifetime in the IA is expired.&lt;/p&gt;&#xA;" OwnerUserId="2062" LastActivityDate="2014-07-01T07:54:19.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9697" PostTypeId="2" ParentId="9689" CreationDate="2014-07-01T08:57:26.703" Score="2" Body="&lt;p&gt;There are basically two options this could be handled by NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the NAT implementation can use an &lt;a href=&quot;https://en.wikipedia.org/wiki/Application-level_gateway&quot; rel=&quot;nofollow&quot;&gt;Application Level Gateway&lt;/a&gt; for &lt;code&gt;RTP&lt;/code&gt;. In this case it will create a new entry in the NAPT mappings. In that mapping the client-facing port should be the one signaled, the server-facing port can be random. After the new mapping has been created, the ALG overwrites the port and ip in the RTP message with the server-facing data of that new mapping. This is transparent for clients, but NAT implementations need to keep up with the protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, if supported by the NAT gateway, a client could use a protocol to learn it's server-facing ip and to allocate a port before signaling &lt;code&gt;RTP&lt;/code&gt;. Most common protocols to do this are &lt;a href=&quot;https://en.wikipedia.org/wiki/Port_Control_Protocol&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;PCP&lt;/code&gt;&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/UPNP&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;UPnP&lt;/code&gt;&lt;/a&gt;. This needs work/added complexity on the client side but is more generic as only the client needs to update it's protocol implementation and can use this for other protocols as well.&lt;/p&gt;&#xA;" OwnerUserId="2062" LastActivityDate="2014-07-01T08:57:26.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9701" PostTypeId="1" CreationDate="2014-07-01T13:39:56.113" Score="1" ViewCount="1495" Body="&lt;p&gt;I use a lot IO Graph in Wireshark but for each capture, I have to set again (and again...) all my &quot;preferences&quot; for X/Y Axis and Graph 2/3 filters and so on...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is really annoying. I looked at Wireshark Lua reference API but found no way to trigger &quot;IO Graph&quot; window opening with my preferred options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to set default values for IO Graph options ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would you recommend me to use to automate this user-interaction task in Wireshark ?&lt;/p&gt;&#xA;" OwnerUserId="6339" LastEditorUserId="6339" LastEditDate="2014-07-01T14:02:20.227" LastActivityDate="2014-07-01T20:27:47.283" Title="How to automate Wireshark GUI like IO Graph" Tags="|wireshark|automation|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9704" PostTypeId="1" CreationDate="2014-07-01T15:12:23.553" Score="7" ViewCount="21070" Body="&lt;p&gt;I am having an issue with DHCP not traversing to devices behind a switch. I have many other switches deployed with nearly the same configuration that are able to receive a DHCP address. On this switch that I am having issues with, most of the devices have a static address and they have access and can be accessed from the network just fine. I am trying to add an AP to one of the ports, and being a UniFi, it needs to get a DHCP address from the server, but it is unable to do so. When I bring the AP to another switch with the same port configuration, it properly gets a DHCP addresses. On this switch that is having the DHCP problems, if I assign a static address, then I again have access to the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to figure out why DHCP is not being passed on properly, or if there is a misconfiguration that I have. The DHCP server is a Windows server, all other devices not attached to this switch, can contact and receive the reservation or address as needed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VLAN information is passed down by VTP and it is on the most up to date revision. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem switch config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;! Last configuration change at 19:25:03 UTC Tue Jul 1 2014&#xA;! NVRAM config last updated at 19:25:05 UTC Tue Jul 1 2014&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;&#xA;!&#xA;!&#xA;no aaa new-model&#xA;switch 1 provision ws-c2960s-24ps-l&#xA;authentication mac-move permit&#xA;ip subnet-zero&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree etherchannel guard misconfig&#xA;spanning-tree extend system-id&#xA;!&#xA;!&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description MDF uplink 1/0/20&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; description Fixed Cam&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA; description PLC&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/5&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/6&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/7&#xA; description IDF Link 1/0/22&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/8&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/9&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/10&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/11&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/12&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/13&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/14&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/15&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/16&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/17&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/18&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/19&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/20&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/21&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/22&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/23&#xA; switchport access vlan 205&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/24&#xA; description UniFi&#xA; switchport trunk native vlan 200&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/25&#xA;!&#xA;interface GigabitEthernet1/0/26&#xA;!&#xA;interface GigabitEthernet1/0/27&#xA;!&#xA;interface GigabitEthernet1/0/28&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan205&#xA; ip address 192.168.205.35 255.255.255.0&#xA;!&#xA;ip default-gateway 192.168.205.1&#xA;ip http server&#xA;ip http secure-server&#xA;ip sla enable reaction-alerts&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; password ----&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VLANS (via VTP)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                            active  Gi1/0/22, Gi1/0/25, Gi1/0/26&#xA;                                                Gi1/0/27, Gi1/0/28&#xA;99   guest                              active&#xA;100  plc                                active  Gi1/0/2, Gi1/0/3, Gi1/0/4&#xA;                                                Gi1/0/5, Gi1/0/6, Gi1/0/8&#xA;                                                Gi1/0/9, Gi1/0/10, Gi1/0/11&#xA;                                                Gi1/0/12, Gi1/0/13, Gi1/0/14&#xA;                                                Gi1/0/15, Gi1/0/16, Gi1/0/17&#xA;                                                Gi1/0/18, Gi1/0/19, Gi1/0/20&#xA;                                                Gi1/0/21&#xA;200 wlan                                active&#xA;205 Mgmnt                               active  Gi1/0/23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interfaces: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Port      Name               Status       Vlan       Duplex  Speed Type&#xA;Gi1/0/1   MDF uplink 1/0/20  connected    trunk      a-half  a-100 10/100/1000BaseTX&#xA;Gi1/0/2   Fixed Cam          connected    100        a-full  a-100 10/100/1000BaseTX&#xA;Gi1/0/3   PLC                connected    100        a-full  a-100 10/100/1000BaseTX&#xA;Gi1/0/4                      connected    100        a-full  a-100 10/100/1000BaseTX&#xA;Gi1/0/5                      notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/6                      notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/7   IDF Link 1/0/22    connected    trunk      a-full  a-100 10/100/1000BaseTX&#xA;Gi1/0/8                      notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/9                      connected    100        a-full a-1000 10/100/1000BaseTX&#xA;Gi1/0/10                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/11                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/12                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/13                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/14                     connected    100        a-full  a-100 10/100/1000BaseTX&#xA;Gi1/0/15                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/16                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/17                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/18                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/19                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/20                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/21                     notconnect   100          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/22                     notconnect   1            auto   auto 10/100/1000BaseTX&#xA;Gi1/0/23                     notconnect   205          auto   auto 10/100/1000BaseTX&#xA;Gi1/0/24  UniFi              connected    trunk      a-full  a-100 10/100/1000BaseTX&#xA;Gi1/0/25                     notconnect   1            auto   auto Not Present&#xA;Gi1/0/26                     notconnect   1            auto   auto Not Present&#xA;Gi1/0/27                     notconnect   1            auto   auto Not Present&#xA;Gi1/0/28                     notconnect   1            auto   auto Not Present&#xA;Fa0                          notconnect   routed       auto   auto 10/100BaseTX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Problem switch &lt;code&gt;sh interfaces trunk&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Port        Mode             Encapsulation  Status        Native vlan&#xA;Gi1/0/1     on               802.1q         trunking      1&#xA;Gi1/0/7     on               802.1q         trunking      1&#xA;Gi1/0/24    on               802.1q         trunking      200&#xA;&#xA;Port        Vlans allowed on trunk&#xA;Gi1/0/1     1-4094&#xA;Gi1/0/7     1-4094&#xA;Gi1/0/24    1-4094&#xA;&#xA;Port        Vlans allowed and active in management domain&#xA;Gi1/0/1     1,98-111,200-215,300&#xA;Gi1/0/7     1,98-111,200-215,300&#xA;Gi1/0/24    1,98-111,200-215,300&#xA;&#xA;Port        Vlans in spanning tree forwarding state and not pruned&#xA;Gi1/0/1     1,98-111,200-215,300&#xA;Gi1/0/7     1,98-111,200-215,300&#xA;Gi1/0/24    1,98-111,200-215,300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MDF Gi1/0/20 (the connection to Gi1/0/1 on the problem switch):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh interfaces trunk&#xA;&#xA;Port        Mode             Encapsulation  Status        Native vlan&#xA;Gi1/0/20    on               802.1q         trunking      1&#xA;&#xA;Port        Vlans allowed on trunk&#xA;Gi1/0/20    1-4094&#xA;&#xA;Port        Vlans allowed and active in management domain&#xA;Gi1/0/20    1,98-111,200-215,300&#xA;&#xA;Port        Vlans in spanning tree forwarding state and not pruned&#xA;Gi1/0/20    1,98-111,200-215,300&#xA;&#xA;&#xA;&#xA;sh run&#xA;!&#xA;interface GigabitEthernet1/0/20&#xA; description ProblemSwitch gi1/0/1&#xA; switchport mode trunk&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;STP information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem Switch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh spanning-tree vlan 200&#xA;&#xA;VLAN0200&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    24683&#xA;             Address     b4a4.e322.7500&#xA;             Cost        19&#xA;             Port        1 (GigabitEthernet1/0/1)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32875  (priority 32768 sys-id-ext 200)&#xA;             Address     b4a4.e313.2480&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  300 sec&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;Gi1/0/1             Root FWD 19        128.1    P2p&#xA;Gi1/0/7             Desg FWD 19        128.7    P2p&#xA;Gi1/0/24            Desg FWD 19        128.24   P2p&#xA;&#xA;&#xA;sh spanning-tree interface gi1/0/1&#xA;&#xA;Vlan                Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;VLAN0001            Root FWD 19        128.1    P2p&#xA;VLAN0098            Root FWD 19        128.1    P2p&#xA;VLAN0099            Root FWD 19        128.1    P2p&#xA;VLAN0100            Root FWD 19        128.1    P2p&#xA;VLAN0101            Root FWD 19        128.1    P2p&#xA;VLAN0102            Root FWD 19        128.1    P2p&#xA;VLAN0103            Root FWD 19        128.1    P2p&#xA;VLAN0104            Root FWD 19        128.1    P2p&#xA;VLAN0105            Root FWD 19        128.1    P2p&#xA;VLAN0106            Root FWD 19        128.1    P2p&#xA;VLAN01.1            Root FWD 19        128.1    P2p&#xA;VLAN0108            Root FWD 19        128.1    P2p&#xA;VLAN0109            Root FWD 19        128.1    P2p&#xA;VLAN0110            Root FWD 19        128.1    P2p&#xA;VLAN0111            Root FWD 19        128.1    P2p&#xA;VLAN0200            Root FWD 19        128.1    P2p&#xA;VLAN0201            Root FWD 19        128.1    P2p&#xA;VLAN0205            Root FWD 19        128.1    P2p&#xA;VLAN0211            Root FWD 19        128.1    P2p&#xA;VLAN0300            Root FWD 19        128.1    P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MDF Switch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh spanning-tree vlan 200&#xA;&#xA;VLAN0200&#xA;  Spanning tree enabled protocol rstp&#xA;  Root ID    Priority    24683&#xA;             Address     b4a4.e322.7500&#xA;             This bridge is the root&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    24683  (priority 24576 sys-id-ext 200)&#xA;             Address     b4a4.e322.7500&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  300 sec&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;Gi2/0/1             Desg FWD 4         128.55   P2p Edge&#xA;Gi2/0/2             Desg FWD 4         128.56   P2p Edge&#xA;Gi2/0/3             Desg FWD 4         128.57   P2p Edge&#xA;Gi2/0/12            Desg FWD 4         128.66   P2p Peer(STP)&#xA;Gi2/0/13            Desg FWD 4         128.67   P2p&#xA;Gi2/0/18            Desg FWD 19        128.72   P2p Peer(STP)&#xA;Gi2/0/24            Desg FWD 19        128.78   P2p&#xA;Gi2/0/25            Desg FWD 4         128.79   P2p&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;&#xA;Gi2/0/26            Desg FWD 4         128.80   P2p Peer(STP)&#xA;Gi1/0/1             Desg FWD 4         128.1    P2p Edge&#xA;Gi1/0/2             Desg FWD 4         128.2    P2p Edge&#xA;Gi1/0/3             Desg FWD 4         128.3    P2p Edge&#xA;Gi1/0/20            Desg FWD 19        128.20   P2p Peer(STP)&#xA;Gi1/0/21            Desg FWD 19        128.21   P2p Peer(STP)&#xA;Gi1/0/22            Desg FWD 4         128.22   P2p&#xA;Gi1/0/24            Desg FWD 4         128.24   P2p&#xA;Gi1/0/25            Desg FWD 4         128.25   P2p Peer(STP)&#xA;Gi3/0/1             Desg FWD 4         128.109  P2p Edge&#xA;Gi3/0/2             Desg FWD 4         128.110  P2p Edge&#xA;Gi3/0/3             Desg FWD 4         128.111  P2p Edge&#xA;&#xA;sh spanning-tree interface gi1/0/20&#xA;&#xA;Vlan                Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;VLAN0001            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0098            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0099            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0100            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0101            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0102            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0103            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0104            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0105            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0106            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0107            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0108            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0109            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0110            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0111            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0200            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0201            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0205            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0211            Desg FWD 19        128.20   P2p Peer(STP)&#xA;VLAN0300            Desg FWD 19        128.20   P2p Peer(STP)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can ping the gateway, and servers from the switch with no issue. On a computer with a statically assigned IP and DNS that is NOT on the native VLAN, I cannot ping the computer name, but I can ping the IP addresses. By assigning a native VLAN ip, I can ping the computer names. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help in figuring out why I cannot get a DHCP address from behind this single switch? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Included entire sanitized config. &lt;/p&gt;&#xA;" OwnerUserId="5006" LastEditorUserId="5006" LastEditDate="2014-07-08T14:41:14.467" LastActivityDate="2018-08-26T16:54:30.140" Title="Devices behind Catalyst 2960 not receiving DHCP addresses" Tags="|cisco|switch|dhcp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9705" PostTypeId="1" CreationDate="2014-07-01T18:14:06.750" Score="1" ViewCount="345" Body="&lt;p&gt;Bit of a newbie question, but what exactly does the telephone exchange do for the internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this where the packets that leave your router go to, to connect to your isp?&lt;/p&gt;&#xA;" OwnerUserId="6079" LastActivityDate="2014-07-01T19:13:38.013" Title="What does the local exchange do for the internet" Tags="|internet|isp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9706" PostTypeId="2" ParentId="9542" CreationDate="2014-07-01T18:55:18.400" Score="4" Body="&lt;p&gt;In addition to Ricky's answer, you can also use the &lt;code&gt;snmptranslate&lt;/code&gt; utility to dump information about SNMP tables and how table entries are indexed, etc. The &lt;code&gt;-Tp -IR&lt;/code&gt; flags will tell &lt;code&gt;snmptranslate&lt;/code&gt; to print a tree view of the table. A very useful (and overlooked) utility IMO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the output for &lt;code&gt;ipNetToPhysicalTable&lt;/code&gt; (which is the table object to which ipNetToPhysicalEntry belongs):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jjensen@VA1-NETOPS-DEV-01:~/.snmp$ snmptranslate -M +mibs -m +ALL -Tp -IR ipNetToPhysicalTable&#xA;+--ipNetToPhysicalTable(35)&#xA;   |&#xA;   +--ipNetToPhysicalEntry(1)&#xA;      |  Index: ipNetToPhysicalIfIndex, ipNetToPhysicalNetAddressType, ipNetToPhysicalNetAddress&#xA;      |&#xA;      +-- ---- Integer32 ipNetToPhysicalIfIndex(1)&#xA;      |        Textual Convention: InterfaceIndex&#xA;      |        Range: 1..2147483647&#xA;      +-- ---- EnumVal   ipNetToPhysicalNetAddressType(2)&#xA;      |        Textual Convention: InetAddressType&#xA;      |        Values: unknown(0), ipv4(1), ipv6(2), ipv4z(3), ipv6z(4), dns(16)&#xA;      +-- ---- String    ipNetToPhysicalNetAddress(3)&#xA;      |        Textual Convention: InetAddress&#xA;      |        Size: 0..255&#xA;      +-- CR-- String    ipNetToPhysicalPhysAddress(4)&#xA;      |        Textual Convention: PhysAddress&#xA;      |        Size: 0..65535&#xA;      +-- -R-- TimeTicks ipNetToPhysicalLastUpdated(5)&#xA;      |        Textual Convention: TimeStamp&#xA;      +-- CR-- EnumVal   ipNetToPhysicalType(6)&#xA;      |        Values: other(1), invalid(2), dynamic(3), static(4), local(5)&#xA;      +-- -R-- EnumVal   ipNetToPhysicalState(7)&#xA;      |        Values: reachable(1), stale(2), delay(3), probe(4), invalid(5), unknown(6), incomplete(7)&#xA;      +-- CR-- EnumVal   ipNetToPhysicalRowStatus(8)&#xA;               Textual Convention: RowStatus&#xA;               Values: active(1), notInService(2), notReady(3), createAndGo(4), createAndWait(5), destroy(6)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you can see how an entry in the table is supposed to be indexed, and also the OIDs that make up the table. The first 3 entries are the indexes. Each entry in the table is going to have these 3 indexes - essentially ipNetToPhysicalIfIndex + ipNetToPhysicalNetAddressType + ipNetToPhysicalNetAddress. Then subsequently there are 5 &quot;columns&quot; in a row of this table:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;ipNetToPhysicalPhysAddress&lt;/li&gt;&#xA;&lt;li&gt;ipNetToPhysicalLastUpdated&lt;/li&gt;&#xA;&lt;li&gt;ipNetToPhysicalType&lt;/li&gt;&#xA;&lt;li&gt;ipNetToPhysicalState&lt;/li&gt;&#xA;&lt;li&gt;ipNetToPhysicalRowStatus&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here's an example from one of my devices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP-MIB::ipNetToPhysicalPhysAddress.1.ipv4.&quot;10.200.17.34&quot; = STRING: 74:8e:f8:62:59:41&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So think of this like a row entry in the table, and we've picked out column 1 from the row, which is ipNetToPhysicalPhysAddress. So in this particular entry, the &lt;code&gt;.1.ipv4.&quot;10.200.17.34&quot;&lt;/code&gt; part is the index of the entry. The 1 is the ifIndex of the interface that the ARP entry is learned on, 'ipv4' is the ipNetToPhysicalNetAddressType which is one of these: &lt;code&gt;unknown(0), ipv4(1), ipv6(2), ipv4z(3), ipv6z(4), dns(16)&lt;/code&gt; and finally, the IP address of the ARP entry, 10.200.17.34. These three things make up the index for that entry. Then the value for ipNetToPhysicalPhysAddress at that specific index is the MAC address &lt;code&gt;748e.f862.5941&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;but when i read this OID over, lets say snmpwalk, i don´t get everything whats inside my Routers Neighbor Cache and ARP Cache.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This could very well be an issue with the SNMP implementation of your device (which you've given us zero information about by the way). It would be useful if you could edit your original question to include this information, as well as output from &lt;code&gt;snmpbulkwalk&lt;/code&gt; against the &lt;code&gt;ipNetToPhysicalTable&lt;/code&gt; table. Also, you could try doing an &lt;code&gt;snmpbulkwalk&lt;/code&gt; against &lt;code&gt;ipv6NetToMediaTable&lt;/code&gt; to see if you get results from that.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2014-07-01T18:55:18.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9707" PostTypeId="2" ParentId="9705" CreationDate="2014-07-01T19:13:38.013" Score="3" Body="&lt;p&gt;The telephone system is only involved in internet connectivity when the copper telephone lines are used for a DSL line. At the user's end the copper line goes into a splitter that separates the phone frequencies from the DSL frequencies. The phone signal goes to a plain phone and the DSL signal goes to a DSL modem. The same happens in the local telephone exchange. The signal is split and the phone signal goes to the classical telephone system. The DSL signal goes to a DSLAM (Digital Subscriber Line Access Multiplexer). Depending on the rules/laws/customs of the country this DSLAM is operated by one or more ISPs, the incumbent phone operator or specialised DSL operators. It might be that there are DSLAMs of multiple operators in the local telephone exchange station.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-07-01T19:13:38.013" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9711" PostTypeId="1" AcceptedAnswerId="9714" CreationDate="2014-07-01T20:19:45.087" Score="4" ViewCount="1033" Body="&lt;p&gt;Is there an efficient way to explicitly configure all interfaces as edge ports except for one or two?  Something along the lines of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols rstp interface all edge&#xA;&#xA;set protocols rstp interface ge-0/0/0 mode point-to-point&#xA;&#xA;set protocols rstp interface ge-0/0/1 mode point-to-point&#xA;&#xA;set protocols rstp interface all bpdu-timeout-action block&#xA;&#xA;set protocols rstp interface all bpdu-timeout-action log&#xA;&#xA;set protocols rstp bpdu-block-on-edge&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6345" LastEditorUserId="3191" LastEditDate="2014-07-02T06:39:51.017" LastActivityDate="2014-07-02T06:39:51.017" Title="EX Series Switch Efficient BPDU Protect Statements" Tags="|juniper|juniper-ex|cli|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9712" PostTypeId="2" ParentId="9701" CreationDate="2014-07-01T20:27:47.283" Score="2" Body="&lt;p&gt;What might be useful here would be an option similar to what Quicken has for reports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://quicken.intuit.com&quot; rel=&quot;nofollow&quot;&gt;Quicken&lt;/a&gt; will, for at least some reports, show them with default options; however, if you've changed the options from the default, you can save the report, with a name, with the new options.  That doesn't save the report &lt;em&gt;data&lt;/em&gt;, it just saves the &lt;em&gt;options&lt;/em&gt;, so if you open up the report with that name, it recalculates the data based on the current state of your Quicken database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The equivalent for Wireshark would be an option to save an I/O Graph's options with a name; you could then open up the named graph, and it would re-calculate the graph values based on the current capture and display that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please file an enhancement request for this at &lt;a href=&quot;http://bugs.wireshark.org&quot; rel=&quot;nofollow&quot;&gt;the Wireshark Bugzilla&lt;/a&gt;, so that it can be tracked, and you can get notified if and when that feature gets added.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2014-07-01T20:27:47.283" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9713" PostTypeId="2" ParentId="1684" CreationDate="2014-07-01T20:58:42.587" Score="3" Body="&lt;p&gt;SCTP and TCP between linux machines on my LAN worked ok, but between machines on two different LANs that are connected via a common ISP, only TCP is propagated. SCTP resulted in no incoming traffic.&#xA;Concluded that ISP's switches/routers/DSL systems do not pass SCTP :( &#xA;Tested Summer 2013.&lt;/p&gt;&#xA;" OwnerUserId="6347" LastActivityDate="2014-07-01T20:58:42.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9714" PostTypeId="2" ParentId="9711" CreationDate="2014-07-01T21:10:10.823" Score="4" Body="&lt;p&gt;Judging by your comments, you're simply trying to simplify your initial &lt;code&gt;set&lt;/code&gt; statements.  The easiest solution is to use the &lt;code&gt;wildcard range&lt;/code&gt; statements released after 12.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example usage:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@host# wildcard range set interfaces ge-0/0/[0-23] unit 0 family vpls&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Equivalent to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@host# set interfaces ge-0/0/0 unit 0 family vpls&#xA;user@host# set interfaces ge-0/0/1 unit 0 family vpls&#xA;user@host# set interfaces ge-0/0/2 unit 0 family vpls&#xA;...&#xA;user@host# set interfaces ge-0/0/23 unit 0 family vpls&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/example/junos-cli-wildcard-range-configuring.html#config-1&quot; rel=&quot;nofollow&quot;&gt;Juniper - Example: Using the Wildcard Command with the Range Option&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example above, you appear to want to &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/example/junos-cli-wildcard-range-configuring.html#jd0e230&quot; rel=&quot;nofollow&quot;&gt;multiple ranges&lt;/a&gt;.  For instance, if you wanted all ports except port 25, you would use this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wildcard range set protocols rstp interface ge-0/0/[0-24,26-47] mode point-to-point&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-07-01T21:10:10.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9715" PostTypeId="1" CreationDate="2014-07-01T22:26:42.930" Score="5" ViewCount="676" Body="&lt;p&gt;Internet - ASA FW (4 SVI's) - Layer 3 - 2*6509 HSRP - MPLS ROUTER - 15 remote sites&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today I have 3 central internet pops within my network all using ASA firewalls, the firewalls each have 15 MPLS locations that receive internet. Currently I have WCCPV2 running on the firewall at each of these locations. The firewalls have 4 interfaces, today we can only monitor 1 of them &quot;LAN side&quot; due to the limitation of the ASA.&#xA;I am getting ready to start a project to move WCCP off of the LAN side interface of the firewall onto our core 6509's.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions 1 - Where is the best placement of the WCCP process given the network layout? I was thinking on the Layer 3 interface between the core 6509's and the ASA. Thoughts? I have also seen design recommendations that say to put the WCCP configuration on the SVI's on the 6509's however, this doesn't cover the 15 sites coming from MPLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question 2 - What is the best practice for monitoring multiple interfaces on the ASA firewall? Is there a different design method I should consider that would allow me to monitor those interfaces as well?&#xA;Let me know if haven't provided enough detail.&#xA;Thanks, &#xA;Danny &lt;/p&gt;&#xA;" OwnerUserId="1477" LastActivityDate="2015-01-07T00:42:14.117" Title="Blue Coat WCCP Placement" Tags="|cisco|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9716" PostTypeId="2" ParentId="6275" CreationDate="2014-07-02T02:05:32.303" Score="-1" Body="&lt;p&gt;I feel its better to leave the command on all ports since it doesn't have any effect on the ports which hasn't got the dhcp snooping enabled vlans assigned to them. The advantage of it is that it gives you capability to change ports to any access port anytime without each time checking whether they are part of dhcp snooping vlan and adding the limit command if needed.&lt;/p&gt;&#xA;" OwnerUserId="6351" LastActivityDate="2014-07-02T02:05:32.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9723" PostTypeId="2" ParentId="9695" CreationDate="2014-07-02T12:11:41.260" Score="2" Body="&lt;p&gt;Whether one should use two firewalls or a single, three-legged firewall to create a DMZ is probably more personal preference than anything else.  A single, three legged firewall works in 95% of the cases and is obviously cheaper and easier to manage than two firewalls with two rule-sets.  On the other hand, two firewalls, if they are different brands, might protect against a (theoretical) vulnerability in one brand.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless your firewall is doing some sort of packet inspection/malware detection, the benefit of a firewall over a simple access list isn't that great.  Ultimately, it makes little difference whether you use one or two firewalls as it's vulnerabilities in OSes or users that result in the vast majority of attacks.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-07-02T12:11:41.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9724" PostTypeId="1" AcceptedAnswerId="9725" CreationDate="2014-07-02T12:40:01.060" Score="10" ViewCount="2442" Body="&lt;p&gt;I have configured my 3550 L3 switch to redirect HTTP traffic to a significant Machine:&lt;/p&gt;&#xA;&lt;p&gt;This is my scenario ( PCs instead of Routers):&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/583Py.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is the switch configuration:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;CAT3550# show running-config &#xA;Building configuration...&#xA;.&#xA;.&#xA;!&#xA;interface Vlan1&#xA;ip address 10.10.10.1 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA;ip address 20.20.20.1 255.255.255.0&#xA;ip policy route-map pbr&#xA;!&#xA;interface Vlan3&#xA;ip address 30.30.30.1 255.255.255.0&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 10.10.10.2&#xA;ip classless&#xA;ip http server&#xA;!&#xA;!&#xA;access-list 10 permit 20.20.20.0 0.0.0.255&#xA;route-map pbr permit 10&#xA;match ip address 10&#xA;set ip next-hop 30.30.30.2&#xA;!&#xA;. &#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;on the PCs I have put an IP address and a GW:&lt;br&gt;&lt;/p&gt;&#xA;&lt;p&gt;for example 10.10.10.2 and the gw is:10.10.10.1&lt;/p&gt;&#xA;&lt;p&gt;My questions is:&lt;/p&gt;&#xA;&lt;p&gt;Why can't I ping from one computer to another for example (from 20.20.20.4):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ping 10.10.10.2&lt;/p&gt;&#xA;&lt;p&gt;return :Request time out.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4777" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-07-22T13:13:28.450" Title="Why can't I ping from one computer to another using L3 cisco 3550 switch?" Tags="|cisco|routing|ping|switch|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9725" PostTypeId="2" ParentId="9724" CreationDate="2014-07-02T13:03:54.937" Score="14" Body="&lt;p&gt;You seem to be missing the &lt;code&gt;ip routing&lt;/code&gt; command which enables L3 routing on the switch.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-07-02T13:03:54.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9733" PostTypeId="1" AcceptedAnswerId="9924" CreationDate="2014-07-02T18:18:44.243" Score="4" ViewCount="672" Body="&lt;p&gt;I'm putting together a SCAPY based tool for simulation. I want to add support for Cisco FabricPath, but I can't find any PCAP's online. My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the expected behavior of Cisco FabricPath in terms of traffic profile? Is it safe to assume that, as an inter-switch L2 protocol, will not be maintained across WAN (MPLS, GRE) links? Is it also safe to assume Cisco FabricPath headers will only be limited to inter-switch traffic? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it safe to assume VLAN and VLAN tagged traffic will be maintained within the Cisco FabricPath frame? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I do not have process any Nexus or Cisco equipment that could simulate this. &lt;/p&gt;&#xA;" OwnerUserId="6286" LastEditorUserId="3191" LastEditDate="2014-07-12T06:42:51.107" LastActivityDate="2014-07-12T18:00:26.670" Title="Cisco FabricPath Simulation with Scapy" Tags="|cisco|cisco-nexus-1000v|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9735" PostTypeId="1" AcceptedAnswerId="10374" CreationDate="2014-07-02T18:56:28.820" Score="1" ViewCount="1752" Body="&lt;p&gt;I have a Virtual Access Point (VAP) group properly set up with both the corporate and guest VAPs on our SonicWALL NSA 3500, but when I apply them to a SonicPoint-NDR I have the issue referred to in the diagram - I have Cisco switches in between the SonicWALL and SonicPoints (no way around that since this LAN spans miles and many buildings) and I can only assign one Access VLAN to the upstream Cisco port at a time.  I tried trunking the Cisco port but nothing seemed to work, unless I granted one VLAN as a native trunk VLAN in which case only that VLAN would work.  Is this impossible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be possible according to Dell/SonicWALL documentation, and I have an open ticket with their support on it, but I haven't heard back in a day and their troubleshooting for this seems very limited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the diagram, VLAN 2 is our general corporate wired LAN, VLAN 802 is our corporate WiFi and VLAN 803 is our guest WiFi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network diagram: &lt;img src=&quot;https://i.stack.imgur.com/4uty5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5960" LastActivityDate="2014-08-10T08:52:12.703" Title="Corp &amp; Guest WiFi on SonicPoint-NDR via Cisco switches" Tags="|cisco|wireless|sonicwall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9737" PostTypeId="1" AcceptedAnswerId="9813" CreationDate="2014-07-02T20:54:53.330" Score="6" ViewCount="15448" Body="&lt;p&gt;I'm the tech guy for a small business. (15 office computers, ~15 staff BOYD's, ~30 guest devices.) I'm looking to replace our Asus RT-N53 with a business class router and two access points each servicing a private and a guess SSID on separate VLANs. We currently have 35 Mbps down, 7 Mbps up, internet service with intentions to upgrade to a faster package or provider in the near future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been looking at Cisco's router offerings, and their &lt;a href=&quot;https://supportforums.cisco.com/sites/default/files/legacy/7/2/6/134627-white_paper_c11_595485.pdf&quot; rel=&quot;noreferrer&quot;&gt;&quot;ISR G2 Performance Overview&quot; whitepaper&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end of the whitepaper, (Table 8 and Figure 1) it summarizes multi-service tests and overall &quot;performance positioning&quot; in terms of max WAN-throughput. The multi-services listed are approximate to the services we'd be running on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Edit:] Questions: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Table 8's numbers are Cisco's attempt to simulate real-world performance, Figure 1's numbers are an RFC-2544 NDR measure of CPU performance, correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Given the above is correct, should I take one of these numbers literally, in that if I wanted to fully utilize a 100 Mbps connection I'd need to chose a router with a listed value of at least 100 Mbps in Table 8?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Or will real-world performance issues (such as if most of the bandwidth was from a single computer running a backup) not stress the router in the same way as Cisco's tests do?&lt;/p&gt;&#xA;" OwnerUserId="6368" LastEditorUserId="775" LastEditDate="2014-07-07T07:59:26.610" LastActivityDate="2014-07-07T08:09:44.583" Title="How to &quot;size&quot; a Router for a Given Uplink" Tags="|cisco|router|performance|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9738" PostTypeId="2" ParentId="3503" CreationDate="2014-07-03T02:53:42.827" Score="1" Body="&lt;p&gt;The mac-address table maintained on the switch is the source mac-address of packets received on that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The destination mac-address has nothing to do with the device attached to that port so the switch has no need to associate that mac-address with the ingress port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Press has &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=2181835&amp;amp;seqNum=5&quot; rel=&quot;nofollow&quot;&gt;an online article&lt;/a&gt; that covers this topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Late reply due to comment...)&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="3191" LastEditDate="2014-07-03T06:51:14.767" LastActivityDate="2014-07-03T06:51:14.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9740" PostTypeId="1" CreationDate="2014-07-03T10:40:39.840" Score="5" ViewCount="7376" Body="&lt;p&gt;We had two SRX210 in a HA cluster, that both accidentely lost power, and when they came up again, the both had lost ALL setup, (similar to a factory reset!), this was very strange and took us som time to fix. (this was a month ago)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later (this week), another SRX100 on a totally different network (different continent also), died with similar problem... when I looked at the setup, it was all totally gone. had to recover from a backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;have anyone seen such a problem? this was running on quite an old firmware 10.x is it a bug? attack? hardware problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; the SRX100 was replaced with a backup device (also SRX100), and the faulty device was upgraded to latest stable firmware, and loaded with the same-ish config as before. then it was setup in a test network, and stress-tested for a few days..  and this weekend it died again. (was showing RED light on STATUS, and no traffic passing trough it). the console window on serial was on the whole time and this is the content.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;U-Boot 1.1.6-JNPR-2.7 (Build time: Nov 26 2013 - 19:04:49)                     &#xA;&#xA;Initializing memory this may take some time...                             &#xA;Measured DDR clock 266.62 MHz                                                  &#xA;SRX_100_LOWMEM board revision major:0, minor:0, serial #: AT0112AF1168         &#xA;OCTEON CN5020-SCP pass 1.1, Core clock: 500 MHz, DDR clock: 266 MHz (532 Mhz d)&#xA;DRAM:  512 MB                                                                  &#xA;Starting Memory POST...                                                        &#xA;Checking datalines... OK                                                       &#xA;Checking address lines... OK                                                   &#xA;Checking 512K memory for U-Boot... OK.                                         &#xA;Running U-Boot CRC Test... OK.                                                 &#xA;Flash:  4 MB                                                                   &#xA;USB:   scanning bus for devices... 4 USB Device(s) found                       &#xA;       scanning bus for storage devices... 2 Storage Device(s) found           &#xA;Clearing DRAM....... done                                                      &#xA;BIST check passed.                                                             &#xA;Boot Media: nand-flash usb                                                     &#xA;Net:   pic init done (err = 0)octeth0                                          &#xA;POST Passed                                                                    &#xA;Press SPACE to abort autoboot in 1 seconds                                     &#xA;ELF file is 32 bit                                                             &#xA;Loading .text @ 0x8f0000a0 (246560 bytes)                                      &#xA;Loading .rodata @ 0x8f03c3c0 (14144 bytes)                                     &#xA;Loading .reginfo @ 0x8f03fb00 (24 bytes)                                       &#xA;Loading .rodata.str1.4 @ 0x8f03fb18 (16516 bytes)                              &#xA;Loading set_Xcommand_set @ 0x8f043b9c (96 bytes)                               &#xA;Loading .rodata.cst4 @ 0x8f043bfc (20 bytes)                                   &#xA;Loading .data @ 0x8f044000 (5744 bytes)                                        &#xA;Loading .data.rel.ro @ 0x8f045670 (120 bytes)                                  &#xA;Loading .data.rel @ 0x8f0456e8 (136 bytes)                                     &#xA;Clearing .bss @ 0x8f045770 (11600 bytes)                                       &#xA;## Starting application at 0x8f0000a0 ...                                      &#xA;Consoles: U-Boot console                                                       &#xA;Found compatible API, ver. 2.7                                                 &#xA;&#xA;FreeBSD/MIPS U-Boot bootstrap loader, Revision 2.7                             &#xA;(ccheng@svl-junos-d081.juniper.net, Tue Nov 26 19:05:43 PST 2013)              &#xA;Memory: 512MB                                                                  &#xA;[0]Booting from nand-flash slice 2                                             &#xA;Un-Protected 1 sectors                                                         &#xA;writing to flash...                                                            &#xA;Protected 1 sectors                                                            &#xA;Loading /boot/defaults/loader.conf                                             &#xA;/kernel data=0xb0496c+0x1344a4 syms=[0x4+0x8a9e0+0x4+0xc8f47]                  &#xA;&#xA;&#xA;Hit [Enter] to boot immediately, or space bar for command prompt.              &#xA;Booting [/kernel]...                                                           &#xA;Kernel entry at 0x801000e0 ...                                                 &#xA;init regular console                                                           &#xA;Primary ICache: Sets 64 Size 128 Asso 4                                        &#xA;Primary DCache: Sets 1 Size 128 Asso 64                                        &#xA;Secondary DCache: Sets 128 Size 128 Asso 8                                     &#xA;GDB: debug ports: uart                                                         &#xA;GDB: current port: uart                                                        &#xA;KDB: debugger backends: ddb gdb                                                &#xA;KDB: current backend: ddb                                                      &#xA;kld_map_v: 0x8ff80000, kld_map_p: 0x0                                          &#xA;Copyright (c) 1996-2014, Juniper Networks, Inc.                                &#xA;All rights reserved.                                                           &#xA;Copyright (c) 1992-2006 The FreeBSD Project.                                   &#xA;Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994       &#xA;        The Regents of the University of California. All rights reserved.      &#xA;JUNOS 12.1X44-D35.5 #0: 2014-05-19 21:36:43 UTC                                &#xA;    builder@dagmath.juniper.net:/volume/build/junos/12.1/service/12.1X44-D35.5l&#xA;JUNOS 12.1X44-D35.5 #0: 2014-05-19 21:36:43 UTC                                &#xA;    builder@dagmath.juniper.net:/volume/build/junos/12.1/service/12.1X44-D35.5l&#xA;real memory  = 536870912 (512MB)                                               &#xA;avail memory = 304193536 (290MB)                                               &#xA;FreeBSD/SMP: Multiprocessor System Detected: 2 CPUs                            &#xA;Security policy loaded: JUNOS MAC/pcap (mac_pcap)                              &#xA;Security policy loaded: JUNOS MAC/runasnonroot (mac_runasnonroot)              &#xA;netisr_init: !debug_mpsafenet, forcing maxthreads from 2 to 1                  &#xA;cpu0 on motherboard                                                            &#xA;: CAVIUM's OCTEON 5020 CPU Rev. 0.1 with no FPU implemented                    &#xA;        L1 Cache: I size 32kb(128 line), D size 8kb(128 line), sixty four way. &#xA;        L2 Cache: Size 128kb, 8 way                                            &#xA;obio0 on motherboard                                                           &#xA;uart0: &amp;lt;Octeon-16550 channel 0&amp;gt; on obio0                                       &#xA;uart0: console (9600,n,8,1)                                                    &#xA;twsi0 on obio0                                                                 &#xA;dwc0: &amp;lt;Synopsis DWC OTG Controller Driver&amp;gt; on obio0                            &#xA;usb0: &amp;lt;USB Bus for DWC OTG Controller&amp;gt; on dwc0                                 &#xA;usb0: USB revision 2.0                                                         &#xA;uhub0: vendor 0x0000 DWC OTG root hub, class 9/0, rev 2.00/1.00, addr 1        &#xA;uhub0: 1 port with 1 removable, self powered                                   &#xA;uhub1: vendor 0x0409 product 0x005a, class 9/0, rev 2.00/1.00, addr 2          &#xA;uhub1: single transaction translator                                           &#xA;uhub1: 2 ports with 1 removable, self powered                                  &#xA;umass0: STMicroelectronics ST72682  High Speed Mode, rev 2.00/2.10, addr 3     &#xA;umass1: Kingston DT 101 G2, rev 2.00/1.00, addr 4                              &#xA;cpld0 on obio0                                                                 &#xA;pcib0: &amp;lt;Cavium on-chip PCI bridge&amp;gt; on obio0                                    &#xA;Disabling Octeon big bar support                                               &#xA;PCI Status: PCI 32-bit: 0xc041b                                                &#xA;pcib0: Initialized controller                                                  &#xA;pci0: &amp;lt;PCI bus&amp;gt; on pcib0                                                       &#xA;pci0: &amp;lt;serial bus, USB&amp;gt; at device 2.0 (no driver attached)                     &#xA;pci0: &amp;lt;serial bus, USB&amp;gt; at device 2.1 (no driver attached)                     &#xA;pci0: &amp;lt;serial bus, USB&amp;gt; at device 2.2 (no driver attached)                     &#xA;gblmem0 on obio0                                                               &#xA;octpkt0: &amp;lt;Octeon RGMII&amp;gt; on obio0                                               &#xA;cfi0: &amp;lt;AMD/Fujitsu - 4MB&amp;gt; on obio0                                             &#xA;Timecounter &quot;mips&quot; frequency 500000000 Hz quality 0                            &#xA;###PCB Group initialized for udppcbgroup                                       &#xA;###PCB Group initialized for tcppcbgroup                                       &#xA;da1 at umass-sim1 bus 1 target 0 lun 0                                         &#xA;da1: &amp;lt;Kingston DT 101 G2 PMAP&amp;gt; Removable Direct Access SCSI-0 device           &#xA;da1: 40.000MB/s transfers                                                      &#xA;da1: 15304MB (31342592 512 byte sectors: 255H 63S/T 1950C)                     &#xA;da0 at umass-sim0 bus 0 target 0 lun 0                                         &#xA;da0: &amp;lt;ST ST72682 2.10&amp;gt; Removable Direct Access SCSI-2 device                   &#xA;da0: 40.000MB/s transfers                                                      &#xA;da0: 1000MB (2048000 512 byte sectors: 64H 32S/T 1000C)                        &#xA;Trying to mount root from ufs:/dev/da0s2a                                      &#xA;WARNING: / was not properly dismounted                                         &#xA;Attaching /cf/packages/junos via /dev/mdctl...                                 &#xA;Mounted junos package on /dev/md0...                                           &#xA;&#xA;Media check on da0                                                             &#xA;Automatic reboot in progress...                                                &#xA;** /dev/da0s2a                                                                 &#xA;** Last Mounted on /                                                           &#xA;** Root file system                                                            &#xA;** Phase 1 - Check Blocks and Sizes                                            &#xA;** Phase 2 - Check Pathnames                                                   &#xA;** Phase 3 - Check Connectivity                                                &#xA;** Phase 4 - Check Reference Counts                                            &#xA;** Phase 5 - Check Cyl groups                                                  &#xA;142 files, 75006 used, 75032 free (32 frags, 9375 blocks, 0.0% fragmentation)  &#xA;&#xA;***** FILE SYSTEM MARKED CLEAN *****                                           &#xA;Verified junos signed by PackageProduction_12_1_0                              &#xA;Verified jboot signed by PackageProduction_12_1_0                              &#xA;Ignoring watchdog timeout during boot/reboot                                   &#xA;veriexec: cannot verify /packages/junos-12.1X44-D35.5-domestic.sig: ERROR: Faic&#xA;** /dev/bo0s3e                                                                 &#xA;** Last Mounted on /config                                                     &#xA;** Phase 1 - Check Blocks and Sizes                                            &#xA;** Phase 2 - Check Pathnames                                                   &#xA;** Phase 3 - Check Connectivity                                                &#xA;** Phase 4 - Check Reference Counts                                            &#xA;** Phase 5 - Check Cyl groups                                                  &#xA;19 files, 50 used, 12388 free (36 frags, 1544 blocks, 0.3% fragmentation)      &#xA;&#xA;***** FILE SYSTEM MARKED CLEAN *****                                           &#xA;** /dev/bo0s3f                                                                 &#xA;** Last Mounted on /cf/var                                                     &#xA;** Phase 1 - Check Blocks and Sizes                                            &#xA;** Phase 2 - Check Pathnames                                                   &#xA;** Phase 3 - Check Connectivity                                                &#xA;** Phase 4 - Check Reference Counts                                            &#xA;** Phase 5 - Check Cyl groups                                                  &#xA;FREE BLK COUNT(S) WRONG IN SUPERBLK                                            &#xA;SALVAGE? yes                                                                   &#xA;&#xA;SUMMARY INFORMATION BAD                                                        &#xA;SALVAGE? yes                                                                   &#xA;&#xA;BLK(S) MISSING IN BIT MAPS                                                     &#xA;SALVAGE? yes                                                                   &#xA;&#xA;637 files, 10808 used, 164510 free (254 frags, 20532 blocks, 0.1% fragmentatio)&#xA;&#xA;***** FILE SYSTEM MARKED CLEAN *****                                           &#xA;&#xA;***** FILE SYSTEM WAS MODIFIED *****                                           &#xA;Loading configuration ...                                                      &#xA;vn_read_compressed: inflate of bytepos 86966272, offset in file = 51491159, er}&#xA;panic: bad inflate                                                             &#xA;cpuid = 0                                                                      &#xA;KDB: stack backtrace:                                                          &#xA;SP 0: not in kernel                                                            &#xA;uart_z8530_class+0x0 (0,0,0,0) ra 0 sz 0                                       &#xA;pid 54, process: md0                                                           &#xA;###Entering boot mastership relinquish phase                                   &#xA;KDB: enter: panic                                                              &#xA;[thread pid 54 tid 100048 ]                                                    &#xA;Stopped at      breakpoint+0x4: jr      ra                                     &#xA;db&amp;gt;                                                                            &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please note the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;a USB drive was in the device&lt;/li&gt;&#xA;&lt;li&gt;a Serial cable was in the device&lt;/li&gt;&#xA;&lt;li&gt;The device was NOT on UPS, and power unstability might have occured. &lt;/li&gt;&#xA;&lt;li&gt;4 different network were created and 3 of these were monitored &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;hope someone can shed some light on what might have gone wrong. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update2:&lt;/strong&gt;&#xA;Pressing the power buttong did nothing, but pressing, and holding it for 6+ seconds turned the switch OFF. and when I turned it ON again, it loaded the config as normal. so, the device was NOT wiped this time, unlike the initial time.&lt;/p&gt;&#xA;" OwnerUserId="6375" LastEditorUserId="6375" LastEditDate="2014-07-14T05:05:28.690" LastActivityDate="2014-07-17T18:50:33.597" Title="Juniper SRX100 and SRX210 goes to factory reset for no reason" Tags="|juniper-srx|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="9742" PostTypeId="2" ParentId="9695" CreationDate="2014-07-03T10:52:29.643" Score="2" Body="&lt;p&gt;I would normally setup a single firewall with 3 sections, (what I call RED, ORANGE, GREEN), and setup rules between the 3. RED is your WAN (internett), ORANGE is your DMZ (where you put any server you want to be reachable from the internett), and a GREEN network for your normal PC's and other servers that are not to be reached from the internet (or the DMZ for that matter).  even with a ORANGE network, this network can be protected quite well (for example only open port 80 if that is all you use).&lt;/p&gt;&#xA;" OwnerUserId="6375" LastActivityDate="2014-07-03T10:52:29.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9743" PostTypeId="1" AcceptedAnswerId="9757" CreationDate="2014-07-03T11:08:19.163" Score="11" ViewCount="298" Body="&lt;p&gt;I'm currently planning a v6 only small datacenter network.&#xA;Imagine for now one deployment consisting of 6 racks with 12 servers per rack.&#xA;Each server has 2 NICs for two physically separate networks (management &amp;amp; data).&#xA;The racks are interconnected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For ULA addresses I want to divide 16 Subnet Bits with 4 bits for &quot;network type&quot;, 4 bits for &quot;deployment ID&quot; and 8 bits for &quot;rack ID&quot;. So each rack gets its own subnet and humans can identify them easily. &#xA;So per rack I need to send RAs with the reachable on-link prefixes of the other racks and one prefix for SLAAC so the servers generate their addresses. But the racks don't have physical routers. Only the distribution layer above the racks has routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My idea now is to let one server send RAs with &quot;Router Lifetime = 0&quot; (which is allowed in that case (see RFC4861)) for the rack. But now the RAs spread over all racks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thesis: I need to block RAs from traversing through switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: Is this how it is meant to be done? Are there any operational experiences with datacenter networks on v6 only?&lt;/p&gt;&#xA;" OwnerUserId="6376" LastEditorUserId="4777" LastEditDate="2014-07-03T11:12:51.300" LastActivityDate="2014-07-07T02:28:33.970" Title="IPv6 Subnetting - Block RA on Switches?" Tags="|router|switch|ipv6|subnet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9744" PostTypeId="1" AcceptedAnswerId="9745" CreationDate="2014-07-03T12:52:36.073" Score="4" ViewCount="5897" Body="&lt;p&gt;I've recently begun working with firewalls (Different brands) and what really confuses me is the order the different firewalls check the ACL and NAT rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, allow HTTP traffic from the internet to a webserver on a LAN:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Public IP: 1.1.2.2&lt;/li&gt;&#xA;&lt;li&gt;Privat IP: 192.168.1.2&lt;/li&gt;&#xA;&lt;li&gt;Destination port: 80&lt;/li&gt;&#xA;&lt;li&gt;NAT the public IP-address 1.1.2.2 to 192.168.1.2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;On some firewalls the ACL allows traffic from the internet to the webserver defining the LAN IP-address as the destination:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ACL: outside-in&lt;/li&gt;&#xA;&lt;li&gt;Allow&lt;/li&gt;&#xA;&lt;li&gt;Interface: Outside&lt;/li&gt;&#xA;&lt;li&gt;Source: any&lt;/li&gt;&#xA;&lt;li&gt;Destination: 192.168.1.2&lt;/li&gt;&#xA;&lt;li&gt;Port: 80&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But I sometimes see the public IP-address instead:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ACL: outside-in&lt;/li&gt;&#xA;&lt;li&gt;Allow&lt;/li&gt;&#xA;&lt;li&gt;Interface: Outside&lt;/li&gt;&#xA;&lt;li&gt;Source: any&lt;/li&gt;&#xA;&lt;li&gt;Destination: 1.1.2.2&lt;/li&gt;&#xA;&lt;li&gt;Port: 80&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In what order does the different brands of firewalls check NAT rules and the ACL's? Is there a difference between versions on the same type of firewall?&lt;/p&gt;&#xA;" OwnerUserId="3200" LastEditorUserId="3200" LastEditDate="2014-07-03T15:14:27.180" LastActivityDate="2023-04-16T19:20:09.487" Title="NAT and ACL order - Cisco ASA, Palo Alto, Checkpoint" Tags="|cisco|cisco-asa|palo-alto|checkpoint|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9745" PostTypeId="2" ParentId="9744" CreationDate="2014-07-03T14:28:27.960" Score="5" Body="&lt;p&gt;I can't speak to other platforms with authority but the Cisco ASA platform does it both ways depending on the version of code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pre-8.3, NAT was done after the ACL (so you would use the global or outside IP address in the ACL).  8.3 or later NAT is done before the ACL (so you will use the actual configured or inside IP in the ACL).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way NAT is configured also changed in this version.  You can check &lt;a href=&quot;https://supportforums.cisco.com/document/48646/asa-83-upgrade-what-you-need-know&quot; rel=&quot;noreferrer&quot;&gt;this Cisco Support Community post&lt;/a&gt; or other resources for details.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-07-03T14:28:27.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9747" PostTypeId="2" ParentId="9695" CreationDate="2014-07-03T14:47:45.173" Score="4" Body="&lt;p&gt;There is a lot of theory in firewall design and the old outside/dmz/inside model, while still common is not by any means as popular as it once was.  This question also borders on being closed as &quot;opinion based,&quot; but I won't vote it as such personally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion (since this sounds like a smaller deployment), you should be looking at for four zones, which would be much easier to manage/support, as well as more cost effective, on a single firewall that supports it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order of security (lowest to highest), I would structure the zones as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;outside: basically outside your firewall and free of any firewall restrictions.  This would also be one of two places you would put any guest access (fitting it in a four zone model and not adding a fifth).&lt;/li&gt;&#xA;&lt;li&gt;student: this is where students would connect to the network, protected from the outside, but without free access to internal resources.  This is the second place you could consider for guest access.&lt;/li&gt;&#xA;&lt;li&gt;dmz: this is the traditional dmz where you would put externally accessed resources.  In this case, it is also where you would put resources that should be accessed by students/guests.&lt;/li&gt;&#xA;&lt;li&gt;internal: for your staff and internal only resources. For added security, this could also be broken up into two different zones.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However key to any good firewall deployment today would be looking into a firewall that is application aware.  This can provide additional protection beyond the traditional &quot;limit access to IP/port&quot; and state rules. For instance, it may be able to detect XSS or SQL injection attacks and block those as well.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-07-03T14:47:45.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9748" PostTypeId="1" AcceptedAnswerId="9919" CreationDate="2014-07-03T15:06:47.340" Score="6" ViewCount="3772" Body="&lt;p&gt;We capture many pcap files every day on many different multicast groups.  For the purposes of testing &amp;amp; benchmarking, we wish to replay these files in an isolated environment and in a controlled way.  These pcap files are captured simultaneously, but on different multicast groups &amp;amp; ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to replay these files back on to the network (possibly with ttl=0 or 1) in the order in which the packets were recorded, and on different (and specifyable) multicast groups.  This ordering must be synchronized accross &lt;em&gt;all&lt;/em&gt; of the files being played back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, suppose we have two capture files, &lt;code&gt;foo.pcap&lt;/code&gt; and &lt;code&gt;bar.pcap&lt;/code&gt;.  We want to replay &lt;code&gt;foo.pcap&lt;/code&gt; packets on mcast group 239.255.0.1:30001, and the &lt;code&gt;bar.pcap&lt;/code&gt; packets should be replayed on 239.255.0.2:30002.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;foo.pcap&lt;/code&gt; has packets recorded at time offsets 0, 1, and 5.  &lt;code&gt;bar.pcap&lt;/code&gt; has packets recorded at time offsets (relative to &lt;code&gt;foo.pcap&lt;/code&gt;) 3, 4, and 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I'm looking for is a way to replay these packets &lt;em&gt;in an order synchronized accross both &lt;code&gt;foo.pcap&lt;/code&gt; and &lt;code&gt;bar.pcap&lt;/code&gt;&lt;/em&gt;.  In other words, the first 2 packets from &lt;code&gt;foo.pcap&lt;/code&gt; should go out on to 239.255.0.1:30001, and then the first two packets from &lt;code&gt;bar.pcap&lt;/code&gt; should go out on 239.255.0.2:30002, and then the past packet from &lt;code&gt;foo.pcap&lt;/code&gt; should go out &lt;em&gt;at the same time&lt;/em&gt; (or close to it) as the last packet from &lt;code&gt;bar.pcap&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We also need to be able to tune the rate at which packets are replayed.  eg, at recorded speed; 10x recorded speed; 1 GB/sec; etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I accomplish this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have looked in to tools such as &lt;a href=&quot;http://tcpreplay.synfin.net/&quot;&gt;tcpreplay&lt;/a&gt; and &lt;a href=&quot;http://bittwist.sourceforge.net/doc/bittwist.1.html&quot;&gt;bittwist&lt;/a&gt;, but these tools either won't send on different groups, or won't synchronize the egress order across all the files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be working in Linux only (RHEL 6.5 primarily &amp;amp; also Ubuntu 12.04)&lt;/p&gt;&#xA;" OwnerUserId="6378" LastActivityDate="2014-07-11T21:56:24.977" Title="How do I mcast multiple pcap files simultaneously with guaranteed ordering and controllable speed?" Tags="|multicast|linux|pcap|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9749" PostTypeId="1" CreationDate="2014-07-03T15:25:24.130" Score="2" ViewCount="197" Body="&lt;p&gt;We use &lt;a href=&quot;http://www.ringcentral.com/&quot; rel=&quot;nofollow&quot;&gt;Ring Central&lt;/a&gt; for VoIP.  I inherited this company and so that's the service we have, and I know nothing about VoIP.  We have increased our bandwidth to 80Mb down and 6+Mb up, and that's as high as we can go.  We might have 5-10 people on the phone, usually 5 or less, at any given time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get complaints about dropped calls and think that might go away after the increased bandwidth, but echos are another issue.  How can I trace echos on our calls?  Thank you, I appreciate this!&lt;/p&gt;&#xA;" OwnerUserId="6379" LastEditorUserId="3191" LastEditDate="2014-07-05T09:31:54.190" LastActivityDate="2014-07-05T09:31:54.190" Title="Echo on VoIP Calls" Tags="|voip|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9752" PostTypeId="1" CreationDate="2014-07-03T17:08:29.017" Score="1" ViewCount="133" Body="&lt;p&gt;I'm wondering how ADSL networks are implemented in an enterprise. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have about 20 computers in my network which will be accessing the ADSL internet connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how my network will be :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ADSL Modem (LAN) ----&gt; (WAN) 24 port switch (LANs) ------------&gt; End users&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ADSL modem's 1 LAN port will be connected to the WAN port of the 24 port switch.&#xA;The end users will be connected to the switch via ethernet cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I'm wondering since all the traffic converges at the single LAN port of the ADSL modem, will there be a congestion ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do large enterprises set up their internet connection in this scenario ?&lt;/p&gt;&#xA;" OwnerUserId="6382" LastActivityDate="2014-07-03T17:15:18.540" Title="Will a network congestion occur if I use a single ADSL router connected to 24 port switch" Tags="|switch|adsl|congestion|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9753" PostTypeId="2" ParentId="9752" CreationDate="2014-07-03T17:15:18.540" Score="4" Body="&lt;p&gt;The Ethernet connections are full duplex, and in this sense there shouldn't be usually problem on a path from end user to switch, and in most of the time, from switch to ADSL router. However, depending on your end user traffic patterns (applications, time, and so on), the bandwidth available on both upstream and downstream of your ADSL service may be oversubscribed (congested) and if ADSL router can't buffer traffic long enough, drops will occur.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, most of the ADSL circuits are oversubscribed anyway from ISP point of view, you may not get maximum bandwidth from the link anyway.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-07-03T17:15:18.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9756" PostTypeId="1" CreationDate="2014-07-03T18:25:41.490" Score="2" ViewCount="1827" Body="&lt;p&gt;Here is the scenario:&#xA;A Cisco ASA 5525 running 9.1(5) receives a packet (let's call it packet 'A') on its OUTSIDE interface with a destination address somewhere on its inside network. However, the ASA does not have a route for that specific destination IP address but does have a static route pointing to the OUTSIDE interface. Therefore, packet 'A' is routed to/egresses the OUTSIDE interface. I assume that a &quot;fast-path&quot; connection is now established which includes that routing information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Soon after, the ASA adds an OSPF-learned route that establishes any IP address on the inside network should be routed to the INSIDE interface on the ASA. The ASA then receives packet 'B' at the OUTSIDE interface. Packet 'B' is identical to packet 'A' (destined for an IP on the inside network), but because of the fast path connection, packet 'B' is routed back out the OUTSIDE interface just like packet 'A.' This happens in spite of the OSPF-learned route which says that packet 'B' should have been sent to the INSIDE interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, this a problem. We replace the OSPF-learned route with an identical static route. Result: no change to the fast path connection. Packets destined to the inside network are still routed back whence they came.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not until we explicitly tell the ASA to &quot;clear connection {inside-IP}&quot; that it deletes that fast-path connection and begins routing packets like 'A' and 'B' correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are: why is the Adaptive Security Algorithm working this way? If a fast-path connection is never in danger of timing out due to steady traffic flow, what has to change for that fast-path to be cleared if not a dynamically-learned route?&lt;/p&gt;&#xA;" OwnerUserId="6385" LastActivityDate="2014-07-18T14:03:41.140" Title="What happens to a fast path connection when a new route is learned?" Tags="|cisco-asa|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9757" PostTypeId="2" ParentId="9743" CreationDate="2014-07-03T19:07:24.290" Score="8" Body="&lt;p&gt;No, this is not how it is meant to be done. The normal way of addressing in IPv6 is to use one /64 per (V)LAN / ethernet segment and number the devices within that /64. So if the network stretches across multiple racks then don't put the rack number in the subnet id, but somewhere in the last 64 bits.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-07-03T19:07:24.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9758" PostTypeId="2" ParentId="2173" CreationDate="2014-07-03T20:36:42.760" Score="0" Body="&lt;p&gt;I would prefer some way to check directly on the Fortigate device which ports are listening, but I could not find yet any command to do this that is clearly documented. However, I´ve found today this document referencing which ports are used by several Fortinet devices for different functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs.fortinet.com/uploaded/files/1880/FortinetOpenPorts.pdf&quot; rel=&quot;nofollow&quot;&gt;http://docs.fortinet.com/uploaded/files/1880/FortinetOpenPorts.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2014-07-03T20:36:42.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9759" PostTypeId="1" CreationDate="2014-07-03T20:55:36.923" Score="3" ViewCount="206" Body="&lt;p&gt;PLPMTUD - Packatization Layer Path MTU Discovery&#xA;Subsequently increasing MTU probe requests are sent to measure optimal MTU till one fails. &#xA;Does the probe request contain actual data to be sent? OR is it just like a dummy packet without any data in it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, how does one differentiate between regular tcp packet and this probe packet?&lt;/p&gt;&#xA;" OwnerUserId="6386" LastEditorUserId="775" LastEditDate="2014-12-08T12:54:16.487" LastActivityDate="2015-05-21T17:59:04.617" Title="RFC4821 PLPMTUD probe request" Tags="|tcp|mtu|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9761" PostTypeId="1" AcceptedAnswerId="9765" CreationDate="2014-07-04T05:00:05.153" Score="3" ViewCount="1349" Body="&lt;p&gt;We've deployed the caching server in local ISP and peered it with the ISP router via BGP protocol in order to get all advertised ip prefixes of ISP. We need to redirect all of these ip prefixes into a file and sync it to the DNS server. So, we'll add all of these prefixes into bind view directive in order to direct all requests coming from our local ISP clients towards the local caching server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;can i use the combination of bash with quagga and redirect all bgp routes into the file ? show ip bgp command displays all the advertised routes but i am unable to redirect these routes into the file. Linux route command also shows these prefixes but i need cidr notation i.e 1.2.3.4/24 but route command doesn't support it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please suggest me if you have better approach.&lt;/p&gt;&#xA;" OwnerUserId="6265" LastActivityDate="2015-02-05T08:23:26.483" Title="Redirect BGP routes into the file with quagga" Tags="|bgp|linux|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9762" PostTypeId="1" AcceptedAnswerId="9766" CreationDate="2014-07-04T07:33:45.263" Score="5" ViewCount="2398" Body="&lt;p&gt;I'm a unix systems engineer and my network background is not so strong; I need a help to do the last touch-up to a cisco 877.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've substituted our adsl router (a simple home router provided by the provider) with this cisco and I've a couple of question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I done the conf after a long walking on google, and the connectivity from office to internet works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I need to use the publics IP: we have some public IP (a /29 net) and with the old router these IPs were forwarded directly to the internal firewall for the management (routing, natting, ecc. ecc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internal firewall mounts on its interfaces these IPs, so I need to forward the traffic from internet, through the router, directly there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second question is: what is the BVI interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the router I've 4 eth interfaces, but hte internat IP is configured on the BVI interface. Why? What is it?&#xA;Can I use it like a VLAN, attaching/detaching interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I create a VLAN, to use on a different net some of these interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the conf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xelerc001#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 3533 bytes&#xA;!&#xA;version 12.4&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname xelerc001&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;logging message-counter syslog&#xA;enable secret 5 xxxxxxxxxxxxxxxxxxxxxxxx&#xA;enable password 7 xxxxxxxxxxxxxxxxxxxxx&#xA;!&#xA;no aaa new-model&#xA;!&#xA;dot11 syslog&#xA;ip source-route&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;ip name-server 8.8.8.8&#xA;ip name-server 8.8.4.4&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;username admin privilege 15 secret 5 ddddddddddddddddddddddddddd&#xA;! &#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;interface ATM0&#xA; no ip address&#xA; no atm ilmi-keepalive&#xA; dsl operating-mode adsl2+ &#xA;!&#xA;interface ATM0.1 point-to-point&#xA; pvc 8/35 &#xA;  encapsulation aal5mux ppp dialer&#xA;  dialer pool-member 1&#xA; !&#xA;!&#xA;interface FastEthernet0&#xA;!&#xA;interface FastEthernet1&#xA;!&#xA;interface FastEthernet2&#xA;!&#xA;interface FastEthernet3&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; ip tcp adjust-mss 1452&#xA; bridge-group 1&#xA;!&#xA;interface Dialer0&#xA; ip address negotiated&#xA; ip mtu 1492&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; encapsulation ppp&#xA; dialer pool 1&#xA; dialer-group 1&#xA; ppp authentication pap chap callin&#xA; ppp chap hostname xxxuserxxx&#xA; ppp chap password 7 XXX00PASSWORD00XX&#xA; ppp pap sent-username xxxuserxxx password 7 XXX00PASSWORD00XX&#xA;!&#xA;interface BVI1&#xA; ip address 192.168.0.254 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; ip tcp adjust-mss 1452&#xA;!&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 Dialer0&#xA;ip http server&#xA;ip http authentication local&#xA;ip http secure-server&#xA;!&#xA;!&#xA;ip nat inside source list 1 interface Dialer0 overload&#xA;!&#xA;access-list 1 permit 192.168.0.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;bridge 1 protocol ieee&#xA;bridge 1 route ip&#xA;!&#xA;line con 0&#xA; password 7 XXpasswordXX&#xA; login&#xA; no modem enable&#xA;line aux 0&#xA;line vty 0 4&#xA; privilege level 15&#xA; login local&#xA; transport input telnet ssh&#xA;!&#xA;scheduler max-task-time 5000&#xA;end&#xA;&#xA;xelerc001# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks to all in advance,&#xA;Regards&lt;/p&gt;&#xA;" OwnerUserId="6392" LastEditorUserId="775" LastEditDate="2014-07-04T11:49:50.867" LastActivityDate="2014-07-04T16:19:17.767" Title="Cisco 877 ADSL Configuration" Tags="|cisco|routing|adsl|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9763" PostTypeId="1" CreationDate="2014-07-04T08:22:05.460" Score="6" ViewCount="1942" Body="&lt;p&gt;I am network administrator in a small company. Until recently i used the Cisco ASA to prevent the employees from surfing facebook, youtube... But now they are using proxy server to overcome this. Any idea on how to prevent this ?&lt;/p&gt;&#xA;" OwnerUserId="6394" LastActivityDate="2020-06-10T04:47:51.710" Title="Block usage of proxy server" Tags="|cisco-asa|http-proxy|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9764" PostTypeId="2" ParentId="9763" CreationDate="2014-07-04T09:05:23.660" Score="4" Body="&lt;p&gt;One way that won't be well-received is to provide a locked-down proxy inside your network and block all inside-out tcp/80 traffic except for that proxy.  Your clients won't get web access unless they go through &lt;em&gt;your&lt;/em&gt; proxy.  If the outside proxy they're using is on some other port, you're probably covered already if you don't have the inside implicit any/any allowed rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.squid-cache.org/&quot; rel=&quot;nofollow&quot;&gt;Squid&lt;/a&gt; comes to mind as one proxy you could use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other considerations should go to ASA-X series firewalls with CX and possibly NBAR on your router.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2014-07-04T09:12:23.267" LastActivityDate="2014-07-04T09:12:23.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9765" PostTypeId="2" ParentId="9761" CreationDate="2014-07-04T12:12:42.403" Score="2" Body="&lt;p&gt;Let's assume that you are in a bash shell on the quagga router... use the &lt;a href=&quot;http://linux.about.com/library/cmd/blcmdl1_script.htm&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;script&lt;/code&gt;&lt;/a&gt; command to capture output from quagga (or any other interactive CLI session)... a contrived example which saves the quagga bgp routes to a file named bgp_routes.txt&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ script bgp_routes.txt&#xA;Script started, file is bgp_routes.txt&#xA;$ telnet localhost 2605&#xA;... authenticate as required&#xA;Router# terminal length 0&#xA;... run show ip bgp command&#xA;Router# exit&#xA;$ exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-07-04T23:05:59.540" LastActivityDate="2014-07-04T23:05:59.540" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9766" PostTypeId="2" ParentId="9762" CreationDate="2014-07-04T16:19:17.767" Score="4" Body="&lt;p&gt;1) Have you asked your ISP to route the /29 public net to the dialer0 address that is assigned to your router via PPP\IPCP(Internet Protocol Control Protocol)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once that is done then route the /29 via a static route towards your firewall it's best to have an interconnect between your internet router and firewall which has public addressing. (I've answered this based on the details you've provided so hopefully I'm not off target with my answer here)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) BVI is 'bridged virtual interface' it is the IRB(Integrated Routing and Bridging) functionality provided by IOS to allow a VLAN to span a router when you have disconnected VLAN domains or have some special requirement to bridge vlans\routed interfaces together in your network. Have a read of &gt;&gt; &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/integrated-routing-bridging-irb/17054-741-10.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/integrated-routing-bridging-irb/17054-741-10.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) You need an 'Advanced IP services' IOS image on the 877 series to be able to create multiple vlans and associated SVIs. Otherwise the base IOS image only allows one routed SVI which by default is Vlan 1. This is the vlan all switchports belong to by default when in L2 switchport mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH.&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2014-07-04T16:19:17.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9767" PostTypeId="2" ParentId="9743" CreationDate="2014-07-04T16:27:59.260" Score="3" Body="&lt;p&gt;Without more details I might be generalizing here... but why don't you give each rack it's own VLAN which is trunked from the distribution layer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then have RAs sent for each rack from it's given Vlan SVI. Thereby ensuring you're not sending RAs left, right and centre. Each rack will be given its own subnet as it is in a separate L2 domain and it can configure its host bits via SLAAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the previous answer is correct regarding best practice... /64 for subnet... allow host to have 64 bits for SLAAC for eui-64 address configuration.&lt;/p&gt;&#xA;" OwnerUserId="168" LastEditorUserId="168" LastEditDate="2014-07-07T02:28:33.970" LastActivityDate="2014-07-07T02:28:33.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9768" PostTypeId="1" CreationDate="2014-07-04T18:42:52.887" Score="4" ViewCount="1998" Body="&lt;p&gt;I am looking a L2/L3 switch spec. which says it supports 256 Router Legs and maximum of 32 Static routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody explain with an example, what is the difference between router leg and static route?&lt;/p&gt;&#xA;" OwnerUserId="3282" LastActivityDate="2020-07-11T14:13:08.030" Title="Difference between router leg and static routes" Tags="|routing|layer3|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9769" PostTypeId="2" ParentId="9768" CreationDate="2014-07-04T19:19:22.347" Score="7" Body="&lt;p&gt;By &quot;router leg&quot; they mean a (directly) connected route (and use a strange way of putting it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is a connected route compared to a static route?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Connected route (router leg)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;connected route&lt;/strong&gt; is a route that &lt;strong&gt;points to an interface&lt;/strong&gt;. For example if you configure &lt;code&gt;10.0.0.1/24&lt;/code&gt; on (ethernet) interface &lt;code&gt;Gi0/1&lt;/code&gt; the directly connected route (the &quot;router leg&quot;) is &lt;code&gt;10.0.0.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router wants to send a packet to a host in the &lt;code&gt;10.0.0.0/24&lt;/code&gt; network it will do a L2 (Layer2) lookup (ARP for IPv4, ND for IPv6) on the &lt;code&gt;Gi0/1&lt;/code&gt; interface to find the MAC address of the host. It will then send the packet to the MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One-liner: Connected routes point to an interface, next-hop for packet will be resolved at L2 by ARP/ND on the respective interface.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Static route&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;static route points to an IP address&lt;/strong&gt;. For example you could have route &lt;code&gt;10.0.0.0/24&lt;/code&gt; pointing to &lt;code&gt;10.0.2.1&lt;/code&gt;. The router will send packets for hosts in the &lt;code&gt;10.0.0.0/24&lt;/code&gt; network to &lt;code&gt;10.0.2.1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this to work &lt;code&gt;10.0.2.1&lt;/code&gt; itself must be part of a connected route so that the router can find the right L2 next-hop for the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One-liner: Static routes point to an IP next-hop. The IP next-hop itself will be resolved by L2 lookup on the interface the connected route for the next-hop points to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing you should ask your vendor: If the specs are for IPv4 and for IPv6, and if not how many IPv6 routes you can have for each of the different types.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-07-04T19:19:22.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9770" PostTypeId="1" AcceptedAnswerId="9771" CreationDate="2014-07-04T22:12:12.770" Score="5" ViewCount="20578" Body="&lt;p&gt;I'm repeating a &quot;LAN Switching and Wireless&quot; module in college and I'm looking over past exam papers in preparation for the repeat exam. One of the questions is&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is a broadcast domain? Using an example, explain how VLANs affect the broadcast domain.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I know that a broadcast domain is a logical division of a network whereby all nodes can reach each-other on the data-link layer by broadcast. And I realise that each VLAN is essentially its own broadcast domain. But I don't know what example I could give that could answer this question properly.&lt;/p&gt;&#xA;" OwnerUserId="6397" LastActivityDate="2020-01-27T10:13:34.770" Title="How do VLANs affect the broadcast domain?" Tags="|vlan|broadcast|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9771" PostTypeId="2" ParentId="9770" CreationDate="2014-07-04T22:26:48.737" Score="15" Body="&lt;p&gt;Each VLAN creates its own broadcast domain in 1 or more physical switches. If you have a switch taken out of the box it tends to put all ports in vlan 1 so for say a 24 ports the broadcast domain includes all 24 ports. If you were to create a vlan 2 and configure half the ports to be members of vlan 2 you then have 2 broadcast domains each of 12 ports. if you create a vlan 3 and put half the ports that are still in vlan 1 in it you would end up with 3 broadcast domains 2 with 6 ports and another 1 with 12 ports.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastEditorUserId="-1" LastEditDate="2020-01-27T10:13:34.770" LastActivityDate="2020-01-27T10:13:34.770" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="9772" PostTypeId="2" ParentId="9749" CreationDate="2014-07-04T22:30:01.080" Score="1" Body="&lt;p&gt;Echo is caused by electrical interactions (like headsets) nothing in the IP part of the environment has anything to do with echo. In my environment headsets are the most common cause of echo.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2014-07-04T22:30:01.080" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9773" PostTypeId="1" AcceptedAnswerId="9775" CreationDate="2014-07-05T01:02:11.233" Score="5" ViewCount="962" Body="&lt;p&gt;We have a Cisco WLC and we want an open SSID for guests. We have a sign in form so they see our terms but this isn't a real liability protection. How can we block illegal activities on the open wireless connection via WLC or other technologies?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking squid + WCCP on our ASA but I'm not sure this is the best method for liability protection of the company. Are there other options that would supersede this? If this is the best option is there a best practice? Do companies normally rotate a guest account instead with 802.1x?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have Cisco firewalls, switches and wireless infrastructure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: specifically we would like to block torrents, site categories (guns, gambling, terrorism, etc) and VPN/proxies which would circumvent our limits.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2014-07-05T02:09:32.350" LastActivityDate="2014-07-05T02:50:59.540" Title="How do we protect our open guest wireless?" Tags="|wlc|http-proxy|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9775" PostTypeId="2" ParentId="9773" CreationDate="2014-07-05T02:50:49.307" Score="5" Body="&lt;p&gt;From a security perspective I've found the WLCs pretty bare on their own. You can do basic ACLs but not much more. I don't think you're going to find an answer on those alone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use an external web filter in association with the ASA - &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/97277-pix-asa-url-filtering.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/97277-pix-asa-url-filtering.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It requires either Websense or N2H2 (now McAfee SmartFilter, I guess?), but if you happen to already have either of those products it makes doing category blocking really simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Home brewing a solution based on Squid or some other caching/protection software could work, but if you're talking about legal liability you've got to be awfully certain of that solution's capabilities for Legal to sign off on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Outside of these options you could look at something like a Palo Alto firewall that will wrap your application and URL blocking into a single package that you can just put between the wireless clients and the internet.&lt;/p&gt;&#xA;" OwnerUserId="1286" LastActivityDate="2014-07-05T02:50:49.307" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9776" PostTypeId="2" ParentId="9773" CreationDate="2014-07-05T02:50:59.540" Score="0" Body="&lt;p&gt;Have the open guest network separated from the corporate network by having different vlans or DSL line for guest network. Have user role based firewall policies on the Cisco WLC allowing only http/https access. You should be able to block proxy server access as well.  There should also be an option to revoke websites. Contacting Cisco TAC would be a very helpful in this case.&lt;/p&gt;&#xA;" OwnerUserId="6267" LastActivityDate="2014-07-05T02:50:59.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9778" PostTypeId="2" ParentId="9749" CreationDate="2014-07-05T07:54:56.320" Score="3" Body="&lt;p&gt;Echo is not a VOIP-only issue, it also occurs on traditional phone systems. But echo is more noticeable in VOIP because of the increased latencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond ensuring that the microphones are not picking up noise from the environment or from speakerphones, the best thing you can do to ensure no echo is to have low latency to Ringcentral's servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not a matter of more bandwidth, but of less travel time between your office and their servers. You can use a tool like Pingplotter to measure latency (make sure you set the packet type to UDP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are things that you can do to improve the voice quality:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Make sure that your voice traffic has priority over your data traffic.&lt;/li&gt;&#xA;&lt;li&gt;Make sure that no other sources of traffic can trample over your voice packets&lt;/li&gt;&#xA;&lt;li&gt;Segregate your data from your voice traffic and send it through 2 different ISPs&lt;/li&gt;&#xA;&lt;li&gt;Get a data T1 - you will see sub 10ms RTTs instead of 40-50ms on cable&lt;/li&gt;&#xA;&lt;li&gt;Make sure your IP phones are wired all the way to the router -- wifi introduces lots of variability to a network's latency&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="6402" LastActivityDate="2014-07-05T07:54:56.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9779" PostTypeId="2" ParentId="9737" CreationDate="2014-07-05T08:08:31.947" Score="0" Body="&lt;p&gt;I've deployed Cisco Meraki for 3 similarly sized small businesses in the last 6 weeks. If you do decide to go with Meraki, you could get:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;An MX80 security appliance which accepts up to 100 users&lt;/li&gt;&#xA;&lt;li&gt;If you need switching infrastrucure, an MS220 switch&lt;/li&gt;&#xA;&lt;li&gt;One or two MR18 or MR26 access points&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This setup regularly supports over 100 end-user devices, 2 WAN interfaces (one 150Mbps and a bonded T1) with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Traffic shaping&lt;/li&gt;&#xA;&lt;li&gt;VLANs&lt;/li&gt;&#xA;&lt;li&gt;Firewalling / SPI&lt;/li&gt;&#xA;&lt;li&gt;load balancing&lt;/li&gt;&#xA;&lt;li&gt;content caching&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, not to sidestep your question, but I feel that the better way to size a router or security appliance is by how many office workers it can support, and the vendor should give you a straight up answer on what that number is. Otherwise you could end up with a monster router for a what amounts to a small office.&lt;/p&gt;&#xA;" OwnerUserId="6402" LastActivityDate="2014-07-05T08:08:31.947" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9781" PostTypeId="1" CreationDate="2014-07-05T08:24:46.307" Score="6" ViewCount="1186" Body="&lt;p&gt;It seems that as time passes, vendors have added almost all the features of a router to a layer 3 switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For branch office deployments, how do other people who design networks choose between deploying a router + a layer 2 switch vs deploying just a layer 3 switch?&lt;/p&gt;&#xA;" OwnerUserId="6402" LastEditorUserId="8499" LastEditDate="2018-03-21T00:44:26.380" LastActivityDate="2018-03-21T00:44:26.380" Title="When is a layer 3 switch more appropriate than a router in a branch office?" Tags="|switch|router|layer3|design|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9782" PostTypeId="2" ParentId="9781" CreationDate="2014-07-05T08:34:01.380" Score="5" Body="&lt;p&gt;Layer 3 switch doesn't provide the typical edge features used on a router:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;NAT/PAT (along with IPv4-&gt;IPv6 transition technologies)&lt;/li&gt;&#xA;&lt;li&gt;Stateful Firewall&lt;/li&gt;&#xA;&lt;li&gt;HQoS for multiple classes of traffic at a rate Ethernet is shaped/policed on the ISP side (usually you'll get subrate service, not full bandwidth of the Ethernet port connected to the device)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That said, for the inter-vlan routing in most of the scenarios the L3 switch will perform better and cause less problems, as small/edge routers are still using CPU to route the traffic and performance may be not ideal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So propably you'll want L3 switch and edge router.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-07-05T08:34:01.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9785" PostTypeId="2" ParentId="9781" CreationDate="2014-07-05T09:49:20.237" Score="4" Body="&lt;p&gt;The distinction between &quot;Layer3 Switch&quot; and &quot;Router&quot; is muddy and not defined. Vendors use whatever term they think is best for PR (sometimes switching between both terms). L3 Switch and router can be substituted almost any time. You must look at the feature list to see if the device has all the features you need for your branch office.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-07-05T09:49:20.237" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9789" PostTypeId="1" AcceptedAnswerId="9802" CreationDate="2014-07-05T10:50:21.957" Score="2" ViewCount="2597" Body="&lt;p&gt;I want to configure my L3 switch to connect multiple devices:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;squid proxy (192.168.1.4)&lt;/li&gt;&#xA;&lt;li&gt;web server (192.168.1.6)&lt;/li&gt;&#xA;&lt;li&gt;client (192.168.1.11)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;something like that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wIzay.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the problem is when I configure one interface it worked will:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address 192.168.1.7 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but when I try(on another interface):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address 192.168.1.8 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this message returned:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.0 overlaped with fastethernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is confusing, because I have used &lt;code&gt;/24&lt;/code&gt; as a mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and even when I try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address 192.168.2.8 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't connect the webserver(192.168.1.6) to the squid (192.168.2.4) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is there something I have missed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I have configured all the interfaces to be &lt;code&gt;no switchport&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4777" LastEditorUserId="4777" LastEditDate="2014-07-05T10:59:04.857" LastActivityDate="2014-07-06T10:01:22.720" Title="IPs overlaps on L3 cisco 3550 switch?" Tags="|cisco|routing|switch|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9791" PostTypeId="2" ParentId="9789" CreationDate="2014-07-05T11:06:51.640" Score="2" Body="&lt;p&gt;Your two IP address statements ARE overlapping. &lt;strong&gt;192.168.1.7&lt;/strong&gt; and &lt;strong&gt;192.168.1.8&lt;/strong&gt; are in the same /24 subnet: 192.168.1.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A /24 are 256 addresses ranging from 192.168.1.0 to 192.168.1.255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know more, there are questions about &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3697/the-slash-after-an-ip-address-cidr-notation&quot;&gt;CIDR subnetting&lt;/a&gt; on this SE.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-07-05T11:06:51.640" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9792" PostTypeId="2" ParentId="9768" CreationDate="2014-07-05T11:34:45.587" Score="1" Body="&lt;p&gt;In addition, static route can also point to a local interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1- Static with next-hop as a local interface:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: &lt;code&gt;ip route 10.0.0.0 255.255.255.0 G0/1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For every destination in &lt;code&gt;10.0.0.0/24&lt;/code&gt;, the router will consider it directly connected to &lt;code&gt;G0/1&lt;/code&gt; and will send an ARP request, and will add an ARP entry when responded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2- Static with next-hope as IP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: &lt;code&gt;ip route 10.0.0.0 255.255.255.0 10.0.2.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the router does not need to send an ARP request for every destination in &lt;code&gt;10.0.0.0/24&lt;/code&gt;, the router will use the L2 address of next-hop (will resolve it once and then re-use ARP cache)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Difference:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;interface as next-hop&quot; will build huge arp table and its not recommended if local interface (&lt;code&gt;G0/1&lt;/code&gt;) connects to a huge network like internet provider or ISP gateway router. ARP table will keep increasing for every new destination on the internet and will eat up all the memory to a chocking point. Its ok to use on a p2p connection though. And it also requires proxy-arp to be enabled on the gateway router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;IP as next-hop&quot; on the other hand uses a single ARP entry, thats is for the gateway IP (&lt;code&gt;10.0.2.1&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="4079" LastActivityDate="2014-07-05T11:34:45.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9796" PostTypeId="2" ParentId="9620" CreationDate="2014-07-05T22:00:14.787" Score="4" Body="&lt;p&gt;This is a Splunk issue and not a network issue. As you can see from my Splunk log of an invalid login attempt (non-LDAP though):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jul  5 17:55:52 firewall.local %ASA-6-113015: AAA user &#xA;  authentication Rejected : reason = Invalid password : local database : &#xA;  user = legioxi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It shows the username in plaintext. The syslog ID is different because I do not have LDAP configured on my lab ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answers you seek will most likely be found in the Splunk manual as it will be as YLearn mentioned, in your &lt;a href=&quot;http://docs.splunk.com/Documentation/Splunk/6.1.1/Data/Anonymizedatausingconfigurationfiles&quot; rel=&quot;nofollow&quot;&gt;splunk config files&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logsevp.html#pgfId-1053227&quot; rel=&quot;nofollow&quot;&gt;explanation (cisco.com)&lt;/a&gt; of the syslog ID you're seeing.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2014-07-05T22:09:57.763" LastActivityDate="2014-07-05T22:09:57.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9798" PostTypeId="2" ParentId="789" CreationDate="2014-07-06T06:15:55.757" Score="-2" Body="&lt;p&gt;Prefix-lists are used to specify an address or range of address to be permit or deny in route updates...&lt;/p&gt;&#xA;" OwnerUserId="6411" LastActivityDate="2014-07-06T06:15:55.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9799" PostTypeId="2" ParentId="789" CreationDate="2014-07-06T06:30:42.393" Score="0" Body="&lt;p&gt;Prefix lists work very similarly to access lists; a prefix list contains one or more ordered entries which are processed sequentially.&lt;/p&gt;&#xA;" OwnerUserId="6411" LastActivityDate="2014-07-06T06:30:42.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9800" PostTypeId="1" AcceptedAnswerId="9809" CreationDate="2014-07-06T07:49:05.003" Score="2" ViewCount="7370" Body="&lt;p&gt;I found that different interfaces have different behaviour on different device (router, switch) when no cable is attached on Packet Tracer 6.0.1.0011.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router's serial  : down down&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router's ethernet: up down&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch's         : down down&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is that so special for ethernet? For serial, I was informed that the status will be up down if a cable is attached but has some mismatch for L2 configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I don't know if the behaviour is same if a cable is attached on the interface but the other end of the cable is not attached to any device.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="775" LastEditDate="2014-07-06T10:11:46.750" LastActivityDate="2023-04-28T16:14:34.290" Title="Packet Tracer: Ethernet interface up/down" Tags="|cisco|ethernet|interface|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9801" PostTypeId="2" ParentId="9789" CreationDate="2014-07-06T08:36:39.633" Score="0" Body="&lt;p&gt;Faster solution :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;&#xA;vlan 10 &#xA;name xxxx&#xA;&#xA;Interface vlan 10&#xA;Description xxxx&#xA;Ip adress 192.168.1.1 255.255.255.0 &#xA;no shut&#xA;Interface vlan 20&#xA;Description xxxx&#xA;Ip adress 192.168.2.1 255.255.255.0&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On ports:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switchport mode access &#xA;Switchport access vlan 10&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and for the squid server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switchport mode access &#xA;Switchport access vlan 20&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basic config , should get you started.&#xA;Now you can use the subnet where you need it , just make the ports access in vlan 10 / vlan 20 for the second subnet&#xA;ps: have fun.&lt;/p&gt;&#xA;" OwnerUserId="6412" LastActivityDate="2014-07-06T08:36:39.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9802" PostTypeId="2" ParentId="9789" CreationDate="2014-07-06T10:01:22.720" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So is there something I have missed?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, you've got the following machines that you want in the same /24 subnet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;squid proxy (192.168.1.4)&lt;/li&gt;&#xA;&lt;li&gt;web server (192.168.1.6)&lt;/li&gt;&#xA;&lt;li&gt;client (192.168.1.11)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However, you're trying to put each one of them on their own routed interface; this is a very common mistake.  The simplest solution to your problem is to create what Cisco calls a &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41860-howto-L3-intervlanrouting.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Switched Vlan Interface (SVI)&lt;/a&gt; for all of 192.168.1.0/24 on your 3550.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume you're going to use Vlan 10 for all these systems;  it doesn't really matter what vlan number you use, although people tend to avoid vlan 1 for security reasons.  I will make assumptions about which switchport you connected these systems to, however the port numbers should not matter; just be sure that you configure their actual port number in &lt;code&gt;vlan 10&lt;/code&gt;. The configuration you want to use is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;!&#xA;! many people set vtp to transparent to avoid future problems...&#xA;vtp mode transparent&#xA;!&#xA;vlan 10&#xA; state active&#xA;!&#xA;interface FastEthernet0/1&#xA; description [Squid Proxy]&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA; description [Web Server]&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/3&#xA; description [Client]&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.1.254 255.255.255.0&#xA; no ip proxy-arp&#xA; no ip directed-broadcast&#xA; no shut&#xA;!&#xA;! Add a default route on a different SVI if you want these systems&#xA;! to route through the 3550 to other networks&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now configure your squid proxy, web server, and client to use 192.168.1.254 as the default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, consider using &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2024/&quot;&gt;&lt;code&gt;switchport nonnegotiate&lt;/code&gt;&lt;/a&gt; on Fa0/1, Fa0/2, and Fa0/3.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-07-06T10:01:22.720" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9803" PostTypeId="1" CreationDate="2014-07-06T16:13:15.307" Score="3" ViewCount="1463" Body="&lt;p&gt;I can't seem to get this code working. I'm not well versed in ASA setups, but there seems to be an increase in popularity around here for them, and word gets out that if you can work on one, you're their guy and the guy for all their friends. Needless today, I copied a configuration from one ASA and modified it to match the settings needed for another location of the business.  I was able to get out to the internet, however, when the other agency tried to ping some equipment at the location so they could do their job, the equipment could not be pinged. I'm not sure how much more specific information you need, but any assistance on this would be more than wonderful. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CISCOASA(config-if)# show run&#xA;: Saved&#xA;:&#xA;ASA Version 8.2(5)&#xA;!&#xA;hostname CISCOASA&#xA;enable password encrypted&#xA;passwd encrypted&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.#.#.33 255.255.255.240&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 70.#.#.78 255.255.255.224&#xA;!&#xA;ftp mode passive&#xA;clock timezone CST -6&#xA;clock summer-time CDT recurring&#xA;object-group network StateNet&#xA; network-object 10.#.#.0 255.255.254.0&#xA; network-object 10.#.#.192 255.255.255.240&#xA; network-object 170.#.#.32 255.255.255.224&#xA; network-object 170.#.#.0 255.255.255.0&#xA; network-object 10.#.#.0 255.255.255.0&#xA; network-object 10.#.#.210 255.255.255.255&#xA;object-group network Inside&#xA; network-object 10.#.#.32 255.#.#.240&#xA;access-list outside_cryptomap extended permit ip object-group Inside object-group StateNet&#xA;access-list inside_nat0_outbound extended permit ip object-group Inside object-group StateNet&#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 0 access-list inside_nat0_outbound&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;route outside 0.0.0.0 0.0.0.0 70.#.#.78 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;http server enable&#xA;http 10.#.#.32 255.255.255.240 inside&#xA;http 170.#.#.100 255.255.255.255 outside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto map outside_map 1 match address outside_cryptomap&#xA;crypto map outside_map 1 set peer 170.#.#.5&#xA;crypto map outside_map 1 set transform-set ESP-AES-256-SHA&#xA;crypto map outside_map 1 set nat-t-disable&#xA;crypto map outside_map interface outside&#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 1&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 5&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA;&#xA;tunnel-group 170.#.#.5 type ipsec-l2l&#xA;tunnel-group 170.#.#.5 ipsec-attributes&#xA; pre-shared-key *****&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc&#xA;  inspect xdmcp&#xA;  inspect sip&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect ip-options&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;&#xA;: end&#xA;CISCOASA(config-if)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6415" LastEditorUserId="33" LastEditDate="2014-08-05T18:01:09.027" LastActivityDate="2015-02-02T00:32:17.010" Title="Configuring ASA: I can browse out, but no incoming traffic?" Tags="|cisco-asa|firewall|nat|ping|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9804" PostTypeId="2" ParentId="9803" CreationDate="2014-07-06T16:56:17.813" Score="2" Body="&lt;p&gt;Ideally we need more information... &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What were they trying to ping and not able to reach? Is this interesting traffic related to the IPSec crypto?&lt;/li&gt;&#xA;&lt;li&gt;What did you use to confirm internet reachability? Ping from the firewall via one of its interfaces or a machine behind the firewall?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However looking briefly at your config I noticed the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_cryptomap extended permit ip object-group &#xA;  Inside object-group SUPERS&#xA;access-list inside_nat0_outbound extended permit ip object-group &#xA;  Inside object-group SUPERS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;SUPERS&lt;/code&gt; object-group doesn't appear to exist in your configuration thus these two configuration lines won't actually be doing anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also it doesn't appear like you're no natting the IPSec VPN traffic. To ensure when it crosses your outbound interface it isn't natted but rather kept with it's original source IP so it can traverse the IPSec VPN tunnel unmodified.&lt;/p&gt;&#xA;" OwnerUserId="168" LastEditorUserId="3191" LastEditDate="2014-09-04T19:43:51.913" LastActivityDate="2014-09-04T19:43:51.913" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9805" PostTypeId="2" ParentId="6130" CreationDate="2014-07-06T19:40:02.327" Score="3" Body="&lt;p&gt;on pfsense put a static global route:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.2.0/24 --&gt;&gt;192.168.2.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on the cisco router/firewall put 2 statis routes :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iproute 192.168.4.0 255.255.255.0 xxxx(wan interface of the pfsense box , ip from 192.168.2.xx subnet)&#xA;iproute 192.168.3.0 255.255.255.0 xxxx(wan interface of the pfsense box , ip from 192.168.2.xx subnet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;make sure to uncheck the &quot;block private networks&quot; on the wan interface of the pfsense box , also you should disable nat on pfsense. &lt;/p&gt;&#xA;" OwnerUserId="6412" LastActivityDate="2014-07-06T19:40:02.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9806" PostTypeId="1" AcceptedAnswerId="9807" CreationDate="2014-07-06T21:07:06.797" Score="3" ViewCount="3523" Body="&lt;p&gt;I am studying for ICND1 through CBTNuggets,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently watched videos on how to interact between different vlans using separate interfaces, sub-interfaces and Layer 3 Switching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first two worked fine for me, but the Layer 3 Switching is not working when i am pinging PC in one VLAN to the PC in other VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose PC A is connected to Fa0/1 of Switcher and PC B is connected to Fa0/2 of Switcher.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I did,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went to Switcher CLI,&#xA;Went to Global Configuration mode,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;created two vlans using commands, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# vlan 10&#xA;# vlan 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I moved &lt;code&gt;fa0/0&lt;/code&gt; port to &lt;code&gt;vlan 10&lt;/code&gt; and &lt;code&gt;fa0/1&lt;/code&gt; port to &lt;code&gt;vlan 20&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assigned IP addresses to PCs,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC A (fa0/1): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.1.100 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Default Gateway: &lt;code&gt;10.1.1.1&lt;/code&gt;&#xA;Subnet Mask: &lt;code&gt;255.255.255.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC B (fa0/2):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.2.100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Subnet Mask: &lt;code&gt;255.255.255.0&lt;/code&gt;&#xA;Default Gateway: &lt;code&gt;10.1.2.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now i went to the CLi of switcher and did this in Global mode,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# interface vlan 10&#xA;# ip address 10.1.1.1 255.255.255.0&#xA;# no shutdown&#xA;# exit&#xA;# interface vlan 20&#xA;# ip address 10.1.2.1 255.255.255.0&#xA;# no shutdown&#xA;# exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both vlans &lt;code&gt;10&lt;/code&gt; and &lt;code&gt;20&lt;/code&gt; are up and running and all the ports are up too, but I couldn't be able to ping &lt;code&gt;PC B&lt;/code&gt; from &lt;code&gt;PC A&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is exactly what the guy did in the video and he managed to ping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What did i miss ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S: I also tried to erase arp tables but still couldn't be able to ping.&lt;/p&gt;&#xA;" OwnerUserId="3821" LastEditorUserId="8499" LastEditDate="2018-03-21T00:47:30.103" LastActivityDate="2018-03-21T00:47:30.103" Title="Layer 3 Switching in Packet Tracer not working" Tags="|vlan|switching|layer3|packet-tracer|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9807" PostTypeId="2" ParentId="9806" CreationDate="2014-07-07T00:12:54.863" Score="7" Body="&lt;p&gt;On the switch, your IP for interface vlan 20 is wrong.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# interface vlan 20&#xA;# ip address 10.1.2.1 255.255.255.0&#xA;# no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then make sure you have &lt;code&gt;ip routing&lt;/code&gt; on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the gateway for PC A should be &lt;code&gt;10.1.1.1&lt;/code&gt; while the gateway for PC B should be &lt;code&gt;10.1.2.1&lt;/code&gt;. The subnet mask should be &lt;code&gt;255.255.255.0&lt;/code&gt; not the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once fixed, make sure you can ping the gateway of each PC from the respective PCs as well.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2014-07-07T00:12:54.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9808" PostTypeId="1" CreationDate="2014-07-07T00:56:23.017" Score="7" ViewCount="273" Body="&lt;p&gt;Our organization has recently restructured IT and has separated network engineers into new roles such as architect, implementation engineer, and operational support engineer.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are concerns surrounding SOX compliance and how / whether we would implement appropriate controls to restrict access to the production environment for architect level personnel as their primary role is strategy and planning.  My understanding is that SOX controls for separation of duty are more specific to financial or accounting data - and access to (for example) a production database for dev/QA only personnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are SOX requirements for access to route/switch/transport equipment?  Where would separation of duties apply to network engineers?&lt;/p&gt;&#xA;" OwnerUserId="6419" LastEditorUserId="31801" LastEditDate="2018-06-05T14:06:36.307" LastActivityDate="2018-06-05T14:06:36.307" Title="Sarbanes Oxley for Network Engineers / Architects" Tags="|management|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9809" PostTypeId="2" ParentId="9800" CreationDate="2014-07-07T02:07:42.473" Score="4" Body="&lt;p&gt;All the PT-jabbing aside, this is just a strange Packet Tracer behavior and does not match the real world.  On a real switch, an unplugged ethernet, fast ethernet, or gigabit ethernet interface would show down down.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-07-07T02:07:42.473" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9811" PostTypeId="1" AcceptedAnswerId="9812" CreationDate="2014-07-07T05:05:35.637" Score="5" ViewCount="1941" Body="&lt;p&gt;Okay, so I'm studying for the Network+ exam, and I've gone over the OSI model about a million times, and I understand most of it fairly well, and my studies are coming along fine. However, there is one hiccup in my comprehension. I understand that when data is sent to another network, it has to use logical addresses, or IP addresses, to get there, and I understand that is layer 3 (Network). So, my question is, what if the destination for the data is on the local network? Do they use IP or MAC with ARP, and is that Layer 3 or 2? Like, is the Network layer used at all if the destination is on the local network?&lt;/p&gt;&#xA;" OwnerUserId="6427" LastEditorUserId="8499" LastEditDate="2018-03-21T01:32:35.807" LastActivityDate="2018-03-21T01:32:35.807" Title="When are MAC addresses used instead of IP addresses in the OSI model?" Tags="|mac-address|layer2|ip-address|layer3|osi|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9812" PostTypeId="2" ParentId="9811" CreationDate="2014-07-07T05:37:12.897" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I understand that when data is sent to another network, it has to use logical addresses, or IP addresses, to get there&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Like the moderator said, IP and mac addresses are used on ethernet, so you are confused and don't understand how this works.  If a PC-A on ethernet sends IPv4 traffic to an PC-B on another network, the packet still needs to arrive at the first-hop router.  The destination IP address will be PC-B, but the destination mac-address is the first-hop router's mac.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC-A is configured with the next-hop router IP address and PC-A ARPs to find the mac address of the first-hop router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, the first-hop router (also called the &quot;default gateway&quot;) uses its routing table to find the proper interface to deliver the packet towards PC-B.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;what if the destination for the data is on the local network? Do they use IP or MAC with ARP, and is that Layer 3 or 2? Like, is the Network layer used at all if the destination is on the local network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If PC-A wants to send IPv4 traffic to PC-C on a local network, both the destination mac-address and the destination IP address are for PC-C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC-A realizes that PC-C is on the same network, so it ARPs to find the mac address of PC-C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, the lan-switch uses its mac-address table to find the proper interface to deliver the packet.  However, PC-C still checks the destination IP address to ensure it belongs on PC-C.&lt;/p&gt;&#xA;" OwnerUserId="5025" LastEditorUserId="5025" LastEditDate="2014-07-07T06:00:33.040" LastActivityDate="2014-07-07T06:00:33.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9813" PostTypeId="2" ParentId="9737" CreationDate="2014-07-07T07:51:44.217" Score="7" Body="&lt;p&gt;Apologies for the delay in my response, I just got back from vacation...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm looking to replace our Asus RT-N53 with a business class router and two access points each servicing a private and a guess SSID on separate VLANs. We currently have 35 Mbps down, 7 Mbps up, internet service with intentions to upgrade to a faster package or provider in the near future.&lt;br&gt;&#xA;  ...&lt;br&gt;&#xA;  1) Table 8's numbers are Cisco's attempt to simulate real-world performance, correct?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;On this point, you are correct.  Table 8 illustrates how the router would perform using a realistic combination of &quot;enterprise&quot; features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/l19nr.png&quot; alt=&quot;Table8 - Unidirectional Feature Traffic test&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, Table 8 (shown above) uses a custom &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Mix&quot; rel=&quot;noreferrer&quot; title=&quot;Internet Mix packet distribution&quot;&gt;IMIX&lt;/a&gt; (average packet size: 409 bytes) traffic stream as defined in this paper:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;61 packets at 64 bytes (ethernet frame size), 3904 bytes total [10.13% by bytes]&lt;/li&gt;&#xA;&lt;li&gt;24 packets at 594 bytes (ethernet frame size), 11856 bytes total [30.77% by bytes]&lt;/li&gt;&#xA;&lt;li&gt;15 packets at 1518 bytes (ethernet frame size), 22770 bytes total [59.09% by bytes]&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Given that &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Mix&quot; rel=&quot;noreferrer&quot; title=&quot;Internet Mix packet distribution&quot;&gt;IMIX&lt;/a&gt; distribution, they send &lt;em&gt;unidirectional&lt;/em&gt; traffic using pre-defined NAT + HQoS + ACL configurations on the router, until the CPU reaches 75% load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take special note of the unidirectional nature of the test traffic, this unidirectional traffic is relevant to the next answer.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Figure 1's numbers are an RFC-2544 NDR measure of CPU performance, correct?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is not correct; &lt;em&gt;Figure 1&lt;/em&gt; recommends an &lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/2900-series-integrated-services-routers-isr/series-comparison.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco ISR G2 Router&quot;&gt;ISR G2&lt;/a&gt; model based on Table 8, which is not a 2544 NDR test.  RFC 2544 NDR tests typically run at about 90% CPU or higher.  Table 8 gives you a performance sample at 75% CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By way of comparison, let's look at the RFC 2544 NDR test results shown in &lt;em&gt;Table 1&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/baE64.png&quot; alt=&quot;Table1 - RFC2544 NDR&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Table 1&lt;/em&gt; shows the Cisco 3945E can handle up to 8.675 Gbps of RFC 2544 NDR traffic; however, &lt;em&gt;Figure 1&lt;/em&gt; merely recommends it for a 350Mbps circuit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9Ym6M.png&quot; alt=&quot;Figure1 - ISR G2 recommendation&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few of implied realities in Figure 1:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/2900-series-integrated-services-routers-isr/series-comparison.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco ISR G2 Router&quot;&gt;ISR G2&lt;/a&gt; switches packets in software, instead of ASIC-based packet forwarding.  Because the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/2900-series-integrated-services-routers-isr/series-comparison.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco ISR G2 Router&quot;&gt;ISR G2&lt;/a&gt; packet-per-second performance degrades as you turn on features, you should take this into consideration.&lt;/li&gt;&#xA;&lt;li&gt;Enterprise networks need more features than you would enable in the typical RFC 2544 NDR test&lt;/li&gt;&#xA;&lt;li&gt;Enterprise networks usually send a mix packet sizes, as represented by &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Mix&quot; rel=&quot;noreferrer&quot; title=&quot;Internet Mix packet distribution&quot;&gt;IMIX&lt;/a&gt; packet distributions&lt;/li&gt;&#xA;&lt;li&gt;Enterprise traffic is bi-directional, but they often upgrade the router before hitting 100% circuit utilization.&lt;/li&gt;&#xA;&lt;li&gt;Enterprise networks don't want their &lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/2900-series-integrated-services-routers-isr/series-comparison.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco ISR G2 Router&quot;&gt;ISR G2&lt;/a&gt; router running at more than 80% CPU for sustained periods of time.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To be explicit, real networks have to use &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_address_translation#One-to-many_NAT&quot; rel=&quot;noreferrer&quot;&gt;NAT&lt;/a&gt; (to conserve IPv4 address space), &lt;a href=&quot;http://www.cisco.com/go/qos&quot; rel=&quot;noreferrer&quot;&gt;QoS&lt;/a&gt; to prioritize VoIP traffic, and &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html&quot; rel=&quot;noreferrer&quot;&gt;ACL&lt;/a&gt;s for basic security.   Every time you enable a feature like this, you're sucking packet processing power from the router; that's why there is such a big difference between the Cisco 3945E numbers shown in Table 1 (8675 Mbps) vs Table 8 (668 Mbps).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your perspective:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cisco is doing you a favor by giving you a recommendation in Figure 1, based on bi-directional traffic using typical enterprise features.&lt;/li&gt;&#xA;&lt;li&gt;Cisco is doing themselves a favor by basing recommendations on such a rich combination of features.  Not all customers will need &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_address_translation#One-to-many_NAT&quot; rel=&quot;noreferrer&quot;&gt;NAT&lt;/a&gt;, &lt;a href=&quot;http://www.cisco.com/go/qos&quot; rel=&quot;noreferrer&quot;&gt;QoS&lt;/a&gt; or &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html&quot; rel=&quot;noreferrer&quot;&gt;ACL&lt;/a&gt;s on a WAN circuit; furthermore, the assumptions in the &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Mix&quot; rel=&quot;noreferrer&quot; title=&quot;Internet Mix packet distribution&quot;&gt;IMIX&lt;/a&gt; traffic they used may not be valid in your case.  If they upsell you on a more powerful router than you need, that is obviously profit for them.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2) Given the above is correct, should I take one of these numbers literally, in that if I wanted to fully utilize a 100 Mbps connection I'd need to chose a router with a listed value of at least 100 Mbps in Table 8?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No based on &lt;em&gt;Figure 1&lt;/em&gt;, you should select the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/2900-series-integrated-services-routers-isr/data_sheet_c78_553896.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco 2951 ISR G2 Router&quot;&gt;Cisco 2951&lt;/a&gt; or &lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/3925-integrated-services-router-isr/index.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco 3925 ISR G2 Router&quot;&gt;Cisco 3925&lt;/a&gt;; this assumes that you really will need &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_address_translation#One-to-many_NAT&quot; rel=&quot;noreferrer&quot;&gt;NAT&lt;/a&gt;, &lt;a href=&quot;http://www.cisco.com/go/qos&quot; rel=&quot;noreferrer&quot;&gt;QoS&lt;/a&gt;, and &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html&quot; rel=&quot;noreferrer&quot;&gt;ACL&lt;/a&gt;s on that 100Mbps circuit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/2900-series-integrated-services-routers-isr/data_sheet_c78_553896.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco 2951 ISR G2 Router&quot;&gt;Cisco 2951&lt;/a&gt; is a little light for this application at an average &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Mix&quot; rel=&quot;noreferrer&quot; title=&quot;Internet Mix packet distribution&quot;&gt;IMIX&lt;/a&gt; packet size of 409 bytes + features.  If you aren't going to turn on a lot of features, or your average packet size will be much higher (as I'd expect for backup traffic), then you can get by with the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/2900-series-integrated-services-routers-isr/data_sheet_c78_553896.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco 2951 ISR G2 Router&quot;&gt;Cisco 2951&lt;/a&gt; (or even smaller - see my next answer).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;3) Or will real-world performance issues (such as if most of the bandwidth was from a single computer running a backup) not stress the router in the same way as Cisco's tests do?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a judgement call, and I don't have enough information to say.  If you'd like to join me in &lt;a href=&quot;http://chat.stackexchange.com/rooms/11177/general-network-engineering-recommendations&quot;&gt;NE chat&lt;/a&gt;, I could walk you through some questions to isolate this further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The biggest question I have is whether you would need 100Mbps any time other than your PC backup case.  Leveraging the reality that your average packet size is high for backup traffic, one could potentially buy an even smaller router than the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/2900-series-integrated-services-routers-isr/data_sheet_c78_553896.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco 2951 ISR G2 Router&quot;&gt;Cisco 2951&lt;/a&gt; if you police the traffic to the systems other than the one that needs 100Mbps for backup traffic.  That said, now we are talking about a more complicated configuration; perhaps you have the money to burn on a &lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/3925-integrated-services-router-isr/index.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco 3925 ISR G2 Router&quot;&gt;Cisco 3925&lt;/a&gt; and don't want to deal with configuration complexities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally think about site growth... if this site grows rapidly, or people are prone to changing their minds about requirements on a whim, just buy the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/3925-integrated-services-router-isr/index.html&quot; rel=&quot;noreferrer&quot; title=&quot;Cisco 3925 ISR G2 Router&quot;&gt;Cisco 3925&lt;/a&gt; and be done with it :-).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-07-07T08:09:44.583" LastActivityDate="2014-07-07T08:09:44.583" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9814" PostTypeId="2" ParentId="9595" CreationDate="2014-07-07T10:03:46.467" Score="0" Body="&lt;p&gt;I think 2 private networks is the right way to do this. The second network is just like what everyone calls a SAN except it's ethernet with iSCSI, etc. instead of FC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your firewall has a public IP and a private IP (10.10.0.1/24). It uses SNAT to translate private machines to the internet public IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All your machines have internal IPs (10.10.0.0/24), including hypervisor, storage server, etc. (so you can manage them). The default gateway is 10.10.0.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hypervisor and storage servers have a separate dedicated storage/migration subnet also (10.100.0.0/24), which is not routed, NATted or bridged to the first subnet, and has no static routes, or gateway (and probably no dns, dhcp, etc.). One reason it is nice to have this separate is so you can raise the MTU without worrying about hardware support of some random desktop machines, etc. which don't support 9000 MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your storage was a cluster, it would be the same (many connections to the main network, and many connections to the storage network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then the VMs would not have any access to the storage network, but they would use the storage from the hypervisor which uses the storage network. (So I don't like your left side diagram that connects VMs to the storage.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To separate them, you can use VLANs (to share switches or other hardware), or different hardware (but the separate hardware should also have some admin access, perhaps join it into the other stuff with a simple VLAN; don't bridge them). And even if they are separate, don't necessarily assume that security is irrelevant; someone can still plug in a device to the network.&lt;/p&gt;&#xA;" OwnerUserId="6430" LastActivityDate="2014-07-07T10:03:46.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9815" PostTypeId="2" ParentId="9811" CreationDate="2014-07-07T10:17:41.473" Score="1" Body="&lt;p&gt;When you say &quot;what is the destination&quot;, I think that depends a lot on what you actually do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you have an application such as FTP, and you FTP from host A to host B on the same network.. you still go all the way up to layer 7 (Application layer), does not matter if host A is on the same network, or on the other side of the world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interesting part is how far up the layer each hop needs to go. if you are on the same network, then you are most likely connected with a switch (a layer 2 device), then the hop in between the two hosts, only need to go to layer 2 for the switch to know what to do with package. but if the two hosts are on separate networks, then the router (level 3) needs to read the address on the network layer to know what to do with it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: if you use another tool like Ping, then only layer 1,2 and 3 are used. (do not think layer 4 is needed for this).&lt;/p&gt;&#xA;" OwnerUserId="6375" LastActivityDate="2014-07-07T10:17:41.473" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9817" PostTypeId="1" AcceptedAnswerId="9818" CreationDate="2014-07-07T11:12:33.483" Score="2" ViewCount="232" Body="&lt;p&gt;When the Sender gets to know that the destination is in a other network ( by doing the AND operation with the subnetting adress of its network ) what are the procedures followed, so the packet does reach at the host side&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose we are sending from PC-A to PC-B&#xA;My questions are&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The first packet from the host will contain the destination host's address or default gateway's address as destination ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if default gateway's address is there in the header packet as destination, then after reaching to the default gateway's address, how does it know where to ( PC-B ), the data will be sent ? ( because we didn't write the destination address as PC-B rather we wrote destination as default gateway). Does both original Destination address ( PC-B ) and default gateway's address travel at a time ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Assume that data reached at the last router/network. I am sure this time destination address will be of PC-B. So the question is how does the network decides to drop the packet in PC-B ? By comparing its &lt;strong&gt;MAC address or the HOST portion of IP address&lt;/strong&gt; of PC-B's address ? ( Please I am really going crazy over this logic, I am not getting any satisfactory answer, please kindly describe it )&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank You&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Admin please, if you think the question is been repeated then please post a link in replay but i have not found the valid/satisfactory answer to my second que.&lt;/p&gt;&#xA;" OwnerUserId="6218" LastActivityDate="2014-07-09T02:46:24.730" Title="What happens at the destination end if it is in a WAN?" Tags="|ipv4|subnet|mac-address|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9818" PostTypeId="2" ParentId="9817" CreationDate="2014-07-07T13:23:21.093" Score="5" Body="&lt;p&gt;I think you are confusing layer 2 (MAC) addressing and layer 3 (IP) addressing.  It's a common mistake for beginning networking students.  It doesn’t matter whether you are the first hop or the last hop – the process is the same:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PCs and routers use their hardware address to send data to each other, based on their physical connections.  In the case of Ethernet, it’s the MAC address.   So when one Ethernet device wants to send to another, it uses the MAC address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC-A sends a packet with the destination IP address of PC-B.  The MAC address will be the MAC address of the default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An important thing to remember is that as the packet travels from source to destination, the layer three information (IP address) is unchanged. The MAC addresses change as the data moves from one layer 2 segment to another.  So as the packet moves from router to router, the destination MAC address will be the MAC of the next-hop router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Layer 3 (IP) address is used to determine which physical interface the sender will use, and the MAC address of the device on that interface.   Again, whether the recipient is a router or the end host, the process is the same.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sender uses the network portion of the IP address and the routing table to determine which physical interface to use.   If the routing table indicates a next-hop address, the sender uses ARP to determine the MAC address of the next hop.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is no next hop, the sender uses ARP to determine the  MAC address of the end host.&#xA;The last hop router will determine that PC-B is on a locally connected network, so will send the data with PC-B's MAC address.  Again, the IP addresses are unchanged.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-07-08T16:11:50.323" LastActivityDate="2014-07-08T16:11:50.323" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="9820" PostTypeId="2" ParentId="9595" CreationDate="2014-07-07T15:05:01.760" Score="0" Body="&lt;p&gt;First, I highly recommend you check out &lt;a href=&quot;http://shop.oreilly.com/product/9781118486498.do&quot; rel=&quot;nofollow&quot;&gt;this book on Hyper-V&lt;/a&gt;. Specifically you will want to read the chapter on Networking, subsection Advanced Networking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, you definitely want VLANs to split out traffic types. It is unfortunate that you're stuck with 1 10GbE adapter that you wish to share with SAN, management and VM traffic. The method I would look at would be this:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Vlans&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Vlan 10: Management &lt;/li&gt;&#xA;&lt;li&gt;Vlan 11: FC Management (if using failover cluster)&lt;/li&gt;&#xA;&lt;li&gt;Vlan 20: SAN &lt;/li&gt;&#xA;&lt;li&gt;Vlan 30: VM internal&lt;/li&gt;&#xA;&lt;li&gt;Vlan 40: VM&#xA;external&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would not route Vlan 20 at all.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Switch Setup&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;On the switch, the 10GbE port would be configured for trunking. The 3 1GbE ports would be configured for LACP, switch port access vlan 40.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Host VM Switch #1&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;On each host you would add a VM switch to the 10GbE adapter. Then you would add Management OS VM net adapters (Hyper-V terms) to this switch. One for actual management and one for iSCSI (and a third for failover cluster communication if you're using FC). You will configure each adapter to its own specific vlan and assign appropriate IPs.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Host LACP Team / VM Switch #2&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Then you would create a network team in Server 2012 for your 3 1GbE ports. You will want to use LACP with HyperVPort load balancing. After this you build a second VM switch using this network team for the VMs external traffic.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;VM Network Adapters&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;When you create your VMs, you can add a NIC on the second switch for external traffic, a NIC on the first switch in Vlan 20 for SAN traffic (if needed, though I recommend their own Vlan for SAN with specific security on the SAN boxes if this is a must so they cannot modify VM storage) and a NIC on the first switch for inter-vlan traffic in Vlan 30.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;QoS&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;For each virtual NIC on the hosts, you will want to add some sort of QoS to make sure the SAN traffic has priority on the 10GbE link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, this has more to do with best practices for your virtualization environment and you may wish to move this to Server Fault.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2014-07-07T15:16:16.300" LastActivityDate="2014-07-07T15:16:16.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9821" PostTypeId="1" CreationDate="2014-07-07T15:06:39.900" Score="5" ViewCount="11002" Body="&lt;p&gt;Let's say that there is a SVI for VLAN 100 and it's been assigned the first usable IP address in subnet 192.168.1.0/24. There is a host on VLAN 100 with an IP address of 192.168.1.130. We need to change the subnet on the SVI to a /25, but we need to do it without causing a significant disruption to the host or changing it's IP address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would you do it?&lt;/p&gt;&#xA;" OwnerUserId="1859" LastEditorUserId="8499" LastEditDate="2018-03-19T18:39:06.350" LastActivityDate="2018-03-19T18:39:06.350" Title="Multiple IP Addresses on VLAN Interface (SVI)" Tags="|vlan|subnet|ip-address|interface|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9822" PostTypeId="2" ParentId="9821" CreationDate="2014-07-07T15:06:39.900" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;Add a secondary IP address to the SVI in the same subnet that is in your new target range.&lt;/li&gt;&#xA;&lt;li&gt;Change the the subnet mask and default gateway on the host.&lt;/li&gt;&#xA;&lt;li&gt;Promote the secondary IP address to primary with the new subnet mask and remove the old primary.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1859" LastActivityDate="2014-07-07T15:06:39.900" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9823" PostTypeId="2" ParentId="9494" CreationDate="2014-07-07T15:52:28.657" Score="2" Body="&lt;p&gt;This is a shot in the dark but it sounds like you &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/mse/3350/7-4/wIPS_Configuration/Guide/7_4_MSE_wIPS/7_4_MSE_wIPS_chapter_01001.html&quot; rel=&quot;nofollow&quot;&gt;need Prime configured&lt;/a&gt; so you can setup a profile for wIPS. The alert is telling you that a profile is not configured yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not gotten this far in my own deployment of some 5508s/PI so I cannot say for certain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Reading further, the default profiles are also supplied by Prime, not the WLC:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;By default, the mobility services engine and corresponding wIPS access&#xA;  points inherit the default wIPS profile from the Prime Infrastructure.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2014-07-07T15:57:50.490" LastActivityDate="2014-07-07T15:57:50.490" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9826" PostTypeId="2" ParentId="9704" CreationDate="2014-07-07T20:01:01.947" Score="0" Body="&lt;p&gt;If the DHCP server is on a different VLAN then you'll need to use an ip helper (DHCP relay agent).  Since DHCP is a layer 2 protocol it cannot span IP subnets.  The ip helper would be configured on the device that is doing your inter-vlan routing.  Typically that occurs at a core switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is info on using ip helper:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_4t/ip_addr/configuration/guide/htdhcpre.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/ios/12_4t/ip_addr/configuration/guide/htdhcpre.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, debugging DHCP can help you narrow down the problem.  You'll want to do that on the device running the relay agent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;debug ip dhcp server packet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should see something similar to this if the relay agent is working:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DHCPD: DHCPINFORM received from client 015c.260a.4837.95 (192.168.200.201).&#xA;DHCPD: Looking up binding using address 192.168.200.1&#xA;DHCPD: setting giaddr to 192.168.200.1.&#xA;DHCPD: BOOTREQUEST from 015c.260a.4837.95 forwarded to 192.168.206.227&lt;/p&gt;&#xA;" OwnerUserId="3501" LastActivityDate="2014-07-07T20:01:01.947" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9829" PostTypeId="2" ParentId="9817" CreationDate="2014-07-07T20:51:11.020" Score="4" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The frame from the sender will contain the gateway's MAC address. Within that frame the IP packet will contain PC-B's IP address. The first-hop router will forward the packet based on PC-B's IP address using its IP routing table.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the last-hop router has a directly connected interface in the same network as PC-B but does not have a MAC address for PC-B, it will send an ARP request out onto the network to get PC-B's MAC address. Once it has that, it will forward the packet onto the segment with PC-B's MAC address and PC-B's IP address as the destination.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit:&lt;/em&gt; If PC-A and PC-B are on the same segment, the router doesn't get involved at all. PC-A sends the ARP request for PC-B, and PC-B responds with its MAC address. PC-A then sends the frame onto the segment using PC-B's MAC address as the destination.&lt;/p&gt;&#xA;" OwnerDisplayName="user6423" LastEditorDisplayName="user6423" LastEditDate="2014-07-09T02:46:24.730" LastActivityDate="2014-07-09T02:46:24.730" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9832" PostTypeId="2" ParentId="9821" CreationDate="2014-07-08T00:17:50.343" Score="0" Body="&lt;p&gt;Also if you are using DHCP make sure to change the DHCP scope to match your new subnet. Also make sure to change the default gateway and subnet mask on EVERYTHING on the subnet (printers, faxes etc).&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2014-07-08T00:17:50.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9833" PostTypeId="2" ParentId="9781" CreationDate="2014-07-08T00:54:17.747" Score="3" Body="&lt;p&gt;I use routers for my remote office ethernets because since I do not buy line rate 'CIR' I need to traffic shape. Switches don't do that. Router QoS is also easier to deal with because switch QoS has lots of hardware dependencies. &lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2014-07-08T00:54:17.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9841" PostTypeId="1" AcceptedAnswerId="9842" CreationDate="2014-07-08T11:49:22.993" Score="2" ViewCount="14149" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_55_se/configuration/guide/3560_scg/swauthen.html#wp1204672&quot; rel=&quot;nofollow&quot;&gt;The steps of this manual&lt;/a&gt; have been executed in order to configure SSH.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once SSH has been configured, how to access the switch from a computer using SSH?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following steps have been executed in order to assign an IP to a switch and subsequently connect to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An IP has been assigned to a Cisco Layer3 switch.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0&#xA; ip address 20.40.60.80 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A computer (20.40.60.81/24) is connected to Gi0/1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, neither from the switch to the computer nor vice versa a ping is successful.&lt;/p&gt;&#xA;" OwnerUserId="5282" LastActivityDate="2020-04-13T22:03:11.513" Title="How to assign a static IP to a Cisco Layer 3 switch in order to connect using SSH?" Tags="|cisco|switch|ipv4|ssh|layer3|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9842" PostTypeId="2" ParentId="9841" CreationDate="2014-07-08T12:48:02.397" Score="8" Body="&lt;pre&gt;&lt;code&gt;interface FastEthernet0&#xA;  switchport&#xA;  switchport mode access&#xA;  switchport access vlan 1&#xA;!&#xA;interface GigabitEthernet0/1&#xA;  switchport&#xA;  switchport mode access&#xA;  switchport access vlan 1&#xA;!&#xA;interface vlan 1&#xA;  ip address 20.40.60.80 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should be the bare minimum configuration to get your scenario working, at least some IP connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason it is not working right now is because those two interfaces are in separate broadcast domains, isolating one Ethernet data-link from another.  The above configuration assigns the IP address to the SVI in VLAN 1 and places both ports into VLAN 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the default configuration applied to Ethernet interfaces would work as well...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;default interface FastEthernet0&#xA;default interface GigabitEthernet0/1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3858" LastEditorUserId="3191" LastEditDate="2014-07-08T17:56:13.937" LastActivityDate="2014-07-08T17:56:13.937" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9845" PostTypeId="1" AcceptedAnswerId="9863" CreationDate="2014-07-08T15:56:38.327" Score="5" ViewCount="1330" Body="&lt;p&gt;I'm looking at implementing a linux-based VPN setup with approx 1200 remote sites connecting into two redundant data centers/DCs. Each remote site has 4 networks, and each DC has ~10. The VPN itself is GRE over IPsec, but what I'm struggling with at present is what is the most appropriate routing protocol to use.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Each remote site only needs to know what networks are at the data center, they do not need to know about the networks in use by other remote sites.&lt;/li&gt;&#xA;&lt;li&gt;The networks at each data center may move between each other from time to time, and new networks added (don't want to update static ipsec configs for 1200+ sites each time this happens).&lt;/li&gt;&#xA;&lt;li&gt;The DCs needs to know what networks are in use by every remote site.&lt;/li&gt;&#xA;&lt;li&gt;When the primary DC dies, traffic should route automatically to the backup DC.&lt;/li&gt;&#xA;&lt;li&gt;Most of these remote sites are on dynamic IPs/3G so it's common for sites to come up/down a couple times during the day, and across 1200 sites that equates to a lot of topology changes.&lt;/li&gt;&#xA;&lt;li&gt;The required capacity at present is around 1200, but could grow to 1800-1900 by end of next year.&lt;/li&gt;&#xA;&lt;li&gt;Cannot use closed solutions (Cisco etc, also EIGRP even though it's technically free now).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;From my reading of OSPF, it does not appear to support the number of sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What routing protocol is best suited for this setup?&lt;/li&gt;&#xA;&lt;li&gt;How should I structure it to handle the large number of sites?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3739" LastEditorUserId="775" LastEditDate="2014-12-08T12:52:28.497" LastActivityDate="2014-12-08T12:52:28.497" Title="Routing protocol for Large scale hub and spoke VPN" Tags="|routing|vpn|design|architecture|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="9846" PostTypeId="1" AcceptedAnswerId="10474" CreationDate="2014-07-08T18:02:48.333" Score="7" ViewCount="2602" Body="&lt;p&gt;I have the following config on a Brocade XMR, running IronWare 5.6.0c.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the traffic mirrored to e 1/13 keep it's VLAN tags, so I can distinguish where it came from? Or will the tags be stripped and all be untagged?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And for bonus points, if it will be untagged, is there any way to keep the tags?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mirror ethernet 1/13&#xA;&#xA;interface ethernet 2/16&#xA; enable&#xA; mon ethernet 1/13 both&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;--&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show vlan e 1/13&#xA;VLAN: 1  Untagged&#xA;&#xA;#show vlan e 2/16&#xA;VLL name                   XXXXXX, VLL ID:               150, VLAN:  910    Tagged&#xA;VLL name                   YYYYYY, VLL ID:               151, VLAN:  911    Tagged&#xA;VLAN: 37  Tagged&#xA;VLAN: 90  Tagged&#xA;VLAN: 129  Tagged&#xA;VLAN: 256  Tagged&#xA;VLAN: 257  Tagged&#xA;VLAN: 280  Tagged&#xA;VLAN: 287  Tagged&#xA;VLAN: 290  Tagged&#xA;VLAN: 291  Tagged&#xA;VLAN: 1014  Tagged&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="412" LastEditorUserId="412" LastEditDate="2014-07-08T18:12:01.190" LastActivityDate="2014-08-16T10:08:34.357" Title="Does a mirror port keep VLAN tags?" Tags="|vlan|brocade|mirror|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9847" PostTypeId="1" AcceptedAnswerId="9848" CreationDate="2014-07-08T18:38:37.103" Score="2" ViewCount="862" Body="&lt;p&gt;We have some new 2960's inbound and I had a 2950 laying around.  Was wondering if I loaded the 2960S IOS onto it (to get the config setup ahead of time) if there would be any permanent negative impact outside of the device not booting properly?  Is there an easy way to recover from this situation if that happens?  Can I create config on say 12.4 on the 2950 and just copy/paste into the new switch (2960 running likely 15.X) or will that cause problems? Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2014-07-08T19:41:33.703" Title="2960S IOS on 2950? Consequences?" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9848" PostTypeId="2" ParentId="9847" CreationDate="2014-07-08T18:51:25.463" Score="4" Body="&lt;p&gt;Aside from the switch checking to make sure the firmware is for that model and any number of boot issues you would have if you could force it to install, the 2960S firmware wouldn't fit on the flash of a 2950. The new switch firmware is too large.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the 2950 has an 8MB flash card while the 2960S firmware is ~13MB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;if there would be any permanent negative impact outside of the device&#xA;  not booting properly? Is there an easy way to recover from this situation if that happens?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It won't load, so there is no other impact and there is nothing to recover from.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I create config on say 12.4 on the 2950 and just copy/paste into the new switch (2960 running likely 15.X) or will that cause problems?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The 2950 capped at 12.1 from what I saw on Cisco's support site. I don't know what changed from 12.1 -&gt; 15.0.2-SE6. You'd have to look into that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could probably get away with some basic stuff but considering the port counts are possibly different and the port types are almost certainly different (Ethernet/FastEthernet on the 2950? to GigabitEthernet on the 2960S) you wouldn't be able to do a direct copy and past. You could copy and paste it into notepad or your text editor of choice and do a replace on FastEthernet for GigabitEthernet and add or remove ports that either did or did not exist on the 2950.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I'd wait and do the config from scratch on the 2960S. It shouldn't take long to do and that way you're not missing a step in converting an old config to a new config and messing with different ports and such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were to load a bad IOS image on a router, switch or AP, you can boot into rommon/recovery mode on the device and use TFTP to download a working image to the unit. I have yet to see a Cisco device without this ability.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2014-07-08T19:41:33.703" LastActivityDate="2014-07-08T19:41:33.703" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9849" PostTypeId="2" ParentId="9704" CreationDate="2014-07-08T18:56:17.220" Score="3" Body="&lt;p&gt;First, thanks to @AveryAbbot, @Ron, @YLearn and @DanielYusteAroca for assisting me greatly in working through this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this time I have determined the cause of the issue to lie with the access points from Ubiquity and not an issue with the Cisco switch itself. After researching further and talking with some of the other network personnel who set this up, it turns out that this one switch connected to the MDF via NanoBridge M5's (that I was unaware of). That is, it is not a straight wire run but in fact a wireless AP to Station in bridge mode. In this setup, the mac addresses stop at the AP side and every outgoing packet gets the AP's mac address. To resolve this, you need to setup the AP and Station in Ubiquiti's Wireless WDS transparent bridge mode. After changing this setting on both AP and Station, and a reload of the switch, all devices connected to the problemswitch, are now receiving a proper DHCP lease when requested. &lt;/p&gt;&#xA;" OwnerUserId="5006" LastActivityDate="2014-07-08T18:56:17.220" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9852" PostTypeId="2" ParentId="596" CreationDate="2014-07-08T22:53:23.900" Score="0" Body="&lt;p&gt;Enable ip device tracking on the switch. USe the following commands&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip device tracking&#xA;ip device tracking probe delay 30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second commands prevents the duplicate ip error from popping up on pc's. There is a Cisco bug for it but can't remember the id.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will want older 12.4 code or 15 code to enable the above.&lt;/p&gt;&#xA;" OwnerUserId="6459" LastActivityDate="2014-07-08T22:53:23.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9854" PostTypeId="1" CreationDate="2014-07-08T23:00:40.180" Score="8" ViewCount="1135" Body="&lt;p&gt;Recently after upgrading several MetroE circuits (L2 connectivity) from 100Mbps to 1Gbps, I noticed that large file transfers fail between some sites; however, the transfer only fails in direction. For instance, consider the following example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From -&gt; To&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A -&gt; B = Fail&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B -&gt; A = Success&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A -&gt; C = Success&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C -&gt; A = Success&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B -&gt; C = Success&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C -&gt; B = Success&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each site is a routed segment behind a L3 switch located at the site. The L3 switch connects to the provider's CPE media converter, which in turn connects to the provider's network via fiber. Static routing is used between L3 switches. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            *Site A*                      *Site B*&#xA;    L3 Switch &amp;lt;-&amp;gt; CPE &amp;lt;--- Provider ---&amp;gt; CPE &amp;lt;-&amp;gt; L3 Switch&#xA;                               |&#xA;                              CPE&#xA;                               |&#xA;                           L3 Switch&#xA;                            *Site C*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The provider performed end-to-end testing of the circuits from the CPEs and reported no loss. However, I see many duplicate ACKs in a packet capture on the hosts before the transfer fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I remove the L3 switches from the equation, and connect two hosts directly to the CPE device at each site, the file transfer completes successfully. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Host A &amp;lt;-&amp;gt; CPE &amp;lt;--- Provider ---&amp;gt; CPE &amp;lt;-&amp;gt; Host B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I place hosts on either side of a L3 switch, interVLAN routing works without a hitch and the file transfer completes successfully. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Host A1 &amp;lt;-&amp;gt; L3 Switch &amp;lt;-&amp;gt; Host A2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The issue only seems to occur when data traverses the provider between two routed segments. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Host A &amp;lt;-&amp;gt; L3 Switch &amp;lt;-&amp;gt; CPE &amp;lt;--- Provider ---&amp;gt; CPE &amp;lt;-&amp;gt; L3 Switch &amp;lt;-&amp;gt; Host B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have verified a number of things - interface statistics are clean (no errors), cpu and memory utilization low, speed and duplex match (client and CPE), MAC and ARP tables correct, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the issue?&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Update 1&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Packet captures from hosts A and B can found at the following URL:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/sh/5m2yohgxieelo59/AADed-0EWOkdmFIe0qT45_uQa&quot; rel=&quot;noreferrer&quot;&gt;https://www.dropbox.com/sh/5m2yohgxieelo59/AADed-0EWOkdmFIe0qT45_uQa&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue originally occurred using Juniper EX3200 switches running 12.3R6.6. I subsequently downgraded the switches to 11.4R6.6, but this did not resolve the issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to replicate the issue using Juiper EX2200 switches running 12.3R6.6 and 11.4R6.6. I was also able able to replicate issue using Dell 6224 switches running 3.3.11.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, only the CPE (ge-0/0/0) and a single host (ge-0/0/1) is connected to a Juniper EX3200 at each site. While troubleshooting the issue, I stripped the configuration of any extraneous parameters, so the configuration is fairly basic. The configuration is essentially the same at each, but with different IP addresses. Below is a snippet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    # show interfaces&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members WAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members LAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 10 {&#xA;            description WAN;&#xA;            family inet {&#xA;                address 192.168.X.X/27;&#xA;            }&#xA;        }&#xA;        unit 100 {&#xA;            description LAN;&#xA;            family inet {&#xA;                targeted-broadcast;&#xA;                address 172.X.X.1/22;&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;    # show vlans&#xA;    WAN {&#xA;        vlan-id 10;&#xA;        l3-interface vlan.10;&#xA;    }&#xA;    LAN {&#xA;        vlan-id 100;&#xA;        l3-interface vlan.100;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Update 2&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Today I noticed that if I scp a file from the L3 switch, Juniper EX3200, at site A to L3 switch, Juniper EX3200, at site B, the scp transfer is also affected by the issue.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find this especially interesting since the transfer is originating from the CPE facing interface on the WAN VLAN, because if I trunk a VLAN between the affected sites through the EX3200 switches, switched file transfers complete successfully between hosts at site A and B. &lt;/p&gt;&#xA;" OwnerUserId="985" LastEditorUserId="985" LastEditDate="2014-07-09T20:11:28.310" LastActivityDate="2017-02-17T08:45:14.930" Title="Unidirectional Packet Loss" Tags="|packet-loss|metro-ethernet|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="9856" PostTypeId="1" CreationDate="2014-07-08T23:41:30.210" Score="7" ViewCount="1263" Body="&lt;p&gt;Has anyone worked with Meraki's CMX raw data feed and can help answer some questions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I came here to ask because I have found no conversations about Meraki's CMX API elsewhere and I imagined that network engineers are still more likely to know about this service than BI teams or developers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have recently set up Meraki access points in a few of our retail stores to report on foot traffic. We set up the data feed to point to a SQL server database with almost live results. Our plan is to have a nightly routine to summarize the data to report on similar metrics as the Meraki dashboard. I have combed through the data we currently have and read through the documentations but notice that not everything is explained. Here are some points I am struggling with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. RSSI not fully explained&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;an RSSI value of &lt;em&gt;0&lt;/em&gt; and &lt;em&gt;102&lt;/em&gt; are disproportionaly higher than any other RSSI value. I assume that a &lt;em&gt;0&lt;/em&gt; value indicates connected but I am not sure what &lt;em&gt;102&lt;/em&gt; is for? Max strength or an error?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Documentation does not support multiple cases when there are an odd amount of pings or a small number of them&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I have noticed instances where there may be two or three pings in a given 20 minute slot that are about 3 minutes apart. This would suggest that this device was a visitor based on Meraki's documentation but could also be read as a slow passerby, window watcher or someone sitting parking their car out front. Anyone have an idea how Meraki handles these?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another case would be when there are only two pings and both are above the RSSI thresholds and greater than 5 minutes apart but less than 20 minutes. Again, this would suggest another visitor but I would argue to be a another passerby.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;My other point of confusion is with strong single pings. I imagine if a phone has a strong ping and only when then they are a passerby but it surprises me not to see multiple pings.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Documentation does not explain methodology of tracking visitors that stay longer than 20 minutes&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are all segments broken up in 20 minute intervals then summed together to create time in store?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Let me know if you want me to add the links to the documentation I have read. Any help would be super helpful.&lt;/p&gt;&#xA;" OwnerUserId="6457" LastEditorUserId="55949" LastEditDate="2019-04-21T14:27:15.180" LastActivityDate="2019-05-21T15:01:01.320" Title="Raw API data for Cisco Meraki CMX Dashboard" Tags="|cisco|router|network|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="9862" PostTypeId="1" AcceptedAnswerId="9871" CreationDate="2014-07-09T12:39:32.987" Score="1" ViewCount="2180" Body="&lt;p&gt;I have some doubts based on ALG and Firewall that are related to NAT. Please correct me if my questions are also wrong.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;NAT is handled by router, and it gives a public address ( routers ip address ) to the all host who are connected. All router is having capability for NAT. So does that mean a group of hosts in a single network, untill they are not connected to outside network ( WAN ), the NAT concepts does not apply on the router ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Among Control Plane and Data Plane, which one is responsible for forwarding the data of a private network and which one is responsible for mapping between the tupples ( private ip &amp;amp; port, public ip &amp;amp; port ). This question leads to another, like a router having ARP cache table, is ther any table maintained for NAT ? If yes what is that called ? If No then how it handles NAT ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the difference between ALG and Firewall, because I was thinking like ALG is the firewall.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As per IANA Private ports range is between 49152 to 65535 but some linux also follows 32768 to 61000. So if a Application use 40,000 port which is not been used in another system ( because of IANA rule ), how this is handled ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IF THERE IS ANY OTHER QUESTIONS POSSIBLE REGARDING NAT PLEASE POST IT, I WOULD LIKE TO KNOW&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You&lt;/p&gt;&#xA;" OwnerUserId="6218" LastEditorUserId="509" LastEditDate="2015-08-16T21:45:44.430" LastActivityDate="2015-08-16T21:45:44.430" Title="NAT, Application Layer Gateway (ALG) vs Firewall" Tags="|ipv4|nat|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9863" PostTypeId="2" ParentId="9845" CreationDate="2014-07-09T12:41:09.773" Score="7" Body="&lt;p&gt;I think BGP is probably your best bet in this situation.  The number of tail sites you have quickly exceeds the benefits of most IGPs.   BGP would allow you to achieve all of your desired implementation requirements, such as limiting tail site knowledge to the primary/backup DC, standards based protocol, ability to &lt;strong&gt;&lt;em&gt;efficiently&lt;/em&gt;&lt;/strong&gt; handle over 5,000 different routes, etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF is still an option; I just don’t think it’s the best option.  You could always setup each leg of your network as a Totally Stubby Area so inter-area routes aren’t propagated down to the each site. Then you could have separate routing instances at each site to handle their networks independently of your head end.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each SPF recalculation is going to cost you a pretty penny on resources. How volatile these connections are will affect that, this could be often depending on how aggressive your timing is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whatever your decision, BGP was designed to scale.  And when anyone says they are looking for a way to scale to 7,000+ networks&lt;sup&gt;1&lt;/sup&gt;, BGP is a no-brainer.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;sup&gt;1&lt;/sup&gt; &lt;sub&gt;Forecasting based on growth to 1,900 sites x 4 networks at each site.&lt;/sub&gt;&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-07-09T12:41:09.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9864" PostTypeId="2" ParentId="9845" CreationDate="2014-07-09T12:49:02.407" Score="4" Body="&lt;p&gt;Mike,&#xA;What you want to do is pushing the limits of any protocol implementation, so there is no good answer. Both OSPF or iBGP could be made to work.  Any solution we (you) come up with will necessarily be a tradeoff between router processing power, memory (ie. cost), bandwidth, and convergence time.  For example, you can break up OSPF into some number of areas to reduce the flooding, but at the expense of memory and CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Convergence time is important, because the faster you want your network to converge, the more CPU and bandwidth you require.  As an extreme example, if you want to converge in a second or less, the hub router must generate, send, receive, and process 14400 hello packets per second (2 x 4 x 1800), and you use significant bandwidth doing so.  That is in addition to actually routing traffic.  That’s a lot to ask of any router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both BGP and (Cisco’s implementation of ) OSPF can filter routing updates to the spoke routers, reducing bandwidth.  But the hub router will still generate them internally, and that takes a lot of CPU and memory.  I don’t know how much you actually save.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will emphasize @MikePennington’s point that for a network this size, you should really look at a hardware router.  If not for your remote sites, then certainly for the hubs – that’s where all the processing is going on.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-07-09T12:49:02.407" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9868" PostTypeId="1" AcceptedAnswerId="9880" CreationDate="2014-07-09T15:15:40.763" Score="6" ViewCount="11991" Body="&lt;p&gt;Follow up to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/16/how-can-i-force-vtp-clients-to-update-their-vlan-database-from-the-vtp-server-o&quot;&gt;this Q&amp;amp;A&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to one of the answers it should be possible to solve a MD5 digest mismatch by synchronizing username, password and domain between VTP Client and Server and subsequently executing a VLAN change on the VTP Server to align the MD5 digest on the Client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, after executing these steps and executing &lt;code&gt;sh vtp st&lt;/code&gt; on both the VTP Server and the Client a discrepancy between MD5 digest between these two remains, which avoids that the VLAN database on the VTP Client is synchronized with the one of the VTP Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once a name of a VLAN has been changed on the VTP server the MD5 digest will be changed. However, the MD5 digest on the client remains the same and the following message is shown:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;*** MD5 digest checksum mismatch on trunk: Po1 ***&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="5282" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2020-08-21T13:07:04.617" Title="How to synchronize MD5 digest between VTP Server and Client?" Tags="|cisco|switch|vtp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9869" PostTypeId="1" AcceptedAnswerId="9872" CreationDate="2014-07-09T17:36:22.533" Score="2" ViewCount="1383" Body="&lt;p&gt;I have a cisco ASA 5515 and a Cisco 3850 switch in our network. I'm a sys admin by trade and know enough to get a switch up and running but the asa thing is confusing me a bit. This hardware was bought by someone who then left the company and so now I'm tasked with setting it up. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now we have a /29 say &lt;/p&gt;&#xA;&#xA;&lt;p&gt;9.10.11.24/29&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our private ip space is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.128.0.0/16 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So our asa is online via the management network on &lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.128.7.103&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our 3850 is also online via &lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.128.7.101&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having some issues assigning out public ip space to the ASA and then routing vlan traffic to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now my vlans are attached to the 3850 like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan60&#xA; ip address 10.128.60.1 255.255.255.0&#xA;!&#xA;interface Vlan70&#xA; ip address 10.128.70.1 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Routing on the 3850 looks like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 10.128.7.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 10.128.7.1 is our old datacenter we are moving away from.. Ideally I'd like to route all traffic out via the ASA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it's like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;internet &amp;lt;--&gt; ASA &amp;lt;--&gt; 3850 &amp;lt;--&gt; internal lans. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure what I'm really missing to tackle this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA Config &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa# show run&#xA;: Saved&#xA;:&#xA;ASA Version 9.1(1)&#xA;!&#xA;hostname asa&#xA;names&#xA;!&#xA;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 70.42.246.25 255.255.255.248&#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif inside&#xA; security-level 0&#xA; ip address 10.128.8.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/2&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/4&#xA; description STATE Failover Interface&#xA;!&#xA;interface GigabitEthernet0/5&#xA; description LAN Failover Interface&#xA;!&#xA;interface Management0/0&#xA; management-only&#xA; nameif management&#xA; security-level 100&#xA; ip address 10.128.7.103 255.255.255.0&#xA;!&#xA;boot system disk0:/asa911-smp-k8.bin&#xA;ftp mode passive&#xA;clock timezone PST -8&#xA;clock summer-time PDT recurring&#xA;dns server-group DefaultDNS&#xA; domain-name sjc.recurly.net&#xA;access-list global_access extended permit icmp any any&#xA;pager lines 24&#xA;logging enable&#xA;logging monitor debugging&#xA;logging buffered debugging&#xA;logging trap debugging&#xA;logging asdm informational&#xA;logging host management 10.128.7.54&#xA;mtu management 1500&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;ip verify reverse-path interface outside&#xA;failover&#xA;failover lan unit primary&#xA;failover lan interface folink GigabitEthernet0/5&#xA;failover key *****&#xA;failover link statelink GigabitEthernet0/4&#xA;failover interface ip folink 172.27.48.1 255.255.255.0 standby 172.27.48.2&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;access-group global_access global&#xA;route outside 0.0.0.0 0.0.0.0 65.42.246.30 1&#xA;route management 10.113.0.0 255.255.0.0 10.128.7.1 1&#xA;route management 10.128.0.0 255.255.0.0 10.128.7.1 1&#xA;route management 10.242.0.0 255.255.0.0 10.128.7.1 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;aaa-server radius-group protocol radius&#xA; accounting-mode simultaneous&#xA; merge-dacl before-avpair&#xA;aaa-server radius-group (management) host 10.128.7.81&#xA; key *****&#xA; authentication-port 1812&#xA; accounting-port 1813&#xA;user-identity default-domain LOCAL&#xA;aaa authentication http console radius-group LOCAL&#xA;aaa authentication ssh console radius-group LOCAL&#xA;aaa authorization command LOCAL&#xA;http server enable&#xA;http 10.0.0.0 255.0.0.0 management&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpool policy&#xA;telnet timeout 5&#xA;ssh 10.0.0.0 255.0.0.0 management&#xA;ssh timeout 5&#xA;ssh version 2&#xA;console timeout 0&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;ntp server 10.128.7.101 source management&#xA;username shon password Vp4yQWvnJ8bKI5Lz encrypted&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc&#xA;  inspect xdmcp&#xA;  inspect sip&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect ip-options&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;Cryptochecksum:1fd56c8cffa842a1390f7b3b366852a4&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6469" LastEditorUserId="6469" LastEditDate="2014-07-10T03:02:01.593" LastActivityDate="2014-07-10T03:02:01.593" Title="Cisco ASA and 3850 routing" Tags="|cisco|cisco-asa|firewall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9871" PostTypeId="2" ParentId="9862" CreationDate="2014-07-09T18:08:42.153" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If I understand your question correctly, the NAT router translates addresses as data moves from the &quot;inside&quot; to the &quot;outside.&quot;   If traffic doesn't pass through the router, there is no translation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&quot;Control plane&quot; and &quot;data plane&quot; are conceptual terms.  There isn't always a correspondence to hardware or software.  That said, forwarding traffic is the function of the data plane.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The terms ALG, firewall, layer3 switch, etc have no fixed definition.  They get defined by the manufacturers and can mean whatever they want it to mean.  But generally speaking, an ALG often performs the same functions as a firewall.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;TCP/IP can't read IANA specifications, so a port is a port, no matter what number is used.  They are all handled (and translated) the same way.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-07-09T18:08:42.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9872" PostTypeId="2" ParentId="9869" CreationDate="2014-07-09T19:10:57.713" Score="6" Body="&lt;p&gt;Enter the following commands on your 3850:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip route 0.0.0.0 0.0.0.0 10.128.7.1&#xA;ip route 0.0.0.0 0.0.0.0 10.128.17.106&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will direct Internet traffic to your firewall.   If you haven't set up NAT on your firewall yet, post a copy of your firewall config and we can modify that for you too.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-07-09T19:10:57.713" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9877" PostTypeId="1" CreationDate="2014-07-10T06:09:20.357" Score="5" ViewCount="718" Body="&lt;pre&gt;&lt;code&gt;IS_NEXUS_7010(config)# interface Ethernet2/2&#xA;IS_NEXUS_7010(config-if)# description Connected to Exchange Cisco 2960 24&#xA;IS_NEXUS_7010(config-if)# switchport trunk allowed vlan 1-14&#xA;IS_NEXUS_7010(config-if)# ip access-group 110 in&#xA;&#xA;ERROR: RACL policies can be configured only on Layer-3 interface which is not a port-channel member. Note that port-channel members use the ACL policies applied on port-channel interface.&#xA;&#xA;IS_NEXUS_7010(config-if)#   switchport&#xA;IS_NEXUS_7010(config-if)#   switchport mode trunk&#xA;IS_NEXUS_7010(config-if)#   switchport trunk allowed vlan 1-14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can't configure &lt;code&gt;ip access-group 110 in&lt;/code&gt; on trunk interface Ethernet2/2, it shows the error above.  How do I resolve this?&lt;/p&gt;&#xA;" OwnerUserId="7478" LastEditorUserId="775" LastEditDate="2014-07-10T07:31:08.147" LastActivityDate="2014-07-12T06:35:15.500" Title="Nexus 7010 ACL Error" Tags="|cisco|acl|cisco-nexus-7k|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9878" PostTypeId="2" ParentId="9877" CreationDate="2014-07-10T07:30:33.153" Score="8" Body="&lt;p&gt;When you apply the ACL to a layer2 trunk, this is called a &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-cfg/sec_ipacls.html#wp1583810&quot;&gt;Port ACL&lt;/a&gt;, use the &lt;code&gt;ip port access-group&lt;/code&gt; syntax to apply it instead of &lt;code&gt;ip access-group&lt;/code&gt;... explicitly...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IS_NEXUS_7010(config)# interface Ethernet2/2&#xA;IS_NEXUS_7010(config-if)# description Connected to Exchange Cisco 2960 24&#xA;IS_NEXUS_7010(config-if)# switchport&#xA;IS_NEXUS_7010(config-if)# switchport mode trunk&#xA;IS_NEXUS_7010(config-if)# switchport trunk allowed vlan 1-14&#xA;IS_NEXUS_7010(config-if)# ip port access-group 110 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-07-10T07:30:33.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9879" PostTypeId="2" ParentId="9351" CreationDate="2014-07-10T07:50:59.953" Score="3" Body="&lt;p&gt;For metrics you can look in to the reports that NSS labs are publishing, they have pretty solid documentation on how they do firewall testing. You can also google for their reports, sometimes firewall vendors publish them free of charge on their own web page for promo purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for what tool you need you can use the ones you have listed, but it boils down to the size of the firewall you are planning to test. For a beefy firewall you will most likely need several servers to create a load where you can see the limits of the device. I have done testing with hping and iperf, which are ok for testing plain throughput. However if you want to test for example IPS catch rate or application control, a dedicated test device would be easiest choice by far. You can also rent the test devices, although the rent isn’t cheap by all means either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to note is that firewall throughput is heavily influenced by the control you have in place, basic firewalling is always fast, but when you turn on antivirus, IPS, SSL-inspection and application control the throughput drops dramatically with all vendors. Try to take this in to account also when making the test plan.&lt;/p&gt;&#xA;" OwnerUserId="2378" LastActivityDate="2014-07-10T07:50:59.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9880" PostTypeId="2" ParentId="9868" CreationDate="2014-07-10T08:11:30.143" Score="5" Body="&lt;p&gt;After checking &lt;a href=&quot;https://learningnetwork.cisco.com/thread/21771&quot; rel=&quot;nofollow&quot;&gt;this thread&lt;/a&gt; on the Cisco Learning Network and subsequently executing some checks on both the VTP Client and Server, e.g:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh vtp st&#xA;sh vtp password&#xA;sh int trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it appears that the &lt;code&gt;domain&lt;/code&gt; is identical and the portchannel is in trunking mode. However, there was a discrepancy between the VTP passwords for some reason. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After synchronizing the passwords on the VTP Client and Server by executing &lt;code&gt;vtp password hello&lt;/code&gt; and changing a name of a VLAN (&lt;code&gt;conf t&lt;/code&gt; &amp;amp;&amp;amp; &lt;code&gt;vl X&lt;/code&gt; &amp;amp;&amp;amp; &lt;code&gt;name helloworld&lt;/code&gt;) on the VTP Server, the MD5 digests became identical &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh vtp st&#xA;VTP Version capable             : 1 to 3&#xA;VTP version running             : 1&#xA;VTP Domain Name                 : domain&#xA;VTP Pruning Mode                : Enabled&#xA;VTP Traps Generation            : Disabled&#xA;Device ID                       : X.Y.Z&#xA;Configuration last modified by X at Y Z&#xA;&#xA;Feature VLAN:&#xA;--------------&#xA;VTP Operating Mode                : Client&#xA;Maximum VLANs supported locally   : 1005&#xA;Number of existing VLANs          : 6&#xA;Configuration Revision            : 6&#xA;MD5 digest                        : 0xfc 0x5e 0x03 0x8d 0x38 0xa5 0x70 0x32 &#xA;                                    0x08 0x54 0x41 0xe7 0xfe 0x70 0x10 0xb0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the VLAN lists subsequently synchronized.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch&amp;gt;sh vl&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                          active    Gi0/1, Gi0/2, Gi0/3, Gi0/4&#xA;                                                Gi0/5, Gi0/6, Gi0/7, Gi0/8&#xA;                                                Gi0/9, Gi0/10, Gi0/11, Gi0/12&#xA;                                                Gi0/13, Gi0/14, Gi0/15, Gi0/16&#xA;                                                Gi0/17, Gi0/18, Gi0/19, Gi0/20&#xA;                                                Gi0/21, Gi0/22, Gi0/23, Gi0/24&#xA;                                                Gi0/25, Gi0/26, Gi0/27, Gi0/28&#xA;                                                Gi0/29, Gi0/30, Gi0/31, Gi0/32&#xA;                                                Gi0/33, Gi0/34, Gi0/35, Gi0/36&#xA;                                                Gi0/37, Gi0/38, Gi0/39, Gi0/40&#xA;                                                Gi0/41, Gi0/42, Gi0/43, Gi0/44&#xA;100  helloworld                       active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5282" LastEditorUserId="5282" LastEditDate="2014-07-10T13:04:05.557" LastActivityDate="2014-07-10T13:04:05.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9886" PostTypeId="1" CreationDate="2014-07-10T12:19:56.927" Score="2" ViewCount="2887" Body="&lt;p&gt;I'm trying to create a VPN connexion between my firewall (a pfsense 2.0.1) and my Amazon Virtual Private Cloud (VPC). Amazon provides two peers endpoints to mount two IPsec tunnels on the same VPC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this moment, I'm able to mount an IPSec tunnel between my public IP and one of the Amazon endpoints.&#xA;The idea is to avoid a &quot;disconnection&quot; on Amazon side in case of the main tunnel fails and to switch on a backup tunnel (failover on our side is managed with CARP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to mount two IPsec tunnels on the same pfsense gateway (one public IP), just like the following graph:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/PLd8Q.jpg&quot; alt=&quot;a VPC&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to do so with pfSense?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jKUU2.png&quot; alt=&quot;a VPC&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The full scenario with a cisco router example is available here: &lt;a href=&quot;http://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/Cisco_NoBGP.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/Cisco_NoBGP.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance for your help,&lt;/p&gt;&#xA;" OwnerUserId="7485" LastEditorUserId="31801" LastEditDate="2018-12-26T22:56:50.133" LastActivityDate="2018-12-26T22:56:50.133" Title="Is it possible to implement IPSec with failover between one pfSense firewall and Amazon VPC (no BGP)" Tags="|failover|pfsense|vpc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="9887" PostTypeId="2" ParentId="9821" CreationDate="2014-07-10T15:04:26.127" Score="0" Body="&lt;p&gt;If the SVI must change from 192.168.1.1/24 to 192.168.1.1/25 and the host's IP address cannot change, then the host will lose connectivity unless proxy-arp is configured on the SVI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assigning a temporary, secondary IP address to the SVI in the 192.168.1.0/25 subnet violates the requirements because at some point the primary IP will have to be changed and that &lt;em&gt;will&lt;/em&gt; cause a disruption to the host.&lt;/p&gt;&#xA;" OwnerDisplayName="user6423" LastActivityDate="2014-07-10T15:04:26.127" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9889" PostTypeId="1" AcceptedAnswerId="9890" CreationDate="2014-07-10T17:01:23.897" Score="3" ViewCount="322" Body="&lt;p&gt;Is reverse DNS part of the DNS protocol, i.e. part of the official DNS specification?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is reverse DNS managed by standard DNS servers and a type of request that DNS servers understand and respond to, or is it additionally functionality on the client side where extra work is done to resolve the domain of an IP?&lt;/p&gt;&#xA;" OwnerUserId="7489" LastActivityDate="2014-07-10T21:14:31.407" Title="Is Reverse DNS part of the DNS protocol?" Tags="|dns|" AnswerCount="2" CommentCount="2" ClosedDate="2018-03-06T00:21:16.137" ContentLicense="CC BY-SA 3.0" />
  <row Id="9890" PostTypeId="2" ParentId="9889" CreationDate="2014-07-10T17:32:48.413" Score="-1" Body="&lt;p&gt;Reverse DNS is part of the DNS protocol official specification see &lt;a href=&quot;http://www.ietf.org/rfc/rfc1035.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 1035&lt;/a&gt; Section 6.4 specifies Inverse queries&lt;/p&gt;&#xA;" OwnerUserId="194" LastEditorUserId="412" LastEditDate="2014-07-10T19:39:25.500" LastActivityDate="2014-07-10T19:39:25.500" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9891" PostTypeId="2" ParentId="9748" CreationDate="2014-07-10T18:16:26.417" Score="5" Body="&lt;p&gt;My thoughts on this are that firstly if you capture the traffic in one place (if you are able to, if you have one capture machine/device joint to both mcast groups) you don't have the complexity of having to replay two different captures files in time with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly you can edit packet captures so that when you &quot;play&quot; them back the packets are sent to a re-written destination addresses (different mcast groups).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you perhaps look at how you are capturing and replaying the packets to see if this scenario can be simplified? Even if you have to separate capture files you can just play them back from the same machine/device; one which has two connections back to the mcast network so it can play into two different mcast groups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you need to refine your problem further with some additional research on the problem and existing solutions. Otherwise the info above is my answer.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="3191" LastEditDate="2014-07-11T21:56:24.977" LastActivityDate="2014-07-11T21:56:24.977" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="9892" PostTypeId="1" AcceptedAnswerId="9901" CreationDate="2014-07-10T18:34:52.170" Score="2" ViewCount="1234" Body="&lt;p&gt;I have a two Sonicwall NSA250Ms where one of them is a &quot;high availability&quot; device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sonicwall engineer suggested that I should connect both my WAN and LAN to both of these devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Naturally, I could use 2 network switches; 1 to connect the WANs together, and 1 to connect the LANs together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am a bit limited in my rack space, and it would be very beneficial if I could just use ONE network switch (with a minimum of 6 ports of course) and somehow split the 6 ports in half. In other words, I need a device that will act as 2 seperate switches in one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I &lt;em&gt;think&lt;/em&gt; I could just connect all these together on any switch, since the Layer 3 communication intended for WAN will just get ignored by the LAN and vice-versa, but I am not sure if this will cause me trouble in the long run. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also &lt;em&gt;think&lt;/em&gt; I could configure a more proper router to act as a switch and designate the ports as different zones/networks. However, I think this may be overkill.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would greatly appreciate any suggestions for devices that could handle this effectively while still being under a couple hundred dollars.&lt;/p&gt;&#xA;" OwnerUserId="7493" LastActivityDate="2014-07-10T23:01:22.887" Title="How to Connect a Sonicwall Firewall to it's High Availability unit using just one switch" Tags="|sonicwall|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9894" PostTypeId="2" ParentId="9669" CreationDate="2014-07-10T19:45:39.720" Score="4" Body="&lt;p&gt;There is no default dscp value assigned do a HTTP connection by a web browser or web server when connections are initiated by either.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2014-07-10T19:45:39.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9895" PostTypeId="2" ParentId="9669" CreationDate="2014-07-10T19:50:45.987" Score="1" Body="&lt;p&gt;As mentioned earlier default DSCP values will be used and if HTTP is transported over provider boundary’s any DSCP will be reset. Unless you pay for any form of QOS will only work inside your network. (or by accident).&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-07-10T19:50:45.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9897" PostTypeId="2" ParentId="9889" CreationDate="2014-07-10T21:08:50.313" Score="9" Body="&lt;p&gt;Reverse DNS for IPv4 is specified in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1035#section-3.5&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1035 Section 3.5&lt;/a&gt;. The special &lt;code&gt;in-addr.arpa&lt;/code&gt; domain was created for this. For IPv6 the special domain is &lt;code&gt;ip6.arpa&lt;/code&gt; as specified in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3596#section-2.5&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC3596&lt;/a&gt;. The record type that gets requested for reverse lookup is the &lt;code&gt;PTR&lt;/code&gt;record.&lt;/p&gt;&#xA;&lt;p&gt;For IPv4 the IP address is reversed on the &amp;quot;dot&amp;quot; boundaries after every byte:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;192.168.0.1&lt;/code&gt; gets transformed into &lt;code&gt;1.0.168.192.in-addr.arpa.&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;For IPv6 the address gets reversed after every 4-bit &amp;quot;nibble&amp;quot; (every number/letter) with a dot inserted:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;2001:db8::dead:beef&lt;/code&gt; gets transformed into&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;f.e.e.b.d.a.e.d.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.b.d.0.1.0.0.2.ip6.arpa.&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;For DNS servers there is no extra work involved, every DNS server software understands/supports PTR records. The reverse lookup on the client is done by the application(s) you use. There are standard system calls for reverse lookup on every OS.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-07-10T21:14:31.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9899" PostTypeId="2" ParentId="9821" CreationDate="2014-07-10T22:16:32.377" Score="1" Body="&lt;p&gt;the ip adress is the first usable ip adress of 192.168.0.128/25&#xA;supposing that you need to use the second part of the subnet(/24) on another svi:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;interface vlan 100 &#xA;no ip adress 192.168.1.1 255.255.255.0&#xA;ip adress 192.168.0.1 255.255.255.128&#xA;interface vlan 200&#xA;ip adress 192.168.1.129 255.255.255.128&#xA;no shut&#xA;exit&#xA;ip route 192.168.1.130 255.255.255.255 vlan 100&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on cisco it will take about 2 seconds if you paste all config.&lt;/p&gt;&#xA;" OwnerUserId="6412" LastActivityDate="2014-07-10T22:16:32.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9900" PostTypeId="2" ParentId="9669" CreationDate="2014-07-10T22:47:16.490" Score="3" Body="&lt;p&gt;Default QoS Markings are &quot;Best Effort&quot; (AKA &quot;0&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, QoS needs to be honoured at each Hop, so it's mainly useless on the Internet (Most ISPs strip/remark to 0, or do nothing more with it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you managed to PAY for a better QoS handling, it would stop at your ISP's Peers borders.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you're talking for within your own lan, there are many ways to mark the traffic, depending on platform &amp;amp; topology, but each hop must be configured for it.  This means configuring each devices to classify/prioritize/process each type of traffic you have, the way you want it to be done.&lt;/p&gt;&#xA;" OwnerUserId="1645" LastEditorUserId="1645" LastEditDate="2014-07-11T14:05:54.070" LastActivityDate="2014-07-11T14:05:54.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9901" PostTypeId="2" ParentId="9892" CreationDate="2014-07-10T23:01:22.887" Score="6" Body="&lt;p&gt;If you have a managed switch that supports VLANs, just separate the WAN and LAN ports onto separate VLANs and you're good.  I would not recommend using one switch with all traffic on the same L2 broadcast domain - it causes multiple headaches, the most basic will be the sonicwall will report a bunch of spoofed traffic.&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2014-07-10T23:01:22.887" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9906" PostTypeId="1" AcceptedAnswerId="9907" CreationDate="2014-07-11T10:06:06.653" Score="6" ViewCount="9259" Body="&lt;p&gt;In &lt;a href=&quot;http://www.rfc-editor.org/rfc/rfc2131.txt&quot; rel=&quot;noreferrer&quot;&gt;RFC2131&lt;/a&gt; (page 12) it's been mentioned that &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The server should use whatever information is available in the&#xA;  configuration information repository to choose an address to reuse. &#xA;  For example, the server may choose the least recently assigned&#xA;  address.  As a consistency check, the allocating server SHOULD probe&#xA;  the reused address before allocating the address, e.g., with an &lt;strong&gt;ICMP&#xA;  echo request&lt;/strong&gt;, and the client SHOULD probe the newly received&#xA;  address, e.g., with &lt;strong&gt;ARP&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Can you please explain to me how ICMP echo requests and ARPs are helpful in DHCP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You&lt;/p&gt;&#xA;" OwnerUserId="6218" LastEditorUserId="3191" LastEditDate="2014-07-11T10:50:26.060" LastActivityDate="2014-07-11T17:15:23.110" Title="USE of ICMP echo request in DHCP" Tags="|dhcp|arp|icmp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9907" PostTypeId="2" ParentId="9906" CreationDate="2014-07-11T10:10:45.270" Score="12" Body="&lt;p&gt;An ICMP Echo request from the DHCP server to the IP address its about to allocate is used to determine if the IP address about to be assigned is already in use on the network.&#xA;If a response is received from that IP the DHCP server will assign a different address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ARP request on the newly received address from the client would do the same, check if another device is using that address and responding to ARP. If so it knows the address it received is already in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RFC you linked to does mention later on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Servers need not reserve the offered network address, although the protocol will&#xA;work more efficiently if the server avoids allocating the offered&#xA;network address to another client.  When allocating a new address,&#xA;servers SHOULD check that the offered network address is not&#xA;already in use; e.g., the server may probe the offered address&#xA;with an ICMP Echo Request.  Servers SHOULD be implemented so that&#xA;network administrators MAY choose to disable probes of newly&#xA;allocated addresses.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am not certain if all DHCP servers implement this requirement but as far as I am aware there is no other way a DHCP server could reliably become aware of another device using an IP that is available in its DHCP pool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also from the same RFC regarding ARP from the clients:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if the client is on a network that&#xA;supports ARP, the client may issue an ARP request for the suggested&#xA;request.  ...  If the network address appears to be in use, the client MUST send a&#xA;DHCPDECLINE message to the server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="80" LastEditorUserId="80" LastEditDate="2014-07-11T10:40:36.410" LastActivityDate="2014-07-11T10:40:36.410" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="9909" PostTypeId="1" AcceptedAnswerId="9911" CreationDate="2014-07-11T11:08:42.367" Score="-1" ViewCount="497" Body="&lt;p&gt;What is meant by fixed length sub-net masking? Is it mean Class A -----255.0.0.0&#xA;Class B -----255.255.0.0 Class C -----255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As i understand its mean is keep the length of the network prefix length constant. Is it right?&lt;/p&gt;&#xA;" OwnerUserId="7501" LastEditorUserId="7501" LastEditDate="2014-07-11T11:45:34.567" LastActivityDate="2014-07-11T12:04:41.583" Title="Meaning of fixed length sub-net masking?" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9911" PostTypeId="2" ParentId="9909" CreationDate="2014-07-11T11:52:00.913" Score="2" Body="&lt;p&gt;Yes, but most importantly, classful addressing (i.e. fixed length subnet masks) is obsolete and has been for at least 20 years.  I don't know why networking classes still teach it.  There are many, many resources on this and other stack exchanges (as well as the Internet) that explain how to use variable length masks. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-07-11T12:04:41.583" LastActivityDate="2014-07-11T12:04:41.583" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9914" PostTypeId="2" ParentId="9906" CreationDate="2014-07-11T14:28:26.353" Score="2" Body="&lt;p&gt;Please see the ICMP codes section of the this link &lt;a href=&quot;http://www.nthelp.com/icmp.html&quot; rel=&quot;nofollow&quot;&gt;ICMP Codes&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some operating systems only show &quot;time-out&quot; whenever a code is returned other than reply or host unreachable, remember this is just a catchall.  So a well-programmed DHCP server can make assumptions based on the specific codes returned.  For instance, if you have devices with a firewall installed the ICMP code 10 (Communication with Destination Host is Administratively Prohibited) would be returned.  At this point the DHCP server can reliable assume the address is in use and not assign it to another device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since ARP is a layer 2 protocol it is only useful if the DHCP Server is on the same network segment.  A DHCP server would send out an ARP request asking who is address x.x.x.x. If no response is given then the server know the address is free and can be allocated.&lt;/p&gt;&#xA;" OwnerUserId="7505" LastEditorUserId="4885" LastEditDate="2014-07-11T17:15:23.110" LastActivityDate="2014-07-11T17:15:23.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9916" PostTypeId="1" AcceptedAnswerId="9917" CreationDate="2014-07-11T18:53:22.677" Score="1" ViewCount="139" Body="&lt;p&gt;Is it possible to connect to an AP from far away? Or is it limited by the device connecting?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question concerns AP's like Ubiquiti's NanoStation locoM2 which claims 5km+ range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would I be able to connect to it from that far (in ideal conditions) with a laptop's embedded WiFi?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that interference and obstacles will greatly reduce this, but would I achieve say, 1km? Or is it limited on the laptop's side?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And is communal WiFi (ie lots of users using the same AP) users vulnerable to network sniffing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something better than Ubiquiti for wide area wifi networks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a beginner in large scale networking, so please forgive the stupidity, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="7508" LastActivityDate="2014-07-11T19:23:37.390" Title="WAN Communal WiFi" Tags="|wireless|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9917" PostTypeId="2" ParentId="9916" CreationDate="2014-07-11T19:23:37.390" Score="3" Body="&lt;p&gt;Operational range depends on both ends. If the AP can be heard 10mi away, it doesn't do much good when your laptop/tablet/phone has a low power transmitter that cannot be heard 300ft away.  The Nanostation range is &lt;em&gt;between two nanostations&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is communal WiFi users vulnerable to network sniffing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, however the link is almost always encrypted (WPA-Enterprise, so each link has it's own key.)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is there something better than Ubiquiti for wide area wifi networks?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's a shopping question / opinion, and off-topic. (Everybody has their favorite gear.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-07-11T19:23:37.390" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9919" PostTypeId="2" ParentId="9748" CreationDate="2014-07-11T21:27:31.920" Score="4" Body="&lt;p&gt;I've done this sort of thing before using &lt;code&gt;tcpreplay&lt;/code&gt; and &lt;code&gt;mergecap&lt;/code&gt; (one of the tools that is distributed with Wireshark). The first step is to use &lt;code&gt;tcprewrite&lt;/code&gt; (part of tcpreplay) to edit the destination IPs of foo.pcap to be first address you are looking to send as, and bar.pcap to be the second. Then use &lt;code&gt;mergecap&lt;/code&gt; to merge the packets chronologically so you get them interleaved the way that you want. Note that when using mergecap, you might need to first edit the timestamps of the packets (e.g. if you took foo.pcap a day before bar.pcap, they won't interleave). In that case, you can use &lt;code&gt;editcap&lt;/code&gt; (another tool from wireshark) to modify the packet times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The really difficult part is going to be playing them back with the timing options that you want. Depending on the speed of the original captures, and your tolerance for variance, you might be all set simply using &lt;code&gt;tcpreplay --multiplier=XXX&lt;/code&gt;. But if the traffic rate is fast, or you need it to be &lt;strong&gt;really&lt;/strong&gt; precise, then you are going to be out of luck until you invest in special hardware from vendors like Spirent or Ixia. Note that if you do buy one of those tools, they have utilities that can do all the packet manipulation for you as part of the setup process.&lt;/p&gt;&#xA;" OwnerUserId="1045" LastActivityDate="2014-07-11T21:27:31.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9924" PostTypeId="2" ParentId="9733" CreationDate="2014-07-12T18:00:26.670" Score="2" Body="&lt;p&gt;FabricPath transports Ethernet frames. Take a look here for frame format:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.valleytalk.org/wp-content/uploads/2013/08/BRKDCT-2081-Cisco-FabricPath-Technology-and-Design.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.valleytalk.org/wp-content/uploads/2013/08/BRKDCT-2081-Cisco-FabricPath-Technology-and-Design.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your device/software package is to work between two FP switches, mind you it's not supported today. Also, make no assumptions with regards to what will protocol do or don't do - put a lot of effort in checking if the thing you received matches your expectations and only then act/call some functions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And yes, VLAN tags are carried through the FP domain if the original traffic was tagged.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-07-12T18:00:26.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9925" PostTypeId="2" ParentId="7973" CreationDate="2014-07-12T18:06:21.330" Score="3" Body="&lt;p&gt;I would suggest creating a static route to Null 0 on the external router:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ip route 192.168.0.0 255.255.248.0 Null 0&lt;br&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Static route to Null interface is seen as a connected interface on the local router.&lt;br&gt;&#xA;&lt;br&gt;Then advertise the summary address in whatever routing protocol is originating the routes with a network statement in the routing process.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When you redistribute from one routing process to the other the summary route should be injected into the OSPF process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also filter out the subnets with a prefix list or route map to be sure the smaller subnets don't get injected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully this helps.&lt;/p&gt;&#xA;" OwnerUserId="2302" LastEditorUserId="2302" LastEditDate="2014-07-13T00:32:24.300" LastActivityDate="2014-07-13T00:32:24.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9926" PostTypeId="2" ParentId="2697" CreationDate="2014-07-12T19:39:44.337" Score="2" Body="&lt;p&gt;The issue has been resolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem was we upgraded the ASA OS version and the upgrade required a memory upgrade as well and memory usage was pegged at 100%.  Memory upgrade is complete now and the stateful nature of the ASA has returned to normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for everyone's support.&lt;/p&gt;&#xA;" OwnerUserId="2302" LastActivityDate="2014-07-12T19:39:44.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9930" PostTypeId="2" ParentId="9724" CreationDate="2014-07-13T04:13:57.447" Score="2" Body="&lt;p&gt;According to the config provided:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;access-list 10 permit 20.20.20.0 0.0.0.255 &lt;br&gt;route-map pbr permit 10&#xA;  match ip address 10 &lt;br&gt;set ip next-hop 30.30.30.2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Any traffic from the 20.20.20.0/24 subnet traversing the VLAN 2 gateway will be redirected to 30.30.30.2 as a next hop.  This should effectively drop packets destined to 10.10.10.2 when sourced from the 20.20.20.0/24 subnet...  &lt;br&gt;Unless 30.30.30.2 is in fact configured as a router with a good route to 10.10.10.2, but that wasn't part of the scenario.&lt;/p&gt;&#xA;" OwnerUserId="2302" LastEditorUserId="4777" LastEditDate="2014-07-22T13:13:28.450" LastActivityDate="2014-07-22T13:13:28.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9935" PostTypeId="1" AcceptedAnswerId="9937" CreationDate="2014-07-13T16:36:30.713" Score="2" ViewCount="3061" Body="&lt;p&gt;I think DHCP isn't working because the &lt;code&gt;GIADDR&lt;/code&gt; is not the source IP address, as &lt;a href=&quot;http://www.itgeared.com/articles/1112-dhcp-relay-agent/&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt; says it should be:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[The DHCP relay agent] Changes the source IP address of the DHCPDISCOVER message to the IP address of the interface on which the broadcasted DHCPDISCOVER was received.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Requests go through but the replies don't come back to the client or relay agent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup: I've got a hypervisor with dnsmasq on a VM. The hypervisor acts as my router and relay agent for the locally-connected switch (client subnet).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dnsmasq (10.0.0.5)&lt;/li&gt;&#xA;&lt;li&gt;client subnet: 192.168.0.0/24&lt;/li&gt;&#xA;&lt;li&gt;router/relay agent (&lt;code&gt;dhcp-helper&lt;/code&gt;):&#xA;&lt;ul&gt;&#xA;&lt;li&gt;client-subnet interface: &lt;code&gt;eth1.2&lt;/code&gt; (192.168.0.1)&lt;/li&gt;&#xA;&lt;li&gt;DHCP-VM interface: &lt;code&gt;venet0&lt;/code&gt; (10.0.0.1)&lt;/li&gt;&#xA;&lt;li&gt;WAN interface: &lt;code&gt;eth0&lt;/code&gt; (1.2.3.4)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Based on the packet captures from the dnsmasq VM, it looks like the problem is that the DHCPDISCOVER is being sent from &lt;code&gt;eth0&lt;/code&gt; (WAN interface) but, like the protocol stipulates, is being replied to via &lt;code&gt;GIADDR&lt;/code&gt; (&lt;code&gt;eth1.2&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;14:28:33.152534 IP (tos 0x0, ttl 64, id 42501, offset 0, flags [none], proto UDP (17), length 328)&#xA;1.2.3.4.67 &amp;gt; 10.0.0.5.67: [udp sum ok] BOOTP/DHCP, Request from de:ad:be:ef:ca:fe, length 300, hops 1, xid 0xbebfc411, Flags [none] (0x0000)&#xA;  Gateway-IP 192.168.0.1&#xA;  Client-Ethernet-Address de:ad:be:ef:ca:fe&#xA;  Vendor-rfc1048 Extensions&#xA;    Magic Cookie 0x63825363&#xA;    DHCP-Message Option 53, length 1: Discover&#xA;    Parameter-Request Option 55, length 13: &#xA;      Subnet-Mask, BR, Time-Zone, Classless-Static-Route&#xA;      Domain-Name, Domain-Name-Server, Hostname, YD&#xA;      YS, NTP, MTU, Option 119&#xA;      Default-Gateway&#xA;    Client-ID Option 61, length 7: ether de:ad:be:ef:ca:fe&#xA;&#xA;14:28:36.153602 IP (tos 0xc0, ttl 64, id 40806, offset 0, flags [none], proto UDP (17), length 332)&#xA;10.0.0.5.67 &amp;gt; 192.168.0.1.67: [udp sum ok] BOOTP/DHCP, Reply, length 304, hops 1, xid 0xbebfc411, Flags [none] (0x0000)&#xA;  Your-IP 192.168.0.29&#xA;  Server-IP 127.0.0.2&#xA;  Gateway-IP 192.168.0.1&#xA;  Client-Ethernet-Address de:ad:be:ef:ca:fe&#xA;  Vendor-rfc1048 Extensions&#xA;    Magic Cookie 0x63825363&#xA;    DHCP-Message Option 53, length 1: Offer&#xA;    Server-ID Option 54, length 4: 127.0.0.2&#xA;    Lease-Time Option 51, length 4: 43200&#xA;    RN Option 58, length 4: 21600&#xA;    RB Option 59, length 4: 37800&#xA;    Subnet-Mask Option 1, length 4: 255.255.255.0&#xA;    BR Option 28, length 4: 192.168.0.255&#xA;    Domain-Name-Server Option 6, length 4: 127.0.0.2&#xA;    Domain-Name Option 15, length 10: &quot;example.net&quot;&#xA;    Default-Gateway Option 3, length 4: 192.168.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems to me that the source IP address should be the &lt;code&gt;GIADDR&lt;/code&gt; (192.168.0.1). I don't see how to configure this in &lt;code&gt;dhcp-helper&lt;/code&gt; the DHCP relay agent. Any ideas how to resolve the problem? &lt;/p&gt;&#xA;" OwnerUserId="7518" LastEditorUserId="775" LastEditDate="2014-07-14T09:12:14.757" LastActivityDate="2014-07-14T09:12:14.757" Title="Linux DHCP-Helper: GIADDR is not the source IP address" Tags="|dhcp|" AnswerCount="1" CommentCount="0" ClosedDate="2018-03-19T18:35:01.270" ContentLicense="CC BY-SA 3.0" />
  <row Id="9937" PostTypeId="2" ParentId="9935" CreationDate="2014-07-14T01:25:15.823" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;[The DHCP relay agent] Changes the source IP address of the DHCPDISCOVER message to the IP address of the interface on which the broadcasted DHCPDISCOVER was received.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is incorrect. The relay agent forwards the &lt;em&gt;DHCPDISCOVER&lt;/em&gt; packet as a broadcast or unicast packet to the DHCP server. The source address of the packet will change, but it will be the source address of the interface on the same network as the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;GIADDR&lt;/em&gt;, unless it is 0.0.0.0, will not change. Otherwise, the relay will change GIADDR to the IP of the interface on which the original &lt;em&gt;DHCPDISCOVER&lt;/em&gt; was received.&lt;/p&gt;&#xA;" OwnerDisplayName="user6423" LastActivityDate="2014-07-14T01:25:15.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9939" PostTypeId="1" AcceptedAnswerId="9941" CreationDate="2014-07-14T08:51:28.817" Score="7" ViewCount="3212" Body="&lt;p&gt;I have network situation like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bGkmM.png&quot; alt=&quot;Problem with VPN tunel from remote location through ISP (PPTP)&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;ISP Router (modem)&lt;/strong&gt; - device given to us by our ISP - modem &amp;amp; router in one but it is set into transparent mode - ISP say so ;D we have to find it that it is true :)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;MikroTik Router (MTR)&lt;/strong&gt; - our edge router with firewall&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Server NAS &amp;amp; VPN Server (NAS)&lt;/strong&gt; - Synology box with our data storage and also with VPN server with running PPTP, OpenVPN, L2TP/IPSec services- to which workers from our local company and from remote location conect to get data&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Local station (LS)&lt;/strong&gt; - workers at our network site - they are using Windows 8 which means they use PPTP&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Remote station (RS)&lt;/strong&gt; - workers at remote site behind different ISP`s&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Bellow I present our Mikrotik configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Routing table:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dst. address   | Gateway      | Distance | Pref. source   |&#xA;0.0.0.0/0      | 1.1.1.9      | 2        | -              |&#xA;1.1.1.8/30     | ether1       | -        | 1.1.1.8/30     |&#xA;192.168.1.0/24 | bridge local | -        | 192.168.1.0/24 |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Firewall:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Action | Chain | Dst. Address  | Protocol | Dst. Port |&#xA;accept | input | 192.168.1.230 | 6 (TCP)  | 1723      |&#xA;accept | input | 192.168.1.230 | 47 (GRE) | -         |&#xA;accept | input | 192.168.1.230 | 6 (TCP)  | 5006      |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NAT:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Action     | Chain  | Source Addr    | Dst Address   | Proto    | Dst Port | Out Intf   |&#xA;masquerade | srcnat | -              | -             | -        | -        | ether1     |&#xA;dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 1723     | -          |&#xA;dstnat     | dstnat | -              | 1.1.1.9       | 47 (GRE) | -        | -          |&#xA;dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 5006     | -          |&#xA;masquerade | srcnat | 192.168.1.0/24 | 192.168.1.230 | -        | -        | -          |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The last rule is used to avoid hairpin occurrence&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Rules at Mikrotik are made for now only for PPTP protocol !!!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Our LS have no problem to connect to to NAS within PPTP VPN tunel. The problem starts when our RS  workers from different locations trying to get VPN tunnel to our NAS. They receive a Windows 619 VPN error code.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I made some tests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I connected directly from ISP site and I eliminated ISP modem and host which I used to the test (it had 1.1.1.9 IP addr. and gateway 1.1.1.10) and it worked fine - but in the NAT rules at MTR were set 1.1.1.10 destinations addresses not 1.1.1.9 like now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I changed it because when I use what.is.my.ip I received our public address within 1.1.1.9 - I also use this adres in dynDNS. That why I changed it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when there is 1.1.1.10 there is no problem to get VPN tunel (only remotes had them - so it could be port blocking at ISP site I think) but when I use 1.1.1.9 in NAT rules also my host acting like a ISP modem get 619 error code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today they get 800 VPN error code instead of 619 :/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the cause of my problem ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why it works from our side when I use 1.1.1.10 and I get error using 1.1.1.9 in NAT table ?&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="6417" LastEditDate="2015-04-06T07:34:17.113" LastActivityDate="2015-04-06T07:34:17.113" Title="Problem with VPN tunel from remote location through ISP (PPTP)" Tags="|routing|vpn|nat|isp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9940" PostTypeId="1" CreationDate="2014-07-14T09:06:00.167" Score="4" ViewCount="17815" Body="&lt;p&gt;I have been tasked with setting up some VLANs on 10 HP 2520 switches. This is a departure from my normal IT support area so thought I'd seek out a little advice from more knowledgable people.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These switches are being deployed in a new building on site and will connect into the existing site infrastructure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So... I need to setup the following VLANs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan ID: VLAN 53&#xA; Ports: 17-20&#xA; IPs: 10.120.130.0/24&#xA; Gateway:  10.120.130.254&#xA; Description:   SVR&#xA; Device IP Range: 10.12.130.1 - 10.120.130.250&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan ID: VLAN 54&#xA; Ports:  1-16&#xA; IPs: 10.120.140.0/24&#xA; Gateway:   10.120.140.254&#xA; Description:   CAM&#xA; Device IP Range: 10.12.140.1 - 10.120.140.250&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan ID: VLAN 55&#xA; Ports:  21-24&#xA; IPs: 10.120.150.0/24&#xA; Gateway: 10.120.150.254&#xA; Description: DESK&#xA; Device IP Range: 10.12.150.1 - 10.120.150.250&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've had a play around with the configurations and these are the commands I believe i need to use to create a VLAN on each of the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 1: Create the VLANs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; HP-Switch(Config)#Vlan 530 name &quot;SVR&quot;&#xA; HP-Switch(Config)#Vlan 540 name &quot;CAM&quot;&#xA; HP-Switch(Config)#Vlan 550 name &quot;DESK&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Step 2: Allocate ports to VLANs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; HP-Switch(Config)#Vlan 53&#xA; HP-Switch(vlan-53)#untagged 17-20&#xA; HP-Switch(vlan-53)#tagged 48 &#xA; HP-Switch(vlan-53)#exit&#xA;&#xA; HP-Switch(Config)#Vlan 54&#xA; HP-Switch(vlan-54)#untagged 1-16&#xA; HP-Switch(vlan-54)#tagged 48 &#xA; HP-Switch(vlan-54)#exit&#xA;&#xA; HP-Switch(Config)#Vlan 55&#xA; HP-Switch(vlan-55)#untagged 21-24&#xA; HP-Switch(vlan-55)#tagged 48 &#xA; HP-Switch(vlan-55)#exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So that should have made the 3 VLANs on specific ports all routing via the tagged port 48.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I cant understand is how I allocate the IP addresses. I had thought I could use the following command to tell the VLAN what IP range to use but it just comes up saying Bad IP&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; HP-Switch(vlan-53)# ip address 10.120.130.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If i change it to 130.1/24 then the switch is allocated the .1 address meaning I'd have to setup an IP for each of the 10 switches for each of the VLANs meaning there would in effect be 4 managment IPs for each switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do i even need to assign an IP range to the VLAN?  The IP addresses are allocated to specific MAc addresses by the existing DHCP servers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-UPDATE-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An update to this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configures one of the VLANS as:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan 55 &#xA;   name &quot;DESK&quot;&#xA;   untagged 20-22&#xA;   tagged 27&#xA;   no ip address&#xA;   exit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the onsite IT are saying they dont see any packets tagged as VLAN 55. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup is that there are 3 switches in a 'control room' 2xHP 2510 and 1xHP 2920. What I've been told is the 10 x HP 2520 switches I need to configure are connected via fibre to these switches. The 2510's have 4 fibre connections each and the 2920 has the other 2 (making the 10 connections).  these switches then connect (via Cat5e) to the main network/switches (called 'NET1) that we have no control over. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question now is, do i need to setup any configuration on these switches in order to pass the tagged packets or should the switch just pass them on with the tag (as added by the 'tagged 27' port)?&lt;/p&gt;&#xA;" OwnerUserId="7525" LastEditorUserId="8499" LastEditDate="2018-03-19T18:17:35.470" LastActivityDate="2018-03-19T18:17:35.470" Title="VLANs and IP addressing" Tags="|switch|vlan|subnet|ip-address|hp|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="9941" PostTypeId="2" ParentId="9939" CreationDate="2014-07-14T09:41:58.350" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why it works from our side when I use 1.1.1.10 and I get error using 1.1.1.9 in NAT table?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You have a problem with the 1.1.1.9 configuration as an external NAT IP on the Mikrotik.   The outside interface of the Mikrotik is a /30; you're using 1.1.1.9/30 as the default gateway &lt;em&gt;and&lt;/em&gt; an outside NAT IP on the Mikrotik.  If you're going to use 1.1.1.9/30 on the Mikrotik, you need 1.1.1.10 as a default-gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it stands, you're currently using 1.1.1.9 as both default-gateway and external NAT IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current Routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dst. address   | Gateway      | Distance | Pref. source   |&#xA;0.0.0.0/0      | 1.1.1.9      | 2        | -              |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Current NAT table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Action     | Chain  | Source Addr    | Dst Address   | Proto    | Dst Port | Out Intf   |&#xA;masquerade | srcnat | -              | -             | -        | -        | ether1     |&#xA;dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 1723     | -          |&#xA;dstnat     | dstnat | -              | 1.1.1.9       | 47 (GRE) | -        | -          |&#xA;dstnat     | dstnat | -              | 1.1.1.9       | 6 (TCP)  | 5006     | -          |&#xA;masquerade | srcnat | 192.168.1.0/24 | 192.168.1.230 | -        | -        | -          |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's a little confusing is the diagram, which says the ISP-A's router is in transparent &quot;modem state&quot;.  Please be sure that the IP addressing scheme you're using on the Mikrotik is consistent with ISP-A's expectations.  If the router is transparent, I'm not entirely sure you should have an IP address on it.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-07-14T09:41:58.350" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9942" PostTypeId="1" AcceptedAnswerId="9943" CreationDate="2014-07-14T09:53:37.817" Score="1" ViewCount="322" Body="&lt;p&gt;The &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfeigrp.html&quot; rel=&quot;nofollow&quot;&gt;following documentation&lt;/a&gt; has been read regarding EIGRP in order to configure it on  Switch1 and 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Switches are connected via a port channel. However, neither Switch1 is able to find Neighbor2 located on Switch2 nor Switch2 is able to find Neighbor1 located on Switch1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Switch1:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router eigrp 1&#xA; network 50.0.0.0&#xA; eigrp router-id 50.50.50.50&#xA; eigrp stub connected static&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Switch2:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router eigrp 2&#xA; network 50.0.0.0&#xA; eigrp router-id 50.50.50.51&#xA; eigrp stub connected static&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EIGRP neighbors:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Switch 1:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch1#sh ip eigrp neighbors detail&#xA;EIGRP-IPv4 Neighbors for AS(1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Switch 2:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch2#sh ip eigrp neighbors detail&#xA;EIGRP-IPv4 Neighbors for AS(2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5282" LastEditorUserId="5282" LastEditDate="2014-07-14T09:59:31.417" LastActivityDate="2014-07-14T10:52:49.247" Title="How to find EIGRP Neighbor located on other Switch?" Tags="|switch|cisco-ios|eigrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9943" PostTypeId="2" ParentId="9942" CreationDate="2014-07-14T10:52:49.247" Score="6" Body="&lt;p&gt;Your AS numbers need to match. Change either switch2 to &lt;code&gt;router eigrp 1&lt;/code&gt; or change switch1 to &lt;code&gt;router eigrp 2&lt;/code&gt; and reimplement the routing configuration on the device that is changed.&lt;/p&gt;&#xA;" OwnerUserId="267" LastActivityDate="2014-07-14T10:52:49.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9944" PostTypeId="2" ParentId="9940" CreationDate="2014-07-14T12:38:54.547" Score="2" Body="&lt;p&gt;The HP 2520 is a layer 2 switch: all you can do with it is bridge the individual VLANs tagged on port 48. Then, as long as what is at the other end of it has the right VLANs, gateway addresses and routing set up, all should be fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: any intermediate switches will also need the VLANs present: tagged on both the uplink and downlink ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You do not need to worry about IP ranges.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastEditorUserId="6377" LastEditDate="2014-08-01T18:01:13.647" LastActivityDate="2014-08-01T18:01:13.647" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9949" PostTypeId="1" AcceptedAnswerId="9950" CreationDate="2014-07-14T17:30:10.320" Score="3" ViewCount="1020" Body="&lt;p&gt;I have two MLS Connected to a Layer 2 Switch, Behind Layer 2 Switch there are some 5 hosts are there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MLS - A - &#xA;Active Router&#xA;IP Add - 192.168.1.10 &#xA;MAC Add - 0000.aaaa.aaaa&#xA;Priority - 200&#xA;VLAN 50&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MLS - B&#xA;Standby Router&#xA;IP add - 192.1681.11&#xA;Mac Add - 0000.bbbb.bbbb&#xA;Priority - 100&#xA;Vlan 50 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Virtual IP address - 192.168.1.1 &#xA;Virtual Mac Address - 0000.0c07.ac01&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When MLS - A is down , Its going to send a Resign Message to MLS - B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How come the Layer 2 Switch will come to know about MLS A got down and It needs to send the traffic to MLS- B Immediately. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether Once the switch got the Resign Message of MLS - A, Its going to Flush the MAC table and Relearn the MAC table completely. Please Let me know How its Possible for the Layer 2 Switch to switch the traffic immediately towards MLS - B &lt;/p&gt;&#xA;" OwnerUserId="3915" LastActivityDate="2014-07-15T05:01:32.977" Title="High Availability on Routers - HSRP, VRRP, GLBP" Tags="|switch|hsrp|vrrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9950" PostTypeId="2" ParentId="9949" CreationDate="2014-07-14T18:22:25.683" Score="5" Body="&lt;p&gt;It's all about the timers.  There's an advertise interval and a master down interval (hello and hold time in HSRP and GLBP).  The master sends VRRP advertisements according to the advertise interval.  This lets the backup know that the master is up.  If the backup doesn't receive an advertisement within the master down interval, it will transition to master.  The key to keeping connections alive is tuning your intervals down to sub-second failover.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the backup router takes over, it sends a gratuitous ARP message telling everyone to use its MAC address for the virtual IP.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-07-14T18:22:25.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9951" PostTypeId="1" CreationDate="2014-07-14T18:59:46.117" Score="6" ViewCount="1109" Body="&lt;p&gt;We are using the Autonomous mode...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco IOS Software, C1040 Software (C1140-K9W7-M), Version 15.2(4)JA1, RELEASE SOFTWARE (fc2)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap#sh controllers do1 radio-reset &#xA;Last radio reset code: 71&#xA;Radio resets - total:22 retries:0 failed:0&#xA;Reset Stats: Start Cnt: 3, Recovery: Cnt 1, Last Ret: 0, Fails: 0, Recvry Status: Stalled NO, In Prog NO&#xA;   Code/Count: 37/00016 2 67/00001 0 68/00004 0 71/00001 BE8D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wireless/aironet-3700-series/117869-technote-ap-00.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Aironet 3700 Series - AP Radio Reset Codes&lt;/a&gt; is the only link I can find with reference infomation regarding radio codes....&lt;/p&gt;&#xA;" OwnerUserId="7532" LastEditorUserId="3191" LastEditDate="2015-07-01T21:13:15.957" LastActivityDate="2015-07-01T21:18:42.997" Title="On the Cisco AIR models, what is the definition of radio reset code 71?" Tags="|cisco|wireless|cisco-ios|aironet|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9952" PostTypeId="1" AcceptedAnswerId="10050" CreationDate="2014-07-14T21:06:41.700" Score="4" ViewCount="7549" Body="&lt;p&gt;Our Root CA Certificate expired recently, in advance we loaded the new one on our ISE servers however after the expiry we have had issues with Android devices and BYOD onboarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apple devices are working without issue and our 802.1x with workstations is also working without issues however Android devices are flagging the following error in the logs: &lt;strong&gt;&quot;EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have tried removing the old certificate, restarted the PSN and ISE servers and forced a resync as well. Apple and Windows devices are showing the certificates are fine and NOT flagging the same error, they operate 100% of the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: All ISE certificates come from our enterprise CA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone encountered this issue before?&lt;/p&gt;&#xA;" OwnerUserId="5120" LastEditorUserId="3191" LastEditDate="2014-07-16T17:04:38.480" LastActivityDate="2014-07-21T23:20:30.837" Title="Cisco ISE - Issues after new CA Certificate" Tags="|cisco|troubleshooting|cisco-ise|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="9953" PostTypeId="1" AcceptedAnswerId="9963" CreationDate="2014-07-14T21:41:59.260" Score="3" ViewCount="587" Body="&lt;p&gt;If the below fields don't match between two firewalls will VPN connectivity be compromised?&#xA;If not, which of the elements MUST be the same on both sides to ensure connectivity.  Keep in mind the first 4 are global settings, and the last (sla monitor) is a per connection configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec df-bit clear-df outside&#xA;crypto ipsec security-association replay window-size 128&#xA;crypto ipsec fragmentation before-encryption outside&#xA;sysopt connection tcpmss 1387&#xA;&#xA;sla monitor 1&#xA; type echo protocol ipIcmpEcho x.x.x.x interface outside&#xA; frequency 5&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2014-07-15T15:15:18.933" LastActivityDate="2014-07-15T15:28:11.293" Title="If the following parameters don't match, will VPN still work?" Tags="|cisco-asa|vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9955" PostTypeId="1" CreationDate="2014-07-14T22:36:49.067" Score="6" ViewCount="8239" Body="&lt;p&gt;I've found the following SNMP OIDs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;BGP Peers: .1.3.6.1.2.1.15.3.1.1&lt;/li&gt;&#xA;&lt;li&gt;BGP Peer state: .1.3.6.1.2.1.15.3.1.1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But I'm looking for the list of &lt;em&gt;advertised&lt;/em&gt; routes by peer. Does anybody know of a way to get this via SNMP? My fallback is to use SSH and screen scrape &lt;code&gt;show&lt;/code&gt; commands, but this seems to be the kind of thing that SNMP was designed for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it makes a difference the target platform for this project is FTOS.&lt;/p&gt;&#xA;" OwnerUserId="500" LastEditorUserId="3191" LastEditDate="2014-07-16T05:30:24.037" LastActivityDate="2017-10-26T13:46:53.400" Title="SNMP OID for advertised routes by peer" Tags="|bgp|snmp|force10|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9957" PostTypeId="2" ParentId="9955" CreationDate="2014-07-15T07:03:59.207" Score="3" Body="&lt;h1&gt;Cisco&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;You should be able to use the OIDs under &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.15.5.1#oidContent&quot; rel=&quot;nofollow&quot;&gt;1.3.6.1.2.1.15.5.1 (bgpPathAttrEntry)&lt;/a&gt; for Cisco devices.  There are 2 OIDs in particular that should accomplish what you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.15.5.1.1#oidContent&quot; rel=&quot;nofollow&quot;&gt;1.3.6.1.2.1.15.5.1.1 (bgpPathAttrPeer)&lt;/a&gt;&lt;/strong&gt; - The IP address of the peer where the path information was learned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.15.5.1.2#oidContent&quot; rel=&quot;nofollow&quot;&gt;1.3.6.1.2.1.15.5.1.2 (bgpPathAttrDestNetwork)&lt;/a&gt;&lt;/strong&gt; - The address of the destination network.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h1&gt;Force10&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This information should be obtainable under &lt;a href=&quot;http://cric.grenoble.cnrs.fr/Administrateurs/Outils/MIBS/?oid=1.3.6.1.4.1.6027.20.1.3.4.1&quot; rel=&quot;nofollow&quot;&gt;1.3.6.1.4.1.6027.20.1.3.4.1 (f10BgpM2PathAttrEntry)&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;http://cric.grenoble.cnrs.fr/Administrateurs/Outils/MIBS/?oid=1.3.6.1.4.1.6027.20.1.3.4.1.12&quot; rel=&quot;nofollow&quot;&gt;1.3.6.1.4.1.6027.20.1.3.4.1.12 (f10BgpM2AsPathString)&lt;/a&gt;&lt;/strong&gt; - This is a string depicting the autonomous system path to this network which was received from the peer which advertised it. The format of the string is implementation-dependent, and should be designed for operator readability.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-07-16T06:41:08.730" LastActivityDate="2014-07-16T06:41:08.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9958" PostTypeId="1" CreationDate="2014-07-15T07:22:16.810" Score="2" ViewCount="442" Body="&lt;p&gt;I have to connect three LAN networks to a node through 24 fiber FO cable. The node contains three different networks a PLC,a security system, a CCTV network. Should I go for three separate CISCO ethernet switches or can I use one switch whcih can identify these three LANs and connect them to the users correctly &lt;/p&gt;&#xA;" OwnerUserId="7538" LastEditorUserId="775" LastEditDate="2014-12-08T12:52:12.303" LastActivityDate="2014-12-08T12:52:12.303" Title="To connect 3 LAN to a switch" Tags="|cisco|switch|ethernet|layer2|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9959" PostTypeId="2" ParentId="9958" CreationDate="2014-07-15T12:16:39.813" Score="2" Body="&lt;p&gt;you have to define 3 vlans Interface like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;each vlan represent a LAN(Virtual LAN)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA;ip address 10.10.10.1 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA;ip address 20.20.20.1 255.255.255.0&#xA;!&#xA;interface Vlan3&#xA;ip address 30.30.30.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you create a vlan using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 2 #for example&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then you add what ever ports you want to each vlan:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(for example):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface fastethernet 0/1&#xA;switchport mode access&#xA;switchport access vlan 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: You have to active routing using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you want a connection between the 3 LANS&lt;/p&gt;&#xA;" OwnerUserId="4777" LastEditorUserId="4777" LastEditDate="2014-07-15T12:29:44.543" LastActivityDate="2014-07-15T12:29:44.543" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="9960" PostTypeId="1" AcceptedAnswerId="9978" CreationDate="2014-07-15T13:26:44.037" Score="4" ViewCount="3473" Body="&lt;p&gt;I am having problems connecting from some of my switches to the router/internet. I have a Cisco 1900 series router with four different 2960 series switches. All Gigabit Ethernet ports are configured to be trunk. The router is connected to FF_Switch using the Gig0/1 port while the Gig0/2 port is connected to a Fiber/T Transceiver(Fiber connection converted to RJ45 using Fiber/T Transceiver) passed over fiber connection to another Fiber/T Transceiver, from which it is connected to Gig0/1 of SVOSwitch2. Gig0/2 of SVOSwitch2 connects to Gig0/1 of SVOSwitch3. Gig0/2 of SVOSwitch3 connects to Gig0/1 of SVOSwitch1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SVOSwitch1 has the ports on VLAN1 and 3, SVOSwitch2 has the ports on VLAN 4 and 5 while SVO Switch 3 has the ports on VLAN 5 and 6. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that whenever I connect to any of the ports, I can only connect and get DHCP on the ports on VLAN 1 and 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration for the router is given below;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ip dhcp pool FF_SWITCH&#xA;network 192.168.1.0 255.255.255.0&#xA;dns-server xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx &#xA;default-router 192.168.1.1 &#xA;!&#xA;ip dhcp pool SVOSwitch1&#xA;network 192.168.3.0 255.255.255.0&#xA;dns-server xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx &#xA;default-router 192.168.3.1 &#xA;!&#xA;ip dhcp pool SVOSwitch2&#xA;network 192.168.4.0 255.255.255.0&#xA;dns-server xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx &#xA;default-router 192.168.4.1 &#xA;!&#xA;ip dhcp pool SVOSwitchVlanPool1&#xA;network 192.168.6.0 255.255.255.0&#xA;dns-server xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx &#xA;default-router 192.168.6.1 &#xA;!&#xA;ip dhcp pool SVOSwitch3&#xA;network 192.168.5.0 255.255.255.0&#xA;dns-server xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx &#xA;default-router 192.168.5.1 &#xA;!&#xA;ip dhcp pool SVOSwitchVlanPool2&#xA;network 192.168.7.0 255.255.255.0&#xA;dns-server xxx.xxx.xxx.xxx xxx.xxx.xxx.xxx &#xA;default-router 192.168.7.1&#xA;&#xA;interface GigabitEthernet0/0&#xA;description ### WAN INTERFACE ###&#xA;ip address xxx.xxx.xxx.xxx 255.255.xxx.xxx&#xA;ip flow ingress&#xA;ip nat outside&#xA;ip virtual-reassembly in&#xA;duplex full&#xA;speed auto&#xA;no cdp enable&#xA;!&#xA;interface GigabitEthernet0/1&#xA;description ### LAN INTERFACE ###&#xA;no ip address&#xA;ip flow ingress&#xA;ip virtual-reassembly in&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface GigabitEthernet0/1.1&#xA;description ###1st FLR NETWORK ###&#xA;encapsulation dot1Q 1 native&#xA;ip address 192.168.1.1 255.255.255.0&#xA;ip access-group 110 in&#xA;ip accounting output-packets&#xA;ip flow ingress&#xA;ip flow egress&#xA;ip nat inside&#xA;ip virtual-reassembly in&#xA;!&#xA;interface GigabitEthernet0/1.3&#xA;description ### TNB WIRELESS NETWORK ###&#xA;encapsulation dot1Q 3&#xA;ip address 192.168.3.1 255.255.255.0&#xA;ip access-group 110 in&#xA;ip accounting output-packets&#xA;ip flow ingress&#xA;ip flow egress&#xA;ip nat inside&#xA;ip virtual-reassembly in&#xA;!&#xA;interface GigabitEthernet0/1.4&#xA;description ### TNB 1ST WING NETWORK ###&#xA;encapsulation dot1Q 4&#xA;ip address 192.168.4.1 255.255.255.0&#xA;ip access-group 110 in&#xA;ip accounting output-packets&#xA;ip flow ingress&#xA;ip flow egress&#xA;ip nat inside&#xA;ip virtual-reassembly in&#xA;!&#xA;interface GigabitEthernet0/1.5&#xA;description ### TNB 2ND WING NETWORK ###&#xA;encapsulation dot1Q 5&#xA;ip address 192.168.5.1 255.255.255.0&#xA;ip access-group 110 in&#xA;ip accounting output-packets&#xA;ip flow ingress&#xA;ip flow egress&#xA;ip nat inside&#xA;ip virtual-reassembly in&#xA;!&#xA;interface GigabitEthernet0/1.6&#xA;description ### TNB PENTHOUSE NETWORK ###&#xA;encapsulation dot1Q 6&#xA;ip address 192.168.6.1 255.255.255.0&#xA;ip access-group 110 in&#xA;ip accounting output-packets&#xA;ip flow ingress&#xA;ip flow egress&#xA;ip nat inside&#xA;ip virtual-reassembly in&#xA;!&#xA;interface GigabitEthernet0/1.7&#xA;description ### TNB OTHER NETWORK ###&#xA;encapsulation dot1Q 7&#xA;ip address 192.168.7.1 255.255.255.0&#xA;ip access-group 110 in&#xA;ip accounting output-packets&#xA;ip flow ingress&#xA;ip flow egress&#xA;ip nat inside&#xA;ip virtual-reassembly in&#xA;!&#xA;interface GigabitEthernet0/0/0&#xA;switchport access vlan 100&#xA;no ip address&#xA;!&#xA;interface GigabitEthernet0/0/1&#xA;no ip address&#xA;!&#xA;interface GigabitEthernet0/0/2&#xA;no ip address&#xA;!&#xA;interface GigabitEthernet0/0/3&#xA;no ip address&#xA;!&#xA;interface Vlan1&#xA;no ip address&#xA;!&#xA;interface Vlan100&#xA;ip address xxx.xxx.xxd.ddd xxx.xxx.xxx.xxx&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;ip flow-export source GigabitEthernet0/1&#xA;ip flow-export version 9&#xA;ip flow-export destination 192.168.1.120 9996&#xA;!&#xA;ip nat inside source list NAT interface GigabitEthernet0/0 overload&#xA;ip route 0.0.0.0 0.0.0.0 aaa.aaa.aaa.aaa&#xA;!&#xA;ip access-list standard NAT&#xA;permit 192.168.1.0 0.0.0.255&#xA;permit 192.168.3.0 0.0.0.255&#xA;permit 192.168.4.0 0.0.0.255&#xA;permit 192.168.5.0 0.0.0.255&#xA;permit 192.168.6.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;snmp-server community public RO&#xA;snmp-server community private RW&#xA;snmp-server ifindex persist&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please what am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Avery Abbott requested, here is it from SVOSwitch3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SVOSwitch3#show vlan brief&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                          active    &#xA;5    VLAN0005                         active    Fa0/1, Fa0/2, Fa0/3, Fa0/4&#xA;                                                Fa0/5, Fa0/6&#xA;6    VLAN0006                         active    Fa0/7, Fa0/8, Fa0/9, Fa0/10&#xA;                                                Fa0/11, Fa0/12, Fa0/13, Fa0/14&#xA;                                                Fa0/15, Fa0/16, Fa0/17, Fa0/18&#xA;                                                Fa0/19, Fa0/20, Fa0/21, Fa0/22&#xA;                                                Fa0/23, Fa0/24&#xA;1002 fddi-default                     act/unsup &#xA;1003 token-ring-default               act/unsup &#xA;1004 fddinet-default                  act/unsup &#xA;1005 trnet-default                    act/unsup &#xA;&#xA;&#xA;SVOSwitch3#show interface trun    &#xA;&#xA;Port        Mode             Encapsulation  Status        Native vlan&#xA;Gi0/1       on               802.1q         trunking      1&#xA;Gi0/2       on               802.1q         trunking      1&#xA;&#xA;Port        Vlans allowed on trunk&#xA;Gi0/1       1-4094&#xA;Gi0/2       1-4094&#xA;&#xA;Port        Vlans allowed and active in management domain&#xA;Gi0/1       1,5-6&#xA;Gi0/2       1,5-6&#xA;&#xA;Port        Vlans in spanning tree forwarding state and not pruned&#xA;Gi0/1       1,5-6&#xA;Gi0/2       1,5-6&#xA;SVOSwitch3#show run int gi0/1&#xA;Building configuration...&#xA;&#xA;Current configuration : 59 bytes&#xA;!&#xA;interface GigabitEthernet0/1&#xA; switchport mode trunk&#xA;end&#xA;&#xA;SVOSwitch3#show run int gi0/2&#xA;Building configuration...&#xA;&#xA;Current configuration : 59 bytes&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport mode trunk&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And for the running config, I have,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SVOSwitch3&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 1/&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;!&#xA;!&#xA;!&#xA;!         &#xA;crypto pki trustpoint TP-self-signed-14&#xA;     enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-14&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-14&#xA;!&#xA;!&#xA;crypto pki certificate chain TP-self-signed-14&#xA;  quit&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 5&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 5&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 5&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport access vlan 5&#xA;!&#xA;interface FastEthernet0/5&#xA; switchport access vlan 5&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport access vlan 5&#xA;!&#xA;interface FastEthernet0/7&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/8&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/9&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/10&#xA; switchport access vlan 6&#xA;!         &#xA;interface FastEthernet0/11&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/12&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/13&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/14&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/15&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/16&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/17&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/18&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/19&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/20&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/21&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/22&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/23&#xA; switchport access vlan 6&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport access vlan 6&#xA;!&#xA;interface GigabitEthernet0/1&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.1.9 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;ip default-gateway 192.168.5.1&#xA;ip http server&#xA;ip http secure-server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That was picked from the SVOSwitch3.&lt;/p&gt;&#xA;" OwnerUserId="3869" LastEditorUserId="3869" LastEditDate="2014-07-17T07:14:46.040" LastActivityDate="2014-07-17T07:14:46.040" Title="Router not assigning DHCP IP Addresses to Interconnecting Switches" Tags="|router|switch|vlan|dhcp|fiber|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9962" PostTypeId="1" AcceptedAnswerId="9966" CreationDate="2014-07-15T14:47:31.273" Score="6" ViewCount="7098" Body="&lt;p&gt;I'm looking to do an IOS upgrade on a two Switch 3850 stack, with minimum downtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As our servers all have redundant uplinks to each switch, it would be preferable to reload each stack member individually. Unfortunately all the documentation I've read so far implies the entire stack needs to reload at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my Question is: Can the IOS be upgraded on a 3850 Stack, without a complete outage? If so, how would I go about doing so?&lt;/p&gt;&#xA;" OwnerUserId="2782" LastActivityDate="2014-07-15T17:04:32.250" Title="Rolling Stack Upgrade on a Catalyst 3850" Tags="|cisco|cisco-catalyst|cisco-ios|stacking|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9963" PostTypeId="2" ParentId="9953" CreationDate="2014-07-15T15:28:11.293" Score="3" Body="&lt;p&gt;Your VPN will still work, but there may possibly be some problems when passing large packets.  The first 4 commands affect the maximum packet size and fragmentation.  Depending on the MTU of your Internet connection, this may or may not be an issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SLA commands do not affect the VPN per se.   However, they may be used to affect routing or some other operation.  I can't tell with just the snippet you've provided.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-07-15T15:28:11.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9964" PostTypeId="1" AcceptedAnswerId="9971" CreationDate="2014-07-15T16:32:09.090" Score="6" ViewCount="902" Body="&lt;p&gt;I'm connecting a Cisco 2851 router to a Layer 3 3750-X stack (2 switches).  The Gi0/0 interface connects to an access port on the stack master.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I achieve redundancy from the 2851 to the stack member?  Throw another HWIC into the router and connect to the stack member?  Or is there not an option&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using EIGRP between this location (2851) and our headquarters (2851).&lt;/p&gt;&#xA;" OwnerUserId="6069" LastActivityDate="2014-07-16T00:58:26.750" Title="Connect one router to layer 3 3750-X stack for redundancy" Tags="|cisco|router|switch|redundancy|eigrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9965" PostTypeId="2" ParentId="9964" CreationDate="2014-07-15T17:00:27.310" Score="3" Body="&lt;p&gt;You'll need another physical interface on your router that runs at the same speed as your existing physical interface.  Once you have that, you can create an etherchannel/port-channel/lag between the switch and the router and you'll need to move your IP address and your sub-interfaces (if you have any) to the new port-channel interface.  Here's a guide on how to get it up and running:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/21066-135.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/21066-135.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-07-15T17:00:27.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9966" PostTypeId="2" ParentId="9962" CreationDate="2014-07-15T17:04:32.250" Score="5" Body="&lt;p&gt;Nope, sorry.  That's why I prefer daisy-chaining to stacking, even though I lose out on some bandwidth and a couple of ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some helpful hints on the upgrade here, though:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/11924636/3850-stack-ios-upgrade&quot;&gt;https://supportforums.cisco.com/discussion/11924636/3850-stack-ios-upgrade&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-07-15T17:04:32.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9969" PostTypeId="1" AcceptedAnswerId="9973" CreationDate="2014-07-15T18:47:28.343" Score="4" ViewCount="368" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9TTKd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MD5 digest between the VTP Server located on Switch1 and the VTP Client located on Switch2 have been synchronized. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although the steps from &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/9868/how-to-synchronize-md5-digest-between-vtp-server-and-client&quot;&gt;this Q&amp;amp;A&lt;/a&gt; have been followed, a trunk has been created between VTP Client Switch3 and VTP Server Switch1, a discrepancy in MD5 digest remains and the VLANs created on Switch1 do not appear on Switch3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;VTP:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Switch1:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh vtp st&#xA;VTP Version capable             : 1 to 3&#xA;VTP version running             : 1&#xA;VTP Domain Name                 : domain&#xA;VTP Pruning Mode                : Enabled&#xA;VTP Traps Generation            : Disabled&#xA;Device ID                       : X.Y.Z&#xA;Configuration last modified by X at Y Z&#xA;&#xA;Feature VLAN:&#xA;--------------&#xA;VTP Operating Mode                : Server&#xA;Maximum VLANs supported locally   : 1005&#xA;Number of existing VLANs          : 6&#xA;Configuration Revision            : 6&#xA;MD5 digest                        : 0xfc 0x5e 0x03 0x8d 0x38 0xa5 0x70 0x32 &#xA;                                    0x08 0x54 0x41 0xe7 0xfe 0x70 0x10 0xb0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Switch3:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Follows ASAP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Trunk:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Switch1:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/X&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Switch3:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/Y&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; trunk type is required on Cisco IOS 3560 and &lt;code&gt;encapsulation dot1q&lt;/code&gt; is not available on Cisco IOS 2950&lt;/p&gt;&#xA;" OwnerUserId="5282" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-07-16T03:36:10.483" Title="Could MD5 digest be synchronized between VTP Server and Client if there is a discrepancy in Switch Versions?" Tags="|cisco-ios|vtp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9971" PostTypeId="2" ParentId="9964" CreationDate="2014-07-16T00:58:26.750" Score="1" Body="&lt;p&gt;The other option is to use the second physical interface as a second subnet and let eigrp from a second neighbor relationship. If the speeds are the same you can do equal cost load balancing. Finally 2 separate L3 links are easier to troubleshoot than a port channel and you don't have to have the exact same hardware. Its a matter of style. I am assuming you are running eigrp between the switch and the router. If you are not then 2 static default routes will do the routing trick.&lt;/p&gt;&#xA;" OwnerUserId="1461" LastActivityDate="2014-07-16T00:58:26.750" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="9973" PostTypeId="2" ParentId="9969" CreationDate="2014-07-16T03:36:10.483" Score="3" Body="&lt;p&gt;The basic answer to your question is no, the different switch versions don't matter.  As long as you're running the same VTP version on the server and client, both are configured for the same VTP domain and password (optional), and the link between switches uses 2 correctly-configured trunk ports, you should be good to go.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-07-16T03:36:10.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9976" PostTypeId="1" CreationDate="2014-07-16T07:41:36.663" Score="2" ViewCount="68" Body="&lt;p&gt;I've been going through STM1 frame structure recently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to put a single E0(64kbps) voice channel directly into a stm1 frame or should it be put sequentially into a E1 and then to an E2 and so on and finally an E4 into a STM1 frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done enough of googling but still couldn’t get it cleared.&lt;/p&gt;&#xA;" OwnerUserId="7551" LastActivityDate="2014-07-16T10:29:00.617" Title="Is it possible to put one E0 voice signal directly into a STM1 frame" Tags="|telephony|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9978" PostTypeId="2" ParentId="9960" CreationDate="2014-07-16T09:04:05.150" Score="2" Body="&lt;p&gt;All thanks to the comment by Avery Abbott, I was able to solve the problem by making sure that all [cascading] switches have the corresponding vlans created so that the trunks can carry data for that vlan across the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks all.&lt;/p&gt;&#xA;" OwnerUserId="3869" LastActivityDate="2014-07-16T09:04:05.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9987" PostTypeId="2" ParentId="9952" CreationDate="2014-07-16T16:49:18.397" Score="2" Body="&lt;p&gt;I would recommend opening a TAC case.  However, consider that with your root cert expiry, you may need to ensure you have uploaded your intermediary certs as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be clear, your PAN should have the root and intermediary certs and your PSNs will send the entire chain.  Do not catenate the certs together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen this error before and we were missing an intermediary chain.  I would echo what Mike suggested and move to ISE 1.2 and realize the many other benefits/bugfixes.&lt;/p&gt;&#xA;" OwnerUserId="6419" LastEditorUserId="6419" LastEditDate="2014-07-16T16:57:17.053" LastActivityDate="2014-07-16T16:57:17.053" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="9988" PostTypeId="1" CreationDate="2014-07-16T19:20:31.470" Score="3" ViewCount="3184" Body="&lt;p&gt;I am trying to implement Dual Stack configuration of a network in Packet Tracer. I have two routers connected to each other both of these routers have one IPv4 client and one IPv6 client. The routers are configured to use both IPv4 and IPv6 protocols. I am able to send packet from one IPv4 client to another IPv4 client via both the routers. Similarly its also working for IPv6 clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am unable to send packet from an IPv4 client to an IPv6 client via both the routers and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this kind of communication between IPv4 and IPv6 is possible using only Dual Stack? If yes kindly help me with the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in Advance.:)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below given is the link to the network we designed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zCxRt.jpg&quot; alt=&quot;network diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="7558" LastEditorUserId="775" LastEditDate="2014-12-08T12:51:45.990" LastActivityDate="2019-03-02T01:47:37.303" Title="Dual Stack Network Configuration" Tags="|routing|ipv6|packet-tracer|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9989" PostTypeId="2" ParentId="9988" CreationDate="2014-07-16T19:33:01.323" Score="5" Body="&lt;p&gt;Dual stack means that an interface can communicate with both v4 and v6 clients.  It DOES NOT mean that it will translate between the two.  For that, you need to implement &lt;a href=&quot;http://blog.ine.com/2008/04/18/understanding-ipv6-nat-pt/&quot; rel=&quot;noreferrer&quot;&gt;NAT-PT&lt;/a&gt;, to translate between the different layer 3 protocols.    BTW, I've never seen NAT-PT work at any scale.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-07-16T19:33:01.323" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9991" PostTypeId="1" AcceptedAnswerId="9994" CreationDate="2014-07-16T20:35:05.620" Score="4" ViewCount="699" Body="&lt;p&gt;I am running CME 8.6 on a Cisco 2811. I would like to install NM-CUE and run CUE 7 with this. It this possible, even with a version mismatch?&lt;/p&gt;&#xA;" OwnerUserId="7560" LastEditorUserId="44" LastEditDate="2014-07-17T05:50:47.550" LastActivityDate="2014-07-17T05:50:47.550" Title="Can I Use Different Versions of CME and CUE" Tags="|cisco|voip|telephony|hardware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="9992" PostTypeId="2" ParentId="9988" CreationDate="2014-07-16T22:24:30.560" Score="4" Body="&lt;p&gt;In a dual stack network, a host has both an IPv4 and an IPv6 configuration allowing them to choose which protocol to use. When communicating with an IPv6 host, it will use its IPv6 address, when talking to an IPv4 host, it will use its IPv4 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From your question, I gather that you have IPv4 on all systems, but IPv6 is only configured on the routers. To make the network fully dual stack, the hosts should also be configured to run IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To allow an IPv4-only host to an IPv6-only one requires some kind of address translation. There are different so-called &quot;IPv6 transition mechanisms&quot;. Most are designed to be able to deploy IPv6-only networks and still allow the machines to talk to IPv4 networks.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-07-16T22:24:30.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9994" PostTypeId="2" ParentId="9991" CreationDate="2014-07-17T05:50:24.013" Score="4" Body="&lt;p&gt;Mixing versions like this, depending on which version of CME and CUE you are using, will work in some instances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your particular case however, it appears that the &lt;strong&gt;answer is no&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;CME 8.6 will only work with CUE versions 7.3, 7.4, 8.5, and 8.6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you're talking about a plain NM-CUE in a 2811, that module will only support up to CUE version 7.0.  Your best bet for a hardware solution would be the NME-CUE, which can support up 8.6 in my testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other option, depending on your other requirements for 15.(1)M4, would be to roll back to an older IOS on the 2811 for an older CME.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/unity_exp/compatibility/cuecomp.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Unity Express Compatibility Matrix&lt;/a&gt; and the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucme/requirements/guide/33matrix.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Unfied CME and Cisco IOS Software Compatability Matrix&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2014-07-17T05:50:24.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9995" PostTypeId="2" ParentId="9988" CreationDate="2014-07-17T08:28:50.557" Score="4" Body="&lt;p&gt;In addition to Gerben answer: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv4 and IPv6 are to different protocols. So a IPv4 only client can only communicate with an IPv4 server. An IPv6 only client can only communicate with an IPv6 Server. Dual-Stacking means that you uses both protocols. Most modern &#xA;operating systems will then prefer IPv6 over IPv4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some ways to &quot;translate&quot; one protocol into another, for HTTP (and some others) you can use a proxy server. For a wider variety of protocols NAT64 / DNS64 works pretty well unless you (or the party you are trying to communicate with) uses IP addresses (e.g. to embedded pictures into a web page) instead of DNS. AFAIK for Cisco the NAT64 part can only be done on ASR1K routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please forget everything you read about NAT-PT which is deprecated but might still be used for some (Cisco) certification tests. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-07-17T08:28:50.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="9998" PostTypeId="1" AcceptedAnswerId="10004" CreationDate="2014-07-17T14:30:00.647" Score="3" ViewCount="6087" Body="&lt;p&gt;Ethernet uses a sliding window to resend lost frames (error correction). It uses a sequence number to account for unordered frames (error correction). It has a frame check sequence to discard corrupted frames (error detection). Does this makes it &quot;reliable&quot;?&lt;/p&gt;&#xA;" OwnerUserId="7568" LastActivityDate="2014-07-17T17:39:12.293" Title="Is Ethernet considered a reliable protocol?" Tags="|ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10004" PostTypeId="2" ParentId="9998" CreationDate="2014-07-17T16:56:22.007" Score="12" Body="&lt;p&gt;Not even remotely. There are no mechanisms for signaling a dropped frame (or why it was dropped -- CRC error, too small (&quot;runt&quot;), too big, no buffer space), thus there is no means to know what needs to be resent. There are no sequence numbers in ethernet frames -- the payload may contain one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only time &lt;em&gt;ethernet&lt;/em&gt; will resend a frame is when the transmitter knows a collision occurred. But with 99.99999% of gear being full duplex today, collisions never happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, this is why iSCSI SANs use special switches with very large internal, per-port buffers. And why FCoE (fibre channel over ethernet) uses special hardware. Both require a reliable transport, and ethernet on it's own isn't.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-07-17T17:39:12.293" LastActivityDate="2014-07-17T17:39:12.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10005" PostTypeId="2" ParentId="9740" CreationDate="2014-07-17T18:50:33.597" Score="2" Body="&lt;p&gt;It sounds like a couple of different issues are going on here...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Older versions of JunOS were known to corrupt things during a power failure.  Remember that JunOS is based on FreeBSD, and so there was an implicit assumption that you would do a proper shutdown before killing power.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To mitigate this, &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.2/topics/task/configuration/junos-software-rescue-configuration-creating-restoring.html&quot; rel=&quot;nofollow&quot;&gt;JunOS has a rescue config&lt;/a&gt;.  If the regular config is corrupt/unreadable, it would load the rescue config instead.  Did you have your rescue config set?  If not, you should have.  My best practice is to update the rescue config on production systems after any config changes are finalized/tested/approved.  This could explain the &quot;revert to defaults&quot; issue you had with the SRX210.  (The second possibility is that your cluster was unhealthy and configs were not syncing between the nodes as expected.  See &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB15505&quot; rel=&quot;nofollow&quot;&gt;the commands here&lt;/a&gt; to verify the cluster is working.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, it was possible to actually corrupt the root filesystem of an older JunOS device, and it would fail to boot, at all, and would fail out to a &lt;code&gt;db&amp;gt;&lt;/code&gt; prompt for debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In newer versions of JunOS, the concerns about corruption due to power failure are pretty much resolved.  The addition of Resilient Dual Root Partitions helped a lot.  Note that if you are upgrading from a much older version that predates these features, there are some extra boot loader / partition table changes that are required during the upgrade process.&#xA;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/security/software-all/initial-config/index.html?topic-56813.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/security/software-all/initial-config/index.html?topic-56813.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure you are running &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB21476&quot; rel=&quot;nofollow&quot;&gt;the latest recommended JunOS build&lt;/a&gt; on both SRXes.  If you upgraded from a much older version, make sure you followed the instructions and did not skip a step as you may miss out on the dual partition features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The failure you saw on the SRX100 looks like a root filesystem corruption issue (&lt;code&gt;panic: bad inflate&lt;/code&gt; is a big clue).  However, it looks like you upgraded to a new enough JunOS version that a corrupt root FS should never happen.  Also, if you rebooted and it magically started working again, that smells like the builtin flash storage is dying.  I would open a ticket with JTAC for a replacement or buy a new one.&lt;/p&gt;&#xA;" OwnerUserId="3989" LastActivityDate="2014-07-17T18:50:33.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10008" PostTypeId="2" ParentId="5459" CreationDate="2014-07-18T02:46:41.930" Score="0" Body="&lt;p&gt;If you're running Quagga on a Linux box, you can enable RPF by setting kernel parameter &lt;code&gt;net.ipv4.conf.default.rp_filter&lt;/code&gt; to 1 or 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please see this page for more details: &lt;a href=&quot;http://www.slashroot.in/linux-kernel-rpfilter-settings-reverse-path-filtering&quot; rel=&quot;nofollow&quot;&gt;http://www.slashroot.in/linux-kernel-rpfilter-settings-reverse-path-filtering&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3285" LastActivityDate="2014-07-18T02:46:41.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10009" PostTypeId="2" ParentId="5459" CreationDate="2014-07-18T05:55:53.627" Score="0" Body="&lt;p&gt;As far as I understand it you have 2 connections to transit providers and 1 connection to a peering point, in this situation I assume that you are using BGP to peer with your transit providers and with an  IXP router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way BGP works is others can only reach the destinations you advertise to them.  So for example you have a /24 and you will advertise this to your transit providers so hosts on the internet can reach you through you transit peers and you would also advertise your /24 to the peering point so that hosts connected to the peering point can reach you directly without going over the internet (as this would be seen as the best path).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For BGP sessions you would normally be filtering what you advertise to your peers and what they advertise to you (if you have downstream peers) with a prefix list for example.  Generally you wont filter inbound from the peering exchange as the exchange will only send you routes of people connected on the exchange.  This is similar to your transit providers except they will generally send you the full global routing table (all destinations on the internet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this situation you would add a prefix list matching an ACL in the outbound direction on the BGP session connected to the peering point to only advertise your /24 prefix this will allow hosts on the peering exchange to reach only IP's in your /24 via your router (which is what you want).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone advertises a default route to you and you accept it, you wont be taking their traffic and sending it to the internet.  In this situation you would see a route to the internet via them because your router will see a route to 0.0.0.0/0 (the internet) through them because they advertised it to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only time hosts connected to the peering exchange will see the internet via you is if you advertise a default route on to the exchange yourself. The only other time you may be used as a “transit AS” is if you have customers that are downstream peers with you and they ask that you advertise their IP space to the IXP so they can reach the exchange through you. &lt;/p&gt;&#xA;" OwnerUserId="248" LastEditorUserId="248" LastEditDate="2014-07-18T06:02:06.740" LastActivityDate="2014-07-18T06:02:06.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10013" PostTypeId="2" ParentId="9756" CreationDate="2014-07-18T14:03:41.140" Score="3" Body="&lt;p&gt;@legioxi, jwbensley:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I apologize for not having responded earlier. Until today, I didn't realize that anyone had actually responded to my original post. That being said, I finally discovered what was going on:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco ASA introduced the &quot;timeout floating-conn&quot; command in the 8.2(5)/8.4(2) release which basically tells the ASA how long to keep an established connection even when the ASA knows about other routes. The default is 0:00:00 - meaning those connections NEVER time out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cisco's own words:&#xA;&quot;When multiple static routes exist to a network with different metrics, the ASA uses the one with the best metric at the time of connection creation. If a better route becomes available, then this timeout lets connections be closed so a connection can be reestablished to use the better route. The default is 0 (the connection never times out). To take advantage of this feature, change the timeout to a new value.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why the default is 0:00:00 is beyond me. I can understand that low timeout values negate the benefits of fast-path connections in terms of sheer processing, but I would think that the timeout should be set to &lt;em&gt;something&lt;/em&gt; and at least give the ASA a chance to adapt to changes in the network or, in the very least, updates in its own configuration made by an administrator.&lt;/p&gt;&#xA;" OwnerUserId="6385" LastActivityDate="2014-07-18T14:03:41.140" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10015" PostTypeId="1" AcceptedAnswerId="10018" CreationDate="2014-07-18T16:17:29.117" Score="4" ViewCount="4202" Body="&lt;p&gt;I'm looking online for definitions of each, but I'm confused as some websites say STP uses only two types of flags; while others refer to TCN, TC, and TCA flags. Are they three separate types of flags? What is the use of each in STP?&lt;/p&gt;&#xA;" OwnerUserId="6397" LastActivityDate="2014-07-19T04:55:21.507" Title="What flags are used in BPDUs in STP?" Tags="|spanning-tree|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10016" PostTypeId="1" AcceptedAnswerId="10209" CreationDate="2014-07-18T18:19:29.233" Score="2" ViewCount="5176" Body="&lt;p&gt;&lt;strong&gt;Network diagram&lt;/strong&gt; &lt;a href=&quot;http://www.gliffy.com/go/publish/6010719&quot; rel=&quot;nofollow&quot;&gt;http://www.gliffy.com/go/publish/6010719&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a small-business grade NAT router, Draytek Vigor 2950. Devices behind the router are unable to communicate with NTP servers on the outside. This includes both Windows PCs, and our IP phones. All other services (DNS, HTTP, FTP, IMAP, SMTP, POP) function as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that NTP (&lt;strong&gt;edit&lt;/strong&gt; used to be &quot;NAT&quot;) uses UDP port 123. I thought I wouldn't have to make any adjustments on the router in order for UDP to function properly; the NAT functionality should take care of it. Our IP phones (and some PCs) use SIP to initiate the connection; they work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I decided to test other UDP applications. Using the method suggested at &lt;a href=&quot;https://support.safesoftsolutions.com/index.php?pg=kb.page&amp;amp;id=639&quot; rel=&quot;nofollow&quot;&gt;https://support.safesoftsolutions.com/index.php?pg=kb.page&amp;amp;id=639&lt;/a&gt; nothing gets through. I'm confused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I further test?&lt;/p&gt;&#xA;" OwnerUserId="7590" LastEditorUserId="7590" LastEditDate="2014-07-30T21:56:52.943" LastActivityDate="2014-07-30T22:55:12.063" Title="Can't query NTP through router" Tags="|router|nat|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10017" PostTypeId="2" ParentId="10016" CreationDate="2014-07-18T19:31:35.540" Score="5" Body="&lt;p&gt;Many NTP servers require the &lt;em&gt;source&lt;/em&gt; of the query come from port 123, or they won't answer.  I would say that's broken, but it doesn't change their behavior. (maybe ntp.org should pull them from the various pools.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-07-18T19:31:35.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10018" PostTypeId="2" ParentId="10015" CreationDate="2014-07-18T20:10:12.463" Score="9" Body="&lt;p&gt;802.1D STP has configuration BPDUs sent by the root bridge. The designated bridges relay these BPDUs on their designated ports. All BPDUs flow from the root. With 802.1D, a port going up or down will generate a topology change, unless portfast has been configured on the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a switch detects a topology change it will generate a TCN BPDU, which is a special BPDU. This BPDU is sent on root port. This BPDU must be acknowledged by the upstream switch until the TCN eventually reaches the root.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/lVsah.png&quot; alt=&quot;TCN&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the TCN BPDU has reached the root bridge, the root bridge will send out configuration BPDU with TC bit set. The root does this for MaxAge + FWD_DELAY seconds which is 20 + 15 seconds by default, for a total of 35 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jJgwr.png&quot; alt=&quot;TCN2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the switches receive this BPDU with TC set, they will shorten the timeout of the MAC address table to flush out stale entries. The timeout is then set to 15 seconds, so stale entries will be removed but active flows will be relearned through the now active ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If using 802.1w then there is a synchronization process through a proposal and agreement mechanism. With RSTP, only ports moving to forwarding can create topology changes. This makes sense since only adding connectivity should be of concern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a RSTP switch, when it detects a change it will set the TC bit in its BPDUs, the switch receiving this BPDU will then flush all MACs learned except for the port on where the BPDU was received. This will repeat throughout the network until the topology has converged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some more details in some of my blog posts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://lostintransit.se/2014/06/24/ethernet-stp-topology-change-and-the-behaviour-of-ethernet/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Topology change&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://lostintransit.se/2013/08/08/rstp-synchronization-behind-the-scenes/&quot; rel=&quot;nofollow noreferrer&quot;&gt;RSTP synchronization&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://lostintransit.se/2013/05/08/stp-convergence-mst/&quot; rel=&quot;nofollow noreferrer&quot;&gt;MST convergence&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://lostintransit.se/2013/05/07/spanning-tree-convergence/&quot; rel=&quot;nofollow noreferrer&quot;&gt;STP convergence&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="105" LastEditDate="2014-07-19T04:55:21.507" LastActivityDate="2014-07-19T04:55:21.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10022" PostTypeId="1" CreationDate="2014-07-19T09:45:36.120" Score="5" ViewCount="311" Body="&lt;p&gt;The below given diagram is a Static NAT implementation. To ping from an IPv4 client to an IPv6 client across the router we have to ping the IPv4-mapped address of the corresponding IPv6 client. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For ex:- To ping from PC3 to PC1 we type the command Ping 192.168.2.2 which is the IPv4 mapped address of PC1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what we want to do is directly enter the IPv6 address when pinging from PC3 to PC1.&#xA;ex:- Ping 2001:DB8:AAAA:B::206. The problem is that it is not able to ping by this command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is there any technique by which we can communicate from an IPv4 to IPv6 without the use of mapped addresses. The mapping should only take place within the router automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1NKtD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="7558" LastEditorUserId="775" LastEditDate="2014-12-08T12:50:35.980" LastActivityDate="2016-10-17T18:11:49.107" Title="Network Address Translation" Tags="|ipv4|nat|ipv6|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10024" PostTypeId="1" CreationDate="2014-07-19T18:18:21.923" Score="1" ViewCount="343" Body="&lt;p&gt;Is there a way to determine it, maybe with some heuristic (sniffing)?&lt;/p&gt;&#xA;" OwnerUserId="7599" LastActivityDate="2014-12-03T14:38:49.467" Title="How can I tell which routing protocol a wifi mesh network is using?" Tags="|routing|wireless|" AnswerCount="1" CommentCount="6" ClosedDate="2019-12-18T18:53:15.503" ContentLicense="CC BY-SA 3.0" />
  <row Id="10026" PostTypeId="2" ParentId="9846" CreationDate="2014-07-19T22:25:19.183" Score="0" Body="&lt;p&gt;Don't know if this would be an exception on Brocade, but you should receive all VLAN tags on mirror port. No VLAN membership setup is needed in mirror port.&lt;/p&gt;&#xA;" OwnerUserId="7600" LastActivityDate="2014-07-19T22:25:19.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10028" PostTypeId="2" ParentId="2473" CreationDate="2014-07-20T03:52:28.247" Score="1" Body="&lt;p&gt;Get a separate AP for guest access and place it behind a firewall. Only allow the Guest AP to connect to the Internet and nothing else. The topology would look something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Guest-AP----Firewall----Internet&#xA;                |&#xA;                |&#xA;         Office Network&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user6423" LastActivityDate="2014-07-20T03:52:28.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10031" PostTypeId="2" ParentId="10022" CreationDate="2014-07-20T12:58:06.390" Score="6" Body="&lt;p&gt;You can't. IPv4 and IPv6 are 2 separate protocols. Without doing some form of &lt;strong&gt;protocol translation&lt;/strong&gt; you cannot access IPv4 resources from IPv6 only hosts and no IPv6 resources from IPv4 only hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now there are 3 standard methods: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Dual-Stack everything&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For HTTP (and some other protocols): Use a proxy&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For a wider variety of protocols implement NAT64 with DNS64. This requires DNS and will not help with pinging IP addresses. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Some older literature will mention NAT-PT which is deprecated and should not be used anymore. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorDisplayName="user2084" LastEditDate="2014-07-21T10:47:16.033" LastActivityDate="2014-07-21T10:47:16.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10035" PostTypeId="5" CreationDate="2014-07-20T20:50:13.920" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://mininet.org/&quot; rel=&quot;nofollow&quot;&gt;Mininet&lt;/a&gt; is a linux network emulator for end-hosts, links switches and routers.  For more information, see the &lt;a href=&quot;https://github.com/mininet/mininet/wiki/Introduction-to-Mininet&quot; rel=&quot;nofollow&quot;&gt;Introduction to Mininet&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7495" LastEditorUserId="775" LastEditDate="2014-07-20T20:54:24.247" LastActivityDate="2014-07-20T20:54:24.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10036" PostTypeId="4" CreationDate="2014-07-20T20:50:13.920" Score="0" Body="For questions about Mininet a network emulator running a collection of end-hosts, switches, routers, and links on a single Linux kernel. " OwnerUserId="7495" LastEditorUserId="7495" LastEditDate="2014-07-20T23:49:51.547" LastActivityDate="2014-07-20T23:49:51.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10042" PostTypeId="1" CreationDate="2014-07-21T13:41:22.720" Score="2" ViewCount="93" Body="&lt;p&gt;Hi guys need help on my project, I was stuck on this research where I am looking for knowing how long is a usual DAD. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking thru the RFC and what I got is that it has a &quot;Random Delay&quot; but there are no information on that matter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At most the prediction does not need to be 100% accurate, I need this so I can make a counter based approach on stopping the attack of DoS on DAD. My system counts the delay time and how many attempts are made then if it sees it pass the abnormal state it will mitigate the problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for sharing your answers and thougts about this&lt;/p&gt;&#xA;" OwnerUserId="6198" LastActivityDate="2014-07-21T19:38:24.813" Title="Are there ways on knowing/predecting how long/many are the delay/attempts of Duplicate Address Detection?" Tags="|ipv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10043" PostTypeId="2" ParentId="3476" CreationDate="2014-07-21T17:19:15.280" Score="0" Body="&lt;p&gt;You must statically set the media-type on the interface.  If you are using SFP port issue the &quot;media-type sfp&quot; command under the interface.  If you are using RJ45 port issue the &quot;media-type rj45&quot; command under the interface.&lt;/p&gt;&#xA;" OwnerUserId="7615" LastActivityDate="2014-07-21T17:19:15.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10045" PostTypeId="2" ParentId="10042" CreationDate="2014-07-21T19:38:24.813" Score="2" Body="&lt;p&gt;The interval between DAD attempts depends on implementation and configuration. Cisco's default is 1 second (1000ms) but that can be configured to be anything between 1000ms and 3600000ms with the &lt;code&gt;ipv6 nd dad time&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/ipv6/command/reference/ipv6_book/ipv6_07.html#wp2359130&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/ipv6/command/reference/ipv6_book/ipv6_07.html#wp2359130&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user6423" LastActivityDate="2014-07-21T19:38:24.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10047" PostTypeId="2" ParentId="6651" CreationDate="2014-07-21T22:55:28.227" Score="2" Body="&lt;p&gt;Ideally these things must match to pass VPN traffic properly:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ACLs&lt;/li&gt;&#xA;&lt;li&gt;NATs&lt;/li&gt;&#xA;&lt;li&gt;ISAKMP (or phase 1)&lt;/li&gt;&#xA;&lt;li&gt;IPSEC (or phase 2)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What you're seeing is probably that one side is encrypting traffic properly but the other side is not. That is why your ACKs are not making it past the firewall. When the firewall gets the packet on the outside interface, it doesn't know what to do with it. Typically, if your security association is formed but traffic is not flowing, it will come down to ACLs and/or NAT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To check Phase 1:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;crypto isa sa (Here you should see &quot;status active&quot;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To check Phase 2:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;crypto ips sa (Look for packets rec and send)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;to check your nat and acl:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;packet-tracer input inside tcp &lt;em&gt;YourSRCIP&lt;/em&gt; &lt;em&gt;SRCport(make it up, doesn't matter)&lt;/em&gt; &lt;em&gt;REMOTEIP&lt;/em&gt; &lt;em&gt;REMOTEPORT&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In 8.4 ASA software you have Real IP, meaning all your traffic deals with the LAN IP's of the machines. So packet tracer would like like this considering&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Your Source IP: 10.10.10.10&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Remote LAN IP: 172.20.10.10&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;packet-tracer input inside tcp 10.10.10.10 4444 172.20.10.10 80&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This will simulate a pakcet from your inside interface to 172.20.10.10. You should be able to see each step, from ACL checks, to NAT checks, to if it actually hits a crypto map on the outside interface for encapsulation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also see tunnel creation debug messages with*:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;debug crypto isa 130&lt;/li&gt;&#xA;&lt;li&gt;debug crypto ips 130&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;*careful with debug messages on production firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What it looks like right away:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your Firewall does not appear to be getting packets from the outside interface to the inside. This is evident in your top code block, lines 1 and 4 are tcp retransmissions, meaning that lines 2 and 3, the requests for the next packets, never made it to your inside end device. Also at some point I'd expect to see packets with a src and dst ip of internal networks, these packets in your post are all LAN to WAN IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This could be because the remote side is not encapsulating vpn traffic properly, or because your firewall is not handling the received traffic correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suspect that your customers end device is receiving everything correctly, but that it's replies are not being encrypted for the return travel. That would result in the return traffic not matching your NAT statement. This is basically one way vpn communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco KB has more info on these issues:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/81824-common-ipsec-trouble.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/81824-common-ipsec-trouble.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7623" LastActivityDate="2014-07-21T22:55:28.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10048" PostTypeId="5" CreationDate="2014-07-21T23:15:17.673" Score="0" Body="&lt;p&gt;Use this tag for questions about Label Distribution Protocol (LDP);  Multiprotocol Label Switching (MPLS) routers exchange label mapping information with LDP.&lt;/p&gt;&#xA;" OwnerUserId="7495" LastEditorUserId="775" LastEditDate="2014-07-22T01:13:18.803" LastActivityDate="2014-07-22T01:13:18.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10049" PostTypeId="4" CreationDate="2014-07-21T23:15:17.673" Score="0" Body="A tag for the Label Distribution Protocol (LDP), a protocol in which routers capable of Multiprotocol Label Switching (MPLS) exchange label mapping information." OwnerUserId="7495" LastEditorUserId="7495" LastEditDate="2014-07-22T01:28:42.363" LastActivityDate="2014-07-22T01:28:42.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10050" PostTypeId="2" ParentId="9952" CreationDate="2014-07-21T23:20:30.837" Score="2" Body="&lt;p&gt;In case this helps someone else I can confirm the problem was ultimately resolved by forcing a manual Sync of the PSN, no other changes were required.&lt;/p&gt;&#xA;" OwnerUserId="5120" LastActivityDate="2014-07-21T23:20:30.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10051" PostTypeId="2" ParentId="9466" CreationDate="2014-07-22T02:16:06.473" Score="10" Body="&lt;p&gt;I got response from Cisco Tech support and there are a few things not correctly described in the manual.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, ASR router supports key size 1024 bit or smaller contrary to its manual(supporting up to 2048 bit key).&lt;br&gt;&#xA;Second, only the key part of SSH public key must be 'de'coded w/ base64 en/decoding program.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;SSH Key Generation&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh-keygen -b 1024 -t rsa -f myrouter_sshkey&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will generate &lt;code&gt;myrouter_sshkey&lt;/code&gt; and &lt;code&gt;myrouter_sshkey.pub&lt;/code&gt;. When you look into the public key file, it looks like followings:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ssh-rsa&#xA;  AAAAB3NzaC1yc2EAAAADAQABAAAAgQDR/ggtknqBZ50pIAyzw0E93wfu2EsGLnft/uF6N4ov6Dsp1H7yoC5ssE+yOcrWHeDEQnD0BsNCLZPW+ye7jjYeE+CUrOINpi04PtD+zx95knpAFnREMV7w8fJ9c7/SMb2L4Jk6KlmTcqtM+lUgrxEnCD7Z1kpCUzkP+0D0N/RG2Q==&#xA;  foo@bar.com&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;We only need the second part of the public key file separated by space for base64 decoding.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;'de'code SSH public key with base64.&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cut -d&quot; &quot; -f2 myrouter_sshkey.pub | base64 -d &amp;gt; myrouter_sshkey.pub.b64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This generated file is binary format and can be imported to ASR router.&lt;br&gt;&#xA;Note that if you're using MAC, use -D option instead.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Upload 'de'coded public key to the router.&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:ASR9K#copy ftp:myrouter_sshkey.pub.b64 harddisk:/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I used ftp but you can use tftp or else.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;import public key to a router user.&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:ASR9K#admin&#xA;RP/0/RSP0/CPU0:ASR9K(admin)#crypto key import authentication rsa username admin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Verify key import&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:ASR9K(admin)#sh crypto key authentication rsa all    &#xA;Key label: admin&#xA;Type     : RSA public key authentication&#xA;Size     : 1024&#xA;Imported : 18:39:54 UTC Thu Jul 03 2014&#xA;Data     :&#xA; {{intentionally removed}}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Login test&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh -oIdentitiesOnly=yes -i myrouter_sshkey ${myrouter}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that if you have more than one ssh keys, &lt;code&gt;-oIdentitiesOnly=yes&lt;/code&gt; must be given or your connection will fail. SSH tries every keys sequentially until one of the keys is accepted or finally falls back to password authentication if applicable. SSH server may allow this multiple key trials even if the first key trial fails. Unfortunately ASR router seems not to allow this. If the first tried key fails, it disconnect the session. To explicitly specify the key you use, give &lt;code&gt;-oIdentitiesOnly=yes&lt;/code&gt; option to ssh.&lt;/p&gt;&#xA;" OwnerUserId="3285" LastActivityDate="2014-07-22T02:16:06.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10054" PostTypeId="1" CreationDate="2014-07-22T13:58:36.877" Score="4" ViewCount="752" Body="&lt;p&gt;I was wondering if it is possible to build a network that allows two subnets to be linked by wireless routers with identical network SSIDs and security protocols in such a way that a DHCP Client can switch between the two without losing any packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've heard that once upon a time there was an idea for IPv4 mobility, allowing cross-subnet roaming by relaying things through a host network, but supposedly it never caught on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible for one router (access point), to detect when a client is disconnecting using DHCP Release, and then forward any further traffic for that client out to other access points to get relayed by whichever AP has the client connected to it?&lt;/p&gt;&#xA;" OwnerUserId="1898" LastActivityDate="2014-07-26T12:10:01.613" Title="How to allow DHCP Client to switch to an identical network on a different subnet without losing TCP/IP" Tags="|router|dhcp|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10058" PostTypeId="1" AcceptedAnswerId="17094" CreationDate="2014-07-22T20:06:45.480" Score="2" ViewCount="10775" Body="&lt;p&gt;I have the firewall LAN &gt; WAN rule in place to require trusted users before allowing http, https, and dns. This allows redirecting to the login page for user authentication when the user visits &lt;a href=&quot;http://example.com&quot; rel=&quot;nofollow&quot;&gt;http://example.com&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is when a user visits &lt;a href=&quot;https://example.com&quot; rel=&quot;nofollow&quot;&gt;https://example.com&lt;/a&gt;, they are not redirected to the login page but are given a network reset error. This is causing our users to think the internet is down rather than they need to login.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I set up a rule to redirect all unauthenticated users to &lt;a href=&quot;https://login.mysonicwall&quot; rel=&quot;nofollow&quot;&gt;https://login.mysonicwall&lt;/a&gt; when they visit an https website before http?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought &lt;a href=&quot;https://www.fuzeqna.com/sonicwallkb/ext/kbdetail.aspx?kbid=10272&amp;amp;SearchType=advanced&amp;amp;referrer=&amp;amp;status=&amp;amp;rfield=&amp;amp;sortmethod=datemodified&amp;amp;usertype=&amp;amp;subcats=True&amp;amp;start=51&amp;amp;match=or&amp;amp;catid=143&amp;amp;formaction=amq&amp;amp;viewguid=08A09FAA-34B1-498F-AF9E-95EDBF539011&quot; rel=&quot;nofollow&quot;&gt;this article&lt;/a&gt; would work for https, but it did not. I do have DPI-SSL license for this Sonicwall.&lt;/p&gt;&#xA;" OwnerUserId="5081" LastActivityDate="2015-03-09T05:13:48.170" Title="Sonicwall re-direct to login page" Tags="|sonicwall|authentication|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10059" PostTypeId="2" ParentId="10058" CreationDate="2014-07-22T21:25:37.790" Score="2" Body="&lt;p&gt;HTTP and HTTPS are different protocols. Redirecting port 80 to port 443 would mean that clients are trying to talk HTTP on port 443, which fails because the server is expecting them to talk HTTPS. You need to do a redirect in HTTP using a 301 or 302 redirect code.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-07-22T21:25:37.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10061" PostTypeId="2" ParentId="10054" CreationDate="2014-07-23T00:07:42.320" Score="0" Body="&lt;p&gt;One thing that you could do is configure wifi roaming between the two APs with network AB (subnet A + subnet B) but in the first AP there's a DHCP server only for network A and in the second AP the DHCP server for network B. This way, a client would have an IP address from its network of origin and still be able to roam.&lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-07-23T00:07:42.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10065" PostTypeId="1" AcceptedAnswerId="10067" CreationDate="2014-07-23T12:32:33.653" Score="14" ViewCount="33042" Body="&lt;p&gt;I was reading DHCP ( RFC 2131 ), I have basic knowledge about Relay Agent and Broadcasting. But for Understanding DHCP in depth, I felt like I have to know Broadcasting and Relay Agent ( RFC 1542 ) in details. But could not find any RFC (RFC919,922 not much helpful) for broadcasting in details.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How broadcast packet routes ? Because if the packet is intended for a different network than source, obviously the router will drop the packet. Is there any protocols for this ? Does router prevents all broadcasting or only the Limited/Local broadcast ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can we send a packet with destination as a direct/limited broadcast IP without a broadcast MAC address ? If Yes, I think because of a perticular MAC address the packet will forward to a single Host, So the question, in which case this would be helpful.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Consider a router is enabled by relay agent. When a DHCPDiscover ( which is a broadcast packet ) comes to that router, How does it proceed ? Because first thing its a broad cast IP also the network &quot;0&quot; is there, Does always relay-agent first checks the packet if the Packet is of DHCP ? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My questions are not from a perticular subject (DHCP ond Broadcasting ), so you might be angry, But Please do help me. Thank You&lt;/p&gt;&#xA;" OwnerUserId="6218" LastEditorUserId="8499" LastEditDate="2018-12-26T04:40:45.780" LastActivityDate="2018-12-26T04:40:45.780" Title="How broadcasting works on different networks?" Tags="|routing|ip|dhcp|broadcast|rfc|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10066" PostTypeId="2" ParentId="10065" CreationDate="2014-07-23T13:59:01.037" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;A router will forward a directed broadcast, such as 192.168.1.255/24 if configured to do so.  For Cisco you can disable this behavior with 'no ip directed-broadcast' under the interface.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To get the router to forward a local broadcast, 255.255.255.255, from one interface to another you would need to bridge those two interfaces.  IE configuring either IRB or CRB and a BVI.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;This would not be possible.  The router will build a new Dst MAC address for every link it has to forward out to.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The router sees that it is a DHCP packet and sends it via unicast to the provisioned DHCP &#xA;'helper' address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is a good article that may help and give further details...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=330807&amp;amp;seqNum=9&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscopress.com/articles/article.asp?p=330807&amp;amp;seqNum=9&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&lt;/p&gt;&#xA;" OwnerUserId="3858" LastEditorUserId="3858" LastEditDate="2014-07-23T14:11:09.513" LastActivityDate="2014-07-23T14:11:09.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10067" PostTypeId="2" ParentId="10065" CreationDate="2014-07-23T14:29:10.027" Score="15" Body="&lt;p&gt;&lt;strong&gt;How Routers Handle Limited and Directed Broadcasts&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing to understand to answer your questions is that limited broadcast frames are not routed. By default when a router receives a frame with a destination address that is broadcast at either layer 2 or layer 3, the router simply drops the frame. That's why routers are said to be the boundary of broadcast domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some examples of these would be:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ff-ff-ff-ff-ff-ff&lt;/code&gt; (layer 2 broadcast)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;255.255.255.255&lt;/code&gt; (layer 3 limited broadcast)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thinking about it, this makes sense. If routers forwarded broadcasts a single arp request would reach every single reachable host on the internet which would be terribly inefficient and rather silly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Directed broadcasts on the other hand are sometimes routed. (I.E. &lt;code&gt;192.168.1.255/24&lt;/code&gt;) Normally by default this functionality is disabled but can be enabled by issuing the &lt;code&gt;ip directed-broadcast&lt;/code&gt; command on the router. This will allow it to forward directed broadcasts according to its routing table as if they were normal packets. This does &lt;em&gt;not&lt;/em&gt; however allow the router to forward limited broadcasts, those are still blocked by default. This is also slightly off topic as to your original question, see &lt;a href=&quot;https://supportforums.cisco.com/discussion/10283586/command-no-ip-directed-broadcast&quot;&gt;this cisco forms page&lt;/a&gt; for more on this.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Layer 3 Broadcast But not Layer 2?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your second question, it would make no sense to have a frame with a layer 3 broadcast address without a layer 2 broadcast address. This would defeat the entire purpose of it being a broadcast frame and just not work outright. Having a unicast layer 2 destination address would not change the router's behavior at all since the router makes its decisions at layer 3. All the router cares about is that &lt;code&gt;255.255.255.255&lt;/code&gt; destination address and drops the packet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where this would matter is with switches which don't care about the layer 3 address at all. The switches would only see the unicast layer 2 address. Instead of sending the packet out all interfaces on the same vlan it would use the source address table (SAT) like it would with any other unicast destination address. In effect, by assigning a unicast layer 2 address the frame is no longer a broadcast frame at all even though it has the &lt;code&gt;255.255.255.255&lt;/code&gt; address at layer 3.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How DHCP Relay Works in Practice&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your last question, DHCP relay is a router's way of &quot;cheating&quot; around the rule about not forwarding broadcast packets. Let's look at a DHCP Discover packet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source MAC: [unicast mac of the source]&lt;/li&gt;&#xA;&lt;li&gt;Dest MAC: &lt;code&gt;ff-ff-ff-ff-ff-ff&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Source IP: &lt;code&gt;0.0.0.0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Destination IP: &lt;code&gt;255.255.255.255&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Source Port: UDP 68&lt;/li&gt;&#xA;&lt;li&gt;Destination Port: UDP 67&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When the router sees a packet arrive on an interface with the &lt;code&gt;ip helper-address&lt;/code&gt; command configured it checks to see is it matches any of the protocols that are &quot;helped&quot; by default or configured with the global &lt;code&gt;ip forward-protocol&lt;/code&gt; command. In this case because it's DHCP the router sees that the destination port matches UDP 67 and allows the packet to be &quot;helped&quot;. The router then changes the destination IP address from &lt;code&gt;255.255.255.255&lt;/code&gt; to the IP address configured by the &lt;code&gt;ip helper-address&lt;/code&gt; command as well as changing the source address to the address of the router interface on which the packet arrived and passes the packet along to the rest of the routing logic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that the packet has a unicast destination address the router treats it like any other packet. It arps for the destination IP address (which is now that helper address) and then replaces the layer 2 addresses before sending the packet out the appropriate interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Getting Back Again&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router uses essentially the same process in reverse for the DHCP offer that is sent back to the client. The DHCP servers sends the offer to the IP address that was specified as the source address on the DHCP Discover packet. So the packet leaving the DHCP server looks like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source MAC: unicast mac of the DHCP server&lt;/li&gt;&#xA;&lt;li&gt;Dest MAC: mac address of the router &lt;strong&gt;or&lt;/strong&gt; the DHCP server's default gateway&lt;/li&gt;&#xA;&lt;li&gt;Source IP: unicast IP address of the DHCP server&lt;/li&gt;&#xA;&lt;li&gt;Destination IP: ip address of the first router interface that the DHCP Discover packet reached&lt;/li&gt;&#xA;&lt;li&gt;Source Port: UDP 67&lt;/li&gt;&#xA;&lt;li&gt;Destination Port: UDP 68&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since this packet has a unicast layer 3 destination address routers will forward the packet normally until it reaches the router with an interface that has an IP address matching the destination IP of the packet. Remember from earlier that this router has the &lt;code&gt;ip helper-address&lt;/code&gt; configuration on that interface still. The router checks if the packet is a DHCP Offer then rewrites the packet to become a broadcast packet and sends it back out that interface knowing that the DHCP client is somewhere on that network segment. The packet leaving the router now looks like this.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source MAC: unicast mac of the router interface&lt;/li&gt;&#xA;&lt;li&gt;Dest MAC: &lt;code&gt;ff-ff-ff-ff-ff-ff&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Source IP: unicast IP address of the DHCP server&lt;/li&gt;&#xA;&lt;li&gt;Destination IP: &lt;code&gt;255.255.255.255&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Source Port: UDP 67&lt;/li&gt;&#xA;&lt;li&gt;Destination Port: UDP 68&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL:DR;&lt;/strong&gt; DHCP relay using the &lt;code&gt;ip helper-address&lt;/code&gt; interface subcommand &quot;cheats&quot; around the rule that routers cannot forward limited broadcasts by changing the packet's destination IP address to the unicast IP address of the DHCP server before routing it. This allows all routers down the line to route the packet appropriately to the DHCP server. When replying the DHCP server sends the packet back to the unicast IP address of the router interface that first received the DHCP Discover packet (the one with the &lt;code&gt;ip helper-interface&lt;/code&gt; command). When the router receives the offer back it converts it back to a broadcast packet and sends it out the interface with the client in its broadcast domain.&lt;/p&gt;&#xA;" OwnerUserId="5613" LastEditorUserId="5613" LastEditDate="2014-07-23T14:43:58.027" LastActivityDate="2014-07-23T14:43:58.027" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10068" PostTypeId="2" ParentId="9689" CreationDate="2014-07-23T14:46:46.970" Score="1" Body="&lt;p&gt;For RTP traffic common way to solve NAT is:&#xA;server announce public ip and port for current call and just wait for first RTP packet arrived to this ip&amp;amp;port from client. after that server starts send RTP traffic to source ip and port of arrived packet (not to source ip|local| and port announced by NATed client)&lt;/p&gt;&#xA;" OwnerUserId="7643" LastActivityDate="2014-07-23T14:46:46.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10069" PostTypeId="2" ParentId="5482" CreationDate="2014-07-23T14:56:52.950" Score="0" Body="&lt;p&gt;If you have no voice quality problems, how will you notice, that QoS was really enabled and working?&#xA;If you have some voice quality problems, you have to investigate them at first.&#xA;Voip can exists with any other data in one network without QoS enabled in many cases.&lt;/p&gt;&#xA;" OwnerUserId="7643" LastActivityDate="2014-07-23T14:56:52.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10070" PostTypeId="1" AcceptedAnswerId="10072" CreationDate="2014-07-23T15:04:52.987" Score="2" ViewCount="1248" Body="&lt;p&gt;I'm wanting to look into designing and implementing a fiber optic network. But I've never done anything with it before, I've never even seen any fiber network actually working either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've designed and implemented several small business ethernet networks, so I'm familiar with networking and the concepts, I just don't know where to begin learning about fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been given a bag of tools that are for making ends on the cables, but I have no understanding of the details of what it takes to setup a network or what the spec ranges are and such.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Do switches and routers exist for Fiber Optic network and do they serve the same functions?&lt;/li&gt;&#xA;&lt;li&gt;What are the basic categories of Fiber Optic network speed specifications?&lt;/li&gt;&#xA;&lt;li&gt;What system is suggested for streaming HD video for editing (my footage is 12-24mbps)?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="7644" LastEditorUserId="775" LastEditDate="2014-12-08T12:48:59.743" LastActivityDate="2015-07-04T11:42:35.303" Title="The Basics of Fiber Optics" Tags="|design|fiber|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10072" PostTypeId="2" ParentId="10070" CreationDate="2014-07-23T15:39:48.067" Score="8" Body="&lt;p&gt;Ethernet over fiber works the same as Ethernet over copper wire (for the most part), so the networking configuration will essentially be the same.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you mention a bag of tools -- you should know that the tolerances for fiber connecters are way more strict than RJ45 connectors.  Fiber ends need to be cut a certain way, cleaned, polished to remove microscopic flaws, etc.  That is a skill that takes training and practice to do it right. And if you do it wrong, you will spend a lot of time troubleshooting.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-07-23T15:39:48.067" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10073" PostTypeId="1" AcceptedAnswerId="10075" CreationDate="2014-07-23T16:01:53.313" Score="27" ViewCount="34347" Body="&lt;p&gt;I am unsure what the following networking tools do. They all seem to do a similar thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First some background. I am familiar with cisco IOS. I am doing some linux networking experimentation with virtual machines so I am trying to create a small virtual network. I started playing with virtual interfaces (tun/tap, loop br etc) and I'd like to be able to examine the traffic going through them for debug purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a bit unsure of what tool to use. I know of the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;tshark (wireshark)&lt;/li&gt;&#xA;&lt;li&gt;dumpcap&lt;/li&gt;&#xA;&lt;li&gt;tcpdump&lt;/li&gt;&#xA;&lt;li&gt;ettercap&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I think tshark/wireshark uses dumpcap underneath. ettercap seems to be a man-in-the-middle attack tool. Which tool (others not listed included) would you use to debug an interface?&lt;/p&gt;&#xA;" OwnerUserId="2986" LastEditorUserId="8499" LastEditDate="2020-12-11T23:33:55.473" LastActivityDate="2020-12-11T23:33:55.473" Title="Difference between sniffer tools" Tags="|wireshark|pcap|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10075" PostTypeId="2" ParentId="10073" CreationDate="2014-07-23T16:35:20.340" Score="30" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;wireshark - powerfull sniffer which can decode lots of protocols, lots of filters.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;tshark - command line version of wireshark &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;dumpcap (part of wireshark) - can only capture traffic and can be used by wireshark / tshark&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;tcpdump - limited protocol decoding but available on most *NIX platforms&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ettercap - used for injecting traffic not sniffing&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All tools use libpcap (on windows winpcap) for sniffing. Wireshark/tshark /dumpcap can use tcpdump filter syntax as capture filter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As tcpdump is available on most *NIX system I usually use tcpdump. Depending on the problem I sometimes use tcpdump to capture traffic and write it to a file, and then later use wireshark to analyze it. If available, I use tshark but if the problem gets more complicated I still like to write the data to a file and then use Wireshark for analysis.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="3024" LastEditDate="2017-11-14T14:51:21.940" LastActivityDate="2017-11-14T14:51:21.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10078" PostTypeId="1" AcceptedAnswerId="10080" CreationDate="2014-07-23T17:46:51.333" Score="2" ViewCount="872" Body="&lt;p&gt;Are the filters &lt;code&gt;http.host != &quot;&quot;&lt;/code&gt; and &lt;code&gt;http.host&lt;/code&gt; the same? The first one makes the filter text edit turn yellow (suggesting I may get undesirable results) whereas the second passes the syntax check fine. They seem to produce the same output.&lt;/p&gt;&#xA;" OwnerUserId="7646" LastActivityDate="2014-07-23T18:16:29.770" Title="Wireshark http filter question" Tags="|wireshark|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10079" PostTypeId="2" ParentId="10078" CreationDate="2014-07-23T18:08:47.013" Score="2" Body="&lt;p&gt;&lt;em&gt;http.host&lt;/em&gt; - show all packets where http.host is set&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;http.host != &quot;&quot;&lt;/em&gt; -show all packets is set and not an empty string&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-07-23T18:08:47.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10080" PostTypeId="2" ParentId="10078" CreationDate="2014-07-23T18:16:29.770" Score="4" Body="&lt;p&gt;The use of the NOT (!=) operator in Wireshark comes with a caveat, as mentioned in the &#xA;&lt;a href=&quot;http://www.wireshark.org/docs/wsug_html_chunked/ChWorkBuildDisplayFilterSection.html&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;6.4.4. A common mistake&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Warning! Using the != operator on combined expressions like: eth.addr,&#xA;  ip.addr, tcp.port, udp.port and alike will probably not work as&#xA;  expected!&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Often people use a filter string to display something like ip.addr ==&#xA;  1.2.3.4 which will display all packets containing the IP address 1.2.3.4.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Then they use ip.addr != 1.2.3.4 to see all packets not containing the&#xA;  IP address 1.2.3.4 in it. Unfortunately, this does not do the&#xA;  expected.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Instead, that expression will even be true for packets where either&#xA;  source or destination IP address equals 1.2.3.4. The reason for this,&#xA;  is that the expression ip.addr != 1.2.3.4 must be read as &quot;the packet&#xA;  contains a field named ip.addr with a value different from 1.2.3.4&quot;.&#xA;  As an IP datagram contains both a source and a destination address,&#xA;  the expression will evaluate to true whenever at least one of the two&#xA;  addresses differs from 1.2.3.4.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If you want to filter out all packets containing IP datagrams to or&#xA;  from IP address 1.2.3.4, then the correct filter is !(ip.addr ==&#xA;  1.2.3.4) as it reads &quot;show me all the packets for which it is not true that a field named ip.addr exists with a value of 1.2.3.4&quot;, or in&#xA;  other words, &quot;filter out all packets for which there are no&#xA;  occurrences of a field named ip.addr with the value 1.2.3.4&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It might be that for your specific filter at hand, the current capture are displaying the same results, but it might give you a different result with a different capture&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;http.host&quot; means any packet which have HTTP hosts&#xA;&quot;http.host != &quot;&quot; &quot; means any packet which http.hosts isn't empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How will the second one react if you do not have http.host at all (ie: non-http traffic?)  you might want to check that&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-07-23T18:16:29.770" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10081" PostTypeId="2" ParentId="10073" CreationDate="2014-07-23T18:32:38.353" Score="2" Body="&lt;p&gt;What do you mean by &quot;debug an interface&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark &amp;amp; Co. will not help you troubleshoot an Interface problem, but will help you troubleshoot connection/traffic/protocol/payload problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to troubleshoot that, the best way is to have a PC not involved in the traffic you want to troubleshoot connected to the same Cisco switch and span the port you want to capture toward that PC/laptop (Note that very highly utilized link might get you packet drops on laptop/pc with low-end cards if Gig-Ethernet is used)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ex: (taken from 3750 running 12.2.x)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;monitor session 1 source interface Gi1/0/10 both&#xA;monitor session 1 destination interface Gi1/0/11 encapsulation replicate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are many other options, everything is in the documentation for your platform &amp;amp; IOS version&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that some platform (those running IOS-XE, at least some 6509 and maybe others) have Integrated sniffers (actually a version of Wireshark).  Actual capability varies from version to version, but I was able to capture traffic on an 8mb circular buffer and import it without problems into a full fledged Wireshark)&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-07-23T18:32:38.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10082" PostTypeId="1" AcceptedAnswerId="10129" CreationDate="2014-07-23T19:38:58.583" Score="3" ViewCount="1119" Body="&lt;p&gt;Some people say that I should stay away from the N9K if I'm not planning to use ACI. Cisco stats that it has 50% less code. Do you guys have any practical experience with deploying N9K switches? I'm eyeing the 9396PX as this has been recommended by our Cisco technical contact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Originally I've been eyeing the 5672UP, and I'm wondering what I'm missing out on if I go with the N5K instead of the N9K?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The features I need are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;48x10GbE ports&lt;/li&gt;&#xA;&lt;li&gt;&gt;= 4x40GbE ports&lt;/li&gt;&#xA;&lt;li&gt;vPC&lt;/li&gt;&#xA;&lt;li&gt;VRRP/HSRP support so I can do the default gateways on these devices&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;FEX support is on the &quot;would be nice to have&quot; list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea is that each server will use LACP and use one physical link per switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="7647" LastActivityDate="2014-07-26T08:02:32.347" Title="Cisco N9K without ACI? Or am I better off with N5K?" Tags="|cisco|switch|cisco-nexus-5k|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10085" PostTypeId="2" ParentId="10054" CreationDate="2014-07-24T01:27:26.333" Score="4" Body="&lt;p&gt;Not with different subnets, no.  You can use the same subnet, same VLAN, and same SSID on both APs and you'll be able to roam between them.  If you try to use a new subnet, the client will need a new IP address or you'll risk duplicate IPs when they roam, plus you'd need some crazy NAT or VRF setup to talk from one side to another.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-07-24T01:27:26.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10086" PostTypeId="2" ParentId="382" CreationDate="2014-07-24T03:16:01.913" Score="5" Body="&lt;p&gt;negotiation of the control-word between the BGP VPLS PE routers is added in Juniper MX series starting from &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos14.1/topics/task/configuration/vpls-bgp-control-word-configuring.html&quot; rel=&quot;nofollow&quot;&gt;Junos 14.1&lt;/a&gt;. so only BGP-signaled VPLS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BR&lt;/p&gt;&#xA;" OwnerUserId="7653" LastEditorUserId="59" LastEditDate="2014-07-24T15:31:39.010" LastActivityDate="2014-07-24T15:31:39.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10087" PostTypeId="1" AcceptedAnswerId="10098" CreationDate="2014-07-24T04:37:34.197" Score="5" ViewCount="1562" Body="&lt;p&gt;I have inherited a network. I have 12 separate sites, all of which have at least 10 vlans. Each site is it's own VTP domain. I have an MPLS ethernet handoff into a switch at each site. From each switch, I have trunks distributing vlans to the other access switches.I have some switches where all vlans are distributed but I have no member ports.&#xA;If I understand the concept correctly, if I have vlans on switch A and B, but no member ports on C, VTP pruning removes the unneeded vlans from C thus reducing bandwidth usage on the trunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual question is: do I have any reason NOT to use VTP Pruning?&lt;/p&gt;&#xA;" OwnerUserId="1068" LastActivityDate="2014-07-24T16:13:09.590" Title="Any reason NOT to use VTP Pruning" Tags="|vlan|cisco-ios|vtp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10089" PostTypeId="1" CreationDate="2014-07-24T08:02:56.963" Score="1" ViewCount="2770" Body="&lt;p&gt;I try to establish a vpn connection but i get this error&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382&#xA;IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.&#xA;Jul 24 07:48:48 [IKE COMMON DEBUG]Tunnel Manager dispatching a KEY_ACQUIRE message to IKEv1.  Map Tag = outside_map.  Map Sequence Number = 10.&#xA;IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382&#xA;IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.&#xA;IPSEC: Received a PFKey message from IKE&#xA;IPSEC: Parsing PFKey GETSPI message&#xA;IPSEC: Creating IPsec SA&#xA;IPSEC: Getting the inbound SPI&#xA;IPSEC: New embryonic SA created @ 0x00007fffa34cbde0,&#xA;    SCB: 0xA34AFFC0,&#xA;    Direction: inbound&#xA;    SPI      : 0xBA3132F1&#xA;    Session ID: 0x00A82000&#xA;    VPIF num  : 0x00000002&#xA;    Tunnel type: l2l&#xA;    Protocol   : esp&#xA;    Lifetime   : 240 seconds&#xA;IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382&#xA;IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.&#xA;Jul 24 07:48:49 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager&#xA;IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382&#xA;IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.&#xA;Jul 24 07:48:50 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager&#xA;IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382&#xA;IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.&#xA;Jul 24 07:48:51 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager&#xA;IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.10, sport=13382, daddr=192.168.128.112, dport=13382&#xA;IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.&#xA;Jul 24 07:48:52 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager&#xA;Jul 24 07:49:21 [IKE COMMON DEBUG]IKEv1 was unsuccessful at setting up a tunnel.  Map Tag = outside_map.  Map Sequence Number = 10.&#xA;Jul 24 07:49:21 [IKE COMMON DEBUG]Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions failed to establish the tunnel. Map Tag= outside_map.  Map Sequence Number = 10.&#xA;Jul 24 07:49:21 [IKE COMMON DEBUG]Tunnel Manager Removed entry.  Map Tag = outside_map.  Map Sequence Number = 10.&#xA;IPSEC: Received a PFKey message from IKE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;THIS IS MY CONFIG&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FW-VPN-IPS# show running-config&#xA;: Saved&#xA;:&#xA;ASA Version 8.6(1)2&#xA;!&#xA;hostname FW-VPN&#xA;domain-name ASAASA&#xA;enable password GTu5JQH2TaCdw/WE encrypted&#xA;passwd 2KFQnbNIdI.2KYOU encrypted&#xA;names&#xA;!&#xA;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 192.168.1.2 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.0.100.254 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/2&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/4&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/5&#xA; shutdown&#xA; no nameif&#xA; security-level 100&#xA; no ip address&#xA;!&#xA;interface Management0/0&#xA; nameif management&#xA; security-level 100&#xA; ip address 192.168.3.1 255.255.255.0&#xA; management-only&#xA;!&#xA;boot system disk0:/asa861-2-smp-k8.bin&#xA;ftp mode passive&#xA;dns server-group DefaultDNS&#xA; domain-name asaasa&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network Remote-ASA&#xA; host 217.X.X.X&#xA;object network RA-VPN-local&#xA; subnet 10.0.100.0 255.255.255.0&#xA;object network Remote-servers&#xA; host 192.168.128.112&#xA;access-list Security-ACL extended permit ip 10.0.100.0 255.255.255.0 host 192.168.128.112&#xA;access-list Security-ACL extended permit ip host 192.168.128.112 10.0.100.0 255.255.255.0&#xA;access-list Interesting-traffic extended permit ip 10.0.100.0 255.255.255.0 host 192.168.128.112&#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;mtu management 1500&#xA;icmp unreachable rate-limit 10 burst-size 10&#xA;icmp permit any outside&#xA;icmp permit any inside&#xA;asdm image disk0:/asdm-66114.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;nat (outside,outside) source static RA-VPN-local RA-VPN-local destination static Remote-servers Remote-servers no-proxy-arp route-lookup&#xA;route outside 0.0.0.0 0.0.0.0 192.168.1.1 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL&#xA;http server enable&#xA;http 192.168.0.0 255.255.255.0 inside&#xA;http 192.168.3.0 255.255.255.0 management&#xA;http 0.0.0.0 0.0.0.0 outside&#xA;http 10.0.100.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set TRANS1 esp-3des esp-sha-hmac&#xA;crypto ipsec ikev2 ipsec-proposal 3DES-SHA&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal DES&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES192&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal secure&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1&#xA;crypto map OUTSIDE_map 10 set security-association lifetime seconds 28800&#xA;crypto map map002 3 match address Interesting-traffic&#xA;crypto map map002 3 set peer 217.X.X.X&#xA;crypto map map002 3 set ikev2 ipsec-proposal 3DES-SHA&#xA;crypto map outside_map 10 match address Interesting-traffic&#xA;crypto map outside_map 10 set pfs&#xA;crypto map outside_map 10 set peer 217.X.X.X&#xA;crypto map outside_map 10 set ikev1 transform-set ESP-3DES-SHA&#xA;crypto map outside_map 10 set ikev2 ipsec-proposal 3DES-SHA DES 3DES AES AES192 AES256 secure&#xA;crypto map outside_map interface outside&#xA;crypto isakmp identity address&#xA;crypto isakmp disconnect-notify&#xA;crypto ikev2 policy 1&#xA; encryption 3des&#xA; integrity sha&#xA; group 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 enable inside&#xA;crypto ikev1 policy 1&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh 192.168.0.0 255.255.255.0 outside&#xA;ssh 0.0.0.0 0.0.0.0 outside&#xA;ssh 192.168.0.0 255.255.255.0 inside&#xA;ssh 192.168.3.0 255.255.255.0 inside&#xA;ssh 10.0.100.0 255.255.255.0 inside&#xA;ssh 192.168.3.0 255.255.255.0 management&#xA;ssh timeout 5&#xA;ssh version 2&#xA;console timeout 0&#xA;no threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-tunnel-protocol ssl-clientless&#xA;group-policy RA-VPN-Group internal&#xA;group-policy RA-VPN-Group attributes&#xA; vpn-filter value Security-ACL&#xA; vpn-tunnel-protocol ikev1&#xA; pfs enable&#xA;group-policy L2L-policy internal&#xA;group-policy L2L-policy attributes&#xA; vpn-filter value Security-ACL&#xA; vpn-tunnel-protocol ikev2&#xA;username cisco password XXXXXXXXX encrypted&#xA;tunnel-group DefaultL2LGroup ipsec-attributes&#xA; isakmp keepalive disable&#xA;tunnel-group 217.X.X.X type ipsec-l2l&#xA;tunnel-group 217.X.X.X general-attributes&#xA; default-group-policy L2L-policy&#xA;tunnel-group 217.X.X.X ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; isakmp keepalive disable&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;no tunnel-group-map enable ou&#xA;tunnel-group-map default-group 217.X.X.X&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc&#xA;  inspect xdmcp&#xA;  inspect sip&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect ip-options&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7655" LastEditorUserId="775" LastEditDate="2014-07-24T08:54:57.357" LastActivityDate="2014-07-24T08:54:57.357" Title="Problem Site to Site VPN ASA 5512 8.6.1" Tags="|cisco-asa|vpn|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10090" PostTypeId="1" CreationDate="2014-07-24T08:27:08.820" Score="5" ViewCount="11812" Body="&lt;p&gt;I am receiving this error when I try to establish an ipsec site to site vpn:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PSEC: Parsing PFKey GETSPI message&#xA;IPSEC: Creating IPsec SA&#xA;IPSEC: Getting the inbound SPI&#xA;IPSEC: New embryonic SA created @ 0x00007fffa372dc60,&#xA;    SCB: 0x9C3EF830,&#xA;    Direction: inbound&#xA;    SPI      : 0x17951BCF&#xA;    Session ID: 0x00AA2000&#xA;    VPIF num  : 0x00000002&#xA;    Tunnel type: l2l&#xA;    Protocol   : esp&#xA;    Lifetime   : 240 seconds&#xA;&#xA;IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, &#xA;saddr=10.0.100.2, sport=45638, daddr=192.168.120.100, dport=45638&#xA;&#xA;IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.&#xA;Jul 24 08:20:49 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager&#xA;&#xA;IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.2, sport=45638, daddr=192.168.120.100, dport=45638&#xA;&#xA;IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.&#xA;Jul 24 08:20:50 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager&#xA;&#xA;IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.2, sport=45638, daddr=192.168.120.100, dport=45638&#xA;&#xA;IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.&#xA;Jul 24 08:20:51 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager&#xA;&#xA;IPSEC(crypto_map_check)-3: Looking for crypto map matching 5-tuple: Prot=1, saddr=10.0.100.2, sport=45638, daddr=192.168.120.100, dport=45638&#xA;&#xA;IPSEC(crypto_map_check)-3: Checking crypto map outside_map 10: matched.&#xA;Jul 24 08:20:52 [IKE COMMON DEBUG]Duplicate entry already in Tunnel Manager&#xA;&#xA;Jul 24 08:21:20 [IKE COMMON DEBUG]IKEv1 was unsuccessful at setting up a tunnel.  Map Tag = outside_map.  Map Sequence Number = 10.&#xA;&#xA;Jul 24 08:21:20 [IKE COMMON DEBUG]Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions failed to establish the tunnel. Map Tag= outside_map.  Map Sequence Number = 10.&#xA;&#xA;Jul 24 08:21:20 [IKE COMMON DEBUG]Tunnel Manager Removed entry.  Map Tag = outside_map.  Map Sequence Number = 10.&#xA;&#xA;IPSEC: Received a PFKey message from IKE&#xA;&#xA;IPSEC: Destroy current inbound SPI: 0x17951BCF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;it never reaches &lt;code&gt;Phase 1 succeed&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FWASA(config)# show isakmp sa&#xA;&#xA;IKEv1 SAs:&#xA;&#xA;   Active SA: 1&#xA;    Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)&#xA;Total IKE SA: 1&#xA;&#xA;1   IKE Peer: 217.117.146.118&#xA;    Type    : L2L             Role    : initiator&#xA;    Rekey   : no              State   : MM_ACTIVE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I resolve this problem?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;this is my config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 8.6(1)2&#xA;!&#xA;hostname FW-VPN-IPS&#xA;domain-name name.sn&#xA;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 192.168.1.2 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.0.100.254 255.255.255.0&#xA;!&#xA;boot system disk0:/asa861-2-smp-k8.bin&#xA;ftp mode passive&#xA;dns server-group DefaultDNS&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network Remote-ASA&#xA; host 217.X.X.X&#xA;object network RA-VPN-local&#xA; subnet 10.0.100.0 255.255.255.0&#xA; object network Remote-servers&#xA; host 192.168.120.100&#xA;access-list Security-ACL extended permit ip 10.0.100.0 255.255.255.0 host 192.168.120.100&#xA;access-list Security-ACL extended permit ip host 192.168.120.100 10.0.100.0 255.255.255.0&#xA;access-list Interesting-traffic extended permit ip 10.0.100.0 255.255.255.0 host 192.168.120.100&#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;mtu management 1500&#xA;icmp unreachable rate-limit 10 burst-size 10&#xA;icmp permit any outside&#xA;icmp permit any inside&#xA;asdm image disk0:/asdm-66114.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;nat (outside,outside) source static RA-VPN-local RA-VPN-local destination static Remote-servers Remote-servers no-proxy-arp route-lookup&#xA;route outside 0.0.0.0 0.0.0.0 192.168.1.1 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set TRANS1 esp-3des esp-sha-hmac&#xA;crypto ipsec ikev2 ipsec-proposal 3DES-SHA&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal DES&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES192&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal secure&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1&#xA;crypto map OUTSIDE_map 10 set security-association lifetime seconds 28800&#xA;crypto map map002 3 match address Interesting-traffic&#xA;crypto map map002 3 set peer 217.X.X.X&#xA;crypto map map002 3 set ikev2 ipsec-proposal 3DES-SHA&#xA;crypto map outside_map 10 match address Interesting-traffic&#xA;crypto map outside_map 10 set pfs&#xA;crypto map outside_map 10 set peer 217.X.X.X&#xA;crypto map outside_map 10 set ikev1 transform-set ESP-3DES-SHA&#xA;crypto map outside_map 10 set ikev2 ipsec-proposal 3DES-SHA DES 3DES AES AES192 AES256&#xA;secure&#xA;crypto map outside_map interface outside&#xA;crypto isakmp identity address&#xA;crypto isakmp disconnect-notify&#xA;crypto ikev2 policy 1&#xA; encryption 3des&#xA; integrity sha&#xA; group 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 enable inside&#xA;crypto ikev1 policy 1&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;console timeout 0&#xA;no threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-tunnel-protocol ssl-clientless&#xA;group-policy RA-VPN-Group internal&#xA;group-policy RA-VPN-Group attributes&#xA; vpn-filter value Security-ACL&#xA; vpn-tunnel-protocol ikev1&#xA; pfs enable&#xA;group-policy L2L-policy internal&#xA;group-policy L2L-policy attributes&#xA; vpn-filter value Security-ACL&#xA; vpn-tunnel-protocol ikev2&#xA;tunnel-group DefaultL2LGroup ipsec-attributes&#xA; isakmp keepalive disable&#xA;tunnel-group 217.X.X.X type ipsec-l2l&#xA;tunnel-group 217.X.X.X general-attributes&#xA; default-group-policy L2L-policy&#xA;tunnel-group 217.X.X.X ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; isakmp keepalive disable&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;no tunnel-group-map enable ou&#xA;tunnel-group-map default-group 217.X.X.X&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7655" LastEditorUserId="775" LastEditDate="2014-07-24T08:50:20.767" LastActivityDate="2014-07-24T12:16:46.360" Title="Problem ipsec site to site ASA" Tags="|cisco-asa|firewall|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10092" PostTypeId="2" ParentId="10087" CreationDate="2014-07-24T11:01:36.167" Score="4" Body="&lt;p&gt;Not exactly a reason not to use VTP pruning but just a few attention points:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If running version 1, transparent mode will disable forwarding of VTP packets, hence making all downstream switches outside of your VTP domain and unaware of VLANs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're running version 2, a switch in transparent mode will forward every VTP packet if the switch is set to NULL domain. If the domain name on the switch is set, it will forward packets only for this domain. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most importantly: be really cautious about used equipment! When you use the &quot;write erase&quot; command to wipe your new-used equipment, it doesn't erase VLAN information, then if you plug it in your network and start to configure VTP, bad things might happen. If it had a bigger revision number than you have on your network, its VLAN information will now be flooded to all your switches. This will happen even if set to null domain, because when in server or client mode, the first non-null domain packet that arrives determine the new VTP domain and then it will flood its VLANs and disrupt your network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I would say it's a really good protocol which will save you some time if used wisely. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: sorry. I misread this question as regarding VTP and not only VTP pruning and I'm not able to delete my answer :(&lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-07-24T11:01:36.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10093" PostTypeId="2" ParentId="10070" CreationDate="2014-07-24T11:19:49.270" Score="2" Body="&lt;p&gt;Switches and routers with fiber do exist and most of the time you would have an equipment with a SFP (or other form factor) that you would plug a fiber or Copper interface, depending on your need. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding speed specification, I find that most of the speed is done by the interface itself and not the fiber. You have 1gbps copper or fiber, 10gbps fiber, and over. I never seen a SFP over 10gbps, it's usually a new standard called SFP+. At least for 1 and 10gbps, the fiber is the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't know how the fiber should be for a DWDM (where you take multiple wave lengths in the same fiber). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also have different interfaces depending on the distance of the fiber, as I have seen: 0.3 km, 1km, 10km, 40km and 80km. Both sides must match, otherwise the shorter range side will get burn by the power received by the other end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/V3saQ.jpg&quot; alt=&quot;router with fiber and copper&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Blue cables to your right are copper, orange fiber are multi mode, usually for cabling on a single location. Blue fiber is single mode, for connecting different locations. &lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-07-24T11:19:49.270" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="10094" PostTypeId="1" CreationDate="2014-07-24T11:25:56.990" Score="3" ViewCount="661" Body="&lt;p&gt;I know that subnetting helps in dividing the internet part and physical address + host part.&lt;/p&gt;&#xA;&lt;p&gt;Like, a class C prefix uses 3 octets for network part and one octet for the host part. I'm reading this book and they keep referring that subnets are used in the internet.&lt;/p&gt;&#xA;&lt;p&gt;But how do the router happen to change the last part of the public IP address to send request for a particular host in the local network?&lt;/p&gt;&#xA;&lt;p&gt;Does the router have control over the last octet to change it by itself? Or is the subnetting technology used for local network only?&lt;/p&gt;&#xA;&lt;p&gt;And does the ISP have any control over how we use subnet? Like my public IP is 49.244.218.112. Does it change the last part 112 (if it were using Class C) for different hosts in a network?&lt;/p&gt;&#xA;" OwnerUserId="7658" LastEditorUserId="38824" LastEditDate="2022-12-20T18:55:39.843" LastActivityDate="2022-12-21T04:32:40.213" Title="Subnetting is used in global or local IP address?" Tags="|subnet|" AnswerCount="6" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="10095" PostTypeId="2" ParentId="10094" CreationDate="2014-07-24T11:34:46.107" Score="5" Body="&lt;p&gt;Just continue reading. Both global and local IP networks can be subneted.&#xA;Network Address Translation (NAT) is used to translate local IP into public.&lt;/p&gt;&#xA;" OwnerUserId="7630" LastActivityDate="2014-07-24T11:34:46.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10098" PostTypeId="2" ParentId="10087" CreationDate="2014-07-24T16:13:09.590" Score="3" Body="&lt;p&gt;The short answer is 'no' there is no downside to VTP pruning that I'm aware of.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;@Pedro Brito gives some good background on the operation and gotcha's of VTP.  Since you are using site specific VTP domains the risk of revision number issues is lessened.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would just add to be very specific which switches are your VTP servers at each site and set the rest to client.  I usually make the spanning-tree primary and secondary root bridges also the VTP servers.&lt;/p&gt;&#xA;" OwnerUserId="266" LastActivityDate="2014-07-24T16:13:09.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10099" PostTypeId="2" ParentId="10094" CreationDate="2014-07-24T17:33:54.773" Score="3" Body="&lt;p&gt;When talking about your specific address, you're talking about a /32. Your network might be in any subnet your ISP sees fit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: 49.244.0.0/16 is the network as received by your ISP from its local IP authority. They might divide it further for different routers, CMTS, dslam or whatever your technology uses, so let's say you receive your 49.244.218.112 in the subnet /20. An internet router might have in his table the full network as 49.244.0.0/16 in its table, but then it need to forward packets to your address, a specific /32, so he thinks: if I take the first 16 bits of this address will it match this 49.244.0.0? If yes, it forwards your packet to &quot;network 49.244.0.0&quot;. As the packet reach your ISP network, /16 is not enough anymore, so your ISP router looks for the network 49.244.208.0/20, which is the network address for the network your address is in. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It maches ones and zeros, from left to right, that's why 49.244.208.0 is the network address of 49.244.218.112/20, even if the third octet is not the same. Very confusing at first. Keep practicing and you'll get the hang of it. &lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-07-24T17:33:54.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10102" PostTypeId="2" ParentId="2939" CreationDate="2014-07-24T18:07:25.080" Score="0" Body="&lt;p&gt;Related to what AdnanG said, check the firmware version on your switch. I have an SG300-28P, running version 1.3.7.18, and I see the &quot;SSL Server | SSL Server Authentication Settings&quot; section exactly where the manual says it should be.&lt;/p&gt;&#xA;" OwnerUserId="7662" LastActivityDate="2014-07-24T18:07:25.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10103" PostTypeId="2" ParentId="7297" CreationDate="2014-07-24T19:37:39.227" Score="0" Body="&lt;p&gt;You're getting the error because you're using 10m instead of 10M. Try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iperf -c 192.168.1.15  -b 10M -l 32k -w 128k&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-07-24T19:37:39.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10105" PostTypeId="2" ParentId="8281" CreationDate="2014-07-24T21:10:46.580" Score="0" Body="&lt;p&gt;Change your user privileges:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;local-user &amp;lt;username&amp;gt;&#xA;authorization-attribute level 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way, when you log in the switch, you'll be already logged in as &quot;super&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://h17007.www1.hp.com/device_help/H3C-Manuals/5500/5500-Configuration-Guide(R2215).pdf&quot; rel=&quot;nofollow&quot;&gt;HP 5500 Configuration Guide&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: correcting privilege level as noted by Jason Cederboom&lt;/p&gt;&#xA;" OwnerUserId="7635" LastEditorUserId="7635" LastEditDate="2014-07-24T23:17:28.090" LastActivityDate="2014-07-24T23:17:28.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10106" PostTypeId="2" ParentId="8281" CreationDate="2014-07-24T22:59:43.717" Score="3" Body="&lt;p&gt;&lt;strong&gt;When&lt;/strong&gt; you are using SSH to access the switch you are using a certain username and password. The fact that you need to elevate your privilege level by using the super command means that the account you are using doesn't have the highest privilege level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in order to prevent elevating your privilege level via the super command you should already have a sufficient privilege level to begin with.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Comware 5, the OS running on the HP 5500 series switches, the privilege levels are defined as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;0-VISIT, 1-MONITOR, 2-SYSTEM, 3-MANAGE&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Privilege level 3, also know as manager level, is the highest privilege level.&#xA;In order to successfully login with privilege level 3, which is equal to super, you would need to specify that for the user account you are using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring a privilege level for a local user goes as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&amp;lt; HP 5500 &gt; system-view&lt;/li&gt;&#xA;  &lt;li&gt;[ HP 5500 ] local-user &lt;/li&gt;&#xA;  &lt;li&gt;[ HP 5500-luser-The_name_of_your_user_account ]  authorization-attribute level 3&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This in term means that you would authenticate locally on the switch which is know as &quot;&lt;strong&gt;Local level switching authentication&lt;/strong&gt;&quot;. If you however are using a RADIUS server, HWTACACS server, you are authenticating remotely which is know as &quot;&lt;strong&gt;Remote level switching authentication&lt;/strong&gt;&quot;. In that scenario the remote authentication server should be configured to provide your user with level 3 privileges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For further information regarding the Authentication Authorization Accounting, also know as AAA, implementation on the HP 5500 I would redirect you to the &quot;HP 5500 EI &amp;amp; 5500 SI Switch Series Security Configuration Guide&quot;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://h20566.www2.hp.com/portal/site/hpsc/template.BINARYPORTLET/public/kb/docDisplay/resource.process/?spf_p.tpst=kbDocDisplay_ws_BI&amp;amp;spf_p.rid_kbDocDisplay=docDisplayResURL&amp;amp;javax.portlet.begCacheTok=com.vignette.cachetoken&amp;amp;spf_p.rst_kbDocDisplay=wsrp-resourceState%3DdocId%253Demr_na-c03962889-1%257CdocLocale%253Den_US&amp;amp;javax.portlet.endCacheTok=com.vignette.cachetoken&quot; rel=&quot;nofollow&quot;&gt;HP 5500 EI &amp;amp; 5500 SI Switch Series Security Configuration Guide&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For more information regarding the privilege level I would redirect you to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.h3c.com/portal/Products___Solutions/Technology/Security_and_VPN/Technology_White_Paper/200911/654661_57_0.htm&quot; rel=&quot;nofollow&quot;&gt;H3C Privilege Level Switching Authentication Technology White Paper&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="7667" LastEditorUserId="775" LastEditDate="2014-08-23T23:34:17.887" LastActivityDate="2014-08-23T23:34:17.887" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10108" PostTypeId="1" AcceptedAnswerId="10109" CreationDate="2014-07-25T00:16:45.997" Score="7" ViewCount="1752" Body="&lt;p&gt;Say for example two routers (R1 and R2) are connected to the same switch (SW1) and both routers have Gateway Load Balancing Protocol (GLBP) correctly configured as the First-Hop Redundancy Protocol (FHRP) solution. Router 1 has been elected the Active Virtual Gateway (AVG) and is in charge of assigning virtual MAC addresses to the Active Virtual Forwarders (AVF).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MY QUESTION:&#xA;Since Router 1 is the AVG, it is the only router responding to ARP Requests, when it is performing load balancing (alternating the virtual MAC address used in the ARP Replies) won't that confuse the MAC address table on the switch? Won't the switch think that both virtual MAC addresses are on that one interface connected to R1 by learning it from the ARP Replies? So now, the switch will forward frames with the destination of R2's virtual MAC address through the interface connected to R1 (where the ARP Replies came from) instead of the interface that R2 is connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does GLBP correct this by automatically making R2 send a gratuitous ARP Reply right after R1 makes the initial reply?&lt;/p&gt;&#xA;" OwnerUserId="7669" LastActivityDate="2016-02-15T15:02:36.977" Title="Won't GLBP confuse a switch's mac address-table?" Tags="|router|switch|mac-address|arp|fhrp|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10109" PostTypeId="2" ParentId="10108" CreationDate="2014-07-25T01:21:08.103" Score="9" Body="&lt;p&gt;GLBP doesn't use gratuituous ARP. When someone asks which MAC does the virtual IP have, the AVG will reply saying &quot;This IP is at this MAC&quot;, using the field &quot;Sender MAC Address&quot;, which is invisible to the switch's CAM table. The source address is still the AVG MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I said it wrong. The IP address requested is actually the Sender, the Target address is the address of the host that sent the arp request in the first place. I'll just upload here an example of ARP Request and Reply and when I get home I'll simulate on GNS so you can see how it really works and not just an example capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TastL.png&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TastL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cadant device asks which is the MAC for x.x.128.77 and if anyone has the answer, please direct it to x.x.128.164.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oracle device then replies with a broadcast saying that x.x.128.77 is himself, at the MAC 00:14:4f:fb:c3:16, at the sender MAC address. The target is x.x.128.164, who was the one requesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this was the case of a GLBP host, it would state the virtual MAC in the sender MAC address field. It's called Proxy ARP. Just hold tight, I'll upload the actual GLBP capture in about 10 hours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GLBP Capture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2 is the AVG, R1 the AVF:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/5SJZs.png&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5SJZs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HOST 192.168.0.200 asked for the MAC of 192.168.0.1, the GLBP VIP. He received an answer from C001.3270.0000, which is the real MAC of the interface fa0/0 from R2, stating that 192.168.0.1 was located at 0007.B400.0101, one of the virtual MAC . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later on, HOST 192.168.0.201 asked for the MAC of 192.168.0.1 and received an answer from the same C001.3270.0000 saying that this IP was with the MAC 0007.B400.0102, the other virtual MAC. Wireshark even throws a yellow line saying that &quot;Hey, lookout, this IP is in use by another host&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When issuing &quot;show glbp&quot; from both routers, the AVG output have a little more detailing, including how many times it answered and ARP request with this or that virtual MAC address. You can see the MAC and IP addresses of the interfaces in &quot;Group Members&quot;, present in both outputs.&lt;/p&gt;&#xA;" OwnerUserId="7635" LastEditorUserId="775" LastEditDate="2014-07-27T16:34:56.497" LastActivityDate="2014-07-27T16:34:56.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10110" PostTypeId="1" AcceptedAnswerId="10218" CreationDate="2014-07-25T02:55:15.553" Score="5" ViewCount="1892" Body="&lt;p&gt;Is it possible to create a NAT rule that translates [changing the source IP] traffic coming from a NAT OUTSIDE interface and that goes to the Internet via another NAT OUTSIDE interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JpirI.png&quot; alt=&quot;MAP&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to know if it is possible to create a NAT rule that allows one of our Service Provider segment [192.166.5.0/24] to access the Internet without changing the NAT interface type [from NAT OUTSIDE to NAT INSIDE] there are some other configurations that make difficult for me to make that change [There are two NAT rules that are being used as virtual IPs to give access to a SFTP server], I want hosts [192.168.5.15 and 192.168.15.16] to access the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any Ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PD: Sorry for the previous post, the map looked well on the editor but it looked horrible in the post. I'm attaching a network map image&lt;/p&gt;&#xA;" OwnerUserId="7513" LastEditorUserId="105" LastEditDate="2014-07-26T05:07:55.717" LastActivityDate="2014-07-31T14:48:48.740" Title="Cisco NAT from Outside Interface to Outside Interface" Tags="|cisco|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10111" PostTypeId="2" ParentId="6801" CreationDate="2014-07-25T03:15:22.353" Score="2" Body="&lt;p&gt;Add IP addresses (gateway) to the &lt;code&gt;ve&lt;/code&gt; interfaces. That way it has a source address to route the DHCP requests from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface ve 100&#xA; ip address 192.168.16.x 255.255.255.x&#xA; ip helper-address 1 192.168.16.205&#xA;!&#xA;interface ve 150&#xA; ip address 10.50.1.x 255.255.255.x&#xA; ip helper-address 1 10.50.1.1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or whatever your subnet is that you're using.&lt;/p&gt;&#xA;" OwnerUserId="7670" LastEditorUserId="3191" LastEditDate="2014-07-25T08:48:28.260" LastActivityDate="2014-07-25T08:48:28.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10114" PostTypeId="2" ParentId="10054" CreationDate="2014-07-25T11:57:53.447" Score="1" Body="&lt;p&gt;Short answer: Soon!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Longer answer: There is an enhancement to TCP called &quot;MPTCP&quot; which will help you accomplish this kind of thing.  Kernels are starting to support it.  Check out &lt;a href=&quot;http://queue.acm.org/detail.cfm?id=2591369&quot; rel=&quot;nofollow&quot;&gt;http://queue.acm.org/detail.cfm?id=2591369&lt;/a&gt; for an overview.&lt;/p&gt;&#xA;" OwnerUserId="1243" LastActivityDate="2014-07-25T11:57:53.447" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10115" PostTypeId="1" AcceptedAnswerId="10193" CreationDate="2014-07-25T11:59:39.740" Score="3" ViewCount="2269" Body="&lt;p&gt;I am trying to understand what constitutes a new data session as listed in a CDR, where the packet switching core is a typical Nokia Siemens setup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, are data sessions managed between a phone's OS and a Serving GPRS Support Node (SGSN)? If this is the case then does moving to a new cell served by a different SGSN create a new session in a CDR or does the handoff maintain the same session?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also does anyone have a link to a good explanation of how Android handles data sessions in detail?&lt;/p&gt;&#xA;" OwnerUserId="5724" LastActivityDate="2014-07-30T07:39:00.717" Title="Typical 3G data session management" Tags="|mobile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10117" PostTypeId="1" AcceptedAnswerId="10901" CreationDate="2014-07-25T13:37:52.287" Score="3" ViewCount="1348" Body="&lt;p&gt;I read a little bit on the &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Protocol_Security&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia IPsec page&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was intrigued by: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IPsec is an end-to-end security scheme operating in the Internet Layer&#xA;  of the Internet Protocol Suite&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I understand this as: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet sender and receiver can see the whole packet. Everyone along the way can see the IP header with the rest encrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would the underlying network be able to differentiate between UDP and TCP since they're at the transport layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will we still have TCP and UDP when we move the IPv6 (although, I see that IPsec has been made optional for IPv6)?&lt;/p&gt;&#xA;" OwnerUserId="4391" LastEditorUserId="8499" LastEditDate="2016-12-19T05:15:08.547" LastActivityDate="2019-07-03T07:36:17.490" Title="IPsec, how to differentiate TCP and UDP" Tags="|tcp|ipsec|udp|transport-protocol|layer4|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10118" PostTypeId="1" AcceptedAnswerId="13393" CreationDate="2014-07-25T14:06:02.757" Score="4" ViewCount="28251" Body="&lt;p&gt;I have &lt;strong&gt;RB2011UiAS-2HnD-IN&lt;/strong&gt; router in my network. It has two switches - &quot;&lt;strong&gt;switch1&lt;/strong&gt;&quot; with 5 x 1Gb ports and &quot;&lt;strong&gt;switch2&lt;/strong&gt;&quot; with 5 x 100Mb ports. There is only one LAN addressing pool - 192.168.1.0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/xISay.jpg&quot; alt=&quot;MikroTik - problem with port bridge over LAN using 2 switches&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All 5 ports at &quot;&lt;strong&gt;switch1&lt;/strong&gt;&quot; is used. I needed to attache one more device so I connected it to 1st port at &quot;&lt;strong&gt;switch2&lt;/strong&gt;&quot;. There is no connection to this device. All 5 ports from &quot;switch1&quot; are in one &lt;strong&gt;bridge-local&lt;/strong&gt; and first port from &quot;&lt;strong&gt;switch2&lt;/strong&gt;&quot; is also attached to this &lt;strong&gt;bridge-local&lt;/strong&gt;. It is also &lt;strong&gt;master-port&lt;/strong&gt; and to him are slaved 4 more ports from &quot;&lt;strong&gt;switch2&lt;/strong&gt;&quot; - so I can only add master to the whole &lt;strong&gt;bridge-local&lt;/strong&gt; ports pool. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no cennectivity to my new device. I changed ports for one from &quot;&lt;strong&gt;switch1&lt;/strong&gt;&quot; and everything is working properly. There is problem when I try to use ports from &quot;&lt;strong&gt;switch2&lt;/strong&gt;&quot;.&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="8499" LastEditDate="2018-02-14T16:38:28.207" LastActivityDate="2018-02-14T16:38:28.207" Title="MikroTik - problem with port bridge over LAN using 2 switches" Tags="|switch|router|lan|bridge|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-09T23:57:36.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="10121" PostTypeId="2" ParentId="7669" CreationDate="2014-07-25T17:49:53.900" Score="2" Body="&lt;p&gt;&lt;strong&gt;You&lt;/strong&gt; could use SNMP in combination with any network management system.&#xA;For instance Intelligent Management Center, also know also IMC, which is a multi vendor network management system from HP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the following links for more information about IMC:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=rBULMziUfI4&amp;amp;list=UUn5rlmbMlGhFb2CWp1Mpq_A&quot; rel=&quot;nofollow&quot;&gt;HP IMC 7 Introduction video&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.youtube.com/watch?v=kbd1yfsUgC8&amp;amp;list=UUn5rlmbMlGhFb2CWp1Mpq_A&quot; rel=&quot;nofollow&quot;&gt;HP IMC 7 Configuring SNMPv3 on Comware Devices video&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="7667" LastEditorUserId="775" LastEditDate="2014-07-27T13:24:05.413" LastActivityDate="2014-07-27T13:24:05.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10129" PostTypeId="2" ParentId="10082" CreationDate="2014-07-26T08:02:32.347" Score="2" Body="&lt;p&gt;For your requirement&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ax0pX.png&quot; alt=&quot;Comparision&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Preferably if your DC is expanding i would suggest to go with N9k if you are not looking specific to any FC port; Regarding the technology with ACI, CISCO's APIC controller is still in its initial stage and would have many bugs initially. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the technical answer for minimal configuration, N5k support Openflow, onePk and python; as long as you are not implementing APIC controller forget about minimal configuration in N9k; both N5k and N9k provide same functionality (keeping aside APIC controller).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look into the hardware and choose the best, configuration minimality is always achievable by software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;btw N9k has more throughput than N5k [1.92/1.44Tbps]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&#xA;Buck!!&lt;/p&gt;&#xA;" OwnerUserId="7685" LastActivityDate="2014-07-26T08:02:32.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10130" PostTypeId="2" ParentId="10054" CreationDate="2014-07-26T12:10:01.613" Score="0" Body="&lt;p&gt;There are vendor-specific solutions that might get you what you want, even though it may not be exactly what you asked for.  You create one SSID for the entire building.  You get an IP address that is associated with that wifi base station.  From then on, as you move around the building (or campus) you keep that IP address.  The network just &quot;does the right thing&quot; for you.  I believe &lt;a href=&quot;http://www.arubanetworks.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.arubanetworks.com/&lt;/a&gt; is one company that has this feature; there are likely many others.&lt;/p&gt;&#xA;" OwnerUserId="1243" LastActivityDate="2014-07-26T12:10:01.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10131" PostTypeId="1" AcceptedAnswerId="10145" CreationDate="2014-07-26T12:12:59.587" Score="2" ViewCount="2273" Body="&lt;p&gt;I want to bridge two networks using a Powerstation 5 22V and a Nanobridge M5 from Ubiquiti but I'm having serious problems with it. Here's a small doodle describing how the network looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4ShIu.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now here's the thing. From my PC, I'm able to ping both Ubiquiti antennas, but I'm not able to ping the Router. But from the Router, I can only ping the Nanobridge - pinging the Powerstation keeps failing.&#xA;From my PC I'm even able to SSH into the Nanobridge and ping the Router from there. What I need is to get a connection to the Router from my PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the network config of both antennas.&#xA;Nanobridge:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/L2vzj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L2vzj.png&quot; alt=&quot;Nanobridge Screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Powerstation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Vt8kn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vt8kn.png&quot; alt=&quot;Powerstation Screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone tell what I'm doing wrong? &#xA;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="7687" LastEditorUserId="775" LastEditDate="2014-12-08T12:48:01.097" LastActivityDate="2015-01-26T16:47:20.510" Title="Problem bridging two networks with Ubiquiti hardware" Tags="|wireless|bridge|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10132" PostTypeId="1" AcceptedAnswerId="10133" CreationDate="2014-07-26T17:27:04.960" Score="1" ViewCount="702" Body="&lt;p&gt;I have a new CAT6 cable that's 50 metres long and only performs at 100 megabit. I've tested it in a variety of gigabit ports and it never allows a gigabit connection. Is it the length that's the problem and will cutting it in half to make two 25 metre cables make it perform at gigabit speeds ? i.e. is the length likely the problem or is it just a duff cable ?&lt;/p&gt;&#xA;" OwnerUserId="7689" LastEditorUserId="8499" LastEditDate="2018-03-21T00:39:51.880" LastActivityDate="2018-03-21T00:39:51.880" Title="Will cutting a 50m CAT6 cable in half achieve a gigabit connection?" Tags="|layer1|cable|cabling|speed|utp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10133" PostTypeId="2" ParentId="10132" CreationDate="2014-07-26T17:35:12.517" Score="6" Body="&lt;p&gt;Cat6 can provide Gigabit speeds up to 90+ meters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is far more likely that one of the terminations is the problem.  Gigabit requires the use of all 8 wires, so if one (or both) of the terminations isn't making good contact, then it could run at 100M which only requires 4 wires.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-07-26T17:35:12.517" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10142" PostTypeId="1" CreationDate="2014-07-28T07:23:06.050" Score="9" ViewCount="994" Body="&lt;p&gt;I have encountered something I'm not familiar with in a customer's configuration, I know that the &quot;(hitcnt=324165)&quot; at the end of every rule in &quot;show access-list&quot; points to rule usage, hit count. But in this output of show access-list I'm also seeing numbers following object and non-object entities in the rule.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Example&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list access-global-in line 5 extended deny ip object-group HA_Networks_All any log &#xA; informational interval 300 0xf688d263&#xA;&#xA;access-list access-global-in line 5 extended deny ip object-group HA_Networks_All(298) any(65537) log &#xA; informational interval 300 (hitcnt=324165) 0xa2669c62&#xA;&#xA;access-list access-global-in line 7 extended deny ip object-group HA-Wireless_10.1.80.0-24 any log &#xA; informational interval 300 0xb25caeed &#xA;&#xA;access-list access-global-in line 7 extended deny ip object-group HA-Wireless_10.1.80.0-24(299) &#xA; any(65537) log informational interval 300 (hitcnt=2133314) 0x111a2d28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice that the same rule is displayed twice (same line number) but once with the parentheses inside the rule and once without.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this some sort of object usage? If so how can it be different from the hit count? I couldn't find any documentation explaining this. &lt;/p&gt;&#xA;" OwnerUserId="5329" LastEditorUserId="775" LastEditDate="2014-07-28T08:24:06.127" LastActivityDate="2014-07-31T07:52:47.307" Title="What do the parentheses &quot;()&quot; after objects mean in Cisco ASA ACLs?" Tags="|cisco|cisco-asa|acl|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10143" PostTypeId="1" AcceptedAnswerId="13503" CreationDate="2014-07-28T07:30:52.617" Score="0" ViewCount="138" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Dedicated_short-range_communications&quot; rel=&quot;nofollow&quot; title=&quot;DSRC&quot;&gt;Dedicated short-range communications&lt;/a&gt; are one-way or two-way short-range to medium-range wireless communication channels specifically designed for automotive use.  DSRC uses the 5.9 GHz band allocated by the US govt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does a smart phone need any additional hardware to send/receive data using this wireless communication protocol?&lt;/p&gt;&#xA;" OwnerUserId="7704" LastEditorUserId="775" LastEditDate="2014-12-08T12:46:59.787" LastActivityDate="2014-12-08T22:42:11.427" Title="Do smartphones require additional hardware to communicate using DSRC?" Tags="|mobile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10144" PostTypeId="2" ParentId="792" CreationDate="2014-07-28T08:30:15.443" Score="0" Body="&lt;p&gt;HSRP is manufactured by cisco for cisco in 1994.it has hello timer of 3 sec and dead timer of 10 sec.the other version of HSRP is GLBP which is identical to HSRP but has ACTIVE-ACTIVE LOAD BALANCING.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VRRP is manufactured by IETF for open vendors in 1999.it has hello timer of 1 sec and dead timer of 3 sec.it allows you to assign individual virtual ip on each interface of a routers,incase  you limited ip address(outbound).&lt;/p&gt;&#xA;" OwnerUserId="7706" LastActivityDate="2014-07-28T08:30:15.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10145" PostTypeId="2" ParentId="10131" CreationDate="2014-07-28T08:58:03.303" Score="1" Body="&lt;p&gt;It works now, all I had to do is to switch the wireless mode on each antenna from Station to AP and vice versa and set their IP-Address to DHCP. I still don't understand why it had to do with the Wireless Mode (Access Point/Station). Can anyone explain this to me please?&lt;/p&gt;&#xA;" OwnerUserId="7687" LastActivityDate="2014-07-28T08:58:03.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10148" PostTypeId="1" AcceptedAnswerId="10151" CreationDate="2014-07-28T15:36:49.973" Score="6" ViewCount="26042" Body="&lt;p&gt;We're planning on creating a 10GbE network for our office. I've got a list of hardware that all support 10GbE, only the router isn't 10GbE:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Synology DS3612+ - 12 Drive NAS&lt;/li&gt;&#xA;&lt;li&gt;Intel X540-T1 - 10GbE Network adaptor for NAS&lt;/li&gt;&#xA;&lt;li&gt;Netgear XS708E - 10GbE Switch&lt;/li&gt;&#xA;&lt;li&gt;SANLink2 - Thunderbolt - 10GbE adapter&lt;/li&gt;&#xA;&lt;li&gt;Cat7 Cables&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Setup is as folows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Our gigabit-router (&lt;strong&gt;NOT&lt;/strong&gt; 10GbE) will be connected to the Switch&lt;/li&gt;&#xA;&lt;li&gt;Computers will be connected to the Switch via SANLink2&lt;/li&gt;&#xA;&lt;li&gt;The NAS will be connected to the Switch via 10GbE adaptor&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I'd like to know:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Will the computers be able to connect to the NAS at 10GbE?&lt;/li&gt;&#xA;&lt;li&gt;Will the router slow things (other than internet) down?&lt;/li&gt;&#xA;&lt;li&gt;Any other drawbacks?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The needs for this network are the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;We want to do 4K video-editing directly from the NAS.&lt;/li&gt;&#xA;&lt;li&gt;We want to transfer 2TB of data to the NAS in less than an hour.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="7710" LastEditorUserId="7710" LastEditDate="2014-07-28T16:18:42.113" LastActivityDate="2015-03-29T03:47:33.303" Title="Do I need a 10GbE router to provide 10Gbps LAN speed?" Tags="|router|switch|ethernet|10gbase|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10150" PostTypeId="2" ParentId="10148" CreationDate="2014-07-28T15:47:53.417" Score="4" Body="&lt;p&gt;As long as all workstations are on the same VLAN as the NAS, you won't need a 10Gig router.&lt;/p&gt;&#xA;" OwnerUserId="2782" LastActivityDate="2014-07-28T15:47:53.417" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10151" PostTypeId="2" ParentId="10148" CreationDate="2014-07-28T16:09:38.377" Score="12" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;Will the computers be able to connect to the NAS at 10GbE?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, if both the computers and the NAS are connected to the switch at 10GbE and do not require routing (ie. both are in the same subnet and VLAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Will the router slow things (other than internet) down?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will slow anything which passes through it down to gigabit, but only if is faster to begin with. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Any other drawbacks?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This could be the perfect setup for you, but it could also fail to deliver under certain conditions. Since we don't know what it has to deliver, it's hard to tell.  It all depends on how you will use it and what you expect from it...&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-07-28T16:09:38.377" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10152" PostTypeId="1" AcceptedAnswerId="10153" CreationDate="2014-07-28T16:26:06.227" Score="4" ViewCount="299" Body="&lt;p&gt;I wanted to ask the community their thoguhts on the pros and cons of this scenario. I have a few L3 switches with their own independent VLANS connecting to a a set of stacked switches over a port-channel. My question is which is better, if knowing these spoke switches are stubs. Using Point-to-point /30 links between each spoke switch and the hub switch, or using a single /24 with the hub switch spanning a vlan across the ports used. I will also be using EIGRP towards our CORE and summarizing wherever possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multipoint -- Multiple /30s &#xA;&lt;img src=&quot;https://i.stack.imgur.com/D772W.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multipoint -- Single /24&#xA;&lt;img src=&quot;https://i.stack.imgur.com/PxAOB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2014-07-28T17:00:38.460" Title="Hub-Spoke topology -- L3 Links use multiple /30s vs single /24 shared?" Tags="|routing|design|layer3|point-to-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10153" PostTypeId="2" ParentId="10152" CreationDate="2014-07-28T17:00:38.460" Score="2" Body="&lt;p&gt;With your current design it's not going to be a huge difference. However, assuming that you would have the same management VLAN for the entire network and spanning lots of switches, the point to point links would be better for the following reasons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Smaller L2 domain size&lt;/li&gt;&#xA;&lt;li&gt;No bridging loop possible&lt;/li&gt;&#xA;&lt;li&gt;Easier troubleshooting&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Because the layer 2 domain would be limited and each management VLAN would only span a pair of switches, any reachability issues would be easy to point out and find the origin of the problem.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-07-28T17:00:38.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10155" PostTypeId="2" ParentId="7669" CreationDate="2014-07-28T18:27:41.267" Score="1" Body="&lt;p&gt;(On reasonably modern HP switches) if you use SFTP to push and pull the configuration files, that avoids the need to issue commands to the command-line. Then you can use whatever CM tool you choose to template, delta, or whatever. You can, of course, push a bad set of changes really fast this way to multiple switches, so be careful if rolling your own system.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2014-07-28T18:27:41.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10158" PostTypeId="1" CreationDate="2014-07-28T20:13:39.997" Score="6" ViewCount="839" Body="&lt;p&gt;I am Cisco certified and have worked for an ISP for the last 5 years. I have made the transition to the LAN side as a Network Administrator so I am a novice at certain things. With that being said, below is the configuration on one of my ASA5520s. I have changed addressing for security, but this is how it looks.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0.2&#xA; nameif Inside&#xA; security-level 100&#xA; ip address 10.x.x.x 255.255.255.248&#xA;!&#xA;interface GigabitEthernet0/0.4&#xA; nameif DMZ&#xA; security-level 50&#xA; ip address 10.x.x.x 255.255.255.248&#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif Outside&#xA; security-level 0&#xA; ip address 159.x.x.x 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is this:&#xA;I have four physical ports on the back of my ASA, why don't they show up in the running config  ,,,why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And my second question: is it ok not to have a VLAN associated with my sub-interfaces?  &lt;/p&gt;&#xA;" OwnerUserId="7714" LastEditorUserId="619" LastEditDate="2014-07-28T21:16:47.243" LastActivityDate="2014-08-30T01:32:59.150" Title="ASA 5520 physical ports" Tags="|cisco-asa|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10159" PostTypeId="2" ParentId="10158" CreationDate="2014-07-28T21:19:08.030" Score="3" Body="&lt;p&gt;In a word: LICENSE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could be your license only allows 2 physical interfaces. &lt;code&gt;show version&lt;/code&gt; will show your licensed features.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-07-28T21:19:08.030" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10166" PostTypeId="1" AcceptedAnswerId="10167" CreationDate="2014-07-29T09:28:20.077" Score="2" ViewCount="347" Body="&lt;p&gt;I want to create a small 10Gbps network where a Netgear XS708E switch connects a Synology DS3612xs NAS to multiple Macs with SANLink2 10GBase-T thunderbolt/ethernet adaptors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read that the switch provides Link Aggregation, but I've never worked with this technology before. All I know is I can create 2 x 10Gbps = 20Gbps connections with it. So it seems interesting!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'd like to know before digging in to this is what the possibilities are for doing this. Can I just combine any two ports I like for LA? And, because the switch only provides 8 ports, can I just add another switch and go on with LA on the other switch, so that I will have (for example) 8 LA connections over 16 ports? And is it possible to create one VLAN with multiple switches? &lt;/p&gt;&#xA;" OwnerUserId="7710" LastEditorUserId="3191" LastEditDate="2014-07-30T20:54:30.627" LastActivityDate="2014-07-30T20:54:30.627" Title="Link Aggregation options" Tags="|vlan|tcp|lan|netgear-prosafe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10167" PostTypeId="2" ParentId="10166" CreationDate="2014-07-29T12:19:38.117" Score="4" Body="&lt;p&gt;You can create a Lagg interface with up to eight ports (says the standard. your switch allows only four ports). It's good because it also provides some level of fault tolerance in your network, if one of the ports become unavailable, the others carry on without the need to reconfigure anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://www.netgear.com/business/products/switches/unmanaged-plus/10g-plus-switch.aspx#tab-techspecs&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, you can only configure 4 Laggs with 2 or 4 ports in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can I just combine any two ports I like for LA?&lt;/strong&gt; Yes!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can I just add another switch and go on with LA on the other switch:&lt;/strong&gt; Yes, but you'll need to connect both switches, and since they're not stackable, you'll need to use some ports and Lagg to connect them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is it possible to create one VLAN with multiple switches?&lt;/strong&gt; Yes, but remember the switches must be connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But practically speaking, why would you wanna do that? I'm running a network with over 400k customers that span over a whole city and have 6 stations spread around, interconnected in a 40gbps ring that won't go near 20gbps most of the time. Also, do you have two 10G interfaces on each of your desktops/laptops?&lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-07-29T12:19:38.117" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10168" PostTypeId="1" AcceptedAnswerId="10169" CreationDate="2014-07-29T13:48:44.560" Score="4" ViewCount="1590" Body="&lt;p&gt;When I issue a &amp;quot;show logging&amp;quot; command to see the locally buffered logs, the log statements are displayed sometimes with an asterisk in front of the date and sometimes with a period in front of the date and sometimes with neither (see below).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;000046: *Apr 22 13:05:46.064 MDT: %DUAL-5-NBRCHANGE: EIGRP-IPv4 666: Neighbor 10.1.2.3(Serial0/0/0:0) is up: new adjacency&lt;/p&gt;&#xA;&lt;p&gt;000068: .Jul 17 08:16:52.399 MDT: %DUAL-5-NBRCHANGE: EIGRP-IPv4 666: Neighbor 10.1.2.3 (Serial0/0/0:0) is down: interface down&lt;/p&gt;&#xA;&lt;p&gt;000083: Jul 17 09:40:41.060 MDT: %DUAL-5-NBRCHANGE: EIGRP-IPv4 666: Neighbor 10.1.2.3(Serial0/0/0:0) is up: new adjacency&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;What do these symbols mean?&lt;/p&gt;&#xA;" OwnerUserId="1911" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-07-29T16:49:08.933" Title="Interpreting Cisco logging symbols" Tags="|cisco-ios|logging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10169" PostTypeId="2" ParentId="10168" CreationDate="2014-07-29T14:27:39.553" Score="8" Body="&lt;p&gt;If nothing is before the date, it means that your router clock was set manually or is in sync with a NTP server by the time of the log.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If with an asterisk, it means you didn't set the clock or it isn't synced with a NTP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's a period, it means the clock was in sync but the NTP server is not accessible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_s2.html#wp1486074&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-07-29T14:27:39.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10170" PostTypeId="1" AcceptedAnswerId="10176" CreationDate="2014-07-29T14:42:49.423" Score="1" ViewCount="4588" Body="&lt;p&gt;How does the authentication take place in a pppoe bridge setup assuming I have a bridge modem and a router that is capable of maintaining a bridge connection both connected to an un-managed switch? &lt;br&gt;&lt;br&gt;&#xA;As far as I can tell the PPP connection is encapsulated by the modem as ethernet frames and then the router interprets those frames for authentication purposes. What I don't understand is the communication between the router and modem. Does the modem have an address on the switch and the gateway of the router is that of the modem? Is authentication information included in every packet that passes through the modem? &lt;/p&gt;&#xA;" OwnerUserId="4299" LastActivityDate="2014-07-29T17:45:00.627" Title="How does PPPOE bridging work?" Tags="|switching|pppoe|ppp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10171" PostTypeId="1" CreationDate="2014-07-29T14:55:00.220" Score="2" ViewCount="3894" Body="&lt;p&gt;At one end I have AF100-2 media convert 10/100Base and at the other end I have TP-Link MC200CM 10/1000Base media converter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Originally there were AF100-2 at both ends, but one of device is not working, so bought a replacement. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On TP Link media converter there is no LED light for FX Link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need same kind of media converters at both end? Anything else I need to change?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7721" LastActivityDate="2014-07-29T15:24:23.070" Title="Media Converter - FX Link LIght Off" Tags="|ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10172" PostTypeId="2" ParentId="10171" CreationDate="2014-07-29T15:15:09.013" Score="5" Body="&lt;p&gt;You need media converters that &quot;talk the same language&quot; at both ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AF100-2 appears to be 100Base-FX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MC200CM is 1000Base-SX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also note that 1000Base-SX has a significantly lower maximum distance (220 or 500 meters depending on type of multimode fiber).  100Base-FX can go up to 2km, so if your fiber run is longer than 1000Base-SX can support, you will need to get a 100Base-FX media converter.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-07-29T15:24:23.070" LastActivityDate="2014-07-29T15:24:23.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10173" PostTypeId="1" CreationDate="2014-07-29T16:29:35.653" Score="1" ViewCount="8106" Body="&lt;p&gt;I need a list of all devices that are directly connected to the cisco device I'm connected to through serial. I tried the arp table, but it contains more entries than I want since it spans multiple switches. I have no idea how to know which one is an end user device and which one is another network device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm basically crawling a network and I need to know where to go next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;This is a general cisco-device question. I want to do this from routers, switches and other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running the commands on a cisco device, looking for any device (not necessarily a cisco device) that is directly connected. And I would also like to know which ones of those devices are other network devices (regardless of brand) and which ones are end users.&lt;/p&gt;&#xA;" OwnerUserId="5518" LastEditorUserId="5518" LastEditDate="2014-07-29T21:47:11.123" LastActivityDate="2017-02-23T15:00:44.197" Title="List of directly connected network devices by mac/ip?" Tags="|cisco|mac-address|arp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10174" PostTypeId="2" ParentId="10173" CreationDate="2014-07-29T17:21:06.743" Score="3" Body="&lt;p&gt;You can get some intel on it with the command &lt;code&gt;show mac-address-table vlan &amp;lt;number&amp;gt;&lt;/code&gt;. It shows all the dynamically learned MACs and the ports they were learned on. You could then decide, based on your network, if said ports are connected to a switch or end device.&lt;/p&gt;&#xA;" OwnerUserId="7635" LastEditorUserId="7635" LastEditDate="2014-07-29T20:42:05.333" LastActivityDate="2014-07-29T20:42:05.333" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="10175" PostTypeId="1" AcceptedAnswerId="11263" CreationDate="2014-07-29T17:34:03.963" Score="14" ViewCount="6501" Body="&lt;h1&gt;Background&lt;/h1&gt;&#xA;&lt;p&gt;We rented a few layer 2 leased lines, i.e. you have one big pipe at the datacenter and the remote sites have smaller pipes. Inside the layer 2 network you can do whatever you like. Probably they use 802.1ad to give each customer their separate network inside their network. AFAICS most sites are connected via plain VDSL.&lt;/p&gt;&#xA;&lt;p&gt;We decided to put a router at each site, and give each site its own VLAN. The firewall at the DC thus has as many VLANs defined as there are sites. Each site thus uses its on address range in its own VLAN.&lt;/p&gt;&#xA;&lt;h2&gt;Network diagram:&lt;/h2&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Z8Wtf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z8Wtf.png&quot; alt=&quot;network diagram&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h1&gt;Problem&lt;/h1&gt;&#xA;&lt;p&gt;Now, we are faced with throughput problems:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Running an FTP transfer from site to DC works fine at about 10Mb/s which is line speed.&lt;/li&gt;&#xA;&lt;li&gt;Running an FTP transfer from DC to site does not work fine at 6Mb/s or less.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;It does not matter &lt;em&gt;which side&lt;/em&gt; initiates the transfer. The only consistent thing is that one direction is not working well. Too bad it is the direction toward the site because that would be the bandwidth we need most as we'd like to use terminal server clients.&lt;/p&gt;&#xA;&lt;p&gt;About 10 seconds into the transfer, the throughput drops. We see DUP ACKs when sniffing. Which maybe leads me to rate limiting at the provider's end?? (Currently, they don't have a clue, and I like to make sure we're not at fault before escalating)&lt;/p&gt;&#xA;&lt;h2&gt;NOTE&lt;/h2&gt;&#xA;&lt;p&gt;The remote sites are limited to 10Mb somehow. Setting the switch-to-Metro-port to 10Mb doesn't help either. In fact it's the worst then (max. 30 KB/s). Setting to 100Mb works fine but already starts to produce the outlined problem. Same for 1G.&lt;/p&gt;&#xA;&lt;p&gt;Captures of the problem can be downloaded here:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;* http://178.63.11.6/dc-to-remote_dc-side.pcapng&#xA;* http://178.63.11.6/dc-to-remote_remote-side.pcapng&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h1&gt;Diagnostics&lt;/h1&gt;&#xA;&lt;p&gt;In the image you see the Wireshark IO Graph with some error details:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;on the left: FTP transfer from DC to site&lt;/li&gt;&#xA;&lt;li&gt;on the right: FTP transfer from site to DC&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/faSWa.jpg&quot; alt=&quot;duplicate acks&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;In case the other side initiates the transfer (i.e. put from dc, instead of get from remote), the problem remains unchanged.&lt;/p&gt;&#xA;&lt;p&gt;Please indulge me with what you think could be the problem here.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h3&gt;UPDATE #1 (integrated above)&lt;/h3&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h3&gt;UPDATE #2 (&lt;em&gt;UPDATED&lt;/em&gt;)&lt;/h3&gt;&#xA;&lt;p&gt;This must be a congestion control thing.&lt;/p&gt;&#xA;&lt;p&gt;Note that from DC to remote we have 10G-&amp;gt;1G-&amp;gt;100M-&amp;gt;10M-&amp;gt;1G links. &amp;lt;-- not working&lt;/p&gt;&#xA;&lt;p&gt;In the other direction we thus have the inverse: 1G-&amp;gt;10M-&amp;gt;100M-&amp;gt;1G-&amp;gt;10G. &amp;lt;-- just fine&lt;/p&gt;&#xA;&lt;p&gt;The first &amp;quot;1G-&amp;gt;10M&amp;quot; is the &amp;quot;invisible&amp;quot; 10M at the remote site, where everything including the uplink port speed is set at 1G, even though there's only 10M behind it (being sold).&lt;/p&gt;&#xA;&lt;p&gt;However the 100Mbps at the DC are real 100Mbps, the interface is configured at 100Mbps on the physical layer.&lt;/p&gt;&#xA;&lt;h3&gt;Now using iperf:&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;TCP&lt;/strong&gt; tests work fine only in one direction (client=DC, server=remote)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;pre&gt;&#xA;./iperf -c 192.168.x -i2 -t 60 -r&#xA;------------------------------------------------------------&#xA;Server listening on TCP port 5001&#xA;TCP window size: 85.3 KByte (default)&#xA;------------------------------------------------------------&#xA;------------------------------------------------------------&#xA;Client connecting to 192.168.x, TCP port 5001&#xA;TCP window size: 16.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  3] local 10.x port 38195 connected with 192.168.x port 5001&#xA;[  3]  0.0- 2.0 sec  1.44 MBytes  6.03 Mbits/sec&#xA;[  3]  2.0- 4.0 sec  2.23 MBytes  9.37 Mbits/sec&#xA;[  3]  4.0- 6.0 sec  2.28 MBytes  9.57 Mbits/sec&#xA;[  3]  6.0- 8.0 sec  1.88 MBytes  7.90 Mbits/sec&#xA;[  3]  8.0-10.0 sec  1.00 MBytes  4.19 Mbits/sec&#xA;[  3] 10.0-12.0 sec  1.30 MBytes  5.47 Mbits/sec&#xA;[  3] 12.0-14.0 sec    688 KBytes  2.82 Mbits/sec&#xA;[  3] 14.0-16.0 sec    840 KBytes  3.44 Mbits/sec&#xA;[  3] 16.0-18.0 sec  1.03 MBytes  4.33 Mbits/sec&#xA;[  3] 18.0-20.0 sec  1.01 MBytes  4.23 Mbits/sec&#xA;[  3] 20.0-22.0 sec  1.03 MBytes  4.33 Mbits/sec&#xA;[  3] 22.0-24.0 sec  1.18 MBytes  4.95 Mbits/sec&#xA;[  3] 24.0-26.0 sec    904 KBytes  3.70 Mbits/sec&#xA;[  3] 26.0-28.0 sec    840 KBytes  3.44 Mbits/sec&#xA;[  3] 28.0-30.0 sec    936 KBytes  3.83 Mbits/sec&#xA;[  3] 30.0-32.0 sec  1.09 MBytes  4.59 Mbits/sec&#xA;[  3] 32.0-34.0 sec    960 KBytes  3.93 Mbits/sec&#xA;[  3] 34.0-36.0 sec    752 KBytes  3.08 Mbits/sec&#xA;[  3] 36.0-38.0 sec  1.09 MBytes  4.59 Mbits/sec&#xA;[  3] 38.0-40.0 sec  1.09 MBytes  4.59 Mbits/sec&#xA;[  3] 40.0-42.0 sec    840 KBytes  3.44 Mbits/sec&#xA;[  3] 42.0-44.0 sec  1.27 MBytes  5.34 Mbits/sec&#xA;[  3] 44.0-46.0 sec  1.16 MBytes  4.85 Mbits/sec&#xA;[  3] 46.0-48.0 sec    840 KBytes  3.44 Mbits/sec&#xA;[  3] 48.0-50.0 sec    960 KBytes  3.93 Mbits/sec&#xA;[  3] 50.0-52.0 sec  1.28 MBytes  5.37 Mbits/sec&#xA;[  3] 52.0-54.0 sec  1.09 MBytes  4.59 Mbits/sec&#xA;[  3] 54.0-56.0 sec    992 KBytes  4.06 Mbits/sec&#xA;[  3] 56.0-58.0 sec  1.00 MBytes  4.19 Mbits/sec&#xA;[  3] 58.0-60.0 sec  1.09 MBytes  4.59 Mbits/sec&#xA;[  3]  0.0-60.2 sec  33.9 MBytes  4.73 Mbits/sec&#xA;[  5] local 10.x port 5001 connected with 192.168.x port 10965&#xA;[  5]  0.0- 2.0 sec  1.85 MBytes  7.75 Mbits/sec&#xA;[  5]  2.0- 4.0 sec  1.90 MBytes  7.98 Mbits/sec&#xA;[  5]  4.0- 6.0 sec  1.89 MBytes  7.93 Mbits/sec&#xA;[  5]  6.0- 8.0 sec  1.92 MBytes  8.07 Mbits/sec&#xA;[  5]  8.0-10.0 sec  1.91 MBytes  8.02 Mbits/sec&#xA;[  5] 10.0-12.0 sec  1.83 MBytes  7.69 Mbits/sec&#xA;[  5] 12.0-14.0 sec  1.86 MBytes  7.78 Mbits/sec&#xA;[  5] 14.0-16.0 sec  1.79 MBytes  7.52 Mbits/sec&#xA;[  5] 16.0-18.0 sec  1.79 MBytes  7.52 Mbits/sec&#xA;[  5] 18.0-20.0 sec  1.89 MBytes  7.91 Mbits/sec&#xA;[  5] 20.0-22.0 sec  1.91 MBytes  8.00 Mbits/sec&#xA;[  5] 22.0-24.0 sec  1.88 MBytes  7.91 Mbits/sec&#xA;[  5] 24.0-26.0 sec  1.95 MBytes  8.16 Mbits/sec&#xA;[  5] 26.0-28.0 sec  1.90 MBytes  7.99 Mbits/sec&#xA;[  5] 28.0-30.0 sec  1.87 MBytes  7.84 Mbits/sec&#xA;[  5] 30.0-32.0 sec  1.85 MBytes  7.77 Mbits/sec&#xA;[  5] 32.0-34.0 sec  1.55 MBytes  6.49 Mbits/sec&#xA;[  5] 34.0-36.0 sec  1.92 MBytes  8.07 Mbits/sec&#xA;[  5] 36.0-38.0 sec  1.90 MBytes  7.99 Mbits/sec&#xA;[  5] 38.0-40.0 sec  1.84 MBytes  7.73 Mbits/sec&#xA;[  5] 40.0-42.0 sec  1.66 MBytes  6.95 Mbits/sec&#xA;[  5] 42.0-44.0 sec  1.92 MBytes  8.07 Mbits/sec&#xA;[  5] 44.0-46.0 sec  1.91 MBytes  7.99 Mbits/sec&#xA;[  5] 46.0-48.0 sec  1.90 MBytes  7.98 Mbits/sec&#xA;[  5] 48.0-50.0 sec  1.84 MBytes  7.70 Mbits/sec&#xA;[  5] 50.0-52.0 sec  1.93 MBytes  8.09 Mbits/sec&#xA;[  5] 52.0-54.0 sec  1.80 MBytes  7.54 Mbits/sec&#xA;[  5] 54.0-56.0 sec  1.83 MBytes  7.67 Mbits/sec&#xA;[  5] 56.0-58.0 sec  1.88 MBytes  7.86 Mbits/sec&#xA;[  5] 58.0-60.0 sec  1.85 MBytes  7.78 Mbits/sec&#xA;[  5]  0.0-60.3 sec  56.0 MBytes  7.79 Mbits/sec&#xA;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;To get to the bottom of it, here are &lt;strong&gt;UDP&lt;/strong&gt; tests from two hosts in the same VLAN yet using the Metro Connection, 200=remote, 201=DC&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;We see the packet loss increasing with incrementing bandwidth (when approaching 10Mbps we have 0.93%, starts to be critical... and would also explain why TCP has problem performing)&lt;/p&gt;&#xA;&lt;pre&gt;&#xA;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&#xA;C:\iperf-2.0.5-2-win32&gt;iperf -c 192.168.191.200 -i 1 -t 20 -r -u&#xA;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&#xA;------------------------------------------------------------&#xA;Server listening on UDP port 5001&#xA;Receiving 1470 byte datagrams&#xA;UDP buffer size: 64.0 KByte (default)&#xA;------------------------------------------------------------&#xA;------------------------------------------------------------&#xA;Client connecting to 192.168.191.200, UDP port 5001&#xA;Sending 1470 byte datagrams&#xA;UDP buffer size: 64.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  4] local 192.168.191.201 port 61759 connected with 192.168.191.200 port 5001&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  4]  0.0- 1.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4]  1.0- 2.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4]  2.0- 3.0 sec   129 KBytes  1.06 Mbits/sec&#xA;[  4]  3.0- 4.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4]  4.0- 5.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4]  5.0- 6.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4]  6.0- 7.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4]  7.0- 8.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4]  8.0- 9.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4]  9.0-10.0 sec   129 KBytes  1.06 Mbits/sec&#xA;[  4] 10.0-11.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4] 11.0-12.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4] 12.0-13.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4] 13.0-14.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4] 14.0-15.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4] 15.0-16.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4] 16.0-17.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4] 17.0-18.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4] 18.0-19.0 sec   131 KBytes  1.07 Mbits/sec&#xA;[  4] 19.0-20.0 sec   128 KBytes  1.05 Mbits/sec&#xA;[  4]  0.0-20.0 sec  2.50 MBytes  1.05 Mbits/sec&#xA;[  4] Sent 1785 datagrams&#xA;[  4] Server Report:&#xA;[  4]  0.0-20.0 sec  2.50 MBytes  1.05 Mbits/sec   0.257 ms    0/ 1785 (0%)&#xA;[  3] local 192.168.191.201 port 5001 connected with 192.168.191.200 port 50749&#xA;[  3]  0.0- 1.0 sec   128 KBytes  1.05 Mbits/sec   0.285 ms    0/   89 (0%)&#xA;[  3]  1.0- 2.0 sec   128 KBytes  1.05 Mbits/sec   0.313 ms    0/   89 (0%)&#xA;[  3]  2.0- 3.0 sec   128 KBytes  1.05 Mbits/sec   0.278 ms    0/   89 (0%)&#xA;[  3]  3.0- 4.0 sec   128 KBytes  1.05 Mbits/sec   0.241 ms    0/   89 (0%)&#xA;[  3]  4.0- 5.0 sec   128 KBytes  1.05 Mbits/sec   0.266 ms    0/   89 (0%)&#xA;[  3]  5.0- 6.0 sec   128 KBytes  1.05 Mbits/sec   0.293 ms    0/   89 (0%)&#xA;[  3]  6.0- 7.0 sec   128 KBytes  1.05 Mbits/sec   0.314 ms    0/   89 (0%)&#xA;[  3]  7.0- 8.0 sec   128 KBytes  1.05 Mbits/sec   0.280 ms    0/   89 (0%)&#xA;[  3]  8.0- 9.0 sec   128 KBytes  1.05 Mbits/sec   0.242 ms    0/   89 (0%)&#xA;[  3]  9.0-10.0 sec   129 KBytes  1.06 Mbits/sec   0.250 ms    0/   90 (0%)&#xA;[  3] 10.0-11.0 sec   128 KBytes  1.05 Mbits/sec   0.275 ms    0/   89 (0%)&#xA;[  3] 11.0-12.0 sec   128 KBytes  1.05 Mbits/sec   0.299 ms    0/   89 (0%)&#xA;[  3] 12.0-13.0 sec   128 KBytes  1.05 Mbits/sec   0.327 ms    0/   89 (0%)&#xA;[  3] 13.0-14.0 sec   128 KBytes  1.05 Mbits/sec   0.290 ms    0/   89 (0%)&#xA;[  3] 14.0-15.0 sec   128 KBytes  1.05 Mbits/sec   0.251 ms    0/   89 (0%)&#xA;[  3] 15.0-16.0 sec   128 KBytes  1.05 Mbits/sec   0.275 ms    0/   89 (0%)&#xA;[  3] 16.0-17.0 sec   128 KBytes  1.05 Mbits/sec   0.303 ms    0/   89 (0%)&#xA;[  3] 17.0-18.0 sec   128 KBytes  1.05 Mbits/sec   0.333 ms    0/   89 (0%)&#xA;[  3] 18.0-19.0 sec   128 KBytes  1.05 Mbits/sec   0.294 ms    0/   89 (0%)&#xA;[  3] 19.0-20.0 sec   131 KBytes  1.07 Mbits/sec   0.281 ms    0/   91 (0%)&#xA;[  3]  0.0-20.0 sec  2.50 MBytes  1.05 Mbits/sec   0.305 ms    0/ 1785 (0%)&#xA;&#xA;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&#xA;C:\iperf-2.0.5-2-win32&gt;iperf -c 192.168.191.200 -i 1 -t 20 -r -u -b 5m&#xA;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&#xA;------------------------------------------------------------&#xA;Server listening on UDP port 5001&#xA;Receiving 1470 byte datagrams&#xA;UDP buffer size: 64.0 KByte (default)&#xA;------------------------------------------------------------&#xA;------------------------------------------------------------&#xA;Client connecting to 192.168.191.200, UDP port 5001&#xA;Sending 1470 byte datagrams&#xA;UDP buffer size: 64.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  4] local 192.168.191.201 port 61760 connected with 192.168.191.200 port 5001&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  4]  0.0- 1.0 sec   610 KBytes  5.00 Mbits/sec&#xA;[  4]  1.0- 2.0 sec   609 KBytes  4.99 Mbits/sec&#xA;[  4]  2.0- 3.0 sec   610 KBytes  5.00 Mbits/sec&#xA;[  4]  3.0- 4.0 sec   609 KBytes  4.99 Mbits/sec&#xA;[  4]  4.0- 5.0 sec   610 KBytes  5.00 Mbits/sec&#xA;[  4]  5.0- 6.0 sec   609 KBytes  4.99 Mbits/sec&#xA;[  4]  6.0- 7.0 sec   610 KBytes  5.00 Mbits/sec&#xA;[  4]  7.0- 8.0 sec   609 KBytes  4.99 Mbits/sec&#xA;[  4]  8.0- 9.0 sec   610 KBytes  5.00 Mbits/sec&#xA;[  4]  9.0-10.0 sec   619 KBytes  5.07 Mbits/sec&#xA;[  4] 10.0-11.0 sec   610 KBytes  5.00 Mbits/sec&#xA;[  4] 11.0-12.0 sec   609 KBytes  4.99 Mbits/sec&#xA;[  4] 12.0-13.0 sec   609 KBytes  4.99 Mbits/sec&#xA;[  4] 13.0-14.0 sec   610 KBytes  5.00 Mbits/sec&#xA;[  4] 14.0-15.0 sec   609 KBytes  4.99 Mbits/sec&#xA;[  4] 15.0-16.0 sec   610 KBytes  5.00 Mbits/sec&#xA;[  4] 16.0-17.0 sec   609 KBytes  4.99 Mbits/sec&#xA;[  4] 17.0-18.0 sec   610 KBytes  5.00 Mbits/sec&#xA;[  4] 18.0-19.0 sec   619 KBytes  5.07 Mbits/sec&#xA;[  4] 19.0-20.0 sec   609 KBytes  4.99 Mbits/sec&#xA;[  4]  0.0-20.0 sec  11.9 MBytes  5.00 Mbits/sec&#xA;[  4] Sent 8504 datagrams&#xA;[  4] Server Report:&#xA;[  4]  0.0-20.0 sec  11.9 MBytes  4.99 Mbits/sec   0.000 ms   12/ 8503 (0.14%)&#xA;[  4]  0.0-20.0 sec  1 datagrams received out-of-order&#xA;[  3] local 192.168.191.201 port 5001 connected with 192.168.191.200 port 50750&#xA;[  3]  0.0- 1.0 sec   606 KBytes  4.96 Mbits/sec   2.238 ms    1/  423 (0.24%)&#xA;[  3]  1.0- 2.0 sec   610 KBytes  5.00 Mbits/sec   2.739 ms    0/  425 (0%)&#xA;[  3]  2.0- 3.0 sec   609 KBytes  4.99 Mbits/sec   3.089 ms    1/  425 (0.24%)&#xA;[  3]  3.0- 4.0 sec   609 KBytes  4.99 Mbits/sec   3.605 ms    0/  424 (0%)&#xA;[  3]  4.0- 5.0 sec   607 KBytes  4.97 Mbits/sec   1.954 ms    0/  423 (0%)&#xA;[  3]  5.0- 6.0 sec   612 KBytes  5.01 Mbits/sec   2.666 ms    0/  426 (0%)&#xA;[  3]  6.0- 7.0 sec   607 KBytes  4.97 Mbits/sec   2.602 ms    0/  423 (0%)&#xA;[  3]  7.0- 8.0 sec   612 KBytes  5.01 Mbits/sec   2.960 ms    0/  426 (0%)&#xA;[  3]  8.0- 9.0 sec   609 KBytes  4.99 Mbits/sec   2.512 ms    0/  424 (0%)&#xA;[  3]  9.0-10.0 sec   619 KBytes  5.07 Mbits/sec   2.133 ms    0/  431 (0%)&#xA;[  3] 10.0-11.0 sec   609 KBytes  4.99 Mbits/sec   3.605 ms    1/  425 (0.24%)&#xA;[  3] 11.0-12.0 sec   609 KBytes  4.99 Mbits/sec   2.509 ms    0/  424 (0%)&#xA;[  3] 12.0-13.0 sec   610 KBytes  5.00 Mbits/sec   3.570 ms    0/  425 (0%)&#xA;[  3] 13.0-14.0 sec   609 KBytes  4.99 Mbits/sec   3.077 ms    1/  425 (0.24%)&#xA;[  3] 14.0-15.0 sec   609 KBytes  4.99 Mbits/sec   2.679 ms    0/  424 (0%)&#xA;[  3] 15.0-16.0 sec   609 KBytes  4.99 Mbits/sec   1.887 ms    0/  424 (0%)&#xA;[  3] 16.0-17.0 sec   610 KBytes  5.00 Mbits/sec   2.651 ms    0/  425 (0%)&#xA;[  3] 17.0-18.0 sec   609 KBytes  4.99 Mbits/sec   3.390 ms    0/  424 (0%)&#xA;[  3] 18.0-19.0 sec   617 KBytes  5.06 Mbits/sec   2.601 ms    0/  430 (0%)&#xA;[  3] 19.0-20.0 sec   612 KBytes  5.01 Mbits/sec   3.525 ms    0/  426 (0%)&#xA;[  3]  0.0-20.0 sec  11.9 MBytes  4.99 Mbits/sec   3.156 ms    3/ 8503 (0.035%)&#xA;[  3]  0.0-20.0 sec  1 datagrams received out-of-order&#xA;&#xA;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&#xA;C:\iperf-2.0.5-2-win32&gt;iperf -c 192.168.191.200 -i 1 -t 20 -r -u -b 9m&#xA;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&#xA;------------------------------------------------------------&#xA;Server listening on UDP port 5001&#xA;Receiving 1470 byte datagrams&#xA;UDP buffer size: 64.0 KByte (default)&#xA;------------------------------------------------------------&#xA;------------------------------------------------------------&#xA;Client connecting to 192.168.191.200, UDP port 5001&#xA;Sending 1470 byte datagrams&#xA;UDP buffer size: 64.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  4] local 192.168.191.201 port 61761 connected with 192.168.191.200 port 5001&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  4]  0.0- 1.0 sec  1.07 MBytes  9.00 Mbits/sec&#xA;[  4]  1.0- 2.0 sec  1.07 MBytes  8.98 Mbits/sec&#xA;[  4]  2.0- 3.0 sec  1.07 MBytes  9.00 Mbits/sec&#xA;[  4]  3.0- 4.0 sec  1.07 MBytes  8.98 Mbits/sec&#xA;[  4]  4.0- 5.0 sec  1.07 MBytes  9.00 Mbits/sec&#xA;[  4]  5.0- 6.0 sec  1.07 MBytes  8.98 Mbits/sec&#xA;[  4]  6.0- 7.0 sec  1.07 MBytes  8.98 Mbits/sec&#xA;[  4]  7.0- 8.0 sec  1.07 MBytes  9.00 Mbits/sec&#xA;[  4]  8.0- 9.0 sec  1.07 MBytes  8.98 Mbits/sec&#xA;[  4]  9.0-10.0 sec  1.09 MBytes  9.14 Mbits/sec&#xA;[  4] 10.0-11.0 sec  1.07 MBytes  9.00 Mbits/sec&#xA;[  4] 11.0-12.0 sec  1.07 MBytes  8.98 Mbits/sec&#xA;[  4] 12.0-13.0 sec  1.07 MBytes  8.98 Mbits/sec&#xA;[  4] 13.0-14.0 sec  1.07 MBytes  9.00 Mbits/sec&#xA;[  4] 14.0-15.0 sec  1.07 MBytes  8.98 Mbits/sec&#xA;[  4] 15.0-16.0 sec  1.07 MBytes  9.00 Mbits/sec&#xA;[  4] 16.0-17.0 sec  1.07 MBytes  8.98 Mbits/sec&#xA;[  4] 17.0-18.0 sec  1.07 MBytes  8.98 Mbits/sec&#xA;[  4] 18.0-19.0 sec  1.09 MBytes  9.14 Mbits/sec&#xA;[  4] 19.0-20.0 sec  1.07 MBytes  9.00 Mbits/sec&#xA;[  4]  0.0-20.0 sec  21.5 MBytes  9.00 Mbits/sec&#xA;[  4] Sent 15315 datagrams&#xA;[  4] Server Report:&#xA;[  4]  0.0-20.0 sec  21.3 MBytes  8.94 Mbits/sec   0.104 ms   96/15314 (0.63%)  !!!!!!!!!!&#xA;[  4]  0.0-20.0 sec  1 datagrams received out-of-order&#xA;[  3] local 192.168.191.201 port 5001 connected with 192.168.191.200 port 50751&#xA;[  3]  0.0- 1.0 sec  1.06 MBytes  8.89 Mbits/sec   2.405 ms    0/  756 (0%)&#xA;[  3]  1.0- 2.0 sec  1.07 MBytes  9.00 Mbits/sec   2.308 ms    0/  765 (0%)&#xA;[  3]  2.0- 3.0 sec  1.07 MBytes  9.00 Mbits/sec   2.305 ms    0/  765 (0%)&#xA;[  3]  3.0- 4.0 sec  1.07 MBytes  8.97 Mbits/sec   2.290 ms    1/  764 (0.13%)&#xA;[  3]  4.0- 5.0 sec  1.07 MBytes  8.98 Mbits/sec   2.271 ms    1/  765 (0.13%)&#xA;[  3]  5.0- 6.0 sec  1.07 MBytes  8.98 Mbits/sec   2.313 ms    0/  764 (0%)&#xA;[  3]  6.0- 7.0 sec  1.07 MBytes  9.00 Mbits/sec   2.191 ms    0/  765 (0%)&#xA;[  3]  7.0- 8.0 sec  1.07 MBytes  8.95 Mbits/sec   2.314 ms    3/  764 (0.39%)&#xA;[  3]  8.0- 9.0 sec  1.07 MBytes  8.98 Mbits/sec   2.232 ms    1/  765 (0.13%)&#xA;[  3]  9.0-10.0 sec  1.09 MBytes  9.13 Mbits/sec   2.257 ms    0/  776 (0%)&#xA;[  3] 10.0-11.0 sec  1.07 MBytes  8.98 Mbits/sec   2.365 ms    0/  764 (0%)&#xA;[  3] 11.0-12.0 sec  1.07 MBytes  8.98 Mbits/sec   2.301 ms    1/  765 (0.13%)&#xA;[  3] 12.0-13.0 sec  1.07 MBytes  8.98 Mbits/sec   2.277 ms    0/  764 (0%)&#xA;[  3] 13.0-14.0 sec  1.07 MBytes  9.00 Mbits/sec   2.323 ms    0/  765 (0%)&#xA;[  3] 14.0-15.0 sec  1.07 MBytes  9.00 Mbits/sec   2.176 ms    0/  765 (0%)&#xA;[  3] 15.0-16.0 sec  1.07 MBytes  8.96 Mbits/sec   2.273 ms    2/  764 (0.26%)&#xA;[  3] 16.0-17.0 sec  1.07 MBytes  8.98 Mbits/sec   2.313 ms    0/  764 (0%)&#xA;[  3] 17.0-18.0 sec  1.07 MBytes  8.98 Mbits/sec   2.247 ms    1/  765 (0.13%)&#xA;[  3] 18.0-19.0 sec  1.09 MBytes  9.11 Mbits/sec   2.276 ms    1/  776 (0.13%)&#xA;[  3] 19.0-20.0 sec  1.07 MBytes  8.97 Mbits/sec   2.394 ms    1/  764 (0.13%)&#xA;[  3]  0.0-20.0 sec  21.5 MBytes  8.99 Mbits/sec   2.659 ms   11/15314 (0.072%)&#xA;[  3]  0.0-20.0 sec  1 datagrams received out-of-order&#xA;&#xA;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&#xA;C:\iperf-2.0.5-2-win32&gt;iperf -c 192.168.191.200 -i 1 -t 20 -r -u -b 9850k&#xA;++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++&#xA;------------------------------------------------------------&#xA;Server listening on UDP port 5001&#xA;Receiving 1470 byte datagrams&#xA;UDP buffer size: 64.0 KByte (default)&#xA;------------------------------------------------------------&#xA;------------------------------------------------------------&#xA;Client connecting to 192.168.191.200, UDP port 5001&#xA;Sending 1470 byte datagrams&#xA;UDP buffer size: 64.0 KByte (default)&#xA;------------------------------------------------------------&#xA;[  4] local 192.168.191.201 port 61762 connected with 192.168.191.200 port 5001&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  4]  0.0- 1.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4]  1.0- 2.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4]  2.0- 3.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4]  3.0- 4.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4]  4.0- 5.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4]  5.0- 6.0 sec  1.17 MBytes  9.83 Mbits/sec&#xA;[  4]  6.0- 7.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4]  7.0- 8.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4]  8.0- 9.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4]  9.0-10.0 sec  1.19 MBytes  10.0 Mbits/sec&#xA;[  4] 10.0-11.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4] 11.0-12.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4] 12.0-13.0 sec  1.17 MBytes  9.83 Mbits/sec&#xA;[  4] 13.0-14.0 sec  1.17 MBytes  9.85 Mbits/sec&#xA;[  4] 14.0-15.0 sec  1.17 MBytes  9.83 Mbits/sec&#xA;[  4] 15.0-16.0 sec  1.17 MBytes  9.85 Mbits/sec&#xA;[  4] 16.0-17.0 sec  1.17 MBytes  9.83 Mbits/sec&#xA;[  4] 17.0-18.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4] 18.0-19.0 sec  1.19 MBytes  10.0 Mbits/sec&#xA;[  4] 19.0-20.0 sec  1.17 MBytes  9.84 Mbits/sec&#xA;[  4]  0.0-20.0 sec  23.5 MBytes  9.85 Mbits/sec&#xA;[  4] Sent 16765 datagrams&#xA;[  4] Server Report:&#xA;[  4]  0.0-20.0 sec  23.3 MBytes  9.74 Mbits/sec   3.421 ms  156/16764 (0.93%) !!!!!!!!!!&#xA;[  4]  0.0-20.0 sec  1 datagrams received out-of-order&#xA;[  3] local 192.168.191.201 port 5001 connected with 192.168.191.200 port 50752&#xA;[  3]  0.0- 1.0 sec  1.16 MBytes  9.74 Mbits/sec   2.131 ms    0/  828 (0%)&#xA;[  3]  1.0- 2.0 sec  1.17 MBytes  9.84 Mbits/sec   2.140 ms    0/  837 (0%)&#xA;[  3]  2.0- 3.0 sec  1.17 MBytes  9.83 Mbits/sec   2.099 ms    1/  837 (0.12%)&#xA;[  3]  3.0- 4.0 sec  1.17 MBytes  9.84 Mbits/sec   2.113 ms    0/  837 (0%)&#xA;[  3]  4.0- 5.0 sec  1.17 MBytes  9.84 Mbits/sec   2.105 ms    0/  837 (0%)&#xA;[  3]  5.0- 6.0 sec  1.17 MBytes  9.83 Mbits/sec   2.058 ms    1/  837 (0.12%)&#xA;[  3]  6.0- 7.0 sec  1.17 MBytes  9.82 Mbits/sec   2.165 ms    1/  836 (0.12%)&#xA;[  3]  7.0- 8.0 sec  1.17 MBytes  9.84 Mbits/sec   2.156 ms    0/  837 (0%)&#xA;[  3]  8.0- 9.0 sec  1.17 MBytes  9.82 Mbits/sec   2.135 ms    2/  837 (0.24%)&#xA;[  3]  9.0-10.0 sec  1.19 MBytes  9.97 Mbits/sec   2.152 ms    2/  850 (0.24%)&#xA;[  3] 10.0-11.0 sec  1.17 MBytes  9.83 Mbits/sec   2.153 ms    1/  837 (0.12%)&#xA;[  3] 11.0-12.0 sec  1.17 MBytes  9.84 Mbits/sec   2.127 ms    0/  837 (0%)&#xA;[  3] 12.0-13.0 sec  1.17 MBytes  9.83 Mbits/sec   2.136 ms    1/  837 (0.12%)&#xA;[  3] 13.0-14.0 sec  1.17 MBytes  9.82 Mbits/sec   2.087 ms    2/  837 (0.24%)&#xA;[  3] 14.0-15.0 sec  1.17 MBytes  9.83 Mbits/sec   2.061 ms    1/  837 (0.12%)&#xA;[  3] 15.0-16.0 sec  1.17 MBytes  9.84 Mbits/sec   2.045 ms    0/  837 (0%)&#xA;[  3] 16.0-17.0 sec  1.17 MBytes  9.82 Mbits/sec   2.203 ms    1/  836 (0.12%)&#xA;[  3] 17.0-18.0 sec  1.17 MBytes  9.84 Mbits/sec   2.165 ms    0/  837 (0%)&#xA;[  3] 18.0-19.0 sec  1.17 MBytes  9.83 Mbits/sec   2.154 ms    1/  837 (0.12%)&#xA;[  3] 19.0-20.0 sec  1.19 MBytes  9.98 Mbits/sec   2.209 ms    0/  849 (0%)&#xA;[  3]  0.0-20.0 sec  23.5 MBytes  9.84 Mbits/sec   2.548 ms   13/16764 (0.078%)&#xA;[  3]  0.0-20.0 sec  1 datagrams received out-of-order&#xA;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h2&gt;The real question remains&lt;/h2&gt;&#xA;&lt;p&gt;We are not oversubscribing the DC link since it's at 100Mbps and cannot send more than 100Mbps. However the remote sites are at 10Mbps.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are the buffers at the remote side overflowing and dropping packets?&lt;/li&gt;&#xA;&lt;li&gt;Is the provider's traffic shaper doing something to the traffic? (Would the traffic coming from another node be influenced by the ISPs traffic shaper or only the traffic ingressing the node (from outside))...... You see what I mean?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Why can't TCP handle that all on its own?&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;h3&gt;Update #3&lt;/h3&gt;&#xA;&lt;p&gt;I tried the following scenario:&lt;/p&gt;&#xA;&lt;pre&gt;&#xA;&#xA;    Laptop ------- ... LAN ... --- DC switch --- Metro-Eth --- Laptop (directly connected)&#xA;    NIC@10Mbps                       100Mbps                  NIC@10Mbps&#xA;&#xA;Here is the packet loss in the DC-&gt;remote direction: (iperf 9 Mbps UDP test)&#xA;&#xA;    [  3] local 192.168.191.200 port 5001 connected with 192.168.191.201 port 55236&#xA;    [ ID] Interval       Transfer     Bandwidth        Jitter   Lost/Total Datagrams&#xA;    [  3]  0.0- 1.0 sec   912 KBytes  7.47 Mbits/sec   2.713 ms    0/  635 (0%)&#xA;    [  3]  1.0- 2.0 sec  1001 KBytes  8.20 Mbits/sec   2.168 ms    0/  697 (0%)&#xA;    [  3]  2.0- 3.0 sec  1001 KBytes  8.20 Mbits/sec   2.478 ms    0/  697 (0%)&#xA;    [  3]  3.0- 4.0 sec   999 KBytes  8.18 Mbits/sec   0.933 ms    0/  696 (0%)&#xA;    [  3]  4.0- 5.0 sec  1001 KBytes  8.20 Mbits/sec   2.620 ms    0/  697 (0%)&#xA;    [  3]  5.0- 6.0 sec  1001 KBytes  8.20 Mbits/sec   2.721 ms    0/  697 (0%)&#xA;    [  3]  6.0- 7.0 sec  1001 KBytes  8.20 Mbits/sec   2.089 ms    0/  697 (0%)&#xA;    [  3]  7.0- 8.0 sec   999 KBytes  8.18 Mbits/sec   2.641 ms    0/  696 (0%)&#xA;    [  3]  8.0- 9.0 sec  1002 KBytes  8.21 Mbits/sec   0.896 ms    0/  698 (0%)&#xA;    [  3]  9.0-10.0 sec  1015 KBytes  8.31 Mbits/sec   2.557 ms    0/  707 (0%)&#xA;    [  3] 10.0-11.0 sec   999 KBytes  8.18 Mbits/sec   2.822 ms    1/  697 (0.14%)&#xA;    [  3] 11.0-12.0 sec   999 KBytes  8.18 Mbits/sec   1.551 ms    1/  697 (0.14%)&#xA;    [  3] 12.0-13.0 sec   998 KBytes  8.17 Mbits/sec   2.504 ms    2/  697 (0.29%)&#xA;    [  3] 13.0-14.0 sec   995 KBytes  8.15 Mbits/sec   2.038 ms    3/  696 (0.43%)&#xA;    [  3] 14.0-15.0 sec   991 KBytes  8.11 Mbits/sec   2.539 ms    7/  697 (1%)&#xA;    [  3] 15.0-16.0 sec   992 KBytes  8.13 Mbits/sec   2.759 ms    6/  697 (0.86%)&#xA;    [  3] 16.0-17.0 sec   998 KBytes  8.17 Mbits/sec   2.229 ms    2/  697 (0.29%)&#xA;    [  3] 17.0-18.0 sec   993 KBytes  8.14 Mbits/sec   2.723 ms    4/  696 (0.57%)&#xA;    [  3] 18.0-19.0 sec   998 KBytes  8.17 Mbits/sec   2.038 ms    2/  697 (0.29%)&#xA;    [  3] 19.0-20.0 sec  1012 KBytes  8.29 Mbits/sec   2.575 ms    3/  708 (0.42%)&#xA;    [  3]  0.0-20.0 sec  19.5 MBytes  8.15 Mbits/sec   2.775 ms   31/13917 (0.22%)&#xA;    [  3]  0.0-20.0 sec  1 datagrams received out-of-order&#xA;&#xA;&lt;/pre&gt;&#xA;&lt;p&gt;The other direction is fine. &lt;em&gt;However&lt;/em&gt;, when running a TCP test the remote-&amp;gt;DC direction does not perform much better than the DC-&amp;gt;remote direction (about 5Mbps)...&lt;/p&gt;&#xA;&lt;p&gt;I'm not sure we reached the bottom of this.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="775" LastEditDate="2021-10-01T11:37:27.933" LastActivityDate="2021-10-01T11:37:27.933" Title="Troubleshooting low Metro Ethernet TCP throughput" Tags="|ethernet|tcp|troubleshooting|packet-analysis|metro-ethernet|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="10176" PostTypeId="2" ParentId="10170" CreationDate="2014-07-29T17:45:00.627" Score="5" Body="&lt;p&gt;In this case, your router talks PPP to the &lt;strong&gt;provider&lt;/strong&gt; directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But first, the router puts this data into Ethernet frames which it transmits to the modem. (hence PPP-over-Ethernet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the modem is in bridge-mode, it won't interpret the frames, only encapsulate them itself in AAL (ATM Adaption Layer) or whatever in order to transmit over the public network to the provider. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The provider then authenticates you etc.pp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other cases:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&quot;half-bridging&quot;&lt;/strong&gt;: the modem performs the PPP authentication for you but doesn't do natting or anything but forwards the Ethernet traffic to an internal host/router which is supposed to do the rest&lt;/li&gt;&#xA;&lt;li&gt;Finally, the modem can also assume the role of a &lt;strong&gt;router&lt;/strong&gt;, in which it does the PPP, NATting/routing, etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2014-07-29T17:45:00.627" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10179" PostTypeId="2" ParentId="10173" CreationDate="2014-07-29T20:52:39.947" Score="-1" Body="&lt;p&gt;If you are on a cisco device use &lt;code&gt;show cdp neighbors&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That will show all Cisco devices that are directly connected. Helpful for spotting Network devices. You will not get workstation info, but other cisco switches, routers, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also get some IP phones on that list.&lt;/p&gt;&#xA;" OwnerUserId="7727" LastActivityDate="2014-07-29T20:52:39.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10182" PostTypeId="1" AcceptedAnswerId="10183" CreationDate="2014-07-29T22:38:20.400" Score="3" ViewCount="2413" Body="&lt;p&gt;I've just set up a rack with a SFP input into a Dell N2024, with a /28 routed to the switch which I can then use as required for devices within the rest of the rack.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is working fine from a single setup point of view, but I'd also bought an additional switch, under the guise that they'd be setup to redundantly fail over should the first switch fail.  The network engineers haven't done this though as part of the original installation and now I've got to work out how to complete the redundancy setup.  I've not had much experience with these switches though (or setting them up in a redundant fashion before)..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like I've got two options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Firstly, get the switch setup how we want it, then copy it's config to the second, although it's a critical service, I'd be happy with a manual move to the switch below (i.e in the unlikely case of complete switch failure some downtime whilst the switches were swapped wouldn't be a huge issue)&lt;/li&gt;&#xA;&lt;li&gt;Secondly, work out how and what the process is, to set these switches up in a redundant fashion.  Am I right in assuming, I'd need a second fibre in (for the SFP port the second switch), as well as dual outputs to each router/firewall?  What are the technologies involved in this process?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any help is much appreciated&lt;/p&gt;&#xA;" OwnerUserId="7728" LastActivityDate="2014-07-29T22:53:58.833" Title="Switch Redundancy with Dell N2000 series switches" Tags="|switch|redundancy|dell|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10183" PostTypeId="2" ParentId="10182" CreationDate="2014-07-29T22:53:58.833" Score="2" Body="&lt;p&gt;Since your switch is stackable, you could configure link aggregation between your devices and your switches, being one interface on one switch and another interface on the other switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should any of the switches fail, all traffic would still be able to reach destination with a few packet drops but quick convergence without the need to reconfigure. As a bonus, you'd get double bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This switch (as a stack) can be configured with up to 128 LAGGs.&lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-07-29T22:53:58.833" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10184" PostTypeId="1" AcceptedAnswerId="10185" CreationDate="2014-07-30T00:46:04.953" Score="4" ViewCount="8961" Body="&lt;p&gt;When trying to update an Aironet 1262 to a new firmware, I received this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap#archive download-sw /overwrite scp://root@10.10.10.10/ap3g1-k9w8-tar.152-4.JB5.tar&#xA;Unable to create temp dir &quot;flash:/update&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My first thought is that the flash was full. Which is odd since normally updating the firmware, I overwrite the old firmware. However, even &lt;code&gt;dir&lt;/code&gt; resulted in an error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap#dir&#xA;%Error opening flash:/ (Invalid argument)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I resolve this issue without trying a reboot of the AP and risking it not booting due to a flash error?&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2014-07-30T00:46:04.953" Title="What would cause 'Unable to create temp dir &quot;flash:/update&quot;' when updating Cisco AP?" Tags="|cisco|wireless|aironet|cisco-wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10185" PostTypeId="2" ParentId="10184" CreationDate="2014-07-30T00:46:04.953" Score="5" Body="&lt;p&gt;Many Cisco devices include the &lt;code&gt;fsck&lt;/code&gt; command to check the file system with. If you run this command on the flash, it will attempt to fix file system errors for you. These were my results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap#fsck flash:&#xA;Fsck operation may take a while. Continue? [confirm]&#xA;flashfs[3]: WARNING - Unable to allocate backup blocks.&#xA;Please free some space on the flash file system.&#xA;flashfs[3]: 202 files, 7 directories&#xA;flashfs[3]: 0 orphaned files, 0 orphaned directories&#xA;flashfs[3]: Total bytes: 31610880&#xA;flashfs[3]: Bytes used: 31610880&#xA;flashfs[3]: Bytes available: 0&#xA;flashfs[3]: flashfs fsck took 19 seconds.&#xA;Fsck of flash: complete&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well, this appears to have proved that the file system is full. But did it fix the issue with the flash system so I could look at the flash system to find files to delete? Yes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap#dir&#xA;Directory of flash:/&#xA;&#xA;    2  -rwx          64   Mar 1 1993 00:03:30 +00:00  sensord_CSPRNG0&#xA;    3  -rwx    12257280   Mar 1 2002 00:44:20 +00:00  ap3g1-k9w7-tar.152-2.JB.tar&#xA;    4  -rwx        1864   Mar 1 1993 00:04:03 +00:00  backup.config&#xA;    5  -rwx      294235   Apr 3 2014 22:01:12 +00:00  ap_log_r1_0.log&#xA;    6  -rwx           0   Apr 4 2014 08:12:42 +00:00  env_vars.tmp&#xA;    7  -rwx        2072   Mar 1 1993 20:26:00 +00:00  private-multiple-fs&#xA;    8  drwx         832   Mar 1 2002 00:54:21 +00:00  ap3g1-k9w7-mx.152-2.JB&#xA;   11  -rwx        3567   Mar 1 1993 20:26:00 +00:00  private-config&#xA;   12  -rwx          64   Apr 3 2014 22:16:37 +00:00  sensord_CSPRNG1&#xA;   13  -rwx       25960   Mar 1 1993 01:05:43 +00:00  event.log&#xA;   14  -rwx           4  Feb 18 2014 21:02:33 +00:00  FOC16441UX9&#xA;   15  -rwx      158878   Mar 7 1993 20:49:30 +00:00  event.r1&#xA;   16  -rwx      294235   Apr 3 2014 22:01:17 +00:00  ap_log_r1_1.log&#xA;   17  -rwx      294235   Apr 3 2014 22:01:22 +00:00  ap_log_r1_2.log&#xA;   18  -rwx     6111232   Apr 3 2014 22:16:23 +00:00  r1.rcore&#xA;   19  -rwx           0   Apr 3 2014 22:16:27 +00:00  r1.rcore.info&#xA;   20  -rwx         217   Apr 3 2014 20:16:20 +00:00  env_vars&#xA;&#xA;31610880 bytes total (0 bytes free)&#xA;ap#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see why the file system is full, someone copied a firmware tarball direct to the AP's flash instead of using the archive command to pull it remotely. Easy fix though, just delete the tarball:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap#del flash:ap3g1-k9w7-tar.152-2.JB.tar&#xA;Delete filename [ap3g1-k9w7-tar.152-2.JB.tar]? &#xA;Delete flash:/ap3g1-k9w7-tar.152-2.JB.tar? [confirm]&#xA;ap#dir&#xA;Directory of flash:/&#xA;&#xA;    2  -rwx          64   Mar 1 1993 00:03:30 +00:00  sensord_CSPRNG0&#xA;    4  -rwx        1864   Mar 1 1993 00:04:03 +00:00  backup.config&#xA;    5  -rwx      294235   Apr 3 2014 22:01:12 +00:00  ap_log_r1_0.log&#xA;    6  -rwx           0   Apr 4 2014 08:12:42 +00:00  env_vars.tmp&#xA;    7  -rwx        2072   Mar 1 1993 20:26:00 +00:00  private-multiple-fs&#xA;    8  drwx         832   Mar 1 2002 00:54:21 +00:00  ap3g1-k9w7-mx.152-2.JB&#xA;   11  -rwx        3567   Mar 1 1993 20:26:00 +00:00  private-config&#xA;   12  -rwx          64   Apr 3 2014 22:16:37 +00:00  sensord_CSPRNG1&#xA;   13  -rwx       25960   Mar 1 1993 01:05:43 +00:00  event.log&#xA;   14  -rwx           4  Feb 18 2014 21:02:33 +00:00  FOC16441UX9&#xA;   15  -rwx      158878   Mar 7 1993 20:49:30 +00:00  event.r1&#xA;   16  -rwx      294235   Apr 3 2014 22:01:17 +00:00  ap_log_r1_1.log&#xA;   17  -rwx      294235   Apr 3 2014 22:01:22 +00:00  ap_log_r1_2.log&#xA;   18  -rwx     6111232   Apr 3 2014 22:16:23 +00:00  r1.rcore&#xA;   19  -rwx           0   Apr 3 2014 22:16:27 +00:00  r1.rcore.info&#xA;   20  -rwx         217   Apr 3 2014 20:16:20 +00:00  env_vars&#xA;&#xA;31610880 bytes total (12257280 bytes free)&#xA;ap#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ok, file system fixed. Free space created. Did all of this fix the original issue of updating the firmware? Yes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap#archive download-sw /overwrite scp://root@10.10.10.10/ap3g1-k9w8-tar.152-4.JB5.tar&#xA;examining image...&#xA;Password: &#xA; Sending file modes: C0644 10475520 ap3g1-k9w8-tar.152-4.JB5.tar&#xA;&#xA;extracting info (286 bytes)&#xA;Image info:&#xA;    Version Suffix: k9w8-.152-4.JB5&#xA;    Image Name: ap3g1-k9w8-mx.152-4.JB5&#xA;    Version Directory: ap3g1-k9w8-mx.152-4.JB5&#xA;    Ios Image Size: 594432&#xA;    Total Image Size: 10465792&#xA;    Image Feature: WIRELESS LAN|LWAPP&#xA;    Image Family: AP3G1&#xA;    Wireless Switch Management Version: 7.6.100.0&#xA;Extracting files...!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2014-07-30T00:46:04.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10189" PostTypeId="2" ParentId="10142" CreationDate="2014-07-30T05:01:46.827" Score="6" Body="&lt;p&gt;Great question! You're right in thinking that it is a function of your object-group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have ACL optimisation activated. This is activated via the global CLI command &lt;a href=&quot;https://supportforums.cisco.com/discussion/9490991/object-group-search-command&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;object-group-search access-control&lt;/code&gt;&lt;/a&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ACL optimisation collapses all the possible ACE combinations for source/destination addresses and ports back into your original objects. The numbers in parentheses are the amount of entries that have been collapsed into that single entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When ACL optimisation is disabled, the &lt;code&gt;show access-list&lt;/code&gt; command will show you the expanded entries instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://supportforums.cisco.com/discussion/9490991/object-group-search-command&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;object-group-search access-control&lt;/code&gt;&lt;/a&gt; command is service affecting and will drop connections while it is performing the algorithm.&lt;/p&gt;&#xA;" OwnerUserId="7730" LastEditorUserId="775" LastEditDate="2014-07-31T07:51:47.420" LastActivityDate="2014-07-31T07:51:47.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10191" PostTypeId="1" AcceptedAnswerId="10206" CreationDate="2014-07-30T07:22:53.207" Score="1" ViewCount="483" Body="&lt;p&gt;I want to add 1000M and SFP TX ports as LACP trunk members but am unable to so because the selection is only for ports 1-24. Is there a way to overcome this?  I have a TP-Link TL-SL2428WEB switch. &lt;/p&gt;&#xA;" OwnerUserId="7736" LastEditorUserId="775" LastEditDate="2014-07-30T11:06:13.177" LastActivityDate="2014-07-30T18:40:57.213" Title="How to add Giga and SFP ports as LACP trunk members" Tags="|switch|trunk|ieee-802.1ax|" AnswerCount="1" CommentCount="0" ClosedDate="2019-05-18T00:51:38.900" ContentLicense="CC BY-SA 3.0" />
  <row Id="10192" PostTypeId="1" CreationDate="2014-07-30T07:27:05.290" Score="2" ViewCount="7953" Body="&lt;p&gt;We have four hotels in different locations, and all hotels have their own server. The main server is in another hotel. Now I want to access applications from the main server at another hotel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I connect them?&lt;/p&gt;&#xA;" OwnerUserId="7735" LastEditorUserId="44" LastEditDate="2014-07-30T16:57:34.077" LastActivityDate="2014-07-31T07:42:17.930" Title="How can I connect two different locations through our ISP?" Tags="|vpn|design|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10193" PostTypeId="2" ParentId="10115" CreationDate="2014-07-30T07:39:00.717" Score="5" Body="&lt;p&gt;Difficult to tell because it depends on the CDR, but in general, a data session in a mobile network refers to a &quot;PDP context&quot;. A PDP context is the state kept for a user in the SGSN and GGSN (in a 3G network) and down to the UA (your phone) via RNCs and the NodeBs (&quot;base stations&quot;). The actual protocol used between GGSN and SGSN is a GTP tunnel while from the SGSN to RNCs you have an interface called IuPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PDP context typically contains start and end time as well as how many packets and bytes that have been transferred and it is likely this is the information you are seeing in the CDR. There's a bunch of other data in there as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you roam from one NodeB to another your PDP context will remain the same in SGSN. A &quot;smallish&quot; network might have two SGSNs (for redundancy purposes), typically multiple RNCs (10-100) while there are thousands of NodeBs. If you roam within the area of one RNC, the RNC will handle the roaming part and inform other nodes of the move. Note how the GTP tunnel doesn't need to change though as it remains from the SGSN to the same RNC. If you roam between two NodeBs that are connected to different RNCs, the SGSN will be involved as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To further complicate things, there is something called 3GDT which stands for Direct Tunneling. This means the GTP tunnel will be directly from the NodeB to the GGSN as to offload traffic from the SGSN. If 3GDT is used, the GGSN will naturally be involved in inter-RNC roaming as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your PDP context is only terminated if you shutdown your phone, loose reception or something goes wrong in the mobile network, so PDP contexts can easily last for days or weeks. Sometimes however, CDRs are chopped up into smaller pieces, despite the PDP context is still active. This is to make it easier to see in the CDR that the user is active, otherwise you might not get any billing data for a subscriber until the PDP context is terminated and since it can potentially live for eternity, that would make billing difficult.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Android is not really involved in this. The OS on your phone only serves to give the baseband chip in your phone some configuration data, like which APN to use and so forth. The rest is handled by the baseband chip, built by suppliers like QualComm. Many chips are used throughout different handsets from different phone producers with different operating systems so compatibility on this layer is really between the baseband chip and the mobile network and not up to the operating system on the handset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also see: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Radio_Network_Controller&quot; rel=&quot;noreferrer&quot;&gt;http://en.wikipedia.org/wiki/Radio_Network_Controller&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/GPRS_core_network&quot; rel=&quot;noreferrer&quot;&gt;http://en.wikipedia.org/wiki/GPRS_core_network&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="672" LastActivityDate="2014-07-30T07:39:00.717" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10194" PostTypeId="2" ParentId="10192" CreationDate="2014-07-30T07:44:30.693" Score="0" Body="&lt;p&gt;Sounds like you want a site-2-site IPSEC VPN. You'll need some firewall or router &#xA;(one for each location) some time and patience and / or external help to configure your setup. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-07-30T07:44:30.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10195" PostTypeId="2" ParentId="10192" CreationDate="2014-07-30T07:46:06.843" Score="2" Body="&lt;p&gt;I suppose you don't want to put public addresses on your server, so you need to create a network connecting your different locations. Either purchase a VPN from your ISP or build your own IPsec VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get a VPN from your ISP, ask for a &quot;IP VPN&quot; or &quot;L3VPN&quot; according to RFC2547/RFC4364. Feel free to throw in &quot;MPLS&quot; in the same sentence. They will often be able to provide you your VPN connectivity over a VLAN on the same physical circuits over which you purchase your Internet connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPSec means you need support in your routers and you need to manually configure those yourself (or bring in a consultant). Beware of MTU issues. Google is your friend :)&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2014-07-30T07:46:06.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10196" PostTypeId="2" ParentId="6483" CreationDate="2014-07-30T09:36:18.543" Score="42" Body="&lt;p&gt;The above answers are quite technical. Think of it this way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact VLANs and tagging is nothing more than a logical separation of networks in contrast to a physical one. Now what does that mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there were no VLANs you would need one switch for each &lt;strong&gt;broadcast domain&lt;/strong&gt;. Imagine the cabling involved and also the potential number of NICs required at the hosts. So first, VLANs allow you to have multiple independent layer 2 constructs within the same switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since now you can have multiple networks on each link/port you have to somehow be able to distinguish which packet belongs to which network. That's why they are tagged. If a port carries more than one VLAN it's also usually called a &lt;strong&gt;trunk&lt;/strong&gt;. (for n&gt;1 VLANs, at least n-1 VLANs have to be tagged and there can be one untagged VLAN, the native VLAN)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally you have to distinguish packets at port ingress (incoming &quot;from the cable&quot;) and egress (outgoing &quot;into the cable&quot;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Ingress&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;ingress untagged: this is where the native vlan of the port comes in. If the switch has multiple VLANs configured, you have to tell the switch to which VLAN an incoming untagged packet belongs ;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ingress tagged: well, if it comes in tagged, then it's tagged, and you can't do much about it. If the switch doesn't know about tagging or about that precise VLAN, it will reject it, sometimes you have to activate some kind of ingress-filter though. You can also force a port to accept untagged or tagged packets only.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Egress&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;egress untagged: for each port you can select one VLAN whose outgoing packets on that port are not tagged (e.g. because the host doesn't support it, or only one VLAN is required for example for a PC, printer, etc.) ;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;egress tagged: You have to tell the switch which VLANs to make available on the port and if more than one, all but one have to be tagged anyway.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;What happens inside the switch&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch has an FDB (&lt;strong&gt;F&lt;/strong&gt;orwarding &lt;strong&gt;D&lt;/strong&gt;ata&lt;strong&gt;B&lt;/strong&gt;ase) which&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;in a switch that is not VLAN capable (sometimes called &quot;unmanaged&quot; or &quot;dumb&quot;, ...): associates a host (MAC address) to a port: the FDB is a table comprised of tuples of two elements: (MAC, port)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;in a switch that is VLAN capable (sometimes called &quot;managed&quot; or &quot;smart&quot;, ...): associates (VLAN, MAC) tuples to a port: the FDB is a table comprised of tuples of three elements: (MAC, port, VLAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only restriction here is that one MAC address cannot appear in the same VLAN twice, even if on different ports (essentially the VLAN in VLAN-capable switches replaces the notion of port in non-VLAN-capable switches). In other words:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;There can be multiple VLANs per port (which is why there need to be tags at some point).&lt;/li&gt;&#xA;&lt;li&gt;There can be multiple VLANs per port and per MAC: the same MAC address can appear in different VLANs and on the same port (although I wouldn't recommend that for sanity purposes).&lt;/li&gt;&#xA;&lt;li&gt;The same MAC address still can&lt;strong&gt;not&lt;/strong&gt; appear on the same VLAN but on different ports (different hosts having the same MAC address in the same layer 2 network).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope this clears the confusion a little bit ;-)&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="2329" LastEditDate="2015-11-12T21:09:55.437" LastActivityDate="2015-11-12T21:09:55.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10198" PostTypeId="2" ParentId="10192" CreationDate="2014-07-30T11:10:52.960" Score="2" Body="&lt;p&gt;Depending on your ISP technology, you have several options. An IPSec or SSL VPN configured by you is the cheapest ISP-independant way to get you going. You would need an edge device to NAT, encrypt and authenticate your packets. The downside for this solution is that you need to have the expertise (or get someone who does) and depending on your current setup, get some new equipment. You wouldn't also have guaranteed bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you call your ISP and ask for a &quot;site connection product&quot; they might sell you L2VPN or L3VPN, either way the configuration is going to be pretty straight-forward (just adding a new route or just connecting the new equipment to a switch) and your ISP might provide for this extra equipment, besides, if you have a 10mbps contract, you're going to have 10mbps bandwidth, no matter the congestion on the network. The ISP will charge you more than your IPSec / SSL VPN costs for this setup. &lt;/p&gt;&#xA;" OwnerUserId="7635" LastEditorUserId="775" LastEditDate="2014-07-30T11:20:25.747" LastActivityDate="2014-07-30T11:20:25.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10202" PostTypeId="2" ParentId="10192" CreationDate="2014-07-30T13:26:23.433" Score="0" Body="&lt;p&gt;Yes you need to create a VPN, and can do it all yourself or your ISP will provide one for you. If you don't know what VPN is then maybe you will need some help to create one yourself .&lt;/p&gt;&#xA;" OwnerUserId="7740" LastActivityDate="2014-07-30T13:26:23.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10203" PostTypeId="1" AcceptedAnswerId="10204" CreationDate="2014-07-30T14:41:24.853" Score="4" ViewCount="228" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/C6JB2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in above diagram  neighbor relationship/peer relations are so &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1---&amp;gt;R2 &#xA;R1---&amp;gt;R3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2 and R3 are not directly or even indirectly (through R1)peer&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2---&amp;gt;R4&#xA;R3---&amp;gt;R6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R4 and R6 are not connected so they are no peers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4---&amp;gt;R5&#xA;R6---&amp;gt;R7&#xA;R5---&amp;gt;R7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;no problem so far, everything works just fine, R2 sees both 55.55 networks of AS 2000 and 77.77 networks of AS 1000,through their just one and only exit interfaces!!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ip bgp&#xA;&#xA;   Network          Next Hop             Metric LocPrf Weight Path&#xA;&amp;gt; 55.55.1.0/24     10.1.24.4             0 3000 2000 i&#xA;&amp;gt; 55.55.2.0/24     10.1.24.4             0 3000 2000 i&#xA;&amp;gt; 77.77.1.0/24     10.1.24.4             0 3000 2000 1000 i&#xA;&amp;gt; 77.77.2.0/24     10.1.24.4             0 3000 2000 1000 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#sh ip bgp&#xA;&#xA;   Network          Next Hop             Metric LocPrf Weight Path&#xA;&amp;gt; 55.55.1.0/24     10.1.36.6             0 3000 1000 2000 i&#xA;&amp;gt; 55.55.2.0/24     10.1.36.6             0 3000 1000 2000 i&#xA;&amp;gt; 77.77.1.0/24     10.1.36.6             0 3000 1000 i&#xA;&amp;gt; 77.77.2.0/24     10.1.36.6             0 3000 1000 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but the problem is when I add a link between R2 and R3 and make them peer instead of seeing 2 path to each of 55.55 and 77.77 network they just see one of them like that(2 paths) and for the other one just on path I mean&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config-router)#do sh ip bgp&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;&amp;gt; 55.55.1.0/24     10.1.24.4             0 3000 2000 i&#xA;&amp;gt; 55.55.2.0/24     10.1.24.4             0 3000 2000 i&#xA;&amp;gt;i77.77.1.0/24     10.1.23.3             0    100   0 3000 1000 i&#xA;                   10.1.24.4             0 3000 2000 1000 i&#xA;&amp;gt;i77.77.2.0/24     10.1.23.3             0    100   0 3000 1000 i&#xA;                   10.1.24.4             0 3000 2000 1000 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to my understanding R2 supposed to learn 55.55 networks through R3 as well I mean from this &lt;strong&gt;path R3--&gt;R6--&gt;R7--&gt;R5&lt;/strong&gt; since these routers are peer and R6 also has got the routes to 55.55 network and R7 got those too and so on, why we do not see a path through that way?&#xA;and also on R3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3(config-router)#do sh ip bgp&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;&amp;gt;i55.55.1.0/24     10.1.23.2                0    100      0 3000 2000 i&#xA;                   10.1.36.6                0 3000 1000 2000 i&#xA;&amp;gt;i55.55.2.0/24     10.1.23.2                0    100      0 3000 2000 i&#xA;                   10.1.36.6                0 3000 1000 2000 i&#xA;&amp;gt; 77.77.1.0/24     10.1.36.6                0 3000 1000 i&#xA;&amp;gt; 77.77.2.0/24     10.1.36.6                0 3000 1000 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and also R3 supposed to learn 77.77 networks through R2 as well I mean &lt;strong&gt;R2--&gt;R4--&gt;R5--&gt;R7&lt;/strong&gt;&#xA;but why this is not happening?&#xA;BTW I know the best practice is to have full iBGP between routers in the AS and also I know that we'd better have direct link between those edge routers so that no need to state or overstate the obvious best practices just answer the question straight to the point thanks.&lt;/p&gt;&#xA;" OwnerUserId="7741" LastEditorUserId="3191" LastEditDate="2014-07-30T18:33:26.457" LastActivityDate="2014-07-30T20:13:18.067" Title="Why BGP not selecting paths correctly here?" Tags="|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10204" PostTypeId="2" ParentId="10203" CreationDate="2014-07-30T14:51:00.440" Score="7" Body="&lt;p&gt;You don't say which hardware you're using but in general BGP will only choose &lt;strong&gt;one&lt;/strong&gt; best path. The one you're seeing is what BGP on the respective router has chosen as the best path. If this path becomes unavailable the router will choose another path. For example if the link between R2 and R4 fails R2 will choose the path via R3-&gt;R6 and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco devices you can see all available paths for a prefix by using &lt;code&gt;show ip bgp 55.55.2.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also if the router receives a better path from another iBGP peer then it will not send its suboptimal path to that router. This would explain why you only see one path at all. If you want to always announce the best &lt;strong&gt;external/eBGP&lt;/strong&gt; path to other iBGP routers, you can (on Cisco) use the &lt;code&gt;bgp advertise-best-external&lt;/code&gt; &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp1.html#wp1111811&quot;&gt;command&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mind you, all this assumes that you have standard iBGP setup with BGP sessions over loopback IPs and all BGP next-hops are reachable (directly or via some sort if IGP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also Cisco has a &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html&quot;&gt;good description of the BGP path selection process&lt;/a&gt; that might help you understand further why the routers chose this path.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Your Example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You establish the BGP Session between R2 and R3. What happens now?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2 receives&lt;/strong&gt; the following path information &lt;strong&gt;from R3&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;55.55.1.0/24 AS_PATH: 3000 1000 2000&lt;/li&gt;&#xA;&lt;li&gt;55.55.2.0/24 AS_PATH: 3000 1000 2000&lt;/li&gt;&#xA;&lt;li&gt;77.77.1.0/24 AS_PATH: 3000 1000&lt;/li&gt;&#xA;&lt;li&gt;77.77.2.0/24 AS_PATH: 3000 1000&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R3 receives&lt;/strong&gt; the following path information &lt;strong&gt;from R2&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;55.55.1.0/24 AS_PATH: 3000 2000&lt;/li&gt;&#xA;&lt;li&gt;55.55.2.0/24 AS_PATH: 3000 2000&lt;/li&gt;&#xA;&lt;li&gt;77.77.1.0/24 AS_PATH: 3000 2000 1000&lt;/li&gt;&#xA;&lt;li&gt;77.77.2.0/24 AS_PATH: 3000 2000 1000&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2 runs&lt;/strong&gt; it's &lt;strong&gt;best path algorithm&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has the shorter AS_PATH (3000 2000) for 55.55.1.0/24 &amp;amp; 55.55.2.0/24 so it will continue to use this path over the one received from R3 (3000 1000 2000).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 77.77.1.0/24 &amp;amp; 77.77.2.0/24 it received a better path (3000 1000) from R3 so it will use this path. &lt;strong&gt;R2 will now send a withdrawal for both prefixes with its old best path (3000 2000 1000) to R3 because it's no longer the best path!&lt;/strong&gt; The old best path from the eBGP peer is still present in R2s RIB but it's no longer the active path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;As soon as R3 receives the withdrawals it will remove the paths from its RIB.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R3 runs&lt;/strong&gt; it's &lt;strong&gt;best path algorithm&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3 does the same as R2 only for R3 its the other way round. It gets new best paths for 55.55.1.0/24 &amp;amp; 55.55.2.0/24 from R2 so it sends withdrawal for the old paths to R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;As soon as R2 receives the withdrawals it will remove the paths from its RIB.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The BGP table on both routers has now settled in the state that you have shown.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2014-07-30T20:13:18.067" LastActivityDate="2014-07-30T20:13:18.067" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="10206" PostTypeId="2" ParentId="10191" CreationDate="2014-07-30T18:22:38.673" Score="2" Body="&lt;p&gt;Quoting the user manual:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;SFP and 1000M port in TL-SL2210WEB/TL-SL2218WEB/TL-SL2428WEB/TL-SL2452WEB, is not able to be the Trunk member. (From Section 5.3.5 Port Trunking, p.57)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="619" LastEditorUserId="775" LastEditDate="2014-07-30T18:40:57.213" LastActivityDate="2014-07-30T18:40:57.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10207" PostTypeId="1" AcceptedAnswerId="10216" CreationDate="2014-07-30T18:44:52.203" Score="8" ViewCount="2032" Body="&lt;p&gt;I just read an article about the process of &quot;punching holes&quot; with the UDP protocol. I understand how it's done, but I have one last question to clear up things. We have the rendezvous server and client A,B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client A punched a hole already for client B. Client B receives the NAT IP and the NAT port from the rendezvous server and starts to send data to the same port as the rendezvous server. Let's say I happen to know a second port the NAT has open for UDP connections. Could I send my packets through this second port also? Or is the port distinguished for every outgoing UDP connection? If so, how come we can use the same port for Client B and the rendezvous server? Wouldn't the NAT open a new port when Client A punches the hole and Client B had to know what new port the NAT opened for this specific connection? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope my question is somewhat understandable.&lt;/p&gt;&#xA;" OwnerUserId="7744" LastEditorUserId="93477" LastEditDate="2024-02-12T05:01:43.310" LastActivityDate="2024-02-12T05:01:43.310" Title="UDP hole punching when NAT port distinguished for every outgoing UDP connection?" Tags="|nat|udp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="10208" PostTypeId="1" AcceptedAnswerId="10210" CreationDate="2014-07-30T20:02:31.263" Score="3" ViewCount="10240" Body="&lt;p&gt;I have to be over looking something dumb here but I can't figure it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fex is set up properly and is communicating to the Nexus 5548 without issue. There are a few other fexs connected as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interface config is bare bones at this point:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface fex100/1/1&#xA;  switchport access vlan xx&#xA;  spanning-tree port type edge&#xA;  no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried to plug other devices into the port and no link lights will come up. No errors are shown in the log. I have connected to the server via its Ethernet port from a directly connected laptop and its link lights come up no problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The vlan is already on the switch as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A show interface shows that zero traffic has crossed the link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is any other information I could provide please let me know.&lt;/p&gt;&#xA;" OwnerUserId="108" LastEditorUserId="108" LastEditDate="2014-07-30T23:06:56.297" LastActivityDate="2014-07-30T23:26:26.777" Title="interface showing &quot;Link not connected&quot; on a Nexus 2200 FEX but it is very much connected" Tags="|cisco|switch|cisco-nexus|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10209" PostTypeId="2" ParentId="10016" CreationDate="2014-07-30T22:55:12.063" Score="5" Body="&lt;p&gt;You updated to say that no UDP appears to be working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not familiar with your product, but I have seen this type of behavior when the device uses a stateful firewall and it is configured to only allow inbound &quot;established&quot; traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP will establish a connection, but UDP does not.  To allow UDP return traffic, you typically have to allow &quot;related&quot; traffic in addition to established traffic.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-07-30T22:55:12.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10210" PostTypeId="2" ParentId="10208" CreationDate="2014-07-30T23:26:26.777" Score="5" Body="&lt;p&gt;I found out the upstream 5k was in a pair so I needed to make the interface config change on both 5ks. Problem solved.&lt;/p&gt;&#xA;" OwnerUserId="108" LastActivityDate="2014-07-30T23:26:26.777" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10211" PostTypeId="2" ParentId="10192" CreationDate="2014-07-31T07:42:17.930" Score="5" Body="&lt;p&gt;&lt;strong&gt;IPSec VPN&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Virtual Private Network (VPN) over the Internet with IPSec protocols for authentication and encryption.  Using a Firewall w/VPN is typical here.  A hub-and-spoke model is generally deployed.  With hub-and-spoke, all VPN tunnels from each hotel (spoke) connects to the main hotel (hub), and spokes cannot talk directly to one another. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;L3VPN (MPLS-VPN)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPN provided by your Service Provider to tie all your sites together on private networks.  This can be done by logically separating your DIA (Direct Internet Access) traffic from your VPN.  Use a provider-managed router that you'll need to &quot;rent&quot; unless you're at an advanced level to tackle this yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;App exposure over Internet&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Expose main server applications over Internet via your main site firewall or load-balancer.  Require SSL on top of app and require application login authentication.  Could restrict access on firewall by only allowing the public source IP blocks of the hotels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PtP (Point-to-Point) links&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These could be various technologies using dedicated circuits to the main site (hub) or Metro Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IP over Avian Carriers (IPoAC)&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IPoAC has been successfully implemented, but for only nine packets of data, with a packet loss ratio of 55% (due to user error), and a response time ranging from 3000 seconds (~54 minutes) to over 6000 seconds (~1.77 hours). &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;See &lt;a href=&quot;http://en.wikipedia.org/wiki/IP_over_Avian_Carriers&quot; rel=&quot;noreferrer&quot;&gt;IPoAC&lt;/a&gt; on Wikipedia&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2014-07-31T07:42:17.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10212" PostTypeId="1" AcceptedAnswerId="10256" CreationDate="2014-07-31T08:47:04.217" Score="3" ViewCount="6514" Body="&lt;p&gt;I have network situation like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZKbU0.png&quot; alt=&quot;Problem with VPN tunel from local network to the local VPN server&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;ISP Router (modem)&lt;/strong&gt; - device given to us by our ISP - modem &amp;amp; router in one but it is set into transparent mode - ISP say so ;D we have to find it that it is true :)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;MikroTik Router (MTR)&lt;/strong&gt; - our edge router with firewall&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Server NAS &amp;amp; VPN Server (NAS)&lt;/strong&gt; - Synology box with our data storage and also with VPN server with running PPTP, OpenVPN, L2TP/IPSec services- to which workers from our local company and from remote location conect to get data&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Local station (LS)&lt;/strong&gt; - workers at our network site - they are using Windows 8 which means they use PPTP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Bellow I present our Mikrotik configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Routing table:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dst. address   | Gateway      | Distance | Pref. source   |&#xA;0.0.0.0/0      | 1.1.1.9      | 2        | -              |&#xA;1.1.1.8/30     | ether1       | -        | 1.1.1.8/30     |&#xA;192.168.1.0/24 | bridge local | -        | 192.168.1.0/24 |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Firewall:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Action | Chain | Dst. Address  | Protocol | Dst. Port |&#xA;accept | input | 192.168.1.230 | 6 (TCP)  | 1723      |&#xA;accept | input | 192.168.1.230 | 47 (GRE) | -         |&#xA;accept | input | 192.168.1.230 | 6 (TCP)  | 5006      |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NAT:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Action     | Chain  | Source Addr    | Dst Address   | Proto    | Dst Port | Out Intf   |&#xA;masquerade | srcnat | -              | -             | -        | -        | ether1     |&#xA;dstnat     | dstnat | -              | 1.1.1.10      | 6 (TCP)  | 1723     | -          |&#xA;dstnat     | dstnat | -              | 1.1.1.10      | 47 (GRE) | -        | -          |&#xA;dstnat     | dstnat | -              | 1.1.1.10      | 6 (TCP)  | 5006     | -          |&#xA;masquerade | srcnat | 192.168.1.0/24 | 192.168.1.230 | -        | -        | -          |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The last rule is used to avoid hairpin occurrence&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Rules at Mikrotik are made for now only for PPTP protocol !!!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;When people from local network try connect to the VPN serwer at NAS there is error 807 or 800 occure - it deepends from station. All are Windows 8 and Windows 7. What could be the cause ?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="6417" LastEditDate="2015-04-06T07:35:13.947" LastActivityDate="2015-04-06T07:35:13.947" Title="Problem with VPN tunel from local network to the local VPN server" Tags="|routing|vpn|nat|" AnswerCount="1" CommentCount="9" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10213" PostTypeId="1" AcceptedAnswerId="10252" CreationDate="2014-07-31T10:53:59.133" Score="6" ViewCount="2696" Body="&lt;p&gt;&lt;strong&gt;The context&lt;/strong&gt;: an Internet facing web site, streaming near real-time market prices. Paying customers can be anywhere on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The issue&lt;/strong&gt;: Customers can experience &lt;em&gt;total&lt;/em&gt; packet loss for 10s, 30s and more. This brings the TCP connection delivering the prices to a halt, thus rendering the website useless. All connectivity from the data center to the peering points have been sized correctly, and have capacity to spare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has been asserted that this is commonplace in public Internet. My gut however says no, and all of my experience as a consumer is to the contrary, however I have no hard facts to draw upon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presuming that packet loss is caused by congestion, when a route becomes congested surely the router holding that route will choose an alternate, and furthermore will do so more rapidly that 10s?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, is there any feedback available when a route congests?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;M.&lt;/p&gt;&#xA;" OwnerUserId="7751" LastEditorUserId="3191" LastEditDate="2014-07-31T15:23:59.950" LastActivityDate="2018-05-07T14:50:33.810" Title="What is an acceptable spell of total packet loss for public Internet traffic?" Tags="|routing|tcp|troubleshooting|packet-loss|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10216" PostTypeId="2" ParentId="10207" CreationDate="2014-07-31T12:18:12.430" Score="6" Body="&lt;p&gt;The NAT device will keep a table with currently open connections so that it can send return packets to the internal host that opened the connection. An entry in the state table could look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Internal Source IP | Internal S-Port | External S-Port | Destination IP | D-Port&#xA;192.168.1.12         10123             10123             203.0.113.1      5555&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When a packet is received (from the external side) the NAT device will check the &lt;strong&gt;Source IP&lt;/strong&gt;, &lt;strong&gt;Source Port&lt;/strong&gt; and &lt;strong&gt;Destination Port&lt;/strong&gt; of the packet and compare it to the &lt;code&gt;Destination IP&lt;/code&gt;, &lt;code&gt;D-Port&lt;/code&gt; and &lt;code&gt;External S-Port&lt;/code&gt; fields in its connection table. When it finds a match it will forward the packet to &lt;code&gt;Internal Source IP&lt;/code&gt; on &lt;code&gt;Internal S-Port&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UDP hole punching depends on the fact that Internal and External Source Ports are the same.&lt;/strong&gt; This is normally the case unless you have a second internal host that uses the same Source port to connect to the same external Destination/D-Port combination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we assume that Internal and External S-Port are the same then both clients A,B can communicate their source port to the rendezvous server which will then relay the information back to the other client respectively.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-07-31T12:18:12.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10217" PostTypeId="2" ParentId="10213" CreationDate="2014-07-31T12:44:48.017" Score="5" Body="&lt;p&gt;&lt;em&gt;Total&lt;/em&gt; Packet loss for 10-30 seconds is surely caused by other factors than lost packets somewhere on Internet. A lost tcp packet would normally generate a retransmit within ~10-100ms. Congested links would not block &lt;em&gt;all&lt;/em&gt; traffic for such a long time period.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A congested link will normally not make a router choose an alternate route unless link state is lost, or the router looses connectivity to adjacent routers on the other end of the link, forcing the router to rebuild its routing table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this happen to all your customers simultaneously? If so, you might have other types of routing issues. I have experienced ospf issues where ip-routes are &quot;hijacked&quot; by mis-configured equipment, disrupting traffic flow in a similar way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not think you as an &quot;end user&quot; would receive any form of feedback when a router link congests. You would have to debug the packet flow and interpret tcp retransmits, changes in tcp window sizes etc. However, routers and network protocols have numerous methods for handling and mitigating network congestions. For details on this: &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_congestion&quot; rel=&quot;noreferrer&quot;&gt;http://en.wikipedia.org/wiki/Network_congestion&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7754" LastActivityDate="2014-07-31T12:44:48.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10218" PostTypeId="2" ParentId="10110" CreationDate="2014-07-31T14:48:48.740" Score="4" Body="&lt;p&gt;&lt;strong&gt;Answer&lt;/strong&gt;: Assuming this is Cisco - no you can't NAT between two OUTSIDE interfaces*&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Corollary&lt;/strong&gt;: you can achieve what you want by migrating your NAT configuration to use NAT Virtual Interface (NVI). NVI precludes the need to have INSIDE/OUTSIDE interfaces and is the &lt;em&gt;new&lt;/em&gt; way to do things. I think you will need at least 12.3T (possibly 12.4T will have to check).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*You can do what you are trying to do with the addition of a route-map and a loopback address but I'm not going to suggest or recommend it.&lt;/p&gt;&#xA;" OwnerUserId="7730" LastActivityDate="2014-07-31T14:48:48.740" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10219" PostTypeId="1" AcceptedAnswerId="10233" CreationDate="2014-07-31T15:28:14.973" Score="10" ViewCount="12336" Body="&lt;p&gt;I have a few /30 subnets connecting OSPF routers over a broadcast capable link.. Should I also configure the interfaces involved in the link to &lt;strong&gt;ip ospf network point-to-point&lt;/strong&gt;? Or does it matter? The only thing I can think of is to prevent the election which from my understanding shouldn't matter since it's only 2 hosts (the routers) in the subnet?&lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2014-08-01T18:32:37.303" Title="OSPF Election with a /30 link?" Tags="|ospf|point-to-point|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10220" PostTypeId="1" AcceptedAnswerId="10229" CreationDate="2014-07-31T15:48:22.110" Score="6" ViewCount="3491" Body="&lt;p&gt;Is there a way to maintain the BGP prefixes a router has learned from another device even when reachability to the peer drops so that bgp doesn't need to withdraw all the routes and then relearn them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running into an issue sometimes when connectivity drops from high cpu load for various reasons and then the ibgp session goes down; at that point,  all routes are withdrawn and then relearned when the session gets reestablished, but it takes way too long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I currently run ibgp between 2 core devices and ospf to advertise the loopbacks; I need solutions for brocade.&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="775" LastEditDate="2014-08-02T01:57:06.180" LastActivityDate="2014-08-02T01:58:20.763" Title="Maintain prefixes even when bgp peer goes down" Tags="|routing|router|bgp|brocade|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10221" PostTypeId="1" CreationDate="2014-07-31T17:15:10.777" Score="4" ViewCount="1298" Body="&lt;p&gt;&lt;strong&gt;Background&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following config which uses lt interfaces to route traffic between 2 routing instances (default and a custom one called vpn).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I do this is so that I can have overlapping IP ranges/subnets and just use destination NAT to get round it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My test device is an SRX 100 and is has the following local IP's&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fe-0/0/0.0   - 1.1.1.1/30            - Overlapping IP range&#xA;fe-0/0/1.0   - 192.168.218.240/24    - IPSEC to another firewall on 192.168.218.1&#xA;fe-0/0/7.0   - 10.10.10.1/24         - Internal LAN&#xA;lt-0/0/0.101 - 10.77.77.101/30       - Attached to default routing instance&#xA;lt-0/0/0.102 - 10.77.77.102/30       - Attached to VPN routing instance&#xA;st0.100      - 10.255.0.100/32       - IPSEC tunnel to remote device&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a test computer (A) sitting on 10.10.10.2/24 and a test firewall connected via fe-0/0/1.0 on 192.168.218.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an IPSEC tunnel between the two devices, it's a simple route based tunnel that works fine. The issue is that I need to get to the remote devices on the network 1.1.1.0/30 which overlaps with my network on fe-0/0/0.0. Unfortunately it's not an option to re-IP it as this is just a test lab, I have a larger device with 100+ VPN's and lots of overlapping networks that I don't control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The config I built basically does destination NAT for 2.2.2.0/30 -&gt; 1.1.1.0/30. To get the traffic to route correctly I have a route in my default routing instance that looks like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inet.0: 11 destinations, 11 routes (11 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;2.2.2.0/30         *[Static/5] 00:31:48&#xA;                    &amp;gt; to 10.77.77.102 via lt-0/0/0.101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The nice thing about this is that any traffic routed via the lt interface causes it to hit my NAT rule and the perform a route lookup in my vpn routing instance which then routes the traffic out of the tunnel interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Total destination-nat rules: 1&#xA;Total referenced IPv4/IPv6 ip-prefixes: 1/0&#xA;&#xA;Destination NAT rule: DNAT-1               Rule-set: t&#xA;  Rule-Id                    : 1&#xA;  Rule position              : 1&#xA;  From routing instance      : vpn&#xA;    Destination addresses    : 2.2.2.0         - 2.2.2.3&#xA;&#xA;&#xA;vpn.inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;1.1.1.0/30         *[Static/5] 05:04:34&#xA;                    &amp;gt; via st0.100&#xA;10.10.10.0/24      *[Static/5] 00:34:52&#xA;                    &amp;gt; to 10.77.77.101 via lt-0/0/0.102&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means I can ping 2.2.2.1 from my computer (10.10.10.2) and it will flow correctly through both routing tables via the lt interface and down the tunnel to the remote overlapping network.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jul 31 17:05:28  Gareth-FW RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.10.10.2/1-&amp;gt;2.2.2.1/21042 icmp 10.10.10.2/1-&amp;gt;2.2.2.1/21042 None None 1 allow_all(global) trust trust 8502 N/A(N/A) fe-0/0/7.0 UNKNOWN UNKNOWN UNKNOWN&#xA;Jul 31 17:05:28  Gareth-FW RT_FLOW: RT_FLOW_SESSION_CREATE: session created 10.10.10.2/1-&amp;gt;2.2.2.1/21042 icmp 10.10.10.2/1-&amp;gt;1.1.1.1/21042 None DNAT-1 1 allow_all(global) vpn vpn 8503 N/A(N/A) lt-0/0/0.102 UNKNOWN UNKNOWN UNKNOWN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Finally the actual question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all works great on my test SRX 100. I would now like to deploy it to my SRX 240 cluster running JUNOS 12.1X46-D10.2 and I instantly find that you can't have an lt interface!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way I can replicate this config using some other interface or method to route my traffic? I would like to avoid using a physical interface if possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SRX Config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've left out the IPSEC config as it's just a simple config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@Gareth-FW# show interfaces&#xA;fe-0/0/0 {&#xA;    unit 0 {&#xA;        family inet {&#xA;            address 172.30.1.100/24 {&#xA;                preferred;&#xA;            }&#xA;            address 1.1.1.1/30;&#xA;        }&#xA;    }&#xA;}&#xA;lt-0/0/0 {&#xA;    unit 101 {&#xA;        encapsulation ethernet;&#xA;        peer-unit 102;&#xA;        family inet {&#xA;            address 10.77.77.101/30;&#xA;        }&#xA;    }&#xA;    unit 102 {&#xA;        encapsulation ethernet;&#xA;        peer-unit 101;&#xA;        family inet {&#xA;            address 10.77.77.102/30;&#xA;        }&#xA;    }&#xA;}&#xA;fe-0/0/1 {&#xA;    unit 0 {&#xA;        family inet {&#xA;            address 192.168.218.240/24;&#xA;        }&#xA;    }&#xA;}&#xA;fe-0/0/7 {&#xA;    unit 0 {&#xA;        family inet {&#xA;            address 10.10.10.1/24;&#xA;        }&#xA;    }&#xA;}&#xA;st0 {&#xA;    unit 100 {&#xA;        family inet {&#xA;            address 10.255.0.100/32;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@Gareth-FW# show routing-options&#xA;static {&#xA;    route 2.2.2.0/30 next-hop 10.77.77.102;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@Gareth-FW# show routing-instances&#xA;vpn {&#xA;    instance-type virtual-router;&#xA;    interface lt-0/0/0.102;&#xA;    interface lo0.101; ## 'lo0.101' is not defined&#xA;    interface st0.100;&#xA;    routing-options {&#xA;        static {&#xA;            route 1.1.1.0/30 next-hop st0.100;&#xA;            route 10.10.10.0/24 next-hop 10.77.77.101;&#xA;        }&#xA;        router-id 10.200.0.2;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@Gareth-FW# show security nat&#xA;destination {&#xA;    pool test {&#xA;        address 1.1.1.0/30;&#xA;    }&#xA;    rule-set t {&#xA;        from routing-instance vpn;&#xA;        rule DNAT-1 {&#xA;            match {&#xA;                destination-address 2.2.2.0/30;&#xA;            }&#xA;            then {&#xA;                destination-nat {&#xA;                    pool {&#xA;                        test;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="139" LastEditorUserId="3191" LastEditDate="2014-08-02T11:11:20.607" LastActivityDate="2014-11-30T13:04:21.930" Title="What can I use on a branch SRX cluster instead of an lt-0/0/0 interface?" Tags="|routing|juniper|juniper-junos|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10222" PostTypeId="2" ParentId="10220" CreationDate="2014-07-31T17:28:03.257" Score="4" Body="&lt;p&gt;If you are unable to stabilize your bgp sessions with longer timeouts or similar, here is a hack I have been forced to use on a few occations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are only a limited number of routes, and you have a stable environment without too many regular changes, you could insert static routes with higher preference/cost than the bgp routes. When the bgp sessions drop, the static routes will become active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I would regard this as a &quot;nasty hack&quot; to stabilize an unstable environment, and not in any way a good permanent solution. You should really fix the CPU issue causing all the problems.&lt;/p&gt;&#xA;" OwnerUserId="7754" LastActivityDate="2014-07-31T17:28:03.257" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10223" PostTypeId="1" AcceptedAnswerId="10238" CreationDate="2014-07-31T17:46:47.880" Score="5" ViewCount="5605" Body="&lt;p&gt;I have a SFP+ cable of dubious parentage (I think it is a knockoff) that I'm trying to use to connect a Cisco 2960S stack with a 4507 core chassis.  I have included what I think is relevant information below but please feel free to request more and I'll provide it.  Neither side complains about it being an incompatible SFP module, or anything of the like.  If I hook the cable up between two 2960S's, it works just fine.  The SFP cable doesn't appear to be listed on Amazon anymore, but here is a comparable version to give you an idea of what I'm using: &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B00KMR8R8S&quot; rel=&quot;noreferrer&quot;&gt;Diablo 15m direct attach SFP+&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My 4507 shows &quot;inactive&quot; status and the 2960S's show &quot;notconnect&quot; leading me to believe the problem may be with the 4507.  I've attempted the &lt;code&gt;service unsupported-transceiver&lt;/code&gt; trick but it has not affected the 'inactive' status.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the 4507 side:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nyhq-core01#sh int status | inc SR&#xA;Te3/3                        inactive     1            full   auto 10GBase-SR&#xA;&#xA;&#xA;interface TenGigabitEthernet3/3&#xA; switchport mode trunk&#xA;end&#xA;&#xA;TenGigabitEthernet3/3 is down, line protocol is down (inactive)&#xA;  Hardware is Ten Gigabit Ethernet Port, address is e02f.6da5.8dc2 (bia e02f.6d)&#xA;  MTU 1500 bytes, BW 10000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, Auto-speed, link type is auto, media type is 10GBase-SR&#xA;  input flow-control is off, output flow-control is off&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;  MTU 1500 bytes, BW 10000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, Auto-speed, link type is auto, media type is 10GBase-SR&#xA;  input flow-control is off, output flow-control is off&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;     Received 0 broadcasts (0 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 input packets with dribble condition detected&#xA;     0 packets output, 0 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 3 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&#xA;NAME: &quot;TenGigabitEthernet3/3&quot;, DESCR: &quot;SFP-10Gbase-SR&quot;&#xA;PID: SFP-10G-SR        , VID: V03  , SN: C1402250129&#xA;NAME: &quot;Supervisor(slot 4)&quot;, DESCR: &quot;Sup 7-E 10GE (SFP+), 1000BaseX (SFP) with 4 SFP+ Ports&quot;&#xA;PID: WS-X45-SUP7-E     , VID: V04  , SN: CAT164ZZZZ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is the 2960S stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NYC-SW-26-01#sh int status | inc SR&#xA;Te2/0/1                      notconnect   1            full    10G SFP-10GBase-SR&#xA;&#xA;&#xA;interface TenGigabitEthernet2/0/1&#xA; switchport mode trunk&#xA;end&#xA;TenGigabitEthernet2/0/1 is down, line protocol is down (notconnect) &#xA;  Hardware is Ten Gigabit Ethernet, address is 44ad.d975.51b3 (bia 44ad.d975.51b3)&#xA;  MTU 1500 bytes, BW 10000000 Kbit/sec, DLY 10 usec, &#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not set&#xA;  Full-duplex, 10Gb/s, link type is auto, media type is SFP-10GBase-SR&#xA;  input flow-control is off, output flow-control is unsupported &#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;     Received 0 broadcasts (0 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     0 packets output, 0 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 3 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&#xA;NYC-SW-26-01#sh log | inc 2/0/1  &#xA;Jul 31 19:00:28.175: %LINK-5-CHANGED: Interface TenGigabitEthernet2/0/1, changed state to administratively down&#xA;Jul 31 19:02:17.989: %LINK-3-UPDOWN: Interface TenGigabitEthernet2/0/1, changed state to down&#xA;&#xA;NYC-SW-26-01#sh inv&#xA;NAME: &quot;1&quot;, DESCR: &quot;WS-C2960S-48LPD-L&quot;&#xA;PID: WS-C2960S-48LPD-L , VID: V04  , SN: FOC1713ZZZZ&#xA;&#xA;NAME: &quot;2&quot;, DESCR: &quot;WS-C2960S-48LPD-L&quot;&#xA;PID: WS-C2960S-48LPD-L , VID: V04  , SN: FOC1713ZZZZ&#xA;&#xA;NAME: &quot;TenGigabitEthernet2/0/1&quot;, DESCR: &quot;SFP-10GBase-SR&quot;&#xA;PID: SFP-10G-SR          , VID: V03  , SN: C1402250130     &#xA;&#xA;NAME: &quot;3&quot;, DESCR: &quot;WS-C2960S-48LPD-L&quot;&#xA;PID: WS-C2960S-48LPD-L , VID: V04  , SN: FOC1709ZZZZ&#xA;&#xA;nyhq-core01#sh log | inc 3/3&#xA;nyhq-core01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="154" LastEditorUserId="154" LastEditDate="2014-07-31T20:00:47.083" LastActivityDate="2014-08-01T11:56:10.910" Title="Why does my Cisco 4507 core switch not recognize my SFP+?" Tags="|cisco|fiber|sfp|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="10224" PostTypeId="2" ParentId="10219" CreationDate="2014-07-31T18:02:02.097" Score="0" Body="&lt;p&gt;One thing to be concerned about is the timers.   Broadcast networks have a 40 sec dead timer, but PTP is 120 secs.  That may be an issue for convergence/recovery time in the event of a network failure.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-07-31T18:02:02.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10226" PostTypeId="2" ParentId="9612" CreationDate="2014-07-31T19:11:24.373" Score="16" Body="&lt;p&gt;Since the question was tagged with IPv6, I'll answer for that because IPv6 is very different from IPv4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To begin with, there is no such thing as ARPv6. The mapping between layer 2 and IPv6 addresses is done by the Neighbor Discovery Protocol (NDP), which is sent over ICMPv6. Thus, you &lt;em&gt;must not&lt;/em&gt; ignore ICMPv6 and filter it away, as is the custom with legacy IP. The NDP provides two message types that are of interest here: Neighbor Solicitation and Neighbor Advertisement. A node that wants to learn a link-layer address for a particular IP address sends a Neighbor Solicitation to the according &lt;em&gt;link-local solicited-node multicast address&lt;/em&gt; - there is no broadcast for IPv6 any more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if the address in question is &lt;code&gt;2001:db8::0011:2233:4455:6677&lt;/code&gt;, then the according solicited-node multicast address is &lt;code&gt;ff02::1:ff55:6677&lt;/code&gt;, and the according ethernet multicast address is &lt;code&gt;33:33:ff:55:66:77&lt;/code&gt;.  All nodes with an address ending on &lt;code&gt;*55:6677&lt;/code&gt; belong to that multicast group and will listen to that - this is most likely only the target system itself. The Neighbor Solicitation contains also the unicast IPv6 addresses and the MAC address of the soliciting system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On receipt, the target node answers with its Neighbor Advertisement, which is sent to the unicast address (link layer and IPv6) of the soliciting node. Thus, the soliciting node learns the MAC-address of the target node.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And yes, NDP-spoofing works much like ARP-spoofing. And no, IPsec is not the answer.&lt;/p&gt;&#xA;" OwnerUserId="7756" LastEditorUserId="7756" LastEditDate="2017-05-19T06:32:32.383" LastActivityDate="2017-05-19T06:32:32.383" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10229" PostTypeId="2" ParentId="10220" CreationDate="2014-07-31T22:56:51.670" Score="6" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4724&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP &lt;em&gt;graceful-restart&lt;/em&gt;&lt;/a&gt; is the mechanism that you are looking for.&lt;/p&gt;&#xA;&lt;p&gt;Graceful-restart maintains forwarding for the routes that have been received from a BGP neighbor while the connection is being restarted. When the neighbor drops, the routes will be marked &lt;em&gt;Stale&lt;/em&gt; (S) in the BGP table and will still be available for route selection.&lt;/p&gt;&#xA;&lt;p&gt;There are two timers that are associated with graceful-restart:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;stalepath time&lt;/strong&gt; - maximum amount of time to hold onto stale routes&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;restart time&lt;/strong&gt; - maximum amount of time to wait for neighbor to come back up&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;BGP graceful-restart capability is advertised in the &lt;code&gt;BGP OPEN&lt;/code&gt; message. This means that if you do decide to use it, you will have to restart the BGP connection for each neighbor before it will work.&lt;/p&gt;&#xA;&lt;p&gt;Probably shouldn't use graceful-restart if you are also using BFD on the link as it can cause issues.&lt;/p&gt;&#xA;&lt;h1&gt;Configuration&lt;/h1&gt;&#xA;&lt;p&gt;&lt;strong&gt;For Brocade Vyatta Routers&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;set protocols bgp 65000 parameters graceful-restart [stalepath-time seconds]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;For Brocade IOS Routers&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;To enable globally&lt;/em&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;router bgp&#xA; graceful-restart&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;em&gt;To enable per-vrf&lt;/em&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;router bgp&#xA; address-family ipv4 unicast vrf test&#xA;  graceful-restart&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h1&gt;Bonus Round&lt;/h1&gt;&#xA;&lt;p&gt;Vyatta routers let you dynamically advertise new capabilities for BGP, this allows you to test options without risking the BGP session not coming up. The following needs to be configured:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;set protocols bgp [ASN] [neighbor address] capability dynamic&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can then configure graceful-restart without resetting the BGP peering.&lt;/p&gt;&#xA;" OwnerUserId="7730" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-08-02T01:58:20.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10230" PostTypeId="2" ParentId="10221" CreationDate="2014-07-31T23:00:50.900" Score="2" Body="&lt;p&gt;One way would to to use a physical loopback cable and run a /30 or/31 over that. Downside is you lose 2x revenue ports&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@Jeff, you'll find that the LT interface is an internal only port not associated with any PIMs etc hence why you can't use it in a cluster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: If you do go the physical link route; I suggest you do one per chassis and run it in a RETH ( it should work )&lt;/p&gt;&#xA;" OwnerUserId="7762" LastEditorUserId="7762" LastEditDate="2014-08-02T06:28:16.553" LastActivityDate="2014-08-02T06:28:16.553" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10231" PostTypeId="2" ParentId="9574" CreationDate="2014-07-31T23:33:52.127" Score="2" Body="&lt;p&gt;Have you created a tunnel interface on the SSG and set it in the Untrust zone?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interface tunnel.1 zone Untrust&#xA;set interface tunnel.1 ip unnumbered interface ethernet0/9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IME if the P1 is not coming up:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;mismatched P1 protocols &lt;/li&gt;&#xA;&lt;li&gt;wrong password &lt;/li&gt;&#xA;&lt;li&gt;interface not set to listen for IKE&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="7762" LastEditorUserId="509" LastEditDate="2015-02-27T06:31:51.317" LastActivityDate="2015-02-27T06:31:51.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10232" PostTypeId="2" ParentId="10219" CreationDate="2014-08-01T01:10:15.053" Score="-1" Body="&lt;p&gt;Usually, setting OSPF to point-to-point is done to save bandwidth on leased links because it won't have elections, so if the link is not leased or metered, you shouldn't see much difference between both setups.&lt;/p&gt;&#xA;" OwnerUserId="7635" LastEditorUserId="7635" LastEditDate="2014-08-01T10:51:57.787" LastActivityDate="2014-08-01T10:51:57.787" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10233" PostTypeId="2" ParentId="10219" CreationDate="2014-08-01T03:42:55.950" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I have a few /30 subnets connecting OSPF routers over a broadcast capable link.. Should I also configure the interfaces involved in the link to ip ospf network point-to-point? Or does it matter?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The network type definitely matters, but you need to be sharp about handling this situation... there are some corner cases to consider.  Let's compare the consequences of configuring a /30 as &quot;Broadcast&quot; or &quot;Point-to-Point&quot; OSPF networks...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;----------+-------+--------------+--------------------+--------------+&#xA;Network   | Hello | DeadInterval | Adjacency Time     | LSAs per /30 | &#xA;----------+-------+--------------+--------------------+--------------|&#xA;Broadcast |   10s |          40s |  &amp;gt; 40s (very slow) |            3 |&#xA;Pt-to-Pt  |   30s |         120s |       &amp;lt;  2s (fast) |            2 |&#xA;----------+-------+--------------+--------------------+--------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Summary&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;OSPF &lt;em&gt;Broadcast&lt;/em&gt; Network types establish an adjacency slowly (because they must wait for the DR election), and generate 50% more LSAs for every /30 you designate as an OSPF Broadcast network.  Those LSAs must be flooded and processed, which slows down convergence.  In short, designs which use many /30 OSPF Broadcast networks will converge somewhat more slowly than if you substituted /30 Point-to-Point networks...&lt;/li&gt;&#xA;&lt;li&gt;OSPF &lt;em&gt;Point-to-Point&lt;/em&gt; network types bring up an adjacency very quickly; however, as Ron mentioned, the &lt;code&gt;RouterDeadInterval&lt;/code&gt; is 120 seconds so you might want to set &lt;code&gt;HelloInterval&lt;/code&gt; lower.  However, a correctly-designed network doesn't need to worry about lowering &lt;code&gt;HelloInterval&lt;/code&gt; for a /30 Point-to-Point OSPF network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Details: /30 on an OSPF Broadcast Network&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OSPF Broadcast Network Defaults&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;HelloInterval&lt;/code&gt;: 10 Seconds&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;RouterDeadInterval&lt;/code&gt;: 40 Seconds&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Time to detect OSPF Process failure&lt;/strong&gt;: &amp;lt;= 40 Seconds&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Adjacency time&lt;/strong&gt;: more-than 40 seconds&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;[Time T =  0]&lt;/code&gt; Both routers send OSPF Hellos as the link comes up.  (&lt;em&gt;OSPF STATE: INIT&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;[Time T =  0]&lt;/code&gt; Both routers see the opposite hello; however, unless configured with DR Priority 0, both routers &lt;em&gt;must&lt;/em&gt; wait &lt;code&gt;RouterDeadInterval&lt;/code&gt; seconds to ensure that there are no other candidate DRs are on the link. (&lt;em&gt;OSPF STATE: 2-WAY&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;[Time T = 40]&lt;/code&gt;  DR / BDR are elected, and DBD exchange starts (&lt;em&gt;OSPF STATE: EXSTART&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;[Time T = 40 + 'DBD exchange time']&lt;/code&gt; DBD is parsed, and SPF runs (&lt;em&gt;OSPF STATE: FULL&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;LSAs&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Each router sends Router LSA(s): OSPF LSA Type 1&lt;/li&gt;&#xA;&lt;li&gt;The DR sends a Type 2 &lt;a href=&quot;https://networkengineering.stackexchange.com/a/3783/775&quot;&gt;Network LSA&lt;/a&gt; for the broadcast link itself&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Details: /30 on an OSPF Point-to-Point Network&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OSPF Point-to-Point Network Defaults&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;HelloInterval&lt;/code&gt;: 30 Seconds&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;RouterDeadInterval&lt;/code&gt;: 120 Seconds&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Time to detect OSPF Process failure&lt;/strong&gt;: &amp;lt;= 120 Seconds&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Adjacency time&lt;/strong&gt;: Fast (normally less-than 2 Seconds)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;[Time T =  0]&lt;/code&gt; Both routers send OSPF Hellos as the link comes up.  (&lt;em&gt;OSPF STATE: INIT&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;[Time T = 0]&lt;/code&gt; Both routers see the opposite hello. (&lt;em&gt;OSPF STATE: 2-WAY&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;[Time T = 0]&lt;/code&gt;  DBD exchange starts (&lt;em&gt;OSPF STATE: EXSTART&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;[Time T = 'DBD exchange time']&lt;/code&gt; DBD is parsed, and SPF runs (&lt;em&gt;OSPF STATE: FULL&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;When to lower &lt;code&gt;HelloInterval&lt;/code&gt; for an OSPF Point-to-Point Network&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Consider these cases...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case A: Direct fiber link between routers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1-------------------------------Router2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The link between the routers is configured as OSPF Network Point-to-Point.  If the link between Router1 and Router2 dies, both routers immediately see their link go down, and run SPF to find an alternative path.  OSPF Process failures tend to be very rare, so there usually isn't a good argument to lower &lt;code&gt;HelloInterval&lt;/code&gt; for CaseA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case B: One Switch between two routers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1-------------Switch------------Router2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The link between the routers is configured as OSPF Network Point-to-Point.  If the link between Router1 and the switch dies, there is a problem... Router1 immediately knows to run SPF (after waiting &lt;code&gt;SPFDelay&lt;/code&gt;); however, Router2's link is still up.  Consequently Router2 must wait to converge until either &lt;code&gt;RouterDeadInterval&lt;/code&gt; expires, or until Router2 sees Router1's new LSA (flooded after Router1 finishes SPF).  In most cases, Router2 will see Router1's new LSA and then run SPF himself... however, Router2's reconvergence in that case is &lt;em&gt;at least&lt;/em&gt; two times the &lt;code&gt;SPFInterval&lt;/code&gt; (&lt;code&gt;SPFInterval&lt;/code&gt; default: 5 seconds in IOS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's worth lowering hello timers (or BFD timers) for CaseB when your routers are configured as OSPF Network Point-to-Point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case C: Two routers adjacent through multiple switches&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1-----Switch1-----Switch2--------Router2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the worst case for OSPF Point-to-Point convergence time; the link between the routers is configured as OSPF Network Point-to-Point.  If the link between Switch1 and Switch2 dies, both routers see their links up; this means the default &lt;code&gt;HelloInterval&lt;/code&gt; timers should be changed to prevent a two-minute delay between the link going down, and the SPF run.  In this case, it's definitely worth lowering hello timers (or BFD timers) for CaseC when your routers are configured as OSPF Network Point-to-Point.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-08-01T18:32:37.303" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10234" PostTypeId="2" ParentId="10219" CreationDate="2014-08-01T05:03:45.757" Score="2" Body="&lt;p&gt;There are actually a few things for you to weigh up with this question. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Use &lt;em&gt;point-to-point&lt;/em&gt; if:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Rapid failure detection and convergence is important to you. &#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Convergence:&lt;/strong&gt; The lack of a DR/BDR election will speed convergence  &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Failure-detection:&lt;/strong&gt; Couple OSPF network &lt;em&gt;point-to-point&lt;/em&gt; network type with BFD to for fast detection of a link-failure. You could adjust the OSPF timers but BFD performs better than &lt;em&gt;fast-hellos&lt;/em&gt; and is a bit easier on system resources. &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;You want to use /31 networks on your point-to-point links to conserve IP address space&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The network-mask in hello packets for point-to-point networks is ignored&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; For routes received via a point-to-point network-type, OSPF will report the next-hop as the neighbour router.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Use broadcast (default type) if:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You aren't too concerned with convergence times&lt;/li&gt;&#xA;&lt;li&gt;You don't want to engineer a complex fine-tuned solution&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; For routes received via a broadcast network-type, OSPF will report the next-hop as the advertising router.&lt;/p&gt;&#xA;" OwnerUserId="7730" LastEditorUserId="7730" LastEditDate="2014-08-01T13:49:42.417" LastActivityDate="2014-08-01T13:49:42.417" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10236" PostTypeId="1" AcceptedAnswerId="10237" CreationDate="2014-08-01T08:49:15.693" Score="3" ViewCount="4814" Body="&lt;p&gt;&lt;strong&gt;Summary&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yesterday, four of the eight systems (connected to same VLAN, identical ethernet adapter settings) were able to ping &lt;code&gt;tweakers.net&lt;/code&gt;. Today, another system is not able to ping the internet anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the &lt;a href=&quot;https://serverfault.com/questions/617008/production-servers-can-suddenly-not-access-the-internet-anymore&quot;&gt;system site has been investigated extensively&lt;/a&gt;, the Cisco switch is perhaps suspected and has been analyzed as well (see &lt;code&gt;Switch analysis section&lt;/code&gt; of the question), but the issue persists.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Current situation:&lt;/strong&gt; &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/640/how-can-i-capture-traffic-on-cisco-ios-switches&quot;&gt;this Q&amp;amp;A&lt;/a&gt; regarding packet sniffing is read&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt; Which further steps can be done to debug while some systems can ping the internet and others not while ethernet adapters are identical and these are connected to the same VLAN?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch Analysis&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;ARP&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch&amp;gt;sh arp&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  10.10.10.2            147   Y               ARPA   VlanNum&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;MAC-Address table&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch&amp;gt;sh mac address-table&#xA;          Mac Address Table&#xA;-------------------------------------------&#xA;&#xA;Vlan    Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA; Num    Y                 DYNAMIC     Gi0/Z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;VLAN&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch&amp;gt;sh vl&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                          active    &#xA;Num  VLAN0Num                         active    Gi0/Z&#xA;&#xA;VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2&#xA;---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------&#xA;1    enet  ...        1500  -      -      -        -    -        0      0&#xA;Num  enet  ...        1500  -      -      -        -    -        0      0&#xA;&#xA;Remote SPAN VLANs&#xA;------------------------------------------------------------------------------&#xA;&#xA;Primary Secondary Type              Ports&#xA;------- --------- ----------------- ------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Running-config&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch&amp;gt;sh run&#xA;&#xA;interface GigabitEthernet0/Z&#xA; switchport access vlan Num&#xA; switchport mode access&#xA; switchport nonegotiate&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;IP Interfaces&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch&amp;gt;sh ip int br&#xA;Interface              IP-Address      OK? Method Status                Protocol&#xA;Vlan1                  X               YES NVRAM  up                    up&#xA;VlanNum                10.10.10.1      YES NVRAM  up                    up&#xA;GigabitEthernet0/Z     unassigned      YES unset  up                    up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Interface&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch&amp;gt;show interface Gi0/Z&#xA;GigabitEthernet0/Z is up, line protocol is up (connected)&#xA;  Hardware is Gigabit Ethernet, address is MAC (bia MAC)&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output 00:00:00, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 669&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 248000 bits/sec, 34 packets/sec&#xA;  5 minute output rate 516000 bits/sec, 51 packets/sec&#xA;     6069964 packets input, 2943921646 bytes, 0 no buffer&#xA;     Received 99 broadcasts (56 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 56 multicast, 88133 pause input&#xA;     0 input packets with dribble condition detected&#xA;     8562995 packets output, 4951152227 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 1 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5282" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-08-01T14:47:24.057" Title="Run out of ideas to troubleshout Ping issue Cisco IOS 3560 Switch" Tags="|switch|cisco-ios|troubleshooting|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10237" PostTypeId="2" ParentId="10236" CreationDate="2014-08-01T10:18:38.807" Score="2" Body="&lt;p&gt;if you want to capture packages and analyze them with a packet sniffer (e.g. wireshark) the correct search term for Cisco IOS is SPAN (Switched Port Analyzer). &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swspan.html&quot; rel=&quot;nofollow&quot;&gt;See this documentation from Cisco&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your problem: I don't think that you'll find anything in the logs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would start checking if the port System1 is connected to is still active an really still accessing the right vlan. (&lt;em&gt;show run&lt;/em&gt;) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;sh ip int brief&lt;/em&gt; and &lt;em&gt;show interface &lt;/em&gt; would be my first choices. Check if there are any error counters &gt; 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may also be some issues on the system itself. Check ip settings, proxy, DNS, ... (again). Ping the default gateway and system 2 and check if arp resolution is working. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorDisplayName="user2084" LastEditDate="2014-08-01T11:56:14.237" LastActivityDate="2014-08-01T11:56:14.237" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10238" PostTypeId="2" ParentId="10223" CreationDate="2014-08-01T11:56:10.910" Score="3" Body="&lt;p&gt;As MikePennington and YLearn have corroborated, if you have dual supervisor cards in a 4500 chassis, only the first two of the four SFP+ slots will work on each sup blade.  The other two ports are disabled in software and there is &lt;em&gt;currently&lt;/em&gt; no indication to the end user that the ports are disabled.&lt;/p&gt;&#xA;" OwnerUserId="154" LastActivityDate="2014-08-01T11:56:10.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10239" PostTypeId="1" AcceptedAnswerId="10243" CreationDate="2014-08-01T14:35:17.603" Score="1" ViewCount="130" Body="&lt;p&gt;Alright, so I got tasked by one of my professors to try and connect a Nanostation M5 to the current network of the faculty. I was instructed to connect it to a Juniper WLC800 controller. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I'm a newbie at these sort of things (which is why I chose a networking course), so I don't really know where to even start. I asked some of the assistants for help, but they are reluctant to try in fear of messing up the network somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, most of what I've found and read on the internet is documentations. I haven't been able to find whether Juniper controllers are compatible with Ubiquiti devices, nor have I been able to find someone else doing this. Everyone I've talked to about this is skeptical that you can even do it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, are Juniper controllers compatible with other devices / Nanostation M5? Is it safe to try it without breaking the network? Has someone else attempted this and I just couldn't find it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And well, pardon if this is a trivial question. &lt;/p&gt;&#xA;" OwnerUserId="7767" LastActivityDate="2014-08-06T09:02:20.310" Title="Adding a Nanostation M5 to a Juniper network." Tags="|juniper|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10240" PostTypeId="2" ParentId="10236" CreationDate="2014-08-01T14:47:24.057" Score="1" Body="&lt;p&gt;If you are able to ping the default gateway from the computer then the switch has done it's job and is forwarding packets. I think you should move on to troubleshoot the configuration of the default gateway router instead of the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the routers NAT configuration, more specifically the access-list which determines which source IP addresses to NAT. I've seen a similar issue in the past caused by a NAT access-list being:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended ACL-NAT-HOSTS&#xA; permit ip 10.10.10.0 0.0.0.**15** any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When it should have been configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended ACL-NAT-HOSTS&#xA; permit ip 10.10.10.0 0.0.0.**255** any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And thus only allowing the first 15 servers (with the ip addresses 10.10.10.1 - 10.10.10.14) from the network to access the internet.&lt;/p&gt;&#xA;" OwnerUserId="2635" LastActivityDate="2014-08-01T14:47:24.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10241" PostTypeId="1" AcceptedAnswerId="10255" CreationDate="2014-08-01T14:52:43.957" Score="2" ViewCount="4057" Body="&lt;p&gt;I have a question, to which I think I know the answer.&#xA;I have a SonicWall TZ 215 configured and working fine with a DMZ and ports mapped through to that DMZ, but the need has come up to map traffic through to a system on the LAN network. &#xA;When I configured the NAT Rules exactly the same as the ones I have for the DMZ no traffic was allowed through to the LAN.&#xA;So, my guess is when you have a DMZ configured, that you can only allow traffic through to that, because lets face it, mapping through to your LAN isn't the smartest thing to do.&#xA;Here are some details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN1 11.11.11.11&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN2 22.22.22.22&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN 192.192.192.192&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DMZ 193.193.193.193&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FTP Traffic mapped through from WAN2 to DMZ address 193.193.193.X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My added configuration was&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTTP Traffic from WAN1 (Or all WAN) to LAN address 192.192.192.X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This just wouldn't work. Suggestions, assistance, help greatly received.&lt;/p&gt;&#xA;" OwnerUserId="7768" LastActivityDate="2014-09-08T21:28:56.930" Title="SonicWall DMZ and LAN inbound mapping" Tags="|routing|wan|sonicwall|lan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10242" PostTypeId="1" AcceptedAnswerId="10371" CreationDate="2014-08-01T15:25:44.057" Score="1" ViewCount="1045" Body="&lt;p&gt;I'm eight hours into this and no better off than before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My customer is a small office in a remote location, about 20 workstations and a Windows '03 server.  They have been served by AT&amp;amp;T DSL for years, but AT&amp;amp;T has forced them to move to Uverse.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the AT&amp;amp;T guy in this small town just does a &quot;drive by&quot; installation, I showed up while he was onsite to make sure everything went well.  After an hour or so everything seemed to be fine.  I was able to get the Motorola router to work behind our router, and so that was it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next day, we found there was one critical website that could not be access:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://infoexchange.relayhealth.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://infoexchange.relayhealth.com&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No other site seems to be a problem.  We're able to access this site with no difficulty on every other Internet connection I've found (including cell networks, our office, and other customers' offices).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I returned to the customer's office, connected the AT&amp;amp;T router directly to a computer (i.e., off of our network) and the site is still inaccessible.  After two hours on the phone with AT&amp;amp;T support they've essentially said they have no idea and that it must be a problem with the website -- even though THEY were able to access the site perfectly from their own computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, now, I have Uverse serving the network except for the most important site at the office.  AT&amp;amp;T is useless at this point, the customer is looking at me to resolve this and I don't know where to go from here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NSLookup infoexchnage.relayhealth.com returns 143.112.40.128, and with that ip address the site is accessible on my in-house network (not uverse).  It is as though that particular IP Address is blocked somewhere along the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two tracerts are attached.  The first is done from the client's server. &lt;img src=&quot;https://i.stack.imgur.com/gd9MQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second is done from MY workstation in MY office, which has no trouble accessing the site.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UVFcV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consistently, whether done from the client's computer or one on a different ISP where the site is accessible, the tracert follows roughly the same pattern -- it times out after about 7-8 hops.  AT&amp;amp;T says this shows it is not their problem, but to me it just seems it shows the tracert is not an effective tool for diagnosing the problem, since it looks about the same regardless of whether the site is on an accessible network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone can suggest ANY approach to resolving this problem I would be deeply appreciative.  I'm a programmer who sometimes has to deal with network problems, not particularly well-versed in network engineering issues, so the problem may be more straightforward for those of you who work with this stuff daily.  Thanks for looking at my problem.&lt;/p&gt;&#xA;" OwnerUserId="7769" LastEditorUserId="3191" LastEditDate="2014-08-01T15:38:10.427" LastActivityDate="2014-12-05T17:41:13.760" Title="Uverse Can't Access One Site" Tags="|routing|troubleshooting|internet|" AnswerCount="1" CommentCount="5" ClosedDate="2019-05-30T00:32:06.703" ContentLicense="CC BY-SA 3.0" />
  <row Id="10243" PostTypeId="2" ParentId="10239" CreationDate="2014-08-01T15:52:39.670" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;are Juniper controllers compatible with other devices / Nanostation M5?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No controlling the AP from a WLC requires &lt;a href=&quot;http://en.wikipedia.org/wiki/CAPWAP&quot; rel=&quot;nofollow&quot;&gt;CAPWAP&lt;/a&gt; however the Nanostation doesn't support it... the &lt;a href=&quot;http://community.ubnt.com/t5/UniFi/UniFi-questions-moved-from-FAQ-thread/td-p/111384&quot; rel=&quot;nofollow&quot;&gt;Unifi series uses TR 069&lt;/a&gt;, but the Nanostation is a autonomous unit that won't coordinate with anything else (thank you jona)&lt;/p&gt;&#xA;" OwnerUserId="5025" LastEditorUserId="5025" LastEditDate="2014-08-06T09:02:20.310" LastActivityDate="2014-08-06T09:02:20.310" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10244" PostTypeId="1" CreationDate="2014-08-01T16:46:52.650" Score="2" ViewCount="242" Body="&lt;p&gt;How many IPSEC Phase 2 SA's can exist for a given VPN tunnel before performance becomes an issue, and at this point what causes the performance issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is posed because I've always asked about specific configs vs specific configs for VPN and which is more efficient and I want to be able to answer this myself based on some real data.  I'm hoping to get feedback from people with more robust VPN backgrounds, who can say - through experience - I see performance drop after X phase 2 SA's, and here's why - so that I can then take this and create my own plan for good crypto ACL's.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2014-08-01T16:57:26.527" LastActivityDate="2014-08-01T19:07:12.680" Title="How many IPSEC P2 SA's can exist before tunnel performance is impacted, and why?" Tags="|vpn|ipsec|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10245" PostTypeId="1" CreationDate="2014-08-01T16:50:49.647" Score="4" ViewCount="4119" Body="&lt;p&gt;Why does using multiple sets of specific ip's to specific ip's in a crypto ACL - cause instability in VPN tunnels, please relate this to phase 2 SA's (IPSEC).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172.16.0.0 -&amp;gt; 10.0.0.0&#xA;172.17.0.0 -&amp;gt; 10.0.0.0&#xA;10.132.0.0 -&amp;gt; 10.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;vs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;any -&amp;gt; 10.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OR&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172.16.0.0 -&amp;gt; 10.0.0.0&#xA;172.16.0.0 -&amp;gt; 12.0.0.0&#xA;10.132.0.0 -&amp;gt; 13.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;vs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;any -&amp;gt; any (and using ACL's on interface or VPN-filter to limit traffic across).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2015-12-03T19:20:40.923" Title="Why do multi-line crypto ACL's create instability in VPN tunnels?" Tags="|vpn|ipsec|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10246" PostTypeId="1" AcceptedAnswerId="10253" CreationDate="2014-08-01T16:53:09.197" Score="1" ViewCount="93" Body="&lt;p&gt;Under what conditions are IPSEC P2 SA's built, broken down, and/or re-created?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to root out the science under the phase 2 SA creation and mechanics so I can answer for myself what is the most efficient way to design our VPN tunnels.  I always get subjective answers when I've asked before, so I'm coming at it different asking about HOW they work at a granular level.  Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2014-08-01T18:57:03.413" Title="Under what conditions are IPSEC P2 SA's built, broken down, and/or re-created?" Tags="|vpn|ipsec|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10247" PostTypeId="1" AcceptedAnswerId="10249" CreationDate="2014-08-01T17:21:02.400" Score="1" ViewCount="1538" Body="&lt;p&gt;so, we have a SRX100 in one site (call it site B) and a SRX240 on our main site (Site A). the ISP at site B asked us to change our IP address from one network to another. (due to some routing issues they were faceing). the problem is that we have a site2site vpn between the two (ike).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so, tonight I am sitting at site B, and want to fix this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I change all the setting on the VPN on both sites, to reflect the changes, and update any firewall rule that need updating for this to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;note 1) on site B, at this point I ADD the IP address in addition to the old ip address (I dit not replace it), but I did replace the default route, and the vpn connection end points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then commit at site A first (since I have to do it while I can still reach it by vpn). then commit site B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I notice that I have internet stil on site B, which is good, but the VPN did NOT come up at all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I look in the logfiles on both sides (I have a secondary vpn to reach the site A switch). and there is nothing there! no trace of the vpn at all.. which is strange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then I notice that my ip as seen from outside is still the old ip address on site B (whatismyip.org or such). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to, then I remove the old ip from the firewall.. and committ again (siteb).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then, the VPN comes UP, and it shows in the logfiles like it should.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so, I try to add the ip address back again to test, and the vpn goes down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and finally I try to remove the old ip on site B again... but the VPN does NOT come up.. and again nothing in the logs.. &lt;/p&gt;&#xA;" OwnerUserId="6375" LastActivityDate="2014-08-01T17:31:05.280" Title="Juniper SRX site 2 site VPN, change IP and default route on one of the hosts leads to problems" Tags="|vpn|juniper-srx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10248" PostTypeId="1" CreationDate="2014-08-01T17:26:56.183" Score="4" ViewCount="2943" Body="&lt;p&gt;How do I check the Log Messages of Last Month on juniper MX960 Router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I am typing the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show log Messages.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's just showing me the messages for last 15 days. We have two MX960 Routers on one when I am entering the command, it's showing me the Logs for more than one month but on the redundant it's just showing for last 15 days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in Advance :-) &lt;/p&gt;&#xA;" OwnerUserId="7772" LastEditorUserId="3191" LastEditDate="2014-08-02T15:39:28.283" LastActivityDate="2014-08-02T15:39:28.283" Title="Log Messages In Juniper MX960" Tags="|juniper-junos|juniper-mx|cli|syslog|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10249" PostTypeId="2" ParentId="10247" CreationDate="2014-08-01T17:31:05.280" Score="1" Body="&lt;p&gt;so, I think I have found the solution finally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;at both sides I run this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show security ike security-associations&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Site B showed &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Index   State  Initiator cookie  Responder cookie  Mode           Remote Address   &#xA;&amp;lt;anumber&amp;gt; DOWN   &amp;lt;some data&amp;gt;  &amp;lt;0000000000000000&amp;gt;  Main           &amp;lt;correct ip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is logical, since the vpn IS down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then I ran same on the other side (side A)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it showed this:&#xA;    Index   Remote Address  State  Initiator cookie  Responder cookie  Mode&#xA;        UP         Main &#xA;        UP         Main&lt;br&gt;&#xA;        UP         Main &lt;/p&gt;&#xA;&#xA;&lt;p&gt;which is strange since again, the vpn is DOWN.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so, I tried to run this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clear security ike security-associations index &amp;lt;index from first one above&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then the vpn came up again... and I finally alro removed the other &quot;old ip&quot; line, and now only have one line (site A)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    &amp;lt;anumber&amp;gt; &amp;lt;newip&amp;gt;   UP     &amp;lt;some data&amp;gt;  &amp;lt;some data&amp;gt;  Main         &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and similarly site B shows &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;anumber&amp;gt; UP     &amp;lt;some data&amp;gt;  &amp;lt;some data&amp;gt;  Main           &amp;lt;correct ip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the vpn seems stable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did not find this solution on any of the juniper FAQ, and googled a lot, but managed by a bit of luck to solve it. so I wanted to document it a bit here just in case someone (like me) need it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IF: I am completely wrong here, and what happened here just luck and not related, I do hope that you will comment or edit thanks!   &lt;/p&gt;&#xA;" OwnerUserId="6375" LastActivityDate="2014-08-01T17:31:05.280" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10250" PostTypeId="2" ParentId="10248" CreationDate="2014-08-01T18:23:13.507" Score="5" Body="&lt;p&gt;The syntax of the show log command is &lt;code&gt;show log &quot;filename&quot;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First try:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show log&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This command will show you all files in the log directory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will probably get the log entries you want simply by typing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show log messages.0.gz&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No need to think about decompressing the file. Junos will do this for you. &lt;/p&gt;&#xA;" OwnerUserId="7754" LastEditorUserId="7754" LastEditDate="2014-08-01T18:47:29.157" LastActivityDate="2014-08-01T18:47:29.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10251" PostTypeId="2" ParentId="10245" CreationDate="2014-08-01T18:48:13.113" Score="4" Body="&lt;p&gt;If you're talking Cisco, each acl record is it's own SA (tunnel).  FWIW, the Cisco PIX/ASA will not allow an &quot;any&quot; rule. (which is why an IOS tunnel interface cannot terminate to a PIX/ASA.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What sort of instability are you seeing? If one rule works, they should all work. Yes, there will be a delay if the SA isn't setup yet.  The only issue I can think of would be where IPsec is passing through a NAT device that cannot keep track of multiple streams.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-08-01T20:17:24.980" LastActivityDate="2014-08-01T20:17:24.980" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10252" PostTypeId="2" ParentId="10213" CreationDate="2014-08-01T18:56:05.677" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The issue: Customers can experience total packet loss for 10s, 30s and more. This brings the TCP connection delivering the prices to a halt, thus rendering the website useless. All connectivity from the data center to the peering points have been sized correctly, and have capacity to spare.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It has been asserted that this is commonplace in public Internet. My gut however says no, and all of my experience as a consumer is to the contrary, however I have no hard facts to draw upon.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your gut instinct is correct.  Speaking as a guy who has built networks for the last 20 years, you should never blindly accept significant ongoing packet loss on a wired network, and do not let any equipment vendor or ISP tell you otherwise.  Regular 10 to 30 second outages are unacceptable; if you have a choice, perhaps you could let your upstream know that you're going to start considering your options unless they take the problem seriously.  The sad reality is that bandwidth isn't free, ISPs profit margins are usually quite low, and some providers will do everything they can to save money even if it means unhappy customers (crazy as that may sound).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming I'm sending basic TCP traffic, the most packet loss I will accept for a public internet service (where you expect some loss from occasional over-subscription) is 0.10% over a 24 hour period, and no more than 0.50% over any 5 minute period &lt;sup&gt;Note 1&lt;/sup&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tolerate 0.0% packet loss inside our wired corporate network &lt;sup&gt;Note 2&lt;/sup&gt;.  As long as the packet drops are not expected, corporate network engineers should upgrade their circuits (or LAN) if they start seeing packet loss.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Presuming that packet loss is caused by congestion, when a route becomes congested surely the router holding that route will choose an alternate, and furthermore will do so more rapidly that 10s?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;By default, routing protocols like OSPF or BGP won't re-route based on congestion unless the congestion makes them drop their routing protocol packets long enough to declare the neighbor down (on the order of 40 seconds to 120 seconds with default timers); the tricky issue here is that routing protocol packets are prioritized higher than other traffic in many vendors equipment.  That means the circuit has to be really congested for that whole interval before the routing protocols will drop.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Finally, is there any feedback available when a route congests?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are technical tools for managing which upstream provider you choose for a given route (assuming you have multiple upstreams); consider &lt;a href=&quot;http://cisco.com/go/pfr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's PfR&lt;/a&gt; as just one possible way to work around this problem.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Note 1&lt;/sup&gt;: While I consider 0.5% packet loss over 5 minutes enough to notice, I wouldn't make a big deal out of it... this threshold is just a number where you can concede that there &lt;em&gt;might&lt;/em&gt; start to be a noticable TCP performance problem; 0.5% loss probably isn't going to get your attention.  However, if the packet loss is both regular and bad enough to notice (such as your case), insist that your provider fix the problem (as long as the loss is in their network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Note 2&lt;/sup&gt;: In my experience, some switches simply cannot operate with zero packet drops when multiple users are on this switch.  At this point you have choices: A) Forklift all the existing switches (if the packet drop problem is big enough), B) Wait for a patch from the vendor to fix the issue, or C) Accept the packet drops as a &quot;feature&quot; of the switch.  By way of example, I have faced this choice with the &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/switches/catalyst-3850-series-switches/200594-Catalyst-3850-Troubleshooting-Output-dr.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco 3850's shared-buffer architecture&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2018-05-07T14:50:33.810" LastActivityDate="2018-05-07T14:50:33.810" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="10253" PostTypeId="2" ParentId="10246" CreationDate="2014-08-01T18:57:03.413" Score="3" Body="&lt;p&gt;At a basic level, they are created when a traffic flow matching the ACL is first active. It will be torn down either after an idle timeout, or at the end of the &quot;lifetime&quot; of the SA (which could be due to bytes or time.) If the SA expires while traffic is flowing, a new SA is setup -- ie. key renegotiated.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-01T18:57:03.413" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10254" PostTypeId="2" ParentId="10244" CreationDate="2014-08-01T19:07:12.680" Score="3" Body="&lt;p&gt;Depending on platform, performance shouldn't be an issue up into the thousands of SAs -- table lookups aren't that expensive.  However, every system I'm aware of limits the total number of SAs, either due to hardware constraints or &quot;lazy programming&quot; (fixed size table.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, it's best to have as few SAs as you can -- eg. 1 /20 vs. 16 /24's -- to reduce the setup time and amount of key renegotiation (which &lt;em&gt;is&lt;/em&gt; computationally expensive.) &lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-01T19:07:12.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10255" PostTypeId="2" ParentId="10241" CreationDate="2014-08-01T22:55:47.680" Score="1" Body="&lt;p&gt;That should work fine.  Did you add a firewall rule in addition to the NAT policy?  You'll need to allow  HTTP traffic from &quot;Any&quot; to &quot;WAN Interface IP&quot; (for both)&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2014-08-01T22:55:47.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10256" PostTypeId="2" ParentId="10212" CreationDate="2014-08-02T11:24:54.743" Score="2" Body="&lt;p&gt;The problem was wrong NAT translation to the VPN server and two rules at the firewall. They should check chain FORWARD instead of INPUT. It is a little hard to belive but it worked. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;INPUT chain is for packet which have router public IP in destination address like in my case so they &quot;wants&quot; reach the router not host beyond - like FORWARD chain does. Thats interesting ^^&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="6417" LastEditDate="2014-08-02T11:29:58.433" LastActivityDate="2014-08-02T11:29:58.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10258" PostTypeId="2" ParentId="9546" CreationDate="2014-08-02T18:05:32.080" Score="1" Body="&lt;p&gt;Restarting the router resolved the issue.&lt;/p&gt;&#xA;" OwnerUserId="2584" LastActivityDate="2014-08-02T18:05:32.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10259" PostTypeId="1" AcceptedAnswerId="10260" CreationDate="2014-08-02T21:58:57.300" Score="2" ViewCount="1193" Body="&lt;p&gt;Our company going to move in a new office, for this I'm trying to re-design the internal network (LAN). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TARGET :&lt;/strong&gt; try to achieve a more reliable and secure network than what we have now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ACTUALLY :&lt;/strong&gt; in a couple of months the number of collaborators improved from 3 to 11, and of course, also the numbers of devices connected to the LAN. I don't think the actual &amp;amp; very basic design is anymore adapt to our situation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/COFh1.png&quot; alt=&quot; &quot;&gt;&#xA;There is the ISP router+firewall connected to the switch, and all the end users connected to the switch via ethernet. Plus there is a shared printer, a NAS for sharing files and a server for testing code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Number Of connected devices (more in detail) :&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;12 labtops (wired)&lt;/li&gt;&#xA;&lt;li&gt;9 smartphones (wifi)&lt;/li&gt;&#xA;&lt;li&gt;3 ipad (wifi)&lt;/li&gt;&#xA;&lt;li&gt;2 access points (wired to the router)&lt;/li&gt;&#xA;&lt;li&gt;1 shared printer (wired).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Following 2 devices, as user3799089 suggested, I plan to put them in the DMZ portion behind firewall:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 webserver&lt;/li&gt;&#xA;&lt;li&gt;1 NAS&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm not an expert, but i've never seen a network design with that many devices connected to just a switch, and i'm thinking to add a new Layer of switches, and devide the network in the following way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/L0z6Z.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, I would directly connect the test server to the router, and give the possibility to reach it from the outside world using NAT(we don't have a static ip actually). I would protect the server and the NAS behind a firewall(in attition to the one integrated in the router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually our bandwidth is 40/4 Mbit/s , but I still doesn't know how much of it we do use. In the first 2 weeks in the new office, the ISP will monitor our bandwidth usage, and tell us if 40/4 is enough for us. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MY QUESTIONS :&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Adding a new layer of switches does improve in any way the reliability of the network? &lt;/li&gt;&#xA;&lt;li&gt;Setting up a double firewall to reach the server and the NAS make it more secure? is usually the firewall integrated in the router reliable?&lt;/li&gt;&#xA;&lt;li&gt;NATTING a dynamic address to make it reachable from the outside, is a bad practice for any security reason?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="7783" LastEditorUserId="7783" LastEditDate="2014-08-03T14:01:27.290" LastActivityDate="2014-08-03T14:01:27.290" Title="first LAN integration ( Network design approach )" Tags="|firewall|nat|design|switch|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10260" PostTypeId="2" ParentId="10259" CreationDate="2014-08-03T07:02:55.267" Score="1" Body="&lt;p&gt;First of all put Your firewall betwen Your ISP and edge router ! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have so few host that You are able to bind all host using at least two switches (which wouldn`t be so expansive) connected to each other so when one fall down second one will continue passing frames to the router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use also static DHCP leases to assign the same IP address to specified hosts in Your network. No matter where they connect their device they will receive  that same IP address all the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good security practice is to give Your AP`s different range of IP addresses and exclude them from Your wired part of LAN network. You can also add a VPN tunels to Your NAS and server aspeccialy while using WiFi.&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="6417" LastEditDate="2014-08-03T07:08:44.430" LastActivityDate="2014-08-03T07:08:44.430" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10261" PostTypeId="1" AcceptedAnswerId="10279" CreationDate="2014-08-03T12:53:29.580" Score="4" ViewCount="2012" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KDeWn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KDeWn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In diagram above R1 has got a loopback with 1.1.1.1/24 ip address, both R1 and R2 advertise out this network 1.1.1.0/24 to other AS using this &lt;code&gt;router bgp&lt;/code&gt; &lt;code&gt;network&lt;/code&gt; config: &lt;code&gt;network 1.1.1.0 mask 255.255.255.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 and R2 are iBGP peers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 is peer with R3 in AS 200&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2 is peer with R4 in As 200&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is R2 advertises 1.1.1.0/24 as this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;* i1.1.1.0/24       10.1.12.1                0    100      0 i&#xA;*&amp;gt;                  10.1.12.1               11         32768 i&#xA;&#xA;&#xA;&#xA;R2# sh ip bgp 1.1.1.0 255.255.255.0  &#xA;BGP routing table entry for 1.1.1.0/24, version 9&#xA;Paths: (2 available, best #2, table Default-IP-Routing-Table)&#xA;  Advertised to update-groups:&#xA;     1          2         &#xA;  Local&#xA;    10.1.12.1 from 10.1.12.1 (1.1.1.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, internal&#xA;  Local&#xA;    10.1.12.1 from 0.0.0.0 (2.2.2.2)&#xA;      Origin IGP, metric 11, localpref 100, weight 32768, valid, sourced, local, best&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It sees itself as the nexthop and uses that as best route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Local&#xA;        10.1.12.1 from 0.0.0.0 (2.2.2.2)&#xA;          Origin IGP, metric 11, localpref 100, weight 32768, valid, sourced, local, best&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So why is this happening? Why does R2 advertise 1.1.1.0/24 back to R1? Why  should R2 do that?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same outputs from R1 in the case you need to check them out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*&amp;gt; 1.1.1.0/24       0.0.0.0                  0         32768 i&#xA;* i                 10.1.12.2               11    100      0 i&#xA;&#xA;R1#sh ip bgp 1.1.1.0 255.255.255.0&#xA;BGP routing table entry for 1.1.1.0/24, version 11&#xA;Paths: (2 available, best #1, table Default-IP-Routing-Table)&#xA;  Advertised to update-groups:&#xA;     1          2      &#xA;  Local&#xA;    0.0.0.0 from 0.0.0.0 (1.1.1.1)&#xA;      Origin IGP, metric 0, localpref 100, weight 32768, valid, sourced, local, best&#xA;  Local&#xA;    10.1.12.2 from 10.1.12.2 (2.2.2.2)&#xA;      Origin IGP, metric 11, localpref 100, valid, internal&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7741" LastEditorUserId="7741" LastEditDate="2014-08-03T15:16:38.397" LastActivityDate="2014-08-04T13:20:38.210" Title="Why BGP choose wrong Next-hop address?" Tags="|cisco|routing|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10263" PostTypeId="1" AcceptedAnswerId="10269" CreationDate="2014-08-03T20:16:01.043" Score="3" ViewCount="104" Body="&lt;p&gt;Follow up to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/10236/run-out-of-ideas-to-troubleshout-ping-issue-cisco-ios-3560-switch&quot;&gt;this Q&amp;amp;A&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Documentation regarding IP Access Lists&lt;/a&gt; is read to understand how this works and include or exclude it as a possible cause that some systems were suddenly not able to access the internet anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the access list would look like as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list acl_permit permit ip 10.10.10.0 0.0.0.7&#xA;access-list acl_deny deny ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this would mean that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.10.10.0&#xA;10.10.10.1&#xA;10.10.10.2&#xA;10.10.10.3&#xA;10.10.10.4&#xA;10.10.10.5&#xA;10.10.10.6&#xA;10.10.10.7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;are able to access the internet, as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2^0=1&#xA;2^1=2&#xA;2^2=4 +&#xA;    7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the access-list does not change and subsequently four more systems are created and the following IPs are assigned:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.10.10.8&#xA;10.10.10.9&#xA;10.10.10.10&#xA;10.10.10.11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;does this mean that these systems would not be able to access the internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be possible that the new systems, e.g. &lt;code&gt;10.10.10.10&lt;/code&gt; could compete with e.g. &lt;code&gt;10.10.10.4&lt;/code&gt; so that the latter cannot access the internet anymore and the first does?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or should the mask be increased from &lt;code&gt;7&lt;/code&gt; to at least &lt;code&gt;15&lt;/code&gt; so that the new systems (&lt;code&gt;10.10.10.8 - 11&lt;/code&gt;) could access the internet?&lt;/p&gt;&#xA;" OwnerUserId="5282" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-08-04T06:08:11.427" Title="Could adding new systems to the network suddenly block access to the internet if Access Lists are unchanged?" Tags="|cisco|switch|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10264" PostTypeId="1" CreationDate="2014-08-03T21:06:08.077" Score="2" ViewCount="303" Body="&lt;p&gt;In general, both are implemented through token bucket algorithm. I am wondering how they are really implemented on hardware, i.e. ASIC or NPU chips. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on an online article I found from Cisco, &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html&quot; rel=&quot;nofollow&quot;&gt;Comparing Traffic Policing and Traffic Shaping for Bandwidth Limiting&lt;/a&gt;, it says the key implementation difference is how tokens are replenished.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;==========================Shaping================================================&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Shaping increments the token bucket at timed intervals using a bits&#xA;  per second (bps) value. A shaper uses the following formula:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Tc = Bc/CIR (in seconds) &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In this equation, Bc represents the committed&#xA;  burst, and CIR stands for committed information rate.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Question:&#xA;Based on description, this sounds leaky buckets alg. to me, so&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Is this implemented based on timer on hardware? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) In the case of a huge number of shaping policies configured on the line card, I imagine this would result in a huge number of different Tc's. Would that affect performance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) A follow up to 2), another way to implement this that i can think of is, all the token buckets are updated with a fixed small enough interval, but each token buckets is updated with different tokens for each trigger. Is this a practical option?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;=========================Policing=============================================&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In contrast, class-based policing and rate-limiting adds tokens&#xA;  continuously to the bucket. Specifically, the token arrival rate is&#xA;  calculated as follows:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;(time between packets (which is equal to t-t1) * policer rate)/8 bits&#xA;  per byte &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In other words, if the previous arrival of the packet was at&#xA;  t1 and the current time is t, the bucket is updated with t-t1 worth of&#xA;  bytes based on the token arrival rate&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) does this mean there is a time stamp kept? and for each packet, we do this calculation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) As I heard before, if different policing policies share the same rate and burst, they can share the same rate profile resource on the hardware, so it helps high scale configurations.&#xA;With this formula above, how does this rate profile work? and how it is shared? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&lt;/p&gt;&#xA;" OwnerUserId="6048" LastActivityDate="2014-08-03T21:06:08.077" Title="Policing vs Shaping implementation difference on hardware/PFE?" Tags="|policing|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10265" PostTypeId="1" CreationDate="2014-08-03T22:44:25.930" Score="2" ViewCount="951" Body="&lt;p&gt;I want to receive (repeatedly if possible) a time stamp (preferably in nanoseconds) at my access point from clients that are not necessarily connected to my access point&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does the 802.11 protocol have such type of packet/frame defined or&#xA;would I have to create my own extension protocol?&lt;/li&gt;&#xA;&lt;li&gt;Is it even possible to extend the 802.1 protocol and customize it ?&lt;/li&gt;&#xA;&lt;li&gt;Would I have to have both the client and the access point use this&#xA;protocol ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="7789" LastEditorUserId="775" LastEditDate="2014-12-08T12:46:32.060" LastActivityDate="2015-04-07T21:47:54.477" Title="Is there a type of WiFi probe frame that sends a time stamp to an access point?" Tags="|wireless|packet-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10269" PostTypeId="2" ParentId="10263" CreationDate="2014-08-04T02:56:08.010" Score="6" Body="&lt;p&gt;Based on the wildcard mask you've specified within the access-list above (which permits only ip addresses from 10.10.10.0-10.0.0.7 rest would be implicitly denied),yes you will need to change the wildcard mask from 7 to 15 which would allow the newly added systems to communicate to the internet. Else they'd be denied by the implicit deny rule of  ACL and no the newly connected systems wouldn't compete with the old one blocking their connection to the internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more thing I would like to add is that you need have the same names for the access-list.&#xA;In the above example I suppose you'd want to apply it to the same interface ,Am I right ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so in that case it would be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list acl_permit permit ip 10.10.10.0 0.0.0.7 any&#xA;access-list acl_permit deny ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope this helps and answers you're query...Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ref &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfacls.html&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfacls.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7790" LastEditorUserId="1291" LastEditDate="2014-08-04T06:08:11.427" LastActivityDate="2014-08-04T06:08:11.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10272" PostTypeId="1" AcceptedAnswerId="10275" CreationDate="2014-08-04T10:16:32.587" Score="3" ViewCount="3387" Body="&lt;p&gt;I understand that IP address is a unique address to identify a machine in a network. But for the first time when i Plug in say ethernet cable of a network to my PC's Ethernet Port, how the IP address is assigned? Let's rule out static IP address where you can configure manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How a DHCP assigns a IP address when i Plugin network cable for first time.&lt;/p&gt;&#xA;" OwnerUserId="7795" LastEditorUserId="8499" LastEditDate="2018-03-19T17:31:49.990" LastActivityDate="2018-03-19T17:31:49.990" Title="How does DHCP assign an IP address?" Tags="|ethernet|dhcp|ip-address|broadcast|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10273" PostTypeId="2" ParentId="10272" CreationDate="2014-08-04T11:53:13.100" Score="4" Body="&lt;p&gt;A DHCP server has a pool of addresses. When your client request an IP address the server will handout one of its free pool. If there are no addresses left, your client will not get an address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address assignment has a certain lifetime. If the request is not renewed within this time the address will go back too the pool and can be handed out to the next client requesting an IP.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-08-04T11:53:13.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10274" PostTypeId="2" ParentId="10272" CreationDate="2014-08-04T11:59:37.623" Score="-1" Body="&lt;p&gt;1) Client makes a UDP Broadcast to the server about the DHCP discovery sPort=67 dPort=68.&#xA;2) DHCP offers to the client.&#xA;3) In response to the offer Client requests the server.&#xA;4)Server responds all the Ip Add/ subnetmask/default gateway/dns/wins info along with the acknowledgement packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this answers you're query... Thanks&lt;/p&gt;&#xA;" OwnerUserId="7790" LastActivityDate="2014-08-04T11:59:37.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10275" PostTypeId="2" ParentId="10272" CreationDate="2014-08-04T12:05:30.287" Score="15" Body="&lt;p&gt;The basic process is quite simple. I'll only cover that and omit scenarios where several DHCP servers exist, error conditions crop up or discovery has to cross network boundaries.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A new client on a network sends a DHCPDISCOVER via udp from&#xA;address 0.0.0.0 to 255.255.255.255:67 (broadcast, port 67).  &lt;/li&gt;&#xA;&lt;li&gt;If there is at least one DHCP servers listining in the network segment&#xA;it responds with a DHCPOFFER to broadcast on port 68. DHCPOFFER&#xA;includes all required settings for the client.&lt;/li&gt;&#xA;&lt;li&gt;The client now sends DHCPREQUEST to the DHCP server, still using the anonymous&#xA;0.0.0.0 address.&lt;/li&gt;&#xA;&lt;li&gt;The contacted DHCP server replies with a DHCPACK, which signals to the client that it may use the provided details.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For more information on the DHCP packet content and what to do in error cases read the Wikipedia article: &lt;a href=&quot;https://en.wikipedia.org/wiki/DHCP&quot;&gt;https://en.wikipedia.org/wiki/DHCP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5926" LastActivityDate="2014-08-04T12:05:30.287" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="10276" PostTypeId="1" AcceptedAnswerId="10277" CreationDate="2014-08-04T12:46:18.350" Score="6" ViewCount="2114" Body="&lt;p&gt;On Cisco gear the maximum administrative distance for a route is 255. This makes the route &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/15986-admin-distance.html#topic2&quot;&gt;unusable&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the administrative distance is 255, the router does not believe the source of that route and does not install the route in the routing table. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is there any practical use in configuring a route with an administrative distance of 255?&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-08-04T13:44:47.077" Title="Cisco administrative distance 255" Tags="|cisco|routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10277" PostTypeId="2" ParentId="10276" CreationDate="2014-08-04T12:57:39.347" Score="4" Body="&lt;p&gt;I suppose the following link states it usage&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/4170-ospfprocesses.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/4170-ospfprocesses.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the link it helps in preventing routing loops by denying the routes to installed within the routing table..(In case of redistribution in OSPF)&#xA;Please have a look at the link, it has an illustrated example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helps Thanks &lt;/p&gt;&#xA;" OwnerUserId="7790" LastEditorUserId="59" LastEditDate="2014-08-04T13:44:47.077" LastActivityDate="2014-08-04T13:44:47.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10279" PostTypeId="2" ParentId="10261" CreationDate="2014-08-04T13:20:38.210" Score="6" Body="&lt;p&gt;Because you are telling R2 to originate the route. Upon origination the weight is set to 32768 as you can see, which beats the route from R1 which has a weight of 0. This allows R2 to advertise it back to R1 as it is R2's bestpath. If you remove the network statement on R2 it will receive the route as a BGP route via R1 only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out the bestpath selection procedure for more info&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7799" LastActivityDate="2014-08-04T13:20:38.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10281" PostTypeId="1" AcceptedAnswerId="10282" CreationDate="2014-08-04T14:03:54.047" Score="3" ViewCount="15169" Body="&lt;p&gt;Our Splunk server recently reported an error on one of our Juniper EX 4200s. &lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Aug  4 11:45:16  25SRV01 /kernel: pid 7661 (dd), uid 0 inumber 217 on /var: filesystem full&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It appears our &lt;code&gt;/var&lt;/code&gt; filesystem is full and is no longer accepting log messages.  This is also causing premature rotation of some of our files.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@25SRV01# run show log interactive-commands.0.gz | last 1&#xA;Aug  4 11:40:16 25SRV01 newsyslog[7609]: logfile turned over due to -F request&#xA;rj@25SRV01# run show log firewall.0.gz | last 1&#xA;Aug  4 11:40:16 25SRV01 newsyslog[7609]: logfile turned over due to -F request&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There doesn’t seem to be anything out of the ordinary with this system versus the rest of our devices.  Below is our configuration. &lt;sup&gt;2&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@25SRV01# show system syslog&#xA;user * {&#xA;    any emergency;&#xA;}&#xA;file syslog {&#xA;    any any;&#xA;}&#xA;file firewall {&#xA;    firewall any;&#xA;}&#xA;file messages {&#xA;    any notice;&#xA;    authorization info;&#xA;}&#xA;file interactive-commands {&#xA;    interactive-commands any;&#xA;}&#xA;{master:0}[edit] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The strange thing is that there isn’t that much actual data in our log files.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@25SRV01:RE:0% du -h /var/log/.&#xA;2.0K    /var/log/./flowc/failed&#xA;4.0K    /var/log/./flowc&#xA;2.0K    /var/log/./ext&#xA;2.0K    /var/log/./ggsn/gtppcdr&#xA;4.0K    /var/log/./ggsn&#xA;2.8M    /var/log/.      &amp;lt;--- very reasonable log size&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've looked in the Juniper Knowledge Article: &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB22966&amp;amp;actp=RSS&quot; rel=&quot;nofollow&quot;&gt;How to resolve the '/var: filesystem full' issue which occurs as result of the WTMP file not being archived&lt;/a&gt;, but my WTMP file is resonably sized.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@25SRV01:RE:0% ls -lsah wtmp*&#xA;3040 -rw-rw-r--  1 root  wheel   1.5M Aug  4 13:48 wtmp   &amp;lt;----- Small enough&#xA;   4 -rw-rw-r--  1 root  wheel    91B Nov 19  2013 wtmp.0.gz&#xA;   4 -rw-rw-r--  1 root  wheel    57B Jun 14  2013 wtmp.1.gz&#xA;   4 -rw-rw-r--  1 root  wheel    82B Nov 19  2013 wtmp.2.gz&#xA;root@25SRV01:RE:0%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do I figure out what's taking up the space and fix it?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;1. I am aware that this pid was induced with &lt;code&gt;dd&lt;/code&gt;, which was intentional to replicate an issue we have had in the past.  I noticed a device getting near the limit and want to share a common issue we have. Command used: &lt;code&gt;dd if=/dev/random of=/var/overrun.pkg bs=1M count=20&lt;/code&gt;.&lt;/sub&gt;&lt;br&gt;&#xA;&lt;sub&gt;2. Some log configuration removed for organizational restrictions, such as &lt;code&gt;syslog host&lt;/code&gt; and &lt;code&gt;syslog source-address&lt;/code&gt;.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-08-05T08:14:04.153" Title="Juniper Filesystem Full" Tags="|juniper|juniper-ex|syslog|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10282" PostTypeId="2" ParentId="10281" CreationDate="2014-08-04T14:03:54.047" Score="7" Body="&lt;p&gt;There are 3 real ways to fix this, all of which are fairly simple.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Automated Storage Cleanup&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Juniper has a &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/command-summary/request-system-storage-cleanup.html&quot; rel=&quot;nofollow&quot;&gt;system cleanup tool&lt;/a&gt; for handling this automatically.  It operates almost exclusively under the &lt;code&gt;/var/*&lt;/code&gt; directory structure; meaning it isn’t all that critical, unless you care about your log files (which you should!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a &lt;code&gt;system storage cleanup&lt;/code&gt; on multiple FPCs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@25SRV01# run request system storage cleanup&#xA;Please check the list of files to be deleted using the dry-run option. i.e.&#xA;request system storage cleanup dry-run&#xA;Do you want to proceed ? [yes,no] (no) yes&#xA;&#xA;fpc0:&#xA;--------------------------------------------------------------------------&#xA;&#xA;List of files to delete:&#xA;&#xA;         Size Date         Name&#xA;    11B Nov 19  2013 /var/jail/tmp/alarmd.ts&#xA;  71.8K Jun 28 20:54 /var/log/chassisd.0.gz&#xA;   147B Aug  5 07:52 /var/log/default-log-messages.0.gz&#xA;   142B Aug  4 13:16 /var/log/default-log-messages.1.gz&#xA;   125B Aug  4 11:40 /var/log/default-log-messages.2.gz&#xA;   135B Aug  5 07:52 /var/log/firewall.0.gz&#xA;   130B Aug  4 13:16 /var/log/firewall.1.gz&#xA;  3045B Aug  4 11:40 /var/log/firewall.2.gz&#xA;  8265B Nov 19  2013 /var/log/firewall.3.gz&#xA;   298B Nov 19  2013 /var/log/install.0.gz&#xA;  1708B Aug  5 07:52 /var/log/interactive-commands.0.gz&#xA;  1275B Aug  4 13:16 /var/log/interactive-commands.1.gz&#xA;  8465B Aug  4 11:40 /var/log/interactive-commands.2.gz&#xA; &amp;lt;snip&amp;gt;&#xA; 124.0K Jun 14  2013 /var/tmp/gres-tp/env.dat&#xA;     0B Jun 14  2013 /var/tmp/gres-tp/lock&#xA; 106.3M Jul 31 08:16 /var/tmp/mchassis-install.tgz&#xA;     0B Jun 14  2013 /var/tmp/rtsdb/if-rtsdb&#xA;&#xA;fpc1:&#xA;--------------------------------------------------------------------------&#xA;&#xA;List of files to delete:&#xA;&#xA;         Size Date         Name&#xA;    11B Jun 14  2013 /var/jail/tmp/alarmd.ts&#xA;   147B Aug  5 07:52 /var/log/default-log-messages.0.gz&#xA;   144B Aug  4 13:16 /var/log/default-log-messages.1.gz&#xA;   126B Aug  4 11:40 /var/log/default-log-messages.2.gz&#xA;   135B Aug  5 07:52 /var/log/firewall.0.gz&#xA;   &amp;lt;snip&amp;gt;&#xA;    27B Oct 20  2013 /var/log/wtmp.2.gz&#xA;    27B Sep 20  2013 /var/log/wtmp.3.gz&#xA;    27B Sep 20  2013 /var/log/wtmp.4.gz&#xA;     5B Jun 14  2013 /var/lost+found/#04112&#xA;     5B Jun 14  2013 /var/lost+found/#04163&#xA; 124.0K Jul 30 16:43 /var/tmp/gres-tp/env.dat&#xA;     0B Jun 14  2013 /var/tmp/gres-tp/lock&#xA;     0B Jun 14  2013 /var/tmp/rtsdb/if-rtsdb&#xA;&#xA;{master:0}[edit]&#xA;rj@25SRV01# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the preferred Juniper way of handling this. Running this with the &lt;code&gt;dry-run&lt;/code&gt; option will show you what will be deleted ahead of time.  You should do this first.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Locate the Offending File&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You should be sending all of your logs to a syslog collector, making option 1 the best solution. If, however, you aren't and would rather not delete &lt;strong&gt;all&lt;/strong&gt; of your log files, you may fare better at finding the offending file yourself.  You will need a tad bit more familiarity with Unix systems, but if you know your way around the CLI, you should be alright.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First you’ll want to see how much over you are on that specific volume.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@25SRV01# run start shell user root&#xA;Password:&#xA;root@25SRV01:RE:0% df -h&#xA;Filesystem       Size    Used   Avail Capacity  Mounted on&#xA;/dev/da0s2a      183M    129M     39M    77%    /&#xA;devfs            1.0K    1.0K      0B   100%    /dev&#xA;/dev/md0          68M     68M      0B   100%    /packages/mnt/jbase&#xA;/dev/md1         5.8M    1.1M    4.2M    21%    /packages/mfs-fips-mode-powerpc&#xA;/dev/md2         2.9M    2.9M      0B   100%    /packages/mnt/fips-mode-powerpc-12.3R3.4&#xA;/dev/md3         9.0M    4.4M    3.9M    53%    /packages/mfs-jcrypto-ex&#xA;/dev/md4          12M     12M      0B   100%    /packages/mnt/jcrypto-ex-12.3R3.4&#xA;/dev/md5         8.1M    3.5M    4.0M    47%    /packages/mfs-jdocs-ex&#xA;/dev/md6         6.2M    6.2M      0B   100%    /packages/mnt/jdocs-ex-12.3R3.4&#xA;/dev/md7          43M     39M    718K    98%    /packages/mfs-jkernel-ex&#xA;/dev/md8         107M    107M      0B   100%    /packages/mnt/jkernel-ex-12.3R3.4&#xA;/dev/md9          12M    7.5M    3.6M    68%    /packages/mfs-jpfe-ex42x&#xA;/dev/md10         21M     21M      0B   100%    /packages/mnt/jpfe-ex42x-12.3R3.4&#xA;/dev/md11         17M     12M    3.2M    79%    /packages/mfs-jroute-ex&#xA;/dev/md12         38M     38M      0B   100%    /packages/mnt/jroute-ex-12.3R3.4&#xA;/dev/md13         12M    7.2M    3.6M    66%    /packages/mfs-jswitch-ex&#xA;/dev/md14         21M     21M      0B   100%    /packages/mnt/jswitch-ex-12.3R3.4&#xA;/dev/md15         14M    9.5M    3.4M    73%    /packages/mfs-jweb-ex&#xA;/dev/md16         25M     25M      0B   100%    /packages/mnt/jweb-ex-12.3R3.4&#xA;/dev/da0s3e      123M    122M   -8.6M   108%    /var  &amp;lt;---- # This doesn't look right&#xA;/dev/md17        126M     12K    116M     0%    /tmp&#xA;/dev/da0s3d      369M    106M    233M    31%    /var/tmp&#xA;/dev/da0s4d       62M    368K     57M     1%    /config&#xA;/dev/md18        118M     22M     87M    20%    /var/rundb&#xA;procfs           4.0K    4.0K      0B   100%    /proc&#xA;/var/jail/etc    123M    122M   -8.6M   108%    /packages/mnt/jweb-ex-12.3R3.4/jail/var/etc&#xA;/var/jail/run    123M    122M   -8.6M   108%    /packages/mnt/jweb-ex-12.3R3.4/jail/var/run&#xA;/var/jail/tmp    123M    122M   -8.6M   108%    /packages/mnt/jweb-ex-12.3R3.4/jail/var/tmp&#xA;/var/tmp         369M    106M    233M    31%    /packages/mnt/jweb-ex-12.3R3.4/jail/var/tmp/uploads&#xA;devfs            1.0K    1.0K      0B   100%    /packages/mnt/jweb-ex-12.3R3.4/jail/dev&#xA;root@25SRV01:RE:0%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, you’ll need to figure out where you’re large directories are.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@25SRV01:RE:0% du /var/ | sort -r&#xA;8       /var/transfer&#xA;24      /var/lost+found/#08193/certs/common&#xA;24      /var/etc/filters&#xA;24      /var/db/certs/common&#xA;232     /var/jail&#xA;223156  /var/lost+found&#xA;217992  /var/tmp&#xA;217756  /var/lost+found/#04099&#xA;217736  /var/lost+found/#04099/remote   &amp;lt;----- # Possible Issue&#xA;208     /var/jail/etc&#xA;root@25SRV01:RE:0% du -h /var/lost+found/#04099/remote&#xA;2.0K    /var/lost+found/#04099/remote/.ssh&#xA;106M    /var/lost+found/#04099/remote  &amp;lt;------ # Culprit&#xA;root@25SRV01:RE:0%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this instance, we can see that something is happening inside &lt;code&gt;/var/lost+found/#04099/remote&lt;/code&gt;, it’s using 106M of a 123M volume.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go there, find the file and remove it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@25SRV01:RE:0% cd /var/lost+found/#04099/remote&#xA;root@25SRV01:RE:0% ls -lsah&#xA;total 217740&#xA;     4 drwxr-xr-x  3 remote  20      512B Nov  7  2013 .&#xA;     4 drwxr-xr-x  5 root    wheel   512B Nov 26  2012 ..&#xA;     4 drwxr-xr-x  2 remote  20      512B Nov 26  2012 .ssh&#xA;217728 -rw-r--r--  1 remote  20      106M Nov  7  2013 jinstall-ex-4200-12.3R3.4-domestic-signed.tgz&#xA;root@25SRV01:RE:0% rm jinstall-ex-4200-12.3R3.4-domestic-signed.tgz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, our filestructure is way under the limit we need it to be at.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@25SRV01:RE:0% df -h&#xA;Filesystem       Size    Used   Avail Capacity  Mounted on&#xA;/dev/da0s2a      183M    129M     39M    77%    /&#xA;devfs            1.0K    1.0K      0B   100%    /dev&#xA;/dev/md0          68M     68M      0B   100%    /packages/mnt/jbase&#xA;/dev/md1         5.8M    1.1M    4.2M    21%    /packages/mfs-fips-mode-powerpc&#xA;/dev/md2         2.9M    2.9M      0B   100%    /packages/mnt/fips-mode-powerpc-12.3R3.4&#xA;/dev/md3         9.0M    4.4M    3.9M    53%    /packages/mfs-jcrypto-ex&#xA;/dev/md4          12M     12M      0B   100%    /packages/mnt/jcrypto-ex-12.3R3.4&#xA;/dev/md5         8.1M    3.5M    4.0M    47%    /packages/mfs-jdocs-ex&#xA;/dev/md6         6.2M    6.2M      0B   100%    /packages/mnt/jdocs-ex-12.3R3.4&#xA;/dev/md7          43M     39M    718K    98%    /packages/mfs-jkernel-ex&#xA;/dev/md8         107M    107M      0B   100%    /packages/mnt/jkernel-ex-12.3R3.4&#xA;/dev/md9          12M    7.5M    3.6M    68%    /packages/mfs-jpfe-ex42x&#xA;/dev/md10         21M     21M      0B   100%    /packages/mnt/jpfe-ex42x-12.3R3.4&#xA;/dev/md11         17M     12M    3.2M    79%    /packages/mfs-jroute-ex&#xA;/dev/md12         38M     38M      0B   100%    /packages/mnt/jroute-ex-12.3R3.4&#xA;/dev/md13         12M    7.2M    3.6M    66%    /packages/mfs-jswitch-ex&#xA;/dev/md14         21M     21M      0B   100%    /packages/mnt/jswitch-ex-12.3R3.4&#xA;/dev/md15         14M    9.5M    3.4M    73%    /packages/mfs-jweb-ex&#xA;/dev/md16         25M     25M      0B   100%    /packages/mnt/jweb-ex-12.3R3.4&#xA;/dev/da0s3e      123M     15M     98M    14%    /var   &amp;lt;----- # Much better&#xA;/dev/md17        126M     12K    116M     0%    /tmp&#xA;/dev/da0s3d      369M    106M    233M    31%    /var/tmp&#xA;/dev/da0s4d       62M    368K     57M     1%    /config&#xA;/dev/md18        118M     22M     87M    20%    /var/rundb&#xA;procfs           4.0K    4.0K      0B   100%    /proc&#xA;/var/jail/etc    123M     15M     98M    14%    /packages/mnt/jweb-ex-12.3R3.4/jail/var/etc&#xA;/var/jail/run    123M     15M     98M    14%    /packages/mnt/jweb-ex-12.3R3.4/jail/var/run&#xA;/var/jail/tmp    123M     15M     98M    14%    /packages/mnt/jweb-ex-12.3R3.4/jail/var/tmp&#xA;/var/tmp         369M    106M    233M    31%    /packages/mnt/jweb-ex-12.3R3.4/jail/var/tmp/uploads&#xA;devfs            1.0K    1.0K      0B   100%    /packages/mnt/jweb-ex-12.3R3.4/jail/dev&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Dry-Run and Locate File&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This way is a little more arguous, since you have to look through everything and make sure not to mistake any &lt;code&gt;M&lt;/code&gt;s for &lt;code&gt;K&lt;/code&gt;s. Run the &lt;code&gt;request system storage cleanup&lt;/code&gt; with the &lt;code&gt;dry-run&lt;/code&gt; option and look through it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@25SRV01# run request system storage cleanup dry-run&#xA;fpc0:&#xA;--------------------------------------------------------------------------&#xA;&#xA;List of files to delete:&#xA;&#xA;         Size Date         Name&#xA;    11B Nov 19  2013 /var/jail/tmp/alarmd.ts&#xA;  71.8K Jun 28 20:54 /var/log/chassisd.0.gz&#xA;   142B Aug  4 13:16 /var/log/default-log-messages.0.gz&#xA;   125B Aug  4 11:40 /var/log/default-log-messages.1.gz&#xA;   130B Aug  4 13:16 /var/log/firewall.0.gz&#xA;   &amp;lt;snip&amp;gt;&#xA;     0B Nov 19  2013 /var/lost+found/#00124&#xA;   231B Nov 19  2013 /var/lost+found/#00125&#xA;   606B Nov 19  2013 /var/lost+found/#00126&#xA;  40.0K Nov 19  2013 /var/lost+found/#00139&#xA;  40.0K Nov 19  2013 /var/lost+found/#00142&#xA;106.3M Nov  7  2013 /var/lost+found/#04099/remote/&#xA;         jinstall-ex-4200-12.3R3.4-domestic-signed.tgz &amp;lt;---- # Here it is&#xA;124.0K Jun 14  2013 /var/tmp/gres-tp/env.dat&#xA;     0B Jun 14  2013 /var/tmp/gres-tp/lock&#xA; 106.3M Jul 31 08:16 /var/tmp/mchassis-install.tgz&#xA;     0B Jun 14  2013 /var/tmp/rtsdb/if-rtsdb&#xA;&#xA;fpc1:&#xA;--------------------------------------------------------------------------&#xA;&#xA;List of files to delete:&#xA;&#xA;         Size Date         Name&#xA;    11B Jun 14  2013 /var/jail/tmp/alarmd.ts&#xA;   144B Aug  4 13:16 /var/log/default-log-messages.0.gz&#xA;   126B Aug  4 11:40 /var/log/default-log-messages.1.gz&#xA;   &amp;lt;snip&amp;gt;&#xA;     0B Jun 14  2013 /var/tmp/rtsdb/if-rtsdb&#xA;&#xA;{master:0}[edit]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then go and delete it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@25SRV01# run start shell user root&#xA;Password:&#xA;root@25SRV01:RE:0% cd /var/lost+found/#04099/remote&#xA;root@25SRV01:RE:0% rm jinstall-ex-4200-12.3R3.4-domestic-signed.tgz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From here, you should have a healthy, usable filesystem that can resume logging.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-08-05T08:14:04.153" LastActivityDate="2014-08-05T08:14:04.153" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10283" PostTypeId="1" AcceptedAnswerId="10287" CreationDate="2014-08-04T17:10:30.450" Score="4" ViewCount="2455" Body="&lt;p&gt;I read in Bus topology that &quot;the network is occupied until the destination computer accepts the data&quot;. Is this statement correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, then what happens if the destination computer is not present? How does the network handle this problem? Of course the bus topology shouldn't be occupied this whole time.&lt;/p&gt;&#xA;" OwnerUserId="7805" LastEditorUserId="775" LastEditDate="2014-12-08T12:44:34.827" LastActivityDate="2014-12-08T12:44:34.827" Title="What happens to a packet sent in bus topology?" Tags="|packet-analysis|" AnswerCount="3" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10286" PostTypeId="2" ParentId="6047" CreationDate="2014-08-04T19:07:37.757" Score="2" Body="&lt;p&gt;You can set alarm thresholds on policy rules&lt;a href=&quot;https://i.stack.imgur.com/DlS0k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;. Would that suffice? I haven't found another way to do this. I would use an external host and read the counters using SNMP.&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2014-08-04T19:07:37.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10287" PostTypeId="2" ParentId="10283" CreationDate="2014-08-04T19:19:34.040" Score="5" Body="&lt;p&gt;If you're talking about Token Ring (which no one uses anymore), the packet will flow around the ring until it comes back to you. At which point, &lt;em&gt;you&lt;/em&gt; don't pass it on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[update]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of your bus as a single wire. Along that wire speakers are attached to it (and earth ground.) Then add key-switches along the line to signal Morse code. Any switch can make all the speakers click, however, while a message is being sent, only one operator can be keying the message. The bus is thus &quot;occupied&quot; as long as the message is being sent. When done, anyone else can key their message.  It doesn't matter if the message is intended for an operator who isn't listening, the message is still &quot;put on the wire&quot;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-08-04T19:57:46.827" LastActivityDate="2014-08-04T19:57:46.827" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10288" PostTypeId="2" ParentId="10283" CreationDate="2014-08-04T19:20:58.307" Score="6" Body="&lt;p&gt;I would say the network is occupied (bus topology) as long as someone is sending data. Once the medium is free (no other node is transmitting), any node can start transmitting. One way this process is governed in Ethernet is via &lt;a href=&quot;http://en.wikipedia.org/wiki/Carrier_sense_multiple_access_with_collision_detection&quot;&gt;Carrier Sense Multiple Access/Collision Detection&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination node is unreachable, this is not handled at layer 2 (again talking about Ethernet, but as far as I know, there's no other protocol that would handle this at OSI layer 2). The sent frame is lost and this must be detected by an upper layer protocol, such as TCP. TCP works based on acknowledgement, if a certain piece of the sent data is not acknowledged as received by the destination within a certain time, the sending device will try again.&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2014-08-04T19:20:58.307" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10290" PostTypeId="2" ParentId="7801" CreationDate="2014-08-04T19:50:23.833" Score="3" Body="&lt;p&gt;STUN or TURN can be used when your SIP device is behind NAT and the device doing the NAT doesn't have an ALG (Application Layer Gateway) that translates your internal IP to your external IP in the SIP messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is as follows, let's say by example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;phone1: IP 192.168.0.88 (a private network)&lt;/li&gt;&#xA;&lt;li&gt;router1: LAN: 192.168.0.1, WAN: 198.51.100.43&lt;/li&gt;&#xA;&lt;li&gt;sipserver1: 198.51.100.1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that SIP messages are carried by layer 4 protocol UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SIP registration packet passes through router1, which will translate the source address of the UDP packet from 192.168.0.88 to 198.51.100.43. Thus, sipserver1 will see 198.51.100.43 as source IP. However, the SIP registration message contains the IP address of phone1 in its headers and sipserver1 will use that information, and not the layer 4 (UDP) source address. So the information in the SIP header has precedence. In other words, the registration database of sipserver1 will list 192.168.0.88 as the address of phone1, which is unreachable from sipserver1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router equipped with a SIP ALG, will recognize that a SIP message is being carried in a UDP packet, and will also translate the information inside the SIP headers, thus alleviating the need for STUN or TURN. phone1 will then correctly register as 198.51.100.43. Any traffic coming back from sipserver1 destined for phone1 will again be translated by router1 (this is how NAT works).&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2014-08-04T19:50:23.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10291" PostTypeId="2" ParentId="10283" CreationDate="2014-08-04T20:08:11.283" Score="5" Body="&lt;p&gt;In a Bus topology, all transceivers connected to the same bus can &quot;hear&quot; each other. This means that they are all a part of the same &lt;a href=&quot;https://en.wikipedia.org/wiki/Collision_domain&quot; rel=&quot;noreferrer&quot;&gt;collision domain&lt;/a&gt;.  When transceivers  transmits something on the bus, the others have to be quiet to avoid a collision. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of this, is the old &lt;a href=&quot;http://docwiki.cisco.com/wiki/Ethernet_Technologies#Half-Duplex_Transmission-The_CSMA.2FCD_Access_Method&quot; rel=&quot;noreferrer&quot;&gt;Half - Dulpex Ethernet&lt;/a&gt;, that used coaxial cables to form a bus topology, with CSMA/CD to avoid and cure collisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that in mind, I think that the correct phrasing is that the bus is occupied &lt;strong&gt;while there is still data on the line, regardless of the receiver&lt;/strong&gt;. Note that I say &quot;data on the line&quot; instead of &quot;while data is being transmitted&quot; since the data remains on the line for a while after the initial transmission due to &lt;a href=&quot;https://en.wikipedia.org/wiki/Propagation_delay&quot; rel=&quot;noreferrer&quot;&gt;propagation delay&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="3905" LastActivityDate="2014-08-04T20:08:11.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10292" PostTypeId="1" AcceptedAnswerId="10367" CreationDate="2014-08-04T20:29:26.887" Score="3" ViewCount="16389" Body="&lt;p&gt;I have a pair of Cisco 2960-X's in a stack configuration using stack modules. This gives me a total of 4, 10 gbps SFP+ slots. I am using interfaces &lt;code&gt;Te1/0/1&lt;/code&gt; and &lt;code&gt;Te2/0/1&lt;/code&gt; as 10 gbps uplinks to the core and previously had &lt;code&gt;Te1/0/2&lt;/code&gt; and &lt;code&gt;Te2/0/2&lt;/code&gt; open.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I need to add a 1 gbps link coming off of one of these switches out to another device which only supports 1 gbps fiber SFP modules. I hooked up a 1 gbps SFP module to the &lt;code&gt;Te2/0/2&lt;/code&gt; interface, however it continued to show the type as &quot;Not Present&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After working at it for a bit I reloaded the switch to find that the list of interfaces had changed to now show a &lt;code&gt;Gi2/0/49&lt;/code&gt; and &lt;code&gt;Gi2/0/50&lt;/code&gt; while now missing &lt;code&gt;Te2/0/2&lt;/code&gt;. (As a side note the &lt;code&gt;Gi2/0/49&lt;/code&gt; interface shows &quot;Not Present&quot; while the &lt;code&gt;Te2/0/1&lt;/code&gt; interface shows the 10 gbps SFP+ module). &lt;code&gt;Gi2/0/50&lt;/code&gt; now shows the 1 gbps SFP and works correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way for the switch to perform this detection process without having to reboot it? I may have to swap these around again in the near future and I would rather not cause downtime for the other systems that are plugged into that switch if it can be avoided.&lt;/p&gt;&#xA;" OwnerUserId="5613" LastEditorUserId="8499" LastEditDate="2018-12-22T06:11:07.270" LastActivityDate="2018-12-22T06:11:07.270" Title="Cisco 2960-X Discover SFP Modules Without Rebooting" Tags="|cisco|switch|cisco-catalyst|sfp|transceiver|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10294" PostTypeId="1" CreationDate="2014-08-04T22:41:47.443" Score="4" ViewCount="1814" Body="&lt;p&gt;I have an outdoor venue where I'm planning a wifi network, the venue covers 350 meters by 350 meters. This is not a question about equipment but only about the planning in theory.&#xA;I will deploy multiple access points across the site on different channels with the same ssid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I divide the area in to several small vlans / dhcp scopes, or is it better to create a large dhcp scope like a /21?&lt;/p&gt;&#xA;" OwnerUserId="7807" LastEditorUserId="775" LastEditDate="2014-08-05T09:50:25.137" LastActivityDate="2014-08-05T12:48:39.110" Title="Multiple VLANS or single large subnet for WiFi with potential 1500+ users" Tags="|wireless|ipv4|dhcp|subnet|design|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10297" PostTypeId="1" AcceptedAnswerId="10300" CreationDate="2014-08-05T05:47:46.847" Score="3" ViewCount="4521" Body="&lt;p&gt;Recently I've been trying to get my head around MPLS, it's a part of the project we're doing. During one of our meetings one of the participant ask a question: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Since LSRs doesn't check IP routing table when it's forwarding packets. If we're sure that every packet is going through MPLS not the normal IP networks, is it necessary to have IP protocols running on LSRs?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I've been trying to get the answer to this question, but can't seems to find a clear enough answer. The closest one I can find is here.&#xA;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6218/mpls-can-reroute-but-can-it-route&quot;&gt;MPLS can reroute, but can it route?&lt;/a&gt;.  That question says MPLS requires a layer 3 protocol to work properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what if the whole network from end-to-end is an MPLS network, will the IP protocol still be necessary? My guess is it's still necessary but my understanding to MPLS is not clear enough so that I can point out a situation that this won't work.&lt;/p&gt;&#xA;" OwnerUserId="7818" LastEditorUserId="8499" LastEditDate="2018-03-21T00:50:00.800" LastActivityDate="2018-03-21T00:50:00.800" Title="Do MPLS LSRs require a Layer 3 IP routing protocol?" Tags="|routing|ipv4|layer3|mpls|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10298" PostTypeId="2" ParentId="10292" CreationDate="2014-08-05T06:18:39.597" Score="1" Body="&lt;p&gt;Based on &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL_6981.html#27925&quot; rel=&quot;nofollow&quot;&gt;Cisco Gigabit Ethernet Transceiver Modules Compatibility Matrix&lt;/a&gt; 1G SFP's are supported. (GLC-T is in there.)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q.    Can the 10 Gigabit SFP+ slots on the Cisco Catalyst 2960-X model support 1 Gigabit SFP modules?&lt;br&gt;&#xA;  A.     Yes. The Cisco Catalyst 2960-S models that support 10 Gigabit SFP+ modules can also support SFP modules that operates at 1 Gigabit.&lt;br&gt;&#xA;  Q.    Can the 10 Gigabit SFP+ slots on the Cisco Catalyst 2960-X models support 100-Mb SFP modules?&lt;br&gt;&#xA;  A.     No. The Cisco Catalyst 2960-X models that support 10 Gigabit SFP+ modules cannot support SFP modules that operate at less than 1 Gigabit.&lt;br&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-2960-x-series-switches/qa_c67-728348.html#_Toc393235529&quot; rel=&quot;nofollow&quot;&gt;2960-X Series Q &amp;amp; A&lt;/a&gt; (note the 2960-S typo)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-05T06:18:39.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10300" PostTypeId="2" ParentId="10297" CreationDate="2014-08-05T06:27:25.400" Score="5" Body="&lt;p&gt;In theory you can run MPLS without an IGP, any sane network admin would not though. MPLS labels can be assigned through:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LDP&#xA;RSVP-TE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Generally a router runs IGP to populate the Routing Information Base (RIB). This is the control plane, routes are then installed into the Forwarding Information Base (FIB). This is the data plane forwarding, depending on platform, there may also be distributed forwarding on linecards so the linecard will have a local database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When running LDP, labels are advertised to adjacent routers based on the RIB. The labels are then stored in the Label Information Base (LIB). This is the control plane and equivalent to the RIB but contains labels. The LIB is then one of the components used to build the Label Forwarding Information Base (LFIB) which is the equivalent of the FIB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running LDP, without an IGP, the labels would not be assigned because there are no routes in the RIB. This could be solved by entering static routes but it's obviously not a scalable solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using RSVP-TE, labels are not assigned through the RIB. Tunnels are manually defined, connectivity is still needed between the headend and tailend, which is usually done through IGP but could be done through static routing as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are special cases where routing is not needed with RSVP-TE because the neighbor is statically defined such as in the configuration below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet1/0&#xA;ip address 20.0.23.2 255.255.255.0&#xA;mpls traffic-eng tunnels&#xA;mpls traffic-eng passive-interface nbr-te-id 3.3.3.3 nbr-if-addr 20.0.23.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example above came from &lt;a href=&quot;http://mellowd.co.uk/ccie/?p=4106&quot; rel=&quot;noreferrer&quot;&gt;RSVP-TE without IGP&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the configuration is possible but definitely not recommended. To be able to reach the router remotely for management you would want to have an IGP running, also possible to solve through static routes of course. In the end it's about scalability and how prone to error each solution is.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-08-05T06:27:25.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10302" PostTypeId="2" ParentId="6655" CreationDate="2014-08-05T10:14:47.997" Score="5" Body="&lt;p&gt;In screenos the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vrouter &quot;trust-vr&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is moving you into editing the trust-vr router section. trust-vr is &lt;em&gt;normally&lt;/em&gt; the default routing instance. The next command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set route 80.70.128.142/32 vrouter &quot;UntrustGi-vr&quot; preference 20 metric 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;adds an entry into the trust-vr routing table saying route all traffic to 80.70.128.142/32 to another virtual routing instance called &quot;UntrustGi-vr&quot; with a preference of 20 and metric 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now depending on if you have changed the trust-vr routing instance to be the non default would depend on how you would add it in Junos.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If it is the default routing instance then you just need to do&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-options static route 80.70.128.142/32 next-table UntrustGi-vr.net.0 preference 20&#xA;set routing-options static route 80.70.128.143/32 metric 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which adds the static route into the default routing table inet.0. The config should look like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routing-options {&#xA;    static {&#xA;        route 80.70.128.142/32 {&#xA;            next-table UntrustGi-vr.inet.0;&#xA;            metric 1;&#xA;            preference 20;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you looked at the routing table you would see this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inet.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;80.70.128.142/32   *[Static/20] 00:08:54, metric 1&#xA;                      to table UntrustGi-vr.inet.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If it isn't the default routing instance and you had created a routing instance called trust-vr then you would do&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-instance trust-vr routing-options static route 80.70.128.142/32 next-table UntrustGi-vr.net.0 preference 20&#xA;set routing-instance trust-vr routing-options static route 80.70.128.142/32 metric 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The config should look similar to this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routing-instances {&#xA;    trust-vr {&#xA;        routing-options {&#xA;            static {&#xA;                route 80.70.128.142/32 {&#xA;                    next-table UntrustGi-vr.inet.0;&#xA;                    metric 1;&#xA;                    preference 20;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the routing table should show this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;trust-vr.inet.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;80.70.128.142/32   *[Static/20] 00:03:15, metric 1&#xA;                      to table UntrustGi-vr.inet.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="139" LastActivityDate="2014-08-05T10:14:47.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10303" PostTypeId="2" ParentId="10294" CreationDate="2014-08-05T10:54:51.743" Score="2" Body="&lt;p&gt;its never a good idea to create to large Broadcast domains. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine, 1 client sends an broadcast(maybe an arp-request), all 1500+ user have to deal with it, its  a waste of bandwith.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if its fit your setup and you habe enought IPs make smal scopes to avoid high basic-noise on your Network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As discussed below if you like to use WLAN-Roaming you can span a big L2-Broadcastomain and use client isolation, to avoid broadcasts flooding your Network.&lt;/p&gt;&#xA;" OwnerUserId="7819" LastEditorUserId="7819" LastEditDate="2014-08-05T12:48:39.110" LastActivityDate="2014-08-05T12:48:39.110" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10304" PostTypeId="2" ParentId="6988" CreationDate="2014-08-05T11:23:35.353" Score="2" Body="&lt;p&gt;i belief you have made 1 mistake in your mind. The Router is for routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;set up an Proxy Server with your 8080-Port open. In the Proxy configuration you can create a rule whitch pipe's the requests from PROXYIP:8080 to 220.221.x.x:80.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your main Problem was &quot; I want it to load 220.221.x.x:80 website&quot; why not just use one of your clients and out of RouterA-Network you dont must create an Port-forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you like to hide the ServerC-Address from your users use the proxy-configuration discribed above. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;just in addition&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You just need a Port forwarding for the opposite case. If you try to connect ServerC (Internet) with one Client in RouterA-(local)Network. Than configure a Static Ip for the Client and than configure your NAT as you done but with the Client-Adress&lt;/p&gt;&#xA;" OwnerUserId="7819" LastActivityDate="2014-08-05T11:23:35.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10305" PostTypeId="2" ParentId="10024" CreationDate="2014-08-05T11:50:19.777" Score="-1" Body="&lt;p&gt;Use Wireshark, to sniff the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Nodes must populate a change in the network if you connect or disconnect a client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you catch this intel you can analyse it and &lt;strong&gt;the type of pupulating information across the mesh should gibe you genought information to determine the protokol.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Ad_hoc_protocol_list&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Ad_hoc_protocol_list&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the only time i get in touch with a mesh they used OSLR &lt;/p&gt;&#xA;" OwnerUserId="7819" LastActivityDate="2014-08-05T11:50:19.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10313" PostTypeId="1" AcceptedAnswerId="10315" CreationDate="2014-08-06T03:05:24.077" Score="2" ViewCount="307" Body="&lt;p&gt;Is there a good estimate to how many ipv6 prefixes are currently being used?&lt;/p&gt;&#xA;" OwnerUserId="7838" LastEditorUserId="775" LastEditDate="2014-12-08T12:44:05.327" LastActivityDate="2014-12-08T12:44:05.327" Title="How many ipv6 prefixes are currently in use?" Tags="|routing|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10315" PostTypeId="2" ParentId="10313" CreationDate="2014-08-06T05:35:25.337" Score="9" Body="&lt;p&gt;If by 'in use' you mean 'seen in the DFZ': around 20K. The &lt;a href=&quot;http://ring.nlnog.net&quot;&gt;NLNOG Ring&lt;/a&gt; has a nice dashboard on which is summarizes the number of prefixes their &lt;a href=&quot;http://lg.ring.nlnog.net&quot;&gt;lookingglass&lt;/a&gt; receives from members. As you can see &lt;a href=&quot;http://ring.nlnog.net/lg&quot;&gt;here&lt;/a&gt;, just over 20K prefixes can be seen there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;APNIC currently &lt;a href=&quot;http://stats.labs.apnic.net/bgp/XA?c=XA&amp;amp;t=1&amp;amp;u=1&amp;amp;v=1&amp;amp;w=1&amp;amp;t=0&amp;amp;u=0&amp;amp;w=0&quot;&gt;reports&lt;/a&gt; a bit less: about 18.5K prefixes, Hurricane Electric &lt;a href=&quot;http://bgp.he.net/ipv6-progress-report.cgi?section=ipv6_prefixes&quot;&gt;reports&lt;/a&gt; just under 18K. The IP transit providers my current employer uses all advertise just over 18K prefixes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's no single correct answer here, it all depends on the filter policies networks and their upstreams use and how all networks on the internet are connected, but it's fair to say that 'around 20K' is a good approximation.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2014-08-06T06:46:45.833" LastActivityDate="2014-08-06T06:46:45.833" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10318" PostTypeId="1" CreationDate="2014-08-06T12:20:25.173" Score="2" ViewCount="3452" Body="&lt;p&gt;I have two geographically separated DC and DR sites with hosts on the same subnet. The hosts on respective networks are connected with each other through respective switches at each site. Both the switches are GigaBit switches. I have a point to point link between the locations which is 5Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect the networks with the point to point link, I get a ping latency of about 18 ms. However as soon as clients start accessing the DC, through a WAN link on a router in front of the switch, I experience serious degradation of connectivity (ping latency = 400 ms and 50% drops). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone please tell me, what do I need to do, to alleviate the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the details: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switches are GigaBit layer2 Ethernet switches . &lt;/li&gt;&#xA;&lt;li&gt;Wan link is wireless Point To Point 5 MBps Link. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Topology is as below. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(DC) Servers ------&amp;gt;Switch-----------&amp;gt;Router----Clients on ILL WAN Link&#xA;                      :&#xA;                      :&#xA;                      :&#xA;         WAN Point to point link (5Mbps)&#xA;                      :&#xA;                      :&#xA;                      :&#xA;&#xA;(DC) Servers ------&amp;gt;Switch-----------&amp;gt;Router----currently no clients&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All servers have Gigabit NICs. All ports on both the switches are on &quot;Auto&quot; mode. Users connect to servers on each side through separate ILL links which terminate into respective routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The P2P link connects the respective switches at the DC and DR. There is no traffic on the P2P WAN link currently. Just the ping traffic, that i use to test. The ping connectivity/latency is fine when no users are connected to DC, but as soon as users get connected, it starts facing problems. Subnets on DC and DR are same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know if you need any more details.&lt;/p&gt;&#xA;" OwnerUserId="7843" LastEditorUserId="775" LastEditDate="2014-12-08T12:43:42.970" LastActivityDate="2014-12-08T12:43:42.970" Title="point to point networking between DC and DR" Tags="|routing|wan|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10319" PostTypeId="2" ParentId="9659" CreationDate="2014-08-06T13:16:17.220" Score="2" Body="&lt;p&gt;I think this is normal behavoir.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the reboot you router has to learn the neigbor-routes. The upper and lower left circle in my picture are around the values representing the known active-used routes of your router. The upper right circle shows that there are stimm routes to learn. This is the Reason for the high Send-value. In the end both routers have prety close accepted-Routes-Values and this is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There could be some reasons why router e.e.e.e dont learn all routes, maybe is a configuration thing and he reject some routes or it is misconfiguration in the update timings. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/T1k2a.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="7819" LastActivityDate="2014-08-06T13:16:17.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10320" PostTypeId="1" CreationDate="2014-08-06T13:34:30.373" Score="4" ViewCount="341" Body="&lt;p&gt;A client of mine is part of a bigger group of companies running a MPLS for connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Clients IP Address range is 192.168.13.0/24. We use this with DHCP and MASK of 255.255.255.0 and our addresses are running out quickly so I need to increase the capacity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This leaves me with one of two options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Change the subnet mask to 255.255.252.0 and add another subnet to the dhcp. This will allow me to use 192.168.12/22 or 192.168.12.0 to 192.168.15.255.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Add an IP on the router on 192.168.14.0/24 and do routing between the subnets on the router.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Problem with option 1 is that 192.168.12.0/24 is used by another company on the MPLS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem with option 2 is that all the traffic between the subnets 192.168.13.0/24 and 192.168.14.0/24 will need to go though the router on a 100mbps port? Is this assumption correct or will the devices be able to communicate &quot;directly&quot; without going through the router once the route is established?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would love to just get a new /22 range as one is available, but all the work involved moving the IP addresses of servers, odbc's ERP system clients etc would be costly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would you do?&lt;/p&gt;&#xA;" OwnerUserId="7844" LastActivityDate="2014-08-07T09:41:12.253" Title="Subnetting Issue with legacy network and poor planning" Tags="|router|tcp|subnet|mpls|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10321" PostTypeId="1" AcceptedAnswerId="10323" CreationDate="2014-08-06T14:25:29.833" Score="3" ViewCount="10244" Body="&lt;p&gt;I am trying to replace the startup configuration on Cisco Nexus device using a file on remote server. I tried the instructions given at this page:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_0/nx-os/fundamentals/configuration/guide2/fun_nx-os_book/fun_config_files.html#wp1236980&quot; rel=&quot;nofollow&quot;&gt;Working With Configuration Files: Downloading the Startup Configuration From a Remote Server&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I tried running command &lt;code&gt;copy tftp://&amp;lt;server-ip-address&amp;gt;/nexus-startup.cfg startup-config&lt;/code&gt; and got the following output with error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nexus7K01# copy tftp://172.16.38.4/nexus7k01.cfg startup-config&#xA;Enter vrf (If no input, current vrf 'default' is considered): management&#xA;Trying to connect to tftp server......&#xA;Connection to Server Established.&#xA;TFTP get operation was successful&#xA;sysmgr_copy_nvram_dest_action: src uri_type = 2 is not supported yet&#xA;Nexus7K01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried to copy the file using all the four remote server protocol and got the same error with different URI type. &lt;code&gt;1 for FTP, 128 for SCP and 512 for SFTP&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device is a Cisco Nexus 7000 series device with following details:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Software&#xA;  BIOS:      version 3.22.0&#xA;  kickstart: version 6.1(3)&#xA;  system:    version 6.1(3)&#xA;&#xA;Hardware&#xA;  cisco Nexus7000 C7010 (10 Slot) Chassis (&quot;Supervisor module-1X&quot;)&#xA;  Intel(R) Xeon(R) CPU         with 8251588 kB of memory.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please let me know what am I doing wrong and how can I rectify this error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Varun&lt;/p&gt;&#xA;" OwnerUserId="7845" LastEditorUserId="7845" LastEditDate="2014-08-06T15:45:29.450" LastActivityDate="2014-09-06T01:38:33.923" Title="How to download startup configuraton from a remote server on Cisco NX-OS" Tags="|cisco-nx-os|tftp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10322" PostTypeId="2" ParentId="10320" CreationDate="2014-08-06T15:10:15.070" Score="0" Body="&lt;p&gt;When the customer is coming into the network, are they utilizing a sub interface or do they have their own at each end? or is all of this being done via the global routing table?  I ask because you mentioned MPLS, you could set the customer up to have their own VRF with entry points at each end, for example:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Same physical link, no sub-ints.  Place route-map that associates traffic from the customer's address to a specific VRF&lt;/li&gt;&#xA;&lt;li&gt;Sub-ints, place ip vrf forwarding entry on the sub-int&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This would allow you to place the overlapping route in your router.&lt;/p&gt;&#xA;" OwnerUserId="7847" LastActivityDate="2014-08-06T15:10:15.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10323" PostTypeId="2" ParentId="10321" CreationDate="2014-08-06T15:20:36.790" Score="4" Body="&lt;p&gt;I would first check that you correctly have the 'nexus-startup.cfg' in your TFTP root folder, so that it's not a path issue.  I suggest this because the uri error your getting would suggest the path is not found.  Also - you'll need to address your syntax.  Following from Nx-OS contextual help:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; tftp:  Enter URL &quot;tftp:[//server[:port]][/path]&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also - I would try just copying it to your flash and then to startup-config after that if it's not liking the syntax you used to copy it over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This known issue with your NX-OS version could be related, or even the root cause:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CSCud05567&#xA;Symptom : Following a system switchover, copying to bootflash on the supervisor module does not work.&#xA;&#xA;Conditions : This symptom might be seen under normal operating conditions for a Cisco Nexus 7000 Series device.&#xA;&#xA;Workaround : None.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Source is &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/6_x/nx-os/release/notes/61_nx-os_release_note.html#pgfId-608687&quot; rel=&quot;nofollow&quot; title=&quot;HERE&quot;&gt;HERE&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The good news is that this issue is only appearing from 6.1, so if you are in a position to move down to 6.0 family of NX-OS you should be good.  My personal preference anyway is to stay a family behind the latest and greatest unless there's a security patch.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2014-08-07T14:17:15.597" LastActivityDate="2014-08-07T14:17:15.597" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="10324" PostTypeId="1" CreationDate="2014-08-06T17:23:56.683" Score="2" ViewCount="1998" Body="&lt;p&gt;We are facing one issue while implementing Akamai in our application, issue is related to session maintenance. My application structure is – Akamai (xyz.com) -&gt; Origin (origin-xyz.com) -&gt; VIP / LB (Session Affinity on Cookie) -&gt; WebServer 1 OR WebServer 2 We don’t have app server, application runs on IIS server on web server itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further details - a. one data center for my servers b. one VIP c. two web servers in pool behind VIP d. Cookie persistence session setting enabled on VIP for port 80 and 443&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try accessing my application without Akamai i.e., with origin.xyz.com everything works fine, no session issue. But if I try with xyz.com (including Akamai) session issue come into picture. Request is floating between two web servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*I am not sure if below information is correct or make any difference but would like to share, as I am not network expert. Note – VIP configured on load balancer is external (internet) if we access the site with origin-xyz.com then request directly approach load balancer but when we are accessing xyz.com then firstly it approaches to Akamai which is within same network and Akamai internally call the origin-xyz.com (seems some gap here, not sure what’s that and what’s the fix)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion for resolving this issue.&lt;/p&gt;&#xA;" OwnerUserId="7848" LastActivityDate="2014-08-06T19:09:02.820" Title="Session, loadbalancer and Akamai" Tags="|load-balancer|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10326" PostTypeId="1" CreationDate="2014-08-06T18:01:41.490" Score="4" ViewCount="3837" Body="&lt;p&gt;I'm looking to purchase a Cisco 2900 series router. My ideal router costs far more than the business' would like to pay, leading me to look into used equipment. (A used 2951 is approximately the same cost as a new 2911, but with over double the routing capacity.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any significant security or reliability risks, or pitfalls to look out for, when purchasing used equipment?&lt;/p&gt;&#xA;" OwnerUserId="6368" LastActivityDate="2014-08-06T19:19:43.083" Title="What are the risks of buying used networking equipment?" Tags="|router|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10328" PostTypeId="2" ParentId="10320" CreationDate="2014-08-06T18:27:09.247" Score="0" Body="&lt;p&gt;The best solution is to add additional subnets as needed and route between them.  Don't increase the size of your broadcast domain, as this will lead to heartburn later.  In other words, option 2 is the better choice.  And to answer your question, yes, you will need to route between the subnets.  In this case, it would be best to use a layer 3 switch to handle your inter-VLAN routing, instead of hairpinning through an external router connected at 100 Mbps.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2014-08-06T18:27:09.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10330" PostTypeId="1" CreationDate="2014-08-06T18:44:47.657" Score="3" ViewCount="1763" Body="&lt;p&gt;We have a new requirement to have two-factor authentication for a certain SSIDs in our enterprise. Currently we run PEAP-MSCHAPv2 to pass windows credentials to a RADIUS server (NPS running on a domain controller) and Cisco 1142 WAPs (all autonomous, no WLC in place).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some methods of two-factor authentication for Wi-Fi SSIDs? I am aware of setting up an authentication proxy (e.g. RSA, etc.). However, would like to know if there are other options, and which, if any in your experience, are more common?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="8499" LastEditDate="2016-04-03T00:46:07.073" LastActivityDate="2016-04-03T00:46:07.073" Title="Two-factor authentication for Wi-Fi?" Tags="|cisco|wireless|authentication|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10331" PostTypeId="2" ParentId="10320" CreationDate="2014-08-06T18:49:52.603" Score="5" Body="&lt;p&gt;Based on the information you provide, I would go with option #3.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Add a secondary /22 or /23 IP range to the interface.&lt;/li&gt;&#xA;&lt;li&gt;Test the new range for expected results (especially since some servers/services may limit access by IP in firewall or ACL).&lt;/li&gt;&#xA;&lt;li&gt;Set this new range as the DHCP scope so clients will move automatically as they renew their DHCP lease.  &lt;/li&gt;&#xA;&lt;li&gt;For devices with static IP addresses: &#xA;&lt;ul&gt;&#xA;&lt;li&gt;Leave devices with static IPs in the current IP range if it is too difficult to move.&lt;/li&gt;&#xA;&lt;li&gt;Migrate those you can move at your leisure. &lt;/li&gt;&#xA;&lt;li&gt;New static assignments should be put in the new range, so over time the old range will get phased out (even if it takes years).&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Obviously there could be a lot more to this plan, but with the limited details provided, this is the framework I would follow.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-08-06T18:49:52.603" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10332" PostTypeId="2" ParentId="10326" CreationDate="2014-08-06T18:57:35.537" Score="4" Body="&lt;p&gt;The short list...&lt;br&gt;&#xA;a) it might be broken (not unlikely with shady eBay stores)&lt;br&gt;&#xA;b) it might be &quot;stolen&quot; (i.e. still on someone else's inventory and/or contracts)&lt;br&gt;&#xA;c) (and here's the big one) only slightly better than a snowball's chance of getting a Cisco smartnet contract on it as it very likely wasn't bought from an &quot;authorized&quot; cisco partner/reseller. Which means no legal/legitimate means of getting software upgrades.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-06T18:57:35.537" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10333" PostTypeId="2" ParentId="10324" CreationDate="2014-08-06T19:09:02.820" Score="4" Body="&lt;p&gt;If I recall correctly, Akamai performs multiple requests in &lt;em&gt;one&lt;/em&gt; TCP/HTTP connection to your origin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If using F5 (but could be of interest as well if not), see &lt;a href=&quot;http://support.f5.com/kb/en-us/solutions/public/7000/200/sol7208.html&quot; rel=&quot;nofollow&quot;&gt;http://support.f5.com/kb/en-us/solutions/public/7000/200/sol7208.html&lt;/a&gt; and enable OneConnect&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes the F5 to examine the client cookie for each HTTP request, instead of just only for the first request. Other vendors might have likewise options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Content Switching&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a OneConnect profile is enabled for an HTTP virtual server, and an HTTP client sends multiple requests within a single connection, the BIG-IP system is able to process each HTTP request individually. The BIG-IP system sends the HTTP requests to different destination servers as determined by the load balancing method. Without a OneConnect profile enabled for the virtual server, the BIG-IP system performs load-balancing only once for each TCP connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: If no OneConnect profile is configured for the virtual server, certain persistence methods can occasionally fail due to HTTP parsing issues. For more information, refer to SOL7964: Persistence may fail for subsequent requests on Keep-Alive connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a OneConnect profile is enabled for a TCP virtual server that does not have an HTTP profile applied, and a client sends multiple requests within a single connection, the BIG-IP system is able to process each request individually. The BIG-IP system sends the requests to different destination servers as determined by the load balancing method. Without a OneConnect profile enabled for the virtual server, the BIG-IP system performs load-balancing only once for each TCP connection.&lt;/p&gt;&#xA;" OwnerUserId="7851" LastActivityDate="2014-08-06T19:09:02.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10334" PostTypeId="2" ParentId="10326" CreationDate="2014-08-06T19:19:43.083" Score="4" Body="&lt;p&gt;In addition to Ricky's answer I would throw in a couple more:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;d) Generally software licenses are non-transferable, either requiring you to re-license or risk fines if you are found in violation of licensing agreements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e) The device has a status of &quot;destroyed&quot; or &quot;disposed.&quot; This is often the result of &quot;upgrade&quot; deals where the owner provides documentation to the vendor stating they have destroyed or disposed of items to get reduced cost on new equipment.  Not only does this make it impossible to get support on the devices, but depending on local laws this could get you and/or the original owner into legal issues best avoided.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-08-06T19:19:43.083" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10339" PostTypeId="2" ParentId="5461" CreationDate="2014-08-07T01:04:55.480" Score="-1" Body="&lt;p&gt;Some more detail would be in order, intermittent faults are frequently caused by external factors &amp;amp; simple answers can become elusive.  Rule out physical connection issues first.   Specifically if you ping the router &amp;amp; it responds for NNN tries (no loss &amp;amp; consistent reply time), you know the cable plant is sound at least for now.  Likewise when it fails, how it responds (actual timeout errors or TTL expiration, some replies only or excessive times) is just as important &amp;amp; may indicate wiring or connector quality.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As always take good notes &amp;amp; don't write off the scientific method.  You've already eliminated the router itself but consider resetting the device during these tests.  If you can trigger an event where the connection drops (or had failed &amp;amp; now works), trap the logs for review.  Of course if you suspect the radio link arrange a time to eliminate that during the outage, off-hours if necessary to avoid business impact.&lt;/p&gt;&#xA;" OwnerUserId="7856" LastActivityDate="2014-08-07T01:04:55.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10341" PostTypeId="2" ParentId="10320" CreationDate="2014-08-07T04:59:59.337" Score="2" Body="&lt;p&gt;assuming that you can not buy a new l3 switch, I would go for option 2 (two subnets), but I would make them two separate networks also physically/logically. so if you have several floors on your office, give one subnet for each floor, or give one subnet for servers and one for PC, or at the very least make sure that heavy traffic servers are on the &quot;correct&quot; network.. e.g. that the backup server is  on the same subnet as the hosts it will be in charge off. (to avoid overloading your 100Mbps bottleneck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you go for the server vs other split, you could also setup good rules in your firewall, to protect your normal PCs better than servers for example. &lt;/p&gt;&#xA;" OwnerUserId="6375" LastEditorUserId="775" LastEditDate="2014-08-07T09:41:12.253" LastActivityDate="2014-08-07T09:41:12.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10342" PostTypeId="1" AcceptedAnswerId="10356" CreationDate="2014-08-07T05:22:13.687" Score="4" ViewCount="10861" Body="&lt;p&gt;We have two separate networks with SRXes on both sides (router, firewall, and site2sitevpn).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On one side (Site A), we have two ISPs (BGP), and currently the VPN is setup to the IP address of one of our ISP (ISP1). but if ISP1 line should go down our VPN also goes down. is there a way to Automatically change the VPN tunnel IP address to the IP of the second ISP (ISP2) in the event that ISP1 should go down? or is that a stupid way to do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is is perhaps better to setup a 2nd VPN tunnel to the ISP2 IP address? if so, how can I automatically start the 2nd VPN if 1st fail?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Map:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2Rwru.png&quot; alt=&quot;explanations of network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: site A has its own AS and ip series, and used BGP to route traffic to/from the two ISPs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have some clarifications, and also some new information (to futher complicate things).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) SITE A has only one SRX, with each ISP on a separate port.&#xA;ge-0/0/4 = isp1&#xA;ge-0/0/3 = isp2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;today the site2site vpn St0 (used ip range 192.168.21.0/30 on the vpn), uses only isp1, but I would like to have isp2 as a backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Site B actually only has one ISP, but they have given us 2 different IP addresses, one of the addresses uses a special routing to their upstream provider (but only that network!), wheras the other IP address uses BGP and will use whatever routing upstream work.. so we have&#xA;vlan.12 ip address 1) 6.6.6.6/29 (the one we use today)&#xA;vlan.12 ip address 2) 5.5.5.5/29 (another ip we also want to use).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the ip 6.6.6.6 gives us very fast speeds between the offices, as the route goes to the shortes path.. but it is limited to one provider, so the chance that it goes down is quite high. ip 5.5.5.5 is quite a bit slower, but is more robust to faults between the two networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/p76N3.png&quot; alt=&quot;further explanations of network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the image above, you can see in red where the site2site vpn goes today. So in the end I would like to have redundancy so that all 4 combinations should work.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;WAN1 - WAN-A&lt;/li&gt;&#xA;&lt;li&gt;WAN1 - WAN-B&lt;/li&gt;&#xA;&lt;li&gt;WAN2 - WAN-A&lt;/li&gt;&#xA;&lt;li&gt;WAN2 - WAN-B&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;noteA: vlan.12 is just a vlan that could easily have been a port such as ge-0/0/2, I have just setup the vlan to be able to use other physical ports on the SRX just in case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;noteB: SITE B only uses one physical port to one and same ISP, but uses two different IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks again for the help so far. I will setup a service window to test tome of these things soon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;update2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP setup on SiteA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;protocols {&#xA;    bgp {&#xA;    group bgp-ISP2 {&#xA;        preference 290;&#xA;        local-address 8.8.8.9;&#xA;        log-updown;&#xA;        import import-bgp-ISP2;&#xA;        authentication-key &quot;somekey&quot;; ## SECRET-DATA&#xA;        peer-as &amp;lt;ASNUMBER&amp;gt;;&#xA;        neighbor 8.9.7.6 {&#xA;            export export-bgp-ISP2;&#xA;        }&#xA;    }&#xA;    group bgp-ISP1 {&#xA;        preference 250;&#xA;        local-address 7.7.7.8;&#xA;        log-updown;&#xA;        import import-bgp-ISP1;&#xA;        authentication-key &quot;somekey&quot;; ## SECRET-DATA&#xA;        peer-as &amp;lt;ASNUMBER&amp;gt;;&#xA;        neighbor 7.8.9.1 {&#xA;            export export-bgp-ISP1;&#xA;        }&#xA;    }&#xA;}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6375" LastEditorUserId="6375" LastEditDate="2014-08-13T09:19:33.193" LastActivityDate="2015-10-07T19:48:49.910" Title="Backup IP for site 2 site VPN (Juniper SRX)" Tags="|vpn|juniper-srx|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10346" PostTypeId="2" ParentId="10318" CreationDate="2014-08-07T12:33:51.063" Score="0" Body="&lt;p&gt;Knowing the brand/model of switch would be helpful too, but based on your description, the most likely problem is that your WAN link simply can't keep up with the traffic.  The link is congested, and therefore you are dropping packets.  If your wireless link is 802.11, you're lucky if you can get 2-3 Mbps actual throughput.  You don't say how many servers you have, but it wouldn't take very many to completely saturate that link.  Simply put, you need (a lot) more bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-07T12:33:51.063" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10347" PostTypeId="1" AcceptedAnswerId="10466" CreationDate="2014-08-07T13:38:26.683" Score="4" ViewCount="5551" Body="&lt;p&gt;We are running a Cisco WLC 5508 with version 7.6.120. We have over 100 autonomous APs around the globe. The latest CAPWAP firmware from Cisco's website for these APs contains CAPWAP code for 7.6.100, not 7.6.120. So each AP I load this with and reboot will then download the latest firmware from the WLC so it has 7.6.120. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This causes a lot more downtime on the APs, especially ones over poor WAN connections. Some sites are 24/7 operations and downtime on the APs can cause production problems if there is not adequate overlapping WIFI coverage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am trying to find a way to pull the update from WLC manually to my laptop to preload on the AP so when I reboot it I only need to configure it in WLC, not wait for it to download another full firmware package. That or send the latest code direct from the WLC to the autonomous AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible? Or am I stuck loading firmware twice on these APs to convert them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: The AP models are 1252, 1262, 2602E, and 3602E all running various 15.X autonomous firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT3: I've tried Smithers' suggestion of grabbing the firmware from a fully updated CAPWAP AP connected to the WLC. It appears to work when I generate the tar file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap-01#archive upload-sw flash:2602.tar&#xA;Image info:&#xA;    Version Suffix: k9w8-.152-4.JB5&#xA;    Image Name: ap3g2-k9w8-mx.152-4.JB5&#xA;    Version Directory: ap3g2-k9w8-mx.152-4.JB5&#xA;    Ios Image Size: 215552&#xA;    Total Image Size: 13701632&#xA;    Image Feature: WIRELESS LAN|LWAPP&#xA;    Image Family: AP3G2&#xA;    Wireless Switch Management Version: 7.6.120.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when I try to load this file on an AP, I get a different set of info for the image. Direct from the &lt;code&gt;info&lt;/code&gt; file in the tar file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version_suffix: diagk9w7-.152&#xA;version_directory: ap3g2-diagk9w7-mx.152&#xA;image_name: ap3g2-diagk9w7-mx.152&#xA;ios_image_file_size: 215552&#xA;total_image_file_size: 10097152&#xA;image_feature: WIRELESS LAN|LWAPP&#xA;image_family: AP3G2&#xA;system_type: 0x9b&#xA;ws_management_version: 7.6.1.118&#xA;info_end:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am unsure why this is a &quot;diag&quot; image and why it is 7.6.1.118 instead of 7.6.120.0.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2014-08-08T02:39:25.700" LastActivityDate="2014-08-15T18:31:14.897" Title="How do I preload an Autonomous AP with the latest CAPWAP firmware from WLC?" Tags="|cisco|wireless|wlc|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10350" PostTypeId="2" ParentId="10347" CreationDate="2014-08-07T18:14:39.873" Score="0" Body="&lt;p&gt;You have to pre-download to your WLC, then pre-download to your APs&#xA;Then, when you're ready, you tell the APs &amp;amp; WLC to reboot using the newest OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used the following &lt;a href=&quot;https://supportforums.cisco.com/discussion/11057996/predownload-image-access-points&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt; to help me understand Cisco's documentation last time I upgraded the WLC &amp;amp; APs on our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the WLC configuration guide:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Download new image to the WLC.&lt;/li&gt;&#xA;&lt;li&gt;Change the new image to backup image. &gt; config boot backup)&lt;/li&gt;&#xA;&lt;li&gt;Predownload new image to access points &gt; config ap image predownload {primary | backup} {ap_name | all}&lt;/li&gt;&#xA;&lt;li&gt;Swap primary and secondary image on AP &gt; config ap image swap {ap_name | all}&lt;/li&gt;&#xA;&lt;li&gt;Make sure all APs have done with the predownload&lt;/li&gt;&#xA;&lt;li&gt;reset system in HH:MM:SS image {swap | no-swap} reset-aps [save-config]&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Note that once Downloaded (to the WLC or the AP) the current image becomes the BACKUP, so it could be a good idea to swap the image until you're ready in case of accidental reboots.&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-08-07T18:14:39.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10352" PostTypeId="2" ParentId="9940" CreationDate="2014-08-07T20:59:29.830" Score="0" Body="&lt;p&gt;After I'd configured the switches in my original post, I additionally had to configure the downstream switches so they knew about the VLANs. Once I did that, everything worked perfectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to everyone that contributed.&lt;/p&gt;&#xA;" OwnerUserId="7525" LastEditorUserId="3191" LastEditDate="2014-08-08T07:30:44.707" LastActivityDate="2014-08-08T07:30:44.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10353" PostTypeId="2" ParentId="10342" CreationDate="2014-08-07T21:32:11.520" Score="2" Body="&lt;p&gt;not sure how it works on Juniper, but if there is any sort of dead peer detection you can do in your VPN setup I'd do it.  On Cisco devices, we set multiple peers and use DPD to push it over when the first peer fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming DPD isn't an option on Juniper, an easy way to do it would be to setup another VPN tunnel to Site B using ISP2's IP address as the endpoint, and use routing (don't know what proto you use inside) to create a secondary path between your sites with a higher administrative distance, that way when the route over your primary tunnel (the lower admin distance) dies, and is removed from your table, the secondary route gets selected, and your tunnel comes up between ISP2 and SITE B. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you post more details I can give you more as well.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2014-08-07T21:32:11.520" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10354" PostTypeId="2" ParentId="10347" CreationDate="2014-08-07T23:21:30.147" Score="2" Body="&lt;p&gt;Take one copy of each of your AP models. You DO have one of each in a lab, right? (If not, you need to push to get this budgeted.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connect them to your WLC so they get the updated code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Console in, download the image for each model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TFTP the appropriate image to each AP worldwide*. Be aware this is going to suck if you don't know how to automate SSHing into the worldwide APs and having them download the image. I don't, and it sucked... and mine were just national!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set the boot image, reboot, and pray.&#xA;(If atheist, drink or smoke... or work on your resume/cv...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enjoy when they come up working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The * means I lied. Do NOT push this to everything at once! What are you, crazy?? Test 1 in the field. Then 2. Then maybe 10... then 50... 100... 1/4th of our environment, then MAYBE all the rest!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://supportforums.cisco.com/&quot; rel=&quot;nofollow&quot;&gt;http://supportforums.cisco.com/&lt;/a&gt; helped me through this a LOT. Might be time to get SmartNet on your WLCs and try to have TAC do this for you. They could actually supply the images for each of your AP models as well.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-08-07T23:21:30.147" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10356" PostTypeId="2" ParentId="10342" CreationDate="2014-08-08T08:56:00.873" Score="8" Body="&lt;p&gt;Junos does have DPD and you can use it in conjunction with multiple endpoint IP addresses in a single IKE tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a bit of info about it here (which I've copied below)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB29211&amp;amp;actp=RSS&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB29211&amp;amp;actp=RSS&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SUMMARY:&lt;/strong&gt;&#xA;This article explains how redundancy in site-to-site VPN can be achieved using multiple address in gateway and dead-peer-detection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PROBLEM OR GOAL:&lt;/strong&gt;&#xA;How to use different modes of dead-peer-detection for VPN failover .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CAUSE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SOLUTION:&lt;/strong&gt;&#xA;The gateway for VPN redundancy can be configured with the following commands :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces fe-0/0/0 unit 0 family inet address 1.1.1.2/24&#xA;set interfaces st0 unit 0 family inet&#xA;set routing-options static route 0.0.0.0/0 next-hop 1.1.1.1&#xA;set security ike policy p1 mode main&#xA;set security ike policy p1 proposal-set standard&#xA;set security ike policy p1 pre-shared-key ascii-text &quot;$9$21oZjmfzCtOHqtO1RlegoJ&quot;&#xA;set security ike gateway g1 ike-policy p1&#xA;set security ike gateway g1 address 2.2.2.1&#xA;set security ike gateway g1 address 3.3.3.1&#xA;set security ike gateway g1 dead-peer-detection interval 10&#xA;set security ike gateway g1 dead-peer-detection threshold 3&#xA;set security ike gateway g1 external-interface fe-0/0/0&#xA;set security ipsec policy p1 proposal-set standard&#xA;set security ipsec vpn v1 bind-interface st0.0&#xA;set security ipsec vpn v1 ike gateway g1&#xA;set security ipsec vpn v1 ike ipsec-policy p1&#xA;set security ipsec vpn v1 establish-tunnels immediately&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first address in the order of configuration is the one chosen to negotiate the tunnel:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gateway g1 {&#xA;            ike-policy p1;&#xA;            address [ 2.2.2.1 3.3.3.1 ];&#xA;            dead-peer-detection {&#xA;                                 interval 10;&#xA;                                 threshold 3;&#xA;                                 }&#xA;            external-interface fe-0/0/0;&#xA;            }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above configuration is in dead-peer-detection optimal mode. It sends probes if packets were sent out (encrypted packets), but no packets were received (decrypted) for the configured interval. Three probe-packets are sent at 10 second intervals.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@srx# run show security ike sa &#xA;Index State Initiator cookie Responder cookie Mode Remote Address &#xA;6770125 UP d570a30c806721ea ccc1572d2f763981 Main 2.2.2.1 &#xA;&#xA;&#xA;root@srx# run show security ipsec sa &#xA;Total active tunnels: 1&#xA;ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway &#xA;&amp;lt;131073 ESP:3des/sha1 1debda06 3397/ unlim - root 500 2.2.2.1 &#xA;&amp;gt;131073 ESP:3des/sha1 7a7dff24 3397/ unlim - root 500 2.2.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As soon as the tunnel drops, dead-peer-detection comes into play. If a response is not received from the peer in 30 seconds, the failover takes place and the tunnel is negotiated with 3.3.3.1 and vice-versa.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@srx# run show security ike sa&#xA;Index State Initiator cookie Responder cookie Mode Remote Address &#xA;6770151 UP 36a2e145e0fd2c10 b3abc0b135cf33fe Main 3.3.3.1&#xA;&#xA;root@srx# run show security ipsec sa &#xA;Total active tunnels: 1&#xA;ID Algorithm SPI Life:sec/kb Mon lsys Port Gateway &#xA;&amp;lt;131073 ESP:3des/sha1 2420b2bd 3598/ unlim - root 500 3.3.3.1 &#xA;&amp;gt;131073 ESP:3des/sha1 5c8bb9da 3598/ unlim - root 500 3.3.3.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Always-Send mode for dead-peer-detection:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to instruct the device to send dead-peer-detection requests, regardless of whether or not there is outgoing IPSec traffic to the peer, the following command is also needed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security ike gateway g1 dead-peer-detection always-send&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured this in a test lab and confirm that it works well. I have 3 devices, S3, S4 and S5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;S4 and S5 both have a basic IPSEC tunnel configured to connect to S3 (7.7.7.22 in my example). The config is dead simple and the same on both devices&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ike {&#xA;    gateway s3-gw {&#xA;        ike-policy ike-policy;&#xA;        address 7.7.7.22;&#xA;        external-interface ge-0/0/1.0;&#xA;    }&#xA;}&#xA;ipsec {&#xA;    policy standard-ipsec-policy {&#xA;        proposal-set standard;&#xA;    }&#xA;    vpn s3 {&#xA;        bind-interface st0.0;&#xA;        ike {&#xA;            gateway s3-gw;&#xA;            ipsec-policy standard-ipsec-policy;&#xA;        }&#xA;        establish-tunnels immediately;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The device S3 has a config that is very similar to the above but has 2 gateways listed and DPD enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant section is in the IKE config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;gateway s4-s5-gw {&#xA;    address [ 7.7.7.21 192.168.211.2 ];&#xA;    dead-peer-detection {&#xA;        always-send;&#xA;        interval 10;&#xA;        threshold 3;&#xA;    }&#xA;    external-interface ge-0/0/1.0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This brings up the tunnel as such&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@TEST-srx3&amp;gt; show security ike security-associations&#xA;Index   State  Initiator cookie  Responder cookie  Mode           Remote Address&#xA;1404200 UP     2f4f0465dc8c4556  d2e6022d0dc213c3  Main           7.7.7.21&#xA;&#xA;root@TEST-srx3&amp;gt; show security ipsec sa&#xA;  Total active tunnels: 1&#xA;  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway&#xA;  &amp;lt;131073 ESP:3des/sha1 d4428f3  3170/ unlim   -   root 500   7.7.7.21&#xA;  &amp;gt;131073 ESP:3des/sha1 5cda9108 3170/ unlim   -   root 500   7.7.7.21&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I deactivate the IKE/IPSEC config sections on S4 the tunnel drops and then comes back up connected to the 2nd gateway&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@TEST-srx3&amp;gt; show security ike security-associations&#xA;&#xA;root@TEST-srx3&amp;gt; show security ipsec sa&#xA;  Total active tunnels: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then after about 30 seconds (10 x 3)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@TEST-srx3&amp;gt; show security ike security-associations&#xA;Index   State  Initiator cookie  Responder cookie  Mode           Remote Address&#xA;1404202 UP     35e54d457be6132f  0444ae31577c71a2  Main           192.168.211.2&#xA;&#xA;root@TEST-srx3&amp;gt; show security ipsec sa&#xA;  Total active tunnels: 1&#xA;  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway&#xA;  &amp;lt;131073 ESP:3des/sha1 93043b2  3595/ unlim   -   root 500   192.168.211.2&#xA;  &amp;gt;131073 ESP:3des/sha1 e5c551e4 3595/ unlim   -   root 500   192.168.211.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you need any help post some config snippets and I'll do my best to have a look!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have built this whole thing in a mini lab. The problem I have found is that while you can use multiple gateways in your IKE configuration you will still need to have an IPSEC tunnel per ISP on each device. This is because you have multiple source IP addresses you want to potentially make an IPSEC tunnel from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/idqYY.png&quot; alt=&quot;Lab Config&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To save me posting a lot of config each SRX (A and B) has two IPSEC tunnels configured as shown below. The things to note are I'm using a single tunnel interface on each device, these are set to multipoint. You could use multiple ones if you wanted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This config will provide full redundancy if a single ISP at site A and/or site B goes down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested this by dropping the linked between SRX-A and SRX-1 and then dropping SRX-B and SRX-4. Due to me using BGP and DPD it took just over a minute for the tunnel to come back up but worked well!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully this will ultimately help you sort out your config!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SRX-A IPSEC Config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ike {&#xA;    gateway SRX-B_via_ISP1 {&#xA;        ike-policy ike-policy;&#xA;        address [ 6.6.6.6 5.5.5.5 ];&#xA;        dead-peer-detection {&#xA;            always-send;&#xA;            interval 10;&#xA;            threshold 3;&#xA;        }&#xA;        external-interface lo0.10;&#xA;        local-address 7.7.7.5;&#xA;    }&#xA;    gateway SRX-B_via_ISP2 {&#xA;        ike-policy ike-policy;&#xA;        address [ 6.6.6.6 5.5.5.5 ];&#xA;        dead-peer-detection {&#xA;            always-send;&#xA;            interval 10;&#xA;            threshold 3;&#xA;        }&#xA;        external-interface lo0.10;&#xA;        local-address 8.8.8.9;&#xA;    }&#xA;}&#xA;ipsec {&#xA;    policy standard-ipsec-policy {&#xA;        proposal-set standard;&#xA;    }&#xA;    vpn SRX-B_via_ISP1 {&#xA;        bind-interface st0.0;&#xA;        ike {&#xA;            gateway SRX-B_via_ISP1;&#xA;            ipsec-policy standard-ipsec-policy;&#xA;        }&#xA;        establish-tunnels immediately;&#xA;    }&#xA;    vpn SRX-B_via_ISP2 {&#xA;        bind-interface st0.0;&#xA;        ike {&#xA;            gateway SRX-B_via_ISP2;&#xA;            ipsec-policy standard-ipsec-policy;&#xA;        }&#xA;        establish-tunnels immediately;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="139" LastEditorUserId="139" LastEditDate="2015-10-07T19:48:49.910" LastActivityDate="2015-10-07T19:48:49.910" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10357" PostTypeId="1" AcceptedAnswerId="10359" CreationDate="2014-08-08T09:48:23.253" Score="5" ViewCount="636" Body="&lt;p&gt;I can't understand some details of route-map working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&#xA;on interface vlan_A I use route-map_A, on interface vlan_B - route-map_B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When host from vlan_A send packet to host from vlan_B what route-maps applied to packet:&#xA;just route-map_A or route-map_A and route-map_B?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words: route-map on vlan interface aplied on all traffic going through interface or just on traffic going from vlan?&lt;/p&gt;&#xA;" OwnerUserId="7877" LastActivityDate="2014-08-09T04:46:34.257" Title="cisco route-map using details" Tags="|cisco|routing|switching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10358" PostTypeId="1" CreationDate="2014-08-08T09:56:45.387" Score="2" ViewCount="241" Body="&lt;p&gt;Hi Fellow Network Enthusiasts!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having a hard time troubleshooting a Real Time Stocks Trading Application. Here are the Steps I've done so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently, this is the only Real-Time Application in the company I'm working at that's experiencing slowness and everyone really likes to blame the network guy(Me) whenever an issue like that happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Performed Traceroute from App to DB, Client to App, DB to App,&#xA;traceroute averages at 4ms to 9ms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Monitored CPU Utilization, Memory Usage, Packet Loss and Link Utilization in &lt;strong&gt;Solarwinds&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Maximum Stats on SOME network devices are:&lt;br&gt;&#xA;CPU Utilization: 30%&lt;br&gt;&#xA;Memory Usage 73%&lt;br&gt;&#xA;Packet Loss 0%&lt;br&gt;&#xA;Link Utilization: 60%  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This doesn't seem helpful except for baseline purposes since it looks okay, yet they're still experiencing slowness&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also performed Sniffing using Wireshark. At first I only sniffed one device at a time and that didn't give me the details so I sniffed two devices at a time: The Switch closest to Trade Application Server and the Switch closest to the Database Server. I compared their I/O graphs and I've found out that the delay of packet transmission from App to DB is the same on both switches but the latency of DB to App is different on both switches. The switch closest to the db shows 10ms or less latency while the switch closest to the Trade server shows &lt;strong&gt;100 - 254ms delay!&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One problem I'm having with wireshark though is that all our switches (except those that connects to the client's PC) perform loads balancing so it's hard to predict which packet it is. Also, the SQL and the FiX protocol is not fully supported by Wireshark yet so it's hard to check that. I'm currently just looking at the delta times. However, I don't know how to check if the &lt;strong&gt;high delta time&lt;/strong&gt; is because of the Application Response time or the Delay in Network transmission. The Server guys don't know how to check the ART -_-'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm currently investigating the very high delay. My problem is, the are a lot of network devices in between the App, DB and the Client's PC, around 30 devices including the 2 two firewalls. I'm planning on sniffing at least all the devices between App and DB excluding the firewalls and that would take me 6 Laptops running at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before I perform that though, I have a few questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Am I doing the troubleshooting process correctly?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are there other things I could look at/check?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Does the number of network hops increases the latency? If yes, does it vary between switches, routers and firewalls?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The vendor for the trading application recommends to implement QoS for this trading application. Is that really necessary?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance for all your help and sorry for the long block of text. :)&lt;/p&gt;&#xA;" OwnerUserId="7876" LastEditorUserId="775" LastEditDate="2014-12-08T13:01:39.923" LastActivityDate="2014-12-08T13:01:39.923" Title="Troubleshooting Slowness in Stocks Trading Applications" Tags="|troubleshooting|packet-analysis|latency|" AnswerCount="1" CommentCount="2" ClosedDate="2014-08-14T07:00:50.027" ContentLicense="CC BY-SA 3.0" />
  <row Id="10359" PostTypeId="2" ParentId="10357" CreationDate="2014-08-08T10:39:06.310" Score="5" Body="&lt;p&gt;Route-maps applied to an interface are always applied in the &lt;code&gt;incoming&lt;/code&gt; direction, meaning as the packet enters the first L3 interface and is about to get routed. In your example only the route-map &lt;code&gt;route-map_A&lt;/code&gt; would be applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For packets not matching the route-map, normal forwarding will take place. There are usually some restrictions as well for PBR such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Correct SDM template&lt;/li&gt;&#xA;&lt;li&gt;Only unicast packets are subject to PBR&lt;/li&gt;&#xA;&lt;li&gt;No deny statements allowed in route-map&lt;/li&gt;&#xA;&lt;li&gt;Software must support it such as IP services&lt;/li&gt;&#xA;&lt;li&gt;VRF and PBR on interface are mutually exclusive&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;An example of configuration and restrictions for the Catalyst 3560 is available &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-0_2_se/configuration/guide/3750x_cg/swiprout.html#wp1228588&quot; rel=&quot;nofollow&quot;&gt;here.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="105" LastEditorUserId="105" LastEditDate="2014-08-09T04:46:34.257" LastActivityDate="2014-08-09T04:46:34.257" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10360" PostTypeId="1" AcceptedAnswerId="10364" CreationDate="2014-08-08T13:16:56.487" Score="1" ViewCount="20676" Body="&lt;p&gt;I have two subnets which are geographically separated, connected by a wireless point to point link (5Mbps). Both networks are connected to internet through their own separate ILL WAN links which are configured on MikroTik routers. I want to connect the subnets through the routers. &#xA;The scenario is :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Site 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether1 xxx.xxx.xxx.xxx/xx ---- connected to Internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether2 192.168.10.1/24    ---- connected to local LAN &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Site 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.10.10.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether1 xxx.xxx.xxx.xxx/xx ---- connected to Internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether2 10.10.10.1/24      ---- connected to local LAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to connect the two LANs together so that there is a seamless traffic between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NO FIREWALL rules on either routers.&#xA;Only source NAT masquerade on WAN links on both routers.&#xA;NO destination NAT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried the below, which, obviously does not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Site 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.0/24 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether1 xxx.xxx.xxx.xxx/xx ---- connected to Internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether2 192.168.10.1/24    ---- connected to local LAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether3 10.10.10.10/24     ---- P2P between Site 1 and 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Site 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.10.10.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether1 xxx.xxx.xxx.xxx/xx ---- connected to Internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether2 10.10.10.1/24      ---- connected to local LAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether3 192.168.10.10/24  ---- P2P between Site 1 and 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing? (Beside, looks like everything?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="7843" LastEditorUserId="8499" LastEditDate="2018-02-14T16:38:57.247" LastActivityDate="2018-02-14T16:38:57.247" Title="mikrotik joining two subnets" Tags="|routing|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-09T23:57:09.407" ContentLicense="CC BY-SA 3.0" />
  <row Id="10362" PostTypeId="2" ParentId="3246" CreationDate="2014-08-08T17:18:17.517" Score="4" Body="&lt;p&gt;I know this is an old post, but the best way I could find to automate the backing up from my controllers was to use SNMP in a script run from cron.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpset -v2c -c &amp;lt;snmp_RW&amp;gt; &amp;lt;WLC_IP&amp;gt; .1.3.6.1.4.1.14179.1.2.9.1.1.0 i 1&#xA;snmpset -v2c -c &amp;lt;snmp_RW&amp;gt; &amp;lt;WLC_IP&amp;gt; .1.3.6.1.4.1.14179.1.2.9.1.2.0 a TFTP_Server_IP&#xA;snmpset -v2c -c &amp;lt;snmp_RW&amp;gt; &amp;lt;WLC_IP&amp;gt; .1.3.6.1.4.1.14179.1.2.9.1.3.0 s /&amp;lt;TFTP_Path&amp;gt;&#xA;snmpset -v2c -c &amp;lt;snmp_RW&amp;gt; &amp;lt;WLC_IP&amp;gt; .1.3.6.1.4.1.14179.1.2.9.1.4.0 s &amp;lt;File_name&amp;gt;&#xA;snmpset -v2c -c &amp;lt;snmp_RW&amp;gt; &amp;lt;WLC_IP&amp;gt; .1.3.6.1.4.1.14179.1.2.9.1.5.0 i 2&#xA;snmpset -v2c -c &amp;lt;snmp_RW&amp;gt; &amp;lt;WLC_IP&amp;gt; .1.3.6.1.4.1.14179.1.2.9.1.6.0 i 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously replace the items within &amp;lt;&gt; to fit your setup.  Hopefully someone somewhere may find this helpful.&lt;/p&gt;&#xA;" OwnerUserId="7884" LastActivityDate="2014-08-08T17:18:17.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10363" PostTypeId="2" ParentId="10358" CreationDate="2014-08-08T18:03:32.490" Score="1" Body="&lt;p&gt;It's hard to tell for sure without more info, but the fact that a host close to the db is fine, but one farther away is slow does suggest network congestion. Also, 60% link utilization is high considering it is usually averaged over a 5 minute period.  You could very easily be saturating some links for short periods.  But in answer to your questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I don't think the extra sniffing will tell you anything more.  You are already seeing the delay.  Check your captures to see if you are experiencing retransmissions.  Also check for drops on each individual link.  Oh, and since you have a complicated network, you should spend the time figuring out the data paths. That will be necessary for troubleshooting.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you have Cisco devices, you can change the port averaging time to 30 secs, which may give you a better sense of your link utilization. You can also look at individual ports for dropped packets.  If you have it, Netflow might be helpful too.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Assuming you have commercial grade switches, the extra latency caused by them will be negligible.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you do in fact have network congestion, then yes, QoS will help out by prioritizing that traffic over all the cat videos everyone is watching.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-08T18:03:32.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10364" PostTypeId="2" ParentId="10360" CreationDate="2014-08-08T18:24:16.050" Score="4" Body="&lt;p&gt;You should make the wireless link its own layer 3 subnet.  That will also help your link latency and saturation problems.   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Site 1 ETH3 192.168.11.1/24 and &#xA;&#xA;Site 2, ETH3: 192.168.11.2/24.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then add static routes between them:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ip route &#xA;add dst-address=10.10.10.0/24 gateway=192.168.11.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and Site 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ip route &#xA;add dst-address=192.168.10.0/24 gateway=192.168.11.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-08T18:24:16.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10367" PostTypeId="2" ParentId="10292" CreationDate="2014-08-09T07:54:37.657" Score="6" Body="&lt;p&gt;Maybe these bugs are affecting you:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CSCuj74167 (Gigabyte link from WS-C2960X-48FPD-L not coming up when using GLC-SX-MM) applies to you. Fixed in software release 15.0(2)EX4.&lt;/li&gt;&#xA;&lt;li&gt;CSCul88801 (1G or 10G in uplink ports of a Catalyst 2960x stack may not come up after a reload or OIR of SFP/SFP+. 1G or 10G SFP appear as “unknown” in the output of the show int status command.). Fixed in software release 15.0(2)EX5.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So before looking any further, I'd upgrade to at least 15.0(2)EX5. (Which is the latest stable available for 2960X as of this writing).&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2014-08-09T07:54:37.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10368" PostTypeId="2" ParentId="10070" CreationDate="2014-08-09T15:59:06.887" Score="2" Body="&lt;p&gt;The first question you didn't ask, and should, is &quot;does fiber optics offer me much or any benefit in my application&quot; - and as someone who was in your shoes, but differently, 4 years ago, I think the answer is probably a resounding no. There's my &quot;push in the right direction&quot; for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are talking about firewire drives (&lt;strong&gt;800 Mbps&lt;/strong&gt; at most - often less in practice) and &lt;strong&gt;24 Mpbs&lt;/strong&gt; video streams, in a single building (at least I take &quot;a video lab&quot; as presumably a single building.) Gigabit (&lt;strong&gt;1000 Mbps&lt;/strong&gt;) copper (Cat5e or higher - not Cat5) ethernet into a network switch will serve those needs without breaking a sweat, and without spending more money to get no practical benefit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiber optics become interesting and useful when you need to interconnect buildings (my project), when your building is large and 100 meters is not a long enough cable, and for higher-speed in-building links (ie, if you moved from Firewire drives to Fiber Channel drive arrays at 2, 4, 8 or 16 Gbps.) They are also of benefit when there are space constraints on the cabling (a fiber cable with 12-24 fibers can be smaller than one cat5e cable, thus much smaller than a bundle of 6-12 such cables.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are not willing to put in the effort to learn in some detail about the various fiber optic standards and practices, then you have lots of company, and there are plenty of folks willing to take quite a bit of your money and do it for you. They might even be happy to pretend that they are offering you something copper does not - after all, they won't be making money from copper, if you do that yourself. They might even actually be giving you something better, if they build you a 10 Gbps fiber network - but you would have a hard time noticing the difference if your use of it consists of moving 24 Mbps video streams around, or accessing files on 800 Mbps Firewire drives....&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2014-08-09T16:05:27.893" LastActivityDate="2014-08-09T16:05:27.893" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10370" PostTypeId="2" ParentId="9846" CreationDate="2014-08-09T22:06:30.330" Score="1" Body="&lt;p&gt;On Cisco devices, when configuring SPAN-mirroring . The packets are received in untagged format and an &quot;encapsulation replicate&quot; command must be defined to keep them tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Brocade, it is probably similar. &#xA;As for keeping the tags maybe this will help&#xA;&lt;a href=&quot;http://community.brocade.com/t5/Design-Build/How-To-Configure-VLAN-Mirroring-on-the-NetIron-Platform/ta-p/36798&quot; rel=&quot;nofollow&quot;&gt;http://community.brocade.com/t5/Design-Build/How-To-Configure-VLAN-Mirroring-on-the-NetIron-Platform/ta-p/36798&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="7893" LastActivityDate="2014-08-09T22:06:30.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10371" PostTypeId="2" ParentId="10242" CreationDate="2014-08-10T07:52:23.687" Score="1" Body="&lt;p&gt;According to ARIN WHOIS (&lt;a href=&quot;http://whois.arin.net/rest/net/NET-104-0-0-0-1/pft&quot; rel=&quot;nofollow&quot;&gt;http://whois.arin.net/rest/net/NET-104-0-0-0-1/pft&lt;/a&gt;), the netblock you're in has only been in use since 2014-01-16. Someone along the line might be blocking your traffic because they are filtering bogon networks and their database is out of date. I'd start with contacting Relayhealth first (where filtering bogon networks would be best practice), then Qwest, which is where the traffic is being dropped according to the traceroute (note that you can reach the hop 205.171.54.158 in your network, but can't your customer's network).&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2014-08-10T07:52:23.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10374" PostTypeId="2" ParentId="9735" CreationDate="2014-08-10T08:52:12.703" Score="2" Body="&lt;p&gt;I'm not that familiar with SonicWALL wireless, but as I'm going through the docs of SonicOS 6.1, there are 3 modes of managing the AP's, 2 of which can apply to your situation. I'm quoting from the documentation.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The following three SonicPoint deployment scenarios are supported:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Local Layer 2 Management– When SonicPoints are deployed in the same Layer 2 &#xA;  network with SonicWALL network security appliance, the existing Layer 2 discovery &#xA;  protocol SDP is used to manage these access points.&lt;/li&gt;&#xA;  &lt;li&gt;Local Layer 3 Management – When SonicPoints are deployed outside of the Layer 2 &#xA;  network boundaries, but still within the same Intranet (for example when there is a thirdparty router between the firewall and the SonicPoints), Layer 3 management protocols can be used manage these access points. &lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm assuming you are using the &quot;local layer 3 management&quot; mode, as that would be the best fit for your network as it is most scalable. In that case, CAPWAP (an industry standard) is used, which makes every AP create a tunnel to the controller, and all traffic is processed at the controller. So as far as the switchports to the AP's are concerned, they would have to be in access mode, with a VLAN that can connect to the NSA's wireless management port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the above diagram is correct, you do not appear to have a wireless management VLAN or you've combined it VLAN 2 (the corporate wired LAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I would do: create a new VLAN (let's pick ID 88, name: ap-mgmt) to be used to connect the access points. Set up a DHCP scope on that VLAN that sets option 138 to the IP address of NSA on which wireless management is active. Set all switchports connecting to AP's to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode access&#xA;switchport access vlan 88&#xA;spanning-tree portfast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(You might want to add some other stuff like bpduguard but that's beyond the scope of this question).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to configure the NSA, that starts on page 389 of the Administrators guide (&lt;a href=&quot;https://support.software.dell.com/download/downloads?id=5328574&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/download/downloads?id=5328574&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the AP's will be doing DHCP, via CAPWAP they will connect to the NSA and set up a tunnel, through which &lt;em&gt;all&lt;/em&gt; traffic will pass. When the AP's have successfully connected and the SSID's are visible, yet you cannot connect (DHCP doesn't work or DHCP does work but you can't reach outside the local network), firewall rules may be preventing communication, in which case we'd have to look further.&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2014-08-10T08:52:12.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10380" PostTypeId="1" CreationDate="2014-08-11T02:39:19.633" Score="1" ViewCount="1245" Body="&lt;p&gt;On Cisco, this can be found using command &lt;em&gt;#show interface&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The focus is like below.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;30 second input rate 0 bits/sec, 0 packets/sec&lt;/p&gt;&#xA;&lt;p&gt;30 second output rate 0 bits/sec, 0 packets/sec&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;How can the throughput be shown on an Allied Telesis switch/router?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-08-11T05:34:46.653" Title="How to show throughput on Allied Telesis switch/router?" Tags="|throughput|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10382" PostTypeId="2" ParentId="10380" CreationDate="2014-08-11T05:34:46.653" Score="3" Body="&lt;p&gt;Since you're not mentioning any model or software version, I'm just guessing it's AlliedWare Plus. A quick google search gives me &lt;a href=&quot;http://alliedtelesis.com/manuals/9000V218CLIRevA/ak1027137.html#Rak46367&quot; rel=&quot;nofollow&quot;&gt;http://alliedtelesis.com/manuals/9000V218CLIRevA/ak1027137.html#Rak46367&lt;/a&gt;, on which &lt;code&gt;show platform table port [port] counters&lt;/code&gt; is mentioned as a way to show interface counters.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-08-11T05:34:46.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10384" PostTypeId="1" AcceptedAnswerId="10385" CreationDate="2014-08-11T08:37:39.797" Score="3" ViewCount="4727" Body="&lt;p&gt;I'm working with routing instances on the Juniper SRX. When you configure NAT you have the option to specify &quot;to&quot; and &quot;from&quot; statements, with these option you can specify NAT to translate to or from a routing instance. On the Routing Instance list you get, you can configure the &quot;default&quot; routing instance. I'm assuming that every interface that wasn't assigned a specific routing instance belongs to the default but I want to be sure, is there a way to verify?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="5329" LastActivityDate="2014-08-11T09:10:44.250" Title="How can I see what interfaces belong to the default routing instance on the SRX?" Tags="|routing|nat|juniper|srx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10385" PostTypeId="2" ParentId="10384" CreationDate="2014-08-11T09:03:33.667" Score="5" Body="&lt;p&gt;There are a couple of ways you can check&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;show interfaces routing-instance all terse&lt;/code&gt; which will list all interfaces and their routing instance (See example)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;show confiuration routing-instances&lt;/code&gt; which is going to show the configuration of any routing instances you have, you will need to check out the interface stanza&lt;/li&gt;&#xA;&lt;li&gt;Check the routing table and see if the routes from your interface are being shown in another routing instance.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The below shows the interfaces are all in the default instance except fe-0/0/6.0 which is in a routing instance called &lt;code&gt;test&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@Gareth-FW&amp;gt; show interfaces fe-0/0* routing-instance all terse&#xA;Interface        Admin Link Proto  Local                Instance&#xA;fe-0/0/0.0       up    up   inet   1.1.1.1/30&#xA;                                   172.30.1.100/24      default&#xA;fe-0/0/1.0       up    up   inet   192.168.218.240/24   default&#xA;fe-0/0/6.0       up    up   inet   10.10.10.2/24&#xA;                                   10.77.77.2/30        test&#xA;fe-0/0/7.0       up    up   inet   10.10.10.1/24        default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="139" LastEditorUserId="139" LastEditDate="2014-08-11T09:10:44.250" LastActivityDate="2014-08-11T09:10:44.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10387" PostTypeId="1" AcceptedAnswerId="10388" CreationDate="2014-08-11T12:24:46.820" Score="6" ViewCount="7368" Body="&lt;p&gt;I want to know the difference between data rate, throughput, and goodput. All I know is the capacity of a link is not its throughput. Also, bandwidth is not capacity. Please, some one help me to know the difference? &lt;/p&gt;&#xA;" OwnerUserId="7909" LastEditorUserId="42290" LastEditDate="2017-12-13T12:03:45.380" LastActivityDate="2017-12-13T12:03:45.380" Title="Difference between good-put throughput and data rate" Tags="|throughput|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10388" PostTypeId="2" ParentId="10387" CreationDate="2014-08-11T12:29:43.977" Score="7" Body="&lt;p&gt;Wikipedia has a good explanation: &lt;a href=&quot;http://en.wikipedia.org/wiki/Goodput&quot;&gt;http://en.wikipedia.org/wiki/Goodput&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;... In computer networks, goodput is the application level throughput,&#xA;  i.e. the number of useful information bits delivered by the network to&#xA;  a certain destination per unit of time.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...[For example, using FTP] the goodput that the user&#xA;  experiences corresponds to the file size in bits divided by the file&#xA;  transfer time. The goodput is always lower than the throughput (the&#xA;  gross bit rate that is transferred physically), which generally is&#xA;  lower than network access connection speed (the channel capacity or&#xA;  bandwidth).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="7909" LastEditDate="2014-08-11T13:10:27.410" LastActivityDate="2014-08-11T13:10:27.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10389" PostTypeId="2" ParentId="6931" CreationDate="2014-08-11T15:19:03.477" Score="1" Body="&lt;p&gt;The answer was, yes, it is enough separation. From the point of view of DMZ 1, the DMZ 2 device is outside.&lt;/p&gt;&#xA;" OwnerUserId="2639" LastActivityDate="2014-08-11T15:19:03.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10397" PostTypeId="1" CreationDate="2014-08-11T19:20:04.040" Score="3" ViewCount="1109" Body="&lt;p&gt;Does anyone know how to setup VLANs and make them communicate using a SonicWALL 4600.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;On the Cisco SG200-50P switch:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I have 3 SG200-50P Cisco switches. Say I want to create a VLAN for our VoIP. I create a VLAN and give it a VLAN ID and name. Then, I assign the ports I want on that VLAN as untagged correct? For example, if I want ports 31-40, I set them all as untagged? Also, by default they're all on trunk mode, I should select access mode right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After I'm done with setting all the ports, do I have to keep the ports connected to the other switches in trunk mode and set them to untagged, tagged, etc?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;On the SonicWALL:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After I create the VLANs on the switches, in order to communicate between VLANs, I have to add interfaces. I create a new zone etc pretty much like in this video: &lt;a href=&quot;https://www.youtube.com/watch?v=1C9UoE4TRes&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=1C9UoE4TRes&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the question is how do I communicate between the two. Yes, I will have now created VLANs on both, but how do I communicate when I keep creating VLANs and need them to communicate, etc. Pretty much, I'm going to use the SonicWALL to do the routing.&lt;/p&gt;&#xA;" OwnerUserId="7681" LastEditorUserId="8499" LastEditDate="2016-04-03T15:31:16.177" LastActivityDate="2018-03-25T12:10:45.587" Title="Cisco 200 series switches with SonicWALL NSA 4600 setting up VLAN" Tags="|cisco|routing|vlan|sonicwall|lan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10399" PostTypeId="2" ParentId="10397" CreationDate="2014-08-11T22:30:40.517" Score="1" Body="&lt;p&gt;Okay, a bunch of answers.  Here we go:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the VoIP VLAN - will the PCs be sharing the switch ports on the back of the phone?  If so, you'll need to set the switch ports as &lt;strong&gt;tagged trunk&lt;/strong&gt; ports, and configure the phone for the VLAN.  Otherwise, you can do as you stated.  The phones will connect to the switch on &lt;strong&gt;untagged access&lt;/strong&gt; ports. The ports between switches and to the SonicWALL will be &lt;strong&gt;tagged trunk&lt;/strong&gt; ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the SonicWALL, you'll create a separate zone for each VLAN. Configure the VLAN interfaces with the proper VLAN ID, and it should work (as long as the SonicWALL is plugged into a &lt;strong&gt;tagged trunk&lt;/strong&gt; port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Give it a shot and let us know if you run into any problems.&lt;/p&gt;&#xA;" OwnerUserId="3624" LastEditorUserId="8499" LastEditDate="2016-04-03T15:32:41.103" LastActivityDate="2016-04-03T15:32:41.103" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10405" PostTypeId="1" AcceptedAnswerId="10406" CreationDate="2014-08-12T15:51:08.603" Score="5" ViewCount="348" Body="&lt;p&gt;What are the possible reasons why STP would choose to use a FastEthernet link over an EtherChannel?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a network diagram where this is happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/L6N5H.png&quot; alt=&quot;Packet Tracer diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="7929" LastEditorUserId="7929" LastEditDate="2014-08-13T04:35:36.577" LastActivityDate="2014-08-13T04:35:36.577" Title="Why FastEthernet STP Link Selected over EtherChannel?" Tags="|switch|spanning-tree|etherchannel|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10406" PostTypeId="2" ParentId="10405" CreationDate="2014-08-12T16:13:17.500" Score="3" Body="&lt;p&gt;One possible answer is because the top switch in the diagram is the root switch.  The other switches have their root ports connected to the root switch.  That means the etherchannel will be blocking to avoid a loop. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a general algorithm that STP uses.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The root switch has all its ports designated (i.e. forwarding).&lt;/li&gt;&#xA;&lt;li&gt;Every other switch selects the port with the lowest cost to the root.  that's the root port (also forwarding)&lt;/li&gt;&#xA;&lt;li&gt;For every other network, the one port with the lowest cost/priority/MAC will be the designated port (forwarding)&lt;/li&gt;&#xA;&lt;li&gt;Every other port will be blocking&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-12T16:13:17.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10407" PostTypeId="1" AcceptedAnswerId="10413" CreationDate="2014-08-12T17:27:33.423" Score="2" ViewCount="521" Body="&lt;p&gt;I got two servers with public IPv4 and (now) IPv6 addresses. They have a VPN to do stuff like MySQL replication. With IPv4 I just took a RFC1918 range (10.0.0.0/8) and if you access the server via that range, it went through the VPN. With IPv6 everything has a globally unique address without NAT. How would you assign addresses to the endpoints? I got on each side a /48 subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see the following possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use a private/documentation/... IPv6 address&lt;/li&gt;&#xA;&lt;li&gt;Somehow route the traffic to the public IPv6 address through the VPN&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How would you do it?&#xA;VPN is tinc.&lt;/p&gt;&#xA;" OwnerUserId="7934" LastActivityDate="2014-08-12T20:26:21.607" Title="IPv6 VPN addressing" Tags="|vpn|ipv6|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10408" PostTypeId="2" ParentId="10405" CreationDate="2014-08-12T17:30:30.790" Score="2" Body="&lt;p&gt;You need to think in terms of the total cost of the paths to the root. As long as the two uplinks to the root have equal cost, they will both be forwarding because the relevant calculation is whether the uplink cost is less than the uplink cost plus the etherChannel cost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should you want the etherChannel active, one way to do it is to increase the cost of one of the uplinks, so that uplink A cost &gt; uplink B cost + etherChannel cost. If you turn the problem around, and think &quot;how can I get this link to block&quot;, that may make it easier to get your head around.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2014-08-12T17:30:30.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10410" PostTypeId="1" AcceptedAnswerId="17429" CreationDate="2014-08-12T19:14:42.603" Score="2" ViewCount="1703" Body="&lt;p&gt;So I currently have two racks where I need a bunch of 10GbE ports (currently using SFP+ TwinAx cables), and I want to replace my current switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically there are three options I could do:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;1x9504 with the 2x 48x10GbE linecard + 2xFEX for 1GbE copper&lt;/li&gt;&#xA;&lt;li&gt;same as before just 2x9504 for redundancy&lt;/li&gt;&#xA;&lt;li&gt;2x9396PX&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;While I understand that the 9396PX is designed to be actually a top of the rack switch and the 9504 is the core one, on base price there doesn't seem to be a &lt;em&gt;huge&lt;/em&gt; difference even if I add in the FEXes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I understand that the 9504 can have redundant supervisors and fabric modules, so with 2 linecards and running vPC to all servers I should be able to survive a linecard failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which one would you go for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nexus 7k would be an option for the core (with the FEX), but I'm a bit afraid Cisco won't push it as much on the roadmap as the 9k line.&lt;/p&gt;&#xA;" OwnerUserId="7647" LastEditorUserId="7647" LastEditDate="2014-08-13T09:18:17.247" LastActivityDate="2015-03-22T08:25:46.027" Title="Cisco Nexus 9000 core + FEX or ToR switches?" Tags="|cisco|switch|network-core|cisco-nexus-7k|" AnswerCount="2" CommentCount="2" ClosedDate="2015-03-23T10:22:21.373" ContentLicense="CC BY-SA 3.0" />
  <row Id="10411" PostTypeId="1" AcceptedAnswerId="10424" CreationDate="2014-08-12T19:41:53.660" Score="3" ViewCount="274" Body="&lt;p&gt;Debate arose recently from a Systems [Windows] engineer over the more logical application in his opionion of File System ACLs vs how &lt;strong&gt;Network ACLs&lt;/strong&gt; work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network ACLs generally work by applying ACEs in order (top-down) and stop on the first match.&#xA;File System ACLs (NTFS in particular) work by considering all ACEs and granting the most privileges unless a deny-ACE is encountered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do Network ACLs work the way they do and why shouldn't they be compared to File System ACLs as I intuitively understand?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network ACLs work as follow per my understanding:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Need to process at the packet-level&lt;/li&gt;&#xA;&lt;li&gt;Need to punt to CPU for first encounter of flow&lt;/li&gt;&#xA;&lt;li&gt;Stops at first match for the sake of speed&lt;/li&gt;&#xA;&lt;li&gt;Considering all ACEs is counter-productive since we're not building up a list of allowable permissions&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="630" LastActivityDate="2014-08-13T15:21:39.110" Title="Network ACLs vs File System ACLs" Tags="|acl|" AnswerCount="2" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10413" PostTypeId="2" ParentId="10407" CreationDate="2014-08-12T20:26:21.607" Score="4" Body="&lt;p&gt;General rule of thumb: never use documentational space. It has a very specific purpose, don't ever use it for anything else or you'll regret it at a later time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If these two servers only need to talk to eachother and don't require any other connectivity for the given IPv6 addresses I'd use &lt;a href=&quot;https://en.wikipedia.org/wiki/Unique_local_address&quot; rel=&quot;nofollow&quot;&gt;ULA space&lt;/a&gt;: pick a somewhat random /64 from within &lt;code&gt;fd00::/8&lt;/code&gt; and use that between the servers.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-08-12T20:26:21.607" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10414" PostTypeId="2" ParentId="10411" CreationDate="2014-08-12T23:38:30.413" Score="1" Body="&lt;p&gt;As noted in the comments, it's for the sake of speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having been a file server dude in another life, and gone through an internal compliance audit that makes the worst PCI inspection look like a picnic, let me also add this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network ACLs working top-down first-match-wins forces you to really put a lot more thought into organizing your access lists when implementing/updating them, and later read far more cleanly and readily than File system ACLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;File system ACLs have the advantage of convenience, and afford far greater unintended consequences.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if your environment doesn't bother with security, then that's not a problem.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-08-12T23:38:30.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10415" PostTypeId="2" ParentId="4983" CreationDate="2014-08-13T00:00:01.963" Score="2" Body="&lt;p&gt;The DHCP server in the ASA does seem to be little more than a SOHO toy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Among its various issues are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;that 256-address pool limit applies to all models&lt;/li&gt;&#xA;&lt;li&gt;it can't be a relayed server, i.e., it can only serve pools corresponding to its own actual interfaces&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3201" LastActivityDate="2014-08-13T00:00:01.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10417" PostTypeId="1" AcceptedAnswerId="10428" CreationDate="2014-08-13T06:37:54.013" Score="-1" ViewCount="760" Body="&lt;p&gt;I need to identify/formulate the relationship between number of concurrent users that are downloading data from a server on network throughput. Suppose, we have a 600KB file on a server A and N users download it at the same time. So, I would lie to know that how increase in N impacts of network throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the relation linear? any equation for&lt;/p&gt;&#xA;" OwnerUserId="695" LastEditorUserId="775" LastEditDate="2014-12-08T12:40:24.327" LastActivityDate="2014-12-08T12:40:24.327" Title="Correlation between network throughput and number of concurrent users" Tags="|lan|throughput|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10421" PostTypeId="1" AcceptedAnswerId="10439" CreationDate="2014-08-13T12:50:51.873" Score="4" ViewCount="357" Body="&lt;p&gt;We need a router to translate a TCP port for a connection between an inside device and an outside server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The outside server (1.1.1.2) will establish a connection to the inside device (10.0.0.10) on TCP port 123, but the inside device is listening on port 234. The router will need to forward inbound traffic destined for 10.0.0.10 port 123 to 10.0.0.10 port 234.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found very simple instructions for doing this &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13772-12.html#topic8&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, but when I try this I get duplicate IP address errors and the router seems to take over the inside device's IP address. (A &quot;show ip arp&quot; will show the router's MAC address for the inside device.)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ip nat inside source static tcp 10.0.0.10 234 10.0.0.10 123&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What could I be doing wrong? The instructions are from 2006. Has Cisco changed NAT since then?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="1911" LastEditorUserId="1911" LastEditDate="2014-08-13T13:10:33.147" LastActivityDate="2014-08-14T10:49:49.893" Title="IOS 15 Port Forwarding" Tags="|nat|cisco-ios|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10423" PostTypeId="1" AcceptedAnswerId="10425" CreationDate="2014-08-13T15:01:48.880" Score="7" ViewCount="1639" Body="&lt;p&gt;I'm studying some networking things, and something I noticed in the interface counters on a Cisco switch (output of &lt;code&gt;#sh int&lt;/code&gt;) one counter for 'babbles'&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 0 babbles, 0 late collision, 0 deferred&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-2900-xl-series-switches/29200-164.html&quot;&gt;Cisco defines babbles&lt;/a&gt; as 'Babble errors occur due to the transmission of &lt;strong&gt;frames in excess of 1518 bytes&lt;/strong&gt; in size'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm confused. &lt;a href=&quot;http://en.wikipedia.org/wiki/Ethernet_frame&quot;&gt;Wikipedia&lt;/a&gt; says that a normal 1500 byte packet plus the layer 2 header/footer encapsulation comes to &lt;strong&gt;1530&lt;/strong&gt; bytes. Wouldn't such a packet be a babble?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just ran wireshark for a few sec and arranging frames by byte size shows almost all of them at 1514 bytes, and none bigger than this. So is Wikipedia wrong its definition of frame size or am I misunderstanding what's happening?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="7949" LastEditorUserId="3191" LastEditDate="2014-08-13T15:50:07.130" LastActivityDate="2014-08-13T15:50:07.130" Title="How long is a frame really supposed to be, and when is a frame a babble?" Tags="|ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10424" PostTypeId="2" ParentId="10411" CreationDate="2014-08-13T15:21:39.110" Score="4" Body="&lt;p&gt;Without saying it, you have the right notion, it all comes down to &lt;em&gt;speed&lt;/em&gt; and &lt;em&gt;flexibility&lt;/em&gt;.  This is directly related to the amount of runtime operations and parameters you must check against.  I’m not an expert on Windows file system ACLs, but conceptually the facts remain the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One look at the &lt;a href=&quot;http://technet.microsoft.com/en-us/library/bb727008.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;extensibility of Windows file system ACLs&lt;/a&gt; and can you can see that you have a lot of different options for a wide array of attributes and security levels.  Each of these options comes with a level of memory and CPU penalties.  The goal is to provide a &lt;em&gt;flexible&lt;/em&gt;, seamless permissions structure that still offers granular control.  This includes capabilities on different file systems, account types and environments.  It was built to serve a specific purpose, file control, which doesn’t necessarily need to operate at over &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00800c9470.shtml#wp42135&quot; rel=&quot;nofollow noreferrer&quot;&gt;100 million events per second, like a 6509 would&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the opposite end of the spectrum, you have network ACLs that were designed with &lt;em&gt;speed&lt;/em&gt; in mind.  When you create an ACL you not only have a hardware-optimized platform performing these comparisons, but you also have a strict set of bit-wise operations that are happening&lt;sup&gt;1&lt;/sup&gt;.  With standard ACLs, you only look at source and destination addresses; indiscriminate of any other TCP/IP variable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take the below test results from the European Advanced Network Test Center (EANTC).  They stress test a 6500 with 32, 10Gb ports at 90% line rate with a packet size of 64 bytes (most stressful) from totally unique addresses and then compare it with a 10,000 line ACL that matches at the 10,001th entry.  It yields a minimal drop in line rate and zero loss. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8pOlL.png&quot; alt=&quot;European Advanced Network Test Center: Test Results&quot;&gt;&lt;br&gt;&#xA;&lt;sup&gt;&lt;a href=&quot;http://www.cisco.com/c/dam/en/us/products/collateral/switches/catalyst-6500-series-switches/prod_white_paper0900aecd800c958a.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;EANTC: Cisco Catalyst 6500 with Supervisor720 — 10 Gigabit Ethernet Performance Test&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although this doesn’t show latency, which would be the real testament to the speed of these platforms, they do say go on to say &lt;em&gt;“Catalyst performance unaffected by the addition of value-added services such as ACLs, QoS traffic classification and NetFlow Statistics gathering.”&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you look to add additional flexibility, such as extended ACLs, you require additional checks against the data.  This adds latency.  The key is that you choose which is most appropriate for the application for your business requirements.  Not everyone needs an extended ACL when a standard ACL will do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As most indicated in the comments, the amount of routines a router will need to go through every moment dwarfs a file system ACL in pretty much every way.  Does this mean they’re better?  Not necessarily.  But they are certainly &lt;em&gt;faster&lt;/em&gt; at what they do, just limited.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt;&lt;sub&gt;This is assuming no logging is happening, which relies on CPU processing to log the message.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-08-13T15:21:39.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10425" PostTypeId="2" ParentId="10423" CreationDate="2014-08-13T15:45:20.637" Score="8" Body="&lt;p&gt;1530 is including the layer-1 overhead (preamble and start frame) which you will never see without dedicated diagnostic gear, as the NIC won't present that to you. 1518 includes the FCS (CRC) which is technically part of the layer-2 information, but I've never seen a NIC pass that up the chain (read: wireshark can't show it.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interesting that you point to a Cisco 2900XL document. I know first hand the 2900XL &lt;em&gt;crashes&lt;/em&gt; if you send it an &quot;oversized&quot; frame -- 802.1q tagged frame on a non-tagged port. (or was that the 3500XL)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you ignore everything Cisco says, a babble is a transmitter not obeying the inter-packet gap -- sending frame after frame with little or no delay. That's a big problem for half-duplex networks.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-13T15:45:20.637" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10426" PostTypeId="1" AcceptedAnswerId="10430" CreationDate="2014-08-13T16:27:59.600" Score="3" ViewCount="11244" Body="&lt;p&gt;I have been working for the past 3 days to no avail. I have goggled and searched for all matter of solutions but still no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My task is to find a way to map an address to another. But, the network it is going in to does not have a default gateway. (Vlan1) (I cannot configure the default gateway on these devices.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The scenario is that this device is about to be used for VPN site to site access. When the other site is connected it will connect using the ip address we map to it (10.1.1.21). For now its only one server that needs to access. But, in the future it might be two or more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An idea of how a ping to 10.1.1.21 would work after finished.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;strong&gt;-RangeOfIPs-&lt;/strong&gt; (Lets say 11.22.33.44)&lt;br&gt;&#xA;Destination: &lt;strong&gt;10.1.1.21&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;=&gt;&lt;/strong&gt; ROUTER NAT &lt;strong&gt;=&gt;&lt;/strong&gt;&lt;br&gt;&#xA;Source: &lt;strong&gt;192.168.0.21&lt;/strong&gt;&#xA;Destination: &lt;strong&gt;192.168.0.114&lt;/strong&gt; (Internal Server)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the return the following would happen:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;strong&gt;192.168.0.114&lt;/strong&gt; (Internal Server)&lt;br&gt;&#xA;Destination: &lt;strong&gt;192.168.0.21&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;=&gt;&lt;/strong&gt; ROUTER NAT &lt;strong&gt;=&gt;&lt;/strong&gt;&lt;br&gt;&#xA;Source: &lt;strong&gt;10.1.1.21&lt;/strong&gt;&lt;br&gt;&#xA;Destination: &lt;strong&gt;-RangeOfIPs-&lt;/strong&gt; (11.22.33.44)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Router in use is currently a &lt;strong&gt;Cisco 881&lt;/strong&gt; and has one WAN port and 4 Switch Ports&lt;br&gt;&#xA;The WAN port is connected to the other networks and one of the switch ports is connected to our local network switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The roll of Loopback 0 is to create a network that the other side of the VPN site to site will use. They connect to the router via VPN which is to its public IP (1.1.1.36), then, they would connect to the server via 10.1.1.21 to access that resource. That way, we dont need default routes and at the same time control which server they have access too via VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I plan on making the VPN after this is complete and ready, and i am going to use ACLs to prevent the VPN from accessing the 192 network. At least, to my knowledge should be possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the configuration that i have to start with.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface Loopback0&#xA; ip address 10.1.1.1 255.255.255.0&#xA;!&#xA;interface FastEthernet4&#xA; ip address 1.1.1.36 255.255.255.240&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet1&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet3&#xA; switchport mode access&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.0.1 255.255.255.0&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 1.1.1.33 &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example Network Topology:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/xwwog.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;strong&gt;Key:&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;Grey:&lt;/strong&gt; Internal Network&lt;br&gt;&#xA;&lt;strong&gt;Orange:&lt;/strong&gt; VPN Site to Site (I'll work on this later, I know how to do this part)&lt;br&gt;&#xA;&lt;strong&gt;Dark Blue:&lt;/strong&gt; Public Network&lt;br&gt;&#xA;&lt;strong&gt;1.1.1.X:&lt;/strong&gt; Represent real public IP addresses.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The right most server&lt;/strong&gt;:&lt;br&gt;&#xA;External IP: &lt;strong&gt;1.1.1.21&lt;/strong&gt; / Gateway: &lt;strong&gt;1.1.1.18&lt;/strong&gt;&lt;br&gt;&#xA;Internal IP: &lt;strong&gt;192.168.0.114&lt;/strong&gt; / Gateway: &lt;strong&gt;None&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="7950" LastEditorUserId="7950" LastEditDate="2014-08-14T22:42:44.370" LastActivityDate="2015-03-12T13:59:36.087" Title="Static Nat Source and Destination on Router" Tags="|cisco|router|switch|vpn|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10428" PostTypeId="2" ParentId="10417" CreationDate="2014-08-13T20:00:55.870" Score="2" Body="&lt;p&gt;Let me make up some numbers: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume a network bandwidth of 4.8Mbps. That works out to 600kB/sec, ignoring overhead. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So one user would get the file in 1 sec (again, ignoring overhead). 2 users would take 2 sec and so on.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-13T20:00:55.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10429" PostTypeId="1" AcceptedAnswerId="10433" CreationDate="2014-08-13T20:24:07.497" Score="2" ViewCount="111" Body="&lt;p&gt;We are currently in the middle of implementing a BYOD policy. Our major opponent is that currently, anyone can hit a site we host publicly and download an cisco VPN software, install it, and with their RSA token + Username/Password use this non-company laptop to access our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We currently run a Cisco ASA 5510 for our VPN and RSA as our authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way using the Cisco ASA 5510 that we can ahead of time have our users by email register their computers with us (Mac Address, secure certificat, etc. yes I know mac's can be spoofed) and we can enter them into configs to only allow connections from said physical addresses or some other identifier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can do this via software or ASA configs. Pretty much open to any suggestions at this time.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2014-08-14T00:05:05.950" Title="ASA 5510 and RSA - Is there a way to make sure that a PC connecting is trusted?" Tags="|cisco-asa|vpn|byod|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10430" PostTypeId="2" ParentId="10426" CreationDate="2014-08-13T20:57:39.770" Score="3" Body="&lt;p&gt;To test your scenario I set up the following lab:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xldkf.png&quot; alt=&quot;NAT topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 10.0.0.0/24 network is your &lt;code&gt;-RangeOfIPs-&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When traffic comes from &lt;code&gt;10.0.0.0/24&lt;/code&gt; it will be NATed to &lt;code&gt;192.168.0.21&lt;/code&gt;.&#xA;Traffic sourcing from &lt;code&gt;192.168.0.114&lt;/code&gt; will be NATed to &lt;code&gt;10.1.1.21&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3(config)#int f0/0&#xA;R3(config-if)#ip nat outside&#xA;R3(config-if)#int f0/1&#xA;R3(config-if)#ip nat inside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above commands define the interfaces as &lt;code&gt;outside&lt;/code&gt; and &lt;code&gt;inside&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3(config)#ip nat inside source static 192.168.0.114 10.1.1.21&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This command translates the &lt;code&gt;inside local&lt;/code&gt; address of &lt;code&gt;192.168.0.114&lt;/code&gt; to an &lt;code&gt;inside global&lt;/code&gt; address of &lt;code&gt;10.1.1.21&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3(config)#access-list 1 permit 10.0.0.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This access-list will define which hosts on the &lt;code&gt;outside&lt;/code&gt; that will get NATed.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3(config)#ip nat pool NAT_POOL 192.168.0.21 192.168.0.21 netmask 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We create a NAT pool consisting of a single address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3(config)#ip nat outside source list 1 pool NAT_POOL add-route &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then we configure so that hosts matching &lt;code&gt;access-list 1&lt;/code&gt; will get NATed to &lt;code&gt;192.168.0.21&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is important to configure add-route here or to add a static route because when doing &lt;code&gt;inside to outside&lt;/code&gt; NAT, NAT takes place before routing in the order of operations. That means that R3 must have a route for 10.1.1.21.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3 now has the following NAT table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#show ip nat translations &#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;--- ---                ---                192.168.0.21       10.0.0.1&#xA;--- 10.1.1.21          192.168.0.114      ---                ---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that R4 has configured with an IP and &lt;code&gt;ip routing&lt;/code&gt; turned off to emulate a host. Debugging of ICMP on R1 is enabled and debugging of ip nat on R3 is also enabled.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#debug ip icmp&#xA;ICMP packet debugging is on&#xA;&#xA;R3#debug ip nat &#xA;IP NAT debugging is on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A ping is then issued from R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#ping 10.1.1.21 so f0/1&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.1.1.21, timeout is 2 seconds:&#xA;Packet sent with a source address of 10.0.0.1 &#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 80/86/104 ms&#xA;R1#&#xA;ICMP: echo reply rcvd, src 10.1.1.21, dst 10.0.0.1&#xA;ICMP: echo reply rcvd, src 10.1.1.21, dst 10.0.0.1&#xA;ICMP: echo reply rcvd, src 10.1.1.21, dst 10.0.0.1&#xA;ICMP: echo reply rcvd, src 10.1.1.21, dst 10.0.0.1&#xA;ICMP: echo reply rcvd, src 10.1.1.21, dst 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debug and NAT table from R3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NAT*: s=10.0.0.1-&amp;gt;192.168.0.21, d=10.1.1.21 [15]&#xA;NAT*: s=192.168.0.21, d=10.1.1.21-&amp;gt;192.168.0.114 [15&#xA;NAT: s=192.168.0.114-&amp;gt;10.1.1.21, d=192.168.0.21 [15]&#xA;NAT: s=10.1.1.21, d=192.168.0.21-&amp;gt;10.0.0.1 [15]&#xA;&#xA;R3#show ip nat translations&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;--- ---                ---                192.168.0.21       10.0.0.1&#xA;icmp 10.1.1.21:3       192.168.0.114:3    192.168.0.21:3     10.0.0.1:3&#xA;--- 10.1.1.21          192.168.0.114      ---                ---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think that this is the kind of configuration you are looking for. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, note that there is a caveat because there is no &lt;code&gt;overload (PAT)&lt;/code&gt; available for &lt;code&gt;outside to inside&lt;/code&gt; translation. That means that as soon as one of your hosts communicate with &lt;code&gt;192.168.0.114&lt;/code&gt;, there will be no free IP's in the pool. What you can do is to increase the &lt;code&gt;pool size&lt;/code&gt; so that you reserve maybe 10 IP's that are only used for &lt;code&gt;NAT&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-08-13T20:57:39.770" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10431" PostTypeId="1" AcceptedAnswerId="10432" CreationDate="2014-08-13T22:36:37.623" Score="10" ViewCount="653" Body="&lt;p&gt;I don't get why a machine on the network is asking the gateway for its MAC address when it already knows its MAC address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/J6FEE.png&quot; alt=&quot;ARP example&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here you can see the machine MAC ***80 (IP &lt;em&gt;.&lt;/em&gt;.*.115) asks the gateway (Cisco_87), who has 10.1.10.1 ? In other words, where is the gateway? But it already knows who the gateway is, because it sent the ARP directly to it! I could understand this, if the query was a broadcast, ie, can ANYBODY tell me who the gateway is, but the packet was not broadcast, it was sent directly to the gateway (CISCO_87) and to nobody else, so obviously the machine already knows who the gateway is.&lt;/p&gt;&#xA;" OwnerUserId="7954" LastEditorUserId="775" LastEditDate="2014-12-08T12:39:54.557" LastActivityDate="2014-12-08T12:39:54.557" Title="Why is adapter ARPing something it already knows?" Tags="|ethernet|arp|packet-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10432" PostTypeId="2" ParentId="10431" CreationDate="2014-08-14T00:03:16.630" Score="12" Body="&lt;p&gt;It's neighbor unreachability detection (NUD). The node makes sure that the gateway is still alive and reachable.&lt;/p&gt;&#xA;" OwnerUserId="7756" LastActivityDate="2014-08-14T00:03:16.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10433" PostTypeId="2" ParentId="10429" CreationDate="2014-08-14T00:05:05.950" Score="2" Body="&lt;p&gt;You could use &lt;a href=&quot;http://www.runtrocks.com/cisco-anyconnect-ssl-vpn-certificate-based-authentication-part-1/&quot; rel=&quot;nofollow&quot;&gt;PKI&lt;/a&gt; in your authentication which would require assigning certs to devices. This is covered under the AnyConnect Essentials license. One thing to note, I have never gotten any ASA to accept any certs encrypted with higher than 2048 bits. This may have changed in releases newer than 9.1.2 though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more in depth option would be using the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect31/administration/guide/anyconnectadmin31/ac05hostscanposture.html&quot; rel=&quot;nofollow&quot;&gt;Host Scan and Posture Module&lt;/a&gt; of AnyConnect. This requires the AnyConnect Premium license and depending on which options, it may require further licensing. This gives you more control and you can limit access to systems with specific registry keys, BIOS serial numbers, OSes, AntiVirus, Firewalls, etc.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2014-08-14T00:05:05.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10434" PostTypeId="2" ParentId="10431" CreationDate="2014-08-14T01:03:58.187" Score="9" Body="&lt;p&gt;Many devices will send these types of ARP requests after entries in the ARP table reach a &quot;certain&quot; age to refresh those entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason they do this is so they can maintain valid ARP entries without having to broadcast ARP for hosts once the entries age out.  Directed ARP is much &quot;friendlier&quot; to a network than broadcast ARP.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-08-14T01:03:58.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10436" PostTypeId="1" CreationDate="2014-08-14T04:04:59.600" Score="7" ViewCount="43962" Body="&lt;p&gt;I'm currently having a problem troubleshooting a trading application. Let me give a simple diagram of the current network setup&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Gov't Stock Exchange Network Router)X--&gt;(256kbs Leased Line)&amp;lt;--X(Telco Router)&amp;lt;-(100mbps fast E link)---&gt;Our Network Devices(5 Switches, 1 Firewall)&amp;lt;--&gt;Trading Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our users reports that they are experiencing slowness at around 9:30 to 9:45am. I checked the CPU, Memory, Response Time and Link Utilization of all our Network Devices and Interfaces and all of them reports normal levels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part of the trading process is the communication between the Stock Exchange Network and our Trading Servers so if there is any slowness on that 256kbps leased line link, surely it would contribute to the slowness. Unfortunately, the telco router is not being monitored by the Telco and we're still asking for permission if we can add their device to our Solarwinds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the closest link I could look at is the 100mbps link from our switch going to the leased line router on our side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the traders are experiencing 3ms to 5ms latency in trading, it shows this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transmit: 1500bps - 1900bps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Receive: 2000bps - 2400bps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bytes Transferred per Minute: 44KB-60KB&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark Reports no problem at this time&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Special note though on every 9:34 - 9:37 because they experience 10ms - 15ms latency in trading:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transmit: 1900bps - 2400bps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Receive: 2400bps - 3200bps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bytes Transferred per Minute: 90KB - 170KB&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark Reports that I'm getting TCP Zero Window(trade server sending the zero window alert to the to stock exchange server) errors but it only lasts for a few milliseconds and only happens at twice or thrice a day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there was even one incident when our traders where experiencing crazy latencies of 1min - 3mins delay in trading!:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transmit: 4000bps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Receive: 5600bps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark Reports that we were getting TCP Zero Window(trade server sending the zero window alert to the to stock exchange server) errors for the whole trading period of that day. This only happened once and until now, I'm still not available to resolve this issue&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Trading Server team reports that their CPU, Memory and NIC utilization is normal and of course, everyone is blaming the network guys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So here are my questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0.) Is there something with the way i troubleshoot this problem?? I figured I should write this as question no. 0, haha.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) When TCP Zero Window happens, what things and devices should I check? Because server team reports that the Memory and NIC utilization of their trading server is normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) Is there a way to graph in wireshark the transmit/receive bps an bytes received? What I currently do is to go to Statistics -&gt; Conversation -&gt; IPV4 -&gt; Check the &quot;Limit Display to this Filter&quot; and the filter I'm using is ip.addr eq X.X.X.X and ip.addr eq Y.Y.Y.Y and (frame.time ge &quot;DATE HH:MM:SS.000000000&quot; and frame.time le &quot;DATE HH:MM:SS.999999999&quot;) and go look at the bps and bytes received&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.) Are there other things I could look at or check(network devices, etc.)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot for all your help guys! :)&lt;/p&gt;&#xA;" OwnerUserId="7876" LastEditorUserId="775" LastEditDate="2014-12-08T12:39:36.640" LastActivityDate="2015-03-08T18:28:18.950" Title="Troubleshooting &quot;TCP Zero Window&quot; Issues" Tags="|tcp|troubleshooting|wireshark|packet-analysis|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10437" PostTypeId="1" AcceptedAnswerId="10541" CreationDate="2014-08-14T07:17:41.760" Score="5" ViewCount="1219" Body="&lt;p&gt;Is there a way to &quot;TagAll&quot; VLANs on a HP Switch Port as it would be in a Cisco environment (by default on a cisco trunk port all VLANs are allowed, or one can explicilty define &quot;allowed vlans tagall -&gt; which then again is default config and won't show up in the running conf)&#xA;So far on HP Switches I am only aware of the ability to &quot;vlan x tagged port y&quot;. Everytime I created a new vlan on the HP switch I would have to add it tagged to the port if.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any one know of any options?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2014-08-20T21:20:23.870" Title="VLAN Tagging HP Switch" Tags="|cisco|switch|vlan|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="10439" PostTypeId="2" ParentId="10421" CreationDate="2014-08-14T10:49:49.893" Score="4" Body="&lt;p&gt;To prevent the router from assuming the IP address you want to port forward from, I discovered that you must add the &quot;no-alias&quot; option at the end.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ip nat inside source static tcp 10.0.0.10 234 10.0.0.10 123 no-alias&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1911" LastActivityDate="2014-08-14T10:49:49.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10442" PostTypeId="1" CreationDate="2014-08-14T21:51:51.333" Score="5" ViewCount="2505" Body="&lt;p&gt;I was pondering my network design today and came upon an idea that makes lots of sense to me, but I fear that it may be a terrible idea. I just don't have enough knowledge or experience to convince myself one way or the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network consists of a core layer and an edge layer (see diagram below). Currently if I need to add a vlan, I must create it on the core, add it to the uplinks for all edge switches, create it on the edge switches, and add it to the uplinks back to the core. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea that came to me is to configure the edge switch ends of the uplinks to do all VLANs, but to specify allowed vlans on the core for each link. This would eliminate at least one step in the process of adding a new vlan. There are some VLANs on the core that have no need to exist on some or all of the edge switches, but there is little to no likelihood that a VLAN will ever exist on an edge switch that doesn't already exist on the core.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/KCtwT.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is a terrible idea, please explain why. If it is a decent idea, again please explain why. I appreciate any constructive criticism you might have to share.&lt;/p&gt;&#xA;" OwnerUserId="88" LastEditorUserId="88" LastEditDate="2014-08-15T13:12:12.330" LastActivityDate="2014-08-15T13:12:12.330" Title="VLANs: To Prune or not to Prune" Tags="|vlan|best-practices|juniper-ex|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10443" PostTypeId="2" ParentId="10442" CreationDate="2014-08-15T01:30:43.293" Score="4" Body="&lt;p&gt;There's a big difference between &quot;allowed&quot; vlans and &quot;created&quot; vlans. Very few (read: NONE) of the switches I'm aware of can handle 4095 vlans. Entering the equiv of &lt;code&gt;vlan create 1-4095&lt;/code&gt; (i.e. &lt;em&gt;all&lt;/em&gt; vlans) will result in an error. &lt;code&gt;switchport trunk allowed vlan 1-4095&lt;/code&gt; is not the same as having all vlans on the switch -- just that the port will not filter any vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bottom line, you still have to go to every switch in the land to create any new vlan(s) and assign them to the necessary ports.  Vlan pruning is simply a means to reduce traffic to switches that have no need for it. A broadcast packet will be replicated to all corners unless the vlan is pruned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(and the only two protocols I know of to communicate vlan configuration -- VTP (cisco), and GVRP -- are a can of snakes, I just don't do it.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-15T01:30:43.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10444" PostTypeId="1" AcceptedAnswerId="10465" CreationDate="2014-08-15T04:16:28.240" Score="4" ViewCount="1137" Body="&lt;p&gt;I've got a Cisco 877 ADSL router from which I advertise a &lt;em&gt;default route&lt;/em&gt; via OSPF to our central router. It also does a standard ADSL / PPP connection to one of our ISPs. What I want is to advertise the default route only when PPP is up. If it goes down stop advertising &lt;em&gt;0.0.0.0/0&lt;/em&gt;. We don't get a BGP or OSPF feed over that ADSL so I can't simply redistribute what I receive. Is that doable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the PPP config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Dialer0&#xA; ip address negotiated&#xA; ip access-group INTERNET-IN in&#xA; no ip redirects&#xA; no ip unreachables&#xA; ip mtu 1492&#xA; ip nat outside&#xA; ip inspect INTERNET out&#xA; ip virtual-reassembly&#xA; encapsulation ppp&#xA; dialer pool 1&#xA; no cdp enable&#xA; ppp authentication pap callin&#xA; ppp pap sent-username ...&#xA; ppp ipcp route default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is the OSPF config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA; log-adjacency-changes&#xA; redistribute static subnets route-map ospf_tcl&#xA; network 192.168.128.0 0.0.15.255 area 1&#xA; default-information originate metric 1&#xA;&#xA;route-map ospf_tcl permit 10&#xA; match ip address prefix-list adsl_defroute&#xA;&#xA;ip prefix-list adsl_defroute seq 5 permit 0.0.0.0/0&#xA;ip prefix-list adsl_defroute seq 10 permit 192.168.128.0/20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt; based on the comments below...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main router has one other internet link (SHDSL) through a different ISP with BGP feed of national prefixes. The ADSL link (slow, cheap data) via Cisco 877 is primarily used for international traffic and the SHDSL link (fast, expensive data) for national traffic (welcome back to the 90's - that's what we get on a remote pacific island ;) However in the even of one link going down I want to automatically fail over all traffic to the other link. At the moment it requires a manual intervention on the main router manually replacing the default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is to have under normal circumstances a higher metric default route over SHDSL, lower metric default route via ADSL and a bunch of more specific national routes via SHDSL. That part already works, just the default routes updating doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the static routes from the Cisco box:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 218.101.y.y to network 0.0.0.0&#xA;&#xA;C    192.168.128.0/24 is directly connected, Vlan128&#xA;     203.97.x.0/32 is subnetted, 1 subnets&#xA;C       203.97.x.x is directly connected, Dialer0&#xA;     218.101.y.0/32 is subnetted, 1 subnets&#xA;C       218.101.y.y is directly connected, Dialer0&#xA;S*   0.0.0.0/0 [1/0] via 218.101.y.y&#xA;S    192.168.128.0/20 [1/0] via 192.168.128.221&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The main router is connected over &lt;code&gt;Vlan128&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="7971" LastEditorUserId="7971" LastEditDate="2014-08-15T09:25:06.667" LastActivityDate="2014-08-15T17:26:41.223" Title="Cisco 877 - Advertise OSPF default route only when PPP is up" Tags="|cisco|ospf|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10445" PostTypeId="1" CreationDate="2014-08-15T04:48:02.963" Score="7" ViewCount="574" Body="&lt;p&gt;I have a situation where I'm required to install a switch in a location that is physically insecure and has guests coming and going. It is in the audio rack of a sound desk at a facility that has lots of non-staff members that have physical access to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a HP ProCurve switch. I plan on taking the following precautions, but am looking for any loopholes I may have missed:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Disable the physical device reset buttons on the front of the switch (in software), not with epoxy&lt;/li&gt;&#xA;&lt;li&gt;Disable all ports that are not in active use&lt;/li&gt;&#xA;&lt;li&gt;Port-based VLAN for the active ports that take them off the main network and onto a less trusted network (but cannot go to a dmz-style totally untrusted network)&lt;/li&gt;&#xA;&lt;li&gt;Leave two ports enabled that go immediately to a captive portal on a guest VLAN for, well, guests. (the use of these ports will be publicly documented)&lt;/li&gt;&#xA;&lt;li&gt;Port-based 802.1X authentication based on known MAC addresses for the active, non-guest ports&lt;/li&gt;&#xA;&lt;li&gt;The uplink port will use 802.1q trunking with a native VLAN that is unused.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The cabling will be static. It will virtually never change, apart from the two guest ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know for a fact that due to the sort of people that come through the location that they will be curious to see what's  on the switch, and I don't want them getting into the protected part of the network unless they actively attempt to subvert the security. (And if they do that, then that's a question for security.se)&lt;/p&gt;&#xA;" OwnerUserId="687" LastEditorUserId="509" LastEditDate="2015-08-16T21:44:52.783" LastActivityDate="2015-08-16T21:44:52.783" Title="Switch security when in an unsecured location" Tags="|security|hp-procurve|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10446" PostTypeId="2" ParentId="10445" CreationDate="2014-08-15T05:02:04.430" Score="4" Body="&lt;p&gt;You also need to consider console port security - ie making sure AAA is enabled on the console. If the ProCurve doesn't support AAA on the console port, then make sure the login password for the console line is strong (and maybe rotated every 90 days or so).&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2014-08-15T05:02:04.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10447" PostTypeId="2" ParentId="10445" CreationDate="2014-08-15T05:10:28.020" Score="5" Body="&lt;p&gt;I'd use a patch panel protector if port security was a real issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, this depends on the access needed, frequency of physical port changes, and the composition of the rest of the rack/enclosure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IsLe1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="548" LastActivityDate="2014-08-15T05:10:28.020" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10450" PostTypeId="1" AcceptedAnswerId="10454" CreationDate="2014-08-15T06:34:39.260" Score="5" ViewCount="3984" Body="&lt;p&gt;A little bit new to Juniper here.&#xA;I am working on scripting few of our switch ports. All switches are Juniper, Ex, FX, QFX, ...etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no access to a lab to test my scripts, and was looking for one. Of course Olive was suggested but really don't have the time to maintain it.&#xA;Saw few ads about SSG-20, at low prices. I see it has several swich ports, and did my best to find out more, but do not see this anywhere.&#xA;Can that be used as a managed switch?&#xA;In other words, same Juniper switch commands (nothing crazy, basic port configuration, adding/changing description, and enable/disable) work on it?&lt;/p&gt;&#xA;" OwnerUserId="7975" LastEditorUserId="7975" LastEditDate="2014-08-15T17:18:24.637" LastActivityDate="2017-12-20T10:12:25.270" Title="Juniper Switching - Cheap Lab" Tags="|juniper|switching|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10452" PostTypeId="2" ParentId="10450" CreationDate="2014-08-15T06:49:28.657" Score="8" Body="&lt;p&gt;The SSG-20 only runs ScreenOS, not JunOS. Juniper switches run JunOS, so this won't help you test your scripts and test configs. Personally, I'd look for a cheap 2nd hand low end model Juniper, but it all depends a bit on your budget.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-08-15T06:49:28.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10453" PostTypeId="1" AcceptedAnswerId="10456" CreationDate="2014-08-15T07:00:54.533" Score="6" ViewCount="1282" Body="&lt;p&gt;Is &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1393&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1393&lt;/a&gt; implemented by real routers in practice?&lt;/p&gt;&#xA;&lt;p&gt;Are there any tools that generate traceroutes using it?&lt;/p&gt;&#xA;" OwnerUserId="7976" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2020-06-14T14:29:15.483" Title="IP Traceroute RFC 1393" Tags="|ipv4|icmp|traceroute|rfc|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10454" PostTypeId="2" ParentId="10450" CreationDate="2014-08-15T07:35:25.260" Score="8" Body="&lt;p&gt;Smallest switch would be an EX-2200c. I bought one for my home lab. It has 12 ports and most of the important features. You can even use virtual chassis functionality (with up to 2 or 4 devices). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/us/en/products-services/nos/junosphere/&quot; rel=&quot;noreferrer&quot;&gt;Junosphere&lt;/a&gt; might also be worth a look. And I guess you already know about the Junos Fasttrack program where you can get the training materials for the &quot;lower&quot; certifications including switching. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorDisplayName="user2084" LastEditDate="2014-08-15T10:25:16.593" LastActivityDate="2014-08-15T10:25:16.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10455" PostTypeId="2" ParentId="10453" CreationDate="2014-08-15T07:43:34.230" Score="6" Body="&lt;p&gt;Quoting from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6814#section-2.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6814&lt;/a&gt; which obsoletes RFC1393&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;###2.3. Traceroute&lt;/p&gt;&#xA;&lt;p&gt;The Traceroute option is defined in [RFC1393].  The Traceroute option&#xA;is defined as Experimental; it was never widely deployed on the&#xA;public Internet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So yes there should have been implementations for this (some one even implemented IP over avian carriers) but I've never seen one.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-08-15T12:34:42.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10456" PostTypeId="2" ParentId="10453" CreationDate="2014-08-15T07:45:27.087" Score="9" Body="&lt;p&gt;The new ICMP message type as defined in this RFC actually was added to the ICMP standard - though it's currently listed as Historic in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6918#section-2.6&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6918&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; 2.6. Traceroute (Type 30)&#xA;   This message type is specified in [RFC1393] and was meant to provide&#xA;   an alternative means to discover the path to a destination system.&#xA;   This message type has never been widely deployed.  The status of&#xA;   [RFC1393] has been changed to Historic by [RFC6814], and the&#xA;   corresponding option this message type relies on (Traceroute, Type&#xA;   82) has been formally obsoleted by [RFC6814].&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And mentioned in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6814#section-2.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6814&lt;/a&gt; where it's formally deprecated:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   The Traceroute option is defined in [RFC1393].  The Traceroute option&#xA;   is defined as Experimental; it was never widely deployed on the&#xA;   public Internet.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I very much doubt there would be any current tools that would support this kind of functionality.&lt;/p&gt;&#xA;" OwnerUserId="7949" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2020-06-14T14:29:15.483" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="10457" PostTypeId="2" ParentId="10450" CreationDate="2014-08-15T10:36:55.160" Score="8" Body="&lt;p&gt;&lt;strong&gt;* UPDATED Dec 2017 *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper renamed this product to the vSRX (virtual SRX). You can still download a trial copy - &lt;a href=&quot;https://www.juniper.net/uk/en/products-services/security/srx-series/vsrx/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.juniper.net/uk/en/products-services/security/srx-series/vsrx/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;You can also download Juniper Firefly which is a virtual SRX device (not the same as an Olive). It has a trial 60 day license so you can test out configuring ports and so on. There will be a few differences compared to a switch but the basic commands will be the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe anyone can download and trial this. I have run them in VMWare Workstation and on ESXi server. I think you might even be able to run it in VMWare Player.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/uk/en/products-services/security/firefly-perimeter/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.juniper.net/uk/en/products-services/security/firefly-perimeter/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are even some articles on running them in QEMU for use in GNS3&lt;/p&gt;&#xA;" OwnerUserId="139" LastEditorUserId="139" LastEditDate="2017-12-20T10:12:25.270" LastActivityDate="2017-12-20T10:12:25.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10461" PostTypeId="1" AcceptedAnswerId="10462" CreationDate="2014-08-15T14:29:19.753" Score="1" ViewCount="2327" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/configuration/guide/conf_gd/cfgnat.html&quot; rel=&quot;nofollow&quot;&gt;this documentation&lt;/a&gt; it should be possible to configure NAT on Cisco ASA. However, when the example command is executed, the input is invalid. A comparable issue occurs while configuring ssh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Outcome&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;configure NAT:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa# conf t&#xA;ciscoasa(config)# nat (inside) 1 X 255.255.255.0&#xA;                       ^&#xA;ERROR: % Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;configure ssh:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# ssh X 255.255.255.0 inside&#xA;                                      ^&#xA;ERROR: % Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;No available interfaces&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# nat (?&#xA;&#xA;configure mode commands/options:&#xA;Current available interface(s):&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Version&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa# sh ve&#xA;&#xA;Cisco Adaptive Security Appliance Software Version 7.2(4)&#xA;Device Manager Version 5.2(4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Subquestion:&lt;/strong&gt; should the &lt;em&gt;inside&lt;/em&gt; interface be configured?&lt;/p&gt;&#xA;" OwnerUserId="5282" LastEditorUserId="5282" LastEditDate="2014-08-16T12:36:47.790" LastActivityDate="2014-08-16T12:36:47.790" Title="Inside interface not recognized on Cisco ASA-5505" Tags="|cisco-asa|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10462" PostTypeId="2" ParentId="10461" CreationDate="2014-08-15T15:12:10.607" Score="2" Body="&lt;p&gt;After reading &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/int5505.html&quot; rel=&quot;nofollow&quot;&gt;this documentation&lt;/a&gt; and executing the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa# conf t&#xA;ciscoasa(config)# interface vlan X&#xA;ciscoasa(config-if)# nameif inside&#xA;INFO: Security level for &quot;inside&quot; set to 100 by default.&#xA;ciscoasa(config-if)# security-level Y&#xA;ciscoasa(config-if)# ip address Z 255.255.255.0&#xA;ciscoasa(config-if)# no shutdown&#xA;ciscoasa(config-if)# end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;interfaces were available:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa# conf t&#xA;ciscoasa(config)# nat (?&#xA;&#xA;configure mode commands/options:&#xA;Current available interface(s):&#xA;&#xA;  inside  Name of interface VlanX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the commands specified in the question could be executed.&lt;/p&gt;&#xA;" OwnerUserId="5282" LastActivityDate="2014-08-15T15:12:10.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10463" PostTypeId="2" ParentId="10450" CreationDate="2014-08-15T15:26:19.137" Score="-1" Body="&lt;p&gt;Not sure if this would help in your case but:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either from &lt;a href=&quot;http://www.juniper.net/techpubs/&quot; rel=&quot;nofollow&quot;&gt;online Juniper documentation&lt;/a&gt;&lt;br&gt;&#xA;OR&lt;br&gt;&#xA;From any of the &lt;a href=&quot;https://www.google.co.in/search?q=junos%20books&amp;amp;oq=junos%20books&amp;amp;aqs=chrome..69i57j69i60l5.1713j0j7&amp;amp;sourceid=chrome&amp;amp;es_sm=122&amp;amp;ie=UTF-8&amp;amp;qscrl=1&quot; rel=&quot;nofollow&quot;&gt;JUNOS books&lt;/a&gt;&lt;br&gt;&#xA;OR&lt;br&gt;&#xA;if possible, you could request someone to get you the Junos CLI command and their respective outputs. You can then code your scripts using them. &#xA;I assume your scripts would roughly be doing the following: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Connecting to the Switch (telnet/ssh)  &lt;/li&gt;&#xA;&lt;li&gt;Go to appropriate JUNOS mode: config/cli/shell  &lt;/li&gt;&#xA;&lt;li&gt;Issue &quot;set&quot; statements for configuration from the config mode(&quot;#&quot; prompt). Issue &quot;commit&quot; thereafter.  &lt;/li&gt;&#xA;&lt;li&gt;Issue verification commands from the CLI (&quot;&gt;&quot; prompt). &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Repeat steps 3 and 4 if needed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most scripting languages (like Perl, Python) have libraries for Telnet/Expect. &lt;/p&gt;&#xA;" OwnerUserId="4319" LastActivityDate="2014-08-15T15:26:19.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10465" PostTypeId="2" ParentId="10444" CreationDate="2014-08-15T17:26:41.223" Score="3" Body="&lt;p&gt;Change your static route to use the interface as well as the next hop.  That way, when the interface goes down, the route will be removed and no longer advertised over OSPF.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip route 0.0.0.0 0.0.0.0 218.101.y.y  &#xA;&#xA;ip route 0.0.0.0 0.0.0.0 218.101.y.y Dialer0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should also remove the redistribute command -- it's not needed&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-15T17:26:41.223" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10466" PostTypeId="2" ParentId="10347" CreationDate="2014-08-15T18:31:14.897" Score="4" Body="&lt;p&gt;Turns out this is a bug and is on file already with Cisco.&lt;/p&gt;&#xA;&lt;p&gt;From Cisco TAC:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A bug has already been filed on this type of scenario. Here is the bug&#xA;ID- &lt;a href=&quot;https://tools.cisco.com/bugsearch/bug/CSCuo44475/?reffering_site=dumpcr&quot; rel=&quot;nofollow noreferrer&quot;&gt;CSCuo44475&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;This should be addressed starting with the 8.0 FCS / 7.6 MR3(7.6.130.0) releases - i.e. at that point you should be able to download the applicable k9w8 image, install it on the AP, and then join that AP directly to a WLC, without having to re-download the software.&lt;/p&gt;&#xA;&lt;p&gt;7.6.130.0 is expected to be released by end of this month and 8.0 in September.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-08-15T18:31:14.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10467" PostTypeId="1" CreationDate="2014-08-15T18:38:30.477" Score="-1" ViewCount="799" Body="&lt;p&gt;Is ftp a one or two way communication? If I need to allow it outbound through a firewall is it enough if I allow it from inside to outside or does it need to be bidirectional? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about SFTP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thx&lt;/p&gt;&#xA;" OwnerUserId="3916" LastActivityDate="2014-08-16T06:50:46.050" Title="FTP communication" Tags="|firewall|tftp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10468" PostTypeId="1" AcceptedAnswerId="10473" CreationDate="2014-08-15T21:06:28.323" Score="1" ViewCount="311" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/access_management.html&quot; rel=&quot;nofollow&quot;&gt;this documentation&lt;/a&gt; it should be possible to enable an SSH connection to a Cisco ASA 5505. However, it is not possible to ping an IP from the ASA while this has been configured. As it is impossible to ping internally then SSH from another system will work neither.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa# sh run&#xA;...&#xA;interface Vlan 100&#xA;  nameif inside&#xA;  security-level 100&#xA;  ip address 192.168.0.10 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ping from ASA&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa# ping 192.168.0.10&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.168.0.10, timeout is 2 seconds:&#xA;No route to host 192.168.0.10&#xA;&#xA;Success rate is 0 percent (0/1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5282" LastActivityDate="2014-08-16T06:58:17.823" Title="SSH to Cisco ASA 5505" Tags="|cisco-asa|ssh|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10472" PostTypeId="2" ParentId="10467" CreationDate="2014-08-16T06:44:26.063" Score="3" Body="&lt;p&gt;&lt;em&gt;Since your comment indicated the client is on the outside and the server sitting inside,  the outside client would be initiating a connection to your inside server.  Therefore, your firewall must have an ACL on your outside interface to permit this, but this is just the beginning of the story....&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;FTP&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;FTP has a &lt;strong&gt;&lt;em&gt;control channel&lt;/em&gt;&lt;/strong&gt; on port 21 and a &lt;strong&gt;data channel&lt;/strong&gt; on port 20 by default, but the data channel is usually some random port negotiated over the control channel.  With a firewall like the Cisco ASA or PIX, you typically need FTP Inspection enabled.  Your Outside ACL only allows tcp/21.  The Inspection occurs at the FTP app layer so the firewall can detect the port for the data channel and create a pinhole for that traffic.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data transfers take place on the data channel in either Active or Passive mode as determined by the client.  [Active mode was once the predominant default, but many clients are moving to Passive now.]  Active mode (FTP &lt;code&gt;PORT&lt;/code&gt; command) indicates the port (and IP address) the client is listening for the incoming data connection initiated by the server.  This often breaks because client firewalls are not often capable of the Inspection-equivalency to let that through.  So often, we see clients doing Passive mode (FTP &lt;code&gt;PASV&lt;/code&gt; command) which asks the server to provide a port that the client will connect to (server listening on PASV port).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without Inspection or its equivalent on your firewall, you'll need to open blocks of ports if clients are Passive and restrict your server to a small range of data channel ports.  Keeping the number of ports low prevents you from opening too many ports on your Outside ACL.  With Active clients and no Inspection, a default &lt;code&gt;permit inside any any&lt;/code&gt; type of statement would let your server initiate a connection out to the client on the data channel, though you may still run into the client's firewall getting in the way as described earlier.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;SFTP&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This is just Secure (or SSH) FTP which is really just SSH file transfers and not the FTP protocol itself.  It defaults to tcp/22 -- same as SSH -- and doesn't require a separate channel.  This is much easier to handle through firewalls, but obviously both client and server need to be speaking the same protocol.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2014-08-16T06:50:46.050" LastActivityDate="2014-08-16T06:50:46.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10473" PostTypeId="2" ParentId="10468" CreationDate="2014-08-16T06:58:17.823" Score="8" Body="&lt;p&gt;The ability to SSH to the firewall and ping outbound are usually two unrelated events and configuration.  Since you're unable to ping the firewall's own &lt;code&gt;192.168.0.10&lt;/code&gt; from itself, the interface appears down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After ensuring &lt;em&gt;vlan 100&lt;/em&gt; is &lt;em&gt;up/up&lt;/em&gt;, you'll need both a crypto key for SSH and a statement like &lt;code&gt;ssh 192.168.0.0 255.255.255.0 inside&lt;/code&gt; to permit all inside hosts on that subnet to SSH into the firewall.  Also check your SSH supported versions so client and server (firewall) are compatbile.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2014-08-16T06:58:17.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10474" PostTypeId="2" ParentId="9846" CreationDate="2014-08-16T10:08:34.357" Score="4" Body="&lt;p&gt;The &lt;a href=&quot;http://www.brocade.com/downloads/documents/html_product_manuals/NI_05600_SWITCHING/wwhelp/wwhimpl/js/html/wwhelp.htm&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt; says: &quot;NOTE: If a port is configured as a mirror port, all traffic sent from that port will retain the encapsulation of the port being monitored and not add the encapsulation of the Egress port.&quot;. So it's a 1:1 packet copy, any tagging is preserved.&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2014-08-16T10:08:34.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10475" PostTypeId="1" AcceptedAnswerId="10476" CreationDate="2014-08-16T13:01:10.103" Score="2" ViewCount="1780" Body="&lt;p&gt;In order to save the configuration on Cisco Switches one could execute &lt;code&gt;wr&lt;/code&gt;. However this does not seem to work on Cisco ASA 5505. Although the system indicates that the config has been saved, a reboot results in data loss. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/start.html&quot; rel=&quot;nofollow&quot;&gt;this documentation&lt;/a&gt; one could execute &lt;code&gt;write memory&lt;/code&gt; to store the config on ASA, but this does save the data neither.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Saving config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa# conf t&#xA;ciscoasa(config)# int vl 100&#xA;ciscoasa(config-if)# end&#xA;ciscoasa# sh sw vl&#xA;VLAN Name                        Status     Ports&#xA;---- --------------------------- ---------- -----------------------------&#xA;1    -                           down       Et0/0, Et0/1, Et0/2, Et0/3&#xA;                                            Et0/4, Et0/5, Et0/6, Et0/7&#xA;100  -                           down&#xA;ciscoasa# write memory&#xA;Building configuration...&#xA;Cryptochecksum: X Y Z&#xA;&#xA;1269 bytes copied in 1.230 secs (1269 bytes/sec)&#xA;[OK]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Config after reboot&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rommon #0&amp;gt; boot&#xA;...&#xA;ciscoasa&amp;gt; en&#xA;Password: &#xA;ciscoasa# sh sw vl&#xA;VLAN Name                        Status     Ports&#xA;---- --------------------------- ---------- -----------------------------&#xA;1    -                           down       Et0/0, Et0/1, Et0/2, Et0/3&#xA;                                            Et0/4, Et0/5, Et0/6, Et0/7&#xA;&#xA;ciscoasa#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5282" LastActivityDate="2014-08-16T17:03:00.827" Title="Unable to save ASA config" Tags="|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10476" PostTypeId="2" ParentId="10475" CreationDate="2014-08-16T14:34:55.357" Score="5" Body="&lt;p&gt;First check your current config register value. You can do that using &lt;code&gt;sh ve&lt;/code&gt; command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default value is &lt;em&gt;0x1&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find possible values &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/c4.html#wp2142170&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="7994" LastEditorUserId="5282" LastEditDate="2014-08-16T17:03:00.827" LastActivityDate="2014-08-16T17:03:00.827" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10481" PostTypeId="1" CreationDate="2014-08-17T05:08:26.697" Score="3" ViewCount="1069" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2784.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;As per the RFC&lt;/a&gt;,&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;GRE (Generic Routing Encapsulation) specifies a protocol for&#xA;encapsulation of an arbitrary protocol over another arbitrary&#xA;network layer protocol.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I don't think I understand why GRE is needed at all. To encapsulate a protocol &lt;code&gt;A&lt;/code&gt; in protocol &lt;code&gt;B&lt;/code&gt;, can you not just send &lt;code&gt;A&lt;/code&gt; packets as the data in &lt;code&gt;B&lt;/code&gt; packets?&lt;/p&gt;&#xA;&lt;p&gt;I know that GRE can be used to create a tunnel, and Section 3 of the current RFC mentions security considerations, but doesn't say anything more than that there should be some security in place.&lt;/p&gt;&#xA;&lt;p&gt;In short, &lt;strong&gt;what benefits does GRE offer over &amp;quot;naive&amp;quot; encapsulation of protocols?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="7998" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2018-12-26T04:30:17.637" Title="What problem does GRE solve?" Tags="|protocol-theory|tunnel|gre|rfc|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10485" PostTypeId="1" CreationDate="2014-08-17T19:00:01.850" Score="3" ViewCount="5247" Body="&lt;p&gt;IS-IS runs natively on layer 2 of the  OSI reference model. How will the routing be done in that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My doubt is that layer 3 has the ability to do the routing. But, ISIS does not run in layer 3 rather it natively runs in layer-2. In that, how does the IS-IS perform routing in layer 2 of the OSI model?&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="8499" LastEditDate="2018-03-21T00:56:37.147" LastActivityDate="2018-03-21T00:56:37.147" Title="How does IS-IS carry IP routes?" Tags="|routing|layer2|layer3|osi|is-is|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10486" PostTypeId="1" CreationDate="2014-08-17T20:11:04.263" Score="10" ViewCount="1966" Body="&lt;p&gt;I've been trying to figure this out but all the documentation I can find seems to be very old. The feeling seems to be that once Dell acquired Sonicwall, documentation became sparse and mostly useless. Ended up here at StackExchange due to a few Google searches bringing me to conversations where it looked like people were doing this sort of thing recently and knew what they were doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was the main piece of documentation that I was using for reference, but as you can see it dates to 2006 and is for SonicOS Enhanced 3. &#xA;&lt;a href=&quot;http://www.sonicwall.com/app/projects/file_downloader/document_lib.php?t=TN&amp;amp;id=208&quot; rel=&quot;noreferrer&quot;&gt;SonicwallOS Enhanced to Openswan Linux Using GroupVPN with XAUTH&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the environment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sonicwall (SonicOS Enhanced 5.9.0.2) - internet - Netgear router - Cisco integrated business router, series 881 (In the DMZ for the Netgear router) - Ubuntu 14.04 running Openswan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN subnet on Sonicwall: 192.168.0.0/23&lt;br&gt;&#xA;Lan behind Cisco: 192.168.100.0/24&lt;br&gt;&#xA;Ubuntu private IP: 192.168.100.25  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So where do I even start? I configured ipsec.conf file as described in that PDF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conn TSBackup&#xA;    left=192.168.100.25&#xA;    leftsubnet=192.168.100.25/32&#xA;    leftnexthop=%defaultroute&#xA;    right=12.69.113.194&#xA;    rightsubnet=192.168.0.0/23&#xA;    rightnexthop=192.168.0.1&#xA;    rightid=@0017C568BE38&#xA;    auto=add&#xA;    authby=secret&#xA;    keyingtries=3&#xA;    pfs=no&#xA;    ike=3des-sha1;modp1024!&#xA;    esp=3des-sha1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the Sonicwall, there's a Site-to-Site defined with the following settings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Policy type: Site to site&#xA;Auth method: IKE using Preshared Secret&#xA;IPsec Primary gateway: (public IP of Ubuntu server)&#xA;Local IKE ID: (Sonicwall's ID)&#xA;Peer IKE ID: ubuntuid&#xA;Local network: Lan Subnets&#xA;Remote Network: (Address object, pointing to Ubuntu's private address 192.168.100.25)&#xA;Phase 1: Main Mode, Group 2, 3DES-Sha1 28800&#xA;Phase 2: ESP, 3DES, SHA1, perfect forward secret not checked,28800&#xA;Enable Keep alive&#xA;Dead peer detection: 180, 3&#xA;VPN policy bound to Zone WAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't even know where to look for logs. I've started over too, thinking maybe I goofed somewhere. Any help or advice is greatly appreciated, and my apologies for being green in all of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Results when initiating the connection:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;104 &quot;TSBackup&quot; #1: STATE_MAIN_I1: initiate&#xA;003 &quot;TSBackup&quot; #1: ignoring unknown Vendor ID payload [5b362bc820f60008]&#xA;003 &quot;TSBackup&quot; #1: received Vendor ID payload [RFC 3947] method set to=115&#xA;106 &quot;TSBackup&quot; #1: STATE_MAIN_I2: sent MI2, expecting MR2&#xA;003 &quot;TSBackup&quot; #1: ignoring Vendor ID payload [Sonicwall 1 (TZ 170 Standard?)]&#xA;003 &quot;TSBackup&quot; #1: received Vendor ID payload [XAUTH]&#xA;003 &quot;TSBackup&quot; #1: received Vendor ID payload [Dead Peer Detection]&#xA;003 &quot;TSBackup&quot; #1: NAT-Traversal: Result using draft-ietf-ipsec-nat-t-ike (MacOS X): i am NATed&#xA;108 &quot;TSBackup&quot; #1: STATE_MAIN_I3: sent MI3, expecting MR3&#xA;003 &quot;TSBackup&quot; #1: next payload type of ISAKMP Hash Payload has an unknown value: 175&#xA;003 &quot;TSBackup&quot; #1: malformed payload in packet&#xA;010 &quot;TSBackup&quot; #1: STATE_MAIN_I3: retransmission; will wait 20s for response&#xA;003 &quot;TSBackup&quot; #1: ignoring informational payload, type INVALID_COOKIE msgid=00000000&#xA;003 &quot;TSBackup&quot; #1: received and ignored informational message&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/e2rQm7wi&quot; rel=&quot;noreferrer&quot;&gt;ipsec barf&lt;/a&gt; @ Pastebin&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Updated ipsec.conf and SonicWall settings. Added results from opening connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2: addded link to ipsec barf.&lt;/p&gt;&#xA;" OwnerUserId="8005" LastEditorUserId="8005" LastEditDate="2014-08-22T19:20:02.147" LastActivityDate="2014-08-22T19:20:02.147" Title="Openswan-Sonicwall VPN tunnel" Tags="|vpn|sonicwall|" AnswerCount="0" CommentCount="4" ClosedDate="2022-11-13T05:18:20.290" ContentLicense="CC BY-SA 3.0" />
  <row Id="10489" PostTypeId="2" ParentId="10481" CreationDate="2014-08-18T03:01:48.353" Score="4" Body="&lt;p&gt;GRE is just a tunneling protocol - its main reason for existence is toplogy hiding/bypass.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some examples include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Tunneling MPLS across a network that may otherwise not support it - MPLS shims are not IP-based, therefore wrapping them in a GRE tunnel allows two routers to appear adjacent when there could be a number of intermediate IP-only devices.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configuring EBGP sessions with neighbours that are not directly attached - this is often used by Anti-DDoS services to allow your prefixes to be advertised at their scrubbing stations, and traffic delivered directly to you even in cases where they may be multiple ASs away from your border &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;GRE over IPSEC is another common use that allows upper-layer routing-protocols to be established across IPSEC-based networks, avoiding the often static configuration and routing limitations posed by traditional (eg: Cisco-based) VPN deployments.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is also an example of the open-ended security that the RFC mentions.  This is not an oversight, merely a way of not excluding future technologies from being used (GREoSSL, GREoQuantumCryptography etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the perspective of intermediary devices, the encapsulated traffic IS &quot;Native&quot; inside a GRE header, the fact that the payload is interpreted as additional headers on the terminating device is IMHO largely irrelevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GRE is just a protocol that most routers understand and it is simple enough that encap/decap doesn't burden the router too much. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of it another way - if you wanted to tunnel IP inside HTTP (perfectly possible, if somewhat inefficient) you would need to implement an HTTP server on all your routers.  GRE is just a simpler, stateless, minimalist way to achieve the same thing.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2014-08-18T03:01:48.353" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10490" PostTypeId="1" AcceptedAnswerId="10494" CreationDate="2014-08-18T06:29:33.670" Score="5" ViewCount="1180" Body="&lt;p&gt;I want to monitor the incoming and outgoing traffic of an lacp trunk (&lt;code&gt;Port 23 and 24 (group id 02)&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get the value?&#xA;I already searched for an OID, but I have not found it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before, I used the following OIDs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IfOutOctets: &lt;code&gt;1.3.6.1.2.1.2.2.1.16.[PORT]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;IfInOctets:  &lt;code&gt;1.3.6.1.2.1.2.2.1.10.[PORT]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But these are only for a single port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch: 3com Baseline Switch 2924 SFP Plus&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result of GetIf:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/t0DZh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="8011" LastEditorUserId="8011" LastEditDate="2014-08-18T07:03:30.530" LastActivityDate="2014-08-18T09:05:51.907" Title="Incoming/Outgoing Traffic of LACP trunk" Tags="|switch|snmp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10491" PostTypeId="1" AcceptedAnswerId="10492" CreationDate="2014-08-18T07:30:57.563" Score="3" ViewCount="231" Body="&lt;p&gt;Let's assume I'm running web service and estimate two possible solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I'm looking for answer from business point of view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I would like to see from any other point of view anyway.&lt;/p&gt;&#xA;" OwnerUserId="8012" LastActivityDate="2014-08-18T07:35:34.143" Title="Advantages of AS over IP block from ISP" Tags="|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10492" PostTypeId="2" ParentId="10491" CreationDate="2014-08-18T07:35:34.143" Score="5" Body="&lt;p&gt;If you don't need to be connected to other ISPs directly, in other words - if you trust your ISP to function up to your SLA commitments for this web service, you can just grab IP block from him and live with that. IP block will propably come from ISP PA block (Provider Aggregatable).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you want to be connected to multiple ISPs, run multihoming and have added redundancy to the solution, you need to have AS to request PI block (Provider Independent). It's usual practice to follow this way, as pros of having connection to two different ISPs usually win the con of having additional connection &amp;amp; paying for it. &lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-08-18T07:35:34.143" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10493" PostTypeId="1" CreationDate="2014-08-18T07:52:39.193" Score="4" ViewCount="6447" Body="&lt;p&gt;I'm trying to establish an IPSec VPN connection between my site and an ISP. I have a Cisco 1941 router and a Cisco firewall on the ISP side. I set up the configuration according to what the ISP has but the status of the connection remains in a DOWN-Negotiating state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config of my router with the results of some show commands. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router Config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpn1#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 4644 bytes&#xA;!&#xA;! Last configuration change at 13:58:46 UTC Sun Aug 17 2014 by vpnroot&#xA;version 15.3&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname vpn1&#xA;!&#xA;boot-start-marker&#xA;boot system flash0:/c1900-universalk9-mz.SPA.153-3.M.bin&#xA;boot-end-marker&#xA;!&#xA;logging buffered 51200 warnings&#xA;enable secret 4 LPBjJOh2X18NmxK5zKaaRkq6ILnm0.W4U17BMUTYhlE&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login default local&#xA;aaa authentication login telnet local&#xA;!&#xA;aaa session-id common&#xA;!&#xA;ip domain name mccarabia.com&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;crypto pki trustpoint TP-self-signed-929942026&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-929942026&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-929942026&#xA;!&#xA;crypto pki certificate chain TP-self-signed-929942026&#xA; certificate self-signed 01&#xA;  30820229 30820192 A0030201 02020101 300D0609 2A864886 F70D0101 05050030&#xA;  30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274&#xA;  69666963 6174652D 39323939 34323032 36301E17 0D313331 30313030 33323532&#xA;  375A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F&#xA;  532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3932 39393432&#xA;  30323630 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100&#xA;  C4C540E7 E4740870 EFF67079 DFC6B8F7 EAE81416 90541D0C CC7F7A92 823D0983&#xA;  FCB5F3CD F365F0E4 42791930 2A9E72B0 CE11DDD9 91A23DCE 806B7D23 D3994D76&#xA;  5AA375C0 90F3530E 3FF0C864 4717FB4C 69F4DCDF DB33E817 E04F7626 C404C17B&#xA;  8E030A54 D76EA2FD FE8E0CEB 68F6A992 3B223DC5 27DB7DAD 8DD81F20 9B8F6E0B&#xA;  02030100 01A35330 51300F06 03551D13 0101FF04 05300301 01FF301F 0603551D&#xA;  23041830 16801492 01A84F97 BA5D81D8 E6F43A65 5FA80563 5389A430 1D060355&#xA;  1D0E0416 04149201 A84F97BA 5D81D8E6 F43A655F A8056353 89A4300D 06092A86&#xA;  4886F70D 01010505 00038181 009EA781 A39E3CF2 3A7195B7 313BDAEB 9A69DEEC&#xA;  9056BFDE 0E14EE15 E66E547E 190AE853 0CCC84E9 8A160F18 56A072D0 8BCF539E&#xA;  2091E1B2 9A90B0AA 63CBBC29 3DF15622 BF288850 E0413B91 BDCFCE12 66E004CA&#xA;  D0AB91F1 BFC3E42B 86576C24 0C0412C6 84AB49E1 6BA185A8 D5F9528C E4F78417&#xA;  501911AB 95258FDA E95965BA 38&#xA;        quit&#xA;license udi pid CISCO1941/K9 sn FCZ1741924U&#xA;license accept end user agreement&#xA;license boot module c1900 technology-package securityk9&#xA;!&#xA;username VPNROOT privilege 15 secret 4 RoxTpXiIZzs3wSY6UZ2pZFHibLCb1XA3HeKpPCLqN                                                                                        XQ&#xA;!&#xA;redundancy&#xA;!&#xA;crypto isakmp policy 2&#xA; encr aes 256&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key xxxxx address x.x.x.x&#xA;crypto isakmp aggressive-mode disable&#xA;!&#xA;crypto ipsec transform-set TransTest esp-aes esp-sha-hmac&#xA; mode tunnel&#xA;!&#xA;crypto map aaa local-address GigabitEthernet0/0&#xA;!&#xA;crypto map maptest 2 ipsec-isakmp&#xA; set peer x.x.x.x&#xA; set transform-set TransTest&#xA; match address 102&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$&#xA; ip address y.y.y.y 255.255.255.252&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; crypto map maptest&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description &quot; Lan Subnet &quot;&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;!&#xA;ip nat source list 166 interface GigabitEthernet0/0 overload&#xA;ip route 0.0.0.0 0.0.0.0 37.216.228.193&#xA;!&#xA;ip access-list extended nat&#xA; deny   ip 192.168.2.0 0.0.0.255 10.122.193.0 0.0.0.255&#xA; permit ip 192.168.2.0 0.0.0.255 any&#xA;!&#xA;access-list 101 permit ip 192.168.2.0 0.0.0.255 10.122.193.0 0.0.0.255&#xA;access-list 102 permit ip any any&#xA;access-list 166 permit ip 192.168.2.0 0.0.0.255 any&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line 2&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport output pad telnet rlogin lapb-ta mop udptn v120 ssh&#xA; stopbits 1&#xA;line vty 0 4&#xA; privilege level 15&#xA; password *************&#xA; login authentication telnet&#xA; transport input ssh&#xA;line vty 5 15&#xA; password *************&#xA; transport input ssh&#xA;!&#xA;scheduler allocate 20000 1000&#xA;!&#xA;end&#xA;&#xA;vpn1#show crypto s&#xA;vpn1#show crypto ses&#xA;vpn1#show crypto session&#xA;Crypto session current status&#xA;&#xA;Interface: GigabitEthernet0/0&#xA;Session status: DOWN-NEGOTIATING&#xA;Peer: x.x.x.x port 500&#xA;  Session ID: 0&#xA;  IKEv1 SA: local y.y.y.y/500 remote x.x.x.x/500 Inactive&#xA;  IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0&#xA;        Active SAs: 0, origin: crypto map&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Useful Info&lt;/strong&gt;    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpn1#show cry&#xA;vpn1#show crypto is&#xA;vpn1#show crypto isakmp sa&#xA;IPv4 Crypto ISAKMP SA&#xA;dst             src             state          conn-id status&#xA;x.x.x.x  y.y.y.y  MM_SA_SETUP          0 ACTIVE&#xA;&#xA;IPv6 Crypto ISAKMP SA&#xA;&#xA;vpn1#show crypto ipse&#xA;vpn1#show crypto ipsec sa de&#xA;vpn1#show crypto ipsec sa detail&#xA;&#xA;interface: GigabitEthernet0/0&#xA;    Crypto map tag: maptest, local addr y.y.y.y&#xA;&#xA;   protected vrf: (none)&#xA;   local  ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)&#xA;   remote ident (addr/mask/prot/port): (0.0.0.0/0.0.0.0/0/0)&#xA;   current_peer x.x.x.x port 500&#xA;     PERMIT, flags={origin_is_acl,}&#xA;    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0&#xA;    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0&#xA;    #pkts compressed: 0, #pkts decompressed: 0&#xA;    #pkts not compressed: 0, #pkts compr. failed: 0&#xA;    #pkts not decompressed: 0, #pkts decompress failed: 0&#xA;    #pkts no sa (send) 32, #pkts invalid sa (rcv) 0&#xA;    #pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0&#xA;    #pkts invalid prot (recv) 0, #pkts verify failed: 0&#xA;    #pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0&#xA;    #pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0&#xA;    ##pkts replay failed (rcv): 0&#xA;    #pkts tagged (send): 0, #pkts untagged (rcv): 0&#xA;    #pkts not tagged (send): 0, #pkts not untagged (rcv): 0&#xA;    #pkts internal err (send): 0, #pkts internal err (recv) 0&#xA;&#xA;     local crypto endpt.: y.y.y.y, remote crypto endpt.: x.x.x.x&#xA;     plaintext mtu 1500, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0&#xA;     current outbound spi: 0x0(0)&#xA;     PFS (Y/N): N, DH group: none&#xA;&#xA;     inbound esp sas:&#xA;&#xA;     inbound ah sas:&#xA;&#xA;     inbound pcp sas:&#xA;&#xA;     outbound esp sas:&#xA;&#xA;     outbound ah sas:&#xA;&#xA;     outbound pcp sas:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8014" LastEditorUserId="453" LastEditDate="2017-09-19T04:10:45.997" LastActivityDate="2017-09-19T04:10:45.997" Title="Cisco IPSec VPN is not working" Tags="|cisco|vpn|ipsec|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10494" PostTypeId="2" ParentId="10490" CreationDate="2014-08-18T08:42:37.660" Score="5" Body="&lt;p&gt;Your SNMP index may not match your port number.  On some platforms, the indexes are not even persistent across reloads unless configured to be.  I'd expect to find an interface speed of 2Gbps in your SNMPwalk for your 2-port LACP.  You should scrutinize any ports showing a speed &amp;gt; 0 besides your physical ports 1-24 as possibly the LACP virtual interface.&lt;/p&gt;&#xA;&lt;p&gt;I'd recommend investing some time to install and learn &lt;a href=&quot;http://www.cacti.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cacti&lt;/a&gt;.  Cacti excels at &lt;strong&gt;SNMP&lt;/strong&gt; monitoring especially using the standard &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2863&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC&lt;/a&gt; &lt;strong&gt;IF-MIB&lt;/strong&gt;.  You can enable debugging when Cacti queries your platform which will correlate other helpful elements of your ports like descriptions.  Keep in mind that your SNMP counters for your VLAN interface may only count octets going into and out of the VLAN, not within the VLAN.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-08-18T09:05:51.907" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10495" PostTypeId="2" ParentId="10485" CreationDate="2014-08-18T09:52:02.980" Score="4" Body="&lt;p&gt;What difference does it make? OSPF and ISIS behave very similarly in the sense that they both use methods to form neighborships/adjacencies with Hello packets (or PDU's) and then exchange topology information (LSA flooding), then their link state databases are constructed, and then the Dijkstra algorithm is run to generate a shortest-path tree and then the routing table is built.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF just runs on top of IP natively, while ISIS does not. Is the concept of NSAP/OSI addressing weird to people that are only used to IP? Yes. But as Mike has pointed out, this is simply because the folks that designed the protocol intended for it to be network-layer agnostic, which not only allows ISIS to support other routed protocols, but also makes extending the protocol to support those routed protocols much easier (Example - because OSPF has a direct dependency on IP, it had to be basically rewritten to support IPv6, whereas with ISIS, only support for a new TLV had to be created).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dijkstra is Dijkstra - it doesn't matter if we're talking about CLNS/CLNP or native IP.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="220" LastEditDate="2014-08-18T11:10:34.853" LastActivityDate="2014-08-18T11:10:34.853" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10496" PostTypeId="2" ParentId="10485" CreationDate="2014-08-18T09:57:36.500" Score="6" Body="&lt;p&gt;ISIS works quite differently than most of the protocols you know. In the original OSI networking, ISIS would make adjacencies with it's neighbors, and tell them about the adresses of any ES it knows. IS means intermediate system, so besically a router. ES means end system, so any host. ISIS has different logic with different levels of routing. The levels used in ISIS are*:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Level 1: Exchange routing information with neighbors in the same&#xA;area.&lt;/li&gt;&#xA;&lt;li&gt;Level 2: Exchange routing information with neighbors in other areas&#xA;(often refered to as the backbone).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Basically, the logic is as follows:&#xA;For level 1: flood all the connected and redistributed routes you know to all the level 1 neighbors &lt;em&gt;in this area&lt;/em&gt;. Set default route to any routers with level 2 capability you know.&#xA;For level 2: Import all routes from level 1 routers you know, flood to all level 2 neighbors &lt;em&gt;in any area&lt;/em&gt;. &#xA;(Please note that you need routers that are both level 1 and 2 to make the translations)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every router floods any packets they receive to their neighbors according to those two rules. The information in these packets are in the format Type,Length,Value (TLV). Using TLV's means the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you want to add a new protocol, say IPv6, you just define a new TLV.&lt;/li&gt;&#xA;&lt;li&gt;If one of the routers doesn't know the Type, it can skip this value (by  just looking Length ahead in the packet) and still work as expected.&lt;/li&gt;&#xA;&lt;li&gt;If one router doesn't know about this Type, it can still forward on the information to other routers.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;ISIS, just like OSPF, runs a Dijkstra Algorithm to find the shortest path. All information for this algorithm is contained in the TLV's. L2 Communication with neighbors is done in two ways:&#xA;-When connected to a shared segment, use the Layer 2 protocol of that segment to communicate. This is done to be able to traverse switches that might not be able to speak the OSI layer 2 protocol CLNS.&#xA;-When connected to a point to point network, communication on Layer 2 is CLNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This doesn't mean that there is no L3 communication. ISIS routers still need a layer 3 address. Since we are talking OSI, and not IP, the address is slightly different. In this case, the address is called a Network Entity Title (NET), which is one address for the entire system (so not one per interface). The NET has many forms, but for most ISIS adjacencies, works as follows: &lt;code&gt;49.&amp;lt;4 char area&amp;gt;.&amp;lt;12 char system identifier&amp;gt;.00&lt;/code&gt;. It doesn't really matter what you use as identifier, but say we have router 192.0.2.5 in area 52, we could make the NET 49.0052.1920.0000.2005.00 Since the addresses are in HEX you prefer 49.0052.0000.B00B.0000.00 (The addresses are hexadecimal).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*) There are other levels in OSI routing, but those aren't significant for the current operation of ISIS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A short illustration of routing &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                       &amp;lt;-----+192.168.1.0/24         &amp;lt;-----+192.168.1.0/24                                     &#xA;      Default route +------&amp;gt;           192.168.2.0/24+-----&amp;gt;         192.168.2.0/24+-----&amp;gt;      &amp;lt;------+  Default route        &#xA;&#xA;              +-------------+          +-------------------+         +-------------------+      +---------------+              &#xA;              |             |          |                   |         |                   |      |               |              &#xA;192.168.1.0/24| L1 router   | L1       |   L1/L2 router    |   L2    |   L1/L2 router    |  L1  |   L1 router   |192.168.2.0/24&#xA;              |   Area 1    +----------+      Area 1       +---------+      Area 2       +------+     Area 2    |              &#xA;              |             |          |                   |         |                   |      |               |              &#xA;              +-------------+          +-------------------+         +-------------------+      +---------------+              &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="220" LastActivityDate="2014-08-18T09:57:36.500" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10497" PostTypeId="1" AcceptedAnswerId="10499" CreationDate="2014-08-18T11:44:14.050" Score="2" ViewCount="4727" Body="&lt;p&gt;Can someone gave some hints on how to enable logging on IPSec tunnel on ASA ? I have typical scenario S2S IPSec and i like to monitor when it goes down and other information. But can't find a way to do this.&lt;/p&gt;&#xA;" OwnerUserId="8017" LastEditorUserId="1291" LastEditDate="2014-08-18T14:14:58.543" LastActivityDate="2014-08-18T14:14:58.543" Title="ASA logging IPSec" Tags="|cisco-asa|vpn|ipsec|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10499" PostTypeId="2" ParentId="10497" CreationDate="2014-08-18T14:11:07.140" Score="3" Body="&lt;h2&gt;General Logging&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To log IPSec events, you will want to run the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging enable&#xA;logging emblem ! (optional for Cisco's emblem format)&#xA;logging timestamp&#xA;logging buffered notifications &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some of these commands will already be on your ASA as you're sending your buffered log to an FTP server. I won't include the FTP commands due to this. Then you will want to look for the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logmsgs.html&quot; rel=&quot;nofollow&quot;&gt;specific codes&lt;/a&gt; you're interested in, in the log on the FTP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example IPSec L2L disconnect message:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;%ASA-4-113019: Group = 202.XXX.YYY.ZZZ, Username = 202.XXX.YYY.ZZZ, IP =&#xA;  202.XXX.YYY.ZZZ, Session disconnected. Session Type: LAN-to-LAN, Duration: 1d 1h:13m:46s, Bytes xmt: 372142455, Bytes rcv: 384146009,&#xA;  Reason: Lost Service&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Emailed Notifications&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First create your list of events you want to catch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Catch All IPSec List&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging list IPSec_Notifications level notification class vpn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Specific Event List&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging list IPSec_Notifications message 113019&#xA;! Replace XXXXXX with next code&#xA;logging list IPSec_Notifications message XXXXXX&#xA;! Repeat for the rest of the codes you're interested in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now setup the email settings.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging mail IPSec_Notifications&#xA;logging from-address your-from-address@your-domain.com&#xA;logging recipient-address who-should-receive-emails@your-domain.com level notifications&#xA;smtp-server X.X.X.X ! Replace with your SMTP server IP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Notes&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;All of the logging above is limited to notifications and higher level (i.e. level 5, 4, 3, 2 and 1). If you find a code of a lower level, you will need to replace &lt;code&gt;level notifications&lt;/code&gt; with &lt;code&gt;level informational&lt;/code&gt; or &lt;code&gt;level debugging&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The example event above (&lt;code&gt;ASA-4-113019&lt;/code&gt;) is &lt;code&gt;level warnings&lt;/code&gt; which you can see from the &lt;code&gt;ASA-4&lt;/code&gt; prefix on the event.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2014-08-18T14:11:07.140" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10504" PostTypeId="1" CreationDate="2014-08-18T20:38:29.213" Score="6" ViewCount="8790" Body="&lt;p&gt;Both attempt to measure the speed of a network. If the data rate is the thing that is commonly measured in Mbps and latency is the thing that is measured in milliseconds, what are their similarities and differences?&lt;/p&gt;&#xA;&lt;p&gt;I've tried searching google but the explanations I get are inconsistent. After searching &amp;quot;network latency&amp;quot; the first result is &lt;a href=&quot;http://en.wikipedia.org/wiki/Latency_%28engineering%29&quot; rel=&quot;nofollow noreferrer&quot;&gt;wikipedia&lt;/a&gt; but this definition pertains more to structural engineering than networks. The second result is &lt;a href=&quot;http://compnetworking.about.com/od/speedtests/a/network_latency.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;about.com&lt;/a&gt; and it states&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The term latency refers to any of several kinds of delays typically&#xA;incurred in the processing of network data.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So does this mean latency is not a well-defined term and can mean whatever a person wants it to?&lt;/p&gt;&#xA;&lt;p&gt;For example, when using &lt;code&gt;ping&lt;/code&gt; what does the latency actually measure (and out of curiosity why doesn't ping tell the data rate, in Mbps)?&lt;/p&gt;&#xA;&lt;p&gt;What is the perceived difference between latency and data rate, is it that latency only matters until the download (or uploaded) first part has been received?&lt;/p&gt;&#xA;" OwnerUserId="8025" LastEditorUserId="81932" LastEditDate="2022-05-06T13:52:26.637" LastActivityDate="2022-05-06T13:52:26.637" Title="What is the difference between data rate and latency?" Tags="|latency|terminology|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="10506" PostTypeId="2" ParentId="10504" CreationDate="2014-08-18T21:15:41.407" Score="12" Body="&lt;p&gt;&lt;strong&gt;Latency&lt;/strong&gt; is the amount of time it takes a packet of data to leave your computer and receive a response back from the end point. That is why this is measure in time. This is key for time sensitive applications like VoIP and video conferencing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bandwidth/data rate&lt;/strong&gt; is the amount of data (bits) you can upload or download in a given time (seconds). This is key for downloads and uploads (i.e. video streaming for Hulu, Netflix, etc). It is also important in video conferencing as you're sending/receiving a lot of video (bandwidth) and the audio portion needs to be in near real time (latency).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Ping&lt;/strong&gt; is sending packets using ICMP and measuring the time it takes until you receive an echo-reply from the end point. It is not sending a lot of data and would not give any accurate information regarding bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like &lt;a href=&quot;http://iperf.sourceforge.net&quot;&gt;iperf&lt;/a&gt; may be used to measure bandwidth by sending a lot of data to the end point which also would be running perf.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can have high latency (slow round trip time for packets) but still have a lot of bandwidth. Satellite service is one example.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2014-08-18T21:15:41.407" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10509" PostTypeId="1" CreationDate="2014-08-18T21:52:31.317" Score="4" ViewCount="7343" Body="&lt;p&gt;We have a SonicWALL NSA 3500, x4 has 2 VLAN interfaces so x4:v300 and x4:v301. Each VLAN has an IP address: v300 is &lt;code&gt;192.168.100.1&lt;/code&gt;, and v301 is &lt;code&gt;192.168.101.1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then have x4 connected to a layer-2-only switch, configured with ports 1-12 v300 and 13-23 v301, and all 23 ports are tagged port 24, then port 24 is tagged for v300 and v301.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I added a firewall access rule to allow subnets on v300 to talk to v301, and vice versa, but all I can do is ping hosts on either subnet. Nothing else, like SSH or HTTP, works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any idea why?&lt;/p&gt;&#xA;" OwnerUserId="8029" LastEditorUserId="8499" LastEditDate="2016-03-18T03:20:46.683" LastActivityDate="2019-12-06T19:03:00.330" Title="SonicWALL routing and L2 VLANs" Tags="|routing|firewall|sonicwall|" AnswerCount="2" CommentCount="7" ClosedDate="2019-12-19T02:37:23.867" ContentLicense="CC BY-SA 3.0" />
  <row Id="10511" PostTypeId="2" ParentId="10504" CreationDate="2014-08-19T03:22:38.607" Score="1" Body="&lt;p&gt;Latency is the delay, it is measured in units of time.&#xA;Data rate is how much data can be sent per unit if time, it is not measured in data rate (per unit of time, normally a standard unit).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data rate can affect latency in the real world, whereas latency affects bandwidth, &quot;goodput&quot;, and I thiiink throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to simulate data rate affecting latency is by pinging with ever-increasing packet sizes (though this has more--I believe--to do with how ICMP is handled than data rate).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to show data rate affecting latency is to measure latency whilst conducting a speed/bandwidth test.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-08-19T03:22:38.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10512" PostTypeId="1" AcceptedAnswerId="10562" CreationDate="2014-08-19T08:28:10.210" Score="6" ViewCount="1951" Body="&lt;p&gt;A client app that registers through a PIX to a 3rd party SIP provider shows a 0:03:00 timeout.  The client automatically reregisters every 5 minutes and doesn't appear configurable.  After 3 minutes, the PIX deletes the REGISTER session as confirmed by &quot;debug sip&quot;. Any calls (i.e., INVITEs) placed outbound between the 3rd and 5th minutes fail until the app registers again.  This was confirmed by packet captures on both sides of firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only SIP timeout in the config matching this 0:03:00 was &lt;code&gt;sip-invite 0:03:00&lt;/code&gt;.  This timeout does not affect the REGISTER timeout when tested, and I see no other configurable timeouts to increase the timeout to be &gt; the 5 minutes of the app.  &lt;strong&gt;Is there another way to increase the timeout for REGISTERs or another way to address this timeout issue short of disabling SIP Inspection?&lt;/strong&gt;  I also don't see any custom SIP Inspection maps that could address this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;fw-oc2-3f-1# sh sip&#xA;Total: 1&#xA;&#xA;call-id 4e32993a6ee34d0eb0499c3615763973&#xA;    CSeq: REGISTER&#xA;From: sip:removed5085@phone.removed.com;86315e57cf92475e9f8f9a5ecd375254&#xA;To: sip:removed5085@phone.removed.com;&#xA;    state Call init, timeout 0:03:00 idle 0:01:45&#xA;        Transaction                    State                 Timeout  Idle&#xA;        Cseq 39763 REGISTER            Transaction Proceeding0:03:00  0:01:45&#xA;&#xA;fw-oc2-3f-1# sh run timeout&#xA;timeout xlate 1:00:00&#xA;timeout conn 0:30:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout uauth 0:05:00 absolute&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;PIX 7.2(2)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2014-08-22T09:16:47.243" LastActivityDate="2014-08-22T09:17:50.493" Title="How can the SIP timeout on a Cisco PIX be increased for the REGISTER transaction type?" Tags="|firewall|sip|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10515" PostTypeId="1" AcceptedAnswerId="12578" CreationDate="2014-08-19T12:30:49.500" Score="6" ViewCount="4057" Body="&lt;p&gt;With two Cisco ME3600 (or similar MPLS &amp;amp; VPLS capable devices) running recent code [15.3(3)S], is it possible to show the MAC addresses passing over a standard MPLS encapsulated xconnect?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the lab as an example I have configured an xconnect from an EVC on Switch1 to an SVI on Switch2 with Switch2 having an access port in the same VLAN (VLAN 1);&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch1:&#xA;interface gi0/18&#xA; switchport trunk allowed vlan none&#xA; switchport mode trunk&#xA; service instance 1 ethernet&#xA;  encapsulation untagged&#xA;  xconnect 1.0.0.2 123456 encapsulation mpls&#xA;&#xA;Switch2:&#xA;int gi0/18&#xA;switchport&#xA;switchport access vlan 1&#xA;&#xA;int vlan 1&#xA;xconnect 1.0.0.1 123456 encapsulation mpls&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything works fine. I have a test PC connected to each end of the pseudowire which can ping each other and the IP assigned to the SVI for VLAN 1 on Switch2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to see their MAC addresses on the switches so I can see what MACs are being carried over this pseudowire?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To the best of my knowledge this is only achievable when using VFIs on IOS-XR (haven't tested VFI on IOS), is that correct?&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2017-04-03T09:39:34.273" LastActivityDate="2017-04-03T09:39:34.273" Title="Cisco IOS: How to view MAC addresses on an Ethernet pseudowire" Tags="|cisco|mac-address|vpls|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10516" PostTypeId="1" CreationDate="2014-08-19T12:51:10.727" Score="-4" ViewCount="2239" Body="&lt;p&gt;As per my Knowledge MAC address is required to communicate two machines...and on layer 2 (Switch) can't understand IP (if i am right)....suppose we have 2 systems (Sys1 and Sys2) with 2 different IP network (ex. 10.0.0.1 &amp;amp; 172.16.0.1) directly connected with layer 2 switch.&#xA; No doubt there is no communication between sys1 and sys2. BUT WHY...?&#xA;If switch only read mac address of source and destination for communication then why systems of 2 different network not able to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what is the reason behind non communication...?&#xA;Are switches works on IPs also...?&#xA;in above example why not switch just read the MAC address of System and send packet to system 2...why in that case IPs are comes to play..?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for ur Replies.&lt;/p&gt;&#xA;" OwnerUserId="8039" LastEditorUserId="8499" LastEditDate="2019-01-12T02:25:35.580" LastActivityDate="2019-01-12T02:25:35.580" Title="IP Address and Layer 2" Tags="|ipv4|switching|mac-address|ip-address|layer2|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10517" PostTypeId="2" ParentId="10516" CreationDate="2014-08-19T13:17:50.190" Score="-4" Body="&lt;p&gt;Assume there are machines M1-172.31.1.10 and M2-10.10.1.10 connected in switch and trying to ping M2 from M1&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;when I put command &lt;strong&gt;&lt;em&gt;&quot;ping 10.10.1.10&quot;&lt;/em&gt;&lt;/strong&gt;&#xA;Output was &quot;unkoun Network/Undefined network&quot; cause the system have routing knowledge of 172.31.1.0/24 network not about 10.10.1.10 so we have to made routing table entry by adding command &lt;strong&gt;&lt;em&gt;&quot;route add -net 10.10.1.0/24 gw 172.31.1.10&quot;&lt;/em&gt;&lt;/strong&gt; which will tell IP and Data-link layer stack where to or on which port this packet need to be forward.&lt;/li&gt;&#xA;&lt;li&gt;Now Ping again &lt;strong&gt;&lt;em&gt;&quot;ping 10.10.1.10&quot;&lt;/em&gt;&lt;/strong&gt; This time error will be different &lt;strong&gt;&lt;em&gt;&quot;Destination Host Unreachable&quot;&lt;/em&gt;&lt;/strong&gt; we encouter this error because when we try to &lt;strong&gt;&lt;em&gt;ping first packet generated will be ARP&lt;/em&gt;&lt;/strong&gt; for IP adress to MAC adress maping. when ARP reply gets generated to broadcast packet from M2 machine its has no routing info where to route this packet so follow same procedure on M2&lt;/li&gt;&#xA;&lt;li&gt;On M2 do execute following command &lt;strong&gt;&lt;em&gt;&quot;route add -net 172.31.1.0/24 gw 10.10.1.10&quot;&lt;/em&gt;&lt;/strong&gt;.&#xA;Now try to ping from M1 to M2 I Hope You will be able to route the packet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8041" LastEditorUserId="13630" LastEditDate="2018-04-25T13:59:24.750" LastActivityDate="2018-04-25T13:59:24.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10521" PostTypeId="2" ParentId="10516" CreationDate="2014-08-19T15:15:18.623" Score="4" Body="&lt;p&gt;Rajan,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It depends what you mean by &quot;communicate.&quot;  The switch will forward packets based on MAC address only.  In that sense they will communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there are many other things that have to happen for the two devices to transfer data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sender needs to know the MAC address of sys2.  And when the receiver (sys2) replies, it also must know the MAC address of sys1. The devices will use the ARP protocol to learn MAC addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP will only work if each device knows which interface to use.  That in turn requires that there is information in the device route table for that subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the destination IP address has to match the IP of the receiver.  Otherwise the receiver will discard the packet.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-19T15:15:18.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10523" PostTypeId="1" AcceptedAnswerId="10580" CreationDate="2014-08-20T00:58:19.957" Score="5" ViewCount="755" Body="&lt;p&gt;I have a Cisco 3945E with two EtherSwitch modules (&lt;code&gt;gi 1/0&lt;/code&gt;, &lt;code&gt;gi 2/0&lt;/code&gt;) and a UCSE (&lt;code&gt;ucse 4/0&lt;/code&gt;) server installed in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The short of it is i'd like to trunk VLANs to the two EtherSwitch modules, and place the UCSE's IMC on a server VLAN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN 08 - SERVER: 10.2.8.1/24  - Trunked to EtherSwitches, untagged to UCSE 4/0.&#xA;VLAN 16 - VOICE:  10.2.16.1/24 - Trunked to EtherSwitches&#xA;VLAN 24 - DATA:   10.2.24.1/24 - Trunked to EtherSwitches&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm familiar with configuring a router on a stick, but totally lost as to how to assign the same broadcast domain (and IP address) to multiple interfaces on a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been able to use BVIs to span the broadcast domain to two of the router's ports, but UCSE is still giving me trouble:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;interface GigabitEthernet0/0.8&#xA; encapsulation dot1Q 8 native&#xA; bridge-group 8&#xA;interface ucse4/0&#xA; ip unnumbered BVI8&#xA; imc ip address 10.2.8.2 255.255.255.0 default-gateway 10.2.8.1 &#xA;interface BVI8&#xA; ip address 10.2.8.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a device on gi 0/0 with ip 10.2.8.3/24 and can ping it with no issues, but the IMC still cannot be reached.  I've tried creating host routes from 10.2.8.2 to bvi 8 and/or ucse 4/0 to no luck...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated!&lt;/p&gt;&#xA;" OwnerUserId="5595" LastEditorUserId="5595" LastEditDate="2014-08-20T01:43:08.660" LastActivityDate="2014-08-22T23:39:09.857" Title="Cisco Router Multiple Interfaces in the Same Broadcast Domain" Tags="|cisco|routing|layer3|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10525" PostTypeId="1" CreationDate="2014-08-20T04:34:47.960" Score="3" ViewCount="4746" Body="&lt;p&gt;I'm looking to see if it is possible to have one VLAN span multiple reth interfaces without needing to do intra-zone security policies (from-zone A to-zone A). The idea is that I have the SRX240 cluster connected to two switches via two separate reth interfaces (reth0 and reth1). I have a management VLAN (VLAN 10) and I would like the SRX to act as the gateway (192.168.2.1/26) via an RVI. The SRX would then be able to provide access to both RVIs configured on the switches (192.168.2.2/26 on switch A and 192.168.2.3/26 on switch B).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading Junipers documentation on ethernet-switching on SRX clusters I see that, &quot;&lt;em&gt;Layer3 routing from L2 ethernet-switching network via L3-interface Vlan.X in chassis cluster deployment is supported as of Junos OS 12.1X44-D20, 12.1X45-D10 and higher versions.&lt;/em&gt;&quot; which seems to be a promising idea but I am unable to find further documentation on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to see if it is at all possible to do via reth interfaces as using switch fabric will cause an outage defeating the purpose, to an extent, of having the cluster.&lt;/p&gt;&#xA;" OwnerUserId="3732" LastEditorUserId="775" LastEditDate="2014-08-20T10:26:43.173" LastActivityDate="2014-08-20T10:26:43.173" Title="Juniper SRX One VLAN Across Multiple reth Interfaces without Intra-zone Policy" Tags="|routing|vlan|juniper|switching|srx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10526" PostTypeId="2" ParentId="10525" CreationDate="2014-08-20T04:54:07.243" Score="2" Body="&lt;p&gt;Ethernet switching on Juniper SRX firewalls in Chassis Cluster is not done through reth interfaces, but by creating a &quot;switching fabric&quot; accross the cluster. In this switching fabric you can create vlans and RVI's as ususal, but this does require a sslight redesign of your configuration. You would need to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create an additional link between the nodes: swfab interface. This link carries the switching fabric traffic between the nodes, and is in addition to the control- and fabric-links between the nodes.&lt;/li&gt;&#xA;&lt;li&gt;Add vlans.&lt;/li&gt;&#xA;&lt;li&gt;Change your reth.X interfaces (redundant ethernet) to vlan.X interfaces (RVI).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Juniper explains this a lot better than I do, in KB21422 (&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB21422&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB21422&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2014-08-20T04:54:07.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10530" PostTypeId="1" CreationDate="2014-08-20T13:29:28.333" Score="4" ViewCount="83186" Body="&lt;p&gt;Would Ping from PC1 to PC2 work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No other L3 ports on these 2 devices and its forwarding table does not contain any entry apart from the one created due to configured interfaces. ARP table is empty.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+---------------+                     +----------------+&#xA;|               |                     |                |&#xA;|  PC1          |                     |    PC2         |&#xA;| 10.10.10.1/24 +---------------------+ 192.168.1.1/24 |&#xA;|               |                     |                |&#xA;|               |                     |                |&#xA;+---------------+                     +----------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8054" LastEditorUserId="8054" LastEditDate="2014-08-20T13:37:39.297" LastActivityDate="2021-01-26T10:06:38.613" Title="Ping between different subnet across a link" Tags="|routing|switching|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10531" PostTypeId="2" ParentId="10530" CreationDate="2014-08-20T13:52:58.093" Score="-1" Body="&lt;p&gt;Let us call PC1 port as &quot;p1&quot; and PC2 port as &quot;p2&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only Direct route would be present in the Forwarding table. Direct routes get created when an interface is configured with an IP address. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Forwarding Table of PC1: &#xA;================================= &#xA;Route (with Prefix)     Nexthop/Interface &#xA;10.10.10.0/24                 p1 &#xA;&#xA;Forwarding Table of PC2: &#xA;================================= &#xA;Route (with Prefix)     Nexthop/Interface &#xA;192.168.1.0/24                p2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you initiate ping from PC1 for &lt;code&gt;IP 192.168.1.1&lt;/code&gt;, &lt;code&gt;PC1&lt;/code&gt; would first try to find the nexthop for that &lt;code&gt;IP 192.168.1.1&lt;/code&gt;.&lt;br&gt;&#xA;It would do a Forwarding Table lookup against &lt;code&gt;IP 192.168.1.1&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For comparison against entry &lt;code&gt;10.10.10.0/24&lt;/code&gt;, the following steps would take place:&lt;br&gt;&#xA;1  &lt;code&gt;192.168.1.1&lt;/code&gt; AND &lt;code&gt;255.255.255.0&lt;/code&gt; = &lt;code&gt;192.168.1.0&lt;/code&gt;  (say &lt;code&gt;X&lt;/code&gt;)&lt;br&gt;&#xA;2  &lt;code&gt;X&lt;/code&gt; (&lt;code&gt;192.168.1.0&lt;/code&gt;) does not match &lt;code&gt;10.10.10.0&lt;/code&gt;; So Forwarding Table lookup would fail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since no L3 interface is found, &lt;code&gt;PC1&lt;/code&gt; would not send out any packet at all.&lt;br&gt;&#xA;The PING utility should typically show an error message(like &lt;code&gt;No route to host&lt;/code&gt;) to the user as mentioned by YLearn. &lt;/p&gt;&#xA;" OwnerUserId="4319" LastEditorUserId="4319" LastEditDate="2014-08-20T14:40:25.293" LastActivityDate="2014-08-20T14:40:25.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10532" PostTypeId="2" ParentId="10530" CreationDate="2014-08-20T14:28:41.540" Score="3" Body="&lt;p&gt;If there is no configured default route/gateway, then a ping will fail with a &quot;no route to host&quot; error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a little more detail, PC1 will compare the destination address to it's local subnet, which is calculated from the IP address and subnet mask.  Since the IP address for PC2 is outside the local subnet, it will go to the routing table to find the route it must use for PC2.  If there is no route, it will not send the traffic and return an error.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-08-20T14:28:41.540" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10533" PostTypeId="1" AcceptedAnswerId="10535" CreationDate="2014-08-20T14:38:10.617" Score="0" ViewCount="233" Body="&lt;p&gt;This is very basic but i need to ask as I have been asked to configure a VPN to our network the router i have to use is a Billion Bipac 7800DX, the server is windows server 2012 (domain, AD, DHCP, DNS) with a 192.168.n.n address. &#xA;Do i configure the VPN service on the server, if so i can find nowhere to enter the public IP of the router ? or do i configure the router with VPN settings and somewhere enter the IP of server, or do i need to do both ?? &lt;/p&gt;&#xA;" OwnerUserId="8055" LastActivityDate="2014-08-20T16:14:28.793" Title="VPN config - on the server on the router or on both ? basic but confused" Tags="|router|vpn|" AnswerCount="1" CommentCount="0" ClosedDate="2019-05-21T00:01:25.537" ContentLicense="CC BY-SA 3.0" />
  <row Id="10535" PostTypeId="2" ParentId="10533" CreationDate="2014-08-20T16:14:28.793" Score="0" Body="&lt;p&gt;You should configure VPN services on the server:&lt;br&gt;&#xA;&lt;a href=&quot;https://www.youtube.com/watch?v=9qbpxKRb-94&quot; rel=&quot;nofollow&quot;&gt;Help Install VPN Server&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the router, set the DMZ (should be in the firewall settings of the router) to the internal IP (192.168.x.x) of the server.&#xA;Now connect your VPN client to the WAN IP of your internet connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firewall in the router will forward all connections to the internal server IP.&lt;/p&gt;&#xA;" OwnerUserId="2693" LastActivityDate="2014-08-20T16:14:28.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10536" PostTypeId="1" AcceptedAnswerId="10538" CreationDate="2014-08-20T16:17:38.927" Score="2" ViewCount="5049" Body="&lt;p&gt;I'm trying to set up some simple routing rules for the following scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;XO LAN : 172.x.x.x&#xA;X1 WAN: 64.x.x.x&#xA;X2 WAN: 199.x.x.x&#xA;X3 SIP: 192.168.28.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X3 has a PBX 192.168.28.2 directly connected to it and I'm trying to route it to only use X2's WAN. Obviously I can ping the X3 Interface from .2 but no routing rules are set up for this and after trying a few, I thought I'd ask for help. It should be simple but I'm not seeing it. Any help is highly appreciated. &lt;/p&gt;&#xA;" OwnerUserId="8058" LastActivityDate="2014-08-20T16:38:55.087" Title="Sonicwall Two Wan Interfaces and Two LAN Interface on TZ100 - Routing Question" Tags="|routing|sonicwall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10537" PostTypeId="2" ParentId="10530" CreationDate="2014-08-20T16:26:34.793" Score="2" Body="&lt;p&gt;As stated, No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if both hosts are configured for &quot;proxy-arp&quot; -- aka. &lt;em&gt;the-entire-internet-is-on-this-ethernet-cable&lt;/em&gt; 0.0.0.0/0 pointed to the interface (not sure that's possible in windows) -- then it will work. &lt;em&gt;Or&lt;/em&gt;, both hosts can be told what additional subnets are on the wire with static routes. As a general &lt;em&gt;Best Practice&lt;/em&gt;, this sort of thing should be avoied.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-20T16:26:34.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10538" PostTypeId="2" ParentId="10536" CreationDate="2014-08-20T16:38:55.087" Score="3" Body="&lt;p&gt;Go to Network-&gt;Routing. Add a new Route Policy.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source = PBX (192.168.28.2) &lt;/li&gt;&#xA;&lt;li&gt;Destination = Any&lt;/li&gt;&#xA;&lt;li&gt;Service = Any (or the    specific services you want routed over X2)&lt;/li&gt;&#xA;&lt;li&gt;Gateway = X2&lt;/li&gt;&#xA;&lt;li&gt;Default Gateway Interface = X2&lt;/li&gt;&#xA;&lt;li&gt;Metric= something less than 20 (10?) so that    it preempts the other&#xA;route policies.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That should do it.  &lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2014-08-20T16:38:55.087" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10540" PostTypeId="2" ParentId="9592" CreationDate="2014-08-20T21:00:42.797" Score="1" Body="&lt;p&gt;Think of networks like the postal service. I send my letter address as&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Name&#xA;Street&#xA;Town/City&#xA;Country&#xA;Post code/Zip code&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also include&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Senders name &#xA;Street&#xA;Etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the IP address the logical route taken by the letter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mac address is the postal services method of delivering this letter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Senders house - Post box&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Post box - Source sorting office &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Local sorting office - Main sorting office &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Main Sorting office to - Destination sorting office&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Destination sorting office - Destination Home&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the concept of logical and physical addressing in networking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The logical is the source and destination only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The physical is how to deliver it.&lt;/p&gt;&#xA;" OwnerUserId="8063" LastActivityDate="2014-08-20T21:00:42.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10541" PostTypeId="2" ParentId="10437" CreationDate="2014-08-20T21:20:23.870" Score="4" Body="&lt;p&gt;Depending on what version of ProCurve you are running, you should be able to do &lt;code&gt;tagged all&lt;/code&gt; and &lt;code&gt;no tagged all&lt;/code&gt; to tag every port on the switch to that VLAN, but you will need to do this for each VLAN unfortunately.&lt;/p&gt;&#xA;" OwnerUserId="5595" LastActivityDate="2014-08-20T21:20:23.870" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10545" PostTypeId="2" ParentId="10530" CreationDate="2014-08-21T12:35:50.510" Score="7" Body="&lt;p&gt;No. It won't work&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's look at PC1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its IP address is 10.10.10.1, its netmask is /24 or 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that as far as it is concerned, IP addresses in the rage of 10.10.10.0 - 10.10.10.255 are in the same subnet. So for destinations with these addresses, it can use ARP to find their MAC address, and send them packets (actually, frames) directly. All other addresses are unreachable to him, since no gateway is defined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same is true about PC2, with the address range 192.168.1.1-192.168.1.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make the two PCs be able to ping each other without adding a router or changing the IPs, you'd need to change the network masks to 0. So PC1 will be 10.10.10.1/0 and PC2 will be 192.168.1.1/0, making the subnet range for both of them the same 0.0.0.0-255.255.255.255&lt;/p&gt;&#xA;" OwnerUserId="3905" LastActivityDate="2014-08-21T12:35:50.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10547" PostTypeId="1" AcceptedAnswerId="10549" CreationDate="2014-08-21T15:55:06.813" Score="5" ViewCount="1414" Body="&lt;p&gt;Suppose you have three groups of servers on the following VLANs and subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name         VLAN ID    Subnet&#xA;-----------------------------------&#xA;Production      3       10.0.0.0/24&#xA;Test           103      10.0.0.0/24&#xA;Lab            111      10.0.0.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Suppose also that &lt;code&gt;Production&lt;/code&gt; is connected to the internet with a Cisco ASA as its gateway at &lt;code&gt;10.0.0.1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of &lt;code&gt;Test&lt;/code&gt; and &lt;code&gt;Lab&lt;/code&gt; is to allow us to replicate as closely as possible the servers on the &lt;code&gt;Production&lt;/code&gt; network so that we can safely test changes to them without impacting production.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you naively replicate the servers on the &lt;code&gt;Production&lt;/code&gt; network and connect them to &lt;code&gt;Test&lt;/code&gt; then they retain their &lt;code&gt;10.0.0.0/24&lt;/code&gt; IP addresses as shown in the above table.  Now suppose I want to also provide a connection to the internet for the &lt;code&gt;Test&lt;/code&gt; network through the same Cisco ASA.  It seems like this would be a problem because the ASA would base its routing decisions on IP addresses of which there are now duplicates on different VLANs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This leaves me with the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there a way to provide internet access to multiple VLANs which incidentally have the same subnet behind a single ASA?&lt;/li&gt;&#xA;&lt;li&gt;If so, how is this acheived?  How would the ASA know to which VLAN to send a given packet if both VLANs have the same subnet?&lt;/li&gt;&#xA;&lt;li&gt;Is there a better way to provide internet connectivity to a test network containing servers with the same IP addresses as production?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2662" LastActivityDate="2014-08-21T16:05:49.800" Title="Multiple VLANs with same subnet behind single ASA" Tags="|routing|cisco-asa|vlan|subnet|testing|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10548" PostTypeId="1" CreationDate="2014-08-21T16:03:55.920" Score="4" ViewCount="1599" Body="&lt;p&gt;&lt;strong&gt;Background&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have Mitel IP phones. The phones use dhcp option 125 to get configuration information, and this tells them to use 802.11q tags for vlan id #5, with address range 192.168.16.0/24. Our computers connect to a pass-through port on the phones, and are on the default vlan (id 1), with IP address range 10.1.1.0/22. We use shared printers, where the Windows print server is also on vlan 1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a few workstations, when a user tries to print, the job will just sit there for hours and hours, often overnight. After it waits long enough, the job will complete. In the meantime, it blocks the print queue for anyone else who tries to print to that printer. If I plug the computer directly into the wall port, instead of the phone's passthrough port, jobs always complete immediately; removing the phone from the cable path always fixes the problem. Obviously, this is not a real solution for us. Users need their phones as much as they need to print, and vice versa, and running additional cables and switching isn't really an option, either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can confirm that both the PC and phones have valid addresses and correct vlan tagging when this issue occurs. It does not effect everyone, but I haven't been able to find a common thread for why a user will have this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone seen this before? Any ideas what's going on? Suggestions for how to fix the problem?&lt;/p&gt;&#xA;" OwnerUserId="1375" LastEditorUserId="1375" LastEditDate="2014-08-21T21:24:39.667" LastActivityDate="2018-06-03T20:10:36.860" Title="IP Phones causing printing issue" Tags="|vlan|voip|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="10549" PostTypeId="2" ParentId="10547" CreationDate="2014-08-21T16:05:49.800" Score="6" Body="&lt;p&gt;Depending on the ASA and license you have, you could use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_contexts.html#pgfId-1035807&quot; rel=&quot;noreferrer&quot;&gt;contexts&lt;/a&gt; which create virtual ASAs within the ASA. Each is independent of the other. This would also allow you to test ASA configs before putting them on production. Each vlan interface is assigned to a context. Packets coming in are &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/ha_contexts.html#pgfId-1124172&quot; rel=&quot;noreferrer&quot;&gt;classified&lt;/a&gt; (in your situation, via MAC of the vlan interface) and then sent to their respective context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option would be to have 3 routers, one per vlan, performing NAT to a central subnet that the ASA is on.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2014-08-21T16:05:49.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10550" PostTypeId="1" CreationDate="2014-08-21T17:00:04.283" Score="4" ViewCount="4325" Body="&lt;p&gt;I have an Adtran NetVanta 3448 and a Sonicwall NSA 3500 that at long last I have established a site-to-site IKE/IPSec VPN connection over. The tunnel shows as up from both ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Site A (SonicWall), I can contact Site B (Adtran). I can NOT Contact Site A from Site B. Here's a quick look at how I'm set up:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Site A - 10.0.0.0 / 255.255.0.0 (LAN) --&gt; X.X.131.90 (WAN)&lt;/li&gt;&#xA;&lt;li&gt;Site B - 10.10.0.0 / 255.255.0.0 (LAN) --&gt; X.X.58.218 (WAN)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Upon running a packet inspection from the SonicWall (Site A), it is showing that the packets from X.X.58.218 (Site B WAN) are being CONSUMED rather than FORWARDED.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help to point me in the right direction on what might be causing traffic to only flow one way?&lt;/p&gt;&#xA;" OwnerUserId="8076" LastEditorUserId="775" LastEditDate="2014-12-08T12:36:56.293" LastActivityDate="2015-03-08T14:22:51.690" Title="VPN Tunnel Only Passing Traffic One Way - Adtran to Sonicwall" Tags="|routing|vpn|sonicwall|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10552" PostTypeId="1" AcceptedAnswerId="10646" CreationDate="2014-08-21T18:46:19.533" Score="4" ViewCount="736" Body="&lt;p&gt;I have a connection that users complain is really slow at times.  My SNMP graphs from Observium don't show the bandwidth being fully used or high latency.  They show a lot of errors on the WAN port of the router though.  None of my other WAN connections show any errors on the WAN port via Observium.  The LAN ports on the router don't show any errors either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Picture of WAN port errors in the past month &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KdhkK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KdhkK.png&quot; alt=&quot;WAN Errors&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are the interface statistics on the uplink port to the cable modem.  The cable modem has been swapped out already without any improvement.  I've attempted various configurations with the duplex settings and none seemed to improve the situation.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  5 minute output rate 198000 bits/sec, 56 packets/sec&#xA; 157099395 packets input, 3610517494 bytes&#xA; Received 1 broadcasts, 76 runts, 0 giants, 655 throttles&#xA; 338 input errors, 0 CRC, 0 frame, 149 overrun, 189 ignored&#xA; 0 watchdog&#xA; 0 input packets with dribble condition detected&#xA; 274553466 packets output, 1939513782 bytes, 0 underruns&#xA; 0 output errors, 0 collisions, 4 interface resets&#xA; 0 unknown protocol drops&#xA; 0 babbles, 0 late collision, 0 deferred&#xA; 0 lost carrier, 0 no carrier&#xA; 0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;show mem stat&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)&#xA;Processor   83590CC4   186053436    37257760   148795676   144860192   139092136&#xA;      I/O    E700000    26214400     8448092    17766308    17753216    17734940&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sh ip nat trans&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Pro Inside global      Inside local       Outside local      Outside global&#xA;tcp MY IP:32971 10.0.2.104:32971 157.56.17.247:443 157.56.17.247:443&#xA;tcp MY IP:33834 10.0.2.104:33834 208.54.46.98:5061 208.54.46.98:5061&#xA;tcp MY IP:34931 10.0.2.104:34931 184.51.108.19:443 184.51.108.19:443&#xA;tcp MY IP:34932 10.0.2.104:34932 23.203.168.248:443 23.203.168.248:443&#xA;tcp MY IP:36366 10.0.2.104:36366 31.13.73.129:443  31.13.73.129:443&#xA;tcp MY IP:39199 10.0.2.104:39199 54.217.202.157:5223 54.217.202.157:5223&#xA;tcp MY IP:42646 10.0.2.104:42646 69.171.245.49:443 69.171.245.49:443&#xA;tcp MY IP:42736 10.0.2.104:42736 50.22.240.164:443 50.22.240.164:443&#xA;tcp MY IP:43689 10.0.2.104:43689 63.116.58.175:80  63.116.58.175:80&#xA;tcp MY IP:50866 10.0.2.104:50866 184.51.126.41:443 184.51.126.41:443&#xA;tcp MY IP:54009 10.0.2.104:54009 31.13.73.113:443  31.13.73.113:443&#xA;tcp MY IP:55067 10.0.2.104:55067 74.125.22.188:5228 74.125.22.188:5228&#xA;tcp MY IP:55569 10.0.2.104:55569 69.171.235.48:443 69.171.235.48:443&#xA;tcp MY IP:59083 10.0.2.104:59083 31.13.73.113:443  31.13.73.113:443&#xA;tcp MY IP:34734 10.0.2.105:34734 74.125.226.52:443 74.125.226.52:443&#xA;tcp MY IP:34790 10.0.2.105:34790 74.125.226.82:80  74.125.226.82:80&#xA;tcp MY IP:35504 10.0.2.105:35504 74.125.226.80:443 74.125.226.80:443&#xA;tcp MY IP:35578 10.0.2.105:35578 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:36974 10.0.2.105:36974 176.32.100.68:80  176.32.100.68:80&#xA;tcp MY IP:38267 10.0.2.105:38267 74.125.226.32:80  74.125.226.32:80&#xA;tcp MY IP:38559 10.0.2.105:38559 74.125.29.95:443  74.125.29.95:443&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;tcp MY IP:39506 10.0.2.105:39506 74.125.226.64:80  74.125.226.64:80&#xA;tcp MY IP:43789 10.0.2.105:43789 74.125.226.67:443 74.125.226.67:443&#xA;tcp MY IP:46489 10.0.2.105:46489 74.125.226.67:443 74.125.226.67:443&#xA;tcp MY IP:49855 10.0.2.105:49855 74.125.226.82:443 74.125.226.82:443&#xA;tcp MY IP:53860 10.0.2.105:53860 54.192.36.122:443 54.192.36.122:443&#xA;tcp MY IP:54184 10.0.2.105:54184 74.125.226.40:443 74.125.226.40:443&#xA;tcp MY IP:55252 10.0.2.105:55252 64.233.171.188:5228 64.233.171.188:5228&#xA;tcp MY IP:55530 10.0.2.105:55530 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:55530 10.0.2.105:55530 74.125.226.71:80  74.125.226.71:80&#xA;tcp MY IP:55753 10.0.2.105:55753 74.125.226.32:80  74.125.226.32:80&#xA;tcp MY IP:55942 10.0.2.105:55942 54.215.210.43:80  54.215.210.43:80&#xA;tcp MY IP:57670 10.0.2.105:57670 205.251.243.57:80 205.251.243.57:80&#xA;tcp MY IP:57700 10.0.2.105:57700 54.201.136.198:80 54.201.136.198:80&#xA;tcp MY IP:59269 10.0.2.105:59269 74.125.228.41:443 74.125.228.41:443&#xA;tcp MY IP:53292 10.0.2.108:53292 17.172.233.110:5223 17.172.233.110:5223&#xA;tcp MY IP:53293 10.0.2.108:53293 31.13.73.134:443  31.13.73.134:443&#xA;tcp MY IP:53294 10.0.2.108:53294 31.13.73.134:443  31.13.73.134:443&#xA;tcp MY IP:53305 10.0.2.108:53305 31.13.73.129:443  31.13.73.129:443&#xA;tcp MY IP:53306 10.0.2.108:53306 31.13.73.129:443  31.13.73.129:443&#xA;tcp MY IP:53307 10.0.2.108:53307 31.13.73.113:443  31.13.73.113:443&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;tcp MY IP:53308 10.0.2.108:53308 31.13.73.113:443  31.13.73.113:443&#xA;tcp MY IP:53328 10.0.2.108:53328 107.14.41.80:443  107.14.41.80:443&#xA;tcp MY IP:53329 10.0.2.108:53329 31.13.73.129:443  31.13.73.129:443&#xA;tcp MY IP:53330 10.0.2.108:53330 31.13.73.129:443  31.13.73.129:443&#xA;tcp MY IP:1975 10.0.2.113:1975  75.146.212.122:5721 75.146.212.122:5721&#xA;tcp MY IP:2225 10.0.2.113:2225  78.108.117.250:443 78.108.117.250:443&#xA;tcp MY IP:2226 10.0.2.113:2226  68.64.13.250:443   68.64.13.250:443&#xA;tcp MY IP:2227 10.0.2.113:2227  68.64.24.250:443   68.64.24.250:443&#xA;tcp MY IP:2228 10.0.2.113:2228  68.64.24.250:443   68.64.24.250:443&#xA;tcp MY IP:2229 10.0.2.113:2229  68.64.13.250:443   68.64.13.250:443&#xA;tcp MY IP:2230 10.0.2.113:2230  78.108.117.250:443 78.108.117.250:443&#xA;tcp MY IP:2231 10.0.2.113:2231  68.64.24.250:443   68.64.24.250:443&#xA;tcp MY IP:2232 10.0.2.113:2232  68.64.13.250:443   68.64.13.250:443&#xA;tcp MY IP:2233 10.0.2.113:2233  78.108.117.250:443 78.108.117.250:443&#xA;tcp MY IP:2234 10.0.2.113:2234  68.64.24.250:443   68.64.24.250:443&#xA;tcp MY IP:2235 10.0.2.113:2235  68.64.13.250:443   68.64.13.250:443&#xA;tcp MY IP:2236 10.0.2.113:2236  78.108.117.250:443 78.108.117.250:443&#xA;tcp MY IP:2237 10.0.2.113:2237  68.64.24.250:443   68.64.24.250:443&#xA;tcp MY IP:2238 10.0.2.113:2238  68.64.13.250:443   68.64.13.250:443&#xA;tcp MY IP:2239 10.0.2.113:2239  78.108.117.250:443 78.108.117.250:443&#xA;tcp MY IP:59995 10.0.2.114:59995 17.110.224.227:5223 17.110.224.227:5223&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;tcp MY IP:60290 10.0.2.114:60290 157.56.52.15:40001 157.56.52.15:40001&#xA;tcp MY IP:60292 10.0.2.114:60292 91.190.218.57:12350 91.190.218.57:12350&#xA;tcp MY IP:60300 10.0.2.114:60300 137.116.40.106:443 137.116.40.106:443&#xA;udp MY IP:33645 10.0.2.117:33645 111.221.74.22:40024 111.221.74.22:40024&#xA;udp MY IP:33645 10.0.2.117:33645 111.221.77.176:40011 111.221.77.176:40011&#xA;udp MY IP:33645 10.0.2.117:33645 157.55.235.150:40024 157.55.235.150:40024&#xA;udp MY IP:33645 10.0.2.117:33645 157.55.235.176:40006 157.55.235.176:40006&#xA;udp MY IP:33645 10.0.2.117:33645 157.56.52.22:40024 157.56.52.22:40024&#xA;udp MY IP:33645 10.0.2.117:33645 213.199.179.145:40004 213.199.179.145:40004&#xA;tcp MY IP:51846 10.0.2.117:51846 17.172.233.95:5223 17.172.233.95:5223&#xA;tcp MY IP:51847 10.0.2.117:51847 157.55.130.161:80 157.55.130.161:80&#xA;tcp MY IP:33190 10.0.2.148:33190 184.51.126.8:443  184.51.126.8:443&#xA;tcp MY IP:34585 10.0.2.148:34585 31.13.73.145:443  31.13.73.145:443&#xA;tcp MY IP:35229 10.0.2.148:35229 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:35895 10.0.2.148:35895 184.28.17.235:443 184.28.17.235:443&#xA;tcp MY IP:37401 10.0.2.148:37401 173.252.103.16:443 173.252.103.16:443&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;tcp MY IP:37809 10.0.2.148:37809 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:41132 10.0.2.148:41132 31.13.71.23:443   31.13.71.23:443&#xA;tcp MY IP:41428 10.0.2.148:41428 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:41893 10.0.2.148:41893 31.13.73.145:443  31.13.73.145:443&#xA;tcp MY IP:42088 10.0.2.148:42088 31.13.73.145:443  31.13.73.145:443&#xA;tcp MY IP:43062 10.0.2.148:43062 184.51.126.8:443  184.51.126.8:443&#xA;tcp MY IP:45688 10.0.2.148:45688 107.14.41.202:80  107.14.41.202:80&#xA;tcp MY IP:45738 10.0.2.148:45738 107.14.41.202:80  107.14.41.202:80&#xA;tcp MY IP:46457 10.0.2.148:46457 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:46730 10.0.2.148:46730 184.51.126.41:443 184.51.126.41:443&#xA;tcp MY IP:47424 10.0.2.148:47424 31.13.71.7:80     31.13.71.7:80&#xA;tcp MY IP:47840 10.0.2.148:47840 107.14.41.163:443 107.14.41.163:443&#xA;tcp MY IP:48932 10.0.2.148:48932 64.233.171.188:5228 64.233.171.188:5228&#xA;tcp MY IP:50549 10.0.2.148:50549 74.125.226.66:443 74.125.226.66:443&#xA;tcp MY IP:51863 10.0.2.148:51863 31.13.71.7:443    31.13.71.7:443&#xA;tcp MY IP:52322 10.0.2.148:52322 31.13.73.145:443  31.13.73.145:443&#xA;tcp MY IP:53313 10.0.2.148:53313 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:53419 10.0.2.148:53419 31.13.73.150:443  31.13.73.150:443&#xA;tcp MY IP:53451 10.0.2.148:53451 31.13.71.7:443    31.13.71.7:443&#xA;tcp MY IP:53583 10.0.2.148:53583 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:54490 10.0.2.148:54490 173.252.102.16:443 173.252.102.16:443&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;tcp MY IP:55095 10.0.2.148:55095 31.13.71.7:80     31.13.71.7:80&#xA;tcp MY IP:57577 10.0.2.148:57577 184.51.126.179:443 184.51.126.179:443&#xA;tcp MY IP:57856 10.0.2.148:57856 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:50197 10.0.2.149:50197 134.170.0.199:443 134.170.0.199:443&#xA;tcp MY IP:50200 10.0.2.149:50200 184.51.126.106:80 184.51.126.106:80&#xA;tcp MY IP:50209 10.0.2.149:50209 134.170.0.199:443 134.170.0.199:443&#xA;tcp MY IP:50220 10.0.2.149:50220 134.170.0.199:443 134.170.0.199:443&#xA;tcp MY IP:3520 10.0.2.154:3520  78.108.119.250:443 78.108.119.250:443&#xA;tcp MY IP:3521 10.0.2.154:3521  216.219.116.244:443 216.219.116.244:443&#xA;tcp MY IP:3523 10.0.2.154:3523  78.108.119.250:443 78.108.119.250:443&#xA;tcp MY IP:3525 10.0.2.154:3525  78.108.119.250:443 78.108.119.250:443&#xA;tcp MY IP:3527 10.0.2.154:3527  78.108.119.250:443 78.108.119.250:443&#xA;tcp MY IP:3529 10.0.2.154:3529  78.108.119.250:443 78.108.119.250:443&#xA;tcp MY IP:41043 10.0.2.158:41043 134.170.25.33:443 134.170.25.33:443&#xA;tcp MY IP:54026 10.0.2.179:54026 75.146.212.122:5721 75.146.212.122:5721&#xA;tcp MY IP:62736 10.0.2.179:62736 216.219.117.244:443 216.219.117.244:443&#xA;tcp MY IP:54265 10.0.2.183:54265 75.146.212.122:5721 75.146.212.122:5721&#xA;tcp MY IP:58413 10.0.2.183:58413 202.173.28.250:443 202.173.28.250:443&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;tcp MY IP:58414 10.0.2.183:58414 54.249.66.39:443  54.249.66.39:443&#xA;tcp MY IP:58415 10.0.2.183:58415 216.219.117.244:443 216.219.117.244:443&#xA;tcp MY IP:58416 10.0.2.183:58416 54.249.66.39:443  54.249.66.39:443&#xA;tcp MY IP:58417 10.0.2.183:58417 202.173.28.250:443 202.173.28.250:443&#xA;tcp MY IP:58418 10.0.2.183:58418 54.249.66.39:443  54.249.66.39:443&#xA;tcp MY IP:58419 10.0.2.183:58419 202.173.28.250:443 202.173.28.250:443&#xA;tcp MY IP:58420 10.0.2.183:58420 54.249.66.39:443  54.249.66.39:443&#xA;tcp MY IP:58421 10.0.2.183:58421 202.173.28.250:443 202.173.28.250:443&#xA;tcp MY IP:58422 10.0.2.183:58422 54.249.66.39:443  54.249.66.39:443&#xA;tcp MY IP:58423 10.0.2.183:58423 202.173.28.250:443 202.173.28.250:443&#xA;tcp MY IP:58424 10.0.2.183:58424 216.219.117.244:443 216.219.117.244:443&#xA;tcp MY IP:59037 10.0.2.183:59037 64.94.18.140:443  64.94.18.140:443&#xA;tcp MY IP:34308 10.0.2.191:34308 124.170.204.20:33090 124.170.204.20:33090&#xA;tcp MY IP:35600 10.0.2.191:35600 89.212.17.133:16881 89.212.17.133:16881&#xA;tcp MY IP:37958 10.0.2.191:37958 173.252.102.16:443 173.252.102.16:443&#xA;tcp MY IP:41931 10.0.2.191:41931 74.125.22.95:443  74.125.22.95:443&#xA;tcp MY IP:43135 10.0.2.191:43135 74.125.226.50:443 74.125.226.50:443&#xA;tcp MY IP:45848 10.0.2.191:45848 112.196.138.40:30412 112.196.138.40:30412&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;tcp MY IP:49857 10.0.2.191:49857 39.54.206.182:41822 39.54.206.182:41822&#xA;tcp MY IP:54963 10.0.2.191:54963 74.125.226.40:80  74.125.226.40:80&#xA;tcp MY IP:55121 10.0.2.191:55121 98.23.93.16:27697 98.23.93.16:27697&#xA;tcp MY IP:59098 10.0.2.191:59098 74.125.22.188:5228 74.125.22.188:5228&#xA;tcp MY IP:59654 10.0.2.191:59654 74.125.226.52:443 74.125.226.52:443&#xA;tcp MY IP:59712 10.0.2.191:59712 69.245.6.109:37498 69.245.6.109:37498&#xA;tcp MY IP:59015 10.0.2.192:59015 216.115.208.199:8200 216.115.208.199:8200&#xA;tcp MY IP:49821 10.0.2.201:49821 173.252.102.16:443 173.252.102.16:443&#xA;tcp MY IP:55018 10.0.2.202:55018 17.151.226.32:443 17.151.226.32:443&#xA;udp MY IP:3150 10.0.2.217:3150  108.168.212.234:5060 108.168.212.234:5060&#xA;tcp MY IP:33998 10.0.2.234:33998 69.171.248.65:443 69.171.248.65:443&#xA;tcp MY IP:34309 10.0.2.234:34309 74.125.226.46:443 74.125.226.46:443&#xA;tcp MY IP:35985 10.0.2.234:35985 216.115.110.118:443 216.115.110.118:443&#xA;tcp MY IP:37960 10.0.2.234:37960 74.125.226.50:443 74.125.226.50:443&#xA;tcp MY IP:37961 10.0.2.234:37961 74.125.226.50:443 74.125.226.50:443&#xA;tcp MY IP:41525 10.0.2.234:41525 64.233.171.188:5228 64.233.171.188:5228&#xA;tcp MY IP:45184 10.0.2.234:45184 31.13.73.97:443   31.13.73.97:443&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;tcp MY IP:50237 10.0.2.234:50237 176.32.99.133:443 176.32.99.133:443&#xA;tcp MY IP:52159 10.0.2.234:52159 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:52171 10.0.2.234:52171 74.125.29.95:443  74.125.29.95:443&#xA;tcp MY IP:53343 10.0.2.234:53343 74.125.226.39:443 74.125.226.39:443&#xA;tcp MY IP:55318 10.0.2.234:55318 74.125.226.9:443  74.125.226.9:443&#xA;tcp MY IP:57411 10.0.2.234:57411 66.196.116.132:8996 66.196.116.132:8996&#xA;tcp MY IP:58455 10.0.2.234:58455 31.13.73.129:443  31.13.73.129:443&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sh run&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 8041 bytes&#xA;!&#xA;version 15.0&#xA;no service pad&#xA;service tcp-keepalives-in&#xA;service tcp-keepalives-out&#xA;service timestamps debug datetime msec localtime show-timezone&#xA;service timestamps log datetime msec localtime show-timezone&#xA;service password-encryption&#xA;service sequence-numbers&#xA;!&#xA;hostname XXXXX&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;no logging on&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login default local&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;memory-size iomem 10&#xA;clock timezone PCTime -5&#xA;clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00&#xA;!&#xA;crypto pki trustpoint TP-self-signed-3973140985&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-3973140985&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-3973140985&#xA;!&#xA;!&#xA;crypto pki certificate chain TP-self-signed-3973140985&#xA; certificate self-signed 01&#xA; XXXXXXXXXXXXXXX&#xA;    quit&#xA;no ip source-route&#xA;!&#xA;!&#xA;ip dhcp excluded-address 10.0.2.1 10.0.2.100&#xA;!&#xA;ip dhcp pool ccp-pool&#xA;   network 10.0.2.0 255.255.255.0&#xA;default-router 10.0.2.13 &#xA;   dns-server 10.0.5.44 8.8.8.8 &#xA;   lease 8&#xA;!&#xA;!&#xA;ip cef&#xA;ip inspect log drop-pkt&#xA;no ip bootp server&#xA;no ip domain lookup&#xA;ip domain name company.com&#xA;ip name-server 10.0.5.44&#xA;!&#xA;!&#xA;license udi pid CISCO861-K9 sn FTX151603YG&#xA;!&#xA;!&#xA;username admin privilege 15 secret 5 XXXXXXXXXXXXXXXX&#xA;!&#xA;!&#xA;ip tcp synwait-time 10&#xA;!&#xA;class-map type inspect match-all icmp&#xA; match access-group name icmp&#xA;class-map type inspect match-any ccp-cls-insp-traffic&#xA; match protocol dns&#xA; match protocol ftp&#xA; match protocol rtsp&#xA; match protocol sql-net&#xA; match protocol tftp&#xA; match protocol tcp&#xA; match protocol udp&#xA; match protocol icmp&#xA;class-map type inspect match-all ccp-insp-traffic&#xA; match class-map ccp-cls-insp-traffic&#xA;class-map type inspect match-any ccp-cls-icmp-access&#xA; match protocol icmp&#xA; match protocol tcp&#xA; match protocol udp&#xA;class-map type inspect match-all out_in&#xA; match access-group 115&#xA;class-map type inspect match-all icmp_test&#xA; match protocol icmp&#xA;class-map type inspect match-all REMOTE_ACCESS&#xA; match access-group name REMOTE_ACCESS&#xA;class-map type inspect match-all ccp-invalid-src&#xA; match access-group 100&#xA;class-map type inspect match-all ccp-icmp-access&#xA; match class-map ccp-cls-icmp-access&#xA;class-map type inspect match-any ccp&#xA;class-map type inspect match-all ccp-protocol-http&#xA;!&#xA;!&#xA;policy-map type inspect ccp-permit-icmpreply&#xA; class type inspect ccp-icmp-access&#xA;  inspect &#xA; class class-default&#xA;  pass&#xA;policy-map type inspect icmp&#xA; class type inspect icmp&#xA;  inspect &#xA;policy-map type inspect ccp-inspect&#xA; class type inspect ccp-invalid-src&#xA;  drop log&#xA; class type inspect ccp-protocol-http&#xA;  inspect &#xA; class type inspect ccp-insp-traffic&#xA;  inspect &#xA; class type inspect icmp_test&#xA; inspect &#xA; class class-default&#xA;  drop&#xA;policy-map type inspect out_in&#xA; class type inspect out_in&#xA;  inspect &#xA; class class-default&#xA;  drop&#xA;policy-map type inspect ccp-permit&#xA; class type inspect REMOTE_ACCESS&#xA;  inspect &#xA; class class-default&#xA;  drop&#xA;!&#xA;zone security out-zone&#xA;zone security in-zone&#xA;zone-pair security ccp-zp-in-out source in-zone destination out-zone&#xA; service-policy type inspect ccp-inspect&#xA;zone-pair security ccp-zp-self-out source self destination out-zone&#xA;zone-pair security ccp-zp-out-self source out-zone destination self&#xA;zone-pair security ccp-zp-out-in source out-zone destination in-zone&#xA; service-policy type inspect out_in&#xA;! &#xA;!&#xA;crypto isakmp policy 10&#xA; hash md5&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key XXXXXXXXXX address VPN END POINT IP&#xA;!&#xA;!&#xA;crypto ipsec transform-set myset esp-3des esp-md5-hmac &#xA;!&#xA;crypto map mymap 10 ipsec-isakmp &#xA; set peer VPN END POINT IP&#xA; set security-association lifetime seconds 36000&#xA; set transform-set myset &#xA; match address 102&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0&#xA;!&#xA;interface FastEthernet1&#xA;!&#xA;interface FastEthernet2&#xA;!&#xA;interface FastEthernet3&#xA;!&#xA;interface FastEthernet4&#xA; description $FW_OUTSIDE$$ES_WAN$&#xA; ip address MY IP 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip flow ingress&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; zone-member security out-zone&#xA; duplex full&#xA; speed 100&#xA; crypto map mymap&#xA;!&#xA;interface Vlan1&#xA; description $ETH-SW-LAUNCH$$INTF-INFO-HWIC 4ESW$$FW_INSIDE$&#xA; ip address 10.0.2.13 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip flow ingress&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; zone-member security in-zone&#xA; ip tcp adjust-mss 1452&#xA;!&#xA;ip forward-protocol nd&#xA;ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;!&#xA;ip nat inside source list no-nat interface FastEthernet4 overload&#xA;ip route 0.0.0.0 0.0.0.0 MY IP&#xA;!&#xA;ip access-list extended REMOTE_ACCESS&#xA; permit tcp any any eq 22&#xA; permit tcp any any eq 443&#xA; permit tcp any any eq telnet&#xA; permit icmp any any&#xA;ip access-list extended icmp&#xA; permit icmp any any&#xA;ip access-list extended no-nat&#xA; deny   ip 10.0.2.0 0.0.0.255 10.0.100.0 0.0.0.255&#xA; deny   ip 10.0.2.0 0.0.0.255 10.0.5.0 0.0.0.255&#xA; deny   ip any host MY IP&#xA; deny   ip host MY IP any&#xA; deny   ip any host 10.0.2.13&#xA; deny   ip host 10.0.2.13 any&#xA; deny   ip 10.0.2.0 0.0.0.255 10.0.0.0 0.0.255.255&#xA; permit ip any any&#xA;!&#xA;ip access-list log-update threshold 1&#xA;no logging trap&#xA;logging 10.0.2.153&#xA;access-list 23 permit 10.0.0.0 0.0.0.255&#xA;access-list 23 permit 10.10.10.0 0.0.0.7&#xA;access-list 100 remark CCP_ACL Category=128&#xA;access-list 100 permit ip host 255.255.255.255 any&#xA;access-list 100 permit ip 127.0.0.0 0.255.255.255 any&#xA;access-list 100 permit ip MY IP 10.0.0.3 any&#xA;access-list 101 deny   ip 10.0.2.0 0.0.0.255 10.0.1.0 0.0.0.255&#xA;access-list 101 deny   ip 10.0.2.0 0.0.0.255 10.0.0.0 0.0.0.255&#xA;access-list 101 deny   ip 10.0.2.0 0.0.0.255 10.0.4.0 0.0.0.255&#xA;access-list 101 deny   ip 10.0.2.0 0.0.0.255 10.0.5.0 0.0.0.255&#xA;access-list 101 deny   ip 10.0.2.0 0.0.0.255 192.168.1.0 0.0.0.255&#xA;access-list 101 deny   ip 10.0.2.0 0.0.0.255 192.168.20.0 0.0.0.255&#xA;access-list 101 remark CCP_ACL Category=2&#xA;access-list 101 permit ip 10.0.2.0 0.0.0.255 any&#xA;access-list 102 permit ip 10.0.2.0 0.0.0.255 10.0.0.0 0.0.255.255&#xA;access-list 102 permit ip 10.0.2.0 0.0.0.255 10.0.100.0 0.0.0.255&#xA;access-list 115 permit ip 10.0.2.0 0.0.0.255 10.0.0.0 0.0.255.255&#xA;access-list 115 permit ip 10.0.0.0 0.0.255.255 10.0.2.0 0.0.0.255&#xA;access-list 199 permit ip host 10.0.2.7 host 10.0.5.120&#xA;access-list 199 permit ip host 10.0.5.120 host 10.0.2.7&#xA;no cdp run&#xA;&#xA;snmp-server community public RO&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; no modem enable&#xA;line aux 0&#xA;line vty 0 4&#xA;transport input ssh&#xA;!&#xA;scheduler max-task-time 5000&#xA;scheduler allocate 4000 1000&#xA;scheduler interval 500&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2309" LastEditorUserId="3191" LastEditDate="2014-08-26T13:39:06.600" LastActivityDate="2014-08-29T19:48:59.783" Title="Multiple error types Cisco 861 router" Tags="|cisco|router|troubleshooting|wan|errors|" AnswerCount="2" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="10553" PostTypeId="1" AcceptedAnswerId="10556" CreationDate="2014-08-21T20:39:21.503" Score="4" ViewCount="665" Body="&lt;p&gt;Background: A client has been hitting the host limit for his license on a Cisco ASA 5505. The license has a max of 50 clients that can access the internet, the 51st connection gets dropped. He has been wanting to get rid of this firewall and this issue put him over the edge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The new firewall has come in and we want to get it up and running fairly quick, but the ASA manages a few site-to-site VPN tunnels. We don't have the info for those tunnels, and we expect it to be a pain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: Is it possible to setup the new firewall and have the ASA still manager these VPN connections until we have more info?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been running into wall after wall with this client trying other workarounds to buy more time.&lt;/p&gt;&#xA;" OwnerUserId="6000" LastEditorUserId="1291" LastEditDate="2014-08-22T15:01:40.020" LastActivityDate="2014-08-22T15:01:40.020" Title="Have Cisco ASA 5505 and want it to maintain site-to-site VPN connections" Tags="|cisco|cisco-asa|vpn|ipsec|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10554" PostTypeId="2" ParentId="6014" CreationDate="2014-08-21T23:26:56.123" Score="2" Body="&lt;p&gt;Let me give the or practical, real-life network engineering answer. Here's the relationship bandwidth and frequency: Higher bandwidth, higher frequency. Done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No, seriously, end of question and answer. You're done, move on to Layer 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't mean to be rude or smartass. Your question has delved way too far into the electrical engineering aspect of the Physical layer to be about what is known as network engineering. What you're asking is far more relevant to telecommunications, electrical engineering, or even computer science than network engineering in all but the strictest, most literal sense. It is also not relevant for anyone but extremely specialized personnel developing either the hardware or the protocols implemented by the hardware. I'd be quite surprised if most CCIE's could answer this question to the degree Mike Pennington did... and wouldn't be surprised at all if they didn't know enough to ask the original question with as much depth as you did!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me put it another way: If you're studying network engineering in the traditional sense, you have mastered Layer 1 far beyond (oh so far beyond) what is required, or even useful in a normal network engineering career. You're good, move on, there's far more to learn.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-08-21T23:26:56.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10556" PostTypeId="2" ParentId="10553" CreationDate="2014-08-22T02:49:07.470" Score="4" Body="&lt;p&gt;If you want to keep the ASA for the L2L tunnels you could assign a second public IP to the new firewall and not modify the ASA. Then set your default route to the new firewall and add routes for the L2L traffic to go to the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though the easiest way would be to recover the VPN config off the ASA and use a single device. You can view the pre shared keys with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;more system://running-config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/document/28501/how-recover-pre-shared-key-pix-asa&quot; rel=&quot;nofollow&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2014-08-22T02:49:07.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10560" PostTypeId="1" AcceptedAnswerId="10564" CreationDate="2014-08-22T06:51:21.537" Score="6" ViewCount="6646" Body="&lt;p&gt;I am setting up a highly redundant network and want to run my two ASA's in failover mode - each with a link to a router connected to two different ISP's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bPDRg.png&quot; alt=&quot;Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My two 2911's are running BGP to the ISPs, and the ASAs are configured in active/passive failover mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how do I configure the links from the ASAs to the routers? They are on 2 different subnets at the moment.&lt;/p&gt;&#xA;" OwnerUserId="8084" LastEditorUserId="775" LastEditDate="2014-08-22T07:15:39.277" LastActivityDate="2015-07-08T21:52:06.497" Title="Dual ASA5510 with dual ISP failover" Tags="|cisco|cisco-asa|redundancy|failover|dual-homed|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10562" PostTypeId="2" ParentId="10512" CreationDate="2014-08-22T09:17:50.493" Score="4" Body="&lt;p&gt;After further research, looks like this is &lt;strong&gt;Cisco bug CSCei29494&lt;/strong&gt; though I see no fixed release.  An ASA 5515-X running 9.1(2) shows the same 0:03:00 timeout, also apparently not configurable, though it doesn't have the same trouble with calls (e.g. INVITEs) when the REGISTER session expired and got deleted by the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Initial REGISTER shows &quot;expires&quot; found and set to 300 seconds, but PIX is setting to 180 (0:03:00).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SIP::Found CSeq 21141 REGISTER&#xA;...&#xA;SIP::Found Expires, 300 seconds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASA looks to allow INVITE and RTP without a REGISTER session as shown by these sip debug entries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SIP::Not updating database for Contact x.17.30.16/60422, registry database total 0&#xA;SIP::Non-session level connection addr x.17.30.16, media port 4000&#xA;Created SIP session for inside:x.17.30.16/55816 to outside:y.241.2.206/5060, 1 total&#xA;SIP::Adding early RTP conn y.241.2.206/* to x.17.30.16/4000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastActivityDate="2014-08-22T09:17:50.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10563" PostTypeId="1" CreationDate="2014-08-22T09:31:39.963" Score="3" ViewCount="4429" Body="&lt;p&gt;I have never used VLANs before, so I'd like confirmation that it will work as I think.&#xA;We have three Netgear GS724T and a fortinet router.&#xA;If I configure a port to be Untagged on VLAN 1 with a PVID set to 1, and Trunk on VLAN 2, will it accept and transmit untagged packet on VLAN 1 and accept and transmit Tagged packet on VLAN 2 ?&#xA;I would like to keep the current default configuration of every port untagged on VLAN 1 and start to add new VLAN as needed without breaking the Internet access or access to the ESX virtual machines. My first test would be to put the ESX Ethernet port Trunk on VLAN 2 to test with a single VM on VLAN 2, and the other VMs still untagged on VLAN 1.&lt;/p&gt;&#xA;" OwnerUserId="8085" LastActivityDate="2014-08-23T16:02:21.727" Title="VLAN membership - Tagged and Untagged" Tags="|vlan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10564" PostTypeId="2" ParentId="10560" CreationDate="2014-08-22T09:46:13.283" Score="7" Body="&lt;p&gt;Assuming a single context active/passive failover configuration with the ASAs connecting to the 2911s on unique subnets, you could trunk the links using two subinterfaces and vlan tagging.  But the &lt;strong&gt;hack&lt;/strong&gt; is to not have both subinterfaces active at the same time on a single ASA.  On the ASA on the left assuming it's active, the first subint would be alive and the second down.  After a failover event, the ASA on the right becomes active, and the first subint goes down and the second subint comes up.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Ideally, the ASAs share a common subnet with the LAN side of the&#xA;  2911s precluding this hack; a L2 switch can sit between the ASAs and provide connectivity&#xA;  from any ASA to any 2911.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Only the relevant subinterfaces' config shown.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ASA&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface GigabitEthernet0/0&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/0.10&#xA; vlan 10&#xA; nameif Outside-ISP1&#xA; security-level 0&#xA; ip address 1.1.1.254 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/0.11&#xA; vlan 11&#xA; nameif Outside-ISP2&#xA; security-level 0&#xA; ip address 2.1.1.254 255.255.255.0&#xA;&#xA;route Outside-ISP1 0.0.0.0 0.0.0.0 1.1.1.1 1&#xA;route Outside-ISP2 0.0.0.0 0.0.0.0 2.1.1.2 1&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2911-ISP1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface GigabitEthernet0/1&#xA; description LAN&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1.10&#xA; description LAN-ISP1&#xA; encapsulation dot1Q 10&#xA; ip vrf forwarding vpn&#xA; ip address 1.1.1.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1.11&#xA; description LAN-ISP2&#xA; encapsulation dot1Q 11&#xA; ip address 2.1.1.1 255.255.255.0&#xA; shutdown&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2911-ISP2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface GigabitEthernet0/1&#xA; description LAN&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1.10&#xA; description LAN-ISP1&#xA; encapsulation dot1Q 10&#xA; ip address 1.1.1.2 255.255.255.0&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/1.11&#xA; description LAN-ISP2&#xA; encapsulation dot1Q 11&#xA; ip address 2.1.1.2 255.255.255.0&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastActivityDate="2014-08-22T09:46:13.283" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10565" PostTypeId="2" ParentId="10563" CreationDate="2014-08-22T12:22:55.577" Score="5" Body="&lt;p&gt;Here's one way to think about it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A port with more than one VLAN associated with it is called a Trunk.&#xA;A Trunk can have exactly ONE untagged vlan (also called the Native VLAN), and one or more Tagged VLANS.&#xA;If you set a VLAN to be untagged on a port, there is no PVID associated with it; there is no PVID field in the Ethernet frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a trunk port is configured with VLAN1 untagged, and VLAN 2 tagged, then all devices that use untagged frames (PCs etc) will communicate on VLAN 1 and be blissfully unaware of any other VLANs.   If a device can tag frames with a PVID =2, then it can communicate on VLAN 2.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-22T12:22:55.577" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10566" PostTypeId="1" CreationDate="2014-08-22T12:28:36.630" Score="3" ViewCount="1186" Body="&lt;p&gt;OSI is a theoretical model, so why are its concepts used to describe real-world networks?&lt;/p&gt;&#xA;" OwnerUserId="8088" LastEditorUserId="3191" LastEditDate="2014-08-22T13:24:34.417" LastActivityDate="2014-09-10T19:56:17.993" Title="Why is the OSI model used to describe real-world networks?" Tags="|protocol-theory|osi|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10568" PostTypeId="1" AcceptedAnswerId="10569" CreationDate="2014-08-22T14:59:35.783" Score="0" ViewCount="176" Body="&lt;p&gt;Is it possible to convert an IP address in the format 8.34.208.0/20 to something in the format like this: xx.xx.xx.*?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes how can I do this? Is there some kind of online tool to do that?&lt;/p&gt;&#xA;" OwnerUserId="8093" LastActivityDate="2014-08-25T15:46:55.180" Title="Convert 8.34.208.0/20 to xx.xx.xx.*" Tags="|ipv4|subnet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10569" PostTypeId="2" ParentId="10568" CreationDate="2014-08-22T15:02:50.680" Score="5" Body="&lt;p&gt;Nope, since a /20 isn't on an 8-bit boundary this notation won't work, which immediately shows why it isn't useful to use wildcards to represent CIDR-blocks this way.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-08-22T15:02:50.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10571" PostTypeId="1" CreationDate="2014-08-22T18:28:02.483" Score="5" ViewCount="220" Body="&lt;p&gt;My edge router is connected to one transit ISP full route table and to IXP.&#xA;I would like to know what is the best way to protect the connection to IXP from becoming unwilling transit ISP.&#xA;For example if one of the IXP members will point static route to my next hop for network that is not one of my prefixes he will be able to reach it because the edge router has full routing table and that way I will become unwilling ISP.&#xA;I was finding about configuring an ACL on the ingress port from the IXP that permit traffic that only designated to my network prefixes.&#xA;Is there any another way to do it ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="8097" LastEditorUserId="630" LastEditDate="2014-08-24T09:09:41.697" LastActivityDate="2014-08-24T09:09:41.697" Title="Internet exchange point" Tags="|bgp|best-practices|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10572" PostTypeId="2" ParentId="10571" CreationDate="2014-08-22T19:34:49.027" Score="5" Body="&lt;p&gt;An ACL is a good idea to block this sort of behavior.  You should also filter out any source addresses not belonging to the IXP networks to prevent spoofing.  RFC 2827 talks about this as well, although their focus is on DoS attacks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't advertise the IXP networks to your ISP, then the return traffic will never come back to the IXP through you. So at worst, you would be part of an asymmetric path.  If there is a stateful firewall somewhere in the path, that should drop the traffic flow.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-22T19:34:49.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10573" PostTypeId="1" AcceptedAnswerId="10574" CreationDate="2014-08-22T19:58:59.197" Score="6" ViewCount="405" Body="&lt;p&gt;I've been scouring for documentation regarding byte pattern recognition on Cisco ASA's, and I've been unable to find anything. I've been tasking with converting a Snort rule into an ASA security object. The snort rule is a simple byte pattern. My question...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are Cisco ASA's capable of identifying byte patterns in TCP packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to identify a pattern such as the following in TCP packets passing through the ASA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6E; depth:1; 36 36 36 58 36 36 36; offset:3; depth:7;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate any assistance. Thank you!&lt;/p&gt;&#xA;" OwnerUserId="8099" LastActivityDate="2014-08-22T20:34:51.633" Title="Cisco ASA TCP packet inspection - byte pattern recognition" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10574" PostTypeId="2" ParentId="10573" CreationDate="2014-08-22T20:28:18.967" Score="2" Body="&lt;p&gt;Yes but you will need the IPS module on your ASA. Then you can &lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/ips_custom_sigs.html&quot; rel=&quot;nofollow&quot;&gt;define a custom signature&lt;/a&gt; with the info from your snort rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, if you don't have the IPS module and if using snort is an option, you could use &lt;a href=&quot;http://www.snortsam.net/index.html&quot; rel=&quot;nofollow&quot;&gt;Snortsam&lt;/a&gt; to trigger a block in your ASA config when snort detects a threat.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastEditorUserId="1291" LastEditDate="2014-08-22T20:34:51.633" LastActivityDate="2014-08-22T20:34:51.633" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10577" PostTypeId="1" CreationDate="2014-08-22T22:27:16.547" Score="3" ViewCount="849" Body="&lt;p&gt;I'm still a student so please forgive me for my ignorance.  I'm still learning.  So I got a T1 line to practice and learn with and they gave me 5 IPs to play with.  For example,8.8.8.0/29  8.8.8.[1-5].  Now I have my line going directly into a Sonicwall Pro 1080 set up with an IP of 8.8.8.1.  I want to add a Cisco 881 and give it the IP address of 8.8.8.2.  I'd like to do it without plugging into the 1080 and use NAT.  So I dropped a switch in front of my 1080 to run the lines in parallel, but once I plugged the 881 in, I lost all Internet access through my 1080.  Is this something that can be done? Is there a better way of doing this?  BTW, the switch I am using is a Buffalo BSL-PS-G2108M.  &lt;/p&gt;&#xA;" OwnerUserId="8103" LastActivityDate="2014-08-23T15:06:27.857" Title="How to utilize multiple IP addresses from IP pool given by ISP" Tags="|router|switch|nat|subnet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10578" PostTypeId="1" CreationDate="2014-08-22T22:36:19.893" Score="4" ViewCount="7728" Body="&lt;p&gt;In reference to: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/8141-calculate-bandwidth-snmp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/8141-calculate-bandwidth-snmp.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the input and output utilization. &#xA;for instance if my number of seconds is 60 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It says: Input utilization = ((ifInOctets * 8) * 100) / (60 * ifspeed)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What metric does it want for Ispeed? Megs? bytes? Gigs?&lt;/p&gt;&#xA;" OwnerUserId="8104" LastActivityDate="2014-08-23T02:23:39.923" Title="monitoring bandwidth with ifHCOutOctets / ifHCInOctets" Tags="|snmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10579" PostTypeId="2" ParentId="10577" CreationDate="2014-08-22T22:56:36.773" Score="0" Body="&lt;p&gt;That should work.  Try plugging a laptop using one of the static IPs into the switch.  I suspect something's up there.&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2014-08-22T22:56:36.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10580" PostTypeId="2" ParentId="10523" CreationDate="2014-08-22T23:39:09.857" Score="4" Body="&lt;p&gt;The configuration in the original post was close, but was missing a few key things:   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface ucse4/0&#xA;  ip unnumbered BVI8&#xA;  imc ip address 10.2.8.2 255.255.255.0 default-gateway 10.2.8.1 &#xA;  imc access-port shared-lom console&#xA;&#xA;ip route 10.2.8.2 255.255.255.255 ucse 4/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note the &lt;code&gt;imc access-port shared-lom console&lt;/code&gt;.  It was the only way I could manage to get the IMC address pingable.  I should also point out that by default, the BVI will not bring itself up unless there is another active port bridged to it.&lt;/p&gt;&#xA;" OwnerUserId="5595" LastActivityDate="2014-08-22T23:39:09.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10581" PostTypeId="1" CreationDate="2014-08-23T01:45:00.513" Score="2" ViewCount="993" Body="&lt;p&gt;I'm really new to Juniper, so I apologize if this is n00b question. I do, however, appreciate your guidance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I want to do: all traffic on &lt;code&gt;ge0.0.0&lt;/code&gt; and &lt;code&gt;ge0.0.1&lt;/code&gt; is to be redirected to &lt;code&gt;fe0.0.2-7&lt;/code&gt;, but I want to ensure that all traffic with the same MAC destination address is always sent to the same &lt;code&gt;fe&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an IBM Nortel (HSSM), I would use a layer-2, static forwarding database, but I can't find an equivalent for Juniper, at least on my old tinker test device. I've looked into defining a VLAN for each &lt;code&gt;fe&lt;/code&gt;, and then adding the MAC addresses to the VLAN (&lt;code&gt;set static vlan [vlan-name] mac [mac-address] next-hop [interface]&lt;/code&gt;), but it seems like there should be a more elegant way to address (har har) the issue. Thoughts?&lt;/p&gt;&#xA;" OwnerUserId="8107" LastEditorUserId="8499" LastEditDate="2016-04-02T21:27:25.067" LastActivityDate="2016-04-02T21:27:25.067" Title="Layer-2, static forwarding on a Juniper SRX?" Tags="|juniper|mac-address|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10582" PostTypeId="2" ParentId="10578" CreationDate="2014-08-23T02:23:39.923" Score="5" Body="&lt;p&gt;The unit for ifSpeed is bits per second.  This is in the description of the ifSpeed OID, down at the bottom of the link you supplied.&lt;/p&gt;&#xA;" OwnerUserId="8079" LastActivityDate="2014-08-23T02:23:39.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10584" PostTypeId="1" CreationDate="2014-08-23T07:09:42.240" Score="3" ViewCount="219" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/WR5K4.png&quot; alt=&quot;OSPF Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem Description&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am having an issue with LSA Type 3's, on R7 in the topology i have 4 loopback addresses&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Loopback1 is up, line protocol is up&#xA;Internet address is 192.168.100.1/28&#xA;Loopback2 is up, line protocol is up&#xA;Internet address is 192.168.100.17/28&#xA;Loopback3 is up, line protocol is up&#xA;Internet address is 192.168.100.33/28&#xA;Loopback4 is up, line protocol is up&#xA;Internet address is 192.168.100.49/29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I change the OSPF network type on all these links to : Network Type POINT_TO_POINT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On R7 under : router ospf 123, i have &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network 192.168.100.0 0.0.0.255 area 44&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on r6 i have the command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;area 44 range 192.168.100.0 255.255.255.0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R6's routing table &lt;/p&gt;&#xA;&#xA;&lt;p&gt;R6#show ip route | i 168.100&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   192.168.100.0/24 is variably subnetted, 5 subnets, 2 masks&#xA;   O       192.168.100.0/28 [110/11] via 192.168.1.129, 00:00:02, FastEthernet0/1&#xA;   O       192.168.100.0/24 is a summary, 00:00:02, Null0&#xA;   O       192.168.100.16/28 &#xA;   O       192.168.100.32/28 &#xA;   O       192.168.100.48/28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As expected, i can see my summary with Null0 and the subordinate routes - all ok here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but here is R5&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   R5#show ip route | i 168.100&#xA; 192.168.100.0/24 is variably subnetted, 5 subnets, 2 masks&#xA;   O IA    192.168.100.0/28 [110/21] via 192.168.1.2, 00:01:50, FastEthernet0/1&#xA;   O IA    192.168.100.0/24 [110/21] via 192.168.1.2, 00:02:36, FastEthernet0/1&#xA;   O IA    192.168.100.16/28 [110/21] via 192.168.1.2, 00:01:40, FastEthernet0/1&#xA;   O IA    192.168.100.32/28 [110/21] via 192.168.1.2, 00:01:30, FastEthernet0/1&#xA;   O IA    192.168.100.48/28 [110/21] via 192.168.1.2, 00:01:20, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is not meant to happen, i am only meant to see &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   O IA    192.168.100.0/24 [110/21] via 192.168.1.2, 00:02:36, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;its the same all the way along to r1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip route | i 168.100 &#xA;     192.168.100.0/24 is variably subnetted, 5 subnets, 2 masks&#xA;O IA    192.168.100.0/28 [110/61] via 10.1.1.2, 00:03:04, FastEthernet0/0&#xA;O IA    192.168.100.0/24 [110/61] via 10.1.1.2, 00:03:50, FastEthernet0/0&#xA;O IA    192.168.100.16/28 [110/61] via 10.1.1.2, 00:02:54, FastEthernet0/0&#xA;O IA    192.168.100.32/28 [110/61] via 10.1.1.2, 00:02:44, FastEthernet0/0&#xA;O IA    192.168.100.48/28 [110/61] via 10.1.1.2, 00:02:34, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason area 0 is where it is, i was practicing virtual links &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you can shed any light on why the subordinate rotes are being advertised i would be very grateful &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Andy&lt;/p&gt;&#xA;" OwnerUserId="8109" LastActivityDate="2014-08-23T11:29:06.540" Title="ospf range command - subordinate routes still being advertised" Tags="|ospf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10585" PostTypeId="2" ParentId="10584" CreationDate="2014-08-23T11:29:06.540" Score="2" Body="&lt;p&gt;Your topology violates OSPF rules.  All your areas must be adjacent to area 0.  Area 44 and 50 are not adjacent to area 0.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-23T11:29:06.540" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10587" PostTypeId="1" AcceptedAnswerId="10590" CreationDate="2014-08-23T14:25:32.053" Score="5" ViewCount="34380" Body="&lt;p&gt;I was reading about Round Trip Time (RTT) and then I came across this formula&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;EstimatedRTT = 0.9 * PreviousEstimatedRTT + 0.1 * Sample RTT&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What is the value of &lt;code&gt;PreviousEstimatedRTT&lt;/code&gt; when it is calculated for the very first time??Is it assumed to be 0 or any other value??&lt;/p&gt;&#xA;" OwnerUserId="7805" LastEditorUserId="189" LastEditDate="2014-08-23T19:40:56.353" LastActivityDate="2014-08-23T19:40:56.353" Title="Initial estimated round trip time in the RTT formula" Tags="|tcp|protocol-theory|latency|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10588" PostTypeId="2" ParentId="10577" CreationDate="2014-08-23T15:06:27.857" Score="3" Body="&lt;p&gt;On the SonicWall 1080 &amp;amp; the Cisco 881 are you using the same Default-gateway (the IP of the T1)?  In your example, 8.8.8.0/29... 8.8.8.1 would be the default gateway of the T1 provider.  So your sonicwall should be .2, 881 should be .3   (.2-.6 usable IPs)&#xA;You are correct that your topology/setup 'SHOULD' Work.  Although you can run into oversubscription issues on your T1 doing that, but is fine for learning/practice.&lt;/p&gt;&#xA;" OwnerUserId="3150" LastActivityDate="2014-08-23T15:06:27.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10589" PostTypeId="2" ParentId="10563" CreationDate="2014-08-23T16:02:21.727" Score="1" Body="&lt;p&gt;I don't know if I understood your question correctly, but if I did, you can't use both tagged and untagged packets at the same interface on end devices. It's either tagged or untagged, unless you have two (or more) interfaces at the same host. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is usually called a management interface. One interface with restrictive firewall rules and VLAN for host management and another for data. You don't change the configuration for this management network  for all of your hosts and then you don't lose access to yjt machine, no matter how unusual this or that requirement for the host. &lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-08-23T16:02:21.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10590" PostTypeId="2" ParentId="10587" CreationDate="2014-08-23T19:38:20.027" Score="4" Body="&lt;p&gt;According to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6298&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6928&lt;/a&gt;, the SRTT is only calculated with the formula&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;code&gt;SRTT &amp;lt;- (1 - alpha) * SRTT + alpha * R'&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;after two RTT measurements have been made. After the first measurement, SRTT is initilized to the value of this first measurement, ie. &lt;code&gt;SRTT &amp;lt;- R'&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;You were close, according to the RFC alpha &lt;code&gt;SHOULD&lt;/code&gt; be 1/8 (= 0.125).&lt;/p&gt;&#xA;&lt;p&gt;Note, in RFC's, &lt;code&gt;SHOULD&lt;/code&gt; means &lt;em&gt;&amp;quot;there may exist valid reasons in particular circumstances to ignore a particular item, but the full implications must be understood and carefully weighed before choosing a different course.&amp;quot;&lt;/em&gt; (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2119&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2119&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-08-23T19:38:20.027" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10591" PostTypeId="1" AcceptedAnswerId="10592" CreationDate="2014-08-23T21:54:38.617" Score="5" ViewCount="660" Body="&lt;p&gt;I'm really confused. I have a list of all the AS numbers and their &quot;description&quot;, which I got from MaxMind. I thought the ASN system was pretty straightforward, but let me show you my confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take AS30058 for example, belonging to FDC Servers: &lt;a href=&quot;http://bgp.he.net/AS30058&quot; rel=&quot;noreferrer&quot;&gt;http://bgp.he.net/AS30058&lt;/a&gt;. So you would assume that that is the complete list of IPs controlled by that company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now look at the huge AS1744, belonging to Congent Communications: &lt;a href=&quot;http://bgp.he.net/AS174#_prefixes&quot; rel=&quot;noreferrer&quot;&gt;http://bgp.he.net/AS174#_prefixes&lt;/a&gt; ... there are many many ranges defined there, with the description &quot;FDCservers.net&quot; there too, that were not part of AS30058. So we can assume that they belong to FDCservers.net too, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be the case that these ranges were handed back to the ISP/owner/whatever, and their info just has not been updated as they have not been re-used yet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that if you click on one of those IP ranges, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, can someone explain the reasoning behind this sort of thing? What is the point of that? Also, is there a way for me to find out all possible IP ranges that belong to a company like FDCservers.net, or some sort of whois query?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am just trying to get a better understanding of how all this works.&lt;/p&gt;&#xA;" OwnerUserId="8114" LastActivityDate="2014-08-23T22:21:40.403" Title="Autonomous System Number overlap confusion" Tags="|ipv4|isp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10592" PostTypeId="2" ParentId="10591" CreationDate="2014-08-23T22:21:40.403" Score="5" Body="&lt;p&gt;You need to think of the difference between IP Range &quot;Announcement&quot; vs Origin AS.  So from the perspective of what Hurricane Electrics AS6939 sees announced from its Peers.  If you look at the Whois Tab information you will see the &quot;Origin&quot; AS.&lt;br&gt;&#xA;To really  answer your question though, how do you find out Who really owns WHAT.  The arin whois lookup will tell you.  Check the link below for all of FDCServers AS30058&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://whois.arin.net/rest/org/FDCSE/nets&quot; rel=&quot;noreferrer&quot;&gt;http://whois.arin.net/rest/org/FDCSE/nets&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://whois.arin.net/rest/org/COGC/nets&quot; rel=&quot;noreferrer&quot;&gt;http://whois.arin.net/rest/org/COGC/nets&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3150" LastActivityDate="2014-08-23T22:21:40.403" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10593" PostTypeId="1" CreationDate="2014-08-24T02:10:09.453" Score="2" ViewCount="12307" Body="&lt;p&gt;I configured static route using &lt;strong&gt;Vyatta&lt;/strong&gt; like following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols static route 192.168.1.0/24 next-hop 10.100.0.204&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But a packet which destination is 192.168.1.10 is not routed to 10.100.0.204.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyatta@vyatta# traceroute 192.168.1.10&#xA;traceroute to 192.168.1.10 (192.168.1.10), 30 hops max, 60 byte packets&#xA; 1  * * *&#xA; 2  * * *&#xA; 3  * * *&#xA; 4  * * *&#xA; 5  * * *&#xA; 6  * * *&#xA; 7  * * *&#xA; 8  * * *&#xA; 9  * * *&#xA;10  * * *&#xA;11  * * *&#xA;12  * * *&#xA;13  * * *&#xA;14  * * *&#xA;15  * * *&#xA;16  * * *^C&#xA;[edit]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems that the routing table is correct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyatta@vyatta# ip route&#xA;default via 10.0.1.1 dev eth0  proto zebra&#xA;10.0.1.0/24 dev eth0  proto kernel  scope link  src 10.0.1.5&#xA;10.100.0.101 dev pptp1  proto kernel  scope link  src 10.255.254.0&#xA;10.100.0.102 dev pptp3  proto kernel  scope link  src 10.255.254.0&#xA;10.100.0.200 dev pptp0  proto kernel  scope link  src 10.255.254.0&#xA;10.100.0.204 dev pptp2  proto kernel  scope link  src 10.255.254.0&#xA;127.0.0.0/8 dev lo  proto kernel  scope link  src 127.0.0.1&#xA;192.168.1.0/24 via 10.100.0.204 dev pptp2  proto zebra&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Strangely, it works correctly if next-hop is set to 10.100.0.200:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;vyatta@vyatta# traceroute 192.168.1.10&#xA;traceroute to 192.168.1.10 (192.168.1.10), 30 hops max, 60 byte packets&#xA; 1  10.100.0.200 (10.100.0.200)  7.524 ms  7.368 ms  7.590 ms&#xA; 2  * * *&#xA; 3  * * *&#xA; 4  * * *&#xA; 5  * * *&#xA; 6  * * *&#xA; 7  *^C&#xA;[edit]&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please tell me where I misconfigured.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;My network architecture is following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/goGGC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running Vagrant on Mac OS X machine(#1).&#xA;Eventually I want to let Mac OS X(#3) access Vagrant VM(192.168.1.10) via VPN.&#xA;The VPN connection is no problem.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Current Vyatta configuration&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;VPN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyatta@vyatta# show vpn&#xA; pptp {&#xA;     remote-access {&#xA;         authentication {&#xA;             local-users {&#xA;                 ...&#xA;             }&#xA;             mode local&#xA;         }&#xA;         client-ip-pool {&#xA;             start 10.100.0.1&#xA;             stop 10.100.0.255&#xA;         }&#xA;         dns-servers {&#xA;             server-1 10.0.1.185&#xA;             server-2 10.0.1.162&#xA;         }&#xA;         outside-address 10.0.1.5&#xA;     }&#xA; }&#xA;[edit]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Routing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyatta@vyatta# show protocols&#xA; static {&#xA;     route 192.168.1.0/24 {&#xA;         next-hop 10.100.0.204 {&#xA;         }&#xA;     }&#xA; }&#xA;[edit]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Vagrant VM Network Configuration&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config.vm.network &quot;public_network&quot;, ip: &quot;192.168.1.10&quot;, netmask: &quot;255.255.255.0&quot;, bridge: &quot;en0: Ethernet&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Status&lt;/h3&gt;&#xA;&#xA;Vyatta&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyatta@vyatta# ip a&#xA;1: lo: &amp;lt;LOOPBACK,UP,LOWER_UP&amp;gt; mtu 16436 qdisc noqueue state UNKNOWN&#xA;    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00&#xA;    inet 127.0.0.1/8 scope host lo&#xA;    inet6 ::1/128 scope host&#xA;       valid_lft forever preferred_lft forever&#xA;2: eth0: &amp;lt;BROADCAST,MULTICAST,UP,LOWER_UP&amp;gt; mtu 1500 qdisc pfifo_fast state UP qlen 1000&#xA;    link/ether &amp;lt;MAC_ADDRESS&amp;gt; brd ff:ff:ff:ff:ff:ff&#xA;    inet 10.0.1.5/24 brd 10.0.1.255 scope global eth0&#xA;    inet6 ************* scope link&#xA;       valid_lft forever preferred_lft forever&#xA;837: pptp3: &amp;lt;POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP&amp;gt; mtu 1496 qdisc pfifo_fast state UNKNOWN qlen 100&#xA;    link/ppp&#xA;    inet 10.255.254.0 peer 10.100.0.102/32 scope global pptp3&#xA;899: pptp1: &amp;lt;POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP&amp;gt; mtu 1496 qdisc pfifo_fast state UNKNOWN qlen 100&#xA;    link/ppp&#xA;    inet 10.255.254.0 peer 10.100.0.101/32 scope global pptp1&#xA;904: pptp2: &amp;lt;POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP&amp;gt; mtu 1496 qdisc pfifo_fast state UNKNOWN qlen 100&#xA;    link/ppp&#xA;    inet 10.255.254.0 peer 10.100.0.204/32 scope global pptp2&#xA;907: pptp0: &amp;lt;POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP&amp;gt; mtu 1496 qdisc pfifo_fast state UNKNOWN qlen 100&#xA;    link/ppp&#xA;    inet 10.255.254.0 peer 10.100.0.200/32 scope global pptp0&#xA;[edit]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It can reach to Mac hosts but can't reach to Vagrant VM.&lt;/p&gt;&#xA;&#xA;Vagrant VM&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[vagrant@vagrant-ubuntu-precise-64:~][2014-08-24T04:59:29]&#xA;$ ip a&#xA;1: lo: &amp;lt;LOOPBACK,UP,LOWER_UP&amp;gt; mtu 65536 qdisc noqueue state UNKNOWN&#xA;    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00&#xA;    inet 127.0.0.1/8 scope host lo&#xA;    inet6 ::1/128 scope host&#xA;       valid_lft forever preferred_lft forever&#xA;2: eth0: &amp;lt;BROADCAST,MULTICAST,UP,LOWER_UP&amp;gt; mtu 1500 qdisc pfifo_fast state UP qlen 1000&#xA;    link/ether &amp;lt;MAC_ADDRESS&amp;gt; brd ff:ff:ff:ff:ff:ff&#xA;    inet 10.0.2.15/24 brd 10.0.2.255 scope global eth0&#xA;    inet6 ************ scope link&#xA;       valid_lft forever preferred_lft forever&#xA;3: eth1: &amp;lt;BROADCAST,MULTICAST,UP,LOWER_UP&amp;gt; mtu 1500 qdisc pfifo_fast state UP qlen 1000&#xA;    link/ether &amp;lt;MAC_ADDRESS&amp;gt; brd ff:ff:ff:ff:ff:ff&#xA;    inet 192.168.1.10/24 brd 192.168.1.255 scope global eth1&#xA;4: docker0: &amp;lt;NO-CARRIER,BROADCAST,MULTICAST,UP&amp;gt; mtu 1500 qdisc noqueue state DOWN&#xA;    link/ether &amp;lt;MAC_ADDRESS&amp;gt; brd ff:ff:ff:ff:ff:ff&#xA;    inet 172.17.42.1/16 scope global docker0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It can reach to every hosts:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[vagrant@vagrant-ubuntu-precise-64:~][2014-08-26T12:36:23]&#xA;$ ping 192.168.1.26&#xA;PING 192.168.1.26 (192.168.1.26) 56(84) bytes of data.&#xA;64 bytes from 192.168.1.26: icmp_req=1 ttl=64 time=0.473 ms&#xA;64 bytes from 192.168.1.26: icmp_req=2 ttl=64 time=0.314 ms&#xA;^C&#xA;--- 192.168.1.26 ping statistics ---&#xA;2 packets transmitted, 2 received, 0% packet loss, time 1001ms&#xA;rtt min/avg/max/mdev = 0.314/0.393/0.473/0.081 ms&#xA;&#xA;[vagrant@vagrant-ubuntu-precise-64:~][2014-08-26T12:36:36]&#xA;$ ping 192.168.1.30&#xA;PING 192.168.1.30 (192.168.1.30) 56(84) bytes of data.&#xA;64 bytes from 192.168.1.30: icmp_req=1 ttl=64 time=1.51 ms&#xA;64 bytes from 192.168.1.30: icmp_req=2 ttl=64 time=0.652 ms&#xA;^C&#xA;--- 192.168.1.30 ping statistics ---&#xA;2 packets transmitted, 2 received, 0% packet loss, time 1003ms&#xA;rtt min/avg/max/mdev = 0.652/1.084/1.516/0.432 ms&#xA;&#xA;[vagrant@vagrant-ubuntu-precise-64:~][2014-08-26T12:36:38]&#xA;$ ping 10.255.254.0&#xA;PING 10.255.254.0 (10.255.254.0) 56(84) bytes of data.&#xA;64 bytes from 10.255.254.0: icmp_req=1 ttl=63 time=7.24 ms&#xA;^C&#xA;--- 10.255.254.0 ping statistics ---&#xA;1 packets transmitted, 1 received, 0% packet loss, time 0ms&#xA;rtt min/avg/max/mdev = 7.245/7.245/7.245/0.000 ms&#xA;&#xA;[vagrant@vagrant-ubuntu-precise-64:~][2014-08-26T12:37:59]&#xA;$ ping 10.100.0.200&#xA;PING 10.100.0.200 (10.100.0.200) 56(84) bytes of data.&#xA;64 bytes from 10.100.0.200: icmp_req=1 ttl=63 time=13.3 ms&#xA;^C&#xA;--- 10.100.0.200 ping statistics ---&#xA;1 packets transmitted, 1 received, 0% packet loss, time 0ms&#xA;rtt min/avg/max/mdev = 13.366/13.366/13.366/0.000 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;Mac OS X (#1)&#xA;&#xA;&lt;p&gt;Routing Table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ netstat -nr&#xA;Routing tables&#xA;&#xA;Internet:&#xA;Destination        Gateway            Flags        Refs      Use   Netif Expire&#xA;default            192.168.1.1        UGSc           10        0     en0&#xA;default            192.168.1.1        UGScI           0        0     en1&#xA;default            10.255.254.0       UGScI           0        0    ppp0&#xA;10                 ppp0               USc             1        6    ppp0&#xA;10.255.254.0       10.100.0.204       UHr             1       76    ppp0&#xA;127                127.0.0.1          UCS             0        0     lo0&#xA;127.0.0.1          127.0.0.1          UH              6   391932     lo0&#xA;169.254            link#4             UCS             0        0     en0&#xA;192.168.1          link#4             UCS             4        0     en0&#xA;192.168.1          link#5             UCSI            2        0     en1&#xA;192.168.1.1        &amp;lt;MAC_ADDRESS&amp;gt;      UHLWIir        13   267249     en0   1200&#xA;192.168.1.1        &amp;lt;MAC_ADDRESS&amp;gt;      UHLWIir         1        4     en1    605&#xA;192.168.1.10       &amp;lt;MAC_ADDRESS&amp;gt;      UHLWI           0        2     en0    507&#xA;192.168.1.26       127.0.0.1          UHS             0        0     lo0&#xA;192.168.1.28       127.0.0.1          UHS             0        3     lo0&#xA;192.168.1.30       &amp;lt;MAC_ADDRESS&amp;gt;      UHLWIi          2     2027     en0   1200&#xA;192.168.1.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       94     en0&#xA;192.168.2          link#11            UC              2        0 vboxnet&#xA;192.168.2.255      ff:ff:ff:ff:ff:ff  UHLWbI          0        9 vboxnet&#xA;192.168.33         link#10            UC              2        0 vboxnet&#xA;192.168.33.255     ff:ff:ff:ff:ff:ff  UHLWbI          0        9 vboxnet&#xA;192.168.59         link#13            UC              2        0 vboxnet&#xA;192.168.59.255     ff:ff:ff:ff:ff:ff  UHLWbI          0        9 vboxnet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;Mac OS X (#2)&#xA;&#xA;&lt;p&gt;Routing Table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ netstat -nr&#xA;Routing tables&#xA;&#xA;Internet:&#xA;Destination        Gateway            Flags        Refs      Use   Netif Expire&#xA;default            192.168.1.1        UGSc           67        0     en0&#xA;default            link#5             UCSI            0        0     en1&#xA;default            link#10            UCSI            0        0 bridge1&#xA;default            10.255.254.0       UGScI           0        0    ppp0&#xA;10                 ppp0               USc             3        0    ppp0&#xA;10.255.254.0       10.100.0.200       UHr             1        4    ppp0&#xA;127                127.0.0.1          UCS             0        0     lo0&#xA;127.0.0.1          127.0.0.1          UH              5     1238     lo0&#xA;169.254            link#4             UCS             1        0     en0&#xA;169.254.78.173     127.0.0.1          UHS             1        0     lo0&#xA;169.254.255.255    link#4             UHRLSW          0      759     en0      5&#xA;192.168.1          link#4             UCS             4        0     en0&#xA;192.168.1.1        &amp;lt;MAC_ADDRESS&amp;gt;      UHLWIir        69     8091     en0   1192&#xA;192.168.1.10       &amp;lt;MAC_ADDRESS&amp;gt;      UHLWI           0        2     en0    917&#xA;192.168.1.26       &amp;lt;MAC_ADDRESS&amp;gt;      UHLWIi          1     1829     en0   1185&#xA;192.168.1.30       127.0.0.1          UHS             0        1     lo0&#xA;192.168.1.255      ff:ff:ff:ff:ff:ff  UHLWbI          0       25     en0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8115" LastEditorUserId="8115" LastEditDate="2014-08-26T00:52:46.767" LastActivityDate="2016-03-28T08:32:11.587" Title="Vyatta static routing does not correctly route to next hop" Tags="|routing|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10595" PostTypeId="2" ParentId="8172" CreationDate="2014-08-24T10:28:55.947" Score="3" Body="&lt;p&gt;No. &lt;code&gt;P&lt;/code&gt; indicates untagged traffic will be placed on that VLAN. 4095 is usually the VLAN for discarded traffic.&lt;/p&gt;&#xA;" OwnerUserId="1807" LastActivityDate="2014-08-24T10:28:55.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10597" PostTypeId="1" AcceptedAnswerId="10615" CreationDate="2014-08-24T16:41:58.533" Score="3" ViewCount="5188" Body="&lt;p&gt;I'd like to know how, using command-line whois, I can get all IP ranges (i.e., NET objects) assigned to a particular organisation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, consider this company: &lt;a href=&quot;http://whois.arin.net/rest/org/HT-136&quot; rel=&quot;nofollow&quot;&gt;http://whois.arin.net/rest/org/HT-136&lt;/a&gt; ... if you click on the link &quot;Related networks&quot; it will bring you to &lt;a href=&quot;http://whois.arin.net/rest/org/HT-136/nets&quot; rel=&quot;nofollow&quot;&gt;http://whois.arin.net/rest/org/HT-136/nets&lt;/a&gt; which shows you the networks assigned to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am finding it difficult to figure out how to get the same info using command-line whois.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="8114" LastEditorUserId="8114" LastEditDate="2014-08-24T18:33:01.990" LastActivityDate="2014-08-25T20:00:38.800" Title="How to whois ARIN to get IP ranges?" Tags="|arin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10598" PostTypeId="1" CreationDate="2014-08-24T20:13:12.067" Score="5" ViewCount="4239" Body="&lt;p&gt;how u doing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just got a Cisco SF300-24 for studying switch configuration and I'm in doubt about the Management VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my conf, I made this VLANs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vlan       Name                   Ports               Created by    &#xA;---- ----------------- --------------------------- ---------------- &#xA; 1           1                                            D         &#xA; 10        DATA              fa9-11,fa21-23               S         &#xA; 11        VOIP                                           S         &#xA; 12      PRINTERS               fa8,fa20                  S         &#xA; 13         SAN               fa6-7,fa18-19               S         &#xA; 14    PRIVATE_WIFI             fa5,fa17                  S         &#xA; 15     PUBLIC_WIFI             fa4,fa16                  S         &#xA; 16        HOUSE              fa2-3,fa14-15               S         &#xA; 99        MGMT                 fa1,fa13                  S         &#xA;999        NULL           fa12,fa24,gi1-4,Po1-8           S    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The IP address for each vlan follows this scheme: 10.1..201/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I eliminated the VLAN 1 and create an 999, that's a black hole. Is this a good configuration for security improvement?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, I'd like the VLAN 99 to be the Management one, but I still can ping/telnet/ssh and whatsoever from ANY subnet. What should I use to block this kind traffic in other VLANs and make just this one for management?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thx in advance!&lt;/p&gt;&#xA;" OwnerUserId="8117" LastActivityDate="2014-08-25T12:44:46.403" Title="Management VLAN Configuration" Tags="|cisco|vlan|management|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10599" PostTypeId="2" ParentId="10598" CreationDate="2014-08-24T22:14:48.430" Score="3" Body="&lt;p&gt;On this switch, you define profiles that control who can access the management interface.  This is different than most IOS based switches.&#xA;From the management console, Click&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Security &amp;gt; Mgmt Access Method &amp;gt; Profile Rules&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you can control what ports, source addresses, protocols, etc can access the management interface.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-24T22:14:48.430" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10601" PostTypeId="2" ParentId="10598" CreationDate="2014-08-24T22:42:47.420" Score="5" Body="&lt;p&gt;This is normal behavior for a layer 3 switch, management traffic can be sent to any active Switch Virtual Interface (SVI). If you only want to allow management traffic from a specific vlan/subnet, you could set up ACLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A layer 2 switch can be assigned a management IP address, attached to one vlan, called the management vlan. It will only be reachable inside this vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of the SF300, I believe you have to define a management ACL instead of a normal IP ACL if you want to filter management traffic into the switch. Use the &lt;code&gt;management access-list&lt;/code&gt; command, and then apply the ACL using &lt;code&gt;management access-class&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2014-08-25T12:44:46.403" LastActivityDate="2014-08-25T12:44:46.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10606" PostTypeId="1" CreationDate="2014-08-25T10:57:19.887" Score="1" ViewCount="203" Body="&lt;p&gt;Let's say there are two pc's and they are connected via. Router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the image that explain everything.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/7huqA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The pc1 has IP address - 1.1.1.4 and pc2 has IP address - 1.1.1.8.&#xA;The router IP address is 2.2.2.7. When pc11 wants to communicate to pc2, then do they need to speak to router? In my opinion, when the destination and src ip address is in the same subnet - there will be an arp request to get the destination machine address. So, the router will not come into the picture. Do you agree with it? So, basically the ip address will be broadcasted to know the mac address. If the arp succeeds, then the destination is found and the communication can happen. On the other hand, if the destination ip address is in the other subnet then the router will come into the picture and will route the packet to the destination ip address. Then again the arp will be done to reach out the destination machine. Is my understanding correct?&lt;/p&gt;&#xA;" OwnerUserId="8123" LastEditorUserId="8123" LastEditDate="2014-08-26T10:16:28.110" LastActivityDate="2014-09-26T02:08:29.860" Title="Is router gw comes into the picture when the routing is within the same subnet?" Tags="|router|subnet|arp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10607" PostTypeId="1" AcceptedAnswerId="10621" CreationDate="2014-08-25T14:32:45.790" Score="4" ViewCount="4616" Body="&lt;p&gt;Anyone have experience with setting up their Nexus 7k core as an NTP server?&lt;p&gt; &#xA;I was thinking the code would look like below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;ntp master stratum 2&#xA;ntp server ns.arc.nasa.gov prefer&#xA;ntp server bitsy.mit.edu&#xA;ntp source-interface vlan 1 &lt;/pre&gt;&#xA;" OwnerUserId="4841" LastActivityDate="2014-08-26T05:30:13.740" Title="Cisco Nexus 7k as NTP server" Tags="|cisco|ntp|cisco-nexus|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10609" PostTypeId="2" ParentId="10568" CreationDate="2014-08-25T15:46:55.180" Score="-1" Body="&lt;p&gt;I think the tool you're looking for is a &quot;subnet calculator.&quot;  You can plug that phrase into any search engine and find a ton of them online.  Their interfaces vary but you can enter your IP address and either the slash notation (/20) or subnet mask into the calculator and it will give you the subnet ID, the broadcast IP and the range of IP addresses that are usable, as well as other details like the total number of hosts, etc.  As has been pointed out, the IP range  won't fit neatly into the x.x.x.* format unless it's a /24.&lt;/p&gt;&#xA;" OwnerUserId="8126" LastActivityDate="2014-08-25T15:46:55.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10610" PostTypeId="2" ParentId="10509" CreationDate="2014-08-25T16:08:42.393" Score="0" Body="&lt;p&gt;If your test is working, it looks like the Sonicwall configuration is good.  Verify the gateways on the PBX as you mentioned in the comments.&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2014-08-25T16:08:42.393" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10614" PostTypeId="1" CreationDate="2014-08-25T19:15:02.290" Score="2" ViewCount="5544" Body="&lt;p&gt;What effects does double-NAT have on VoIP? What happens to the traffic in this type of situation and what conditions can occur as a result of it?&lt;/p&gt;&#xA;" OwnerUserId="1453" LastActivityDate="2014-08-26T09:35:51.453" Title="Double-NAT's Effects on SIP and RTP" Tags="|router|nat|voip|sip|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10615" PostTypeId="2" ParentId="10597" CreationDate="2014-08-25T19:55:36.870" Score="9" Body="&lt;pre&gt;&lt;code&gt;$ whois -a &quot;o ! &amp;gt;  HT-136&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As found by doing &lt;code&gt;man whois&lt;/code&gt; and &lt;code&gt;whois -a ?&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;-a&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Use the American Registry for Internet Numbers (ARIN) database.&#xA;  It contains network numbers used in those parts of the world cov-&#xA;  ered neither by APNIC, AfriNIC, LACNIC, nor by RIPE.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;o&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Query-by-record-type:&#xA;       o       Organizations&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;!&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Query-by-attribute:&#xA;       !          Searches for matches by handle or id&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Record hierarchy:&#xA;                Displays the record related down the hierarchy.&#xA;                For an organization or customer, display&#xA;                the resources registered to that organization or customer, in&#xA;                list format.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Result is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&#xA;# ARIN WHOIS data and services are subject to the Terms of Use&#xA;# available at: https://www.arin.net/whois_tou.html&#xA;#&#xA;# If you see inaccuracies in the results, please report at&#xA;# http://www.arin.net/public/whoisinaccuracy/index.xhtml&#xA;#&#xA;&#xA;&#xA;#&#xA;# The following results may also be obtained via:&#xA;# http://whois.arin.net/rest/orgs;handle=HT-136?showDetails=true&amp;amp;ext=netref2&#xA;#&#xA;&#xA;OrgName:        HAProxy Technologies, Inc.&#xA;OrgId:          HT-136&#xA;Address:        1013 Centre Road, Suite 403S&#xA;City:           Wilmington&#xA;StateProv:      DE&#xA;PostalCode:     19805&#xA;Country:        US&#xA;RegDate:        2014-04-02&#xA;Updated:        2014-07-18&#xA;Ref:            http://whois.arin.net/rest/org/HT-136&#xA;&#xA;TechHandle: SCARP14-ARIN&#xA;TechName:   Scarpa, John&#xA;TechPhone:  +1-857-366-5050&#xA;TechEmail:  john.scarpa@haproxy.com&#xA;TechRef:    http://whois.arin.net/rest/poc/SCARP14-ARIN&#xA;&#xA;TechHandle: BRKIC2-ARIN&#xA;TechName:   Brkic, andrej&#xA;TechPhone:  +19547320642&#xA;TechEmail:  abrkic@haproxy.com&#xA;TechRef:    http://whois.arin.net/rest/poc/BRKIC2-ARIN&#xA;&#xA;NOCHandle: NETWO6774-ARIN&#xA;NOCName:   Network Operations&#xA;NOCPhone:  +1-857-366-5050&#xA;NOCEmail:  noc@haproxy.com&#xA;NOCRef:    http://whois.arin.net/rest/poc/NETWO6774-ARIN&#xA;&#xA;AdminHandle: SCARP14-ARIN&#xA;AdminName:   Scarpa, John&#xA;AdminPhone:  +1-857-366-5050&#xA;AdminEmail:  john.scarpa@haproxy.com&#xA;AdminRef:    http://whois.arin.net/rest/poc/SCARP14-ARIN&#xA;&#xA;AbuseHandle: NETWO6775-ARIN&#xA;AbuseName:   Network Abuse&#xA;AbusePhone:  +1-857-366-5050&#xA;AbuseEmail:  abuse@haproxy.com&#xA;AbuseRef:    http://whois.arin.net/rest/poc/NETWO6775-ARIN&#xA;HAProxy Technologies, Inc. SCNET-205-234-170-0-1 (NET-205-234-170-0-1) 205.234.170.0 - 205.234.170.255&#xA;HAProxy Technologies, Inc. SCNET-205-234-181-0-1 (NET-205-234-181-0-1) 205.234.181.0 - 205.234.181.255&#xA;HAProxy Technologies, Inc. SCNET-205-234-165-0-1 (NET-205-234-165-0-1) 205.234.165.0 - 205.234.165.255&#xA;HAProxy Technologies, Inc. SCNET-205-234-166-0-1 (NET-205-234-166-0-2) 205.234.166.0 - 205.234.166.255&#xA;HAProxy Technologies, Inc. HAPNET-1 (NET-104-152-112-0-1) 104.152.112.0 - 104.152.119.255&#xA;HAProxy Technologies, Inc. (AS11019) HAPROXY-TECHNOLOGIES 11019&#xA;&#xA;&#xA;&#xA;#&#xA;# ARIN WHOIS data and services are subject to the Terms of Use&#xA;# available at: https://www.arin.net/whois_tou.html&#xA;#&#xA;# If you see inaccuracies in the results, please report at&#xA;# http://www.arin.net/public/whoisinaccuracy/index.xhtml&#xA;#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As an alternate answer, using CURL or any REST client via RWHOIS is in my opinion MUCH easier to parse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;curl http://whois.arin.net/rest/org/HT-136/nets&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;?xml-stylesheet type='text/xsl' href='http://whois.arin.net/xsl/website.xsl' ?&amp;gt;&#xA;&amp;lt;nets xmlns=&quot;http://www.arin.net/whoisrws/core/v1&quot; xmlns:ns2=&quot;http://www.arin.net/whoisrws/rdns/v1&quot; xmlns:ns3=&quot;http://www.arin.net/whoisrws/netref/v2&quot; termsOfUse=&quot;https://www.arin.net/whois_tou.html&quot; inaccuracyReportUrl=&quot;http://www.arin.net/public/whoisinaccuracy/index.xhtml&quot;&amp;gt;&#xA;   &amp;lt;limitExceeded limit=&quot;256&quot;&amp;gt;false&amp;lt;/limitExceeded&amp;gt;&#xA;   &amp;lt;netRef startAddress=&quot;205.234.170.0&quot; endAddress=&quot;205.234.170.255&quot; name=&quot;SCNET-205-234-170-0-1&quot; handle=&quot;NET-205-234-170-0-1&quot;&amp;gt;http://whois.arin.net/rest/net/NET-205-234-170-0-1&amp;lt;/netRef&amp;gt;&#xA;   &amp;lt;netRef startAddress=&quot;205.234.181.0&quot; endAddress=&quot;205.234.181.255&quot; name=&quot;SCNET-205-234-181-0-1&quot; handle=&quot;NET-205-234-181-0-1&quot;&amp;gt;http://whois.arin.net/rest/net/NET-205-234-181-0-1&amp;lt;/netRef&amp;gt;&#xA;   &amp;lt;netRef startAddress=&quot;205.234.165.0&quot; endAddress=&quot;205.234.165.255&quot; name=&quot;SCNET-205-234-165-0-1&quot; handle=&quot;NET-205-234-165-0-1&quot;&amp;gt;http://whois.arin.net/rest/net/NET-205-234-165-0-1&amp;lt;/netRef&amp;gt;&#xA;   &amp;lt;netRef startAddress=&quot;205.234.166.0&quot; endAddress=&quot;205.234.166.255&quot; name=&quot;SCNET-205-234-166-0-1&quot; handle=&quot;NET-205-234-166-0-2&quot;&amp;gt;http://whois.arin.net/rest/net/NET-205-234-166-0-2&amp;lt;/netRef&amp;gt;&#xA;   &amp;lt;netRef startAddress=&quot;104.152.112.0&quot; endAddress=&quot;104.152.119.255&quot; name=&quot;HAPNET-1&quot; handle=&quot;NET-104-152-112-0-1&quot;&amp;gt;http://whois.arin.net/rest/net/NET-104-152-112-0-1&amp;lt;/netRef&amp;gt;&#xA;&amp;lt;/nets&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="412" LastEditorUserId="412" LastEditDate="2014-08-25T20:00:38.800" LastActivityDate="2014-08-25T20:00:38.800" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10616" PostTypeId="1" CreationDate="2014-08-25T21:23:49.630" Score="1" ViewCount="2380" Body="&lt;p&gt;The networking industry has come to a general consensus that large layer 2 networks are more troublesome to build and maintain because of the inherent problems in the layer 2 switching. To name a few of the main pain points..&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;packet loop causing network meltdown&lt;/li&gt;&#xA;&lt;li&gt;STP reducing the effective bandwidth of the network&lt;/li&gt;&#xA;&lt;li&gt;Because of STP inefficient packet paths in large l2 networks&lt;/li&gt;&#xA;&lt;li&gt;Lack of proper ECMP (TRILL came in too late and still not available widely)&lt;/li&gt;&#xA;&lt;li&gt;Lack of visibility into the packet path for debugging.&lt;/li&gt;&#xA;&lt;li&gt;bandaids like BPDU filter, BPDU guard, port fast etc. making config more difficult and error prone.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am curious to know what are some real world examples of these kind of issues Network engineers have seen over the years. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If large L2 domains are such a cause of misery why haven't we moved to a model where L2 is terminated at access/TOR switch and reduce the size of L2 domain as much as possible ?&lt;/p&gt;&#xA;" OwnerUserId="3489" LastActivityDate="2014-08-26T03:41:09.060" Title="Network engineers - What are some specific layer 2 network problems you have seen?" Tags="|cisco|vlan|ethernet|switching|best-practices|" AnswerCount="1" CommentCount="3" ClosedDate="2014-08-26T06:49:01.307" ContentLicense="CC BY-SA 3.0" />
  <row Id="10620" PostTypeId="2" ParentId="10616" CreationDate="2014-08-26T03:41:09.060" Score="0" Body="&lt;p&gt;In many cases, that's what people do. But in general, your list is example after example of network admins / engineers doing a poor job. Spanning-tree fixes the first. STP isn't an issue if the network is setup correctly, by someone aware of how STP works.  ECMP is a layer-3 thing; for layer-2, that would be &quot;etherchannel&quot;. (eg. LACP) Knowing the packet path is the virtual equivalent of hooking your finger on the wire and following it -- looking on each switch, hop-by-hop. (there's no &lt;em&gt;traceroute&lt;/em&gt; at layer-2)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-26T03:41:09.060" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10621" PostTypeId="2" ParentId="10607" CreationDate="2014-08-26T05:30:13.740" Score="2" Body="&lt;p&gt;That is all you need to get going, however it isn't an ideal configuration. I'll ignore security and local NTP architecture and focus on your current config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The minimum recommended NTP servers is generally 3, but preferably 4. The reason for this is not only resiliency but it gives the client (your N7k) a better reference if any of the upstream servers start experiencing issues or clock drift.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With NTP, when a server is well out of sync, the client will disregard it as a valid source (even if it is a higher stratum than the others!). If you have two servers configured then how do you tell who is out of sync? The third server gives the client another point of reference that can be used to tell who is out of sync (the more the merrier, up until a certain point).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I think bitsy.mit.edu is a Stratum 3 - you might be able to find a few Stratum 2 servers that are close by instead. If you have a reason for those particular servers then feel free to ignore this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tl;dr yes it will work.&lt;/p&gt;&#xA;" OwnerUserId="7730" LastActivityDate="2014-08-26T05:30:13.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10623" PostTypeId="2" ParentId="10614" CreationDate="2014-08-26T09:35:51.453" Score="3" Body="&lt;p&gt;&lt;strong&gt;As @Ricky Beam indicated, you should have no issues other than delay with fully-functional, SIP-aware NAT devices.&lt;/strong&gt;  This is known as ALG (Application Layer Gateway) on some lower-end network devices and SIP Fixup or SIP Inspection on different Cisco firewall platforms depending on software version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, the recommendation on not using ALG comes from poor implementation of either ALG itself or the client not putting its address into the SIP packets for it to be found and updated with the NAT'd address.  On higher-end network devices, this generally works though you may run into a bug as I did in a recent &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/10512/how-can-the-sip-timeout-on-a-cisco-pix-be-increased-for-the-register-transaction&quot;&gt;question&lt;/a&gt; with an older Cisco PIX version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any type of ALG/SIP Inspection requires symetrically routing especially if implemented in a stateful firewall so the NAT'd addresses can get reversed on their way back to the client sitting inside the NAT device.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-08-26T09:35:51.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10625" PostTypeId="1" AcceptedAnswerId="10630" CreationDate="2014-08-26T10:13:12.587" Score="1" ViewCount="2313" Body="&lt;p&gt;I have a requirement to build a network that has 3 internet feeds, 2 of which will be designated to VLANS 10-20 and the 3rd feed for VLAN 30 (only). I have in my posession the following hardware:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ASA 5510&lt;/li&gt;&#xA;&lt;li&gt;Cisco 3560X switch&lt;/li&gt;&#xA;&lt;li&gt;3 x 2911 routers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The idea would be to have the switch act as the core whereby all VLAN's are distributed, each having an SVI on the same switch which will act as the gateway for users behind each VLAN i.e. VLAN10 SVI will be 172.16.10.1, VLAN30 SVI will be 172.16.30.1 etc;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem arises in the fact that the ASA will not do policy routing and hence, need a router to do the routing to the relevant ISP's. I have a design in mind however am a little hesitant that it'll work and thus, would greatly appreciate if somebody could validate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a /29 and a /30 to each ISP; i'll be using the /30 to get to the public internet space, with the /29 being used for various services/clients sitting behind the switch, of which i'd like to have the ASA act as the NAT/inspection box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/CEWWA.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;The plan would be to do a static NAT on the ASA for certain VLAN's to an IP on the 172.16.251.0/24 subnet, i'll then configure PBR on 2911-1 to match this source subnet and route it out the correct interface and hence, the correct ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a requirement for VLAN10-20 to be able to failover between ISP's however i can easily implement IP SLA on 2911-2 to sort this out. As a worst case, if ISP3 was to be taken out by a backhoe, there would be a need to route this traffic out via ISP1 or ISP2, again, easily done by fixing policy route on 2911-1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the design, it seems as though there are too many private networks between the 2911's however i could just be over-analyzing the layout. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there is a workaround to have the ASA do pseudo-policy-routing with the use of NAT rules, however i'd prefer a supported (and scalable) solution. So as it stands, my options are - &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Implement the above design - assuming the design is correct and will work&lt;/li&gt;&#xA;&lt;li&gt;Use the ASA to do policy routing - not supported&lt;/li&gt;&#xA;&lt;li&gt;Sit the ASA in transparent mode; doing inspection (and even NAT, albeit not being required). &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If anybody can lend me a hand, that would be excellent!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks guys&lt;/p&gt;&#xA;" OwnerUserId="1001" LastActivityDate="2014-08-26T17:10:22.707" Title="Triple-WAN load-balancing" Tags="|cisco-asa|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10628" PostTypeId="1" AcceptedAnswerId="28214" CreationDate="2014-08-26T15:41:23.643" Score="3" ViewCount="950" Body="&lt;p&gt;We run 5 x GS752TPS as a single stack. We run both our data and voice on the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know, no advanced setup has been done on the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to remove the infrastructure as a possible cause for the network running slow. How can I measure the load the switches are put under?&lt;/p&gt;&#xA;" OwnerUserId="8146" LastEditorUserId="8499" LastEditDate="2016-02-26T15:14:37.263" LastActivityDate="2016-02-26T15:14:37.263" Title="Monitoring traffic on Netgear GS752TPS" Tags="|netgear-prosafe|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10630" PostTypeId="2" ParentId="10625" CreationDate="2014-08-26T17:10:22.707" Score="2" Body="&lt;p&gt;Your design in the diagram is a reasonable approach.  Do policy-based routing on 2911-1, and do you NAT on the border routers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative, if you can use contexts, is to connect VLAN 30 directly to the ASA (either with a different interface, or use sub-interfaces and a VLAN trunk. Make the ASA the default gateway.  Connect 2911-3 similarly with a separate interface.  Now you can create a separate context for VLAN 30 traffic, and direct it to ISP 3.  This may or may not be practical, depending on your situation.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-26T17:10:22.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10632" PostTypeId="1" AcceptedAnswerId="10700" CreationDate="2014-08-26T19:06:35.547" Score="4" ViewCount="2444" Body="&lt;p&gt;We are in our second week of school, now, and starting yesterday we started receiving complaints about slow wireless internet.  After some investigating, we found out that our entire wireless network is being sapped with ICMPv6 neighbor solicitation packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I captured a wireshark packet captures for 1 minute on multiple occasions, and it is pretty clear that this traffic is the culprit.  During times where wireless is running flawlessly, about 1-2% of the total traffic is ICMPv6.  When the wireless is bogged down, ICMPv6 accounts for 40-65% of the network traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running out of ideas as to how I can fix this.  It looks like an IPv6 denial of service from inside.  I can't pinpoint it to a single machine, as there are multiple IPv6 source and destination addresses, along with multiple source and destination MACs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have posted both a good and a bad sample of the traffic at &lt;a href=&quot;https://www.dropbox.com/sh/u202fhol0t3tqtg/AAApKkm9PtbZwQfZtwkBViKka?dl=0&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/sh/u202fhol0t3tqtg/AAApKkm9PtbZwQfZtwkBViKka?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We thought we had this fixed after about 11:00 AM this morning, when we found an access point that was causing the issues.  We replaced the AP with a new one and everything was fine for three hours until now.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our wireless system is Unifi, by the way.  98% of our laptops are using Realtek 8188CE wireless NICs, and the other 2% are using a Centrino 7000 series NIC, not sure on the exact model.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I forgot to mention two things at the initial time of posting.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I have two buildings, only one of them is experiencing the problem.  The networking equipment is identical between the buildings, and the only thing that is different is concurrent users (only about 70 less than the failing building), and laptop hardware, but the wireless cards are still the same except the working building is 100% Realtek 8188CE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) It will work during certain periods of the school day, then it will shut down for entire periods, which we thought pointed to malicious user activity, but any time we thought we were able to pinpoint it, the flood would start again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;UPDATE AS OF 8/28/14 11:14 AM&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It currently appears that a piece of software installed, LAN School, used to monitor the activity of students, may have been the issue.  We updated the version of this on every machine at the problematic building, and icmpv6 traffic has since maxed out at .5% and is often at 0%.  I'm going to give it another day's time to verify, but it appears to be fixed.&lt;/p&gt;&#xA;" OwnerUserId="2670" LastEditorUserId="775" LastEditDate="2014-12-08T12:35:31.330" LastActivityDate="2014-12-08T12:35:31.330" Title="Entirely wireless network being taken down by ICMPv6 neighbor solicitations" Tags="|wireless|icmpv6|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10634" PostTypeId="2" ParentId="10632" CreationDate="2014-08-26T20:07:19.807" Score="4" Body="&lt;p&gt;It appears your network isn't running IPv6 -- no RAs are seen in the capture -- which may be a big part of the problem.  Otherwise, it looks like the standard effects of a bunch of windows machines joining the network. Couple that with the simple fact that 99.999% of APs (wifi in general) don't handle multicast worth a damn, and you have the perfect recipe for a meltdown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[** Multicast is just broadcast to most gear. In the wifi world, broadcast is handled at the &quot;basic rate&quot; which could be as low as 1Mbps. I've tested several APs (linksys, cisco, ...) with an HDHR as the source: it'll unicast two full video stream (39m) QAMs without a single error, but switch to multicast and even a 3M Standard Definition video sub-stream will kill wireless. (disclaimer) I've not done that with a Unifi.]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Alternate Option&lt;/strong&gt;&lt;br&gt;&#xA;1) Disable 802.11b -- use G only, or G/N only.&lt;br&gt;&#xA;2) Change the basic-rate selection(s) on the APs. This will significantly reduce the range of each AP. And could cause some clients problems. But, it &lt;em&gt;will&lt;/em&gt; increase the bandwidth for broadcast traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Have you talked to UBNT about your issues with IPv6? They may have nothing for you, but pinging them doesn't cost anything.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-08-28T20:09:49.363" LastActivityDate="2014-08-28T20:09:49.363" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10636" PostTypeId="1" AcceptedAnswerId="10640" CreationDate="2014-08-26T20:37:02.057" Score="6" ViewCount="2304" Body="&lt;p&gt;Need some assistance with a small query.&#xA;Can a 5508 WLC be configured to host multiple concurrent captive portals?&#xA;Have been googling for the information but if anyone has the info available, I would appreciate it.&#xA;Thanks:-)&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="4565" LastEditDate="2014-08-27T20:05:27.050" LastActivityDate="2014-08-27T20:05:27.050" Title="Cisco Prime / 5508 WLC captive portals" Tags="|wireless|wlc|cisco-wireless|byod|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10637" PostTypeId="1" CreationDate="2014-08-26T20:57:58.620" Score="-1" ViewCount="4543" Body="&lt;p&gt;I have a .pcap file that I would like to look at. But when I open it in notepad++ i get strings of discernible information, but a whole lot more of black boxes with 'NUL' written in them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can use wireshark to open the .pcap file, but i'm trying to see the hexcode for the .pcap file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway to see the .pcap header information in Hex? Also what format is the .pcap file in? Is it a binarycode? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="8151" LastActivityDate="2014-08-28T17:32:56.200" Title="Pcap file parsing" Tags="|packet-analysis|wireshark|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10638" PostTypeId="2" ParentId="10637" CreationDate="2014-08-26T21:45:54.873" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;what format is the .pcap file in? Is it a binarycode?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.tcpdump.org/manpages/pcap-savefile.5.html&quot; rel=&quot;nofollow&quot;&gt;Yes&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there anyway to see the .pcap header information in Hex?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A &lt;a href=&quot;https://en.wikipedia.org/wiki/Hex_editor&quot; rel=&quot;nofollow&quot;&gt;hex file editor&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2014-08-26T21:45:54.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10640" PostTypeId="2" ParentId="10636" CreationDate="2014-08-26T22:03:41.660" Score="4" Body="&lt;p&gt;Based on this &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/71881-ext-web-auth-wlc.html#c5&quot; rel=&quot;nofollow&quot;&gt;Configuration Guide&lt;/a&gt;, it would appear to only support one portal. I don't know if there's a way to specify the SSID (network) to the portal page / WLC. (I've never needed to. [it's in the &lt;code&gt;wlan&lt;/code&gt; query param])&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: Apparently 7.3+ can, but it's a lot more involved. &quot;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-3/configuration/guide/b_cg73/b_wlc-cg_chapter_01011.html#d104691e2151a1635&quot; rel=&quot;nofollow&quot;&gt;Assigning Login, Login Failure, and Logout Pages per WLAN&lt;/a&gt;&quot;&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-08-26T22:18:26.090" LastActivityDate="2014-08-26T22:18:26.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10641" PostTypeId="2" ParentId="10606" CreationDate="2014-08-27T01:31:20.067" Score="2" Body="&lt;p&gt;You are mostly correct in your assumptions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination is within the same subnet (determined by network mask) then the source will send a layer 2 ARP request for the destination MAC address. If the destination is outside of the subnet, the source will send a layer 2 ARP request for the gateway's MAC address. Only when the destination address is outside of the subnet is the router involved. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you speak of the router on a different subnet, this won't work for what you are describing. The routers job is to forward packets that are destined for places outside of the subnet, it cannot operate without access to your local network segment. &lt;/p&gt;&#xA;" OwnerUserId="274" LastActivityDate="2014-08-27T01:31:20.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10642" PostTypeId="2" ParentId="10636" CreationDate="2014-08-27T04:28:05.640" Score="4" Body="&lt;p&gt;Not directly on the WLC, but using &lt;strong&gt;Cisco ACS&lt;/strong&gt;, ISE or other RADIUS server, you can set the captive URL using the &lt;code&gt;url-redirect&lt;/code&gt; value of the &lt;code&gt;cisco-av-pair&lt;/code&gt; RADIUS attribute.  This &lt;strong&gt;overrides&lt;/strong&gt; the WLC default setting for &lt;strong&gt;External Webauth URL&lt;/strong&gt;.  You can also set the url-redirect-acl to match a named ACL on the WLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/lIOg1.png&quot; alt=&quot;ACS url-redirect RADIUS attribute&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="775" LastEditDate="2014-08-27T07:34:37.680" LastActivityDate="2014-08-27T07:34:37.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10644" PostTypeId="1" AcceptedAnswerId="10647" CreationDate="2014-08-27T06:26:25.803" Score="1" ViewCount="712" Body="&lt;p&gt;As far as I know, 802.11b and 802.11g operate on same frequency 2.4 GHz. But why does 802.11g achieve faster connection than 802.11b?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the mechanism of how 802.11g can achieve it?&lt;/p&gt;&#xA;" OwnerUserId="8154" LastEditorUserId="21048" LastEditDate="2016-06-25T11:30:59.150" LastActivityDate="2016-06-25T11:30:59.150" Title="Why is Wireless 802.11g Faster Than 802.11b?" Tags="|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10645" PostTypeId="1" CreationDate="2014-08-27T06:39:37.247" Score="1" ViewCount="861" Body="&lt;p&gt;I want to identify a gratuitous ARP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I say:&#xA;If sender IP address and target IP address equal, it's always a gratuitous ARP?&lt;/p&gt;&#xA;" OwnerUserId="8155" LastEditorUserId="775" LastEditDate="2014-12-08T12:34:32.827" LastActivityDate="2014-12-08T12:34:32.827" Title="Identify gratuitous ARP" Tags="|ethernet|protocol-theory|arp|broadcast|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10646" PostTypeId="2" ParentId="10552" CreationDate="2014-08-27T07:18:42.727" Score="4" Body="&lt;p&gt;@PHLiGHT, hello there! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;your cisco 861, imho, has overloaded by ingress traffic. Lets look on your cisco iface counters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 5 minute output rate 198000 bits/sec, 56 packets/sec&#xA; 157099395 packets input, 3610517494 bytes&#xA; Received 1 broadcasts, 76 runts, 0 giants, 655 throttles&#xA; 338 input errors, 0 CRC, 0 frame, 149 overrun, 189 ignored&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you have 655 throttles, so there is two major reasons: cpu overload, buffers overload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and you have 338 errors (&quot;149 overruns&quot; &lt;strong&gt;+&lt;/strong&gt; &quot;189 ignored&quot;), i guess this is (too) caused by overload of your router.&#xA;details: &lt;a href=&quot;https://supportforums.cisco.com/document/13796/overruns-counter-show-interfaces-command-output-increasing&quot; rel=&quot;nofollow&quot;&gt;overruns&lt;/a&gt;, &lt;a href=&quot;https://supportforums.cisco.com/document/12426/ignored-packets-are-router-due-traffic-overload-or-faulty-interface&quot; rel=&quot;nofollow&quot;&gt;ignored&lt;/a&gt; and &lt;a href=&quot;http://www.frameip.com/dos-cisco/queue_drops.pdf&quot; rel=&quot;nofollow&quot;&gt;userfull cisco pdf about drops troubleshooting&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is very interesting for me, to see output these commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; sh interfaces fa4  | i que  &#xA; sh interfaces fa4 switching&#xA; sh proc cpu sort&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ps very strange is to see 76 runts, as usually, it caused by collisions(can be only in simplex mode), but in config we have &quot;duplex full&quot;. imho, clean counters, do not change duplex mode, wait some time, runts are shouldnt increase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pps i guess, this situiatuion cant cause serious problems, because you have &quot;only&quot; 1 error on each ~500000 packets, it is not too bad in most cases, really ;-)&lt;/p&gt;&#xA;" OwnerUserId="3478" LastActivityDate="2014-08-27T07:18:42.727" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10647" PostTypeId="2" ParentId="10644" CreationDate="2014-08-27T09:33:28.530" Score="3" Body="&lt;p&gt;802.11g has a higher bitrate (54mbs, realisitc 22-26mbs).  802.11g uses the same radio-frequency bandwidth as 802.11b, but 802.11g implements  QAM / modulation.  So a 64-QAM modulation increases the bitrate to 54mbs theoretical speed. It's basically the accuracy of the wlan. How accuratly you can transmit/modulate your signal and how accuratly the client can receive and process the signal.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="775" LastEditDate="2014-08-27T09:54:54.787" LastActivityDate="2014-08-27T09:54:54.787" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10648" PostTypeId="2" ParentId="10645" CreationDate="2014-08-27T10:00:37.493" Score="6" Body="&lt;p&gt;You can identify Gratuitous ARPs by looking at the ARP Sender Protocol Address and ARP Target Protocol Address, so as you mentioned when they are the same it's a gratuitous ARP.  See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2002#section-4.6&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2002, Section 4.6&lt;/a&gt; for a reference (the emphasis - &lt;code&gt;!!!!&amp;gt;&lt;/code&gt; and &lt;code&gt;&amp;lt;!!!!&lt;/code&gt; is mine)...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;      4.6. ARP, Proxy ARP, and Gratuitous ARP&#xA;&#xA;      &amp;lt;...&amp;gt;&#xA;&#xA;      A Gratuitous ARP [23] is an ARP packet sent by a node in order to&#xA;      spontaneously cause other nodes to update an entry in their ARP&#xA;      cache.  A gratuitous ARP MAY use either an ARP Request or an ARP&#xA;      Reply packet.  In either case, the (!!!!&amp;gt;) ARP Sender Protocol Address&#xA;      and ARP Target Protocol Address are both set to the IP address&#xA;      of the cache entry to be updated (&amp;lt;!!!!), and the ARP Sender Hardware&#xA;      Address is set to the link-layer address to which this cache&#xA;      entry should be updated.  When using an ARP Reply packet, the&#xA;      Target Hardware Address is also set to the link-layer address to&#xA;      which this cache entry should be updated (this field is not used&#xA;      in an ARP Request packet).&#xA;&#xA;      In either case, for a gratuitous ARP, the ARP packet MUST be&#xA;      transmitted as a local broadcast packet on the local link.  As&#xA;      specified in [16], any node receiving any ARP packet (Request or&#xA;      Reply) MUST update its local ARP cache with the Sender Protocol&#xA;      and Hardware Addresses in the ARP packet, if the receiving node&#xA;      has an entry for that IP address already in its ARP cache.  This&#xA;      requirement in the ARP protocol applies even for ARP Request&#xA;      packets, and for ARP Reply packets that do not match any ARP&#xA;      Request transmitted by the receiving node [16].&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-08-27T10:16:24.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10651" PostTypeId="2" ParentId="10632" CreationDate="2014-08-27T16:31:12.563" Score="-1" Body="&lt;p&gt;MooseBalm, can you confirm, you are blocking RAs and the problem has been solved? &#xA;It would be even better if you could kill them closer to the source, on the AP, or disable it on the clients completely. &lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2014-08-27T16:31:12.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10656" PostTypeId="1" AcceptedAnswerId="10659" CreationDate="2014-08-27T19:46:07.813" Score="-1" ViewCount="98" Body="&lt;p&gt;I have a network and I have 2 subnets from ISP. Can I give these 2 IP to router from switch like it is shown in this figure:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/k8hvN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know, I can give to one physical port, but I want now about realisation like this. Will it work or not?&lt;/p&gt;&#xA;" OwnerUserId="8170" LastEditorUserId="21048" LastEditDate="2016-06-25T11:30:45.743" LastActivityDate="2016-06-25T11:30:45.743" Title="give several subnet ip from one switch" Tags="|switch|router|ip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10658" PostTypeId="2" ParentId="10637" CreationDate="2014-08-27T22:28:56.633" Score="2" Body="&lt;p&gt;wireshark and tcpdump should work. Several other tools as well. But if you have to ask, it probably not the right tool for you.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-08-27T22:28:56.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10659" PostTypeId="2" ParentId="10656" CreationDate="2014-08-28T05:28:44.003" Score="4" Body="&lt;p&gt;If your provider (ISP) allows you to split the two into VLAN's, for example the link to your provider to be configured as a trunk interface passing Vlan 10 and VLan 20 for example then you may do this either by two physical access ports back to the router ot another trunk on the switch and sub-interfaces on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is the provider using the second IP as a secondary address? If so then this is not possible.&lt;/p&gt;&#xA;" OwnerUserId="8175" LastActivityDate="2014-08-28T05:28:44.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10660" PostTypeId="1" CreationDate="2014-08-28T05:30:52.250" Score="3" ViewCount="449" Body="&lt;p&gt;&lt;strong&gt;@edit: SOLVED!!! - See my answer below!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how's going?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario: Trunk two Switches (&lt;strong&gt;Dell 6224 and Cisco SF300&lt;/strong&gt;) for accessing them from the MGMT VLAN.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco ge2 -------TRUNK-------&amp;gt; Dell 1/g22&#xA;&#xA;Dell 1/g1 ------ACCESS-------&amp;gt; PC01&#xA;Cisco fe1 ------ACCESS-------&amp;gt; PC02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco conf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gigabitethernet2                                          &#xA; switchport trunk allowed vlan add 10-16,99,999                     &#xA;interface fastethernet1                                             &#xA; switchport mode access                                             &#xA; switchport access vlan 99 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Dell conf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ip address 10.1.99.202 255.255.255.0&#xA;    ip address vlan 99&#xA;    interface ethernet  1/g22&#xA;      switchport mode trunk&#xA;      switchport trunk allowed vlan add 99&#xA;    interface ethernet 1/g1&#xA;    switchport access vlan 99&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I can:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From PC01, reach the Dell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From PC02, reach the Cisco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to be able to run the trunk and reach any device from any device on this list, PC01 -&gt; Cisco; Dell -&gt; Cisco etc etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Att.&lt;/p&gt;&#xA;" OwnerUserId="8117" LastEditorUserId="8117" LastEditDate="2014-08-28T14:13:39.230" LastActivityDate="2014-08-28T14:13:39.230" Title="Trunking MGMT Vlan Cisco x Dell" Tags="|cisco|vlan|management|trunk|dell|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10661" PostTypeId="1" AcceptedAnswerId="10963" CreationDate="2014-08-28T06:14:58.123" Score="8" ViewCount="13055" Body="&lt;p&gt;&lt;strong&gt;Situation:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to get 802.1X working for me. I want RADIUS server to dynamically assign VLANs to ports based on RADIUS reply attribute for particular user. I have an HP E2620 switch and a FreeRADIUS server. The supplicant is a Windows 8.1 machine&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I referred to &lt;a href=&quot;http://wiki.freeradius.org/vendor/HP&quot; rel=&quot;nofollow&quot;&gt;this document&lt;/a&gt; on freeradius website.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I've done so far:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On FreeRADIUS I created a user with such parameters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dot1xtest    User-Password := &quot;secret&quot;&#xA;             Tunnel-Type = &quot;VLAN&quot;,&#xA;             Tunnel-Medium-Type = &quot;IEEE-802&quot;,&#xA;             Tunnel-Private-Group-ID = &quot;100&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also tried &lt;code&gt;Tunnel-Pvt-Group-ID&lt;/code&gt; instead, but it doesn't work on FreeRADIUS, just barks at me (I saw this on resources for configuring on Microsoft NPS, &lt;a href=&quot;http://technet.microsoft.com/en-us/library/cc754422%28v=ws.10%29.aspx&quot; rel=&quot;nofollow&quot;&gt;one of these&lt;/a&gt;)&#xA;. Also I tried values &quot;802&quot;, 802, 6 for tunnel medium type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I tried to use actual VLAN name instead of VLAN-ID as Group ID value. Anyway its datatype is string.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured the HP switch to use this RADIUS server for AAA and set this up for port 10:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa port-access gvrp-vlans&#xA;aaa authentication port-access eap-radius&#xA;aaa port-access authenticator 10&#xA;aaa port-access authenticator 10 auth-vid 150&#xA;aaa port-access authenticator 10 unauth-vid 200&#xA;aaa port-access authenticator active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;VLANs:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN 100 - VLAN which I want to get after authentication.&#xA;VLAN 150 - VLAN which I get now, because my config is not working&#xA;VLAN 200 - Unauthorized VLAN which is used on auth. failure&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Notes:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Port 10 also has untagged VLAN 150 assigned to it: &lt;code&gt;vlan 150 untagged 10&lt;/code&gt;. And I can't get rid of the static assignment&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;All VLANs listed above are present in switch's VLAN database. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Whenever I plug into this port it asks me for credentials; after I succeed with authentication it just sends me to VLAN150 and if I try to fail I get to VLAN200. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I enabled 802.1X authentication on Windows connection just like described &lt;a href=&quot;http://windows.microsoft.com/en-us/windows/enable-802-1x-authentication#1TC=windows-7&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I tried enabling GVRP - it doesn't change anything&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Diagnostic/show command output:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Static VLAN assignment for Port 10. VLAN 150 untagged&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; SW # show vlans ports 10 detail&#xA;&#xA; Status and Counters - VLAN Information - for ports 10&#xA;&#xA;  VLAN ID Name                             | Status     Voice Jumbo Mode&#xA;  ------- -------------------------------- + ---------- ----- ----- --------&#xA;  150     VLAN150                          | Port-based No    No    Untagged&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;In&lt;/em&gt; &lt;code&gt;show logging&lt;/code&gt; &lt;em&gt;I see this:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I 08/28/14 08:29:24 00077 ports: port 10 is now off-line&#xA;I 08/28/14 08:29:29 00435 ports: port 10 is Blocked by AAA&#xA;I 08/28/14 08:29:29 00435 ports: port 10 is Blocked by STP&#xA;I 08/28/14 08:29:29 00076 ports: port 10 is now on-line&#xA;I 08/28/14 08:29:29 00001 vlan: VLAN200 virtual LAN enabled&#xA;I 08/28/14 08:29:29 00435 ports: port 10 is Blocked by AAA&#xA;I 08/28/14 08:29:29 00002 vlan: UNUSED virtual LAN disabled&#xA;I 08/28/14 08:29:29 00435 ports: port 10 is Blocked by STP&#xA;I 08/28/14 08:29:29 00076 ports: port 10 is now on-line&#xA;I 08/28/14 08:29:29 00001 vlan: UNUSED virtual LAN enabled&#xA;I 08/28/14 08:29:47 00002 vlan: UNUSED virtual LAN disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show port-access authenticator&lt;/code&gt; &lt;em&gt;output:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW # show port-access authenticator&#xA;&#xA; Port Access Authenticator Status&#xA;&#xA;  Port-access authenticator activated [No] : Yes&#xA;  Allow RADIUS-assigned dynamic (GVRP) VLANs [No] : Yes&#xA;&#xA;       Auths/  Unauth  Untagged Tagged           % In  RADIUS Cntrl&#xA;  Port Guests  Clients VLAN     VLANs  Port COS  Limit ACL    Dir&#xA;  ---- ------- ------- -------- ------ --------- ----- ------ -----&#xA;  10   1/0     0       150      No     No        No    No     both&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;RADIUS user test:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Linux-server # radtest dot1xtest secret localhost 0 secretkey&#xA;Sending Access-Request of id 158 to 127.0.0.1 port 1812&#xA;        User-Name = &quot;dot1xtest&quot;&#xA;        User-Password = &quot;secret&quot;&#xA;        NAS-IP-Address = 127.0.0.1&#xA;        NAS-Port = 0&#xA;        Message-Authenticator = 0x00000000000000000000000000000000&#xA;rad_recv: Access-Accept packet from host 127.0.0.1 port 1812, id=158, length=37&#xA;        Tunnel-Type:0 = VLAN&#xA;        Tunnel-Medium-Type:0 = 802&#xA;        Tunnel-Private-Group-Id:0 = &quot;100&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;This is what I saw in TCPdump on the RADIUS server. I was capturing outgoing UDP traffic with source port 1812.&lt;/em&gt; It's what my switch gets (if it does actually, not sure how to check that...)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      Tunnel Type Attribute (64), length: 6, Value: Tag[Unused]#13&#xA;        0x0000:  0000 000d&#xA;      Tunnel Medium Attribute (65), length: 6, Value: Tag[Unused]802&#xA;        0x0000:  0000 0006&#xA;      Tunnel Private Group Attribute (81), length: 5, Value: 100&#xA;        0x0000:  3130 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Debug:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debug security radius-server&#xA;debug security port-access authenticator&#xA;debug destination buffer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that I unplugged and plugged in the cable and did &lt;code&gt;show debug buffer&lt;/code&gt; and &lt;a href=&quot;http://www.pastebucket.com/54046&quot; rel=&quot;nofollow&quot;&gt;here is the copy-paste of it&lt;/a&gt;. It's weird, nothing is said about any attributed related to VLAN.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read in a bunch of resources that if the RADIUS assigns a VLAN ID switch uses that in the first place. Then it falls back to Authorized VLAN configured for Port-Access Authenticator if authentication succeeds. If that is not present it assigns Untagged VLAN configured on the port. Why don't I get that behavior? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I kind of start to think the attribute &lt;code&gt;Tunnel-Private-Group-Id&lt;/code&gt; is not supported on these switches. It seems every resource refers to &lt;code&gt;Tunnel-Pvt-Group-Id&lt;/code&gt; instead (configuring on Microsoft). Too bad I don't have Windows Server to check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe it's firmware related? Didn't try to upgrade yet, I use RA_15_06_0009.swi and there's RA_15_14_0007.swi out there already&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just tried on a &lt;code&gt;3500yl-24G-PWR&lt;/code&gt; model and still doesn't work. So.. I'd guess, switches just don't get the config from the RADIUS server (or did I use incorrect attributes or operators?). How can I troubleshoot that?&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="2093" LastEditDate="2014-09-12T08:12:09.127" LastActivityDate="2014-09-12T10:32:24.350" Title="Regarding Dot1X dynamic VLAN assignment" Tags="|switch|vlan|radius|ieee-802.1x|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10662" PostTypeId="2" ParentId="10660" CreationDate="2014-08-28T07:38:20.463" Score="1" Body="&lt;p&gt;If the Dell switch does not support DTP, you might need to explicitly set&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;switchport mode trunk&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on the Cisco's ge2 interface.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-08-28T07:38:20.463" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10663" PostTypeId="1" CreationDate="2014-08-28T07:41:24.360" Score="5" ViewCount="1899" Body="&lt;p&gt;I have a few interfaces on my Cisco 2801 router, the interfaces are configured in different VRFs and all have the same IP address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 1.1.1.1 255.255.255.255&#xA;!&#xA;interface Loopback1&#xA; ip vrf forwarding RED&#xA; ip address 2.2.2.2 255.255.255.255&#xA;!&#xA;interface Loopback2&#xA; ip vrf forwarding BLUE&#xA; ip address 1.1.1.1 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When i use &lt;em&gt;snmpbulkget&lt;/em&gt; on my linux machine to try and get the interface information, I only get the IP of one of the interfaces. This happens with loopbacks as well as physical interfaces. Any ideas on how I can get the rest of the interfaces in this case?&#xA;Here is the the output from the &lt;em&gt;snmpbulkget&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpbulkget -v 2c -c cisco123 10.100.70.159 .1.3.6.1.2.1.4.20.1&#xA;IP-MIB::ipAdEntAddr.1.1.1.1 = IpAddress: 1.1.1.1&#xA;IP-MIB::ipAdEntAddr.2.2.2.2 = IpAddress: 2.2.2.2&#xA;IP-MIB::ipAdEntAddr.10.100.5.159 = IpAddress: 10.100.5.159&#xA;IP-MIB::ipAdEntAddr.10.111.5.45 = IpAddress: 10.111.5.45&#xA;IP-MIB::ipAdEntAddr.50.50.50.50 = IpAddress: 50.50.50.50&#xA;IP-MIB::ipAdEntIfIndex.1.1.1.1 = INTEGER: 8&#xA;IP-MIB::ipAdEntIfIndex.2.2.2.2 = INTEGER: 7&#xA;IP-MIB::ipAdEntIfIndex.10.100.5.159 = INTEGER: 1&#xA;IP-MIB::ipAdEntIfIndex.10.111.5.45 = INTEGER: 5&#xA;IP-MIB::ipAdEntIfIndex.50.50.50.50 = INTEGER: 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice that the 1.1.1.1 address only returns once.&#xA;All advice is appreciated, thanks!&lt;/p&gt;&#xA;" OwnerUserId="5329" LastEditorUserId="5329" LastEditDate="2014-08-28T07:49:10.753" LastActivityDate="2016-09-27T07:25:45.543" Title="problems retrieving duplicate IP addresses through SNMP on Cisco Routers" Tags="|cisco|snmp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10664" PostTypeId="1" CreationDate="2014-08-28T07:52:41.977" Score="8" ViewCount="1122" Body="&lt;p&gt;&lt;strong&gt;What I've got:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two 24 port switches in building A, with 2 fibre trunks from building A to building B - where there are two 48 port switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8uZBR.jpg&quot; alt=&quot;Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two 24 port switches support RSTP and STP. HP 1810-24G v2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two 48 port switches do not. HP 1810-48G v1.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I want to do:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to add a trunk between 24 Port No 1 and 24 Port No 2 (using OM3-3) so that if OM3-1 or OM3-2 become disconnected or damaged, the packets will take the alternate path to the 48 port switches in building B.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Current issue:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I add OM3-3, the switches lock up because I'm clearly creating a loop. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My Thoughts/Queries:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All switches are currently being managed on the same VLAN, which is 1080.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will that solve my issue if I set the &lt;strong&gt;management VLAN&lt;/strong&gt; on the two 24 port switches to say &lt;strong&gt;VLAN 2021&lt;/strong&gt;, and leave the 48 ports on 1080 - then tag VLAN 2021 on the trunk between 48 Port No 1 and 48 Port No 2 so the switches can see each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've had no experience with RSTP so I'm at a bit of a loss. The obvious solution is to replace the two 48 port switches with models which support RSTP and be done with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to achieve this without replacing the 48 port switches?&lt;/p&gt;&#xA;" OwnerUserId="8176" LastEditorUserId="775" LastEditDate="2014-08-28T08:42:52.207" LastActivityDate="2014-12-27T22:05:50.057" Title="RSTP Basics: Can this be done?" Tags="|spanning-tree|hp|loop|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="10666" PostTypeId="2" ParentId="10637" CreationDate="2014-08-28T09:17:34.470" Score="0" Body="&lt;p&gt;When U use a mac (Mac OS X), you could use: &lt;a href=&quot;http://www.tastycocoabytes.com/cpa/&quot; rel=&quot;nofollow&quot;&gt;cocoaPacketAnalyzer&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2693" LastActivityDate="2014-08-28T09:17:34.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10669" PostTypeId="2" ParentId="10664" CreationDate="2014-08-28T12:34:11.923" Score="-2" Body="&lt;p&gt;BPDU's should pass and one side should block, (most likely the side supporting RSTP). You can modify the port priorities to have one of the inter-building links blocking. If the 48 port switches do not support STP as long as the link between them is configured as a trunk BPDU's should pass. (access ports do not pass / process BPDU's).&lt;/p&gt;&#xA;" OwnerUserId="8175" LastActivityDate="2014-08-28T12:34:11.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10671" PostTypeId="2" ParentId="10660" CreationDate="2014-08-28T14:12:43.090" Score="3" Body="&lt;p&gt;&lt;strong&gt;@edit: SOLVED!!!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just missed the port numbers, CAN'T BELIEVE IT!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco and Dell port order numbers are different .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But well, this conf I just posted works as a charm, now I have all devices connected!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks anyway :D&lt;/p&gt;&#xA;" OwnerUserId="8117" LastActivityDate="2014-08-28T14:12:43.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10674" PostTypeId="1" AcceptedAnswerId="10675" CreationDate="2014-08-28T16:57:13.447" Score="2" ViewCount="356" Body="&lt;p&gt;I'm trying to become more familiar with DMVPN, NHRP, and mGRE. I just have one quick question regarding solutions that offer spoke-to-spoke connections:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) Why is it necessary to disable split-horizon in order to enable spoke-to-spoke connections?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time!&lt;/p&gt;&#xA;" OwnerUserId="8099" LastActivityDate="2014-08-28T17:08:39.560" Title="Split Horizon, and mGRE/NHRP" Tags="|vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10675" PostTypeId="2" ParentId="10674" CreationDate="2014-08-28T17:08:39.560" Score="5" Body="&lt;p&gt;The split horizon rule is essentially:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Don't advertise a route out of the same interface you learned it from.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With hub and spoke networks and mGRE, the hub is connected to the spokes by a single (logical) interface.  So when the hub learns a route from Spoke1, split horizon prevents advertising the route to Spoke2, because the route was learned via the same interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By disabling split horizon, the hub can advertise routes from spoke1 to spoke2.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-28T17:08:39.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10676" PostTypeId="2" ParentId="10637" CreationDate="2014-08-28T17:32:56.200" Score="1" Body="&lt;p&gt;Wireshark is your best bet. It's also free. Download it, open the pcap, click on a packet, and the very bottom window will show the entire packet in hex and ASCII.&lt;/p&gt;&#xA;" OwnerUserId="8099" LastActivityDate="2014-08-28T17:32:56.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10677" PostTypeId="2" ParentId="1713" CreationDate="2014-08-28T17:48:28.750" Score="2" Body="&lt;p&gt;For the multi-wan bridge + NAT + load balancing, it can be setup as follow :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 Create a DMZ interface&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IPv4 Configuration Type : None&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;2 Create a bridge&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Interfaces&lt;/li&gt;&#xA;&lt;li&gt;Assign&lt;/li&gt;&#xA;&lt;li&gt;Bridges&lt;/li&gt;&#xA;&lt;li&gt;Add&lt;/li&gt;&#xA;&lt;li&gt;Select WAN1, WAN2 and DMZ&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;3 Firewall rules&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unblock necessary ports and allow them in the appropriate WAN :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source : *&lt;/li&gt;&#xA;&lt;li&gt;Port : *&lt;/li&gt;&#xA;&lt;li&gt;Destination : External IP address&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;With that configuration, servers on the DMZ can now work with public IP addresses. The only drawback so far is that I can't access hosts on DMZ from LAN.&lt;/p&gt;&#xA;" OwnerUserId="1496" LastActivityDate="2014-08-28T17:48:28.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10685" PostTypeId="1" CreationDate="2014-08-29T14:23:50.097" Score="5" ViewCount="1803" Body="&lt;p&gt;I generated a CSR using CLI, then Thawte senT me certificate. I typed some commands, something went wrong, and I deleted the CSR from the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to generate new a CSR and ask Thawte for new certificate, or is it possible to restore a deleted CSR? I have ASDM access as well.&lt;/p&gt;&#xA;" OwnerUserId="7630" LastEditorUserId="8499" LastEditDate="2016-03-14T17:56:26.187" LastActivityDate="2018-11-01T01:00:20.793" Title="Identity certificate import after deleting CSR from ASA" Tags="|cisco-asa|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10687" PostTypeId="1" AcceptedAnswerId="10688" CreationDate="2014-08-29T17:04:24.200" Score="2" ViewCount="192" Body="&lt;p&gt;I'm going to buy a Cisco 1750, but its lack the ADSL WIC Module. My question is, &lt;strong&gt;can I use the AUX Port to plug my RJ11 for  DSL PPPoE Authentication?&lt;/strong&gt; Like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          Cisco 1750&#xA;ISP --- AUX ------ F0/0 --- INTERNAL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If not, will I be able to do this with a consumer dlink modem?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP --- D-LINK MODEM ---- f0/0 CISCO 1750 f0/1 ---- INTERNAL&#xA;          BRIDGED              (PPPoE Auth)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thx!&lt;/p&gt;&#xA;" OwnerUserId="8117" LastEditorUserId="775" LastEditDate="2014-08-29T18:00:23.040" LastActivityDate="2014-08-29T19:02:55.520" Title="Simple question: Cisco 1750 AUX Port as &quot;ADSL WIC&quot;" Tags="|cisco|isp|pppoe|adsl|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10688" PostTypeId="2" ParentId="10687" CreationDate="2014-08-29T17:52:09.257" Score="5" Body="&lt;p&gt;The first diagram will not work, and in fact may result in damage to your router. The AUX port is a regular RS232 serial port, which is completely incompatible with ADSL. &lt;strong&gt;Don't do it.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second diagram should work, provided your D-Link modem can operate in bridged mode.&lt;/p&gt;&#xA;" OwnerUserId="1339" LastActivityDate="2014-08-29T17:52:09.257" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10689" PostTypeId="2" ParentId="10687" CreationDate="2014-08-29T19:02:55.520" Score="4" Body="&lt;p&gt;Except the 1750 only has &lt;strong&gt;one&lt;/strong&gt; fastethernet port. A WIC-1ENET is 10m, WIC-4ESW a 4 port switch... but they both live on the WIC bus that'll top out about 6-8m.  Depending on your DSL speed, this may not be a problem.  I use a WIC-1ADSL (and WIC-4ESW) in a 1720, but the DSL line is 6m anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(and neither the 1720 nor 1750 support dot1q; that's a feature of the 17x1 line.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-29T19:02:55.520" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10691" PostTypeId="2" ParentId="10664" CreationDate="2014-08-29T19:45:29.163" Score="2" Body="&lt;p&gt;RSTP is completely interoperable with STP. as per standards RSTP enabled port will go STP when connected to an STP enabled network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume the older 1810 switches support STP and the 1810-v2 switches support RSTP, So in your setup the loop prevention should work fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do config check on all switches to ensure they have the STP or RSTP enabled at switch level (global) as well as at port level.&lt;/p&gt;&#xA;" OwnerUserId="8201" LastEditorUserId="8201" LastEditDate="2014-08-29T20:00:24.927" LastActivityDate="2014-08-29T20:00:24.927" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10692" PostTypeId="2" ParentId="10552" CreationDate="2014-08-29T19:48:59.783" Score="-1" Body="&lt;p&gt;As Pyatka stated, it looks like your interface is overutilized. That's why you're getting overruns and throttles.&#xA;Start monitoring interface traffic, not just errors. Your interface thinks it's being overutilized? Monitor to prove it.&#xA;Start monitoring CPU usage as well. Your interface might be acting like it's overloaded because the CPU is being overutilized.&#xA;Start logging everything! &quot;logging buffered 7&quot;, then &quot;logging buffered &amp;lt;~50% of the free space determined in 'dir' command&gt;&quot; is what I'd do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check &quot;show processes cpu history&quot; and see if you see spikes, see if you can match the pattern of CPU use with the pattern of errors.&#xA;(Note, the history graphs start with MOST-RECENT on the LEFT of the chart, NOT THE RIGHT. This can be very confusing!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can discern a pattern from all this... log in when it happens!! Show procs, show ints, show logs, check everything. Nothing's quite like seeing the issue &quot;in the wild.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for speed/duplex, we've found speed and duplex being hard-set on both ends is the best bet; since you've already stated you've done auto and hard-set, duplex probably isn't your issue. I'm not seeing errors in the patterns you'd really expect for a duplex mismatch anyway, though it's always an option. You might turn on CDP for giggles and do a &quot;sh cdp neighbors detail&quot; for giggles to see what the other end is advertising itself to CDP as. I don't think they're your issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-08-29T19:48:59.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10693" PostTypeId="1" AcceptedAnswerId="10777" CreationDate="2014-08-29T19:54:40.107" Score="5" ViewCount="653" Body="&lt;p&gt;Looking for guidance on network topology changes. Currently our network has 2 different stacks of switches running in layer 2. These switches then connect to a stack of layer 3 switches to do internal routing before hitting our router to the outside world. (See diagram below)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are looking to implement a Lantronix xPrintServer to print using AirPrint. The problem that we are facing is that we can only see the printers on one side of the building. If we connect the xPrintServer to the East side of the building any iOS devices connected on that side of the building work until you walk to the West side. My thoughts on this are that the layer 3 switch is blocking the traffic from getting to the other stack of switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a network design standpoint is it better to join all layer 2 switches to a single layer 2 switch before connecting to a layer 3 switch? Or would our current setup be the preferred method and we just have it configured incorrectly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current Topology:&#xA;(MDF is on East side of building and IDF is on West side of building)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/LB04n.jpg&quot; alt=&quot;Current Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLANS 10-15 are available across all switches.&lt;/li&gt;&#xA;&lt;li&gt;xPrintServer is in VLAN 11 which is where all of the clients that would be using it are located.&lt;/li&gt;&#xA;&lt;li&gt;We currently not attempting to traverse across subnets. We are only wanting to stay on VLAN 11. When we are connected to the IDF(West) side of the building we no longer have AirPrint, but if we are on the MDF(East) side of the building everything works fine.&lt;/li&gt;&#xA;&lt;li&gt;Uplink ports to core switch from MDF and IDF are actually 10G links and they are setup in port channels.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3449" LastEditorUserId="3449" LastEditDate="2014-09-02T11:35:08.683" LastActivityDate="2014-09-03T16:02:41.203" Title="Network topology suggestions?" Tags="|routing|switch|layer2|layer3|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10695" PostTypeId="2" ParentId="10693" CreationDate="2014-08-29T20:26:36.083" Score="4" Body="&lt;p&gt;The problem you are experiencing is due to the fact that mDNS (Bonjour/Multicast DNS used by Apples printer discovery protocol) does not traverse across subnets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three possible options I can think of:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;To allow your iOS devices on a separate subnet to see the AirPrint printers, you'll need to allow multicast packets to traverse the subnets on the L3 switch. mDNS is a multicast UDP packet to port 5353. There are routers will allow multicast forwarding, this is normally complex configuration and might/might-not be supported by specific Dell switches.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;there are specialized print servers available in market which have a way to support AirPrint across networks (requires client side software to be installed). For example - &lt;a href=&quot;http://mobile.eurosmartz.com/downloads.html&quot; rel=&quot;nofollow&quot;&gt;Weprint&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can have a single VLAN across all the switches to support natural AirPrint. Might not be an ideal network design, but might be most practical in your scenario.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8201" LastEditorUserId="3191" LastEditDate="2014-09-02T11:42:38.110" LastActivityDate="2014-09-02T11:42:38.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10696" PostTypeId="1" AcceptedAnswerId="10702" CreationDate="2014-08-29T20:28:19.427" Score="3" ViewCount="499" Body="&lt;p&gt;I want to know if there is an option to have two DHCP servers with one pool.&#xA;The reason for this unorthodox is,&#xA;I have two router in remote locations on the same LAN (10.0.0.0)&#xA;And sometimes, the main router is down, and I cannot reboot it for sometime.&#xA;But I want to be able to still use the network with the router that is up but not running DHCP and therefore new devices cannot join in.&#xA;I can't create two lans because one of my routers does not support WAN.&#xA;Thank you :-)&lt;/p&gt;&#xA;" OwnerUserId="8204" LastActivityDate="2014-08-29T21:18:38.980" Title="2 dhcp server with one pool" Tags="|dhcp|lan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10699" PostTypeId="2" ParentId="10696" CreationDate="2014-08-29T20:52:16.543" Score="3" Body="&lt;p&gt;Not unless you want address overlaps. While everything is connected, &lt;code&gt;ping&lt;/code&gt;'s from each server should verify the validity of the address it's handing out, but as soon as the networks are isolated, each server is very likely to be handing out the same address. And the clients using the &quot;remote&quot; DHCP server will likely lose their address (as they'll have to bind to the other server.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR; You're asking for a mess.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-29T20:52:16.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10700" PostTypeId="2" ParentId="10632" CreationDate="2014-08-29T21:00:03.580" Score="3" Body="&lt;p&gt;The most recent update on my question was, indeed, the solution.  It seems we had a few bad installs of LAN School on some (maybe all) of the laptops, and as soon as we updated it to the newest released version the problem disappeared entirely.  Any time we see ICMPv6 traffic, sure enough, there is another laptop without the most up to date version of the software.  Immediately upon updating it to the newest version, the ICMPv6 packets disappear again and we end up back to 0 ICMPv6 packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@RickyBeam Another update.  The issue went away for a while, then just came back again yesterday afternoon.  After more testing, it is a UBNT issue.  We are putting our old HP Procurve wireless back in tonight.  It remedies the problem entirely.  This is the second time we have had to remove the Unifi product from our network.&lt;/p&gt;&#xA;" OwnerUserId="2670" LastEditorUserId="2670" LastEditDate="2014-09-16T19:16:32.430" LastActivityDate="2014-09-16T19:16:32.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10702" PostTypeId="2" ParentId="10696" CreationDate="2014-08-29T21:18:38.980" Score="3" Body="&lt;p&gt;Yes, you can do this if you do it properly and your devices allow it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the DHCP, what I would normally do to avoid problems is use a larger then necessary subnet, such as a /23 when you only need a /24.  Then you assign half of the network to one device's scope, and the other half to the second device.  This way there is no overlap between the IP addresses managed by the two DHCP servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the trick you haven't mentioned is what happens when the main router goes down but is configured as the default gateway for most devices.  Without something like VRRP or HSRP to share an IP address between your two routers, this becomes a challenge.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-08-29T21:18:38.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10704" PostTypeId="1" AcceptedAnswerId="10716" CreationDate="2014-08-29T21:31:29.427" Score="4" ViewCount="1572" Body="&lt;p&gt;I'm trying to configure a Cisco 886VA router to use a full-duplex fiber cable modem for internet access. The modem (Alcatel-Lucent) is pre-programmed and doesn't support DHCP (192.168.1.0/24, gateway 192.168.1.1).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modem is connected to FastEthernet0/0 while the internal LAN is configured at FastEthernet0/1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone help me out with the necessary configuration steps, please?&lt;/p&gt;&#xA;" OwnerUserId="8207" LastActivityDate="2016-03-31T05:09:08.453" Title="Configuring a Cisco router behind a fiber cable modem" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10705" PostTypeId="1" AcceptedAnswerId="10707" CreationDate="2014-08-29T21:58:12.913" Score="3" ViewCount="308" Body="&lt;p&gt;We have 20 location and about 150 laptop clients, each location has Cisco WLC 5508. Right now everyone is using same password which is individually configured on all WLCs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any management software that allows to set WiFi password automatically on all laptops remotely?&#xA;- I do not want users to use their windows credentials (so they do not connect phones)&#xA;- Users are not allowed to know the password (same reason) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ideal is: &#xA;- I configure username/password in ACS&#xA;- I somehow send (set) username/password (from ACS) on user PCs (THAT IS THE PROBLEM)&#xA;- User connects to a network (if user is in WiFi group in AD and authenticated through ACS).&lt;br&gt;&#xA;- if i decide to change network password, I update wifi credentials in ACS and all users get this updated credentials on their laptops. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now every time we change the password we go through headache of updating it for users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&#xA;Thanks for our reply. I was thinking about this and actually configured machine based authentication. And it works through PEAP. Then I though what if someone who not suppose to have wifi access logs in to that laptop (since employees always leave laptops laying on a table unattended). I tried to find a way to perform Machine AND User authentication, but could not find a solution, unless I add all laptops to ACS and create host group and then use User authentication through PEAP. I was thinking more about 2 step process. Step 1: A software or hardware (WHAT I NEED) that takes care of credentials for the device and saves it (lets say only laptops have credentials for WiFi)  Step 2:  ACS checks against allowed users in AD group, time, location, etc.   P.S. May be I want too much, but I think there should be a solution. &lt;/p&gt;&#xA;" OwnerUserId="2024" LastEditorUserId="2024" LastEditDate="2014-08-30T00:22:42.603" LastActivityDate="2014-08-30T00:33:24.890" Title="Manage Wifi clients" Tags="|cisco|wireless|wlc|radius|cisco-wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10706" PostTypeId="2" ParentId="10705" CreationDate="2014-08-29T22:16:26.320" Score="0" Body="&lt;p&gt;Haven't messed around with OUs in AD for some time but if I recall correctly, you could update the passwords on all windows clients with Group Policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would seriously test this before deploying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick google search showed many links and howtos.&#xA;&lt;a href=&quot;http://www.techrepublic.com/blog/the-enterprise-cloud/change-local-username-and-password-via-group-policy/&quot; rel=&quot;nofollow&quot;&gt;http://www.techrepublic.com/blog/the-enterprise-cloud/change-local-username-and-password-via-group-policy/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2014-08-29T22:16:26.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10707" PostTypeId="2" ParentId="10705" CreationDate="2014-08-30T00:06:59.270" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I do not want users to use their windows credentials (so they do not connect phones) - Users are not allowed to know the password (same reason)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you mentioned Windows and ACS, you can still use user &lt;strong&gt;credentials via dot1X&lt;/strong&gt; and not allow them to connect via phones.  As long as you're doing &lt;strong&gt;Machine auth in ACS&lt;/strong&gt; and requiring computer authentication in Windows in the wireless profile, then only computers joined to your AD domain tied to ACS would be allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/afg4Z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/afg4Z.png&quot; alt=&quot;ACS Machine Access Restrictions&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Windows wireless profile, under &lt;em&gt;Advanced Settings&lt;/em&gt;, the &lt;em&gt;authentication mode&lt;/em&gt; would be &quot;User or computer authentication&quot;.  This setting is poorly named as it can be both user and computer authentication.  When Windows is started but before user login, and assuming an existing wireless profile, computer authentication takes place with the computer account tied to AD.  After a user login, then another dot1X AuthN event takes place with the user account.  The time between the computer AuthN and the user AuthN must be in the window specified by the Aging time in the ACS Machine Access Restrictions shown above or the user AuthN will repeatedly fail.  I keep this aging time wide to prevent issues, and this obviously needs to mirror your security tolerance for your org.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gciwa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gciwa.png&quot; alt=&quot;Windows wirless profile computer-user AuthN&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="775" LastEditDate="2014-08-30T00:33:24.890" LastActivityDate="2014-08-30T00:33:24.890" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10708" PostTypeId="1" CreationDate="2014-08-30T01:26:43.657" Score="2" ViewCount="1396" Body="&lt;p&gt;In my network journey, I'm studying static routes now (I know that isn't used in large environments, but just studies).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made this topology in GNS3, and I'm wondering if some points are correct.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/qzyHA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: The &lt;em&gt;.x&lt;/em&gt; are the IP of the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routing tables are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**R1**&#xA;     172.16.0.0/24 is subnetted, 1 subnets&#xA;C       172.16.1.0 is directly connected, FastEthernet0/0&#xA;     10.0.0.0/30 is subnetted, 2 subnets&#xA;S       10.0.0.0 [1/0] via 10.0.1.2&#xA;C       10.0.1.0 is directly connected, FastEthernet1/0&#xA;C    192.168.1.0/24 is directly connected, FastEthernet0/1&#xA;S    192.168.2.0/24 [1/0] via 10.0.1.2&#xA;S    192.168.3.0/24 [1/0] via 10.0.0.2&#xA;&#xA;&#xA;**R2**&#xA;     10.0.0.0/30 is subnetted, 2 subnets&#xA;C       10.0.0.0 is directly connected, FastEthernet0/0&#xA;C       10.0.1.0 is directly connected, FastEthernet1/0&#xA;S    192.168.1.0/24 [1/0] via 10.0.1.1&#xA;C    192.168.2.0/24 is directly connected, FastEthernet0/1&#xA;S    192.168.3.0/24 [1/0] via 10.0.0.2&#xA;&#xA;&#xA;**R3**&#xA;     10.0.0.0/30 is subnetted, 2 subnets&#xA;C       10.0.0.0 is directly connected, FastEthernet0/0&#xA;S       10.0.1.0 [1/0] via 10.0.0.1&#xA;S    192.168.1.0/24 [1/0] via 10.0.1.1&#xA;S    192.168.2.0/24 [1/0] via 10.0.0.1&#xA;C    192.168.3.0/24 is directly connected, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm wondering, for the R3 to reach the subnet 192.168.1.0, I do need to specify static routes for &lt;strong&gt;10.0.1.0/30 AND 192.168.1.0?&lt;/strong&gt;. Same goes for the R1 reach 192.168.3.0... Is this the way it works?&lt;/p&gt;&#xA;" OwnerUserId="8117" LastActivityDate="2014-08-30T06:10:06.543" Title="Learning Static Route: Is this correct?" Tags="|cisco|gns3|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10709" PostTypeId="2" ParentId="10158" CreationDate="2014-08-30T01:32:59.150" Score="0" Body="&lt;p&gt;Log into the admin context to see the number of interfaces, or use Cisco ASDM if you are a novice with the ASA, it will provide you with a good view of the configuration and performance.&lt;/p&gt;&#xA;" OwnerUserId="8175" LastActivityDate="2014-08-30T01:32:59.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10710" PostTypeId="2" ParentId="10708" CreationDate="2014-08-30T01:40:26.517" Score="0" Body="&lt;p&gt;This is one way to do it however not best practice, two things;&#xA;1/ If your router only has one connection outside of its LAN side in your case R3 only has fa0/0 which is connected to 10.0.0.0/30. You can just have a static default route 0.0.0.0 0.0.0.0 pointing to the next hop of 10.0.0.1 on R2. Treat R3 as a stub unless you add more interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2/ the static route you have configured: S    192.168.3.0/24 [1/0] via 10.0.0.2 should NEVER be used in real environment, pointing a static route to a local IP address rather than a directly connected next-hop will cause excessive ARP, each time a packet is sent out this interface in turn resulting in high CPU. Might not see this in GNS3 as it is all software processed in CPU anyway but on a real router (if Cisco) this will not be CEF switched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also as you said so many static routes is not a good idea, if you want to advertise your LAN networks just use a routing protocol...&lt;/p&gt;&#xA;" OwnerUserId="8175" LastActivityDate="2014-08-30T01:40:26.517" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10711" PostTypeId="2" ParentId="10708" CreationDate="2014-08-30T06:10:06.543" Score="3" Body="&lt;p&gt;If your plan is to replicate the insanity of a dynamic routing protocol, then you're well on your way. :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No &lt;em&gt;sane&lt;/em&gt; network engineer would ever add static routes to non-local endpoints. Your 192.168.3.0/24 on R1, for example, is routed to 10.0.0.2, which is not connected to it. In order to install that route in the table, a route to 10.0.0.2 (10.0.0.0/30) must exist. This just makes reading your config a pain. The router will make multiple passes over the RIB to build the active route table. (in this case, it'll sync in a fraction of a second.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Textbook answer: &lt;em&gt;The next-hop must be reachable for the route to be installed.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Dynamic routing protocols may do this for other reasons. Humans tend to avoid it because it generates real headaches.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-30T06:10:06.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10712" PostTypeId="1" AcceptedAnswerId="10714" CreationDate="2014-08-30T07:46:45.113" Score="5" ViewCount="1354" Body="&lt;p&gt;I have a Brocade FESX648-PREM switch that is currently connected to an IXP and a single upstream transit provider. This switch accepts the default route via BGP from the transit provider. I announce a few prefixes to the transit provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to add another uplink of equal speed from a second transit provider to multi-home. However, my switch is not able to accept the full routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be possible to accept a default route from the second transit provider as well as the first provider? What sort of configuration would I need to load balance between the two uplinks? It seems to me that two static default routes with equal weight could work... but I'm not certain.&lt;/p&gt;&#xA;" OwnerUserId="8209" LastEditorUserId="8209" LastEditDate="2014-08-30T18:55:46.260" LastActivityDate="2014-08-30T18:55:46.260" Title="Load balancing between two default routes" Tags="|bgp|brocade|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10714" PostTypeId="2" ParentId="10712" CreationDate="2014-08-30T09:38:20.230" Score="4" Body="&lt;p&gt;No, that won't work that way. Your switch will select one of those two as default, most likely the one with the lowest IP address. One way to solve this is of course buy a real router capable of handling two full feeds, but there are other solutions which may work. You could ask both your transit providers to announce the default route as two /1's or four /2's (etc). That way you can use local preferences to prefer parts of the routing table via each provider. Of course, load balancing based on prefixes is no guarantee that you're actually balacing traffic ratios evenly.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-08-30T09:38:20.230" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10715" PostTypeId="1" AcceptedAnswerId="10727" CreationDate="2014-08-30T11:12:17.563" Score="18" ViewCount="25453" Body="&lt;p&gt;I am searching for this answer for quite some time now. Why there is CSMA/CD in LAN but CSMA/CA in WLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best explanation I could find is &quot;due to extreme ratio in transmitting and receiving power, it is very impractical to transmit data on the same channel. Hence collision avoidance is used&quot;. Couldn't get the meaning. Even if you're using two separate channels for transmit and receive, CSMA is used to decide which node will use channel, so no point in dropping CD in place of CA. So this explanation somehow doesn't seem fit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only reason I could think of is that if number of nodes are low, hence chances of collision is low, we should use CD, if chances of collision are high, we should use CA. But there isn't a difference of number of users between LAN and WLAN.&lt;br&gt;&#xA;If someone could please explain.&lt;/p&gt;&#xA;" OwnerUserId="8212" LastEditorUserId="775" LastEditDate="2014-08-31T22:01:19.577" LastActivityDate="2022-11-11T10:04:42.347" Title="Why does WLAN use Collision Avoidance and not Collison detection?" Tags="|wireless|protocol-theory|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10716" PostTypeId="2" ParentId="10704" CreationDate="2014-08-30T14:20:59.010" Score="4" Body="&lt;p&gt;From what I understand, the modem has the internal IP is 192.168.1.1 .. If that is correct, then this is pretty simple on the router ..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;from the CLI, apply the following and it should work with you ...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;  int FastEthernet0/0&#xA;    ip address 192.168.1.2 255.255.255.0&#xA;    speed 100&#xA;    duplex full&#xA;    exit&#xA;  ip route 0.0.0.0 0.0.0.0 192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let me explain the commands ...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This allows you to access the route configuration mode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This enters the interface configuration mode, in this case the interface is &lt;code&gt;FastEthernet0/0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address 192.168.1.2 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This adds a static IP Address of &lt;code&gt;192.168.1.2&lt;/code&gt; to the interface &lt;code&gt;FastEthernet0/0&lt;/code&gt; to be in the same subnet of the modem (&lt;code&gt;192.168.1.0/24&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;speed 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This enabled the interface to use the speed &lt;code&gt;100 MB&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;duplex full&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This enables the interface to use full duplex&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This adds a default route which informs the router to send all traffic that is not found in the routing table to the modem &lt;code&gt;192.168.1.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this scenario won't work, because the 192.168.1.0/24 is a private range and doesn't propagate over the internet .. The best thing is to change the modem mode to &lt;code&gt;bridge&lt;/code&gt; this allows the router to have an IP in the same subnet of the ISP which allows you to have internet access ...&lt;/p&gt;&#xA;" OwnerUserId="3377" LastEditorUserId="15305" LastEditDate="2016-03-31T05:09:08.453" LastActivityDate="2016-03-31T05:09:08.453" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10717" PostTypeId="2" ParentId="10715" CreationDate="2014-08-30T14:40:54.843" Score="4" Body="&lt;p&gt;&lt;strong&gt;EDIT(Based on Ricky's correction):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below  is a excerpt from&#xA;&lt;a href=&quot;http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Linux.Wireless.mac.html&quot; rel=&quot;nofollow&quot;&gt;http://www.hpl.hp.com/personal/Jean_Tourrilhes/Linux/Linux.Wireless.mac.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;CSMA/CA is derived from CSMA/CD (Collision Detection), which is the base of Ethernet. The main difference is the collision avoidance: on a wire, the transceiver has the ability to listen while transmitting and so to detect collisions (with a wire all transmissions have approximately the same strength). But, even if a radio node could listen on the channel while transmitting, the strength of its own transmissions would mask all other signals on the air. So, the protocol can't directly detect collisions like with Ethernet and only tries to avoid them.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The link below is good read on CSMA/CA and also explains how CSMA/CA works:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www2.cs.uidaho.edu/~oman/SC&amp;amp;CI/CSMA-CA-collisions_Bonaventure.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www2.cs.uidaho.edu/~oman/SC&amp;amp;CI/CSMA-CA-collisions_Bonaventure.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7596" LastEditorUserId="7596" LastEditDate="2014-08-31T12:39:47.000" LastActivityDate="2014-08-31T12:39:47.000" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10719" PostTypeId="1" AcceptedAnswerId="10720" CreationDate="2014-08-31T01:22:43.383" Score="0" ViewCount="91" Body="&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can the dedicated nature of the ethernet service makeup for it's lower nominal link speed? If so, how significantly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, I'm comparing 150/20 Mbps w/ phone service from a cable company with a slightly more expensive 10/10 Mbps w/ phone service from a B2B business ethernet company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our primary usages, in order of importance, are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A web app used to manage all customer data (tons of small AJAX requests)&lt;/li&gt;&#xA;&lt;li&gt;Up to two HD video streams (YouTube or Netflix) for business use. (Entertaining children, and Digital Signage)&lt;/li&gt;&#xA;&lt;li&gt;Online backup (almost-real-time file share backups, nightly server backup)&lt;/li&gt;&#xA;&lt;li&gt;Customer and off-the-clock-staff web access (≤40 users browsing the internet, several using streaming video services.)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="6368" LastActivityDate="2014-08-31T01:39:08.043" Title="How to Compare Dedicated Ethernet with Shared Cable Service" Tags="|isp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10720" PostTypeId="2" ParentId="10719" CreationDate="2014-08-31T01:39:08.043" Score="3" Body="&lt;p&gt;Assuming the providers actually deliver what they advertise (A very big assumption), then no, the cable service would provide higher bandwidth for your apps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question to ask each of these providers is what service level agreements they offer, and what escalation procedures they have when your service is degraded.  It may be the case that the slower ethernet service has a higher guaranteed uptime than the cable service.  Then it's a matter of deciding what the reliability value is to your business.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-08-31T01:39:08.043" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10721" PostTypeId="1" AcceptedAnswerId="10731" CreationDate="2014-08-31T02:38:48.843" Score="1" ViewCount="2286" Body="&lt;p&gt;I've configured my pfSense router with two bridged WAN to a DMZ (OPT2). Everything is fine to access web server from external with public IP directly on servers behind DMZ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup is pretty much the same as : &lt;a href=&quot;http://doc.m0n0.ch/handbook/examples-filtered-bridge.html&quot; rel=&quot;nofollow&quot;&gt;http://doc.m0n0.ch/handbook/examples-filtered-bridge.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only bad thing, I can't access these web servers from behind the LAN (which is NATed). Exactly as described in the same example : &lt;a href=&quot;http://doc.m0n0.ch/handbook/faq-bridge.html&quot; rel=&quot;nofollow&quot;&gt;http://doc.m0n0.ch/handbook/faq-bridge.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking about having two routers (one bridge and one NAT) because I have 8 IPs for each WAN so it could be possible. But this is not interresting, is there any other turn arround?&lt;/p&gt;&#xA;" OwnerUserId="1496" LastEditorUserId="1496" LastEditDate="2014-08-31T20:35:45.830" LastActivityDate="2014-08-31T20:41:15.883" Title="Can't access Bridged DMZ IP's from NATed LAN" Tags="|nat|bridge|pfsense|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10723" PostTypeId="2" ParentId="10715" CreationDate="2014-08-31T09:20:28.150" Score="20" Body="&lt;p&gt;Avoidance is used for the very simple fact that every radio (&quot;client&quot;) is not necessarily in range of each other. Thus, without the AP coordinating who can talk, distant radios may step on each other because they cannot know the other is transmitting.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-08-31T09:20:28.150" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10727" PostTypeId="2" ParentId="10715" CreationDate="2014-08-31T14:30:04.013" Score="20" Body="&lt;p&gt;In a wired CSMA/CD Ethernet environment, it is possible to detect a collision because there are separate TX and RX pairs (using the example of 10BaseT).  If a half-duplex 10BaseT NIC sends a frame on the TX pair, but sees that frame is corrupted on the RX pair, the NIC detected a collision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, with an 802.11 wireless device, there are no &quot;conductors,&quot; just antennas which do not simultaneously transmit and receive.  When an 802.11 device is transmitting it cannot in practical terms listen for another signal transmitting at the same time on the same frequency. The reason for this is that RF signal strength drops off very quickly when transmitting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if we built an imaginary WiFi device that could simultaneously receive and transmit, it will only be able to hear a downstream collision if the other device is using a much higher output power (either raw power or through passive/active gain of some sort).  Normally its own TX signal will be too strong and &quot;drown&quot; out any other received signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So another process was required, resulting in the need for CSMA/CA.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="775" LastEditDate="2014-08-31T22:14:00.763" LastActivityDate="2014-08-31T22:14:00.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10731" PostTypeId="2" ParentId="10721" CreationDate="2014-08-31T20:41:15.883" Score="1" Body="&lt;p&gt;Finally by trial and error I've found a solution, I don't know if this is the &lt;em&gt;state of the art&lt;/em&gt; solution, but it is working perfectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 Create a new Gateway&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Systems &gt; Routing &gt; Gateways&lt;/li&gt;&#xA;&lt;li&gt;Add Gateway&lt;/li&gt;&#xA;&lt;li&gt;Select the interface that is your DMZ&lt;/li&gt;&#xA;&lt;li&gt;Give a name and leave without IP (dynamic)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;2 Create Firewall Rules&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Firewall &gt; Rules &gt; LAN&lt;/li&gt;&#xA;&lt;li&gt;Create a rule before default LAN with source : any, destination : single host with Bridged IP, advanced feature gateway : The gateway you created.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've created a rule for each bridged IP, since I don't bridge all IPs I've done it so.&lt;/p&gt;&#xA;" OwnerUserId="1496" LastActivityDate="2014-08-31T20:41:15.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10734" PostTypeId="1" CreationDate="2014-09-01T08:52:29.620" Score="1" ViewCount="120" Body="&lt;p&gt;Naturally, Wi-Fi devices (access points, client adapters) receive frames that were sent on an adjacent channel as these overlap, i.e., they 'see' frames that were sent on a channel that the device itself is not operating on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I made the observation that they react differently: &#xA;Hardware access points discard/drop/ignore all these frames. Client hardware (particilary a Wi-Fi adapter under Linux) does not ignore such frames but passes them to higher layers (i.e., it treats such frames as if they were sent on the 'correct' channel). This seems to happen to all types of access points and all Wi-Fi chipsets/drivers on the client side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain, why this is the case? Is different hardware (i.e., Wi-Fi chipset) used to construct APs or client adapters? Does the AP's firmware implement something that standard Wi-Fi chipset's firmware does not implement? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hint is greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="8233" LastActivityDate="2014-09-01T08:52:29.620" Title="How do Wi-Fi access points discard frames on adjacent channels?" Tags="|wireless|frame-relay|hardware|mac|packet-path|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10737" PostTypeId="2" ParentId="9675" CreationDate="2014-09-01T15:58:58.390" Score="1" Body="&lt;p&gt;The short answer is no, it does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 802.11 standard and it's amendments are developed and maintained by the &lt;a href=&quot;http://www.ieee.org/&quot; rel=&quot;nofollow&quot;&gt;IEEE&lt;/a&gt;.  802.11ac is &quot;Very High Throughput&quot; standard amendment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wi-Fi Direct is a standard developed by the &lt;a href=&quot;http://www.wi-fi.org/&quot; rel=&quot;nofollow&quot;&gt;Wi-Fi Alliance&lt;/a&gt; for which they also provide certification.  This organization was originally formed to test and certify devices as adhering to certain aspects of the IEEE standards.  This was done to provide a level of assurance to consumers that devices would be able to interoperate.  It is a voluntary certification process and they can test and provide certification for a number of aspects of wireless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the longer answer is that Wi-Fi Direct is not a standard created or maintained by the IEEE and as such there are no current plans to incorporate it into any IEEE standard officially.  If it were to be included in the future, it would become the basis for an amendment and go through the normal process any amendment goes through to get approved by the IEEE.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-01T15:58:58.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10738" PostTypeId="2" ParentId="9634" CreationDate="2014-09-01T16:47:42.977" Score="2" Body="&lt;p&gt;What you describe is actually similar to the way that Meru Networks enterprise wireless works.  The controllers actually attempt to determine the best AP and move the station assignment between APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The detractors of this approach will point out that 802.11 doesn't always lend itself to this design.  While the system may determine that a certain AP is &quot;best,&quot; there is no way it can actually determine the conditions where the client is actually located.  This is born out by many wireless troubleshooting tools where most professionals will tell you you need to run them as close to where the clients are to gather the correct information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I see flaws on both sides, as the client also can't determine conditions at the AP location so is just as likely to select the wrong AP itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, 802.11 is always advancing and improving, especially when it comes to sharing information between station/network and faster roaming.  Several amendments of note in this aspect are 802.11k, 802.11r, and 802.11v which have all been approved and rolled up in the 802.11-2012 maintenance release.  Two additional amendments going through the approval process are 802.11ai and 802.11aq.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-09-01T18:53:19.477" LastActivityDate="2014-09-01T18:53:19.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10739" PostTypeId="1" CreationDate="2014-09-01T19:03:59.200" Score="1" ViewCount="1222" Body="&lt;p&gt;How can I manually configure DHCP to give a certain IP address to a specific MAC address in Cisco Packet Tracer?  I know how to configure DHCP, but I don't know the configuration which is used give an IP address to a specific MAC.&lt;/p&gt;&#xA;" OwnerUserId="8241" LastEditorUserId="8499" LastEditDate="2018-03-19T19:06:14.890" LastActivityDate="2018-03-19T19:06:14.890" Title="How to Configure DHCP to Assign a Specific IP Address to a MAC Address in IOS" Tags="|cisco|cisco-ios|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10740" PostTypeId="2" ParentId="10739" CreationDate="2014-09-02T00:56:59.593" Score="4" Body="&lt;p&gt;Simple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool (hostname)&#xA;   host (ip address) (netmask)&#xA;   hardware-address (mac)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-09-02T00:56:59.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10741" PostTypeId="1" AcceptedAnswerId="10742" CreationDate="2014-09-02T03:00:04.540" Score="1" ViewCount="108" Body="&lt;p&gt;Is &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;deny tcp any host 1.1.0.0 0.0.255.255&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;correct,when I want to block access to the 1.1.0.0/16 subnet for any host on the LAN?&lt;/p&gt;&#xA;" OwnerUserId="8242" LastActivityDate="2014-09-02T03:20:08.983" Title="what is the correct syntax for denying tcp connections to a subnet (cisco)?" Tags="|cisco|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10742" PostTypeId="2" ParentId="10741" CreationDate="2014-09-02T03:20:08.983" Score="2" Body="&lt;p&gt;Presuming it is an ASA/FWSM it is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;deny tcp any 1.1.0.0 255.255.0.0 [log]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The log portion is optional depending on the version being run. Specifying &quot;host&quot; would only be if you are going to specify access to be denied to a single host, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;deny tcp any host 1.1.1.1 [log]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3732" LastActivityDate="2014-09-02T03:20:08.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10743" PostTypeId="1" CreationDate="2014-09-02T04:02:44.143" Score="1" ViewCount="310" Body="&lt;p&gt;Bridge forwards frames between PCs based on S/W.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch forwards frames between PCs based on H/W.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does S/W  and  H/W mean?&lt;/p&gt;&#xA;" OwnerUserId="8243" LastEditorUserId="33" LastEditDate="2014-09-02T16:57:20.850" LastActivityDate="2014-09-02T16:57:20.850" Title="Bridges and switches" Tags="|switch|bridge|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10744" PostTypeId="2" ParentId="10743" CreationDate="2014-09-02T06:25:51.620" Score="2" Body="&lt;p&gt;Bridge and switches are the same things, marketing make the difference, so bridge was not fancy and switch was cool about 20 yeas ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMHO Daniel is right about interpretation of s/w &amp;amp; .h/w&lt;/p&gt;&#xA;" OwnerUserId="8244" LastEditorDisplayName="user2084" LastEditDate="2014-09-02T09:50:56.063" LastActivityDate="2014-09-02T09:50:56.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10746" PostTypeId="2" ParentId="10743" CreationDate="2014-09-02T09:03:28.610" Score="4" Body="&lt;p&gt;Matt, good question!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bridge and switch are almost same things. Bridge, now(in 2014 ;-), is a basic function of the ever modern OS, so this is software. Lets look on bridge architecture(bridge operations are described in ieee 802.1D), bridge must have:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;forwarding proccess, forwards frames.&lt;/li&gt;&#xA;&lt;li&gt;learning proccess, writes incoming frames source addresses to the fitering database&lt;/li&gt;&#xA;&lt;li&gt;filtering database, holds info about what host can be found behind what interface, used by forwarding proccess.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All this operations are uses CPU, which is shared by another OS proccesses, this is an important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what is typical switch? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch, as usual, have multiple (!)different type(!) processors: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CPU(one or multiple on &quot;big&quot; enterprise\isp swithces), which is do switch OS management operations. &lt;/li&gt;&#xA;&lt;li&gt;And few specialized proccessors - ASICs(one ASIC on each 4-12 ports, depends from vendor policy, switch type, ports bandwidth), which are can &quot;only&quot; forwards frames, but some switches(enterprise) can modify frames, build smart queues, etc. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, when switch forwards frame, it is uses just ASIC, and in theory, CPU can be overloaded, but switching will works fine. ASICs and CPU are separated, ASICs even haves own superfast memory(CPU have typical RAM). When you are send configuration command to your switch oven ssh\telnet, CPU recieve commands from ssh\telnet process, and send them to the ASICs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches architecture is very complex, and it is vendor-specific, IMHO, modern switch this is true-engineering-excellence.&lt;/p&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="3478" LastEditDate="2014-09-02T09:50:03.037" LastActivityDate="2014-09-02T09:50:03.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10747" PostTypeId="1" AcceptedAnswerId="10764" CreationDate="2014-09-02T12:12:36.743" Score="7" ViewCount="1173" Body="&lt;p&gt;is there a way to configure separated admins, one for the SRX root lsys and another to a specific lsys? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i'm trying to create two users that when you login with user1 you will login to the root lsys and when you login with user2 you will login to one of the lsyss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks for your help.&lt;/p&gt;&#xA;" OwnerUserId="8247" LastActivityDate="2014-09-03T05:42:17.773" Title="how to create managment access to SRX Lsys." Tags="|juniper|juniper-srx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10748" PostTypeId="1" AcceptedAnswerId="16319" CreationDate="2014-09-02T13:38:16.343" Score="5" ViewCount="286" Body="&lt;p&gt;We are currently implementing a failover site at a remote location to mitigate problems caused by weather or power outages. CiscoAnyConnect is run from our ASA5510 in Home Office to allow employees to VPN into our network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we implement the second ASA5510 in the remote location, will we need a second Cisco AnyConnect and Hostcan and Posture module license?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a command that we will need to have or setting in place to make sure it fails over properly (other than the normal protocol run between the ASA's)?&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-01-24T04:25:11.960" Title="Stateful Fail Licensing for CiscoAnyConnect on ASA5510" Tags="|cisco-asa|vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10749" PostTypeId="2" ParentId="10743" CreationDate="2014-09-02T14:19:16.147" Score="1" Body="&lt;p&gt;All operations that take place in a network device are programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, when most people think of running a program, this is done in the system's processor (CPU), memory, and storage resources.  This is software processing.  It is flexible, easy to update, and can be shared by different programs easily. It can be used to run programs that weren't even thought of at the time the device was manufactured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, many hardware components also contain programs embedded into the silicon itself during manufacturing or using ROM or flash memory.  This is specialized and often limited to running only the type of program it is designed to run.  It may or may not be upgradeable, but the process is typically more involved.  However, when running the program it is designed to run, it runs that program &lt;em&gt;VERY&lt;/em&gt; fast as there is no loading the program into/out of memory, storage or the CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, you want as much of your network traffic to be hardware processed rather than software processed.  The reason being that hardware processing is fast and dedicated to the process.  Software based processing is shared and may be subject to delays as other programs use the same resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While that should provide an answer to your question about &quot;what does S/W and H/W mean,&quot; I will expand on that to say that technology is always advancing and changing.  What was software based yesterday may be hardware based today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flash or solid state storage being used generally would have been unthinkable ten or fifteen years ago.  It was simply too expensive to use on that scale.  However, this has changed rapidly and continues to change.  Who now doesn't have a USB flash drive?  How many people are using SSD in computers?  Yes, it is still expensive when priced per MB compared to traditional storage, but that gap is closing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Company specific, proprietary hardware based ASICs in switching have long been the kings of performance.  In the last several years, &quot;commodity silicon&quot; is rapidly evolving the networking landscape.  At a much lower cost, it can provide equivalent (depending on who you talk to) performance as ASIC based hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASICs also always improve, adding additional functionality into the hardware itself.  Ten years ago you couldn't find a switch with IPv6 functionality built into the hardware, but today you shouldn't consider an enterprise class switch that doesn't have it in hardware (RA guard, etc).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-02T14:19:16.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10750" PostTypeId="2" ParentId="10743" CreationDate="2014-09-02T14:48:40.443" Score="5" Body="&lt;p&gt;The succinct answer is &quot;S/W&quot; = software and &quot;H/W&quot; = hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bridge used to be a computer and controlled the layer 2 traffic flowing through it with a special program, hence &quot;software.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch is built for purpose and the layer 2 traffic flow is controlled by special hardware (ASICs as mentioned in other answers) as it flows through the switch.&lt;/p&gt;&#xA;" OwnerUserId="8251" LastActivityDate="2014-09-02T14:48:40.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10757" PostTypeId="1" CreationDate="2014-09-02T22:45:16.640" Score="2" ViewCount="356" Body="&lt;p&gt;I am in the processing of setting up our office network. Unfortunately, I'm not very experienced in this aspect and am encountering several issues (possibly due to the same cause).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network Diagram&lt;/strong&gt;&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/byMuv.png&quot; alt=&quot;Proposed Network Diagram&quot;&gt;&lt;br&gt;&#xA;&lt;strong&gt;The Devices&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;5x 4G Routers (Huawei) with WiFi and LAN&lt;/li&gt;&#xA;&lt;li&gt;1x Load Balancing Router (TP-Link R480T+)&lt;/li&gt;&#xA;&lt;li&gt;1x Router (TP-Link N900)&lt;/li&gt;&#xA;&lt;li&gt;~12 PCs in Group 1, ~4 PCs in Group 1, ~20 phones/tablets in total for Group 1 and 2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note:&#xA;The #1 and #5 4G Routers have Static IPs which are necessary for certain VPN/Whitelist server access.&#xA;The Load Balancing Router does not have WiFi and requires connectivity to another device for WiFi capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IP Addresses&lt;/strong&gt;&lt;br&gt;&#xA;My idea was to setup a series of IP Addresses as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;4G Routers :- &lt;strong&gt;&lt;em&gt;192.168.30.1 - 192.168.30.5&lt;/em&gt;&lt;/strong&gt; &lt;/li&gt;&#xA;&lt;li&gt;Load Balancing Router :- &lt;strong&gt;&lt;em&gt;192.168.20.1&lt;/em&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Router: &lt;strong&gt;&lt;em&gt;192.168.10.1&lt;/em&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;PCs and other Devices: &lt;strong&gt;&lt;em&gt;192.168.10.10 - 192.168.10.254&lt;/em&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note: I believe this setup might be incorrect and thus the cause. As I recall, all the networking devices have 255.255.255.0 as the subnet mask (I can check on this if need be).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Idea&lt;/strong&gt;&lt;br&gt;&#xA;The idea is to allow any devices in Group 1 easy access to each other's machines. I intend to allocate preferred IP addresses from the available IP Range to the PCs and any other devices so that we need not check what someone's IP is (as caused by DHCP).&#xA;Though the 4G Routers have WiFi, I intend to disable it such that all the devices in Group 1 are connected to the internet through the routers and thereafter through the 4G routers.&#xA;Group 2's devices will connect directly to the 4G Router #5 (this may expand and follow a similar setup as Group 1 in future).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Issue&lt;/strong&gt;&lt;br&gt;&#xA;A few other colleagues and I will be required to access the 4G Routers as well as the Load Balancing Router for monitoring/configurations/status-checks, etc. However, me pinging 192.168.20.1 (Load Balancing Router) from my PC does not work. Whereas, pinging the same address from the Router (N900 Router) works. However, any pings to the 192.168.30.1-5 range does not seem to work at all from the N900 Router or my PC. Traces also fail and doesn't seem to go beyond the originating device (1st hop).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Question&lt;/strong&gt;&lt;br&gt;&#xA;What changes need to be made to allow for this setup to work properly?&lt;br&gt;&#xA;Thank you in advance!&lt;/p&gt;&#xA;" OwnerUserId="8258" LastEditorUserId="8258" LastEditDate="2014-09-02T23:28:50.480" LastActivityDate="2014-09-03T17:05:12.707" Title="Office Network Topology - Lack of connectivity to devices" Tags="|routing|ipv4|dhcp|subnet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10759" PostTypeId="1" AcceptedAnswerId="10763" CreationDate="2014-09-03T02:17:24.607" Score="10" ViewCount="1241" Body="&lt;p&gt;I have several Layer 3 switch/routers which are all connected via an OSPF routed network.  Also attached to each switch are two other networks.  I have to assign a VLAN to each of these networks, I figure that I can just reuse the same two VLANS on each switch as all the traffic leaving the switch is untagged (as its routed, not on a VLAN trunk) - is there any reason I shouldn't do this and give each network a different VLAN?  For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/42yiC.png&quot; alt=&quot;example&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="6088" LastEditorUserId="3191" LastEditDate="2014-09-03T10:05:41.010" LastActivityDate="2015-04-12T03:39:52.967" Title="VLAN assignment philosophy" Tags="|vlan|design|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10760" PostTypeId="1" CreationDate="2014-09-03T04:07:54.030" Score="2" ViewCount="3087" Body="&lt;p&gt;I have a Cisco ASA 5505 with a Security Plus license.  I'm trying to have two physical ports provide two separate VLAN connections to the same physical network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have both VLANs defined properly - named &quot;inside&quot; and &quot;test&quot;.  I have the test VLAN assigned to Ethernet0/1.  The goal is to have a completely segregated &quot;test&quot; network that cannot communicate with the inside network even if the proper subnet is applied to the NICs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It works, somewhat, but I'm definitely missing something.  When I have the cable plugged into e0/1 connecting it to my switch I get heavy and random packetloss from traffic over both VLANs - but traffic does flow to/from the Internet over both VLANs.  When unplugging the cable traffic on the inside interface reverts to its rock-solid state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any direction would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="8261" LastActivityDate="2014-10-03T08:30:46.277" Title="How to use multiple VLANs on an ASA 5505" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10761" PostTypeId="1" AcceptedAnswerId="10762" CreationDate="2014-09-03T04:17:40.753" Score="-1" ViewCount="108" Body="&lt;p&gt;I'm trying to maintain around 40 kiosks using Windows Server 2012. The kiosks run Windows 8.1 Pro. In addition to the use of Active Directory Directory Services on these kiosks, I am trying to assign IP addresses to these kiosks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to be able to monitor these kiosks using third party software and have all the kiosks be part of my single WS2012 Domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've heard different opinions about using static addressing for kiosks and for using dynamic addressing.  Should I be using DHCP or will that affect my ability to be able to monitor and perhaps RDP into these kiosks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the pros and cons of each in my scenario?&lt;/p&gt;&#xA;" OwnerUserId="8260" LastEditorUserId="8260" LastEditDate="2014-09-03T04:39:21.290" LastActivityDate="2014-09-03T04:39:21.290" Title="Public Facing Kiosks use of Static or Dynamic IP addressing?" Tags="|ipv4|dhcp|" AnswerCount="1" CommentCount="0" ClosedDate="2018-03-05T00:49:01.987" ContentLicense="CC BY-SA 3.0" />
  <row Id="10762" PostTypeId="2" ParentId="10761" CreationDate="2014-09-03T04:35:42.987" Score="3" Body="&lt;p&gt;If you are logging into these via RDP and have DHCP configured for their IP's then you need to have appropriate DNS / name services configured, so when/if the IP changes you can still access the kiosks. Another option with DHCP would be have mac-IP bindings on your DHCP server so that each host always receives the same IP and have these reserved.&lt;/p&gt;&#xA;" OwnerUserId="8175" LastActivityDate="2014-09-03T04:35:42.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10763" PostTypeId="2" ParentId="10759" CreationDate="2014-09-03T05:24:17.560" Score="10" Body="&lt;p&gt;It's fine to reuse VLANs on segments that will never meet at layer 2.&lt;/p&gt;&#xA;" OwnerUserId="500" LastEditorUserId="775" LastEditDate="2014-09-03T06:08:52.873" LastActivityDate="2014-09-03T06:08:52.873" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10764" PostTypeId="2" ParentId="10747" CreationDate="2014-09-03T05:42:17.773" Score="5" Body="&lt;p&gt;There are three steps to this.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create a logical system&lt;/li&gt;&#xA;&lt;li&gt;Create a user class bound to the logical system&lt;/li&gt;&#xA;&lt;li&gt;Create a user with the class&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is a very incomplete example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set logical-system lsys1&#xA;set system login class lsys1-class logical-system lsys1&#xA;set system login user lsys1-admin class lsys1-class&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously you need to configure the rest of the parameters for the logical-system as well as any additional class or user authentication and authorization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By simply assigning a user to a class assigned to a logical-system you are restricting the user to the lays.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The master administrator can assign one or more system administrators to each logical system. Logical system administrators are confined to the context of the logical system to which they are assigned. This means that logical system administrators cannot access any global configuration statements. This also means that command output is restricted to the context to which the logical system administrators are assigned.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For more, here's a link to Juniper's documentation on &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/topic-map/logical-systems-admin.html&quot; rel=&quot;noreferrer&quot;&gt;configuring users and permission levels for logical systems&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="500" LastActivityDate="2014-09-03T05:42:17.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10765" PostTypeId="2" ParentId="10759" CreationDate="2014-09-03T07:07:00.077" Score="8" Body="&lt;p&gt;There is no significant reasons to use different vlan in your situation, but, some vendors(cisco at least) recommends to use this way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example, we have N branches, and we need four routed broadcast domains(LAN) on each, let`s calculate them:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;branch1 = 1&#xA;branch2 = 2&#xA;...&#xA;branchN = N&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;worstations - ip:10.N.0.0/24, vlan 100+N&lt;/li&gt;&#xA;&lt;li&gt;servers - 10.N.64.0/24, vlan 200+N&lt;/li&gt;&#xA;&lt;li&gt;voice - 10.N.128.0/24, vlan 300+N&lt;/li&gt;&#xA;&lt;li&gt;mgmt - 10.N.192.0/24, vlan 400+N&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;for tunnel interfaces networks, (we are) as usually, uses 172.16.0.0 network, with same rule:&#xA;172.16.N.0/30 - left side of the ring(or main uplink)&#xA;172.16.N.5 - right side of the ring(or reserve uplink)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you have more than 255 branches, than you just need to use binary calculation, and you will get much more economical utilisation of address space(say if you need formula, i can provide it for you).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;imho, this is good way, because you always know, in one look, what branch network, what branch vlan and what tunnel you are looking.&lt;/p&gt;&#xA;" OwnerUserId="3478" LastActivityDate="2014-09-03T07:07:00.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10766" PostTypeId="2" ParentId="10760" CreationDate="2014-09-03T08:06:22.220" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm trying to have two physical ports provide two separate VLAN connections to the same physical network.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not sure I understand that sentence. It sounds a lot like &quot;AP isolation&quot; in wireless networks -- clients aren't allowed to talk to each other. That would be &lt;code&gt;switchport protected&lt;/code&gt; on an ASA, but that's within a single VLAN. If the ports are in different VLANs, then they're routed based on security level, acls, nat, etc. (and you cannot have the same subnet on more than one active VLAN)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/configuration/guide/conf_gd/int5505.html&quot; rel=&quot;nofollow&quot;&gt;Configuring Interfaces for the Cisco ASA 5505 Adaptive Security Appliance&lt;/a&gt; for more.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-09-03T08:06:22.220" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10767" PostTypeId="2" ParentId="10759" CreationDate="2014-09-03T10:04:56.887" Score="3" Body="&lt;p&gt;There isn’t anything technologically wrong with it, but it's not ideal. From a design perspective it’s prone to problems down the road.  &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/10759/vlan-assignment-philosophy#comment18171_10763&quot;&gt;Jens Link’s comment&lt;/a&gt; is &lt;strong&gt;very&lt;/strong&gt; accurate; if you have an issue, this will compound the problem and complexity of trying to figure out what’s wrong.  That would be even more exacerbated during intense, large-scale outages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although you haven’t mentioned network growth in your OP, it’s reasonable to assume that you’ll eventually deploy a switch downstream from one of your main routers.  When you have matching VLAN-id’s in neighboring areas, this eliminates the possibility (well, makes it a PITA) of dual-homing connections to multiple upstream routers.  You may not be forecasting this now, but it’s best to set things up for future success when it's an option, rather than a necessity. &lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-09-05T07:19:14.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10768" PostTypeId="1" AcceptedAnswerId="10821" CreationDate="2014-09-03T11:30:12.997" Score="5" ViewCount="731" Body="&lt;p&gt;I have to receive some multicast groups for an IPTV platform. I can't use PIM (they don't give me an RP address for the groups...). The provider suggested me to do a join to each multicast group and then distribute the multicast from my switch to the receivers (via PIM), which are in a different VLAN than the interface where i do the join.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have my switch subscribed to some multicast groups but my receivers can't join the group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My switch configuration is something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan10&#xA; ip address X.X.X.X 255.255.255.224&#xA; ip pim sparse-mode&#xA; ip igmp join-group 234.X.X.X&#xA;!&#xA;interface Vlan20&#xA; ip address 192.168.20.1 255.255.255.0&#xA; ip pim sparse-mode&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My receivers are in VLAN 20 and I join the Provider groups in the VLAN 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion or idea to get this working?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I attach an scheme to clarify. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Mcast Provider 2 is working with PIM without problems and now I have a subscription to a MCAST from provider 1 via join command and would like to receive it in my receivers in vlan 62&#xA;&lt;img src=&quot;https://i.stack.imgur.com/fgC7q.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="2028" LastEditDate="2014-09-04T12:13:35.233" LastActivityDate="2014-09-05T17:48:56.777" Title="Multicast Distribution with PIM" Tags="|cisco|multicast|igmp|pim|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10769" PostTypeId="1" CreationDate="2014-09-03T12:25:50.243" Score="0" ViewCount="5140" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1PPVn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is need to add WiFi network to boardroom. I would like to add one more LAN segment to my 192.168.1.0 network. I wish that network have diferent IP address scheme - 192.168.2.0. Edge router is connected to my new WiFi router by a separate switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I would like to separate 192.168.2.0 traffic from 192.168.1.0 traffic. Hosts from 192.168.2.0 network must not have acces to devices in 192.168.1.0 network.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is it possible to do that without VLANs ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How should be configured MikroTik WiFi router ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In what mode the WiFi router should work ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="8499" LastEditDate="2018-02-14T16:50:34.150" LastActivityDate="2018-02-14T16:50:34.150" Title="Two or more different networks without VLANs using MikroTik devices" Tags="|switch|vlan|wireless|ipv4|" AnswerCount="3" CommentCount="1" ClosedDate="2017-08-09T02:43:49.717" ContentLicense="CC BY-SA 3.0" />
  <row Id="10771" PostTypeId="2" ParentId="10768" CreationDate="2014-09-03T14:57:20.700" Score="3" Body="&lt;p&gt;The static igmp join on your vlan 10 should be enough to get the mcast data into the switch.  So since your switch now knows how to get to the mcast data you can cheat and make the RP your switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to do this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list standard iptv&#xA;permit 234.X.X.X    &#xA;ip pim rp-address X.X.X.X iptv&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where x.x.x.x is the IP of vlan 10 or any other ip on your switch&lt;/p&gt;&#xA;" OwnerUserId="8265" LastActivityDate="2014-09-03T14:57:20.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10772" PostTypeId="1" AcceptedAnswerId="10785" CreationDate="2014-09-03T15:06:05.497" Score="3" ViewCount="492" Body="&lt;p&gt;I'm having an issue with an AIR-AP1252ag that won't advertise multiple SSIDs in Beacons.  I'm trying to setup 3 SSIDs, 1 hidden (Controls), 1 Guest (works fine), 1 Internal Data-Wifi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the Internal Data WLAN is not sending the SSID in the beacons. To an end host/client, it just shows up like a hidden network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using c1250-k9w7-tar.152-2.JA.tar for the image.  And I'm starting to think from reading the config guide that I should just go back to 12.4. But I wanted to ask the question to see if anyone can help me set this up right first.  It &lt;em&gt;should&lt;/em&gt; be fairly simple and I'm probably missing something silly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the config.  I've tried a mix of information-element ssidl advertisement with &amp;amp; without mbssid under the dot11 ssid. But I just can't figure out the right combination to get the ssid advertised properly.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;dot11 syslog&#xA;!&#xA;dot11 ssid Controls&#xA;   vlan 32&#xA;   authentication open&#xA;   authentication key-management wpa version 2&#xA;   mbssid dtim-period 50&#xA;   wpa-psk ascii 7 xxxxxxxxxxxxxxx&#xA;!&#xA;dot11 ssid Guest&#xA;   vlan 31&#xA;   authentication open&#xA;   mbssid guest-mode dtim-period 75&#xA;   information-element ssidl advertisement&#xA;!&#xA;dot11 ssid Data-Wifi&#xA;   vlan 30&#xA;   authentication open&#xA;   authentication key-management wpa version 2&#xA;   mbssid dtim-period 75&#xA;   wpa-psk ascii 7 xxxxxxxxxxxxxxxxxx&#xA;   information-element ssidl advertisement&#xA;!&#xA;crypto pki token default removal timeout 0&#xA;!&#xA;!&#xA;username admin privilege 15 secret xxxxxxxxxxxxxxxxxxxxx&#xA;!&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption vlan 30 mode ciphers aes-ccm tkip&#xA; !&#xA; encryption vlan 32 mode ciphers aes-ccm tkip&#xA; !&#xA; ssid Controls&#xA; !&#xA; ssid Guest&#xA; !&#xA; ssid Data-Wifi&#xA; !&#xA; antenna gain 0&#xA; mbssid&#xA; station-role root access-point&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.30&#xA; encapsulation dot1Q 30&#xA; no ip route-cache&#xA;!&#xA;interface Dot11Radio0.31&#xA; encapsulation dot1Q 31&#xA; no ip route-cache&#xA;!&#xA;interface Dot11Radio0.32&#xA; encapsulation dot1Q 32&#xA; no ip route-cache&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA; antenna gain 0&#xA; dfs band 3 block&#xA; channel dfs&#xA; station-role root&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; no ip route-cache&#xA; duplex auto&#xA; speed auto&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; no bridge-group 1 source-learning&#xA;!&#xA;interface GigabitEthernet0.30&#xA; encapsulation dot1Q 30&#xA; no ip route-cache&#xA;!&#xA;interface GigabitEthernet0.31&#xA; encapsulation dot1Q 31&#xA; no ip route-cache&#xA;!&#xA;interface GigabitEthernet0.32&#xA; encapsulation dot1Q 32&#xA; no ip route-cache&#xA;!&#xA;interface BVI1&#xA; ip address 172.16.99.15 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;bridge 1 route ip&#xA;bridge 1 protocol ieee&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3150" LastEditorDisplayName="user10222" LastEditDate="2015-06-07T20:52:02.100" LastActivityDate="2015-06-07T20:52:02.100" Title="Cisco Air-AP1252ag -- 15.2 can't get multiple SSIDs advertising properly" Tags="|cisco|access-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10773" PostTypeId="2" ParentId="10550" CreationDate="2014-09-03T15:12:46.970" Score="2" Body="&lt;p&gt;This depends on the firewall rules you have. So, on SonicWall, if you enable source 10.0.0.0/24 to communicate with 10.10.0.0/24, but on the Adtran you didn't allow the same, the traffic will drop on the Adtran. But if the traffic is allowed on Adtran, then it will pass and response will pass as well .. This has to work both ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the source is 10.10.0.0/24, then on both firewalls, you have to allow source 10.10.0.0/24 to communicate with 10.0.0.0/24&lt;/p&gt;&#xA;" OwnerUserId="3377" LastActivityDate="2014-09-03T15:12:46.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10774" PostTypeId="2" ParentId="9634" CreationDate="2014-09-03T15:34:08.677" Score="0" Body="&lt;p&gt;We've dealt with these scenarios before as an MSP. One place was solid concrete construction, so the areas had to have their own AP's. We also have a client that we manage that takes up a large scale shopping center for their operations. We've done surveys to determine best placement of devices for handoff. The best solutions we've found is carrier-class equipment (wisp). Ubiquiti has a great controller based system called UniFi, with some great paired AP's. Another one being Meraki.&lt;/p&gt;&#xA;" OwnerUserId="8202" LastActivityDate="2014-09-03T15:34:08.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10777" PostTypeId="2" ParentId="10693" CreationDate="2014-09-03T16:02:41.203" Score="4" Body="&lt;p&gt;It looks like things are a configuration issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After more and more searching I found that the following command was enabled on VLAN 11 on the IDF switch causing things not to function. (Crazy how you can stare at the same problem and not even see it!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;bridge multicast forbidden forward-unregistered&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="3449" LastActivityDate="2014-09-03T16:02:41.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10778" PostTypeId="1" CreationDate="2014-09-03T16:16:07.043" Score="5" ViewCount="4098" Body="&lt;p&gt;I've been tasked with helping to troubleshoot a DMVPN Phase 3 connection over the internet. Unfortunately, I'm not experienced with DMVPN configs and setups. We have two test devices right now that are set up as a hub and spoke to communicate over the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our DMVPN test devices work just fine if they all are connected locally. However, if we mimic the config on two other test devices to pass over the internet, the tunnel appears to be set up but that is all. The devices cannot ping each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Initial troubleshooting leads me to believe at least part of the problem is the hub router's EIGRP config. EIGRP adjacency is not being established and then I noticed no EIGRP hello packets are being sent out the interface for the DMVPN tunnel. I figured it may just be best to copy over the config and let more experienced NE's tell me if they spot any red flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The config has had the IP's and Names changed. This is also only a small portion of the config. The hub has multiple DMVPN clouds set up that all seem to be working just fine when not passing over the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need more information or more of the config posted, please let me know and I will post necessary parts of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the EIGRP and associated interface config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface Port-channel2.7&#xA; description Link to Internet&#xA; encapsulation dot1Q 7&#xA; ip vrf forwarding PLACEHOLDER3&#xA; ip address 1.1.1.1 255.255.255.248&#xA; ip virtual-reassembly&#xA;&#xA;interface Tunnel1601&#xA; description PLACEHOLDER1&#xA; bandwidth 1000&#xA; ip vrf forwarding PLACEHOLDER2&#xA; ip address 172.17.1.1 255.255.252.0&#xA; no ip redirects&#xA; ip mtu 1400&#xA; ip hello-interval eigrp 1601 20&#xA; ip hold-time eigrp 1601 60&#xA; no ip next-hop-self eigrp 1601&#xA; no ip split-horizon eigrp 1601&#xA; ip pim neighbor-filter PIM_NEIGHBORS&#xA; ip pim nbma-mode&#xA; ip pim sparse-mode&#xA; ip nhrp authentication NHRPKey2&#xA; ip nhrp map multicast dynamic&#xA; ip nhrp network-id 1601&#xA; ip nhrp holdtime 300&#xA; ip nhrp nhs 172.18.1.2&#xA; ip nhrp nhs 172.18.1.3&#xA; ip tcp adjust-mss 1360&#xA; if-state nhrp&#xA; cdp enable&#xA; tunnel source Port-channel2.7&#xA; tunnel mode gre multipoint&#xA; tunnel key 100001&#xA; tunnel vrf PLACEHOLDER3&#xA; tunnel protection ipsec profile IPSEC-INTERNET&#xA;&#xA;router eigrp DMVPN-INTERNET&#xA; !&#xA; address-family ipv4 unicast vrf PLACEHOLDER2 autonomous-system 1601&#xA;  !&#xA;  af-interface Tunnel1601&#xA;   hello-interval 20&#xA;   hold-time 60&#xA;   no next-hop-self no-ecmp-mode&#xA;   no split-horizon&#xA;  exit-af-interface&#xA;  !&#xA;  topology base&#xA;   auto-summary&#xA;   redistribute connected&#xA;   redistribute eigrp 1 route-map ROUTE-TAG-OUT-1601&#xA;   redistribute eigrp 4 route-map ROUTE-TAG-OUT-1601&#xA;   redistribute eigrp 95 route-map ROUTE-TAG-OUT-1601&#xA;   redistribute eigrp 1600 route-map ROUTE-TAG-OUT-1601&#xA;  exit-af-topology&#xA;  network 172.18.1.0 0.0.3.255&#xA;  network 172.18.64.0 0.0.63.255&#xA;  eigrp router-id 192.168.2.2&#xA;  eigrp log-neighbor-warnings 300&#xA; exit-address-family&#xA; !&#xA; service-family ipv4 vrf PLACEHOLDER2 autonomous-system 1601&#xA;  !&#xA;  topology base&#xA;  exit-sf-topology&#xA; exit-service-family&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="8099" LastEditorUserId="8099" LastEditDate="2014-09-03T17:15:59.197" LastActivityDate="2015-01-19T02:16:39.307" Title="DMVPN EIGRP Config Error - No EIGRP Hello packets sent out interface" Tags="|vpn|eigrp|" AnswerCount="3" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="10782" PostTypeId="2" ParentId="10757" CreationDate="2014-09-03T17:05:12.707" Score="2" Body="&lt;p&gt;Every router needs to know where to route their packets. The N900 will send ping packets to the load balancing router with an IP address 'closest' to that router, so 192.168.20.X. The load balancing router knows how to route this, because it is directly connected. Your PC will send it's packets with a source IP address of 192.168.10.10. If the load balancing router is only configured with a default towards the Huawei routers, it will send any reply to your computer to the Huawei routers. It will never reach your computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to do, is make sure that both the load balancing router and the Huawei's know where to route 192.168.10.0/24. They only need to know the next hop, So for the Huawei's, the 192.168.10.0/24 should point towards the 192.168.30.X address of the load balancing router. The Load Balancing router in turn needs a route for the same subnet to the 192.168.20.X address of the N900.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the only reason to give the Huawei's a route for 192.168.20.0/24, is if you wanted them to be able to reach something on that network. They don't need to know this subnet to reach the computers.&lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2014-09-03T17:05:12.707" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10783" PostTypeId="1" AcceptedAnswerId="10797" CreationDate="2014-09-03T17:35:08.953" Score="1" ViewCount="1881" Body="&lt;p&gt;I want to answer a past exams question with a clean/simple way about:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does ATM protocol use for virtual circuit numbering both VPI&#xA;  &lt;strong&gt;and&lt;/strong&gt; VCI logical numbers?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From what I've understood: The VCI changes through the nodes that it goes through and VPI has the destination path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this also: &lt;em&gt;The address is broken into a VCI and a VPI subfield.&#xA;Session following the same path for several nodes can be assigned the same VPI. Some switches only look at VPI, simplifying switch complexity.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help me get this cleared?&lt;/p&gt;&#xA;" OwnerUserId="8274" LastActivityDate="2014-09-04T15:58:17.383" Title="ATM protocol: VCI and VPI definition" Tags="|protocol-theory|atm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10785" PostTypeId="2" ParentId="10772" CreationDate="2014-09-03T19:23:16.767" Score="6" Body="&lt;p&gt;&lt;code&gt;Data-Wifi&lt;/code&gt; doesn't have guest-mode enabled (&lt;code&gt;mbssid guest-mode&lt;/code&gt;) so it will not beacon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See Also: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/access_point/12-4_10b_JA/command/reference/cr2410b/cr12410b-chap2.html#wp3659596&quot;&gt;guest-mode&lt;/a&gt; and &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/access_point/12-4_10b_JA/command/reference/cr2410b/cr12410b-chap2.html#wp2702003&quot;&gt;mbssid guest-mode&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-09-03T19:23:16.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10787" PostTypeId="2" ParentId="10769" CreationDate="2014-09-03T21:29:39.403" Score="1" Body="&lt;p&gt;&lt;strong&gt;Is it possible to do this without VLANs?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be done without VLANs. The simplest way might be to connect the Wifi router directly to the Cloud Core router/firewall instead of to the HP switch. This way, the firewall functionality in the CCR can prevent 192.168.2.0 from reaching 192.168.1.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick and dirty solution that might meet your requirements is configuring your wifi router as any home wifi router, NATting the wireless subnet onto your network. No vlans, and the rest of the network cannot contact the wireless subnet. I would advise against this because NAT is not necessary inside your network, but it is a quick fix.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2014-09-04T12:36:33.493" LastActivityDate="2014-09-04T12:36:33.493" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10790" PostTypeId="1" CreationDate="2014-09-04T07:39:16.270" Score="3" ViewCount="4921" Body="&lt;p&gt;I want achieve a load balancing of ISP like the one below.&lt;img src=&quot;https://i.stack.imgur.com/8yCA6.jpg&quot; alt=&quot;Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only 2 subnet should go through ISP 2, and rest of the traffic should go to ISP 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know all the things that I need to do on a 3750x core and firewall.&#xA;Waiting for your response......&lt;/p&gt;&#xA;" OwnerUserId="5479" LastEditorUserId="17678" LastEditDate="2015-09-19T19:28:39.327" LastActivityDate="2015-09-19T22:29:18.847" Title="PBR on cisco Switch 3750x for Dual ISP load balancing" Tags="|router|switch|switching|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="10792" PostTypeId="2" ParentId="10769" CreationDate="2014-09-04T09:08:10.693" Score="0" Body="&lt;p&gt;Is it possible to do that without VLANs ?&#xA;yes, but why, you have good switch?! ;-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should be configured MikroTik WiFi router ?&#xA;In what mode the WiFi router should work ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your switch is in default config, then you just need to connect wifi-router ethernet1 port to the switch. This will be &quot;wan&quot; for wifi-router, add address to this interface for. example 192.168.1.254, set gateway 192.168.1.1. It will works. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to limit connections from 192.168.2.0 to 192.168.1.0, set acl on mikrotik. But, if you want, to permit 192.168.1.0 to 192.168.2.0 and deny 192.168.2.0 to 192.168.1.0, both, you need:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. disable nat on mikrotik(routing mode), allow forwarding from &quot;wan&quot;. &#xA;2. set route on cloud core, a-la: ip route -net 192.168.2.0 -mask 255.255.255.0 -gateway 192.168.2.254&#xA;3. set mikrotik firewall(allow from 192.168.1.0 to 2.0, deny 192.168.2.0 to 1.0, except 1.1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3478" LastActivityDate="2014-09-04T09:08:10.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10796" PostTypeId="2" ParentId="10768" CreationDate="2014-09-04T12:02:53.000" Score="4" Body="&lt;p&gt;Remember that &quot;ip igmp join-group&quot; will cause all multicast packets for this group to be forwarded also to the CPU. Probably this is not what you want.&#xA;Instead talk to your provider and tell them to use &quot;ip igmp static-group&quot; on their side. &lt;/p&gt;&#xA;" OwnerUserId="970" LastActivityDate="2014-09-04T12:02:53.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10797" PostTypeId="2" ParentId="10783" CreationDate="2014-09-04T15:58:17.383" Score="1" Body="&lt;p&gt;One reason--and I'm sure there are many, many more--is because you can have the same VCI on multiple different VPIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VPI is 8 (OK, 8-12) bits, while the VCI is 16 bits. VPI 0 has VCI 35... but VPI 1 also has VCI 35, as does VPI 2. Guess what? VPI 3 also has a VCI 35. These VCIs don't necessarily interact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is probably more for the PVC (Permanent Virtual Circuit) implementation, common in ISP networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a bit like asking why you have a third AND a fourth octet in an IP address, or why you need a street AND city name in a postal address. ;)&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-09-04T15:58:17.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10799" PostTypeId="2" ParentId="10759" CreationDate="2014-09-04T17:05:58.393" Score="4" Body="&lt;p&gt;Here's another take in the opposite direction - a reason to reuse VLAN numbers since you can. I had a situation where I was working with some poor-quality IP phones that would download their configuration from a TFTP server, not from DHCP options. I wanted to be able to pick up a phone in any location and drop in any other without having to reconfigure, and the phones required the IP address and file name of the TFTP configuration to be statically configured on the phone. The config file had to specify the tagged VLAN number that the phones should jump to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to make those horrible phones work the way I wanted, I had to make the voice VLAN the same VLAN number at every location. Sure I could have set up several different TFTP servers and/or config files and programmed each phone separately and reprogrammed them every time a phone moved. I just wanted to point out that there could be many other situations where re-using VLAN numbers would help you solve another problem.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastEditorUserId="4889" LastEditDate="2015-04-12T03:39:52.967" LastActivityDate="2015-04-12T03:39:52.967" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10804" PostTypeId="1" AcceptedAnswerId="10832" CreationDate="2014-09-04T20:14:11.473" Score="5" ViewCount="2890" Body="&lt;p&gt;Is it correct that the SIP inspection in the ASA 5500 firewalls only kicks in for traffic on port 5060?&#xA;The referenced document below states so (this doc is specifically for the newer generation 5500-x series).&#xA;And I have trouble to get audio working when my IP PBX is configured to receive inbound calls on another port than 5060. The IP PBX I am using is a SIP proxy with a built-in SBC and it demands that inbound traffic shall be sent to port 5080. Traffic between IP PBX and ITSP goes via an ASA 5505 firewall (that's the older generation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inbound Calls do connect, but then I have one-way audio. The RTP does not flow from external to internal. (Outbound calls are no problem, all fine with 2-way audio - but they are sent with destination port 5060).&#xA;This would make sense if the ASA won't start the SIP inspection due to the different port 5080. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But is that really the case? &#xA;And if that is so, can I configure somewhere which SIP port the ASA should look for? Or is there any workaround? (I can probably open all inbound RTP ports ... but I would like to avoid that)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82446-enable-voip-config.html#sip&quot; rel=&quot;noreferrer&quot;&gt;Cisco documentation ASA 5500&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8294" LastActivityDate="2014-10-06T18:14:44.887" Title="Cisco ASA 5500 configuration - SIP ports other than 5060" Tags="|cisco-asa|sip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10805" PostTypeId="2" ParentId="10778" CreationDate="2014-09-04T20:19:29.377" Score="2" Body="&lt;p&gt;I dont have any experience with multi-hub DMVPN, but it seems like you need to provide mapping from the tunnel address for the NHS's to their NBMA/external addresses under your tunnel interface at the spokes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! on each spoke&#xA;int Tunnel1601&#xA;ip nhrp map 172.18.1.2 &amp;lt;NBMA Address for hub1&amp;gt;&#xA;ip nhrp map 172.18.1.3 &amp;lt;NBMA Address for hub2&amp;gt;&#xA;! probably also need to send multicast somewhere for EIGRP to form neighbors&#xA;ip nhrp map multicast &amp;lt;NBMA Address for hub1&amp;gt;&#xA;ip nhpp map multicast &amp;lt;NBMA Address for hub2&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would not bother troubleshooting EIGRP until you get the DMVPN up and can ping between the tunnel IPs.&lt;/p&gt;&#xA;" OwnerUserId="8293" LastActivityDate="2014-09-04T20:19:29.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10806" PostTypeId="2" ParentId="10804" CreationDate="2014-09-04T20:29:19.120" Score="-1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The well-known port 5060 must be used on the initial call setup ...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;[&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/inspect_voicevideo.html#wp1204403&quot; rel=&quot;nofollow&quot;&gt;Configuring Inspection of Voice and Video Protocols&lt;/a&gt;]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-09-04T20:29:19.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10807" PostTypeId="1" AcceptedAnswerId="10824" CreationDate="2014-09-04T20:30:04.110" Score="8" ViewCount="52051" Body="&lt;p&gt;All,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently bought 3 Cisco switches: 3560x and two 2960Xs. 3560 acting as the core switch and other 2 switches are connected using SFP+ (One SFP-H10GB-CU1M and other SFP-10G-SR)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have issue with the SFP-10G-SR. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I connected the SFP-10G-SRs with an 50m OM3 cable. It worked initially, however the log always have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;026123: Jun 12 20:42:02.573: %SFF8472-5-THRESHOLD_VIOLATION: Te1/2: Rx power high warning; Operating value:  -0.9 dBm, Threshold value:  -1.0 dBm.&#xA;026124: Jun 12 20:48:35.730: %SFF8472-5-THRESHOLD_VIOLATION: Te1/2: Rx power high warning; Operating value:  -0.9 dBm, Threshold value:  -1.0 dBm.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In one incident, I noticed the SFP port SFP-10G-SR went down. I was playing on that so I didn't care and I simply rebooted the switches and it all came back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, the SFP ports will not come up anymore. I'm in production, so I tried to change the Fibre and I tried to change SFP+ modules. No luck&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show inventory&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NAME: &quot;TenGigabitEthernet1/2&quot;, DESCR: &quot;SFP-10GBase-SR&quot;&#xA;PID: SFP-10G-SR          , VID: V03  , SN: FNS16481363&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;show int te1/2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    TenGigabitEthernet1/2 is down, line protocol is down (notconnect) &#xA;  Hardware is Ten Gigabit Ethernet, address is 24e9.b3e3.a29e (bia 24e9.b3e3.a29e)&#xA;  Description: NGPSW03 Trunk&#xA;  MTU 1500 bytes, BW 10000000 Kbit/sec, DLY 10 usec, &#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not set&#xA;  Full-duplex, 10Gb/s, link type is auto, media type is SFP-10GBase-SR&#xA;  input flow-control is off, output flow-control is unsupported &#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 6d09h, output 6d09h, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     1119868 packets input, 124583435 bytes, 0 no buffer&#xA;     Received 302202 broadcasts (301488 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 301488 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     48617012 packets output, 4642677414 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 3 interface resets&#xA;     1 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Model/Version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch Ports Model              SW Version            SW Image                 &#xA;------ ----- -----              ----------            ----------               &#xA;*    1 30    WS-C3560X-24       15.0(2)SE6            C3560E-IPBASEK9-M&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;br&gt;&#xA;I tried relocating the Cable+SFP from Te1/2 to Te1/1, now the Warning is reverse.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SFF8472-5-THRESHOLD_VIOLATION: Te1/1: Rx power low warning; Operating value: -13.8 dBm, Threshold value: -13.0 dBm.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8295" LastEditorUserId="8295" LastEditDate="2014-09-04T22:14:58.237" LastActivityDate="2014-09-06T01:21:57.723" Title="SFP+ complains threshold violation and went down" Tags="|cisco|cisco-catalyst|fiber|sfp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10809" PostTypeId="1" CreationDate="2014-09-04T23:03:20.077" Score="2" ViewCount="88" Body="&lt;p&gt;EDIT: My general question is if different versions of ios, spanning from 12 and 15, can work well in direct connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am in way over my head because I went ahead and ordered a full CCIE lab without even taking my CCENT, I just really wanted something to practice on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the problem, I ordered six 2811 Routers (running on ios15), and then got three more routers to function as my backbone routers. These backbones are 2821XM, which run on ios12. That won't be a problem right? I just want them for OSPF and BGP labs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm dying here because I actually paid more for the 2621XMs than I did for the 2821s: they were all refurbished, and I am learning that the refurbished market is highly illogical price-wise. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I bite the bullet and just buy three more 2821s to keep the ios15 uniform? I might be able to salvage the 2621XMs* for random home projects. I'm ordering from Hawaii, so returning and reshipping some heavy cheap refurbished routers isn't going to be an option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to anyone who can help a noob out!&lt;/p&gt;&#xA;" OwnerUserId="8297" LastEditorUserId="8297" LastEditDate="2014-09-05T00:25:52.583" LastActivityDate="2014-09-05T00:25:52.583" Title="New Cisco routers backward compatible with old ones?" Tags="|cisco|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10810" PostTypeId="2" ParentId="10809" CreationDate="2014-09-05T00:22:14.233" Score="4" Body="&lt;p&gt;You will be fine.  In fact, you have yourself quite a lab for whatever exam you attempt.&#xA;Remember that routing protocols like BGP and OSPF are standards, so all routers will run them compatibly, even (gasp!) other manufacturers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The newer IOS versions may have some extra &quot;knobs&quot; you can tweak, but you are unlikely to run into that on any of your tests.  IIRC, the IOS in the labs isn't always the latest and greatest.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-09-05T00:22:14.233" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10811" PostTypeId="1" CreationDate="2014-09-05T07:20:33.780" Score="12" ViewCount="18896" Body="&lt;p&gt;comparing to Cisco IOS , we can create any number of loopbacks on router , but on Junos you can create only one loopback interface  (even logical units from same loopback) in the routing instance , did any one suggest  or think about the reason for this design ? and did Junos has another logical interface can be used in the place of loopback ?  &lt;/p&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="3191" LastEditDate="2014-09-05T07:31:29.683" LastActivityDate="2014-09-08T21:41:43.537" Title="why we can't create multiple loopback interfaces in Junos?" Tags="|routing|juniper|juniper-junos|loopback|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10812" PostTypeId="2" ParentId="10790" CreationDate="2014-09-05T08:21:11.223" Score="4" Body="&lt;p&gt;If you only want outbound traffic to be load-balanced like that (beware inbound traffic from the Internet won't be affected and will be routed according to Internet routing tables) then let's suppose your ASA1 IP address is 192.168.0.1/30 and ASA2 address is 192.168.0.5/30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two subnets that should go through ISP 2 are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.0/24&#xA;192.168.2.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything else goes through ISP1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you create two ACLs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit 192.168.1.0 0.0.0.255&#xA;access-list 101 permit 192.168.2.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Create a route-map (last permit line is to match all remaining traffic and route by default):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map pbr1 permit 10&#xA;  match ip address 101&#xA;  set ip next-hop 192.168.0.5&#xA;route-map pbr1 permit 20&#xA;  set ip next-hop 192.168.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Apply to inbound interface facing the local subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet 0/1&#xA;  ip policy route-map pbr1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope that helps a little bit. &#xA;Some more helpful resources for you:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ciscozine.com/pbr-route-a-packet-based-on-source-ip-address/&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscozine.com/pbr-route-a-packet-based-on-source-ip-address/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/54sg/configuration/guide/config/pbroute.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/54sg/configuration/guide/config/pbroute.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Also you can see if PBR is supported on your 3750x on &lt;a href=&quot;http://tools.cisco.com/ITDIT/CFN/jsp/by-feature-technology.jsp&quot; rel=&quot;nofollow&quot;&gt;Cisco's Feature navigator&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="2093" LastEditDate="2014-09-05T09:29:14.907" LastActivityDate="2014-09-05T09:29:14.907" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10813" PostTypeId="2" ParentId="10661" CreationDate="2014-09-05T09:15:00.567" Score="6" Body="&lt;p&gt;Alex, hеllo there!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ive builded test environmet for you, so i am using freeradius 2.1.12+dfsg-1.2 (on debian), and switch hp 2650. Ive just repeated your config, and have no problems with this. My test procurve ip 10.0.10.29, test freeradius ip 192.168.2.60.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;procurve config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Running configuration:&#xA;&#xA;; J4899A Configuration Editor; Created on release #H.10.83&#xA;&#xA;hostname &quot;ProCurve Switch 2650&quot;&#xA;interface 1&#xA;   no lacp&#xA;exit&#xA;interface 2&#xA;   no lacp&#xA;exit&#xA;interface 3&#xA;   no lacp&#xA;exit&#xA;interface 4&#xA;   no lacp&#xA;exit&#xA;interface 5&#xA;   no lacp&#xA;exit&#xA;interface 6&#xA;   no lacp&#xA;exit&#xA;interface 7&#xA;   no lacp&#xA;exit&#xA;interface 8&#xA;   no lacp&#xA;exit&#xA;interface 9&#xA;   no lacp&#xA;exit&#xA;interface 10&#xA;   no lacp&#xA;exit&#xA;snmp-server community &quot;public&quot; Unrestricted&#xA;vlan 1&#xA;   name &quot;DEFAULT_VLAN&quot;&#xA;   untagged 11-50&#xA;   ip address dhcp-bootp&#xA;   no untagged 1-10&#xA;   exit&#xA;vlan 100&#xA;   name &quot;success&quot;&#xA;   untagged 1-10&#xA;   exit&#xA;vlan 200&#xA;   name &quot;fail&quot;&#xA;   exit&#xA;aaa authentication port-access eap-radius&#xA;radius-server host 192.168.2.60 key test&#xA;aaa port-access authenticator 1-10&#xA;aaa port-access authenticator 1 unauth-vid 200&#xA;aaa port-access authenticator 2 unauth-vid 200&#xA;aaa port-access authenticator 3 unauth-vid 200&#xA;aaa port-access authenticator 4 unauth-vid 200&#xA;aaa port-access authenticator 5 unauth-vid 200&#xA;aaa port-access authenticator 6 unauth-vid 200&#xA;aaa port-access authenticator 7 unauth-vid 200&#xA;aaa port-access authenticator 8 unauth-vid 200&#xA;aaa port-access authenticator 9 unauth-vid 200&#xA;aaa port-access authenticator 10 unauth-vid 200&#xA;aaa port-access authenticator active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;/etc/freeradius/users:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;...&amp;gt;&#xA;testuser User-Password := test&#xA;        Tunnel-Type = VLAN,&#xA;        Tunnel-Medium-Type = IEEE-802,&#xA;        Tunnel-Private-Group-Id = &quot;100&quot;&#xA;&amp;lt;...&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;/etc/freeradius/radiusd.conf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;...&amp;gt;&#xA;client switch {&#xA;        ipaddr          = 10.0.10.29&#xA;        secret          = test&#xA;        require_message_authenticator = no&#xA;        nastype     = other&#xA;}&#xA;&amp;lt;...&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And i`ve used this manual, to enable 8021x in windows: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;http://windows.microsoft.com/en-us/windows/enable-802-1x-authentication#1TC=windows-7 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, I`ve disabled usage of logged user creds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if user creds are correct, i have this message in /var/log/freeradius/radius.log&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tail -f /var/log/freeradius/radius.log&#xA;Fri Sep  5 12:54:14 2014 : Auth: Login OK: [testuser/&amp;lt;via Auth-Type = EAP&amp;gt;] (from client switch port 0 via TLS tunnel)&#xA;Fri Sep  5 12:54:14 2014 : Auth: Login OK: [testuser/&amp;lt;via Auth-Type = EAP&amp;gt;] (from client switch port 1 cli b4-99-ba-5a-bb-65)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and on my switch ive got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ProCurve Switch 2650(eth-1)# sh vlans ports 1&#xA;&#xA; Status and Counters - VLAN Information - for ports 1&#xA;&#xA;  802.1Q VLAN ID Name         Status       Voice&#xA;  -------------- ------------ ------------ -----&#xA;  100            success      Port-based   No&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If creds are incorrect:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Fri Sep  5 12:56:06 2014 : Auth: Login incorrect: [sasdasd/&amp;lt;via Auth-Type = EAP&amp;gt;] (from client switch port 0 via TLS tunnel)&#xA;Fri Sep  5 12:56:06 2014 : Auth: Login incorrect: [sasdasd/&amp;lt;via Auth-Type = EAP&amp;gt;] (from client switch port 1 cli b4-99-ba-5a-bb-65)&#xA;&#xA;&#xA;ProCurve Switch 2650(eth-1)# sh vlans ports 1&#xA;&#xA; Status and Counters - VLAN Information - for ports 1&#xA;&#xA;  802.1Q VLAN ID Name         Status       Voice&#xA;  -------------- ------------ ------------ -----&#xA;  200            fail         Port-based   No&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;maybe you havent enabled 8021x in windows? I hope this helps to you man. &lt;/p&gt;&#xA;" OwnerUserId="3478" LastEditorUserId="3478" LastEditDate="2014-09-05T09:31:11.720" LastActivityDate="2014-09-05T09:31:11.720" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10814" PostTypeId="1" AcceptedAnswerId="10828" CreationDate="2014-09-05T11:08:52.097" Score="2" ViewCount="1610" Body="&lt;p&gt;first of all this is my first post on this forum however I got quite a lot of very helpful information from here in the past.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My company is operating in travel business and the at the moment we really struggle to meet our guests internet demands. We upgraded our connections to bonded DSL to gain more bandwidth however it is still not enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As fibre is not available in the areas of our estate at the moment, we are looking into installing Leased Lines. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our current supplier was unable to provide us with impartial info if it is going to take major improvement on the speed( they just want to sale more...). Since there is a massive hike in pricing costs I need to understand if it is going to improve speed of connection.&#xA;Selling points like SLA are great but in the past we did not have downtime issues so it is hard to justify the costs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any input or experience in difference of speed between bonded DSL and Leased Lines greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="4956" LastActivityDate="2017-05-08T10:34:16.400" Title="Leased lines vs. bonded DSL" Tags="|adsl|" AnswerCount="6" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10815" PostTypeId="2" ParentId="10814" CreationDate="2014-09-05T12:44:49.057" Score="3" Body="&lt;p&gt;I don't know where you are based, but I'm in the UK. Here ADSL is &quot;contended&quot; in other words you are potentially sharing your connection with a number of other users this can hammer performance at peak times &lt;a href=&quot;http://en.wikipedia.org/wiki/Contention_ratio&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Contention_ratio&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A leased line isn't shared (1:1 contention ratio) so you get all the bandwidth all the time so can be quite a bit quicker than the numbers would suggest. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also found that the leased line we have is far more reliable than any ADSL connection we have.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Edit &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;With the advent of ADSL2+ (&quot;up to&quot; 20Mbit/s service), FTTC (Fibre to the Cabinet) offering 40Mbit/s services and even FTTP (Fibre to the Premises) offering 100Mbit/s, BT no longer work on &quot;contention ratio&quot; as a planning rule.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So your milage may vary depending on what you've got.&lt;/p&gt;&#xA;" OwnerUserId="1585" LastActivityDate="2014-09-05T12:44:49.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10818" PostTypeId="1" AcceptedAnswerId="10819" CreationDate="2014-09-05T14:35:35.377" Score="2" ViewCount="444" Body="&lt;p&gt;This might be a duplicate but I didn't find it.Maybe I didn't used the right keywords while searching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was reading &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0123850592&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; book and in Chapter 1, it was written that&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When a source node wants the network to deliver a message to a certain destination node, it specifies the address of the destination node.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;One thing that is bugging me how does the &lt;code&gt;source node&lt;/code&gt; knows the address of the &lt;code&gt;destination node&lt;/code&gt; when it is communicating for the first time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the &lt;code&gt;source node&lt;/code&gt; have to know the address of the &lt;code&gt;destination node&lt;/code&gt; before starting to  communicate for the first time?&lt;/p&gt;&#xA;" OwnerUserId="7805" LastActivityDate="2014-09-05T15:10:19.777" Title="How source node knows the destination node address beforehand?" Tags="|packet-path|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10819" PostTypeId="2" ParentId="10818" CreationDate="2014-09-05T15:10:19.777" Score="5" Body="&lt;p&gt;Because you specified an address, or name that can be resolved to an address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How did your computer get to this website? You entered a URL (or clicked a link) pointing here. Behind the &quot;mouse&quot;, your computer used it's configured DNS server(s) to resolve the name to an address. That DNS request had to find it's way to your default gateway (pre-configured) -- assuming it's not a local server, etc. On your local ethernet (wifi), your computer finds the address (MAC) of the gateway via ARP.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-09-05T15:10:19.777" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10820" PostTypeId="1" AcceptedAnswerId="10848" CreationDate="2014-09-05T15:59:15.743" Score="3" ViewCount="1161" Body="&lt;p&gt;How can I configured MPLS-TE FRR on IOS using tunnels with dynamic paths (Is this even possible, I think it might be IOS-XR only)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/EIm54.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this topology I have a full mesh of MPLE-TE tunnels configured. Below is the R1 configuration but all nodes are the same just with the IPs changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to test FRR between R1 and R3. Under Tunnel3 on R1 (and Tunnel1 on R3) I have one dynamic path configured (I'd like to follow the IGP in this example). Looking over Cisco documentation for MPLS-TE FRR at lesat one explicit path seems to be in all examples I can find. &lt;strong&gt;If I add a 2nd path to the tunnel interface on each router (R1-Tu3 and R3-Tu1) that is also configured as &lt;code&gt;dynamic&lt;/code&gt; can I use FRR, and how?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know how to configure FRR without an explicit path (only theorise how it might work but my mental hypothesis seems sup-optimal - which is why I'm not sure its even achievable).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mpls traffic-end tunnels&#xA;!&#xA;interface Loopback0&#xA; ip address 10.0.0.1 255.255.255.255&#xA; ip ospf 1 area 0&#xA;!&#xA;interface Tunnel2&#xA; ip unnumbered Loopback0&#xA; tunnel mode mpls traffic-eng&#xA; tunnel destination 10.0.0.2&#xA; tunnel mpls traffic-eng autoroute announce&#xA; tunnel mpls traffic-eng path-option 1 dynamic&#xA; tunnel mpls traffic-eng fast-reroute&#xA;!&#xA;interface Tunnel3&#xA; ip unnumbered Loopback0&#xA; tunnel mode mpls traffic-eng&#xA; tunnel destination 10.0.0.3&#xA; tunnel mpls traffic-eng autoroute announce&#xA; tunnel mpls traffic-eng path-option 1 dynamic&#xA; tunnel mpls traffic-eng fast-reroute&#xA;!&#xA;interface Tunnel4&#xA; ip unnumbered Loopback0&#xA; tunnel mode mpls traffic-eng&#xA; tunnel destination 10.0.0.4&#xA; tunnel mpls traffic-eng autoroute announce&#xA; tunnel mpls traffic-eng path-option 1 dynamic&#xA; tunnel mpls traffic-eng fast-reroute&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.0.12.1 255.255.255.0&#xA; ip ospf 1 area 0&#xA; mpls traffic-eng tunnels&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 10.0.14.1 255.255.255.0&#xA; ip ospf 1 area 0&#xA; mpls traffic-eng tunnels&#xA;!&#xA;router ospf 1&#xA; router-id 10.0.0.1&#xA; mpls traffic-eng router-id Loopback0&#xA; mpls traffic-eng area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="253" LastActivityDate="2014-09-07T15:26:07.310" Title="Cisco IOS: Can I have MPLS-TE tunnels use FRR when using dynamic paths?" Tags="|cisco|mpls-te|frr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10821" PostTypeId="2" ParentId="10768" CreationDate="2014-09-05T17:48:56.777" Score="3" Body="&lt;p&gt;I have resolved the issue. As you told me , pim must be enabled, sparse-mode in the interface vlan, the rp-address for the multicast group but one command was missing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip route-cache distributed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to everyone!!&lt;/p&gt;&#xA;" OwnerUserId="2028" LastActivityDate="2014-09-05T17:48:56.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10822" PostTypeId="2" ParentId="10814" CreationDate="2014-09-05T20:46:05.110" Score="2" Body="&lt;p&gt;Do you have any visibility into what is using the majority of your bandwidth? It is possible that you have a few of your users hogging all of the bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case you would need to start limiting the amount of bandwidth a single user can use. This approach might be more cost effective than adding more bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some potential solutions to accomplish that are from Sonicwall, Ubiquiti, or even using iptables. Here are some ideas from a different question about this. &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/10680/very-high-latency-for-https-websites-except-google-and-some-others-good-laten/10800#10800&quot;&gt;Very high latency for HTTPS websites (except Google and some others), good latency for the HTTP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5331" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-09-05T20:46:05.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10823" PostTypeId="2" ParentId="10778" CreationDate="2014-09-05T22:42:23.613" Score="-2" Body="&lt;p&gt;IPsec does not support multicast. EIGRP uses multicast to communicate with adjacent routers.  You might have to configure a GRE tunnel to carry the multicast traffic.&lt;/p&gt;&#xA;" OwnerUserId="8311" LastActivityDate="2014-09-05T22:42:23.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10824" PostTypeId="2" ParentId="10807" CreationDate="2014-09-06T01:21:57.723" Score="2" Body="&lt;p&gt;You may have two problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the SFP is transmitting out of spec.  At most, it should put out -1.2dBm per the link supplied by lacasitos above.  You may be able to RMA it if a Cisco SFP is complaining that another Cisco SFP is sending too hot of a signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, because you're now getting a Rx threshold error (it should not put out less than -7.3dBm and -13.8 is quite a loss on a short link), the fiber may not be fully inserted at either the tx or rx end, or the fiber is dirty or the transmitter or receiver is dirty.  (It's usually the fiber getting scratched on insertion unless you're in a dirty environment.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If RMAing is out of the question, you could always introduce some loss to bring it under spec by using an attenuator or introducing extra patches.&lt;/p&gt;&#xA;" OwnerUserId="8079" LastActivityDate="2014-09-06T01:21:57.723" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10825" PostTypeId="1" CreationDate="2014-09-06T01:24:21.877" Score="1" ViewCount="1798" Body="&lt;p&gt;I have the following network setup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet -- | ASA 5500 | --- DMZ -- Checkpoint Firewall&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The checkpoint firewall is used to build a L2L tunnel for payment services. The checkpoint device requires publicly routable IP address. Our ISP has provided us with an additional /30 subnet that is routed in over our main link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The external address is assigned to the checkpoint device, but I'm unsure how to pass this traffic through the ASA. No nat is allowed per the payment vendor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should the ASA be configured to pass the traffic through to the checkpoint device?&lt;/p&gt;&#xA;" OwnerUserId="8312" LastEditorUserId="8312" LastEditDate="2014-09-06T16:58:33.043" LastActivityDate="2014-12-26T00:57:34.353" Title="Route external IP to DMZ on ASA" Tags="|cisco|routing|cisco-asa|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10826" PostTypeId="2" ParentId="10321" CreationDate="2014-09-06T01:38:33.923" Score="0" Body="&lt;p&gt;my understanding is NX-OS does not support copying from remote file system directly to NVRAM:.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The work around is to first copy the file to bootflash, then to copy from boot flash to NVRAM:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ie.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy ftp://user:password@server/config.cfg bootflash:///config.cfg&#xA;copy bootflash:///config.cfg startup-configuration&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="8313" LastActivityDate="2014-09-06T01:38:33.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10828" PostTypeId="2" ParentId="10814" CreationDate="2014-09-06T11:26:13.717" Score="6" Body="&lt;p&gt;You need to check a few things;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;DSL is an aggregation technology which is normally on 'shared' media (you will be sharing with other, both the media to the point of presence and aggregation devices such as DSLAM, LNS so there is always potential for oversubscription.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It will also depend on latency, you need to ask the carrier for latency numbers for the leased line and test this against your DSL links. (Leased line should be better) however remember if latency is high no matter how much Mb (bandwidth) you purchase your download speeds will be limited; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bandwidth-in-bits-per-second * Round-trip-latency-in-seconds = TCP window size in bits / 8 = TCP window size in bytes example below;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RTT is 20 ms, and connection speed is 10Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 x (10Mbps/8 * .020s) = 50Kbytes (using standard window size of 64K)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Maybe you should look at using QoS effectively to limit wasting bandwidth&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8175" LastEditorUserId="3191" LastEditDate="2014-09-08T19:35:13.237" LastActivityDate="2014-09-08T19:35:13.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10831" PostTypeId="1" CreationDate="2014-09-06T15:17:06.813" Score="5" ViewCount="8097" Body="&lt;p&gt;The infrastructure I currently work on has 3 switches: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One 3560X which is acting as a core switch and as a VTP Server with below characteristics:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no aaa new-model&#xA;system mtu routing 1500&#xA;ip routing&#xA;&#xA;interface FastEthernet0&#xA; ip address 10.0.0.11 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;&#xA;interface Vlan100&#xA; ip address 10.1.0.1 255.255.252.0&#xA;!&#xA;interface Vlan110&#xA; ip address 10.1.4.1 255.255.252.0&#xA; ip helper-address 10.0.4.40&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's got about 5 VLANs with IP set as 10.1.0.1/22, 10.1.4.1/22 etc. The FastEthernet0 is Management port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current VLAN Layout is like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vlan1                  10.0.0.1         YES NVRAM  up                    up      &#xA;Vlan2                  10.0.1.1        YES NVRAM  up                    up      &#xA;Vlan10                 unassigned      YES unset  down                  down    &#xA;Vlan20                 10.0.2.1        YES NVRAM  up                    up      &#xA;Vlan30                 10.0.4.1        YES NVRAM  up                    up      &#xA;Vlan100                10.1.0.1        YES NVRAM  up                    up      &#xA;Vlan110                10.1.4.1        YES NVRAM  up                    up      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I have 2 other Cisco 2960Xs, acting as Access Switches and as VTP clients. Both switch is SSH enabled and I can do ssh by connecting to the management console and by assigning an IP to the client machine which is in the range management port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have below stuffs working correcting:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Inter-VLAN routing from all the switches.&lt;/li&gt;&#xA;&lt;li&gt;I can ssh to the Core switch using any of the VLAN IP addresses (E.g. 10.1.4.1) and manage it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I cannot ping the Default VLAN IP (10.0.0.1) from any other VLAN&lt;/li&gt;&#xA;&lt;li&gt;I cannot ping IP address given to the management consoles of the&#xA;2960Xs (10.0.0.11, 10.0.0.12).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Question is, how I can do an SSH to the Access Switch and Manage it by sitting in other VLANs? What configuration is pending here ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&#xA;Corrected wrong default VLAN IP Address. I can now ping the Default VLAN. &lt;/p&gt;&#xA;" OwnerUserId="8295" LastEditorUserId="8295" LastEditDate="2014-09-06T15:50:51.973" LastActivityDate="2014-09-08T19:14:20.907" Title="SSH to Access Switch Management Console from other VLANs" Tags="|cisco|vlan|management|" AnswerCount="2" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10832" PostTypeId="2" ParentId="10804" CreationDate="2014-09-06T17:48:50.953" Score="2" Body="&lt;p&gt;Seems that the trick is like that&#xA;(credit to Alex over at serverfault.com):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First go in your configuration terminal and create the class-map;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;asa(config)# class-map SIP_5080&#xA;asa(config-cmap)# match port tcp eq 5080&#xA;asa(config-cmap)# exit&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then create a policy-map;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;asa(config)# policy-map SIP_Policy&#xA;asa(config-pmap)# class SIP_5080&#xA;asa(config-pmap-c)# inspect sip&#xA;asa(config-pmap-c)# exit&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, assign the policy-map to an interface;&#xA;asa(config)# service-policy SIP_Policy interface [name of your interface]&lt;/p&gt;&#xA;" OwnerUserId="8294" LastActivityDate="2014-09-06T17:48:50.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10833" PostTypeId="1" CreationDate="2014-09-06T19:21:44.753" Score="2" ViewCount="663" Body="&lt;p&gt;Is it taken into account by the standards before they give the theoretical maximums per stream, per generation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could the loss in bandwidth due to TCP overhead be calculated? &lt;/p&gt;&#xA;" OwnerUserId="8320" LastEditorUserId="775" LastEditDate="2014-09-06T19:50:55.667" LastActivityDate="2014-09-06T21:58:40.823" Title="Where Does TCP overhead factor in when it comes to Wifi speeds?" Tags="|wireless|protocol-theory|bandwidth|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10835" PostTypeId="2" ParentId="10833" CreationDate="2014-09-06T21:58:40.823" Score="5" Body="&lt;p&gt;802.11 data rates are only reflective of how many &quot;bits per second&quot; are transmitted.  Whether those bits are made up of headers or actual data is not reflected in the data rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is also true of wired speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, generally speaking in networking, the more efficient the traffic is on the header to data payload ratio, the better off you are.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-06T21:58:40.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10840" PostTypeId="1" CreationDate="2014-09-07T00:53:44.597" Score="8" ViewCount="1021" Body="&lt;p&gt;Quick question for the VoIP gurus.  A while back I learned a trick where if I received a call on a VoIP phone, but after answering I couldn't hear anything, I would ask the person to press a number on their keypad if they could hear me.  If I heard the tone, I knew it was a one way audio situation.  I was wondering if anybody new why I would be able to hear the number tone but not their speech?&lt;/p&gt;&#xA;" OwnerUserId="8327" LastActivityDate="2015-01-16T20:58:21.443" Title="Troubleshooting One Way Audio" Tags="|voip|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10843" PostTypeId="2" ParentId="10840" CreationDate="2014-09-07T09:29:01.993" Score="8" Body="&lt;p&gt;Because in some VoIP protocols signalling (setup of connection, but also DTMF tones) can be carried in separate session from voice payload. If the voice payload can't traverse both ways (and it's often the case with NAT/firewall gateways) you'll get one way audio, but the connection still will be made and can provide some additional services (like your tones).&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="286" LastEditDate="2014-09-07T13:41:50.360" LastActivityDate="2014-09-07T13:41:50.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10846" PostTypeId="2" ParentId="10831" CreationDate="2014-09-07T15:12:39.370" Score="1" Body="&lt;p&gt;2960X have only one vlan interface allowed so I'm assuming you've configured the IP on Vlan1 for their management interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add the following to both switches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip default-gateway 10.0.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try ping the switch from another vlan now... it should work. SSH etc should work as well assuming you've generated crypto keys and the other associated work needed to enable a switch for SSH access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also why does the 3560X FastEthernet0 have the 10.0.0.11 address that you mentioned is assigned to one of your 2960s?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure Vlan1 has not been pruned from any trunks either. If you want to maintain Vlan1 for management data communication.&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2014-09-07T15:12:39.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10848" PostTypeId="2" ParentId="10820" CreationDate="2014-09-07T15:26:07.310" Score="6" Body="&lt;p&gt;'Backup Auto Tunnels' are what you're after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/mpls/configuration/guide/12_2sy/mp_12_2sy_book/mp_te_autotunnel.html#wp1055333&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/mpls/configuration/guide/12_2sy/mp_12_2sy_book/mp_te_autotunnel.html#wp1055333&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way you've currently set it out would need 'mpls traffic-eng backup-path' on the protected links. However this is the static backup tunnel way and if you use 'dynamic' paths the LSP will always signal using best IGP paths. Your protection paths will not be protected by a backup as the backup would try to use the same IGP path (due to lowest metric).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why an explicit path is necessary in IOS when using static backup tunnels as it allows the software to determine the alternate path that can provide protection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a read about 'auto tunnel backup' and it should resolve your query. IOS and IOS-XR both support Auto tunnels.&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2014-09-07T15:26:07.310" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10849" PostTypeId="2" ParentId="10811" CreationDate="2014-09-07T17:17:46.527" Score="6" Body="&lt;p&gt;Because it's entirely unnecessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In JunOS you can have multiple addresses on a single logical interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; show configuration interfaces lo0.0&#xA;family inet {&#xA;    address 127.0.0.1/32;&#xA;    address 127.0.0.2/32;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="500" LastActivityDate="2014-09-07T17:17:46.527" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10850" PostTypeId="2" ParentId="10318" CreationDate="2014-09-07T19:02:13.680" Score="1" Body="&lt;p&gt;Taking into consideration that you haven't posted your switches makes and configs, your WAN link could be your bottleneck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While saving on some costs it is usually a half-duplex connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recommendation:- &#xA;For the desired bandwidth between your sites, it makes more sense to rent fibre (or sdsl)  from a Telco/ISP provider as a point-to-point between your two sites (or install your own fibre).&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2014-09-07T19:02:13.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10852" PostTypeId="2" ParentId="10831" CreationDate="2014-09-07T23:24:55.393" Score="3" Body="&lt;p&gt;Based on @TeunVink's comments, Problem 1 was fixed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are the methods I have used for setting up the management interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I chose not to use VLAN 1 for management, as per many recommendations. So I cleared IPs from VLAN 1 and Management Console (Fastethernet0), as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;int vlan 1&#xA;no ip address&#xA;exit&#xA;int fa0&#xA;no ip address&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming that VTP is enabled is working between Core and Access switches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create a separate management vlan in the core switch. E.g. VLAN 10&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;vlan 10&#xA;name management&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assign IP address to this vlan&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int vlan 10&#xA;ip address 10.0.10.1 255.255.255.0&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then connect to the 2960 access switch via console and verify the vlan 10 is present there using show vlan command. It should be there as the VTP already would have taken care of distributing it. Now assign ip separately here for vlan 10 in the access switch as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;int vlan 10&#xA;ip address 10.0.10.2 255.255.255.0&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configure ssh by following &lt;a href=&quot;http://www.thegeekstuff.com/2013/08/enable-ssh-cisco/&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's it. Now Ping 10.0.10.2 from other vlans to the Access switch. Should be good to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41260-189.html&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; link can be treated as an excellent reference for this purpose. &lt;/p&gt;&#xA;" OwnerUserId="8295" LastEditorUserId="8295" LastEditDate="2014-09-08T19:14:20.907" LastActivityDate="2014-09-08T19:14:20.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10855" PostTypeId="1" CreationDate="2014-09-08T04:39:14.370" Score="0" ViewCount="388" Body="&lt;p&gt;I applied inbound ACL to block ping request from host IP to host IP. The effect after that is ping reply from unblocked IP on the interface that has been applied the inbound ACL is slow/loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any comment? Can it be solved by enabling flow control?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware:&#xA;Cisco 3700&#xA;Fastethernet&lt;/p&gt;&#xA;" OwnerUserId="8239" LastActivityDate="2014-09-08T22:00:50.863" Title="Ping reply is slow after applying inbound ACL" Tags="|acl|ping|icmp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10856" PostTypeId="1" AcceptedAnswerId="10880" CreationDate="2014-09-08T04:51:24.763" Score="1" ViewCount="298" Body="&lt;p&gt;I don't know if my question is clear. But, this is what I know now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet MAC sublayer is part of NIC (but I'm unclear of LLC sublayer). PPP, HDLC and frame relay can be implemented on the same serial link. Therefore, I assume PPP, HDLC and frame relay are not part of NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What other data link layer protocols that are not part of NIC?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please correct me if I am wrong.&lt;/p&gt;&#xA;" OwnerUserId="8239" LastActivityDate="2014-09-08T22:39:12.907" Title="Data link layer protocols that are not part of NIC" Tags="|layer2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10857" PostTypeId="1" CreationDate="2014-09-08T05:00:17.507" Score="16" ViewCount="15242" Body="&lt;p&gt;I have a question regarding BGP and how to achieve this configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My enterprise core router is connected to an ISP (single homed). This router has already exchanged the specific public ip prefixes to the ISP in BGP updates. Now lets says there is an AS several hops away that is flooding my local AS with a DDoS attack. There are multiple networks in that AS targeting the web servers in my local AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can we stop this traffic on our router by using BGP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate your response!! :)&lt;/p&gt;&#xA;" OwnerUserId="8343" LastEditorUserId="775" LastEditDate="2014-09-08T11:28:42.410" LastActivityDate="2016-09-21T14:57:41.707" Title="Use BGP to defend against a DDoS attack originating from remote AS" Tags="|routing|bgp|" AnswerCount="6" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10858" PostTypeId="2" ParentId="10857" CreationDate="2014-09-08T06:35:20.880" Score="4" Body="&lt;p&gt;From a BGP perspective, there is not much you can do. You could stop advertising your prefix but then you are just completing the DoS attack because noone will be able to access your service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have multiple prefixes you could renumber but likely the attack will move to the new prefix as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to do is to work with your upstream. Do they have a scrubbing service? If they have a system such as Arbor Peakflow, they could scrub the traffic and clean it before it enters your network. Such services are often very expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also other options such as Cloudflare and similar companies where you setup BGP through a GRE tunnel to that company and your traffic gets handled by their &quot;cloud&quot; which can handle a lot more traffic than your local devices.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-09-08T06:35:20.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10859" PostTypeId="2" ParentId="10857" CreationDate="2014-09-08T06:49:59.767" Score="14" Body="&lt;p&gt;There are two things you could do with BGP:&lt;/p&gt;&#xA;&lt;h2&gt;RTBH - Remotely-Triggered Black Hole&lt;/h2&gt;&#xA;&lt;p&gt;First option is the radical one: Blackhole (stop traffic) for the IP getting attacked. Downside: The IP being targeted is no longer reachable. Benefit: The rest of your network stays up. &lt;a href=&quot;http://packetlife.net/blog/2009/jul/6/remotely-triggered-black-hole-rtbh-routing/&quot; rel=&quot;noreferrer&quot;&gt;Packetlife has a nice explanation on how it work and how to do it.&lt;/a&gt; The second option builds on the first one:&lt;/p&gt;&#xA;&lt;h2&gt;Source-Based RTBH&lt;/h2&gt;&#xA;&lt;p&gt;RTBH can also be used (in certain configurations) to block traffic coming from specific IPs (in a real DDoS that wouldn't help much as traffic would come in from thousands of IPs). &lt;a href=&quot;http://packetlife.net/blog/2010/aug/23/source-based-rtbh/&quot; rel=&quot;noreferrer&quot;&gt;Again, Packetlife has an explanation.&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In your case you could get all prefixes for the AS from a Routing Database like &lt;a href=&quot;http://radb.net/&quot; rel=&quot;noreferrer&quot;&gt;RADB&lt;/a&gt; and block these with Source-Based RTBH. Traffic would still hit your network at the border though.&lt;/p&gt;&#xA;&lt;p&gt;When you use &amp;quot;simple&amp;quot; RTBH the advantage is that you can send these RTBH routes to your Upstream ISP (if they support it) who could then block the traffic in their network already so you don't have to handle it.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-09-08T12:44:33.540" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10862" PostTypeId="1" CreationDate="2014-09-08T14:34:16.077" Score="2" ViewCount="10473" Body="&lt;p&gt;Greetings Everyone!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My mind is about to explode as everyone is always blaming the network guys for disconnections and slowness in the networks, but Solarwinds Reports that all utilization in the network devices and links are Okay. So I tried sniffing then I got &quot;Zero Window&quot; errors. So If I may ask:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) &lt;strong&gt;How is TCP Window Size Allocated?&lt;/strong&gt; (Is it per TCP conversation like if you have 1 Application(Mozilla Firefox) and 5 tabs open, then the OS allocates Window Size per tab?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) &lt;strong&gt;What causes and How do you fix a &quot;TCP Zero - Window&quot; issue?&lt;/strong&gt; (The Stock Trading Server is the one who is having a hard time processing burst traffic and sending the TCP Zero window messages to the traders but based on the Network Utilization(CPU, Memory and Link Utilization of Network Devices) in Solarwinds and Performance Monitoring(CPU, Disk Space, Memory, NIC Utilization) in both the Stock Trading Server and Database Server, it shows that is Perfectly Normal and even under-utilized!.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.) &lt;strong&gt;Is it perhaps in the Trading Server's Settings?&lt;/strong&gt; (32 GB Memory but only uses the default tcp window allocation size of 64 MB)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.) &lt;strong&gt;Or is there something wrong with how slow the Trading Application process the data?&lt;/strong&gt; (I am planning to increase the TCP Buffer Size from 64KB to probably 256KB but it might not help if the the Trading Application Server itself process the data slowly.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5.) &lt;strong&gt;Also, all the traders are experiencing &quot;Unable to Connect to Trading Server&quot; and &quot;Intermittent Connections&quot; errors.&lt;/strong&gt; (but there's no report of network problem like &quot;down links&quot; or &quot;fully utilized links&quot;. I've even tried to change the polling data to every 1 minute to capture short disconnections but I still see no problem) So I think that there might be a latency problem&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6.) &lt;strong&gt;How do you measure Latency of Network Communication efficiently?&lt;/strong&gt; What Free and Paid Software Solutions do you recommend? (Traceroute reports 4ms and even if i increase the ping packet to 1mb, it also shows 1-3ms delay so I don't think that's helpful)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7.) &lt;strong&gt;How do you sort out each TCP thread/conversations if the source port and destination port are the same and the data is encrypted?&lt;/strong&gt; (Like if the Stock Trading Server and the SQL Server talks on the same port numbers but has multiple transactions going on.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry, I'm just new to the networking world so there are a lot of stuff I don't know and can't find in books and other resources. I think this kind of things are learned through experience so please share your wisdom.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you and Have a Good Day! :)&lt;/p&gt;&#xA;" OwnerUserId="7876" LastActivityDate="2014-10-11T17:18:32.380" Title="TCP Window Size Allocation and TCP Zero Window Errors" Tags="|tcp|monitoring|wireshark|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10864" PostTypeId="2" ParentId="10857" CreationDate="2014-09-08T16:03:15.237" Score="-2" Body="&lt;p&gt;You can blackhole their AS from your local network, so your BGP router creates null routes for any prefix they announce.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pro:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;your AS will appear dead to them, which is their goal, while you still exchange data with everyone else normally.&lt;/li&gt;&#xA;&lt;li&gt;your local ingress filtering will automatically drop incoming packets from that AS&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Contra:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;they can create blackhole routes on your router, so be sure to have appropriate rules in place to keep your most vital routes intact&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2069" LastActivityDate="2014-09-08T16:03:15.237" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10865" PostTypeId="2" ParentId="10857" CreationDate="2014-09-08T17:00:06.873" Score="-1" Body="&lt;p&gt;If all the evidence you have collected is a flood of packets with source IP addresses from one particular AS, you have likely jumped to the wrong conclusion. A more likely explanation would be that those source IPs are spoofed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A reflection/amplification attack involves sending lots of packets spoofing the source IP address of a victim. If this is actually what is happening, and you have servers in your network, that can amplify an attack, then the network you are accusing of an attack is actually the victim, and you are aiding the attacker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In such a situation the solution is not to apply any sort of traffic engineering, but rather to configure your servers such that they cannot be used in an amplification attack. How to do this is not really a network engineering question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is of course possible, that all the packets are originating from one AS. With co-operation from the offending AS, you could get confirmation, that the packets do in fact originate from their AS. However with that level of co-operation, you could also get the attack blocked at the source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we assume you have through some method I haven't thought about gotten confirmation the packets are really originating from the AS you think, and that you cannot get it blocked at the source and instead want to block it through means of BGP, then  I have read about a somewhat risky method to achieve this. The idea is that you prepend an AS path to the route you are announcing. In this prepended AS path you include the AS number of the source of those packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the announcement reaches the BGP routers in the offending AS, they are going to detect a loop and drop the announcement. Meanwhile the rest of the world won't see a loop and accept the announcement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's the theory. Whether it will actually work in practice depends on a few different factors. For example it depends on actually using the AS number the packets are originating from, which could be different from the AS number announcing those IP addresses. (Such difference could be legitimate or due to spoofing.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also depends on your upstream not filtering the route if they find the AS path suspicious. Moreover networks further away from you may also drop your route for example if they also has had bad experiences with the offending AS and have decided to drop all routes from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's your call whether this approach is worth the risk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I would have linked to the source for this approach, if I could find it again.)&lt;/p&gt;&#xA;" OwnerUserId="5842" LastEditorUserId="5842" LastEditDate="2014-09-09T10:10:57.307" LastActivityDate="2014-09-09T10:10:57.307" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10866" PostTypeId="2" ParentId="10814" CreationDate="2014-09-08T18:00:39.680" Score="1" Body="&lt;p&gt;If the bandwidth is greater, then it is going to improve the speed of the connection... however, that's not your real question, is it? It seems you really want to know if it will improve the perceived speed for your clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer this, review all the other answers. Also check if you're utilizing your upstream bandwidth or not. You say you have 3 DSL lines at 8 Mbits each... OK, that's nice, but what's the upload rate on those? If you're running 8Mb down but only 384kb up, that's 24 Mb downstream but barely over 1Mb upstream. While most users download more than they upload, every TCP connection sends SOMEthing upstream... and some, eg Skype calls, VOIP, BitTorrent, etc, send a HECK of a lot upstream! If you're utilizing all your upstream bandwidth, then even if you have plenty of downstream to spare your users aren't going to be able to use it til they can send their ACK packets, their requests, their half of the video call, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you can identify your upstream and downstream bandwidth and utilization thereof, you can begin to tell what up/down bandwidth you'll need.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-09-08T18:00:39.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10868" PostTypeId="2" ParentId="644" CreationDate="2014-09-08T19:31:30.853" Score="11" Body="&lt;p&gt;I just came across a new way that I was never aware of before and offers the same information you find in the ASDM interface, including the feature to logoff a vpn session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issue this for example to get a list of site to site vpn tunnels that are up. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show vpn-sessiondb l2l&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;output example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Connection   : 192.168.1.1&#xA;Index        : 330                    IP Addr      : 192.168.121.0&#xA;Protocol     : IKE IPsec&#xA;Encryption   : DES 3DES               Hashing      : MD5 SHA1&#xA;Bytes Tx     : 62226826               Bytes Rx     : 71173170&#xA;Login Time   : 17:15:49 PDT Sun Sep 7 2014&#xA;Duration     : 19h:08m:49s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then to logoff that VPN tunnel you can execute the following to logoff based in index shown above.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpn-sessiondb logoff index 330&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8351" LastActivityDate="2014-09-08T19:31:30.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10869" PostTypeId="1" AcceptedAnswerId="10876" CreationDate="2014-09-08T19:54:41.857" Score="2" ViewCount="207" Body="&lt;p&gt;In order to establish a Websocket connection, according to the WebSocket protocol, the client must send to the server a HTTP Upgrade Request. This is the client's handshake. &#xA;Now, please tell me if I'm wrong: is it true that before sending that message the client must establish a TCP connection with the server, and that the client can only send that message after the TCP's three-way handshake?&#xA;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="8336" LastActivityDate="2014-09-10T06:15:39.600" Title="Question about Websocket protocol" Tags="|protocol-theory|transport-protocol|" AnswerCount="1" CommentCount="0" ClosedDate="2019-05-23T01:42:02.733" ContentLicense="CC BY-SA 3.0" />
  <row Id="10870" PostTypeId="1" CreationDate="2014-09-08T21:12:10.593" Score="17" ViewCount="103206" Body="&lt;p&gt;Is there such a thing as an Ethernet cable or technically no? Are they actually called UTP cables?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Twisted_pair#Unshielded_twisted_pair_.28UTP.29&quot;&gt;wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;UTP cables are found in many Ethernet networks and telephone systems.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8025" LastEditorUserId="8499" LastEditDate="2018-03-21T00:26:16.617" LastActivityDate="2022-01-13T14:05:03.067" Title="What's the difference between an Ethernet cable and a UTP cable?" Tags="|ethernet|layer1|cable|terminology|utp|" AnswerCount="6" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10872" PostTypeId="1" AcceptedAnswerId="18529" CreationDate="2014-09-08T21:16:57.773" Score="2" ViewCount="161" Body="&lt;p&gt;I have 3 different networks and I'd like users from network A to be able to wake up pc network B (ofc with certain password) so I guess it could be good idea to allow them to use WOL capabilities built in router.&lt;/p&gt;&#xA;" OwnerUserId="8352" LastEditorUserId="8499" LastEditDate="2018-02-14T16:50:23.420" LastActivityDate="2018-02-14T16:50:23.420" Title="RouterOS - creating user only with access to tools" Tags="|router|radius|accounting|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-09T23:56:13.173" ContentLicense="CC BY-SA 3.0" />
  <row Id="10873" PostTypeId="2" ParentId="10870" CreationDate="2014-09-08T21:19:59.590" Score="23" Body="&lt;p&gt;The accurate answer is that they are not Ethernet cables.  The cables themselves are not limited to transmitting Ethernet, nor is Ethernet restricted to using just UTP cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the first case, they are often used with many different types of signaling, including as examples voice and serial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the second case, you can run Ethernet over coax, fiber, or shielded cables as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it is common for people to call them Ethernet cables as this is probably their most widely used purpose.  So from a &quot;connotation&quot; standpoint, it isn't entirely inaccurate to call them Ethernet cables, especially when dealing with non-technical users.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-09-08T21:47:52.940" LastActivityDate="2014-09-08T21:47:52.940" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10875" PostTypeId="2" ParentId="10811" CreationDate="2014-09-08T21:41:43.537" Score="6" Body="&lt;p&gt;You can add an individual lo0.x to each routing-instance present. So if you configure multiple routing-instances, you can configure multiple, separate loopback interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this is 'the proper way to do it', instead of multiple loopbacks per single routing-instance. The purpose of the loopback interface is to act as both an anchor interface for identification, but also an 'always-up' anchor interface. There should be no need for multiple anchors or identification points for a single instance of a network-computing entity (my ad hoc alternative term for a routing-instance). As others have stated here already, it's not just plausible but advisable to merely add more addresses to the single loopback interface instead of creating more interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not being able to have that kind of functionality in a routing-instance would be disastrous for things like OSPF and others, so it's possible to place as many as necessary into each routing-instance you decide to configure (one being as many as necessary).&lt;/p&gt;&#xA;" OwnerUserId="3958" LastActivityDate="2014-09-08T21:41:43.537" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10876" PostTypeId="2" ParentId="10869" CreationDate="2014-09-08T21:46:11.023" Score="5" Body="&lt;p&gt;Since Websocket uses TCP as its protocol, then yes, you must establish a TCP connection before passing any other traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the same as any other protocol that utilizes TCP, such as HTTP, FTP, SSH, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the TCP connection is established, then the request to establish the Websocket connection can be sent across that TCP connection.  In practical use, the TCP connection will already be established if the Websocket request is going to the same host that was part of an earlier HTTP request, assuming the TCP connection hasn't been closed yet.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="630" LastEditDate="2014-09-10T06:15:39.600" LastActivityDate="2014-09-10T06:15:39.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10877" PostTypeId="2" ParentId="10870" CreationDate="2014-09-08T21:49:35.643" Score="2" Body="&lt;p&gt;UTP is a general-purpose/universal cable that can be used for, among other things, T1 lines, Ethernet, and serial communications (read: Junos serial console cabling).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet merely uses most/all of those pairs in the 4-pair (regular/poe), other technologies may not use all of the unshielded, twisted, pairs available in your standard UTP cable offering, like your standard telephone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet cabling, lastly, may now be classified as &quot;UTP for Ethernet&quot; as the standards for 10Gbps Ethernet and higher have more demands for quality versus distance than previous Ethernet speeds (read: 10Mbps).&lt;/p&gt;&#xA;" OwnerUserId="3958" LastEditorUserId="3958" LastEditDate="2014-09-09T05:53:53.543" LastActivityDate="2014-09-09T05:53:53.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10878" PostTypeId="2" ParentId="10855" CreationDate="2014-09-08T22:00:50.863" Score="-1" Body="&lt;p&gt;The problem is that you're using the finest-grained ACL (host-to-host with a specific protocol (icmp)) and it sounds like you're applying it to an interface that hosts a whole bunch of incoming traffic. You're asking the router to pay attention to three different fields to block or allow traffic, so if you could re-work that to two fields you'd likely see better performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not necessarily as a permanent solution, but as a temporary alleviation to the issue, can you apply that ACL in reverse on the exit interface that leads to the 'victim' you're trying to protect? And by reverse I mean don't allow your victim's icmp echo-replies to make it back to the 'attacker'. It's true this won't stop a flood of icmp inbound from attacker-to-victim immediately, but often echo requests are stopped (automagically or manually) after there aren't any replies. And in this manner you'd free that previous interface from the ACL burden you placed on it.&lt;/p&gt;&#xA;" OwnerUserId="3958" LastActivityDate="2014-09-08T22:00:50.863" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10879" PostTypeId="2" ParentId="10862" CreationDate="2014-09-08T22:32:33.747" Score="3" Body="&lt;p&gt;Well I think you are in luck, as there is a wireshark forum convo that addresses this completely, and describes your situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://ask.wireshark.org/questions/2365/tcp-window-size-and-scaling&quot; rel=&quot;nofollow&quot;&gt;https://ask.wireshark.org/questions/2365/tcp-window-size-and-scaling&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, it's not the network, it's more likely the server your traders are all trying to access. The server can't process the packets it's getting at the rate it's getting them (i.e., drinking from the firehose) and thus that message is the result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Asking about tools, well, wireshark ;) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need networking monitoring for long-term bandwidth and error graphing/tracking. Cacti and Nagios (or Icinga) are free applications that run on any unix/linux platform. For Windows, you're better off buying something from SolarWinds (you work for a trading firm so they should be able to spend a small amount on this); What's Up Gold would be a decent starting point. Not from SolarWinds but very good is PRTG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For immediate tools, read more on ping and traceroute in windows. The defaults for those commands are absolutely horrible, and tweaking them can give you better and faster results. If you have a unix/linux system available, mtr is the trace/path-performance tool-of-choice for network administrators.&lt;/p&gt;&#xA;" OwnerUserId="3958" LastActivityDate="2014-09-08T22:32:33.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10880" PostTypeId="2" ParentId="10856" CreationDate="2014-09-08T22:39:12.907" Score="2" Body="&lt;p&gt;I think the best way to answer that is to answer the reverse question- what protocols are part of NIC (sic)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network interface card handles (primarily, exceptions below) Layer1 and Layer2 of the OSI protocol stack; namely, physical/electrical signals, and HDLC/Ethernet-style framing of other data used in Layer3 (typically these days, IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read up on this wikipedia page-&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Data_link_layer&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Data_link_layer&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And anything not listed there is what's not included ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CAVEAT- most modern NIC's can now perform some sort of feature-set generally-known as 'offloading'- this can apply to Layer2 but typically involves Layer3 activities that would normally be handled by the CPU/OS-network-stack. Instead of burdening the operating system's network stack (and thus the CPU it runs on) most network interface cards have the ability to do things like processing checksums and other mundane activities, freeing the CPU to do more funstuff. Those mundane tasks, per the particular network interface card you are dealing with, might handle some Layer3 work. That's the only caveat, otherwise NIC's deal with Layer1 and Layer2, that's it.&lt;/p&gt;&#xA;" OwnerUserId="3958" LastActivityDate="2014-09-08T22:39:12.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10881" PostTypeId="2" ParentId="10814" CreationDate="2014-09-08T22:52:57.620" Score="1" Body="&lt;p&gt;You're either being quoted T1 (1.544 Mbps) or E1 (2 Mbps) lines. Those speeds are symmetrical, so you get 1.544 in each direction of a T1 simultaneously. The &quot;A&quot; in ADSL means it's asymmetric, and regardless of your ADSL speeds today, the upload of the circuit termination is a fraction of the download rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem to determine is- where do you need the speed? If the clients you service are needing to pull/download information to them to be happy, then bonding DSL is cheaper and can get you more than 1.544 Mbps of a T1. That's why ADSL technology is so popular in the residential Internet Access market- people send small amounts of internet requests that are fullfilled by webservers that send many multiples of data back (like video or web pages). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they send you more information (for instance, they have to upload backups or reports on a frequent basis) than they typically download at a particular time, you might be tying one hand behind your back with DSL technology, even when bonded. There are so many speeds of DSL it doesn't help to ask here- just determine what your full upload capability is from the client location and compare that to 1.544 Mbps. If it's less, and they need to send you gobs of info versus receiving it, then you need a T1 at their location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also keep in mind that T1 lines can be bonded as well (in a former life I bonded 4 of them for roughly 6Mbps of bidirectional access).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are in a region of the world that has E1's, substitute 2Mbps for the 1.544 you see in this post.&lt;/p&gt;&#xA;" OwnerUserId="3958" LastActivityDate="2014-09-08T22:52:57.620" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10882" PostTypeId="1" AcceptedAnswerId="10883" CreationDate="2014-09-09T02:31:07.617" Score="4" ViewCount="2319" Body="&lt;p&gt;I recently had a single-mode fiber cross-connect setup between two cabinets on different floors. I have a Brocade FESX648-PREM on one end and a Brocade FESX448-PREM on the other end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both switches have a Brocade E1MG-LX-OM 1000BASE-LX SFP transceiver. Both switches seem to recognize the SFP correctly with a &lt;code&gt;show media&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, after connecting the fiber cable to the transceivers, the link light on both ends did not turn on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shouldn't the link lights turn on without any configuration on the XC ports?&lt;/p&gt;&#xA;" OwnerUserId="8209" LastEditorUserId="3191" LastEditDate="2014-09-09T09:23:55.523" LastActivityDate="2014-09-09T09:23:55.523" Title="Single-mode cross-connect -- link light off" Tags="|fiber|brocade|transceiver|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10883" PostTypeId="2" ParentId="10882" CreationDate="2014-09-09T03:38:53.123" Score="6" Body="&lt;p&gt;Many types of fiber connections, including 1000base-LH/LX, use two strands of fiber.  However the strands are actually used individually as dedicated TX and RX on each and the traffic on each strand is entirely unidirectional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when you are connecting two such devices, you need to cross the strands at some point so that TX on one side matches up with RX on the other.  If you do not do so, you end up in a situation where TX on one side is connected to TX on the other and RX is connected to RX.  This results in no link connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiber patch cords typically come from the manufacturer either straight through or crossed depending on the manufacturer.  Depending on the number of cross connects, either one could give you the end result of a straight through connection (i.e. an even number of crossed connections results in a straight through connection).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a cross connect situation like you describe, where there is connectivity between floors by a third party, often they will provide you a straight through connection. The reason for this is that you are free to use the cross connect with any fiber solution you wish, which may include a solution that uses a single strand bidirectionally.  However there may be a number of different cross connections along the path, and if they don't tell you specifically whether it is straight through or crossed, it may be either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most fiber patch cords use some sort of plastic piece to connect the two strands of fiber together for easier insertion and removal. There is usually some means of detaching the strands from this plastic piece so that you reverse the strands and re-attach, but the exact means varies depending on the manufacturer (and sometimes the production run).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, some of these will open on some sort of plastic &quot;hinge&quot; that will open and allow the strand to be removed.  Others may require a &quot;twisting&quot; motion to remove and insert.  I know I have come across GBIC based cables where there are two plastic halves that enclose the strands, but I haven't seen that personally with LC connectors but I would imagine it's possible as well.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-09-09T03:45:14.733" LastActivityDate="2014-09-09T03:45:14.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10884" PostTypeId="1" AcceptedAnswerId="10887" CreationDate="2014-09-09T06:13:59.807" Score="4" ViewCount="26936" Body="&lt;p&gt;I have a BGP session where the other participant is advertising the default route in addition to a number of small prefixes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to filter out the default, but accept those other prefixes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to use:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip prefix-list no-default-route  seq 5 deny 0.0.0.0/0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In combination with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;neighbor 10.4.1.1 prefix-list no-default-route in&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that ends up filtering all of the smaller prefix routes as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way I can filter out the default, but accept all other prefixes?&lt;/p&gt;&#xA;" OwnerUserId="8209" LastEditorUserId="8209" LastEditDate="2014-09-09T06:39:54.237" LastActivityDate="2017-11-20T11:15:57.860" Title="Filter the default route, but accept all other routes" Tags="|bgp|brocade|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10885" PostTypeId="1" CreationDate="2014-09-09T06:16:04.330" Score="2" ViewCount="1844" Body="&lt;p&gt;I have a network that provides external IP addresses through VLANs. The same network also provides VLANs for internal use. Roughs map (not all switches):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                VLAN 20 (for internal subnet)&#xA;            |switchB|----|switchE|----computers  &#xA;                |&#xA;Router------|switchA| &#xA;                |                 VLAN 10 (with external IP)&#xA;            |switchC|----|switchD|----|Firewall|---server &#xA;                             |            |&#xA;                             --------------&#xA;                                  VLAN 20 (For internal subnet)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question, does this make a loop that will bring down the VLAN 20?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for all answers. &lt;/p&gt;&#xA;" OwnerUserId="8357" LastEditorUserId="509" LastEditDate="2014-09-09T06:34:28.490" LastActivityDate="2014-09-09T08:38:32.160" Title="Does this make a VLAN loop?" Tags="|switch|vlan|loop|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10886" PostTypeId="2" ParentId="10885" CreationDate="2014-09-09T06:35:35.770" Score="6" Body="&lt;p&gt;Assuming the firewall is a Layer 3 firewall (and not in layer 2 mode like some firewalls are) this won't generate a loop. If it will work, that's a totally different question, that depends on your actual configuration.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-09-09T06:35:35.770" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10887" PostTypeId="2" ParentId="10884" CreationDate="2014-09-09T06:46:22.310" Score="8" Body="&lt;p&gt;You need to add a statement to explicitly allow those prefixes after denying the default-route, so the final prefix-list becomes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list no-default-route seq 5 deny 0.0.0.0/0&#xA;ip prefix-list no-default-route seq 10 permit 0.0.0.0/0 le 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastEditorUserId="630" LastEditDate="2014-09-10T06:04:09.583" LastActivityDate="2014-09-10T06:04:09.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10888" PostTypeId="2" ParentId="10661" CreationDate="2014-09-09T06:54:43.053" Score="1" Body="&lt;p&gt;You need to add the following command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;aaa port-access authenticator 10 auth-vid 150&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would tell the switch that port 10 will use the auth-vid assigned VLAN for authenticated devices unless it gets a different value from RADIUS. Without this, it will just use the configured port value and ignore any RADIUS provided VLAN assignments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some digging and found this tidbit in one of my saved HP docs:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the RADIUS server specifies a VLAN for an authenticated supplicant connected to an 802.1X authenticator port, this VLAN assignment overrides any Authorized-Client VLAN assignment configured on the authenticator port. This is because both VLANs are untagged, and the switch allows only one untagged VLAN membership per-port. For example, suppose you configured port 4 to place authenticated suppli- cants in VLAN 20. If a RADIUS server authenticates supplicant “A” and assigns this supplicant to VLAN 50, then the port can access VLAN 50 for the duration of the client session. When the client disconnects from the port, then the port drops these assignments and uses only the VLAN memberships for which it is statically configured.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-09T06:54:43.053" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10889" PostTypeId="2" ParentId="10870" CreationDate="2014-09-09T07:09:57.637" Score="6" Body="&lt;p&gt;Some distinctions and history: Ethernet and other networking systems can use a variety of physical media, including fiber optic and metallic wires. Since the wires are almost always made of copper, people usually speak of fiber vs. copper. The original 3 MBps Ethernet developed by Xerox in the 1970s used 50-Ohm RG-8/U coax cable. Later a version using the thinner RG-58 50-Ohm coax was introduced. Eventually several different standards emerged which used twisted-pair cabling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;twisted pair&quot; means that, no matter how many conductors there are in the cable, they are arranged in pairs (for example orange and white-with-orange-stripe, green and white-with-green-stripe, etc.). The twist is important for properly carrying electrical signals down the wires, for several reasons.&#xA;1) Each signal is sent down a separate twisted pair, rather than using several signal wires plus a single shared ground. This produces less signal distortion, especially at higher frequencies. &#xA;2) The twist reduces &quot;cross-talk&quot; and other forms of interference between the signals in the same cable, and between cables. The wires act like antennas, so they send and receive electro-magnetic waves; if two wires are next to each other, a signal on one will be picked up by the other. The twist reduces this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Twisted-pair cables can be either STP (shielded twisted pair) and UTP (unshielded twisted pair). As the name implies, STP adds a conductive layer (typically metal foil) surrounding either each pair or the entire cable. This shielding helps reduce interference from electrical sources outside the cable. If the individual paris are shielded, this also reduces crosstalk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at the cable connecting your telephone to the wall. Assuming this is a conventional analog system like you would find at home (not a digital PBX or VoIP), all the conductors are parallel, rather than arranged in twisted pairs. For carrying a single voice signal, this is fine. But if you have many signals in the same cable (as in the thick cables that serve an entire office), you would hear other people's conversations if these cables did not use twisted pairs. So, those thick cables always use twisted pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look again at that phone cord. If you hold the two male connectors next to each other, facing the same way, you will see that the colors of the wires are in a different order. In fact, according to the spec for phone cords, they are always supposed to be &quot;crossover&quot; cables. That is, whatever color wire is all the way to the left at one end of the cable, must be all the way to the right at the other end, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK, what about TP Ethernet cables? First off, the standard cables are all &quot;straight-through.&quot; That is, the wire connected to the pin all the way on the left in the connector at one end has to be also be all the way to the left on the other end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you cannot just connect all the wires straight-through; you have to pair them properly on the eight pins. The TP Ethernet standard says that the two pins closest to the center of the connector must be attached to the same twisted pair of wires. The next two farther out must connect to another pair. The others are different; the two all the way to the left are a pair, and the two all the way to the right are a pair. And the computers, switches, and other equipment have their female jacks wired to take this into the account. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: they do make crossover Ethernet cables, which are used to connect, for example, two Ethernet switches together. If you look at one of these, you will see that the wire colors at the two ends are neither the same nor mirror-images of each other. Instead, they cross over so that the signals traveling along the cable in each of the two directions arrive at the right pins. However, many modern switches can sense what is at the other end, and the type of cable, and compensate for it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more thing: One of the differences between, say, a Cat 5 cable and a Cat 6 cable is that the Cat 6 twists more often and requires that the twist be maintained closer to the connector. This is one of the reasons it can handle the higher data rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the result of all this? If you tried to use an Ethernet cable to carry a telephone signal, it might work. But if you tried to use a telephone cable to carry an Ethernet signal, it wouldn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what about STP vs. UTP? While both can be used for Ethernet, UTP is much more commonly used, especially for new installations. The lack of shielding makes UTP less expensive and more flexible than STP, and the superior interference rejection of STP is usually not needed for acceptable performance. If you go to a computer store, you are much more likely to see UTP than STP, both in bulk cable (such as that intended to be installed inside a wall) and in patch cables which are sold with the connectors already attached.&lt;/p&gt;&#xA;" OwnerUserId="8360" LastEditorUserId="8360" LastEditDate="2014-09-12T21:57:51.827" LastActivityDate="2014-09-12T21:57:51.827" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="10891" PostTypeId="1" AcceptedAnswerId="10908" CreationDate="2014-09-09T11:06:30.197" Score="4" ViewCount="675" Body="&lt;p&gt;I used &lt;code&gt;iperf -c FOO_NODE -t 120 -i 10&lt;/code&gt; to test the network with the other node FOO_NODE, sometimes I get the result like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ ID] Interval       Transfer     Bandwidth&#xA;[  3]  0.0-10.0 sec  3.75 MBytes  3.15 Mbits/sec&#xA;[  3] 10.0-20.0 sec  3.75 MBytes  3.15 Mbits/sec&#xA;[  3] 20.0-30.0 sec  3.62 MBytes  3.04 Mbits/sec&#xA;[  3] 30.0-40.0 sec  3.88 MBytes  3.25 Mbits/sec&#xA;[  3] 40.0-50.0 sec  4.25 MBytes  3.57 Mbits/sec&#xA;[  3] 50.0-60.0 sec  3.75 MBytes  3.15 Mbits/sec&#xA;[  3] 60.0-70.0 sec  4.00 MBytes  3.36 Mbits/sec&#xA;[  3] 70.0-80.0 sec  3.62 MBytes  3.04 Mbits/sec&#xA;[  3] 80.0-90.0 sec  3.25 MBytes  2.73 Mbits/sec&#xA;[  3] 90.0-100.0 sec  3.75 MBytes  3.15 Mbits/sec&#xA;[  3] 100.0-110.0 sec  4.38 MBytes  3.67 Mbits/sec&#xA;[  3] 110.0-120.0 sec  3.50 MBytes  2.94 Mbits/sec&#xA;[  3]  0.0-120.5 sec  45.6 MBytes  3.18 Mbits/sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All are in range of 3~6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But sometimes I got the result like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ ID] Interval       Transfer     Bandwidth&#xA;[  3]  0.0-10.0 sec  54.0 MBytes  45.3 Mbits/sec&#xA;[  3] 10.0-20.0 sec  56.6 MBytes  47.5 Mbits/sec&#xA;[  3] 20.0-30.0 sec  58.2 MBytes  48.9 Mbits/sec&#xA;[  3] 30.0-40.0 sec  58.2 MBytes  48.9 Mbits/sec&#xA;[  3] 40.0-50.0 sec  59.4 MBytes  49.8 Mbits/sec&#xA;[  3] 50.0-60.0 sec  57.5 MBytes  48.2 Mbits/sec&#xA;[  3] 60.0-70.0 sec  58.0 MBytes  48.7 Mbits/sec&#xA;[  3] 70.0-80.0 sec  58.2 MBytes  48.9 Mbits/sec&#xA;[  3] 80.0-90.0 sec  58.8 MBytes  49.3 Mbits/sec&#xA;[  3] 90.0-100.0 sec  58.2 MBytes  48.9 Mbits/sec&#xA;[  3] 100.0-110.0 sec  57.6 MBytes  48.3 Mbits/sec&#xA;[  3] 110.0-120.0 sec  59.2 MBytes  49.7 Mbits/sec&#xA;[  3]  0.0-120.2 sec   694 MBytes  48.5 Mbits/sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All are in range of 40~50.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And 3~6 happened more often.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested that from a node in ec2 to a node in other cloud server center. And I don't think there'll be much congestion cause both of them are less used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This's weird. What's the problem?&lt;/p&gt;&#xA;" OwnerUserId="8362" LastEditorUserId="8362" LastEditDate="2014-09-09T11:26:04.603" LastActivityDate="2016-07-15T22:48:00.693" Title="There's huge gap between two results for iperf" Tags="|iperf|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10899" PostTypeId="1" CreationDate="2014-09-09T19:25:09.477" Score="8" ViewCount="13017" Body="&lt;p&gt;A switch doesn't alter the frame, and source/destination mac addresses remain how sending host specified them,so let me say it again Layer 2 Switching never changes the frames means no changes in MAC and in CRC values,switches either flood, forward, or filter MAC addresses. Since they do transparent bridging by nature!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every single port on a switch has its own mac address then what are they used for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there are some posts and discussion over this subject but there is no clear satisfying valid answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in this link &lt;a href=&quot;http://www.firewall.cx/networking-topics/protocols/spanning-tree-protocol/1042-spanning-tree-protocol-fundamentals.html&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; the guy says Switch changes the source mac address to its own port MAC addresses when want to flood or do any kinda transmission but provides no reference to that which kinda seems to be wrong!&lt;/p&gt;&#xA;" OwnerUserId="7741" LastEditorUserId="509" LastEditDate="2014-09-09T20:45:22.283" LastActivityDate="2016-03-19T13:54:02.863" Title="Why each and every single port on Layer 2 switches need to have it's own MAC address?" Tags="|switch|mac-address|switching|layer2|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10901" PostTypeId="2" ParentId="10117" CreationDate="2014-09-09T20:28:39.917" Score="4" Body="&lt;p&gt;Assuming you mean to protect confidentiality of the communication at IP layer with IPsec:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How would the underlying network be able to differentiate between UDP&#xA;  and TCP since they're at the transport layer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The next header field of the ESP header tells you the type of payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use tunnel mode (which is custom for VPNs), then without the necessary keys you cannot decide what's at transport layer because the next header field will tell you just that there's a whole IP packet encapsulated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use transport mode, then  the next header field tells you the type of payload at transport layer.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Will we still have TCP and UDP when we move the IPv6(Although I see&#xA;  that IPsec has been made optional for IPv6)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;TCP and UDP are agnostic to the layer-3 protocol. In fact, TCP and UDP (and SCTP and DCCP) exist also for IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What seems to puzzle you is that in IPsec tunnel (VPN) mode there is no way to inspect the content. This is supposed to happen at the tunnel end-points. An organization that is worried by this loss of control should not allow IPsec that is not under it's own control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further reading: &lt;a href=&quot;http://www.unixwiz.net/techtips/iguide-ipsec.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;An Illustrated Guide to IPsec&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7756" LastEditorUserId="7756" LastEditDate="2019-07-03T07:36:17.490" LastActivityDate="2019-07-03T07:36:17.490" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="10903" PostTypeId="1" CreationDate="2014-09-09T21:45:07.287" Score="2" ViewCount="758" Body="&lt;p&gt;I am attempting to set up a network for a large, warehouse-type space (~5000 sqm) with dozens of various devices. Not wanting to run miles of cable everywhere, we bought WiFi access points that boasted ranges of over 50 metres. As an total beginner in computer networking, I neglected to consider the transmitter ranges of the devices - I have no idea what the relationship is between AP range, device range, and signal quality. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See hastily-drawn image below, where the dotted line corresponds to the maximum signal range of the respectively-coloured device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fw0Fg.png&quot; alt=&quot;I drew this quickly to illustrate my concern. Like a Venn diagram of radio waves.&quot;&gt; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Device A can see AP and vice versa. All good, right?&lt;/li&gt;&#xA;&lt;li&gt;Device B cannot see AP and vice versa. No connectivity, right?&lt;/li&gt;&#xA;&lt;li&gt;Device C can see AP but the AP is out of the device's transmitter range. So what happens when the AP's signal can reach the device but not vice versa? Is any data transfer possible at this point? What's the typical range of a smartphone or laptop WiFi transmitter, anyway? If neither the AP nor the device can be moved, what's the solution here?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8377" LastActivityDate="2014-09-09T22:17:14.630" Title="WiFi hotspot range limited by device transmitter range" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10904" PostTypeId="2" ParentId="10899" CreationDate="2014-09-09T22:06:19.070" Score="9" Body="&lt;p&gt;One key use for per port MAC addresses on switches is for Spanning-tree BPDU's.  These are Layer-2 multicasts with source MAC address of the egress switch port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would have to brush up on other Layer-2 protocols such as TRILL and SPB, but they might also take advantage of a per port MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does that help?&lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2014-09-09T22:06:19.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10905" PostTypeId="2" ParentId="10903" CreationDate="2014-09-09T22:17:14.630" Score="4" Body="&lt;p&gt;Let me start out by saying that warehouses can often be a very difficult environment to deploy wireless and it is often best to get a wireless expert to design the wireless for them.  Any solution given here would just be a general idea and may not work in your environment without visiting the specific location, knowing the network needs of the devices, understanding what is being stored/moved in the warehouse (and how), etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speaking to this type of problem generally, this is often addressed in an enterprise environment by providing a full deployment of access points that provide adequate coverage everywhere.  However this doesn't often lend itself to wide open spaces such as warehouses (or stadiums, convention centers, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a space like you describe with devices using low powered radios, typically you would want to turn down the transmit power on the AP and use passive and/or active gain to increase the transmit and receive capabilities of the AP.  Most often, this takes the form of high gain and/or directional antennas.  While that is the most common, there are signal amplifiers and I have also seen locations that used leaky coax quite successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the flip side, this type of deployment can also run afoul of a number of other problems, such as the hidden node problem, which may need to get addressed.  End result is that I am back to the beginning and would recommend you hire a wireless expert if you want good and reliable coverage in a warehouse type setting.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-09T22:17:14.630" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10906" PostTypeId="1" CreationDate="2014-09-09T22:32:22.660" Score="1" ViewCount="67" Body="&lt;p&gt;I'm finding statements about SNMP holding-time like &quot;traps whose holding time expires are deleted.&quot; While that COULD be written less usefully, it would take significant effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming that it doesn't work exactly as described, else setting any holding time would delete all traps the moment that time passes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not seeing how this--as described--does anything but keep any and all traps from ever being sent. So what does holding time actually do, and how does it do it?&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-09-09T22:32:22.660" Title="What does SNMP holding time do, and how does it do it?" Tags="|snmp|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10908" PostTypeId="2" ParentId="10891" CreationDate="2014-09-10T05:43:21.797" Score="2" Body="&lt;p&gt;&lt;strong&gt;Welcome to the downside of cloud computing!  Jitter (latency variability) and aggressive oversubscription&lt;/strong&gt;.  Your node is competing for shared resources at many different points that can be greatly oversubscribed in public clouds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would tackle this problem by measuring/capturing the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;EC2 to EC2 (intra-cloud) iperf to elminate the traversal of the public Internet to the other cloud server.  Be sure to choose instances within the same region and availability zone (AZ) -- instances need to be in the same account to ensure they are in the same AZ.&lt;/li&gt;&#xA;&lt;li&gt;Traceroutes during slow and fast iperf runs to ensure paths haven't changed significantly that could account for latency differences.&lt;/li&gt;&#xA;&lt;li&gt;If possible, shutdown the instance and bring it back up in the hope that it moves to a different compute host.  Your issue could be the &quot;noisy neighbor&quot; problem.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Anything that subtracts from the full bandwidth available to you will reduce your iperf results.  That includes both competing traffic on-box and off-box.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2014-09-10T05:43:21.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10909" PostTypeId="2" ParentId="10272" CreationDate="2014-09-10T06:28:03.673" Score="0" Body="&lt;p&gt;After browsing few sites, I come across a youtube video which explains DHCP very well. Here it is : &lt;a href=&quot;https://www.youtube.com/watch?v=RUZohsAxPxQ&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=RUZohsAxPxQ&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it may help few more people like me..&lt;/p&gt;&#xA;" OwnerUserId="7795" LastActivityDate="2014-09-10T06:28:03.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10910" PostTypeId="1" AcceptedAnswerId="10937" CreationDate="2014-09-10T08:27:31.743" Score="10" ViewCount="404" Body="&lt;p&gt;I am new to Juniper and has a basic doubt about assigning an interface to a VLAN. I have read that JunOS admits both approaches. My question is, what method prevalence when you use &lt;strong&gt;both&lt;/strong&gt; of them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean, I have encountered this real config in a device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xe-5/1/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members [ v20 v30 ];&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;....&#xA;vlans {&#xA;    v40 {&#xA;        description OTHERVLAN;&#xA;        vlan-id 40;&#xA;        interface {&#xA;            xe-0/1/0.0;&#xA;            xe-5/1/0.0;&#xA;        }&#xA;    }&#xA;    v50 {&#xA;        description v50;&#xA;        vlan-id 50;&#xA;        interface {&#xA;            xe-0/1/0.0;&#xA;            xe-5/1/0.0;&#xA;        }&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case, what Vlan IDs are being transmitted by interface xe-5/1/0.0, v20 and v30? v40 and v50? all of them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastEditorUserId="3191" LastEditDate="2014-09-10T11:45:51.970" LastActivityDate="2014-09-11T15:37:26.163" Title="Juniper, vlan-centric vs interface-centric. Which has prevalence?" Tags="|juniper|juniper-junos|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10914" PostTypeId="1" CreationDate="2014-09-10T14:03:53.260" Score="8" ViewCount="47288" Body="&lt;p&gt;I inherited a bit of mess and am preparing to redo our IP addressing scheme and also split our network into multiple VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possibly something like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10.1.10.0/24 VLAN 10 VOIP&lt;/li&gt;&#xA;&lt;li&gt;10.1.20.0/24 VLAN 20 Users&lt;/li&gt;&#xA;&lt;li&gt;10.1.30.0/24 VLAN 30 Management&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The address scheme isn't really the question and the above is just an example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have not been able to get my head around is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I access all VLANs from my Macbook?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had to hit the ground running with this so I haven't had time yet for a proper course of study (will start on my CCNA soon). The problem with learning by total immersion is that there are often holes in my knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I gather that there are 3 options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Add multiple aliases to my laptop NIC and do VLAN trunking on the port the NIC is connected to. That is still pretty fuzzy to me.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Connect to a layer 3 switch and route between the VLANs. Our switches are all layer 2/3 (static layer 3 routes) but I can add a full layer 3 switch if need be.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Connect my laptop NIC to a router and route based on subnet. Something like a Cisco 2811 or 2821 with an multi-port ethernet card.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;With all that said, what is the &lt;em&gt;proper&lt;/em&gt; way to do this?&lt;/p&gt;&#xA;" OwnerUserId="8392" LastEditorUserId="8392" LastEditDate="2014-09-23T01:02:16.823" LastActivityDate="2020-08-02T02:23:01.587" Title="Access Multiple VLANs from One Computer" Tags="|vlan|layer3|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="10915" PostTypeId="2" ParentId="10914" CreationDate="2014-09-10T15:17:31.073" Score="0" Body="&lt;p&gt;I wish I could simply add a comment instead of propose this as an answer, but I don't have that ability yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will suggest to you that if you there are no firewall or ACL issues preventing you from accessing one VLAN from another, and that there are routes in your layer 3 switches to provide for that to happen, then all you have to do is trunk those VLAN down to your ethernet drop that your MacBook uses.  If you are connecting over 802.11 then simply make sure that the same restrictions I mentioned earlier aren't in place.  I do not see any reason you would need to subscribe to multiple IP addresses on your macbook to allow this to happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact the situation I describe above is exactly what I is being done from the PC I am typing this on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wish this were a comment only, but I do hope it helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="7534" LastActivityDate="2014-09-10T15:17:31.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10917" PostTypeId="2" ParentId="10914" CreationDate="2014-09-10T17:10:04.083" Score="2" Body="&lt;h2&gt;Obligatory Answer for a Windows Workstation&lt;/h2&gt;&#xA;&lt;p&gt;&lt;em&gt;(I've never seen such a setup on a Mac, but it might help to know what works on windows.)&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;I assume you require access to each of the VLANs to perform network administration tasks on those VLANs.&lt;/p&gt;&#xA;&lt;h3&gt;NIC and Driver with VLAN Support&lt;/h3&gt;&#xA;&lt;p&gt;I have had success using Intel mobile adapters that support VLANs on Windows desktop OSes.  In that case, the Intel driver adds a special &lt;code&gt;VLANs&lt;/code&gt; tab to the properties dialog box.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/T09s9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/T09s9m.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In that dialog box you can create different virtual network adapters for each VLAN, which you can enable and disable to switch between the VLANs.&lt;/p&gt;&#xA;&lt;h3&gt;VMs are your Friend&lt;/h3&gt;&#xA;&lt;p&gt;I found switching between VLANs on a single OS to be rather cumbersome for everything but the most basic administration tasks.  Inevitably you'll end up in a troubleshooting task where you need simultaneous positive connections to multiple VLANs.  The challenge in doing that on a single operating system is that you'll end up with multiple possible paths for your packets -- one for each VLAN.  In general, controlling to which network adapter (and therefore VLAN) an application on a single OS sends its packets is difficult or impossible to control.  On the other hand, if you have multiple VMs, you can enable exactly one network adapter corresponding to the VLAN to which you want to connect.  Then you have certainty over which VLAN everything on that entire VM is using.&lt;/p&gt;&#xA;&lt;p&gt;I've done some &lt;a href=&quot;https://networkengineering.stackexchange.com/a/6806/2662&quot;&gt;pretty elaborate network troubleshooting&lt;/a&gt; from a single pane of glass that way.  Actually, that link is also a great example of the uncertainty of which network adapter an application (in that case Chrome) ended up sending its packets.  Without VMs, you will severely limit your ability to troubleshoot.&lt;/p&gt;&#xA;" OwnerUserId="2662" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-09-10T17:10:04.083" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10918" PostTypeId="2" ParentId="10914" CreationDate="2014-09-10T19:25:23.007" Score="8" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Add multiple aliases to my laptop NIC and do VLAN trunking on the port the NIC is connected to&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Your keywords here are &amp;quot;tagged VLAN&amp;quot;. You might set up a switch port as a tagged member of all three VLANs and &lt;a href=&quot;https://web.archive.org/web/20130101213033/http://support.apple.com/kb/PH4322&quot; rel=&quot;nofollow noreferrer&quot;&gt;set up virtual interfaces using the VLAN tag identifiers in your Mac OS X instance&lt;/a&gt;, basically leaving you with three virtual interfaces in three virtual networks.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;If you ever wanted intercommunication between the three networks, this is not what you should do.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Connect to a layer 3 switch and route between the VLANs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;To nit-pick, you would not be able to access &amp;quot;the VLANs&amp;quot; in this case. Your IP packets would be routed to the destinations in these VLANs (and given that routing is set up correctly on the receivers, their response packets would be routed back), but you would not get any of the non-IP or broadcast traffic from these networks as long as you are not directly a member.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;This is the preferable option if you plan on interconnecting the networks anyway&lt;/em&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Connect my laptop NIC to a router and route based on subnet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This is not really different from your previous option aside from the fact that you are not using virtual interfaces configured for a VLAN membership (this is what an L3 switch actually is about) but physical interfaces tying up physical Ethernet ports. If you can avoid this, please do.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;what is the proper way to do this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;There is no proper way. You do what you need to do.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you are separating the networks in order to keep them &lt;em&gt;separate&lt;/em&gt; and to completely prevent inter-network communications, you should not interconnect them by a router in the next step.&lt;/li&gt;&#xA;&lt;li&gt;If you are just doing this to break up your broadcast domains in smaller pieces or in order to be able to control the kind of traffic they are exchanging (segmentation), choose a router (or L3 switch) capable of setting IP filters (mostly called ACLs in Cisco's implementation) according to your needs.&lt;/li&gt;&#xA;&lt;li&gt;If your laptop needs broadcast or non-IP traffic from these networks, you would need to connect it to a port configured as a member (either tagged or untagged) as the router would not forward this kind of traffic to another network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Choose your poison.&lt;/p&gt;&#xA;" OwnerUserId="795" LastEditorUserId="70070" LastEditDate="2020-08-01T15:02:31.603" LastActivityDate="2020-08-01T15:02:31.603" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="10919" PostTypeId="2" ParentId="10566" CreationDate="2014-09-10T19:56:17.993" Score="4" Body="&lt;p&gt;Because the concepts defined by OSI model are &lt;em&gt;useful&lt;/em&gt; for understanding real-world networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSI defines 7 layers, these layers (especially layer 5/Session and 6/Presentation) don't match well with the now dominant well-known telecom protocols (above and around IP) - the model should not be blamed for this. After all we can't say that the IP protocol stack is particularly well designed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The model defines a lot of very useful concepts, and distinctions to be made, in the  analysis/understanding/design of any complex telecom system.&lt;br&gt;&#xA;For example: the notions of &lt;em&gt;service&lt;/em&gt; and &lt;em&gt;protocol&lt;/em&gt;; the notion of &lt;em&gt;primitive&lt;/em&gt; (request, confirm,  indication, response, signal); the notion of &lt;em&gt;protocol entity&lt;/em&gt; and &lt;em&gt;Service Access Point&lt;/em&gt;; the notion of &lt;em&gt;connection&lt;/em&gt; vs. &lt;em&gt;association&lt;/em&gt;; the notions of &lt;em&gt;SDU&lt;/em&gt; (Service Data Unit), &lt;em&gt;PDU&lt;/em&gt; (Protocol Data Unit), &lt;em&gt;IDU&lt;/em&gt; (Interface Data Unit); etc. These concepts are extremely useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, OSI model is still used heavily to define current protocols.&lt;br&gt;&#xA;For example ISO 11073-20601 and friends (Point-of-care medical device communication), used in medical devices (typically over Bluetooth) heavily use OSI modelling of Application Layer.&#xA;Or the IEEE 802.xxx lower layer protocols (e.g. 802.15.4, radio protocol) - these use the ISO modelling of the lower layers. These protocols are recently designed and in use today.&lt;/p&gt;&#xA;" OwnerUserId="8398" LastActivityDate="2014-09-10T19:56:17.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10920" PostTypeId="1" CreationDate="2014-09-10T20:05:09.263" Score="10" ViewCount="65949" Body="&lt;p&gt;one difference is that  Rapid Spanning Tree Protocol (RSTP IEEE 802.1W) assumes the three Spanning Tree Protocol (STP) ports states Listening, Blocking, and Disabled are same (these states do not forward Ethernet frames and they do not learn MAC addresses). Hence Rapid Spanning Tree Protocol (RSTP IEEE 802.1W) places them all into a new called Discarding state.Learning and forwarding ports remain more or less the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So is it really a play on words or what? what are main differences?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="7741" LastActivityDate="2018-06-01T15:10:50.123" Title="RSTP vs. STP it really sounds just a big ball of semantics? what's the main difference between them?" Tags="|spanning-tree|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10921" PostTypeId="1" AcceptedAnswerId="10947" CreationDate="2014-09-10T20:24:49.683" Score="1" ViewCount="1282" Body="&lt;p&gt;What does &quot;rate 10000 cir 0&quot; mean on an alcatel device?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I thought cir ment &quot;committed information rate&quot; but why would it be&#xA;set on 0 in this example?  &lt;/li&gt;&#xA;&lt;li&gt;What does the &quot;rate 10000&quot; stand for?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="623" LastEditorUserId="775" LastEditDate="2015-05-04T11:15:13.707" LastActivityDate="2018-10-11T13:56:10.303" Title="What does &quot;rate 10000 cir 0&quot; mean on an alcatel device?" Tags="|speed|alcatel-lucent-7750|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10922" PostTypeId="2" ParentId="6915" CreationDate="2014-09-10T20:39:57.610" Score="1" Body="&lt;p&gt;ACKs are useful in sliding window protocols, they allow Transmitter A to be aware that data sent has been received by remote B. Transmitter A can then proceed to send next data - until its transmit window is full (of data sent to remote but not yet acknowledged).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ACKs may be considered more essential than NAKs. NAKs simply allow for &lt;em&gt;faster recovery&lt;/em&gt;, in the case where a packet/block sent by A is not received by B, and B detects by some way that a packet/block is missing.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is perfectly feasible to design a protocol supporting reliable transfer and flow control only with ACK, &lt;strong&gt;without NAK&lt;/strong&gt; (with retransmission by Transmitter in case Transmitter does not receive an ACK, retransmission mechanism that is needed in any case).&lt;/p&gt;&#xA;" OwnerUserId="8398" LastActivityDate="2014-09-10T20:39:57.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10923" PostTypeId="2" ParentId="6106" CreationDate="2014-09-10T22:26:01.680" Score="0" Body="&lt;p&gt;You may use the following protocol (inspired by PPP over Asynchronous Links RFC), with two special characters IDLE and ESC. You will need about 2 bytes of RAM at the Transmitter and 2 bytes at the Receiver to maintain state information (plus two more bytes for CRC computation). Payload data are arbitrary, from 0x00 to 0xFF.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say &lt;em&gt;IDLE&lt;/em&gt; is 0x7E, &lt;em&gt;ESC&lt;/em&gt; (for Escape) is 0x7D.&lt;br&gt;&#xA;IDLEs MAY be sent by Transmitter &lt;em&gt;at any time when it has no payload&lt;/em&gt; data to Transmit.&lt;br&gt;&#xA;When Transmitter wants to send a frame/packet, it MUST send IDLE, then the escaped (see below) payload data, then IDLE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As IDLE should not appear in frame data, we define a second special character ESC that will be used by Transmitter when it wants to escape data. IDLE and ESC itself will be escaped, at a minimum.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the Transmitter wants to send payload byte:&lt;br&gt;&#xA;- 0x7E (IDLE), it transmits two bytes: ESC followed by (IDLE ^ 0x40) [IDLE XOR 0x40]&lt;br&gt;&#xA;- 0x7D (ESC), it transmits two bytes: ESC followed by (ESC ^ 0x40)&lt;br&gt;&#xA;- other byte, it transmits the byte unchanged. Alternatively this byte MAY be escaped by ESC followed by (byte ^ 0x40), provided that (byte ^ 0x40) does not result in IDLE or ESC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The escaping formula (byte ^ 0x40) is not magic, it can be replaced by another. The important thing if that the result of the escaping formula is never ESC or IDLE.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the Receiver point of view, any data received between two IDLE makes a frame/packet. Receiver has to unESCape these data in order to get the initial payload data.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is of course strongly advised to add a (2-byte) CRC at the end of the frame/packet, just before the closing IDLE. This CRC has also to be ESCaped. CRC can be computed on-the fly, on a byte-by-byte basis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have implemented this kind of protocol (precisely: &lt;strong&gt;encapsulation&lt;/strong&gt;) numerous times, it's very simple, reliable and efficient.&lt;/p&gt;&#xA;" OwnerUserId="8398" LastEditorUserId="8398" LastEditDate="2014-09-10T22:53:43.607" LastActivityDate="2014-09-10T22:53:43.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10925" PostTypeId="2" ParentId="10857" CreationDate="2014-09-11T00:04:07.683" Score="7" Body="&lt;p&gt;The RTBH method described by @Sebastian via &lt;a href=&quot;http://packetlife.net/blog/2009/jul/6/remotely-triggered-black-hole-rtbh-routing/&quot; rel=&quot;noreferrer&quot;&gt;Packetlife&lt;/a&gt; is helpful, but that method will only work if your uplink is &lt;strong&gt;not&lt;/strong&gt; saturated by attack traffic. If your uplink is saturated, then the blackhole must be implemented at a point &lt;em&gt;before&lt;/em&gt; the attack traffic reaches your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can accomplish this with upstream blackhole communities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.he.net/adm/blackhole.html&quot; rel=&quot;noreferrer&quot;&gt;Hurricane Electric&lt;/a&gt; offers a simple explanation/example of customer-triggered blackholing with a BGP community:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Attack Starts &lt;/li&gt;&#xA;  &lt;li&gt;Customer identifies ip or ip range under attack &lt;/li&gt;&#xA;  &lt;li&gt;Customer static routes the ip or ip range to Null0 and adds an announcement of&#xA;  the corresponding prefix with a route map that tags it with 6939:666.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cisco configuration example (where X.X.X.X is the ip being attacked):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;ip route X.X.X.X 255.255.255.255 Null0&#xA;router bgp YourAS&#xA;network X.X.X.X mask 255.255.255.255 route-map blackhole&#xA;route-map blackhole permit 10&#xA;set community 6939:666&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that &lt;code&gt;6939:666&lt;/code&gt; is the blackhole community specific to Hurricane Electric. You would modify this value to correspond with the blackhole community of your upstream provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are of course multiple ways to configure this. On my Brocade gear, I use the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp&#xA;!&#xA;redistribute static route-map blackhole&#xA;!&#xA;!&#xA;route-map blackhole permit  5&#xA; match tag  66&#xA; set community  55555:666&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;55555:666&lt;/code&gt; is the blackhole community of your upstream provider. An upstream blackhole can then applied with a simple command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 123.123.123.123 255.255.255.255 null0 tag 66&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8209" LastEditorUserId="8209" LastEditDate="2014-09-11T09:40:05.867" LastActivityDate="2014-09-11T09:40:05.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10927" PostTypeId="2" ParentId="10920" CreationDate="2014-09-11T01:11:43.657" Score="11" Body="&lt;p&gt;RSTP needs backwards compatibility with STP switches. Thus Discarding state merges Disabled, Blocking, Listening into one. Ideally if running a complete RSTP topology then discarding becomes practically unneeded due to the explanation below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In STP BPDU will only be sent from root bridge &gt; down, therefore non-root bridges would only forward on BPDUs that are received from the root-bridge via their root port. Therefore topology change will mean a longer convergence time as the TCN has to be propagated to the root bridge first then from the root bridge out to all remaining bridges in the switching domain. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For STP Hello(2 secs), max age timer (10 x hello time, by default 20s), then 15s each for Listening and Learning. If no timers are touched  for STP and you haven't enabled any add-on features like backbonefast or uplinkfast then you can be looking at ~50s for convergence time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In RSTP all switches can send BPDUs every hello time period not just the root bridge, the BPDUs carry up to date information. This enables faster convergence as the switch that determines the failure can advise the rest of the switching domain(bridge) of the TCN(Topology Change Notification) immediately. As the failure detection time becomes 3 x hello timer. Therefore if the hello timers are left at the default of 2 secs, detection of a failure can happen within ~6 secs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RSTP also has two additional port states:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternate port : Technically in discarding state but is allocated as a alternate best path to the root-bridge. If the current root port fails the alternate port will take over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Backup port : This port is allocated as a redundant designated port. If there is already a designated port forwarding for that segment then this port will remain backup until it is needed. Technically this port is in discard state until needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more point RSTP marks edge ports as ports connected to end devices  (No BPDUs expected on this port). This enables STP 'portfast' features to ensure the host port comes up as quickly as possible to avoid dropping DHCP packets etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the main differences - Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="168" LastEditorUserId="168" LastEditDate="2014-09-11T01:17:47.510" LastActivityDate="2014-09-11T01:17:47.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10929" PostTypeId="1" AcceptedAnswerId="10932" CreationDate="2014-09-11T05:59:04.703" Score="7" ViewCount="11427" Body="&lt;p&gt;When an IPv4 packet traverses a router or is processed by a host, the TTL is decremented and if the TTL is too low, the packet is dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When is the TTL decremented? Before or after the packet is considered for dropping?&lt;/li&gt;&#xA;&lt;li&gt;What is the drop condition? Is it if the TTL=0? Or is it if the TTL would be 0 if the TTL were decremented? Something else?&lt;/li&gt;&#xA;&lt;li&gt;Do certain types of networking hardware behave differently than others? For example, if a router would drop a packet received with TTL=0, would a host also drop this, or would it forward it to the client?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;From this &lt;a href=&quot;http://www.dslreports.com/forum/r25655787-When-is-TTL-Decremented-by-a-Router-&quot; rel=&quot;noreferrer&quot;&gt;forum post&lt;/a&gt;, it appears that the answer to the first question is usually that the TTL is decremented only once the router has decided not to drop the packet, and that the drop condition is that the the packet is dropped if the TTL=0 on the received packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What that really leaves is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there more nuance to these answers than that forum post would make it seem?&lt;/li&gt;&#xA;&lt;li&gt;If a router would drop a packet, is a host delivering a packet to a client considered to be a &quot;hop&quot; (and thus the packet is dropped), or not?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8404" LastActivityDate="2014-09-11T07:36:01.667" Title="When is an IPv4 TTL decremented and what is the drop condition?" Tags="|ipv4|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10931" PostTypeId="1" CreationDate="2014-09-11T07:03:12.997" Score="2" ViewCount="1147" Body="&lt;p&gt;I have a couple problems that I'm trying to find solutions to. I have Openswan and ASA configure as a IPSec VPN tunnel and the connection is established and working, but with some little problems. The topology is looking like this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;MyPC&#xA;  (192.168.0.0/23)&amp;lt;--&gt;ASA==IPSecVPNTunnel==Openswan(192.168.10.0/23)&amp;lt;-&gt;Server1,2,3,4,5&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;ping&lt;/code&gt; from myPC to one of the servers is working. But &lt;code&gt;ping&lt;/code&gt; from the servers or Openswan is not working. What I have done for now is using &lt;code&gt;iptables&lt;/code&gt; (POSTROUTING,MASQUERADE,enabled forwarding etc.). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the routing table it appears that I'm missing the route that Openswan should've added.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Kernel IP routing table Destination     Gateway         Genmask        Flags Metric Ref    Use Iface&#xA;1.1.1.1    0.0.0.0         255.255.255.192 U     0      0        0 eth0&#xA;192.168.10.0      0.0.0.0         255.255.254.0   U     0      0        0 eth2&#xA;169.254.0.0     0.0.0.0         255.255.0.0     U     1002   0        0 eth0&#xA;169.254.0.0     0.0.0.0         255.255.0.0     U     1003   0        0 eth2&#xA;0.0.0.0         1.1.1.1    0.0.0.0         UG    0      0        0 eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I don't know why it's not adding. When I try to add it manually, it still is not working. Any solutions about this or hints?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, this is all installed on CentOS with two physical interfaces eth0 (public) eth2 ( local ) and this is what I found in the log files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sep 11 05:36:09 localhost pluto[7516]: &quot;infra&quot; #6: route-client output: /usr/libexec/ipsec/_updown.netkey: doroute `ip route replace 192.168.0.0/23 via 192.168.10.1 dev eth0  src 192.168.10.1' failed (RTNETLINK answers: No such process)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8017" LastEditorUserId="5483" LastEditDate="2016-05-10T18:31:20.503" LastActivityDate="2016-05-10T18:31:20.503" Title="Openswan not updating the routing table" Tags="|vpn|ipsec|" AnswerCount="0" CommentCount="2" ClosedDate="2019-03-14T01:20:04.543" ContentLicense="CC BY-SA 3.0" />
  <row Id="10932" PostTypeId="2" ParentId="10929" CreationDate="2014-09-11T07:36:01.667" Score="9" Body="&lt;p&gt;What you are looking for is specified in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1812#section-4.2.2.9&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1812&lt;/a&gt;. To answer your specific questions:&lt;/p&gt;&#xA;&lt;p&gt;The router would drop the packet when it sees the TTL is too low after it decides to forward it:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Note in particular that a router MUST NOT check the TTL of a packet&#xA;except when forwarding it.&lt;/p&gt;&#xA;&lt;p&gt;A router MUST NOT originate or forward a datagram with a Time-to-Live&#xA;(TTL) value of zero.&lt;/p&gt;&#xA;&lt;p&gt;A router MUST NOT discard a datagram just because it was received with&#xA;TTL equal to zero or one; if it is to the router and otherwise valid,&#xA;the router MUST attempt to receive it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The receiving host doesn't check the TTL so even though a packet with TTL 0 should not be sent the receiving host will process it anyway:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;TTL expiration is intended to cause datagrams to be discarded by&#xA;routers, but not by the destination host.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="632" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-09-11T07:36:01.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10937" PostTypeId="2" ParentId="10910" CreationDate="2014-09-11T15:37:26.163" Score="2" Body="&lt;p&gt;As @Ryan suggests, I use show ethernet-switching interfaces xe-5/1/0 to show what VLAN id are being transported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to this info, the 4 VLANs are being transported. So VLAN-centric and interface-centric are compatible.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2014-09-11T15:37:26.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10939" PostTypeId="2" ParentId="10862" CreationDate="2014-09-11T16:44:28.730" Score="2" Body="&lt;p&gt;This question is a bit too broad to answer without more details regarding client/server configurations, hardware, and packet captures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP Window Zero happens when one side (can be client or server, but usually server) is receiving more data than it can process. TCP Window is basically a receive buffer that data is placed into as received and waiting to be processed. If the buffer gets full, a TCP Window Zero condition is sent out to halt the data transfer until the buffer is processed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The buffer is by default fairly small, but this can be overcome by both sides (client/server) agreeing to use Window Scaling during the TCP handshake. If both sides do not agree to use it, then the smaller default buffer size is used. It's important to note, that interconnecting devices along the path can be malfunctioning and changing the options during the handshake (thus causing options like Window Scaling not to happen even if both sides want to use it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many reasons the buffer can be full, but ensure that Window Scaling is on. Then, I would look into issues with the server application and server itself.&lt;/p&gt;&#xA;" OwnerUserId="8099" LastActivityDate="2014-09-11T16:44:28.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10943" PostTypeId="2" ParentId="10899" CreationDate="2014-09-11T21:39:13.110" Score="7" Body="&lt;p&gt;Okay, here is a more direct answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past implicit tagging required each port to have a MAC address.  With 802.1Q, that is no longer necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transparent bridging does not alter the frame. Layer 2 switches do not need the base Ethernet MAC address of the device nor its switchport MAC addresses to operate. The source and destination MAC addresses of the incoming frame are examined, the first one being saved in the MAC address table along with the receiving port, while the destination MAC address being looked up in the MAC address table to see if there is an associated port. If there is the frame is forwarded out that port only, otherwise it gets broadcast out all ports, except the source port (split horizon rule). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the whole process the frame remains completely unchanged (unless forwarded towards a VLAN trunk - then the frame gets tagged with VLAN ID).&lt;/p&gt;&#xA;" OwnerUserId="7534" LastEditorUserId="4341" LastEditDate="2016-03-19T13:54:02.863" LastActivityDate="2016-03-19T13:54:02.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10945" PostTypeId="2" ParentId="8092" CreationDate="2014-09-11T22:55:13.463" Score="5" Body="&lt;p&gt;No common usage cable is rated for exposure to the natural elements. If it isn't going to be used inside of a home or environment-controlled switching office, it either needs to be specially ordered, or carried inside of conduit which is tailored to the task. Not to say that it won't work, but rather that it isn't designed to perform under that duress. Even a small amount of water can attenuate a signal if it somehow finds its way into the core, and there are numerous ways in which the cladding of a non-hardened cable can be breached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Short answer: If it looks like the stuff you would plug into your home device, don't use it outside. It needs to be protected.&lt;/p&gt;&#xA;" OwnerUserId="8420" LastEditorUserId="8420" LastEditDate="2014-10-25T00:10:05.333" LastActivityDate="2014-10-25T00:10:05.333" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="10947" PostTypeId="2" ParentId="10921" CreationDate="2014-09-11T23:33:16.947" Score="4" Body="&lt;p&gt;User Teun Vink is very correct in his assertion that context is required, mainly in the platform that you are using and the configuration that the rate is being applied to, whether QoS or service utilization. Nevertheless, here is some basic information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CIR is your committed rate, which is the desired bandwidth of a service. It is not an indication of maximum, but a reservation of minimum bandwidth on the available interfaces the services is built. In an Alcatel-Lucent service router, the CIR is measured in kbps. As an example, if you have a 10gbps port and your services' CIR is 1048576, then your service has reserved all 1gbps of the port. If you then also have 10gbps of services mapped through that port without a CIR, then the service at 1gbps will always have 1gbps available to it, while all of the other traffic will be buffered and delayed in favor of that traffic. Most boxes will not allow you to provision a CIR that is higher than the maximum bandwidth capacity of a given port, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that you are using an Alcatel-Lucent service router in the 7xxx range of products, then the rate is a measurement of maximum kbps. The individual who applied &quot;rate 10000&quot; was probably trying to map the service for 10mbps, not realizing that our world of telecommunications and computing exists in base 16. The true measurement of 10mbps would be 10240kbps.&lt;/p&gt;&#xA;" OwnerUserId="8420" LastActivityDate="2014-09-11T23:33:16.947" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10949" PostTypeId="2" ParentId="9473" CreationDate="2014-09-12T00:01:05.140" Score="2" Body="&lt;p&gt;Everything that follows is assuming a traditional, classroom networking environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, D is not connected to any device that will allow it access to a network. It is connected to another client (C), establishing an ad-hoc point to point network connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the information provided, the only way to solve is to add a physical connection from D to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main question that I would ask is: How are each of the clients A, B, and C capable of multiple IP addresses, when the diagram clearly only shows a single physical connection? Where a switch/router would be able to apply IP interfaces onto VLANs, a PC is not capable of doing so. Is there a communication media that we are unaware of (wireless)?&lt;/p&gt;&#xA;" OwnerUserId="8420" LastActivityDate="2014-09-12T00:01:05.140" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10951" PostTypeId="2" ParentId="6075" CreationDate="2014-09-12T00:43:16.223" Score="4" Body="&lt;p&gt;You can change the paramters of what ESMTP inspection does by creating a custom policy map.  For example, say you wanted to do disable the banner masking and also log rather than deny lines greater than 998 characters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map type inspect esmtp custom_esmtp_map&#xA; parameters&#xA;   no mask-banner&#xA; match header line length gt 998 &#xA;  log&#xA; match body line length gt 998 &#xA;  log&#xA;!&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  no inspect esmtp&#xA;  inspect esmtp custom_esmtp_map &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8421" LastActivityDate="2014-09-12T00:43:16.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10952" PostTypeId="2" ParentId="6617" CreationDate="2014-09-12T00:44:56.720" Score="3" Body="&lt;p&gt;Hope this helps as I had the same issue and this corrected the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;568750 - False Duplicate IP detection on Logix Ethernet modules when used with Cisco switches&#xA;Access Level: Everyone&#xA;Date Created: 10/22/2013 10:54 AM&#xA;Last Updated: 08/27/2014 10:33 AM&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem&#xA;When Logix Ethernet modules are connected to a subnet containing Cisco switches with &quot;ip device tracking&quot; (IPDT) enabled, the modules may go into a duplicate IP address state after a restart/reset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Environment&#xA;Any layer two networks that contain both Logix Ethernet modules and Cisco switches running IPDT. IPDT is much more likely to be implemented on Cisco switches as of August, 2013 because of a behavior change which enables this command if any feature which requires it is enabled. This behavior change also removes the ability to turn off IPDT without first turning off any features which require IPDT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Stratix line of switches will not have “ip device tracking” enabled by default until a permanent solution is in place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cause&#xA;The IPDT feature sends probe ARP packets with a source IP address of 0.0.0.0., the source MAC ID of the switch, and the target IP and MAC ID for the device being probed to check that it is still connected and responsive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a device becomes disconnected, and then is reconnected within the configurable IPDT timeout period, probe ARP packets may be received by a Logix Ethernet module at the same time as it is in its Address Conflict Detection mechanism. If this happens, the Logix Ethernet module will immediately go into a duplicate IP state, and stop communicating.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPDT when activated on a Cisco switch will try to probe for every ip connected on the subnet, regardless of whether it is connected to that switch or not. Testing has shown that this affects the majority of Ethernet modules sold by Rockwell Automation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Workaround&#xA;Several workarounds to this issue exist. They all make suggestions using Cisco IOS command-line interface commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Workaround 1&#xA;Architect manufacturing zone subnets such that:&#xA;1.     IPDT is explicitly disabled on every trunk port with the following command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hostname (config-if)# ip device tracking maximum 0&#xA;2.     IPDT probe delay is manually configured on any access port connected to a Rockwell Automation Ethernet module with the following command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hostname (config)# ip device tracking probe delay 10&#xA;Workaround 2&#xA;If the switch in question has an administration IP (SVI) configured on the subnet/VLAN in question the Cisco CLI command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hostname (config)# ip device tracking probe use-svi&#xA;will insert the administration IP into the source IP in the IPDT packet. This packet will not impact Address Conflict Detection operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Workaround 3&#xA;Disable IPDT on any Cisco switch ports with IPDT enabled that subsequently connect to a Rockwell Automation Ethernet module with the following command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hostname (config-if)# ip device tracking maximum 0&#xA;Solution&#xA;The permanent solution is under consideration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Comments (1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;jbrodsky&#xA;06/04/2014 08:13 AM&#xA;This command does not work in all Cisco switch firmwares.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command that worked for me was &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hostname (config-if) # nmsp attach suppress&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and I later confirmed that it worked by issuing the following command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hostname # show ip device tracking all&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the device should NOT show up in the list of enabled devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The alternative command that others have used to disable IP device tracking is &#xA;Hostname (config-if) # no ip device tracking max&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that had no effect for me using a 3850 stack with version 3.02.03.SE&#xA;The command was accepted but did not disable anything when I checked with showing device tracking. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be forewarned that Cisco is having complaints about this issue and they are probably going to change the firmware yet again...&#xA;Reply | Flag as Inappropriate |&#xA;Post a Comment&#xA;Product Tree for This Answer (expand/collapse)Expand Product Tree for This Answer ID&#xA;Answers others found helpful&lt;/p&gt;&#xA;&#xA;&lt;p&gt;35072 - EtherNet/IP Duplicate Address Detection&#xA;118216 - Logix modules Duplicate IP address detection enhancement&#xA;51541 - 1756-ENBT display Duplicate IP scrolling over display&#xA;573991 - Unknown multicast traffic flooding network with 1783-ETAP with IGMP&#xA;42616 - IP addresses of Ethernet modules in a Redun&lt;/p&gt;&#xA;" OwnerUserId="8422" LastActivityDate="2014-09-12T00:44:56.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10956" PostTypeId="1" AcceptedAnswerId="11054" CreationDate="2014-09-12T05:04:04.503" Score="3" ViewCount="1562" Body="&lt;p&gt;I have two buildings. Building A has wifi (2.4GHz) infrastructure, Building B doesn't. One side of building B can pick up the wifi signal from building A. I want to &lt;em&gt;passively&lt;/em&gt; extend the signal through to the rest of building B, using two antennas and a short piece of coax. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Supposing I put a decent directional antenna (24dBi) in building B, pointing at a WAP in building A, then joined that to an omnidirectional antenna with a short (50cm) piece of coax. In this scenaria, for the omni antenna, would it be better to have a large (e.g. 12-15 dBi) antenna, or a small one (~7 dBi) (assuming the smaller one can still cover the range of the building)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware an active repeater would be better, but I'd like to get some thoughts on this scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: background reading: &lt;a href=&quot;http://www.netscum.com/~clapp/wireless.html#passive&quot; rel=&quot;nofollow&quot;&gt;http://www.netscum.com/~clapp/wireless.html#passive&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8426" LastEditorUserId="8426" LastEditDate="2014-09-14T23:42:11.990" LastActivityDate="2014-09-19T02:25:02.747" Title="Wifi passive repeater (antenna to antenna connection)" Tags="|wireless|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10960" PostTypeId="2" ParentId="10956" CreationDate="2014-09-12T09:10:53.933" Score="0" Body="&lt;p&gt;The antenna still needs to be connected to something that will function as the bridge in Building B. This will allow a bridge connection between A and B allowing clients to talk between the buildings. As the clients will need to associate with something locally as well as they won't just bounce off the passive antenna.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd put an AP in Building B that can bridge to an AP in Building A to provide a wireless uplink (bridge connection), ideally in the 5GHz spectrum. This connection can be omnidirectional depending on distance between buildings, if it is a fair distance away (&gt;150m then I'd probably start looking at directional antenna instead). Then have that AP also function as a local AP in the 2.4GHz spectrum for building B clients to associate with for connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Omindirectional 7dBi should be plenty... but again there is no mention of area/distance/size so it is hard to provide a recommendation without these measurement factors.&lt;/p&gt;&#xA;" OwnerUserId="168" LastEditorUserId="168" LastEditDate="2014-09-12T09:23:04.387" LastActivityDate="2014-09-12T09:23:04.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10962" PostTypeId="1" CreationDate="2014-09-12T09:53:16.323" Score="5" ViewCount="3951" Body="&lt;p&gt;I have a pair of Nexus switches configured for vPCs. In several cases, it is working correctly: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;core01# sh vpc consistency-parameters int po40&#xA;&#xA;    Legend:&#xA;        Type 1 : vPC will be suspended in case of mismatch&#xA;&#xA;Name                        Type  Local Value            Peer Value&#xA;-------------               ----  ---------------------- -----------------------&#xA;mode                        1     active                 active&#xA;Speed                       1     1000 Mb/s              1000 Mb/s&#xA;Duplex                      1     full                   full&#xA;Port Mode                   1     access                 access&#xA;MTU                         1     1500                   1500&#xA;Admin port mode             1&#xA;Shut Lan                    1     No                     No&#xA;vPC card type               1     FEX                    FEX&#xA;Allowed VLANs               -     1052                   1052&#xA;Local suspended VLANs       -     -                      -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, in several cases, it is not: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;core01# sh vpc consistency-parameters int po60&#xA;&#xA;    Legend:&#xA;        Type 1 : vPC will be suspended in case of mismatch&#xA;&#xA;Name                        Type  Local Value            Peer Value&#xA;-------------               ----  ---------------------- -----------------------&#xA;vPC card type               1     Empty                  FEX&#xA;Allowed VLANs               -     1-4094                 1-4094&#xA;Local suspended VLANs       -     -                      -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the partner switch, the local and peer values match what core01 reports: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;core02# sh vpc consistency-parameters int po60&#xA;&#xA;    Legend:&#xA;        Type 1 : vPC will be suspended in case of mismatch&#xA;&#xA;Name                        Type  Local Value            Peer Value&#xA;-------------               ----  ---------------------- -----------------------&#xA;vPC card type               1     FEX                    Empty&#xA;Allowed VLANs               -     1-4094                 1-4094&#xA;Local suspended VLANs       -     -                      -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I haven't been able to figure out why the vPC card type is reporting as Empty. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas or troubleshooting steps I could try? &lt;/p&gt;&#xA;" OwnerUserId="62" LastEditorUserId="8499" LastEditDate="2018-02-22T21:10:19.333" LastActivityDate="2018-02-22T21:10:19.333" Title="Cisco Nexus vpc card type mismatch" Tags="|cisco|vpc|cisco-nexus-5k|cisco-nx-os|fex|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10963" PostTypeId="2" ParentId="10661" CreationDate="2014-09-12T10:32:24.350" Score="2" Body="&lt;p&gt;Wow, I would have never though of this one. It was just a random solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the problem was with &lt;code&gt;authorize&lt;/code&gt; section in my &lt;code&gt;default&lt;/code&gt; site configuration at &lt;code&gt;/etc/raddb/sites-enabled/default&lt;/code&gt;, it was kind of default. I don't really know what's up with that (if you, guys, know, comment on that, please), gonna do some research on that; here it is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eap {&#xA;    ok = return&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I commented this out and replaced with just:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was not hoping any more to ever get it working and then I reconnected and... it happened, just randomly and I'm so excited now! I got assigned a VLAN dynamically:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Debug:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0001:03:15:51.07 RAD  mRadiusCtr:ACCESS REQUEST id: 194 to 192.168.1.27,&#xA;   session: 56, access method: PORT-ACCESS, User-Name: dot1x,&#xA;   Calling-Station-Id: dead00-00beef, NAS-Port-Id: 10, NAS-IP-Address:&#xA;   192.168.100.17.&#xA;0001:03:15:51.10 RAD  tRadiusR:ACCESS ACCEPT id: 194 from 192.168.1.27 received.&#xA;0001:03:15:51.10 1X   m8021xCtrl:Port 10: received Success for client&#xA;   dead00-00beef, finished authentication session.&#xA;0001:03:15:51.10 1X   m8021xCtrl:Port: 10 MAC: dead00-00beef RADIUS Attributes,&#xA;   vid: 100.&#xA;0001:03:15:51.10 1X   m8021xCtrl:Port 10: starting session for client&#xA;   dead00-00beef.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SW # show port-access authenticator 10 vlan&lt;/code&gt; - still shows Unauthorized VLAN 200 and Authorized VLAN 150&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Port Access Authenticator VLAN Configuration&#xA;&#xA;  Port-access authenticator activated [No] : Yes&#xA;  Allow RADIUS-assigned dynamic (GVRP) VLANs [No] : No&#xA;&#xA;       Access  Unauth  Auth&#xA;  Port Control VLAN ID VLAN ID&#xA;  ---- ------- ------- -------&#xA;  10   Auto    200     150&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SW # show vlans ports 10 detail&lt;/code&gt; - And the untagged VLAN on port 10 got set to &lt;code&gt;VLAN 100&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Status and Counters - VLAN Information - for ports 10&#xA;&#xA;  VLAN ID Name                 | Status     Voice Jumbo Mode&#xA;  ------- -------------------- + ---------- ----- ----- --------&#xA;  100     VLAN100              | Port-based No    No    Untagged&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SW # show port-access authenticator&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Port Access Authenticator Status&#xA;&#xA;  Port-access authenticator activated [No] : Yes&#xA;  Allow RADIUS-assigned dynamic (GVRP) VLANs [No] : No&#xA;&#xA;       Auths/  Unauth  Untagged Tagged           % In  RADIUS Cntrl&#xA;  Port Guests  Clients VLAN     VLANs  Port COS  Limit ACL    Dir&#xA;  ---- ------- ------- -------- ------ --------- ----- ------ -----&#xA;  10   1/0     0       100      No     No        No    No     both&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, if you want it to work, you have to create all required VLANs on the switch, otherwise you'll get this kind of stuff:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;W 09/12/14 12:47:57 02400 dca: 8021X client, RADIUS-assigned VID validation&#xA;            error. MAC DEAD0000BEEF port 10 VLAN-Id 0 or unknown.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the Windows will just say: &lt;code&gt;Authentication failed&lt;/code&gt; which is kind of confusing too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Didn't quite get it to work with unknown VLANs in spite of the fact GVRP was enabled, &lt;code&gt;aaa port-access gvrp-vlans&lt;/code&gt; was set and I also explicitly set &lt;code&gt;unknown-vlans learn&lt;/code&gt; on interface 10, but oh well...nvm. &lt;/p&gt;&#xA;" OwnerUserId="2093" LastActivityDate="2014-09-12T10:32:24.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10965" PostTypeId="1" AcceptedAnswerId="10980" CreationDate="2014-09-12T11:15:19.727" Score="-2" ViewCount="101" Body="&lt;p&gt;On a Cisco 3560 switch, are all L3 processing offloaded to card instead of normal CPU?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="775" LastEditDate="2014-09-13T22:19:57.760" LastActivityDate="2014-09-13T22:28:49.543" Title="L3 switch - All L3 processing offloaded to card?" Tags="|switch|layer3|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10969" PostTypeId="1" AcceptedAnswerId="10970" CreationDate="2014-09-12T20:38:21.580" Score="2" ViewCount="1071" Body="&lt;p&gt;I have a Brocade FESX648-PREM I set a static route with the following command:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip route 123.123.123.123 255.255.255.255 124.124.124.124&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Where 123.123.123.123 is my real IP address and 124.124.124.124 is an intentionally incorrect next hop IP.&lt;/p&gt;&#xA;&lt;p&gt;Since, 124.124.124.124 is an invalid next hop IP, 123.123.123.123 stops pinging immediately.&lt;/p&gt;&#xA;&lt;p&gt;However, when I clear the route with &lt;code&gt;no ip route 123.123.123.123 255.255.255.255 124.124.124.124&lt;/code&gt; the 123.123.123.123 still does not ping.&lt;/p&gt;&#xA;&lt;p&gt;If I follow up with  &lt;code&gt;clear ip route 123.123.123.123 255.255.255.255&lt;/code&gt; the IP again will continue to not ping.&lt;/p&gt;&#xA;&lt;p&gt;If I run a &lt;code&gt;show ip route 123.123.123.123&lt;/code&gt;, I can see that it is correctly routing to the default gateway.&lt;/p&gt;&#xA;&lt;p&gt;However, if I &lt;code&gt;write memory&lt;/code&gt; and &lt;code&gt;reload&lt;/code&gt; the switch, then the IP will ping again.&lt;/p&gt;&#xA;&lt;p&gt;It was suggested to me that I should verify that my &lt;code&gt;ip-route&lt;/code&gt; and &lt;code&gt;ip-cache&lt;/code&gt; entries are not exceeding their &lt;code&gt;system-max&lt;/code&gt; values, but that checked out OK as well:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Total number of IP routes: 64382, avail: 15618 (out of max 80000)&lt;/p&gt;&#xA;&lt;p&gt;Total number of cache entries: 303&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Any ideas why this route is getting &amp;quot;stuck&amp;quot;?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; I found a workaround. 1. Remove the invalid static route, 2. manually set the correct static route, 3. clear the route set in the previous step. Strange, seems like this should not be necessary. If anyone has any thoughts or suggestions on resolving the core issue, I'd still be very happy to hear them.&lt;/p&gt;&#xA;" OwnerUserId="8209" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-09-12T21:59:40.563" Title="Static IP route will not clear" Tags="|routing|brocade|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10970" PostTypeId="2" ParentId="10969" CreationDate="2014-09-12T21:50:17.643" Score="2" Body="&lt;p&gt;Is there another existing routing protocol, default route, or static-route that would begin to take precedence once the less explicit route entry is removed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does placing a static-route that is correct (valid next-hop) allow pings to flow again?&lt;/p&gt;&#xA;" OwnerUserId="8420" LastActivityDate="2014-09-12T21:50:17.643" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10972" PostTypeId="1" AcceptedAnswerId="10981" CreationDate="2014-09-13T03:11:03.783" Score="2" ViewCount="881" Body="&lt;p&gt;The IP address 127.0.0.1 is used to test the IP stack on an individual node. What is IP stack here ?Some blogs redirects this question to TCP/IP stack.But I am unable to co relate and understand it.&lt;/p&gt;&#xA;" OwnerUserId="8436" LastEditorUserId="8499" LastEditDate="2018-03-19T18:33:31.207" LastActivityDate="2018-03-19T18:33:31.207" Title="IP stack and loopback address" Tags="|ip|tcp|ip-address|loopback|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="10973" PostTypeId="2" ParentId="10972" CreationDate="2014-09-13T05:44:06.933" Score="2" Body="&lt;p&gt;It refers to the &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_layer&quot; rel=&quot;nofollow&quot;&gt;Internet Layer&lt;/a&gt; of the &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Protocol&quot; rel=&quot;nofollow&quot;&gt;Internet Protocol&lt;/a&gt;, not specifically to TCP/IP.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-09-13T05:44:06.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10976" PostTypeId="1" CreationDate="2014-09-13T08:41:36.857" Score="1" ViewCount="4635" Body="&lt;p&gt;I have configured an IPsec Site - site VPN tunnel with Cisco ASA on both sides.there is no issue with the phase 1 of tunnel.but frequently connection towards some IPs  become timedout&lt;br&gt;&#xA;only from some vlans. when i checked the device logs its showing like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Connection terminated for peer X.X.X.X(peer IP)  Reason: IPSec SA Idle Timeout  Remote Proxy X.X.X.X(remote end IP), Local Proxy X.X.X.X(Source end IP)&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we need to re-initiate the traffic from both the sides for re-establish the connection. &lt;/p&gt;&#xA;" OwnerUserId="2775" LastEditorUserId="509" LastEditDate="2014-09-13T15:20:18.320" LastActivityDate="2019-12-06T04:47:51.787" Title="Connection terminated for peer x.x.x.x. Reason: IPSec SA Idle Timeout" Tags="|cisco-asa|vpn|tunnel|l2vpn|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10978" PostTypeId="2" ParentId="10417" CreationDate="2014-09-13T16:45:27.177" Score="0" Body="&lt;p&gt;User Waiting time:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are interested in the mean time (T) each of N user should wait for the data, you can model the system as an M/G/1 queue. T can be seen as &quot;waiting in queue&quot; +  &quot;service time&quot;. For the latter you can assume deterministic service time (is the time for serving one only user), and for the former you can use the M/G/1 formula for queueing time ( M is for exponential distributed arrival that is good if user are uncorrelated; G is for geneneral service time, and in this case you can assume deterministic service time, e.g the time for serving a single user, and 1 stands for only one server aviable).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mean queueing time M/G/1: (l*(mean service time)^2) / 2(1 - ro))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;l (arrival/sec) is the arrival intensity: it is the parameter for exponential distribution modelling the arrival&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ro= l*(mean service time)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Server working time:&#xA;if you are interested in the time that is need for the server for finishing the job:&#xA;assuming F the file dimension, N the number of user, and C the server throughput, the server has to transmit NF bits. The time needed is NF/C&lt;/p&gt;&#xA;" OwnerUserId="8442" LastActivityDate="2014-09-13T16:45:27.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10980" PostTypeId="2" ParentId="10965" CreationDate="2014-09-13T22:28:49.543" Score="6" Body="&lt;p&gt;On the 3560 switch, as well as on most modern L3 switches still being sold, L3 is done on ASIC that handles a number of things - including L2 switching, L3 routing, ACLs, QoS and so on. &quot;Normal CPU&quot; is being used for chassis management and interaction with the user/admin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's no separate &quot;card&quot; in 1RU/2RU systems usually. On the chassis systems yes, sometimes L3 processing is done on a separate daughterboard on the line cards (in distributed fashion) or in main management module (usually called Supervisor).&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-09-13T22:28:49.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10981" PostTypeId="2" ParentId="10972" CreationDate="2014-09-13T22:36:06.030" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.cs.newpaltz.edu/~pletcha/NET_PY/the-protocols-tcp-ip-illustrated-volume-1.9780201633467.24290.pdf&quot; rel=&quot;nofollow&quot;&gt;TCP/IP Illustrated Volume 1&lt;/a&gt; discusses at a high level how the loopback address works in the context of an Ethernet driver (see Chapter 2 Section 7, and diagram 2.4). The reason why pinging the loopback address is used is because it verifies the correct operation of the TCP/IP &quot;stack&quot; on a system without it needing to be connected to anything else. Here &quot;stack&quot; is used to refer to a software suite, not a conceptual model, such as the TCP/IP model.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2014-09-13T22:36:06.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10983" PostTypeId="1" AcceptedAnswerId="10985" CreationDate="2014-09-14T10:28:57.077" Score="2" ViewCount="459" Body="&lt;p&gt;I am trying to setup a cisco 2811 router for a lan party. So Far I have the following configuration. The router can ping the &quot;outside&quot; lan, but nothing from &quot;inside&quot; can see out.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ena&#xA;&#xA;conf term&#xA;&#xA;no ip domain lookup&#xA;no logging console&#xA;&#xA;ip dhcp pool Main&#xA; network 172.16.0.0 255.255.0.0&#xA; default-router 172.16.0.1&#xA; dns-server 4.2.2.1&#xA;&#xA;exit&#xA;&#xA;int Fa0/0&#xA;&#xA;ip access-list standard 1&#xA; permit 172.16.255.255&#xA; deny any&#xA; exit&#xA;&#xA;interface FastEthernet0/0&#xA; ip address 172.16.0.1 255.255.0.0&#xA; duplex auto&#xA; speed auto&#xA; no shutdown&#xA; ip nat inside&#xA;&#xA;&#xA;interface FastEthernet0/1&#xA; no shutdown&#xA; ip address dhcp&#xA; ip nat outside&#xA; duplex auto&#xA; speed auto&#xA;&#xA;&#xA;&#xA;exit&#xA;&#xA;ip nat inside source list 1 interface FA0/0&#xA;ip route 0.0.0.0 0.0.0.0 FA0/1&#xA;&#xA;&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8447" LastEditorUserId="8447" LastEditDate="2014-09-14T11:07:24.590" LastActivityDate="2014-09-14T11:25:18.047" Title="Cisco 2811 nat question" Tags="|cisco|nat|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10984" PostTypeId="2" ParentId="10983" CreationDate="2014-09-14T10:37:52.827" Score="1" Body="&lt;p&gt;Unless you only want address 172.16.255.255 to be NAT'ed that access-list is wrong. It should be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list standard 1&#xA; permit 172.16.0.0 0.0.255.255&#xA; deny any&#xA; exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-09-14T10:37:52.827" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="10985" PostTypeId="2" ParentId="10983" CreationDate="2014-09-14T11:25:18.047" Score="4" Body="&lt;p&gt;Your translation is not correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should use &#xA;ip nat inside source list 1 interface &quot;FA0/1 overload&quot; instead of FA0/0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;remember your outside interface is Fa0/1 and you want your LAN to exit through that interface IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ravi&lt;/p&gt;&#xA;" OwnerUserId="1497" LastActivityDate="2014-09-14T11:25:18.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="10994" PostTypeId="1" AcceptedAnswerId="10995" CreationDate="2014-09-15T03:30:44.690" Score="2" ViewCount="696" Body="&lt;p&gt;With the purpose of registering many users on a big network (~600 users), each user's IP and MAC are needed. Currently, I am using arp command to retrieve the MAC, but for some users, I recieve an &quot;incomplete&quot; response. An example output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LucasKobo.rede           ether   3c:77:e6:d2:31:eb   C                     eth0&#xA;android-b83812fa0aa8e77          (incomplete)                              eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is the arp response incomplete? And is there a fail proof way of getting each users MAC and IP on the application layer?&lt;/p&gt;&#xA;" OwnerUserId="8457" LastActivityDate="2014-09-16T00:05:13.757" Title="Failing to obtain MAC" Tags="|ipv4|mac-address|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="10995" PostTypeId="2" ParentId="10994" CreationDate="2014-09-15T05:32:25.827" Score="4" Body="&lt;p&gt;Make sure the machine you're using to lookup the ARP table is in the same broadcast network as the MAC addresses you're looking for. If that's the case, generate some traffic towards the hosts you're looking for so that ARP requests will be sent. You can do this using &lt;code&gt;ping&lt;/code&gt; for example, or sweep an entire network using &lt;code&gt;nmap -sP &amp;lt;iprange&amp;gt;&lt;/code&gt;. After that, you should see an ARP entry in your ARP table if the device is online on the same broadcast network.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-09-15T05:32:25.827" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="10999" PostTypeId="1" AcceptedAnswerId="11005" CreationDate="2014-09-15T15:00:39.827" Score="1" ViewCount="1076" Body="&lt;p&gt;I have been running NetFlow successfully on all of my ASAs for the past few months.  Recently, one of my ASA failover pairs has decided to stop sending netflow packets.  Is there a command to restart the subsystem that handles netflow, or any other fix I'm overlooking?  I'd like to see if there are easier options before I move into &lt;code&gt;reload-standby;reload&lt;/code&gt; situations or even cold cycling the pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flow-export destination NYHQ-SERVERS 1.2.3.4 12346&#xA;flow-export template timeout-rate 1&#xA;&#xA;policy-map global_policy&#xA; class class-default&#xA;  set connection decrement-ttl&#xA;  user-statistics accounting&#xA;  flow-export event-type all destination 1.2.3.4&#xA;!&#xA;&#xA;ASA# sh flow counter&#xA;destination: NYHQ-SERVERS 1.2.3.4 12346&#xA;  Statistics:&#xA;    packets sent                                         45442077&#xA;  Errors:&#xA;    block allocation failure                                    0&#xA;    invalid interface                                           0&#xA;    template send failure                                       0&#xA;    no route to collector                                       0&#xA;    source port allocation failure                              0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="154" LastActivityDate="2014-09-15T18:38:59.957" Title="My ASA has decided to stop sending NetFlow traffic. Is there a way to fix this short of restarting?" Tags="|cisco-asa|netflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11005" PostTypeId="2" ParentId="10999" CreationDate="2014-09-15T18:38:59.957" Score="2" Body="&lt;p&gt;I found the reason and it was a stupid mistake.  For some reason the global policy was not enabled globally.  By executing &lt;code&gt;service-policy global_policy global&lt;/code&gt; I got netflow talking once again.&lt;/p&gt;&#xA;" OwnerUserId="154" LastActivityDate="2014-09-15T18:38:59.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11006" PostTypeId="2" ParentId="10994" CreationDate="2014-09-16T00:05:13.757" Score="0" Body="&lt;p&gt;For ARP table, MAC address = (incomplete) = not alive. In other word, the machine is not on. You can try this by ping to any unused IP in the same network and then check the ARP table for that IP. The MAC address = (incomplete).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: This is on *nix. On Windows, no entry at all for IP without MAC address.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2014-09-16T00:05:13.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11007" PostTypeId="1" CreationDate="2014-09-16T00:36:07.247" Score="6" ViewCount="1329" Body="&lt;p&gt;Ethernet can be divided into 2 sublayers; MAC and LLC. For WAN protocols like PPP, HDLC and frame relay, it is not discussed in regards to protocol sublayer for media access control. On serial interface, the encapsulation can be chosen from PPP, HDLC, frame relay, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, do WAN protocols like PPP, HDLC and frame relay have their own media access control protocol or do they use the same media access control protocol?&lt;/p&gt;&#xA;" OwnerUserId="8239" LastEditorUserId="8239" LastEditDate="2014-09-16T01:12:35.093" LastActivityDate="2016-03-13T13:06:56.830" Title="Media Access Control for WAN protocols (equivalent to IEEE 802.3 Ethernet sublayer)" Tags="|ethernet|wan|layer2|lan|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11010" PostTypeId="1" CreationDate="2014-09-16T05:56:49.403" Score="6" ViewCount="275" Body="&lt;p&gt;We have a Juniper ERX 310 configured as B-ras, as per specifications of the router, we should be able to terminate 8000 PPP sessions, but we notice that traffic on the router interface not going more than 710 Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the interface configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gigabitEthernet 2/0  &#xA;ip block-multicast-sources  &#xA;ip address x.x.x.x/x  &#xA;no ip proxy-arp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is no limitation on the interface, so is it hardware limitation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are the router modules: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SRP310-10G&#xA; GE-2 I/O &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="8499" LastEditDate="2016-04-01T00:39:52.800" LastActivityDate="2016-04-01T20:13:22.037" Title="Juniper ERX 310 traffic not going more than 710 mbps?" Tags="|router|juniper|pppoe|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11011" PostTypeId="1" CreationDate="2014-09-16T08:47:58.360" Score="0" ViewCount="671" Body="&lt;p&gt;Hello everybody I hope all is well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if somebody can help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to find a command to run for the power utilization on a ASR1006 using the following version of IOS-XE;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco IOS XE Software, Version 03.12.00.S&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&#xA;Zi&lt;/p&gt;&#xA;" OwnerUserId="8409" LastActivityDate="2014-09-16T11:57:53.983" Title="Cisco ASR1006 Power usage" Tags="|cisco|router|isp|cisco-asr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11012" PostTypeId="1" CreationDate="2014-09-16T08:56:43.697" Score="3" ViewCount="2530" Body="&lt;p&gt;What prevents two devices in separate subnets to talk to each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a device &lt;code&gt;d1&lt;/code&gt; in subnet &lt;code&gt;S1&lt;/code&gt; wants to talk to device &lt;code&gt;d2&lt;/code&gt; in subnet &lt;code&gt;S2&lt;/code&gt;, it sends an ARP request. Given that &lt;code&gt;d1&lt;/code&gt; and &lt;code&gt;d2&lt;/code&gt; are connected to the same switch, the switch will flood the broadcast ARP request all ports out. &lt;code&gt;d2&lt;/code&gt; can recieve the request and reply with its MAC address sent to the MAC address of &lt;code&gt;d1&lt;/code&gt; provided in the ARP request. Nothing prevents further communication of the devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Few questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I am thinking that protocol is the only thing that dictates the usage of a gateway to communicate accross subnets?&lt;/li&gt;&#xA;&lt;li&gt;Would this be a reason to use VLANs to crop the broadcast domain?&lt;/li&gt;&#xA;&lt;li&gt;How do separate VLANs prevent &lt;code&gt;d1&lt;/code&gt; and &lt;code&gt;d2&lt;/code&gt; to communicate if the MAC addresses are previously known?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="8475" LastActivityDate="2014-09-16T20:47:26.990" Title="How do I prevent communication across subnets?" Tags="|routing|switch|vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11014" PostTypeId="2" ParentId="11012" CreationDate="2014-09-16T11:27:39.717" Score="4" Body="&lt;p&gt;In your scenario (using TCP/IP), if d1 wants to talk to d2, it first determines that d2 is not in subnet s1.  Normally, the device will forward the data to the default gateway.  If, as in your case, there is no default gateway, d1 will not ARP, and instead return a 'network unreachable' error to the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answers to your questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, it's essentially the protocol that in fact defines subnetworks, and therefore the need for routing.  there are other protocols, such as Netbios, that do not have the concept of networks and therefore are non-routable.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There are many reasons to use VLANs. In most cases, there is one VLAN per subnet, and vice versa.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Switches will not forward frames from one VLAN to another.  so no traffic goes between them.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="8420" LastEditDate="2014-09-16T20:47:26.990" LastActivityDate="2014-09-16T20:47:26.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11015" PostTypeId="2" ParentId="11011" CreationDate="2014-09-16T11:48:42.413" Score="-1" Body="&lt;p&gt;IOS-XE could may be virtual i.e. on  CSR1000V and there is no power/environment options on this VM. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show platform hardware ?&#xA;crypto-device   crypto device information&#xA;interface       Interface information&#xA;network-clocks  Show network clock device&#xA;port            port information&#xA;qfp             Quantum Flow Processor&#xA;raid            raid information&#xA;slot            Slot information&#xA;subslot         Subslot information&#xA;throughput      Show throughput commands&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8479" LastEditorUserId="2142" LastEditDate="2014-09-16T11:57:53.983" LastActivityDate="2014-09-16T11:57:53.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11021" PostTypeId="2" ParentId="6617" CreationDate="2014-09-16T19:31:09.997" Score="2" Body="&lt;p&gt;[Sorry, worke intruded]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP Device Tracking/NMSP affect PLCs in automated production network. We had an issue too when adding a new 3850 to a network and the PLCs started reporting Duplicate IPs with the 3850 MAC, when that switch didn't even have an IP on that subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add to this that the Dupes weren't reported immediately, but had a 5-35 minutes delay after booting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I lost two days troubleshooting this, after opening a TAC, the Cisco engineer found the problem in less than 15 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;New Feature... new Active by Default Feature... which isn't easily linked to the symptoms when you first encounter it&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-09-16T19:31:09.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11022" PostTypeId="2" ParentId="8007" CreationDate="2014-09-16T20:42:51.850" Score="1" Body="&lt;p&gt;to whoever may run into this issue with the Cisco 7941(G)s, I was able to get it to work by using Microsoft DHCP Option 66. Putting the IP address in the ASCII string field for option 66 DOES NOT work. The string has to be a FQDN resolvable by your DNS servers. For me I created the A record for sip.mycompany.local on my DNS servers and placed that name in the DHCP option 66 field &quot;sip.mycompany.local&quot; no tftp:// ftp:// http:// https:// needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Short answer&lt;/strong&gt;&#xA;Option 66 ASCII String requires a name that the phone will query the DNS servers it is assigned by DHCP. Putting an IP address in this field will NOT work.&lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2014-09-16T20:42:51.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11023" PostTypeId="1" AcceptedAnswerId="11026" CreationDate="2014-09-16T22:31:04.040" Score="1" ViewCount="3919" Body="&lt;p&gt;My AP is set up to use a 40MHz channel:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kepfeltoltes.hu/140917/pic_www.kepfeltoltes.hu_.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;router http://kepfeltoltes.hu/140917/pic_www.kepfeltoltes.hu_.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, my macbook Air (2012 model) says that the connection is only 20mhz. I don't really know why, it should be 40MHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="8487" LastEditorUserId="8487" LastEditDate="2014-09-17T12:42:47.613" LastActivityDate="2014-09-17T12:42:47.613" Title="MacBook Air only uses 20MHz of a 40MHz 2.4GHz wifi channel" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11026" PostTypeId="2" ParentId="11023" CreationDate="2014-09-16T23:29:48.063" Score="2" Body="&lt;p&gt;The reason for this is that while the standard allows the use of a 40Mhz channel on 2.4GHz, this makes for only a single non-overlapping channel.  As the instances where you can actually do this without negatively impacting surrounding 802.11 networks are incredibly rare, the industry best practices state that you should only use 20Mhz wide channels in 2.4GHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, many wireless client devices will be configured by default to only utilize a 20MHz wide channel on 2.4GHz.  While some drivers will allow you to adjust this setting, others will not.  On MacBooks, you generally can't tweak the driver settings for most hardware options.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-16T23:29:48.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11027" PostTypeId="2" ParentId="11010" CreationDate="2014-09-17T00:45:43.647" Score="-4" Body="&lt;p&gt;&quot;Gigabit Ethernet&quot; = 1024 Mbps total maximum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After Ethernet &amp;amp; Protocol overhead, you're going to cap out at ~850 Mbps under the most ideal circumstances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: Network Engineer for a Fortune 50 who works extensively with Juniper gear.&lt;/p&gt;&#xA;" OwnerUserId="8489" LastActivityDate="2014-09-17T00:45:43.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11028" PostTypeId="1" AcceptedAnswerId="11031" CreationDate="2014-09-17T08:03:22.513" Score="6" ViewCount="3568" Body="&lt;p&gt;my question is simple: if I am logged into a Cisco router via console or ethernet in priviledged mode, is there a command to initiate a connection through the local AUX port to a nearby console port of another router/switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(alternatively, could I accomplish this if I configured reverse telnet on the local router and then type the command &quot;telnet local_loopbackIP 2xxx&quot; port?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="5249" LastActivityDate="2014-09-17T13:35:35.720" Title="console connection via Cisco router's AUX port" Tags="|cisco|router|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11031" PostTypeId="2" ParentId="11028" CreationDate="2014-09-17T13:29:51.457" Score="5" Body="&lt;p&gt;Yes, just telnet to a local (up) interface using port 2001.  Aux 0 is (always?) line 1.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int loopback0&#xA; ip address 192.168.1.1 255.255.255.255&#xA;!&#xA;line aux 0&#xA; transport input all&#xA; transport output all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Telnet 192.168.1.1 2001.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastEditorUserId="2104" LastEditDate="2014-09-17T13:35:35.720" LastActivityDate="2014-09-17T13:35:35.720" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11032" PostTypeId="1" AcceptedAnswerId="11039" CreationDate="2014-09-17T13:33:12.017" Score="1" ViewCount="850" Body="&lt;p&gt;I don't mean simply the data format of these, as that is easy enough to look up. I am referring to what they actually mean, and the units and where they originate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at a script I have been tasked with amending, it appears radiotap.mactime is the transmission end time of a frame (from which the transmission start time can be determined by subtracting the frame length in octets divided by radiotap.datarate&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, are there any up-to-date references that describe all the Wireshark elements in fairly leisurely terms?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A page such as &lt;a href=&quot;https://www.wireshark.org/docs/dfref/r/radiotap.html&quot; rel=&quot;nofollow&quot;&gt;https://www.wireshark.org/docs/dfref/r/radiotap.html&lt;/a&gt; is of fairly limited use if one doesn't know what most of the values mean!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIA&lt;/p&gt;&#xA;" OwnerUserId="6380" LastActivityDate="2014-09-17T18:33:01.820" Title="In a Wireshark trace how do radiotap.mactime and wlan_mgt.fixed.timestamp differ?" Tags="|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11034" PostTypeId="1" CreationDate="2014-09-17T13:53:00.640" Score="6" ViewCount="40384" Body="&lt;p&gt;If I want just 1 device to be on the network, can I set the subnet mask to 255.255.255.255?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the consider the network card configuration&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP   10.0.0.10     mask 255.255.255.255    Gateway 10.0.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.0.0.10 will be the only device in the network talking to the 10.0.0.1 gateway?&#xA;Is there a problem with this configuration?&lt;/p&gt;&#xA;" OwnerUserId="8191" LastEditorUserId="8499" LastEditDate="2020-07-17T01:12:38.430" LastActivityDate="2020-07-17T01:12:38.430" Title="Setting subnet mask to 255.255.255.255" Tags="|ip|ipv4|subnet|ip-address|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11036" PostTypeId="2" ParentId="11034" CreationDate="2014-09-17T15:16:44.893" Score="14" Body="&lt;p&gt;Yes, there's a problem.  Your default gateway needs to be in the same subnet as your device.  By setting the subnet mask to 255.255.255.255, you've told the computer that nothing else is in its subnet.  A more appropriate way to do things would be to set your device IP to 10.0.0.2, your gateway to 10.0.0.1, and your subnet mask to 255.255.255.252.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-09-17T15:16:44.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11037" PostTypeId="2" ParentId="11034" CreationDate="2014-09-17T15:18:28.993" Score="5" Body="&lt;p&gt;There are two machines in your subnet pc + gateway, so you should set up at least /30 mask (255.255.255.252) and the proper network of course.&#xA;Cheers.&lt;/p&gt;&#xA;" OwnerUserId="7718" LastActivityDate="2014-09-17T15:18:28.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11038" PostTypeId="2" ParentId="11034" CreationDate="2014-09-17T17:35:13.150" Score="3" Body="&lt;p&gt;A device address 32-bit mask cannot have a gateway; it must be routed.  Typically, 32-bit masks are used on loopback addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are attempting to have a point-to-point link, you may use a 31-bit mask, per RFC 3021, Using 31-Bit Prefixes on IPv4 Point-to-Point Links.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2014-09-17T17:35:13.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11039" PostTypeId="2" ParentId="11032" CreationDate="2014-09-17T18:33:01.820" Score="1" Body="&lt;p&gt;&lt;code&gt;radiotap.mactime&lt;/code&gt; is the &lt;a href=&quot;http://www.radiotap.org/defined-fields/TSFT&quot; rel=&quot;nofollow&quot;&gt;&quot;value in microseconds of the MAC's 64-bit 802.11 Time Synchronization Function timer when the first bit of the MPDU arrived at the MAC&quot;&lt;/a&gt;.  If it's the &lt;em&gt;end&lt;/em&gt; time, whoever wrote the driver for the adapter on which the capture was done apparently didn't read the radiotap Web site's documentation for that field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;wlan_mgt.fixed.timestamp&lt;/code&gt; is the field described by section 8.4.1.10 &quot;Timestamp field&quot; of &lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.11-2012.pdf&quot; rel=&quot;nofollow&quot;&gt;IEEE Std 802.11-2012&lt;/a&gt;.  The Time Synchronization Function is described in section 10.1 &quot;Synchronization&quot; in that document.  Note that the TSF timer does &lt;strong&gt;&lt;em&gt;NOT&lt;/em&gt;&lt;/strong&gt; represent any particular &lt;em&gt;absolute&lt;/em&gt; time, so you can't use it to, for example, determine the time and date at which some particular packet was transmitted or received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There probably aren't any references of the sort you describe.  Protocol specifications and tutorials don't generally talk about Wireshark (or any other particular network analyzer), so all you have to translate between a Wireshark field name and the field in the specification to which it corresponds is the field name and Wireshark blurb for the field, if it has a blurb.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2014-09-17T18:33:01.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11045" PostTypeId="1" AcceptedAnswerId="11065" CreationDate="2014-09-18T09:32:12.907" Score="2" ViewCount="103" Body="&lt;p&gt;O3b Networks provides a 8063 km height satellite network over the equator. This allows to provide an internet connection with 4x lower latency than when using geostationary satellite links. The connection is provided to fixed points on earth, as well as to ships over the oceans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For ships, they use a beam tracking system (as of the provider datasheet):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;O3b’s satellite beams follow the ship on its normal route.&lt;/li&gt;&#xA;  &lt;li&gt;O3b maintains the ship within the beam centre.&lt;/li&gt;&#xA;  &lt;li&gt;O3b receives latitude/longitude updates on two hour intervals via in-band or out-of-band channel.&lt;/li&gt;&#xA;  &lt;li&gt;Beam tracking updates in real time if the ship has to change course.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It probably works because the ship speed is relatively low, so that the beam tracking can adjust the beam to the ship's position.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can this technology be applied to an aircraft (e.g. speed, antenna size) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first guess would that the&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;aircraft speed is too high, so the beam tracking system may not be able to adapt in real-time (beam is 700 km wide)&lt;/li&gt;&#xA;&lt;li&gt;the antenna size is too big (1.2m diameter) to be integrated in the aircraft&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8511" LastActivityDate="2014-10-20T04:26:55.187" Title="Satellite link: can intermediate 8000 km height satellites provide connection in aircrafts" Tags="|routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11048" PostTypeId="1" AcceptedAnswerId="11050" CreationDate="2014-09-18T18:54:34.743" Score="1" ViewCount="1290" Body="&lt;p&gt;I want to convert 1023 into ipv4 format because I want to add this number to another number in ipv4 format.&#xA;Can anyone help to sort it out.&lt;/p&gt;&#xA;" OwnerUserId="8048" LastEditorUserId="40371" LastEditDate="2017-10-20T19:01:04.230" LastActivityDate="2017-10-20T19:01:04.230" Title="Convert decimal number to ipv4 format" Tags="|ipv4|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11050" PostTypeId="2" ParentId="11048" CreationDate="2014-09-18T19:32:49.380" Score="4" Body="&lt;p&gt;If you are using python you can do it simply with the IPAddress object from the netaddr library.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;In [68]: from netaddr import IPAddress&#xA;In [69]: IPAddress(1023)&#xA;Out[69]: IPAddress('0.0.3.255')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To get an integer value of an IPAddress object you can do the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;In [74]: IPAddress(&quot;10.10.0.0&quot;).value&#xA;Out[74]: 168427520&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you could do something like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;In [75]: IPAddress(&quot;10.10.0.0&quot;).value + IPAddress(1023)&#xA;Out[75]: IPAddress('10.10.3.255')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit: &#xA;If you just have pen and paper, here is how you do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll have to convert both to decimal form, add the two and convert from decimal to binary. When you convert 122.13.17.34 to binary break each octet out and convert that to binary, which will give you 01111010.00001101.00010001.00100010 then remove the dots can you get 01111010000011010001000100100010. Now convert that to a decimal number and you'll get 2047676706. Now 2047676706 + 1023 = 2047677729. Convert that back to binary and you'll get 01111010000011010001010100100001. Now breaking that up into octets and just convert those octets back to decimal and you'll get 122.13.21.33&lt;/p&gt;&#xA;" OwnerUserId="8265" LastEditorUserId="8265" LastEditDate="2014-10-10T03:09:16.633" LastActivityDate="2014-10-10T03:09:16.633" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="11052" PostTypeId="1" CreationDate="2014-09-18T21:21:02.510" Score="6" ViewCount="1409" Body="&lt;p&gt;I'm trying to set up a DMVPN Phase 2 configuration, but I cannot manage to get past Phase 1 because the hub router's tunnel interface refuses to disable split-horizon. The spokes never form an EIGRP adjacency to teach other and never learn routes directly to the other spokes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for suggestions on something I may be doing wrong. I've tried disabling on the interface itself and in the routing configuration as well just be sure. When I check the interface, it still says split horizon is enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't added any optimizations commands yet or anything unnecessary to establish communication. Once I can get my spokes talking directly, I'll worry about improving the configuration. This is solely a test environment right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: To clarify, the fact that spokes receive no routes to other spokes and never form adjacencies tells me that split horizon is still on. The Tun1601 interface shows split horizon still enabled. Sh ip eigrp interface says thats its disabled. Short of taking a packet capture and investigating what's really happen, it seems it is in fact not disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hub:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface Tunnel1601&#xA; description DMVPN over INTERNET&#xA; bandwidth 1000&#xA; ip vrf forwarding Green&#xA; ip address 172.17.13.7 255.255.252.0&#xA; no ip redirects&#xA; ip mtu 1400&#xA; no ip split-horizon eigrp 1601&#xA; ip nhrp authentication NHRPKey2&#xA; ip nhrp map multicast dynamic&#xA; ip nhrp network-id 1601&#xA; ip nhrp holdtime 300&#xA; ip nhrp registration timeout 30&#xA; tunnel source Port-channel2.7&#xA; tunnel mode gre multipoint&#xA; tunnel key 100001&#xA; tunnel vrf INTERNET&#xA; tunnel protection ipsec profile IPSEC-INTERNET&#xA;&#xA;router eigrp DMVPN-INTERNET&#xA; !&#xA; address-family ipv4 unicast vrf Green autonomous-system 1601&#xA;  !&#xA;  af-interface Tunnel1601&#xA;   no next-hop-self no-ecmp-mode&#xA;   no split-horizon&#xA;  exit-af-interface&#xA;  !&#xA;  topology base&#xA;  exit-af-topology&#xA;  network 172.17.12.0 0.0.3.255&#xA;  network 172.30.3.0 0.0.0.255&#xA;  network 172.30.6.0 0.0.0.255&#xA; exit-address-family&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sh ip int tun1601:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Tunnel1601 is up, line protocol is up&#xA;  Internet address is 172.17.13.7/22&#xA;  Broadcast address is 255.255.255.255&#xA;  Address determined by setup command&#xA;  MTU is 1400 bytes&#xA;  Helper address is not set&#xA;  Directed broadcast forwarding is disabled&#xA;  Multicast reserved groups joined: 224.0.0.10 224.0.0.251&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;  Proxy ARP is enabled&#xA;  Local Proxy ARP is disabled&#xA;  Security level is default&#xA;  Split horizon is enabled&#xA;  ICMP redirects are never sent&#xA;  ICMP unreachables are always sent&#xA;  ICMP mask replies are never sent&#xA;  IP fast switching is enabled&#xA;  IP Flow switching is disabled&#xA;  IP CEF switching is enabled&#xA;  IP CEF switching turbo vector&#xA;  IP Null turbo vector&#xA;  VPN Routing/Forwarding &quot;Green&quot;&#xA;  Associated unicast routing topologies:&#xA;        Topology &quot;base&quot;, operation state is UP&#xA;  Tunnel VPN Routing/Forwarding &quot;INTERNET&quot;&#xA;  IP multicast fast switching is enabled&#xA;  IP multicast distributed fast switching is disabled&#xA;  IP route-cache flags are Fast, CEF&#xA;  Router Discovery is disabled&#xA;  IP output packet accounting is disabled&#xA;  IP access violation accounting is disabled&#xA;  TCP/IP header compression is disabled&#xA;  RTP/IP header compression is disabled&#xA;  Probe proxy name replies are disabled&#xA;  Policy routing is disabled&#xA;  Network address translation is disabled&#xA;  BGP Policy Mapping is disabled&#xA;  Input features: MCI Check, TCP Adjust MSS&#xA;  Output features: TCP Adjust MSS&#xA;  Post encapsulation features: IPSEC Post-encap output classification&#xA;  IPv4 WCCP Redirect outbound is disabled&#xA;  IPv4 WCCP Redirect inbound is disabled&#xA;  IPv4 WCCP Redirect exclude is disabled&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;@cpt_fink&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sh ip eigrp vrf Green int&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;EIGRP-IPv4 VR(DMVPN-INTERNET) Address-Family Interfaces for AS(1601)&#xA;           VRF(Green)&#xA;                              Xmit Queue   PeerQ        Mean   Pacing Time   Multicast    Pending&#xA;Interface              Peers  Un/Reliable  Un/Reliable  SRTT   Un/Reliable   Flow Timer   Routes&#xA;Tu1601                   1        0/0       0/0          62       0/22         252           0&#xA;Lo2                      0        0/0       0/0           0       0/0            0           0&#xA;Gi0/1                    0        0/0       0/0           0       0/0            0           0&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="8099" LastEditorUserId="8099" LastEditDate="2014-09-19T18:47:43.927" LastActivityDate="2014-09-19T18:47:43.927" Title="Split Horizon will not disable on interface" Tags="|routing|troubleshooting|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11054" PostTypeId="2" ParentId="10956" CreationDate="2014-09-19T02:25:02.747" Score="2" Body="&lt;p&gt;I didn't want to answer until I validated my thoughts with a RF expert I know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While what you describe is possible based on the physics, you are most likely going to face issues in the real world application of such a repeater.  You are going to lose a fair amount of signal, probably in the 2-6dB range (or worse with low quality components).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, there is nothing to filter out any other interference or RF signal with something like this, so you will also be repeating that as well. This will potentially introduce additional interference into Building A and impact the wireless experience there.  Depending on the actual environment, the higher gain omni may help (&quot;flatter&quot; coverage may avoid some interference above/below) or hurt (repeat more interference on the same plane with the antenna).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another issue you may face is that depending on the components themselves, some amount of the signal may get &quot;reflected&quot; back out toward the original source.  Any directional filter you used to prevent this would also prevent bidirectional communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without testing, I think the real problem may be that you will find this works better in one direction than the other.  Ultimately, if you want to go down this road, you should test heavily to make sure this works as intended.  However, as wireless environments are always in flux, I wouldn't depend on this link too heavily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't even touch on some other problems this may introduce, such as the hidden node problem.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-19T02:25:02.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11057" PostTypeId="2" ParentId="11052" CreationDate="2014-09-19T06:33:41.150" Score="3" Body="&lt;p&gt;Try adding this command to your tunnel interface. Your spokes are receiving routes with the next-hop as the hub router without it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip next-hop-self eigrp 1601&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7730" LastEditorUserId="762" LastEditDate="2014-09-19T07:34:40.900" LastActivityDate="2014-09-19T07:34:40.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11058" PostTypeId="1" CreationDate="2014-09-19T06:33:52.490" Score="3" ViewCount="2064" Body="&lt;p&gt;I had 4x3850 - Lan Base and 1x3850 - IP Base, i want to put then in to stack, i think its not possible but can we downgrade the 1x3850 - IP Base to LAN Base. If yes then How, please provide the steps.....&#xA;Waiting for your response.&lt;/p&gt;&#xA;" OwnerUserId="5479" LastActivityDate="2014-10-22T07:45:03.150" Title="Cisco 3850 Switch Stack Issue" Tags="|switch|switching|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11059" PostTypeId="1" CreationDate="2014-09-19T09:06:09.550" Score="6" ViewCount="3774" Body="&lt;p&gt;Juniper has two kinds of Copper SFPs. One (&lt;strong&gt;SFP-1GE-T&lt;/strong&gt;) only does Gigabit. The other one (&lt;strong&gt;SFP-1GE-FE-E-T&lt;/strong&gt;) can also run at 100M and 10M respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, in the chassis inventory &lt;em&gt;both&lt;/em&gt; are identified as &lt;strong&gt;SFP-T&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FPC 11           REV 10   750-038489   XXXXXXXX          MPCE Type 1 3D&#xA;  CPU            REV 04   711-038484   XXXXXXXX          MPCE PMB 2G &#xA;  MIC 0          REV 27   750-028392   XXXXXXXX          3D 20x 1GE(LAN) SFP&#xA;    PIC 0                 BUILTIN      BUILTIN           10x 1GE(LAN) SFP&#xA;      Xcvr 0     REV 02   740-013111   XXXXXXX           SFP-T&#xA;      Xcvr 1     SX       740-011782   XXXXXXX           SFP-SX&#xA;      Xcvr 2     SX       740-011782   XXXXXXX           SFP-SX&#xA;      Xcvr 3     LX       740-011783   XXXXXXX           SFP-LX10&#xA;      Xcvr 4     REV 02   740-013111   XXXXXXX           SFP-T&#xA;      Xcvr 5     REV 02   740-013111   XXXXXXX           SFP-T&#xA;      Xcvr 6     REV 02   740-013111   XXXXXXX           SFP-T&#xA;      Xcvr 7     REV 02   740-013111   XXXXXXX           SFP-T&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On insert we see the SFP type in the syslog:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fpc11 MIC(11/0): Link 7 Tri Rate Copper SFP  - plugged in.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but except for that I know no way to distinguish these two. And after two years these logs are probably gone and noone knows the type anymore. So, is there another way?&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2015-05-05T18:39:03.900" Title="Is there a way to identify a Tri-Rate Copper SFP in a Juniper MX device" Tags="|juniper|sfp|hardware|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11060" PostTypeId="1" AcceptedAnswerId="11084" CreationDate="2014-09-19T13:59:55.127" Score="4" ViewCount="4003" Body="&lt;p&gt;i am replacing a Juniper SSG5 with Screenos against a SRX100 with Junos (12.1X44-D35.5).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am replacing a virtual router configuration that Looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                     +--------------------+&#xA;    192.168.0.1/24 --------(fe-0/0/2)| trust-vr           |&#xA;(Trust zone network)                 | routing-instance   | &#xA;                                     +--------------------+&#xA;                                               |&#xA;                                               |&#xA;                                               |&#xA;                                               |&#xA;                                     +---------------------+&#xA;   pppoe dynamic ip--------(fe-0/0/0)| untrust-vr          |&#xA;(Untrust zone network)               | routing-instance    |&#xA;                                     +---------------------+ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I found a Juniper KB that explains exactly this at &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB22053&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB22053&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In ScreenOS it is possible to Point static routes inside a VR to another VR (In this example: Inside trust-vr - Target 0.0.0.0/0 - next hop - untrust vr)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the Juniper KB with Junos they configure a Frame realy (virtual Interface) on both Virtual Routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This Approach has 2 downsides in my opinion: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I Need to configure IP Adresses for the Virtual Routers (okay i could live with that) but more important: The configuration is three times larger (more lines) than with ScreenOS and thus also more complex to troubleshoot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there no &quot;easy way&quot; to just set a Virtual Router as a next-hop in JunOS as it was possible in ScreenOS?&lt;/p&gt;&#xA;" OwnerDisplayName="user8530" LastActivityDate="2014-11-21T11:38:29.763" Title="Juniper SRX100 / Junos - Static Routers between virtual Routers" Tags="|juniper|juniper-junos|screenos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11063" PostTypeId="2" ParentId="11058" CreationDate="2014-09-19T19:29:26.097" Score="1" Body="&lt;p&gt;You cannot stack them if they have different licenses. Yes, you can downgrade them with the help of Cisco License TAC at &quot;Cisco Licensing Support&quot; . Its painful but I have done it before. &lt;/p&gt;&#xA;" OwnerUserId="8533" LastActivityDate="2014-09-19T19:29:26.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11065" PostTypeId="2" ParentId="11045" CreationDate="2014-09-20T03:53:31.080" Score="2" Body="&lt;p&gt;Almost certainly will not work.  I'm not sure about the tracking speed issue, but then antenna gain from a parabolic antenna mounted on a ship (or fixed site) is much greater than that of any sort of aircraft mounted flat panel array.&#xA;Unless the provider was willing (and able) to turn up the power on the spotbeam your aircraft is operating in, your downlink snr (signal to noise ratio) will be too low to use.&lt;/p&gt;&#xA;" OwnerUserId="8536" LastActivityDate="2014-09-20T03:53:31.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11071" PostTypeId="1" CreationDate="2014-09-21T05:17:48.510" Score="2" ViewCount="2640" Body="&lt;p&gt;I have researched about Ethernet keepalive for quite a long time and I think it is time to check whether what I know is correct because I found no certainty in this topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet keepalive is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;to test L2 functionality. The frame has same source MAC and destination MAC (ethertype 0×9000). The other end of Ethernet interface will TX back this type of frame. If the interface does not receive its own frame, then L1 &amp;amp; L2 have problem.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;to detect network loop. On same switch, if the Ethernet keepalive frame of fa0/0 is received by other port, then it means there is network loop.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My question is how come ethernet (FE, GE) ports status of router and switch for L2 (protocol) are up when the port is connected to hub? Hub does not analyze frame thus it will not know the frame type and thus forward back the frame on the port it receives the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Useful resources:&#xA;&lt;a href=&quot;http://pbsplaza.nl/?p=65&quot; rel=&quot;nofollow&quot;&gt;1&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.routerdiscussions.com/viewtopic.php?f=16&amp;amp;t=63&quot; rel=&quot;nofollow&quot;&gt;2&lt;/a&gt;&#xA;&lt;a href=&quot;http://forums.whirlpool.net.au/archive/1277152&quot; rel=&quot;nofollow&quot;&gt;3&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="775" LastEditDate="2014-09-21T14:43:16.383" LastActivityDate="2018-05-26T12:22:32.317" Title="Ethernet keepalive: Test L2 functionality and detect network loop (switch)?" Tags="|ethernet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11072" PostTypeId="1" AcceptedAnswerId="11090" CreationDate="2014-09-21T05:28:53.503" Score="4" ViewCount="801" Body="&lt;p&gt;According to &lt;a href=&quot;http://en.wikipedia.org/wiki/Autonegotiation#Electrical_signals&quot; rel=&quot;nofollow&quot;&gt;Wikipedia about link pulse&lt;/a&gt;, link pulse is used to detect link failure/L1 status. Autonegotiation on FE and GE use link pulse mechanism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When speed and duplex are forced and autonegotiation is turned off, is the interface still generate link pulse?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2014-09-22T15:42:40.013" Title="Link pulse when autonegotiation is off on FE, GE Ethernet" Tags="|ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11073" PostTypeId="2" ParentId="11071" CreationDate="2014-09-21T07:26:13.407" Score="6" Body="&lt;p&gt;Detecting link on a port is not done using ethernet frames, but with electrical pulses known as &lt;em&gt;normal link pulses&lt;/em&gt;. If no frames are being sent, a device puts these on the wire every 16 ms (+/- 8 ms). They are also used for autonegotiation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A link is considered down if no frames and no pulses are received. Receiving the pulses will make a Cisco tell you the port is up, but as we all know, it is perfectly possible to have &quot;&lt;code&gt;FastEthernet0/0 is up, line protocol is down&lt;/code&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The normal link pulses are not frames, and will not be forwarded by hubs or switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keepalive frames are forwarded or switched, and can be used to detect a loop.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-09-21T07:26:13.407" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11076" PostTypeId="1" CreationDate="2014-09-21T12:03:44.340" Score="6" ViewCount="684" Body="&lt;p&gt;Can someone please tell me what is the interface ge-2/1/0.0 IS-IS level after we have applied this config? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does Juniper takes both commands?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;level 2 disable at the interface level &lt;/li&gt;&#xA;&lt;li&gt;level 1 disable at the protocol level&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Or just one of them?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;protocols { &#xA;        isis {&#xA;                level 1 { &#xA;                          disable; &#xA;                        } &#xA;                interface ge-2/1/0.0 { &#xA;                                        level 2 { &#xA;                                                  disable; &#xA;                                                }&#xA;                                      } &#xA;&#xA;                interface ge-2/2/0.0;&#xA;                interface lo0.0;&#xA;             }&#xA;      }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From my understanding I believe that the interface ge-2/1/0.0 will have both level 1 and level 2 disabled, but I am not sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="8548" LastEditorUserId="8548" LastEditDate="2014-09-21T12:40:11.400" LastActivityDate="2015-02-02T20:21:46.823" Title="Juniper IS-IS levels hierarchy configuration" Tags="|juniper|is-is|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11080" PostTypeId="2" ParentId="11058" CreationDate="2014-09-22T01:01:01.163" Score="3" Body="&lt;p&gt;Try to disable it with the right-to-use license:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch# license right-to-use deactivate ipbase all&#xA;Switch# reload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2933" LastEditorUserId="3191" LastEditDate="2014-09-22T06:57:03.257" LastActivityDate="2014-09-22T06:57:03.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11083" PostTypeId="1" AcceptedAnswerId="14567" CreationDate="2014-09-22T09:44:10.777" Score="3" ViewCount="182" Body="&lt;p&gt;I have the following setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A wifi network with four access points on it (ubiquiti APs). When I connect my phone to the network, the phone gets assigned to one of the access points, lets say AP_A. I can read RSSI value between the phone and AP_A easily - not the problem. I also want to be able to read RSSI between the phone and other three access points (they are all on the same network) while the phone is connected to AP_A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible? If so, I'd like some leads. Ubiquiti API documentation is non-existent / unhelpful. &lt;/p&gt;&#xA;" OwnerUserId="8558" LastEditorUserId="775" LastEditDate="2014-12-11T08:37:12.297" LastActivityDate="2014-12-11T08:37:12.297" Title="Reading RSSI of a phone on a network with multiple access points" Tags="|wireless|access-point|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11084" PostTypeId="2" ParentId="11060" CreationDate="2014-09-22T10:10:20.843" Score="4" Body="&lt;p&gt;In Junos you can add a route to point at your next routing table. EG If you wanted to route 0.0.0.0/0 to your routing instance called untrust you would use this syntax&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-options 0.0.0.0/0 next-table untrust.inet.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The untrust routing instance is configured using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-instances untrust instance-type virtual-router&#xA;set routing-instances untrust interface x.0&#xA;set routing-instances routing-options static route 0.0.0.0/0 next-hop x.x.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then if you did a show route 1.1.1.1 you should see something like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;show route 1.1.1.1&#xA;&#xA;inet.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;0.0.0.0/0           *[Static/5] 1d 22:15:55&#xA;                      to table untrust.inet.0&#xA;&#xA;untrust.inet.0: 1 destinations, 1 routes (1 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;0.0.0.0/0           *[Static/5] 1d 22:14:42&#xA;                    &amp;gt; to x.x.x.x via ge-0/0/0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="139" LastActivityDate="2014-09-22T10:10:20.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11086" PostTypeId="1" CreationDate="2014-09-22T12:47:15.887" Score="1" ViewCount="135" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UJBt8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an existing network 192.168.51.0 as in the top-right in the image&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a new network that I need to hook up to this network. The new network comprises:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2x CISCO Routers (interfaces to existing network has IPs 231 and 232)&lt;/li&gt;&#xA;&lt;li&gt;2x CISCO Switches (with trunk interconnect)&lt;/li&gt;&#xA;&lt;li&gt;A workstation (single ethernet port configured with 2 addresses ending in .10 on VLANs 192.168.11 and 13 )&lt;/li&gt;&#xA;&lt;li&gt;2x servers (node1/2) with 4 ethernet ports each. they are bonded in pairs with each bond cross-connected to both switches (color coded to illustrate bond pairs). the one bond is on network 192.168.1.0 and the other bond has three VLAN IP addresses on the bond on VLANs 11, 12 and 13&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All workstations and servers are running Linux if that matters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how to properly configure routing on the two routers so 192.168.51.10 can access 192.168.11.10 or 13.10 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More specifically what should the &lt;em&gt;ip route&lt;/em&gt; and &lt;em&gt;router rip&lt;/em&gt; parts be ? I have already&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;ip route 0.0.0.0 0.0.0.0 192.168.51.254&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interfaces are of the form&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0                                                                                               &#xA; ip address 192.168.1.254 255.255.255.0                                   &#xA; ip nat outside                                                           &#xA; ip virtual-reassembly in                                                 &#xA; duplex auto                                                              &#xA; speed auto                                                               &#xA;!                                                                         &#xA;interface GigabitEthernet0/0.11                                           &#xA; encapsulation dot1Q 11                                                   &#xA; ip address 192.168.11.254 255.255.255.0                                  &#xA;!                                                                         &#xA;interface GigabitEthernet0/0.12                                           &#xA; encapsulation dot1Q 12                                                   &#xA; ip address 192.168.12.254 255.255.255.0                                  &#xA;!                                                                         &#xA;interface GigabitEthernet0/0.13                                           &#xA; encapsulation dot1Q 13                                                   &#xA; ip address 192.168.13.254 255.255.255.0                                  &#xA;!                                                                         &#xA;interface GigabitEthernet0/1                                                                                                &#xA; ip address 192.168.51.232 255.255.255.0                                  &#xA; ip access-group DHCP out                                                 &#xA; ip nat inside                                                            &#xA; ip virtual-reassembly in                                                 &#xA; duplex auto                                                              &#xA; speed auto                                                               &#xA; no mop enabled                                                           &#xA;!               &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(the VLANs are for VLAN tag based QoS on the switches in case anyone wonders)&lt;/p&gt;&#xA;" OwnerUserId="8561" LastActivityDate="2014-09-22T17:50:16.100" Title="CISCO routing newby" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11088" PostTypeId="2" ParentId="11076" CreationDate="2014-09-22T15:04:12.207" Score="3" Body="&lt;p&gt;It seems that I was correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interface ge-2/1/0.0 will have both level 1 and level 2 disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have just seen this question on the Junos Genius APP for Android.&lt;/p&gt;&#xA;" OwnerUserId="8548" LastActivityDate="2014-09-22T15:04:12.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11090" PostTypeId="2" ParentId="11072" CreationDate="2014-09-22T15:42:40.013" Score="2" Body="&lt;p&gt;I believe the answer is &lt;strong&gt;no&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, because of the history of Ethernet, you often see statements about it that are only true for 10Mb/s operation, or only for half-duplex operation and so forth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.3 clause 28.1.4.1 says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Auto-Negotiation does not support the transmission of the NLP sequence. The 10BASE-T PMA provides this function if it is connected to the MDI.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In other words, you don't get link test pulses sent if you force the speed to 100Mb/s or 1000Mb/s. They are unnecessary, because idle symbols are continuously transmitted in these modes. &lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2014-09-22T15:42:40.013" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11092" PostTypeId="2" ParentId="11071" CreationDate="2014-09-22T16:40:10.693" Score="1" Body="&lt;p&gt;I misunderstand what you were confused about; rereading the question, 1 is completely backwards. If a host sees its own loopback frames you have a loop or duplicate address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only time you might want to see it is with an external loopback plug to test a possibly faulty NIC. &lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2014-09-22T16:40:10.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11094" PostTypeId="1" AcceptedAnswerId="11102" CreationDate="2014-09-22T17:30:32.333" Score="5" ViewCount="1770" Body="&lt;p&gt;When MAC addresses are sent out they are sent such that the Group Address Indicator is the first bit of the Ethernet frame but&#xA;when stored in memory this forms the LSB of the leftmost byte of the MAC address.&#xA;For example-&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;             In memory,      12       34       56       78       9A       BC&#xA;               canonical:   00010010 00110100 01010110 01111000 10011010 10111100&#xA;&#xA;                            1st bit appearing on LAN (group address indicator)&#xA;                            |&#xA;               On LAN:      01001000 00101100 01101010 00011110 01011001 00111101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What is the reason for this design decision that requires swapping of the bits of a byte in the a address before it is sent out&#xA;on the LAN? Does it have a historic importance in that it made sense when the protocol was designed?&#xA;Does this design have certain specific advantages?&lt;/p&gt;&#xA;&lt;p&gt;Also something of relevance to my question that I thought I must mention is that this wasn't the case with all the of the LAN adopters.&#xA;(mentioned here:&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2469#page-2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2469&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="6389" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2016-09-07T11:41:24.783" Title="Did the LSB-first method of transmitting the canonical MAC address in Standard Ethernet have any specific advantages?" Tags="|ethernet|mac-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11095" PostTypeId="2" ParentId="11086" CreationDate="2014-09-22T17:50:16.100" Score="2" Body="&lt;p&gt;You don't need to add any static routes or routing protocols to these two routers.&#xA;Both networks are directly connected to the routers so they should be able to route traffic between the two by default. If it does not work it's not going to be a routing issue but rather something else such as NAT.&lt;/p&gt;&#xA;" OwnerUserId="8575" LastActivityDate="2014-09-22T17:50:16.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11097" PostTypeId="1" CreationDate="2014-09-22T22:54:36.330" Score="3" ViewCount="1850" Body="&lt;p&gt;I have an MPLS network with 5 remote locations with 1544 routers, our central office, and our data center. All of the traffic from the remote locations routes out the central office unless it goes down, in which case everything routes out the data center connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I want to ping anything on the public internet from the router cli, I can. If I want to ping/traceroute anything on the MPLS network that is not local, I have to give the command with &quot;source&quot;, i.e. &lt;code&gt;ping 10.0.1.11 source 10.5.0.1&lt;/code&gt; or I get nothing. Netflow is working fine because I could define the source as being eth 0/1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default route is going out the ppp MPLS interface, and no one inside the 10.5.0.0/23 network has any issues getting everywhere they need to, including servers at the data center that I cannot reach from the router itself without the &quot;source 10.5.0.1&quot; being added.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there doesn't appear to be any way to define &quot;source&quot; for the syslog stuff. So the adtrans at the remote sites cannot get their syslog data to the syslog server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These routers were primarily configured by the telco before we took ownership, so I don't know why they did certain things the way they did. e.g. should proxy-arp actually be enabled for this to work? Or could that break something else in this config? Do you see something else that would fix this problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh ip route&#xA;Codes: C - connected, S - static, R - RIP, O - OSPF, B - BGP&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       IA - OSPF inter area&#xA;&#xA;Gateway of last resort is 208.46.133.129 ppp 1&#xA;&#xA;S    0.0.0.0/0 [1/1/0] via 208.46.133.129, ppp 1&#xA;C    10.5.0.0/23 is directly connected, eth 0/1&#xA;S    67.14.0.0/17 [1/1/0] via 208.46.133.129, ppp 1&#xA;S    67.14.128.0/19 [1/1/0] via 208.46.133.129, ppp 1&#xA;C    208.46.133.128/30 is directly connected, ppp 1&#xA;C    208.46.133.129/32 is directly connected, ppp 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is what should be the relevant parts of the config from one of the five remote routers (they are all functionally identical):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip firewall&#xA;no ip firewall alg msn&#xA;no ip firewall alg mszone&#xA;no ip firewall alg h323&#xA;!&#xA;ip flow export destination 10.0.1.11 7003 source eth 0/1&#xA;ip flow export destination 10.0.1.2 9996 source eth 0/1&#xA;ip flow cache timeout active 5&#xA;ip flow top-talkers&#xA;!&#xA;no ethernet cfm&#xA;!&#xA;interface eth 0/1&#xA;  description desc LAN Block 10.5.0.0/23&#xA;  ip address  10.5.0.1  255.255.254.0&#xA;  no ip proxy-arp&#xA;  ip access-policy LAN&#xA;  ip flow ingress&#xA;  ip flow egress&#xA;  no shutdown&#xA;  no lldp send-and-receive&#xA;!&#xA;interface ppp 1&#xA;  description DS1NT&#xA;  ip address  y.y.133.130  255.255.255.252&#xA;  no rtp quality-monitoring&#xA;  ppp multilink interleave&#xA;  ppp multilink fragmentation&#xA;  ppp multilink&#xA;  no shutdown&#xA;  cross-connect 1 t1 1/1 1 ppp 1&#xA;  cross-connect 2 t1 1/2 1 ppp 1&#xA;!&#xA;ip access-list extended DATA-ACL&#xA;  permit ip 10.5.0.0 0.0.1.255  10.0.0.0 0.0.1.255&#xA;  permit ip 10.5.0.0 0.0.1.255  10.1.0.0 0.0.0.255&#xA;  permit ip 10.5.0.0 0.0.1.255  5.5.0.0 0.0.255.255&#xA;  permit ip 10.5.0.0 0.0.1.255  5.6.0.0 0.0.255.255&#xA;  deny   ip 10.5.0.0 0.0.1.255  10.0.0.0 0.255.255.255&#xA;  deny   ip 10.5.0.0 0.0.1.255  172.16.0.0 0.15.255.255&#xA;  deny   ip 10.5.0.0 0.0.1.255  192.168.0.0 0.0.255.255&#xA;  permit ip 10.5.0.0 0.0.1.255  any&#xA;!&#xA;ip policy-class LAN&#xA;  allow list DATA-ACL&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 208.46.133.129&#xA;ip route 5.6.0.0 255.255.224.0 10.1.0.1&#xA;ip route x.x.0.0 255.255.128.0 y.y.133.129&#xA;ip route x.x.128.0 255.255.224.0 y.y.133.129&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8578" LastEditorUserId="3191" LastEditDate="2014-09-23T17:58:11.210" LastActivityDate="2015-04-26T18:39:54.900" Title="Adtran NetVanta router on MPLS network can only reach other MPLS sites if source address set" Tags="|routing|router|mpls|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11098" PostTypeId="1" AcceptedAnswerId="11100" CreationDate="2014-09-23T01:08:02.150" Score="2" ViewCount="306" Body="&lt;p&gt;People often define the internet as a network of networks but this is wrong. If I connected two LANs together that wouldn't nesecarilly be on or part of the internet. In class we learned about ATM, and how it's not part of the internet. If the internet is just the joining of networks, how can one possibly say a network protocol isn't part of the internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, to be part of the internet, must TCP/IP suite be used? Must Ethernet be used, or can Token ring be used? For every layer of the OSI model must a certain technology be used to be part of the internet?&lt;/p&gt;&#xA;" OwnerUserId="8025" LastEditorUserId="8499" LastEditDate="2019-01-04T20:54:27.407" LastActivityDate="2019-08-20T23:18:26.963" Title="What are the minimum requirements to be on the internet?" Tags="|routing|ethernet|internet|lan|osi|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11100" PostTypeId="2" ParentId="11098" CreationDate="2014-09-23T02:41:37.180" Score="5" Body="&lt;p&gt;An internet (lower-case &quot;i&quot;) is a network of networks.  The Internet (upper-case &quot;I&quot;) is what you mean.  The Internet is the largest internet (network of networks).  The networks comprising the Internet connect to each other by agreement of the network owners using BGP as the routing protocol.  Since BGP is based on TCP, TCP/IP is a requirement.  After all, IP stands for Internet Protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 3 of the OSI model (IP) is the lowest layer that the Internet cares about.  That means that any layer-1 or layer-2 protocols (ethernet, token-ring, FDDI, arcnet, ATM, frame relay, etc.) may be used (or required) on or between any of the individual networks, so ethernet is not an Internet requirement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any network &lt;i&gt;could&lt;/i&gt; use a different layer-3 protocol, as long as the layer-3 protocol connecting the networks is IP. This used to be common when IPX networks were first connecting to the Internet through an IP gateway before they were converted from IPX to IP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2019-08-20T23:18:26.963" LastActivityDate="2019-08-20T23:18:26.963" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11101" PostTypeId="1" AcceptedAnswerId="11158" CreationDate="2014-09-23T03:06:24.987" Score="5" ViewCount="520" Body="&lt;p&gt;On a packet switching network, a router is required to route packets to different networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does packet switching uses the term 'switching' when a packet is a term for a layer 3 PDU and switching is layer 2?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="8499" LastEditDate="2018-03-21T01:08:20.317" LastActivityDate="2018-03-21T01:08:20.317" Title="Why use 'switching' term for packet switching" Tags="|switching|layer2|layer3|terminology|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11102" PostTypeId="2" ParentId="11094" CreationDate="2014-09-23T03:24:52.967" Score="8" Body="&lt;p&gt;There is no &lt;em&gt;real&lt;/em&gt; advantage to sending LSB (Little-endian) or MSB (Big-endian) first.  As long as the same convention is followed by everyone, this allows communication to take place.  To your final note, other communications protocols such as RS-232 (serial) also used Little-endian and in general, I believe it was much more common to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that computers operate based purely on bits.  Anything else you see is simply a conversion to a more &quot;human&quot; way to deal with the bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were to use Big-endian, then the easiest way to store the same 48-bit address in memory would be as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0100 1000  0010 1100  0110 1010  0001 1110  0101 1001  0011 1101&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the bits actually had significance beyond being just bits, then you would end up with the following in hex:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;4    8     2    C    6     A     1    E     5    9     3    D&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So your Little-endian address hex representation of the bits is 12-34-56-78-9A-BC, but the very same address in a Big-endian network would be 48-2C-6A-1E-59-3D (if I did all that right...been a while since I had to convert Little-endian addressing to Big-endian).  The exact same address, just a different way to store/transmit the bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Heading off the beaten path, so feel free to stop reading...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This lead to some really interesting interactions with TCP/IP.  Since Ethernet (Little-endian) came before Token Ring (Big-endian), ARP was designed around the Little-endian addressing.  When you bridged traffic between Ethernet and Token Ring, the bridge has to support IP (in order to recognize ARP packets) and re-order the bits in the ARP address fields appropriately.  This was a less than ideal solution as it forced L3 functionality on L2, but it did resolved the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When FDDI (Big-endian) came along even later, the TCP/IP designers wanted to avoid this problem and designed ARP on FDDI to use Little-endian for the address fields.  This avoided having to modify both the headers and the payload of ARP packets when bridging Ethernet to FDDI.  However, it also meant a bridge connecting Token Ring to FDDI would need to re-order the bits in the address fields.  It was just much rarer to bridge Token Ring to FDDI than it was to bridge Ethernet to FDDI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other protocols such as AppleTalk were also similarly affected, but generally weren't provided a solution as they were not as prevalent as TCP/IP.  So, if you were to bridge Ethernet to Token Ring, this would break AppleTalk.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-23T03:24:52.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11103" PostTypeId="2" ParentId="11101" CreationDate="2014-09-23T03:50:26.660" Score="7" Body="&lt;p&gt;A very good question coming at it from a networking viewpoint.  Your question is based on the networking models that were developed long after packet switching was proposed as a concept.  However networks across any distance were interconnected over the existing telecommunications &quot;networks&quot; and while many network and telecommunications terms are the same, they will carry somewhat different meanings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traditional phone connections are circuit switched, meaning that there is one established circuit forming a connection between two end points.  A telephone switch in a phone system used to be the device that created and tore down these connections.  If you go way back, human operators would work at &quot;switch boards&quot; manually making and removing these connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet switching is a much more recent concept (relatively speaking) and refers to networks that would take the data and transmit the data units independently over the network.  It is often far more efficient to &quot;share&quot; the resources of the underlying network in this way.  Today, VoIP uses &quot;virtual circuits&quot; to emulate circuit switched connections over a packet switched network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Wikipedia pages for &lt;a href=&quot;http://en.wikipedia.org/wiki/Circuit_switching&quot;&gt;Circuit Switching&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Packet_switching&quot;&gt;Packet Switching&lt;/a&gt; are pretty well written and should provide more background.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-23T03:50:26.660" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11105" PostTypeId="2" ParentId="11101" CreationDate="2014-09-23T06:05:54.053" Score="1" Body="&lt;p&gt;&lt;strong&gt;A packet (L3) still needs to be switched as a frame (L2) as it ingresses and egresses interfaces.&lt;/strong&gt;  A router would serve no useful purpose if it makes routing decisions, but has no way to switch packets out.  &lt;em&gt;In other words, you can take routing out of switching, but you can't take switching out of routing.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2014-09-23T06:44:42.897" LastActivityDate="2014-09-23T06:44:42.897" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11106" PostTypeId="1" CreationDate="2014-09-23T07:49:11.010" Score="10" ViewCount="2557" Body="&lt;p&gt;I am trying to set up the following arrangement with 10 switches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/eRRXL.jpg&quot; alt=&quot;Switch arrangement&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think it's relatively self-explanatory, but basically I have 8 different networks (in 8 separate VLANs) which are physically switched separately too (just because I can).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to set up the switches for each &quot;pair&quot; of LANs, and for each endpoint switch have a backup path to the root switch via its mate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using &lt;strong&gt;HP V1910-48G (JE009A)&lt;/strong&gt; for the ROOT and &quot;ROOT B&quot; switch.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is where the servers are physically connected to the network.&lt;/li&gt;&#xA;&lt;li&gt;The reason I have switches where the servers are located is to get access to 8 fibre ports.&lt;/li&gt;&#xA;&lt;li&gt;There's a 4Gbit LACP trunk between ROOT and ROOT B to handle the bandwidth and all VLANs are trunked and tagged&lt;/li&gt;&#xA;&lt;li&gt;All switches are managed on VLAN 1080. Does that matter? I'm thinking not.&lt;/li&gt;&#xA;&lt;li&gt;All VLANs are tagged on the trunks as necessary. Again, I can't see it mattering.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For my endpoint switches, I'm using &lt;strong&gt;HP V1810-24G v2 (J9803A)&lt;/strong&gt; switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;All switches DO support RSTP!&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment I can't get this working correctly. When I disconnect the trunk between Switch with VLAN20 to Root switch - the port to Switch VLAN21 doesn't forward packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bridge configuration for all Endpoint Switches:&lt;/strong&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/LqqSk.jpg&quot; alt=&quot;RSTP Bridge Configuration&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Port config on VLAN20 Switch:&lt;/strong&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/2Bgjp.png&quot; alt=&quot;VLAN20 Switch Port Config&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be most appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Sam.&lt;/p&gt;&#xA;" OwnerUserId="8179" LastEditorUserId="23971" LastEditDate="2016-10-18T09:42:00.513" LastActivityDate="2017-12-20T09:07:58.863" Title="RSTP: Using switches in pairs to two switches?" Tags="|switch|spanning-tree|hp|" AnswerCount="5" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="11108" PostTypeId="1" CreationDate="2014-09-23T14:42:31.090" Score="7" ViewCount="6812" Body="&lt;p&gt;Why are ethernet- / mac-addresses in hex (and have 48 bits) and ip numbers in decimals (and have 32 bits)? Does that have historical or practical reasons? &lt;/p&gt;&#xA;" OwnerUserId="8591" LastActivityDate="2017-01-26T09:23:19.197" Title="Why are ethernet / mac -addresses in hex and ip numbers in decimals?" Tags="|ipv4|ethernet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11110" PostTypeId="1" AcceptedAnswerId="11117" CreationDate="2014-09-23T18:40:31.037" Score="4" ViewCount="3145" Body="&lt;p&gt;Can somebody provide me with a use case of using BGP in a large private IP network. (as specified in the &lt;a href=&quot;http://en.wikipedia.org/wiki/Border_Gateway_Protocol#Uses&quot; rel=&quot;nofollow&quot;&gt;BGP wiki&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two follow up questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Also in a broader sense can really BGP be used to advertise a private IP address range?&lt;/li&gt;&#xA;&lt;li&gt;Can I have my own AS numbers without being registered with IANA in my large private IP network?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="7916" LastEditorUserId="3191" LastEditDate="2015-01-04T22:05:38.133" LastActivityDate="2015-01-04T22:05:38.133" Title="Use case for using BGP in a large private IP network? Can BGP be used for addressing private IP address range?" Tags="|ipv4|bgp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11112" PostTypeId="1" AcceptedAnswerId="11114" CreationDate="2014-09-23T19:37:41.473" Score="3" ViewCount="1212" Body="&lt;p&gt;Is it possible to point a route to a next hop that isn't directly attached to my router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router A owns the subnet 10.10.10.0/24&lt;br&gt;&#xA;Router A and Router B communicate on the 10.0.1.0/24 subnet&lt;br&gt;&#xA;Router B and Router C communicate on the 10.0.2.0/24 subnet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router C has learned the 10.0.1.0/24 subnet from Router B with Router B as a next hop&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I put a route for the 10.10.10.0/24 subnet on Router C and point it straight to Router A?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is Router C smart enough to figure out that it would need to send to Router B to get to Router A?  I know the normal practice is to tell Router C that Router B is the next hop for Router A's subnet.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-09-23T20:15:39.637" Title="Pointing a route to a next-hop that isn't directly attached" Tags="|routing|router|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11113" PostTypeId="2" ParentId="11108" CreationDate="2014-09-23T20:06:25.367" Score="11" Body="&lt;p&gt;Different people design different protocols. Ethernet can transport more than IP (IPX was quite common 15-20 years ago and also used hex in it's addresses. To be more precise: The local part of an IPX address was the MAC address). IP on the other hand  can run without using Ethernet as Layer-2 protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Somehow Ethernet (and MAC addressing) became the dominant layer-2 protocol and IPv4 the dominant layer-3 Protocol. With IPv6 we have HEX back in our IP(v6) addresses .&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-09-23T20:06:25.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11114" PostTypeId="2" ParentId="11112" CreationDate="2014-09-23T20:10:52.180" Score="5" Body="&lt;p&gt;That's called recursive next-hop lookup (or something along those lines) by most vendors.  Most equipment will handle that just fine, but its not a particularly good practice to get into for static routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FWIW, iBGP typically works this way.  The &quot;next-hop&quot; carried in an iBGP session is the next-hop on the far side of the autonomous system and some sort of IGP (typically OSPF, less commonly, IS-IS, RIP, or even static routing) is used to recursively resolve that iBGP next-hop to an immediate next-hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do too much of this, the gear is having to do more and more layers of recursion to find the real next-hop.  I've never really tested any gear to see how many times it would recurse to find a real next-hop, but I wouldn't be surprised if the limit were 3 or 4.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2014-09-23T20:10:52.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11115" PostTypeId="2" ParentId="11110" CreationDate="2014-09-23T20:13:22.813" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;Sure, why no. An address is an address.&lt;/li&gt;&#xA;&lt;li&gt;Just use AS numbers reserved for private use. See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6996&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6996&lt;/a&gt; for details.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-09-23T20:13:22.813" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11116" PostTypeId="2" ParentId="11112" CreationDate="2014-09-23T20:15:39.637" Score="-2" Body="&lt;p&gt;The router has to know what interface to forward packets out of. If you try and specify a route to a network it doesn't know about and don't include a valid next-hop interface it will not enter that route into it's forwarding table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would need to introduce a routing protocol to make the router &quot;smart&quot; enough to know what do with that packet.&lt;/p&gt;&#xA;" OwnerUserId="8595" LastActivityDate="2014-09-23T20:15:39.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11117" PostTypeId="2" ParentId="11110" CreationDate="2014-09-23T20:28:00.410" Score="5" Body="&lt;p&gt;Our network isn't even all that big and we utilize this network design pattern.  It just makes manageability easier.  Scale-ability just completely goes away as an issue.  And ultimately it becomes a little easier to grok what's going on in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general idea is that the network infrastructure uses OSPF (or IS-IS, or other sorts of IGP routing information), while &quot;customer&quot; routes are carried by BGP.  Where &quot;customer&quot; there could be IP blocks at the edge of the network, routes from upstream providers, routes from 3rd party partners and VPNs.  The result being that you can look at the source of the route...if its from an IGP, you know that its describing the internal network topology of your network, and if its a BGP route, you know its a &quot;source&quot; or &quot;destination&quot; network (at least from the perspective of your internal network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We go so far as to have Quagga or other routing protocol implementations on some of our Linux servers...they're peering using eBGP to their upstream routers (typically 2), and inject routes for IP addresses on their loopback interfaces into BGP.  Using BGP allows us to put a lot of policy enforcement on the edge routes to only allow the Linux servers to advertise certain specific IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overall this use case works &lt;strong&gt;extremely&lt;/strong&gt; well, reliable and hugely scale-able.  It does take a bit of mind-set change from typical Enterprise network design, but its well worth it, IMO.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2014-09-23T20:28:00.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11120" PostTypeId="1" AcceptedAnswerId="11121" CreationDate="2014-09-24T00:57:16.997" Score="9" ViewCount="15156" Body="&lt;p&gt;In the DHCP discover packet, the source IP address field is 0.0.0.0 which means the client does not have an IP address yet. But, in the DHCP offer packet, an unicast address (which will be allocated for this client) is specified as destination address. Since the client does not have an IP address at this moment, how does the packet which has an unicast address reach the client correctly ? How the client identifies that this offer packet is destined for it ? My understanding is that, the client which has no IP can only be reachable with a broadcast IP. I cannot understand how it is reachable with an unicast IP.&lt;/p&gt;&#xA;" OwnerUserId="8597" LastActivityDate="2018-10-05T05:39:58.853" Title="How DHCP OFFER unicast works?" Tags="|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11121" PostTypeId="2" ParentId="11120" CreationDate="2014-09-24T01:04:26.333" Score="9" Body="&lt;p&gt;This is because the DHCP server must reside or have a relay/proxy on the same L2 network as the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DHCP OFFER is sent to the L2 address of the client (i.e. it's MAC address).  If the request was relayed/proxied, then the DHCP OFFER goes to the relay/proxy which will then forward it to the correct L2 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Broadcast traffic can be problematic for networks, so this reduces the amount of broadcast network that is necessary.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-24T01:04:26.333" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11122" PostTypeId="1" AcceptedAnswerId="11123" CreationDate="2014-09-23T18:46:52.283" Score="1" ViewCount="262" Body="&lt;p&gt;I was wondering if two different OSPF areas connected via an MPLS/GRE tunneled link run OSPF across them?&#xA;May be keeping the interconnecting MPLS/GRE routers in OSPF backbone area 0?&lt;/p&gt;&#xA;" OwnerUserId="7916" OwnerDisplayName="Subraminion" LastActivityDate="2014-09-24T09:27:56.933" Title="Can different networks connected by MPLS run the same OSPF area?" Tags="|gre|ospf|mpls|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11123" PostTypeId="2" ParentId="11122" CreationDate="2014-09-24T02:40:12.947" Score="2" Body="&lt;p&gt;You can certainly run OSPF on GRE interfaces and routers will exchange routes quite happily via the GRE tunnel.  A GRE interface should be just like any other interface to OSPF, so normal rules would apply for area assignments just the same as they would apply to other interface types.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2014-09-24T02:40:12.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11124" PostTypeId="2" ParentId="11122" CreationDate="2014-09-24T03:00:39.350" Score="1" Body="&lt;p&gt;Yes - this is commonly done over metro Ethernet circuits via an L2VPN solution (ie pseudo-wire or VLL) or can also be done with L3VPN services from a carrier - but this means that you need to participate in routing with your carrier - more often than not however this will require more complexity in your L3 domain; so rather than doing this, it is possible to run OSPF over a GRE tunnel, as @JeffMcAdams has mentioned. It's usually more desirable to utilize an L2VPN-based solution.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2014-09-24T03:00:39.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11125" PostTypeId="1" AcceptedAnswerId="11151" CreationDate="2014-09-24T04:43:12.800" Score="1" ViewCount="26061" Body="&lt;p&gt;Site 1: Locally connected to port 1 with interface IP 192.168.1.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site 2: Locally connected to port 2 with interface IP 192.168.2.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port 3 is the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Master Ports none on all interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No firewall is configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dynamic routes are listed for both subnets and the router can ping IPs on the inside of both LANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT is configured srcnat, Out-interface Port 3, masquerade, Dst. Address NOT 192.168.0.0/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These subnets need to see each other, but cannot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="1985" LastEditorUserId="8499" LastEditDate="2018-02-14T16:50:13.683" LastActivityDate="2019-10-25T17:34:18.810" Title="Mikrotik RouterOS routing between subnets on local ports" Tags="|routing|" AnswerCount="2" CommentCount="2" ClosedDate="2017-08-09T02:48:39.327" ContentLicense="CC BY-SA 3.0" />
  <row Id="11126" PostTypeId="1" AcceptedAnswerId="40646" CreationDate="2014-09-24T06:09:21.280" Score="6" ViewCount="6161" Body="&lt;p&gt;In the text book: Computer Networks 5th edition by Peterson and Davie, I found &quot;The designers of IP decided that fragmentation should always happen on 8-byte boundaries, which means that the offset field counts 8-byte chunks, not bytes&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why the offset field is designed as a multiple of 8 ? I don't understand the significance of this.&#xA;Also, what happens if the MTU-offset is not a multiple of 8 ? &#xA;(e.g) If MTU = 1502 bytes, 20 bytes for header and 1482 bytes for data. In this case, what would be fragment offset in the second fragment, as 1482 is not a mutilple of 8.&lt;/p&gt;&#xA;" OwnerUserId="8597" LastEditorUserId="8597" LastEditDate="2014-09-24T06:38:15.247" LastActivityDate="2017-04-23T18:53:31.317" Title="Why IP fragmentation is on 8 byte boundary?" Tags="|ipv4|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11127" PostTypeId="2" ParentId="11108" CreationDate="2014-09-24T06:14:28.307" Score="2" Body="&lt;p&gt;Jens has a great technical answer (and got an upvote from me) but the other aspect is human readability, because as humans we were always intended to be the &quot;things&quot; that would need to understand these addresses at a higher layer of consciousness that machines do not possess. Conveying a 48-bit address in decimal would be less efficient than conveying a 32-bit address in decimal (in the context of human readability; everything is binary to a router/switch/whatever).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the number space that's able to be expressed by 32 bits lends itself nicely to carving that space up into evenly-sized chunks (the chunks here are bytes, or &lt;em&gt;octets&lt;/em&gt;) of 8 bits each, and you have a maximum decimal &quot;capacity&quot; of 255 for each one of those chunks. This would naturally lead to representing those addresses in the dotted decimal format, because you won't ever have an octet that's longer than 3 decimal digits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A MAC address is different. Hexadecimal is more efficient here because you can express more with less, and you are again limiting the scope of the length of digits to compensate for the larger address space. There are 6 octets in a 48-bit address, and each hexadecimal digit is 4 bits; you won't have any octet in a 48-bit address be longer than two hexadecimal digits.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aa:d3:ad:be:ef:aa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is easier (more efficient) to read, write and interpret than&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;170:211:173:190:239:170&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="762" LastActivityDate="2014-09-24T06:14:28.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11128" PostTypeId="1" CreationDate="2014-09-24T07:27:30.930" Score="3" ViewCount="759" Body="&lt;p&gt;I'm working on a community wifi project for an impoverished settlement. We have a router and a cable modem installed in a container house, sometimes without heating for days. Both are designed for indoor use. (Wifi coverage is provided by outdoor APs.) What should I do to protect the indoor equipment from frost? Outdoor temperatures sometimes reach -15 °C (5 °F), the container is made of metal. We would need the cheapest workable and safe solution. The cable modem is provided by the ISP and they offer no outdoor equipment (but we may be able to convince them to let us use our own one).&lt;/p&gt;&#xA;" OwnerUserId="8601" LastEditorUserId="49" LastEditDate="2014-09-24T10:55:58.870" LastActivityDate="2014-09-25T01:40:39.780" Title="Frost prevention for indoor router and cable modem" Tags="|router|hardware|environmental-monitoring|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11129" PostTypeId="2" ParentId="11126" CreationDate="2014-09-24T07:35:09.137" Score="4" Body="&lt;p&gt;I can think of two advantages to using 8-byte chunks: firstly, having the data aligned on an even boundary might be more efficent in term of the CPU you use. Secondly, you save three bits from the IP header on &lt;strong&gt;every&lt;/strong&gt; IP packet you send, fragemented or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer to your second part of your question, is that if you send 1482 bytes of data, and it's not the last packet, then you haven't fragmented correctly. You would send 1480 bytes instead.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2014-09-24T07:35:09.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11131" PostTypeId="2" ParentId="11122" CreationDate="2014-09-24T09:27:56.933" Score="2" Body="&lt;p&gt;I think you're looking for the OSPF &quot;Sham-Link&quot; feature. This feature builds virtual OSPF links over an MPLS infrastructure to connect OSPF networks. The feature is available on &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/15-sy/iro-15-sy-book/iro-sham-link.html&quot; rel=&quot;nofollow&quot;&gt;Cisco&lt;/a&gt; and &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.3/topics/topic-map/ospfv2-sham-links.html&quot; rel=&quot;nofollow&quot;&gt;Juniper&lt;/a&gt; gear at least.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-09-24T09:27:56.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11133" PostTypeId="2" ParentId="11128" CreationDate="2014-09-24T10:54:41.580" Score="2" Body="&lt;p&gt;Buy an inexpensive cooler -- a big plastic or styrofoam one like you'd use for a picnic -- remove the lid, place it open side &lt;em&gt;down&lt;/em&gt; over the equipment. As long as there's no drafts in the container/house-unit, the heat from the equipment will stay up inside the cooler. If it's &lt;em&gt;really&lt;/em&gt; cold, move the wall-wart power supply/ies inside the cooler too.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2014-09-24T10:54:41.580" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11137" PostTypeId="1" AcceptedAnswerId="11141" CreationDate="2014-09-24T14:42:26.770" Score="7" ViewCount="1323" Body="&lt;p&gt;I have a decent understanding of networking, but this question popped up in my head randomly and I can't figure it out. For example, if I have an iPhone that is used on a 3G network but is also connected to my home wifi throughout the day, how does an application know whether to send data (whether it be a push notification or something else) to my phone via my cellular IP, or my Wifi IP address? Wouldn't both the cellular network and my home network associate my phone with themselves?&lt;/p&gt;&#xA;" OwnerUserId="8607" LastEditorUserId="3191" LastEditDate="2014-09-25T07:11:00.453" LastActivityDate="2014-09-25T09:35:49.637" Title="How does a network know whether to send via internet/wifi or through cellular service?" Tags="|routing|wireless|mobile|dual-homed|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11138" PostTypeId="1" AcceptedAnswerId="11180" CreationDate="2014-09-24T15:12:09.907" Score="2" ViewCount="309" Body="&lt;p&gt;The &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6396#page-12&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6396&lt;/a&gt; specifies the header for RIB-entry mrt-records like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        0                   1                   2                   3&#xA;        0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;       |         Peer Index            |&#xA;       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;       |                         Originated Time                       |&#xA;       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;       |      Attribute Length         |&#xA;       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;       |                    BGP Attributes... (variable)&#xA;       +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But the textual explanation (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6396#page-12&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;) does not specify how and in which order the BGP Attributes have to appear. Assuming that they mean path attributes of the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4271#page-23&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP-4 standard&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;How and in which order are the BGP attributes to be represented to be consistent with RFC6396 (Multi-Threaded Routing Toolkit (MRT) Routing Information Export Format)?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="8570" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-09-26T23:49:02.800" Title="How are the RIB entry BGP attributes represented according to RFC6396 (MRT Routing Information Export Format)" Tags="|bgp|standardisation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11139" PostTypeId="2" ParentId="11138" CreationDate="2014-09-24T15:40:46.623" Score="-2" Body="&lt;p&gt;I'm guessing it grabs that info from the Update Message, which contains a 2 byte Path Attribute Section.&lt;/p&gt;&#xA;" OwnerUserId="8609" LastActivityDate="2014-09-24T15:40:46.623" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11140" PostTypeId="2" ParentId="11137" CreationDate="2014-09-24T15:43:18.907" Score="0" Body="&lt;p&gt;There's only one default route active, so if you have both enable, it will choose one. For example, if both are reachable, then use wifi, if wifi is unreachable use 3G. The routes are basically balanced with a preference.&lt;/p&gt;&#xA;" OwnerUserId="8609" LastActivityDate="2014-09-24T15:43:18.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11141" PostTypeId="2" ParentId="11137" CreationDate="2014-09-24T15:44:50.967" Score="11" Body="&lt;p&gt;In this scenario, your phone has at least two network interfaces: WLAN and 3G. Each interface has his own IP address and mask. They usually install as two routes on the phones routing table, the locally connected network and a default gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's see a simplified example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface: Wifi&#xA;IP/mask: 192.168.10.10 255.255.255.0&#xA;Default gateway: 192.168.10.1 (your home router)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface: 3G&#xA;IP/mask: 10.10.10.10 255.255.255.0&#xA;Default gateway: 10.10.10.1 (your next hop to ISP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resulting routing table:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Destination  Interface  Metric&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.0/24  Wifi 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0.0.0.0/0 Wifi 20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.10.10.0 3G 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0.0.0.0/0 3G 30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what happens when your phone wants to send a packet? It checks the destination IP address vs its own routing table and decides which interface to send it to.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you send a packet to 192.168.10.49 it matchs first line and sends it through the Wifi interface.&lt;/li&gt;&#xA;&lt;li&gt;If you send a packet to 10.10.10.50 it matches the third line and sends it through the 3G interface.&lt;/li&gt;&#xA;&lt;li&gt;If you send a a packet to 8.8.8.8 (Google DNS) there are two matches. Which of the two lines has precedence? The one with the &lt;strong&gt;lowest&lt;/strong&gt; metric. In this case it's the second line and your packet to internet will go through the Wifi interface.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In personal devices, this metric is automatic. Your iphone is smart enough to set a lower metric to Wifi.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastEditorUserId="6389" LastEditDate="2014-09-25T05:49:31.187" LastActivityDate="2014-09-25T05:49:31.187" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11144" PostTypeId="2" ParentId="11125" CreationDate="2014-09-24T15:55:49.297" Score="0" Body="&lt;p&gt;Site 1 and Site 2, whatever devices you have there, must have routes to point to each other, or just create a default route. The problem is that they do not know where the other is. Assuming all configs are correct.&lt;/p&gt;&#xA;" OwnerUserId="8609" LastActivityDate="2014-09-24T15:55:49.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11145" PostTypeId="1" CreationDate="2014-09-24T18:30:45.933" Score="5" ViewCount="199" Body="&lt;p&gt;I've recently moved from point-to-point WAN to a point-to-multipoint WAN, unfortunately this has really messed up my brain...in regards to shaping. These circuits are aggregated into three physical ports and three separate VLAN's. I am trying to shape before the traffic is dropped by the ISP and am running into a problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I am doing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any speed-50-test&#xA;  match access-group 120&#xA;!&#xA;policy-map speed-50-test&#xA; class speed-50-test&#xA; bandwidth 50000&#xA; shape average 50000000&#xA;!&#xA;access-list 120 remark ** speed 50 test **&#xA;access-list 120 permit ip any 10.240.0.0 0.0.255.255&#xA;!&#xA;interface gig 4/0/1&#xA; service-policy output speed-50-test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IOS kicks back saying: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Match numbered access-list is not supported for this interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IOS version: ipservicesk9-mz.122-33.SRE8.bin&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen some threads saying that advanced ip services will allow this. Is this true? Or is this configuration done improperly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if I use a subinterface I am able to apply this policy (after defining the class-default).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess now I am wondering if this is the proper way to accomplish enforcing CIR on this VLAN.&lt;/p&gt;&#xA;" OwnerUserId="4854" LastEditorUserId="4854" LastEditDate="2014-09-24T21:36:22.367" LastActivityDate="2014-09-24T21:36:22.367" Title="Shaping on ES20/7606-S" Tags="|cisco|qos|wan|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11147" PostTypeId="2" ParentId="11128" CreationDate="2014-09-25T01:40:39.780" Score="3" Body="&lt;p&gt;Whenever I am deploying something outside in an enclosure, this is the procedure I use.  First, make sure you start with the proper enclosure (for example NEMA 3 or 4).  If you penetrate the enclosure, make sure the penetrations are properly sealed to maintain the rating.  (I assume this would be the case as you need electricity and because you mention that the enclosure is made of metal and no one wants their antennas inside a metal box, right?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since your enclosure is going to be restricting air from flowing into/out of the enclosure, you now only need to contend with any moisture that is trapped within the enclosure with your devices.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your next step is to reduce the moisture in the trapped air. Low moisture means less chance of condensation and with no condensation, you get no frost.  For this, I prefer to use silica packs.  You can buy these cheaply, but even better they come in the packaging with many items (shoes, clothes, electronics, and so on).  Most people throw them away, but I recommend saving them as they have many uses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before you close you enclosure, add some silica packs.  However, before you do that, make sure the packs are &quot;fresh&quot; by heating them.  Heating them (120-150C/250-300F) will cause them to &quot;release&quot; the moisture they have gathered.  For this, I use either an oven (longer, but you can easily set the temperature) or microwave on 1-2 minute cycles (faster, but you need to figure out a way to determine if you have heated them enough and some outside packages won't do as well).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, silica packs will not remove all the moisture from the air, but you don't really need to remove all the moisture.  The waste heat from your electronic devices will help to prevent the moisture from condensing on them and most of the condensation (if you have any) would be on the inside of the enclosure itself (which will tend to be colder).  Make sure you account for this by not setting any electronics or power cords directly on the bottom of the enclosure.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-25T01:40:39.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11148" PostTypeId="2" ParentId="11137" CreationDate="2014-09-25T01:58:39.937" Score="5" Body="&lt;p&gt;The other answer deals well with how the outbound traffic from your device decides which network connection to use.  However it seems your question is asking more about how data inbound to your phone (such as push notifications) decides which network to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a number of ways this is done, but if it is truly a service that works on both WiFi and cellular, then odds are it periodically &quot;phones home&quot; or establishes and maintains a connection to a server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the device/app is checking in or &quot;phoning home,&quot; it can collect any messages that are stored for it.  In this case, it works much like email and all return traffic from the server will go back to whichever IP address was used to send the request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is that the device/app creates a connection to the server and keeps it open so that the server can use it to immediately push the notification to the client whenever it receives one.  If your device connects/disconnects, the device/app will re-establish the connection to the server.  Again, since the device/app will originate this traffic, all return traffic will go to the source IP whether that is on your WiFi network or your cellular network.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-25T01:58:39.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11151" PostTypeId="2" ParentId="11125" CreationDate="2014-09-25T09:57:44.743" Score="1" Body="&lt;p&gt;The fault was with the DHCP server setup on the Mikrotik. Before:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[xxxx@MikroTik] /ip dhcp-server&amp;gt; network print &#xA;&#xA; # ADDRESS            GATEWAY         DNS-SERVER      WINS-SERVER     DOMAIN                 &#xA; 0 192.168.100.0/32   192.168.100.1   8.8.8.8                                       &#xA; 1 192.168.102.0/32   192.168.102.1   8.8.8.8                                        &#xA; 2 192.168.105.0/32   192.168.105.1   8.8.8.8                                       &#xA; 3 192.168.200.0/32   192.168.200.1   8.8.8.8   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[xxxx@MikroTik] /ip dhcp-server&amp;gt; network print&#xA;&#xA; # ADDRESS            GATEWAY         DNS-SERVER      WINS-SERVER     DOMAIN&#xA; 0 192.168.100.0/24   192.168.100.1   8.8.8.8                                           &#xA; 1 192.168.102.0/24   192.168.102.1   8.8.8.8                                       &#xA; 2 192.168.105.0/24   192.168.105.1   8.8.8.8                                            &#xA; 3 192.168.200.0/24   192.168.200.1   8.8.8.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The difference is the subnet mask (&lt;code&gt;/32&lt;/code&gt; -&gt; &lt;code&gt;/24&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even though the Mikrotik has an option to add the Netmask as &lt;code&gt;/24&lt;/code&gt; on the DHCP Network screen in Winbox, it does not automatically pull that mask value through to the address value and thus needs to be explicitly added to the address value as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I know this export example is not exactly like my question, but I did not want to over-complicate the question)&lt;/p&gt;&#xA;" OwnerUserId="1985" LastEditorUserId="55273" LastEditDate="2019-10-25T17:34:18.810" LastActivityDate="2019-10-25T17:34:18.810" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="11153" PostTypeId="1" AcceptedAnswerId="11177" CreationDate="2014-09-25T13:42:15.837" Score="3" ViewCount="6729" Body="&lt;p&gt;network experts! Help, please, to  understand why there is no ping from source address to destination address over ipsec vpn(here, route-based).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have such schema:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/HOpKH.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase1 and Phase2 of IPSec are up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;cisco1811:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show crypto session &#xA;Crypto session current status&#xA;&#xA;Interface: Tunnel0&#xA;Session status: UP-ACTIVE     &#xA;Peer: 1.1.1.2 port 500 &#xA; IKEv1 SA: local 1.1.1.1/500 remote 1.1.1.2/500 Active &#xA; IPSEC FLOW: permit ip 0.0.0.0/0.0.0.0 0.0.0.0/0.0.0.0 &#xA;    Active SAs: 2, origin: crypto map&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SRX210:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit]&#xA;root# run show security ike security-associations &#xA;Index   State  Initiator cookie  Responder cookie  Mode           Remote Address   &#xA;507742  UP     e4ce17853e784b75  686afe9bad0c6831  Main           1.1.1.1  &#xA;&#xA;[edit]&#xA;root# run show security ipsec security-associations &#xA;  Total active tunnels: 1&#xA;  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway   &#xA;  &amp;lt;131073 ESP:3des/sha1 f7797ad5 3409/  4608000 -  root 500   1.1.1.1         &#xA;  &amp;gt;131073 ESP:3des/sha1 f4f78f65 3409/  4608000 -  root 500   1.1.1.1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But there is no connection from cisco loopback 10.10.10.1 to srx fe-0/0/4 dest 20.20.20.1.&#xA;Ping faild. To my mind all routing and security zones, policies has configured correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But pings failed. ( Ping from tunnel0 to st0.1 failed too).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;output cisco1811:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 15.1&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;memory-size iomem 20&#xA;!&#xA;!&#xA;dot11 syslog&#xA;ip source-route&#xA;!         &#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO1811W-AG-A/K9 sn FHK0930507W&#xA;!&#xA;!&#xA;! &#xA;!&#xA;crypto isakmp policy 1&#xA; encr 3des&#xA; authentication pre-share&#xA; group 2&#xA; lifetime 28800&#xA;crypto isakmp key regata577 address 1.1.1.2&#xA;!&#xA;!&#xA;crypto ipsec transform-set TS esp-3des esp-sha-hmac &#xA;!&#xA;crypto ipsec profile VPN_P2&#xA; set transform-set TS &#xA;!&#xA;!&#xA;interface Loopback10&#xA; ip address 10.10.10.1 255.255.255.0&#xA;!&#xA;interface Tunnel0&#xA; ip address 172.16.0.1 255.255.255.252&#xA; ip mtu 1400&#xA; tunnel source 1.1.1.1&#xA; tunnel mode ipsec ipv4&#xA; tunnel destination 1.1.1.2&#xA; tunnel protection ipsec profile VPN_P2&#xA;!&#xA;interface FastEthernet0&#xA; ip address 1.1.1.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1&#xA; ip vrf forwarding vrf1&#xA; ip address 5.5.5.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Async1&#xA; no ip address&#xA; encapsulation slip&#xA;!&#xA;&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 1.1.1.2&#xA;ip route 20.20.20.0 255.255.255.0 Tunnel0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;output srx210:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.1X44-D35.5;&#xA;system {&#xA;    root-authentication {&#xA;        encrypted-password &quot;$1$APbBS19g$N1umrpu1sUcdWCb7RUyLa1&quot;; ## SECRET-DATA&#xA;    }&#xA;    services {&#xA;        ssh;&#xA;    }&#xA;    syslog {&#xA;        file kmd-logs {&#xA;            daemon info;&#xA;            match KMD;&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {                                  &#xA;    fe-0/0/4 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 20.20.20.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    fe-0/0/5 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 1.1.1.2/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    st0 {&#xA;        unit 1 {&#xA;            family inet {&#xA;                mtu 1400;&#xA;                address 172.16.0.2/30;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {                            &#xA;        route 0.0.0.0/0 next-hop 1.1.1.1;&#xA;        route 10.10.10.0/24 next-hop st0.1;&#xA;    }&#xA;}&#xA;security {&#xA;    ike {&#xA;        policy ike_policy {&#xA;            mode main;&#xA;            proposal-set compatible;&#xA;            pre-shared-key ascii-text &quot;$9$.fF/u0IleWTzSevMN-.Pfz9AIEc&quot;; ## SECRET-DATA&#xA;        }&#xA;        gateway ike_gate {&#xA;            ike-policy ike_policy;&#xA;            address 1.1.1.1;&#xA;            external-interface fe-0/0/5;&#xA;        }&#xA;    }&#xA;    ipsec {&#xA;        policy ipsec_policy {&#xA;            proposal-set standard;      &#xA;        }&#xA;        vpn My_VPN {&#xA;            bind-interface st0.1;&#xA;            ike {&#xA;                gateway ike_gate;&#xA;                ipsec-policy ipsec_policy;&#xA;            }&#xA;            establish-tunnels immediately;&#xA;        }&#xA;    }&#xA;    flow {&#xA;        tcp-mss {&#xA;            ipsec-vpn {&#xA;                mss 1350;&#xA;            }&#xA;        }&#xA;    }&#xA;    policies {&#xA;        from-zone Untrust to-zone Trust {&#xA;            policy 100 {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone Trust to-zone Untrust {&#xA;            policy 101 {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    zones {&#xA;        security-zone Untrust {&#xA;            address-book {              &#xA;                address MOSCOW 10.10.10.0/24;&#xA;            }&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                fe-0/0/5.0;&#xA;                st0.1;&#xA;            }&#xA;        }&#xA;        security-zone Trust {&#xA;            address-book {&#xA;                address KRASNODAR 20.20.20.0/24;&#xA;            }&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }                       &#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                fe-0/0/4.0;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4635" LastEditorUserId="4635" LastEditDate="2014-09-25T14:34:58.783" LastActivityDate="2014-12-26T19:53:47.077" Title="Route-based ipsec between cisco router end juniper srx" Tags="|cisco|ipsec|juniper-srx|tunnel|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11154" PostTypeId="1" AcceptedAnswerId="12665" CreationDate="2014-09-25T14:43:45.603" Score="1" ViewCount="725" Body="&lt;p&gt;Assume 3 switches connected in a ring topology forming a loop.&#xA;If STP is disabled, a single broadcast packet is going to create a broadcast storm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i assume a broadcast packet size to be 100bytes and all the links to be 100Mbytes per sec, how can i quantify/calculate how much of the bandwidth is being utilized because of this packet storm? To avoid complications lets assume there are no other traffic. Just a single broadcast packet that got in and the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit:i do not necessaryily need to measure it in the network. I was looking at an equation that can estimate it based on the link speed, transmission delay etc&lt;/p&gt;&#xA;" OwnerUserId="8617" LastEditorUserId="8617" LastEditDate="2014-09-25T15:12:29.163" LastActivityDate="2014-10-26T00:20:04.113" Title="Calculating link utilization during a broadcast storm" Tags="|switch|broadcast|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11155" PostTypeId="2" ParentId="11154" CreationDate="2014-09-25T15:09:54.317" Score="0" Body="&lt;p&gt;It's going to increase until all the bandwidth available is used, but you wouldn't be able to measure it because the CPU would be way too high for you to do anything. &lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-09-25T15:09:54.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11157" PostTypeId="2" ParentId="11154" CreationDate="2014-09-25T18:04:00.687" Score="0" Body="&lt;p&gt;Let the broadcast storm run for over 5 minutes.&#xA;Disconnect the broadcasting device.&#xA;IMMEDIATELY log into switch and check interface stats, should show last 5-minutes values.&#xA;(Probably best done via script, to each device, to make it both quicker and more reliable.)&#xA;Use this data to &quot;walk backwards&quot; and derive a calculation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note this is quite likely to vary by switch model, OS version, OS features, etc. You may be able to come up with a general &quot;rule of thumb&quot; calculation if you try all the models/versions/features you're interested in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to look at your vendor's whitepapers, they could have some info on this.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-09-25T18:04:00.687" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11158" PostTypeId="2" ParentId="11101" CreationDate="2014-09-25T21:04:00.993" Score="3" Body="&lt;p&gt;Years ago, in a Cisco course (BCMSN, when it existed) the teacher explained to us the Evolution of the LAN, from the ThickNet (Coax) to the current Switched UTP/Fiber connection&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first, various LAN were either routed connected with Hubs, with a hub being often prefered because of cost if possible.  When a router wasn't really needed but a Hub didn't do the job, they split the LANs with Bridges.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HOST(A)----\&#xA;HOST(B)----(HUB)-------HOST(D)&#xA;HOST(C)----/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the bridge saw a frame going by, it noticed it was from SRC port X to somewhere and noted it.  Since it didn't know where the DST was it broadcasted on the other port (early bridge had 2 ports it was simply used to limit broadcast domain)  When it got the reply back, it noted from where it was coming from etc.  Note that you had broadcast medium on each side (Coax)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NETWORK(A)---(BRIDGE)---NETWORK(B)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;cost less than &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NETWORK(A)==(Router)==NETWORK(B)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but not useful everywhere&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, someone had the idea to bridge &lt;em&gt;EACH&lt;/em&gt; station to a central network... all in the same box, with the network in the middle to pass data between interfaces.  This also means that it's easier to track hosts to a specific port, thus limiting flooding to actual Unknown MACs or Broadcast MAC.  It also limited the collision domain, as no two hosts were directly talking to each other, Full Duplex also became possible.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HOST(A)---\----------------------/---Host(D)&#xA;          | Bridge        Bridge |&#xA;          |    \            /    |&#xA;          |     ------------     |&#xA;          |     | INTERNAL |     |&#xA;HOST(B)---|Br.--|  SHARED  |--Br.|---HOST(E)&#xA;          |     | NETWORK  |     |&#xA;          |     ------------     |&#xA;          |     /          \     |&#xA;          | Bridge        Bridge |&#xA;HOST(C)---/----------------------\---ROUTER(A)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One last problem was that you had limited bandwidth in the internal network as it created a single bottleneck for all traffic in the case where it couldn't transfer data from one port to another quickly enough (Buffers were used, but they had their limits).  To remediate to that, they devised special hardware to optimize inter-port traffic and instead of using an internal shared network, have the equivalent of a Phone system's &quot;Switchboard&quot; where you can temporarily connect two ports without blocking data connection between another set of two ports&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex: Where Host(A) and Host(D) can communicate full speed while Host(C) communicates with Router(A) and one doesn't block the other nor reduce their possible bandwidth&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was called a &quot;Switched Fabric&quot;, and thus was born The Network Switch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            --------------&#xA;HOST(A)-----|  INTERNAL  |-----SWITCH(B)&#xA;            |            |&#xA;HOST(B)-----|   SWITCH   |-----HOST(D)&#xA;            |            |&#xA;HOST(C)-----|   FABRIC   |-----ROUTER(A)&#xA;            --------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, that is why we say a frame is Switched - the temporary (virtual) interconnection of two ports being like the old Telephone Switchboard, for the duration of the frame transfer. (It's all done by ASICs with buffers and very fast memory now, but you get the gist of it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helped!&lt;/p&gt;&#xA;" OwnerUserId="1645" LastEditorUserId="1645" LastEditDate="2014-09-26T13:50:31.567" LastActivityDate="2014-09-26T13:50:31.567" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11159" PostTypeId="2" ParentId="11154" CreationDate="2014-09-25T23:16:14.960" Score="1" Body="&lt;p&gt;Sounds like a homework question. Just think about it for a minute and the answer should be obvious: whatever bandwidth it takes to transmit that single frame, twice as the broadcast frame will be flying around the ring in both directions forever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What makes these sorts of loop a Very Bad Thing&amp;trade; is that whatever generated the first frame is going to generate more -- in fact, every device on an ethernet network generates broadcast frames. One frame won't even be noticed. After a few minutes when there are potentially hundreds screaming around the network, &lt;em&gt;everything&lt;/em&gt; is going to notice it.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-09-25T23:16:14.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11160" PostTypeId="1" AcceptedAnswerId="11168" CreationDate="2014-09-25T23:36:29.430" Score="1" ViewCount="662" Body="&lt;p&gt;Can QoS for a corporate environment be adjusted to prioritize traffic from SharePoint online so that improves user experience when uploading/downloading large files?  My network team is telling me no because the SharePoint URL is outside the network.  I am probably wrong but isn't QoS used for precisely prioritizing types of traffic for users?  Thanks for helping me understand.&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="8622" LastActivityDate="2014-09-26T14:09:33.513" Title="QoS with SharePoint Online" Tags="|qos|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11161" PostTypeId="2" ParentId="11097" CreationDate="2014-09-26T00:38:29.757" Score="0" Body="&lt;p&gt;This is normal and expected behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be a real problem if you could ping from any router, anywhere, without sourcing, every time - this is generally a &quot;no no&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine you are an IP packet header. If you do not specify a SOURCE IP address, what will be the &quot;Source IP&quot; entry in the header?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whatever is filled in there by default (non-routed loopback, physical non-routed interface, etc) is what is sent out of the default gateway. When you source, you are giving your IP header a valid address &amp;amp; subnet to return to. It is a best practice to source accordingly. Also, there are security implications of not explicitly defining these things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: Network Engineer for 6+ years @ Fortune 50 company.&lt;/p&gt;&#xA;" OwnerUserId="8489" LastActivityDate="2014-09-26T00:38:29.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11165" PostTypeId="2" ParentId="11160" CreationDate="2014-09-26T12:16:55.907" Score="1" Body="&lt;p&gt;There are two issues here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, can you identify Sharepoint traffic exclusively?  Since it uses ports 80 and 443, it's hard to distiguish Sharepoint from normal web traffic.  I assume you don't also want to prioritize cat videos.  To identify Sharepoint reliably, you need deep packet inspection -- that takes a lot of network horsepower.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, are you sure that network congestion on your internal network is really causing the problem?  Is all web browsing slow? You say your Sharepoint sites are external to your network. There are many possible external causes for slowness that you have no control over, and QoS will do nothing to help that.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-09-26T12:56:24.803" LastActivityDate="2014-09-26T12:56:24.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11168" PostTypeId="2" ParentId="11160" CreationDate="2014-09-26T14:09:33.513" Score="1" Body="&lt;p&gt;QoS is of no use if the traffic is going on the Internet, simply because almost no ISP is acting on QoS markings (in fact, it's normally stripped automatically when entering their network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For QoS to be useful at all, all nodes in the path (routers, switches, etc) mustn't reset the marking and also must ACT on it (ie: if you have &quot;DSCP EF&quot; marking - normally used for Voice &amp;amp; Video, if the switch doesn't strip it but doesn't prioritize those packets, it doesn't help)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is why your Network team told you that they can't do anything - unless there are some network bottleneck on your own network, if you go out the Internet where QoS isn't used, everything is &quot;Best Effort&quot; and every stream is (supposedly) treated equally (your Sharepoint traffic isn't more important to your provider than your're co-worker web requests).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you had a special understanding with your provider, they're connected to others and so on and so forth, until you reach the Sharepoint servers.  If any LINK used to reach those doesn't support QoS, then you have NONE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR: QoS is &lt;em&gt;NOT&lt;/em&gt; supported on the Internet at large&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-09-26T14:09:33.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11175" PostTypeId="1" AcceptedAnswerId="11181" CreationDate="2014-09-26T13:36:47.610" Score="2" ViewCount="792" Body="&lt;p&gt;802.1X Multiple Hosts mode is usually used when an access point acts as a supplicant and authenticates to the switch, then allows further hosts by bridging it to the wireless network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is whether this will work with a second switch instead of the access point, where one of the hosts authenticates. Will the second switch forward the EAP-Request packets to its hosts?&lt;/p&gt;&#xA;" OwnerUserId="1807" OwnerDisplayName="Locutus" LastEditorUserId="775" LastEditDate="2014-12-08T12:24:04.833" LastActivityDate="2014-12-08T12:24:04.833" Title="Does 802.1X Multiple Hosts mode only work for access points or even through another switch?" Tags="|ethernet|radius|ieee-802.1x|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11177" PostTypeId="2" ParentId="11153" CreationDate="2014-09-26T18:10:40.197" Score="2" Body="&lt;p&gt;I have done some changes. Added the router behind srx. Setup bgp. Now it works good. (routing, security ike, ipsec, policies). Here I use crypto map instead VTI on cisco router. ( VTI have tried too. Works good.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wSY5R.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;cisco1811:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;no logging console&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!         &#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;! &#xA;!&#xA;crypto isakmp policy 1&#xA; encr 3des&#xA; authentication pre-share&#xA; group 2&#xA; lifetime 28800&#xA;crypto isakmp key regata577 address 172.16.0.2&#xA;!&#xA;!&#xA;crypto ipsec transform-set TS esp-3des esp-sha-hmac &#xA;!&#xA;crypto ipsec profile IPSECPROFILE&#xA; set transform-set TS &#xA;!&#xA;!&#xA;crypto map PI-IPSEC 1 ipsec-isakmp &#xA; description **TEST-IPSEC**&#xA; set peer 172.16.0.2&#xA; set security-association lifetime seconds 28800&#xA; set transform-set TS &#xA; match address TEST-IPSEC&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;policy-map FOO&#xA; class class-default&#xA;  shape average 128000&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback5&#xA; ip address 5.5.5.1 255.255.255.255&#xA;!&#xA;interface Loopback10&#xA; ip address 10.10.10.1 255.255.255.0&#xA;!&#xA;interface Loopback33&#xA; description **for IPSEC-PI**&#xA; ip address 33.33.33.33 255.255.255.255&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; ip policy route-map REROUTE&#xA; crypto map PI-IPSEC&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 172.16.0.1 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router bgp 100&#xA; bgp log-neighbor-changes&#xA; neighbor 172.16.0.2 remote-as 200&#xA; !&#xA; address-family ipv4&#xA;  redistribute connected&#xA;  neighbor 172.16.0.2 activate&#xA;  no auto-summary&#xA;  no synchronization&#xA; exit-address-family&#xA;!&#xA;ip local policy route-map REROUTE&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 172.16.0.2&#xA;ip route 20.20.20.0 255.255.255.0 Loopback33&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip access-list extended TEST-IPSEC&#xA; permit ip 10.10.10.0 0.0.0.255 20.20.20.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;route-map REROUTE permit 6&#xA; description **for IPSEC-PI**&#xA; match ip address REROUTE&#xA; set default interface Loopback33&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;srx:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;system {&#xA;    root-authentication {&#xA;        encrypted-password &quot;$1$XTjfjhv5$vXlOzT/W4kK6nj4fHfxvY/&quot;; ## SECRET-DATA&#xA;    }&#xA;    login {&#xA;        user vlazarev {&#xA;            uid 2000;&#xA;            class super-user;&#xA;            authentication {&#xA;                encrypted-password &quot;$1$KN2wmboA$co8aH/Q1nZfBQ1oO81HLv0&quot;; ## SECRET-DATA&#xA;            }&#xA;        }&#xA;    }&#xA;    services {&#xA;        telnet;&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 172.16.0.2/30;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 192.168.0.2/30;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/2 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 131.131.131.100/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    st0 {&#xA;        unit 0 {&#xA;            family inet;&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 10.10.10.0/24 next-hop st0.0;&#xA;    }&#xA;    autonomous-system 200;&#xA;}&#xA;protocols {&#xA;    bgp {&#xA;        group eBGP {&#xA;            type external;&#xA;            neighbor 172.16.0.1 {&#xA;                export send-direct;&#xA;                peer-as 100;&#xA;            }&#xA;            neighbor 192.168.0.1 {&#xA;                export [ send-direct send-static ];&#xA;                peer-as 300;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;policy-options {&#xA;    policy-statement send-direct {&#xA;        term term1 {&#xA;            from protocol direct;&#xA;            then accept;&#xA;        }&#xA;    }&#xA;    policy-statement send-static {&#xA;        from protocol static;&#xA;        then accept;&#xA;    }&#xA;}&#xA;security {&#xA;    ike {&#xA;        policy ike_policy {&#xA;            mode main;&#xA;            proposal-set compatible;&#xA;            pre-shared-key ascii-text &quot;$9$wP2JD.mT9Cu4anCtpREwY2ajHTz3&quot;; ## SECRET-DATA&#xA;        }&#xA;        gateway ike_gate {&#xA;            ike-policy ike_policy;&#xA;            address 33.33.33.33;&#xA;            external-interface ge-0/0/0;&#xA;        }&#xA;    }&#xA;    ipsec {&#xA;        policy ipsec_policy {&#xA;            proposal-set compatible;&#xA;        }&#xA;        vpn IPSEC_VPN {&#xA;            bind-interface st0.0;       &#xA;            ike {&#xA;                gateway ike_gate;&#xA;                proxy-identity {&#xA;                    local 20.20.20.0/24;&#xA;                    remote 10.10.10.0/24;&#xA;                    service any;&#xA;                }&#xA;                ipsec-policy ipsec_policy;&#xA;            }&#xA;            establish-tunnels immediately;&#xA;        }&#xA;    }&#xA;    policies {&#xA;        from-zone Untrust to-zone Trust {&#xA;            policy 100 {&#xA;                match {&#xA;                    source-address MOSCOW;&#xA;                    destination-address KRASNODAR;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone Trust to-zone Untrust {&#xA;            policy 101 {&#xA;                match {&#xA;                    source-address KRASNODAR;&#xA;                    destination-address MOSCOW;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    zones {&#xA;        security-zone ACCESS {&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {                &#xA;                ge-0/0/2.0;&#xA;            }&#xA;        }&#xA;        security-zone Trust {&#xA;            address-book {&#xA;                address KRASNODAR 20.20.20.0/24;&#xA;            }&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    ike;&#xA;                }&#xA;                protocols {&#xA;                    bgp;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                ge-0/0/1.0;&#xA;            }&#xA;        }&#xA;        security-zone Untrust {&#xA;            address-book {&#xA;                address MOSCOW 10.10.10.0/24;&#xA;            }&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                ge-0/0/0.0;&#xA;                st0.0;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4635" LastActivityDate="2014-09-26T18:10:40.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11180" PostTypeId="2" ParentId="11138" CreationDate="2014-09-26T23:49:02.800" Score="2" Body="&lt;p&gt;It turns out the attributes are encoded the same way &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4271#page-23&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4271(BGP-4)&lt;/a&gt; specifies them. In a previous draft it was even &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-grow-mrt-13#page-11&quot; rel=&quot;nofollow noreferrer&quot;&gt;explicitly stated&lt;/a&gt; but it got somehow dropped in the final version:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;...the BGP path attribute length and attributes encoded as provided in a BGP Update message.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Each path attribute is therefore a triple &lt;code&gt;&amp;lt;attribute type, attribute length, attribute value&amp;gt;&lt;/code&gt; of variable length and its exact layout/specs can be read at the &lt;a href=&quot;http://www.iana.org/assignments/bgp-parameters/bgp-parameters.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;corresponding RFC&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8570" LastEditorUserId="-1" LastEditDate="2021-10-07T07:18:56.873" LastActivityDate="2014-09-26T23:49:02.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11181" PostTypeId="2" ParentId="11175" CreationDate="2014-09-27T01:37:36.587" Score="2" Body="&lt;p&gt;EAPOL is done at layer 2, so it's frames not packets, and should be passed through except when the second switch has 802.1X enabled.  If 802.1X is enabled on the second switch then it will either not allow clients to authenticate (if pae authenticator is not enabled on the port facing the host) or act as the authenticator (thus the switch you want to act as the authenticator won't see the frames).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The behavior could vary with cheap/low-end switches that don't handle 01:80:c2 frames as expected.&lt;/p&gt;&#xA;" OwnerUserId="8079" LastActivityDate="2014-09-27T01:37:36.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11184" PostTypeId="1" CreationDate="2014-09-27T03:48:57.307" Score="6" ViewCount="957" Body="&lt;p&gt;I was reading about TCP and came across the topic of congestion control wherein the TCP sender is responsible for obeying flow control and congestion control messages to prevent congestion in the network. What will happen if the sender decides not to listen to the congestion control messages and continues sending packets at a high rate anyway? Is there some way to protect the network from such devices as it seems like a security threat? I could not find the answer to this question in the text book and google wasn't of much help either so decided to ask here.&lt;/p&gt;&#xA;" OwnerUserId="8639" LastActivityDate="2014-12-28T16:08:06.377" Title="What if someone doesn't implement congestion control?" Tags="|tcp|congestion|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11186" PostTypeId="2" ParentId="3781" CreationDate="2014-09-27T09:33:51.677" Score="0" Body="&lt;p&gt;I think a reason is that in a Router-LSA the network is only represented as the IP address (no netmask) of the DR of that network while both the IP and the netmask are included in the Network-LSA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conceptually it is the DR that identifies the network, not an average router linked to the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another reason is that such a Network-LSA will be sent to others and time out as a single unit. For example, a retiring DR can flush its old Network-LSA so that that network will be deleted from other routers' link state DB.&lt;/p&gt;&#xA;" OwnerUserId="8641" LastEditorUserId="8641" LastEditDate="2015-07-24T05:02:35.893" LastActivityDate="2015-07-24T05:02:35.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11188" PostTypeId="1" CreationDate="2014-09-27T13:39:45.850" Score="6" ViewCount="2418" Body="&lt;p&gt;What is distributed firewall? What are the problems associated with conventional firewall that gave rise to distributed firewall? Are there any kind of attacks that can be prevented by using distributed firewall?&lt;/p&gt;&#xA;" OwnerUserId="8644" LastEditorUserId="6389" LastEditDate="2014-09-27T16:25:11.957" LastActivityDate="2014-11-07T21:25:30.903" Title="What is distributed firewall?" Tags="|firewall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11189" PostTypeId="2" ParentId="11188" CreationDate="2014-09-27T14:32:46.577" Score="4" Body="&lt;p&gt;As you can imagine, distributed firewalls were born out of necessity of scaling out the performance of firewalling services. While one central firewall, clustered (or whatever) can today handle usually up to multiple of 10Gbit/s streams, distributed firewall can in theory scale to unlimited bandwidth - as long as you can instantiate/install next units and synchronize configuration (and sometimes also state) between them. The policy you define once is synchronized across all access network entities, and appropriate filtering takes place across all ports of a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for examples - Cisco VSG with Nexus 1000v is distributed firewall, just like the newest VMWare NSX firewall. &lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-09-27T14:32:46.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11193" PostTypeId="1" AcceptedAnswerId="11198" CreationDate="2014-09-28T02:03:31.897" Score="2" ViewCount="1975" Body="&lt;p&gt;I know how the Spanning tree protocol works ,but where its works whether in trunk port Scenario or access port?&#xA; If works in trunk port how STP behave,then also how its behave in access port.&lt;/p&gt;&#xA;" OwnerUserId="4289" LastActivityDate="2014-09-28T09:37:44.923" Title="where the STP works in Switches?" Tags="|switch|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11197" PostTypeId="1" CreationDate="2014-09-28T06:42:23.167" Score="1" ViewCount="93" Body="&lt;p&gt;Peter Paluch did an &lt;a href=&quot;https://supportforums.cisco.com/discussion/10816351/whats-loop-traffic-ethereal&quot; rel=&quot;nofollow noreferrer&quot;&gt;experiment&lt;/a&gt; regarding loop frame. However I do not understand the connection/cabling on that experiment. Refer statement below.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The switch under test was connected via Fa0/1 to a hub (for sniffing&#xA;  purposes) and the hub was subsequently connected to another switch&#xA;  whose other two ports were intentionally connected together, creating&#xA;  a loop.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This maybe the answer to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/11071/ethernet-keepalive-test-l2-functionality-and-detect-network-loop-switch&quot;&gt;my question&lt;/a&gt; if I can understand the connection/cabling that he made.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-09-30T10:43:44.353" Title="Loop frame case study" Tags="|ethernet|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11198" PostTypeId="2" ParentId="11193" CreationDate="2014-09-28T09:37:44.923" Score="4" Body="&lt;p&gt;Trunk port is Cisco terminology and Cisco is one of the few vendors implementing Per VLAN Spanning Tree + (PVST+) which is the equivalent to 802.1D but with one spanning tree instance per VLAN. There is also Rapid Per VLAN Spanning Tree + (RPVST+) which is the equivalent of 802.1w but per VLAN. The plus means that STP is running over 802.1Q trunks as opposed to ISL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On an access port, only one VLAN is allowed, hence only one instance of spanning tree will be running on the port and the Bridge Protocol Data Units (BPDUs) will be sent untagged. Normally access ports will connect to end devices and the port would be configured as an edge port to bypass listening and learning state and to not generate any Topology Change Notification (TCN) on link up/down. You could run an access port between switches as well but that is generally a waste because you will want to have several VLANs between the switches. So far everything is the same but Cisco runs PVST+/RPVST+ and other vendors run STP/RSTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a trunk port (Cisco terminology) several VLANs will generally be allowed to traverse the trunk. On Cisco devices, every VLAN will in its own instance and different VLANs can be forwarding on blocking on the same physical port. On other vendors there will only be one instance running, even though several VLANs are traversing the trunk. This means that all VLANs most follow the same topology. It's not possible to any form of load sharing/traffic engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco devices will allow a different number of instances depending on what platform it is. Some will allow 32 instances, some 64 and some 128 and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also the option of running Multiple Spanning Treee (MST) which does not do per VLAN Spanning Tree. Instead it groups VLANs together into instances which is more effective.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage of PVST+/RPVST+ is that you can send VLANs on different paths and do traffic engineering. Also a change in one VLAN will not affect the others. The drawback is that it's less scalable if you have a lot of VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reverse is true for STP/RSTP, it scales better but it does not offer load sharing and changes sourcing from one VLAN can affect the others.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-09-28T09:37:44.923" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11199" PostTypeId="2" ParentId="11184" CreationDate="2014-09-28T10:33:21.070" Score="7" Body="&lt;p&gt;Congestion control enforced by TCP clients is not there to protect the network, it's simply to try determine the maximum network resource that is reliably available for that specific client at that point in time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As TCP is a reliable protocol (acknowledging each packet) any packet loss (for example caused by congestion) will result in the TCP connection slowing down to perform re-transmissions, congestion control tries to limit these retransmissions to speed up the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Congestion will &lt;strong&gt;always&lt;/strong&gt; happen on your network, as a networking engineer you should always assume that clients are not trusted and therefore you need tools within the (trusted) network that will protect you from their traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look into tools like Quality of Service, Scheduling and Queues. Simply put you should be enforcing polices on your network so high priority traffic like network control OSPF traffic should not have the same level of service as someone downloading a video from YouTube, that way client congestion will not affect other services on your network.&lt;/p&gt;&#xA;" OwnerUserId="8652" LastActivityDate="2014-09-28T10:33:21.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11200" PostTypeId="1" AcceptedAnswerId="11205" CreationDate="2014-09-28T12:24:02.043" Score="27" ViewCount="21215" Body="&lt;p&gt;What is the purpose of network address? (aka subnet address, starting address of each subnet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example in this network:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  192.168.1.0/24   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why we should leave &lt;strong&gt;192.168.1.0&lt;/strong&gt; address free? &lt;/p&gt;&#xA;" OwnerUserId="7824" LastEditorUserId="-1" LastEditDate="2020-07-20T13:00:16.010" LastActivityDate="2020-07-20T15:00:05.417" Title="What is the purpose of network address?" Tags="|ipv4|subnet|ip-address|" AnswerCount="8" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="11202" PostTypeId="1" AcceptedAnswerId="25006" CreationDate="2014-09-28T20:28:28.787" Score="2" ViewCount="594" Body="&lt;p&gt;I understand that the name &lt;strong&gt;&quot;Modem&quot; stands for Modulator/Demodulator&lt;/strong&gt;, which means that it works on the analogic singal coming from the backbone and translates it into digital.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I was just thinking: does the network card on the PCs work as Modems as well? I have checked and noticed that, somehow, UTP cables transfer inforation through digital signals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How does that work? Are the digital signals the same that the CPU transmits to other componentes in the computer via circuits?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I see, there's 3 types of signal transfer:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;From CPU to other components via Circuits&lt;/li&gt;&#xA;&lt;li&gt;Something else via Ethernet Cables&lt;/li&gt;&#xA;&lt;li&gt;Via internet&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Why we need to modulate signal to send it through the backbone and do not need to modulate it to transfer data via UTP cables?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;Got some interesting answers (thank you very much @rickybeam and @user2964971) but it still isn't clear for me why we require mod/demod for the backbone, but we don't need it to Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that a better way of asking the same would be: via internet (say dial up) we convert electronic signals into waves and back, and Ethernet just get electronic signals and send it through just like in a circuit, would that be the case?&lt;/p&gt;&#xA;" OwnerUserId="8656" LastEditorUserId="8656" LastEditDate="2015-01-16T02:38:26.207" LastActivityDate="2016-03-05T01:38:23.373" Title="Do network cards work as Modems too?" Tags="|ethernet|internet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11204" PostTypeId="2" ParentId="11202" CreationDate="2014-09-28T20:50:53.883" Score="1" Body="&lt;p&gt;Unless we're talking about dialup, most things today aren't technically a &quot;modem&quot;. An RS-232 modem really is modulating and demodulating. The +/-25VDC serial signal (as per spec, that few systems provide) is literally translated to/from the audio signal. (the encoding at higher speeds is much more complex, but in the beginning (Bell 103) it was 4 distinct tones.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we call a modem today -- cablemodem, DSL modem, etc. -- are protocol translators. They interconnect two layer-1 technologies.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-09-28T20:50:53.883" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11205" PostTypeId="2" ParentId="11200" CreationDate="2014-09-28T20:59:20.737" Score="12" Body="&lt;p&gt;They are functionally identical -- all-hosts subnet broadcast.  In the early days, long long ago, the all-zero's address (&quot;Network&quot;) was used for broadcast traffic. That was later changed to the all-one's address (&quot;Broadcast&quot;), and that's what we use today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[NOTE]&lt;/strong&gt;&lt;br&gt;&#xA;This is not the same thing as &quot;subnet-zero&quot; (or the all-one subnet) which is the the top and bottom &lt;em&gt;subnets&lt;/em&gt; from a &lt;em&gt;larger mask&lt;/em&gt;. eg. 192.168.1.0/24 broken into /28's: subnet-zero is 192.168.1.0/28 and all-ones subnet is 192.168.1.240/28&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Network Address&quot; and &quot;Broadcast Address&quot; are the first and last address &lt;em&gt;of a subnet&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-10-06T19:50:55.580" LastActivityDate="2014-10-06T19:50:55.580" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="11206" PostTypeId="2" ParentId="11200" CreationDate="2014-09-29T00:10:31.707" Score="7" Body="&lt;p&gt;It is used for routing purposes. When a router is told to route packets from sub-network A to sub-network B, the network address is used by the router to indicate the source and destination sub-networks as a whole.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there would be no way to distinguish a specific node on the sub-network from the entire subnet if we assigned a device to the network address but I believe the true purpose the the routing factor, I may be mistaken though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;further reading: &lt;a href=&quot;http://www.techexams.net/forums/network/90005-purpose-network-id-broadcast-id.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.techexams.net/forums/network/90005-purpose-network-id-broadcast-id.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8657" LastEditorUserId="8657" LastEditDate="2014-09-29T00:15:37.200" LastActivityDate="2014-09-29T00:15:37.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11207" PostTypeId="2" ParentId="11184" CreationDate="2014-09-29T08:30:13.240" Score="5" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;What will happen if the sender decides not to listen to the congestion&#xA;control messages and continues sending packets at a high rate anyway?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I would argue that a sender refusing to abide by congestion control algorithms is attempting a DoS attack.  To me, it's akin to saying &lt;em&gt;&amp;quot;I don't care if you're getting too much data, out of order, and with missing data. I'm just going to send it anyways, even if you don't accept.&amp;quot;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;If you get the time, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5681&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5681&lt;/a&gt; isn't &lt;em&gt;that&lt;/em&gt; bad of a read.  Especially if you need something to help you sleep.&lt;/p&gt;&#xA;&lt;p&gt;The good thing is that a sender that falls into this category is going to be sending more than it's receiving, meaning you can drop traffic before it reaches your border without much effort.  This is also easy to detect if you're monitoring your hosts bandwidth usage.  If you were the receiver, however, you might have a little more of a difficult time.  This is something webmasters constantly battle with.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Is there some way to protect the network from such devices as it seems&#xA;like a security threat?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I'll reiterate what I said above, a host attempting something like that should be considered compromised.  That is abnormal host behavior.  QoS will help to minimize the internal impact, but having control of your hosts is even more vital (not to mention CYA when your ISP comes complaining).&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-09-29T08:30:13.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11208" PostTypeId="1" AcceptedAnswerId="11213" CreationDate="2014-09-29T09:24:20.253" Score="1" ViewCount="2546" Body="&lt;p&gt;I was in a technical interview yesterday and my interviewer asked me a question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a single router connected to a private LAN and also connecting to two ISPs&#xA;(single multihomed design) like this topology: &lt;img src=&quot;https://i.stack.imgur.com/GUVPh.png&quot; alt=&quot;BGP Single-multihomed&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume that the Enterprise Router E1 connected to a LAN (whatever its IP) and running eBGP between each of those ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could you route your LAN's UPLOAD traffic via ISP1 and your DOWNLOAD traffic via ISP2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I told him that my knowledge is just about CCNA R&amp;amp;S and CCNP ROUTE because I thought that this question is very advanced for a CCNP ROUTE certificate holder. He told me that this question is within the CCNP ROUTE syllabus. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wondered if I can answer this question by CCNP ROUTE knowledge and also wonder how to answer this question by using BGP attributes or by any means?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope if someone could help me answering this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="8662" LastActivityDate="2014-09-29T14:46:19.853" Title="How to use BGP for upload/download traffic engineering?" Tags="|bgp|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11212" PostTypeId="2" ParentId="11208" CreationDate="2014-09-29T13:22:41.727" Score="3" Body="&lt;p&gt;I agree the question is a little vague, but if I had asked the question, I would be looking for your general understanding of BGP and techniques, not a specific configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside, if you think the question is vague, you should always ask for clarification.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To influence how traffic is received by E1, you control what you advertise to the ISPs. So to have traffic only come from ISP2, you only advertise your network to ISP2.  You could also advertise specific subnets to ISP2, and a larger network to both ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:  I forgot to mention that you can also use AS-PATH prepending (to ISP1) to have traffic use ISP2 over ISP1 (I clearly have not had enough coffee this morning).  Note that in real life, this only works for some ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To control traffic to the ISPs,  you can manipulate BGP advertisements received from the ISPs, so that outbound traffic uses ISP1.  For example, you can use the WEIGHT attribute on routes received from ISP1 to have all traffic go to ISP1.  Or, you can dispense with BGP altogether and use static routes, PBR, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a real network there would be lots of other factors that determine which techniques you use.  The point here is to demonstrate that you know at least some ways to manipulate BGP to control routing.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-09-29T14:46:19.853" LastActivityDate="2014-09-29T14:46:19.853" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11213" PostTypeId="2" ParentId="11208" CreationDate="2014-09-29T13:28:09.293" Score="1" Body="&lt;p&gt;He might have asked you not to implement this, but just to test your knowledge about BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding upstream traffic:&#xA;Ask ISP1 to advertise only a default route to your router. Filter all routes received from ISP2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding downstream traffic: &#xA;Advertise all your routes through ISP2. Advertise none through ISP1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bonus point:&#xA;Instead of filtering all routes from ISP2, create a policy stating that it should receive a default route, only with a metric higher than the one from ISP1. If you have more specific routes, those are preferred so if you have a /23, advertise a /23 to ISP1 and two /24 to ISP2. These would cover you should one of the ISPs fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other ways of doing this would be local preference and weight (cisco proprietary) for upstream traffic and MED for downstream traffic, but you would have to ask your ISPs if it's accepted.&lt;/p&gt;&#xA;" OwnerUserId="7635" LastEditorUserId="7635" LastEditDate="2014-09-29T14:14:51.213" LastActivityDate="2014-09-29T14:14:51.213" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="11216" PostTypeId="1" AcceptedAnswerId="43302" CreationDate="2014-09-29T20:14:39.103" Score="2" ViewCount="364" Body="&lt;p&gt;I am trying to do a bit of planning and would like some clarification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the overall network speed be degraded when the default gateway port speed is only 100Mbps?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance. Our network has a MPLS router that has a port speed of 100Mbps set as the default gateway for that office. That location does also have a 1Gbps and 10Gbps fiber connection connecting other offices together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone point me in the correct direction of a diagram of how packet traffic flows across/through the default gateway and the network? Does an initial packet hit the default gateway to get the route and then all following packets understand the route the first packet took after the default gateway?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Updates:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;9/30/2014&lt;/strong&gt;&#xA;The picture below is an overview of the network. The SBN network in the upper right hand corner is all one VLAN. That network is all flat and nothing special. All end users and servers are on the same VLAN and subnet. That location as well as all of the other locations get their internet piped through the the Metronet device. (This Metronet is a city wide fiber ring shared among several businesses in the area. We do not manage the routers that deal with that network)&#xA;All of our servers are currently in the SBN office and will soon be moving over to our new location at the MC office in the upper left corner of the diagram. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The GAP location is a shared datacenter space we have that is setup in bridged mode with our SBN location. The default gateway for the SBN and GAP locations is the 100Mbps MPLS router labeled GAP MPLS. There is a 1Gbps fiber link between the SBN and GAP locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We use the MPLS devices for phone and some specialized data. The ASA and Comcast devices are setup to connect the offices for the rest of their data needs to the SBN/GAP office. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are looking into transitioning the GAP SW25 switch to a better layer 3 switch and do some of our own routing on that device instead of the MPLS router that we do not manage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ax7pN.jpg&quot; alt=&quot;Network Overview&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3449" LastEditorUserId="775" LastEditDate="2014-12-08T12:22:48.313" LastActivityDate="2017-08-16T15:04:18.333" Title="Network performance when gateway connection is 100Mbps" Tags="|routing|mpls|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11224" PostTypeId="1" CreationDate="2014-09-30T13:18:43.253" Score="1" ViewCount="825" Body="&lt;p&gt;I have a few remote offices running Cisco 800 Routers and a HQ that is running a Fortigate 80D and an Azure Cloud enviroment that has a VPN Tunnel to the Fortigate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I have setup IPSec VPN's between all the remote offices and the Fortigate at HQ but I'm having difficulty routing the traffic from the remote sites throught to the Azure enviroment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remote site 1 Cisco - 192.168.66.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HQ Fortigate - 192.168.89.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Azure - 10.0.0.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new to newotking so have been strugling with this for a few days now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="8679" LastActivityDate="2014-10-30T19:33:18.100" Title="Routing from IPSec VPN1 to IPSec VPN2 through HQ" Tags="|cisco|routing|vpn|ipsec|fortigate|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11225" PostTypeId="1" AcceptedAnswerId="12600" CreationDate="2014-09-30T13:22:49.793" Score="5" ViewCount="242" Body="&lt;p&gt;I am investigating resiliency in LTE Evolved Packet Core.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each EPC components has information storage as defined for each user in 3GPP TS 23.40 (Ch 5.7).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case of failure this info needs to be sent to redundant component (synchronization).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know how much is the size of the info storage for each user. Then I can made deductions about the synchronization load.&lt;/p&gt;&#xA;" OwnerUserId="8680" LastEditorUserId="8550" LastEditDate="2019-11-09T23:24:41.580" LastActivityDate="2019-11-09T23:24:41.580" Title="LTE EPC Synchronization between redundant components" Tags="|network-core|lte|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11226" PostTypeId="2" ParentId="11216" CreationDate="2014-09-30T15:20:40.207" Score="0" Body="&lt;p&gt;Will the overall network speed be degraded when the default gateway port speed is only 100Mbps?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depends on the current traffic capacity. As i understood from your explanation you have 2 modes for connecting both locations. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;via dedicated bw&lt;/li&gt;&#xA;&lt;li&gt;via MPLS&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You need to carefully monitor the current traffic utilization to see how much you route via MPLS.&lt;/p&gt;&#xA;" OwnerUserId="8684" LastActivityDate="2014-09-30T15:20:40.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11227" PostTypeId="1" AcceptedAnswerId="11229" CreationDate="2014-09-30T15:48:15.697" Score="1" ViewCount="2930" Body="&lt;p&gt;Question: To setup uplink ports from network switch in trunk mode vs putting them in a port-channel?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We use Dell N series and PowerConnect switches in our agency. We are installing a new rack for our servers. Currently we are specifying the uplink ports to be part of a port-channel back to our core switch. If there is only (currently) one uplink connection is it better to leave the ports in the port-channel or just specify them as trunk ports?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Te1/0/1&#xA;channel-group 1 mode active&#xA;description &quot;Uplink to Core&quot;&#xA;exit&#xA;interface port-channel 1&#xA;classofservice trust ip-dscp&#xA;switchport mode trunk&#xA;switchport trunk native vlan 10&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;vs &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Te1/0/1&#xA;classofservice trust ip-dscp&#xA;switchport mode trunk&#xA;switchport trunk native vlan 10&#xA;description &quot;Uplink to Core&quot;&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would initially setting up the switches with the port-channel allow for easier expansion in the future without interruptions if we decided we needed more bandwidth?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; Decided to go with LACP between the the switches just in case we needed to add more bandwidth in the future. This rack that I am setting up is for a healthcare agency. There will be iSCSI traffic going across these switches as well as additional user traffic. &lt;/p&gt;&#xA;" OwnerUserId="3449" LastEditorUserId="3449" LastEditDate="2014-10-02T18:47:49.207" LastActivityDate="2014-10-02T18:47:49.207" Title="Uplink ports in trunk mode or aggregate link?" Tags="|switching|trunk|ieee-802.1ax|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11228" PostTypeId="2" ParentId="11216" CreationDate="2014-09-30T16:00:10.863" Score="2" Body="&lt;p&gt;There are many things you can to do improve the manageability and reliability of your network.  I would start with breaking up the large and geographically diverse layer 2 network (10.10.10.0) into smaller layer 3 subnets and route between.  But to answer your specific question, if the traffic flows through the MPLS router to the WAN network, then the interface speed may be a factor, depending on the WAN bandwidth.  But if traffic goes through one of the firewalls, then the MPLS router should issue a redirect to the host so it will send traffic directly to the firewall.  In that case the router is not involved in the traffic flow.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-09-30T16:00:10.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11229" PostTypeId="2" ParentId="11227" CreationDate="2014-09-30T16:31:05.790" Score="1" Body="&lt;p&gt;I would suggest using Port-channel if you intend to add more links in near future. You have enabled LACP which will take care of additional links once added.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&lt;/p&gt;&#xA;" OwnerUserId="8684" LastActivityDate="2014-09-30T16:31:05.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11230" PostTypeId="2" ParentId="11227" CreationDate="2014-09-30T17:07:28.997" Score="2" Body="&lt;p&gt;My general rule of thumb: if you don't need or aren't currently using a feature, don't enable it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enabling features you don't need/use only exposes yourself to more problems.  At the very least, this adds unnecessary lines to the configuration, making it longer and/or more complex.  The longer and more complex a configuration, the more prone it is to human errors and it can slow down troubleshooting processes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can also expose you to bugs/problems in the code that you would not otherwise be subject to without the unnecessary service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is something you plan to implement in the short term, then you may consider it.  However keep in mind that when you are adding your additional links, you can add the link aggregation at that time with a minimum of downtime (if done correctly).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-09-30T17:07:28.997" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11231" PostTypeId="2" ParentId="11224" CreationDate="2014-09-30T18:48:22.827" Score="2" Body="&lt;p&gt;Considering you have the IPSec tunnels up and running, that's half the battle, the other half is getting your Fortinet HQ to act as an Internet transport &quot;between&quot; hubs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the Forinet you can use either the Policy-Based or Route-Based VPN to enable communication between the spokes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a &lt;strong&gt;Policy-Based&lt;/strong&gt; hub-and-spoke VPN, you define a concentrator to enable communication between the spokes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To define the VPN concentrator&#xA;1. At the hub, go to VPN &gt; IPsec &gt; Concentrator and select Create New.&#xA;2. In the Concentrator Name field, type a name to identify the concentrator.&#xA;3. From the Available Tunnels list, select a VPN tunnel and then select the right-pointing arrow.&#xA;4. Repeat Step 3 until all of the tunnels associated with the spokes are included in the concentrator.&#xA;5. Select OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a &lt;strong&gt;Route-Based&lt;/strong&gt; hub-and-spoke VPN allowing communication between ONLY two spokes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;• Create a &lt;em&gt;security policy for each pair of spokes&lt;/em&gt; that are allowed to communicate with each other. The number of policies required increases rapidly as the number of spokes increases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To enable communication between two spokes, you need to define an &lt;strong&gt;ACCEPT&lt;/strong&gt; security policy for them. To allow either spoke to initiate communication, you must create a policy for each direction. This procedure describes a security policy for communication from Spoke 1 to Spoke 2. &#xA;1. Define names for the addresses or address ranges of the private networks behind each spoke. For more information, see “Defining policy addresses” on page 59.&#xA;2. Go to Policy &amp;amp; Objects &gt; Policy &gt; IPv4 and select Create New.&#xA;3. Leave the Policy Type as Firewall and leave the Policy Subtype as Address.&#xA;4. Enter the settings and select OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Incoming Interface&quot; Select the IPsec interface that connects to Spoke 1. &#xA;&quot;Source Address&quot; Select the address of the private network behind Spoke 1. &#xA;&quot;Outgoing Interface&quot; Select the IPsec interface that connects to Spoke 2. &#xA;&quot;Destination Address&quot; Select the address of the private network behind Spoke 2. &#xA;&quot;action&quot; Select ACCEPT.&#xA;&quot;Enable NAT&quot; Enable.&lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-09-30T18:48:22.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11232" PostTypeId="1" CreationDate="2014-09-30T22:44:33.397" Score="1" ViewCount="3638" Body="&lt;p&gt;Autonegotiation works at physical layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Autonegotiation negotiates speed and duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CSMA/CD is actually physical layer or MAC data link layer (software) implementation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If autonegotiation is physical layer implementation, how come duplex can be negotiated? Because MAC data link layer is the one that control whether frames to be transmitted or not in half duplex mode.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2017-02-22T04:11:24.497" Title="CSMA/CD - physical layer or MAC data link layer (software) implementation" Tags="|ethernet|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11233" PostTypeId="1" AcceptedAnswerId="11246" CreationDate="2014-10-01T00:53:35.813" Score="1" ViewCount="276" Body="&lt;p&gt;Can a single NLRI have more than one AS-Segment in an AS-path?&lt;br&gt;&#xA;Is AS-segment same as a AS-Number in a AS-path ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastEditorUserId="3193" LastEditDate="2014-10-01T16:28:44.690" LastActivityDate="2014-10-01T17:45:39.010" Title="In BGP What is an AS-segment? How is it different from an AS-path?" Tags="|bgp|bgp-ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11234" PostTypeId="1" CreationDate="2014-10-01T09:09:23.093" Score="10" ViewCount="11521" Body="&lt;p&gt;I was asked a question my one of my teachers. What is TCP port 0 reserved for? I did a bit of searching and research found 2 reasons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;For linux based system, to get the next available port from the OS that the program can use. Like asking for dynamically allocated ports.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Packets that don't need port numbers (like ICMP) use port number 0 in their packet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But these seemed like something that has evolved to be used for, just because port 0 was not being used for anything else. I did not find any use of port 0 that was assigned by 'IANA' in the beginning. Is there anything that was officially assigned to port 0?&lt;/p&gt;&#xA;" OwnerUserId="8280" LastEditorUserId="3191" LastEditDate="2014-11-30T15:25:56.307" LastActivityDate="2022-09-15T12:28:47.617" Title="TCP port 0 reserved for what purpose?" Tags="|tcp|transport-protocol|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11236" PostTypeId="2" ParentId="11232" CreationDate="2014-10-01T10:30:48.920" Score="5" Body="&lt;p&gt;Carrier sense and collision detect are physical layer functions; collision detect works quite differently between a bus based system like 10BASE2 and 10BASE-T. However the MAC layer is the part that uses these functions to decide when to transmit or backoff. Being at the MAC layer doesn't mean it's implemented in software though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a management interface between the MAC layer and the PHY layer containing control and status registers; this, amongst other things, allows the MAC layer to set speed and duplex. If the MAC layer enables autonegotiation, it should read back the result from the status register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The boundary between the MAC layer and PHY layer for 100Mbit/s and above is the &lt;a href=&quot;http://en.wikipedia.org/wiki/Media_Independent_Interface&quot; rel=&quot;nofollow&quot;&gt;Media Independent Interface&lt;/a&gt;, for example the SFP socket. So the PHY layer is on the transceiver, MAC layer on the NIC. &lt;/p&gt;&#xA;" OwnerUserId="6377" LastEditorUserId="6377" LastEditDate="2014-10-02T09:46:01.770" LastActivityDate="2014-10-02T09:46:01.770" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11239" PostTypeId="1" CreationDate="2014-10-01T12:23:36.277" Score="2" ViewCount="349" Body="&lt;p&gt;Am I correct that only &lt;em&gt;ARP request&lt;/em&gt; and &lt;em&gt;ARP reply&lt;/em&gt; messages will update the Cisco IOS ARP cache?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="775" LastEditDate="2014-10-01T16:53:55.410" LastActivityDate="2014-10-07T07:37:08.000" Title="Which traffic is able to update the ARP cache?" Tags="|cisco|arp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11240" PostTypeId="1" AcceptedAnswerId="11241" CreationDate="2014-10-01T12:50:43.757" Score="1" ViewCount="11435" Body="&lt;p&gt;I am trying to set up a very simple network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an Ubiquiti Edgerouter on 192.168.1.1 with eth0 as WAN port.&#xA;I also have an Ubiquiti Rocket m5 on 192.168.1.2, both the router and the Rocket have a web interface. I have set the https-port from the router on port 8443. The Rocket has a web interface on port 80 &amp;amp; 443.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i did:&#xA;I have made a working connection with my router, both ssh and web interface on 8443.&lt;br&gt;&#xA;Add a firewall rule for both port 80 and 443.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/issOX.png&quot; alt=&quot;Firewall Wan_local&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This seems to be working.&#xA;I also made a NAT rule to forward to the Rocket on 192.168.1.2&#xA;1 for port 80 and 1 for port 443.&#xA;Like so:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/2Dm8j.png&quot; alt=&quot;Nat rule&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the &quot;count&quot; is still 0. So i'm assuming this is the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone help me here? I'm looking for a very simple way to forward to 192.168.1.2. I am quite sure the web interface is enabled, because, if i &quot;join&quot; the network by plugging a cable directly into the router and into my PC, i can access the web interface.&lt;/p&gt;&#xA;" OwnerUserId="8693" LastActivityDate="2014-10-01T14:07:29.497" Title="Why cant i NAT to a local network address on my UBNT edgerouter" Tags="|routing|nat|ip-forwarding-table|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11241" PostTypeId="2" ParentId="11240" CreationDate="2014-10-01T14:07:29.497" Score="3" Body="&lt;p&gt;This may seem a little counter-intuitive, but you need to change the &quot;Translations&quot; IP address to 192.168.1.2 and remove the IP address from the &quot;Dest Address&quot; field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What the configuration is actually telling the device is that when you receive traffic with destination address/port on this interface, translate it to the translation address/port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of this is in cases where someone may have additional external IP addresses that they are given by their provider and you may want to be doing NAT translationns.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-10-01T14:07:29.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11243" PostTypeId="2" ParentId="11234" CreationDate="2014-10-01T14:21:19.223" Score="5" Body="&lt;p&gt;Keep in mind that a &amp;quot;reserved&amp;quot; resource is not an &amp;quot;assigned&amp;quot; resource.  Just because it is reserved doesn't mean that it is intended to be used for anything, at least at the current time.  Rather it has been set aside and should not be used, unless otherwise specified.&lt;/p&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6335&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6335&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; Reserved port numbers are not available for regular&#xA; assignment; they are &amp;quot;assigned to IANA&amp;quot; for special purposes.&#xA; Reserved port numbers include values at the edges of each range,&#xA; e.g., 0, 1023, 1024, etc., which may be used to extend these&#xA; ranges or the overall port number space in the future.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-10-01T14:21:19.223" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11246" PostTypeId="2" ParentId="11233" CreationDate="2014-10-01T17:45:39.010" Score="1" Body="&lt;p&gt;AS-PATHs contain one or more segments.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Yes, if the AS=PATH includes both an AS-Sequence and an AS-SET.&lt;/li&gt;&#xA;&lt;li&gt;Not exactly.  The segment includes the type (sequence or set), length, and value (list of ASNs).  In other words the segment can include more than one ASN.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-10-01T17:45:39.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11257" PostTypeId="1" AcceptedAnswerId="11258" CreationDate="2014-10-02T10:15:58.627" Score="6" ViewCount="4471" Body="&lt;p&gt;This is something I have wondered for awhile and couldn't find answer of. Apologies for the stupid question, but here it goes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If two computers have static IP's then they can easily send each other packets over TCP/IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a computer is behind a firewall/router/another device that connects it to the internet the computer doesn't have an external IP address. Instead it has a LAN address, e.g. 192.168.&lt;em&gt;.&lt;/em&gt;. If this computer wants to access a webpage, it knows the webserver's IP address, or uses DNS to obtain it. It sends a TCP/IP package, but how does the server then know what IP to send the answer to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Request:  A --[send to C, return to A]-&amp;gt; B --[send to C, return to B]-&amp;gt; C&#xA;Response: A &amp;lt;-[send to A, return to C]-- B &amp;lt;-[send to B, return to C]-- C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;A&lt;/code&gt; is the computer in question, &lt;code&gt;B&lt;/code&gt; is the router it sits behind, and &lt;code&gt;C&lt;/code&gt; is the target webserver. This doesn't seem realistic though, as &lt;code&gt;B&lt;/code&gt; would have to memorize who to forward replies to for &lt;strong&gt;every packet it routed out&lt;/strong&gt;. Which is probably a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my &lt;strong&gt;question 1&lt;/strong&gt; is: How does &lt;code&gt;C&lt;/code&gt; reply to &lt;code&gt;A&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In another scenario, computer &lt;code&gt;A&lt;/code&gt; wants to send a packet to computer &lt;code&gt;D&lt;/code&gt; both of which live in separate LAN networks. Is this possible without a central server &lt;code&gt;E&lt;/code&gt;? I imagine something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Request:  A --[s.t. D, r.t. A]-&amp;gt; B --[s.t. D, r.t. B]-&amp;gt; C --[s.t. D, r.t. C]-&amp;gt; D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, there is no way &lt;code&gt;A&lt;/code&gt; could know the address of &lt;code&gt;D&lt;/code&gt;, as &lt;code&gt;D&lt;/code&gt; in fact does not have an external IP address. The only solution using a central server &lt;code&gt;E&lt;/code&gt; is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A connects to E; has an id in E's system which is id_A&#xA;D connects to E; has an id in E's system which is id_D&#xA;A sends a message to D indirectly, by sending it to E and saying it is for id_D&#xA;E forwards the message to D, as it knows how to communicate with D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And even in this case, I don't quite get how can &lt;code&gt;E&lt;/code&gt; send a message to &lt;code&gt;D&lt;/code&gt;, if &lt;code&gt;D&lt;/code&gt; didn't request it (as my model for PC &amp;lt;-&gt; Server communication depends on the assumption that the PC requests and the Server responds; see question 1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My &lt;strong&gt;question 2&lt;/strong&gt; is: Is it possible and how can two computers that only have LAN IP's communicate directly, if they are in different LAN's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can point me to some beginners literature, that would be more than enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time.&lt;/p&gt;&#xA;" OwnerUserId="8708" LastEditorUserId="775" LastEditDate="2014-12-08T12:21:56.977" LastActivityDate="2016-05-07T19:04:57.597" Title="NEWBIE: How can two computers communicate if they are behind firewalls?" Tags="|ipv4|nat|tcp|ipv6|lan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11258" PostTypeId="2" ParentId="11257" CreationDate="2014-10-02T11:36:23.307" Score="12" Body="&lt;p&gt;First: What you describe is NAT, not firewalling. A firewall just filters what can go through, a NAT device changes addresses in packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You almost answer the first question yourself. Yes, a NAT device needs to keep track of every session going through it. Most communication on the internet uses TCP or UDP. Both of these protocols use port numbers. A session is defined by source address, source port number, destination address and destination port number. The NAT device needs to maintain a mapping between which numbers on the inside correspond to which numbers on the outside. And then it has to match every packet to an entry in its mapping table and adjust the packet accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is also why NAT devices are less than optimal: a normal router is stateless. It doesn't need to keep track of what happened previously and it doesn't need to adjust the numbers and addresses in the packet. If a router fails another router can take over immediately. When a NAT device fails the device that takes over doesn't have the same mapping table and all sessions break and have to be re-established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your second question is more complex. One option is to configure port forwarding in one of the NAT devices. Then you let A send a packet to the forwarded port on C. B will change the source address and port to one of its own. When the packet arrives at C it then adjusts the destination address and port so the packet is forwarded to D. Reply packets do exactly the same in the opposite direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is no port forwarding then it gets more difficult. You need to have the assistance of an external server E. Both A and D have to initiate connections to E. Then E has to coordinate setting up the session between A and D. A and D both send outbound packets to trick B and C into adding entries to their mapping tables. Once those mappings are in place they can communicate directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To summarise: the way things usually work is that for outbound packets you have a device that performs source NAT. It changes the source address and port of the internal device to one of its own. For inbound packets you have a device that performs destination NAT. It changes the destination address and port to what is in its mapping table. The mapping table is filled either by manual configuration, by a protocol that lets internal systems request a mapping (didn't talk about those, look up UPNP and PCP) or automatically when the NAT device creates an entry for an outbound packet.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-10-02T11:36:23.307" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11260" PostTypeId="1" CreationDate="2014-10-02T13:00:59.393" Score="3" ViewCount="5568" Body="&lt;p&gt;I have a Windows 2008 server and an application that connects over Internet to it. &#xA;From time to time I see that I receive a TCP [RST, ACK] that is ignored by my application. &#xA;Using TCPViewer I still can see that connection is still up.&#xA;I did different Wireshark captures and I can see that in case of the RST ignore, another packet is send back, and the connection is never dropped.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;269037  72.5.42.235 172.16.1.138    TCP 60  9003?54020 [RST, ACK] Seq=2655287284 Ack=371936778 Win=0 Len=0&#xA;269038  172.16.1.138    72.5.42.235 TCP 66  [TCP Dup ACK 268965#33] 54020?9003 [ACK] Seq=371936778 Ack=2655238984 Win=2097120 Len=0 SLE=2655243124 SRE=2655287284&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This usually happens when the connection is bad and I get a lot of latency, delayed packets and retransmissions.&#xA;Can somebody explain the situation when a [RST, ACK] may be ignored by an application or operating system?&lt;/p&gt;&#xA;" OwnerUserId="8711" LastEditorUserId="2142" LastEditDate="2014-10-02T19:48:54.010" LastActivityDate="2014-10-25T09:27:48.450" Title="Why TCP [RST, ACK] is ignored?" Tags="|tcp|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11263" PostTypeId="2" ParentId="10175" CreationDate="2014-10-02T14:29:20.853" Score="3" Body="&lt;p&gt;While discussing this problem was very interesting, the ISP has in the meantime started exchanging the DSL modems on the different sites by another brand. Some packet fragmentation issue they say. And hey, 9.5 Mbps in both directions without any problems or special settings.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="2329" LastEditDate="2016-04-02T21:14:05.550" LastActivityDate="2016-04-02T21:14:05.550" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11264" PostTypeId="1" AcceptedAnswerId="11280" CreationDate="2014-09-25T16:33:51.933" Score="5" ViewCount="1486" Body="&lt;p&gt;I have a Cisco WS-C3560G-24PS. We're going to make some changes to it, so I ran the command &lt;code&gt;show archive config diff&lt;/code&gt; to make sure everything is fine if we need to revert the changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that when I run that command it gives me the following that is in my running config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto pki certificate chain TP-self-signed-##########&#xA; +certificate self-signed 01 nvram:IOS-Self-Sig#1.cer&#xA;crypto pki certificate chain TP-self-signed-##########&#xA; -certificate self-signed 01&#xA;  lots and lots of numbers&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After checking with my manager, he confirmed that we added some certificates to the switch and I can save the running config. I ran the command &lt;code&gt;copy system:running-config nvram:startup-config&lt;/code&gt; and ran the &lt;code&gt;show archive config diff&lt;/code&gt; again and it shows the same thing. Cisco isn't my strong suite, so I'm not sure if this is normal behavior with certificates on a Cisco device or not. Is this something I need to worry about?&lt;/p&gt;&#xA;" OwnerUserId="8713" OwnerDisplayName="Nixphoe" LastEditorUserId="3191" LastEditDate="2014-10-03T08:45:17.157" LastActivityDate="2014-10-03T08:45:17.157" Title="Cisco &quot;show archive config diff&quot; displays crypto pki" Tags="|cisco|cli|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11268" PostTypeId="2" ParentId="11257" CreationDate="2014-10-02T18:16:01.623" Score="0" Body="&lt;p&gt;This is one of the problems &lt;a href=&quot;http://azure.microsoft.com/en-us/documentation/articles/service-bus-dotnet-how-to-use-relay/&quot; rel=&quot;nofollow&quot;&gt;Azure service bus relay&lt;/a&gt; is supposed to solve. It works in case both computers can access the internet. They both connect to azure which then handles the communication between them. &lt;/p&gt;&#xA;" OwnerUserId="8720" LastActivityDate="2014-10-02T18:16:01.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11269" PostTypeId="1" AcceptedAnswerId="11270" CreationDate="2014-10-02T19:32:04.823" Score="2" ViewCount="218" Body="&lt;p&gt;Working on setting up a new set of switches. When one of our offices network was setup we did not change any of the spanning tree settings and just let everything work itself out. We are now expanding and need to work on changing the spanning tree setup a bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a diagram of the network switches we are adding. What we are finding is that STP is blocking the LACP connection of the 2x 40GB cables between the switches up to the core. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question that we are having is how do we configure the ports for the LACP between the 2x Dell N4064 switches so that traffic flows between them before hitting the root bridge core switches? The port cost to get back to the root bridge is currently 2000 and the port cost across the 80G LACP between the switches is 250.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently the red X is where the ports are disabled and we would like to have the ports disabled at the purple X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Root Bridge has a configured spanning-tree priority of 4096. The other two switches both have the same priority of 20480.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/TXrjY.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3449" LastActivityDate="2014-10-02T19:42:48.487" Title="Changing spanning tree data path?" Tags="|spanning-tree|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ClosedDate="2014-10-08T07:17:27.387" ContentLicense="CC BY-SA 3.0" />
  <row Id="11270" PostTypeId="2" ParentId="11269" CreationDate="2014-10-02T19:42:48.487" Score="0" Body="&lt;p&gt;Increase the port cost on the uplink to the root switch to something greater than 3500  on either N4064 switch.  That will cause that port to block and the LACP bundle to start forwarding.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-10-02T19:42:48.487" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11271" PostTypeId="2" ParentId="11260" CreationDate="2014-10-02T20:59:13.490" Score="2" Body="&lt;p&gt;To close a whole TCP connection you need to close it on both sides. If one side closes the connection from its side, another side can have that connection opened as long as it wants.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check here how it works&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Transmission_Control_Protocol&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Transmission_Control_Protocol&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2453" LastEditorUserId="2453" LastEditDate="2014-10-25T09:27:48.450" LastActivityDate="2014-10-25T09:27:48.450" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11272" PostTypeId="2" ParentId="11260" CreationDate="2014-10-02T21:39:41.850" Score="2" Body="&lt;p&gt;A TCP connection is normally terminating using a special procedure where each side independently closes its end of the link. Connections are only a pair of two-way handshakes, not the normal 3-way handshake some people expect. Normal connection shutdown states are different at each end. It normally begins with one of the application processes signaling to its TCP layer that the session is no longer needed. That device sends a FIN message to tell the other device that it wants to end the connection, which is acknowledged. When the responding device is ready, it too sends a FIN that is acknowledged; after waiting a period of time for the ACK to be received, I believe its 4 mins, the session is closed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TCP protocol detects and responds to various problems that can occur during an established connection. One of the most common is the half-open connection. This occurs when one device closes the connection without the other one knowing about it, due to some problem with the connection, such as a bad network connection continuously flapping, which sounds like what you're experiencing. This means one device is in the ESTABLISHED state while the other may be in the CLOSED state, or some other transient state. This can cause states of the two devices to become unsynchronized. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP handles these half-open connections with the RST reset function, which is is generated whenever something happens that is “unexpected” by the TCP software. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your client issued the RST, your http server ACK'd the RST, which should have closed the connection. However, because of the network flapping and the connection being half-open and unsynchronized, this caused some packet-loss or received out of order. This is why you also see the DUP ACK in your post.  &lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-10-02T21:39:41.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11274" PostTypeId="1" AcceptedAnswerId="11276" CreationDate="2014-10-02T21:43:53.533" Score="3" ViewCount="10256" Body="&lt;p&gt;I need to determine the subnetmask and Host Id of a given address: 175.142.213.217/22&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I have so far:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address:    01010111.10001110.11010101.11011001&#xA;SubnetMask: 11111111.11111111.11111100.00000000 = 255.255.252.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The part I'm stuck on is how to determine the Host Id.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please explain to me in great detail how I would get to that point from what I have so far (assuming my answers above are correct)&lt;/p&gt;&#xA;" OwnerUserId="8703" LastEditorUserId="8499" LastEditDate="2018-03-11T01:50:28.180" LastActivityDate="2018-03-11T01:50:28.180" Title="Determining Host portion from a given ip address" Tags="|ipv4|ip|subnet|ip-address|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11276" PostTypeId="2" ParentId="11274" CreationDate="2014-10-03T01:25:05.890" Score="3" Body="&lt;p&gt;You have a subnet mask, but you need a host mask, which is just the NOT of the subnet mask (reverse the ones and zeros) to get 00000000.00000000.00000011.11111111.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AND the address and the host mask (only ones in both positions get to be one in the result) to get 00000000.00000000.00000001.11011001.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Convert that back to decimal (0.0.1.217) or give it as an offset into the subnet (473).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2014-10-03T13:04:49.517" LastActivityDate="2014-10-03T13:04:49.517" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11277" PostTypeId="2" ParentId="11274" CreationDate="2014-10-03T01:25:32.523" Score="1" Body="&lt;p&gt;Address:    01010111.10001110.11010101.11011001&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SubnetMask: 11111111.11111111.11111100.00000000 = 255.255.252.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to clarify, your Host ID is your actual IP address above. But here is how it looks from the binary perspective. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The subnet is determined from the natural &quot;class B&quot; network, which is everything from the left of the 16th binary bit, so we are dealing with the last 2 octets here. Your subnet is dictated by the &quot;1&quot; bits from left to right, starting from the 16th bit. So you have 6 bits set for the subnet (252 or /22) This leads us to the host bits. In this case the host bits are the &quot;0&quot;'s starting from right to left, from the very last bit. In this case we have 10 &quot;0&quot; bits set for your Host ID's to come from.&lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-10-03T01:25:32.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11278" PostTypeId="1" CreationDate="2014-10-03T01:39:05.383" Score="1" ViewCount="89" Body="&lt;p&gt;All books that I read will say value of line protocol (up/down) is indicator whether data link layer is working or not. Let us look at diagram below by &lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.3-2008_section2.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE regarding Ethernet, page 2&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/utta5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If line protocol (up/down) is indicator whether data link layer is working or not, they why when devices that process data link layer PDU, e.g. switch, router, connected to devices that do not process data link layer PDU (repeater), e.g. hub, media converter, have value of line protocol up?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2014-10-03T01:39:05.383" Title="What mechanism/value is used to determine value of line protocol?" Tags="|layer2|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11279" PostTypeId="1" CreationDate="2014-10-03T03:59:00.207" Score="0" ViewCount="164" Body="&lt;p&gt;I am rather new to VLAN setups, and I am not sure if I understand the basic implementation. To save some bits, I'll attempt a quick and dirty run down of my setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a crude picture(drawing) to start - &#xA;&lt;a href=&quot;https://drive.google.com/file/d/0B5EkiD8tb1Z9SnhaOU12ZXRSOHM/view?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;https://drive.google.com/file/d/0B5EkiD8tb1Z9SnhaOU12ZXRSOHM/view?usp=sharing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the internet feed coming into my basement to the ISPs &quot;ONT&quot;. From there, it runs to a switch(Dell PowerConnect 2748), port 48 if it helps, and set to unmanaged mode. I then have a consumer grade router connected to port 47. It is able to pick up the dynamic IP from the ISP with no issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then connect 4 nix-based servers to the ports on that router and create a 10.2.40.xxx subnet. They are all able to pickup the internet connection from the router just fine, and I configure the IP's in a static fashion. This router also servers up DHCP for all of my wireless devices up stairs(phones, xbox, laptops, etc) with no issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my basement, I have 4 more nix-based servers. 2 of them have static public IP addresses provided by my ISP, and they connect to ports 45 and 46 on the switch. They are picking up the network connection and all is well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have done next was ran a cable from the upstairs router(port1), down to the basement switch(port 1). This allows the basement servers access to the servers upstairs over the 10.2.40.xxx subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This setup appears to be working, however, there is a very obvious jump in overall latency on both sides. The overall speed doesn't appear to affected as when the speedtest.net finally did load, I was able to get it to show a download of 234MB/s. There were still a lot of timeouts and high latency responses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am hoping that putting the switch in &quot;managed&quot; mode might allow me to separate the public and private networks. PErhaps the VLAN and/or LAG settings? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is what I'm doing here even considered natural in the neteng world? I have set this up applying what ive learned as a sysadmin, and cannot say that my network terminology is correct &gt;.&amp;lt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;DDS&lt;/p&gt;&#xA;" OwnerUserId="8729" LastEditorUserId="775" LastEditDate="2014-12-08T12:21:26.933" LastActivityDate="2014-12-08T12:21:26.933" Title="Multi inbound networks on one switch - is it possible to mitigate high latency?" Tags="|vlan|dell|powerconnect|" AnswerCount="1" CommentCount="2" ClosedDate="2019-05-30T00:44:06.997" ContentLicense="CC BY-SA 3.0" />
  <row Id="11280" PostTypeId="2" ParentId="11264" CreationDate="2014-10-03T06:48:34.903" Score="2" Body="&lt;p&gt;Use the &lt;code&gt;archive config&lt;/code&gt; command to write a new copy of the config to the archive. That should clear up your diffs.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-10-03T06:48:34.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11281" PostTypeId="2" ParentId="11279" CreationDate="2014-10-03T07:41:47.047" Score="1" Body="&lt;p&gt;Set the Dell switch to 'managed mode' and create an external vlan for all devices outside your NAT router (in your case 45-48 for the two servers, internet and NAT router's outside interface). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to get further into the networking part, then move the rest of your ports off of vlan 1 to something else, but for home use you would be OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would expect a DHCP device connected to the internal vlan would occasionally pick up an public IP and bypass the limited security your NAT router is providing for you. You can demonstrate this by shutting down your router and watching 'internal' devices pick up a public IP.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="3912" LastEditDate="2014-11-02T15:46:12.817" LastActivityDate="2014-11-02T15:46:12.817" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11282" PostTypeId="1" AcceptedAnswerId="11284" CreationDate="2014-10-03T09:45:15.790" Score="4" ViewCount="5221" Body="&lt;p&gt;I am aware that situation, where duplicate MAC addresses appear in the same broadcast domain, should never happen. However, if such situation happens, then how will the network work? I think one should distinguish three scenarios here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) If NIC's with the same MAC address are directly connected with a crossover-cable, then based on my tests, some kernels will not send the ARP reply(for example FreeBSD 9.2 kernel, IOS 12.2) if the MAC address in &quot;ARP reply&quot; message is the same as configured to the NIC, while others do(for example Linux 2.6 and 3.7).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) If NIC's with the same MAC address are connected through a switch and those two hosts try to communicate with each other. This should not work because if one host sends an unicast frame which has the same source and destination MAC address, then switch would like to send the frame out of the port where it received the frame which is an illegal operation? In other words, such traffic should be dropped by the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) If two NIC's with the same MAC address are connected to switch and try to communicate with other hosts in the same broadcast domain. In this case, only one host at a time should be reachable? Depends on which of the switch ports has learned the MAC address. If both hosts generate traffic, then MAC address will flap between the two switch ports and there is a packet loss to both hosts?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-04-14T18:47:04.457" Title="What happens if two hosts with the same MAC address are in the same broadcast domain?" Tags="|mac-address|switching|arp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11283" PostTypeId="1" CreationDate="2014-10-03T11:20:29.807" Score="3" ViewCount="6833" Body="&lt;p&gt;I spent some time on this topic, but a lot of things is still unclear to me.&lt;/p&gt;&#xA;&lt;p&gt;Basically I don't understand how the pre-fragmentation is supposed to be configured on modern IOS boxes (does it have to be configured at all?) and what is the relationship between &amp;quot;ip mtu&amp;quot;, &amp;quot;crypto ipsec fragment before-encryption&amp;quot; and &amp;quot;crypto ipsec df-bit&amp;quot; commands.&lt;/p&gt;&#xA;&lt;p&gt;Imagine simplest scenario possible: H1 ---- R1 ----- R2 ---- H2. There is a IPsec over VTI tunnel between R1 and R2. IPsec over VTI automatically accounts for ESP overhead. When the tunnel is built, the MTU is automatically lowered to 1432 bytes.&lt;/p&gt;&#xA;&lt;p&gt;In this scenario two things can happen.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Packet comes in to R1. R1 realize that the size of the packet + overhead exceed egress interface MTU, so it will fragment it and THEN encrypt. End host H2 will be responsible for assembling the packet.&lt;/li&gt;&#xA;&lt;li&gt;Packet comes in to R1. It won't fit into egress interface, so it must be fragmented. Router first encrypt and then fragment. This is undesired behavior, because R2 will need to assembly the fragments before decryption. This means process switching, increased CPU load and bad things in general.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Now, the cisco DocCD says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When a packet is nearly the size of the MTU of the outbound link of the encrypting router and it is encapsulated with IPsec headers, it is likely to exceed the MTU of the outbound link. This causes packet fragmentation after encryption. The decrypting router must then reassemble these packets in the process path, which decreases the decrypting router's performance.&lt;/p&gt;&#xA;&lt;p&gt;The Pre-fragmentation for IPsec VPNs feature increases the decrypting router's performance by enabling it to operate in the high-performance CEF path instead of the process path. An encrypting router can predetermine the encapsulated packet size from information available in transform sets, which are configured as part of the IPsec security association (SA). If it is predetermined that the packet exceeds the MTU of the output interface, the packet is fragmented before encryption. This function avoids process-level reassembly before decryption and helps improve decryption performance and overall IPsec traffic throughput.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;&lt;br /&gt;&#xA;&lt;strong&gt;The pre-fragmentation feature is turned off by default for tunnel interfaces.&lt;/strong&gt; To receive pre-fragmentation performance benefits, turn pre-fragmentation on after ensuring that the tunnel interfaces have the same MTU on both ends.&#xA;Crypto maps are no longer used to define fragmentation behavior that occurred before and after encryption. &lt;strong&gt;Now, IPsec Virtual Tunnel Interface (also referred to as Virtual-Template interface) (VTI) fragmentation behavior is determined by the IP MTU settings that are configured on the VTI.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I've checked what are the default settings in newer IOS and they are as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec df-bit copy&#xA;crypto ipsec fragmentation before-encrypt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So how does this reflect above statements? Is the pre-fragmentation turned off by default, or not?&#xA;When should we use &amp;quot;ip mtu&amp;quot; on an interface and when not?&lt;/p&gt;&#xA;&lt;p&gt;Things are even more confusing, if we add the chart from the cisco DocCD to the mix.&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dplane/configuration/15-mt/sec-ipsec-data-plane-15-mt-book/sec-pre-frag-vpns.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dplane/configuration/15-mt/sec-ipsec-data-plane-15-mt-book/sec-pre-frag-vpns.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Chart describes the relationship between &amp;quot;crypto ipsec df-bit&amp;quot; and pre-fragmentation. How can the pre-fragmentation be turned on &lt;strong&gt;and&lt;/strong&gt; off with &lt;strong&gt;the same&lt;/strong&gt; &amp;quot;crypto ipsec df-bit&amp;quot; setting and actual DF bit in the IP header? (last 4 rows in the chart)&lt;/p&gt;&#xA;&lt;p&gt;If pre-fragmentation works by default, what is the purpose of &amp;quot;ip mtu&amp;quot; command? Any best practices?&lt;/p&gt;&#xA;" OwnerUserId="970" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-12-26T04:27:28.607" Title="Pre-fragmentation for IPsec VPNs on cisco routers" Tags="|vpn|ipsec|mtu|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11284" PostTypeId="2" ParentId="11282" CreationDate="2014-10-03T13:23:25.497" Score="4" Body="&lt;p&gt;I have seen this a few times, where manufacturers are lazy and store MAC addresses in CMOS or similar, and fall back to a common default. It would also be easy to arrange if using locally assigned addresses (e.g. when provisioning VMs)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I've not tested what individual OSs do. If your only problem is ARP, then static ARP entries might work for you.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Some old DEC systems used to send loopback packets to their own address, as a duplicate address check. I believe some Cisco switches do the same for loop detection. Either way, it's a special case of destination MAC filtering. If the address wasn't in the cache, I wouldn't be sure that first packet would be dropped immediately: it might be added to the forwarding tables and forwarded. Otherwise, silently drop.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The MAC address would flap; if you are running a stateless protocol at the higher levels, you may end up with something like a crude unicast load balancer. For something like TCP, you'll get a lot of RST's as well as packet loss. And as others have said, to an 'enterprise' switch it looks like MAC spoofing and some may log/trap on this event.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2014-10-03T13:23:25.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11291" PostTypeId="2" ParentId="11274" CreationDate="2014-10-04T00:39:38.583" Score="2" Body="&lt;p&gt;I think you mean host ip, but... whatever&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there are 5 classfull address, A B C D E. The difference from each other is the first bits in the first octet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A first bit=0           so from 1 to 127 in decimal&lt;/li&gt;&#xA;&lt;li&gt;B first two bits=10     so from 128 to 191 in decimal&lt;/li&gt;&#xA;&lt;li&gt;C first tree bits=110   so from 192 to 223 in decimal&lt;/li&gt;&#xA;&lt;li&gt;D first four bits=1110  so from 224 to 239 in decimal&lt;/li&gt;&#xA;&lt;li&gt;E first five bits=1111  so from 240 to 255 in decimal&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In the past those class was used instead of subnet mask,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;so a class A address mean by default 255.0.0.0 as subnet mask&lt;/li&gt;&#xA;&lt;li&gt;Class B address mean by default 255.255.0.0 as subnet mask&lt;/li&gt;&#xA;&lt;li&gt;Class C address mean by default 255.255.255.0 as subnet mask.&lt;/li&gt;&#xA;&lt;li&gt;Class D and E are used for particular purpose&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;so, in a class A the host-id is represented by the last 3 byte (the last 24 bits)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in a class B the host-id is represented by the last 2 byte (the last 16 bits)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in a class C the host-id is represented by the last 1 byte (the last 8 bits)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;so, to calculate the host id in a classfull notation is pretty simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but if you want to calculate it in a classless notation... is quite simple, too:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you just have to take the portion of the host address in binary (just count the number of zeros in the subnet mask: that is the number of bit dedicated to the host), then translate it in decimal. Be carefull:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you have to translate in decimal maximum 8 bits each time, from right to left. If the host id is more than 8 bits, you have to translate in decimal the first part, write a dot on the left, then the other bits, maximum 8 bits each time. That's why an ip address like that (256.256.256.256) doesn't exist.&lt;/p&gt;&#xA;" OwnerUserId="8727" LastActivityDate="2014-10-04T00:39:38.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11298" PostTypeId="2" ParentId="9951" CreationDate="2014-10-04T16:16:01.263" Score="2" Body="&lt;p&gt;Here is what I have gleaned from the Cisco support pages.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Status 71: Reset to update radio status on WLC. Also usually done upon&#xA;  AP joining the WLC after boot up.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&#xA;&lt;em&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/11364506/link-3-updown-interface-dot11radio0-changed-state-down#comment-6988651&quot; rel=&quot;nofollow&quot;&gt;Cisco Support Community - %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to down&lt;/a&gt;&lt;/em&gt;&#xA;&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="8686" LastEditorUserId="3191" LastEditDate="2015-07-01T21:18:42.997" LastActivityDate="2015-07-01T21:18:42.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11305" PostTypeId="1" CreationDate="2014-10-05T12:28:58.893" Score="8" ViewCount="1844" Body="&lt;p&gt;Can someone please tell me what protocols and port numbers I need to add to my Prec 5 DSCP QoS configurations to ensure that any video traffic gets pushed out first if there is congestion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it just RTP and H.323 protocols? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks :) &lt;/p&gt;&#xA;" OwnerUserId="5622" LastActivityDate="2016-02-08T08:27:13.360" Title="QoS Video - I want to prioritise video traffic. What protocols and port numbers should I add to my QoS design?" Tags="|qos|video|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11308" PostTypeId="2" ParentId="11305" CreationDate="2014-10-05T15:57:56.440" Score="1" Body="&lt;p&gt;As you mention RTP and H.323 you are probably prioritizing videoconferencing traffic. I won't go into the details of H.323 advantages over SIP, so I''ll just go over H.323 protocols. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also Prec 5 is really just EF (Express Forwarding). However, EF queues are very small which could lead to dropped packets. I would suggest using AF41, as you're not going to get a better advantage giving the audio portion of the videoconference a higher priority than video. Use AF41 for both audio and video. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the recommended ports for the H.323 protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;80  Static TCP  HTTP Web Interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;389 Static TCP  LDAP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;443 Static TCP  HTTPS &amp;amp; Port Tunnelling&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1718 Static UDP Gatekeeper Discovery&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1719 Static UDP Gatekeeper RAS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1720 Static TCP H.323 Call Setup&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2253 - 2263 TCP Sony endpoints&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2326 - 2485 UDP Cisco/Tandberg endpoints&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3230 - 3235 TCP Polycom endpoints&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3230 - 3280 UDP Polycom endpoints&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5001        TCP &amp;amp; UDP   Polycom PPCIP client&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5004 - 6004 TCP &amp;amp; UDP   ClearOne endpoints&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5060        TCP &amp;amp; UDP   SIP endpoints&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5061        TCP SIP TLS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5555 - 5574 TCP Cisco/Tandberg endpoints&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6000-6006   TCP &amp;amp; UDP   Librestream endpoints&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8080    Static TCP  HTTP Server Push (optional)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;9400 - 9406 TCP &amp;amp; UDP   AudiSoft endpoints&lt;/p&gt;&#xA;&#xA;&lt;p&gt;9800 - 9806 TCP AudiSoft Server/Gateway&lt;/p&gt;&#xA;&#xA;&lt;p&gt;9810 - 9822 UDP AudiSoft Server/Gateway&lt;/p&gt;&#xA;&#xA;&lt;p&gt;15100   Static TCP  NetPoint Q.931 Call&lt;/p&gt;&#xA;&#xA;&lt;p&gt;15101   Static TCP  NetPoint Default&lt;/p&gt;&#xA;&#xA;&lt;p&gt;15102   Static UDP  NetPoint Default&lt;/p&gt;&#xA;&#xA;&lt;p&gt;22136   Static TCP  MXM endpoint administration&lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-10-05T15:57:56.440" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="11310" PostTypeId="1" CreationDate="2014-10-06T08:30:18.370" Score="8" ViewCount="2237" Body="&lt;p&gt;I am trying to monitor individual transceivers on two EX8216 Juniper switches regarding the following parameters:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;RxPower &lt;/li&gt;&#xA;  &lt;li&gt;TxPower&lt;/li&gt;&#xA;  &lt;li&gt;Bias Current&lt;/li&gt;&#xA;  &lt;li&gt;Temperature&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The methodology I am following is the following: I do an SNMP walk on the 1.3.6.1.2.1.2.2.1.2 (ifDescr) OID to view the switches' interfaces and I identify the indexes of the transceivers I am interested in. Having identified the correct indexes I use the Juniper &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/general/jnxdomcurrententry-mib.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;jnxDomCurrentTable&lt;/a&gt; MIB to identify the OID of the aforementioned parameters that I want to monitor. Namely, the OIDs I am using are the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; - jnxDomCurrentRxLaserPower :.1.3.6.1.4.1.2636.3.60.1.1.1.1.5.&#xA; - jnxDomCurrentTxLaserBiasCurrent : .1.3.6.1.4.1.2636.3.60.1.1.1.1.6.&#xA; - jnxDomCurrentTxLaserOutputPower: .1.3.6.1.4.1.2636.3.60.1.1.1.1.7.&#xA; - jnxDomCurrentModuleTemperature: .1.3.6.1.4.1.2636.3.60.1.1.1.1.8.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when I do SNMP GETs on the two EX8216 switches I do not retrieve any values, instead I receive a message that the OID does not exist: &quot;No Such Instance currently exists at this OID&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The methodology I am following works fine for two MX960 Juniper devices and I am able to monitor the parameters mentioned above. However, it does not for the two EX8216 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Do EX8216 Juniper switches support the Juniper &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.2/topics/concept/mib-digital-optical-monitoring-overview.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Digital Optical&#xA;Monitoring MIB&lt;/a&gt;?&lt;/li&gt;&#xA;&lt;li&gt;If they do support this MIB, do I have to do something further to&#xA;enable SNMP polling of individual transceivers on the switches for&#xA;the specific OIDs I mentioned above?&lt;/li&gt;&#xA;&lt;li&gt;Finally, if they do not support it, is there another way to SNMP&#xA;poll those switches for the parameters I am interested in?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would be grateful for any pointers or advice on how to go about achieveing my goal.&lt;/p&gt;&#xA;" OwnerUserId="8760" LastEditorUserId="52517" LastEditDate="2019-06-06T13:30:26.620" LastActivityDate="2019-06-07T01:15:13.360" Title="SNMP Monitoring Juniper EX8216 switches for Rx/Tx power, temperature and bias current" Tags="|snmp|monitoring|juniper-ex|juniper-mx|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="11311" PostTypeId="2" ParentId="11239" CreationDate="2014-10-06T10:38:33.150" Score="-4" Body="&lt;p&gt;In general — yeah. There's special case of ARP messages called Gratuitous ARP, but anyways there're either replies or requests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://learningnetwork.cisco.com/thread/16335&quot; rel=&quot;nofollow&quot;&gt;https://learningnetwork.cisco.com/thread/16335&lt;/a&gt;&#xA;&lt;a href=&quot;http://wiki.wireshark.org/Gratuitous_ARP&quot; rel=&quot;nofollow&quot;&gt;http://wiki.wireshark.org/Gratuitous_ARP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8761" LastActivityDate="2014-10-06T10:38:33.150" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="11312" PostTypeId="1" AcceptedAnswerId="11314" CreationDate="2014-10-06T12:44:44.880" Score="3" ViewCount="22551" Body="&lt;p&gt;&lt;strong&gt;Mikrotik router Model :450g&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;like as,Access lists :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.www.google.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.www.yahoo.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.www.banglalinkgsm.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Denny list :&#xA;All sites without access listed sites .&lt;/p&gt;&#xA;" OwnerUserId="8759" LastActivityDate="2017-07-08T18:29:01.560" Title="How to give a user access only three sites and other all sites is blocked by mikrotik router?" Tags="|router|" AnswerCount="2" CommentCount="0" ClosedDate="2017-07-08T18:30:26.083" ContentLicense="CC BY-SA 3.0" />
  <row Id="11313" PostTypeId="2" ParentId="10769" CreationDate="2014-10-06T12:51:41.297" Score="0" Body="&lt;p&gt;Yes. It possible in different ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gerben and pyatka describe some possible solutions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can add more ways.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Create EoIP tunnel between RB2011 and CCR and bridge Wireless and this tunnel at RB2011. It allow make all wireless settings on AP (RB2011) and all routing, dhcp, firewall... on router (CCR).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use CAPsMAN on CCR and make Wi-Fi AP controlled. And use Central forwarding. Then virtual Wireles interface arrive on controller (CCR). Then almost all settings for AP done on CCR.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;PS. EoIP on my experience can limit bandwidth to 10 - 30 Mbit, but it can be enough for one AP.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="7539" LastEditDate="2014-10-06T14:06:57.827" LastActivityDate="2014-10-06T14:06:57.827" CommentCount="2" CommunityOwnedDate="2014-10-06T14:06:57.827" ContentLicense="CC BY-SA 3.0" />
  <row Id="11314" PostTypeId="2" ParentId="11312" CreationDate="2014-10-06T13:06:59.573" Score="4" Body="&lt;p&gt;&lt;strong&gt;You can follow this procedure:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use Firewall &gt; Filter Rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;For www.google.com access :&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.add a new rule&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.chain: forward&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.Src.Address : LAN Network IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.Dst.Address: www.google.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5.in.Interface : LAN Port Name&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6.action: accept&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7.apply &gt;OK &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;For www.yahoo.com access :&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.add a new rule&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.chain: forward&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.Src.Address : LAN Network IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.Dst.Address: www.yahoo.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5.in.Interface : LAN Port Name&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6.action: accept&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7.apply &gt;OK &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;For www.banglalinkgsm.com access :&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.add a new rule&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.chain:forward&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.Src.Address : LAN Network IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.Dst.Address: www.banglalinkgsm.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5.in.Interface : LAN Port Name&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6.action: accept&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7.apply &gt;OK &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;For Other sites access :&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.add a new rule&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.chain: forward&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.in.Interface : LAN Port Name&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.action: drop&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5.apply &gt;OK &lt;/p&gt;&#xA;" OwnerUserId="8758" LastActivityDate="2014-10-06T13:06:59.573" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11316" PostTypeId="2" ParentId="11310" CreationDate="2014-10-06T13:49:19.373" Score="2" Body="&lt;p&gt;From what I understand, the DOM MIB will only work with 10G XFP optical only, no support for 1G SFP yet unfortunately. See &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos14.1/topics/reference/mibs/mib-jnx-dom.txt&quot; rel=&quot;nofollow&quot;&gt;Juniper MIB References&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-10-06T13:49:19.373" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11318" PostTypeId="1" AcceptedAnswerId="11320" CreationDate="2014-10-06T15:02:31.843" Score="1" ViewCount="177" Body="&lt;p&gt;In Sonicwall, we &quot;split&quot; T1 line into two lines: Internal LAN (so we can get on the internet) and Client line (so clients can work with server that we host). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We simply dedicated 25% of bandwidth to our Internal LAN, and rest is given to client line. (25/75 ration was found through trial and error) Problem is - 25% is very,very slow for our office needs. And at the same time, clients are not using all the 75% all the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there way to make this speed dynamically adjustable, because clients are not using entire 75% of bandwidth all the time ?&lt;/p&gt;&#xA;" OwnerUserId="7758" LastActivityDate="2014-10-06T16:02:29.690" Title="Dynamic bandwith sharing in SonicWall" Tags="|sonicwall|bandwidth|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11319" PostTypeId="2" ParentId="11200" CreationDate="2014-10-06T15:21:06.380" Score="1" Body="&lt;p&gt;You never can count anything by 0.Host ID one kinds of counting .so Host ID start by 1 .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0/24&#xA;this expression use for router .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It means,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnet Mask:255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network :192.168.1.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Broadcast :192.168.1.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="8759" LastActivityDate="2014-10-06T15:21:06.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11320" PostTypeId="2" ParentId="11318" CreationDate="2014-10-06T16:02:29.690" Score="2" Body="&lt;p&gt;You should be able to set the guaranteed bandwidth along with the maximum allowed bandwidth for each connection.  So, for example, you can set your guaranteed bandwidth to 25% with a max of 75% on the Internal policy, while setting the Client policy to guarantee 50% with a max of 75%.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that if the client policy isn't using all of the bandwidth allocated, the internal policy can utilize the available bandwidth.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You didn't mention which device you're working with, but here's an overview of BWM policies from Sonicwall:  &lt;a href=&quot;http://help.mysonicwall.com/sw/eng/7630/ui2/70/Policies_Firewall_BWM_Snwls.html&quot; rel=&quot;nofollow&quot;&gt;http://help.mysonicwall.com/sw/eng/7630/ui2/70/Policies_Firewall_BWM_Snwls.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2014-10-06T16:02:29.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11321" PostTypeId="1" CreationDate="2014-10-06T16:58:54.707" Score="3" ViewCount="8148" Body="&lt;p&gt;The signal at source is tolerable at a peak of 6 mb/s, but from the server room to other network switches in other buildings, figure a distance of say a football field, it's terrible. You can barely use it and it keeps dropping. Is there anything out that can be installed in the network cabinet in addition to the switches and routers that can amplify the UTP copper signal to other areas from the source, which in my case is a server room. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is no device what would you recommend?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB: The signal is received by radio from the ISP but to the other buildings we have a wired UTP LAN network connection.&lt;/p&gt;&#xA;" OwnerUserId="8770" LastEditorUserId="775" LastEditDate="2014-10-07T12:47:08.770" LastActivityDate="2018-02-01T04:17:06.050" Title="What devices are used to boost a UTP copper ethernet signal?" Tags="|lan|cabling|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11322" PostTypeId="2" ParentId="11321" CreationDate="2014-10-06T19:16:15.407" Score="5" Body="&lt;p&gt;If the problem is on a long UTP copper cable pinned for ethernet, there are some solutions.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Change the copper UTP cable to Single-Mode Fiber. It solves not only the distance problem, but it also eliminates possible problems due to different electrical potential between buildings.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Add an Ethernet switch in middle of link, splitting the link into 2 parts, &amp;lt;=100m each; ethernet switches can regenerate the signal. FYI, the switch even can be powered by PoE from one of sides. (e.g. a Mikrotik RB260G)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use G.SHDSL.bis modem. It gives you up to 11 Mbit on 2 copper pairs; however, it's not very cheap and not very fast. The advantage is the ability to work on UTP copper runs of roughly 1 to 5 km.  You could also use another kind of Ethernet Cable Extender, I googled one up to 100 Mbit.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Ugly Russian solution: Use old 3COM switches (without MDII-MDX auto-sensing) it has a reputation of high sensitive/high power device. (I don't recommend this, because it is not guaranteed to work.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use minimal as possible cross commutation in this link. Ideally, crimp RJ45 (8P8C) directly on the cable and put it in the switch.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Tighter wires and higher category cabling is better. However, if you need to install new cables, fiber optics are strongly advised between buildings.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Partial solution: Try configuring this link as Half-duplex rather than Full-duplex, or 10 Mbit rather 100 Mbit. (Half-duplex can lower importance of NEXT interference).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;PS. Solutions 4,5, and 6 are ugly because it's non-standard. 7 also, because it is really a broken link. Choose wisely.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="3191" LastEditDate="2014-10-09T16:00:16.553" LastActivityDate="2014-10-09T16:00:16.553" CommentCount="4" CommunityOwnedDate="2014-10-06T19:16:15.407" ContentLicense="CC BY-SA 3.0" />
  <row Id="11323" PostTypeId="2" ParentId="6309" CreationDate="2014-10-06T19:30:04.403" Score="0" Body="&lt;h1&gt;Original Answer&lt;/h1&gt;&#xA;&lt;p&gt;As a rule of thumb, a &amp;quot;LAN&amp;quot; is a broadcast domain. (It may consist of more than one.) Then again, as a rule of thumb, a rule of thumb applies 3/8ths of the time, so this doesn't really give much to go on.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;This was understandably rather poorly received, so I've expanded below.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;h1&gt;Updated Answer&lt;/h1&gt;&#xA;&lt;p&gt;I've never really liked the essentially recursive answer of &amp;quot;a LAN is a network of devices in the same area.&amp;quot; Granted, it's a rather subjective term, so here are a few other options to illustrate what one may be. Note they may not apply in all situations, there may be exceptions... or they may ALL apply to your situation:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Layer 2 Network&lt;/strong&gt;&#xA;If devices are in the same Layer 2 Network, they can be described as being on a LAN.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Broadcast Domain&lt;/strong&gt;&#xA;Devices in a broadcast domain are in a LAN (or multiple LANs). This normally applies to VLANs (Virtual LANs), which can be used to segment a LAN... or can be used to link physically distant devices into essentially the same LAN. Yes, this stretches the definition of &amp;quot;local!&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Non-Routable IP Address&lt;/strong&gt;&#xA;A set of devices on the same non-routable IP address subnet who can talk to each other (without NAT or other workarounds) are most likely on the same LAN as well. What are non-routable IP addresses? Wikipedia explains it well enough: &lt;a href=&quot;http://en.wikipedia.org/wiki/IP_address#IPv4_private_addresses&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://en.wikipedia.org/wiki/IP_address#IPv4_private_addresses&lt;/a&gt; Essentially, these ranges are set aside for &amp;quot;local&amp;quot; use and are not to be forwarded out to the internet.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Sidebar&lt;/em&gt;&#xA;These non-routable ranges appear to have been rather arbitrarily chosen--eg, there's nothing special in electricity that makes 10.0.0.0/8 range not route, but someone realized some ranges should be set aside and made a judgement call about which ones. I could be wrong (which isn't rare by a long shot), but Jodies.de lets us see the binary of these ranges ( &lt;a href=&quot;http://jodies.de/ipcalc?host=10.0.0.0&amp;amp;mask1=8&amp;amp;mask2=&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://jodies.de/ipcalc?host=10.0.0.0&amp;amp;mask1=8&amp;amp;mask2=&lt;/a&gt; ). I don't see anything terribly remarkable about the addresses. They just seem arbitrary. See for yourself:&lt;/p&gt;&#xA;&lt;p&gt;Address:   10.0.0.0              00001010 .00000000.00000000.00000000&#xA;Netmask:   255.0.0.0 = 8         11111111 .00000000.00000000.00000000&lt;/p&gt;&#xA;&lt;p&gt;Address:   172.16.0.0            10101100.0001 0000.00000000.00000000&#xA;Netmask:   255.240.0.0 = 12      11111111.1111 0000.00000000.00000000&lt;/p&gt;&#xA;&lt;p&gt;Address:   192.168.0.0           11000000.10101000 .00000000.00000000&#xA;Netmask:   255.255.0.0 = 16      11111111.11111111 .00000000.00000000&lt;/p&gt;&#xA;&lt;p&gt;Enough digression!&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;VPN Tunnels&lt;/strong&gt;&#xA;Additionally, a VPN tunnel (be it just from your PC to your company or a site-to-site/LAN-to-LAN tunnel) lets a remote machine behave as though it were on the LAN. If it walks like a duck, and it talks like a duck, and it tastes like a duck...&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion&lt;/strong&gt;&#xA;&amp;quot;LAN&amp;quot; and &amp;quot;WAN&amp;quot; are rather ambiguously defined. They are hardly the only delineations, either--I've been trained on a model that went from LAN to optional CAN (Campus Area Network) and/or to MAN (Metropolitan Area Network) to WAN. You may define your LAN as everything behind your home internet modem, but your ISP could consider every subscriber on your block to be in a LAN... and they could both be right simultaneously! The terms can subjective to a degree, but these guidelines (and all the others posted) should help you determine if something is a member of a LAN, a WAN, or both.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-10-09T19:24:52.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11325" PostTypeId="2" ParentId="11200" CreationDate="2014-10-06T22:42:31.460" Score="13" Body="&lt;p&gt;The use of &amp;quot;0&amp;quot; in a IP addresss was defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc923&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC923&lt;/a&gt; and carried over in successive RFCs:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Special Addresses:&#xA;&#xA;  In certain contexts, it is useful to have fixed addresses with&#xA;  functional significance rather than as identifiers of specific&#xA;  hosts.  When such usage is called for, the address zero is to be&#xA;  interpreted as meaning &amp;quot;this&amp;quot;, as in &amp;quot;this network&amp;quot;.  The address&#xA;  of all ones are to be interpreted as meaning &amp;quot;all&amp;quot;, as in &amp;quot;all&#xA;  hosts&amp;quot;.  For example, the address 128.9.255.255 could be&#xA;  interpreted as meaning all hosts on the network 128.9.  Or, the&#xA;  address 0.0.0.37 could be interpreted as meaning host 37 on this&#xA;  network.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This example provides for a specific host on the current network (0.0.0.37) by using 0's in the network portions of the address, but it doesn't actually clarify the opposite case (0's in the host portion of the address).  However as it did define &amp;quot;0&amp;quot; as &amp;quot;this.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;From there, I haven't been able to find any documentation to back up my memory, but in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1060&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1060&lt;/a&gt; the address &amp;quot;0.0.0.0&amp;quot; was clearly documented as &amp;quot;this host on this network&amp;quot;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;     (a)   {0, 0}&#xA;&#xA;        This host on this network.  Can only be used as a source&#xA;        address (see note later).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Since all zeroes for the host part of the address meant &amp;quot;this host,&amp;quot; it is unusable as a host address on the network.&lt;/p&gt;&#xA;&lt;p&gt;Logically, a network was referenced by using the &amp;quot;network&amp;quot; portion of the address followed by all zeros (i.e. no host bits in use).  I can't find documentation to back up my memory but I believe that this was widely accepted long before &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1060&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1060&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Thanks to Ricky's mention of &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc919&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC919&lt;/a&gt;, I found the reference I had been looking for that illustrates what I recall about the general acceptance of the network address:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;However, as a notational convention, we refer to&#xA;networks (as opposed to hosts) by using addresses with zero fields.&#xA;For example, 36.0.0.0 means &amp;quot;network number 36&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;As an aside, touching on Ricky's mention of subnet-zero and the all-ones subnet, I believe the first documentation of that comes from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc950&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC950&lt;/a&gt; which references &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc943&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC943&lt;/a&gt; (which obsoleted &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc923&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC923&lt;/a&gt; above but uses the same language for special addresses):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;     It is useful to preserve and extend the interpretation of these&#xA;     special addresses in subnetted networks.  This means the values&#xA;     of all zeros and all ones in the subnet field should not be&#xA;     assigned to actual (physical) subnets.&#xA;&#xA;        In the example above, the 6-bit wide subnet field may have&#xA;        any value except 0 and 63.&#xA;&#xA;     Please note that there is no effect or new restriction on the&#xA;     addresses of hosts on non-subnetted networks.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-10-07T00:11:47.863" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11327" PostTypeId="2" ParentId="11239" CreationDate="2014-10-07T07:37:08.000" Score="2" Body="&lt;p&gt;I wouldn't say that ARP Requests / Replys are the &lt;em&gt;only&lt;/em&gt; way an address makes it into the FIB, but it is certainly the most predominant. &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7716/3191&quot;&gt;Gratutious ARP&lt;/a&gt; has been mentioned a few times, and with good reason. It doesn't follow the standard ARP Request/Reply procedures, but certainly accomplishes the same goal – populating the FIB with a relevant entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don’t forget about manual intervention.  Another way of populating the FIB is by manually setting a static address on the interface or having one automatically stick with port-security.  &lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-10-07T07:37:08.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11330" PostTypeId="1" CreationDate="2014-10-07T08:53:14.477" Score="5" ViewCount="10667" Body="&lt;p&gt;I am currently in this situation and I'll try to be as specific as I can.&#xA;My firewall has 20 VPNs (over the internet) with different vendors. Everything was fine til a month ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I usually use ping to monitor the remote networks and some of my VPNs have 1-5% packet loss. The VPN does not go down, but the ping does. The firewall log shows nothing wrong, not any blocked packets everything seems all right. Overall, it is a 0% packet loss / day, but in some intervals it goes to 5% (at about 1pm, where traffic peaks)&#xA;Some other VPNs are fine with 100% reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I noticed: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Most loss occours when we're at peak traffic (again, only for the &quot;damaged&quot; VPNs. The other VPNs are fine)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-From my WAN i have 0% loss with 8.8.8.8 but there's 1-5% packet loss with the remote WANs in question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Restarting the firewall stabilizes the situation for about a day, but then everything starts over again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-The VPN tunnel is UP all the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;any help from your experience would be truly appreciated&lt;/p&gt;&#xA;" OwnerUserId="8775" LastActivityDate="2015-02-05T22:11:03.033" Title="Some VPNs have 1-5% packet loss" Tags="|cisco|vpn|internet|packet-loss|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11332" PostTypeId="1" CreationDate="2014-10-07T12:24:13.573" Score="1" ViewCount="1969" Body="&lt;p&gt;I have a ZyWALL USG 50.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe it is capable of restricting Internet access. For example when a user attempts to visit a website they need to first present a username and password that is allowed to access the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't see any documentation on it, or how it is set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there someone who has some experience doing such things with a ZyWALL USG 50?&lt;/p&gt;&#xA;" OwnerUserId="8780" LastActivityDate="2015-01-13T22:20:15.077" Title="How can I restrict Internet access on a ZyWALL USG 50?" Tags="|firewall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11335" PostTypeId="1" CreationDate="2014-10-07T14:57:53.163" Score="2" ViewCount="1187" Body="&lt;p&gt;Can I connect a Dell R720 with a Broadcom 57840S Quad Port 10Gb SFP+ Direct Attach Rack Network Daughter Card (540-BBCN) and Cisco 2960S SPF connection?  I'm using a Cisco Twinax cable and the ports show up as cable diconnected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions?&#xA;Thank you&lt;/p&gt;&#xA;" OwnerUserId="8782" LastEditorUserId="8782" LastEditDate="2014-10-07T16:15:14.580" LastActivityDate="2014-10-09T15:47:35.820" Title="Dell R720 and Cisco 2960S SFP+ connection" Tags="|cisco|sfp|dell|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11336" PostTypeId="1" CreationDate="2014-10-07T15:06:02.197" Score="3" ViewCount="1426" Body="&lt;p&gt;When setting up my 3750 stacks, I enable IPv6 on the Vlan1 interface so that I can manage the stack over IPv6.  The stacks are not doing any layer 3 routing.  However, it seems that the IPv6 address that gets automatically assigned changes if a different switch becomes the stack master, presumably because the mac address of the vlan interfaces changes as well.  Other than manually assigning an IPv6 address, is there a way to prevent this annoying behavior?&lt;/p&gt;&#xA;" OwnerUserId="8781" LastEditorUserId="8499" LastEditDate="2018-12-21T04:48:36.913" LastActivityDate="2018-12-21T04:48:36.913" Title="IPv6 address assigned to vlan interface of 3750 switch changes" Tags="|cisco|ipv6|ip-address|interface|cisco-3750|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11337" PostTypeId="2" ParentId="11336" CreationDate="2014-10-07T16:55:43.927" Score="1" Body="&lt;p&gt;You could use DHCPv6 to send them IPv6 addresses, but your best bet is going to be the same approach with IPv4 - static IP addressing for management interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, consider using a different and unique VLAN for your management interface and applying ACLs limiting access to the management interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=2181837&amp;amp;seqNum=11&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscopress.com/articles/article.asp?p=2181837&amp;amp;seqNum=11&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2014-10-07T16:55:43.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11339" PostTypeId="2" ParentId="11335" CreationDate="2014-10-07T17:26:48.177" Score="3" Body="&lt;p&gt;SFP+ = 10gig&lt;br&gt;&#xA;SFP = 1gig&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most SFP+ ports will accept an SFP transceiver&lt;br&gt;&#xA;SFP ports cannot support SFP+ transceivers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might be able to connect a 1gig link from the Broadcom to your switch (if the Broadcom supports SFP, which I couldn't find), but you cannot connect a 10gig link to your switch since your four transceiver ports are all SFP, not SFP+.&lt;/p&gt;&#xA;" OwnerUserId="74" LastEditorUserId="3191" LastEditDate="2014-10-09T15:47:35.820" LastActivityDate="2014-10-09T15:47:35.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11340" PostTypeId="2" ParentId="11335" CreationDate="2014-10-07T17:51:24.310" Score="3" Body="&lt;p&gt;The Cisco WS-C2960S-48-FPS-L has 4 SFP ports which operate at 1Gbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the documentation I can find on the Broadcom 57840S, it has four SFP+ ports that operate at 10Gbps.  I find no mention that it can support lower data rates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your Cisco Twinax cables, the only ones I am aware of are 10G.  These will not work in your 2960S.  A couple of posts that may be somewhat relevant to this from the Cisco forums would be &lt;a href=&quot;https://supportforums.cisco.com/discussion/11905936/can-sfp-copper-twinax-connection-be-configured-1gb&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; and &lt;a href=&quot;https://supportforums.cisco.com/discussion/11648126/possible-downgrade-10gb-twinax-cu-sfp-cable-1gb&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-10-07T17:51:24.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11347" PostTypeId="1" CreationDate="2014-10-08T08:39:17.557" Score="11" ViewCount="14529" Body="&lt;p&gt;The Unix command &lt;code&gt;traceroute&lt;/code&gt; traces the IP addresses of the nodes from a source node to a destination node. Every node in between has an incoming and an outgoing interface.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/U7KMT.png&quot; alt=&quot;traceroute&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Executing &lt;code&gt;traceroute -n dst&lt;/code&gt; on &lt;code&gt;src&lt;/code&gt; will show the IP addresses of src, dst and all incoming interfaces of the hops in between.&lt;/p&gt;&#xA;&lt;p&gt;But how to trace the outging IP addresses?&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Update&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;I tried the &lt;code&gt;ping -R&lt;/code&gt; suggestion but it does not seem to work. This is the traceroute to a public web server:&lt;/p&gt;&#xA;&lt;pre&gt;&#xA;$ ping -n -c 1 -R 212.227.222.9&#xA;PING 212.227.222.9 (212.227.222.9) 56(124) bytes of data.&#xA;64 bytes from 212.227.222.9: icmp_req=1 ttl=57 time=47.4 ms&#xA;RR:     192.168.2.111&#xA;        169.254.1.1&#xA;        87.186.224.94&#xA;        62.154.76.34&#xA;        62.154.12.175&#xA;        212.227.117.13&#xA;        212.227.117.8&#xA;        10.71.3.253&#xA;        212.227.222.9&#xA;&#xA;&#xA;--- 212.227.222.9 ping statistics ---&#xA;1 packets transmitted, 1 received, 0% packet loss, time 0ms&#xA;rtt min/avg/max/mdev = 47.441/47.441/47.441/0.000 ms&#xA;&lt;/pre&gt;&#xA;&lt;p&gt;And this is the IP address of my dial-up connection.&lt;/p&gt;&#xA;&lt;pre&gt;&#xA;$ curl -s https://toolbox.googleapps.com/apps/browserinfo/info/ | jq -r .remoteAddr&#xA;93.192.75.247&#xA;&lt;/pre&gt;&#xA;&lt;p&gt;But it has not been recorded by the ping command. What can be the reason?&lt;/p&gt;&#xA;" OwnerUserId="8797" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-10-09T09:34:41.850" Title="How to trace outgoing interfaces?" Tags="|ping|traceroute|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11349" PostTypeId="2" ParentId="11347" CreationDate="2014-10-08T09:46:17.247" Score="7" Body="&lt;p&gt;I's not exactly the answer at your question, but that a simple (but limited) way to do (in certain case) what you want.&#xA;I'm coping-post the option -R of ping man page:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;-R     Record  route.   Includes the RECORD_ROUTE option in the ECHO_REQUEST packet and displays the &lt;strong&gt;route buffer&lt;/strong&gt; on returned packets.&#xA;Note that the IP header is only large enough for nine such routes.&#xA;Many hosts ignore or discard this option.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So you can see also the &lt;strong&gt;return path&lt;/strong&gt; of the ECHO_REQUEST, that is not the exit interface (that you are asking about) unless the outgoing path is the same of the come back path. Only in this case, the returning path is the IP address of the outgoing interface you are asking for.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;That's an real example on my internet provider net, maybe not so clear, but I don't have just now some router to link each other :)&lt;/em&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/qskc5.png&quot; alt=&quot;dest 10.2.105.178&quot; /&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;traceroute 10.2.105.178&#xA;traceroute to 10.2.105.178 (10.2.105.178), 30 hops max, 60 byte packets&#xA; 1  192.168.1.254 (192.168.1.254)  3.418 ms  3.575 ms  4.021 ms&#xA; 2  10.189.48.1 (10.189.48.1)  11.237 ms * *&#xA; 3  10.2.105.178 (10.2.105.178)  15.235 ms * *&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ping -R 10.2.105.178 PING 10.2.105.178 (10.2.105.178) 56(124) bytes of&#xA;data.&lt;/p&gt;&#xA;&lt;p&gt;64 bytes from 10.2.105.178: icmp_req=5 ttl=253 time=74.1 ms NOP RR:&lt;/p&gt;&#xA;&lt;p&gt;192.168.1.133&lt;/p&gt;&#xA;&lt;p&gt;10.189.51.61&lt;/p&gt;&#xA;&lt;p&gt;10.2.105.177&lt;/p&gt;&#xA;&lt;p&gt;10.2.105.178&lt;/p&gt;&#xA;&lt;p&gt;10.2.105.178&lt;/p&gt;&#xA;&lt;p&gt;10.189.48.1&lt;/p&gt;&#xA;&lt;p&gt;192.168.1.254&lt;/p&gt;&#xA;&lt;p&gt;192.168.1.133&lt;/p&gt;&#xA;&lt;p&gt;----omitted----&lt;/p&gt;&#xA;&lt;p&gt;64 bytes from 10.2.105.178: icmp_req=6 ttl=253 time=13.0 ms NOP RR:&lt;/p&gt;&#xA;&lt;p&gt;192.168.1.133&lt;/p&gt;&#xA;&lt;p&gt;10.189.51.61&lt;/p&gt;&#xA;&lt;p&gt;10.2.105.177&lt;/p&gt;&#xA;&lt;p&gt;10.2.105.178&lt;/p&gt;&#xA;&lt;p&gt;10.2.105.218 ##change every time, Idon't know why##&lt;/p&gt;&#xA;&lt;p&gt;10.189.48.1&lt;/p&gt;&#xA;&lt;p&gt;192.168.1.254&lt;/p&gt;&#xA;&lt;p&gt;192.168.1.133&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8727" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-10-08T12:04:11.283" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="11351" PostTypeId="2" ParentId="11347" CreationDate="2014-10-08T13:47:57.393" Score="6" Body="&lt;p&gt;According to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1812&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1812&lt;/a&gt; the source address of ICMP message generated by the router should be that of the egress interface over which the packet would normally return to the sender.&lt;/p&gt;&#xA;&lt;p&gt;In reality, it is very likely that you will face non-standard behavior where router will source the ICMP reply with the source of ingress interface. This usually make the traceroute much easier to read.&lt;/p&gt;&#xA;&lt;p&gt;As a follow-up to YLearn's question I'm posting a network diagram and some outputs.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/E007V.jpg&quot; alt=&quot;Sample topology to illustrate how traceroute works&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Let's assume we are souring the traceroute from R5's loopback 5.5.5.5 to R1's loopback 1.1.1.1. As you can see, the forward path is via R4-R2, while reverse path is R3-R4.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;R4#sh ip route 1.1.1.1&#xA;Routing entry for 1.1.1.1/32&#xA;Known via &amp;quot;bgp 4&amp;quot;, distance 20, metric 0&#xA;Tag 2, type external&#xA;Last update from 10.1.24.2 00:02:42 ago&#xA;Routing Descriptor Blocks:&#xA;* 10.1.24.2, from 10.1.24.2, 00:02:42 ago&#xA;  Route metric is 0, traffic share count is 1&#xA;  AS Hops 2&#xA;&#xA;R1#sh ip route 5.5.5.5&#xA;Routing entry for 5.5.5.5/32&#xA;Known via &amp;quot;bgp 1&amp;quot;, distance 20, metric 0&#xA;Tag 3, type external&#xA;Last update from 10.1.13.3 00:14:18 ago&#xA;Routing Descriptor Blocks:&#xA;* 10.1.13.3, from 10.1.13.3, 00:14:18 ago&#xA;  Route metric is 0, traffic share count is 1&#xA;  AS Hops 2&#xA;  Route tag 3&#xA;  MPLS label: none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The traceroute output from R5 looks as following:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;R5#traceroute&#xA;Protocol [ip]:&#xA;Target IP address: 1.1.1.1&#xA;Source address: 5.5.5.5&#xA;Numeric display [n]:&#xA;Timeout in seconds [3]:&#xA;Probe count [3]:&#xA;Minimum Time to Live [1]:&#xA;Maximum Time to Live [30]:&#xA;Port Number [33434]:&#xA;Loose, Strict, Record, Timestamp, Verbose[none]:&#xA;Type escape sequence to abort.&#xA;Tracing the route to 1.1.1.1&#xA;VRF info: (vrf in name/id, vrf out name/id)&#xA;1 10.1.45.4 208 msec 140 msec 100 msec&#xA;2 10.1.24.2 96 msec 44 msec 104 msec&#xA;3 10.1.12.1 224 msec 220 msec 112 msec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So while the actual ICMP traffic generated by R1 is going back to R5 via R3, the IP header of ICMP Unreachable message will have the source of ingress interface 10.1.12.1.&lt;/p&gt;&#xA;&lt;p&gt;In my experience this how Cisco and Juniper routers behave, I'm not sure about other vendors.&lt;/p&gt;&#xA;" OwnerUserId="970" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-10-09T09:34:41.850" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11363" PostTypeId="1" AcceptedAnswerId="60216" CreationDate="2014-10-09T09:17:15.707" Score="0" ViewCount="1239" Body="&lt;p&gt;Packet switched networks break data up into packets. Obviously on a circuit switched network it needs to break a 100MB file up into parts, so what is the equivalent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I once heard the term &quot;packet&quot; used to refer to whatever it is the circuit switched network uses to transfer data, but it seems to be the general consensuses that only a packet switched network has packets&lt;/p&gt;&#xA;" OwnerUserId="8025" LastEditorUserId="775" LastEditDate="2014-10-09T09:29:51.600" LastActivityDate="2019-07-04T07:42:19.200" Title="How is data transferred in a circuit switched network?" Tags="|protocol-theory|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11364" PostTypeId="1" CreationDate="2014-10-09T09:20:21.310" Score="6" ViewCount="28199" Body="&lt;p&gt;I need to reset my CUCM Admin password and name.  On previous versions of Cisco Call Manager, I had to log in to CLI and run these commands :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;utils reset_ui_administrator_name&#xA;utils reset_ui_administrator_password&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it seems as they do not exist anymore in 10.5. At least the CLI does not support them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody confirm this? Also, is there a way to work around this issue? (I know about password recovery but that is not what I need).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3484" LastEditorUserId="3191" LastEditDate="2015-01-05T17:33:51.370" LastActivityDate="2017-11-03T09:09:58.547" Title="CUCM 10.5 - Reset Admin name &amp; password" Tags="|cisco|voip|cisco-voip|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11365" PostTypeId="1" AcceptedAnswerId="11369" CreationDate="2014-10-09T10:11:01.673" Score="1" ViewCount="143" Body="&lt;p&gt;In a LAN only network without any routers but only two levels of switchs (4500s for core and  2960s for access) I would like to enable IPv6 autoconfiguration for Windows 7 hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible for the 4500s to send RAs with a prefix and thus allow hosts for stateless conf ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure wether it is relevant or not but the LAN is divided between VLANs for which each of the switchs has a configured IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="8827" LastEditorUserId="8827" LastEditDate="2014-10-09T13:43:00.017" LastActivityDate="2014-10-09T13:43:00.017" Title="IPv6 RAs on Cisco 4500 switch" Tags="|cisco|ipv6|lan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11366" PostTypeId="2" ParentId="11200" CreationDate="2014-10-09T11:47:39.333" Score="-3" Body="&lt;p&gt;Networks are divided into subnetworks mainly for the following reason. &#xA;There is a concept called the public IP and private IP space in IPV4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for an organisation to communicate with outside world it should have public IP , &#xA;we cannot afford to have public IP for each and every system in our org. so to overcome this we have used subnetting &lt;/p&gt;&#xA;&#xA;&lt;p&gt;also used for security reasons. basically to custom restrict the access between a set of users &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is just a broader view :)&lt;/p&gt;&#xA;" OwnerUserId="8828" LastActivityDate="2014-10-09T11:47:39.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11367" PostTypeId="2" ParentId="11363" CreationDate="2014-10-09T11:48:29.083" Score="-2" Body="&lt;p&gt;A circuit switched network can also transport packets. The difference between a packet-switched and a circuit-switched network is in how the routing is done:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In a packet-switched network, each packet has a source/destination address and is routed &lt;em&gt;individually&lt;/em&gt; through the entire network. So it is possible that two consecutive packets (transporting the data of the same “file”) go through different network nodes.&lt;/li&gt;&#xA;&lt;li&gt;In a circuit-switched network, the route is typically computed when you establish a connection. So the route is determined once for all before any data transfer, and every packet will follow the same route. Each intermediate node will associate a label to this route, so that packets don't need to include a source/destination address anymore, they can just include their routing label, and each intermediate node will simply read the label, and transmit the packet on the appropriate link.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In real life things are usually more complex, some examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a packet-switched network will behave a little bit like a circuit-switched network by caching already calculated routes, which results in a performance gain (widely used on IP networks to reduce latencies).&lt;/li&gt;&#xA;&lt;li&gt;a circuit-switched network has re-routing protocols in case if a node fails. It's also very important in mobile networks, when a cellphone changes the base station it is connected to.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8778" LastEditorUserId="8778" LastEditDate="2014-10-09T11:54:06.017" LastActivityDate="2014-10-09T11:54:06.017" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11368" PostTypeId="1" CreationDate="2014-10-09T12:40:12.313" Score="3" ViewCount="4743" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hB0FJ.png&quot; alt=&quot;How to agregate multiple traffic at Layer 2/3 between different vendors devices&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Hi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have network design like at above picture. There are 3 floors and each one is stapled by one switch. All 3 floors are connected to the MAIN Switch which is connected to the Edge router`s interrior switch only by one cat. 5e cable. That means that 3 floors use only one 1GB Ethernet connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 spare cables which I would like to use to provide better communication accross my network. The plan is to connect each floor by separate cable (3 x 1 GB) within one address network range - 192.168.1.0/24 because there are no VLAN`s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can`t connect all 3 cables just like that because of Spanning Tree and frame storm when  multiple connections between single switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CloudCore has interior switch stapled into one bridge. HP switches has one single switch with default VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What would be the best practice and how can I force MikroTik CloudCore and HP MAIN Switch to use all 3 cables (one cable should carry all traffic from single floor) ad the same time ?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="8499" LastEditDate="2018-02-14T16:49:50.733" LastActivityDate="2018-02-14T16:49:50.733" Title="How to agregate multiple traffic at Layer 2/3 between different vendors devices?" Tags="|switch|router|switching|hp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11369" PostTypeId="2" ParentId="11365" CreationDate="2014-10-09T13:37:02.283" Score="1" Body="&lt;p&gt;Not sure if you are talking about the 3750 or the 2960 you mention above. But yes IPv6 stateless autoconfiguration on interfaces, subnets and sites is supported by both switches with the minimum IOS 12.2(44)SE. &lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-10-09T13:37:02.283" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11370" PostTypeId="1" CreationDate="2014-10-09T13:38:16.193" Score="1" ViewCount="78" Body="&lt;p&gt;All areas in an Open Shortest Path First (OSPF) autonomous system must be physically connected to the backbone area (Area 0). does it mean do all the data really have to traverse through area 0, and it's part of area 0's duty to distribute inter area LSAs from one area to another? how making this star topology, I mean the urge of connecting other areas to area 0 gonna guard against routing loops within a multi-area network? is it about making just control-plane information, or actual data gonna get through other areas just by area 0?&lt;/p&gt;&#xA;" OwnerUserId="7741" LastActivityDate="2014-10-09T13:38:16.193" Title="Why All areas in an OSPF autonomous system must be physically connected to the backbone area (Area 0)? is it a control-plane thing or what?" Tags="|ospf|" AnswerCount="0" CommentCount="2" ClosedDate="2014-10-11T00:32:16.710" ContentLicense="CC BY-SA 3.0" />
  <row Id="11371" PostTypeId="2" ParentId="11368" CreationDate="2014-10-09T14:43:42.180" Score="0" Body="&lt;p&gt;For the HP 1810&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Go to &quot;Trunks&quot;&lt;/li&gt;&#xA;&lt;li&gt;&quot;Trunk Configuration&quot;&lt;/li&gt;&#xA;&lt;li&gt;Click &quot;Create&quot; checkbox and name the link then apply changes&lt;/li&gt;&#xA;&lt;li&gt;Go to &quot;Trunk membership&quot;&lt;/li&gt;&#xA;&lt;li&gt;Pick the trunk id that was created earlier&lt;/li&gt;&#xA;&lt;li&gt;Pick the ports you'd like to aggregate then apply changes&lt;/li&gt;&#xA;&lt;li&gt;Save Configuration&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For the MikroTik CCR1036&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example Config: &lt;em&gt;/inteface bonding add slaves=ether1,ether2 mode=802.3ad lacp-rate=30secs link-monitoring=mii-type1 \ transmit-hash-policy=layer-2-and-3&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://hotfortech.wikispaces.com/Link+aggregation+(802.3ad)+on+HP+1800G+%26+1810G&quot; rel=&quot;nofollow&quot;&gt;HP Config Reference&lt;/a&gt;&#xA;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Interface/Bonding#802.3ad&quot; rel=&quot;nofollow&quot;&gt;Mikrotik Config Reference&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8829" LastActivityDate="2014-10-09T14:43:42.180" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11378" PostTypeId="2" ParentId="11368" CreationDate="2014-10-09T17:21:07.997" Score="2" Body="&lt;p&gt;I made Trunk at HP using LACP Active and I made bonding at CloudeCore using balance-rr which gave me load balancing at all 3 Ethernet cables between floors and also backup if cables get failure :D&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="775" LastEditDate="2015-03-08T22:23:33.130" LastActivityDate="2015-03-08T22:23:33.130" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11380" PostTypeId="1" CreationDate="2014-10-09T19:17:57.483" Score="2" ViewCount="188" Body="&lt;p&gt;Currently using a sonicwall but looking... small organization but calls are important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do a failover between two different ISP's and NOT have the sip traffic drop.  We use a Internet based VoIP provider, we have no onprem equipment.&lt;/p&gt;&#xA;" OwnerUserId="8833" LastEditorUserId="775" LastEditDate="2014-12-08T12:20:34.303" LastActivityDate="2014-12-08T12:20:34.303" Title="Small Business SIP Fail over multiple ISP's" Tags="|cisco|sonicwall|failover|sip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11381" PostTypeId="2" ParentId="11380" CreationDate="2014-10-09T19:27:11.660" Score="3" Body="&lt;p&gt;In a word: NO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your IP address changes when you change ISPs. So any calls currently active on the now-down-ISP will fail. (there may be some trickery that could get the call(s) to redirect/forward to a new SIP endpoint, but I don't think that can work with the current endpoint unreachable.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a tunnel to your internet voip provider, then yes, you could rearrange the underlying transport all you want -- the endpoints aren't changing, so the calls will stay up. (failover &lt;em&gt;quickly&lt;/em&gt;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-10-09T19:27:11.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11383" PostTypeId="2" ParentId="11200" CreationDate="2014-10-09T22:59:13.690" Score="1" Body="&lt;p&gt;&lt;strong&gt;For the sake of basic understanding&lt;/strong&gt;, network address is used for identifying a network, just like a group name identifies a group. In the example you took 192.168.1.0/24, the network address 192.168.1.0 is taken as a name for the group comprising of IP addresses from 192.168.1.1 to 192.168.1.254.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if the router needs to find where, for example, IP 192.168.1.24 exists, it will search for its IP pool name (i.e network address) 192.168.1.0/24 and not the individual IP addresses. This is the reason why network address in not assigned to a particular machine.&lt;/p&gt;&#xA;" OwnerUserId="8835" LastEditorUserId="31518" LastEditDate="2016-12-25T17:36:02.363" LastActivityDate="2016-12-25T17:36:02.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11384" PostTypeId="1" AcceptedAnswerId="11386" CreationDate="2014-10-09T23:25:22.960" Score="4" ViewCount="11012" Body="&lt;p&gt;I've been brought in to troubleshoot an issue on an install performed by a different engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic topology is: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1x Dell N2000 as Core Switch&#xA;1x Dell N2000 as Access Switch 01&#xA;1x Dell N2000 as Access Switch 02&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access switches trunk with a single 1gb interface to the core (Gi1/0/24 on both access switches) so there are no switching loops or anything like that so far as I can tell. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, the topology looks like this: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(ACSW01)Gi1/0/24 &amp;lt;-&gt; Gi1/0/22 (CORE) Gi1/0/21 &amp;lt;-&gt; Gi1/0/24(ACSW02)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nothing fancy - The VLANs are: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 47 - 192.168.47.0/24&#xA;VLAN 48 - 192.168.48.0/24&#xA;VLAN 49 - 192.168.49.0/24&#xA;VLAN 50 - 192.168.50.0/24 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point, clients on any VLAN get internet connectivity, but clients on VLAN 49 or VLAN 50 cannot ping a printer on VLAN48 located on Edge Switch 01 (ESW01) - but if the printer's connection is physically moved to the core switch, they can. The problem follows the VLANs on edge switches, not the devices; any device connected to an edge switch that is NOT on VLAN 48 will not be able to communicate with any other VLAN - unless the device is on the core switch. Additionally, those clients experience no issues with internet connectivity (and that works fine across all VLANs too). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are my troubleshooting steps taken thusfar: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: Verify configuration integrity&#xA;    Notice that &quot;ip routing&quot; is on both edge switches - issue &quot;no ip routing&quot; command&#xA;    Ensure that &quot;ip default gateway 192.168.48.254&quot; is set - OK&#xA;        When setting IP default gateway, automatically switch creates an entry with &quot;ip route 0.0.0.0 0.0.0.0 192.168.48.254&quot; &#xA;    Verify trunk tagging for Edge - Core - Edge:&#xA;        Appears OK - 48 native, 47,49,50 tagged&#xA;    Verify Aerohive trunk encapsulation&#xA;        Untagged 47, Tagged 48, 49, 50&#xA;&#xA;2: Verify Layer 2 connectivity path&#xA;    Examine Spanning-Tree&#xA;        CSW01 reports it is NOT the root bridge&#xA;            Root bridge is ESW01 &#xA;        Changing CSW01 bridge priority to 8192 - &quot;spanning-tree priority 8192&quot;&#xA;            Root bridge is now CSW01 &#xA;    Checking MAC address table&#xA;        Printer on VLAN 48 on ESW01 has MAC w/last 4 D53C &#xA;            CSW01: D53C appears on Gi1/0/22 (correct trunk link to ESW01) on VLAN 48&#xA;        My laptop on VLAN 49 on Aerohive (connected to CSW01) w/last 4 MAC A560&#xA;            ESW01: &quot;show mac address-table | inc A560&quot; - shows on Gi1/0/24 leading to Core on VLAN 49 - correct trunk link&#xA;&#xA;3: Verify Layer 3 connectivity path&#xA;    Ping 192.168.48.225 (Printer, D53C) &#xA;        FAILS from laptop on wireless VLAN 49 connected to CSW01&#xA;        FAILS from Aerohive on VLAN 47 connected to ESW01 &#xA;        WORKS from CSW01 command line&#xA;        WORKS from ESW01 command line&#xA;        WORKS from ESW02 command line &#xA;        FAILS from laptop on wired VLAN 49 connected to CSW01 &#xA;        FAILS from laptop on wired VLAN 49 connected to ESW01&#xA;&#xA;    Ping 192.168.48.1 (Sonicwall)&#xA;        WORKS from Aerohive connected to ESW01&#xA;        WORKS from Core Switch&#xA;        WORKS from Laptop on VLAN 49 connected to Core Switch&#xA;        WORKS from ESW01 command line&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Below are the configs (some output suppressed for redundancy / brevity) with relevant portins: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CORE SWITCH: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    AS-CSW01#show run&#xA;&#xA;!Current Configuration:&#xA;!System Description &quot;Dell Networking N2024P, 6.0.1.3, Linux 3.6.5-320b2282&quot;&#xA;!System Software Version 6.0.1.3&#xA;!&#xA;configure&#xA;vlan 47&#xA;name &quot;Aerohive Management&quot;&#xA;vlan association subnet 192.168.47.0 255.255.255.0&#xA;exit&#xA;vlan 48&#xA;name &quot;Client Company Wired Production&quot;&#xA;vlan association subnet 192.168.48.0 255.255.255.0&#xA;exit&#xA;vlan 49&#xA;name &quot;Client Company Wireless Production&quot;&#xA;vlan association subnet 192.168.49.0 255.255.255.0&#xA;exit&#xA;vlan 50&#xA;name &quot;Client Company Wireless Guest&quot;&#xA;vlan association subnet 192.168.50.0 255.255.255.0&#xA;exit&#xA;vlan 47-50&#xA;exit              &#xA;hostname &quot;AS-CSW01&quot;&#xA;slot 1/0 8    ! Dell Networking N2024P&#xA;slot 2/0 5    ! Dell Networking N2048&#xA;stack&#xA;member 1 7    ! N2024P&#xA;member 2 8    ! N2048&#xA;exit&#xA;ip routing&#xA;ip route 0.0.0.0 0.0.0.0 192.168.48.1&#xA;interface vlan 1&#xA;exit&#xA;interface vlan 47&#xA;ip address 192.168.47.254 255.255.255.0&#xA;ip helper-address 192.168.48.31&#xA;exit&#xA;interface vlan 48&#xA;ip address 192.168.48.254 255.255.255.0&#xA;exit&#xA;interface vlan 49&#xA;ip address 192.168.49.254 255.255.255.0&#xA;ip helper-address 192.168.48.31&#xA;exit&#xA;interface vlan 50 &#xA;ip address 192.168.50.254 255.255.255.0&#xA;ip helper-address 192.168.48.31&#xA;exit&#xA;username ´(output omitted)&#xA;ip ssh server&#xA;!&#xA;interface Gi1/0/1&#xA;description &quot;AS-APFL1-01&quot; (Aerohive AP trunk port)&#xA;switchport mode general&#xA;switchport general pvid 47&#xA;switchport general allowed vlan add 47&#xA;switchport general allowed vlan add 48-50 tagged&#xA;switchport general allowed vlan remove 1&#xA;exit&#xA;!&#xA;(Output omitted for brevity)&#xA;!&#xA;interface Gi1/0/18 (A regular access port)&#xA;switchport mode general&#xA;switchport general pvid 48&#xA;switchport general allowed vlan add 48&#xA;switchport general allowed vlan remove 1&#xA;exit&#xA;!&#xA;!&#xA;interface Gi1/0/21&#xA;description &quot;AS-ESW02&quot;&#xA;switchport mode general&#xA;switchport general pvid 48&#xA;switchport general allowed vlan add 48&#xA;switchport general allowed vlan add 47,49-50 tagged&#xA;switchport general allowed vlan remove 1&#xA;switchport trunk native vlan 48&#xA;exit&#xA;!&#xA;interface Gi1/0/22&#xA;description &quot;AS-ESW01&quot;&#xA;switchport mode general&#xA;switchport general pvid 48&#xA;switchport general allowed vlan add 48&#xA;switchport general allowed vlan add 47,49-50 tagged&#xA;switchport general allowed vlan remove 1&#xA;switchport trunk native vlan 48&#xA;exit&#xA;!&#xA;interface Gi1/0/23&#xA;description &quot;SonicWall X0&quot;&#xA;switchport mode general&#xA;switchport general pvid 48&#xA;switchport general allowed vlan add 48&#xA;switchport general allowed vlan add 47,49-50 tagged&#xA;switchport general allowed vlan remove 1&#xA;exit&#xA;!&#xA;interface Gi1/0/24&#xA;description &quot;Uplink to NetGear&quot;&#xA;switchport mode general&#xA;switchport general pvid 48&#xA;switchport general allowed vlan add 48&#xA;switchport general allowed vlan add 47,49-50 tagged&#xA;switchport general allowed vlan remove 1&#xA;exit&#xA;!&#xA;exit&#xA;snmp-server engineid local 800002a203f8b1564d9fb4&#xA;snmp-server community &quot;public&quot; ro&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Access Switch 01:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AS-ESW01#show run&#xA;&#xA;!Current Configuration:&#xA;!System Description &quot;Dell Networking N2024P, 6.0.1.3, Linux 3.6.5-320b2282&quot;&#xA;!System Software Version 6.0.1.3&#xA;!&#xA;configure&#xA;vlan 47&#xA;name &quot;Aerohive Management&quot;&#xA;vlan association subnet 192.168.47.0 255.255.255.0&#xA;exit&#xA;vlan 48&#xA;name &quot;Client Company Wired Production&quot;&#xA;vlan association subnet 192.168.48.0 255.255.255.0&#xA;exit&#xA;vlan 49&#xA;name &quot;Client Company Wireless Production&quot;&#xA;vlan association subnet 192.168.49.0 255.255.255.0&#xA;exit&#xA;vlan 50&#xA;name &quot;Client Company Wireless Guest&quot;&#xA;vlan association subnet 192.168.50.0 255.255.255.0&#xA;exit&#xA;vlan 47-50&#xA;exit              &#xA;hostname &quot;AS-ESW01&quot;&#xA;slot 1/0 8    ! Dell Networking N2024P&#xA;slot 2/0 5    ! Dell Networking N2048&#xA;stack&#xA;member 1 7    ! N2024P&#xA;member 2 8    ! N2048&#xA;exit&#xA;ip default-gateway 192.168.48.254&#xA;ip route 0.0.0.0 0.0.0.0 192.168.48.254 253&#xA;interface vlan 1&#xA;exit&#xA;interface vlan 47&#xA;ip address 192.168.47.253 255.255.255.0&#xA;exit&#xA;interface vlan 48&#xA;ip address 192.168.48.253 255.255.255.0&#xA;exit&#xA;interface vlan 49&#xA;ip address 192.168.49.253 255.255.255.0&#xA;exit&#xA;interface vlan 50&#xA;ip address 192.168.50.253 255.255.255.0&#xA;exit&#xA;username (output omitted)&#xA;ip ssh server&#xA;!&#xA;interface Gi1/0/1&#xA;description &quot;AS-APFL3-01&quot;&#xA;switchport mode general&#xA;switchport general pvid 47&#xA;switchport general allowed vlan add 47&#xA;switchport general allowed vlan add 48-50 tagged&#xA;switchport general allowed vlan remove 1&#xA;exit&#xA;!&#xA;(Output omitted for brevity)&#xA;!&#xA;interface Gi1/0/24&#xA;description &quot;Trunk to Suite 128 (AS-CSW01)&quot;&#xA;switchport mode general&#xA;switchport general pvid 48&#xA;switchport general allowed vlan add 48&#xA;switchport general allowed vlan add 47,49-50 tagged&#xA;switchport general allowed vlan remove 1&#xA;switchport trunk native vlan 48&#xA;exit              &#xA;!&#xA;exit&#xA;snmp-server engineid local 800002a203f8b1564da008&#xA;snmp-server community &quot;public&quot; ro&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I attempted to replicate this problem in my home lab (albeit on Cisco equipment) and was unable to: inter-VLAN routing worked fine on that setup. At this point, I'm kinda stumped. Dell tech support wanted us to create a separate VLAN for each switch, and static-route between them. No thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All thoughts / input appreciated!&lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2014-10-10T02:11:29.143" Title="Dell N2000 - Inter-VLAN routing problem" Tags="|vlan|dell|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11386" PostTypeId="2" ParentId="11384" CreationDate="2014-10-10T02:02:46.050" Score="2" Body="&lt;p&gt;&lt;strong&gt;Solution:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The commands on VLANs on the access switches for VLAN association with subnet are the root cause of the issue. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan associate subnet 192.168.48.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This command tells the switch to associate traffic with the appropriate VLAN by source-IP address in packet headers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What was happening is that the return traffic from a client would be dumped into the wrong VLAN on the access switch - the VLAN associated with its source IP, different than that of the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Removal of these commands on the access switches resulted in immediate desired connectivity across all VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDITED to add: Credit for this fix goes to a fellow networking professional who pointed out their function and voiced his concern.&lt;/p&gt;&#xA;" OwnerUserId="2912" LastEditorUserId="2912" LastEditDate="2014-10-10T02:11:29.143" LastActivityDate="2014-10-10T02:11:29.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11390" PostTypeId="1" CreationDate="2014-10-10T06:35:49.117" Score="3" ViewCount="796" Body="&lt;p&gt;If packets with ip source and/or ip destination 127.0.0.0/8 leaves the node, what can possibly happen? Can this be used as an attack vector against control plane (assuming L2 connectivity)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenarios:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;destination is a control plane service on a loopback address (possibly bypassing ACLs depending on the architecture?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;responses to a local service (reflection because of a 127.0.0.0/8 source IP)&#xA;etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34" LastEditorUserId="3191" LastEditDate="2014-10-10T07:13:58.000" LastActivityDate="2014-11-09T11:26:51.823" Title="Spoofed 127.0.0.0/8 possible?" Tags="|ipv4|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11391" PostTypeId="1" CreationDate="2014-10-10T07:50:09.077" Score="0" ViewCount="1171" Body="&lt;p&gt;I have a NetModule NB1600 acting as a router and a OpenVPN client. I have two networks (192.168.100.x and 172.16.2.x) on this router plus additionally the OpenVPN network (10.10.10.x) routes traffic to the 172.16.2.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to accomplish is that the 172.16.2.x has access to the public networks such as 8.8.8.8 How can I create this on the NB1600?&lt;/p&gt;&#xA;" OwnerUserId="6161" LastActivityDate="2014-12-09T23:04:00.443" Title="How do I manually route traffic from one network to another on the same routerr?" Tags="|routing|vpn|" AnswerCount="1" CommentCount="2" ClosedDate="2019-06-01T00:18:26.247" ContentLicense="CC BY-SA 3.0" />
  <row Id="11393" PostTypeId="2" ParentId="11390" CreationDate="2014-10-10T10:33:39.123" Score="3" Body="&lt;p&gt;Two cases here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;127.0.0.0/8 as a source address, real IP as destinantion:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;might reach the target (if reverse path filtering is disabled on routers), but replies will &quot;go out&quot; the loopback interface (actually stay inside)&lt;/li&gt;&#xA;&lt;li&gt;since no replies, only unidirectional attacks possible - protocols such as TCP wont work, because handshake is needed&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;127.0.0.0/8 as a destination address (manually crafted packet, with the targets MAC address in the header) &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;might be accepted by the target if forwarding is enabled&lt;/li&gt;&#xA;&lt;li&gt;wont traverse any routers, since routers forward 127.0.0.0/8 packets to their internal loopbacks&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Either way, in most cases, these (and simmilar) packets are filtered on firewalls:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Bogon_filtering&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Bogon_filtering&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Martian_packet&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Martian_packet&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Reverse_path_forwarding#Unicast_RPF_.28uRPF.29&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Reverse_path_forwarding#Unicast_RPF_.28uRPF.29&lt;/a&gt; (&quot;&lt;em&gt;packets with source addresses that could not be reached via the input interface can be dropped without disruption to normal use, as they are probably from a misconfigured or malicious source&lt;/em&gt;.&quot;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1220" LastActivityDate="2014-10-10T10:33:39.123" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11394" PostTypeId="1" AcceptedAnswerId="12420" CreationDate="2014-10-10T11:46:07.117" Score="0" ViewCount="1957" Body="&lt;p&gt;I know how the trunk and access ports vlans are behave.&#xA;I found something in huawei switches that is called hybrid vlan. what is hybrid vlan and how its behave? &lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="4289" LastEditDate="2014-10-10T17:59:37.397" LastActivityDate="2014-10-12T00:21:02.680" Title="HYBRID VLAN in Huawei Switches" Tags="|vlan|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11395" PostTypeId="1" CreationDate="2014-10-10T13:02:25.077" Score="0" ViewCount="1659" Body="&lt;p&gt;I've got 2 IP over ADSL boxes (Orange &amp;amp; OVH) and 1 TP-LINK router to manage the possible failover of one link.&#xA;When the Ethernet link between the primary box falls or when the bow itself is down, the router manages correctly the backup to the other wan link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://lh5.googleusercontent.com/-OFX0P5NC6U8/VDuUOWzg8eI/AAAAAAAAAGA/vs0lVgK09Y4/s972/LAN%2520Backup.jpg&quot; alt=&quot;LAN backup illustration&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, when the WAN link of the primary box is down, the router doesn't see the error and still try to send on the primary WAN line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://lh4.googleusercontent.com/-KV9Y2PPAoNQ/VDuUOkZmRuI/AAAAAAAAAGE/JyThHX7pErY/s972/WAN%2520Backup.jpg&quot; alt=&quot;WAN backup illustration&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I solve this issue ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;... I've updated the links. Images can be viewed now, I hope...&lt;/p&gt;&#xA;" OwnerUserId="8842" LastEditorUserId="8842" LastEditDate="2014-10-13T09:03:57.927" LastActivityDate="2015-09-25T07:29:30.117" Title="How to configure WAN backup with 2 ADSL boxes and 1 router?" Tags="|router|failover|adsl|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="11399" PostTypeId="1" CreationDate="2014-10-10T21:34:11.407" Score="1" ViewCount="231" Body="&lt;p&gt;From RFC and tutorials in the internet I understand that the MPLS cloud acts as a switch and switches traffic between end points in a VPLS. And that VPLS ID along with RD is used to reach the VPLs site across mpls cloud. But I 'm trying to understand how the destination ip address is mapped. Any reference? Any one has sample vpls packet captures ? &#xA;In show vpls table cli commands of vendors like cisco and Juniper the VPLS ID is mapped with a destination ip addresses. How is this mapping formed ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastEditorUserId="8499" LastEditDate="2018-12-26T05:34:29.877" LastActivityDate="2019-01-14T20:49:56.173" Title="BGP VPLS - How the destination ip address is mapped?" Tags="|bgp|protocol-theory|rfc|vpls|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="11400" PostTypeId="2" ParentId="11391" CreationDate="2014-10-10T21:42:52.203" Score="1" Body="&lt;p&gt;At bare minimum you would need to setup a NAT from your 172.16.x network outbound toward the internet.  There are a few ways to accomplish a route, but the easiest way would be to set a default route in the system's route table that points toward your internet default gateway.  &lt;/p&gt;&#xA;" OwnerUserId="2822" LastActivityDate="2014-10-10T21:42:52.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="11401" PostTypeId="1" CreationDate="2014-10-10T21:49:02.090" Score="15" ViewCount="47017" Body="&lt;p&gt;I am needing to access a local LEMP server through its domain name for a PHP package that uses domain names in every link, making IP address usage not possible for this application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can access the domain just fine from devices elsewhere on the www.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pfSense manages two physically separate networks, but accessing the server with the domain brings up the &quot;Potential DNS Rebind attack detected&quot; warning page when accessed from either network, however, using the IP address brings up the server's pages just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server has a static mapping configured with the domain name set in the configuration in Services DHCP Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the DNS Forwarder enabled and the Register DHCP static mappings in DNS forwarder is checked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am running pfSense 2.1.5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What else do I need to do?&lt;/p&gt;&#xA;" OwnerUserId="2658" LastActivityDate="2023-04-14T17:15:06.610" Title="Configure pfSense to not give 'potential DNS rebind attack detected' warning for local server" Tags="|pfsense|pfsense-2|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11404" PostTypeId="1" CreationDate="2014-10-11T00:23:39.453" Score="0" ViewCount="2445" Body="&lt;p&gt;I'm a ICT engineering student studying networking. I was wondering if someone could tell me what type of a cable Cat7 is ?&lt;/p&gt;&#xA;" OwnerUserId="8847" LastEditorUserId="8499" LastEditDate="2018-03-20T23:33:13.640" LastActivityDate="2018-03-20T23:33:13.640" Title="What type of cable is a cat 7 : UTP or STP ?" Tags="|layer1|cable|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11405" PostTypeId="2" ParentId="11404" CreationDate="2014-10-11T00:47:46.070" Score="3" Body="&lt;p&gt;Cat 7 is neither UTP or STP.  It is typically either F/FTP or S/FTP.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-10-11T00:47:46.070" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11407" PostTypeId="1" CreationDate="2014-10-11T01:54:43.100" Score="6" ViewCount="846" Body="&lt;p&gt;NAT works by maintaining a mapping table between &lt;code&gt;(internal IP, internal port)&lt;/code&gt; and &lt;code&gt;(external IP, external port)&lt;/code&gt;. But both UDP and TCP has 16-bit port numbers, which means that the table can have at most 65536*2 entries (suppose there is only one public IP assigned to this private network). Since that each computer makes a lot of connections, a not-very-large private network will soon fill this table, right? How to handle the lack of ports on the external IP then?&lt;/p&gt;&#xA;" OwnerUserId="8388" LastActivityDate="2014-10-11T10:13:53.327" Title="How does NAT work for large private networks?" Tags="|nat|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="11408" PostTypeId="2" ParentId="11407" CreationDate="2014-10-11T07:44:39.793" Score="2" Body="&lt;p&gt;They don't NAT, use multiple WAN IP's for NAT, or use proxies, WAN accelerators or more levels of NAT to reduce the number of outbound connections.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-10-11T07:44:39.793" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="11409" PostTypeId="2" ParentId="11407" CreationDate="2014-10-11T10:13:53.327" Score="6" Body="&lt;p&gt;As a rule of thumb, I size my firewalls for 250 tcp sessions per user. That's on the high side right now, but as people start to use more and more cloud services (dropbox, Office365, etc, etc) the number of sessions per user is only going up in the near future, so I prefer to be on the safe side. This means a single public IP is enough to NAT for only 250 users. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have more users, you would need to use more public IP addresses for NAT. This is called a NAT Pool. Your firewall will use IPs from the pool to assign IP/port combinations as needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cisco IOS, you configure a NAT pool thus:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat pool &amp;lt;name&amp;gt; &amp;lt;start-ip&amp;gt; &amp;lt;end-ip&amp;gt; &#xA; {netmask &amp;lt;netmask&amp;gt; | prefix-length &amp;lt;prefix-length&amp;gt;}&#xA; [type {rotary}]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to know everything about NAT, check out the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/12-4t/nat-12-4t-book/iadnat-addr-consv.html&quot;&gt;Cisco documentation&lt;/a&gt;. It's an excellent read.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2014-10-11T10:13:53.327" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="11412" PostTypeId="1" AcceptedAnswerId="12416" CreationDate="2014-10-11T18:01:57.720" Score="3" ViewCount="1633" Body="&lt;p&gt;I'm learning TCP networking by analysing the uploading of a large file to a web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the syn, syn/ack, ack, the server and the client agree on &lt;code&gt;Maximum Segment Size = 1460&lt;/code&gt;. This is consistent with what I read on the net.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But from my Wireshark capture I can see that each TCP segment actually contains 2776 bytes of data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly these are two different things and I've misunderstood something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How/When/Where does the length of data of TCP segments get decided?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="8852" LastEditorUserId="8852" LastEditDate="2014-10-11T18:10:43.320" LastActivityDate="2014-10-11T23:37:11.587" Title="Max. Segment Size vs TCP Segment Size" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12412" PostTypeId="1" AcceptedAnswerId="12422" CreationDate="2014-10-11T20:04:56.483" Score="3" ViewCount="380" Body="&lt;p&gt;JunOS newbie question here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Juniper SRX router that I am trying to set up in a very basic mode:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ge-0/0/0 is set to 192.168.140.100  -- I can ping that address from hostA at .140.200 attached to the router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ge-4/0/0 is set to 192.168.144.104  -- I can also ping that address from  hostB at .144.200 also attached to router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From JunOS, I can also ping/ssh to hostA and hostB&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BUT, I can't access hostA from hostB (these are Centos based. I have created ip routes on them so they know how to acccess each other).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to create static routes on the router? I have tried that and that doesnt seem to work. Here are my router routes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;admin@JUN01&gt; show route terse &lt;/p&gt;&#xA;&#xA;&lt;p&gt;inet.0: 8 destinations, 16 routes (8 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Destination        P Prf   Metric 1   Metric 2  Next hop         AS path&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.140.100/32 D   0                       &gt;ge-0/0/0.0&lt;br&gt;&#xA;                 L   0                        Local&lt;/li&gt;&#xA;&lt;li&gt;192.168.141.101/32 D   0                       &gt;ge-0/0/1.0&lt;br&gt;&#xA;                 L   0                        Local&lt;/li&gt;&#xA;&lt;li&gt;192.168.142.102/32 D   0                       &gt;ge-0/0/2.0&lt;br&gt;&#xA;                 L   0                        Local&lt;/li&gt;&#xA;&lt;li&gt;192.168.143.103/32 D   0                       &gt;ge-0/0/3.0&lt;br&gt;&#xA;                 L   0                        Local&lt;/li&gt;&#xA;&lt;li&gt;192.168.144.104/32 D   0                       &gt;ge-0/0/4.0&lt;br&gt;&#xA;                 L   0                        Local&lt;/li&gt;&#xA;&lt;li&gt;192.168.145.105/32 D   0                       &gt;ge-0/0/5.0&lt;br&gt;&#xA;                 L   0                        Local&lt;/li&gt;&#xA;&lt;li&gt;192.168.146.106/32 D   0                       &gt;ge-0/0/6.0&lt;br&gt;&#xA;                 L   0                        Local&lt;/li&gt;&#xA;&lt;li&gt;192.168.147.107/32 D   0                       &gt;ge-0/0/7.0&lt;br&gt;&#xA;                 L   0                        Local&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot&#xA;-jfs&lt;/p&gt;&#xA;" OwnerUserId="9853" LastActivityDate="2014-10-12T08:18:08.543" Title="Basic Junos question on routing" Tags="|router|juniper|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12416" PostTypeId="2" ParentId="11412" CreationDate="2014-10-11T23:37:11.587" Score="5" Body="&lt;p&gt;If you are referring to the Wireshark &quot;data length&quot; column, that is a SUM of all IP fragments of one TCP segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why this is done is that your OS is actually sending big TCP segments to the network card and the network card does the fragmentation to the (smaller) MTU, that's why you see that you're sending 2776 bytes long frames (the same can happen on the receiving side I think). If you'd sniff directly on the wire (a switch for example) you would see only 1518/1522 bytes frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is called Large Segment Offload and is a function of a network card. It can be turned off and then the OS will have to send frames to the network card which are under the MTU limit.&lt;/p&gt;&#xA;" OwnerUserId="75" LastActivityDate="2014-10-11T23:37:11.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12420" PostTypeId="2" ParentId="11394" CreationDate="2014-10-12T00:21:02.680" Score="3" Body="&lt;p&gt;it's not a hybrid vlan, it's a hybrid port. You have access port = one untagged vlan, you have trunk port = multiple tagged and at most one untagged vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then you have hybrid - multiple untagged vlan. But then you need to somehow know where to put each incoming frame - that is done on per-frame basis based on MAC address/IP address/protocol/ports/etc. Outgoing frame is always sent untagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keywords for you: IP based VLANs, protocol based VLANs, MAC based VLANs&lt;/p&gt;&#xA;" OwnerUserId="75" LastActivityDate="2014-10-12T00:21:02.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12422" PostTypeId="2" ParentId="12412" CreationDate="2014-10-12T08:05:30.927" Score="3" Body="&lt;p&gt;Juniper SRX by default works in a flow mode (it acts like a firewall), so probably you will need to create appropriate security zones, assign interfaces and define policies in order for the traffic to pass through device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also switch the SRX into packet mode, which will make its behavior more like a router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check operational mode using the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mk@SRX210&amp;gt; show security flow status &#xA;Flow forwarding mode:&#xA;Inet forwarding mode: flow based&#xA;Inet6 forwarding mode: drop&#xA;MPLS forwarding mode: drop&#xA;ISO forwarding mode: drop&#xA;Advanced services data-plane memory mode: Default&#xA;Flow trace status&#xA;Flow tracing status: off&#xA;Flow session distribution&#xA;Distribution mode: RR-based&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you can switch into packet mode by issuing following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mk@SRX210# delete security &#xA;mk@SRX210# set security forwarding-options family mpls mode packet-based &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="970" LastEditorUserId="970" LastEditDate="2014-10-12T08:18:08.543" LastActivityDate="2014-10-12T08:18:08.543" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12426" PostTypeId="1" AcceptedAnswerId="12427" CreationDate="2014-10-12T14:47:27.203" Score="0" ViewCount="54" Body="&lt;p&gt;&lt;strong&gt;NOTE&lt;/strong&gt;: &lt;em&gt;The following question can be hypothetical as I don't know whether it really happens or not.I am asking it just out of curiosity&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I am sending data in a network.The data is in form of &lt;code&gt;bit stream&lt;/code&gt; like&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1 0 1 1 0 0 1 0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and there is another data which is in the form&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0 1 0 1 1 0 1 0 &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and somehow both of the data intermixes and the final data is still like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1 0 1 1 0 0 1 0&#xA;    ^ ^ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is still same as originally transmitted data but the arrowed bits are from 2nd data (due to intermixing)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have two questions in my mind&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1)When the receiver receives this data, will it be treated same as that of original data or it will be changed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2)Does it happen in real life in networking?&lt;/p&gt;&#xA;" OwnerUserId="7805" LastEditorUserId="775" LastEditDate="2014-12-08T12:19:52.357" LastActivityDate="2014-12-08T12:19:52.357" Title="What happens if data intermixes" Tags="|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12427" PostTypeId="2" ParentId="12426" CreationDate="2014-10-12T15:35:59.850" Score="3" Body="&lt;p&gt;Of course data can intermix in the transmission, if the medium is suspectible to that, but there is a ton of protocols and standards with regards to how to protect the data stream from being damaged/modified - at very basic levels, and at more sophisticated levels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If at bit level the stream is exactly the same even if there was a problem in the transmission path, most of the bit-correction mechanisms won't even notice it. Some more sophisticated mechanisms/protocols will detect transmission/receive problem and try to do some additional evasion - like for example, changing the transmission channel or retransmit just to make sure it's good.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-10-12T15:35:59.850" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12435" PostTypeId="2" ParentId="5476" CreationDate="2014-10-12T23:12:11.637" Score="2" Body="&lt;p&gt;I have a DGS-3224TGR switch that I bought second hand and had the same issue.  I found in another forum how to correctly do the factory reset, and it worked for me.  Here is what I found:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;connect your switch to your computer and set it up for the basic 9600 for the CLI&lt;/p&gt;&#xA;&#xA;&lt;p&gt;once you see the switch starting to boot displaying the ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please wait, loading runtime image..................... 00%&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hit SHIFT + 3 ( not NUM 3)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will then ask to reset to factory settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE if you hit Shift + 3 during the post it will only give you a shorter menu to flash new images onto it&lt;/p&gt;&#xA;" OwnerUserId="9864" LastActivityDate="2014-10-12T23:12:11.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12436" PostTypeId="1" CreationDate="2014-10-13T00:13:40.970" Score="1" ViewCount="273" Body="&lt;p&gt;What happens if traffic is sent to a multicast group from a host which is not a member of that multicast group ? Does the router keep any information for a valid Multicast source and discard this traffic ? I could not get a clear picture of (*, G) vs (S, G) entry. Will the packet be forwarded since there is a (*, G) entry ?&lt;/p&gt;&#xA;" OwnerUserId="8597" LastEditorUserId="8597" LastEditDate="2014-10-13T01:21:21.583" LastActivityDate="2014-10-13T14:26:31.600" Title="Should the Multicast source in an ASM network be a member of the Multicast group?" Tags="|ipv4|multicast|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12437" PostTypeId="1" CreationDate="2014-10-13T02:38:40.090" Score="1" ViewCount="292" Body="&lt;p&gt;Can someone please explain to me Why I do have 9 LSA type 3 on Router B and D in this topology ?&#xA;&lt;img src=&quot;https://i.stack.imgur.com/u4UOP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="9865" LastActivityDate="2014-10-13T03:12:40.980" Title="LSA Type in OSPF" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12438" PostTypeId="2" ParentId="12437" CreationDate="2014-10-13T03:12:40.980" Score="3" Body="&lt;p&gt;Both router B and D are your ABRs (area border routers), which hold summaries for the areas they border, in your case they hold summaries for areas 1 and 0, and 0 and 2 respectively.  Type 3 LSA's are summary LSA's, which if you look at both routers A and E, they already have part of the answer for you; they both have &quot;5&quot; LSA type 3 summaries. Then if you look at router C in area 0, it has a total of &quot;4&quot; type 3 LSA's. Add these summaries up, &quot;5&quot; + &quot;4&quot;, on each ABR, you have your &quot;9&quot; type 3 LSAs.&lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-10-13T03:12:40.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12439" PostTypeId="2" ParentId="12436" CreationDate="2014-10-13T04:21:39.180" Score="2" Body="&lt;p&gt;Multicast senders are not generally part of the multicast group they are sending to, since they already have the information they are sending to the group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your multicast configuration the router could take the new multicast packet and forward to a known rendezvous point and the RP will forward towards interested receivers. This would create an (S,G) entry, if you want to control who is sending to your multicast groups you need to &lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/multicast_toolkit.html#27&quot; rel=&quot;nofollow&quot;&gt;limit&lt;/a&gt; the sender source address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other configurations could have different forwarding decisions.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-10-13T04:21:39.180" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12440" PostTypeId="2" ParentId="11395" CreationDate="2014-10-13T05:02:40.433" Score="0" Body="&lt;p&gt;In general you need to use some type of probe/monitoring to detect the failure of any path past the physical layer of the device you are configuring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also - &lt;a href=&quot;http://www.tp-link.com/en/article/?faqid=529&quot; rel=&quot;nofollow&quot;&gt;http://www.tp-link.com/en/article/?faqid=529&lt;/a&gt; - see note #2.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-10-13T05:02:40.433" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12442" PostTypeId="2" ParentId="11395" CreationDate="2014-10-13T10:33:51.333" Score="2" Body="&lt;p&gt;Currently, your router monitors WAN connections only on layer 1, i.e. if a link is up or down. In order to react to a broken WAN connection, your router should monitor on a higher layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 3 approaches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;a)&lt;/strong&gt; You use a router with two interface directly conntected to the splitter or telephone jack. Your router could still be monitoring a WAN link on layer 1. But your router would dial up via PPPoA. You could monitor both the line and the registration of your router by each ISP's RADIUS or TACACS server. Either your DSL line is run by a protocol such as ADSL2+ and authentication is done by user/password or by a protocol such as VDSL2 and authentication is done by modem MAC address. In case of user/password all you need are login credentials. In case of MAC address you have to personally negiotiate the registration of your router with both ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;b)&lt;/strong&gt; Your router dials up via PPPoE without the need of using new WAN interfaces. This would allow you to monitor each WAN connection on layer 2 which is sufficient enough. Your router would become the gateway and you could reduce the modems to managing DSL lines. This requires both modems to run a firmware supporting dialup by another device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;c)&lt;/strong&gt; Your router monitors by probing a host on the WAN. Usually, there is at least one core router. which replies to ICMP Echo. Try &lt;code&gt;traceroute -I 8.8.8.8&lt;/code&gt; with both connections. It changes the &lt;code&gt;Type of Service&lt;/code&gt; field to request Echo-Reply messages from each hop during the trace. You should at least find one core router for each ISP which you can probe on a regular basis. Then, you have to reduce the TTL of that ping to prevent reaching that destination on detours when the monitored WAN link fails.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2014-10-13T10:33:51.333" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12443" PostTypeId="2" ParentId="12436" CreationDate="2014-10-13T14:26:31.600" Score="1" Body="&lt;p&gt;Multicast sources register with the RP (rendezvous point) through their local first-hop routers (DR - designated router) and the receivers &quot;join&quot; the shared tree rooted to the RP via their own local first hop DR. Now (in sparse mode) the receivers join the shared tree (&amp;#42;,G) via IGMP messages indicating they wish to receive the multicast, and then the (S,G) (shortest path) state is built from RP towards source's DR. Once this connection is realized, the multicast traffic is sent down the shared tree. However, once the receiver's DR sees the multicast's source IP in the first few packets down the shared tree (&amp;#42;,G) , it switches over to use the shortest path (S,G) and the shortest path tree means it uses the unicast routing shortest path back to the source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer the first part of your question &quot;What happens if traffic is sent to a multicast group from a host which is not a member of that multicast group ?&quot;  If you do not have any security built into your multicast configurations, traffic can be delivered to a multicast group from a rouge source. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second part of your question &quot;Does the router keep any information for a valid Multicast source and discard this traffic ?&quot; Again, if you had no security, yes the DR routers accepts this as a valid source and retains it's (S,G) state, which will also send a PIM source message to the RP, which maps it to the source. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the third part of your question &quot;I could not get a clear picture of (&amp;#42;, G) vs (S, G) entry. Will the packet be forwarded since there is a (&amp;#42;, G) entry ?&quot; Again, if you had no security, the rogue multicast source can and would send traffic to all requesting receivers. The rogue builds a valid, but unauthorized shared tree (&amp;#42;,G) to the receivers and once the receiver's DR receives the first few multicast packets from the unauthorized source, the DR will switch to the unicast routing distribution scheme, meaning it will use the shortest path to the source (S,G).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in your case, for &quot;rogue source security&quot;, which is a very common best practice, you can use the &quot;pim accept-register&quot; on the RP and all DR's and then this is tied to an ACL permitting all valid multicast sources. &#xA;&quot;ip pim accept register list valid_sources&quot;&#xA;&quot;ip access-list extended valid_sources&quot;&#xA;&quot;permit ip 171.71.68.20 0.0.0.15 239.x.0.0 0.0.255.255&lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-10-13T14:26:31.600" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12449" PostTypeId="1" CreationDate="2014-10-14T03:56:00.250" Score="2" ViewCount="2357" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/998Fr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have VLAN 3 with the IP address of 172.16.0.1 on R0 and on R2, and I can't get them to ping one another. How do I need to advertise them if they are both on the same network? Any help would be much appreciated&lt;/p&gt;&#xA;" OwnerUserId="9880" LastEditorUserId="8499" LastEditDate="2016-03-12T19:04:01.733" LastActivityDate="2016-03-12T19:04:01.733" Title="How do I configure two routers to advertise the same network out different ports using EIGRP?" Tags="|cisco|routing|switch|eigrp|" AnswerCount="3" CommentCount="2" ClosedDate="2019-03-21T01:24:57.160" ContentLicense="CC BY-SA 3.0" />
  <row Id="12451" PostTypeId="1" CreationDate="2014-10-14T08:00:21.613" Score="2" ViewCount="3909" Body="&lt;p&gt;As the question , I don't really understand what is a wireless channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Supposed we have an access point with the standard 802.11b, it will use the frequency 2.4 GHz --&gt;Is this the bandwith? And the transfer rate of this standard is 11 Mbps. What is the relationship between them? and why do we have to divide the bandwith into different channels?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone give me a briefly bottom-up concept about these concepts?&#xA;Thanks in advanced.&lt;/p&gt;&#xA;" OwnerUserId="9884" LastActivityDate="2014-10-26T19:38:08.503" Title="What is wireless channel?" Tags="|wireless|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12453" PostTypeId="1" CreationDate="2014-10-14T08:49:07.793" Score="1" ViewCount="130" Body="&lt;p&gt;Is there any way to overcome the 2 monitor session limitation by upgrading the Sup engine card for 6500 Cisco Switch?&lt;/p&gt;&#xA;" OwnerUserId="9885" LastEditorUserId="775" LastEditDate="2014-10-14T08:57:44.423" LastActivityDate="2014-10-16T16:52:24.780" Title="overcome limitation on cisco 6500 monitor session" Tags="|cisco|switch|mirror|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12454" PostTypeId="1" AcceptedAnswerId="12492" CreationDate="2014-10-14T09:37:21.847" Score="1" ViewCount="2416" Body="&lt;p&gt;Can somebody explain to me how to do the UDP checksum of two 16 bit integers. While using the wraparound, sum and checksum? here an example...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;add these two 16 bit integers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1110011001100110&#xA;1101010101010101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How would I go about doing this?&lt;/p&gt;&#xA;" OwnerUserId="8674" LastEditorUserId="775" LastEditDate="2014-10-15T22:30:51.363" LastActivityDate="2014-10-15T22:30:51.363" Title="UDP checksum - explaining the method of adding two 16 bit integers?" Tags="|protocol-theory|udp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12455" PostTypeId="1" CreationDate="2014-10-14T11:11:21.550" Score="1" ViewCount="7544" Body="&lt;p&gt;&lt;strong&gt;MY QUESTION IS:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it possible to use static DHCP leases for same IP addres and two MAC addresses - LAN and WAN - that the host would be able to receive all the time the same IP address (192.168.1.100) regardless of LAN or WAN connection ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/DMA5g.png&quot; alt=&quot;MikroTik - same static DHCP lease with one IP address for LAN and WAN&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have problem with DHCP static leases in MikrtoTik CloudCore 1036. When I use static lease for WAN MAC address everything goes fine and host get IP 192.168.1.100. When I switch from WAN to LAN connection host don't receive IP 192.168.1.100 because there is already static lease for this IP address. I can`t enable second MAC to IP record because there is an information that this address already belongs to the host.&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="8499" LastEditDate="2018-02-14T16:49:39.253" LastActivityDate="2018-02-14T16:49:39.253" Title="MikroTik - same static DHCP lease with one IP address for LAN and WAN" Tags="|ipv4|dhcp|lan|wan|" AnswerCount="4" CommentCount="0" ClosedDate="2017-02-25T05:02:02.030" ContentLicense="CC BY-SA 3.0" />
  <row Id="12456" PostTypeId="1" CreationDate="2014-10-14T11:17:32.803" Score="1" ViewCount="1178" Body="&lt;p&gt;Is it possible to use a G.652.D with a G.655 fiber for just a small distance (less than 10 m) for the interconnect only (from the patch panel to the switch) ? If yes or no, what will happen ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And for long distance, its not possible and it will not work, because of the IOR will be different right ? or because another thing ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best Regards&lt;/p&gt;&#xA;" OwnerUserId="9887" LastEditorUserId="775" LastEditDate="2014-12-08T12:19:05.443" LastActivityDate="2015-06-13T22:09:01.050" Title="Using a G. 655 with a G. 652.D fiber cable?" Tags="|fiber|cabling|optics|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12457" PostTypeId="1" AcceptedAnswerId="12458" CreationDate="2014-10-14T12:04:02.553" Score="2" ViewCount="522" Body="&lt;p&gt;Maybe this question is very easy for some people. I know very basic of networking and I am trying to learn more. I have followed tutorials on Microsoft and I read this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Using a subnet mask of 255.255.255.192, your 192.168.123.0 network&#xA;  then becomes the four networks 192.168.123.0, 192.168.123.64,&#xA;  192.168.123.128 and 192.168.123.192. These four networks would have as valid host addresses:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   192.168.123.1-62&#xA;   192.168.123.65-126&#xA;   192.168.123.129-190&#xA;   192.168.123.193-254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I used online subnet calculator here I got available host adderss range of:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;192.168.123.1 - 192.168.123.62&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I appreciate if anyone can explain how can I access&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   192.168.123.65-126&#xA;   192.168.123.129-190&#xA;   192.168.123.193-254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;by subnet mask of 255.255.255.192, on 192.168.123.0 network or explain if I am doing something wrong. Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9x217.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="9889" LastEditorUserId="8499" LastEditDate="2018-12-22T02:28:10.007" LastActivityDate="2018-12-22T02:28:10.007" Title="How subnetting works on network design?" Tags="|ip|ipv4|subnet|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12458" PostTypeId="2" ParentId="12457" CreationDate="2014-10-14T13:33:20.863" Score="1" Body="&lt;p&gt;As you said, you have four different networks:&lt;br&gt;&#xA;&lt;code&gt;192.168.123.0&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;192.168.123.64&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;192.168.123.128&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;192.168.123.192&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to put each of those as a separate network into your calculator.  Your calculator will only work on one network at a time, and you have four networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you enter 192.168.123.192 as the network with a mask of 255.255.255.192, you should get 192.168.123.193 - 192.168.123.254 as host address range.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2014-10-14T15:48:39.123" LastActivityDate="2014-10-14T15:48:39.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12460" PostTypeId="2" ParentId="12455" CreationDate="2014-10-14T14:06:02.143" Score="0" Body="&lt;p&gt;I just checked here on my RB951 (don't know if you're running routerOS also) and there's no specification of interfaces in IP&gt;DHCP SERVER&gt;LEASES. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I could see causing the problem is if you have separate DHCP address pool for each interface, even if overlapping. I tested changing ports and the host still gets the same reserved address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what I have seen, the only difference from a LAN port and a WAN port in a MikroTik router is the DHCP, in the former it's configured for DHCP server and the latter for DHCP client. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you provide configs?&lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-10-14T14:06:02.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12465" PostTypeId="1" AcceptedAnswerId="12466" CreationDate="2014-10-14T17:10:24.993" Score="8" ViewCount="14854" Body="&lt;p&gt;I've successfully configured a Cisco 3750G to perform the authenticator function of the 802.1x process. I have a test Win7 machine as a supplicant and a Windows 2008 server running NPS as the Authentication Server. The Win7 machine is able to successfully authenticate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've now hooked up a Cisco 7941 IP Phone in front of the Win7 machine, configured the switch with the &lt;strong&gt;swtichport voice vlan&lt;/strong&gt; command, I plug it in and it is granted power, but the port quickly moves to a down state. After looking through the debug logs I believe the issue to be something with 802.1x trying to authentication on both the Access VLAN and the Voice VLAN. Is there a way to only perform 802.1x on the Access VLAN? and not the Voice?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenario:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{RADIUS}  &amp;lt;----&amp;gt;   {3750G} &amp;lt;-----&amp;gt; {Cisco 7941 Phone} &amp;lt;-----&amp;gt;  {Win7 802.1x client}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am currently testing on interface gi1/0/3, here is the interface config line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/3&#xA;  description TestPort&#xA;  switchport access vlan 100&#xA;  switchport voice vlan 110&#xA;  switchport mode access&#xA;  authentication port-control auto&#xA;  authentication periodic&#xA;  authentication timer reauthenticate server&#xA;  dot1x pae authenticator&#xA;  spanning-tree portfast&#xA;  auto qos voip cisco-phone&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some of the debugs from the 3750G&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Apr 21 13:44:04.045: %ILPOWER-7-DETECT: Interface Gi1/0/3: Power Device detected: IEEE PD&#xA;*Apr 21 13:44:04.322: %ILPOWER-5-POWER_GRANTED: Interface Gi1/0/3: Power granted&#xA;*Apr 21 13:44:07.811: dot1x-ev(Gi1/0/3): Interface state changed to UP&#xA;*Apr 21 13:44:07.811:     dot1x_auth Gi1/0/3: initial state auth_initialize has enter&#xA;*Apr 21 13:44:07.811: dot1x-sm(Gi1/0/3): 0x0000003B:auth_initialize_enter called&#xA;*Apr 21 13:44:07.811:     dot1x_auth Gi1/0/3: during state auth_initialize, got event 0(cfg_auto)&#xA;*Apr 21 13:44:07.811: @@@ dot1x_auth Gi1/0/3: auth_initialize -&amp;gt; auth_disconnected&#xA;*Apr 21 13:44:07.811: dot1x-sm(Gi1/0/3): 0x0000003B:auth_disconnected_enter called&#xA;*Apr 21 13:44:07.811:     dot1x_auth Gi1/0/3: idle during state auth_disconnected&#xA;*Apr 21 13:44:07.811: @@@ dot1x_auth Gi1/0/3: auth_disconnected -&amp;gt; auth_restart&#xA;*Apr 21 13:44:07.811: dot1x-sm(Gi1/0/3): 0x0000003B:auth_restart_enter called&#xA;*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Sending create new context event to EAP for 0x0000003B (0000.0000.0000)&#xA;*Apr 21 13:44:07.820:     dot1x_auth_bend Gi1/0/3: initial state auth_bend_initialize has enter&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_bend_initialize_enter called&#xA;*Apr 21 13:44:07.820:     dot1x_auth_bend Gi1/0/3: initial state auth_bend_initialize has idle&#xA;*Apr 21 13:44:07.820:     dot1x_auth_bend Gi1/0/3: during state auth_bend_initialize, got event 16383(idle)&#xA;*Apr 21 13:44:07.820: @@@ dot1x_auth_bend Gi1/0/3: auth_bend_initialize -&amp;gt; auth_bend_idle&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_bend_idle_enter called&#xA;*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Created a client entry (0x0000003B)&#xA;*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Dot1x authentication started for 0x0000003B (0000.0000.0000)&#xA;*Apr 21 13:44:07.820: dot1x-ev:DOT1X Supplicant not enabled on GigabitEthernet1/0/3&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): Posting !EAP_RESTART on Client 0x0000003B&#xA;*Apr 21 13:44:07.820:     dot1x_auth Gi1/0/3: during state auth_restart, got event 6(no_eapRestart)&#xA;*Apr 21 13:44:07.820: @@@ dot1x_auth Gi1/0/3: auth_restart -&amp;gt; auth_connecting&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_connecting_enter called&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_restart_connecting_action called&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): Posting RX_REQ on Client 0x0000003B&#xA;*Apr 21 13:44:07.820:     dot1x_auth Gi1/0/3: during state auth_connecting, got event 10(eapReq_no_reAuthMax)&#xA;*Apr 21 13:44:07.820: @@@ dot1x_auth Gi1/0/3: auth_connecting -&amp;gt; auth_authenticating&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_authenticating_enter called&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_connecting_authenticating_action called&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): Posting AUTH_START for 0x0000003B&#xA;*Apr 21 13:44:07.820:     dot1x_auth_bend Gi1/0/3: during state auth_bend_idle, got event 4(eapReq_authStart)&#xA;*Apr 21 13:44:07.820: @@@ dot1x_auth_bend Gi1/0/3: auth_bend_idle -&amp;gt; auth_bend_request&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_bend_request_enter called&#xA;*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Sending EAPOL packet to group PAE address&#xA;*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Role determination not required&#xA;*Apr 21 13:44:07.820: dot1x-registry:registry:dot1x_ether_macaddr called&#xA;*Apr 21 13:44:07.820: dot1x-ev(Gi1/0/3): Sending out EAPOL packet&#xA;*Apr 21 13:44:07.820: EAPOL pak dump Tx&#xA;*Apr 21 13:44:07.820: EAPOL Version: 0x3  type: 0x0  length: 0x0005&#xA;*Apr 21 13:44:07.820: EAP code: 0x1  id: 0x1  length: 0x0005 type: 0x1&#xA;*Apr 21 13:44:07.820: dot1x-packet(Gi1/0/3): EAPOL packet sent to client 0x0000003B (0000.0000.0000)&#xA;*Apr 21 13:44:07.820: dot1x-sm(Gi1/0/3): 0x0000003B:auth_bend_idle_request_action called&#xA;*Apr 21 13:44:09.791: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/3, changed state to up&#xA;*Apr 21 13:44:10.798: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to up&#xA;*Apr 21 13:44:36.844: dot1x-ev(Gi1/0/3): Interface state changed to DOWN&#xA;*Apr 21 13:44:36.844: dot1x-ev(Gi1/0/3): Deleting client 0x0000003B (0000.0000.0000)&#xA;*Apr 21 13:44:36.844: dot1x-ev:dot1x_supp_port_down: No DOT1X subblock found on GigabitEthernet1/0/3&#xA;*Apr 21 13:44:36.844: dot1x-ev:Delete auth client (0x0000003B) message&#xA;*Apr 21 13:44:36.844: dot1x-ev:Auth client ctx destroyed&#xA;*Apr 21 13:44:37.842: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to down&#xA;*Apr 21 13:44:38.841: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/3, changed state to down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Latest Interface Config:&lt;/strong&gt;&#xA;interface GigabitEthernet1/0/3&#xA; switchport access vlan 105&#xA; switchport mode access&#xA; switchport voice vlan 110&#xA; srr-queue bandwidth share 1 30 35 5&#xA; priority-queue out&#xA; authentication control-direction in&#xA; authentication event fail action next-method&#xA; authentication host-mode multi-auth&#xA; authentication open&#xA; authentication order dot1x mab&#xA; authentication priority mab dot1x&#xA; mab&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos voip cisco-phone&#xA; dot1x pae authenticator&#xA; spanning-tree portfast&#xA; service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Global configs&lt;/strong&gt;&#xA;dad&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debugs:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show version&#xA;Switch Ports Model              SW Version            SW Image&#xA;------ ----- -----              ----------            ----------&#xA;*    1 28    WS-C3750G-24PS     15.0(2)SE6            C3750-IPSERVICESK9-M&#xA;&#xA;#show authentication sessions interface gi1/0/3&#xA;            Interface:  GigabitEthernet1/0/3&#xA;          MAC Address:  Unknown&#xA;           IP Address:  Unknown&#xA;               Status:  Authz Success&#xA;               Domain:  DATA&#xA;      Security Policy:  Should Secure&#xA;      Security Status:  Unsecure&#xA;       Oper host mode:  multi-auth&#xA;     Oper control dir:  in&#xA;        Authorized By:  Authentication Server&#xA;          Vlan Policy:  N/A&#xA;      Session timeout:  N/A&#xA;         Idle timeout:  N/A&#xA;    Common Session ID:  0A6363FE0000001900347F3C&#xA;      Acct Session ID:  0x00000020&#xA;               Handle:  0x7A00001A&#xA;&#xA;Runnable methods list:&#xA;       Method   State&#xA;       dot1x    Authc Success&#xA;       mab      Not run&#xA;&#xA;#show dot1x all details&#xA;Sysauthcontrol              Enabled&#xA;Dot1x Protocol Version            3&#xA;&#xA;Dot1x Info for GigabitEthernet1/0/3&#xA;-----------------------------------&#xA;PAE                       = AUTHENTICATOR&#xA;QuietPeriod               = 60&#xA;ServerTimeout             = 0&#xA;SuppTimeout               = 30&#xA;ReAuthMax                 = 2&#xA;MaxReq                    = 2&#xA;TxPeriod                  = 30&#xA;&#xA;Dot1x Authenticator Client List Empty&#xA;&#xA;show run | in dot1x&#xA;aaa authentication dot1x default group RADIUS&#xA;dot1x system-auth-control&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Console&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Oct 15 20:16:41.392: dot1x-ev(Gi1/0/3): Interface state changed to DOWN&#xA;Oct 15 20:16:41.400: dot1x-ev(Gi1/0/3): Deleting client 0x74000003 (0000.0000.0000)&#xA;Oct 15 20:16:41.400: dot1x-ev:dot1x_supp_port_down: No DOT1X subblock found on GigabitEthernet1/0/3&#xA;Oct 15 20:16:41.400: dot1x-ev:Delete auth client (0x74000003) message&#xA;Oct 15 20:16:41.400: dot1x-ev:Auth client ctx destroyedshut&#xA;Oct 15 20:16:42.180: %SWITCH_QOS_TB-5-TRUST_DEVICE_LOST: cisco-phone no longer detected on port Gi1/0/3, operational port trust state is now untrusted&#xA;Oct 15 20:16:43.363: %LINK-5-CHANGED: Interface GigabitEthernet1/0/3, changed state to administratively down&#xA;Oct 15 20:16:44.370: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state tno shut&#xA;SW1(config-if)#&#xA;Oct 15 20:16:47.801: %ILPOWER-7-DETECT: Interface Gi1/0/3: Power Device detected: IEEE PD&#xA;Oct 15 20:16:48.807: %ILPOWER-5-POWER_GRANTED: Interface Gi1/0/3: Power granted&#xA;Oct 15 20:16:48.916: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/3, changed state to down&#xA;Oct 15 20:16:50.124: dot1x-ev(Gi1/0/3): Interface state changed to UP&#xA;Oct 15 20:16:50.133:     dot1x_auth Gi1/0/3: initial state auth_initialize has enter&#xA;Oct 15 20:16:50.133: dot1x-sm(Gi1/0/3): 0xD8000004:auth_initialize_enter called&#xA;Oct 15 20:16:50.133:     dot1x_auth Gi1/0/3: during state auth_initialize, got event 1(cfg_force_auth)&#xA;Oct 15 20:16:50.133: @@@ dot1x_auth Gi1/0/3: auth_initialize -&amp;gt; auth_force_auth&#xA;Oct 15 20:16:50.133: dot1x-sm(Gi1/0/3): 0xD8000004:auth_force_auth_enter called&#xA;Oct 15 20:16:50.133: dot1x-ev(Gi1/0/3): Sending EAPOL packet to group PAE address&#xA;Oct 15 20:16:50.133: dot1x-ev(Gi1/0/3): Role determination not required&#xA;Oct 15 20:16:50.133: dot1x-registry:registry:dot1x_ether_macaddr called&#xA;Oct 15 20:16:50.133: dot1x-ev(Gi1/0/3): Sending out EAPOL packet&#xA;Oct 15 20:16:50.133: EAPOL pak dump Tx&#xA;Oct 15 20:16:50.133: EAPOL Version: 0x3  type: 0x0  length: 0x0004&#xA;Oct 15 20:16:50.133: EAP code: 0x3  id: 0x1  length: 0x0004&#xA;Oct 15 20:16:50.133: dot1x-packet(Gi1/0/3): dot1x_auth_txCannedStatus: EAPOL packet sent to client 0xD8000004 (0000.0000.0000)&#xA;Oct 15 20:16:50.133:     dot1x_auth_bend Gi1/0/3: initial state auth_bend_initialize has enter&#xA;Oct 15 20:16:50.133: dot1x-sm(Gi1/0/3): 0xD8000004:auth_bend_initialize_enter called&#xA;Oct 15 20:16:50.133:     dot1x_auth_bend Gi1/0/3: initial state auth_bend_initialize has idle&#xA;Oct 15 20:16:50.133:     dot1x_auth_bend Gi1/0/3: during state auth_bend_initialize, got event 16383(idle)&#xA;Oct 15 20:16:50.133: @@@ dot1x_auth_bend Gi1/0/3: auth_bend_initialize -&amp;gt; auth_bend_idle&#xA;Oct 15 20:16:50.133: dot1x-sm(Gi1/0/3): 0xD8000004:auth_bend_idle_enter called&#xA;Oct 15 20:16:50.133: dot1x-ev(Gi1/0/3): Created a client entry (0xD8000004)&#xA;Oct 15 20:16:50.133: dot1x-ev(Gi1/0/3): Dot1x authentication started for 0xD8000004 (0000.0000.0000)&#xA;Oct 15 20:16:50.133: dot1x-ev:DOT1X Supplicant not enabled on GigabitEthernet1/0/3&#xA;Oct 15 20:16:50.141: dot1x-ev(Gi1/0/3): Sending event (2) to Auth Mgr for 0000.0000.0000&#xA;Oct 15 20:16:50.141: dot1x-redundancy: State for client  0000.0000.0000 successfully retrieved&#xA;Oct 15 20:16:52.113: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/3, changed state to up&#xA;Oct 15 20:16:53.119: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/3, changed state to up&#xA;Oct 15 20:17:34.542: %SWITCH_QOS_TB-5-TRUST_DEVICE_DETECTED: cisco-phone detected on port Gi1/0/3, port's configured trust state is now operational.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Port still ends up in a shutdown state, but supplies power to Phone...&lt;/p&gt;&#xA;" OwnerUserId="3528" LastEditorUserId="775" LastEditDate="2015-01-07T10:01:42.840" LastActivityDate="2018-05-02T18:26:55.653" Title="802.1x on Access VLAN only, not on Voice VLAN" Tags="|cisco|cisco-catalyst|authentication|ieee-802.1x|mac-auth-bypass|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12466" PostTypeId="2" ParentId="12465" CreationDate="2014-10-14T18:11:07.890" Score="4" Body="&lt;p&gt;You would need to configure MAB (Mac Auth Bypass) authentication for the ip phone in the multi-vlan interface. You also need multi-auth so the switch knows to look for more than one MAC address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-authentication host-mode multi-auth &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-authentication order mab dot1x&lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-10-14T18:11:07.890" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12467" PostTypeId="2" ParentId="12453" CreationDate="2014-10-14T18:32:13.313" Score="2" Body="&lt;p&gt;As far as I know you cannot do anything to increase the amount of SPANs (monitor-sessions) you can perform simultaneously on a Catalyst6509.  When we previously ran into this problem, we started using VACLs instead and sending the traffic to capture ports.&lt;/p&gt;&#xA;" OwnerUserId="26" LastActivityDate="2014-10-14T18:32:13.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12469" PostTypeId="2" ParentId="12465" CreationDate="2014-10-14T20:01:04.950" Score="5" Body="&lt;p&gt;802.1x is port based. So, in simplest form, the port is either authorized or not; once authorized -- MAC limits aside -- traffic from anything will be allowed. Modern 802.1x systems are much smarter (&quot;more complicated&quot;) and can independently police multiple hosts on a single port. This is where &lt;code&gt;multi-auth&lt;/code&gt; and &lt;code&gt;multi-domain&lt;/code&gt; come in. (consult Cisco &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/guide/scg3750/sw8021x.html#wp1271507&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Jaxxs points out, the only compromise is to allow the phone access without authentication (i.e. by MAC.) Because the 7941 won't do 802.1x itself, but will &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cuipph/7961g_7961g-ge_7941g_7941g-ge/7_0/english/administration/guide/6141_701_AG/7961ovr.html#wp1048798&quot; rel=&quot;noreferrer&quot;&gt;pass EAPOL through, and &quot;fake&quot; a logoff when the PC port is disconnected.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Ignoring that it's in terms of NX-OS, &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/identity-based-networking-services/config_guide_c17-663759.html&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; is how MAB works.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-10-14T20:01:04.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12474" PostTypeId="2" ParentId="11202" CreationDate="2014-10-14T21:52:57.053" Score="1" Body="&lt;p&gt;&lt;em&gt;Why we need to modulate signal to send it through the backbone&lt;/em&gt;: When modems were used as modulators/demodulators, a phone call was done. A modem dial-up really means dialing up. A modem accesses the internet by dialing a number at the ISP's site. Once, the connection is established the line is occupied. When then someone else tries to make a voice call the internet connection breaks or the caller hears a screechy sound and finally the internet access connection breaks. The experience depends on the telco's wiring. Then, DSL came. From a consumer's perspective it did one very special thing: Talking over the phone while surfing on the net.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;not need to modulate it to transfer data via UTP cables&lt;/em&gt;: Twisted pairs of copper wire are designed for local networks (a room, between rooms, a floor, between floors). The signal from a CPU sockets runs on a bus and after 10 or more centimeters it reaches a slot or onboard device. Nonetheless are both the cable and the bus manufactured for being a medium for a certain signal. The modem as in mo-/demodulator was invented to send data via a signal over a wire that once was used for carrying a human voice sampled by a speaker. Yes, the voice was sampled and the signal then amplified. The connection of two endpoints was switched by a company or a state facility. Hence, PSTN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there other modems? For examples, a DOCSIS modem. Its uses a coaxial cable for transmission. Although only a portion within the frequency spectrum is used, that spectrum could be endlessly subdivided. Therefore, it's analog as well. Its definitely not digital.&#xA;(Look up &quot;coaxial antenna&quot; to get the picture)&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2014-10-14T21:52:57.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12475" PostTypeId="2" ParentId="12451" CreationDate="2014-10-14T22:32:00.517" Score="2" Body="&lt;p&gt;When it says 2.4 GHz, it means the band between 2.4 GHz and 2.5 GHz (the exact range varies from one country to another). It's a similar idea to the allocation to CB radio of channels around 27 MHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, a single frequency just gives you a carrier; you need to modulate it to send information. If you looked at the signal with a spectrum analyzer, the sharp peak of the carrier will be broadened. This frequency spread is what analogue engineers call the bandwidth: 22 MHz in the case of 802.11b.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Networking people usually quote bandwidth in terms of bits/second; the exact relationship between frequency and bits/second depends on the encoding used. For 802.11b, divide by two: later standards tend to have more complex and efficient encodings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage of having multiple channels is that you can get aggregate performance of more than 11 Mbps by staggering the frequencies. In a corporate deployment with many APs, adjacent APs will operate on non-overlapping channels, as far as possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stealing gio's link: &lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_WLAN_channels&quot; rel=&quot;nofollow&quot;&gt;en.wikipedia.org/wiki/List_of_WLAN_channels&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2014-10-14T22:32:00.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12479" PostTypeId="1" AcceptedAnswerId="12480" CreationDate="2014-10-15T11:44:56.533" Score="2" ViewCount="981" Body="&lt;p&gt;While I was diagnosing a &lt;code&gt;pcapng&lt;/code&gt; file on my linux laptop (Debian Wheezy), I wanted to map out where the packets were coming from, so I followed the standard procedure for a building a GeoIP map...&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Setup&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Downloaded all the IPv4 &lt;a href=&quot;http://dev.maxmind.com/geoip/legacy/geolite/#Downloads&quot; rel=&quot;nofollow&quot; title=&quot;Gzip-compressed Maxmind GeoLite Databases&quot;&gt;GeoIP files&lt;/a&gt; into a dedicated directory (&lt;code&gt;/home/mpenning/geoip&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Extracted the &lt;code&gt;.gz&lt;/code&gt; files with &lt;code&gt;gzip -dc filename.dat.gz &amp;gt; filename.dat&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Pointed wireshark to the GeoIP files... &lt;em&gt;Edit &gt; Preferences &gt; Name Resolution &gt; GeoIP database directories &gt; New&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;Restarted Wireshark, and opened my pcap&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Statistics &gt; Endpoints &gt; IPv4 &gt; Map&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I can see the GeoIP data points in the &lt;code&gt;ipmap.html&lt;/code&gt; file; however, when I open the file in my browser, it was blank.  How can I get wireshark to correctly display the GeoIP map?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Details&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Debian Wheezy (x86)&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Output from &lt;code&gt;wireshark --version&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mpenning@Mudslide:~/geoip$ wireshark --version&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;wireshark 1.8.2&#xA;&#xA;Copyright 1998-2012 Gerald Combs  and contributors.&#xA;This is free software; see the source for copying conditions. There is NO&#xA;warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.&#xA;&#xA;Compiled (32-bit) with GTK+ 2.24.10, with Cairo 1.12.2, with Pango 1.30.0, with&#xA;GLib 2.32.4, with libpcap, with libz 1.2.7, with POSIX capabilities (Linux),&#xA;with SMI 0.4.8, with c-ares 1.9.1, with Lua 5.1, without Python, with GnuTLS&#xA;2.12.20, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP, with PortAudio&#xA;V19-devel (built Dec  7 2011 23:44:47), with AirPcap.&#xA;&#xA;Running on Linux 3.2.0-4-686-pae, with locale en_US.UTF-8, with libpcap version&#xA;1.3.0, with libz 1.2.7, GnuTLS 2.12.20, Gcrypt 1.5.0, without AirPcap.&#xA;&#xA;Built using gcc 4.7.2.&#xA;mpenning@Mudslide:~/geoip$&#xA;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;File: &lt;code&gt;ipmap.html&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;html xmlns=&quot;http://www.w3.org/1999/xhtml&quot;&amp;gt;&#xA;  &amp;lt;head&amp;gt;&#xA;    &amp;lt;title&amp;gt;Wireshark: IP Location Map&amp;lt;/title&amp;gt;&#xA;    &amp;lt;style type=&quot;text/css&quot;&amp;gt;&#xA;    body {&#xA;      font-family: Arial, Helvetica, sans-serif; font-size: 13px;&#xA;      line-height: 17px;&#xA;    }&#xA;    &amp;lt;/style&amp;gt;&#xA;    &amp;lt;script type=&quot;text/javascript&quot; src=&quot;http://openlayers.org/api/OpenLayers.js&quot;&amp;gt;&amp;lt;/script&amp;gt;&#xA;    &amp;lt;script type=&quot;text/javascript&quot; src=&quot;http://openstreetmap.org/openlayers/OpenStreetMap.js&quot;&amp;gt;&amp;lt;/script&amp;gt;&#xA;&#xA;    &amp;lt;script type=&quot;text/javascript&quot;&amp;gt;&#xA;        &amp;lt;!--&#xA;        var map, layer;&#xA;        var selectControl, selectedFeature;&#xA;&#xA;        function onPopupClose(event) {&#xA;            selectControl.unselect(this.feature);&#xA;        }&#xA;&#xA;        function EndpointSelected(event) {&#xA;            var feature = event.feature;&#xA;            popup = new OpenLayers.Popup.FramedCloud(&quot;endpoint&quot;,&#xA;                feature.geometry.getBounds().getCenterLonLat(),&#xA;                new OpenLayers.Size(25,25),&#xA;                &quot;&amp;lt;h3&amp;gt;&quot;+ feature.attributes.title + &quot;&amp;lt;/h3&amp;gt;&quot; +&#xA;                feature.attributes.description,&#xA;                null, true, onPopupClose);&#xA;            feature.popup = popup;&#xA;            popup.feature = feature;&#xA;            map.addPopup(popup);&#xA;        }&#xA;&#xA;        function EndpointUnselected(event) {&#xA;            var feature = event.feature;&#xA;            if (feature.popup) {&#xA;                popup.feature = null;&#xA;                map.removePopup(feature.popup);&#xA;                feature.popup.destroy();&#xA;                feature.popup = null;&#xA;            }&#xA;        }&#xA;&#xA;        function init() {&#xA;            var endpoints = {&#xA;                &quot;type&quot;: &quot;FeatureCollection&quot;,&#xA;                &quot;features&quot;: [ // Start endpoint list - MUST match hostlist_table.c&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-121.870499, 37.440399] },&#xA;  'properties': { 'title': '24.6.173.220', 'description': 'AS: AS7922 Comcast Cable Communications, Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Milpitas, CA&amp;lt;br/&amp;gt;Packets: 2376&amp;lt;br/&amp;gt;Bytes: 1744436' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-121.894997, 37.339401] },&#xA;  'properties': { 'title': '68.87.76.182', 'description': 'AS: AS7922 Comcast Cable Communications, Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: San Jose, CA&amp;lt;br/&amp;gt;Packets: 244&amp;lt;br/&amp;gt;Bytes: 26329' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-118.298698, 33.786598] },&#xA;  'properties': { 'title': '199.181.132.250', 'description': 'AS: AS8137 Disney Online&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Burbank, CA&amp;lt;br/&amp;gt;Packets: 10&amp;lt;br/&amp;gt;Bytes: 1374' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-118.298698, 33.786598] },&#xA;  'properties': { 'title': '198.105.194.105', 'description': 'AS: AS8137 Disney Online&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Burbank, CA&amp;lt;br/&amp;gt;Packets: 85&amp;lt;br/&amp;gt;Bytes: 69473' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-71.084297, 42.362598] },&#xA;  'properties': { 'title': '69.22.148.82', 'description': 'AS: AS4436 nLayer Communications, Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Cambridge, MA&amp;lt;br/&amp;gt;Packets: 494&amp;lt;br/&amp;gt;Bytes: 434075' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-97.000000, 38.000000] },&#xA;  'properties': { 'title': '24.143.203.16', 'description': 'AS: AS7843 Time Warner Cable Internet LLC&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: -&amp;lt;br/&amp;gt;Packets: 89&amp;lt;br/&amp;gt;Bytes: 62863' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-104.873802, 39.623699] },&#xA;  'properties': { 'title': '204.2.164.118', 'description': 'AS: AS2914 NTT America, Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Englewood, CO&amp;lt;br/&amp;gt;Packets: 98&amp;lt;br/&amp;gt;Bytes: 71411' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-118.298698, 33.786598] },&#xA;  'properties': { 'title': '68.71.208.113', 'description': 'AS: AS8137 Disney Online&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Burbank, CA&amp;lt;br/&amp;gt;Packets: 10&amp;lt;br/&amp;gt;Bytes: 1894' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-97.000000, 38.000000] },&#xA;  'properties': { 'title': '24.143.203.18', 'description': 'AS: AS7843 Time Warner Cable Internet LLC&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: -&amp;lt;br/&amp;gt;Packets: 92&amp;lt;br/&amp;gt;Bytes: 82142' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-71.084297, 42.362598] },&#xA;  'properties': { 'title': '205.234.225.88', 'description': 'AS: AS4436 nLayer Communications, Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Cambridge, MA&amp;lt;br/&amp;gt;Packets: 13&amp;lt;br/&amp;gt;Bytes: 2572' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-118.298698, 33.786598] },&#xA;  'properties': { 'title': '68.71.220.175', 'description': 'AS: AS8137 Disney Online&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Burbank, CA&amp;lt;br/&amp;gt;Packets: 10&amp;lt;br/&amp;gt;Bytes: 2402' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-104.873802, 39.623699] },&#xA;  'properties': { 'title': '204.2.164.104', 'description': 'AS: AS2914 NTT America, Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Englewood, CO&amp;lt;br/&amp;gt;Packets: 124&amp;lt;br/&amp;gt;Bytes: 101358' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-98.398697, 29.488899] },&#xA;  'properties': { 'title': '72.32.153.176', 'description': 'AS: AS33070 Rackspace Hosting&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: San Antonio, TX&amp;lt;br/&amp;gt;Packets: 39&amp;lt;br/&amp;gt;Bytes: 26300' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-71.084297, 42.362598] },&#xA;  'properties': { 'title': '69.22.148.33', 'description': 'AS: AS4436 nLayer Communications, Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Cambridge, MA&amp;lt;br/&amp;gt;Packets: 114&amp;lt;br/&amp;gt;Bytes: 100615' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-71.084297, 42.362598] },&#xA;  'properties': { 'title': '69.22.148.42', 'description': 'AS: AS4436 nLayer Communications, Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Cambridge, MA&amp;lt;br/&amp;gt;Packets: 23&amp;lt;br/&amp;gt;Bytes: 15818' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-122.094597, 37.304199] },&#xA;  'properties': { 'title': '143.127.102.125', 'description': 'AS: AS16733 Symantec Corporation&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Cupertino, CA&amp;lt;br/&amp;gt;Packets: 10&amp;lt;br/&amp;gt;Bytes: 1229' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-88.054001, 42.053398] },&#xA;  'properties': { 'title': '138.108.29.10', 'description': 'AS: AS16477 ACNIELSEN&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Schaumburg, IL&amp;lt;br/&amp;gt;Packets: 10&amp;lt;br/&amp;gt;Bytes: 1520' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-111.961800, 40.324501] },&#xA;  'properties': { 'title': '66.235.133.11', 'description': 'AS: AS15224 Adobe Systems Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Lehi, UT&amp;lt;br/&amp;gt;Packets: 9&amp;lt;br/&amp;gt;Bytes: 3410' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-77.487503, 39.043701] },&#xA;  'properties': { 'title': '184.73.230.118', 'description': 'AS: AS14618 Amazon.com, Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Ashburn, VA&amp;lt;br/&amp;gt;Packets: 10&amp;lt;br/&amp;gt;Bytes: 1384' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-97.000000, 38.000000] },&#xA;  'properties': { 'title': '24.143.203.42', 'description': 'AS: AS7843 Time Warner Cable Internet LLC&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: -&amp;lt;br/&amp;gt;Packets: 10&amp;lt;br/&amp;gt;Bytes: 1650' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-104.873802, 39.623699] },&#xA;  'properties': { 'title': '204.2.164.8', 'description': 'AS: AS2914 NTT America, Inc.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Englewood, CO&amp;lt;br/&amp;gt;Packets: 47&amp;lt;br/&amp;gt;Bytes: 35518' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-118.298698, 33.786598] },&#xA;  'properties': { 'title': '68.71.208.178', 'description': 'AS: AS8137 Disney Online&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Burbank, CA&amp;lt;br/&amp;gt;Packets: 16&amp;lt;br/&amp;gt;Bytes: 9332' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-98.398697, 29.488899] },&#xA;  'properties': { 'title': '72.32.153.177', 'description': 'AS: AS33070 Rackspace Hosting&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: San Antonio, TX&amp;lt;br/&amp;gt;Packets: 16&amp;lt;br/&amp;gt;Bytes: 2476' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-122.419403, 37.774899] },&#xA;  'properties': { 'title': '63.233.61.22', 'description': 'AS: AS20940 Akamai International B.V.&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: San Francisco, CA&amp;lt;br/&amp;gt;Packets: 766&amp;lt;br/&amp;gt;Bytes: 678473' }&#xA;},&#xA;{&#xA;  'type': 'Feature', 'geometry': { 'type': 'Point', 'coordinates': [-118.298698, 33.786598] },&#xA;  'properties': { 'title': '68.71.209.230', 'description': 'AS: AS8137 Disney Online&amp;lt;br/&amp;gt;Country: United States&amp;lt;br/&amp;gt;City: Burbank, CA&amp;lt;br/&amp;gt;Packets: 37&amp;lt;br/&amp;gt;Bytes: 10818' }&#xA;},&#xA;                ]&#xA;            };&#xA;            map = new OpenLayers.Map('map', {&#xA;                controls: [&#xA;                    new OpenLayers.Control.PanZoomBar(),&#xA;                    new OpenLayers.Control.ZoomBox(),&#xA;                    new OpenLayers.Control.ScaleLine(),&#xA;                    new OpenLayers.Control.MousePosition(),&#xA;                    new OpenLayers.Control.MouseDefaults(),&#xA;                    new OpenLayers.Control.Attribution()&#xA;                    ],&#xA;                //projection: new OpenLayers.Projection(&quot;EPSG:900913&quot;),&#xA;                //displayProjection: new OpenLayers.Projection(&quot;EPSG:4326&quot;),&#xA;                //maxExtent: new OpenLayers.Bounds(-20037508.34,-20037508.34, 20037508.34, 20037508.34),&#xA;                //numZoomLevels: 18,&#xA;                //maxResolution: 156543,&#xA;                //units: &quot;m&quot;&#xA;            });&#xA;            layer = new OpenLayers.Layer.WMS(&quot;OpenLayers WMS&quot;,&#xA;                    &quot;http://vmap0.tiles.osgeo.org/wms/vmap0&quot;,&#xA;                    {layers: 'basic'} );&#xA;            map.addLayer(layer);&#xA;            //map.addLayer(new OpenLayers.Layer.OSM.Mapnik(&quot;Mapnik&quot;));&#xA;            //map.addLayer(new OpenLayers.Layer.Text(&quot;IP Locations&quot;, {&#xA;            //    location: map_file, projection: new OpenLayers.Projection(&quot;EPSG:4326&quot;)} ) );&#xA;            //&#xA;            //map.setCenter(new OpenLayers.LonLat(lon, lat), zoom);&#xA;&#xA;            var geojson_format = new OpenLayers.Format.GeoJSON();&#xA;            var vector_layer = new OpenLayers.Layer.Vector(&quot;IP Endpoints&quot;);&#xA;            map.addLayer(vector_layer);&#xA;            vector_layer.addFeatures(geojson_format.read(endpoints));&#xA;&#xA;            if (endpoints.features.length &amp;lt; 1) {&#xA;                document.getElementById(&quot;statusmsg&quot;).innerHTML = &quot;No endpoints to map&quot;;&#xA;            } else {&#xA;                map.zoomToExtent(vector_layer.getDataExtent());&#xA;            }&#xA;&#xA;            selectControl = new OpenLayers.Control.SelectFeature(vector_layer);&#xA;            map.addControl(selectControl);&#xA;            selectControl.activate();&#xA;&#xA;            vector_layer.events.on({&#xA;                'featureselected': EndpointSelected,&#xA;                'featureunselected': EndpointUnselected&#xA;            });&#xA;        }&#xA;        // --&amp;gt;&#xA;    &amp;lt;/script&amp;gt;&#xA;  &amp;lt;/head&amp;gt;&#xA;  &amp;lt;body onload=&quot;init()&quot;&amp;gt;&#xA;    &amp;lt;div id=&quot;statusmsg&quot; style=&quot;float: right; z-index: 9999;&quot;&amp;gt;&amp;lt;/div&amp;gt;&#xA;    &amp;lt;div id=&quot;map&quot; style=&quot;z-index: 0;&quot;&amp;gt;&amp;lt;/div&amp;gt;&#xA;  &amp;lt;/body&amp;gt;&#xA;&amp;lt;/html&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-10-15T12:00:36.407" LastActivityDate="2014-10-15T12:00:36.407" Title="Blank Wireshark GeoIP map" Tags="|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12480" PostTypeId="2" ParentId="12479" CreationDate="2014-10-15T11:44:56.533" Score="3" Body="&lt;p&gt;It turns out that I hit &lt;a href=&quot;https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5016&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Wireshark Bug ID 5016&quot;&gt;Wireshark bug 5016&lt;/a&gt;... based on the code diffs in the &lt;a href=&quot;https://bugs.wireshark.org/bugzilla/attachment.cgi?id=9227&quot; rel=&quot;nofollow noreferrer&quot;&gt;bug's attachment&lt;/a&gt;, I got the map to display by making some minor changes to the contents of &lt;code&gt;ipmap.html&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A unix diff of the before and after looks like this... &lt;code&gt;/tmp/ipmap.html&lt;/code&gt; is the working copy...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mpenning@Mudslide:~$ diff ipmap.orig.html /tmp/ipmap.html &#xA;158c158&#xA;&amp;lt;                     new OpenLayers.Control.MouseDefaults(),&#xA;---&#xA;&amp;gt;                     new OpenLayers.Control.Navigation(),&#xA;160c160&#xA;&amp;lt;                     ],&#xA;---&#xA;&amp;gt;                     ]&#xA;mpenning@Mudslide:~$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just change &lt;code&gt;OpenLayers.Control.MouseDefaults()&lt;/code&gt; to &lt;code&gt;OpenLayers.Control.Navigation()&lt;/code&gt;, and then remove the trailing comma after the bracket containing the value we changed.  Now I have a working map...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/a3DB4.png&quot; alt=&quot;Wireshark GeoIP Map&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Excerpt from the working html file...&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       map = new OpenLayers.Map('map', {&#xA;            controls: [&#xA;                new OpenLayers.Control.PanZoomBar(),&#xA;                new OpenLayers.Control.ZoomBox(),&#xA;                new OpenLayers.Control.ScaleLine(),&#xA;                new OpenLayers.Control.MousePosition(),&#xA;                new OpenLayers.Control.Navigation(),&#xA;                new OpenLayers.Control.Attribution()&#xA;                ]&#xA;            //projection: new OpenLayers.Projection(&quot;EPSG:900913&quot;),&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-10-15T11:44:56.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12482" PostTypeId="1" AcceptedAnswerId="12483" CreationDate="2014-10-15T15:06:19.997" Score="0" ViewCount="4503" Body="&lt;p&gt;Suppose I was given this IP gateway : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;199.141.27.129/26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I tell the subnet mask from the &lt;code&gt;/26&lt;/code&gt;? Sometimes I notice this, for example : IP 150.10.10.10 with a mask 255.255.252.0 can be written 150.10.10.10/22 &lt;/p&gt;&#xA;" OwnerUserId="8832" LastActivityDate="2014-10-15T15:23:05.817" Title="How to calculate subnet mask from IP Gateway" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="0" ClosedDate="2014-10-15T15:57:50.693" ContentLicense="CC BY-SA 3.0" />
  <row Id="12483" PostTypeId="2" ParentId="12482" CreationDate="2014-10-15T15:23:05.817" Score="3" Body="&lt;p&gt;The number (26) is the number of bits in the mask:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111.11111111.11111111.11000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Convert it back to decimal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;255.255.255.192&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2014-10-15T15:23:05.817" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12485" PostTypeId="1" AcceptedAnswerId="12530" CreationDate="2014-10-15T17:46:41.633" Score="11" ViewCount="28701" Body="&lt;p&gt;Copy-pasting from my lecturer's slides:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;• Receiver indicates the window size is 3000 &#xA;• Transfer goes ahead &#xA;• Acknowledge every 3000 bytes &#xA;• Receiver increases window size to 4000 &#xA;• 4000 bytes will be transferred before the next acknowledgement &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So from this I gather that the Window Size represent how many bytes the receiver will gather before sending an ACK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this isn't what I see in this Wireshark capture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/SOdjD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see in the screenshot (from a TCP file transfer), the server is ACKing every ~1400 bytes or so (looking at the ACK number), but at the same time is indicating a window size of 100'000+ bytes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand from my lecturer's slides, the server should be ACKing every 100'000+ bytes? Why is he ACKing much more often than that?&lt;/p&gt;&#xA;" OwnerUserId="8852" LastEditorUserId="8499" LastEditDate="2018-10-27T02:29:33.170" LastActivityDate="2018-10-27T02:29:33.170" Title="Window Size and ACK Number" Tags="|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12490" PostTypeId="1" CreationDate="2014-10-15T21:10:29.660" Score="2" ViewCount="92" Body="&lt;p&gt;Back in the day I was messing around with MadWifi and, if I remember properly, after a packet was transmitted if the sender did not receive an ACK in SIFS time after the completion of the transmission, the sender would attempt a retransmission using the same or lower rate (multi rate retransmissions) without going into the backoff/contention phase. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I spent some time going through the 802.11-2012 protocol trying to find relevant information without any luck. Is anyone familiar with that concept? Is this what the protocol implies?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers/suggestions are greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="9916" LastEditorUserId="9916" LastEditDate="2014-10-15T23:30:44.617" LastActivityDate="2014-10-15T23:30:44.617" Title="MAC Layer Retransmissions during the same TXOP" Tags="|wireless|protocol-theory|mac|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12491" PostTypeId="2" ParentId="12485" CreationDate="2014-10-15T21:21:49.833" Score="5" Body="&lt;p&gt;The Window Size is used to prevent congestion at the receiver (as opposed to the congestion window that tries to prevent congestion in the network). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The functionality of it is relatively simple: the receiver informs the sender about its window size, which usually represents the available buffer size. Therefore this number should be decreased every time a new packet arrives at the receiver and should be increased each time a packet is processed at the receiver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the sender side, the sender tries to make sure that at any given time he/she does not have &lt;strong&gt;in transit&lt;/strong&gt; more bytes than the last received advertised window and therefore lower the probability of flooding the receiver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now from your wireshark output we can see that your window size is relatively big and thus your transmissions are not throttled and you receive an ACK for every packet that you send (as it should be in the general case scenario where no ACK aggregation is used). Currently the mostly used maximum size for ethernet frames is 1500 bytes. If you remove all the headers you will see that the bytes that remain are actually the number by which your ACKs are increased.&lt;/p&gt;&#xA;" OwnerUserId="9916" LastActivityDate="2014-10-15T21:21:49.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12492" PostTypeId="2" ParentId="12454" CreationDate="2014-10-15T21:27:52.293" Score="4" Body="&lt;p&gt;The answer you are looking for can be found &lt;a href=&quot;http://www4.ncsu.edu/~mlsichit/Teaching/407/Resources/udpChecksum.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For completion reasons, I paste it here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;First, the checksum calculation is defined in RFC 768 but hints as to how to calculate it efficiently are in RFC 1071. Both are worth reading and contain a much more in-depth description that I'm going to write here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic idea is that the UDP checksum is a the complement of a 16-bit one's complement sum calculated over an IP &quot;pseudo-header&quot; and the actual UDP data. The IP pseudo-header is the source address, destination address, protocol (padded with a zero byte) and UDP length. So to take the example of this short packet, the source IP address is 152.1.51.27, and the destination IP address is 152.14.94.75. Divided into 16-bit quantities, these are 0x9801, 0x331b and 0x980e, 0x5e4b. If you add those together using two's complement (e.g. with Windows calculator), you get 0x1c175. Note that this overflows a 16-bit quantity, but we'll take care of that later. Next is to add in the protocol and UDP length. For this packet, the protocol is UDP so the protocol type byte is 17or 0x11. We pad that with zero to get 0x0011 and then add the UDP length which is 0x000a (10 bytes). So 0x1c175 + 0x0011 + 0x0! 00a = 0x1c190.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we add the entire UDP datagram, treating it all as 16-bit quantities and skipping the checksum (until we finish calculating it!). For this datagram, that's 0xa08f, 0x2694, 0x000a, 0x6262, so if we add all that to our running sum, we get 0x1c190 + 0xa08f + 0x2694 + 0x000a + 0x6262 = 0x2eb1f.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to convert to a ones complement 16-bit sum we just treat our current sum (0x2eb1f) as a 32-bit quantity and add the high half to the low half. 0x0002 + 0xeb1f = 0xeb21. (If that still had an overflow, we'd add the high and low halves again until there was no longer an overflow.) Now we complement that quantity (i.e. flip all the bits, or do a NOT operation) and we get a value of 0x14de which is exactly what the reported checksum shows in the packet.&quot;&lt;/p&gt;&#xA;" OwnerUserId="9916" LastActivityDate="2014-10-15T21:27:52.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12496" PostTypeId="1" AcceptedAnswerId="12507" CreationDate="2014-10-16T08:17:51.260" Score="19" ViewCount="31751" Body="&lt;p&gt;I'm working on Wireshark lab-IP in &lt;em&gt;Computer networking - A top down approach&lt;/em&gt; and I don't understand why every packet that normally expired has a TTL of 1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my Wireshark capture file.&#xA;&lt;a href=&quot;https://www.dropbox.com/s/rr5wgze9j20gzvu/traceroute-56.pcapng?dl=0&quot;&gt;https://www.dropbox.com/s/rr5wgze9j20gzvu/traceroute-56.pcapng?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I captured the execution of the &lt;code&gt;traceroute&lt;/code&gt; program in Linux (with the option of 56 bytes), as executed with the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute http://gaia.cs.umass.edu 56&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see that most of the packet's TTL == 1 and I don't know why, since I learned that every subsequent hop has a TTL of +1 (or more).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I'm using Lubuntu on VMware with bridged network to the host.&lt;/li&gt;&#xA;&lt;li&gt;I captured it with wireshark on host machine (Windows)&lt;/li&gt;&#xA;&lt;li&gt;I'm connected to a wireless AP using it's own DHCP server on top of NAT protocol&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="9922" LastEditorUserId="16234" LastEditDate="2015-06-28T19:55:59.430" LastActivityDate="2015-06-28T19:55:59.430" Title="Traceroute - every packet has TTL == 1" Tags="|wireshark|icmp|traceroute|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12497" PostTypeId="1" CreationDate="2014-10-16T08:50:54.007" Score="3" ViewCount="1070" Body="&lt;p&gt;Hi all hope you can help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our Psion handheld devices used in the warehouse have been renewing their DHCP leases every time they change AP on our Aruba network. I have spoken to Psion and they say it is an AP configuration issue, rather than the handhelds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DHCP server on which they renew their IPs is on a separate subnet and sometimes we have to either take the link down, or reboot the DHCP server. This causes all handhelds to stop working as soon as they move to new AP which should not be happening as they are on an 8 day lease.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All APs and clients are on the same subnet and get their IPs from the same DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Psion told me the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have analyzed your issue and as well I have consulted my colleagues&#xA;  from the          Motorola wireless support and we think that the&#xA;  issue can’t be cause from the client’s side (the EP10) and we believe&#xA;  this would be a configuration issue with the AP’s. Further to this,&#xA;  when the AP’s are set up to be transparent (as we have them in the&#xA;  office, then once every few hours, minutes, depending on how they were&#xA;  set up, they will check with the server if the same IP is still&#xA;  available and will continue using it, without refreshing it) , but&#xA;  when they are not set up as transparent, then they will act like a&#xA;  router and then the IP will be renewed while the client will switch&#xA;  from one AP to another.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I cant find anything in the configuiration that seems to fit this explanation? Can anybody suggest anything?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The access points are Aruba IAP-104.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help.&lt;/p&gt;&#xA;" OwnerUserId="9923" LastEditorUserId="3191" LastEditDate="2015-01-14T20:40:20.857" LastActivityDate="2016-11-05T16:26:56.697" Title="Handheld Device Aruba AP Change Causes DHCP Renewal" Tags="|dhcp|access-point|aruba|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12500" PostTypeId="2" ParentId="7423" CreationDate="2014-10-16T16:09:31.180" Score="1" Body="&lt;p&gt;You may want to use more than 3 Access Points.  You will definitely want to use the 5GHz Spectrum and Disable the 2.4 GHz Spectrum.  If you can swing it, go for APs utilizing 802.11AC specifications which take advantage of multipath, but you don't need to bond 40MHz or 80MHz channels. You will also want to make sure that you use the same SSID and non-overlapping channels (take care not to introduce side-band interference).  Remember that WiFi is simplex, a shared medium- You do not want too many devices contending for the same medium, especially when you have a multimedia stream.  Remember that half of your overall bandwidth (Give or take) is going to be used up in overhead, and the theoretical throughput listed on the manufacturers descriptions shows speeds that you are highly unlikely to achieve.  I would recommend using at least 5 APs for this because you are trying to provide capacity, not coverage area.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps &lt;/p&gt;&#xA;" OwnerUserId="9927" LastActivityDate="2014-10-16T16:09:31.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12506" PostTypeId="2" ParentId="12496" CreationDate="2014-10-16T17:02:51.703" Score="15" Body="&lt;p&gt;Your client is only sending the first three packets with a TTL of 1.  The next three are sent with a TTL of 2.  The next three are sent with a TTL of 3.  And so on and so forth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An easier way to view this is to set the IP TTL field as its own column in Wireshark.  Simply right click on the TTL value in any packet, and select &quot;Apply as Column&quot;:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ZbkNC.png&quot; alt=&quot;Set TTL as a Column in Wireshark&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, you can see that packets 8,9,10 have a TTL of 1.  And packets 11,12,13 have a TTL of 2.  And so on and so forth.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/WqwGl.png&quot; alt=&quot;TTL in a Traceroute&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is happening because this is how Traceroute works.  It takes advantage of what a Router does when it decreases a TTL to 0.  Rather than continue forwarding the packet, it sends back to the original client a &quot;ICMP TTL Expired in Transit message&quot; &lt;em&gt;(see packet #24 in your capture)&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So as a client, when you send the first set of packets with a TTL of 1, the first router in the path responds with the TTL Expired message.  You then measure how long it took to receive the TTL Expired message against when you sent the initial messages, and that gives you your first three values in the Traceroute output.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you send another set of three packets with a TTL of 2.  The first router in the path decrements this to 1, and then forwards it to the next router in the path.  Upon reception, when that second router gets it, it decrements the TTL to 0, which prompts it to drop the packet and send you the TTL Expired in transit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The process continues until your client has received a (well, three) TTL Expired message from every router in transit between you and the final destination you are running your traceroute against.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-10-16T17:02:51.703" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12507" PostTypeId="2" ParentId="12496" CreationDate="2014-10-16T17:16:27.137" Score="14" Body="&lt;p&gt;Let me &lt;em&gt;try&lt;/em&gt; to answer this, because it's a little more complicated that it may look initially.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that you already know the basic operation of &lt;code&gt;traceroute&lt;/code&gt; but before anything else here is a very small recap: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;traceroute&lt;/code&gt; tries to determine all the in-between steps from your host to a destination host, or just the distance, i.e. number of hops, from your host to a destination host. To do that it starts sending packets to the destination host with a &quot;random&quot; destination port number and a TTL that starts from 1 and keeps increasing.&lt;br&gt; &#xA;The idea is that each router in between decreases the TTL by 1. Thus, if TTL reaches 0 (in reality it never does since the router that is about to decrease it to 0 produces an error before that), the router will return an ICMP &quot;&lt;strong&gt;Time-to-live exceeded&lt;/strong&gt;&quot; error message, e.g. &lt;em&gt;packet number 24&lt;/em&gt; in your capture file. What you get from that is that your destination is further away and this is why you keep increasing the TTL. &lt;br&gt;&#xA;When your packet has a TTL that is big enough to reach the destination, you will get a different ICMP error message: &quot;&lt;strong&gt;Destination Unreachable (Port Unreachable)&lt;/strong&gt;&quot;, e.g. &lt;em&gt;packet number 208&lt;/em&gt; in your capture file. What you get from that is that the last used TTL is indeed the number of hops between you and the destination node. The reason that you get an error is simply because you are sending a message to a &quot;random&quot; port that the destination node (hopefully) is not listening to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now going into specifics for your capture file:&lt;br&gt;&lt;/strong&gt;&#xA;From the manual page of &lt;code&gt;traceroute&lt;/code&gt; we can see that &lt;strong&gt;each TTL is used 3 times&lt;/strong&gt; (option '-q') and the default protocol used is &lt;strong&gt;UDP&lt;/strong&gt; (option '-P'). By examining the first 3 UDP packets, i.e. &lt;em&gt;packets 8-9-10&lt;/em&gt;, we can see indeed that the &lt;strong&gt;TTL is 1&lt;/strong&gt;. The next 3, i.e. &lt;em&gt;11-12-13&lt;/em&gt;, have a &lt;strong&gt;TTL 2&lt;/strong&gt; and so on. So from the source perspective everything seems to go fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, after some time dependent on the delay of the network, we start getting the anticipated error messages. Thus we can see that &lt;em&gt;packets 24-25-26&lt;/em&gt; are &quot;&lt;strong&gt;Time to live exceeded&lt;/strong&gt;&quot; error packets and thus meaning that the destination is further away. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This back-and-forth of attempts and errors continues, until, finally, &lt;em&gt;packet 208&lt;/em&gt; and on you can see &quot;&lt;strong&gt;Port Unreachable&lt;/strong&gt;&quot; error messages, meaning that your destination has been reached. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By counting the packets you send and the responses you can actually find out even from the trace which TTL actually worked but its a tedious task :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helped&lt;/p&gt;&#xA;" OwnerUserId="9916" LastActivityDate="2014-10-16T17:16:27.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12508" PostTypeId="1" AcceptedAnswerId="12548" CreationDate="2014-10-16T17:46:31.073" Score="3" ViewCount="137" Body="&lt;p&gt;Is it possible to query a router to return a list multicast sources it has registered, via a protocol? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I want to know what multicast sources are available on a router but I don't have control over that router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thought was a PIM query or spoofing as another router via PIM message may allow me to recieve the multicast table. Is this possible, or am  I going down the wrong path?&lt;/p&gt;&#xA;" OwnerUserId="4455" LastActivityDate="2014-10-18T03:32:10.190" Title="Query router for list of multicast sources" Tags="|multicast|pim|" AnswerCount="1" CommentCount="1" ClosedDate="2019-05-26T00:39:26.950" ContentLicense="CC BY-SA 3.0" />
  <row Id="12510" PostTypeId="2" ParentId="12497" CreationDate="2014-10-16T19:19:32.167" Score="1" Body="&lt;p&gt;If the AP is a bridge, then it's not involved in the DHCP transaction.  In all cases, it's up to the client as to when it renews or rebinds.  If I had to guess, the Psions are resetting when they &quot;roam&quot; because the link is getting reset. (almost all systems will restart DHCP (&quot;rebind&quot;) if the link state changes.) That said, even if they are rebinding, it shouldn't matter much, as the DHCP server should prefer to give it the same address it already has.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need a fully integrated wireless network (read: wireless lan controller) to get the APs to signal clients to move between APs vs. the client choosing when it moves into/out of range.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-10-16T19:19:32.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12513" PostTypeId="2" ParentId="12457" CreationDate="2014-10-17T00:28:56.830" Score="1" Body="&lt;p&gt;With the four defined networks that you want to use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.123.0/26 (/26 = 255.255.255.192)&#xA;192.168.123.64/26&#xA;192.168.123.128/26&#xA;192.168.123.192/26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You apply these four networks onto router interfaces. Suppose you use the first address as your gateway address, your router interfaces would be assigned these addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface FastEthernet 0/0&#xA; description network-1&#xA; 192.168.123.1 255.255.255.192&#xA;!&#xA;interface FastEthernet 0/1&#xA; description network-2&#xA; 192.168.123.65 255.255.255.192&#xA;!&#xA;interface FastEthernet 0/2&#xA; description network-3&#xA; 192.168.123.129 255.255.255.192&#xA;!&#xA;interface FastEthernet 0/3&#xA; description network-4&#xA; 192.168.123.193 255.255.255.192&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So with a computer on network-1, that computer can have an address of 192.168.123.2 with a default gateway of 192.168.123.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A computer on network-2, can have an address 192.168.123.68 with a default gateway of 192.168.123.65.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So on and so forth as long as the address meets the criteria of the range of the respective subnet.&lt;/p&gt;&#xA;" OwnerUserId="5601" LastActivityDate="2014-10-17T00:28:56.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12517" PostTypeId="1" CreationDate="2014-10-17T05:55:46.337" Score="2" ViewCount="19017" Body="&lt;p&gt;I keep seeing the definition of nodal processing delay as &quot;The time it takes to process a packet in a network node (router, switch, hub, etc.), which is dependent on the speed of the device and congestion in the network. Contrast with propagation delay&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, a node can be anything on the network (including recipient computer), so does nodal delay include things such as the amount of time the recipient takes to read the packet? What if the traffic is going through a proxy or VPN, would the intermediate computer be included in the processing delay too?&lt;/p&gt;&#xA;" OwnerUserId="8025" LastActivityDate="2023-09-04T09:03:23.803" Title="What is nodal delay?" Tags="|routing|terminology|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12518" PostTypeId="1" AcceptedAnswerId="12522" CreationDate="2014-10-17T06:07:28.233" Score="-2" ViewCount="138" Body="&lt;p&gt;I took 4 classes in networking. I have a doubt. If I am downloading something from say mp3skull.com . My private ip address is  say 10.155.23.143 and ip address of company A, which provided me the private ip, is 10.155.23.22 and lets say some other company bought an Ip address 10.155.23.143. the songs server will send the packets to my ip address which is 10.155.23.143 but it will reach company B. how am I still able to receive packets?&lt;/p&gt;&#xA;" OwnerUserId="9896" LastEditorUserId="775" LastEditDate="2014-12-08T12:16:59.730" LastActivityDate="2014-12-08T12:16:59.730" Title="How do I receive packets to my private ip from outside out of my network" Tags="|nat|ip|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12521" PostTypeId="1" CreationDate="2014-10-17T07:48:58.077" Score="-3" ViewCount="85" Body="&lt;p&gt;When logging into the Cisco Device, it will promt for username and password. &#xA;While entering username its visible, Password is not at all seen (even encrypted) what is the reason &lt;/p&gt;&#xA;" OwnerUserId="8828" LastActivityDate="2014-10-17T12:38:21.330" Title="Tacacs Password not visible" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12522" PostTypeId="2" ParentId="12518" CreationDate="2014-10-17T11:07:27.467" Score="3" Body="&lt;p&gt;Your private IP address, 10.155.23.143, can't be sold to anyone. All of the private ranges are reserved for internal use and will not be sold as public addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens is that your router will translate your private IP address into an individual (or shared) public IP address owned by your ISP. Then any packets which are part of your communication stream will be directed back to your individual machine. Your private IP address never leaves your network. This is referred to as Network Address Translation, or NATing, and helps delay the problem of running out of IPv4 addresses.&lt;/p&gt;&#xA;" OwnerUserId="9941" LastActivityDate="2014-10-17T11:07:27.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12523" PostTypeId="2" ParentId="9439" CreationDate="2014-10-17T11:41:00.150" Score="0" Body="&lt;p&gt;You actually can tag VLAN 1 on a force10 switch if you change the native VLAN. The restriction is, you cant tag the native vlan and as VLAN 1 by default is the native vlan you cant tag it. You cant even put an IP on it unless the native vlan is changed.&lt;/p&gt;&#xA;" OwnerUserId="9942" LastActivityDate="2014-10-17T11:41:00.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12524" PostTypeId="2" ParentId="12521" CreationDate="2014-10-17T12:38:21.330" Score="2" Body="&lt;p&gt;Cisco does this is for security-reasons. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine you're working in an office with your colleagues. It would be horrible if any of your colleagues standing next to you could see your password. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This also is a common practice among other systems like Linux...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see the password you're typing you could use a SSH to log in and a SSH Client which allows for showing the password you're typing, which i wouldn't recommend.&lt;/p&gt;&#xA;" OwnerUserId="9943" LastActivityDate="2014-10-17T12:38:21.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12526" PostTypeId="1" AcceptedAnswerId="12761" CreationDate="2014-10-17T12:59:00.453" Score="4" ViewCount="8699" Body="&lt;p&gt;Hi guys I have a couple of questions related to PPPoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When an ISP provides a service and they use a Radius Server for Authentication how does the client router know where to send the Authentication request?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I am of the understanding that when the router is turned on at some point it will send a PPPoE Active Discovery Initiation (PADI) packet, according to this page.&#xA;&lt;a href=&quot;http://whatismyipaddress.com/ppp-pppoe&quot; rel=&quot;nofollow&quot;&gt;http://whatismyipaddress.com/ppp-pppoe&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does the router know the address of the Radius server to send the packet to? Does the packet simply hop from gateway to gateway broadcasting the packet until it hits a Radius server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly whilst using an active internet connection, is it possible to say Authenticate through another PPPoE server outside of the current network so that you can receieve a different public IP? or is the only way to use another network, is to use a VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies if these questions are a bit moronic, I'm just trying to wrap my head around this.&lt;/p&gt;&#xA;" OwnerUserId="6081" LastEditorUserId="775" LastEditDate="2014-12-08T12:16:18.650" LastActivityDate="2014-12-08T12:16:18.650" Title="PPPoE - How does it reach the Radius Server?" Tags="|pppoe|radius|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12530" PostTypeId="2" ParentId="12485" CreationDate="2014-10-17T14:54:27.433" Score="12" Body="&lt;p&gt;I teach TCP, and I often run into people who were mis-taught that the ACK is only sent when the Window Size is reached.  This is not true.  (To be really transparent, I too taught this incorrectly before I knew better as well, so I completely understand the mistake).&lt;/p&gt;&#xA;&lt;p&gt;NOTE, I'll be using Receiver/Sender to describe it, but keep in mind TCP is bidirectional, and both parties maintain a Window Size.&lt;/p&gt;&#xA;&lt;p&gt;The Window Size (that the Receiver sets) is a hard limit on how many bytes the Sender can send without being forced to stop to wait for an acknowledgement.&lt;/p&gt;&#xA;&lt;p&gt;The Window Size &lt;em&gt;does not&lt;/em&gt; determine how often the Receiver should be sending ACKnowledgements.  Originally, the &lt;a href=&quot;http://www.faqs.org/rfcs/rfc793.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP protocol&lt;/a&gt; called for an acknowledgement to be sent after each segment was received.  Later, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122#section-4.2.3.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP was optimized&lt;/a&gt; to allow the Receiver to skip ACKs and send an ACKnowledgment every other packet (or more).&lt;/p&gt;&#xA;&lt;p&gt;The goal of TCP then, is for the Sender to continually be sending packets, without delay or interruption, because it continually receives ACKnowledgements, such that the count of &amp;quot;bytes in transit&amp;quot; is always less than the Window Size.  If at any time, the Sender has sent a count of bytes equal to the window size without receiving an ACK, it is forced to pause sending and wait.&lt;/p&gt;&#xA;&lt;p&gt;The important thing to consider in all this is the Round Trip Time.  Often, when you are studying TCP in a wireshark, you are only seeing the perspective of one party in the TCP conversation, which makes it hard to infer, or truly &amp;quot;see&amp;quot;, the effect of the RTT. To illustrate the effect of RTT, take a look at these &lt;em&gt;two&lt;/em&gt; captures.  They are both capturing the same conversation, a 2MB file download over HTTP, but one is from the &lt;a href=&quot;http://oca.racku.org/pcap/tcp-client.pcap&quot; rel=&quot;nofollow noreferrer&quot;&gt;perspective of the Client&lt;/a&gt;, and the other is from the &lt;a href=&quot;http://oca.racku.org/pcap/tcp-server.pcap&quot; rel=&quot;nofollow noreferrer&quot;&gt;perspective of the Server&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Note: its easier to analyse TCP if you turn &lt;strong&gt;off&lt;/strong&gt; the Wireshark feature &amp;quot;&lt;a href=&quot;http://oca.racku.org/pcap/tcp-subdissector.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Allow subdissector to reassemble TCP streams&lt;/a&gt;&amp;quot;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;Notice from the Server side capture (who is the sender of the file), the Server sends 8 full sized packets in a row (packet#'s 6-13) before receiving the first ACK in packet# 14.  If you drill down in that ACK, notice the Client's acknowledgement is for the segment sent in Packet#7.  And the ACK the Client sent in packet 20 is from the segment sent in Packet#9.&lt;/p&gt;&#xA;&lt;p&gt;See how the Client is indeed acknowledging every other packet.  But it almost seems like it is acknowledging them &amp;quot;late&amp;quot;.  But in fact, this is just the effect of Round Trip Time.  The Sender is able to send 7~ segments in the time it takes for the first segment to reach client and for the client's ACK to reach the server.  If you take a look at the capture from the Client's perspective, it looks very 'clean', which is to say that every second packet it receives, it sends out an ACK.&lt;/p&gt;&#xA;&lt;p&gt;Notice also what happens at Packet# 23.  The Server has sent all it can, because the &amp;quot;bytes in transit&amp;quot; reaches the Window Size, so it is forced to stop sending.  Until the next ACK arrives.  Since the ACK's are coming in every other segment received.  Each ACK allows the sender to again send two new segments, before the Window is full again, and the Server is again forced to pause.  This happens up until Packet# 51, when the Client (Recever) increases the Window Size significantly, allowing the Server (sender) to start transmitting data uninhibited again... at least until Packet #175, when the new Window fills up.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2014-10-17T14:54:27.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12531" PostTypeId="1" AcceptedAnswerId="14667" CreationDate="2014-10-17T16:23:04.290" Score="6" ViewCount="5490" Body="&lt;p&gt;I've (finally) got a VPN tunnel to an AWS VPC up and running.  I'm not a network engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It works fine from the office to the VPC, but remote users cannot access anything through this site-to-site tunnel.  Just to eliminate anything on the AWS side I've set a #1 ACL rule to allow all traffic and I have a test VM with a security group that allows all traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All we really care about is office and remote (10.0.0.0/8) to VPC (172.17.0.0/16) traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll try to post relevant config info, but let me know if you need more which I will gladly share.  The only things I've redacted are the AWS tunnel IPs and our office's outside IP address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;access lists&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# show run access-list&#xA;access-list inside_nat0_outbound extended permit ip any 10.0.0.0 255.255.255.192 &#xA;access-list Split_Tunnel_List standard permit 10.0.0.0 255.255.255.0 &#xA;access-list Split_Tunnel_List standard permit 172.17.0.0 255.255.0.0 &#xA;access-list acl-amzn extended permit ip any 172.17.0.0 255.255.0.0 &#xA;access-list amzn-filter extended permit ip 172.17.0.0 255.255.0.0 10.0.0.0 255.0.0.0 &#xA;access-list amzn-filter extended deny ip any any &#xA;access-list outside_access_in extended permit ip host AWS_TUNNEL_IP_1 host OFFICE_OUTSIDE_IP&#xA;access-list outside_access_in extended permit ip host AWS_TUNNEL_IP_2 host OFFICE_OUTSIDE_IP&#xA;ciscoasa(config)# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;group-policy&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# show run group-policy&#xA;group-policy RA_GROUP internal&#xA;group-policy RA_GROUP attributes&#xA; dns-server value 8.8.8.8 8.8.4.4&#xA; vpn-tunnel-protocol IPSec &#xA; split-tunnel-network-list value Split_Tunnel_List&#xA;group-policy filter internal&#xA;group-policy filter attributes&#xA; vpn-filter value amzn-filter&#xA;ciscoasa(config)# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;crypto map&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# show run crypto map&#xA;crypto map outside_map 1 match address acl-amzn&#xA;crypto map outside_map 1 set pfs &#xA;crypto map outside_map 1 set peer AWS_TUNNEL_IP_1 AWS_TUNNEL_IP_2 &#xA;crypto map outside_map 1 set transform-set transform-amzn&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map outside_map interface outside&#xA;ciscoasa(config)# show run nat&#xA;nat (inside) 0 access-list acl-amzn&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;nat (outside) 1 10.0.0.0 255.255.255.0&#xA;ciscoasa(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;same-security-traffic&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# show run same-security-traffic &#xA;same-security-traffic permit intra-interface&#xA;ciscoasa(config)# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ping from 10.0.0.15 to VPC works&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# packet-tracer input inside icmp 10.0.0.15 0 8 172.17.44.71      &#xA;&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: input&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   0.0.0.0         0.0.0.0         outside&#xA;&#xA;Phase: 2&#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 3&#xA;Type: INSPECT&#xA;Subtype: np-inspect&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 4&#xA;Type: NAT-EXEMPT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;  match ip inside any outside 172.17.0.0 255.255.0.0&#xA;    NAT exempt&#xA;    translate_hits = 258, untranslate_hits = 104&#xA;Additional Information:&#xA;&#xA;Phase: 5&#xA;Type: NAT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;  match ip inside any outside any&#xA;    dynamic translation to pool 1 (OFFICE_OUTSIDE_IP [Interface PAT])&#xA;    translate_hits = 9425616, untranslate_hits = 1313465&#xA;Additional Information:&#xA;&#xA;Phase: 6&#xA;Type: NAT&#xA;Subtype: host-limits&#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;  match ip inside any inside any&#xA;    dynamic translation to pool 1 (No matching global)&#xA;    translate_hits = 0, untranslate_hits = 0&#xA;Additional Information:&#xA;&#xA;Phase: 7&#xA;Type: HOST-LIMIT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 8&#xA;Type: ACCESS-LIST&#xA;Subtype: vpn-user&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 9&#xA;Type: VPN&#xA;Subtype: encrypt&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 10&#xA;Type: FLOW-CREATION&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;New flow created with id 10392911, packet dispatched to next module&#xA;&#xA;Result:&#xA;input-interface: inside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: outside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: allow&#xA;&#xA;ciscoasa(config)# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ping from office outside IP fails&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# packet-tracer input inside icmp OFFICE_OUTSIDE_IP 0 8 172.17.44.71 detailed &#xA;&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: input&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   0.0.0.0         0.0.0.0         outside&#xA;&#xA;Phase: 2&#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0xc959e0e0, priority=0, domain=inspect-ip-options, deny=true&#xA;    hits=9738259, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0&#xA;    src ip=0.0.0.0, mask=0.0.0.0, port=0&#xA;    dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0&#xA;&#xA;Phase: 3&#xA;Type: INSPECT&#xA;Subtype: np-inspect&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0xc959dd58, priority=66, domain=inspect-icmp-error, deny=false&#xA;    hits=305383, user_data=0xc959dc40, cs_id=0x0, use_real_addr, flags=0x0, protocol=1&#xA;    src ip=0.0.0.0, mask=0.0.0.0, port=0&#xA;    dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0&#xA;&#xA;Phase: 4&#xA;Type: NAT-EXEMPT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;  match ip inside any outside 172.17.0.0 255.255.0.0&#xA;    NAT exempt&#xA;    translate_hits = 259, untranslate_hits = 107&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0xc9603e48, priority=6, domain=nat-exempt, deny=false&#xA;    hits=271, user_data=0xca1792f8, cs_id=0x0, use_real_addr, flags=0x0, protocol=0&#xA;    src ip=0.0.0.0, mask=0.0.0.0, port=0&#xA;    dst ip=172.17.0.0, mask=255.255.0.0, port=0, dscp=0x0&#xA;&#xA;Phase: 5&#xA;Type: NAT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;  match ip inside any outside any&#xA;    dynamic translation to pool 1 (OFFICE_OUTSIDE_IP[Interface PAT])&#xA;    translate_hits = 9431076, untranslate_hits = 1314029&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0xc9620cf8, priority=1, domain=nat, deny=false&#xA;    hits=10741033, user_data=0xc9620c38, cs_id=0x0, flags=0x0, protocol=0&#xA;    src ip=0.0.0.0, mask=0.0.0.0, port=0&#xA;    dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0&#xA;&#xA;Phase: 6&#xA;Type: NAT&#xA;Subtype: host-limits&#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;  match ip inside any inside any&#xA;    dynamic translation to pool 1 (No matching global)&#xA;    translate_hits = 0, untranslate_hits = 0&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0xc96208b8, priority=1, domain=host, deny=false&#xA;    hits=10681997, user_data=0xc9620538, cs_id=0x0, reverse, flags=0x0, protocol=0&#xA;    src ip=0.0.0.0, mask=0.0.0.0, port=0&#xA;    dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0&#xA;&#xA;Phase: 7&#xA;Type: HOST-LIMIT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0xc95a1058, priority=0, domain=host-limit, deny=false&#xA;    hits=3610687, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0&#xA;    src ip=0.0.0.0, mask=0.0.0.0, port=0&#xA;    dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0&#xA;&#xA;Phase: 8&#xA;Type: ACCESS-LIST&#xA;Subtype: vpn-user&#xA;Result: DROP&#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; out id=0xca201808, priority=12, domain=vpn-user, deny=true&#xA;    hits=17, user_data=0xc793c300, filter_id=0x4(amzn-filter), protocol=0&#xA;    src ip=0.0.0.0, mask=0.0.0.0, port=0&#xA;    dst ip=0.0.0.0, mask=0.0.0.0, port=0&#xA;&#xA;Result:&#xA;input-interface: inside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: outside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: drop&#xA;Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;&#xA;ciscoasa(config)# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sysopt&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# show run all sysopt&#xA;no sysopt connection timewait&#xA;sysopt connection tcpmss 1387&#xA;sysopt connection tcpmss minimum 0&#xA;sysopt connection permit-vpn&#xA;sysopt connection reclassify-vpn&#xA;no sysopt connection preserve-vpn-flows&#xA;no sysopt nodnsalias inbound&#xA;no sysopt nodnsalias outbound&#xA;no sysopt radius ignore-secret&#xA;no sysopt noproxyarp inside&#xA;no sysopt noproxyarp outside&#xA;ciscoasa(config)# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Turning on &lt;code&gt;debug icmp trace&lt;/code&gt; and pinging from a remote connection yields nothing when I try to ping something through the site-to-site tunnel.  When I try to ping something in the office LAN I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ICMP echo request from outside:10.0.0.19 to outside:10.0.1.34 ID=12 seq=0 len=8&#xA;ICMP echo request translating outside:10.0.0.19/12 to outside:OFFICE_OUTSIDE_IP/47077&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;10.0.0.19 is the remote connection's IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the office LAN I can successfully ping AWS VMs through the site-to-site tunnel but the pings fail if done directly from the ASA 5505.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if this is normal behavior but to my untrained eyes it looks like the remote connection is being treated as an outside connection.  I would have assumed if you're connected via the VPN you'd be considered inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the route table when connected remotely minus the IPv6 section(produced by &lt;code&gt;netstat -nr&lt;/code&gt; on a macbook):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Routing tables&#xA;&#xA;Internet:&#xA;Destination        Gateway            Flags        Refs      Use   Netif Expire&#xA;default            link#12            UCS            16        0   utun1&#xA;default            10.128.128.128     UGScI          16        0     en0&#xA;8.8.8.8            link#12            UHWIi           6       41   utun1&#xA;10                 link#4             UCS             1        0     en0&#xA;10.0.0.19          10.0.0.19          UH              0       11   utun1&#xA;10.128.128.128/32  link#4             UCS             1        0     en0&#xA;10.128.128.128     0:18:a:34:c7:94    UHLWIir        19       89     en0   1198&#xA;10.243.58.109/32   link#4             UCS             0        0     en0&#xA;10.255.255.255     ff:ff:ff:ff:ff:ff  UHLWbI          0        3     en0&#xA;17.146.233.11      link#12            UHW3I           0        5   utun1     10&#xA;17.158.28.36       link#12            UHWIi           2       10   utun1&#xA;17.171.4.15        link#12            UHWIi           1        1   utun1&#xA;17.172.224.14      link#12            UHWIi           1        3   utun1&#xA;17.172.232.134     link#12            UHWIi           1       23   utun1&#xA;17.173.254.222     link#12            UHW3I           0        9   utun1      9&#xA;17.173.254.223     link#12            UHW3I           0        4   utun1      9&#xA;23.211.232.189     link#12            UHW3I           0       17   utun1      7&#xA;23.212.21.149      link#12            UHWIi           1        4   utun1&#xA;74.125.25.188      link#12            UHWIi           1       14   utun1&#xA;74.125.28.125      link#12            UHWIi           1       71   utun1&#xA;74.125.239.17      link#12            UHWIi           1       18   utun1&#xA;74.125.239.181     link#12            UHWIi           1       19   utun1&#xA;127                127.0.0.1          UCS             0        0     lo0&#xA;127.0.0.1          127.0.0.1          UH              1    39007     lo0&#xA;169.254            link#4             UCS             0        0     en0&#xA;OFFICE_OUTSIDE_IP  10.128.128.128     UGHS            3        1     en0&#xA;OFFICE_OUTSIDE_IP  link#12            UHW3I           0        3   utun1      6&#xA;224.0.0.251        link#12            UHmW3I          0        0   utun1     10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A cleaner route table from my home linux box connected to the VPN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ route -n&#xA;Kernel IP routing table&#xA;Destination       Gateway         Genmask         Flags Metric Ref    Use Iface&#xA;0.0.0.0           0.0.0.0         0.0.0.0         U     0      0        0 tun0&#xA;10.0.0.0          0.0.0.0         255.255.255.0   U     0      0        0 tun0&#xA;OFFICE_OUTSIDE_IP 192.168.1.1     255.255.255.255 UGH   0      0        0 eth0&#xA;192.168.1.0       0.0.0.0         255.255.255.0   U     1      0        0 eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As an experiment (AKA grasping at straws) I added the OFFICE_OUTSIDE_IP to the amazon-filter access list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list amzn-filter extended permit ip 172.17.0.0 255.255.0.0 10.0.0.0 255.0.0.0 &#xA;access-list amzn-filter extended permit ip 172.17.0.0 255.255.0.0 host OFFICE_OUTSIDE_IP &#xA;access-list amzn-filter extended deny ip any any &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With that in place, and &lt;code&gt;debug icmp trace&lt;/code&gt; I can see ping attempts from remote connections, but the pings still fail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ICMP echo request from outside:10.0.0.19 to outside:172.17.44.71 ID=22350 seq=2 len=56&#xA;ICMP echo request translating outside:10.0.0.19/22350 to outside:OFFICE_OUTSIDE_IP/8998&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The current running config is &lt;a href=&quot;https://gist.github.com/pmac72/f483ea8c7c8c8c254626&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;.  Anything that I edited in the configuration should be pretty obvious.  The address spaces are messy due to what I inherited.  I do hope to clean that up in the future.&lt;/p&gt;&#xA;" OwnerUserId="9928" LastEditorUserId="9928" LastEditDate="2014-10-23T16:38:18.877" LastActivityDate="2014-12-16T19:30:24.493" Title="Cisco ASA 5505 Remote Users Cannot Access site-to-site tunnel" Tags="|cisco-asa|vpn|" AnswerCount="4" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12534" PostTypeId="1" AcceptedAnswerId="12535" CreationDate="2014-10-17T17:30:39.273" Score="11" ViewCount="9981" Body="&lt;p&gt;In TCP header, what happens when both SYN and FIN flags are set to 1? Or, can both even be simultaneously set to 1 ?&lt;/p&gt;&#xA;" OwnerUserId="9949" LastEditorUserId="8499" LastEditDate="2018-10-27T02:14:48.897" LastActivityDate="2018-10-27T02:14:48.897" Title="What happens when SYN and FIN flags in TCP headers are both set to 1?" Tags="|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12535" PostTypeId="2" ParentId="12534" CreationDate="2014-10-17T17:40:35.457" Score="12" Body="&lt;p&gt;In normal TCP behavior, they should never both be set to 1 (on) in the same packet.  There are &lt;a href=&quot;http://sectools.org/tag/packet-crafters/&quot;&gt;many tools that exist that let you craft TCP packets&lt;/a&gt;, and the typical response to a packet with SYN and FIN bits set to one is a RST, since you are violating the rules of TCP.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-10-17T17:40:35.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12537" PostTypeId="2" ParentId="12534" CreationDate="2014-10-17T19:53:20.850" Score="9" Body="&lt;p&gt;One type of attack in the olden days was to have every Flags set to 1.  That was:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Nonce&lt;/li&gt;&#xA;&lt;li&gt;CWR&lt;/li&gt;&#xA;&lt;li&gt;ECN-ECHO&lt;/li&gt;&#xA;&lt;li&gt;URGENT&lt;/li&gt;&#xA;&lt;li&gt;ACK &lt;/li&gt;&#xA;&lt;li&gt;Push &lt;/li&gt;&#xA;&lt;li&gt;RST &lt;/li&gt;&#xA;&lt;li&gt;SYN &lt;/li&gt;&#xA;&lt;li&gt;FIN&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A few implementation of IP stacks didn't check correctly and crashed.  It was called a Christmas Tree Packet&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-10-17T19:53:20.850" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12538" PostTypeId="1" CreationDate="2014-10-17T22:11:47.490" Score="1" ViewCount="440" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/oYDh2.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oYDh2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt; Suppose i want to transmit a frame from IP 179.58.10.101 to 179.58.20.11,&#xA;How forwarding tables are built for each switch in newly configured Virtual LAN when all devices are just turned on? All PCs were configured with static IP address.&lt;/p&gt;&#xA;" OwnerUserId="9953" LastEditorUserId="9953" LastEditDate="2014-10-17T22:43:47.513" LastActivityDate="2014-10-17T23:21:56.777" Title="Virtual LAN configuration" Tags="|vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12539" PostTypeId="2" ParentId="12538" CreationDate="2014-10-17T22:18:31.710" Score="1" Body="&lt;p&gt;A switch doesn't particularly care of, nor make note of, whatever IP addresses are in use on frames traversing the switch ports.  A switch only cares about the MAC address.  Every time a frame is &lt;em&gt;received&lt;/em&gt; on a particular switch port, the Switch learns the frame's &lt;em&gt;source MAC address&lt;/em&gt;.   How this works with VLANs, is that &lt;strong&gt;each VLAN on a switch has its own, independent MAC address table&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the following topology, a packet from HostA to HostB would bounce between each switch, going from VLAN to VLAN.  The switch, upon receiving the frame, would learn each time from the &lt;em&gt;source MAC address&lt;/em&gt; of each frame received, on each VLAN, on each Port.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gHRFQ.png&quot; alt=&quot;Frame Bouncing between two Switches&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end, after a packet had gone from HostA to HostB and back, the fully populated MAC address tables would look like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TOP Switch:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN    PORT    MAC Address&#xA;10      1       aaaa.aaaa.aaaa&#xA;10      3       bbbb.bbbb.bbbb&#xA;30      5       aaaa.aaaa.aaaa&#xA;30      7       bbbb.bbbb.bbbb&#xA;50      9       aaaa.aaaa.aaaa&#xA;50      11      bbbb.bbbb.bbbb&#xA;70      13      aaaa.aaaa.aaaa&#xA;70      15      bbbb.bbbb.bbbb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BOTTOM Switch:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN    PORT    MAC Address&#xA;20      3       aaaa.aaaa.aaaa&#xA;20      5       bbbb.bbbb.bbbb&#xA;40      7       aaaa.aaaa.aaaa&#xA;40      9       bbbb.bbbb.bbbb&#xA;60      11      aaaa.aaaa.aaaa&#xA;60      13      bbbb.bbbb.bbbb&#xA;80      15      aaaa.aaaa.aaaa&#xA;80      17      bbbb.bbbb.bbbb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;NOTE1: I intentionally didn't put IP addresses on my hosts, because they are entirely inconsequential and would not affect the behavior described above whatsoever.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;NOTE2: Port 3 of the TOP switch is in VLAN 10.  Port 3 of the BOTTOM switch is in VLAN 20.  But we'll assume these are both &lt;strong&gt;access ports&lt;/strong&gt; and therefore the traffic leaves the switchports untagged.  As such, the BOTTOM switch doesn't know of (or care about) VLAN 10, and the TOP switch doesn't know of (or care about) VLAN 20.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Yikes, your question changed drastically.  I'm going to leave my original anwer, because I still think it is relevant to your (new) question.  But to properly answer it, I had to add to your picture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/DJyPy.jpg&quot; alt=&quot;enter image description here&quot;&gt;&#xA;Before you can really understand how the Switches learn source MAC addresses, you have to learn how the packet travels from HostA (on the left), to HostB (on the right).  I put numbers at each position of the packet and the direction it is traveling to get to HostB.  The Src/Dst IP/MAC at each position would be as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;** Position 1 **&#xA;Src IP : 179.58.10.101          Src MAC: aaaa.aaaa.aaaa&#xA;Dst IP : 179.58.20.11           Dst MAC: eeee.eeee.eeee&#xA;&#xA;** Position 2 **&#xA;Src IP : 179.58.10.101          Src MAC: aaaa.aaaa.aaaa&#xA;Dst IP : 179.58.20.11           Dst MAC: eeee.eeee.eeee&#xA;&#xA;** Position 3 **&#xA;Src IP : 179.58.10.101          Src MAC: eeee.eeee.eeee&#xA;Dst IP : 179.58.20.11           Dst MAC: bbbb.bbbb.bbbb&#xA;&#xA;** Position 4 **&#xA;Src IP : 179.58.10.101          Src MAC: eeee.eeee.eeee&#xA;Dst IP : 179.58.20.11           Dst MAC: bbbb.bbbb.bbbb&#xA;&#xA;** Position 5 **&#xA;Src IP : 179.58.10.101          Src MAC: eeee.eeee.eeee&#xA;Dst IP : 179.58.20.11           Dst MAC: bbbb.bbbb.bbbb&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you take this information, and map out what the switches are doing at each step, you would end up with MAC address table as below for each switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;** Switch1 MAC Address Table **&#xA;Port facing HostA   - VLAN 10 - aaaa.aaaa.aaaa&#xA;Port facing Router  - VLAN 10 - eeee.eeee.eeee (not learned until HostB responds)&#xA;Port facing Router  - VLAN 20 - eeee.eeee.eeee&#xA;Port facing Switch3 - VLAN 20 - bbbb.bbbb.bbbb (not learned until HostB responds)&#xA;&#xA;** Switch3 MAC Address Table **&#xA;Port facing Switch1 - VLAN 20 - eeee.eeee.eeee&#xA;Port facing HostB   - VLAN 20 - bbbb.bbbb.bbbb (not learned until HostB responds)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(I provided what the switch would learn on the return path when HostB responds to HostA as well, but if you are only interested in how the switches would populate with a packet from HostA to HostB ONLY, then please ignore those lines)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2014-10-17T23:17:55.347" LastActivityDate="2014-10-17T23:17:55.347" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12540" PostTypeId="1" AcceptedAnswerId="12553" CreationDate="2014-10-17T22:22:51.653" Score="14" ViewCount="5163" Body="&lt;p&gt;I recently read an article entitled &lt;a href=&quot;http://computer.howstuffworks.com/nat.htm&quot; rel=&quot;noreferrer&quot; title=&quot;How NAT works&quot;&gt;how NAT works&lt;/a&gt;. Some things still remain unclear to me. I would be thankful if someone could explain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the part of the article regarding DynamicNAT that is most confusing:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A computer on the stub domain attempts to connect to a computer&#xA;  outside the network, such as a Web server.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The router receives the packet from the computer on the stub domain.&#xA;  The router saves the computer's non-routable IP address to an address&#xA;  translation table. The router replaces the sending computer's&#xA;  non-routable IP address with the first available IP address out of the&#xA;  range of unique IP addresses. The translation table now has a mapping&#xA;  of the computer's non-routable IP address matched with the one of the&#xA;  unique IP addresses.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When a packet comes back from the destination computer, the router&#xA;  checks the destination address on the packet. It then looks in the&#xA;  address translation table to see which computer on the stub domain the&#xA;  packet belongs to.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;1) How does NAT know that the packet &quot;comes back&quot; to destination computer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) What if other computers in the LAN are connected to the same server? How does the NAT know which packet should &quot;come back&quot; where?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Does the packet header modification allow to perform an Internet attack, in which the &quot;source IP&quot; is replaced with the victim's IP, and the answering server will flood victim with unwanted packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess multiple attackers would need to be involved...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Is StaticNAT equivalent to the PortForwarding of all ports?&lt;/p&gt;&#xA;" OwnerUserId="9952" LastEditorUserId="775" LastEditDate="2014-10-18T11:37:11.437" LastActivityDate="2014-10-18T13:25:32.060" Title="How NAT / PortForwarding / TCP/IP works?" Tags="|nat|tcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12541" PostTypeId="2" ParentId="12531" CreationDate="2014-10-17T22:33:13.820" Score="1" Body="&lt;p&gt;I think your vpn-filter is causing an issue and isn't necessary. Try removing it by doing &lt;code&gt;clear config group-policy filter&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check that you have this setting turned on:&#xA;&lt;code&gt;sysopt connection permit-vpn&lt;/code&gt; by doing &lt;code&gt;show run all sysopt&lt;/code&gt;. &#xA;When that is on, all of the VPN traffic will bypass the interface ACL and you won't have a need for the VPN-Filter.&lt;/p&gt;&#xA;" OwnerUserId="949" LastActivityDate="2014-10-17T22:33:13.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12543" PostTypeId="2" ParentId="12540" CreationDate="2014-10-17T23:01:24.123" Score="6" Body="&lt;p&gt;The router knows where packets belong because &lt;code&gt;The router saves ... an address translation table.&lt;/code&gt; It remembers what inside-outside address translations it has made. As such, one inside address equals one outside address, and the out-on-the-internet destination is irrelevant. This, of course, ignores the firewall present in practically every NAT router, which tracks full connections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(inside) src:ip+port,dst:ip+port &amp;lt;-&amp;gt; (outside) src:ip+port,dst:ip+port&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NAT can change any combination of ip and/or port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;#3 is any entirely different subject: &lt;em&gt;spoofing&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;#4 &quot;Static NAT&quot;, or &quot;1-to-1&quot;, is an address only map. So, port (and even protocol: tcp, udp, gre, etc.) is irrelevant.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-10-17T23:35:21.953" LastActivityDate="2014-10-17T23:35:21.953" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12545" PostTypeId="2" ParentId="12538" CreationDate="2014-10-17T23:21:56.777" Score="1" Body="&lt;p&gt;The only thing Eddie left out is what happens when the table is empty, or otherwise has no destination port for a given MAC. In that case, the packet is &lt;em&gt;unicast flood&lt;/em&gt; to all ports; it doesn't know where the frame belongs, so it's sent everywhere.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-10-17T23:21:56.777" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12548" PostTypeId="2" ParentId="12508" CreationDate="2014-10-18T03:32:10.190" Score="4" Body="&lt;p&gt;If you don't have control over the router that you are trying to query it is going to be difficult to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By spoofing a PIM query or join, the router isn't going to tell you what its has in its routing table, it will start forwarding you the data and you'll be able to see all the sources.  So if you don't have any control over the router this maybe your only option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that in multicast routing all the routing decisions are made by that one router alone, based on the routers unicast routing table.  So there isn't really a mechanism to learn someone else multicast routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are SNMP MIBs for querying the mroute table, but that again would require some level of control over the router you wish to query. &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.83.1.1.2.1#oidContent&quot; rel=&quot;nofollow&quot;&gt;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.83.1.1.2.1#oidContent&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another method, if you had control over the router, is to use MSDP.  &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfmsdp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfmsdp.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast Source Discovery Protocol will allow RPs in a network to share the sources for multicast groups with each other.  However, you need to setup a MSDP peer between each RP to do so.&lt;/p&gt;&#xA;" OwnerUserId="8265" LastActivityDate="2014-10-18T03:32:10.190" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12551" PostTypeId="2" ParentId="11007" CreationDate="2014-10-18T07:20:47.560" Score="2" Body="&lt;p&gt;No, PPP, HDLC, FR do not have their own MAC. In the OSI model, MAC is associated with layer 2. PPP, HDLC, FR are on L2 as well. But LLC is associated with L1, the physical layer. MAC is not just a theoretical concept like a sublayer, MAC is a protocol by itself. There are many LLC protocols, but there is only one MAC, with the exception of a VLAN tag field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let us have a look at the third and the fourth field of a MAC portion of an Ethernet frame: Destination MAC Address; Source MAC Address. An address is 6 bytes long. In comparison, an HDLC address is 1 byte long. FR and PPP frames reach their destination very differently from MAC or HDLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a nutshell, Ethernet formats network data on both L2 and L1, while PPP, HDLC, FR stay on L2. That is why none of them needs an extra sublayer.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2014-10-18T07:20:47.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12553" PostTypeId="2" ParentId="12540" CreationDate="2014-10-18T13:25:32.060" Score="12" Body="&lt;p&gt;There is a general misconception between &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_address_translation&quot; rel=&quot;noreferrer&quot;&gt;NAT&lt;/a&gt; (Network address translation) and PAT (Port Address Translation), which is what we mostly use in our home routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NAT&lt;/strong&gt;&lt;br&gt;&#xA;Let's assume we have a network with the following topology:&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Private_Network&lt;/em&gt; &amp;lt;-------&gt; &lt;em&gt;Router&lt;/em&gt; &amp;lt;-------&gt; &lt;em&gt;The_Internet&lt;/em&gt; &lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interface of the &lt;em&gt;Router&lt;/em&gt; that is connected to the &lt;em&gt;Private_Network&lt;/em&gt; has &lt;a href=&quot;http://en.wikipedia.org/wiki/Private_network&quot; rel=&quot;noreferrer&quot;&gt;a private IP address&lt;/a&gt;, i.e. one that is not unique in &lt;em&gt;The_Internet&lt;/em&gt;. On the other hand, in the case of &lt;strong&gt;NAT&lt;/strong&gt;, &lt;em&gt;Router&lt;/em&gt; has &lt;strong&gt;multiple&lt;/strong&gt; interfaces connected to &lt;em&gt;The_Internet&lt;/em&gt;. Each interface has a unique IP address in &lt;em&gt;The_Internet&lt;/em&gt;. Now let's assume that &lt;em&gt;Host_A&lt;/em&gt; and &lt;em&gt;Host_B&lt;/em&gt; are in the &lt;em&gt;Private_Network&lt;/em&gt; and they both want to access &lt;em&gt;Website_X&lt;/em&gt; in &lt;em&gt;The_Internet&lt;/em&gt; at the same time. The IPs and the ports of &lt;em&gt;Host_A&lt;/em&gt;'s packet will be:&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source IP: &lt;em&gt;Host_A&lt;/em&gt;'s private IP&lt;br&gt;&#xA;Source Port: A port on &lt;em&gt;Host_A&lt;/em&gt;&lt;br&gt;&#xA;Destination IP: &lt;em&gt;Website_X&lt;/em&gt;'s public/unique IP&lt;br&gt;&#xA;Destination Port: A port where &lt;em&gt;Website_X&lt;/em&gt;'s server is listening to&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and in the same way for a packet coming from &lt;em&gt;Host_B&lt;/em&gt;.&lt;br&gt;&#xA;If the Source IP is left unchanged, then &lt;em&gt;Website_X&lt;/em&gt; will reply to an IP address that is private, i.e. not unique, and therefore the packet will never be able to find it's way back. In order to solve that problem, the &lt;em&gt;Router&lt;/em&gt; checks whether one of his unique IP addresses connected to &lt;em&gt;The_Internet&lt;/em&gt; is not used. If that is the case, it does the following mapping:&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Host_A&lt;/em&gt;'s private IP ======= &lt;em&gt;Router's_unique_IP_K&lt;/em&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and now the packet that started from &lt;em&gt;Host_A&lt;/em&gt; going to &lt;em&gt;Website_X&lt;/em&gt; and is now leaving the interface of the &lt;em&gt;Router&lt;/em&gt; connected to &lt;em&gt;The_Internet&lt;/em&gt; will have the form:&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source IP: &lt;em&gt;Router's_unique_IP_K&lt;/em&gt;&lt;br&gt;&#xA;Source Port: A port on &lt;em&gt;Host_A&lt;/em&gt;&lt;br&gt;&#xA;Destination IP: &lt;em&gt;Website_X&lt;/em&gt;'s public/unique IP&lt;br&gt;&#xA;Destination Port: A port where &lt;em&gt;Website_X&lt;/em&gt;'s server is listening to&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus you can understand that there is an one-to-one association from private IPs to public IPs. Therefore when a packet arrives from &lt;em&gt;Website_X&lt;/em&gt; to the &lt;em&gt;Router&lt;/em&gt;, this association is checked and the destination IP address is changed back to the private one and delivered successfully to the right host. &lt;br&gt;&#xA;As you can see, this method is quite simple, but it has one big disadvantage: each private host has to have a unique IP address reserved, which is expensive, thus we select to have fewer unique IP addresses than hosts in the private network. Therefore if all the private hosts attempt to access &lt;em&gt;The_Internet&lt;/em&gt; at the same time, only a subset of them, equal to the number of the available public IP addresses that the &lt;em&gt;Router&lt;/em&gt; has, will have access and the rest will be denied.&lt;br&gt;&#xA;In order to counter that we created &lt;strong&gt;PAT&lt;/strong&gt;. &lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PAT&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;PAT&lt;/strong&gt; is what the vast majority of our home routers is using. The basic limitation is that the &lt;em&gt;Router&lt;/em&gt; has a single unique IP address with which it connects to &lt;em&gt;The_Internet&lt;/em&gt;, but we still want to allow multiple hosts from the private network to access &lt;em&gt;The_Internet&lt;/em&gt; at the same time. &lt;br&gt;&#xA;The way we do that is &quot;similar&quot; to the way &lt;strong&gt;NAT&lt;/strong&gt; does it with a key difference: instead of the &lt;em&gt;Router&lt;/em&gt; holding a pool of IP address, it holds a pool of port numbers. More precisely, a packet arriving at the &lt;em&gt;Router&lt;/em&gt; from &lt;em&gt;Host_A&lt;/em&gt; in the &lt;em&gt;Private_Network&lt;/em&gt; destined to &lt;em&gt;Website_X&lt;/em&gt; in &lt;em&gt;The_Internet&lt;/em&gt; will have the following format:&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source IP: &lt;em&gt;Host_A&lt;/em&gt;'s private IP&lt;br&gt;&#xA;Source Port: A port on &lt;em&gt;Host_A&lt;/em&gt;&lt;br&gt;&#xA;Destination IP: &lt;em&gt;Website_X&lt;/em&gt;'s public/unique IP&lt;br&gt;&#xA;Destination Port: A port where &lt;em&gt;Website_X&lt;/em&gt;'s server is listening to&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the &lt;em&gt;Router&lt;/em&gt; will do two tasks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It will change the Source IP to the &lt;em&gt;Router&lt;/em&gt;'s unique public IP &lt;strong&gt;AND&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;It will change the Source Port to a port from a pool that the &lt;em&gt;Router&lt;/em&gt; is maintaining and is not already used, e.g. &lt;em&gt;Port_Z&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;and now the packet that started from &lt;em&gt;Host_A&lt;/em&gt; going to &lt;em&gt;Website_X&lt;/em&gt; and is now leaving the interface of the &lt;em&gt;Router&lt;/em&gt; connected to &lt;em&gt;The_Internet&lt;/em&gt; will have the form:&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source IP: &lt;em&gt;Router's_unique_IP_K&lt;/em&gt;&lt;br&gt;&#xA;Source Port: &lt;em&gt;Port_Z&lt;/em&gt;&lt;br&gt;&#xA;Destination IP: &lt;em&gt;Website_X&lt;/em&gt;'s public/unique IP&lt;br&gt;&#xA;Destination Port: A port where &lt;em&gt;Website_X&lt;/em&gt;'s server is listening to&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the &lt;em&gt;Router&lt;/em&gt; will keep the following mapping:&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Host_A&lt;/em&gt;'s private IP &lt;strong&gt;AND&lt;/strong&gt; a port on &lt;em&gt;Host_A&lt;/em&gt; ======= &lt;em&gt;Port_Z&lt;/em&gt;&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does this work?&lt;br&gt; &#xA;Now when a packet comes back, the &lt;em&gt;Router&lt;/em&gt; simply checks the destination port number and changes the destination IP address and the destination port number according to the pre-mentioned mapping and the packet gets delivered successfully. &lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if I run multiple applications on the same Host?&lt;br&gt;&#xA;Different applications will have different ports, by definition, thus they will mapped to a different port from the &lt;em&gt;Router&lt;/em&gt;.&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if multiple Hosts attempt to access &lt;em&gt;The_Internet&lt;/em&gt; at the same time and they all use the same application?&lt;br&gt;&#xA;Different Hosts will have different private IP addresses, by definition, thus they will mapped to a different port from the &lt;em&gt;Router&lt;/em&gt;.&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PAT&lt;/strong&gt; is dangerously balancing in a grey space of cross-layer. Port numbers are part of the Transport Protocol while Routers are allowed to operate up to the Internet Protocol. So technically speaking is something that is not allowed by the protocols. Therefore there are, at least theoretically, potential dangers: the port pool is limited. Therefore if my private network consists of 1000 Hosts and each one is running port_pool/10 applications, the mapping table at the router will run out of available entries and access to applications will be denied.&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This answer greatly exceeded my intended length, but I hope it was helpful.&lt;/p&gt;&#xA;" OwnerUserId="9916" LastActivityDate="2014-10-18T13:25:32.060" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12555" PostTypeId="2" ParentId="12517" CreationDate="2014-10-18T18:29:52.320" Score="2" Body="&lt;p&gt;Nodal delay would be delay from a node in the network path, this is to separate it from delay caused by circuit length (distance/speed of light in fiber, etc.) or client/server delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the packet is passing through a VPN, the VPN device is a 'network node' to the packet and would be counted.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-10-18T18:29:52.320" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12556" PostTypeId="1" AcceptedAnswerId="16623" CreationDate="2014-10-18T19:04:33.860" Score="1" ViewCount="1155" Body="&lt;p&gt;While parsing an &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6396#page-9&quot; rel=&quot;nofollow noreferrer&quot;&gt;TABLE_DUMP_V2 RIB_IPV6_UNICAST&lt;/a&gt; entry I encountered this binary sequence representing a &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4760&quot; rel=&quot;nofollow noreferrer&quot;&gt;MP_REACH_NLRI&lt;/a&gt; BGP Path Attribute:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;80 E 26 0 2 1 20 20 1 5 4 0 1 0 0 0 0 A5 1 30 30&#xA; 0 1 FE 80 0 0 0 0 0 0 2 1B ED FF FE 32 A1 1 0 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Whereas:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  Attribute Header&#xA;  80  -&amp;gt; 10000000 attribute is optional and no other flag set&#xA;  E   -&amp;gt; attribute type 14 (MP_REACH_NLRI)&#xA;  26  -&amp;gt; a length of 38 octets&#xA;  Attribute&#xA;  0 2 -&amp;gt; AFI-Type two is IPv6 (as indicated by dump subtype)&#xA;  1   -&amp;gt; SAFI-Type 1 which is unicast (as indicated by dump subtype)&#xA;  20  -&amp;gt; indicates a length of 32 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And that last part is the point where I am confused as an IPv6 address is supposed to be at most 16 bytes of length and the rfc does not state that more than a single next hop address can be specified.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;How am I supposed to interprete an IPv6 address(es?) of length 32 in this context?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="8570" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2018-12-27T01:55:42.397" Title="How to interpret MP_REACH_NLRI attribute with address length of 32 bytes contained in a MRT Dump" Tags="|bgp|protocol-theory|rfc|bgp-ipv6|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12557" PostTypeId="1" AcceptedAnswerId="12581" CreationDate="2014-10-19T05:36:41.597" Score="3" ViewCount="2471" Body="&lt;p&gt;I have a dilemma; I have a customer with an application server running on CentOS 5 (latest).  The app server is configured with 2 interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eth0 - connect to the client network with subnet 192.168.3.0/24&#xA;eth1 - connects to local subnet which hosts all the devices the application manages with subnet 192.168.1.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is that the client has a remote office which has a subnet that overlaps with the app server internal network (namely 192.168.1.0/24) and would like the users in that subnet to have access to the app server.  Here's some ascii art to help get the topology across:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|--------------------------------------------|                |---------------------------------------------------|&#xA;|    Application Server Internal Network     |                |            Internal Client Network                |&#xA;|                                            |                |                                 Remote Network    |&#xA;|                       ----------------     |                |    ---------------            ------------------  |&#xA;|                       |              |     | 192.168.3.0/24 |    |    Client    |           |                |  |&#xA;|  192.168.1.0/24 &amp;lt;&amp;gt;--&amp;lt;&amp;gt;   App Server   &amp;lt;&amp;gt;------&amp;lt;&amp;gt;      &amp;lt;&amp;gt;-------&amp;lt;&amp;gt;   Controlled  |           | 192.168.1.0/24 |  |&#xA;|                   eth1|              |eth0 |                |  .1| Cisco Router |           |                |  |&#xA;|                     .1----------------.10  |                |    ----------------           ------------------  |&#xA;|--------------------------------------------|                |---------------------------------------------------|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm trying to resolve the issue by calling upon the Linux router capabilities (iptables targets DNAT, SNAT, NETMAP, ROUTE, etc.), but I'm stumped.  The client is attempting to access 192.168.3.10 to access the web app but the packets never get back as the app server see the connection attempt as being from a locally connected device and proceeds to arp for the MAC address.  I've setup a test environment in our lab and this is what tcpdump reveals when I attempt a ping from the client PC:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -n -l -i eth0 net 192.168.1.0/24&#xA;15:50:40.006196 IP 192.168.1.48.10689 &amp;gt; 192.168.3.10.10690: S 1413694241:1413694241(0) win - &amp;lt;mss 1460,nop,nop,timestamp 1413694241 0,nop,wscale 1&amp;gt;&#xA;15:50:41.002813 IP 192.168.1.48.10689 &amp;gt; 192.168.3.10.10690: S 1413694241:1413694241(0) win - &amp;lt;mss 1460,nop,nop,timestamp 1413694242 0,nop,wscale 1&amp;gt;&#xA;&#xA;tcpdump -n -l -i eth1 net 192.168.1.0/24&#xA;15:50:40.008269 arp who-has 192.168.1.48 tell 192.168.3.10&#xA;15:50:41.003657 arp who-has 192.168.1.48 tell 192.168.3.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've requested the client to implement NAT on their Cisco router and they have started the change approval process.  However, their network change requests take over 3 weeks to get approved so they were hoping that this issue can be resolved on the Linux end sooner; the app server is not under their change approval process being that it is an isolated network and under our direct control!  The only thing we cannot do is change the IP address on the app server eth0 interface!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&#xA;ak.&lt;/p&gt;&#xA;" OwnerUserId="9963" LastActivityDate="2020-04-23T01:22:04.947" Title="Resolve overlapping subnet problem using Linux and IPTABLES!" Tags="|routing|linux|" AnswerCount="2" CommentCount="3" ClosedDate="2020-04-23T01:22:50.617" ContentLicense="CC BY-SA 3.0" />
  <row Id="12558" PostTypeId="2" ParentId="12517" CreationDate="2014-10-19T09:39:00.027" Score="11" Body="&lt;h1&gt;(Nodal) Processing Delay&lt;/h1&gt;&#xA;&lt;p&gt;The &lt;strong&gt;(&lt;em&gt;nodal&lt;/em&gt;) processing delay&lt;/strong&gt; is every device along the communication path that actually processes/examines the packets; these include routers, switches, and statistical multiplexers. The receiver doesn’t count towards this delay because the receiver is the receiver and has received the packet at that point, it doesn’t matter what will be done on its side with the signal.&lt;sup&gt;[1][2]&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;p&gt;Regarding proxies and VPNs: yes, every device that does anything with the packets counts towards the delays. Especially NATs (rewriting) or devices that perform deep packet inspection add a lot of processing time.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;nodal processing = node processing&lt;/p&gt;&#xA;&lt;p&gt;nodal processing ≠ nodal delay&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h1&gt;(Total) Nodal Delay&lt;/h1&gt;&#xA;&lt;p&gt;The &lt;strong&gt;(&lt;em&gt;total&lt;/em&gt;) nodal delay&lt;/strong&gt; on the other hand is the sum of all latency delays. There are exactly four delays:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;(&lt;em&gt;Nodal&lt;/em&gt;) Processing Delay&lt;/strong&gt; amount of time used to process the packet headers, check for bit errors and determine the destination host.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Queuing Delay&lt;/strong&gt; amount of time a packet is waiting in the queue (buffer) before it can be pushed on the link.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Transmission Delay&lt;/strong&gt; amount of time necessary to push all the bits on the link.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Propagation Delay&lt;/strong&gt; amount of time it takes the signal’s header to travel from the sender to the receiver.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;d&lt;/em&gt;&lt;sub&gt;nodal&lt;/sub&gt; = &lt;em&gt;d&lt;/em&gt;&lt;sub&gt;proc&lt;/sub&gt; + &lt;em&gt;d&lt;/em&gt;&lt;sub&gt;queue&lt;/sub&gt; + &lt;em&gt;d&lt;/em&gt;&lt;sub&gt;trans&lt;/sub&gt; + &lt;em&gt;d&lt;/em&gt;&lt;sub&gt;prop&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://citeseerx.ist.psu.edu/document?repid=rep1&amp;amp;type=pdf&amp;amp;doi=77a928b2dd7ccf5e8b0847a98b397728571f0034&quot; rel=&quot;nofollow noreferrer&quot;&gt;Table 1 in this paper&lt;/a&gt; typical timings for each delays are:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;d&lt;/em&gt;&lt;sub&gt;proc&lt;/sub&gt; = 10–1,000 µs&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;d&lt;/em&gt;&lt;sub&gt;queue&lt;/sub&gt; = 0…∞&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;d&lt;/em&gt;&lt;sub&gt;trans&lt;/sub&gt; = 10 µs&lt;sup&gt;[3]&lt;/sup&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;d&lt;/em&gt;&lt;sub&gt;prop&lt;/sub&gt; = 1,000 µs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The queue delay may reach infinity and the whole network suffers from &lt;em&gt;congestion collapse&lt;/em&gt;; which actually happened during the 1980s and was the reason why &lt;a href=&quot;http://ee.lbl.gov/papers/congavoid.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Congestion Avoidance and Control&lt;/a&gt; was invented.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;As a packet travels from one node (host or router) to the subsequent node (host or router) along this path, the packet suffers from several types of delays at &lt;em&gt;each&lt;/em&gt; node along the path. The most important of these delays are the &lt;strong&gt;nodal processing delay&lt;/strong&gt;, &lt;strong&gt;queuing delay&lt;/strong&gt;, &lt;strong&gt;transmission delay&lt;/strong&gt;, and &lt;strong&gt;propagation delay&lt;/strong&gt;; together, these delays accumulate to give a &lt;strong&gt;total nodal delay&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;— (Kurose and Ross 2013, 35–36)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This is only a very terse primer on the subject, I encourage you to read on.&lt;/p&gt;&#xA;&lt;h1&gt;References&lt;/h1&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Kurose, James F.; Ross, Keith W. (2013): “Computer Networking. A Top-Down Approach”. 6th ed. Pearson Education, pp. 35–47. ISBN: 978-0-13-285620-1&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Packet_transfer_delay&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia: “Packet transfer delay”&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Network_delay&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia: “Network delay”&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h1&gt;Footnotes&lt;/h1&gt;&#xA;&lt;p&gt;&lt;sup&gt;[1]&lt;/sup&gt; Of course it matters, but it doesn’t matter for the delay calculations because we are only interested in the delay incurred by the underlying network and not the delays within sender and receiver.&lt;/p&gt;&#xA;&lt;p&gt;&lt;sup&gt;[2]&lt;/sup&gt; I’ve seen that the receiver is sometimes counted as well. I don’t know if this is correct or not, a good reference is needed here.&lt;/p&gt;&#xA;&lt;p&gt;&lt;sup&gt;[3]&lt;/sup&gt; This number is much higher in real world and highly depends on the distance to cover, also the &lt;a href=&quot;https://en.wikipedia.org/wiki/Last_mile&quot; rel=&quot;nofollow noreferrer&quot;&gt;last mile problem&lt;/a&gt; is very important here.&lt;/p&gt;&#xA;" OwnerUserId="9964" LastEditorUserId="9964" LastEditDate="2023-09-04T09:03:23.803" LastActivityDate="2023-09-04T09:03:23.803" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="12559" PostTypeId="1" AcceptedAnswerId="12560" CreationDate="2014-10-19T09:44:03.810" Score="3" ViewCount="611" Body="&lt;p&gt;I stumble upon both abbreviations in the same context and it seems they are used interchangeably. But I'd like clarification if this is actually the case or if there are differences between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer may be as simple as &lt;em&gt;“the two are the same”&lt;/em&gt; but it would be very nice to see some proof. I failed to find anything.&lt;/p&gt;&#xA;" OwnerUserId="9964" LastEditorUserId="3191" LastEditDate="2014-10-21T20:19:23.963" LastActivityDate="2014-10-21T20:19:23.963" Title="Difference between RWND and RWIN?" Tags="|tcp|terminology|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12560" PostTypeId="2" ParentId="12559" CreationDate="2014-10-19T12:14:06.223" Score="6" Body="&lt;p&gt;From the &lt;a href=&quot;http://tools.ietf.org/wg/ippm/draft-ietf-ippm-tcp-throughput-tm/draft-ietf-ippm-tcp-throughput-tm-11-from-10.diff.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;diffs of draft-ietf-ippm-tcp-throughput-tm&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;p&gt;This diff seems to show all the RWIN abberviations being replaced with RWND, below is an example.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    It is important to clarify the interaction between the sender's Send&#xA;-   Socket Buffer and the receiver's advertised TCP RWIN Size.  TCP test&#xA;-   programs such as iperf, ttcp, etc. allow the sender to control the&#xA;+   Socket Buffer and the receiver's advertised TCP RWND Size.  TCP test&#xA;+   programs such as iperf, ttcp, etc. allows the sender to control the&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The latest version of this document, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6349&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;RFC 6349&quot;&gt;RFC 6349&lt;/a&gt;, doesn't have RWIN anywhere in it.  Looks like they mean the same thing to me.&lt;/p&gt;&#xA;" OwnerUserId="8265" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-10-21T15:11:47.457" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12565" PostTypeId="1" AcceptedAnswerId="12566" CreationDate="2014-10-19T20:53:24.877" Score="9" ViewCount="12425" Body="&lt;p&gt;I remember when I connected to the internet via the phone line and a 56kbps modem, changing ISPs was as simple as changing the phone number dialled by the modem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remember that my IP address would change every 1 minute, without a break in connection. But I also remember downloading large files over HTTP, sometimes downloads would take hours to complete. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In a situation like this, how does the TCP connection remain open, while the IP address changes frequently?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, as a side question... I live in the UK, so it's all fibre optic and static IP's now, I'd be interested to know if other places in the world still rely on technology like this.&lt;/p&gt;&#xA;" OwnerUserId="9970" LastActivityDate="2014-11-13T12:47:37.787" Title="How is a TCP connection maintained over a changing IP address" Tags="|ipv4|tcp|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12566" PostTypeId="2" ParentId="12565" CreationDate="2014-10-19T21:02:47.367" Score="10" Body="&lt;p&gt;The TCP connection cannot stay open with a changing IP, because a connection is defined by source IP+Port and destination IP+Port. If one of these changes, then you don't have the same connection anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to maintain a connection when the IP to your ISP changes, then you should not use this IP as outgoing, but instead built a tunnel to some VPN server outside. The VPN will give you a constant IP, even if the IP you got from the ISP changes. Another option would be to write your application so that it notices changes of IP and reconnects and resumes traffic.&lt;/p&gt;&#xA;" OwnerUserId="4063" LastActivityDate="2014-10-19T21:02:47.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12569" PostTypeId="2" ParentId="12565" CreationDate="2014-10-20T07:51:14.170" Score="1" Body="&lt;p&gt;It was already clarified by Steffen Ullrich what happens to the TCP connection. I'd like to answer your side question as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of the IPv4 address exhaustion many ISPs around the world still rely on IP leases. A change every minute isn't realistic, but a change every 24 h is what usually happens. The reason is simply because they don't have enough addresses to give each client its dedicated IP. This situation will change with IPv6 which has enough addresses in the foreseeable future.&lt;/p&gt;&#xA;" OwnerUserId="9964" LastActivityDate="2014-10-20T07:51:14.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12574" PostTypeId="1" CreationDate="2014-10-20T14:30:41.040" Score="2" ViewCount="287" Body="&lt;p&gt;I'm using multicast communications with IGMP snooping enable in the switch, I have 6 nodes (A, B, C, D, E, F), 3 sends data to different Multicast address and 3 receive data from every multicast address at the same time. The first scenario is, A send to mcast_addr1 and B send to mcast_addr2, I run receiver program in D, E nodes, everyone does JOIN to each multicast address, D and E nodes can receive the traffic multicast. The second scenario is, A send to mcast_addr1, B send to mcast_addr2 and C send to mcast_addr3, I run the receiver program in nodes, first in D, then E and finally F, the traffic multicast only is received in the nodes E and F, which are the last two nodes joined a multicast address. I can see with tcpdump that the sender send the data to the multicast address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I run the second scenario at different times, the traffic is received at the nodes D, E and F.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, the traffic only is received by the last two nodes that are joined to a multicast address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch is D-Link DGS-1248T, IGMPv3, and OS Centos 6.5 (kernel 2.6.32-431.20.3)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone know of IGMP has some limitations? Any suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards, Ra&lt;/p&gt;&#xA;" OwnerUserId="9979" LastActivityDate="2015-01-21T09:57:12.670" Title="Don't receive multicast traffic" Tags="|multicast|igmp|" AnswerCount="0" CommentCount="3" ClosedDate="2019-12-20T00:29:15.890" ContentLicense="CC BY-SA 3.0" />
  <row Id="12575" PostTypeId="2" ParentId="12531" CreationDate="2014-10-20T14:31:33.267" Score="1" Body="&lt;pre&gt;&lt;code&gt;access-list amzn-filter extended permit ip 172.17.0.0 255.255.0.0 10.0.0.0 255.0.0.0 &#xA;access-list amzn-filter extended deny ip any any &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unless your &quot;remote&quot; users are contained in the 10.0.0.0/8 network, your filter is missing their IP range.  From what I gather of your output, there is AWS (172.17.0.0/16), your Office (10.0.0.0/8), and the &quot;Remote&quot; network.    You never provided the IP Range, so I can't know for sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your second &lt;strong&gt;packet-tracer&lt;/strong&gt; output.  It seems you are trying to ping from your Inside interface using the source address of your Outside interface.  I'm pretty sure that will always fail, as your Outside interface IP is (more than likely) not in the range of IPs you are allowing in your Encryption Domain.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-10-20T14:31:33.267" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="12578" PostTypeId="2" ParentId="10515" CreationDate="2014-10-20T15:36:35.647" Score="1" Body="&lt;p&gt;It turns out this can't be done simply because pseudowire data plane traffic doesn't interact with any control plane logic in that MACs for example, aren't learnt. Although I knew this, as pseudowires are a point-to-point L2 bridge essentially I was hoping there may be a way to see something, anything!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without the use of an VFI MACs aren't learnt. Sadly though I have no official Cisco documentation to back this up, I've just been told this by friends and collleagues who's technical knowledge I highly value.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2014-10-20T15:36:35.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12581" PostTypeId="2" ParentId="12557" CreationDate="2014-10-20T23:47:16.903" Score="5" Body="&lt;p&gt;I was able to find a kludge to my dilemma.  Since all traffic coming to the app server from the overlapping subnet is heading to port 80 (and no host on the local overlapping subnet talks to port 80 - apologies for overlooking that part in my question above), all I need to do is mark the packets heading out of port 80 using iptables, create a new routing table for the remote overlapping subnet, add routing information for the new routing table, and finally implement policy routing for the marked packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are the commands I used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables -t mangle -A OUTPUT -p tcp --sport 80 -d 192.168.1.0/24 -j MARK --set-mark 30&#xA;echo &quot;200 overlap&quot; &amp;gt;&amp;gt; /etc/iproute2/rt_tables&#xA;ip route add 192.168.1.0/24 via 192.168.3.1 table overlap&#xA;ip rule add fwmark 30 lookup overlap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This resolved the issue and was quite an eye opener to what the Linux router can really accomplish!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&#xA;ak.&lt;/p&gt;&#xA;" OwnerUserId="9963" LastEditorUserId="9963" LastEditDate="2014-10-21T12:06:59.263" LastActivityDate="2014-10-21T12:06:59.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12584" PostTypeId="1" CreationDate="2014-10-21T06:00:22.310" Score="2" ViewCount="876" Body="&lt;p&gt;How does a GSM network route internet packets? Does GSM use NAT based PAT like a physical Router? For example, user A visits website #1 and user B visits website #2. how data of website #1 are given to user A instead of B or both of them?&lt;/p&gt;&#xA;" OwnerUserId="9988" LastEditorUserId="8550" LastEditDate="2019-11-09T23:23:41.707" LastActivityDate="2019-11-09T23:23:41.707" Title="How GSM network routes Internet packets?" Tags="|routing|nat|mobile|gsm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12587" PostTypeId="1" CreationDate="2014-10-21T12:09:37.023" Score="4" ViewCount="521" Body="&lt;p&gt;How do I find number of BGP route announcements from RIS Raw data (RIPE Network Coordination Centre) if, for example, I want to look at a particular date? If I choose random route collector, download traffic traces for particular time I am interested in, and since those messages are in MRT format, after converting them to text I get information I do not know how to handle. If I select all BGP messages that have &quot;announce&quot; type I am not getting the volume of the data some research papers are referring to. It must be that I am wrong since I found few references stating similar results..and mine are not even close! Please help. &lt;/p&gt;&#xA;" OwnerUserId="8668" LastActivityDate="2014-10-23T05:52:34.973" Title="BGP route announcement definition" Tags="|bgp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12588" PostTypeId="1" AcceptedAnswerId="12608" CreationDate="2014-10-21T12:17:08.630" Score="4" ViewCount="3476" Body="&lt;p&gt;We want to be able to disable a computer in Active Directory and prevent that computer from accessing our VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an ASA VPN setup, with Cisco Security Desktop, and a Dynamic Access Policy to check the host. The AAA uses LDAP to talk to active directory. The primary authentication is for the user, with a secondary authentication setup for the computer with DAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first guess is that I may have to switch to RADIUS? If we had an Enterprise Certificate Authority setup for the Domain with auto-enrollment, we could check the computer certificates, but we do not, nor can we.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is there a way to have the ASA 'proxy' do something similar to the Kerberos authentication that the computer would do with AD in order to validate access?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, is there a Computer equivalent to the User AAA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa-server AD-LDAP protocol ldap&#xA;aaa-server AD-LDAP (INSIDE) host AD-SERVER&#xA;ldap-base-dn OU=Users,OU=Dept,DC=company,DC=org&#xA;ldap-scope subtree&#xA;ldap-naming-attribute userPrincipalName&#xA;ldap-login-password *****&#xA;ldap-login-dn CN=vpn.service.account,OU=ServiceAccounts,OU=Users,OU=Dept,DC=company,DC=org&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where you could change &lt;code&gt;userPrincipalName&lt;/code&gt; to maybe the computer &lt;code&gt;CN&lt;/code&gt; and &lt;code&gt;base-dn&lt;/code&gt; to the Computers container?&lt;/p&gt;&#xA;" OwnerUserId="3071" LastEditorUserId="3071" LastEditDate="2014-10-21T17:53:05.750" LastActivityDate="2014-10-23T02:10:05.470" Title="How do you block a specific computer from VPN on a Cisco ASA?" Tags="|cisco-asa|vpn|aaa|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12589" PostTypeId="2" ParentId="8263" CreationDate="2014-10-21T12:47:27.233" Score="2" Body="&lt;p&gt;I think your username is wrong in your commands, try substituting &lt;code&gt;testusername&lt;/code&gt; for &lt;code&gt;ALL&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server view TESTVIEW mib-2 included &#xA;snmp-server group TESTGROUP v3 auth read TESTVIEW &#xA;snmp-server user testusername TESTGROUP v3 auth sha testpassword &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3071" LastActivityDate="2014-10-21T12:47:27.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12590" PostTypeId="1" AcceptedAnswerId="12610" CreationDate="2014-10-22T03:15:35.763" Score="1" ViewCount="1399" Body="&lt;p&gt;I'm new to networking and new to this forum so excuse me if I have chosen the wrong place to ask this question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I was wanting to build my first Linux Cluster using Rocks. I was wondering if it is possible to build a private network between the nodes in my cluster using only a network switch or if I need other hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do to build the cluster?&lt;/p&gt;&#xA;" OwnerUserId="9995" LastEditorUserId="775" LastEditDate="2014-12-08T12:14:48.410" LastActivityDate="2014-12-08T12:14:48.410" Title="Network Switch to Create Private Network - Computer Cluster" Tags="|design|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12592" PostTypeId="1" AcceptedAnswerId="12598" CreationDate="2014-10-22T11:51:21.537" Score="3" ViewCount="3292" Body="&lt;p&gt;I have learned that your mobile periodically updates it's location when it moves from one location area to another and I learned that some updates will be made to VLR and HLR like in VLR your details will be added and in HLR your details will be deleted when you change the location.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I live in India. If you move from one state to another there will be roaming charges. Is one state corresponds to one location area.&lt;/li&gt;&#xA;&lt;li&gt;If my details are deleted from HLR when they will added to HLR again? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Note: please forgive me if my questions are dumb. I am a newbie. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="9896" LastEditorUserId="775" LastEditDate="2014-12-08T12:13:45.920" LastActivityDate="2019-02-10T15:32:15.980" Title="How does &quot;location update&quot; happens in your mobile?" Tags="|mobile|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12594" PostTypeId="1" AcceptedAnswerId="12603" CreationDate="2014-10-22T14:35:57.037" Score="4" ViewCount="612" Body="&lt;p&gt;It seems the situation with finding routers in IPv4 with DHCP was okay and now IPv6 has RA's and we have to worry about rogue RA, different vendors provide protection against it, etc. What is IPv6 trying to fix/improve with RAs that makes the downsides worth it?&lt;/p&gt;&#xA;" OwnerUserId="10004" LastActivityDate="2017-02-20T19:01:56.543" Title="What is IPv6 trying to fix with Router Advertisements (RA)?" Tags="|ipv6|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12595" PostTypeId="1" AcceptedAnswerId="12596" CreationDate="2014-10-22T14:44:16.113" Score="3" ViewCount="314" Body="&lt;p&gt;I'd like to start by apologizing for not doing a thorough research on this subject, but after talking to a work mate VOIP came up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know very roughly how it works (most basic knowledge you can imagine), but then I thought. VOIP calls from PC to PC (skype or any other softwares alike) are free, but calls to or from telephones (land lines) and cellphones are paid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is that? What is preventing me from coding my own VOIP client, or building my own VOIP server to do the exact same thing I'm being charged by other softwares? Does it change from one physical media to another? Is it because we are using the phone company's infrastructure for it? I really need to know this, because I have been thinking about it almost non stop since thursday and I need to get this doubt out of my head.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: Sorry for any english mistakes. It isn't my first language. And also, I'm almost certain that the company that provides my internet, phone and cable uses some kind of VOIP client or something (I don't know if that's a thing, or if it is possible or legal to do it without the client's consent, but it seemed a pertinent observation that might assist with your answers)&lt;/p&gt;&#xA;" OwnerUserId="10006" LastActivityDate="2014-10-22T14:50:39.670" Title="Why is it necessary to pay for VOIP calls to phones?" Tags="|voip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12596" PostTypeId="2" ParentId="12595" CreationDate="2014-10-22T14:50:39.670" Score="7" Body="&lt;p&gt;It's the PSTN part that cost money.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to interconnect with the regular phone network and depending on the provider the costs vary (fixed cost per month or per call, etc...).  Using IP to IP calls you do not connect to the PSTN network, hence no need to pay for that part of the infrastructure&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-10-22T14:50:39.670" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12597" PostTypeId="2" ParentId="12594" CreationDate="2014-10-22T15:09:35.950" Score="1" Body="&lt;p&gt;I guess you never had to worry about rogue DHCP which is much easier to get on your network than rogue RAs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router Advertaisement are part of the &lt;a href=&quot;http://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol&quot; rel=&quot;nofollow&quot;&gt;Neighbor Discovery Protocol&lt;/a&gt; (NDP) not just a replacement for DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also methods to use RAs to migrate netwok (v6 to v6... from one prefix to another) without ever having to touch or even reboot the hosts.&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-10-22T15:09:35.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12598" PostTypeId="2" ParentId="12592" CreationDate="2014-10-22T17:15:10.663" Score="3" Body="&lt;p&gt;It is possible to take calls from any location because, the mobile phone keeps the network/cellular operator informed about its location. This in-turn enables the mobile operator to route the calls to you anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HLR is the most important database maintained by the operator. The subscriber info is created by the operator in HLR at the time of purchase of subscription by an user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLR is a database that contains temporary information about the subscriber. It is used to service the visiting subscribers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Location area refers to group of cells. If the mobile moves from one location area to a cell in different location area, it shall perform a location update to the network/cellular operator about its location. The mobile performs a location update to inform the operator about its exact location by checking the location area of the old cell and new cell. If the location area is different, the mobile will definitely perform a location udpate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the new location area, the VLR shall check its database for the subscriber information for authentication. If the subscriber information is not present in its database, it shall check with the HLR and get the copy of the subscription information via the location update. In this entire process, only a copy is made available to VLR and the HLR will not delete the subscriber information. The HLR shall infact update its records such that the subscriber information is updated with current VLR serving the mobile. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In scenario where a mobile moves from first VLR(eg - first location area) to a cell in second VLR(eg - second location area), the subscriber information that was copied into the first VLR shall be deleted once the mobile moves out of that first location area and the subscriber information in the recent VLR(second VLR) shall be retained. Once the mobile moves towards the second VLR (second location area), the HLR shall request the first VLR(old VLR) to remove the subscriber record. Note that only the subscriber information in the first VLR(old VLR) is deleted. The HLR updates its database with the current VLR serving the mobile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the above scenarios, you will observe that addition/deletion of subscriber info happens in VLR and only updation of subscriber info happens in HLR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the HLR data is stored only as long as the subscriber uses the service of the cellular operator. That is, if the user opts to move with different cellular operator due to an attractive plan or any other reason, then obviously it implies that he is closing his subscription and only in that case, the subscriber information shall be deleted from HLR.&lt;/p&gt;&#xA;" OwnerUserId="8550" LastEditorUserId="8550" LastEditDate="2014-10-22T17:26:53.867" LastActivityDate="2014-10-22T17:26:53.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12599" PostTypeId="1" CreationDate="2014-10-22T18:04:05.937" Score="1" ViewCount="162" Body="&lt;p&gt;Probably a quick question. I am testing my dotx (802.1x) deployment on an Access Layer switch. I want to know if I plug in a consumer router, like a Linksys or Netgear, will the dotx only see the WAN's ports MAC address during the authentication process? I believe that should be the case, however I am testing with an Aruba Access Point. I've plugged in the WAN of the Aruba into the dot1x enabled Access Switch. Using MAB i've added the MAC to bypass authentication...however periodically devices behind the ARuba will show up in my Access Layer switch's logs asking for EAPOL???&lt;/p&gt;&#xA;" OwnerUserId="3528" LastEditorUserId="3528" LastEditDate="2014-10-22T18:51:25.697" LastActivityDate="2014-11-22T04:44:53.477" Title="Should Consumer Router plugged into dotx (802.1x) enabled port see only WAN MAC address?" Tags="|cisco|bridge|ieee-802.1x|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12600" PostTypeId="2" ParentId="11225" CreationDate="2014-10-22T18:42:14.147" Score="4" Body="&lt;p&gt;It should be calculated based on the respective fields in the respective information storage of HSS/MME/SGW/PGW as mentioned in section 5.7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One tip is that the following 3GPP specs can be referred for respective IE in information storage to determine the sizes.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;S1AP IEs - 36.413&lt;/li&gt;&#xA;&lt;li&gt;RRC  IEs - 36.331&lt;/li&gt;&#xA;&lt;li&gt;GTP-C IEs - 29.274&lt;/li&gt;&#xA;&lt;li&gt;GTP-U IEs - 29.281&lt;/li&gt;&#xA;&lt;li&gt;NAS IEs - 24.301&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8550" LastActivityDate="2014-10-22T18:42:14.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12603" PostTypeId="2" ParentId="12594" CreationDate="2014-10-22T21:15:09.783" Score="5" Body="&lt;p&gt;Fix? I don't know. But it's abundantly clear the committee members were blind to history: IPv4 had the same horrible, nasty, and insecure feature that was almost instantly abandoned -- ICMP Router Advertisements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;purpose&lt;/em&gt; of the RA is to announce a router, the prefix for the segment (served by that router, there can be more than one router on a segment), and flags for &quot;managed&quot; (i.e. use DHCPv6 for addresses) and &quot;other&quot; (i.e. use DHCPv6 for other, non-address elements -- dns servers, domain name, etc.)  IPv6 compliant hosts are &lt;em&gt;required&lt;/em&gt; to accept and process &lt;em&gt;all&lt;/em&gt; RAs they see, however many systems limit the number to mitigate one of the GREAT MANY security issues with RAs. (crashing systems with millions of unique RAs) As there is no support for signing or authentication, any node on a network can originate an RA and pretend to be a router, spoof the origin making some other node (possibly non-existent) eat traffic, or as previously mentioned, spew RAs until everything crashes.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-10-22T21:15:09.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12605" PostTypeId="1" AcceptedAnswerId="12629" CreationDate="2014-10-22T23:01:01.600" Score="4" ViewCount="1408" Body="&lt;p&gt;quick bit of context so my question makes sense:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been asked to plan out some subnets and routing for a new IP range we've just been allocated. The range will be used to customer's equipment (on IPs allocated out of this range) to peering providers.&#xA;&amp;lt;/context&amp;gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every routing example I've seen appears to revolve around one central &quot;Core&quot; router, which connects to all the other networks and routers. This would leave me with a setup looking something like this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/T49XM.png&quot; alt=&quot;Network diagram number 1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full diagram at &lt;a href=&quot;http://www.gliffy.com/go/publish/6360724&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.gliffy.com/go/publish/6360724&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me, this would seem to have a few disadvantages, namely a single point of failure, and wasting 2 IPs for each additional connection. That lead me to come up with this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/akiYJ.png&quot; alt=&quot;Network diagram number 2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full diagram at &lt;a href=&quot;http://www.gliffy.com/go/publish/6360825&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.gliffy.com/go/publish/6360825&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory, this makes better use of the IP ranges, and has fewer single points of failure. Can anybody suggest why the first set-up seems preferable, even with it's seemingly obvious faults?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="5530" LastEditorUserId="31801" LastEditDate="2018-12-29T03:05:11.090" LastActivityDate="2018-12-29T03:05:11.090" Title="Why have a single, &quot;core&quot;, router" Tags="|routing|router|subnet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="12606" PostTypeId="2" ParentId="12584" CreationDate="2014-10-23T00:44:45.463" Score="3" Body="&lt;p&gt;IMEI is provided by equipment manufacturer for the mobile. It is stored in EIR via the network operator while registration. IMSI is a combination of MCC(Mobile country code), MNC(Mobile Network code) , MSIN(Mobile subscriber Identification number) and is stored in SIM. There are several such identifiers based on the mode of operation to uniquely identify a user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GSM is a combination of TDMA/FDMA. Each BS is assigned one or more carrier frequencies which is then divided in time, using a TDMA scheme, into 8 time slots. The time slot usage is such that the mobile does not recieve and send it the same time. That is, the MS uses one time slot for transmission and one for reception. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The BSS acts as a radio resource manager and allocates a traffic channel (a radio channel and a time slot) for every MS once authenticated and informed by MSC. Each MS operates only over the provided radio channel in the given time slot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In GSM, the RR protocol between the MS, BTS and BSC(BSS) does the routing of the data to the recipient and you can consider it to be similar to that of network layer(layer 3 of OSI). The routing of data is further coupled with SCCP for end to end addressing/routing in SS7.&lt;/p&gt;&#xA;" OwnerUserId="8550" LastEditorUserId="8550" LastEditDate="2014-10-23T00:59:28.533" LastActivityDate="2014-10-23T00:59:28.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12608" PostTypeId="2" ParentId="12588" CreationDate="2014-10-23T02:10:05.470" Score="4" Body="&lt;p&gt;In general, if you are utilizing Cisco Secure Desktop, this opens up a whole world of options to give you restrictions based on the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just as an example off of the top of my head, you could do the following.  I haven't had the opportunity to test this configuration, however I have seen similar configurations in the field.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create a Group Policy in AD that &lt;a href=&quot;http://technet.microsoft.com/en-us/library/cc753092.aspx&quot; rel=&quot;nofollow&quot;&gt;creates a specific registry entry&lt;/a&gt; called VPN-ACCESS (for example) on every desktop that will be accessing the VPN.&lt;/li&gt;&#xA;&lt;li&gt;Create a security group and disable inheritance of the first Group Policy.  In it's place, configure a Group Policy that deletes the VPN-ACCESS registry entry if it exists.  &lt;/li&gt;&#xA;&lt;li&gt;Place all PCs are not allowed to have VPN access into this security group. This step would require some scripting elbow grease to ensure that your &quot;blocked&quot; PC's got put into the security group based on whatever criteria you chose.&lt;/li&gt;&#xA;&lt;li&gt;In Cisco Secure Desktop, have it evaluate if that registry entry exists, if it doesn't exist then block access.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This would take care of only allowing &quot;known&quot; PCs into the VPN, as well as allowing you to explicitly blacklist PCs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure there are other ways to do this as well, and this may not even be the best way by far.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main thrust is, once you've paid for the Anyconnect Premium licenses and have deployed Cisco Secure Desktop, you're only restrained by your ingenuity with regards to what kind of &quot;better mouse trap&quot; you build.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/csd/csd36/configuration/guide/CSD36cfg/CSDintro.html&quot; rel=&quot;nofollow&quot;&gt;the CSD Admin Guide&lt;/a&gt; for more information on all of it's bells and whistles.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2014-10-23T02:10:05.470" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12610" PostTypeId="2" ParentId="12590" CreationDate="2014-10-23T03:08:14.153" Score="1" Body="&lt;p&gt;all you need is a switch to connect all the nodes in the cluster together. this switch must have VLANs created if you will also have other devices on the switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, for example, you have 3 nodes; a front end and 2 compute nodes. You connect the front end nodes first NIC to the switch and connect the compute nodes to the switch also. This will give them all physical connectivity. Your front end node should give all other nodes their IP address's to complete the connection. I have never used Rocks Cluster before so I could be wrong on the IP addressing.&lt;/p&gt;&#xA;" OwnerUserId="10016" LastActivityDate="2014-10-23T03:08:14.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12611" PostTypeId="2" ParentId="12605" CreationDate="2014-10-23T03:12:45.140" Score="0" Body="&lt;p&gt;it is control. You client router don't know how to get to what. That is what your core router does. It is the middleman that connects your clients to their upstream. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also their would be 9 interfaces if the B site is included.&lt;/p&gt;&#xA;" OwnerUserId="10016" LastActivityDate="2014-10-23T03:12:45.140" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12612" PostTypeId="2" ParentId="12565" CreationDate="2014-10-23T04:03:07.790" Score="3" Body="&lt;p&gt;TCP is a connection oriented protocol that uses stream socket. It is bound by IP address and port number at both the endpoints. In connection oriented protocol, a logical channel is established between the peers before exchanging data. So, if the IP address is changing, it has to tear down the existing connection and re-establish the connection which obviously is disruptive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible that IP address can change during every restart provided the subscriber is configured for such a plan of either static IP address or Dynamic IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, IP address change is not preferred while the connection is ON as it will be disruptive considering the fact that the higher level protocols like TCP will be shutdown. Such scenarios may happen when the mobile moves between different PDNs. To overcome this, 3GPP based networks use either GTP or Mobile IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GTP(GPRS Tunneling Protocol) ensures that the data is tunneled such that the same IP address is retained. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mobile IP allows location independent routing of data with the use of CoA (Care of Address) which utilizes the PGW as home agent(HA) and the SGW as the foreign agent(FA). Here, a mobile specific CoA is provided to the HA by FA, so that packets can be forwarded to the correct destination of mobile location.&lt;/p&gt;&#xA;" OwnerUserId="8550" LastActivityDate="2014-10-23T04:03:07.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12613" PostTypeId="2" ParentId="12599" CreationDate="2014-10-23T04:11:56.873" Score="2" Body="&lt;p&gt;It sounds like your Aruba AP is not tunneling (all) it's client's traffic, and if so, this would be expected behaviour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would happen in situations where:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You're using an Aruba IAP - in which case, all client traffic is being bridged&lt;/li&gt;&#xA;&lt;li&gt;You're using a controller-homed AP, but you have configured &lt;strong&gt;Forward-Mode&lt;/strong&gt; to be &lt;strong&gt;Bridged&lt;/strong&gt; for a particular SSID&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The AP is just a two-port switch at the end of the day (tunneling aside), albeit one with a wireless port and a wired - no MAC hiding will be taking place.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2014-10-23T04:11:56.873" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12614" PostTypeId="2" ParentId="12587" CreationDate="2014-10-23T04:40:57.987" Score="4" Body="&lt;p&gt;The easiest way is to use &lt;a href=&quot;http://code.google.com/p/pybgpdump/source/browse/#svn%2Ftrunk&quot; rel=&quot;nofollow&quot; title=&quot;pybgpdump&quot;&gt;pybgpdump&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The package includes a tool in the samples directory called simple.py which will summarise the announce/withdrawal count for a given MRT file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;./simple.py -i updates.20070131.2330.gz&#xA;2630 total messages with 12028 announced and 5666 withdrawn routes&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're after an entire day's worth of data, you'll need to download all the 288 files of 5-minute intervals, and then hack simple.py to iterate through the list.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="775" LastEditDate="2014-10-23T05:52:34.973" LastActivityDate="2014-10-23T05:52:34.973" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12616" PostTypeId="2" ParentId="12584" CreationDate="2014-10-23T04:59:14.173" Score="7" Body="&lt;p&gt;GSM data networks (GPRS, LTE etc) allocate IP addresses to end devices (Mobile Phones) just like any other network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to whether NAT/PAT is used, this is entirely carrier dependent - based on a factor of how big their subscriber base is and how many public IPv4 addresses they have available. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Australia, the incumbent telco Telstra uses a CGN (carrier-grade NAT) to support the massive numbers of 3G/LTE subscribers currently using it's network.  All devices using their default APN are allocated an address from 10.0.0.0/8, and then NATted to the Internet.  Public IPs are available, but only on premium services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In markets where IPv6 is more established (eg: much of Asia), end devices are more likely to be provided with a public v6 address, requiring CGN only where the content being viewed is v4 only.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2014-10-23T04:59:14.173" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12621" PostTypeId="1" CreationDate="2014-10-23T13:14:52.193" Score="2" ViewCount="1980" Body="&lt;p&gt;I'm having great difficulty transferring a QoS configuration from a Procurve HP switch to an HP switch running Comware v7. The documentation lists all available configuration parameters, but fails to explain how they all fit together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each blade in our rack has only two physical interfaces, so different types of traffic are separated by VLAN tags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each VLAN basically needs to be classified into one of five groups, with descending priority and a guaranteed minimum bandwidth for each group. If there is no other traffic on the wire, each group should be able to claim the full capacity of the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Procurve configuration is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 10&#xA;   name blah&#xA;   qos priority 7&#xA;   exit&#xA;&#xA;vlan 20&#xA;   name blahblah&#xA;   qos priority 3&#xA;   exit&#xA;&#xA;vlan 30&#xA;   name blahblahblah&#xA;   qos priority 1&#xA;   exit&#xA;&#xA;[...etc...]&#xA;&#xA;interface 1&#xA;   bandwidth-min output 10 10 60 20&#xA;&#xA;interface 2&#xA;   bandwidth-min output 10 10 60 20&#xA;&#xA;[...etc...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have been experimenting with wfq configuration for the Comware switch, but I cannot seem to fit the pieces together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I &lt;em&gt;think&lt;/em&gt; I want to do is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Classify the traffic on each VLAN into a local-precendence group (0-7) using something like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traffic classifier BLAH operator and&#xA;  if-match any&#xA;&#xA;traffic behavior BLAH&#xA;  remark local-precendence 7&#xA;&#xA;qos policy BLAH&#xA;  classifier BLAH behavior BLAH&#xA;&#xA;qos vlan-policy BLAH vlan 10 inbound&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And use the local-precedence groups to separate the traffic into different wfq queues with a guaranteed minimum bandwidth:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ten-GigabitEthernet 1/1/8&#xA;  qos wfq byte-count&#xA;  qos wfq 7 group 1 byte-count 5&#xA;  qos bandwidth queue 7 min 4000000&#xA;[...etc...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although the configuration seems to work, I cannot confirm that the traffic is marked correctly and weighted fair queuing is actually taking place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone point me in the right direction?&lt;/p&gt;&#xA;" OwnerUserId="10026" LastEditorUserId="36720" LastEditDate="2020-01-02T13:57:07.290" LastActivityDate="2020-01-02T13:57:07.290" Title="QoS on an HP 6125 XLG switch running Comware 7" Tags="|qos|hp|hp-comware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12622" PostTypeId="1" AcceptedAnswerId="18007" CreationDate="2014-10-23T13:44:22.697" Score="4" ViewCount="6879" Body="&lt;p&gt;Is there a way to configure a fortinet firewall (e.g, fortigate600 running FortiOS 5 or FortiOS 4) so it do not generate log entries for pings that are directed to the firewall's own interfaces but still do generate log entries for implicitly denied traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In both cases, the log entries specifies the policy with id '0' as the policy generating the log message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of successful pings, 'status' is set to 'accept' in the log and the VDOM name is set as the 'dstintf'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to create firewall rules that match the ping traffic directed to local firewall interfaces, with the intent to explicitly disable logging, but I failed to come up with a rule that manage to match the traffic.  Also, there is the option to disable the logging for implicit rule 0 (the implicit 'deny' rule at the bottom of the policy) but that also disables the logging of denied traffic, which is not what I want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pinging firewall interfaces (for determining that the firewall interface is available) is relied upon in certain situations and can not always be designed away. (E.g is some setups using load balancers).  Also, being able to configure network equipment to avoid unwanted logging messages from being generated is always desirable, to keep down the amount of &quot;noise&quot; that is sent to external logging servers (Splunk etc), and in our case, logs about those 'heartbeat pings' is just considered noise.&lt;/p&gt;&#xA;" OwnerUserId="3306" LastActivityDate="2015-04-21T11:57:17.770" Title="Fortigate logging: how to prevent ping to firewall interface to be logged while still getting logs for implicitly denied traffic" Tags="|firewall|fortigate|logging|fortinet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12624" PostTypeId="2" ParentId="12531" CreationDate="2014-10-23T14:28:51.917" Score="1" Body="&lt;p&gt;Assuming you have something to the likes of:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[ 10.0.0.0/8 nets ] --- [ router ] --- [ asa ] ---&gt; [ internet ]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try something like the below. Note the config isn't complete, meaning it doesn't allow Internet access for example. If you post your full config, we could provide a little more help. Just redact anything sensitive like you've been doing (passwords, PSK's, outside IP's, etc. etc.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;!&#xA;!&#xA;interface Ethernet0/0&#xA; description to internet&#xA; nameif outside&#xA; security-level 0&#xA; ip address 1.1.1.2 255.255.255.252&#xA;!&#xA;interface Ethernet0/1&#xA; description to router&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.10.10.252 255.255.255.252&#xA;!&#xA;!&#xA;!&#xA;object-group protocol PROTOCOLS_ALL&#xA; protocol-object ip&#xA; protocol-object icmp&#xA;!&#xA;object-group network GRP_AWS_NET&#xA; network-object 172.17.0.0 255.225.0.0&#xA;!&#xA;object-group network GRP_LOCAL_NETS&#xA; network-object 10.0.0.0 255.0.0.0&#xA;!&#xA;!&#xA;!&#xA;access-list acl-amzn extended permit ip object-group GRP_LOCAL_NETS object-group GRP_AWS_NET&#xA;access-list inside_access_in extended permit object-group PROTOCOLS_ALL object-group GRP_LOCAL_NETS object-group GRP_AWS_NET&#xA;access-list inside_access_in extended permit object-group PROTOCOLS_ALL object-group GRP_AWS_NET any&#xA;!&#xA;!&#xA;!&#xA;access-group outside_access_in in interface outside&#xA;access-group inside_access_in in interface inside&#xA;!&#xA;!&#xA;!&#xA;route outside 0.0.0.0 0.0.0.0 1.1.1.1 1&#xA;route inside 10.0.0.0 255.0.0.0 10.10.10.251&#xA;!&#xA;!&#xA;!&#xA;global (outside) 1 interface&#xA;nat (inside) 0 access-list acl-amzn&#xA;nat (inside) 1 10.0.0.0 255.0.0.0&#xA;!&#xA;!&#xA;!&#xA;crypto map outside_map 1 match address acl-amzn&#xA;crypto map outside_map 1 set pfs&#xA;crypto map outside_map 1 set connection-type originate-only&#xA;crypto map outside_map 1 set peer &amp;lt;YOUR_AMZN_IP_1&amp;gt; &amp;lt;YOUR_AMZN_IP_2&amp;gt;&#xA;crypto map outside_map 1 set transform-set transform-amzn&#xA;crypto map outside_map 1 set nat-t-disable ! &amp;lt;--- this may help you. give it a try.&#xA;crypto map outside_map interface outside&#xA;!&#xA;!&#xA;!&#xA;tunnel-group &amp;lt;YOUR_AMZN_IP_1&amp;gt; type ipsec-l2l&#xA;tunnel-group &amp;lt;YOUR_AMZN_IP_1&amp;gt; ipsec-attributes&#xA; pre-shared-key  SOME_PRESHARED_KEY&#xA;!&#xA;tunnel-group &amp;lt;YOUR_AMZN_IP_2&amp;gt; type ipsec-l2l&#xA;tunnel-group &amp;lt;YOUR_AMZN_IP_2&amp;gt; ipsec-attributes&#xA; pre-shared-key  SOME_PRESHARED_KEY&#xA;!&#xA;!&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5601" LastActivityDate="2014-10-23T14:28:51.917" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12625" PostTypeId="1" CreationDate="2014-10-23T16:11:03.167" Score="6" ViewCount="1962" Body="&lt;p&gt;We have a Cisco WLC2504 campus controller that serves our 19 access points across the organization.  We're having a meetup this week with all of the technical staff.  70 people with their iphones, nexus 7's, ipads, all that good stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Signal strength is fantastic, however latency is horrible and people occasionally get disconnected completely even though signal strength is showing excellent reception.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My gut instinct is that the Cisco 3602e access point that services the area where most of the people are housed is overloaded.  I'm wondering if there's any particular error log entry on the AP itself or the WLC2504 that might indicate to me that the intermittent service is due to band overcrowding?&lt;/p&gt;&#xA;" OwnerUserId="154" LastActivityDate="2014-12-23T21:13:03.077" Title="Is there a way to tell if a Cisco access point is overloaded?" Tags="|cisco|wireless|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12626" PostTypeId="1" AcceptedAnswerId="12627" CreationDate="2014-10-23T18:17:21.253" Score="7" ViewCount="8235" Body="&lt;p&gt;I understand that Carrier Sense is essentially the NIC &quot;listening&quot; to the medium for any transmissions, Multiple Access means that multiple devices on the network can &quot;listen&quot; to the medium, and Collision Detection is the procedure it goes through if there is a Frame collision. My question is how does a NIC actually determine if there was a collision? is there a discrepancy in the voltages, or what?&lt;/p&gt;&#xA;" OwnerUserId="10032" LastActivityDate="2016-03-31T13:25:15.993" Title="How does Ethernet detect a collision in the CSMA/CD method?" Tags="|ethernet|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12627" PostTypeId="2" ParentId="12626" CreationDate="2014-10-23T18:36:40.440" Score="5" Body="&lt;p&gt;Assume you have the following situation...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;PC with the NIC hard-coded to 100Mbps, Full-duplex&lt;/li&gt;&#xA;&lt;li&gt;RJ45 cable, pinned EIA-568B (not that the colors in the pinout matter)&lt;/li&gt;&#xA;&lt;li&gt;Cisco Catalyst Switch, using autonegotiation (at 100Mbps)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since the PC's NIC is locked at 100/full, the Cisco's Ethernet autonegotiation fails and it falls back to 100/half. Now there is a duplex mismatch on the line.  The Cisco switch uses CSMA/CD for access to the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume the PC and the Cisco both transmit at exactly the same instant; the logical diagram and physical layer diagram show the same behavior from two different perspectives, but the physical layer diagram is most relevant to your question.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  LOGICAL DIAGRAM&#xA;  ===============&#xA;&#xA;                   Tx                     Tx&#xA;  100/full       -----&amp;gt;                 &amp;lt;-----   100/half&#xA;  PC        -----------------------------------  Cisco Catalyst Switch&#xA;&#xA;&#xA;  PHYSICAL LAYER PIN DIAGRAM&#xA;  ==========================&#xA;&#xA;      PC                                         Cisco Catalyst Switch&#xA;      100/full                                   100/half&#xA;&#xA;                    Tx D1             &#xA;                    -----&amp;gt;&#xA;      568B                                       568B&#xA;      Pin Signal                                 Pin Signal&#xA;      1   TX+ D1    ---------------------------  3   RX+ D2&#xA;      2   TX- D1    ---------------------------  6   RX- D2&#xA;      3   RX+ D2    ---------------------------  1   TX+ D1&#xA;      6   RX- D2    ---------------------------  2   TX- D1&#xA;&#xA;                                         &amp;lt;------&#xA;                                           Tx D1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the diagrams above, the PC (full duplex) is on the left and the Cisco Switch (half duplex) is on the right.  Both sides transmit (Tx) simultaneously on pins 1 and 2, this pair of pins is called D1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the NIC on the switch receives the PC's frame on the D2 pair while the switch is simultaneously transmitting on the D1 pair, the switch registers a collision (&lt;a href=&quot;https://electronics.stackexchange.com/a/98457/4179&quot; title=&quot;Electronics.SE&quot;&gt;answer reference&lt;/a&gt;).  The collision is only registered on the switch, because it is in half-duplex mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notes about GigabitEthernet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Half-duplex is called out in the standard&lt;sup&gt;&lt;em&gt;Note 1&lt;/em&gt;&lt;/sup&gt;; however, nobody actually uses half-duplex GigE.  This means that GE won't use CSMA/CD&lt;/li&gt;&#xA;&lt;li&gt;GE uses all 8 pins in the RJ45 mod plug, and the specific TX / RX pins are allocated dynamically.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;End Notes&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;em&gt;Note 1&lt;/em&gt;&lt;/sup&gt; Quoting IEEE 802.3-2012 4.1 (Italic emphasis mine):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;4.1.2.1.2 Reception without contention&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;em&gt;In half duplex mode, at an operating speed of 1000 Mb/s&lt;/em&gt;, frames may be extended by the transmitting station under the conditions described in 4.2.3.4. The extension is discarded by the MAC sublayer of the receiving station, as defined in the procedural model in 4.2.9.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:08.917" LastActivityDate="2014-10-23T23:42:58.493" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="12628" PostTypeId="2" ParentId="12626" CreationDate="2014-10-23T19:39:29.430" Score="2" Body="&lt;p&gt;In the olden days (10base-2), a collision was detected by current sensing -- it takes more power (electrical current) when two transmitters step on each other. For the 10/100/1000-baseT specs, it's as simple as looking at the RX pair while transmitting on your TX pair. (or &lt;em&gt;pairs&lt;/em&gt; in the case of 1000, but gig-e never does half-duplex.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modern (for 10base-X tech) transceivers use echo cancellation to subtract their signal from the wire to listen for other signals.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-10-23T19:39:29.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12629" PostTypeId="2" ParentId="12605" CreationDate="2014-10-23T21:12:30.433" Score="2" Body="&lt;p&gt;With your &quot;one big /24&quot; solution, each client router will need to make a decision of which upstream peering router to send traffic to, so they would either need to carry full internet routes or use some other (e.g. policy-based) method to make a decision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With your &quot;one big core router&quot; solution, each client router simply needs to have a default route pointing to the one big core router, which in turn will make the upstream routing decision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, I wouldn't recommend having just &quot;one big core router&quot;, but would prefer to see &quot;two big core routers&quot; instead.  Each client router can then be dual-homed to those two big core routers, providing the necessary redundancy (both for connectivity and routing) when there is a core router failure.&lt;/p&gt;&#xA;" OwnerUserId="1680" LastActivityDate="2014-10-23T21:12:30.433" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12630" PostTypeId="1" AcceptedAnswerId="12645" CreationDate="2014-10-23T21:41:29.383" Score="2" ViewCount="206" Body="&lt;p&gt;Can I create a local ip pool with a /22 mask to support 1022 VPN hosts on an ASA or limited to a /24 mask per subnet&lt;/p&gt;&#xA;" OwnerUserId="6069" LastActivityDate="2014-10-24T16:23:08.967" Title="Cisco ASA 5520 - Create local VPN pool" Tags="|cisco-asa|vpn|ipsec|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12631" PostTypeId="1" AcceptedAnswerId="41018" CreationDate="2014-10-23T22:30:56.620" Score="2" ViewCount="2832" Body="&lt;p&gt;We have an unknown device causing broadcast storms on the network. I have applied storm control to ever single access port in the location, and yet the broadcast storm exists. I was wondering if I could apply Storm Control to an trunking interface to protect that switch by simply filtering excess broadcasts. So I setup storm control as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA; storm-control broadcast level pps 1k 100&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then cleared the interface counters and checked the interface stats&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interface g0/1&#xA;GigabitEthernet0/1 is up, line protocol is up (connected)&#xA;  Hardware is Gigabit Ethernet, address is 0019.e781.b981 (bia 0019.e781.b981)&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, &#xA;     reliability 255/255, txload 1/255, rxload 2/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not set&#xA;  Full-duplex, 1000Mb/s, link type is auto, media type is 1000BaseSX SFP&#xA;  input flow-control is off, output flow-control is unsupported &#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:00, output 00:00:03, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 00:00:04&#xA;  Input queue: 1/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 8188000 bits/sec, 10874 packets/sec&#xA;  5 minute output rate 5000 bits/sec, 3 packets/sec&#xA;     43901 packets input, 4142320 bytes, 0 no buffer&#xA;     Received 43855 broadcasts (0 multicast)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 43763 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     33 packets output, 4676 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So its been 4 seconds, and I've already got 43855. That was WAY above the 1,000 packets limit I set. However, it doesn't seem to care about filtering at all and just keeps forwarding/processing the traffic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show storm-control g0/1&#xA;Interface  Filter State   Upper        Lower        Current&#xA;---------  -------------  -----------  -----------  ----------&#xA;Gi0/1      Forwarding         1k pps      100 pps       13 pps&#xA;show storm-control g0/1&#xA;Interface  Filter State   Upper        Lower        Current&#xA;---------  -------------  -----------  -----------  ----------&#xA;Gi0/1      Forwarding         1k pps      100 pps       29 pps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does encapsulation prevent storm control from working? Does storm control simply not work on trunking ports? I'm worried that storm control might not be in effect at all on any of the switches, despite having it enabled.&lt;/p&gt;&#xA;" OwnerUserId="10034" LastActivityDate="2017-05-08T00:12:36.587" Title="Cisco: Storm Control not filtering packets on trunking port" Tags="|cisco|broadcast|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12633" PostTypeId="2" ParentId="12631" CreationDate="2014-10-24T02:44:14.447" Score="2" Body="&lt;p&gt;Try enabling &quot;storm control multicast level pps 1k 100&quot; and enable the action when the level you just configured is reached: &quot;storm-control action {shutdown | trap}&quot;&lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-10-24T02:44:14.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12635" PostTypeId="1" AcceptedAnswerId="12636" CreationDate="2014-10-24T05:21:08.320" Score="-1" ViewCount="488" Body="&lt;p&gt;I was always curious why I can't capture other people's packets that are flying on air by Wireshark. Of course I know there's airmon-ng but I was just wondering why Wireshark itself can't &quot;just simply&quot; capture it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I'm a computer science major, I tried thinking my best based on what I have learned and finally came up guessing should it have anything to do with the CDMA that wireless protocols use? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I've learned that every users have their own chip code to minimize the interference from each other by transmitting in same frequency, does it mean that since I don't have the chip code of every other users, I can't display other people's packets?&lt;/p&gt;&#xA;" OwnerUserId="9922" LastEditorUserId="775" LastEditDate="2014-12-08T12:13:16.087" LastActivityDate="2019-06-10T15:13:24.603" Title="is CDMA the main reason why Wireshark can't capture packet on wireless in promiscuous mode?" Tags="|wireless|wireshark|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12636" PostTypeId="2" ParentId="12635" CreationDate="2014-10-24T05:57:40.737" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I was always curious why I can't capture other people's packets that are flying on air by Wireshark. Of course I know there's airmon-ng but I was just wondering why Wireshark itself can't &quot;just simply&quot; capture it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because the only OS that makes it relatively simple to put a Wi-Fi interface into monitor mode is OS X.  With a bunch of work the versions of libpcap that ship with Linux distribution should be able to capture in monitor mode using the same APIs that Just Work with OS X (using the same mechanisms that airmon-ng uses, but without using libnl, which is a bit of a Library From Hell); with some more work, it should be able to work with current versions of FreeBSD as well.  (On Windows, significant changes would need to made to the kernel-mode driver that's part of WinPcap.)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;should it have anything to do with the CDMA that wireless protocols use?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Given that the only wireless protocols that use CDMA are 1) the 2G CDMAone mobile phone radio-layer protocols from Qualcomm and 2) both the CDMA2000 and W-CDMA mobile phone radio-layer protocols, no, it wouldn't have anything to do with that.  Wi-Fi doesn't use CDMA, nor does 2G GSMA nor LTE.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Since I've learned that every users have their own chip code to minimize the interference from each other by transmitting in same frequency, does it mean that since I don't have the chip code of every other users, I can't display other people's packets?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That might cause a problem if you're trying to capture on a 2G CDMAone network or a 3G network, but it would be far from the only problem.  On a Wi-Fi network, however, users &lt;em&gt;don't&lt;/em&gt; have chip codes, because Wi-Fi, as noted, doesn't use CDMA.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2014-10-24T05:57:40.737" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12637" PostTypeId="2" ParentId="3780" CreationDate="2014-10-24T06:34:10.233" Score="1" Body="&lt;p&gt;Not sure of the type of handover you are talking here. In general, Inter-RAT handover of LTE to UMTS does not require any change in MAC layer as the PDCP layer takes care of the packet delivery.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The handover procedure shall be similar to that of Intra-LTE mobility banked upon S1-based handover based procedures. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SGW plays the role of anchor in case of handover with other 3GPP technologies like UMTS or GPRS. In case of mobility from S1 mode to Iu mode, as soon as the source eNB sends a handover required message to source MME, it will do a forward relocation request to Target SGSN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The target SGSN does the mapping of the EPS bearers to PDP contexts. It also maps the EPS bearer QoS to that of Rel99 QoS parameters and triggers a Relocation request message to Target RNC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The target RNC allocates the resources and returns the applicable parameters to the target SGSN in the message Relocation Request Acknowledge message. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the Forward relocation response from Tgt SGSN to MME, it can establish path for either an indirect forwarding or direct forwarding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the Handover complete is indicated by UE, If it is direct forwarding, source eNB will perform direct forwarding of DL data to Target RNC else if it is indirect forwarding, source eNB will forward the DL data to SGW and via Tgt SGSN to Target RNC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seamless handover does not use a STATUS TRANSFER msg and hence it should be fine. However, incase of lossless handover, the PDCP status preservation shall not be present(context shall not be continued) as STATUS TRANSFER message was introduced in LTE and not supported in UMTS.&lt;/p&gt;&#xA;" OwnerUserId="8550" LastActivityDate="2014-10-24T06:34:10.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12638" PostTypeId="1" AcceptedAnswerId="12648" CreationDate="2014-10-24T07:39:42.957" Score="5" ViewCount="2165" Body="&lt;p&gt;how can I filter all the routes from one AS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GWejj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I want to filter all routes from  AS 6400 towards AS1000, how can I filter whole routes from one AS to another?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not want to be used as transit AS so I need to do that, I Googled and got some stuff about using prefix-list + route-map but the thing is AS6400 is an actual Internet active AS which hosts some 500000 plus routes, and it does not sound reasonable to write prefix list for that amount of route, so what should I do?&lt;/p&gt;&#xA;" OwnerUserId="7741" LastActivityDate="2019-02-09T12:32:31.570" Title="how can I filter all the BGP routes from one specific AS?" Tags="|bgp|route-filter|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12639" PostTypeId="1" CreationDate="2014-10-24T08:09:04.427" Score="3" ViewCount="1277" Body="&lt;p&gt;I have two Cisco 2921's that run a site to site with static crypto maps. Everything seems pretty straightforward. Plenty of people do this. I don't have trouble with this typically. Today, the VPN just decided that it didn't want to work. I have checked over phase 1 and phase 2 in triple on both ends, I have rebuilt both routers configs from the ground up. I was running yesterday. WTH? I feel that this is just odd behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are failing on phase 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone else have an issue like this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ill post my config for posterity:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router-A&#xA;crypto isakmp policy 10&#xA; encr 3des&#xA; hash md5&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key xyz address 50.xx.xx.xx   &#xA;crypto ipsec transform-set VPN_SET esp-3des esp-md5-hmac &#xA; mode tunnel&#xA;crypto map S2S_VPN 1 ipsec-isakmp &#xA; description S2S VPN to Home Motors&#xA; set peer 50.xx.xx.xx&#xA; set transform-set VPN_SET &#xA; set pfs group1&#xA; match address VPN_ACL&#xA;ip access-list extended PRC_HM_VPN_ACL&#xA; permit ip 10.x.x.0 0.0.0.255 10.x.x.0 0.0.0.255&#xA; permit ip 10.x.x.0 0.0.0.255 10.x.x.0 0.0.0.255&#xA; permit ip 10.x.x.0 0.0.0.255 10.x.x.0 0.0.0.255&#xA; permit ip 10.x.x.0 0.0.0.255 10.x.x.0 0.0.0.255&#xA;&#xA;Router-B&#xA;crypto isakmp policy 10&#xA; encr 3des&#xA; hash md5&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key xyz address 206.xx.xx.xx&#xA;crypto ipsec transform-set S2S_SET esp-3des esp-md5-hmac&#xA; mode tunnel&#xA;crypto map S2S_VPN 1 ipsec-isakmp&#xA; description S2S VPN to Paso Robles Chevrolet&#xA; set peer 206.xx.xx.xx&#xA; set transform-set S2S_SET&#xA; set pfs group1&#xA; match address VPN_ACL&#xA;ip access-list extended VPN_ACL&#xA; permit ip 10.x.x.0 0.0.0.255 10.x.x.0 0.0.0.255&#xA; permit ip 10.x.x.0 0.0.0.255 10.x.x.0 0.0.0.255&#xA; permit ip 10.x.x.0 0.0.0.255 10.x.x.0 0.0.0.255&#xA; permit ip 10.x.x.0 0.0.0.255 10.x.x.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the crypto maps applied to the appropriate outside interfaces with matching IPs&lt;/p&gt;&#xA;" OwnerUserId="5187" LastEditorUserId="5187" LastEditDate="2014-10-24T15:57:15.913" LastActivityDate="2014-12-03T00:22:04.743" Title="Site to Site VPN between two Cisco 2921's IOS 15.2" Tags="|vpn|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12642" PostTypeId="2" ParentId="12630" CreationDate="2014-10-24T13:24:20.107" Score="-1" Body="&lt;p&gt;I dont see a reason why it wouldnt work with 22 prefix.&#xA;Not sure the ASA has the hardware to deal 1000 vpn connections.&lt;/p&gt;&#xA;" OwnerUserId="10042" LastActivityDate="2014-10-24T13:24:20.107" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12643" PostTypeId="2" ParentId="12622" CreationDate="2014-10-24T13:42:49.920" Score="0" Body="&lt;p&gt;A policy allowing ping only from specific addresses following by a policy that denies ping from any source. havent tested it, but if it falls on a policy, it shouldnt get to the implicit rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to restrict admin login from specific host. you can restrict the admin login to all addresses that you need ping from and addresses that needs access to the fortigate. if anyone else tries to ping, it will be blocked before it gets to the policies.&lt;/p&gt;&#xA;" OwnerUserId="10042" LastActivityDate="2014-10-24T13:42:49.920" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12644" PostTypeId="2" ParentId="12638" CreationDate="2014-10-24T15:14:50.790" Score="6" Body="&lt;p&gt;If your goal is to not transit traffic through your AS to others, all you need to do is strictly control your outbound announcements to ensure that only your routes are advertised to either upstream peer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are an edge AS (not a BGP-speaking ISP to your own customers) the simple way is almost exactly as you mentioned, but just using a prefix-list to control route announcements to peers.  Define all of your prefixes exactly as you want to announce them to the peers, then apply that prefix-list outbound toward both peers.  There is a great example of this (among other good BGP practices) on the Team Cymru &lt;a href=&quot;https://www.team-cymru.org/ReadingRoom/Templates/secure-bgp-template.html&quot; rel=&quot;noreferrer&quot;&gt;Secure BGP Template&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Their example shows the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp ###&#xA;neighbor x.x.x.x remote-as ****&#xA;neighbor x.x.x.x prefix-list announce out&#xA;&#xA;ip prefix-list announce description Our allowed routing announcements&#xA;ip prefix-list announce seq 5 permit 192.0.2.0/24&#xA;ip prefix-list announce seq 10 deny 0.0.0.0/0 le 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This causes the 192.0.2.0/24 network to be matched exactly and permitted, while the next line matches all other prefixes (mask length is 0, but match length is less-than/equal-to 32) and denies them.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="3912" LastEditDate="2014-10-24T16:15:16.923" LastActivityDate="2014-10-24T16:15:16.923" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12645" PostTypeId="2" ParentId="12630" CreationDate="2014-10-24T15:47:02.970" Score="4" Body="&lt;p&gt;ASA VPN address pools can be a /22 (or larger) and function correctly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The limitation of how many of those addresses can actually be active at any one time is based on the hardware in use. The 5520 supports up to 750 concurrent VPN peers per the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/product_data_sheet0900aecd802930c5.html&quot; rel=&quot;nofollow&quot;&gt;datasheet&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="3912" LastEditDate="2014-10-24T16:23:08.967" LastActivityDate="2014-10-24T16:23:08.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12647" PostTypeId="1" AcceptedAnswerId="12656" CreationDate="2014-10-24T16:38:47.413" Score="4" ViewCount="1256" Body="&lt;p&gt;I have inherited a network with significant wireless demands and it is having problems. My background is in application development so please understand if I have some erroneous assumptions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problems:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Slow response less than 1 mps&lt;/li&gt;&#xA;&lt;li&gt;Dropped connections&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Layout:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Internet&lt;/li&gt;&#xA;&lt;li&gt;Comcast Modem (&lt;strong&gt;up to&lt;/strong&gt; 150 mps)&lt;/li&gt;&#xA;&lt;li&gt;ZyWall USG 100 (Manages 4 VLANS with DHCP for 200 ip addresses each)&lt;/li&gt;&#xA;&lt;li&gt;NetGear 24 Port POE Switch (GS728TP)&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;4 ports go to 4 Ruckus 7376 AP&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All Cat5E cables&lt;/li&gt;&#xA;&lt;li&gt;All devices noted to be 10/100/1000&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Audience:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;60+ Students on wireless laptops&lt;/li&gt;&#xA;&lt;li&gt;10+ staff laptops and tablets&lt;/li&gt;&#xA;&lt;li&gt;5-10 guests (phones, etc...)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Notes/Thoughts:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The APs are set to give out at most 3Mps per station (Rate Limit per SSID). So my assumption is 80-100M reliable throughput / 80 = 1+ mbps average throughput per station. I am seeing .4 Mbps or dropped wireless connections. &lt;/li&gt;&#xA;&lt;li&gt;With less than 25 users on the wireless network things seem to be fine.&lt;/li&gt;&#xA;&lt;li&gt;Most of the users connect through 2 of the APs and are in close proximity to each other with their devices. I am not sure if the APs just cannot handle that many stations or if there is just too much noise and the APs are getting confused. The APs are set to 40mhz which is suppose to allow up to 300Mps throughput.&lt;/li&gt;&#xA;&lt;li&gt;I have noted Packet Error Rates of 40-80% during high volume periods&lt;/li&gt;&#xA;&lt;li&gt;The firewall resources show less than half utilization, but my reading has told me not to rule out getting a better firewall. Is it taking to much time for the firewall to relay DCHP information.&lt;/li&gt;&#xA;&lt;li&gt;The APs run on only 2.4 Ghz. (that was how it was orginaly setup). I am unsure on how to get the figures regarding the channel utilization.&lt;/li&gt;&#xA;&lt;li&gt;During peek times there are an average of 36 device trying to connect through one AP.&lt;/li&gt;&#xA;&lt;li&gt;Just checked and all priority devices use Dell Wireless 1506 802.11b/g/n (2.4) cards. So no benefit I can see for setting up 5Ghz connections.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Looking for&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overall direction and recommendations on how to narrow down problem device or service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any advice!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Direction Taken&lt;/strong&gt;&#xA;As of 10/28/2014&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sight survey was done previously from what I am told (they did not leave any documentation), but they never took into account the number of intended devices and proximity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also disabled Wireless B connections with out much improvement from what I can tell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since all the important devices only operate on 2.4 Ghz and we are getting significant noise issues, I believe that if a move one AP directly into one room and move another AP (rarely used), into the room across the hall. Setting them up using the channels 1 and 11 (non overlapping channels) at 20Mhz would allow for reduced devices per AP and better connection (less noise on one channel). Also, setting the Level to low.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;GOOD NEWS&lt;/strong&gt; as of 10/29/2014&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far the changes made have shown a huge improvement. Here are the key notes&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;3 APS instead of 2&lt;/li&gt;&#xA;&lt;li&gt;re-positioning APs &lt;/li&gt;&#xA;&lt;li&gt;Non-overlapping channels 1,6,11&lt;/li&gt;&#xA;&lt;li&gt;Power Level set to Half or Lower&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10046" LastEditorUserId="10046" LastEditDate="2014-10-29T14:52:46.633" LastActivityDate="2014-10-29T14:52:46.633" Title="Wireless Network Issues - Dropped Connections" Tags="|wireless|access-point|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12648" PostTypeId="2" ParentId="12638" CreationDate="2014-10-24T16:59:35.897" Score="9" Body="&lt;p&gt;There are a couple ways to do this, without having to specify every single prefix that you're receiving from AS6400 in a prefix-list (I would personally advise against doing this because as you mentioned, the administrative overhead is high and the process will become exponentially more error-prone as the number of prefixes increases).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Tag routes you've received from AS6400 with the no export community. You would do this within a route-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map RECEIVE-FROM-6400 permit 5&#xA;  set community no-export additive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will tell R3 to &lt;em&gt;not&lt;/em&gt; advertise the routes learned from AS6400 to AS1000 via the eBGP session to R1. This is your simplest option (note here that this will need to be an &lt;strong&gt;inbound&lt;/strong&gt; filter applied on R4 on the eBGP session to R2/AS6400).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) You could use an AS Path access list to determine which prefixes have an AS path that begins with 6400 and then you could use it on a BGP neighbor statement with a filter list, or you could use it in a route-map to deny advertising the prefixes on R3. This is less simple because it requires knowledge of regex (to be fair, the regex required here is somewhat simple) and it also depends on no one doing anything funny with their AS path, of which there's no real guarantee. Using a route-map, the configuration to implement would look something like this (assuming IOS):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip as-path access-list 10 permit ^6400_[0-9]*$&#xA;&#xA;route-map ANNOUNCE-TO-1000 deny 5&#xA;  match as-path 10&#xA;&#xA;route-map ANNOUNCE-TO-1000 permit 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the above will need to be configured as an &lt;strong&gt;outbound&lt;/strong&gt; filter on R3 for the eBGP session with AS1000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the well-known 'no export' community is likely going to be your best bet, along with being very judicious with your outbound announcements to AS1000 and AS6400.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2014-10-25T21:34:50.853" LastActivityDate="2014-10-25T21:34:50.853" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12651" PostTypeId="2" ParentId="12647" CreationDate="2014-10-24T19:17:42.650" Score="1" Body="&lt;p&gt;&lt;em&gt;I only can tell about dropped conections&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My scenario: Only 10 computer accesing a single Wireless Access Point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My sloppy solution was to change from 2.4GHz (B+G+N) to 2.4 GHz (G+N). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My maximum internet speed was 1MB/s and didn't decrease with the change and the signal is now much more consistent with no drops. &lt;/p&gt;&#xA;" OwnerUserId="10050" LastActivityDate="2014-10-24T19:17:42.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12652" PostTypeId="2" ParentId="9381" CreationDate="2014-10-24T20:09:36.950" Score="0" Body="&lt;p&gt;What core switches are you running? Policies are usually done at the distribution layer, if you are going with a collapsed Core design, then the core should be able to handle your requirements.  Also, are you liking for statefull inspection or just acls. If you have any compliance you need to follow, acls may not be enough.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I would go with a firewall, perhaps look for one that can be clustered so you can cluster each together and maintain centrally managed rule base, such as a sourcefire firewall.  &lt;/p&gt;&#xA;" OwnerUserId="10052" LastActivityDate="2014-10-24T20:09:36.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12653" PostTypeId="2" ParentId="12625" CreationDate="2014-10-24T20:15:19.040" Score="2" Body="&lt;p&gt;It's the ap light weight pot autonomous? There should be logs in the wlc that could give you an indication.  Keep in mind that every connected user shares the lowest connected speed of a client.  Set your required speeds to a high enough setting and lower the power not to over saturate the area.  Multiple aps also where needed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We use 4aps in a lecture hall of about 100 students.  No complaints from any of them.&lt;/p&gt;&#xA;" OwnerUserId="10052" LastActivityDate="2014-10-24T20:15:19.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12656" PostTypeId="2" ParentId="12647" CreationDate="2014-10-25T05:20:32.257" Score="3" Body="&lt;p&gt;The better approach for deploying AP is a complete site survey to determine the AP density , multipath propagation characteristics, interference, noise etc.. before setting up the AP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first immediate checkpoint for the scenario in-hand should be checking of SNR, RSSI and operating frequency/co-channel interference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For optimal performance, placement of AP plays a key role. AP should be located centrally within areas requiring coverage. Ensure to avoid coverage holes with proper overlapping of APs coverage areas. The radio range and data rate are inversely proportional. That is, the nearer the user to the AP, the higher the data rate(Due to reduced path loss and high SNR). For effective radio range, also ensure to avoid buildings in-between.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The type of antenna, its placement and antenna gain are crucial in deciding the maximum radio range and the coverage area. The range is directly proportional to antenna height, however if the height is beyond certain limit, interference can be more. An istropic antenna provides coverage area in the form a sphere. Dipole antenna provides coverage area in the form of doughnut. There are also various directional antennas. Beware that the omni-directional antenna can lead to hidden node problem incase of large cell size. Antenna with focused beam can be helpful. Multi-sector directional antenna can give high capacity, range. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Determine if there are other active channels in your environment that introduce interference. Presence of other APs operating in the same frequency in the same radio coverage area can cause interference. The operating channel and channel separation can also play a role in connection speed / call drops. You may need to change the channel/separation accordingly to reduce interference incase if there are only 802.11 devices. However it might not solve the problem incase of presence of interference from other non-802.11 technology devices (Bluetooth/Cordless phones etc..).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that interference need not necessarily from another 802.11 devices, but also from other non-802.11 devices(Microwave oven, Cordless phones, Bluetooth devices...) that can cause secondary effects such that data rate gets reduced. The impact can be due to  high output power and the time/frequency the signal is on. For example, Microwave ovens mostly operate in the same frequency band as 802.11b/g and hence are more likely to cause interference. It is better to keep away such devices(Microwave ovens,bluetooth, cordless phones etc...) from the coverage area or shield those devices to continue presence in the coverage area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a typical tradeoff between capacity and coverage. The higher power level can increase the range but if there are nearby APs, it can lead to interference. If the capacity is of importance, it is better to have the APs closer together. However if the APs are closely placed, the proper level should be set to low to reduce co-channel interference. So, ensure to keep optimal power levels. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above such points should be analyzed along with site survey and the collected data should be analyzed for optimal performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From your observations of high PER, suggest that transmission channel is impacted due to high interference / multipath fading/channel noise. A proper site survey can be very helpful to you.&lt;/p&gt;&#xA;" OwnerUserId="8550" LastEditorUserId="8550" LastEditDate="2014-10-26T20:12:43.427" LastActivityDate="2014-10-26T20:12:43.427" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12660" PostTypeId="2" ParentId="12534" CreationDate="2014-10-25T15:33:07.420" Score="3" Body="&lt;p&gt;The response depends on the type of Operating System. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The combination of SYN and FIN flag being set in TCP header is illegal and it belongs to the category of illegal/abnormal flag combination because it calls for both establishment of connection(via SYN) and termination of connection(via FIN). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The method to handle such illegal/abnormal flag combinations is not conveyed in the RFC of TCP. So, such illegal/abnormal flag combinations are handled differently in various operating systems. Different operating system also generate different kind of responses for such packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a very big concern for security community because attackers shall exploit these response packets to determine the type of OS on the target system to craft his attack. So, such flag combinations are always treated as malicious and modern intrusion detection systems detect such combinations to avoid attacks.&lt;/p&gt;&#xA;" OwnerUserId="8550" LastActivityDate="2014-10-25T15:33:07.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12665" PostTypeId="2" ParentId="11154" CreationDate="2014-10-26T00:20:04.113" Score="2" Body="&lt;p&gt;It depends on several factors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IF there is only a single ring (eg. each switch is connected to exactly two switches using exactly one cable to each switch) and the source is connected to one of the switches then if you do a broadcast storm (destination MAC FF:FF:FF:FF:FF:FF) and if you would constantly be flooding frames from the source then it would utilize all of the links to the full capacity in both directions (it's full duplex).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you would for example only send one frame and let it circulate, the utilization would depend on how quickly a switch can forward that frame. Then you'd need to sum up the forwarding, propagation, serialization and other delays in the entire loop and that often would that one (actually two, one in each direction) frame arrive on each particular interface. Then based on the frame size you would simply calculate the utilization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But remember, utilization is always a function of time, there is no such thing as instant utilization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to answer the formula question: utilization of each single link in one particular direction = (num_frames * frame_size / sum_of_all_delays_in_the_path) / capacity_of_the_link&lt;/p&gt;&#xA;" OwnerUserId="75" LastActivityDate="2014-10-26T00:20:04.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12666" PostTypeId="1" CreationDate="2014-10-26T02:12:29.687" Score="2" ViewCount="2421" Body="&lt;p&gt;I'm trying to use GNU screen on Ubuntu 14.04 to connect to an HP 1910-8G switch console but it is not working. So far for all of my attempts, screen seems to terminate or just appears blank. Has anyone tried this before? What command did you issue to get it working?&lt;/p&gt;&#xA;" OwnerUserId="10069" LastEditorUserId="775" LastEditDate="2015-05-04T11:15:30.973" LastActivityDate="2015-05-04T11:15:30.973" Title="How do I connect to an HP 1910 switch console from GNU screen?" Tags="|hp|hp-procurve|linux|cli|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12667" PostTypeId="2" ParentId="12666" CreationDate="2014-10-26T02:17:04.980" Score="4" Body="&lt;p&gt;I was able to get it working with this command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo screen /dev/ttyS0 38400,cs8,-ixon,ixoff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Before running the command, I had to use &lt;code&gt;dmesg&lt;/code&gt; to find which of the ttyS or ttyU devices was to be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the parameters after the ttyS device are the exact ones specified in the the HP 1910 manuals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other programs such as cu and minicom. I chose GNU screen because it was already a familiar tool. The minicom program seems to have a lot of features bu GNU screen has almost zero learning curve for me. The simplest program for me is cu, doesn't it work so great on Ubuntu - it does work well on FreeBSD and Apple OS X.&lt;/p&gt;&#xA;" OwnerUserId="10069" LastActivityDate="2014-10-26T02:17:04.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12669" PostTypeId="2" ParentId="12451" CreationDate="2014-10-26T06:13:59.330" Score="-1" Body="&lt;p&gt;Multiple channels is the WAY to make a system available for multiple users, multiple streams of multimedia of multiple bandwidth options and multiple technologies&#xA;Wireless is able to serve today 7 billion devices though the same devices are consumed by about 3.x billion people and world still needs to keep its energy and environment reachable to all humanity by 20XY year. Just like while light is of seven colors, and periodic table has multiple groups of blocks, the electromagnetic energy which is essentially from where our Radio Frequencies we use in all wireless come from is divided into several categories such as Infra-Red, Visible, Ultraviolet, Millimeter,X-Ray Gamma Ray,Ku band etc and each of these bands have some absorption band and some lucky bands like our visible band which is helping us to view this beautiful world because the visible spectrum of 7500 nano meters to 4000 nano meters of visible VIBGYOR not easily absorbed in nature in general and hence on a sunnny day we see every thing normally.The world of telecommunications is full of channels and various telecom Access technologies such as LTE, 3G, CDMA or GSM use several of these channels of different sizes in each of these technologies like 200 KHZ for eight time slots in GSM associated with a single Radio Transceiver and we have 124 of those to be divided amongst the telecommunication service providers in 900 MHz frequency range. In LTE the channel bandwidths are typically 1.4 Mhz, 3MHz,5 MHz, 10 MHz,15 and 20 MHz respectively of which 20 MHz is most widely deployed both in TDD and in FDD. There are multiple frequencies for multiple nations and you can look up more inputs in PREZI &quot;LANDSCAPE OF ELECTROMAGNETIC SPECTRUM for a global perspective of end to end frequencies and their applications using various channels including details of each channel bandwidth&lt;/p&gt;&#xA;" OwnerUserId="10071" LastActivityDate="2014-10-26T06:13:59.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12671" PostTypeId="2" ParentId="12451" CreationDate="2014-10-26T16:53:58.407" Score="1" Body="&lt;p&gt;To make a communication channel, a carrier frequency is selected (else you work on base band, which has greater loss and other problems). And on that carrier, a bandwidth for the signal is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, your carrier frequency is 2.4GHz, which means the center frequency. and the 11MHz is the bandwidth of your channel, meaning that the channel is from 2400-5.5 MHz to 2400+5.5 Mhz (5.5 = 11/2, and central freq. is 2400MHz).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Channels are used to separate signals, for different usages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example on an FM radio, each channel is used for a radio provider (I dont know what they are called in english! sorry), so when you change frequency of a radio, you can hear different radio programs.&lt;/p&gt;&#xA;" OwnerUserId="10072" LastActivityDate="2014-10-26T16:53:58.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12674" PostTypeId="2" ParentId="12451" CreationDate="2014-10-26T19:38:08.503" Score="2" Body="&lt;p&gt;Data transmission or reception happen through channels. Channel indicates the frequency range of operation. Typically its bandwidth will be +/- frequency range based on a operating frequency / center frequency.  Here 2.4Ghz is the operating frequency / carrier frequency. The channel bandwidth for 802.11b is 22Mhz. This range is divided into 14 channels spaced 5 MHz apart. Channel contention shall occur if multiple AP operate in same channel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The higher the channel bandwidth, the higher the amount of data that can be sent and higher the cost. So, Wide bandwidth channel will enable more data transfer, but in turn raises the chances of interference with other channels. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11b supports a max of only 11 Mbps data rate. Theoretical throughput is the maximum channel capacity of system that is equivalent to the maximum possible amount of data that can be transmitted in the channel in ideal conditions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presence of multiple channels provides choice of usage to avoid interference. Different countries have different policies in allowing the channel usage, number of users and power level within the operating frequency ranges.&lt;/p&gt;&#xA;" OwnerUserId="8550" LastActivityDate="2014-10-26T19:38:08.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12675" PostTypeId="1" AcceptedAnswerId="12678" CreationDate="2014-10-26T20:38:44.483" Score="2" ViewCount="8428" Body="&lt;p&gt;I have an endless amount of books and websites at my disposal, but this question stays totally unanswered, or rather every author invests his own solution for this problem. It's even placed within different layers depending on which Wikipedia article you're just reading.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        TCP/IP&#xA;|--------------------|&#xA;| application layer  |&#xA;|--------------------|&#xA;|   transport layer  |&#xA;|--------------------|&#xA;|    internet layer  |&#xA;|--------------------|&#xA;|        link layer  |&#xA;|--------------------|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I assume in my question that we all agree that TCP/IP consists of four layers. Yes, I've seen different views on this as well. Mainly people adding a fifth layer at the bottom for the physical stuff or they added a fifth layer beneath the application layer, just to place TLS there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I understand the whole thing, TLS (and the old dying SSL), are situated in the application layer of TCP/IP and acting as a wrapper around other application layer protocols (e.g. HTTP). Further they act on behalf of e.g. TCP, but the protocol is merely sitting in front of the actual application protocol rather than in the transport layer and sharing the space with TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, I'd love to hear a clarification of this maybe not so important &lt;em&gt;problem&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="9964" LastActivityDate="2014-10-30T04:17:42.490" Title="In which layer is TLS situated within the TCP/IP stack?" Tags="|protocol-theory|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12678" PostTypeId="2" ParentId="12675" CreationDate="2014-10-26T23:43:42.143" Score="6" Body="&lt;p&gt;Given the 4-layer model you are working within, TLS would fall the Application Layer.  The Transport Layer only deals with the connection mode between processes - TCP/UDP multiplexing and the like.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2014-10-26T23:43:42.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12686" PostTypeId="1" CreationDate="2014-10-27T14:25:00.180" Score="1" ViewCount="206" Body="&lt;p&gt;Please let me further elaborate on my question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say we have an HNB with 2 Watts of power allocated for the common pilot channel. This would mean that the radiated signal power at the HNB site (with 1dBi antenna attached) should be around 33-34dBm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, by using a mobile phone to test the reception, we can see that that the RSCP power will be -25dBm on the site and will gradually reduce when increasing the distance between the HNB and UE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I don't understand, is how exactly the radiated CPICH power and measured RSCP values are correlated. My goal is to calculate the exact path loss value in dBm by using these 2 parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the RSCP range is [-25;-120] by specification, but how does it correspond to standard power measurements performed with an RF power meter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Experimentally I can see that when the power meter measures ~28 dBm a couple of meters away from the HNB, this will correspond to -36 dBm RSCP on the test phone (the values are not exact, I'm just using them to illustrate my point).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I apologize for the noob question and I will be immensely grateful if anyone could explain this relation to me in an understandable way (for someone without an engineering degree).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind Regards&lt;/p&gt;&#xA;" OwnerUserId="10086" LastActivityDate="2014-10-27T14:25:00.180" Title="Is it possible to calculate the path loss in an UMTS system if the current HNB CPICH power and RSCP values are known?" Tags="|qos|mobile|broadcast|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12687" PostTypeId="1" CreationDate="2014-10-27T15:14:52.180" Score="2" ViewCount="1101" Body="&lt;p&gt;In the network below, I have a simple setup of two hosts (R1 and R2). They both are connected to a L2 access switch. Both the L2 access switches are connected on two interfaces to the L3 distribution switches. Key task is to make the communication between R1 and R2 redundant, meaning that if one of the L2 access switches would die, communication may not be interrupted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know already that there is a chance that network packets &quot;loop&quot; in the &quot;upper square&quot;, and that you have to use Spanning Tree Protocol (STP) to prevent loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I don't understand how to configure this properly with VLAN ID's. I do not use VLAN's in my setup. Do you need to use them to make STP work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 and R2 are both Cisco Catalyst 7200 routers. SW1 and SW2 are both generic L2 switches. ESW1 and ESW2 are L3 switches, which are running a Cisco 3725 IOS. In GNS they are called EtherSwitch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole setup is made in GNS 1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nb4kw.png&quot; alt=&quot;Basic setup of my network&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10088" LastActivityDate="2014-12-28T19:17:18.153" Title="How to properly configure STP in this simple setup?" Tags="|cisco|spanning-tree|redundancy|failover|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12688" PostTypeId="1" AcceptedAnswerId="12703" CreationDate="2014-10-27T16:57:00.033" Score="6" ViewCount="1949" Body="&lt;p&gt;On an IPv6 multicast packet, the last nibble of the first hextet represents the Scope of the packet.  This defines effectively how far you want your multicast packet to travel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address makeup is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|   8    |  4 |  4 |              112 bits               |&#xA;+--------+----+----+-------------------------------------+&#xA;|11111111|flgs|scop|              group ID               |&#xA;+--------+----+----+-------------------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &quot;scop&quot; bits can have any of the following values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1  Interface-Local scope&#xA;2  Link-Local scope&#xA;4  Admin-Local scope&#xA;5  Site-Local scope&#xA;8  Organization-Local scope&#xA;E  Global scope&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(all others are reserved / not in use)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is specifically surrendering the &quot;Interface-Local&quot; scope.   I understand academically what it means, the multicast packet travels only so far as the local interface (aka, doesn't actually hit the wire).  But practically, &lt;strong&gt;what are some use cases for the Interface-Local scope?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2014-10-28T14:09:51.990" LastActivityDate="2014-10-28T14:09:51.990" Title="IPv6 Multicast - Purposes for the Interface-Local scope?" Tags="|ipv6|multicast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12689" PostTypeId="2" ParentId="12688" CreationDate="2014-10-27T17:21:58.220" Score="3" Body="&lt;p&gt;Just like the unicast loopback address (::1/128) it can be used for testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See RFC3513: &quot;interface-local scope spans only a single interface on a node, and is useful only for loopback transmission of multicast.&quot;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2014-10-27T17:21:58.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12692" PostTypeId="1" CreationDate="2014-10-27T19:22:23.740" Score="8" ViewCount="73157" Body="&lt;p&gt;I've been trying to figure out how to divide a network number into particular subjects where one of them require a particular number of hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the Computer Networking: A Top Down Approach but it doesn't really specify or show the method of calculating this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I have the question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A company has the network number 193.1.1.0/24 and wants to have 6 subnets, where the largest one needs to support up to 25 hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the material I have it says to determine the number of bits required to define 6 subnets but have no idea how/where to go from there and how the bits needed are determined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking for the method and explanation how to work out these type of questions, I don't want a answer as I want to learn how to apply it myself. :)&lt;/p&gt;&#xA;" OwnerUserId="3035" LastEditorUserId="8499" LastEditDate="2018-03-11T01:54:38.637" LastActivityDate="2019-02-22T07:33:42.580" Title="How to divide network into subnets?" Tags="|ipv4|ip|subnet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12693" PostTypeId="2" ParentId="12692" CreationDate="2014-10-27T19:36:29.307" Score="14" Body="&lt;p&gt;Remember that everything is binary, so a power of 2.  Addresses and masks have 32 bits.  You are given 8 bits (2^8 = 256) to work with since your network is /24 (32 - 24 = 8).  The required number of subnets is 6, not a power of 2, so you need to pick the next higher power of 2 (8).  8 is 2^3.  The 24 bits you already have plus the 3 bits for the subnets is 27 bits.  That leaves 5 bits for the number of addresses (2^5 = 32) per subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must AND the original subnet with the mask to get the first subnet, and the number of addresses per subnet to that to get the next subnet, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is how you do it without me telling you the answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OK.  This is the answer:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Network 193.1.1.0 is                    11000001.00000001.00000001.00000000 in binary&#xA;Mask /24 is                             11111111.11111111.11111111.00000000 in binary&#xA;Mask /27 (with 3 bits for 8 subnets) is 11111111.11111111.11111111.11100000&#xA;1st subnet is                           11000001.00000001.00000001.00000000&#xA;2nd subnet is                           11000001.00000001.00000001.00100000&#xA;3rd subnet is                           11000001.00000001.00000001.01000000&#xA;4th subnet is                           11000001.00000001.00000001.01100000&#xA;5th subnet is                           11000001.00000001.00000001.10000000&#xA;6th subnet is                           11000001.00000001.00000001.10100000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2014-10-27T19:59:46.950" LastActivityDate="2014-10-27T19:59:46.950" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12695" PostTypeId="2" ParentId="12687" CreationDate="2014-10-27T20:25:39.810" Score="0" Body="&lt;p&gt;Yes spannning tree is for preventing loops at layer2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this simple setup you may want to add a few of things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Add another trunk link connecting ESW1 to ESW2.&lt;/li&gt;&#xA;&lt;li&gt;Make ESW1 stp root primary and ESW2 stp root secondary.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can then check your spanning tree root paths for vlan1 (default) on both sw1 and sw2.&#xA;And add many other test vlans for your studies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that should you shutdown sw1, your client R1 will still be cut off as it only has one link (path).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also consider researching/adding vtp version 2 to your scenario to propagate the vlans you create on ESW1 or ESW2 to the access switches.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2014-10-27T20:25:39.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12698" PostTypeId="2" ParentId="12590" CreationDate="2014-10-27T21:09:31.060" Score="0" Body="&lt;p&gt;I decided to steer clear of Rocks after learning that setting up this private network is fairly easy, especially in Linux. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used Fedora 20 and an unmanaged 5-port ethernet switch. I connected all nodes to this switch, via ethernet of course, and went to the WiFi settings, which is the network settings window in Fedora. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here I went to the wired connection and changed the IPv4 IP address and Subnet to 1.1.1.x and 255.255.255.0, respectively. x here is a counter which is incremented for each node in the cluster, so I have address 1.1.1.1, 1.1.1.2, etc. Of course if you're making your own cluster any address will do, for most intents and purposes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is most of the work. However, I was having trouble connecting to this private network. I found this is because it was trying to do things with the IPv6 address information. So i turned this off and the computer connected right away. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From here I wrote some &quot;Hello World&quot; OpenMPI programs and ran them. This required a machine/host file and credential-free SSH connections, but these are issues for other threads. &lt;/p&gt;&#xA;" OwnerUserId="9995" LastActivityDate="2014-10-27T21:09:31.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12701" PostTypeId="1" AcceptedAnswerId="12705" CreationDate="2014-10-27T21:45:42.050" Score="2" ViewCount="32013" Body="&lt;p&gt;I know I can set the administrative status of WAN/DMZ ports to down to disable them, but I can only see how to set the entire internal interface up/down. Is there a way to set individual LAN ports down so someone cannot plug into them and access the network?&lt;/p&gt;&#xA;" OwnerUserId="10100" LastActivityDate="2016-11-16T22:07:16.340" Title="How to disable unused LAN ports on Fortigate" Tags="|fortigate|fortinet|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12703" PostTypeId="2" ParentId="12688" CreationDate="2014-10-27T21:57:04.733" Score="5" Body="&lt;p&gt;Node-local scope is mostly useful for inter-process communication. The sender and receiver can be different processes on the same node.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-10-27T21:57:04.733" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12704" PostTypeId="2" ParentId="12701" CreationDate="2014-10-27T22:18:00.720" Score="0" Body="&lt;p&gt;This can be accomplished through the GUI by&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;navigating to System -&amp;gt; Network -&amp;gt; interface&lt;/li&gt;&#xA;&lt;li&gt;select the desired interface&lt;/li&gt;&#xA;&lt;li&gt;select edit for that interface&lt;/li&gt;&#xA;&lt;li&gt;change &amp;quot;Administrative Access&amp;quot; to Down.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;This can also be accomplished through the CLI with these commands:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;config system interface&lt;/p&gt;&#xA;&lt;p&gt;edit (desired interface)&lt;/p&gt;&#xA;&lt;p&gt;set status down&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;(this works for devices running fortios)&lt;/p&gt;&#xA;" OwnerUserId="4946" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-10-27T22:18:00.720" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12705" PostTypeId="2" ParentId="12701" CreationDate="2014-10-28T01:58:27.140" Score="2" Body="&lt;p&gt;It's look like that the&lt;code&gt;internal-switch-mode&lt;/code&gt; is set as &lt;em&gt;switch¹&lt;/em&gt; (by default). That means that all port on the &lt;strong&gt;internal&lt;/strong&gt; interface are configured as they are only one:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Switch mode combines FortiGate unit interfaces into one switch with&#xA;  one address. Interface mode gives each internal interface its own&#xA;  address.²&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;so, as I understand, if in system global configuration you set: &lt;code&gt;internal-switch-mode interface&lt;/code&gt;, you shall configure each port independently, so you will able to reconfigure port 1 and 2 then disable the other as @David say.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB &lt;strong&gt;&lt;em&gt;Before&lt;/strong&gt; switching modes, all configuration settings for the interfaces affected by the switch &lt;strong&gt;must&lt;/strong&gt; be set to defaults.&lt;/em&gt;²&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ref:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://docs-legacy.fortinet.com/fgt/handbook/cli_html/index.html#page/FortiOS%25205.0%2520CLI/config_system.24.034.html&quot; rel=&quot;nofollow&quot;&gt;Fotigate &quot;Interface&quot; command CLI document&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://docs-legacy.fortinet.com/fgt/handbook/cli_html/index.html#page/FortiOS%25205.0%2520CLI/config_system.24.031.html&quot; rel=&quot;nofollow&quot;&gt;Fotigate &quot;Global config&quot; command CLI document&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8727" LastEditorUserId="15569" LastEditDate="2015-09-18T20:48:52.587" LastActivityDate="2015-09-18T20:48:52.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12709" PostTypeId="1" CreationDate="2014-10-28T12:42:46.333" Score="1" ViewCount="174" Body="&lt;p&gt;I have heard this term often in discussion, for example, somebody asks can you change the watermarks of the switch ports? What is exactly one referring to? Searching on the net didn't result any meaningful result.&lt;/p&gt;&#xA;" OwnerUserId="3282" LastActivityDate="2014-10-28T13:05:08.887" Title="What are watermark in switch ports?" Tags="|switch|switching|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12710" PostTypeId="2" ParentId="12709" CreationDate="2014-10-28T13:05:08.887" Score="4" Body="&lt;p&gt;They would be referring to the 'high water mark' or the maximum level of traffic that interface has seen.  Clearing the watermarks would just set everything back to 0 and let the interfaces track utilization with an empty history.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-10-28T13:05:08.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12712" PostTypeId="1" CreationDate="2014-10-28T15:01:32.397" Score="3" ViewCount="2189" Body="&lt;p&gt;I have 18 &lt;a href=&quot;http://www.edge-core.com/ProdDtl.asp?sno=DEBMAJ&quot; rel=&quot;nofollow&quot;&gt;Edge-corE ES4324&lt;/a&gt; switches running 2.5.1.8 (and a single &lt;a href=&quot;http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02581575-1.pdf&quot; rel=&quot;nofollow&quot;&gt;3-com 2948-SFP Plus&lt;/a&gt; running 01.00.01) deployed initially as 2 physically separate networks, running side by side for the most part. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At some point wireless access to network A was desired from APs on network B, which was implemented by having the Ubiquiti UniFi access points running on network B add an SSID mapped to VLAN 4, and running links from the A switches into a PVID 4 port on the B switch with ingress filtering enabled. VLAN 4 only applied on the B switch, and only to the ingress port from A (as primary) and the AP(s) ports (as a tagged secondary.) VLAN 4 DOES NOT run over interswitch links except where there is no network A switch but there is a Network B switch with an AP needing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It recently came to light that something strange was going on with the cross-linked SSID in some locations, but not others. RSTP was blocking the cross-link ports in some places, but not others, and all the switches on both networks were hailing the 3-com (that is correctly the root of network A) as the root. I suspect now (though I did not notice the strangeness near enough in time to connect it to this until now) that the issue probably arose when I &#xA;got around to putting the correct settings back into the 3-com, which had defaulted itself after a power outage but was running fine despite that (so the root would have been the &quot;B&quot;  network root as the 3-com had set itself to 32768.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I've gathered that RSTP is evidently not VLAN aware - there were loops (looking at wires) but no loops (paying attention to VLANs controlling what the wires did.) While there are VLAN-aware versions out there, I don't have them, and they have their own collection of acronyms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I turned off STP on the link ports, from both sides. The SSID began to work as it should again in the places it had gone strange, where the ports had gone &quot;Alternate&quot; (actually &quot;Alternated&quot; in EdgeCore's unique approach to translating into English) when in RSTP and they were now non-STP so they were passing traffic again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And yet all 19 switches still hail the 3-com as the root, with at least one ES4324 noting that the connection to the root is via port 18, (but also that port 18 is a non-STP port, since it's the link port and I disabled STP on it.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Things seem to work correctly again, and I have gathered that I should not expect &quot;normal&quot; RSTP/STP to be VLAN-Aware, but I &lt;strong&gt;was&lt;/strong&gt; rather surprised to find that taking all the &quot;cross-link&quot; ports out of RSTP (&quot;disabled&quot; or &quot;Not enabled&quot;) had no apparent effect on the RSTP mating of the networks. Network B has RSTP settings defined that should result in it's root being on it (and in a different server room, as the outgoing connections are in different locations for the two networks); presumably the 3-com has the lower MAC address, but at this point (if things worked in the manner I would expect when I disable RSTP on a port) it should not be seeing the 3-com (or anything else on network A) as a RSTP entity. Evidently things don't work the way I think they should, and all that switching off RSTP on the port is doing is removing the ability to shut the port down automatically, while still passing and processing BDPUs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this seem like the expected behavior to others?&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2014-10-28T15:53:57.403" LastActivityDate="2014-10-28T15:53:57.403" Title="RSTP ignores VLANs and even &quot;Non-STP&quot; ports?" Tags="|spanning-tree|3-com|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12716" PostTypeId="1" CreationDate="2014-10-28T21:02:34.837" Score="3" ViewCount="2331" Body="&lt;p&gt;I am beginner in networking and I have two questions, because I can't understand it well.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I know how auto-negotiation works, but what happens if two connected devices have different speeds and auto-negotiation is disabled? What happens if only one device has auto-negotiation disabled?&lt;/li&gt;&#xA;&lt;li&gt;What happens if I connect 100 Mb/s ethernet to hub (switch) with/without auto-negotiation?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="10117" LastEditorUserId="619" LastEditDate="2014-10-28T22:01:01.540" LastActivityDate="2014-11-03T20:23:20.240" Title="Autonegotiation disabled, different speed, hub" Tags="|switch|ethernet|autonegotiation|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12717" PostTypeId="1" AcceptedAnswerId="12808" CreationDate="2014-10-28T21:47:59.243" Score="1" ViewCount="740" Body="&lt;p&gt;The first device that I connect will work fine, reporting power consumption correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connecting a second or third device will seem to increase the power consumption on the first port while not reporting anything on any of those ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, power output on these ports seems to switch on/off rapidly, creating a pulsating glow in the power led on those devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Troubleshooting done so far:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Disconnected devices, reconnected on other ports. Result: same.&lt;/li&gt;&#xA;&lt;li&gt;Disconnected devices, connected devices in a different order. Result: the first port that is connected reports correctly, the subsequent ones doesn't not. (The difference is this time it is another device and another port.)&lt;/li&gt;&#xA;&lt;li&gt;Checked power consumption. Result: &amp;lt;7W pr port.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="3632" LastActivityDate="2014-11-04T07:17:53.943" Title="Managed Cisco switch w/POE reports all power consumption on first connected device, rapidly flaps power on devices connected subsequently" Tags="|cisco|power-over-ethernet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12718" PostTypeId="2" ParentId="12716" CreationDate="2014-10-28T22:10:29.220" Score="5" Body="&lt;p&gt;Two devices operating at different set speeds will not link. If only one side is auto, they &lt;em&gt;may&lt;/em&gt; link, but it depends on the specific device(s) as some require the link-pulse information while others will cycle through speeds to get a link; and in the absence of link-pulse information, they will default to half-duplex. (Note: the non-negotiating side may have been set to full-duplex, but the other side will be half-duplex.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your second case, a hub is always half-duplex; as long as it supports 100Mbps, it will link. A switch can run in either full or half-duplex. Same as before, without the information from link-pulses, they will default to half-duplex. (unless configured otherwise.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-10-28T22:10:29.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12720" PostTypeId="1" AcceptedAnswerId="12721" CreationDate="2014-10-29T04:05:14.253" Score="10" ViewCount="53356" Body="&lt;p&gt;My AP operates in the 5Ghz band. There are no problems using Channel 36 to 64; however, clients can't even detect the SSID if I use Channel 100 to 140.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a screenshot of Netspot showing all the signals in my area. It seems like its not my router issue, and that my clients can't detect anything else in the 100-140 channel range. Why is that? Is it a regional issue? I would like to have my router run on an orthogonal channel without any network interfering with it, hence I would like it to run on channel 100+.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yBeHd.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yBeHd.png&quot; alt=&quot;netspot showing signals in my area&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10099" LastEditorUserId="775" LastEditDate="2014-10-29T09:39:31.557" LastActivityDate="2020-11-25T01:08:42.160" Title="Cannot use 5GHz band Wi-Fi from channels 100-140" Tags="|router|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12721" PostTypeId="2" ParentId="12720" CreationDate="2014-10-29T04:41:06.413" Score="6" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bLNIS.jpg&quot; alt=&quot;802.11a Frequency Channel Map&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps this will help.  Also, consult &lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_WLAN_channels&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia&lt;/a&gt; for futher reference. In short, in the US, the H band is restricted due to interference issues with Terminal Doppler Weather Radar (TDWR). (at least for &lt;em&gt;outdoor use&lt;/em&gt;.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-10-29T04:41:06.413" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12722" PostTypeId="2" ParentId="12675" CreationDate="2014-10-29T08:19:03.833" Score="-2" Body="&lt;p&gt;Actually, TLS (Transport Layer Security) is initialized in the transport layer and is ended in the application layer. It is must so that the data received in the application layer by the viewer is protected till the end.&lt;/p&gt;&#xA;" OwnerUserId="10121" LastActivityDate="2014-10-29T08:19:03.833" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12724" PostTypeId="2" ParentId="12717" CreationDate="2014-10-29T11:18:03.783" Score="0" Body="&lt;p&gt;Try this command in &lt;strong&gt;interface configuration mode&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-if)#power inline delay shutdown 20 initial 300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This command will give enough time for the device to power on and will not interrupt power during boot even if the device flaps link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To execute this command for all interfaces at once use the &lt;em&gt;range&lt;/em&gt; option of &lt;em&gt;interface&lt;/em&gt; command an then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-if-range)#power inline delay shutdown 20 initial 300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10125" LastEditorUserId="10125" LastEditDate="2014-10-30T16:04:32.203" LastActivityDate="2014-10-30T16:04:32.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12728" PostTypeId="1" CreationDate="2014-10-29T16:56:28.477" Score="4" ViewCount="1187" Body="&lt;pre&gt;&lt;code&gt;http://www.dummies.com/how-to/content/the-tcpip-networking-protocol-suite.html&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was reading the difference between the two, and in the example of TCP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when a user running a Web browser requests a page, the browser uses HTTP to send a request via TCP to the Web server. When the Web server receives the request, it uses HTTP to send the requested Web page back to the browser, again via TCP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example of UDP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best-known Application layer protocol that uses UDP is DNS, the Domain Name System. When an application needs to access a domain name such as www.dummies.com, DNS sends a UDP packet to a DNS server to look up the domain. When the server finds the domain, it returns the domain's IP address in another UDP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which of the two happens initially? How does connection to a website happens in the end?&lt;/p&gt;&#xA;" OwnerUserId="10129" LastEditorUserId="8499" LastEditDate="2016-12-18T23:09:55.520" LastActivityDate="2016-12-18T23:09:55.520" Title="Difference between UDP and TCP" Tags="|ipv4|tcp|udp|layer4|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12730" PostTypeId="2" ParentId="12687" CreationDate="2014-10-29T17:58:44.747" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;user4565 brings up a very important point, you need the redundant connections.  You could have all of the redundancy in the world upstream of R1/R2, if a link between R1/R2 and SW1/SW2 goes down, that corresponding R is still going to be offline. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Add the following connections for the best possible redundancy:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1 &amp;lt;=&gt; SW2&lt;/li&gt;&#xA;&lt;li&gt;R2 &amp;lt;=&gt; SW1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now you can lose either SW1 or SW2, and still have connection to your R's.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;As user4565 said, add another trunk between ESW1 and ESW2 - more redundancy isn't a bad thing.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure all of your trunk links carry both VLANs if you decide to use more than the default VLAN.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Just to clarify a couple of extra things, if you're interested:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will always a native VLAN, one will always exist (VLAN 1 by default).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you're running some seriously ancient gear, Cisco typically runs STP in the default mode of PVST+ or RPVST+.  This means that each VLAN you configured, will have it's own instance of STP running (PVST = Per Vlan Spanning Tree).  This is helpful because let's say you have 2 VLANs, VLAN 1 and VLAN 10.  If something breaks in VLAN10, it will adjust the paths accordingly, and leave VLAN1 completely unaffected, this means zero service disruption for VLAN1.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a little bit more older STP context, it used be that only a single instance of STP ran, no matter how many VLANs you had.  That means, if you had a link in VLAN1 go down, all other VLANs would have disruptions because STP had to recalculate the loop free paths.  This is why PVST is so important.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Along with each VLAN having its own instance of spanning tree, PVST+ adds some other capabilities.  The important one being, alternate ports.  Let's look at the difference of how an older version of STP would run vs. PVST+ when an outage event happens, if you had two interfaces, connecting the same two devices (in EACH VLAN, so lets just say you have VLAN1 only).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1 Eth1/1 &amp;lt;=&gt; SW1 Eth2/1&lt;/li&gt;&#xA;&lt;li&gt;R1 Eth1/2 &amp;lt;=&gt; SW1 Eth2/2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Older STP:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;IMPORANT: When STP calculates, there can only be one path, all others are automatically blocking, this is how STP prevents loops.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1 Eth1/1 &amp;lt;=&gt; SW1 Eth2/1 - FORWARDING&lt;/li&gt;&#xA;&lt;li&gt;R1 Eth1/2 &amp;lt;=&gt; SW1 Eth2/2 - BLOCKING&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;That blocking port doesn't know anything, if its up, it is only used if STP needs to recalculate.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Link 1 of 2 breaks in some way (shutting a link, cable being cut, cable failing, etc.)&lt;/li&gt;&#xA;&lt;li&gt;STP will tell the entire STP domain to flush its entire topology and recalculate all paths.  Resulting in service disruption.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;After STP recalculates, the port that was originally BLOCKING will move through the LISTENING, and LEARNING states before entering FORWARDING.  This can take some time, thus causing downtime.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1 Eth1/2 &amp;lt;=&gt; SW1 Eth2/2 - FORWARDING&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;PVST+&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;IMPORANT: When PVST+ calculates, something different happens with those extra interfaces you have connected.  If R1 has two ports connected to R2&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1 Eth1/1 &amp;lt;=&gt; SW1 Eth2/1 - FORWARDING&lt;/li&gt;&#xA;&lt;li&gt;R1 Eth1/2 &amp;lt;=&gt; SW1 Eth2/2 - ALTERNATE&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The difference with PVST+ is in the initial calculation, when the loop free topology is built, redundant ports facing upstream to the root bridge will be an alternate port.  This means that it KNOWS that the alternate port is a way to the root bridge, so should the primary link fail, it doesn't need to recalculate - it can immediately jump to the FORWARDING state and push traffic as normal, instead of being forced to run through all of the phases again.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Link 1 of 2 breaks in some way.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;R1 Eth1/2 immediately switches to forwarding.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1 Eth1/2 &amp;lt;=&gt; SW1 Eth2/2 - FORWARDING&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;No service interruption.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope this helps, I apologize if it's a bit long winded - but it helps to know your options.  If you need any clarification, feel free to ask.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2014-10-29T17:58:44.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12731" PostTypeId="2" ParentId="12728" CreationDate="2014-10-29T18:23:06.770" Score="2" Body="&lt;p&gt;I'll try to answer your question directly without going into a huge rant about TCP v UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically you need to understand that both HTTP and DNS are completely independent applications/protocols.  Sometimes you need to actually send a DNS query to a DNS server, sometimes you don't (if the DNS record is cached locally on your PC/Server).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;We do NOT have a DNS record cached.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://google.com&quot; rel=&quot;nofollow&quot;&gt;http://google.com&lt;/a&gt; is entered in the browser.&lt;/li&gt;&#xA;&lt;li&gt;Your PC checks the local DNS cache, and sees it does NOT have a record for google.com&lt;/li&gt;&#xA;&lt;li&gt;A UDP DNS query is sent to a DNS server, in this case it's most likely your ISP's DNS server.  &lt;/li&gt;&#xA;&lt;li&gt;The DNS server sends a UDP response back.&lt;/li&gt;&#xA;&lt;li&gt;You now have your answer in the form of an IP address, now you can initiate your TCP connection to google.com&lt;/li&gt;&#xA;&lt;li&gt;The 3-way handshake occurs between you and google.com (SYN, SYN/ACK, ACK) - if you do not know what this is you can search for &quot;TCP 3 way handshake&quot; and find some good information.&lt;/li&gt;&#xA;&lt;li&gt;After the handshake completes, HTTP will render in the form of your favorite search engine.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;We HAVE a DNS record cached.  There is a very small difference here, but I'm going to include the whole thing so you can see the comparison.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://google.com&quot; rel=&quot;nofollow&quot;&gt;http://google.com&lt;/a&gt; is entered in the browser.&lt;/li&gt;&#xA;&lt;li&gt;Your PC checks the local DNS cache, and sees it has a record cached in the form of an IP address.&lt;/li&gt;&#xA;&lt;li&gt;You now have your IP address for google.com, now you can initiate your TCP connection to google.com&lt;/li&gt;&#xA;&lt;li&gt;The 3-way handshake occurs between you and google.com (SYN, SYN/ACK, ACK)&lt;/li&gt;&#xA;&lt;li&gt;After the handshake completes, HTTP will render in the form of your favorite search engine.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So just because you're trying to get to a webpage you do not have to send a UDP DNS query.  DNS is independent, visiting a webpage is not the only time you'd need to use DNS.  Feel free to comment if you need clarification.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2014-10-29T18:23:06.770" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12732" PostTypeId="2" ParentId="12720" CreationDate="2014-10-29T18:26:05.277" Score="7" Body="&lt;p&gt;Radio frequency is a limited resource that is managed individually by various organizations geographically.  In the US, the government entity that regulates the use of RF is the FCC.  As of February 2013, the FCC did agree to additional frequency for unlicensed use and the current allocation is as follows (I apologize as I forget from where I saved this image and when searching came across it in several locations so can't attribute properly):&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Wc5dI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several challenges to overcome when using the newly available frequencies, but we may see their adoption in some products as early as 2015.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other countries/regions will allow/disallow frequency based on their own requirements and current (or historic) uses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since there are many differences globally in which frequencies can be used (and at which power levels), if you move from one region to another your device may try to use frequencies that may be illegal to use in that region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To resolve this problem, &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.11d-2001&quot; rel=&quot;noreferrer&quot;&gt;802.11d&lt;/a&gt; was approved in 2001.  This added the ability to include a country/region code into the beacons, probe requests and probe responses of an 802.11 device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK, all modern access points now include support for 802.11d.  However the client support is typically dependent on the wireless driver and network implementation on the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, on one of my Linux systems, I can find this output relating to it adjusting channels/power levels based on 802.11d by using &quot;dmesg&quot; after connecting to a wireless network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[  403.990529] cfg80211: Calling CRDA for country: US&#xA;[  403.993283] cfg80211: Regulatory domain changed to country: US&#xA;[  403.993286] cfg80211:   (start_freq - end_freq @ bandwidth), (max_antenna_gain, max_eirp)&#xA;[  403.993287] cfg80211:   (2402000 KHz - 2472000 KHz @ 40000 KHz), (300 mBi, 2700 mBm)&#xA;[  403.993288] cfg80211:   (5170000 KHz - 5250000 KHz @ 40000 KHz), (300 mBi, 1700 mBm)&#xA;[  403.993289] cfg80211:   (5250000 KHz - 5330000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)&#xA;[  403.993289] cfg80211:   (5490000 KHz - 5600000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)&#xA;[  403.993293] cfg80211:   (5650000 KHz - 5710000 KHz @ 40000 KHz), (300 mBi, 2000 mBm)&#xA;[  403.993294] cfg80211:   (5735000 KHz - 5835000 KHz @ 40000 KHz), (300 mBi, 3000 mBm)&#xA;[  403.993295] cfg80211:   (57240000 KHz - 63720000 KHz @ 2160000 KHz), (N/A, 4000 mBm)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know OSX also supports 802.11d, but I don't have an OSX system to provide output or to say how to get this information exactly.  Based on &lt;a href=&quot;http://jeff-with-a-g.blogspot.co.uk/2012/04/5ghz-wifi-on-your-mac-got-you-down.html&quot; rel=&quot;noreferrer&quot;&gt;this blog post&lt;/a&gt;, it appears that unlike my Linux system (which appears to set the available channels each time it connects), OSX may set channels/power levels based on the first beacon if finds when the wireless network interface comes up.  This can be problematic if you have devices advertising incorrect country/region codes in your area.  I haven't tested this myself, so can't speak to the accuracy of the blog post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, going back to my FCC channel example above, even once the technical challenges of the new channels are overcome and they are supported on new access points, if you client doesn't recognize them as part of the &quot;US&quot; region, they won't be available when 802.11d kicks in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To specifically answer your question, we would need to know a bit more information.  Your guess that it may be based on your region is close, however it is actually based on the region your client &lt;em&gt;thinks&lt;/em&gt; it is in.  If it thinks it is in a region where channels 100-140 are not usable, you won't be able to use them (whether or not you really could be using them is another matter entirely).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conversely, you need to make sure your access point is configured for the correct region.  If it isn't, it is possible that you could be subject to legal repercussions if you are reported or found to be using frequencies that you don't have the right to use.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-10-29T18:46:08.257" LastActivityDate="2014-10-29T18:46:08.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12733" PostTypeId="1" AcceptedAnswerId="12741" CreationDate="2014-10-29T21:44:17.560" Score="5" ViewCount="3471" Body="&lt;p&gt;So we have an environment with several VLANs connected to a FortiNet firewall using multiple interfaces trunked back to our L3 Dell PowerConnect 6248P switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently the FortiNet is setup to do the routing for all networks but I was curious performance benefit we may get by moving routing from the FortiNet to the Dell switches. I created a test by creating IP addresses for a couple of VLANs on our network on the Dell switches and made sure routing was enabled on the switches. I then set my computer up to use the new test gateway for that switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did a simple ping test to get the latency and it came back with an average of about 1.5ms every time I pinged the new IP address for that VLAN on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I change back so my gateway is going through the FortiNet so it does the routing and ping the IP address assigned for the VLAN on the FortiNet, I get an average latency of 0.5ms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shouldn't routing through the L3 switches have reduced latency over the FortiNet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing some obvious crucial piece to getting this working as I had expected?&lt;/p&gt;&#xA;" OwnerUserId="10135" LastActivityDate="2021-01-28T18:32:08.107" Title="Routing on firewall vs L3 switches" Tags="|routing|vlan|interface|powerconnect|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12736" PostTypeId="2" ParentId="12675" CreationDate="2014-10-30T01:19:49.160" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;As far as I understand the whole thing, TLS (and the old dying SSL), are situated in the application layer of TCP/IP&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Correct.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;and acting as a wrapper around other application layer protocols (e.g. HTTP). Further they act on behalf of e.g. TCP, but the protocol is merely sitting in front of the actual application protocol&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't know what 'wrapper around' or 'on behalf of' or 'in front of' mean. TLS operates as an application protocol layered directly over TCP, and other application protocols such as HTTPS operate over TLS.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;rather than in the transport layer and sharing the space with TCP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Correct.&lt;/p&gt;&#xA;" OwnerUserId="10138" LastEditorUserId="10138" LastEditDate="2014-10-30T04:17:42.490" LastActivityDate="2014-10-30T04:17:42.490" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12737" PostTypeId="1" AcceptedAnswerId="12740" CreationDate="2014-10-30T04:08:04.087" Score="2" ViewCount="9735" Body="&lt;p&gt;Whether a router is needed to connect two subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Subnet-1 : 192.168.0.0 to 192.168.0.127  Subnet Mask:255.255.255.128&#xA;Subnet-2 : 192.168.0.128 to 192.168.0.255 Subnet Mask:255.255.255.128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whether subnet-1 requires a router and subnet 2 requires another router.&lt;/p&gt;&#xA;" OwnerUserId="8157" LastEditorUserId="3912" LastEditDate="2014-10-30T10:12:41.530" LastActivityDate="2014-10-30T10:12:41.530" Title="Connecting two or more subnets" Tags="|routing|router|subnet|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12738" PostTypeId="2" ParentId="12737" CreationDate="2014-10-30T06:07:05.323" Score="0" Body="&lt;p&gt;Routing is required to transit between two networks, whether a 'router' or layer 3 aware switch is better suited to the environment depends on the circumstances of the individual network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same routing device can support multiple subnets.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-10-30T06:07:05.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12739" PostTypeId="2" ParentId="12737" CreationDate="2014-10-30T07:28:23.257" Score="0" Body="&lt;p&gt;You need only one single Router to connect several IP subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you need one Layer 3 interface per Subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To connect the two Subnets you have several options, depending on the topology you're having there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: &lt;br/&gt;&#xA;[Layer 2 Switch] &amp;lt;-&gt; [Router] &amp;lt;-&gt; [Layer 2 Switch]&lt;br/&gt;&#xA;[Server] &amp;lt;-&gt; [Multilayer Switch] &amp;lt;-&gt; [Server]&lt;br/&gt;&#xA;[Server] &amp;lt;-&gt; [Router] // Connected with one tagged interface&lt;br/&gt;&#xA;[Server] &amp;lt;-&gt; [Router] // Connected with one cable per Interface / Subnet&lt;/p&gt;&#xA;" OwnerUserId="9943" LastActivityDate="2014-10-30T07:28:23.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12740" PostTypeId="2" ParentId="12737" CreationDate="2014-10-30T09:50:23.143" Score="1" Body="&lt;p&gt;You could use separate routers for each subnet or you could use one for both. If you would use only one router, there are two ways to go: Router-on-a-stick (both subnets will use or are connected to the same router interface) or connect each subnet to a different interface (remember each router interface should belong to different subnets).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router-on-a-stick is usually the way to go since routers generally have few interfaces.&lt;/p&gt;&#xA;" OwnerUserId="10141" LastActivityDate="2014-10-30T09:50:23.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12741" PostTypeId="2" ParentId="12733" CreationDate="2014-10-30T10:35:55.857" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Am I missing some obvious crucial piece to getting this working as I had expected?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You musn't confuse the latency of traffic destined &lt;em&gt;to&lt;/em&gt; the switch with the latency &lt;em&gt;through&lt;/em&gt; the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you ping a VLAN interface on a switch, you are quite often hitting the CPU/Control plane, which in the case of most enterprise-grade switches, is not a very powerful processor, and treats thing like inbound ICMP with a very low priority.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Re-run your test by rapidly pinging a device (multiple times) on another subnet when the Firewall is the gateway, and again when the switch is the gateway.  You will probably find that latency measurements are now virtually indistinguishable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where you will get the best performance improvement though is routing throughput - most switches should be able route L3 at line rate (at least the majority should for the majority of their interfaces).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use a tool like iperf to measure throughput between two hosts on different subnets with both the firewall and the switch in path and see what your results look like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You didn't mention the model of your firewall, but it may handle 1Gbps of traffic without any issue, so be sure to scale your testing!&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2014-10-30T10:35:55.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12744" PostTypeId="2" ParentId="3148" CreationDate="2014-10-30T11:37:47.133" Score="1" Body="&lt;p&gt;I'm not sure that FEC128 is limited to just manual discovery of PWs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've always used the FEC128 multi-home method described in the link with BGP auto-discovery and it works just fine - if I understand your question correctly.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2014-10-30T11:37:47.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12745" PostTypeId="2" ParentId="9381" CreationDate="2014-10-30T12:04:03.110" Score="5" Body="&lt;p&gt;I'd pick one of two choices: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Individual per-tenant Virtual Firewalls&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pros:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Horizontally scalable&lt;/li&gt;&#xA;&lt;li&gt;Spin-up and spin-down&lt;/li&gt;&#xA;&lt;li&gt;Relatively immune to future topology/design changes&lt;/li&gt;&#xA;&lt;li&gt;Complete customer separation/isolation&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Cons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Unless you enforce a standard template, you now have n individual firewalls to manage&lt;/li&gt;&#xA;&lt;li&gt;You now have n individual firewalls to monitor&lt;/li&gt;&#xA;&lt;li&gt;You now have n individual firewalls to patch&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Large firewall chassis/cluster with a routing-instance/context per tenant&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Deploy a large central firewall (cluster) hanging off to the side of your core, and use an &lt;strong&gt;internal&lt;/strong&gt; and an &lt;strong&gt;external&lt;/strong&gt; routing-instance to route traffic over and back to it (e.g.: default gateway on Internal instance is the firewall, default gateway on the firewall is your external instance on the core and the default for the external instance is your border(s).)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pros:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Single box to manage and configure&lt;/li&gt;&#xA;&lt;li&gt;Single box to monitor&lt;/li&gt;&#xA;&lt;li&gt;Single box to patch&lt;/li&gt;&#xA;&lt;li&gt;Customer separation&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Cons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Day one cost will be higher&lt;/li&gt;&#xA;&lt;li&gt;No scaling down&lt;/li&gt;&#xA;&lt;li&gt;Depending on configuration inter-customer traffic may start routing across your border routers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="1392" LastEditDate="2014-10-30T12:14:14.030" LastActivityDate="2014-10-30T12:14:14.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12747" PostTypeId="2" ParentId="12728" CreationDate="2014-10-30T14:48:55.633" Score="0" Body="&lt;p&gt;Think of UDP as sending a letter regular postage, and TCP as sending it with tracking numbers and notifications on delivery. Keep in mind UDP and TCP are just delivery methods, they don't give a damn what's in the packet or what the application receiving it does with the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DNS is a stupid example to show someone the difference between TCP and UDP. SNMP (and traps in particular) is better. Let me try below. Note, examples are simplified slightly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a router sends an SNMP trap (an alert such as &quot;Hey, I've just rebooted, thought you should know&quot;) to the SNMP server via UDP it does just that: it sends the packet to the server and that's it. If the server is programmed to send something back, UDP doesn't care. UDP delivered its packet, now it's going to the pub for a pint. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what would happen with TCP? Well, the router world send the packet containing the trap message to the server. After a certain timeout period, it would then send the packet again... And again... And again... Until the server finally responds with an ACKNowledgement packet. And that's ALL TCP cares about. It doesn't care about the data packet that the server may (or may not) need to send back. TCP will deliver its packet and return with an ACKnowledgement, or die trying (more or less).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to review the OSI model, keeping in mind that each layer encapsulates the one above it. That is, each layer wraps the stuff it received from the layer above and carries it with professional disinterest as to the contents.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-10-30T14:48:55.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12752" PostTypeId="1" AcceptedAnswerId="17110" CreationDate="2014-10-31T08:04:05.443" Score="4" ViewCount="8318" Body="&lt;p&gt;What exactly do the &lt;code&gt;Internet Port&lt;/code&gt; and &lt;code&gt;Public IP&lt;/code&gt; settings mean on the CISCO Meraki Z1 gateway?&#xA;&lt;br /&gt;&#xA;&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Context&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: this is a detailed explanation with images - I apologize for its length but I'm striving for quality.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Objective:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm setting up the Z1 for my father to connect to a VPN with a cloud-hosted service from his work.  It seems like the configuration should be easy, but I'm getting some grief from the tech people at the cloud hosting service but not really getting their help in figuring out the answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Network config:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet &amp;lt;--&gt; DSL Modem-Router &amp;lt;--&gt; Meraki Z1, Wireless Router, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specific problem I'm having is that I've been told that the &lt;code&gt;Internet Port&lt;/code&gt; and the &lt;code&gt;Public IP&lt;/code&gt; settings for the Z1 should be the same. I don't think I can set up the &lt;code&gt;Internet Port&lt;/code&gt; to match our public IP since that would mean that the actual endpoint on the Internet would be the Z1 - and that's not possible since we need the modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My solution so far:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked and followed &lt;a href=&quot;https://docs.meraki.com/display/Z1/Installation+guide#Installationguide-ConnectingtoWAN&quot; rel=&quot;nofollow noreferrer&quot;&gt;the Meraki Z1 installation documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NVGYR.png&quot; alt=&quot;Instructions from CISCO configuration website&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It tells me that the only necessary WAN configuration for the device is to tell it how to connect to the Internet, which it can do through DHCP or statically (I've set it statically to be sure it's the correct way to do it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also set the public IP address on the configuration page, so that it knows our IP on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current overview on the device looks like this (all green):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/TkZ99.png&quot; alt=&quot;Configuration overview of Z1 device&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Finally&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This looks like it's ready to go.  So, in summary: have I made an incorrect assumption? Should I do something differently?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="10152" LastActivityDate="2015-08-20T16:01:27.573" Title="How to configure Internet Port and Public IP settings on the CISCO Meraki Z1?" Tags="|cisco|routing|vpn|troubleshooting|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12757" PostTypeId="1" AcceptedAnswerId="12759" CreationDate="2014-10-31T16:58:59.300" Score="9" ViewCount="7245" Body="&lt;p&gt;Is the requirement of 2&lt;sup&gt;n&lt;/sup&gt; number of ports for EtherChannel a critical requirement or just a recommendation to ensure, perhaps, an even load balancing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Particularly, if we setup an EtherChannel group with 8 ports but one of them went down. Would the remaining 7 ports still be functional but with uneven load balance, or would 3 ports be forced into standalone to ensure a power of two group?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it dealt with similarly for both PAgP and LACP?&lt;/p&gt;&#xA;" OwnerUserId="10161" LastEditorDisplayName="user3878" LastEditDate="2014-10-31T22:33:05.137" LastActivityDate="2014-12-02T23:45:10.130" Title="EtherChannel and odd number of ports" Tags="|ieee-802.1ax|etherchannel|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12759" PostTypeId="2" ParentId="12757" CreationDate="2014-10-31T18:04:15.700" Score="8" Body="&lt;p&gt;The power of 2 requirement varies per vendor/hardware/software.  Cisco had (has) a pretty bad stigma against them with a lot of the earlier catalyst switches capable of 10G.  The problem comes with how the software hashes (or &quot;balances&quot;) data over the multiple ports in the port-channel (this is agnostic of PAgP or LACP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This post does an excellent job of simplifying the problem in finer detail.  This is less relevant today with hardware/software improvements, but again, it varies - so just check your hardware requirements and make sure you're not buying older hardware that falls victim to this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.packetmischief.ca/2012/07/24/doing-etherchannel-over-3-5-6-and-7-link-bundles/&quot;&gt;http://www.packetmischief.ca/2012/07/24/doing-etherchannel-over-3-5-6-and-7-link-bundles/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2014-10-31T18:04:15.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12760" PostTypeId="2" ParentId="12526" CreationDate="2014-10-31T20:58:48.350" Score="2" Body="&lt;p&gt;The router you dial into forwards the authentication request to a RADIUS server, the client itself does not contact the RADIUS server directly. The router's configuration will have a list of RADIUS servers to use. There are numerous of configuration samples to be found on the internet, it's pretty standard and widely deployed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick google gave me this: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wan/point-to-point-protocol-ppp/10361-advancedradius.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/wan/point-to-point-protocol-ppp/10361-advancedradius.html&lt;/a&gt;. The same goes for PPPoE, the encapsulation is just different. Here we can see the following statements:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Use RADIUS for PPP connections&#xA;aaa authentication ppp default if-needed radius&#xA;! Use server 10.1.1.3 for authentication and authorization&#xA;radius-server host 10.1.1.3 auth-port 1645 acct-port 0&#xA;! Use server 10.1.1.5 for accounting&#xA;radius-server host 10.1.1.5 auth-port 0 acct-port 1646&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Multiple RADIUS servers can be defined to allow for redundancy. It would help if you provide us with the brand and type of router you have to provide a configuration sample.&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2014-10-31T20:58:48.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12761" PostTypeId="2" ParentId="12526" CreationDate="2014-10-31T21:24:42.750" Score="5" Body="&lt;p&gt;For your home router to establish a WAN connection to your ISP, a few things specific to PPP must happen first.&#xA;You may also have to do some research on LCP and NCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check this link below, it may have the answer you are looking for (see the excerpt on PPPoE below):&#xA;&lt;a href=&quot;https://infoproducts.alcatel-lucent.com/html/0_add-h-f/93-0098-09-01/7750_SR_OS_Triple_Play_Guide/concepts_PPPoE.html&quot; rel=&quot;noreferrer&quot;&gt;https://infoproducts.alcatel-lucent.com/html/0_add-h-f/93-0098-09-01/7750_SR_OS_Triple_Play_Guide/concepts_PPPoE.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PPPoE has two phases, the discovery phase and the session phase.•&lt;br&gt;&#xA;Discovery: The client identifies the available servers. &#xA;To complete the phase the client and server must communicate a session-id. During the discovery phase all packets are delivered to the PPPoE control plane (CPM or MDA). The IOM identifies these packets by their ethertype (0x8863). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;→   PPPoE Active Discovery Initiation (PADI). This broadcast packet is used by the client to search for an active server (Access Concentrator) providing access to a service. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;→   PPPoE Active Discovery Offer (PADO): If the access server can provide the service it should respond with a unicast PADO to signal the client it may request connectivity. Multiple servers may respond and the client may choose a server to connect to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;→   PPPoE Active Discovery Request (PADR): After the client receives a PADO it will use this unicast packet to connect to a server and request service. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;→   PPPoE Active Discovery Session-confirmation (PADS) A server may respond to the client with this unicast packet to establish the session and provide the session-id. Once the PADS was provided the PPP phase begins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•   Session: Once the session ID is established connectivity is available for the duration of the session, using ethertype 0x8864. Either client or server can terminate a session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the life of the session the packets may be uniquely identified by the client’s MAC address and session-id. The session can terminate either by PADT sent by the client or server or by an LCP Terminate-Request packet.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2014-10-31T21:24:42.750" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12762" PostTypeId="1" CreationDate="2014-10-31T21:44:04.043" Score="1" ViewCount="348" Body="&lt;p&gt;I have bought a Cisco access server 2509 from eBay. But unfortunately they didn't give me a password. I tried to follow the password recovery procedure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Mac. I connect to access console server and launch it is using Minicom.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I powered off and then on and I hit Cntrl+A then F which shows sending break. But it didn't take me into ROMmon mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other way to reset? Any other break key?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried cmd +b it didn't work.&lt;/p&gt;&#xA;" OwnerUserId="10163" LastEditorDisplayName="user10222" LastEditDate="2015-06-01T05:52:44.667" LastActivityDate="2015-06-01T05:52:44.667" Title="Cisco term server 2509 password reset" Tags="|cisco|router|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12764" PostTypeId="1" AcceptedAnswerId="12766" CreationDate="2014-11-01T06:48:15.770" Score="6" ViewCount="10946" Body="&lt;p&gt;In IPv4 we have class A, class B, and class C. In IPv6 we have only global prefix and Interface ID. I know there are plenty of addresses in IPv6 but it gives room for too many host addresses.And when it comes to P2P links only two addresses are used but /64 gives around 18 quintillion possible addresses that's a terrible waste of ip addresses. Is it good or bad practice to subnet the address beyond global prefix ?&lt;/p&gt;&#xA;" OwnerUserId="6118" LastEditorUserId="6118" LastEditDate="2014-11-03T08:56:59.260" LastActivityDate="2015-11-08T09:18:16.237" Title="Why there are no different classes of network in IPv6?" Tags="|ipv6|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12765" PostTypeId="2" ParentId="12764" CreationDate="2014-11-01T07:16:53.393" Score="6" Body="&lt;p&gt;The classes of networks have not existed since around 1995; they are irrelevant, since they referred to permanent allocations, which have not been available in almost two decades. People use the term &quot;class C&quot; to refer to a /24 network segment out of historical habit, and newer engineers have picked up the habit without really knowing the history. Tell me, do you know what &quot;Class E&quot; networks were reserved for (hint: ask anyone who did DARPA or NSFNet research between mid 1980s and mid 1990s)? Do you know any telecoms operating multicast-backbone devices that refer to the 224.0.0.0/4 as &quot;Class D&quot;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In point-to-point segments, use &quot;IP UNNUMBERED&quot;, and point your route to segments beyond the point-to-point link (an interface on a router terminating a point-to-point link is rarely interesting; your users probably care abut a resource behind it). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your allocation, use segments that are a consistent /64. I know it sounds wasteful and sparse, but it will make everything &lt;em&gt;A&lt;/em&gt; &lt;em&gt;LOT&lt;/em&gt; easier, and you are unlikely to run out of addresses. If you do, get a second allocation, and document your network, as it is probably a GOOGLE-scale or DoD-scale network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IPv6, the standard is a /64 for every non-point-to-point segment, and standard allocations of /48 (this means you can break every allocation into 65536 individual segments ; one or two allocations are likely more than you will ever need for all but the largest, most complex networks). RFC 6177 also recommends smaller allocations of /56 for SOHO networks, and possibly flexible allocation sizes for larger networks, although I have trouble imagining a /32 allocation outside of an ISP that is giving addresses from its allocation (the way IPv4 ISPs do) instead of sending their customers directly to ARIN. &lt;/p&gt;&#xA;" OwnerUserId="10104" LastEditorUserId="10104" LastEditDate="2014-11-28T18:03:45.040" LastActivityDate="2014-11-28T18:03:45.040" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="12766" PostTypeId="2" ParentId="12764" CreationDate="2014-11-01T07:19:44.637" Score="11" Body="&lt;p&gt;IPv4 classes A, B and C have been deprecated since the publication of &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1519&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1519&lt;/a&gt; in 1993.&lt;/p&gt;&#xA;&lt;p&gt;I agree with you that 64 bits for host addresses is more than anybody will ever need, but that is how it is designed and never having to worry about subnet sizes is wonderful! :)&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-11-08T09:18:16.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12768" PostTypeId="2" ParentId="12762" CreationDate="2014-11-01T07:58:56.657" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;When you use mac try using Z-TERMINAL(command-b) or iterm2(ctrl+a and then ctrl+b) instead of minicom  to get into rommon mode.&lt;/li&gt;&#xA;&lt;li&gt;Only use connection through console port because other ports like Aux are not active while booting therefore useless to send break through Aux.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;use these settings for console &#xA;       9600 baud rate&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   No parity&#xA;&#xA;   8 data bits&#xA;&#xA;   1 stop bit&#xA;&#xA;   No flow control&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Send break within a few seconds after powering on the cisco&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="6118" LastEditorUserId="775" LastEditDate="2014-12-01T10:36:30.890" LastActivityDate="2014-12-01T10:36:30.890" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12770" PostTypeId="2" ParentId="12526" CreationDate="2014-11-01T13:12:01.820" Score="3" Body="&lt;p&gt;In short, your client does not interact directly with the RADIUS server, the head-end router does. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your client speaks to the head-end router, which is configured to only allow authenticated connections, so it queries the client for authentication. Your client responds to the head-end router, which forwards an authentication to the RADIUS server, which says &quot;Let him in&quot; or &quot;Not allowed&quot;. If the head-end router lets the client complete the connection, then some time later it restarts the authentication challenge, to make sure the client is still allowed and hasn't been swapped for an unauthorized client. &lt;/p&gt;&#xA;" OwnerUserId="10104" LastActivityDate="2014-11-01T13:12:01.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12772" PostTypeId="1" AcceptedAnswerId="47555" CreationDate="2014-11-01T19:11:45.357" Score="2" ViewCount="1485" Body="&lt;p&gt;I have a few 3Com Baseline 2824 SFP Plus gigabit switches, 3C16487. These are apparently also known as HP JE738A (after HP bought up 3Com) though mine are not badged that way. One does need to find this out to get any useful results from the HP website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Management software they came with was &lt;strong&gt;1.0.0.7&lt;/strong&gt; - I just got them updated to the latest I could find &lt;strong&gt;1.0.1.1&lt;/strong&gt; though it felt like I was crawling through a cobwebby basement at HP's website to find that. The download file is a windows .exe self-extracting archive...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the new management software does not solve my biggest issue in using these switches many places - a terrible VLAN implementation, where ports are EITHER &quot;desktop&quot; and untagged and only on one VLAN, or they are &quot;Uplink&quot; and everything is tagged. I frequently have need of &quot;this VLAN tagged and this VLAN not tagged&quot; on a given port, so this limitation makes them far less useful than a Baseline 2948 I have that does manage the tagged/untagged concept – presumably a major difference between the 2800 and 2900 series.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect that's as good as they can manage, and I'll just have to find them homes where they can be &quot;one step above a dumb switch,&quot; but I thought I'd ask if anyone knew otherwise, in case it turned out I was missing anything. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Responding to comment:&lt;/strong&gt; Is there any way (firmware version I have not located, etc.) to get a more modern approach to VLANs on this model of switch, where ports can be tagged or untagged on different VLANs, rather than this extremely limited approach to VLANs where certain ports are &quot;uplinks&quot; and all traffic is tagged, while other ports are &quot;desktop&quot;, limited to one VLAN, and untagged only?&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2014-11-02T00:19:54.160" LastActivityDate="2018-02-02T14:45:25.073" Title="3Com Baseline 2824 SFP Plus (HP JE738A) VLANs" Tags="|switch|vlan|hp|3-com|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12775" PostTypeId="2" ParentId="12716" CreationDate="2014-11-01T20:41:11.623" Score="-1" Body="&lt;p&gt;Use a rule: if only one device has auto-negotiation disabled, then it won't work. The standard says auto-negotiation will work only if both sides are configured to use it so there'll be very small chance it'll work always and as intended if you set it up on one side only. So never trust such a config even if it appears to work at first glance.&lt;/p&gt;&#xA;" OwnerUserId="10168" LastActivityDate="2014-11-01T20:41:11.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12781" PostTypeId="1" AcceptedAnswerId="12782" CreationDate="2014-11-02T14:47:18.553" Score="2" ViewCount="936" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Assuming I have BGP forwarding from my ISP, a BGP capable router and an ASN. What stops me from advertising IP ranges not belonging to me? Do routers check if an IP address belongs to the correct ASN from RIR databases ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do router routing tables contain the ASN? Or just IP ranges, metrics and interface names? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Does every router connected to the internet with more than one upstream provider know the complete internet routing table?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="7824" LastEditorUserId="1519" LastEditDate="2014-11-06T00:56:25.883" LastActivityDate="2014-11-06T00:56:25.883" Title="How do Autonomous Systems work?" Tags="|routing|bgp|internet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12782" PostTypeId="2" ParentId="12781" CreationDate="2014-11-02T15:03:12.043" Score="7" Body="&lt;ol&gt;&#xA;&lt;li&gt;The networks you connect to should set up filters to accept routes from you only if they are &quot;yours&quot; or those of your customer(s).  Some ISPs build filters from various databases (RIR or IRR).  Not all networks do this.&lt;/li&gt;&#xA;&lt;li&gt;BGP tables (RIB) do contain ASNs.  Forwarding tables (FIB) do not.&lt;/li&gt;&#xA;&lt;li&gt;Not necessarily.  It depends on your needs.  You could also accept just a default route from each provider, or a subset of the routes your upstreams know, or a complete table form one upstream and partial routes from another.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8079" LastActivityDate="2014-11-02T15:03:12.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12783" PostTypeId="2" ParentId="12781" CreationDate="2014-11-02T15:03:42.887" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;You would find no one willing to peer with you. The Internet connections between ASs is cooperative, and, if you don't cooperate, you don't get in.&lt;/li&gt;&#xA;&lt;li&gt;As far as Cisco routers go, the routing table contains the best route for a given prefix from all the routing protocol tables. In other words, &quot;No.&quot; Each routing protocol maintains its own table, and the routing table chooses its content from those tables.&lt;/li&gt;&#xA;&lt;li&gt;Not necessarily. It is the universal networking answer: &quot;It depends...&quot; You really need to know what you are trying to accomplish in what way to answer that question for any particular design.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2014-11-02T15:03:42.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12785" PostTypeId="2" ParentId="12764" CreationDate="2014-11-02T21:03:41.230" Score="3" Body="&lt;p&gt;In fact, there is not room for too many hosts. The size of the network identifier makes possible mechanisms like SLAAC, opaque interface identifier, or privacy extensions (and several more). Each of these mechanisms need a large space to pick - more or less - randomly an interface identifier with next to negligible probability for a collision. Alas, the proven patterns and paths from Legacy IP make you (and many other admins) think that addresses are wasted and hinder you to unleash the power of IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;N.B. doing away with subnets and subnet masks eliminates a big source of trouble. Subnetting in IPv6 is as simple as it possibly gets.&lt;/p&gt;&#xA;" OwnerUserId="7756" LastActivityDate="2014-11-02T21:03:41.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12790" PostTypeId="1" CreationDate="2014-11-03T15:49:30.850" Score="4" ViewCount="2549" Body="&lt;pre&gt;&lt;code&gt;Catalyst-3650#request system shell&#xA;Activity within this shell can jeopardize the functioning of the system.&#xA;Are you sure you want to continue? [y/n] y&#xA;Challenge: 94d5c01766c7a0a29c8c59fec3ab992[..]&#xA;Please enter the shell access response based on the&#xA;above challenge (Press &quot;Enter&quot; when done or to quit.):&#xA;/bin/sh&#xA;Key verification failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I remember being able to get through to the shell by entering something trivial like '/bin/sh' instead. I am sure it wasn't a dream but i clearly remember i didn't write it down because i'm foolish like that..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how do i drop into bash from IOS-XE on a Cisco Catalyst 3650?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch Ports Model              SW Version        SW Image              Mode&#xA;------ ----- -----              ----------        ----------            ----&#xA;*    1 28    WS-C3650-24PS      03.03.03SE        cat3k_caa-universalk9 INSTALL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10197" LastEditorUserId="775" LastEditDate="2014-11-12T17:54:55.940" LastActivityDate="2014-11-12T17:54:55.940" Title="IOS-XE: request system shell vulnerability" Tags="|cisco|cisco-catalyst|cisco-ios|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12791" PostTypeId="1" AcceptedAnswerId="12792" CreationDate="2014-11-03T16:35:30.140" Score="1" ViewCount="159" Body="&lt;p&gt;I have the following situation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RouterA has an eBGP peering with a transit provider X and an eBGP session with a downstream customer with ASN 12345 as an example.  I've requested from provider X that they modify their as-path filter to allow updates from the customer ASN 12345.  I've also modified the filters on our RouterA to allow their prefix and ASN in our as-path filter so things should be working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On routerA, I see the received prefix from them fine however it is not being advertised to transit provider X and the prefix isn't working from the outside world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From RouterA, I can ping various configured interfaces on the customer equipment on the new prefix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="864" LastActivityDate="2014-11-03T17:01:57.713" Title="Transit-AS, AS-Path filtering" Tags="|bgp|" AnswerCount="1" CommentCount="0" ClosedDate="2019-05-27T01:57:35.903" ContentLicense="CC BY-SA 3.0" />
  <row Id="12792" PostTypeId="2" ParentId="12791" CreationDate="2014-11-03T17:01:57.713" Score="1" Body="&lt;p&gt;I found out what the problem was.  In the transit provider's route-map, there was a match for a prefix-list that was denying prefix advertisements for certain blocks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Correcting the prefix-list fixed my issue and all is good.&lt;/p&gt;&#xA;" OwnerUserId="864" LastActivityDate="2014-11-03T17:01:57.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12794" PostTypeId="1" CreationDate="2014-11-03T18:08:32.830" Score="0" ViewCount="101" Body="&lt;p&gt;Are there any problems resulting when connecting two 8 port ethernet switches together.&lt;/p&gt;&#xA;" OwnerUserId="10200" LastActivityDate="2014-11-03T18:29:28.617" Title="Are there any problems resulting in connecting 2 8 port ethernest switches together?" Tags="|switch|" AnswerCount="1" CommentCount="2" ClosedDate="2019-05-27T01:57:00.947" ContentLicense="CC BY-SA 3.0" />
  <row Id="12795" PostTypeId="2" ParentId="12794" CreationDate="2014-11-03T18:29:28.617" Score="3" Body="&lt;p&gt;In general, no.  Assuming you're using a single ethernet cable to connect the two.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to use multiple cables/ports, you'll need to configure a LAG.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll also want to make sure that loops are prevented using STP or something similar.&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2014-11-03T18:29:28.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12797" PostTypeId="2" ParentId="12716" CreationDate="2014-11-03T20:23:20.240" Score="2" Body="&lt;p&gt;There are two different things to think about, each can be enabled or forced:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Speed Negotiation (Auto, 10mbps, 100mbps, 1gbps, etc..)&lt;/li&gt;&#xA;&lt;li&gt;Duplex Negotiation (Auto, Full, Half)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Speed negotiation is normally pretty easy.  As long as both ends support the same speed (you don't force the speed on each end to a different ones or there are speed limitation because of hardware - some SFPs that support 1Gbps only and not 100Mbps, etc.) you'll link-up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Duplex negotiation (or lack of) will not prevent linking, but any mismatch will create extreme slowdowns.  You can find those by checking stats: One end sees a lot of Collisions while the other has no collisions but lots of FCS Errors.  Basically, the full duplex end sees incomplete frames sent by the half-duplex that stopped mid-transmission because of a collision. (I've seen 10Mbps &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Few more info:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For 10, 100mbps links, Duplex negotiation failure means the interface falls-back to HALF duplex&lt;/li&gt;&#xA;&lt;li&gt;For Gigabit links, Duplex negotiation failure means it falls-back to FULL duplex&lt;/li&gt;&#xA;&lt;li&gt;HUBS do not support Full Duplex, nor speed negotiation (all ends must be at the same speed and HALF duplex).  Hubs are mainly &quot;cross-over wires&quot; for every ports.&lt;/li&gt;&#xA;&lt;li&gt;Unmanaged switches will always negotiate Speed and duplex (and provide a buffer between links different speed)&lt;/li&gt;&#xA;&lt;li&gt;Managed switches can have any components use negotiation or forced&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-11-03T20:23:20.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12805" PostTypeId="2" ParentId="7427" CreationDate="2014-11-04T06:12:53.353" Score="0" Body="&lt;p&gt;Lets compute the longest common prefix between the two given IP address range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.19.40.1 in binary is 10101100.00010011.00101000.00000001&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.19.47.254 in binary is 10101100.00010011.00101111.11111110&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Longest common prefix is 10101100.00010011.00101 which has a length of 21(excluding  &quot;.&quot;) which corresponds to subnet mask, therefore the remaining 11 bits(32 - 21 = 11) can be used for host which can either contain 0 or 1.&#xA;so 2^11 = 2048.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Out of this addresses the first and last address correspond to network and broadcast address which cannot be used for host. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e 2048-2 = 2046 are the maximum number of host the given range of IP address can have.&lt;/p&gt;&#xA;" OwnerUserId="8765" LastActivityDate="2014-11-04T06:12:53.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12806" PostTypeId="1" CreationDate="2014-11-04T06:15:45.890" Score="2" ViewCount="934" Body="&lt;p&gt;Distance vector routing protocols have Split horizon &amp;amp; poison reverse for avoiding routing loops in the network.&#xA;  why the link state routing protocol not having that kind of measures and how the link state routing protocol avoid his loops?&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="4289" LastEditDate="2014-11-07T06:57:09.837" LastActivityDate="2014-11-07T06:57:09.837" Title="Distance Vector vs. Link State routing" Tags="|routing|protocol-theory|loop|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12808" PostTypeId="2" ParentId="12717" CreationDate="2014-11-04T07:17:53.943" Score="1" Body="&lt;p&gt;It turned out to be an issue with gnd and negative being connected in the equipment in question.&lt;/p&gt;&#xA;" OwnerUserId="3632" LastActivityDate="2014-11-04T07:17:53.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12812" PostTypeId="1" CreationDate="2014-11-04T12:54:23.087" Score="5" ViewCount="1292" Body="&lt;p&gt;Presently I am analysing the LTE network architecture for a full MVNO network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am just wondering whether S-GW is required as part of MVNO LTE architecture or MNO - SGW will be able to communicate via S5/S8 interface with the MVNO P-GW ?&#xA;If S-GW needed then MNO-MME should communicate with MVNO-SGW and call should process with MVNO-PGW. Could anybody can clarify?&lt;/p&gt;&#xA;" OwnerUserId="10212" LastEditorUserId="775" LastEditDate="2014-11-04T13:34:38.167" LastActivityDate="2017-01-18T12:27:44.393" Title="Do Full MVNO's need S-GW in their LTE network?" Tags="|routing|wireless|firewall|switching|mobile|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12816" PostTypeId="2" ParentId="12757" CreationDate="2014-11-04T20:52:25.280" Score="2" Body="&lt;p&gt;What I can recall (correct me):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Etherchannel does not load balance per say, it is load distribution.  An EC with an odd number of links will not distribute the load between the links evenly - the lower numbered links receive more traffic.  Traffic will continue to flow if the physical links are broken.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic is balanced by destination mac address (by default).  Depending on your topology, this may result in undesirable traffic patterns:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a mail server on one switch with an EC between switches, all the workstations on the switch on the other side of the Etherchannel will use the same link to reach the mail server....if the majority of your traffic is to the mail server, this provides no load balancing and only a single link in the Etherchannel is used for the mail server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may help: &lt;a href=&quot;https://supportforums.cisco.com/blog/150511/how-do-etherchannel-hash-algorithm-works-and-load-distribution-happen&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/blog/150511/how-do-etherchannel-hash-algorithm-works-and-load-distribution-happen&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10220" LastActivityDate="2014-11-04T20:52:25.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12817" PostTypeId="2" ParentId="12806" CreationDate="2014-11-04T23:49:23.567" Score="4" Body="&lt;p&gt;In link state protocols each participating router knows the whole topology of a network, which is stored in the link state database.  Using the link state database each router will calculate the best path to the destination.  The easiest way to think about it is as if with a link state routing protocol is that you give all your friends a map (the LSDB) and you tell them to find the shortest path based on mileage (bandwidth in the case of OSPF, not 100% about ISIS) to a given city.  As long as you all follow the map and the formula, you don't really need to worry about loops.&lt;/p&gt;&#xA;" OwnerUserId="8265" LastActivityDate="2014-11-04T23:49:23.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12819" PostTypeId="1" AcceptedAnswerId="12820" CreationDate="2014-11-05T01:39:44.227" Score="3" ViewCount="142" Body="&lt;p&gt;Have two sites with Cisco 2520 grid switches connected over fibre (OPGW, to be precise).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Site #1 is the existing site, with a 2520 connected to Site #2 (via fibre). There is an existing 3G backup connection elsewhere in that network (via a 1900 + 3G WIC).&lt;/li&gt;&#xA;&lt;li&gt;Site #2 is the new site, solely 2520 switches, and needs a backup 3G connection.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The current plan is to connect a 3G router (i.e. Sierra Raven XE) to a second port on the Site #2 edge switch that terminates the OPGW fibre. Ideally, if there's a comms failure on the Site #2 switch FE0/1 port connected to the OPGW (i.e. damage, contractor bumps a FOBOT, etc) the switch should pick up on this and fail over to the 3G router sitting on FE0/2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is that setting up an IP SLA on the Site #2 edge switch that hits (via &lt;code&gt;icmp-echo&lt;/code&gt;) an IP within Site #1 is the 'simplest' approach here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site #2 edge switch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;ip sla 1&#xA;icmp-echo 192.168.x.x`&#xA;frequency 5&#xA;timeout 500&#xA;ip sla schedule 1 life forever start-time now&#xA;track 1 ip sla reachability&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;ip route 0.0.0.0 0.0.0.0 192.168.x.x track 1&#xA;ip route 0.0.0.0 0.0.0.0 FastEthernet0/2 20 &#xA;! metric of 20 to ensure it only kicks in when track 1 fails&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site #1 edge switch stays 'as is'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have I missed anything here? Can we do this purely with IP switches?&lt;/p&gt;&#xA;" OwnerUserId="10223" LastActivityDate="2014-11-05T02:10:59.320" Title="Cisco 2520 CGS - IP SLA Failover from FE0/1 to FE0/2 Possible?" Tags="|cisco|routing|failover|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12820" PostTypeId="2" ParentId="12819" CreationDate="2014-11-05T02:10:59.320" Score="2" Body="&lt;p&gt;Other than the inherent issues with routing to an &lt;em&gt;ethernet interface&lt;/em&gt; -- which is an arp table muderous case of proxy-arp -- I see no problem. (I'm assuming your ping target is the other switch, not some machine that could be randomly &quot;unreachable&quot;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-11-05T02:10:59.320" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12821" PostTypeId="1" AcceptedAnswerId="12823" CreationDate="2014-11-05T02:38:44.033" Score="12" ViewCount="24009" Body="&lt;p&gt;Two host of different subnets, let it be A - 10.1.2.1/24 and B - 10.1.3.1/24 be connect to the same switch S. &#xA;Can they communicate?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So as far I understand:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A sends a packets with IP of B&lt;/li&gt;&#xA;&lt;li&gt;S receives it and compare it with    values in Stored Address Table&#xA;else broadcasts it.&lt;/li&gt;&#xA;&lt;li&gt;B receives the    packets, check the IP and accepts it.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Am I right?&lt;/p&gt;&#xA;" OwnerUserId="8328" LastEditorUserId="-1" LastEditDate="2016-07-01T12:46:27.920" LastActivityDate="2019-04-24T18:05:08.357" Title="Two hosts of different subnets connected to switch" Tags="|switch|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12823" PostTypeId="2" ParentId="12821" CreationDate="2014-11-05T04:19:53.483" Score="20" Body="&lt;p&gt;Unfortunately, no, you are incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ron makes a good point, you didn't provide a subnet mask, so if we were to assume the classful mask, the 10.x.x.x address would have a 255.0.0.0 mask, which would actually put the two hosts on the same network.  If that is the case, they would have no problem communicating.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, given the nature of your question, I imagine you intended for each of these hosts to use a smaller mask -- we'll go ahead and use 255.255.255.0, which puts both hosts in two different subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, the heart of what you are missing lies in forgetting about &lt;a href=&quot;https://www.youtube.com/watch?v=QPi5Nvxaosw&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;ARP&lt;/strong&gt; (Address Resolution Protocol)&lt;/a&gt;.  Specifically, in whom HostA decides to ARP for.  Let me explain...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR&gt;&#xA;Before any host puts any packet on the wire, the first thing it does is determine whether the destination IP is on its own network, or on a foreign network.  Let's run through it from the perspective of Host A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host A know its IP (10.1.2.1), and its Subnet Mask (/24, or 255.255.255.0).  With a little &lt;a href=&quot;https://www.youtube.com/watch?v=BWZ-MHIhqjM&amp;amp;list=PLIFyRwBY_4bQUE4IB5c4VPRyDoLgOdExE&quot; rel=&quot;noreferrer&quot;&gt;subnetting&lt;/a&gt;, HostA determines that its network spans all the IP addresses in the range of 10.1.2.0 through 10.1.2.255.  &lt;em&gt;(We'll leave out details of the NetID and BroadcastIP, since for the moment they aren't relevant)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host A also knows its destination IP is 10.1.3.1, which falls &lt;em&gt;outside&lt;/em&gt; of the range of IP addresses within Host A's own network.  As such, Host A would would come to the conclusion that the destination IP 10.1.3.1 is on a foreign network, and Host A could only reach a foreign network by speaking through a Router.  Or more specifically, through HostA's &lt;em&gt;default gateway&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If HostA isn't configured with a Default Gateway at this point, then the process ends here with a general failure.  HostA can not speak to HostB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If HostA &lt;em&gt;is&lt;/em&gt; configured with a Default Gateway, it would send out an ARP Request (which is itself a Broadcast frame), asking for the MAC address of its default gateway --  &lt;strong&gt;NOT&lt;/strong&gt; the MAC address of the final destination IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch, having received the broadcast frame would flood the packet out all interfaces, to include the one HostB is connected to.  HostB would indeed receive the packet, &lt;em&gt;but&lt;/em&gt; since the ARP is looking for the Default Gateway's MAC address &lt;em&gt;(and not the MAC address of HostB)&lt;/em&gt;, HostB would simply drop and ignore the ARP Request, without ever sending any sort of response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HostA, then, would never receive a MAC address for its default gateway, and would therefore be unable to encapsulate the Layer 3 Packet with a Layer 2 header.  The packet would fail there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the ARP process illustrated in &lt;a href=&quot;https://www.youtube.com/watch?v=QPi5Nvxaosw&quot; rel=&quot;noreferrer&quot;&gt;this video&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, although somewhat unrelated to your question, I did want to speak to something you said.  This may be terminology nuance, but I just want to make sure it is communicated.  A switch only does two things:  &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-switch/#switch-functions&quot; rel=&quot;noreferrer&quot;&gt;&lt;strong&gt;forwards&lt;/strong&gt; frame for which it know the destination MAC address, or &lt;strong&gt;flood&lt;/strong&gt; frames for which it doesn't know the destination MAC address&lt;/a&gt;.  &lt;em&gt;A switch never broadcasts&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-switch/#broadcasts&quot; rel=&quot;noreferrer&quot;&gt;broadcast&lt;/a&gt;&lt;/strong&gt; is a frame who's destination MAC address is &lt;code&gt;ffff.ffff.ffff&lt;/code&gt;.  This is a specially reserved MAC address, specifically designed for broadcast frames.  When a switch encounters a frame destined to &lt;strong&gt;ffff.ffff.ffff&lt;/strong&gt;, its behavior is to always &lt;strong&gt;flood&lt;/strong&gt; that frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could look at it like this, since &lt;strong&gt;ffff.ffff.ffff&lt;/strong&gt; is a reserved MAC address, it is un-learn-able by the switch.  Therefore, whenever a switch receives something destined to ffff.ffff.ffff, it is forced to flood it out all ports in the VLAN that the frame was originally received in.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2018-05-29T18:25:12.827" LastActivityDate="2018-05-29T18:25:12.827" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="12829" PostTypeId="1" AcceptedAnswerId="12832" CreationDate="2014-11-05T09:10:14.857" Score="2" ViewCount="611" Body="&lt;p&gt;Having a 192.168.1.0/&lt;strong&gt;24&lt;/strong&gt; network connected to a router1 on &lt;em&gt;eth0&lt;/em&gt;, I want to access several others in the 192.168.222.0/&lt;strong&gt;28&lt;/strong&gt;, 192.168.222.16/&lt;strong&gt;28&lt;/strong&gt;, ..., 192.168.222.240/&lt;strong&gt;28&lt;/strong&gt; range, all accessible through &lt;em&gt;eth1&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it OK to add a single &quot;192.168.222.0/&lt;strong&gt;24&lt;/strong&gt; via &lt;em&gt;eth1&lt;/em&gt;&quot; routing entry, or do I need to add one for each network &quot;192.168.222.0/&lt;strong&gt;28&lt;/strong&gt; via &lt;em&gt;eth1&lt;/em&gt;&quot;, &quot;192.168.222.16/&lt;strong&gt;28&lt;/strong&gt; via &lt;em&gt;eth1&lt;/em&gt;&quot;, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, &lt;em&gt;eth1&lt;/em&gt; is connected to another router2, living in the first subnet 192.168.222.0/&lt;strong&gt;28&lt;/strong&gt; with the IP 192.168.222.1. That one is the one routing to all the other subnets, that is, specifying their gateways with individual rules. So that router2 is the one which would be the gateway for router1's &quot;192.168.222.0/&lt;strong&gt;24&lt;/strong&gt; via 192.168.222.1%&lt;em&gt;eth1&lt;/em&gt;&quot; entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On router1 is it possible to insert just one rule? Can there the &quot;route summary&quot; Pedro Brito is talking about be applied?&lt;/p&gt;&#xA;" OwnerUserId="3390" LastEditorUserId="8499" LastEditDate="2018-02-14T16:49:19.613" LastActivityDate="2018-02-14T16:49:19.613" Title="Routing to multiple subnets" Tags="|routing|subnet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12830" PostTypeId="2" ParentId="12790" CreationDate="2014-11-05T09:12:08.280" Score="3" Body="&lt;pre&gt;&lt;code&gt;Switch#request system shell&#xA;Activity within this shell can jeopardize the functioning of the system.&#xA;Are you sure you want to continue? [y/n] y&#xA;Challenge: 438e1fd36da9cfdb61e655353a48bb9cf69f274ab2d2[..]&#xA;Please enter the shell access response based on the above challenge &#xA;(Press &quot;Enter&quot; when done or to quit.):&#xA;`/bin/sh`&#xA;sh-3.2# uname -a&#xA;sh-3.2#&#xA;sh-3.2# uname -2323&#xA;uname: invalid option -- '2'&#xA;Try `uname --help' for more information.&#xA;#AHA SO WE HAVE STDERR, but not STDOUT..&#xA;sh-3.2# ls&#xA;sh-3.2# pwd&#xA;sh-3.2# whoami&#xA;sh-3.2# exit&#xA;exit&#xA;Key verification failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alright then, let's go again.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#request system shell&#xA;Activity within this shell can jeopardize the functioning of the system.&#xA;Are you sure you want to continue? [y/n] y&#xA;Challenge: b577ea00feb8c833d725a85c6c53e1839ab9[..]&#xA;Please enter the shell access response based on the above challenge&#xA;(Press &quot;Enter&quot; when done or to quit.):&#xA;`bash 1&amp;gt;&amp;amp;2`&#xA;bash-3.2# uname -a&#xA;Linux localhost 2.6.32.59-cavium-octeon2.cge-cavium-octeon #1 SMP PREEMPT Fri May 10 11:48:14 PDT 2013 mips64 GNU/Linux&#xA;bash-3.2# ls&#xA;BinOS       config     hugepages  lic0        rommon_to_env  sys     webui&#xA;RP_0_0_cli  crashinfo  include    lic1        root           tftp&#xA;auto        dev        install    lkern_init  sbin           tmp&#xA;bin         drec0      isan       misc        selinux        ucode0&#xA;bsn         epc        issu       mnt         share          usr&#xA;chasfs      etc        lib        obfl0       space          var&#xA;common      flash      lib32      proc        spi            vol&#xA;bash-3.2# whoami&#xA;root&#xA;bash-3.2# cat /etc/passwd&#xA;root:x:0:0:root:/root:/bin/bash&#xA;binos:x:85:85:binos administrative user:/usr/binos/conf:/usr/binos/conf/bshell.sh&#xA;bin:x:1:1:bin:/bin:/sbin/nologin&#xA;daemon:x:2:2:daemon:/sbin:/sbin/nologin&#xA;adm:x:3:4:adm:/var/adm:/sbin/nologin&#xA;lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin&#xA;[..]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10197" LastActivityDate="2014-11-05T09:12:08.280" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12832" PostTypeId="2" ParentId="12829" CreationDate="2014-11-05T10:12:42.170" Score="3" Body="&lt;p&gt;It's generally possible. It's called a route summary and normally used to simplify routing when using static routes or to reduce the size of the routing table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's a subnet in the range that isn't accessible via eth1, packets are still going to be delivered in that interface, unless there's a more specific route pointing somewhere else. &lt;/p&gt;&#xA;" OwnerUserId="7635" LastActivityDate="2014-11-05T10:12:42.170" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12833" PostTypeId="1" CreationDate="2014-11-05T10:15:19.320" Score="4" ViewCount="5972" Body="&lt;p&gt;It is the first time that I am working with HP switches.&#xA;I want to use LACP on two stacked HP 2920-48G switches.&#xA;Does somebody have an example of the configuration I need to use on both switches ?&#xA;Also, I want to connect the two stacked switches with two other stacked switches by using the 10GbE module. Is it just plug and connect or do I have to configure something ? &lt;/p&gt;&#xA;" OwnerUserId="10229" LastEditorUserId="189" LastEditDate="2014-12-09T10:50:05.127" LastActivityDate="2014-12-09T10:56:57.467" Title="LACP on stacked HP 2920-48G" Tags="|hp|ieee-802.1ax|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12836" PostTypeId="1" AcceptedAnswerId="12837" CreationDate="2014-11-05T15:32:18.180" Score="2" ViewCount="283" Body="&lt;p&gt;I have two 2960X switches and a 3750X switch. I am trying to configure these switches so that the 3750X switch acts as a core switch and connects to the two 2960X switches. Each of the 2960X switches will then connect to several SG-200 switches, which clients will be connected to, with the exception of one SG-200 switch, which will connect to several servers. The infrastructure does not use any routers and is not connected to the Internet or any other network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to successfully access and run the browser-based express setup on the 3750X and 2960X switches. After configuring the switches, I was able to access them at the new IP addresses I set for them. However, after I finished configuring the 2960X switch and went to change some settings on the 3750X, I have been unable to configure any of the switches. When I enter the IPs of each switch in my browser, I only get warnings that I cannot access the page from the browser. I have noticed that previously, when connected to the switches, the IP address on the client that I am using to configure the switches was in the same 10.0.1.X subnet. However, now the client’s IP address when connected to any of the switches is a link-local address - 169.254.X.X..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I configure the clients to get an address within the subnet? In the future, I will be using a DHCP server, but for now I am only trying to get basic configuration done and have not yet setup a DHCP server. Is a separate DHCP server my only option?&lt;/p&gt;&#xA;" OwnerUserId="10236" LastActivityDate="2014-11-05T15:42:49.543" Title="Getting Link-Local IP after Initial Switch Configuration" Tags="|cisco|switch|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12837" PostTypeId="2" ParentId="12836" CreationDate="2014-11-05T15:42:49.543" Score="2" Body="&lt;p&gt;You either have to statically assign an IP address to your client or setup a DHCP server.  If the client is setup as a DHCP client and there is no server available, it will auto-assign itself a 169.254.x.x addrsss.&lt;/p&gt;&#xA;" OwnerUserId="10237" LastActivityDate="2014-11-05T15:42:49.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12839" PostTypeId="1" AcceptedAnswerId="12847" CreationDate="2014-11-05T20:37:06.877" Score="2" ViewCount="182" Body="&lt;p&gt;I'm working with a very flakey piece of network equipment, the uplink between our fiber handoff and our firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I've seen all kinds of setups that use RFC 1918 addresses, a firewall, an an uplink and a handoff of some sort I've not seen any cases where the firewall is also acting as the router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All over the place:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/KvVrt.png&quot; alt=&quot;Standard Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But never this:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/dPMLw.png&quot; alt=&quot;Converged Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming such a topology exists; if so what is it called and how do I find if a given firewall supports it?  &lt;/p&gt;&#xA;" OwnerUserId="657" LastActivityDate="2014-11-06T08:58:35.017" Title="&quot;Converged&quot; firewall and public side router - what am I looking for?" Tags="|routing|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12840" PostTypeId="1" AcceptedAnswerId="12842" CreationDate="2014-11-05T21:09:19.347" Score="3" ViewCount="10096" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/u4PkE.png&quot; alt=&quot;Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my current topology, I have two locations linked by a trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything on one side of the trunk is Site A, everything on the other is Site B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example above, for 10.0.200.4 to talk to 10.0.100.5 it must traverse the trunk because the gateway is on Side A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that I have machines on the same subnet in both locations, but I dont want to traverse the trunk if my traffic stays within the site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure there is something basic I'm missing here, and OSPF seems like it may be a more complicated solution that I need. Do I make both sides of the trunk gateways? Both are capable of layer 3.&lt;/p&gt;&#xA;" OwnerUserId="10240" LastEditorUserId="10240" LastEditDate="2014-11-05T22:34:41.447" LastActivityDate="2015-09-01T23:06:02.533" Title="Routing the same subnet in two locations / gateways?" Tags="|routing|vlan|layer2|layer3|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12842" PostTypeId="2" ParentId="12840" CreationDate="2014-11-05T22:29:39.017" Score="2" Body="&lt;p&gt;Create two gateways, .1 for Site A and .2 for Site B.  Then setup all the machines in Site B to use the .2 gateway and all the machines in Site A to use the .1 gateway.  The one rectangle with nothing in it would be the gateway 10.0.100.2 and 10.0.200.2.  Then the one rectangle on the left labeled L3 gateway, this will stay the gateway for 10.0.100.1 and 10.0.200.1.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in this setup you would have to re IP the circle in the top left with 10.0.100.2 and 10.0.200.2 to something else.  &lt;/p&gt;&#xA;" OwnerUserId="8265" LastEditorUserId="8265" LastEditDate="2014-11-05T22:37:35.903" LastActivityDate="2014-11-05T22:37:35.903" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12843" PostTypeId="1" AcceptedAnswerId="12854" CreationDate="2014-11-06T00:51:29.397" Score="3" ViewCount="1858" Body="&lt;p&gt;&lt;em&gt;Host A&lt;/em&gt;: &lt;code&gt;128.238.66.100/16&lt;/code&gt;&lt;br&gt;&#xA;&lt;em&gt;Host B&lt;/em&gt;: &lt;code&gt;128.238.67.100/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hosts are connected to the same &lt;strong&gt;hub&lt;/strong&gt; and nothing else is connected to that hub. The routing and &lt;code&gt;ARP&lt;/code&gt; tables of both hosts are empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Host A&lt;/em&gt; attempts to ping &lt;em&gt;Host B&lt;/em&gt;. Since &lt;em&gt;Host A&lt;/em&gt; believes that &lt;em&gt;Host B&lt;/em&gt; is in the same subnet, whether that should be relevant or not, I see an &lt;code&gt;ARP Request&lt;/code&gt; going out. On the other hand, &lt;em&gt;Host B&lt;/em&gt; never replies back with an &lt;code&gt;ARP Reply&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before proceeding, please check &lt;a href=&quot;http://www.cisco.com/c/dam/en/us/td/i/Other/Cisco_Press/ITG/10-19-01/TR890701.eps/jcr:content/renditions/TR890701.jpg&quot; rel=&quot;nofollow&quot;&gt;this figure&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 1:&lt;/strong&gt; Would &lt;em&gt;Host A&lt;/em&gt; produce an &lt;code&gt;ARP Request&lt;/code&gt; if its &lt;code&gt;IP&lt;/code&gt; address was &lt;code&gt;128.238.66.100/24&lt;/code&gt;? According to my knowledge the answer is no, since &lt;code&gt;ICMP&lt;/code&gt; is above &lt;code&gt;IP&lt;/code&gt; therefore the comparison of whether &lt;code&gt;Host B&lt;/code&gt; belongs on the same subnet or not would happen before &lt;code&gt;Host A&lt;/code&gt; determines whether he needs to produce an &lt;code&gt;ARP Request&lt;/code&gt; or not, and since the routing table is empty the packet would be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 2:&lt;/strong&gt; Should &lt;code&gt;Host B&lt;/code&gt; send back an &lt;code&gt;ARP Reply&lt;/code&gt;? Since &lt;code&gt;ARP&lt;/code&gt; is below &lt;code&gt;IP&lt;/code&gt;, no subnet comparison should take place and the host should immediately reply back, right?&lt;/p&gt;&#xA;" OwnerUserId="9916" LastActivityDate="2019-02-14T12:52:23.643" Title="Should I receive an ARP reply from a host that is logically on a different subnet but is connected to my host via a hub?" Tags="|subnet|arp|layer2|layer3|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12845" PostTypeId="2" ParentId="12843" CreationDate="2014-11-06T03:54:31.567" Score="4" Body="&lt;p&gt;Host A thinks Host B is &quot;local&quot; because it's within the /16 netmask. Host B would normally answer it unless someone went overboard on &quot;security&quot;. However, given the smaller netmask (putting A &quot;off net&quot;), B would never attempt to contact A directly. Once A and B no longer overlap, neither will look for the other locally, but will route any traffic (if possible) through other node(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(ARP and ICMP are different protocols entirely.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-11-06T03:54:31.567" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12847" PostTypeId="2" ParentId="12839" CreationDate="2014-11-06T08:58:35.017" Score="2" Body="&lt;p&gt;Such a setup isn't horribly uncommon, you'll even see a fair number of 'SMB' or branch firewall devices (such as the Juniper SRX series) with modular WAN/T1 card slots or even built-in DSL modems which can help to eliminate the need for another box, in other cases, the firewall functionality built into a modern Cisco ISR router is plenty sufficient for many basic firewall use cases (NAT, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the vendor data sheets even bother to mention it, most non-consumer-grade firewalls support being deployed in what will sometimes be referred to as an 'in-line deployment' both as a transparent bridge or a router between subnets. Often in such cases, NAT is treated like any other firewall rule or policy and is simply a configurable action (just like allow, deny, etc.) that occurs (or doesn't occur) whenever a new state is established to a specified matching source, destination, protocol, zone, or combination thereof.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your fiber handoff device though, if it's managed customer premise equipment (CPE) leased/loaned to you by the provider, you might want to discuss it with them prior to removing / replacing it, and it's possible that the handoff device is doing anything from QinQ tagging to MPLS VPN that will exceed both the capabilities of your firewall and the provider's patience with you at the same time.&lt;/p&gt;&#xA;" OwnerUserId="1701" LastActivityDate="2014-11-06T08:58:35.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12849" PostTypeId="1" AcceptedAnswerId="23001" CreationDate="2014-11-06T11:38:16.330" Score="3" ViewCount="546" Body="&lt;p&gt;Context :- For network monitoring/packet mirrioring techniques like SPAN and RSPAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is it mandatory to have a dedicated vlan for RSPAN ? why can't we mirror the packets received in a port and send it directly to a specific destination,  why to forward it as vlan only ?&lt;/p&gt;&#xA;" OwnerUserId="3193" LastActivityDate="2015-10-02T07:45:45.560" Title="Why vlan is mandatory for rspan network monitoring?" Tags="|packet-analysis|mirror|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12851" PostTypeId="2" ParentId="12849" CreationDate="2014-11-06T14:49:24.790" Score="3" Body="&lt;p&gt;Because RSPAN is &quot;Remote Span&quot; right? SPAN is just local on the same switch. With RSAPN You need to configure a vlan because you are 'mirroring' a remote port on a remote switch. In order to pass this traffic to the destination port, on a remote switch, you need to configure a vlan for this purpose. &lt;/p&gt;&#xA;" OwnerUserId="8686" LastActivityDate="2014-11-06T14:49:24.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12852" PostTypeId="1" CreationDate="2014-11-06T14:50:12.300" Score="2" ViewCount="533" Body="&lt;p&gt;I've configured SIP behind nat, but facing issues with RTP -- i.e I cannot have any voice communication, but signalling is ok.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please find below config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$&#xA; ip address 192.168.1.224 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address X.X.X.X 255.255.255.248&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip nat inside source list 111 interface GigabitEthernet0/1 overload&#xA;ip nat inside source static udp 192.168.1.218 5060 interface GigabitEthernet0/1 5060&#xA;ip route 0.0.0.0 0.0.0.0 X.X.X.X&#xA;ip route 192.168.101.0 255.255.255.0 192.168.1.215&#xA;!&#xA;access-list 111 permit ip host 192.168.1.215 any&#xA;access-list 111 permit ip host 192.168.1.216 any&#xA;access-list 111 permit ip host 192.168.1.217 any&#xA;access-list 111 permit ip host 192.168.1.218 any&#xA;access-list 111 permit ip host 192.168.1.219 any&#xA;access-list 111 permit ip host 192.168.1.220 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;192.168.1.218 is my Sip Server&lt;br/&gt;&#xA;192.168.1.220 is Media gateway&lt;br/&gt;&#xA;192.168.101.0 is Voice Network&lt;/p&gt;&#xA;" OwnerUserId="10248" LastEditorUserId="619" LastEditDate="2014-11-06T21:23:46.953" LastActivityDate="2015-02-05T13:17:05.010" Title="RTP issue over NAT" Tags="|ipv4|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12853" PostTypeId="2" ParentId="11336" CreationDate="2014-11-06T18:22:09.440" Score="1" Body="&lt;p&gt;You are probably getting a Link Local address.  The Link Local address is typically formed using EUI-64, which means it is based upon the MAC address of the interface.  If the interface changes (due to stack of switches, or redundant switches, or failover, or new SVIs), then the Link Local address is likely to change as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution?  Manually configure a static IPv6 link local address, so that all manors of redundancy use the same one.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could, theoretically, also disable IPv6 if you weren't looking to use it.  But again, that wouldn't be an option if you actually wanted to reach this switch via IPv6.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-11-06T18:22:09.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12854" PostTypeId="2" ParentId="12843" CreationDate="2014-11-06T18:27:35.640" Score="4" Body="&lt;p&gt;HostA &lt;em&gt;would&lt;/em&gt; send an ARP looking for a target address of 128.238.67.100.&lt;BR&gt;&#xA;HostB &lt;em&gt;would&lt;/em&gt; receive the ARP request&lt;BR&gt;&#xA;Whether HostB &lt;em&gt;responds&lt;/em&gt; or not is a matter of how the client is configured.&lt;em&gt;*(see below)&lt;/em&gt;&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, even if HostB responds, communication would fail because when HostA sends the ICMP Echo to HostB, HostB will get it, but from HostB's perspective, HostA's address is on a foreign network, so HostB will try to send the response to a default gateway.  If none are configured, the packet would simply be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a bit about how ARP and Switches work &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/12821/two-hosts-of-different-subnets-connected-to-switch/12823#12823&quot;&gt;in this post&lt;/a&gt;.  Might be useful to help drive the concept home.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&#xA;*An ARP Response is not sent to a destination IP.  It is sent to a destination MAC.  An ARP Request contains the &quot;Sender IP&quot; and &quot;&lt;strong&gt;Sender MAC&lt;/strong&gt;&quot;.  So technically, HostB, upon receiving the ARP Request, has everything it needs to build a proper ARP Response.  The &quot;Additional configuration&quot; lies in whether or not the HostB's operating system chooses to also validate whether the &quot;Sender IP&quot; from the ARP Request is on its own network.  If it doesn't do this check, the ARP Response will be sent.  If it does, the ARP Response will not be sent.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just labbed it out in GNS3 using two Routers as HostA and HostB.  Using &quot;debug arp&quot;, this is the console message I received from &quot;HostB&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar  1 00:12:14.595: IP ARP req filtered src 128.238.67.100 c202.28dc.0000, dst 128.238.66.100 0000.0000.0000 wrong cable, interface FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it appears, according to Cisco IOS, that the additional verification that the Sender IP is within the receiver's network &lt;em&gt;does&lt;/em&gt; happen, and as such, the ARP Response is &lt;em&gt;not&lt;/em&gt; sent.  I verified it with a packet capture as well, and only saw the ARP Request, not the ARP Response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the 'additional configuration' I was referring to above.  Whether all OS's operate this way, I'm afraid I can't know for certain, you would have to test them out individually.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-11-06T20:33:27.227" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12856" PostTypeId="2" ParentId="12852" CreationDate="2014-11-06T21:28:45.730" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;Your access-list doesn't allow NAT for 192.168.101.0/24, so they cannot talk to anything on the Internet. (they should be talking to your proxy, but might not.)&lt;/li&gt;&#xA;&lt;li&gt;You have no NAT mapping(s) for RTP traffic, so unsolicited traffic from the internet won't make it past the router.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;(As you can see, running SIP behind NAT is an enormous pain in the a**.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-11-06T21:28:45.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12858" PostTypeId="1" AcceptedAnswerId="12860" CreationDate="2014-11-07T00:49:05.750" Score="11" ViewCount="57469" Body="&lt;p&gt;I work for a VoIP service provider and I am working an issue with a customer who has a cable internet connection that's throwing me for a loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He has a single block, which we'll pretend is 70.141.15.0/29, with the gateway at .1 and routers at .2 and .3. Both routers are connected to his cable modem which is, to the best of our knowledge, set to whatever cable providers imagine &quot;bridge mode&quot; is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am pinging both these routers simultaneously from the same box, which is a linux system connected to fiber from (probably) Level(3). So needless to say, nobody on the planet knows how many nodes there are between here and there. But check out the ping results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To the first router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;64 bytes from 70.141.15.2: icmp_seq=2637 ttl=47 time=45.0 ms&#xA;64 bytes from 70.141.15.2: icmp_seq=2638 ttl=47 time=39.2 ms&#xA;64 bytes from 70.141.15.2: icmp_seq=2639 ttl=47 time=37.3 ms&#xA;64 bytes from 70.141.15.2: icmp_seq=2640 ttl=47 time=46.1 ms&#xA;64 bytes from 70.141.15.2: icmp_seq=2641 ttl=47 time=45.8 ms&#xA;64 bytes from 70.141.15.2: icmp_seq=2642 ttl=47 time=46.5 ms&#xA;64 bytes from 70.141.15.2: icmp_seq=2643 ttl=47 time=40.9 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the second:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;64 bytes from 70.141.15.3: icmp_seq=631 ttl=239 time=54.7 ms&#xA;64 bytes from 70.141.15.3: icmp_seq=637 ttl=239 time=40.5 ms&#xA;64 bytes from 70.141.15.3: icmp_seq=638 ttl=239 time=40.3 ms&#xA;64 bytes from 70.141.15.3: icmp_seq=639 ttl=239 time=38.4 ms&#xA;64 bytes from 70.141.15.3: icmp_seq=640 ttl=239 time=44.9 ms&#xA;64 bytes from 70.141.15.3: icmp_seq=641 ttl=239 time=38.4 ms&#xA;64 bytes from 70.141.15.3: icmp_seq=642 ttl=239 time=38.8 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Check out the TTL values. Does this make sense? These devices are directly adjacent to each other, plugged into that modem via separate switch ports. How can one appear to have nearly 200 more hops? From pinging other sites I'm getting the impression that TTL is just not implemented the way I think it is. I doubt there are 200 hops between me and 4.2.2.2, or woot.com, yet I get under 50 TTL results from both of those.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of these routers (the one with the higher TTL) is from Fortinet, while the other one is a custom Linux-based device. I'm pretty sure the Forti has a home-rolled network stack, while the Linux box uses whatever came with the source tarball the hardware devs downloaded. Is it likely that ICMP echo is implemented in a bizarre form on one of these and deliberately sends all replies with a TTL of 50? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also notice that one of the only sites I can find that replies with sane-looking TTL is slashdot, and I can imagine that their servers and routers might be a little less &quot;whatever we found in the garage&quot; than the average website, which sort of makes me feel like I might be on the right track with that last supposition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum up: does TTL on ping mean anything reliable whatsoever?&lt;/p&gt;&#xA;" OwnerUserId="10255" LastEditorUserId="3191" LastEditDate="2014-11-07T08:20:11.037" LastActivityDate="2023-03-06T15:40:52.377" Title="Interpreting TTL in ping results" Tags="|troubleshooting|linux|ping|icmp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12860" PostTypeId="2" ParentId="12858" CreationDate="2014-11-07T02:02:29.527" Score="25" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;So needless to say, nobody on the planet knows how many nodes there&#xA;are between here and there.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I know how many nodes.  There are exactly 16.  The reason you get different responses is because different operating systems use different starting values for TTL.  Some devices use 255, while others use 63. So, one of the devices you are pinging sends the reply with the TTL set to 255.  By the time it gets back to you, it has decremented to 239.  That's 16 hops.&lt;/p&gt;&#xA;&lt;p&gt;The other device you ping sets the TTL to 63.  So when it gets to you, the value is 47.&lt;/p&gt;&#xA;&lt;p&gt;255-239 = 63-47 = 16.&lt;/p&gt;&#xA;&lt;p&gt;If you want to be sure about the number of hops between you and the target, use traceroute.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2022-11-09T20:30:59.477" LastActivityDate="2022-11-09T20:30:59.477" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="12861" PostTypeId="2" ParentId="12840" CreationDate="2014-11-07T03:59:09.490" Score="-1" Body="&lt;p&gt;What you are asking will not work because the fundamental idea of a network segment is that everything in a network stays local, and everything outside the network gets route out via the gateway. You could make it work by overlaying a virtual layer 2 network on top of the existing routed network, but that is a painful, ugly hack to achieve what you are looking for. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your choices are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The two sides of the routed network necessarily need to be separate VLANs, subnets, etc, and route between them like normal (for example, 10.0.100/24 on the left, 10.0.200/24 on the right)&lt;/li&gt;&#xA;&lt;li&gt;You create a switched network, which you can carve up, and assign layer 2 ports to VLANs. Your trunk is now a layer two link, and both backbone devices are operating at layer 2, with layer 2 down to the edge&lt;/li&gt;&#xA;&lt;li&gt;You setup a routed network between the two routers and overlay a virtual switching fabric using OTV, tunnels, multicast and other complex technologies&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Guess which one will be easiest (hint, keeping the two sides of the layer 3 boundary in separate network segments)&lt;/p&gt;&#xA;" OwnerUserId="10104" LastActivityDate="2014-11-07T03:59:09.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12864" PostTypeId="1" CreationDate="2014-11-07T10:24:08.663" Score="1" ViewCount="138" Body="&lt;p&gt;A very elementary question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we speak of adding a name to a router or a switch, what do we mean by that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much.&lt;/p&gt;&#xA;" OwnerUserId="10258" LastActivityDate="2014-11-07T19:45:14.420" Title="Router and Switch Configuration" Tags="|cisco|router|switch|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12866" PostTypeId="1" AcceptedAnswerId="12905" CreationDate="2014-11-07T10:52:21.710" Score="4" ViewCount="1104" Body="&lt;p&gt;What is the multicast routing latency of Cisco C891F-K9 ISR?  Please cite references for your answer.  I think it's store-forward type and isn't one of the fastest models (given its price!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read a datasheet from Netgear claiming its L2 VLAN switch has the latency of 4.5 us.  If Cisco ISR does routing by CPU, should we expect it is much slower, (eg. 10--20 us?)&lt;/p&gt;&#xA;" OwnerUserId="8688" LastEditorUserId="8499" LastEditDate="2018-03-19T19:33:06.113" LastActivityDate="2018-03-19T19:33:06.113" Title="Cisco C891F-K9 ISR latency?" Tags="|cisco|routing|multicast|latency|cisco-isr|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12870" PostTypeId="1" AcceptedAnswerId="12871" CreationDate="2014-11-07T14:40:19.910" Score="8" ViewCount="6845" Body="&lt;p&gt;We're having issues where SNMPv3 ceases to accept SNMP requests on our Juniper EX series switches.  In what seems like random occurrences, Juniper nodes refuse SNMP authentication credentials.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what we end up getting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00525SYS01:~$ snmpwalk -v 3 -a SHA -A &quot;PASS&quot; -l authPriv -x AES -X &quot;PASS&quot; &#xA;  -u &quot;username&quot; mhn00416an01 iso.3.6.1.2.1.1.1.0&#xA;snmpwalk: Unknown user name&#xA;rj@MHN00525SYS01:~$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Our devices were working, but then just stop.  The usernames are correct and loaded into the system.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00416AN01# run show snmp v3 users&#xA;&#xA;Engine ID: 80 00 0a 4c 04 31 33 &amp;lt;...snip...&amp;gt;&#xA;    User                            Auth/Priv   Storage      Status&#xA;    username                         sha/aes128 nonvolatile  active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After dealing with this for some time, we finally decided to investigate.  I'm seeing this entry before the system stops accepting requests:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nov  6 09:44:32  MHN00416AN01 mgd[7996]: UI_COMMIT: User 'rj' requested 'commit' &#xA;  operation (comment: none)&#xA;Nov  6 09:44:35  MHN00416AN01 snmpd[1260]: LIBJSNMP_NS_LOG_ERR: ERR: snmpd: send_trap: USM &#xA;  unknown security name (no such user exists) (plaintext scopedPDU header type 00: s/b 30)&#xA;Nov  6 09:44:35  MHN00416AN01 snmpd[1260]: SNMPD_ENGINE_ID_CHANGED: Warning: Local &#xA;  engine ID has changed. Passwords for all the users under [edit snmp v3 usm local-engine] &#xA;  need to be reconfigured.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have found that simply re-inputting the username/passwords restore access to the device.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00416AN01# set snmp v3 usm local-engine user username &#xA;  authentication-sha authentication-password PASS&#xA;&#xA;{master:0}[edit]&#xA;rj@MHN00416AN01# set snmp v3 usm local-engine user username &#xA;  privacy-aes128 privacy-password PASS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After a &lt;code&gt;commit&lt;/code&gt; operation, we can access it again.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00525SYS01:~$ snmpwalk -v 3 -a SHA -A &quot;PASS&quot; -l authPriv -x AES -X &quot;PASS&quot; &#xA;  -u &quot;username&quot; mhn00416an01 iso.3.6.1.2.1.1.1.0&#xA;iso.3.6.1.2.1.1.1.0 = STRING: &quot;Juniper Networks, Inc. ex3300-48p Ethernet Switch, kernel &#xA;  JUNOS 12.3R3.4, Build date: 2013-06-14 02:21:01 UTC Copyright (c) 1996-2013 Juniper &#xA;  Networks, Inc.&quot;&#xA;rj@MHN00525SYS01:~$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This issue is happening across a ton of different devices.  Models include EX2200-c, EX3300, EX4200 and EX4550 on version 12.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this happening and how can I make it stop?&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-11-10T08:51:36.287" LastActivityDate="2014-11-13T13:32:52.310" Title="Unpredictable Juniper SNMPv3 Access Error" Tags="|troubleshooting|snmp|juniper-ex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12871" PostTypeId="2" ParentId="12870" CreationDate="2014-11-07T14:40:19.910" Score="6" Body="&lt;p&gt;This issue is a result of the engine-id changing.  If you run into this syslog message, that is the exact definition of the problem.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nov  6 09:44:35  MHN00416AN01 snmpd[1260]: SNMPD_ENGINE_ID_CHANGED: Warning: Local &#xA;  engine ID has changed. Passwords for all the users under [edit snmp v3 usm local-engine] &#xA;  need to be reconfigured.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I have found that this is happening for no apparent reason.  The commit performed before this engine-id changed was a simple &lt;code&gt;syslog-host&lt;/code&gt; addition that resulted in the engine-id changing.  &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos13.2/topics/reference/configuration-statement/engine-id-edit-snmp.html&quot; rel=&quot;nofollow&quot;&gt;Juniper covers the &lt;code&gt;engine-id&lt;/code&gt; option in their TechLibrary&lt;/a&gt;, which says the default option is to use the default IP address of the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a lot of beating our heads against the desk, we have found that simply defining one with an explicit setting is the best option, as it remains consistent.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00416AN01# set snmp engine-id local ***.**.244.245&#xA;&#xA;{master:0}[edit]&#xA;rj@MHN00416AN01# commit&#xA;configuration check succeeds&#xA;commit complete&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Juniper also has a note for changing the engine-id that needs to be done before it will work.  It effectively means once you commit a new engine-id, you must also commit another username/password.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; SNMPv3 authentication and encryption keys are generated based on the associated passwords and the engine ID. If you configure&#xA;  or change the engine ID, you must commit the new engine ID before you&#xA;  configure SNMPv3 users. Otherwise the keys generated from the&#xA;  configured passwords are based on the previous engine ID. For the&#xA;  engine ID, we recommend using the MAC address of the management port.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You'll need to commit new users into the configuration &lt;strong&gt;after&lt;/strong&gt; the engine change.  This is important because SNMPv3 users won't function if you don't do this despite what is actually said under the &lt;code&gt;show snmp v3 users&lt;/code&gt;.  So make sure you define new users.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00416AN01# set snmp v3 usm local-engine user username &#xA;  authentication-sha authentication-password PASS&#xA;&#xA;{master:0}[edit]&#xA;rj@MHN00416AN01# set snmp v3 usm local-engine user username &#xA;  privacy-aes128 privacy-password PASS&#xA;&#xA;{master:0}[edit]&#xA;rj@MHN00416AN01# commit&#xA;configuration check succeeds&#xA;commit complete&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Before the change:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00416AN01# run show snmp v3&#xA;&#xA;Local engine ID: 80 00 0a 4c 01 ** ** f4 f5&#xA;Engine boots:           1&#xA;Engine time:       421043 seconds&#xA;Max msg size:       65507 bytes&#xA;&#xA;Engine ID: 80 00 0a 4c 04 31 33 &amp;lt;...snip...&amp;gt;&#xA;    User                            Auth/Priv   Storage      Status&#xA;    Username                         sha/aes128 nonvolatile  active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After the change:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Local engine ID: 80 00 0a 4c 04 31 33 &amp;lt;...snip...&amp;gt;   &amp;lt;---- previously Engine ID&#xA;Engine boots:           1&#xA;Engine time:       421110 seconds&#xA;Max msg size:       65507 bytes&#xA;&#xA;Engine ID: local   &amp;lt;------ changed&#xA;    User                            Auth/Priv   Storage      Status&#xA;    Username                         sha/aes128 nonvolatile  active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This provides a more reliable SNMP setup that isn't prone to engine-id changes and eliminating access.  Juniper does recommend that you use the &lt;code&gt;use-mac-address&lt;/code&gt; option as opposed to the &lt;code&gt;local engine-id-suffix&lt;/code&gt;.  This option is susceptible to issues in a virtual chassis setup.  If a backup routing engine takes over, the SNMP engine-id will change to the &lt;code&gt;me0&lt;/code&gt; interface of the new master.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-11-13T13:32:52.310" LastActivityDate="2014-11-13T13:32:52.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12872" PostTypeId="1" CreationDate="2014-11-07T14:40:22.000" Score="3" ViewCount="203" Body="&lt;p&gt;I have cisco 3750 with three routed interfaces. IntA have an auto-assing cost of 1, IntB have an auto-assing cost of 10 and IntC have a manually-assing cost of 100. If IntB goes protocol down, I will like the device to automaticlly increment/decrement the cost of IntA and IntC, in such a way that IntC get the routing path preference.&lt;/p&gt;&#xA;" OwnerUserId="10170" LastEditorUserId="8499" LastEditDate="2020-12-16T21:06:31.307" LastActivityDate="2020-12-19T18:35:24.820" Title="It is possible to automaticly increment/decrement interface OSPF cost based on interface status?" Tags="|cisco|routing|switch|router|ospf|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="12877" PostTypeId="2" ParentId="12864" CreationDate="2014-11-07T19:45:14.420" Score="2" Body="&lt;p&gt;I'll take it that you're talking about giving the device a &lt;strong&gt;hostname&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are no technical requirement to &quot;name&quot; a device.  But as the name is often used to (depending on manufacturer/line)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Indicate the device you are logged into&lt;/li&gt;&#xA;&lt;li&gt;Added to Syslog message when sent to a syslog server&lt;/li&gt;&#xA;&lt;li&gt;Indicate the remote device in case of CDP/LLDP&#xA;and some other stuff...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It's normally a good idea do name your device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the particular device, there are variation on the method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cisco (config mode):   &lt;em&gt;hostname name-of-device&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;Juniper (config mode): &lt;em&gt;set system host-name name-of-device&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The device will now refer to itself by &quot;&lt;em&gt;name-of-device&lt;/em&gt;&quot; instead of a generic name (ie: router, switch, etc) in prompts, syslogs, CDP/LLDP, etc...  This is nothing much more than if you entered a computer name in your PC's windows setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A side effect of that is that it's wayyy more fun to refer to your router/switch name than it's IP and/or function&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of saying that the Core Switch has blown, you can say &quot;insert-device-name-here died&quot;.  another game often played is to name all your devices following a family/category of name.  I've seen servers named after fighter planes (hornet, falcon, etc) named after LoTR character names, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's more satisfying to say that &quot;MinasTirith (your firewall's name) is secure&quot; than &quot;FW-ASA-1000-BSMT-1 is secure&quot;.&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2014-11-07T19:45:14.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12878" PostTypeId="1" AcceptedAnswerId="12890" CreationDate="2014-11-07T20:23:18.320" Score="7" ViewCount="845" Body="&lt;p&gt;I'm used to the Juniper and Extreme worlds more than Cisco.  I'm able to get by OK, but some basic cli issues arise that have finally frustrated me enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside a Cisco ASA 5505/5510 running 8.3+ or a Cisco 2901 router running 15.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to setup the IOS prompts so that you know which interface's config you are in, or which sub-menu you are in? For instance if I type &quot;interface vlan 1&quot; it will change to (config-if) but it sure would be nice to be able to know which interface submenu I'm in at that point that way I don't accidentally change something on the wrong interface, like if I had accidentally typed &quot;interface vlan 2&quot;.  Something like: (config-if/vlan1) would be nice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or am I simply looking at it from the wrong perspective and there's a good reason for the prompt syntax convention as is?&lt;/p&gt;&#xA;" OwnerUserId="943" LastEditorUserId="3191" LastEditDate="2014-11-08T14:55:44.953" LastActivityDate="2014-11-08T20:05:11.153" Title="Cisco IOS cli prompts - any way to know which interface you are configuring?" Tags="|cisco-ios|cli|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12882" PostTypeId="2" ParentId="11188" CreationDate="2014-11-07T21:25:30.903" Score="3" Body="&lt;p&gt;I know something about this topic and am happy to answer :-)&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What is a distributed firewall?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;A distributed firewall is a security architecture used to protect hosts on a network.  (Some might argue with the term 'architecture' here and prefer the word 'design'.) &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What are the problems associated with conventional firewalls that gave rise to distributed firewalls?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;A conventional firewall architecture forces network traffic through a single 'choke point' - the firewall itself.  There is therefore a fundamental requirement on that particular topology, and there are number of inherent disadvantages as a consequence.  These include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The interactions that occur purely &lt;em&gt;between&lt;/em&gt; the hosts on the network cannot be filtered, since the firewall cannot observe that traffic.&lt;/li&gt;&#xA;&lt;li&gt;Some hosts require more access to the &quot;outside&quot; (such as the Internet) than others.  This requirement then has to be built into the network architecture and the arrangement of hosts (such as with a DMZ arrangement).&lt;/li&gt;&#xA;&lt;li&gt;There is a tendency for the ruleset of a firewall that protects large numbers of hosts to become very complex over time. (See the work of Prof. Avishai Wool from Tel Aviv University on this topic.)&lt;/li&gt;&#xA;&lt;li&gt;The firewall has to either terminate or proxy end-to-end encrypted traffic that traverses the firewall in order to inspect the content of that encrypted traffic.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In the distributed firewall model, each host on the network is responsible for filtering the traffic that it individually receives.  In theory, this ameliorates the above problems.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Are there any kind of attacks that can be prevented by using a distributed firewall?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;A distributed firewall emphasizes the security of individual hosts. Particular scenarios in which the distributed model might therefore be advantageous include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Attacks between hosts, i.e. that occur within the network perimeter.&lt;/li&gt;&#xA;&lt;li&gt;Malicious insiders that are by-definition already within the network perimeter.&lt;/li&gt;&#xA;&lt;li&gt;Attacks that defeat or compromise a perimeter firewall (e.g. Mike Schiffman and Dave Goldsmith's 'Firewalking' technique.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I will also note that the distributed firewall idea, although interesting, has not found much real-world traction.  Perimeter firewalls are still pervasive.  It might be possible to argue that distributed firewalls were the precursor to network-enabled host-based configuration management, although this would probably be something of a stretch.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Academic research&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The early academic research on the topic of distributed firewalls was carried out by Steven M. Bellovin (who is also the co-author of the book &lt;em&gt;Firewalls &amp;amp; Internet Security&lt;/em&gt;). The two most notable papers by Bellovin on the topic of distributed firewalls are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.cs.columbia.edu/~smb/papers/distfw.pdf&quot; rel=&quot;nofollow&quot;&gt;Distributed Firewalls&lt;/a&gt; (1999)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www1.cs.columbia.edu/~smb/papers/ccs-df.pdf&quot; rel=&quot;nofollow&quot;&gt;Implementing a Distributed Firewall&lt;/a&gt; (2000) &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you're interested in reviewing additional academic research you can perform a search on Microsoft's Academic Search service for &quot;distributed firewall&quot;, which currently returns 77 results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this is useful. Best of luck to you!&lt;/p&gt;&#xA;" OwnerDisplayName="user10267" LastActivityDate="2014-11-07T21:25:30.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12884" PostTypeId="1" AcceptedAnswerId="12886" CreationDate="2014-11-07T21:56:17.697" Score="4" ViewCount="10911" Body="&lt;p&gt;I've seen similar spins on this question before but not one that adequately answers it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the following (paraphrased, not literal) config on a Cisco SF300:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet1&#xA;Port mode General&#xA;General access VLAN 20 tagged&#xA;General access VLAN 10 untagged&#xA;PVID 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I plug a PC into this port, any untagged packets entering the port will internally enter VLAN 10. Any traffic on VLAN 10 will exit that port untagged. This I completely accept since I use it on a daily basis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the purpose of setting untagged access without setting PVID? Is untagged ingress traffic going to just go nowhere? If so, what's the purpose of having an untagged VLAN that can't communicate bidirectionally?&lt;/p&gt;&#xA;" OwnerUserId="10255" LastEditorUserId="619" LastEditDate="2014-11-08T00:43:56.357" LastActivityDate="2018-05-07T18:50:41.293" Title="PVID vs. untagged" Tags="|cisco|switch|vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12885" PostTypeId="2" ParentId="12878" CreationDate="2014-11-07T22:28:53.300" Score="2" Body="&lt;p&gt;IOS switches/routers do not have a command to show what sub-configuration mode you are in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NX-OS has the &lt;code&gt;where&lt;/code&gt; command. &lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-11-07T22:28:53.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12886" PostTypeId="2" ParentId="12884" CreationDate="2014-11-08T00:54:49.157" Score="6" Body="&lt;p&gt;Without getting into NDA territory, a lot of it has to do with the switch (chip) internals. Of course anyone with a clue codes their UI and configuration language to handle these things automatically. You'd think something with a Cisco logo on it would be better, but you'd be wrong -- that switch grew out of the Linksys Small Business product line and has never seen the same engineering effort behind IOS, for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it makes little sense, it's a valid configuration to set a PVID of 20 in your example. Untagged traffic handed to the switch would forward in VLAN 20. (no one in their right mind would(should) do that.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Note: even in switch IOS, one can set the native VLAN to something that isn't in the allowed list. And it's 100% valid.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-11-08T00:54:49.157" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12888" PostTypeId="2" ParentId="12878" CreationDate="2014-11-08T01:39:42.897" Score="0" Body="&lt;p&gt;No. However, you can simply input the interface name again to ensure you're in the expected interface. &lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-11-08T01:39:42.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12889" PostTypeId="1" CreationDate="2014-11-08T08:00:21.733" Score="1" ViewCount="16882" Body="&lt;p&gt;I'd like to build the company network with a L2 Switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the requirements.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Marketing team's computers and the visitors's mobile devices need to access the Internet.&lt;/li&gt;&#xA;&lt;li&gt;Other business computers and employee's mobile devices can't access the Internet.&lt;/li&gt;&#xA;&lt;li&gt;visitor's mobile devices can't access all computers of company such as marketing team's computers and other business computers.&lt;/li&gt;&#xA;&lt;li&gt;Employee's mobile devices need to access the business computer.&lt;/li&gt;&#xA;&lt;li&gt;Visitor's mobile devices and Employee's mobile devices use the WiFi Access Points together.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Unfortunately my L2 switch (Huawei S2700) has not DHCP Server function.&#xA;So I made the network configuration as following.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/O92jv.png&quot; alt=&quot;Network Diagram for my computer&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Marketing team's computers can obtain IP address well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But sometimes the visitor's mobile devices can't obtain IP address from DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What problem is this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Employee's mobile devices obtain IP Address as I tested, but I can't sure this always will be worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured all ports as hybrid port.&lt;/p&gt;&#xA;" OwnerUserId="10272" LastEditorUserId="10272" LastEditDate="2014-11-08T12:46:35.700" LastActivityDate="2017-07-18T07:23:31.313" Title="Devices in VLAN can't obtain IP address from DHCP server" Tags="|routing|switch|wireless|vlan|dhcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12890" PostTypeId="2" ParentId="12878" CreationDate="2014-11-08T08:29:33.023" Score="7" Body="&lt;p&gt;AFAIK, the answer is &lt;strong&gt;NO&lt;/strong&gt;.  I never understood how this valuable feature has escaped IOS for so many years or I manged to never discover it.  ;-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use the following technique in some cases when I want to be absolutely sure I'm configuring the interface that I think I am.  Comments (!) shown.  I know this technique is long-winded for the net vets, but it fits perfectly with the paranoid crowd which is sometimes both.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;do sh run int g1/1&#xA;! Look over int config and note description&#xA;int g1/1&#xA; desc GiveMeThisInterfaceOrGiveMeDeath&#xA; do sh run int g1/1&#xA; !Confirm the int you think you're inside configuring is the one intended&#xA; &amp;lt;config-if commands here&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastActivityDate="2014-11-08T08:29:33.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12891" PostTypeId="2" ParentId="12889" CreationDate="2014-11-08T10:55:35.610" Score="1" Body="&lt;p&gt;From your topology, visitor's vlan is 40.&#xA;I cannot see which DHCP server is serving that scope - is it the access point ?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Suggestions&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you have multiple VLANs and hence need multiple DHCP scopes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I would connect have 1 single DHCP server connected to the router&#xA;2) make the uplink port from switch to router as TRUNK&#xA;3) then configure DHCP RELAY for all the different VLANs&#xA;4) the DHCP server would serve all the scopes&lt;/p&gt;&#xA;" OwnerUserId="1497" LastActivityDate="2014-11-08T10:55:35.610" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12896" PostTypeId="2" ParentId="12878" CreationDate="2014-11-08T20:05:11.153" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm used to the Juniper and Extreme worlds more than Cisco. I'm able to get by OK, but some basic cli issues arise that have finally frustrated me enough.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Inside a Cisco ASA 5505/5510 running 8.3+ or a Cisco 2901 router running 15.2.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Technically with IOS 15.2, the answer is &quot;yes, you can know what interface you're configuring&quot; but admittedly my solution involves a rather unpleasant kludge-fix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will demonstrate how to use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/netmgmt/configuration/guide/12_2sx/nm_12_2sx_book/nm_eem_overview.html&quot; rel=&quot;nofollow&quot; title=&quot;Embedded Event Manager&quot;&gt;EEM&lt;/a&gt; version 3.2 to print out the interface name that you last configured.  I do not pretend this solution is perfect, but it gets the job done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Example&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DEN-EDGE-02#sh ver | i IOS&#xA;Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 15.1(4)M7, RELEASE &#xA;SOFTWARE (fc2)&#xA;DEN-EDGE-02#&#xA;DEN-EDGE-02#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;DEN-EDGE-02(config)#username cisco password cisco&#xA;DEN-EDGE-02(config)#&#xA;DEN-EDGE-02(config)#interface Fa0/0&#xA;Last interface configured was: FastEthernet0/0&#xA;&#xA;DEN-EDGE-02(config-if)#no ip proxy-arp&#xA;Last interface configured was: FastEthernet0/0&#xA;&#xA;DEN-EDGE-02(config-if)#interface lo0&#xA;Last interface configured was: Loopback0&#xA;&#xA;DEN-EDGE-02(config-if)#ip address 1.1.1.1 255.255.255.255&#xA;Last interface configured was: Loopback0&#xA;&#xA;DEN-EDGE-02(config-if)#exit&#xA;Last interface configured was: Loopback0&#xA;&#xA;DEN-EDGE-02(config)#&#xA;DEN-EDGE-02(config)#username cisco password cisco&#xA;Last interface configured was: Loopback0&#xA;&#xA;DEN-EDGE-02(config)#end&#xA;DEN-EDGE-02#&#xA;DEN-EDGE-02#sh ver | i IOS&#xA;Cisco IOS Software, 2800 Software (C2800NM-ADVENTERPRISEK9-M), Version 15.1(4)M7, RELEASE &#xA;SOFTWARE (fc2)&#xA;DEN-EDGE-02#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this point, my answer is closer to proof-of-concept code, which has several caveats...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Interface logging happens even after exiting interface configuration sub-mode; thus you will be reminded about what interface you recently configured as long as you're still in any Cisco IOS configuration mode.  The EEM policy silences itself after exiting config mode with &lt;code&gt;end&lt;/code&gt; - but it doesn't catch exit via &lt;code&gt;cntl-z&lt;/code&gt; at this point.&lt;/li&gt;&#xA;&lt;li&gt;EEM configures the router to store script state variables (i.e. &lt;code&gt;$_user_intf&lt;/code&gt; and &lt;code&gt;$_config_mode&lt;/code&gt;).  This means you get &lt;code&gt;%SYS-5-CONFIG_I&lt;/code&gt; syslog messages each time the script changes state (which is quite annoying if you're on the console).  Technically you could glue in an &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/xe-3se/3650/esm-xe-3se-3650-book.html&quot; rel=&quot;nofollow&quot;&gt;ESM policy&lt;/a&gt; to silence the EEM syslog messages, but that only increases the work you're doing to solve this problem...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Please find the configuration to print the last configured interface below... I need to give credit to Ivan Pepelnjak for his &lt;a href=&quot;http://blog.ipspace.net/2011/01/eem-event-cli-command-options-and.html&quot; rel=&quot;nofollow&quot;&gt;blog about &lt;code&gt;_exit_status&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Reset to defaults...&#xA;no event manager applet IntfCliLog&#xA;no event manager environment _user_intf&#xA;no event manager environment _config_mode&#xA;!&#xA;event manager environment _user_intf _None_&#xA;event manager environment _config_mode 1&#xA;event manager applet IntfCliLog&#xA; event cli pattern &quot;.*&quot; sync yes&#xA; action 010 set match &quot;_None_&quot;&#xA; action 020 regexp &quot;^(configure t)&quot; $_cli_msg match&#xA; action 030 comment !! Set _config_mode upon entering config mode&#xA; action 040 if $match ne &quot;_None_&quot;&#xA; action 050 cli command &quot;enable&quot;&#xA; action 060 cli command &quot;configure t&quot;&#xA; action 070 cli command &quot;event manager environment _config_mode 1&quot;&#xA; action 080 cli command &quot;end&quot;&#xA; action 090 end&#xA; action 100 set match &quot;_None_&quot;&#xA; action 110 regexp &quot;^(end)&quot; $_cli_msg match&#xA; action 120 comment !! clear variables upon exit from config mode&#xA; action 130 if $match ne &quot;_None_&quot;&#xA; action 140 cli command &quot;enable&quot;&#xA; action 150 cli command &quot;configure t&quot;&#xA; action 160 cli command &quot;event manager environment _config_mode 0&quot;&#xA; action 170 cli command &quot;event manager environment _user_intf _None_&quot;&#xA; action 180 cli command &quot;end&quot;&#xA; action 190 end&#xA; action 200 comment !! Parse any &quot;interface&quot; commands&#xA; action 210 set intfName &quot;_None_&quot;&#xA; action 220 regexp &quot;^interface *(.*)&quot; $_cli_msg match intfName&#xA; action 230 if $intfName ne &quot;_None_&quot;&#xA; action 240 cli command &quot;enable&quot;&#xA; action 250 cli command &quot;configure t&quot;&#xA; action 260 cli command &quot;event manager environment _user_intf $intfName&quot;&#xA; action 270 cli command &quot;end&quot;&#xA; action 280 end&#xA; action 290 comment !! Log the last interface configured&#xA; action 300 if $_config_mode eq 1&#xA; action 340 if $_user_intf ne &quot;_None_&quot;&#xA; action 350 puts &quot;Last interface configured was: $_user_intf&quot;&#xA; action 360 end&#xA; action 370 end&#xA; action 380 comment !! Set _exit_status 1 to run commands with &quot;event cli ... sync yes&quot;&#xA; action 390 set _exit_status 1&#xA; action 400 exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-11-08T20:05:11.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12900" PostTypeId="1" CreationDate="2014-11-08T22:37:26.540" Score="1" ViewCount="46" Body="&lt;p&gt;Just asking something I cannot find in the cisco doc&#xA;A teacher told today that when a serial interface goes up the router tries to load configuration from it!&#xA;Is it true or can you give me some reference?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="9913" LastActivityDate="2014-11-09T01:53:16.847" Title="Serial interface loading configuration" Tags="|cisco|router|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12901" PostTypeId="2" ParentId="12900" CreationDate="2014-11-08T23:34:08.307" Score="1" Body="&lt;p&gt;It's not specific to serial interfaces. Check out the &quot;service config&quot; statement: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_r1.html#wp1076778&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_r1.html#wp1076778&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2014-11-08T23:34:08.307" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12903" PostTypeId="2" ParentId="12900" CreationDate="2014-11-09T01:53:16.847" Score="1" Body="&lt;p&gt;If the link encapsulation is PPP, then this is &lt;em&gt;very broadly&lt;/em&gt; true -- PPP can negotiate a great many parameters. But this is a long way from getting any configuration &quot;cli&quot; content.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-11-09T01:53:16.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12904" PostTypeId="1" CreationDate="2014-11-09T11:58:02.520" Score="4" ViewCount="922" Body="&lt;p&gt;Some ISPs are doing QoS based on traffic type (online streaming), such as &lt;a href=&quot;http://blog.level3.com/internet-broadcast/an-ip-engineer-and-consumer-view-of-xfinity-traffic-prioritization/&quot; rel=&quot;nofollow&quot;&gt;Comcast&lt;/a&gt; and &lt;a href=&quot;https://groups.google.com/a/measurementlab.net/forum/#!topic/discuss/vcQnaZJO6nQ&quot; rel=&quot;nofollow&quot;&gt;Cogent&lt;/a&gt;. Why don't they reset IP DSCP at the edge so it is not as obvious that they are doing some kind of traffic shaping? Most CPEs are going to ignore DSCP anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any insight on how ISPs usually implement this type of QoS? I am thinking at exchange point, source IP (content networks) based mapping. What am I missing here (the linecard is going to be pretty expensive...on platform like ASR9K)?&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2014-11-10T02:04:36.383" LastActivityDate="2014-11-10T02:04:36.383" Title="Why doesn't ISPs reset DSCP at the edge before delivering traffic to customers?" Tags="|qos|isp|service-provider|dscp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12905" PostTypeId="2" ParentId="12866" CreationDate="2014-11-09T12:54:57.400" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the multicast routing latency of Cisco C891F-K9 ISR? Please cite references for your answer. I think it's store-forward type and isn't one of the fastest models (given its price!).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;... &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/12866/cisco-c891f-k9-isr-latency#comment19818_12866&quot;&gt;from the comments&lt;/a&gt;: we want to know the effective bandwidth of routing multicast packets w/o dropping any packets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What you're looking for is the RFC 2544 No Drop Rate (NDR), which is shown in Table 1 of &lt;a href=&quot;http://www.cisco.com/web/partners/downloads/765/tools/quickreference/routerperformance.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's Portable Product Sheet&lt;/a&gt;, I've included a copy of it inline below...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/s2wuM.png&quot; alt=&quot;Portable Product Sheet&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, the fastest a Cisco 891 can forward packets without dropping them is 100Kpps, which translates to 10 microseconds of latency; however, realize this is the fastest you can forward traffic.  The performance will be lower if you turn on interface-level features, such as netflow, CBWFQ, or security access-lists.  Unfortunately you can't know how much lower without testing the performance yourself; you can use tools such as &lt;a href=&quot;https://github.com/esnet/iperf&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;iperf3&quot;&gt;iperf3&lt;/a&gt; for this kind of testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually it's a safe assumption to take 60% of the maximum NDR and use that number as your forwarding rate (with a lot of features); 60% of 100Kpps is 60Kpps, or 17 microseconds of latency.  There should not be a meaningful difference between unicast and multicast forwarding rates.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;... &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/12866/cisco-c891f-k9-isr-latency#comment19818_12866&quot;&gt;from the comments&lt;/a&gt;: the Cisco 891 seems to be limited to 20 us =&gt; 50k packets/sec =&gt; 26 Mpbs for 64 byte packets. 4.5 us =&gt; 114 Mpbs&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is where your assumptions are leading you sideways.  A router's NDR is measured with 64-byte frames, but you should not use that to build the maximum possible bandwidth of the device, because no sane person builds services that inefficiently; we all use much larger frames than 64-bytes.  You're the only person who can tell us what your average server's packets will be, but let's assume they are 300 bytes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cisco 891 @ 60Kpps (many features) and 300 byte IP packets: 144Mbps&lt;/li&gt;&#xA;&lt;li&gt;Cisco 891 @ 100Kpps and 300 byte IP packets: 240Mbps&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Final notes&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that the PPS forwarding rate of the router is a unidirectional measurement.  Bidirectional traffic will consume part of those numbers... so if we use 60Kpps / 300-byte packets, and you require 90Mbps downstream, you should plan on no more than 54 Mbps of upstream traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also account for the reality that network engineers do not want to operate routers at 100% CPU all the time.  Usually we start looking for upgrades around 70 or 80% CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So... all that said, your best approach to finding out whether a Cisco 891 is enough is to do some testing with the real services and features that you're going to pass in production.  If your IT staff won't turn on many features, plan on 100Mbps bi-directionally.  If your IT staff needs to turn on a lot of features, you really should test the router with the combination of features you think you'll need.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-11-09T23:43:05.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12906" PostTypeId="2" ParentId="12904" CreationDate="2014-11-09T14:15:09.053" Score="6" Body="&lt;p&gt;I have no practical experience in running CoS/DSCP in ISP networks, but a logical explanation would be that it doesn't make sense to just change fields in a header. Even if I as an intermediate ISP wouldn't be interested in these fields, the receiver or some other intermediate party could be. Resetting DSCP fields just because I'm not using them sounds like a waste of resources and unneeded meddling in my customers' packets.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-11-09T14:15:09.053" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12909" PostTypeId="2" ParentId="10891" CreationDate="2014-11-09T15:05:50.927" Score="-1" Body="&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/users/630/generalnetworkerror&quot;&gt;generalnetworkerror&lt;/a&gt; had a great answer.  I just want to add one additional though:  iperf by default uses TCP, which is susceptible to changes in RTT and congestion.  A more accurate measure of throughput would be to use the &lt;code&gt;-u&lt;/code&gt; option (on both client and server) to measure the bandwidth using UDP.  Make sure you also set a bandwidth target on the client as well.  Excerpt from the MAN Page:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GENERAL OPTIONS&#xA;   -u, --udp&#xA;          use UDP rather than TCP&#xA;&#xA;CLIENT SPECIFIC OPTIONS&#xA;   -b, --bandwidth n[KM]&#xA;          set target bandwidth to n bits/sec (default 1 Mbit/sec).  This setting requires UDP (-u).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Typically, if you are measuring maximum throughput with iperf, you almost always want to use UDP.  The exception is if you are specifically looking for TCP throughput data.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-11-09T15:05:50.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12911" PostTypeId="1" CreationDate="2014-11-09T19:47:06.317" Score="3" ViewCount="1518" Body="&lt;p&gt;I have an ASA 5510 running 8.2(5) with the following configuration and I am having problems routing traffic between sub-interfaces at the same security level. Although not shown there are ACL's for each sub-interface allowing ICMP and IP traffic in both directions.&#xA;NOTE: I have cut down the amount of config posted but what is there should be sufficient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The restrictions in place are:&#xA;No upgrade beyond 8.2(5) &#xA;No use of same-security commands&#xA;All inside interfaces to be same security level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic flows to/from the outside to the various sub-interface, but between sub-interfaces it is hit &amp;amp; miss, which is the source of my confusion. If it were consistent in not working it would be easy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problems I am seeing for example are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Asymmetric NAT rules matched for forward and reverse flows; for traffic from sub-int 112 to 104&lt;/li&gt;&#xA;&lt;li&gt;ICMP traffic being denied by an implicit rule, yet each ACL has &lt;code&gt;ext perm ICMP any any&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;I am pretty sure this line nat (DMZ-102) 1 192.168.102.0 255.255.255.0 is an error but having it or removing it seems to make no difference.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So if anyone has suggestions/recommendations please let me know.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/0&#xA; speed 100&#xA; duplex full&#xA; nameif outside&#xA; security-level 0&#xA; ip address 10.172.1.212 255.255.255.0 &#xA;&#xA;interface Ethernet0/1&#xA; speed 1000&#xA; duplex full&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;&#xA;interface Ethernet0/1.102&#xA; vlan 102&#xA; nameif DMZ-102&#xA; security-level 100&#xA; ip address 192.168.102.251 255.255.255.0 &#xA;&#xA;interface Ethernet0/1.103&#xA; vlan 103&#xA; nameif DMZ-103&#xA; security-level 100&#xA; ip address 192.168.103.252 255.255.255.0 &#xA;&#xA;interface Ethernet0/1.104&#xA; vlan 104&#xA; nameif DMZ-104&#xA; security-level 100&#xA; ip address 192.168.104.252 255.255.255.0 &#xA;&#xA;interface Ethernet0/1.112&#xA; vlan 112&#xA; nameif DMZ-112&#xA; security-level 100&#xA; ip address 192.168.112.252 255.255.255.0 &#xA;&#xA;access-list incoming extended permit ip any any&#xA;access-list OUTBOUND extended permit ip any any &#xA;global (outside) 1 interface&#xA;global (DMZ-102) 1 interface&#xA;global (DMZ-103) 1 interface&#xA;global (DMZ-104) 1 interface&#xA;global (DMZ-112) 1 interface&#xA;nat (DMZ-102) 1 192.168.102.0 255.255.255.0&#xA;nat (DMZ-102) 0 192.168.102.0 255.255.255.0&#xA;nat (DMZ-103) 0 192.168.103.0 255.255.255.0&#xA;nat (DMZ-104) 0 192.168.104.0 255.255.255.0&#xA;nat (DMZ-112) 0 192.168.112.0 255.255.255.0&#xA;static (DMZ-103,outside) 10.172.1.213 192.168.103.11 netmask 255.255.255.255 &#xA;static (DMZ-102,DMZ-103) 192.168.102.0 192.168.102.0 netmask 255.255.255.255&#xA;static (DMZ-102,DMZ-104) 192.168.102.0 192.168.102.0 netmask 255.255.255.255&#xA;static (DMZ-102,DMZ-112) 192.168.102.0 192.168.102.0 netmask 255.255.255.255&#xA;static (DMZ-103,DMZ-102) 192.168.103.0 192.168.103.0 netmask 255.255.255.255&#xA;static (DMZ-103,DMZ-104) 192.168.103.0 192.168.103.0 netmask 255.255.255.255&#xA;static (DMZ-103,DMZ-112) 192.168.103.0 192.168.103.0 netmask 255.255.255.255&#xA;static (DMZ-104,DMZ-102) 192.168.104.0 192.168.104.0 netmask 255.255.255.255&#xA;static (DMZ-104,DMZ-103) 192.168.104.0 192.168.104.0 netmask 255.255.255.255&#xA;static (DMZ-104,DMZ-112) 192.168.104.0 192.168.104.0 netmask 255.255.255.255&#xA;static (DMZ-112,DMZ-102) 192.168.112.0 192.168.112.0 netmask 255.255.255.255&#xA;static (DMZ-112,DMZ-103) 192.168.112.0 192.168.112.0 netmask 255.255.255.255&#xA;static (DMZ-112,DMZ-104) 192.168.112.0 192.168.112.0 netmask 255.255.255.255&#xA;access-group incoming in interface outside&#xA;access-group OUTBOUND out interface outside&#xA;route outside 0.0.0.0 0.0.0.0 10.172.1.1 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10288" LastEditorUserId="10288" LastEditDate="2014-11-09T20:07:44.260" LastActivityDate="2014-11-09T22:38:51.867" Title="Cisco ASA 8.2(5) same security routing issue" Tags="|vlan|cisco-asa|nat|firewall|security|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12914" PostTypeId="2" ParentId="12911" CreationDate="2014-11-09T22:38:51.867" Score="7" Body="&lt;p&gt;Without the use of &lt;code&gt;same-security&lt;/code&gt;, traffic &lt;em&gt;will not&lt;/em&gt; flow between interfaces at the same security level. That's the way it's designed, and the very purpose of those commands. No amount of ACLs can override that basic function. Once &lt;code&gt;inter-interface&lt;/code&gt;/&lt;code&gt;intra-interface&lt;/code&gt; is enabled -- thus allowing traffic at all -- ACLs will apply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(You could set interfaces to different levels and use NAT/ACLs to control the traffic, but your restrictions don't allow that either. And it's a mess to maintain.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-11-09T22:38:51.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12920" PostTypeId="1" AcceptedAnswerId="12931" CreationDate="2014-11-10T09:22:15.137" Score="0" ViewCount="578" Body="&lt;p&gt;I send two requests to a remote host:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;request1 (ICMP request): ping &lt;strong&gt;IP_adresse&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;request2 (TCP request):  hping3 -S -p open_port &lt;strong&gt;IP_adresse&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I received two responses that show different TTL:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;response1: 64 bytes from &lt;strong&gt;IP_adresse&lt;/strong&gt;: icmp_req=1 ttl=&lt;strong&gt;121&lt;/strong&gt; time=78.3 ms&lt;/li&gt;&#xA;&lt;li&gt;response2: len=56 ip=&lt;strong&gt;IP_adresse&lt;/strong&gt; ttl=&lt;strong&gt;111&lt;/strong&gt; DF id=5156 flags=SA seq=0 win=1460 rtt=1729.1 ms&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;According to this &lt;a href=&quot;http://www.binbert.com/blog/2009/12/default-time-to-live-ttl-values/&quot; rel=&quot;nofollow&quot; title=&quot;link&quot;&gt;link&lt;/a&gt;, recent Windows OS releases have the same default TTL=128 for all protocoles&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why the TTL received in the two responses TCP &amp;amp; ICMP is different ?&lt;/p&gt;&#xA;" OwnerUserId="6358" LastEditorUserId="6358" LastEditDate="2014-11-10T16:01:21.120" LastActivityDate="2014-11-10T16:08:41.843" Title="can a Windows OS have different default Time To Live values (TTL) depending on protocol?" Tags="|tcp|" AnswerCount="1" CommentCount="0" ClosedDate="2019-05-27T02:16:10.987" ContentLicense="CC BY-SA 3.0" />
  <row Id="12923" PostTypeId="1" AcceptedAnswerId="12940" CreationDate="2014-11-10T10:30:56.720" Score="4" ViewCount="722" Body="&lt;p&gt;On a Cisco IOS router can I use the same transform set with multiple crypto maps?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I.E. Is the below configuration example valid?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;crypto isakmp policy 1&#xA; encr aes 256&#xA; authentication pre-share&#xA; group 2&#xA;!&#xA;crypto isakmp key *** address 192.168.255.1&#xA;crypto isakmp key *** address 172.16.255.1&#xA;crypto isakmp key *** address 10.255.255.1&#xA;!&#xA;!&#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-md5-hmac &#xA;!&#xA;!&#xA;crypto map CMAP100 1 ipsec-isakmp &#xA; description *VPN WITH CLIENT 1*&#xA; set peer 192.168.255.1&#xA; set transform-set ESP-3DES-SHA &#xA; match address 110&#xA;!&#xA;!&#xA;crypto map CMAP200 1 ipsec-isakmp &#xA; description *VPN WITH CLIENT 2*&#xA; set peer 172.16.255.1&#xA; set transform-set ESP-3DES-SHA &#xA; match address 120&#xA;!&#xA;crypto map CMAP200 2 ipsec-isakmp &#xA; description *VPN WITH CLIENT 3*&#xA; set peer 10.255.255.1&#xA; set transform-set ESP-3DES-SHA &#xA; match address 130&#xA;!&#xA;!&#xA;!&#xA;interface Fa0/0&#xA; description *WAN1*&#xA; ip address 10.0.0.1 255.255.255.0&#xA; crypto map CMAP100&#xA;!&#xA;interface Fa0/1&#xA; description *WAN2*&#xA; ip address 10.1.0.1 255.255.255.0&#xA; crypto map CMAP200&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3619" LastActivityDate="2014-11-10T21:33:34.097" Title="Cisco IOS | Can I use same transform set in different crypto maps?" Tags="|cisco|vpn|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12925" PostTypeId="1" AcceptedAnswerId="12930" CreationDate="2014-11-10T12:35:20.950" Score="0" ViewCount="261" Body="&lt;p&gt;I've come around following example in TCP/IP illustrated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Figure 2-3. A site is allocated the classical class B network number 128.32. The&#xA;network administrator decides to apply a site-wide subnet mask of 255.255.255.0,&#xA;giving 256 subnetworks where each subnetwork can hold 256 – 2 = 254 hosts. The&#xA;IPv4 address of each host on the same subnet has the subnetwork number in&#xA;common. All of the IPv4 addresses of hosts on the left-hand LAN segment start&#xA;with 128.32.1, and all of those on the right start with 128.32.2.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NF3L5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would imagine B class address (128.32.) with a 255.255.255.0 mask resulting in 128.32.0.[0-254] address range. The book says its 128.32.[0-254].[0-254], as fas as I understood. Can someone explain why despite third octet is masked, the book refers to 128.32.1 and 128.32.2 avaialble? &lt;/p&gt;&#xA;" OwnerUserId="10298" LastEditorUserId="10298" LastEditDate="2014-11-13T16:03:59.927" LastActivityDate="2014-11-13T16:27:50.660" Title="Can masked octets in network adress still be used?" Tags="|ipv4|subnet|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12926" PostTypeId="1" CreationDate="2014-11-10T12:50:07.420" Score="2" ViewCount="764" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_WLAN_channels&quot; rel=&quot;nofollow&quot;&gt;The list of wifi channels are presented here&lt;/a&gt;. My question:&#xA;Let us assume that I have two Access points. which of the channels listed are used by which Access point? and how many users are supported per each Access point? are users allowed to send data concurrently to the access point (in other words, how many users can the channel hear at once?) Thank you. &lt;/p&gt;&#xA;" OwnerUserId="8739" LastActivityDate="2014-11-10T20:37:03.593" Title="Which channels are used by Wifi access points?" Tags="|access-point|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12930" PostTypeId="2" ParentId="12925" CreationDate="2014-11-10T15:28:03.127" Score="1" Body="&lt;p&gt;The book is saying that the network admin is subnetting the class B network &lt;code&gt;128.32.0.0/16&lt;/code&gt; into 256 subnets with a netmask of &lt;code&gt;255.255.255.0&lt;/code&gt; (/24 in CIDR notation): &lt;code&gt;128.32.0.0/24&lt;/code&gt;, &lt;code&gt;128.32.1.0/24&lt;/code&gt;, &lt;code&gt;128.32.2.0/24&lt;/code&gt;... The whole &lt;code&gt;128.32&lt;/code&gt; class B still routes to that site. The smaller subnets are &quot;internal&quot; (the rest of the internet need not be aware).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example scenario: &lt;code&gt;128.32.0.0&lt;/code&gt; is assigned to some company. Call it the Acme corporation. Acme has several departments: IT, Accounting, Sales, etc that they would like to keep on separate networks. So they assign each its own subnetwork: IT=&lt;code&gt;128.32.0.0/24&lt;/code&gt;, Accounting=&lt;code&gt;128.32.1.0/24&lt;/code&gt; etc. The rest of the internet does not care about these internal designations. All that matters is that the internet can reach Acme. &lt;/p&gt;&#xA;" OwnerUserId="10300" LastEditorUserId="762" LastEditDate="2014-11-10T18:39:05.293" LastActivityDate="2014-11-10T18:39:05.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12931" PostTypeId="2" ParentId="12920" CreationDate="2014-11-10T16:08:41.843" Score="1" Body="&lt;p&gt;In default configuration TTL for all communication is the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you're experiencing is either:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There's a different path taken by each of those protocols in the network - due to things like traffic engineering, different routing policies or whatever is between you and the destination host.&lt;/li&gt;&#xA;&lt;li&gt;There's a box in the middle (like firewall or something similar) that's modifying the TTL field because either that's a policy (and for one protocol it's in place, for the other it's not) or it's doing something in addition to just processing the packet from one side to the other.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-11-10T16:08:41.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12932" PostTypeId="2" ParentId="12925" CreationDate="2014-11-10T16:10:22.700" Score="0" Body="&lt;p&gt;In binary form:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.23.0.0    = 10000000000101110000000000000000&#xA;255.255.255.0 = 11111111111111111111111100000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The mask computation result would be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        10000000000101110000000000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same as the net was before subnetting. So, despite third octet looks &quot;masked&quot; when written in decimal form, it's not. That's why we can use 128.23.&lt;em&gt;.&lt;/em&gt; adresses.&lt;/p&gt;&#xA;" OwnerUserId="10298" LastActivityDate="2014-11-10T16:10:22.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12934" PostTypeId="1" CreationDate="2014-11-10T17:37:39.787" Score="2" ViewCount="95" Body="&lt;p&gt;I have been looking for an example online but could not find one so hopefully someone here might give me an example. I am trying to set up an ACL to block any entire network accessing  a specific device on another network. The routing protocol I am using is ospf.&#xA;I was trying something like this but it doesnt work.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 106 deny ospf 192.168.3.0 0.0.0.31 host Server&#xA;access-list 106 permit ip any any&#xA;int g0/0&#xA;ip access-group 106 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If anyone can provide an example I would be grateful.&lt;/p&gt;&#xA;" OwnerUserId="10303" LastActivityDate="2014-11-10T20:26:08.223" Title="Access Control List from a network to a specific device on another network." Tags="|ospf|access-control|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12935" PostTypeId="2" ParentId="12925" CreationDate="2014-11-10T18:57:32.023" Score="1" Body="&lt;p&gt;The behavior of a router is to send packets to a destination based on the longest prefix match. This simply refers to the specificity of a route determined by it's mask length. It's exactly analogous to putting a letter you've written to your friend in Albuquerque, NM in the mailbox. If you just write &quot;Albuquerque, NM 87111&quot; as the destination address on the envelope (as opposed to &quot;12338 Anyplace Street Albuquerque, NM 87111&quot;), your letter will get to Albuquerque - if your local postal carrier decides to not yell at you, but using an accurate address will get your letter to the right place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Abstracting this concept to IP addresses and routes: if all three of these routes exist in a router's routing table, which one of these do you think a router would choose as the proper route to send packets to a destination, if the destination IP address is &lt;code&gt;192.168.1.75&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.0.0/16&#xA;192.168.1.0/24&#xA;192.168.1.64/27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you guessed the third option, you'd be correct, as this is the &lt;em&gt;most specific&lt;/em&gt; route to the destination address, and thus will be the route that the router uses to send the traffic to that IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, with that said if you get your own IP space from an RIR and you want to connect to the Internet, you will be required by most transit providers (ISPs) to announce this IP space with a prefix length no longer than a /24. The point of doing this is to keep the global routing table of the Internet as small as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example you provided, if &quot;the site&quot; has an entire /16 of their own IP address space, that creates a possible 256 subnets (routes) of a /24 mask length. Only under certain circumstances would the site want to do anything &lt;em&gt;besides&lt;/em&gt; announce a single /16 prefix to the Internet Service Provider in order to route traffic to their network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This concept is referred to as &lt;em&gt;route aggregation&lt;/em&gt; and is generally regarded as a desirable thing to do whenever possible, especially when connecting to the Internet.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2014-11-10T19:08:32.520" LastActivityDate="2014-11-10T19:08:32.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12936" PostTypeId="2" ParentId="12934" CreationDate="2014-11-10T20:25:36.853" Score="2" Body="&lt;p&gt;You want to deny IP packets from that network.  Update the first line of your ACL to read &lt;code&gt;access-list 106 deny ip 192.168.3.0 0.0.0.31 host Server&lt;/code&gt; and you should be good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that OSPF is your dynamic routing protocol has no impact on this question, it's just extra information that is throwing you off.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-11-10T20:25:36.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12937" PostTypeId="2" ParentId="12934" CreationDate="2014-11-10T20:26:08.223" Score="3" Body="&lt;p&gt;You are confusing routing with traffic flow.  The routing protocol is used to learn networks from other routers.   It does not directly affect the flow of traffic.  If you want to block access to the host Server from 192.268.3.0/27, you want to block IP packets.  So your access list would look something like this;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 106 deny ip 192.168.3.0 0.0.0.31 host Server&#xA;access-list 106 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-11-10T20:26:08.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12939" PostTypeId="2" ParentId="12926" CreationDate="2014-11-10T20:37:03.593" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Which of the channels listed are used by which Access point?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For best results, only 1, 6 and 11 are used in the 2.4GHz band.  Typically, you would not have the two access points on the same channel because they would tend to interfere with each other.  You can manually select the channel, or some APs will pick the &quot;best&quot; one.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How many users are supported per each Access point?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That depends on the model of access point and the amount of bandwidth each user requires.  Cisco APs will allow up to 256 clients to associate, but normally you would saturate the channel long before then.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are users allowed to send data concurrently to the access point?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;802.11 is CSMA/CA, so each client waits until the channel is clear before sending.  In short, no.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-11-10T20:37:03.593" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12940" PostTypeId="2" ParentId="12923" CreationDate="2014-11-10T21:33:34.097" Score="3" Body="&lt;p&gt;Yes, both transform-sets like ACLs to select interesting traffic can be reused in different crypto maps and different crypto map entries of the same map.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2014-11-10T21:33:34.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12942" PostTypeId="1" CreationDate="2014-11-10T23:43:24.777" Score="7" ViewCount="1370" Body="&lt;p&gt;I'm a bit new to BGP and need a little assistance with a configuration change. We are currently using our MPLS connection for all traffic to all sites. Going forward We would want to segragate the Datacenter backup link from the other spoke sites and will be adding an additional MPLS leg in our core datacenter to accommodate. See image of current setup and router configs.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/2Lltf.jpg&quot; alt=&quot;Diagram before new service&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/abYNv.jpg&quot; alt=&quot;Router Configurations&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have ordered a new MPLS leg with a Closed User Group(CUG) from the ISP. This new service is for datacenter to datacenter traffic only. The existing MPLS leg will be used exclusivly for our remote sites.(Hub-Spoke) &lt;img src=&quot;https://i.stack.imgur.com/YbHcj.jpg&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/7sczT.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how do I program the core router with this new CUG that has the same AS number from the ISP (AS207). Do I just add the new network and neighbor to the existing AS 65001? I believe I only need to change the core router because the backup DC MPLS will be integrated into the new CUG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a production network which is why I'm a little apprehensive making this program change.&lt;/p&gt;&#xA;" OwnerUserId="10304" LastActivityDate="2014-11-12T01:59:27.743" Title="Configuring a second MPLS connection for our backup Data center (BGP Closed User Group)" Tags="|cisco|routing|bgp|mpls|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12943" PostTypeId="1" CreationDate="2014-11-11T01:12:56.613" Score="5" ViewCount="529" Body="&lt;p&gt;I work for a VoIP provider, and one of the biggest hassles I deal with is downstream traffic management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our flagship product is QoS-enabled bonded T1 or SHDSL bundles configured to support our own VoIP service. We build QoS policies at our edge router that sort our voice traffic into the highest priority queue, and that product is very effective. When the circuit is built correctly, there's nothing the customer can do to interfere with their audio quality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's bothering me is that I've gotten a LOT of flack from other network engineers, IT techs, etc. who think that it's possible to make a service like this work without edge router QoS. I don't feel like this practical. I'd like to explain my understanding, and I hope somebody has the time to poke holes in it, if there are any. Pardon the lengthy question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take a Comcast circuit. I don't work for Comcast so I'm speculating on their network build, but I imagine it's something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Comcast's fiber backs up to a Cisco edge router, and from there connects to their cable headend. Each customers IP is built out on the edge router with a given downstream bandwidth - say, 30mbit - which allocates them a queue of 30 megabits plus some percentage of overhead (I don't know how much this typically is).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say the subscriber goes to download a 40mbyte file from a large enterprise server. They hit download, the TCP connection establishes and starts the slow-start process, but after a few seconds the server is pushing well over 30mbit of data. This fills up the queue on the edge router and it starts dropping packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point TCP congestion avoidance kicks in and starts slowing down the transfer to fit within the available bandwidth, but obviously voice is ruined already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I've been told that routers with inbound QoS policies are capable of leveraging the TCP congestion avoidance mechanism by dropping ACKs in order to rate-shape inbound traffic. I've never seen this done in practice, or at least never seen it work; is this a real thing? If so, is it effective? Wouldn't it result in a run of dropped packets every time that a new connection ramped up to speed, before the congestion algorithm could start slowing things down?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to that, however, what if the traffic utilizing the circuit is largely UDP? If a request for a large amount of UDP data is sent to a server, it's naturally going to send the data as quickly as feasible, flood the queue and cause dropped voice packets - but maybe I'm overreacting to that scenario. Is UDP used for any high-throughput internet technologies these days?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More specifically, have you ever personally seen a QoS method that let VoIP work without constant quality problems on a frequently-saturated internet connection without ISP-provided QoS? Have you ever heard of a DSL or cable provider implementing edge router QoS for an application like this? I've only ever heard of that offered as part of MPLS products, is that pretty much a necessity if someone wants downstream QoS?&lt;/p&gt;&#xA;" OwnerUserId="10255" LastActivityDate="2016-04-15T10:54:23.623" Title="Downstream QoS Feasibility" Tags="|qos|voip|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12944" PostTypeId="1" AcceptedAnswerId="13050" CreationDate="2014-11-11T11:05:05.607" Score="3" ViewCount="4167" Body="&lt;p&gt;There is a desktop computer in our LAN that keeps booting almost every time seconds after it  has been turned off manually. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspected it was a Wake-on-LAN issue since the beginning, and it looks like it: the problem disappears if the ethernet cable is disconnected before turning the computer off. Also, although the BIOS does not have an specific option to disable WOL, it has a power saving option that switches off the network card when the computer is not running, and this solves the problem too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is I cannot find who is sending WOL packets. I am sniffing the whole LAN with Wireshark using the capture filter &quot;ether proto 0x0842 or udp&quot;, as suggested in &lt;a href=&quot;http://wiki.wireshark.org/WakeOnLAN&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://wiki.wireshark.org/WakeOnLAN&lt;/a&gt; and it does not detect anything. But when I manually send WOL packets from different computers on the network Wireshark does catch these packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see anything weird when capturing all traffic to and from this computer either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &quot;Wake on Pattern Match&quot; option is enabled on the computer. According to &lt;a href=&quot;https://superuser.com/questions/560175/what-is-wake-on-pattern-match-in-network-card-preferences&quot;&gt;https://superuser.com/questions/560175/what-is-wake-on-pattern-match-in-network-card-preferences&lt;/a&gt; the default patterns are: magic packet, NetBIOS name query, TCPv4 SYN, TCPv6 SYN, IPv6 Neighbour Solicitation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other PCs have this option enable too, but they do not randomly wake up. I am going to check if this computer is receiving any of these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/B2tgP.png&quot; alt=&quot;Power Management options of the computer&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10311" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2015-03-18T22:28:25.400" Title="Computer booting due to (I guess) untraceable wake-on-lan packet" Tags="|wireshark|wake-on-lan|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="12945" PostTypeId="1" CreationDate="2014-11-11T12:35:33.700" Score="5" ViewCount="3790" Body="&lt;p&gt;I have a little problem to realize a AP solution on a small office environment. At first I do not have any skills in configuring Cisco Access Points ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following environment: A small office about 15 people and a network which is segmented into 2 VLANs (VLAN100 for clients and RADIUS server and VLAN200 for guests with very restricted access. The AP is connected on a L3 switch port with access on both VLANs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if someone uses the AP, an authentication is required over the RADIUS server in VLAN100. On the RADIUS server I configured the NPS server role (Windows Server 2008R2) with 2 network policies (for each VLAN one policy) to grant access by successfull authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally I have the problem if someone authenticates himself by using a guest account, he gets no network connectivity cause he does not know the VLAN. - Are there best practice tutorials for CISCO APs with RADIUS and VLANs or something like that, maybe someone has a better idea to realize that authentication/VLAN tagging procedure?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Ok here is the config, maybe I made a mistake:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Current configuration : 4225 bytes&#xA;!&#xA;! Last configuration change at 01:17:55 +0100 Mon Mar 1 1993&#xA;version 15.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname AP01&#xA;!&#xA;!&#xA;logging rate-limit console 9&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa group server radius rad_eap&#xA; server 172.0.0.30&#xA;!&#xA;aaa authentication login eap_methods group rad_eap&#xA;aaa authorization exec default local&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;clock timezone +0100 1 0&#xA;no ip routing&#xA;no ip cef&#xA;ip domain name domain.local&#xA;ip name-server 172.0.0.31&#xA;ip name-server 172.0.0.30&#xA;ip name-server 172.0.0.28&#xA;!&#xA;!&#xA;!&#xA;no dot11 syslog&#xA;!&#xA;dot11 ssid WLAN-SSID&#xA;   vlan 100&#xA;   authentication open eap eap_methods&#xA;   authentication key-management wpa version 2&#xA;   mbssid guest-mode&#xA;!&#xA;!&#xA;power inline negotiation prestandard source&#xA;crypto pki token default removal timeout 0&#xA;!&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption vlan 100 mode ciphers aes-ccm&#xA; !&#xA; encryption mode ciphers aes-ccm&#xA; !&#xA; encryption vlan 200 mode ciphers aes-ccm&#xA; !&#xA; ssid WLAN-SSID&#xA; !&#xA; antenna gain 0&#xA; stbc&#xA; beamform ofdm&#xA; mbssid&#xA; station-role root&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.100&#xA; encapsulation dot1Q 100&#xA; no ip route-cache&#xA; bridge-group 100&#xA; bridge-group 100 subscriber-loop-control&#xA; bridge-group 100 spanning-disabled&#xA; bridge-group 100 block-unknown-source&#xA; no bridge-group 100 source-learning&#xA; no bridge-group 100 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.200&#xA; encapsulation dot1Q 200&#xA; no ip route-cache&#xA; bridge-group 200&#xA; bridge-group 200 subscriber-loop-control&#xA; bridge-group 200 spanning-disabled&#xA; bridge-group 200 block-unknown-source&#xA; no bridge-group 200 source-learning&#xA; no bridge-group 200 unicast-flooding&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption vlan 100 mode ciphers aes-ccm&#xA; !&#xA; encryption mode ciphers aes-ccm&#xA; !&#xA; encryption vlan 200 mode ciphers aes-ccm&#xA; !&#xA; ssid WLAN-SSID&#xA; !&#xA; antenna gain -128&#xA; no dfs band block&#xA; stbc&#xA; beamform ofdm&#xA; mbssid&#xA; channel dfs&#xA; station-role root&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1.100&#xA; encapsulation dot1Q 100&#xA; no ip route-cache&#xA; bridge-group 100&#xA; bridge-group 100 subscriber-loop-control&#xA; bridge-group 100 spanning-disabled&#xA; bridge-group 100 block-unknown-source&#xA; no bridge-group 100 source-learning&#xA; no bridge-group 100 unicast-flooding&#xA;!&#xA;interface Dot11Radio1.200&#xA; encapsulation dot1Q 200&#xA; no ip route-cache&#xA; bridge-group 200&#xA; bridge-group 200 subscriber-loop-control&#xA; bridge-group 200 spanning-disabled&#xA; bridge-group 200 block-unknown-source&#xA; no bridge-group 200 source-learning&#xA; no bridge-group 200 unicast-flooding&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; no ip route-cache&#xA; duplex auto&#xA; speed auto&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; no bridge-group 1 source-learning&#xA;!&#xA;interface GigabitEthernet0.100&#xA; encapsulation dot1Q 100&#xA; no ip route-cache&#xA; bridge-group 100&#xA; bridge-group 100 spanning-disabled&#xA; no bridge-group 100 source-learning&#xA;!&#xA;interface GigabitEthernet0.200&#xA; encapsulation dot1Q 200&#xA; no ip route-cache&#xA; bridge-group 200&#xA; bridge-group 200 spanning-disabled&#xA; no bridge-group 200 source-learning&#xA;!&#xA;interface BVI1&#xA; ip address 172.0.10.5 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;interface BVI100&#xA; ip address dhcp&#xA; no ip route-cache&#xA;!&#xA;interface BVI200&#xA; ip address dhcp&#xA; no ip route-cache&#xA;!&#xA;ip default-gateway 172.0.10.250&#xA;ip forward-protocol nd&#xA;ip http server&#xA;ip http authentication aaa&#xA;no ip http secure-server&#xA;ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag&#xA;ip radius source-interface BVI1&#xA;!&#xA;radius-server host 172.0.0.30 key *******&#xA;!&#xA;bridge 1 route ip&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; transport input all&#xA;!&#xA;sntp broadcast client&#xA;end&#xA;&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="10260" LastEditorUserId="775" LastEditDate="2014-11-11T18:47:43.690" LastActivityDate="2014-12-11T19:13:47.800" Title="Configure Cisco Aironet 1600 AP with RADIUS and multiple VLANs" Tags="|cisco|wireless|vlan|radius|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12947" PostTypeId="2" ParentId="12945" CreationDate="2014-11-11T14:25:15.497" Score="2" Body="&lt;p&gt;One way to solve this problem is to change the AP connection to a layer 2 trunk with both VLANs on the trunk.   You can have two different SSIDs (one for users, one for guests) and each SSID is associated with a VLAN.  When a client connects to the Guest SSID, her data goes on VL 200; a regular user's data goes on VL 100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need separate DHCP scopes for each VLAN, either on the AP or a central DHCP server.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="775" LastEditDate="2014-11-11T18:45:37.427" LastActivityDate="2014-11-11T18:45:37.427" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="12950" PostTypeId="1" AcceptedAnswerId="12951" CreationDate="2014-11-11T17:37:03.583" Score="4" ViewCount="16924" Body="&lt;p&gt;In RIPv1 the packets are broadcasted out all ports with dest. IP 255.255.255.255.  In v2 they are multicasted with dest. IP 224.0.0.9. In Packet Tracer, this v2 packet is transmitted over all interfaces at the same time which looks like broadcasting with an IP of multicasting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When EIGRP uses multicasting it transmits packets to  only one dest. at a time. It also tries to send EIGRP packets to an undesired host (PC, server, etc.) which drops it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried this only on Cisco Packet Tracer. So can someone please explain me why RIPv2 packet transmission looks like broadcasting with destination IP address as 224.0.0.9?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="10317" LastEditorUserId="3191" LastEditDate="2014-11-11T18:21:02.467" LastActivityDate="2014-11-11T18:21:02.467" Title="RIP V2 multicasting looks as broadcasting at IP add 224.0.0.9" Tags="|multicast|eigrp|broadcast|rip|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="12951" PostTypeId="2" ParentId="12950" CreationDate="2014-11-11T17:57:47.610" Score="5" Body="&lt;p&gt;224.0.0.9 is a protocol standard multicast address, meaning that it is reserved for all RIPv2 speaking routers.  This reduces unnecessary overhead, and only speaks to RIPv2 routers, instead of a full broadcast.  Here is a portion from the RIPv2 RFC.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2453&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2453&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;4.5 Multicasting&lt;/p&gt;&#xA;&lt;p&gt;In order to reduce unnecessary load on those hosts which are not&lt;br /&gt;&#xA;listening to RIP-2 messages, an IP multicast address will be used for&#xA;periodic broadcasts.  The IP multicast address is 224.0.0.9.  Note&lt;br /&gt;&#xA;that IGMP is not needed since these are inter-router messages which&lt;br /&gt;&#xA;are not forwarded.&lt;/p&gt;&#xA;&lt;p&gt;On NBMA networks, unicast addressing may be used.  However, if a&lt;br /&gt;&#xA;response addressed to the RIP-2 multicast address is received, it&lt;br /&gt;&#xA;should be accepted.&lt;/p&gt;&#xA;&lt;p&gt;In order to maintain backwards compatibility, the use of the&lt;br /&gt;&#xA;multicast address will be configurable, as described in section 5.1.&lt;br /&gt;&#xA;If multicasting is used, it should be used on all interfaces which&lt;br /&gt;&#xA;support it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-11-11T17:57:47.610" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12952" PostTypeId="2" ParentId="12945" CreationDate="2014-11-11T18:58:31.023" Score="2" Body="&lt;p&gt;Normally you'd have two SSID's, one &quot;company&quot; SSID and one &quot;guest&quot; SSID that maps to their respective VLAN's. However, you could use something like NAC (Network Admission Control) and &quot;trick&quot; the RADIUS server to send an admission deny for clients authenticating with the guest credentials. Check out this doc from Cisco: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/access_point/15-3-3/configuration/guide/cg15-3-3/cg15-3-3-chap7-mbssid.html#pgfId-1069486&quot; rel=&quot;nofollow&quot; title=&quot;NAC Support for MBSSID&quot;&gt;NAC Support for MBSSID&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2014-11-11T18:58:31.023" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12954" PostTypeId="2" ParentId="12944" CreationDate="2014-11-11T19:19:23.050" Score="1" Body="&lt;p&gt;Presumably listening in promiscuous mode on the entire LAN segment, &lt;em&gt;without&lt;/em&gt; a filter, would produce too much traffic (otherwise, you could just do that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a hub &lt;a href=&quot;http://wiki.wireshark.org/HubReference&quot; rel=&quot;nofollow&quot;&gt;a real hub, not a &quot;switching hub&quot;&lt;/a&gt;, you could &lt;a href=&quot;http://wiki.wireshark.org/CaptureSetup/Ethernet#Capture_using_an_Ethernet_hub&quot; rel=&quot;nofollow&quot;&gt;plug the computer that keeps waking up into one port on the hub, and plug your machine running Wireshark into another port&lt;/a&gt;, so that you're physically sniffing only the traffic to and from that machine.  Then you could capture with &lt;em&gt;no&lt;/em&gt; filter and, while the machine is asleep, presumably still not see a lot of traffic.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2014-11-11T19:19:23.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12955" PostTypeId="1" CreationDate="2014-11-11T21:50:09.520" Score="1" ViewCount="64" Body="&lt;p&gt;I am curious, technically, how a cell phone number is linked with a provider. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I know the IMEI and CCID numbers were used when I activated my last phone, how does this link with my phone number?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea behind this, is that I have a phone number that I do not want to use at the moment.  I can cancel my current service, but I do not want to lose the number. I want it to be &quot;parked&quot;. There are sites that do this, such as &lt;a href=&quot;http://www.parkmycellphone.com&quot; rel=&quot;nofollow&quot;&gt;ParkMyCellPhone&lt;/a&gt;. What are the technical  aspects behind this? Could it be done using, say, Asterisk PBX?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if there is a better SE website for this please let me know I know it doesn't fit well here but I could not find a better option.&lt;/p&gt;&#xA;" OwnerUserId="10326" LastActivityDate="2014-11-11T21:50:09.520" Title="cell phone number and provider, how are they linked?" Tags="|design|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12956" PostTypeId="1" CreationDate="2014-11-11T23:58:44.030" Score="2" ViewCount="401" Body="&lt;p&gt;I am trying to configure 2 VLANS on my Cisco 871 router. VLAN 10 &amp;amp; VLAN 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 10 is for my VoIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 20 is for my Data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My physical connection is this: ISP &gt; Cisco 871 &gt; Unmanaged Switch &gt; All Devices&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have My ISP connected to FastEthernet 4 &amp;amp; I have my Unmanaged Switch connected to FastEthernet 1 .. All my network devices are connected to that unmanaged switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to do is tag all my cisco SPA IP phones with vlan 10. And have that port Fe1 do some sort of subinterface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how that would work...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can Anyone tell me what I'm trying to do is possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;amp; If so. How?&lt;/p&gt;&#xA;" OwnerUserId="10329" LastActivityDate="2014-12-12T19:35:07.457" Title="Cisco 871 Router VLAN Ideas" Tags="|vlan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12958" PostTypeId="2" ParentId="12944" CreationDate="2014-11-12T01:06:07.953" Score="0" Body="&lt;p&gt;A suggestion you might have already tried, but check to see if there is an updated driver for the NIC.  You might even want to get the driver from the NIC manufacturer, if the computer manufacturer does not have one.  A friend of my had problems with a new, out of the box Dell that was using an Intel NIC, and it was causing problems with bad packets until he got an updated driver installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't say which operating system you are using, but if it is Windows, check the Power Management setting for the NIC.  Make sure to uncheck the &quot;Allow this device to wake the computer&quot; (or check the box to make sure only a magic packet wakes it).&#xA;&lt;img src=&quot;https://i.stack.imgur.com/h1NYc.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="394" LastEditorUserId="394" LastEditDate="2014-11-12T01:21:25.917" LastActivityDate="2014-11-12T01:21:25.917" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12960" PostTypeId="2" ParentId="12942" CreationDate="2014-11-12T01:59:27.743" Score="3" Body="&lt;p&gt;There a few inconsistencies in your diagram / configurations. In the diagram it is AS 207, in the configuration it is AS 209 and in the final configuration it is AS 207.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the provider AS is the same in both MPLS networks then:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I'll call your original network CUG-1 and your new one CUG-2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There won't be any problems with advertising the routes to CUG-2 as&#xA;it will be in a different VPN to CUG-1. If you don't do any filtering&#xA;then the routes will be automatically advertised to CUG-1 via the&#xA;core (provided you aren't separating them with VRFs on that device). &#xA;You will need to rewrite the AS number before advertising it out to&#xA;the spokes from your core and vice versa.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you don't do this then:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Backup DC routes will be dropped by the CUG-1 PE router due to the BGP loop prevention mechanism i.e. routers in AS207 will see their own AS in the AS-Path ( e.g. AS 65002 -&gt; &lt;strong&gt;AS 207&lt;/strong&gt; -&gt; AS 65001 -&gt; &lt;strong&gt;AS 207&lt;/strong&gt; &lt;em&gt;DROP&lt;/em&gt;). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Spoke routes will be dropped by the CUG-2 PE router for the same reason (AS 65004 -&gt; &lt;strong&gt;AS 207&lt;/strong&gt; -&gt; AS 65001 -&gt; &lt;strong&gt;AS 207&lt;/strong&gt; &lt;em&gt;DROP&lt;/em&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you use BGP AS-override then the AS-Path will look something like this on e.g. Backup DC to Spoke Site: AS 65001 -&gt; AS 65001 -&gt; AS 65001 -&gt; AS 207 -&gt; AS 65004.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because you will be circumventing the BGP loop prevention mechanism, ensure that the Core DC is the only location that is peering with both CUGs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wrote this on mobile so let me know if it is a bit disjointed and I'll clean it up later.&lt;/p&gt;&#xA;" OwnerUserId="7730" LastActivityDate="2014-11-12T01:59:27.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12961" PostTypeId="1" CreationDate="2014-11-12T05:31:28.700" Score="5" ViewCount="231" Body="&lt;p&gt;i have googled about mac address spoofing.All I know is that MAC filtering is not much of a protection in wireless network.And in wired network it only works for routers that support MAC Filtering.Is there any other way to protect wired networks from MAC spoofing?&lt;/p&gt;&#xA;" OwnerUserId="10334" LastActivityDate="2014-11-12T22:30:06.113" Title="does MAC filtering provide security against MAC spoofing in wired networks?" Tags="|mac-address|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12962" PostTypeId="2" ParentId="12961" CreationDate="2014-11-12T08:17:13.347" Score="2" Body="&lt;p&gt;ARP inspection and/or IP Source Guard along with dot1x is a better option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simpler way is also port-security on interfaces and allow only one MAC per host. The initial MAC must be learnt upon first boot/ARP from the host subsequent MAC's are blocked and interface may be put into a error disable state.&lt;/p&gt;&#xA;" OwnerUserId="8175" LastActivityDate="2014-11-12T08:17:13.347" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12965" PostTypeId="1" AcceptedAnswerId="12966" CreationDate="2014-11-12T13:14:43.653" Score="1" ViewCount="3445" Body="&lt;p&gt;I am looking to make some speed performance tests. Normally our server responds within ~25 ms or so, but, I would somehow like to make it answer with delay. So basicly I would like to make some setting that increased the latency to f.ex 50ms, 100ms, 1000ms etc. Numbers do not have to be exactly 50ms,100ms etc, but in the same neighbourhood.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this somehow possible?&lt;/p&gt;&#xA;" OwnerUserId="10338" LastActivityDate="2020-11-05T03:09:21.197" Title="Can I somehow increase the latency / response time of a server for testing?" Tags="|latency|speed|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12966" PostTypeId="2" ParentId="12965" CreationDate="2014-11-12T13:45:20.487" Score="2" Body="&lt;p&gt;There are plenty of tools that will do this for you.  A quick google search revealed the following&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For linux&#xA;&lt;a href=&quot;http://www.linuxfoundation.org/collaborate/workgroups/networking/netem&quot; rel=&quot;nofollow&quot;&gt;http://www.linuxfoundation.org/collaborate/workgroups/networking/netem&lt;/a&gt;&#xA;&lt;a href=&quot;http://bencane.com/2012/07/16/tc-adding-simulated-network-latency-to-your-linux-server/&quot; rel=&quot;nofollow&quot;&gt;http://bencane.com/2012/07/16/tc-adding-simulated-network-latency-to-your-linux-server/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For MAC OS X&#xA;network link conditioner xcode (&lt;a href=&quot;http://nshipster.com/network-link-conditioner/&quot; rel=&quot;nofollow&quot;&gt;http://nshipster.com/network-link-conditioner/&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Windows&#xA;&lt;a href=&quot;http://jagt.github.io/clumsy/index.html&quot; rel=&quot;nofollow&quot;&gt;http://jagt.github.io/clumsy/index.html&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.softperfect.com/products/connectionemulator/&quot; rel=&quot;nofollow&quot;&gt;https://www.softperfect.com/products/connectionemulator/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Granted all those look like they need to run on the server themselves.  If you want something transparent you could try this &#xA;&lt;a href=&quot;http://wiki.scn.sap.com/wiki/display/Basis/WAN+Simulator+Live+CD&quot; rel=&quot;nofollow&quot;&gt;http://wiki.scn.sap.com/wiki/display/Basis/WAN+Simulator+Live+CD&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8265" LastActivityDate="2014-11-12T13:45:20.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12967" PostTypeId="1" AcceptedAnswerId="12974" CreationDate="2014-11-12T15:09:00.940" Score="3" ViewCount="534" Body="&lt;p&gt;I've ran into a strange problem at one of my clients. They use ShoreTel Sky cloud IP telephony service and use Cisco 7960 IP phones hooked up to an ASA 5520.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration is done through IP SLA tracking. The phones do work when the connection gets swapped from MAIN to BACKUP and I see routes 0.0.0.0 are pointed to the IP of BACKUP_ISP. So I would get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C BACKUP ISP IP 255.255.255.248 is directly connected, BACKIP_ISP&#xA;&#xA;C MAIN ISP IP 255.255.255.248 is directly connected, MAIN_ISP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this part when MAIN_ISP is up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S* 0.0.0.0 0.0.0.0 [1/0] via MAIN ISP IP, MAIN_ISP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and when BACKUP_ISP gets switched I see route is being updated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S* 0.0.0.0 0.0.0.0 [1/0] via BACKUP ISP IP, BACKUP_ISP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once the interfaces get switched back to MAIN_ISP everything does work the route &lt;code&gt;S*&lt;/code&gt; gets populated with MAIN_ISP in the routing table, WAN for workstations and phones is reachable, but when I dial after a swap from BACKUP_ISP to MAIN_ISP to any phones, the phone does dial out but we hear no voice, I do get the call to my cell phone, but I hear no voice on the IP phone or on receiving cell phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to resolve this problem as of right now is to disable/enable BACKUP interface to have &lt;code&gt;C BACKUP_ISP IP 255.255.255.248 is directly connected, BACKIP_ISP&lt;/code&gt; removed and then readded. This seems to work, we also need to reinitialize the phones, meaning since they are PoE we need to unplug/plug patch cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please if anyone knows what can I do about this or what direction to look into, I would really appreciate. The main issue here that on the network side I have captured the traffic from all conditions and there is no difference whatsoever when phones work and when they do not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="10341" LastEditorUserId="3191" LastEditDate="2014-11-13T22:43:02.157" LastActivityDate="2018-06-18T01:21:03.530" Title="Problem with IP phones after ISP failover change" Tags="|cisco-asa|troubleshooting|cisco-7900-ip-phones|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12970" PostTypeId="2" ParentId="12956" CreationDate="2014-11-12T19:07:26.080" Score="2" Body="&lt;p&gt;The switch as mentioned earlier has to be vlan aware, and then you would configure the connection to the router as a trunk port, add both vlans to that switch and encapsulate them with 802.1q, make the data traffic native for vlan 20, and mark the phone traffic with vlan id 10, you can buy a cheap Cisco 2950 if bandwidth does not need to be more then 100mbps, if your internet speed is slower you may also want to configure QOS with a service policy or such.&lt;/p&gt;&#xA;" OwnerUserId="10346" LastActivityDate="2014-11-12T19:07:26.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12972" PostTypeId="1" CreationDate="2014-11-12T20:02:46.533" Score="1" ViewCount="104" Body="&lt;p&gt;Suppose one wishes to provide guests with access to the Internet (and &lt;em&gt;only&lt;/em&gt; the Internet) over one's network.  For obvious reasons, switch ports will be assigned to a private VLAN created specifically for that purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It strikes me that one can either place the hosts in a shared subnet (isolating between them at L2 only); or else place each of them in their own subnet (thereby also isolating at L3)&amp;mdash;this latter case effectively creates point-to-point links between each guest host and the gateway, which seems more rational to me because it more accurately reflects the logical design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However such point-to-point links would traditionally require a subnet with at least a /30 prefix (in order to address both the guest and the gateway as well as provide network and broadcast addresses for the subnet itself); applying RFC 3021, one could use /31 prefixes&amp;mdash;but this would still require a virtual interface on the router for each guest and consume 2 addresses per guest host: not a particularly efficient use of resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it has struck me that one solution could be to use PPPoE between the guest host and the router&amp;hellip;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is this sensible?  Have I overlooked any pitfalls, or more appropriate solutions?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can DHCP configure a client expecting IPoE to use IPoPPPoE instead, or must the guest host OS be prepared for PPPoE?  If the latter, do popular workstation OSes (Windows/Linux/OSX) attempt PPPoE Discovery if DHCP fails?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the router is also performing IP-masquerading (i.e. many-to-one NAT) it strikes me that every PPPoE host &lt;em&gt;could&lt;/em&gt; in fact be assigned the router's egress address: the NAT need merely map upstream ports to PPP interfaces (rather than IP addresses); this would provide the &quot;advantage&quot; that the hosts would then be configured with their actually visible external address.  Seems pretty ridiculous to me, but is it nevertheless possible?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4911" LastActivityDate="2014-12-12T23:42:44.823" Title="Addressing guest hosts" Tags="|nat|subnet|dhcp|pppoe|private-vlan|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="12973" PostTypeId="1" AcceptedAnswerId="16837" CreationDate="2014-11-12T20:20:56.497" Score="3" ViewCount="2235" Body="&lt;p&gt;I would like to do QoS based on port-based VLAN traffic on a Brocade VDX67xx series router running NOS 4.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just need a way to say, &quot;traffic on VLAN 100 has a higher priority ingress/egress than vlan 200.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not seeing an obvious way to do this. I know in the past, on Cisco devices, you can assign a priority to a VLAN interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've combed google, and the manual and must be missing something. The &lt;code&gt;qos&lt;/code&gt; command in the configuration doesn't seem like anything I need either.&lt;/p&gt;&#xA;" OwnerUserId="10240" LastEditorUserId="8499" LastEditDate="2016-03-19T04:52:33.720" LastActivityDate="2016-05-18T06:11:32.497" Title="Configuring VLAN-based priority/QOS on Brocade NOS?" Tags="|routing|vlan|qos|brocade|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12974" PostTypeId="2" ParentId="12967" CreationDate="2014-11-12T20:43:13.397" Score="4" Body="&lt;p&gt;From your description of the issue, this could be related to the UDP connections not being torn down from the Backup interface once the Main interface becomes available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;timeout floating-conn 0:01:00    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This specifies the timeout to be one minute before the ASA tears down the connection once a more preferred route is added to the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The assumption here is that when you manually down the interface, the connections will be torn down via brute force. This should be a more elegant and automated approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This command was introduced in later code versions so you may have to upgrade your code to use this feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Credit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113592-udp-traffic-fails-00.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Link explaining issue in detail&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2231" LastEditorUserId="2231" LastEditDate="2014-11-13T21:26:51.593" LastActivityDate="2014-11-13T21:26:51.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12975" PostTypeId="1" CreationDate="2014-11-12T21:51:07.750" Score="3" ViewCount="1592" Body="&lt;p&gt;I am currently doing an assignment that requires us to generate ICMP packet with various types and codes. I have consulted the RFCs as well as various other place. Many of the types and codes I get make perfect sense; except for this one. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I somehow generated a packet that had a type of 8 (echo request) and a code of 9. The problem is that type 8 ICMP can only have a single code of 0. See the packet below as a hex dump from wireshark:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;0000   a8 39 44 fa 14 e0 94 de 80 6b ab 74 08 00 45 00&#xA;0010   00 94 92 7b 40 00 28 01 fb 61 c0 a8 01 40 68 83&#xA;0020   9a 20 08 09 ac c9 4a 06 01 27 00 00 00 00 00 00&#xA;0030   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0040   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0050   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0060   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0070   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0080   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0090   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;00a0   00 00&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reply can also be seen in the next hex dump. It is also strange because it is an ICMP echo reply with a code of 9. An ICMP echo can only have a code of 0.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;0000   94 de 80 6b ab 74 a8 39 44 fa 14 e0 08 00 45 00&#xA;0010   00 94 98 af 00 00 39 01 24 2e 68 83 9a 20 c0 a8&#xA;0020   01 40 00 09 b4 c9 4a 06 01 27 00 00 00 00 00 00&#xA;0030   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0040   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0050   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0060   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0070   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0080   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;0090   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00&#xA;00a0   00 00&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The question I am asking is how is this possible, what does code 9 mean? Can it be ignored or would it be worth investigating further?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read in a previous answer that when ICMP tunneling comes in to play the data included in an echo is arbitrary, can this carry over to the header?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="10348" LastActivityDate="2015-02-12T08:47:47.330" Title="What Does ICMP Code 9 Mean For a Type 8 Packet?" Tags="|wireshark|packet-analysis|ping|icmp|" AnswerCount="1" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12978" PostTypeId="2" ParentId="12961" CreationDate="2014-11-12T22:30:06.113" Score="4" Body="&lt;p&gt;To answer the primary question: MAC filters provide absolutely &lt;em&gt;zero&lt;/em&gt; security. A user can set their MAC to whatever they want -- and many NICs have a well documented eeprom interface/structure with tools to change them permanently.  Wired networks are no harder to &quot;monitor&quot; for allowed MACs to spoof than wireless, 'tho one does have to gain physical access. (but they'll going to have that access anyway if they're trying this.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-11-12T22:30:06.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12979" PostTypeId="2" ParentId="12972" CreationDate="2014-11-12T22:48:39.850" Score="2" Body="&lt;p&gt;Separate private VLAN that has it's own L3 addressing scheme is the option that would make the most sense.  Or you can get fancy and use vrf's.  Simple is better, do not make things complicated when you do not have to because it makes troubleshooting a nightmare.&lt;/p&gt;&#xA;" OwnerUserId="10350" LastActivityDate="2014-11-12T22:48:39.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12980" PostTypeId="1" AcceptedAnswerId="12984" CreationDate="2014-11-12T23:08:14.300" Score="3" ViewCount="1712" Body="&lt;p&gt;I am setting the BGP MED value on some out bound routing advertisements but I can't find anyway to check the  MED on my advertised routes on Cisco IOS XR, to verify my configuration is correct (in this particular case the routes are sent to an eBGP peer, I am not able to see or ask how they are receiving the routes):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;prefix-set MED-0&#xA; 1.1.1.1/30,&#xA; 1.1.2.1/29&#xA;end-set&#xA;&#xA;prefix-set MED-1000&#xA; 2.2.2.1/29 le 32,&#xA; 2.2.2.2/29 le 32&#xA;end-set&#xA;&#xA;route-policy MED-OUT&#xA;  if destination in MED-1000 then&#xA;    set med 1000&#xA;    pass&#xA;  elseif destination in MED-0 then&#xA;    pass&#xA;  else&#xA;    drop&#xA;  endif&#xA;end-policy&#xA;&#xA;router bgp 12345&#xA; vrf A-VRF&#xA; rd 12345:55555&#xA;&#xA; address-family ipv4 unicast&#xA;&#xA; neighbor 5.5.5.5&#xA;   remote-as 55555&#xA;   description External AS Peer&#xA;   address-family ipv4 unicast&#xA;    route-policy MY-IN-POLICY in&#xA;    route-policy MED-OUT out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the output I have which is not telling me the MEDs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:router1#show bgp vrf A-VRF neighbor 5.5.5.5 advertised-routes&#xA;Wed Nov 12 22:59:38.982 UTC&#xA;Network            Next Hop        From            AS Path&#xA;Route Distinguisher: 12345:55555 (default for vrf A-VRF)&#xA;1.1.1.1/30         5.5.5.6         10.0.0.5        i&#xA;1.1.2.1/29         5.5.5.6         10.0.0.5        i&#xA;2.2.2.1/30         5.5.5.6         10.0.0.5        i&#xA;2.2.2.2/29         5.5.5.6         10.0.0.5        i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="253" LastActivityDate="2018-07-26T08:09:57.403" Title="BGP MED On IOS XR" Tags="|bgp|cisco-ios-xr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12984" PostTypeId="2" ParentId="12980" CreationDate="2014-11-13T04:08:08.403" Score="4" Body="&lt;p&gt;Unfortunately on IOS the show advertised command has always showed the attributes of the route pre policy. It will drop routes that were denied but the attributes are the original ones. Instead I recommend setting up a bgp session to another one of your devices, turning on soft reconfig inbound and denying all routes. This will let you look at the attributes of the sent routes.  You could also try a debug, but that might be a lot to go through.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2014-11-13T04:08:08.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12986" PostTypeId="2" ParentId="7976" CreationDate="2014-11-13T08:01:03.013" Score="1" Body="&lt;p&gt;Citrix NetScaler will do this &lt;strong&gt;on explicit demand only&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs.citrix.com/en-us/netscaler/10-5/ns-tmg-wrapper-10-con/ns-ssl-wrapper-con-10/ns-ssl-customize-ssl-config-con/ns-ssl-manage-server-auth-tsk.html&quot; rel=&quot;nofollow&quot;&gt;http://docs.citrix.com/en-us/netscaler/10-5/ns-tmg-wrapper-10-con/ns-ssl-wrapper-con-10/ns-ssl-customize-ssl-config-con/ns-ssl-manage-server-auth-tsk.html&lt;/a&gt; (Archived &lt;a href=&quot;https://archive.is/13LpR&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the appliance does not usually authenticate the Web server's certificate. [...]&lt;br&gt;&#xA;  To authenticate the server, you must first enable server authentication and then bind the certificate of the CA that signed the server's certificate to the SSL service on the NetScaler. When binding the certificate, you must specify the bind as CA option.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="10355" LastEditorUserId="10355" LastEditDate="2015-09-07T06:59:38.747" LastActivityDate="2015-09-07T06:59:38.747" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12989" PostTypeId="2" ParentId="12565" CreationDate="2014-11-13T12:47:37.787" Score="2" Body="&lt;p&gt;Can not be done with vanilla TCP right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But: Something called &quot;Multipath TCP&quot; is being developed with the explicit aim of &quot;Decoupling TCP from IP&quot;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Multipath_TCP&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Multipath_TCP&lt;/a&gt;  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://multipath-tcp.org/&quot; rel=&quot;nofollow&quot;&gt;http://multipath-tcp.org/&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;If you're really, really curious: Here's a 185 page presentation: &lt;a href=&quot;http://multipath-tcp.org/data/MultipathTCP-netsys.pdf&quot; rel=&quot;nofollow&quot;&gt;http://multipath-tcp.org/data/MultipathTCP-netsys.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10355" LastActivityDate="2014-11-13T12:47:37.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12991" PostTypeId="2" ParentId="12925" CreationDate="2014-11-13T16:27:50.660" Score="1" Body="&lt;p&gt;First off, recognize that TCP/IP Illustrated...while a great book (I have a copy as well), is quite dated at this point.  In modern networking, talking about IPv4 address classes as anything other than an historical footnote is going to get you into trouble really quickly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, think of the example this way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A site is allocated 128.32.0.0/16, and the site administrator assigns network numbers* within the site based on a 24-bit mask, or 255.255.255.0 in dotted-quad notation.  Note that the internal networks need not all use the same network mask length, but we'll stick with them for this example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A 24-bit netmask includes the first 3 octets in dotted-quad notation in the network portion of the IP address, so any set of IP addresses that have the first &lt;em&gt;3&lt;/em&gt; octets in common are part of the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that 128.32.0.x is a network, 128.32.1.x is a network, 128.32.2.x is a network, and so on, because all IP addresses in each network with different values of &quot;x&quot; still have the first 3 octets in common which is what the 24-bit netmask signifies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that, in the example, 128.32.0.0/16 is never actually assigned as a /16 network to any network segment, only various networks with 24-bit network masks are.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You'll note that I avoid the term subnet. I believe that term should be retired from usage in modern networking discussion.  I don't think its really an accurate description of what is happening anymore, as its original definition was a subnetwork of a classful IP network address.  In modern days we have networks, full stop.  Those networks can have any network mask that is appropriate and a smaller network(s) allocated from a larger allocation is not necessarily hierarchically connected to the larger allocation from a network topological point of view.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="97" LastActivityDate="2014-11-13T16:27:50.660" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="12995" PostTypeId="1" CreationDate="2014-11-13T19:25:28.120" Score="3" ViewCount="4886" Body="&lt;p&gt;I need to find out what port a MAC address is connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given a Cisco 3750, I can do a&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show mac address-table dynamic&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and see all the mac addresses that the switch has seen frames travelling to and from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I have a physical machine hosting some vms. That physical machine has two nics teamed and they trunk to this Cisco 3750. While the vms are actively communicating, the host machines aren't sending data so their macs aren't in the table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know from my sh mac address-table that the ports on the switch are 1/0/15 and 2/0/15 (it's a stack of two) because I can see the macs of the vms in the address table. But I want to know which of the switch ports is physically connected to eth0 and eth1 on the server. I know the macs of the physical nics. I just can't work out how to arp ping them from the switch and get some sort of reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should add that physically tracing the cables is out of the question and I need to do this remotely. I'll be putting the data in a visio chart.&lt;/p&gt;&#xA;" OwnerUserId="106" LastEditorUserId="33" LastEditDate="2015-07-03T18:18:21.397" LastActivityDate="2015-07-03T18:18:21.397" Title="Ping a mac address to get it to reply and update mac address-table" Tags="|mac-address|arp|ping|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="12996" PostTypeId="2" ParentId="12995" CreationDate="2014-11-13T19:34:30.693" Score="1" Body="&lt;p&gt;This depends on what OS the VM's are running. If they're running Linux or some other UNIX variant you can use &lt;code&gt;arping&lt;/code&gt; to accomplish this. If they're running Windows (XP/7/8), whenever a new IP address is added to an interface, Windows will send gratuitous ARPs for that IP address for duplicate address detection by default, so you may be able to get the MAC address that way.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2014-11-13T19:34:30.693" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="12997" PostTypeId="1" AcceptedAnswerId="12998" CreationDate="2014-11-13T19:46:14.857" Score="5" ViewCount="274" Body="&lt;p&gt;I have a 2901 between a network and the internet. It shipped with the routing defined as follows. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using the interface like this instead of an IP struck me odd when it came in, but we didn't change it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've been having mallocfail errors, which I traced back to the &quot;IP ARP Adjacency&quot; process. A show arp comes back with 60,000+ entries. That would explain the memory consumption and poor performance but I'm not 100% sure as to &lt;em&gt;why&lt;/em&gt; this is happening.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen a few references that if you use an interface name it results in needing to resolve every IP to the MAC to use for the next hop. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that what is happening here? How can I tell? &lt;/p&gt;&#xA;" OwnerUserId="657" LastEditorUserId="775" LastEditDate="2014-11-14T14:05:17.627" LastActivityDate="2014-11-14T17:29:09.867" Title="malloc failures and ARP packed on a Cisco 2901" Tags="|cisco|routing|ethernet|cisco-ios|arp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="12998" PostTypeId="2" ParentId="12997" CreationDate="2014-11-13T20:15:26.923" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;show arp comes back with 60,000+ entries. That would explain the memory consumption and poor performance but I'm not 100% sure as to why this is happening.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you configured &lt;code&gt;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1&lt;/code&gt;, you effectively told the router that you have directly connected the entire internet to GigabitEthernet 0/1.  Your router believes you, so it must send an ARP request for each new destination IP address following that default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the next hop router is configured with &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13718-5.html&quot; rel=&quot;nofollow&quot;&gt;proxy-ARP&lt;/a&gt;   (default config on Cisco routers), then this actually &quot;works&quot; until one of the routers hits resource exhaustion as yours did.  Both routers could run out of CPU (from ARP processing), but only your router could hit a memory limitation due to the massive ARP cache.  I normally disable proxy-ARP on interfaces to ensure my routers won't participate in misconfigurations like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simple solution on your side is configuring an explicit IP next hop instead of pointing out the interface.  If you had a masochistic streak, you could leave the route as-is and play ARP timeout games to stave off memory exhaustion, but one should never play games like that on production networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Default routing to an ethernet interface is bad news; every network engineer makes this mistake once.  I learned the same way myself.  If you're really unfortunate, the reason your ARP table is full is because something (ie a virus) decides to scan the whole internet for victims.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="3191" LastEditDate="2014-11-14T17:29:09.867" LastActivityDate="2014-11-14T17:29:09.867" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="13003" PostTypeId="1" CreationDate="2014-11-14T01:41:17.287" Score="5" ViewCount="1717" Body="&lt;p&gt;How can I SSH to my Servers from Cisco IOS. My only current access to router is via console port.&lt;/p&gt;&#xA;" OwnerUserId="10371" LastActivityDate="2015-09-29T18:09:33.823" Title="Consoled into Nexus 5596 and can't SSH or Ping directly attached servers - No route to host" Tags="|cisco|cisco-ios|cisco-nexus-5k|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13008" PostTypeId="1" AcceptedAnswerId="13011" CreationDate="2014-11-14T07:48:37.460" Score="3" ViewCount="2218" Body="&lt;p&gt;I have a Provantage FS526T; my understanding is that all traffic can be captured in this sort of setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Device -&gt; HUB -&gt; FS526T Switch -&gt; LAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or if the Switch CAM table is flooded, so it starts acting like a HUB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if the LAN is not being used while the HUB is connected, is there any other way to capture traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. finding out information about the VLANS being used and then somehow joining a VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies if the question is somewhat vague.&lt;/p&gt;&#xA;" OwnerUserId="10187" LastEditorUserId="775" LastEditDate="2015-02-01T06:37:31.477" LastActivityDate="2015-02-01T06:37:31.477" Title="How can all network traffic be captured on a switched network?" Tags="|switch|ethernet|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13011" PostTypeId="2" ParentId="13008" CreationDate="2014-11-14T09:38:43.620" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a monitoring port on the switch (if the switch supports this, check out the &lt;a href=&quot;http://wiki.wireshark.org/CaptureSetup/Ethernet&quot; rel=&quot;nofollow&quot;&gt;Wireshark wiki&lt;/a&gt; for more details). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_tap&quot; rel=&quot;nofollow&quot;&gt;network TAP&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2014-11-14T09:38:43.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13012" PostTypeId="1" CreationDate="2014-11-14T10:29:53.900" Score="30" ViewCount="74132" Body="&lt;p&gt;Say the switch table is empty. If computer A sends a frame destined to computer B, the switch will broadcast asking who has the MAC address of B. What if C suddenly sends a frame to A? What is the mechanism so the switch doesn't mistakenly think computer C is computer B? Is it that it remembers the MAC address of the destination desired by computer A, and when C tries to get to A it also contains its own MAC address and the switch sees it isn't the same destination as computer A wanted?&lt;/p&gt;&#xA;&lt;p&gt;Basically I'm asking, when a switch floods for an unknown MAC address for a request sent by host A, how does it know that the destination is responding to host A or if some other host just happens to be transmitting to A?&lt;/p&gt;&#xA;" OwnerUserId="8025" LastEditorUserId="43734" LastEditDate="2023-09-01T15:53:45.330" LastActivityDate="2023-09-01T15:53:45.330" Title="How does a switch learn a switch table?" Tags="|switch|ethernet|mac-address|arp|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="13013" PostTypeId="2" ParentId="13012" CreationDate="2014-11-14T11:49:28.117" Score="-3" Body="&lt;p&gt;Its not called switch table ; its MAC table. Now consider that MAC table is empty. When A tries to send a packet to B; the packet contains the MAC address of A and B. The switch updates MAC address of A in MAC table. Now since it doesn't know the port to which B is connected, so it broadcasts &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_Resolution_Protocol&quot; rel=&quot;nofollow&quot;&gt;ARP&lt;/a&gt; packet at all of its ports and waits for all hosts to reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now at the same time if C tries to send a packet to A, It extracts the MAC address of C from that packet and stores it in MAC table. Now since the MAC address of is already present in MAC table, so it knows to which port A is connected. Remember Data packets contains MAC address of both source and destination. Hence the MAC address of B &amp;amp; C are different. So the switch does not get confused. Now switch forwards the packet from C to A (Given that both are present in same VLAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To send the packet from A to B, it waits till B responds to ARP packet sent by switch. When it receives response from B, it updates the MAC address of B in its MAC table. Then finally the packet is forwarded to B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence the switch does not get confused as the data packets (tcp/udp) contains both source and destination MAC address. And your switch won't forward a packet on an interface whose end host MAC address is not known to switch. It has to wait till the end host replies to ARP broadcast sent by switch.&lt;/p&gt;&#xA;" OwnerUserId="10317" LastActivityDate="2014-11-14T11:49:28.117" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13014" PostTypeId="2" ParentId="13012" CreationDate="2014-11-14T14:59:42.717" Score="50" Body="&lt;p&gt;Layer 2 switches (bridges) have a MAC address table that contains a MAC address and physical port number.  Switches follow this simple algorithm for forwarding frames:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When a frame is received, the switch compares the SOURCE MAC address to the MAC address table.  If the SOURCE is unknown, the switch adds it to the table along with the physical port number the frame was received on.  In this way, the switch learns the MAC address and physical connection port of every transmitting device.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The switch then compares the DESTINATION MAC address with the table.  If there is an entry, the switch forwards the frame out the associated physical port.  If there is no entry, the switch sends the frame out all its physical ports, except the physical port that the frame was received on (Flooding). If the DESTINATION is on the same port as the SOURCE (if they're both on the same segment), the switch will not forward the frame.)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Note that the switch does not learn the destination MAC until it receives a frame from that device.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2021-11-18T20:42:14.590" LastActivityDate="2021-11-18T20:42:14.590" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="13015" PostTypeId="2" ParentId="13008" CreationDate="2014-11-14T17:16:16.467" Score="3" Body="&lt;p&gt;Cisco switches use SPAN (Switched Port Analyzer) in which you can use commands as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)# monitor session 1 source interface fastEthernet0/1&#xA;Switch(config)# monitor session 1 destination interface fastEthernet0/10&#xA;Switch(config)# end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are often limitations as to how many ports can be &quot;monitored&quot; simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be better off throwing a HUB like you mentioned, but you might as well get smart and learn a better way to do it&lt;/p&gt;&#xA;" OwnerUserId="2477" LastActivityDate="2014-11-14T17:16:16.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13016" PostTypeId="1" AcceptedAnswerId="13179" CreationDate="2014-11-14T17:31:59.023" Score="0" ViewCount="1301" Body="&lt;p&gt;I have a Windows webserver which resides inside a LAN 172.20.10.0/24. I want my webserver to serve IIS pages over the internet behind a D-Link DFL-860e NetDefend Firewall, through my company's public IP address and a web browser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way it works now (see Steps done below), &lt;strong&gt;I can reach my webserver&lt;/strong&gt; through my public IP address. However, when I try to use a web app like &lt;em&gt;[public-ip/app_name]&lt;/em&gt;, there's no response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Product manual has been of great help so far, but I haven't able to figure out this bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps done so far:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configured a SAT rule like this:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Interface: any as Source, wan1 as Destination.&lt;/li&gt;&#xA;&lt;li&gt;Network: all-nets as Source, my_public_ip as Destination&lt;/li&gt;&#xA;&lt;li&gt;Service is http-in&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Added a NAT rule with the same source and destination interfaces and networks and same service.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I managed to make it work through a simple Windows Server 2003 Internet Connection Sharing (ICS) configuration, but now we need to replace said server with this new Firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connection from my LAN devices to the Internet works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time.&lt;/p&gt;&#xA;" OwnerUserId="10380" LastActivityDate="2014-11-22T20:01:22.620" Title="Web apps through D-Link DFL-860e NetDefend Firewall" Tags="|nat|" AnswerCount="1" CommentCount="0" ClosedDate="2019-05-28T18:54:42.747" ContentLicense="CC BY-SA 3.0" />
  <row Id="13021" PostTypeId="1" CreationDate="2014-11-15T05:45:33.993" Score="0" ViewCount="808" Body="&lt;p&gt;I'm attempting to forward remote desktop (3389) to a PC inside my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made it work, but I'm curious if I'm doing it right.  It doesn't seem natural to me.  I'm using ASDM visual setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NAT rule itself is on the INSIDE interface.  The &quot;original&quot; is &quot;internal_ip:3389&quot; and the &quot;translated&quot; is &quot;external_ip:3389&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Isn't the &quot;original&quot; (incoming packets from internet) going to &quot;external_ip:3389&quot;?  The &quot;translated&quot; should be the internal PC.  Basically the flip-flop of what I said above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if I create the NAT rule on the OUTSIDE interface like such, it doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shouldn't it work on either since NAT and UN-NAT?&lt;/p&gt;&#xA;" OwnerDisplayName="user10389" LastActivityDate="2015-05-15T05:51:00.340" Title="Am I using NAT correctly on my Cisco ASA 5505?" Tags="|cisco|routing|nat|" AnswerCount="1" CommentCount="1" ClosedDate="2019-06-22T00:14:41.887" ContentLicense="CC BY-SA 3.0" />
  <row Id="13026" PostTypeId="2" ParentId="13012" CreationDate="2014-11-15T18:56:30.050" Score="5" Body="&lt;p&gt;Your question presumes that the switch is involved in, or is aware of, the communication/conversation between two hosts (Is this a conversation between A and B or between A and C?). The switch isn't involved in the communication/conversation between two hosts. It simply knows (or learns) which MAC address is associated with which port and forwards (or switches) traffic destined for a particular MAC address to the associated port (once it has learned which port is associated with the MAC address), regardless of whether the source is B, or C or any other host connected to any other switch port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches work at layer 2. Session management is the responsibility of higher layers.&lt;/p&gt;&#xA;" OwnerUserId="2115" LastActivityDate="2014-11-15T18:56:30.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13027" PostTypeId="1" AcceptedAnswerId="13028" CreationDate="2014-11-16T14:01:49.950" Score="-1" ViewCount="275" Body="&lt;p&gt;If I have UDP streaming connection between two machines in the internet (with fixed IPs). Will I receive packets out-of-order?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that out-of-order packets happens because some packets might be re-transmitted (as in TCP). So I think that since both ends have fixed IPs, so packets will flow on the same path (at least for enough long time).&lt;/p&gt;&#xA;" OwnerUserId="10403" LastActivityDate="2014-11-16T14:25:59.913" Title="UDP out-of-order on the same route" Tags="|routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13028" PostTypeId="2" ParentId="13027" CreationDate="2014-11-16T14:25:59.913" Score="4" Body="&lt;p&gt;There's no guarantee that packets are received in order when using UDP, so yes, you can receive them out of order. Retransmission isn't available in UDP unlike you mentioned, this could be done on application level though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, it may very well be possible that routers on the path between two endpoints loadbalance packets over various links, so you can't assume that they use the same path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really care about packet ordering, UDP isn't the appropriate protocol.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-11-16T14:25:59.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13031" PostTypeId="2" ParentId="13021" CreationDate="2014-11-16T17:22:43.830" Score="2" Body="&lt;p&gt;Given what you said, I think you are forgetting to consider the direction of traffic.  Lets start with a high level view of what a TCP connection looks like, then we'll talk about how it applies to NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume my computer has the IP 10.1.1.1, and I am speaking to a server with the IP 3.3.3.3.  Let's also say that I am making a WEB/HTTP request, which runs on TCP port 80.  On the wire, the picket will have these attributes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source IP       : 10.1.1.1&#xA;Source Port     : 1111 (randomly chosen)&#xA;Destination IP  : 3.3.3.3&#xA;Destination Port: 80 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When this packet makes it to the target server, and that server generates a response, the Source and Destination will be flipped.  That return traffic will therefore have the following attributes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source IP       : 3.3.3.3&#xA;Source Port     : 80&#xA;Destination IP  : 10.1.1.1&#xA;Destination Port: 1111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With that established, lets see how NAT affects this packet.  In particular, notice that the Source IP is a Private IP, and therefore must be NAT'ed when speaking on the internet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we would want, then, is for NAT to &lt;strong&gt;change the Source IP on the Outbound traffic&lt;/strong&gt; and &lt;strong&gt;change the Destination IP on the Return traffic&lt;/strong&gt;.  If NAT were to change the Destination IP on Outbound traffic or the Source on the Return traffic, the communication would never work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now in your particular case, you want inbound traffic &lt;em&gt;destined to your public IP address&lt;/em&gt; to be forwarded through your NAT device to a particular host on your internal network.  So using the packet attributes above, you want a packet that looks like this to be NATed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source IP       : 9.9.9.9       (some IP address out there on the internet)&#xA;Source Port     : 9999          (randomly chosen)&#xA;Destination IP  : 2.2.2.2       (your External_IP)&#xA;Destination Port: 3389          (Remote Desktop Port)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you want it to be NAT'ed to the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source IP       : 9.9.9.9       (unchanged)&#xA;Source Port     : 9999          (unchanged)&#xA;Destination IP  : 192.168.0.20  (your Internal_IP)&#xA;Destination Port: 3389          (Remote Desktop Port)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice, you are intending to change the &lt;strong&gt;destination IP&lt;/strong&gt;, and not the &lt;strong&gt;source&lt;/strong&gt;.  But remember, what we are looking at here is the attributes for the incoming packet, &lt;em&gt;not those of the return traffic&lt;/em&gt;.  If we were to map out the Return traffic, we would end up with the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source IP       : 192.168.0.20  (your Internal_IP)&#xA;Source Port     : 3389          (Remote Desktop Port)  &#xA;Destination IP  : 9.9.9.9       (unchanged)&#xA;Destination Port: 9999          (unchanged)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;On the &lt;em&gt;Return traffic&lt;/em&gt;, you are intending to NAT the &lt;em&gt;Source&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now, we can finally get back to your original question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Isn't the &quot;original&quot; (incoming packets from internet) going to&#xA;  &quot;external_ip:3389&quot;? The &quot;translated&quot; should be the internal PC.&#xA;  Basically the flip-flop of what I said above.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;But if I create the NAT rule on the OUTSIDE interface like such, it&#xA;  doesn't work.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Shouldn't it work on either since NAT and UN-NAT?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're firewall is being told to NAT the &lt;strong&gt;Source&lt;/strong&gt; from &lt;code&gt;internal_ip:3389&lt;/code&gt; to &lt;code&gt;external_ip:3389&lt;/code&gt;.  This is only the Source when the traffic is arriving on your Firewall's Inside interface -- which is to say, when your Firewall is seeing the &lt;strong&gt;return traffic&lt;/strong&gt; of the RDP connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you create the NAT rule on the OUTSIDE interface, it is &lt;strong&gt;still looking at the Source&lt;/strong&gt; of the packet -- which is why the connection doesn't work, because you don't actually want to change the Source of the incoming packet, you want to change the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By configuring the NAT on the INSIDE interface, you are telling your Firewall that when the Source IP:Port is &lt;code&gt;internal_:3389&lt;/code&gt;, change it to &lt;code&gt;external_ip:3389&lt;/code&gt;.  Lucky for you, your Firewall is automatically doing the inverse:  changing the Destination IP:Port from &lt;code&gt;external_ip:3389&lt;/code&gt; to &lt;code&gt;internal_ip:3389&lt;/code&gt; when it sees it on the Outside interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And lastly, as you've already found out, No, the NAT statement does not work when configured on either interface.  The particular NAT statement is looking specifically at the Source, and therefore must be configured from the perspective of when the Source needs to be changed.  If you configure it from the Outside interface, the changing the Source will not permit the traffic to get through your NAT and to your internal host.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-11-16T17:22:43.830" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13032" PostTypeId="2" ParentId="12449" CreationDate="2014-11-16T17:24:01.707" Score="0" Body="&lt;p&gt;As mentioned by another responder, this is poor design. I suggest NATing on Router1 and using static routes on Routers 0 and 2 as the best way to get around this.&lt;/p&gt;&#xA;" OwnerUserId="10407" LastActivityDate="2014-11-16T17:24:01.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13033" PostTypeId="2" ParentId="11336" CreationDate="2014-11-16T19:07:37.267" Score="0" Body="&lt;p&gt;If you try to take the route of DHCPv6, chances are you will have a similar problem with the addresses assigned via DHCP reservations. When we turned on DHCPv6, we would get the reserved IPv6 address we gave it, another randomly assigned address from the reservation that would keep returning no matter how many we deleted it, and a link local address. All of these addresses would confuse the routing table, and our network clients would not be able to find the proper route to try and pass information anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have found that if you remove DHCPv6 all together and statically assign IP addresses to everything, your network will know where to go, no matter what the link local address turns out to be. That is where our network is now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a method that we plan to look into within the next few months called SLACC that may also solve your problem. SLACC seems to do the same functionality that DHCP does for v4, but for v6. &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=2154680&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscopress.com/articles/article.asp?p=2154680&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this was helpful!&lt;/p&gt;&#xA;" OwnerUserId="10409" LastActivityDate="2014-11-16T19:07:37.267" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13034" PostTypeId="1" AcceptedAnswerId="13039" CreationDate="2014-11-16T19:48:27.587" Score="3" ViewCount="464" Body="&lt;p&gt;The OUTSIDE interface on my firewall appliance is assigned IP address .2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router it's connected to (ISP) is .1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keeping in mind Proxy ARP was turned on (don't recall doing that, but it was), I had accidentally mis-configured the interface on my firewall (the .2 device) as 255.255.255.248 instead of .240.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would limit the range of usable IPs from .0-15 to .0-7&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, all my traffic (and NAT) was done using IPs &quot;less than .7&quot;.  However, after awhile, if Proxy ARP was turned off, internet connectivity was lost.  Turning Proxy ARP back on would provide internet again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After changing to the subnet on the outside interface to be correct (.240), and turning Proxy ARP off, everything worked as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So everything works - that's great.  But why didn't it work even with the wrong subnet, considering I was using all IPs within the misconfigured subnet?  The only reason I can think is the IP broadcast address changed, but ARP is Ethernet not IP so a wrong IP broadcast address means nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have enough insight to what was going wrong, for learning value?&lt;/p&gt;&#xA;" OwnerUserId="10411" LastEditorUserId="8499" LastEditDate="2018-02-15T19:32:53.240" LastActivityDate="2018-02-15T19:32:53.240" Title="Do you happen to know why this happened on my outside interface? (wrong subnet, proxy arp)" Tags="|subnet|arp|broadcast|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13036" PostTypeId="2" ParentId="11336" CreationDate="2014-11-16T20:49:00.057" Score="1" Body="&lt;p&gt;Always assign static IPv6 addresses to any network device. If you are using the 3750 for routing Statles  Address Autoconfiguration (SLAAC) is not even supposed to work . Cisco may think otherwise: I opened a TAC case for an ASA and got &quot;yes we ignore the RFC&quot; as answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using SLAAC the address of the switch is based on a prefix (received from a router on your network) and a the MAC address of the interface (with ff:fe added in the middle and the U/L bit set to locally assigned). If the master of your stack changes the MAC address most likely changes too. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorDisplayName="user2084" LastEditDate="2014-11-17T16:46:20.133" LastActivityDate="2014-11-17T16:46:20.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13037" PostTypeId="2" ParentId="11336" CreationDate="2014-11-16T20:57:19.880" Score="2" Body="&lt;p&gt;You need to enable the 'Persistent MAC-Address' feature of the 3750 with the &lt;code&gt;stack-mac persistent timer 0&lt;/code&gt; command. There is no way to assign a virtual mac-address to a 3750 stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/guide/scg3750/swstack.html#wp1206500&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/guide/scg3750/swstack.html#wp1206500&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-11-16T20:57:19.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13039" PostTypeId="2" ParentId="13034" CreationDate="2014-11-16T21:58:18.787" Score="0" Body="&lt;p&gt;You are correct when you say an ARP request is not addressed to the &quot;Broadcast IP Address&quot; of a particular subnet.  So at no time were your ARP &quot;broadcasts&quot; destined to .7 or .15.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me try to explain why I said Proxy ARP is required for this to work.  Lets assume everything is properly configured, and we'll use the 9.9.9.0/28 network for the example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your Firewall owns the IP &lt;strong&gt;9.9.9.2&lt;/strong&gt;, of the &lt;strong&gt;9.9.9.0/28&lt;/strong&gt; network.  Your Firewall's default gateway is &lt;strong&gt;9.9.9.1&lt;/strong&gt;, which is owned by the upstream router.  You have three static NAT's configured for servers behind your Firewall, they each own the IP &lt;strong&gt;9.9.9.3&lt;/strong&gt;, &lt;strong&gt;.4&lt;/strong&gt;, and &lt;strong&gt;.5&lt;/strong&gt;.  The server's internal IP addresses are &lt;strong&gt;10.0.0.3&lt;/strong&gt;, &lt;strong&gt;.4&lt;/strong&gt;, &lt;strong&gt;.5&lt;/strong&gt;, respectively.  For this all to work, &lt;strong&gt;Proxy ARP must be enabled on your Firewall&lt;/strong&gt;.  Here is why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your Firewall (9.9.9.2) can respond to pings.  This is because when I ping your Firewall's IP, Routing takes it to the upstream router, who then checks its Route Table and realizes the 9.9.9.0/28 network is directly connected.  As a result, it issues an ARP Request for the 9.9.9.2 address, to which your Firewall replies with its MAC address as the 'owner' of the 9.9.9.2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if I ping your server, at IP 9.9.9.5, the same Routing will also take it the up-stream router, who will yet again notice that the 9.9.9.0/28 network is directly connected.  So the Router issues an ARP Request, looking for the MAC address that 'owns' the IP address 9.9.9.5.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your server, who is neither on this network or configured for this address, is unable to respond to this ARP Request.  &lt;em&gt;Something else&lt;/em&gt; must Respond to this ARP on behalf of the server, who is indeed the &lt;em&gt;true&lt;/em&gt; owner of this IP.  Your Firewall now comes to the rescue, and answers the Up-stream Router's ARP Request with an ARP Response, providing the Firewall's MAC address as the owner of 9.9.9.5.  This allows the Router to encapsulate the packet in a way that gets it to the Firewall, who can then forward it to the Server's real address (10.0.0.5).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without the Firewall issuing a Proxy ARP to respond to the Up-Stream Router's ARP Request, the Router has no way of knowing to send the packet destined to &lt;strong&gt;9.9.9.5&lt;/strong&gt; to the Firewall.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was going to post this initially, but when you said everything is now working with Proxy ARP disabled, I was rather confused.  Because in fact, it shouldn't be.  Could you post the relevent portion of the Router's &quot;show arp&quot; entries for the Firewall and Server IP addresses?  The ones equivalent to the &lt;strong&gt;9.9.9.2&lt;/strong&gt;, &lt;strong&gt;.3&lt;/strong&gt;, &lt;strong&gt;.4&lt;/strong&gt;, and &lt;strong&gt;.5&lt;/strong&gt; addresses from my example above.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-11-16T21:58:18.787" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13045" PostTypeId="2" ParentId="9589" CreationDate="2014-11-17T11:52:58.850" Score="0" Body="&lt;p&gt;No. MAC address and IP address are not doing the same job. One is for local segment of network and is limited in scope, while IP address is (generally) global in scope and can be routed out of segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Coming to the question - why do we need both? Why can't we do the whole Internet routing with the MAC address alone and why do we need IP address on top of MAC address - one of the answer is that MAC address comes hardcoded in the NIC card - it can't be configured dynamically or assigned. The network admin won't have any control over the MAC addresses that are part of the network. Hence he/she can't design a hierarchical network.&lt;/p&gt;&#xA;" OwnerUserId="10424" LastActivityDate="2014-11-17T11:52:58.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13048" PostTypeId="2" ParentId="2557" CreationDate="2014-11-17T12:13:57.170" Score="2" Body="&lt;p&gt;In case of TCP, you need not worry about handling dropped packets during the connection. But in case you want to have ability to handle dropped connections, handling re-transmission at application level may make sense. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP terminates the connection when it gets RST (which may be due to some network error or new firewall policy). If you don't want to drop the data which is received till then and start afresh, but would like to continue from the point, till which you have received data - you can implement some kind of ordering scheme at application level and handle re-transmissions.&lt;/p&gt;&#xA;" OwnerUserId="10424" LastActivityDate="2014-11-17T12:13:57.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13049" PostTypeId="1" AcceptedAnswerId="13074" CreationDate="2014-11-17T14:09:07.267" Score="2" ViewCount="6230" Body="&lt;p&gt;Hey guys I have a Problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea why but when I'm connected via VPN I'm not albe to connect to the LAN Servers in our Network. I can surf through the internet with the VPN but I'm not even able to Ping them... It's not a site to site VPN just normal Client To Network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did I forgot something? Do you need further information?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st Pic VPN -&gt; LAN&#xA;2nd Pic LAN -&gt; VPN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/uT03j.png&quot; alt=&quot;VPN -&amp;gt; LAN Policies&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/xDw8g.png&quot; alt=&quot;LAN -&amp;gt; VPN Policies&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    netstat -r&#xA;Routing tables&#xA;&#xA;Internet:&#xA;Destination        Gateway            Flags        Refs      Use   Netif Expire&#xA;default            192.168.37.1       UGSc           26        0     en1&#xA;80.150.XXX.4       192.168.37.1       UGHS            0        0     en1&#xA;127                localhost          UCS             0        0     lo0&#xA;localhost          localhost          UH             14 35760176     lo0&#xA;169.254            link#5             UCS             0        0     en1&#xA;192.168.0.1        192.168.5.3        UH              1        2    ppp0&#xA;192.168.5          ppp0               USc             0        0    ppp0&#xA;192.168.37         link#5             UCS             1        0     en1&#xA;192.168.37.1       68:7f:74:1:d1:5d   UHLWIir        33      173     en1   1162&#xA;ersatzbook         localhost          UHS             0       25     lo0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qa0eG.png&quot; alt=&quot;NatPolicy&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the VPN Access:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/d3f0w.png&quot; alt=&quot;VPN Access&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here we can See the Address Object which is defined in the Firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZggKw.png&quot; alt=&quot;Address Object&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After all that there are no changes in the connection to the LAN server. But still I'm not able to connect to them.&lt;/p&gt;&#xA;" OwnerUserId="10429" LastEditorUserId="10429" LastEditDate="2014-11-19T14:35:58.200" LastActivityDate="2014-11-21T15:01:49.410" Title="SonicWALL - VPN no LAN conneciton" Tags="|vpn|lan|sonicwall|policing|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13050" PostTypeId="2" ParentId="12944" CreationDate="2014-11-17T15:10:05.580" Score="6" Body="&lt;p&gt;Mystery solved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Windows 7 computer was continuously receiving TCP SYN packets to the 9100 port from another computer in the same LAN, waking up as a result when &quot;Wake on Pattern Match&quot; was activated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This port is used by network printers. The IP of the Windows 7 computer belonged before to a long-time discarded HP printer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The computer sending the packets is old, and it is always on as it is used sometimes to run software that only works in Windows XP. This computer still had the old network printer configured, pointing to the local IP address that now belongs to the Windows 7 computer having the problems. There were still documents in the printing queue, so the Windows XP computer was continuously sending TCP SYN packets to the Windows 7 computer, thinking it was the network printer. Removing the old printer from Windows XP and its associated TCP/IP Printer Port solved the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could not catch this traffic between both computers from mine using Wireshark. I had to install it on the affected computer and run it with promiscuous mode disabled.&lt;/p&gt;&#xA;" OwnerUserId="10311" LastActivityDate="2014-11-17T15:10:05.580" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13053" PostTypeId="1" AcceptedAnswerId="13065" CreationDate="2014-11-17T17:37:35.890" Score="3" ViewCount="1078" Body="&lt;p&gt;we have about 5 Servers and currently only a cheap L2 Switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We got an /42 IPv6 Network assigned from our provider and want to route this /42 Network into multiple /64 subnets. These can just be static without any DHCP but they should have access to the internet.&#xA;In this case we want to upgrade our switch to an L3 Switch to support basic routing options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are thinking about a Juniper EX4200-48T or a Juniper EX3300-48T but we don't want to buy anything that expensive without knowing the switch is the right one.&#xA;Also we have seen we need an AFL license to enable all the L3 routing features and only basic L3 features are available without the AFL license.&#xA;Since nobody has done this before here, we are probably a little bit confused what exactly we are needing now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a little pull out of the EX4200 documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Layer 3 Features: IPv6&lt;/strong&gt;  &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Max number of Neighbor Discovery (ND) entries: 16,000 (shared with IPv4)&lt;/li&gt;&#xA;  &lt;li&gt;Max number of IPv6 unicast routes in hardware: 4,000&lt;/li&gt;&#xA;  &lt;li&gt;Max number of IPv6 multicast routes in hardware: 2,000&lt;/li&gt;&#xA;  &lt;li&gt;routing protocols: rIPng, OSPFv3, IPv6, ISIS, BGP4+, PIM, MLD, MLDv2&lt;/li&gt;&#xA;  &lt;li&gt;Static routing&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Am I right when I assume we just need &quot;static ipv6 routing&quot; for what we want to do?&#xA;And does anybody know whether static ipv6 routing is useable without an AFL license.&#xA;If someone has a better suggestion what we should do or which switch we need to do this I would be very grateful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;//Edit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We don't want to exchange subnet information with neighboring routers.&#xA;We only want that every server or virtual Server which is connected to that switch gets his own /64 subnet.&#xA;My thought was here, we just have to create for every subnet a static ipv6 route which is available without AFL (i think)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Router -&gt; Juniper Switch&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Port1 = Server1 with its own /64 subnet&lt;/li&gt;&#xA;  &lt;li&gt;Port2 = Server2 with its own /64 subnet and every vserver on it&lt;/li&gt;&#xA;  &lt;li&gt;Port3 = Server3 with its own /64 subnet&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="10428" LastEditorUserId="10428" LastEditDate="2014-11-18T08:26:19.587" LastActivityDate="2015-06-28T07:48:16.167" Title="EX4200 / EX3300 IPv6 Routing Question" Tags="|routing|switch|ipv6|juniper-ex|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13055" PostTypeId="1" CreationDate="2014-11-17T19:39:10.297" Score="1" ViewCount="572" Body="&lt;p&gt;I am looking at building an application that broadcasts audio using my own proprietary protocol.  Under the covers I'd prefer to use IGMP or something where 1000 clients don't use 1000 times the networking resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know if it is possible to use IGMP over arbitrary internet connections?  If I have a server on EC2 or some common host will it be able to get data via multicast to arbitrary clients worldwide in the same way I could host HTTP to arbitrary people?&lt;/p&gt;&#xA;" OwnerUserId="7937" LastActivityDate="2014-11-17T21:14:27.867" Title="Is it possible to use group multicast (IGMP) over the internet?" Tags="|multicast|igmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13056" PostTypeId="2" ParentId="13055" CreationDate="2014-11-17T20:17:07.057" Score="2" Body="&lt;p&gt;Multicast is not enabled on the Internet. So if you directly connect to the Internet router, IGMP will be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tunneling can be used to carry multicast packets across the Internet, however. You can also get a Mutlicast-VPN from an ISP. Page 2 in the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www22.verizon.com/wholesale/attachments/solutions/W5032.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www22.verizon.com/wholesale/attachments/solutions/W5032.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards.&lt;/p&gt;&#xA;" OwnerUserId="10306" LastEditorUserId="10306" LastEditDate="2014-11-17T21:14:27.867" LastActivityDate="2014-11-17T21:14:27.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13057" PostTypeId="1" CreationDate="2014-11-17T20:38:31.837" Score="2" ViewCount="479" Body="&lt;p&gt;I need support understanding these 4 lines. looks like tcp dump but I'm actully not understanding what exactly is happening here.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;13:13:22.407445 IP 192.168.246.128.54955 &amp;gt; 192.168.246.13.80: S 2910497703:2910497703(0)&#xA;  win 5840 &amp;lt;mss 1460,sackok,timestamp=&quot;&quot; 518611=&quot;&quot; 0,nop,wscale=&quot;&quot; 6=&quot;&quot;&amp;gt;&#xA;&#xA;13:13:22.407560 IP 192.168.246.13.80 &amp;gt; 192.168.246.128.54955: S 3762608065:3762608065(0)&#xA;  ack 2910497704 win 64240 &amp;lt;mss 1460,nop,wscale=&quot;&quot; 0,nop,nop,timestamp=&quot;&quot; 0=&quot;&quot; 0,nop,nop,sackok=&quot;&quot;&amp;gt;&#xA;&#xA;13:13:22.407963 IP 192.168.246.128.54955 &amp;gt; 192.168.246.13.80: .&#xA;  ack 1 win 92 &amp;lt;nop,nop,timestamp 518611=&quot;&quot; 0=&quot;&quot;&amp;gt;&#xA;&#xA;13:13:22.408321 IP 192.168.246.128.54955 &amp;gt; 192.168.246.13.80: R 1:1(0)&#xA;  ack 1 win 92 &amp;lt;nop,nop,timestamp 518611=&quot;&quot; 0=&quot;&quot;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10432" LastEditorUserId="27143" LastEditDate="2016-06-14T00:36:48.897" LastActivityDate="2016-06-14T00:36:48.897" Title="TCP DUMP 4 lines I do not understand, please help?" Tags="|tcp|tcpdump|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13061" PostTypeId="2" ParentId="13057" CreationDate="2014-11-17T23:28:37.830" Score="2" Body="&lt;p&gt;You are looking at a successful three way handshake (SYN, SYN ACK, ACK).  And then an ungraceful connection closure sent by the client (R for Reset).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP 192.168.246.128.54955 &gt; 192.168.246.13.80: &lt;strong&gt;S&lt;/strong&gt; 2910497703:2910497703(0) win 5840&lt;BR&gt;&#xA;IP 192.168.246.13.80 &gt; 192.168.246.128.54955: &lt;strong&gt;S&lt;/strong&gt; 3762608065:3762608065(0) &lt;strong&gt;ack&lt;/strong&gt; 2910497704 win 64240&lt;BR&gt;&#xA;IP 192.168.246.128.54955 &gt; 192.168.246.13.80: . &lt;strong&gt;ack&lt;/strong&gt; 1 win 92&lt;BR&gt;&#xA;IP 192.168.246.128.54955 &gt; 192.168.246.13.80: &lt;strong&gt;R&lt;/strong&gt; 1:1(0) ack 1 win 92&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(I removed the timestamps so you could see it all on one line)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This particular pattern often occurs when someone is scanning your environment for open ports.  Someone completed the three way handshake, noted that Port 80 was open on the Server (192.168.246.13), and then close the connection.  This method (actually completing the three way handshake) shows up less often on IDS/IPS monitoring systems than the traditional port scan pattern which just includes SYN, SYN ACK, RESET.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-11-17T23:28:37.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13064" PostTypeId="1" CreationDate="2014-11-18T01:43:49.657" Score="0" ViewCount="75" Body="&lt;p&gt;I have 3 internet providers in the same environment, but distributed in different points/hosts. Sometimes a link is off while the others are okay. My idea is to centralize all connections in a server to guarantee that all hosts are online since at least one internet provider is working properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I have a few questions.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is is possible to share all internet connections and serve them as they were a unique provider? So, when one is off the others could take care of the signal?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In case the first question results in negative answer, what do I need to do in order to start developing a server that handles 3 simultaneous internet connections?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have done network sharing before using Debian as a server, but never did failover system before. Thus, any point, tip, tutorial, online material, etc, is welcome. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="10439" LastActivityDate="2015-09-18T08:26:57.323" Title="What is a good approach to develop internet access failover system?" Tags="|internet|failover|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13065" PostTypeId="2" ParentId="13053" CreationDate="2014-11-18T01:57:52.613" Score="3" Body="&lt;p&gt;If you aren't trying to exchange subnet information with neighboring routers about these /64's, then you'll be fine with the stock EX4200 loadout.  However, if you were going to, you'll need routing protocol support (i.e. RIPng, OSPFv3, ISIS, BGP) that only comes with an AFL.  Given your design intentions, you don't need the AFL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out Juniper's &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/concept/ex-series-software-licenses-overview.html&quot; rel=&quot;nofollow&quot;&gt;&quot;Understanding Software Licenses for EX Series Switches&quot;&lt;/a&gt; to get more information into what you actually get with the AFL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note:  All of this functionality exists with/without the AFL, you simply get a warning/syslog message when you don't.  They go on more of an honor system.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-11-18T14:26:05.227" LastActivityDate="2014-11-18T14:26:05.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13067" PostTypeId="2" ParentId="13064" CreationDate="2014-11-18T04:45:46.273" Score="2" Body="&lt;p&gt;YEs you can use all ISPs at the same time and also use as primary, secondary ISPs. Primary is the one which would be used by default and secondary would be used in case of failure of primary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To know do this things, there are two options known to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) You can use multiple Routers and configure them for redundancy protocols such as HSRP, VRRP or GLBP. You can  find more about the configuration on youtube.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) You can also implement this if you have a hardware firewall such as SonicWall, FortyGate, PIX or Juniper. There you can have multiple ISP connections and you can create the strategy about how the internet sharing could be done. You would also be able to more help on configuring firewall on youtube if you search for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There might be other ways also but I shared the ones I currently use. I would really like to know any other methods that could also be used for the same.&lt;/p&gt;&#xA;" OwnerUserId="10317" LastActivityDate="2014-11-18T04:45:46.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13071" PostTypeId="1" AcceptedAnswerId="13109" CreationDate="2014-11-18T08:11:21.867" Score="5" ViewCount="1372" Body="&lt;p&gt;I've previously run a Cisco based network (Catalyst switches, ASA and PIX firewalls) which segmented a medium sized business network into 8 VLANs with little issue. I've recently started in a new company and have taken over part of the network admin, which includes creating a VLAN configuration to allow for a staff &quot;guest&quot; network and to provide for segmentation to test customer equipment, this time using a mix of D-Link switches, D-Link and Zyxel wireless access points, a Draytek Vigor 2830 router, and a pair of Deliberant APC 5M-18 V2 units in a wireless bridge configuration connecting two buildings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting up a VLAN network in the main office was fairly straightforward, tagging the ports on the primary D-Link switch (a DGS-1210-48) that connected to the Zyxel access point, and adding a second SSID to the access point and adding VLAN IDs to both SSIDs. Initially the Vigor 2830 caused problems due to it giving out the wrong IP address and DNS settings from time to time, apparently it's a common issue with using multiple VLANs on a single port so the Vigor was given two connections to the main switch, both ports on the switch untagged but with the appropriate PVID for the LAN configured on the matching router port. This works as expected, and has been up and running for a few weeks without any problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a very simplified (I've left out all the printers, servers, desktops, etc., to focus just on the main elements that are affected by the VLAN changes) diagram of the VLAN configuration so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/eC9Ck.png&quot; alt=&quot;Current VLAN Configuration&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 192.168.4.4 is the main switch, a D-Link DGS-1210-48. The Deliberant wireless bridge units are labelled &quot;APC U12&quot; (running in Access Point mode) and &quot;APC U14&quot; (running in Station mode) configured as a Point-to-Point bridge. Switch 192.168.4.12 is the switch in the other office, a D-Link DES-1210-28.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I'm having trouble is extending the VLAN over the wireless bridge. We have two buildings, separated by a car park, and are currently using a pair of Deliberant APC 5M-18 V2 units - these are 5Ghz IP66 rated units for external fitting that can provide connectivity up to around 20km in PTP mode, however we are using them to bridge about 100m. They work well as a bridge, and with no VLANs have been running here at the company for about a year. However, they have become a sticking point with extending the VLANs to our other building.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Deliberant APC units themselves have no VLAN settings. I have been in touch with Deliberant support and they are adamant that there is nothing to configure on the units, and that they will pass frames across the bridge whether they have 802.1Q VLAN header data or not, and they have an MTU of 3790 bytes so should be plenty large enough to accommodate the 802.1Q bytes. Apparently all we have to do is add the 802.1Q header and that's it. But this is where we're finding a disparity between what they're telling us and what we actually see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As soon as the switch port 42, connected to APC U12, on the D-Link DGS-1210-48 is &quot;tagged&quot; so that frames have the appropriate VLAN header added, no PC in the main office can ping or connect to the APC U12 unit. Same happens when port 13 on the switch on the other end is &quot;tagged&quot;, APC U14 cannot be pinged or accessed. No traffic appears to pass over the bridge when either/both port is tagged, but also nothing is shown the APC logs (which can be accessed once the ports are untagged). No errors are displayed in the switch logs either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if I only tag the switch ports as a member of VLAN1 (leaving them as not a member of VLAN2) devices on one side cannot contact the other side, and I've tried rebooting the switches and wireless bridge units with no luck. As soon as they D-Link ports are returned to their &quot;untagged&quot; setting and a PVID of 1 the bridge starts passing traffic again. Working from the main office side, I can tag port 13 on the switch on the far side and still ping it/use the web admin interface, so I assume that the frames have on VLAN headers at this point as the remote switch is simply replying to ping packets that have no VLAN header. It is only when the local switch has it's port 42 tagged that I can no longer connect to the APC units or the remote office switch/devices. As soon as port 42 is untagged everything works again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Deliberant support have had copies of the configs from both APC units, and claim that they have replicated our network in their lab and it works &quot;perfectly&quot; when tagging the switch ports. Obviously as they don't have D-Link switches, or our switch config backups, they cannot possibly have duplicated our network setup. They have offered to remote in to our network and take a look, but so far we have arranged this on 4 different days and on each occasion their assigned engineer has failed to connect in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to my questions,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correctly configuring the switches at each end of the wireless bridge, by setting the ports connected to the APC units to &quot;tagged&quot; for VLAN1 and VLAN2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is my assumption that the Deliberant APC units are dropping the frames with VLAN headers a reasonable one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone had success with using a pair of Deliberant APC 5M units in PTP bridge mode and having multiple VLANs pass over the bridge?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dan&lt;/p&gt;&#xA;" OwnerUserId="10446" LastActivityDate="2014-11-20T07:33:34.247" Title="802.1Q VLAN over Deliberant APC wireless bridge - am I doing something wrong?" Tags="|switch|wireless|vlan|bridge|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13073" PostTypeId="1" CreationDate="2014-11-18T09:10:22.850" Score="1" ViewCount="150" Body="&lt;p&gt;I was wondering if anyone has made an &lt;a href=&quot;http://en.wikipedia.org/wiki/MTR_(software)&quot; rel=&quot;nofollow&quot;&gt;mtr&lt;/a&gt;-like tcl script for Cisco devices to get a &quot;remote&quot; picture, or if there is a good reason to not make/use it.&lt;/p&gt;&#xA;" OwnerUserId="399" LastEditorUserId="509" LastEditDate="2014-11-18T09:19:00.197" LastActivityDate="2014-11-18T09:19:00.197" Title="mtr-like tcl script for Cisco devices" Tags="|mtr|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13074" PostTypeId="2" ParentId="13049" CreationDate="2014-11-18T09:57:32.993" Score="1" Body="&lt;p&gt;First, check if your client has correct routes. Asumming windows, execute &lt;em&gt;route print&lt;/em&gt; in cmd. You should see a line containing a route for your LAN throught your VPN interface. Something like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.0 (your lan) 255.255.255.0 192.168.10.200 (your VPN asigned IP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this route exist on your client routing table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case not, your SonicWall fw is not passing correct network proposals in one of the phases of IPSec negotiation. There are an option where you can specify what networks can be accesible from your remote client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This VPN allowed networks are not in the firewall rules, they are located in a tab called VPN Access in the user config, i mean the user you configured for VPN access. Check &lt;a href=&quot;https://support.software.dell.com/kb/sw7507&quot; rel=&quot;nofollow&quot;&gt;this URL&lt;/a&gt; for screenshots and a further explanation.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2014-11-18T09:57:32.993" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="13079" PostTypeId="1" CreationDate="2014-11-18T18:09:41.533" Score="0" ViewCount="1563" Body="&lt;p&gt;I know that because of the distance the data has to travel, and light only being so fast, the connection will take longer, and the first bit should arrive slower than downloading from a server which is closer, but once that first bit arrives from the server, shouldn't the rest follow straight after?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if 100 cars set off from France to Spain, it wouldn't take long for the first car to arrive and they should all arrive at the same time. If they set off from China to Spain, it would take much longer, but after the first car arrived, wouldn't the others arrive just after in a continuous stream?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or does it send one bit (or one packet), then by the time it sends the next, some other bits/packets have been sent so there is &quot;traffic&quot; in between?&lt;/p&gt;&#xA;" OwnerUserId="10457" LastEditorUserId="775" LastEditDate="2014-12-08T12:08:16.223" LastActivityDate="2016-03-30T03:44:22.300" Title="Why are downloads slower if the server is far away?" Tags="|bandwidth|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13080" PostTypeId="1" CreationDate="2014-11-18T18:40:55.090" Score="3" ViewCount="404" Body="&lt;p&gt;Is there a way for the the &lt;strong&gt;wifi router&lt;/strong&gt; to know how many wifi enabled devices are within range &lt;strong&gt;even if they are not connected&lt;/strong&gt; ? Is this the same technology as my laptop/mobile phone knowing all possible wifi routers in an area and listing it according to signal strength ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Judging by the phrasing and triviality- you can know I have no idea whatsoever about wifi networks and stuff)&lt;/p&gt;&#xA;" OwnerUserId="10458" LastActivityDate="2014-12-29T16:29:21.363" Title="How many wifi devices are within range?" Tags="|router|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13082" PostTypeId="1" AcceptedAnswerId="13093" CreationDate="2014-11-18T20:22:41.780" Score="6" ViewCount="2938" Body="&lt;p&gt;Working with a network entirely consisting of Cisco router/switch, two devices (server and client) are talking to each other across a network, about 5 hops of routers including a nexus 7k.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Server packet capture from directly on the hardware (not SPAN) is showing the TCP segment length above the MTU (1500) and the DF bit set&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client packet capture is from SPAN'd port is showing those same segments (as matched using the IP-ID value and absolute time) but they appear fragmented, still showing the DF bit but not the MF or any other sign of being an IP fragment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data lengths of the two packets (1460 + 648 byte) received by the client add up exactly to the length of the one packet sent by the server (2108 byte)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on what would be responsible for chopping up the packet and not following fragmentation standards for ipv4?&lt;/p&gt;&#xA;" OwnerUserId="2477" LastEditorUserId="2477" LastEditDate="2014-11-18T22:16:50.547" LastActivityDate="2014-11-19T02:08:36.243" Title="Don't fragment set, still being fragmented" Tags="|cisco|ipv4|wireshark|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13083" PostTypeId="1" AcceptedAnswerId="13094" CreationDate="2014-11-18T21:15:12.217" Score="5" ViewCount="1198" Body="&lt;p&gt;I am building a network with stacked switches for redundancy. The problem I have is that some of the machines connected to the network will only have one available network card. This card is not a dual port card so I will only have one port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have pseudo-network fault tolerance with a simple unmanaged switch? The reason I am doing this is because there are many machines on the network and if a managed switch goes down, all the machines should not go with it. If the unmanaged switch goes down it will only take the local machines access with it.&lt;/p&gt;&#xA;" OwnerUserId="10462" LastEditorUserId="3191" LastEditDate="2014-11-22T02:17:23.143" LastActivityDate="2014-11-22T02:17:23.143" Title="Can I use an unmanaged switch as a substitute for redundant, stacked switches when using a single network card?" Tags="|redundancy|stacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13084" PostTypeId="2" ParentId="13080" CreationDate="2014-11-18T22:03:21.883" Score="6" Body="&lt;p&gt;Simple answer: No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your mobile knows the APs around it because it's listening for beacons. (and actively probing its list of known APs) For an AP to figure out what's around it, it would have to constantly listen &lt;em&gt;on every channel&lt;/em&gt; to pick up traffic. That's better known as &lt;em&gt;monitor mode&lt;/em&gt; -- something &lt;code&gt;air-snort&lt;/code&gt; does.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-11-18T22:03:21.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13085" PostTypeId="1" AcceptedAnswerId="13086" CreationDate="2014-11-18T22:22:24.520" Score="3" ViewCount="6856" Body="&lt;p&gt;Can i have two process networks using the same unmanaged switch?&lt;/p&gt;&#xA;" OwnerUserId="10462" LastActivityDate="2016-01-11T18:10:44.630" Title="Can 2 seperate lans share an unmanaged switch" Tags="|switch|subnet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13086" PostTypeId="2" ParentId="13085" CreationDate="2014-11-18T22:34:45.913" Score="3" Body="&lt;p&gt;Sure. As long as the subnets don't overlap. (i.e. they aren't both 192.168.1.0/24)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-11-18T22:34:45.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13088" PostTypeId="2" ParentId="13085" CreationDate="2014-11-18T22:59:25.013" Score="4" Body="&lt;p&gt;It may technically work, but it's not a great idea.  The two networks will share a single broadcast domain.  In practice, this can cause very strange, hard to diagnose issues in some applications. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be much better to get a second unmanaged switch or spring for a cheap managed switch.&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2014-11-18T22:59:25.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13089" PostTypeId="1" CreationDate="2014-11-18T23:10:03.737" Score="3" ViewCount="406" Body="&lt;p&gt;Does IPv6 have a private IP addressing scheme?&lt;/p&gt;&#xA;" OwnerUserId="10437" LastEditorUserId="775" LastEditDate="2014-11-19T01:12:16.060" LastActivityDate="2014-11-20T16:57:41.477" Title="Which private IP addresses can be used internally?" Tags="|router|ipv4|ipv6|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13093" PostTypeId="2" ParentId="13082" CreationDate="2014-11-19T02:08:36.243" Score="7" Body="&lt;p&gt;This is, as Ricky Beam indicates, almost certainly TCP segmentation being done by the NIC.  If you're capturing traffic on the server, capturing packets being sent by the server, and TCP segmentation offloading is being done, the server's operating system will hand packets bigger than the network's MTU to the NIC (with the expectation that the NIC will turn them into multiple IP packets) &lt;em&gt;and&lt;/em&gt; to the packet capture mechanism and thus to the packet capture program, so it will appear as if a packet bigger than the network's MTU is being transmitted on that network - for example, Ethernet packets larger than 1514 bytes.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2014-11-19T02:08:36.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13094" PostTypeId="2" ParentId="13083" CreationDate="2014-11-19T04:06:53.893" Score="3" Body="&lt;p&gt;No.  What you are proposing is to create a loop in your network with an unmanaged switch and then hoping it understands spanning-tree, or hoping that it forwards spanning-tree through itself so the two upstream managed switches can work out that there is a loop and block one of their downstream ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best case for single-NIC servers is a highly available network switch (dual power supplies, possibly dual supervisors and/or some type of ISSU).  Or you can add a second NIC or create some type of HA cluster with another single-NIC server attached to a different switch.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-11-19T04:06:53.893" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13095" PostTypeId="2" ParentId="13089" CreationDate="2014-11-19T04:19:17.413" Score="3" Body="&lt;p&gt;Answering the edited questions...&lt;/p&gt;&#xA;&lt;p&gt;IPv6 has Unique Local Addresses, see &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4193&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1493&lt;/a&gt;.  These are from the fd00::/8 block and should not be used on the Internet.  There is also an fc00::/8 block that is semi-related but the usage definition is still being worked out and is not available for use.&lt;/p&gt;&#xA;&lt;p&gt;This address pool is thought to be large enough that if you randomly assign yourself a block from that range you will have a good chance of not colliding with other users of ULA space.  This is only important if you have to talk from one network using ULA to a network under different administrative control that is also using ULA, since there is no large-scale NAT deployed for IPv6 (yet, see other answer's comment thread).  Also there are &lt;a href=&quot;https://www.sixxs.net/tools/grh/ula/&quot; rel=&quot;nofollow noreferrer&quot;&gt;registries&lt;/a&gt; where you can mark usage of a network block to (hopefully) reduce the collision probability.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-11-19T04:19:17.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13096" PostTypeId="2" ParentId="13089" CreationDate="2014-11-19T04:21:59.257" Score="6" Body="&lt;p&gt;IPv6 has &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4193&quot; rel=&quot;nofollow noreferrer&quot;&gt;ULA&lt;/a&gt; (Unique Local Addresses). The idea is that everybody can generate a different prefix for local use so that when networks are merged our connected in the future the addresses don't conflict.&lt;/p&gt;&#xA;&lt;p&gt;You usually don't use NAT with IPv6 though so these addresses are for internal use only, not for reaching the internet. Hosts have multiple IPv6 Address so they can get both ULA and global addresses at the same time. The ULA addresses can then be used internally while the global addresses are used to connect outside. I have also seen cases where ULA is used internally and a proxy server is used for external connectivity.&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2014-11-20T04:51:10.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13097" PostTypeId="2" ParentId="13079" CreationDate="2014-11-19T10:06:43.053" Score="3" Body="&lt;p&gt;Using the car analogy, there's 1000+ km between central France and central Spain.  After a certain number of cars arrive at the destination, you need to &lt;strong&gt;ACKnowledge&lt;/strong&gt; that they arrived by sending a car in the &lt;em&gt;other&lt;/em&gt; direction which incurs delay.  To minimize effects of the long pipe, you need to keep both sides of the road filled with traffic.  This ties into the question of window sizes to allow the pipe to remain full.  Of course, we're assuming the app is able to not let the network buffers flush out and have nothing left to send.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.kehlet.cx/articles/99.html&quot; rel=&quot;nofollow&quot;&gt;Tuning TCP for High Bandwidth-Delay Networks&lt;/a&gt; gives a concise technical explanation of the Long Fat Network issue with respect to the Bandwidth-Delay Product with some simple animations to illustrate the issue with keeping the pipe full &lt;em&gt;in both directions&lt;/em&gt;!&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2014-11-19T10:06:43.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13098" PostTypeId="1" AcceptedAnswerId="22553" CreationDate="2014-11-19T10:51:03.597" Score="0" ViewCount="275" Body="&lt;p&gt;I'm not sure what i'am doing wrong, but when i add a vlan, i can not join a vlan on a selected port because the box is empty. I had trouble before with a SG-300 52 port, but somehow cant get this baby switch to see the vlan 1 and vlan 999.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also to add to this, If i manually set up vlans via the interface settings. Traffic does not pass through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MTnHC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4880" LastActivityDate="2015-09-16T20:53:02.677" Title="Cisco SG-300 10 Port Vlans" Tags="|cisco|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13099" PostTypeId="1" AcceptedAnswerId="13104" CreationDate="2014-11-19T12:44:31.303" Score="9" ViewCount="46365" Body="&lt;p&gt;Why do we use the &lt;code&gt;ip ospf network point-to-point&lt;/code&gt; command on loopback interfaces?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 2.2.2.2 255.255.255.0&#xA; ip ospf network point-to-point&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;kindly explain that..&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="3191" LastEditDate="2014-11-20T05:23:56.353" LastActivityDate="2014-11-20T05:29:15.460" Title="Why do we use OSPF Point-to-Point Networks for Loopbacks?" Tags="|ospf|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13101" PostTypeId="2" ParentId="13099" CreationDate="2014-11-19T13:55:35.893" Score="-2" Body="&lt;p&gt;Since there are only two routers on a point-to-point link, there is no need to hold an election for a Designated Router (DR) and a backup DR as OSPF would in a broadcast network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An OSPF router on a point-to-point link will multicast its OSPF on the link for the other end to receive. On a point-to-point link, a router can only establish one neighborship.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A loopback interface in OSPF will be in loopback mode. Setting OSPF to point-to-point mode results in advertised routes containing the actual subnet mask instead of the default behaviour of advertising /32 for a loopback interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Iirc I read something about scenarios in which advertising a /32 instead of the actual mask causes trouble. I have only ever used this to start advertising a network that was not yet attached to the router.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2014-11-19T20:32:26.787" LastActivityDate="2014-11-19T20:32:26.787" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13103" PostTypeId="2" ParentId="13099" CreationDate="2014-11-19T15:27:03.850" Score="6" Body="&lt;p&gt;By using point-to-point command you will be overriding the default categorization of OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per &lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;noreferrer&quot;&gt;RFC 2328&lt;/a&gt;, OSPF only supports following types of links:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;               Link type   Description       Link ID&#xA;               __________________________________________________&#xA;               1           Point-to-point    Neighbor Router ID&#xA;                           link&#xA;               2           Link to transit   Interface address of&#xA;                           network           Designated Router&#xA;               3           Link to stub      IP network number&#xA;                           network&#xA;               4           Virtual link      Neighbor Router ID&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Loopback interfaces fall in link-type 3:  the stub network. The RFC states:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            If the state of the interface is Loopback, add a Type 3&#xA;            link (stub network) as long as this is not an interface&#xA;            to an unnumbered point-to-point network.  The Link ID&#xA;            should be set to the IP interface address, the Link Data&#xA;            set to the mask 0xffffffff (indicating a host route),&#xA;            and the cost set to 0.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="10306" LastActivityDate="2014-11-19T15:27:03.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13104" PostTypeId="2" ParentId="13099" CreationDate="2014-11-19T16:24:39.437" Score="8" Body="&lt;p&gt;If we create a loopback and give classful or classless addresses, then by default the route to that loop back is advertised as the most specific route: /32 prefix and it will ignore any configured prefix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 2.2.2.2 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here, the loopback network address is 2.2.2.0/24. By default OSPF will advertise this route to loopback0 as 2.2.2.2/32 (most specific route to that loopback).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To override this we have to change the network type to point-to-point. After this OSPF will advertise the address to loopback as 2.2.2.0/24.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 2.2.2.2 255.255.255.0&#xA; ip ospf network point-to-point&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10474" LastEditorUserId="3191" LastEditDate="2014-11-20T05:29:15.460" LastActivityDate="2014-11-20T05:29:15.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13107" PostTypeId="1" AcceptedAnswerId="13112" CreationDate="2014-11-19T17:45:10.040" Score="3" ViewCount="314" Body="&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13099/ip-ospf-network-point-to-point&quot;&gt;Please click here for the reference link.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I agree with the comments from Ryan and the answer provided by RahulKrishnan R A that we have to declare the interface as point-to-point in order to carry the mask for the loopback interface that's is configured with a mask other than /32.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: in this case, what will be the LinkID for that link? Since for point-to-point the LinkID is supposed to be the 'Neighbor Router ID', what will it's value be for the loopback - which actually is a stub and has no neighbor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;May be that's one of the reasons a Juniper router doesn't allow a loopback address other than /32 for ipv4.&lt;/p&gt;&#xA;" OwnerUserId="10306" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-11-19T20:06:40.410" Title="OSPF LinkID for the Loopback Interface Configured as Point-to-Point on a Cisco Router" Tags="|cisco|routing|ospf|juniper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13108" PostTypeId="1" AcceptedAnswerId="13116" CreationDate="2014-11-19T19:03:53.780" Score="2" ViewCount="334" Body="&lt;p&gt;Ok this question is related to&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13083/can-i-use-an-unmanaged-switch-as-a-substitute-for-a-nft-with-a-single-network-ca&quot;&gt;Can I use an unmanaged switch as a substitute for redundant, stacked switches when using a single network card?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have network with two stacked Cisco 2960 switches configured for lacp I have some entities on the network that only have one network card but i want to make use of the redundancy capabilities of the network. If i add a lacp capable level 2 switch at the machine level of these entities can i run two cables back from Them and Then have redundancy? And if i can do i need to configure Them?&lt;/p&gt;&#xA;" OwnerUserId="10462" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-11-20T00:31:38.477" Title="Do I have to configure a level 2 LACP capable switch for it to work properly on a network with LACP redundant switches" Tags="|switch|redundancy|ieee-802.1ax|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13109" PostTypeId="2" ParentId="13071" CreationDate="2014-11-19T19:14:13.850" Score="4" Body="&lt;p&gt;Please ignore the comment above, it was supposed to be an answer but I can't delete it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this evening spent some time in a remote session with Deliberant support, and between us we managed to nail down the issues so it now works. I'm posting this information in case it is of help to anyone else in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) The Deliberant APC web interface will not respond to tagged frames. This requires the switch ports connected to the APC units to have at least one untagged VLAN assigned, and this VLAN to be used for management of the units. By setting the ports at each end to tagged in VLAN2, untagged in VLAN1, and a PVID of 1 the APCs can be managed from VLAN1 while still allowing VLAN2 traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Always check your physical switch ports! After trying to get VLAN2 to work over the bridge unsuccessfully the company electrician handily pointed out that he'd moved some cables, but didn't tell the IT department that he'd unplugged anything. He thought he'd put the cables back in the same place, but when we checked during the support call found that the cables were put in the wrong ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The support call wasn't a complete waste of time in that it identified (1) as an issue, but had the IT documentation been updated to reflect the remote switch cable configuration having been changed the VLANs would have been working prior to the support call. As it is we would still have had the issue of not being able to manage the Deliberant APC units given that they drop tagged frames directed to their management interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dan&lt;/p&gt;&#xA;" OwnerUserId="10446" LastEditorUserId="10446" LastEditDate="2014-11-20T07:33:34.247" LastActivityDate="2014-11-20T07:33:34.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13110" PostTypeId="1" CreationDate="2014-11-19T19:54:21.440" Score="14" ViewCount="710" Body="&lt;p&gt;I've created a lab to troubleshoot an issue I'm having with PIM-SM and BSR. There are two sites connected via two Juniper SSG5s (6.3.0r17) with just enough configuration to focus on the problem at hand (configs below). The sending site has an emulated Cisco 3600 acting as the RP and BSR (config below) and the other site has a receiver.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;source --- (fa0/0)R1(fa1/0) --- (bg0)FW1(e0/0) === (e0/0)FW2(bg0) --- receiver&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My problem is as follows: FW2 is not learning about the BSR and thus also not learning RP information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FW1 learns the BSR just fine:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FW1-&amp;gt; get vrouter trust-vr protocol pim bsr&#xA; Zone : Trust&#xA;-----------------&#xA; Bootstrap Router address : 10.1.1.1&#xA;  BSR hash mask length    : 0&#xA;  BSR priority            : 0&#xA;  BSR timer expires in    : 00:01:31&#xA;  BSR up time             : 00:01:37&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's FW2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FW2-&amp;gt; get vrouter trust-vr protocol pim bsr&#xA; Zone : Trust&#xA;-----------------&#xA; Bootstrap Router address : 0.0.0.0&#xA;  BSR hash mask length    : 0&#xA;  BSR priority            : 0&#xA;  BSR timer expires in    : -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Specifying a static RP on FW2 with the following two lines gets things going, just to show that PIM is otherwise working:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vrouter trust-vr access-list 1 permit ip 224.0.0.0/4 1&#xA;set vrouter trust-vr protocol pim zone trust rp address 10.1.1.1 mgroup-list 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I misunderstanding something fundamental? &lt;code&gt;debug pim all&lt;/code&gt; on FW2 is logging &quot;RP not found for Group&quot; type messages and hellos between the two firewalls, but nothing stands out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the config commands as entered into fresh devices (I don't see a way to create collapsible sections, sorry for the wall o' text!):&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;R1:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip multicast-routing&#xA;interface FastEthernet0/0&#xA;    ip address 10.1.1.1 255.255.255.0&#xA;    ip pim sparse-mode&#xA;    no shutdown&#xA;interface FastEthernet1/0&#xA;    ip address 172.16.1.2 255.255.255.0&#xA;    ip pim sparse-mode&#xA;    no shutdown&#xA;router ospf 1&#xA;    network 0.0.0.0 255.255.255.255 area 0.0.0.5&#xA;    exit&#xA;ip pim bsr-candidate FastEthernet0/0 0&#xA;ip pim rp-candidate FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;FW1:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# interfaces&#xA;set interface ethernet0/0 ip 1.1.1.1/24&#xA;set interface bgroup0 ip 172.16.1.1/24&#xA;set interface bgroup0 route&#xA;set interface tunnel.1 zone trust&#xA;set interface tunnel.1 ip unnumbered interface bgroup0&#xA;# vpn&#xA;set ike gateway &quot;GW&quot; address 1.1.1.2 main outgoing-interface ethernet0/0 preshare password sec-level basic&#xA;set vpn &quot;VPN&quot; gateway &quot;GW&quot; sec-level basic&#xA;set vpn &quot;VPN&quot; monitor optimized rekey&#xA;set vpn &quot;VPN&quot; bind interface tunnel.1&#xA;set vpn &quot;VPN&quot; proxy-id local-ip 172.16.1.0/24 remote-ip 172.16.2.0/24 any&#xA;# ospf&#xA;set vrouter trust-vr protocol ospf&#xA;set vrouter trust-vr protocol ospf area 0.0.0.5&#xA;set vrouter trust-vr protocol ospf enable&#xA;set interface bgroup0 protocol ospf area 0.0.0.5&#xA;set interface bgroup0 protocol ospf enable&#xA;set interface tunnel.1 protocol ospf area 0.0.0.5&#xA;set interface tunnel.1 protocol ospf enable&#xA;# pim&#xA;set vrouter trust-vr protocol pim&#xA;set vrouter trust-vr protocol pim enable&#xA;set interface bgroup0 protocol pim&#xA;set interface bgroup0 protocol pim enable&#xA;set interface tunnel.1 protocol pim&#xA;set interface tunnel.1 protocol pim enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;FW2:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# interfaces&#xA;set interface ethernet0/0 ip 1.1.1.2/24&#xA;set interface bgroup0 ip 172.16.2.1/24&#xA;set interface bgroup0 route&#xA;set interface tunnel.1 zone trust&#xA;set interface tunnel.1 ip unnumbered interface bgroup0&#xA;# vpn&#xA;set ike gateway &quot;GW&quot; address 1.1.1.1 main outgoing-interface ethernet0/0 preshare password sec-level basic&#xA;set vpn &quot;VPN&quot; gateway &quot;GW&quot; sec-level basic&#xA;set vpn &quot;VPN&quot; monitor optimized rekey&#xA;set vpn &quot;VPN&quot; bind interface tunnel.1&#xA;set vpn &quot;VPN&quot; proxy-id local-ip 172.16.2.0/24 remote-ip 172.16.1.0/24 any&#xA;# ospf&#xA;set vrouter trust-vr protocol ospf&#xA;set vrouter trust-vr protocol ospf area 0.0.0.5&#xA;set vrouter trust-vr protocol ospf enable&#xA;set interface bgroup0 protocol ospf area 0.0.0.5&#xA;set interface bgroup0 protocol ospf enable&#xA;set interface tunnel.1 protocol ospf area 0.0.0.5&#xA;set interface tunnel.1 protocol ospf enable&#xA;# pim&#xA;set vrouter trust-vr protocol pim&#xA;set vrouter trust-vr protocol pim enable&#xA;set interface bgroup0 protocol pim&#xA;set interface bgroup0 protocol pim enable&#xA;set interface tunnel.1 protocol pim&#xA;set interface tunnel.1 protocol pim enable&#xA;# igmp&#xA;set interface bgroup0 protocol igmp router&#xA;set interface bgroup0 protocol igmp enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;EDIT&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Binding the tunnels to the &quot;untrust&quot; zones and adding multicast policies also permits multicast traffic to flow, but I'd still like to keep the tunnels in the &quot;trust&quot; zone.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;FW1 &amp;amp; FW2:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interface tunnel.1 zone untrust&#xA;set interface tunnel.1 ip unnumbered interface ethernet0/0&#xA;set multicast-group-policy from &quot;trust&quot; mgroup any to &quot;unTrust&quot; pim-message bsr-static-rp join-prune bi-directional&#xA;set policy from untrust to trust any any any permit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've also confirmed that intra-zone blocking is disabled on the &quot;trust&quot; zones, which is the default.&lt;/p&gt;&#xA;" OwnerUserId="3780" LastEditorUserId="3780" LastEditDate="2014-11-20T21:28:59.313" LastActivityDate="2020-03-02T02:35:18.827" Title="PIM-SM with BSR over SSG5 VPN tunnel" Tags="|multicast|screenos|pim|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13112" PostTypeId="2" ParentId="13107" CreationDate="2014-11-19T20:06:40.410" Score="3" Body="&lt;p&gt;You actually found and posted the relevant section from the RFC. So I believe you already answered your own question! :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers have two choices when setting the LinkID for an OSPF point-to-point link:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A)If the router knows the neighbor's IP address then that becomes the LinkID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B) If the router does not know the neighbor's IP adress, the LinkID is set to the subnet address for the stub link. So in this case it would be 2.2.2.0 and the Link Data will be the original /24 subnet mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real question about why this happens is due to how OSPF treats loopback addresses WITHOUT the point-to-point command. A loopback is a special type of network in OSPF and is always advertised as a host route UNLESS the point-to-point command is configured.&lt;/p&gt;&#xA;" OwnerUserId="7730" LastActivityDate="2014-11-19T20:06:40.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13113" PostTypeId="1" CreationDate="2014-11-19T20:20:24.447" Score="2" ViewCount="2903" Body="&lt;p&gt;I have a problem with my HP 2920-48G Switch and my Apple air port extreme 6th gen. The problem is: once the apple wifi access point (that is all I use the Airport for is a Wifi Access Point) connects to the network, I get errors on the HP 2920 of &quot;multiple devices lost connection&quot; and other errors that point to mismatched port speeds between the two devices. I think the problem is with the port negotiations on the two network devices. My question is does anyone know which setting or command can enable better communication between the two different network devices? I know on the Airport there are not many network settings, but the HP might have something in the command line that can help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate any advice and if anyone else has had problems with Apple wifi and HP 2920 switches. I used to run Cisco switches, but decided to go with HP switches and these problems started after I upgraded both the core network (HP 2920) and the Airport. Do these devices just not play well together?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update Dec 27, 2014&lt;/strong&gt;: HP Command line Interface print out &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;14:50:34 00328 FFI: port 45-Excessive jabbering/fragments. &#xA;14:51:15 00328 FFI: port 45-Excessive jabbering/fragments. &#xA;14:52:16 00328 FFI: port 45-Excessive jabbering/fragments. &#xA;14:52:57 00328 FFI: port 45-Excessive jabbering/fragments. &#xA;15:39:46 00328 FFI: port 45-Excessive jabbering/fragments. &#xA;15:53:26 00328 FFI: port 45-Excessive jabbering/fragments. &#xA;15:58:13 00328 FFI: port 45-Excessive jabbering/fragments. &#xA;16:01:17 00328 FFI: port 45-Excessive jabbering/fragments. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Above is a copy of the logs on the HP 2920. I am wondering if there is any setting in the command line that can help this? Or do these two network devices not work good together and if I should just invest in another wifi solution? I have changed all of the port settings on the HP GUI ie. changed the port speeds from auto to 1000-auto and everything in between. I do not know how to access these setting via the HP CLI and I am hoping someone has had a similar problem with HP and Apple Airport Extreme wifi. Any advice would be greatly appreciated with this issue and I thank anyone who has taken the time to look at this problem for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards,&lt;/p&gt;&#xA;" OwnerUserId="10480" LastEditorUserId="76" LastEditDate="2015-04-06T20:36:23.007" LastActivityDate="2015-04-06T20:37:06.980" Title="HP 2920-48G Switch and Apple Airport Extreme problems" Tags="|switch|wireless|hp-procurve|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13116" PostTypeId="2" ParentId="13108" CreationDate="2014-11-20T00:31:38.477" Score="1" Body="&lt;p&gt;Yes, you can use LACP to bundle two parallel links into a single logical interface.  You will need to configure the 'level 2' switch so that it knows what interfaces are 'uplink' to the 2960 stack and that it should request/respond to LACP on those interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also need to configure the stacked 2960 switches for a unique port-channel ID for every pair of interfaces connecting to a 'level 2' switch.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-11-20T00:31:38.477" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13117" PostTypeId="1" AcceptedAnswerId="13130" CreationDate="2014-11-20T03:23:26.790" Score="2" ViewCount="581" Body="&lt;p&gt;Ok, my company has three telco providers, each telco provides data links from the central site to different remote sites. Telco provider 'A' provides layer 2 &quot;dedicated&quot; fiber optic links from the central site to remote sites 1, 2, and 3, and each remote site can be accessed through a distinct port on a layer 2 switch at the central site. My company is then free to place layer 3 devices with IPs from a given subnet at the remote sites and central site.&#xA;That is the ideal scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, telco provider 'B' for remote sites 4, 5, and 6, only has satellite links and they say that their transmission network is layer 3, but they have added extra equipment to convert it to layer 2 as required by my company. The only thing is that they  can only give us one physical layer 2 port at the central site through which we can access sites 4-6.  Layer 3 devices are again connected to the given layer 2 ports at local and remote ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, telco provider 'C' for remote sites 7-9, also only has satellite links and has a layer 3 transmission network, but they are not able to give us access to the remote site through a layer 2 device, instead they can only deliver us layer 3 access to the remote sites.This means that the remote end devices must have IPs from their subnet, and we must create routes to their network from our central site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(all three scenarios are exemplified in rudimentary attached image)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to work with providers B and C, so that they can migrate to the same scenario as provider A. Unfortunately, I do not know how provider A is able to deliver this scenario, nor do I know if there is some limitation for satellite networks that makes this more difficult.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In conclusion, my questions are:&#xA;How can a telecommunications carrier convert his layer 3 transmission network to layer 2 at client site ?&#xA;Once this is done, how can he deliver a link to each remote site on a different switchport?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/dLB8o.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="4547" LastActivityDate="2014-11-24T14:17:03.913" Title="How can a telecommunications carrier convert his layer 3 transmission network to layer 2 at client site?" Tags="|switch|layer2|layer3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13118" PostTypeId="1" CreationDate="2014-11-20T06:17:22.867" Score="3" ViewCount="326" Body="&lt;p&gt;Do routers and switches generally have the same hardware? That is to say, if one flashed the firmware of a router on a switch, would it effectively be a router?&lt;/p&gt;&#xA;" OwnerUserId="8025" LastActivityDate="2014-11-20T15:36:46.840" Title="Are a router and switch the same in terms of their hardware?" Tags="|switch|router|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13119" PostTypeId="1" AcceptedAnswerId="13126" CreationDate="2014-11-20T06:22:36.730" Score="2" ViewCount="982" Body="&lt;p&gt;If a switch doesn't have a destination in its table it floods to all (but the sending) ports. Why doesn't it always do this if it can, since it would be faster than doing a look up in a table? I guess it has to do with collision: when 2 nodes transmit on the same medium simultaneously. But collisions can always happen anyways, and can be fixed using &lt;a href=&quot;http://en.wikipedia.org/wiki/Carrier_sense_multiple_access&quot; rel=&quot;nofollow&quot;&gt;CSMA&lt;/a&gt;. I guess CSMA is slow and wants to be avoided?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be nice if we had tags for hubs and flooding. &lt;/p&gt;&#xA;" OwnerUserId="8025" LastEditorUserId="8025" LastEditDate="2014-11-23T20:17:24.340" LastActivityDate="2014-11-25T11:01:06.580" Title="Why don't switches always flood?" Tags="|switch|ethernet|packet-path|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13120" PostTypeId="2" ParentId="13119" CreationDate="2014-11-20T07:23:29.547" Score="2" Body="&lt;p&gt;Short answer - Flooding doesn't scale as the bandwidth and user count increases.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="775" LastEditDate="2014-11-25T10:22:47.913" LastActivityDate="2014-11-25T10:22:47.913" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13122" PostTypeId="2" ParentId="13119" CreationDate="2014-11-20T08:10:27.067" Score="7" Body="&lt;p&gt;You're arguing that it's better to flood, limiting the &lt;em&gt;total&lt;/em&gt; throughput the switch to effectively the bandwidth of its slowest link, to avoid a few nanoseconds consulting a MAC address table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd argue that you're looking at it wrong - switching provides much better performance than flooding, at an extremely minimal cost of a lookup table, which is done in hardware for speed in most cases.  The performance trade-off is most definitely in favor of switching over flooding.&lt;/p&gt;&#xA;" OwnerUserId="221" LastActivityDate="2014-11-20T08:10:27.067" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13123" PostTypeId="1" CreationDate="2014-11-20T08:32:57.760" Score="6" ViewCount="4983" Body="&lt;p&gt;I want to get MAC address of machines &lt;strong&gt;directly connected&lt;/strong&gt; to a switch using SNMP. I am querying &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=dot1qTpFdbPort&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&quot;&gt;dot1qTpFdbPort&lt;/a&gt; for this. But this returns all the MAC addresses learned by switch which includes machines which are not physically connected to this switch but are learned by switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do get MAC addresses of only those machines which are physically connected to ports on switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to figure out all the machines which are physically connected to a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using a non cisco switch. But I want to implement a generic method for all boxes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; [root@dani ~]# snmpwalk  -c public -v 2c 192.168.48.1 **sysDescr**&#xA; SNMPv2-MIB::sysDescr.0 = STRING: **3Com Baseline Switch 2928-SFP Plus**&#xA; Software Version 5.20 Release 1101P10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10487" LastEditorUserId="3191" LastEditDate="2014-11-20T16:35:38.150" LastActivityDate="2015-11-03T14:13:34.303" Title="Using SNMP retrieve MAC addresses of directly connected machines to a switch" Tags="|switch|snmp|mac-address|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13126" PostTypeId="2" ParentId="13119" CreationDate="2014-11-20T12:09:00.017" Score="11" Body="&lt;p&gt;cpt_fink and Shane already gave good answers, but I will add $0.02...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume you flood every frame that comes into a switch, you're essentially turning what we know as switches into a hub.  That causes problems with:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;em&gt;Security / Privacy&lt;/em&gt;: IP networks are largely unencypted.  Flooding packets shares private information with everyone in that broadcast domain... DNS lookups, FTP passwords, websites you're visiting.  All I need is wireshark on a flooded network, and I know a lot about what is happening.  It's much easier to hijack TCP sessions if you know the TCP sequence numbers in use.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;End user count&lt;/em&gt;:  If we flooded packets for every user to every other user, there is a much lower limit for how many users we can pack into one switch, because every user consumes the other user's bandwidth (see next bullet).  Ultimately, this means you're spending a lot more money on network administrators, network infrastructure, vendor support costs, power, rack space, cooling, etc...&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;User throughput&lt;/em&gt;: If any user on the switch sends line-rate traffic (i.e. no faster than 1Gbps on a GigabitEthernet link), we are flooding that line-rate traffic to every other user in the switch (as well as the broadcast domain).  This is terribly inefficient.  Mac-learning is much better than flooding&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;FYI: YLearn provided some &lt;a href=&quot;https://networkengineering.stackexchange.com/a/13229/775&quot;&gt;practical examples&lt;/a&gt; of how flooding causes problems in wired networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A final thought:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If switches always flooded instead of learning mac-addresses, switched topologies would no longer be viable in modern networks.  Engineers would resort to routing as quickly as possible because the three issues listed above are deal-killers for many wired network designs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly enough, wireless 802.11 only implements privacy and security from the list above; otherwise wifi has the aforementioned problems with &quot;flooding&quot; non-broadcast traffic to all hosts (technically it isn't flooding, but the result is the same).  802.11's privacy and security measures make wifi at least a viable option.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In a comment, Celeritas &lt;a href=&quot;https://meta.stackexchange.com/questions/244003/if-a-question-is-posted-to-one-site-and-receives-answers-can-it-be-changed-to-a/244027#comment797608_244027&quot;&gt;said&lt;/a&gt;:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;... you say that switches are more secure, but I seriously doubt that people choose a switch over a hub because they want security, security would be built at a different level. Also it would be nice if the answers didn't use too much jargon, for example what is &quot;linerate&quot;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I am afraid you have misunderstood why people choose switches over hubs.  People choose switches instead of hubs, because all three disadvantages listed above are a problem for wired networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11 wifi has two of the three problems that hubs have; however, the privacy and security measures built into wifi make it a feasible choice in some situations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies for confusing you with the term &quot;line-rate&quot;.  Line-rate means you're sending traffic as fast as the wired NIC can.  On gigabit ethernet links, line-rate depends on the packet size you send, but line-rate cannot exceed the transmit speed of a GE NIC, which is 1,000,000,000 bits per second.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-11-25T11:01:06.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13127" PostTypeId="1" CreationDate="2014-11-20T13:05:09.993" Score="1" ViewCount="900" Body="&lt;p&gt;I have question regarding what type of cable shall I use in this situation to minimize the loss as much as possible.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;We have an old G.655 cable that is being used in the 1310 Wavelength and we want to lay a new fiber cable and patch it to the old one using patch panel. So, Since the G.652 is better in the 1310 Wavelength and the old cable is G.655, Shall we use a G.652 or a G.655 in this case ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Best Regards&lt;/p&gt;&#xA;" OwnerUserId="9887" LastEditorUserId="8499" LastEditDate="2018-08-09T22:49:47.040" LastActivityDate="2018-08-09T22:49:47.040" Title="Splicing g. 655 with g. 652?" Tags="|layer1|fiber|cabling|optical|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13128" PostTypeId="2" ParentId="13119" CreationDate="2014-11-20T13:07:02.170" Score="0" Body="&lt;p&gt;Switches (I mean Ethernet at least) generally work in Fill-Duplex mode, where CSMA not used.&#xA;Anyway Ethernet switch split Collision domain to each Half-Duplex segment. Then collision anymore not a problem for all network, only for small part of it where Half-Duplex is used (usually one link).&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2014-11-20T13:07:02.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13130" PostTypeId="2" ParentId="13117" CreationDate="2014-11-20T14:28:45.540" Score="5" Body="&lt;p&gt;Layer 2 over a Layer 3/IP core can be done by using tunnels between the appropriate supported endpoint equipment.  Some possible tunneling protocols are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;L2TP &lt;/li&gt;&#xA;&lt;li&gt;GRE &lt;/li&gt;&#xA;&lt;li&gt;VPLS (over a MPLS backbone, not strictly L3)  &lt;/li&gt;&#xA;&lt;li&gt;…&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(some disadvantages of using L2 over a global network are growing broadcast traffic and increased difficulty to manage a L2 network with many devices…)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of these options would be able to provide a separate interface for each remote site on a switch at your central site, but it really depends on the configuration implemented by the service provider.  This includes the equipment that is or will be used, engineering skills, etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the service provider doesn't give you L2 connectivity when you directly ask for it – you should change your ISP or build the L2 connectivity yourself with the assistance of an integrator and your own equipment that can create a L2 extension over L3 (aka, pseudowire).&lt;/p&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="4547" LastEditDate="2014-11-24T14:17:03.913" LastActivityDate="2014-11-24T14:17:03.913" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13131" PostTypeId="1" CreationDate="2014-11-20T15:18:44.727" Score="0" ViewCount="147" Body="&lt;p&gt;how does hand off take place in wireless LAN.I mean hand off form wireless LAN to gprs and from gprs to wireless lan.&lt;/p&gt;&#xA;" OwnerUserId="10495" LastActivityDate="2014-11-20T15:37:02.830" Title="hand off management in wireless LAN" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13132" PostTypeId="2" ParentId="13118" CreationDate="2014-11-20T15:36:46.840" Score="4" Body="&lt;p&gt;Mike Pennington already said that the answer was generally &quot;no&quot;, and that's a good answer as far as it goes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer really comes down to definitional questions.  The term &quot;switch&quot; is really pretty poorly defined and used in a lot of contexts, so its almost impossible to give an absolute answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Layer 3 switching&quot; was originally a (very marketingish) term for a router that forwards packets based on inspection of layer 3 header information using &quot;hardware&quot; such as an ASIC to do the forwarding, rather than using software running on a general purpose CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nowadays, most routers of any significant scale use ASICs (or FPGAs) in the data plane to forward packets.  Hardware based routers turn out to be able to do switching at Layer 2 or routing at Layer 3 with essentially no performance differences, so the definition between &quot;switch&quot; and &quot;router&quot; has really become very blurry with modern gear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether traffic if forwarded based on layer 2 header information or layer 3 information has become a matter of configuration on modern high end gear rather than hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To pick one example, with the right set of blades, you could take every blade out of a Cisco 6500 &quot;Switch&quot; (as they label it on their website) and slide them into a 7600 &quot;Router&quot; (again, as they label it on their website), and the behavior essentially doesn't change at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That having been said, you can still get gear that only does layer 2 switching and isn't capable of doing layer 3 switching based on the capabilities of the ASICs included in the equipment.  You'll also could find examples where a device is released with a certain set of capabilities (say layer 2 switching only), but the hardware is capable of more and the software to control it just hasn't been written, yet.  Later releases of the firmware/software for the device can then enable those capabilities that had been physically available, just not turned on by software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So...the answer can really only be, &quot;it depends.&quot;  Sorry, I know that's typically an unsatisfying answer, but its the best that can really be done without narrowing down the scope a bit.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2014-11-20T15:36:46.840" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13133" PostTypeId="2" ParentId="13131" CreationDate="2014-11-20T15:37:02.830" Score="1" Body="&lt;p&gt;As I know, in this scenario no hand off on network layer. Hand of handled by application. Old connections close/die and new connection must be established by application.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2014-11-20T15:37:02.830" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13134" PostTypeId="1" CreationDate="2014-11-20T15:55:48.117" Score="4" ViewCount="727" Body="&lt;p&gt;I have a problem with cisco asa 5505 vpn configuration. I set l2tp for windows clients. I can connect to vpn but:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;when i have &quot;use default gateway on remote network&quot; on NIC enabled i have access to all resources in network but i don't have internet access (can't open websites etc).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;when i have &quot;use default gateway on remote network&quot; on NIC disabled i dont have access to resources in network but i have internet access.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In my config file there is a little mess i tried to use ASDM and tried to configure Cisco Anyconnect but those lines in config aren't important and don't work. My VPN subnet is 192.168.20.0 and  I need only l2tp for windows. If someone wants to help here is my config:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://justpaste.it/i2os&quot; rel=&quot;nofollow&quot;&gt;justpaste.it/i2os&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10497" LastActivityDate="2015-05-21T17:10:53.190" Title="problem with cisco asa 5505 vpn configuration" Tags="|cisco|cisco-asa|vpn|l2tp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13136" PostTypeId="2" ParentId="13123" CreationDate="2014-11-20T16:43:52.513" Score="2" Body="&lt;p&gt;There is no way for a switch to determine whether the device plugged in to a particular port is an 'end host' or a second switch with many end hosts.  You could, guesstimate, that if multiple MAC addresses are learned on a single port, then that port is connected to another switch.  But that leaves you open to misidentifying a connection to another switch with only one other host behind it as a host (and not an actual switch).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would have to depend on some extra configuration on the switch, to identify whether the port is connected to an end-host, and if so, pull the MAC address table for that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you pull a list of all the interfaces, and determine which of them are marked as &quot;Portfast&quot; (or &quot;Edge&quot; ports, for non Cisco gear).  That is &lt;em&gt;almost&lt;/em&gt; a guarantee of that particular interface being connected to an end host &lt;em&gt;(just almost, see below comments by MikePennington and others)&lt;/em&gt;, and then when you pull the full MAC address table, filter it to just 'store' the data on the portfast/edge ports.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2014-11-20T20:09:23.197" LastActivityDate="2014-11-20T20:09:23.197" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13137" PostTypeId="2" ParentId="13089" CreationDate="2014-11-20T16:57:41.477" Score="4" Body="&lt;p&gt;You've gotten a lot of good answers regarding the &quot;what&quot; of &quot;private addresses&quot; in IPv6 (ULA address space).  But I just wanted to add a quick note about the why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ULA does not exist for the purpose of NAT.  It might end up being used that way, &lt;em&gt;(I'm hoping it doesn't!)&lt;/em&gt; but the original purpose for ULA address space was for internal only resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, there is a good chance your network printer does not need to be reached from the other end of the Internet.  If so, that makes it a perfect candidate for ULA address space.  Or maybe your company has an intranet portal, or HR management system, or knowledbase wiki, or ticketing system, or any other slew of applications that have no business being accessed from the Internet.  These too, are perfect candidates for receiving ULA address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note, having a ULA address does not preclude you from having a Firewall protecting your network.  ULA (like RFC1918 IPv4 private addresses) aren't meant to be routeable on the Internet... &lt;em&gt;however&lt;/em&gt;, that isn't something magically built into all Routers, it is simply a function of access-list filtering dropping traffic from a source/destination of a Private/ULA address -- and not something you should assume your ISP is doing.  Do it yourself, on the Edge Router/Firewall you control, so you know for a fact no private addresses are coming into your network from the external world.    Look up &lt;a href=&quot;http://www.team-cymru.org/Services/Bogons/bogon-dd.html&quot; rel=&quot;nofollow&quot;&gt;Bogon filtering&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-11-20T16:57:41.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13141" PostTypeId="2" ParentId="8263" CreationDate="2014-11-20T20:45:57.817" Score="0" Body="&lt;p&gt;I agree with glallen that you should be substituting &lt;strong&gt;testusername&lt;/strong&gt; for &lt;strong&gt;all&lt;/strong&gt; in your &lt;em&gt;snmp-server user&lt;/em&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if that doesn't work, for troubleshooting purposes, I would start with a more basic SNMPv3 configuration, see if it works and then start adding a more complex configuration from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My suggestion start with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server group TESTGROUP v3 auth&#xA;snmp-server user testusername TESTGROUP v3 auth sha testpassword  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;per:  &lt;a href=&quot;http://networklessons.com/network-management/how-to-configure-snmpv3-on-cisco-ios-router/#ixzz2rzU2BWJa&quot; rel=&quot;nofollow&quot;&gt;http://networklessons.com/network-management/how-to-configure-snmpv3-on-cisco-ios-router/#ixzz2rzU2BWJa&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="4547" LastEditorUserId="33" LastEditDate="2014-11-20T21:15:14.673" LastActivityDate="2014-11-20T21:15:14.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13142" PostTypeId="1" CreationDate="2014-11-20T21:19:16.603" Score="0" ViewCount="179" Body="&lt;p&gt;On our HP and Cisco devices, we had two static routes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.0.0.0/0  gateway  10.10.10.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.10.90.0/24  gateway  10.10.90.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...both with a metric of 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went to send some traffic to 10.10.90.x (from a not-mentioned subnet) and the layer 3 switch with these two static routes of course would pick either one since the metric is equal.  Of course it happened to pick the 0.0.0.0/0 match which caused connection troubles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I updated the metric on the 0.0.0.0/0 (internet at 10.10.10.1) to be a higher metric, as I expect many do and was an error on our part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the switch continued to forward all traffic to that path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the command to view/reset route selections?  I wanted the switch to re-check routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;more info:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;show ip route&quot; indeed works and shows the routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My curiosity is; say that I changed that route table.  How do I get the switch to check these routes again?  Should it automatically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say I had a packet destined to 10.10.10.5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two routes were available:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.0.0.0/0  gateway  192.168.1.1 metric 1  -and-&#xA;10.10.10.0/24  gateway  192.168.50.50 metric 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;... and the switch was sending that &quot;10.10.10.5&quot;-bound packet via the 192.169.50.50 gateway.  However, say I changed that route to have a metric of 2.  I would now expect that &quot;10.10.10.5&quot;-bound packet to be routed 192.168.1.1, correct?  Since it has the lower metric?  However, my switch never makes that change until power cycled or I pull cables for a few seconds.  It's not, what I am calling, &quot;re-evaluating&quot; the route table.&lt;/p&gt;&#xA;" OwnerUserId="10411" LastEditorUserId="775" LastEditDate="2014-12-08T12:07:19.607" LastActivityDate="2014-12-08T12:07:19.607" Title="How do you view selected route?" Tags="|routing|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13143" PostTypeId="2" ParentId="13142" CreationDate="2014-11-20T21:32:36.333" Score="3" Body="&lt;p&gt;If I understand your post correctly you're making one fundamental mistake here: more specific routes are always preferred over less specific routes. So the route for 10.10.90.0/24 gateway 10.10.90.1 always is preferred over 10.10.10.1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You didn't mention which type of Cisco and HP equipment and software versions you're using, but on most Cisco's you can view the routing table using the &lt;code&gt;show ip route&lt;/code&gt; command.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-11-20T21:32:36.333" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13144" PostTypeId="1" AcceptedAnswerId="13239" CreationDate="2014-11-21T07:27:24.363" Score="1" ViewCount="449" Body="&lt;p&gt;I was working with &lt;strong&gt;VRRP&lt;/strong&gt; on a small setup. I came across command switch-back-delay. According to us we can set MIN and MAX limit for switch-back-delay by changing the code in our program, but I wanted to know whats the MIN and MAX limit for VRRP switch-back-delay and why? I saw in RFC there I could not find the answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="10507" LastEditorUserId="8499" LastEditDate="2018-12-26T05:22:25.903" LastActivityDate="2018-12-26T05:22:25.903" Title="VRRP Switch-back-delay limit according to standards?" Tags="|protocol-theory|rfc|vrrp|fhrp|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13146" PostTypeId="1" AcceptedAnswerId="14761" CreationDate="2014-11-21T09:58:20.463" Score="5" ViewCount="6603" Body="&lt;p&gt;We know that RIP v2 uses multicast address 224.0.0.9 for periodic broadcast of routing table. So it means that every router configured with RIP V2 is monitoring for any packet with destination address of 224.0.0.9. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now if I ping that ip address; since router si listening to that ip, I should get a reply. But when I tested it on both GNS3 and Packet Tracer, no reply came.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know what is the reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="10317" LastEditorUserId="775" LastEditDate="2015-07-25T10:59:50.547" LastActivityDate="2015-07-25T10:59:50.547" Title="Why we can not ping to multicast address 224.0.0.9 of RIP" Tags="|routing|router|multicast|ping|rip|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13147" PostTypeId="1" AcceptedAnswerId="13152" CreationDate="2014-11-21T13:24:20.473" Score="2" ViewCount="714" Body="&lt;p&gt;I am looking for some expert networking advice on what would be &quot;best practice&quot; if I wanted to achieve the goal below based on the available equipment we have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Equipment:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SonicWALL TZ 105&lt;/li&gt;&#xA;&lt;li&gt;HP V1910-48G&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Goal(s):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2x &lt;em&gt;external&lt;/em&gt; subnet VLANs that can provide service to internet through DNAT from SonicWALL i.e. 192.168.1.0/24 &amp;amp; 192.168.10.0/24.&lt;/li&gt;&#xA;&lt;li&gt;Hosts in these two external subnets can reach the internet.&lt;/li&gt;&#xA;&lt;li&gt;Hosts in these two external subnets can route / communicate to each other.&lt;/li&gt;&#xA;&lt;li&gt;There will be other &quot;private&quot; subnet VLANS (storage, backup, management, etc.) but these of course do not need to be externally route-able or reachable.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have read two trains of thought on how to set this up so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first is to &quot;hairpin&quot; route through the SonicWALL by creating sub-interfaces (VLAN-aware) ports on the SonicWALL and trunk to the switch. I believe this is called Router-on-a-stick?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second is to create a separate &quot;routing&quot; domain (subnet) between the switch and firewall so there would effectively be three subnet VLANS: 192.168.0.0/24 between firewall and switch and the aforementioned two inter-VLAN subnets 192.168.1.0/24 and 192.168.10.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I probably clobbered those examples and got some terminology wrong but basically, what would best practice be to ensure security, scalability, etc.? Also, I would not mind knowing the &lt;em&gt;expedient&lt;/em&gt; set up just in case I cannot get it set up &quot;proper&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. So far I have tried the former set up but have only been successful on getting one of the &lt;em&gt;external&lt;/em&gt; subnet VLANS to be able to reach the internet.&lt;/p&gt;&#xA;" OwnerUserId="10475" LastActivityDate="2014-11-21T16:52:32.717" Title="Best Practice(?): 2 publicly available subnet VLANs and inter VLAN routing" Tags="|routing|switch|vlan|nat|subnet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13148" PostTypeId="2" ParentId="13049" CreationDate="2014-11-21T15:01:49.410" Score="0" Body="&lt;p&gt;Awww man.... I'm so ****. I found the issue... There was/is a setting in the VPN Client from MacOSX to put every network connection through the VPN... Now it routes everything through the VPN and I'm able to Ping and SSH the Server in LAN and DMZ. Arigatou Gozaimasu! Thanks Alot Every One!&lt;/p&gt;&#xA;" OwnerUserId="10429" LastActivityDate="2014-11-21T15:01:49.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13151" PostTypeId="1" AcceptedAnswerId="43245" CreationDate="2014-11-21T16:28:58.070" Score="6" ViewCount="3257" Body="&lt;p&gt;I am experiencing a problem with lost routes in an OSPF over DMVPN environment. I am running ubuntu server 14.04 with Quagga 0.99.22.4, and OpenNHRP 0.14.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While technically the DMVPN network is an NBMA network, the NHRP protocol does a simulated broadcast (a capture of the multicast traffic, and a duplicated unicast to other known/configured nodes). This allows the DMVPN subnet to be configured as a broadcast network in OSPF. This configuration is a requirement to do dynamic spoke-to-spoke tunnels, which, in turn, is a requirement of my project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if the problem I'm facing is an OSPF design flaw, or a quagga bug, but I haven't been able to come up with the right search phrase combinations to find someone having a similar problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On this DMVPN network, I have three routers: A hub node in each of two data centers, and a spoke node at a branch (there will be many, many more branches as I migrate them to the DMVPN). Each node has several routable subnets behind it, and the subnets behind each data center node are routable to eachother via other paths. The design allows for either hub node to go down, and OSPF re-converges to allow full communication throughout my AS. This all works flawlessly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem comes into play when there is partial connectivity over my DMVPN. If there is a communication problem from the spoke to the primary hub (which is the DR), then the spoke drops that hub from the neighbor table, and &lt;strong&gt;presumes&lt;/strong&gt; the secondary hub as the new DR. In this particular case however, the secondary hub has &lt;strong&gt;no issue&lt;/strong&gt; communicating with both the spoke and the primary hub, and therefore still happily considers &lt;em&gt;itself&lt;/em&gt; the &lt;strong&gt;BDR&lt;/strong&gt;, and the primary hub the DR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In simulating this issue with a couple of iptables rules to drop traffic to/from the primary hub, I can watch the dead timer expire for the primary hub within the spoke, and at that instant quagga removes all ospf routes from the spoke's routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the spoke, I can still see a neighbor relationship with Full adjacency to the secondary hub, and the spoke &lt;strong&gt;assumes&lt;/strong&gt; that this hub is now the DR (please note, I've manually changed router-ids, hostnames, and addresses):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spoke-router# sh ip ospf neigh&#xA;&#xA;Neighbor ID     Pri State             Dead Time Address       Interface            RXmtL RqstL DBsmL&#xA;1.1.1.2         254 Full/DR           35.184s   10.10.10.2    gre1:10.10.10.3          0     0     0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I look at the secondary hub, which can still communicate with both other nodes, it tells a different story.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;secondary-hub# sh ip ospf neigh gre1&#xA;&#xA;Neighbor ID Pri State           Dead Time Address         Interface            RXmtL RqstL DBsmL&#xA;1.1.1.1     255 Full/DR         36.513s   10.10.10.1      gre1:10.10.10.2          0     0     0&#xA;1.1.1.3       0 Full/DROther    35.387s   10.10.10.3      gre1:10.10.10.2          0     0     0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can probably anticipate the neighbor table of the primary hub:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;primary-hub# sh ip ospf neigh gre1&#xA;&#xA;Neighbor ID Pri State           Dead Time Address         Interface            RXmtL RqstL DBsmL&#xA;1.1.1.2     254 Full/Backup     37.067s   10.10.10.2      gre1:10.10.10.1          0     0     0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to tcpdump, I am still sending and recieving hello packets between the spoke and the secondary hub. After the communication breakdown however the hello packets contain some interesting data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Naturally, the DR and BDR addresses are mismatched, and I can only assume that this is why the spoke router removes all ospf learned routes. The spoke router's hello packets list the DR &lt;strong&gt;and&lt;/strong&gt; BDR as &lt;code&gt;10.10.10.2&lt;/code&gt; (My somewhat limited knowledge of OSPF would lead me to assume that from it's perspective the BDR should be set to &lt;code&gt;0.0.0.0&lt;/code&gt;). The secondary hub's hello packets list &lt;code&gt;10.10.10.1&lt;/code&gt; as the DR, and &lt;code&gt;0.0.0.0&lt;/code&gt; as the BDR (Again, from it's perspective I would assume that the BDR would be listed as itself: &lt;code&gt;10.10.10.2&lt;/code&gt;. This is the case before the communication failure).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you can see where this is a bit frustrating since the spoke router still has a perfectly viable path through the secondary hub to the entire AS, but OSPF completely drops all of the known routes to get there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can anyone tell me if this is a shortcoming of OSPF or a quagga bug?&lt;/strong&gt; Is there a configuration setting that would allow me to ignore mismatched DR/BDR in the hello packets? Would that be more dangerous than its worth?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I can work around the issue by doing a dual cloud DMVPN with only one DR at each data center, but that requires a bit more complexity, management overhead, and performance overhead. I'd really prefer to stick with a single cloud dual hub deployment if at all possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know if you need me to provide any more information!&#xA;(I tried to create DMVPN as a tag, but I don't have enough reputation here yet.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quick Note:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issuing a &lt;code&gt;show ip ospf database&lt;/code&gt; on the spoke router still shows the full link state database of the entire AS, yet quagga still does not commit the routes to the kernel routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More Info:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;tcpdump of OSPF Hello packets from the perspective of the spoke router (manually changed ip addresses and router ids, copy/pasted individually so ignore timestamps):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;21:13:43.643160 IP (tos 0xc0, ttl 1, id 25083, offset 0, flags [none], proto OSPF (89), length 68)&#xA;10.10.10.3 &amp;gt; 224.0.0.5: OSPFv2, Hello, length 48&#xA;Router-ID 1.1.1.3, Backbone Area, Authentication Type: none (0)&#xA;Options [External]&#xA;  Hello Timer 10s, Dead Timer 40s, Mask 255.255.255.0, Priority 0&#xA;  Designated Router 10.10.10.2, Backup Designated Router 10.10.10.2&#xA;  Neighbor List:&#xA;    1.1.1.2&#xA;21:13:37.736761 IP (tos 0xc0, ttl 1, id 32711, offset 0, flags [none], proto OSPF (89), length 72)&#xA;10.10.10.2 &amp;gt; 224.0.0.5: OSPFv2, Hello, length 52&#xA;Router-ID 1.1.1.2, Backbone Area, Authentication Type: none (0)&#xA;Options [External]&#xA;  Hello Timer 10s, Dead Timer 40s, Mask 255.255.255.0, Priority 254&#xA;  Designated Router 10.10.10.1&#xA;  Neighbor List:&#xA;    1.1.1.1&#xA;    1.1.1.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to bring a Cisco 2801 in as another spoke in my DMVPN topology described above. Simulating the partial connectivity results in the &lt;em&gt;exact same behavior&lt;/em&gt; on the Cisco spoke, as what I experience on the quagga spoke. Right down to the content of the hello packets between the Cisco and the secondary hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, more editing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After seeing the content of the secondary hub's hello packets change, even though it's &lt;em&gt;connectivity perspective&lt;/em&gt; hadn't changed, I wanted to try a different OSPF implementation. Specifically, the secondary hub's hello packets have listed the primary hub as the DR, and nothing as the BDR during the simulated communication failure. Even though it is quite happily still acting as a BDR. My thought was that perhaps a different OSPF implementation would still send the proper information in it's hello packets. I attempted to use &quot;bird&quot; as suggested in one of the answers, however it would not allow me to override the NBMA network type to broadcast, therefore it would not participate in my OSPF environment. So the next test was to configure a Cisco router as the secondary hub. I went through the process of setting it all up and then simulated the communication failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I suspected, the Cisco router still advertised it's hello packets correctly from it's perspective: The primary hub as the DR and the secondary hub as the BDR. I was hopeful that having at least one of the two matching properly in the hello packets from the spoke (both set to the secondary hub, remember) would be enough to have the spoke router keep the routes installed to the kernel to allow traffic to flow through the secondary hub to the rest of the network. Unfortunately, this was not the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More details, as requested:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;              xxxxxxx xxxx xx                   xxxxxxx xxxx xx&#xA;            xx              xxxx              xx              xxxx&#xA;            xx                 xxx            xx                 xxx&#xA;              x   Other Subnets  +--------------+   Other Subnets  x&#xA;               xx               xx               xx               xx&#xA;                 xxxxxxx+xxxxxxxx                 xxxxxxx+xxxxxxxx&#xA;                        |                                |&#xA;               +--------+--------+               +-------+----------+&#xA;               |                 |               |                  |&#xA;               |  Primary Hub    |               |  Secondary Hub   |&#xA;               |  id: 1.1.1.1    |               |  id: 1.1.1.2     |&#xA;               |                 |               |                  |&#xA;               +------+----------+               +-----------+------+&#xA;                      | .1                               .2  |&#xA;                      |        xxxxx xx                      |&#xA;                      |       xxxxxxx xxxx xx                |&#xA;                      |     xx              xxxx             |&#xA;                      |     xx                 xxx           |&#xA;                      +------+x    DMVPN Cloud   +-----------+&#xA;                              xxx  10.10.10.0/24 x&#xA;                                xx               xx&#xA;                                 xxxxxxx++xxxxxxxx&#xA;                                        |&#xA;                                        |&#xA;                                        | .3&#xA;                             +----------+-----------+&#xA;                             |                      |&#xA;                             |                      |&#xA;                             |     Spoke            |&#xA;                             |     id: 1.1.1.3      |&#xA;                             |                      |&#xA;                             |                      |&#xA;                             +----------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All interfaces connecting to the DMVPN subnet are &quot;gre1&quot;. Yes, the diagram really is that simple when looking at this at the GRE subnet layer. There are routable stub networks that live behind the spoke as well. I can see where the design and different implementations of OSPF potentially never accounted for a &lt;em&gt;node-to-node&lt;/em&gt; failure over a single &lt;em&gt;broadcast domain&lt;/em&gt;. Physically, in a local layer 2 network it would be highly unlikely to have that type of failure... possible but not likely. But because in this case the broadcast domain is &lt;strong&gt;virtual&lt;/strong&gt;, and extends &lt;strong&gt;over the internet&lt;/strong&gt;, the type of failure scenario described above is much more likely (I have seen it twice in the last year or so). Remember, from OSPF's perspective, the DMVPN is simply a normal layer 2 broadcast domain to use as a transit network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two primary purposes of a DMVPN. One is to ease the configuration and maintenance burden on the hub sites. You can actually run a branch on a dynamic IP if required or desired, and the hubs only need one configuration... not one for each branch. Second is that the technology allows for the dynamic establishment of &lt;em&gt;direct&lt;/em&gt;, and &lt;em&gt;encrypted&lt;/em&gt; spoke to spoke connectivity over the internet (even with a branch on a dynamic IP). Essentially a full mesh VPN, without the nightmare of a full mesh configuration. Both of these purposes are important to this project because as I grow this network from one spoke to 80, I won't have as high an administrative burden. And, when one branch calls the other over VoIP, the media packets are taking the shortest possible path, without having to hair-pin through a hub site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order for OSPF to correctly establish the direct routes, the GRE subnet must act as a virtual broadcast domain. What allows this to work over the internet is the NHRP protocol, which for the sake of argument can be considered like a layer 3 to layer 3 arp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Requested, here are the relevant OSPF configs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spoke:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf&#xA; ospf router-id 1.1.1.3&#xA; auto-cost reference-bandwidth 1024&#xA; passive-interface default&#xA; no passive-interface gre1&#xA; network &amp;lt;branch-subnet&amp;gt;/24 area 0.0.0.0&#xA; network 10.10.10.0/24 area 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Primary Hub:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf&#xA; ospf router-id 1.1.1.1&#xA; auto-cost reference-bandwidth 1024&#xA; passive-interface default&#xA; no passive-interface eth0&#xA; no passive-interface gre1&#xA; network 10.10.10.0/24 area 0.0.0.0&#xA; network &amp;lt;primary-transit-supernet&amp;gt;/26 area 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Secondary Hub:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf&#xA; ospf router-id 1.1.1.2&#xA; auto-cost reference-bandwidth 1024&#xA; passive-interface default&#xA; no passive-interface eth0&#xA; no passive-interface gre1&#xA; network 10.10.10.0/24 area 0.0.0.0&#xA; network &amp;lt;secondary-transit-supernet&amp;gt;/26 area 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10493" LastEditorUserId="10493" LastEditDate="2014-12-02T20:07:35.377" LastActivityDate="2017-08-14T14:28:13.693" Title="Quagga OSPF DR/BDR Mismatch: Losing Routes" Tags="|routing|vpn|ospf|layer3|quagga|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13152" PostTypeId="2" ParentId="13147" CreationDate="2014-11-21T16:52:32.717" Score="1" Body="&lt;p&gt;It kind of depends on how much data you will be moving &lt;em&gt;between&lt;/em&gt; these two external subnets. If you allow the HP to route directly between those subnets, you can have as many 1GB streams between them as you have ports configured for them. With &quot;router-on-a-stick&quot; (I've always called it vlan-on-a-stick, but same concept), you would be limited to just 1GB in total throughput between the vlans (leaving out the possibility of doing an lacp trunk between the SonicWALL and the HP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In doing this method, the third vlan would be considered a &quot;transit network&quot;, and would make it easier down the road as your network grows to implement a dynamic routing protocol, or to add more routers into the network, if the need ever arises.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HP switch would be acting as your layer 3 core, and you would have an IP address in each of the 3 vlans. The SonicWALL would need only an access port to the transit network, and it's own IP on that network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, a default route statement in the HP pointing to the SonicWALL's transit net ip address, and two static routes in the SonicWALL (one for each of your 'external' subnets) pointing back at the HP's transit net IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easy button is to simply run a vlan trunk to the SonicWALL, and put an address on each of the vlans you want to route for. I've done it this way in the past, and if you don't plan on heavy traffic, it's perfectly viable, and pretty easy to configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you could post some of your route statements in your attempts at setting up the transit net, I'm sure someone could help you get that straightened out.&lt;/p&gt;&#xA;" OwnerUserId="10493" LastActivityDate="2014-11-21T16:52:32.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13154" PostTypeId="5" CreationDate="2014-11-21T17:17:00.453" Score="0" Body="&lt;p&gt;MPLS fast reroute (FRR) refers to local protection methods such as one-to-one and many-to-one (facility) backup. In the general networking community, the term FRR has become a shorthand way of describing the entire spectrum of MPLS traffic protection mechanisms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/nog-mpls-frr/nog-mpls-frr.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/en_US/junos11.4/information-products/topic-collections/nog-mpls-frr/nog-mpls-frr.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7495" LastEditorUserId="7495" LastEditDate="2014-11-25T11:40:41.787" LastActivityDate="2014-11-25T11:40:41.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13155" PostTypeId="4" CreationDate="2014-11-21T17:17:00.453" Score="0" Body="For questions about FRR (Fast ReRoute), where it is a MPLS (Multiprotocol Label Switching) and IP resiliency technology to provide fast traffic recovery upon link or router failures for mission critical services. " OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2018-02-18T09:30:18.673" LastActivityDate="2018-02-18T09:30:18.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13156" PostTypeId="5" CreationDate="2014-11-21T17:35:16.757" Score="0" Body="&lt;p&gt;The iSCSI (Internet Small Computer Systems Interface) is a  a transport protocol for Internet aiming to be fully compliant with the standardized SCSI architecture model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.faqs.org/rfcs/rfc3720.html&quot; rel=&quot;nofollow&quot;&gt;http://www.faqs.org/rfcs/rfc3720.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7495" LastEditorUserId="7495" LastEditDate="2014-11-22T08:56:26.423" LastActivityDate="2014-11-22T08:56:26.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13157" PostTypeId="4" CreationDate="2014-11-21T17:35:16.757" Score="0" Body="The iSCSI (Internet Small Computer Systems Interface) is a  a transport protocol for Internet aiming to be fully compliant with the standardized SCSI architecture model." OwnerUserId="7495" LastEditorUserId="7495" LastEditDate="2014-11-22T02:07:56.617" LastActivityDate="2014-11-22T02:07:56.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13158" PostTypeId="5" CreationDate="2014-11-21T17:41:02.743" Score="0" Body="&lt;p&gt;L2TP (Layer Two Tunneling Protocol) extends the PPP model by allowing the L2 and PPP endpoints to reside on different devices interconnected by a packet-switched network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.faqs.org/rfcs/rfc3720.html&quot; rel=&quot;nofollow&quot;&gt;http://www.faqs.org/rfcs/rfc3720.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7495" LastEditorUserId="7495" LastEditDate="2014-11-23T02:17:38.890" LastActivityDate="2014-11-23T02:17:38.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13159" PostTypeId="4" CreationDate="2014-11-21T17:41:02.743" Score="0" Body="L2TP (Layer Two Tunneling Protocol) extends the PPP model by allowing the L2 and PPP endpoints to reside on different devices interconnected by a packet-switched network.  Use this tag for questions about L2TP" OwnerUserId="7495" LastEditorUserId="775" LastEditDate="2014-11-23T02:17:33.230" LastActivityDate="2014-11-23T02:17:33.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13160" PostTypeId="5" CreationDate="2014-11-21T17:44:03.640" Score="0" Body="&lt;p&gt;Point-to-Point Protocol over Ethernet (PPPoE) is a network protocol for encapsulating PPP frames inside Ethernet frames.&lt;/p&gt;&#xA;" OwnerUserId="7495" LastEditorUserId="8499" LastEditDate="2016-11-29T20:49:11.817" LastActivityDate="2016-11-29T20:49:11.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13161" PostTypeId="4" CreationDate="2014-11-21T17:44:03.640" Score="0" Body=" For questions about PPPoE (Point-to-Point Protocol over Ethernet), which provides a method to connect two PPP nodes by encapsulating PPP frames inside Ethernet frames." OwnerUserId="253" LastEditorUserId="8499" LastEditDate="2016-11-29T20:49:11.817" LastActivityDate="2016-11-29T20:49:11.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13163" PostTypeId="1" CreationDate="2014-11-21T18:46:26.443" Score="5" ViewCount="1966" Body="&lt;p&gt;On an ASA I can change the severity of a single syslog message by doing this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging message 713120 level notifications&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do this on a Cisco Router running 15.1 code? I am only collecting syslogs on level &lt;code&gt;notification&lt;/code&gt; but the syslog I want is set for level &lt;code&gt;informational&lt;/code&gt;. I don't want to log all informational because it becomes too much. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying this command but it's not working:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging message %FW-6-DROP_PKT level notification&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="949" LastEditorUserId="3191" LastEditDate="2014-11-21T23:14:37.827" LastActivityDate="2014-12-24T18:20:50.557" Title="Cisco IOS - Is it possible to change severity level of a single syslog message?" Tags="|cisco|cisco-ios|syslog|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13164" PostTypeId="2" ParentId="13151" CreationDate="2014-11-21T18:58:18.087" Score="2" Body="&lt;p&gt;To answer your question directly, this is expected behavior by OSPF and not a bug in Quagga.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So first, let's take a look at the DR/BDR section of the RFC.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Designated Router&#xA;    The Designated Router selected for the attached network.  The&#xA;    Designated Router is selected on all broadcast and NBMA networks&#xA;    by the Hello Protocol.  Two pieces of identification are kept&#xA;    for the Designated Router: its Router ID and its IP interface&#xA;    address on the network.  The Designated Router advertises link&#xA;    state for the network; this network-LSA is labelled with the&#xA;    Designated Router's IP address.  The Designated Router is&#xA;    initialized to 0.0.0.0, which indicates the lack of a Designated&#xA;    Router.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Backup Designated Router&#xA;    The Backup Designated Router is also selected on all broadcast&#xA;    and NBMA networks by the Hello Protocol.  All routers on the&#xA;    attached network become adjacent to both the Designated Router&#xA;    and the Backup Designated Router.  The Backup Designated Router&#xA;    becomes Designated Router when the current Designated Router&#xA;    fails.  The Backup Designated Router is initialized to 0.0.0.0,&#xA;    indicating the lack of a Backup Designated Router.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the BDR field in the Hello packet header is set to 0.0.0.0, it means you &lt;strong&gt;do not&lt;/strong&gt; have a BDR elected.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case this is because you have your other router set to a priority of 0, this makes the router ineligible to become a BDR (this is why you see &quot;DROther&quot; and not &quot;BDR&quot;).  You just need to set the priority on your other router to something that isn't 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the other piece from the RFC for some more context.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Router Priority&#xA;    An 8-bit unsigned integer.  When two routers attached to a&#xA;    network both attempt to become Designated Router, the one with&#xA;    the highest Router Priority takes precedence.  A router whose&#xA;    Router Priority is set to 0 is ineligible to become Designated&#xA;    Router on the attached network.  Advertised in Hello packets&#xA;    sent out this interface.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow&quot;&gt;https://www.ietf.org/rfc/rfc2328.txt&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2014-11-21T19:17:56.643" LastActivityDate="2014-11-21T19:17:56.643" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13165" PostTypeId="2" ParentId="13163" CreationDate="2014-11-21T19:12:04.187" Score="0" Body="&lt;p&gt;You have a syntax issue, you need to indicate the syslog message ID, not the message itself.  There may also be sub messages under &quot;FW-6-DROP_PKT&quot;, so you might have to change multiple IDs.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;logging message &lt;strong&gt;713120&lt;/strong&gt; level notifications&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This works because the ID points directly at the syslog message specifically.  (see &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logmsgs.html#pgfId-4775683&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logmsgs.html#pgfId-4775683&lt;/a&gt;) &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;logging message &lt;strong&gt;%FW-6-DROP_PKT&lt;/strong&gt; level notification&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This doesn't because %FW-6-DROP_PKT is not a valid ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can paste the full syslog message(s) you're wanting to change, I could edit my answer to be a bit more helpful.  &lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2014-11-21T19:12:04.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13168" PostTypeId="2" ParentId="9693" CreationDate="2014-11-22T00:58:06.893" Score="2" Body="&lt;p&gt;Configure your devices to send SNMP Traps and Syslog messages when your ports become err-disabled and have your monitoring system collect these.&lt;/p&gt;&#xA;" OwnerUserId="4547" LastActivityDate="2014-11-22T00:58:06.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13171" PostTypeId="1" CreationDate="2014-11-22T13:18:13.103" Score="0" ViewCount="87" Body="&lt;p&gt;Is it valid to say that the complexity of ARP requests in a broadcast domain increases squared to the number of participants, as in the worst case every participant wants to address every other participant in the domain?&lt;/p&gt;&#xA;" OwnerUserId="10519" LastEditorUserId="33" LastEditDate="2015-07-07T18:47:57.207" LastActivityDate="2015-07-07T18:47:57.207" Title="ARP request complexity squared?" Tags="|mac-address|arp|broadcast|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13172" PostTypeId="5" CreationDate="2014-11-22T14:32:08.340" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-11-22T14:32:08.340" LastActivityDate="2014-11-22T14:32:08.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13173" PostTypeId="4" CreationDate="2014-11-22T14:32:08.340" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2014-11-22T14:32:08.340" LastActivityDate="2014-11-22T14:32:08.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13174" PostTypeId="1" AcceptedAnswerId="13384" CreationDate="2014-11-22T14:59:31.147" Score="4" ViewCount="1839" Body="&lt;p&gt;I am trying to solve problem about configuration of transparent proxy server. &#xA;I don't have any configuration on devices, I have not started yet. Because of preparing and studying that topic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am starting to be little bit confused how the GRE tunnel for encapsulation of packets works. In fact I know how GRE tunnels works but with the configuration of wccp &amp;lt;-&gt; squid it seems to be different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco official documentation says, GRE tunnels are created automatically. Why not... Less works for me. But I have to configure GRE tunnel on server side. Thats what squid documentation says, by the way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router IP address       = 192.168.1.254&lt;/li&gt;&#xA;&lt;li&gt;Local engine with squid = 192.168.1.253&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For debian I use following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip tunnel add wccp0 mode gre remote 192.168.1.254 local 192.168.1.253 dev eth0&#xA;ifconfig wccp0 192.168.1.253 netmask 255.255.255.255 up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I don't have to specify GRE IP address? As in normal situation of site to site tunnel, when I have to? How it works? Cisco router and proxy server will negotiate IP address for GRE encapsulation automatically? Which IP addresses they will use? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each manual or HOWTO on internet looks pretty different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be very glad for any answer.&#xA;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Daniel&lt;/p&gt;&#xA;" OwnerUserId="10520" LastActivityDate="2020-01-08T06:37:25.180" Title="Transparent proxy (wccp and squid)" Tags="|cisco|gre|http-proxy|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13175" PostTypeId="2" ParentId="7297" CreationDate="2014-11-22T15:02:43.273" Score="3" Body="&lt;p&gt;I'm inclined to believe that it is your caps/non-caps on the bandwidth designations (i.e. &lt;code&gt;-b 10M -l 32K -w 128K&lt;/code&gt;). I can't test it because we don't know what version you're running.  Iperf does make a distinction between bits and bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-f, --format    [kmKM]   format to report: Kbits, Mbits, KBytes, MBytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Though, the sections you were modifying were strictly &lt;code&gt;K&lt;/code&gt; or &lt;code&gt;M&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-b, --bandwidth #[KM]    for UDP, bandwidth to send at in bits/sec&#xA;                         (default 1 Mbit/sec, implies -u)&#xA;-l, --len       #[KM]    length of buffer to read or write (default 8 KB)&#xA;-w, --window    #[KM]    TCP window size (socket buffer size)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I can, however, tell you that getting your version up to current will render this issue obsolete. Iperf version 2.0.5 (08 Jul 2010) makes no distinction between the 2 different types in those fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is your exact cli syntax working for one of my private servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Server:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@AFP001SRV01:~# iperf -s -u&#xA;------------------------------------------------------------&#xA;Server listening on UDP port 5001&#xA;Receiving 1470 byte datagrams&#xA;UDP buffer size:  208 KByte (default)&#xA;------------------------------------------------------------&#xA;[  3] local 127.0.0.1 port 5001 connected with 127.0.0.1 port 40974&#xA;[ ID] Interval       Transfer     Bandwidth        Jitter   Lost/Total Datagrams&#xA;[  3]  0.0-10.0 sec   550 KBytes   449 Kbits/sec   0.017 ms    0/  383 (0%)&#xA;^C&#xA;root@AFP001SRV01:~# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Client:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@AFP001SRV01:~# iperf -c 127.0.0.1  -b 10m -l 32k -w 128k&#xA;WARNING: option -b implies udp testing&#xA;------------------------------------------------------------&#xA;Client connecting to 127.0.0.1, UDP port 5001&#xA;Sending 32768 byte datagrams&#xA;UDP buffer size:  256 KByte (WARNING: requested  128 KByte)&#xA;------------------------------------------------------------&#xA;[  3] local 127.0.0.1 port 40542 connected with 127.0.0.1 port 5001&#xA;[ ID] Interval       Transfer     Bandwidth&#xA;[  3]  0.0-10.0 sec  12.0 MBytes  10.0 Mbits/sec&#xA;[  3] Sent 383 datagrams&#xA;[  3] Server Report:&#xA;[  3]  0.0-10.0 sec   550 KBytes   449 Kbits/sec   0.008 ms    0/  383 (0%)&#xA;root@AFP001SRV01:~# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-11-22T15:02:43.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13176" PostTypeId="2" ParentId="13151" CreationDate="2014-11-22T15:03:44.617" Score="0" Body="&lt;p&gt;Quagga losing routes was my primary reason to switch to bird. Over some time I am running a corporate VPN with hundreds of branch-offices, linked through the ipsec/gre/whatever point-to-point tunnels. On some branch offices I was using the FreeBSD/quagga setups. The issue was - in a OSPF router chain like A - B - C the prefix originated from A was seen on B, but not on C. After months of struggling, finding no solution, and seeing this situation spontaneously arises and clears it self with quagga (and with no proprietary vendors like Cisco or Juniper) and various prefixes, I switched to bird. Now the problem is gone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may call this lame. You may say I should report this and help communnity to fix it. But for me quagga and it's bugtracker seems to be for a long time some kind of post-nuclear desert, where sporadic groups of friendly developers may be encountered, but more likely you will die of dehydration or some bug. Bird is developed more intensively, and it's mailing list is more populated with developrs and practical help.&lt;/p&gt;&#xA;" OwnerUserId="10496" LastActivityDate="2014-11-22T15:03:44.617" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="13177" PostTypeId="1" CreationDate="2014-11-22T18:24:12.593" Score="3" ViewCount="124" Body="&lt;p&gt;Some of the employees of our company telecommute via a Juniper SSG5 VPN FW in their home. The company no longer supports this router, but they are not proactively forcing users off. However, there is not another telecommuting option.  The employees obviously want to preserve the life of this router for as long as they can. Short of saying prayers over it each nite, is there anything else they can do to keep it working? The company tells them to keep it clean, ventilated and not to power cycle it often.  What else can they do to keep this Juniper router working as long as possible?&lt;/p&gt;&#xA;" OwnerUserId="10523" LastEditorUserId="10523" LastEditDate="2014-11-23T13:47:39.983" LastActivityDate="2014-11-23T13:47:39.983" Title="Best way to prolong the life of a Juniper router" Tags="|juniper|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13179" PostTypeId="2" ParentId="13016" CreationDate="2014-11-22T20:01:22.620" Score="0" Body="&lt;p&gt;Short answer: &lt;strong&gt;RTFM&lt;/strong&gt;.&#xA;&lt;a href=&quot;http://www.dlink.com/-/media/Business_Products/DFL/DFL%20860E/Manual/DFL%20860E_User%20Manual_EN_US.pdf&quot; rel=&quot;nofollow&quot;&gt;DFL 860E User Manual&lt;/a&gt; Chapter 7 &quot;Address Translation&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My specific problem is addressed on Section 7.4.1. I need to allow my internal server to use my router's IP when replying to a remote device, we need to define a NAT rule for this. Then, we also need to Allow traffic to go from my lan or DMZ into the internet, this means also a new IP rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case, configuration should add &lt;strong&gt;three IP rules&lt;/strong&gt; like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SAT RULE:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source: any as Interface, all-nets as Network&lt;/li&gt;&#xA;&lt;li&gt;Destination: core as Interface, wan1_ip as Network (public IP, assigned to this router)&lt;/li&gt;&#xA;&lt;li&gt;Service is http-in in my case&lt;/li&gt;&#xA;&lt;li&gt;Webserver local IP goes on the SAT tab.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;NAT RULE&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source: lan as Interface, lan-net as Network (or DMZ if you're using one, which you should)&lt;/li&gt;&#xA;&lt;li&gt;Destination: any as Interface, all-nets as Network.&lt;/li&gt;&#xA;&lt;li&gt;Service can either be &quot;all_services&quot;, or http_in in my case according to the manual. I chose the later.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;ALLOW RULE&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source: any as Interface, all-nets as Network.&lt;/li&gt;&#xA;&lt;li&gt;Destination: core as Interface, wan1_ip as Network.&lt;/li&gt;&#xA;&lt;li&gt;Service is again, http-in for my case&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope this helps somebody.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers.&lt;/p&gt;&#xA;" OwnerUserId="10380" LastActivityDate="2014-11-22T20:01:22.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13181" PostTypeId="2" ParentId="13177" CreationDate="2014-11-22T22:28:15.443" Score="2" Body="&lt;p&gt;Well it's going to be roughly the same concepts as any device, take a look at the datasheet - vendors do pretty extensive testing into how long things would last, and their optimal operating environment.  You might want to ask your telecom guys if you still have support through Juniper on the device, just because your company doesn't directly support it, doesn't mean they can't do you a favor and call Juniper should something catastrophic happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the SSG5 datasheet - &lt;a href=&quot;http://www.juniper.net/assets/us/en/local/pdf/datasheets/1000176-en.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/assets/us/en/local/pdf/datasheets/1000176-en.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Operating temperature 32° to 104° F (0° to 40° C)&lt;/li&gt;&#xA;&lt;li&gt;Humidity 10% to 90% noncondensing&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Other than that, you obviously do want to keep it well ventilated like you mentioned, which is pretty easy as its such a small device, just don't close it in a cabinet forever.  Make sure if you are wiping it down for dust, you're just doing it with a cloth and not something like Pledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And to comment on the note of powering it off every night, that's not going to help it last any longer really, your telecom guys are right.  These things are designed with the intention that they can run for years.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2014-11-22T22:28:15.443" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13182" PostTypeId="1" AcceptedAnswerId="13183" CreationDate="2014-11-22T23:56:11.720" Score="8" ViewCount="4595" Body="&lt;p&gt;We are planning to remove VTP from a production network that has RPVST running. This is at the core (a pair of Cisco 3750s) and we are trying to weigh the impact it has on the production network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory, this should not effect anything, the VLANs are already in the switches' VLAN database and they would continue humming along. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This following is quoted from the Cisco 3560 configuration guide.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note: You can use the vtp mode transparent global configuration&#xA;  command to disable VTP on the switch and then to change its VLAN&#xA;  information without affecting the other switches in the VTP domain.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I may have answered own question above but the real question really is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Has anyone done this configuration before to test the theory above?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="5330" LastEditorUserId="5330" LastEditDate="2014-11-25T12:36:18.413" LastActivityDate="2014-11-25T16:17:14.747" Title="Impact of removing VTP from a production network" Tags="|cisco|switch|vtp|cisco-3750|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13183" PostTypeId="2" ParentId="13182" CreationDate="2014-11-23T01:24:09.500" Score="9" Body="&lt;p&gt;In theory, you'll want to migrate the clients to transparent before you remove the server from the equation.  This makes absolute certain that things will continue to function without any gotchas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice, it doesn't matter.  A server will just stop sending summary advertisements to the VTP domain and the clients will continue using the last seen revision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We just went through this on one of our tiny, alternate networks.  Someone completely wiped out the VTP server and it went unnoticed for months before anyone looked.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-11-23T20:01:32.897" LastActivityDate="2014-11-23T20:01:32.897" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13184" PostTypeId="1" AcceptedAnswerId="13189" CreationDate="2014-11-23T02:47:21.340" Score="4" ViewCount="8608" Body="&lt;p&gt;I have some pre-8.3 ASAs that I'm planning to upgrade to standardize on the new NAT semantics.  I am aware of the big changes between pre-8.3 and 8.3+ from &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7028/upgrading-asa-and-asdm-on-a-asa5510&quot;&gt;these&lt;/a&gt; &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/8/migrating-pre-8-3-asa-config-to-8-3?rq=1&quot;&gt;two&lt;/a&gt; great Q&amp;amp;As.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is unclear to me is how to choose from the numerous 8.3+ ASA software releases available to me.  This is what the software release tree looks like in my Cisco support portal:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2wmgt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2wmgtm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IOS Cisco published &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-121-t/15071-choosing-ios.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;How to Choose IOS Software Release&lt;/a&gt; which, among other things, defines the nomenclature for the version numbers (ie. format &lt;code&gt;A.B(C)D&lt;/code&gt;) and software image type (ie. &lt;code&gt;ED&lt;/code&gt; vs. &lt;code&gt;GD&lt;/code&gt; etc).  I have not found an equivalent document for ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Surely there is some careful release engineering going on by Cisco to strive for stability in some ASA releases and new features in others.  I haven't, however, found any document that helps me to sort between the two priorities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I expect to read the release notes to establish what features are available in each release, but without other information I'd still be guessing at how stable each release is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess I'm left with the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In general, how do you decide which ASA software release to upgrade to?&lt;/li&gt;&#xA;&lt;li&gt;Is there a way to get a sense for how stable a particular release is?&lt;/li&gt;&#xA;&lt;li&gt;What does the &lt;code&gt;.ED&lt;/code&gt; suffix mean?  What does a numeric &lt;code&gt;.x&lt;/code&gt; suffix mean?&lt;/li&gt;&#xA;&lt;li&gt;Can I glean stability of a release based on the age of major and minor releases?  For example, should I expect &lt;code&gt;8.4.7.ED&lt;/code&gt; to be more stable than &lt;code&gt;9.2.1.ED&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2662" LastActivityDate="2014-11-24T15:05:44.330" Title="How to choose Cisco ASA software release" Tags="|cisco-asa|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13186" PostTypeId="1" AcceptedAnswerId="13187" CreationDate="2014-11-23T11:24:09.580" Score="0" ViewCount="208" Body="&lt;p&gt;I want to set up a wireless router to connect wireless devices with the rest of the network. I'm no specialist, so I'm not sure how to ask this question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the devices in the sub-network to be included in the main network, so that it would not make a difference wether you connect them to the wireless router or to the main network router. They should all be able to communicate as if they were all in one network. (have the same Irange and stuff like that)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen a similar question with the same problem, but it only needs cable devices to work, so a switch is a really simple solution. However, I need this to work with wireless devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What settings should I use?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im sorry for the bad explanation, but as I said I'm no specialist.&lt;/p&gt;&#xA;" OwnerUserId="10532" LastEditorUserId="775" LastEditDate="2014-12-08T12:06:56.313" LastActivityDate="2015-02-06T09:06:01.320" Title="single network with two routers" Tags="|router|subnet|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13187" PostTypeId="2" ParentId="13186" CreationDate="2014-11-23T11:32:40.197" Score="2" Body="&lt;p&gt;Many wireless routers allow you to configure them in bridge mode, where you connect the uplink of the wireless router to a switch port on your main router, and it broadcasts a wireless network (with whatever settings you like). Any traffic from clients connected to the wifi is then relayed back/forth onto the wired router as if they were connected directly. Perhaps that is what you'd like?&lt;/p&gt;&#xA;" OwnerUserId="10095" LastActivityDate="2014-11-23T11:32:40.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13189" PostTypeId="2" ParentId="13184" CreationDate="2014-11-23T13:35:28.967" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;In general, how do you decide which ASA software release to upgrade to?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If the newest major release has been out for a while, I look at the release notes to get a sense if there are no bugs that would affect my network and pick a minor version based on that.  Else, I go with the newest version of the second-newest major release--assuming that doesn't have open bugs that would affect my network.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Is there a way to get a sense for how stable a particular release is?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Absolutely, look at the open caveats in the release notes.  For software that's been in the wild for a reasonable amount of time, the shorter the list of open caveats, the better.  This has held true in my experience going back to 6.x.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;What does the .ED suffix mean? What does a numeric .x suffix mean?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;ED = early deployment -- &quot;Early Deployment releases offer new feature, platform, or interface support. Most non-major releases contain ED releases.&quot;  This is a flag to tell you that there's something new--read the release notes as you say but it's usually benign in my experience.  A fourth number (.x in your question) is a &quot;interim release&quot; that replaces another version previously released.  For 8.4(4.1) (&quot;8.4.4.1&quot; above) there was a &quot;build problem&quot; with 8.4(4) so 8.4(4.1) was put out to replace it.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Can I glean stability of a release based on the age of major and minor releases? For example, should I expect 8.4.7.ED to be more stable than 9.2.1.ED?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Maybe.  I'd definitely say 8.4.7, as an example, would be more stable than 9.0 or 9.1, but a point-2 release could have reached sufficient maturity.  It really depends on the open caveats and your specific config and use case.&lt;/p&gt;&#xA;" OwnerUserId="8079" LastActivityDate="2014-11-23T13:35:28.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13191" PostTypeId="1" AcceptedAnswerId="24974" CreationDate="2014-11-23T18:49:09.770" Score="3" ViewCount="661" Body="&lt;p&gt;Given the requirements that a standard Cat 5e cable must live up to, is it possible to transfer data over it faster than the 1 Gbit for maximum 100 meters of cable for 1000BASE-T?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My old ADSL line used the same phone line that my even older 56K modem used, but achieved much higher speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, I realize the switches and/or routers that this Cat 5e cabling is connected to must also be replaced, but that's a lot cheaper than replacing cabling, at least in countries where labor is expensive relative to cost of materials.&lt;/p&gt;&#xA;" OwnerUserId="10536" LastEditorUserId="8499" LastEditDate="2018-03-21T00:43:04.887" LastActivityDate="2018-03-21T00:43:04.887" Title="Is it possible to reliably transfer data faster than 1 Gbit/s over Cat 5e cable?" Tags="|layer1|cabling|utp|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13192" PostTypeId="1" AcceptedAnswerId="13199" CreationDate="2014-11-23T19:35:51.820" Score="8" ViewCount="11020" Body="&lt;p&gt;Recently I had a discussion about differences between TCP and UDP, and the other person insisted that there's a difference in packet forwarding: The packets in a TCP connection follow an established path, so that in a diamond configuration where a host has two paths to another host a connection will use only one path. Moreover, if a path is broken the TCP connections on it will not use the other path, they will time out instead. UDP traffic is not affected in any way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This goes against what I've learned about packet forwarding in general, but I haven't been able to confirm or deny it. Is it true? Why would switches give TCP connections this special treatment, doesn't it make the network less reliable in general? &lt;/p&gt;&#xA;" OwnerUserId="10537" LastEditorUserId="8499" LastEditDate="2016-12-19T05:19:56.320" LastActivityDate="2016-12-19T05:19:56.320" Title="Packet forwarding in TCP vs UDP" Tags="|routing|tcp|switching|udp|layer4|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13193" PostTypeId="2" ParentId="13192" CreationDate="2014-11-23T20:12:34.960" Score="11" Body="&lt;p&gt;Transport of both UDP and TCP packets from one router to the next is done at the IP layer and solely based on the information at this layer. This means, that there is no distinction between UDP and TCP and in both cases change of path, congestion or router hickups can cause loss, duplication or reordering of packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, contrary to UDP, TCP can deal with duplication and reordering due to the sequence number in each packet and with packet loss by acknowledging packets and retransmitting unacknowledged packets. But this kind of repair is only done at the endpoints of the communication.&lt;/p&gt;&#xA;" OwnerUserId="4063" LastActivityDate="2014-11-23T20:12:34.960" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13194" PostTypeId="2" ParentId="13192" CreationDate="2014-11-23T20:49:02.143" Score="3" Body="&lt;p&gt;You're correct, not the person you were speaking to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP establishes a connection between a &quot;client&quot; and &quot;server&quot;, anything in between is just the the paths.  It doesn't care &lt;strong&gt;how&lt;/strong&gt; the traffic gets there, just that it does get there (using the built in sequence numbers, acknowledgments, and congestion avoidance capabilities).  In your diamond example, you load share over both of the middle routers, you could just have one primary and one backup path, etc.  It doesn't matter, as long as IP reachability is present, TCP can handle the loss.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2014-11-23T20:49:02.143" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13195" PostTypeId="2" ParentId="13191" CreationDate="2014-11-23T21:05:03.043" Score="3" Body="&lt;p&gt;So you're almost on the way to answering your own question.  It might be possible to push more data down CAT5(e)/CAT6, but the hardware would have to support it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is really not &quot;whats possible&quot; more than &quot;whats feasible&quot;.  There are already a lot of ways to scale between 1G and 10G.  The development cost of hardware to push, let's say, 4G or 8G isn't really worth it as we already have fiber optics that can push 10G over even longer distances.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the concern is shorter distances of ~100m, and you know that hardware would have to be replaced anyway, fiber is the way to go.  Fiber optics are cheap as long as you don't buy major vendor branded transceivers (SFP/XFP) as $1000+ each, you can buy commodity transceivers for a couple hundred bucks - and the hardware to physically support them isn't any different.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2014-11-23T21:05:03.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13196" PostTypeId="2" ParentId="13191" CreationDate="2014-11-23T21:09:43.183" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Given the requirements that a standard Cat 5e cable must live up to, is it possible to transfer data over it faster than the 1 Gbit for maximum 100 meters of cable for 1000BASE-T?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You have answered your own question without realizing it.  1000BaseT cannot exceed 1Gbps, because 1000Base-T refers to hardware standard (&lt;a href=&quot;http://en.wikipedia.org/wiki/802.3ab&quot; rel=&quot;nofollow&quot;&gt;IEEE 802.3ab&lt;/a&gt;).  &lt;a href=&quot;http://en.wikipedia.org/wiki/802.3ab&quot; rel=&quot;nofollow&quot;&gt;IEEE 802.3ab&lt;/a&gt; includes specifications for not only the cabling, but also the chips in your NIC, which terminate the cabling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now can someone else come along and create a protocol standard for Cat5e, which exceeds 1Gbps?  That's possible, but we can only speculate about the future.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My old ADSL line used the same phone line that my even older 56K modem used, but achieved much higher speeds.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's because ADSL uses a different &lt;a href=&quot;http://en.wikipedia.org/wiki/Asymmetric_digital_subscriber_line#ADSL_standards&quot; rel=&quot;nofollow&quot;&gt;protocol standard&lt;/a&gt; than old 56k async modems used.  ADSL uses signal processing techniques that were foreign to the consumer market when async modems were invented.  Those signal processing techniques (and restrictions on distance) give ADSL a big advantage.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-11-23T21:09:43.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13199" PostTypeId="2" ParentId="13192" CreationDate="2014-11-23T21:58:08.880" Score="10" Body="&lt;p&gt;Actually there is &lt;em&gt;some&lt;/em&gt; truth in what the other person was saying, though it is largely false.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Is it true (that packets in a TCP connection follow an established path)?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Yes, in general, all packets in a TCP stream will follow the same path through the network - even in the presence of a &quot;diamond&quot; network, all packets in the same stream will be routed down the same side of the diamond. However, it's not true that if that side of the diamond goes down, the TCP stream will time out - in that case it will be rerouted and its path will change.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Why would switches give TCP connections this special treatment?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here I'll answer why switches and routers will always try to send packets in a stream along the same side of a &quot;diamond&quot;, hopefully giving some insight into where your interlocutor got their (flawed) understanding of the situation. The brief answer is &quot;performance&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Background: While it's true that TCP &lt;em&gt;can&lt;/em&gt; handle reordered packets successfully, in practice reordering tends to cause significant performance issues. For instance, if the other end sees packets in the order &quot;1 2 4 3&quot;, it will notice when it sees packet 4 that it has not yet seen packet 3, and request for the other end to resend it - and it will then receive packet 3 twice (the one originally sent plus the resend). This results in bandwith being wasted (by sending packets twice unnecessarily), and also in reduced connection performance, since the sender will assume the &quot;packet loss&quot; it thinks it has seen is due to congestion, so it will slow down its sending.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore most quality switches and routers will go to quite some lengths to avoid packet reordering, and as part of this will try to send all packets from the same TCP stream along the same path (in case one path has higher latency than the other).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Contrary to what others have said, this happens even for core routers. Where there are multiple links that are being load-balanced over, the router will try to send packets from the same TCP stream over the same link. Although this might seem to require the tracking of a huge amount of state, in fact it can be done without tracking all of the streams: the router takes the identifiers of the stream (source/destination IP address, and sometimes source/destination port), and combines them (&lt;em&gt;hashes&lt;/em&gt; them) into a single number. This number is used to select which link to send the packet on. (To give an example of one vendor's implementation of this feature, search for &lt;code&gt;ip cef load-sharing algorithm&lt;/code&gt;.)&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Doesn't it make the network less reliable in general?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Yes, of course it would, if networks did exactly what your interlocutor described - so they don't do that. The behaviour the other person talked about where a path is dropped and TCP connections using that path time out is not typical: though it may be possible to configure some products to behave like this, in general both TCP and UDP will start to use the alternative route straight away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a link goes down, the hashes will be redistributed across the remaining links. This will result in TCP streams changing their paths - which may sometimes result in some reordering - but this is generally acceptable as it happens occasionally, rather than on every packet.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Other relevant information&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The discussion was originally about the difference between handling of TCP and UDP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, all of the above handing is done for UDP packets too: that is, UDP packets from the same &quot;connection&quot; will also typically always follow the same path. This is desirable since UDP packets are often used for realtime media streams such as phone calls - if many of your voice packets arrive out of order, this can result in terrible audio quality (since for a phone call large buffering is highly undesirable, so the received will typically drop packets that arrive out of sequence).&lt;/p&gt;&#xA;" OwnerUserId="10539" LastEditorUserId="10539" LastEditDate="2014-11-24T09:38:04.590" LastActivityDate="2014-11-24T09:38:04.590" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13200" PostTypeId="2" ParentId="13191" CreationDate="2014-11-23T23:28:40.907" Score="0" Body="&lt;p&gt;Yes, it is possible, though substandard and not recommended. There exists a 10GBase-T standard ( &lt;a href=&quot;http://en.wikipedia.org/wiki/10-gigabit_Ethernet#10GBASE-T&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/10-gigabit_Ethernet#10GBASE-T&lt;/a&gt; ) and the equipment is pretty cost efficient, but it requires Cat-6 cabling. But if the distances are not extreme and your cabling was done good, and the patch panels are good and there's no much interference - you may attain 10G speeds on Cat-5e. It worked for me using Intel X520-T cards and 5e cabling at least up to 25ft.&#xA;Buy a couple of cards off ebay, find a longest path in your cabling system and try these two cards peer to peer (without a switch first). If they establish a link at 10G then try to send some data over for a few hours and see how many errors you'll have in the card statistics. If the stats are OK, transmission speeds are acceptable then you're good to go. Just remember that you're exceeding the standard and taking a risk.&lt;/p&gt;&#xA;" OwnerUserId="10542" LastActivityDate="2014-11-23T23:28:40.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13201" PostTypeId="1" AcceptedAnswerId="13212" CreationDate="2014-11-24T06:43:40.553" Score="3" ViewCount="797" Body="&lt;p&gt;First of all, I am fairly new to TCP, sorry if I miss anything obvious.&#xA;Also, any suggestion to help me investigate are welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;from my understanding, if I have a setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SENDER------SWITCH------RECEIVER&#xA;        A           B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if both link A &amp;amp; B have 0% loss rate &amp;amp; 100Mbps bandwidth but:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;scenario 1) A has 1~301ms delay and B has 1ms&lt;/strong&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/D4Hae.png&quot; alt=&quot;scenario 1) A has 1~301ms delay and B has 1ms&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;scenario 2) A has 1~151ms delay and B has 1~151ms&lt;/strong&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/AhAqW.png&quot; alt=&quot;scenario 2) A has 1~151ms delay and B has 1~151ms&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;since the total delay of the network should be the same in both scenarios, &lt;strong&gt;shouldn't the graph of throughput against time on sender side looks exactly the same?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;take the 60ms line in both graphs for example. Although the total delay in scenario 2 is still 60ms in the network, it never encounters another congestion event between around second 1 and until it hits bandwidth cap, not like scenario 1 which had many.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the two major concern are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;why does the shape of low latency line during the early stage be different?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;why do some previously unable-to-reach-cap cases could now reach the cap?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;some background info that might/might not help:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I used mininet(virtual network with ubuntu) for the test setup.&lt;/li&gt;&#xA;&lt;li&gt;linux, so TCP CUBIC for congestion avoidance algo. &lt;/li&gt;&#xA;&lt;li&gt;the iperf command used&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;recvr.cmd('iperf -s -p', port, '&gt; %s/iperf_server.txt' % args.dir, '&amp;amp;')&#xA;sender.sendCmd('iperf -c %s -p %s -t %d -i 1 -yc &gt; %s/iperf_%s.txt' % (recvr.IP(), port, seconds, args.dir, 'h1'))&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;cwnd for link A 121ms delay, link B 1ms (scenario 1, 120ms line)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/HOWqw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/li&gt;&#xA;&lt;li&gt;cwnd for link A 61ms delay, link B 61ms (scenario 2, 120ms line)&#xA;&lt;img src=&quot;https://i.stack.imgur.com/tn8rA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10549" LastEditorUserId="42290" LastEditDate="2017-12-13T12:03:49.533" LastActivityDate="2017-12-13T12:03:49.533" Title="when plot throughput vs time, why 2 links with X delay each differs with 1 link with 2X delay?" Tags="|tcp|throughput|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13204" PostTypeId="1" CreationDate="2014-11-24T10:36:57.130" Score="1" ViewCount="266" Body="&lt;p&gt;This is a small site in the 3rd and 4th floor of the building. We deployed 3 AP's in the Third floor and 2 AP's in the fourth floor. Additionally a new AP is configured and yet to set in the fourth floor. There is no problem in the 4the floor but in the 3rd floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Site survey is not taken by the previous engineer who setup this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AP1 and AP3 are working fine but the AP2 is having problem. Users near the AP2 having limited connectivity problem though they are close to the AP. So thought there might be some interference and disconnected the AP1. Found it is working quite well for all the users.&#xA;Though sometimes users are thrown out of the network. Still some users saying the fourth floor AP is connecting and found working fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most users are using MAC. 802.11b/g clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configured only single SSID &quot;KPH-3 SAL&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TAC support suggested this on the radio interface 0 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#speed basic-1.0 basic-2.0 basic-5.5 basic-6.0 basic-9.0 basic-11.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is my configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname KPH-3-SAL-AP2&#xA;!&#xA;!&#xA;logging rate-limit console 9&#xA;enable secret 5 &amp;lt;removed&amp;gt;&#xA;!&#xA;no aaa new-model&#xA;no ip source-route&#xA;no ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;dot11 syslog&#xA;dot11 activity-timeout unknown default 25000&#xA;!&#xA;dot11 ssid KPH-3 SAL&#xA;   vlan 10&#xA;   authentication open&#xA;   authentication key-management wpa version 2&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 &amp;lt;removed&amp;gt;&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;username CISCO password 7 &amp;lt;removed&amp;gt;&#xA;!&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption vlan 10 mode ciphers aes-ccm&#xA; !&#xA; ssid KPH-3 SAL&#xA; !&#xA; antenna gain 0&#xA; stbc&#xA; beamform ofdm&#xA; mbssid&#xA; speed  basic-1.0 basic-2.0 basic-5.5 basic-11.0 basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0&#xA; packet retries 128 drop-packet&#xA; station-role root&#xA; no dot11 extension aironet&#xA;!&#xA;interface Dot11Radio0.1&#xA; encapsulation dot1Q 1 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.10&#xA; encapsulation dot1Q 10&#xA; no ip route-cache&#xA; bridge-group 10&#xA; bridge-group 10 subscriber-loop-control&#xA; bridge-group 10 spanning-disabled&#xA; bridge-group 10 block-unknown-source&#xA; no bridge-group 10 source-learning&#xA; no bridge-group 10 unicast-flooding&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; !&#xA; encryption vlan 10 mode ciphers aes-ccm&#xA; !&#xA; ssid KPH-3 SAL&#xA; !&#xA; antenna gain 0&#xA; peakdetect&#xA; no dfs band block&#xA; stbc&#xA; beamform ofdm&#xA; mbssid&#xA; speed  basic-12.0 18.0 24.0 36.0 48.0 54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15.&#xA; packet retries 128 drop-packet&#xA; channel dfs&#xA; station-role root&#xA; no dot11 extension aironet&#xA;!&#xA;interface Dot11Radio1.1&#xA; encapsulation dot1Q 1 native&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1.10&#xA; encapsulation dot1Q 10&#xA; bridge-group 10&#xA; bridge-group 10 subscriber-loop-control&#xA; bridge-group 10 spanning-disabled&#xA; bridge-group 10 block-unknown-source&#xA; no bridge-group 10 source-learning&#xA; no bridge-group 10 unicast-flooding&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0.1&#xA; encapsulation dot1Q 1 native&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; no bridge-group 1 source-learning&#xA;!&#xA;interface GigabitEthernet0.10&#xA; encapsulation dot1Q 10&#xA; bridge-group 10&#xA; bridge-group 10 spanning-disabled&#xA; no bridge-group 10 source-learning&#xA;!&#xA;interface BVI1&#xA; mac-address 18e7.28f7.8468&#xA; ip address 192.168.1.43 255.255.255.0&#xA; ipv6 address dhcp&#xA; ipv6 address autoconfig&#xA; ipv6 enable&#xA;!&#xA;ip default-gateway 192.168.1.1&#xA;ip forward-protocol nd&#xA;ip http server&#xA;no ip http secure-server&#xA;ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag&#xA;!&#xA;!&#xA;bridge 1 route ip&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; password 7 &amp;lt;removed&amp;gt;&#xA; login&#xA;line vty 0 4&#xA; password 7 &amp;lt;removed&amp;gt;&#xA; login&#xA; length 0&#xA; transport input all&#xA;line vty 5 15&#xA; password 7 &amp;lt;removed&amp;gt;&#xA; login&#xA; transport input all&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Kindly suggest me some ideas to fix this.&lt;/p&gt;&#xA;" OwnerUserId="10553" LastEditorUserId="775" LastEditDate="2014-11-24T12:44:07.370" LastActivityDate="2014-12-25T14:29:12.640" Title="Users are thrown out of the network with no clue. They are connected with Autonomous AP (Cisco Aironet 1602i)" Tags="|cisco|wireless|aironet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13206" PostTypeId="1" CreationDate="2014-11-24T12:12:38.873" Score="4" ViewCount="2979" Body="&lt;p&gt;I work at a data center, we need to setup a completely separate OOB network, I know about OOB using access server/terminal server, I mean how to setup something like Cisco 2511 with SCSI-2 ports and octal cable, but what the heck do they mean OOB network? I mean am i supposed to create a whole new subnet and connect each and every router, switch, firewall, server... to that? I'm a bit lost, I read this &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/SAFE_RG/SAFE_rg/chap9.html&quot; rel=&quot;nofollow&quot;&gt;doc on Cisco &lt;/a&gt; but can't get it right, please don't talk about configuration, just the positioning of devices, and the main concept of having an &lt;strong&gt;OOB management network/subnet&lt;/strong&gt;, any kinda document in simple words will do good thank you&lt;/p&gt;&#xA;" OwnerUserId="7741" LastActivityDate="2017-11-17T13:03:24.697" Title="How to design/build a separate network to carry the management-related traffic or so-called &quot;out of band&quot; (OOB) management network/subnet?" Tags="|cisco|oob|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13209" PostTypeId="1" AcceptedAnswerId="13213" CreationDate="2014-11-24T14:47:15.483" Score="4" ViewCount="225" Body="&lt;p&gt;I'm trying to find out what the command line option is to set the password memory of an F5 BIG IP. I know Password Memory can be set from the GUI but I'm not sure how it is done using the tmsh?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I reviewed the online documentation of F5, but this command wasn't listed.&lt;/p&gt;&#xA;" OwnerUserId="29" LastActivityDate="2014-11-24T19:22:45.850" Title="How do you configure the Password Memory on the F5 Big IP?" Tags="|f5|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13210" PostTypeId="2" ParentId="13184" CreationDate="2014-11-24T15:05:44.330" Score="2" Body="&lt;p&gt;dk1's answer was great.  I just want to add one more thing:  I think the most important thing to determine when choosing a release code is features.  If there is a feature in 9.2 code you would make use of, then it doesn't matter how stable 8.4.7 is, because it doesn't do what you need it to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm going to list the notable features for each code version that I know of, organize by major and minor release.  I'll make this a community wiki so others can add to it as well:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;8.3 - new NAT&lt;/li&gt;&#xA;&lt;li&gt;8.4(2) - IKEv2, NAT done better, Synergy with 8.6.1 for ASAx&lt;/li&gt;&#xA;&lt;li&gt;8.6.1 - Synergy with 8.4.2 for ASA&lt;/li&gt;&#xA;&lt;li&gt;9.0 - SSL VPN Client for Win8 support, NAT between IPv4 and IPv6&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(personal note:  8.3 changed the NAT, but you may as well consider it the rough draft and 8.4.2 the final.  I would highly, highly recommend not using 8.3 for any reason)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-11-24T15:05:44.330" CommentCount="0" CommunityOwnedDate="2014-11-24T15:05:44.330" ContentLicense="CC BY-SA 3.0" />
  <row Id="13211" PostTypeId="2" ParentId="13182" CreationDate="2014-11-24T15:11:59.857" Score="-1" Body="&lt;p&gt;Change to transparent mode will not affect the VLAN configuration in other switches in VTP domain.VTP advertisements still pass through the transparent mode switch.&lt;/p&gt;&#xA;" OwnerUserId="10474" LastEditorUserId="10474" LastEditDate="2014-11-25T16:17:14.747" LastActivityDate="2014-11-25T16:17:14.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13212" PostTypeId="2" ParentId="13201" CreationDate="2014-11-24T15:40:46.873" Score="0" Body="&lt;p&gt;I think I might have found the reason, but I am not sure. Any feedback will be welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;why does some previously unable-to-reach-cap cases could now reach the cap?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is the switch's buffer size.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In scenario 1 (link A has 2X delay), the real bottleneck situation is&#xA;2X delay with K buffer  size. &lt;/li&gt;&#xA;&lt;li&gt;In scenario 2 (link A&amp;amp;b both have X delay), the real bottleneck&#xA;situation is X delay with K buffer size.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since this are lossless links, once I crank the buffer size up every case seems to be able to reach network ceiling.&lt;/p&gt;&#xA;" OwnerUserId="10549" LastActivityDate="2014-11-24T15:40:46.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13213" PostTypeId="2" ParentId="13209" CreationDate="2014-11-24T18:15:02.200" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Last login: Mon Nov 24 11:12:09 2014 from 1.1.1.1&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;bp&gt;!bash&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[JH@F5:Standby] ~ # tmsh&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;JH@F5(Standby)(tmos)# modify auth password-policy password-memory ?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Specifies the number of passwords that the BIG-IP system will remember for each user. A user will not be able to set their password&#xA;  to one of these passwords. The default value is 0 (zero).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you look under the section for password-policy in the link below, you'll find password-memory in the available commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://rekrowten.wordpress.com/2011/12/16/f5-tmos-configuration-part-1/&quot; rel=&quot;noreferrer&quot;&gt;http://rekrowten.wordpress.com/2011/12/16/f5-tmos-configuration-part-1/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2014-11-24T19:22:45.850" LastActivityDate="2014-11-24T19:22:45.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13215" PostTypeId="1" AcceptedAnswerId="13514" CreationDate="2014-11-20T12:56:31.320" Score="5" ViewCount="2152" Body="&lt;p&gt;interface &quot;ldap&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-group ldap_access_in in interface ldap&#xA;access-group ldap_access_out out interface ldap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I had zero hits until I started to try ssh;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list ldap_access_out line 1 extended deny tcp host 10.99.2.70 host 10.99.11.8 eq ssh (hitcnt=5) 0xa18d6298 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I wait ten minutes without connecting, no hits. Checking on the remote host who is logged on I can see that the source address is what I expect it to be, and capture captures the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4 minutes after the previous tries, I will now connect three times and check the hit count:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[user@ldap0 ~]$ ssh 10.99.11.8&#xA;Last login: Thu Nov 20 13:48:34 2014 from 10.99.2.70&#xA;[user@root0 ~]$ logout&#xA;Connection to 10.99.11.8 closed.&#xA;&#xA;[user@ldap0 ~]$ ssh 10.99.11.8&#xA;Last login: Thu Nov 20 13:53:23 2014 from 10.99.2.70&#xA;[user@root0 ~]$ ^C&#xA;[user@root0 ~]$ logout&#xA;Connection to 10.99.11.8 closed.&#xA;&#xA;[user@ldap0 ~]$ ssh 10.99.11.8&#xA;Last login: Thu Nov 20 13:53:24 2014 from 10.99.2.70&#xA;[user@root0 ~]$ logout&#xA;Connection to 10.99.11.8 closed.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And ...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list ldap_access_out line 1 extended deny tcp host 10.99.2.70 host 10.99.11.8 eq ssh (hitcnt=8) 0xa18d6298 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't have sysopt permit-vpn (this is ipsec traffic incoming on outside interface, routed to ldap interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the cause of this?&lt;/p&gt;&#xA;" OwnerUserId="2934" OwnerDisplayName="user135361" LastEditorUserId="775" LastEditDate="2014-12-09T09:46:07.090" LastActivityDate="2014-12-09T10:14:50.360" Title="Cisco ASA acl deny hit rule but traffic permitted" Tags="|cisco|cisco-asa|vpn|acl|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13216" PostTypeId="1" AcceptedAnswerId="13228" CreationDate="2014-11-24T22:22:48.027" Score="20" ViewCount="57664" Body="&lt;p&gt;I have a WiFi base station, and a WiFi range extender. Both of them have the same SSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a device connects to that SSID, what exactly happens? How does the device know that base station and range extender are part of the same network and no third party can impersonate another range extender on the same network? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, what happens if the device moves around and signal strengths change? Is there some kind of renegotiation going on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does the range extender actually do? Simply rebroadcast whatever it gets from device and base station, or is it more intelligent than that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This sounds like several questions, but if somebody had a concise explanation handy, it would probably answer all of those at the same time.&lt;/p&gt;&#xA;" OwnerUserId="10199" LastActivityDate="2017-12-14T05:33:00.177" Title="How does a WiFi range extender work?" Tags="|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13217" PostTypeId="2" ParentId="13216" CreationDate="2014-11-24T23:35:31.293" Score="3" Body="&lt;p&gt;Range extenders use WDS (wireless distribution system) to join a wireless network and act as a store &amp;amp; forward repeater to extend radio coverage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The range extender needs to use the same setting (except for the SSID) as as the AP (channel, encryption method/keys). Some range extenders allow you to enter a different SSID so you know that you are connecting to the range extender instead of the AP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device doesn't know that the range extender is part of the same network. A 3rd party can just as easily impersonate the range extender as they can any other wifi AP or client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Range extenders are soho equipment so they typically don't have the client management features that you'd find in many enterprise/carrier system. This means any handling of roaming would be up to the client device. &lt;/p&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2014-11-24T23:35:31.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13218" PostTypeId="2" ParentId="13206" CreationDate="2014-11-25T00:00:22.843" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I mean am i supposed to create a whole new subnet and connect each and every router, switch, firewall, server... to that?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Basically, yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OOB network is whatever you need to recover the network without relying on the network (Out Of Band). The form it takes will depend on the devices you could need to access out of band.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In many cases having remote access to a terminal server attached to console ports is sufficient for recovering from configuration mistakes but that's limited to devices with CLI and doesn't really help with recovering erased firmware, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've done is take a router with dual-WAN and use my network for one WAN and the other WAN to a separate provider. Then I set up VPN access to the router. Then plug in every management port, server management card, console server, IP KVM, etc into the LAN side of the router. The idea being you VPN into the OOB router and have access to all devices that you'd need to fix to restore the network.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2014-11-25T00:00:22.843" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13220" PostTypeId="1" AcceptedAnswerId="13226" CreationDate="2014-11-25T01:36:57.287" Score="2" ViewCount="5786" Body="&lt;p&gt;I have a Wireshark capture of an 802.11 beacon. I am looking at the &quot;HT Capabilities&quot; and &quot;HT Information&quot; sections. Both contain the following information element: &quot;Rx Modulation and Coding Scheme: [Basic] MCS Set&quot;. However, their values differ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do they differ? What is the difference between these two information elements?&lt;/p&gt;&#xA;" OwnerUserId="2360" LastEditorUserId="33" LastEditDate="2015-04-20T22:43:57.357" LastActivityDate="2015-04-20T22:43:57.357" Title="802.11 HT Capabilities IE vs. HT Information IE" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13222" PostTypeId="1" CreationDate="2014-11-25T02:34:52.203" Score="2" ViewCount="128" Body="&lt;p&gt;Could someone shed some light on measures I could take to ensure a few clients (ports) doesn't flood traffic (perhaps UDP?) and congest the switch for everyone?  I've always been a little behind on Ethernet flow control outside of TCP scaling, which in the end of things, could be ignored by a malicious client.&lt;/p&gt;&#xA;" OwnerUserId="10416" LastEditorUserId="775" LastEditDate="2014-11-26T00:31:32.197" LastActivityDate="2014-11-26T20:31:35.417" Title="What is available to prevent a few ports/clients from congesting the network?" Tags="|switch|ethernet|congestion|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13226" PostTypeId="2" ParentId="13220" CreationDate="2014-11-25T06:30:54.363" Score="4" Body="&lt;p&gt;The &lt;em&gt;HT Capabilities&lt;/em&gt; section provides the MCS values which are supported by the wireless network.  These data rates can be used by both the AP and the client to send unicast traffic back and forth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;HT Information&lt;/em&gt; section contains the &lt;em&gt;Basic Data Rates&lt;/em&gt; supported (if any).  The &lt;em&gt;Basic Data Rates&lt;/em&gt; will be a subset of the supported data rates and are used for broadcast, multicast and management traffic.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-11-25T06:30:54.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13228" PostTypeId="2" ParentId="13216" CreationDate="2014-11-25T06:56:57.330" Score="14" Body="&lt;p&gt;There are two types of wireless extenders.  First would be an extender that uses some sort of mesh technology.  This type of extender is typically only found within an enterprise deployment and will establish a connection to the network in addition to also acting as an AP.  Often a mesh device will use two radios, one providing the &quot;back haul&quot; and one to provide client access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However most devices referred to as wireless extenders fall into the second group and are actually just repeaters. When a wireless repeater receives (or &quot;hears&quot;) a frame, it will then transmit a copy of that frame into the air.  Naturally it will only hear frames on the channel to which it is configured, and typically will also be configured to only re-transmit frames for a particular SSID or BSSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since RF is a shared resource, this repetition of data can result in a significant loss of performance.  To reduce this impact, some repeaters are smart enough to not repeat frames where it hears both the frame and the acknowledgement between the AP and client device, but others are not and will re-transmit all frames.  Even if you are using a &quot;smarter&quot; repeater, if the client is too far from the repeater to be heard, all AP traffic will get repeated leading to the same loss of performance.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When a device connects to that SSID, what exactly happens?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When a client device connects, it goes through an association process with the access point.  If the client is out of range of the AP, but within range of the repeater, the repeater will re-transmit the client frames as well as the return frames from the AP.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How does the device know that base station and range extender are part of the same network and no third party can impersonate another range extender on the same network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The device doesn't.  When function as a repeater, the repeater itself doesn't really have any &quot;identity&quot; on the network (any management interface on the repeater is a separate matter).  It is merely repeating the frames that it hears unchanged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even  if a third party does place a repeater on in the area, this is not really a problem as the client device is associating (and establishing encryption) with the access point itself and not the repeater.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Then, what happens if the device moves around and signal strengths change? Is there some kind of renegotiation going on?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With most repeaters, there is no roaming or renegotiation.  The client device will either see the frame from the original AP, the repeated frame from the repeater, or possibly both.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What does the range extender actually do? Simply rebroadcast whatever it gets from device and base station, or is it more intelligent than that?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See above.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-11-25T06:56:57.330" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13229" PostTypeId="2" ParentId="13119" CreationDate="2014-11-25T07:46:47.220" Score="3" Body="&lt;p&gt;Mike has posted a great answer, but let me provide some examples to illustrate the problems inherent in flooding all traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine you have a switch with 24 1000baseT ports (i.e. capable or running at 1000 Mbps - while not really achievable in the real world, for simplicity let's say we can).  Ports 01-20 have computer/workstations connected to them, ports 21-23 are connected to servers, and port 24 is connected to the &quot;internet gateway.&quot;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Computer01 starts pushing raw video footage to Server21.  Server21 is capable of taking a full 1000Mbps of raw video footage and encoding it into a specified format and returns it in &quot;real time&quot; to the host that upload the raw footage.  So Computer01 sends 150Mbps of raw footage to Server21 which then returns a 10Mbps stream of data.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With data being flooded, there is now 160Mbps of data being sent out all ports on the switch.  No performance problem at this point, but Computers02-20, Server22-23, and the Gateway are all also receiving 160Mbps of data that they each have to process to the point of knowing it isn't meant for them and then drop the traffic.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Computer02-06 also start pushing raw video footage to Server21.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With five more computers, we have now hit 960Mbps of traffic being flooded out all ports.  Again, this is below our 1000Mbps per second limit, but not by much.  Again, most of the devices on the network will be receiving this traffic and have to process it to some degree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With only 6 active computers and one server, we have almost reached the capacity of the flooded network.  There is almost no capacity left for the remaining devices on the network, say if Computer07 wants to start an FTP download from Server22.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens when we hit that 1000Mbps limit?  Which traffic doesn't get flooded?  How does that impact performance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now imagine this on a fully populated 48-port switch (i.e. more computers/servers/end points).  How about with a stack of 7 48-port switches?  An enterprise network with 1000's of switch ports?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, take a mixed environment where you may have 10baseT, 100baseTX, and 1000baseT ports all on the same network.  Computer01 above would fully saturate a slower device on the network all by itself.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Computer10 starts exporting a patient list from Server23 and downloading it as an XML file.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This may not take up much bandwidth, and while normally a network device will drop traffic not addressed to itself, this is not always the case.  On this network, Computer 15 has been compromised and it now watching all the traffic it receives and now is able to also &quot;download&quot; the XML file containing the patient list as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To protect against this, you now require that all internal traffic be encrypted or protected by some means.  This takes resources to develop, resources to verify everything is secure, and resources on the end points themselves to encrypt/decrypt everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, back to your original question, &quot;Why doesn't it always do this if it can, since it would be faster than doing a look up in a table?&quot;  Most switches utilize specialized hardware that does these look ups very, very quickly.  This isn't measured in microseconds, but rather in nanoseconds (and won't reach the double digits at that).  It is also not tied to CPU or memory resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compare this to the amount of processing required by each station as it inspects and drops all the unnecessary traffic (also typically measured in nanoseconds, but it needs to be done by each device and not just the switch).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or the time it takes to time out and re-transmit a frame when the network is congested (which may be measured in seconds).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or the time it takes to establish some sort of encryption between each set of two devices that want to communicate in a secure fashion (which can easily introduce microseconds of delay).  In addition, this may require additional traffic (such as a SSL/TLS exchange, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flooding all traffic is simply unfeasible on a network with more than a handful of devices.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-11-25T07:46:47.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13230" PostTypeId="1" CreationDate="2014-11-25T09:48:12.120" Score="4" ViewCount="678" Body="&lt;p&gt;I need to get to a point where my routers ask me for a user and password after I've entered the &quot;enable&quot; command. like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PYP7W.png&quot; alt=&quot;Config example&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help with this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="5329" LastActivityDate="2014-11-25T13:58:53.523" Title="How to configure IOS/IOS-XE routers to prompt for users after &quot;enable&quot;?" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13231" PostTypeId="2" ParentId="13204" CreationDate="2014-11-25T13:42:59.553" Score="3" Body="&lt;p&gt;I have to disagree with TAC on this one.  Running those low speeds is really not a good idea.  I wouldn't run anything lower than 12 unless you absolutely need 11b.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have interference, the only way you're going to find it is with some sort of sniffer or spectrum analyzer. Maybe you can borrow one?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try turning off your WLAN and see what other wifi signals you pick up.  You might look for microwave ovens in the vicinity.  You can also try changing channels to see if that helps (choose from 1, 6 or 11).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-11-25T13:42:59.553" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13232" PostTypeId="2" ParentId="13230" CreationDate="2014-11-25T13:58:53.523" Score="3" Body="&lt;p&gt;You can't do that, but you can configure the router so it prompts for name/password at login, and based on the user's privilege, they will be in enable mode or not. So instead of a two-step login, they login once and are put in the proper mode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username farouk password foo &#xA;username jong-mee password bar privilege 15&#xA;&#xA;aaa new-model&#xA;aaa authentication login default local&#xA;aaa authorization enable default local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When jong-mee logs in, she gets prompted for her password, and immediately goes into enable mode.  But when Farouk logs in, he is only in user mode.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make the enable secret long and complicated so it can't be guessed.  You won't have to use it anymore.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-11-25T13:58:53.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13233" PostTypeId="1" AcceptedAnswerId="13281" CreationDate="2014-11-25T15:18:50.867" Score="-1" ViewCount="3502" Body="&lt;p&gt;I'm just learning about bit and byte stuffing. So far, it seems that they're both trying to prevent the same thing from happening in say, HDLC frames, that is, to avoid treating a 0x7E value in the data frame as the 0x7E flag that delimits a frame. The difference is bit stuffing works on a bit-by-bit basis, while byte stuffing works on a byte-by-byte basis. Does this mean that both bit and byte stuffing cannot occur in the same traffic? For example, if I find that the frames contain bit stuffing, then it cannot be byte stuffed as well?&lt;/p&gt;&#xA;" OwnerUserId="8424" LastEditorUserId="775" LastEditDate="2014-11-28T00:57:56.970" LastActivityDate="2015-12-26T18:46:35.173" Title="Bit and byte stuffing in HDLC frames" Tags="|protocol-theory|layer2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13235" PostTypeId="1" AcceptedAnswerId="13243" CreationDate="2014-11-25T16:15:32.090" Score="1" ViewCount="139" Body="&lt;p&gt;Could anyone help me with the Cisco IOS command for finding the suported protocols (level 2: link layer) by one serial interface, Serial 0/0 in this case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router is a Cisco 2600 (1 ethernet port, 2 serial ports).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="10576" LastActivityDate="2014-11-25T19:49:48.983" Title="Cisco 2600 IOS interface supported protocols" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13236" PostTypeId="2" ParentId="13222" CreationDate="2014-11-25T16:47:50.937" Score="0" Body="&lt;p&gt;One way would be to use ACLs/firewall filters (depending on the vendor) to rate limit traffic on those ports. It depends on what type of features are supported on your box.&lt;/p&gt;&#xA;" OwnerUserId="10545" LastActivityDate="2014-11-25T16:47:50.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13239" PostTypeId="2" ParentId="13144" CreationDate="2014-11-25T18:37:09.223" Score="2" Body="&lt;p&gt;I’ve never heard the term switch-back-delay, nor can I find anything referencing it on the internet or in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5798&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5798&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The you’re really looking for is &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos13.3/topics/task/configuration/vrrp-preemption-configuring-qfx-series.html#jd0e59&quot; rel=&quot;nofollow noreferrer&quot;&gt;Preemption Hold Time&lt;/a&gt;.  This is the time a higher priority VRRP speaker will wait until preemption of the mastership role happens.  There isn't a hold timer reference in the RFC, so that’s a vendor specific implementation.&lt;/p&gt;&#xA;&lt;p&gt;VRRP only operates in 3 different modes.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;                             +---------------+&#xA;                  +---------&amp;gt;|               |&amp;lt;-------------+&#xA;                  |          |  Initialize   |              |&#xA;                  |   +------|               |----------+   |&#xA;                  |   |      +---------------+          |   |&#xA;                  |   |                                 |   |&#xA;                  |   V                                 V   |&#xA;          +---------------+                       +---------------+&#xA;          |               |----------------------&amp;gt;|               |&#xA;          |    Master     |                       |    Backup     |&#xA;          |               |&amp;lt;----------------------|               |&#xA;          +---------------+                       +---------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;sup&gt; &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5798#section-6.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5798 - 6.3.  State Transition Diagram&lt;/a&gt; &lt;/sup&gt;&lt;/p&gt;&#xA;&lt;p&gt;When a router with a higher priority becomes active and has the preemption flag set, it actively tries to usurp that state.  But in some instances, that router might have something wrong with it.  Maybe it’s flapping for some reason.  That problem is even more aggravated when you have sub-second operation; a couple missed packets result in a network-wide flooding of gratuitous ARPs.&lt;/p&gt;&#xA;&lt;p&gt;To protect from this, some vendors offer the ability to back-off that preemption time a bit.  In networks where you're utilizing aggressive timing, you’ll still have the power to react to offline nodes at sub-second intervals.  In addition to that, you can also make sure devices coming on/off at a rapid pace don’t affect the overall state of VRRP within your boundary.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I wanted to know whats the MIN and MAX limit for VRRP&#xA;switch-back-delay and why?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This will be totally vendor dependent.  As an example, Juniper devices have a range between 0 to 3600 seconds.  0 seconds being the default (instant preemption).  3600 seconds, or 1 hour, being the extreme.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-11-27T12:50:36.380" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13242" PostTypeId="1" AcceptedAnswerId="13244" CreationDate="2014-11-25T19:05:08.767" Score="3" ViewCount="639" Body="&lt;p&gt;I am a little new to this but here is what I am hoping to achieve.  I have an Adtran TA908e that I am managing as an ISP router.  I am hoping to create a vLan to be able to attach it to my LAN for management purposes.  Here is what I have done so far, but the LAN vLan does not work.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface eth 0/1&#xA;  description Publicly Routable LAN&#xA;  encapsulation 802.1q&#xA;  no shutdown&#xA;!&#xA;interface eth 0/1.1&#xA;  description Publicly Routable LAN&#xA;  vlan-id 1 native&#xA;  ip address  216.5.156.185  255.255.255.248&#xA;  no shutdown&#xA;interface eth 0/1.100&#xA;  vlan-id 100&#xA;  ip address  172.31.9.244  255.255.255.0&#xA;  no shutdown&#xA;!&#xA;interface eth 0/2&#xA;  description  WAN&#xA;  ip address  216.157.108.103  255.255.255.252&#xA;  no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;eth 0/1.1 is publicly routable and I already have two devices using .186 and .187 functioning.  They are attached to an 8 port unmanaged switch attached to eth 0/1.  I have another cable from that unmanaged switch to one of the switches on my LAN.  That's why I setup the vlan-id 100 on eth 0/1.100 to match the vlan on my LAN.  I cannot access the Adtran router through the 172.31.9.244.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This Adtran is there to route the traffic from the public range of IP's that the ISP gave me to there equipment.  This is working exactly as it should.  What I need is a way to manage the Adtran from my LAN.  Any help or recommendations would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Joshua&lt;/p&gt;&#xA;" OwnerUserId="10578" LastActivityDate="2019-11-20T15:52:01.043" Title="How to setup a management LAN on ISP Router" Tags="|vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13243" PostTypeId="2" ParentId="13235" CreationDate="2014-11-25T19:49:48.983" Score="6" Body="&lt;p&gt;From an exec prompt,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show protocols serial 0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;would give you the protocols &lt;em&gt;currently&lt;/em&gt; being used by the serial port numbered 0/0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find out more in interface configuration mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#configure terminal&#xA;Router(config)#interface serial 0/0&#xA;Router(config-if)#encapsulation ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you hit the ? after typing 'encapsulation', it kicks into ios help which will provide a list of things your router would accept as a layer 2 encapsulation / protocol. Mine are wic-2t cards and offer sdlc, ppp, hdlc among others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside, to find out what protocols your &lt;em&gt;actual router&lt;/em&gt; is geared up to work with, you can do&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to find out your ios image (mine is currently 'c1841-adventerprisek9-mz.151-2.T.bin') and put it into the feature navigator at &lt;a href=&quot;http://tools.cisco.com/ITDIT/CFN/jsp/SearchBySoftware.jsp&quot;&gt;http://tools.cisco.com/ITDIT/CFN/jsp/SearchBySoftware.jsp&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="106" LastActivityDate="2014-11-25T19:49:48.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13244" PostTypeId="2" ParentId="13242" CreationDate="2014-11-25T19:51:13.570" Score="5" Body="&lt;p&gt;There are a few things wrong.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Your unmanaged switch doesn't understand vlan tagging.  You need a managed switch that supports vlan tagging in order to make this work.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You need an ACL or other method of filtering traffic to block access to your management interface.  As you have it now, anyone can access it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You need to insure that your static routing is configured correctly so that your management traffic only goes to to internal network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-11-25T19:51:13.570" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13247" PostTypeId="1" AcceptedAnswerId="13292" CreationDate="2014-11-25T22:36:37.403" Score="4" ViewCount="15429" Body="&lt;p&gt;I have to setup a stack of 3 Cisco 3850 switchs.  They are licences to IP Base feature. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I inspirated my setup from an another configuration we got here but those switches have the IP Services IOS. As my topic said, I'm unable to ping other vlan in the switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's the scenario :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My stack will connect to a Cisco Switch that we don't manage. This switch provide us (via VPN MPLS) network we can use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This switch (from ISP) have two ports (network) enable :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Port 1 L3 : 10.140.68.1/22&#xA;Port 2 L3 : 192.168.69.33/27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My switch stack (LAN) configuration looks like this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;&#xA;interface Vlan68&#xA; ip address 10.140.68.2 255.255.255.0&#xA; ip helper-address 10.140.68.4&#xA;&#xA;interface Vlan69&#xA; ip address 10.140.69.1 255.255.255.0&#xA; ip helper-address 10.140.68.4&#xA;&#xA;interface Vlan70&#xA; ip address 10.140.70.1 255.255.255.0&#xA; ip helper-address 10.140.68.4&#xA; shutdown&#xA;&#xA;interface Vlan71&#xA; ip address 10.140.71.1 255.255.255.0&#xA; ip helper-address 10.140.68.4&#xA; shutdown&#xA;&#xA;interface Vlan192&#xA; ip address 192.168.69.33 255.255.255.224&#xA;&#xA;router eigrp 100&#xA; network 10.140.68.0 0.0.3.255&#xA; network 192.168.69.32 0.0.0.31&#xA; redistribute static&#xA; passive-interface default&#xA; eigrp stub connected summary&#xA;&#xA;ip route 0.0.0.0 0.0.0.0 10.140.68.1&#xA;&#xA;interface GigabitEthernet1/0/1&#xA; description To MPLS SWITCH PORT 1&#xA; switchport access vlan 68&#xA;interface GigabitEthernet1/0/2&#xA; description To MPLS SWITCH PORT 2&#xA; switchport access vlan 192&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Someone can help me to configure the InterVlan routing and the I'm not sure if the 2 ports who'll be connected to the uplink switch is correct too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made ping test having a two laptops connected to the switch, 1 in vlan 68 and 1 in vlan 69.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; (for a comment below that I can't format)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface   IP-Address    OK?   Method  Status                  Protocol&#xA;Vlan1       172.16.100.1  YES   manual  administratively down   down&#xA;Vlan68      10.140.68.3   YES   manual  up                      up&#xA;Vlan69      10.140.69.1   YES   manual  up                      up&#xA;Vlan70      10.140.70.1   YES   NVRAM   administratively down   down&#xA;Vlan71      10.140.71.1   YES   NVRAM   administratively down   down&#xA;Vlan192     192.168.69.34 YES   manual  up                      up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT2:&lt;/strong&gt;&lt;br&gt;&#xA;Now I can ping all vlan from the switch (via the console connection). I can put a laptop in a port in the &lt;code&gt;Vlan68&lt;/code&gt; and ping the switch (by all vlan ip address) same thing from a laptop in the &lt;code&gt;Vlan192&lt;/code&gt;. BUT, if I put a laptop in a port of Vlan69 I can't ping the switch from any vlan IP even the &lt;code&gt;Vlan69&lt;/code&gt; (69.1). When I do a &lt;code&gt;show arp&lt;/code&gt; the laptop's mac and IP address don't show. I try with many laptop and samething everytime. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Resolution&lt;/strong&gt;&#xA;The problem came of the fact that some interface configuration about dhcp snooping and arp inspection prevents statics address ip. Adding a DHCP solve the problem. &lt;/p&gt;&#xA;" OwnerUserId="10583" LastEditorUserId="3912" LastEditDate="2014-12-02T09:25:06.623" LastActivityDate="2017-08-17T10:29:15.980" Title="Can't ping other vlan on same stack switch" Tags="|cisco|routing|vlan|cisco-ios|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13248" PostTypeId="2" ParentId="13247" CreationDate="2014-11-25T22:48:18.207" Score="5" Body="&lt;p&gt;In general, a VLAN SVI will not be &quot;UP&quot; if there are no ports within that VLAN that are up. As only 2 of your VLANs are assigned to interfaces (as per the limited bit of config provided), only 2 VLANs should be operational.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-11-25T22:48:18.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13249" PostTypeId="2" ParentId="13222" CreationDate="2014-11-25T23:16:16.003" Score="2" Body="&lt;p&gt;There are a few ways of setting a limit on single user bandwidth consumption.  It isn’t very common for an individual to seriously affect your entire network unless they genuinely have malicious intent.  Along with technical suggestions, it is also worth adding in administrative ones, too.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Access Control:&lt;/strong&gt; Limit who has access to your machines and what gets done on them.  This isn’t a technical step, and not even viable in every scenario (like a downstream customer), but your initial question leads me to believe you’re concerned with nefarious users on your network.  A good step would be to not let them on to begin with or stopping them from getting toolsets that allow them to do what your trying to prevent.&lt;/p&gt;&#xA;&lt;p&gt;You’ll almost always find that once a lower layer is penetrated, the higher ones start to follow.  It isn’t always common to find a machine vulnerable to some 0-day you found off exploitdb, but it is common (and easy) to find an open port, send out bogus ARP replies, and then spoof websites.  802.1X is getting heavy push in most organizations for a reason: port-security just isn’t cutting it anymore.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Solid Device Baseline:&lt;/strong&gt; Get a good, secure baseline that all of your devices are working off of.  Even if you restrict someone to a 128k connection, that won’t stop any amplification attack and will render the entire initiative useless.  Good device baselines can be found on the &lt;a href=&quot;https://www.nsa.gov/ia/_files/switches/switch-guide-version1_01.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;NSA's site&lt;/a&gt;, along with solid explinations.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Policing:&lt;/strong&gt; This is effectively setting a hard cap on any port you choose.  Anything beyond the pre allocated bandwidth is just chopped off and sent to the bit bucket.  If you’re looking to limit a single port to a specific amount of bandwidth, this is the &lt;strong&gt;easiest&lt;/strong&gt; way of achieving it.&lt;/p&gt;&#xA;&lt;p&gt;This does have a critical drawback, it isn’t intelligent in any way; once an interface reaches that threshold, it’s gone.  What does this mean when no one’s using the network?  Well, those policed aren’t going to, either.  You can look at that as wasting usable bandwidth.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Shaping:&lt;/strong&gt; There isn’t a good way of performing this within the boundary of your LAN, but it does an excellent job of sharing bandwidth at the edge (probably your POP or your customers POP).  If you police a port, that port can never exceed the amount you’ve provisioned.  When you shape, you can set group bandwidth percentages and different drop characteristics that allow priority ports all the bandwidth they can eat, when they actually need it.&lt;/p&gt;&#xA;&lt;p&gt;This, too, has a pretty big drawback; it’s kind of difficult to get going.  You will need to figure out a marking/queuing discipline that gives you exactly what you want.  Plus, you’ll need to get all of the devices on your network talking the same language (configuration-wise) before you get real benefit from it.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-11-26T12:04:09.407" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13252" PostTypeId="2" ParentId="9692" CreationDate="2014-11-26T05:08:41.720" Score="2" Body="&lt;p&gt;Use this configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Virtual-Template3 type tunnel&#xA; ip unnumbered Dialer3&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; tunnel mode ipsec ipv4&#xA; tunnel protection ipsec profile CiscoCP_Profile1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10588" LastEditorUserId="775" LastEditDate="2014-11-26T08:58:28.813" LastActivityDate="2014-11-26T08:58:28.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13253" PostTypeId="1" CreationDate="2014-11-26T11:32:07.863" Score="3" ViewCount="1888" Body="&lt;p&gt;in this diagram :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WI5nO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WI5nO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;we are peering with 2 ISPs, let's say I have a class c IP space like 200.200.200.0/24 and let's say my ASN is 65000, the thing is where should I run NAT? on which device? I mean on Cisco Routers that face the internet or could I run that on the FortiGate? and where on which device should I config the peering? again on Cisco routers facing those ISPs or is it possible to have BGP peering configured on the FortiGate? I know some stuff about BGP and how it works, an I know it's based on the TCP session and it's not working like IGPs in which peers are directly connected, but the thing is how could I have NAT alongside the BGP in this diagram?what's the best to do?&lt;/p&gt;&#xA;" OwnerUserId="7741" LastEditorUserId="775" LastEditDate="2014-11-26T13:43:18.950" LastActivityDate="2014-11-29T12:15:56.937" Title="where to NAT?where to run BGP?" Tags="|cisco|bgp|nat|design|fortigate|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13254" PostTypeId="2" ParentId="13253" CreationDate="2014-11-26T14:21:38.970" Score="2" Body="&lt;p&gt;You should run BGP on your Cisco routers connecting to ISP. If FW supports BGP, it should run iBGP with the routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would prefer doing NAT on the FW. All you have to do is make sure that the traffic leaving a FW comes back to the same. I think you would already be doing that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH.&lt;/p&gt;&#xA;" OwnerUserId="10306" LastEditorUserId="10306" LastEditDate="2014-11-26T15:23:45.427" LastActivityDate="2014-11-26T15:23:45.427" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13259" PostTypeId="2" ParentId="13222" CreationDate="2014-11-26T20:31:35.417" Score="2" Body="&lt;p&gt;There are many ways of addressing this and which one you choose can be dependent on the situation.  Let me go over some of the more common ones.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Quality of Service (aka QoS) - this could include rate limits, policing, marking traffic, etc.  Depending on the capabilities of the device in use, this can take on a number of forms.&lt;/li&gt;&#xA;&lt;li&gt;Storm Control - depending on you device, this can provide hard limits and/or scaled limits on the amount of traffic that is received from a host.  This will typically at least include broadcast traffic, but may also include multicast and/or unicast traffic as well.&lt;/li&gt;&#xA;&lt;li&gt;802.1X/RADIUS - not only does this provide limitations requiring devices to authenticate to the network, you can configure policies that the host will be limited by, such as the amount of traffic allowed over a given period of time.&lt;/li&gt;&#xA;&lt;li&gt;IDS/IPS/SEIM - this would be a security based solution that would be looking for various types of events or abnormal behaviors.  It can generally be configured to alert and/or take action when certain types of events occur.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-11-26T20:31:35.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13260" PostTypeId="1" AcceptedAnswerId="13263" CreationDate="2014-11-26T20:40:46.933" Score="3" ViewCount="879" Body="&lt;p&gt;Does anyone know how to view ICMP packets (ping), if possible, traversing through a Cisco 2600 router, that is, how to use the console connection to the router (the usual for configuration) to display info about those packets, as a sort of 'wireshark lite' protocol analyzer built into it? Or some kind of summary about them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope to have explained it clearly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show version&#xA;&#xA;Cisco IOS Software, C2600 Software (C2600-IPBASEK9-M), Version 12.4(17), RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2007 by Cisco Systems, Inc.&#xA;Compiled Fri 07-Sep-07 16:04 by prod_rel_team&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10576" LastEditorUserId="509" LastEditDate="2014-11-27T07:20:05.120" LastActivityDate="2014-12-02T00:14:40.983" Title="Cisco 2600 IOS ICMP packets viewing" Tags="|cisco-ios|icmp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13262" PostTypeId="1" AcceptedAnswerId="14578" CreationDate="2014-11-26T21:14:34.513" Score="7" ViewCount="1660" Body="&lt;p&gt;I was wondering if anyone can shed some light on when Multicast Listener Discovery (MLD) messages ought to be send during IPv6 Duplicate Address Detection. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4862#section-5.4.2&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;RFC 4862&quot;&gt;RFC4862 section 5.4.2&lt;/a&gt; gives a detailed description of which multicast groups an IPv6 host performing DAD should join, namely the all-nodes multicast address and the solicited-node multicast address. It also mentions the use of MLD, however I can't seem to explain the observed behaviour of windows and Linux as I will explain below.&lt;/p&gt;&#xA;&lt;p&gt;From RFC4863 it is my understanding that a node should not announce its interest in the all-nodes multicast address (as MLD snooping switches will process all-nodes multicast traffic anyway), but that it is advised to send MLD messages for the solicited-node multicast address (as MLD snooping switches can not possibly be aware of all the solicited-node multicast addresses it ought to listen for and forward).&lt;/p&gt;&#xA;&lt;p&gt;So far so good, however when I look at how Windows, Linux and FreeBSD have implemented MLD message sending during DAD I don't understand why the MLD messages for the solicited-node multicast address are sent twice. Here are three traces showing DAD for the link-local address when bringing up the Ethernet interface of a Linux, Windows and FreeBSD machine respectively.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.pcapr.net/view/florisvda/2014/10/3/12/ipv6_dad_linux_host.pcap.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;DAD for Linux&quot;&gt;DAD for fe80::20e:8eff:fe3b:23ad in Linux&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.pcapr.net/view/florisvda/2014/10/3/12/ipv6_dad_windows_host.pcap.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;DAD for Windows&quot;&gt;DAD for fe80::c14b:8228:ee4:d4aa in Windows&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.pcapr.net/view/florisvda/2014/10/3/15/ipv6_dad_freebsd_host.pcap.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;DAD for FreeBSD 8.3&quot;&gt;DAD for fe80::1234 in FreeBSD&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Some seemingly strange behaviour:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Linux, Windows and FreeBSD all send the MLD message twice. Linux and Windows space  them about 300 ms apart, in FreeBSD this is ~2200ms. Why is the second message sent, seeing how it is an exact copy of the first? Is this some form of retransmission?&lt;/li&gt;&#xA;&lt;li&gt;Linux delays the neighbour solicitation message (SOL) until after the second MLD message, whereas windows and freebsd send the SOL message immediately.&lt;/li&gt;&#xA;&lt;li&gt;Windows and freebsd send the MLD messages after the neighbour solicitation message. Granted it sends the first MLD message immediately after the SOL message. Also, when windows sends the SOL message, it has most likely already joined the multicast group; only the announcement itself is delayed not the actual joining of the group. Still, wouldn't sending the MLD message first reduce the chance of missing a neighbour advertisement from a host behind a MLD snooping switch?&lt;/li&gt;&#xA;&lt;li&gt;(Note that windows actually proactively advertises that it has assigned fe80::c14b:8228:ee4:d4aa in message #4, this is however not related to MLD)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;So far, I have come to the preliminary conclusion that there are no standardized practices on timing of MLD messages. There are some guidelines that restrict sending MLD messages in order to prevent congestion such as in RFC 4862. Can anyone refer to further material on when to send MLD messages during IPv6 DAD and thereby explain the observations from the traces above? I assume that every OS chooses when to send MLD messages during DAD and that Linux and Windows/FreeBSD made a different choice, however why did all three OSs chose to send MLD messages for the solicited-node multicast address twice (and spaced 300/300/2200ms apart)?&lt;/p&gt;&#xA;&lt;p&gt;Note that I am aware that MLD messaging is not required for DAD in most cases and that DAD usually works fine when blocking MLD messages (unless there is a MLD snooping switch somewhere). However, some of our students get confused by the erratic behaviour of MLD messaging and I'm at a loss explaining the observed behaviour to them.&lt;/p&gt;&#xA;" OwnerUserId="10595" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2018-12-27T01:29:06.377" Title="MLD messages during IPv6 duplicate address detection" Tags="|ipv6|protocol-theory|multicast|rfc|icmpv6|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13263" PostTypeId="2" ParentId="13260" CreationDate="2014-11-26T22:27:34.910" Score="6" Body="&lt;p&gt;&lt;strong&gt;*DISCLAIMER: Don't run debugs on equipment doing even remotely useful stuff unless you have to *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you've specified console cable which is cool, because debugs normally go to a console session. But if you connect via SSH you won't see debugs until you type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1#terminal monitor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As YLearn notes, by default this will only show packets addressed to the router you're debugging. To show transit packets as well, you'll need to run the following on the interfaces you expect the packets to pass through.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config-if)#no ip route-cache&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will switch the packets between the interfaces in software rather than using fast switching / CEF. As such, you should only do it in a test environment because it slows the process of sending and receiving data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using image c2600-adventerprisek9-mz.124-15.T14.bin provides some functions that may help, and Cisco's &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-121-mainline/12778-ping-traceroute.html&quot; rel=&quot;nofollow&quot;&gt;documentation for ping in version 12.1&lt;/a&gt; (first I got in Google) suggests it's been around in general for some time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming you want to monitor Router1 for pings coming from Router2 and they are at 10.0.0.1 and 10.0.0.2 respectively, you could run&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1#debug ip icmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on Router 1 and whenever you send pings over from Router 2, you'll see something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar  1 00:02:30.530: ICMP: echo reply sent, src 10.0.0.1, dst 10.0.0.2&#xA;*Mar  1 00:02:30.622: ICMP: echo reply sent, src 10.0.0.1, dst 10.0.0.2&#xA;*Mar  1 00:02:30.674: ICMP: echo reply sent, src 10.0.0.1, dst 10.0.0.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which simply shows that Router1 replied (so obviously received the pings).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1#undebug all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to switch off this particular debug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you go with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1#debug ip packet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and send some pings over from Router2, you'll see more detail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar  1 00:15:42.961: IP: tableid=0, s=10.0.0.2 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), routed via RIB&#xA;*Mar  1 00:15:42.961: IP: s=10.0.0.2 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), len 100, rcvd 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which tells you the source address and interface and the destination address and interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, if you go with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1#debug ip packet detail&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then each ping will show this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar  1 00:19:15.069: IP: tableid=0, s=10.0.0.2 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), routed via RIB&#xA;*Mar  1 00:19:15.069: IP: s=10.0.0.2 (FastEthernet0/0), d=10.0.0.1 (FastEthernet0/0), len 100, rcvd 3&#xA;*Mar  1 00:19:15.073:     ICMP type=8, code=0&#xA;*Mar  1 00:19:15.073: IP: tableid=0, s=10.0.0.1 (local), d=10.0.0.2 (FastEthernet0/0), routed via FIB&#xA;*Mar  1 00:19:15.073: IP: s=10.0.0.1 (local), d=10.0.0.2 (FastEthernet0/0), len 100, sending&#xA;*Mar  1 00:19:15.077:     ICMP type=0, code=0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which gives you the same details as the previous debug but also tells you the packet was 100 bytes in length, was ICMP and the type - 8 is the actual ping, 0 is the response.&lt;/p&gt;&#xA;" OwnerUserId="106" LastEditorUserId="106" LastEditDate="2014-11-29T13:53:31.013" LastActivityDate="2014-11-29T13:53:31.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13265" PostTypeId="1" AcceptedAnswerId="25541" CreationDate="2014-11-27T09:43:41.760" Score="5" ViewCount="3091" Body="&lt;p&gt;I have a problem deleting a rule that was created on Pan-OS via Panorama.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have Pan-OS firewall (5.0.0) that was managed by Panorama (5.0.0), then I added the Pan-OS to a DG and created some rules.&#xA;after a while someone deleted the DG and committed to the Panorama.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have a Pan-OS firewall with a DG rule that I can't remove.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does someone know how to remove a Panorama rule from Pan-OS?    &lt;/p&gt;&#xA;" OwnerUserId="8247" LastEditorUserId="46962" LastEditDate="2018-08-17T21:41:16.383" LastActivityDate="2018-09-16T22:00:18.003" Title="How do I remove a rule that was configured on PanOS via Panorama?" Tags="|firewall|palo-alto|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="13266" PostTypeId="1" AcceptedAnswerId="19696" CreationDate="2014-11-27T13:12:08.523" Score="8" ViewCount="107336" Body="&lt;p&gt;Actually my machine &lt;strong&gt;wwan0&lt;/strong&gt; MTU is 1500&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ashokkrishna@ashokkrishna-Lenovo-B560:~$ ping -s 1490 example.com&#xA;PING example.com (93.184.216.119) 1490(1518) bytes of data.&#xA;1498 bytes from 93.184.216.119: icmp_seq=1 ttl=51 time=1119 ms&#xA;1498 bytes from 93.184.216.119: icmp_seq=2 ttl=51 time=1130 ms&#xA;1498 bytes from 93.184.216.119: icmp_seq=3 ttl=51 time=1260 ms&#xA;^C&#xA;--- example.com ping statistics ---&#xA;4 packets transmitted, 3 received, 25% packet loss, time 3178ms&#xA;rtt min/avg/max/mdev = 1119.258/1170.102/1260.574/64.137 ms, pipe 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but when i ping like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ashokkrishna@ashokkrishna-Lenovo-B560:~$ ping -M do -s 1490 example.com&#xA;PING example.com (93.184.216.119) 1490(1518) bytes of data.&#xA;ping: local error: Message too long, mtu=1500&#xA;ping: local error: Message too long, mtu=1500&#xA;ping: local error: Message too long, mtu=1500&#xA;^C&#xA;--- example.com ping statistics ---&#xA;3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 1999ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what is this difference? &lt;br&gt;My intention is to know the example.com server's MTU size? how can I find that?&lt;/p&gt;&#xA;" OwnerUserId="6195" LastEditorUserId="775" LastEditDate="2014-11-27T13:17:47.527" LastActivityDate="2019-05-20T15:45:01.253" Title="dont fragment bit PING TOOL" Tags="|ipv4|linux|ping|mtu|icmp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13268" PostTypeId="1" AcceptedAnswerId="13316" CreationDate="2014-11-27T15:53:32.830" Score="1" ViewCount="9801" Body="&lt;p&gt;I would need a list of IP addresses (that can be reached by traceroute), preferably in random physical locations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to generate such a list from RIPE, ARIN and APNIC? If so, how would I do that? Or is there some other tool for generating random reachable IP addresses? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The list should contain at least 100 IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="10606" LastActivityDate="2016-04-01T07:16:42.140" Title="List of random existing IP addresses" Tags="|routing|internet|" AnswerCount="5" CommentCount="2" ClosedDate="2018-04-18T23:00:32.527" ContentLicense="CC BY-SA 3.0" />
  <row Id="13269" PostTypeId="1" CreationDate="2014-11-27T15:54:57.823" Score="6" ViewCount="644" Body="&lt;p&gt;I am trying to debug STP on a C7613 but I have logging issues.&#xA;IOS version 15.2(4)S2&#xA;The Route Switch Processor is  RSP720-3CXL-GE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running every debug commands for Spanning-Tree but nothing gets shown either on the console or in the logs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are my debug commands : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debug spanning-tree events&#xA;debug spanning-tree bpdu receive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that RSTP is running on my switch, as well as my ports are receiving BPDUs all the time. I should see traffic with this debug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the logging config : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging buffered 10000000000&#xA;logging monitor debugging&#xA;logging alarm informational&#xA;logging trap debugging&#xA;logging facility local2&#xA;logging host 10.162.33.69&#xA;logging console&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is it that I cannot see anything in the logs from this debug ?&#xA;Also, I tried with a CDP debug and all the debug logs were seen in the logs buffer. This seems like a STP issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2016-03-14T22:10:28.967" Title="Spanning-Tree debug logs C7600" Tags="|cisco|spanning-tree|logging|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13270" PostTypeId="1" CreationDate="2014-11-27T15:56:30.547" Score="4" ViewCount="1345" Body="&lt;p&gt;I'm quite new to HP networking and have inherit a setup with HP 8200 switches connected using DT-LACP trunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our project right now is to connect two switches from another datacenter to these two 8200 DT switches..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, datacenter A uses 8200 switches (switch A &amp;amp; B)&#xA;Datanceter B uses random Procurve (switch E&amp;amp;F)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch E&amp;amp;F has STP activated and uses a trunk between them currently)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I connect switches E&amp;amp;F to Switch A&amp;amp;B, won't it cause a loop? Since HP DT disables on the 8200 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch E connects to Switch A&#xA;Switch F connects to switch B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch E&amp;amp;F has a redundancy trunk between them.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having hard time finding documentation regarding this..would appreciate all the help I can get!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="10607" LastActivityDate="2014-12-21T01:29:20.883" Title="HP Switching, DT Links to two STP switches?" Tags="|spanning-tree|hp|ieee-802.1ax|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13272" PostTypeId="1" CreationDate="2014-11-27T16:41:30.023" Score="-1" ViewCount="1018" Body="&lt;p&gt;I am learning about switches, hubs etc and I am confused with understanding what switches, hubs, computers do if they get wrong ethernet frame ( check sum is calculated and it turns out that destination address is wrong). Devices can run in different modes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that for hub it doesn't matter if frame is wrong, because it doesn't calculate checksum. I know also that switches can work in promiscuous mode. Is it correct that switches and computers reject that frame ?&lt;/p&gt;&#xA;" OwnerUserId="10609" LastActivityDate="2014-11-27T17:42:41.817" Title="Wrong destination address frame" Tags="|switch|ethernet|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13273" PostTypeId="2" ParentId="13272" CreationDate="2014-11-27T17:26:42.260" Score="0" Body="&lt;p&gt;Yes the switch will drop the frame. But switches don't work like end hosts, so it's not quite right to say they operate in promiscuous mode. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-11-27T17:26:42.260" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13274" PostTypeId="2" ParentId="13272" CreationDate="2014-11-27T17:42:41.817" Score="2" Body="&lt;p&gt;If I understand you correctly then the process you're describing happens on a couple of levels (or layers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switch detects a checksum failure then it'll discard the frame and probably make an internal note of the error (Cisco 3550s certainly record errors, runt frames etc). At this point the switch couldn't know if the address was 'wrong' or which part of the frame was damaged so discarding it is the only reasonable thing to do. The checksum is just a way of deciding if &quot;an error of some sort&quot; happened when transmitting the frame, but can't tell you where in the frame the error was. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, that frame is part of a packet being sent somewhere. Because it gets dropped, the packet it belongs to is going to be broken and TCP is going to be patiently waiting for a packet with a particular sequence number to arrive. Part of the packet will arrive but the networking stack on the destination can't do anything with a part packet so will send a request to the source host asking for the whole packet to be resent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In reality you could have some freak error in the part of the frame that holds the Frame Check Sequence. In this case the real data might be intact but the frame is dropped because it'd be checked with an incorrect FCS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The destination knows which packet to request because it's kept a record of where it's gotten to in the sequence. If it receives packets 1,2,3 and 5, it'll know something went wrong with packet 'number' 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The different modes you talk of are Store and Forward, Cut Through and Fragment Free, which offer different levels of checking a frame before passing it onto the next device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A hub would be oblivious to all the above since it's only concerned with bits - a hub literally just repeats everything it receives. In one ear and out the others, if you will.&lt;/p&gt;&#xA;" OwnerUserId="106" LastActivityDate="2014-11-27T17:42:41.817" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13276" PostTypeId="1" AcceptedAnswerId="13279" CreationDate="2014-11-27T21:20:55.570" Score="3" ViewCount="890" Body="&lt;p&gt;I'm a little confused about the meaning of DHCP and NAT in Internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know NAT is used to translate local IP address and ports to a public IP and port. So your local network has IP looking like 192.168.212/24 for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then I found that DHCP is used to give IP address and configurations to hosts connected to a router, and that our home routers have a DHCP server to assign IPs to the hosts. Isn't that already done by NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other strange thing, if I access websites that give me my IP, from two computers in the same local network, these sites will give me different IPs, shouldn't it be the IP of my router?&lt;/p&gt;&#xA;" OwnerUserId="10612" LastEditorDisplayName="user10222" LastEditDate="2016-06-18T08:33:21.080" LastActivityDate="2016-06-18T08:33:21.080" Title="The role of DHCP and NAT in assigning IP addresses" Tags="|nat|dhcp|ip-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13277" PostTypeId="1" AcceptedAnswerId="16965" CreationDate="2014-11-27T22:00:28.203" Score="4" ViewCount="13558" Body="&lt;p&gt;I am familiar with adding a secondary ip address to cisco device interfaces in order to work around corner case scenarios, for example having 2 ip subnets within the same vlan, needing to expand when one subnet is exhausted or to migrate the default gateway of a host from one address to another etc.&lt;br&gt;&#xA;The implementation scenarios I have seen Customers/clients use seem to point towards poor network design but I am not sure whether its usage is also perfectly valid either?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know what are the main pitfalls related to using a secondary ip addresses on an interface, i.e use of the same broadcast domain, any impact upon TTL, impact on DHCP, sharing of mac address, sub-optimal routing between hosts etc?&lt;/p&gt;&#xA;" OwnerUserId="109" LastEditorUserId="8499" LastEditDate="2018-03-10T04:30:10.277" LastActivityDate="2018-03-10T04:30:10.277" Title="Implementing a secondary IP address?" Tags="|cisco|ipv4|ip|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13279" PostTypeId="2" ParentId="13276" CreationDate="2014-11-27T22:23:54.030" Score="4" Body="&lt;p&gt;NAT and DHCP are two totally different things. DHCP assigns IP addresses, DNS servers and gateways, NAT translates adresses between two networks, typically between a private network using RFC1918 (local) addresses and a public network, so multiple local devices can share one public IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your second question: there can be many reasons why those two computers have different IPs, they all depend on your network. One very obvious reason would be that there's no NAT involved and those two computers use different routable IP's, another explanation could be the use of a proxy farm which uses different IP's for its outbound connections. Without any more details on the local IPs, the IPs shown in these tests and the actual network configuration it's mostly guessing though.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-11-27T22:23:54.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13281" PostTypeId="2" ParentId="13233" CreationDate="2014-11-27T23:37:01.877" Score="3" Body="&lt;p&gt;You are correct that bit-stuffing and byte-stuffing perform broadly the same role, but note:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is no reason in principle why you cannot do both at the same time, though this is not typically done - rather:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Bit stuffing is typically used on synchronous serial links.&lt;/li&gt;&#xA;&lt;li&gt;Byte stuffing is typically used on asynchronous serial links (eg. RS-232).&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;In any case, both ends must agree in advance which convention (bit stuffing, byte stuffing, both, something else) is in force: the sender can't simply choose one, or else the receiver won't know how to interpret the transmissions.&lt;/li&gt;&#xA;&lt;li&gt;Bit stuffing is not just to distinguish the inter-frame marker &lt;code&gt;01111110&lt;/code&gt; from the data value 0x7e (which would otherwise also be sent as &lt;code&gt;01111110&lt;/code&gt;) - bits must also be inserted when bits in adjacent bytes might look like the inter-frame marker (as with two bytes &lt;code&gt;00000111 11100000&lt;/code&gt;). This scenario does not arise with byte stuffing.&lt;/li&gt;&#xA;&lt;li&gt;Bit stuffing is typically done by the serial hardware; byte stuffing is often done in software. Thus, unless you're directly measuring the electrical signals on the wire, you're unlikely to observe bit stuffing directly - but you may be able to observe byte stuffing via (for example) a debugger.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10539" LastActivityDate="2014-11-27T23:37:01.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13288" PostTypeId="1" AcceptedAnswerId="13289" CreationDate="2014-11-28T13:30:36.590" Score="1" ViewCount="322" Body="&lt;p&gt;sorry if my terminology is way off, I'm not well versed with networking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can any combination of hardware and software make following scenario a reality:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In location A there is a WiFi network called, let's say, 'X-wifi'. In location B (geographically distant - another district, city, country) there is a WiFi network also called 'X-wifi'. Using Internet as a intermediary, can you construct such a system so that machines connected to 'X-wifi' in location A and B see each other, just as (or effectively as) if they were actually connected to the same access point? If yes, what is the simplest way to achieve it?&lt;/p&gt;&#xA;" OwnerUserId="10623" LastActivityDate="2016-10-23T13:55:41.470" Title="How, if possible, extend WiFi network over Internet?" Tags="|wireless|internet|bridge|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13289" PostTypeId="2" ParentId="13288" CreationDate="2014-11-28T14:10:54.737" Score="1" Body="&lt;p&gt;One way to achieve this is with two commercial-grade routers (I assume you have an Internet connection in both locations).  You configure the routers to create a GRE Tunnel between them so they can route traffic between the two sites.  Your two sites will be able to communicate with each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should point out that you will have a routed connection (layer 3) between the two access points, which may not be suitable for all applications.  But for general use, it should be fine.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-11-28T14:50:41.890" LastActivityDate="2014-11-28T14:50:41.890" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13290" PostTypeId="1" CreationDate="2014-11-28T17:04:41.150" Score="1" ViewCount="876" Body="&lt;p&gt;I am learning about &lt;a href=&quot;http://en.wikipedia.org/wiki/Ingress_filtering&quot; rel=&quot;nofollow&quot;&gt;Ingress Filtering&lt;/a&gt; where unauthorised packets are filtered out from entering the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get a better understanding of it , I found an article which said:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the system examines all incoming packets to get information about&#xA;  their origins. The system compares this information to a database to&#xA;  determine if a packet is indeed from the place it says it is. If it&#xA;  appears to be a match, it can be allowed through. If there is a&#xA;  problem with the source, the system can hold the packet, keeping it&#xA;  out of the network and protecting any users who might be attached to&#xA;  the network.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I understand that if the spoofed packets are from a source address which is not in the database , it will not be allowed to enter the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HOWEVER&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming a hacker spoof a source address which can be found in the database , when the system compares this information to the database information , a match will be found and the packet will enter the network though it has been spoofed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering if the system is able to detect packets which has been spoofed with IP source address which could be found in the database and if yes how are such packets detected ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;EDIT : It appears the term &quot;legitimate&quot; and &quot;illegitimate&quot; has been causing alot of confusion so I have changed it to source address found in the database and source address not found in the database. I hoped this has made the question easier to understand&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3723" LastEditorUserId="3723" LastEditDate="2014-11-28T17:39:45.750" LastActivityDate="2014-11-28T23:41:55.387" Title="How does ingress filtering protect against legitimate spoof packets?" Tags="|security|acl|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13291" PostTypeId="1" CreationDate="2014-11-28T18:13:03.457" Score="2" ViewCount="202" Body="&lt;p&gt;Looking to get some insight from guys in the service provider space.&#xA;The question is straightforward:  If you're in a provider environment, and lets say you have 10,000 customers, each with their own environment (say IaaS/racks in a colo) - How do you segregate all of those customers efficiently.  Private VLAN's, mpls, etc etc.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second part of the question from those with extensive SP experience, is is there a relatively standard way you see people doing this, or if there are a million ways to skin this cat is it really just a matter of opinion on how providers achieve the goal of managing each customer network.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2014-11-28T18:21:19.907" LastActivityDate="2014-12-29T13:40:04.717" Title="How do service providers segregate customers?" Tags="|service-provider|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13292" PostTypeId="2" ParentId="13247" CreationDate="2014-11-28T19:59:05.183" Score="2" Body="&lt;p&gt;The problem came of the fact that some interface configuration about dhcp snooping and arp inspection prevents static address ip. Adding a DHCP solve the problem.&lt;/p&gt;&#xA;" OwnerUserId="10583" LastActivityDate="2014-11-28T19:59:05.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13293" PostTypeId="1" CreationDate="2014-11-28T21:59:28.240" Score="6" ViewCount="19682" Body="&lt;p&gt;I have a Mikrotik of RB9xx series (mipsbe). I would like to see how much data flow through the router each month. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't need anything fancy like flow per user (MAC address) stats, just the whole download / upload number on WAN interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Queue&quot; rel=&quot;noreferrer&quot;&gt;Mikrotik wiki&lt;/a&gt; I've found only some examples that are connected with limiting bandwidth, but that I do not want to do.&lt;/p&gt;&#xA;" OwnerUserId="10626" LastEditorUserId="8499" LastEditDate="2018-02-14T16:48:56.257" LastActivityDate="2018-02-14T16:48:56.257" Title="How to measure monthly download and upload on interface on Mikrotik?" Tags="|router|" AnswerCount="3" CommentCount="0" ClosedDate="2017-01-28T20:50:36.747" ContentLicense="CC BY-SA 3.0" />
  <row Id="13294" PostTypeId="2" ParentId="13293" CreationDate="2014-11-28T23:19:00.070" Score="2" Body="&lt;p&gt;While most networking equipment has the ability to see interface statistics (like traffic over a period of time), these counters are generally used for troubleshooting or while you're actively in the switch.  For longer term data from an interface like what you're looking for I strongly suggest a monitoring tool that utilizes SNMP for the job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mirkotik has a specific example using MRTG here:&#xA;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/SNMP_MRTG&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/SNMP_MRTG&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find this example to be overly complicated but not knowing your environment it's hard to say what you will think.  Personally I suggest, a free tool if you only have this one use case, like PRTG which can be downloaded for free, and remains free unless you monitor more than 30 things with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://shop.paessler.com/shop/standalone_free_license/&quot; rel=&quot;nofollow&quot;&gt;https://shop.paessler.com/shop/standalone_free_license/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have your tool of choice installed, setting up SNMP can be as simple as setting a community string, and setting a target for SNMP traps.  Details on configuring SNMP for your device are here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.mikrotik.com/testdocs/ros/2.9/root/snmp.php&quot; rel=&quot;nofollow&quot;&gt;http://www.mikrotik.com/testdocs/ros/2.9/root/snmp.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have need of more monitoring than just this one interface, you may want to investigate other tools to fit your specifications.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2014-11-28T23:19:00.070" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13295" PostTypeId="2" ParentId="13290" CreationDate="2014-11-28T23:36:21.003" Score="4" Body="&lt;p&gt;If a hacker spoofs packets which match your SRC/DST fields at any line in an ACL, then the firewall is going to allow the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only exception to this is if you have a stateful firewall, and the spoofed packets don't make 'sense' for the given conversation the firewall is tracking.  An example of this would be a hacker spoofing tcp syn's to a host that's already mid-conversation with the real source IP.  The firewall would see this behavior and drop the packet.  This doesn't apply if there's no session already being tracked by the firewall, so again the cases in which a stateful firewall is going to completely block all spoofed packet is situational at best.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are exceptions for both stateful and stateless firewalls, but being general it's hard to give you more (useful) detail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can however design ACL's in way that can detect spoofed IP's in certain situations.  For instance, you could have an edge firewall, and you know logically only public IP's will be coming from the outside to your network, so you could create ACL's blocking all of the private IP space from the outside, and that could stop some spoofing attempts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In similar veins you could do this for networks you &lt;em&gt;know&lt;/em&gt; will not be coming inbound to the interface you're making the ACL for, and so poor spoofing attempts would be stopped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many tools that need to work in concert with a firewall to protect against spoofing attacks, but the best any engineer can do is look at the firewalls placement in their network and design ACL's that factor in which traffic should logically ever be allowed to pass through a given interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need more detail let me know and I'll reword the answer for you!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2014-11-28T23:41:55.387" LastActivityDate="2014-11-28T23:41:55.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13296" PostTypeId="1" AcceptedAnswerId="13297" CreationDate="2014-11-29T04:35:23.350" Score="4" ViewCount="7516" Body="&lt;p&gt;so quick question, in the ACL bellow, Would &quot;permit ip any any&quot; allow ICMP packet to traverse the router? Or is &quot;permit ip any any&quot; in the ACL only referring to allowing any layer 3 address from traversing the router and since there is not a specific ACL for ICMP packets it will deny (Implicit Deny).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 102 permit tcp any any eq ftp&#xA;access-list 102 permit tcp any any eq ftp-data&#xA;access-list 102 deny tcp any any eq telnet&#xA;access-list 102 deny icmp any any echo-reply&#xA;access-list 102 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10628" LastEditorUserId="775" LastEditDate="2014-11-29T10:48:30.777" LastActivityDate="2020-12-06T07:58:34.793" Title="ACL Question. access-list permit ip any any" Tags="|cisco|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13297" PostTypeId="2" ParentId="13296" CreationDate="2014-11-29T06:48:03.427" Score="6" Body="&lt;p&gt;Referring to IP in an access list refers to all IP based protocols. You have denied echo replies but all other messages as ICMP redirect, time exceeded, fragmentation needed, echo would be allowed through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other IP based protocols such as OSPF would also be allowed to pass through with your ACL.&lt;/p&gt;&#xA;" OwnerUserId="105" LastActivityDate="2014-11-29T06:48:03.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13298" PostTypeId="1" AcceptedAnswerId="13304" CreationDate="2014-11-29T06:54:31.333" Score="15" ViewCount="10979" Body="&lt;p&gt;SysAdmins often try to convince me that x86 general-purpose OS's can perform just as well as routers with low MHz CPUs and dedicated silicon (i.e., ASICs) at 1Gbps line rates. This thinking is carrying over into the SDN realm such as virtual switches in VMWare. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I intuitively understand the differences between the benefits of ASICs vs x86 in handling traffic particularly with respect to microbursts. &lt;strong&gt;Is it correct in assuming that ASICs for router or switch interfaces will outperform the use of an x86 CPU for &lt;em&gt;all&lt;/em&gt; packet processing which will greatly suffer from CPU interrupts?&lt;/strong&gt; I know the OS (Windows, Linux, or specialized) greatly contributes to the hardware's performance to route or switch too.  And I know the x86 bus-speeds impose theoretical maximums to switching bandwidth especially once rates exceed 1Gbps.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How does the Catalyst 6500 Sup2T ASIC switching speed, for example, compare to the realistic x86 switching speeds found on general OSes or SDNs?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How does the Cisco 7200VXR-NPE-G2 switching speed, for example, compare to same...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How do typical router or switch latencies compare to general OSes performing the same function?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;NOTE: I don't want to hear the merits of virtual switch placement or their role within a virtual and physical network.  I also do not want to debate the merits of SDN for application time-to-deployment.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="775" LastEditDate="2014-11-29T12:30:25.423" LastActivityDate="2014-12-08T10:43:39.253" Title="ASICs vs x86 general-purpose routing/switching" Tags="|cisco|routing|cisco-catalyst|switching|linux|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13299" PostTypeId="2" ParentId="13291" CreationDate="2014-11-29T06:59:04.540" Score="3" Body="&lt;p&gt;When I worked for an early IaaS provider, we would provide a separate VLAN and associated /29 for a customer, with a dedicated BVI on the distribution router for their first server instance (or for each stand-alone server instance). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the customer had several instances and wanted local-to-local (many customers did not care; their business model was local-to-internet only), we would combine their downstream ports into the same VLAN and pull that to the same BVI for their first L3 hop. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since we metered traffic at the BVI, local-to-local was their business unless they impacted the infrastructure (in which case Abuse and the Network Architect talked to them) or violated TOU (in which case Abuse and Law Enforcement talked to them). &lt;/p&gt;&#xA;" OwnerUserId="10104" LastActivityDate="2014-11-29T06:59:04.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13300" PostTypeId="2" ParentId="13298" CreationDate="2014-11-29T07:18:32.977" Score="0" Body="&lt;p&gt;The 7200 series is being deprecated in favor of the ASR series because they cannot handle line-rate multi-gigabit switching. Catalysts and Nexus switches have a forwarding advantage over a general purpose processor IF the packet switching stays in silicon. If the traffic has to be process switched (i.e. it must be evaluated on the CPU instead of in the ASIC / FPGA), your throughput plummets and latency rises. For this reason, if you need high throughput switching, you separate the forwarding plane from the routing plane, and optimize to keep as much ofyour switching in silicon as possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some cases, you will see special-purpose switching silicon married to a general purpose processor (such as the white box switches intended to use Big Switch or other SDN for top-of-rack, distribution or overlay), and in these cases, you can see the best of all worlds (high throughput, low latency switching; high power processing for route and policy determination; integration with management frameworks such as Puppet or Chef). &lt;/p&gt;&#xA;" OwnerUserId="10104" LastActivityDate="2014-11-29T07:18:32.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13302" PostTypeId="2" ParentId="13268" CreationDate="2014-11-29T07:32:24.500" Score="1" Body="&lt;p&gt;Reach out to the authors of masscan for the list of live IP addresses they found. You should then be able to feed them into a structure from which you can pull out elements at random. &lt;/p&gt;&#xA;" OwnerUserId="10104" LastActivityDate="2014-11-29T07:32:24.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13303" PostTypeId="2" ParentId="13253" CreationDate="2014-11-29T12:15:56.937" Score="1" Body="&lt;p&gt;You don't have to accept all the routes from the Internet. Simply apply an in-bound filter to accept only the default route and a few other prefixes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can either use VRRP/HSRP on router's inside interfaces or use E/iBGP on the firewalls. This will allow routers to send the default route to the FW dynamically. If one router goes down, FW will not be black-holing the traffic to it as that route will simply go away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards.&lt;/p&gt;&#xA;" OwnerUserId="10306" LastActivityDate="2014-11-29T12:15:56.937" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13304" PostTypeId="2" ParentId="13298" CreationDate="2014-11-29T12:28:24.800" Score="21" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it correct in assuming that ASICs for router or switch interfaces will outperform the use of an x86 CPU for all packet processing which will greatly suffer from CPU interrupts?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's hard to say specifically whether interrupts are a limitation, since we aren't naming specific CPU, operating system or router models in this part of your question.  Overall, it's a safe generalization that general-purpose CPUs cannot touch the packet-switching performance of a well-designed ASIC.  When I say performance, I'm talking about &lt;a href=&quot;https://www.ietf.org/rfc/rfc2544.txt&quot; rel=&quot;noreferrer&quot;&gt;RFC 2544&lt;/a&gt; metrics, such as no-drop packets-per-second forwarding rate (NDR), throughput, and latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's not to say that there isn't a place for a CPU-based router; just that our life experiences tell us a CPU can't switch packets as quickly as an ASIC or FPGA.  My conclusion about ASICs / FPGAs being faster than a multi-core CPU seems to be reinforced by &lt;a href=&quot;https://electronics.stackexchange.com/q/140618&quot;&gt;this Q&amp;amp;A on Electronics.SE&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;PCI-bus performance&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I know the x86 bus-speeds impose theoretical maximums to switching bandwidth especially once rates exceed 1Gbps.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not sure which bus restrictions you're referring to here, but the information you have could be somewhat outdated.  The PCI Express bus used in most systems scales well above 10Gbps these days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/PCI_Express#PCI_Express_2.0&quot; rel=&quot;noreferrer&quot; title=&quot;PCI Express 2.0&quot;&gt;PCIe 2.0&lt;/a&gt; uses an &lt;a href=&quot;http://en.wikipedia.org/wiki/8b/10b_encoding&quot; rel=&quot;noreferrer&quot;&gt;8b/10b encoding&lt;/a&gt; scheme that penalized it approximately 20% for the PCI lane encoding overhead; before that encoding penalty, &lt;a href=&quot;http://en.wikipedia.org/wiki/PCI_Express#PCI_Express_2.0&quot; rel=&quot;noreferrer&quot; title=&quot;PCI Express 2.0&quot;&gt;PCIe 2.0&lt;/a&gt; delivers 4Gbps of raw bandwidth per lane.  However, even with the 20% 8b/10b penalty, &lt;a href=&quot;http://en.wikipedia.org/wiki/PCI_Express#PCI_Express_2.0&quot; rel=&quot;noreferrer&quot; title=&quot;PCI Express 2.0&quot;&gt;PCIe 2.0&lt;/a&gt; x8 (8 PCIe lanes) squeezes out over 25Gbps; thus you can easily run a single 10GE adapter at bidirectional line-rate on a PCIe 2.0 x8 card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/PCI_Express#PCI_Express_3.x&quot; rel=&quot;noreferrer&quot; title=&quot;PCI Express 3.0&quot;&gt;PCIe 3.0&lt;/a&gt; (used in Intel Ivy Bridge chipsets) uses 128b/130b encoding, which greatly improves PCI-bus efficiency, and doubles the per-lane bandwidth.  Thus a PCIe 3.0 x8 card could deliver 63Gbps (8.0*8*128/132).  This is nothing to sneeze at; you can safely pack two line-rate 10GEs on a single riser with those performance rates.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Cisco vs Vyatta performance&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Caveat: I'm using vendor-supplied marketing material for all comparisions...  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;How does the Catalyst 6500 Sup2T ASIC switching speed, for example, compare to the realistic x86 switching speeds found on general OSes or SDNs?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a bit challenging because we're going to compare a fully-distributed switching system (Sup2T) to a centralized-switching system (Vyatta), so be careful interpreting the results.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Sup2T can forward at up to 60Mpps non-drop rate &lt;em&gt;with features enabled&lt;/em&gt;.  Reference: &lt;em&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/white_paper_c11-676346.html&quot; rel=&quot;noreferrer&quot;&gt;Catalyst 6500 Sup2T Architecture White Paper&lt;/a&gt;&lt;/em&gt;.  Note that this is just a bare Sup2T system with no Distributed Forwarding Cards (DFC).&lt;sup&gt;Note 1&lt;/sup&gt;&lt;/li&gt;&#xA;&lt;li&gt;I have found RFC 2544 test results for the Vyatta 5600 forwarding at up to 20.58Mpps non-drop rate, and 70Mpps if you can accept some drops.  The NDR throughput was 72Gbps.  Reference: &lt;em&gt;&lt;a href=&quot;https://www.sdncentral.com/download-brocade-vyatta-5600-vrouter-performance-report/&quot; rel=&quot;noreferrer&quot;&gt;Vyatta 5600 vRouter Performance Test (SDN Central)&lt;/a&gt;&lt;/em&gt;.  SDN Central registration is required to see the full report.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;How does the Cisco 7200VXR-NPE-G2 switching speed, for example, compare to same...&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The Vyatta blows an NPE-G2 out of the water, performance-wise; the NPE-G2 can do up to 2Mpps based on the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/7200-series-routers/product_data_sheet0900aecd8047177b.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco NPE-G2 Datasheet&lt;/a&gt;.  That's not really a fair comparison though given the age of the NPE-G2, vs a brand-new Intel 10-Core system packed with 10GE cards.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How do typical router or switch latencies compare to general OSes performing the same function?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is a fantastic question. &lt;a href=&quot;http://www.iaeng.org/publication/WCECS2012/WCECS2012_pp973-978.pdf&quot; rel=&quot;noreferrer&quot;&gt;This paper&lt;/a&gt; indicates that Vyatta has higher latencies, but I would like to see this kind of testing done against the Intel E5 series CPUs.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Summary&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Recap of a side-by-side comparison of Sup2T vs the Brocade Vyatta 5600:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Sup2T: 60Mpps NDR IPv4 with features (such as ACLs)&lt;/li&gt;&#xA;&lt;li&gt;Vyatta and Intel E5: up to 20Mpps IPv4 NDR &lt;em&gt;without features&lt;/em&gt;, or 70Mpps if you can accept small numbers of drops.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Sup2T still wins in my opinion, particularly when you look at what you get with the Sup2T (distributed scale to 720Mpps, MPLS, countless MIBs, Layer2 and Layer3 switching, etc...). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all you care about is raw switching performance, you can get respectable performance numbers from an x86 CPU.  However, in real networks, it's not often just about who has the best drag-race numbers; most people &lt;a href=&quot;https://networkengineering.stackexchange.com/a/3131/775&quot;&gt;need to worry about features&lt;/a&gt; (see: &lt;em&gt;When should I focus on each value for switch assessment?&lt;/em&gt;).  A big factor to consider is the number of features available, and how they integrate with the rest of your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also worth looking at operational feasibility of using x86-based systems in your company.  I haven't used Brocade + Vyatta myself, but they could do a decent job building good show commands and support hooks into the box.  If they indeed support enough features, and their system scales well in &lt;em&gt;real networks&lt;/em&gt;, then go for it if that's what you like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if someone goes cheap and just builds a linux box + &lt;code&gt;bird&lt;/code&gt; / &lt;code&gt;quagga&lt;/code&gt; + ACLs + qos, I would not want to be the guy supporting that solution.  I have always maintained that the open-source community does a great job innovating, but the supportability of their systems pales when compared with mainstream network vendors (Arista / Cisco / Force10 / Juniper).  One needs only to look at &lt;code&gt;iptables&lt;/code&gt; and &lt;code&gt;tc&lt;/code&gt; to see just how convoluted you can make a CLI.  I occasionally field questions from people who look at the output of &lt;code&gt;ip link show&lt;/code&gt; or &lt;code&gt;ifconfig&lt;/code&gt; and get wierded out because the packet counters aren't right; typically the major network vendors do a much better job testing their counters, vs what I see in the linux NIC drivers.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;End Notes&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Note 1&lt;/sup&gt; Nobody who cares about performance would ever buy a Sup2T and fail to populate the chassis with DFCs.  The Sup2T can switch at 60Mpps, but a loaded chassis with DFCs scales to 720Mpps.&lt;br&gt;&lt;br&gt;&#xA;&lt;sup&gt;Note 2&lt;/sup&gt; The Vyatta test ran on dual-processor, 10-core Intel E5-2670v2 at 2.5Ghz per core; if we count a single core as two virtual cores (i.e. hyper-threading), that's a total of 40 cores for packet switching.  The Vyatta was configured with Intel x520-DA2 NICs, and used Brocade Vyatta version 3.2.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-12-08T10:43:39.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13305" PostTypeId="1" CreationDate="2014-11-29T13:58:53.263" Score="2" ViewCount="29230" Body="&lt;p&gt;I am studying with Cisco Packet Tracer. Now I have a problem: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- A DHCP Server connect to switch A, with 3 VLAN 1,2,3&#xA;- 2 switches B,C connect to switch A, B is VLAN 2 and C is VLAN 3&#xA;- Some computer connect to B and C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OGHXK.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can use IP helper to help the computers in different VLANs contact DHCP server if all computers and server is connected into 1 switch, but I dont know how to do it in the above scenario with multiple switch. So how can I do that? And a bit of explaining is great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;I mean that:&#xA;Should I set the port between 2 switches as Trunk or just Access?&#xA;Should I set the other Switches with IP address, IP helper address, VLAN database like the main switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Follow Dougrritzer and Teun Vink answer, I set as follow:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch A:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enable&#xA;conf t&#xA;&#xA;int fa0/1&#xA;switchport trunk encapsulation dot1q&#xA;switchport native vlan 2&#xA;switchport mode trunk&#xA;exit&#xA;&#xA;int fa0/3&#xA;switchport access vlan 1&#xA;switchport mode access&#xA;exit&#xA;&#xA;int vlan 1&#xA;ip address 192.168.1.1 255.255.255.0&#xA;exit&#xA;&#xA;int vlan 2&#xA;ip address 192.168.2.1 255.255.255.0&#xA;exit&#xA;&#xA;ip routing&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enable&#xA;conf t&#xA;&#xA;int fa0/1&#xA;switchport trunk encapsulation dot1q&#xA;switchport native vlan 2&#xA;switchport mode trunk&#xA;exit&#xA;&#xA;int fa0/2&#xA;switchport access vlan 2&#xA;switchport mode access&#xA;exit&#xA;&#xA;int fa0/2&#xA;switchport access vlan 2&#xA;switchport mode access&#xA;exit&#xA;&#xA;int vlan 2&#xA;ip helper-address 192.168.1.2&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the computers on port fa0/2 still &quot;DHCP request failed&quot;. Am I wrong at some points?&lt;/p&gt;&#xA;" OwnerUserId="10633" LastEditorUserId="10633" LastEditDate="2014-11-30T09:39:06.960" LastActivityDate="2016-06-05T09:51:37.457" Title="Cisco - How to configure IPHelper to relay DHCP with multiple switches?" Tags="|cisco|cisco-ios|" AnswerCount="4" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="13306" PostTypeId="2" ParentId="13305" CreationDate="2014-11-29T14:13:12.007" Score="0" Body="&lt;p&gt;For a host in one VLAN to receive DHCP information from a DHCP server in another VLAN you have to configure inter-vlan routing, whether that would be a router-on-a-stick config or using a Layer 3 switch.&lt;/p&gt;&#xA;" OwnerUserId="10332" LastActivityDate="2014-11-29T14:13:12.007" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13307" PostTypeId="1" AcceptedAnswerId="29247" CreationDate="2014-11-29T15:43:28.020" Score="2" ViewCount="2407" Body="&lt;p&gt;Currently you have to search the entire forwarding database table because the SNMP &lt;strong&gt;key&lt;/strong&gt; contains the MAC address while the SNMP &lt;strong&gt;value&lt;/strong&gt; contains the port number:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpbulkwalk -c public -v 2c switch 1.3.6.1.2.1.17.4.3.1.2 | grep &quot;INTEGER: 123&quot;&#xA;0.34.107.48.216.142 = INTEGER: 123&#xA;^^^^^^^^^^^^^^^^^^^ MAC Address in decimal on port 123&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does a standard SNMP subtree containing a &quot;Port -&gt; MAC&quot; association perhaps exist? Or is there a more efficient way to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That way you would not have to &lt;code&gt;snmpwalk&lt;/code&gt; the switch but could concisely query for a certain port, which would certainly alleviate the load on the switch's CPU and also accelerate the queries.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Background&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm currently trying to find out what kind of burden a NAC (Network Access Control device) performing a MAC authentication would put on the devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please don't tell me MAC auth is not secure. I know. But you have to start somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know you can also use Radius (which transmits the MAC address directly). Not sure however what would happen in that case when someone plugs in a &quot;dumb&quot; switch = more than one device/MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's stick to the fact that this would be a generic NAC that receives snmp traps when the link comes up and then does its work.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2016-04-02T21:12:31.180" Title="Retrieve MAC address(es) directly via port number (using SNMP)" Tags="|snmp|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13311" PostTypeId="1" CreationDate="2014-11-29T20:21:54.047" Score="3" ViewCount="4873" Body="&lt;p&gt;&lt;strong&gt;Situation:&lt;/strong&gt;&#xA;Previous company setup each building on their own ISP/Modem. They then used cisco routers to create a VPN connection over the internet from the looks of it to the other building. This from my deduction has caused quickbooks to freeze and work horribly when trying to access the central server in building 2 at the bottom.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Fix:&lt;/strong&gt;&#xA;What I want to do, correct me if this is the wrong way to go, is setup a wifi bridge by shooting a signal to each and connecting as so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SWITCH&amp;lt;---&amp;gt;WifiBridge&amp;lt;-------&amp;gt;WifiBridge&amp;lt;---&amp;gt;SWITCH&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is the going to be the correct way to go?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what should I consider or look for when trying to determine hardware? My issue is they want this done ASAP and while I understand networking decently enough, I lack physical tools like ladders, drills, glue, ect... for doing serious professional mounting with polls like if I was going to mount a satellite dish. So I was wondering if maybe it would be enough to just mount or position the wifi bridge antennas in the comrooms high enough to shoot through the buildings roof and if that would be ok due to the short distant. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We ruled out running fiber or a CAT6 cable just due to all the concrete and hard labor that would be involved to properly run the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zL4cJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="3191" LastEditDate="2014-11-30T00:36:51.330" LastActivityDate="2014-12-01T15:40:31.157" Title="Wireless options for connecting two buildings together (300ft)" Tags="|switch|wireless|bridge|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13312" PostTypeId="2" ParentId="13305" CreationDate="2014-11-29T20:38:50.920" Score="0" Body="&lt;p&gt;Please make sure you completely understand the difference between Layer 2 and Layer 3 before proceeding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you're talking about trunk and access that's Layer 2, so I ignore that, since your question is about DHCP. Because DHCP relay is a layer 3 feature, you configure it on an &lt;em&gt;interface&lt;/em&gt; of a &lt;em&gt;router&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically the answer to your question is that you will have to configure a DHCP relay/IP helper on the router that &quot;terminates&quot; the layer 3 network on which you'd like to use DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since switch A seems to be a router that routes between all 3 networks (from your drawing), for a PC connected to switch B (vlan 2) to be able to successfully perform DHCP requests (and receive answers) from a DHCP server in vlan 1, you'd configure a DHCP relay on switch A on interface vlan 2 and use as destination the IP address of the DHCP server as it is present in vlan 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router routing between vlan 2 and vlan 1 will convert the DHCP broadcast to unicast and send it to the DHCP server using its own IP. It will also translate the DHCP server's reply back so that it can reach the requesting machine in vlan 2.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="775" LastEditDate="2014-11-29T20:46:02.750" LastActivityDate="2014-11-29T20:46:02.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13313" PostTypeId="2" ParentId="13305" CreationDate="2014-11-29T20:53:12.093" Score="0" Body="&lt;p&gt;Connection between a switch and a switch should have the ports trunked and have access ports between switch and host. Trunk ports are tagged with the vlan you want to be allowed on it that's why. Access ports strip off the tag and frames from it are defaulted to native vlan (by default this is vlan 1).&#xA;To trunk the ports,&#xA;assuming fa0/1 is port on switchA connecting to switchB&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SwitchA(config) int fa0/1&#xA;&#xA;SwitchA(config-if)switchport encapsulation dot1q&#xA;&#xA;SwitchA(config-if)switchport mode trunk allowed vlan 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;do this for port on A connecting to C using vlan 3. Do this on the switches B and C too.This makes sure the switches only allow the native + the tagged vlan only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, add an IP address on vlan 1, 2 and 3. Use different subnet masks. (that's what vlans do, separate LANs, separate subnets, separate broadcast domains)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SwitchA(config)#int vlan 1&#xA;&#xA;SwitchA(config-if)#ip address 192.168.10.1 255.255.255.0&#xA;&#xA;Have the ports to the hosts as access ports.&#xA;&#xA;SwitchB(config)#int fa0/10&#xA;&#xA;SwitchB(config-if)# switchport mode access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your switches have layer 3 capability so no need for router on a stick. Enable ip routing on the switchA. No need to enable it on the others&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SwitchA(config)#ip routing&#xA;&#xA;SwitchA(config)#int vlan 1&#xA;&#xA;SwitchA(config-if)#ip address 192.168.10.1 255.255.255.0&#xA;&#xA;SwitchA(config-if)#int vlan 2&#xA;&#xA;SwitchA(config-if)#ip address 192.168.20.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then on switchB and C, &lt;strong&gt;set the ip helper-address on the vlans&lt;/strong&gt; 2 and 3. I assume in this case dhcp server is in &quot;vlan 1&quot; so address is in its subnet, maybe a .40&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SwitchB(config)#int vlan 2&#xA;&#xA;SwitchB(config-if)#ip helper-address 192.168.10.40&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10640" LastEditorUserId="509" LastEditDate="2014-11-29T21:52:29.037" LastActivityDate="2014-11-29T21:52:29.037" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13314" PostTypeId="2" ParentId="13268" CreationDate="2014-11-29T21:22:04.170" Score="2" Body="&lt;p&gt;Go to the Hurricane Electric internet services website, &lt;a href=&quot;http://lg.he.net/&quot; rel=&quot;nofollow&quot;&gt;http://lg.he.net/&lt;/a&gt; . They have a list of looking glasses from Europe, North America and Asia with the listed cities of their location. place your pointer on any of them, write down the address (this you will have to do manually) and trace it. Pick IP address being traced Looking glassess always have traceroute enabled&lt;/p&gt;&#xA;" OwnerUserId="10640" LastActivityDate="2014-11-29T21:22:04.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13315" PostTypeId="2" ParentId="13268" CreationDate="2014-11-29T21:43:29.777" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://ring.nlnog.net&quot; rel=&quot;nofollow&quot;&gt;NLNOG Ring&lt;/a&gt; nodes could be useful for this. &lt;a href=&quot;https://ring.nlnog.net/api/1.0/nodes&quot; rel=&quot;nofollow&quot;&gt;https://ring.nlnog.net/api/1.0/nodes&lt;/a&gt; has a nice parseable list of nodes, &lt;a href=&quot;http://map.ring.nlnog.net&quot; rel=&quot;nofollow&quot;&gt;http://map.ring.nlnog.net&lt;/a&gt; shows them on a map.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-11-29T21:43:29.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13316" PostTypeId="2" ParentId="13268" CreationDate="2014-11-29T22:10:00.887" Score="4" Body="&lt;p&gt;A crude, but functional way of finding addresses within the scope of what you’re looking for is pretty simple, given you find the right site.  Personally, I’d just crawl through &lt;a href=&quot;http://www.nirsoft.net/countryip/&quot; rel=&quot;nofollow&quot;&gt;NirSoft’s Major IP Address Blocks By Country&lt;/a&gt;.  Not entirely sure how reliable or up to date this site is, but it's the best I found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do a &lt;code&gt;curl&lt;/code&gt; on that link combined with a couple parsing parameters, you’d come up with something like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ryans-MacBook-Pro-4:~ ryan$ curl -s http://www.nirsoft.net/countryip/ | grep &quot;&amp;lt;td&amp;gt;&amp;lt;a&quot;&#xA;&amp;lt;td&amp;gt;&amp;lt;a href=&quot;af.html&quot;&amp;gt;Afghanistan&amp;lt;/a&amp;gt;&#xA;&amp;lt;td&amp;gt;&amp;lt;a href=&quot;al.html&quot;&amp;gt;Albania&amp;lt;/a&amp;gt;&#xA;&amp;lt;td&amp;gt;&amp;lt;a href=&quot;dz.html&quot;&amp;gt;Algeria&amp;lt;/a&amp;gt;&#xA;&amp;lt;td&amp;gt;&amp;lt;a href=&quot;as.html&quot;&amp;gt;American Samoa&amp;lt;/a&amp;gt;&#xA;&amp;lt;td&amp;gt;&amp;lt;a href=&quot;ad.html&quot;&amp;gt;Andorra&amp;lt;/a&amp;gt;&#xA;&amp;lt;...snip...&amp;gt;&#xA;&amp;lt;td&amp;gt;&amp;lt;a href=&quot;ye.html&quot;&amp;gt;Yemen&amp;lt;/a&amp;gt;&#xA;&amp;lt;td&amp;gt;&amp;lt;a href=&quot;zm.html&quot;&amp;gt;Zambia&amp;lt;/a&amp;gt;&#xA;&amp;lt;td&amp;gt;&amp;lt;a href=&quot;zw.html&quot;&amp;gt;Zimbabwe&amp;lt;/a&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From there, you just iterate through each &lt;code&gt;href&lt;/code&gt; and replace the .html with .csv to get an usable output.  For example, if you wanted to see what IP spaces Yemen was using, I used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ryans-MacBook-Pro-4:~ ryan$ curl -s http://www.nirsoft.net/countryip/ye.csv&#xA;31.31.176.0,31.31.191.255,4096,21/03/11,Public Telecommunication Corporation&#xA;46.35.64.0,46.35.95.255,8192,13/10/10,Public Telecommunication Corporation&#xA;78.137.64.0,78.137.95.255,8192,11/09/12,Public Telecommunication Corporation&#xA;82.114.160.0,82.114.191.255,8192,30/12/03,Public Telecommunication Corporation&#xA;89.189.64.0,89.189.95.255,8192,11/10/06,Public Telecommunication Corporation&#xA;109.74.32.0,109.74.47.255,4096,20/10/09,Public Telecommunication Corporation&#xA;109.200.160.0,109.200.191.255,8192,05/02/10,Public Telecommunication Corporation&#xA;195.94.0.0,195.94.31.255,8192,15/08/96,TeleYemen&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some basic syntax would make it usable; like taking the first subnet in each section.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ryans-MacBook-Pro-4:~ ryan$ curl -s http://www.nirsoft.net/countryip/ye.csv | head -1 \&#xA; | cut -d &quot;,&quot; -f 1-2 | tr &quot;,&quot; &quot; &quot;&#xA;31.31.176.0 31.31.191.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For obvious reasons we aren’t going to automate this entire process for you, but this should set you off in the right direction.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-11-29T22:10:00.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13319" PostTypeId="1" AcceptedAnswerId="13320" CreationDate="2014-11-30T02:47:03.083" Score="5" ViewCount="1142" Body="&lt;p&gt;I am currently using Wireshark version 1.12.2.&#xA;When I searched the internet I found this result&#xA;&lt;a href=&quot;https://i.stack.imgur.com/CdvLZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CdvLZ.jpg&quot; alt=&quot;alt text&quot; /&gt;&lt;/a&gt;&lt;br /&gt;&#xA;&lt;sub&gt;(source: &lt;a href=&quot;https://wiki.wireshark.org/TCP_Relative_Sequence_Numbers?action=AttachFile&amp;amp;do=get&amp;amp;target=tcprelativesequencenumbers.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;wireshark.org&lt;/a&gt;)&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;p&gt;But, this option is not available in my version. I could see only the &amp;quot;Relative sequence numbers&amp;quot; check box. There is no option to enable/disable &amp;quot;Window scaling&amp;quot; feature.&#xA;Where can I find this in Wireshark v1.12.2 ?&#xA;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="8597" LastEditorUserId="31801" LastEditDate="2022-12-28T05:51:05.513" LastActivityDate="2022-12-28T05:51:05.513" Title="How to disable TCP window scaling in Wireshark?" Tags="|tcp|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="13320" PostTypeId="2" ParentId="13319" CreationDate="2014-11-30T03:23:41.337" Score="6" Body="&lt;p&gt;So all you need to do is: &lt;strong&gt;Right Click&lt;/strong&gt; one of the TCP segments =&gt; &lt;strong&gt;Protocol Preferences&lt;/strong&gt; =&gt; uncheck &lt;strong&gt;Relative Sequence Numbers&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Wj8Jc.png&quot; alt=&quot;Relative-Sequence-Numbers&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;FYI:&lt;/strong&gt; Ignore the filters, I just did that to make it more aesthetically pleasing.  They have nothing to do with the option selected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to address your comment:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the older version of Ethereal it has the option to disable relative sequence numbers and window scaling.  When the window scaling option is enabled in the older version you first mentioned (Ethereal aka old school Wireshark), it simply calculates the current window size against the current window scaling factor to give you a total.  When it's disabled, it only displays the current window size without the scaling factor taken into account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sZUJM.png&quot; alt=&quot;Window-Scaling&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The picture above is a snippet from the new version of Wireshark sniffing a TCP segment.  Here's how it correlates to the older version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Window Size value&lt;/strong&gt; This is the value present when window scaling is &lt;strong&gt;disabled&lt;/strong&gt; in the older version.&#xA;&lt;strong&gt;Calculated Window size&lt;/strong&gt; This is the value present when window scaling is &lt;strong&gt;enabled&lt;/strong&gt; in the older version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The major difference being is that the newer version contains both values and not just one or the other, so disabling the window scaling option isn't necessary.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2014-11-30T09:07:19.930" LastActivityDate="2014-11-30T09:07:19.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13324" PostTypeId="1" CreationDate="2014-11-30T14:53:41.600" Score="1" ViewCount="136" Body="&lt;p&gt;TCP is able to do flow and error control, is it a resulting consequence of using virtual circuit to send pacquets ?&#xA;Would it be possible to do error end flow control in datagram mode ? For e.g with UDP ?&lt;/p&gt;&#xA;" OwnerUserId="10649" LastActivityDate="2014-11-30T16:34:55.580" Title="Flow and error control" Tags="|tcp|udp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13325" PostTypeId="2" ParentId="13324" CreationDate="2014-11-30T16:34:55.580" Score="4" Body="&lt;p&gt;No, it's the other way around. TCP creates a virtual circuit, it is not using one: IP is connectionless. Doing error corection and flow control would be possible in the application using UDP, but what would be the point? If you require those, it would make more sense to use a protocol which already provides it, like TCP.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-11-30T16:34:55.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13327" PostTypeId="1" CreationDate="2014-11-30T20:05:34.287" Score="2" ViewCount="1203" Body="&lt;p&gt;When I tried packet capture with wireshark, I observed that the Don't fragment bit is always set for&#xA;1. all TCP packets and&#xA;2. DNS query response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understood why it is so in case 1, &lt;a href=&quot;https://stackoverflow.com/questions/2779198/benefits-of-dont-fragment-on-tcp-packets&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, my question is &#xA;1. Why it is always set for DNS query reponse ?&#xA;2. If the DF bit is not set for this packet and it gets fragmented on the way to client, will it cause any problems at the client ?&lt;/p&gt;&#xA;" OwnerUserId="8597" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2014-11-30T20:52:44.150" Title="DF bit always set for DNS query response" Tags="|ipv4|dns|ip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13328" PostTypeId="2" ParentId="13327" CreationDate="2014-11-30T20:30:43.233" Score="2" Body="&lt;p&gt;So to be frank, I had no idea this was a thing or why - but a bit of Google-fu was able to provide an answer.  Please do some more research in the future.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Stole part of a response from ServerFault:&lt;/strong&gt;&lt;/em&gt; &lt;a href=&quot;https://serverfault.com/questions/587625/why-dns-through-udp-has-a-512-bytes-limit&quot;&gt;https://serverfault.com/questions/587625/why-dns-through-udp-has-a-512-bytes-limit&lt;/a&gt;&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Firewalls will typically set a hard 512 byte limit on DNS packets (this is adjustable).  Per the IP RFC (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc791&lt;/a&gt;):&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Every internet destination must be able to receive a datagram of 576&#xA;octets either in one piece or in fragments to be reassembled.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As DNS is usually UDP, (with the exception of things like zone transfers, or DNSSEC which are TCP) as such, delivery is not ensured.  The above statement in the RFC guarantees the host will be able to handle the response size.  This appropriately, corresponds to the smallest possible MTU of 576 bytes.&lt;/p&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;It can, as mentioned above if you're using additional DNS features (DNSSEC, EDNS, etc.).  Typically in those cases you can increase the packet size maximum on the firewall(s).  Here's an example: &lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/dnssec.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/web/about/security/intelligence/dnssec.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-11-30T20:30:43.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13329" PostTypeId="1" AcceptedAnswerId="13330" CreationDate="2014-11-30T22:18:33.277" Score="13" ViewCount="1605" Body="&lt;p&gt;&lt;strong&gt;TLDR Question&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Who pays for traffic when it transits multiple providers&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there are a great many sites out there with this question and answer, but as yet I have not been able to understand them. If I am in CT and want to contact someone (a server) in CA, it is likely that my data will be transferred through at least three ISPs - my ISP, their ISP and some other(s) in between. The same is true if a connection is routed overseas to the UK and then to Germany and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to me too marvelous to be true to say that these companies who have built these huge networks are &quot;just fine&quot; with letting traffic though neither from or to their customers. Especially someone situated in Oklahoma or who ran a US-Europe or US-Asia underseas cable, the majority of the traffic won't be from their customers and there is no way for them to be paid for thru-traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could go on and on with this, but you can imagine yourselves all the questions and complexities. Maybe it is just relatively cheap to pass along this traffic once it reaches a &quot;major artery&quot; and even to lay underseas cables? Or maybe a little government funding and corporate charity supports the whole thing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this might be the wrong site for this, but I am looking for someone who actually knows something about the topic.&lt;/p&gt;&#xA;" OwnerUserId="10652" LastEditorUserId="775" LastEditDate="2014-11-30T22:37:21.967" LastActivityDate="2014-12-01T16:22:07.027" Title="Who pays for traffic when it transits multiple providers" Tags="|internet|isp|peering|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13330" PostTypeId="2" ParentId="13329" CreationDate="2014-12-01T00:07:00.323" Score="12" Body="&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: I forgot to mention this - if you're interested, there have been books written about this topic. I highly recommend Bill Norton's &lt;em&gt;The Internet Peering Playbook&lt;/em&gt;. &lt;a href=&quot;http://drpeering.net/core/buyTheBook.html&quot; rel=&quot;noreferrer&quot;&gt;Available in print or digital copies&lt;/a&gt; - it's pretty much the de facto text on this kind of stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DISCLAIMER&lt;/strong&gt;: The examples used here are hypothetical only - I have zero insight into the business relationships of the carriers mentioned in the below post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Internet is really controlled by the peering coordinators of the Tier 1 ISP's around the world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Internet connectivity business world, there's &lt;strong&gt;&lt;em&gt;transit&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;peering&lt;/em&gt;&lt;/strong&gt;. There are also various forms of peering (paid peering, settlement-free peering, etc) but for the most part, these are what Internet connectivity as a whole boils down to. Yes, it is complex because when it comes down to it, there &lt;strong&gt;is&lt;/strong&gt; a cost involved with getting your bits from Oklahoma to Germany and back. It's not just technical jargon and routing policy - there are significant economic and business drivers involved as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The term &quot;buying transit&quot; just refers to a contract where you're paying a provider money to get bits off of your network and on to someone else's network. Keeping to your example, let's say there are three providers involved with you sending traffic from your local office in Oklahoma to a branch office in Germany. Let's say your local provider is Hurricane Electric. Hurricane Electric gets the traffic to Germany via Level3. Level3 connects to a major German incumbent provider - DTAG, aka Deutsche Telekom AG. DTAG will then get your traffic to its final destination if the local office is buying transit from DTAG, or from someone else that relies on DTAG. So the connectivity would go something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Local office -&amp;gt; HE -&amp;gt; Level3 -&amp;gt; DTAG -&amp;gt; local German ISP -&amp;gt; remote office&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HE is not a tier one carrier, so they likely will buy transit from Level3, or may have paid peering with Level3. Level3 and DTAG are both tier one carriers and thus are most certainly peers, and the local German ISP that your remote office connects to would likely buy transit from DTAG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Forgetting the routing involved and only thinking about the money, one needs to understand traffic ratios. Typically the big tier one carriers (like Level3) will not peer (referring to settlement-free peering here) with others unless the traffic ratios are somewhat even. Unless you're another big carrier, this will almost certainly never be the case. Most local ISP's and content providers are called &quot;eyeball customers&quot;, because their ratios are outbound-heavy. Taking that into a business context, Level3's network would be utilized much more than the content provider or local ISP's network. At this point, you're right - Level3 does not benefit from peering with a local provider or a content provider, and it simply wouldn't happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you are a very large ISP with a great deal of customers and also a good chunk of originated prefixes, but you and Level3's traffic ratios just &lt;em&gt;aren't quite there yet&lt;/em&gt;, then paid peering may be an option - often much cheaper than buying transit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what if you're not a big carrier? Do you benefit from peering with other people, even if they aren't carriers or ISP's? &lt;strong&gt;&lt;em&gt;Yes.&lt;/em&gt;&lt;/strong&gt; When you buy transit, you're usually paying for a set cost per megabit, billed at 95% percentile usage rates, with a minimum commitment. If you're a content provider, it's in your best interest to peer with as many people as possible, because this just brings the cost per megabit of your transit down, because when you peer with folks, you have a direct route to their network, and you no longer need to rely on transit for your bits to reach their network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also playing into all of this is routing policy of these tier 1 carriers. Typically these carriers will do hot-potato routing. What that means is if Level3 peers with DTAG in multiple geographic locations, Level3 will likely dump off the traffic destined to your remote office at a DTAG peering point as quickly as possible, rather than carrying the traffic on its own network to a DTAG peering point that is closest to the final destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also run into situations where carriers neglect peering ports in order to strong-arm their peers into doing something they want. In other situations in peering relationships, one carrier will simply de-peer with the other carrier, causing devastating impact for a significant portion of Internet users (see Level3 and Cogent).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer the original question - the TL;DR answer is all networks involved with getting the traffic from the source to the destination, pay in some way or another. The longer answer is that if you're going to buy transit, make sure you're buying the transit from a reputable carrier. You're not just paying for uptime and availability, you're also paying for the carrier's connectivity as well.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2014-12-01T16:22:07.027" LastActivityDate="2014-12-01T16:22:07.027" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13332" PostTypeId="2" ParentId="10436" CreationDate="2014-12-01T03:40:47.257" Score="3" Body="&lt;p&gt;Well.  Since you've captured packets that show that your Trading Server is sending the TCP ACK's with a window size of 0, you at least know the problem is definitely on your side.  Which is actually a good thing, because you are in a position to fix it.  &lt;em&gt;(There is one thing that might be the issue which would be a problem on their end, I'll talk about that later)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You've also traced the issue to happening during times of increased throughput, also a good thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You said the CPU/RAM usage on your Trading Server reported normal.  The application you are using, is it by chance configured to use a limited amount of RAM on the host OS?  Maybe a limited percent?  Because it would stand to reason that if so, as you had more connections and more throughput, there was less RAM available to the application, and therefore less resources available for TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, what OS is your Trading Server using?  If you haven't already, you should look into tuning the OS to dedicate more RAM to TCP.  In &lt;a href=&quot;http://kb.globalscape.com/KnowledgebaseArticle10438.aspx&quot; rel=&quot;nofollow&quot;&gt;Windows, there are Registry values you can modify&lt;/a&gt;.  In &lt;a href=&quot;http://kaivanov.blogspot.com/2010/09/linux-tcp-tuning.html&quot; rel=&quot;nofollow&quot;&gt;Linux, there are config files you can edit&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would also be wise to make sure your Firewall (and nothing else in between) is trying to proxy your TCP sessions.  That way you know you are dealing with the full &quot;client to server&quot; TCP connection, and not something in between.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last thing I can offer is to study the TCP packets being sent from the Stock Exchange to your server just before your server sends a Window Size of 0.  In particular, look for the incoming packets to have the value 11 in the IP Header's ECN field (&lt;a href=&quot;http://en.wikipedia.org/wiki/IPv4#ECN&quot; rel=&quot;nofollow&quot;&gt;Explicit Congestion Notification&lt;/a&gt; -- the last two bits in what used to be &lt;a href=&quot;http://en.wikipedia.org/wiki/IPv4#DSCP&quot; rel=&quot;nofollow&quot;&gt;DSCP&lt;/a&gt;, bits 14 and 15 if you're looking at an &lt;a href=&quot;http://en.wikipedia.org/wiki/IPv4#Header&quot; rel=&quot;nofollow&quot;&gt;IP Header&lt;/a&gt;).  There is a chance that if both the Client and Server in the communication supported ECN, and a router in transit detected congestion, that it turned these bits on to tell the client and server to slow down their transfers.  &lt;em&gt;(This is that thing I said that might be a problem on their end)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that (tries to) answer questions 0,1,3.  I'll have to dig around a bit more to give you a reliable answer for 2.  But I'm pretty confident there is a way.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-12-01T03:40:47.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13333" PostTypeId="2" ParentId="13329" CreationDate="2014-12-01T03:50:06.530" Score="7" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Who pays for traffic when it transits multiple providers?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Ultimately, you do.&lt;/p&gt;&#xA;&lt;p&gt;John Jensen did a &lt;a href=&quot;https://networkengineering.stackexchange.com/a/13330/775&quot;&gt;fantastic job&lt;/a&gt; explaining how this works overall, but I suspect a diagram could help.  I will borrow the example providers he used.&lt;/p&gt;&#xA;&lt;p&gt;Let's assume you have a web server colo'd in an &lt;a href=&quot;http://en.wikipedia.org/wiki/Hurricane_Electric&quot; rel=&quot;noreferrer&quot;&gt;HE.net&lt;/a&gt; facility; assume you pay &lt;a href=&quot;http://en.wikipedia.org/wiki/Hurricane_Electric&quot; rel=&quot;noreferrer&quot;&gt;HE.net&lt;/a&gt; $500/month for a 100Mbps co-colocation.  All &lt;a href=&quot;http://en.wikipedia.org/wiki/Hurricane_Electric&quot; rel=&quot;noreferrer&quot;&gt;HE.net&lt;/a&gt;'s transit and upstream provider's fees are passed through to &lt;a href=&quot;http://en.wikipedia.org/wiki/Hurricane_Electric&quot; rel=&quot;noreferrer&quot;&gt;HE.net&lt;/a&gt;'s customers.&lt;/p&gt;&#xA;&lt;p&gt;When someone on Teo L.T's network pulls a page from your server, the traffic has to go through &lt;a href=&quot;http://en.wikipedia.org/wiki/Hurricane_Electric&quot; rel=&quot;noreferrer&quot;&gt;HE.net&lt;/a&gt;, (potentially) &lt;a href=&quot;http://en.wikipedia.org/wiki/Level_3_Communications&quot; rel=&quot;noreferrer&quot;&gt;Level(3)&lt;/a&gt;, &lt;a href=&quot;http://en.wikipedia.org/wiki/Deutsche_Telekom&quot; rel=&quot;noreferrer&quot;&gt;DTAG&lt;/a&gt;, and &lt;a href=&quot;http://en.wikipedia.org/wiki/Teo_LT&quot; rel=&quot;noreferrer&quot;&gt;Teo LT&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EsKUh.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EsKUh.png&quot; alt=&quot;Sample topology&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As a &lt;a href=&quot;http://en.wikipedia.org/wiki/Tier_2_network&quot; rel=&quot;noreferrer&quot;&gt;Tier 2&lt;/a&gt; provider, &lt;a href=&quot;http://en.wikipedia.org/wiki/Hurricane_Electric&quot; rel=&quot;noreferrer&quot;&gt;HE.net&lt;/a&gt; needs to buy transit from &lt;a href=&quot;http://en.wikipedia.org/wiki/Level_3_Communications&quot; rel=&quot;noreferrer&quot;&gt;Level(3)&lt;/a&gt; (Link {D}) and &lt;a href=&quot;http://en.wikipedia.org/wiki/Hurricane_Electric&quot; rel=&quot;noreferrer&quot;&gt;HE.net&lt;/a&gt; also buys bandwidth from an &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_exchange_point&quot; rel=&quot;noreferrer&quot;&gt;IXP&lt;/a&gt; (Link {E}).  Those transit / IXP fees are paid for by &lt;a href=&quot;http://en.wikipedia.org/wiki/Hurricane_Electric&quot; rel=&quot;noreferrer&quot;&gt;HE.net&lt;/a&gt;'s customers and any other revenue streams that &lt;a href=&quot;http://en.wikipedia.org/wiki/Hurricane_Electric&quot; rel=&quot;noreferrer&quot;&gt;HE.net&lt;/a&gt; might have (such as selling off some &lt;a href=&quot;http://en.wikipedia.org/wiki/Hurricane_Electric&quot; rel=&quot;noreferrer&quot;&gt;HE.net&lt;/a&gt; spare fiber capacity).&lt;/p&gt;&#xA;&lt;p&gt;An imaginary breakdown of who pays who for peering, transit and IXP colo is shown below...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Link | Link Type | Buyer      | Seller&#xA;---- + --------- + ---------- + ----------&#xA;{A}    Peering     N/A          N/A&#xA;{B}    Peering     N/A          N/A&#xA;{C}    IXP         Level(3)     IXP&#xA;{D}    Transit     HE.net       Level(3)&#xA;{E}    IXP         HE.net       IXP&#xA;{F}    IXP         DTAG         IXP&#xA;{G}    Transit     Teo L.T.     DTAG&#xA;{H}    Transit     Google       Level(3)&#xA;{I}    Transit     Google       DTAG&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;em&gt;Caveat:&lt;/em&gt; This diagram may have no resemblance to real peering / transit / IXP relationships; purely for purposes of illustration.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-12-01T04:09:32.237" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13335" PostTypeId="1" CreationDate="2014-12-01T08:19:35.547" Score="1" ViewCount="1102" Body="&lt;p&gt;I have stuck with formula how to calculate hosts and subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, I use formulas:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host = (2^(32-P))-2, where 32 are all bits for network, /P - is prefix&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnets = 2^(/P-N), where /P is prefix and N - is network part of class A,B or C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if I have mask 255.255.255.128(/P=25) and IP 192.10.1.0, there will be 126 hosts and 2 subnets&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hosts = (2^(32-25)-2)=126&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and subnets= 2^(25-24)=2, N=24 as it is class C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if I have address 192.10.1.0 and mask 255.240.0.0, /P=12 and N = 24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hosts = (2^(32-12))-2=1048574&lt;/p&gt;&#xA;&#xA;&lt;p&gt;subnets = 2^(12-24)  or for this variant I should use formula 2^P to calculate subnets ????&lt;/p&gt;&#xA;" OwnerUserId="7766" LastActivityDate="2014-12-01T12:50:09.537" Title="Subnetting. How to calculate hosts and subnets if /P &lt; N" Tags="|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13337" PostTypeId="2" ParentId="13335" CreationDate="2014-12-01T12:50:09.537" Score="8" Body="&lt;p&gt;First things first: Network Classes (A-E) are obsolete since 1993. Please stop using them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your formula is wrong, if you want to know how many /24 networks fit into a /12 you use:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2^(24-12) = 4096&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A /12 has 12 fixed bits:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111.11110000.00000000.00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A /24 has 24 fixed bits:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111.11111111.11111111.00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The difference between these two are the bits you can use for addressing your subnets (Here I used &lt;strong&gt;X&lt;/strong&gt; to make them visible):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111.1111XXXX.XXXXXXXX.00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2^12 are 4096 possible combinations, and in conclusion 4096 possible /24s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want the amount of hosts (/32) in a /23, use &lt;strong&gt;2^(32-23) = 512&lt;/strong&gt; and substract 2 addresses for network address and broadcast. You end up with &lt;strong&gt;510 hosts&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2014-12-01T12:50:09.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13338" PostTypeId="1" CreationDate="2014-12-01T14:07:29.083" Score="1" ViewCount="266" Body="&lt;p&gt;After many research I found that HSPA share the UMTS 5 Mhz band. However, I have not understood how can these two thechnology share it and why don't operator use only HSPA technology if it can offer the best performance than UMTS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can user use the two network in the same time and how?&#xA;How can user choose between HSPA and UMTS to send his data?&#xA;What the difference in code plan?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks.&lt;/p&gt;&#xA;" OwnerUserId="10657" LastEditorUserId="775" LastEditDate="2014-12-01T14:13:43.120" LastActivityDate="2015-10-26T17:11:13.763" Title="I have a bit confusion about the deployment of HSPA?" Tags="|mobile|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13339" PostTypeId="2" ParentId="13311" CreationDate="2014-12-01T15:40:31.157" Score="1" Body="&lt;p&gt;Check out Ubiquiti, ubnt.com. A number of choices there that will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a window in each building that has line of sight to the other window, you can place the wireless devices inside. I've seen that done with Hawking wireless bridges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, an external install would work best. Both Ubiquiti and Hawking's equipment is intended for outdoor install.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In either case you'll have to run cable to the antenna. Just placing it high in the building probably wont result in a decent signal. Those buildings probably have steel trusses and roof decking -- that's a tough environment for low-powered RF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are they too cheap to buy/rent ladders? Does no-one have tools?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And you already know the 'best' solution: run fiber between the buildings. (Edit: DO NOT run copper between the buildings -- lots of reasons -- lightning, ground potential, distance are some) I see some poles in the picture (parking lot lights?) -- those might/could be used for aerial cable between the buildings. Corning makes good aerial optical cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can't figure it out and/or install it, then hire a consultant/specialist. DON'T hire 'an electrician' -- they typically don't understand low-voltage and network requirements.&lt;/p&gt;&#xA;" OwnerUserId="10659" LastActivityDate="2014-12-01T15:40:31.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13340" PostTypeId="1" AcceptedAnswerId="14931" CreationDate="2014-12-01T16:37:20.693" Score="1" ViewCount="893" Body="&lt;p&gt;I am trying to understand why this doesn't seem to work as I am thinking it should.&#xA;I am in the middle of implementing VLAN in order to seclude different traffics such as voice, server, workstations... and I am still trying to understand how the un/tagging works&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the setup:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;ESX Server on Dell SW with default VLAN 1 - so everything is untagged&#xA;in VLAN 1 I have an LACP using p17-18&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;HP Procurve Server SW with default VLAN 1 - again everything is untagged in VLAN 1 I also have an LACP. the LACP status is active and&#xA;good. the LACP trunk is in VLAN 1. I have a trunk to the Core switch&#xA;below aka Trk1, this Trk1 is in VLAN 1.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;HP procurve Core SW with default VLAN 1 - all is untagged in VLAN 1 I have a trunk to the server switch above aka Trk1, this Trk1 is in&#xA;VLAN1. VLAN has a DHCP, through IP helpers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My issue:&#xA;Setting up a vSwitch in ESX not using tagging, everything works fine.&#xA;Seeting up a vSwitch in ESX using tagging (here VLAN1), I loss connectivity to/from that VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagined that the explicit tagging of that virtual switch would not impact anything, but somehow it does and I do not understand why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did I miss something obvious?&lt;/p&gt;&#xA;" OwnerUserId="10661" LastEditorUserId="10661" LastEditDate="2014-12-01T16:51:40.247" LastActivityDate="2015-03-03T14:21:21.217" Title="VLAN routing and LACP on Procurve, VMware" Tags="|switch|vlan|hp-procurve|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13341" PostTypeId="2" ParentId="13340" CreationDate="2014-12-01T17:19:43.683" Score="1" Body="&lt;p&gt;If you draw graph of your network, you apply tagging on the links between nodes. You always need to apply tagging on the two systems connected to that link at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for a virtual switch, depending on which side you are tagging, you either need to tag the physical connection on the uplink port, or you need to change the VM to accept tagged packets. More likely the former.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2014-12-01T17:19:43.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13342" PostTypeId="1" AcceptedAnswerId="13343" CreationDate="2014-12-01T18:49:32.057" Score="3" ViewCount="981" Body="&lt;p&gt;I have a network on Packet tracer consisting of 3 routers and 1 ISP router. Each router is connected to a switch. I am practising using OSPF v2 for my Cisco CCNA tests.&#xA;I have configured Router 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial0/0/0&#xA; ip address 192.168.28.202 255.255.255.252&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 192.168.28.209 255.255.255.252&#xA; clock rate 2000000&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; network 192.168.28.200 0.0.0.3 area 0&#xA; network 192.168.28.208 0.0.0.3 area 0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;router 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial0/0/0&#xA; ip address 192.158.28.206 255.255.255.252&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 192.168.28.210 255.255.255.252&#xA; clock rate 2000000&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; network 192.168.28.204 0.0.0.3 area 0&#xA; network 192.168.28.208 0.0.0.3 area 0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and router 3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial0/0/0&#xA; ip address 192.168.28.201 255.255.255.252&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 192.168.28.205 255.255.255.252&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/1/0&#xA; ip address 123.123.123.31 255.255.255.0&#xA; clock rate 2000000&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; network 192.168.28.200 0.0.0.3 area 0&#xA; network 192.168.28.204 0.0.0.3 area 0&#xA;!&#xA;ip default-gateway 123.123.123.31&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using this set up I currently have Router 1 and Router 3 exchanging, Router 1 and router 2 as well but Router 2 and Router 3 just don't work. I have removed all the network entries and started again.&#xA;But they just don't seem to want to play.&#xA;Just for clarity here is the OSPF neighbours table for router 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Neighbor ID     Pri   State           Dead Time   Address         Interface&#xA;202.202.29.254    0   FULL/  -        00:00:35    192.168.28.201  Serial0/0/0&#xA;192.168.28.210    0   FULL/  -        00:00:38    192.168.28.210  Serial0/0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;router 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Neighbor ID     Pri   State           Dead Time   Address         Interface&#xA;192.168.28.209    0   FULL/  -        00:00:30    192.168.28.209  Serial0/0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;router 3: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Neighbor ID     Pri   State           Dead Time   Address         Interface&#xA;192.168.28.209    0   FULL/  -        00:00:32    192.168.28.202  Serial0/0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas why OSPF isn't working for the final connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks &lt;/p&gt;&#xA;" OwnerUserId="10662" LastEditorUserId="189" LastEditDate="2014-12-01T19:26:34.367" LastActivityDate="2014-12-01T23:54:40.707" Title="Why doesn't my OSPF config work?" Tags="|routing|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13343" PostTypeId="2" ParentId="13342" CreationDate="2014-12-01T19:25:36.850" Score="6" Body="&lt;p&gt;There is a typo on router 2, the IP address of serial0/0/0 is incorrect:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address 192.158.28.206 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;158 instead of 168...&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-12-01T19:25:36.850" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13345" PostTypeId="1" CreationDate="2014-12-01T19:30:31.860" Score="-1" ViewCount="1824" Body="&lt;p&gt;I have one sender and one receiver node, connected through one switch. I am collecting advertised window size from both tcpdump and kernel. I am running tcp dump on the receiver side, to watch for window size on ACK packets, and also I've added some code in &quot;tcp_input.c&quot; file to printk the snd_wnd value. I believe these two values should be the same. I put data on two graphs, and the observed values on both graphs are completely different. I don't know why this is happening and I'm trying to find an answer for it. Here you can see these two graphs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCPDUMP result:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/J0P3Y.jpg&quot; alt=&quot;TCPDUMP Result&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;KERNEL result:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/M8AkO.jpg&quot; alt=&quot;Kernel Result&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10663" LastActivityDate="2014-12-01T22:49:06.333" Title="Advertised Window Size" Tags="|packet-analysis|tcpdump|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13347" PostTypeId="2" ParentId="13345" CreationDate="2014-12-01T22:49:06.333" Score="0" Body="&lt;p&gt;The Send window is different than the Receive window.  In an ACKnowledgement packet (segment), the sender of the ACK is advertising its &lt;strong&gt;Receive window&lt;/strong&gt;.  At no time in a TCP communication are either party sharing with each other their &lt;strong&gt;Send window&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SND_window is a running count of data the sender is meaning to send, as well as data that is sent that has not yet been acknowledged.  Whereas the RCV_window is a running count of data the receiver is willing to accept that is within the advertised window size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at these two pictures from the TCP/IP Guide:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/iwAsj.png&quot; alt=&quot;SND Window&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/VYsJH.png&quot; alt=&quot;RCV Window&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can (should) read the full articles on the &lt;a href=&quot;http://www.tcpipguide.com/free/t_TCPSlidingWindowDataTransferandAcknowledgementMech-2.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Send&lt;/a&gt; and &lt;a href=&quot;http://www.tcpipguide.com/free/t_TCPSlidingWindowDataTransferandAcknowledgementMech-3.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Receive&lt;/a&gt; windows at the &lt;a href=&quot;http://www.tcpipguide.com/free/index.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP/IP Guide&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-12-01T22:49:06.333" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13349" PostTypeId="2" ParentId="13260" CreationDate="2014-12-02T00:14:40.983" Score="0" Body="&lt;p&gt;If you want to see the data portion use debug ip packet detail with the [dump] keyword behind. You can't tab complete it. It's a 'hidden' command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debug ip packet detail &amp;lt;acl&amp;gt; dump&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10668" LastActivityDate="2014-12-02T00:14:40.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13350" PostTypeId="1" AcceptedAnswerId="13352" CreationDate="2014-12-02T01:07:36.433" Score="2" ViewCount="793" Body="&lt;p&gt;This has exhausted every resource I've found and nothing explains why enabling any vLAN besides the management vLAN   automatically shutdowns the management vLAN rendering their switch ports useless for IP traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a portable CCNA lab and following the exercises in Cisco's Exploration 3 and 4... creating a new management vLAN or using the default mgmt vLAN1 still Administratively shutdowns the currently running vLAN after &quot;no shut&quot; a different vLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches aren't constrained to just one running vLAN, but why is my config instantly shutting down the other singular operating vLAN the instant I &quot;no shut&quot; a different vLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appended an abridged running config and thoroughly exhausted the troubleshooting methods. More suggestions for additional troubleshooting are well meant... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I'm in need of some skilled peek of my flawed config instead of more suggestions cause I've exhaustively troublehshooted and switched cables to the infinite.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By now, I'm leaning towards some insidious Cisco limitation in a workgroup switch but the 2940 has seemingly executed every function w/o objection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;====RUNNING CONFIG (ABRIDGED FOR CLARITY)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree mode pvst&#xA;no spanning-tree optimize bpdu transmission&#xA;spanning-tree extend system-id&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 99&#xA; switchport mode dynamic auto&#xA; mdix auto&#xA; spanning-tree portfast&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 99&#xA; switchport mode dynamic auto&#xA; mdix auto&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 30&#xA; mdix auto&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport access vlan 20&#xA; switchport trunk native vlan 20&#xA; switchport mode dynamic auto&#xA; mdix auto&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;===SNIP===&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA;!&#xA;interface Vlan12&#xA; no ip address&#xA; no ip route-cache&#xA;!&#xA;interface Vlan20&#xA; ip address 172.16.20.20 255.255.255.0&#xA; no ip route-cache&#xA; shutdown&#xA;!&#xA;interface Vlan99&#xA; ip address 172.16.1.3 255.255.255.0&#xA; no ip route-cache&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Enabling VLAN interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;square(config-if-range)#inte vlan 99&#xA;square(config-if)#no shut&#xA;square(config-if)#&#xA;00:58:52: %LINK-3-UPDOWN: Interface Vlan99, changed state to up&#xA;00:58:52: %LINK-5-CHANGED: Interface Vlan20, changed state to administratively down&#xA;00:58:53: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan99, changed state to up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;do sh vlan brief&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                          active    Fa0/5, Fa0/6, Fa0/7, Fa0/8&#xA;                                                Gi0/1&#xA;10   FacultyStaff                     active&#xA;20   Students                         active    Fa0/4&#xA;30   Guest                            active    Fa0/3&#xA;99   ManagementNative                 active    Fa0/1, Fa0/2&#xA;1002 fddi-default                     act/unsup&#xA;1003 token-ring-default               act/unsup&#xA;1004 fddinet-default                  act/unsup&#xA;1005 trnet-default                    act/unsup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10669" LastEditorUserId="33" LastEditDate="2014-12-02T01:58:11.670" LastActivityDate="2014-12-02T01:58:11.670" Title="Cisco Catalyst 2940 / IoS 12.1 will only run ONE vLAN" Tags="|cisco|vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13351" PostTypeId="2" ParentId="13350" CreationDate="2014-12-02T01:51:05.527" Score="0" Body="&lt;p&gt;This behavior is by design. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/9992351/creating-multiple-vlans-ip-addresses-2940-8tf&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/9992351/creating-multiple-vlans-ip-addresses-2940-8tf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2014-12-02T01:51:05.527" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13352" PostTypeId="2" ParentId="13350" CreationDate="2014-12-02T01:51:33.457" Score="8" Body="&lt;p&gt;What you are actually referring to is the Switch Virtual Interface (SVI) and this assigns a L3 interface to a VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs are L2 and do not require an SVI to function.  This switch can support up to 128 VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2940 is a L2 switch.  The SVI is only for management, and the switch does not have any L3 routing capabilities.  As such, it only supports one active SVI at any time, as does the 2950 platform it is based upon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a quick reference as to it's capabilities, you can check the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-2940-series-switches/product_data_sheet09186a00801973c8.html&quot;&gt;datasheet&lt;/a&gt; on Cisco's website.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-12-02T01:51:33.457" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13353" PostTypeId="2" ParentId="13305" CreationDate="2014-12-02T05:19:19.043" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Should I set the port between 2 switches as Trunk or just Access?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It really doesn't matter in this situation.  Since SwB is only on VLAN 2 and SwC is only on VLAN 3, you can provide access with either a trunk/tagged port or an access port.  However, if you want the management SVI on SwB and SwC to be in VLAN 1 like SwA, they will need to be trunk/tagged ports.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Should I set the other Switches with IP address, IP helper address,&#xA;  VLAN database like the main switch?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IP helper statements do not apply to the L2 VLAN, rather they are applied to the L3 VLAN SVI (switch virtual interface).  They should be aware of the VLANs they will be configured to utilize but do not need any IP configuration (other than for management purposes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, SwA is functioning as your L3 gateway and should have an SVI for each VLAN with an appropriate IP address assigned.  You would configure your IP helper statements in the SVI for VLAN 2 and VLAN 3 to refer to the IP address of your DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a station broadcasts out a DHCP Discover frame on the VLAN, the SVI (which exists on that VLAN) will hear it.  If it has an IP helper statement configured, it will then relay/proxy the request to the configured IP address (which should be your DHCP server).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And the computers on port fa0/2 still &quot;DHCP request failed&quot;. Am I wrong at some points?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, you put your IP helper statement on an SVI on SwB (which has no IP address).  It should be on the SVI for VLAN 2 on SwA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in midn that if you are configuring an SVI for the first time, it is disabled by default.  To enable the SVI, you would need to add a &lt;em&gt;no shutdown&lt;/em&gt; statement to your configurations unless you had previously configured and enabled the SVI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This also assumes that the DHCP server is connected to Fa0/3 on SwA and that the station is connected to Fa0/2 on SwB based on your configuration above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; A final note is that your DHCP server needs to be configured to understand it is providing service for more than one network.  If it hasn't been configured to do so, it may not provide the correct information necessary for the setup to work as you wish.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2014-12-02T05:24:57.510" LastActivityDate="2014-12-02T05:24:57.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13357" PostTypeId="1" AcceptedAnswerId="13358" CreationDate="2014-12-02T14:30:17.097" Score="0" ViewCount="128" Body="&lt;p&gt;I have a web server who's perfmon stats report a TCP retransmittal rate of about 10%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have a client who makes heavy use of this server reporting poor performance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The performance problems started when we moved the server to a new hosting facility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the high retransmittal rate strongly indicate a congestion issue somewhere between the server and the client?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done trace routes between the server and the client's public IP and the RTT times are consistently good. Does this evidence weaken the case for congestion?&lt;/p&gt;&#xA;" OwnerUserId="5447" LastEditorUserId="775" LastEditDate="2014-12-08T12:04:31.757" LastActivityDate="2015-09-05T20:08:07.557" Title="Is a high TCP retransmittal % a conclusive indication of congestion?" Tags="|tcp|troubleshooting|congestion|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13358" PostTypeId="2" ParentId="13357" CreationDate="2014-12-02T15:12:47.583" Score="3" Body="&lt;p&gt;High re-transmission percentage is a definitive sign of &lt;em&gt;something&lt;/em&gt; being wrong.  But unfortunately it isn't always a direct sign that &lt;em&gt;congestion&lt;/em&gt; is the issue.  If you could provide some packet captures, that would help us help you determine what the problem is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also suggest running sets of 1000 pings throughout the day.  Look at the resulting Round Trip Times (RTT) and the resulting Packet Loss %.  Those each tell you something different.  Typically, high RTT means congestion, and high Packet Loss indicates an unreliable path (which can also be due to a plethora of different reasons).&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-12-02T15:12:47.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13360" PostTypeId="1" AcceptedAnswerId="13382" CreationDate="2014-12-02T16:24:32.253" Score="7" ViewCount="4825" Body="&lt;p&gt;I understand the MSS is the Maximum Segment Size, which is the size of the Payload TCP will send.  I also understand that a &quot;receiving&quot; MSS value is suggested by both parties in a TCP conversation during the 3-way handshake, and both parties will adhere to the other's proposed MSS when sending data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, what goes into setting the MSS?  What factors does a Client or Server use when they state &quot;I want you to send me TCP segments in maximum chunks of X&quot; bytes.  Is it solely based on the MTU?  Do other factors go into the calculation of one side's MSS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(while somewhat unrelated to my question, &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/8288/difference-between-mss-and-mtu&quot;&gt;this Q&amp;amp;A&lt;/a&gt; did provide some useful background information)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="8499" LastEditDate="2018-10-26T19:12:32.957" LastActivityDate="2018-10-26T19:12:32.957" Title="How do Endpoints in a TCP conversation determine their MSS?" Tags="|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13361" PostTypeId="1" AcceptedAnswerId="13362" CreationDate="2014-12-02T17:47:07.237" Score="2" ViewCount="445" Body="&lt;p&gt;I'm thinking of starting to work on my CCNA since I'm getting a little training in Fortinet and maybe getting sent to certification class.&lt;/p&gt;&#xA;" OwnerUserId="9994" LastEditorUserId="3191" LastEditDate="2014-12-02T19:35:45.347" LastActivityDate="2014-12-02T19:35:45.347" Title="I've been told that Cisco is changing their commands with every IOS, that seems unlikely. Can anyone confirm that?" Tags="|cisco|cli|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13362" PostTypeId="2" ParentId="13361" CreationDate="2014-12-02T18:01:26.520" Score="4" Body="&lt;p&gt;Although changes do occur between major releases of IOS, examples being: the addition of EIGPv6, and changes in the crypto key generate command. These commands can also vary based on the allowed feature set and the underlying hardware that is running the IOS image (ISL being one that comes to mind). Understanding that things will change is necessary in any line of work, however Cisco tries to keep the syntax for its commands the same and will give ample warning if they change anything. There is always the tab complete option and ? on actual IOS devices if you ever find yourself not finding the command you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TLDR: Cisco will change things as needed (new features, outdated technology) but they aren't pointlessly making it difficult for its users&lt;/p&gt;&#xA;" OwnerUserId="4946" LastActivityDate="2014-12-02T18:01:26.520" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13363" PostTypeId="1" AcceptedAnswerId="13366" CreationDate="2014-12-02T18:02:37.210" Score="1" ViewCount="7865" Body="&lt;p&gt;This is from a fake test before the real exam. It's a course which goes through Cisco academy - a course in networking. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Use the address space 10.10.16.0/24 to design an addressing scheme.&#xA;  a) Split the address space into two equal-sized networks by subnetting it again.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I consider the question a bit unclear, for instance &quot;subnetting it again&quot;. I guess they mean VLSM?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have really tried to subnetting with VLSM this packettracer network but I always fail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a network 10.10.16.0/24 that is to be subnetted effectively into two equal networks, that is not wasting any addresses. (VLSM). There are one router that is to be configured with the new parameters which should be applied to the router interface g0/0 and g0/1. There are two switches and two computers. See the image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mq1Ah.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to first borrow 3 bits from 10.10.16.0/24 taking the new network 10.10.16.32 and subnetting that again taking two bits so I lastly get a 10.10.16.40/29 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is now I got network 1 and I calculated network 2 to 10.10.16.48/29.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - then packettracer wants me to take the first and last hostaddress for the router interface and the pc-computer.  I did so, and yes, the PC:s can ping the default gateway and each other. But I fail completely according to the answer. &lt;/p&gt;&#xA;" OwnerUserId="10681" LastEditorDisplayName="user10222" LastEditDate="2015-05-30T11:59:24.860" LastActivityDate="2015-05-30T11:59:24.860" Title="Subnetting a subnet - VLSM" Tags="|subnet|ip|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="13364" PostTypeId="1" AcceptedAnswerId="13371" CreationDate="2014-12-02T18:42:17.343" Score="11" ViewCount="7213" Body="&lt;p&gt;Hi Cisco student/newbie here!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that data passes down through the OSI model and then at the physical layer is transported as bits across the networkcables. But I'm confused at exactly where the layers are happening (in the PC, in the router etc ?). Does the processes at layers 7-2 happen in a PC before the data goes out on the cables as per layer 1? That doesn't sound right, as I know switches operate at layer 2 and routers at layer 3. But then wouldn't the data have already needed to go out on the cables to get to the switch or router? Thanks :-)&lt;/p&gt;&#xA;" OwnerUserId="10682" LastActivityDate="2016-09-21T13:34:54.910" Title="OSI model and physical location of the layers" Tags="|osi|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13365" PostTypeId="2" ParentId="13361" CreationDate="2014-12-02T19:02:12.373" Score="6" Body="&lt;p&gt;In general, if you learned IOS 11, you can jump into an IOS 15 device and still feel somewhat at home.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, absolutely there are changes between different versions of IOS and even the same version of IOS on different platforms.  There would be no progress if there were no changes and I personally wouldn't want to be running IOS 11 today.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;New features/commands&lt;/strong&gt; are added to provide additional functionality or access to new information.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Enahanced features/commands&lt;/strong&gt; add additional options to existing features and commands.  An example of this type of enhancement is the improvements to *show running-config** over the years that let a user display parts of the configuration instead of all of it.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Deprecated features/commands&lt;/strong&gt; are often supported for years before they are phased out entirely.  Most will tell you they are deprecated in some fashion and other commands should be used instead (sometimes this is logged at boot time).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Hardware dependent features/commands&lt;/strong&gt; will be available or not depending on the hardware.  A prime example would be Cisco's &lt;a href=&quot;https://supportforums.cisco.com/document/74231/how-use-time-domain-reflectometer-tdr&quot;&gt;TDR Cable Diagnostics&lt;/a&gt; feature.  If the hardware doesn't support it, even if the commands are available, they won't work.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However, when you are talking about Cisco more generally, they definitely have a range of operating systems that do not look/feel/act like IOS.  Here is a very brief and non-inclusive list of some of them:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;CatOS&lt;/strong&gt; - common on their earlier chassis based switches, such as the 4000s, 5500s, 6500s and the like, but could be found on other platforms as well (such as the 2980).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;NX-OS&lt;/strong&gt; - the Nexus Operating System which runs on all their new Nexus platforms.  While similar in many respects to IOS, there is enough of a difference to trip someone up if they are not aware of them.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Catalyst 1900 OS&lt;/strong&gt; - some would say the predecessor to IOS, but even if you had the enterprise version (with access to the CLI rather than just the menu driven interface), the differences are significant.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Acquired technology&lt;/strong&gt; - many of the acquired technologies by Cisco do not operate like IOS.  As time goes by, they do often try to convert many of these to be more IOS-like in nature.  Or they implement the acquired features into IOS.  One example is the OS run on their wireless controllers, which have not been updated to match IOS.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-12-02T19:02:12.373" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13366" PostTypeId="2" ParentId="13363" CreationDate="2014-12-02T19:21:47.660" Score="3" Body="&lt;p&gt;Subnetting will always be a &quot;2n&quot; bit-wise operation. Subnets fall on specific bit boundaries, no matter what. You can't subnet on arbitrary boundaries or addresses. Just think, &quot;always equal proportions.&quot; Not any different than cutting a pie into equal proportions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I always use a /24 as a &quot;base&quot; to start from. Again, this is a 2n (ie multiply or divide by 2) operation, so you go from a single subnet, to two halves, or four quarters, or eighths, sixteenths, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you split a /24 into two halves, each one of those halves will be a /25 subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you split a /24 into four quarters, each one of those quarters is a /26 subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you split a /24 into eighths, each eighth is a /27 subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The converse is true when going in the opposite direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you combine two /24's into a single subnet, you end up with a /23.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you combine four /24's into a single subnet, you end up with a /22.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you combine eight /24's into a single subnet, you end up with a /21.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your question, if you split 10.10.16.0/24 into two equal-sized subnets, you end up with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. 10.10.16.0/25&#xA;2. 10.10.16.128/25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first and last usable from each subnet would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. 10.10.16.1/25 and 10.10.16.126/25&#xA;2. 10.10.16.129/25 and 10.10.16.254/25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2014-12-02T19:54:52.240" LastActivityDate="2014-12-02T19:54:52.240" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="13367" PostTypeId="2" ParentId="13364" CreationDate="2014-12-02T19:27:37.747" Score="3" Body="&lt;p&gt;The Layers can happen in multiple devices, at multiple levels.&#xA;When it hits my firewall, for example, the firewall peels back all the way to Layer 4 to check the TCP ports against my ACLs.&#xA;It then re-wraps the data down to Layer 1--and if I'm doing NAT/PAT, it even (gasp) &lt;em&gt;modifies&lt;/em&gt; that data!!--and hammers that onto the wire to the next device, which may dig deeper, or not as deep.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OSI Model layers are more for thinking about things. It may--or may not--necessarily be happening precisely. Some things happen on multiple layers. One kind of &quot;thinking about things&quot; is programming. In vague, general terms, each layer is handled independently and assumes that the layers below/above it are functioning properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But as useful as it is for thinking about things, as much as it's used to program and process data, don't forget that in the end, in the words of Monty Python, &quot;It's only a model.&quot;&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2014-12-02T19:27:37.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13371" PostTypeId="2" ParentId="13364" CreationDate="2014-12-02T20:34:55.350" Score="18" Body="&lt;p&gt;&lt;strong&gt;tl;dr&lt;/strong&gt; Many different devices can encounter multiple OSI levels.  Whichever end point is requesting something from a layer 7 protocol (like HTTP), will use all 7 layers before putting it on the wire.  Intermediate nodes, like routers and switches might only use up to the first 3 layers, firewalls or WAN accelerators can affect layer 4, load balancers do interesting things as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're interested in a more detailed answer, look below - I &lt;em&gt;tried(?)&lt;/em&gt; to keep it fairly simple, and use a real world example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OSI Model&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JkC1I.png&quot; alt=&quot;OSI Model&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Source: &lt;a href=&quot;http://www.tcpipguide.com/free/t_DataEncapsulationProtocolDataUnitsPDUsandServiceDa.htm&quot; rel=&quot;noreferrer&quot;&gt;TCP/IP Guide&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What layers encapsulate the data depends on what generates the data.  In general, de-encapsulation will only happen for what is relevant to the data's current place in the network (on a router, on a host, etc.)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By this I mean, if I'm a router, I don't care that there is an HTTP request buried in this packet if all I'm trying to do is route traffic via Layer 3 - I will only strip off enough headers to get what I need, do my job, and move on to the next packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We all use the internet everyday in some way, so here's what a typical HTTP request will look like, taking the OSI model into account.  For simplicity's sake, we can assume the network is available and there aren't any problems.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I type &quot;&lt;a href=&quot;http://google.com&quot; rel=&quot;noreferrer&quot;&gt;http://google.com&lt;/a&gt;&quot; into a browser, and hit enter.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;[Layer 7]&lt;/strong&gt; Your PC/Server will generate an HTTP GET request to send toward your specified webserver, in this case we're talking about google.com.  So if you look above, we have that GET request, which is considered &quot;data&quot;.  HTTP is a layer 7 protocol, we're going to add that header.  Because there is nothing else to do at this layer, lets pass it down to layer 6.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;[Layer 6]&lt;/strong&gt; We can think of layer 6 as how the data should be formatted, for a website nothing is really going to happen here, but an administrator/developer/engineer could do something with this if they chose to.  Our PC/Server is still going to add a header on top of the layer 7 (HTTP) header, and send it down to layer 5.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;[Layer 5]&lt;/strong&gt; At this point because our PC/Server knows we're trying to contact a webserver, we need to make this request in a format the application as a whole can understand, for this we use an Application Program Interface (API).  This is what manages the &lt;strong&gt;applications session&lt;/strong&gt;, this is so the web server will know what &quot;stream&quot; the data is a part of.  Let's add our layer 5 header, and pass it down to Layer 4.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;[Layer 4]&lt;/strong&gt; Network engineers care about all data, but this is where it starts to get very specific for us.  Layer 4 is our transport layer, this is where we decide &lt;strong&gt;how&lt;/strong&gt; our data gets there, not the path, but how - i.e. TCP or UDP.  In this case, our PC/Server needs to establish a connection with the web server.  I'm going to skip over some things for simplicity, but this is where your typical TCP 3-way handshake would happen.  We encapsulate what we currently have in a TCP header, this contains things like source and destination port numbers, sequence and acknowledgment numbers, and TCP windowing information.  &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;[Layer 3]&lt;/strong&gt; Here's the other layer we as engineers really care about, the network layer.  This is where packets are addressed to their destinations, we need IP addresses to get to places on a network.  Our PC/Server will add its source and destination IP address.  Not only will the packets get to the right destination, but that endpoint will use our source IP address to send it back to us when it needs to send us data of any kind.  Now, something to note here is that even PCs/Servers can have multiple interfaces, so we need to send the data to the correct place.  Our PC/Server will have a routing table just like routers, typically if your a host of some kind, your packets will be routed to your default gateway in the hopes that it will know how to get the packet to its destination.  Lets add that IP header and hand it off to the data link layer.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;[Layer 2]&lt;/strong&gt; Our PC/Server's network interface card (NIC), doesn't know how to speak IP on its own, so it uses media access control (MAC) addresses to move that data.  Your PC/Server is going to have ARP entries for each IP it can reach, so in this case its going to have an entry for your default gateway.  Your gateways IP address, will correlate to a destination MAC address.  So let's add our L2 header that destination MAC address, this header also contains our PC/Server NIC's MAC address as the source.  Now we have everything we need to put that data onto the wire as bits.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;[Layer 1]&lt;/strong&gt; As you mentioned in your question, this is where the data flows over the wire, it's where we see the raw 1's and 0's.  Now there isn't a Layer 1 header per se, if you look at the diagram on layer 2 you'll see that.  The data that is up until now which has all of the headers from L7 down to L2, will be converted to those 1's and 0's.&lt;/li&gt;&#xA;&lt;li&gt;Now we have bits on the wire, on it's way to your gateway router.  Up until this point, your PC/Server has done &lt;strong&gt;ALL&lt;/strong&gt; of the work encapsulating the data that bound for google.com's web server.  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/FwBF2.png&quot; alt=&quot;OSI-at-L3&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;10&quot;&gt;&#xA;&lt;li&gt;&lt;strong&gt;[Layer 1]&lt;/strong&gt; Now your gateway router receives the 1's and 0's.  The NIC (interface) on the router gets that data and basically says &quot;I have no idea how to read this!&quot; and brings it up to layer 2 so it can read the data.  &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;[Layer 2]&lt;/strong&gt; The gateway router now inspects the L2 frame, it says &quot;okay cool you came from this MAC, neat.  I see your destination MAC was set to my MAC address, so I am allowed to keep doing the work.  It will de-encapsulate the L2 header so it can get a look at the IP header (layer 3).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;[Layer 3]&lt;/strong&gt; Your gateway router is going to look at the source and destination IP address now.  It says &quot;Okay, you came from this source, cool.  Your destination is this IP address.  Hmm I don't own this IP address, but I know who does.&quot;  It will lookup a route for the destination IP address (google.com) in its routing table and use that entry.&lt;/li&gt;&#xA;&lt;li&gt;After all of this, the same general process repeats.  It will check what interface it needs to send the packet, use that interfaces MAC address, turn it to bits and send it.  The next router will do the same thing, and so on.  In general these packets will only be stripped back down to the layer 7 when it reach its final destination.  As I mentioned before, the routers only care about getting the packets to their destination, so it is only going to care about Layer 3, so it won't have a reason to look at anything else besides what it needs to in order to get to that information.  So it will see L1/L2/L3 information, but nothing else.&lt;/li&gt;&#xA;&lt;li&gt;Eventually the data will hopefully get to the destination web-server and at that point the data will have its outer layers stripped all the way down to the HTTP header for the web server to read, and do whatever is necessary to process that request.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; It's fair to mention that other things can interfere with the typical behavior (firewalls, NAT/PAT, ACL's, etc.)  But it's best to have a very solid understanding of where all the encapsulation and de-encapsulation is taking place to understand how those affect the network and the traffic.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2016-09-21T13:34:54.910" LastActivityDate="2016-09-21T13:34:54.910" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13373" PostTypeId="1" AcceptedAnswerId="13374" CreationDate="2014-12-02T21:45:44.580" Score="2" ViewCount="1027" Body="&lt;p&gt;I understand the idea of proxy arp, that it allows me to communicate with other computers from other subnet, because proxy broadcast is made and router act as a proxy, but what if I disable proxy arp ? For example, I have empty arp table and I want to ping computer B. Then arp broadcast is made , but router doesn't redirect it so I won't be able to communicate with computer from others subnet ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that it might be very basic question, but after reading about it I am still not able to understand it clearly. I read that having arp proxy enabled can hide subnet misconfiguration. Could someone give me an example ?&lt;/p&gt;&#xA;" OwnerUserId="10686" LastActivityDate="2017-02-23T09:07:09.260" Title="Proxy arp disabled - how it works?" Tags="|router|arp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13374" PostTypeId="2" ParentId="13373" CreationDate="2014-12-02T22:10:16.407" Score="2" Body="&lt;p&gt;Let's start out with the remark that routers &lt;em&gt;not&lt;/em&gt; doing proxy arp is the default situation, proxy arp is disabled in most networks, and, if not used carefully, it can break a lot of things in nasty ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the normal situation with proxy ARP disabled your client will see that the other machine is not on its local network. So it looks at its routing table and see that it should reach the other network via the router. Then, it will forward packets there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your second question: one example of that is a misconfiguration in netmasks. A machine with 10.0.0.1/24 can think it's netmask was configured as a /16 because it sees ARP entries for 10.0.1.1/16, while the latter is not on the local network.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="762" LastEditDate="2014-12-02T22:25:54.177" LastActivityDate="2014-12-02T22:25:54.177" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13376" PostTypeId="2" ParentId="12757" CreationDate="2014-12-02T23:45:10.130" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the requirement of 2n number of ports for EtherChannel a critical&#xA;  requirement or just a recommendation to ensure, perhaps, an even load&#xA;  balancing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most vendors don't have such a requirement.  This is a convention often discussed based on the limitations of a three bit hash when load balancing.  I personally disagree with this stance, but I will get to that after answering your questions.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Particularly, if we setup an EtherChannel group with 8 ports but one&#xA;  of them went down. Would the remaining 7 ports still be functional but&#xA;  with uneven load balance, or would 3 ports be forced into standalone&#xA;  to ensure a power of two group?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Typically, if you have 8 ports in a link aggregation group and one goes down, the other seven will remain active.  Yes, the load will be a bit unbalanced in a sense, but again, I will get to that in a minute.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it dealt with similarly for both PAgP and LACP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, and the same with a static LAG group.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now to my view point as to why I don't personally hold to the power of two &quot;rule of thumb&quot; when it comes to link aggregation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To start, you really need to understand that &lt;strong&gt;no link aggregation ever balances link utilization across the LAG&lt;/strong&gt;.  Clearly there are differences in the load balancing method chosen, and some are better than others (although no single one is best in every circumstance).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The load balancing method does not balance the traffic, rather it balances what you can consider &quot;flows.&quot;  Based on the platform, you have options to use source and/or destination values which may include MAC address, IP addresses, port numbers, etc.  These values are then hashed to determine which link is selected for that particular flow.  Frames with the same set of values will always receive the same hash and be assigned to the same link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not all flows are equal and this means that it is not possible to balance the link utilization by these means.  Not to take away from the value of LAG, as it often does do a pretty good job of balancing the utilization as well, but you need to understand the limitations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is entirely possible for one or more of these flows to utilize their entire link in the LAG and starve other flows assigned to the same link.  Meanwhile the other links are under utilized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When most people looks at charts like those in &lt;a href=&quot;http://www.packetmischief.ca/2012/07/24/doing-etherchannel-over-3-5-6-and-7-link-bundles/&quot; rel=&quot;nofollow&quot;&gt;this blog post&lt;/a&gt; or &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4.html&quot; rel=&quot;nofollow&quot;&gt;this Cisco document&lt;/a&gt;, they see that the traffic is unbalanced.  In the sense that some links receive more flows than others, this is true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My view of these tables is a little different.  First, even with the unbalanced distribution, as you add links there is never any point where the percentage of assigned flows on a link increases; rather in the majority of cases the percentage decreases.  Put another way, at no time is there less opportunity for a flow to have access to bandwidth, and in many cases, it will have more opportunity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, if I were to look at this chart to decide between two or three links in an LAG, in my mind I see this as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Two links&lt;/strong&gt; - a single link being fully utilized will affect 50% of the traffic flows leaving 50% unaffected&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Three links&lt;/strong&gt; - a single link being fully utilized will affect at most 37.5% of the traffic flows leaving 62.5% unaffected; possibly as little as 25% leaving 75% unaffected&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Finally, consider what happens if you lose a link in the LAG.  Given two links to start, this would reduce my LAG to one link.  If I start with three, I will still have two left.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sure, balanced flows appeal to the obsessive compulsive parts of my personality, but this still doesn't reflect balanced traffic.  Aside from that, more links is better any way I look at it.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-12-02T23:45:10.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13377" PostTypeId="1" AcceptedAnswerId="13381" CreationDate="2014-12-02T23:52:33.867" Score="1" ViewCount="300" Body="&lt;p&gt;Suppose two computers and a router are connected to a layer 2 ethernet switch. Both computers are registered on the router's IP network. The user of computer 1 sends an ICMP ping request to computer 2 using computer 2's IP address. My understanding (which may not be correct) is that this communication will not pass through the router, only through the switch because computer 1 keeps an ARP table and is able to resolve computer 2's IP address to its MAC address before sending. My question is twofold:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) What is the mechanism through which the source computer originally &quot;learns&quot; the MAC address of the destination computer and is therefore able to register this relationship in its ARP table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Are these two computers technically still communicating over IP (layer 3)? Or are they technically implementing ICMP in layer 2? My confusion stems from the fact that ICMP is considered an &quot;IP protocol&quot;.&lt;/p&gt;&#xA;" OwnerUserId="7637" LastActivityDate="2015-01-02T02:26:45.903" Title="Function of network switch for IP traffic" Tags="|switch|router|ip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13379" PostTypeId="2" ParentId="13377" CreationDate="2014-12-03T00:12:05.687" Score="4" Body="&lt;p&gt;The switch is Layer 2 only and only maintains a table containing mac-addresses and switch ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PC's are Layer 3 devices and would use ARP to find the mac-address of the other L3 device they wanted to talk to.  Once the IP to mac-address mapping is known, then the sending PC would create a packet with the IP of the remote PC in the destination field.  This packet is then turned into a frame with the mac-address of the remote PC in the destination field and then sent onto the wire.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To directly answer question 1) The switch inspects all incoming frames to map the source mac-address to that interface.  Then the switch inspects the destination mac-address field to determine where to send the frame, it is not interested in the IP (or IPv6) address in the frame's data field(where the IP packet is contained). If the destination mac-address of a packet is not known, then the switch floods the packet to all ports in the vlan it was received on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And question 2) Yes, the PC's are communicating via IP.  You don't need to know the mac-address of the remote PC as that is handled as part of the network stack.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="3912" LastEditDate="2014-12-03T02:04:44.653" LastActivityDate="2014-12-03T02:04:44.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13380" PostTypeId="2" ParentId="12639" CreationDate="2014-12-03T00:22:04.743" Score="1" Body="&lt;p&gt;I lab'd this with substitute config and I have QM_IDLE. However, Router A has an incorrect ACL name, it should be VPN_ACL as referenced in the crypto map S2S_VPN. Beyond that, I didn't have to correct any config. I also made my crypto map seq # and the policy seq # match, but this is not a requirement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may seem basic, but do the two routers have reachability not only at layer 3 but also layer 4 (port 500). One way to test this from the router, is to run a traceroute and count the amount of hops away it is. Now, run another traceroute, without paramaters, and in the wizard, put the correct decremented port number value so the last hop is on port 500. If it responds, the port is open, if it doesn't the port is closed. This can help you troubleshoot transit (firewall) issues. The traceroutes are UDP, but this works because isakmp is port 500 UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since, that's a confusing and I can't think of a better way to word it, visual:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WAN#traceroute &#xA;Protocol [ip]: &#xA;Target IP address: xxxxxx&#xA;Source address: xxxxxx&#xA;Numeric display [n]: &#xA;Timeout in seconds [3]: &#xA;Probe count [3]: &#xA;Minimum Time to Live [1]: &#xA;Maximum Time to Live [30]: &#xA;Port Number [33434]: 497  &amp;lt;----------- If RouterB is 4 hops away the last hop will land on port 500, and you should receive a response if the port is open and you have connectivity.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HTH&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;On Router A, these are the two values I'm talking about.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;match address VPN_ACL&#xA;ip access-list extended PRC_HM_VPN_ACL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10668" LastActivityDate="2014-12-03T00:22:04.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13381" PostTypeId="2" ParentId="13377" CreationDate="2014-12-03T00:30:45.883" Score="3" Body="&lt;p&gt;To send a ICMP ping both L2 and L3 connectivity are required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When computer 1 realises that the MAC address for computer 2 is not in its ARP table it will send an ARP request to computer 2. The ARP request will be sent to a destination of computer 2s IP address using a destination MAC address of FF:FF:FF:FF:FF:FF, this is the broadcast MAC address and means that the frame will be sent to all hosts in the L2 segment. However, only the host that matches the IP destination of the ARP request will respond, in this case computer 2, all other hosts will drop it. When computer 2 receives the ARP request it will use the source IP and MAC to send a unicast ARP response back to computer 1 containing its MAC address. On receiving the ARP response computer 1 will have both an IP address and a MAC address for computer 2 and will be able to communicate fully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your other question, ICMP is considered to operate at layer 3. Each layer in the OSI model is dependent on the layers below it.&lt;/p&gt;&#xA;" OwnerUserId="104" LastActivityDate="2014-12-03T00:30:45.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13382" PostTypeId="2" ParentId="13360" CreationDate="2014-12-03T01:23:01.187" Score="11" Body="&lt;p&gt;&lt;strong&gt;1. What goes into setting the MSS?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the question you referenced it stated this, the MSS is derived directly from MTU.  A typical Ethernet MTU will 1500, but IP and TCP headers must also be taken into account - each of them are 20 bytes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Just an FYI, MTU can be different sizes - &lt;em&gt;see &lt;a href=&quot;http://en.wikipedia.org/wiki/Jumbo_frame&quot;&gt;Jumbo Frames&lt;/a&gt; for an example&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We end up with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MSS = 1500 - 20 - 20&#xA;MSS = 1460 bytes of TCP data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd like to emphasize something you mentioned, you are 100% correct in stating that the MSS for the TCP connection is established during the 3 way handshake.  Should either side of the connection want to adjust its MSS, the TCP connection would have to be torn down and re-established.  Before going any further, we need to clarify that a &quot;receive MSS&quot;, what you're thinking of is the TCP receive window.  This is not the same as the MSS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Do other factors go into the calculation of one side's MSS?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So remember, the TCP MSS is established during the TCP handshake along with all of the other session options.  The vast majority of the time the agreed upon MSS will be the largest possible payload that can be sent in a TCP segment &lt;strong&gt;without fragmentation&lt;/strong&gt;.  The last part is key, this means if a client and server are trying to establish a TCP connection, and the client has a smaller MSS size set, the connection will choose the smaller of the two values to avoid said fragmentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it should be noted, it is possible to manually set MSS if whoever is running the application/service doesn't care about fragmentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. What factors does a Client or Server use when they state &quot;I want you to send me TCP segments in maximum chunks of X bytes?&quot;  Is it solely based upon the MTU?&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bottom line is that TCP will try to squeeze as much data into each message as it can to maximize network efficiency.  To be clear, a &lt;strong&gt;single un-fragmented&lt;/strong&gt; TCP segment's payload (headers, data, options, etc.) &lt;strong&gt;CANNOT&lt;/strong&gt; exceed than that of the MSS, if that single TCP segment is one message, or a piece of a fragmented one is irrelevant to TCP - that's what it's designed to handle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not solely based on MTU of the end hosts, but as previously mentioned it is derived from it.  Things like a lower &quot;Path MTU&quot; &lt;em&gt;(see &lt;a href=&quot;http://en.wikipedia.org/wiki/Path_MTU_Discovery&quot;&gt;Path MTU Discovery (PMTUD)&lt;/a&gt;)&lt;/em&gt;, can affect network performance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other factors &lt;strong&gt;&lt;em&gt;can&lt;/em&gt;&lt;/strong&gt; affect network performance as well, but not necessarily only MSS.  You can check out things like &lt;a href=&quot;http://en.wikipedia.org/wiki/TCP_tuning&quot;&gt;TCP Tuning&lt;/a&gt;, if you'd like an idea of what else you might think about when designing an application or service around TCP.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2014-12-03T01:38:40.537" LastActivityDate="2014-12-03T01:38:40.537" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13383" PostTypeId="2" ParentId="8224" CreationDate="2014-12-03T01:52:59.040" Score="2" Body="&lt;p&gt;I don't have your issue, so I cannot duplicate this. However, I believe this to be what you're describing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shows Line 0 has a speed of 9600, type CTY is for console&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IOU2(config)#do sh line&#xA;    Tty Typ     Tx/Rx    A Modem  Roty AccO AccI   Uses   Noise  Overruns   Int&#xA;*     0 CTY              -    -      -    -    -      0       0     0/0       -&#xA;    &amp;lt;..snip..&amp;gt;&#xA;&#xA;IOU2(config)#do sh term&#xA;Line 0, Location: &quot;&quot;, Type: &quot;&quot;&#xA;Length: 24 lines, Width: 80 columns&#xA;Baud rate (TX/RX) is 9600/9600, no parity, 2 stopbits, 8 databits&#xA;   &amp;lt;..snip..&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Change the line speed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IOU2(config)#line 0&#xA;IOU2(config-line)#speed 115200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Verification:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IOU2(config)#do sh term&#xA;Line 0, Location: &quot;&quot;, Type: &quot;&quot;&#xA;Length: 24 lines, Width: 80 columns&#xA;Baud rate (TX/RX) is 115200/115200, no parity, 2 stopbits, 8 databits&#xA;   &amp;lt;..snip..&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In case you're OS has issues, here's what I'm running:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IOU2(config)#do sh ver | i LI&#xA;Cisco IOS Software, Linux Software (I86BI_LINUX-ADVENTERPRISEK9-M), Experimental Version 12.4(20090407:185408) [yuiu-redbuild-V124_24_5_6_PIC1 177]&#xA;IOU2(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10668" LastActivityDate="2014-12-03T01:52:59.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13384" PostTypeId="2" ParentId="13174" CreationDate="2014-12-03T03:28:38.310" Score="3" Body="&lt;p&gt;I think Cisco was referring to the interesting traffic is automatically put into a GRE formed tunnel. Which is different than we normally think of when making a GRE tunnel. Usually it has to do with routing and you need a virtual interface to have an IP address so you have something from R1 to push routes to R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Correct, in WCCP you don't have to specify an IP address for the GRE interface wccp0. Most of the times I've see it set to the same as the physical interface so you can run squid on that IP address only. As long as you have ip_forward=1 the packet is already decapsulated and in the wccp0 virtual interface. You can verify this by doing a tcpdump -i wccp -vvv and you will see stuff. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The trick here is WCCP happens after the routing process, which is usually how we use GRE.  We are skipping the Tunnel interface IP part because we are using an ACL on the Cisco side, and Squid WCCP process gets the packet since it's automatically decapsulated when it arrives. Squid isn't a router so we don't need a Tunnel interface IP for next-hop statements...the decapsulated packet is ready for processing....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://thejimmahknows.com/proxy-wccp-cisco-asa-squid-3-4/&quot; rel=&quot;nofollow&quot;&gt;WCCP SSL redirection using Squid3.4+ and Cisco ASA&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3528" LastEditorUserId="3528" LastEditDate="2014-12-04T16:35:22.520" LastActivityDate="2014-12-04T16:35:22.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13385" PostTypeId="1" CreationDate="2014-12-03T08:56:20.263" Score="3" ViewCount="923" Body="&lt;p&gt;I have two Wi-Fi modules (Moxa AWK 3131) from MOXA. I am trying to set up these two modules in such a way that they can talk to each other. I have connected them as follows,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fRPBn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured the MOXA1 as AP and MOXA2 as a client and the IP address of to laptop are chosen under the same sub net that is 192.168.127.xxx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to connect these two MOXA modules and I am also able to ping the IP address of Laptop_A from laptop_B (from Client to AP) but what I am not being able to do is ping the IP address of Laptop_B from Laptop_A (from AP to Client).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why am I not being able to ping from AP to client? Is AP only listening from client ? Is this set up wrong to make a two way communication? If so, what changes do I need to make in order to establish a two way communication between these two MOXA modules?&lt;/p&gt;&#xA;" OwnerUserId="10694" LastEditorUserId="775" LastEditDate="2014-12-08T12:01:27.660" LastActivityDate="2018-09-21T15:01:16.660" Title="Problem setting up two Wi-Fi module for two way communication" Tags="|wireless|ethernet|subnet|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="13389" PostTypeId="1" CreationDate="2014-12-03T15:09:21.810" Score="0" ViewCount="140" Body="&lt;p&gt;My question will seem pretty basic as I am a beginner in network configuration and design&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am about to setup an environment which is from a functional point of view like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;INTERNET &amp;lt;---&gt;  APP_SERVER (Ip Table) &amp;lt;---&gt; SERVER_1 ;  SERVER_2 ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically there is one server which is able to connect to the internet using an IPv4. Other servers i.e. SERVER_1 to SERVER_N are not reachable from the internet but must be reachable from APP_SERVER. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am completely lost about what hardware is needed to setup such an environment: the datacenter gave me one IPv4 address and I have one switch (Cisco Catalyst 3500 XL)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have enough equipment? Do i need other things such as a router / firewall etc ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="10702" LastEditorUserId="775" LastEditDate="2014-12-08T12:00:46.583" LastActivityDate="2015-01-07T12:19:38.207" Title="Simple Network configuration in datacenter" Tags="|switch|" AnswerCount="1" CommentCount="1" ClosedDate="2019-06-04T00:32:31.537" ContentLicense="CC BY-SA 3.0" />
  <row Id="13390" PostTypeId="1" AcceptedAnswerId="13401" CreationDate="2014-12-03T15:32:17.927" Score="2" ViewCount="1446" Body="&lt;p&gt;I'm looking to write out an SOP for a network installation project involving WAP installs back-hauling to existing telecom rooms/racks.  It needs to be standards based, and I've found plenty of info from ANSI/TIA 568C as well as TIA TSB-162-A and UFC-3-580-01 (for DoD).  These are all fine and dandy and more or less specify the same things regarding cable length, HZ/VZ cabling, etc.  What I'm trying to hunt down is a draft of an installation SOP/Best Practices that can cite the required tools, techniques, and materials an installer should be required to obtain in order to carry out the installation.  For example: a drywall saw, fiberglass mesh, spackle, and putty knife should all be things on that list.  Also your punch down tool, crimper, utility blade, etc.  I don't want to forget anything so I'm hoping somebody can point me to a document that would only need some revisions specific to my project.  Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="1067" LastEditorUserId="8499" LastEditDate="2018-12-21T03:43:09.660" LastActivityDate="2018-12-21T03:43:09.660" Title="Network Cable Installation SOP" Tags="|layer1|cable|cabling|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13392" PostTypeId="2" ParentId="13389" CreationDate="2014-12-03T15:46:39.530" Score="1" Body="&lt;p&gt;There are many ways to accomplish this.  If you want absolutely no internet connectivity from the Internet to Server1/2, then I would put them in a separate VLAN.  The connection would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{Internet}&#xA;    |&#xA;{Switch - VLAN 10}&#xA;    |&#xA;[APP Server]&#xA;    |&#xA;{Switch - VLAN 20}&#xA; |            |&#xA;Server1     Server2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use one physical switch for &quot;in front&quot; and &quot;behind&quot; the App Server, with two different VLANs.  Or you can use two separate physical switches.  Also, the easiest way to cable the above is to use two NIC's on the APP Server, one facing the Upstream (towards the Internet), and the other facing downstream (towards the Server1/2).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you only have one NIC available, you will have to use a Trunk link to a single switch, which will send both VLANs to your server over one physical connection.  Then you will have to make your APP Server VLAN aware so it can properly segregate traffic going to the Internet or traffic going to Server1/2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In all cases, you will have a particular IP Network for the &quot;in front&quot; VLAN,  another one for the &quot;behind&quot; VLAN.  The &quot;in front&quot; VLAN's IP will be set by your hosting provider.  The &quot;behind&quot; VLAN can be anything you choose.  I used VLAN#'s 10 and 20 above, but those are arbitrary, they can be anything you like them to be.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-12-03T15:46:39.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13393" PostTypeId="2" ParentId="10118" CreationDate="2014-12-03T16:35:16.890" Score="9" Body="&lt;p&gt;I'd suggest to remove ports from bridge if it is possible to add them to switch group. When your ports are bridged - all packets going through these interface are processed using CPU while, if they would have been in the same switch group, special switch chip would process those packets, decreasing load on CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in your case, you can make &lt;strong&gt;ether1&lt;/strong&gt; to be a master port for &lt;strong&gt;ether2-5&lt;/strong&gt;. Don't forget that before assigning master port you have to remove them from bridge (&lt;strong&gt;bridge-local&lt;/strong&gt;). Then, do the same for the second switch group (ports 6-10), so &lt;strong&gt;ether6&lt;/strong&gt; will be a master port for &lt;strong&gt;ether7-10&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface ethernet&#xA;  set ether1 master-port=none&#xA;  set ether2 master-port=ether1&#xA;  set ether3 master-port=ether1&#xA;  set ether4 master-port=ether1&#xA;  set ether5 master-port=ether1&#xA;  set ether6 master-port=none&#xA;  set ether7 master-port=ether6&#xA;  set ether8 master-port=ether6&#xA;  set ether9 master-port=ether6&#xA;  set ether10 master-port=ether6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After doing that you'll get two separate and independent switch groups, however, as you mentioned it in your post, you want them to be connected. In such case, there are two options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;to use software bridge;&lt;/li&gt;&#xA;&lt;li&gt;connect them using cable.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Software (CPU) bridging&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;In this case, switch groups 1 and 2 will be switched using CPU, so any packet going from any interface in group 1 to group 2, or vice versa, will be processed using CPU.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface bridge&#xA;  add name=bridge-local&#xA;  port add interface=eth1 bridge=bridge-local&#xA;  port add interface=eth6 bridge=bridge-local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NOTE:&lt;/em&gt;&lt;/strong&gt; don't forget to assign an IP address to the bridge and, if you're using DHCP server on Mikrotik, change its interface to &lt;strong&gt;bridge-local&lt;/strong&gt; as well.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ip address add interface=bridge-local address=192.168.1.1/24&#xA;/ip dhcp-server add interface=bridge-local address-poll=[name of your address pool]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Patch cord&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Just connect any port from group 1 (&lt;strong&gt;ether1-5&lt;/strong&gt;) to any port in group 2 (&lt;strong&gt;ether6-10&lt;/strong&gt;). Yes, it takes 2 port and only applicable if you have ones. If all ports in one of the switch groups are already in use, I'd suggest using first option (bridging).&lt;/p&gt;&#xA;" OwnerUserId="10705" LastActivityDate="2014-12-03T16:35:16.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13396" PostTypeId="1" CreationDate="2014-12-03T21:15:14.233" Score="4" ViewCount="5602" Body="&lt;p&gt;I have PE router (MX) with several ge interfaces that aggregate traffic from hundreds of client's circuits. I want to get the names of all routing instances (vrfs) that includes logical units coming from specific physical interface (e.g. ge-0/0/0) and these vrfs have ebgp sessions inside.&#xA;How to do this in simple way ?&lt;/p&gt;&#xA;" OwnerUserId="10708" LastActivityDate="2015-07-09T17:33:08.210" Title="How to display all routing instances that include specific interface and ebgp?" Tags="|juniper|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13397" PostTypeId="2" ParentId="9803" CreationDate="2014-12-03T21:58:31.580" Score="0" Body="&lt;p&gt;One of the reasons you can't ping is that your ASA configuration lacks ICMP and ICMP ERROR inspect. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modify your configuration to include the following commands: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map global-policy&#xA;    class-map inspection default&#xA;        inspect icmp&#xA;        inspect icmp-error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2014-12-03T21:58:31.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13399" PostTypeId="2" ParentId="9803" CreationDate="2014-12-03T22:49:56.520" Score="1" Body="&lt;p&gt;The problem is you have no access-lists applied.  Access-lists are applied to an interface using the &lt;code&gt;access-group&lt;/code&gt; command, which I did not find in your configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without an access-list, traffic trying to pass through your ASA is filtered purely based upon your security levels.  Which means traffic from a higher security level interface is allowed to pass to a lower security level interface, but not the other way around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, you have two interfaces:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Inside - Security Level 100&lt;/li&gt;&#xA;&lt;li&gt;Outside - Security Level 0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any traffic that starts on the Inside (100) will be permitted to pass to the Outside (0).  But any traffic that starts on the Outside (0), will &lt;strong&gt;not&lt;/strong&gt; be permitted to pass to the Inside (100).  The only way to override this behavior is to apply an access-list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that since the ASA is a stateful device, the return traffic of a connection initiated from the Inside will still be allowed back through, even though the return traffic is coming from the Outside heading to the Inside.  Any traffic initiated from the Outside, however, will not be allowed through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR&gt;&#xA;FYI, the access-lists is &lt;strong&gt;definitively&lt;/strong&gt; preventing traffic from the outside from accessing the inside.  But I can't say for sure whether it is &lt;strong&gt;solely responsible&lt;/strong&gt; for it.  There might be something else going on, but either way the lack of an ACL is your first issue to fix.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;edit: You never mentioned if the &quot;other agency&quot; is coming from the Public Internet or from the other side of the VPN tunnel you have configured.  I answered with the assumption that they were coming from the Public Internet.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2014-12-03T23:31:56.650" LastActivityDate="2014-12-03T23:31:56.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13401" PostTypeId="2" ParentId="13390" CreationDate="2014-12-03T23:34:27.810" Score="3" Body="&lt;h2&gt;Don't Overspecify the Work to a Professional&lt;/h2&gt;&#xA;&lt;p&gt;Assuming you're using a qualified professional to perform the install, you should be careful not to overspecify things that don't actually matter to you.  After all, you are hiring them, in part, because they have innovative and up-to-date capabilities, techniques, and practices that you might not even know (or care) about.  For example, discussion about tools that an installer uses is overspecification.  You care about the product they produce, not how they produce it, &lt;em&gt;right&lt;/em&gt;?&lt;/p&gt;&#xA;&lt;p&gt;The most common consequence of overspecification that I have seen is that installers turn down your work.  I have seen RFP/RFQ/SOW documents that included enough unproductive, irrelevant, unclear, or contradictory details that no installer who looked at it was interested in the work.  The professional installers I've worked with don't take second looks at jobs that seem problematic; the first impression you make counts.&lt;/p&gt;&#xA;&lt;p&gt;You can really get yourself into a bind with documents that overspecify work.  If you widely distribute a badly-formulated RFP in your area you can easily burn through all the capable installers in your area.&lt;/p&gt;&#xA;&lt;h2&gt;Things you probably should specify&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;all work is required to comply with regulations of all levels of government&lt;/li&gt;&#xA;&lt;li&gt;all work that requires a permit shall be performed only after a permit has been obtained&lt;/li&gt;&#xA;&lt;li&gt;where permits are required (usually electrical and fire), who will be the permittee and who is responsible for ensuring the work is passes inspection&lt;/li&gt;&#xA;&lt;li&gt;payment for the work is not due (or at least part of the payment) before the work has been documented to have passed inspection by the applicable regulatory authority (and documented to have been tested and certified, if applicable)&lt;/li&gt;&#xA;&lt;li&gt;a plan view of the site showing all the relevant cable termination locations&lt;/li&gt;&#xA;&lt;li&gt;a table listing each cable to be installed and the location of both ends of the cable&lt;/li&gt;&#xA;&lt;li&gt;for ethernet cable, whether to use &lt;a href=&quot;http://en.wikipedia.org/wiki/TIA/EIA-568&quot; rel=&quot;nofollow noreferrer&quot;&gt;TIA/EIA-568&lt;/a&gt; A or B color codes&lt;/li&gt;&#xA;&lt;li&gt;how the cables and terminations will be labeled&lt;/li&gt;&#xA;&lt;li&gt;the cabling standard that cable and terminations are required to comply with (eg. CAT5, CAT5e, CAT6, CAT6A, etc)&lt;/li&gt;&#xA;&lt;li&gt;whether the installed cables and terminations are required to pass communication test and certification and, if so, what standard will be used for testing&lt;/li&gt;&#xA;&lt;li&gt;wherever cables must be installed in finished walls, ceilings, or floors, what the method of installation will be (surface mount conduit? cutting drywall? fishing cable?), and who is responsible for returning any damage to its original finished state&lt;/li&gt;&#xA;&lt;li&gt;some general statements about quality of workmanship and tidiness&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Things you might specify&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;special site-specific cable requirements&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I've specified plenum-rated cable because I knew some future changes &lt;em&gt;might&lt;/em&gt; require old cable to have a better flame-test rating&lt;/li&gt;&#xA;&lt;li&gt;I've specified stranded cable for cables ending in patch panels that are likely to be worked on regularly.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;the location and amount of cable slack&#xA;&lt;ul&gt;&#xA;&lt;li&gt;where I expect cables to be re-terminated in future, I usually specific some extra length&lt;/li&gt;&#xA;&lt;li&gt;if I think that a patch panel might be moved up or down in a rack, I usually specify the whole bundle to make some 'S' turns nearby or in the rack to provide the additional cable length&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Things you should only specify if you have a really good reason for it&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;anything that might conflict with the electrical or fire code requirements&lt;/li&gt;&#xA;&lt;li&gt;how the work must be performed&lt;/li&gt;&#xA;&lt;li&gt;what tools must be used&lt;/li&gt;&#xA;&lt;li&gt;specific part numbers or manufacturers of materials (specify materials by standards and properties if at all possible)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2662" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-12-03T23:34:27.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13404" PostTypeId="1" AcceptedAnswerId="13405" CreationDate="2014-12-04T07:03:07.493" Score="2" ViewCount="10306" Body="&lt;p&gt;When setting up VLAN networks, we have to define whether the ports on the switch are tagged or untagged. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is the difference?&lt;/li&gt;&#xA;&lt;li&gt;How are the ports related to trunk ports and access ports?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="10701" LastEditorUserId="5848" LastEditDate="2014-12-12T01:56:51.677" LastActivityDate="2014-12-12T01:56:51.677" Title="What is the difference between an untagged port and a tagged port?" Tags="|vlan|transport-protocol|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13405" PostTypeId="2" ParentId="13404" CreationDate="2014-12-04T08:00:02.363" Score="9" Body="&lt;p&gt;This all comes about because different vendors often choose to use different terminology or in some cases the same terminology for different concepts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What Cisco calls a trunk port is also known as a tagged port by certain other vendors.  This means that 802.1Q headers are inserted on all of the traffic for the tagged VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What Cisco calls an access port would then equate to an untagged port.  Not to confuse the issue, but a tagged port generally will have zero or one untagged VLAN assigned to it as well.  An untagged port is more specifically one on which no traffic is 802.1Q tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some environments (Solaris, some HP switches, etc), a trunk is used to refer to link aggregation, or what Cisco calls etherchannel.  So sometimes to avoid confusion, tagged port may be preferred by some people.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="619" LastEditDate="2014-12-04T09:11:21.117" LastActivityDate="2014-12-04T09:11:21.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13406" PostTypeId="1" AcceptedAnswerId="13407" CreationDate="2014-12-04T09:22:23.203" Score="4" ViewCount="3020" Body="&lt;p&gt;On the front panel of a Cisco 2950 is a button which can be used to reset the switch to factory defaults, when held down for a few seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know of a way to disable this within IOS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks!&lt;/p&gt;&#xA;" OwnerUserId="10713" LastActivityDate="2020-01-27T23:05:30.850" Title="Disable reset button on Cisco 2950?" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13407" PostTypeId="2" ParentId="13406" CreationDate="2014-12-04T10:04:14.667" Score="7" Body="&lt;p&gt;You can disable this feature using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no setup express&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To quote &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_19_ea1/command/reference/2950cr/cli2.html#wp3550000&quot; rel=&quot;noreferrer&quot;&gt;Cisco&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The primary purpose of the &lt;code&gt;no setup express&lt;/code&gt; command is to prevent&#xA;  someone from deleting the switch configuration by pressing the Mode&#xA;  button for 10 seconds.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-12-04T10:04:14.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13408" PostTypeId="1" CreationDate="2014-12-04T10:36:08.090" Score="0" ViewCount="262" Body="&lt;p&gt;Is there a rule like 1Gb/s for every 100 houses or something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example: imagine there are 1000 houses with 40Mb broadband. Does this mean that I would need a 40Gb/s connection or would I just have something like a 2Gb/s connection and use a device like a Netequalizer to rate limit everyone?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have examples of how an established ISP does it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking into the possibility of setting up a local ISP in the UK for my town.&lt;/p&gt;&#xA;" OwnerUserId="10715" LastEditorUserId="10715" LastEditDate="2014-12-04T11:59:35.410" LastActivityDate="2014-12-05T02:19:34.527" Title="I am looking to set up a local ISP, what connection speed will I have at my local exchange?" Tags="|isp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13410" PostTypeId="1" AcceptedAnswerId="13411" CreationDate="2014-12-04T12:40:23.977" Score="5" ViewCount="1961" Body="&lt;p&gt;I have small problem with my edge router. I use QoS, standard CBWFQ template with one LLQ queue. Howewer I have match in access-list of 'ef' class, router probably not mark packet properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My configuration is below; hopefully this gives a better explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whole queuing/scheduling and shaping map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;policy-map etm-blazeknet&#xA; class realtime&#xA;  priority 512&#xA;  police 512000 conform-action transmit  exceed-action drop&#xA; class priority&#xA;  bandwidth remaining percent 40&#xA;  random-detect dscp-based&#xA; class missioncritical&#xA;  bandwidth remaining percent 39&#xA;  random-detect dscp-based&#xA; class transactional&#xA;  bandwidth remaining percent 16&#xA;  random-detect dscp-based&#xA; class general&#xA;  bandwidth remaining percent 1&#xA;  random-detect dscp-based&#xA; class class-default&#xA;  bandwidth remaining percent 4&#xA;  random-detect dscp-based&#xA;policy-map shape-etm-blazeknet&#xA; class class-default&#xA;  shape average 3400000&#xA;  service-policy etm-SpiraxSarco-SXSNet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Class map for realtime and ef:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any realtime&#xA; match ip dscp cs5  ef&#xA;class-map match-all ef&#xA; match access-group name ef&#xA; match protocol rtp&#xA; .&#xA; .&#xA; .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Part of marking map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map ingress-mark&#xA; class ef&#xA;  set ip dscp ef&#xA; class af41&#xA;  set ip dscp af41&#xA;  .&#xA;  .&#xA;  .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Access-list for ef class-map and show command that show match:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended ef&#xA; permit udp any range 49152 57500 any range 49152 57500&#xA; permit tcp any range 49152 57500 any range 49152 57500&#xA;&#xA;sxs-sgsingapor-2677033#sh access-lists ef&#xA;Extended IP access list ef&#xA;    10 permit udp any range 49152 57500 any range 49152 57500&#xA;    20 permit tcp any range 49152 57500 any range 49152 57500 (234 matches)&#xA;sxs-sgsingapor-2677033#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, in the ef access-list has matches, but when I look into stats of my marking map, I see that no packets was marked.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sxs-sgsingapor-2677033#sh policy-map int in&#xA; GigabitEthernet0/0&#xA; GigabitEthernet0/1&#xA;&#xA;  Service-policy input: ingress-mark&#xA;&#xA;    Class-map: ef (match-all)&#xA;      0 packets, 0 bytes&#xA;      5 minute offered rate 0 bps, drop rate 0 bps&#xA;      Match: access-group name ef&#xA;      Match: protocol rtp&#xA;      QoS Set&#xA;        dscp ef&#xA;          Packets marked 0&#xA;      .&#xA;      .&#xA;      .&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same is in output map, priority class doesn't works for me.&#xA;Yeah of course, marking map is attached on LAN interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anybody had same problem, how I can solve it? Everything seems to be OK and I've never had a similar problem. Marking for other class is OK.&lt;/p&gt;&#xA;" OwnerUserId="10520" LastEditorUserId="16668" LastEditDate="2015-07-18T07:30:15.097" LastActivityDate="2015-07-18T15:08:40.070" Title="QoS, Marking map not marking properly" Tags="|cisco|qos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13411" PostTypeId="2" ParentId="13410" CreationDate="2014-12-04T12:59:18.087" Score="4" Body="&lt;p&gt;I overlooked the &lt;code&gt;match-all&lt;/code&gt; statement in &lt;code&gt;class-map ef&lt;/code&gt;. In my case it meant that packet that reach LAN interface has to match both statements &lt;code&gt;access-group name ef&lt;/code&gt; and &lt;code&gt;protocol rtp&lt;/code&gt;. Problem was packet not match the second conditions &lt;code&gt;protocol rtp&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all ef&#xA; match access-group name ef&#xA; match protocol rtp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I changed it to &lt;code&gt;match-any&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any ef&#xA; match access-group name ef&#xA; match protocol rtp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10520" LastEditorUserId="3191" LastEditDate="2015-07-18T15:08:40.070" LastActivityDate="2015-07-18T15:08:40.070" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13412" PostTypeId="2" ParentId="13408" CreationDate="2014-12-04T13:22:13.900" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;imagine there are 1000 houses with 40Mb broadband. Does this mean that I would need a 40Gb/s connection?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;or would I just have something like a 2Gb/s connection and use a device like a Netequalizer to rate limit everyone?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's one way to do it.  Strategies like this are one of the things that will make or break a provider.  You absolutely must do two things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Keep customers from leaving, because customer provisioning costs are high&lt;/li&gt;&#xA;&lt;li&gt;Control your overhead, that includes (but not limited to) your &lt;a href=&quot;https://networkengineering.stackexchange.com/q/13329/775&quot;&gt;transit fees&lt;/a&gt; (such as the aforementioned 2Gpbs connection)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In case it isn't obvious, those two goals are opposed to each other.  In a previous life, I worked with a provider that routinely dropped many VoIP calls every Friday evening; this went on for months simply because they were too cheap to buy bigger circuits.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I am looking into the possibility of setting up a local ISP in the UK for my town.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Allow me to try to save you some money.  The internet provider business is extremely low-margin, because it is &lt;a href=&quot;http://arstechnica.com/business/2014/04/one-big-reason-we-lack-internet-competition-starting-an-isp-is-really-hard/&quot; rel=&quot;nofollow noreferrer&quot;&gt;absurdly expensive to operate&lt;/a&gt;.  Lots of people who aren't in this business have thought &quot;I think I'll open my own ISP&quot;, as if this is like operating a fast-food restaurant (conjure mental images of serving YouTube videos on a bun).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;It's not&lt;/em&gt; like operating a restaurant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think about your costs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Trench cabling, or lease the transport to your customers premises (both options are very expensive)&lt;/li&gt;&#xA;&lt;li&gt;Backbone circuits and transit&lt;/li&gt;&#xA;&lt;li&gt;Infrastructure costs, like routers, switches and firewalls; these become obsolete, at most every five years.  This means you're in a non-stop planning effort for &quot;the next upgrade&quot;.  Imagine what it's like to constantly renovate your house, that's not unlike what happens in a decent-sided provider.&lt;/li&gt;&#xA;&lt;li&gt;Build or acquire your own billing system&lt;/li&gt;&#xA;&lt;li&gt;Build or acquire your own customer provisioning system&lt;/li&gt;&#xA;&lt;li&gt;Legal challenges: &lt;a href=&quot;http://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act&quot; rel=&quot;nofollow noreferrer&quot;&gt;DCMA&lt;/a&gt; takedowns, &lt;a href=&quot;http://en.wikipedia.org/wiki/Lawful_interception&quot; rel=&quot;nofollow noreferrer&quot;&gt;lawful intercept&lt;/a&gt;, etc...&lt;/li&gt;&#xA;&lt;li&gt;Hedge against regulatory risks, such as &lt;a href=&quot;https://networkengineering.stackexchange.com/q/7924/775&quot;&gt;net-neutrality&lt;/a&gt; wrangling in the US&lt;/li&gt;&#xA;&lt;li&gt;Costs of &lt;a href=&quot;http://en.wikipedia.org/wiki/STEM_fields&quot; rel=&quot;nofollow noreferrer&quot;&gt;STEM labor&lt;/a&gt;; sadly there already &lt;a href=&quot;http://www.huffingtonpost.com/linda-rosen/the-truth-hurts-the-stem-_b_3900575.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;aren't enough of those laborers&lt;/a&gt; in the world&lt;/li&gt;&#xA;&lt;li&gt;All the other headaches of operating your own business.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you try to play this game, you'll need to battle all the other established players.  They have already figured out ways of handling the aforementioned challenges.  You need to be better than them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The truth is unpleasant, but it needs to be said.  If you aren't sure how much transit bandwidth to buy, you're not showing a lot of promise for competing in this business.  You need to find people sharper than this to operate and engineer things, or be prepared to pay for the &lt;a href=&quot;http://en.wikipedia.org/wiki/School_of_Hard_Knocks&quot; rel=&quot;nofollow noreferrer&quot;&gt;school of hard-knocks&lt;/a&gt;.  That's an expensive education in the internet provider business.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-12-05T02:19:34.527" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13413" PostTypeId="1" CreationDate="2014-12-04T14:03:14.920" Score="0" ViewCount="298" Body="&lt;p&gt;Our company (WISP company) has a management computer located on one gateway (Gateway A) with multiple routers with redundant routes to a second gateway (Gateway B). The traffic going through Gateway B is not visible through Gateway A when Gateway B is the active route. I'm needing the server to be able to see clients dynamically whether it's going through either gateway. Both Gateway A and Gateway B are controlled by Edge Routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By gateway I mean a path to the internet. We are running a public webpage on the server as well!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NduaA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NduaA.png&quot; alt=&quot;small network diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10719" LastEditorUserId="8499" LastEditDate="2018-02-14T16:48:20.120" LastActivityDate="2018-02-14T16:48:20.120" Title="Client visibility with two gateways" Tags="|routing|router|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13414" PostTypeId="2" ParentId="11330" CreationDate="2014-12-04T14:32:17.700" Score="1" Body="&lt;p&gt;same boat here &lt;/p&gt;&#xA;&#xA;&lt;p&gt;what we have determined is carriers are using adavnced boxes (like giant bluecoats) to rate limit udp and esp traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;try getting one of these on cisco vpn ezvpn if they are cisco asa 5505's and use ipsec/tcp to the main site with network extension mode. this &quot;chap&quot; has a nice quick write up for you to follow&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.jump.net.uk/blog-cisco-easy-vpn-on-asa&quot; rel=&quot;nofollow&quot;&gt;http://www.jump.net.uk/blog-cisco-easy-vpn-on-asa&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the loss stopped when we did ipsec/tcp&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but smokeping had 5% loss for weeks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;nasty times, huh?&lt;/p&gt;&#xA;" OwnerUserId="10722" LastActivityDate="2014-12-04T14:32:17.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13415" PostTypeId="1" CreationDate="2014-12-04T15:04:05.410" Score="1" ViewCount="586" Body="&lt;p&gt;I cannot get a IPsec tunnel up and run between a Perle IOLAN SCS 32 with firmware 4.5 and Cisco ASR 1001 with IOS  XE 15.3 - it fails in phase 2 with invalid proposals&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has some out there a sample for getting this right - defining a useable IPsec transform-set which can be accepted by the IOLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See - the IOLAN supports this IKE1 &amp;amp; 2 proposals:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IKE Phase 1 Proposals&#xA;The following IKE Phase 1 proposals are supported by the IOLAN VPN gateway:&#xA;Ciphers—3DES, AES&#xA;Hashes—MD5, SHA1&#xA;Diffie-Hellman Groups—2 (MODP1024), 5 (MODP1536), 14 (MODP2048), 15 (MODP3072), 16 (MODP4096), 17 (MODP6144), 18 (MODP8192)&#xA;ESP Phase 2 Proposals&#xA;The following ESP Phase 2 proposals are supported by the IOLAN VPN gateway:&#xA;Ciphers—3DES, AES&#xA;Authentication Algorithms—MD5, SHA1, SHA2&#xA;&#xA;and the vpn tunnel must be in &quot;tunnel mode&quot; &#xA;perfect forward secrecy: no&#xA;protocol: ESP&#xA;mode: tunnel (not transport)&#xA;opportunistic encryption: no&#xA;aggressive mode: no&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a ASR 1001 with a dedicated fvrf and ivrf for the clients - it comes in to a shared internet vrf and is put into a separate vrf (dmz_iolan) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ike pase 1 seems to be negotiated correct but the ike phase 2 doesn't - here is the cryptomap:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto map IPSECMAP2 3003 ipsec-isakmp &#xA; set peer 195.41.107.40&#xA; set transform-set IOLAN-STD &#xA; set reverse-route distance 100&#xA; set isakmp-profile IOLAN-PROF&#xA; match address iolan01-acl&#xA; reverse-route static&#xA;!&#xA;&#xA;crypto isakmp profile IOLAN-PROF&#xA;   vrf DMZ_SCS&#xA;   keyring IPSEC-KEY2&#xA;   match identity address 195.41.107.40 255.255.255.255 INTERNET2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and my current IPsec proposals &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec transform-set IOLAN-STD esp-3des &#xA; mode tunnel&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and a bit of debug&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ec 15 14:11:48.907: ISAKMP (45255): received packet from 195.41.107.40 dport 500 sport 500 INTERNET2 (R) QM_IDLE&#xA;Dec 15 14:11:48.907: ISAKMP: set new node 2045930127 to QM_IDLE&#xA;Dec 15 14:11:48.908: ISAKMP:(45255): processing HASH payload. message ID = 2045930127&#xA;Dec 15 14:11:48.908: ISAKMP:(45255): processing SA payload. message ID = 2045930127&#xA;Dec 15 14:11:48.908: ISAKMP:(45255):Checking IPSec proposal 0&#xA;Dec 15 14:11:48.908: ISAKMP: transform 0, ESP_AES&#xA;Dec 15 14:11:48.908: ISAKMP:   attributes in transform:&#xA;Dec 15 14:11:48.908: ISAKMP:      encaps is 1 (Tunnel)&#xA;Dec 15 14:11:48.908: ISAKMP:      SA life type in seconds&#xA;Dec 15 14:11:48.908: ISAKMP:      SA life duration (basic) of 28800&#xA;Dec 15 14:11:48.908: ISAKMP:      authenticator is HMAC-SHA&#xA;Dec 15 14:11:48.908: ISAKMP:(45255):atts are acceptable.&#xA;Dec 15 14:11:48.908: ISAKMP:(45255):Checking IPSec proposal 0&#xA;Dec 15 14:11:48.908: ISAKMP: transform 1, ESP_AES&#xA;Dec 15 14:11:48.908: ISAKMP:   attributes in transform:&#xA;Dec 15 14:11:48.908: ISAKMP:      encaps is 1 (Tunnel)&#xA;Dec 15 14:11:48.908: ISAKMP:      SA life type in seconds&#xA;Dec 15 14:11:48.908: ISAKMP:      SA life duration (basic) of 28800&#xA;Dec 15 14:11:48.908: ISAKMP:      authenticator is HMAC-MD5&#xA;Dec 15 14:11:48.908: ISAKMP:(45255):atts are acceptable.&#xA;Dec 15 14:11:48.908: ISAKMP:(45255):Checking IPSec proposal 0&#xA;Dec 15 14:11:48.908: ISAKMP: transform 2, ESP_3DES&#xA;Dec 15 14:11:48.908: ISAKMP:   attributes in transform:&#xA;Dec 15 14:11:48.908: ISAKMP:      encaps is 1 (Tunnel)&#xA;Dec 15 14:11:48.908: ISAKMP:      SA life type in seconds&#xA;Dec 15 14:11:48.908: ISAKMP:      SA life duration (basic) of 28800&#xA;Dec 15 14:11:48.908: ISAKMP:      authenticator is HMAC-SHA&#xA;Dec 15 14:11:48.908: ISAKMP:(45255):atts are acceptable.&#xA;Dec 15 14:11:48.908: ISAKMP:(45255):Checking IPSec proposal 0&#xA;Dec 15 14:11:48.908: ISAKMP: transform 3, ESP_3DES&#xA;Dec 15 14:11:48.908: ISAKMP:   attributes in transform:&#xA;Dec 15 14:11:48.908: ISAKMP:      encaps is 1 (Tunnel)&#xA;Dec 15 14:11:48.908: ISAKMP:      SA life type in seconds&#xA;Dec 15 14:11:48.908: ISAKMP:      SA life duration (basic) of 28800&#xA;Dec 15 14:11:48.908: ISAKMP:      authenticator is HMAC-MD5&#xA;Dec 15 14:11:48.908: ISAKMP:(45255):atts are acceptable.&#xA;Dec 15 14:11:48.908: ISAKMP:(45255): IPSec policy invalidated proposal with error 256&#xA;Dec 15 14:11:48.910: ISAKMP:(45255): IPSec policy invalidated proposal with error 256&#xA;Dec 15 14:11:48.912: IPSEC(ipsec_process_proposal): transform proposal not supported for identity:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10724" LastEditorUserId="2142" LastEditDate="2018-10-11T13:08:10.203" LastActivityDate="2018-10-11T13:08:10.203" Title="ipsec tunnel between Cisco IOS router and Perle IOLAN SCS 32" Tags="|cisco|vpn|ipsec|cisco-ios-15|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="13417" PostTypeId="1" AcceptedAnswerId="19612" CreationDate="2014-12-04T15:43:54.517" Score="31" ViewCount="16469" Body="&lt;p&gt;In discussions that have spurred from &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13360/how-do-endpoints-in-a-tcp-conversation-determine-their-mss&quot;&gt;other questions&lt;/a&gt; on &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/8288/difference-between-mss-and-mtu&quot;&gt;this site&lt;/a&gt;, I've realised that I don't have a solid understanding of &lt;strong&gt;when&lt;/strong&gt; Path MTU Discovery (PMTUD) is performed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know &lt;em&gt;what&lt;/em&gt; it does -- discover the lowest MTU on a path from Client to Server).&lt;BR&gt;&#xA;I know &lt;em&gt;how&lt;/em&gt; it does it -- send progressively larger packets with their &quot;Don't Fragment&quot; bit set, and see how big of a packet you can get through without getting a &quot;ICMP Need to Fragment&quot; error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is specifically then, &lt;strong&gt;&lt;em&gt;when&lt;/em&gt; will a host perform PMTUD?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for specific cases.  Not just something generic like &quot;when a host wants to discover the path MTU&quot;.  Bonus points if you can provide a packet capture of a host doing it, or provide instructions for generating such a packet capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I am specifically referring to IPv4.  I know in IPv6 transient routers aren't responsible for fragmentation, and can imagine that PMTUD happens much more commonly.  But for now, I'm looking for specific examples of PMTUD in IPv4.  &lt;em&gt;(although if the only packet capture you can put together of PMTUD is in IPv6, I would still love to see it)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2022-02-02T03:25:17.680" Title="Exactly when is PMTUD performed? (Path MTU discovery)" Tags="|ipv4|mtu|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13420" PostTypeId="2" ParentId="13417" CreationDate="2014-12-04T19:52:35.997" Score="-3" Body="&lt;p&gt;PMTUD is used to calculate the best MSS for TCP sessions. &#xA;One example is BGP implementation on Cisco or Juniper routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/usage-guidelines/routing-configuring-mtu-discovery-for-bgp-sessions.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/en_US/junos12.1/topics/usage-guidelines/routing-configuring-mtu-discovery-for-bgp-sessions.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="10306" LastActivityDate="2014-12-04T19:52:35.997" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13421" PostTypeId="1" AcceptedAnswerId="13485" CreationDate="2014-12-04T22:58:58.197" Score="0" ViewCount="1240" Body="&lt;p&gt;Is it possible to emulate a CISCO PIX 515 firewall with the software GNS3? Provided I have a working image, of course (that's another topic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="10576" LastActivityDate="2014-12-08T02:27:55.013" Title="Emulate a CISCO PIX Firewall" Tags="|cisco|firewall|gns3|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13422" PostTypeId="1" AcceptedAnswerId="13423" CreationDate="2014-12-05T00:12:26.763" Score="6" ViewCount="39574" Body="&lt;p&gt;Came across a situation where powering off a module in a Cisco 4500 (Sup7-E) would have been nice, but couldn't seem to find the command.  Ended up having to unseat the module until we had the fix in place and then someone had to go insert it again&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, it was off site, so it required someone to go to the location to do this and it would have been nice to be able to do remotely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know with a 6500 you can do a &lt;code&gt;no power enable module &amp;lt;#&amp;gt;&lt;/code&gt; (IOS) or &lt;code&gt;set module power down &amp;lt;#&amp;gt;&lt;/code&gt; (CatOS) to power off the module, but just couldn't find it on the 4500.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any suggestions or ideas?  Hidden command maybe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or can anyone confirm the platform doesn't have the capability (and why)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems somewhat odd to me that the capability to do a reset (&lt;code&gt;hw-module [slot|module] &amp;lt;#&amp;gt; reset&lt;/code&gt;) of a module exists, but no capability to power it off entirely.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2017-01-11T18:43:07.360" Title="Command to power off (not reset) module in Cisco 4500?" Tags="|cisco|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13423" PostTypeId="2" ParentId="13422" CreationDate="2014-12-05T00:15:16.147" Score="7" Body="&lt;p&gt;To power off a particular module, use &lt;code&gt;Switch(config)# no hw-module module _num_ power&lt;/code&gt;; you can find that command on Page 20 of &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/15-1/XE_330SG/configuration/guide/config/pwr_envr.pdf&quot; rel=&quot;nofollow&quot;&gt;this Cisco doc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI, there &lt;a href=&quot;https://supportforums.cisco.com/discussion/11515966/power-cisco-core-switch&quot; rel=&quot;nofollow&quot;&gt;isn't a graceful shutdown command for the whole switch&lt;/a&gt;.&#xA;You should backup your config (just in case), issue a reboot, wait till you can audibly hear a change in fan speed, and then remove power before system starts booting.&lt;/p&gt;&#xA;" OwnerUserId="876" LastEditorUserId="775" LastEditDate="2014-12-05T11:41:40.560" LastActivityDate="2014-12-05T11:41:40.560" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13425" PostTypeId="2" ParentId="13421" CreationDate="2014-12-05T03:51:09.300" Score="5" Body="&lt;p&gt;No. However, the pix (and asa) images can be run via qemu. GNS3 does document how to do this. (as well as various youtube videos, and thousands of blogs.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[I personally don't bother since the real hardware can be found on eBay for next to nothing.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-05T03:51:09.300" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13427" PostTypeId="2" ParentId="13421" CreationDate="2014-12-05T04:14:56.727" Score="1" Body="&lt;p&gt;I don't believe so.  GNS3 will not allow it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the other answer has a good point.&lt;br&gt;&#xA;Buy a firewall online for cheap.&lt;br&gt;&#xA;I got a PIX 525 for 28.00 on ebay...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet Tracer 6.1 has only one firewall 5505 ASA...&#xA;No PIX there either.&lt;/p&gt;&#xA;" OwnerUserId="10728" LastActivityDate="2014-12-05T04:14:56.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13428" PostTypeId="1" AcceptedAnswerId="13431" CreationDate="2014-12-05T04:48:19.137" Score="3" ViewCount="900" Body="&lt;p&gt;I have set up a 6in4 tunnel, namely &quot;sit1&quot;, but I have discovered that if I traceroute non exist IP within the subnet, it will loop. What should I do to solve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routing table: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0WVjP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10711" LastEditorUserId="8499" LastEditDate="2018-02-14T16:48:05.250" LastActivityDate="2018-02-14T16:48:05.250" Title="How to solve this IPv6 looping problem?" Tags="|routing|ipv6|tunnel|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="13429" PostTypeId="2" ParentId="9806" CreationDate="2014-12-05T04:51:18.297" Score="0" Body="&lt;p&gt;According to you, PC'B' is on fa0/2. This means that PC'B' is on VLAN 1 by default.&#xA;And PC'A' is in VLAN 20. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is the mistake i guess&lt;/p&gt;&#xA;" OwnerUserId="10712" LastActivityDate="2014-12-05T04:51:18.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13431" PostTypeId="2" ParentId="13428" CreationDate="2014-12-05T06:45:28.950" Score="6" Body="&lt;p&gt;The tunnel is a point-to-point interface, all packets sent over the tunnel are received and processed by the remote device.  When the remote device realizes the packet is destined for a subnet-local address it sends it back across the tunnel to your Microtik. You are hitting a the &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-ipngwg-p2p-pingpong-00&quot; rel=&quot;nofollow noreferrer&quot;&gt;ping-pong vulnerability&lt;/a&gt; in IPv6.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2014-12-05T06:45:28.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13435" PostTypeId="1" CreationDate="2014-12-05T10:50:38.070" Score="1" ViewCount="7050" Body="&lt;p&gt;Here is my topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/lJrUC.png&quot; alt=&quot;Network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC3 - VLAN 10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC0, PC4 - VLAN 20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch connected to a router is a Server Switch in VTP. The other two are clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know about router on the stick and PC3 and PC4 can ping each other. I have a question about PC3 to PC0 connection. It just doesn't work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it because the switch doesn't have a connection to a router and directs the packet only to the correct port by MAC? I guess I don't understand the mechanics enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can be done to make the two PCs ping each other? I know it's not what VLANs are for but it just bothers me. Do they need their own router?&lt;/p&gt;&#xA;" OwnerUserId="2405" LastEditorUserId="2405" LastEditDate="2014-12-05T10:55:52.087" LastActivityDate="2014-12-05T19:00:03.313" Title="How to make two computers connected to a switch but in the different VLANs ping each other?" Tags="|routing|switch|vtp|" AnswerCount="2" CommentCount="1" ClosedDate="2019-05-30T00:33:41.110" ContentLicense="CC BY-SA 3.0" />
  <row Id="13436" PostTypeId="2" ParentId="13435" CreationDate="2014-12-05T11:06:54.203" Score="1" Body="&lt;p&gt;Check if you have configured the default gateway for PC0.&#xA;More information is needed to solve your scenario here (Configurations of the switch and the IP addresses assigned to the router, PCs)&lt;/p&gt;&#xA;" OwnerUserId="10712" LastActivityDate="2014-12-05T11:06:54.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13438" PostTypeId="1" AcceptedAnswerId="13439" CreationDate="2014-12-05T11:54:18.167" Score="13" ViewCount="18211" Body="&lt;p&gt;I don't quite understand if i posting http form data from the browser to the server, does the protocol still need to make three-way handshake (syn-ack-data) or it only works for GET http requests?&lt;/p&gt;&#xA;" OwnerUserId="10741" LastEditorUserId="8499" LastEditDate="2018-10-27T02:32:12.443" LastActivityDate="2021-06-16T15:52:26.410" Title="Is a TCP three-way handshake required for an HTTP POST?" Tags="|ip|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13439" PostTypeId="2" ParentId="13438" CreationDate="2014-12-05T12:15:01.650" Score="13" Body="&lt;p&gt;Both HTTP GET and HTTP POSTS use TCP.  If you are asking whether a POST also requires a 3-way TCP handshake (syn-synack-ack), it does just like any other TCP connection.  The TCP handshake is required before any application protocol (such as HTTP) starts work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI, your three-way handshake is incorrect; it should be &quot;syn-synack-ack&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ADD:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If browser use &lt;a href=&quot;https://en.wikipedia.org/wiki/QUIC&quot; rel=&quot;noreferrer&quot;&gt;QUIC&lt;/a&gt; (Quick UDP Internet Connections, pronounced quick. Proposed by Google) protocol for HTTP is possible to avoid 3-way TCP handshake.&#xA;But AFAIK it supported in Chrome and Google.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most software prefer &lt;a href=&quot;https://en.wikipedia.org/wiki/HTTP/2&quot; rel=&quot;noreferrer&quot;&gt;HTTP/2&lt;/a&gt; which still TCP but wit many features it use &#xA;persistent connection then 3-way handshake done once for each server server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this protocols is used, 3-way hanshake can be avoided by any request, including GET.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="7539" LastEditDate="2017-03-05T12:31:27.573" LastActivityDate="2017-03-05T12:31:27.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13444" PostTypeId="1" CreationDate="2014-12-05T17:28:49.153" Score="-1" ViewCount="726" Body="&lt;p&gt;I do know about Physical port but a little knowledge about channel and interface, can any one explain how these 3 work simultaneously, i am not getting proper idea and from cisco i got to know about LACP but first i have to know the basic part. Thanks Everyone&lt;/p&gt;&#xA;" OwnerUserId="10748" LastActivityDate="2014-12-05T19:42:23.477" Title="How port, channel and interface are working together?" Tags="|switch|etherchannel|interface|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13447" PostTypeId="1" AcceptedAnswerId="13471" CreationDate="2014-12-05T18:38:24.520" Score="10" ViewCount="9518" Body="&lt;p&gt;I know that Ethernet over twisted pairs have two standards as the figure below:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/MeuvT.jpg&quot; alt=&quot;Ethernet standards over twisted pairs&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The pairs are twisted to avoid cross-talk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why in both standards there is one pair that is not adjacent (pin 3 always pairs with pin 6)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once I have got a wrong &lt;strong&gt;long cable&lt;/strong&gt; that was working intermittently. It was made with all &lt;code&gt;rings&lt;/code&gt; adjacent to their corresponding &lt;code&gt;tips&lt;/code&gt;. After correcting it worked fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I am sure that I have already seen a &lt;strong&gt;short cable&lt;/strong&gt; that worked fine too. Hence there must be an effect that this configuration avoids which I have googled and not found.&lt;/p&gt;&#xA;" OwnerUserId="3578" LastEditorUserId="8499" LastEditDate="2018-03-10T00:38:47.493" LastActivityDate="2018-03-10T00:38:47.493" Title="Why one of the pairs on Ethernet is not adjacent?" Tags="|ethernet|layer1|cable|cabling|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13448" PostTypeId="2" ParentId="13435" CreationDate="2014-12-05T19:00:03.313" Score="1" Body="&lt;p&gt;1- Can PC3 and PC0 and ping R2 successfully ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- Did you assign interface 0/24 (PC3) on S2 to VLAN 10 properly ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S2(config)#interface fastEthernet 0/24&#xA;S2(config-if)#switchport access vlan 10&#xA;S2(config-if)#no shutdown &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3- Did you assign interface 0/23 (PC0) on S2 to VLAN 20 properly ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S2(config)#interface fastEthernet 0/23&#xA;S2(config-if)#switchport access vlan 20&#xA;S2(config-if)#no shutdown &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4- have you configured Iner-VLAN on R2 properly ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- 172.17.1.1 /24 is our R2 network&#xA;- 172.17.10.1/24 is our Vlan 10&#xA;- 172.17.20.1/24 is our Vlan 20&#xA;- 172.17.99.1/24 is our Vlan 99 (management)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2 Configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)#interface fastEthernet 0/0&#xA;R2(config-if)#no shutdown&#xA;&#xA;R2(config-if)#interface fastEthernet 0/0.1&#xA;R2(config-subif)#encapsulation dot1Q 1&#xA;R2(config-subif)#ip address 172.17.1.1 255.255.255.0&#xA;&#xA;R2(config-if)#interface fastEthernet 0/0.10&#xA;R2(config-subif)#encapsulation dot1Q 10&#xA;R2(config-subif)#ip address 172.17.10.1 255.255.255.0&#xA;&#xA;R2(config-if)#interface fastEthernet 0/0.20&#xA;R2(config-subif)#encapsulation dot1Q 20&#xA;R2(config-subif)#ip address 172.17.20.1 255.255.255.0&#xA;&#xA;R2(config-if)#interface fastEthernet 0/0.99&#xA;R2(config-subif)#encapsulation dot1Q 99 native&#xA;R2(config-subif)#ip address 172.17.99.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;5- Finally did you assign the Gateway on PC3 and PC0 properly ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;based on IP addresses mentioned above:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP Address......................: 172.17.10.10&#xA;Subnet Mask.....................: 255.255.255.0&#xA;Default Gateway.................: 172.17.10.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;PC0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP Address......................: 172.17.20.10&#xA;Subnet Mask.....................: 255.255.255.0&#xA;Default Gateway.................: 172.17.20.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10753" LastActivityDate="2014-12-05T19:00:03.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13449" PostTypeId="2" ParentId="13447" CreationDate="2014-12-05T19:23:28.980" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But why in both standards there is one pair that is not adjacent (pin 3 always pairs with pin 6)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This goes back to &lt;a href=&quot;http://en.wikipedia.org/wiki/TIA/EIA-568#Backwards_compatibility&quot;&gt;compatibility&lt;/a&gt; in phone system wiring.  It is based on the TIA/EIA 568 standard.  The middle pair (4,5) was used for the first voice circuit. the next pair (going out from the middle - 3,6) was for the 2nd phone line.  The reason it makes sense is that twisted-pair ethernet was first used on phone system (category 3) cabling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a slight difference between the two TIA/EIA 568 standards (A or B), but I will leave that exercise up to you.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="630" LastEditDate="2014-12-06T09:53:24.220" LastActivityDate="2014-12-06T09:53:24.220" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="13450" PostTypeId="2" ParentId="13444" CreationDate="2014-12-05T19:42:23.477" Score="2" Body="&lt;p&gt;802.3ad Link Aggregation serves to bond multiple, individual physical interfaces into a single, logical virtual interface: a &quot;port-channel&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The virtual interface of the port-channel controls the traffic across all interfaces which are members of it. Think of the port-channel being the supervisor and the individual interfaces being the employees: the port-channel tells everyone else what to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understanding the underlying code and mechanisms that Cisco uses to perform this task is outside the scope of your studies. The following document should suffice: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/gigeth.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/gigeth.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2014-12-05T19:42:23.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13452" PostTypeId="2" ParentId="13268" CreationDate="2014-12-05T21:22:43.017" Score="0" Body="&lt;p&gt;The accepted answer by Ryan Foley looks nice!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I ended up going for a totally different tactic. Using a BASH script, I simply generated IP's with four random numbers 0-255. I then ran traceroute on them via another BASH script with a success rate of 5% - 10% within 30 hops. Then I ran the IP's that gave a successful traceroute result through yet another BASH script, using &lt;a href=&quot;https://freegeoip.net&quot; rel=&quot;nofollow&quot;&gt;https://freegeoip.net&lt;/a&gt; to get the country of the IP address and then manually assigning that to a region. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One could also use the list at &lt;a href=&quot;http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml&quot; rel=&quot;nofollow&quot;&gt;http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml&lt;/a&gt; to get the region (Africa, North America, South America, Europe, Asia) of the IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I would do this again I would've tried the accepted solution, mainly because running traceroute on 2500 IP's and only getting 200 successful results was quite time consuming.&lt;/p&gt;&#xA;" OwnerUserId="10606" LastActivityDate="2014-12-05T21:22:43.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13453" PostTypeId="1" AcceptedAnswerId="13460" CreationDate="2014-12-05T23:34:04.773" Score="2" ViewCount="2249" Body="&lt;p&gt;I have a Cisco router with Site to Site IPSec. I am wondering if you're able to split tunnel  a single host inside, out to the internet, that is also referenced in the interesting traffic ACL?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does the order of operations work for VPN interesting traffic versus NAT overload?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interesting Traffic ACL: 10.1.1.0/24&#xA;PAT Host : 10.1.1.20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the 10.1.1.20 sends traffic, will it hit the crypto ACL and transport across the ipsec tunnel, or will it PAT across the WAN using the NAT overload? It has just a single default static route out to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it doesn't, do you have to break apart your interesting ACL to exclude the host, or dney it across the tunnel in the VPN interesting traffic ACL?&lt;/p&gt;&#xA;" OwnerUserId="10668" LastActivityDate="2014-12-06T08:56:18.407" Title="Order of operations Crypto over NAT overload?" Tags="|cisco|vpn|nat|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13455" PostTypeId="1" CreationDate="2014-12-06T02:23:08.573" Score="6" ViewCount="2413" Body="&lt;p&gt;A normal (untagged) broadcast packet is sent into a trunk port on a switch, the vlans it accepts are 11, 12, and 13. What will happen to that packet? Will it be sent out all access ports with vlan 11 12 and 13? Will the packet be dropped? Will it only be sent out another trunk port? Or, will something I haven't considered happen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="10759" LastActivityDate="2014-12-06T08:22:23.487" Title="VLAN Tagging on Trunk Port" Tags="|vlan|trunk|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13456" PostTypeId="2" ParentId="13455" CreationDate="2014-12-06T03:00:17.560" Score="9" Body="&lt;p&gt;It will be sent out all ports on the native (untagged) VLAN.  If there is no native VLAN, the packet is dropped.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-12-06T03:00:17.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13457" PostTypeId="2" ParentId="13413" CreationDate="2014-12-06T06:02:09.460" Score="1" Body="&lt;p&gt;Assuming you mean the clients need to reach the server, it looks like you would add a static route to the 450-G (non-edge device) pointing the 10.254.254.0/30 network at 10.202.1.1.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you mean something else by 'see clients dynamically whether it's going through either gateway' like WCCP/etc. then we would need that information to assist further.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2014-12-06T06:02:09.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13459" PostTypeId="2" ParentId="13455" CreationDate="2014-12-06T08:22:23.487" Score="2" Body="&lt;p&gt;By default the native VLAN is enable on each trunk port of the switch. In this case your packet will not be dropped, but will be tagged with the same number of VLAN that native VLAN is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a clarification, what native vlan does:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Tags incoming un-tagged traffic on trunk links with the native VLAN.&lt;/li&gt;&#xA;&lt;li&gt;Un-tag outgoing traffic that has already been tagged with same VLAN that is being used for the native VLAN on the trunk.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10520" LastActivityDate="2014-12-06T08:22:23.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13460" PostTypeId="2" ParentId="13453" CreationDate="2014-12-06T08:29:05.300" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How does the order of operations work for VPN interesting traffic versus NAT overload?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Quoting from the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/6209-5.html&quot; rel=&quot;nofollow&quot;&gt;order of IPSec operations&lt;/a&gt; in Cisco IOS, including both IPSec and NAT.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Inside to outside traffic&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If IPSec then check input access list&#xA;decryption - for CET (Cisco Encryption Technology) or IPSec&lt;/li&gt;&#xA;&lt;li&gt;check input access list&lt;/li&gt;&#xA;&lt;li&gt;check input rate limits&lt;/li&gt;&#xA;&lt;li&gt;input accounting&lt;/li&gt;&#xA;&lt;li&gt;redirect to web cache&lt;/li&gt;&#xA;&lt;li&gt;policy routing&lt;/li&gt;&#xA;&lt;li&gt;routing&lt;/li&gt;&#xA;&lt;li&gt;NAT inside to outside (local to global translation)&lt;/li&gt;&#xA;&lt;li&gt;crypto (check map and mark for encryption)&lt;/li&gt;&#xA;&lt;li&gt;check output access list&lt;/li&gt;&#xA;&lt;li&gt;inspect (Context-based Access Control (CBAC))&lt;/li&gt;&#xA;&lt;li&gt;TCP intercept&lt;/li&gt;&#xA;&lt;li&gt;encryption&lt;/li&gt;&#xA;&lt;li&gt;Queueing&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Outside to Inside traffic&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If IPSec then check input access list&lt;/li&gt;&#xA;&lt;li&gt;decryption - for CET or IPSec&lt;/li&gt;&#xA;&lt;li&gt;check input access list&lt;/li&gt;&#xA;&lt;li&gt;check input rate limits&lt;/li&gt;&#xA;&lt;li&gt;input accounting&lt;/li&gt;&#xA;&lt;li&gt;redirect to web cache&lt;/li&gt;&#xA;&lt;li&gt;NAT outside to inside (global to local translation)&lt;/li&gt;&#xA;&lt;li&gt;policy routing&lt;/li&gt;&#xA;&lt;li&gt;routing&lt;/li&gt;&#xA;&lt;li&gt;crypto (check map and mark for encryption)&lt;/li&gt;&#xA;&lt;li&gt;check output access list&lt;/li&gt;&#xA;&lt;li&gt;inspect CBAC&lt;/li&gt;&#xA;&lt;li&gt;TCP intercept&lt;/li&gt;&#xA;&lt;li&gt;encryption&lt;/li&gt;&#xA;&lt;li&gt;Queueing&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Regarding how to split traffic from a single host between the tunnel and the internet connection: you will need to include the destination at the other end of the tunnel in the ACL for interesting traffic and also make sure you have a route to this destination vía the interface where the crypto map is applied.&lt;/p&gt;&#xA;" OwnerUserId="76" LastEditorUserId="775" LastEditDate="2014-12-06T08:56:18.407" LastActivityDate="2014-12-06T08:56:18.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13461" PostTypeId="1" AcceptedAnswerId="13462" CreationDate="2014-12-06T08:42:55.970" Score="2" ViewCount="572" Body="&lt;p&gt;we all know that if we use the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show port-security address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;we'll see the entire table of secure mac addresses. &#xA;I need to know which file does IOS use to store these addresses (specifically the dynamic addresses) on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="10762" LastActivityDate="2014-12-06T09:29:51.973" Title="where does cisco switches store dynamically learned secure mac addresses?" Tags="|cisco|port-security|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13462" PostTypeId="2" ParentId="13461" CreationDate="2014-12-06T09:29:51.973" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I need to know which file does IOS use to store these addresses (specifically the dynamic addresses) on?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm afraid that's not how Cisco IOS stores information.  Cisco's &lt;a href=&quot;https://learningnetwork.cisco.com/thread/51718&quot; rel=&quot;nofollow noreferrer&quot;&gt;CAM table&lt;/a&gt; is not stored in a file.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13461/where-does-cisco-switches-store-dynamically-learned-secure-mac-addresses?noredirect=1#comment20722_13461&quot;&gt;Seena Moshiri said&lt;/a&gt;: I believe that these secure addresses should be stored somewhere :) if it doesn't then how the &quot;switchport port-security aging&quot; works?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This works the same way that all other mac-address tables work in Cisco switches.  Typically the mac-addresses are stored in a &lt;a href=&quot;https://supportforums.cisco.com/document/60831/cam-vs-tcam&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCAM&lt;/a&gt;, which is a kind of memory optimized for quick lookups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see what is in the &lt;code&gt;port-security&lt;/code&gt; mac-address table, these are some possible options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;step=2&amp;amp;mibName=CISCO-PORT-SECURITY-MIB&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;CISCO-PORT-SECURITY-MIB&quot;&gt;&lt;code&gt;CISCO-PORT-SECURITY-MIB&lt;/code&gt;&lt;/a&gt;. However, MIB queries are complicated.&lt;/li&gt;&#xA;&lt;li&gt;Use a script to capture from Cisco IOS CLI, and parse the values into whatever format you want&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-12-06T09:29:51.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13464" PostTypeId="2" ParentId="13438" CreationDate="2014-12-06T15:05:21.897" Score="30" Body="&lt;p&gt;If you are asking in a general sense, then the answer is most definitely &amp;quot;yes&amp;quot;, any HTTP method (like POST) requires a TCP connection, and the only way to initiate a TCP connection is to use the three way handshake.&lt;/p&gt;&#xA;&lt;p&gt;IF, however, you are asking in a specific case, maybe if you are capturing your own traffic and don't see the 3 way handshake after you submit content to a website, then the answer is a little less simple.  We'll have to discuss a few HTTP related concepts before we can properly answer it...&lt;/p&gt;&#xA;&lt;HR&gt;&#xA;&lt;p&gt;In the original release of HTTP1.0, every object you requested from a webpage required a new TCP connection to be formed for each object.  Take the following simplistic website that includes some text, and two images:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;HTML&amp;gt;&#xA;  &amp;lt;HEAD&amp;gt;&#xA;    &amp;lt;TITLE&amp;gt;My Title&amp;lt;/TITLE&amp;gt;&#xA;  &amp;lt;/HEAD&amp;gt;&#xA;  &amp;lt;BODY&amp;gt;&#xA;    Stack Exchange Rules!&#xA;    &amp;lt;IMG SRC=&amp;quot;a.gif&amp;quot;&amp;gt;&#xA;    &amp;lt;IMG SRC=&amp;quot;b.gif&amp;quot;&amp;gt;&#xA;  &amp;lt;/BODY&amp;gt;&#xA;&amp;lt;/HTML&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In traditional HTTP1.0, to load this website into your browser would require &lt;strong&gt;three&lt;/strong&gt;  TCP connections (each with their own 3-way handshake, and 4-way closure).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;HTTP 1.0:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;--&amp;gt; SYN&#xA;                SYN ACK &amp;lt;--&#xA;--&amp;gt; ACK&#xA;&#xA;--&amp;gt; GET /index.html&#xA;           &amp;lt;index.html&amp;gt; &amp;lt;--&#xA;&#xA;--&amp;gt; FIN&#xA;                    ACK &amp;lt;--&#xA;                    FIN &amp;lt;--&#xA;--&amp;gt; ACK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;--&amp;gt; SYN&#xA;                SYN ACK &amp;lt;--&#xA;--&amp;gt; ACK&#xA;&#xA;--&amp;gt; GET /a.gif&#xA;                &amp;lt;a.gif&amp;gt; &amp;lt;--&#xA;&#xA;--&amp;gt; FIN&#xA;                    ACK &amp;lt;--&#xA;                    FIN &amp;lt;--&#xA;--&amp;gt; ACK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;--&amp;gt; SYN&#xA;                SYN ACK &amp;lt;--&#xA;--&amp;gt; ACK&#xA;&#xA;--&amp;gt; GET /b.gif&#xA;                &amp;lt;b.gif&amp;gt; &amp;lt;--&#xA;&#xA;--&amp;gt; FIN&#xA;                    ACK &amp;lt;--&#xA;                    FIN &amp;lt;--&#xA;--&amp;gt; ACK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Note there are 27 packets above, just to download three items:  The HTML page itself (index.html), image a.gif, and image b.gif.  &lt;em&gt;(there would actually be more than 27 packets, but to save vertical space, I only included the ACK's in the 3-way-handshake and the 4-way-closure, and omitted ACK's within the data stream)&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;To improve the efficiency of HTTP, a feature called &amp;quot;Connection Keepalive&amp;quot; was introduced, which allows HTTP to re-use the same TCP connection to request for multiple objects.  The transfer above would be reduced to the following:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;HTTP 1.1 with Connection Keepalive&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;--&amp;gt; SYN&#xA;                SYN ACK &amp;lt;--&#xA;--&amp;gt; ACK&#xA;&#xA;--&amp;gt; GET /index.html&#xA;           &amp;lt;index.html&amp;gt; &amp;lt;--&#xA;--&amp;gt; GET /a.gif&#xA;                &amp;lt;a.gif&amp;gt; &amp;lt;--&#xA;--&amp;gt; GET /b.gif&#xA;                &amp;lt;b.gif&amp;gt; &amp;lt;--&#xA;&#xA;--&amp;gt; FIN&#xA;                    ACK &amp;lt;--&#xA;                    FIN &amp;lt;--&#xA;--&amp;gt; ACK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Notice that only a single TCP connection was used to request all three objects.  This time, it only took 13 packets, a large improvement from the 27 from earlier.&lt;/p&gt;&#xA;&lt;p&gt;The last imrpovement to HTTP that we must discuss is a feature called Pipelining.  This feature further increased HTTP's efficiency, by making it so the Client can requests multiple options at once, without waiting to receive the prior asked object.  Let me show you:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;HTTP1.1 with Pipelining&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;--&amp;gt; SYN&#xA;                SYN ACK &amp;lt;--&#xA;--&amp;gt; ACK&#xA;&#xA;--&amp;gt; GET /index.html&#xA;--&amp;gt; GET /a.gif&#xA;--&amp;gt; GET /b.gif&#xA;           &amp;lt;index.html&amp;gt; &amp;lt;--&#xA;                &amp;lt;a.gif&amp;gt; &amp;lt;--&#xA;                &amp;lt;b.gif&amp;gt; &amp;lt;--&#xA;&#xA;--&amp;gt; FIN&#xA;                    ACK &amp;lt;--&#xA;                    FIN &amp;lt;--&#xA;--&amp;gt; ACK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;We're still only using one TCP connection, and we're still only using 9 packets.  However, we &lt;em&gt;don't&lt;/em&gt; have to wait the Round Trip Time (RTT) it takes between the Client and the Server in between asking for and receiving each object.  If you need an analogy, imagine you're at a Restaurant, and you need Salt, Pepper, and Ketchup.  Is it more efficient to ask your waiter/waitress for all three items at once, or to ask for them one at a time and wait for them to come back before making the next request?&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;(Pipelining isn't directly related to your question, but is often described in conjunction with Keepalives and other HTTP efficiency features, so I decided to include it in this answer for completeness)&lt;/em&gt;&lt;/p&gt;&#xA;&lt;HR&gt;&#xA;&lt;p&gt;Now we can finally come back to your question:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Is a TCP three-way handshake required for an HTTP POST?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;If you open a connection to a web server and download a webpage using the GET method, and that webserver supports connection keepalive.  Subsequent requests to that web server, including the POST method, might simply re-use the already existing TCP connection.  Therefore, that particular POST would not require a new 3-way handshake, since the data would be transferred in an already existing TCP connection.&lt;/p&gt;&#xA;&lt;p&gt;Connection Keepalive, however, does not have an infinite duration.  So if after downloading the webpage, you waited a while before sending your POST, the original TCP connection may have already closed, and in this case, your browser would have to open a new TCP connection to POST your data, which would obviously require starting with the 3-way handshake.&lt;/p&gt;&#xA;&lt;p&gt;Since many browsers and webservers use different timers for how long they want their &amp;quot;connection keepalive&amp;quot; feature to keep connections alive, I wouldn't be able to give you reliable numbers as to how long they typically last.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2021-06-16T15:52:26.410" LastActivityDate="2021-06-16T15:52:26.410" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="13465" PostTypeId="1" CreationDate="2014-12-06T15:36:46.990" Score="8" ViewCount="2057" Body="&lt;p&gt;I have BGP multihoming with two cisco routers. Each router has its own ISP and announce our AS with our /24 network to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is between those two routers :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router A, routing table looks like :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BGP table version is 9622808, local router ID is 10.100.100.2&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,&#xA;              x best-external, a additional-path, c RIB-compressed,&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;RPKI validation codes: V valid, I invalid, N Not found&#xA;&#xA;     Network          Next Hop            Metric LocPrf Weight Path&#xA; *&amp;gt;i 1.0.0.0/24       10.100.100.3         10041    150      0 175 15169 i&#xA; *                    192.168.200.1              0             0 800 15169 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router B, routing table looks like : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;router#sh ip bgp &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BGP table version is 10261936, local router ID is 192.168.1.2&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter,&#xA;              x best-external, a additional-path, c RIB-compressed,&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;RPKI validation codes: V valid, I invalid, N Not found&#xA;&#xA;     Network          Next Hop            Metric LocPrf Weight Path&#xA; *&amp;gt;  1.0.0.0/24       192.168.1.1        10041    150      0 175 15169 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router A&#xA;&lt;pre&gt;&lt;code&gt; &#xA;    #sh ip bgp 1.0.0.0&#xA;    BGP routing table entry for 1.0.0.0/24, version 9124223&#xA;    Paths: (2 available, best #1, table default)&#xA;    Multipath: eBGP&#xA;     Not advertised to any peer&#xA;    Refresh Epoch 1&#xA;    175 15169&#xA;    10.100.100.3 from 10.100.100.3 (192.168.1.1 )&#xA;      Origin IGP, metric 10041, localpref 150, valid, internal, best&#xA;      rx pathid: 0, tx pathid: 0x0&#xA;    Refresh Epoch 1&#xA;    8220 15169&#xA;    192.168.200.1 from 192.168.200.1 (212.74.90.252)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      Community: 538770940 538771322&#xA;      rx pathid: 0, tx pathid: 0&#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router B&#xA;&lt;pre&gt;&lt;code&gt;&#xA;    #sh ip bgp 1.0.0.0&#xA;    BGP routing table entry for 1.0.0.0/24, version 9772009&#xA;    Paths: (1 available, best #1, table default)&#xA;    Multipath: eBGP&#xA;    Advertised to update-groups:&#xA;     15&#xA;    Refresh Epoch 1&#xA;    175 15169&#xA;    192.168.1.1 from 192.168.1.1 (38.28.4.10)&#xA;      Origin IGP, metric 10041, localpref 150, valid, external, best&#xA;      Community: 11424364 11425276&#xA;      rx pathid: 0, tx pathid: 0x0&#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;pre&gt;&lt;code&gt;&#xA;Router B&#xA;    #sh ip bgp summary&#xA;   Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;   10.100.100.2    4        48020  748914 2167278 10705132    0    0 2w4d         3350&#xA;   192.168.1.1   4          175 2591251   29738 10705000    0    0 2w4d       509418&#xA;&lt;/pre&gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is that Router B has only one Next Hop for the 1.0.0.0/24 (this is an example).&#xA;I am expecting that router B has another Next Hop to router A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router A is showing both Next hop as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This issue has serious impact, If we lose router B as the preferred router we lose Internet, since it is not able to route traffic through router A.&lt;/p&gt;&#xA;" OwnerUserId="3406" LastEditorUserId="3406" LastEditDate="2014-12-07T13:02:49.273" LastActivityDate="2016-03-28T10:58:08.837" Title="Internal BGP route exchange issue" Tags="|cisco|routing|bgp|troubleshooting|internet|" AnswerCount="4" CommentCount="12" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13467" PostTypeId="1" CreationDate="2014-12-06T18:09:23.967" Score="2" ViewCount="785" Body="&lt;p&gt;Actually I was doing NAT exemption on ASA 8.0, so I was not able to do NAT exemption from lower security level to higher security level, but I was able to do NAT exempt from higher to lower security level, please tell me how it works?&lt;/p&gt;&#xA;" OwnerUserId="10769" LastEditorUserId="509" LastEditDate="2014-12-06T23:38:02.003" LastActivityDate="2014-12-06T23:38:02.003" Title="Why is it not possible to do NAT exemption from lower to higher security level on ASA 8.0" Tags="|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13468" PostTypeId="1" AcceptedAnswerId="13473" CreationDate="2014-12-06T18:24:27.827" Score="11" ViewCount="16052" Body="&lt;p&gt;I was doing IPsec VPN on ASA 8.0, and I understand a little about that. The initiator starts by sending its ISAKMP policy to the responder, and the responder sends back the matched policy. After that, the Diffie-Hellman key gets exchange, and then both send the pre-shared key to the other for authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we have two keys:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One will be generated by AES encryption&lt;/li&gt;&#xA;&lt;li&gt;One will be generated by the Diffie-Hellman group&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Which key is used to encrypt the pre-shared key?&lt;/p&gt;&#xA;" OwnerUserId="10769" LastEditorUserId="16668" LastEditDate="2015-07-18T07:29:24.197" LastActivityDate="2017-07-08T10:12:56.130" Title="In IPsec VPN, how is the pre-shared key encrypted?" Tags="|cisco|cisco-asa|vpn|ipsec|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13470" PostTypeId="2" ParentId="13468" CreationDate="2014-12-06T21:48:30.943" Score="5" Body="&lt;p&gt;Your answer is in your question:  The Diffie-Hellman exchange is used to generate a common key to securely exchange a common key (i.e. pre-share).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See this: &lt;a href=&quot;https://security.stackexchange.com/questions/67953/understanding-diffie-hellman-key-exchange&quot;&gt;https://security.stackexchange.com/questions/67953/understanding-diffie-hellman-key-exchange&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.953" LastActivityDate="2014-12-06T21:48:30.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13471" PostTypeId="2" ParentId="13447" CreationDate="2014-12-06T21:49:43.667" Score="4" Body="&lt;p&gt;Data transmission use differential signalling, in pair two wires carry opposite polarity. It lower sensitivity to external interference and to cross interference (betwen different pairs in cable).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pair 3,6 not adjacent only in jack. All other way it adjacent. In-adjacency in jack make low difference in interference, but make compatibility with phone, who use primary central pair (4,5)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Tinti comment. If for transmission of differential signal used not twisted pair (it named split pair) cross talk raise dramaticaly and such link not work more that 10m. (UPD: not more that 10m in Full Duplex mode, that is auto detected in most cases)&lt;/p&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="7539" LastEditDate="2015-10-22T19:43:31.413" LastActivityDate="2015-10-22T19:43:31.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13473" PostTypeId="2" ParentId="13468" CreationDate="2014-12-06T22:15:57.750" Score="16" Body="&lt;p&gt;You've asked a great question.  The question seems very simple, but in fact the answer is somewhat more complex.  I'll do my best to answer it in a succinct manner.  Also, since you mentioned ISAKMP, I am going to assume you are interested in IKEv1.  Things change a little for IKEv2 (well, a lot), but I did want to mention the answer below only correlates to IKEv1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase 1 can be accomplished in two different mods:  Main Mode and Aggressive Mode.  In either mode, the first message is sent by the Initiator, and the second message is sent by the Responder.  Both of these messages include what is known in the cryptography world as a &lt;strong&gt;Nonce&lt;/strong&gt;.  A Nonce is simply a randomly generated number to use in key generation.  &lt;em&gt;(the term Nonce comes from _N_umber used _Once_)&lt;/em&gt;.  So, after message 1 and message 2, both sides know each other's Nonces.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Nonce's are combined with the Pre-Shared-Key to create a Seed value for generating secret keys.  The relative part of the &lt;a href=&quot;http://www.faqs.org/rfcs/rfc2409.html&quot;&gt;IKE RFC&lt;/a&gt; is here:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; For pre-shared keys:       SKEYID = prf(pre-shared-key, Ni_b | Nr_b)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;SKEYID is the Seed value that will later be used to generate additional secret keys.  The Pre-Shared-Key and both Nonce values (Ni_b is the Initiator's Nonce, and Nr_B is the Responder's Nonce) is combined by using a PRF, or Psuedo Random Function.  A PRF is like a hashing algorithm, except that the result can be as many bits as you need.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you were initially doing Main Mode, messages 3 and 4 share the Initiator's and Responder's (respectively) Diffie-Hellman public keys.  They both use the these values to generate the Diffie-Hellman &lt;strong&gt;shared secret&lt;/strong&gt;.  If you were doing Aggressive mode, these DH Public values are also included in Message 1 and Message 2 (along with the Nonces).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Seed value is then combined with the DH Shared Secret (and a few other values) to create three &lt;strong&gt;Session Keys&lt;/strong&gt;:  a Derevative key, an Authentication key, and an Encryption key.  The RFC states it as such:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The result of either Main Mode or Aggressive Mode is three groups of&#xA;    authenticated keying material:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; SKEYID_d = prf(SKEYID, g^xy | CKY-I | CKY-R | 0)&#xA; SKEYID_a = prf(SKEYID, SKEYID_d | g^xy | CKY-I | CKY-R | 1)&#xA; SKEYID_e = prf(SKEYID, SKEYID_a | g^xy | CKY-I | CKY-R | 2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;SKEYID_d, _a, and _e are the three Session keys mentioned above.  &lt;code&gt;SKEYID&lt;/code&gt; is the Seed value.  &lt;code&gt;g^xy&lt;/code&gt; is the DH Shared Secret. &lt;code&gt;CKY-I&lt;/code&gt; and &lt;code&gt;CKI-R&lt;/code&gt; are the Initiator and Responder Cookies, these are just additional randomly generated values that are used later to identify this particular ISAKMP exchange and security association.  &lt;code&gt;0 1 2&lt;/code&gt; are the literal numbers 0, 1, and 2.  The Pipe symbol &lt;code&gt;|&lt;/code&gt; represents concatenation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, all these values are combined together using a PRF which creates three Session keys:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Derivative Key&lt;/strong&gt; -- this key is &lt;em&gt;not&lt;/em&gt; used by ISAKMP, and is instead handed to IPsec so that IPsec can create its own Secret Keys&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Authentication Key&lt;/strong&gt; -- this key is used by ISAKMP in its HMAC (aka, Hashing algorithm secured with a Secret key)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Encryption Key&lt;/strong&gt; -- this key is used by ISAKMP to symmetrically encrypt anything ISAKMP wants to securely to the other peer.  So if the chosen Encryption algorithm for Phase1 is AES, AES will &lt;em&gt;use this key&lt;/em&gt; to symmetrically encrypt data -- AES will not generate its own keying material.  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Authentication Key and Encryption Key are used to secure/encrypt the ensuing Phase2 negotiation.  In Main Mode, messages 5 and 6 of Phase1 are also protected by these keys.  Furthermore, any future ISAKMP informational exchanges (DPD, Rekey events, Delete messages, etc) are also protected by these two keys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Derivative Key is handed to IPsec, and IPsec generates its own Keying material from this Key.  If you recall, IPsec does not innately include a Key Exchange mechanism, so the only way for it to acquire secret keys is to either set them manually (which is archaic, and never really done anymore), OR to depend on an external service to provide the keying material, like ISAKMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RFC says it like so:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;SKEYID_e is the keying material used by the ISAKMP SA to protect&#xA;  the confidentiality of its messages.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;SKEYID_a is the keying material used by the ISAKMP SA to&#xA;  authenticate its messages.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;SKEYID_d is the keying material used to derive keys for non-ISAKMP&#xA;  security associations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With all that said, we can refer back to your question:  What key is used to secure the Pre-Shared-Key?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Main Mode, the Pre-Shared-Key (PSK) is verified in Messages 5 and 6.  Message 5 and 6 are Protected by the Session keys ISAKMP generates, described above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Aggressive Mode, none of the messages in the negotiation are encrypted.  And the PSK is verified in Messages 2 and 3.  Notice, I said in both cases the PSK is &lt;em&gt;verified&lt;/em&gt;, and I never said the PSK is &lt;em&gt;exchanged&lt;/em&gt;.  Obviously, if nothing in Aggressive mode is Encrypted, and you simply sent the Pre-Shared-Key across the wire unencrypted, there would be a huge gaping security vulnerability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lucky for us, the writers of ISAKMP already thought of that.  And as a result, they created a special method for verifying that each party has the correct PSK, without actually sharing it across the wire.  There are two items that are use to validate to each Peer that they both have the same PSK:  the &lt;strong&gt;Identity Method&lt;/strong&gt; and the &lt;strong&gt;Identity Hash&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPN Peers can choose to identify themselves by various methods; most commonly, peers will simply use their source IP address.  But they have the option to use a FQDN or Hostname.  Each of these, along with the correlating value for the chosen method, are what make up the Identity Method.  So for example, if I had the IP 5.5.5.5, and I wanted to use my IP address to identify myself, my &lt;strong&gt;ID Method&lt;/strong&gt; would effectively be &lt;strong&gt;[IP Address, 5.5.5.5]&lt;/strong&gt;.  &lt;em&gt;(Note:  BOTH values make up the entire ID Method)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ID Method is then combined (using a PRF) with the Seed value we discussed earlier (SKEYID), and a few other values, to create the &lt;strong&gt;Identity Hash&lt;/strong&gt;.   Recall, that what went into creating SKEYID in the first place was the Pre-Shared-Key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ID Method and ID Hash are then sent across the wire, and the other party attempts to re-create the ID Hash using the same formula.  If the receiver is able to re-create the same ID Hash, it proves to the receiver that the sender must have had the correct pre-shared-key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is described in the RFC here:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To authenticate either exchange the initiator of the protocol&#xA;    generates HASH_I and the responder generates HASH_R where:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HASH_I = prf(SKEYID, g^xi | g^xr | CKY-I | CKY-R | SAi_b | IDii_b )&#xA;HASH_R = prf(SKEYID, g^xr | g^xi | CKY-R | CKY-I | SAi_b | IDir_b )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IDii and IDir are the ID Method.  And HASH_I and HASH_R are the Initiator and Responder hash's.  Both of these are shared in Phase1.  From the RFC:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When doing a pre-shared key authentication, Main Mode is defined as&#xA;    follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         Initiator                        Responder&#xA;        ----------                       -----------&#xA;         HDR, SA             --&amp;gt;&#xA;                             &amp;lt;--    HDR, SA&#xA;         HDR, KE, Ni         --&amp;gt;&#xA;                             &amp;lt;--    HDR, KE, Nr&#xA;         HDR*, IDii, HASH_I  --&amp;gt;&#xA;                             &amp;lt;--    HDR*, IDir, HASH_R&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Aggressive mode with a pre-shared key is described as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       Initiator                        Responder&#xA;      -----------                      -----------&#xA;       HDR, SA, KE, Ni, IDii --&amp;gt;&#xA;                             &amp;lt;--    HDR, SA, KE, Nr, IDir, HASH_R&#xA;       HDR, HASH_I           --&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And now, we can finally answer your question fully:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Pre-Shared-Key is combined using a PRF with Nonces, and a bunch of other values known to anyone else in the negotiation.  The result is a value that can only be mutually attained by two parties if both parties started with the same values -- aka, the same pre-shared-key.  The resulting value is what is shared on the wire, with allows two parties to verify they have matching Pre-Shared-Keys without actually exposing any information about the Pre-Shared-Key itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Main Mode goes a step more secure by also encrypting the exchange of the &quot;resulting value&quot; described above, making it even more difficult to extract any useful information about what the Pre-Shared-Key was.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR&gt;&#xA;&lt;em&gt;(it seems I failed miserably at answering this succinctly)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-12-06T22:15:57.750" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="13475" PostTypeId="2" ParentId="13467" CreationDate="2014-12-06T22:23:23.077" Score="5" Body="&lt;p&gt;NAT Exemption is by definition bi-directional.  If I have the following networks, with the following security-levels and IPs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DMZ    - Security Level 50  - 10.1.1.0/24&#xA;Inside - Security Level 100 - 10.2.2.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There will never be a case where I DON'T want to NAT between my Inside and DMZ, but I DO want to NAT between my DMZ and Inside.  I'll either want to NAT, or not-NAT, between INSIDE/DMZ or DMZ/INSIDE, regardless of the direction or network where the traffic was initiated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So Cisco, to avoid making you configure NAT Exemption in both directions, chose to make it by-directional by default.  And to leave ambiguity out, simply arbitrarily picked &quot;High to Low&quot; as the correct method for configuring NAT Exemption.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much like NAT is typically configured from &quot;High to Low&quot; security levels.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-12-06T22:23:23.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13482" PostTypeId="1" AcceptedAnswerId="13483" CreationDate="2014-12-07T12:33:20.477" Score="3" ViewCount="15212" Body="&lt;p&gt;I am using packettracer to configure a network. The problem is that the router (that is acting as a router-on-a-stick) is not offering ip-addresses from its pool. The pc that act as the client belongs to vlan 30 and the interface fa0/1 on the switch is in acess-mode state. So no problem. And - the G0/1-interface to the router is configured as a trunk link. OK! AND - And the PC can communicate with ICMP-messages to the router if its configured static. So I do not understand why the router doesnt offer any address to the client?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I click the DHCP-radiobutton on the pc-GUI I get the following error information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DHCP failed. APIPA is being used&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router config for dhcp&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HQ(config)#ip dhcp excluded-address 10.10.10.193 255.255.255.192&#xA;HQ(config)#ip dhcp pool LAN&#xA;HQ(dhcp-config)#network 10.10.10.192 255.255.255.192&#xA;HQ(dhcp-config)#default-router 10.10.10.193&#xA;HQ(dhcp-config)#end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the addressing info looks like this for vlan-30 on the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;G0/0.30   10.10.10.193   255.255.255.192&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And my config on the router for this subinterface&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HQ(config-subif)#encapsulation dot1q 30&#xA;HQ(config-subif)#ip address 10.10.10.193 255.255.255.192&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I add a screenshot here so you easily can see the topology of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would be  greatful if someone could see why the router wont offer the ip-addresses? May it have something to do with the native vlan that is VLAN 45?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cincerely&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/9S7gE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10681" LastEditorUserId="775" LastEditDate="2014-12-08T12:00:13.480" LastActivityDate="2016-06-03T20:14:52.813" Title="DHCP-offer fails on dhcpserver - router-on-a-stick" Tags="|vlan|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13483" PostTypeId="2" ParentId="13482" CreationDate="2014-12-07T16:30:46.763" Score="4" Body="&lt;p&gt;You've excluded all IP's available in the pool except for the network address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HQ(dhcp-config)#network 10.10.10.192 255.255.255.192&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;indicates available IP addresses are 10.10.10.192 upto and including 10.10.10.255, and &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HQ(config)#ip dhcp excluded-address 10.10.10.193 255.255.255.192&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Indicates that except for 10.10.10.192 these addresses cannot be used. So fix that last statement so the DHCP server actually has some addresses it can assign.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2014-12-07T16:30:46.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13485" PostTypeId="2" ParentId="13421" CreationDate="2014-12-08T02:27:55.013" Score="1" Body="&lt;p&gt;You can do a PIX emulation if you need to, and there is still a demand for this functionality in spite of there no longer being &quot;official&quot; support for PIX within GNS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jason Neumann explains the process on the GNS3 community web site at &lt;a href=&quot;https://community.gns3.com/message/8432#8432&quot; rel=&quot;nofollow&quot;&gt;https://community.gns3.com/message/8432#8432&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6154" LastActivityDate="2014-12-08T02:27:55.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13486" PostTypeId="1" AcceptedAnswerId="13496" CreationDate="2014-12-08T02:51:36.280" Score="4" ViewCount="5991" Body="&lt;p&gt;Let's say I have a multicast group 239.0.0.1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If A and B are members of this group and listening on port 6000, I can send data to (239.0.0.1, 6000) and both A and B will receive.&#xA;Now, if A is listening on port 6000 and B on port 7000, how to send data to both the members in a single transmission ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the above scenario is not possible, then does it mean that a multicast group is not just identified by its multicast group address but by the 2-tuple multicast group address and port number ? I could not find such definition for a multicast group anywhere.&lt;/p&gt;&#xA;" OwnerUserId="8597" LastEditorUserId="8597" LastEditDate="2014-12-08T22:21:02.553" LastActivityDate="2014-12-08T22:21:02.553" Title="Is it possible to have same multicast group members listening on different port numbers?" Tags="|multicast|udp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13487" PostTypeId="1" CreationDate="2014-12-08T04:49:21.993" Score="1" ViewCount="620" Body="&lt;p&gt;What is maximum number of routes that can be sent in one lsa update packet.I know the lsa update is send in response to lsa request. But there would be some number right.&lt;/p&gt;&#xA;" OwnerUserId="10782" LastActivityDate="2015-04-16T13:26:57.260" Title="What is maximum number of routes that can be sent in one lsa update packet" Tags="|ospf|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13489" PostTypeId="1" AcceptedAnswerId="13492" CreationDate="2014-12-08T06:59:20.660" Score="2" ViewCount="136" Body="&lt;p&gt;I am trying to create a BGP simulation in GNS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following topology&#xA;&lt;img src=&quot;https://i.stack.imgur.com/OA21h.png&quot; alt=&quot;network topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I have understood:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 will advertise 201.10.10.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2 will advertise 203.0.2.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3 will advertise 203.0.2.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R4 will advertise 203.0.4.0, 205.0.0.0, 205.0.0.128&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since, the next hop is not changed in iBGP sessions, I will either have to use &lt;code&gt;neighbor next-hop-self&lt;/code&gt; command or add IGP.'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am adding IGP. In AS 200 for R3 I will have to add 203.0.2.0 and 203.0.3.0. Similarly for R2 I will have to add 203.0.1.0 and 203.0.2.0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I choose to add RIP or OSPF with same process ID in AS 200 and AS 300 then doing IGP will share the routing information of AS 200 and AS 300 with each other using IGP.&#xA;How do I fix this?&lt;/p&gt;&#xA;" OwnerUserId="10784" LastEditorUserId="10784" LastEditDate="2014-12-08T07:18:19.570" LastActivityDate="2014-12-08T10:30:57.780" Title="Can adjacent AS in BGP run same protocol in IGP?" Tags="|routing|bgp|gns3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13490" PostTypeId="2" ParentId="13465" CreationDate="2014-12-08T08:48:17.957" Score="1" Body="&lt;p&gt;In your case, B should not have route from A because B itself is declaring its learned route as the best route and disseminating this info via iBGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router A can't advertise its eBGP learned 1.0.0.0/8 to B because it's not the best route. The best route for A is the one it learned via iBGP from B and iBGP routes can't be re-advertised.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of the eBGP routers are learning networks from both ISPs. When ISP for B fails, A eBGP routes will become eligible to be sent to B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH.&lt;/p&gt;&#xA;" OwnerUserId="10306" LastEditorUserId="10306" LastEditDate="2014-12-08T13:00:07.700" LastActivityDate="2014-12-08T13:00:07.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13492" PostTypeId="2" ParentId="13489" CreationDate="2014-12-08T10:30:57.780" Score="3" Body="&lt;p&gt;The answer is actually very easy: make sure R3 and R4 do not form an IGP neighbor relationship. You do this by configuring the serial interface between those routers as &quot;passive&quot; only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A passive interface does not send or receive routing protocol updates, but it is advertised in the routing protocol. For RIP you configure this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA;    passive-interface s0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OSPF configuration is left as an exercise for the reader.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2014-12-08T10:30:57.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13494" PostTypeId="2" ParentId="10265" CreationDate="2014-12-08T15:10:40.587" Score="0" Body="&lt;p&gt;As I remember my last Wi-Fi packet capture, there no imestamp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory, extension can be made, but it need deep integrated in driver and hardware. AFAIK not any Wi-Fi hardware allow such deep modification.&#xA;(I imply it must be extension in wireless-management frames, to not be encrypted, when client connected to WPA protected AP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course client and Your sniffer (because client connected to other AP) must support it.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2014-12-08T15:10:40.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13495" PostTypeId="1" CreationDate="2014-12-08T15:18:16.653" Score="2" ViewCount="330" Body="&lt;p&gt;I understood that three session keys are generated by diffi-helmen and nonces, in phase 1 msg 3 and msg 4 both exchanged diffi-helmen public key and generate shared secret key ,and shared secret key and nonces are mixed together to created three session keys ,&#xA;1 encryption key &#xA;2 authentication key&#xA;3 derivate key &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now i want to know that what is sent in msg 5 msg 6 ,and how pre-shared key encrypted and how both verify each other authentication with pre-shared key &lt;/p&gt;&#xA;" OwnerUserId="10769" LastEditorUserId="775" LastEditDate="2014-12-10T05:09:44.933" LastActivityDate="2014-12-10T05:09:44.933" Title="ipsec vpn with preshared key p" Tags="|cisco-asa|vpn|ipsec|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13496" PostTypeId="2" ParentId="13486" CreationDate="2014-12-08T16:23:38.620" Score="4" Body="&lt;p&gt;Subscribing to a multicast group and listening on a multicast address and port are two different things. If you are subscribed to a multicast group all traffic with that destination address should be sent to your host. It is another step to listen on a specific port and process that traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, traffic with destination 239.0.0.1:6000 would be sent to both hosts but since only host A has an application that is listening, only host A will do anything with that traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not possible to send to all port numbers or send to the &lt;code&gt;*&lt;/code&gt; port. No such concept exists in TCP/UDP. If you were using a different protocol, maybe there is something like that.&lt;/p&gt;&#xA;" OwnerUserId="579" LastActivityDate="2014-12-08T16:23:38.620" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13500" PostTypeId="1" AcceptedAnswerId="13510" CreationDate="2014-12-08T19:38:33.890" Score="3" ViewCount="268" Body="&lt;p&gt;I'm trying to come up with a plan to get our core network design a bit more resilient to failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a drawing of what I would like to achieve:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/mhZ74.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final design would probably involve one more instance, but the drawing got way too cluttered with a third line all around the place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've figured out on my own is how to set the MST instance root for each instance. What I don't quite get is how I'm supposed to design this that RACKSW02 takes over root for MST2 if RACKSW01 dies etc. Is it just a matter of setting the correct MST root priorities around the setup?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to set custom link costs if I want to override the default metrics, as RACKSW01&amp;lt;-&gt;RACKSW02 is 20gbps, while CORESW01/02 only has 10gbps?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The design goal behind all this is to balance out the load across the links, as 99.9% of the MST2 instance is only between the two top-of-rack switches.&lt;/p&gt;&#xA;" OwnerUserId="122" LastActivityDate="2014-12-09T07:18:40.490" Title="MSTP with no single point of failure with 4 switches and 2 regions" Tags="|design|spanning-tree|ieee-802.1s|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13501" PostTypeId="2" ParentId="13495" CreationDate="2014-12-08T20:20:30.023" Score="1" Body="&lt;p&gt;All of your questions were already answered in &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13468/in-ipsec-vpn-how-pre-shared-key-is-encrypted/13473#13473&quot;&gt;your original question&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In Main Mode, the Pre-Shared-Key (PSK) is verified in Messages 5 and 6.  Message 5 and 6 are Protected by the Session keys ISAKMP generates, described above.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In Aggressive Mode, none of the messages in the negotiation are encrypted.  And the PSK is verified in Messages 2 and 3.  Notice, I said in both cases the PSK is &lt;em&gt;verified&lt;/em&gt;, and I never said the PSK is &lt;em&gt;exchanged&lt;/em&gt;.  Obviously, if nothing in Aggressive mode is Encrypted, and you simply sent the Pre-Shared-Key across the wire unencrypted, there would be a huge gaping security vulnerability.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Lucky for us, the writers of ISAKMP already thought of that.  And as a result, they created a special method for verifying that each party has the correct PSK, without actually sharing it across the wire.  There are two items that are use to validate to each Peer that they both have the same PSK:  the &lt;strong&gt;Identity Method&lt;/strong&gt; and the &lt;strong&gt;Identity Hash&lt;/strong&gt;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;VPN Peers can choose to identify themselves by various methods; most commonly, peers will simply use their source IP address.  But they have the option to use a FQDN or Hostname.  Each of these, along with the correlating value for the chosen method, are what make up the Identity Method.  So for example, if I had the IP 5.5.5.5, and I wanted to use my IP address to identify myself, my &lt;strong&gt;ID Method&lt;/strong&gt; would effectively be &lt;strong&gt;[IP Address, 5.5.5.5]&lt;/strong&gt;.  &lt;em&gt;(Note:  BOTH values make up the entire ID Method)&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The ID Method is then combined (using a PRF) with the Seed value we discussed earlier (SKEYID), and a few other values, to create the &lt;strong&gt;Identity Hash&lt;/strong&gt;.   Recall, that what went into creating SKEYID in the first place was the Pre-Shared-Key.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The ID Method and ID Hash are then sent across the wire, and the other party attempts to re-create the ID Hash using the same formula.  If the receiver is able to re-create the same ID Hash, it proves to the receiver that the sender must have had the correct pre-shared-key.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When doing a pre-shared key authentication, Main Mode is defined as&#xA;    follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         Initiator                        Responder&#xA;        ----------                       -----------&#xA;         HDR, SA             --&amp;gt;&#xA;                             &amp;lt;--    HDR, SA&#xA;         HDR, KE, Ni         --&amp;gt;&#xA;                             &amp;lt;--    HDR, KE, Nr&#xA;         HDR*, IDii, HASH_I  --&amp;gt;&#xA;                             &amp;lt;--    HDR*, IDir, HASH_R&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Message 5 is HDR, IDii, and HASH_I&lt;BR&gt;&#xA;Message 6 is HRD, IDir, and HASH_R&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my description, IDix was the ID Method, and HASH_x was the ID Hash.  Was there something in there that didn't make sense?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If Firewall1 has the IP 1.1.1.1, and Firewall2 has the IP 2.2.2.2, and they are both using the Pre-Shared-Key of &quot;Zebra&quot;, then Message 5 and Message 6 would include this information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.1.1.1                                    2.2.2.2&#xA;----------                             -----------&#xA;HDR*, IDii, HASH_I   ---5--&amp;gt;&#xA;                     &amp;lt;--6---    HDR*, IDir, HASH_R&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Message 5 would include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IDii, which is effectively &lt;strong&gt;[IP Address, 1.1.1.1]&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;li&gt;HASH_I, which is a hash of the following values:  (&lt;strong&gt;SEED Value&lt;/strong&gt; + IDii + Public Values)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Message 6 would include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IDir, which is effectively &lt;strong&gt;[IP Address, 2.2.2.2]&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;HASH_R, which is a hash of the following values:  (&lt;strong&gt;SEED Value&lt;/strong&gt; + IDir + Public Values)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;Public Values&lt;/em&gt; above are values that were exchanged in cleartext Messages 1, 2, 3, and 4, that anyone would have access to if they were eavesdropping on the wire.  The Seed Value is the only part of the Hash that would only be known to whomever had the original Pre-Shared-Key.  As one of the values that went into creating the Seed Value is the string &quot;&lt;em&gt;Zebra&lt;/em&gt;&quot; -- aka, the pre-shared-key.  See above, and &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13468/in-ipsec-vpn-how-pre-shared-key-is-encrypted/13473#13473&quot;&gt;the original answer&lt;/a&gt; for more details on how that is formed.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-12-09T22:45:36.640" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="13503" PostTypeId="2" ParentId="10143" CreationDate="2014-12-08T22:42:11.427" Score="3" Body="&lt;p&gt;Very likely, yes, as it's not the same protocol as 802.11a (even if you could get the 5ghz radio onto the right band)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-08T22:42:11.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13505" PostTypeId="1" CreationDate="2014-12-09T02:20:36.363" Score="4" ViewCount="2703" Body="&lt;p&gt;In weighted fair queuing, how does the router/switch/multiplexer know which queue to put a packet into? For example does it read the headers of each packet to find out the sender and the intended application?&#xA;&lt;img src=&quot;https://i.stack.imgur.com/LUpE6.gif&quot; alt=&quot;diagram&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;For example how does &amp;quot;classify arrivals&amp;quot; work?&lt;/p&gt;&#xA;" OwnerUserId="8025" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-10-04T16:40:50.890" Title="How does a router/switch know which queue a packet should be put in?" Tags="|cisco|router|qos|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13507" PostTypeId="2" ParentId="13505" CreationDate="2014-12-09T07:05:10.970" Score="4" Body="&lt;p&gt;A network device generally has 3-4 queues for traffic handling. WFQ is not strictly speaking a queuing algorithm, it's a egress traffic scheduling algorithm. It determines how the traffic placed in different queues is sent out of the device. The way fair queuing works is that traffic placed on different queues is served in order, for example in case of three queues they would be served 1-2-3-1-2-3 and so on. We can give double weight for queue 1, in which case the queues would be served 1-1-2-3-1-1-2-3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Classifying arrivals&quot; refers to the way ingress packets are handled within the device itself. Generally network devices uphold the existing priority of the traffic, placing incoming packets to appropriate egress queue based on what priority it has. However in every case the device actually looks into the frame itself, either the L2 or L3 header. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ingress frames can be prioritized several different ways. We can use the ingress interface, or determine it by Layer 2 frame information such as 802.1p/Q priority (Class of Service, CoS), L2 MAC address or VLAN ID. This is how a L2 device such as a switch works. For example the packet may arrive in a specific &quot;Voice&quot; VLAN (used for VOIP traffic), in which case it will be placed in high priority egress queue. Or the frame header's 802.1Q VLAN Tag may contain a 3-bit PCP (Priority Code Point) field which determines which queue the packet is placed in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router as L3 device would look at the IP packet header in the frame payload. There's a wide range of ways to prioritize the traffic, from the incoming interface to the IP address, subnet, TCP/IP port number and so on. Most commonly used is probably DiffServ (Differentiated Services). This uses 6-bit Differentiated Services Code Point (DSCP) in 8-bit DS field in the packet header. This allows much more granulated priority categorization, in theory 64 (2^6) different priority levels. In practice however most networks use commonly defined per-hop behaviors:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Default PHB - typically best-effort traffic, used for normal PC data&#xA;traffic &lt;/li&gt;&#xA;&lt;li&gt;Expedited Forwarding (EF PHB) - used for low-loss,&#xA;low-latency traffic, for example VOIP &lt;/li&gt;&#xA;&lt;li&gt;Assured Forwading (AF PHB) - ensures delivery under certain pre-defined conditions &lt;/li&gt;&#xA;&lt;li&gt;Class Selector PHB - maintains backward compatibility with previously used ToS (Type of Service) field in IPv4 header&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;More in-depth descriptions how traffic priorization works can be found for example in Wikipedia. Type of Service, Class of Service, Quality of Service, 802.1p and 802.1Q are good starting points. &lt;/p&gt;&#xA;" OwnerUserId="10799" LastEditorUserId="10799" LastEditDate="2014-12-09T10:41:12.907" LastActivityDate="2014-12-09T10:41:12.907" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="13510" PostTypeId="2" ParentId="13500" CreationDate="2014-12-09T07:18:40.490" Score="2" Body="&lt;p&gt;Yes, it's that simple, just set priorities appropriately :-) So you configure your Core 1 with highest and Core 2 with lower priority for instance 1, and configure instance 2 similar way. You leave other devices in the network to their default priorities. The only way to overwrite the default link costs is to set them manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would consider a different configuration. There's no point setting your STP root to the edge. Rather leave the core switches as roots for different MSTP instances; for example Core 1 for odd and Core 2 for even instances. This way the root ports are core uplinks so non-blocking, and you don't have to care about the link costs on the edge. Another advantage is that it's easier to keep track on which ports are blocking on which instances. &lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2014-12-09T07:18:40.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13512" PostTypeId="2" ParentId="12833" CreationDate="2014-12-09T07:43:49.430" Score="2" Body="&lt;p&gt;If you're just using 1 10Gb port to connect them, you only have to add that link into the VLANs you want to share between the switches, if any. Out of the box, there'd be no configuration on your side w/ 1 link&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With 2 links, you will want to form a link aggregation in one of 2 ways. Say you're going to link over 1/49 and 2/49 (first 10Gb on both switches in the stack) to ports 1/50 and 2/50 on the 2nd stack (second 10Gb on both switches in the stack). It's like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stack 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;trunk 1/49,2/49 trk1 lacp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Stack 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;trunk 1/50,2/50 trk1 lacp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The name 'trk1' becomes the virtual port name. It doesn't have to match on both sides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last keyword &lt;code&gt;lacp&lt;/code&gt; can also be &lt;code&gt;trunk&lt;/code&gt;. The difference is that &lt;code&gt;lacp&lt;/code&gt; is a more stateful connection, &lt;code&gt;trunk&lt;/code&gt; being static port bundle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, if you have VLANs that need to transit the trunk, you have to allow those across. Just like the other ports are set up, but with the 'trk1' port. If you had, say VLANs 10 and 20, you'd do this on both stacks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 10&#xA;&#xA;tagged trk1&#xA;&#xA;vlan 20&#xA;&#xA;tagged trk1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10801" LastEditorUserId="775" LastEditDate="2014-12-09T10:56:57.467" LastActivityDate="2014-12-09T10:56:57.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13513" PostTypeId="2" ParentId="13215" CreationDate="2014-12-09T08:15:11.400" Score="1" Body="&lt;p&gt;It's not readily clear what the issue is. Your ASA is still acting like permit-vpn is turned on. :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, it's good to have a little more flexibility than what the permit-vpn sysopt will allow you since it's global. You can apply a vpn filter to that user's group policy&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd try this just to ensure it does work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;group-policy MYVPN internal&#xA;group-policy MYVPN attributes&#xA; vpn-filter value ldap_access_out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10801" LastEditorUserId="775" LastEditDate="2014-12-09T10:14:50.360" LastActivityDate="2014-12-09T10:14:50.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13514" PostTypeId="2" ParentId="13215" CreationDate="2014-12-09T08:56:28.640" Score="2" Body="&lt;p&gt;It turns out 'sysopt connection permit-vpn' is implicit, meaning you don't see it in the config (unless you actually have &lt;em&gt;no sysopt connection permit-vpn&lt;/em&gt;).&lt;/p&gt;&#xA;" OwnerUserId="2934" LastActivityDate="2014-12-09T08:56:28.640" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13518" PostTypeId="2" ParentId="13505" CreationDate="2014-12-09T10:45:05.740" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In queuing algorithms such as weighted fair queuing, how does the router/switch/multiplexer know which queue to put a packet into?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;... For example how does &quot;classify arrivals&quot; work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When &lt;a href=&quot;http://en.wikipedia.org/wiki/Weighted_fair_queueing&quot; rel=&quot;nofollow noreferrer&quot;&gt;wfq&lt;/a&gt; is enabled on an interface, the router builds a table of flows, and prioritizes low-bandwidth flows over high-bandwidth flows.  By prioritizing flows, it &lt;em&gt;classifies&lt;/em&gt; lower bandwidth flows into a higher priority queue;  for more detail, see &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfwfq.html#wp1000889&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's QoS config guide&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;WFQ provides traffic priority management that automatically sorts among individual &#xA;traffic streams without requiring that you first define access lists. WFQ can &#xA;also manage duplex data streams such as those between pairs of applications, &#xA;and simplex data streams such as voice or video. There are two categories of WFQ &#xA;sessions: high bandwidth and low bandwidth. Low-bandwidth traffic has effective &#xA;priority over high-bandwidth traffic, and high-bandwidth traffic shares the &#xA;transmission service proportionally according to assigned weights.&#xA;&#xA;When WFQ is enabled for an interface, new messages for high-bandwidth traffic &#xA;streams are discarded after the configured or default congestive messages threshold &#xA;has been met. However, low-bandwidth conversations, which include control message &#xA;conversations, continue to enqueue data. As a result, the fair queue may occasionally &#xA;contain more messages than its configured threshold number specifies.&#xA;&#xA;With standard WFQ, packets are classified by flow. Packets with the same source IP &#xA;address, destination IP address, source TCP or User Datagram Protocol (UDP) &#xA;port, or destination TCP or UDP port belong to the same flow. WFQ allocates &#xA;an equal share of the bandwidth to each flow. Flow-based WFQ is also called &#xA;fair queueing because all flows are equally weighted.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;One should also remember that QoS disciplines never kick in until there is congestion on the interface.  Finally, if possible, it's a good idea to manage queue depth with &lt;a href=&quot;http://en.wikipedia.org/wiki/Weighted_random_early_detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;wred&lt;/a&gt; for all the reasons outlined in &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5316/how-are-weighted-fair-queuing-and-weighted-random-early-detection-related?rq=1&quot;&gt;this question&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-12-09T10:45:05.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13519" PostTypeId="1" AcceptedAnswerId="13523" CreationDate="2014-12-09T11:15:03.290" Score="2" ViewCount="583" Body="&lt;p&gt;If the packets captured by wireshark is&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;28.263227 193.54.236.133   193.54.236.132 66 55555 &amp;gt; 19745 [ACK] Seq=1 Ack=2897 Win=2880 Len=0&lt;/p&gt;&#xA;&lt;p&gt;28.263228 193.54.236.132   193.54.236.133 1514 19745 &amp;gt; 55555 [PSH, ACK] Seq=2897 Ack=1 Win=5760 Len=1448&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;What is the last byte received on the machine having IP 193.54.236.133 ? Is it 2897+1448 or 2897+1448-1 ? And why is there a PSH flag in the second packet ?&lt;/p&gt;&#xA;" OwnerUserId="10654" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2014-12-09T13:45:10.467" Title="last byte received, using wireshark" Tags="|tcp|wireshark|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13520" PostTypeId="1" AcceptedAnswerId="13521" CreationDate="2014-12-09T11:58:49.407" Score="7" ViewCount="7628" Body="&lt;p&gt;I was wondering if it's possible at all to configure a password policy which enforces password complexity for locally defined accounts. I know it's possible for TACACS+ and RADIUS, but I need to know if it's possible to enforce such policy for locally defined accounts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devices I have in scope are running IOS and NX-OS&lt;/p&gt;&#xA;" OwnerUserId="29" LastEditorUserId="775" LastEditDate="2014-12-09T13:32:55.513" LastActivityDate="2014-12-16T11:25:28.187" Title="Configuring a password policy on Cisco IOS or NX-OS" Tags="|cisco|cisco-ios|security|cisco-nexus-5k|cisco-nexus-7k|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13521" PostTypeId="2" ParentId="13520" CreationDate="2014-12-09T12:46:08.653" Score="7" Body="&lt;p&gt;Regarding password complexity for local accounts, you have these options...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Cisco NX-OS&lt;/strong&gt;: I'm not sure you can configure a local password policy in NX-OS; however, NX-OS &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/sec_rbac.html#wp1258879&quot; rel=&quot;nofollow noreferrer&quot;&gt;rejects weak passwords by default&lt;/a&gt;.  To disable this feature, use &lt;code&gt;no password strength-checking&lt;/code&gt; in the global configuration.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Cisco IOS&lt;/strong&gt;:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Password length: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s1.html#wp4245155510&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;security password min-length&lt;/code&gt;&lt;/a&gt;.  Admittedly, length is a fairly weak check itself, but IOS at least can detect / deny brute force attacks (see below).&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are a few things to remember...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Many older versions of Cisco IOS use a &lt;a href=&quot;http://packetlife.net/toolbox/type7/&quot; rel=&quot;nofollow noreferrer&quot;&gt;weak &quot;Type 7&quot; hash&lt;/a&gt; to protect passwords from shoulder-surfing; there are a billion tools like this on the internet to reverse those hashes.  Type 7 hashes should not be considered secure and thus, archive configs in a directory with good permissions enforcement (i.e. your linux tftp directory probably isn't a good location, since most people change tftp file permissions to 777).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ironically the weak &quot;Type 7&quot; algorithm looks secure to the uninitiated, and is enabled with a command called &lt;code&gt;service password-encryption&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;One should always use the &lt;code&gt;secret&lt;/code&gt; keyword when possible in usernames: i.e. &lt;code&gt;username joe secret 5 $1$pJz5$28CTViXggZmhjikYdDyls0&lt;/code&gt;.   This is at least a decent &lt;code&gt;md5&lt;/code&gt; hash of the plaintext password.  Newer IOS versions &lt;a href=&quot;http://www.infoworld.com/article/2613969/password-security/cisco-inadvertently-weakens-password-encryption-in-its-ios-operating-system.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;attempt to use a stronger algorithm&lt;/a&gt;, but failed before getting it right.&lt;/li&gt;&#xA;&lt;li&gt;It's not a bad idea to audit local accounts to see whether you can upgrade them to use the &lt;code&gt;secret&lt;/code&gt; keyword. In linux, it's as simple as &lt;code&gt;grep ^username /path/to/your/configs/* | grep -v secret&lt;/code&gt; (making a note to myself to do this today at my $dayjob)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Newer versions of IOS have a feature to trap brute-force attacks against the router; an ACL is applied to the vty.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This command would automatically apply an acl to block the offending source IP address for 60 seconds if it had failed password checks 3 times in five minutes: &lt;code&gt;login block-for 60 attempts 3 within 300&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;You can customize the access-list which is applied using &lt;code&gt;login quiet-mode access-class [acl-name]&lt;/code&gt;; by default &lt;a href=&quot;https://networkengineering.stackexchange.com/a/6675/775&quot;&gt;IOS applies an acl called &lt;code&gt;sl_def_acl&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2014-12-16T11:25:28.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13522" PostTypeId="1" AcceptedAnswerId="13539" CreationDate="2014-12-09T12:47:04.150" Score="2" ViewCount="369" Body="&lt;p&gt;I am working on a problem to minimize load for my thesis. &#xA;Where the load is taken as the function of amount of traffic (bit) and length (m) to reduce the distance over which a demand is served.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My supervisor told me that this metric is widely used but I could not find any reference except for &lt;a href=&quot;http://www.commscope.com/Blog/optimizing-the-cost-per-bit-per-meter/&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; article.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I use this metric (bit-meter) to analyse communication network ?&lt;/p&gt;&#xA;" OwnerUserId="8680" LastEditorUserId="775" LastEditDate="2014-12-10T17:33:39.083" LastActivityDate="2014-12-10T17:34:11.517" Title="Optimizing The Cost Per Bit Per Meter" Tags="|routing|wan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13523" PostTypeId="2" ParentId="13519" CreationDate="2014-12-09T13:45:10.467" Score="4" Body="&lt;p&gt;Because 2897 is the sequence number of the first byte in the received segment, the sequence number of the last byte is 2897+1448-1. When this segment is acked, the ACK field will contain 2897+1448 since that is the sequence number of the next byte expected to arrive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PSH or push flag indicates that TCP should not buffer this data. In other words, TCP should not wait for more data before transmitting it (sender) or before handing it over to the application (receiver). As to &lt;em&gt;why&lt;/em&gt; the flag is there in this case, that is a question for whoever wrote the application or protocol being used. &lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-12-09T13:45:10.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13524" PostTypeId="1" AcceptedAnswerId="14772" CreationDate="2014-12-09T15:43:16.143" Score="7" ViewCount="3909" Body="&lt;p&gt;I mostly seeing configuration of QoS queues based on CBWFQ, witch is tripped off by shaping map. Something like below example.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map test&#xA; class test&#xA;  bandwidth remaining percent 20&#xA;  random-detect dscp-based&#xA; class test2&#xA;  bandwidth remaining percent 20&#xA;  random-detect dscp-based&#xA; class test3&#xA;  bandwidth remaining percent 20&#xA;  random-detect dscp-based&#xA; class test4&#xA;  bandwidth remaining percent 20&#xA;  random-detect dscp-based&#xA; class class-default&#xA;  bandwidth remaining percent 20&#xA;  random-detect dscp-based      &#xA;policy-map shape-test&#xA; class class-default&#xA;  shape average xxx&#xA;  service-policy test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Of course it's configured on appropriated interface (out).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know about simple variant of CBWFQ called WFQ. Where I don't have to specify classes (automatic creation of classes). Yea I also know that it's done by hash from header, and each class has weight... And so one...&#xA;Almost always, I see configuration of fair-queue on interface or simply, in the default class called 'class-default'. This default-class is configured on appropriate interfaces thanks to police-map. So both ways should has same result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, today I saw something that made me feel jittery. I saw something like CBWFQ with fair-queue statement in class-default. For better explain, example.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map test&#xA; class test&#xA;  bandwidth remaining percent 20&#xA;  random-detect dscp-based&#xA; class test2&#xA;  bandwidth remaining percent 20&#xA;  random-detect dscp-based&#xA; class test3&#xA;  bandwidth remaining percent 20&#xA;  random-detect dscp-based&#xA; class test4&#xA;  bandwidth remaining percent 20&#xA;  random-detect dscp-based&#xA; class class-default&#xA;  fair-queue&#xA;  queue-limit 1024 packets&#xA;policy-map shape-test&#xA; class class-default&#xA;  shape average xxx&#xA;  service-policy test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here my question starts... It means that the guy that configured class-default with   'fair-queue', 'queue-limit 1024 packets' made from CBWFQ normal WFQ? Same as we can configure it on interface? And just specified the WFQ classes fixedly, instead of automatically specification that Cisco devices does?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why? It doesn't look like a standard solution, isn't it? &#xA;&lt;em&gt;It is possible that the man did not know what he did...&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any answer, or links that could point me to understand it properly!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DANIEL&lt;/p&gt;&#xA;" OwnerUserId="10520" LastEditorUserId="10520" LastEditDate="2014-12-09T19:47:30.353" LastActivityDate="2015-01-29T15:29:54.677" Title="What is benefit of using CBWFQ with fair-queue statement" Tags="|cisco|cisco-ios|qos|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13525" PostTypeId="1" AcceptedAnswerId="13538" CreationDate="2014-12-09T16:06:48.450" Score="4" ViewCount="825" Body="&lt;p&gt;Let's say i have the following WAN:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/h89nw.png&quot; alt=&quot;From solutions of computer networking a top-down approach 5th edition&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose that all arp tables are empty and that E wants to send a packet to A.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The E will send an arp request with destination ip of Router 2(unicast), get its mac and send it the packet.&lt;/li&gt;&#xA;&lt;li&gt;Router 2 will receive the packet, finds the packet's subnet next hop using BGP using past calculations, in this case Router 1, then using its intranetwork protocol(RIP,OSPF) find that Router 1 is the next router and then it makes arp request with the address of Router 1 in order to get its mac. Then it sends the packet with the new ethernet addresses to Router 1&lt;/li&gt;&#xA;&lt;li&gt;Router 1 receives the packet, recognize that it belongs to its own subnet and makes an arp request using the destination ip address of A. After that it delivers the packet A.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would like to know if the procedure flow is correct.&#xA;a)Also if the E got its ip manually (not with DHCP), it would need to broadcast the arp request.&#xA;Am i right? (since it wouldn't know the network mask)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="10805" LastActivityDate="2014-12-09T22:29:16.447" Title="ARP Destination address (internetwork)" Tags="|dhcp|arp|wan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13527" PostTypeId="1" AcceptedAnswerId="13528" CreationDate="2014-12-09T17:29:08.020" Score="6" ViewCount="134" Body="&lt;p&gt;On the core router I use OSPF with other routers for internal networks and a default route to the ISP's router for Internet access. All internal routers have the CORE router as the default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case that the connection to any of the internal routers/networks are not available I want the core router not to use the default route to look for any of the internal networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How?&lt;/p&gt;&#xA;" OwnerUserId="10170" LastEditorUserId="775" LastEditDate="2014-12-17T11:09:15.630" LastActivityDate="2014-12-17T11:09:15.630" Title="How do I setup cisco router not to use the default route to look for internal networks that are down?" Tags="|cisco|routing|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13528" PostTypeId="2" ParentId="13527" CreationDate="2014-12-09T17:57:18.813" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In case that the connection to any of the internal routers/networks are not available I want the core router not to use the default route to look for any of the internal networks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Configure a null0 route in your IGP core which covers all the IGP address space, then redistribute into area 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ip route 10.0.0.0 255.0.0.0 null0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now redistribute into ospf...  You can optionally add a high admin distance if your routing policy requires it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  router ospf 100&#xA;      redistribute static subnets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-12-17T11:02:08.353" LastActivityDate="2014-12-17T11:02:08.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13532" PostTypeId="1" CreationDate="2014-12-09T21:27:17.330" Score="4" ViewCount="4454" Body="&lt;p&gt;Referring to the following Cisco SAFE design :&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Small_Enterprise_Design_Profile/SEDP/chap5.html#wp1058019&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Small_Enterprise_Design_Profile/SEDP/chap5.html#wp1058019&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z14wy.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why use an L3 switch in front of a firewall? Why not let the firewall do all the routing and put an L2 switch instead? The firewall will have to route anyway from my understanding. It seems to me there is too much routing devices &quot;daisy chained&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm referring to Cisco SAFE because it represent the kind of design I commonly see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="10791" LastActivityDate="2014-12-10T01:20:18.793" Title="Routing with a firewall vs L3 switches" Tags="|routing|switch|firewall|design|architecture|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13538" PostTypeId="2" ParentId="13525" CreationDate="2014-12-09T22:29:16.447" Score="1" Body="&lt;p&gt;You're almost 100% correct.  Slight corrections bolded below:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;HostE will send an ARP Request with a &lt;strong&gt;target address&lt;/strong&gt; of Router2's IP address.  The destination MAC address of the ARP packet will be &lt;code&gt;ffff.ffff.ffff&lt;/code&gt;, which would indeed make it a &lt;strong&gt;broadcast&lt;/strong&gt;.  Router2 responds unicst with its MAC address, and HostE generates the packet with a Source and Destination IP of 192.168.3.1 and 192.168.1.1, and a Source and Destination MAC of 7777.7777.7777 and 8888.8888.8888 (respectively).&lt;/li&gt;&#xA;&lt;li&gt;Router 2 will receive the packet, and &lt;strong&gt;consult its Route Table&lt;/strong&gt; to determine the Next Hop for the 192.168.1.0/24.  If Router2 doesn't already know Router1's MAC address, it will issue a broadcast ARP Request for it.  Once it learns it, it will then forward the packet leaving the Source/Destination IP unchanged, and encapsulating the IP packet with a Layer 2 header with a Source and Destination MAC of 5555.5555.5555 and 3333.3333.3333.&lt;/li&gt;&#xA;&lt;li&gt;Router1 receives the packet and &lt;strong&gt;consults its Route Table&lt;/strong&gt; to determine the destination Network is directly connected.  Router1 sends a Broadcast ARP Request for the IP 192.168.1.1 to learn HostA's MAC address, and then finally forward the packet to the final destination.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And to answer your last question.  Whether HostE gets its address from DHCP or not, the process flow would appear as above if HostE did not have an entry in its ARP Cache for Router2's MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IF, Router2 was the DHCP Server (which it doesn't have to be).  And Router2 &lt;em&gt;just&lt;/em&gt; assigned HostE its address.  Then theoretically, HostE would know Router2's MAC address.  But ARP entries don't last forward, particularly on clients.  For example, my Windows 7 laptop keeps ARP entries for only 34.5 seconds (see below).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So even if Router2 was the DHCP server, and gave HostE its IP address, sooner or later HostE's ARP cache would time out, and it would have to run the broadcast ARP request all over again, just like if HostE had always only had a static IP assigned.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\eddie&amp;gt;netsh interface ipv4 show interfaces 20&#xA;&#xA;Interface Local Area Connection Parameters&#xA;----------------------------------------------&#xA;IfLuid                             : ethernet_11&#xA;IfIndex                            : 20&#xA;State                              : connected&#xA;Metric                             : 20&#xA;Link MTU                           : 1500 bytes&#xA;Reachable Time                     : 34500 ms     &amp;lt;-----&#xA;Base Reachable Time                : 30000 ms&#xA;Retransmission Interval            : 1000 ms&#xA;DAD Transmits                      : 3&#xA;Site Prefix Length                 : 64&#xA;Site Id                            : 1&#xA;Forwarding                         : disabled&#xA;Advertising                        : disabled&#xA;Neighbor Discovery                 : enabled&#xA;Neighbor Unreachability Detection  : enabled&#xA;Router Discovery                   : dhcp&#xA;Managed Address Configuration      : enabled&#xA;Other Stateful Configuration       : enabled&#xA;Weak Host Sends                    : disabled&#xA;Weak Host Receives                 : disabled&#xA;Use Automatic Metric               : enabled&#xA;Ignore Default Routes              : disabled&#xA;Advertised Router Lifetime         : 1800 seconds&#xA;Advertise Default Route            : disabled&#xA;Current Hop Limit                  : 0&#xA;Force ARPND Wake up patterns       : disabled&#xA;Directed MAC Wake up patterns      : disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-12-09T22:29:16.447" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13539" PostTypeId="2" ParentId="13522" CreationDate="2014-12-09T22:33:33.870" Score="4" Body="&lt;p&gt;&lt;a href=&quot;http://drpeering.net/AskDrPeering/blog/articles/Ask_DrPeering/Entries/2011/1/13_How_do_ISPs_cost_their_network.html&quot; rel=&quot;nofollow&quot;&gt;Here is a decent explanation from DrPeering.net&lt;/a&gt; of the cost per bit-mile(meter).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Simple Bit-Mile Costing model tries to establish a network&#xA;  component price per bit mile. This calculation might take all route&#xA;  segments and calculate the average cost per mile. The end result would&#xA;  be a $/bit mile cost number. Then gross traffic analysis would be&#xA;  applied to see what a customer actually uses of the network bit mile&#xA;  resources. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For example, if a customer has 55Mbps of traffic from SFO to Seattle&#xA;  (say 1200 miles) multiplied by the $/bit mile yields $X to carry that&#xA;  traffic. The customer also has about 95Mbps from SFO to LA (say 400&#xA;  miles) multiplied by the $/bit mile yields $Y to carry that traffic.&#xA;  When taken in aggregate, one can get  sense of the order of magnitude&#xA;  of the cost of this customer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also &lt;a href=&quot;http://www.level3.com/en/legal/ip-traffic-exchange-policy/&quot; rel=&quot;nofollow&quot;&gt;here is Level3 peering agreement&lt;/a&gt; that talks bit-mile.  Level 3 seems to be one of the main carriers pushing for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to be clear bit-mile costs are used for billing and peering agreements.  The bit-mile cost isn't a routing metric like hop count or bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To minimize the bit-mile cost on your network, you would have to hack the bit-mile cost into the network some how.  The easiest way I can think is if you had a big OSPF network you could calculate all the bit-mile cost of all your links and statically configure them.  Then OSPF will calculate the route between locations using the lowest bit-mile cost.&lt;/p&gt;&#xA;" OwnerUserId="8265" LastEditorUserId="3191" LastEditDate="2014-12-09T22:53:17.990" LastActivityDate="2014-12-09T22:53:17.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13540" PostTypeId="2" ParentId="13422" CreationDate="2014-12-09T23:03:02.233" Score="1" Body="&lt;p&gt;or you could just type:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hw-module slot &lt;em&gt;num&lt;/em&gt; reset power-cycle&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but if a sup card and in rommon (message &quot;Module not completely up&quot;) it does not want to play. (assuming its not my equipment) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;.. off to site we go.. &lt;/p&gt;&#xA;" OwnerUserId="10812" LastActivityDate="2014-12-09T23:03:02.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13542" PostTypeId="2" ParentId="13532" CreationDate="2014-12-10T01:20:18.793" Score="7" Body="&lt;p&gt;You certainly could use a L2 switch, and it would probably work just fine.  But here are a few reasons why a L3 switch might be a better choice:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You may want to segregate your servers into different VLANs to&#xA;simplify access control, apply QoS, limit failure domains, etc.  An L3&#xA;switch will make this much easier.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;While Firewalls can run routing protocols, they don't seem to do it&#xA;as well as routers, except in the most simplest of cases.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Network management features are usually more mature on routers than&#xA;firewalls.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In many organizations, firewalls are administered by the security&#xA;team (a bad idea, IMO), so they need to get involved if routing&#xA;changes are needed. It's better if network routing is controlled by&#xA;a single administrative group.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the simple diagram you presented, there aren't many routing decisions to be made (there is only one data path), so static routes would probably suffice.  but if you start adding redundant switches with redundant paths, then you need devices that can detect and respond to topology changes -- i.e. run routing protocols.  &quot;Daisy-chaining&quot; routers is not going to cause problems unless the network is very large.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-12-10T01:20:18.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13543" PostTypeId="1" AcceptedAnswerId="13544" CreationDate="2014-12-10T02:11:32.343" Score="2" ViewCount="1681" Body="&lt;p&gt;I have a question about NAT, and this question has answered most of it : &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/12540/how-nat-portforwarding-tcp-ip-works&quot;&gt;How NAT / PortForwarding / TCP/IP works?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am left confused on, is in this part of the question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does this work?&#xA;  Now when a packet comes back, the Router simply checks the destination port number and changes the destination IP address and the destination port number according to the &lt;strong&gt;pre-mentioned mapping&lt;/strong&gt; and the packet gets delivered successfully. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My question is the following: What happens if a random computer (computer A) tries to connect on a random port of a computer on a LAN (computer B) behind the router using NAT? For example, what happens if computer A wants to connect via TCP on port 42534 on computer B? The packet sent to the LAN would be the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source_address: computer A's public address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source_port: computer A's port&lt;/p&gt;&#xA;&#xA;&lt;p&gt;destination_address: the LAN's public address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;destination_port: 42534&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How will the router know to which computer it should send the packet? Is there a mapping that would allow the router to know to which computer on the LAN to send it to?&lt;/p&gt;&#xA;" OwnerUserId="10813" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-12-10T02:29:59.350" Title="Connecting on a port on a computer behind NAT" Tags="|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13544" PostTypeId="2" ParentId="13543" CreationDate="2014-12-10T02:29:59.350" Score="1" Body="&lt;p&gt;Yes.  Typically, devices that are accessible from the public side have a static mapping.  So the (public) destination address and port are mapped to a private address behind the NAT device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the static mapping is not set up in advance, then the router will not know how to process the packet and will drop it.  In other words, unless the administrator configures NAT mapping, no translation will occur.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the type of NAT configured, all ports will be mapped to a single private address. Or, specific ports can be mapped to separate private addresses and ports.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, you can use a single public IP and map it to different servers.  Using the same public IP, mail (tcp 25) can be mapped to one server, SSH (tcp 22) can be mapped to a different server, and web (tcp 80) to a third.  But they all appear to the public as a single address.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-12-10T02:29:59.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13548" PostTypeId="2" ParentId="2122" CreationDate="2014-12-10T11:54:56.977" Score="2" Body="&lt;p&gt;Was looking for some other stuff and ran across this post.  A few suggestions/thoughts in case anyone else runs across this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the DNS issue, agreed, it can be a pain in a larger environment to assign all AP's to one Controller.  You could potentially use either IP Anycast for this, if you've set up your management networks for Anycast, or use round-robin DNS for load-sharing amongst the controllers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the DHCP Option 43, I am running a pair of ASA's (5505's w the onboard PoE ports) for a set of AP's and have the following syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  dhcpd option 43 hex f104.c0a8.f92a &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looks pretty like what the OP has, aside from different IP's.  The decimal-&gt;hex matches so that doesn't appear to be the issue.  I would take a look at the local console of the AP when it boots up.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. Does it look more like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar  1 00:17:34.521: %CAPWAP-5-DHCP_RENEW: Could not discover WLC using DHCP IP. Renewing DHCP IP.&#xA;Not in Bound state.&#xA;*Mar  1 00:17:43.117: %CAPWAP-3-ERRORLOG: Invalid event 38 &amp;amp; state 2 combination.&#xA;*Mar  1 00:17:43.150: %DHCP-6-ADDRESS_ASSIGN: Interface GigabitEthernet0 assigned DHCP address 192.168.253.67, mask 255.255.255.0, hostname AP1####.####.####&#xA;&#xA;Translating &quot;CISCO-CAPWAP-CONTROLLER&quot;...domain server (192.168.253.1) [OK]&#xA;&#xA;*Mar  1 00:17:51.024: %CAPWAP-3-ERRORLOG: Did not get log server settings from DHCP.   &amp;lt;---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or more like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar  1 00:14:00.251: %LWAPP-3-LWAPP_INTERFACE_GOT_IP_ADDRESS: Interface GigabitEthernet0 obtained IP from DHCP...&#xA;*Mar  1 00:14:10.930:  status of voice_diag_test from WLC is false&#xA;*Mar  1 00:14:10.987: Logging LWAPP message to 255.255.255.255.&#xA;&#xA;Translating &quot;CISCO-CAPWAP-CONTROLLER&quot;...domain server (192.168.253.1) [OK]&#xA;&#xA;*Mar  1 00:14:22.010: %CAPWAP-5-DHCP_OPTION_43: Controller address 192.168.249.42 obtained through DHCP     &amp;lt;-------&#xA;*Dec 10 10:57:48.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 192.168.249.42 peer_port: 5246&#xA;*Dec 10 10:57:48.000: %CAPWAP-5-CHANGED: CAPWAP changed state to  &#xA;*Dec 10 10:57:48.509: %CAPWAP-5-DTLSREQSUCC: DTLS connection created sucessfully peer_ip: 192.168.249.42 peer_port: 5246&#xA;*Dec 10 10:57:48.509: %CAPWAP-5-SENDJOIN: sending Join Request to 192.168.249.42&#xA;*Dec 10 10:57:48.509: %CAPWAP-5-CHANGED: CAPWAP changed state to JOIN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You might also try a &quot;show capwap client config&quot; command, to show the local configuration on the AP.  e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AP3502-02#show capwap client config &#xA;configMagicMark         0x#########&#xA;chkSumV2                ####&#xA;chkSumV1                #####&#xA;swVer                   7.0.250.0&#xA;adminState              ADMIN_ENABLED(1)&#xA;name                    AP3502-02&#xA;location                ASA02&#xA;...&#xA;Heart Beat Timer        30 secs&#xA;Led State Enabled       1 &#xA;Primed Interval         0 &#xA;AP ILP Pre-Standard Switch Support Disabled&#xA;AP Power Injector Disabled&#xA;Infrastructure MFP validation Enabled&#xA;Configured Switch 1 Addr 192.168.249.44      &amp;lt;-------&#xA;non-occupancy channels: &#xA;Ethernet (Duplex/Speed) auto/auto &#xA;&#xA;Slot 0&#xA;        adminstate              ADMIN_ENABLED(1)&#xA;        radioType               RADIO_TYPE_80211bg&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10815" LastActivityDate="2014-12-10T11:54:56.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13549" PostTypeId="2" ParentId="13385" CreationDate="2014-12-10T12:45:31.430" Score="2" Body="&lt;p&gt;Copying here hat I put in Super User a few days ago:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a peek at the not-too-informative manuals and the not-much-more-informative website. I did notice your setup is the same test setup you find in the installation guide. There's the same test, ping from laptop connecting to the Client to the laptop connecting to the AP. If it works, test is successful; there's no mention that pinging the other way should be successful or even tested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's four modes; AP, Client, Master and Slave. AP is clear, Master/Slave combo is for creating a wireless bridge (WDS). I guess the Client mode is intended for using this device as a dumb wireless NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that mode you'd connect the box to Ethernet NIC of another device which has no WiFi capability. The Client is the one which connects to the wireless network, just as a wless NIC does, and acts the same way - passes traffic between the wireless interface and the &quot;bus&quot;, i.e. the Ethernet interface. Since the other device is not actually connecting to the network itself, it won't be seen and it shouldn't need an IP address at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run a Wireshark trace on laptop A when you're pinging from laptop B. I bet the ICMP echo packets are originating from IP address .127.254. If I'm right, from the network point of view address .127.1 doesn't exist at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that if you want specifically laptop B itself to be pingable, you'd need to configure Master/Slave mode. However there's a catch: now .127.253 is in AP mode, which means any wless client can connect to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specs specify two antennas, but I couldn't find out how many radios the device has. One radio can only perform one function, it's either serving the WDS bridge, or serving wireless clients. So if there's only one radio, the Master and Slave can only talk to each other, not to wless clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please do let me know :-)&lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2014-12-10T12:45:31.430" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13553" PostTypeId="2" ParentId="13465" CreationDate="2014-12-10T16:38:13.560" Score="-3" Body="&lt;p&gt;This is a normal BGP behavior of 'path hiding', one of legacy feature to alliveate the scaling issue. Failover should work as intended. If you need the routerA eBGP llearned route still display on B, use 'best-external' BGP command on rourterA(as well as in B). &lt;/p&gt;&#xA;" OwnerUserId="10819" LastActivityDate="2014-12-10T16:38:13.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13554" PostTypeId="1" CreationDate="2014-12-10T19:27:01.597" Score="2" ViewCount="617" Body="&lt;p&gt;Is there a good reason why Junos limits its logical interfaces to 16385 ? i would love to use like the numbering schema to facilitate int.xxxxyyyy which helps with clearly identifying interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so is there a technical reason why this limitation exists ? &lt;/p&gt;&#xA;" OwnerUserId="1092" LastActivityDate="2018-01-19T17:16:40.723" Title="Junos sub interface number limited to 16385" Tags="|juniper|juniper-junos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="13558" PostTypeId="1" AcceptedAnswerId="14594" CreationDate="2014-12-10T22:59:41.410" Score="4" ViewCount="9912" Body="&lt;p&gt;I'm trying to build an IKEv2/IPSec VPN between a pfSense which uses StrongSWAN 5.2.1 and an ASA 5512 (version 9.1 software.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the pfSense starts the connection, everything works fine. When the ASA starts the connection, the SA comes up, but the CHILD_SA fails because &lt;a href=&quot;http://pastebin.com/egAZmYFu&quot; rel=&quot;noreferrer&quot;&gt;the ASA claims it can't find a matching policy&lt;/a&gt;. This happens every night, after the CHILD_SA expires so I have to manually restart the tunnel from the pfSense every morning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The config for the Cisco looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network Victoria-network&#xA; subnet 192.168.244.0 255.255.255.0&#xA; description Victoria office subnet&#xA;object network NOC-network&#xA; subnet 192.168.242.0 255.255.255.0&#xA; description NOC management subnet&#xA;&#xA;nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Victoria-network Victoria-network no-proxy-arp route-lookup&#xA;&#xA;access-list OUTSIDE_cryptomap extended permit ip 192.168.242.0 255.255.255.0 object Victoria-network &#xA;&#xA;crypto ipsec ikev2 ipsec-proposal AES256-SHA256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-512&#xA;&#xA;crypto map OUTSIDE_map 1 match address OUTSIDE_cryptomap&#xA;crypto map OUTSIDE_map 1 set pfs group14&#xA;crypto map OUTSIDE_map 1 set peer 1.2.3.4 &#xA;crypto map OUTSIDE_map 1 set ikev2 ipsec-proposal AES256-SHA256&#xA;crypto map OUTSIDE_map interface OUTSIDE&#xA;crypto ca trustpool policy&#xA;&#xA;crypto ikev2 policy 2&#xA; encryption aes-256&#xA; integrity sha512&#xA; group 14&#xA; prf sha512&#xA; lifetime seconds 3600&#xA;&#xA;crypto ikev2 enable OUTSIDE&#xA;&#xA;group-policy GroupPolicy_1.2.3.4 internal&#xA;group-policy GroupPolicy_1.2.3.4 attributes&#xA; vpn-tunnel-protocol ikev2&#xA;&#xA;tunnel-group 1.2.3.4 type ipsec-l2l&#xA;tunnel-group 1.2.3.4 general-attributes&#xA; default-group-policy GroupPolicy_1.2.3.4&#xA;tunnel-group 1.2.3.4 ipsec-attributes&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the strongSwan config looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conn con1&#xA;    fragmentation = yes&#xA;    keyexchange = ikev2&#xA;    reauth = yes&#xA;    forceencaps = no&#xA;    rekey = yes&#xA;    reqid = 1&#xA;    installpolicy = yes&#xA;    type = tunnel&#xA;    dpdaction = restart&#xA;    dpddelay = 10s&#xA;    dpdtimeout = 60s&#xA;    auto = route&#xA;    left = 1.2.3.4&#xA;    right = 9.8.7.6&#xA;    leftid = 1.2.3.4&#xA;    ikelifetime = 28800s&#xA;    lifetime = 3600s&#xA;    rightsubnet = 192.168.242.0/24&#xA;    leftsubnet = 192.168.244.0/24&#xA;    ike = aes256-sha512-modp2048!&#xA;    esp = aes256-sha512-modp2048,aes256gcm128-sha512-modp2048!&#xA;    leftauth = psk&#xA;    rightauth = psk&#xA;    rightid = 9.8.7.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Full disclosure: I may be woefully unqualified for this task. That said, I have so far managed to get a Juniper NS5-GT, Fortigate FG-60B, and a pfSense 2.1 box tunneled to this ASA so I must be doing something right! Any assistance will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="10827" LastEditorUserId="10827" LastEditDate="2014-12-12T17:07:54.830" LastActivityDate="2014-12-12T23:15:26.837" Title="ASA VPN works as responder but not as initiator" Tags="|cisco-asa|ipsec|tunnel|pfsense|ike|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="13559" PostTypeId="1" CreationDate="2014-12-10T23:26:17.447" Score="3" ViewCount="1273" Body="&lt;p&gt;I'm working on a client's H3C S5820X-28S switch. I'm thoroughly unfamiliar with H3C (which, as I understand, is just an pre-buyout HP switch) having only touched Cisco and some Juniper switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anywho, I have a 10Gig port That appears to be configured, but refuses to turn on for some reason. It's in a remote datacenter and I have eyes on the switch that say that we have it patched properly, but not getting link. I've managed to pull up its current config and this is what it's set to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; [conf]display interface Ten-GigabitEthernet1/0/14&#xA; Ten-GigabitEthernet1/0/14 current state: DOWN&#xA; IP Packet Frame Type: PKTFMT_ETHNT_2, Hardware Address: 3822-d6e5-3763&#xA; Description: Ten-GigabitEthernet1/0/14 Interface&#xA; Loopback is not set&#xA; Media type is stack wire,Port hardware type is STACK_SFP_PLUS&#xA; 10Gbps-speed mode, full-duplex mode&#xA; Link speed type is force link, link duplex type is force link&#xA; Flow-control is not enabled&#xA; The Maximum Frame Length is 10000&#xA; Broadcast MAX-ratio: 100%&#xA; Unicast MAX-ratio: 100%&#xA; Multicast MAX-ratio: 100%&#xA; Allow jumbo frame to pass&#xA; PVID: 101&#xA; Link delay is 0(sec)&#xA; Port link-type: access&#xA; Tagged   VLAN ID : none&#xA; Untagged VLAN ID : 101&#xA; Port priority: 0&#xA; Peak value of input: 0 bytes/sec, at 2003-08-06 09:46:13&#xA; Peak value of output: 0 bytes/sec, at 2003-08-06 09:46:13&#xA; Last 300 seconds input:  0 packets/sec 0 bytes/sec 0%&#xA; Last 300 seconds output:  0 packets/sec 0 bytes/sec 0%&#xA; Input (total):  0 packets, 0 bytes&#xA;         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses&#xA; Input (normal):  0 packets, - bytes&#xA;         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses&#xA; Input:  0 input errors, 0 runts, 0 giants, 0 throttles&#xA;         0 CRC, 0 frame, - overruns, 0 aborts&#xA;         - ignored, - parity errors&#xA; Output (total): 0 packets, 0 bytes&#xA;         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses&#xA; Output (normal): 0 packets, - bytes&#xA;         0 unicasts, 0 broadcasts, 0 multicasts, 0 pauses&#xA; Output: 0 output errors, - underruns, - buffer failures&#xA;         0 aborts, 0 deferred, 0 collisions, 0 late collisions&#xA;         0 lost carrier, - no carrier&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've manually enabled/disabled the port with &lt;code&gt;shutdown/undo shutdown&lt;/code&gt; but still cannot get it working. Is there something that I may have missed in the config? &lt;/p&gt;&#xA;" OwnerUserId="10828" LastActivityDate="2019-06-30T20:33:03.330" Title="Enabling an ethernet port on an H3C S5820X-28S switch" Tags="|switch|hp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="13561" PostTypeId="2" ParentId="13559" CreationDate="2014-12-11T03:56:31.423" Score="3" Body="&lt;pre&gt;&lt;code&gt;Media type is stack wire,Port hardware type is STACK_SFP_PLUS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You haven't said what's being connected to the port, or if there are any syslog errors (presumably of an &quot;unsupported&quot; SFP) Run &quot;&lt;code&gt;display transceiver interface&lt;/code&gt;&quot; to see what it thinks about the module(s).  Your output shows a direct-attach cable is plugged in.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-11T03:56:31.423" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="13563" PostTypeId="1" CreationDate="2014-12-11T05:43:05.323" Score="4" ViewCount="23181" Body="&lt;p&gt;I have a 3550 Catalyst Switch. &#xA;2 computers connected to the switch have the same IP address configured and there is an IP address conflict. &#xA;How do i zero in on these computers with just the CLI of the switch?&lt;/p&gt;&#xA;" OwnerUserId="10712" LastEditorUserId="8499" LastEditDate="2018-03-19T18:18:31.497" LastActivityDate="2018-03-19T18:34:36.650" Title="Identifying an IP address conflict through a Cisco Switch" Tags="|cisco|ip|ip-address|" AnswerCount="5" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="14563" PostTypeId="2" ParentId="13563" CreationDate="2014-12-11T06:16:44.793" Score="-3" Body="&lt;p&gt;ravi babu .. the best way to clear the ip conflict ,if DHCP is enabled in your network just give ipconfig /release and ipconfig/renew in both the pcs . If you gave static ip in your both the pcs .. then go to network settings and change the ip on both pcs. I don't think in the switch you can achieve this ,unless you have to shutdown any one of the switch port.&lt;/p&gt;&#xA;" OwnerUserId="11831" LastActivityDate="2014-12-11T06:16:44.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14567" PostTypeId="2" ParentId="11083" CreationDate="2014-12-11T08:15:35.580" Score="2" Body="&lt;p&gt;after much research we came to a conclusion it is impossible (at least without spending ridiculous amount of resources) to make this work with Ubiquiti APs.&lt;/p&gt;&#xA;" OwnerUserId="8558" LastActivityDate="2014-12-11T08:15:35.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14568" PostTypeId="5" CreationDate="2014-12-11T09:05:41.503" Score="0" Body="" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-12-11T09:05:41.503" LastActivityDate="2014-12-11T09:05:41.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14569" PostTypeId="4" CreationDate="2014-12-11T09:05:41.503" Score="0" Body="Use this tag for questions about discovering the IP addresses, mac-addresses, vlans, or the physical topology of a network." OwnerUserId="775" LastEditorUserId="775" LastEditDate="2014-12-11T09:05:41.503" LastActivityDate="2014-12-11T09:05:41.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14570" PostTypeId="1" CreationDate="2014-12-11T09:55:55.280" Score="8" ViewCount="4564" Body="&lt;p&gt;I need to make a sure a certain user on an IOS router can only type specific commands. I was able to do this with privilege levels but them whenever the user would type &quot;enable&quot; he would be right back to priv level 15 and about to type all commands. I want to make sure that even when he enters &quot;enable&quot; he will still only be able to type the specific commands I've allow. I also tried with Role-Based cli but ran into the same issue. I don't want to use any external authentication servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks! &lt;/p&gt;&#xA;" OwnerUserId="5329" LastActivityDate="2014-12-11T21:44:30.563" Title="How do I restrict a user for certain commands on Cisco IOS" Tags="|router|cisco-ios|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14572" PostTypeId="2" ParentId="13563" CreationDate="2014-12-11T13:01:20.397" Score="1" Body="&lt;p&gt;As far as I know there is no straight solution for this. In your case you can create a MAC address based ACL and bind it to the VLAN in which those SwitchPort exist. Of the two MAC address block one. Detection of the problem this way will be quick with a little obstruction in network service. You can refer to &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3550-series-switches/64844-mac-acl-block-arp.html#conf&quot; rel=&quot;nofollow&quot;&gt;this configuration&lt;/a&gt; from Cisco doc.&lt;/p&gt;&#xA;" OwnerUserId="4752" LastActivityDate="2014-12-11T13:01:20.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14575" PostTypeId="2" ParentId="14570" CreationDate="2014-12-11T14:51:26.440" Score="-5" Body="&lt;p&gt;Restricting the commands can be done in Cisco ACS if you configure the device to use TACACS for AAA.&lt;/p&gt;&#xA;" OwnerUserId="10103" LastActivityDate="2014-12-11T14:51:26.440" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14576" PostTypeId="1" AcceptedAnswerId="14585" CreationDate="2014-12-11T15:04:47.377" Score="1" ViewCount="651" Body="&lt;p&gt;I was asked to review a network architecture at work. As I am not very familiar with VLAN utilization with multicast, that is why I am here to request your help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The old network consists of many servers linked to clients though a switch (can be seen as separated networks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each client have very specific needs like a dedicated DHCP configuration, video broadcast through multicast, .... I can't put them on the same network even if I review services configuration for example. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We want to limit the number of server used, and put them in the same room, and later virtualize them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The use of VLAN seems mandatory, to separate those network, but as most servers use multicast for the video, i don't want to have to broadcast the video stream on each server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They use a lot of network and CPU ressources, which isn't optimal for the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't use IGMP on client to retrieve the media stream, and VLAN must be untagged for clients as those both features are not supported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clients won't answer to the video stream, they will just receive it, and display it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial idea was to set a separate VLAN on which the video stream will be send, and then put it on the untagged port of the switch linked to the client (with the video stream also untagged). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that possible? Add an unidirectional untagged VLAN into another untagged VLAN? Which kind of switch could handle that kind of thing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware that I could solve this problem using a router, but i can't do it on some clients, as they use very specific kind of traffic (Ethernet broadcast) to work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for reading this long post, and sorry for my english, i am not a native speaker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope someone got some ideas or pointer to solve my problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a small Scheme : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;server1&amp;gt;      &amp;lt;=== VLAN UNTAGGED1 ===&amp;gt;    &amp;lt;          &amp;gt; &amp;lt;==VLAN UNTAGGED1+3 ==&amp;gt; Client1&#xA;&#xA;&amp;lt;server2&amp;gt;      &amp;lt;=== VLAN UNTAGGED2 ===&amp;gt;    &amp;lt;  switch  &amp;gt;&#xA;&#xA;&amp;lt;video server&amp;gt; &amp;lt;=== VLAN UNTAGGED3 ===&amp;gt;    &amp;lt;          &amp;gt; &amp;lt;==VLAN UNTAGGED2+3 ==&amp;gt; Client2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11840" LastActivityDate="2016-01-07T17:22:29.203" Title="Unidirectional untagged VLAN into another untagged VLAN" Tags="|vlan|multicast|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14577" PostTypeId="2" ParentId="14570" CreationDate="2014-12-11T17:28:56.813" Score="7" Body="&lt;p&gt;You already know the majority of the answer to your own question - you need to configure commands the user can run at a specific privilege level. &lt;code&gt;enable&lt;/code&gt; without a privilege level argument defaults to privilege level 15, which has permissions to run all commands. The two things you need to do are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Change the default enable password so the user doesn't have access to it anymore and therefore can't get to privilege level 15.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set the user's default privilege level at login to the same privilege level that you've changed the desired commands the user can run at:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Router(config)#username joe privilege &amp;lt;x&amp;gt; password foobar&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where X is the privilege level for your desired command set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I should point out that this doesn't actually provide &lt;em&gt;true&lt;/em&gt; user based command authorization, it only provides &lt;em&gt;privilege level based&lt;/em&gt; authorization, because the commands themselves are only bound to one privilege level at a time, so it's effectively a router-wide change. It's intended to work in a hierarchical fashion; each privilege level can run the commands at that level as well as all levels below it. If you want true user based authorization, you need an AAA server of some kind (see my note below).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could technically also change the privilege level of the &lt;code&gt;enable&lt;/code&gt; command to be one higher than the user's privilege level so they don't even have the option of running it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Router(config)#privilege exec level &amp;lt;x&amp;gt; enable&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This of course assumes that you don't want the user to be able to run any configuration commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to make sure that when the user logs in and types &lt;code&gt;enable&lt;/code&gt; they need to specify their privilege level rather than no privilege level, which defaults to 15.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Router&amp;gt;enable &amp;lt;x&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously you can specify enable passwords for all 16 privilege levels if you so desire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My final point is that without an external AAA server, all of this is a giant pain in the ass. There are a multitude of open source TACACS+ implementations available that only have a cost of initial setup, but they make doing stuff like this somewhat trivial, and it's centralized, so if you have multiple routers you don't have to keep repeating the same command privilege jumprope on every device you manage. This is why AAA servers exist in the first place, so your requirement that you don't want to use one doesn't make a lot of sense.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2014-12-11T21:44:30.563" LastActivityDate="2014-12-11T21:44:30.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14578" PostTypeId="2" ParentId="13262" CreationDate="2014-12-11T17:49:21.727" Score="7" Body="&lt;p&gt;Key to answering your question is making a very important distinction:  Duplicate Address Detection (DAD) and Multicast Listener Discovery (MLD) are completely separate protocols.&lt;/p&gt;&#xA;&lt;p&gt;Now, that said, I think this paragraph of &lt;a href=&quot;https://www.ietf.org/rfc/rfc2710.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC2710&lt;/a&gt; explains the &amp;quot;duplicate&amp;quot; transmission:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When a node starts listening to a multicast address on an interface,&#xA;it should immediately transmit an unsolicited Report for that address&#xA;on that interface, in case it is the first listener on the link.  To&#xA;cover the possibility of the initial Report being lost or damaged, it&#xA;is recommended that it be repeated once or twice after short delays&#xA;[Unsolicited Report Interval].  (A simple way to accomplish this is&#xA;to send the initial Report and then act as if a Multicast-Address-&#xA;Specific Query was received for that address, and set a timer&#xA;appropriately).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3810&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC3810&lt;/a&gt; supersedes RFC2710, but still agrees with the above. &lt;em&gt;(Thanks to  @logion for pointing this out!)&lt;/em&gt;.  I'm leaving the quote from RFC2710 in place because I think it lends itself to be more easily understood without additional context.  In particular, the part of RFC 3810 that confirms the behavior is here:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;To cover the possibility of the State Change Report being missed by&#xA;one or more multicast routers, [Robustness Variable] - 1&#xA;retransmissions are scheduled, through a Retransmission Timer, at&#xA;intervals chosen at random from the range (0, [Unsolicited Report&#xA;Interval]).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Which leaves us to having to discuss DAD, and specifically, why DAD is completely independent from MLD.&lt;/p&gt;&#xA;&lt;p&gt;Before an IPv6 node intends to use an IP address, it must first check if the address in use.  This check is done by sending a Neighbor Solicitation (NS) message to the Solicited Node Multicast (SNM) address of the target IP address.  The SNM is a multicast address that anyone who would own the target IP address would be listening to.&lt;/p&gt;&#xA;&lt;p&gt;The Destination IP of the Neighbor Solicitation packet is &lt;code&gt;FF02::1:FFyy:yyyy&lt;/code&gt; (where &lt;code&gt;yy:yyyy&lt;/code&gt; is the last 24 bits of the target IPv6 address).  And the Source IP is &lt;code&gt;::&lt;/code&gt;, the &amp;quot;unspecified&amp;quot; IPv6 address.  It must use the Unspecified address, to prevent using the target address itself, since it might trigger a duplicate.  At this time, the initial host doesn't know whether the address is unique or not.&lt;/p&gt;&#xA;&lt;p&gt;If another host on the network already owns the target IPv6 address, they would receive the Neighbor Solicitation message described above, and would respond by sending a Neighbor Advertisement (NA) indicating the IP is already in use.&lt;/p&gt;&#xA;&lt;p&gt;Here is the key:  Since the initial NS was sent from the unspecified address (&lt;code&gt;::&lt;/code&gt;), the other host which owns the target IPv6 address will have no way of knowing who to send the responding NA to.  As a result, it must send the result to &lt;code&gt;FF02::1&lt;/code&gt;, the &amp;quot;All Nodes&amp;quot; Multicast address.&lt;/p&gt;&#xA;&lt;p&gt;This is how DAD can still perform, if you are blocking all MLD messages.  Because joining the All Nodes multicast group doesn't require a MLD transaction, all switches that understand IPv6 will automatically forward the &amp;quot;All Nodes&amp;quot; destined frames to all ports in the respective VLAN.  DAD, does not require listening on a particular multicast group to receive notification of an address already in use.&lt;/p&gt;&#xA;&lt;p&gt;If no one claims the IPv6 address, DAD then determines the IPv6 address is unique, and allows the initiating Host to start using the address itself.  This is what prompts the joining of the correlating SNM group for the target address with some MLD messages sent to the MLD multicast address of &lt;code&gt;FF02::16&lt;/code&gt;.  (and according to the RFC above, this message is intended to be sent twice).&lt;/p&gt;&#xA;&lt;p&gt;The windows capture seems to use the Source IP before sending out the Neighbor Advertisement that claims the IP on the network which occurs at the end of DAD.  I can't help but feel this is jumping the gun a little, since the NA is what marks the end of the DAD process, and the confirmation that the address is indeed unique on the network.&lt;/p&gt;&#xA;&lt;p&gt;The linux capture has MLD messages sent before the DAD NS, but these are sent from the unspecified address, so can't cause an IP conflict.  If any MLD Sniffing switches on the network only need to correlate a MAC address to a joined MLD group, then this would work just fine (Disclaimer:  I am not intimately familiar with the intricacies of MLD sniffing, and can not claim whether this is exactly how it works)&lt;/p&gt;&#xA;&lt;p&gt;The BSD capture doesn't include the NA, but the two MLD messages occur .15 seconds after the DAD NS is sent out.  Which to me, seems a bit too short, since the DAD process calls for a wait of just shy of a second before considering an address unique (according to the captures and testing I've done).&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2014-12-12T14:55:22.137" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14580" PostTypeId="2" ParentId="6785" CreationDate="2014-12-11T23:04:52.747" Score="2" Body="&lt;p&gt;Make sure that you do not have the dhcpd deamon running (set system services dhcp). When running dual stack you'll need to be running your internal dhcp through the jdhcpd deamon (system services dhcp-local-server). Its a bit odd, but the dhcpd deamon stomps on the jdhcpd deamon. &lt;/p&gt;&#xA;" OwnerUserId="11847" LastActivityDate="2014-12-11T23:04:52.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14581" PostTypeId="2" ParentId="6938" CreationDate="2014-12-11T23:39:37.980" Score="-3" Body="&lt;p&gt;Just randomly browsing the key terms &quot;Wifi&quot; and &quot;Channel 3&quot;..  it's gonna be different for everyone.  For me, channel 1, 6 and 11 simply do not work.  There's way too much interference and my wireless mouse keeps skipping. My wireless keyboard also lags (A LOT).  I set the router to channel 3 and the internet sped up about 5%, and also the wireless mouse and keyboard stopped lagging/skipping.  &lt;/p&gt;&#xA;" OwnerUserId="11848" LastActivityDate="2014-12-11T23:39:37.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14585" PostTypeId="2" ParentId="14576" CreationDate="2014-12-12T14:08:50.077" Score="1" Body="&lt;p&gt;It seems that the Asymmetric VLAN feature fit my needs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a feature from DLINK switch, it might have another name on other manufacturers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible with this feature to have two untagged VLAN on a single port, and still keep isolation between VLAN. Here is an example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say i have a VLAN 2 with a type A of clients, a VLAN3 with a type B of clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &amp;amp; B clients can't coexist on the same network, and both shares a ressources present on VLAN4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will be able to spread VLAN4 on the port of client A and client B, but client A and B won't be linked with each others, even with untagged network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We could consider that VLAN2 and VLAN3 are contained into the VLAN4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case the multicast is the shared ressources, and i still keep my client network separated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a small documentation from Cisco about the feature : &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/connectedgrid/cgs2520/software/release/15_0_2_ed/configuration/guide/cgs_15_0_2ed/cgs_asym-vlan.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/connectedgrid/cgs2520/software/release/15_0_2_ed/configuration/guide/cgs_15_0_2ed/cgs_asym-vlan.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time.&lt;/p&gt;&#xA;" OwnerUserId="11840" LastEditorUserId="11840" LastEditDate="2014-12-12T15:04:27.543" LastActivityDate="2014-12-12T15:04:27.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14590" PostTypeId="2" ParentId="13487" CreationDate="2014-12-12T21:20:36.970" Score="-3" Body="&lt;p&gt;There is no as such limits for carrying LSA size.&lt;/p&gt;&#xA;" OwnerUserId="11860" LastActivityDate="2014-12-12T21:20:36.970" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14592" PostTypeId="1" CreationDate="2014-12-12T21:31:41.903" Score="3" ViewCount="4836" Body="&lt;p&gt;I have heard a lot of people saying ospf uses a backbone area mechanism to avoid routing loops, yet I always failed to understand where and when ospf produces loops in its topology?&#xA;if anyone can explain this with real lab scenario.. please explain..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have more to discuss on this.&lt;/p&gt;&#xA;" OwnerUserId="11860" LastEditorUserId="2142" LastEditDate="2014-12-13T00:05:26.983" LastActivityDate="2015-03-09T08:00:47.643" Title="How does the backbone area prevent routing loops in ospf?" Tags="|ospf|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14594" PostTypeId="2" ParentId="13558" CreationDate="2014-12-12T23:15:26.837" Score="2" Body="&lt;p&gt;I've seen similar behavior when the Phase 2 SA liftetime settings don't match.  You may want to try matching both your Phase 1 and 2 lifetime settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is your Phase 1 lifetime configuration on the ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  crypto ikev2 policy 2&#xA;  lifetime seconds 3600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is your Phase 1 lifetime configuration with StrongSwan:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ikelifetime = 28800s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ASA Phase 2 lifetime defaults to 28800 seconds.  You can explicitly configure the Phase 2 lifetime globally or on a per crypto map instance.  You can configure the latter as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; crypto map OUTSIDE_map 1 set security-association lifetime seconds 28800&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Phase 2 lifetime configuration with StrongSwan:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; lifetime = 3600s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Try changing the StrongSwan lifetime value to 28800 to match the ASA default value.  &lt;/p&gt;&#xA;" OwnerUserId="2231" LastActivityDate="2014-12-12T23:15:26.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14595" PostTypeId="2" ParentId="14592" CreationDate="2014-12-12T23:58:20.140" Score="3" Body="&lt;p&gt;Imagine a network with three areas: 0, 1 and 2.  Area 0 is connected to 1 and 2; area 1 is connected to 0 and 2; and area 2 is connected to 0 and 1. Further, imagine that in this network, there is nothing special about area 0 -- in this network, backbone rules don't apply. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Area 1 learns about routes from area 2 from two sources:  area 2 and area 0.  Now let's say that because of metrics, the shortest path to area 2 is through area 0 (instead of your direct connection).  Area 0 also learns about area 2 from area 1 and area 2.  But because of misconfigured metrics, the shortest path to area 2 is through area 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you send data from area 1 to area 2, the packets get forwarded to area 0, but area 0 forwards them back to area 1.  This is a classic routing loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, if we make area 0 a backbone, and say areas can only receive routes from the backbone, then there is only one possible path to area 2 -- through the backbone. Area 1 will ignore routes being advertised directly from area 2. In this way there are no multiple paths, and therefore no loops. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-12-13T00:10:58.633" LastActivityDate="2014-12-13T00:10:58.633" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14596" PostTypeId="2" ParentId="14592" CreationDate="2014-12-13T00:23:22.267" Score="-1" Body="&lt;p&gt;I would say traffic passes through backbone area because developer of ospf designed it such a way, they new if they dont bring area 0 it will die.&#xA;It is more like someone asking why 1+1=2?&lt;/p&gt;&#xA;" OwnerUserId="11860" LastEditorUserId="775" LastEditDate="2014-12-13T09:57:10.897" LastActivityDate="2014-12-13T09:57:10.897" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14598" PostTypeId="1" CreationDate="2014-12-13T03:08:36.177" Score="2" ViewCount="662" Body="&lt;p&gt;I'm attempting to set up a Cisco 2504 Wireless Controller for personal use (50+ connections to access point) and I'm having trouble accessing the configuration page.  Before the wireless controller, we had an ASUS router set up and whenever we attempt to access the configuration page of the controller, we see a failed attempt to connect to the configuration page of the ASUS router.&#xA;We've attempted rebooting the router, but we get the same page.&#xA;My thought is that for whatever reason, we're using the wrong ip address to access the GUI.&#xA;Any help is greatly appreciated.  Thanks.&lt;/p&gt;&#xA;" OwnerUserId="11864" LastEditorUserId="775" LastEditDate="2014-12-13T08:04:49.070" LastActivityDate="2014-12-13T08:04:49.070" Title="Cisco 2504 Wireless Controller Setup" Tags="|cisco|wireless|cisco-wireless|access-point|" AnswerCount="0" CommentCount="2" ClosedDate="2019-06-01T00:40:58.200" ContentLicense="CC BY-SA 3.0" />
  <row Id="14602" PostTypeId="1" CreationDate="2014-12-13T11:43:31.110" Score="3" ViewCount="2166" Body="&lt;p&gt;I an trying to configure 2 IPSEC VPSN Tunnels on the Cisco 1941 WAN Port. The tunnel with the higher crypto map sequence pre-empts the lower sequence number so only one tunnel is active at a time. I need both to be active simultaneously. Below is main configs. Parts omitted for brevity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how to get this to work?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)# crypto isakmp policy 1&#xA;R2(config-isakmp)# encr des&#xA;R2(config-isakmp)# hash md5&#xA;R2(config-isakmp)# authentication pre-share&#xA;R2(config-isakmp)# group 1&#xA;R2(config-isakmp)# lifetime 29800&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ex&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)# crypto isakmp key 1234567890 address 192.235.X.X&#xA;R2(config)# crypto isakmp key 1234567 address 65.183.10.90&#xA;&#xA;R2(config)# ip access-list extended VPNTRAFFIC-BDOS&#xA;R2(config-ext-nacl)# permit ip 192.168.0.0 0.0.0.255 192.168.254.0 0.0.0.255&#xA;&#xA;R2(config)# ip access-list extended VPNTRAFFIC-JCA&#xA;R2(config-ext-nacl)# permit ip 192.168.0.0 0.0.0.255 188.155.100.0 0 0.0.0.255&#xA;&#xA;&#xA;&#xA;R2(config)# crypto ipsec transform-set TS-BDOS esp-des esp-md5-hmac &#xA;R2(config)#crypto ipsec transform-set TS-JCA esp-des esp-md5-hmac&#xA;&#xA;&#xA;R2(config)# crypto map CMAP-ROTO 10 ipsec-isakmp&#xA;R2(config)#set pfs group 1&#xA;R2(config-crypto-map)# set peer 192.235.X.X&#xA;R2(config-crypto-map)# set transform-set TS-BDOS&#xA;R2(config-crypto-map)# match address VPNTRAFFIC-BDOS&#xA;R2(config)# crypto map CMAP-ROTO 100  ipsec-isakmp&#xA;R2(config-crypto-map)# set pfs group 1&#xA;R2(config-crypto-map)# set peer 65.183.X&amp;gt;X&#xA;R2(config-crypto-map)# set transform-set TS-JCA&#xA;R2(config-crypto-map)# match address VPNTRAFIC-JCA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11868" LastEditorUserId="775" LastEditDate="2014-12-13T12:12:59.470" LastActivityDate="2017-09-18T18:21:00.757" Title="Multiple IPSec Tunnels on Cisco router's interface" Tags="|cisco|vpn|ipsec|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14603" PostTypeId="1" CreationDate="2014-12-13T13:07:22.763" Score="2" ViewCount="7623" Body="&lt;p&gt;I hope you can offer me some assistance with my case, we have a Cisco router 2800 series ,having the error ( %SYS-2-MALLOCFAIL: Memory allocation),&#xA;(and if restarted the router it works OK for while.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;our admin who is responsible for opening case with TAC contacted them and the answer from them was as follows, but we did not understand it so, can you explain this?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;SHOW PROCESS MEMORY NOTIFICATIONS (if any)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;INFO: The output of 'show process memory' only shows the memory associated with&#xA;the processor and does not identify other memory such as I/O, Fast, VM, etc. To&#xA;receive a statistical analysis on these types of memory, submit the first page of&#xA;output from the 'show memory' and 'show version' commands to Output Interpreter.&#xA;NOTE: The types of memory vary depending on router platform and installed modules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;INFO: Processor memory utilization is 11.22801%.&#xA;INFO: Processor memory or main memory stores the running configuration and routing&#xA;tables. The Cisco IOS software executes from main memory.&#xA;INFO: The amount of processor memory required by the router is affected by the Cisco&#xA;IOS version used, the size of the network and by the access list configurations.&#xA;Ensure that an optimal IOS version has been chosen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;INFO: The top 3 processes that are holding less than 1 MB of memory are:&#xA;  - 'Chunk Manager' is holding 964368 bytes&#xA;  - 'Exec' is holding 337640 bytes&#xA;  - 'LICENSE AGENT' is holding 37592 bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ERROR MESSAGE NOTIFICATIONS (if any)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ERROR: No Error message was found.&#xA;TRY THIS: Ensure that the error message has the following format:&#xA;  %FACILITY-SEVERITY-MNEMONIC:&#xA;Some examples would be:&#xA;  %SYS-2-MALLOCFAIL:&#xA;  %PIX-1-103001:&#xA;Resubmit the output as necessary.&lt;/p&gt;&#xA;" OwnerUserId="10816" LastEditorUserId="775" LastEditDate="2014-12-13T13:18:33.663" LastActivityDate="2014-12-16T06:58:40.597" Title="TAC Response on the error( %SYS-2-MALLOCFAIL: Memory allocation)" Tags="|router|troubleshooting|memory|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14608" PostTypeId="1" AcceptedAnswerId="14612" CreationDate="2014-12-14T01:00:25.843" Score="1" ViewCount="2230" Body="&lt;p&gt;From what I know, routers do not forward packets from/to address of the range 169.254.x.x&#xA;That being said, after exchanging a router &quot;tracert 169.254.0.1&quot; did in fact find a route with 13 hops. I'm not sure what to make of this.&lt;/p&gt;&#xA;" OwnerUserId="11876" LastEditorUserId="775" LastEditDate="2014-12-14T06:35:14.350" LastActivityDate="2022-10-29T08:30:51.220" Title="How is it possible that tracert finds a route to link-local over outside internet?" Tags="|routing|ipv4|ip-link-local|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14609" PostTypeId="2" ParentId="14603" CreationDate="2014-12-14T01:15:26.147" Score="3" Body="&lt;p&gt;The most common reason I've seen for alloc failures has been serious misconfiguration of the default route -- &lt;code&gt;ip route 0.0.0.0 0.0.0.0 f0/0&lt;/code&gt; will cause this because it's &lt;em&gt;proxy-arp&lt;/em&gt;, and the ARP table will grow to an insane size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A distant second place goes to dynamic routing protocols causing severe memory fragmentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We (and TAC) will need &lt;em&gt;a lot&lt;/em&gt; more information to debug this.  The first place I would suggest looking is the output of &lt;em&gt;show memory failures alloc&lt;/em&gt; after failures are happening. (&lt;strong&gt;before rebooting&lt;/strong&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: because memory is relatively cheap (when not bought from Cisco), I tend to load my routers with as much memory as they'll hold.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-14T01:15:26.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14611" PostTypeId="1" AcceptedAnswerId="14613" CreationDate="2014-12-14T03:05:06.883" Score="2" ViewCount="4304" Body="&lt;p&gt;I have a Telecommunications provider installing a router running OSPF v3 in area 0, I want to integrate my switches with it to exchange routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems straightforward however I will be using OSPF for Routed access which I'm not familiar with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know if the below will work?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA; network 1.1.1.0 0.0.0.255 area 0 #Subnet to Router&#xA; network 2.2.2.0 0.0.0.255 area 0 #My Network to advertise&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5120" LastActivityDate="2014-12-14T09:05:31.593" Title="OSPF For Routed Access" Tags="|cisco|ospf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14612" PostTypeId="2" ParentId="14608" CreationDate="2014-12-14T05:57:06.960" Score="5" Body="&lt;p&gt;Your computer is missing a route for 169.254.0.0/16. It's a perfectly legal address range as far as routers are concerned. It's up to the &lt;em&gt;host&lt;/em&gt; to define it as a link-local scope. (or the network admin to null route it, where appropriate.)&lt;/p&gt;&#xA;&lt;p&gt;That said, a &lt;em&gt;modern&lt;/em&gt; router should be aware of &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3927#section-2.7&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;An IPv4 packet whose source and/or destination address is in the 169.254/16 prefix MUST NOT be sent to any router for forwarding, and any network device receiving such a packet MUST NOT forward it, regardless of the TTL in the IPv4 header.&quot;&gt;RFC3927, Section 2.7&lt;/a&gt; and have 169.254/16 as a link-local subnet. Routers must drop any 169.254/16 destination.  However, not all comply.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2014-12-14T06:36:03.857" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14613" PostTypeId="2" ParentId="14611" CreationDate="2014-12-14T09:05:31.593" Score="2" Body="&lt;p&gt;&quot;OSPF for Routed Access&quot; is a Cisco licensing term. It is a normal OSPF implementation, but it's limited by licensing to 1 instance and 200 learned routes (see &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-4500-series-switches/product_bulletin_c25-553133.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;). If you want to run more instances or learn more routes, you need to upgrade to another license (from IP Base to IP Sevices in general).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your config should work, as long as it is OSPF v2 (not v3) and you're not using authentication (which you should consider in my opinion).  &lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2014-12-14T09:05:31.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14618" PostTypeId="1" AcceptedAnswerId="14627" CreationDate="2014-12-14T18:38:46.027" Score="3" ViewCount="4423" Body="&lt;p&gt;A teacher told us about VLSM and &quot;nested subnetting&quot;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you should NOT use all-1 / all-0 subnets&lt;/li&gt;&#xA;&lt;li&gt;the same public network you got, can be split up in subnetworks of different size / having different subnet masks&lt;/li&gt;&#xA;&lt;li&gt;you can nest subnets, so that the same IP actually belongs to 2 subnetworks: in the example below the range of B is from 193.174.26.161 to 190, but C is nested inside from 193.174.26.189 to 193.174.26.190; furthermore B &amp;amp; C are nested in A&lt;/li&gt;&#xA;&lt;li&gt;the aim of this is to waste less IPs&lt;/li&gt;&#xA;&lt;li&gt;it is not supported by routers, but theoretically it would work&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The teacher gave us examples with requirements like these:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you got 193.174.26.0 /24 from your ISP&lt;/li&gt;&#xA;&lt;li&gt;A: 140 hosts&lt;/li&gt;&#xA;&lt;li&gt;B: 20 hosts&lt;/li&gt;&#xA;&lt;li&gt;C: 2 hosts &lt;/li&gt;&#xA;&lt;li&gt;given: C should be nested in B&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;--&gt; using equally sized subnets without nesting will not work&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;┌───────┬──────────────┬──────────┬──────┬──────────┬─────────┬─────────┐&#xA;│network│net address   │last octet│suffix│first host│last host│broadcast│&#xA;├───────┼──────────────┼──────────┼──────┼──────────┼─────────┼─────────┤&#xA;│A      │193.174.26.0  │0000 0000 │/24   │1         │254      │255      │&#xA;├───────┼──────────────┼──────────┼──────┼──────────┼─────────┼─────────┤&#xA;│B      │193.174.26.160│1010 0000 │/27   │161       │190      │191      │&#xA;├───────┼──────────────┼──────────┼──────┼──────────┼─────────┼─────────┤&#xA;│C      │193.174.26.188│1011 1100 │/30   │189       │190      │191      │&#xA;└───────┴──────────────┴──────────┴──────┴──────────┴─────────┴─────────┘&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I had never head about it and could not find very much information, so I have some questions about it:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I think C is an all-1-subnet, am I right?&lt;/li&gt;&#xA;&lt;li&gt;What happens if a router (e.g. the router connecting the local network to the internet) receives a packet with target = 193.174.26.255? How does it decide, whether to route it to all hosts (everyone between 193.174.26.1 and 193.174.26.254, no matter, whether it is in subnet B or C) or just to the hosts, that are directly in network 193.174.26.0 (the root of the nested networks)&lt;/li&gt;&#xA;&lt;li&gt;Who will receive packets addressed to 193.174.26.191? All hosts in B including C or only the hosts in C?  &lt;/li&gt;&#xA;&lt;li&gt;In general, even if you do not use VLSM and nesting, but you ALLOW all-0 / all-1-networks: How do you distinguish between the network / broadcast address of the &quot;super-network&quot; and the sub-network? (following the linked article it should work meanwhile)&lt;/li&gt;&#xA;&lt;li&gt;Does anyone use this technique in real life?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Cisco article about all-1 and all-0 subnets&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13711-40.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13711-40.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11881" LastEditorUserId="8499" LastEditDate="2018-02-15T19:32:42.833" LastActivityDate="2018-02-15T19:32:42.833" Title="subnetting, nested subnetting, VLSM &amp; broadcast addresses" Tags="|ipv4|subnet|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14619" PostTypeId="1" AcceptedAnswerId="14622" CreationDate="2014-12-14T19:58:24.407" Score="2" ViewCount="97369" Body="&lt;p&gt;In setting up a new network switch (Catalyst 2960-S), I did the initial configuration dialog (via the console port), in which it asks for host-name, secret, password, virtual terminal password, and other things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set the enable secret, the enable password, and the virtual terminal password. At no point does it ask for a username. If I exit or let it time out, then I need to get back in, at which point it asks for a username/password. What is this username/password?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the password one of the three mentioned above that it asks me to create during setup? Is it some default value? Is the username something like &quot;cisco&quot; or &quot;admin&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;getting started guide&quot; suggests that the initial web-interface default password is cisco and that it ignores the username field. I tried that.&lt;/p&gt;&#xA;" OwnerUserId="11883" LastActivityDate="2021-05-19T13:06:16.043" Title="Cisco default username" Tags="|cisco|cisco-catalyst|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14620" PostTypeId="2" ParentId="14618" CreationDate="2014-12-14T20:29:46.520" Score="6" Body="&lt;p&gt;Your teacher, unfortunately, has made an error.  You can't &quot;nest&quot; or overlap subnets.  In fact, many routers will not let you configure addresses this way -- they will give you an error because they don't know which interface to use for a given &quot;nested&quot; address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All your questions are good ones -- they point out the problems with trying to overlap subnets and why that won't work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can say that the answer to 5 is No.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-12-14T20:29:46.520" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="14622" PostTypeId="2" ParentId="14619" CreationDate="2014-12-14T22:31:34.933" Score="4" Body="&lt;p&gt;On the Cisco 2960-S, the default credentials are cisco/cisco.  These get deleted after the first time you login to the switch. There shouldn't be any access control on the console, unless the express setup puts it in there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you set the virtual terminal password, then it probably just set a password on the &lt;em&gt;line vty&lt;/em&gt; block, this should let you in with Telnet without needing a username.  Once you get in to the switch with telnet you can run &lt;em&gt;sh run | inc username&lt;/em&gt;.  This will tell you what the username is set as, and probably the password if you don't have the password-encryption service on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this fails to work, then you will have to do a &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps628/products_password_recovery09186a0080094184.shtml&quot; rel=&quot;nofollow&quot;&gt;password recovery&lt;/a&gt; on the switch.&lt;/p&gt;&#xA;" OwnerUserId="5104" LastActivityDate="2014-12-14T22:31:34.933" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14623" PostTypeId="2" ParentId="14603" CreationDate="2014-12-14T22:43:40.670" Score="2" Body="&lt;p&gt;I can tell you the last time I dealt with a MALLOCFAIL was caused by an IOS bug.  I had to upgrade to a later version of IOS.  But, if I recall correctly, that was on one of my 2901s. There are a lot more troubleshooting stops you would have to make before I would try that, though.  If you want to do more troubleshooting try, &lt;em&gt;show tech&lt;/em&gt;, &lt;em&gt;show memory&lt;/em&gt;, and &lt;em&gt;show buffers&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="5104" LastActivityDate="2014-12-14T22:43:40.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14624" PostTypeId="2" ParentId="13563" CreationDate="2014-12-14T22:51:16.780" Score="0" Body="&lt;p&gt;There are a few ways to do this.  Is your switch running layer-3?  If it is, then you can review the arp table on the switch for duplicate entries.  You can also turn on ip tracking on the switch and then go through that data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to enable ip tracking first: &lt;em&gt;ip device tracking&lt;/em&gt;&#xA;You can then use: &lt;em&gt;show ip device tracking all&lt;/em&gt;.  Instead of using all you can enter an interface or an ip address to show these commands.&lt;/p&gt;&#xA;" OwnerUserId="5104" LastActivityDate="2014-12-14T22:51:16.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14626" PostTypeId="2" ParentId="14619" CreationDate="2014-12-15T02:15:41.867" Score="4" Body="&lt;p&gt;Cisco IOS has no default username and/or password.  The admin (or whatever setup wizard used) has to configure authentication to have (and check) user and password. Without a password set on the vty -- or AAA configuration, the only allowed access is via the console. And the console will require no authentication. (that's how you got to the CLI setup in the first place.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CLI &lt;code&gt;setup&lt;/code&gt; does not create users. (unless Cisco changed it in the 15.x line)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-15T02:15:41.867" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14627" PostTypeId="2" ParentId="14618" CreationDate="2014-12-15T02:54:59.627" Score="4" Body="&lt;p&gt;&quot;Nesting&quot; (overlapping networks) requires &lt;em&gt;proxy-arp&lt;/em&gt; and therefore SHOULD be avoided at all costs. No enterprise router will allow such a broken configuration -- each interface/subnet must be completely independent, which means out in the real world, where &lt;em&gt;real&lt;/em&gt; IP addresses are routed, this method of &quot;&lt;em&gt;conservation&lt;/em&gt;&quot; cannot be used. (aka: nonsense) &lt;sup&gt;[*]&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It SHOULD not be attempted by anyone not thoroughly versed in networking. (i.e. if you haven't been designing, setting up, and maintaining large, complex networks for a decade or more, you shouldn't even be talking about this type of damage.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;(Full disclosure)&lt;/strong&gt;&lt;br/&gt;&#xA;I'm doing this exact thing in an OpenStack development environment right now. 192.168.xx.0/24 has a /29 behind one of the machines in the larger /24. That machine has to have a number of specific, non-default setting changed to &lt;em&gt;pretend&lt;/em&gt; to be hosts within the /29 slice. (aka &lt;em&gt;proxy-arp&lt;/em&gt;) Yes, I can add a route for the /29 on the router, but the machines in the /24 still won't be able to talk to the /29 because their larger netmask means they're link-local; I'd have to add that /29 route to all the machines in the /24 for them to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;All-0 and All-1&lt;/strong&gt;&lt;br/&gt;&#xA;Those concepts haven't had any tangible meaning in modern networking for decades. Nothing you're likely to run into on the internet makes any assumptions about network size -- everything is &lt;em&gt;classless&lt;/em&gt; now. Yes, there &lt;em&gt;used&lt;/em&gt; to be issues using an all-0 (or 1) subnet -- say 199.72.0.0/24 (the first subnet from 199.72.0.0/16) &lt;sup&gt;(true story)&lt;/sup&gt; -- because some random system on the internet (AIX) applied class logic to the range. Nothing does that today. So, with 199.72.0.0/16, the address range is 0.0 to 255.255 -- with the those too addresses being the /16's &lt;em&gt;network&lt;/em&gt; and &lt;em&gt;broadcast&lt;/em&gt; addresses. Those are &lt;em&gt;always&lt;/em&gt; the /16's network and broadcast, even if a /24 were nested with it somewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The active netmask ALWAYS defines the network and broadcast. Yes, that means a nested construct has multiple broadcast addresses, but due to different netmasks, nodes within different zones (sub-network, parent-network, ...) listen to different addresses. At layer-2 (ethernet), all hosts in the same domain (eg. vlan) see the same broadcasts but the host will filter out, at layer-3, the &quot;foreign&quot; broadcasts, unless they're sent to the &quot;all nodes&quot; broadcast address of 255.255.255.255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;[*] ISPs wanting to conserve space like this do it via &lt;em&gt;bridging&lt;/em&gt;, but that has it's own problems.&lt;/sup&gt;&lt;br/&gt;&#xA;&lt;sup&gt;[*] I warned my idiot (&quot;we know more than you&quot;) coworkers not to use 199.72.0.0/24, but they did it anyway -- putting the webdev desktops in 0.0/25. A day later came the &quot;&lt;em&gt;What. Did. I. Tell. You.&lt;/em&gt;&quot; after complaints from every single person about random places on the internet they simply couldn't get. That was in 1997.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-12-16T22:59:53.617" LastActivityDate="2014-12-16T22:59:53.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14630" PostTypeId="1" AcceptedAnswerId="14632" CreationDate="2014-12-15T07:22:28.927" Score="6" ViewCount="2179" Body="&lt;p&gt;I'm developing a &lt;code&gt;SNMP&lt;/code&gt; Monitor for my company. I've done it before, and that is why I'm not sure why I have the behavior, and because I'm not a network engineer, I'm not a 100% sure where to go and trouble shoot the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm requesting &lt;code&gt;OID&lt;/code&gt; 1.3.6.1.2.1.2.2.1.10 (In Octets for an interface) and I receive a value. However, If I request it again 5 seconds later, I get exactly the same value, but 5 seconds later there is movement. If I request it every 10 seconds, there is movement all the time. (I do request the Out Octets as well, and experience the same behavior)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I log on to the router and I run &lt;code&gt;sh int fastEthernet 0/0/0&lt;/code&gt; the input bytes changes the whole time like I expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At my previous company I did a similar monitor, and I requested the value every 2 seconds, and it worked fine. Unfortunately I cannot remember the series of the Cisco routers there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running Wireshark I see the requests and responses, and the response from the router definitely returns the same value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 3 questions regarding this.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there a setting or configuration that I can set? &lt;/li&gt;&#xA;&lt;li&gt;Will it be better to use traps instead of query?&lt;/li&gt;&#xA;&lt;li&gt;Is this native to the 1900 series to only update the SNMP agent (forgive me if this is the wrong terminology) like it is doing at the moment.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any help in any direction will be appreciated. If there is any information that you need that I might have left out, please ask. Like I said, I'm not a network engineer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="11889" LastEditorUserId="775" LastEditDate="2014-12-15T10:18:01.577" LastActivityDate="2014-12-15T10:18:01.577" Title="SNMP IF-MIB stats export interval in Cisco IOS" Tags="|cisco|router|snmp|management|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14631" PostTypeId="2" ParentId="12455" CreationDate="2014-12-15T08:39:23.373" Score="1" Body="&lt;p&gt;If you want to go with static IP addresses then you can specify the dhcp-server by name against each lease.  As user3799089 pointed out, the latest RouterOS supports this, you may need to upgrade if the option doesn't exist.  I'm running 6.23.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example from my config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ip dhcp-server&#xA;add address-pool=lan_pool disabled=no interface=LAN-bridge lease-time=3d name=lan&#xA;add address-pool=other_pool disabled=no interface=DMZ-bridge lease-time=3d name=DMZ&#xA;/ip dhcp-server lease&#xA;add address=192.168.0.254 client-id=1:0:c:29:ef:**:** mac-address=00:0C:29:EF:**:** server=lan&#xA;/ip pool&#xA;add name=lan_pool ranges=192.168.0.100-192.168.0.199&#xA;add address=192.168.1.254 client-id=1:0:c:29:ef:**:** mac-address=00:0C:29:EF:**:** server=DMZ&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MAC address has been partially obscured with **.&lt;/p&gt;&#xA;" OwnerUserId="11890" LastActivityDate="2014-12-15T08:39:23.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14632" PostTypeId="2" ParentId="14630" CreationDate="2014-12-15T09:46:01.440" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Is this native to the 1900 series to only update the SNMP agent (forgive me if this is the wrong terminology) like it is doing at the moment.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What you're seeing is expected behavior.  IOS has cached &lt;code&gt;IF-MIB&lt;/code&gt; statistics for on 10-second intervals (by default) for a while, for instance see this entry in the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/9226-mibs-9226.html#q20b&quot; rel=&quot;noreferrer&quot;&gt;SNMP FAQ&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, I have a few switches which seem to defy this &quot;typical&quot; 10-second SNMP stats export interval.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Is there a setting or configuration that I can set?&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_r1.html#wp1067159&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;service counters max age [age-in-seconds]&lt;/code&gt;&lt;/a&gt;; this command will show up in the running configuration; however, it's not available in older versions of IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also change the IF-MIB 64-bit counters to update interval with this hidden command: &lt;code&gt;snmp-server hc poll [interval]&lt;/code&gt;, where the interval is measured in hundredths of seconds; however, this command will not show up in the running configuration.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Will it be better to use traps instead of query?&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It won't matter whether you push or pull, unless your platform exports the stats quickly enough.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-12-15T09:46:01.440" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14639" PostTypeId="1" AcceptedAnswerId="14642" CreationDate="2014-12-15T15:58:09.993" Score="5" ViewCount="2130" Body="&lt;p&gt;I am trying to understand BGP and looking glass server concepts. The IP address of &lt;strong&gt;stackexchange&lt;/strong&gt; is &lt;code&gt;198.252.206.140&lt;/code&gt;. Now, I use the looking glass server from &lt;a href=&quot;http://lg.bt.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I selected &lt;em&gt;BGP network&lt;/em&gt; and clicked on &lt;strong&gt;submit&lt;/strong&gt; button.&lt;/li&gt;&#xA;&lt;li&gt;I give the starting location of the looking glass server as Australia and try to trace the traffic till &lt;strong&gt;stackexchange&lt;/strong&gt;. So, I give the IP address as &lt;code&gt;198.252.206.140&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, this is the output I get. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BGP routing table entry for 198.252.206.0/24, version 315807603&#xA;Paths: (4 available, best #3, table default)&#xA;  Advertised to update-groups:&#xA;     15     19    &#xA;  4637 174 25791, (aggregated by 25791 198.252.206.3)&#xA;    134.159.98.29 (metric 693) from 195.206.69.80 (195.206.69.80)&#xA;      Origin IGP, metric 0, localpref 90, valid, confed-internal, atomic-aggregate&#xA;      Community: 3300:4 3300:1804 3300:1999 3300:3070 3300:3071&#xA;  4637 174 25791, (aggregated by 25791 198.252.206.3)&#xA;    134.159.208.153 (metric 693) from 195.206.69.81 (195.206.69.81)&#xA;      Origin IGP, metric 0, localpref 90, valid, confed-internal, atomic-aggregate&#xA;      Community: 3300:4 3300:1804 3300:1999 3300:3070 3300:3071&#xA;  4637 174 25791, (aggregated by 25791 198.252.206.3)&#xA;    134.159.188.77 from 134.159.188.77 (202.84.219.195)&#xA;      Origin IGP, localpref 90, valid, external, atomic-aggregate, best&#xA;      Community: 3300:4 3300:1804 3300:1999 3300:3070 3300:3071&#xA;  4637 174 25791, (aggregated by 25791 198.252.206.3), (received-only)&#xA;    134.159.188.77 from 134.159.188.77 (202.84.219.195)&#xA;      Origin IGP, localpref 100, valid, external, atomic-aggregate  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I understand currently, the numbers 4637, 174 and 25791 are the as numbers of the route. Also, as per the output, I get 4 paths and the best path is &lt;strong&gt;#3&lt;/strong&gt;. So what is that I have to look in this output to see why #3 is the best path or route? Or in other words, how to decipher this output from the looking glass server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went through &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1056/route-servers-and-looking-glasses-what-are-they&quot;&gt;this&lt;/a&gt; question which helped me understand the concepts. But am still looking for a way to decipher the output from the looking glass server. &lt;/p&gt;&#xA;" OwnerUserId="11896" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2022-11-22T14:44:29.843" Title="How looking glass server output should be decoded?" Tags="|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14640" PostTypeId="1" AcceptedAnswerId="49624" CreationDate="2014-12-15T16:46:10.233" Score="5" ViewCount="1055" Body="&lt;p&gt;I have two L2L VPNs connected to a central ASA.  I want these VPNs to communicate with each other but there are some caveats i'm having issues with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the first VPN (VPN1), everything is working fine.  This is a more &quot;traditional&quot; IPSEC VPN, with limited to no NAT.  That is to say that everything communicates via real addresses and traffic is routed through the use of an interesting ACL.  There are no problems here: HQ and VPN traffic move just fine to one another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the second VPN (VPN2), a newly provisioned link, I want clients on VPN2 to communicate with a server at VPN1.  The challenge is that VPN2 uses IP space that overlaps with VPN1 and with the headquarters ASA that both of these VPNs connect to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want VPN2's traffic, all of it, to PAT to a single address.  Headquarters should see this traffic as the PAT'd address and should never see the real addresses.  In an ideal world, this PAT would be handled on VPN2 so that HQ doesn't need to know any details or manage any specifics.  From HQ's perspective, and from VPN1's perspective, all traffic is simply sourced from an address that is in the interesting traffic ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, once the PAT traffic hits HQ, another NAT needs to take place.  This time, HQ needs to NAT, on a 1:1 basis, traffic going to servers in a &quot;hidden&quot; subnet.  HQ exposes a subnet (which is in the interesting traffic ACL of VPN2's ASA, and thus encrypted via ipsec).  The logical way you would do this on today's ASA code is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network foo&#xA; nat (outside,outside) static foo.bar.baz.bang&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't seem to get a configuration with the following characteristics to work:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;HQ ASA: Twice NAT with the source being the PAT address of VPN2 and the destination being the hidden and real subnets of VPN1&lt;/li&gt;&#xA;&lt;li&gt;HQ ASA: Simple NAT (with only the straight exposed &quot;hidden&quot; subnet)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'd like to figure out what the right configuration model is to achieve this.  Ideally, my requirements would be that VPN2 only shows up to me as a PAT (and it should be handled on their end), and HQ ASA handles the NAT for traffic from VPN2 to VPN1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;HQ talks to VPN1 normally (10.4.0.0-&gt;10.5.0.0)&lt;/li&gt;&#xA;&lt;li&gt;I want clients at VPN2 to talk to servers behind VPN1 (192.168.1.1-&gt;192.168.200.1)&lt;/li&gt;&#xA;&lt;li&gt;I want HQ to NAT VPN1's &quot;real addresses&quot; to a &quot;hidden subnet&quot; for VPN2 (192.168.200.0-&gt;10.5.0.0)&lt;/li&gt;&#xA;&lt;li&gt;I want VPN2's clients to be seen as a single address (PAT) (10.4.0.0-&gt;192.168.1.1)&lt;/li&gt;&#xA;&lt;li&gt;Ideally VPN2 would do its own PAT before the traffic ever gets to me (10.4.0.0-&gt;192.168.1.1)&lt;/li&gt;&#xA;&lt;li&gt;The interesting traffic ACLs are all correct&lt;/li&gt;&#xA;&lt;li&gt;All devices are running 8.4+ (some 9.x+)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;                                        +----+        &#xA;                                        |SRV |       &#xA;                 Outside +--------+     +----+        &#xA;                +--------&gt;  FW1   +-----+             &#xA;                |        +--------+ Inside            &#xA;                |                           &#xA;                |                                     &#xA;+----+          |                            +-------+&#xA;| HQ |  outside |                            |Client1|&#xA;|----+----------+        +--------+          +-------+&#xA;                  |        |  FW2   |          |        &#xA;                  +--------+--------+-----------&gt;       &#xA;                   Outside                     |        &#xA;                                               +-------+&#xA;                                               |Client2|&#xA;                                               +-------+&#xA;                                                        &#xA;&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="43" LastEditorUserId="43" LastEditDate="2015-01-05T17:48:06.427" LastActivityDate="2018-06-02T14:58:43.537" Title="ASA spoke-to-spoke with NAT 9.1" Tags="|cisco-asa|firewall|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14642" PostTypeId="2" ParentId="14639" CreationDate="2014-12-15T17:55:02.313" Score="5" Body="&lt;p&gt;The 4637, 174 and 25791 are numbers of &lt;a href=&quot;http://en.wikipedia.org/wiki/Autonomous_System_%28Internet%29&quot; rel=&quot;nofollow noreferrer&quot;&gt;Autonomous Systems &lt;/a&gt; that packet must pass in order to achieve a target 198.252.206.140.&lt;/p&gt;&#xA;&lt;p&gt;BGP uses several attributes to decide the best path. In fact there are 10 main attributes which are browses sequentially. That's called path selection.&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5HRBc.png&quot; alt=&quot;BGP Path selection&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Image Source: &lt;a href=&quot;https://packetlife.net/media/library/1/BGP.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP Cheat Sheet by Jeremy Stretch&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;When all attributes for different paths are the same. &lt;strong&gt;As in your case&lt;/strong&gt;. The path with &lt;strong&gt;lowest Router ID&lt;/strong&gt; (tenth attribute) will be selected as &lt;strong&gt;best&lt;/strong&gt;. That's the reason why path #3 is the best. [&lt;strong&gt;I overlooked the 'IGP cost' the eighth attribute, please see it in below comments.&lt;/strong&gt;]&lt;/p&gt;&#xA;&lt;p&gt;In case that some path to destination network will have just one more &lt;strong&gt;preferred attribute&lt;/strong&gt; and other attributes will be same (for example highest 'local preference' than other path has). The router will choose that path as the best. But be &lt;strong&gt;aware&lt;/strong&gt; other attributes of the above 'local preference' will have to be &lt;strong&gt;same&lt;/strong&gt; for each path. In our example each router will has to have the same &lt;strong&gt;weight&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;By the way...&lt;/em&gt;&#xA;You may ask why the the fourth path &lt;strong&gt;form your routing table entry&lt;/strong&gt; is not the best because of his &lt;strong&gt;highest local preference&lt;/strong&gt; (100 others has 90 localpref). But the Fourth path has in parentheses 'received-only', that means that the route has only been received, but not entered in the routing table (inbound soft reconfiguration).&lt;/p&gt;&#xA;&lt;p&gt;I hope that's what you wanted to explain.&lt;/p&gt;&#xA;&lt;p&gt;Daniel&lt;/p&gt;&#xA;" OwnerUserId="10520" LastEditorUserId="47657" LastEditDate="2022-11-22T14:44:29.843" LastActivityDate="2022-11-22T14:44:29.843" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="14646" PostTypeId="1" AcceptedAnswerId="14647" CreationDate="2014-12-16T05:20:47.050" Score="3" ViewCount="420" Body="&lt;p&gt;I Hope I'm at the right place. I am trying to figure out why RJ45 jacks and plugs require 2 incoming wires and 2 outgoing wires to work. Why is just 1 incoming and 1 outgoing not enough? IS there a bandwidth limit on 24 gauge wire? I also just read this on Wikipedia &quot; The cable standard provides performance of up to 100 MHz and is suitable for 10BASE-T, 100BASE-TX (Fast Ethernet), and 1000BASE-T (Gigabit Ethernet)&quot;. If cat 5 supports gigabit, then why is Google fiber such a big deal and why don't we already have gigabit nation wide in the US?&lt;/p&gt;&#xA;" OwnerUserId="11905" LastEditorUserId="8499" LastEditDate="2018-03-20T23:32:30.330" LastActivityDate="2018-03-20T23:32:30.330" Title="Why Do RJ45 jacks/plugs require multiple incoming and outgoing wires to work?" Tags="|ethernet|layer1|cabling|cable|utp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14647" PostTypeId="2" ParentId="14646" CreationDate="2014-12-16T05:54:10.630" Score="4" Body="&lt;p&gt;Continue reading. Ethernet uses a &quot;balanced pair&quot; for TX/RX. So there's a positive and a negative lead. 10/100 only needs two pairs (one TX and one RX); gigabit needs all four.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiber is far superior to copper in both noise immunity, and transmit distance. The maximum distance for twisted pair is 100m -- and all too often many network cards and cheap switches have insufficient power to drive the full length. Vs. multi-mode fiber going 500m, and single-mode fiber spans of 80+km. (120km is possible.) Plus, since photons don't interfere with each other, one can (and xPON does) use a single fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&quot;Gigabit Nation&quot;&amp;trade;&lt;/strong&gt;&lt;br/&gt;&#xA;The lack of a &quot;gigabit nation&quot; in the US is mostly a function of the market. There's very little monetary drive to build such networks. The copper phone line across the country can only get you so far -- and they aren't going anywhere trying to push ethernet ('tho there is a Long Reach Ethernet standard.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AT&amp;amp;T's Uverse DSL network is a great example of how poorly thin copper wires are for high speed data -- a VRAD (fiber node) has to be within ~4k wire-ft of the customer and then they may still need &lt;em&gt;two&lt;/em&gt; pairs. They aren't stringing fiber everywhere simply due to cost -- instead, continuing to milk all the copper they already have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Verizon FiOS is an example of the opposite. They've spent billions running fiber. And where they ran fiber, they've been known to rip out the copper. Firstly, copper is a valuable metal. Lastly, they aren't required to &lt;em&gt;share&lt;/em&gt; their fiber like they are copper (aka &quot;open access&quot;.) That, btw, was the concession to get them to do this in the first place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google, Inc. has money to burn. (apparently) It's great advertising. And it does promote competition and innovation.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2014-12-16T06:08:06.517" LastActivityDate="2014-12-16T06:08:06.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14648" PostTypeId="2" ParentId="14603" CreationDate="2014-12-16T06:58:40.597" Score="0" Body="&lt;p&gt;There are many reasons for such errors, and it may affect processor and I/O memory pools so the first step is to identify the affected pool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mallocs maybe due to a memory leak caused by a sw bug or misconfiguration, memory lack due to overwhelming the router with features and services or memory fragmentation which may also be caused by a bug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order for TAC to troubleshoot more details are needed and you'd probably need to take several iterations of &quot;show proc mem sorted, show memory stat, etc..&quot; and depending on the scenario it may be over a period of days. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I always keep the below document around for such cases :)&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-151m-t/116467-technote-ios-00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-151m-t/116467-technote-ios-00.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11906" LastActivityDate="2014-12-16T06:58:40.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14649" PostTypeId="1" AcceptedAnswerId="14654" CreationDate="2014-12-16T12:08:03.600" Score="-2" ViewCount="419" Body="&lt;ol&gt;&#xA;&lt;li&gt;how to configure switch to do tagging and untagging of VLAN's?&lt;/li&gt;&#xA;&lt;li&gt;what do the different 802.1q VLAN tag mode: bypass C-TAG, port isolation and .1q mean?&lt;/li&gt;&#xA;&lt;li&gt;explain how will the VLAN's be tagged or untagged in the following scenario:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;User---L2Switch1---L2switch2----router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;both for traffic coming to and going from user?&#xA;4. if the frames are tagged once by switch1, will the switch2 again tag them? if not why and how does it happen?&lt;/p&gt;&#xA;" OwnerUserId="11909" LastActivityDate="2014-12-16T13:53:01.270" Title="Layer 2 switch and VLAN" Tags="|switch|vlan|layer2|" AnswerCount="1" CommentCount="2" ClosedDate="2019-06-01T00:46:02.120" ContentLicense="CC BY-SA 3.0" />
  <row Id="14654" PostTypeId="2" ParentId="14649" CreationDate="2014-12-16T13:53:01.270" Score="0" Body="&lt;p&gt;1) without knowing exactly branch and model of the switch, i cant help you, because theres a lot of ways to do this!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) &#xA;      a) Bypass C-TAG is a term that only applies to your switch&#xA;      b) Port Isolation o Private VLAN is a technique to applies to a given switch port, in wich that port can only comunicate with a single &quot;uplink&quot;.&#xA;      c) 1q, or dot1q or 802.1q is the tagging protocol that makes real the vlans, wich means a 1q port is a port wich is part of a vlan, and can be tag or untagged, but mostly reffers to a tag port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A workstation initiate traffic and send it to Switch 1. From the workstation, no packet is tagged in any way. Suppose the workstation is in VLAN 10 and that VLAN dont is default VLAN.&#xA;Switch 1 receive traffic and decide to send to switch 2, and insert the dot1q tag to the frame, indicates that frame belong to VLAN 10.&#xA;Switch 2 receives the Packet and if the port have various vlans (like cisco trunk o tag port with multiple vlans), then read the frame and then send it to the router in wich case this last port, must be a trunk (cisco) or tag port.&#xA;The Router receives the frame, read the frame and send it to another interface o subinterface depending the destiny of the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later, the router receives the repply, and add the tag (VLAN10) to the frame, and send it to switch 2.&#xA;Switch 2, reads the frame, and send to switch, without removing the tag.&#xA;Switch1 receives the frame, remove the tag and send to the workstation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the frame have the tag, and need to send it to another switch trough a trunk port or tag port, then do not remove the tag, just read it and send the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hope helps! :)&lt;/p&gt;&#xA;" OwnerUserId="10098" LastActivityDate="2014-12-16T13:53:01.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14655" PostTypeId="2" ParentId="9808" CreationDate="2014-12-16T14:22:27.113" Score="4" Body="&lt;p&gt;After having been through this process for a for a few clients now I would generally start with ensuring that you have implemented at least the following controls - note that none of these are specific to SOX, as route/switch/transport doesn't generally play a role in financial reporting aside from a pure availability standpoint:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All changes to the network are performed by authorised individuals (e.g.: RADIUS/TACACS backed accounts for any super-user access)&lt;/li&gt;&#xA;&lt;li&gt;All changes to the network are reviewed by authorised individuals (e.g.: there is some formalised method of change management, including perhaps an audit trail in the form of helpdesk tickets, change forms etc.)   &lt;/li&gt;&#xA;&lt;li&gt;An audit trail exists for providing super-user access and any changes to it (e.g.: logging on your directory server of choice that shows user/role assignment and who performed it)&lt;/li&gt;&#xA;&lt;li&gt;An audit trail exists for any changes that are made and who made them (e.g.: version control of network configurations, syslog recording of logins and interactive commands)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To answer your question regarding your Architect resource having access to the production network, I would not see this as being dictated by SOX requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, from a security standpoint the Principle of Least Privilege would probably apply and thus a read-only account may be more appropriate.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2014-12-16T14:22:27.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14657" PostTypeId="1" CreationDate="2014-12-16T14:57:24.220" Score="3" ViewCount="527" Body="&lt;p&gt;I have a little question and I did not find any direct answer on the WWW. So maybe someone else in this forum has the answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two Cisco 2960X switches running in a stack with the &lt;code&gt;sdm prefer lanbase-routing&lt;/code&gt; template. I route the traffic over these two switches between two subnets. In the official Cisco manual, they are talking about IPv4 unicast routing in relation to the &lt;code&gt;sdm prefer lanbase-routing&lt;/code&gt; template. We are also running a Microsoft Software Deployment in one of these subnets, using multicast to server multiple clients at the same time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my question: Is it possible to forward the multicast traffic of these software deployment tools over my stacked switches with the IPv4 unicast routing to the other subnet? &lt;/p&gt;&#xA;" OwnerUserId="10260" LastEditorUserId="8499" LastEditDate="2018-03-19T19:41:45.903" LastActivityDate="2018-09-13T11:01:14.940" Title="Multicast over Unicast IPv4 Routing" Tags="|cisco|routing|ipv4|cisco-catalyst|multicast|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14658" PostTypeId="1" AcceptedAnswerId="14660" CreationDate="2014-12-16T16:06:52.403" Score="3" ViewCount="99" Body="&lt;p&gt;I am attempting to get an embedded board working that using TCP/IP and UDP/IP. I have it working so that I can issue HTTP POST and GET commands and UDP works fine but am struggling with SNTP, so I have bought a managed switch so I can mirror what my embedded board is sending out and try to track NTP packets in and out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following set-up:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Embedded board 192.168.0.200&#xA;Desktop running Apache server on Linux: 192.168.0.65 (Also sends receives custom UDP packets). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using a normal switch the embedded board can GET and POST with the Apache server just fine and Wireshark, running on 192.168.0.65 can capture the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I connect up the Linux machine and the embedded board to the managed switch, the GET and POST stops working. The ACK of the SYN,SYN-ACK,ACK doesn't work properly and the whole system fails to POST and GET correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the embedded board connected to port 2 and the desktop to port 5. I have selected, on the switch management web page that the &lt;em&gt;mirroring&lt;/em&gt; port is port 5 and &lt;em&gt;mirrored&lt;/em&gt; port 2, with port 2 ingress and egress enabled. I've tried that the other way round too, so that mirroring port is port 2 and mirrored is port 5. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the first time I've ever used a managed switch so I'm probably doing something incredibly naive or stupid. Is this enough information to help advise me what I might be doing wrong? If not, I will supply any info that would help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/L9Alk.jpg&quot; alt=&quot;Here&amp;#39;s a JPEG of the set-up using the web interface for the switch&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="11914" LastEditorUserId="11914" LastEditDate="2014-12-16T16:19:55.753" LastActivityDate="2014-12-16T16:45:22.917" Title="Managed switch stopping my system working" Tags="|switch|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14660" PostTypeId="2" ParentId="14658" CreationDate="2014-12-16T16:35:39.917" Score="4" Body="&lt;p&gt;EDITED&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes you need a third machine.  The port that receives the mirrored traffic can't receive regular traffic.  That's why things aren't working.  If you have a second interface on your desktop, you could possibly use that and bind Wireshark to that interface.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2014-12-16T16:45:22.917" LastActivityDate="2014-12-16T16:45:22.917" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14662" PostTypeId="1" AcceptedAnswerId="14668" CreationDate="2014-12-16T17:37:41.613" Score="4" ViewCount="205" Body="&lt;p&gt;Cisco IOS 12.4T and later: &lt;code&gt;show ip ospf rib&lt;/code&gt; informs about the cost for each network learned by OSPFv2. What command does the equivalent for OSPFv3?&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2014-12-16T19:44:12.353" Title="Cisco IOS: OSPFv3 route cost" Tags="|cisco-ios|ospf|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14667" PostTypeId="2" ParentId="12531" CreationDate="2014-12-16T19:30:24.493" Score="4" Body="&lt;p&gt;Got a &lt;a href=&quot;https://supportforums.cisco.com/discussion/12373291/remote-vpn-users-cannot-access-site-site-tunnel&quot; rel=&quot;nofollow&quot;&gt;response on the cisco forums&lt;/a&gt; that solved my problem.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;you are missing NAT exempt from the IP local pool to the destination of the site to site:&#xA;&#xA;access-list NAT_EXEMPT permit ip 10.0.0.0 255.255.255.0 172.17.0.0 255.255.0.0&#xA;&#xA;NAT (outside) 0 access-list NAT_EXEMPT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="9928" LastActivityDate="2014-12-16T19:30:24.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14668" PostTypeId="2" ParentId="14662" CreationDate="2014-12-16T19:44:12.353" Score="8" Body="&lt;p&gt;I believe you are looking for &lt;code&gt;show ipv6 ospf rib&lt;/code&gt;. Almost all &lt;code&gt;show ip *&lt;/code&gt; commands have a &lt;code&gt;show ipv6&lt;/code&gt; equivalent.&lt;/p&gt;&#xA;" OwnerUserId="10323" LastActivityDate="2014-12-16T19:44:12.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14670" PostTypeId="1" AcceptedAnswerId="43223" CreationDate="2014-12-17T03:04:23.607" Score="3" ViewCount="2709" Body="&lt;p&gt;&lt;strong&gt;IMPORTANT UPDATE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have worked out that the PE is in fact forwarding the updates to the route reflector. The issue seems to be to do with what rd I am looking at. You see part of this scenario was to do a rewrite of the rt and rd at the change of AS. The rt rewrite is in fact working. Being translated from 2203:3000 to 46202:3000. The faulty assumption that I made was that the rd would also be translated. This is not happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my problem is now not so much redistribution of routes, as this is working, but translation of the rd. I can't for the life of me work out how to do this on cisco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taken from a wireshark capture of the BGP updates:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Community Transitive Two-Octet AS Route Target: 46202:3000&#xA;Label Stack=16 (bottom) RD=2203:3000, IPv4=10.0.0.1/32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update on this first issue:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The commands to do this are missing from any IOS release other than on XE (and maybe XR, I don't have access to an XR device).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From one of our production BRAS's:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-route-map)#set extcommunity ?&#xA;  cost               Cost extended community&#xA;  rt                 Route Target extended community&#xA;  soo                Site-of-Origin extended community&#xA;  vpn-distinguisher  VPN Distinguisher&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That last line doesn't exist on IOS ver 15, which is what I am running on my lab environment. So for the mean time that is as far as I can go with that part of the scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;End of update on that issue&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So on top of this issue I have also found another one to do with MPLS PHP. From the PE going to the external AS it is popping off all labels and thus making it so it doesn't work at all. So the other AS receives a packet with no labels at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All packets from inside my AS are destined for the other AS next hop IP of 34.20.43.11:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE-4#show mpls forwarding-table&#xA;Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop&#xA;Label      Label      or Tunnel Id     Switched      interface&#xA;16         Pop Label  34.20.43.11/32   0             Gi0/0      34.20.43.11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see it pops the label when it shouldn't as the other AS is expecting a label of 16:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LinkedISP#show mpls forwarding-table&#xA;Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop&#xA;Label      Label      or Tunnel Id     Switched      interface&#xA;16         Pop Label  10.0.0.1/32[V]   0             aggregate/CUSTOMER_3000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also not sure about how to solve this. Turning off PHP for a next hop doesn't seem to be able to be done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any thoughts on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Original Post + Asked for Show commands:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am labbing up a scenario where we would peer with another service provider that is in a location that our service provider isn't. For example another country. My plan is to peer with that SP and exchange vpnv4 extended communities so that our customers can access their sites that are off that SP's network over a L3VPN. The basic premise is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Customer&amp;lt;-into a L3VPN-&gt;Our MPLS network&amp;lt;-&gt;Peering with other SP&amp;lt;-&gt;their MPLS network&amp;lt;-Out of L3VPN-&gt;Customer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured it all up and I am successfully exchanging the communities over eBGP. The issue I have that I have been so far unable to solve is that for some reason the cisco routers are not re-advertising the externally learnt vpnv4 routes over the internal vpnv4 BGP sessions. Outputs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE-4#show ip bgp vpnv4 rd 46202:3000&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;Route Distinguisher: 46202:3000 (default for vrf CUSTOMER_3000_Mapped)&#xA;*&amp;gt; 10.0.0.1/32      34.20.43.11              0             0 2203 ?&#xA;*&amp;gt; 10.0.0.3/32      0.0.0.0                  0         32768 ?&#xA;* i10.0.0.200/32    115.40.0.130             0    100      0 ?&#xA;*&amp;gt;i                 115.40.0.130             0    100      0 ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see the route being received from the other service provider (AS2203) and is also inserted into the routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE-4#show ip route vrf CUSTOMER_3000_Mapped&#xA;      10.0.0.0/32 is subnetted, 3 subnets&#xA;B        10.0.0.1 [20/0] via 34.20.43.11, 00:58:11&#xA;C        10.0.0.3 is directly connected, Loopback3001&#xA;B        10.0.0.200 [200/0] via 115.40.0.130, 00:58:11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is also successfully receiving routes from the route reflector (10.0.0.200 route).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The route reflector is not being given the routes from the other service provider.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RR1#show ip bgp vpnv4 rd 46202:3000&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;Route Distinguisher: 46202:3000&#xA;*&amp;gt;i10.0.0.3/32      115.40.0.131             0    100      0 ?&#xA;*&amp;gt;i10.0.0.200/32    115.40.0.130             0    100      0 ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm at a loss as to why the external vpnv4 routes are not redistributed internally. Below are the relevant configs. Thank you in advance for any help!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE-4#&#xA;vrf definition CUSTOMER_3000_Mapped&#xA; rd 46202:3000&#xA; !&#xA; address-family ipv4&#xA;  route-target export 46202:3000&#xA;  route-target import 46202:3000&#xA; exit-address-family&#xA;!&#xA;interface Loopback3001&#xA; vrf forwarding CUSTOMER_3000_Mapped&#xA; ip address 10.0.0.3 255.255.255.255&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description ### PE-4 &amp;lt;-&amp;gt; LinkedISP ###&#xA; ip address 34.20.43.10 255.255.255.254&#xA; duplex full&#xA; speed 1000&#xA; media-type gbic&#xA; negotiation auto&#xA; mpls bgp forwarding&#xA;&#xA;router bgp 46202&#xA; bgp log-neighbor-changes&#xA; bgp graceful-restart restart-time 120&#xA; bgp graceful-restart stalepath-time 360&#xA; bgp graceful-restart&#xA; no bgp default ipv4-unicast&#xA; no bgp default route-target filter&#xA; neighbor ROUTE-REFLECTORS peer-group&#xA; neighbor ROUTE-REFLECTORS remote-as 46202&#xA; neighbor 34.20.43.11 remote-as 2203&#xA; neighbor 115.40.1.1 peer-group ROUTE-REFLECTORS&#xA; neighbor 115.40.1.2 peer-group ROUTE-REFLECTORS&#xA; !&#xA; address-family ipv4&#xA;  neighbor ROUTE-REFLECTORS send-community extended&#xA;  neighbor 115.40.1.1 activate&#xA;  neighbor 115.40.1.2 activate&#xA; exit-address-family&#xA; !&#xA; address-family vpnv4&#xA;  neighbor ROUTE-REFLECTORS send-community extended&#xA;  neighbor 34.20.43.11 activate&#xA;  neighbor 34.20.43.11 send-community extended&#xA;  neighbor 34.20.43.11 route-map community-rewrite-46202:3000 out&#xA;  neighbor 115.40.1.1 activate&#xA;  neighbor 115.40.1.2 activate&#xA; exit-address-family&#xA; !&#xA; address-family ipv6&#xA;  neighbor 115.40.1.1 activate&#xA;  neighbor 115.40.1.2 activate&#xA; exit-address-family&#xA; !&#xA; address-family vpnv6&#xA;  neighbor ROUTE-REFLECTORS send-community extended&#xA;  neighbor 115.40.1.1 activate&#xA;  neighbor 115.40.1.2 activate&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf CUSTOMER_3000_Mapped&#xA;  redistribute connected&#xA; exit-address-family&#xA;!&#xA;ip extcommunity-list 2 permit rt 46202:3000&#xA;ip bgp-community new-format&#xA;!&#xA;route-map community-rewrite-46202:3000 permit 10&#xA; match extcommunity 2&#xA; set extcomm-list 2 delete&#xA; set extcommunity rt 2203:3000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Route Reflectors are standard config, just simply set up with the PE's as route-reflector-clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 'other provider' is set up basically as a mirror to the above config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Updated with requested outputs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE-4#show bgp vpnv4 unicast all neighbors 115.40.1.1 advertised-routes&#xA;--Output Omitted--&#xA;Route Distinguisher: 46202:3000 (default for vrf CUSTOMER_3000_Mapped)&#xA;*&amp;gt; 10.0.0.3/32      0.0.0.0                  0         32768 ?&#xA;&#xA;PE-4#show bgp vpnv4 unicast rd 46202:3000 10.0.0.1&#xA;BGP routing table entry for 46202:3000:10.0.0.1/32, version 37&#xA;Paths: (1 available, best #1, table CUSTOMER_3000_Mapped)&#xA;  Not advertised to any peer&#xA;  2203, imported path from 2203:3000:10.0.0.1/32&#xA;    34.20.43.11 from 34.20.43.11 (34.20.43.11)&#xA;      Origin incomplete, metric 0, localpref 100, valid, external, best&#xA;      Extended Community: RT:46202:3000&#xA;      mpls labels in/out nolabel/16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More Updated shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE-4#show ip route vrf CUSTOMER_3000_Mapped 10.0.0.1&#xA;&#xA;Routing Table: CUSTOMER_3000_Mapped&#xA;Routing entry for 10.0.0.1/32&#xA;  Known via &quot;bgp 46202&quot;, distance 20, metric 0&#xA;  Tag 2203, type external&#xA;  Last update from 34.20.43.11 14:18:17 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 34.20.43.11 (default), from 34.20.43.11, 14:18:17 ago&#xA;      Route metric is 0, traffic share count is 1&#xA;      AS Hops 1&#xA;      Route tag 2203&#xA;      MPLS label: 16&#xA;      MPLS Flags: MPLS Required&#xA;&#xA;PE-4#show ip cef vrf CUSTOMER_3000_Mapped 10.0.0.1&#xA;10.0.0.1/32&#xA;  nexthop 34.20.43.11 GigabitEthernet0/0 label 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;34.20.43.10/31 is also advertised in the global routing table as a connected subnet over OSPF for MPLS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE-4#show ip ospf 1 0.0.0.8 interface&#xA;GigabitEthernet0/0 is up, line protocol is up&#xA;  Internet Address 34.20.43.10/31, Area 8, Attached via Network Statement&#xA;  Process ID 1, Router ID 115.40.0.131, Network Type BROADCAST, Cost: 1&#xA;  Topology-MTID    Cost    Disabled    Shutdown      Topology Name&#xA;        0           1         no          no            Base&#xA;  Transmit Delay is 1 sec, State WAITING, Priority 1&#xA;  No designated router on this network&#xA;  No backup designated router on this network&#xA;  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5&#xA;    oob-resync timeout 40&#xA;    No Hellos (Passive interface)&#xA;    Wait time before Designated router selection 00:00:37&#xA;  Supports Link-local Signaling (LLS)&#xA;  Cisco NSF helper support enabled&#xA;  IETF NSF helper support enabled&#xA;  Index 3/3, flood queue length 0&#xA;  Next 0x0(0)/0x0(0)&#xA;  Last flood scan length is 0, maximum is 0&#xA;  Last flood scan time is 0 msec, maximum is 0 msec&#xA;  Neighbor Count is 0, Adjacent neighbor count is 0&#xA;  Suppress hello for 0 neighbor(s)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11927" LastEditorUserId="11927" LastEditDate="2015-01-05T22:48:23.517" LastActivityDate="2017-08-13T20:27:33.893" Title="Cisco VPNv4 over eMPBGP" Tags="|cisco|mpls|mpls-vpn|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="14671" PostTypeId="1" AcceptedAnswerId="14748" CreationDate="2014-12-17T08:45:35.217" Score="2" ViewCount="1717" Body="&lt;p&gt;I have grouped two ports of a switch into a channel and specified load balancing based on source and destination MAC address. I do not understand how will the switch do load balancing, using which hash algorithm,please explain with an example?&#xA;the switch is CTS FOS-3124&lt;/p&gt;&#xA;" OwnerUserId="11909" LastActivityDate="2014-12-21T00:46:21.267" Title="static link aggregation" Tags="|ieee-802.1ax|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14672" PostTypeId="1" AcceptedAnswerId="14675" CreationDate="2014-12-17T09:04:18.240" Score="2" ViewCount="59741" Body="&lt;p&gt;I am trying to create a separate subnet, which is isolated from my LAN subnet. I want some controlled traffic flow between these subnets. I hope to control it using the Sonicwall firewall rules. But here is the thing, I want the machines to see each other directly, if allowed through the rules. What I mean is I want no NAT translation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN_1: 172.16.1.0&#xA;LAN_2: 192.168.1.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN_1 is the default LAN, the SonicWall LAN IP is 172.16.1.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SonicWall has 5 interfaces. X0 is LAN interface (LAN_1) and X1 is WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering about how to setup LAN_2. Do I buy separate router, or can SonicWall give me this routing ability, if I define one of the available interfaces (X2,X3,X4) for connecting LAN_2? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind I am no network engineer, but I am often forced to play that role.&lt;/p&gt;&#xA;" OwnerUserId="11931" LastActivityDate="2015-08-26T19:40:53.043" Title="Using Sonicwall to route between subnets" Tags="|routing|sonicwall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14673" PostTypeId="5" CreationDate="2014-12-17T09:15:28.883" Score="0" Body="&lt;p&gt;For questions about Protocol Independent Multicast (PIM), where PIM is IP routing protocol-independent and can leverage whichever unicast routing protocols are used to populate the unicast routing table, including Enhanced Interior Gateway Routing Protocol (EIGRP), Open Shortest Path First (OSPF), Border Gateway Protocol (BGP), and static routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PIM is a multicast routing protocol that leverages the existing unicast routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tools.ietf.org/html/rfc4601&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tools.ietf.org/html/rfc4601&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7495" LastEditorDisplayName="user36472" LastEditDate="2018-02-12T17:34:53.690" LastActivityDate="2018-02-12T17:34:53.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14674" PostTypeId="4" CreationDate="2014-12-17T09:15:28.883" Score="0" Body="For questions about Protocol Independent Multicast (PIM), where PIM is IP routing protocol-independent and can leverage whichever unicast routing protocols are used to populate the unicast routing table, including Enhanced Interior Gateway Routing Protocol (EIGRP), Open Shortest Path First (OSPF), Border Gateway Protocol (BGP), and static routes." OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2018-02-12T17:34:45.417" LastActivityDate="2018-02-12T17:34:45.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14675" PostTypeId="2" ParentId="14672" CreationDate="2014-12-17T09:40:50.103" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What I mean is I want no NAT translation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is the default behaviour.  Adding NAT translation between neighboring subnets would not be an &lt;em&gt;'enabled by default'&lt;/em&gt; feature.  Simply adding those subnets into your SonicWall would allow them to communicate as long as your hosts are pointing to it as a default gateway.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I am wondering about how to setup LAN_2. Do I buy separate router, or&#xA;  can SonicWall give me this routing ability, if I define one of the&#xA;  available interfaces (X2,X3,X4) for connecting LAN_2?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;SonicWall will give you that capability without the need for any additional routers.  You may need more switches to deal with the additional hosts on your second subnet (LAN_2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're on the right track with the interfaces.  Use any of the additional interfaces you have.  Logically, your setup should look like this in the end.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;               +-----------+ X0 ---- 172.16.1.1/24&#xA;WAN_IP ---- X1 | SonicWall | &#xA;               +-----------+ X2 ---- 192.168.1.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this instance, &lt;code&gt;X0&lt;/code&gt; and &lt;code&gt;X2&lt;/code&gt; will be able to communicate.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-12-17T09:40:50.103" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14676" PostTypeId="1" AcceptedAnswerId="14678" CreationDate="2014-12-17T09:50:35.867" Score="4" ViewCount="808" Body="&lt;p&gt;OK, so the story is this: I'm a school governor for my daughter's primary school here in the UK (roughly equivalent to being 'on the school board' in the USA, I think).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm the IT governor (pretty much by default) because I work in IT but my work has never included network engineering. So I don't know much about this specific area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The school is being extended and refurbished soon, and we want to upgrade the network from 100 Mbit/s to GbE. The new part of the building will be fitted out with appropriate cabling for GbE. We'll be buying new switches for the the whole school.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The existing part of the building is being refurbished and we have the opportunity to replace the existing network cabling. Or we can save money and keep the existing cabling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the question that I'd like to find a way to answer is: is the existing cabling capable of working properly at GbE speeds?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's the case that an upgrade from 100 Mbit/s to GbE &lt;em&gt;always&lt;/em&gt; requires new cabling, then I guess my question is answered quite simply: we just need to replace the cabling. But I'm not clear whether that's the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally I'd like to answer this question without paying for an expensive survey from an external company, since the school has fixed budgets and any money that we save here is freed up to be spent on teacher salaries, educational resources, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't want to start making holes in the walls and physically looking at the existing cabling - every part of the school is in constant use by teachers and children at the present time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither the school nor the local authority has yet located any plans or diagrams or other details of how the network is cabled and what standard of cabling was used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network may well have been added to gradually over the years, rather than installed all-in-one-go. I know that none of it has been installed within the past 7 years. The walls have RJ45 sockets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see a variety of devices billed as 'network cable testers' are available - I could buy one of those but I'm not clear if this is really the purpose they're intended for, or if they're just for checking that a new installation is wired up correctly. Some of them just have LEDs showing a quality result from 1 to 10 - I'm not clear how to interpret that in the context of &quot;is this good enough for GbE?&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have plenty of laptops supporting GbE that we could plug into the network if there's a way of testing this using them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice much appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="11932" LastEditorUserId="8499" LastEditDate="2018-12-21T03:44:13.187" LastActivityDate="2018-12-21T03:44:13.187" Title="An easy yet effective way to test if existing network cabling will be ok for GbE?" Tags="|layer1|cable|cabling|certification|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14678" PostTypeId="2" ParentId="14676" CreationDate="2014-12-17T11:31:02.617" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/14676/easiest-way-to-test-if-existing-network-cabling-will-be-ok-for-gbe#comment22054_14676&quot;&gt;A E said&lt;/a&gt;: OK @MikePennington, so what's the &quot;right way&quot;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Either hire a professional cable installer to check out your cable installation, or get something similar to a &lt;a href=&quot;http://www.flukenetworks.com/enterprise-network/network-testing/CableIQ-Qualification-Tester&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fluke CableIQ&lt;/a&gt;.  These meters perform detailed tests on the cable that reveal what you're dealing with.  GigE has Signal to Noise requirements that simple continuity testers will not check.  Cheaper continuity testers are typically what you'll find at lower prices in consumer electronics stores.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you have satisfied one of the conditions above, test every cable. That's expensive and time-consuming, but it's the only way to be sure you won't deal with flaky connections down the road.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some might argue that you could merely look at the jacket of the cable and see whether it's at least &lt;a href=&quot;http://en.wikipedia.org/wiki/Category_5_cable#Category_5e&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cat5e&lt;/a&gt;; however, that's still inadequate to truly know whether you can use this for GigabitEthernet because:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Someone could have used the wrong cable connectors or patch panels&lt;/li&gt;&#xA;&lt;li&gt;Someone could have crimped / punched down the correct equipment poorly &lt;/li&gt;&#xA;&lt;li&gt;Someone could have made errors pulling the cabling (i.e. used excessive force)&lt;/li&gt;&#xA;&lt;li&gt;Someone could have run the cabling across sources of significant electronic noise&lt;/li&gt;&#xA;&lt;li&gt;Someone could have violated cable run length requirements&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you're willing to gamble, you can test every cable with a couple of cheap 1GE switches from Wal-Mart, ensure each cable links to 1GE, and hope that those results are repeatable.  However, I don't recommend this approach for anyone who cares about whether every cable is done right.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-12-18T00:15:18.047" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14680" PostTypeId="2" ParentId="14676" CreationDate="2014-12-17T11:59:22.207" Score="5" Body="&lt;p&gt;The standard for Gigabit Ethernet was ratified in 1999, so it's certainly possible that the building was wired to cat 5E or better, if it was wired some time this century. However, as Mike Pennington notes, using the right components doesn't guarantee the installation will meet the specification. The higher the rating, in general the more careful you have to be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could certainly look at the cable and panels to see whether it could meet the 5E at least standard before you waste your money getting it professionally tested. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also have to consider how much effort nursemaiding a potentially dodgy installation would be. If you don't have the expertise on site, which I'm guessing you won't it could get expensive. The worst scenario is that it works at Gigabit rates but unreliably.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2014-12-17T11:59:22.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14681" PostTypeId="1" CreationDate="2014-12-17T12:35:17.300" Score="2" ViewCount="764" Body="&lt;p&gt;What is the difference between source sequence number and destination sequence number in RREQ packet in AODV? &lt;/p&gt;&#xA;" OwnerUserId="11936" LastEditorUserId="3075" LastEditDate="2016-01-16T12:48:30.880" LastActivityDate="2018-05-19T12:18:57.853" Title="What is the difference between source and destination sequence number in AODV?" Tags="|routing|protocol-theory|ad-hoc-wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14683" PostTypeId="1" AcceptedAnswerId="14692" CreationDate="2014-12-17T14:25:44.503" Score="9" ViewCount="50212" Body="&lt;p&gt;As the title states, how can I see what optic I have installed in an interface for an MX router?&lt;/p&gt;&#xA;" OwnerUserId="11938" LastActivityDate="2022-10-18T21:19:06.440" Title="How can I find what optic is in an interface for a Juniper MX-series router?" Tags="|juniper|optics|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14686" PostTypeId="2" ParentId="14683" CreationDate="2014-12-17T15:19:14.727" Score="4" Body="&lt;p&gt;Have a look at the output of&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show chassis hardware&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show chassis pic fpc-slot &amp;lt;X&amp;gt; pic-slot &amp;lt;Y&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-12-17T15:19:14.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14687" PostTypeId="2" ParentId="14683" CreationDate="2014-12-17T15:20:32.017" Score="0" Body="&lt;pre&gt;&lt;code&gt;show chassis pic fpc-slot 1 pic-slot 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11942" LastEditorUserId="509" LastEditDate="2014-12-17T22:25:54.493" LastActivityDate="2014-12-17T22:25:54.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14688" PostTypeId="1" AcceptedAnswerId="14693" CreationDate="2014-12-17T15:50:49.937" Score="5" ViewCount="12028" Body="&lt;p&gt;I have a Cisco 2621XM connected straight to my ISP modem. I have a computer on the second interface of the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP -&amp;gt; Modem -&amp;gt; Cisco Router -&amp;gt; Computer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run a speedtest on my computer I get 30/10. When I connect my computer straight to my modem I get 100/10. I also have another Cisco Router, 871. Same exact results, I get 30/10 when I connect my computer to it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm starting to think that it's a default setting that comes baked into the router? Here's my config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 &amp;lt;REMOVED&amp;gt;&#xA;!&#xA;no aaa new-model&#xA;!&#xA;resource policy&#xA;!&#xA;no network-clock-participate slot 1&#xA;no network-clock-participate wic 0&#xA;ip subnet-zero&#xA;ip cef&#xA;!&#xA;no ip dhcp use vrf connected&#xA;ip dhcp excluded-address 10.4.4.1 10.4.4.100&#xA;!&#xA;ip dhcp pool ALL_ACCESS&#xA;   network 10.4.4.0 255.255.255.0&#xA;   dns-server 8.8.8.8 8.8.4.4&#xA;   default-router 10.4.4.1&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.4.4.1 255.255.255.0&#xA; ip nat inside&#xA; speed 100&#xA; full-duplex&#xA;!&#xA;interface Serial0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address dhcp&#xA; ip nat outside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip classless&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip nat inside source list 1 interface FastEthernet0/1 overload&#xA;!&#xA;access-list 1 permit 10.4.4.0 0.0.0.255&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA; logging synchronous&#xA;line aux 0&#xA;line vty 0 4&#xA; login&#xA;line vty 5 181&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output from &lt;code&gt;show interface&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh interfaces FastEthernet0/1&#xA;FastEthernet0/1 is up, line protocol is up&#xA;  Hardware is AmdFE, address is 000e.3836.ff41 (bia 000e.3836.ff41)&#xA;  Internet address is xxx.xxx.xxx.xxx/xx&#xA;  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 100Mb/s, 100BaseTX/FX&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:00, output 00:00:00, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 1/75/128247/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 51000 bits/sec, 41 packets/sec&#xA;  5 minute output rate 4000 bits/sec, 6 packets/sec&#xA;     16778657 packets input, 2855708480 bytes&#xA;     Received 5967982 broadcasts, 0 runts, 0 giants, 0 throttles&#xA;     69379 input errors, 0 CRC, 0 frame, 15274 overrun, 54105 ignored&#xA;     0 watchdog&#xA;     0 input packets with dribble condition detected&#xA;     3231581 packets output, 590804149 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 2 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     484 lost carrier, 0 no carrier&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sh interfaces FastEthernet0/1 status&lt;/code&gt; - Doesn't output anything&lt;/p&gt;&#xA;" OwnerUserId="10329" LastEditorUserId="3191" LastEditDate="2014-12-17T23:49:42.190" LastActivityDate="2018-08-08T14:10:30.143" Title="Cisco Router Limiting Bandwidth" Tags="|cisco|router|bandwidth|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14690" PostTypeId="2" ParentId="14688" CreationDate="2014-12-17T16:07:45.503" Score="0" Body="&lt;p&gt;Can you post a show interfaces of the WAN connection?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh interfaces FastEthernet0/1&#xA;sh interfaces FastEthernet0/1 status&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Maybe the portspeed is not what is should be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/12133061/slow-performance-cisco-2621&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; guy is having the same problem, could be the CPU that is to slow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional info: &lt;a href=&quot;https://supportforums.cisco.com/discussion/11377266/cpu-utilization-hitting-100-cisco-2621xm&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/11377266/cpu-utilization-hitting-100-cisco-2621xm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2693" LastEditorUserId="2693" LastEditDate="2014-12-17T16:14:17.963" LastActivityDate="2014-12-17T16:14:17.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14691" PostTypeId="2" ParentId="14688" CreationDate="2014-12-17T17:26:06.763" Score="6" Body="&lt;p&gt;You have input errors on that interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     69379 input errors, 0 CRC, 0 frame, 15274 overrun, 54105 ignored&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Check speed/duplex on both sides, or just set to auto negotiate on both sides&lt;/p&gt;&#xA;" OwnerUserId="2477" LastActivityDate="2014-12-17T17:26:06.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14692" PostTypeId="2" ParentId="14683" CreationDate="2014-12-17T18:38:41.200" Score="14" Body="&lt;p&gt;You need to be looking under the &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/reference/command-summary/show-chassis-hardware.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;show chassis hardware&lt;/code&gt;&lt;/a&gt; stanza.  That gives you all the inner-workings of the devices plugged into the chassis, including VC members.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On an MX platform, this is along the lines of what you'd expect:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@host&amp;gt; show chassis hardware&#xA;Hardware inventory:&#xA;Item             Version  Part number  Serial number     Description&#xA;Chassis                                E1372             MX10-T&#xA;Midplane         REV 01   711-038211   YF5285            MX10-T&#xA;PEM 0            Rev 04   740-028288   VB01678           AC Power Entry Module&#xA;Routing Engine            BUILTIN      BUILTIN           Routing Engine&#xA;TFEB 0                    BUILTIN      BUILTIN           Forwarding Engine Processor&#xA;  QXM 0          REV 05   711-028408   ZA9053            MPC QXM&#xA;FPC 0                     BUILTIN      BUILTIN           MPC BUILTIN&#xA;  MIC 0                   BUILTIN      BUILTIN           4x 10GE XFP&#xA;    PIC 0                 BUILTIN      BUILTIN           4x 10GE XFP&#xA;FPC 1                     BUILTIN      BUILTIN           MPC BUILTIN&#xA;  MIC 0          REV 24   750-028392   YX9436            3D 20x 1GE(LAN) SFP&#xA;    PIC 0                 BUILTIN      BUILTIN           10x 1GE(LAN) SFP&#xA;      Xcvr 0     REV 01   740-031851   AM1107SUFQW       SFP-SX&#xA;    PIC 1                 BUILTIN      BUILTIN           10x 1GE(LAN) SFP&#xA;Fan Tray                                                 Fan Tray&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;sup&gt;Sample information derived from &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/reference/command-summary/show-chassis-hardware.html#jd0e1039&quot; rel=&quot;noreferrer&quot;&gt;Juniper TechLibrary&lt;/a&gt;&lt;/sup&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or perhaps you don't buy &lt;em&gt;everything&lt;/em&gt; from Juniper and/or you live in a multi vendor environment (like me).  Your system will look eerily similar to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FPC 0            REV 20   750-045402   LX0XXXXXXXXX      EX4550-32F&#xA;  CPU                     BUILTIN      BUILTIN           FPC CPU&#xA;  PIC 0                   BUILTIN      BUILTIN           32x 1G/10G SFP/SFP+&#xA;    Xcvr 0       REV 01   740-021309   ARS0HB7           SFP+-10G-LR&#xA;    Xcvr 1       REV 01   740-021309   ARS0HB2           SFP+-10G-LR&#xA;    Xcvr 12      c        NON-JNPR     FNS0838H4CB       SFP-LX10&#xA;    Xcvr 13               NON-JNPR     FNS0838H4AJ       SFP-LX10&#xA;    Xcvr 14      M        NON-JNPR     FNS0835T08U       SFP-LX10&#xA;    Xcvr 15               NON-JNPR     FNS0838H4B0       SFP-LX10&#xA;    Xcvr 16      U        NON-JNPR     FNS0835T0C2       SFP-LX10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although this is on an EX4550, the transceivers marked &lt;code&gt;NON-JNPR&lt;/code&gt; would show up the same on an MX platform.  It's not a malfunction, the system just doesn't recognize the device signatures.  If you want additional information on them, such as the vendor, fiber wavelength, or fiber type, use the &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos13.3/topics/reference/command-summary/show-chassis-pic.html&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;show chassis pic fpc-slot &amp;lt;FPC&amp;gt; pic-slot &amp;lt;PIC&amp;gt;&lt;/code&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00525CN01&amp;gt; show chassis pic fpc-slot 0 pic-slot 0&#xA;FPC slot 0, PIC slot 0 information:&#xA;  Type                             32x 1G/10G SFP/SFP+ Builtin&#xA;  State                            Online&#xA;  Uptime                         56 days, 6 hours, 5 minutes, 6 seconds&#xA;&#xA;PIC port information:&#xA;                         Fiber                    Xcvr vendor       Wave-    Xcvr&#xA;  Port Cable type        type  Xcvr vendor        part number       length   Firmware&#xA;  0    10GBASE LR        SM    FINISAR CORP.      FTLX1471D3BCL-J1  1310 nm  0.0&#xA;  1    10GBASE LR        SM    FINISAR CORP.      FTLX1471D3BCL-J1  1310 nm  0.0&#xA;  12   GIGE 1000LX10     SM    CISCO-FINISAR      FTRJ-1319-7D-CSC  1310 nm  0.0&#xA;  13   GIGE 1000LX10     SM    CISCO-FINISAR      FTRJ-1319-7D-CSC  1310 nm  0.0&#xA;  14   GIGE 1000LX10     SM    CISCO-FINISAR      FTRJ-1319-7D-CSC  1310 nm  0.0&#xA;  15   GIGE 1000LX10     SM    CISCO-FINISAR      FTRJ-1319-7D-CSC  1310 nm  0.0&#xA;  16   GIGE 1000LX10     SM    CISCO-FINISAR      FTRJ-1319-7D-CSC  1310 nm  0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Most of the time, though, &lt;code&gt;show chassis hardware&lt;/code&gt; will be more than sufficient. &lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-12-18T16:03:46.370" LastActivityDate="2014-12-18T16:03:46.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14693" PostTypeId="2" ParentId="14688" CreationDate="2014-12-17T19:41:11.877" Score="8" Body="&lt;p&gt;Neither of the routers you are referencing will ever be able to run at line rate.  While the 2621XM is a better &quot;class&quot; of device, it is much older, so the performance is actually similar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While dated, &lt;a href=&quot;http://www.cisco.com/web/partners/downloads/765/tools/quickreference/routerperformance.pdf&quot;&gt;this document&lt;/a&gt; contains details for both routers you mention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;overrun&quot; and &quot;ignored&quot; errors in your interface output indicate you are trying to pass more data through the device than it can handle.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-12-17T19:41:11.877" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14694" PostTypeId="1" AcceptedAnswerId="14696" CreationDate="2014-12-17T20:52:47.730" Score="5" ViewCount="3924" Body="&lt;p&gt;I just learned networking and according to a &lt;a href=&quot;http://en.wikipedia.org/wiki/Broadcast_radiation#Prevention&quot; rel=&quot;noreferrer&quot;&gt;wiki article on broadcast radiation prevention&lt;/a&gt;, it says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Filtering broadcasts by Layer 3 equipment, typically routers (and even switches that employ advanced filtering called brouters).&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But I do not understand how exactly routers resolves broadcast storm problem. Any explanation in detail?&lt;/p&gt;&#xA;" OwnerUserId="10455" LastEditorUserId="3191" LastEditDate="2014-12-17T22:03:21.080" LastActivityDate="2016-08-04T16:50:44.447" Title="How does router prevent Broadcast radiation" Tags="|router|broadcast|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14695" PostTypeId="1" CreationDate="2014-12-17T21:45:53.963" Score="3" ViewCount="2773" Body="&lt;p&gt;I have two locations that have a site-to-site ipsec vpn configuration setup.  The lan on one side is 192.168.30.x.  The lan on the other side is 192.168.16.x with a subnet attached via a cisco 3560 switch that is 192.168.2.x.  All locations on both the 192.168.30.x and 192.168.16.x lans can ping, rdp, etc., with no issues.  The problem is that the 192.168.2.x and the 192.168.30.x subnets cannot see each other (cannot ping, rdp, etc.).  I am using a ASA-5510 on the 192.168.16.x side and a TZ-215 on the 192.168.30.x side.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the ASA-5510 configuration on the 192.168.16.x side which has the subnet 192.168.2.x attached via the Cisco 3560 switch.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 8.2(5)48 &#xA;!&#xA;hostname ***-**-*****&#xA;domain-name **********.com&#xA;enable password **************** encrypted&#xA;passwd **************** encrypted&#xA;names&#xA;dns-guard&#xA;!&#xA;interface Ethernet0/0&#xA; speed 100&#xA; duplex full&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.16.42 255.255.255.252 &#xA;!&#xA;interface Ethernet0/1&#xA; description Credit Solutions connection&#xA; nameif outside&#xA; security-level 0&#xA; ip address 97.64.134.142 255.255.255.252 &#xA;!&#xA;interface Ethernet0/2&#xA; description Internet Connection (and VOIP)&#xA; nameif internet&#xA; security-level 0&#xA; ip address 63.229.183.186 255.255.255.248 &#xA;!&#xA;interface Ethernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management0/0&#xA; speed 100&#xA; duplex full&#xA; nameif management&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0 &#xA;!&#xA;boot system disk0:/asa825-48-k8.bin&#xA;ftp mode passive&#xA;dns server-group DefaultDNS&#xA; domain-name **********.com&#xA;same-security-traffic permit intra-interface&#xA;object-group network telesoft_in_nonvoip&#xA; network-object 69.176.73.0 255.255.255.224&#xA; network-object 69.176.73.32 255.255.255.224&#xA;object-group network telesoft_in_voip&#xA; network-object 172.25.0.0 255.255.0.0&#xA;object-group service telesoft_in_voip_tcpudp tcp-udp&#xA; port-object eq sip&#xA; port-object eq www&#xA;object-group service telesoft_in_nonvoip_udp udp&#xA; port-object eq tftp&#xA;object-group service telesoft_in_nonvoip_tcp tcp&#xA; port-object eq ftp&#xA;object-group service telesoft_in_voip_udp udp&#xA; port-object range 16384 32776&#xA;object-group network inside_voip&#xA; network-object 10.255.18.208 255.255.255.240&#xA;object-group network test-access&#xA; network-object host 184.98.74.30&#xA; network-object host 4.2.2.2&#xA;object-group network RFC1918&#xA; network-object 192.168.0.0 255.255.0.0&#xA; network-object 10.0.0.0 255.0.0.0&#xA; network-object 172.16.0.0 255.240.0.0&#xA;object-group network VoIP&#xA; description Telesphere Ranges&#xA; network-object 63.229.183.184 255.255.255.248&#xA; network-object 69.176.73.0 255.255.255.192&#xA;access-list internet-side extended permit ip 162.42.243.208 255.255.255.240 63.229.183.184 255.255.255.248 &#xA;access-list internet-side extended deny ip any host 10.255.18.209 &#xA;access-list internet-side extended permit tcp object-group telesoft_in_nonvoip 10.255.18.208 255.255.255.240 object-group telesoft_in_nonvoip_tcp &#xA;access-list internet-side extended permit udp object-group telesoft_in_nonvoip 10.255.18.208 255.255.255.240 object-group telesoft_in_nonvoip_udp &#xA;access-list internet-side extended permit tcp object-group telesoft_in_voip object-group inside_voip object-group telesoft_in_voip_tcpudp &#xA;access-list internet-side extended permit udp object-group telesoft_in_voip object-group inside_voip object-group telesoft_in_voip_tcpudp &#xA;access-list internet-side extended permit udp object-group telesoft_in_voip object-group inside_voip object-group telesoft_in_voip_udp &#xA;access-list internet-side extended permit icmp any any echo-reply &#xA;access-list internet-side extended permit icmp any any time-exceeded &#xA;access-list nonat extended permit ip object-group RFC1918 object-group RFC1918 &#xA;access-list nonat extended permit ip object-group RFC1918 object-group VoIP &#xA;access-list nonat extended permit ip 192.168.16.0 255.255.255.0 192.168.30.0 255.255.255.0 &#xA;access-list nonat extended permit ip 192.168.2.0 255.255.255.0 192.168.30.0 255.255.255.0 &#xA;access-list inside extended permit icmp any any &#xA;access-list inside extended permit ip any any &#xA;access-list outside extended permit icmp any any &#xA;access-list vpn_tunnel_phxnap extended permit ip 192.168.16.0 255.255.255.0 192.168.30.0 255.255.255.0 &#xA;access-list vpn_tunnel_phxnap extended permit ip 192.168.2.0 255.255.255.0 192.168.30.0 255.255.255.0 &#xA;pager lines 24&#xA;logging enable&#xA;logging buffer-size 16384&#xA;logging monitor debugging&#xA;logging buffered debugging&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;mtu internet 1500&#xA;mtu management 1500&#xA;ip local pool NogalesTest 192.168.16.28-192.168.16.29 mask 255.255.255.248&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;icmp permit any outside&#xA;asdm image disk0:/asdm-713.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 0 access-list nonat&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;nat (management) 1 0.0.0.0 0.0.0.0&#xA;static (inside,outside) 192.168.2.0 192.168.6.0 netmask 255.255.255.0 &#xA;access-group inside in interface inside&#xA;access-group outside in interface outside&#xA;access-group internet-side in interface internet&#xA;route outside 0.0.0.0 0.0.0.0 97.64.134.141 1&#xA;route outside 4.2.2.2 255.255.255.255 97.64.134.141 1&#xA;route outside 10.10.0.0 255.255.0.0 192.168.7.2 1&#xA;route inside 10.255.18.208 255.255.255.240 192.168.16.41 1&#xA;route internet 65.243.39.0 255.255.255.0 63.229.183.185 1&#xA;route internet 69.176.73.0 255.255.255.224 63.229.183.185 1&#xA;route internet 69.176.73.32 255.255.255.224 63.229.183.185 1&#xA;route internet 162.42.243.208 255.255.255.240 63.229.183.185 1&#xA;route internet 172.25.0.0 255.255.0.0 63.229.183.185 1&#xA;route outside 184.98.74.30 255.255.255.255 173.16.104.1 1&#xA;route outside 184.164.128.134 255.255.255.255 97.64.134.141 1&#xA;route inside 192.168.0.0 255.255.0.0 192.168.16.41 1&#xA;route inside 192.168.2.0 255.255.255.0 192.168.16.41 1&#xA;route inside 192.168.4.0 255.255.255.0 192.168.16.41 1&#xA;route inside 192.168.17.0 255.255.255.0 192.168.16.41 1&#xA;route outside 192.168.30.0 255.255.255.0 184.164.128.134 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;aaa authentication ssh console LOCAL &#xA;aaa authentication enable console LOCAL &#xA;aaa authentication http console LOCAL &#xA;http server enable&#xA;http 192.168.16.0 255.255.255.192 inside&#xA;http 192.168.1.0 255.255.255.0 management&#xA;http 192.168.0.73 255.255.255.255 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto map outside-map 2 match address vpn_tunnel_phxnap&#xA;crypto map outside-map 2 set peer 184.164.128.134 &#xA;crypto map outside-map 2 set transform-set ESP-3DES-SHA&#xA;crypto map outside-map interface outside&#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 10&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 5&#xA; lifetime 86400&#xA;crypto isakmp policy 20&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 30&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 28800&#xA;telnet timeout 5&#xA;ssh 192.168.0.0 255.255.255.0 inside&#xA;ssh 192.168.16.0 255.255.255.192 inside&#xA;ssh 184.98.74.30 255.255.255.255 outside&#xA;ssh 192.168.1.0 255.255.255.0 management&#xA;ssh timeout 60&#xA;console timeout 0&#xA;management-access inside&#xA;dhcpd address 192.168.1.2-192.168.1.254 management&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA;group-policy DfltGrpPolicy attributes&#xA; dns-server value 192.168.2.14 192.168.0.7&#xA; default-domain value *********.com&#xA;username asaadmin password **************** encrypted&#xA;username admin password **************** encrypted&#xA;username jmartin password **************** encrypted privilege 0&#xA;tunnel-group 184.164.128.134 type ipsec-l2l&#xA;tunnel-group 184.164.128.134 ipsec-attributes&#xA; pre-shared-key ****************&#xA; isakmp keepalive threshold 10 retry 3&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect rsh &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect tftp &#xA;  inspect dns &#xA;  inspect ip-options &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;Cryptochecksum:***********************&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11946" LastEditorUserId="2358" LastEditDate="2015-02-09T13:20:18.607" LastActivityDate="2015-09-23T05:46:00.210" Title="How can I connect to different subnet within site-to-site vpn configuration" Tags="|cisco-asa|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14696" PostTypeId="2" ParentId="14694" CreationDate="2014-12-17T21:58:12.827" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But I do not understand how exactly routers resolves broadcast storm&#xA;  problem. Any explanation in detail?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When a router receives a packet, it gets inspected, then forwarded out the appropriate interface or it gets dropped.  When a router receives a broadcast packet, it drops it (excluding directed-broadcasts, dhcp, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a switch receives a frame, it either forwards it on to a known interface or floods it out all of its ports if it doesn't know where to go.  When a broadcast frame comes along, it get's flooded out all interfaces.  Every machine in your segment sees it.  Excessive amounts of these constitute a storm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most common way for a broadcast storm to happen is from a switching loop.  If you somehow get a switching loop on your network, these broadcasts will perpetually send this data back and forth forever, or until you remove the loop.  This will cause data to hit every machine on your segment.  This can cause your network to stop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have a router in between multiple layer 2 segments, each is inherently protected from the other.  Remember, a router won't forward on broadcasts.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----+    +------+    +-----+&#xA;|LAN 1|----|ROUTER|----|LAN 2|&#xA;+-----+    +------+    +-----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;LAN 1&lt;/code&gt; can be all sorts of messed up, and &lt;code&gt;LAN 2&lt;/code&gt; will be none the wiser because &lt;code&gt;ROUTER&lt;/code&gt; won't forward &lt;code&gt;LAN 1&lt;/code&gt; broadcast packets on to anyone.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-12-17T21:58:12.827" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14697" PostTypeId="1" AcceptedAnswerId="14706" CreationDate="2014-12-17T22:29:30.483" Score="2" ViewCount="1667" Body="&lt;p&gt;I hope you are well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did the upgrade of SF300-48P to the latest version 1.4.0.88 using my TACACS acc. After that I could ssh to the switch, but it wouldn't allow me access Privileged EXEC mode - &quot;wrong password&quot;. Surprisingly, I can access the switch via HTTP and make/save changes (using the same TACACS acc.). Also I can login and access the Privileged EXEC mode with another account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This problem repeated on two other switches (both SF300-48P): first I had had the access to Privileged EXEC mode and after the upgrade it stopped working for the account that made the upgrade.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I check the logs (they are quite limited) I see my account being authorised by TACACS server (when I ssh) and when I try enter Privileged EXEC mode - it says it has been rejected. On any other switches this account works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions what might be the cause of this bizarre behaviour?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AAA/TACACAS before the change:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication enable Console enable&#xA;aaa authentication enable SSH tacacs enable&#xA;aaa authentication enable Telnet enable&#xA;aaa authentication enable default tacacs enable&#xA;ip http authentication aaa login-authentication https tacacs local&#xA;aaa authentication login Console local&#xA;aaa authentication login SSH tacacs local&#xA;aaa authentication login Telnet local&#xA;aaa authentication login default tacacs local&#xA;tacacs-server host x.x.x.x    priority 2&#xA;tacacs-server host x.x.x.x  priority 1&#xA;tacacs-server key xyz&#xA;tacacs-server timeout 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After the change:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip http authentication aaa login-authentication https tacacs local&#xA;aaa authentication login SSH tacacs local&#xA;aaa authentication enable SSH tacacs enable&#xA;aaa authentication login Telnet local&#xA;aaa authentication enable Telnet enable&#xA;aaa authentication login Console local&#xA;aaa authentication enable Console enable&#xA;aaa authentication login default tacacs local&#xA;aaa authentication enable default tacacs enable&#xA;tacacs-server host x.x.x.x priority 2&#xA;tacacs-server host x.x.x.x priority 1&#xA;encrypted tacacs-server key 123456 (encrypted xyz)&#xA;tacacs-server timeout 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11947" LastEditorUserId="11947" LastEditDate="2014-12-18T09:56:24.153" LastActivityDate="2016-11-17T13:35:00.993" Title="Privileged EXEC mode not accessible after the upgrade" Tags="|cisco|aaa|tacacs|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14699" PostTypeId="1" AcceptedAnswerId="14707" CreationDate="2014-12-18T03:35:10.753" Score="7" ViewCount="63857" Body="&lt;p&gt;How could I easily identify whether my network at my office is capable or is utilizing PoE? I have Cisco IP phones but I know some phones can operate entirely over ultra-low voltage. &lt;strong&gt;How could I look at my network set up and be able to identify if my network has PoE?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it doesn't have/utilize PoE would it be easy to implement it?&lt;/p&gt;&#xA;" OwnerUserId="2584" LastActivityDate="2014-12-18T13:04:41.267" Title="How Can I Easily Tell If My Network Has Power Over Ethernet?" Tags="|power-over-ethernet|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14701" PostTypeId="2" ParentId="7539" CreationDate="2014-12-18T05:19:59.267" Score="5" Body="&lt;p&gt;Unfortunately not.  This is a frustrating limitation of the way Juniper have implemented Isolated ports and Promiscuos ports in PVLANs - it essentially boils down to if the interfaces is in &lt;strong&gt;access&lt;/strong&gt; mode, it's an &lt;strong&gt;Isolated&lt;/strong&gt; port, but if it's &lt;strong&gt;tagged&lt;/strong&gt;, it's a &lt;strong&gt;Promiscuous&lt;/strong&gt; port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;https://mellowd.co.uk/ccie/?p=5387&quot; rel=&quot;noreferrer&quot;&gt;https://mellowd.co.uk/ccie/?p=5387&lt;/a&gt; is worth a read if you haven't seen it already - goes into a bit more detail than the Juniper Support documentation examples.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2014-12-18T05:19:59.267" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14703" PostTypeId="2" ParentId="14699" CreationDate="2014-12-18T06:39:32.500" Score="8" Body="&lt;p&gt;Some ways to check if you have PoE on the network:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;On a Cisco switch, log in and enter &lt;code&gt;show power inline&lt;/code&gt; and if it supports PoE, you should get output showing which ports are drawing power, a summary of configuration, etc. Any managed PoE switch should have a similar command.&lt;/li&gt;&#xA;&lt;li&gt;Do a web search for your network equipment's model/line and see if it lists PoE as one of the features.&lt;/li&gt;&#xA;&lt;li&gt;Use a testing tool that checks for PoE, such as the &lt;a href=&quot;http://www.flukenetworks.com/enterprise-network/network-testing/LinkRunner-AT-Network-Auto-Tester&quot;&gt;Fluke LinkRunner AT&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Check for &quot;midspan&quot; power injection devices.  These can be on the switch side or the client side (or somewhere in between).  The small form factor ones will have two network connections, a data in and a data/power out.  Larger ones may have multiple pairs of data in and data/power out.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since you mention Cisco VoIP phones, they need to be getting power from somewhere.  The two options are PoE or a power supply. If they are using a power supply, then you probably don't have PoE (or at least enough power available on PoE). Neither allows you to connect a PoE device to the PC port to get power (there is no PoE pass through).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you find you really need to daisy chain, then you may be able to use a product like the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/wireless/aironet-700w-series/index.html&quot;&gt;Cisco 700W AP&lt;/a&gt;. Haven't used them myself, but I know they have a PoE port in the switch ports they provide, so you could possibly plug the phone into the AP.  However I do believe they require 802.3at power to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two pieces of equipment you list are a 2811 router and a 2950 switch.  Most routers do not provide PoE, and to my knowledge, the 2811 is no exception to this.  I also don't know of any 2950 series switches that have PoE, and based on the age of that product line, if there were any it would be the Cisco pre-standard proprietary flavor, not 802.3af or 802.3at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to how easy it is to implement if you don't have it, typically most places will either replace their older switch or add a new switch that supports PoE for their PoE devices.  You will probably wish to have a new switch anyhow as the 2950s are all 10/100Mbps (with a couple exceptions that have two or transceiver capabilities) and even 802.11n wireless access points can exceed 100Mbps of throughput so 1000Mbps ports are nice to have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't want to go down the new switch route, then you can use midspan power injectors. These come in inexpensive non-managed versions as well as more expensive managed versions.  The problem with most non-managed versions is that there is no way to remotely power cycle a non-responsive access point, someone will have to physically disconnect the cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In either case, some form of PoE will almost always be less expensive than running electricity to the AP location.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-12-18T06:39:32.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14706" PostTypeId="2" ParentId="14697" CreationDate="2014-12-18T10:52:32.587" Score="0" Body="&lt;p&gt;I've recreated my TACACS account with the same settings and it's working now. Strange...&lt;/p&gt;&#xA;" OwnerUserId="11947" LastActivityDate="2014-12-18T10:52:32.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14707" PostTypeId="2" ParentId="14699" CreationDate="2014-12-18T13:04:41.267" Score="6" Body="&lt;p&gt;Adding to what YLearn already said, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/troubleshooting/g_power_over_ethernet.html#wp1002308&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;show power inline&lt;/code&gt;&lt;/a&gt; is how you can quickly retrieve that information from the cli to see if your hardware supports it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;non&lt;/strong&gt;-PoE supported device would display the output below if it were available.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MHN00642AN01#show power inline&#xA;&#xA;Module   Available     Used     Remaining&#xA;          (Watts)     (Watts)    (Watts)&#xA;------   ---------   --------   ---------&#xA;1             n/a        n/a         n/a&#xA;Interface Admin  Oper       Power   Device              Class Max&#xA;                            (Watts)&#xA;--------- ------ ---------- ------- ------------------- ----- ----&#xA;MHN00642AN01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Versus a fully PoE capable system:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MHN00421AN01#show power inline&#xA;Available:124.0(w)  Used:0.0(w)  Remaining:124.0(w)&#xA;&#xA;Interface Admin  Oper       Power   Device              Class Max&#xA;                            (Watts)&#xA;--------- ------ ---------- ------- ------------------- ----- ----&#xA;Fa0/1     auto   off        0.0     n/a                 n/a   15.4&#xA;Fa0/2     auto   off        0.0     n/a                 n/a   15.4&#xA;Fa0/3     auto   off        0.0     n/a                 n/a   15.4&#xA;Fa0/4     auto   off        0.0     n/a                 n/a   15.4&#xA;Fa0/5     auto   off        0.0     n/a                 n/a   15.4&#xA;Fa0/6     auto   off        0.0     n/a                 n/a   15.4&#xA;Fa0/7     auto   off        0.0     n/a                 n/a   15.4&#xA;Fa0/8     auto   off        0.0     n/a                 n/a   15.4&#xA;MHN00421AN01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On a chassis style switch, it's even simpler.  Just issuing the &lt;code&gt;show power&lt;/code&gt; command gives detailed output of what your system can offer.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MHN00526CAN01#show power&#xA;Power                                             Fan      Inline&#xA;Supply  Model No          Type       Status       Sensor   Status&#xA;------  ----------------  ---------  -----------  -------  -------&#xA;PS1     PWR-C45-2800AC    AC 2800W   good         good     good&#xA;PS2     PWR-C45-2800AC    AC 2800W   good         good     good&#xA;&#xA;Power supplies needed by system    : 1&#xA;Power supplies currently available : 2&#xA;&#xA;Power Summary                      Maximum&#xA; (in Watts)              Used     Available&#xA;----------------------   ----     ---------&#xA;System Power (12V)        856        1360&#xA;Inline Power (-50V)       182        1400&#xA;Backplane Power (3.3V)     40          40&#xA;----------------------   ----     ---------&#xA;Total                    1078        2800&#xA;&#xA;MHN00526CAN01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-12-18T13:04:41.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14709" PostTypeId="2" ParentId="14695" CreationDate="2014-12-18T14:15:38.693" Score="1" Body="&lt;p&gt;Check your &lt;code&gt;static (inside,outside) 192.168.2.0 192.168.6.0 netmask 255.255.255.0&lt;/code&gt; line. I haven't used pre 8.4 NAT statements, but this may be applying to the traffic as your VPN traffic's interface will be the outside interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this NAT is being applied, then your ACLs may need to be changed to match the corrected addressing.&lt;/p&gt;&#xA;" OwnerUserId="1291" LastActivityDate="2014-12-18T14:15:38.693" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14713" PostTypeId="1" AcceptedAnswerId="14714" CreationDate="2014-12-18T23:14:31.973" Score="6" ViewCount="1398" Body="&lt;p&gt;After upgrading our ASAs from 9.1(1) to newer versions, users were no longer able to connect using native IPsec VPN client software when inside of an office network.  From outside networks it still worked just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The office networks have established VPN tunnels covering the IP range that the user's system falls under, but the workflow is to VPN in to gain access to restricted resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We verified that disconnecting the LAN to LAN IPsec tunnel to the office allowed the client to connect in successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When debugging the connection attempt's IKE and IPsec, a log entry shows why this is failing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Skipping dynamic map OUTSIDE_DYN_MAP sequence 100: cannot match peerless map when peer found in previous map entry.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That log entry led to several reports of this issue (&lt;a href=&quot;https://supportforums.cisco.com/discussion/11954391/issue-remote-access-vpn&quot;&gt;1&lt;/a&gt;, &lt;a href=&quot;https://supportforums.cisco.com/discussion/12099546/ipsec-vpn-not-working-after-upgrade-847&quot;&gt;2&lt;/a&gt;) with information clarifying that this behavior was introduced as a security fix in CSCuc75090, but no real functional workarounds - just recommendations to use the established tunnel or NAT the users to a different address than the tunnel peering is happening over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an effective workaround to allow for client VPN from these locations again?&lt;/p&gt;&#xA;" OwnerUserId="221" LastActivityDate="2014-12-18T23:14:31.973" Title="After upgrading ASA, client VPN failing from site with active LAN to LAN tunnel" Tags="|cisco-asa|vpn|ipsec|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14714" PostTypeId="2" ParentId="14713" CreationDate="2014-12-18T23:14:31.973" Score="5" Body="&lt;p&gt;Yes, the device can be instructed to accept the client VPN connections from the peer that it already has an open tunnel with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is done by updating the dynamic map to include new entries with a configured peer address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, with this existing configuration accepting a dynamic connection from any address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto map vpnmap 10 match address peer_acl&#xA;crypto map vpnmap 10 set peer 192.0.2.15&#xA;crypto map vpnmap 10 set ikev1 transform-set ESP-AES-SHA1&#xA;crypto map vpnmap 65500 ipsec-isakmp dynamic OUTSIDE_DYN_MAP&#xA;crypto dynamic-map OUTSIDE_DYN_MAP 100 set ikev1 transform-set ESP-3DES-SHA&#xA;crypto dynamic-map OUTSIDE_DYN_MAP 100 set security-association lifetime seconds 86400&#xA;crypto dynamic-map OUTSIDE_DYN_MAP 100 set reverse-route&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;..the dynamic map can be edited to allow client VPN connections from the &lt;code&gt;192.0.2.15&lt;/code&gt; peer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto map vpnmap 10 match address peer_acl&#xA;crypto map vpnmap 10 set peer 192.0.2.15&#xA;crypto map vpnmap 10 set ikev1 transform-set ESP-AES-SHA1&#xA;crypto map vpnmap 65500 ipsec-isakmp dynamic OUTSIDE_DYN_MAP&#xA;crypto dynamic-map OUTSIDE_DYN_MAP 10 set ikev1 transform-set ESP-3DES-SHA&#xA;crypto dynamic-map OUTSIDE_DYN_MAP 10 set security-association lifetime seconds 86400&#xA;crypto dynamic-map OUTSIDE_DYN_MAP 10 set reverse-route&#xA;crypto dynamic-map OUTSIDE_DYN_MAP 10 set peer 192.0.2.15&#xA;crypto dynamic-map OUTSIDE_DYN_MAP 100 set ikev1 transform-set ESP-3DES-SHA&#xA;crypto dynamic-map OUTSIDE_DYN_MAP 100 set security-association lifetime seconds 86400&#xA;crypto dynamic-map OUTSIDE_DYN_MAP 100 set reverse-route&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;..and client IPsec connections will now be allowed from &lt;code&gt;192.0.2.15&lt;/code&gt; despite having an active LAN to LAN tunnel.&lt;/p&gt;&#xA;" OwnerUserId="221" LastActivityDate="2014-12-18T23:14:31.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14716" PostTypeId="1" CreationDate="2014-12-19T05:51:06.570" Score="5" ViewCount="1546" Body="&lt;p&gt;In connection oriented networks, the source first establish connection with destination before sending packets. When a connection is established sequence of packets are sent on that connection which is some virtual tube or pipe.&#xA;Also it is written that in connection oriented protocol, decision about route for sequence of packets can be made only once when the connection is established.&#xA;(Ref: Data communication and networking, by Behrouz Forouzan)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My doubt is:&#xA;TCP is connection-oriented protocol and IP use connection-less packet switched routing.&#xA;So while implementing TCP with IP as network layer protocol, how routing is done.&#xA;If IP decides one route when establishing connection and use it for entire communication, how it is done.&#xA;Or IP is free to choose any possible route during the communication? I mean, is it possible that network layer can choose different path for different packets for same connection?&lt;/p&gt;&#xA;" OwnerUserId="10764" LastActivityDate="2014-12-19T10:32:35.860" Title="how IPv4 routing is done for TCP? as TCP is connection oriented but IP is not" Tags="|routing|tcp|ip|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14717" PostTypeId="2" ParentId="14716" CreationDate="2014-12-19T06:02:34.637" Score="1" Body="&lt;p&gt;IP makes path selection decisions with no knowledge or care about the upper layer protocols. TCP is connection-oriented in the sense that it emulates connections by enforcing in-order delivery and knowledge of delivery success. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP traffic can (and sometimes does) change paths in the middle of a session. When this happens, either the upper layer protocols (like TCP) simply back-up to the last acknowledge in-order message and continue from there, or the upper layer protocols (like UDP and RTSP) just assume the connectivity was lost and reestablished , and keep going. &lt;/p&gt;&#xA;" OwnerUserId="10104" LastActivityDate="2014-12-19T06:02:34.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14718" PostTypeId="2" ParentId="14716" CreationDate="2014-12-19T07:53:32.943" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In connection oriented networks, the source first establish connection&#xA;  with destination before sending packets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The process of establishing that connection &lt;strong&gt;is&lt;/strong&gt; sending packets.  I think you're referring to how TCP establishes a connection before sending data.  So in that case, you would need a &lt;a href=&quot;http://www.inetdaemon.com/tutorials/internet/tcp/3-way_handshake.shtml&quot; rel=&quot;nofollow&quot;&gt;successful 3-way handshake&lt;/a&gt; before you can transfer data.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Or IP is free to choose any possible route during the communication? I&#xA;  mean, is it possible that network layer can choose different path for&#xA;  different packets for same connection?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not only is it possible, but it happens.  The underpinnings of packet switching is that it really doesn't matter how it gets there, just that it does.  This sometimes comes with issues in delivering packets out of order because of that asynchronous routing.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-12-19T09:46:50.067" LastActivityDate="2014-12-19T09:46:50.067" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14719" PostTypeId="1" AcceptedAnswerId="14746" CreationDate="2014-12-19T09:38:56.207" Score="4" ViewCount="966" Body="&lt;p&gt;Is it possible to set up a Distributed Trunk with 2 Core an 1 Acces Switch on HP 5406zl?&#xA;I know that you can connect two switches with an interswitchconnect port. That would be the 2 core switches. Now you can set up a Distributed trunk, e.g. you want to plug in a server with one cabel per switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First Question: will the traffic run over one cabel until it's link is down or are the switches performing kind of load balancing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second Question: can i connect a Acces Switch with the same method?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See Graph below&#xA;&lt;img src=&quot;https://i.stack.imgur.com/PRJwv.png&quot; alt=&quot;Graph_Switch&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in Advance, Sorry for Mistakes :P&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Greeting From Germany, Max&lt;/p&gt;&#xA;" OwnerUserId="11967" LastActivityDate="2014-12-20T20:10:33.697" Title="Distributed Trunking With core and Access Swtiches?" Tags="|switch|hp-procurve|network-core|trunk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14720" PostTypeId="1" AcceptedAnswerId="14737" CreationDate="2014-12-19T09:54:43.487" Score="5" ViewCount="7305" Body="&lt;p&gt;Does anyone know whether it is possible to remotely change the mgmt IP, vlan and default gw of a HP Switch without losing connectivity when connecting via ssh to said IP?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create new (mgmt) vlan&lt;/li&gt;&#xA;&lt;li&gt;Create svi in new vlan&lt;/li&gt;&#xA;&lt;li&gt;Change default gw to network of new vlan IP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="49701" LastEditDate="2018-08-27T05:15:40.930" LastActivityDate="2018-08-27T05:15:40.930" Title="Change mgmt IP, vlan and default GW HP Switch" Tags="|switch|vlan|hp|ip|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="14721" PostTypeId="2" ParentId="14716" CreationDate="2014-12-19T10:32:35.860" Score="4" Body="&lt;p&gt;A connection oriented network is one where the network layer (roughly equivalent to the IP layer) where the routing done is connection based (like X.25 or a telephone call).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this is absolutely true:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In connection oriented networks, the source first establish connection&#xA;  with destination before sending packets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;but this misses the important word &lt;em&gt;network&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;in connection oriented [network] protocol, decision about route for sequence of&#xA;  packets can be made only once when the connection is established&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, a protocol like TCP has to add sequence numbers, acknowledgments and retries to ensure that it delivers data in the same order it was supplied. It works with the connectionless service the lower layer provides though. &lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2014-12-19T10:32:35.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14722" PostTypeId="1" CreationDate="2014-12-19T14:33:31.233" Score="3" ViewCount="28" Body="&lt;p&gt;Is there a way to limit communication between community members in a PVLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex.&#xA;Service provider ABC has 1000 clients, the clients with more than one VM to their name have their own community, however the provider wants only specific ports to talk across the VM's within that community.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is a way please explain how it would work!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2014-12-19T15:17:15.247" Title="Limiting community member communication in PVLAN's" Tags="|access-control|private-vlan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14723" PostTypeId="1" CreationDate="2014-12-19T15:14:39.200" Score="0" ViewCount="184" Body="&lt;p&gt;While broadcast address in IPv4 is used to send traffic to all the hosts in the network, then what is the purpose of network address in IPv4 network?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2014-12-19T16:58:40.667" Title="Purpose of network address in IPv4?" Tags="|ipv4|protocol-theory|" AnswerCount="2" CommentCount="0" ClosedDate="2014-12-19T17:51:47.253" ContentLicense="CC BY-SA 3.0" />
  <row Id="14724" PostTypeId="2" ParentId="14722" CreationDate="2014-12-19T15:17:15.247" Score="2" Body="&lt;p&gt;Private VLANS are a layer 2 technology.  To filter specific ports, you need something that operates at layer 4.  There are virtualized firewalls that would be applied per VM that could do this for you.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-12-19T15:17:15.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14725" PostTypeId="2" ParentId="14723" CreationDate="2014-12-19T16:28:10.323" Score="0" Body="&lt;p&gt;It's simply an identifier, used to tell the start of a particular network segment. This is more useful when you get into subnetting and VLSM, where there are several smaller-sized networks. &lt;/p&gt;&#xA;" OwnerUserId="11974" LastActivityDate="2014-12-19T16:28:10.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14726" PostTypeId="2" ParentId="14723" CreationDate="2014-12-19T16:58:40.667" Score="-1" Body="&lt;p&gt;IPv4 address are used to locate a network host (PC, Laptop, Ip Phone, cell Phone and a large etcetera...). Each host must have a IPv4 Address when you need a type of traffic called unicast, wich means a communication between two  network hosts, like visiting a web page, senf a file or send an email.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If each communication send a broadcast to every network host, each host can view the web page, the file or the email (this is not exactly technically, but illustrate my point)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and last, to make an example, if each communication are a broadcast, is like every phone call is share by every phone, or every letter is send to everyone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope Helps!&lt;/p&gt;&#xA;" OwnerUserId="10098" LastActivityDate="2014-12-19T16:58:40.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14727" PostTypeId="1" AcceptedAnswerId="14728" CreationDate="2014-12-19T17:15:53.627" Score="7" ViewCount="77404" Body="&lt;p&gt;The command &quot;show interface fa0/1&quot; prints the following output:&#xA;&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ANMwL.gif&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;br&gt;&lt;br&gt;What is the difference between &quot;CRC&quot; and &quot;input errors&quot;? CRC errors confirms that a frame error has occured, but what about &quot;input errors&quot;?&lt;/p&gt;&#xA;" OwnerUserId="3200" LastActivityDate="2017-07-25T12:04:07.383" Title="Difference between CRC and input errors - show interface" Tags="|cisco|interface|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14728" PostTypeId="2" ParentId="14727" CreationDate="2014-12-19T17:25:52.747" Score="6" Body="&lt;p&gt;The &quot;input errors&quot; counter will increment whenever the interface receives a frame with any sort of input error, which includes CRC among other types of errors.  Each frame is only counted once, no matter how many types of specific errors it contains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see an example of this if you check &lt;a href=&quot;https://networkengineering.stackexchange.com/q/14688/33&quot;&gt;this recent question&lt;/a&gt; which also has input errors.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2014-12-19T21:01:13.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14729" PostTypeId="2" ParentId="14727" CreationDate="2014-12-19T17:28:24.243" Score="5" Body="&lt;p&gt;See this page, table 4-6:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/internetworking/troubleshooting/guide/tr1904.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/en/US/docs/internetworking/troubleshooting/guide/tr1904.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Description of input errors from that page:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Includes runts, giants, no buffer, CRC, frame, overrun, and ignored counts. Other input-related errors can also cause the input error count to be increased, and some datagrams may have more than one error; therefore, this sum may not balance with the sum of enumerated input error counts.&lt;/p&gt;&#xA;" OwnerUserId="840" LastActivityDate="2014-12-19T17:28:24.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14730" PostTypeId="1" CreationDate="2014-12-19T20:13:42.443" Score="2" ViewCount="3833" Body="&lt;p&gt;Look this scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host 1:&#xA;Ip:192.168.0.1&#xA;mask:255.255.255.0&#xA;gateway: not defined&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host 2:&#xA;Ip:192.168.1.1&#xA;mask:255.255.255.0&#xA;gateway: not defined&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to ping from host 1 to host 2? assume that both are connected on the same hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried in the packet tracer and didn't work, this is normal or a configuration fault? &#xA;if it was a switch?&#xA;to route between networks must use a router?&lt;/p&gt;&#xA;" OwnerUserId="11977" LastActivityDate="2014-12-20T07:19:11.910" Title="Ipv4 routing - 2 host of diferents nets ping each other in the same Hub" Tags="|routing|router|ipv4|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14731" PostTypeId="2" ParentId="14730" CreationDate="2014-12-19T20:38:57.803" Score="-1" Body="&lt;p&gt;They are on different networks (192.168.0.0/24 and 192.168.1.0/24), so in order to communicate, you either have to change one of the IPs to be on the same network as the other, or place a router in between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a nutshell, the subnet mask lets clients know which addresses are local and which are remote.   So, 192.168.0.1 with a mask of 255.255.255.0 can communicate with anything else with IPs between 192.168.0.2 and 192.168.0.254.  If you were to subnet to smaller network*, an IP at 192.168.0.1 with a mask of 255.255.255.248 would only be able to communicate with 192.168.0.2 through .6 and would need a router to communicate with, say, 192.168.0.10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*192.168.x.y addresses cannot be supernetted up to a larger subnet mask, such as 255.255.0.0, but that's another discussion.&lt;/p&gt;&#xA;" OwnerUserId="10237" LastEditorUserId="10237" LastEditDate="2014-12-19T20:46:01.733" LastActivityDate="2014-12-19T20:46:01.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14733" PostTypeId="2" ParentId="14730" CreationDate="2014-12-19T22:04:55.367" Score="1" Body="&lt;p&gt;When it host is going to send IP traffic, it first checks to see if the destination IP address is on the local subnet.  It uses both it's IP address and the subnet mask to make this determination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination IP is not on the local subnet (your case), the host then checks to see if it has a route to the destination IP in it's routing table.  Generally most hosts only have one route, the default route or gateway that is provides somewhere to forward traffic for any other network (barring any more specific route to the destination IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, with no configured gateway, the host will determine it doesn't know how to get to the destination IP.  This means it has nowhere to send the traffic resulting in the traffic being dropped while generally returning an error like &quot;No Route to Host.&quot;  &lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-12-19T22:04:55.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14734" PostTypeId="1" AcceptedAnswerId="20017" CreationDate="2014-12-19T22:52:19.967" Score="5" ViewCount="7570" Body="&lt;p&gt;What's the difference between a traditional switch and OpenFlow Switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that OpenFlow switch is used in Software-defined networking but am failing to understand why a OpenFlow switch is so special?&lt;/p&gt;&#xA;" OwnerUserId="3035" LastActivityDate="2018-08-06T00:00:05.083" Title="What's the difference between a traditional switch and OpenFlow Switch?" Tags="|switch|openflow|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14735" PostTypeId="2" ParentId="14734" CreationDate="2014-12-20T01:17:44.897" Score="1" Body="&lt;p&gt;In a traditional switch device, packet forwarding and high-level routing are on the same device. An OpenFlow switch separates the data path from the control path. Separate controller makes high-level routing decisions. The switch and controller communicate by the OpenFlow protocol.&lt;/p&gt;&#xA;" OwnerUserId="6417" LastActivityDate="2014-12-20T01:17:44.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14736" PostTypeId="2" ParentId="14730" CreationDate="2014-12-20T04:05:08.857" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it &lt;strong&gt;possible&lt;/strong&gt; to ping from host 1 to host 2? assume that both are connected on the same hub.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. But you have to add a route to the other network on each host.  As it stands, there are two networks on the wire, but each host only knows about the network in which they reside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Linux, assuming eth0 is your interface:&lt;br/&gt;&#xA;(host 1) &lt;code&gt;ip route add 192.168.1.0/24 dev eth0&lt;/code&gt;&lt;br/&gt;&#xA;(host 2) &lt;code&gt;ip route add 192.168.0.0/24 dev eth0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The same can be done in widows, but you have to know the interface numbers.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-20T04:05:08.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14737" PostTypeId="2" ParentId="14720" CreationDate="2014-12-20T04:40:25.480" Score="5" Body="&lt;p&gt;This depends entirely on the switch model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simple layer-2 switches, &quot;&lt;em&gt;not likely&lt;/em&gt;&quot;. The issue is the inability to enter an atomic set of commands. Each configuration change will be active the instant it's entered. So, when you enter &lt;code&gt;primary-vlan xx&lt;/code&gt;, the minute you hit &lt;kbd&gt;enter&lt;/kbd&gt; your connection will fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With layer-3 switches, &quot;Yes&quot;. But it takes a careful sequence. Be sure your moving of the mgmt interface and any associated route(s) will not break traffic forwarding/routing through the switch. Bring up IP on a different SVI (vlan). Then access the switch through that new interface, preferably from a local host (i.e. host in the same subnet) to avoid any routing issues. Then move the management vlan, if that model has any notion of &quot;management vlan&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Doing an in-place network / management redesign with a few nortel (avaya) switches was a real test. That ultimately took a bit of netmask juggling, proxy-arp, /32 routing *grin* &lt;sup&gt;(yes, a host can live on the wrong network)&lt;/sup&gt;, and leap-frog telnet's... and that was on a switch down the hall from me.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-20T04:40:25.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14738" PostTypeId="1" CreationDate="2014-12-20T06:35:21.767" Score="3" ViewCount="212" Body="&lt;p&gt;One of my switches is being replaced.  It is a 24 port 100 base MTRJ Cisco switch.  It is being replaced with a WS-C3750X-24S-E.  Will this switch support 100/1000 or 1000 base only?  I have some devices that do not support 1000 yet.  If it does support 100/1000 does this depend on the SFP's?  I thought it would auto negotiate the speeds but I am being told that it isn't.&lt;/p&gt;&#xA;" OwnerUserId="11985" LastEditorUserId="33" LastEditDate="2014-12-20T07:50:46.663" LastActivityDate="2015-07-22T04:28:25.427" Title="Cisco Fiber switch perform at 100/1000" Tags="|cisco|fiber|sfp|cisco-3750|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14739" PostTypeId="2" ParentId="14730" CreationDate="2014-12-20T07:19:11.910" Score="0" Body="&lt;p&gt;Is it possible to ping from host 1 to host 2? assume that both are connected on the same hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;while using of Cisco router you can ping both host 1 and 2 on the same hub.But without router you can't communicate. Because for two different ips we want to take them in one network or one gateway ip. For this we want to use routers.&#xA;If we use two different network in single switch or hub ,their ip will conflicting again and again.By this the communication could not possible.  &lt;/p&gt;&#xA;" OwnerUserId="11986" LastActivityDate="2014-12-20T07:19:11.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14740" PostTypeId="2" ParentId="14738" CreationDate="2014-12-20T07:50:32.227" Score="5" Body="&lt;p&gt;You don't say which switch you are replacing nor specify the type of transceiver it has (you only specify the connector).  However, the only 24 port Cisco switches I know of personally that have 100Mbps MT-RJ ports utilize 100base-FX, but make sure you double check.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Will this switch support 100/1000 or 1000 base only?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;According to the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL632702.pdf&quot;&gt;Cisco 100-Megabit Ethernet SFP Modules Compatibility Matrix&lt;/a&gt;, the WS-C3750X-24S can utilize GLC-GE-100FX transceivers so it can operate at either speed.  This should work fine for your 100Mbps devices provided the assumption I made above is correct.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If it does support 100/1000 does this depend on the SFP's?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you use Cisco transceivers, then yes it does depend on the SFPs.  AFAIK, all Cisco transceivers operate at only one speed or the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some third party vendors do sell transceivers that operate at either 100Mbps or 1000Mbps.  Keep in mind that these are not officially supported by Cisco and you will have to do your research to make sure they will work in your switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, since it seems you are somewhat new to fiber, make sure you are using compatible transceivers.  In your case, if your existing devices are using 100base-FX, you would not be able to use a third party 100/1000base-SX transceiver.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-12-20T07:50:32.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14741" PostTypeId="1" CreationDate="2014-12-20T08:25:23.747" Score="0" ViewCount="328" Body="&lt;p&gt;I have an industrial machine controller with an ethernet connection. the Controller is DTU-1000x for a Testing Machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to check the whether the controller has an inbuilt webserver based configuration tool .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder how do I findout the IP address of this controller, so I can configure the IP of my adapter to one on the same subnet and try to see if there is a webserver on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dont' have or can't get the usermanual of this thing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried the usual suspects 192.168.1.x etc but so far no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am on machine with windows 7&lt;/p&gt;&#xA;" OwnerUserId="11987" LastActivityDate="2014-12-23T12:16:18.973" Title="Find out the IP Address of an Industrial machine controller" Tags="|ip|" AnswerCount="3" CommentCount="0" ClosedDate="2019-06-02T04:09:49.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="14742" PostTypeId="2" ParentId="14741" CreationDate="2014-12-20T11:35:31.600" Score="4" Body="&lt;p&gt;I would start by connecting my machine to the same VLAN (or back to back) and running Wireshark to see if the device is attempting to communicate with anything else, reboot the device too to see if there is any initial communications that might reveal an IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can use nmap to port scan the device to see what services are running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failing that, a quick bit of Googling turns up the Korean manufacturer of the product: &lt;a href=&quot;http://www.idtnt.com/eng/&quot; rel=&quot;nofollow&quot;&gt;http://www.idtnt.com/eng/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And their contact email: dtnt@paran.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could always try asking for a manual&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2014-12-20T11:35:31.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14746" PostTypeId="2" ParentId="14719" CreationDate="2014-12-20T20:10:33.697" Score="3" Body="&lt;p&gt;HP Switches support distributed trunking, so yes you can connect a switch to the trunk.  The trunk is a single logical link, so yes the traffic is load balanced based on some combination of source and destination mac addresses.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-12-20T20:10:33.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14748" PostTypeId="2" ParentId="14671" CreationDate="2014-12-21T00:46:21.267" Score="3" Body="&lt;p&gt;LACP is nowadays in IEEE802.1AXbk-2012. The abstract reads:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Link Aggregation allows one or more links to be aggregated together to&#xA;  form a Link Aggregation Group, such that a Media Access Control (MAC)&#xA;  Client can treat the Link Aggregation Group as if it were a single&#xA;  link. To this end, it specifies the establishment of data terminal&#xA;  equipment (DTE) to DTE logical links, consisting of N parallel&#xA;  instances of full-duplex, point-to-point links operating at the same&#xA;  data rate. The MAC independent Link Aggregation capability, and&#xA;  general information relevant to specific MAC types that support Link&#xA;  Aggregation, are defined in this standard.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It standardizes the connectivity and communication between devices but it does not describe how the device internally handles the packets. The actual algorithm is proprietary to the manufacturer, and normally device design including functionality is confidential to the company. If it isn't you're likely to find it in the device manual or other documentation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;LACP does not have actual load balancing intelligence, it does not take existing link load into account when deciding where to forward the traffic. The devices participating in LACP aggregation do not exchange information about forwarding decisions either, it's done independently per conversation on each switch. How this works in general:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.-------.   .-------.   .-------.   &#xA;|client1|---|       |   |       |    &#xA;'-------'   |       |   |       |   .------. &#xA;.-------.   |       |---|       |   |      |        &#xA;|client1|---|switch1|   |switch2|---|server|&#xA;'-------'   |       |---|       |   |      | &#xA;.-------.   |       |   |       |   '------' &#xA;|client1|---|       |   |       |    &#xA;'-------'   '-------'   '-------'   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Client1 connects to the server&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switch1 decides using sa/da-based algorithm to assign this conversation to leg 1 (top link)&lt;/li&gt;&#xA;&lt;li&gt;Server responds, and switch2 decides to assign this conversation to link 2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Client2 connects to the server&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switch1 assigns this conversation to leg 2&lt;/li&gt;&#xA;&lt;li&gt;Server responds, and switch2 assigns this conversation to leg 2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Client3 connects to the server&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switch1 assigns this conversation to leg 2&lt;/li&gt;&#xA;&lt;li&gt;Server responds, and switch2 assigns this conversation to leg 1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that we are now in a situation where 2 conversations are flowing on leg 1, 4 conversations on leg 2. This is normal behavior, since existing load isn't taken into account at any point. However the more conversations you have running in the network, the more evenly the traffic usually gets distributed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;How this will help&quot; is a bit of an open question. Many manufacturers offer their own, proprietary aggregation method, which usually is protocoll-less. These tend to work together between manufacturers, but there is no standardization.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that's one advantage of LACP - it's a standard, so you know how devices are supposed to behave. You can configure your switch to static LACP and connect it to another switch with similar configuration (or to a server NIC team - they also usually have LACP capability) and if everything is correctly configured, you will have a working aggregated link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another advantage is that you can configure LACP to be dynamic. In this mode you have an active and a passive partner. For example you can configure all your core switch ports for active LACP and your edge switch ports for passive LACP. If you run out of bandwidth on an edge switch link, the only thing you need to do is connect another cable between the devices and they will form an aggregated link without any other configuration. The downside in dynamic mode is that since the aggregated link doesn't actually exist until the cables are connected, you can't assign it to a given VLAN. A dynamic LACP link usually drops to the default VLAN.&lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2014-12-21T00:46:21.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14749" PostTypeId="2" ParentId="13270" CreationDate="2014-12-21T01:29:20.883" Score="4" Body="&lt;p&gt;This isn't Distributed Trunking. The described topology is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.-------.  .-------.&#xA;|       |  |       |&#xA;| 8200A |--| 8200B |&#xA;|       |  |       |&#xA;'-------'  '-------'&#xA;    |          |&#xA;    |          |&#xA;.-------.  .-------.&#xA;| sw e  |--| sw f  |&#xA;'-------'  '-------'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since it's said that the 8200s are connected with &quot;DT-LACP trunks&quot; I assume the Inter-switch link required for DT is present between them. If these links are in the same VLAN and STP is not enabled, there is a loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what Distributed Trunking looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.-------.  .-------.&#xA;|       |  |       |&#xA;| 8200A |--| 8200B |&#xA;|       |  |       |&#xA;'-------\  /-------'&#xA;    |    \/    |&#xA;    |    /\    |&#xA;.-------/  \-------.&#xA;| Sw E  |  | Sw F  |&#xA;'-------'  '-------'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The links on 8200s are configured for Distributed Trunk, and the link between them as Switch Interconnect link which makes the downlinks to each edge switch appear as one logical link. The uplinks on switches E and F are aggregated with LACP so each of them will see one logical link as well. There is no loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's a redundant link between switches E and F and it's in the same VLAN as the uplinks, a loop will form. STP is needed to counteract that, and root and path priorities must be configured so that STP blocks the redundant link. &lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2014-12-21T01:29:20.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14758" PostTypeId="2" ParentId="3355" CreationDate="2014-12-21T23:37:10.230" Score="6" Body="&lt;p&gt;I will try to answer these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The technology I probably talked about is called &quot;&lt;a href=&quot;http://en.wikipedia.org/wiki/G.fast&quot; rel=&quot;nofollow&quot;&gt;G.fast&lt;/a&gt;&quot; and it is being standardized as I write this; most of the G.fast standard was passed last week.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;G.fast is a hybrid fiber-copper system, or deep-fiber, that uses copper only for the last hundred meters or so.  It will pump from some hundreds to say 2 Gb/s in future versions.  Alcatel has announced work on another system that will carry around 10 Gb/s but only over some twenty or so meter of copper.  This one is intended as a fiber-drop replacement and probably at first targeting the French market.  (Apparently they cannot accept the drilling of holes in their homes, thus reusing copper.)  So on the topic of fibre:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;if you dig anyway, always put down some fiber too. It costs essentially nothing.  &lt;/li&gt;&#xA;&lt;li&gt;otherwise try to stay technology agnostic and choose something with good price-performance.&lt;/li&gt;&#xA;&lt;li&gt;in the future fiber will be able to go very far as capacity goes, but this is not so relevant for the domestic market.  My guess is that the ability to bring some power (for trickle charging your gadgets) may become a much more important quality than the extra gigabits.  But nobody works on this yet.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12002" LastEditorUserId="2746" LastEditDate="2014-12-23T19:58:01.423" LastActivityDate="2014-12-23T19:58:01.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14761" PostTypeId="2" ParentId="13146" CreationDate="2014-12-22T08:55:27.007" Score="4" Body="&lt;p&gt;Damon, I'm afraid there is something wrong with your specific implementation.  I, personally, can't think of an instance where a router &lt;strong&gt;doesn't&lt;/strong&gt; respond to an icmp request on any of it's interfaces.  Others, please chime in if that's inaccurate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At any rate, I mocked it up in GNS3 to make sure there weren't any funky software bugs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/o4DJ5.png&quot; alt=&quot;GNS3 Network Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basic configurations were set up on the interfaces with each router having it's router number as the &lt;code&gt;lo0&lt;/code&gt; interface address (i.e. R1 - &lt;code&gt;1.1.1.1&lt;/code&gt;).  For verification, here's the rip routing table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip route rip&#xA;     2.0.0.0/32 is subnetted, 1 subnets&#xA;R       2.2.2.2 [120/1] via 10.1.1.2, 00:00:07, FastEthernet0/0&#xA;     3.0.0.0/32 is subnetted, 1 subnets&#xA;R       3.3.3.3 [120/1] via 10.3.3.3, 00:00:26, FastEthernet0/1&#xA;     10.0.0.0/24 is subnetted, 3 subnets&#xA;R       10.2.2.0 [120/1] via 10.3.3.3, 00:00:26, FastEthernet0/1&#xA;                 [120/1] via 10.1.1.2, 00:00:07, FastEthernet0/0&#xA;R1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When pinging the multicast address of &lt;code&gt;224.0.0.9&lt;/code&gt;, 3 replys came back; &lt;code&gt;R2&lt;/code&gt; sent a reply, &lt;code&gt;R3&lt;/code&gt; sent a reply, and &lt;code&gt;R1&lt;/code&gt; replied to itself because it is also listening for that address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#debug ip icmp&#xA;ICMP packet debugging is on&#xA;R1#ping 224.0.0.9 source lo0 repeat 1&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 1, 100-byte ICMP Echos to 224.0.0.9, timeout is 2 seconds:&#xA;Packet sent with a source address of 1.1.1.1&#xA;&#xA;*Mar  1 00:15:41.163: ICMP: echo reply sent, src 1.1.1.1, dst 1.1.1.1&#xA;*Mar  1 00:15:41.163: ICMP: echo reply rcvd, src 1.1.1.1, dst 1.1.1.1   &amp;lt;--- R1 Response&#xA;*Mar  1 00:15:41.179: ICMP: echo reply rcvd, src 10.1.1.2, dst 1.1.1.1  &amp;lt;--- R2 Response&#xA;*Mar  1 00:15:41.179: ICMP: echo reply rcvd, src 10.3.3.3, dst 1.1.1.1  &amp;lt;--- R3 Response&#xA;Reply to request 0 from 1.1.1.1, 8 ms&#xA;Reply to request 0 from 10.3.3.3, 24 ms&#xA;Reply to request 0 from 10.1.1.2, 20 ms&#xA;R1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pinging a multicast address will generate a response from participants listening to that address.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2014-12-22T17:32:16.217" LastActivityDate="2014-12-22T17:32:16.217" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14762" PostTypeId="1" CreationDate="2014-12-22T09:16:24.673" Score="2" ViewCount="338" Body="&lt;p&gt;When I see &lt;code&gt;sh port status&lt;/code&gt; on Enterasys s8 switch, it given me list of tbp ports as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tbp.0.1                       down     up                     other&#xA;tbp.0.2                       down     up                     other&#xA;tbp.0.3                       down     up                     other&#xA;tbp.0.4                       down     up                     other&#xA;tbp.0.5                       down     up                     other&#xA;tbp.0.6                       down     up                     other&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what are these tbp ports?&lt;/p&gt;&#xA;" OwnerUserId="12005" LastEditorUserId="775" LastEditDate="2014-12-23T12:49:52.507" LastActivityDate="2014-12-24T17:10:58.453" Title="Enterasys S8 switch shows tbp port" Tags="|switch|ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14763" PostTypeId="1" AcceptedAnswerId="14767" CreationDate="2014-12-22T14:33:48.923" Score="5" ViewCount="1532" Body="&lt;p&gt;We've recently installed a POC for Cisco ISE and have confirmed that we are able to log into the switches that poll it for RADIUS information. Since we've moved from TACACS+, we can't seem to find the area of ISE that contains the accounting information for commands entered on the switches/routers that poll ISE. Is there a comparable tool on ISE? Will it require extra commands be entered on the config level?&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2019-08-29T23:38:09.983" Title="Cisco ISE - CLI Accounting" Tags="|cisco|cli|cisco-ise|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14764" PostTypeId="1" CreationDate="2014-12-22T14:45:07.073" Score="3" ViewCount="1044" Body="&lt;p&gt;I'm trying to limit internet users by traffic quota in fortigate firewall.Is there a way to limit users traffic usage and set quota for them in fortigate?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i think there is no built-in feature for this,but i guess by means of an external AAA server it may be possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i've used cisco ACS before ,but i don't know how to configure it for this scenario.&#xA;and i don't know if fortigate support CoA or Packet of Disconnect either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="12011" LastActivityDate="2020-12-20T12:14:02.570" Title="Fortigate user traffic quota" Tags="|fortigate|aaa|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14765" PostTypeId="1" AcceptedAnswerId="71880" CreationDate="2014-12-22T14:45:40.753" Score="5" ViewCount="303" Body="&lt;p&gt;Here is the background info: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I support a legacy regional group of users with trunk mounted cellular data modems.  These devices use a private APN, meaning they do not communicate directly over the Internet, all traffic from these devices come from the wireless provider into our private network over a leased line, at which point the firewall decides to discard or route the packet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The vendor who provided this private APN setup a long time ago used public addresses for the mobile devices as well as a specific public subnet that they could communicate with. For illustration purposes, I'll say the subnet was 1.2.3.0/29 (this is not the real subnet).  So we could address 6 devices on our network (1.2.3.1 - 1.2.3.6).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device provides connectivity for laptops in the vehicle, but also each also reports AVL location data to one of these servers, lets say that is 1.2.3.6.  These reports are UDP messages on a well known port, let's say that is port 21000.  The device configuration requires an IP Address, not a DNS queryable device name.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;No server on our private network actually has the address 1.2.3.6.  The Cisco ASA Firewall has a UDP PORT NAT for port 21000 from any machine in the public subnet that the mobile units use to the real address of the AVL server.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Change is coming:&#xA;Now, so many years later, we are upgrading capabilities, and the devices will now be assigned private addresses by the wireless vendor.  The public subnet for the mobile devices, as well as the public subnet for our servers (1.2.3.0/248 above) will no longer be assigned to us once the migration is complete.  So then the 1.2.3.6 address that we've been using for AVL will no longer &quot;belong&quot; or otherwise be assigned to us (It's always belonged to the vendor). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem:&#xA;The new private subnet the mobile devices will now get addresses in is not included in the UDP PORT NAT firewall rule.  Once we migrate the APN, then, the cellular modem will no longer be able to report their AVL location successfully.&#xA;The cellular modems (over 1000 of them) must be manually reconfigured one at a time if we change the AVL server address. If we move forward with the migration, the AVL reports will stop working until we manually reconfigure each modem.  If we reconfigure before the migration, we break AVL until the migration occurs.  There is no way to automate making these changes concurrently.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Solution:&#xA;I first asked my network vendor to add the new 10.x.x.x subnet for mobile devices to the firewall rule that port forwards UDP to 1.2.3.6 port 21000 to the proper server.  I was told I cannot NAT traffic from a private (10.x.x.x) address that is attempting to reach a public address (1.2.3.6) to an internal server.  I don't know if this is a safety violation the Cisco ASA will not allow, or if this is a policy of the network vendor.  I then asked if perhaps the router before the firewall could do this UDP PORT NAT for me, changing 1.2.3.6 to the server's &quot;real&quot; address before the traffic reaches the firewall. No, I was told that since we will no longer be assigned this one particular public address, he cannot include that UDP PORT NAT in the router.  &quot;we cannot hang on to a block assignment we do not lease or own.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Question:&#xA;Perhaps this is a matter of opinion?  Only traffic coming in on our leased line (which is just the mobile devices) would even have access to this one very specific rule.  They certainly would never need nor try to access a public Internet device at 1.2.3.6 port 21000.  Are there risks I am not aware of?  I understand the situation is not ideal, but I am trying to find a solution that would allow us to move forward with the newer faster APN technology but not break every modem configuration in the fleet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I asking the vendor to do something that legitimately should not be done?&#xA;I don't wish to cause any security risks, or try to use or steal public address space not allocated to me.  What would you do to support this network challenge?  &lt;/p&gt;&#xA;" OwnerUserId="11976" LastEditorUserId="11976" LastEditDate="2015-01-07T15:01:43.293" LastActivityDate="2021-01-05T19:57:56.143" Title="What risks to continue to use a legacy public network address in specific address/port NAT on a private network" Tags="|nat|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14766" PostTypeId="1" AcceptedAnswerId="14768" CreationDate="2014-12-22T14:46:05.660" Score="5" ViewCount="7002" Body="&lt;p&gt;I'm asking you today for helping me out with demistifying a question I have regarding the native vlan and a trunk link between a regular L2 switch and a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me explain quickly the scenario here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a seperate network whose switch is a regular HP2824 hooked up with a SM fiber uplink coming from another building (the corporate network/internet). The trunk port 20 of this switch is hooked up to a regular router in our engineering network (isolated). This router serves us to route between multiple vlans/subnets we have for different sectors in the factory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is that trunk port going to the HP switch which confuses me a bit. I'm a cisco guy so i speak access/trunk links, not tag/untag. I'm getting used to it more everyday. On the HP switch, &lt;strong&gt;port 20 is untag vlan 8&lt;/strong&gt;. vlan1 is not used on the HP side. So i'm assuming the native vlan of that port is 8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the router side, the link is considered an &lt;strong&gt;edge port&lt;/strong&gt; (not configured as trunk) and its &lt;strong&gt;pvid is 69&lt;/strong&gt;. In the factory, when you hook something in the vlan 69, you can pass through the corporate side and get internet access/ip phone, etc. Which makes sense. On switches that have computers needing an internet access, you must tag/allow vlan 69 to passthrough and untag the said port in 69 for their NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering how the traffic is handled between the switch and the router? &lt;strong&gt;There is obviously a native vlan mismatch which leads to double-tagging/hopping. How in the 802.something world is this working?&lt;/strong&gt; Router knows the destination network so it discards the vlan tag (which there isn't any) and routes traffic to next hop?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wanting to change that router port to a trunk (because that's how to nature of things works in networking isn't? trunking two equipments together), leaving the native vlan 69 but i'm wondering what would happen on the other side with that port 20 leaving untag on vlan 8 ?? Should I tag port20 with vlan 8 accordingly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Need to mention there is no traffic restriction or acls on the network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for reading me and taking the time to help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Happy holidays!&lt;/p&gt;&#xA;" OwnerUserId="12010" LastActivityDate="2014-12-22T15:15:19.177" Title="Native VLAN between switch and router" Tags="|vlan|hp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14767" PostTypeId="2" ParentId="14763" CreationDate="2014-12-22T15:15:17.763" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;It was my understanding that Cisco's ACS+ was EOL, which is why we were moving to ISE in the first place.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Somewhere there was a misunderstanding because &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/security/secure-access-control-system/bulletin-c25-732915.html&quot; rel=&quot;nofollow&quot;&gt;Cisco ACS 5.6&lt;/a&gt;  is currently supported.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are you suggesting that we use ACS+ or are you saying ISE cannot perform accounting? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;ISE is basically just a fancy RADIUS server, which is heavily focused on EAP / 802.1X.  Save yourself pain and suffering, don't hammer the square peg (ISE) into a round hole (CLI accounting).  Cisco ACS is designed for CLI accounting; ISE isn't.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-12-22T15:15:17.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14768" PostTypeId="2" ParentId="14766" CreationDate="2014-12-22T15:15:19.177" Score="3" Body="&lt;p&gt;Hope I understand what you are asking here (your writing is long and my memory is short :))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HP untagged VLAN on a tagged interface functions similarly as the native VLAN you configure on Cisco switch trunk interface (actually tag/untag makes more sense than access/trunk technically speaking), the VLAN 8 in your case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On your router interface facing HP switch, it is running as access/untagged port. So all ingress traffic on that router interface is VLAN 69; meantime router will remove VLAN 69 tag of the egree traffic to switch and when traffic arrives on switch, it will be VLAN 8. However if you have traffic marked with other VLAN, like VLAN 10 and send the traffic to router as the interface facing router is tagged/trunk port, router will not be able to understand it as the edge interface is expecting something without VLAN tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no native VLAN mismatch just like you connect a laptop to a trunk interface with certain native VLAN configured and switch does not complain about mismatch, right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="10478" LastActivityDate="2014-12-22T15:15:19.177" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14769" PostTypeId="2" ParentId="14764" CreationDate="2014-12-22T15:16:06.120" Score="3" Body="&lt;p&gt;What version of fortios are you using? and what model de you have?&#xA;FortiOs 5.0 and 5.2 (i think) have what are you looking for which includes an UTM options of client reputation (in other words, users rating) not just by traffic,  by malware, network applications or IPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope Helps!&lt;/p&gt;&#xA;" OwnerUserId="10098" LastActivityDate="2014-12-22T15:16:06.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14770" PostTypeId="2" ParentId="14764" CreationDate="2014-12-22T15:46:19.620" Score="3" Body="&lt;p&gt;I've used FortiGate in the past and you can do that with UTM like M4niac said. One thing to be careful with, maybe you've already experienced this, is Forti units are slow to process changes. In my experience, you do something in the configuration and it takes a couple of minutes before actually applying. Especially when speaking of UTM features. It looks like sessions needs to be dropped then initiated again on the new feature you just applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are under licensing, you can post a question to their support. They are quite helpful. I've done it a couple times for config issues. :)&lt;/p&gt;&#xA;" OwnerUserId="12010" LastActivityDate="2014-12-22T15:46:19.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14771" PostTypeId="2" ParentId="14741" CreationDate="2014-12-22T15:53:10.390" Score="1" Body="&lt;p&gt;If you physically have access to the device and assuming you are the network admin, you can trace down where it is connected. Find out which switch it's connected in. If you have access to the switch, like chintu said, connect your laptop to the same vlan and fire up wireshark. Good old console cable would provide access to the switch in worst case. You could've previously check for the mac address on the device physically if possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the device would be dhcp, you could make sure a dhcp server is configured for the said vlan. If not, hook the device in the same vlan as other machines. Once it gets an IP, you will be able to configure it via the web interface. Depending it's hirschmann or Schneider, usually they are dhcp at the beginning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those devices weither it's NOE card or PLC sometimes runs under 57600 baud rate. You can try to telnet directly in those with a rs232-usb cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps :)&lt;/p&gt;&#xA;" OwnerUserId="12010" LastActivityDate="2014-12-22T15:53:10.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14772" PostTypeId="2" ParentId="13524" CreationDate="2014-12-22T17:09:01.127" Score="4" Body="&lt;p&gt;&lt;strong&gt;To summarize my comments:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The benefit of using &lt;strong&gt;CBWFQ&lt;/strong&gt; (class based weighted fair queuing) with the &lt;code&gt;fair-queue&lt;/code&gt; statement in the &lt;code&gt;class-default&lt;/code&gt; queue (your second example):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA; class class-default&#xA;  fair-queue&#xA;  queue-limit 1024 packets&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Packets use &lt;strong&gt;WFQ&lt;/strong&gt; (weighted fair queuing) for scheduling and are de-queued based on their calculated weight.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When using &lt;strong&gt;CBWFQ&lt;/strong&gt; without the &lt;code&gt;fair-queue&lt;/code&gt; statement in the &lt;code&gt;class-default&lt;/code&gt; queue (your first example): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA; class class-default&#xA;  bandwidth remaining percent 20&#xA;  random-detect dscp-based      &#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Packets are de-queued using the &lt;strong&gt;FIFO&lt;/strong&gt; (first in first out) method.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2476" LastEditorUserId="2476" LastEditDate="2015-01-29T15:29:54.677" LastActivityDate="2015-01-29T15:29:54.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14778" PostTypeId="2" ParentId="14765" CreationDate="2014-12-22T23:28:20.317" Score="4" Body="&lt;p&gt;If I'm reading this correctly, the bottom line is a need to hairpin traffic at the ASA? On the old Pix, that's not possible -- traffic cannot enter and leave the same interface. On the ASA (somewhere in the 7.x line) &lt;code&gt;same-security-traffic permit intra-interface&lt;/code&gt; came about to allow hairpinning.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network Private-Addresses&#xA; network-object 10.0.0.0 255.0.0.0&#xA; network-object 172.16.0.0 255.240.0.0&#xA; network-object 192.168.0.0 255.255.0.0&#xA;&#xA;nat (inside,inside) source dynamic Private-Addresses interface \&#xA;    destination static [PUBLIC-ADDRESS-OBJECT][[PRIVATE-ADDRESS-OBJECT]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/12148536/nat-hairpin-dns-rewrite&quot; rel=&quot;nofollow&quot;&gt;This link&lt;/a&gt; on Cisco's support forum may be of great use to you.  What you need is a &quot;&lt;em&gt;nat (inside,inside)&lt;/em&gt;&quot; rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Of course, the &lt;em&gt;correct&lt;/em&gt; path is to fix the software... stop hard coding an IP into software where it cannot be changed. Numerous vendors have been bitten on the ass with that one -- builtin ntp server addresses. This is also a lessen in not assuming currently &quot;unused&quot; space is yours to do with as you please.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-22T23:28:20.317" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14780" PostTypeId="1" AcceptedAnswerId="14806" CreationDate="2014-12-23T11:40:04.503" Score="3" ViewCount="281" Body="&lt;p&gt;When IPv6 is performing NDP and the message is Neighbor Solicitation and the observation point is between two routers, what would the IPv6 source address be? The one from the host or the one from the router?&lt;/p&gt;&#xA;" OwnerUserId="12023" LastEditorUserId="775" LastEditDate="2014-12-23T12:19:37.760" LastActivityDate="2014-12-24T21:20:36.367" Title="Neighbor Discovery Protocol" Tags="|ipv6|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14781" PostTypeId="1" CreationDate="2014-12-23T11:51:37.803" Score="1" ViewCount="398" Body="&lt;p&gt;How do I configure AppSecure to function as a reverse proxy for my web servers based on the HTTP host header field?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. website1.domain.com and website2.domain.com should be reverse proxied to different internal servers from the same public IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've search and searched and cannot find any documentation for this. I don't see anything in J-Web and the CLI is unhelpful for AppSecure.&lt;/p&gt;&#xA;" OwnerUserId="1807" LastEditorDisplayName="user36472" LastEditDate="2018-02-18T09:09:11.163" LastActivityDate="2018-02-18T09:09:11.163" Title="Junos HTTP reverse proxy forwarded based on HTTP host" Tags="|juniper-junos|proxy|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14782" PostTypeId="2" ParentId="14741" CreationDate="2014-12-23T12:16:18.973" Score="0" Body="&lt;p&gt;A switch or computer on the same LAN/VLAN should receive ARP announcements from the device. Find out its MAC address and look for it in the switch or computer ARP table.&lt;/p&gt;&#xA;" OwnerUserId="1807" LastActivityDate="2014-12-23T12:16:18.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14783" PostTypeId="1" AcceptedAnswerId="14787" CreationDate="2014-12-23T14:17:48.477" Score="2" ViewCount="312" Body="&lt;p&gt;There is a company who has a Cellphone tower in the back lot, about 300 ft from the building. The Wifi(n signal) network is inside the building about 20 ft from the side door, and with a cellphone they can not keep the Wifi signal more then 10ft outside that side door. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the cell phone tower doing to the Wifi Signal? They want to install Wifi Cameras to watch a gas tank and some other equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would installing an outdoor range extender even help with this, or would the cellphone tower keep it contained to a small area?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anywhere to read on cell phones and the effect on Wifi signals?&lt;/p&gt;&#xA;" OwnerUserId="8167" LastActivityDate="2015-01-22T17:01:41.440" Title="Wireless WIFI Singnal range Under a Cellphone Tower" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14784" PostTypeId="2" ParentId="14670" CreationDate="2014-12-23T14:48:13.647" Score="-1" Body="&lt;pre&gt;&lt;code&gt;mpls labels in/out nolabel/16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is &quot;mpls bgp forwarding&quot; configured on the interface facing your transit provider?  Same on their interface facing you?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit:  Just reviewed your config, and you do have it -- would check with your peer to see if they have it configured as well&lt;/p&gt;&#xA;" OwnerUserId="141" LastActivityDate="2014-12-23T14:48:13.647" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14787" PostTypeId="2" ParentId="14783" CreationDate="2014-12-23T16:30:26.123" Score="5" Body="&lt;p&gt;Wifi and cellular telephones use two completely different frequency bands, so your problem has nothing to do with the cell tower.  An outdoor antenna and/or a more powerful access point will help your coverage outside.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-12-23T16:30:26.123" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14788" PostTypeId="2" ParentId="14780" CreationDate="2014-12-23T17:07:13.117" Score="3" Body="&lt;p&gt;The source address is the link local address of the sending host.  NDP is not routed, so unless you're on the same subnet, you won't be able to observe it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-12-23T17:07:13.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14794" PostTypeId="1" AcceptedAnswerId="14798" CreationDate="2014-12-24T07:55:46.603" Score="3" ViewCount="2144" Body="&lt;p&gt;I have the following routing table:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/x8Gds.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x8Gds.png&quot; alt=&quot;Routing Table Snapshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;say I get packet with dest IP 10.5.89.34 and the next hop IP is that of a logical VLANIF94 interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;please explain what all steps will happen here like MAC rewrite, VLAN tagging etc.&lt;/p&gt;&#xA;" OwnerUserId="11909" LastEditorUserId="775" LastEditDate="2014-12-24T12:42:06.097" LastActivityDate="2014-12-24T12:42:06.097" Title="Should my layer 3 switch rewrite this MAC address?" Tags="|switch|vlan|layer3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14797" PostTypeId="1" CreationDate="2014-12-24T10:34:33.277" Score="2" ViewCount="673" Body="&lt;p&gt;I've got the following error for a security policy in PA 3020:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L7 processing  ;  ctd error bypass &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried Googling, but I couldn't find a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone knows the meaning of this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is that  the packet with identical 5 tuple sometimes does not match the configured policy. &lt;/p&gt;&#xA;" OwnerUserId="1860" LastEditorUserId="8499" LastEditDate="2016-03-29T22:19:59.690" LastActivityDate="2016-03-29T22:19:59.690" Title="Palo Alto Layer 7" Tags="|firewall|troubleshooting|acl|palo-alto|" AnswerCount="0" CommentCount="0" ClosedDate="2019-12-20T00:25:53.867" ContentLicense="CC BY-SA 3.0" />
  <row Id="14798" PostTypeId="2" ParentId="14794" CreationDate="2014-12-24T11:43:35.070" Score="7" Body="&lt;p&gt;A layer 3 switch will do both routing and switching. In this case:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The packet arrives on some layer 3 interface. The destination IP is 10.5.89.34, and the MAC address on the incoming frame is the MAC address of the receiving interface. &lt;/li&gt;&#xA;&lt;li&gt;The routing table says packet should go out to a directly connected subnet on VLANIF94. A new ethernet frame has to be built containing the same dest IP, but with the dest MAC address set to the address of 10.5.89.34, which needs to be found through ARP.&lt;/li&gt;&#xA;&lt;li&gt;An ARP request &quot;Who has 10.5.89.34?&quot; is broadcasted from the VLANIF94 interface. Since this is a vlan-interface, it will be sent out of all ports in vlan 94. The copies of the frame will be vlan tagged if they go out of a tagged port, and untagged if they go out of an access port.&lt;/li&gt;&#xA;&lt;li&gt;An ARP reply will be received informing the router of the MAC address for 10.5.89.34, and the original packet can be sent out VLANIF94 in a frame using this MAC address as its destination.&lt;/li&gt;&#xA;&lt;li&gt;The frame will be sent out the switch port in vlan 94 which is listed with that dest MAC address in the MAC address table (this entry was learned in step 4).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, as a router, your layer 3 switch will forward the IP packet in a frame with different MAC addresses. As a switch, it will do vlan tagging if needed when sending the packet on the switchport. The same is true for the incoming packet, it could have been tagged or untagged.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2014-12-24T11:43:35.070" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14799" PostTypeId="2" ParentId="14762" CreationDate="2014-12-24T14:01:19.703" Score="2" Body="&lt;p&gt;The tbp port refers to a Tunnel bridge port, aka a GRE tunnel.&lt;/p&gt;&#xA;" OwnerUserId="311" LastEditorUserId="311" LastEditDate="2014-12-24T17:10:58.453" LastActivityDate="2014-12-24T17:10:58.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14801" PostTypeId="1" AcceptedAnswerId="14803" CreationDate="2014-12-24T16:14:03.007" Score="-2" ViewCount="770" Body="&lt;p&gt;Today during a free online CCENT exam I was given the following question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Which 2 statements best describe IP Address 10.16.3.65/23?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2 answers were:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Broadcast Address of the subnet is 10.16.3.255&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;The Lowest Host Address in the subnet is 10.16.2.1/23&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are, how is this question solved methodically and whats happening to the 3rd octet? It seems to be changing from .3 to .2 when there is only 1 bit in the 3rd octet to play with (NNNNNNNH).&lt;/p&gt;&#xA;" OwnerUserId="6354" LastEditorUserId="762" LastEditDate="2014-12-24T19:48:17.500" LastActivityDate="2014-12-24T19:48:17.500" Title="What is happening to the 3rd octet in this question?" Tags="|subnet|" AnswerCount="2" CommentCount="4" ClosedDate="2014-12-24T17:46:50.023" ContentLicense="CC BY-SA 3.0" />
  <row Id="14802" PostTypeId="2" ParentId="14801" CreationDate="2014-12-24T16:21:38.573" Score="0" Body="&lt;p&gt;Don't look on octets in this questions. IPv4 is 32 bits. /23 mean first 23 bits is network address, other bits is host address.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2014-12-24T16:21:38.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14803" PostTypeId="2" ParentId="14801" CreationDate="2014-12-24T16:22:08.260" Score="2" Body="&lt;p&gt;Think of it like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the third octet of the /23 mask: &lt;code&gt;11111110&lt;/code&gt; What does that rightmost &lt;code&gt;1&lt;/code&gt; represent? It represents the &lt;code&gt;2&lt;/code&gt;s place, so the interval between subnets is 2. Some example subnets would be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;10.16.0.0/23&#xA;10.16.2.0/23&#xA;10.16.4.0/23&#xA;10.16.6.0/23&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And so on. Now, the particular IP address in question, &lt;code&gt;10.16.3.65&lt;/code&gt;, falls into the &lt;code&gt;10.16.2.0/23&lt;/code&gt; subnet. Hence, you just need to look at the subnet itself to determine the answers to your questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The broadcast address is the highest address before the next highest subnet. In this case, &lt;code&gt;10.16.3.255&lt;/code&gt;. The lowest host address or the first usable IP is one more than the subnet address. Since the subnet address is &lt;code&gt;10.16.2.0&lt;/code&gt; the lowest host address is &lt;code&gt;10.16.2.1&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerDisplayName="user6423" LastActivityDate="2014-12-24T16:22:08.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14804" PostTypeId="2" ParentId="13163" CreationDate="2014-12-24T18:20:50.557" Score="2" Body="&lt;p&gt;The closest IOS equivalent to the ASA's &lt;strong&gt;logging message&lt;/strong&gt; command is the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/12-4t/esm-12-4t-book/esm-syslog.html&quot; rel=&quot;nofollow&quot;&gt;Embedded Syslog Manager (ESM)&lt;/a&gt; feature. It offers similar capabilities, but is far more flexible (and, consequently, more complex). I've never needed to use it, but based on a quick reading of the documentation, it works like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create one or more logging filters in TCL. In your case, your filter will need to manipulate the message severity.&lt;/li&gt;&#xA;&lt;li&gt;Tell IOS about the filter(s) with one or more &lt;strong&gt;logging filter&lt;/strong&gt; commands. The filter can be stored on local flash or can be accessed using any remote protocol supported by your device (e.g. HTTP, TFTP, etc.).&lt;/li&gt;&#xA;&lt;li&gt;Modify your &lt;strong&gt;logging host&lt;/strong&gt;, &lt;strong&gt;logging console&lt;/strong&gt;, etc. commands to include the &lt;strong&gt;filtered&lt;/strong&gt; keyword.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The linked documentation includes an &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/esm/configuration/12-4t/esm-12-4t-book/esm-syslog.html#GUID-F76A4452-896E-4F52-A1BC-29FB9CDD75CB&quot; rel=&quot;nofollow&quot;&gt;example script&lt;/a&gt; that modifies the message severity, which may help you get started.&lt;/p&gt;&#xA;" OwnerUserId="1339" LastActivityDate="2014-12-24T18:20:50.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14806" PostTypeId="2" ParentId="14780" CreationDate="2014-12-24T21:20:36.367" Score="3" Body="&lt;p&gt;It depends.&lt;/p&gt;&#xA;&lt;p&gt;Neighbor Discovery Protocol (NDP) serves various functions on a network.  Multiple of those functions require sending a Neighbor Solicitation message, and the structure of that message, and the underlying IP Header are different depending on what specific function NDP is performing.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;If NDP is performing Address Resolution&lt;/strong&gt; (aka, IPv6's version of ARP), the Source IP address of the Neighbor Solicitation message will be the Link-Layer address of the sending host (typically starting with &lt;code&gt;FE80&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;If NDP is performing Duplicate Address Detection&lt;/strong&gt;, the Source IP address of the Neighbor Solicitation message will be the unspecified address:  &lt;code&gt;::&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;All this is outlined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861#section-4.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;section 4.3 of RFC 4861&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2014-12-24T21:20:36.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14809" PostTypeId="1" AcceptedAnswerId="14810" CreationDate="2014-12-25T02:29:25.800" Score="4" ViewCount="530" Body="&lt;p&gt;In 10BASE-T and 100BASE-TX Ethernet over twisted-pair cable(for example &lt;em&gt;Cat5e&lt;/em&gt;, &lt;em&gt;Cat6a&lt;/em&gt;) on PHY level the signals of two endpoints are connected as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tx+ &amp;lt;--&amp;gt; Rx+&#xA;Tx- &amp;lt;--&amp;gt; Rx-&#xA;Rx+ &amp;lt;--&amp;gt; Tx+&#xA;Rx- &amp;lt;--&amp;gt; Tx-&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This might be a bit of an electrical engineering question, but why there are two Tx signals(obviously two Rx at the receiving end)? If data is transmitted at the same time over Tx+ and Tx-, then does this mean that Ethernet on PHY level is a parallel connection?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2014-12-25T02:50:29.527" Title="Why does 10BASE-T and 1000BASE-TX Ethernet have two Tx signals?" Tags="|ethernet|protocol-theory|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14810" PostTypeId="2" ParentId="14809" CreationDate="2014-12-25T02:50:29.527" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;why there are two Tx signals(obviously two Rx at the receiving end)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is for &lt;a href=&quot;http://en.wikipedia.org/wiki/Differential_signaling&quot;&gt;differential signalling&lt;/a&gt; to increase noise immunity.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If data is transmitted at the same time over Tx+ and Tx-, then does this mean that Ethernet on PHY level is a parallel connection?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is not parallel within a single pair; parallel data transfer involves multiple bit streams.  10/100m Ethernet doesn't leverage parallel data transfer.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2014-12-25T02:50:29.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14813" PostTypeId="1" CreationDate="2014-12-25T10:47:59.720" Score="4" ViewCount="747" Body="&lt;p&gt;The situation is as follow. I have a Nexus device 5000 family and an IBM blade center with Nortel Layer2-3 GbE Switch Module(Fiber).&lt;br&gt;&#xA;These two devices are connected directly. On Nexus I have a vlan Vlan153              79.170.119.177 and on Nortel I have vlan 153 with IP IP: 79.170.119.178.&#xA;The IPs are pingable.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found an issue once I want to setup a bgp session (is and iBGP) and here is the log message from nortel device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bgp: session with 79.170.119.177 failed (OPEN Message Error : Unsupported Opt Param &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the bgp session on Nexus is in idle:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;79.170.119.178  4 25286      28      43        0    0    0 00:27:06 Idle&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using a debug command on Nexus side I have the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nexus1# debug bgp all&#xA;&#xA;Nexus1# 2014 Dec 25 12:16:01.992881 bgp: 25286 [1191] EVT: Executing bgp_damp_timer_callback&#xA;2014 Dec 25 12:16:04.192908 bgp: 25286 [1191] EVT: Sent periodic cleanup message to bgp_cleanup_mq&#xA;2014 Dec 25 12:16:04.192953 bgp: 25286 [1191] EVT: Starting periodic BRIB processing&#xA;2014 Dec 25 12:16:04.192994 bgp: 25286 [1191] (default) BRIB: [IPv4 Unicast] Inspecting prefix 0.0.0.0/0 f or cleanup&#xA;2014 Dec 25 12:16:04.193029 bgp: 25286 [1191] (default) BRIB: [IPv4 Unicast] Inspecting prefix 79.170.112. 0/24 for cleanup&#xA;2014 Dec 25 12:16:04.193052 bgp: 25286 [1191] (default) EVT: [IPv4 Unicast] Table cleanup refcount 5&#xA;2014 Dec 25 12:16:04.193071 bgp: 25286 [1191] (default) EVT: vrf_ctx cleanup: refcount 4&#xA;2014 Dec 25 12:16:04.392857 bgp: 25286 [1191] (default) EVT: 79.170.119.178 peer connection retry timer ex pired&#xA;2014 Dec 25 12:16:04.393249 bgp: 25286 [1191] (default) EVT: 79.170.119.178 Triggered active open for peer&#xA;2014 Dec 25 12:16:04.393294 bgp: 25286 [1191] (default) EVT: 79.170.119.178 went from Idle to Active (Acti ve setup)&#xA;2014 Dec 25 12:16:04.395711 bgp: 25286 [1191] (default) EVT: 79.170.119.178 Schedule wait for connect&#xA;2014 Dec 25 12:16:04.395730 bgp: 25286 [1191] (default) EVT: 79.170.119.178 Wait (5 sec) for session setup response&#xA;2014 Dec 25 12:16:04.967477 bgp: 25286 [1191] (default) EVT: 79.170.119.178 connect to peer is successful&#xA;2014 Dec 25 12:16:04.967497 bgp: 25286 [1191] (default) EVT: 79.170.119.178 sending OPEN message to peer&#xA;2014 Dec 25 12:16:04.967513 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 Sending OPEN, version 4, AS 25 286, hold-time 180, router-id 79.170.112.13&#xA;2014 Dec 25 12:16:04.967527 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending (old) dynamic capabili ty (66/0) to peer&#xA;2014 Dec 25 12:16:04.967540 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending dynamic capability (67 /3) to peer&#xA;2014 Dec 25 12:16:04.967552 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending (old) route refresh ca pability (128/0) to peer&#xA;2014 Dec 25 12:16:04.967565 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending route refresh capabili ty (2/0) to peer&#xA;2014 Dec 25 12:16:04.967578 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending [IPv4 Unicast] capabil ity (1/4) to peer&#xA;2014 Dec 25 12:16:04.967591 bgp: 25286 [1191] (default) ADJ: my restart time 120 restart state 0&#xA;2014 Dec 25 12:16:04.967603 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending graceful restart capab ility (64/6) to peer&#xA;2014 Dec 25 12:16:04.967616 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending 4-byte AS capability ( 65/4) to peer&#xA;2014 Dec 25 12:16:04.967626 bgp: 25286 [1191] Hexdump at 0x8338d5c, 62 bytes:&#xA;2014 Dec 25 12:16:04.967641 bgp: 25286 [1191]      FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF&#xA;2014 Dec 25 12:16:04.967655 bgp: 25286 [1191]      003E0104 62C600B4 4FAA700D 21021F42&#xA;2014 Dec 25 12:16:04.967669 bgp: 25286 [1191]      00430302 01408000 02000104 00010001&#xA;2014 Dec 25 12:16:04.967682 bgp: 25286 [1191]      40060078 00010100 41040000 62C6&#xA;2014 Dec 25 12:16:04.972618 bgp: 25286 [1191] (default) EVT: 79.170.119.178 went from Active to OpenSent ( Active setup)&#xA;2014 Dec 25 12:16:04.972646 bgp: 25286 [1191] (default) EVT: 79.170.119.178 Wait (5 sec) for session setup response&#xA;2014 Dec 25 12:16:04.974110 bgp: 25286 [1191] (default) EVT: Peer 79.170.119.178 closed connection&#xA;2014 Dec 25 12:16:04.974129 bgp: 25286 [1191] (default) EVT: 79.170.119.178 Error session closed (during s ession open) in session to peer, value 0, state OpenSent&#xA;2014 Dec 25 12:16:04.974147 bgp: 25286 [1191] (default) EVT: [IPv4 Unicast] 79.170.119.178 GR state: none, saved flags: 0&#xA;2014 Dec 25 12:16:04.974162 bgp: 25286 [1191] (default) EVT: 79.170.119.178 cleaning up active peer setup, thread id 0x0&#xA;2014 Dec 25 12:16:04.974224 bgp: 25286 [1191] EVT: Starting fd_close processing 45702&#xA;2014 Dec 25 12:16:06.560128 bgp: 25286 [1191] (default) EVT: Connection request from peer 79.170.119.178 p ort 3196 fd 51, vrf default&#xA;2014 Dec 25 12:16:06.560944 bgp: 25286 [1191] (default) EVT: 79.170.119.178 went from Idle to Connect (Pas sive setup)&#xA;2014 Dec 25 12:16:06.560962 bgp: 25286 [1191] (default) EVT: 79.170.119.178 sending OPEN message to peer&#xA;2014 Dec 25 12:16:06.560977 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 Sending OPEN, version 4, AS 25 286, hold-time 180, router-id 79.170.112.13&#xA;2014 Dec 25 12:16:06.560990 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending (old) dynamic capabili ty (66/0) to peer&#xA;2014 Dec 25 12:16:06.561003 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending dynamic capability (67 /3) to peer&#xA;2014 Dec 25 12:16:06.561017 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending (old) route refresh ca pability (128/0) to peer&#xA;2014 Dec 25 12:16:06.561030 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending route refresh capabili ty (2/0) to peer&#xA;2014 Dec 25 12:16:06.561044 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending [IPv4 Unicast] capabil ity (1/4) to peer&#xA;2014 Dec 25 12:16:06.561056 bgp: 25286 [1191] (default) ADJ: my restart time 120 restart state 0&#xA;2014 Dec 25 12:16:06.561068 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending graceful restart capab ility (64/6) to peer&#xA;2014 Dec 25 12:16:06.561081 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending 4-byte AS capability ( 65/4) to peer&#xA;2014 Dec 25 12:16:06.561092 bgp: 25286 [1191] Hexdump at 0x8338d5c, 62 bytes:&#xA;2014 Dec 25 12:16:06.561107 bgp: 25286 [1191]      FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF&#xA;2014 Dec 25 12:16:06.561121 bgp: 25286 [1191]      003E0104 62C600B4 4FAA700D 21021F42&#xA;2014 Dec 25 12:16:06.561135 bgp: 25286 [1191]      00430302 01408000 02000104 00010001&#xA;2014 Dec 25 12:16:06.561149 bgp: 25286 [1191]      40060078 00010100 41040000 62C6&#xA;2014 Dec 25 12:16:06.561386 bgp: 25286 [1191] (default) EVT: 79.170.119.178 went from Connect to OpenSent (Passive setup)&#xA;2014 Dec 25 12:16:06.561407 bgp: 25286 [1191] (default) EVT: 79.170.119.178 Wait (5 sec) for session setup response&#xA;2014 Dec 25 12:16:06.974556 bgp: 25286 [1191] (default) EVT: 79.170.119.178 Process OPEN message from peer&#xA;2014 Dec 25 12:16:06.974575 bgp: 25286 [1191] Hexdump at 0x8338d5c, 29 bytes:&#xA;2014 Dec 25 12:16:06.974591 bgp: 25286 [1191]      FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF&#xA;2014 Dec 25 12:16:06.974604 bgp: 25286 [1191]      001D0104 62C600B4 4FAA77AB 00&#xA;2014 Dec 25 12:16:06.974624 bgp: 25286 [1191] (default) ADJ: 79.170.119.178 sending first KEEPALIVE to pee r&#xA;2014 Dec 25 12:16:06.976266 bgp: 25286 [1191] (default) EVT: 79.170.119.178 went from OpenSent to OpenConf irm (Passive setup)&#xA;2014 Dec 25 12:16:06.976285 bgp: 25286 [1191] (default) EVT: 79.170.119.178 Wait (5 sec) for session setup response&#xA;2014 Dec 25 12:16:06.977226 bgp: 25286 [1191] (default) ADJ: Expected first keepalive from 79.170.119.178, got msg type 3&#xA;2014 Dec 25 12:16:06.977245 bgp: 25286 [1191] (default) EVT: Received NOTIFICATION unsupported optional pa ram error (0) from 79.170.119.178&#xA;2014 Dec 25 12:16:06.977267 bgp: 25286 [1191] (default) EVT: Reset by peer (unsupported optional param err or (0)) in session to 79.170.119.178, value 0, state was OpenConfirm&#xA;2014 Dec 25 12:16:06.977284 bgp: 25286 [1191] (default) EVT: [IPv4 Unicast] 79.170.119.178 GR state: none, saved flags: 0&#xA;2014 Dec 25 12:16:06.977298 bgp: 25286 [1191] (default) EVT: 79.170.119.178 cleaning up passive peer setup , thread id 0x0&#xA;2014 Dec 25 12:16:06.977356 bgp: 25286 [1191] EVT: Starting fd_close processing 45703&#xA;q2014 Dec 25 12:16:09.502893 bgp: 25286 [1191] (default) EVT: 212.73.206.121 keepalive timer fired for pee r&#xA;2014 Dec 25 12:16:09.502918 bgp: 25286 [1191] (default) ADJ: 212.73.206.121 sending KEEPALIVE&#xA;2014 Dec 25 12:16:09.503650 bgp: 25286 [1191] (default) EVT: 212.73.206.121 next keepalive expiry due in 0 0:00:29&#xA;&#xA;        ^&#xA;% Invalid command at '^' marker.&#xA;Nexus1# 2014 Dec 25 12:16:12.002923 bgp: 25286 [1191] EVT: Executing bgp_damp_timer_callback&#xA;2014 Dec 25 12:16:12.549401 bgp: 25286 [1191] (default) ADJ: 212.73.206.121 KEEPALIVE rcvd&#xA;&#xA;Nexus1# 2014 Dec 25 12:16:18.103086 bgp: 25286 [1191] (default) EVT: 79.170.119.162 keepalive timer fired for peer&#xA;2014 Dec 25 12:16:18.103107 bgp: 25286 [1191] (default) ADJ: 79.170.119.162 sending KEEPALIVE&#xA;2014 Dec 25 12:16:18.109973 bgp: 25286 [1191] (default) EVT: 79.170.119.162 next keepalive expiry due in 0 0:00:59&#xA;2014 Dec 25 12:16:18.110002 bgp: 25286 [1191] (default) EVT: 79.170.119.236 keepalive timer fired for peer&#xA;2014 Dec 25 12:16:18.110022 bgp: 25286 [1191] (default) ADJ: 79.170.119.236 sending KEEPALIVE&#xA;2014 Dec 25 12:16:18.110050 bgp: 25286 [1191] (default) EVT: 79.170.119.236 next keepalive expiry due in 0 0:00:59&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Did anyone here had a similar situation and does know which parameters is not supported?&lt;/p&gt;&#xA;" OwnerUserId="2665" LastEditorUserId="2461" LastEditDate="2014-12-25T11:44:05.870" LastActivityDate="2014-12-26T04:47:45.623" Title="bgp: session with 79.170.119.177 failed (OPEN Message Error : Unsupported Opt Param" Tags="|cisco|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14815" PostTypeId="1" CreationDate="2014-12-25T11:43:08.413" Score="3" ViewCount="587" Body="&lt;p&gt;i have the following network: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WLGRf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WLGRf.png&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lower right router shall be my dhcp server (net 192.168.2.0/24 - ip 192.168.2.3)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It shall provide IPs for the upper left and lower left PCs and Printers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lower left net: 192.168.1.0/24 The upper left: 192.168.0.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured the ip helper-address 192.168.2.3 on the lower left routers for vlan 2 interface witch is the one connected to the switches&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i wireshark the connection i cann see the DHCP discover message reaching the router in the lower right. The problem is: i don't get a reply from the dhcp server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the config of it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address 192.168.1.1 192.168.1.30&#xA;&#xA;ip dhcp pool area1&#xA;network 192.168.1.0 255.255.255.0&#xA;! (192.168.1.2 is the vlan interface of the lower left router)&#xA;default-router 192.168.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT// Just found out that my DHCP Server 'prentends' sending out dhcp offers ... but they never reach the client or even the next router as you can see on this wireshark snap:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5coBp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5coBp.jpg&quot; alt=&quot;DHCP&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And additionally if i enter 'show ip dhcp binding' the server did assign an ip (192.168.1.31) to the correct mac address .... but it just never reached the client&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another question: Is there a possibility to put the second interface of the dhcp server into the same subnet for redundancy reasons?&lt;/p&gt;&#xA;" OwnerUserId="12047" LastEditorUserId="775" LastEditDate="2014-12-25T20:04:20.460" LastActivityDate="2014-12-25T20:04:57.610" Title="Cisco DHCP discover with multiple routers - dhcp discover without reply" Tags="|cisco|router|dhcp|ip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14816" PostTypeId="2" ParentId="14815" CreationDate="2014-12-25T17:21:17.343" Score="2" Body="&lt;p&gt;I solved my problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i was able to ping the dhcp router via the lower left router but never tried vise versa. I assumed as the dhcp discover can reach the router there shouldn't be a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually the 192.168.1.0 net was missing in the lower left eigrp tables, and the dhcp discover could only reach the server 'cos of the ip helper-address...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should have tried it for the upper left ones earlier, because everything was fine there, it took me far to long to figure this out -.- &lt;/p&gt;&#xA;" OwnerUserId="12047" LastEditorUserId="775" LastEditDate="2014-12-25T20:04:57.610" LastActivityDate="2014-12-25T20:04:57.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14817" PostTypeId="2" ParentId="11097" CreationDate="2014-12-25T21:09:28.680" Score="2" Body="&lt;p&gt;If You don't configure the source address and send the packet to 10.0.1.11, it routed by the default route, and will get the source address from interface attached to the default GW (I suspect 208.46.133.129) automatically, but not 10.5.0.1. Something in the configuration of network (routes, ACLs, IPSec policy, MPLS filters ...) prevents to communication from this address.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="775" LastEditDate="2014-12-25T23:21:49.677" LastActivityDate="2014-12-25T23:21:49.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14819" PostTypeId="2" ParentId="10825" CreationDate="2014-12-26T00:57:34.353" Score="1" Body="&lt;p&gt;You have a few options, two of which in particular come to mine.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Solution 1&lt;/strong&gt;&lt;BR /&gt;&#xA;Many times, when a Vendor says &quot;no &lt;em&gt;NAT&lt;/em&gt; is allowed&quot;, they really mean &quot;no &lt;strong&gt;PAT&lt;/strong&gt; is allowed&quot;.  This is typically because of a PAT being, by definition, unidirectional. In most VPN type systems, both peers need to be able to initiate traffic to the other, which isn't possible in a unidirectional communication system, like PAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, the solution is to give your Checkpoint Firewall a Private address, say 192.168.1.25.  Then create a &lt;strong&gt;Static NAT&lt;/strong&gt; on your ASA to translate 192.168.1.25 to one of the IPs in the additional /30 your ISP has assigned.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the VPN configuration perspective, the remote end will use the Public /30 address as their &quot;opposing peer&quot;, and you will use the other end's IP address as your &quot;opposing peer&quot;.  Then, as long as NAT Traversal is enabled (which it typically is by default, but I can only confirm that on the Cisco ASA), the VPN tunnel should be able to build through the Static NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is your ideal solution, I would suggest going this route if you can.  Mainly, because you are holding in reserve the other 3 IPs of the 4 they gave you in the /30.  But, if you see no use for these, now or in the future, Solution 2 might work out for you:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Solution 2&lt;/strong&gt;&lt;BR /&gt;&#xA;Use the /30 assigned by your ISP as its own &quot;transit&quot; network between the ASA and Checkpoint.  You'll need an additional interface on the ASA, or you could have the same effect with a Trunk configuration.  The ASA will have two segments off it, the transit network, and the DMZ network.  Then your &quot;inside&quot; network will simply be &quot;behind&quot; the Checkpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was going to try to explain this with text, but I figured a picture was easier.  I made up the IPs, since you didn't provide them:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/951e7.png&quot; alt=&quot;Transient /30 network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could either use Identity NAT on the ASA to allow the traffic through un-natted, or simply configure a NAT Exemption for the /30 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All other options beyond this require a bit of creativity, but are probably considered non-standard, and as such should be avoided unless the solutions above don't work.  If they don't, please provide specific details as to why, so we can try to provide additional solutions.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-12-26T00:57:34.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14820" PostTypeId="2" ParentId="14813" CreationDate="2014-12-26T04:47:45.623" Score="3" Body="&lt;p&gt;See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4271#section-6.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4271 Section 6.2&lt;/a&gt;, specifically:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If one of the Optional Parameters in the OPEN message is recognized,&#xA;but is malformed, then the Error Subcode MUST be set to 0&#xA;(Unspecific).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Ideally debug output from the Nortel would be more useful here, but it's obvious the Nortel isn't liking a BGP capability that the Nexus is sending. There's no real way to tell which of those options is triggering the error unless you get similar debug output from the Nortel device, but I would start with disabling those optional parameters on the Nexus for that peer - stuff like route refresh and/or 4-byte ASNs. Might also help to disable all parameters on the Nexus just to get the BGP session to come up, then start enabling them one at a time until you get the error to figure out which optional capability is causing the problem.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2014-12-26T04:47:45.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14824" PostTypeId="1" AcceptedAnswerId="14839" CreationDate="2014-12-26T10:14:05.600" Score="6" ViewCount="16690" Body="&lt;p&gt;I have two routers, AS50 and AS100, both are under my control. Since they are using different ASN, they should be eBGP routers. These two routers are connected by internet VPN and lease line, which means dual path between these two routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lease line will take higher preference on packet routing while internet VPN will act as backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;According to my reading, Local pref seems only applicable to iBGP not eBGP router, is this correct?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I am currently using prepend AS-path out method on both router, so the packet cover bidirectional routing. It seems work fine and I tested couple time on connection lost, BGP pick up change very quickly. But it did have couple packet loss in between. So when internet backup link in service, the primary link is recover, it will take couple packet loss before switching to primary link, is it possible to tell BGP test and ensure the primary link is functional before switching back from internet VPN backup link?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;prepend always use &quot;out&quot; direction, is there have any real situation which prepend &quot;in&quot; could be use?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;what will happen if I accidentally use local pref on eBGP routers instead of prepend?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4479" LastEditorUserId="775" LastEditDate="2014-12-27T15:08:35.140" LastActivityDate="2024-01-28T00:37:57.383" Title="Local pref VS prepend AS-path for two eBGP router" Tags="|cisco|routing|ipv4|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14828" PostTypeId="1" AcceptedAnswerId="14829" CreationDate="2014-12-26T14:52:48.967" Score="5" ViewCount="1500" Body="&lt;p&gt;I'm currently learning the IPv6 tunneling via IPv4 in GNS3. I've done manual tunnels, 6to4 and now I'm tackling 6rd.&#xA;I've read on the subject and I think I get the whole concept..The IPv6 prefix, the common IPv4 suffix/prefix etc.&#xA;Then I've read a config example on the web &lt;a href=&quot;http://docwiki.cisco.com/w/index.php?title=6rd_Configuration_Example&amp;amp;oldid=48585#CE&quot; rel=&quot;noreferrer&quot;&gt;&gt;&gt;here&amp;lt;&amp;lt;&lt;/a&gt;. What I have hard time to comprehend is the whole &lt;code&gt;ipv6 general-prefix&lt;/code&gt; options. Could someone explain these two lines from the CE config?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ipv6 general-prefix DELEGATED_PREFIX 6rd Tunnel0&lt;/li&gt;&#xA;&lt;li&gt;ipv6 address DELEGATED_PREFIX ::/128 anycast (on int Tunnel 0)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;maybe this as well:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ipv6 address DELEGATED_PREFIX ::/64 eui-64 (on int Ethernet 0)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="12057" LastActivityDate="2014-12-26T15:44:43.293" Title="Cisco 6rd configuration example - ipv6 general-prefix" Tags="|cisco|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14829" PostTypeId="2" ParentId="14828" CreationDate="2014-12-26T15:44:43.293" Score="6" Body="&lt;pre&gt;&lt;code&gt;ipv6 general-prefix DELEGATED_PREFIX 6rd Tunnel0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This line defines &lt;code&gt;DELEGATED_PREFIX&lt;/code&gt;. It automatically calculates the IPv6 prefix based on the 6rd settings of the &lt;code&gt;Tunnel0&lt;/code&gt; interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 address DELEGATED_PREFIX ::/128 anycast (on int Tunnel 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This line sets an IPv6 address on the &lt;code&gt;Tunnel0&lt;/code&gt; interface using the &lt;code&gt;DELEGATED_PREFIX&lt;/code&gt; defined before. It tells the router to take the prefix, leave the other bits zero (&lt;code&gt;::&lt;/code&gt;) and configure it as a single anycast address. The &lt;code&gt;anycast&lt;/code&gt; flag tells the router that the address may be used on multiple devices at the same time. It will therefore not perform any Duplicate Address Detection (not really relevant for a tunnel interface) and it will not use that address as a source address (because the return traffic might end up at one of the other anycast nodes).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 address DELEGATED_PREFIX ::/64 eui-64 (on int Ethernet 0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This does the same for the &lt;code&gt;Ethernet0&lt;/code&gt; interface. It uses the &lt;code&gt;DELEGATED_PREFIX&lt;/code&gt; to give an address to the interface. One problem is that you're using the same subnet on the tunnel interface. You should use separate subnets for different interfaces. The &lt;code&gt;eui-64&lt;/code&gt; flag tells the router to generate the last 64 bits of the interface address based on its MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example to (hopefully) make things clearer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take the 6rd settings from the example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;6rd IPv4 prefix: 10.0.0.0/8&lt;/li&gt;&#xA;&lt;li&gt;6rd IPv6 prefix: 2001:db80::/28&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then if your router has IPv4 address &lt;code&gt;10.0.0.10&lt;/code&gt; you will get IPv6 prefix &lt;code&gt;2001:db80:0:a000::/52&lt;/code&gt;. The &lt;code&gt;/8&lt;/code&gt; in the IPv4 prefix means that the first 8 bits are fixed. So when constructing the IPv6 prefix it will only use the last 24 (32 - 8) bits from the IPv4 address. These have binary value &lt;code&gt;0000 0000 0000 0000 0000 1010&lt;/code&gt;. When written in hexadecimal that is &lt;code&gt;00 00 0a&lt;/code&gt;. This is appended to the &lt;code&gt;/28&lt;/code&gt; IPv6 prefix, giving a &lt;code&gt;/52&lt;/code&gt; (28 + 24).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;DELEGATED_PREFIX&lt;/code&gt; will get value &lt;code&gt;2001:db80:0:a000::/52&lt;/code&gt;. Therefore the &lt;code&gt;Tunnel0&lt;/code&gt; interface will get address &lt;code&gt;2001:db80:0:a000::/128&lt;/code&gt; and the &lt;code&gt;Ethernet0&lt;/code&gt; interface will get something like &lt;code&gt;2001:db80:0:a000:1234:56ff:fe78:90ab/64&lt;/code&gt; (assuming MAC address &lt;code&gt;12.34.56.78.90.ab&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be better to give the ethernet interface an address from a different subnet, like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 address DELEGATED_PREFIX 0:0:0:1::/64 eui-64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That would result in &lt;code&gt;2001:db80:0:a001:1234:56ff:fe78:90ab/64&lt;/code&gt;. And if you don't want to make the address dependent on the MAC address you can also just give it a fixed address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 address DELEGATED_PREFIX 0:0:0:1::1/64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That would result in &lt;code&gt;2001:db80:0:a001::1/64&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2014-12-26T15:44:43.293" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14830" PostTypeId="2" ParentId="11153" CreationDate="2014-12-26T19:47:02.887" Score="1" Body="&lt;p&gt;I believe st0.0 must be part of the Trusted lan not the Untrusted as you want to inject traffic into that tunnel. And you mixed up the naming as created an st0.0 but using st0.1 which doesn't exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interfaces {&#xA;   ge-0/0/0.0;&#xA;        st0.0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But here :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interfaces {&#xA;   ge-0/0/1.0;&#xA;            }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You cannot sent data to st0.1 as doesn't exist&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routing-options {&#xA;    static {                            &#xA;        route 0.0.0.0/0 next-hop 1.1.1.1;&#xA;        route 10.10.10.0/24 next-hop st0.1;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12060" LastEditorUserId="12060" LastEditDate="2014-12-26T19:53:47.077" LastActivityDate="2014-12-26T19:53:47.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14833" PostTypeId="2" ParentId="14824" CreationDate="2014-12-26T23:08:00.627" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;Correct.  localpref is not sent to eBGP peers.&lt;/li&gt;&#xA;&lt;li&gt;BGP by itself only checks that a route to the destination exists in the routing table.  There are other ways to verify functionality.  If you're using a Cisco router, you can use IP SLA and object tracking or Performance Routing.  Other brands of routers have similar functions.&lt;/li&gt;&#xA;&lt;li&gt;No.  Prepend doesn't modify received AS-PATH attributes.&lt;/li&gt;&#xA;&lt;li&gt;See #1.  local pref is not sent to eBGP peers.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Since both routers are under your control, you can set the MED attribute with the command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bgp always-compare-med&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;instead of using as-path length.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-12-26T23:08:00.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14839" PostTypeId="2" ParentId="14824" CreationDate="2014-12-27T15:13:25.097" Score="10" Body="&lt;p&gt;Most of your confusion seems to be related to your other &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/14837/bgp-prepend-question&quot;&gt;duplicate question&lt;/a&gt;, which is the same as 3. above...:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;prepend AS path usually running with route-map out to adjust outbound traffic from router which contain this option&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I'm sorry, but you are mistaken; prepending your ASN out adjusts traffic &lt;em&gt;inbound&lt;/em&gt; to your ASN.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Does prepend work with route-map in at all to adjust inbound traffic?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, it does, but prepending inbound bgp routes influences &lt;em&gt;outbound traffic flow&lt;/em&gt; from your BGP router.  This is an example prepend in BGP policy to prepend 5 more of the last-as in the received AS path for an eBGP neighbor...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;route-map FOO_in permit 10&#xA; set as-path prepend last-as 5&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Let's clarify some things...&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;neighbor x.x.x.x route-map FOO_out out&lt;/code&gt; adjusts traffic &lt;em&gt;inbound&lt;/em&gt; to your ASN.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;neighbor x.x.x.x route-map FOO_in in&lt;/code&gt; adjusts traffic &lt;em&gt;outbound&lt;/em&gt; from your ASN; use local-preference or some other criteria to influence your outbound traffic.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;em&gt;Example configuration:&lt;/em&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list MATCH_ALL permit 0.0.0.0/0&#xA;!&#xA;route-map nei_AS100_routes_out&#xA; match ip address prefix-list MATCH_ALL&#xA; ! --&amp;gt; Prepend so other ASN don't prefer this path&#xA; !     NOTE: don't do this... 20 prepends is absurd in the real world.&#xA; !          Five or ten ASN prepends should be sufficient&#xA; set ip as-path prepend 65001 65001 65001 65001 65001&#xA;!&#xA;route-map nei_AS100_routes_in&#xA; match ip address prefix-list MATCH_ALL&#xA; ! --&amp;gt; Set local-pref lower than 100, so we don't prefer this peer&#xA; set local-preference 50&#xA;!&#xA;router bgp 777&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; !&#xA; neighbor 192.0.2.2 remote-as 100&#xA; !&#xA; address-family ipv4 unicast&#xA;  network 10.0.0.0 mask 255.255.0.0&#xA;  neighbor 192.0.2.2 activate&#xA;  ! --&amp;gt; nei_AS100_routes_out adjusts *inbound* traffic&#xA;  neighbor 192.0.2.2 route-map nei_AS100_routes_out out&#xA;  ! --&amp;gt; nei_AS100_routes_in adjusts *outbound* traffic&#xA;  neighbor 192.0.2.2 route-map nei_AS100_routes_in in&#xA; exit-address-family&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;NOTE: Prepending is deceptive; it might seem like nobody should select a path if you have prepended a lot of ASNs to your announcements, but even if you did that's no guarantee that downstream routers won't send traffic to you over that prepended path.  The reality is that internet routing is still a &lt;em&gt;per-hop / per-ASN&lt;/em&gt; decision, and you're still somewhat at the mercy of others.  See below for an example.&lt;/p&gt;&#xA;&lt;h1&gt;Problems with AS-prepend traffic engineering&lt;/h1&gt;&#xA;&lt;p&gt;Strictly speaking, you loose complete control of inbound routing paths when you announce your prefix to multiple providers because there are independent routing decisions made downstream for return traffic to you.  Furthermore, your announcements could even be modified by downstream providers after you send them.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is one example of what can happen.  Continuing with the example configuration shown above...&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Suppose you have AS 777; you got a portable address block (2.2.0.0/22) from AS 100.&lt;/li&gt;&#xA;&lt;li&gt;You are dual homed to both AS 100 and AS 200&lt;/li&gt;&#xA;&lt;li&gt;You have services that a company with Router A needs to access.&lt;/li&gt;&#xA;&lt;li&gt;Assume that AS 100 doesn't have a good link to you (maybe it's intermittently corrupting traffic due to physical-layer problems you haven't been able to fix).  So you think to yourself, &lt;em&gt;&amp;quot;I'll just prepend all my announcements to AS100 with a large number of ASNs so nobody will prefer the AS100 link until I can fix this&amp;quot;&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0vmvG.png&quot; alt=&quot;bgp asymmetric&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;The problem is that you only have complete control of your &lt;em&gt;outbound routing decisions&lt;/em&gt;.  You don't get complete control inbound... so let's suppose Router A's administrator doesn't know your link to AS100 is bad.  They are dual-homed to AS200 and AS100, but AS100 offers much cheaper transit, per-Mbps; therefore Router A's engineer takes full routes from AS100 and only uses AS200 as a backup (taking only a default from them).&lt;/p&gt;&#xA;&lt;p&gt;AS 100's engineering team decides to set a high local-pref for 2.2.2.0/22 announcements from you.  As such , the combination of full routes at router A and AS 100’s local pref means that you’ve lost control for ingress traffic through AS 100 to AS 777.&lt;/p&gt;&#xA;&lt;p&gt;To summarize, As the admin of AS 777, you can force AS 777’s egress traffic to Router A through AS 200, but traffic from Router A to 2.2.0.0/22 would still take AS 100 (because the best route is through AS 100, at Router A).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2024-01-28T00:37:57.383" LastActivityDate="2024-01-28T00:37:57.383" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="14840" PostTypeId="1" AcceptedAnswerId="14882" CreationDate="2014-12-27T21:50:00.917" Score="1" ViewCount="4824" Body="&lt;p&gt;So i have a customer who purchased 5 HP 1910 switches (4 24port and 1 8port switch). They currently have a flat network using 192.168.80.x/24 subnet. They are adding voice and wanto to segregate their network using vlans. It's been a while since i've configured HP switches (these are web based GUI's) and i wanted to confirm my config appears correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Managment: Vlan1 - 10.10.1.X/28&lt;br/&gt;&#xA;Data: Vlan10 - 192.168.80.X/24&lt;br/&gt;&#xA;Voice: Vlan20 - 172.16.80.X&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Router (running BGP) &gt; Core switch &gt; 4 distribution switches &gt; LAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using 1 of the 24port 1910's as a Layer 3 Core switch i've configured it the folowing way:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IP: 10.10.1.2&lt;/li&gt;&#xA;&lt;li&gt;Port 28: SFP Trunk port to the 8port HP 1910 switch connected via Fiber&lt;/li&gt;&#xA;&lt;li&gt;Port 24: Trunk port to the Cisco Router (should this be a trunk or &quot;Hybrid&quot; port?)&lt;/li&gt;&#xA;&lt;li&gt;Port 23: Trunk port connected to the 2nd 24port HP1910 switch&lt;/li&gt;&#xA;&lt;li&gt;Port 22: Trunk port connected to the 3rd 24port HP1910 switch&lt;/li&gt;&#xA;&lt;li&gt;Port 21: Trunk port connected to the 4th 24port HP1910 switch&lt;/li&gt;&#xA;&lt;li&gt;Configured Vlan10 with IP 192.168.80.X with IP helper going to a remote site DHCP server&lt;/li&gt;&#xA;&lt;li&gt;Configured Vlan20 with IP 172.168.80.X with IP helper going to a remote site DHCP server&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the Distribution switches they configured as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2nd: IP 10.10.1.3&lt;/li&gt;&#xA;&lt;li&gt;3rd: IP 10.10.1.4&lt;/li&gt;&#xA;&lt;li&gt;4th: IP 10.10.1.5&lt;/li&gt;&#xA;&lt;li&gt;5th (remote): IP 10.10.1.6&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Switches 2-4 are configured identically:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ports 1-23 are untagged in Vlan1 and 10, tagged in Vlan20 with PVID 1&lt;/li&gt;&#xA;&lt;li&gt;Port 24 is the uplink port to the core switch configured as a trunk&lt;/li&gt;&#xA;&lt;li&gt;I've configured the Vlan's on the switch as well but did not assign them IP's (i set to to &quot;DHCP&quot;) assuming they would get their IP's from the DHCP server&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Switch 5:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Port 1-8 are untagged in Vlan1 and 10, tagged in Vlan20 with PVID 1&lt;/li&gt;&#xA;&lt;li&gt;Port 9 is the uplink port to the core switch configured as a trunk with a fiber SFP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My question really is will it work the way i think it should? IE if i plug a PC in any of the distribution switches it should grab a Vlan10 IP, likewise if i plug a phone into a port it should grab a Vlan20 IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it stands i can ping the distribution switches from the core and vice versa. I didn't have any way of testing the Vlan's. I'm a little confused as when to use a Trunk port and when to use a Hybrid port as HP's terminology differs from Cisco's.&lt;/p&gt;&#xA;" OwnerUserId="12069" LastEditorUserId="619" LastEditDate="2014-12-30T02:06:15.020" LastActivityDate="2015-08-27T07:20:14.073" Title="HP 1910 Configuration Question" Tags="|vlan|hp-procurve|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14841" PostTypeId="1" CreationDate="2014-12-28T02:26:47.207" Score="8" ViewCount="761" Body="&lt;p&gt;In the IP packet header there is an 8-bit Protocol field (at offset 9) that holds the &quot;next level protocol&quot;, with assigned numbers given in RFC 790. For example, TCP is 6. My question is, why is the IP layer aware of higher layers in the network stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZPUnf.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10751" LastEditorUserId="8499" LastEditDate="2018-12-27T01:39:11.247" LastActivityDate="2020-12-20T02:49:49.587" Title="Why is the IP layer aware of higher layers in the network stack?" Tags="|ipv4|tcp|layer3|layer4|rfc|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14842" PostTypeId="2" ParentId="14841" CreationDate="2014-12-28T03:18:15.910" Score="2" Body="&lt;p&gt;The IPv4 protocol field allows the endpoint to determine what type of data is in the packet. The endpoint's IP layer uses the protocol field to determine which protocol to hand the packet off to.&lt;/p&gt;&#xA;" OwnerDisplayName="user6423" LastEditorUserId="775" LastEditDate="2014-12-28T08:17:47.410" LastActivityDate="2014-12-28T08:17:47.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14843" PostTypeId="1" CreationDate="2014-12-28T05:13:15.050" Score="3" ViewCount="2319" Body="&lt;p&gt;How to verify Firewall Session Table or Stateful database entries on Cisco Zone Based Firewall configured Boxes? what's the command to show the content/records of that table? is there any command like the NAT table show commands or what?&lt;/p&gt;&#xA;" OwnerUserId="7741" LastActivityDate="2015-08-27T06:20:24.903" Title="How to verify Firewall Session Table or Stateful database entries on Cisco ZBF configured Boxes?" Tags="|cisco|firewall|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14844" PostTypeId="1" AcceptedAnswerId="14847" CreationDate="2014-12-28T06:01:00.317" Score="3" ViewCount="377" Body="&lt;p&gt;I am aware of MAC address filtering available on most wifi access points, but mac filtering doesn't establish a user identity, it only controls access on a device by device basis.  One user may have many devices, so mac filtering doesn't scale well.  Is there any way to control network access on per-user basis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What authentication scheme should be used to control network access where each user has their own password, and access to the network can be revoked across all their devices by revoking their login credentials?&lt;/p&gt;&#xA;" OwnerUserId="12015" LastEditorUserId="775" LastEditDate="2014-12-28T15:28:06.813" LastActivityDate="2014-12-28T15:28:06.813" Title="Per-user network authentication without mac-filtering" Tags="|wireless|security|authentication|ieee-802.1x|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14846" PostTypeId="2" ParentId="14841" CreationDate="2014-12-28T07:07:56.627" Score="10" Body="&lt;p&gt;Every &quot;header&quot; has some sort of &quot;Next Protocol&quot; identification field.  This is necessary because on the wire, the data is nothing but a string of 1's and 0's.  The receiving endpoint must have a way of interpreting what the next bits refer to.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not for such a field which definitively indicates how to interpret the next set of 1's and 0's, there would be no way of determining if the next 32 bits were a TCP Sequence number or the IP Source Address (for instance).  Both those fields are indeed 32 bits, so there is no way to programmatically determine what those 1's and 0's actually mean -- other than some sort of &quot;Next Protocol&quot; field.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2014-12-28T15:37:28.593" LastActivityDate="2014-12-28T15:37:28.593" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14847" PostTypeId="2" ParentId="14844" CreationDate="2014-12-28T08:25:52.607" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am aware of MAC address filtering available on most WiFi routers, but this is about access control on a device by device basis. One user may have many devices. Is there any way to control WiFi network access on a user by user basis?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Use &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1X&quot; rel=&quot;nofollow&quot;&gt;802.1X&lt;/a&gt; with &lt;a href=&quot;http://en.wikipedia.org/wiki/Protected_Extensible_Authentication_Protocol#PEAPv0_with_EAP-MSCHAPv2&quot; rel=&quot;nofollow&quot;&gt;PEAP/MSCHAPv2&lt;/a&gt;.  This authentication scheme will permit you to authenticate your users against a &lt;a href=&quot;http://en.wikipedia.org/wiki/RADIUS&quot; rel=&quot;nofollow&quot;&gt;RADIUS&lt;/a&gt; server which utilizes a central credential store, such as a local source (text file or database), &lt;a href=&quot;http://en.wikipedia.org/wiki/Active_Directory&quot; rel=&quot;nofollow&quot;&gt;MS ActiveDirectory&lt;/a&gt;, or &lt;a href=&quot;http://en.m.wikipedia.org/wiki/Lightweight_Directory_Access_Protocol&quot; rel=&quot;nofollow&quot;&gt;LDAP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In principle, you could also use other &lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1X&quot; rel=&quot;nofollow&quot;&gt;802.1X&lt;/a&gt; authentication methods, such as &lt;a href=&quot;http://en.wikipedia.org/wiki/Extensible_Authentication_Protocol#EAP-TLS&quot; rel=&quot;nofollow&quot;&gt;EAP-TLS&lt;/a&gt;; however, your question implies a desire for easy management, and EAP-TLS requires per-user TLS certificates installed on each client.  Managing individual TLS certificates is more maintenance than something like PEAP.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="33" LastEditDate="2014-12-28T14:36:30.500" LastActivityDate="2014-12-28T14:36:30.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14850" PostTypeId="2" ParentId="11184" CreationDate="2014-12-28T16:08:06.377" Score="4" Body="&lt;p&gt;To add to Ryan Foley's and iTom's great answers, I just wanted to mention a quick note from a non malicious or compromised host perspective.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In TCP, any packet that didn't make it through must be re-transmitted.  If I, as the sender, decide to ignore the Congestion indication from the Receiver, and continue to send traffic as fast as I can, I am only shooting myself in the foot because sooner or later the Receiver is going to request re-transmission and I'm going to have to do twice the work to send the same number of packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why you don't typically see senders ignoring congestion indications, because its beneficial to both parties (sender &lt;em&gt;and&lt;/em&gt; receiver) to obey the congestion control rules and slow down their transmission. &lt;em&gt;(Again, this is only relevant in a &lt;strong&gt;non-malicious&lt;/strong&gt; scenario -- see the other answers for the proper response to this happening under dubious circumstances)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way of looking at it:  If you're trying to fill a teacup with water using a fire-hose, its going to take considerably more effort and time then if you simply used a regular faucet.  &lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2014-12-28T16:08:06.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14853" PostTypeId="2" ParentId="10387" CreationDate="2014-12-28T17:26:14.190" Score="-5" Body="&lt;p&gt;Throughput as I understand it means transfer bits, that data that traverses your network, for example data going to and from your network to the Internet data in both directions would be the throughput or transfer bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good put seems to be related to a FTP command to place a file on a website, I could be wrong, but &quot;put&quot; and &quot;get&quot; are FTP commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LA Reid &lt;/p&gt;&#xA;" OwnerUserId="12078" LastActivityDate="2014-12-28T17:26:14.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14854" PostTypeId="2" ParentId="14841" CreationDate="2014-12-28T17:49:38.410" Score="0" Body="&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/OSI_model#Layer_3:_network_layer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Layer 3: Network layer&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The network layer provides the functional and procedural means of&#xA;  transferring variable length data sequences (called datagrams) from&#xA;  one node to another connected to the same network. A network is a&#xA;  medium to which many nodes can be connected, on which every node has&#xA;  an address and which permits nodes connected to it to transfer&#xA;  messages to other nodes connected to it by merely providing the&#xA;  content of a message and the address of the destination node and&#xA;  letting the network find the way to deliver (&quot;route&quot;) the message to&#xA;  the destination node. In addition to message routing, the network may&#xA;  (or may not) implement message delivery by splitting the message into&#xA;  several fragments, delivering each fragment by a separate route and&#xA;  reassembling the fragments, report delivery errors, etc.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Datagram delivery at the network layer is not guaranteed to be&#xA;  reliable. A number of layer-management protocols, a function defined&#xA;  in the management annex, ISO 7498/4, belong to the network layer.&#xA;  These include routing protocols, multicast group management,&#xA;  network-layer information and error, and network-layer address&#xA;  assignment. It is the function of the payload that makes these belong&#xA;  to the network layer, not the protocol that carries them.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Each layer supports the layers about it, that is the how the OSI Model is designed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JMFBR.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="12078" LastEditorUserId="33" LastEditDate="2014-12-29T16:07:32.240" LastActivityDate="2014-12-29T16:07:32.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14856" PostTypeId="1" AcceptedAnswerId="14864" CreationDate="2014-12-28T22:12:35.493" Score="7" ViewCount="16172" Body="&lt;p&gt;Can you give me an example when poison reverse is actually necessary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Distance vector routing protocols employ split horizon with poison reverse to minimize the convergence time when a route is no longer available. The thing is that I can't think of an example when poison reverse is actually useful.&lt;/p&gt;&#xA;" OwnerUserId="12080" LastActivityDate="2015-01-12T03:08:58.783" Title="Poison reverse example" Tags="|routing|protocol-theory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14858" PostTypeId="2" ParentId="14856" CreationDate="2014-12-29T00:55:09.960" Score="5" Body="&lt;p&gt;The only useful example I could find for split-horizon/poison-reverse is multi-access routed segments (point-to-multipoint frame relay or an ethernet segment with &amp;gt;2 routers).&lt;/p&gt;&#xA;&lt;p&gt;Both the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIP RFC&lt;/a&gt; (section 2.2.1), &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/16406-eigrp-toc.html#splithorizon&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's EIGRP doc&lt;/a&gt; and &lt;a href=&quot;http://www.juniper.net/techpubs/software/junos-es/junos-es92/junos-es-swconfig-interfaces-and-routing/split-horizon-and-poison-reverse-efficiency-techniques.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Juniper's RIP document&lt;/a&gt; all show multi-access examples.  Cisco's EIGRP RFC doesn't detail it's split horizon or poison-reverse implementation.&lt;/p&gt;&#xA;&lt;p&gt;---Edit to remove previous incorrect info---&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-01-12T03:08:58.783" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14861" PostTypeId="1" CreationDate="2014-12-29T13:32:48.273" Score="1" ViewCount="2771" Body="&lt;p&gt;Is there a way i can make HP 1910 works in layer 2 mode.&#xA;I check the web interface but not seeing anything&#xA;Also i enable the cli and went to system view but not seeing any thing related no ip routing or way to make the ports works in layer 2 mode ... my current setting requires layer 2 switch &#xA;Please help&lt;/p&gt;&#xA;" OwnerUserId="12086" LastEditorUserId="8499" LastEditDate="2018-03-21T00:54:37.580" LastActivityDate="2018-03-21T00:54:37.580" Title="HP 1910 disable layer 3 mode" Tags="|routing|switch|layer2|layer3|hp|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14862" PostTypeId="2" ParentId="13291" CreationDate="2014-12-29T13:40:04.717" Score="0" Body="&lt;p&gt;In our supplier, with around 1000 clients, segregation is done by VRF and MPLS, and in cases more specific by PVLAN. The bandwidth is controlled by Access Lists and QoS is applied to achieve adminsitracion traffic. But I understand that each provider segregates according to its criteria.&lt;/p&gt;&#xA;" OwnerUserId="10098" LastActivityDate="2014-12-29T13:40:04.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14864" PostTypeId="2" ParentId="14856" CreationDate="2014-12-29T15:30:32.710" Score="4" Body="&lt;p&gt;Consider the following topology:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;               A&#xA;             / |&#xA;Internet -- S  |&#xA;             \ |&#xA;               B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using RIP, S announces (0.0.0.0/0, 0), and both A and B announce (0.0.0.0/0, 1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose now that router S fails.  Suppose further that you're unlucky, and that A and B both switch their next hops to each other -- they create a routing loop.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;with plain Bellman-Ford, A and B have no way to get rid of the loop in a timely manner — they need to count to infinity;&lt;/li&gt;&#xA;&lt;li&gt;with split horizon, A and B immediately stop announcing the default route to each other — they get rid of the loop as soon as the route times out;&lt;/li&gt;&#xA;&lt;li&gt;with poison reverse, A and B announce an infinite metric default route to each other, which gets rid of the routing loop as soon as an update is successfully transmitted.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that poison reverse has a drawback ­— it increases the size of updates, sometimes dramatically so (especially from stub routers).  Note further that poison reverse only gets rid of loops of size two — in order to get rid of larger loops in a timely manner, you need a feasibility condition, as in EIGRP or Babel.&lt;/p&gt;&#xA;" OwnerUserId="12089" LastActivityDate="2014-12-29T15:30:32.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14865" PostTypeId="2" ParentId="13428" CreationDate="2014-12-29T15:42:30.443" Score="2" Body="&lt;p&gt;The simplest solution would be to refrain from assigning a prefix to the point-to-point link, and to use a link-local address as the next hop.&lt;/p&gt;&#xA;" OwnerUserId="12089" LastActivityDate="2014-12-29T15:42:30.443" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14866" PostTypeId="2" ParentId="13171" CreationDate="2014-12-29T16:20:34.920" Score="1" Body="&lt;p&gt;Yes, ARP is quadratic in the worst case.  This is the case of every flat routing protocol (and ARP can be seen as a degenerate routing protocol) — in order to get sub-quadratic scaling, you need some form of route summarisation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is actually a problem on your network, you should either split it into multiple networks connected by layer 3 routers (which can be seen as performing summarisation), or change your application to use multicast (which doesn't need ARP).&lt;/p&gt;&#xA;" OwnerUserId="12089" LastActivityDate="2014-12-29T16:20:34.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14868" PostTypeId="2" ParentId="13080" CreationDate="2014-12-29T16:29:21.363" Score="3" Body="&lt;p&gt;While is it probably not possible (or at least not easy) to know the set of devices in range, it is possible to know the set of devices that you can hear (which is not the same thing — you might hear them but they might not hear you, or they might be in range but not speaking).  This is done by putting the interface into &quot;monitor mode&quot;, where it passes to userspace all frames that it hears.  (Under Linux, at least, most hardware supports simultaneous AP and monitor mode).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is of course highly OS and hardware dependent, and using the information may require a fair amount of hacking.&lt;/p&gt;&#xA;" OwnerUserId="12089" LastActivityDate="2014-12-29T16:29:21.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14870" PostTypeId="1" AcceptedAnswerId="14884" CreationDate="2014-12-29T17:04:52.327" Score="4" ViewCount="4909" Body="&lt;p&gt;The SMB organization I work for is migrating to HP/3COM Comware L3 switches and we will be implementing the standard Core&gt;Distribution&gt;Access design.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please refer to this diagram for clarification:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dxQD7.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dxQD7.jpg&quot; alt=&quot;Network Design Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Cisco world, it's always been highly recommended to have layer 3 between distribution and core using a routing protocol.  Mainly due to avoiding blocked ports due to STP, faster convergence/fail over times, L2 loop prevention etc.  Also allowing inter-vlan traffic without sending traffic up to the core. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is:&lt;/strong&gt; Is the practice of implementing a 'layer 3 distribution to core' applicable today in the HP world when it's possible to have a highly redundant layer 2 to  the core without STP, using IRF?&lt;br&gt;&#xA;&lt;em&gt;I’ve researched a bit but can’t find clear guidance when it comes to specifically a core using IRF or equivalent.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’m torn between the ease of L2 and the wildly recommended L3 solution. Thanks very much for your help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further Information: In the layer 2 example, I would be tagging traffic all the way to routed interfaces on the core using inter-vlan routing.  This would allow me to do most of my configuration on the core without having to replicate it to the distribution - resulting in simplicity and less human error (Could be useful for eg guest VRF or security policies).  The HP switch specs are well beyond our requirements therefore larger broadcast traffic isn’t an issue.&lt;/p&gt;&#xA;" OwnerUserId="12092" LastEditorUserId="3191" LastEditDate="2014-12-29T18:52:24.257" LastActivityDate="2014-12-30T13:37:26.547" Title="Layer 2 vs Layer 3 core - with HP IRF" Tags="|design|layer2|hp|layer3|3-com|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14871" PostTypeId="2" ParentId="14870" CreationDate="2014-12-29T18:41:40.267" Score="0" Body="&lt;p&gt;Isolated Layer 3 inter networking issues is &lt;em&gt;far&lt;/em&gt; easier, more manageable and less business impacting than isolating Layer 2 spanning tree forwarding issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 3 can be used in a &quot;Broadcast&quot; or &quot;Point to Point&quot; type of construct to stitch together today's networks. Your f&lt;strong&gt;ault isolation can be extremely good&lt;/strong&gt;, down to a single device, a single P2P OSPF or BGP connection. Prefix list filtering, ACL's and specific routing &amp;amp; PBR can be used here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 2 spans &lt;strong&gt;multiple VLAN's&lt;/strong&gt; across &lt;strong&gt;multiple switches&lt;/strong&gt;. This is a legacy design. If you can push layer 3 down to the access switch / ToR, you're saving yourself headaches and future-proofing your designs.&lt;/p&gt;&#xA;" OwnerUserId="8844" LastActivityDate="2014-12-29T18:41:40.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14875" PostTypeId="1" AcceptedAnswerId="14879" CreationDate="2014-12-29T23:57:26.487" Score="7" ViewCount="9254" Body="&lt;p&gt;I understand which types of devices tend to use MDI or MDI-X, but why don't all devices just use one of them? It seems like Auto MDI-X was the solution to this but it still seems like all newly manufactured devices could just switch over to one. This way only crossover cables would be needed for all related connections.&lt;/p&gt;&#xA;" OwnerUserId="12098" LastEditorUserId="12098" LastEditDate="2014-12-30T01:23:24.513" LastActivityDate="2014-12-30T18:29:51.503" Title="Why do we have both MDI and MDI-X?" Tags="|ethernet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14876" PostTypeId="1" AcceptedAnswerId="14878" CreationDate="2014-12-29T23:59:04.340" Score="4" ViewCount="2405" Body="&lt;p&gt;Say we have two clients A and B that wish to connect to each other, both behind symmetric NAT's NA and NB respectively. Also there is a rendezvous server S that exists to assist clients A and B with the hole punching process. The literatures says that because NA and NB randomly assign external ports anytime their respective clients initiate a new connection (even if the destination address is the same) the external port information that rendezvous server S swaps between its connecting clients is effectively useless. What i'm wondering is why is it not possible for clients A and B to try the external port information provided by S first and then, if that fails try repeatedly guessing/brute-forcing the external ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that trying all 2^16 ports would take too long or something is going completely over my head and the brute force search would require (2^16)^2 guesses which is completely unfeasible. &lt;/p&gt;&#xA;" OwnerUserId="12099" LastActivityDate="2022-06-17T20:32:30.103" Title="Is it possible to brute force search/guess symmetric NAT port prediction for hole punching?" Tags="|ipv4|nat|network-discovery|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14877" PostTypeId="2" ParentId="14876" CreationDate="2014-12-30T01:07:59.833" Score="1" Body="&lt;p&gt;It's not enough to guess the source port.  You also need to know S's port  When A connects to S, NA is expecting traffic to return with a source IP of S.  So  B would also have to spoof the port and IP of S.  If NA were a &quot;real&quot; firewall, you'd also have to guess TCP sequence numbers, otherwise the firewall would reject you.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2014-12-30T01:07:59.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14878" PostTypeId="2" ParentId="14876" CreationDate="2014-12-30T01:10:49.250" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;why is it not possible for clients A and B to try the external port information provided by S&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because the ports used for talking to S will never be the ports used to talk to either endpoint. A-&gt;S will be one port; A-&gt;B will be a &lt;em&gt;different&lt;/em&gt; port. If NAT is being done correctly, neither port is guessable. The NAT entry maps Src(ip:port)/Dst(ip:port)[inside] to Src(ip:port)/Dst(ip:port)[outside] -- that's 8 numbers that NAT &lt;em&gt;can&lt;/em&gt; change. When A changes from S to B, that's a completely new connection with completely new, unknown, external values. STUN/ICE/etc. are counting on the inside-outside src port association remaining the same for multiple destinations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A and B have no way to know what port was selected by NAT, even if it is &quot;sticky&quot; (as long as the same inside src port is used, NAT uses the same outside src port), unless the same port(s) are used for multiple dst IPs. S only knows what was used to talk to it; if NAT uses a different outside src port, then neither S nor A will know what that port is.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-30T01:10:49.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14879" PostTypeId="2" ParentId="14875" CreationDate="2014-12-30T01:23:40.363" Score="5" Body="&lt;p&gt;This is a matter of DTE vs. DCE -- the role each endpoint takes. The NIC in your desktop is a &quot;user terminal&quot; (DTE). The switch it connects to is &quot;communication equipment&quot; (DCE). All this means is which pins are transmit vs. receive, such that a straight through cable from DTE to DCE works as expected.  This is why a crossover cable is(was) required to connect two switches (DCE) or two hosts (DTE) together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Auto&quot; really didn't become popular (read: everywhere) until the era of gigabit ethernet. Gig-e uses all four pairs for both TX and RX, so the required logic for auto-mdix is already there. Prior to this, additional logic (read: additional &lt;em&gt;costs&lt;/em&gt;) were required.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-30T01:23:40.363" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14880" PostTypeId="2" ParentId="14861" CreationDate="2014-12-30T01:43:54.387" Score="3" Body="&lt;p&gt;Like Ryan said, it's a layer-2 device &lt;em&gt;first&lt;/em&gt;. If you don't configure any layer-3 features, it won't have any. Out of the box, it has no ip interfaces (maybe a default management address, not sure with the 1910) and all ports are in the default vlan (1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The automatic default gateway can be removed, or replaced. But it has zero effect on switching of traffic. It will only &lt;em&gt;route&lt;/em&gt; traffic sent directly to it -- i.e. if 192.168.1.254 (it's mgmt address) is the gateway on the hosts in your LAN.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-30T01:43:54.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14881" PostTypeId="2" ParentId="14843" CreationDate="2014-12-30T02:10:38.547" Score="1" Body="&lt;pre&gt;&lt;code&gt;show policy-map type inspect %zone-pair% %zone-pair-name% sessions&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a great doc on the Cisco Support forums for troubleshooting ZBF's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/document/60736/zbfw-troubleshooting-command-list&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/document/60736/zbfw-troubleshooting-command-list&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12100" LastEditorUserId="509" LastEditDate="2015-04-29T05:09:44.703" LastActivityDate="2015-04-29T05:09:44.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14882" PostTypeId="2" ParentId="14840" CreationDate="2014-12-30T02:25:53.490" Score="2" Body="&lt;p&gt;First, it is invalid to configure &lt;em&gt;more than one&lt;/em&gt; untagged VLAN per port. Into which VLAN does an untagged packet belong? Thus, VLAN 1 (management) should exist, and be the PVID, only on trunk ports. (PVID 10 everywhere else.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, unless a switch is acting as a router (eg. the core switch), it doesn't need an ip on any non-management interfaces. Thus, the default gateway for devices in VLANs 10 and 20 (and 1) should be the relevant address of the core switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this setup, the VoIP devices need to know to use VLAN 20. This can be via direct configuration, maybe DHCP(???), or CDP/LLDP&lt;sup&gt;[1]&lt;/sup&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;[1] Disable &quot;Voice VLAN Security&quot;. Enable LLDP-MED.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2014-12-30T02:25:53.490" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14883" PostTypeId="2" ParentId="14875" CreationDate="2014-12-30T06:14:47.637" Score="9" Body="&lt;p&gt;The ability to configure the logic into a device to sense whether a pair is being used for RX or TX in networking is relatively recent and until included (as an option) in Gig Ethernet, was relatively expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So before this time, a pair was designated at TX on one side and RX on the other.  For proper communications, a &quot;cross&quot; was required at some point in the connection to make this work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So where best to make this &quot;cross?&quot; While considering this, one needs to keep in mind two &quot;crosses&quot; will negate each other (or that you need to maintain an &quot;odd number of crosses&quot;).  Here are the options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use crossover cables to make connections&lt;/li&gt;&#xA;&lt;li&gt;Cross the infrastucture cabling&lt;/li&gt;&#xA;&lt;li&gt;Manufacture a cross into one of the two endpoints&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the first case, this works fine if the two devices are directly connected.  But if infrastructure cable were used, then you would need a crossed cable on one side and a straight cable on the other.  Or, while less than ideal itslef, one runs into situations where two cables are &quot;coupled&quot; together and this would require a straing/crossed combo to work.  It is much simpler to manage and less prone to human error if you were to use straight cables on each side.  So this is less than ideal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the second case, this can have several problems, but most can be avoided by combining with the first case and use crosses with both cable and infrastructure.  However the problem comes in when you go to manage the cable infrastructure itself.  Namely, both sides (near and far) will use different patterns.  Which is used on which side?  What if this were mixed over time (maybe by different staff with different personal &quot;standards&quot;)?  What about the case where you have three (or more) rooms all interconnected by infrastructure cabling?  Again, this can be more complex to manage/troubleshoot as well as prone to human error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third case actually provides the simplest and most easily standardized way to introduce a cross.  If the L2 network device always provided a crossed connection (MDI-X), and the end user device is always straight through (MDI), then it makes the &quot;rules&quot; very simple.  You always use a straight connection (cable and infrastructure) unless you are connecting two end user devices (MDI to MDI) or two network devices (MDI-X to MDI-X).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this will cover the majority of connections/situations, this makes it less prone to error and allows an entity to maintain most of their inventory as straight cables with no or few crossed cables (as they can typically be ordered at the time of need - with the network equipment).  No one needs to remember which side of the infrastructure cabling needs to use which pattern.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-12-30T06:14:47.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14884" PostTypeId="2" ParentId="14870" CreationDate="2014-12-30T12:24:36.210" Score="4" Body="&lt;p&gt;Straight from Cisco’s &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/HA_campus_DG/hacampusdg.html&quot; rel=&quot;nofollow&quot;&gt;Campus Network for High Availability Design Guide&lt;/a&gt;, L3 is superior because:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;– Faster convergence around a link or node failure.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;– Increased scalability because neighbor relationships and meshing are&#xA;  reduced.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;– More efficient bandwidth utilization.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;From &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/HA_campus_DG/hacampusdg.html#wp1107724&quot; rel=&quot;nofollow&quot;&gt;Cisco: Campus Network for High Availability Design Guide - Core Layer&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are all great reasons, but you won’t stand to benefit from any of them, as your setup doesn’t allow for it.  If a packet arrives at your distribution node, it’s only going to have one node that it can go to next; your core which is using IRF.  There isn’t a routing protocol that is going to be intelligent enough to determine that you have another (perhaps &lt;em&gt;lower&lt;/em&gt; speed) connection combining your 2 cores.  That additional hop is transparent and would require some manual intervention (somehow).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I don’t think it’s a good idea for you to virtualize your cores. Path determination is impossible, independent device operation is severed, and you completely eliminate the possibility of intelligent routing.  All of those are critical to a well oiled network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though, you may have additional business requirements that dictate this design but aren't outlined above.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In the Cisco world, it's always been highly recommended to have layer&#xA;  3 between distribution and core using a routing protocol.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This isn’t just the Cisco world, this is the Networking world overall.  Network engineers work to eliminate STP in as many cases as possible because they know of the limitations it drags along with it.  Routing to the access layer is recommended nowadays:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Consider EIGRP/Routing in the access layer.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A routing protocol like EIGRP, when properly tuned, can achieve&#xA;  better convergence results than designs that rely on STP to resolve&#xA;  convergence events. A routing protocol can even achieve better&#xA;  convergence results than the time-tested L2/L3 boundary hierarchical&#xA;  design. However, some additional complexity (uplink IP addressing and&#xA;  subnetting) and loss of flexibility are associated with this design&#xA;  alternative. Additionally, this option is not as widely deployed in&#xA;  the field as the L2/L3 distribution layer boundary model.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;From &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Campus/HA_campus_DG/hacampusdg.html#wp1107593&quot; rel=&quot;nofollow&quot;&gt;Cisco: Campus Network for High Availability Design Guide&#xA;- Access Layer Tuning&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There used to be an idiom: &lt;em&gt;“Switch where you can, Route where you must”&lt;/em&gt;.  In recent times, that has been &lt;strong&gt;completely&lt;/strong&gt; flipped on it’s head:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Route where you can, Switch where you must&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tons of enterprise switches support some level of routing now.  We can’t stand behind &lt;em&gt;‘my device doesn’t support that’&lt;/em&gt; because that’s not the case, anymore.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the practice of implementing a 'layer 3 distribution to core'&#xA;  applicable today in the HP world when it's possible to have a highly&#xA;  redundant layer 2 to the core without STP, using IRF?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it absolutely is.  HP’s Intelligent Redundant Framework is just another system virtualization technology like Cisco’s StackWise and Juniper’s Virtual Chassis, just painted a different color and tagged with ‘the most disruptive technology in ages’.  Every vendor will tout how much better theirs is than the competitor, but it’s not a game changer or anything to write home about.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2014-12-30T12:24:36.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14886" PostTypeId="2" ParentId="14870" CreationDate="2014-12-30T13:37:26.547" Score="0" Body="&lt;p&gt;I personally will go for layer 3 to access layer if possible...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plus with your SMB organization, why you need both distribution and core layers? Why not just use access with consolidated distribution/core layers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run layer3 at the higher layer (static or dynamic routing). You will get the flexibility to apply traffic control and QoS besides the benefits others mentioned.&lt;/p&gt;&#xA;" OwnerUserId="10478" LastActivityDate="2014-12-30T13:37:26.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14887" PostTypeId="2" ParentId="13113" CreationDate="2014-12-30T13:48:27.717" Score="0" Body="&lt;p&gt;Here are something you can try on CLI (I donot have a airport extreme).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config t&#xA;inter 45&#xA;speed-duplex 1000-full&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The error messages you listed are Switch complaining of the CSC and normally caused by duplex mismatch. Plus what is the setting on your switch for port 45?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like it might not be a switch issue now. Again I never used airport before. I guess you are bridging the 2 to increase the coverage? If so, I would recommend you to move the 2 airports closer to each other. Normally 20% overlap of the coverage is recommended.&lt;/p&gt;&#xA;" OwnerUserId="10478" LastEditorUserId="76" LastEditDate="2015-04-06T20:37:06.980" LastActivityDate="2015-04-06T20:37:06.980" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14888" PostTypeId="2" ParentId="14875" CreationDate="2014-12-30T14:31:10.023" Score="0" Body="&lt;p&gt;This is one of those design decisions, which in retrospect seems like an obviously poor choice. But once the problem with the design decision became apparent, the installed base was already too large to simply undo the mistake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One might think this could be fixed as part of standardization on a higher speed, which has happened several times since the problem became known. But since crossover cables are a minority, it is not that simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we wanted to fix it, we would have to proceed in multiple stages:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Make auto MDI/MDI-X negotiation part of the standard as upgrading the speed&lt;/li&gt;&#xA;&lt;li&gt;Make cross over be a requirement for cables&lt;/li&gt;&#xA;&lt;li&gt;Make auto MDI/MDI-X be an optional part of the standard&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;At each stage we would have to wait for enough old equipment to be replaced, such that we wouldn't cause a problem by taking the next step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem is even harder to fix. Because 10BASE-T and 100BASE-TX crossover cables only cross over two of the pairs, while the other two pairs are still straight. So most of the crossover cables that we already have are insufficient to completely eliminate the auto negotiation. So at the first step, we would have to standardize on auto negotiation with support for three different kinds of cabling, straight and &lt;a href=&quot;http://en.m.wikipedia.org/wiki/Ethernet_crossover_cable#Crossover_cable_pinouts&quot; rel=&quot;nofollow&quot;&gt;two different kinds of crossover cables&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the part about only three ways to wire a cable being required is an oversimplification. If you start mixing the different kinds when patch cables are used at each end of a link, there will be four different ways the cabling could come out. And that is assuming each of the parts of the cable run were done correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover if a new standard mandated MDI/MDI-X/.../... auto negotiation with support for all four ways of crossing or not, what are the chances cable manufacturers would start manufacturing only such a new kind of crossover cable? After all, the old cables without crossover would work with all devices, the new standard cables would only work with the newest devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally one has to remember that crossover must only happen on the cables that connect male to male or female to female connectors. If you have any cable run with a male connector in one end and a female connector in the other end, that particular cable need to be straight. Failing to follow this requirement on all your cables would mean they could be connected with an even number of crosses on the path, which would result in an uncrossed connection between the two devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular any female-female connector you already have for connecting two patch cables together could be incompatible with the all crossed approach if that female-female connector did not also cross the connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With all that complexity involved in retroactively fixing a poor design choice, it seems obvious why it isn't going to happen. It is not even obvious, that it would be desirable, even if we could eliminate all the old straight cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we imagine a world where all cables were crossover, and MDI/MDI-X negotiation was an non-existing concept, straight cables would occasionally happen by mistake when connectors are manually installed on cables. So auto negotiation might actually be the desirable design, in particular since we already paid for it being developed and standardized.&lt;/p&gt;&#xA;" OwnerUserId="5842" LastEditorUserId="5842" LastEditDate="2014-12-30T18:29:51.503" LastActivityDate="2014-12-30T18:29:51.503" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="14890" PostTypeId="1" AcceptedAnswerId="14892" CreationDate="2014-12-30T16:30:38.043" Score="3" ViewCount="841" Body="&lt;p&gt;I have been considering enabling the &lt;code&gt;ip dhcp snooping&lt;/code&gt; option to avoid potential issues with users attaching wireless access points and the like. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the examples I've seen show using a trusted VLAN that has the DHCP server running on it... In the case I'm working with the DHCP server is running on the 3750 itself. Even the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750e_3560e/software/release/15-0_1_se/configuration/guide/scg3750e/swdhcp82.html&quot; rel=&quot;nofollow&quot;&gt;official documentation&lt;/a&gt; appears this way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if any special steps do I need to take, considering that the the switch is also acting as the DHCP server? &lt;/p&gt;&#xA;" OwnerUserId="657" LastActivityDate="2014-12-30T16:58:04.217" Title="Enabling dhcp snooping on Cisco 3750 running DHCP server?" Tags="|cisco|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14891" PostTypeId="2" ParentId="8044" CreationDate="2014-12-30T16:33:12.060" Score="3" Body="&lt;p&gt;Distributed Bellman-Ford (BF) and Dijkstra work in opposite directions: BF builds path starting at the source of the routing information (the data sink), while Dijkstra starts at the data sender.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since distance vector protocols work incrementally starting at the source, they cannot use Dijkstra, and hence use distributed BF.  There is nothing in principle that would prevent a link-state protocol from using BF, but (non-distributed) BF has cubic complexity, while Dijkstra (if implemented correctly) is O(&lt;em&gt;n&lt;/em&gt;² log &lt;em&gt;n&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Because of the different directions, BF and Dijkstra will build different paths with some very weird metrics — metrics that fail Sobrinho's &lt;em&gt;isotonicity&lt;/em&gt; condition —, but the difference is unlikely to be relevant in practice.)&lt;/p&gt;&#xA;" OwnerUserId="12089" LastActivityDate="2014-12-30T16:33:12.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14892" PostTypeId="2" ParentId="14890" CreationDate="2014-12-30T16:58:04.217" Score="4" Body="&lt;p&gt;If the switch is providing DHCP services, then the only difference should be that you should not need to &quot;trust&quot; any port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why is that the trusted ports are allowed to receive (and not drop) DHCP server types of messages (ACK, NAK, OFFER, etc).  Since the switch is generating them, it won't be receiving them on any port.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-12-30T16:58:04.217" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14894" PostTypeId="1" CreationDate="2014-12-30T19:51:52.407" Score="5" ViewCount="2727" Body="&lt;p&gt;I am currently managing a large datacenter spine-and-leaf topology. On our leafs, we use stacked 3750-X switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know how much bandwidth is currently going across the stack links (currently 6 switches in the stack, about to be 8). We currently use 10GB uplinks to our spine using a SM module (only two links currently up to the spine from different switches in the stack). I can look at the total available bandwidth (which is 32Gbps) but not what is being used. I tried to graph the stack links in Cacti but nothing is showing up using the standard graphs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to tell current bandwidth or dropped frames due to oversubscription? Can I graph this is Cacti to monitor for a period of time to tell peak usage? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not finding much information on Google right now, thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Aaron&lt;/p&gt;&#xA;" OwnerUserId="12105" LastActivityDate="2019-07-29T11:33:19.443" Title="Cisco 3750-X Stack Bandwidth" Tags="|cisco|bandwidth|cisco-3750|stacking|oversubscription|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14895" PostTypeId="2" ParentId="13113" CreationDate="2014-12-31T00:10:20.917" Score="2" Body="&lt;p&gt;The event message means that the connected device is incessantly transmitting either oversized packets with CRC errors (jabbering), or fragmented frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is unlikely to be caused by a duplex mismatch. The usual symptoms of DM are Excessive CRC/Alignment errors, link flapping and port defaulting to HDx mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch isn't usually the root cause either, it's just reporting what it is receiving on the port. The usual root causes for jabbering are failure of the physical connector, firmware or driver of the connecting device; or bad cabling / patch panel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what to do about this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ensure that both devices are running current SW/FW to exclude&#xA;SW-related issues &lt;/li&gt;&#xA;&lt;li&gt;Use a brand new cable directly connected between the Airport and the switch to exclude faulty cabling / patch panel&lt;/li&gt;&#xA;&lt;li&gt;Verify that both device ports are set to Autonegotiation - this is default setting in most networking devices, I'd expect Airport to use that as well&lt;/li&gt;&#xA;&lt;li&gt;Test by setting &lt;em&gt;both ends&lt;/em&gt; of the link to fixed 100FDx or 1000FDx&#xA;mode - this will exclude negotiation errors &lt;/li&gt;&#xA;&lt;li&gt;Test in one of the first 12 ports - this will exclude failing switch port, or port controller &lt;/li&gt;&#xA;&lt;li&gt;If possible test with another Airport&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Do the tests one at a time, and you'll identify the point of failure. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, or if the failure appears to be on the switch, call support. That 2920 carries a lifetime warranty (if purchased from a legit HP reseller) so you only pay for a local call. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Applicable HP Knowledge base articles:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.hp.com/rnd/device_help/help/hpwnd/webhelp/HPJ4819A/Alert_Descriptions.htm&quot; rel=&quot;nofollow&quot;&gt;ProCurve alert descriptions&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://h20565.www2.hp.com/hpsc/doc/public/display?sp4ts.oid=4063679&amp;amp;docId=emr_na-c02597291&quot; rel=&quot;nofollow&quot;&gt;Defining find, fix and inform events&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2014-12-31T00:10:20.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14898" PostTypeId="2" ParentId="14894" CreationDate="2014-12-31T13:14:19.577" Score="2" Body="&lt;p&gt;I do not know a direct way to show the exact bw utilization per stack port, however you can show the total number of frames sent by each stack member to the stack ring by using the command &quot;&lt;em&gt;show switch stack-ring activity&lt;/em&gt;&quot;, you can also know the overall utilization of the stack-ring using the command &quot;&lt;em&gt;show controllers utilization&lt;/em&gt;&quot; but it wont show you the percentage of each stack port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/commmand/reference/3750cr/cli2.html&quot; rel=&quot;nofollow&quot;&gt;Catalyst 3750 Command Reference&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="11906" LastActivityDate="2014-12-31T13:14:19.577" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14901" PostTypeId="1" CreationDate="2014-12-31T14:13:19.943" Score="2" ViewCount="2022" Body="&lt;p&gt;I am planning a switch cluster with 2 Cisco 2960G switches for the following scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Layer-2 connection between two branch offices terminated on a switch on each side. My goal is to get a high availability on our HQ side. That means if one of these 2 switches fails, the second switch in the cluster should take over the control and forward the traffic. In a server environement you create a heartbeat link between the cluster-member-servers to check the availability of these cluster-members but how do I realize that with Cisco switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read these articel from Cisco: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swethchl.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swethchl.html&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I donot understand how to realize the cluster with these informations, can someone help me please?&lt;/p&gt;&#xA;" OwnerUserId="10260" LastEditorUserId="10260" LastEditDate="2015-01-12T10:00:55.170" LastActivityDate="2015-01-12T10:00:55.170" Title="Clustering two Cisco 2960G switches" Tags="|cisco|switch|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14902" PostTypeId="2" ParentId="14841" CreationDate="2014-12-31T14:34:19.270" Score="0" Body="&lt;p&gt;Protocols that can encapsulate multiple upper layer protocols need some way of indicating what that upper layer protocol is. Ethernet uses an Ethertype field, with 0x0800 denoting IP, and 0x0806 representing ARP. TCP uses well known port numbers, with e.g. 80 representing HTTP. HTTP uses the Content-Type: header field.&lt;/p&gt;&#xA;" OwnerUserId="12111" LastActivityDate="2014-12-31T14:34:19.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14903" PostTypeId="2" ParentId="14901" CreationDate="2014-12-31T15:26:15.900" Score="0" Body="&lt;p&gt;I am not sure if clustering is the correct term for your scenario...Plus you did not give much detail regarding what you try to accomplish really.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the link you included, it shows how to do etherchannel. With etherchannel, you could potentially failover from on link to another between the 2 switches. But you wont be able to manage the 2 switches with one management IP (which is clustering for).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco switch, run &quot;show interface portgroup (etherchannel group #)&quot; and &quot;show etherchannel (etherchannel group #) detail/summary&quot; will show you the state of the links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are just looking for managing 2 switches with one management IP address, then you need stacking however 2960G can not do that.&lt;/p&gt;&#xA;" OwnerUserId="10478" LastActivityDate="2014-12-31T15:26:15.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14904" PostTypeId="2" ParentId="14901" CreationDate="2014-12-31T17:05:01.980" Score="8" Body="&lt;p&gt;Cisco has developed two ways to manage a group of access switches in a somewhat consolidated fashion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first on the scene was switch clustering.  This provided the means to manage a group of switches utilizing only one management IP address.  It did not provide any sort of fault tolerance or centralized configuration (you had to &quot;hop&quot; from the master switch to the others and still configure them individually).  Most network engineers felt the benefits of this approach did not out weigh the negatives and it was seldom deployed outside environments where CiscoWorks/LMS was also deployed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second approach was switch stacking.  This required that the switches provided the ability to be connected utilizing a &quot;stacking cable&quot; that provided a shared control and possibly data plane.  It provides centralized management of all switches (i.e. you can configure them all from one switch) as well was fault tolerance as any stack member is a potential master and can take over if the master fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you mention 2960G switches, AFAIK none of them had the option to utilize switch stacking so you are only left with clustering.  I would recommend not clustering them unless you really have a need and the ability to properly manage them.  It probably won't provide you any real benefit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The link you provide doesn't cover either of these two technologies, so not sure  how that comes into play at all.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Just to note it in case anyone comes across it and is confused by the terminology, Cisco did also produce a product called a GigaStack.  This GBIC solution really has nothing to do with stacking or clustering, but really only provides interconnectivity between switches.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2014-12-31T17:05:01.980" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14905" PostTypeId="1" AcceptedAnswerId="40551" CreationDate="2014-12-31T17:57:27.493" Score="1" ViewCount="15112" Body="&lt;p&gt;I have two Cisco 2950C switches with two trunk port connections between them.  On one line the lights are green on both ends. On the other, the light turned amber only on one end (green on the other).  The switch with the amber light also has two trunk connections to another switch.  I was able to get the light to turn green by setting the port mode to trunk. But when setting it back to trunk desirable it turns amber again.  I can see no other errors or problems, but I'm curios about this behavior.&lt;/p&gt;&#xA;" OwnerUserId="12115" LastActivityDate="2017-04-18T19:45:23.300" Title="Why only one amber light between two switches" Tags="|cisco|switch|trunk|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14906" PostTypeId="2" ParentId="13340" CreationDate="2014-12-31T18:58:44.473" Score="0" Body="&lt;p&gt;More info might be better to help you out. But just based on what you described, it seems like this is not a LACP issue but VLAN trunking issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you add VLAN into vswitch, vswitch then stops, then maybe the issue is on the vmware side. I assume you are using the standard vswitch, right? How did you configured your portgroup (VLAN or VLAN Trunking)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you use a chassis based server/host? If so, how do you configured your chassis switch?&lt;/p&gt;&#xA;" OwnerUserId="10478" LastActivityDate="2014-12-31T18:58:44.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14908" PostTypeId="1" CreationDate="2014-12-31T23:24:13.533" Score="2" ViewCount="118" Body="&lt;p&gt;How do wireless hotspots, routers etc. go about displaying their name to devices in their range? For example, when you open your laptops network center and see named wireless connections: &lt;code&gt;linksys-xxx&lt;/code&gt;, &lt;code&gt;DIR-xxx&lt;/code&gt; etc. How is this message displayed exactly from technology point, what are the processes involved? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, would it be somehow possible to display an image or other data besides text in the same fashion? If so, would it require altering hardware or something else? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, is it possible to programmatically decrease the range of your router's signal?&lt;/p&gt;&#xA;" OwnerUserId="12118" LastEditorUserId="2062" LastEditDate="2015-02-10T09:45:17.357" LastActivityDate="2015-02-10T09:45:17.357" Title="How do wi-fi spots display their name?" Tags="|router|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14911" PostTypeId="2" ParentId="14908" CreationDate="2015-01-01T01:13:16.353" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How is this message displayed...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;APs broadcast their presence via a beacon frame every 100ms. (by default. this can be disabled: &quot;hidden SSID&quot;, and the timer adjusted.)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would it be somehow possible to display an image or other data...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. The beacon contains no such fields. It's purpose is to announce the availability of networks and the capabilities of the AP.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to programatically decrease the range of your router's signal?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most systems do have a power level setting. Consult the documentation for your specific brand of AP.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-01-03T00:22:21.570" LastActivityDate="2015-01-03T00:22:21.570" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14914" PostTypeId="1" CreationDate="2015-01-01T08:52:16.893" Score="5" ViewCount="6165" Body="&lt;p&gt;Let's say we have two routers running a BGP that is fully converged and both routers are advertising routes to each other. The link between them fails (physically so to speak). Now, after the hold down timer and both routers deemed the other as down. What happens when the link comes back to life? Do we have to re-configure the BGP session all over again? If not, what happens to the networks that are advertised from each router to the other? Is it instantly advertised again once the link comes back up, or there is some kind of update timer so that each router deems the other as an up neighbor?&lt;/p&gt;&#xA;" OwnerUserId="12125" LastEditorUserId="19086" LastEditDate="2016-06-09T04:40:05.477" LastActivityDate="2016-06-09T04:40:05.477" Title="What happens when a BGP link is lost and then came back up?" Tags="|routing|bgp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14916" PostTypeId="2" ParentId="14914" CreationDate="2015-01-01T12:20:37.143" Score="1" Body="&lt;p&gt;BGP sends &lt;strong&gt;KEEPALIVE&lt;/strong&gt; packets in specified interval (60 seconds by default). If BGP not received 3 keepalive packets from neighbour, HOLD DOWN timer expires and the neighbour is considered as dead. Assuming the neighbor is down, shutting down the BGP session, and withdrawing all routes from it's announcements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HOLD DOWN timer, it's three times KEEPALIVE (180 seconds by default).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When link between BGP peers came back to life (physically) and neighbours received KEEPALIVE packets the session is automatically UP. Peers starts advertise their routes in announcements, according to specified criteria. You don't have to reconfigure BGP session again. It would not make sense, because in real environments, BGP session fails quite a often.&lt;/p&gt;&#xA;" OwnerUserId="10520" LastActivityDate="2015-01-01T12:20:37.143" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14917" PostTypeId="2" ParentId="14905" CreationDate="2015-01-01T12:47:54.090" Score="3" Body="&lt;p&gt;Fred this behavior would be due to Spanning Tree Protocol detecting the possible loop you've created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/WTEig.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When a Port LED is Amber the Port is not forwarding. This is possibly due to the port being disabled by management, an address violation, or Spanning Tree Protocol (STP). After the port is reconfigured, the port LED can remain amber for up to 30 seconds while STP checks the switch for possible loops.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/hardware/installation/guide/2950hig/hgovrev.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/hardware/installation/guide/2950hig/hgovrev.htm&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="6354" LastActivityDate="2015-01-01T12:47:54.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14921" PostTypeId="1" AcceptedAnswerId="14924" CreationDate="2015-01-01T20:07:50.120" Score="2" ViewCount="2915" Body="&lt;p&gt;I have an HP V1910-48G and SonicWALL TZ 105 set up with two VLANs that should be able to reach the Internet but they cannot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 1 - 192.168.1.0/24 - Transport Network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 50 - 192.168.50.0/24 - Infrastructure 1 (Ideally can reach and be reached from Internet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 100 - 192.168.100.0/24 - Infrastructure 2 (Ideally can reach and be reached from Internet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.1 - SonicWALL LAN interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.254 - Switch VLAN interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.50.1 - Switch VLAN interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.100.1 - Switch VLAN interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The odd thing is that a client in one of the infrastructure networks, say, 192.168.50.55 can ping every VLAN interface i.e. 192.168.50.1, 192.168.100.1, 192.168.1.254 but cannot ping the SonicWALL at 192.168.1.1. Even stranger is that using the diagnostic tools on both the SonicWALL and the Switch, I can ping both devices from eachother i.e. SonicWALL can ping 192.168.1.254 and Switch can ping 192.168.1.1. So I know there is connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems as if the issue is either my VLAN membership/tagging configuration or routing configuration on the HP Switch or a combination of the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN Setup:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/eurw2.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;VLAN Interfaces:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/eAcgB.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;Routing:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/bBYBr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="10475" LastActivityDate="2015-01-02T01:33:40.430" Title="HP V1910-48G cannot route to Internet from VLANs" Tags="|routing|vlan|internet|sonicwall|hp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14922" PostTypeId="2" ParentId="6784" CreationDate="2015-01-01T22:00:07.230" Score="5" Body="&lt;h2&gt;We had the same issue and I found solution for it:&lt;/h2&gt;&#xA;&lt;p&gt;It is called &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/45282-event-expression-config-sample-config.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Expression MIB&lt;/a&gt; as per &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2982&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2982&lt;/a&gt;. You can do logical OR on this level by creating of new SNMP OID object which will be calculated at the same time as the SNMP Request comes to router/switch for this OID.&lt;/p&gt;&#xA;&lt;p&gt;Afterwards you can use this object to poll SNMP statistics of 2 or more ORed (via Expression MIB) IP SLA probes.&lt;/p&gt;&#xA;&lt;p&gt;I can provide you with more details if you want. I will also prepare blog post about it with step by step instructions how to create new SNMP OID for this particular use via Expression MIB.&lt;/p&gt;&#xA;&lt;p&gt;Let's say you have 3 HTTP IP SLA probes configured on device and you want to monitor (via SNMP) ORed result:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;IP SLA Index / rttMonHTTPStatsEntry == 3000&lt;/li&gt;&#xA;&lt;li&gt;IP SLA Index / rttMonHTTPStatsEntry == 3001&lt;/li&gt;&#xA;&lt;li&gt;IP SLA Index / rttMonHTTPStatsEntry == 3002&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;You can use following OID &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.42.1.5.1.1.6#oidContent&quot; rel=&quot;nofollow noreferrer&quot;&gt;rttMonLatestHTTPOperSense&lt;/a&gt; (one per entry / ip sla probe) and assign its value to variable in order to use this values in expression evaluation.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;How to:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;destroys an eventual old expression that is created&lt;/p&gt;&#xA;&lt;p&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.2.3.1.3.101.49.101.120.112 integer 6&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;create and wait&lt;/p&gt;&#xA;&lt;p&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.2.3.1.3.101.49.101.120.112 integer 5&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;creates the index to use later to retrieve the result of the expression&lt;/p&gt;&#xA;&lt;p&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.2.3.1.2.101.49.101.120.112 u 1&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the description of the expression&lt;/p&gt;&#xA;&lt;p&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.1.1.4.1 s &amp;quot;Expression MIB - IP SLA Probes ORing&amp;quot;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Expression to be evaluated&lt;/p&gt;&#xA;&lt;p&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.1.1.2.1 s '((($1 &amp;lt; 2) &amp;amp;&amp;amp; ($1 &amp;gt; 0)) || (($2 &amp;lt; 2) &amp;amp;&amp;amp; ($2 &amp;gt; 0)) || (($3 &amp;lt; 2) &amp;amp;&amp;amp; ($3 &amp;gt; 0)))'&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;sets variable $1 for rttMonLatestHTTPOperSense&lt;/p&gt;&#xA;&lt;p&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.2.1.1 objectidentifier 1.3.6.1.4.1.9.9.42.1.5.1.1.6.3000&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;sets variable $2 for rttMonLatestHTTPOperSense&lt;/p&gt;&#xA;&lt;p&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.2.1.2 objectidentifier 1.3.6.1.4.1.9.9.42.1.5.1.1.6.3001&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;sets variable $3 for rttMonLatestHTTPOperSense&lt;/p&gt;&#xA;&lt;p&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.2.1.3 objectidentifier 1.3.6.1.4.1.9.9.42.1.5.1.1.6.3002&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;sets type of $1 variable to absolute (for delta is 2)&lt;/p&gt;&#xA;&lt;p&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.4.1.1 integer 1&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;sets type of $2 variable to absolute (for delta is 2)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.4.1.2 integer 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;11&quot;&gt;&#xA;&lt;li&gt;sets type of $3 variable to absolute (for delta is 2)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.4.1.3 integer 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;12&quot;&gt;&#xA;&lt;li&gt;Set the rows in the expObjectTable to active&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;snmpset -v2c -cstart123 172.0.0.1&#xA; 1.3.6.1.4.1.9.10.22.1.3.2.1.10.1.1 integer 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;13&quot;&gt;&#xA;&lt;li&gt;Set the rows in the expObjectTable to active&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.10.1.2 integer 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;14&quot;&gt;&#xA;&lt;li&gt;Set the rows in the expObjectTable to active&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.10.1.3 integer 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;15&quot;&gt;&#xA;&lt;li&gt;Activates the expression&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.2.3.1.3.101.49.101.120.112 integer 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Only script:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.2.3.1.3.101.49.101.120.112 integer 6&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.2.3.1.3.101.49.101.120.112 integer 5&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.2.3.1.2.101.49.101.120.112 u 1&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.1.1.4.1 s &amp;quot;Expression MIB - IP SLA Probes ORing&amp;quot;&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.1.1.2.1 s '((($1 &amp;lt; 2) &amp;amp;&amp;amp; ($1 &amp;gt; 0)) || (($2 &amp;lt; 2) &amp;amp;&amp;amp; ($2 &amp;gt; 0)) || (($3 &amp;lt; 2) &amp;amp;&amp;amp; ($3 &amp;gt; 0)))'&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.2.1.1 objectidentifier 1.3.6.1.4.1.9.9.42.1.5.1.1.6.3000&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.2.1.2 objectidentifier 1.3.6.1.4.1.9.9.42.1.5.1.1.6.3001&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.2.1.3 objectidentifier 1.3.6.1.4.1.9.9.42.1.5.1.1.6.3002&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.4.1.1 integer 1&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.4.1.2 integer 1&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.4.1.3 integer 1&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.10.1.1 integer 1&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.10.1.2 integer 1&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.3.2.1.10.1.3 integer 1&#xA;snmpset -v2c -cstart123 172.0.0.1 1.3.6.1.4.1.9.10.22.1.2.3.1.3.101.49.101.120.112 integer 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12131" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-01-04T16:15:18.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14924" PostTypeId="2" ParentId="14921" CreationDate="2015-01-02T01:33:40.430" Score="1" Body="&lt;p&gt;@Ron&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That was it. Forgot that packets would not know how to get back to the source IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Created two static routes on SonicWALL with gateway 192.168.1.254 for networks 192.168.50.0/24 and 192.168.100.0/24.&lt;/p&gt;&#xA;" OwnerUserId="10475" LastActivityDate="2015-01-02T01:33:40.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14928" PostTypeId="2" ParentId="14861" CreationDate="2015-01-02T09:30:20.597" Score="-1" Body="&lt;p&gt;Got the replacment today and it was my switch all along ... the new one with the same config (Layer 2) works awesomely .... thank you all for all your help...&lt;/p&gt;&#xA;" OwnerUserId="12086" LastActivityDate="2015-01-02T09:30:20.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14931" PostTypeId="2" ParentId="13340" CreationDate="2015-01-02T13:15:41.717" Score="1" Body="&lt;p&gt;this behaviour is because you begin  to tag frames from the vSwitch and the Switch HP procurve Core SW is not tagging VLAN 1, this is usual because VLAN 1 is most frequently the default VLAN or Native VLAN. In most environments this VLAN is not tagging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make this work right: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1)you must untagged VLAN 1 in the vSwitch, and tag all the others VLAN that you want to create.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) other option: you can tag VLAN 1 in your vSwitch and in the HP procurve Core SW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would prefer first option, but its matter of taste.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I Hope Helps!&lt;/p&gt;&#xA;" OwnerUserId="10098" LastActivityDate="2015-01-02T13:15:41.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14934" PostTypeId="1" AcceptedAnswerId="14938" CreationDate="2015-01-02T16:47:19.847" Score="-1" ViewCount="110" Body="&lt;p&gt;We have a Toshiba Strata VOIP phone system. Getting bombarded with calls from 'cisco'. Answering the call immediately hangs up. Happening every 3-4 seconds. Not sure if they are originating from outside our office or if it is an internal thing. I do not have a device on our lan title 'cisco', so I'm not sure where its coming from. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how to stop this before our receptionist quits?&lt;/p&gt;&#xA;" OwnerUserId="12148" LastActivityDate="2015-01-02T20:18:33.143" Title="Toshiba Strata CIX Calls From 'cisco'" Tags="|voip|" AnswerCount="1" CommentCount="1" ClosedDate="2019-06-03T21:33:21.327" ContentLicense="CC BY-SA 3.0" />
  <row Id="14935" PostTypeId="1" AcceptedAnswerId="16109" CreationDate="2015-01-02T17:04:13.083" Score="3" ViewCount="801" Body="&lt;p&gt;In a capture I've made between a Cisco 6500 (with two SUP2T card) and another Firewall I can see that the Cisco Router is sending a &amp;quot;Forwarding State&amp;quot; Flag equal to 0.&lt;/p&gt;&#xA;&lt;p&gt;Since this is in the initialization and since in the RFC we can read :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;https://www.rfc-editor.org/rfc/rfc4724&lt;/p&gt;&#xA;&lt;p&gt;If one wants to apply graceful restart only when the restart is&#xA;planned (as opposed to both planned and unplanned restart), then one&#xA;way to accomplish this would be to set the Forwarding State bit to 1&#xA;after a planned restart, and to 0 in all other cases.  Other&#xA;approaches to accomplish this are outside the scope of this document.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Does-this mean that the Cisco is only capable to supporting Planned Graceful-restart (ie. Card SwitchOver) and not unplanned (ie. Sudden problem with the SUP2T card).&lt;/p&gt;&#xA;&lt;p&gt;Is there any reason for the Cisco to not send a &amp;quot;Forwarding State&amp;quot; Flag equal to 1 in the initialization ?&lt;/p&gt;&#xA;&lt;p&gt;Thanks for any help,&lt;/p&gt;&#xA;" OwnerUserId="12149" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2018-12-27T01:06:18.823" Title="BGP Graceful-restart Initialization Flag" Tags="|cisco|routing|bgp|protocol-theory|rfc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14936" PostTypeId="1" AcceptedAnswerId="14991" CreationDate="2015-01-02T17:50:56.353" Score="3" ViewCount="2260" Body="&lt;p&gt;I have linux machine multicasting UDP streams with Java applications. The multicats go though ciso router. I see lot of packet losses at receivers. Checking ports in routers reveals overruns counter increasing. Searching on internet specifies these happens due to microbursts from TX machine. I also guess same, because drops increases with time, may be java app getting unstable with time, and then starting outputting bursts of packets, its buggy.  Maybe I can change something in the router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following is Cisco hardware:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco WS-C6504-E w/ FAN-MOD-4HS Empty 4-slot 6500 Enhanced Chassis 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco PWR-2700-AC/4 2700W AC Power for 7604 6504-E #12025 X 2 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Catalyst 6500 7600 Supervisor 720 Module - WS-SUP720-3BXL WS-F6K-PFC3BXL 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco WS-X6548-GE-TX 48-Port 1G Copper Eth Module&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following is CPU utilization:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RHE-001#show fabric utilization all&#xA; slot    channel      speed    Ingress %     Egress %&#xA;    1          0        20G            0            0&#xA;    2          0         8G           12            2&#xA;    3          0         8G            9           14&#xA;    4          0         8G            0           13&#xA;&#xA;RHE-001#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Following is interface statistics:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RHE-001#show int GigabitEthernet 2/4&#xA;GigabitEthernet2/4 is up, line protocol is up (connected)&#xA;  Hardware is C6k 1000Mb 802.3, address is 0023.04dd.0d00 (bia 0023.04dd.0d00)&#xA;  Internet address is 10.0.1.13/30&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,&#xA;     reliability 255/255, txload 7/255, rxload 21/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseT&#xA;  input flow-control is off, output flow-control is off&#xA;  Clock mode is auto&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:27, output 00:00:05, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 5d08h&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 83389000 bits/sec, 7648 packets/sec&#xA;  5 minute output rate 30360000 bits/sec, 2786 packets/sec&#xA;  L2 Switched: ucast: 32 pkt, 2048 bytes - mcast: 0 pkt, 0 bytes&#xA;  L3 in Switched: ucast: 0 pkt, 0 bytes - mcast: 3542591539 pkt, 4825009676118 bytes mcast&#xA;  L3 out Switched: ucast: 0 pkt, 0 bytes mcast: 2879819193 pkt, 3922313740866 bytes&#xA;     3542548642 packets input, 4830700273704 bytes, 0 no buffer&#xA;     Received 3542548610 broadcasts (3542458124 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 4243199 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     1276819687 packets output, 1738995021346 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;RHE-001#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As we can see &lt;strong&gt;overrun&lt;/strong&gt; counter increasing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Buffers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RHE-001#show buffers&#xA;Buffer elements:&#xA;     499 in free list (500 max allowed)&#xA;     623919821 hits, 0 misses, 0 created&#xA;&#xA;Public buffer pools:&#xA;Small buffers, 104 bytes (total 1024, permanent 1024):&#xA;     1021 in free list (128 min, 2048 max allowed)&#xA;     183749828 hits, 0 misses, 0 trims, 0 created&#xA;     0 failures (0 no memory)&#xA;Medium buffers, 256 bytes (total 3000, permanent 3000):&#xA;     2999 in free list (64 min, 3000 max allowed)&#xA;     22779465 hits, 0 misses, 0 trims, 0 created&#xA;     0 failures (0 no memory)&#xA;Middle buffers, 600 bytes (total 512, permanent 512):&#xA;     510 in free list (64 min, 1024 max allowed)&#xA;     5814462 hits, 0 misses, 0 trims, 0 created&#xA;     0 failures (0 no memory)&#xA;Big buffers, 1536 bytes (total 1000, permanent 1000):&#xA;     999 in free list (64 min, 1000 max allowed)&#xA;     2009529750 hits, 0 misses, 0 trims, 0 created&#xA;     0 failures (0 no memory)&#xA;VeryBig buffers, 4520 bytes (total 10, permanent 10):&#xA;     10 in free list (0 min, 100 max allowed)&#xA;     363 hits, 0 misses, 0 trims, 0 created&#xA;     0 failures (0 no memory)&#xA;Large buffers, 9240 bytes (total 8, permanent 8):&#xA;     8 in free list (0 min, 10 max allowed)&#xA;     57 hits, 0 misses, 0 trims, 0 created&#xA;     0 failures (0 no memory)&#xA;Huge buffers, 18024 bytes (total 2, permanent 2):&#xA;     2 in free list (0 min, 4 max allowed)&#xA;     41 hits, 0 misses, 0 trims, 0 created&#xA;     0 failures (0 no memory)&#xA;&#xA;Interface buffer pools:&#xA;Syslog ED Pool buffers, 600 bytes (total 150, permanent 150):&#xA;     118 in free list (150 min, 150 max allowed)&#xA;     10421 hits, 10168 misses&#xA;LI Middle buffers, 600 bytes (total 512, permanent 256, peak 512 @ 7w0d):&#xA;     256 in free list (256 min, 768 max allowed)&#xA;     171 hits, 85 fallbacks, 0 trims, 256 created&#xA;     0 failures (0 no memory)&#xA;     256 max cache size, 256 in cache&#xA;     0 hits in cache, 0 misses in cache&#xA;EOBC0/0 buffers, 1524 bytes (total 2400, permanent 2400):&#xA;     1200 in free list (0 min, 2400 max allowed)&#xA;     1200 hits, 0 fallbacks&#xA;     1200 max cache size, 680 in cache&#xA;     2369496864 hits in cache, 0 misses in cache&#xA;LI Big buffers, 1536 bytes (total 512, permanent 256, peak 512 @ 7w0d):&#xA;     256 in free list (256 min, 768 max allowed)&#xA;     171 hits, 85 fallbacks, 0 trims, 256 created&#xA;     0 failures (0 no memory)&#xA;     256 max cache size, 256 in cache&#xA;     0 hits in cache, 0 misses in cache&#xA;IPC buffers, 4096 bytes (total 2352, permanent 2352):&#xA;     2242 in free list (784 min, 7840 max allowed)&#xA;     333747144 hits, 0 fallbacks, 0 trims, 0 created&#xA;     0 failures (0 no memory)&#xA;LI Very Big buffers, 4520 bytes (total 257, permanent 128, peak 257 @ 7w0d):&#xA;     129 in free list (128 min, 384 max allowed)&#xA;     85 hits, 43 fallbacks, 4101 trims, 4230 created&#xA;     0 failures (0 no memory)&#xA;     128 max cache size, 128 in cache&#xA;     0 hits in cache, 0 misses in cache&#xA;Private Huge IPC buffers, 18024 bytes (total 2, permanent 2):&#xA;     2 in free list (1 min, 4 max allowed)&#xA;     0 hits, 0 misses, 0 trims, 0 created&#xA;     0 failures (0 no memory)&#xA;Private Huge buffers, 65280 bytes (total 2, permanent 2):&#xA;     2 in free list (1 min, 4 max allowed)&#xA;     787 hits, 0 misses, 0 trims, 0 created&#xA;     0 failures (0 no memory)&#xA;&#xA;Header pools:&#xA;&#xA;&#xA;RHE-001#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are no switches. The multicast transmitting machines and receiving machines are directly connected to cisco router.&lt;/p&gt;&#xA;" OwnerUserId="12150" LastEditorUserId="8499" LastEditDate="2018-03-19T17:08:43.180" LastActivityDate="2018-03-19T17:08:43.180" Title="overcome microbursts in cisco router or transmitting linux machine" Tags="|cisco|switch|multicast|linux|packet-loss|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="14937" PostTypeId="1" AcceptedAnswerId="15998" CreationDate="2015-01-02T18:04:05.373" Score="4" ViewCount="1608" Body="&lt;p&gt;I wanted to implement trivial MAC-based authentication on some Cisco SG300 (small-business) switches. The client doesn't ask for auth but I simply want the client's MAC address to be authenticated, like for a printer.&lt;/p&gt;&#xA;&lt;p&gt;Those switches can do both 802.1x as well as MAC-based auth. However their definition/implementation of the latter seems interesting. Read ahead.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;First&lt;/strong&gt;, in the case of MAC-based auth, as usual the switch assumes the role of the supplicant. However these ones still send EAP packets inside the RADIUS request, instead of a plain RADIUS request, to the authentication/RADIUS server. The manual gives this hint:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;MAC-based authentication is an alternative to 802.1X authentication&#xA;that allows network access to devices (such as printers and IP phones)&#xA;that do not have the&#xA;802.1X supplicant capability. MAC-based authentication uses the MAC address of the connecting device to grant or deny network access.&lt;/p&gt;&#xA;&lt;p&gt;In this case, the switch supports EAP MD5 functionality with the username&#xA;and password equal to the client MAC address&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Now all the other gear we have doesn't do that when you want to use plain MAC-based auth. Even Cisco themselves don't do that on their IOS devices (where the feature is called &amp;quot;MAC-auth bypass&amp;quot;).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Second&lt;/strong&gt;, these switches (SG series) can do dynamic VLAN assignment, meaning you return a certain RADIUS attribute with a VLAN embedded in it, and then the switch will apply that VLAN on the port if possible.&lt;/p&gt;&#xA;&lt;p&gt;Now in this case, this attribute is silently ignored, if it is not nicely provided in an EAP &amp;quot;envelope&amp;quot;. This is where it all comes together and breaks our current setup (or it needs to be modified.)&lt;/p&gt;&#xA;&lt;p&gt;I could of course try to configure the RADIUS server (here freeradius) to handle both situations (EAP as well as plain RADIUS), but what I mainly want to know from someone who has already gone through all this is: &lt;em&gt;Is a &amp;quot;MAC authentication&amp;quot; that still generates EAP packets a valid approach?&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Now what I would want to do is:&lt;/strong&gt; Nail Cisco's support and tell them that either the device should do&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;EAP when 802.1x is requested&lt;/li&gt;&#xA;&lt;li&gt;plain RADUIS when MAC-auth is requested (and not some kind of EAP nevertheless)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;However I would need some strong rationale for that :)&lt;/p&gt;&#xA;&lt;p&gt;I know this isn't some &amp;quot;I've tried this and that and how do I finally get it to work&amp;quot; question but rather the type &amp;quot;Why is it working like that? Is it correct of them to implement it this way? If yes, why; if no, why not?&amp;quot; (Maybe you have some RFC or the like in mind.) Hope that's ok.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-01-07T10:00:27.030" Title="EAP packets generated for plain MAC-based authentication" Tags="|cisco|radius|ieee-802.1x|mac-auth-bypass|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14938" PostTypeId="2" ParentId="14934" CreationDate="2015-01-02T20:18:33.143" Score="1" Body="&lt;p&gt;These calls were coming from an &quot;unknown source&quot; via our VOIP service provider. They have since blocked the calls and everything is as normal.&lt;/p&gt;&#xA;" OwnerUserId="12148" LastActivityDate="2015-01-02T20:18:33.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14939" PostTypeId="1" CreationDate="2015-01-02T20:37:56.697" Score="4" ViewCount="5261" Body="&lt;p&gt;I have two network appliances configured on a network, an older Juniper Firewall and a Meraki Security Appliance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Juniper device I can use the base static IP address, ex: xx.xx.xx.xx and then I can use a /29 prefix and route all of the static IP traffic through said device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configure the untrusted uplink as such: xx.xx.xx.xx/29&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I replicate this on a Meraki or other networking device?&lt;/p&gt;&#xA;" OwnerDisplayName="user12153" LastActivityDate="2016-01-02T11:54:26.360" Title="Configuring Static IP Block On Meraki Security Appliance" Tags="|cisco|routing|nat|ip|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14941" PostTypeId="2" ParentId="2836" CreationDate="2015-01-03T00:52:24.000" Score="0" Body="&lt;p&gt;I have the same issue as you while running Kali Linux on my 2009 Macbook Pro. However, I can see the rest of the traffic on my network if plug directly into my router and use the ethernet connection rather than wlan0 (en0 for OSX) as my interface for Wireshark.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are options out there for ethernet to USB adaptors for the Macbook air. Much less stealthy, but it may do the trick :)&lt;/p&gt;&#xA;" OwnerUserId="12155" LastActivityDate="2015-01-03T00:52:24.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14944" PostTypeId="1" AcceptedAnswerId="14945" CreationDate="2015-01-03T16:08:10.217" Score="4" ViewCount="1002" Body="&lt;p&gt;I work at a medium-sized retail company, and we'll be moving warehouse sometime early this year. One requirement that we have for the new warehouse is that we need a proper, stable wireless network covering the entire warehouse area, since we work a lot with web-based tools which require constant connectivity. A rough estimate says that it's about 10 meters high, and maybe 50 x 50 meters along the walls. In our current warehouse, which is of similiar height, we have a couple of HP MSM430 mounted to beams in the ceiling, and controlled by a HP MSM710 controller. This setup has proven unstable and spotty in it's connectivity, which puts a bit of pressure on us to get it right this time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're using UniFi AP Pro's in our retail locations, and they've proven reliable so far, but I'm concerned about how well they'll perform in a warehouse environment since there'll be greater distances to cover (if they're mounted to the ceiling), and more devices connected to them than in a store. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've come up with so far is to use UniFi AP Pro's, and have the access points mounted in the ceiling, placed above the &quot;aisles&quot; between the shelves, two APs per aisle. There's 10 aisles, and I'm planning on &quot;shifting&quot; the placement in the ceiling along the aisles so that every odd row has the access points lined up with eachother, which I imagine will give better overall coverage. Simple illustration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;|   |   |   |   |&#xA;|   |   |   |   |&#xA;|   | o |   | o |&#xA;|   |   |   |   |&#xA;|   |   |   |   |&#xA;|   |   |   |   |&#xA;| o |   | o |   |&#xA;|   |   |   |   |&#xA;|   |   |   |   |&#xA;|   |   |   |   |&#xA;|   | o |   | o |&#xA;|   |   |   |   |&#xA;|   |   |   |   |&#xA;|   |   |   |   |&#xA;| o |   | o |   |&#xA;|   |   |   |   |&#xA;|   |   |   |   |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this a sound idea, or is there better ways to do this?&lt;/p&gt;&#xA;" OwnerUserId="12160" LastEditorUserId="33" LastEditDate="2015-11-21T11:13:35.950" LastActivityDate="2015-11-23T03:08:30.863" Title="WiFi planning for warehouse-sized location" Tags="|wireless|ieee-802.11|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14945" PostTypeId="2" ParentId="14944" CreationDate="2015-01-03T17:32:56.290" Score="11" Body="&lt;p&gt;Hire a professional who has warehouse experience.  If you were using an enterprise vendor, I would suggest looking at their consulting services as they have probably done this with their products a number of times.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Warehouses and stadiums are considered the two most difficult wireless environments to work in with 802.11.  There are many factors that make warehouse areas very difficult to work in, for instance, open spaces combined with metal rack shelving, the long thin aisles that can channel energy further than you suspect, the adding/removing of invenorty that changes the environment on a continual basis, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without the proper tools and experience, you are simply gambling on your wireless network.  It may work, but odds are you will have strange issues, issues in certain locations, and other unforseen problems.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-01-03T17:32:56.290" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14947" PostTypeId="1" AcceptedAnswerId="14953" CreationDate="2015-01-03T21:31:57.510" Score="12" ViewCount="13979" Body="&lt;p&gt;RFC 1771 defines a path attribute type of &lt;strong&gt;AS_PATH&lt;/strong&gt; as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AS_PATH (Type Code 2):&#xA;&#xA;AS_PATH is a well-known mandatory attribute that is composed&#xA;of a sequence of AS path segments. Each AS path segment is&#xA;represented by a triple &amp;lt;path segment type, path segment&#xA;length, path segment value&amp;gt;.&#xA;&#xA;The path segment type is a 1-octet long field with the&#xA;following values defined:&#xA;&#xA;Value Segment Type&#xA;1 AS_SET:      unordered set of ASs a route in the&#xA;               UPDATE message has traversed&#xA;2 AS_SEQUENCE: ordered set of ASs a route in&#xA;               the UPDATE message has traversed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using a AS_PATH type of AS_SEQUENCE makes perfect sense to me: You end up with a reverse list of the ASN's you cross to get to a particular prefix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I have no idea what purpose having an unordered list of ASN's between you and the prefix that would occur if you chose to use an AS_PATH of AS_SET.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The quote above is from the UPDATE message format, so presumably, an Admin has the option to send to BGP peers an ordered list or an unordered list.  My question then is, &lt;strong&gt;what would the purpose be of sending an unordered list&lt;/strong&gt;?   In what cases would you be better off sending an unordered list as opposed to an ordered list?&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="8499" LastEditDate="2018-12-27T01:07:13.140" LastActivityDate="2018-12-27T01:07:13.140" Title="How is BGP &quot;AS_SET&quot; used?" Tags="|routing|bgp|protocol-theory|rfc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14953" PostTypeId="2" ParentId="14947" CreationDate="2015-01-04T00:06:24.157" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question then is, what would the purpose be of sending an unordered list? In what cases would you be better off sending an unordered list as opposed to an ordered list?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;as-set&lt;/code&gt; is commonly used when aggregating routes downstream of an autonomous system; so the use case for an unordered list is &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5441-aggregation.html&quot;&gt;bgp aggregation&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;EXAMPLE&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example below, AS65500 aggregates the eBGP announcements from AS65000 and AS65001 into 10.1.0.0/23.  After aggregating the announcements from AS65000 and AS65001, AS65500 sends &lt;code&gt;NETWORK: 10.1.2.0/23   AS-PATH: 65500&lt;/code&gt; and &lt;code&gt;NETWORK: 10.1.0.0/23   AS-PATH: 65500 {65000, 65001}&lt;/code&gt; (the aggregate).  Typically, an AS will aggregate when it has delegated portions of a larger address block to customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't make sense to build an ordered list when you aggregate space for multiple ASNs; for instance, an ordered AS-PATH for the aggregate below would be either &lt;code&gt;65500 [65000, 65001]&lt;/code&gt; or &lt;code&gt;65500 [65001, 65000]&lt;/code&gt;.  However, both of those ordered lists are non-sense because ordering is irrelevant to the aggregate (i.e. both autonomous systems are directly connected to AS 65500).  Ordering implies a sequence which is meaningless to the aggregate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unordered lists (i.e. &lt;em&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Set_%28mathematics%29&quot;&gt;mathematical sets&lt;/a&gt;&lt;/em&gt;) make the most sense for an AS_SET.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          _.------------.&#xA;      ,-''               `--.&#xA;    ,'                       `.&#xA;   (         AS65000           )&#xA;    `.       10.1.0.0/24     ,'&#xA;      `--.               _.-'&#xA;          `------------''&#xA;                    \          ------&amp;gt; NETWORK: 10.1.2.0/23   AS-PATH: 65500&#xA;                     \         ------&amp;gt; NETWORK: 10.1.0.0/23   AS-PATH: 65500 {65000, 65001}&#xA;           _.--------------.        router bgp 65500&#xA;       ,-''                 `--.     no sync&#xA;     ,'                         `.   no auto-summary&#xA;    (          AS65500             ) neighbor 10.1.0.2 remote-as 65000&#xA;     `.        10.1.2.0/23      ,'   neighbor 10.1.1.2 remote-as 65001&#xA;       --.                 _.-'      network 10.1.2.0 mask 255.255.254.0&#xA;           `--------------''         aggregate-add 10.1.0.0 255.255.254.0 summary-only as-set&#xA;                    /&#xA;                   /&#xA;          _.--------------.&#xA;      ,-''                 `--.&#xA;   ,'                         `.&#xA;  (           AS65001           )&#xA;   `.         10.1.1.0/24     ,'&#xA;     `--.                 _.-'&#xA;         `--------------''&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-01-04T00:31:17.233" LastActivityDate="2015-01-04T00:31:17.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14956" PostTypeId="1" AcceptedAnswerId="14959" CreationDate="2015-01-04T13:48:42.940" Score="2" ViewCount="1686" Body="&lt;p&gt;let's say that we have a router with address: &lt;strong&gt;172.31.219.33/27&lt;/strong&gt; from this I can tell several things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Subnet mask: &lt;strong&gt;255.255.255.224&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Broadcast address (here I am not sure if last digit should 64 or 65 - see later): &lt;strong&gt;172.31.219.64&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Last host address (since we know broadcast address; also not sure if last digit should be 63 or 62): &lt;strong&gt;172.31.219.63&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;We could also tell first host address (&lt;strong&gt;172.31.219.33&lt;/strong&gt;) and network address (&lt;strong&gt;172.31.219.32&lt;/strong&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand two things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why is first host address &lt;strong&gt;X.X.X.33&lt;/strong&gt;? It is like the router is already host?&lt;/li&gt;&#xA;&lt;li&gt;Why is network address &lt;strong&gt;X.X.X.32&lt;/strong&gt;? In other way, why it is not &lt;strong&gt;X.X.X.33&lt;/strong&gt; (from router address)?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="12177" LastEditorUserId="775" LastEditDate="2015-01-04T15:12:38.017" LastActivityDate="2015-01-06T22:31:22.697" Title="Why is this a network if all host bits are zeros?" Tags="|router|ipv4|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14958" PostTypeId="2" ParentId="11110" CreationDate="2015-01-04T14:41:29.673" Score="0" Body="&lt;p&gt;BGP can be used in large data centers along with IGP as transit, there is one use case developed by Yakov and Cisco lifted this use case for Nexus 9000. This eliminates the STP. We can use any AS numbers as long as we don't leak the traffic into the internet. Still it is recommended to use private ASes.&lt;/p&gt;&#xA;" OwnerUserId="12179" LastEditorUserId="619" LastEditDate="2015-01-04T20:46:42.870" LastActivityDate="2015-01-04T20:46:42.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14959" PostTypeId="2" ParentId="14956" CreationDate="2015-01-04T14:41:32.187" Score="4" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Why is first host address X.X.X.33?&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It is like the router is already host?&lt;/li&gt;&#xA;&lt;li&gt;Why is network address X.X.X.32? In other way, why it is not X.X.X.33 (from router address)?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The reason for calculating network addresses and host addresses like this is specified in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc950&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 950&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1878&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1878&lt;/a&gt;; contiguous binary network masks are used to divide IPv4 addresses into host portions and network portions; if the host portion is all-zeros, that is by-definition a network, and &lt;em&gt;not&lt;/em&gt; a host.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;10101100.00011111.11011011.00100001    =&amp;gt; IP 172.31.219.33 as binary&#xA;11111111.11111111.11111111.11100000    =&amp;gt; 27-bit network mask (binary AND with IP for net)&#xA;                              ^^^^^&#xA;                                Host bits are zero in a network mask&#xA;^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^&#xA;             Network bits are ones in a network mask&#xA;----------------------------------------------------------------------------&#xA;10101100.00011111.11011011.00100000    &amp;lt;= 172.31.219.32 is the *network*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If you need help understanding how to calculate these correctly, we have many Q&amp;amp;As which already respond to this problem.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-01-04T15:10:42.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14962" PostTypeId="1" AcceptedAnswerId="14963" CreationDate="2015-01-04T19:31:01.620" Score="0" ViewCount="1202" Body="&lt;p&gt;I am monitoring my network and I would like to know how many mobile devices are there. I am already filtering probe requests and matching MAC adresses with OUI identifier. However I have few doubts about this procedure:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Around 90% of MAC addresses captured do not match any OUI. Can we&#xA;assume that mobile devices will always have a known OUI?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there any list with known OUI belonging to mobile devices? I&#xA;would like to filter our laptops and PCs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I know it depends on many factors, but what is the average frequency&#xA;more or less in which the probe requests are send?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="12174" LastActivityDate="2015-04-04T21:40:31.723" Title="Filter mobile devices MAC address" Tags="|wireless|mac-address|tcpdump|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14963" PostTypeId="2" ParentId="14962" CreationDate="2015-01-04T19:38:20.913" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;[rewriting your question without assumptions about the solution]&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Q: &quot;How do I find what OS/Device is connected to our wifi?&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Don't use mac-addresses to determine endpoint operating systems; mac-addresses are easily spoofed, and vendors can change their wifi PHY ASIC supplier on a whim&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use something like &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3031/can-dhcp-server-determine-clients-os&quot;&gt;DHCP Fingerprinting&lt;/a&gt;, or better still, &lt;a href=&quot;http://www.cisco.com/c/en/us/products/security/identity-services-engine/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco ISE&lt;/a&gt; (which does DHCP, HTTP, RADIUS EAP supplicant, and &lt;a href=&quot;http://nmap.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;nmap&lt;/code&gt;&lt;/a&gt; fingerprinting, all in one appliance)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-01-04T19:38:20.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14965" PostTypeId="1" AcceptedAnswerId="14968" CreationDate="2015-01-04T22:17:33.423" Score="1" ViewCount="1281" Body="&lt;p&gt;I am learning about ICMP Redirect and I struggle with understanding it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I have a network like this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/J9EkS.png&quot; alt=&quot;photo&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to communicate from PC0 to PC1 which are on different subnet and at the beginning ICMP packet will be send to default gateway ( Router 3)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I have static routing like this :&#xA;Router3 - &gt; Router2 -&gt; Router1 -&gt; Router0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) I have static routing like this :&#xA;Router3 -&gt; Router1 -&gt; Router0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) I have static routing like this :&#xA;Router3 -&gt; Router0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and please let me know if I am right&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ad 1 :&#xA;there won't be ICMP redirect, because next hop of Router 3 , which is Router 2 isn't on the same subnet as PC0 is. Every time PC0 will communicate with PC1 the path will be&#xA;PC0 -&gt; Router3 -&gt; Router2 -&gt; Router1 -&gt; Router0 -&gt; PC1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ad 2:&#xA;At the begining communication will be PC0 -&gt; Router3  -&gt; Router1 -&gt; Router0 -&gt; PC1&#xA;Then ICMP redirect will send and next communication will be&#xA;PC0 -&gt;  Router1 -&gt; Router0 -&gt; PC1&#xA;and ICMP redirect will send again and next communication will be&#xA;PC0  -&gt; Router0 -&gt; PC1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ad 3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the begining PC0 -&gt; Router3 -&gt; Router0 -&gt; PC1.&#xA;Then, ICMP redirect and the path will be PC0 -&gt; Router0 -&gt; PC1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for my English&lt;/p&gt;&#xA;" OwnerUserId="12187" LastEditorUserId="31801" LastEditDate="2018-12-30T21:17:15.097" LastActivityDate="2018-12-30T21:17:15.097" Title="ICMP Redirect , static routing" Tags="|router|icmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="14968" PostTypeId="2" ParentId="14965" CreationDate="2015-01-05T04:23:38.900" Score="1" Body="&lt;p&gt;You are almost correct.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1) I have static routing like this : Router3 - &gt; Router2 -&gt; Router1 -&gt; Router0&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ad 1 : there won't be ICMP redirect, because next hop of Router 3 , which is Router 2 isn't on the same subnet as PC0 is. Every time PC0 will communicate with PC1 the path will be PC0 -&gt; Router3 -&gt; Router2 -&gt; Router1 -&gt; Router0 -&gt; PC1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Absolutely correct.  Since Router3 doesn't know the full path, only the next hop, it would just forward the packet to Router2&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2) I have static routing like this : Router3 -&gt; Router1 -&gt; Router0&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ad 2: At the begining communication will be PC0 -&gt; Router3 -&gt; Router1 -&gt; Router0 -&gt; PC1 Then ICMP redirect will send and next communication will be PC0 -&gt; Router1 -&gt; Router0 -&gt; PC1 and ICMP redirect will send again and next communication will be PC0 -&gt; Router0 -&gt; PC1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Almost.  You are correct in saying that Router 3 will send an ICMP Redirect to PC0, informing PC0 that the proper 'next-hop' to get to PC1 is to use Router1.  &lt;em&gt;However&lt;/em&gt;, &lt;strong&gt;when the ICMP Redirect is sent to the original sender, the &lt;em&gt;original packet is still forwarded&lt;/em&gt;&lt;/strong&gt;.  Which means when Router1 receives the original packet, it will be receiving a packet from a host in its own network, for which a better next-hop exists, also in the same network (Router0).  So Router1 will also send an ICMP redirect from the first packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the path of the first packet will actually go Router3 -&gt; Router1 -&gt; Router0 -&gt; PC1.  But &lt;em&gt;both&lt;/em&gt; Router3 &lt;em&gt;and&lt;/em&gt; Router1 will send PC0 an ICMP Redirect informing PC0 of the better next hop.   Since Router1's ICMP redirect will come &lt;em&gt;after&lt;/em&gt; Router3's, then Router1's ICMP redirect will overwrite Router3's.  So the second packet will go PC0 -&gt; Router0 -&gt; PC1.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;3) I have static routing like this : Router3 -&gt; Router0&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ad 3: At the begining PC0 -&gt; Router3 -&gt; Router0 -&gt; PC1. Then, ICMP redirect and the path will be PC0 -&gt; Router0 -&gt; PC1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Absolutely Correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR&gt;&#xA;Two final points to keep in mind:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, in all cases, the ICMP Redirect is temporary.  I believe that PC0 will use the information in the ICMP redirect for 10 minutes, before 'going back to' what it knew before... which would prompt additional ICMP redirects, and an additional 10 minutes of more efficient routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, ICMP Redirect was created when the Internet was a nice place, with trust worthy people.  Now a days, the Internet is a dark and scary place, for which you should have very little trust.  As a security best practice, most Network Admins prevent their Routers from sending ICMP Redirects and prevent their Routers from 'obeying' ICMP redirects.  Similarly, a lot of client OS's also flat out ignore ICMP redirects.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for this is it would be very easy to abuse the ICMP redirect to become a Man in the Middle.  If you and I happen to be on the same network, I could easily send you an ICMP Redirect message that tells you the &quot;better next hop&quot; to reach your [Facebook, Banking, e-Commerce, Intra-net Portal, anything] network is through my own IP.  Voila, instant Man in the Middle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, I think its good to know the basics of ICMP Redirect, but I think it isn't very functional to spend much time mastering how they work.  Its nearly across the board disabled and/or disallowed -- for good reason.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-01-05T04:23:38.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14970" PostTypeId="2" ParentId="11364" CreationDate="2015-01-05T14:01:02.657" Score="3" Body="&lt;p&gt;You should be able to use: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;utils reset_application_ui_administrator_name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;utils reset_application_ui_administrator_password&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To confuse things a bit, the latest install guide &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/install/10_0_1/CUCM_BK_I95AD2FE_00_installing-cucm-100.pdf&quot; rel=&quot;nofollow&quot;&gt;Installing Cisco Unified Communications Manager, Release 10.0(1)&lt;/a&gt; indicates you can use &lt;code&gt;utils reset ui administrator name&lt;/code&gt; and  &lt;code&gt;utils reset ui administrator password&lt;/code&gt; but those are also not available on my lab servers.&lt;/p&gt;&#xA;" OwnerUserId="12194" LastEditorUserId="3191" LastEditDate="2015-01-05T17:27:43.693" LastActivityDate="2015-01-05T17:27:43.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14974" PostTypeId="1" AcceptedAnswerId="14980" CreationDate="2015-01-05T17:06:29.487" Score="3" ViewCount="359" Body="&lt;p&gt;My ISP terminates their fiber connection with a Ceina router, which then goes to a Cisco router which hands off my internet connection.  I only have documentation on the Cisco (2nd device in line) config, not the Ceina (1st device, fiber termination).  I noticed on the Cisco config the eth port going to the Ceina is an IP/subnet in the public range, but isn't my static IP block from my ISP.  The eth port going to my network from the Cisco router is indeed that block however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand with proper routing this can work.  I'm just curious what that 2nd unknown public-space block of IP's is about?  Does my ISP forward traffic to that subnet?  Doesn't the fact it overlays public IP space make an issue?  Wouldn't the Ceina just use up one of my IPs in my block?  Anyone seen this before?&lt;/p&gt;&#xA;" OwnerUserId="10411" LastEditorUserId="2142" LastEditDate="2015-01-06T20:54:56.533" LastActivityDate="2015-01-06T20:54:56.533" Title="Why is ISP link address different than my assigned IP addresses?" Tags="|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14975" PostTypeId="1" CreationDate="2015-01-05T17:59:16.100" Score="18" ViewCount="15866" Body="&lt;p&gt;This inversion is bijective, so I can't figure out what is it's use.&lt;/p&gt;&#xA;" OwnerUserId="12080" LastActivityDate="2020-06-19T09:26:07.237" Title="Why is the U/L bit inversed in EUI64?" Tags="|ipv6|protocol-theory|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14977" PostTypeId="2" ParentId="14975" CreationDate="2015-01-05T19:53:47.087" Score="20" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#appendix-A&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291&lt;/a&gt; provides instructions on how to create the EUI64 address:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Links or Nodes with IEEE 802 48-bit MACs&#xA;&#xA;[EUI64] defines a method to create an IEEE EUI-64 identifier from an&#xA;IEEE 48-bit MAC identifier.  This is to insert two octets, with&#xA;hexadecimal values of 0xFF and 0xFE (see the Note at the end of&#xA;appendix), in the middle of the 48-bit MAC (between the company_id&#xA;and vendor-supplied id).  An example is the 48-bit IEEE MAC with&#xA;Global scope:&#xA;&#xA;|0              1|1              3|3              4|&#xA;|0              5|6              1|2              7|&#xA;+----------------+----------------+----------------+&#xA;|cccccc0gcccccccc|ccccccccmmmmmmmm|mmmmmmmmmmmmmmmm|&#xA;+----------------+----------------+----------------+&#xA;&#xA;where &amp;quot;c&amp;quot; is the bits of the assigned company_id, &amp;quot;0&amp;quot; is the value of&#xA;the universal/local bit to indicate Global scope, &amp;quot;g&amp;quot; is&#xA;individual/group bit, and &amp;quot;m&amp;quot; is the bits of the manufacturer-&#xA;selected extension identifier.  The interface identifier would be of&#xA;the form:&#xA;&#xA;|0              1|1              3|3              4|4              6|&#xA;|0              5|6              1|2              7|8              3|&#xA;+----------------+----------------+----------------+----------------+&#xA;|cccccc1gcccccccc|cccccccc11111111|11111110mmmmmmmm|mmmmmmmmmmmmmmmm|&#xA;+----------------+----------------+----------------+----------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2373#section-2.5.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2373&lt;/a&gt; provides the 'why' behind flipping the 7th bit:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;The motivation for inverting the &amp;quot;u&amp;quot; bit when forming the interface&#xA;identifier is to make it easy for system administrators to hand&#xA;configure local scope identifiers when hardware tokens are not&#xA;available.  This is expected to be case for serial links, tunnel end-&#xA;points, etc.  The alternative would have been for these to be of the&#xA;form 0200:0:0:1, 0200:0:0:2, etc., instead of the much simpler ::1,&#xA;::2, etc.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But that is a bit of a mouthful.  So in simpler terms...  &lt;strong&gt;In MAC address architecture, the 7th bit signifies whether the MAC address was universally or locally assigned.&lt;/strong&gt; A value of 0 indicates the address is universally administered. For instance, the when IANA assigns an Organizationally Unique Identifier (OUI) to a NIC card vendor, the 7th bit will be 0, indicating the OUI was universally assigned. &lt;strong&gt;Should a user manually change their MAC address, this 7th bit would be set to 1, indicating the Ethernet address was locally administered&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;There is also some more information about this at &lt;a href=&quot;http://packetlife.net/blog/2008/aug/4/eui-64-ipv6/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PacketLife&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-01-05T19:53:47.087" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="14978" PostTypeId="1" AcceptedAnswerId="20481" CreationDate="2015-01-05T20:13:50.887" Score="3" ViewCount="3605" Body="&lt;p&gt;I have a brocade 6740 that I am using as my gateway. All traffic on the network performs as expected, EXCEPT when I actually access the ip address of the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if I ping the gateway my latency is over half a second&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: Brocade has confirmed that ICMP on virtual interfaces is extremeley low priority for the CPU, which is why ping times are high (expected behavior) However this does not answer the issue of why telnet/ssh to these interfaces are slow, Brocade has also confirmed this is NOT expected behavior.&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@workstation:~# ping 10.0.112.2&#xA;PING 10.0.112.2 (10.0.112.2) 56(84) bytes of data.&#xA;64 bytes from 10.0.112.2: icmp_req=1 ttl=64 time=605 ms&#xA;64 bytes from 10.0.112.2: icmp_req=2 ttl=64 time=606 ms&#xA;64 bytes from 10.0.112.2: icmp_req=3 ttl=64 time=606 ms&#xA;64 bytes from 10.0.112.2: icmp_req=4 ttl=64 time=606 ms&#xA;64 bytes from 10.0.112.2: icmp_req=5 ttl=64 time=606 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if I ping a machine that is behind my gateway latency is exactly what i expect, ie under .2ms&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@workstation:~# ping 10.0.121.50&#xA;PING 10.0.121.50 (10.0.121.50) 56(84) bytes of data.&#xA;64 bytes from 10.0.121.50: icmp_req=1 ttl=63 time=0.207 ms&#xA;64 bytes from 10.0.121.50: icmp_req=2 ttl=63 time=0.193 ms&#xA;64 bytes from 10.0.121.50: icmp_req=3 ttl=63 time=0.184 ms &#xA;64 bytes from 10.0.121.50: icmp_req=4 ttl=63 time=0.181 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This becomes a problem when ssh/telneting into the switch any configuration is painful due to the latency&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interface is configured as a virtual ethernet interface with an ipaddress&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch-01# show running-config rbridge-id 15 int ve&#xA;interface Ve 112&#xA;ip dhcp relay address 10.0.100.223&#xA;ip proxy-arp&#xA;ip address 10.0.112.2/22&#xA;no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My routing table is simple, and looks as such. Note that in this situation I am still staying within the switch-01, the traffic does not leave the network I am just routing across vlans(ie, it does not traverse the default route of 0.0.0.0/0 below)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch-01# show ip route&#xA;Total number of IP routes: 9&#xA;Type Codes - B:BGP D:Connected I:ISIS O:OSPF R:RIP S:Static; Cost - Dist/Metric&#xA;BGP  Codes - i:iBGP e:eBGP&#xA;ISIS Codes - L1:Level-1 L2:Level-2&#xA;OSPF Codes - i:Inter Area 1:External Type 1 2:External Type 2 s:Sham Link&#xA;    Destination        Gateway         Port           Cost          Type Uptime&#xA;1       0.0.0.0/0          10.66.6.1       Ve 666         1/1           S    28d17h&#xA;2       10.0.100.0/24      DIRECT          Ve 100         0/0           D    28d17h&#xA;3       10.0.108.0/23      DIRECT          Ve 108         0/0           D    28d22h&#xA;4       10.0.112.0/22      DIRECT          Ve 112         0/0           D    28d22h&#xA;5       10.0.118.0/23      DIRECT          Ve 118         0/0           D    28d22h&#xA;6       10.0.121.0/24      DIRECT          Ve 121         0/0           D    28d22h&#xA;7       10.0.123.0/24      DIRECT          Ve 123         0/0           D    28d22h&#xA;8       10.0.124.0/23      DIRECT          Ve 124         0/0           D    5d23h&#xA;9       10.66.6.0/29       DIRECT          Ve 666         0/0           D    28d17h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question basically boils down to - why is this interface so slow when communicating directly to a machine, however the traffic traversing this interface is quite speedy?&lt;/p&gt;&#xA;" OwnerUserId="10240" LastEditorUserId="10240" LastEditDate="2015-01-06T00:45:07.190" LastActivityDate="2015-08-06T22:17:58.007" Title="Gateway interface latency is very high, while latency of traffic traversing gateway is very low?" Tags="|routing|brocade|layer2|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="14979" PostTypeId="2" ParentId="14975" CreationDate="2015-01-05T20:47:28.087" Score="8" Body="&lt;p&gt;It is done to classify hand-assigned addresses such as &lt;code&gt;prefix::1&lt;/code&gt;, &lt;code&gt;prefix::2&lt;/code&gt; etc. as local.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose that you're setting up a network in prefix &lt;code&gt;2001:db8:dead:beef::/64&lt;/code&gt;.  You'll probably use MAC-based IPs for most of your nodes.  For some nodes, however, such as the DNS server, the directory server, etc., you'll want to use addresses that are easier to type and easier to memorise than the MAC-based addresses.  For the DNS server, you'll probably want to use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2001:db8:dead:beef::53&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the U/L bit is set to 0 — which, due to the bit's inversion, classifies the host-id as local.&lt;/p&gt;&#xA;" OwnerUserId="12089" LastEditorUserId="12089" LastEditDate="2015-08-19T23:46:19.360" LastActivityDate="2015-08-19T23:46:19.360" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14980" PostTypeId="2" ParentId="14974" CreationDate="2015-01-05T21:13:17.777" Score="4" Body="&lt;p&gt;Many (most?) ISPs use a separate address block for their PE-CE links.  It allows them to manage their devices more easily, and it doesn't use up addresses from the blocks they assign to customers (like you).  The address block they use is assigned to them, so there's no issue with addressing.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-01-05T21:13:17.777" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14981" PostTypeId="1" AcceptedAnswerId="14983" CreationDate="2015-01-05T22:32:42.413" Score="3" ViewCount="11714" Body="&lt;p&gt;I'm trying to figure out what characters the Cisco router doesn't like when creating a password or pre-shared key. Please help me understand this. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="12207" LastActivityDate="2015-01-06T01:24:32.560" Title="What are invalid characters for a password in a Cisco router or firewall?" Tags="|cisco|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14983" PostTypeId="2" ParentId="14981" CreationDate="2015-01-05T22:38:18.783" Score="3" Body="&lt;p&gt;Generally, the characters &lt;code&gt;?&lt;/code&gt; and &lt;code&gt;[space]&lt;/code&gt; are the only il-advised characters. The &lt;code&gt;?&lt;/code&gt; indicates you are asking for help. The space indicates you are done with the password and moving onto the next command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should avoid &lt;code&gt;@&lt;/code&gt; and &lt;code&gt;!&lt;/code&gt; since they could interfere with other commands as you type them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IOS, &lt;code&gt;username (user) password 0 ...&lt;/code&gt; everything to the end-of-line is the password - literally, even a &quot;blind&quot; trailing space! For an ASA, &lt;code&gt;username (user) password &quot;...&quot;&lt;/code&gt; everything inside the quotes is the password. (&lt;kbd&gt;ctrl&lt;/kbd&gt;&lt;kbd&gt;v&lt;/kbd&gt; will allow the input of &lt;code&gt;?&lt;/code&gt; on both platforms) (the use of quotes allows use of spaces, but then excludes the use quotes in the password)&lt;/p&gt;&#xA;" OwnerUserId="12208" LastEditorUserId="619" LastEditDate="2015-01-06T01:24:32.560" LastActivityDate="2015-01-06T01:24:32.560" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="14984" PostTypeId="2" ParentId="11330" CreationDate="2015-01-05T23:26:44.630" Score="0" Body="&lt;p&gt;Nearly every piece of hardware will drop ICMP (ping) traffic in favour of TCP, UDP, and other &quot;real&quot; traffic. Seeing 1-5% packet loss during peak utilization is not remarkable. &lt;em&gt;I would expect, however, to see similar loss across all tunnels terminating at the same firewall were this the case,&lt;/em&gt; but 1-5% is still pretty much nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way for a provider to limp older hardware along is to traffic shape or rate-limit ICMP, which means it gets dropped even more aggressively. &lt;em&gt;I would also expect similar loss on all tunnels going through the same provider hardware,&lt;/em&gt; so you may want to Traceroute/MTR (there's a &lt;a href=&quot;http://winmtr.net/&quot; rel=&quot;nofollow&quot;&gt;WinMTR&lt;/a&gt; for Windows machines) these tunnel endpoints to see if there are any similarities in routes. But, again, 1-5% is usually nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to look into &lt;a href=&quot;http://www.elifulkerson.com/projects/tcping.php&quot; rel=&quot;nofollow&quot;&gt;TCPing&lt;/a&gt;, which simulates ICMP but using TCP connections. If you're getting 1-5% packet loss with TCP traffic too, then that's more remarkable (but still not terrible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check CPU utilization on the firewalls on both sides, memory, interface stats like errors, discards, overruns, etc.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2015-01-05T23:26:44.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="14985" PostTypeId="1" CreationDate="2015-01-06T00:34:22.140" Score="0" ViewCount="2396" Body="&lt;p&gt;I would like to know what RST does when establishing TCP connection&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firewall Log&lt;/p&gt;&#xA;&#xA;&lt;p&gt;id=&quot;1&quot; severity=&quot;info&quot; sys=&quot;SecureNet&quot; sub=&quot;packetfilter&quot; name=&quot;Packet dropped&quot; action=&quot;drop&quot; fwrule=&quot;60003&quot; srcip=&quot;x.x.x.x&quot; dstip=&quot;172.16.x.x&quot; proto=&quot;6&quot; length=&quot;40&quot; tos=&quot;0x00&quot; prec=&quot;0x00&quot; ttl=&quot;64&quot; srcport=&quot;80&quot; dstport=&quot;49670&quot; tcpflags=&quot;RST&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above packet is being dropped and I dont know why..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone explain what RST does and why it is being dropped?&lt;/p&gt;&#xA;" OwnerUserId="12210" LastActivityDate="2015-01-06T00:57:43.233" Title="Why I see RST being dropped?" Tags="|firewall|tcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14986" PostTypeId="2" ParentId="14985" CreationDate="2015-01-06T00:57:43.233" Score="2" Body="&lt;p&gt;&lt;code&gt;RST&lt;/code&gt; == Reset Connection&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has nothing to do with &lt;em&gt;establishing&lt;/em&gt; a TCP connection. It's used to close a connection, either due to error or as a means to (rapidly) bypass the normal FIN closing sequence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most likely you are seeing a RST after the connection is already closed and the firewall no longer has any state for it. (172.16 suggests NAT. Without a NAT translation, the FW has no idea where to send the packet, thus it's dropped.) However, the firewall my have an explicit rule to drop all RST packets as a &quot;security&quot; feature. (eg: &lt;a href=&quot;http://en.wikipedia.org/wiki/TCP_reset_attack&quot; rel=&quot;nofollow&quot;&gt;TCP Reset Attack&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-06T00:57:43.233" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="14988" PostTypeId="2" ParentId="14956" CreationDate="2015-01-06T01:45:05.153" Score="-2" Body="&lt;p&gt;The first address of each subnet may be the broadcast address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;WAIT&quot;, I hear you scream.  &quot;I thought the &lt;em&gt;LAST&lt;/em&gt; address of each subnet was the broadcast address!&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yeah, that is what they teach you, isn't it?  &quot;They&quot; just expect people to be trusting and follow whatever rules people teach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, the secret is: it depends on what equipment you're using.  Some older equipment actually used the first address as the broadcast address.  (This may be from back in the days when other technologies, like perhaps Token Ring instead of Ethernet, were competing with the standards that are more commonly used today.)  People started treating the first address as a &quot;Network ID&quot;, perhaps in part because they were trying to avoid using that address.  People spread the advice to treat that as &quot;unusable&quot;.  The common reason is just that it was a &quot;network ID&quot;.  And the results seemed positive: as long as people follow that advice, people managed to avoid conflicting with that old equipment.  And eventually, some networking hardware/software may have started to make the assumption that people follow that recommended advice.  So rules were enforced to follow that recommended advice, which means that now even more equipment (including some newer stuff) may not be able to use such addresses.  And so now, the result is that even with modern standards, instead of having only 75% of IPv4 addresses in a /30 being recognized as being usable, we have 50% available.  Instead of 25% waste, we have 50% waste.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cover this, perhaps in more detail at: &lt;A HREF=&quot;http://cyberpillar.com/dirsver/1/mainsite/glossary/glossryn.htm#netwrkid&quot; rel=&quot;nofollow&quot;&gt;][CyberPillar][ glossary: Network ID&lt;/A&gt;&lt;sup&gt;Note 1&lt;/sup&gt; and/or the glossary entry for Broadcast address.  (For instance, even more RFCs are referenced there.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully that helped to explain &lt;em&gt;why&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Note 1&lt;/sup&gt; Full disclosure, I started the ][CyberPillar][ site&lt;/p&gt;&#xA;" OwnerUserId="12192" LastEditorUserId="12192" LastEditDate="2015-01-06T22:31:22.697" LastActivityDate="2015-01-06T22:31:22.697" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="14990" PostTypeId="2" ParentId="12465" CreationDate="2015-01-06T10:02:04.767" Score="1" Body="&lt;p&gt;CDP should actually take care of the port authentication for an Cisco IP phone. There is a little-known feature called &quot;CDP bypass&quot; which allows a Cisco switch to detect a specific TLV in the CDP message which allows immediate authentication. Be aware however, that newer version of Cisco IOS no longer include this CDP bypass feature.&lt;/p&gt;&#xA;" OwnerUserId="12219" LastActivityDate="2015-01-06T10:02:04.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="14991" PostTypeId="2" ParentId="14936" CreationDate="2015-01-06T10:28:51.637" Score="6" Body="&lt;p&gt;So first of all &lt;code&gt;show fabric utilization all&lt;/code&gt; shows fabric utilization, not CPU utilization. Fabric doesn't have CPU component per se, and you can go all up to 100% of fabric utilization without any adverse effects similar to what CPU causes when nearing to the full load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, the &lt;strong&gt;WS-X6548-GE-TX is 8Gbit/s card&lt;/strong&gt;, so &quot;old&quot; fabric attached LC with 8Gbit/s channel. Internally, it shares buffers per 8 ports on card, so given you're getting 'overrun' errors that typically point to a problem with receiving traffic in timely manner and handing it over to other ports, first thing I'd do is separate incoming 8-port group on the card to separate group. In other words, if there is specific port/group of ports receiving high-volume multicast traffic, I'd move it to separate group on the card - and please rememeber, each consecutive 8 ports is one &quot;group&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/hardware/Module_Installation/Mod_Install_Guide/6500-emig/02ethern.html#wp1043307&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/hardware/Module_Installation/Mod_Install_Guide/6500-emig/02ethern.html#wp1043307&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means, among other things, that the 8Gbit/s interface to fabric is statically sliced in 6 groups of 8 ports, out of which each group gets 1Gbit/s maximum. So, if in any given port group (of 8x 10/100/1000 ports) you have ports receiving traffic over 1Gbit/s you'll hit exactly problems you're encountering. That's why my proposal is to move any other ports out of the 8-port group apart from the one interface receiving massive amounts of multicast traffic (it seems it's &lt;code&gt;GigabitEthernet 2/4&lt;/code&gt; in your case). You can find this information literally stated in the release notes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.html#pgfId-4909956&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/15-1SY/release_notes.html#pgfId-4909956&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The aggregate bandwidth of each set of 8 ports (1–8, 9–16, 17–24,&#xA;  25–32, 33–40, and 41–48) is 1 Gbps.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For better utilization of the physical ports, I'd recommend you take a look at the &lt;strong&gt;WS-X6748-GE-TX&lt;/strong&gt; card, that also has 48 10/100/1000 ports but has also &lt;strong&gt;two 20Gbit/s fabric connections&lt;/strong&gt;. Those 20Gbit/s fabric channels are split between ports 1-24 and 25-48, so you get still oversubscription, but only 24Gbit/s over the 20Gbit/s supported by channel, not 8Gbit/s over 1Gbit/s as in 6548 (so, effectively, 1.2:1 oversubscription in 6748 vs 8:1 in 6548). This should give you space to burst traffic over the link from the sending station and distribute it across the system.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2015-01-06T10:28:51.637" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="14997" PostTypeId="2" ParentId="9715" CreationDate="2015-01-07T00:42:14.117" Score="3" Body="&lt;p&gt;When you are implementing WCCP it shouldn't be inline. Place your Bluecoat that's doing WCCP anywhere in your network provided the ASA can route to it. Take a look at the &quot;Transparent Deployment&quot; section of this document.&#xA;&lt;a href=&quot;https://www.bluecoat.com/sites/default/files/documents/files/SWG_Deployment_Methodologies.2.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.bluecoat.com/sites/default/files/documents/files/SWG_Deployment_Methodologies.2.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the second question I would monitor the ASA interfaces by pinging whatever they are connected to. This way when that goes down I can check if it's a problem with the  ASA or the device I'm pinging. There may be a way to do this with IP SLA too but I don't know how.&lt;/p&gt;&#xA;" OwnerUserId="12208" LastActivityDate="2015-01-07T00:42:14.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="15998" PostTypeId="2" ParentId="14937" CreationDate="2015-01-07T09:39:01.830" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;what I mainly want to know from someone who has already gone through all this is: Is a &quot;MAC authentication&quot; that still generates EAP packets a valid approach?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here's a &lt;a href=&quot;http://lists.freeradius.org/pipermail/freeradius-users/2015-January/thread.html#75146&quot; rel=&quot;nofollow&quot;&gt;freeradius-users thread&lt;/a&gt; which answers most of these questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The crux is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using EAP for MAC auth makes no real sense.&lt;/li&gt;&#xA;&lt;li&gt;But it isn't bad either if it's at least correctly implemented.&lt;/li&gt;&#xA;&lt;li&gt;Users on the freeradius list didn't think Cisco's SG series implements 802.1x EAP MAB correctly, since the EAP Service-Type is missing.  As &lt;a href=&quot;http://lists.freeradius.org/pipermail/freeradius-users/2015-January/075186.html&quot; rel=&quot;nofollow&quot;&gt;Nick Lowe mentioned&lt;/a&gt;, if the EAP Service-Type is missing, it becomes awkward, hackish and potentially unreliable to discriminate between the type of service being used by a client.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="775" LastEditDate="2015-01-07T09:59:52.067" LastActivityDate="2015-01-07T09:59:52.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16000" PostTypeId="1" AcceptedAnswerId="22746" CreationDate="2015-01-07T10:55:21.457" Score="1" ViewCount="1173" Body="&lt;p&gt;On a L3 switch there are two equal cost ISIS routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Destination/Mask    Proto   Pre  Cost      Flags NextHop         Interface&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.150.4.12/32  ISIS-L2 15   10          D   10.200.15.42    Vlanif27&#xA;                ISIS-L2 15   10          D   10.200.15.38    Vlanif26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the switch is huawei s5700&#xA;I want to understand which route will be taken and why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also if MPLS is enabled on it. I see there are two LSP's as shown in the image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/IWWiI.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;and MPLS RFC says: &quot;Packets belonging to an FEC will always follow the same path&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so I want to understand which LSP will be chosen and why? is there any kind of load balancing happening?&lt;/p&gt;&#xA;" OwnerUserId="11909" LastEditorUserId="286" LastEditDate="2015-01-07T14:40:05.407" LastActivityDate="2015-09-23T08:43:42.983" Title="MPLS load balancing on Huawei S5700" Tags="|mpls|service-provider|is-is|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16001" PostTypeId="1" CreationDate="2015-01-07T10:55:32.937" Score="2" ViewCount="1119" Body="&lt;p&gt;I have this device Layer 2-3 Gigabit Ethernet Switch Module for IBM eServer BladeCenter and I need to know how to enable jumbo frames to 9000 if this is possible. I searched a lot but I was unable to find any info but that the jumbo frames are supported. &#xA;Does anyone know how  it can be done, and if it is possible to set MTU of 9000 per VLAN, interface etc !?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;End how I can see if the jumbo-frames are enabled. I am using the user interface that is not like on cisco devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like: /c/l2/vlan etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I see if jumbos are enabled using this interface!?&lt;/p&gt;&#xA;" OwnerUserId="2665" LastEditorUserId="-1" LastEditDate="2015-01-07T15:23:43.413" LastActivityDate="2015-01-07T23:49:56.080" Title="Layer 2-3 Gigabit Ethernet Switch Module MTU 9000" Tags="|mtu|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16005" PostTypeId="1" AcceptedAnswerId="16011" CreationDate="2015-01-07T14:41:40.133" Score="16" ViewCount="27073" Body="&lt;p&gt;I'm setting up a Cisco 2901 router. I have a login password on the console line, and the vty lines are configured to only accept ssh connections with public key authentication. The auxiliary line is shut down. There are only two admins who will be accessing the router and we are both authorized to perform any configuration on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not an expert on Cisco gear, but I consider this adequate to secure access to the router configuration. However, every single guide I've read states I should set an enable secret, regardless of any other user or line passwords.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something more to the enable password that I'm not aware off? Is there any other way to access the router than then console, auxiliary, or vty lines?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;EDIT:&lt;/b&gt;&#xA;I've added the actual configuration below to be more clear about my situation. The following works, with requiring an enable password, or a &lt;code&gt;username&lt;/code&gt; config aside from the one within &lt;code&gt;ip ssh pubkey-chain&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;&#xA;ip ssh time-out 60&#xA;ip ssh authentication-retries 2&#xA;ip ssh version 2&#xA;ip ssh pubkey-chain&#xA; username tech&#xA;  key-hash ssh-rsa [HASH]&#xA;ip scp server enable&#xA;&#xA;line vty 0 4&#xA; transport input ssh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13237" LastEditorUserId="13237" LastEditDate="2015-01-08T12:30:08.777" LastActivityDate="2018-01-28T16:32:57.050" Title="Do I need to set the enable secret on Cisco device?" Tags="|cisco|security|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16006" PostTypeId="2" ParentId="16005" CreationDate="2015-01-07T15:21:45.740" Score="4" Body="&lt;p&gt;Yes, you need to set it to something.  That's just the way the IOS works.&#xA;You can make it the same as your login password, if you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For multiple users, I recommend you set up AAA authentication, which will allow you to go directly into enable mode without having to enter another password.  It will also allow you to track individual admins' activity.  (But you still need to set the enable secret password to something.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new model&#xA;aaa authentication login default local&#xA;aaa authorization enable default local&#xA;&#xA;username chen-li password foo privilege 15&#xA;username safar password bar privilege 15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-01-07T15:21:45.740" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16007" PostTypeId="2" ParentId="16005" CreationDate="2015-01-07T15:40:48.733" Score="0" Body="&lt;p&gt;It is basically an extra layer of security.  If you do not have a version of IOS that supports service password-encryption, then only enable passwords are encrypted while the console and VTY passwords are plaintext.  If someone were able to get a copy of your config (say from a backup, or an unattended computer that was telnetted in), the encrypted enable password would make it more difficult getting control of your router, even if they can telnet in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even with encrypted VTY and console passwords, you should still have a different enable password to be on the safe side and provide an extra barrier.   &lt;/p&gt;&#xA;" OwnerUserId="10237" LastActivityDate="2015-01-07T15:40:48.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16008" PostTypeId="1" AcceptedAnswerId="16009" CreationDate="2015-01-07T16:46:21.870" Score="3" ViewCount="1020" Body="&lt;p&gt;I want to create a closed network (Vlan 1010) with internetaccess but I am new to tagged and untagged ports. I have a Netgear switch.&#xA;This is my current setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/YJMuL.png&quot; alt=&quot;Screenshot&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;TG = Firewall WAN&lt;/li&gt;&#xA;&lt;li&gt;Office = Office network with default gateway to internet&lt;/li&gt;&#xA;&lt;li&gt;TG LAN = Firewall LAN&lt;/li&gt;&#xA;&lt;li&gt;SM + GM = Devices&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The untagged and VLAN1010 are connected by the Firewall. Will my vlan 1010 network be able to get internet access through the firewall with this setup?&lt;/p&gt;&#xA;" OwnerUserId="13239" LastEditorUserId="21048" LastEditDate="2015-12-02T20:41:03.993" LastActivityDate="2015-12-02T20:41:03.993" Title="Basic VLAN setup" Tags="|vlan|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16009" PostTypeId="2" ParentId="16008" CreationDate="2015-01-07T18:19:46.080" Score="5" Body="&lt;p&gt;VLAN tagging in a nutshell:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When a port must pass traffic from only one VLAN, the port is untagged on that VLAN&lt;/li&gt;&#xA;&lt;li&gt;When a port must pass traffic from multiple VLANs, the port can be untagged on one VLAN (the port's &quot;native&quot; VLAN) and must be tagged on all additional VLANs&lt;/li&gt;&#xA;&lt;li&gt;Very few PC or other egde device NICs can do 802.1Q, so edge ports generally are untagged members of one VLAN only, and links interconnecting network devices are tagged in additional VLANs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The picture only appears to show your Netgear configuration, but not the physical topology. If your Firewall has 2 ports (LAN and Internet) it should be physically connected like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.----------.&#xA;| INTERNET |     .------------------.     .--------.&#xA;|  ROUTER  =-----= WAN    FW    LAN =-----= SWITCH |&#xA;|          |     '------------------'     '--------'&#xA;'----------'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So only one cable between the FW and the switch, VLANs created on the switch and LAN port of the FW. The link between switch and FW LAN port should be the one tagged, all edge ports untagged to whichever VLAN they belong to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are running your firewall's Internet connection through switch port 1, have office PC connected to ports 2-4 and ports 1-4 are on the same VLAN on the switch, the firewall is not protecting your office PCs. &lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2015-01-07T18:19:46.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16010" PostTypeId="2" ParentId="16008" CreationDate="2015-01-07T18:34:31.570" Score="3" Body="&lt;p&gt;Your configuration should function properly &lt;em&gt;if&lt;/em&gt;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: Your VLAN Layer3 interfaces are properly configured on your firewall &#xA;&#xA;2: Your NetGear switch has proper tagged, untagged and PVID values set for its ports: &#xA;    2a: Ensure that &quot;Untagged VLAN&quot; and &quot;PVID&quot; values are set: the PVID value is the second half of VLAN membership for ports on NetGear switches. &#xA;&#xA;    2b: Ensure that the firewall understands the difference between the VLANs, (for example, with a 802.1q trunk and tagged / native VLAN functionality between the switch and firewall).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2015-01-07T18:34:31.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16011" PostTypeId="2" ParentId="16005" CreationDate="2015-01-07T18:50:40.633" Score="26" Body="&lt;p&gt;No, you don't -- technically.  But whether you can enter enable mode without one depends on how you log in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here's the instant gratification version:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can enter via the console without an enable password, but you will be stuck in user mode if you use a simple vty login password without an enable password set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here's the long-winded StackExchange answerer version:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco authentication is kind of a mess for a beginner.  There's a lot of legacy baggage there.  Let me try to break this down in a real-world sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everyone that has any business logging into a router or switch pretty much goes directly to privileged (enable) mode.  The user mode is basically a front lobby, and serves little more purpose than to keep the draft out.  In large organizations where you have vast networks and equally vast pools of labor, it may be justifiable to have someone who can knock on the front door and make sure someone is still there.  (That is, to log in and run the most trivial commands just to see that the device is, in fact, responding and not on fire.)  But in every environment I've ever worked in, tier 1 had at least &lt;em&gt;some&lt;/em&gt; ability to break things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, and particularly in a scenario like yours, knowing the enable password is obligatory to get anything done.  You could say this is a second level of security -- one password to enter the device, another to escalate to administrative privilege -- but that seems a little bit silly to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As already noted, you can (and many people do) use the same password, which doesn't help much if someone has gained unauthorized access via telnet/ssh.  Having static, global passwords shared by everyone is arguably more of an issue than having just one token required to enter.  Finally, most other systems (services, appliances, etc.) don't require a second layer of authentication, and are not generally considered insecure because of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK, that's my opinion on the topic.  You'll have to decide for yourself whether it makes sense in light of your own security stance.  Let's get down to business.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco (wisely) requires you to set a remote access password by default.  When you get into line configuration mode...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router&amp;gt; enable&#xA;router# configure terminal&#xA;router(config)# line vty 0 15&#xA;router(config-line)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...you can tell the router to skip authentication:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-line)# no login&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...and promptly get hacked, but your attacker will end up in user mode.  So if you have an enable password set, at least you have &lt;em&gt;somewhat&lt;/em&gt; limited the damage that can be done.  (Technically, you can't go any further &lt;em&gt;without&lt;/em&gt; an enable password either.  More on that in a moment...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Naturally, no one would do this in real life.  Your minimum requirement, by default and by common sense, is to set a simple password:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-line)# login&#xA;router(config-line)# password cisco&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, you will be asked for a password, and you will again end up in user mode.  If you're coming in via the console, you can just type &lt;code&gt;enable&lt;/code&gt; to get access without having to enter another password.  But things are different via telnet, where you will probably get this instead:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ telnet 10.1.1.1&#xA;Trying 10.1.1.1...&#xA;Connected to 10.1.1.1.&#xA;Escape character is '^]'.&#xA;&#xA;&#xA;User Access Verification&#xA;&#xA;Password: *****&#xA;router&amp;gt; enable&#xA;% No password set&#xA;router&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Moving on... You probably already know that, by default, all your configured passwords show up as plain text:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router# show run | inc password&#xA;no service password-encryption&#xA; password cisco&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is one of those things that tightens the sphincter of the security-conscious.  Whether it's justified anxiety is again something you have to decide for yourself.  On one hand, if you have sufficient access to &lt;em&gt;see&lt;/em&gt; the configuration, you probably have sufficient access to &lt;em&gt;change&lt;/em&gt; the configuration.  On the other hand, if you happen to have carelessly revealed your configuration to someone who doesn't have the means themselves, then ... well, now they &lt;em&gt;do&lt;/em&gt; have the means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luckily, that first line in the snippet above, &lt;code&gt;no service password-encryption&lt;/code&gt;, is the key to changing that:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)# service password-encryption&#xA;router(config)# line vty 0 15&#xA;router(config-line)# password cisco&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, when you look at the configuration, you see this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-line)# do show run | begin line vty&#xA;line vty 0 4&#xA; password 7 01100F175804&#xA; login&#xA;line vty 5 15&#xA; password 7 01100F175804&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is marginally better than plain-text passwords, because the displayed string isn't memorable enough to shoulder-surf.  However, it's trivial to decrypt -- and I use that term loosely here.  You can literally paste that string above into one of a dozen JavaScript password crackers on the first Google results page, and get the original text back immediately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These so-called &quot;7&quot; passwords are commonly considered &quot;obfuscated&quot; rather than &quot;encrypted&quot; to highlight the fact that it is just barely better than nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it turns out, however, all those &lt;code&gt;password&lt;/code&gt; commands are deprecated.  (Or if they're not, they should be.)  That's why you have the following two options:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)# enable password PlainText&#xA;router(config)# enable secret Encrypted&#xA;router(config)# do show run | inc enable&#xA;enable secret 5 $1$sIwN$Vl980eEefD4mCyH7NLAHcl&#xA;enable password PlainText&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The secret version is hashed with a one-way algorithm, meaning the only way to get the original text back is by brute-force -- that is, trying every possible input string until you happen to generate the known hash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you enter the password at the prompt, it goes through the same hashing algorithm, and should therefore end up generating the same hash, which is then compared to the one in the configuration file.  If they match, your password is accepted.  That way, the plain text isn't known to the router except during the brief moment when you are creating or entering the password.  Note: There's always the chance some other input can generate the same hash, but statistically it's a very low (read: negligible) probability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were to use the above configuration yourself, the router will allow both the &lt;code&gt;enable password&lt;/code&gt; and &lt;code&gt;enable secret&lt;/code&gt; lines to exist, but the secret wins from the password prompt.  This is one of those Cisco-isms that doesn't make much sense, but it's the way it is.  Furthermore, there's no &lt;code&gt;secret&lt;/code&gt; equivalent command from line configuration mode, so you're stuck with obfuscated passwords there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alright, so we now have a password that can't be recovered (easily) from the config file -- but there's still one problem.  It's being transmitted in plain text when you log in via telnet.  No good.  We want SSH.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SSH, being designed with more robust security in mind, requires a little extra work -- and an IOS image with a certain feature set.  One big difference is that a simple password is no longer good enough.  You need to graduate to user-based authentication.  And while you're at it, set up an encryption key pair:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)# username admin privilege 15 secret EncryptedPassword&#xA;router(config)# line vty 0 15&#xA;router(config-line)# transport input ssh&#xA;router(config-line)# no password&#xA;router(config-line)# login local&#xA;router(config-line)# exit&#xA;router(config)# ip ssh version 2&#xA;router(config)# crypto key generate rsa modulus 1024&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you're cooking with gas!  Notice this command uses &lt;code&gt;secret&lt;/code&gt; passwords.  (Yes, you can, but shouldn't, use &lt;code&gt;password&lt;/code&gt;).  The &lt;code&gt;privilege 15&lt;/code&gt; part allows you to bypass user mode entirely.  When you log in, you go straight to privileged mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ssh admin@10.1.1.1&#xA;Password: *****&#xA;&#xA;router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this scenario, there's no need to use an enable password (or secret.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not yet thinking, &quot;wow... what a clusterfudge &lt;em&gt;that&lt;/em&gt; was&quot;, bear in mind there's a whole other long-winded post still lurking behind the command &lt;code&gt;aaa new-model&lt;/code&gt;, where you get to dive into things like external authentication servers (RADIUS, TACACS+, LDAP, etc.), authentication lists (which define the sources to use, and in which order), authorization levels, and user activity accounting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Save all that for a time when you feel like getting locked out of your router for a while.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps!&lt;/p&gt;&#xA;" OwnerUserId="13242" LastActivityDate="2015-01-07T18:50:40.633" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="16013" PostTypeId="1" AcceptedAnswerId="16015" CreationDate="2015-01-07T20:09:27.253" Score="3" ViewCount="841" Body="&lt;p&gt;I have created a simple topology with routers and computers and I ping from computer A to computer B . Firstly, computer A send ARP request to gateway of A and then got reply. Mac and ip of gateway is addes to arp table of computer A. Then ICMP packet is send ( let's say to router X) . Later, I got reply on computer A from computer B , which comes from router Y, but mac and ip of router Y isn't added to arp table of computer A.&#xA;Is it right behaviour or I misconfigured something ?&lt;/p&gt;&#xA;" OwnerUserId="13240" LastActivityDate="2015-01-07T20:55:08.073" Title="ping reply arp table" Tags="|router|arp|ping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16014" PostTypeId="2" ParentId="11368" CreationDate="2015-01-07T20:12:11.957" Score="0" Body="&lt;p&gt;From the information here the HP1810-24G supports LACP&#xA;&lt;a href=&quot;http://h20195.www2.hp.com/v2/GetDocument.aspx?docname=4AA2-6799ENW&amp;amp;cc=en&amp;amp;lc=en&quot; rel=&quot;nofollow&quot;&gt;http://h20195.www2.hp.com/v2/GetDocument.aspx?docname=4AA2-6799ENW&amp;amp;cc=en&amp;amp;lc=en&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have not played with microtik but their documentation was very easy to google:&#xA;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Interface/Bonding&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Manual:Interface/Bonding&lt;/a&gt;&#xA;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Interface/Bridge&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Manual:Interface/Bridge&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current (and future) troubles I think you may be encountering are possibly with the HP1810, I have deployed the Version1 of these HPs in the past and found out they were really intended for cheap access switches, did not have a cli and did not properly support spanning-tree and had to rely on the upstream switch/aggregator which then was an old Layer2 dell powerconnect 5224.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being a HP shop, perhaps you could consider replacing the HP1810-24G with a more featured/robust HP switch that fully supports stp, rstp, mstp and the other networking features that you require?&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2015-01-07T20:12:11.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16015" PostTypeId="2" ParentId="16013" CreationDate="2015-01-07T20:55:08.073" Score="4" Body="&lt;p&gt;Network devices can only see MAC addresses of devices on the local network (broadcast domain, actually.)  ARP traffic is broadcasted and not routed.   When your Computer A is trying to communicate with Computer B on a different network, it doesn't need to know the MAC address of B. It only needs to know how to route to that IP address and the MAC address of the local router.&lt;/p&gt;&#xA;" OwnerUserId="10237" LastActivityDate="2015-01-07T20:55:08.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16016" PostTypeId="2" ParentId="16001" CreationDate="2015-01-07T23:49:56.080" Score="3" Body="&lt;p&gt;Assuming Blade OS - the command reference is a good place to start.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see if jumbo support is enabled per vlan, navigate to  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/info/l2/vlan&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To enable jumbo support per vlan, navigate to  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/cfg/l2/vlan &amp;lt;VLAN number&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't see anything for more granular control.&lt;br&gt;&#xA;Source: &lt;a href=&quot;http://bladenetwork.net/userfiles/file/PDFs/IBM_GbE_L2-7_Command_Ref.pdf&quot; rel=&quot;nofollow&quot;&gt;http://bladenetwork.net/userfiles/file/PDFs/IBM_GbE_L2-7_Command_Ref.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13244" LastActivityDate="2015-01-07T23:49:56.080" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="16017" PostTypeId="1" AcceptedAnswerId="16071" CreationDate="2015-01-08T00:04:16.097" Score="6" ViewCount="5431" Body="&lt;p&gt;This is to support a user who has the requirement of simulating specific speeds for download/upload.  We have configured a limit using service-policy that as successfully limiting upload speed (ingress on the interface) but we (more importantly) need to limit download speed (egress on the interface).  I know of using srr-queue but we need specific speeds (such as 512KB).  Been banging away at this for a few days now and can't find a working method.  I pursued shaping via:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any CLASS_EgressLimit_512KB&#xA;  match access-group name ACL_RateLimit_512KB&#xA;policy-map POLICY_EgressLimit_512KB&#xA;  class CLASS_EgressLimit_512KB&#xA;    shape average 512000&#xA;interface gi0/6&#xA;  service-policy output POLICY_EgressLimit_512KB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but shaping doesn't seem to be supported in this context on our switch &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;(WS-C2960G-8TC-L 15.0(2)SE4 C2960-LANBASEK9-M)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is sincerely appreciated!&lt;/p&gt;&#xA;" OwnerUserId="7534" LastEditorUserId="619" LastEditDate="2015-01-08T00:42:10.973" LastActivityDate="2015-01-10T04:20:24.000" Title="Limit egress traffic 2960G" Tags="|cisco|qos|bandwidth|cisco-2960|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16020" PostTypeId="1" AcceptedAnswerId="16022" CreationDate="2015-01-08T06:58:21.667" Score="8" ViewCount="3293" Body="&lt;p&gt;Forgive me as I have very little domain knowledge in this area, I'm helping out at my parent's office and was asked to look into speeding up the internet. They've been using this IT guy that I think is ripping them off... They have a T1 line which costs a ton and only provides 3 Up, 3 Down. The IT guy is convinced that it is necessary for the VPN which is used by employees to access documents on the office server when they're out of the office. They also use it to access some applications which run on the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that this is for reliability but if you don't have a T1 line going to your house, how are you going to see that reliability? Am I missing something about VPNs? Is the T1 necessary at all? I'd think you need T1's from point to point? Why can't we just put a VPN on a normal cable connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm just about to finish my CS degree, but know very little about networking, so be gentle please.&lt;/p&gt;&#xA;" OwnerUserId="13247" LastActivityDate="2015-01-13T17:14:34.697" Title="Why would a VPN require a T1?" Tags="|vpn|" AnswerCount="7" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16022" PostTypeId="2" ParentId="16020" CreationDate="2015-01-08T07:44:11.253" Score="15" Body="&lt;p&gt;First of all, T1 gives you around 1.5Mbit/s in both directions, not 3Mbit/s. If you're seeing 3Mbit/s, it may be bundled from two separate lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, for VPN, if that's IP-based VPN as 99% of VPNs currently are, of course it doesn't matter if your physical interface is T1, E1, ATM OC-3 or 10GE WAN PHY - it's just used to provide higher-layer connectivity - which for VPNs (IPsec, DTLS or whatever) is usually IP connectivity. As soon as you obtain IP connectivity, you should be able to establish VPN sessions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the description you provide, that T1 line (or bundled T1 line) is used as a hub for employee remote connectivity. This may mean, that the VPN device has T1 ports built-in and that's why the &quot;IT guy&quot; claims T1 is needed to provide the connectivity, or there are some other constraints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the costs of dedicated circuits, I'd rather ask local available ISPs about Ethernet line - be it 10Mbit/s, 100Mbit/s or sub-rate 1GE/full-rate 1GE. You'll get more for less (propably), and still get IP connectivity which is needed for VPN sessions.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2015-01-08T07:44:11.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16023" PostTypeId="2" ParentId="16017" CreationDate="2015-01-08T07:47:14.820" Score="1" Body="&lt;p&gt;The configuration you're trying to use is based on router capabilities, not switch capabilities. While it's true 2960 can do shaping, it's configured in a different way and works in a slightly different way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please take a look here to read about the idea, and then when you have configuration get back with any other, specific questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swqos.html#wp1200681&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swqos.html#wp1200681&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One example of configuring sub-rate shaping on interface is proposed here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.techrepublic.com/blog/data-center/limit-bandwidth-on-a-cisco-catalyst-switch-port/&quot; rel=&quot;nofollow&quot;&gt;http://www.techrepublic.com/blog/data-center/limit-bandwidth-on-a-cisco-catalyst-switch-port/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2015-01-08T07:47:14.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16025" PostTypeId="2" ParentId="16020" CreationDate="2015-01-08T14:25:52.387" Score="10" Body="&lt;p&gt;There is no &lt;em&gt;technical&lt;/em&gt; reason for requiring a leased line or similar for the VPN if another (cheaper) option is adequately fast and sufficiency low latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be that the leased line comes with significant service level agreements (with refunds/other built in to the contract for if the service fails to achieve these levels of availability/speed/latency/other) which a bog standard cable connection may not. If the VPN is essential to the business (and it is likely to be if there are remote workers) then this level of assurance is often worth paying for.&lt;/p&gt;&#xA;" OwnerUserId="13251" LastActivityDate="2015-01-08T14:25:52.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16027" PostTypeId="2" ParentId="16020" CreationDate="2015-01-08T16:02:47.360" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why can't we just put a VPN on a normal cable connection?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can. I VPN to the office from my &lt;em&gt;phone&lt;/em&gt; reasonably frequently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What technology you use for the transport layer is ultimately irrelevant: as long as you are on an IP network and your routers support VPN pass-through, you can use whatever you like. Dial-up, DSL, cable, ethernet, smoke signals...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be SLA constraints as others have said, or it may be that the only alternative in your area is a connection slower than T1 (which is already very slow for a business!) in which case it may struggle to keep up with the demand expected to be placed upon the VPN by its users.&lt;/p&gt;&#xA;" OwnerUserId="13256" LastActivityDate="2015-01-08T16:02:47.360" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16029" PostTypeId="2" ParentId="16020" CreationDate="2015-01-08T17:06:32.257" Score="4" Body="&lt;p&gt;The questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How many people are using the VPN?&lt;/li&gt;&#xA;&lt;li&gt;What are they doing with it?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If it is many people, and they need to use wasteful (e.g. CIFS) protocols to access very large documents, they are going to need a lot more bandwidth than if there are few of them. I think that you are misunderstanding a claim about the VPN which is really a claim about the total required bandwidth; whether the claim is correct I can't tell you.&lt;/p&gt;&#xA;" OwnerUserId="9956" LastActivityDate="2015-01-08T17:06:32.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16033" PostTypeId="2" ParentId="9389" CreationDate="2015-01-08T18:08:17.377" Score="1" Body="&lt;p&gt;You &lt;em&gt;might&lt;/em&gt; could connect them as PoE Wall port -&gt; hub -&gt; Phone and Computer &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BUT I would not guarantee that the phone will work well and this might cause intermittent connectivity issues. But it is a thought.&lt;/p&gt;&#xA;" OwnerUserId="1638" LastActivityDate="2015-01-08T18:08:17.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16034" PostTypeId="1" CreationDate="2015-01-08T18:20:39.463" Score="2" ViewCount="164" Body="&lt;p&gt;I'm looking to find out if there is a way to know if a Cisco phone (7940,7960,7911's and the like) either through Cisco Callmanager or through the direct Web interface on the phone. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for this so that I can go to all of the switches that we just replaced with PoE switches and go reclaim all the extraneous phone PSUs. &lt;/p&gt;&#xA;" OwnerUserId="1638" LastActivityDate="2015-01-08T18:20:39.463" Title="Determine if cisco phone is on POE or adapter remotely" Tags="|cisco|power-over-ethernet|cisco-voip|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16036" PostTypeId="2" ParentId="16020" CreationDate="2015-01-08T20:49:29.900" Score="1" Body="&lt;p&gt;VPN connections don't require any particular connection type. However, it may be facilitated by a point-to-point T1 in this particular case.&lt;/p&gt;&#xA;" OwnerUserId="13267" LastActivityDate="2015-01-08T20:49:29.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16038" PostTypeId="1" CreationDate="2015-01-08T22:32:56.707" Score="1" ViewCount="600" Body="&lt;p&gt;We have two VSS switch pairs, one which has TACACS working correctly with a similar config to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    aaa group server tacacs+ TacacsVrf&#xA;      server-private 10.4.25.8 key 7 ourKeyIsSecret&#xA;      ip vrf forwarding mgmtVrf&#xA;      ip tacacs source FastEthernet1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with the source interface an individual gigE interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a second pair (6807xl) with the same config, but using a port-channel Interface as the source interface. TACACS requests are not getting to the ACS as far as I know.&lt;/p&gt;&#xA;" OwnerUserId="13269" LastEditorUserId="13269" LastEditDate="2015-01-08T22:39:06.923" LastActivityDate="2015-01-08T22:39:06.923" Title="can TACACS in VRF source interface be the ip for a Port-channel?" Tags="|vrf|tacacs|" AnswerCount="0" CommentCount="2" ClosedDate="2020-12-16T21:08:53.310" ContentLicense="CC BY-SA 3.0" />
  <row Id="16039" PostTypeId="1" CreationDate="2015-01-08T22:50:37.030" Score="1" ViewCount="394" Body="&lt;p&gt;I have an external DSL link on a ground floor of my building that needs to be sent up to the second floor. Now im sure it would be easy to just run a cable however thats not an option. However, i do have cisco 3750 switches on each floor and they are all tied in floor by floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how do I create a vlan and trunk this DSL link through my switches to the second floor without it broadcasting through my network other than on a port specified on my second floor?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to user Panther Modern's answer, but I still can't get it to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what my port configuration looks like floor to floor for what I am trying to do. Please let me know if you see anything that could be stopping the traffic flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GROUND FL SW&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/45&#xA; description DSL UPLINK&#xA; switchport access vlan 93&#xA; switchport mode access&#xA;&#xA;interface GigabitEthernet1/0/49&#xA; description Trunk to 1st Fl&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 1,70,93&#xA;&#xA;interface Vlan93&#xA; ip address 10.244.193.254 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;1ST FL SW&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet3/7&#xA; description Trunk to Ground Fl&#xA; no ip address&#xA; switchport&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 1,70,85,93&#xA; switchport mode trunk&#xA;&#xA;interface GigabitEthernet3/1&#xA; description Trunk to 2nd Fl&#xA; no ip address&#xA; switchport&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 1,51,72,74,81-83,85,93,172,1080&#xA; switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2ND FL SW&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/49&#xA; description Trunk to 1st Fl&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 1,51,74,81-83,85,93,172,193,600&#xA; switchport mode trunk&#xA;&#xA; interface GigabitEthernet2/0/37&#xA; description DSL LINK&#xA; switchport access vlan 93&#xA; switchport mode access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13270" LastEditorUserId="775" LastEditDate="2015-01-09T10:58:24.227" LastActivityDate="2015-01-12T09:15:14.343" Title="Trunk an external link through switches" Tags="|cisco|switching|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16040" PostTypeId="2" ParentId="16039" CreationDate="2015-01-08T22:56:57.990" Score="0" Body="&lt;p&gt;This doesn't work since the DSL signal is not ethernet, the switches can't transport it.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-01-08T22:56:57.990" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16041" PostTypeId="2" ParentId="16039" CreationDate="2015-01-08T23:12:25.153" Score="3" Body="&lt;p&gt;This should work fine, as long as the VLAN you're attaching the DSL connection to is extended across your switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP will take care of the rest, as your clients who need to send any data to the default gateway of the DSL connection will address their frames to the MAC of the DSL modem.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;               Gi1/0/1 +----------+ Gi1/0/11            Gi1/0/2 +----------+&#xA;DSL--------------------| sw-1stFl |-----------------------------| sw-2ndFl |&#xA;192.168.0.1/24         +----------+            dot1q            +----------+&#xA;                                                                      | Gi1/0/5&#xA;                                                                      | vlan 900 access&#xA;                                                                      |&#xA;                                                                  Client2-1&#xA;                                                                  192.168.0.50/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to relegate it to a network of its own: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1: Create a new VLAN: &#xA;   vlan 900&#xA;     name DSL-EGRESS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;2: Create VLAN SVI on your Core Switch:&lt;/s&gt;&#xA;&lt;s&gt;interface vlan 900&lt;/s&gt;&#xA;&lt;s&gt;ip address [IP] [MASK]&lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3: Assign membership: &#xA;   interface 1/0/1&#xA;     description DSL-MODEM&#xA;     switchport access vlan 900&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4: Obviously, also your clients who wish to send data to the internet thru the DSL modem will need the DSL modem's internal IP as their default gateway, etc, etc, basic networking stuff.  Detailed configs are included below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Configs below provided by Mike Pennington in later edit.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This example configuration makes some assumptions about what IP addresses are assigned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration for &lt;code&gt;sw-1stFl&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname sw-1stFl&#xA;vtp mode transparent&#xA;!&#xA;vlan 900&#xA; name DSL_modem&#xA;!&#xA;interface Gi1/0/1&#xA; descr [To DSL modem]&#xA; switchport mode access&#xA; switchport access vlan 900&#xA;!&#xA;interface Gi1/0/11&#xA; description [To sw-2ndFl:Gi1/0/2]&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;interface Vlan900&lt;/s&gt;&#xA;&lt;s&gt; no shutdown&lt;/s&gt;&#xA;&lt;s&gt; ip address 192.168.0.254 255.255.255.0&lt;/s&gt;&#xA;&lt;s&gt; no ip proxy-arp&lt;/s&gt;&#xA;&lt;s&gt; no ip redirects&lt;/s&gt;&#xA;&lt;s&gt; no ip unreachables&lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration for &lt;code&gt;sw-2ndFl&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname sw-2ndFl&#xA;vtp mode transparent&#xA;!&#xA;vlan 900&#xA; name DSL_modem&#xA;!&#xA;interface Gi1/0/2&#xA; description [To sw-1stFl:Gi1/0/11]&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface Gi1/0/5&#xA; description [Client2-1]&#xA; switchport mode access&#xA; switchport access vlan 900&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2912" LastEditorUserId="3912" LastEditDate="2015-01-12T09:15:14.343" LastActivityDate="2015-01-12T09:15:14.343" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16042" PostTypeId="1" CreationDate="2015-01-09T01:27:23.243" Score="2" ViewCount="945" Body="&lt;p&gt;Currently, DOCSIS 3 uses 5-42 MHz for the upstream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, that means my cable modem is transmitting a signal down the copper at 5 MHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing about coaxial networks is there's a single copper conductor carrying &lt;strong&gt;everything&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what about my &lt;strong&gt;neighbors&lt;/strong&gt;. They have to transmit on 5 MHz &lt;strong&gt;too&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if me and all my neighbors are uploading something at the &lt;strong&gt;same time&lt;/strong&gt;. How does DOCSIS work &lt;strong&gt;without interference&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I post this question only &lt;strong&gt;regarding upstream and not downstream&lt;/strong&gt; is because I can see how downstream would work. The cable headend can &lt;strong&gt;send everyone's data to everyone&lt;/strong&gt; on the node. And only the &lt;strong&gt;right person&lt;/strong&gt; can decrypt it. Everyone else discards what they &lt;strong&gt;cant decrypt&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The upstream is different because everyone's modem would act like a &lt;strong&gt;signal jammer&lt;/strong&gt; to everyone else, wouldn't it? Or does everyone on the same node use a &lt;strong&gt;different frequency&lt;/strong&gt;. If that's true, then that makes me wonder what exactly nodes do.&lt;/p&gt;&#xA;" OwnerUserId="13272" LastEditorUserId="13272" LastEditDate="2015-01-09T01:35:52.157" LastActivityDate="2015-01-10T01:42:46.717" Title="DOCSIS upstream frequencies" Tags="|docsis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16048" PostTypeId="1" AcceptedAnswerId="16055" CreationDate="2015-01-09T06:47:10.390" Score="1" ViewCount="235" Body="&lt;p&gt;Here is my understanding, when the packet is within subnet - only ARP or ARP cache comes into picture. Basically, the L2 is enough - we just need to  match the device ADDRESS - i.e. MAC ADDRESS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when the packet is for other subnet - the device is look for its routing table, based on the rule the packet will be send to the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is when this happens - do the sender will change the ethernet frame destination MAC address to router MAC address? As the sender doesn't know anything about the destination MAC address. Is my understanding right. Once the router will receive( a router will receive the packet because its mac address matches) the packet, it will check the destination IP and based on the routing table - it will forward the packet to the appropriate gateway. Once the packet moves to the other gateway, will they change the source IP as the other gateway IP? If the other gateway is in the same subnet as of the destination subnet. They will simply use ARP or ARP CACHE -right. However,a router needs to track that the PACKET actually belongs to the other network - Is it a NAT - network address table that it will look for. &#xA;Thus, the &lt;/p&gt;&#xA;" OwnerUserId="13278" LastActivityDate="2015-01-09T13:03:32.353" Title="When the packet is for the other subnet, how a packet is encapsulated?" Tags="|routing|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16051" PostTypeId="2" ParentId="5457" CreationDate="2015-01-09T09:48:41.220" Score="1" Body="&lt;p&gt;You can use a perl script, such as &lt;a href=&quot;https://gist.github.com/AlexAvlonitis/005e5e91f160fea9e913&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt;.  Usage: &lt;code&gt;perl cisco_backup.pl &quot;my-enable-password&quot;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="13281" LastEditorUserId="775" LastEditDate="2015-01-09T10:22:01.410" LastActivityDate="2015-01-09T10:22:01.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16055" PostTypeId="2" ParentId="16048" CreationDate="2015-01-09T13:03:32.353" Score="3" Body="&lt;p&gt;You are mostly correct.  As a packet gets forwarded from host to router, to (another) router, to host, the mac addresses change at each hop.  But the IP addresses do not change -- they are the original destination and source IPs.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-01-09T13:03:32.353" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16058" PostTypeId="1" CreationDate="2015-01-09T15:51:05.940" Score="2" ViewCount="4664" Body="&lt;p&gt;How to stop a connected network (gig2/1) from being advertised in eigrp? I was thinking to use passive interface but the connected subnet would still be advertised because of &quot;network 10.0.0.0&quot; under eigrp, am I right?  Below is the configuration.  Thanks a lot.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;int gig2/1&#xA;no switchport&#xA;ip address 10.80.1.12 255.255.252.0&#xA;!&#xA;router eigrp 1&#xA; network 10.0.0.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13292" LastEditorUserId="13290" LastEditDate="2015-01-11T05:28:51.837" LastActivityDate="2015-01-13T16:45:58.330" Title="How to stop a connected network from being advertised in eigrp?" Tags="|cisco|routing|eigrp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16061" PostTypeId="2" ParentId="16058" CreationDate="2015-01-09T18:21:07.833" Score="5" Body="&lt;p&gt;Create network statements with subnet masks for each interface you do want to advertise and exclude the interface you don't want to advertise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you have&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int gi 1/1&#xA;ip address 10.1.1.1 255.255.255.0&#xA;!&#xA;int gi 1/2&#xA;ip address 10.1.2.1 255.255.255.0&#xA;!&#xA;int gi 1/3 &#xA;ip address 10.1.3.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you don't want to advertise 10.1.2.0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router eigrp 1&#xA;network 10.1.1.0 255.255.255.0&#xA;network 10.1.3.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;10.1.2.0 won't be advertised in eigrp&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-01-09T18:21:07.833" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16062" PostTypeId="1" AcceptedAnswerId="16063" CreationDate="2015-01-09T21:15:33.547" Score="9" ViewCount="28238" Body="&lt;p&gt;Short:&lt;br&gt;&#xA;I want DHCP server to assign a preconfigured IP address based on a port (on a switch, ideally) a device is connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My situation:&lt;br&gt;&#xA;I am building an automated indoor farm (for growing tomatoes). The farm is composed of many (12 for now, but will grow to hundreds) identical 7&quot;x7&quot; rooms. Each room will have an Ethernet port, and into this port an environment control system will be plugged in. Note that each room needs to be controlled individually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rooms are arranged in rows of 12, so I was thinking I will have a switch per row, and connect these switches to a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could program each environmental controller with a static IP, so that I can associate a controller to a particular room on the server, but I think it would be easier if I could assign an IP address to each room, which would also make controllers interchangeable and hot swap-able with no need for manual configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;InB4: I am also considering using ZigBee network for this application, but I may need to transmit diagnostic images, and with hundreds of units ZigBee may be inadequate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt; is it possible to assign a preconfigured IP address based on a port a device is connected to? What devices do I need for this?&lt;/p&gt;&#xA;" OwnerUserId="13301" LastEditorUserId="775" LastEditDate="2015-01-10T01:40:56.460" LastActivityDate="2016-02-27T05:29:37.160" Title="Assign an IP address based on switch port" Tags="|cisco|switch|router|ethernet|dhcp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16063" PostTypeId="2" ParentId="16062" CreationDate="2015-01-09T21:23:12.397" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;is it possible to assign a preconfigured IP address based on a port a device is connected to? What devices do I need for this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can use a Cisco switch and an IOS that supports &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst2960/software/release/12.2_55_se/configuration/guide/swdhcp82.html#wp1320905&quot;&gt;DHCP Server Port-Based Address Allocation&lt;/a&gt; on your switch; you also must issue DHCP from your switch.  Assume that you have got &lt;code&gt;Fa0/1&lt;/code&gt; and &lt;code&gt;Fa0/2&lt;/code&gt; in Vlan120.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp use subscriber-id client-id&#xA;ip dhcp subscriber-id interface-name&#xA;ip dhcp excluded-address 192.0.2.1 192.0.2.10&#xA;!&#xA;ip dhcp pool VLAN120&#xA;   network 192.0.2.0 255.255.255.0&#xA;   default-router 192.0.2.1&#xA;   dns-server 192.0.2.5&#xA;   reserved-only&#xA;   address 192.0.2.101 client-id &quot;Fa0/1&quot; ascii&#xA;   address 192.0.2.102 client-id &quot;Fa0/2&quot; ascii&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This configuration reserves addresses for fa0/1 and fa0/2.  The same address will always be assigned to those ports.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-01-09T21:23:12.397" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16064" PostTypeId="1" CreationDate="2015-01-09T22:26:20.087" Score="2" ViewCount="624" Body="&lt;p&gt;When my computer is in the same place, the RSS (received signal strength) value it receives from my router tends to stay constant at around -60dBM. However, my bandwidth tends to fluctuate a lot over time. Is there an upper or lower bound to bandwidth given a current RSS?&lt;/p&gt;&#xA;" OwnerUserId="10099" LastActivityDate="2015-02-18T03:15:22.090" Title="Is there an upper or lower bound of bandwidth given a particular RSS value?" Tags="|router|wireless|bandwidth|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16065" PostTypeId="1" CreationDate="2015-01-09T22:46:33.060" Score="2" ViewCount="441" Body="&lt;p&gt;I have WiFi mesh network with more than one AP. So I want to see the clients' RSSI level for each APs to steer them to AP with better RSSI. I am curious whether I can check the RSSI by forcing them to broadcast some packets. In other words, I dont want to wait for the clients to send Broadcast packets, I want to make them send it, whenever I want. Lets say, I have full control over AP's software.&lt;/p&gt;&#xA;" OwnerUserId="10789" LastActivityDate="2016-01-06T11:05:05.867" Title="force client to send broadcast packet" Tags="|wireless|broadcast|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16067" PostTypeId="2" ParentId="13396" CreationDate="2015-01-10T00:35:32.440" Score="3" Body="&lt;p&gt;I am not sure of a way to do it on one command however you can do it in two and correlate the output. To show the VRFs that contain a physical interface you could (all from configuration mode, add &lt;code&gt;configuration&lt;/code&gt; after &lt;code&gt;show&lt;/code&gt; in operational mode) do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show routing-instances | match ge-0/0/0 | display set&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which would provide output like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-instances ROUTER-A interface ge-0/0/0.1&#xA;set routing-instances ROUTER-B interface ge-0/0/0.2&#xA;set routing-instances ROUTER-C interface ge-0/0/0.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To find all of the routing-instances you could do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show routing-instances | display set | match bgp | match &quot;type external&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which would produce output like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-instances ROUTER-A protocols bgp group EXTERNAL type external&#xA;set routing-instances ROUTER-B protocols bgp group EXTERNAL type external&#xA;set routing-instances ROUTER-C protocols bgp group EXTERNAL type external&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3732" LastActivityDate="2015-01-10T00:35:32.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16068" PostTypeId="5" CreationDate="2015-01-10T00:43:07.530" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2015-01-10T00:43:07.530" LastActivityDate="2015-01-10T00:43:07.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16069" PostTypeId="4" CreationDate="2015-01-10T00:43:07.530" Score="0" Body="The Juniper SRX is a series of security services devices running Junos. Security features include the full UTM functionality previously found on ScreenOS, including web filtering, IDP and anti-virus. Although high-end and low-end SRX platforms differ in the underlying hardware, common software base enables feature consistency and signature Juniper routing code." OwnerUserId="3732" LastEditorUserId="3732" LastEditDate="2015-01-10T09:36:42.770" LastActivityDate="2015-01-10T09:36:42.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16070" PostTypeId="2" ParentId="16042" CreationDate="2015-01-10T01:42:46.717" Score="6" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;6.2 Upstream&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;6.2.1 Overview&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The upstream Physical Media Dependent (PMD) sublayer uses an FDMA/TDMA (herein called TDMA mode) or FDMA/TDMA/S-CDMA (herein called S-CDMA mode) burst type format, which provides six modulation rates and multiple modulation formats. The use of TDMA or S-CDMA mode is configured by the CMTS via MAC messaging.&lt;/p&gt;&#xA;&lt;p&gt;FDMA (frequency division multiple access) indicates that multiple RF channels are assigned in the upstream band. A CM transmits on one or more RF channels and may be reconfigured to change channels.&#xA;...&lt;/p&gt;&#xA;&lt;p&gt;TDMA (time division multiple access) indicates that upstream transmissions have a burst nature. A given RF channel is shared by multiple CMs via the dynamic assignment of time slots. S-CDMA (synchronous code division multiple access) indicates that multiple CMs can transmit simultaneously on the same RF channel and during the same TDMA time slot, while being separated by different orthogonal codes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;CableLabs spec (&lt;a href=&quot;http://www.cablelabs.com/wp-content/uploads/specdocs/CM-SP-PHYv3.0-I11-130808.pdf&quot; rel=&quot;noreferrer&quot;&gt;CM-SP-PHYv3.0-I11-130808&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-01-10T01:42:46.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16071" PostTypeId="2" ParentId="16017" CreationDate="2015-01-10T04:20:24.000" Score="3" Body="&lt;pre&gt;&lt;code&gt;mls qos aggregate-policer ltusa-5mbps-in 5000000 625000 exceed-action drop&#xA;mls qos aggregate-policer ltusa-5mbps-out 5000000 625000 exceed-action drop&#xA;mls qos min-reserve 5 170&#xA;mls qos min-reserve 6 85&#xA;mls qos min-reserve 7 51&#xA;mls qos min-reserve 8 34&#xA;mls qos&#xA;...&#xA;class-map match-all cm-ltusa&#xA; match ip dscp default &#xA;!&#xA;policy-map pm-ltusa-out&#xA; class cm-ltusa&#xA;    police aggregate ltusa-5mbps-out&#xA;policy-map pm-ltusa-in&#xA; class cm-ltusa&#xA;    police aggregate ltusa-5mbps-in&#xA;...&#xA;interface FastEthernet0/xxx&#xA; switchport access vlan 4000&#xA; switchport mode access&#xA; fair-queue&#xA; service-policy input pm-ltusa-in&#xA; service-policy output pm-ltusa-out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far as I recall, that worked on my 3550. (It's not in service anymore.) There's more than one interface in vlan 4000; all have the same configuration. &lt;code&gt;mls qos&lt;/code&gt; is the Magic&amp;trade; to make shaping work on a switch.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-10T04:20:24.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16073" PostTypeId="1" AcceptedAnswerId="16081" CreationDate="2015-01-10T11:56:46.893" Score="-1" ViewCount="822" Body="&lt;p&gt;Suppose Host A wants to send a large file to Host B. The path from Host A to Host B has 3 links of rates:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1 = 512 Kbps&lt;/li&gt;&#xA;&lt;li&gt;R2 = 2 Mbps&lt;/li&gt;&#xA;&lt;li&gt;R3 = 1 Mbps&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What is the throughput for the file transfer (in Kbytes per minute)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to me the whole link is equivalent to a 512kbps link&#xA;and according to that the efficiency = 512*60/8 (KBytes/min).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the logic and answer correct, or am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="13307" LastEditorUserId="619" LastEditDate="2015-01-11T04:05:35.127" LastActivityDate="2015-01-11T04:05:35.127" Title="Throughput of the network in the given scenario" Tags="|throughput|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16074" PostTypeId="1" AcceptedAnswerId="16076" CreationDate="2015-01-10T14:00:52.547" Score="1" ViewCount="5218" Body="&lt;p&gt;Is the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_rules.html#wp1185516&quot; rel=&quot;nofollow&quot;&gt;global rule&lt;/a&gt; and the implicit deny following it looked at, even if no explicit interface ACL is configured on the interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_rules.html#wp1185516&quot; rel=&quot;nofollow&quot;&gt;They say&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If you configure a global access rule, then the implicit deny comes after the global&#xA;  rule is processed. See the following order of operations:&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;&lt;p&gt;Interface access rule.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Global access rule.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Implicit deny. &lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What if 1. does not exist and only 2. exists?&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2016-01-11T13:27:31.133" Title="Cisco ASA: global ACL rule" Tags="|cisco-asa|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16076" PostTypeId="2" ParentId="16074" CreationDate="2015-01-10T18:19:54.313" Score="3" Body="&lt;p&gt;If you don't have an Interface ACL applied, than only the Global ACL and the Implicit Deny at the end of it will be considered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;#3 always exists &lt;em&gt;(so long as either #1 or #2 are applied to an interface)&lt;/em&gt;.  You don't have to configure the Implicit Deny (that would make it an explicit deny).  &lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2015-01-11T14:27:39.057" LastActivityDate="2015-01-11T14:27:39.057" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16080" PostTypeId="2" ParentId="16058" CreationDate="2015-01-11T01:41:17.887" Score="6" Body="&lt;p&gt;You sound like you are looking for distribute-list. Have a look here for the command reference &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfeigrp.html#wp1030208&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfeigrp.html#wp1030208&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what you want, i think (not tested):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 1 deny 10.80.1.12&#xA;access-list 1 permit any&#xA;router eigrp 1&#xA;  network 10.0.0.0&#xA;  distribute-list 1 out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Note a similar method can stop external routes from being learnt, using &lt;code&gt;distribute-list number in&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="13290" LastEditorUserId="13290" LastEditDate="2015-01-13T16:45:58.330" LastActivityDate="2015-01-13T16:45:58.330" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16081" PostTypeId="2" ParentId="16073" CreationDate="2015-01-11T02:25:16.513" Score="2" Body="&lt;p&gt;From the limited information provided and taking the most basic networking view you are correct, you will always be limited by the slowest link in a network with a single route from A to B. In reality most topologies are redundant, all file transport protocols have overhead and most networks have congestion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you look to have assumed 8 bits in a byte and 60 seconds in a minute :)&lt;/p&gt;&#xA;" OwnerUserId="13290" LastActivityDate="2015-01-11T02:25:16.513" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16082" PostTypeId="2" ParentId="16065" CreationDate="2015-01-11T06:15:23.507" Score="2" Body="&lt;p&gt;You could probably force your peers to send ARP or ND packets by sending a gratuitious ARP with their address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This, however, is not the approach usually taken — most mesh networking daemons send broadcast or multicast packets periodically (these are typically known as &quot;Hello&quot; packets, and are compulsory in OLSR(v2) and Babel, and optional in DYMO/AODVv2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note further that RSSI is a poor predictor of link quality, at least for 802.11.  You'll find a good discussion of related issues in the &lt;a href=&quot;http://wireless.kernel.org/en/developers/Documentation/mac80211/RateControl/minstrel&quot; rel=&quot;nofollow&quot;&gt;Minstrel&lt;/a&gt; litterature.&lt;/p&gt;&#xA;" OwnerUserId="12089" LastActivityDate="2015-01-11T06:15:23.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16086" PostTypeId="1" AcceptedAnswerId="20577" CreationDate="2015-01-11T16:10:33.860" Score="3" ViewCount="4613" Body="&lt;p&gt;I'd like to set up a little network environment. We have bought 2 different subnet from our ISP. &#xA;&lt;br&gt;&lt;strong&gt;The WAN internet connection&lt;/strong&gt; : xx.yy.81.61/26&#xA;&lt;br&gt;&lt;strong&gt;WAN gateway&lt;/strong&gt;: xx.yy.81.1&#xA;&lt;br&gt;&lt;strong&gt;First subnet&lt;/strong&gt; : xx.yy.81.80/30    (this has the same first 3 octet as the WAN, probably doesn't count, because it is a different subnet)&#xA;&lt;br&gt;&lt;strong&gt;Second subnet&lt;/strong&gt; : zz.uu.156.48/29&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see in the first diagram, the xx.yy.81.61/26 is assigned to the CISCO's outside(WAN) interface, the internet connection is alive, all hosts in LAN have internet connection. We want to assign some hosts with public IP address (for webserver sake). I'm not familiar with networking, so please forgive me if I make some silly questions. In brackets, I make the cisco router setup with the &quot;Cisco Configuration Professional&quot; PC program.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;      |     &#xA;      |     ADSL or Optical cable (fiber link)&#xA;      |&#xA;   +-----+&#xA;   |     |   modem&#xA;   |     |&#xA;   +-----+&#xA;      |&#xA;      |        WAN (xx.yy.81.61/26)&#xA;      |     Gateway(xx.yy.81.1)&#xA;      |&#xA; +----------+&#xA; |          |&#xA; |          |    CISCO 881 (router/firewall)&#xA; |          |    IOS 15.2(4)M6&#xA; |          |&#xA; +----------+&#xA;      |&#xA;      |&#xA; -----+-------------   our local LAN segment (vlan)&#xA;  10.10.10.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;I want to set up the CISCO:&lt;br&gt;&#xA;- The question is, that how can i make my subnets alive? I just want to transmit(NAT) some public IP from subnet to specific HOST computer(or inverse?). I have made the NAT rules (zz.uu.156.50 &amp;lt;- 10.10.10.xxx), but no result, the public IP is unreachable(no ping, no traceroute). &lt;br&gt;&#xA;- Do I have to assign a second IP(virtual) address from subnets to the outside interface(WAN). If yes, than how?&#xA;&lt;br&gt;&lt;br&gt;&#xA;The truth is that the original setup was different, as you can see in the second diagram. In this case the both subnet was alive. Based on this I think the subnets is being routed through the WAN IP address(xx.yy.81.61). Now, I unmounted the ISP owned HP router and I attached the CISCO directly to the modem output(first diagram), because we had some DNS issues and I think it is unnecessary to be 2 router sequentially. Please indicate if i was wrong. &lt;br&gt;&#xA;I mention, that by the original setup, I could access the HP router (just the login interface) from internet with first IP of the subnets (xx.yy.81.81 from the first subnet and  zz.uu.156.49 from the second subnet).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;      |     &#xA;      |     ADSL or Optical cable (fiber link)&#xA;      |&#xA;   +-----+&#xA;   |     |   modem&#xA;   |     |&#xA;   +-----+&#xA;      |&#xA;      |&#xA;      |&#xA;  +-------+&#xA;  |       |    blackbox, no acces&#xA;  |       |    ISP owned HP router&#xA;  |       |&#xA;  +-------+&#xA;      |&#xA;      |        WAN (xx.yy.81.82/30)    or      WAN (zz.uu.156.50/29)&#xA;      |     Gateway(xx.yy.81.81)            Gateway(zz.uu.156.49) &#xA;      |&#xA; +----------+&#xA; |          |&#xA; |          |    CISCO 881 (router/firewall)&#xA; |          |    IOS 15.2(4)M6&#xA; |          |&#xA; +----------+&#xA;      |&#xA;      |&#xA; -----+-------------   our local LAN segment&#xA;  10.10.10.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="13320" LastActivityDate="2016-05-08T20:36:12.277" Title="How to setup Cisco IOS with multi public IP's" Tags="|cisco|routing|cisco-ios|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16089" PostTypeId="1" CreationDate="2015-01-12T08:38:50.600" Score="0" ViewCount="233" Body="&lt;p&gt;When a ping passes a switch, how does the switch know which port to send it to?&lt;/p&gt;&#xA;" OwnerUserId="13327" LastEditorUserId="189" LastEditDate="2015-01-12T09:25:50.077" LastActivityDate="2015-01-12T09:25:50.077" Title="How does a switch know out of which port to send a frame?" Tags="|arp|ping|" AnswerCount="1" CommentCount="0" ClosedDate="2015-01-12T10:01:25.167" ContentLicense="CC BY-SA 3.0" />
  <row Id="16090" PostTypeId="2" ParentId="16089" CreationDate="2015-01-12T08:46:54.363" Score="-4" Body="&lt;p&gt;Maybe I misunderstood your question, in that case i apologize in advance.&#xA;But packets contain in their header many fields, one of which is the destination port. So the switch simply reads that information.&lt;/p&gt;&#xA;" OwnerUserId="13326" LastActivityDate="2015-01-12T08:46:54.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16095" PostTypeId="2" ParentId="12943" CreationDate="2015-01-12T13:06:02.963" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Now, I've been told that routers with inbound QoS policies are capable of leveraging the TCP congestion avoidance mechanism by dropping ACKs in order to rate-shape inbound traffic. I've never seen this done in practice, or at least never seen it work; is this a real thing? If so, is it effective? Wouldn't it result in a run of dropped packets every time that a new connection ramped up to speed, before the congestion algorithm could start slowing things down?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I doubt it, certainly for queues as these are relatively TCP friendly anway. Some routers might have tried this strategy to build tcp-friendly policers but I doubt this would be a decent solution. First of all, an ACK can be accompanied by data so you can't really only drop 'ACK's. Secondly, even if that is true for some streams, why would you drop only on the return path? For the TCP stream it's just as good to simply drop the original data and that way you don't waste bandwidth and processing resources between your edge router and receiver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More likely is to have H-QoS, with a 30Mbps queue/scheduler on the circuit/user level and then multiple smaller-tier queues feeding into that. A simple setup could be to let both TCP and UDP feed into two different 25Mbps queues, so TCP can still leave 5Mbps for UDP and vice versa. Of course more complex variations exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, consider that &lt;code&gt;ssthresh&lt;/code&gt; is usually adapted fairly quick towards your available bandwidth (here 30Mbps - your voice BW). While TCP does not stop increasing &lt;code&gt;cwnd&lt;/code&gt; at &lt;code&gt;ssthresh&lt;/code&gt;, it will only increase slowly afterwards and disturbing your voice stream only slightly when congestion is reached. However, at the start of the TCP connection, before ssthresh is adapted to a realistic value this will probably significantly disturb your voice flow (albeit shortly). Finally, while it might work okay with only a few TCP streams, when somebody starts 100s of TCP connections (e.g. P2P app) it gets more difficult. It's unlikely that all &lt;code&gt;ssthresh&lt;/code&gt; and &lt;code&gt;cwnd&lt;/code&gt; values stabilize (quickly) to guarantee fairness, even more if those connections are quite volatile (as is often the case with P2P).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, next to drops notice that a saturated connection also has a negative impact on your jitter, this might sometimes be just as problematic (or even worse) than a few packet drops.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In addition to that, however, what if the traffic utilizing the circuit is largely UDP? If a request for a large amount of UDP data is sent to a server, it's naturally going to send the data as quickly as feasible, flood the queue and cause dropped voice packets - but maybe I'm overreacting to that scenario. Is UDP used for any high-throughput internet technologies these days?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're 100% correct, UDP has no fairness built-in. Many real-time multimedia applications (voip, video conferencing, ...) still use UDP. Tunnels (e.g. for VPN) also usually use UDP to avoid TCP-in-TCP retransmit timer conflicts. So yes, you certainly can have quite some high-throughput UDP traffic on a connection.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;More specifically, have you ever personally seen a QoS method that let VoIP work without constant quality problems on a frequently-saturated internet connection without ISP-provided QoS? Have you ever heard of a DSL or cable provider implementing edge router QoS for an application like this? I've only ever heard of that offered as part of MPLS products, is that pretty much a necessity if someone wants downstream QoS?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well, here the question is of course if many modern internet connections are frequently saturated. In my experience the available BW for a fixed connection often exceeds the average usage. There are always exceptions but usually the bulk of the people have loads of BW, it might still get saturated somewhere, but not that often on your direct access circuit. However, you might encounter it more often in mobile access as this is a relatively low-bandwidth low-reliability shared medium. Currently 4G helps a lot but that will only last this long as mobile BW usage is still growing heavily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, I have heard providers implementing QoS for multimedia applications. For which applications that might differ a lot from provider to provider. Assume they just qualify traffic as BE unless there is a good reason to do otherwise. But some might indifferently prioritize SIP/RTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MPLS is certainly not a necessity for QoS, any decent BNG today also includes quite significant QoS options.&lt;/p&gt;&#xA;" OwnerUserId="2062" LastEditorUserId="2062" LastEditDate="2016-04-15T10:54:23.623" LastActivityDate="2016-04-15T10:54:23.623" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16096" PostTypeId="1" AcceptedAnswerId="16106" CreationDate="2015-01-12T13:14:29.183" Score="3" ViewCount="1181" Body="&lt;p&gt;My configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map Shape_FTP&#xA; class FTP&#xA;  shape average percent 5&#xA; class class-default&#xA;  fair-queue&#xA;policy-map Shaper&#xA; class class-default&#xA;  shape average percent 100&#xA;   service-policy Shape_FTP&#xA;&#xA;interface tunnel 0&#xA; bandwidth 512&#xA; tunnel protection ipsec profile aes&#xA; service-policy output Shaper&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Bandwidth value is used from physical interface. Is it possible to make QoS use bandwidth value from tunnel interface? I have a lot of tunnel interfaces with different bandwidthes (with the same tunnel source IP). I would like to use one policy map with &lt;code&gt;shape average percent 100&lt;/code&gt; rather than a lot of with &lt;code&gt;shape average 512000&lt;/code&gt; and so on&lt;/p&gt;&#xA;" OwnerUserId="7630" LastActivityDate="2015-01-20T11:27:09.173" Title="QoS on tunnel interface" Tags="|cisco|qos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16097" PostTypeId="1" AcceptedAnswerId="16098" CreationDate="2015-01-12T16:07:15.710" Score="8" ViewCount="1763" Body="&lt;p&gt;I inherited some configs on a network I manage from a previous administrator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some of the ACLs there are some very strange wildcard masks that i've not seen before, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10 permit ip any 10.160.1.0 0.31.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I cannot find anywhere online where it states that this kind of ACL is valid. Is anyone able to confirm/deny this for me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="13332" LastActivityDate="2015-01-12T20:37:17.920" Title="Unusual wildcard mask in Cisco ACL configuration" Tags="|cisco|acl|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16098" PostTypeId="2" ParentId="16097" CreationDate="2015-01-12T16:16:19.240" Score="13" Body="&lt;p&gt;That is a valid wildcard mask.  It will match any IP with the format 10.(160-191).1.(0-255).  Whether or not this is intended, or good design, is unknown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wildcard masks are just &quot;do-we-care&quot; bitwise masks used when looking at an IP -- a value of 0 means &quot;do-care&quot;, and 1 means &quot;don't-care&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, 0.31.0.255 translates to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00000000 00011111 00000000 1111111&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the IP listed in the ACL (10.160.1.0) will have a binary value of &lt;/p&gt;&#xA;&#xA;&lt;p&gt;00001010 10100000 00000001 00000000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Testing an IP (10.190.1.200):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001010 10111110 00000001 11001000 (10.190.1.200)&#xA;00001010 10100000 00000001 00000000 (10.160.1.0)&#xA;^^^^^^^^ ^^^      ^^^^^^^^          (0.31.0.255)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The carets represent the wildcard mask, showing which bits MUST match.  Since they do, 10.190.1.200 would match this ACL statement.&lt;/p&gt;&#xA;" OwnerUserId="141" LastEditorUserId="141" LastEditDate="2015-01-12T20:37:17.920" LastActivityDate="2015-01-12T20:37:17.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16100" PostTypeId="2" ParentId="14914" CreationDate="2015-01-12T20:50:00.680" Score="5" Body="&lt;p&gt;It's treated as a fresh session up when the peers restart.  TCP handshake, capability re-negotiation, address family advertisement, and then NLRI exchange.  If the hold down timer expires, the peer is marked as dead, the session goes into the IDLE state, and follows its own rules for transitioning from IDLE to Active (actively attempting to establish a TCP connection).  Note that a peer in the IDLE state can still accept an inbound TCP handshake from the other router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exact time needed for a specific route to be available again is dependent on the total # of NLRIs to be exchanged between the two routers.  If you're exchanging full tables (500K+ NLRI), depending on processor size on both routers, it could take upwards of 5 minutes.  If you only have 20 routes to announce, they'll process the NLRI real quick like.&lt;/p&gt;&#xA;" OwnerUserId="141" LastActivityDate="2015-01-12T20:50:00.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16105" PostTypeId="1" CreationDate="2015-01-13T07:43:10.653" Score="1" ViewCount="820" Body="&lt;p&gt;So, I have run into an issue that is stumping me. I have a Cisco 2811 running 15.1(3)T4, and I am using it to run CME on a small (three phone) VoIP system. The system has a SIP trunk through Vitelity. as well as a POTS line (for failover, as well as 911 calling.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The primary receptionist has watch lines (meaning, &quot;button 5w3&quot;, etc.) for the other two phones. When I cut them over to the SIP trunk, all of a sudden, she cannot use those buttons to transfer calls, but ONLY when they come in over the SIP trunk...calls that enter via the POTS line transfer correctly. She CAN transfer normally if she types their extension manually, as opposed to using the watch buttons. So, to summarize what is happening:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Incoming call via POTS -&amp;gt; Receptionist -&amp;gt; Transfer using Trnsfer+watch button -&amp;gt; Success&#xA;Incoming call via POTS -&amp;gt; Receptionist -&amp;gt; Transfer using Trnsfer+dialing extension -&amp;gt; Success&#xA;Incoming call via SIP Trunk -&amp;gt; Receptionist -&amp;gt; Transfer using Trnsfer+dialing extension -&amp;gt; Success&#xA;Incoming call via SIP Trunk -&amp;gt; Receptionist -&amp;gt; Transfer using Trnsfer+watch button -&amp;gt; Call drops&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea what is going on here? I have already set &quot;voice service voip&quot; -&gt; &quot;sip&quot; -&gt; &quot;no update-callerid&quot;. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="7560" LastActivityDate="2015-01-13T07:43:10.653" Title="Cisco CME Failing to Transfer Calls From SIP Trunk, via Watcher Button" Tags="|cisco|sip|cisco-voip|" AnswerCount="0" CommentCount="0" ClosedDate="2019-06-04T20:34:28.093" ContentLicense="CC BY-SA 3.0" />
  <row Id="16106" PostTypeId="2" ParentId="16096" CreationDate="2015-01-13T08:02:56.250" Score="6" Body="&lt;p&gt;Have you tried using &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/qos/command/reference/qos_book/qos_a1.html#wp1027485&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;bandwidth qos-reference&lt;/code&gt;&lt;/a&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel100&#xA; bandwidth 1000&#xA; bandwidth qos-reference 1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="155" LastEditorUserId="775" LastEditDate="2015-01-20T11:27:09.173" LastActivityDate="2015-01-20T11:27:09.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16107" PostTypeId="2" ParentId="12975" CreationDate="2015-01-13T08:47:25.640" Score="4" Body="&lt;p&gt;If we look at &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc792#page-14&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 792&lt;/a&gt; (pages 14-15) it clearly only defines code 0 for ICMP types 0 and 8, this corresponds to IANA's definitions for &lt;a href=&quot;http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml#icmp-parameters-codes-0&quot; rel=&quot;nofollow noreferrer&quot;&gt;reply&lt;/a&gt; and &lt;a href=&quot;http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml#icmp-parameters-codes-8&quot; rel=&quot;nofollow noreferrer&quot;&gt;request&lt;/a&gt;. This means above all that 9 does not have a meaning, so it does &lt;em&gt;not&lt;/em&gt; mean &lt;code&gt;Communication with Destination Network is Administratively Prohibited&lt;/code&gt; as used in the Destination Unreachable message.&lt;/p&gt;&#xA;&lt;p&gt;The next point is if any other code than &lt;code&gt;0&lt;/code&gt; is allowed. RFC 792 is quite old and does not really follow the more strict SHOULD/MUST/MAY/... conventions. The remainder of the RFC only states sections like &lt;code&gt;IF code = 0 ...&lt;/code&gt; or &lt;code&gt;Code 0 may be received ...&lt;/code&gt;. It actually never states what should be done if code is not zero. One might intuitively interpret it as the opposite of what is defined, so &lt;code&gt;may *not* be received&lt;/code&gt;, another might say that if it's not explicitly disallowed it's okay. There is nothing in the RFC that even hints at what's right, so behavior will likely be very implementation-specific.&lt;/p&gt;&#xA;&lt;p&gt;There is also &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122#page-42&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1122&lt;/a&gt; but this does not provide any extra specific limitation on the &lt;code&gt;code&lt;/code&gt; field.&lt;/p&gt;&#xA;&lt;p&gt;Now as for why the reply also uses &lt;code&gt;9&lt;/code&gt;, easiest bet is to look at implementation. A simple echo reply would just take the incoming packet, replace the type &lt;code&gt;8&lt;/code&gt; with type &lt;code&gt;0&lt;/code&gt;, recalculate the checksum and send back. This is simpler and more efficient than building the reply from scratch, but of course leaves the &lt;code&gt;9&lt;/code&gt; code.&lt;/p&gt;&#xA;" OwnerUserId="2062" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2015-01-13T08:47:25.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16109" PostTypeId="2" ParentId="14935" CreationDate="2015-01-13T10:44:31.663" Score="1" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Does-this mean that the Cisco is only capable to supporting Planned Graceful-restart (ie. Card SwitchOver) and not unplanned (ie. Sudden problem with the SUP2T card)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;No, it just means that BGP hasn't restarted yet.&lt;/p&gt;&#xA;&lt;p&gt;Quoting from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4724#page-5&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;RFC 4724, page 5&quot;&gt;RFC 4724 Graceful Restart Mechanism for BGP, pg 5&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  Flags for Address Family:&#xA;&#xA;     This field contains bit flags relating to routes that were&#xA;     advertised with the given AFI and SAFI.&#xA;&#xA;         0 1 2 3 4 5 6 7&#xA;        +-+-+-+-+-+-+-+-+&#xA;        |F|   Reserved  |&#xA;        +-+-+-+-+-+-+-+-+&#xA;&#xA;     The most significant bit is defined as the Forwarding State (F)&#xA;     bit, which can be used to indicate whether the forwarding state&#xA;     for routes that were advertised with the given AFI and SAFI has&#xA;     indeed been preserved during the previous BGP restart.  When&#xA;     set (value 1), the bit indicates that the forwarding state has&#xA;     been preserved.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The RFC is pretty specific, when &lt;code&gt;Forwarding State&lt;/code&gt; is set, then the routes were preserved during the &amp;quot;previous BGP restart&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Also refer to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4724#section-4.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section 4.1&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;To re-establish the session with its peer, the Restarting Speaker&#xA; MUST set the &amp;quot;Restart State&amp;quot; bit in the Graceful Restart Capability&#xA; of the OPEN message.  Unless allowed via configuration, the&#xA; &amp;quot;Forwarding State&amp;quot; bit for an address family in the capability can be&#xA; set only if the forwarding state has indeed been preserved for that&#xA; address family during the restart.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Again we see that (aside from static configuration), one should set the Forwarding State bit &amp;quot;only if the forwarding state has indeed been preserved for that address family during the restart&amp;quot;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-01-13T10:44:31.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16112" PostTypeId="1" AcceptedAnswerId="16113" CreationDate="2015-01-13T12:34:50.970" Score="2" ViewCount="382" Body="&lt;p&gt;I know that IP ranges can be returned to RIRs and reassigned, but what about AS numbers?&lt;/p&gt;&#xA;" OwnerUserId="7599" LastActivityDate="2015-01-13T15:04:34.837" Title="Can AS numbers be reassigned?" Tags="|routing|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16113" PostTypeId="2" ParentId="16112" CreationDate="2015-01-13T12:40:11.457" Score="7" Body="&lt;p&gt;AS numbers can be reassigned; quoting &lt;a href=&quot;http://www.ripe.net/ripe/docs/2007-01-asn&quot;&gt;RIPE Autonomous System (AS) Number Assignment Policies and Procedures, Section 1.8&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1.8 Returning an AS Number&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If an organisation has an AS Number that is no longer in use, it can be &#xA;     returned to the public pool of AS Numbers by sending a message to &#xA;     hostmaster@ripe.net. It can then be reassigned to another Autonomous System by the RIPE NCC.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can't find a similar public statement from ARIN, but I know someone personally who received a reassigned ASN from ARIN.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-01-13T12:40:11.457" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16114" PostTypeId="2" ParentId="16008" CreationDate="2015-01-13T12:53:52.213" Score="0" Body="&lt;p&gt;thank you very much for both of your anwsers @PantherModern and @Arimo. I was able to solve it fairly easy, the issue turned out to be when you have a NetGear router you have to make sure all untagged ports on your custom vlans are given the correct PVID. When I did that, there was no issues.&#xA;I appreciate all your help, and by that I was able to understand my situation better. I wish you a great day.&lt;/p&gt;&#xA;" OwnerUserId="13352" LastActivityDate="2015-01-13T12:53:52.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16116" PostTypeId="2" ParentId="16112" CreationDate="2015-01-13T15:04:34.837" Score="0" Body="&lt;p&gt;AS number can be &lt;a href=&quot;http://www.ripe.net/lir-services/resource-management/reassigning-as-numbers&quot; rel=&quot;nofollow&quot;&gt;reassigned&lt;/a&gt; or maybe later this year transferred (&lt;a href=&quot;http://www.ripe.net/ripe/policies/proposals/2014-13&quot; rel=&quot;nofollow&quot;&gt;proposal&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information can be found: &lt;a href=&quot;http://www.ripe.net/ripe/docs/2007-01-asn#18&quot; rel=&quot;nofollow&quot;&gt;http://www.ripe.net/ripe/docs/2007-01-asn#18&lt;/a&gt; / &lt;/p&gt;&#xA;" OwnerUserId="2693" LastActivityDate="2015-01-13T15:04:34.837" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16117" PostTypeId="1" AcceptedAnswerId="16119" CreationDate="2015-01-13T15:10:46.960" Score="1" ViewCount="127" Body="&lt;p&gt;Will a Cat6 ethernet cable work on a router/NIC that only supports cat5 speeds? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that it won't give me cat6 speeds but will it even work in the first place? &lt;/p&gt;&#xA;" OwnerUserId="13355" LastEditorUserId="13355" LastEditDate="2015-01-13T15:41:18.413" LastActivityDate="2015-01-15T15:39:56.637" Title="Cat6 compatability" Tags="|ethernet|cable|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16118" PostTypeId="2" ParentId="16020" CreationDate="2015-01-13T15:20:14.307" Score="1" Body="&lt;p&gt;I believe that your IT person was referring to the minimum speed that gives acceptable quality of service in order for VPN services to function properly.  Your T1 which runs at a line speed of 1.5 Mbps Up/Down is being doubled through compression on the link between your Telco and your site to give you 3 Mbps of real throughput but that is a very small amount of data capacity to use for a business. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the VPN connections need to share this small capacity (and maybe all office communications to the Internet as well?) and it can be used of very quickly. Transferring large files would easily saturate this data pipe and and mentioned any RDP connection to a Windows Server would use .5 to 1 Mbps when moving through the GUI - much less when there is a static pages. A VNC connection on the other hand can use 2 to 3 Mbps - a much more likely connection if your IT support staff needs to connection to a server's GUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPN is very finicky when it comes to the quality of the connection but this has more to do with latency than bandwidth.  If the connection is not stable then the VPN will drop and you will need to reconnect.  In the end though, any connection to your ISP that gives good throughput and low latency will work but they might not be available in your area. Not everyone has metro Ethernet in their city and usually rely on DSL or Cable modem service as alternatives to T1 or T3.  Those two services can very widely in their speed with many DSL lines limited to 1.5 Mbps upload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most Cable modem service now provides 2 Mpbs upload speeds so for single users that will create a very solid VPN connection as long as your cable company has a good network, and most at least can give that level of QOS. With multiple simultaneous connections where people require VPN and their network to work reliably to get work done, DSL and normal cable modems won't cut it.  We use 100 Mpbs Up/Down service to provide Internet access at branch offices with between 5 to 15 employees and use VPN endpoints on those networks that are able to use all of that capacity if it is needed. &lt;/p&gt;&#xA;" OwnerUserId="13357" LastActivityDate="2015-01-13T15:20:14.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16119" PostTypeId="2" ParentId="16117" CreationDate="2015-01-13T15:46:17.040" Score="4" Body="&lt;p&gt;Yep, Category 6 cable, commonly referred to as Cat 6, is a standardized cable for Gigabit Ethernet and other network physical layers that is backward compatible with the Category 5/5e and Category 3 cable standards. &lt;a href=&quot;http://www.belden.com/docs/upload/what_is_category_6_q-a.pdf&quot; rel=&quot;nofollow&quot;&gt;More&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1315" LastActivityDate="2015-01-13T15:46:17.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16120" PostTypeId="2" ParentId="16020" CreationDate="2015-01-13T17:14:34.697" Score="2" Body="&lt;p&gt;As others have pointed out, T1s typically provide ~1.5 megabits u/d.  You must have bonded T1s: two physical copper circuits which are teamed to provide a single connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current set up is providing reliable VPN access, but there's no technical reason that other lower-priced offerings wouldn't do the same or better for a small office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I moved an office from two T1s to a point-to-point microwave WAN circuit a few years ago and improved up and down speeds by at least 1000%.  Half the price and somewhere between just as and much more reliable in terms of uptime.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2015-01-13T17:14:34.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16124" PostTypeId="2" ParentId="11332" CreationDate="2015-01-13T22:20:15.077" Score="2" Body="&lt;p&gt;I believe you want to enable Forced User Authentication.  Quoting from the help:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Forced User Authentication&#xA;  Instead of making users for which user-aware policies have been configured go to the ZyWALL Login screen manually, you can configure the ZyWALL to display the Login screen automatically whenever it routes HTTP traffic for anyone who has not logged in yet.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note:&#xA;  This works with HTTP traffic only. The ZyWALL does display the Login screen when users attempt to send other kinds of traffic.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The ZyWALL does not automatically route the request that prompted the login, however, so users have to make this request again.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can do this from the Auth. Policy section in the USG (where you can also find the Help link.)  FYI: I've worked with USG 20s, 50s and 100s and am fairly familiar with them, but haven't tried doing this.&lt;/p&gt;&#xA;" OwnerUserId="10237" LastActivityDate="2015-01-13T22:20:15.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16131" PostTypeId="1" AcceptedAnswerId="16133" CreationDate="2015-01-14T07:51:06.887" Score="3" ViewCount="2723" Body="&lt;p&gt;For testing purposes decided to add static IP addresses to my router for some mac addresses. For simplifity I started with &lt;code&gt;aa:aa:aa:aa:aa:aa&lt;/code&gt; and assigned ip &lt;code&gt;192.168.1.100&lt;/code&gt;. These combination has been saved successful. But when I tried &lt;code&gt;bb:bb:bb:bb:bb:bb&lt;/code&gt; router told me &quot;non-unicast mac address&quot;. What does it means? Why I can not use this mac address inside our network?&lt;/p&gt;&#xA;" OwnerUserId="13374" LastEditorUserId="775" LastEditDate="2015-01-14T10:25:18.583" LastActivityDate="2015-01-14T20:18:24.550" Title="Why bb:bb:bb:bb:bb:bb is non-unicast mac address?" Tags="|ethernet|mac-address|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16133" PostTypeId="2" ParentId="16131" CreationDate="2015-01-14T09:02:42.990" Score="8" Body="&lt;p&gt;The &lt;a href=&quot;http://en.wikipedia.org/wiki/Least_significant_bit&quot; rel=&quot;nofollow&quot;&gt;least significant bit (LSB)&lt;/a&gt; in the MAC-Address is the Individual/Group type specification. &lt;a href=&quot;http://standards.ieee.org/about/get/802/802.3.html&quot; rel=&quot;nofollow&quot;&gt;IEEE 802.3&lt;/a&gt; specifies the MAC-Address like this (with &lt;a href=&quot;http://en.wikipedia.org/wiki/Least_significant_bit&quot; rel=&quot;nofollow&quot;&gt;LSB&lt;/a&gt; first):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+---------+---------+----------------+&#xA;| I/G Bit | L/G Bit | 46-Bit Address |&#xA;+---------+---------+----------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I/G Bit:&lt;/strong&gt; If this bit is 0, it shall indicate that the address field contains an individual address. If this bit is 1, it shall indicate that the address field contains a group address that identifies none, one or more, or all of the stations connected to the LAN. In the Source Address field, the first bit is reserved and set to 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;L/G Bit:&lt;/strong&gt; The second bit shall be used to distinguish between locally or globally administered addresses. For globally administered (or U, universal) addresses, the bit is set to 0. If an address is to be assigned locally, this bit shall be set to 1. Note that for the broadcast address, this bit is also a 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you convert the first byte of your address &lt;code&gt;bb&lt;/code&gt; into binary, you get &lt;code&gt;10111011&lt;/code&gt;. Here the LSB is last, so the &lt;em&gt;last bit&lt;/em&gt; in the first octet/byte is the &lt;strong&gt;I/G bit&lt;/strong&gt;, which is &lt;strong&gt;1&lt;/strong&gt;. This makes your MAC address a group MAC address which your router rejects. If you use &lt;code&gt;aa&lt;/code&gt;, you get &lt;code&gt;10101010&lt;/code&gt; where the last bit is &lt;strong&gt;0&lt;/strong&gt;, making this an individual (unicast) MAC-Address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make your MAC-Adress unicast and also make clear that you've locally assigned it (and to prevent MAC collision) you should use an address where the I/G bit is turned &lt;strong&gt;off&lt;/strong&gt; and the L/G bit is turned &lt;strong&gt;on&lt;/strong&gt;. This means one of the following addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;X2:XX:XX:XX:XX:XX&#xA;X6:XX:XX:XX:XX:XX&#xA;XA:XX:XX:XX:XX:XX&#xA;XE:XX:XX:XX:XX:XX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use any hex value you want for &lt;code&gt;X&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2015-01-14T20:18:24.550" LastActivityDate="2015-01-14T20:18:24.550" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16134" PostTypeId="1" AcceptedAnswerId="16142" CreationDate="2015-01-14T09:07:41.633" Score="2" ViewCount="1608" Body="&lt;p&gt;As you know, packets flow from higher security level interfaces to lower ones by default. If you want to have an operational connection between two interfaces, your ASA must inspect the traffic so that it won't drop the connections initiated from inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if I want ping to work I must inspect ICMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here is the question&lt;/strong&gt;: What if I have a computer outside listening on an arbitrary port, and I want to connect to that computer from inside (obviously from a randomly generated port by OS)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets can get from inside to outside because of security levels, but since ASA doesn't inspect the traffic will it drop the return packets from outside to inside?&lt;/p&gt;&#xA;" OwnerUserId="13376" LastEditorUserId="44" LastEditDate="2015-01-14T23:28:16.743" LastActivityDate="2015-01-14T23:28:16.743" Title="ASA Inspect Everything" Tags="|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16135" PostTypeId="1" AcceptedAnswerId="16136" CreationDate="2015-01-14T09:46:04.493" Score="1" ViewCount="258" Body="&lt;p&gt;Why we need virtual chassis in a network ? What is the use of it ? Why not have one switch instead of having 2 or more switches (Virtual chassis) in a network .&lt;/p&gt;&#xA;" OwnerUserId="13377" LastEditorUserId="509" LastEditDate="2015-08-18T21:59:29.553" LastActivityDate="2015-08-18T21:59:29.553" Title="Use of virtual chassis" Tags="|switch|router|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16136" PostTypeId="2" ParentId="16135" CreationDate="2015-01-14T09:55:50.453" Score="4" Body="&lt;p&gt;There are two main reasons for using stacking techniques like virtual chassis: redundancy and ease of management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have just a single switch and it fails in some way, then your network is completely down. If you have a stack of switches and one node in the stack fails, then you have some form of connectivity left. When you design your network right, it can survive failure of any single device in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the second reason: if you want to provide access for 400 endpoints, you would need a very large switch to provide for all those access ports. More likely, you would use 10 smaller switches because that's a lot cheaper usually. When you stack those 10 switches, you can manage them as a single device, making your job a lot easier.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2015-01-14T09:55:50.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16142" PostTypeId="2" ParentId="16134" CreationDate="2015-01-14T16:41:07.237" Score="3" Body="&lt;p&gt;It won't drop the packets, because the ASA is a Stateful device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you have to understand what I mean when I say &lt;strong&gt;the ASA is a stateful device&lt;/strong&gt;.  This means if the firewall allowed traffic in the direction outbound, it automatically allows the correlating return traffic back inbound -- even if the inbound ACL or Security-Level would have prevented all traffic inbound.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for ICMP, &lt;strong&gt;by default, ICMP is &lt;em&gt;not&lt;/em&gt; stateful&lt;/strong&gt;.  Which is to say, if you want to allow ICMP packets to &lt;em&gt;leave&lt;/em&gt; your network, you must explicitly allow it (via ACL or Security-Level).  And if you intend for ICMP packets to &lt;em&gt;come back into&lt;/em&gt; your network, you must also explicitly allow it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you can override that default behavior by enabling ICMP inspection.  On the ASA &lt;strong&gt;inspecting ICMP makes the ASA consider ICMP stateful&lt;/strong&gt;.  Which means, if it allows an ICMP Echo Request &lt;em&gt;leave&lt;/em&gt; your network, it will automatically allow the ICMP Echo Response &lt;em&gt;come back into&lt;/em&gt; your network.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2015-01-14T21:36:51.870" LastActivityDate="2015-01-14T21:36:51.870" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16143" PostTypeId="1" AcceptedAnswerId="16278" CreationDate="2015-01-14T17:03:53.403" Score="2" ViewCount="3325" Body="&lt;p&gt;I have a small business network (&lt;code&gt;192.168.10.x/24&lt;/code&gt;) with a pfSense firewall (about 20 hosts: mix of Windows, Macs and Linux machines and printers...). The ISP modem from the WWW connects to the firewall which connects to a 16-port switch, and all the workstations/servers/printers connect to other switches downstream. All the switches (except for the hidden, because I'm not sure) are Netgear ProSafe (5-, 8- and 16-port) gigabit switches (unmanaged).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm trying to accomplish are two things:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, if someone is streaming video or up/down-loading a large file through the Internet, this bogs down the entire network, so I'd like to set it up so this doesn't affect others on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, if someone transfers a large file to/from a file server on the LAN (not through the Internet), this also bogs down the network, so I'd also like to set it up so this doesn't affect others on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common use case is like this: I have one user uploading files to a file share service on the web (via HTTP/HTTPS) and another user accessing an Apache web server on the subnet (on &lt;code&gt;192.168.10.x&lt;/code&gt;) and the user on the subnet accessing the web server sees really slow responses for the web app (to the extent that sometimes it times out). When the file is done, accessing the web server is normal again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One additional side-question that has been bothering me... If I have a layer-2 unmanaged switch and it stands in the way of two workstations or servers that communicate with one another, am I correct in my understanding that the switch will log the MAC addresses and route traffic without contacting the firewall?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should note as well that the speeds I usually see with a speed test are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;60 Mbps down (+/- 5 Mbps)&#xA;12 Mbps up (+/- 3 Mbps)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is a diagram of the network in question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/x8sK2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, the hidden switch doesn't come into play. I'm running tests now and the loop is from a host on the left side of the diagram to the right side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the feedback on this question. I was hoping to get some more concrete feedback, but I suppose since this is a tricky question, more troubleshooting is in need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding gear... I've been considering a managed switch. I see that Cisco has some 10-port gigabit managed switches for under $200, which seems reasonable to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is would it help to replace the 16-port unmanaged switch with a 10-port managed switch? I know that this would allow for better troubleshooting in the future, but would it also help me bottleneck issues?&lt;/p&gt;&#xA;" OwnerUserId="5292" LastEditorUserId="5292" LastEditDate="2015-01-22T00:18:13.467" LastActivityDate="2015-11-04T18:05:11.393" Title="Limit Internal LAN Traffic and Internet Traffic - Managed Switch?" Tags="|switch|bandwidth|pfsense-2|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="16149" PostTypeId="2" ParentId="16135" CreationDate="2015-01-15T02:19:04.727" Score="3" Body="&lt;p&gt;Further to RobinG's answer - the single control plane in virtual chassis (and other stacking technologies) allows you to do thinks like attach an aggregated ethernet link between the virtual chassis and a downstream switch, and distribute the member links across both chassis nodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had two stand-alone switches uplinked to a downstream switch, this would not work, and you'd have to resort to active/standy links using Spanning-Tree or similar (or MC-LAG if your switch supports it)&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-01-15T02:19:04.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16151" PostTypeId="1" CreationDate="2015-01-15T03:39:37.190" Score="3" ViewCount="445" Body="&lt;p&gt;hey guys was wondering if someone can potentially explain this to me&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but lets say switch-A just learned a Ethernet address on port 4 (00:0f:4b:02:63:ae) based on the forwarding table&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now a station on port 6 with a Ethernet address of lets say (00:aa:bb:cc:dd:ee) sends to 00:0f:4b:02:63:ae, that is on port 4, what will that switch do with the frame and forwarding table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;does it just update the forwarding table? or does it perform some sort of algorithm and learn its new neighbors?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and how does it work exactly?&lt;/p&gt;&#xA;" OwnerUserId="13395" LastEditorUserId="619" LastEditDate="2015-01-16T04:32:26.997" LastActivityDate="2015-01-16T04:32:26.997" Title="question about switches and frame and forwarding table" Tags="|switch|ethernet|switching|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16152" PostTypeId="2" ParentId="16151" CreationDate="2015-01-15T03:52:38.220" Score="3" Body="&lt;ul&gt;&#xA;&lt;li&gt;the SRC MAC (00:aa:bb:cc:dd:ee) is checked in the forwarding table&#xA;&lt;ul&gt;&#xA;&lt;li&gt;add if not in the table&lt;/li&gt;&#xA;&lt;li&gt;update (move) if it was on a different port&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;the DST MAC (00:0f:4b:02:63:ae) is checked in the forwarding table&#xA;&lt;ul&gt;&#xA;&lt;li&gt;not found will &lt;em&gt;unicast flood&lt;/em&gt; to all other ports&lt;/li&gt;&#xA;&lt;li&gt;otherwise forward on that port&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In other words, the forwarding table is populated on receive with the source within the frame. If the destination isn't in the table, it'll go &quot;everywhere&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note: some switches can have flooding disabled. In such a case, unknown destinations are dropped -- or sent to the switch CPU to deal with.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-01-15T03:57:54.363" LastActivityDate="2015-01-15T03:57:54.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16153" PostTypeId="1" CreationDate="2015-01-15T04:13:16.140" Score="3" ViewCount="533" Body="&lt;p&gt;[R1]---[FRSW]---[R2] - is the topology.  Everything is L2, there are no PVC's, all physical interfaces.  At startup everything is running with HDLC.  Enable CDP - we get CDP neighbors across the board.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next steps - enabled FR switching on FRSW, made its interfaces FR encapsulation, switched interface type to DCE, the branch routers simply changed encapsulation to FR (so they're FR DTE's).  Then manually enabled CDP on each FR interface.  No CDP neighbors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why?  CDP is a L2 technology.  I show up/up for all interfaces.  Thanks in advance !&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2015-01-15T06:28:14.180" Title="CDP over Frame-Relay" Tags="|cisco|frame-relay|cdp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16154" PostTypeId="2" ParentId="16153" CreationDate="2015-01-15T06:28:14.180" Score="4" Body="&lt;p&gt;Via (&lt;em&gt;one of many&lt;/em&gt;) very old discussions on the Cisco Support Forums:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;CDP will transit through the Frame Relay PVC carried by the FR switch. By default it's disabled on FR interfaces, but you can enable it. Then the end point routers will see one another, but you won't see the intermediate frame switch(es). &lt;a href=&quot;https://supportforums.cisco.com/discussion/10095386/question-cdp-over-frame-relay&quot; rel=&quot;nofollow&quot;&gt;[link]&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, CDP is layer-2. However, the frame switch is a &lt;em&gt;frame switch&lt;/em&gt;. CDP isn't frame-relay, so it will ignore it. Once a PVC is created, CDP will flow through it, but not before. As there's no VCs, R1 and R2 aren't connected to each other.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-15T06:28:14.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16155" PostTypeId="2" ParentId="16135" CreationDate="2015-01-15T06:50:38.420" Score="4" Body="&lt;p&gt;Some reasons I haven't seen mentioned yet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;ease of cabling&lt;/strong&gt;: instead of having hundreds of cables which need to go to one specific switch in one rack, you can use a chassis consisting of a number of switches, which gives you (if you have enough rack space) more room to do decent cable management&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;pay as you grow&lt;/strong&gt;: you may not need hundreds of ports directly, but you may need them in a year time. Buying more small switches which become part of a virtual chassis when you need them enables you to spread costs in time&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-01-15T06:50:38.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16159" PostTypeId="1" CreationDate="2015-01-15T14:26:14.903" Score="0" ViewCount="248" Body="&lt;p&gt;Hey guys well i kind of understand what switches do with the forwarding tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;example: Switch-A has just learned a Ethernet address of 00:0f:4b:02:63:ae is on port 4 based on forwarding table. Now, a station on port 6 with an ethernet address of lets say 00:aa:bb:cc:dd:ee sends to 00:0f:4b:02:63:ae&lt;/p&gt;&#xA;&#xA;&lt;p&gt;answer:&#xA;I already know, the SRC MAC (00:aa:bb:cc:dd:ee) is checked in the forwarding table&#xA;add if not in the table, update (move) if it was on a different port&#xA;the DST MAC (00:0f:4b:02:63:ae) is checked in the forwarding table; not found will unicast flood to all other ports&#xA;otherwise forward on that port&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but now lets say same switch-A now receives a frame on port5 with an ethernet address of of 00:41:51:61:71:81 and a destination Ethernet address of 00:a2:b2:11:22:33.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now how will this switch update the forwarding table and what exactly would it do with this &quot;frame it is receiving on port 5&quot; will the switch do the same thing, but how ill it handle the destination&lt;/p&gt;&#xA;" OwnerUserId="13395" LastEditorUserId="619" LastEditDate="2015-01-16T04:31:52.200" LastActivityDate="2015-01-16T04:31:52.200" Title="question about how switches learn Ethernet addresses from other ports and forwarding tables" Tags="|switch|mac-address|" AnswerCount="1" CommentCount="4" ClosedDate="2015-01-16T11:04:40.870" ContentLicense="CC BY-SA 3.0" />
  <row Id="16160" PostTypeId="1" AcceptedAnswerId="16161" CreationDate="2015-01-15T14:34:40.920" Score="1" ViewCount="1551" Body="&lt;p&gt;What is the difference between throttling network and network tuning?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doesn't both means to send with the maximum possible bandwidth?&lt;/p&gt;&#xA;" OwnerUserId="13402" LastActivityDate="2015-01-16T03:24:33.297" Title="What is the difference between throttling network and network tuning?" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16161" PostTypeId="2" ParentId="16160" CreationDate="2015-01-15T15:16:51.037" Score="5" Body="&lt;p&gt;Check out this article on Policing traffic versus Shaping traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XWxH3.gif&quot; alt=&quot;Cisco: Policing vs. Shaping&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Policing (aka &lt;em&gt;throttling&lt;/em&gt;) is done by dropping traffic when it exceeds the configured rate. Network Tuning (aka &lt;em&gt;shaping&lt;/em&gt;, QoS, etc.) implements queues to hold traffic that exceeds configured rates. (this can include prioritization of different types/classes of traffic. eg. VoIP getting high priority than web browsing.)&lt;/p&gt;&#xA;" OwnerUserId="2477" LastEditorUserId="619" LastEditDate="2015-01-16T03:24:33.297" LastActivityDate="2015-01-16T03:24:33.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16162" PostTypeId="2" ParentId="16117" CreationDate="2015-01-15T15:39:56.637" Score="1" Body="&lt;p&gt;To expand on t3mp's answer, the standard defines loss characteristics that the cabling need to meet and not the design of the cable itself.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cabling isn't actually Cat 6 or Cat 5/5e until it's installed and tested.  Until then, it's all just unshielded twisted pair (UTP) with TIA/EIA-568 modular connectors.  If the cabling is certified to meet Cat 6, it also meets Cat 5/5e.&lt;/p&gt;&#xA;" OwnerUserId="5464" LastActivityDate="2015-01-15T15:39:56.637" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16163" PostTypeId="2" ParentId="16159" CreationDate="2015-01-15T15:46:15.497" Score="0" Body="&lt;p&gt;It will search its table for 00:a2:b2:11:22:33.  If the table hasn't been populated with that address because a frame with that address as a source hasn't been seen, the frame will be flooded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches uses source addresses to build the forwarding table, but searches for destination addresses when it needs to forward a frame.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switch is making a &lt;em&gt;decision&lt;/em&gt; based upon the source, then you're talking about filtering instead of forwarding and the decision is typically whether to continue forwarding or to drop (e.g. port security).&lt;/p&gt;&#xA;" OwnerUserId="5464" LastActivityDate="2015-01-15T15:46:15.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16164" PostTypeId="1" AcceptedAnswerId="16165" CreationDate="2015-01-15T16:28:54.377" Score="4" ViewCount="3953" Body="&lt;p&gt;I have two switches in a stack. One is master and the other is a slave. If I turn off the slave, the master will work with no problem. My questions: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if I turn off the master, will the slave still work, will the stack switch work normally, or I will have a downtime of the entire stack?&lt;/li&gt;&#xA;&lt;li&gt;once the master switch that we turned off previously is turned on again, will be the master again?! I think it should be re-elected as master as the priority number of this switch is higher then the priority number of the slave. &lt;/li&gt;&#xA;&lt;li&gt;Will the vlan database should not be affected by loosing the master?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2665" LastEditorUserId="775" LastEditDate="2015-01-16T12:15:02.943" LastActivityDate="2015-01-20T19:41:46.147" Title="Master stack switch turn off" Tags="|cisco|redundancy|stacking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16165" PostTypeId="2" ParentId="16164" CreationDate="2015-01-15T16:35:48.023" Score="4" Body="&lt;p&gt;This is true of Cisco Catalyst and as far as I know all Cisco switches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you already have made both switches stack members, the slave switch should be elected to master if the current master becomes unavailable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the original master will be reelected upon a power cycle of the stack, or just the slave I suppose, assuming the original master is again online/available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From cisco.com:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When is the stack master elected?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-When the whole switch stack is reset&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-When the stack master is reset or powered off&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: If you reset the stack master, it would reset the whole stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-When the stack master is removed from the stack&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-When the stack master switch has failed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within these events, the current stack master has a greater chance to get re-elected.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2015-01-16T20:56:04.307" LastActivityDate="2015-01-16T20:56:04.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16166" PostTypeId="1" AcceptedAnswerId="16174" CreationDate="2015-01-15T17:00:15.040" Score="1" ViewCount="2969" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/D0VWv.png&quot; alt=&quot;PoE scheme&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is PoE really that simple as the diagram above describes? I've heard there are some power negotiations, i.e. at first the voltage given isn't 48V but much lower value and then increases gradually to see if everything is OK and whether the device on the other end is adapted to use PoE. Although that seems reasonable, how &lt;em&gt;exactly&lt;/em&gt; it works?&lt;/p&gt;&#xA;" OwnerUserId="13403" LastActivityDate="2015-01-16T03:13:32.067" Title="What do Power over Ethernet negotiation mean?" Tags="|power-over-ethernet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16170" PostTypeId="1" AcceptedAnswerId="16173" CreationDate="2015-01-15T21:51:52.417" Score="8" ViewCount="20777" Body="&lt;p&gt;I got an assignment to implement unicast, multicast and broadcast in UDP or TCP in java, so I searched for it and I only got UDP implementation of multicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is following:&lt;br&gt;&#xA;Is there multicast possible in TCP?&lt;/p&gt;&#xA;" OwnerUserId="13406" LastEditorUserId="51251" LastEditDate="2019-03-05T14:46:46.860" LastActivityDate="2020-06-16T11:57:57.140" Title="Is multicast possible in tcp?" Tags="|tcp|multicast|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16171" PostTypeId="1" AcceptedAnswerId="16172" CreationDate="2015-01-15T22:19:47.137" Score="1" ViewCount="1472" Body="&lt;p&gt;So I'm looking at the &quot;show perfmon&quot; output from my ASA (5550, 9.0 software), and am confused by the &quot;VALID CONNS RATE in TCP INTERCEPT&quot; output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;primary-int# sh perfmon    &#xA;&#xA;PERFMON STATS:                     Current      Average&#xA;Xlates                              111/s          0/s&#xA;Connections                         155/s          0/s&#xA;TCP Conns                           106/s          0/s&#xA;UDP Conns                            45/s          0/s&#xA;URL Access                           66/s          0/s&#xA;URL Server Req                       41/s          0/s&#xA;TCP Fixup                          3761/s          0/s&#xA;TCP Intercept Established Conns       0/s          0/s&#xA;TCP Intercept Attempts                0/s          0/s&#xA;TCP Embryonic Conns Timeout           3/s          0/s&#xA;HTTP Fixup                         3761/s          0/s&#xA;FTP Fixup                             9/s          0/s&#xA;AAA Authen                            0/s          0/s&#xA;AAA Author                            0/s          0/s&#xA;AAA Account                           0/s          0/s&#xA;&#xA;VALID CONNS RATE in TCP INTERCEPT:    Current      Average&#xA;                                       N/A         5027.59%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't really figure out what this means, nor why it's such a ridiculously high number... though I suspect the latter is due to this being a failover ASA in an HA pair, which has been powered on and in standby state for several months. Of course, I didn't get a chance to look at these numbers on the primary. :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, 2 part question:&#xA;&lt;strong&gt;What does &quot;VALID CONNS RATE in TCP INTERCEPT&quot; mean?&lt;/strong&gt; and &#xA;&lt;strong&gt;why is the average so extraordinarily high?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2015-01-16T02:52:45.097" Title="ASA 5550 show perfmon &quot;VALID CONNS RATE in TCP INTERCEPT&quot; meaning" Tags="|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16172" PostTypeId="2" ParentId="16171" CreationDate="2015-01-16T02:52:45.097" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What does &quot;VALID CONNS RATE in TCP INTERCEPT&quot; mean?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;TCP Intercept&lt;/em&gt; is a firewall function (ASA or IOS) that acts as an inline-proxy for all TCP connections, vs. mere inspection and passing through (with possible NAT rewrite.) This is a means of syn flood protection. &quot;&lt;em&gt;Valid conns rate&lt;/em&gt;&quot; is the rate of valid (fully completed tcp three-way handshake) connections forming when this feature is enabled.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;why is the average so extraordinarily high?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Bug? I'm assuming you do not have the tcp-intercept feature enabled, so it's using nonsense numbers and/or attempting to divide by zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[See Also: &lt;a href=&quot;https://supportforums.cisco.com/document/12021641/tcp-intercept-feature-asa-device&quot; rel=&quot;nofollow&quot;&gt;TCP intercept Feature on the ASA device&lt;/a&gt;]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;(PS: I'm not a fan of Cisco's blog documentation.)&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-16T02:52:45.097" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16173" PostTypeId="2" ParentId="16170" CreationDate="2015-01-16T03:02:58.780" Score="17" Body="&lt;p&gt;In a word: &lt;strong&gt;NO&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast is a one-to-many system. TCP requires a one-to-one handshake to synchronize counters (sequence numbers) to ensure reliable transport. This cannot be done with many receivers as the sender has no way to know how many receivers there are and thus how many ACKs to expect, or what to do if one of the receivers disappears mid-transfer, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of multicast as a speaker in a lecture hall. They don't know how many people are supposed to be there, nor care if some are late or leave. Nor do they know (or care) if everyone in the hall is hearing everything they say.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-16T03:02:58.780" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16174" PostTypeId="2" ParentId="16166" CreationDate="2015-01-16T03:13:32.067" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is PoE really that simple as the diagram above describes&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Electrically, yes, it's just that simple. (in theory) The AC component (the ethernet signals) will cross the transformer without issue. The DC component won't affect anything, and can be collected from the taps, minus any resistance of the coil which is normally very low.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Ron's link covers the finer details of signaling, etc. &lt;a href=&quot;http://en.wikipedia.org/wiki/Power_over_Ethernet&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt; is a good reference as well.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-16T03:13:32.067" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16175" PostTypeId="1" AcceptedAnswerId="16176" CreationDate="2015-01-16T03:59:30.663" Score="1" ViewCount="2705" Body="&lt;p&gt;I'm new to networking and was wondering if switches modify frames as they pass through? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've heard that routers modify the contents of their packets as they pass through (which I believe is true), but I can't find a concrete answer about what modifications switches make to the frames that pass through it, if any. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help would be appreciated! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="13277" LastActivityDate="2015-01-16T04:23:15.027" Title="Do switches modify frames as they pass through?" Tags="|router|switch|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16176" PostTypeId="2" ParentId="16175" CreationDate="2015-01-16T04:23:15.027" Score="3" Body="&lt;p&gt;In general, &lt;em&gt;layer-2&lt;/em&gt; switching does not modify the frames.&lt;sup&gt;[1]&lt;/sup&gt; A VLAN tag may be added or removed as necessary for frames between tagged and untagged ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;em&gt;layer-3&lt;/em&gt; switch is both a router (l3) and switch (l2). When it switches traffic, it's just like any other layer-2 switch. When it routes traffic between segments, then it's routing and will modify packets like any router (namely decrement ttl.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;[1] Not to confuse matters, but &quot;carrier ethernet&quot; hardware can do VLAN translation, which does, technically, modify frames.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-16T04:23:15.027" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16184" PostTypeId="1" CreationDate="2015-01-16T17:45:27.753" Score="3" ViewCount="9700" Body="&lt;p&gt;How do I check the ssd status on a Cisco ASA firewall?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show configuration | inc boot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This shows me disk0, which I am assuming is the SSD, but is there a way I can get more information about the SSD?&lt;/p&gt;&#xA;" OwnerUserId="13422" LastActivityDate="2015-10-09T03:19:36.963" Title="SSD status on Cisco ASA" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16186" PostTypeId="2" ParentId="16184" CreationDate="2015-01-16T19:22:22.273" Score="3" Body="&lt;p&gt;Use the &lt;code&gt;show disk0: all&lt;/code&gt; command. It will give you geometry, directory along with free space information and controller type/vendor. What else do you need?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;ASA 5505&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sslvpn/example.com# show disk0: all&#xA;--#--  --length--  -----date/time------  path&#xA;...&#xA;129073152 bytes total (82755584 bytes free)&#xA;&#xA;******** Flash Card Geometry/Format Info ********&#xA;&#xA;COMPACT FLASH CARD GEOMETRY&#xA;   Number of Heads:           16&#xA;   Number of Cylinders       498&#xA;   Sectors per Cylinder       32&#xA;   Sector Size               512&#xA;   Total Sectors          254976&#xA;&#xA;Flash Model: SMC128AFB6E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="286" LastEditorUserId="619" LastEditDate="2015-01-16T23:21:33.693" LastActivityDate="2015-01-16T23:21:33.693" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16188" PostTypeId="1" AcceptedAnswerId="16274" CreationDate="2015-01-16T19:44:28.033" Score="3" ViewCount="5944" Body="&lt;p&gt;I have a problem with my scenario in limiting bandwidth of ubuntu PC in GNS3 with class-map and policy-map.&#xA;this is my topology in GNS3:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/xtL3v.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The R1 is a cisco 3725 router with c3725-adventerprisek9-mz.124-25d.bin image, and this is my configuration:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;access-lists&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended UBUNTU_DW&#xA;  permit ip any host 10.0.0.51&#xA;ip access-list extended UNUNTU_UP&#xA;  permit ip host 10.0.0.51 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;class and policy maps&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all UBUNTU_DW&#xA;  match access-group name UBUNTU_DW&#xA;class-map match-all UBUNTU_UP&#xA;  match access-group name UBUNTU_UP&#xA;&#xA;policy-map UP&#xA;  class UBUNTU_UP&#xA;    police cir 32000 bc 4000 be 4000&#xA;      conform-action transmit &#xA;      exceed-action drop &#xA;      violate-action drop &#xA;policy-map DW&#xA;  class UBUNTU_DW&#xA;    police cir 32000 bc 4000 be 4000&#xA;      conform-action transmit &#xA;      exceed-action drop &#xA;      violate-action drop &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;interface FastEthernet0/1&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA;  ip address 192.168.10.254 255.255.255.0&#xA;  ip nat outside&#xA;  ip virtual-reassembly&#xA;  duplex auto&#xA;  speed auto&#xA;  service-policy input DW&#xA;  service-policy output UP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is the 32kbps limitaion for ubuntu does not work.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh policy-map interface fastEthernet 0/1&#xA; FastEthernet0/1&#xA;&#xA;  Service-policy input: DW&#xA;&#xA;    Class-map: UBUNTU_DW (match-all)&#xA;      0 packets, 0 bytes&#xA;      5 minute offered rate 0 bps, drop rate 0 bps&#xA;      Match: access-group name UBUNTU_DW&#xA;      police:&#xA;          cir 32000 bps, bc 4000 bytes, be 4000 bytes&#xA;        conformed 0 packets, 0 bytes; actions:&#xA;          transmit&#xA;        exceeded 0 packets, 0 bytes; actions:&#xA;          drop&#xA;        violated 0 packets, 0 bytes; actions:&#xA;          drop&#xA;        conformed 0 bps, exceed 0 bps, violate 0 bps&#xA;&#xA;    Class-map: class-default (match-any)&#xA;      905 packets, 812409 bytes&#xA;      5 minute offered rate 27000 bps, drop rate 0 bps&#xA;      Match: any&#xA;&#xA;  Service-policy output: UP&#xA;&#xA;    Class-map: UBUNTU_UP (match-all)&#xA;      0 packets, 0 bytes&#xA;      5 minute offered rate 0 bps, drop rate 0 bps&#xA;      Match: access-group name UBUNTU_UP&#xA;      police:&#xA;          cir 32000 bps, bc 4000 bytes, be 4000 bytes&#xA;        conformed 0 packets, 0 bytes; actions:&#xA;          transmit&#xA;        exceeded 0 packets, 0 bytes; actions:&#xA;          drop&#xA;        violated 0 packets, 0 bytes; actions:&#xA;          drop&#xA;        conformed 0 bps, exceed 0 bps, violate 0 bps&#xA;&#xA;    Class-map: class-default (match-any)&#xA;      979 packets, 154180 bytes&#xA;      5 minute offered rate 7000 bps, drop rate 0 bps&#xA;      Match: any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any wrong configuration? How can I apply this policy?&lt;/p&gt;&#xA;" OwnerUserId="8467" LastEditorUserId="619" LastEditDate="2015-01-16T23:06:35.280" LastActivityDate="2015-01-21T19:49:38.783" Title="Limit bandwidth in cisco router with policy-map doesn't work" Tags="|router|cisco-ios|qos|bandwidth|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16189" PostTypeId="2" ParentId="10840" CreationDate="2015-01-16T20:58:21.443" Score="3" Body="&lt;p&gt;This is because the tone is sent to your endpoint out of band, seperate to the media in a SIP INFO(SIP 2.0) or UII (H.245) message then generated locally by your device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SIP/H.323 is the protocol used to set up your VoIP call and is usually carried over a TCP socket that is opened up by your router in a similar way an HTTP request would be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SIP INFO example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INFO sip:012345678901@example.com SIP/2.0&#xA;Via: SIP/2.0/UDP alice.uk.example.com:5060&#xA;From: &amp;lt;sip:109876543210@alice.uk.example.com&amp;gt;;tag=d3je23d&#xA;To: &amp;lt;sip:012345678901@example.com&amp;gt;;tag=8932&#xA;Call-ID: 312352@myphone&#xA;CSeq: 5 INFO&#xA;Content-Length: 24&#xA;Content-Type: application/dtmf-relay&#xA;&#xA;Signal=5&#xA;Duration=160&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The voice traffic will be carried over a UDP stream. To allow the media inbound to your device, the router needs to inspect the SIP/H.323 protocol to identify the UDP port that will be used for media then open up that port up and NAT (Network Address Translation) it to your endpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some providers will run symmetric-latching, this essentially waits for the media you send then streams the return speech back to the same source port and IP on your device as this typically will be opened up and NAT'd back to your endpoint making the call.&lt;/p&gt;&#xA;" OwnerUserId="13427" LastActivityDate="2015-01-16T20:58:21.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16190" PostTypeId="1" AcceptedAnswerId="16304" CreationDate="2015-01-16T21:20:42.140" Score="7" ViewCount="2269" Body="&lt;p&gt;This is really a &lt;strong&gt;strange&lt;/strong&gt; problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to install a Juniper SRX 220H as the gateway to replace my old Cisco router in my testing network environment. The simplified topology is listed below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ISP ----- ONT ----- SRX ----- Other devices (Routers, switches, client computers...)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The link from ISP to SRX is a 802.1Q trunk link contains two VLANs (VLAN 35 for Internet access, IP address assigned by DHCP, lease for 20min. VLAN 34 for IPTV which is not used here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX can obtain IP address from ISP at first. After 12 to 17 minutes (after first DHCP lease renew and before second renew), SRX lost Internet access (cannot ping the gateway). There is nothing special or even a notice in the system log or system status. &quot;show interface&quot; said everything works fine. But no traffic at all in ge-0/0/0. If I unplug the cable or reboot SRX, it works for another 12 to 17 minutes and then all traffic are stopped again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before I install this SRX, the old Cisco router with same configuration works without any problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any clues?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Partial configuration of SRX is listed below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members vlan-internet;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    vlan {&#xA;        mac xx:xx:xx:xx:xx:xx;&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 192.168.99.254/24;&#xA;            }&#xA;        }&#xA;        unit 35 {&#xA;            family inet {&#xA;                dhcp;&#xA;            }&#xA;        }&#xA;    }&#xA;    }                                   &#xA;&#xA;vlans {&#xA;    vlan-internet {&#xA;        vlan-id 35;&#xA;        l3-interface vlan.35;&#xA;    }&#xA;    vlan-trust {&#xA;        vlan-id 3;&#xA;        l3-interface vlan.0;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Corresponding Cisco configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description WAN&#xA; mac-address xxxx.xxxx.xxxx&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; media-type rj45&#xA; no negotiation auto&#xA;!&#xA;interface GigabitEthernet0/0.35&#xA; description FibreOP-Internet&#xA; encapsulation dot1Q 35&#xA; ip address dhcp&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I replaced the cable which connects ISP and SRX ge-0/0/0. Nothing good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured a spare Cisco switch to simulate my ISP environment. VLAN trunk and same DHCP lease term are set. Then I connect ge-0/0/0 of SRX to that switch. The configuration of SRX is kept. In this experiment, SRX behavior normal. This makes me really confused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT3:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output requested by @ryanklein&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@Firewall&amp;gt; show dhcp client statistics                   &#xA;warning: dhcp-service subsystem not running - not needed by configuration.&#xA;&#xA;root@Firewall&amp;gt; show dhcp client binding &#xA;warning: dhcp-service subsystem not running - not needed by configuration.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT4:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output requested by @ryanklein&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@Firewall&amp;gt; show system services dhcp statistics &#xA;Packets dropped:&#xA;    Total                      0&#xA;&#xA;Messages received:&#xA;    BOOTREQUEST                0&#xA;    DHCPDECLINE                0&#xA;    DHCPDISCOVER               0&#xA;    DHCPINFORM                 0&#xA;    DHCPRELEASE                0&#xA;    DHCPREQUEST                0&#xA;&#xA;Messages sent:&#xA;    BOOTREPLY                  0&#xA;    DHCPOFFER                  0&#xA;    DHCPACK                    0&#xA;    DHCPNAK                    0&#xA;&#xA;root@Firewall&amp;gt; show system services dhcp client &#xA;&#xA; Logical Interface name         vlan.35&#xA;        Hardware address        xx:xx:xx:xx:xx:xx&#xA;        Client status           bound&#xA;        Address obtained        142.xxx.xxx.xxx&#xA;        Update server           disabled&#xA;        Lease obtained at       2015-01-18 03:35:47 NST&#xA;        Lease expires at        2015-01-18 03:55:47 NST&#xA;&#xA;DHCP options:&#xA;    Code: 1, Type: ip-address, Value: 255.255.252.0&#xA;    Name: server-identifier, Value: 142.yyy.yyy.yyy&#xA;    Name: router, Value: [ 142.xxx.xxx.1 ]&#xA;    Name: name-server, Value: [ 47.55.55.55, 142.166.166.166 ]&#xA;&#xA;root@Firewall&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT5:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I captured the data between SRX and ISP and found something may be useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The topology diagram is updated (added missing ONT device between SRX and ISP).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;When Internet is gone, layer 2 communications between ONT and SRX is still active. It seems that the ONT keep sending ARP query requests to the IP addresses my ISP assigned to SRX. After the gone of Internet, I can still see those ARP requests and responses. I think this behavior indicates that the ONT is not the root of this problem.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When Internet is gone, DHCP request packets will get no responses just like other traffic. I tried to renew my IP address on SRX after Internet is gone but failed. The captured data shows that no responses from remote side.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DHCP renew is succeed when Internet is normal. When I issued &quot;request system service dhcp client renew vlan.35&quot;, I can see DHCP request and corresponding DHCP ACK.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;(INCORRECT. See next item)When Internet is gone, release current DHCP lease and ask for a new one will restore the connectivity. I tried to release the current DHCP lease and renew it, then SRX got a new IP address and the Internet is back. Captured data shows that although a single DHCP request packet gets no response (see above), a DHCP release packet results a &lt;strong&gt;DHCP NAK&lt;/strong&gt; response. After that, a DHCP discover is issued and get correct DHCP offer. Then the Internet is back. However, when I tried to repeat this result, nothing good: neither DHCP release nor DHCP discover gets responses. I issued release and renew command just after a renew command. I'm not sure the unresponding behavior is caused by sending those packets too quick or not.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;After Internet is gone, issue a DHCP discover request and processed as first time request will restore the Internet connection. Captured data show that when Internet is gone, issuing a DHCP request packet will results a DHCP NAK response. Combine with the result from previous item, issuing both DHCP request and DHCP release will result in DHCP NAK. However, process as if it is the first time to request a IP address from DHCP server (send DHCP discover then DHCP request) will get positive result and restore the Internet access. UPDATED: It seems the NAK is not always sent... sometimes DHCP request/release returned with DHCP NAK, sometime just silence...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13428" LastEditorUserId="13428" LastEditDate="2015-01-18T08:46:08.613" LastActivityDate="2015-01-24T03:36:50.513" Title="Juniper SRX - No traffic after 17 minutes" Tags="|cisco|juniper-junos|srx|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16191" PostTypeId="1" AcceptedAnswerId="16210" CreationDate="2015-01-16T22:02:14.833" Score="7" ViewCount="6623" Body="&lt;p&gt;I'm studying the difference between the protocols IP and TCP. &#xA;IP is said to provide an unreliable datagram service whereas TCP provides a reliable bytestream service. Further, TCP works on top of IP.&#xA;So my question is, can the protocol IP be used solely to send packets (without passing through TCP protocols) ? &lt;/p&gt;&#xA;" OwnerUserId="10654" LastEditorUserId="775" LastEditDate="2018-07-23T22:31:48.220" LastActivityDate="2021-08-24T17:29:54.310" Title="Raw IP communication?" Tags="|ipv4|ip|tcp|protocol-theory|transport-protocol|" AnswerCount="6" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16196" PostTypeId="2" ParentId="16188" CreationDate="2015-01-17T03:51:01.597" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;ip access-list extended UNUNTU_UP&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Looks like you have a typo. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know what the rest of your NAT configuration looks like, but if 10.0.0.51 is only local your policies may not be matching because the ACLs see the global address.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/6209-5.html&quot; rel=&quot;nofollow&quot;&gt;NAT Order of Operation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-packet-marking/22141-qos-orderofop-3.html&quot; rel=&quot;nofollow&quot;&gt;QoS Order of Operation&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'd want to test this to be sure, but I believe the QoS operations are all contained within the ACL checking steps of the NAT order.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, then UP is evaluated after translation and DW is evaluated before translation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would leave you the option of matching on the global address and making sure it's static, or apply the policies on the F0/0 (a safer option).  In the wild, you are more likely to see separate routers doing NAT and WAN hand-off.&lt;/p&gt;&#xA;" OwnerUserId="5464" LastEditorUserId="5464" LastEditDate="2015-01-17T17:50:19.347" LastActivityDate="2015-01-17T17:50:19.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16197" PostTypeId="1" AcceptedAnswerId="16200" CreationDate="2015-01-17T03:53:20.517" Score="3" ViewCount="4352" Body="&lt;p&gt;What is the maximum segment length of fiber-optic cable for both single-node and multi-node?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't seem to find a straight answer for this. Does anyone know the answer to this or know of somewhere I can reference?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for taking a look!&lt;/p&gt;&#xA;" OwnerUserId="13435" LastActivityDate="2015-12-03T19:53:58.643" Title="What is the maximum segment length of fiber-optic cable for both single-node and multi-node?" Tags="|internet|fiber|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16198" PostTypeId="2" ParentId="16191" CreationDate="2015-01-17T04:01:06.983" Score="4" Body="&lt;p&gt;TCP doesn't actually send packets.  It uses segments, which are sequenced messages sent between hosts by IP in packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP is how the data (TCP, UDP, or other) makes it from one host to another ... it is the forwarding.  TCP specifies how those hosts implement a reliable connection over a packet-based network layer with no delivery guarantee, with sequencing, windowing, and retransmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may sound weird but once you get used to the idea that &quot;TCP packet&quot; is shorthand for &quot;TCP segments carried within IP packets&quot; and &quot;UDP packets&quot; is shorthand for &quot;UDP datagrams within IP packets&quot;, it becomes less confusing.&lt;/p&gt;&#xA;" OwnerUserId="5464" LastActivityDate="2015-01-17T04:01:06.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16200" PostTypeId="2" ParentId="16197" CreationDate="2015-01-17T04:15:01.860" Score="2" Body="&lt;p&gt;It really depends on what kind of distance and bandwidth are part of your requirements.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;LR / ER / XR optics are used with single mode.&#xA;SR optics are used with multimode or OM3 (they're pretty much the same thing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a good resource for how far the laser can be pushed over each fiber with each optic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/transceiver-modules/data_sheet_c78-455693.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/transceiver-modules/data_sheet_c78-455693.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-01-17T04:15:01.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16201" PostTypeId="2" ParentId="16170" CreationDate="2015-01-17T04:18:51.950" Score="6" Body="&lt;p&gt;No.  Even though TCP is composed of two separate sender/receiver relationships, the communication needs to be one-to-one and bidirectional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there are protocols which implement &lt;a href=&quot;http://en.wikipedia.org/wiki/Reliable_multicast&quot; rel=&quot;noreferrer&quot;&gt;reliable transport over multicast&lt;/a&gt;, but they often use an inverse tree (publisher becomes consumer, and vice-versa) for negative acknowledgements. They are very different from TCP.&lt;/p&gt;&#xA;" OwnerUserId="5464" LastActivityDate="2015-01-17T04:18:51.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16203" PostTypeId="1" CreationDate="2015-01-17T04:44:42.567" Score="3" ViewCount="3145" Body="&lt;p&gt;I want to connect FEX directly to Nexus 7k as dual home.. but recommendation says not to connect FEX with 7k as Dual home.. I want to know the reason.. Please help.&lt;/p&gt;&#xA;" OwnerUserId="13437" LastActivityDate="2015-01-18T22:00:12.303" Title="why we cannot connect to FEX dual home with Nexus 7k?" Tags="|cisco-nexus-7k|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16204" PostTypeId="1" CreationDate="2015-01-17T05:50:50.610" Score="10" ViewCount="1124" Body="&lt;p&gt;I was hoping that someone might be able to shed some light on a problem I'm having. I have a lab that I created that is a multi-region Hub and Spoke network. There are 5 Regional Hubs along with one central hub. Each Region has 4 spokes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem comes when I try to use Phase 3 for DMVPN. I think I know what is happening, I'm just not quite sure how to go about fixing it. Basically, I will try to ping from a computer off of the spoke to the Central Hub. The first couple of pings go through, and then no further pings will go through. When the first pings are sent through, they should be traversing the entire network (Host-Spoke-Regional Hub-Central Hub). As NHRP Mappings are established, it attempts to go point-to-point for that connection and it breaks the network since the Tunnels are on different subnets. Here is the relevant network information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All Routers are running EIGRP (AS 1). All neighborships are created properly and the routing table is populated as I would expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Regional to Central Hub network is Tunnel 0. 172.16.0.0/24 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Regional to Spoke network is Tunnel 1. 172.16.1.0/24 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All outside interfaces are on the 192.168.1.0/24 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside interfaces follow the following scheme: 10.region.spoke.0/24 (Central is 10.0.0.0/24, Regional Hubs are 10.region.0.0/24).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any insight that you can provide is greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="13438" LastActivityDate="2018-12-22T14:02:35.563" Title="Cisco DMVPN Phase 3 Question" Tags="|cisco|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16205" PostTypeId="2" ParentId="16191" CreationDate="2015-01-17T11:07:58.420" Score="4" Body="&lt;p&gt;TCP and IP are at different layers in the OSI model; TCP a layer 4 protocol, the transport layer, and IP is one below from layer 3, a network protocol.&lt;/p&gt;&#xA;&lt;p&gt;Each layer in the model performs a specific function so it might help to have a quick description of each layer:&lt;/p&gt;&#xA;&lt;p&gt;Layer 3 (Network) - Defines functions and procedures for transferring variable length data sequences from one node to another on a network. Basically this layer is just about sending the data given to it from higher layers to the destination, there is no reliability here. Addressing and routing live at this layer. Example protocols: IPv4, IPv6, IPsec, AppleTalk.&lt;/p&gt;&#xA;&lt;p&gt;Layer 4 (Transport) - The OSI defines this layer as protocols that define functions and procedures for transferring variable length data sequences from one node to another on a network while maintaining Quality of Service functions. This layer is all about getting data to the far end as reliably as required, TCP provides delivery assurance and flow control, UDP doesn't for example. Example protocols: TCP, UDP, L2TP.&lt;/p&gt;&#xA;&lt;p&gt;So lets look at an IP packets header (From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791#section-3.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791&lt;/a&gt;):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; 0                   1                   2                   3&#xA; 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|Version|  IHL  |Type of Service|          Total Length         |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|         Identification        |Flags|      Fragment Offset    |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|  Time to Live |    Protocol   |         Header Checksum       |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                       Source Address                          |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                    Destination Address                        |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                    Options                    |    Padding    |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Notice on the third line of the header there is a protocol section, here the packet describes which layer 4 protocol is contained within the packet, some examples possible are (&lt;a href=&quot;http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml#protocol-numbers-1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Full List&lt;/a&gt;):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  Decimal     Protocol Name       &#xA;  -------     ---------------- &#xA;       1       ICMP&#xA;       6       TCP &#xA;      17       UDP&#xA;      88       EIGRP&#xA;      89       OSPFIGP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So to sum up, yes you can send data without using TCP. :)&lt;/p&gt;&#xA;" OwnerUserId="13290" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2015-01-17T11:07:58.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16208" PostTypeId="2" ParentId="16190" CreationDate="2015-01-17T18:39:01.347" Score="0" Body="&lt;p&gt;One thing you might want to confirm is that the SRX is using a proper DHCPREQUEST to renew the address instead of another DHCPDISCOVER.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how to enable the debugging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB26748#DHCP_Client&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB26748#DHCP_Client&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got limited experience with Juniper, but I've seen at least one major OS do this when the system clock was not correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the very least, you want to see what's happening with the renewal.&lt;/p&gt;&#xA;" OwnerUserId="5464" LastActivityDate="2015-01-17T18:39:01.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16210" PostTypeId="2" ParentId="16191" CreationDate="2015-01-18T10:38:04.637" Score="8" Body="&lt;p&gt;I think there is a little bit of confusion when it comes to some networking fundamentals here: first you say that &quot;TCP works on top of IP&quot;, which is correct, and then you ask if it's possible for IP to send packets &quot;without passing through TCP protocols&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since IP works at a lower OSI layer than TCP (IP is a level 3 protocol while TCP is a level 4 protocol), it's TCP data that gets encapsulated by IP, not viceversa. &lt;strong&gt;Every OSI layer (and TCP/IP layer for that matter), provides services to the layers above it and sends data to the layers below it.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yes, IP can send data without using TCP, it's TCP data that cannot avoid going through the IP layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that potentially, another Level 3 protocol could be used, IP just so happens to be the most widely used one.&lt;/p&gt;&#xA;" OwnerUserId="13443" LastEditorUserId="13443" LastEditDate="2015-01-18T12:14:22.187" LastActivityDate="2015-01-18T12:14:22.187" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="16212" PostTypeId="2" ParentId="16191" CreationDate="2015-01-18T13:00:07.510" Score="14" Body="&lt;p&gt;[summarizing the question]&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Can I communicate with raw IP datagrams, without a transport layer?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;&lt;em&gt;Short answer&lt;/em&gt;:&lt;/h3&gt;&#xA;&lt;p&gt;Yes, but:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It's an exceptionally strange way to build an application (you'd have to tell your OS NIC driver to send packets having used [IP protocol numbers] to their proper kernel driver, make your egress data avoid collision with existing IP protocol numbers, and queue all other packets directly to your application buffers).&lt;/li&gt;&#xA;&lt;li&gt;You should not bother entertaining this idea other than the time it takes to read this sentence.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;h3&gt;&lt;em&gt;Longer answer&lt;/em&gt;:&lt;/h3&gt;&#xA;&lt;p&gt;Perhaps you want to know why...&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This answer assumes all applications communicate with IPv4; we will ignore IPv6 (which uses similar dynamics) and ignore raw ethernet protocols.&lt;/li&gt;&#xA;&lt;li&gt;After IP data arrives at the endpoint address, you need to know &lt;em&gt;which application to deliver it to&lt;/em&gt;; that means &lt;strike&gt;most people&lt;/strike&gt; everybody want more than &amp;quot;just an IP address&amp;quot; to identify the application.  Why everybody?  If you only use your IP address to identify the application, you have to filter out a mountain of &amp;quot;normal&amp;quot; application traffic that also happens to use your application id, like DNS, ssh, ping, etc...  Why would you build your application with so much noise in the channel?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Transport_layer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Transport protocols&lt;/a&gt; such as TCP and UDP use port numbers to multiplex applications on a single address; occasionally people use an &lt;a href=&quot;http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;IANA's list of IP Protocols&quot;&gt;IP Protocol number&lt;/a&gt;  (but the IP protocol header is only 8-bits wide).  In all cases though, you must put something in the IP protocol field (even if that's going to be ignored by your host as you proposed).&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Most IP protocols are wasted space in a very small field&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;p&gt;Another interesting thing about that &lt;a href=&quot;http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;IANA's list of IP Protocols&quot;&gt;IP protocol number&lt;/a&gt; list: at least 50% of those protocols with a dedicated 8-bit &lt;a href=&quot;http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;IANA's list of IP Protocols&quot;&gt;IP protocol number&lt;/a&gt; are archaeological relics of the internet (read: wasted protocol numbers).&lt;/p&gt;&#xA;&lt;p&gt;Rhetorical question: When was the last time you heard of someone using &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc741&quot; rel=&quot;nofollow noreferrer&quot;&gt;Network Voice Protocol (IP protocol 11)&lt;/a&gt; or &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc869&quot; rel=&quot;nofollow noreferrer&quot;&gt;Host Monitoring Protocol (IP Protocol 20)&lt;/a&gt;?  Nobody does, they use &lt;a href=&quot;http://en.wikipedia.org/wiki/Session_Initiation_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;SIP&lt;/a&gt; for voice (both TCP and UDP) or ping (ICMP) for host monitoring.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;List of common IP protocols&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;p&gt;Nearly every application I can think of uses one of the following IPv4 protocols (in rough order of frequency people see on the wire):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Transmission_Control_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP&lt;/a&gt; (IP Protocol 6)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/User_Datagram_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;UDP&lt;/a&gt; (IP Protocol 17)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Control_Message_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;ICMP&lt;/a&gt; (IP Protocol 1)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Open_Shortest_Path_First&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSPF&lt;/a&gt; (IP Protocol 89)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Enhanced_Interior_Gateway_Routing_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;EIGRP&lt;/a&gt; (IP Protocol 88)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Generic_Routing_Encapsulation&quot; rel=&quot;nofollow noreferrer&quot;&gt;GRE&lt;/a&gt; (IP Protocol 47)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/IPsec#Encapsulating_Security_Payload&quot; rel=&quot;nofollow noreferrer&quot;&gt;ESP&lt;/a&gt; (IP Protoocl 50)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/IPsec#Authentication_Header&quot; rel=&quot;nofollow noreferrer&quot;&gt;AH&lt;/a&gt; (IP Protocol 51)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Protocol_Independent_Multicast&quot; rel=&quot;nofollow noreferrer&quot;&gt;PIM&lt;/a&gt; (IP Protocol 103)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_Group_Management_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;IGMP&lt;/a&gt; (IP Protocol 2)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_Router_Redundancy_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;VRRP&lt;/a&gt; (IP Protocol 112)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Stream_Control_Transmission_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;SCTP&lt;/a&gt; (IP Protoocl 132)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;That's it... statistically, every other IP protocol ranks in noise... and if it wasn't obvious enough, every one of those protocols performs at least one of the functions of an IP &lt;a href=&quot;http://en.wikipedia.org/wiki/Transport_layer&quot; rel=&quot;nofollow noreferrer&quot;&gt;Transport protocol&lt;/a&gt;.  This simply reinforces the fact that while &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/16191/raw-ip-communication/16212#comment23838_16191&quot;&gt;&amp;quot;you can build your own protocols inside of raw IP payload if you want.  Very few people &lt;em&gt;should&lt;/em&gt; want to&amp;quot;&lt;/a&gt;.  Doing so dedicates your IP address to a single application, and probably is going to &amp;quot;reinvent the wheel&amp;quot; in several ways.&lt;/p&gt;&#xA;&lt;p&gt;Summary: Most people should use TCP (because of its advanced error recovery, data acknowledgment, MSS negotiation, and flow control).  A few should use UDP, or SCTP.  The rest will multiplex their protocol with ethertype or IP protocol.  Nobody should solely identify their app with the host IP address.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2021-08-24T17:29:54.310" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="16215" PostTypeId="2" ParentId="16064" CreationDate="2015-01-18T20:56:01.127" Score="0" Body="&lt;h2&gt;The performance envelope&lt;/h2&gt;&#xA;&lt;p&gt;Yes there is an upper and lower bound given a current RSS. The bandwidth available is determined by something called the modulation coding scheme (MCS). The radio in your endpoint will have an RSSI to MCS mapping that determines the likely successful coding scheme for the current RSSI i.e. the modulation, coding rate (error correction) and spatial streams required to achieve a certain bitrate without constantly dropping out. You see this in action as your connection speed drops when increasing the distance between yourself and the wireless AP. Below is a table showing you some of the factors that contribute to the achievable data (PHY) rates:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZsNmR.gif&quot; alt=&quot;Modulation Coding Schemes&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://i.stack.imgur.com/ZsNmR.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;electronicdesign.com&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h2&gt;Application performance&lt;/h2&gt;&#xA;&lt;p&gt;Application performance depends on the 802.11 protocol that you are using. Funnily enough, at certain RSSI levels, 802.11g and 802.11n is comparable in performance. 802.11n experiences a higher initial loss from bad RSSI than 802.11g. Without investigating further, my hunch is that this is probably due to the complexity of the modulation in 802.11n.&lt;/p&gt;&#xA;&lt;h2&gt;What does this mean?&lt;/h2&gt;&#xA;&lt;p&gt;In some locations with poor RSSI, 802.11g may actually lead to a better experience with certain applications. The performance difference between 802.11g and 802.11n when using VoIP is usually negligible due to the lower data rates required. For applications requiring high-speed data transfer you really can't go past newer technologies such as 802.11n/ac though.&lt;/p&gt;&#xA;" OwnerUserId="7730" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-01-18T20:56:01.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16217" PostTypeId="2" ParentId="16203" CreationDate="2015-01-18T22:00:12.303" Score="5" Body="&lt;p&gt;Dual-homing to a single N7k is a supported topology so I'm guessing you mean dual-homing to two N7ks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason it isn't supported should be posed as a different question: 'Why WOULD you dual home a FEX to two separate N7ks?'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember, a FEX should only be thought of as a remote linecard of the upstream Nexus switch i.e. it doesn't perform local forwarding between ports. The topology you are describing would be like sharing a linecard between two chassis, something that doesn't really happen (I know people could argue that this happens in VSS or nV though).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a server with a single NIC then you can only connect it to a single switch anyway. So even though you want to add redundancy upstream, you will still have a single point of failure where it connects to the FEX. Cisco's rationale is that if you really want HA for a server then you would have two NICs on it. Each NIC would be connected to a separate FEX that are each dual-homed to a separate N7k.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That doesn't go to say that this may become a supported topology in the future however.&lt;/p&gt;&#xA;" OwnerUserId="7730" LastActivityDate="2015-01-18T22:00:12.303" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16218" PostTypeId="1" AcceptedAnswerId="16277" CreationDate="2015-01-19T00:28:28.257" Score="3" ViewCount="408" Body="&lt;p&gt;First time using the ASA CX. I am trying to update the IPS signatures. I am unsure how to do this? I went onto the cisco website and downloaded, &quot;IPS-sig-S844-req-E4.pkg&quot;. I tried uploading it under 'Administration &gt; Upgrades' but from what I can tell is this is the place to upload CX packages, not signatures. I am sure there is an easy answer to this but google is failing me on this one. Any help would be much appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;" OwnerUserId="11927" LastActivityDate="2015-01-22T00:02:34.733" Title="Cisco ASA CX IPS Signature updates" Tags="|cisco|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16219" PostTypeId="2" ParentId="10778" CreationDate="2015-01-19T02:16:39.307" Score="1" Body="&lt;p&gt;On the spoke routers make sure you have the hub routers configured as multicast destinations under the nhrp configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nhrp map multicast &quot;hub ip address&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EIGRP won't send hellos on interfaces that aren't configured to allow multicast, and by default DMVPN interfaces don't allow it. The other option is to configure EIGRP to use unicast instead of multicast by configuring 'neighbor' statements under the eigrp config (usually instead of network statements).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router eigrp 300&#xA; neighbor x.x.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope this helps!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cheers,&lt;/p&gt;&#xA;" OwnerUserId="11927" LastActivityDate="2015-01-19T02:16:39.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16223" PostTypeId="1" AcceptedAnswerId="33914" CreationDate="2015-01-19T13:37:44.543" Score="3" ViewCount="3986" Body="&lt;p&gt;Nagios is used from &lt;strong&gt;HOST1&lt;/strong&gt; to check the NTP server on &lt;strong&gt;HOST2&lt;/strong&gt;. One of the servers resides in an ACL. The assumption was that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended vlanX&#xA; permit udp host HOST1 X Y eq ntp&#xA; deny   ip any any log&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;would allow the ntp response, but it results in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;re-sending request to peer 0&#xA;NTP CRITICAL: No response from NTP server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;while executing the command on HOST2 works. It seems that the NTP has been blocked. How to allow it in the ACL? Note that the ACL works, as PING from specific hosts have to be explicitly allowed by adding new access rules.&lt;/p&gt;&#xA;" OwnerUserId="5282" LastActivityDate="2016-08-10T09:57:12.960" Title="Access rule that permits NTP response" Tags="|cisco-ios|ntp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16230" PostTypeId="1" CreationDate="2015-01-19T22:20:01.433" Score="3" ViewCount="3215" Body="&lt;p&gt;I have set up the following network:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/a4XyW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to allow connections to be initiated from the computer on the right (Host 2) to the computer on the left (Host 1). I also want Host 1 to be unable to initiate connections. Finally, I want Host 1 to be unable to send inbound traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Very simple ACL's:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 line 1 extended permit tcp any any&#xA;access-list 101 line 2 extended deny ip any any&#xA;access-list 102 line 1 extended deny ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ACL 101 - applied to inbound traffic of the right side of the ASA&lt;/li&gt;&#xA;&lt;li&gt;ACL 102 - applied to inbound traffic of the left side of the ASA&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Using NetCat, I was able to forge a connection from Host 2 to Host 1 with no problem and am denied, as intended, from initiating the connection from Host 1 to Host 2:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/3SyiZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, sending it from the Host 2 (white screen) to Host 1 (black screen) creates the FW flag UO (TCP handshake completed and outbound traffic). Now, When I send traffic from the black terminal to the white terminal, it changes the FW flag to &quot;UIO&quot; (outbound and inbound traffic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/cPN3q.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want is to block incoming traffic from Host 1 while keeping the connection established and allowing outbound traffic. How can I accomplish this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3836" LastActivityDate="2015-01-19T23:15:18.993" Title="ASA Block Incoming TCP Traffic from Established Connection" Tags="|routing|cisco-asa|firewall|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16231" PostTypeId="1" AcceptedAnswerId="16232" CreationDate="2015-01-19T22:40:33.430" Score="2" ViewCount="1107" Body="&lt;p&gt;I have a big problem with configuring inter vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a topology like this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JSPc0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have routing configured. I want to ping from Router 3 (VLAN 10) , a router 4 (VLAN 20). I know that I have to configure sub interfaces on Router 6, but it is impossible because this two addresses overlaps with 24 subnet mask. What is wrong ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;actual topology&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/p3IIa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="13240" LastEditorUserId="13240" LastEditDate="2015-01-19T23:37:17.363" LastActivityDate="2015-01-19T23:37:17.363" Title="inter vlan , sub interfaces" Tags="|switch|router|vlan|trunk|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16232" PostTypeId="2" ParentId="16231" CreationDate="2015-01-19T22:59:31.900" Score="1" Body="&lt;p&gt;In brief, because a vlan should roughly equate to a subnet. If a destination address is in the same subnet as the source address, it wouldn't want to route it. You switch within subnets but route between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your example to work routers 3 and 4 can't be on the same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If instead router 3 was 192.168.10.1 and router 4 was 192.168.20.1, they'd be in different subnets and would need routing to be able to communicate. You could put 2 sub interfaces of  router 6 - 192.168.10.254 and 192.168.20.254 for example and then add a static default route to each of router 3 and 4 to point to the corresponding subinterface on router 6. That default route says &quot;to get to anything not in my subnet, go through my default gateway at 192.168.10.254&quot; (or 192.168.20.254 for router 4)&lt;/p&gt;&#xA;" OwnerUserId="106" LastEditorUserId="106" LastEditDate="2015-01-19T23:06:04.770" LastActivityDate="2015-01-19T23:06:04.770" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="16233" PostTypeId="2" ParentId="16231" CreationDate="2015-01-19T23:03:59.873" Score="4" Body="&lt;p&gt;You have created an &quot;invalid&quot; network design.  You have two VLANs that have the same IP subnet configured on them.  You can't configure subinterfaces (as you've discovered) because the router, operating at layer 3, can't distinguish between the two subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, you should have one IP subnet per VLAN and vice versa.  Either change the IP subnet on one of your VLANs (you will have to enable routing), or make everything the same VLAN.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-01-19T23:03:59.873" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16234" PostTypeId="2" ParentId="16230" CreationDate="2015-01-19T23:14:26.167" Score="1" Body="&lt;p&gt;Configure the ASA so that the left side is the &quot;outside&quot; interface (low security level), and the right side is the inside interface (high security level).  You do not need any access lists as the security zone mechanism of the ASA does exactly what you want, and traffic will be filtered in the manner you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will have to address translation (or specify no translation) as well. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-01-19T23:14:26.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16235" PostTypeId="2" ParentId="16230" CreationDate="2015-01-19T23:15:18.993" Score="3" Body="&lt;p&gt;You must construct your access list(s) in a a fashion which explicitly targets the traffic and / or hosts you wish to permit or deny, in this case, Host 1 and Host 2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config)# access-list 101 extended permit ip [host2] [host1] any&#xA;(config)# access-list 101 extended deny ip [host1] any log&#xA;(config)# access-list 101 extended permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NOTE: The final line is required if you wish any other traffic from the same network as Host 2 to be allowed outside your firewall: a silent, implicit deny exists at the end of every Cisco ACL. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, on the interface which first receives this traffic initiated by Host 2 (inside): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-if): ip access-group 101 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With regards to your request that Host1 may not communicate with Host2 unless Host2 has already begun a session with Host1, this is the default nature of the Cisco ASA: it is a stateful packet-filter: connections which were not initiated from the inside zone will not be accepted when coming from the outside, unless rules configured by the Administrator explicitly permit them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the following guide for more details: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/acl_overview.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/acl_overview.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2015-01-19T23:15:18.993" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="16236" PostTypeId="1" AcceptedAnswerId="16237" CreationDate="2015-01-19T23:45:59.807" Score="5" ViewCount="644" Body="&lt;p&gt;In a standard Cisco 3600 router, I am able to apply TCP flag filtering to an extended access list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#configure terminal&#xA;R1(config)#ip access-list extended 101&#xA;R1(config-ext-nacl)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From here,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config-ext-nacl)#deny tcp any any ?&#xA;  ack          Match on the ACK bit&#xA;  dscp         Match packets with given dscp value&#xA;  eq           Match only packets on a given port number&#xA;  established  Match established connections&#xA;  fin          Match on the FIN bit&#xA;  fragments    Check non-initial fragments&#xA;  gt           Match only packets with a greater port number&#xA;  log          Log matches against this entry&#xA;  log-input    Log matches against this entry, including input interface&#xA;  lt           Match only packets with a lower port number&#xA;  neq          Match only packets not on a given port number&#xA;  precedence   Match packets with given precedence value&#xA;  psh          Match on the PSH bit&#xA;  range        Match only packets in the range of port numbers&#xA;  rst          Match on the RST bit&#xA;  syn          Match on the SYN bit&#xA;  time-range   Specify a time-range&#xA;  tos          Match packets with given TOS value&#xA;  urg          Match on the URG bit&#xA;  &amp;lt;cr&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, this functionality to filter by TCP flag seems non existent in ASA firewalls. Is there a menu I am not seeing? If this is the case, why disallow this feature? It has come in handy more than once.&lt;/p&gt;&#xA;" OwnerUserId="3836" LastActivityDate="2015-01-19T23:58:31.030" Title="Filter by TCP Flag ASA" Tags="|firewall|route-filter|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16237" PostTypeId="2" ParentId="16236" CreationDate="2015-01-19T23:58:31.030" Score="6" Body="&lt;p&gt;The ASA doesn't have the same &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/acl_extended.html#wp1074591&quot;&gt;filtering capabilities&lt;/a&gt;, unfortunately.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-01-19T23:58:31.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16242" PostTypeId="2" ParentId="7765" CreationDate="2015-01-20T10:16:39.190" Score="3" Body="&lt;p&gt;As per default, etherchannel is running in &quot;silent&quot; mode. So ethch goes up at the first time, but if you try to disable/enable on side maybe ethch doesn't goes up again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From CISCO CCO :&#xA;non-silent —(Optional) If your switch is connected to a partner that is PAgP capable, configure the switch port for nonsilent operation when the port is in the auto or desirable mode. If you do not specify non-silent , silent is assumed. The silent setting is for connections to file servers or packet analyzers. This setting allows PAgP to operate, to attach the port to a channel group, and to use the port for transmission.&lt;/p&gt;&#xA;" OwnerUserId="13469" LastActivityDate="2015-01-20T10:16:39.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16245" PostTypeId="1" AcceptedAnswerId="16246" CreationDate="2015-01-20T14:53:00.490" Score="2" ViewCount="1142" Body="&lt;p&gt;Trying figure out the key differences between T568A and T568B wiring, if any exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found claims in a thread that T568A has advantages over T568B due to the fact that each twisted-pair in a cat5/cat6 varies slightly in the tightness of the winding. That would imply that, while nominal, selection of twisted-pairs for TX/RX does have a physical impact.&#xA;(&lt;a href=&quot;http://community.spiceworks.com/topic/422129-t568a-or-t568b&quot; rel=&quot;nofollow&quot;&gt;http://community.spiceworks.com/topic/422129-t568a-or-t568b&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain the reason why one might claim 568A is better than 568B; or if this isn't true?&lt;/p&gt;&#xA;" OwnerUserId="13472" LastEditorUserId="13472" LastEditDate="2015-01-21T15:52:59.170" LastActivityDate="2015-01-21T15:52:59.170" Title="Do physical wire properties impact the choice between T568A &amp; T568B?" Tags="|cabling|bandwidth|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16246" PostTypeId="2" ParentId="16245" CreationDate="2015-01-20T15:47:23.723" Score="5" Body="&lt;p&gt;Neither is &quot;better.&quot;  It's a matter of convention only.  T568B has always appeared to me to be in much more widespread use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is true that bulk cat5/6 has variances in the tightness of the winding of each pair, but that wouldn't cause one spec to be more appropriate than the other.  Only if one spec required more untwisting for termination or something like that could we say that it may be &quot;worse&quot; or degrade the transmission quality more.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2015-01-20T16:13:17.590" LastActivityDate="2015-01-20T16:13:17.590" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16247" PostTypeId="1" AcceptedAnswerId="16255" CreationDate="2015-01-20T17:14:31.300" Score="4" ViewCount="830" Body="&lt;p&gt;The carrier has given me a COS profile of 102: 80/10/10 80% RT for a new 100mb circuit. I've compiled the below as my QoS policy-map and bandwidth configs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; speed 100&#xA; max-reserved-bandwidth 100&#xA; service-policy output ***&#xA;&#xA;policy-map ***&#xA;class voice&#xA;  priority percent 80&#xA;  set ip dscp ef&#xA;class priority1&#xA;  bandwidth remaining percent 16&#xA;  set ip dscp af31&#xA;class priority2&#xA;  bandwidth remaining percent 2&#xA;  set ip dscp af21&#xA;class class-default&#xA;  fair-queue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm a bit confused on the nature of &quot;bandwidth remaining&quot;, the way I understand it is as follows;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class voice&#xA;  priority percent 80 = **80mbs**&#xA;  set ip dscp ef&#xA;class priority1&#xA;  bandwidth remaining percent 16 = **3.2mbs, or 16% of the 20mb remainder**&#xA;  set ip dscp af31&#xA;class priority2&#xA;  bandwidth remaining percent 2 = **0.336mbs, or 2% of the 16.8mb remainder**&#xA;  set ip dscp af21&#xA;class class-default = **16.46mbs, aka &quot;whatever is left&quot;**&#xA;  fair-queue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I incorrect?&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="4634" LastEditDate="2015-01-20T20:05:33.727" LastActivityDate="2015-01-20T21:28:13.960" Title="QoS for 100mb Circuit" Tags="|cisco|qos|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16249" PostTypeId="2" ParentId="16247" CreationDate="2015-01-20T17:41:44.583" Score="5" Body="&lt;p&gt;You are correct about the semantics of &quot;bandwidth remaining&quot;, but the numbers are a bit different in IOS.  IOS only allows QoS to reserve 75% of the bandwidth by default, which can be tuned with &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/qos/command/reference/qos_book/qos_m1.html#wp1054626&quot; rel=&quot;noreferrer&quot;&gt;max-reserved-bandwidth&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What this means is that the bandwidth reserved for the voice class in your example is about 60%, and &quot;bandwidth remaining&quot; dices up the remainder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As noted in the link, IOS &gt; 15.0 and IOS-XE is a little different.&lt;/p&gt;&#xA;" OwnerUserId="5464" LastEditorUserId="5464" LastEditDate="2015-01-20T17:55:09.150" LastActivityDate="2015-01-20T17:55:09.150" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16250" PostTypeId="1" CreationDate="2015-01-20T17:53:51.657" Score="3" ViewCount="184" Body="&lt;p&gt;If I have a educational lab that's commonly used for multiple computers for teaching networking. I'm worried that if they remove the computer to put it in the classroom networking gear and come back but plug it in the wrong port that it would restrict their traffic. My basic port config for the student labs is as follows. If they were to unplug a PC from 5/0/7 and into 5/0/8 would that be restricted still? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet5/0/7&#xA; switchport access vlan 214&#xA; switchport mode access&#xA; switchport port-security&#xA; switchport port-security violation restrict&#xA; spanning-tree portfast&#xA;exit&#xA;&#xA;interface FastEthernet5/0/8&#xA; switchport access vlan 214&#xA; switchport mode access&#xA; switchport port-security&#xA; switchport port-security violation restrict&#xA; spanning-tree portfast&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1638" LastActivityDate="2015-01-20T18:31:29.003" Title="Does violation restrict still apply within same switch but different port" Tags="|security|port-security|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16251" PostTypeId="2" ParentId="16250" CreationDate="2015-01-20T18:08:20.830" Score="2" Body="&lt;p&gt;No, if I'm reading this right, a violation on the 5/0/8 doesn't &quot;poison&quot; the secure status of the address on 5/0/7.  Doing so would allow port-security to be used as an easy DOS tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the secure address was learned on 5/0/7 and they moved to 5/0/8, a violation occurs.  If they move back to 5/0/7, their connectivity is restored.&lt;/p&gt;&#xA;" OwnerUserId="5464" LastEditorUserId="5464" LastEditDate="2015-01-20T18:31:29.003" LastActivityDate="2015-01-20T18:31:29.003" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16252" PostTypeId="1" AcceptedAnswerId="16268" CreationDate="2015-01-20T18:45:20.233" Score="6" ViewCount="494" Body="&lt;p&gt;I come from a computer science background but physics is not presently one of my strengths. I've been reading some research regarding multi-hop routing of wireless (ad-hoc) networks such as &lt;a href=&quot;http://www.cs.jhu.edu/~cs647/class-papers/Routing/p114-draves.pdf&quot;&gt;this paper&lt;/a&gt; and &lt;a href=&quot;http://ocw.cs.pub.ro/courses/_media/isrm/articole/etx_2003.pdf&quot;&gt;this one&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One item that the authors seem to take for granted is the fact that a wireless signal will interfere &lt;em&gt;with itself&lt;/em&gt; across a single node that is responsible for receiving and forwarding the signal (datagram) about 50% of the time.  &lt;strong&gt;WHAT!?&lt;/strong&gt; A 50% loss rate sounds like &lt;em&gt;the most important thing&lt;/em&gt; to devote research toward mitigating! Yet, these authors aren't dunces. There must be a really good reason why self-interference is extremely difficult to work around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for someone familiar with networking and computer science, but not as much with wireless networking and certainly not the physical layer's nuances, can anyone explain why packets being forwarded to and then from a mid-point node will interefere with itself (and perhaps even why it is hard/impossible to avoid it)? &lt;/p&gt;&#xA;" OwnerUserId="13476" LastActivityDate="2016-01-03T21:02:11.067" Title="Why do wireless signals interfere with themselves regularly?" Tags="|ieee-802.11|packet-loss|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16253" PostTypeId="2" ParentId="16164" CreationDate="2015-01-20T19:41:46.147" Score="0" Body="&lt;p&gt;Yes, you are correct on the priority number. As long as the master switch is set to a higher priority than the member, you should be fine when your master switch is powered on and comes back online in regards to VLAN database. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am going to assume you have redundant uplinks configured on both switches A and B. If switch B doesnt have redundant uplinks and master switch A goes offline, switch B will be of no good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&#xA;Rez&lt;/p&gt;&#xA;" OwnerUserId="2320" LastActivityDate="2015-01-20T19:41:46.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16255" PostTypeId="2" ParentId="16247" CreationDate="2015-01-20T21:28:13.960" Score="3" Body="&lt;pre&gt;&lt;code&gt;class voice&#xA;  priority percent 80&#xA;  set ip dscp ef&#xA;class priority1&#xA;  bandwidth remaining percent 80&#xA;  set ip dscp af31&#xA;class priority2&#xA;  bandwidth remaining percent 10&#xA;  set ip dscp af21&#xA;class class-default&#xA;  fair-queue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above is actually the correct config. You are looking for 80mbs, 16mb, 2mb and 2mb Best Effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;80% of the remaining 20mbs is 16mbs. This leaves 4mbs remainder available for priority 2 and Best effort.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-01-20T21:28:13.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16256" PostTypeId="1" AcceptedAnswerId="16257" CreationDate="2015-01-20T22:06:19.143" Score="2" ViewCount="1062" Body="&lt;p&gt;When a router receives a padded 64 byte &lt;em&gt;Ethernet II&lt;/em&gt;(aka &lt;em&gt;DIX&lt;/em&gt;) frame and it needs to send this over an &lt;em&gt;dot1q&lt;/em&gt; sub-interface, then router will add a new &lt;em&gt;Ethernet II&lt;/em&gt; header, &lt;em&gt;IEEE 802.1q&lt;/em&gt; field and recalculate the &lt;em&gt;FCS&lt;/em&gt;. The question is, should router put a 64 byte frame onto wire or 68 byte frame? For example router receives an &lt;em&gt;ICMP &quot;echo request&quot;&lt;/em&gt; message which has 6+6+2 byte &lt;em&gt;DIX&lt;/em&gt; header, 20 byte &lt;em&gt;IPv4&lt;/em&gt; header, 8 byte &lt;em&gt;ICMP&lt;/em&gt; header, padding of zeros for 14 bytes and then the 4 byte &lt;em&gt;FCS&lt;/em&gt;. Now if the router will forward this frame over &lt;em&gt;802.1q&lt;/em&gt; sub-interface, which means that 4-byte &lt;em&gt;802.1q&lt;/em&gt; field is added, then should the router preserve all the padding and send 68 byte frame to wire or should it cut off 4-bytes of padding and send the 64 byte frame? A reference to RFC would be great.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-01-21T00:11:55.260" Title="Length of 64 byte padded Ethernet II(aka DIX) frame after 802.1q payload is added?" Tags="|ethernet|protocol-theory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16257" PostTypeId="2" ParentId="16256" CreationDate="2015-01-20T22:30:49.717" Score="4" Body="&lt;p&gt;Routers work at layer-3. Your ICMP message would be extracted from it's layer-2 container (which is bigger than the l3 payload) and processed as such. The next-hop would be presented 28 bytes to be encoded for whatever layer-2 it might be. Thus, in theory, a 64byte padded frame would be transmit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a switch, yes, an 802.1q tag would be inserted into the otherwise as-is frame. (adding 4 bytes.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-20T22:30:49.717" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16259" PostTypeId="2" ParentId="16256" CreationDate="2015-01-21T00:05:16.107" Score="2" Body="&lt;p&gt;While DIX can't tell the exact payload length when padding is used, a router is going to decapsulate the IP packet.  When it is forwarded, the packet is encapsulated with a minimum payload requirement of 42 octets.  So 64 octets should be send out at layer 2 on the dot1q interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, it's entirely possible that one or two vendors don't vary the padding ... so I would include the same &quot;in theory&quot; caveat as Ricky.&lt;/p&gt;&#xA;" OwnerUserId="5464" LastEditorUserId="5464" LastEditDate="2015-01-21T00:11:55.260" LastActivityDate="2015-01-21T00:11:55.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16260" PostTypeId="1" AcceptedAnswerId="16262" CreationDate="2015-01-21T01:28:34.350" Score="4" ViewCount="1579" Body="&lt;p&gt;I am trying to set the local preference of certain routes based on the community string.  I created the community list and confirmed it is working by checking the routes reported matching the community-list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show policy community-list&#xA; community-list 100 {&#xA;     rule 10 {&#xA;         action permit&#xA;         regex ###:####&#xA;     }&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I used that community list in the route-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show policy route-map default-import&#xA; rule 20 {&#xA;     action permit&#xA; }&#xA; rule 21 {&#xA;     action permit&#xA;     match {&#xA;         community {&#xA;             community-list 100&#xA;         }&#xA;     }&#xA;     set {&#xA;         local-preference 50&#xA;     }&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, on committing and resetting the BGP session, I do not see any local preference adjustments when I run &lt;code&gt;show ip bgp&lt;/code&gt;.  Am I missing something in my config?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OS: VyOS 1.05&lt;/p&gt;&#xA;" OwnerUserId="13450" LastEditorUserId="3191" LastEditDate="2015-01-24T19:11:34.817" LastActivityDate="2015-01-24T19:11:34.817" Title="Matching a community in a route-map" Tags="|bgp|vyos|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16262" PostTypeId="2" ParentId="16260" CreationDate="2015-01-21T04:13:34.793" Score="9" Body="&lt;p&gt;Your issue was caused by the generic permit (no match clause) attached to rule 20 of the default-import route-map.  Route-maps usually act like ACL's and stop processing after the first match.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cisco-land you can use the &lt;code&gt;continue&lt;/code&gt; keyword to continue evaluating the route-map instead of exiting at the first match.  I wasn't able to find VyOS documentation about this, so I don't know if it exists in your OS.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-01-21T04:13:34.793" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16268" PostTypeId="2" ParentId="16252" CreationDate="2015-01-21T15:24:02.710" Score="6" Body="&lt;p&gt;Self-interference is an identity issue within mesh wireless networks, primarily with pre 802.11b wireless networks.  The standards prior to 802.11n required only 3 non-overlapping channels of the 2.4GHz band.  In large mesh deployments you would have multiple cells conflicting with one another and reporting back to the primary host controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11n improves this situation by opening up the additional channels in the 5 GHz band thus introducing many more new channels that can mitigate this self-interference challenge.  However, while more channels helps, they do not eliminate the problem entirely. The use of smart antennas in 802.11n, particularly with beam forming, dramatically increases range but not necessarily in predictable or manageable patterns. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While the range increase is a benefit, it also brings with it increased interference at distance with other nodes. These issues suggest that the problem of interference is reduced with the advances of 802.11n; it will continue to be a key challenge in the design of large scale, high performance 802.11n Wi-Fi networks.&lt;/p&gt;&#xA;" OwnerUserId="13479" LastEditorUserId="13479" LastEditDate="2016-01-03T21:02:11.067" LastActivityDate="2016-01-03T21:02:11.067" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16269" PostTypeId="1" AcceptedAnswerId="16270" CreationDate="2015-01-21T16:04:57.580" Score="1" ViewCount="333" Body="&lt;p&gt;Can anyone suggest a protocol or testing procedure for evaluating WiFi traffic/interference on-site? This isn't something I regularly do so I am hoping that this will not require the purchase of expensive test gear that won't be used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm deploying some custom wireless technology in a Govt space that appears to have many different wireless networks running concurrently.&#xA;Thus far I've been spoiled and never had to &quot;complete&quot; with other wireless networks and haven't had to do too much in the way of troubleshooting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to know if it's feasible or if additional considerations need to be made. I believe i can use 5GHz or 2.4GHz.&lt;/p&gt;&#xA;" OwnerUserId="13494" LastActivityDate="2015-01-22T06:01:28.507" Title="On-site WIFI Feasibility Study" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16270" PostTypeId="2" ParentId="16269" CreationDate="2015-01-21T17:03:09.787" Score="4" Body="&lt;p&gt;There are many freeware applications suited for this task, some can even run on your phone. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out this list by Network World: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.networkworld.com/article/2183790/wireless/8-free-wi-fi-stumbling-and-surveying-tools.html&quot; rel=&quot;nofollow&quot;&gt;http://www.networkworld.com/article/2183790/wireless/8-free-wi-fi-stumbling-and-surveying-tools.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, a handy Android app is &quot;WiFi Analyzer&quot;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://play.google.com/store/apps/details?id=com.farproc.wifi.analyzer&quot; rel=&quot;nofollow&quot;&gt;https://play.google.com/store/apps/details?id=com.farproc.wifi.analyzer&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above app will show you graphical representations of shared channel overlap, as well as other stats like signal strength, etc. - very handy for mapping signal strengths. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of technique for your survey, a solid course of action would be: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: Submit your Plan of Action for approval: Since this is a .gov facility, you'll likely need to comply with their in-house Information Assurance &amp;amp; Change Control guidelines - this will entail putting together your plan-of-action (things you will do) and if need be, a back-out plan (how you'll restore service(s) if something goes wrong). Note that this plan of action should also include the software you'll be running to scan WiFi signals, so that they understand you're not doing something nefarious like sniffing without permission. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2: Obtain a floor-plan, and note the zones which your wifi will be required to cover: Mark these zones with unique identifiers like &quot;Zone A&quot;, which will allow you to easily name and track your WiFi mesh nodes ie: &quot;GOV-WAP-A2&quot; - this will facilitate ease of maintenance in case someone else is called in to work on your setup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3: Using your above zones, map the signal strengths of each existing WiFi signal in the areas you're supposed to cover - choose the WiFi channel which is least-used in that zone to be the channel used by that AP (or multiple APs, depending on your type of coverage / service-set). Record this zone data as part of your survey and note it in your design document.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4: After your APs are configured with the proper channels / etc you desire, do a second site-survey and note signal strengths of all APs in each zone as needed, and do a full walk-thru with a constant &quot;ping&quot; running, to watch WiFi handoff between APs, and adjust accordingly. Note all signal strengths in your final report, so that they can see what you've delivered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: With .gov projects, documentation is a huge part - depending on the agency, you may be held accountable in the future if your work is not up-to-spec with what they expect. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2015-01-21T17:03:09.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16272" PostTypeId="2" ParentId="6212" CreationDate="2015-01-21T19:26:41.843" Score="1" Body="&lt;p&gt;In order for the client to be able to connect to resources outside of the VPN tunnel, a split tunnel must be configured.  This will allow the adapter to inherit routes outside of it's own route table as well as allow the traffic out.  Adding routes upon connect is only part of the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a link with instructions for the ADM and CLI&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/70917-asa-split-tunnel-vpn-client.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/70917-asa-split-tunnel-vpn-client.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13479" LastActivityDate="2015-01-21T19:26:41.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16273" PostTypeId="1" AcceptedAnswerId="16276" CreationDate="2015-01-21T19:41:20.483" Score="2" ViewCount="1081" Body="&lt;p&gt;I have been struggling with this issue for a few days now. please bear with me, I am not a expert in networking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to setup ESXI lab with network segmentation based on Vlans defined in pfSense and a Cisco SG300 switch in L3 mode to which I also have an Airport extreme BS attached, which will have a private and guest network setup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good picture is worth 1000 words, hence I have tried my best to illustrate the design that I have in my mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Constraints:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Airport extreme doesn't have routing features.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Can you please review and advice on how to best realize this setup?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://cosni.in/homelab/1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Highlevel design http://cosni.in/homelab/1.png&lt;/a&gt;&#xA;&lt;a href=&quot;http://cosni.in/homelab/2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Physical connections http://cosni.in/homelab/2.png&lt;/a&gt;&#xA;&lt;a href=&quot;http://cosni.in/homelab/3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://cosni.in/homelab/3.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to support the following scenarios with this setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://cosni.in/homelab/4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Requiremnt 1 http://cosni.in/homelab/4.png&lt;/a&gt;&#xA;&lt;a href=&quot;http://cosni.in/homelab/5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Requirement 2 http://cosni.in/homelab/5.png&lt;/a&gt;&#xA;&lt;a href=&quot;http://cosni.in/homelab/6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Requirement 3 http://cosni.in/homelab/6.png&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12158" LastEditorUserId="13479" LastEditDate="2015-02-28T20:09:22.787" LastActivityDate="2015-12-23T17:27:53.717" Title="ESXI + pFsense + L3 Switch + Airport extreme setup advice" Tags="|switch|wireless|vlan|pfsense|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16274" PostTypeId="2" ParentId="16188" CreationDate="2015-01-21T19:49:38.783" Score="3" Body="&lt;p&gt;I solve the problem with dscp packet marking.here is the configuration for Downloading stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the class map as before:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all UBUNTU_DW  match access-group name UBUNTU_DW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the new policy with the help of dscp is: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Policy-Map DW&#xA;    Class UBUNTU_DW&#xA;     police cir 32000 bc 1500 pir 64000 be 2000&#xA;       conform-action set-dscp-transmit af21&#xA;       exceed-action set-dscp-transmit default&#xA;       violate-action drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then I apply the policy to int fa 0/0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;service-policy output DW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it works :)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh policy-map interface fa 0/0 output&#xA; FastEthernet0/0&#xA;&#xA;  Service-policy output: DW&#xA;&#xA;    Class-map: UBUNTU_DW (match-all)&#xA;      1699 packets, 2075517 bytes&#xA;      5 minute offered rate 20000 bps, drop rate 8000 bps&#xA;      Match: access-group name UBUNTU_DW&#xA;      police:&#xA;          cir 32000 bps, bc 1500 bytes&#xA;          pir 64000 bps, be 2000 bytes&#xA;        conformed 964 packets, 1063157 bytes; actions:&#xA;          set-dscp-transmit af21&#xA;        exceeded 336 packets, 440593 bytes; actions:&#xA;          set-dscp-transmit default&#xA;        violated 399 packets, 571767 bytes; actions:&#xA;          drop&#xA;        conformed 10000 bps, exceed 3000 bps, violate 8000 bps&#xA;&#xA;    Class-map: class-default (match-any)&#xA;      77 packets, 7490 bytes&#xA;      5 minute offered rate 0 bps, drop rate 0 bps&#xA;      Match: any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8467" LastActivityDate="2015-01-21T19:49:38.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16276" PostTypeId="2" ParentId="16273" CreationDate="2015-01-21T22:39:29.947" Score="2" Body="&lt;p&gt;Here are a few points regarding the presented configuration and assuming you have shared your complete VLAN footprint regarding the physical and virtual switching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any additional information would be helpful.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;pfSense&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configure a public VLAN in the Physical Switch&lt;/li&gt;&#xA;&lt;li&gt;Configure a public virtual switch within the ESXi host&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Apple Airport Config&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configure a VLAN for 172.16.42.0/24&lt;/li&gt;&#xA;&lt;li&gt;Configure a route to pass through the private pfSense interface&lt;/li&gt;&#xA;&lt;li&gt;Validate quad 0 route on pfSense for Internet access&lt;/li&gt;&#xA;&lt;li&gt;Ensure there is only one route for the guest network.  Allowing anonymous users into a the environment, I assume, is against the organizations security policy&lt;/li&gt;&#xA;&lt;li&gt;Configure VLAN in physical switch for 10.0.1.0/24 for the private wireless.  Ensure this VLAN can access resources in other VLAN's for services such as DNS, etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Network Modem attached to GE10&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Add appropriate VLAN's to physical switch&lt;/li&gt;&#xA;&lt;li&gt;Ensure GE10 has appropriate routes&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Primary questions regarding access revolve around routing.  The Cisco SG-300 has a limited command set and is NOT a full IOS Cisco product.  All of the routing can be done via the https interface of the device.&lt;/p&gt;&#xA;" OwnerUserId="13479" LastEditorUserId="13479" LastEditDate="2015-12-23T17:27:53.717" LastActivityDate="2015-12-23T17:27:53.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16277" PostTypeId="2" ParentId="16218" CreationDate="2015-01-22T00:02:34.733" Score="3" Body="&lt;p&gt;This is all resolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA CX has an automated update system in place. It requires current licences for the modules that you want updates for, and it needs access outbound on tcp/80 and tcp/443.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA CX establishes a connection to Cisco's update server on port 80 which then responds with the update server node IP address and establishes a connection to that on port 443 which then updates the ASA CX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately Cisco couldn't give me a list of IP addresses that the ASA CX would connect to so I had to add in a blanket ASA CX to any on 80,443 ACL. &lt;/p&gt;&#xA;" OwnerUserId="11927" LastActivityDate="2015-01-22T00:02:34.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16278" PostTypeId="2" ParentId="16143" CreationDate="2015-01-22T00:16:16.093" Score="0" Body="&lt;p&gt;Not all together happy with how this post turned out, but I've learned things that I didn't know before, so that's good. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, normally if two nodes (A and B) are connected to a switch which is on the downstream side of another device like your firewall, the switch will route packets from A -&gt; B and vise versa without contacting anything upstream (from @Tedwin).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decided to post my own answer with the good parts from the comments with @Panther Modern.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Use higher quality hardware. Since I'm using Netgear ProSafe unmanaged switches, I'm considering upgrading to something like Cisco. @Mike Pennington suggested the SG300 series, which I have researched before and found on Amazon for less than $200. @Panther Modern suggests Arista, Cisco, Juniper and Brocade switches.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Troubleshoot each piece independently and isolate the problem. I've done some of this, to the extent that I have isolated the general path, but in an environment where 100% uptime makes people happy and allows them to get work done, this can be tricky. But point taken...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Consider topology and where you have access to and how many users you have. These factors can influence your choices for gear and how you go about answering your questions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Find good networking tools and use those to help troubleshoot your issue. pfSense helped a lot concerning traffic that passed through the firewall. I also learned about &lt;a href=&quot;http://en.wikipedia.org/wiki/Robocopy&quot; rel=&quot;nofollow&quot;&gt;Robocopy&lt;/a&gt; for limiting traffic on the client. This tool works pretty well.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="5292" LastActivityDate="2015-01-22T00:16:16.093" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16279" PostTypeId="1" AcceptedAnswerId="16280" CreationDate="2015-01-22T04:12:14.453" Score="3" ViewCount="13528" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Em2Fm.png&quot; alt=&quot;switch loop&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have enabled spanning-tree bpduguard on the Cisco 2960 but it seems like the unmanaged switch does not have spanning tree protocol. Any other configuration to prevent loop?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-01-22T22:40:26.160" Title="How to prevent possible loop?" Tags="|cisco|switch|spanning-tree|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16280" PostTypeId="2" ParentId="16279" CreationDate="2015-01-22T04:35:01.333" Score="6" Body="&lt;p&gt;Spanning-tree is the protocol designed to detect and prevent loops. bpduguard is intended for &lt;em&gt;access ports&lt;/em&gt; -- ports connected to end users/machines (a single node.) A port configured for bpduguard gets disabled upon receiving a bpdu -- any bpdu.&lt;sup&gt;[1][2]&lt;/sup&gt; As such, enabling this feature on a port headed to a simple switch (aka &quot;hub&quot;) is asking for trouble, the instant anyone connected to that &quot;hub&quot; sends a bpdu, the 2960 will disable the port leading to it -- cutting off the &quot;hub&quot; and everything connected to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best option is to simply let spanning-tree on the 2960 work like normal. If you want the port to pass traffic immediately on link -- thus bypassing the normal stp discovery phase -- enable &lt;em&gt;portfast&lt;/em&gt;. But otherwise, leave bpduguard off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[1] &lt;a href=&quot;https://supportforums.cisco.com/document/45136/importance-bpdu-guard-and-bpdu-filter&quot;&gt;https://supportforums.cisco.com/document/45136/importance-bpdu-guard-and-bpdu-filter&lt;/a&gt;&lt;br/&gt;&#xA;[2] &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10586-65.html&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10586-65.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-22T04:35:01.333" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16281" PostTypeId="2" ParentId="16279" CreationDate="2015-01-22T05:32:12.607" Score="3" Body="&lt;p&gt;To start, take note that BPDU Guard (and BPDU Filter) are only in effect on ports that also have portfast enabled if enabled globally.  If portfast is not enabled, BPDU Guard will have no effect unless applied directly to the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience, non-managed switches come in two flavors with regards to BPDUs.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Switches that produce, relay, or forward BPDUs normally.&lt;/li&gt;&#xA;&lt;li&gt;Switches that drop or fail to relay BPDUs.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the first case, BPDU guard will disable the port the instant it sees a spanning-tree BPDU, even if that BPDU isn't its own (thus a loop.) As drawn, BPDU guard will disable &lt;em&gt;both&lt;/em&gt; ports since the 2960 will send a BPDU out both ports which will be reflected by the unmanaged switch into the opposite port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the second case, if the switch is not participating in STP itself, this will result in a L2 loop. Depending on your environment, there are a number of ways to mitigate a loop in this situation.  Feel free to mix and match as you like.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swtrafc.html&quot; rel=&quot;nofollow&quot;&gt;Storm Control&lt;/a&gt; - make sure you understand this feature before enabling as when misconfigured it can cause normal traffic to be dropped erroneously.  This typically takes place in hardware and uses thresholds for multicast, broadcast, and unicast traffic to suppress traffic when it exceeds the threshold.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swtrafc.html#wp1038501&quot; rel=&quot;nofollow&quot;&gt;Port Security&lt;/a&gt; - set a reasonable maximum value for the number of MAC addresses per port.  Typically a loop will result in traffic for many hosts to be carried over the link resulting in the configured violation mode to take effect.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swdhcp82.html#wp1058138&quot; rel=&quot;nofollow&quot;&gt;DHCP Snooping&lt;/a&gt; - setting a appropriate DHCP snooping rate limit on the port will cause the port to err-disable if that limit is exceeded.  This typically can be very low for an access port, although be warned that some features of security software can generate excess DHCP traffic (for example, at least one major security software vendor has a feature that allows it to &quot;scan&quot; the local network to look for compromised hosts).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are other loop protection methods as well, such as loop guard, but these are the ones that I can think of that could help in the situation you describe.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="619" LastEditDate="2015-01-22T22:40:26.160" LastActivityDate="2015-01-22T22:40:26.160" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="16282" PostTypeId="2" ParentId="16269" CreationDate="2015-01-22T06:01:28.507" Score="5" Body="&lt;p&gt;Since non-802.11 traffic can impact the utilization of any given channel as well as other 802.11 networks, you really need to use a tool that measures channel utilization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This comes down to some solution that will have at least basic spectrum analyzer functionality.  You can find these in a number of forms including (but not limited to) handheld devices, deployable sensors/probes, or USB adapters/software.  Functionality and costs will vary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you only want to concern yourself with 802.11 channel utilization, you can use capture software like WildPackets OmniPeek or AirMagnet WiFi Analyzer which will give you reporting tools that can calculate utilization based on the traffic it captures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that any tool will only give you information at the the time and place at which you are testing.  This is something that many people new to 802.11 troubleshooting often overlook.  Some examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Time of day can have a significant impact on any measurements you take.  If you take your measurements &quot;after hours&quot; when no one else is around, this won't reflect that actual working conditions when everyone is around.&lt;/li&gt;&#xA;&lt;li&gt;The location at which you take any measurements will only be able to make use of any usable signal at that location.  This means that you may &quot;hear&quot; additional devices/traffic in the next room that was too weak at the current location. This also often means that you can gather a lot of lower data rate transmissions because the higher data rate transmissions are not usable where you are located.&lt;/li&gt;&#xA;&lt;li&gt;The environment is always changing.  Maybe there is a heavy 802.11 user that happens to be out of the office on vacation when you do your testing.  Or maybe next week someone gets a fancy new pair of those &quot;WiFi enabled pants&quot; (i.e. any 802.11 device that may not have been in the environment before).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-01-22T06:01:28.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16285" PostTypeId="1" CreationDate="2015-01-22T07:47:42.667" Score="2" ViewCount="1279" Body="&lt;p&gt;The requirement is that when DH min size is set to group 14 (2048) a session using DH group 1 (1024) is not allowed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I really test this requirement on 2 CISCO routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to configure ip ssh dh min size both on ssh client and server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Network_freak&lt;/p&gt;&#xA;" OwnerUserId="13505" LastActivityDate="2015-01-22T08:24:32.983" Title="How do I I test ip ssh dh min size on two cisco routers?" Tags="|cisco|ssh|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16286" PostTypeId="2" ParentId="16285" CreationDate="2015-01-22T07:52:01.460" Score="2" Body="&lt;p&gt;Use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/d1/sec-d1-xe-3se-5700-cr-book/sec-d1-xe-3se-5700-cr-book_chapter_0110.html#wp1494948249&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;ip ssh dh min size&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a configuration command...  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw1&amp;gt; enable&#xA;Password:&#xA;sw1# conf t&#xA;sw1(config)# ip ssh dh min size 2048&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The doc link above lists it as an EXEC mode command, which is incorrect on my version of IOS...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw1#sh ver | i IOS&#xA;Cisco IOS Software, C3560 Software (C3560-IPSERVICESK9-M), Version 12.2(58)SE2, &#xA;RELEASE SOFTWARE (fc1)&#xA;sw1#ip ssh dh min size 4096&#xA;       ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;sw1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All this assumes you have an IOS &quot;K9&quot; image to begin with...&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-01-22T08:02:10.480" LastActivityDate="2015-01-22T08:02:10.480" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="16288" PostTypeId="2" ParentId="16285" CreationDate="2015-01-22T08:24:32.983" Score="1" Body="&lt;p&gt;A commandline ssh client (eg. linux slogin) will show the key size used:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% slogin -vv -l foo switch&#xA;...&#xA;debug2: bits set: 2051/4096&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That was with the size set to 4096. It also takes a lot longer to connect with it set like that.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-22T08:24:32.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16298" PostTypeId="1" CreationDate="2015-01-22T19:03:25.670" Score="2" ViewCount="987" Body="&lt;p&gt;I am having a problem with a DMVPN tunnel I recently created.  I have done some torubleshooting on this and discovered the tunnel to be up between both sites, but they are not passing any traffic between each other.  To create this tunnel I used code from a working tunnel and modified for the needs of this new tunnel.  In my research i have not found a configuration example similar to what is configured on my routers. I feel like the problem is with either EIGRP or an access list&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config of the spoke router (Cisco 1921 Running 15.4) that is not passing traffic over the tunnel, internet works.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel0&#xA; bandwidth 10000&#xA; ip unnumbered GigabitEthernet0/1&#xA; tunnel source Cellular0/0/0&#xA; tunnel mode ipsec ipv4&#xA; tunnel destination (IP Removed)&#xA; tunnel path-mtu-discovery&#xA; tunnel protection ipsec profile Mesh-VPN&#xA;&#xA;router eigrp 1&#xA; network 192.168.154.0&#xA; passive-interface default&#xA; no passive-interface Tunnel0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are the results of the show commands EIGRP neighbor and ip access-lists on the Spoke Router that is not passing Traffic&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PatonBMCXRou#show ip eigrp neighbors&#xA;EIGRP-IPv4 Neighbors for AS(1)&#xA;PatonBMCXRou#show ip access-list&#xA;Extended IP access list Internet-IN&#xA;    10 permit udp any any eq non500-isakmp&#xA;    20 permit udp any any eq isakmp (3 matches)&#xA;    30 permit esp any any&#xA;Extended IP access list InternetIn&#xA;Extended IP access list NAT&#xA;    10 deny ip 192.168.148.0 0.0.2.255 192.168.154.0 0.0.0.255&#xA;    20 deny ip 192.168.152.0 0.0.7.255 192.168.154.0 0.0.0.255&#xA;    30 permit ip 192.168.154.0 0.0.0.255 any (11004 matches)&#xA;Extended IP access list VPDNSplitTunnel&#xA;    10 permit ip 192.168.148.0 0.0.2.255 192.168.154.0 0.0.0.255&#xA;    20 permit ip 192.168.152.0 0.0.7.255 192.168.154.0 0.0.0.255&#xA;Extended IP access list acl-nat&#xA;Extended IP access list acl-static-nat&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the config on the spoke router (Cisco 3925 running 15.2)  The Port Arthur Tunnel works and I can pass traffic over it.  The BMCX one, the tunnel is up but I cannot&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel2&#xA; description BMCX&#xA; bandwidth 5000&#xA; no ip address&#xA; delay 100&#xA; tunnel source GigabitEthernet0/0&#xA; tunnel mode ipsec ipv4&#xA; tunnel destination (IP Removed)&#xA; tunnel path-mtu-discovery&#xA; tunnel protection ipsec profile Mesh-VPN&#xA;!&#xA;interface Tunnel4&#xA; description Port Arthur&#xA; bandwidth 10000&#xA; ip unnumbered Vlan1&#xA; tunnel source GigabitEthernet0/0&#xA; tunnel mode ipsec ipv4&#xA; tunnel destination (IP Removed)&#xA; tunnel path-mtu-discovery&#xA; tunnel protection ipsec profile Mesh-VPN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are the results of the show commands EIGRP neighbor and ip access-lists on the Hub Router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HouCoreRou#show ip eigrp neighbors&#xA;EIGRP-IPv4 Neighbors for AS(1)&#xA;H   Address                 Interface              Hold Uptime   SRTT   RTO  Q  Seq&#xA;                                                   (sec)         (ms)       Cnt Num&#xA;0   172.31.254.246          Tu0                      11 1d21h      51   582  0  6335&#xA;1   172.31.254.251          Tu1                      10 2d00h      80   582  0  12169&#xA;2   192.168.153.1           Tu4                      11 6d02h      17   102  0  260&#xA;HouCoreRou#show ip access-list&#xA;Standard IP access list 10&#xA;    10 permit any&#xA;Standard IP access list Management&#xA;    10 permit (IP Removed), wildcard bits 0.0.0.3&#xA;    20 permit 192.168.148.0, wildcard bits 0.0.3.255&#xA;    30 permit 192.168.153.0, wildcard bits 0.0.0.255&#xA;    40 permit 10.0.8.0, wildcard bits 0.0.3.255&#xA;    50 permit 10.0.44.0, wildcard bits 0.0.3.255&#xA;    60 permit 192.168.150.0, wildcard bits 0.0.0.255&#xA;Extended IP access list InternetIn&#xA;    200 permit icmp any any (1143766 matches)&#xA;    210 permit udp any any eq non500-isakmp&#xA;    220 permit udp any any eq isakmp&#xA;&#xA;Extended IP access list NAT&#xA;    10 deny ip 192.168.146.0 0.0.4.255 10.0.12.0 0.0.1.255&#xA;    20 deny ip 192.168.146.0 0.0.4.255 10.0.40.0 0.0.3.255&#xA;    30 deny ip 192.168.146.0 0.0.4.255 10.0.44.0 0.0.3.255&#xA;    40 deny ip 10.0.8.0 0.0.3.255 192.168.146.0 0.0.4.255&#xA;    50 deny ip 10.0.8.0 0.0.3.255 10.0.8.0 0.0.3.255&#xA;    60 deny ip 10.0.8.0 0.0.3.255 10.0.12.0 0.0.1.255&#xA;    70 deny ip 10.0.8.0 0.0.3.255 10.0.40.0 0.0.3.255&#xA;    80 deny ip 10.0.8.0 0.0.3.255 10.0.44.0 0.0.3.255&#xA;    90 deny ip 10.0.12.0 0.0.1.255 192.168.146.0 0.0.4.255&#xA;    100 deny ip 10.0.12.0 0.0.1.255 10.0.8.0 0.0.3.255&#xA;    110 deny ip 10.0.12.0 0.0.1.255 10.0.12.0 0.0.1.255&#xA;    120 deny ip 10.0.12.0 0.0.1.255 10.0.40.0 0.0.3.255&#xA;    130 deny ip 10.0.12.0 0.0.1.255 10.0.44.0 0.0.3.255&#xA;    140 deny ip 10.0.40.0 0.0.3.255 192.168.146.0 0.0.4.255&#xA;    150 deny ip 10.0.40.0 0.0.3.255 10.0.8.0 0.0.3.255&#xA;    160 deny ip 10.0.40.0 0.0.3.255 10.0.12.0 0.0.1.255&#xA;    170 deny ip 10.0.40.0 0.0.3.255 10.0.40.0 0.0.3.255&#xA;    180 deny ip 10.0.40.0 0.0.3.255 10.0.44.0 0.0.3.255&#xA;    190 deny ip 10.0.44.0 0.0.3.255 192.168.146.0 0.0.4.255&#xA;    200 deny ip 10.0.44.0 0.0.3.255 10.0.8.0 0.0.3.255&#xA;    210 deny ip 10.0.44.0 0.0.3.255 10.0.12.0 0.0.1.255&#xA;    220 deny ip 10.0.44.0 0.0.3.255 10.0.40.0 0.0.3.255&#xA;    230 deny ip 10.0.44.0 0.0.3.255 10.0.44.0 0.0.3.255&#xA;    240 permit ip 192.168.150.0 0.0.1.255 any (20325248 matches)&#xA;    250 permit ip 192.168.152.0 0.0.1.255 any&#xA;    260 permit ip 192.168.153.0 0.0.0.255 any&#xA;    270 permit ip 10.0.8.0 0.0.3.255 any (7381154 matches)&#xA;    280 permit ip 10.0.12.0 0.0.1.255 any (430120 matches)&#xA;    290 permit ip 10.0.40.0 0.0.3.255 any (672384 matches)&#xA;    300 permit ip 10.0.44.0 0.0.3.255 any (2 matches)&#xA;    310 deny ip 192.168.146.0 0.0.4.255 192.168.146.0 0.0.4.255&#xA;    320 deny ip 192.168.146.0 0.0.4.255 10.0.8.0 0.0.3.255&#xA;&#xA;Extended IP access list VPDNSplitTunnel&#xA;    10 permit ip 192.168.150.0 0.0.1.255 192.168.150.0 0.0.1.255&#xA;    20 permit ip 192.168.150.0 0.0.1.255 192.168.152.0 0.0.0.255&#xA;    30 permit ip 192.168.152.0 0.0.0.255 192.168.150.0 0.0.1.255&#xA;    40 permit ip 192.168.152.0 0.0.0.255 192.168.152.0 0.0.0.255&#xA;Extended IP access list acl-nat&#xA;    10 permit ip object-group og-rfc1918 any&#xA;    20 permit ip any object-group og-rfc1918&#xA;    30 deny ip object-group og-rfc1918 object-group og-rfc1918&#xA;Extended IP access list acl-static-nat&#xA;    10 permit ip object-group og-rfc1918 any (12138 matches)&#xA;    20 permit ip any object-group og-rfc1918&#xA;    30 deny ip object-group og-rfc1918 object-group og-rfc1918&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the config of the spoke router (Cisco 1921 Running 15.1) that is passing traffic over the tunnel. This is where i sourced my code for the spoke that is not working&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel0&#xA; bandwidth 10000&#xA; ip unnumbered GigabitEthernet0/0&#xA; tunnel source GigabitEthernet0/1&#xA; tunnel mode ipsec ipv4&#xA; tunnel destination (IP Removed)&#xA; tunnel path-mtu-discovery&#xA; tunnel protection ipsec profile Mesh-VPN&#xA;&#xA;router eigrp 1&#xA; network 192.168.153.0&#xA; passive-interface default&#xA; no passive-interface Tunnel0&#xA; no passive-interface Tunnel1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are the results of the show commands EIGRP neighbor and ip access-lists on the Spoke Router that is passing Traffic&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PAFiberRou#show ip eigrp neighbors&#xA;EIGRP-IPv4 Neighbors for AS(1)&#xA;H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq&#xA;                                            (sec)         (ms)       Cnt Num&#xA;0   192.168.150.1           Tu0               14 6d02h      17   200  0  867&#xA;PAFiberRou#show ip access-list&#xA;Standard IP access list Management&#xA;    10 permit (IP Removed), wildcard bits 0.0.0.3&#xA;    20 permit 192.168.150.0, wildcard bits 0.0.0.255 (10 matches)&#xA;    30 permit 192.168.153.0, wildcard bits 0.0.0.255&#xA;Extended IP access list InternetIn&#xA;    10 permit tcp any any eq 22 (38338 matches)&#xA;    20 permit udp any any eq isakmp (2885 matches)&#xA;    30 permit udp any any eq non500-isakmp (45565572 matches)&#xA;    40 permit esp any any (373917919 matches)&#xA;Extended IP access list NAT&#xA;    10 deny ip 192.168.150.0 0.0.1.255 192.168.153.0 0.0.0.255 (26 matches)&#xA;    20 deny ip 192.168.152.0 0.0.7.255 192.168.153.0 0.0.0.255 (2440069 matches)&#xA;    30 permit ip 192.168.153.0 0.0.0.255 any (5027871 matches)&#xA;Extended IP access list VPDNSplitTunnel&#xA;    10 permit ip 192.168.150.0 0.0.1.255 192.168.153.0 0.0.0.255&#xA;    20 permit ip 192.168.152.0 0.0.7.255 192.168.153.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13514" LastEditorUserId="2476" LastEditDate="2015-01-22T21:15:41.997" LastActivityDate="2015-01-23T05:33:19.643" Title="DMVPN EIGRP routes not passing" Tags="|acl|eigrp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16299" PostTypeId="2" ParentId="16298" CreationDate="2015-01-22T21:33:40.673" Score="-1" Body="&lt;p&gt;The answer was &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP unnumbered vlan1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on tunnel 2 of the hub&lt;/p&gt;&#xA;" OwnerUserId="13514" LastEditorUserId="509" LastEditDate="2015-01-23T05:33:19.643" LastActivityDate="2015-01-23T05:33:19.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16300" PostTypeId="2" ParentId="6938" CreationDate="2015-01-22T21:34:59.343" Score="1" Body="&lt;p&gt;You can use any channel you want, but as others have said channels 1, 6, and 11 are your best bet. The channels overlap each other such that 1, 6, and 11 are the only channels that don't overlap each other. A picture is worth a thousand words, this one is from the Android app &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.farproc.wifi.analyzer&amp;amp;hl=en&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wifi Analyzer&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QmjEJ.png&quot; alt=&quot;sample image of overlapping channels&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice that SSID S, centred on channel 1, gets interference from not just SSID 2412s (which is also on channel 1), but from 2417s on channel 2 and from 2422s on channel 3! However 2347s on channel 6 doesn't interfere with it at all. 2347s also does not interfere with 2362s, on channel 11.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may need to use a wifi analyzer to find out which channel has the least interference, but bear in mind a lot of devices will change channel automagically. It is possible, though, that you're in an area where the local internet provider uses equipment that all sits on one channel, so you could get lucky. At one point I was in an apartment with 24+ different wifi networks bleeding in... all on channel 1, all gear from same ISP. There were only 3 networks elsewhere. As long as I chose a channel 6 or higher, I had no trouble.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Avoid channel 13 and 14 unless you like the idea of prison, being a prisoner, living the prison lifestyle, etc. You'll get plenty of conflicting advice, a little wifi is not worth running the risk that you have to change your definition of a good day to be &quot;one where I didn't get assaulted until AFTER lunch.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR version: Yes, you can choose any channel, but assuming an essentially even distribution (a safe assumption in most cases), choosing 1, 6, or 11 will give you best performance since they don't overlap with each other.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastEditorUserId="7869" LastEditDate="2015-01-26T22:33:06.160" LastActivityDate="2015-01-26T22:33:06.160" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16301" PostTypeId="1" AcceptedAnswerId="20792" CreationDate="2015-01-22T23:47:24.380" Score="4" ViewCount="262" Body="&lt;p&gt;I have a Cisco 1142 access point and would like to collect the statistics shown by the command &quot;show int dot11Radio [N] statistics&quot; command via SNMP. Specifically, I want to collect the number of bytes transmitted and received by the specified radio at each data rate for graphing and radio link performance analysis purposes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked around with snmpwalk but have not been able to find the OIDs that correspond to these counters. If anyone knows them or can suggest a more effective way to try to find them, I'd really appreciate it.&lt;/p&gt;&#xA;" OwnerUserId="13516" LastActivityDate="2015-08-21T02:21:27.290" Title="Cisco 1142: Gather &quot;show int dot11Radio N statistics&quot; Data via SNMP?" Tags="|cisco|wireless|snmp|monitoring|cisco-wireless|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16302" PostTypeId="2" ParentId="16301" CreationDate="2015-01-23T01:24:16.587" Score="4" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/access_point/12-3_7_JA/configuration/guide/i1237sc/s37mib.html&quot; rel=&quot;nofollow&quot;&gt;this list&lt;/a&gt;, none of those MIBs carry per-rate statistics. Looking through all the v1 and v2 MIBs, I see nothing to indicate a way to get the per-rate stats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/MainServlet?ReleaseSel=3764&amp;amp;PlatformSel=18&amp;amp;fsSel=1396&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS MIB Locator&lt;/a&gt; for my specific 1242. Use &quot;New Search&quot; to get the specifics for your 1142.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-01-23T01:29:52.023" LastActivityDate="2015-01-23T01:29:52.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16303" PostTypeId="1" CreationDate="2015-01-23T02:04:35.380" Score="4" ViewCount="882" Body="&lt;p&gt;In Cisco, this can be easily achieved by:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map TVPrio&#xA; description Set VLAN priority to 4&#xA; class class-default&#xA;  set cos 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and apply this policy-map to the interface. How to do equivalent in JunOS?&lt;/p&gt;&#xA;" OwnerUserId="13428" LastEditorUserId="59" LastEditDate="2015-04-29T08:14:25.523" LastActivityDate="2016-05-04T07:07:19.690" Title="How to override 802.1p CoS on outgoing interfaces?" Tags="|qos|juniper-junos|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16304" PostTypeId="2" ParentId="16190" CreationDate="2015-01-23T02:38:46.807" Score="6" Body="&lt;p&gt;I solved this problem finally. By capturing and comparing DHCP Discover packets sent from JunOS and Cisco, I found Cisco sends Option 64 Client Identifier and Option 12 Host Name by default. However, JunOS will not send them without explicit instructions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think my ISP sets up a filter or something on their side. The above two options are mandatory. When I configure my SRX to send them, everything went through.&lt;/p&gt;&#xA;" OwnerUserId="13428" LastEditorUserId="13428" LastEditDate="2015-01-24T03:36:50.513" LastActivityDate="2015-01-24T03:36:50.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16305" PostTypeId="1" CreationDate="2015-01-23T04:59:06.287" Score="5" ViewCount="8932" Body="&lt;p&gt;I'm trying to disable line aux 0 with the following commands on a AS2511-RJ router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;!&#xA;line aux 0&#xA; transport input none&#xA; transport output none&#xA; no exec&#xA; exec-timeout 0 1&#xA; no password&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it the right way and how can I re-enable it if need to?&lt;/p&gt;&#xA;" OwnerUserId="13293" LastEditorUserId="775" LastEditDate="2015-01-23T07:25:58.353" LastActivityDate="2015-01-23T07:25:58.353" Title="Enable and disable AUX port" Tags="|cisco|router|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16306" PostTypeId="2" ParentId="16305" CreationDate="2015-01-23T05:39:06.800" Score="9" Body="&lt;p&gt;First of all, I had to go look up the part number and it's actually on a part of Cisco's site where they've archived the picture files...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second you could shorten your config to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line aux 0&#xA; no exec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And to re-enable the config would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line aux 0&#xA; exec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note you can still use the aux line for reverse telnet access to a serial port on another device with &lt;code&gt;no exec&lt;/code&gt; configured, so you're only preventing incoming sessions with that command.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-01-23T05:39:06.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16311" PostTypeId="1" AcceptedAnswerId="16317" CreationDate="2015-01-23T15:40:46.813" Score="1" ViewCount="247" Body="&lt;p&gt;We were wondering if there was a command to remove the vlans on an rfs6000 switch?&#xA;We have tried factory resting the switch with the Username: restore but this keeps the Vlans. Help would be much appreciated. &lt;/p&gt;&#xA;" OwnerUserId="13529" LastActivityDate="2015-01-24T01:09:26.727" Title="rfs6000 wireless switch removing Vlans" Tags="|switch|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16317" PostTypeId="2" ParentId="16311" CreationDate="2015-01-24T01:09:26.727" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;h2&gt;&lt;strong&gt;3.1.21 erase&lt;/strong&gt;&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;&lt;em&gt;Privileged Exec Mode Commands&lt;/em&gt;&lt;br/&gt;&#xA;  Erases a device’s (wireless controller, access point, and service platform) file system. Erases the content of the specified storage device. Also erases the startup configuration to restore the device to its default.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://portal.motorolasolutions.com/Support/US-EN/Wireless+Networks/Wireless+LAN/Unified+Access+Platforms/RFS6000_RF_Switch_US-EN&quot; rel=&quot;nofollow&quot;&gt;RFS6000 Support&lt;/a&gt; &gt;&gt;&gt; &lt;a href=&quot;https://atgsupportcentral.motorolasolutions.com/content/emb/docs/manuals/MN001394A01.pdf&quot; rel=&quot;nofollow&quot;&gt;Motorola Solutions WiNG 5.5.5 CLI Reference Guide&lt;/a&gt;[pdf], (p.3-57)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;erase startup-config&lt;/code&gt; should do it. That should put it back to &quot;factory fresh&quot;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-01-24T01:09:26.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16319" PostTypeId="2" ParentId="10748" CreationDate="2015-01-24T04:25:11.960" Score="3" Body="&lt;p&gt;If you are running code versions &lt;strong&gt;8.2 and before&lt;/strong&gt;, you will need duplicate licenses, one for the Primary and one for the Secondary in an HA pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are running code versions &lt;strong&gt;8.3 and after&lt;/strong&gt;, you only need a single license, and the Primary and Secondary firewall in the HA pair will 'share' the features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This change is outlined in the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/release/notes/asarn83.html#pgfId-466985&quot; rel=&quot;nofollow&quot;&gt;8.3 release notes&lt;/a&gt;, which you can read here:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Failover licenses no longer need to be identical on each unit. The license used for both units is the combined license from the primary and secondary units.&lt;BR /&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you happen to have had two licenses, one for each pre-8.3 Firewall in an HA pair, and then you upgraded to 8.3 or later, then the licenses will be combined.  Which is to say, if you had a 5 SSL VPN user license on the Primary, and a 5 SSL VPN on the Secondary, you would now (after upgrading to 8.3+) have 10 SSL VPN users allowed to connect at once.  This works for licenses which offer a numbered feature.  If your license was something like AnyConnect Essentials, there is no benefit to upgrading &lt;em&gt;(*see note below)&lt;/em&gt;, since its impossible to enable the AnyConnect Essentials twice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&#xA;*There is no benefit to upgrading &lt;em&gt;in so far as duplicating the licenses&lt;/em&gt;... I would say, however, &lt;em&gt;there is significant benefit in terms of security and functionality of upgrading past 8.3&lt;/em&gt;.  In fact, I would suggest to go all the way to 9.x+ to get cool new IPv6 features... but that is completely outside of the scope of your question.&#xA;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your last question... the output of &lt;code&gt;show version&lt;/code&gt; has changed in 8.3+ and should be sufficient in determine what your firewalls in the HA pair are licensed for or not.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-01-24T04:25:11.960" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16322" PostTypeId="1" CreationDate="2015-01-24T16:03:55.383" Score="0" ViewCount="1430" Body="&lt;p&gt;I tried to configure simple topology using switch layer 3, but it doesn't work and I don't have an idea what is wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/wdL55.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I ping from 192.168.1.2 a computer 192.168.2.3 , a ICMP packet stops at Multilayer Switch. When I remove Switch2, everything works, but my goal is to create multiple switches L2 and each one having link to multilayer switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit :&#xA;There was a mistake on label next to multilayer switch&#xA;VLAN 10 -  192.168.1.1&#xA;VLAN 20 -  192.168.2.1&lt;/p&gt;&#xA;" OwnerUserId="13541" LastEditorUserId="8499" LastEditDate="2018-03-21T00:05:51.670" LastActivityDate="2018-03-21T00:05:51.670" Title="Inter VLAN - switch layer 3" Tags="|switch|vlan|layer3|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16323" PostTypeId="1" CreationDate="2015-01-24T17:21:11.763" Score="2" ViewCount="109" Body="&lt;p&gt;The other day I ran across a piece of software configured to &amp;quot;multicast&amp;quot; using the address 255.5.6.7.&lt;/p&gt;&#xA;&lt;p&gt;While I've seen local broadcast (255.255.255.255) and &amp;quot;true&amp;quot; multicast (as defined in rfc5771), this address seems to reside outside either of those recommendations. The address did seem to work, however, as a corresponding client was receiving the messages (it was on the same subnet).&lt;/p&gt;&#xA;&lt;p&gt;I was wondering if this address worked merely since the first octet identified as broadcast, and network devices are coded to shortcut the logic. Does anyone know if this is the case or whether this address falls within another commonly recommended block?&lt;/p&gt;&#xA;&lt;p&gt;For reference, I already checked &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc919&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC919&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5771&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC5771&lt;/a&gt; and neither seemed to include this block.&lt;/p&gt;&#xA;" OwnerUserId="13542" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-01-25T06:31:15.017" Title="Valid broadcast and multicast addressing" Tags="|multicast|ip|broadcast|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16326" PostTypeId="1" CreationDate="2015-01-24T21:17:59.487" Score="2" ViewCount="197" Body="&lt;p&gt;I am a little confused with assigning ip to computers. &#xA;I have a topology like this :&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Sm82g.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should all segments between Router 9 and Router 10 be on the same subnet ?&#xA;I should be able to communicate between vlans, so I have to create sub-interfaces on Router 9, but to do this, I have non-overlapping ip for each vlan. If vlans should be on different subnets, what with these two segments with VLAN 30 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am confident, that it might be basic question, but I don't have much experience. Could someone give me any hint ? What is the good way to address it ?&lt;/p&gt;&#xA;" OwnerUserId="13541" LastActivityDate="2015-04-25T08:32:34.490" Title="Addressing between routers - vlans" Tags="|router|vlan|trunk|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16327" PostTypeId="2" ParentId="16326" CreationDate="2015-01-24T22:40:49.613" Score="0" Body="&lt;p&gt;If you want to divide your network by VLANs each one needs is own subnet. Here is a link to some Cisco documentation &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/switch/configuration/guide/fswtch_c/xcfvl.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/switch/configuration/guide/fswtch_c/xcfvl.html&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerDisplayName="user4043" LastActivityDate="2015-01-24T22:40:49.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16332" PostTypeId="2" ParentId="16323" CreationDate="2015-01-25T06:31:15.017" Score="2" Body="&lt;p&gt;It shouldn't work.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1112#section-4&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc1112#section-4&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm guessing the vendor/developer was assuming it would be used as extended multicast space, but the last proposal for the space was for unicast use.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-fuller-240space-02&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://datatracker.ietf.org/doc/html/draft-fuller-240space-02&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Are you actually seeing it routed?&lt;/p&gt;&#xA;" OwnerUserId="5464" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-01-25T06:31:15.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16333" PostTypeId="2" ParentId="16326" CreationDate="2015-01-25T06:46:35.237" Score="3" Body="&lt;p&gt;The picture specifically states that the R9-S0 and S0-S1 links are trunks, while PC0 and R10 are only on vlan 30 and PC1 is on vlan 20.  Since the diagram shows two different vlans, you would normally use two different subnets.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-01-25T06:46:35.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16340" PostTypeId="1" CreationDate="2015-01-26T15:26:05.113" Score="2" ViewCount="424" Body="&lt;p&gt;Consider my local network infrastructure map:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OLHqW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OLHqW.png&quot; alt=&quot;LAN&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've a device with a Virtual Machine that acts as a QOS manager/firewall to filter and prioritize traffic with complex rules that my main router cannot manage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I would know if it's possible to route all connection to ZeroShell VM only when it's up and running, otherwise keeping the main router as default route for internet.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need it because sometime the Firewall/QOS machine can go offline/under maintenance but i need that all devices continue to have internet access without manually change IP&lt;/p&gt;&#xA;" OwnerUserId="13568" LastEditorUserId="13568" LastEditDate="2015-01-27T09:41:26.397" LastActivityDate="2015-02-26T19:10:42.453" Title="How to create a dynamic route to firewall?" Tags="|routing|firewall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16342" PostTypeId="2" ParentId="6755" CreationDate="2015-01-26T17:01:49.663" Score="3" Body="&lt;p&gt;From the 14.4.6M guide:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.3.3.4 Performing an MLAG ISSU Upgrade&#xA;The following procedure performs an MLAG ISSU upgrade:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 1 Verfy configuration consistency on each peer (Section 10.3.3.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 2 Verify version compatibility between the new and existing images (Section 10.3.3.2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 3 Configure reload-delay mlag (Section 10.3.2). Recommended delay period varies by switch type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 4 Install the new image onto one of the peers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Step a Upload the new image to the switch (Section 2.4.1.2).&lt;/li&gt;&#xA;&lt;li&gt;Step b Set the boot path to the new image (Section 2.4.1.3).&lt;/li&gt;&#xA;&lt;li&gt;Step c Enter the reload command. (Section 2.4.1.4).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Step 5 Resolve all reload warnings (Section 10.3.3.3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 6 Confirm the reload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 7 Wait for MLAG peers to renegotiate to the active state and reload-delay expiry on rebooted peer. Avoid configuration changes on both peers after this step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 8 Repeat the upgrade process for the other peer. When upgrading modular switches with dual supervisors, upgrade the standby supervisors first, then upgrade the active  supervisors.&lt;/p&gt;&#xA;" OwnerUserId="13570" LastActivityDate="2015-01-26T17:01:49.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16343" PostTypeId="2" ParentId="5832" CreationDate="2015-01-26T17:22:29.633" Score="0" Body="&lt;p&gt;Here are the exact steps that Nick took:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Install FortiExplorer. Connect the usb cable to the router and go to the web view. First just try ‘admin’ and no password. If that fails, you’ve gotta reset it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Download a firmware from the Fortinet ftp server: &lt;a href=&quot;ftp://pftpintl:F0rt1intl@support.fortinet.com&quot; rel=&quot;nofollow&quot;&gt;ftp://pftpintl:F0rt1intl@support.fortinet.com&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Upload the firmware to the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5) Unplug the power. Plug it back in and wait for the router to boot up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6) Use a pen to hold the reset button for about 5 seconds within 30 seconds of the router booting up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7) At this point I was unable to access the web view. Maybe try rebooting again and see if it works. If it does, you’re done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8) Install the new firmware that you uploaded in step 4. Reboot and login with ‘admin’ and no password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took those exact steps and it worked on one of our FortiGate 60Ds. Just hitting the reset button for 5 seconds did not work.&lt;/p&gt;&#xA;" OwnerUserId="13572" LastActivityDate="2015-01-26T17:22:29.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16347" PostTypeId="1" AcceptedAnswerId="16349" CreationDate="2015-01-26T21:07:33.963" Score="2" ViewCount="144" Body="&lt;p&gt;I am here hoping you guys might be able to give me some information I can take to my owner and get the entire building rewired.  We are an old school (built in 66) that has been converted to a Manufacturing plant.  Currently the network is horrible.  We have multiple people running Solidworks and CAMworks at the same time and we have 7 servers that are being accessed constantly; ERP, 2 Temrinals, Exchange, 2 Domain Controllers, and a File Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now all of the servers are in a rack and the servers are fairly new.  We have a total of 14 switches scattered in the building for approximately 60 PC's and 15 printers.  The connection right now comes in through TWC business as fiber and goes about 200 feet to our server room and then hits the filters and firewall and goes 200ft back to the origin to hit a patch panel and switch.  The switch is a good 3com switch put the patch panel goes out to all of the switches scattered about and it only has CAT5 cabling hooked up.  Right off the bat, nothing is gigabit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this is lengthy so I will get to the questions.  I am not a networking expert but I know enough to be dangerous.  Lets say a user opens up a CAD file over the network.  Between him and server are 2 switches and the network connection is terminated and remade twice.  Is the risk of losing data everytime it hits a switch and terminates and remade again a big factor do you think?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran a speed test on my PC for the LAN.  According to it, it takes me 3 seconds to transfer a file 100mb in size to and from the server, and there is only one switch between us and its gigabit.  To send and receive to his PC is 10 seconds each.  What can you guys tell me to explain to my owner that this needs to be redone?&lt;/p&gt;&#xA;" OwnerUserId="13578" LastEditorUserId="3191" LastEditDate="2015-01-26T22:20:48.280" LastActivityDate="2015-01-27T13:23:23.750" Title="Selling on a Network remodel" Tags="|ethernet|cabling|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16348" PostTypeId="1" AcceptedAnswerId="16350" CreationDate="2015-01-26T21:34:48.037" Score="4" ViewCount="1227" Body="&lt;p&gt;Is the hold time standardized? Is there a standard or reliable recommendation for a timeout? I am well aware that a SOHO non-managed switch requires a shorter timer than a data-center switch.&lt;/p&gt;&#xA;&lt;p&gt;That was my starting point:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IETF: None specified. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 826&lt;/a&gt;, &lt;em&gt;An Ethernet Address Resolution Protocol&lt;/em&gt;: &lt;em&gt;&lt;strong&gt;It may be desirable to have table aging and/or timeouts. The&#xA;implementation of these is outside the scope of this protocol.&lt;/strong&gt;&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Various platforms, various timers:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Microsoft: 2 min. &lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc940021.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;TechNet&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Cisco IOS (version undefined): 4hr. &lt;a href=&quot;http://docwiki.cisco.com/wiki/Cisco_NX-OS/IOS_Default_Configuration_Differences#Layer_3_Switching_Features_and_Protocols&quot; rel=&quot;nofollow noreferrer&quot;&gt;DocWiki&lt;/a&gt;, &lt;em&gt;Cisco NX-OS/IOS Default Configuration Differences&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;Cisco NX-OS: 25 min. (see above)&lt;/li&gt;&#xA;&lt;li&gt;Cisco IOS 15M&amp;amp;T: 4 hours: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_arp/configuration/15-mt/arp-15-mt-book/arp-config-arp.html#GUID-5F461B65-6268-453B-98FB-E751E74B460B&quot; rel=&quot;nofollow noreferrer&quot;&gt;cisco.com&lt;/a&gt;, &lt;em&gt;IP Addressing: ARP Configuration Guide&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;Juniper: 20 min. &lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junos10.4/topics/task/configuration/arp-learning-aging-options-configuring.html#id-10920970&quot; rel=&quot;nofollow noreferrer&quot;&gt;TechLibrary&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2018-12-27T01:56:35.220" Title="ARP table aging: What timer can I expect?" Tags="|protocol-theory|arp|rfc|standardisation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16349" PostTypeId="2" ParentId="16347" CreationDate="2015-01-26T22:20:31.990" Score="3" Body="&lt;p&gt;If there isn't an &lt;em&gt;'in your face'&lt;/em&gt; requirement to repair the infrastructure that's in the building right now, then you're going to be fighting an uphill battle.  Most managers (and users, for that matter) are willing to accept sub-par service as long as it works; mainly because they want their IT gear to last until it dies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a degraded level of service has been provided for long enough, people will not communicate issues anymore.  They'll simply accept it as what it is, a crummy system, then complain to their coworkers and think it's your doing (you &lt;em&gt;personally&lt;/em&gt;).  I can't tell you how many times I've run across a user that's had a different issue and, upon further diagnosis, found out there was bad wiring or auto negotiation was turned off that resulted in pathetically slow speeds.  My response is always to the flavor of &quot;I can't believe you never said anything...&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In essence, if your managers don't see a legitimate need for better resources, they'll accept the heartache is business-as-usual and tell everyone to suck it up and move on.  As a network engineer, a big part of your job is going to be communicating those requirements to your higher-management that doesn't entirely understand what you need or why you need it.  You can interpret that as 'salesman'. A method that's always worked for me is giving them cold, hard facts, but do &lt;strong&gt;not&lt;/strong&gt; forget the sugar coating...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Correlate things that actually matter to them.  A few off the top of my head:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Amount of errors/loss (total) - Attempt to get across roughly how bad it is and why they should care.&lt;/li&gt;&#xA;&lt;li&gt;Estimate the time spent waiting - Turn it around into a real business objective; no manager wants to hear &quot;Collectively, your employees will waste 3 hours a day waiting for network resources. 3 hours a day = 15 hours a week = 780 hours a year = ($40K average salary) = $15K a year.&quot;  Go crazy, but don't lie.&lt;/li&gt;&#xA;&lt;li&gt;No continuity plan - Relay how detrimental it will be if that cabling failed en masse (however unlikely).  If the people that are fed by those poor resources are important, then mention that. &lt;/li&gt;&#xA;&lt;li&gt;Provide transparent estimations on cost - This may give some people knots, but it will signal them that you're serious and you know what you're talking about.  This isn't some hop-scotch idea that you dreamt up last night; you've considered the risks important enough to bring up in a business meeting.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is the most difficult part for people: If the facts don't add up to legitimately support your case, then perhaps there aren't any serious issues and you should really consider if it's as bad as you're making it out to be.  We've all made things out to be worse than they are from time to time, but if you find yourself digging deeper and deeper for an issue, then maybe there isn't one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the facts do add up and they still don't want to take action, then just wait for the day you can say &lt;em&gt;&quot;I told you so... err, with all due respect&quot;&lt;/em&gt; and perhaps next time they'll listen and take your proposals more seriously.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2015-01-26T22:20:31.990" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16350" PostTypeId="2" ParentId="16348" CreationDate="2015-01-26T22:26:57.130" Score="5" Body="&lt;p&gt;You answered yourself. No RFC sets a value. Everyone chooses what they think is reasonable. Older IOS (12) has it hard coded to 4hrs; newer (15) can be changed. Linux can be (&lt;em&gt;annoying&lt;/em&gt;) anywhere from 15sec to 2min.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, routers hold for long periods because they're likely to continue dealing with that host. Individual hosts (windows, linux, etc.) expire their cache quickly to keep it small, and since they are generally talking to the router constantly, that entry stays fresh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When talking about &lt;em&gt;switches&lt;/em&gt; (layer-2), &quot;ARP&quot; means the management plane, and it's just a host at that level. The layer-2 mac forwarding tables are a different animal. From the provided docwiki &lt;em&gt;MAC Table Aging Timer&lt;/em&gt; is 30min for NX-OS and 5min for IOS.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-01-26T22:40:43.187" LastActivityDate="2015-01-26T22:40:43.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16351" PostTypeId="1" AcceptedAnswerId="16387" CreationDate="2015-01-27T01:10:45.023" Score="8" ViewCount="2340" Body="&lt;p&gt;I am working on a new network deployment, and have run into an interesting question...  Should the OSPF area 0 be extended across a WAN's point to point links (thereby creating more border routers), or should one's WAN Aggregation router serve as the ABR for each area?  Consider the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/azCCq.jpg&quot; alt=&quot;OSPF Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;strong&gt;Scenario 1&lt;/strong&gt;, R2, assuming area 1 is a totally stubby area receives only a default route, thereby reducing WAN bandwidth... I think?  In &lt;strong&gt;Scenario 2&lt;/strong&gt;, R2 receives many more routes.  This seems like a trivial question, but I feel it may have a performance impact at scale.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best practice for extending area 0 across a WAN?&lt;/p&gt;&#xA;" OwnerUserId="5595" LastActivityDate="2015-07-04T14:59:41.067" Title="OSPF Backbone Area and the WAN" Tags="|cisco|ospf|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16355" PostTypeId="2" ParentId="16340" CreationDate="2015-01-27T12:54:53.213" Score="2" Body="&lt;p&gt;you should check out VRRP or HSRP (when using Cisco)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_Router_Redundancy_Protocol&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Virtual_Router_Redundancy_Protocol&lt;/a&gt;&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Hot_Standby_Router_Protocol&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Hot_Standby_Router_Protocol&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In a nutshell:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 routers will check availability, when the main disconnects, the backup takes over. These routers need to be in the same subnet doh, using 1 IP per router and 1 shared IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This shared IP is your default gateway. &lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2015-01-27T12:54:53.213" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16356" PostTypeId="1" AcceptedAnswerId="16365" CreationDate="2015-01-27T13:04:38.097" Score="2" ViewCount="3214" Body="&lt;p&gt;I'm handling some Cisco ASA with multiple context, and I'm looking for a solution where I can have RANCID handle the backup of the multiple context, but by adding the changeto system and show tech-support command to the @commandtable in rancid, RANCID bugs out and tell me that the command was not found and other times it's telling me the command was missed, by using RANCIDs catchall last in the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't seen anybody succeed with this, and therefor I write to you guys on this forum, have any of you succeeded with this solution to the problem.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Entries from google:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://permalink.gmane.org/gmane.network.rancid/6220&quot; rel=&quot;nofollow&quot;&gt;http://permalink.gmane.org/gmane.network.rancid/6220&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.shrubbery.net/pipermail/rancid-discuss/2012-July/006435.html&quot; rel=&quot;nofollow&quot;&gt;http://www.shrubbery.net/pipermail/rancid-discuss/2012-July/006435.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of these solutions seems like a good idea, but is not doable in the environment I'm working in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution I'm looking for is using the RANCID scripts available and adding functionality to the @commandtable array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="13583" LastActivityDate="2021-10-14T11:12:51.893" Title="Cisco ASA multiple context and RANCID backup" Tags="|rancid|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16357" PostTypeId="2" ParentId="16347" CreationDate="2015-01-27T13:23:23.750" Score="0" Body="&lt;p&gt;Thanks Ryan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I honestly am about to be at that part of just waiting for something horrible to go wrong.  Users are seeing downtime.  I actually had a user this morning email be that it took 5 minutes to launch a solidworks file over the network and another 5 minutes to save that file.  I am having him come into my office this afternoon to test the same file because I am gigabit into the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can understand that some people think that if it works then that's great, lets not mess with it.  I will tell you guys, to back up my wanting of a remodel, that being in an old school building cabling is laid out in the ceiling in a horrible fashion mixing power, network, and video cables with each other and leaving spools of extra cabling leading to a station up there to be found.  I pulled more than a trashcan size bundle from a switch that was removed over 2 years ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a scenario I had a PC constantly dropping connection.  I didn't have any method of troubleshooting because there were no other connection dropping into the ceiling.  I had to track down the cabling and before it even got into the ceiling the line was terminated one already.  I then had to pop ceiling tile after ceiling tile to track it all down.  It took me a few hours and I found 2 switches piggybacking off one another in another room.  I replaced it with a 16 port switch but what I found around the switch would amaze you.  Almost every connection to that switch had a spool of cabling that then terminated again with a random keystone jack then ran another cable to actually get to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC---------{terminates at keystone randomly in the ceiling}---------[switch]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its this kind of thing that is found all over the building.  I have multiple users struggling to stream solidworks and CAMworks files over the networks to their desktops but cant because it crashes.  They have to pull the file off the network to their local PC then open it, work on it, save it, then put it back on the network.  I personally think it needs done, especially with some of the projects he wants to come down the line including VOIP and IP Cameras.&lt;/p&gt;&#xA;" OwnerUserId="13578" LastActivityDate="2015-01-27T13:23:23.750" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16358" PostTypeId="1" AcceptedAnswerId="16359" CreationDate="2015-01-27T14:33:21.760" Score="4" ViewCount="3612" Body="&lt;p&gt;I would really appreciate some clarification in the following matter.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What I'm seeing&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I'm looking at two different SRX210 firewalls and specifically at their &lt;em&gt;ipsec&lt;/em&gt; stanza.&#xA;I'm seeing the following which makes me wonder about &lt;em&gt;proxy-identity&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;admin@firewall&amp;gt; show configuration security ipsec vpn &amp;lt;vpn-name&amp;gt;&#xA;bind-interface st0.1;&#xA;ike {&#xA;    gateway &amp;lt;gateway&amp;gt;;&#xA;    proxy-identity;&#xA;    ipsec-policy &amp;lt;policy-name&amp;gt;;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I make a questionmark after &lt;em&gt;ike&lt;/em&gt;, the following is produced which is of no help to me in understanding this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;admin@firewall# set security ipsec vpn &amp;lt;vpn-name&amp;gt; ike ?&#xA;Possible completions:&#xA;&amp;gt; proxy-identity       IPSec proxy-id to use in IKE negotiations&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;The question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;What are the effects, if any, by entering nothing after &lt;em&gt;proxy-identity&lt;/em&gt; in the configuration of a SRX?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Mark: all names and identites have been replaced for security sakes&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="10602" LastActivityDate="2015-04-22T12:21:39.830" Title="Juniper SRX blank proxy-identity" Tags="|vpn|ipsec|juniper-junos|srx|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16359" PostTypeId="2" ParentId="16358" CreationDate="2015-01-27T15:21:21.027" Score="3" Body="&lt;p&gt;Proxy-identity defaults to whatever you have set on the policy (in case of policy-based VPN). In case of route-based VPN, it defaults to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;proxy-identity {&#xA;   local 0.0.0.0/0;&#xA;   remote 0.0.0.0/0;&#xA;   service any;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Proxy-identity is used only for negotiating the IKE phase of the VPN, and has to mirror the proxy-identity that is set on the other site of the VPN tunnel. It has no effect on actually routing or permitting traffic through the tunnel once it has been established, that has to be done with routes and/or policies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is easily verified if you have access to Juniper routers where you can mess around with the VPN settings.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;no proxy-identity settings&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Testing default settings without mentioning proxy-identity.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpn ike-vpn {&#xA;    bind-interface st0.0;&#xA;    ike {&#xA;        gateway gw-vpn;&#xA;        ipsec-policy ipsec-phase2-policy;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The VPN is established, using 0.0.0.0/0 as local and remote subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@srx-01&amp;gt; show security ipsec security-associations detail&#xA;  ID: 131073 Virtual-system: root, VPN Name: ike-vpn&#xA;  Local Gateway: 192.168.159.133, Remote Gateway: 192.168.159.128&#xA;  Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)&#xA;  Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;real proxy-identity settings&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;As a second test, I've added real proxy-identity settings to match my remote and local subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpn ike-vpn {&#xA;    bind-interface st0.0;&#xA;    ike {&#xA;        gateway gw-vpn;&#xA;        proxy-identity {&#xA;            local 10.2.1.0/24;&#xA;            remote 10.1.1.0/24;&#xA;        }&#xA;        ipsec-policy ipsec-phase2-policy;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As expected, the tunnel is established using the proper local and remote subnet information: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@srx-01# run show security ipsec security-associations detail&#xA;  ID: 131073 Virtual-system: root, VPN Name: ike-vpn&#xA;  Local Gateway: 192.168.159.133, Remote Gateway: 192.168.159.128&#xA;  Local Identity: ipv4_subnet(any:0,[0..7]=10.2.1.0/24)&#xA;  Remote Identity: ipv4_subnet(any:0,[0..7]=10.1.1.0/24)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;blank proxy-identity&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Now I'll remove the local and remote subnets from the proxy-identity stanza:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpn ike-vpn {&#xA;    bind-interface st0.0;&#xA;    ike {&#xA;        gateway gw-vpn;&#xA;        proxy-identity;&#xA;        ipsec-policy ipsec-phase2-policy;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The tunnel is reastablished using 0.0.0.0/0 as local and remote subnets.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@srx-02# run show security ipsec security-associations detail&#xA;  ID: 131073 Virtual-system: root, VPN Name: ike-vpn&#xA;  Local Gateway: 192.168.159.128, Remote Gateway: 192.168.159.133&#xA;  Local Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)&#xA;  Remote Identity: ipv4_subnet(any:0,[0..7]=0.0.0.0/0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In other words, my assumption is correct and leaving the stanza blank means the router uses its default settings.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastEditorUserId="8049" LastEditDate="2015-01-29T13:04:42.660" LastActivityDate="2015-01-29T13:04:42.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16360" PostTypeId="1" AcceptedAnswerId="16364" CreationDate="2015-01-27T15:44:09.373" Score="0" ViewCount="160" Body="&lt;p&gt;I'm currently building a virtual private cloud on AWS EC2 using CentOS and am considering allowing access to the cloud via an SSL VPN server. I've never seen a company that uses an SSL VPN, however; I've only seen companies use IPSec.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there currently a consensus amongst network admins regarding SSL VPN Security? Something along the lines of &quot;It just isn't as secure, because it's higher up the stack and uses SSL, which is not difficult for serious organizations to compromise&quot;? Or is there really no consensus to speak of?&lt;/p&gt;&#xA;" OwnerUserId="13584" LastActivityDate="2015-01-27T17:59:40.067" Title="SSL VPN Security" Tags="|vpn|ipsec|sslvpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16362" PostTypeId="1" AcceptedAnswerId="16366" CreationDate="2015-01-27T17:27:06.233" Score="1" ViewCount="337" Body="&lt;p&gt;To phrase it as it's phrased more commonly:&#xA;What does &lt;code&gt;RTT/T&lt;/code&gt; tell us?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen this formula - Transmission Efficiency - mentioned a lot when it comes to networks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;β = RTT/T&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But what exactly does this mean? Why is it useful? What's the intuition behind it?&lt;/p&gt;&#xA;" OwnerUserId="6026" LastActivityDate="2015-01-27T18:11:40.213" Title="What does Round Trip Time / Transmission Time tell us?" Tags="|broadcast|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16363" PostTypeId="1" CreationDate="2015-01-27T17:43:04.920" Score="2" ViewCount="1203" Body="&lt;p&gt;As a follow-up to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7989/generate-list-of-subnets-on-switch-using-snmp&quot;&gt;Generate list of subnets on switch using SNMP?&lt;/a&gt;, we would like to do the same thing for IPv6 - i.e. poll all of our routers (Juniper and Cisco, at least for now) to identify which IPv6 subnets are active on which interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPv4 it's fairly straightforward to get the ipAdEntAddr and ipAdEntIfIndex, and with the former we can then get the ipAdEntNetMask for each address found.  (In our environment we also get the ifAlias; if the combination of these doesn't match what's in our database then we start looking for typos in either the config or the database.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPv6 it's not so obvious how to do get this information; it looks like in the IP-MIB we could query the ipAddressTable, but so far all attempts I've made have returned &quot;IP-MIB::ipAddressTable = No Such Object available on this agent at this OID&quot;.  On the other hand I've tried a few things using the IPv6-MIB, but from these all I've gotten is &quot;IPv6-MIB::ipv6MIBObjects: Unknown Object Identifier&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm clearly missing something; assistance would be appreciated!&lt;/p&gt;&#xA;" OwnerUserId="13586" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-01-30T01:04:49.810" Title="Generate list of IPv6 subnets on router using SNMP?" Tags="|ipv6|subnet|snmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16364" PostTypeId="2" ParentId="16360" CreationDate="2015-01-27T17:59:40.067" Score="2" Body="&lt;p&gt;Many companies implement SSL VPN as the preferred method of choice for accessing internal resources securely.  Mainly, the rise in SSL VPN popularity is due to the ease of deploying the software -- often as simple as going to a web URL and installing the plug in that the browser automatically asks you to install.  Much like installing Flash or Silverlight.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where as with IPsec VPN CLients, the client software usually has to be manually installed.  Which isn't notably difficult (the usual double click, next, next, agree, install, finish).  But it does involve a manual process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of security, you can go ahead and consider them equally sufficiently secure.  That is the current industry consensus (at least from the portion of the industry that I have been exposed to).  It is also about as much as can be explained in this context, on the Network Engineering stack exchange.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I will point out, that if you really break down the cryptography of it, IPsec VPNs can be considered &lt;em&gt;slightly&lt;/em&gt; more secure because of the order and method it employs Encryption and Authentication.  Namely, &lt;a href=&quot;https://crypto.stackexchange.com/questions/202/should-we-mac-then-encrypt-or-encrypt-then-mac/354#354&quot;&gt;IPsec does Encryption then Authentication, and SSL does Authentication then Encryption&lt;/a&gt;.  But the discussion of what that is and why one is &quot;better&quot; than the other is beyond the scope of your question, and even this particular stack exchange community.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:48:27.740" LastActivityDate="2015-01-27T17:59:40.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16365" PostTypeId="2" ParentId="16356" CreationDate="2015-01-27T18:05:06.840" Score="2" Body="&lt;p&gt;This took a bit of hacking of the RANCID code to deal with - nothing terribly complicated, I basically run one remote &lt;code&gt;show context&lt;/code&gt; up front and use the output from this to build the command list for the rest of the script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a few code snippets to show what I did (sorry about the funky formatting, I'm new to this site and don't know all the tricks yet):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;\##### Main&#xA;&#xA;\# Get the list of contexts from the FW.  fwsmlogin handles multi-context ASAs.&#xA;open(INPUT,&quot;fwsmlogin -t $timeo -c \&quot;changeto system;show context\&quot; $host &amp;lt;/dev/null |&quot;) || die &quot;fwsmlogin failed for $host: $!\n&quot;;&#xA;&#xA;$ContextFlag = 0;&#xA;$ModeFlag = 0;&#xA;&#xA;while (&amp;lt;INPUT&amp;gt;) {&#xA;    tr/\015//d;&#xA;&#xA;    print STDERR (&quot;Processing line: $_&quot;) if ($DEBUG);&#xA;&#xA;    if ( /^Context Name/ ) {&#xA;        $ContextFlag = 1;&#xA;        if ( / Mode / ) {$ModeFlag = 1}&#xA;    }&#xA;&#xA;    if ( /Connection.*closed/ ) {&#xA;        print STDERR (&quot;\nDEBUG: Connection closed\n\n&quot;) if ($DEBUG);&#xA;        $clean_run=1;&#xA;        last;&#xA;    }&#xA;&#xA;    if ( /^Error:/ ) {&#xA;        print STDOUT (&quot;$host fwsmlogin error: $_&quot;);&#xA;        print STDERR (&quot;$host fwsmlogin error: $_&quot;) if ($DEBUG);&#xA;        $clean_run=0;&#xA;        last;&#xA;    }&#xA;&#xA;    if ( /^Total active Security Contexts: (\d+)/ ) {&#xA;        $ContextCount = $1;&#xA;        last;&#xA;    }&#xA;&#xA;    if ( $ContextFlag ) {&#xA;        if ( $ModeFlag &amp;amp;&amp;amp; /^.(\S+)\s+\S+\s+\S+\s+\S+\s+\S+$/ ||&#xA;            !$ModeFlag &amp;amp;&amp;amp; /^.(\S+)\s+\S+\s+\S+\s+\S+$/ ) {&#xA;            print STDERR (&quot;$host matched context $1\n&quot;) if ($DEBUG);&#xA;            push @ContextList, $1;&#xA;            next;&#xA;        }&#xA;    }&#xA;}&#xA;close INPUT;&#xA;&#xA;print STDERR (&quot;\nDEBUG: Preprocessing found $ContextCount contexts: @ContextList\n\n&quot;) if ($DEBUG);&#xA;&#xA;if (scalar @ContextList ne $ContextCount) {&#xA;    print STDERR (&quot;\nERROR: Context count mismatch, count = $ContextCount, List = @ContextList\n\n&quot;);&#xA;    exit 1;&#xA;}&#xA;&#xA;%commands=(&#xA;        'changeto context'              =&amp;gt; &quot;ChangeContext&quot;,&#xA;        'changeto system'                       =&amp;gt; &quot;IgnoreOutput&quot;,&#xA;        'dir all-filesystems'           =&amp;gt; &quot;DirAll&quot;,&#xA;        'show context'                  =&amp;gt; &quot;ShowFWContext&quot;,&#xA;        'show failover'                 =&amp;gt; &quot;ShowFailover&quot;,&#xA;        'show mode'                     =&amp;gt; &quot;ShowMode&quot;,&#xA;        'show resource acl-partition'   =&amp;gt; &quot;ShowResourceACL&quot;,&#xA;        'show resource allocation'      =&amp;gt; &quot;ShowResourceAlloc&quot;,&#xA;        'show resource partition'       =&amp;gt; &quot;ShowResourcePart&quot;,&#xA;        'show resource rule'            =&amp;gt; &quot;ShowResourceRule&quot;,&#xA;        'show resource usage'           =&amp;gt; &quot;ShowResourceUsage&quot;,&#xA;        'show run'                      =&amp;gt; &quot;ShowRun&quot;,&#xA;        'show version'                  =&amp;gt; &quot;ShowVersion&quot;&#xA;);&#xA;&#xA;.&#xA;.&#xA;.&#xA;&#xA;\## Add the commands to pull the config for each context&#xA;foreach my $context (@ContextList) {&#xA;    $commands{&quot;changeto context $context&quot;} = &quot;ChangeContext&quot;;&#xA;    push @commands, &quot;changeto context $context&quot;, &quot;show failover&quot;, &quot;show run&quot;;&#xA;}&#xA;&#xA;$cisco_cmds=join(&quot;;&quot;,@commands);&#xA;$cmds_regexp=join(&quot;|&quot;,@commands);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think this is all you really need to handle multiple contexts - if you're reasonably familiar with Perl it shouldn't be too hard to see how this works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside, I've also moved most of the subroutines into separate libraries, so when working on custom versions I can include the needed ones with appropriate &quot;use lib&quot; and &quot;use&quot; statements - for example customized scripts for CatOS devices will have this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;use lib '/home/rancid/lib';&#xA;use RANCIDsubs;&#xA;use CatOSsubs;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;while for IOS devices we replace &quot;use CatOSsubs&quot; with &quot;use IOSsubs&quot;; for our ACE30 and ACE4710 devices with &quot;use ACEsubs&quot;; for Force10 switches with &quot;use F10subs&quot;, etc.  This makes it a lot easier to write custom RANCID scripts for whatever purpose you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for fwsmlogin, over the years I've created many customized versions of clogin for various other device types; fwsmlogin is one of these.  It's not very different from clogin - I mostly added comments and deleted unneeded code (for example &quot;proc label&quot;, which is unnecessary since we don't use Xterm).  The only important change is right at the end of this script, as the command needed on the firewalls to disable paging is different from that needed in IOS/CatOS.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To create your own fwsmlogin, edit a copy of clogin, find the &quot;elseif { $do_script }&quot; line near the end of of the file, and change the section that follows to look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    :&#xA;    :&#xA; } elseif { $do_script } {&#xA;    send &quot;term pager 0\r&quot;&#xA;    sleep 0.2&#xA;    expect -re $prompt  {}&#xA;    source $sfile&#xA;    close&#xA; } else {&#xA;    :&#xA;    :&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your formatting may look different, but it shouldn't be too hard to figure this out.&lt;/p&gt;&#xA;" OwnerUserId="13587" LastEditorUserId="13587" LastEditDate="2015-01-29T22:44:16.333" LastActivityDate="2015-01-29T22:44:16.333" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16366" PostTypeId="2" ParentId="16362" CreationDate="2015-01-27T18:11:40.213" Score="2" Body="&lt;p&gt;The transmission time reflects how long it takes for a device to push a packet onto the wire at line rate - it's purely a function of packet size and bit rate.  The round-trip time adds in the speed-of-light delays, queueing delays, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See:&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Transmission_time&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Transmission_time&lt;/a&gt;, ...Round-trip_delay_time and ...Bandwidth-delay_product&lt;/p&gt;&#xA;" OwnerUserId="13587" LastActivityDate="2015-01-27T18:11:40.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16375" PostTypeId="1" AcceptedAnswerId="17958" CreationDate="2015-01-28T10:23:20.360" Score="3" ViewCount="1293" Body="&lt;h3&gt;Assumption:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Your interest lies in logging each and every session&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Approach 1&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;You configure the session logging within each and every policy, for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security policies from-zone trust to-zone untrust policy policy-1 match source-address any&#xA;set security policies from-zone trust to-zone untrust policy policy-1 match destination-address any&#xA;set security policies from-zone trust to-zone untrust policy policy-1 match application any&#xA;set security policies from-zone trust to-zone untrust policy policy-1 then permit&#xA;set security policies from-zone trust to-zone untrust policy policy-1 then log session-init&#xA;set security policies from-zone trust to-zone untrust policy policy-1 then log session-close&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Approach 2&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;You configure session logging in the &lt;em&gt;groups&lt;/em&gt; stanza and &lt;strong&gt;omit&lt;/strong&gt; logging in policies:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set groups log-all security policies from-zone &amp;lt;*&amp;gt; to-zone &amp;lt;*&amp;gt; policy &amp;lt;*&amp;gt; then log session-init&#xA;set groups log-all security policies from-zone &amp;lt;*&amp;gt; to-zone &amp;lt;*&amp;gt; policy &amp;lt;*&amp;gt; then log session-close&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Question&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;What are the performance effects to be gained by approaching session logging in two different manners within JUNOS like showed above, if any?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I'm thinking that there will be less configuration to read/write which would effect the performance when commiting and transfering the configuration. Listing all effects on the two different scenarios would be a great reference.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="10602" LastActivityDate="2015-04-18T09:01:15.710" Title="Performance differences of logging session-init and session-close invididually compared to through apply-groups" Tags="|juniper-junos|juniper-srx|performance|logging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16378" PostTypeId="1" CreationDate="2015-01-28T12:39:36.027" Score="3" ViewCount="749" Body="&lt;p&gt;I plan to replace a Juniper EX4200 that was configured a vlan default gateway, for less downtime, I will setup a new EX4200, copy configuration and transfer network cables from the old switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if the new switch online, it will be two duplicate gateway ip exist on the network, the routing will be failed, how can I fixed this problem? Thanks&lt;/p&gt;&#xA;" OwnerUserId="13597" LastActivityDate="2015-01-29T14:45:07.370" Title="How can i changeover gateway to new switch with less downtime?" Tags="|switch|router|juniper-junos|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16380" PostTypeId="2" ParentId="7203" CreationDate="2015-01-28T14:06:04.200" Score="0" Body="&lt;p&gt;it was my problem too.&#xA;you should create tow static route:&#xA;one of them referred to ISP1 and another to ISP2 , but ISP1's distance is 1 and ISP2's distance is 2.&#xA;in this situation all client go out through ISP1 and if ISP1 is failed it is transferred to &#xA;ISP2 .&#xA;I wish you good luck.&lt;/p&gt;&#xA;" OwnerUserId="13600" LastActivityDate="2015-01-28T14:06:04.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16381" PostTypeId="2" ParentId="16378" CreationDate="2015-01-28T14:10:19.920" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;...and transfer network cables from the old switch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you move the cabling from the currently active switch to the new switch, the new switch will become the only available gateway on the network since the old switch no longer has any cables connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest configuring the new EX4200 without cables connected(except console) and when you are done, shut the old one down, remove all cables from the old switch and plug them into the new. To minimize downtime keep the new switch running before you shut the old one down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However you approach this you will not be able to make the swap without network down-time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this does not answer your question, please try to describe in more detail what issue you are facing.&lt;/p&gt;&#xA;" OwnerUserId="10602" LastActivityDate="2015-01-28T14:10:19.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16382" PostTypeId="1" CreationDate="2015-01-28T16:04:46.803" Score="2" ViewCount="3120" Body="&lt;p&gt;I have an existing data network of 192.168.1.0/24 consisting of a switch and SonicWall TZ200. I am adding an Avaya switch for their new phone system. I created 2 vlans on the new switch - one for their existing data network and a second for the phone subnet 192.168.2.0/24. I can ping back and forth across the switch all day, but I can't get my phone system controller at 192.168.2.30 to ping 192.168.1.1 (default gateway of the router.) I have static route on switch 0.0.0.0 0.0.0.0 192.168.1.1 1 but still nothing. Switch is live in production - waiting to put phone system live when I can get this. Phone system has to access internet time server. Any help??&lt;/p&gt;&#xA;" OwnerUserId="13602" LastActivityDate="2015-04-29T20:31:19.337" Title="Cannot get 2nd vlan to access internet or ping router gateway" Tags="|switch|router|vlan|sonicwall|ping|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16383" PostTypeId="1" CreationDate="2015-01-28T16:37:33.290" Score="2" ViewCount="11859" Body="&lt;p&gt;We have a small, local ISP that is having some networking issues and I'm trying to understand the cause to better communicate with their network guys. I work with a number of companies with different network/router configurations using their service (dsl). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a range of issues but the most repeatable one is that packets are dropped when using a large amount of bandwidth. For example, when I run a speed test and I have a couple pings running at the same time, I see packet loss go to 50 percent and latency go to 10 times what it was. This happens regardless of the customer's configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen the same thing happen when someone is, for example, uploading an album to facebook. All other wan traffic becomes unstable, with high latency and lots of dropped packets. Even when we are not using much bandwidth, however, we still see intermittent packet loss and often unexpectadly high latency's for customers on their network. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For a novice network admin trying to understand the issue, is the&#xA;most likely culprit here a problem with the DSL equipment or an&#xA;insufficient router to handle their traffic?  &lt;/li&gt;&#xA;&lt;li&gt;How can I test to better understand what is going on?  &lt;/li&gt;&#xA;&lt;li&gt;What would be the best way to&#xA;demonstrate the problem to them (and that it is happening for all&#xA;their customers), so as to provide their networking guy with the&#xA;necessary info to resolve the problem?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="845" LastActivityDate="2018-12-10T13:08:36.883" Title="What causes packet loss when using full bandwidth from ISP?" Tags="|routing|latency|isp|packet-loss|adsl|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="16385" PostTypeId="1" CreationDate="2015-01-28T19:33:12.803" Score="3" ViewCount="2017" Body="&lt;p&gt;im trying to find the reason why cisco switches have a base mac-address and one for each port?? Can anyone help me to understand this..&lt;/p&gt;&#xA;" OwnerUserId="13605" LastActivityDate="2016-06-03T07:24:29.573" Title="Why cisco switches have many mac-addresses?" Tags="|switch|" AnswerCount="2" CommentCount="1" ClosedDate="2015-01-29T01:59:41.043" ContentLicense="CC BY-SA 3.0" />
  <row Id="16386" PostTypeId="2" ParentId="16385" CreationDate="2015-01-28T19:38:33.817" Score="2" Body="&lt;p&gt;The MAC address is the &quot;hardware address&quot; which uniquely identifies a virtual device (such as an SVI or loopback interface), a host, a port or what-have-you at Layer 2 of your network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These extra MAC addresses are utilized by managed devices (such as Cisco switches) to provide additional functionality beyond that of a &quot;dumb&quot; switch or hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understanding the 7-Layer OSI Networking Model is critical to your understanding and troubleshooting of networking issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/OSI_model&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2912" LastEditorUserId="775" LastEditDate="2015-01-28T20:06:24.727" LastActivityDate="2015-01-28T20:06:24.727" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16387" PostTypeId="2" ParentId="16351" CreationDate="2015-01-28T20:57:33.087" Score="4" Body="&lt;p&gt;There is no one &quot;best practice,&quot; but rather several &quot;good practices&quot; and a few &quot;not-so-good practices.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, if you have multiple areas, you want the hub and spokes in the same area, and summarize between the hub and the rest of the LAN network.  You can make the whole hub and spoke area totally stubby.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility is to break up the spokes into a few (no more than 2-3) areas, with the hub as the ABR.  The most important factor that would make this design preferable is the relative instability of your WAN and remote LAN links.  If you have a lot of links going up and down, this will affect the amount of flooding over the WAN and therefore the link utilization.  But for 50 routes or so, that shouldn't be a problem for a T1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=1763921&amp;amp;seqNum=6&quot; rel=&quot;nofollow&quot;&gt;Here is some more design information&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-01-28T20:57:33.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16389" PostTypeId="2" ParentId="16385" CreationDate="2015-01-28T22:10:27.230" Score="2" Body="&lt;p&gt;As far as I know a switch uses its own MAC address when it needs to send traffic on the control plane. It does not use them when it's performing switching.&lt;/p&gt;&#xA;" OwnerUserId="13605" LastEditorDisplayName="user10222" LastEditDate="2016-06-03T07:24:29.573" LastActivityDate="2016-06-03T07:24:29.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16390" PostTypeId="1" CreationDate="2015-01-29T00:30:30.757" Score="2" ViewCount="602" Body="&lt;p&gt;I'm running a Vyatta based BGP-router with multiple transit providers which send full BGP tables. I'd like to reduce the load generated by route-calculation but want to keep some possibility of choosing AS-paths. Therefore, just asking for only default-routes is not an option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it make a significant difference in performance whether to ask the transit providers to send less (partial) routes or to keep full-tables and filter with route-maps. &lt;/p&gt;&#xA;" OwnerUserId="13610" LastEditorUserId="2142" LastEditDate="2015-03-01T02:05:32.037" LastActivityDate="2015-03-01T15:18:52.420" Title="Should I ask for fewer routes or use a route-map to reduce table-size?" Tags="|bgp|route-filter|quagga|vyos|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16391" PostTypeId="2" ParentId="16390" CreationDate="2015-01-29T02:27:13.693" Score="4" Body="&lt;p&gt;If the providers can filter their updates for you, then that's fewer prefixes to be sent over your links, and fewer for you to process.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common technique is for providers to send you their AS and directly connected customer AS's, in addition to a default route.  For AS's that are farther away, it may not matter which provider you use to get there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that you can control outbound traffic paths, but you're limited in what can you do for inbound traffic.  So one link will probably be used more than the other.  If you're really interested in balancing (outbound) traffic, you can adjust local preference for particular AS paths. But at some point, it will be more trouble than it's worth.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-01-29T02:27:13.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16392" PostTypeId="2" ParentId="16383" CreationDate="2015-01-29T02:57:16.080" Score="5" Body="&lt;p&gt;There are a number of possibilities here, not limited to, but including:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The CPE's CPU is maxing out. (CPE=Customer Premesis Device)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the specifications for the router you are using to make sure it can support the level of traffic you're trying to push. Try and graph the CPE's CPU if you are unsure.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Bufferbloat in your ISP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your ISP has configured traffic shaping for DSL tails (to avoid tail dropping packets) - they may have configured their buffer size too large. A good way to tell is by maxing out your connection in the downstream (download) direction. If your latency goes up by 200ms or more, this is probably a problem with your ISP's shaping configuration for DSL tails, and you should complain. They should reduce their buffer depth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd suggest &gt;50ms of buffer is harmful.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The upstream of your xDSL is being maxed out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember on most DSL technologies, bandwidth is asymmetric. Thus it takes a much smaller amount of traffic to congest the upstream (upload) on most DSL technologies than the downstream. &#xA;Make sure you aren't congesting upstream.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Remember tools that graph links are usually averaging samples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tools like rrdtool (and cacti and NMIS and...) are usually showing you a 5-minute sample average of your links. This makes them poor for identifying situations where a user congests a link for 10 seconds or so. That'll just appear as a small bump on a 5-minute-sampled graph. Look for tools which can give you a 'high water mark' of the link as well as a rolling average.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13611" LastActivityDate="2015-01-29T02:57:16.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16393" PostTypeId="2" ParentId="16378" CreationDate="2015-01-29T10:09:37.423" Score="3" Body="&lt;p&gt;To be clear, there are two sub-issues worth identifying--the gateway and the ports.  Moving the ports is relatively easy if you connect the two switches together via an ethernet-switching port (I personally use trunks between all switches), copy the remaining port configurations over, then move cables one-at-a-time.  This lets you control which ports (and potentially users/services) go down at what time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best answer for the gateway is to setup VRRP for that gateway, but it still will require 2 short down times, and has enough configuration gotchas that it may not be worth the time invested.  I suggest trunking the two switches together, then simply remove the vlan from one and add it to the other.  Using Juniper for both switches, you get the advantage of the commit button.  Load your command set on each, the just commit on the first, wait until it completes, then commit on the second.  Failback is just as easy: rollback on new, wait, rollback on old.&lt;/p&gt;&#xA;" OwnerUserId="13537" LastActivityDate="2015-01-29T10:09:37.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16398" PostTypeId="1" AcceptedAnswerId="16403" CreationDate="2015-01-29T14:09:10.840" Score="2" ViewCount="88" Body="&lt;p&gt;I need to patch a fiber connection from a red secured (keyed) wall port to an unsecured (not-keyed) media converter. It is LC to LC Multimode Duplex. Who sells a secured to unsecured patch cable? Will I have to make this type of cable?&lt;/p&gt;&#xA;" OwnerUserId="13624" LastActivityDate="2015-01-29T15:25:28.970" Title="How to patch fiber connection from secured to unsecured ports" Tags="|cabling|fiber|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16400" PostTypeId="2" ParentId="16378" CreationDate="2015-01-29T14:45:07.370" Score="2" Body="&lt;p&gt;As others have said, you'll want to utilize VRRP to get one ready for the transition.  Since you're using the vlan subinterface as the gateway for your vlan, you'll want a configuration similar to below.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are sample configurations for the master that I stood up.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00528CAN01# show interfaces vlan.1&#xA;family inet {&#xA;    address 10.1.1.2/24 {&#xA;        vrrp-group 1 {&#xA;            virtual-address 10.1.1.1;&#xA;            priority 254;&#xA;            fast-interval 100;&#xA;            preempt;&#xA;            accept-data;&#xA;            advertisements-threshold 10;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And an example of the backup.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00528AN02# show interfaces vlan.1&#xA;family inet {&#xA;    address 10.1.1.3/24 {&#xA;        vrrp-group 1 {&#xA;            virtual-address 10.1.1.1;&#xA;            priority 126;&#xA;            fast-interval 100;&#xA;            preempt;&#xA;            accept-data;&#xA;            advertisements-threshold 10;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Take note of the priorities as the higher, the more preferable a &lt;code&gt;master&lt;/code&gt; it will be.  One thing that always screwed with me was the &lt;code&gt;accept-data&lt;/code&gt; configuration statement.  A VRRP speaker will &lt;strong&gt;not&lt;/strong&gt; accept data on a virtual address unless it has that explicitly configured, or if the virtual address is the same as the interface address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now verify that the master is talking.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00528CAN01&amp;gt; show vrrp brief&#xA;Interface     State       Group   VR state VR Mode   Timer    Type   Address&#xA;vlan.1        up              1   master   Active      A  0.043 lcl    10.1.1.2&#xA;                                                                vip    10.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then ensure the backup sees the master advertising.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rj@MHN00528AN02&amp;gt; show vrrp brief&#xA;Interface     State       Group   VR state VR Mode   Timer    Type   Address&#xA;vlan.1        up              1   backup   Active      D  0.994 lcl    10.1.1.3&#xA;                                                                vip    10.1.1.1&#xA;                                                                mas    10.1.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the configuration statements above (taking into account the &lt;code&gt;fast-interval&lt;/code&gt; and &lt;code&gt;advertisements-threshold&lt;/code&gt; values) you would achieve a 1 second failover time.  Depending on your environment and how critical this vlan is, you may want less or more.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2015-01-29T14:45:07.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16403" PostTypeId="2" ParentId="16398" CreationDate="2015-01-29T15:25:28.970" Score="3" Body="&lt;p&gt;I am not aware of any &quot;standardized&quot; secure fiber connectors.  All the ones I am aware of are vendor proprietary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, I would venture to say that you would have to check with the vendor of your secured connectors to see if they have such a product.  Of the ones I have seen, they either have such a cable or they have an &quot;insert&quot; that will secure the cable to the device as well.  If they didn't, their solution wouldn't be very useful as devices will come with standard connectors and incompatible with their solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they don't have a solution for you (highly unlikely), you have three options.  Contact the vendor to see if they will make it.  Contact a third party cable manafacturer to see if they will make it.  Or, as you suggested, you will need to make it yourself.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-01-29T15:25:28.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16404" PostTypeId="1" CreationDate="2015-01-29T15:52:06.170" Score="0" ViewCount="418" Body="&lt;p&gt;I am preparing for my CCENT exam and about 3-4 month ago, I had found a method of calculating subnet. Unfortunately I did not bookmark the site and i forgot how to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I remember is how you start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You first build that table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0_____1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1_____2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2_____4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3_____8&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4_____16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5_____32&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6_____64&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7_____128&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8_____256&lt;/p&gt;&#xA;&#xA;&lt;p&gt;9_____512&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10____1024&lt;/p&gt;&#xA;&#xA;&lt;p&gt;11____2048&lt;/p&gt;&#xA;&#xA;&lt;p&gt;12____4096&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a 3rd column that you start from the middle after you are done with the first 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont remember where it starts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone have seen this way of doing it and can explain it properly or link to the site that suggest this method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Benoit Bourgault&lt;/p&gt;&#xA;" OwnerUserId="8150" LastActivityDate="2015-01-29T18:09:51.470" Title="Rediscover method of calculation Subnet" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="0" ClosedDate="2015-01-29T18:36:39.420" ContentLicense="CC BY-SA 3.0" />
  <row Id="16406" PostTypeId="2" ParentId="16404" CreationDate="2015-01-29T16:42:05.170" Score="1" Body="&lt;p&gt;I think this might be the kind of table you're referring to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mnYZD.png&quot; alt=&quot;subnet quick ref&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It came from site: &lt;a href=&quot;http://www.techrepublic.com/blog/data-center/ip-subnetting-made-easy-125343/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.techrepublic.com/blog/data-center/ip-subnetting-made-easy-125343/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2015-01-29T18:09:51.470" LastActivityDate="2015-01-29T18:09:51.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16409" PostTypeId="2" ParentId="16382" CreationDate="2015-01-29T18:55:50.947" Score="4" Body="&lt;p&gt;I believe you mean to say that the router has an IP address 192.168.1.1/24, and this is the default gateway for clients in subnet 192.168.1.0/24? The router has another default route pointing to somewhere in the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of a subnet as a house, and gateway as a door. To get into or out of the house you must use the door of that house, neighbor's door just won't do. The same way to get into or out of subnet 192.168.2.0/24 your SonicWall must have an IP address on this range. This is the IP interface it will use to route traffic into and out of this subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically you must create the Avaya VLAN in your SonicWall and give it an IP address 192.168.2.1/24. This is the IP you use as default gateway for devices in the Avaya VLAN. Then you tag the link between the switch and the SonicWall to the Avaya VLAN, and traffic should flow correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to do this configuration in a live production network without causing any disruption in the network services. &lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2015-01-29T18:55:50.947" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16411" PostTypeId="1" AcceptedAnswerId="16412" CreationDate="2015-01-29T19:37:04.583" Score="2" ViewCount="1044" Body="&lt;p&gt;I've got at least one problem of consistently high CPU on an HP 5412. It works fine while the management interface is unavailable, but i'm unable to login to SSH or the web. It seems to happen at random, and if the cpu goes over ~80% it becomes inaccessible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can login via Serial and access the commands, but it's painfully slow to display anything.&#xA;I've looked at the logs and it's pretty sparse. The only thing i can think of is there is a trunk between this switch and a Cisco UCS. It's giving some PVID mismatch, but looking at the logs it's been that way for over a year, with this CPU issue only occurring in the past few weeks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm really at a loss as to why the CPU would be so high. Normally this switch runs &amp;lt;20%. I've not dealt with networking let alone switches in years, it's been my experience that you just set them and they run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess it boils down to any idea after 1+ years of running a switch would go from 20% CPU average to 80% average. Also why would high CPU knock out the IP management interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FWIW I've rebooted the switch to no avail, if anything it's made it worse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;==Update==&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've updated firmware, and fixed the PVID issues. The CPU issue still seems to be present, The difference definitely seems to relate to usage, as the day or so it ran fine was during a weekend. I'm not seeing any egregious port usage, or anything like that. Our Toshiba phones do tend to generate errors, but nothing has really changed recently with them.  I've updated HP as well. &lt;/p&gt;&#xA;" OwnerUserId="13632" LastEditorUserId="13632" LastEditDate="2015-02-02T19:18:21.580" LastActivityDate="2015-02-02T19:18:21.580" Title="HP Procurve 5412zl Management unresponsive via IP when cpu high" Tags="|switch|management|hp-procurve|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16412" PostTypeId="2" ParentId="16411" CreationDate="2015-01-29T19:57:43.517" Score="3" Body="&lt;p&gt;There's a very simple answer. Management traffic such as SSH, HTTP, ICMP is handled by the CPU. The main purpose of the switch is traffic forwarding, and management traffic has the lowest priority. Thus when CPU is roofing, all mgmt access gets trampled underway to preserve the network services. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're running and old code you might be bumping into a SW issue. Download current SW from HPN website and upgrade. If you don't need the latest and greatest features but rather are interested in stability, go for the Maintenance release, current one is K.15.10.0015m. It has longer lifespan than the others, and new features aren't added so it will update only if there's a bugfix. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PVID mismatch is also a simple one. The PVID of Procurve is the VLAN id of the untagged VLAN. PVID mismatch shouldn't affect the CPU, but it will fill up your log with unnecessary crap. Mismatching the VLAN tagging also causes broadcasts from one subnet to spill into another which isn't a behavior you want to see. So ensure VLAN tagging matches on both ends of the link.&lt;/p&gt;&#xA;" OwnerUserId="10799" LastEditorUserId="10799" LastEditDate="2015-01-29T20:03:57.287" LastActivityDate="2015-01-29T20:03:57.287" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16414" PostTypeId="2" ParentId="2240" CreationDate="2015-01-29T22:29:39.803" Score="0" Body="&lt;p&gt;Some proprietary stuff I have used in the past,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solarwinds.com - good for SNMP stuff and network services monitoring.&#xA;not cheap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the Netgear support netflow? If so there are several good netflow graphing tools out there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I currently work for this company, so shameless plug.&#xA;&lt;a href=&quot;http://turbosoftnetworks.com/blog/78-video-real-time-traffic-monitoring&quot; rel=&quot;nofollow&quot;&gt;http://turbosoftnetworks.com/blog/78-video-real-time-traffic-monitoring&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13633" LastActivityDate="2015-01-29T22:29:39.803" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16417" PostTypeId="2" ParentId="13008" CreationDate="2015-01-29T23:50:29.940" Score="0" Body="&lt;p&gt;I would like to add to this. A network tap will sit in-line and monitors all traffic passing in/out of your switch. However, it will need to sit between the switch and the router. If you don't have a simple port to port connection this becomes more difficult.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can, like suggested above, configure your switch to mirror all traffic to a monitor port then you can monitor all traffic on the switch that way. However, I believe there will be some data loss if the traffic becomes too much for the switch to handle (check your switch specifications for specifics).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, you will need some software/hardware to view the traffic. I work for a company that develops NetScope, which works like a tap interface and sits in-line on your network. It will also monitor a mirror port on a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://turbosoftnetworks.com/blog/76-video-netscope-interactive-reports-with-historical-drill-down&quot; rel=&quot;nofollow&quot;&gt;http://turbosoftnetworks.com/blog/76-video-netscope-interactive-reports-with-historical-drill-down&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some free programs out there that will do it. Some a Linux-based ones based on ntop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ntop.org/products/ntop/&quot; rel=&quot;nofollow&quot;&gt;http://www.ntop.org/products/ntop/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13633" LastActivityDate="2015-01-29T23:50:29.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16418" PostTypeId="2" ParentId="16363" CreationDate="2015-01-30T01:04:49.810" Score="3" Body="&lt;p&gt;The answer you were given for IPv4 uses OIDs that existed before RFC4293 and RFC4292. Cisco has updated its MIBs to use protocol-independent objects in the IP-MIB and IP-FORWARD-MIB.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/ipv6_mib.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/web/about/security/intelligence/ipv6_mib.html&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To cut a long story short, instead of using the node 1.3.6.1.2.1.4.20&lt;br&gt;&#xA;try using the node 1.3.6.1.2.1.4.34&lt;br&gt;&#xA;and its subnodes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco's SNMP Object Navigator is useful for visualising the data structure of the MIB.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=ipAddressAddr&quot; rel=&quot;nofollow&quot;&gt;OID Interface Address&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="13244" LastActivityDate="2015-01-30T01:04:49.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16419" PostTypeId="2" ParentId="13008" CreationDate="2015-01-30T05:58:40.577" Score="0" Body="&lt;p&gt;If your switch supports OpenFlow you can create flows to get you the data you want. This obviously depends on your switch. Port Mirroring was a much implemented feature and many lower cost switches still implement monitoring that way.&lt;/p&gt;&#xA;" OwnerUserId="13595" LastActivityDate="2015-01-30T05:58:40.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16420" PostTypeId="1" CreationDate="2015-01-30T07:16:19.247" Score="5" ViewCount="2499" Body="&lt;p&gt;Below are the following commands I used to get the specific data that I need.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Get Port Id and Interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;snmpwalk -r:&quot;switchName&quot; -v:2 -t:10 -c:&quot;*******&quot; -os:&quot;1.3.6.1.2.1.2.2.1.2&quot; -op:&quot;1.3.6.1.2.1.2.2.1.3&quot;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Get Vlan No and Vlan Name&lt;/p&gt;&#xA;&#xA;&lt;p&gt;snmpwalk -r:&quot;switchName&quot; -v:2 -t:10 -c:&quot;*******&quot; -os:&quot;1.3.6.1.4.1.2636.3.40.1.5.1.5.1.2&quot; -op:&quot;1.3.6.1.4.1.2636.3.40.1.5.1.5.1.3&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;snmpwalk -r:&quot;switchName&quot; -v:2 -t:10 -c:&quot;*******&quot; -os:&quot;1.3.6.1.4.1.2636.3.40.1.5.1.5.1.5&quot; -op:&quot;1.3.6.1.4.1.2636.3.40.1.5.1.5.1.6&quot;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Get MAC Address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;snmpwalk -r:&quot;switchName&quot; -v:2 -t:10 -c:&quot;*******&quot; -os:&quot;1.3.6.1.2.1.2.2.1.2&quot; -op:&quot;1.3.6.1.2.1.2.2.1.3&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;snmpwalk -r:&quot;switchName&quot; -v:2 -t:10 -c:&quot;*******&quot; -os:&quot;1.0.8802.1.1.2.1.4.1.1.7&quot; -op:&quot;1.0.8802.1.1.2.1.4.1.1.8&quot;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Get Port Id and Vlan No / Interface And Vlan No&lt;/p&gt;&#xA;&#xA;&lt;p&gt;??????????????????&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Do you guys know what command/oid will I used to get the following vlan no per interface? kindly also verify OID that I used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="13635" LastEditorUserId="13635" LastEditDate="2015-01-30T07:28:07.257" LastActivityDate="2015-04-24T20:31:43.127" Title="juniper snmp oid: Retrieve the list of interface with vlan no?" Tags="|cisco|snmp|juniper-junos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16421" PostTypeId="1" CreationDate="2015-01-30T09:53:42.807" Score="0" ViewCount="755" Body="&lt;p&gt;If I have two sites from where I connect to a separate server in a remote location. From 1 site I can connect fine, i.e. good response times etc. However from the other site I cannot connect and the application I am connecting to is extremely slow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how does one go about finding the exact hop/location where the issue is being caused? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traceroute from both sites in both directions is showing no packet loss, and same response times however 1 site is still slower in loading on the client side. The client is a GUI which basically sends xmlhttp requests to the server. 1 site is fine and loading times in the client are good - however the other site the loading times are very slow and I get disconnected from the server a lot. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 3 seperate ISP's involved here. 1 network is where the server is hosted. 1 client, and the other client (the slow one). Nothing has changed from my side, i.e. I have not configured anything differently and the slowness seems to be completely random. Plus I have no visibility of how the ISP is balancing/routing etc.&lt;/p&gt;&#xA;" OwnerUserId="13636" LastEditorUserId="13636" LastEditDate="2015-01-30T16:25:14.870" LastActivityDate="2015-03-01T16:58:54.630" Title="Finding bad node in a network" Tags="|tcp|troubleshooting|" AnswerCount="1" CommentCount="8" ClosedDate="2020-12-21T17:31:55.260" ContentLicense="CC BY-SA 3.0" />
  <row Id="16422" PostTypeId="2" ParentId="16421" CreationDate="2015-01-30T10:17:26.360" Score="2" Body="&lt;p&gt;Consider using a tool like Wireshark and plug it into the network on both sites.  Be sure to test the front as well as the back of the hop/location when you do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That way, you can identify what goes right in one location, and what is different - i.e. goes wrong - on the other site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I'm telling you to test both sides of the hop/location - especially in the 'wrong' part of your networktown  ( 1. traffic going to first route point and 2. traffic going beyond route point) - is because the issue may be further down the line than your first hop.  You should be able to isolate the issue simply by following the river. :)&lt;/p&gt;&#xA;" OwnerUserId="13309" LastEditorUserId="13309" LastEditDate="2015-01-30T12:12:36.747" LastActivityDate="2015-01-30T12:12:36.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16428" PostTypeId="1" AcceptedAnswerId="16430" CreationDate="2015-01-30T23:54:00.750" Score="1" ViewCount="1429" Body="&lt;p&gt;I have remote access to a Cisco 2821 Router with a security firmware license in California with an IPSec tunnel going to a site in New York. On the New York side, there is a RFC 1918 IP scheme of &lt;strong&gt;10.0.0.0/8&lt;/strong&gt;. The LA side is &lt;strong&gt;172.17.0.0/16&lt;/strong&gt;. On the router, there is a VPN which hands out IP's by this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip local pool Pool-1 192.168.50.1 192.168.50.30*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The issue is that, when I (or any other client) connects to the VPN on a remote computer, they are given an IP address (as seen below) but are still not able to contact the &lt;strong&gt;10.0.0.0/8&lt;/strong&gt; network. They can still access the local network and the internet, but I'm not sure that access to the internet is going through the VPN. It may be going through their normal home connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/LploT.png&quot; alt=&quot;IP Addresses&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Attempted Solutions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The first thing I did was look at the routing table. It had no routes for the &lt;strong&gt;192.168.50.0/24&lt;/strong&gt; subnet, so I added some. I added the same route as the &lt;strong&gt;172.17.0.0/16&lt;/strong&gt; network since they had access, however this did not work.&lt;/li&gt;&#xA;&lt;li&gt;After that, I imagined I should have put an ACL in place to allow &lt;strong&gt;192.168.50.0/24&lt;/strong&gt; traffic. I edited the existing ACLs to no avail.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;My question:&lt;/em&gt;&lt;br&gt;&#xA;When all said and done, the IP address of the VPN clients is originating within the router and is all virtual. My question is to what interface would I apply an ACL as to allow &lt;strong&gt;192.168.50.0/24&lt;/strong&gt; traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Other Notes:&lt;/em&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I had a coworker VPN into it as well and he was not able to ping my 192.168.50.29 address.&lt;/li&gt;&#xA;&lt;li&gt;The actual IP schemes are far more complex, but for sanity's sake, I've made them nice and easy without VLSM.&lt;/li&gt;&#xA;&lt;li&gt;When I (or another client) connect to the VPN, there is a dynamic CRYPTO MAP policy added with an ACL that allows all incoming traffic to the IP, but nothing showing what it's allowed to go to...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3836" LastEditorUserId="619" LastEditDate="2015-01-31T00:48:02.400" LastActivityDate="2015-09-28T03:16:37.000" Title="Cisco VPN Clients Routing Over IPSec VPN - ACL?" Tags="|cisco|vpn|cisco-ios|access-control|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16429" PostTypeId="1" CreationDate="2015-01-31T00:06:11.640" Score="3" ViewCount="1454" Body="&lt;p&gt;Can an ASA 5525-X dynamically PAT one IP subnet of private addresses (from inside port to outside port) and simultaneously pass another subnet through without PAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a public IP address on the outside interface and another public IP subnet behind the firewall.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;outside interface - 198.98.9.1/24&lt;/li&gt;&#xA;&lt;li&gt;ISP gateway 198.98.9.2&lt;/li&gt;&#xA;&lt;li&gt;Private IP - 192.168.1.1/24. The inside interface connects to another router at 192.168.1.2/24.  That router has:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Private interface 191.167.1.1/24&lt;/li&gt;&#xA;&lt;li&gt;Public interface 187.87.7.1/27&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My goal is to dynamically PAT only IP subnet 191.167.1.0/24 and not IP subnet 187.87.7.0/27.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 198.98.9.1 255.255.255.0&#xA;&#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0 &#xA;&#xA;ASA(config)#object network PUBLIC&#xA;ASA(config-obj)#subnet 187.87.7.0 255.255.255.224&#xA;&#xA;ASA(config)#object network PRIVATE&#xA;ASA(config-obj)#subnet 191.167.1.0 255.255.255.0&#xA;&#xA;ASA(config)#object network INTERNET&#xA;ASA(config-obj)#subnet 0.0.0.0 0.0.0.0&#xA;&#xA;ASA(config)#nat (inside,outside) source dynamic PRIVATE interface&#xA;&#xA;ASA(config)#nat (inside,outside) source static PUBLIC PUBLIC destination static INTERNET INTERNET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Routing between router and asa is simple. I have default route on cisco router forward to inside asa address. And on asa default route forward to ISP address. On other direction on asa I have two static routes forward to public and private ip subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can something like this work?&lt;/p&gt;&#xA;" OwnerUserId="13652" LastEditorUserId="775" LastEditDate="2015-01-31T16:26:02.337" LastActivityDate="2015-09-19T01:37:33.150" Title="ASA 5525-X PAT only for one IP subnet" Tags="|cisco|routing|nat|firewall|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="16430" PostTypeId="2" ParentId="16428" CreationDate="2015-01-31T00:14:44.823" Score="2" Body="&lt;p&gt;Obviously you aren't using a Cisco VPN client, as it monitors the route table and will remove your &lt;em&gt;tampering&lt;/em&gt; immediately. Even if the routes stick, the ASA will ignore traffic that doesn't belong in the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two possibilities at play here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the ASA isn't configured to hairpin traffic&lt;/li&gt;&#xA;&lt;li&gt;the ASA isn't configured to allow those networks through the tunnel&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The first can be enabled via &lt;code&gt;same-security-traffic permit inter-interface&lt;/code&gt; and &lt;code&gt;same-security-traffic permit intra-interface&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second requires changes to the VPN &lt;em&gt;split-tunnel&lt;/em&gt; configuration, any ACLs restricting access, routes on other gateways to know where the vpn-pool lives, and finally ensure the site-to-site VPNs know about and allow that pool across their tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The latter is why my ASA proxy's DHCP from the local LAN for clients. It essentially makes VPN clients look like nodes on the local LAN.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[UPDATE]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With IOS, the crypto map defines what traffic goes in the tunnel(s). (&lt;code&gt;match address&lt;/code&gt; clause) That info is provided to the IPSec client. (it creates a security-association (SA) for each rule of the ACL.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(for the record, I don't use the old IPSec client engine anymore. I prefer the SSLVPN (&lt;em&gt;webvpn&lt;/em&gt;) setup on both ASA and IOS -- the setup is nearly identical. ASA-IOS tunnels are still the old, complicated &lt;code&gt;crypto map&lt;/code&gt; IPSec setup. IOS-IOS tunnels, I prefer &lt;code&gt;Tunnel&lt;/code&gt; interfaces.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-01-31T00:54:45.463" LastActivityDate="2015-01-31T00:54:45.463" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16436" PostTypeId="1" AcceptedAnswerId="16437" CreationDate="2015-02-01T01:26:53.660" Score="3" ViewCount="662" Body="&lt;p&gt;I have a Cisco 890 with IOS 15.4. &#xA;As brief summary of my configuration, FastEthernet 8 is the uplink and NATs the other interfaces (which are grouped into vlan 1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to block access to a specific host or short of that, a network block, but I'm not having luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I've got: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended wan_ipv4_out&#xA; permit tcp any any&#xA; permit ip any any&#xA; deny   tcp any 208.73.210.0 0.0.1.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then to apply it to FastEthernet&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet8&#xA; ip dhcp client client-id ascii router&#xA; ip address dhcp&#xA; ip access-group wan_ipv4_out out&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; [... snipped ipv6 stuff ..]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it doesn't seem to be working. Ideally I'd like to block any IPs that (e.g0 &quot;foo.example.com&quot; resolves to, but this is a temporary hack around a site that's causing me trouble, so I don't mind blocking a whole /23.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any help!&#xA;-Pablo&lt;/p&gt;&#xA;" OwnerUserId="13662" LastActivityDate="2015-02-01T01:50:15.577" Title="Simple egress block ACL on Cisco IOS" Tags="|cisco|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16437" PostTypeId="2" ParentId="16436" CreationDate="2015-02-01T01:50:15.577" Score="2" Body="&lt;p&gt;With Cisco ACL's, there is an implicit &lt;strong&gt;deny ip any any&lt;/strong&gt; at the end of every list. You need to explicitly state the traffic that you want to allow/deny. Note that it short-circuits on the first ACL entry it hits that it applies to, so if you're sending a packet from a host on the &lt;strong&gt;208.73.210.0/23&lt;/strong&gt; network, it will first hit this ACL entry:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit tcp any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If it is TCP, it will be allowed regardless of its source. This is a rather moot entry since the next one will allow any source IP address over any protocol. Change it to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended wan_ipv4_out&#xA;  deny tcp any 208.73.210.0 0.0.1.255&#xA;  permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the &lt;strong&gt;208.73.210.0/23&lt;/strong&gt; network will still be able to communicate to other networks over different protocols (UDP, ICMP, etc). To block all outgoing traffic, try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended wan_ipv4_out&#xA;  deny ip any 208.73.210.0 0.0.1.255&#xA;  permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will allow all traffic except &lt;em&gt;incoming traffic&lt;/em&gt; on FastEthernet8 with a source address of &lt;strong&gt;208.73.210.0/23&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3836" LastActivityDate="2015-02-01T01:50:15.577" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16438" PostTypeId="1" AcceptedAnswerId="16440" CreationDate="2015-02-01T02:21:47.233" Score="23" ViewCount="16276" Body="&lt;p&gt;I'm reading &lt;em&gt;Computer Networks - A Systems Approach 5th ed.&lt;/em&gt;, and I came across the following statistics for the speed of light through different mediums:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Copper – 2.3 × 10&lt;sup&gt;8&lt;/sup&gt; m/s&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiber – 2.0 × 10&lt;sup&gt;8&lt;/sup&gt; m/s&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, are these figures wrong, or is there another reason to explain why copper is worse than fiber?  Does fiber have better bandwidth (per volume) or something?&lt;/p&gt;&#xA;" OwnerUserId="13664" LastEditorUserId="3955" LastEditDate="2015-07-06T08:59:24.173" LastActivityDate="2021-09-28T06:37:41.743" Title="Speed of Light in Copper VS Fiber - Why is Fiber Better?" Tags="|cabling|fiber|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16439" PostTypeId="2" ParentId="13008" CreationDate="2015-02-01T03:15:53.993" Score="-1" Body="&lt;p&gt;If you want to monitor all trafic that is going through the switch, I guess you can use a network tap &gt;&gt; &lt;a href=&quot;https://greatscottgadgets.com/throwingstar/&quot; rel=&quot;nofollow&quot;&gt;https://greatscottgadgets.com/throwingstar/&lt;/a&gt;. &#xA;On the monitor station use something like wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to monitor only one port, and you have access to that switch, use port mirroring.&lt;/p&gt;&#xA;" OwnerUserId="13661" LastActivityDate="2015-02-01T03:15:53.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16440" PostTypeId="2" ParentId="16438" CreationDate="2015-02-01T03:28:15.277" Score="44" Body="&lt;p&gt;No, the numbers are right (Page 46).  If I can reword your question, it's &amp;quot;Why should I use fiber if the propagation delay is worse than copper?&amp;quot;  You are assuming that propagation delay is an important characteristic.  In fact (as you'll see a few pages later), it rarely is.&lt;/p&gt;&#xA;&lt;p&gt;Fiber has three characteristics that make it superior to copper in many (but not all) scenarios.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Higher bandwidth.  Because fiber uses light, it can be modulated at a much higher frequency than electrical signals on copper wire, giving you a much higher bandwidth.  Also the maximum modulation frequency on copper wire is highly dependent on the length -- inductance and capacitance increase with length, reducing the maximum modulation frequency.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Longer distance.  Light over fiber can travel tens of kilometers with little attenuation, which makes it ideal for long distance connections.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Less interference.   Because fiber uses light, it is impervious to electromagnetic interference.  That makes it best for &amp;quot;noisy&amp;quot; electromagnetic environments.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Electrical isolation.  Fiber does not conduct electricity, so it can electrically isolate devices.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;But fiber has drawbacks too.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Expense.  The optical transmitters and receivers can be expensive ($100's) and have more stringent environmental requirements than copper wire.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Fiber optic cable is more fragile than wire.  If you bend it too sharply, it will fracture. Copper wire is much more tolerant of movement and bending.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Difficult to terminate.  Placing a connector on a optical fiber strand requires precision tools, technique, and expertise.  Fiber cables are usually terminated by trained specialists.  In comparison, you can terminate a copper cable in seconds with little or no training.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="54822" LastEditDate="2020-09-04T13:03:54.157" LastActivityDate="2020-09-04T13:03:54.157" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="16442" PostTypeId="1" AcceptedAnswerId="16444" CreationDate="2015-02-01T07:37:11.930" Score="2" ViewCount="506" Body="&lt;p&gt;I am looking for a way to server clients a different IP based on location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a Casper administrator (Mac management using software by JAMF Software) and manage over 75 distribution servers globally. Mac clients receive software and patches from these 75 distribution server over https. Today, I am scoping individual site subnets to specific server in the Casper admin console. When a client checks in to Casper for any pending policies, the clients IP is evaluated against the Casper servers subnet list and then told which specific distribution server to go get packages from. This method has a lot of overhead because I must update the list of subnets and servers in Casper manually. The company has two private class A subnets which are not super-netable for physical sites and changes constantly. I'm also limited in what network information is available to me because management of the corporate network is outsourced. However I know the product VitalQIP is being used for DHCP/DNS control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is when a Mac checks in to Casper to get its policies, the Casper server returns something like &quot;distribution.company.com&quot; as the DNS name for the distribution server the client should use. Then when the client looks up the servers IP address, DNS serves the IP of the distribution server closest to the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm fairly new to DNS and am still researching the subject. Any advise or guidance would be helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for reference, a client downloads software from the distribution server using a http get request with simple password authentication using a link similar to this one: &lt;a href=&quot;https://server-hostname-01.company.com/CasperShare/Packages/Security%20patch%201.pkg&quot; rel=&quot;nofollow&quot;&gt;https://server-hostname-01.company.com/CasperShare/Packages/Security%20patch%201.pkg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="170" LastActivityDate="2015-02-01T09:47:15.883" Title="Serve a different server IP to clients based on locations" Tags="|dns|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16443" PostTypeId="1" CreationDate="2015-02-01T08:50:06.600" Score="2" ViewCount="2423" Body="&lt;p&gt;am a bit confused on how this &quot;Secondary network IP address on a different subnet&quot; work.&#xA;&lt;a href=&quot;http://www.watchguard.com/help/docs/wsm/xtm_11/en-US/index.html#cshid=en-US/networksetup/second_net_config_c.html&quot; rel=&quot;nofollow&quot;&gt;http://www.watchguard.com/help/docs/wsm/xtm_11/en-US/index.html#cshid=en-US/networksetup/second_net_config_c.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the diagram I see the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Internal interface assigned with an IP of 10.10.10.254 and&#xA;172.16.1.254.&lt;/li&gt;&#xA;&lt;li&gt;Machines in the subnets 10.10.10.x and 172.16.1.x connected to this interface.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&#xA;  In other words, this is what I can visualize.&lt;br&gt;&#xA;  10.10.10.x subnet &amp;lt;--&amp;gt; &lt;b&gt;Switch&lt;/b&gt; &amp;lt;--&amp;gt; Watchguard Interface&lt;br&gt;&#xA;  172.16.1.x subnet ------^&#xA;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how can a switch be connected to two different subnets or networks?  Given we have 2 subnets, don't we need a router to route the traffic from this interface to the 2 subnets like in the following configuration?.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&#xA;  10.10.10.x subnet &amp;lt;--&amp;gt; &lt;b&gt;Router&lt;/b&gt; &amp;lt;--&amp;gt; Watchguard Interface&lt;br&gt;&#xA;  172.16.1.x subnet ------^&#xA;&lt;/p&gt;&#xA;" OwnerUserId="2982" LastEditorUserId="2982" LastEditDate="2015-02-01T09:04:16.640" LastActivityDate="2015-02-02T12:45:20.107" Title="How does Watchguard's Secondary Network work?" Tags="|switch|router|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16444" PostTypeId="2" ParentId="16442" CreationDate="2015-02-01T09:47:15.883" Score="1" Body="&lt;p&gt;There are two problems that have to be fixed before any reasonable solution can be implemented:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;em&gt;changes constantly&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;management of the corporate network is outsourced&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Without knowledge of and control over your network(s), there's not much to be done. In a dynamic network environment, you never know where a IP &lt;em&gt;actually&lt;/em&gt; is, and therefore what cache is local to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many CDN's use DNS to direct traffic, but they have a pretty good idea where a client is based on address. The other option is &lt;em&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Anycast&quot; rel=&quot;nofollow&quot;&gt;anycast&lt;/a&gt;&lt;/em&gt; -- leveraging routing to have one IP in many locations -- but this requires control of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are local DNS servers per site, region, etc., you can approximate both through a local dns zone that points to the local server: &quot;distribution.&lt;em&gt;casper.company.com&lt;/em&gt;&quot; with the subdomain (&lt;em&gt;casper&lt;/em&gt;) defined, individually, on each local DNS server.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-02-01T09:47:15.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16445" PostTypeId="2" ParentId="16443" CreationDate="2015-02-01T10:06:27.470" Score="2" Body="&lt;p&gt;Technically, the firewall would be the &quot;router&quot; in this case. Multiple subnets &lt;em&gt;can&lt;/em&gt; coexist on one layer-2 broadcast domain. Each subnet will function as if the others aren't there.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-02-01T10:06:27.470" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16446" PostTypeId="2" ParentId="6782" CreationDate="2015-02-01T12:02:48.227" Score="0" Body="&lt;p&gt;S-SAP is an 8-bit long field that represents the logical address of the network layer entity that has created the message. (Network layer protocol that is sending).&#xA;D-SAP is an 8-bit long field that represents the logical addresses of the network layer entity intended to receive the message. (Network layer protocol that is receiving).&#xA;Usually they carry identical values. &lt;/p&gt;&#xA;" OwnerUserId="13666" LastActivityDate="2015-02-01T12:02:48.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16448" PostTypeId="1" AcceptedAnswerId="16455" CreationDate="2015-02-01T19:06:23.130" Score="4" ViewCount="1724" Body="&lt;p&gt;The Cisco &quot;deny&quot; ACL seems to quietly drop TCP/IP packets. Is it possible for it to send either ICMP responses or TCP RST's in response to a denied request?&lt;/p&gt;&#xA;" OwnerUserId="13662" LastEditorUserId="775" LastEditDate="2015-02-02T12:29:05.677" LastActivityDate="2015-02-02T12:37:01.160" Title="Cisco ACL to block connections with ICMP or RST" Tags="|cisco|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16449" PostTypeId="1" AcceptedAnswerId="16450" CreationDate="2015-02-01T22:21:02.207" Score="5" ViewCount="8668" Body="&lt;p&gt;Relevant Log messages&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb  1 03:39:08.338 EST: %IPV6-4-DUPLICATE: Duplicate address FE80::212:44FF:FE4D:4400 on GigabitEthernet8/20&#xA;Feb  1 03:39:08.904 EST: %UDLD-SP-4-UDLD_PORT_DISABLED: UDLD disabled interface Gi8/20, transmit/receive loop detected&#xA;Feb  1 03:39:08.904 EST: %PM-SP-4-ERR_DISABLE: udld error detected on Gi8/20, putting Gi8/20 in err-disable state&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Not Really sure where to go with this, i feel like the duplicate address message is telling in this case, however, sh run |i  yields nothing, the interface itself doesn't even have that address to begin with.. Would really like to know more about both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already understand UDLD - I'm just not familiar with that state and what to look at afterwards&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh udld gi8/20&#xA;&#xA;Interface Gi8/20&#xA;---&#xA;Port enable administrative configuration setting: Follows device default&#xA;Port enable operational state: Enabled&#xA;Current bidirectional state: Transmit-to-receive loop&#xA;Current operational state: Disabled port&#xA;Message interval: 7&#xA;Time out interval: 5&#xA;No neighbor cache information stored&#xA;&#xA;interface GigabitEthernet8/20&#xA; ip address 43.160.0.229 255.255.255.252&#xA; ip flow ingress&#xA; ip flow egress&#xA; ipv6 address 2607:FD28:AAAA:4::1/64&#xA; ipv6 enable&#xA; ipv6 ospf network point-to-point&#xA; ipv6 ospf 21 area 0&#xA;end&#xA;&#xA;GigabitEthernet8/20 is down, line protocol is down (err-disabled)&#xA;  Hardware is C6k 1000Mb 802.3, address is 0012.444d.4400 (bia 0012.444d.4400)&#xA;  Internet address is 43.160.0.229/30&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, &#xA;     reliability 255/255, txload 0/255, rxload 0/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 1000Mb/s, media type is LH&#xA;  input flow-control is off, output flow-control is off&#xA;  Clock mode is auto&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 06:10:24, output 06:10:24, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 22:09:46&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;  L2 Switched: ucast: 0 pkt, 0 bytes - mcast: 3 pkt, 246 bytes&#xA;  L3 in Switched: ucast: 0 pkt, 0 bytes - mcast: 0 pkt, 0 bytes mcast&#xA;  L3 out Switched: ucast: 0 pkt, 0 bytes mcast: 0 pkt, 0 bytes&#xA;     4 packets input, 488 bytes, 0 no buffer&#xA;     Received 4 broadcasts (0 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles &#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     140 packets output, 37264 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 3 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2015-02-02T08:06:18.810" LastActivityDate="2015-02-03T05:54:02.013" Title="UDLD state: tx/rx loop detected" Tags="|cisco|ethernet|cabling|fiber|udld|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16450" PostTypeId="2" ParentId="16449" CreationDate="2015-02-01T23:47:59.597" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Relevant Log messages&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb  1 03:39:08.338 EST: %IPV6-4-DUPLICATE: Duplicate address FE80::212:44FF:FE4D:4400 on GigabitEthernet8/20&#xA;Feb  1 03:39:08.904 EST: %UDLD-SP-4-UDLD_PORT_DISABLED: UDLD disabled interface Gi8/20, transmit/receive loop detected&#xA;Feb  1 03:39:08.904 EST: %PM-SP-4-ERR_DISABLE: udld error detected on Gi8/20, putting Gi8/20 in err-disable state&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you see &quot;Duplicate address&quot; and &quot;transmit/recieve loop detected&quot; on the same interface, that's almost a slam-dunk that this is a cabling problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looped circuits are very common when dealing with WAN providers.  It typically happens because some technician is testing the circuit with a loop&lt;sup&gt;Note 1&lt;/sup&gt; at their cross-connnect and gets pulled off to perform some other task.  However, the loop prevents your circuit from coming up on both sides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch is complaining because it (correctly) considers it a problem when it sees it's own packets received on the interface it was sent from.  The best thing to do is work with the provider and tell them you've detected a loop at this location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the provider resists (not uncommon), ask them to perform a loop at on their panel at &lt;em&gt;this site&lt;/em&gt; towards the other site.  If the circuit is indeed correct, you should see your other switch link up (assuming you don't have UDLD on it, as you stated).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the loop is corrected, just shut/no shut this port to test it again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This problem illustrates a good use-case for out-of-band connections to your WAN sites through another carrier.  This way, if you need to diagnose your far-end circuits, you've got some way to connect to your far-end router / switch.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;End Notes&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Note 1&lt;/sup&gt;  A loop is just a physical or logical jumper, which connects the Transmit side to the Receive side of the same circuit.  This is usually done so a tech can validate the circuit is functional to some demarc point in their network.  Ironically, it takes down all connectivity past the loop (until it is removed).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-02-03T05:54:02.013" LastActivityDate="2015-02-03T05:54:02.013" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16454" PostTypeId="1" AcceptedAnswerId="16458" CreationDate="2015-02-02T10:38:33.823" Score="27" ViewCount="110171" Body="&lt;p&gt;When running traceroutes some hops return * which as far as I know means that the host is not responding to ICMP echo request, and some other hops (mainly the last) return &lt;strong&gt;!H&lt;/strong&gt; which according to the man pages it means that the host is &lt;em&gt;unreachable&lt;/em&gt;. What does &lt;em&gt;unreachable&lt;/em&gt; means? That there's no known route to that address? &lt;/p&gt;&#xA;" OwnerUserId="6431" LastEditorUserId="619" LastEditDate="2015-02-02T22:44:42.060" LastActivityDate="2015-10-15T13:16:03.930" Title="Difference between unresponsive (*) and unreachable (!H) hosts in traceroute output" Tags="|traceroute|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16455" PostTypeId="2" ParentId="16448" CreationDate="2015-02-02T12:10:26.967" Score="3" Body="&lt;p&gt;Short answer: no. Cisco IP Access Lists can only &quot;permit&quot; or &quot;deny&quot; (drop) packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I stand corrected. Configuring &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/ipapp/command/reference/iap_i2.html#wp1088079&quot; rel=&quot;nofollow&quot;&gt;IP Unreachables&lt;/a&gt; on the interface results in an ICMP-unreachable message when the packet is dropped.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA; ip address 10.1.1.2 255.255.255.0&#xA; ip access-group 101 in&#xA; ip unreachables&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8049" LastEditorUserId="8049" LastEditDate="2015-02-02T12:37:01.160" LastActivityDate="2015-02-02T12:37:01.160" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16458" PostTypeId="2" ParentId="16454" CreationDate="2015-02-02T14:54:40.123" Score="6" Body="&lt;p&gt;The simple difference is that for an unreachable host, the last hop router is returning an &lt;a href=&quot;http://en.m.wikipedia.org/wiki/Internet_Control_Message_Protocol#Destination_unreachable&quot; rel=&quot;noreferrer&quot;&gt;ICMP destination unreachable&lt;/a&gt; response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most routers will hardware process ACLs or rate limits, but generation of ICMP responses require CPU resources so it is common practice to not generate them.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="619" LastEditDate="2015-02-02T22:44:06.783" LastActivityDate="2015-02-02T22:44:06.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16461" PostTypeId="1" AcceptedAnswerId="17184" CreationDate="2015-02-02T15:30:31.377" Score="6" ViewCount="5060" Body="&lt;p&gt;Our network runs OSPF for IPv4 on Cisco hardware. The following image shows the relevant topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Topology&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/86lOB.png&quot; alt=&quot;Problem Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem Statement&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a Cisco ASA firewall, which also is the VPN gateway for incoming VPN connections. As said, we are running OSPF as internal routing protocol. The ASA performs reverse route injection (RRI) for the VPN clients, which means it creates a static /32 route for every VPN connection. Those /32 routes are then redistributed into the OSPF domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Router on the right is our perimeter router running BGP. In between there is a Multilayer Switch (Cat6500 w/ Sup720-3B and IPServices) also running OSPF. The problem is, that those /32 routers are visible in the OSPF database both at the MLS and the Router, but are not inserted into the routing table on the MLS. At the router, they however are in the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debugging Output&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two such subnets (two different VPN profiles), which are xx.xx.37.0/24 and xx.xx.202.0/24. As those /32 routers are redistributed into OSPF, they appear as LSA type 5 in the rest of the routing domain, however, they are not injected into the routing table at the MLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can see those LSAs at the database:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip ospf database external | i xx.xx.202.&#xA;  Link State ID: xx.xx.202.5 (External Network Number )&#xA;  Link State ID: xx.xx.202.6 (External Network Number )&#xA;  Link State ID: xx.xx.202.8 (External Network Number )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we look at the specific LSA, we also can see that the routing bit is set, hence the LSA is eligible for OSPF routing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip ospf database external xx.xx.202.5&#xA;&#xA;            OSPF Router with ID (xx.xx.207.4) (Process ID 2)&#xA;&#xA;                Type-5 AS External Link States&#xA;&#xA;  Routing Bit Set on this LSA&#xA;  LS age: 1887&#xA;  Options: (No TOS-capability, DC)&#xA;  LS Type: AS External Link&#xA;  Link State ID: xx.xx.202.5 (External Network Number )&#xA;  Advertising Router: xx.xx.192.20&#xA;  LS Seq Number: 80000001&#xA;  Checksum: 0x8147&#xA;  Length: 36&#xA;  Network Mask: /32&#xA;        Metric Type: 2 (Larger than any link state path)&#xA;        TOS: 0&#xA;        Metric: 20&#xA;        Forward Address: xx.xx.192.21&#xA;        External Route Tag: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Further, debugging the SPF of the OSPF process shows, that the partial update is received and processed, and no error can be found (debug ip ospf spf):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb  2 16:17:40.537: OSPF: Schedule partial SPF - type 5 id xx.xx.202.5 adv rtr xx.xx.192.20&#xA;Feb  2 16:17:40.537: OSPF: Service partial SPF 0/1/0&#xA;Feb  2 16:17:40.537: OSPF process partial spfQ entry&#xA;Feb  2 16:17:40.537: OSPF process partial spfQ entry&#xA;Feb  2 16:17:40.537: OSPF process partial spfQ LSA id xx.xx.202.5: mask 255.255.255.255, type 5 adv_rtr xx.xx.192.20, age 1, seq 0x80000001 (Area dummy area)&#xA;Feb  2 16:17:40.537: OSPF: Start partial processing Type 5 External LSA xx.xx.202.5, mask 255.255.255.255, adv xx.xx.192.20, age 1, seq 0x80000001, metric 20, metric-type 2&#xA;Feb  2 16:17:40.537:    Add path: next-hop xx.xx.192.21, interface Vlan511&#xA;Feb  2 16:17:40.537: OSPF: insert route list LS ID xx.xx.202.5, type 5, adv rtr xx.xx.192.20&#xA;Feb  2 16:17:40.537: OSPF process partial spfQ entry&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, the route is not inserted into the routing table. As a work around, we added a static route using the /24 subnet. This however is no reason why the /32 subnet is not placed into the table. While the AD is lower (1 static route vs 110 OSPF external), the longest prefix match rule is evaluated first, hence the /32 subnet should be added.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly, at the Router behind the MLS, the /32 route is added to the routing table as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Further Information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MLS is a Cisco 6500 Chassis w/ Sup720-3B (MSFC3) SUP running &quot;s72033-ipservicesk9-mz.122-33.SXI14.bin&quot; software. The Router is a Cisco ASR1001-F router, running &quot;asr1000rp1-advipservicesk9.03.04.06.S.151-3.S6.bin&quot; software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are no routing filters in place, the OSPF config of the devices is pretty basic. OSPF adjacencies are OK, all other routes or OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF configuration of MLS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 2&#xA; router-id xx.xx.207.4&#xA; log-adjacency-changes&#xA; auto-cost reference-bandwidth 100000&#xA; area 0 authentication message-digest&#xA; passive-interface default&#xA; no passive-interface ...&#xA; network 0.0.0.0 255.255.255.255 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OSPF configuration Router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 2&#xA; router-id xx.xx.207.1&#xA; auto-cost reference-bandwidth 100000&#xA; area 0 authentication message-digest&#xA; traffic-share min across-interfaces&#xA; passive-interface default&#xA; no passive-interface ...&#xA; default-information originate always metric-type 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;New Information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some further troubleshooting, I may have found the issue, however, have no idea how to solve it. Looking at the firewall, the generated static route looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S xx.xx.202.13 255.255.255.255 [1/0] via xx.xx.192.21, outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The default behaviour of RRI is to set the next-hop of the generated static route to the default gateway of the ASA interface where the crypto map is applied (which is outside in our case). In our case, it is xx.xx.192.21, which is the interface of the MLS!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13682-10.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Documentation&lt;/a&gt;, a non-zero forwarding address is set, if the following conditions are met:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;OSPF is enabled on the ASBR’s next hop interface AND&#xA;  ASBR’s next hop interface is non-passive under OSPF AND&#xA;  ASBR’s next hop interface is not point-to-point AND&#xA;  ASBR’s next hop interface is not point-to-multipoint AND&#xA;  ASBR’s next hop interface address falls under the network range specified in the router ospf command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;All these conditions are met, as we need the outside interface (which is next hop) enabled in OSPF, as it is the interface pointing to the MLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As written above, the LSA at the MLS contains the forwarding address of xx.xx.192.21 which is the address of the MLS in the subnet between MPLS and ASA. According to the documentation linked above, the forwarding address needs to be known as internal OSPF route. This is given at the Router, and the routing entries are added to the routing table. This however is not given at the MLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are the routes not added to the routing table? I appreciate any idea.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="3875" LastEditDate="2015-03-10T11:05:35.510" LastActivityDate="2015-07-25T08:13:54.450" Title="Cisco OSPF type 5 /32 routes in database, but not in routing table" Tags="|cisco|cisco-ios|ospf|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16462" PostTypeId="1" CreationDate="2015-02-02T16:32:23.640" Score="1" ViewCount="88" Body="&lt;p&gt;We configured our new cisco ASA 5520 firewall device to act as RAVPN peer device. AAA is configured in such a way that user will get authenticate at our ACS 5.4 server. After completion of all other RAVPN related configurations, we tested aaa authentication for specific user ID and it was successful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upon successful aaa test, we initiated the actual RAVPN traffic from Internet hosted windows machine through cisco vpn client. The connectivity was successful but after few seconds, the vpn connectivity got disconnected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When verified at ASA, it was hung with last shown error as: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;i82546GB/enadap_get: 1 not null.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Google referred the similar error occurrence with PIX firewalls but not with ASA. No solutions/suggestions available for those pix occurrences too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tried below options but ended in no positive result&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IOS upgrade from 8.0(4) to 8.2.5(33) (Interim stable version with pre 8.3 IOS versions of ASA.)&lt;/li&gt;&#xA;&lt;li&gt;Firewall reboot&lt;/li&gt;&#xA;&lt;li&gt;Cleared complete configuration and tried re-building once.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Suggestions or solution for this is highly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="13680" LastEditorUserId="3191" LastEditDate="2015-02-02T19:46:35.227" LastActivityDate="2015-02-02T19:46:35.227" Title="Cisco ASA Hung - Error: &quot;i82546GB/enadap_get: 2 not null&quot;" Tags="|cisco|cisco-asa|firewall|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16464" PostTypeId="1" CreationDate="2015-02-02T18:21:42.383" Score="0" ViewCount="1059" Body="&lt;p&gt;I have a physical host server connected to an HP (say, 2650 series?) switch. The host is running multiple Hyper-V virtualized OSes, each on a different VLAN. If I make the switch port dot1q tagged for each VLAN and untagged on the main host, will that allow access for the OSes to function and connect to the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In pseudo-Cisco terms, if I make it a trunk port for VLAN 2&amp;amp;3 and an access port for VLAN 1 (you can do that in HP), will this solve my problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is very time sensitive so I'm sorry for the short post. More information is available to me if needed. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="3836" LastActivityDate="2015-06-03T00:45:51.743" Title="Multiple VLANs on a single port Virtual Host" Tags="|switch|hp|dot1q|" AnswerCount="1" CommentCount="1" ClosedDate="2019-06-24T00:26:12.627" ContentLicense="CC BY-SA 3.0" />
  <row Id="16465" PostTypeId="1" AcceptedAnswerId="16467" CreationDate="2015-02-02T18:31:10.837" Score="1" ViewCount="153" Body="&lt;p&gt;There is one line in this article (&lt;a href=&quot;http://www.flukenetworks.com/content/80211ac-faqs&quot; rel=&quot;nofollow&quot;&gt;http://www.flukenetworks.com/content/80211ac-faqs&lt;/a&gt;) that I am not clear about:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;If you have an 802.11n network, consider that a 1:1 swap of AP's to&#xA;  802.11ac can increase your user capacity.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Won't the capacity remain the same, unless all clients are 802.11ac (unlikely since the original network was 802.11n)?&lt;/p&gt;&#xA;" OwnerUserId="2360" LastActivityDate="2015-02-02T19:49:42.057" Title="How does 802.11ac increase client capacity?" Tags="|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16467" PostTypeId="2" ParentId="16465" CreationDate="2015-02-02T19:49:42.057" Score="3" Body="&lt;p&gt;There are a number of factors that can contribute to this increase in capacity.  Keep in mind that to increase capacity what you really need to do is increase efficiency so that you can transmit more bits in the same amount of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the statement says  it &quot;can increase your user capacity&quot; not that it definitely will.  However in most cases it will do so.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;As you noted, yes most clients will likely still be 802.11n, but this is changing quickly.  In the BYOD environment I am currently in, we are running about 15-20% 802.11ac clients in areas that have 802.11ac deployed.  Each 802.11ac client can achieve higher data rates making the use of spectrum more efficient on average.&lt;/li&gt;&#xA;&lt;li&gt;An 802.11n access point can be single band.  802.11ac are always dual band, so depending on the 802.11n access points currently deployed this can provide a significant capacity increase.&lt;/li&gt;&#xA;&lt;li&gt;802.11ac has a number of improvements, such as beam forming, that are not client dependent.  This will allow the clients to receive at higher signal strengths which often translates to higher data rates.  This again increases efficiency.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-02-02T19:49:42.057" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16470" PostTypeId="2" ParentId="16464" CreationDate="2015-02-02T21:57:23.147" Score="1" Body="&lt;p&gt;You say you are already running virtualized OSes on the host, which are running in different VLANs. Hence I guess you already have the switch configured to perform dot1q trunking (Cisco terminology), otherwise you would not be able to have different VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the main host, you can configure Hyper-V either to use a tagged VLAN or send the management traffic untagged. Compare &lt;a href=&quot;https://social.technet.microsoft.com/Forums/systemcenter/en-US/bf5df8b5-30a4-41de-9470-a24aa4245b96/using-a-trunk-port-for-management-interface-and-other-vlans-in-hyperv-server-2012-bare-metal?forum=virtualmachingmgrhyperv&quot; rel=&quot;nofollow&quot;&gt;this answer&lt;/a&gt; at Microsoft Technet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you configure the management VLAN to be tagged, there is no need to configure an untagged port at your Switch. Otherwise, you need to configure one untagged VLAN (HP), or native VLAN (Cisco terminology). You can set any existing VLAN to be sent untagged. In summary, the management packets are tagged anyway. Either to already tag them at the host, or the switch performs the tagging, as soon as the untagged packet coming in at native VLAN proceeds to another trunk, there this management VLAN needs to be tagged.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2015-02-02T21:57:23.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16471" PostTypeId="1" AcceptedAnswerId="16472" CreationDate="2015-02-02T23:00:48.897" Score="5" ViewCount="2473" Body="&lt;p&gt;I am currently using a very simple eBGP and iBGP configuration in my network to route out through a single ISP. This diagram gives a rough idea of what I currently have in operation:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/hBqxM.png&quot; alt=&quot;Single homed BGP&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am running out of capacity through ISP 1 and would like to add an additional ISP and create a dual homed setup. I have a /20 from ARIN that I am advertising to ISP1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the setup I would like to end up with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NKFt3.png&quot; alt=&quot;Dual Homed eBGP&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I can use local-pref to control which of my two edge routers customer traffic should exit through. However, inbound route control is more difficult. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to advertise my same /20 to both ISP 1 and ISP 2. Is there any way I can load-balance incoming traffic into my network? I know there are tricks such as as-path prepending, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't want to run into a situation where all inbound traffic is taking preference through ISP 1, to the point where I'm maxing out the 1G connection, while ISP 2 sits idle. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use VyOS on my edge routers.&lt;/p&gt;&#xA;" OwnerUserId="13689" LastEditorUserId="13689" LastEditDate="2015-02-02T23:08:18.390" LastActivityDate="2015-02-11T14:20:21.143" Title="eBGP Dual ISP, Dual Edge Router" Tags="|routing|bgp|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16472" PostTypeId="2" ParentId="16471" CreationDate="2015-02-02T23:13:13.913" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;inbound route control is more difficult&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Understatement of the century. Just as you can use local-pref to push traffic out which ever pipe you wish, others can as well. As a result, you have little control over how traffic reaches you.  AS-PATH is the only sure-fire way to remotely influence route preference (and the local network admin can still override it, but my experience says that's rare.)  Depending on your two ISPs, there may be various communities that can limit where your routes go.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-02-02T23:13:13.913" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16473" PostTypeId="1" CreationDate="2015-02-03T00:21:33.243" Score="1" ViewCount="5866" Body="&lt;p&gt;I’m really struck with configuring VLAN and route, I hope you can help.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 ASA5512 Firewall&lt;/li&gt;&#xA;&lt;li&gt;1 CISCO SG500x Layer 3 switch (Core Switch)&lt;/li&gt;&#xA;&lt;li&gt;3 CISCO SG200-50p switch (web management access only) (Access Switch)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have created 6 VLANS on the firewall and have assigned IP Address to it accordingly, on the core switch I have created 6 VLANS with the same VLAN ID as firewall and assigned ports to it (Ie &lt;code&gt;interface range gi1/1 – 3&lt;/code&gt;, &lt;code&gt;VLAN x&lt;/code&gt;, etc) In the core switch I have assigned 3 ports per vlan as they will be trunk ports (I hope this is correct).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What port do I need to assign IP Address to? Also for the three access switch do I create one trunk port for each and all other ports are to be access ports?&lt;/p&gt;&#xA;" OwnerUserId="13692" LastEditorUserId="619" LastEditDate="2015-02-03T00:56:31.093" LastActivityDate="2017-10-06T15:37:13.180" Title="ASA and Switch VLAN Configuration" Tags="|vlan|cisco-asa|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16474" PostTypeId="2" ParentId="16471" CreationDate="2015-02-03T00:52:56.533" Score="3" Body="&lt;p&gt;Rule number 1 of BGP: &quot;You can't tell someone else what to do with their traffic. You can only gently prod them in the right direction.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AS-Path Prepending would be my recommendation. If your upstream strips of the prepending, phone them up and ask them nicely to stop. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Local-Preference would be my recommendation for outbound load balancing. You can easily create policies that attach a local preference to BGP communities. You then tag the communities when the routes are advertised to you. The ISP I work for does this to seperate out domestic peerings vs international, and public peering exchanges, different locations, and so on. Makes it easy to see where routes have come from and then apply an L-Pref to them. You can then also potentially use communities to advertise bgp remote triggered black hole (RTBH), if your upstreams support it of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Was just thinking. We have a situation where we want a 100% guarantee that an upstream will use a certain path for return traffic. We advertise to them the individual /24's instead of the bigger supernet. Could be a potential option as &lt;em&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Longest_prefix_match&quot; rel=&quot;nofollow&quot;&gt;longest match&lt;/a&gt;&lt;/em&gt; always wins over anything else.&lt;/p&gt;&#xA;" OwnerUserId="11927" LastEditorUserId="619" LastEditDate="2015-02-03T01:15:10.720" LastActivityDate="2015-02-03T01:15:10.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16475" PostTypeId="2" ParentId="16473" CreationDate="2015-02-03T01:10:12.780" Score="2" Body="&lt;pre&gt;&lt;code&gt;interface Ethernet0/0&#xA; no shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Ethernet0/0.48&#xA; vlan 48&#xA; nameif vlan48&#xA; security-level 100&#xA; ip address 192.168.48.1 255.255.255.192 &#xA;!&#xA;interface Ethernet0/0.101&#xA; vlan 101     &#xA; nameif vlan101&#xA; security-level 100&#xA; ip address 192.168.48.66 255.255.255.224 &#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ASA port (e0/0 in this example) would go to a trunk port set to allow all the vlans configured on the ASA (48 and 101, here) The ASA is then the router between those VLANs. Any address assigned to the switches would be purely for management. And they would assigned to a VLAN, not a port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The topology between devices is, indeed, all trunks. (because you want all vlans to be available everywhere.) The access ports -- ports where individual machines are connected -- would be assigned to only one VLAN.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-02-03T01:10:12.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16477" PostTypeId="1" AcceptedAnswerId="16479" CreationDate="2015-02-03T07:33:29.603" Score="0" ViewCount="2007" Body="&lt;p&gt;In &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5952#section-5&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5952 - section 5&lt;/a&gt; it is stated that for some IPv6 addresses it is recommended to give the mixed notation, if it has a certain prefix. However, it is unclear which prefixes are used for this, because it is stated that a prefix may be used if it is commonly used as a prefix for a IPv4-mapped address. Thus meaning basically any prefix could be used for this.&lt;/p&gt;&#xA;&lt;p&gt;Now my question is:&lt;br /&gt;&#xA;May every IPv6 address be written as an IPv4-mapped IPv6-address?&lt;br /&gt;&#xA;If not, what are the exact rules for correctly writing an IPv4-mapped IPv6-address?&lt;/p&gt;&#xA;&lt;p&gt;So can every IPv6 address be written in the format of:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;x:x:x:x:x:x:d.d.d.d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Afterwards applying the compression for IPv6 text representation to the hexadecimal part.&lt;/p&gt;&#xA;" OwnerUserId="13696" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2018-12-27T01:10:47.073" Title="May every IPv6 address be written as an IPv4-mapped IPv6-address?" Tags="|ip|subnet|ipv6|protocol-theory|rfc|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16479" PostTypeId="2" ParentId="16477" CreationDate="2015-02-03T13:27:31.860" Score="1" Body="&lt;p&gt;The only IPv4-mapped IPv6 address that I have seen/know of is ::FFFF:/96.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Examples:&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The above is used for sharing IPv6 network prefixes over IPv4 transport in BGP:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos13.2/topics/example/bgp-ipv6.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/documentation/en_US/junos13.2/topics/example/bgp-ipv6.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;F5 LTM Appliance. Even if the user configures IPv4 addresses for the box, internally all addresses are treated/converted to IPv6.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://devcentral.f5.com/articles/ipaddr-and-ipv6&quot; rel=&quot;nofollow&quot;&gt;https://devcentral.f5.com/articles/ipaddr-and-ipv6&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Explanation for IPv4-mapped IPv6 addresses is available here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.tcpipguide.com/free/t_IPv6IPv4AddressEmbedding-2.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.tcpipguide.com/free/t_IPv6IPv4AddressEmbedding-2.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="10306" LastEditorUserId="10306" LastEditDate="2015-02-03T13:58:24.523" LastActivityDate="2015-02-03T13:58:24.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16483" PostTypeId="1" AcceptedAnswerId="16492" CreationDate="2015-02-03T15:13:39.253" Score="4" ViewCount="180" Body="&lt;p&gt;I need to allocate IPv6 /48 block from one provider to another, located in different country. Is it possible at all? I don't own this block but let's assume that current provider will agree to &quot;delegate&quot; (don't know if it's proper term) it. What steps should be taken to make this work? Thank you in advance for any suggestions.&lt;/p&gt;&#xA;" OwnerUserId="13703" LastActivityDate="2015-06-27T21:40:40.737" Title="IPv6 addresses allocation" Tags="|ipv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16484" PostTypeId="1" CreationDate="2015-02-03T15:51:33.650" Score="-1" ViewCount="373" Body="&lt;p&gt;I'm having trouble understand exactly what the point of a subnet is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read about WHAT it is, and all definitions say something along the lines of that it is a logical grouping of nodes with the same &lt;code&gt;X&lt;/code&gt; first digits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't understand what benefit this provides. To me this sounds like implementing &quot;sub-student groups&quot; for students at my university, based on their IDs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for my fictional student ID of &lt;code&gt;52446581&lt;/code&gt;, I'll be part of the &lt;code&gt;5XXXXXXX&lt;/code&gt; substudent group, the &lt;code&gt;52XXXXXX&lt;/code&gt; subgroup, the &lt;code&gt;524XXXXX&lt;/code&gt; subgroup etc. This seems so silly and obvious to me.  Me and the guy with &lt;code&gt;52489425&lt;/code&gt; don't really have anything in common. We might be in totally different faculties and semesters apart. From what I read, it can be the same with &quot;subnets&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why have them?&lt;/p&gt;&#xA;" OwnerUserId="6026" LastActivityDate="2015-02-03T16:39:45.807" Title="What is the point of the &quot;subnet&quot; concept?" Tags="|subnet|ip|" AnswerCount="1" CommentCount="0" ClosedDate="2016-05-17T05:13:07.983" ContentLicense="CC BY-SA 3.0" />
  <row Id="16486" PostTypeId="2" ParentId="16484" CreationDate="2015-02-03T16:19:26.200" Score="5" Body="&lt;p&gt;I'll try to apply your example, with a really terrible analogy (you have been warned).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need more than just StudentID's, let's say you have StudentID and Major.  So your would have to have something in common for it to be efficient.  If you didn't, you would have really terrible performance, this is one of the many reasons proper subnetting is a good idea, For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Jimmy - StudentID: 52440001, Major: Computer Science &lt;/li&gt;&#xA;&lt;li&gt;Johnny -&#xA;StudentID: 52440010, Major: Pre-Medicine &lt;/li&gt;&#xA;&lt;li&gt;Susan - StudentID: 52440935,&#xA;Major: Computer Science&lt;/li&gt;&#xA;&lt;li&gt;Carol - StudentID: 52440553, Major:&#xA;Pharmacology&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now let's take it a bit further, what happens if you have a job fair and these students have no idea where to go so you say &quot;Group (subnet ID) 52440000, this represents all students with StudentID's between 52440001 - 52449999 (IP addresses), go to the Computer Science Building (the next destination)&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Really simple right?  It is until Johnny and Carol show up at the Computer Science building, what do a Pre-Medicine and Pharmacology major care about Computer Science?  They don't, so now someone else has to &quot;route&quot; them, to get to their buildings.  This is bad in networks, because there is no guarantee that Johnny and Carol don't have to go back the same way they came to get to where they need to go.  So now Jimmy and Susan are where they need to be, but now Johnny and Carol are late for class and can't get a seat so they just go back to their dorms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how do we solve this?  We plan.  Now, what happens if the college starts saying, &quot;Okay, all students in Major X, will be in Group Y.  Now when we say &quot;Group 52440000, go to Computer Science.&quot; or &quot;Group 50010000, go to Pre-Medicine.&quot; This everyone ends up with a better experience, than the previous example.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in short, you need to plan your IP space accordingly.  Ideally you're not going to just shotgun IP's all over the network, you &lt;em&gt;should&lt;/em&gt; group IP ranges to the same use cases, regions, destinations, whatever your network calls for - how you group them really depends on the environment.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I told you it was terrible, if its not clear please let me know and I will happily edit my answer)&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2015-02-03T16:39:45.807" LastActivityDate="2015-02-03T16:39:45.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16490" PostTypeId="1" AcceptedAnswerId="16491" CreationDate="2015-02-03T19:56:50.997" Score="3" ViewCount="12746" Body="&lt;p&gt;Simple question&#xA;What functionally happens when executing 'clear int giX/X/X' on a switch?  The port config looks the same afterwards, I see no difference.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2015-02-09T14:20:55.853" Title="What does 'clear int giX/X/X' do? Cisco" Tags="|cisco|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16491" PostTypeId="2" ParentId="16490" CreationDate="2015-02-03T20:01:57.200" Score="9" Body="&lt;p&gt;&lt;strong&gt;Clear Interface&lt;/strong&gt; resets the hardware logic on the specific interface. It basically resets the controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were looking to clear the configs on a port, &lt;strong&gt;default interface&lt;/strong&gt; will do the job for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&#xA;It does nothing to the configuration of the port. And yes, the GigE's controller for that specific interface is reset. It is not the same as bringing the interface up/down. Bringing the interface up/down only prevents it from taking traffic while &lt;code&gt;clear interface&lt;/code&gt; is used for interfaces that are not functioning properly to rectify problems with the way the port is handling the traffic. &lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="4634" LastEditDate="2015-02-09T14:20:55.853" LastActivityDate="2015-02-09T14:20:55.853" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16492" PostTypeId="2" ParentId="16483" CreationDate="2015-02-03T20:14:54.953" Score="10" Body="&lt;p&gt;(The word is &quot;announce&quot;, not allocate.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have Provider Assigned (&quot;PA&quot;) address space. It may or may not be &quot;portable&quot;. In order for you to &quot;dual home&quot; that prefix, the owner of the address space would have to give you written permission to announce it outside their network. Everyone involved would have to announce that specific (/48) prefix. (A /48 is &quot;more specific&quot; than a /32 (provider block))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know about your ISPs, but the one's I'm familiar with in the US &lt;em&gt;really&lt;/em&gt; don't like doing that. And as IPv6 &quot;PI&quot; (independent) space is easy to obtain, there's no reason for them to allow such unproductive dilution of their address space.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-02-03T20:14:54.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16493" PostTypeId="1" CreationDate="2015-02-03T21:16:33.223" Score="3" ViewCount="448" Body="&lt;p&gt;I am looking to secure our console ports in our remote console router equipped with HWIC-16A cards and RS232 cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the network admins, we usually login to these routers first (using privilege 15 accounts via TACACS+) then connect to our hosts by telnet to their corresponding ports&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eg. telnet 1.1.1.1 2021&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now our server guys have obtained devices that can be managed by console access and they'd like to use our routers for this. They have a read-only account that we've setup with &quot;privilege 5&quot; access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've provided them with &quot;telnet 192.168.0.5 2020&quot; which will have them login once to the router and then prompting to login with their read-only account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I found is that they're able to console connect to our firewalls which lives on port 2021.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there a way to limit connections to port 2021 to only users with privilege 15?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried entering &quot;privilege 15&quot; on line 0/1/1 which port 2021 resides on and I can still access our firewall's console with read-only account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All our network devices authenticates with TACACS+ and read-only access are not permitted to firewalls. I am looking to secure these connections further as usage of our router may increase over time!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated. Thank you!&lt;/p&gt;&#xA;" OwnerUserId="13711" LastActivityDate="2015-02-05T04:07:30.957" Title="Securing Console Serial Ports" Tags="|cisco|router|cisco-ios|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16496" PostTypeId="1" CreationDate="2015-02-03T23:43:52.097" Score="-1" ViewCount="1074" Body="&lt;p&gt;Say I have an uplink port (1/3/1) connected to our upstream, then various clients across 1/1/1 - 1/1/48. I want to create two or more VLANs where each VLAN can only use IPs from a specific subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 101&#xA;tag e 1/3/1&#xA;untag e 1/1/1 to 1/1/24&#xA;(assign 10.0.0.0/24 to vlan 101)?&#xA;&#xA;vlan 102&#xA;tag e 1/3/1&#xA;untag e 1/1/25 to 1/1/48&#xA;(assign 10.0.1.0/24 to vlan 102)?&#xA;&#xA;(route vlan 101 &amp;amp; 102 traffic through 1/3/1)?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to prevent a host in vlan 102 (e.g. 1/1/25) from using an IP that belongs to vlan 101 (e.g. 10.0.0.5) and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What's the best way to accomplish this?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this switch is layer 3 capable.&lt;/p&gt;&#xA;" OwnerUserId="13713" LastActivityDate="2015-03-27T21:45:40.840" Title="Restricting IP subnets to specific VLANs (Brocade ICX)" Tags="|vlan|subnet|brocade|layer3|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16500" PostTypeId="1" CreationDate="2015-02-04T08:28:05.303" Score="0" ViewCount="144" Body="&lt;p&gt;We are setting a web application in our local network, but due to the large number of our users, we would like to give our application server a public ip address while using it behind our router. &#xA;We don't want our application server to interfere with other computers in the subnetwork.&#xA;P.S.: I am not a network savvy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your kind answers.&lt;/p&gt;&#xA;" OwnerUserId="13718" LastEditorUserId="775" LastEditDate="2015-02-04T13:25:47.960" LastActivityDate="2016-06-20T17:45:29.363" Title="How to set up a computer to use an ISP provided public address behind my router" Tags="|nat|internet|ip|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16501" PostTypeId="1" CreationDate="2015-02-04T09:21:54.580" Score="5" ViewCount="1426" Body="&lt;p&gt;Does anyone know if it's possible to enable SNMP traps to be sent from a Cisco IOS device when an ACL blocks traffic?  I'd like to send a trap whenever a &lt;code&gt;deny&lt;/code&gt; statement gets a hit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've only been able to find information about sending ACL logs to a remote syslog server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="13719" LastEditorUserId="3191" LastEditDate="2015-02-04T13:43:21.747" LastActivityDate="2022-08-20T16:04:55.567" Title="Enable SNMP traps for ACLs using Cisco IOS?" Tags="|cisco|cisco-ios|snmp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16503" PostTypeId="2" ParentId="16501" CreationDate="2015-02-04T12:12:16.570" Score="-1" Body="&lt;p&gt;So long as the IOS version supports it, you can use extended ACLs to allow the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the management IP of the Cisco device is 10.10.10.10 and the trap destination is 20.20.20.20...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure SNMP: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/13506-snmp-traps.html&quot; rel=&quot;nofollow&quot;&gt;[Reference]&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server host 20.20.20.20 traps version *version* *community-string*&#xA;snmp-server enable traps global configuration&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Allow traps through ACL: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html#extacls&quot; rel=&quot;nofollow&quot;&gt;[Reference]&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list *access-list-number*&#xA;  permit udp 10.10.10.10 255.255.255.255 20.20.20.20 255.255.255.255 162&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then assign that access list to the management interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface *interface*&#xA;  ip access-group *access-list-number* in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13537" LastActivityDate="2015-02-04T12:12:16.570" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16504" PostTypeId="2" ParentId="16500" CreationDate="2015-02-04T13:13:40.303" Score="0" Body="&lt;p&gt;The easiest way to do this is to get a second router, assign it an unused public IP address, and forward the appropriate ports to your server.  The server would be physically separated from the rest of your network.   As an example, lets say you have a cable modem with a built in 4 port switch and a block of 5 usable IPs 100.0.0.2 through 100.0.0.6.   You'd plug the WAN ports of the two routers into the cable modem, assign 100.0.0.2 to one router and 100.0.0.3 to the other.   To access the server, you'd either have to physically be in front of it, use a program like TeamViewer, or forward port 3389 to the server so you can use RDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more sophisticated way of doing it would to get a router supports 1 to 1 NAT.  That would allow you assign one public IP address to your server and another for the rest of your network using only one router. Depending on the router, you could either create a separate sub-interface for your server to keep it separate or use VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have much experience, I'd probably go with option A unless you have a need for computers on your network to be able to access that server locally.&lt;/p&gt;&#xA;" OwnerUserId="10237" LastActivityDate="2015-02-04T13:13:40.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16505" PostTypeId="1" CreationDate="2015-02-04T14:38:52.763" Score="2" ViewCount="6140" Body="&lt;p&gt;I'm studying about MPLS Network, i've doubt on that i.e.,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what is the difference between MPLS Layer-2 Vs Layer-3 Network ?&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="8499" LastEditDate="2018-03-21T01:04:16.603" LastActivityDate="2018-03-21T01:04:16.603" Title="Regarding MPLS L2 Vs L3" Tags="|layer2|layer3|mpls|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16509" PostTypeId="2" ParentId="9761" CreationDate="2015-02-04T21:27:12.530" Score="0" Body="&lt;p&gt;This should do the trick for you.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vtysh -c &quot;show ip bgp neighbors X.X.X.X routes&quot; | sed '1,6d' | awk '{print $2}' | head -n -2 &amp;gt; routes.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will output only the routes into the file routes.txt&lt;/p&gt;&#xA;" OwnerUserId="13728" LastEditorUserId="509" LastEditDate="2015-02-05T08:23:26.483" LastActivityDate="2015-02-05T08:23:26.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16510" PostTypeId="2" ParentId="16505" CreationDate="2015-02-04T22:38:31.673" Score="6" Body="&lt;p&gt;Here is a short answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A L2 VPN acts like a layer 2 network.  That is, all the devices that connect to the VPN would normally be on the same subnet, and broadcasts go to all devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a L3 VPN, each site makes a L3 point to point link to the MPLS provider.  Each site must run a routing protocol (or use static routing) with the provider to reach other sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to think about it is, a L2 VPN acts like a virtual switch, while a L3 VPN acts like a virtual router.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-02-04T22:38:31.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16514" PostTypeId="2" ParentId="16493" CreationDate="2015-02-05T04:07:30.957" Score="3" Body="&lt;p&gt;Assuming you're running relevant code, the &lt;code&gt;aaa authorization reverse-access&lt;/code&gt; would let you determine what users are allowed to access which reverse-telnet ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to configure your tacacs server to provide the correct authorization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an example in the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/command/reference/fsecur_r/srfauth.html#wp1017573&quot; rel=&quot;nofollow&quot;&gt;command reference&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-02-05T04:07:30.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16516" PostTypeId="1" AcceptedAnswerId="16686" CreationDate="2015-02-05T14:50:21.640" Score="1" ViewCount="155" Body="&lt;p&gt;I am confused with the Circuit switching and Virtual circuit approaches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In which layers the Circuit switching works ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In one book there is a line &quot;we will not use destination address in circuit switching&quot; my doubt is that at first time during call setup phase the sender should address the destination to NCC(network control center) if not how it will know?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In todays internet, are we Using the Circuit switching?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;can this Circuit switching technology works in store and forward switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the switching Technology used in todays Telephone networks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dedicated path means what? is the whole wire dedicated or the only one channel in the wire is dedicated in circuit switching?&lt;/p&gt;&#xA;" OwnerUserId="6195" LastEditorUserId="6195" LastEditDate="2015-02-06T14:35:11.157" LastActivityDate="2015-02-15T11:43:23.143" Title="Todays switching technology in Telephone networks" Tags="|switch|switching|internet|osi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16525" PostTypeId="2" ParentId="11330" CreationDate="2015-02-05T22:11:03.033" Score="0" Body="&lt;p&gt;If it was me I wouldn't measure up time of a connection using ICMP. During these peak times are the sites that are showing this 1-5% ping packet loss showing any other signs of link degradation? Like an increase in TCP round-trip time or dropped sessions/services?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I work as part of a team that does network analysis of situations such as these. What I would do is put detailed network traffic monitoring on the main link (behind your firewall) to capture traffic patterns so you can do full analysis of the data and see how things like round trip times are affected by peak data usage. And as another user suggested put some traffic shaping policies in place to rate limit some of the data streams to see if you can improve performance. There are a number of free and paid solutions to do this.&lt;/p&gt;&#xA;" OwnerUserId="13633" LastActivityDate="2015-02-05T22:11:03.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16528" PostTypeId="2" ParentId="16505" CreationDate="2015-02-06T11:01:47.220" Score="2" Body="&lt;ul&gt;&#xA;&lt;li&gt;L2 VPN think of it as a big distributes Ethernet switch&lt;/li&gt;&#xA;&lt;li&gt;L3 VPN think of it as a big distributed router&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Pseudowire or VLL (Virtual Local Loop) is a special variant of a L2 VPN which acts more like a L1 service (plain cable) as there is no mac learning inside the MPLS cloud and it can only be point to point where VPLS acts like a switch and dies mac learning and is point to multipoint.&lt;/p&gt;&#xA;" OwnerUserId="13745" LastActivityDate="2015-02-06T11:01:47.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16530" PostTypeId="1" AcceptedAnswerId="16705" CreationDate="2015-02-06T13:32:17.090" Score="7" ViewCount="9853" Body="&lt;p&gt;Monitoring my network I realized some time ago that traceroute used to print routes more complete than it is doing right now... and, right now, sometimes traceroute omits some devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, this is a more complete traceroute, including my gateway:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo traceroute -F xxx.xx.136.5&#xA;&#xA;traceroute to xxx.xx.136.5 (xxx.xx.136.5), 30 hops max, 60 byte packets&#xA;&#xA; 1  * * *&#xA;&#xA; 2  192.168.1.1 (192.168.1.1)  1.607 ms  1.604 ms  1.627 ms&#xA;&#xA; 3  xxx.xx.136.5 (xxx.xx.136.5)  3.286 ms  5.729 ms  7.416 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, the exactly the same command omits my gateway:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo traceroute -F xxx.xx.136.5&#xA;&#xA;traceroute to xxx.xx.136.5 (xxx.xx.136.5), 30 hops max, 60 byte packets&#xA;&#xA;1  xxx.xx.136.5 (xxx.xx.136.5)  24.004 ms  28.267 ms  42.343 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These commands were given on the same machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I set to always have the entire route?&lt;/p&gt;&#xA;" OwnerUserId="13748" LastEditorUserId="33" LastEditDate="2015-02-06T16:28:33.247" LastActivityDate="2018-05-28T17:18:28.230" Title="traceroute doesn't print entire route sometimes" Tags="|traceroute|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16531" PostTypeId="2" ParentId="16530" CreationDate="2015-02-06T16:05:33.750" Score="6" Body="&lt;p&gt;Any form of traceroute works by incrementing the TTL of an IP packet by one. &#xA;The first packet has a TTL of one and the 1 router decrements the timer and send out an error massage via ICMP (Time to live exceeded). Standard *NIX traceroute uses UDP, Windows tracert ICMP, there are also versions that use TCP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are different cases why you don't see a hop:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;People think that ICMP is evil an block it. This will lead to many problems (e.g. PMTU discovery).&lt;/li&gt;&#xA;&lt;li&gt;People only think of windows and block UDP. Try running &lt;code&gt;traceroute -I&lt;/code&gt; should to the trick.&lt;/li&gt;&#xA;&lt;li&gt;you may also want to try using tcptraceroute &lt;/li&gt;&#xA;&lt;li&gt;If a router is busy routing packets it's my not have the resources to send out ICMP packets.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerDisplayName="user2084" LastEditorDisplayName="user2084" LastEditDate="2018-05-28T17:18:28.230" LastActivityDate="2018-05-28T17:18:28.230" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16533" PostTypeId="1" CreationDate="2015-02-06T20:31:56.847" Score="1" ViewCount="301" Body="&lt;p&gt;What is the CLI syntax to remove webserver-logs from a Palo Alto router?&lt;/p&gt;&#xA;" OwnerUserId="13750" LastEditorUserId="775" LastEditDate="2015-02-09T01:43:05.203" LastActivityDate="2015-02-09T01:43:05.203" Title="Palo Alto Router Webserver-log removal" Tags="|router|firewall|palo-alto|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16534" PostTypeId="2" ParentId="16530" CreationDate="2015-02-06T22:35:57.697" Score="5" Body="&lt;p&gt;I prefer to use &lt;code&gt;tcptraceroute&lt;/code&gt; for a better detail of hop-to-hop routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tcptraceroute&lt;/code&gt; essentially bypasses most protective firewall ignoring ICMP packets that is used by &lt;code&gt;traceroute&lt;/code&gt;.  Use port 80 or 53.&lt;/p&gt;&#xA;" OwnerDisplayName="user11981" LastActivityDate="2015-02-06T22:35:57.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16539" PostTypeId="1" AcceptedAnswerId="16599" CreationDate="2015-02-07T06:13:37.107" Score="3" ViewCount="1347" Body="&lt;p&gt;I have a client with CME on a 2951 router.  They lost the login creds for CME and I attempted to reset the login via creating a session to the embedded service engine.  When I tried to do this I realized for some reason there was no IP address assigned to the ESE and therefore I could not connect to it.  I then tried to do an IP unnumbered assigned to the LAN interface on the router.  When I tried to connect to it this time it said open but could not type anything.  What is the best practice for giving the ESE an IP so that you can create a session to it?  Is there another way to reset or recover a login for CME?  Any info will be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="5188" LastActivityDate="2015-02-10T22:19:12.837" Title="CME and 2951 embedded service engine issue" Tags="|cisco|router|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16545" PostTypeId="2" ParentId="2347" CreationDate="2015-02-07T21:28:05.740" Score="2" Body="&lt;p&gt;Use this in your Cisco router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpdn enable&#xA;vpdn logging&#xA;vpdn logging local&#xA;vpdn logging user&#xA;!&#xA;vpdn-group 1&#xA; accept-dialin&#xA; !! This will allow L2TP &amp;amp; PPTP&#xA;  protocol any&#xA;  virtual-template 1&#xA; force-local-chap&#xA; lcp renegotiation always&#xA; no l2tp tunnel authentication&#xA; l2tp tunnel timeout no-session 15&#xA;!&#xA;username youruser password 1234&#xA;!&#xA;crypto keyring UserVPN&#xA;  pre-shared-key address 0.0.0.0 0.0.0.0 key test1234&#xA;!&#xA;crypto ipsec transform-set AES-SHA esp-aes 256 esp-sha-hmac&#xA; mode transport&#xA;!&#xA;crypto isakmp policy 20&#xA; encr 3des&#xA; authentication pre-share&#xA; group 2&#xA;!&#xA;crypto dynamic-map UserVPN 10&#xA; set nat demux&#xA; set transform-set AES-SHA&#xA;!&#xA;crypto map Gig0 10 ipsec-isakmp dynamic UserVPN&#xA;!&#xA;!! This is my WAN interface, replace it with yours&#xA;interface GigabitEthernet0&#xA; crypto map Gig0&#xA;!&#xA;interface Virtual-Template1&#xA; ip unnumbered GigabitEthernet0&#xA; ip mtu 1392&#xA; ip nat inside&#xA; ip tcp adjust-mss 1352&#xA; !! I happen to have an IP pool called 192.168.0.0/24. Replace this with your&#xA; !! DHCP pool or an ip local pool&#xA; peer default ip address dhcp-pool 192.168.0.0/24&#xA; ppp encrypt mppe 128&#xA; ppp authentication ms-chap-v2&#xA; ! Put in your DNS servers here. 192.168.0.254 is my router.&#xA; ppp ipcp dns 192.168.0.254 8.8.8.8&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Create a new VPN connection in Windows with type L2TP and as PSK test1234. When connecting, supply as username &quot;youruser&quot; and as password &quot;1234&quot;.&lt;/p&gt;&#xA;" OwnerUserId="1959" LastEditorUserId="1959" LastEditDate="2015-02-07T21:35:54.220" LastActivityDate="2015-02-07T21:35:54.220" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16546" PostTypeId="1" CreationDate="2015-02-07T21:57:59.527" Score="0" ViewCount="851" Body="&lt;p&gt;I am currently using PFsense as my firewall and was happy until I introduced VLAN in my network. I need to be able to apply QoS over multiple VLANs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a 10/2 mbit line and want following scenario:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN1: guaranteed 5/1 mbit&lt;/li&gt;&#xA;&lt;li&gt;VLAN2: guaranteed 3/0.5 mbit&lt;/li&gt;&#xA;&lt;li&gt;VLAN3: guaranteed 2/0.5 mbit&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I would like is that VLAN3 should be able to use the full line, if VLAN1 and VLAN2 is not in use or just swiftly used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I provide these services?&lt;/p&gt;&#xA;" OwnerUserId="13760" LastEditorUserId="775" LastEditDate="2015-02-08T00:26:54.107" LastActivityDate="2015-06-08T06:05:55.320" Title="QoS between multiple VLANs" Tags="|vlan|ethernet|qos|" AnswerCount="2" CommentCount="1" ClosedDate="2019-06-25T00:24:20.157" ContentLicense="CC BY-SA 3.0" />
  <row Id="16547" PostTypeId="1" CreationDate="2015-02-07T22:58:49.223" Score="2" ViewCount="580" Body="&lt;p&gt;Does anyone know the difference between an ESP (Ethernet switching path) and an EVC (Ethernet virtual connection)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards,&#xA;Michelot&lt;/p&gt;&#xA;" OwnerUserId="13762" LastActivityDate="2015-07-07T22:10:24.813" Title="Carrier Ethernet, difference between ESP and EVC" Tags="|ethernet|metro-ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16548" PostTypeId="2" ParentId="16546" CreationDate="2015-02-07T23:17:59.203" Score="0" Body="&lt;p&gt;VLAN tagging of ethernet frames means that, in theory, you should be able to set up QOS rules that trigger when a particular VLAN tag is matched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure on specifics of your firewall PFsense, but I know it can be done with other solutions. Netscope will do it (Disclaimer, I work for them), you can set rules based on VLAN header tags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for free/opensource solutions, it looks like 'tc' will allow you to shape based on VLAN tags. If PFsense uses 'tc' then you're in luck.&lt;/p&gt;&#xA;" OwnerUserId="13633" LastActivityDate="2015-02-07T23:17:59.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16550" PostTypeId="2" ParentId="16530" CreationDate="2015-02-08T01:07:38.447" Score="1" Body="&lt;p&gt;If your gateway has a logging option, enable it. You may find an entry explaining the observed behavior. A router may interpret repeated ICMP as DOS.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;... although, intuitively, one might expect the source to be on the outside network.  &lt;/p&gt;&#xA;" OwnerUserId="13244" LastActivityDate="2015-02-08T01:07:38.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16551" PostTypeId="2" ParentId="9537" CreationDate="2015-02-08T01:48:09.377" Score="6" Body="&lt;p&gt;This is not a fix but a workaround to get your switch boot up. It did worked on my 2960G.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WS-2960G has a reset switch SW2 that hasn't been soldered (see picture). By shorting those two soldering points couple times I managed to boot the switch correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that the affected memory will not initialize immediately after the switch is powered, but it will more likely initialize once the power is there and the hard reset applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eAOjV.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eAOjV.jpg&quot; alt=&quot;WS-2960G-48 boot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13765" LastEditorUserId="775" LastEditDate="2015-02-09T04:23:12.143" LastActivityDate="2015-02-09T04:23:12.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16554" PostTypeId="2" ParentId="16533" CreationDate="2015-02-08T03:21:32.130" Score="2" Body="&lt;p&gt;Interesting question. From the PAN-OS CLI Reference Guide:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The following command lists the contents of the web server error log.&lt;/p&gt;&#xA;&lt;p&gt;username@hostname&amp;gt; less webserver-log error.log&lt;/p&gt;&#xA;&lt;p&gt;webserver-log — Lists contents of the specified webserver log file (press tab for a list of log files)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The CLI Reference Guide mentions the &lt;code&gt;clear&lt;/code&gt; command but it does not apply to the web-server logs.&lt;/p&gt;&#xA;&lt;p&gt;From this Palo Alto support page, the &lt;code&gt;delete&lt;/code&gt; command can be used to delete specific files.&lt;/p&gt;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://live.paloaltonetworks.com/docs/DOC-4687&quot; rel=&quot;nofollow noreferrer&quot;&gt;Palo Alto - delete command&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I would suggest trying &lt;code&gt;delete ?&lt;/code&gt; to see the full context of the delete command.&lt;/p&gt;&#xA;" OwnerUserId="13244" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-02-08T03:21:32.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16558" PostTypeId="1" CreationDate="2015-02-08T12:36:17.377" Score="0" ViewCount="1196" Body="&lt;p&gt;Is there a way to measure packet loss on a wifi network that is caused by bad reception or interference?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to measure it from the client side without moving the computer or access point. &lt;/p&gt;&#xA;" OwnerUserId="13618" LastActivityDate="2015-09-09T19:35:39.083" Title="Measuring packet loss caused by bad reception or interference" Tags="|packet-loss|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16559" PostTypeId="1" AcceptedAnswerId="16560" CreationDate="2015-02-08T13:48:32.577" Score="3" ViewCount="214" Body="&lt;p&gt;I've read different sources of information, and the only answer I found is that the source mac is needed to fill the switch's table (the one that maps the address to the port).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it right? What happens if the two computers are directly connected? There is no use for the mac address in this situation?&lt;/p&gt;&#xA;" OwnerUserId="13770" LastEditorUserId="775" LastEditDate="2015-02-08T15:35:39.800" LastActivityDate="2015-02-09T10:15:51.750" Title="Is a source Mac Address required for two directly connected computers?" Tags="|ethernet|mac-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16560" PostTypeId="2" ParentId="16559" CreationDate="2015-02-08T15:05:00.670" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You're correct about switches learning device location (port) via the source MAC address.  That alone means they're necessary everywhere.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In your example with two computers/servers connected they're still required because those computers/servers could have multiple interfaces.  MAC addresses are per interface, each interface would have to be able to discern what traffic is destined for it.  The network stack of your OS doesn't care what it's connected to, it's going to interoperate the same with anything.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-02-08T15:05:00.670" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16561" PostTypeId="1" AcceptedAnswerId="16563" CreationDate="2015-02-08T15:06:37.947" Score="1" ViewCount="274" Body="&lt;p&gt;Consider the case of a Router-on-a-Stick topology with multiple vlan tags, when a new computer joins the network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the DAD Neighbor Solicitation message be tagged with a VLAN?  Will all the computers in the network receive one even with the different VLAN Tag? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another scenario, let say there are no Router-on-a-Stick or inter-vlan, when a computer asks for an address will everyone still receive an Neighbor Solicitation, or just the computers in the same VLAN?&lt;/p&gt;&#xA;" OwnerUserId="13772" LastEditorUserId="775" LastEditDate="2015-02-08T17:10:41.277" LastActivityDate="2015-02-08T18:33:51.700" Title="Question about Duplicate Address Detection with VLANS?" Tags="|vlan|ethernet|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16563" PostTypeId="2" ParentId="16561" CreationDate="2015-02-08T16:27:32.490" Score="4" Body="&lt;p&gt;Everything you're talking about is scoped by the L2 VLAN.  When servers communicate with the router or other servers, they will be doing so with packets/frames that will only be seen in the VLAN that they're sent on.  The only way packets/frames can cross from the original VLAN to a different VLAN is via the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the router's perspective, all the data mentioned with be tagged with the appropriate VLAN tag.  The switch is adding the tag to the data from your servers depending on the VLAN assignment on the port.  Since the router is Router-on-a-stick (802.1q trunk), it has to be able to differentiate traffic between different VLANs.  The only way it can do that is with the VLAN tag that was added by the switch.  Any responses are also tagged with the appropriate VLAN tag before sending across the trunk back to the switch. &lt;/p&gt;&#xA;" OwnerUserId="155" LastEditorUserId="155" LastEditDate="2015-02-08T18:33:51.700" LastActivityDate="2015-02-08T18:33:51.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16564" PostTypeId="2" ParentId="16558" CreationDate="2015-02-08T18:45:58.353" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;One option to test packet loss is to &lt;em&gt;ping&lt;/em&gt;, e.g you can send a large number of pings to an IP address, this way you can find the failed responses and can estimate the packet loss. &#xA;following example send a set of 40 pings to the address you specify.       &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Ping -n 40 (IP Address or domain name)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;another option can be &lt;em&gt;traceroute,&lt;/em&gt; although the output will not show you the packet loss but it will show the slow-responding routers along the path, this will help you find where the packet loss may occur. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;or test some monitoring tools such as: IP-SLA or pingplotter (&lt;a href=&quot;http://pingplotter.com/index.php&quot; rel=&quot;nofollow&quot;&gt;http://pingplotter.com/index.php&lt;/a&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="7989" LastEditorUserId="7989" LastEditDate="2015-02-10T16:37:19.063" LastActivityDate="2015-02-10T16:37:19.063" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16567" PostTypeId="1" AcceptedAnswerId="16577" CreationDate="2015-02-09T00:17:56.480" Score="2" ViewCount="570" Body="&lt;p&gt;I received an alert stating that a crypto engine was 'dead'.  I did a bit of digging and was able to find some output to validate this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh crypto eng config&#xA;&#xA;&#xA;    crypto engine name:  Virtual Private Network (VPN) Module&#xA;    crypto engine type:  hardware&#xA;                 State:  Enabled&#xA;              Location:  onboard 0&#xA;          Product Name:  Onboard-VPN&#xA;            FW Version:  1&#xA;          Time running:  2868294 seconds&#xA;           Compression:  Yes&#xA;                   DES:  Yes&#xA;                 3 DES:  Yes&#xA;               AES CBC:  Yes (128,192,256)&#xA;              AES CNTR:  No&#xA; Maximum buffer length:  4096&#xA;      Maximum DH index:  0000&#xA;      Maximum SA index:  0000&#xA;    Maximum Flow index:  8000&#xA;  Maximum RSA key size:  0000&#xA;&#xA;    crypto engine name:  Virtual Private Network (VPN) Module&#xA;    crypto engine type:  hardware&#xA;                 State:  Disabled&#xA;              Location:  slot 0&#xA;          Product Name:  ISM VPN Accelerator&#xA;          UBOOT Ver   : U-Boot 1.1.1 - ISRG2-Crypto-Engine - Version 2.7 (Build time: Mar  7 2011 - 09:12:23)&#xA;          Firmware Ver:   User: ssafari - View/Label: REVENTON_FW_COMMIT_IOS_12022013 - Date: Dec  2 2013 - Time: 16:18:14 &#xA;&#xA;          HW State    : DEAD&#xA;&#xA;           Compression:  No&#xA;                   DES:  Yes&#xA;                 3 DES:  Yes&#xA;               AES CBC:  Yes (128,192,256)&#xA;              AES CNTR:  No&#xA; Maximum buffer length:  4096&#xA;      Maximum DH index:  5120&#xA;      Maximum SA index:  5120&#xA;    Maximum Flow index:  10230&#xA;  Maximum RSA key size:  2048&#xA;&#xA;    crypto lib version:  22_421.0.0&#xA;&#xA;    crypto lib version:  22_421.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm unfamiliar with what this output is saying.  Is the VPN Module like a line card that is plugged into the router and can be replaced?  Does the HW State: DEAD mean the card is bad and needs to be replaced?  What are some other show commands I can use to validate what this output is implying? &lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2015-02-09T00:19:34.493" LastActivityDate="2015-02-09T18:21:09.843" Title="HW State: DEAD - Cisco 3925" Tags="|cisco|vpn|troubleshooting|hardware|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16573" PostTypeId="1" AcceptedAnswerId="16576" CreationDate="2015-02-09T09:19:41.320" Score="1" ViewCount="2502" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/q9cS7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data link is completely okay. I can access MGMT IPs of routers (10.0.0.2 |10.0.0.4) from 3750 but not from PC. I can access 3750 MGMT IP (10.0.0.1) from PC . Any idea why ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note : All management links are in same vlan in 3750  &lt;/p&gt;&#xA;" OwnerUserId="4472" LastEditorUserId="775" LastEditDate="2015-02-09T11:58:53.533" LastActivityDate="2015-02-09T12:41:04.910" Title="Cant access remote management interface" Tags="|cisco|routing|switching|management|cisco-asr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16574" PostTypeId="2" ParentId="16559" CreationDate="2015-02-09T10:15:51.750" Score="-1" Body="&lt;p&gt;When 2 Ethernet equipments are back to back connected, with the same cable to the 2 ports, the MAC layer is in situation of connected mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The native behavior of the MAC layer is connectionless mode, with source address and destination address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A connectionless mode protocol can operate in connected mode, but a connected mode protocol (as ATM, MPLS, PPP) can never operate in connectionless mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you're right, in this case, the Ethernet is simply used in connection mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The behaviour is same with PBB-TE carrier Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards,&#xA;Michel&lt;/p&gt;&#xA;" OwnerUserId="13762" LastActivityDate="2015-02-09T10:15:51.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16576" PostTypeId="2" ParentId="16573" CreationDate="2015-02-09T11:58:19.857" Score="3" Body="&lt;p&gt;You need the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Plug an ethernet cable from the cisco 3750 into the ASR's &lt;code&gt;MGMT ETHERNET&lt;/code&gt; port&lt;/li&gt;&#xA;&lt;li&gt;Ensure the ASR &lt;code&gt;MGMT ETHERNET&lt;/code&gt; cables are in &lt;code&gt;mgmt_vlan&lt;/code&gt; on the 3750&lt;/li&gt;&#xA;&lt;li&gt;Ensure the &lt;code&gt;mgmt_vlan&lt;/code&gt; with 10.0.0.0 is in the Cisco 3750's global routing table&lt;/li&gt;&#xA;&lt;li&gt;Put an IP address on the &lt;code&gt;MGMT ETHERNET&lt;/code&gt; GigabitEthernet0 port of the ASR's RP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After you've checked those things, then add this command on each of the ASRs...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route vrf Mgmt-intf 0.0.0.0 0.0.0.0 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/asr1000/configuration/guide/chassis/asrswcfg/Management_Ethernet.html#pgfId-1060607&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco ASR1000 doc ref&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KJ5ju.png&quot; alt=&quot;Mgmt-intf&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-02-09T12:41:04.910" LastActivityDate="2015-02-09T12:41:04.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16577" PostTypeId="2" ParentId="16567" CreationDate="2015-02-09T14:37:20.983" Score="4" Body="&lt;p&gt;Yes, the VPN module is a linecard that's plugged into the router and can be replaced.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A 'DEAD' hardware state simply means the router has lost communication with the ISM.  This does not actually mean the hardware is dead, as a variety of issues in the field have caused this for me: Cards that somehow get unseated, incompatibilities with IOS and the card's firmware, etc.  The first issue usually has different evidence, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try to reload the router, but the best bet would be to engage Cisco's TAC to identify whether it is a backplane problem on the router or a problem with the module itself.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that the &lt;code&gt;show crypto engine config&lt;/code&gt; command still returns results about the card is an indicator that the card itself may be OK and has just crashed, but the HW state 'DEAD' doesn't mean the hardware is gone forever (though it could indicate a hardware problem such as memory corruption, electrical failure, etc).  Cisco bug CSCtz51773 may be relevant here, find a release that has a fix for this bug and try it out to see if it works for you.&lt;/p&gt;&#xA;" OwnerUserId="43" LastEditorUserId="43" LastEditDate="2015-02-09T18:21:09.843" LastActivityDate="2015-02-09T18:21:09.843" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16581" PostTypeId="1" AcceptedAnswerId="16582" CreationDate="2015-02-09T16:37:09.317" Score="1" ViewCount="1727" Body="&lt;p&gt;Please forgive the basic nature of this question, but I have very little experience with networking and would appreciate feedback / input on this.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rundown: We have access to multiple static IP addresses through our ISP.  We have a primary office network, a secondary guest network, and a couple of file / web servers that need to be accessible from the outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for a primary / secondary network behind the modem, is to allow guests at the office to sign in to wifi, without having to expose any of our internal servers/computers to that network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have attached a diagram of what I believe will work for this, and am wondering if this is the best way to set something like this up, or if there is a better way to do what we are trying to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your time! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uPTgA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;Network Diagram&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13788" LastActivityDate="2015-02-09T16:54:28.837" Title="General Network Setup for multiple static IP addresses" Tags="|routing|design|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16582" PostTypeId="2" ParentId="16581" CreationDate="2015-02-09T16:54:28.837" Score="0" Body="&lt;p&gt;Yes, this is a pretty typical setup.  However, depending upon your hardware, you could simplify things a bit.  For instance, I have a similar setup but use only one router.  I have two LANs (corporate/public) which connect to the router through two interfaces, Lan1 and Lan2.  They are isolated form one another through routes and firewall rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lan1 connects to the WAN via Wan1 interface and Lan2 can only connect to the WAN via a physically different interface, Wan2.  Those two Wan interfaces are assigned two respective static IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, web servers etc. which need to be accessible from the WWW are on a different internal interface called the DMZ.  This is an internal network, a third subnet, mostly isolated from Lan1 and Lan2 for security reasons.  Using Network Address Translation, your router may be able to &quot;translate&quot; an incoming request on a third, fourth, nth static IP address to an internal IP.  You can better protect your server(s) using a hardware firewall instead of relying on whatever software your server is running.  &lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2015-02-09T16:54:28.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16584" PostTypeId="1" CreationDate="2015-02-09T18:53:15.220" Score="1" ViewCount="461" Body="&lt;p&gt;I'm trying to connect ubiquity NanoStation M2 as Station/Router mode to a hotspot that I believe has WPA/AES security and EAP-PEAP for auth.&#xA;I have tested the username and password from my laptop and it works fine. Now I'm trying to connect to the same hotspot from around 700 meters away using my Nanostation M2. However here's the error that I got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb 04 23:59:10 system: Start&#xA;Feb 4 23:59:10 syslogd started: BusyBox v1.11.2&#xA;Feb 4 23:59:11 dnsmasq[19961]: started, version 2.47 cachesize 150&#xA;Feb 4 23:59:11 dnsmasq[19961]: compile time options: IPv6 GNU-getopt no-DBus no-I18N TFTP&#xA;Feb 4 23:59:11 dnsmasq[19961]: DHCP, IP range 192.168.1.2 -- 192.168.1.254, lease time 10m&#xA;Feb 4 23:59:11 dnsmasq[19961]: no servers found in /etc/resolv.conf, will retry&#xA;Feb 4 23:59:11 dnsmasq[19961]: read /etc/hosts - 1 addresses&#xA;Feb 4 23:59:11 dropbear[19963]: Not backgrounding&#xA;Feb 4 23:59:11 wireless: ath0 Set Mode:Managed&#xA;Feb 4 23:59:11 wpa-supplicant: Trying to associate with 1c:6a:7a:a8:ef:a0 (SSID='Testwifi' freq=2437 MHz)&#xA;Feb 4 23:59:11 wireless: ath0 Set Mode:Managed&#xA;Feb 4 23:59:11 wireless: ath0 Set Frequency:2.437 GHz (Channel 6)&#xA;Feb 4 23:59:11 wireless: ath0 New Access Point/Cell address:1C:6A:7A:A8:EF:A0&#xA;Feb 4 23:59:11 wpa-supplicant: Associated with 1c:6a:7a:a8:ef:a0&#xA;Feb 4 23:59:11 wpa-supplicant: CTRL-EVENT-EAP-STARTED EAP authentication started&#xA;Feb 4 23:59:11 wpa-supplicant: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected&#xA;Feb 4 23:59:12 wpa-supplicant: CTRL-EVENT-EAP-FAILURE EAP authentication failed&#xA;Feb 4 23:59:14 wpa-supplicant: Authentication with 1c:6a:7a:a8:ef:a0 timed out.&#xA;Feb 4 23:59:14 wireless: ath0 Sending disassoc to 1c:6a:7a:a8:ef:a0. Reason: Station has left the basic service area and is disassociated (8).&#xA;Feb 4 23:59:14 wireless: ath0 New Access Point/Cell address:Not-Associated&#xA;Feb 4 23:59:14 wpa-supplicant: CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys&#xA;Feb 4 23:59:16 wireless: ath0 Scan request completed&#xA;Feb 4 23:59:16 wpa-supplicant: Trying to associate with 1c:6a:7a:a8:ef:a0 (SSID='Testwifi' freq=2437 MHz)&#xA;Feb 4 23:59:16 wireless: ath0 Set Mode:Managed&#xA;Feb 4 23:59:16 wireless: ath0 Set Frequency:2.437 GHz (Channel 6)&#xA;Feb 4 23:59:16 wireless: ath0 New Access Point/Cell address:1C:6A:7A:A8:EF:A0&#xA;Feb 4 23:59:16 wpa-supplicant: Associated with 1c:6a:7a:a8:ef:a0&#xA;Feb 4 23:59:16 wpa-supplicant: CTRL-EVENT-EAP-STARTED EAP authentication started&#xA;Feb 4 23:59:16 wpa-supplicant: CTRL-EVENT-EAP-METHOD EAP vendor 0 method 25 (PEAP) selected&#xA;Feb 4 23:59:16 wpa-supplicant: CTRL-EVENT-EAP-FAILURE EAP authentication failed&#xA;Feb 4 23:59:17 dnsmasq[19961]: DHCPDISCOVER(br0) a0:f3:c1:b0:a0:09 &#xA;Feb 4 23:59:17 dnsmasq[19961]: DHCPOFFER(br0) 192.168.1.91 a0:f3:c1:b0:a0:09 &#xA;Feb 4 23:59:17 dnsmasq[19961]: DHCPREQUEST(br0) 192.168.1.91 a0:f3:c1:b0:a0:09 &#xA;Feb 4 23:59:17 dnsmasq[19961]: DHCPACK(br0) 192.168.1.91 a0:f3:c1:b0:a0:09 WR720N&#xA;Feb 4 23:59:18 wpa-supplicant: Authentication with 1c:6a:7a:a8:ef:a0 timed out.&#xA;Feb 4 23:59:18 wireless: ath0 Sending disassoc to 1c:6a:7a:a8:ef:a0. Reason: Station has left the basic service area and is disassociated (8).&#xA;Feb 4 23:59:18 wireless: ath0 New Access Point/Cell address:Not-Associated&#xA;Feb 4 23:59:18 wpa-supplicant: CTRL-EVENT-DISCONNECTED - Disconnect event - remove keys&#xA;Feb 4 23:59:21 wireless: ath0 Scan request completed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it repeats over and over again.&#xA;I have updated to the latest AirOs firmware.&#xA;Thanks for any help&lt;/p&gt;&#xA;" OwnerUserId="13794" LastActivityDate="2015-02-09T18:53:15.220" Title="wpa-aes EAP-peap authentication problem" Tags="|routing|router|security|authentication|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16585" PostTypeId="1" AcceptedAnswerId="16587" CreationDate="2015-02-09T19:02:18.337" Score="2" ViewCount="172" Body="&lt;p&gt;When using AS prepending in a multi-homed BGP environment (primary/secondary routers, secondary prepends one more ASN), how fast is reconvergence of inbound traffic when the primary router goes down? How much time does it generally take for other routers to notice the primary router is down and it should not use this route?&lt;/p&gt;&#xA;" OwnerUserId="13795" LastActivityDate="2015-02-09T20:34:41.900" Title="When using AS prepending in a multi-homed BGP environment, how fast is reconvergence of inbound traffic when the primary router goes down?" Tags="|routing|router|ipv4|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16587" PostTypeId="2" ParentId="16585" CreationDate="2015-02-09T20:34:41.900" Score="2" Body="&lt;p&gt;Default BGP keepalives are sent every 60 seconds. If a participating device does not receive a return response within 180 seconds, the default Hold Time, a reconvergence will occur. So by default, it will take 3 minutes for your devices to determine a neighbor is down before reconvergence. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Defaults&#xA;keepalive: 60 seconds&#xA;holdtime: 180 seconds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are some helpful commands for BGP &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp4.html&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-02-09T20:34:41.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16589" PostTypeId="1" AcceptedAnswerId="16590" CreationDate="2015-02-09T21:23:28.623" Score="4" ViewCount="1478" Body="&lt;p&gt;I do however, need ISP1 to automatically become the primary route once the route is back up. There are only 3 routers in this topology, router 1 and router 3 are connected with ISP1 and ISP2 respectively.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP1 AS 1000 R1        ISP3 AS 3000 R3&#xA;          \             /&#xA;           \           /&#xA;             AS 2000 R2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am looking at using the &lt;code&gt;neighbor 10.1.12.2 default-originate&lt;/code&gt; command, which, if I understand correctly is supposed to not only create the default route but also advertise it to the specified neighbor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with this is I don't know how I would create the backup to ISP2 with this technique. I am assuming I need to change the BGP route attributes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was also looking at using the AS-Path prepend and route-map command which may work for setting up my back up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone could point me in the right direction as I am obviously unfamiliar with the process. &lt;/p&gt;&#xA;" OwnerUserId="13800" LastEditorUserId="775" LastEditDate="2015-02-10T09:34:07.113" LastActivityDate="2015-02-10T09:34:07.113" Title="In a multi-homed BGP network I am looking to create a default route to ISP 1 with ISP2 as backup" Tags="|cisco|bgp|redundant-routes|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16590" PostTypeId="2" ParentId="16589" CreationDate="2015-02-10T03:32:05.630" Score="4" Body="&lt;p&gt;This &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/16471/ebgp-dual-isp-dual-edge-router/16474&quot;&gt;link&lt;/a&gt; is very similar to what you are asking I think. It doesn't have specific configuration however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are wanting to use default routes I would be inclined to use a floating static route on your secondary router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 *next-hop-address* 250&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where '&lt;em&gt;250&lt;/em&gt;' is the administrative distance of the default route. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On your primary router simply use the above route without the administrative distance and then redistribute it into BGP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bgp *ASN*&#xA; redistribute static route-map *name of route-map* out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can then match the default route in a prefix list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list default-route seq 5 permit 0.0.0.0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And match the prefix list in the route-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map *name of route-map* permit *seq number*&#xA; match ip address prefix-list default-route&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;iBGP has an administrative distance value of &lt;em&gt;170&lt;/em&gt;. So when your primary router advertises that to your secondary router it will prefer the iBGP route over the statically set default route. If you want to advertise the default from the secondary router to the primary then I would suggest using local preferences. Local Preferences values that are attached to routes on BGP advertisements. A higher Local Preference is preferred in BGP even when they have the same Administrative Distance (170) and they are the same route, in this case, 0.0.0.0/0. In that route map you can also attach local preference to the route as well as other BGP attributes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set local-preference *value*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note, default local preference is &lt;em&gt;100&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to track whether there is reachability for the default routes you can attach an ip sla to the static route. You can read about ip sla's &lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/813-cisco-router-ipsla-basic.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that link I mentioned at the start, it talks about how the ISP's would prioritise sending back to a specific connection. So I'd recommend having a read of that to see if that answers that part of your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;H&lt;/p&gt;&#xA;" OwnerUserId="11927" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-02-10T03:32:05.630" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16599" PostTypeId="2" ParentId="16539" CreationDate="2015-02-10T22:19:12.837" Score="2" Body="&lt;p&gt;From your comments I understand you want to log into your Cisco Unity Express (CUE) via CLI session to do password recovery. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next is a sample configuration for NME with CUE:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet0/0&#xA; description LAN&#xA; ip address 10.10.10.5 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA; media-type rj45&#xA;!&#xA;!&#xA;!&#xA;interface Integrated-Service-Engine2/0&#xA; ip unnumbered GigabitEthernet0/0&#xA; service-module ip address 10.10.10.10 255.255.255.0&#xA; !Application: CUE Running on NME&#xA; service-module ip default-gateway 10.10.10.1&#xA; no keepalive&#xA;!&#xA;!&#xA;ip route 10.10.10.10 255.255.255.255 Integrated-Service-Engine2/0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can access router´s CLI in 10.10.10.5 and CUE GUI in 10.10.10.10. Also, to log into CUE CLI you can do it from router CLI by running the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#service-module Integrated-Service-Engine 2/0 session&#xA;Trying 10.10.10.10, 2130 ... Open&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From your comments I think you are reaching this point. Once there, press enter twice and you should get the the CUE prompt:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#service-module Integrated-Service-Engine 2/0 session&#xA;Trying 10.10.10.10, 2130 ... Open&#xA;&#xA;UnityExpress#&#xA;UnityExpress# &#xA;UnityExpress# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just in case you need it, the process to do password reset in CUE GUI is documented here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unity-express/64234-cue-gui-pw.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unity-express/64234-cue-gui-pw.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In brief, you have to create a new user, assign a password to it and add this user to group &quot;Administrators&quot;, using the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UnityExpress&amp;gt;&#xA;UnityExpress&amp;gt;user Administrator create &#xA;UnityExpress&amp;gt;&#xA;UnityExpress&amp;gt;user Administrator group Administrators&#xA;UnityExpress&amp;gt;&#xA;UnityExpress&amp;gt;user Administrator password cisco&#xA;UnityExpress&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="76" LastActivityDate="2015-02-10T22:19:12.837" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16600" PostTypeId="1" CreationDate="2015-02-11T00:10:20.607" Score="1" ViewCount="275" Body="&lt;p&gt;Fairly new with setting up fiber optic so bear with me.We have a single mode fiber optic running around 200m. After doing some research I have come down to purchasing this SFP: DLINK DEM310GT 1000BASE-LX MINI&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My only main concern is that whether I need to consider other things which I read like wavelength or the OM of the fiber as our fiber is only running at 200 meters?&lt;/p&gt;&#xA;" OwnerUserId="13817" LastEditorUserId="775" LastEditDate="2015-02-11T10:45:40.570" LastActivityDate="2015-02-11T10:45:40.570" Title="SFP for old, 200m fiber run" Tags="|fiber|cabling|sfp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16601" PostTypeId="2" ParentId="16600" CreationDate="2015-02-11T01:40:32.240" Score="3" Body="&lt;p&gt;OM ratings are for multi-mode fiber.  Single-mode fiber uses OS ratings and for a 200 meter run, the choice of OS rating should only be dependent on they type of installation (and should have been properly determined by your installer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the wavelength this is determined by the transceiver, so you will be fine as long as you go with LX or LH transceivers for this run.  I prefer optics that support &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/asr_901/Configuration/Guide/b_asr901-scg/b_asr901-scg_chapter_0101000.pdf&quot; rel=&quot;nofollow&quot;&gt;digital optical monitoring&lt;/a&gt; (DOM), if the platform (i.e. switch/router) also supports it as this will allow you to determine things like low/high power levels.  The linked product does not appear to have DOM support.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-02-11T01:40:32.240" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16602" PostTypeId="1" CreationDate="2015-02-11T01:52:18.460" Score="3" ViewCount="561" Body="&lt;p&gt;i have a BFR file from a customer that contains nano-second resolution. OI can convert it via tshark, but it does not retain the nano-second resolution on the end pcap file. Is there a way to convert BFR without loosing the nano-second resolution?&lt;/p&gt;&#xA;" OwnerUserId="6286" LastEditorUserId="775" LastEditDate="2015-02-11T03:45:32.190" LastActivityDate="2015-02-11T03:45:32.190" Title="Convert BFR to PCAP without loosing nano-second resolution" Tags="|wireshark|tcpdump|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16603" PostTypeId="2" ParentId="16602" CreationDate="2015-02-11T02:18:50.423" Score="3" Body="&lt;p&gt;I assume by &quot;BFR file&quot; you mean &quot;file from Network Instruments Observer&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pcap files, by default, support only microsecond resolution time stamps.  There's a modified version of pcap that supports nanosecond-resolution time stamps, but not all programs that can read pcap files will be able to read those files correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're willing to have a file that not all programs could read, you could use &lt;code&gt;editcap&lt;/code&gt; or &lt;code&gt;tshark&lt;/code&gt; to convert the file and use the flag &lt;code&gt;-F nseclibpcap&lt;/code&gt; to force &lt;code&gt;editcap&lt;/code&gt; or &lt;code&gt;tshark&lt;/code&gt; to write a nanosecond-resolution pcap file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;editcap&lt;/code&gt; and &lt;code&gt;tshark&lt;/code&gt; don't support that, you probably have a version of Wireshark that's too old, and will need to get a newer one.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastEditorUserId="775" LastEditDate="2015-02-11T03:45:16.507" LastActivityDate="2015-02-11T03:45:16.507" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16605" PostTypeId="2" ParentId="16471" CreationDate="2015-02-11T12:18:50.560" Score="-1" Body="&lt;p&gt;You can use MED to influence inbound traffic to your AS.&lt;/p&gt;&#xA;" OwnerUserId="13826" LastActivityDate="2015-02-11T12:18:50.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16606" PostTypeId="1" AcceptedAnswerId="16609" CreationDate="2015-02-11T12:21:37.770" Score="4" ViewCount="2779" Body="&lt;p&gt;Assume a simple IPv4 network where all machines are on the same subnet and share a single switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If an IP moves to another MAC, how are Layer 3 clients supposed to detect that change? Will a client keep trying on the old MAC until its ARP cache times out, or will it do something smarter? Is it dependent on OS/networking stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm dealing with a case where a GARP announce was made by the overtaking MAC, but it was missed by some clients who weren't connected at that point in time. &lt;/p&gt;&#xA;" OwnerUserId="13825" LastActivityDate="2015-06-12T20:54:13.100" Title="ARP: how are MAC changes for an IP detected?" Tags="|mac-address|arp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16607" PostTypeId="1" AcceptedAnswerId="16608" CreationDate="2015-02-11T12:44:21.293" Score="3" ViewCount="1525" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/pfOev.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the switch learns the addresses using flooding. But what happens when there is a hub connected? What address do I write in the table if for example computer &lt;em&gt;d&lt;/em&gt; sends a message to &lt;em&gt;a&lt;/em&gt; through port 3, and also &lt;em&gt;c&lt;/em&gt; sends a message to &lt;em&gt;b&lt;/em&gt; through port 3?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whose address does the switch take? or does it add another listing in the table for port 3 ?&lt;/p&gt;&#xA;" OwnerUserId="13770" LastEditorUserId="2142" LastEditDate="2015-02-11T14:51:53.200" LastActivityDate="2015-02-11T14:51:53.200" Title="How is the switch's MAC table filled when there is a hub connecting multiple hosts to the switch?" Tags="|switch|switching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16608" PostTypeId="2" ParentId="16607" CreationDate="2015-02-11T13:17:39.357" Score="6" Body="&lt;p&gt;First, let me clarify:  the switch does not learn addresses by flooding.  The switch learns addresses by examining the source address of each frame received, then updating the MAC address if necessary.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mac address table lists each mac address received and the associated port (among other things).  So your switch would have an entry for mac D listing port 3, and an entry for mac C, also listing port 3.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if the switch gets a frame destined for either C or D, it knows to forward it out port 3.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-02-11T13:17:39.357" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16609" PostTypeId="2" ParentId="16606" CreationDate="2015-02-11T13:30:30.200" Score="3" Body="&lt;p&gt;Clients will use the ARP cache entry as long as it's valid.  How long that is depends on the OS.  On a Cisco router, it's 4 hours.  On a Windows PC, it's a random value (really!) between 15 and 45 seconds.  Most Linux systems use 60 seconds.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-02-11T13:30:30.200" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="16610" PostTypeId="2" ParentId="16471" CreationDate="2015-02-11T14:20:21.143" Score="0" Body="&lt;p&gt;Like others have said, there's no foolproof way to do this, and it will constantly need tweaking.  That said, we've had the best luck by deaggregating.  I know it's very frowned upon, but it seems to be pretty effective.  Essentially, continue to advertise the /20 to both providers, but then also advertise the first half of the /20 (a /21) to ISP 1 and advertise the last half of the /20 (a /21) to ISP 2.  Thus, all traffic destined to the first /21 uses ISP 1, and all traffic destined to the second /21 uses ISP 2.  If either connection fails, the /20 advertised to the other ISP will keep everything flowing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like I said, I know this is bad form and frowned upon...but it works.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2015-02-11T14:20:21.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16611" PostTypeId="1" CreationDate="2015-02-11T15:15:32.673" Score="1" ViewCount="1092" Body="&lt;p&gt;first I'm gonna warn that I'm fairly bad at understanding networking so kinda nervous about posting this.... I'm using NetsimK to study setting up a network for a college assignment, I'm finding it really difficult and my assignment is due in 2 weeks (I can't work on it outside college so essentially I only have 2 days) so I'm in a bit of a panic. I'm trying to mess about with the simulator at home so I don't spend so much of my class time googling how to do stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the scenario is that I'm setting up an office network using 6 PCs. All these PCs are connected to a 24 port switch. I'ce named these PCs PC1, PC2, etc and manually assigned IPs respectively i.e. 010.000.000.001, 010.000.000.002 etc. For the second part of the assignment, we're supposed to make this network wireless. and this is the part I'm having trouble with, my lecturer is no help as he just brushes off my questions and is really intimidating - I've been trying to figure it out using Google but can't do it. Anyway - lecturer has said that we should add an access point to add wireless capability, which makes sense. Another point - there is no access point in the simulator, even though in my lecturers example screenshot of simulator there was one, so I've used a router instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway the problem is that I don't know how to assign an IP and gateway to the switch (I'm not to use DHCP). I can open HyperTerminal and use user and priviledged EXEC codes. When I click &quot;check configuration&quot; on the simulator:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/VoS9C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VoS9C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My physical topology:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/JxXQ0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JxXQ0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cables used are all straight through cables. I would appreciate ANY help - I hope I've explained everything right and supplied enough information.&#xA;Edit: I've run a console/rollover cable from PC1 to the router as I can't open HyperTerminal otherwise&lt;/p&gt;&#xA;" OwnerUserId="13829" LastEditorUserId="775" LastEditDate="2015-02-12T11:11:50.933" LastActivityDate="2018-02-27T10:55:36.863" Title="Howto configure router to add to private network LAN?" Tags="|cisco|router|switch|access-point|" AnswerCount="3" CommentCount="5" ClosedDate="2018-02-27T21:52:28.760" ContentLicense="CC BY-SA 3.0" />
  <row Id="16612" PostTypeId="1" AcceptedAnswerId="16620" CreationDate="2015-02-11T15:25:35.367" Score="1" ViewCount="12117" Body="&lt;p&gt;Please help me on this case:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect a NIC manually set to 100 Mbps and Full Duplex to a Gigabit Ethernet port (set to Auto/Auto), what will the result be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the Gigabit Ethernet port negotiate to 100Mbps/FD or 100Mbps/HD?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any documents that describe this behavior in detail?&lt;/p&gt;&#xA;" OwnerUserId="13751" LastEditorUserId="43" LastEditDate="2015-02-11T23:43:35.227" LastActivityDate="2015-02-13T06:43:11.887" Title="Negotiation speed/duplex between a Gigabit ethernet switch or hub and NIC" Tags="|duplex|" AnswerCount="2" CommentCount="0" ClosedDate="2015-02-13T10:20:52.347" ContentLicense="CC BY-SA 3.0" />
  <row Id="16613" PostTypeId="1" AcceptedAnswerId="16614" CreationDate="2015-02-11T15:40:58.783" Score="6" ViewCount="24509" Body="&lt;p&gt;This may be stupid question as I don't have much knowledge in networking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, I have Cisco Catalyst 2960 switch and I'm curios if I can configure it to get IP configuration from DHCP server, like all other devices on network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I have to write it's IP configuration manually, but it would be nice if that can be handled by DHCP server.&lt;/p&gt;&#xA;" OwnerUserId="3060" LastActivityDate="2018-03-24T13:26:24.860" Title="Can Cisco Catalyst switch get IP from DHCP server?" Tags="|cisco|switch|dhcp|cisco-catalyst|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16614" PostTypeId="2" ParentId="16613" CreationDate="2015-02-11T15:49:52.010" Score="10" Body="&lt;p&gt;You can specify an interface to receive an address from DHCP like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure terminal&#xA;interface (int-name-num)&#xA;ip address dhcp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This guide gives way more detail into DHCP features - &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/12-4t/dhcp-12-4t-book/config-dhcp-client.html#GUID-8BC4B08B-0436-42B6-8E3A-021DE842A893&quot;&gt;Cisco DHCP Client Configuration&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should note that there are additional commands to the ones I listed, but they are optional.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-02-11T15:49:52.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16618" PostTypeId="2" ParentId="16611" CreationDate="2015-02-12T00:10:31.483" Score="0" Body="&lt;p&gt;You don't have to have your switch or wireless AP have the default gateway unless they're performing routing, which, probably isn't the case. Whatever IP address is on the Router's E0 interface is going to be your host's (PC's) default gateway. You'll have to manually set the default gateway on the PC's since you don't have a DHCP server in place to distribute that information. Hope this has helped. Generally, switches will only operate as a layer 2 device (where they don't handle IP addresses, just MAC addresses). If it's part of your assignment, to give the switch an IP address, you'll also have to add a &quot;default gateway.&quot; checkout this site for the ip default-gateway command: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_19_ea1/configuration/guide/2950scg/swipaddr.html#wp1037806&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_19_ea1/configuration/guide/2950scg/swipaddr.html#wp1037806&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13832" LastEditorUserId="13832" LastEditDate="2015-02-12T00:21:31.667" LastActivityDate="2015-02-12T00:21:31.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16620" PostTypeId="2" ParentId="16612" CreationDate="2015-02-12T03:11:56.580" Score="2" Body="&lt;p&gt;By manually setting the speed and duplex on one side with automatic detection on the other side, the side with automatic speed will detect (not negotiate) the correct speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the duplex, negotiation will fail.  This results in the side with automatic duplex set to the default duplex for the speed.  The default duplex for 1 Gb is FULL, and for 10 and 100 Mb is HALF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your scenario results in a duplex mismatch which causes several problems that will slow the link to a crawl.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a nice table in this document: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/17053-46.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/17053-46.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently, someone has isolated the &lt;a href=&quot;http://tools.cisco.com/search/results/display?url=https%3A%2F%2Fsupportforums.cisco.com%2Fsites%2Fdefault%2Ffiles%2Flegacy%2F7%2F3%2F0%2F9037-Switch%2520-%2520to%2520-%2520PC%2520Speed%2520%2526%2520Duplex%2520Settings%2520-%2520Valid%2520Configuration%2520Table.doc&amp;amp;pos=27&amp;amp;query=autonegotiation%20duplex%20mismatch&quot; rel=&quot;nofollow&quot;&gt;table&lt;/a&gt; in a separate document.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-02-12T03:24:43.543" LastActivityDate="2015-02-12T03:24:43.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16623" PostTypeId="2" ParentId="12556" CreationDate="2015-02-12T07:41:37.507" Score="1" Body="&lt;p&gt;32 length specifies 16 bytes of global ipv6 address and 16 bytes for link-local address. See &quot;RFC- 2545 Use of BGP-4 Multiprotocol Extensions for IPv6 Inter-Domain Routing&quot; for more details.&lt;/p&gt;&#xA;" OwnerUserId="13835" LastActivityDate="2015-02-12T07:41:37.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16624" PostTypeId="1" CreationDate="2015-02-12T08:20:45.760" Score="1" ViewCount="5563" Body="&lt;p&gt;My company has 2 ASA firewall with model 5510 &amp;amp; 5512 in difference country, I was connected it via IPSEC VPN. It can work in normal until 2 weeks ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked from log in ASA5512 firewall, it has error message :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tunnel Manager has failed to establish an L2L SA.  All configured IKE versions &#xA;failed to establish the tunnel. Map Tag= outside_map.  Map Sequence Number = 1.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this message only display in ASA5512 and haven't alert in ASA5510. Also, the problem only affected specified tunnel only, remain other IPSEC VPN tunnel able to work properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran &lt;code&gt;show isakmp sa&lt;/code&gt; on both firewall it shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IKE Peer: [Firewall IP Address]&#xA;Type    : user            Role    : initiator &#xA;Rekey   : no              State   : MM_WAIT_MSG2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It look IKE phase 1 is unable to connect on each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone can advise on this issue?&lt;/p&gt;&#xA;" OwnerUserId="13836" LastEditorUserId="775" LastEditDate="2015-02-12T10:40:50.490" LastActivityDate="2015-02-12T10:40:50.490" Title="VPN tunnel connection issue" Tags="|cisco|cisco-asa|vpn|ipsec|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16625" PostTypeId="1" CreationDate="2015-02-12T09:31:41.613" Score="10" ViewCount="190989" Body="&lt;p&gt;I wonder what can cause the first line output of the command &lt;code&gt;show interfaces&lt;/code&gt; to be: &lt;code&gt;FastEthernet is up, line protocol is down&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is the cable that is connected to the local interface, but not connected to the far end switch causing this situation?&lt;/li&gt;&#xA;&lt;li&gt;Is a good cable that is connected to both switches, but one switch had it's interface in an &quot;administratively down&quot; state causing this situation?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If not, what would cause an interface to be in an up,down state?&lt;/p&gt;&#xA;" OwnerUserId="13837" LastEditorUserId="453" LastEditDate="2018-04-07T00:18:20.953" LastActivityDate="2018-09-25T23:27:32.553" Title="What can cause &quot;FastEthernet is up, line protocol is down&quot; on a Cisco Switch?" Tags="|cisco|switch|ethernet|interface|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16626" PostTypeId="1" CreationDate="2015-02-12T10:26:02.777" Score="7" ViewCount="25249" Body="&lt;p&gt;Is there a difference between the following two configurations on a cisco device?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g0/1&#xA;switchport mode access&#xA;switchport access vlan 10&#xA;switchport voice vlan 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g0/1&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;switchport trunk native vlan 10&#xA;switchport trunk allowed vlan 10,20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Environment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco Port ---&amp;gt; IP Phone ---&amp;gt; Client Computer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which configuration do I have to use and why? If there is no difference, which method is the preferred one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&#xA;koron54&lt;/p&gt;&#xA;" OwnerUserId="13839" LastActivityDate="2015-02-17T14:17:44.843" Title="Difference between trunk and access/voice port" Tags="|cisco|" AnswerCount="3" CommentCount="2" ClosedDate="2015-04-20T14:36:59.917" ContentLicense="CC BY-SA 3.0" />
  <row Id="16627" PostTypeId="2" ParentId="16625" CreationDate="2015-02-12T10:54:07.757" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I wonder what can cause that the first line output of the command &quot;show interfaces&quot; will be: &quot;fastEthernet is up, line protocol is down&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cisco ethernet interfaces are normally down / down if they don't have a link.  If you're seeing up / down, the most likely causes are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cable fault&lt;/li&gt;&#xA;&lt;li&gt;Speed mismatch (I personally haven't seen a duplex mismatch bring an intf up / down)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;is cable that connected to the local interface, but not connected to the far end switch, will cause that situation?&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If the cable is bad...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;is good cable that connected to both switches, but one switch had it's interface in &quot;administratively down&quot; state, will cause that situation?&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I haven't seen that recently.  For example, I have a c3560c in my lab and shutdown fa0/12... then I connected a good cable between the fa0/11 and fa0/12 ports...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw1#sh ip int brief | i 0/1[1-9]&#xA;FastEthernet0/11       unassigned      YES unset  down                  down&#xA;FastEthernet0/12       unassigned      YES unset  administratively down down&#xA;sw1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That said, I do have vague memories of seeing up / down when the remote interface was shut on other platforms in the past, but I don't remember seeing it recently&#xA;If the cable is faulty, it could cause up / down status&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Testing your cabling&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a Cisco switch, you can test your cabling on the up / down interface like this... the following is good &lt;a href=&quot;https://supportforums.cisco.com/document/74231/how-use-time-domain-reflectometer-tdr&quot;&gt;&lt;code&gt;tdr&lt;/code&gt;&lt;/a&gt; output for the command when nothing is connected to the other end of the cable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw1#test cable-diagnostic tdr interface Fa0/6&#xA;TDR test started on interface Fa0/6&#xA;A TDR test can take a few seconds to run on an interface&#xA;Use 'show cable-diagnostics tdr' to read the TDR results.&#xA;sw1#&#xA;sw1#show cable-diagnostics tdr interface fa0/6&#xA;TDR test last run on: February 12 04:45:37&#xA;&#xA;Interface Speed Local pair Pair length        Remote pair Pair status&#xA;--------- ----- ---------- ------------------ ----------- --------------------&#xA;Fa0/6     auto  Pair A     31   +/- 1  meters N/A         Open&#xA;                Pair B     31   +/- 1  meters N/A         Open&#xA;                Pair C     N/A                N/A         Not Supported&#xA;                Pair D     N/A                N/A         Not Supported&#xA;sw1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: FastEthernet interfaces by-definition can only test two of the four pairs.  GigabitEthernet interfaces can test all four pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Older switches don't have a tdr function... you'd have to test the cabling manually.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-02-12T11:00:19.687" LastActivityDate="2015-02-12T11:00:19.687" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16628" PostTypeId="1" AcceptedAnswerId="16632" CreationDate="2015-02-12T11:01:12.797" Score="5" ViewCount="1064" Body="&lt;p&gt;So I have done a little reading around PaGP silent mode, and I don't understand why it exists. My understanding is from:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The silent mode is used when the switch is connected to a device that&#xA;  is not PAgP-capable and seldom, if ever, sends packets. An example of&#xA;  a silent partner is a file server or a packet analyzer that is not&#xA;  generating traffic. In this case, running PAgP on a physical port&#xA;  connected to a silent partner prevents that switch port from ever&#xA;  becoming operational; however, the silent setting allows PAgP to&#xA;  operate, to attach the interface to a channel group, and to use the&#xA;  interface for transmission.&#xA;  &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-1_13_ea1/configuration/guide/3550scg/swethchl.html#wp1028480&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3550/software/release/12-1_13_ea1/configuration/guide/3550scg/swethchl.html#wp1028480&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you know the partner device is never going to negotiate why not just force the channel with no negotiation protocol (neither PaGP or LACP) and just set it to on?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I tried to test this with the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch 1           Switch 2               Results&#xA;auto (silent)      auto (silent)          ports suspended&#xA;auto (silent)      on                     sw1 ports suspended&#xA;des  (silent)      on                     sw1 ports suspended&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I fundamentally missing something here?&lt;/p&gt;&#xA;" OwnerUserId="13290" LastEditorUserId="33" LastEditDate="2015-06-24T19:56:16.953" LastActivityDate="2015-06-24T19:56:16.953" Title="What is the technical reason for PaGP Silent mode and why is it a default?" Tags="|cisco|etherchannel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16629" PostTypeId="2" ParentId="16612" CreationDate="2015-02-12T13:24:14.343" Score="1" Body="&lt;p&gt;There are quite a few different autonegotiation standards.  The earlier standards (pre 802.3ab in 1999) were less than reliable, so you would have some cases where negotiation was done incorrectly between a host port and a switch port when both were doing negotiation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The negotiation standards work by sending pulses, called FLP pulses, across the link.  These pulses are 16 bits in most (all?) standards.  The important bits are 0 through 12, 13, and 16.  0 through 12 defines the standards used and capabilities of the link.  13 defines a link failure and 16 defines an acknowledgement.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most NICs won't send or pay attention to an FLP if autonegotiation is disabled in the NIC software.  It is possible the port will come up in half duplex, depending on the switch (many early-generation 100Mbits switches were this way).  On Gigabit capable ports, the port should default to full duplex, but this depends on how the manufacturer implemented the standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you didn't state whether or not your host was connected to a port capable of 100 Mbps operation.  Not all Gigabit ports are (e.g., in a 1Gb/10Gb switch).  If the port is connected to a switch which does not advertise the correct modes supported by your card, the port will not connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ethermanage.com/ethernet/pdf/dell-auto-neg.pdf&quot; rel=&quot;nofollow&quot;&gt;Here's&lt;/a&gt; an excellent reprint from PowerSolutions that describes the process in detail -- and &lt;a href=&quot;https://www.iol.unh.edu/sites/default/files/knowledgebase/ge/Clause_37_Auto-Negotiation.pdf&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; is a great presentation on autonegotiation from the IOL at University of New Hampshire which is an exceptional treatment of the subject.&lt;/p&gt;&#xA;" OwnerUserId="43" LastEditorUserId="43" LastEditDate="2015-02-12T13:51:04.237" LastActivityDate="2015-02-12T13:51:04.237" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16630" PostTypeId="2" ParentId="16626" CreationDate="2015-02-12T13:39:18.257" Score="2" Body="&lt;p&gt;The voice VLAN feature is supported only on access ports.  Voice VLAN permits the switch to accept tagged traffic on an access (normally untagged) link.  CDP is used to negotiate the voice VLAN between the phone and the network switch (the switch signals the phone; this voice VLAN is a separate TLV in the CDP standard).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The integrated switch on the back of the phone transmits the &quot;data&quot; packets (the port connected to the PC) as &quot;native VLAN&quot; (e.g. untagged packets, the access VLAN).  The voice packets are transmitted tagged, and the tag is read by the access switch and put in the correct VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a trunk port, the phone should detect the trunk and both access and voice VLAN packets should be tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The template for Cisco phone configurations in some Cisco switches is to configure the port as an access port.  Configuring the port as a trunk port may be dangerous without the appropriate security features; allowed VLAN is only part of an effective switchport security strategy.  Sticky MAC addresses might be a good next step.&lt;/p&gt;&#xA;" OwnerUserId="43" LastActivityDate="2015-02-12T13:39:18.257" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16631" PostTypeId="2" ParentId="16626" CreationDate="2015-02-12T14:02:06.213" Score="0" Body="&lt;pre&gt;&lt;code&gt;int g0/1&#xA;switchport mode access&#xA;switchport access vlan 10&#xA;switchport voice vlan 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above is the preferred configuration for VoiP phones connected to a client computer. Trunking was apparently the configuration used for older VoIP equipment. When configured as an access port, you can apply QOS to the vlan, prevent loops with STP, and lock down the PC/VOiP phone with port security. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI, for PC/VoiP phones, you'll need to enable &lt;code&gt;switchport port security max 2&lt;/code&gt; to allow for 2 macs on the access port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-4500-series-switches/69632-configuring-cat-ip-phone.html#configs&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt; specifically shows the access port configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the difference between Trunks and Access ports, a trunk does add dot1q or ISL tags directly to frames and can exist on all or multiple vlans. While an access port only passes traffic from a set vlan but does not modify the frame with a vlan tag.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="4634" LastEditDate="2015-02-17T14:17:44.843" LastActivityDate="2015-02-17T14:17:44.843" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16632" PostTypeId="2" ParentId="16628" CreationDate="2015-02-12T14:55:49.967" Score="3" Body="&lt;p&gt;PAgP silent permits the channel to be formed, but PAgP packets can still be interpreted by the device that is set to silent.   Imagine the case with some devices that do support PAgP but may not enable it on a &quot;secondary&quot; LAG, but you still want this LAG to be online in the event of a failure so you can switch over to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could force the channel on, which would have the same function in terms of getting the channel up but may have other side effects.  In networks with spanning tree configured, PAgP silent will also prevent spanning tree from reporting the port to be down.  Since LACP/PAGP frames are normally received only over one link in the bundle, if they are not sent or received on a port configured in a bundle and set to &quot;on&quot; then the port will be marked as down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/24046-184.html&quot; rel=&quot;nofollow&quot;&gt;these&lt;/a&gt; &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/24330-185.html#cg6&quot; rel=&quot;nofollow&quot;&gt;two&lt;/a&gt; links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is important to understand that there are a lot of other features such as loop guard and UDLD that may cause your ports to be suspended.&lt;/p&gt;&#xA;" OwnerUserId="43" LastActivityDate="2015-02-12T14:55:49.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16635" PostTypeId="1" AcceptedAnswerId="16637" CreationDate="2015-02-12T21:15:49.547" Score="2" ViewCount="1772" Body="&lt;p&gt;We have added to our existing network an HP v1910 switch with the purpose of adding two VLANS.  The computers in these two VLANS will need internet access, to communicate between the two VLANS and also to be able to contact computers that are still in the current network segment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured the VLANS on the HP switch and added a test computer in each VLAN.  The following is what works and doesn't work. I have also included screenshots of relevant information and a diagram of the physical layout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices in VLAN2(computer A) and VLAN3(computer B) can communicate with each other and access the internet without problems.  I had to add the two static routes (as seen in the diagram) on the ASA 5505 to make this work.  The problem is that devices on VLAN2 and VLAN3 cannot connect to devices on the original network outside of the HP v1910 switch. (as illustrated by computer C and the DHCP server)  My feeling is there is another static route or routes that need to be configured either on the ASA or the HP switch.  Advanced network routing is not my expertise but I do understand the basic concepts and can usually manage, but this has had me confused for days.  Also, I'm not sure if I have the ports tagged right since I don't have a good understanding of that purpose so I just left everything as default untagged.  Any help would be appreciated as I have scoured the internet for help to no avail.  I'll try to attach images below if I can figure out how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BV6kO.jpg&quot; alt=&quot;Physical Layout&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ik27J.jpg&quot; alt=&quot;VLAN Summary&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/TXUuS.jpg&quot; alt=&quot;VLAN Interfaces&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UIwxm.jpg&quot; alt=&quot;HP v1910 Active Routes&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/E2btG.jpg&quot; alt=&quot;Cisco ASA Static Routes&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="13842" LastActivityDate="2015-02-12T21:38:16.383" Title="VLAN problem on HP v1910 switch" Tags="|vlan|cisco-asa|hp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16636" PostTypeId="1" CreationDate="2015-02-12T21:37:57.943" Score="5" ViewCount="12850" Body="&lt;p&gt;I was searching this for quite long time but I haven't found any satisfying  result so my question is basically that, if I understand correctly how modems work and when they are used. I have some more questions so here is what I think I know&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;They work on OSI layer 2 (MAC adresses) and they are connected directly to ISP since they don't know how to work with IP of some webpage which I am requesting (OSI layer 3) (Or they can somehow go up the OSI stack to third layer?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;They are used only when you are accessing internet through telephone cable because they need to modulate/demodulate analog signal for a router or computer to which they are connected.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If number 1 is right and they are connected directly to ISP, what is next? Are packets sent through routers and other networking devices like switches and so?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13848" LastActivityDate="2015-02-13T19:58:31.977" Title="Which layer does modem operate and are they still used?" Tags="|router|mac-address|osi|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16637" PostTypeId="2" ParentId="16635" CreationDate="2015-02-12T21:38:16.383" Score="1" Body="&lt;p&gt;The computers (computer C and the DHCP server) will send traffic destined for the 192.168.x.0/24 blocks to the ASA, and apparently the ASA is not hair-pinning that traffic or sending ICMP redirects, which would not be terribly surprising for a firewall (or the computers aren't paying attention to the ICMP redirects).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few options...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Put static routes on the DHCP server and computer C (and any other computers on that network) similar to the ones you put in the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Re-IP computer C and the DHCP server into a VLAN4 (or whatever) on the v1910 so that the v1910 is handling all of the internal routing...all of your endpoints can just use default routes, that point toward the v1910, and you would only have to put static routes on the ASA pointing towards the v1910.  If you've got enough ports on the v1910 for your needs, you could ditch the unmanaged switch if you do this.  (I like Procurves...if you've got enough ports, this or option 2a would be the way to go IMO)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2a) Re-IP the ASA in a similar way to option 2, meaning computer C and the DHCP server can keep their IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) There may be a way to get the ASA to issue ICMP redirects on the 172.16.3.x network so that the computers on that network can learn about the existence of the v1910.  Alternatively, maybe there's a way to get the ASA to hair-pin the traffic...I don't know enough about ASA's to be able to answer that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Move the v1910 to another port on the ASA, instead of daisy-chaining it off the unmanaged switch and route the traffic through the ASA as well.  That would mean configuring whatever policy would be needed to get the traffic through the ASA appropriately.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2015-02-12T21:38:16.383" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16638" PostTypeId="1" CreationDate="2015-02-12T09:50:46.340" Score="4" ViewCount="2009" Body="&lt;p&gt;I'm currently studying about L2TP and there's something I don't quite understand, even after studying a tutorial and some parts of the RFC. Specifically, when connected via L2TP, how does the client know where to forward data frames? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in regular ethernet, the client uses ARP to find out the MAC address it needs to send to, writes that as the destination, and sends it. Does ARP work over L2TP and the destination is the MAC address of the device on the other side of the tunnel? Or does it use the MAC address of the router as the destination of its frame? Or am I misunderstanding this entirely?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any answers!&lt;/p&gt;&#xA;" OwnerDisplayName="Pepe Maglutac" LastActivityDate="2018-03-01T01:04:31.553" Title="How does an L2TP Client know where to forward frame?" Tags="|l2tp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16644" PostTypeId="2" ParentId="7451" CreationDate="2015-02-13T07:57:04.177" Score="-1" Body="&lt;p&gt;Ethernet supports both half-duplex and full-duplex modes. Please take a look at &lt;a href=&quot;http://www.learn44.com/what-is-half-duplex-and-full-duplex-ethernet-modes/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And also please take a look at here &lt;a href=&quot;https://stackoverflow.com/questions/28494850/is-tcp-bidirectional-or-full-duplex&quot;&gt;https://stackoverflow.com/questions/28494850/is-tcp-bidirectional-or-full-duplex&lt;/a&gt;. It address the same question.&lt;/p&gt;&#xA;" OwnerUserId="13856" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2015-02-13T09:04:42.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16645" PostTypeId="1" AcceptedAnswerId="16647" CreationDate="2015-02-13T09:06:45.857" Score="3" ViewCount="761" Body="&lt;p&gt;I've been doing some reading about MTU and I just can't get my head around something. When we talk about MTU for ethernet, it's documentated that the MTU is 1500, however the frame size is larger after the Ethernet headers are added. So effectively, when people talk about the MTU for ethernet being 1500, they are referring to the payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now then, I could accept the above statement if this was a standard case for every other protocol. But with TCP for example, the MTU is considered the payload + the IP header + the TCP header. If you compare this to Ethernet, the MTU was just the payload, but with TCP it's the payload + the headers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I understanding this right, because this is really confusing to work out which protocols include the headers with the MTU, and which don't? I have a sneaking suspicion that it's just Ethernet that does not include the headers when talking about MTU, since it would be setting the standard for the maximum packet size for upper layer protocols (i.e. you could only ever have an IP packet with a total packet size that uses a 1500MTU including all the headers and everything). But I want to get some clarity on this topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do realise that fragmentation can be used, but I want to know how to work this out without talking about fragmentation.&lt;/p&gt;&#xA;" OwnerUserId="817" LastActivityDate="2015-02-14T18:51:59.117" Title="Why does the MTU mean different things?" Tags="|routing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16647" PostTypeId="2" ParentId="16645" CreationDate="2015-02-13T10:12:01.887" Score="4" Body="&lt;p&gt;You have hit what I have always considered a pain point in the naming here. Let me start with a small correction to what you said: technically speaking, the MTU is the maximum size of an L3PDU inside an Ethernet frame. The L3PDU is made up of IP headers and payload. So payload =/= MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when you talk about this informally, you often just say &quot;payload&quot;, without clarifying whether you are talking about the payload of the Ethernet frame, or the effective payload of the L3PDU inside it. And this brings me to the issue: the confusion comes from the fact that some of the names actually overlap. When you talk about TCP MTU, you are effectively talking about the &lt;strong&gt;maximum packet size&lt;/strong&gt;, which is a value that is independent from the physical Ethernet MTU, which remains 1500 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, the real MTU is the physical one, i.e. the maximum size of the IP packet inside an Ethernet frame. When you talk about MTU with regards to other network layers, you are effectively talking about the maximum packet size, which doesn't necessarily have the same value of the physical MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://compnetworking.about.com/od/networkprotocols/g/mtu-maximum.htm&quot; rel=&quot;nofollow&quot;&gt;This article&lt;/a&gt; talks about this in a bit more detail, but here is an excerpt that is relevant to this question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Higher-level network protocols like TCP/IP can be configured with a maximum packet size, a parameter independent of the physical layer MTU over which TCP/IP runs. Unfortunately, many network devices use the terms interchangeably. On both home broadband routers and Xbox Live enabled game consoles, for example, the parameter called MTU is in fact the maximum TCP packet size and not the physical MTU. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="13443" LastEditorUserId="13443" LastEditDate="2015-02-13T10:29:21.187" LastActivityDate="2015-02-13T10:29:21.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16648" PostTypeId="2" ParentId="16636" CreationDate="2015-02-13T10:44:29.287" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The role of modems is to modulate and demodulate (hence the word modem) data so that it can flow over the phone line, effectively transforming the data from digital to analog and viceversa. For this reason, they can be considered Layer 1 devices. They cannot work on Layer 3 of the OSI model (routers and Layer 3 switches can do that).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Correct, but they are not necessarily used only with telephone cables. They could also be used with a cable (CATV) line.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, the data flows in the wires to the next network devices. In summary, the next router in the nextwork will receive the stream, deencapsulate it until the layer 3 IP packet inside it is exposed, and will use this information to decide where to send the data. This is repeated until the data arrives at the destination.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And to answer the question in the title: yes, they are still used today. It's just that you don't see them most of they time because they are built-in the routers you buy in the shops.&lt;/p&gt;&#xA;" OwnerUserId="13443" LastActivityDate="2015-02-13T10:44:29.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16652" PostTypeId="1" CreationDate="2015-02-13T12:44:28.273" Score="5" ViewCount="3336" Body="&lt;p&gt;I wanted to check something about MTU size with PPPoE. Since PPP adds another 8 bytes, we should reduce our MTU to 1492 on our dialer interface. I wanted to actually test and do this, however I'm having issues with it. I have provided my configuration below, note that with this provider I have to use Eth0.101 as the VLAN tag in order for PPPoE to work, so just assume it's the physical WAN interface. FYI I'm using a Cisco 887VA with a FTTC connection, with PPPoE.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;interface Dialer1&#xA;&#xA; ip address negotiated&#xA;&#xA; ip mtu 1492&#xA;&#xA; ip nat outside&#xA;&#xA; ip virtual-reassembly in&#xA;&#xA; encapsulation ppp&#xA;&#xA; ip tcp adjust-mss 1452&#xA;&#xA; dialer pool 1&#xA;&#xA; ppp authentication chap callin&#xA;&#xA; ppp chap hostname bthomehub@btbroadband.com&#xA;&#xA; ppp chap password 0 bt&#xA;&#xA; no cdp enable&#xA;&#xA;end&#xA;&#xA;!&#xA;&#xA;interface Ethernet0.101&#xA;&#xA; encapsulation dot1Q 101&#xA;&#xA; ip mtu 1492&#xA;&#xA; pppoe-client dial-pool-number 1&#xA;&#xA;end&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But now in the #debug ppp negotiation I see that for some reason my MRU being sent is STILL 1500, it's so annoying&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;Feb 10 22:46:15.060: %DIALER-6-BIND: Interface Vi2 bound to profile Di1&#xA;Feb 10 22:46:15.064: %LINK-3-UPDOWN: Interface Virtual-Access2, changed state to up&#xA;Feb 10 22:46:15.064: Vi2 PPP: Sending cstate UP notification&#xA;Feb 10 22:46:15.064: Vi2 PPP: Processing CstateUp message&#xA;Feb 10 22:46:15.064: PPP: Alloc Context [8551EED0]&#xA;Feb 10 22:46:15.064: ppp4 PPP: Phase is ESTABLISHING&#xA;Feb 10 22:46:15.064: Vi2 PPP: Using dialer call direction&#xA;Feb 10 22:46:15.064: Vi2 PPP: Treating connection as a callout&#xA;Feb 10 22:46:15.064: Vi2 PPP: Session handle[85000004] Session id[4]&#xA;Feb 10 22:46:15.064: Vi2 LCP: Event[OPEN] State[Initial to Starting]&#xA;Feb 10 22:46:15.064: Vi2 PPP: No remote authentication for call-out&#xA;Feb 10 22:46:15.064: Vi2 LCP: O CONFREQ [Starting] id 1 len 10&#xA;Feb 10 22:46:15.064: Vi2 LCP:    MagicNumber 0x87665B00 (0x050687665B00)&#xA;Feb 10 22:46:15.068: Vi2 LCP: Event[UP] State[Starting to REQsent]&#xA;Feb 10 22:46:15.104: Vi2 LCP: I CONFREQ [REQsent] id 88 len 19&#xA;Feb 10 22:46:15.104: Vi2 LCP:    MRU 1492 (0x010405D4)&#xA;Feb 10 22:46:15.104: Vi2 LCP:    AuthProto CHAP (0x0305C22305)&#xA;Feb 10 22:46:15.104: Vi2 LCP:    MagicNumber 0x7CCF52D6 (0x05067CCF52D6)&#xA;Feb 10 22:46:15.104: Vi2 LCP: O CONFNAK [REQsent] id 88 len 8&#xA;Feb 10 22:46:15.104: Vi2 LCP:    MRU 1500 (0x010405DC)&#xA;Feb 10 22:46:15.104: Vi2 LCP: Event[Receive ConfReq-] State[REQsent to REQsent]&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So on the I for the inbound PPP message we are seeing that the peer would like to use an MTU of 1492, but we NAK it and tell him we want to use 1500 on the O outound message. This just goes around in an endless loop until it does a ConfREJ I don't get why? So I checked the interfaces specifically to see the MTU settings, and they just ain't changed. See below. How can I fix this?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;router#sh int di1&#xA;Dialer1 is up, line protocol is up (spoofing)&#xA;  Hardware is Unknown&#xA;  Internet address is 86.11.24.7/32&#xA;  MTU 1500 bytes, BW 56 Kbit/sec, DLY 20000 usec,&#xA;!&#xA;!output ommitted, basically I've skipped to the output at the bottom of this command.&#xA;!&#xA;Bound to:&#xA;Virtual-Access2 is up, line protocol is up&#xA;  Hardware is Virtual Access interface&#xA;  MTU 1500 bytes, BW 56 Kbit/sec, DLY 20000 usec&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried a #shut, no shut, and a reload. Still I can't get this to change. &#xA;In the interim I did manage to figure out a command to make it work, but I'm not particularly happy that my #ip mtu command didn't work.  The command I'm using to fix this currently is below. I just stumbled across it when trying to fix this issue.&#xA;int di1&#xA;ppp mtu adaptive&lt;/p&gt;&#xA;" OwnerUserId="817" LastActivityDate="2015-02-13T17:40:21.367" Title="PPPoE config with MTU" Tags="|mtu|pppoe|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16654" PostTypeId="2" ParentId="16613" CreationDate="2015-02-13T15:01:39.960" Score="0" Body="&lt;p&gt;Since it's 2960, then it's only Layer 2 device, you can't assign the IP directly on the interface, however, you can use SVI (Switch Virtual Interface).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, assign Fa0/1 to vlan 100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface Vlan 100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip address dhcp&lt;/p&gt;&#xA;&#xA;&lt;p&gt;!&lt;/p&gt;&#xA;" OwnerUserId="13863" LastActivityDate="2015-02-13T15:01:39.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16655" PostTypeId="1" CreationDate="2015-02-13T15:03:57.863" Score="0" ViewCount="2031" Body="&lt;p&gt;I have a 16mbps/1mbps speed for Internet access. When a user downloads a file at full speed or torrent, other users can't browse because connections time out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to share bandwidth dynamically, like if both users download then speed to be half for both? I don't care about QoS, etc.; just to avoid timeouts.&lt;/p&gt;&#xA;" OwnerUserId="2984" LastEditorUserId="8499" LastEditDate="2018-02-14T16:47:54.263" LastActivityDate="2018-02-14T16:47:54.263" Title="MikroTik bandwidth management" Tags="|bandwidth|" AnswerCount="4" CommentCount="0" ClosedDate="2017-08-07T18:39:01.100" ContentLicense="CC BY-SA 3.0" />
  <row Id="16657" PostTypeId="2" ParentId="16638" CreationDate="2015-02-13T16:30:00.003" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Or does it use the MAC address of the router as the destination of its frame? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, that's exactly right.  The VPN router typically utilizes proxy ARP to answer ARP queries on behalf of the actual destination host.  When the packets are received by the router, they're forwarded on to the actual destination host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://en.wikipedia.org/wiki/Proxy_ARP&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Proxy ARP is a technique by which a device on a given network answers&#xA;  the ARP queries for a network address that is not on that network. The&#xA;  ARP Proxy is aware of the location of the traffic's destination, and&#xA;  offers its own MAC address as (ostensibly final) destination. The&#xA;  &quot;captured&quot; traffic is then typically routed by the Proxy to the&#xA;  intended destination via another interface or via a tunnel.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="8499" LastEditDate="2016-04-09T01:25:16.197" LastActivityDate="2016-04-09T01:25:16.197" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16658" PostTypeId="2" ParentId="16652" CreationDate="2015-02-13T17:40:21.367" Score="5" Body="&lt;p&gt;I think what you want to set is the interface MTU not the ip MTU.  Just use this command and you will be good to go:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mtu 1492&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the ppp mtu adaptive is usually the way to go&lt;/p&gt;&#xA;" OwnerUserId="13693" LastActivityDate="2015-02-13T17:40:21.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16659" PostTypeId="1" CreationDate="2015-02-13T17:58:24.077" Score="1" ViewCount="290" Body="&lt;p&gt;I'm trying to make a project to detect NAs in an inter-vlan IPv6 environment via trunk line. I know that NAs are sent in multicast so it would be possible to see the NA messages using a trunk line. With this in mind, I set up an environment consisting of 5 pcs and 2 vlans (10 and 20). PC1 and PC2 are vlan 10(switchport mode access) and PC3 and PC4 are vlan 20(switchport mode access). PC5 is a trunkline (switchport mode trunk). In order to verify I receive the messages, I use wireshark to check all packets. I can ping from one vlan to another and I can see other NDP message types such as RS, RA and even NS; however, there was no NA detected. I can't seem to find any reason why. Any response would help. Thanks&lt;/p&gt;&#xA;" OwnerUserId="13865" LastActivityDate="2015-02-13T19:54:17.533" Title="IPV6 Neighbor Advertisement (NA) not recieved" Tags="|switch|vlan|ipv6|trunk|icmpv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16660" PostTypeId="2" ParentId="16636" CreationDate="2015-02-13T19:07:46.003" Score="1" Body="&lt;p&gt;A modem does not 'care' about networking as it strictly a physical layer device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the name suggests, a modem's job is to (de)modulate signals so that they may be transmitted across various media.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are four scenarios in which two parties may wish to transfer data. In each case they will require a different type of modem.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Your home router connects to an ISP's access network by using a &lt;strong&gt;digital&lt;/strong&gt; xDSL modem to establish a connection over a twisted pair of Copper cables (your telephone line). Some providers do this over a coaxial cable ( your cable TV line) instead. Older systems typically used &lt;strong&gt;analogue&lt;/strong&gt; 56Kbps dial-up modems. If you are lucky enough to have &lt;em&gt;fibre-to-the-door&lt;/em&gt; then you'll be given an &lt;strong&gt;optical&lt;/strong&gt; modem instead.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Your mobile device connects to a wireless router using a &lt;strong&gt;wireless&lt;/strong&gt; modem. This allows a connection to be established using radio waves. Similarly Infra red devices will use an &lt;strong&gt;infra red&lt;/strong&gt; modem.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You are underwater and want to communicate with another vessel. To do this you will transmit data via an &lt;strong&gt;acoustic&lt;/strong&gt; modem. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When you switch your mobile telephone on, it will attempt to connect to a base station (cell tower) using a &lt;strong&gt;GSM&lt;/strong&gt; modem.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The point is there are many different types of modem (satellite-, voice-, soft-, the list goes on), but they all essentially do the same job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding point 2 in your post. Just because a signal is transmited over a particular (possibly exotic) medium, this does not automatically mean that the signal is analogue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding point 3 in your post. After leaving your home computer network, your data enters your ISP's &lt;strong&gt;access network&lt;/strong&gt;. The job of the access network is to get your data to your ISP's &lt;strong&gt;core network&lt;/strong&gt; as quickly as possible. Your data will traverse the core network and then exit &quot;out the other side&quot; down another access network until the it reaches it's destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole thing is analogous to the road network.   &lt;/p&gt;&#xA;" OwnerDisplayName="user13866" LastEditorDisplayName="user13866" LastEditDate="2015-02-13T19:58:31.977" LastActivityDate="2015-02-13T19:58:31.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16661" PostTypeId="2" ParentId="16659" CreationDate="2015-02-13T19:54:17.533" Score="3" Body="&lt;p&gt;Since there is no ARP in ipv6 you need the Neighbor Solicitation and Neighbor Advertisement messages to resolve IP to MAC addresses within the same subnet.  If you are pinging PCs in the same subnet across switches, at some point in time the NS and NA messages were present.  If you can't see them now its most probably because the MAC addresses have been cached in the PCs.&lt;/p&gt;&#xA;" OwnerUserId="13693" LastActivityDate="2015-02-13T19:54:17.533" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16662" PostTypeId="2" ParentId="7451" CreationDate="2015-02-14T01:15:59.790" Score="2" Body="&lt;p&gt;Ethernet is a half duplex protocol, however, it was created in the 1980's about 30 years ago. At which time an Ethernet segment was shared between devices using a hub and all PC's shared the same collision domain. They therefore had to take turns in sending data, and listening to make sure nobody was transmitting at the same time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In normal/modern networks the collision domain is localized to only one device per switch port. So we don't have this issue of collisions. Since then, an IEEE 802.3 standard has been introduced that supports full duplex interfaces and a variety of speeds above the original 10Base-T standard.&lt;/p&gt;&#xA;" OwnerUserId="13870" LastActivityDate="2015-02-14T01:15:59.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16663" PostTypeId="1" CreationDate="2015-02-14T01:42:39.447" Score="1" ViewCount="108" Body="&lt;p&gt;Say you have a router with two subnets attached:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.100/24&#xA;192.168.200/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I plug my PC into the 192.168.100/24 network, but I statically set my IP address to be within 192.168.200/24 or any other IP out-of-subnet for that matter...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the circumstances are correct (or I otherwise force traffic to the default gateway), all routers I've tested accept this traffic coming from an interface that is known to be &quot;192.168.100.xxx&quot; despite the IP address being outside of that range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an easy setting to prevent traffic &quot;leaving an interface&quot; that hasn't a source address within the known subnet range?  I'm just curious, but also feel that could be leveraged somehow maliciously.  Or perhaps this is required and I'm not considering all situations.&lt;/p&gt;&#xA;" OwnerUserId="10416" LastActivityDate="2016-08-13T23:53:07.483" Title="Risk/prevention of source addresses that don't fall within LAN segment?" Tags="|router|ip|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16671" PostTypeId="2" ParentId="16645" CreationDate="2015-02-14T18:41:46.167" Score="0" Body="&lt;p&gt;-&#xA;Hi Steve,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Telecom is a real difficult discipline because there are many wanted ambiguities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MTU just means &quot;maximum transmission unit&quot;, no more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, consider that the payload of a MAC 802.3 frame is 1500 bytes in LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the MTU of a IPv4 or IPv6 datagram encapsulated in a MAC 802.3 frame is 1500 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MTU of a IPv4 or IPv6 datagram encapsulated in PPP, PPP in PPPoE, PPPoE in MAC 802.3, is 1492 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can compose as you want. For example, the MTU of a PPP frame encapsulated in PPPoE, with PPPoE in a MAC 802.3 frame, is 1494 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I let you to define the MTU of a MAC 802.3 frame VLAN tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes, people want to be more technical by forgetting important words.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards,&#xA;Michel &lt;/p&gt;&#xA;" OwnerUserId="13878" LastEditorUserId="13878" LastEditDate="2015-02-14T18:51:59.117" LastActivityDate="2015-02-14T18:51:59.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16681" PostTypeId="1" CreationDate="2015-02-15T00:52:41.513" Score="3" ViewCount="8545" Body="&lt;p&gt;I am starting up a small business network. The ISP has provided us two distinct static IP ranges; understand that the actual IP addresses provided by the ISP are in routable Internet space. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network 1: 128.66.0.0/30, gateway 128.66.0.1, usable IP 128.66.0.2.&#xA;Network 2: 128.66.1.0/29, gateway 128.66.1.1, usable IPs 128.66.1.2-6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hardware provided is a simple cable-modem bridge device with a coax port and a single Ethernet port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do initial testing, I connected a server directly to the Ethernet port. If I perform static IP assignments given the above parameters, connectivity works as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I want to use a Cisco 2800 series router (surplus) to provide some actual routing for this setup. Basically, I want the router to provide NAT for basic Internet access from workstations, and also allow me to use the other five usable IPs for public-facing servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, the router's Gi0/0 will be assigned 128.66.0.2/29, and its Gi0/1 will be assigned 192.168.1.0/24 (for NAT/source overload). The router will also provide DHCP to the LAN and such. Basically, Gi0/0 will be used as a WAN outside port while Gi0/1 will be a LAN inside port. I do not care about actually running services on 128.66.0.2, in fact since that will be used for general Internet access I will be applying filtering rules to make inbound unsolicited traffic drop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's where I'm confused. I want to now be able to have servers providing services to the Internet via the 128.66.1.x IPs. However, I don't really want to connect them &lt;em&gt;directly&lt;/em&gt; to the cable modem via a switch. This would mean I'd have to independently firewall each machine within itself, and also would have to deal directly with static IPs. Instead, I'd really prefer to use a VLAN to separate the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Cisco 3560 switch available for this purpose. I want to assign, say, VLAN 100 to be my &quot;servers&quot; VLAN. I would then connect a cable from the router's Gi0/1 interface to a trunk port on the switch. General workstations would (for now) be on the untagged VLAN (1) while servers would be on ports assigned to VLAN 100. (I will probably end up configuring the workstations to be on a different VLAN too, but I already understand what to do there.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok, so the problem is that short of using NAT and having my servers be assigned IPs like 192.168.100.x, I don't see how I can more or less have the same network appear on two interfaces in the router. Remember, the cable modem expects traffic to be sent to itself with a source IP in the 128.66.1.0/29 range, and also 128.66.1.1 is used with ARP to locate the cable modem. Putting computers on the other side of the Cisco router seems to make this impossible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could just use NAT, but I am running some in-house software on the servers that strongly prefers the servers to have their real world IP addresses on the interfaces. Protocols like FTP, SIP, IRC's DCC, etc. depend on reverse connections, and dealing with packet mangling is a headache in and of itself, if Cisco routers can even do that sorta thing. (Linux can, but I was hoping to use my Cisco hardware.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thinking about how IP networking and ARP work, I can't see a way for this scenario to work without either using NAT or directly connecting the servers to the cable modem. Consider: If a server at 128.66.1.5 wants to access the Internet, it's told to use default gateway 128.66.1.1. If the router receives an ARP request on Gi0/0.100 for that IP, it will ignore it since it doesn't have that IP address. Therefore, the server cannot reach the Internet. The router itself could place an ARP request on Gi0/0 for 128.66.1.1 and receive the MAC  address of the cable modem, but this does not help the server. Even if we forced the server to be aware of the router's MAC address and associate it with 128.66.1.1, the server will send a packet with source IP 128.66.1.5 to the router. The router would know that 128.66.1.1 is on Gi0/0, and would thus route the packet there. However, when the response returns, the router would also say that 128.66.1.0/29 is on Gi0/0, and thus would never re-forward that packet back out Gi0/1.100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to summarize:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cable modem provides single Ethernet port and expects two separate IP networks to exist on the same physical LAN segment.&lt;/li&gt;&#xA;&lt;li&gt;Cisco router with IOS 15.0/Advanced IP Services-K9 will be used to provide routing and NAT for workstations. It will be connected directly to the cable modem on one interface, and to a 3560 switch on the other interface, to which all of the workstations and servers will connect, using ports assigned to the correct VLANs.&lt;/li&gt;&#xA;&lt;li&gt;I want servers to exist on a VLAN and for the Cisco router to be able to hand traffic back and forth to that VLAN, possibly providing filtering and access control in the process. I do NOT want the servers directly connected to the Internet, depending entirely on their own local firewalls for security.&lt;/li&gt;&#xA;&lt;li&gt;I do not know if it is possible, or if it is how to implement, routing such so that the servers can be assigned their real-world static IPs but still have their traffic flowing through the Cisco router.&lt;/li&gt;&#xA;&lt;li&gt;I do not want to waste one of the five public IPs in the second range by having to assign it to the router.&lt;/li&gt;&#xA;&lt;li&gt;Workstations inside the network must be able to access servers on the server VLAN via their native IPs. Example: 192.168.1.5 should be able to access 128.66.1.4 directly.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In theory, what I feel like I almost need is some kind of bridge. Basically, packets coming in Gi0/1/VLAN100 should be &lt;em&gt;bridged&lt;/em&gt; over to Gi0/0, but at the same time, access control should be able to be applied to prevent unsolicited inbound traffic on ports I want closed, and so on.  The other possibility is some form of subrouting; the 2800 would be aware of 128.66.1.0/29, but would have some exception telling it that 128.66.1.1 is on Gi0/0, whereas the &lt;em&gt;rest&lt;/em&gt; of the network is on Gi0/1.100. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have advice?&lt;/p&gt;&#xA;" OwnerUserId="13884" LastEditorUserId="775" LastEditDate="2015-02-15T01:05:45.760" LastActivityDate="2015-08-26T20:16:41.647" Title="Cisco router + cable modem - How to configure routing?" Tags="|cisco|switch|router|nat|design|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16683" PostTypeId="2" ParentId="16663" CreationDate="2015-02-15T03:27:29.580" Score="2" Body="&lt;p&gt;For Cisco (IOS): &lt;code&gt;ip verify unicast reverse-path&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Linux: set &lt;em&gt;net.ipv4.conf.all.rp_filter&lt;/em&gt; to 1 (&quot;all&quot; can be an interface)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-02-15T03:27:29.580" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16684" PostTypeId="1" CreationDate="2015-02-15T07:04:58.747" Score="2" ViewCount="4751" Body="&lt;ol&gt;&#xA;&lt;li&gt;I assume that the source and destination IP addresses are the same, so the if there is another host on the network which uses the same IP will reply and the computer will know that there is a conflict with the IP addresses. Is it a correct assumption?&lt;/li&gt;&#xA;&lt;li&gt;I don't understand the other use of the GARP - When can a change in the MAC address occur on a network that initiates the GARP broadcast to update the arp tables?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13770" LastActivityDate="2015-02-15T16:20:43.973" Title="Gratuitous ARP request - same destination and source IP addresses, uses of GARP" Tags="|arp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16686" PostTypeId="2" ParentId="16516" CreationDate="2015-02-15T11:24:57.133" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In which layers the Circuit switching works ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;All layers can have a circuit switching, except real layer 1, which has no switching, just a connection circuit.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...during call setup phase the sender should address the destination to NCC&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Right! in the control plane&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In todays internet, are we Using the Circuit switching?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, in SDH, OTN, connected Ethernet...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;can this Circuit switching technology works in store and forward switches?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no relation between CS and store and forward, it'a not a technology, just an operating of the connection matrix.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the switching Technology used in todays Telephone networks?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;E1 operates in CS mode.&#xA;IP operates in PS mode (packet switching)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is the whole wire dedicated or the only one channel in the wire is dedicated in circuit switching?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A circuit is a connected channel&lt;/p&gt;&#xA;" OwnerUserId="13878" LastEditorUserId="775" LastEditDate="2015-02-15T11:43:23.143" LastActivityDate="2015-02-15T11:43:23.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16687" PostTypeId="2" ParentId="11007" CreationDate="2015-02-15T11:39:01.407" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Ethernet can be divided into 2 sublayers; MAC and LLC.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No and no!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.3 Ethernet is a stack of protocols :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It includes MAC 802.3 which is a level 2 sublayer and a physical layer specific to 802.3 IEEE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The physical layer is divided in :&#xA;the RS sublayer,  and the&#xA;PHY 802.3 sublayer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you can have non 802.3 Ethernet, for example ETH over FR over SDH. This is another story.&lt;/p&gt;&#xA;" OwnerUserId="13878" LastEditorUserId="775" LastEditDate="2015-02-15T11:46:01.673" LastActivityDate="2015-02-15T11:46:01.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16688" PostTypeId="2" ParentId="16684" CreationDate="2015-02-15T12:38:28.713" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5227&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5227&lt;/a&gt; defines duplicate address detection on IPv4 using ARP. If you start a packet capture on a Windows host and then configure a new IP address you'll see this in the capture:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The host sends 3 ARP &lt;strong&gt;requests&lt;/strong&gt;. These requests will ask about its own IP (as you've correctly assumed), but will present himself as 0.0.0.0 so &lt;strong&gt;other hosts don't log its IP address yet&lt;/strong&gt;. If there's no reply after those 3 requests, it will send a GARP packet effectively updating everyone else in the network*.&lt;/p&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;A GARP packet is sent from your MAC address to Broadcast (ff:ff:ff:ff:ff:ff), stating which one is your IP address. That's how the other hosts learn your MAC address.&#xA;Depending on the OS some devices will cache that information for several minutes, so if you happen to change your IP by any reason you'll want to send a GARP to immediately update that.&#xA;A very common reason to send GARP is when there's a failover in an active/passive HA pair. Especially if that HA pair is a pair of firewalls and your network's gateway. The new firewall will be the active and it needs to tell everyone where to send the packets now. This is just one of the several approaches to high availability, other vendors fake a common MAC address so there are no GARP packets involved.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;For security reasons, not every device will accept GARP for the gateway's IP address from the network if they already have an entry. In my experience this is the case with Cisco IP phones. Had a hard time with them and a pair of Checkpoint firewalls running ClusterXL.&lt;/p&gt;&#xA;" OwnerUserId="444" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-02-15T16:20:43.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16698" PostTypeId="1" AcceptedAnswerId="43224" CreationDate="2015-02-16T00:54:38.277" Score="8" ViewCount="7815" Body="&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems that route maps only match on IP addresses, not on the ports. Had another situation this week on a different device, model and software version. Ended up changing the NAT statements to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip nat inside source static tcp &lt;em&gt;192.168.1.20 3389 x.x.x.x 3389&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then restricted access based on an ACL rather than a route map. Would have been nice to define conditional NATing, but it seems it just doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So we have a pretty standard NAT box setup to offer a hosted NAT solution for a number of customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the basic topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/BAchM.jpg&quot; alt=&quot;Topology&quot; title=&quot;Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Cisco IOS Software, C2900 Software (C2900-UNIVERSALK9-M), Version 15.2(4)M3, RELEASE SOFTWARE (fc2)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue I have is to do with the route-map section of the NAT statements.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static tcp 10.1.10.201 22 x.x.x.x 22 vrf Customer1-vrf route-map Customer1-portforwarding extendable&#xA;&#xA;ip access-list extended Customer1-forwarding-acl&#xA; permit tcp host 10.1.10.201 host a.a.a.a eq 22&#xA; permit tcp host 10.1.10.201 host b.b.b.b eq 22&#xA;&#xA;route-map Customer1-portforwarding permit 10&#xA; match ip address Customer1-forwarding-acl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe I have the understanding of the route-map correct. It is meant to designate what is allowed to NAT and what isn't. I am basically trying to set it up to allow only translations from specific public source addresses. It doesn't seem to be doing that. It seems to be permitting translations from any public address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I changed the ACL completely to a 'deny ip any any' statement and it still permits. I'm at a bit of a loss. It appears the route-map isn't doing anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;H&lt;/p&gt;&#xA;" OwnerUserId="11927" LastEditorUserId="11927" LastEditDate="2015-06-18T02:35:59.847" LastActivityDate="2017-08-13T20:29:12.250" Title="Cisco Static NAT with route-maps" Tags="|cisco|nat|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16702" PostTypeId="1" CreationDate="2015-02-16T06:29:34.147" Score="1" ViewCount="59" Body="&lt;p&gt;I think that the use is so that we could know the offset where the actual addresses begin in the ARP format, but if so, then the protocol type for example can tell us this information (length of the address according to the type).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why both are needed? The type and length fields?&lt;/p&gt;&#xA;" OwnerUserId="13770" LastActivityDate="2015-02-16T06:34:10.330" Title="ARP format- What's the use of the length fields?" Tags="|arp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16703" PostTypeId="2" ParentId="16702" CreationDate="2015-02-16T06:34:10.330" Score="3" Body="&lt;p&gt;Did you read &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC826&lt;/a&gt;? It says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;In theory, the length fields (ar$hln and ar$pln) are redundant,&#xA;since the length of a protocol address should be determined by&#xA;the hardware type (found in ar$hrd) and the protocol type (found&#xA;in ar$pro).  It is included for optional consistency checking,&#xA;and for network monitoring and debugging (see below).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="509" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-02-16T06:34:10.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16705" PostTypeId="2" ParentId="16530" CreationDate="2015-02-16T10:58:25.450" Score="0" Body="&lt;p&gt;I have discovered what really goes with traceroute (and mtr, tpctraceroute, etc) on my intranet.&#xA;It's my own router hiding known hops.&#xA;My router (a TP-Link WAP like, with Linux 2.6.15) uses to hide the hops to known routes. So, v.g., giving traceroute on google, will outputs just one hop, google itself, because my router knows very well the route (I stay all day long using google). But, just connecting a PC straight on the access point, then giving traceroute toward google, it outputs back the entire route from here to google.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, now I know what is going on, but not why it does that in this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a workaround, I use the tracerout provided by the embedded linux running on the (problematic) router: that is, the router that, through my PC, hides hops, in its own embedded system provides an interface that executes tracerout properly...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whatever, thanks for the reply!&lt;/p&gt;&#xA;" OwnerUserId="13748" LastEditorUserId="13748" LastEditDate="2017-08-12T17:24:53.903" LastActivityDate="2017-08-12T17:24:53.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16712" PostTypeId="2" ParentId="16698" CreationDate="2015-02-16T20:21:25.727" Score="0" Body="&lt;p&gt;Try removing port 22 from:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip nat inside source static tcp 10.1.10.201 22 x.x.x.x 22 vrf Customer1-vrf route-map Customer1-portforwarding extendable&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user6423" LastEditorUserId="775" LastEditDate="2015-02-16T22:49:46.880" LastActivityDate="2015-02-16T22:49:46.880" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16713" PostTypeId="2" ParentId="16626" CreationDate="2015-02-16T20:22:08.077" Score="0" Body="&lt;p&gt;Whenever you connect a Cisco IP phone to a Cisco switch you should do the first method of defining it as an access port and then using the additional switchport voice vlan configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is really not that much difference between the two configs though. The first method is actually a dot1q trunk as well (just as all switchports are trunk ports regardless of whether you set them to access or trunk) despite what Cisco calls this setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be issues when the phone first connects if you are using the second method though. While the connection between the phone is a dot1q tagged trunk, Cisco has some additional minor changes.  It might affect the POE negotiation, the COS that gets applied to the voice VLAN on the phone, and possibly the COS trust barrier on the switch. I am not a CCIE Vo or Collab so I do not know/remember as much details to really state the actual ramifications if any.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short - use the first methodology.&lt;/p&gt;&#xA;" OwnerUserId="13357" LastActivityDate="2015-02-16T20:22:08.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16716" PostTypeId="1" AcceptedAnswerId="16717" CreationDate="2015-02-17T00:45:58.443" Score="4" ViewCount="2671" Body="&lt;p&gt;I have been handed a ticket to work an RMA for a failed line card in a Cat6509-E.  Not ever having worked with these devices before I had a few questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The config that applies to the ports on the failed line card, do those persist via the Supervisory modules?? Meaning, if we simply rip/replace with the RMA'd linecard the ports will reconfigure themselves as they were?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are any commands required after swapping out the failed line card to bring the new card online to the system / restore configuration to those ports?  If so, what are those?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any other best practices when swapping line cards on the 6509-E you may have please feel free to share via comments.  Finally - if the community feels this should be broken into separate Q's let me know and I will take care of it. &lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2015-02-17T02:24:56.787" Title="Replacing Line-Card - Catalyst 6509-E - Questions" Tags="|cisco|cisco-catalyst|cisco-6500|line-card|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16717" PostTypeId="2" ParentId="16716" CreationDate="2015-02-17T02:24:56.787" Score="4" Body="&lt;p&gt;A line card swap is exceedingly simple.  You'll need to make sure that the replacement card is the exact same model as the old one.  You can certainly bring TAC on the call with you to do the swap if you want help.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the configuration is saved in the running-config/startup-config, and will be applied to the new line card after your insert it and it boots up okay&lt;/li&gt;&#xA;&lt;li&gt;no commands required after swapping the card.  I would recommend a &quot;copy run start&quot; before starting.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A couple of caveats I've picked up through experience:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;leave room in your management's mind for a whole switch reset.  It's unlikely, but I've seen it happen.&lt;/li&gt;&#xA;&lt;li&gt;if a tech is doing this for you remotely, log in via console to watch the proceedings.  You'll also get to see all the log messages as the blade boots up.&lt;/li&gt;&#xA;&lt;li&gt;never ever ever ever EVER leave a line card partially inserted*.  Pull the old one completely out, put the new one completely in.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Of course, all of this will need to be done in a maintenance window.  You should only expect traffic interruption on the line card in question, but leave yourself a &quot;the switch might reset&quot; clause in your maintenance window description.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best of luck!&lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2015-02-17T02:24:56.787" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16718" PostTypeId="1" AcceptedAnswerId="16721" CreationDate="2015-02-17T05:19:45.793" Score="1" ViewCount="161" Body="&lt;p&gt;Hey guys if you are familiar with ICMPv6, i have a problem right now considering RA. I am trying to come up with a mitigation for last hop router attack, so i thought of how about sending a packet identical to the attack except the lifetime is 0. Will that work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also is it possible to have the computer consider me the router with just RA. Like my victim does not have any neighbor cache with myself?&lt;/p&gt;&#xA;" OwnerUserId="13772" LastActivityDate="2015-02-17T08:36:14.747" Title="ICMPv6 RA to make it as default gateway in the Network" Tags="|ipv6|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16720" PostTypeId="1" CreationDate="2015-02-17T08:34:41.213" Score="6" ViewCount="1334" Body="&lt;p&gt;&lt;strong&gt;THE SYSTEM:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a L2 Managed 1Gbps switch with IGMP snooping (the switch I'm testing with is a TP-Link TL-SG3216). I have several identical devices (these are embedded devices that we are developing) attached to the switch, and this system is NOT connected to any other network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While all devices send some data to all other devices, most of the time they spend in pairs (these pairs change with time). When paired, they utilise close to the full-bandwidth of the connection in one direction. I now have a situation where there are cases in which a device has to send the 1Gbps data stream to two or three devices at once: I need multicasting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I were to broadcast this data the other ports would become congested and would effectively prevent other pairs from effectively communicating? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way that I know of to achieve multicasting (as opposed to broadcasting) on a switch such as this, is via IGMP snooping (PLEASE CORRECT ME IF THIS STATEMENT IS INCORRECT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IGMP snooping requires a device to act as a multicast router in respect to IGMP. I have added IGMPv2 capabilities to the devices: whichever device on the switch has the lowest MAC address becomes the multicast router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This system works: devices can join and leave groups as they wish, and the multicast data is correctly directed by the switch. So far so good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;THE PROBLEM:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IGMP the multicast router is a member of EVERY multicast group, and receives all data sent to any multicast address. Once more than one multicast group is established in this network then the full 1Gbps data streams from multiple devices is sent to the multicast router completely overrunning the link from the switch resulting in huge packet loss. The device acting as multicast router must also perform its regular (non-router) duties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way for the multicast router to not be a member of a multicast group, or at least not be sent every packet? I've been told by others that this is not possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a different solution to achieving multicasting on this switch?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears the solution is to use a different switch: one with a multicast querier built in. This avoids the problem of there being insufficient bandwidth for a multicast router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Will a switch with multicast querier suffer from the same problem as the multicast router in the original system?&lt;/strong&gt; Specifically that all multicast frames (not just the IGMP reports) are sent to the multicast router (in this case the switch querier), and with the high traffic the querier will be swamped.&lt;/p&gt;&#xA;" OwnerUserId="13923" LastEditorUserId="453" LastEditDate="2018-06-07T03:05:42.500" LastActivityDate="2018-06-07T03:05:42.500" Title="IGMP Multicast router overrun" Tags="|switch|multicast|igmp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="16721" PostTypeId="2" ParentId="16718" CreationDate="2015-02-17T08:36:14.747" Score="2" Body="&lt;p&gt;Yes that will work. Take a look at &lt;code&gt;ndpmon&lt;/code&gt; which can do exactly what you describe.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-02-17T08:36:14.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16723" PostTypeId="1" CreationDate="2015-02-17T10:29:17.700" Score="1" ViewCount="7344" Body="&lt;p&gt;We are trying to form the ether channel between cisco WS-C3560V2-48PS model switch with DELL server but ether channel is not established between them. Dell server has 4 NIC and its connected with 3560V2 switch 4 interface and try to bundle into single port channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below i have mentioned the switch config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface Port-channel1&#xA; switchport access vlan 21&#xA; switchport mode access&#xA;end&#xA;!&#xA;interface FastEthernet0/5&#xA; switchport access vlan 21&#xA; switchport mode access&#xA; channel-group 1 mode active&#xA;end&#xA;!&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport access vlan 21&#xA; switchport mode access&#xA; channel-group 1 mode active&#xA;end&#xA;!&#xA;interface FastEthernet0/7&#xA; switchport access vlan 21&#xA; switchport mode access&#xA; channel-group 1 mode active&#xA;end&#xA;!&#xA;interface FastEthernet0/8&#xA; switchport access vlan 21&#xA; switchport mode access&#xA; channel-group 1 mode active&#xA;end&#xA;!&#xA;&#xA;&#xA;Switch#sh etherchannel summary &#xA;&#xA;Number of channel-groups in use: 1&#xA;Number of aggregators:           1&#xA;&#xA;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+-----------------------------------------------&#xA;1      Po1(SU)         LACP      Fa0/5(w)    Fa0/6(I)    Fa0/7(w)    &#xA;                                 Fa0/8(w)    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13925" LastEditorUserId="775" LastEditDate="2015-02-17T12:28:54.027" LastActivityDate="2015-02-18T14:03:01.287" Title="Ether channel between Cisco switch and Dell server" Tags="|etherchannel|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16726" PostTypeId="1" AcceptedAnswerId="16729" CreationDate="2015-02-17T13:33:43.450" Score="2" ViewCount="6496" Body="&lt;p&gt;I am trying to configure link aggregation (LACP) from a server to a HP 2920-48G switch. The server has a 4 port Intel NIC that supports LACP, and a OS that natively supports LACP as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch has three modes for LACP, Passive, Active, and a separate &quot;LACP Trunk&quot; which appears to be primarily a proprietary option for trunking HP switches together. I have tried all three options on the two ports I am attempting to aggregate with no success. I have also read that I must have GVRP enabled on the ports, then forbid those ports from joining the default VLAN (as I am attempting to aggregate on a different VLAN then the default) to get dynamic LACP working. I have tried that with all three previous options and I still cannot get a working connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on where I am failing?&lt;/p&gt;&#xA;" OwnerUserId="13926" LastActivityDate="2015-02-17T21:56:34.780" Title="LACP from Server to Switch" Tags="|hp|ieee-802.1ax|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16727" PostTypeId="2" ParentId="16723" CreationDate="2015-02-17T15:06:28.907" Score="0" Body="&lt;pre&gt;&lt;code&gt;no switchport mode access vlan 21&#xA;switchport mode trunk encapsulation dot1q&#xA;    switchport mode trunk&#xA;    switchport trunk vlan allowed 21&#xA;    channel-group 1 mode active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Turn the switch ports into a trunk. I've not seen any configuration in production that uses access ports for channel-groups. It may be that your configuration isn't necessarily wrong but that bonded NICs (trunked) should be configured trunk on both ends.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="13939" LastEditDate="2015-02-18T14:03:01.287" LastActivityDate="2015-02-18T14:03:01.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16728" PostTypeId="1" AcceptedAnswerId="16731" CreationDate="2015-02-17T15:14:41.320" Score="1" ViewCount="355" Body="&lt;p&gt;I was asked to change the IP address of the management interface on our firewalls but not issue &quot;no ip address&quot; because it will put the interface in shutdown mode which needs to issue no shut again and simply just apply the new ip address. I could not try this to see if it actually happens because it's production environment so here I am. Is that right if I issue no ip address on the management interface, it goes to shutdown mode?&lt;/p&gt;&#xA;" OwnerUserId="539" LastActivityDate="2015-02-17T23:13:48.833" Title="ASA 55x - Will management interface shutdown if I remove the IP" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16729" PostTypeId="2" ParentId="16726" CreationDate="2015-02-17T15:15:44.700" Score="2" Body="&lt;p&gt;Sounds like you're almost there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need to create a &quot;team&quot; on the server using two or more of the Intel ports.  Use the Configure option in the NIC settings to choose 802.3ad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say you're using a team with two server NIC ports into two ports (47 and 48) on the same switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the HP switch,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;HP Procurve 2920&gt; config&lt;br&gt;&#xA;  HP Procurve 2920(config)# int 47-48 lacp active&lt;br&gt;&#xA;  HP Procurve 2920(config)# show lacp  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Check to be sure lacp status is &quot;success&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now patch in your server, each Intel NIC port to an HP port.  Come back to the CLI and &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;HP Procurve 2920(config)# show lacp&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;to check if it's successful.  Look for LACP partner = yes on both interfaces 47 and 48 and be sure all interfaces in your team are &quot;up&quot;  Check your server to be sure traffic is flowing through both NIC ports.  If so, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;HP Procurve 2920(config)# write mem&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;to save configuration to memory.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2015-02-17T21:56:34.780" LastActivityDate="2015-02-17T21:56:34.780" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16731" PostTypeId="2" ParentId="16728" CreationDate="2015-02-17T16:15:16.197" Score="3" Body="&lt;p&gt;Issuing the &lt;code&gt;No Ip Address&lt;/code&gt; command &lt;strong&gt;does not&lt;/strong&gt; put the interface in a shutdown state. However, I believe your coworker is telling you that your telnet session will be dropped if you issue this command which is correct. Because you would no longer have a management address, you would also no longer have a session using the address set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have to issue the &lt;code&gt;No Ip address&lt;/code&gt;command, do so from a console connection to avoid losing your session.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-02-17T16:15:16.197" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16732" PostTypeId="1" CreationDate="2015-02-17T18:07:41.310" Score="4" ViewCount="1079" Body="&lt;p&gt;I have a Sonicwall NSA 2400 (soon to replace with NSA 2600).  The LAN has a widely varying number of users/devices.  Some days there are 10 people onsite, some days 75-100.  I want to be able to equally and dynamically allocate our WAN bandwidth (about 75 Mbps down, 20 Mbps up) to each device on the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the days with 10 devices onsite, each device should get 1/10th the bandwidth.  On the days with 75 devices, each device gets 1/75th. Or, 10 devices downloading something via the WAN connection, each device gets 1/10th bandwidth.  The goal is fairness to all devices.  I don't want to prioritize traffic types (i.e. HTTP, FTP, etc.); I don't care what the device is doing on the internet, they just need to have about equal bandwidth to everyone else.  What they do with their slice, we don't care.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm familiar with the bandwidth management settings where I can put an absolute limit on the bandwidth, e.g. 1,000 Kbps.  I can't do this because we would have massive underutilization of the available bandwidth on the days with fewer devices onsite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if the Sonicwall has some existing settings I could configure to achieve this goal?  Or do I need to look at some QOS configuration to achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit in response to comment from Ron&lt;/strong&gt;&#xA;The goal is fairness of available bandwidth but without wasting it when there's only a few people.  So if only 2 devices are using the internet connection, each should get roughly half.  After posting this question, I did more digging on my NSA 2400.  After upgrading firmware to 5.9 I get a checkbox in Firewall &gt; Bandwidth Objects to put a per-IP kpbs max.  But this doesn't work as desired since the number of devices using the internet varies.&lt;/p&gt;&#xA;" OwnerUserId="13930" LastEditorUserId="13930" LastEditDate="2015-02-19T01:38:54.927" LastActivityDate="2016-09-06T07:44:57.383" Title="Equal WAN bandwidth for all LAN devices using Sonicwall NSA 2400/2600" Tags="|qos|sonicwall|bandwidth|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16735" PostTypeId="2" ParentId="16720" CreationDate="2015-02-17T20:19:33.383" Score="0" Body="&lt;p&gt;Unless you want to configure your switch ports statically, you need a multicast router and this one will always receive the multicast traffic.&#xA;Theoretically you could use an L3 interface on the switch to act as multicast router, but your switch is L2, so I'm afraid you're out of luck with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, please take into account the backplane bandwidth of the switch, and that some switches use the same ASIC for groups of (normally 8) ports, effectively sharing limited bandwidth between them. What I'm saying is that the switch's total bandwidth might be far from 1Gbps x # of ports. So even if you could work around the multicast router issue you might still have another bandwidth problem. &lt;/p&gt;&#xA;" OwnerUserId="444" LastActivityDate="2015-02-17T20:19:33.383" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16736" PostTypeId="1" AcceptedAnswerId="16752" CreationDate="2015-02-17T20:25:36.550" Score="2" ViewCount="1323" Body="&lt;p&gt;In a Level 3 network with multiple, isolated (i.e. &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/16736/ospf-with-multiple-vlans#comment24651_16736&quot;&gt;firewalled&lt;/a&gt;) VLANs, how does OSPF interact with the VLANs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it standard to use multiple OSPF instances, i.e. one per VLAN?&lt;/li&gt;&#xA;&lt;li&gt;If the VLANs have the same topology, can a single OSPF instance be used?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13935" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-02-18T12:59:48.723" Title="OSPF with Multiple VLANs" Tags="|routing|vlan|ospf|security|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16738" PostTypeId="2" ParentId="16723" CreationDate="2015-02-17T23:00:13.130" Score="2" Body="&lt;p&gt;In addition to the port config mentioned below.....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end - you have several of the links status as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; w - waiting to be aggregated&#xA;&#xA; i - inoperable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does the Dell side config look like for those ports?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you using LLDP for on your switch and server?  If so - what does the following output display from the Cisco side:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   sho lldp neighbor int fa0/5 &#xA;   sho lldp neighbor int fa0/6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You are using LACP for the Port-channel - that's the 'non Cisco proprietary one' so you're good there, and using adding that &lt;code&gt;channel-group 1 mode active&lt;/code&gt; will force a trunk.  Just make sure the Dell side is using LACP as well (I'm not sure what it tries by default).  For reference:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You enable LACP on each channel by configuring the interface in that&#xA;channel for the channel mode as either active or passive.&#xA;When an LACP attempts to negotiate with an interface in the on&#xA;state, it does not receive any LACP packets and becomes an individual&#xA;link with that interface; it does not join the LACP channel group&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can also use the following command (on the Cisco side) to verify what Port-Channel Health:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; show int po1 brief&#xA; show int po1 sw&#xA; show int po1 trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13939" LastEditorUserId="775" LastEditDate="2015-02-18T12:05:12.573" LastActivityDate="2015-02-18T12:05:12.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16741" PostTypeId="1" AcceptedAnswerId="24901" CreationDate="2015-02-17T23:32:58.037" Score="3" ViewCount="790" Body="&lt;p&gt;&lt;strong&gt;Is it possible to use a UTP cable for:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;12V DC (~30W),&lt;/li&gt;&#xA;&lt;li&gt;100BASE-TX Ethernet, and&lt;/li&gt;&#xA;&lt;li&gt;A single phone line,&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;at the same time?&lt;/strong&gt; 100BASE-TX should give me two spare pairs, can I use one pair for the phone line and one for the power?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My plan is to supply a (rather old) VoIP-capable board with power, internet and a hook it up to a single phone. Can I do all that with a single cable? If yes, how do I do the wiring (&lt;del&gt;i.e. which are the spare pairs in 100BASE-TX&lt;/del&gt; Nevermind. Found that &lt;a href=&quot;http://en.wikipedia.org/wiki/Ethernet_over_twisted_pair#Shared_cable&quot; rel=&quot;nofollow&quot;&gt;on Wikipedia&lt;/a&gt;)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To clarify, I would only run this over a short distance, 1-2m.&lt;/p&gt;&#xA;" OwnerUserId="13940" LastEditorUserId="8499" LastEditDate="2017-08-06T02:19:20.213" LastActivityDate="2017-08-06T02:19:20.213" Title="100BASE-TX, PoE and PSTN over a single UTP Category 5 cable?" Tags="|ethernet|layer1|power-over-ethernet|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16742" PostTypeId="2" ParentId="16741" CreationDate="2015-02-17T23:42:58.087" Score="2" Body="&lt;p&gt;It should be possible (in theory), as long as your PoE is using &lt;a href=&quot;http://en.wikipedia.org/wiki/Power_over_Ethernet#Power_capacity_limits&quot; rel=&quot;nofollow&quot;&gt;802.3af mode A&lt;/a&gt;.  Mode A uses the data pairs to provide power.  If however your PoE is using mode B, then it is sending power over the unused pairs and will not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practical terms, a cable where there are more twists per pair, or even better a separator between the pairs, would be preferred to reduce the chance of cross talk.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-02-17T23:42:58.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16743" PostTypeId="2" ParentId="16741" CreationDate="2015-02-18T01:37:23.583" Score="2" Body="&lt;p&gt;First, Category 5 cable is no longer a recognized cable per the &lt;a href=&quot;http://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0CCAQFjAA&amp;amp;url=http%3A%2F%2Fwww.csd.uoc.gr%2F~hy435%2Fmaterial%2FCabling%2520Standard%2520-%2520ANSI-TIA-EIA%2520568%2520B%2520-%2520Commercial%2520Building%2520Telecommunications%2520Cabling%2520Standard.pdf&amp;amp;ei=ZujjVJTkA4meNofvg8gO&amp;amp;usg=AFQjCNH45jqpP70LgTNgD_YEyQkCdjohjQ&amp;amp;sig2=Rq3OUYEsOYCfK4s4NbKamQ&amp;amp;bvm=bv.85970519,d.eXY&quot; rel=&quot;nofollow&quot;&gt;ANSI/TIA/EIA-568B Commercial Building Telecommunications Standard&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Recognized Categories&#xA;  Categories 1, 2, 4, and 5 are not recognized as part of the standard and therefore&#xA;  transmission parameters are not listed.&#xA;  The only recognized categories are 3,5e and 6. Category 6 was ratified mid 2002, and&#xA;  the specifications for it can be found in Addendum 1.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Second, sharing ethernet and PSTN in the same 4-pair cable sheath is non-standard not not allowed.  You are allowed to share different, compatible applications in a 25-pair binder group, but there are restrictions that preclude what you propose:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Signals with significantly different power levels should not share the same binder group.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-02-18T03:46:20.863" LastActivityDate="2015-02-18T03:46:20.863" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16744" PostTypeId="2" ParentId="16064" CreationDate="2015-02-18T03:15:22.090" Score="2" Body="&lt;p&gt;There's no way to say &quot;RSS -60dBm equals transmit rate X Mb/s&quot; or something similar. WiFi performance depends on many factors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bandwidth itself can be a bit confusing context. A wireless standard has a max transmit rate, for example with 802.11g it's 54Mb/s. However this is achievable only in a carefully controlled lab environment. In real world you must calculate in protocol and application overheads, effect of half duplex medium etc. If you get 30Mb/s with g you're doing good. Distance from antenna affects your transmit rate, but not signal fluctuation with a stationary client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're talking about radio traffic. There's all kinds of WiFi and non-WiFi interference coming from multitude of devices. This cannot be avoided.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another point is how do you observe the fluctuation. Are you running sequential tests with speedtest.net, or just looking how many bars Windows WiFi icon shows? With Internet-based speedtests you're not only dealing with your own WiFi, you're also depending on your ISP line and a bunch of other Internet paths. Any disturbance on the way affects your transmit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since your device is stationary, we're most likely talking about interference and possibly poor antenna placement. I'd suggest that you download a WiFi scanner application and check your wireless environment. Examples of such applications are inSSIDer (google for v3, that's freeware) or ViStumbler for Windows. It's also available for Android in Google Play Store (free) along with a bunch of similar apps. For OSX you could use for example NetSpot. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of them will show output similar to this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/CG9d8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This shows you how heavily used each channel is (in this example on b/g 2.4Ghz spectrum). Set your router's radio to channel with least usage. If you're on b/g, in Americas you should choose 1, 6 or 11; elsewhere you can also choose 1, 7, 13. This because the channels overlap, so if you set your radio to for example ch3 you're getting interference from neighboring radios on both ch1 and ch6. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW while scanning don't associate your device to the WiFi, that'll skew the scan. Note that these applications will only show you WiFi-related info, not non-WiFi interference. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try moving the router to a different place. Under the table, in a cupboard or behind a TV are not ideal locations. Keeping the antenna(s) upright is (usually) the best option, as is having basically line-of-sight between the antenna and your device. And don't hang anything on the antenna(s) or place the device right next to a metal plate.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, sometimes different standard can give you a better performance. If your devices are capable of n on 5GHz spectrum, test setting the radio on that. 5GHz has much less usage (and interference) than 2.4GHz. If you're currently on n, test setting the radio to b/g. Note that you only configure this on the router, not on the client. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test with different driver versions - sometimes older may work better. Also I'd suggest that you check which Wireless NIC your device has and google if other people are experiencing issues with it. &lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2015-02-18T03:15:22.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16745" PostTypeId="1" AcceptedAnswerId="16747" CreationDate="2015-02-18T06:25:49.533" Score="0" ViewCount="1009" Body="&lt;p&gt;I had designed an application which will allow me to send and receieve large files on wireless LANs. I am curious to know of the maximum speed that WLAN allows me for transfer.Currently I am using a buffer size of 100MegaBytes for reading and writing to the &lt;code&gt;networkStream&lt;/code&gt;.What optimized size should i use to allow me fast copying without buffer-overflow?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using IEEE 802.11n Standard currently...Would it be affected for other standards?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. I am new here.If my Question seems inappropriate/unplaced here please guide me to right forum instead of down-voting.I had already googled but of no-advantage to me. &lt;/p&gt;&#xA;" OwnerUserId="13944" LastEditorUserId="775" LastEditDate="2015-02-18T12:03:00.317" LastActivityDate="2015-02-18T12:03:00.317" Title="What is the maximum data transfer rate on WLAN for data sharing" Tags="|wireless|speed|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16746" PostTypeId="1" AcceptedAnswerId="16750" CreationDate="2015-02-18T09:45:21.167" Score="4" ViewCount="489" Body="&lt;p&gt;I believe NIV is 802.1qbh and 802.1BR seems to be just an advanced version of it. By simple looks, there doesnt seem to be much difference. Can someone please confirm this? And if there are any advancements, could you please list them?&lt;/p&gt;&#xA;" OwnerUserId="8689" LastEditorUserId="775" LastEditDate="2015-02-18T12:28:01.440" LastActivityDate="2015-02-18T12:28:01.440" Title="Is there any difference between 802.1Qbh NIV and 802.1 BR?" Tags="|vlan|ethernet|protocol-theory|fex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16747" PostTypeId="2" ParentId="16745" CreationDate="2015-02-18T10:21:23.853" Score="1" Body="&lt;p&gt;I'm afraid that on the network point of view this is a somewhat impossible question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In wired Ethernet if you have a Gigabit switch and 2 clients with GB NICs, you can expect to get a stable ~1GB/s throughput rate. In the wireless world the advertised max throughput rates can only be achieved in a strictly controlled lab environment, in any real live environment many factors affect your throughput:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- Wireless is a half duplex medium&#xA;- Wireless is a shared medium. The more clients you have on the same radio, the less bandwidth is available for each client.&#xA;- The point above is theoretical, distance affects. If your clients are both 2m from the AP, you get throughput n. When one of the clients moves to 4m away from the AP, your throughput drops.&#xA;- There's background noise, and there's interference from both WiFi and non-WiFi devices. This means that if you get average throughput of n Mb/s, I won't get the same throughput even using exactly same equipment and drivers you use due to only different noise floors. Even you may see different throughput in the afternoon compared to the morning. If you use a wired mouse and mine is btooth, we're likely to get different results. Lighting fixtures can interfere wireless throughput. And so on.&#xA;- You're using n, where &quot;max throughput&quot; becomes a complicated matter. It depends on what modulation scheme is used, how many spatial streams you have, guard interval etc., answer being somewhere between 6.5 Mb/s and 600Mb/s... same applies to ac-networks.&#xA;- If you have legacy clients on your wireless network, the average throughput will drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd suggest you put this question to Stack Overflow. The coders might be able to give you a more meaningful answer as someone is likely to have tackled similar situation in the past. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course you can just take the expected average throughput rates for example from &lt;a href=&quot;http://www.speedguide.net/faq/what-is-the-actual-real-life-speed-of-wireless-374&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.speedguide.net/faq/what-is-the-actual-real-life-speed-of-wireless-374&lt;/a&gt;, but those tend to depend on whom you're asking. Here's a discussion from Superuser concerning wless average throughput on 802.11n: &lt;a href=&quot;https://superuser.com/questions/187485/average-transit-speed-for-802-11n-wireless-ap&quot;&gt;https://superuser.com/questions/187485/average-transit-speed-for-802-11n-wireless-ap&lt;/a&gt;. Still you should ask about calculating appropriate buffer size in Stack Overflow.  &lt;/p&gt;&#xA;" OwnerUserId="10799" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2015-02-18T10:21:23.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16748" PostTypeId="1" AcceptedAnswerId="16754" CreationDate="2015-02-18T11:37:11.523" Score="3" ViewCount="905" Body="&lt;p&gt;If you have a gigabit switch connected to non-gigabit router, will the internal network transfer rates be gigabit when the devices are connected to the switch, or will the router also have to have a gigabit port?&lt;/p&gt;&#xA;" OwnerUserId="13949" LastEditorUserId="775" LastEditDate="2015-02-18T12:07:29.637" LastActivityDate="2016-10-10T03:52:02.943" Title="Does both switch and router have to be gigabit for higher speeds?" Tags="|switch|router|ethernet|speed|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16749" PostTypeId="2" ParentId="16723" CreationDate="2015-02-18T11:55:43.940" Score="1" Body="&lt;p&gt;As I stated in my comment already, DELL servers have Intel or Broadcom NICs built in (mostly and afaik).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to install the full driver and a special tool delivered with this driver (Intel) or a own configuration application (Broadcom, for example Broadcom Advanced Control Suite) to use LACP or other Link aggregation features with Windows. If you use Linux on the Server, you can create a bonding interface to use LACP support within the Linux kernel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, use the information provided in the answer provided by Jonathan to check the health of your port channel while setting up the server-side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best,&#xA;Sebastian&lt;/p&gt;&#xA;" OwnerUserId="2112" LastActivityDate="2015-02-18T11:55:43.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16750" PostTypeId="2" ParentId="16746" CreationDate="2015-02-18T12:27:28.430" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I believe NIV is 802.1qbh and 802.1BR seems to be just an advanced version of it. By simple looks, there doesnt seem to be much difference. Can someone please confirm this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IEEE 802.1Qbh was &lt;a href=&quot;http://standards.ieee.org/about/sasb/nescom/0911recs.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;withdrawn in 2011&lt;/a&gt; in favor of IEEE 802.1BR:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ieee802.org/1/pages/802.1bh.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m7mUT.png&quot; alt=&quot;802.1Qbh withdrawn&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, 802.1BR is simply an evolution of the abandoned Qbh standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://twitter.com/reneraeber&quot; rel=&quot;nofollow noreferrer&quot;&gt;Rene Raeber&lt;/a&gt; who participated in the 802.1Qbh standardization effort, there is no difference between 802.1Qbh and 802.1BR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ipspace.net/2012/08/8021br-same-old-same-old.html?showComment=1361394360605#c4758788858269471914&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RHL4d.png&quot; alt=&quot;Rene Raeber quote&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-02-18T12:27:28.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16752" PostTypeId="2" ParentId="16736" CreationDate="2015-02-18T12:46:18.100" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Is it standard to use multiple OSPF instances, i.e. one per (isolated) VLAN?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a standard approach, only so far as you're using &lt;a href=&quot;https://stackoverflow.com/a/10848160/667301&quot;&gt;MPLS VPN&lt;/a&gt; and/or &lt;a href=&quot;http://packetlife.net/blog/2009/apr/30/intro-vrf-lite/&quot; rel=&quot;nofollow noreferrer&quot;&gt;vrf-lite&lt;/a&gt; to isolate your vlan routing information; read more about OSPF in the context of MPLS VPN and VRF-lite &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_l3_vpns/configuration/xe-3s/mp-l3-vpns-xe-3s-book/mp-vpn-ospf-pe-ce-support.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;OSPF VRF PE CE Support&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the main reasons for using multiple OSPF instances is for controlling LSA flooding (that assumes you couldn't otherwise &lt;a href=&quot;http://blog.ine.com/2009/08/17/ospf-route-filtering-demystified/&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;OSPF LSA Filtering&quot;&gt;control LSA distribution&lt;/a&gt;)&lt;sup&gt;Note 1&lt;/sup&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;If the VLANs have the same topology, can a single OSPF instance be used?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In cases where you don't have to isolate vlans for security purposes, a single OSPF instance can and &lt;em&gt;should&lt;/em&gt; be used. Most of the time, you should avoid multiple OSPF instances.  Some exceptions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When your vlans are assigned to different customers use MPLS VPN (which uses BGP as the underlying control-plane)&lt;/li&gt;&#xA;&lt;li&gt;When you are trying to filter LSAs (as noted above)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Note 1&lt;/sup&gt;As an aside, I personally dislike the whole concept of filtering OSPF LSAs; address summarization is perfectly normal... blocking an LSA that should otherwise be flooded makes things more complicated to troubleshoot.  OSPF loves to flood LSAs; in many cases people who are (ab)using OSPF for route/LSA control should be offload the work to a protocol which was designed for controlling routes (such as iBGP).&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2015-02-18T12:54:56.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16753" PostTypeId="1" CreationDate="2015-02-18T13:15:40.280" Score="4" ViewCount="660" Body="&lt;p&gt;The carrier is providing Q-in-Q tunneling to all 20+ remote sites and corporate. My questions is: what is the best way to utilize this setup?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Should I only use a transitional VLAN &amp;amp; subnet and route everything?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Should I pass all the VLANs back to the main site and route from that location?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Should I pass only the corporate VLANs out to the remotes and route at each remote?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13951" LastEditorUserId="8499" LastEditDate="2016-03-28T22:44:38.830" LastActivityDate="2016-09-25T07:06:01.973" Title="In a Q-in-Q tunnel network with 20+ sites, should only the remote site VLANs be passed and routed at the main site?" Tags="|router|vlan|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16754" PostTypeId="2" ParentId="16748" CreationDate="2015-02-18T14:11:41.793" Score="3" Body="&lt;p&gt;Do you have VLAN segmentation?  If so - I would assume the 'routing point' for your network is the router, in which case any traffic going between VLANs would traverse the uplink from the GIG switch to the non-gig router.  I'm also assuming the speed of your 'non-gig' router is 100mb?  Depending on what the network is being used for, and how many users - that 100mb link can be adequate bandwidth or it can be saturated constantly.  The only sure way to know would be to check interface statistics during peak transfer periods - on a Cisco Device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; show interface Fa0/x&#xA; show interface Gi0/x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the traffic flow is not between VLANs (hosts that are plugged into the switch are all on the same VLANs) - then they would not be using that link to the router as they are all on the same broadcast domain.  Assuming all ports negotiated at 1 Gig -  you would get 1 Gig speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is (as Mike P. classified off topic) a home router/switch question - then I would think the bottleneck would be the ISP speed (unless you've got Gig speeds there).  &lt;/p&gt;&#xA;" OwnerUserId="13939" LastActivityDate="2015-02-18T14:11:41.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16755" PostTypeId="2" ParentId="16753" CreationDate="2015-02-18T15:04:38.427" Score="3" Body="&lt;p&gt;You didn't really provide enough information to answer this directly (routing protocols, traffic patterns, vendor choices, etc), but this is the way I would evaluate the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are working with a routing protocol that may reach &quot;all&quot; the peers on a single VLAN, you may get unusual behavior you didn't expect depending on how your IP addressing is handled.  For instance, in a network with default settings, the &quot;highest&quot; IP will be elected in the case of OSPF.  This means that, for instance, if you number your networks with .1 being the &quot;core&quot; and .254 being the most distant edge, .254 will be the designated router.  So you'll have to carefully consider the choice of routing protocol and the configuration of that protocol.  In a case where you may want to split the routing into two areas in the case of OSPF, you'll probably want multiple interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case where the latency is highly variable between sites (e.g. a QinQ service provided through a single &quot;billing&quot; carrier but potentially multiple delivery carriers, fairly common in large metro markets), there may be unusual effects on routing protocol timers as well.  This may cause problems in protocols such as EIGRP, which relies heavily on hello timers and acknowledgments of updates.  This is going to lead to poor scaling, in the sense that you'll be sending a lot of hellos that every router will have to process.  Further, without specific configuration (EIGRP stub routing) each site will also end up acknowledging every other site's routing information, and more importantly, when a site is down HQ will ask every other site for that subnet.  In a situation where you have a flapping site, this will also cause issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some vendors may have varying support for features designed to mitigate these design issues, so the vendor choice is a factor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP would solve these problems but it is a higher learning burden for most network engineers not experienced with it.  There are ways to solve these problems with OSPF and EIGRP as well, but it requires a sensitive awareness of conditions and requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 20 sites, I don't think this would be a significant amount of processing or concern.  In the case where sites need to communicate to each other frequently it may make more sense.  But if the sites mostly need to communicate with the core and very rarely to other sites, I would consider single VLANs used as &quot;transit VLANs&quot; from the core to each site.  This means you only have to provision the VLANs once on each location, and once at the core.  Doing &lt;code&gt;N*sites*VLANs&lt;/code&gt; is quite a big provisioning exercise and will not scale well and will be enormously complex to operate as the number of sites grows without a good network operations team that understands templating and programming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a hybrid design with most traffic going through the core and an occasional &quot;side VLAN&quot; for direct communication between two sites, there may be some value to you.  But you'll have to carefully consider the routing interactions that might result.  It is best to consult with your provider to understand the details behind how the network is built and provisioned on their end (do they own all the resources?  Are there &quot;central POPs&quot; that might remain up where other pieces of the network can be down?  etc) in order to better understand your choices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a common trope in the industry that routing designs scale better, but this is mostly a response to very flat very large switched data center networks which have a wide failure and broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the design options you have proposed, I would want to understand the requirements better before making a specific recommendation, but I think that I would lean to individual interfaces from the corporate site to the remote site as &quot;transit&quot; VLANs with each site maintaining its own VLAN database and treating each interface at the core independently (hub and spoke).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example interface configuration for this option on Cisco gear would be:&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;R1 (Core)&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int E0/0.201&#xA; encaps dot1q 201&#xA; no shut&#xA; ip address 192.168.1.1 255.255.255.0&#xA;&#xA;int E0/0.202&#xA; encaps dot1q 202&#xA; no shut&#xA; ip address 192.168.2.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;R2 (Remote Site)&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int E0/0.201&#xA; encaps dot1q 201&#xA; no shut&#xA; ip address 192.168.1.2 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;R3&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int E0/0.202&#xA; encaps dot1q 202&#xA; no shut&#xA; ip address 192.168.2.2 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you would run a routing protocol on each of these interfaces, almost exactly like an individual router would have multiple distinct interfaces to different routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The provider can provide you with a list of acceptable VLAN tags or can allow you to run any tags, depending on how their service is provisioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If instead what you want is to bridge large broadcast layer 2 domains between multiple sites and have servers/hosts/clients at multiple locations be on the same VLANs so they can communicate to each other &quot;locally&quot;, there are many additional concerns.  This can create real problems without a thorough understanding of your environment, since providers doing QinQ often fail to pass some important protocols that do not operate well in a QinQ environment.&lt;/p&gt;&#xA;" OwnerUserId="43" LastEditorUserId="43" LastEditDate="2015-02-19T02:01:21.110" LastActivityDate="2015-02-19T02:01:21.110" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16758" PostTypeId="1" AcceptedAnswerId="16806" CreationDate="2015-02-18T15:44:17.197" Score="7" ViewCount="3030" Body="&lt;p&gt;I found a neat little behavior on a Juniper box I was working with today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We were migrating from a Cisco ASR to an MX and all of our internet exchange peers that had authentication configured didn't come up.  We received log messages on the MX480 implying that our local authentication wasn't set, even though it was.  (See following labbed config)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;group R01-DSN-PEERS {&#xA;    type external;&#xA;    authentication-algorithm md5;&#xA;    authentication-key-chain STUPID;&#xA;    neighbor 192.168.100.1 {&#xA;        peer-as 6996;&#xA;    }&#xA;}&#xA;&#xA;key-chain STUPID {&#xA;    key 0 {&#xA;        secret &quot;$9$uEns1crM8xbY45Qt0O1cS&quot;; ## SECRET-DATA&#xA;        start-time &quot;2015-1-1.01:01:00 +0000&quot;;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The opposite side, I found out looked like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 6996&#xA;neighbor 192.168.100.0 password _secret_stuff_&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NOTE: Yes the opposite neighbor was configured properly, this is just to give you an idea - the previously installed ASR had the peer Established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We ended up getting it working by setting the authentication directly on the neighbor, without a key-chain, see below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;group R01-DSN-PEERS {&#xA;    type external;&#xA;    neighbor 192.168.100.1 {&#xA;        authentication-key &quot;$9$041sISlWL7w2oTzpOBISy&quot;; ## SECRET-DATA&#xA;        peer-as 6996;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Great, now we have it working - we didn't have any particular attachment to using key-chains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decided to fully lab this out, and pull packet captures to see what the difference in TCP/BGP options were.  Below are each of the scenarios I tried (it's all Juniper, I don't have a Cisco box in the lab):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Peer entered ESTABLISHED:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;authentication-key-chain on the BGP group of both peers.&lt;/li&gt;&#xA;&lt;li&gt;authentication-algorithm on the BGP group of both peers.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When using the authentication-key-chain, etc. the packet capture didn't give me the TCP authentication options I'd expect (I can provide full captures if necessary):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/A731Z.png&quot; alt=&quot;cap-1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Peer entered ESTABLISHED:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;authentication-key on the BGP peer within the group on both routers.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here's what I would expect using MD5 authentication:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/H4bt3.png&quot; alt=&quot;cap-2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, MD5 is explicitly called out in the capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now as I mentioned, we don't care if we use key-chains or not, it was just very curious when I did mismatch the configs, (see below) - they wouldn't enter ESTABLISHED even though it would seem they should:&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Peers flapped between ACTIVE/CONNECT&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Peer 1: authentication-key on the BGP peer within the group.&lt;/li&gt;&#xA;&lt;li&gt;Peer 2: authentication-key-chain set on the BGP peer within the group.&lt;/li&gt;&#xA;&lt;li&gt;Peer 2: authentication-algorithm set on the BGP peer within the group.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All in all, what could account for the difference in the captures for the &quot;same&quot; options?  If anyone needs clarifying information, just let me know.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-02-20T16:15:59.447" Title="BGP authentication-key-chain vs. authentication-key" Tags="|cisco|bgp|juniper-junos|authentication|bgp-ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16760" PostTypeId="1" CreationDate="2015-02-18T17:23:15.743" Score="2" ViewCount="1284" Body="&lt;p&gt;Anyone aware of a way to tie a static route to HSRP, so that it is only advertised when the router is Active?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot think of any way to do this other than via an EEM script which looks at syslog for state changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="5661" LastActivityDate="2015-04-19T21:38:07.267" Title="Tying a static route to HSRP to only advertise when Active" Tags="|router|hsrp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16762" PostTypeId="2" ParentId="16760" CreationDate="2015-02-18T18:04:52.440" Score="2" Body="&lt;p&gt;EEM/EOT script is the right approach for this feature taken on its own.  If there is a VPN involved, you could consider using &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/xe-3s/asr1000/sec-vpn-availability-xe-3s-asr1000-book/sec-vpn-ha-enhance.html#GUID-19A97374-7F1E-4652-A281-6450CE72253B&quot; rel=&quot;nofollow&quot;&gt;reverse route injection&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="43" LastActivityDate="2015-02-18T18:04:52.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16763" PostTypeId="1" CreationDate="2015-02-18T18:44:59.563" Score="1" ViewCount="646" Body="&lt;p&gt;I have multiple GSM modems connected to a laptop and now I want to increase their signal. I thought in buying an antenna and a repeater and put the repeater next to the modems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know, the repeater is commonly used to increase the signal in interiors, repeating the signal that receives from/to the antena on the roof. So if I put a receiver next to so the modems, supposedly, their will receive a better signal (the one that the repeater receives from the high gain antenna).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is: Will be they possible to send/receive high quantity of data at the same time using the same antenna?&lt;/p&gt;&#xA;" OwnerUserId="12004" LastActivityDate="2015-02-18T18:44:59.563" Title="Can I use 1 GSM antenna connected to multiple GSM modems?" Tags="|mobile|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16764" PostTypeId="1" CreationDate="2015-02-18T19:07:49.100" Score="3" ViewCount="1106" Body="&lt;p&gt;I've worked up a spreadsheet that attempts to model how a 3-layer, nonblocking Clos (fat-tree) topology scales.  For my initial case I'm dealing with a non-oversubscribed fabric, so for each switch other than those at the top layer, the (# of uplinks == # of downlinks).  I've used &quot;N&quot; as the number of ports required, and &quot;k&quot; as the number of ports on an individual switch (properly called the radix).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The formulas I've gotten to are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;top layer  is N/K switches&lt;/li&gt;&#xA;&lt;li&gt;middle layer is 2*(N/K) switches&lt;/li&gt;&#xA;&lt;li&gt;the bottom layer is also 2*(N/K) switches&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I'm trying to figure out is whether or not there's a more efficient way to build this out where the bottom two levels aren't the same number of switches.  What I &lt;em&gt;think&lt;/em&gt; I've gotten myself to is that unless you remove the restriction on nonblocking these layers have to be the same width (meaning the same number of switches)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone suggest a more efficient way to build/scale/wire this up?&lt;/p&gt;&#xA;" OwnerUserId="13955" LastEditorUserId="775" LastEditDate="2015-02-20T13:29:19.583" LastActivityDate="2015-02-20T13:29:19.583" Title="3-layer clos/fat-tree scaling question" Tags="|switch|design|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16766" PostTypeId="1" AcceptedAnswerId="16767" CreationDate="2015-02-18T20:57:44.683" Score="2" ViewCount="767" Body="&lt;p&gt;I have a 25m CAT 5e cable and I'm trying to connect to a router. The connection obtained is always 100Base-TX full-duplex, it never reaches 1000Base-T. What can be the problem? As long as it says it's full duplex I assume the jacks are ok.&lt;/p&gt;&#xA;" OwnerUserId="13956" LastEditorUserId="8499" LastEditDate="2018-03-20T23:06:04.503" LastActivityDate="2018-03-20T23:06:04.503" Title="Only 100Base-TX full-duplex over a 25m CAT 5e cable" Tags="|ethernet|layer1|cabling|cable|utp|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="16767" PostTypeId="2" ParentId="16766" CreationDate="2015-02-18T21:19:54.607" Score="4" Body="&lt;p&gt;Ron hit the nail on the head for the most likely cause. As long as the router has a gig interface and the computer or switch connected to it is capable of gig speeds, then it's most likely a cabling issue. I had this same issue when I did some home wiring a few months ago, turned out 7 of the 8 wires were connected, not 8/8 = not 1000BaseT.&lt;/p&gt;&#xA;" OwnerUserId="817" LastActivityDate="2015-02-18T21:19:54.607" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16768" PostTypeId="2" ParentId="16764" CreationDate="2015-02-18T21:56:07.143" Score="3" Body="&lt;p&gt;The first and second stage should be identical for a non-blocking design eg: inputs should equal outputs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your forumla is missing a couple of components - have a read through the following:&#xA;&lt;a href=&quot;http://people.seas.harvard.edu/~jones/cscie129/nu_lectures/lecture11/switching/clos_network/clos_network.html&quot; rel=&quot;nofollow&quot;&gt;http://people.seas.harvard.edu/~jones/cscie129/nu_lectures/lecture11/switching/clos_network/clos_network.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When relating this back to wiring up real network switches, you will also need to allow for links between the stages potentially using higher capacity interfaces than your input/output ports.  Eg: if you have a switch that's 20x 10GE and 6x 40GE, the number of links wired up into the 2nd stage is going to be 4x less than a formula would suggest.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-02-18T21:56:07.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16769" PostTypeId="2" ParentId="16766" CreationDate="2015-02-18T22:25:37.340" Score="-1" Body="&lt;p&gt;Did you try to manually enter the speed, instead of auto-negotiation? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try this under the switchport:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config-if)#speed 1000&#xA;Switch(config-if)#duplex full&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the host, if it is a Windows machine, right-click the adapter, click properties, then 'Configure' and then 'Advanced'. Click on 'Link Speed &amp;amp; Duplex' and under Value, choose 1.0 Gbps Full Duplex'&lt;/p&gt;&#xA;" OwnerUserId="13918" LastEditorUserId="33" LastEditDate="2015-02-18T22:51:25.640" LastActivityDate="2015-02-18T22:51:25.640" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16770" PostTypeId="2" ParentId="16753" CreationDate="2015-02-18T22:32:01.690" Score="2" Body="&lt;p&gt;Sounds like you don't know what your design goal is, or at least haven't explained it clearly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using a hub and spoke setup, which would effectively be a VLAN per tunnel, then you should just route via the tunnel everywhere. You could run something like OSPF on the hub, and an area per tunnel. Then just advertise sumamry default route to the branch so it goes via the hub. This is providing you want the routing VIA the hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's really not clear what your design goal is or how your QinQ tunnels are setup. You should ask yourself these questions and then give us the answers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have spoke to spoke tunnels? &#xA;Does each site have local internet breakout?&#xA;Does everything need to go via the hub?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the sites have local internet breakout, you could use something like DMVPN, and just advertise a default route to the branch. Your spokes would then just build dynamic vpn tunnels between them via the internet.&lt;/p&gt;&#xA;" OwnerUserId="817" LastActivityDate="2015-02-18T22:32:01.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16775" PostTypeId="1" CreationDate="2015-02-19T08:24:45.797" Score="1" ViewCount="475" Body="&lt;p&gt;Apologize if I am not very technical, but networking is not my field of expertise. I work at a positioning system service. We collect data from GPS satellites via GPS antennas in the field, get the data from the antennas, calculate X,Y,Z coordinates in our servers, and distribute accurate coordinates to GPS users in the field via the mobile GPRS network. &#xA;We have 5 servers here. Three collect data from the antennas, and the other (NTRIP server) distributes them to the users. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, we are having network interruptions during certain hours of the day (8 AM to 18 PM approximately, Monday to Friday). In the evening and during the night, everything works fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our internet provider confirmed that everything is fine on their end. It seems there is a problem with the communication among our servers. &#xA;If you try to ping one server from the other through the CMD, we would get a request time out for every 20 successful replies. The timeouts are random. &#xA;The servers are inside the Active Directory. Windows Server 2008 R2 is installed in all the servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have had some IT specialists have a look at our system, but they haven't been able to get the reason why this is happening. So, I desperately came to ask here. Please feel free to edit my question.&#xA;Any tip would be great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edits&lt;/strong&gt;: I myself tried restarting the servers, the switch, the modem and the router, but nothing changed. I am providing the network topology here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lpC37.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lpC37.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The active directory domain is located at Control Center server. The Datastorage, Network are used to calculate the coordinates collected from 16 GPS reference stations. The coordinates are stored in the Datastorage server. The RTCD-Admin holds the Microsoft SQL database. Ignore the the RINEX, and the Transformation server from the topology. They don't have any role anymore. The NTRIP server gets the data from the Datastorage server and distrubutes it to the users. We give the users the public IP of the NTRIP server, the port, the username and the password. They enter these data in their GPS receivers and get real time coordinates via GPRS internet.&#xA;This installation was an existing one, and we don't understand why the problem appeared. The user traffic has not increased. Indeed, we have very few users we distribute data to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Updates&lt;/strong&gt; following the suggestions, I isolated the problem. It came out that when the router was disconnected from the switch, the communication between the servers was normailzed (no request timed out anymore).&#xA;Now, I am trying to understand whether that is a problem with the router or the modem, and wheather the problem is physical or it has to do with the configurations.&lt;/p&gt;&#xA;" OwnerUserId="13962" LastEditorUserId="13962" LastEditDate="2015-03-26T13:41:34.747" LastActivityDate="2015-03-26T13:41:34.747" Title="Network issues in certain hours every day" Tags="|ethernet|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16777" PostTypeId="1" AcceptedAnswerId="16822" CreationDate="2015-02-19T09:26:32.510" Score="1" ViewCount="1623" Body="&lt;p&gt;What does it mean when I get small variations in ping results when pinging an empty LAN ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example : &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When pinging a resource in the same vlan (layer 2) : no variations, ping &amp;lt; 1ms constantly&lt;/li&gt;&#xA;&lt;li&gt;When pinging another vlan ip address (layer 3, routed by the L3 switch) : the ping varies between 1 ms and &amp;lt;1ms&lt;/li&gt;&#xA;&lt;li&gt;When pinging another vlan ip address (layer 3, through a firewall) : the ping varies between 1ms and &quot;&amp;lt;1ms&quot;&lt;/li&gt;&#xA;&lt;li&gt;When pinging a server in another vlan (layer 3, routed by the L3 switch), the ping varies between &amp;lt;1ms and 3ms&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The firewall has no traffic filters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions is : is this behavior normal? I am not worried about the response time in itself, but more by the variation that I cannot really explain.&#xA;The switches are not busy, so is the firewall because my network is empty at this time, so it should not be a load issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking forward hearing thoughts on this issue.&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2015-02-21T14:10:29.613" Title="Small variations in ping on a LAN" Tags="|ping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16778" PostTypeId="1" CreationDate="2015-02-19T09:53:03.447" Score="2" ViewCount="803" Body="&lt;p&gt;Just a small question can we stack poe and non poe switch (2960x)suppose we have 2 non poe and 2 poe switch , then can we stack this&#xA;Can we make stack of 4&lt;/p&gt;&#xA;" OwnerUserId="5479" LastActivityDate="2015-02-20T23:33:01.827" Title="cisco Switch Stack Query" Tags="|cisco|cisco-catalyst|switching|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16779" PostTypeId="2" ParentId="16778" CreationDate="2015-02-19T12:35:42.200" Score="2" Body="&lt;p&gt;Yes, there is no issue with stacking PoE and non-PoE switches.  The biggest trick is to know which ports are PoE and which are not--if they are the same speed then you will have to rely on commands like &lt;code&gt;show inventory&lt;/code&gt; and &lt;code&gt;show power inline&lt;/code&gt; to keep track of the PoE ports.   Also, watch your power readings (and add redundant power depending on the model).&lt;/p&gt;&#xA;" OwnerUserId="13537" LastActivityDate="2015-02-19T12:35:42.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16780" PostTypeId="1" AcceptedAnswerId="16804" CreationDate="2015-02-19T12:50:00.533" Score="7" ViewCount="3176" Body="&lt;p&gt;Situation: two ethernet connections, between a switch and a server.&lt;br&gt;&#xA;At the switch end, the two interfaces are configured for LACP.&lt;br&gt;&#xA;At the server end, they're configured as normal ethernet interfaces.&lt;br&gt;&#xA;How do the switch interfaces behave?&lt;br&gt;&#xA;I believe that they'll behave as two normal ethernet interfaces and forward the traffic in parallel to the server as if they had no LACP config applied to them. The server will pick one interface and use it for outbound traffic.&lt;br&gt;&#xA;The switch interfaces might be configured for LACP but until they form an LACP trunk with the server end interfaces, nothing happens to the normal traffic.&#xA;In reality it's halving the bandwidth available between them because they're both forwarding the same traffic.&lt;br&gt;&#xA;Is this correct please?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: The interfaces are configured as outbound mirrored ports.&lt;/p&gt;&#xA;" OwnerUserId="13965" LastEditorUserId="13965" LastEditDate="2015-02-21T09:11:43.453" LastActivityDate="2016-01-17T17:44:05.540" Title="How do interfaces behave in a single-ended LACP configuration?" Tags="|ieee-802.1ax|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16781" PostTypeId="1" AcceptedAnswerId="16784" CreationDate="2015-02-19T13:02:25.573" Score="3" ViewCount="1446" Body="&lt;p&gt;I have a quick question regarding MSTP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do all the switches in an MSTP domain should agree to which VLANs are mapped to an instance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being that dumb, I've just caused an outage by just simply creating a VLAN and adding it to an instance on one of the two core switches. Can you explain what happened when I did that, just want to understand that? Did I have to first add it as a tagged VLAN on the trunk between the core switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the correct procedure to add a VLAN to MSTP domain? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I did that caused the trouble:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)# vlan 700&#xA;Switch(vlan-700)# name test&#xA;Switch(config)# spanning-tree instance 1 vlan 700&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switches: HP ProCurve 3500yl&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="2093" LastEditDate="2015-02-19T13:14:19.400" LastActivityDate="2015-02-19T13:26:59.747" Title="Multiple Spanning-Tree. Same VLANs on instance for all switches?" Tags="|vlan|spanning-tree|hp-procurve|ieee-802.1s|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16783" PostTypeId="2" ParentId="6212" CreationDate="2015-02-19T13:21:30.147" Score="0" Body="&lt;p&gt;TO access internet u will have to configure split tunnel, because split tunnel define what traffic will go by tunnel and what will not , because by default all traffic will go by tunnel . u can see on your computer by typing ( print route),that all traffic will go by tunnel , and if u dont want to use split tunnel , then we have  one more solution you can configure reverse natting, first packet will go to your remote server and remote server will send back to internet&lt;/p&gt;&#xA;" OwnerUserId="10769" LastActivityDate="2015-02-19T13:21:30.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16784" PostTypeId="2" ParentId="16781" CreationDate="2015-02-19T13:26:59.747" Score="5" Body="&lt;p&gt;The switches in a MSTP domain do agree which VLANs are mapped to which instances. Altering the mapping will change the configuration digest. The result of that will be two separate, degenerate MSTP domains. Any configuration applied to the internal spanning tree will become moot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They way you are supposed to do it is to create a 'pending' configuration on all the switches first, then apply it simultaneously. See the section &quot;Enabling an Entire MST Region at Once or&#xA;Exchanging One Region Configuration for Another&quot; in the Advanced Traffic Management Guide for details.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2015-02-19T13:26:59.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16788" PostTypeId="1" CreationDate="2015-02-19T18:28:21.573" Score="2" ViewCount="3178" Body="&lt;p&gt;I have to keep prefacing my question with &quot;I am not trying to reimplement ipv4 nat inbound for outdated security I don't understand correctly&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hi! I am wondering if it is possible to implement an ipv6 nat under pfsense.  My goal is to perform the nat on the &lt;strong&gt;LAN&lt;/strong&gt; interface so that I can redirect any outbound v6 port 53 into a local v6 dns server.  My ISP (comcast) does not allow me to configure my own v6 server on their router, and they do not allow me to do prefix delegation requests.  I just want to hijack the requests going to their auto-learned DNS servers into a server that has beter than 98.5% uptime. &lt;em&gt;Please note: I am not interested in making changes to my ISP, etc.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I literally want a rule that says &quot;packets coming in on this interface with a source address of my lan clients and destination of any, destination port 53, protocols udp and tcp, go to this local ipv6 global address on port 53.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It works just fine on ipv4.  I do not suspect this capability exists in pfsense, but would like someone a bit of an expert to give advice.  Thanks.&lt;/p&gt;&#xA;" OwnerUserId="13971" LastActivityDate="2015-06-20T15:44:48.803" Title="can pfsense perform ipv6 nat (for outbound service redirection)" Tags="|nat|ipv6|pfsense|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16789" PostTypeId="1" AcceptedAnswerId="16791" CreationDate="2015-02-19T20:35:50.260" Score="0" ViewCount="120" Body="&lt;p&gt;Hello I'm kind of new to networking and I'm having a small problem of.. not knowing where to start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have three Windows2012 servers which I would like to assign three IP's from my range given by Frontier. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network goes as follow,&#xA;ATT Rack -&gt; Small Business Cisco Router RV042G -&gt; SonicWall NSA 2400 (Passthrough, L2-Bridge) -&gt; Switches -&gt; Server A (DNS, DHCP, AD DS, DC), Server B (IIS,FTP), Server C (IIS,FTP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My ideal set up would be to have, &#xA;x.x.x.178 ServerA (RDP Only)&#xA;x.x.x.179 ServerB (HTTP,FTP)&#xA;x.x.x.180 ServerC (HTTP,FTP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A consultant CCNA told me it was not possible with the current hardware, he said I would need something capable of proper NAT routing. So this is where I am stuck. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment I am only using x.x.x.178.&#xA;HTTP is port-forwarded to ServerB, while RDP is forwarded to ServerA. This was done through the Cisco Router Web Interface, and the sonicwall is passing through all traffic for now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm completely new to networking and I would appreciate any pointers in the right direction.&lt;/p&gt;&#xA;" OwnerUserId="13975" LastEditorUserId="13975" LastEditDate="2015-02-19T20:43:43.843" LastActivityDate="2015-02-19T21:02:12.000" Title="Three Servers on Three IP's" Tags="|cisco|router|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16791" PostTypeId="2" ParentId="16789" CreationDate="2015-02-19T21:02:12.000" Score="2" Body="&lt;p&gt;Unless I'm mistaken, the RV042G can do 1 to 1 NAT. &#xA;There's a guide on Cisco's website on how to enable it &lt;a href=&quot;http://sbkb.cisco.com/CiscoSB/GetArticle.aspx?docid=9c994cc0865c446489cde9aeaf990c49_One_to_One_NAT_on_a_RV042.xml&amp;amp;pid=2&amp;amp;converted=0&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, lets say your public IP block includes 100.0.0.177 through .180 as usable IPs. And your LAN is 192.168.1.x.  You'd make 1 to 1 NAT mappings so that 100.0.0.178 maps to 192.168.1.178, 100.0.0.179 to 192.168.1.179, etc, with .177 used for the rest of your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you only really need to do multiple public IPs if you are hosting services on the same port.   Since only Server A is doing RDP, you don't need to give it's own public IP and it can share .177 with the rest of the network, with the appropriate NAT and firewall rules for the RDP port. .&lt;/p&gt;&#xA;" OwnerUserId="10237" LastActivityDate="2015-02-19T21:02:12.000" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16794" PostTypeId="2" ParentId="16775" CreationDate="2015-02-19T23:00:53.443" Score="2" Body="&lt;p&gt;You have to try and isolate the problem as much as possible. Need to work out exactly which communication stream drops out. Do this by testing connections between all isolated parts of the network, that is computer one - &gt; computer two, computer three - &gt;computer four. Once you have narrowed down the problem it will be a lot easier to fix.&lt;/p&gt;&#xA;" OwnerUserId="13633" LastActivityDate="2015-02-19T23:00:53.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16795" PostTypeId="1" AcceptedAnswerId="16797" CreationDate="2015-02-19T23:29:47.517" Score="2" ViewCount="226" Body="&lt;p&gt;I am new to networking and I'm following a CCNA course. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few terms that I don't (properly) understand, and I've searched for them like a mad man, but with no success.  I've only read 2 chapters so far, namely the introduction and how to configure an IOS, so please refrain from explaining things in terms of the &lt;strong&gt;OSI model&lt;/strong&gt;, I am not that far yet. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;As I interpret wikipedia, a &lt;strong&gt;channel&lt;/strong&gt; is the media used for the connection. Then the definition of a &lt;strong&gt;data link&lt;/strong&gt; is the means of connecting one location to another for the purpose of transmitting and receiving digital information.  Does this mean they are the same thing?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What is a &lt;strong&gt;VLAN&lt;/strong&gt;? As of now, I understand it as a &quot;fake&quot; LAN. So you have two LANs, in different geographical area's (e.g. seperate buildings), and you treat them as one. However, I don't see how it makes sense in the context of a switch console. In the CCNA course I'm following, I've navigated to &lt;code&gt;(config-if)#&lt;/code&gt; by entering the the command &lt;code&gt;interface vlan 1&lt;/code&gt;. Is this a different kind of VLAN?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Apparently theres many ways to configure a switch: CTY (console), VTY (telnet/SSH), AUX (based on a phone cable?), and TTY. After googling however, I still do not understand what TTY means. How do we use TTY? And are all these *TY terms examples of &lt;strong&gt;lines&lt;/strong&gt;? Actually, what's a line? What am I saying when I use the command &lt;code&gt;line console 0&lt;/code&gt;? Is a line just a port?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Sorry about the questions not being completely related, but I feel like these questions aren't worth asking seperately. You don't have to answer all 3 of the questions, any information is appreciated...&lt;/p&gt;&#xA;" OwnerUserId="13978" LastActivityDate="2015-08-02T01:16:53.317" Title="Terminology on data link, channel, VLAN" Tags="|cisco-ios|terminology|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16796" PostTypeId="2" ParentId="16780" CreationDate="2015-02-20T00:08:54.020" Score="-1" Body="&lt;p&gt;It all depends on the mode of LACP you have configured on the switch. For eg, under the interfaces, you type 'channel-group 1 mode on/active/passive'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have selected 'active', then the switch will look for the other end of the connection to be either in the active or passive mode. If it detects either, then an LACP port-channel gets formed and traffic gets load-balanced among the ports. If not, they will be treated as regular ports and spanning-tree will kill one of the 2 ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you have selected the mode 'on'(which you never should), then it will force a port-channel on the switch. If the other side does not form a port-channel, then there is possibility of a loop, which can cause a network meltdown. &lt;/p&gt;&#xA;" OwnerUserId="13918" LastActivityDate="2015-02-20T00:08:54.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16797" PostTypeId="2" ParentId="16795" CreationDate="2015-02-20T03:36:18.657" Score="3" Body="&lt;p&gt;The first thing to remember is that all these terms came into use via the marketing departments of network equipment manufacturers.  As companies developed technologies, they invented terms, created new meanings for existing terms, or borrowed terms from other disciplines with similar characteristics.  The point is there are no hard and precise definitions, and sometimes they only mean what companies want them to mean at this moment in time -- they can change as new technologies are developed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, here are some rough definitions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;A channel usually refers to a physical medium, while data link is usually a logical connection.  Again, the terms can be fuzzy, and there are no doubt exceptions to what I just said, although I can't think of any at the moment.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A LAN can be thought of a set of devices that share a medium (e.g. Ethernet) with these two characteristics:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a.  Every device can directly address every other device via the media, creating a data link connection.  In Ethernet, every device on a LAN can send traffic directly to every other device using the MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b.  Devices can send data to all devices on the medium at once (i.e., broadcast).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Back in the good old days, this was done via a physical medium: Ethernet cable, Token Ring, or Arcnet.  On a modern network (Ethernet) switch, you can create groups of ports that have these two characteristics.  For example, you can configure a 24 port switch so that only ports 1,2,3, and 10 can directly address each other and listen to broadcasts from these ports.  You have created 'virtual' LAN or VLAN.  It's virtual in the sense that it doesn't rely on physical media, but on the configuration of the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can create another group of ports (11,12,13) that also have the two characteristics -- you have created a different virtual LAN on the same switch.  To answer your specific question, a VLAN interface is a logical layer 3 interface on a VLAN.  It's the logical equivalent of connecting a router's interface to a VLAN.  It is not the same thing as the VLAN itself.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;This question refers specifically to Cisco devices.  Other manufacturers use different terms (just to add to your confusion).&#xA;There are a number of physical and logical &quot;ports&quot; you can use to configure a switch.  The console and aux ports are physical ports on the device.  Both use RS-232 as the physical medium and protocol (here the terms medium and data link get fuzzy).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;TTY is an abbreviation of &quot;teletype.&quot; Tt's a term that persists even though the original use is long obsolete (the &quot;return&quot; key is another term like that).  Think of it as a logical connection to the administrative interface of the switch.  You can get here via a physical connection (console or aux ports) or a logical connection using telnet/ssh, using a virtual tty port, or VTY.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't get too hung up on the specific definitions.  VLANS and their importance will make more sense when you get to OSI.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-02-20T03:36:18.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16798" PostTypeId="1" CreationDate="2015-02-20T09:03:07.657" Score="4" ViewCount="1590" Body="&lt;p&gt;We are looking into rate limiting some specific IP addresses down to 5mbit for various bandwidth reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is is possible to rate limit ingress and egress traffic for specific IP addressees on the 2960S and 2960X series?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We know we can use &quot;srr-queue bandwidth limit 50&quot; combined with &quot;speed 10&quot; to limit egress traffic on a interface to 5mbit, but this will then apply to all IP's and not just the specific ones we want to limit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is not possible, any chance it would be possible if we changed the SDM template to &quot;lanbase-routing&quot; as that enables some layer3 functionality?&lt;/p&gt;&#xA;" OwnerUserId="318" LastActivityDate="2015-03-02T09:40:41.080" Title="Rate limiting specific IP adresses on Cisco 2960S and 2960X series" Tags="|cisco|qos|bandwidth|cisco-2960|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16801" PostTypeId="1" CreationDate="2015-02-20T12:48:25.870" Score="1" ViewCount="438" Body="&lt;p&gt;A group of computers connected by a layer 2 Switch, can communicate each other by the layer 2 address i.e. MAC address. Does IP address also require on LAN(Layer 2) network(assuming there is no Router exists in the given LAN network) to communicate messages between hosts for a given applications(HTTP,FTP)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, Computer A running a browser and trying to access a http server hosted on computer B. Now both the computer A and B are connected by a Layer 2 Switch(Ethernet Switch). Now in this scenario http shouldn't require an IP address.. rather MAC is enough to communicate between computer A and B. But still we do provide IP to both the computer .. WHY?&lt;/p&gt;&#xA;" OwnerUserId="13985" LastEditorUserId="33" LastEditDate="2015-07-07T18:44:55.513" LastActivityDate="2015-07-07T18:44:55.513" Title="Is IP address required on Ethernet network(ex. LAN network)?" Tags="|switch|mac-address|ip|lan|" AnswerCount="1" CommentCount="0" ClosedDate="2015-02-20T18:51:21.867" ContentLicense="CC BY-SA 3.0" />
  <row Id="16802" PostTypeId="2" ParentId="16801" CreationDate="2015-02-20T13:10:54.747" Score="2" Body="&lt;p&gt;The answer to your question is that it depends on the protocol.  It is true that some protocols will work at layer 2 alone (for example NetBIOS), but others were written from the ground up to use upper layer protocols like IP (layer 3) and TCP (layer 4).  The two you refer to are HTTP and FTP.  Both of them rely on TCP to establish the virtual circuit session, so by nature of the protocol they cannot work at layer 2 alone.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need detailed description on how the protocol works, the RFCs are a great source.  &lt;a href=&quot;https://www.ietf.org/rfc/rfc2616.txt&quot; rel=&quot;nofollow&quot;&gt;See the HTTP 1.1 RFC doc here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13693" LastActivityDate="2015-02-20T13:10:54.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16804" PostTypeId="2" ParentId="16780" CreationDate="2015-02-20T13:55:25.897" Score="2" Body="&lt;p&gt;You didn't specify a manufacturer, I will assume Cisco switches though most other vendors should behave similarly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the channel group's mode is active, the interfaces will not forward traffic, since the switch will actively be trying to form a channel and if the channel negotiation fails, the port channel will be &quot;down&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the channel group's mode is passive or analog to passive, the interfaces will forward traffic normally and will listen for LACP/PaGP negotiations.  This will bring the interfaces up and listen for traffic on the interfaces.  If the switch sees these LACP packets from the host and a negotiation commences, the channel will be negotiated and packets will be forwarded over the port channel interface and not the individual interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the server's perspective, at the IP layer, if the destination host is in the subnet defined by the network configuration on the interface, the server will attempt to ARP this address.  If somehow both interfaces were connected to the same subnet (most OS will show a warning or disallow this behavior), they may ARP out both interfaces.  So once the ARP is received on a given interface, the server will know to send the packets out this interface, and the switch will also identify which IP and MAC are tied to each individual interface (but the forwarding behavior will be controlled by the below).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are purely talking about Ethernet packets, and not IP, the server will forward the frames using whatever interface is specified.  If I am not mistaken, in Linux the interface MUST be specified; in Windows it will probably use the interface with the highest (top) priority in the network interface bindings.  This behavior varies OS to OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the switch's perspective, the switch will flood frames with a MAC address out all interfaces until it learns which port a given MAC address is on.  It will learn this port by listening for a frame with the source MAC address.  So if 0111.2222.3333 is sending a frame to 0111.2222.3334, the switch will flood the frame out all ports in that VLAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0111.2222.3333 (Fa0/1) -&gt; 0111.2222.3334 will flood to all ports&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Until it sees a reply&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0111.2222.3334 (Fa0/2) -&gt; 0111.2222.3333 (Fa0/1) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it will commence forwarding all traffic to the specific port that issued these frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a number of edge cases here that might bring more confusion such as the potential spanning tree interaction, but this covers the basics.&lt;/p&gt;&#xA;" OwnerUserId="43" LastEditorUserId="43" LastEditDate="2015-02-20T16:38:41.197" LastActivityDate="2015-02-20T16:38:41.197" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16805" PostTypeId="2" ParentId="16788" CreationDate="2015-02-20T13:56:28.020" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://forum.pfsense.org/index.php?topic=89014.0&quot; rel=&quot;nofollow&quot;&gt;https://forum.pfsense.org/index.php?topic=89014.0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An expert finally responded - the answer is no, pfSense provides no IPv6 NAT capabilities.&lt;/p&gt;&#xA;" OwnerUserId="13971" LastActivityDate="2015-02-20T13:56:28.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16806" PostTypeId="2" ParentId="16758" CreationDate="2015-02-20T16:15:59.447" Score="5" Body="&lt;p&gt;Well I managed to figure this out.&lt;/p&gt;&#xA;&lt;p&gt;The bottom line is:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using authentication-key-chains uses the &amp;quot;TCP Enhanced Authentication&#xA;Option&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;Using authentication-key uses the &amp;quot;TCP MD5 Signature Option&amp;quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-bonica-tcp-auth-06&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://datatracker.ietf.org/doc/html/draft-bonica-tcp-auth-06&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;12.4.  Backwards Compatibility&#xA;&#xA;   On any particular TCP connection, use of the TCP Enhanced&#xA;   Authentication Option precludes use of the TCP MD5 Signature Option.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You simply cannot mix the two different TCP options.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2015-02-20T16:15:59.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16808" PostTypeId="1" AcceptedAnswerId="16826" CreationDate="2015-02-20T19:50:09.543" Score="3" ViewCount="1568" Body="&lt;p&gt;I've been trying to familiarize myself with IPv6 and one thing that's left me hanging is the benefit of multicasting over broadcasting in IPv6. To use Neighbor Discovery Address Resolution as an example, I understand that nodes will use the solicited-node multicast address when trying to map an IP address to its corresponding MAC address, but how this actually reduces unnecessary processing by other nodes on the same link is not immediately clear to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that to fully maximize the utility of multicasting, we need both a router that speaks Multicast Listener Discovery (MLD) AND a switch supporting MLD snooping. We need the router so that MLD is active on the network and the &quot;smart&quot; switch to keep track of which interfaces are associated with which multicast addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, if we do NOT have a router speaking MLD or our switch does NOT support MLD snooping, then, sure, neighbor solicitations will be directed at the solicited-node multicast address, but any potential savings in network chatter  will be negated when the switch just broadcasts out all ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if what I say is true, does this mean that for almost all networks, especially consumer/soho networks, there will be virtually no benefit by switching over from ARP-based broadcast to ND-based multicast?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDITED:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does a network with switches that do not include MLD snooping treat multicast the same as broadcast and therefore negate the benefits of multicast? As for your second point, forgive me as I am pretty new to all this, but why would an unwanted multicast be less disruptive than a broadcast? If we take the example of ARP, another node sees the broadcast ARP frame, sees it is not referring to itself, and drops it. In ND, the neighbor sees the multicasted solicitation (because it has been broadcasted by the switch), and drops?&lt;/p&gt;&#xA;" OwnerUserId="13988" LastEditorUserId="2142" LastEditDate="2015-02-21T16:35:12.427" LastActivityDate="2015-02-21T17:02:54.577" Title="What is the advantage of multicasting in IPv6 (compared to broadcast)?" Tags="|ipv6|protocol-theory|multicast|" AnswerCount="1" CommentCount="6" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16809" PostTypeId="1" AcceptedAnswerId="16813" CreationDate="2015-02-20T20:00:06.650" Score="5" ViewCount="18403" Body="&lt;p&gt;In a job interview i had faced a question that&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my company we always use udp because it is very much fast. and we have reliability also. can u answer how? without adding so much overhead to the udp how can you make udp reliable?&lt;/p&gt;&#xA;" OwnerUserId="6195" LastActivityDate="2018-07-03T16:26:02.607" Title="how to make udp reliable" Tags="|protocol-theory|udp|speed|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16811" PostTypeId="2" ParentId="13265" CreationDate="2015-02-20T20:10:10.583" Score="2" Body="&lt;p&gt;When you commit in Panorama, select the &quot;Device Group&quot; radio button. There should be a checkbox on the bottom right that says &quot;Force Template Values&quot;. I am wondering if you force the template values for the Device Group whether you will delete the rules from the PanOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also recreate the Device Group and add just this PanOS to the group and commit to see if the policies go away. Then commit again deleting the Device Group.&lt;/p&gt;&#xA;" OwnerUserId="4887" LastActivityDate="2015-02-20T20:10:10.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16812" PostTypeId="1" CreationDate="2015-02-20T20:52:43.543" Score="2" ViewCount="545" Body="&lt;p&gt;I'm trying to get DHCP relay set up on our Cisco SGE2010P switch. Sadly, we can't afford a catalyst switch right now. It looks like I have everything configured correctly, but something is going wrong. VLAN 5 is set up for DHCP relay with giaddr 10.0.10.9, DHCP server is at 10.0.3.4. I can see the DHCP Discover packet being sent by the host AND received by the server. The server replies with a DHCP Offer packet, but this is apparently dropped by the switch, because it never makes it back to the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch automatically creates static routes for VLAN interfaces (which are used as the giaddr IP). For this vlan the route is 10.0.10.0\23 and there is no nexthop address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know anything else you need to help troubleshoot this and I'll try to provide. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="13992" LastActivityDate="2016-07-16T15:31:07.103" Title="Cisco Small-business switch - DHCP Relay offer packet dropped" Tags="|dhcp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16813" PostTypeId="2" ParentId="16809" CreationDate="2015-02-20T22:10:53.497" Score="8" Body="&lt;p&gt;UDP by itself isn't reliable.  The data acknowledge/retransmission functions have to occur at a higher (i.e. application) level.  TFTP is a good example of that.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-02-20T22:10:53.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16814" PostTypeId="2" ParentId="16429" CreationDate="2015-02-20T22:41:04.940" Score="3" Body="&lt;p&gt;You are trying to specify a NO-NAT for your 187.87.7.0/27 but I don't know why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply having &quot;nat (inside,outside) source dynamic PRIVATE interface&quot; will dynamically PAT your 191.167.1.0/24 to 198.98.9.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then traffic traversing your inside to outside will not hit the NAT statement therefore pass through without NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Isn't this what you want?&lt;/p&gt;&#xA;" OwnerUserId="13993" LastActivityDate="2015-02-20T22:41:04.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16817" PostTypeId="2" ParentId="16778" CreationDate="2015-02-20T23:33:01.827" Score="0" Body="&lt;p&gt;Yes you can do that. I am pretty sure they can be different models as long as they are running the same IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jack.&lt;/p&gt;&#xA;" OwnerUserId="13995" LastActivityDate="2015-02-20T23:33:01.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16819" PostTypeId="2" ParentId="16681" CreationDate="2015-02-21T04:14:43.073" Score="1" Body="&lt;p&gt;&lt;em&gt;I'm making some assumptions on your setup and how exactly your ISP is giving you these IPs, so if any of this is wrong I apologize and will happily change my answer&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your internal network I would suggest you setup a DHCP pool for your workstations and statically assign IPs to your servers.  I'll leave the DHCP pool setup for you, as I think you're mainly aiming to make sure both public IPs are utilized by the proper networks.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;i.e.&#xA;  172.16.1.0/24 for your workstations, with DHCP, assigned to VLAN10&#xA;  172.16.2.0/29 for your servers, statically assigned, on VLAN20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That all being said here is what I personally would try and setup to get your gear online.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g0/0&#xA;  ip address dhcp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will pull an IP from your modem and give it to your external port.  I suspect it will be an ISP internal IP because I doubt they'd give your modem a publicly routable IP. That'd be weird.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this scenario, you should not be manually inputting any default routes on your router as it should all be supplied from the DHCP pull.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g0/1.10&#xA;  ip address 172.16.1.1 255.255.255.0&#xA;int g0/1.20&#xA;  ip address 172.16.2.1 255.255.255.248&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This setups the internal gateways for your two networks. So all your workstations will be pointing to &lt;em&gt;172.16.1.1&lt;/em&gt; and your servers to &lt;em&gt;172.16.2.1&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that you'll need to setup NAT rules on the router to handle passing of traffic outwards for your workstations.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g0/0&#xA;  ip nat outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This setups your external facing interface as your outside nat interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g0/1.10&#xA;  ip nat inside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This setups your internal facing interface as an inside nat interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# ip nat pool internet 128.66.0.2 128.66.0.2 prefix 24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Creates a NAT pool named &lt;em&gt;internet&lt;/em&gt; being translated to one of your public IPs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# ip nat inside source list 7 pool name internet overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This says to NAT all IPs in list 7 to the NAT pool you just created and that you can overload it.  Which is to say more than one internal IP can use the same external IP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# access-list 7 172.16.1.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Creates the list referenced in the previous command.  Now onto NAT for your servers, which I suggest be statically assigned if you want them publicly available.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g0/1.20&#xA;  ip nat inside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Same as before, this setups your internal interface as an inside NAT interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# ip nat inside source static 172.16.2.(2-6) 128.66.1.(2-6)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A new line for each static assignment is needed.  This creates a static translation between your internal IP and your external IP that was assigned to you.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As for your switch; all you would need to do is properly tag your ports depending on what is plugged in and make sure your trunk is passing both VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point both subnets should hitting your router, and your router should know where to pass the traffic, be it internally (your workstations getting to your servers) or externally (internet).  Access control can either be setup with ACLs on the router, a stand-alone firewall, or firewalls on your servers.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now this all hinges on how your ISP has your modem setup.  If it works the way I think it works, when your external interface pulls it's information through DHCP, your router should populate both your public IP ranges so that when your router NATs it knows where to send your traffic.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I suspect someone will give a better written answer, but hopefully this points you in the correct direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also referenced the following link for help on the NAT parts as they are definitely not something I play with very often.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13772-12.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13772-12.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13998" LastActivityDate="2015-02-21T04:14:43.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16822" PostTypeId="2" ParentId="16777" CreationDate="2015-02-21T12:45:54.577" Score="6" Body="&lt;p&gt;I'd say it looks normal. But I think you're doing this a bit wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping has one function only: probing, i.e. &quot;Hello, are you there&quot; - &quot;Hello, yes I am here&quot;. While it shows you the latency between two hosts, it is &lt;em&gt;not&lt;/em&gt; a network performance tool.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your &quot;empty&quot; network is never silent. When you connect two network devices together - any devices - they will start exchanging all kinds of information immediately; availability, capabilities, link status etc. This is (like ICMP) network management traffic, and handled by the CPU. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The primary function of any network device is traffic forwarding. When the first packet of a discussion comes, a Layer 2 switch will first check the MAC/ARP tables to see if the port leading to the destination is known. If not, it will ARP the network to learn the destination port. Once it is known, the traffic forwarding is delegated to the forwarding engine. CPU will not touch packets in that discussion, but it will still keep communicating with the other network devices. L3 forwarding (i.e routing) is often done entirely by the CPU. This depends on the device, some routing switches are capable of hardrware packet forwarding similar to L2 switching. This is known as &quot;route once / switch many&quot; or &quot;&lt;a href=&quot;http://en.wikipedia.org/wiki/Multilayer_switch&quot; rel=&quot;noreferrer&quot;&gt;Multilayer switching&lt;/a&gt;&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network devices are configured to maintain the primary functionality of the network. All mgmt traffic it's given secondary priority, and ICMP ping has the lowest of low priorities. This is - as far as I know - true for all devices. Allowing ICMP a higher priority would open door for DOS attacks such as &lt;a href=&quot;http://en.wikipedia.org/wiki/Ping_of_death&quot; rel=&quot;noreferrer&quot;&gt;Ping of Death&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Ping_flood&quot; rel=&quot;noreferrer&quot;&gt;Ping Flood&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence tests 2 and 3 are irrelevant. Devices are responding, which shows traffic is flowing correctly. The devices will not sacrifice CPU cycles for ping, they will respond only when (or if!) they have time. Once the network gets more traffic, you can expect higher variation on network device ping responses. It's still expected behavior, their latency has no relation whatsoever to network performance. Host-to-host response times should be less affected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tests 1 and 4 are more sensible; but they aren't a valid comparison between L2 and L3 forwarding performance. In test 1 you're pinging a &quot;resource&quot;, in test 4 you're pinging a server - i.e. not the same device. While the network may be playing part, the latency depends on the recipient. What's above applies also to any computer; a NIC is a network device and ICMP is handled by CPU... maybe your server is taking it's own sweet time responding. When you're pinging to a different subnet you're bringing in yet another potential source of latency - the default gateways.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to test the forwarding capability of your network, you need to do it differently. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Download &lt;a href=&quot;https://iperf.fr/&quot; rel=&quot;noreferrer&quot;&gt;iperf&lt;/a&gt;. This is a simple, but very powerful network performance tool. Start with default TCP testing. You can change the parameters, run UDP test etc. afterwards for more specified testing.&lt;/li&gt;&#xA;&lt;li&gt;Use the same two devices in all testing to exclude host-based differences&lt;/li&gt;&#xA;&lt;li&gt;Where to connect depends on what exactly is tested - cabling, patch panels etc. are also potential sources of latency&lt;/li&gt;&#xA;&lt;li&gt;I would use static IPs in all testing; I don't want my test devices do anything I do not specifically instruct them to do including renewing the IP&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.numion.com/faq/ping.html&quot; rel=&quot;noreferrer&quot;&gt;The Ping Fallacy&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10799" LastEditorUserId="10799" LastEditDate="2015-02-21T14:10:29.613" LastActivityDate="2015-02-21T14:10:29.613" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16823" PostTypeId="1" CreationDate="2015-02-21T12:50:28.870" Score="3" ViewCount="40006" Body="&lt;p&gt;If you can't ping an ip address since you are not resolving a canonical name this has nothing to do with dns and only has to do with the inability to reach that machine (routing) right?&lt;/p&gt;&#xA;" OwnerUserId="14004" LastEditorUserId="775" LastEditDate="2015-02-21T13:07:03.507" LastActivityDate="2019-04-29T14:37:16.327" Title="If you can't ping an ip address this means nothing in regards to dns right?" Tags="|ping|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16824" PostTypeId="2" ParentId="16823" CreationDate="2015-02-21T12:57:09.953" Score="4" Body="&lt;p&gt;Correct. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;DNS is a service which resolves a name to an IP address. If you are not pinging a name, you aren't using DNS.&lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2015-02-21T12:57:09.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16825" PostTypeId="2" ParentId="16823" CreationDate="2015-02-21T13:51:21.487" Score="6" Body="&lt;p&gt;You are correct in that if you ping an IP address you are not using DNS.  If you are using a hostname instead of an IP address with &lt;code&gt;ping&lt;/code&gt;, then you will be using DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, just because you are using &lt;code&gt;ping&lt;/code&gt; with an IP address, even if you don't get a response this does not necessarily mean there is a routing problem.  Many hosts are configured to rate limit ICMP echo requests (i.e. ping) or to ignore them entirely.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2019-04-29T14:37:16.327" LastActivityDate="2019-04-29T14:37:16.327" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16826" PostTypeId="2" ParentId="16808" CreationDate="2015-02-21T17:02:54.577" Score="8" Body="&lt;p&gt;Switches without MLD or IGMP snooping will treat multicast and broadcast (if there were broadcast in IPv6) the same -- namely, they would flood the packets out all ports.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the second half of your statement, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;and therefore negate the benefits of multicast&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;doesn't follow.  The advantages of multicast are not for the switch.  They are for the end hosts.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;End hosts can process multicast more efficiently than broadcast packets.  The network interface card (NIC) on most hosts can be set to accept specific multicast addresses and reject all others, just as they do with unicast packets.  So unwanted multicast traffic is ignored by the NIC as well as unwanted unicast traffic.  But when the host receives a broadcast packet, it must accept it and send it to the CPU to process, even if it is not important to this host.  In a network with lots of broadcast traffic, hosts are continually interrupted to process the broadcasts, even though they care about very few of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast solves this problem by &quot;delegating&quot; the task of selecting important packets to the NIC hardware.  Only packets directly addressed to the host are sent to the CPU for processing.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-02-21T17:02:54.577" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16827" PostTypeId="1" CreationDate="2015-02-21T18:49:57.883" Score="7" ViewCount="10209" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/fozGi.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a small query with respect to NATing in Fortigate.I'm struck in particular by a scenario where the remote network allows users with a specific IP range with a specific port for RDP over a different set of physical links. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;User(192.168.60.0/24) in LAN should connect to 10.48.1.3 on remote network which is connected to Internal ports on Fortigate (Nor WAN since it is used for internet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link between Remote network firewall &amp;amp; Fortigate has been established (10.189.254.17-10.189.254.18). I can ping remote firewall interace 10.189.254.17.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Admin wants us to access 10.48.1.3 over 3389 port via 10.189.1.8-10.189.1.15 (allowed IPs on remote firewall).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically, user (ex:Source: 192.168.60.15 need to access Destination 10.48.1.4 via allowed IPs (10.189.1.8-10.189.1.15) over physical link between Fortigate &amp;amp; remote firewall (10.189.254.18-18.189.254.17).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried VIP (Static NAT) (Source NAT) port forwarding, IP Pool (Destination NAT), but no help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please advice how to proceed. It is a typical scenario , can we achieve it?&lt;/p&gt;&#xA;" OwnerUserId="8498" LastEditorUserId="453" LastEditDate="2018-08-06T07:14:04.650" LastActivityDate="2020-08-07T11:34:27.253" Title="Source NATing Fortigate typical scenario" Tags="|nat|fortigate|fortinet|snat|dnat|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="16831" PostTypeId="2" ParentId="16827" CreationDate="2015-02-21T22:45:39.703" Score="1" Body="&lt;p&gt;Under your Policy Rule to allow access from 192.168.60.15 to 10.48.1.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply select NAT then create a Pool and put IP range of 10.189.1.8-10.189.1.15.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Key thing for this to work is you have route on your fortigate pointing 10.48.1.4 to 10.189.254.17 and finally 10.189.254.17 knows 10.189.1.8-10.189.1.15 lives back via 10.189.254.18.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thats a pretty standard rule and sounds achievable. Some packet captures may help you to debug the issue.&lt;/p&gt;&#xA;" OwnerUserId="13993" LastActivityDate="2015-02-21T22:45:39.703" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16832" PostTypeId="1" CreationDate="2015-02-22T00:35:40.730" Score="1" ViewCount="392" Body="&lt;p&gt;Rephrasing: I want to know if Router A need to be set by a network administrator of Stub Network... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I meant about the IP configuration.. Router A belongs a stub network? In this case the IP configuration for Router A, Who do? Administrator of Stub Network or ISP ( If Router A not belongs a Stub)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7wphw.gif&quot; alt=&quot;Stub Network&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="14008" LastEditDate="2015-02-22T13:58:38.033" LastActivityDate="2015-02-22T21:46:56.203" Title="Question about Stub Network?" Tags="|routing|router|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="16833" PostTypeId="2" ParentId="16812" CreationDate="2015-02-22T02:42:23.320" Score="2" Body="&lt;p&gt;You can check if DHCP snooping is enabled, you can try disable DHCP snooping or add your uplink port to trusted DHCP source.&lt;/p&gt;&#xA;" OwnerUserId="5262" LastActivityDate="2015-02-22T02:42:23.320" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16836" PostTypeId="2" ParentId="16832" CreationDate="2015-02-22T16:38:16.497" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Who will configure the IP in Router A? Me or a ISP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is a very basic notion here.  The person that owns a thing has responsibility for its configuration.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If you own Router A, then you configure it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If your ISP owns Router A, then the ISP configures it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I can't imagine a IT world which operates otherwise and actually works reliably.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Stub Network&quot; is a network accessed by a single router! &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Incidentally, the network behind Router B is not commonly called a &quot;stub network&quot; in English.  It's just called &quot;my company's network&quot; or &quot;the network behind Router B&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you say &quot;stub&quot;, that carries a loaded meaning to network professionals, particularly since OSPF has &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7477/how-ospf-decides-a-network-to-be-a-stub-network&quot;&gt;stub networks&lt;/a&gt;; so does &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/eigrpstb.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;EIGRP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-02-22T21:46:56.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16837" PostTypeId="2" ParentId="12973" CreationDate="2015-02-22T18:23:25.480" Score="3" Body="&lt;p&gt;I think it can be done in this way.&#xA;First select the traffic to mark:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw0(config)# ip access-list extended acl1&#xA;&#xA;sw0(conf-ipacl-ext)# permit ip any any vlan 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then link the ACL with a class-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw0(config)# class-map class1&#xA;&#xA;sw0(config-classmap)# match access-group acl1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then assign the CoS value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw0(config)# policy-map policy1&#xA;&#xA;sw0(config-policymap)# class class1&#xA;&#xA;sw0(config-policymap-class)# set cos 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As a last step apply the ACL to an RBridge:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw0(config)# qos service-policy in policy1&#xA;&#xA;sw0(config-service-policy-in/policy1)# attach rbridge-id add 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14016" LastEditorUserId="509" LastEditDate="2015-02-22T21:49:56.460" LastActivityDate="2015-02-22T21:49:56.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16841" PostTypeId="2" ParentId="9763" CreationDate="2015-02-22T21:49:54.250" Score="0" Body="&lt;p&gt;There is a pretty simple method for doing this and it sounds like you already have most of the equipment already in place. You can also add bandwidth saving features like caching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Squid really is the best option out there. I found a &lt;a href=&quot;https://supportforums.cisco.com/discussion/11072536/redirect-http-and-https-traffic-asa-5520-squid&quot; rel=&quot;nofollow&quot; title=&quot;External CISCO Website&quot;&gt;CISCO community forums post&lt;/a&gt; describing how to set up a route on your firewall and configure it to point to a Squid server correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using, Squid3(beta) or Squid2(stable), in transparent proxy mode you can force all client traffic that has to go through your firewall to squid and use Dansguardian(web content filter) to stop them from going to Facebook including with their phones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend using FreeBSD or any flavor of BSD really. It is extremely optomized for tasks such as routing and the like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have transparency mode established properly you can turn on Squid's best feature: static HTTP content caching (HTTPS caching with Squid3). You can configure Squid to cache things like: images, videos, HTML files, CSS files, etc. Saves you bandwidth and reduces network chatter. You can even cache Windows updates for the whole network. Download on the initial machine and all the others are directed the the cache.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To achieve this more easily there is a networking OS called &lt;a href=&quot;https://www.pfsense.org/&quot; rel=&quot;nofollow&quot; title=&quot;pfSense external website&quot;&gt;pfSense&lt;/a&gt;(which uses FreeBSD) that has all of this stuff in an integrated GUI. Allows you to easily install Squid2 or 3) and configure it as your network's perimeter firewall. It comes with many automatic security features like CISCO products.&lt;/p&gt;&#xA;" OwnerUserId="14018" LastActivityDate="2015-02-22T21:49:54.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16842" PostTypeId="1" AcceptedAnswerId="16847" CreationDate="2015-02-23T02:18:40.817" Score="3" ViewCount="358" Body="&lt;p&gt;Do there exist any routing protocols which take link capacities and loads into account?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To illustrate the question, suppose there are are multiple paths between a source host A and a destination host B. OSPF will load-balance on a flow-by-flow basis if the paths are of equal cost, but if the links are of non-equal cost, OSPF will only load the lower cost link. More to the point, even in the equal-cost path case, OSPF does not take link loads from other source-destination pairs into account and so may still choose a (badly) sub-optimal assignment of flows to paths. We see that OSPF does not consider link capacity and load but only a static &quot;cost&quot;.&lt;/p&gt;&#xA;" OwnerUserId="13935" LastActivityDate="2015-02-23T13:39:14.700" Title="Do any routing protocols take link capacity into account?" Tags="|routing|ospf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16843" PostTypeId="2" ParentId="16842" CreationDate="2015-02-23T03:10:02.807" Score="2" Body="&lt;p&gt;EIGRP uses the load indicated by IOS as part of its calculations. EIGRP can also load-balance relatively appropriately on unequal cost paths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/enhanced-interior-gateway-routing-protocol-eigrp/whitepaper_C11-720525.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/enhanced-interior-gateway-routing-protocol-eigrp/whitepaper_C11-720525.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-02-23T03:10:02.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16845" PostTypeId="1" CreationDate="2015-02-23T06:20:37.503" Score="1" ViewCount="383" Body="&lt;p&gt;I need to configure a cisco router where 5mb will be split between 2 separate networks one for voice 1mb and one for data 4mb with voice being the main priority. The only way i can think of doing it would be by using ACL's but i dont quite know how to go about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Diagram&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                  |&#xA;                  |     &amp;lt;---  5mbs coming into cisco router&#xA;                  |&#xA;                _____&#xA;              [router]&#xA;&#xA;              |      |&#xA;voice 1Mbs    |      |   10.2.2.0&#xA;10.1.1.0      |      |   data 4Mbs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14022" LastEditorUserId="775" LastEditDate="2015-02-23T08:25:28.930" LastActivityDate="2015-03-25T15:27:40.820" Title="Networking, dedicating bandwidth to specific networks" Tags="|cisco|router|bandwidth|access-control|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16847" PostTypeId="2" ParentId="16842" CreationDate="2015-02-23T09:50:30.477" Score="9" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Do there exist any routing protocols which take link capacities and loads into account?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;There are two ways to handle the issues you describe:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;MPLS TE w/ RSVP (complicated)&lt;/li&gt;&#xA;&lt;li&gt;EIGRP (easier, but isn't so good out of the box)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;MPLS TE w/ RSVP&lt;/strong&gt;&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/RSVP-TE&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS Traffic Engineering&lt;/a&gt; is not quite a routing protocol, but it adds the capability for OSPF or ISIS to calculate costs based on offered load using IGP extensions that are specific to MPLS-TE (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3630&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSPF Opaque LSAs&lt;/a&gt; or &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5305&quot; rel=&quot;nofollow noreferrer&quot;&gt;ISIS Sub-TLVs&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;There are two normal ways of adjusting traffic based on the offered load along  MPLS TE paths:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One is via what Cisco and Juniper call &amp;quot;automatic bandwidth adjustment&amp;quot; (&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/mp_te_path_setup/configuration/xe-3s/mp-te-path-setup-xe-3s-book/mp-te-auto-bandwdth.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco doc&lt;/a&gt; / &lt;a href=&quot;https://www.juniper.net/documentation/en_US/junos12.2/topics/usage-guidelines/mpls-configuring-automatic-bandwidth-allocation-for-lsps.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Juniper doc&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;You can also use offline calculations for traffic optimization, and push policies to your MPLS TE nodes.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/mpls/13731-mpls-te-ospf.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS TE w/ RSVP&lt;/a&gt; reserves bandwidth along an entire path, and then each MPLS TE router can be configured to periodically announce updates and even enforce those bandwidth limits per-hop; &lt;a href=&quot;https://www.nanog.org/meetings/nanog37/presentations/pete-templin.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pete Templin's NANOG presentation&lt;/a&gt; has a pretty good overview of how this works.   Some people say that Cisco doesn't enforce MPLS TE bandwidth constraints along the path; however, that's actually only part of the story.  If you use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2s/feature/guide/fsdserv3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Diffserv-aware TE (DS-TE)&lt;/a&gt;, you can enforce bandwidth limits on tunnels (subject to platform / IOS support).&lt;/p&gt;&#xA;&lt;p&gt;Closing note: your question described link loading problems, which MPLS TE certainly can handle; however, MPLS TE is more of a path-management framework.  MPLS TE is meant to manage multiple paths between routers... with each path being more than one link.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;EIGRP&lt;/strong&gt;&lt;/em&gt;:&lt;/p&gt;&#xA;&lt;p&gt;Certainly EIGRP has the capability to adjust IGP costs based on the offered load; however, this capability is disabled by default in EIGRP (for good reason).  The command to enable it is &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_eigrp/configuration/12-4/ire-12-4-book/Configuring_EIGRP.html#GUID-86D573E5-F921-45E2-8062-C2EDEAFC7656&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;metric weights&lt;/code&gt;&lt;/a&gt;, which uses this formula.  The &lt;code&gt;K2&lt;/code&gt; parameter defaults to 0; when it's non-zero it will take Cisco's interface &amp;quot;load-average&amp;quot; parameter into consideration.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;EIGRP Metric = 256*((K1*Bw) + (K2*Bw)/(256-Load) + (K3*Delay) + (K5/(Reliability + K4)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However, EIGRP &lt;em&gt;won't&lt;/em&gt; send updates merely because the load-interval changes, it will only send an update &lt;a href=&quot;https://learningnetwork.cisco.com/message/77820#77820&quot; rel=&quot;nofollow noreferrer&quot;&gt;when there is another topology change&lt;/a&gt;.  The end result is that until there is a topology change, the local router will make decisions based on load; however, other routers won't be aware of those decisions until EIGRP is forced to send updates.  Practically, this EIGRP load-average feature can solve some point problems, but isn't as helpful as MPLS TE in my opinion.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-02-23T13:39:14.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16848" PostTypeId="2" ParentId="2532" CreationDate="2015-02-23T14:48:27.320" Score="3" Body="&lt;p&gt;For prefix assignment using SLAAC (RFC 4862), the lifetimes are fully governed by the description in section &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4862#section-5.5.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;5.5.3. Router Advertisement Processing&lt;/a&gt;. To simplify:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If the prefix is not yet used, you can use it with the preferred and valid lifetimes that are signaled, no restrictions.&lt;/li&gt;&#xA;&lt;li&gt;If the prefix is already used, update the preferred lifetime with the signaled value, no restrictions. For the valid lifetime the signaled valid lifetime (&lt;code&gt;signaled&lt;/code&gt;) must be compared to the current remaining valid lifetime (&lt;code&gt;remaining&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;li&gt;If &lt;code&gt;remaining&amp;lt;signaled&lt;/code&gt;: just update it, no restrictions.&lt;/li&gt;&#xA;&lt;li&gt;If &lt;code&gt;signaled&amp;lt;remaining&lt;/code&gt;: Beware, this could be a DOS attack, only update this if &lt;code&gt;signaled &amp;gt; 2h&lt;/code&gt; (or the source is authenticated). 2h should be enough time to allow a valid RA with correct timers to appear.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;So in short, when it comes to deprecation you can make sure that a SLAAC address is no longer used for new connections (set preferred lifetime to 0) but you cannot kill ongoing sessions as long as the valid lifetime is running. Of course various implementations might provide administrative interfaces to forcefully remove an address, but that's outside of RFC scope.&lt;/p&gt;&#xA;&lt;p&gt;As far as the RFC goes, you can put the preferred lifetime to anything, though &lt;code&gt;0&lt;/code&gt; does not make sense. The valid lifetime cannot be &lt;code&gt;0&lt;/code&gt; except when deprecating. Preferred must always be bigger than valid. So what time you put it is your own choice and depends on your use case.&lt;/p&gt;&#xA;&lt;p&gt;What RFC 4862 states about prefix lifetimes has nothing to do with SLAAC, this is pure about how long on-link prefixes are valid to perform neighbor discovery.&lt;/p&gt;&#xA;" OwnerUserId="2062" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-02-23T14:48:27.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16849" PostTypeId="2" ParentId="16845" CreationDate="2015-02-23T15:22:28.810" Score="2" Body="&lt;p&gt;There are lots of ways to use Cisco routers with advanced routing features that can do what you are looking to do. They all fall under &quot;Quality of Service,&quot; or QoS for short. Cisco routers can regulate bandwidth in many many ways, such as marking, prioritization, queueing, bandwidth shaping, and traffic engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you want to make sure that voice traffic sounds great and gets prioritized over other types of IP traffic. This is one of the most common uses for QoS, and there are quite a number of documents and case studies on the Cisco website. You might want to look into the Cisco website for something called &quot;low-latency queuing&quot;, or LLQ. This basically means that the traffic will be put into a queue that guarantees that it won't be waiting long to be sent out on the wire, no matter whether there is other traffic on the wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a good article that shows how to troubleshoot voice quality issues, and I especially like the way they explain how to mark traffic to be treated as priority, not only in your own network, but also further up the line. You can engineer your network to be the best for voice quality, but you also want upstream networks to honor that marking as well. Here's the link: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/voice/voice-quality/20371-troubleshoot-qos-voice.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/voice/voice-quality/20371-troubleshoot-qos-voice.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="4887" LastActivityDate="2015-02-23T15:22:28.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16850" PostTypeId="2" ParentId="16823" CreationDate="2015-02-23T15:29:50.927" Score="0" Body="&lt;p&gt;&quot;PING&quot; on a Windows 7/8 machine will attempt to perform a &quot;Reverse DNS&quot; lookup on the IP address before attempting a PING. It's reverse DNS because you are doing the reverse of what DNS natively does, i.e. resolve a name to an IP address. But that is just a feature to help identify what you're pinging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PING still uses the IP address to formulate its echo request. The inability to perform the reverse DNS does not preclude the ICMP echo request to be sent, nor does it prevent the echo reply to come back if there is one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="4887" LastActivityDate="2015-02-23T15:29:50.927" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16858" PostTypeId="2" ParentId="16420" CreationDate="2015-02-23T20:00:57.257" Score="3" Body="&lt;ul&gt;&#xA;&lt;li&gt;find the vlan number as you discussed. &lt;/li&gt;&#xA;&lt;li&gt;after you find the vlan number, you can find the association between Port's dot1dBasePortIfIndex number and VLAN number by using 1.3.6.1.4.1.2636.3.40.1.5.1.7.1.3 (jnxExVlanPortStatus)&lt;/li&gt;&#xA;&lt;li&gt;translate between dot1dBasePortIfIndex and IfIndex using 1.3.6.1.2.1.17.1.4.1.1 (dot1dBase)&lt;/li&gt;&#xA;&lt;li&gt;translate between IfIndex and Interface name as you discussed using 1.3.6.1.2.1.2.2.1.2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My version of snmpwalk has very different command structure, but hopefully this helps.&lt;/p&gt;&#xA;" OwnerUserId="14032" LastActivityDate="2015-02-23T20:00:57.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16859" PostTypeId="2" ParentId="7989" CreationDate="2015-02-23T21:06:10.407" Score="1" Body="&lt;p&gt;If you want to get information about interface IPs from switches/ routers in a format similar to a host file you may use my bash script. I wanted to have actual information about all IP addresses of network devices in our network. All devices are reachable through SNMP. I was not able to find a tool or script that can do it so I decided to write it myself. Output can be simple add to the host file. Interface description or a prefix is written as a comment so it will be shown for example in traceroute output while you can search the host file for interface description.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output is in this format:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A.B.C.D          Device_hostname-Interface_name  #/Prefix    #Interface description&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.1.1.1 router_R01-Gi1/0/2          #28 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.5.1.22    Beijing-router01-WAN-Tu611  #24         # Port to internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.24.254   firewall2-eth5  #24 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The script is available from &lt;a href=&quot;http://network-linux.webnode.cz/news/bash-script-for-gathering-ip-addresses-of-interfaces-through-snmp&quot; rel=&quot;nofollow&quot;&gt;http://network-linux.webnode.cz/news/bash-script-for-gathering-ip-addresses-of-interfaces-through-snmp&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14033" LastEditorUserId="14033" LastEditDate="2015-02-23T21:14:11.993" LastActivityDate="2015-02-23T21:14:11.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16860" PostTypeId="1" AcceptedAnswerId="16887" CreationDate="2015-02-23T23:28:24.163" Score="3" ViewCount="12490" Body="&lt;p&gt;I cannot figure out how to establish a telnet connection between two routers in Cisco Packet Tracer. This is a relatively simple process, I know, but I have been back and forth looking for how to fix this issue. At first, I thought I created the ip addresses with a subnet that was too small, but after increasing the size of the subnet from 255.255.255.252 to a standard class C subnet, I've realized that wasn't the problem. I will post the information that is related to this issue to simply your ability to help me. Please help me to understand what I am doing wrong. I will look at resources you post, but please be aware that I've been looking at resources on google for 2 weeks now. There are no users configured for the routers, because I figured that if I can't get the connection to even establish, then logging in is another problem I can deal with after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I telnet from router one with &quot;telnet 172.16.3.1&quot;, I continue to recieve that the connection timed out and that the remote host isn't responding. It is the same from router2 to 172.16.1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to set a line to connection from one console port to another or what? I am lost on what to do next. I appreciate all help. I need to do this so I can change the motd remotely. It's a demonstration I am doing for class, and the teacher refuses to help. Please and thank you. I'll update any additional information you feel is necessary to help me.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1#&#xA;fa0/0 172.16.2.1 255.255.255.0&#xA;s2/0 172.16.1.1 255.255.255.0&#xA;&#xA;Router2#&#xA;fa0/0 172.16.4.1 255.255.255.0&#xA;s2/0 172.16.3.1 255.255.255.0&#xA;&#xA;vty 0 4&#xA;! for both routers&#xA; password password&#xA; login local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14036" LastEditorUserId="775" LastEditDate="2015-02-24T00:40:02.563" LastActivityDate="2015-02-24T17:13:44.310" Title="Cisco router telnet troubleshooting - connection timeout; unresponsive host" Tags="|cisco|troubleshooting|packet-tracer|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16861" PostTypeId="1" CreationDate="2015-02-23T23:47:04.467" Score="2" ViewCount="217" Body="&lt;p&gt;I am confused about SFP transceiver choice, and compatibility with single mode fiber based on the fiber's &lt;a href=&quot;https://learningnetwork.cisco.com/docs/DOC-3791&quot; rel=&quot;nofollow&quot;&gt;OS rating&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My only question is, when choosing an SFP is it necessary to consider the OS rating of a single mode fiber? Or is it enough to know the cable length?&lt;/p&gt;&#xA;" OwnerUserId="13817" LastEditorUserId="775" LastEditDate="2015-02-24T00:49:40.823" LastActivityDate="2015-02-24T00:53:13.783" Title="SFP GBIC and OS rating" Tags="|cabling|fiber|sfp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16863" PostTypeId="2" ParentId="16860" CreationDate="2015-02-23T23:54:33.957" Score="1" Body="&lt;p&gt;Your routers on the f0/0 network are not in the same subnet.  Router 2 should be 172.16.2.2 255.255.255.0  They can only communicate with each other if they have a shared subnet.  I'm also assuming that the ethernet network is the one you're using to connect them.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2015-02-23T23:54:33.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16865" PostTypeId="2" ParentId="16861" CreationDate="2015-02-24T00:47:12.367" Score="3" Body="&lt;p&gt;The OS rating of single mode fiber should have no bearing on your choice of transceivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both OS1 and OS2 will work with the most popular single mode transceivers (most of which use wavelengths around 1310nm and 1550nm).  This includes 1000Base-LX/LX10/EX/LH/ZX and it is the transceiver which larger determines the distance the signal will propagate, not the fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main difference in OS1 and OS2 is the construction of the cable, although OS2 &lt;em&gt;may&lt;/em&gt; specify cable with a lower attenuation specification (depending on when and under which standards it was manufactured).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-02-24T00:47:12.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16866" PostTypeId="2" ParentId="16861" CreationDate="2015-02-24T00:53:13.783" Score="2" Body="&lt;p&gt;In short, no - it doesn't matter.  What matters is your distance requirements (as you stated).  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Choose optic based on distance requirements - &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/transceiver-modules/data_sheet_c78-455693.html&quot; rel=&quot;nofollow&quot;&gt;See here&lt;/a&gt;. (Doesn't have to be Cisco obviously, but the optical standards are the same.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Choose fiber based on optic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And, other than that, it's really this simple:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using SR optics?  Use multimode fiber (50 or 62.5 micron).  See &lt;a href=&quot;http://en.wikipedia.org/wiki/Multi-mode_optical_fiber#Comparison&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Using LR/ER optics?  Use singlemode fiber (9 micron).  See &lt;a href=&quot;http://en.wikipedia.org/wiki/Single-mode_optical_fiber&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-02-24T00:53:13.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16867" PostTypeId="1" AcceptedAnswerId="16868" CreationDate="2015-02-24T03:09:02.070" Score="2" ViewCount="1931" Body="&lt;p&gt;I have always used a &quot;dumb&quot; (unmanaged) switch as the entry point and distribution to my LAN network.  ISP's copper goes into the switch and about six or 8 other connections come out of the switch to various devices (&quot;main&quot; firewall, a few other firewalls/routers protecting different networks, a &quot;public&quot; wireless network, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever I see a network schema for a network similar to mine, it typically shows a router at the edge of the network as opposed to a switch like I'm using.  Is a switch poor form?  Why would I need a router?  Are there any other alternatives to distributing my WAN connection?&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2015-02-24T04:54:02.673" Title="Router vs. switch between ISP and firewall" Tags="|switch|router|design|architecture|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16868" PostTypeId="2" ParentId="16867" CreationDate="2015-02-24T04:54:02.673" Score="1" Body="&lt;p&gt;In your case, you don't need a router.  The most common reason for having one is to convert from one kind of network media to another.  Your ISP may use DOCSIS (cable), DSL, T1, or something else to connect you to the Internet, while your internal media is Ethernet.  In your particular case, since your ISP provides an Ethernet handoff, you don't need a router.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-02-24T04:54:02.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16871" PostTypeId="2" ParentId="636" CreationDate="2015-02-24T07:43:42.950" Score="2" Body="&lt;p&gt;BFD is a feature that was invented to detect L2 connectivity issue when there is some intermediary device in between two peers.&#xA;So BFD is a failure detection feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically we need BFD if we have 2 routers interconnected via L2 switch 9or any other L2 cloud). In this case if single router goes down, link state won't be reflected on another router, as switch would keep the link up.&#xA;If it were just P2P link (single cable) between the routers, interface would go down right on peer's failure and IGP would reconverge in sub-second interval.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the reasson not to use BFDs are:&#xA; - BFD is not supported on the box[es];&#xA; - BFD is not needed, as you have no intermediate device (use udld and carrier-delay instead).&lt;/p&gt;&#xA;" OwnerUserId="14040" LastActivityDate="2015-02-24T07:43:42.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16872" PostTypeId="1" AcceptedAnswerId="16899" CreationDate="2015-02-24T08:33:56.687" Score="2" ViewCount="2027" Body="&lt;p&gt;I'm new into networking and I have a problem setting up ASA 5512 firewall. The problem is that I can't setup internet connection inside my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've created two interfaces WAN with the public IP address (security level 0), and LAN with the ip of 192.168.35.4, security level 100. Actually, we are replacing the old router, and this one should take his address. I've added static route 0\0 to my default gateway, and I'm able to ping Google DNS server from the router, but can't from network computer. The network switch is also present on 192.168.35.254.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the testing purpose I've changed WAN IP address to 192.168.99.1, and attached computer to it with IP 192.168.99.2, and when I try to ping it from the LAN interface, it does not return ping. I've also allowed ICMP inspection and created LAN to WAN NAT rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate any help.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Result of the command: &quot;show runn&quot;&#xA;&#xA;: Saved&#xA;:&#xA;ASA Version 9.1(2) &#xA;!&#xA;hostname ciscoasa&#xA;enable password 0EnLStscpb84AAdM encrypted&#xA;names&#xA;!&#xA;interface GigabitEthernet0/0&#xA; nameif WAN&#xA; security-level 0&#xA; ip address 192.168.99.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif LAN&#xA; security-level 100&#xA; ip address 192.168.35.6 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/2&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA; !&#xA; interface GigabitEthernet0/3&#xA; nameif LanTest&#xA; security-level 0&#xA; ip address 192.168.9.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/4&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/5&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management0/0&#xA; management-only&#xA; nameif Management&#xA; security-level 100&#xA; ip address 192.168.2.1 255.255.255.0 &#xA;!&#xA;boot system disk0:/asa912-smp-k8.bin&#xA;ftp mode passive&#xA;clock timezone CEST 1&#xA;clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;dns domain-lookup WAN&#xA;dns domain-lookup LAN&#xA;dns server-group DefaultDNS&#xA; name-server 208.67.222.222&#xA; name-server 208.67.220.220&#xA; name-server 8.8.8.8&#xA; name-server 8.8.4.4&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network Bruce&#xA; host 192.168.35.203&#xA;object network Buzz&#xA; host 192.168.35.202&#xA;object network Exchange&#xA; host 192.168.35.205&#xA;object network Fiona&#xA; host 192.168.35.25&#xA;object network Mirror2&#xA; host 192.168.35.24&#xA;object network Remy&#xA; host 192.168.35.147&#xA;object network VOIP-Phone&#xA; host 192.168.35.152&#xA;object service 81&#xA; service tcp source eq 81 destination eq 81 &#xA;object service Fax-TCP&#xA; service tcp source eq 5061 destination eq 5061 &#xA;object service Fax-UDP&#xA; service udp source eq 5061 destination eq 5061 &#xA;object service Phone1&#xA; service tcp source range sip 5090 destination range sip 5090 &#xA;object service Phone2&#xA; service udp source range sip 5090 destination range sip 5090 &#xA;object service Phone3&#xA; service udp source range 7000 7499 destination range 7000 7499 &#xA;object service Phone4&#xA; service udp source range 9000 9049 destination range 9000 9049 &#xA;object service Phone5&#xA; service udp source eq 10000 destination eq 10000 &#xA;object service SVN&#xA; service tcp source eq 3690 destination eq 3690 &#xA;object service Sipgate&#xA; service udp source eq sip destination eq sip &#xA;object service Telavox&#xA; service udp source eq sip destination eq sip &#xA;object service Voiptalk&#xA; service udp source eq sip destination eq sip &#xA;object network Dug&#xA; host 192.168.35.39&#xA;object network obj-0.0.0.0&#xA; subnet 0.0.0.0 0.0.0.0&#xA;access-list WAN_cryptomap extended permit ip 192.168.35.0 255.255.255.0 192.168.11.0             255.255.255.0 &#xA;access-list WAN_cryptomap_1 extended permit ip 192.168.35.0 255.255.255.0 192.168.135.0 255.255.255.0 &#xA;access-list WAN_cryptomap_4 extended permit ip 192.168.35.0 255.255.255.0 10.176.0.0 255.240.0.0 &#xA;access-list WAN_cryptomap_2 extended permit ip 192.168.35.0 255.255.255.0 192.168.13.0 255.255.255.0 &#xA;access-list WAN_access_in extended permit tcp any interface WAN eq pptp &#xA;access-list WAN_access_in extended permit object Telavox any interface WAN &#xA;access-list global_access extended permit object Phone1 object Dug any &#xA;access-list global_access extended permit object Phone2 object Dug any &#xA;access-list global_access extended permit object Phone3 any any &#xA;access-list global_access extended permit object Phone4 any any &#xA;access-list global_access extended permit object Phone5 any any &#xA;access-list global_access extended permit object Phone1 object VOIP-Phone any &#xA;access-list global_access extended permit object Phone2 object VOIP-Phone any &#xA;access-list global_access extended deny object Phone1 any any &#xA;access-list global_access extended deny object Phone2 any any &#xA;access-list global_access extended permit tcp object Exchange any eq smtp &#xA;access-list global_access extended permit tcp object Exchange any eq pop3 &#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu Management 1500&#xA;mtu WAN 1500&#xA;mtu LAN 1500&#xA;mtu LanTest 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;icmp permit any Management&#xA;icmp permit any LAN&#xA;asdm image disk0:/asdm-713.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;!&#xA;nat (LAN,WAN) after-auto source dynamic any interface&#xA;access-group WAN_access_in in interface WAN&#xA;access-group global_access global&#xA;route WAN 0.0.0.0 0.0.0.0 192.168.99.2 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication telnet console LOCAL &#xA;aaa authentication enable console LOCAL &#xA;aaa authorization command LOCAL &#xA;aaa authorization exec LOCAL&#xA;http server enable&#xA;http 192.168.1.0 255.255.255.0 Management&#xA;http 192.168.0.0 255.255.0.0 Management&#xA;http 192.168.0.0 255.255.0.0 LAN&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've done what JJBurgess suggested and here is the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Result of the command: &quot;packet-tracer input LAN tcp 192.168.45.2 80 192.168.99.2 80 detailed&quot;&#xA;&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: input&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   192.168.99.0    255.255.255.0   WAN&#xA;&#xA;Phase: 2&#xA;Type: ACCESS-LIST&#xA;Subtype: log&#xA;Result: ALLOW&#xA;Config:&#xA;access-group LAN_access_in in interface LAN&#xA;access-list LAN_access_in extended permit ip any any &#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x7fffa033ca70, priority=13, domain=permit, deny=false&#xA;    hits=1, user_data=0x7fff9b795140, cs_id=0x0, use_real_addr, flags=0x0, protocol=0&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;    input_ifc=LAN, output_ifc=any&#xA;&#xA;Phase: 3&#xA;Type: NAT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;nat (LAN,WAN) after-auto source dynamic any interface&#xA;Additional Information:&#xA;Dynamic translate 192.168.45.2/80 to 192.168.99.1/80&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x7fff9fdfa6a0, priority=6, domain=nat, deny=false&#xA;    hits=6, user_data=0x7fff9fb4e6a0, cs_id=0x0, flags=0x0, protocol=0&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;    input_ifc=LAN, output_ifc=WAN&#xA;&#xA;Phase: 4&#xA;Type: NAT&#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x7fff9eba4d20, priority=0, domain=nat-per-session, deny=false&#xA;    hits=19194, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;    input_ifc=any, output_ifc=any&#xA;&#xA;Phase: 5&#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x7fff9ff06120, priority=0, domain=inspect-ip-options, deny=true&#xA;    hits=7932, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;    input_ifc=LAN, output_ifc=any&#xA;&#xA;Phase: 6&#xA;Type: NAT&#xA;Subtype: rpf-check&#xA;Result: ALLOW&#xA;Config:&#xA;nat (LAN,WAN) after-auto source dynamic any interface&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; out id=0x7fff9f52e430, priority=6, domain=nat-reverse, deny=false&#xA;    hits=2, user_data=0x7fffa05f92b0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;    input_ifc=LAN, output_ifc=WAN&#xA;&#xA;Phase: 7&#xA;Type: NAT&#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Reverse Flow based lookup yields rule:&#xA; in  id=0x7fff9eba4d20, priority=0, domain=nat-per-session, deny=false&#xA;    hits=19196, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;    input_ifc=any, output_ifc=any&#xA;&#xA;Phase: 8&#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Reverse Flow based lookup yields rule:&#xA; in  id=0x7fff9e391890, priority=0, domain=inspect-ip-options, deny=true&#xA;    hits=16734, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;    input_ifc=WAN, output_ifc=any&#xA;&#xA;Phase: 9&#xA;Type: FLOW-CREATION&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;New flow created with id 17528, packet dispatched to next module&#xA;Module information for forward flow ...&#xA;snp_fp_tracer_drop&#xA;snp_fp_inspect_ip_options&#xA;snp_fp_tcp_normalizer&#xA;snp_fp_translate&#xA;snp_fp_adjacency&#xA;snp_fp_fragment&#xA;snp_ifc_stat&#xA;&#xA;Module information for reverse flow ...&#xA;snp_fp_tracer_drop&#xA;snp_fp_inspect_ip_options&#xA;snp_fp_translate&#xA;snp_fp_tcp_normalizer&#xA;snp_fp_adjacency&#xA;snp_fp_fragment&#xA;snp_ifc_stat&#xA;&#xA;Result:&#xA;input-interface: LAN&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: WAN&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: allow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14041" LastEditorUserId="775" LastEditDate="2015-02-25T14:13:51.627" LastActivityDate="2015-02-26T11:02:53.760" Title="Cisco ASA 5512 internet connection" Tags="|cisco|cisco-asa|firewall|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16873" PostTypeId="1" AcceptedAnswerId="16874" CreationDate="2015-02-24T09:16:52.253" Score="3" ViewCount="422" Body="&lt;p&gt;I'm a bit out of my depth with this one &amp;amp; am terrified of making any mistakes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have two Cisco routers, R1 &amp;amp; R2, configured with BGP. They both have their own internet connections, however R1 is the main (larger) connection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem is, R1 is routing out through R2 instead of its own internet connection.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router01#show bgp sum BGP router identifier 222.222.222.58, local AS&#xA;number 333333 BGP table version is 250008, main routing table version&#xA;250008 5 network entries using 740 bytes of memory 9 path entries&#xA;using 576 bytes of memory 3/2 BGP path/bestpath attribute entries&#xA;using 408 bytes of memory 1 BGP AS-PATH entries using 24 bytes of&#xA;memory 0 BGP route-map cache entries using 0 bytes of memory 0 BGP&#xA;filter-list cache entries using 0 bytes of memory BGP using 1748 total&#xA;bytes of memory Dampening enabled. 0 history paths, 0 dampened paths&#xA;BGP activity 125006/125001 prefixes, 125010/125001 paths, scan&#xA;interval 60 secs&#xA;&#xA;Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ&#xA;Up/Down  State/PfxRcd&#xA;111.111.203.253 4       333333    1440    1444   250008    0    0 21:43:39        5&#xA;222.222.222.57  4         9822       0       0        1    0    0 21:43:31 Idle (PfxCt)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm stumped and out of my depth. 0.0.0.0 should be routing out through its interface 222.222.222.58 -&gt; 222.222.222.57, but it's selecting 111.111.203.243 (R2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you please help me get my head around why? The config looks fine to me. But again, out of my depth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the relevant config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; description Primary Router Internet Link 20Mbit&#xA; ip address 222.222.222.58 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router bgp 333333&#xA; bgp log-neighbor-changes&#xA; bgp dampening&#xA; network 111.111.200.0 mask 255.255.255.0&#xA; network 111.111.201.0 mask 255.255.255.0&#xA; network 111.111.202.0 mask 255.255.255.0&#xA; network 111.111.203.0 mask 255.255.255.0&#xA; neighbor 111.111.203.253 remote-as 333333&#xA; neighbor 111.111.203.253 next-hop-self&#xA; neighbor 222.222.222.57 remote-as 9999&#xA; neighbor 222.222.222.57 version 4&#xA; neighbor 222.222.222.57 prefix-list announce out&#xA; neighbor 222.222.222.57 maximum-prefix 125000&#xA; neighbor 222.222.222.57 filter-list 1 in&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip as-path access-list 1 deny _7473_&#xA;ip as-path access-list 1 deny _4648_&#xA;ip as-path access-list 1 deny _4637_&#xA;ip as-path access-list 1 deny _1239_&#xA;ip as-path access-list 1 deny _2914_&#xA;ip as-path access-list 1 permit .*&#xA;!&#xA;ip route 111.111.200.0 255.255.255.0 111.111.203.1&#xA;ip route 111.111.201.0 255.255.255.0 111.111.203.1&#xA;ip route 111.111.202.0 255.255.255.0 111.111.203.1&#xA;!&#xA;ip access-list extended isp-in&#xA; remark DENY FRAGMENTS&#xA; deny   tcp any any fragments&#xA; deny   udp any any fragments&#xA; deny   icmp any any fragments&#xA; deny   ip any any fragments&#xA; remark DENY IP OPTIONS&#xA; deny   ip any any option any-options&#xA; remark BGP SESSION&#xA; permit tcp host 222.222.222.57 host 222.222.222.58 eq bgp&#xA; permit tcp host 222.222.222.57 eq bgp host 222.222.222.58&#xA; deny   ip any host 111.111.204.254&#xA; deny   ip any host 111.111.204.253&#xA; deny   ip any host 111.111.204.252&#xA; deny   ip any host 222.222.222.58&#xA; remark DEFAULT ALLOW&#xA; permit ip any any&#xA;!&#xA;!&#xA;ip prefix-list announce description ALLOWED ROUTING ANNOUNCEMENTS&#xA;ip prefix-list announce seq 10 permit 111.111.200.0/24&#xA;ip prefix-list announce seq 20 permit 111.111.201.0/24&#xA;ip prefix-list announce seq 30 permit 111.111.202.0/24&#xA;ip prefix-list announce seq 40 permit 111.111.203.0/24&#xA;ip prefix-list announce seq 50 deny 0.0.0.0/0 le 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14042" LastActivityDate="2015-02-27T17:10:24.883" Title="Cisco BGP Wrong Next Hop" Tags="|cisco|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16874" PostTypeId="2" ParentId="16873" CreationDate="2015-02-24T09:21:00.483" Score="5" Body="&lt;p&gt;Well, this node BGP session to ISP is down so you don't get any routes over 222.222.222.57 and that's why all the traffic goes to the other BGP neighbor:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;111.111.203.253 4       333333    1440    1444   250008    0    0 21:43:39        5&#xA;222.222.222.57  4         9822       0       0        1    0    0 21:43:31 Idle (PfxCt)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 'Idle (PfxCt)' status means this specific session exceeded maxium-prefix set and was reset. In your configuration you have 'neighbor 222.222.222.57 maximum-prefix 125000' which means the session was up for some time, then it exceeded 125k of prefixes and was reset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fix the limit and then we can check if the flow is correct from your point of view, once both sessions are up.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="286" LastEditDate="2015-02-24T19:19:58.117" LastActivityDate="2015-02-24T19:19:58.117" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16875" PostTypeId="1" AcceptedAnswerId="16876" CreationDate="2015-02-24T09:32:03.713" Score="2" ViewCount="3216" Body="&lt;p&gt;If a certain cable has a bandwidth of &lt;code&gt;10 mbps&lt;/code&gt;, that means in can contain 10 megabytes of data inside it at any given second. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, does this assume some standard length? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The analogy I've been given is that the cable transmitting data is like a pipe carrying water, and the bandwidth is like the amount of water the pipe can hold. However, longer pipes can hold more water.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do longer cables have more bandwidth?&lt;/p&gt;&#xA;" OwnerUserId="6026" LastEditorUserId="8499" LastEditDate="2018-03-21T00:27:35.320" LastActivityDate="2018-03-21T00:27:35.320" Title="Is the bandwidth of cable constrained by its length?" Tags="|layer1|bandwidth|cable|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16876" PostTypeId="2" ParentId="16875" CreationDate="2015-02-24T11:19:10.803" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If a certain cable has a bandwidth of 10 mbps, that means in can contain 10 megabytes of data inside it at any given second. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not at all, it means it can &lt;strong&gt;send&lt;/strong&gt; 10 mega&lt;strong&gt;bits&lt;/strong&gt; over the time period of one second.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;However, does this assume some standard length? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This depends on the technology, but most often: yes. For example, the popular 10base-T ethernet specification assumes a nominal maximum length of 100m. Longer than that your bandwidth will most likely drop (quickly to 0). Even with short enough cables other factors can diminish your throughput however, e.g. bad connectors.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The analogy I've been given is that the cable transmitting data is like a pipe carrying water, and the bandwidth is like the amount of water the pipe can hold. However, longer pipes can hold more water.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Decent analogy, completely wrong interpretation. It is not about how much water a pipe can hold, almost nobody really cares about that. It's about how much water you can get through at a given time. E.g. you don't care that your garden hose can hold a full swimming pool worth of water at once, you care how fast that hose can fill that swimming pool so you can take a fresh dive. In hydraulics terms, you care about discharge. This does not increase as a factor of length (rather decrease). It increases based on diameter and pressure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bandwidth is comparable to discharge in this analogy, so no it does increase with length (again, rather decrese), but mainly depends on other factors like modulation and interference levels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot say that an ethernet cable can hold data (bits) as a water pipe can hold water. Bits are modulated on an electromagnetic wave, which is only there for as long as that wave is traveling your cable (which is even an over-simplified statement). There is not a tap that you can shut so that all the bits currently in the cable stay there. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Do longer cables have more bandwidth?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No&lt;/p&gt;&#xA;" OwnerUserId="2062" LastEditorUserId="2062" LastEditDate="2015-02-24T12:11:37.653" LastActivityDate="2015-02-24T12:11:37.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16878" PostTypeId="1" CreationDate="2015-02-24T12:31:58.423" Score="4" ViewCount="2233" Body="&lt;p&gt;My network Figure is :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ik7bS.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this figure switch 3750 is my main switch and all of ACL and vlaning and DHCP server and... comands are in this switch.&#xA;I want set ARP inspection configs for security in my network.  Do I need to do it in the 3750 switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read cisco sources and most of them are for state that dhcp server is separated from switch (for this example 3750) and not useful for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I need to do to make Dynamic ARP Inspection work for this topology?&lt;/p&gt;&#xA;" OwnerUserId="3985" LastEditorUserId="775" LastEditDate="2015-03-28T00:11:18.977" LastActivityDate="2022-01-09T07:50:12.343" Title="arp inspection with dhcp snooping" Tags="|cisco|switch|dhcp|arp|dhcp-snooping|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16879" PostTypeId="1" CreationDate="2015-02-24T13:25:11.900" Score="1" ViewCount="63" Body="&lt;p&gt;In case of an intrusion does changing my private ip/lan ip helps ?&lt;/p&gt;&#xA;" OwnerUserId="14021" LastActivityDate="2018-07-18T07:38:15.123" Title="In case of an intrusion does changing my private ip/lan ip helps?" Tags="|security|ip|intrusion-prevention|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16880" PostTypeId="2" ParentId="16879" CreationDate="2015-02-24T13:38:59.750" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In case of an intrusion does changing my private ip/lan ip helps ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Does changing your name help if a thief is in your house?  Re-addressing is the last thing I would think about in an intrusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you assuming you found the intrusion?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, then fix the hole the intruder came in and trust &lt;em&gt;nothing&lt;/em&gt;.  Hard drive firmware, keyboard firmware, almost anything is game if someone gets a good hold in your network.  Hopefully you had backups on offline physical media (CD / DVD / tape) so you know what you can trust.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the sophistication of the intruder there is no limit to what can be compromised; if they are nation / state-level actors even &lt;a href=&quot;http://leaksource.info/2013/12/30/nsas-ant-division-catalog-of-exploits-for-nearly-every-major-software-hardware-firmware/&quot; rel=&quot;nofollow&quot;&gt;routers, switches, or firewall firmware can be hacked&lt;/a&gt; (see any number of compromises: BANANAGLEE, HALLUXWATER, JETPLOW, just to name a few).  Quite honestly, if it's a state actor, you're just up a creek; you can't fight people like that.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-02-24T13:49:25.970" LastActivityDate="2015-02-24T13:49:25.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16881" PostTypeId="1" CreationDate="2015-02-24T14:02:48.730" Score="2" ViewCount="2348" Body="&lt;p&gt;We'd like to get away from split-tunneling on our remote-access VPNs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I am having is once I turn off split-tunneling, internet bound traffic hairpins on the outside interface without going through our proxy servers. I would like that traffic (specifically 80/443) to be routed to our BlueCoat ProxySGs to ensure safer web-browsing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SGs are on the inside network behind our ASA which is the firewall and VPN concentrator. We are using WCCP between the ASA and SGs for transparent proxying. It looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;proxy --- inside-net --- ASA --- outside-net --- VPN/Internet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The configuration I used on the ASA after disabling split-tunneling was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wccp interface outside 90 redirect in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The access-list for redirection would match the VPN subnet so I won't post that configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to note is if I explicitly set the proxy IP in my web browser, it works. But something about allowing the ASA and SGs to handle this transparently is not working. Any insight is greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="146" LastEditorUserId="775" LastEditDate="2015-02-25T13:11:19.087" LastActivityDate="2015-02-25T13:11:19.087" Title="Redirecting remote-access VPN traffic to BlueCoat web proxy" Tags="|cisco|cisco-asa|vpn|http-proxy|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16883" PostTypeId="1" AcceptedAnswerId="16885" CreationDate="2015-02-24T16:16:34.507" Score="2" ViewCount="5619" Body="&lt;p&gt;At work I've been tasked to create a program that acts similar to Fluke testing devices (such as LinkRunners) but will be much more extensive and specific to our needs. One of the capabilities that has been requested is determining the interface port that the testing device is currently connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So before I run off into detail, &lt;strong&gt;does Cisco deploy a standard or proprietary protocol that handles all this?&lt;/strong&gt; Somehow a Fluke LinkRunner is retrieving the information without logging in administratively, an operation that I would like to mimic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To put this in perspective, a laptop with the loaded software will either connect directly to an Ethernet port on the switch or through permalink by testing on the jack-end where it is terminated for the customer. Like Fluke testing devices they would like for it to display the switch name, interface, port, VLAN, etc. so that the technician may verify that everything is working properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I don't know (since I'm only a student engineer being trained on the job) is how Cisco communicates with a testing device and provides this information. I understand that you can determine what a device is connected to on the administrative end by checking for the MAC Address in the ARP table or looking up the client IP but this is to work on the front-end. I could try to use SNMP but with how the college has set up the network the switches are on a different, secure VLAN. The laptop would not be able to jump onto this VLAN to run SNMP and fetch the required information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideas, suggestions, questions, critcism?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CDP/LLDP was pointed out and I feel silly for working with these but not having had yet researched them. From this I can get information, however this brings up another question if it must be enabled on the switch to allow retrieving said information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A comment upon the answer has finished fulfilling my questions. Special thanks to the two who helped!&lt;/p&gt;&#xA;" OwnerUserId="14048" LastEditorUserId="14048" LastEditDate="2015-02-24T18:42:51.853" LastActivityDate="2015-02-24T18:42:51.853" Title="How do testers (i.e. Fluke) get the port they're connected to?" Tags="|cisco|ethernet|testing|interface|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16884" PostTypeId="2" ParentId="11364" CreationDate="2015-02-24T16:19:39.540" Score="-1" Body="&lt;p&gt;&lt;code&gt;set password user admin&lt;/code&gt; is the new command&lt;/p&gt;&#xA;" OwnerUserId="14049" LastEditorUserId="509" LastEditDate="2015-02-24T21:24:20.057" LastActivityDate="2015-02-24T21:24:20.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16885" PostTypeId="2" ParentId="16883" CreationDate="2015-02-24T16:36:50.233" Score="3" Body="&lt;p&gt;I'm almost 100% positive that for Cisco switches it would be CDP (Cisco Discovery Protocol) while on other vendors, they would use the industry standard LLDP (Link Layer Discovery Protocol). From CDP, you can get information such as switch port, VLAN, switch name, and link negotiation info (e.g. full vs half duplex) to name a few.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="146" LastActivityDate="2015-02-24T16:36:50.233" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16887" PostTypeId="2" ParentId="16860" CreationDate="2015-02-24T17:13:44.310" Score="1" Body="&lt;p&gt;Assuming you're trying to telnet via the serial interfaces s2/0...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are Router1 and Router2 connected serially on their respective s2/0 interfaces? Make sure they are. And if they are, the IP addresses you have assigned to them (172.16.1.1 and 172.16.3.1) are not in the same subnet with your specified 255.255.255.0 subnet mask. Either change your subnet mask to something that will encompass both IP addresses (e.g., 255.255.0.0) &lt;strong&gt;OR&lt;/strong&gt; change the IP address(es) to the same subnet (e.g., 172.16.1.1 and 172.16.1.2).&lt;/p&gt;&#xA;" OwnerUserId="13988" LastActivityDate="2015-02-24T17:13:44.310" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16891" PostTypeId="1" CreationDate="2015-02-24T20:32:18.113" Score="4" ViewCount="866" Body="&lt;p&gt;I’m hopeful that someone can give us a pointer as we are sure it is a very simple error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We were recently running an IPSec site-to-site VPN using 2 x Cisco ASA 5505s between a UK and US office. Both had ASA 8.4.1. We initially tried an upgrade directly to 9.1.5 but this caused connectivity issues and we rolled back the version and config and did a staged upgrade as per the release notes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before the upgrade…&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;US staff in the US who remotely accessed using Anyconnect to the US ASA. They could access things on the UK network. UK staff connect to the UK ASA from home and could access the US network.&lt;/li&gt;&#xA;&lt;li&gt;Devices directly connected to the UK network could access devices on the US network (an appropriate static route via the respective ASA was on each device).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both devices are now on 9.1.5 but we are seeing problems.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;UK Anyconnect clients and UK devices can communicate over the VPN&#xA;(ping, smtp, ssh etc).&lt;/li&gt;&#xA;&lt;li&gt;US Anyconnect clients and US devices can communicate with each other but not with UK devices. The connection simply times out.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I’ve linked the running configs below. Thank you for any pointers than can be provided!&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;US Range: 192.168.0.0/16&lt;br&gt;&#xA;UK Range: 172.16.0.0/16&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UK VPN running-config:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;ASA Version 9.1(5)&#xA;!&#xA;hostname ukvpn&#xA;domain-name inside.testco.com&#xA;names&#xA;ip local pool vpnips 172.16.200.151-172.16.200.200 mask 255.255.0.0&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA; switchport access vlan 12&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 172.16.254.7 255.255.0.0&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 29.135.92.8 255.255.254.0&#xA;!&#xA;interface Vlan12&#xA; management-only&#xA; no forward interface Vlan2&#xA; nameif mgmt&#xA; security-level 100&#xA; ip address 10.0.0.35 255.0.0.0&#xA;!&#xA;boot system disk0:/asa915-k8.bin&#xA;boot system disk0:/asa913-k8.bin&#xA;ftp mode passive&#xA;clock timezone GMT/BST 0&#xA;clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00&#xA;dns domain-lookup inside&#xA;dns server-group DefaultDNS&#xA; name-server 172.16.254.8&#xA; name-server 192.168.254.111&#xA; domain-name inside.testco.com&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network obj-172.16.0.0&#xA; subnet 172.16.0.0 255.255.0.0&#xA;object network obj-192.168.0.0&#xA; subnet 192.168.0.0 255.255.0.0&#xA;object network NETWORK_OBJ_172.16.200.128_25&#xA; subnet 172.16.200.128 255.255.255.128&#xA;object network obj-45.99.208.8&#xA; host 45.99.208.8&#xA;object network obj-172.16.254.8&#xA; host 172.16.254.8&#xA;object-group network DM_INLINE_NETWORK_1&#xA; network-object object obj-172.16.0.0&#xA; network-object object obj-192.168.0.0&#xA;access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 192.168.0.0 255.255.0.0&#xA;access-list outside_1_cryptomap extended permit icmp host 172.16.254.8 host 45.99.208.8&#xA;access-list outside_1_cryptomap extended permit ip host 172.16.254.8 host 65.99.209.9&#xA;access-list outside_1_cryptomap extended permit icmp host 29.135.92.8 host 192.168.254.111&#xA;access-list outside_1_cryptomap extended permit ip host 29.135.92.8 host 192.168.254.111&#xA;access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 10.1.2.0 255.255.255.0&#xA;access-list outside_1_cryptomap extended permit ip 172.16.0.0 255.255.0.0 10.0.8.0 255.255.252.0&#xA;access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 192.168.0.0 255.255.0.0&#xA;access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.50.0.0 255.255.192.0&#xA;access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.1.2.0 255.255.255.0&#xA;access-list inside_nat0_outbound extended permit ip 172.16.0.0 255.255.0.0 10.0.8.0 255.255.252.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 172.16.0.0 255.255.0.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.101.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.102.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.105.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.200.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.254.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.50.0.0 255.255.192.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.53.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.54.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.49.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.50.0 255.255.254.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.52.0 255.255.252.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.56.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.106.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.60.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.1.2.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.140.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.141.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.8.0 255.255.252.0&#xA;access-list inside_access_in extended permit ip any4 any4&#xA;access-list inside_access_in extended permit icmp any4 any4&#xA;access-list outside_access_in extended permit ip any4 any4&#xA;access-list outside_access_in extended permit icmp any4 any4&#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;mtu mgmt 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;icmp permit any inside&#xA;asdm image disk0:/asdm-733.bin&#xA;asdm location 10.0.0.0 255.0.0.0 inside&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (inside,outside) source static any any destination static NETWORK_OBJ_172.16.200.128_25 NETWORK_OBJ_172.16.200.128_25 no-proxy-arp route-lookup description mystery rule&#xA;nat (inside,any) source static obj-172.16.0.0 obj-172.16.0.0 destination static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 no-proxy-arp&#xA;!&#xA;object network obj-172.16.0.0&#xA; nat (inside,outside) dynamic interface&#xA;access-group inside_access_in in interface inside&#xA;access-group outside_access_in in interface outside&#xA;route outside 0.0.0.0 0.0.0.0 29.135.92.1 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA; webvpn&#xA;  url-list value testco&#xA;  file-browsing enable&#xA;  file-entry enable&#xA;  http-proxy enable&#xA;  url-entry enable&#xA;aaa-server nt protocol nt&#xA;aaa-server nt (inside) host 172.16.254.8&#xA; nt-auth-domain-controller dc-uk&#xA;aaa-server nt (outside) host 192.168.254.111&#xA; nt-auth-domain-controller dc-us&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set isr-vpn-set esp-des esp-md5-hmac&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map outside_map 1 match address outside_1_cryptomap&#xA;crypto map outside_map 1 set pfs group1&#xA;crypto map outside_map 1 set peer 45.99.208.8&#xA;crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map outside_map interface outside&#xA;crypto ca trustpoint ASDM_TrustPoint0&#xA; enrollment self&#xA; subject-name CN=ukvpn&#xA; proxy-ldc-issuer&#xA; crl configure&#xA;crypto ca trustpool policy&#xA;crypto ca certificate chain ASDM_TrustPoint0&#xA; certificate aafb674d&#xA;    &amp;lt;removed&amp;gt;&#xA;  quit&#xA;crypto isakmp nat-traversal 10&#xA;crypto ikev2 remote-access trustpoint ASDM_TrustPoint0&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 ipsec-over-tcp port 10000&#xA;crypto ikev1 policy 10&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;vpn-sessiondb max-other-vpn-limit 10&#xA;vpn-sessiondb max-anyconnect-premium-or-essentials-limit 25&#xA;&#xA;dhcpd address 172.16.254.100-172.16.254.150 inside&#xA;dhcpd dns 172.16.254.8 192.168.254.111 interface inside&#xA;dhcpd lease 14400 interface inside&#xA;dhcpd domain inside.testco.com interface inside&#xA;dhcpd option 3 ip 172.16.254.7 interface inside&#xA;dhcpd option 60 ip 172.16.254.11 interface inside&#xA;dhcpd enable inside&#xA;!&#xA;threat-detection statistics&#xA;threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200&#xA;ssl trust-point ASDM_TrustPoint0 inside&#xA;ssl trust-point ASDM_TrustPoint0 outside&#xA;webvpn&#xA; enable inside&#xA; enable outside&#xA; anyconnect-essentials&#xA; anyconnect image disk0:/anyconnect-win-3.1.06079-k9.pkg 1 regex &quot;Windows NT&quot;&#xA; anyconnect image disk0:/anyconnect-macosx-i386-3.1.06079-k9.pkg 2 regex &quot;Intel Mac OS X&quot;&#xA; anyconnect enable&#xA; cache&#xA;  disable&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-idle-timeout none&#xA; vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless&#xA; password-storage enable&#xA; split-tunnel-network-list value testcostaffvpn_splitTunnelAcl&#xA; webvpn&#xA;  hidden-shares visible&#xA;  activex-relay disable&#xA;  auto-signon allow uri * auth-type all&#xA;group-policy testcostaffvpn internal&#xA;group-policy testcostaffvpn attributes&#xA; dns-server value 172.16.254.8 192.168.254.111&#xA; vpn-access-hours none&#xA; vpn-simultaneous-logins 4&#xA; vpn-idle-timeout none&#xA; vpn-session-timeout none&#xA; vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless&#xA; password-storage enable&#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value testcostaffvpn_splitTunnelAcl&#xA; default-domain value inside.testco.com&#xA; split-dns value dfw1.rlocal lon1.rlocal testcopub.com testcopub.co.uk testco.com&#xA; vlan none&#xA; webvpn&#xA;  url-list value testco&#xA;  filter none&#xA;  http-proxy enable&#xA;  customization value DfltCustomization&#xA;  hidden-shares visible&#xA;  file-entry enable&#xA;  file-browsing enable&#xA;  url-entry enable&#xA;  auto-signon allow uri * auth-type all&#xA;tunnel-group DefaultWEBVPNGroup general-attributes&#xA; address-pool vpnips&#xA; authentication-server-group nt&#xA; default-group-policy testcostaffvpn&#xA;tunnel-group testcostaffvpn type remote-access&#xA;tunnel-group testcostaffvpn general-attributes&#xA; address-pool vpnips&#xA; authentication-server-group nt&#xA; default-group-policy testcostaffvpn&#xA;tunnel-group testcostaffvpn ipsec-attributes&#xA; ikev1 pre-shared-key &amp;lt;removed&amp;gt;&#xA; isakmp keepalive threshold 30 retry 2&#xA;tunnel-group testcostaffvpn ppp-attributes&#xA; no authentication chap&#xA; no authentication ms-chap-v1&#xA; authentication ms-chap-v2&#xA;tunnel-group anyconnect type remote-access&#xA;tunnel-group anyconnect general-attributes&#xA; address-pool vpnips&#xA; authentication-server-group nt&#xA; default-group-policy testcostaffvpn&#xA;tunnel-group 45.99.208.17 type ipsec-l2l&#xA;tunnel-group 45.99.208.17 ipsec-attributes&#xA; ikev1 pre-shared-key &amp;lt;removed&amp;gt;&#xA;tunnel-group 45.99.208.8 type ipsec-l2l&#xA;tunnel-group 45.99.208.8 ipsec-attributes&#xA; ikev1 pre-shared-key &amp;lt;removed&amp;gt;&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect rsh&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc &#xA;  inspect xdmcp&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect ip-options&#xA;  inspect icmp&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;Cryptochecksum:838a16ab71a9de739edc27076262d7b6&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;US VPN running-config:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;ASA Version 9.1(5)&#xA;!&#xA;hostname usvpn&#xA;domain-name inside.testco.com&#xA;names&#xA;ip local pool vpnips 192.168.200.151-192.168.200.200 mask 255.255.0.0&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA; switchport access vlan 3&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA; switchport access vlan 12&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.254.107 255.255.0.0&#xA; ospf cost 10&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 45.99.208.8 255.255.255.224&#xA; ospf cost 10&#xA;!&#xA;boot system disk0:/asa915-k8.bin&#xA;boot system disk0:/asa913-k8.bin&#xA;ftp mode passive&#xA;clock timezone CST -6&#xA;clock summer-time CDT recurring&#xA;dns domain-lookup inside&#xA;dns server-group DefaultDNS&#xA; name-server 192.168.254.111&#xA; name-server 172.16.254.8&#xA; domain-name inside.testco.com&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network obj-192.168.0.0&#xA; subnet 192.168.0.0 255.255.0.0&#xA;object network obj-172.16.0.0&#xA; subnet 172.16.0.0 255.255.0.0&#xA;object network obj-192.168.200.192&#xA; subnet 192.168.200.192 255.255.255.224&#xA;object network NETWORK_OBJ_192.168.254.128_25&#xA; subnet 192.168.254.128 255.255.255.128&#xA;object network obj-29.135.92.8&#xA; host 29.135.92.8&#xA;object network obj-192.168.254.111&#xA; host 192.168.254.111&#xA;object network obj-192.168.254.200&#xA; host 192.168.254.200&#xA;object network obj-10.1.2.0&#xA; subnet 10.1.2.0 255.255.255.0&#xA;object network obj-10.0.250.0&#xA; subnet 10.0.250.0 255.255.255.0&#xA;object network obj-10.0.0.0&#xA; subnet 10.0.0.0 255.0.0.0&#xA; description http://www.cisco.com/en/US/docs/security/asa/asa83/upgrading/migrating.html#wp97481&#xA;object network intra&#xA;object-group network DM_INLINE_NETWORK_1&#xA; network-object object obj-172.16.0.0&#xA; network-object object obj-192.168.0.0&#xA; network-object object obj-10.1.2.0&#xA; network-object object obj-10.0.250.0&#xA; network-object object obj-10.0.0.0&#xA;access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 172.16.0.0 255.255.0.0&#xA;access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.50.0.0 255.255.192.0&#xA;access-list inside_nat0_outbound extended permit ip 192.168.0.0 255.255.0.0 10.0.250.0 255.255.255.0&#xA;access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 172.16.0.0 255.255.0.0&#xA;access-list outside_1_cryptomap extended permit icmp host 45.99.208.8 host 172.16.254.8&#xA;access-list outside_1_cryptomap extended permit ip host 45.99.208.8 host 172.16.254.8&#xA;access-list outside_1_cryptomap extended permit icmp host 192.168.254.111 host 29.135.92.8&#xA;access-list outside_1_cryptomap extended permit ip host 192.168.254.111 host 29.135.92.8&#xA;access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 10.1.2.0 255.255.255.0&#xA;access-list outside_1_cryptomap extended permit ip 192.168.0.0 255.255.0.0 10.0.250.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 172.16.0.0 255.255.0.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.50.0.0 255.255.192.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.100.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.101.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.102.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.105.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.200.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.254.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.53.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.54.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.250.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.49.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.50.0 255.255.254.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.52.0 255.255.252.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.56.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.106.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.60.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.1.2.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.140.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.8.0 255.255.252.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.55.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.16.0 255.255.252.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.253.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.141.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 192.168.23.0 255.255.255.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.0.0 255.255.252.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.24.0 255.255.252.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.32.0 255.255.252.0&#xA;access-list testcostaffvpn_splitTunnelAcl standard permit 10.0.250.0 255.255.255.0&#xA;access-list inside_access_in extended permit ip any4 any4&#xA;access-list inside_access_in extended permit icmp any4 any4&#xA;access-list outside_access_in extended permit ip any4 any4&#xA;access-list outside_access_in extended permit icmp any4 any4&#xA;pager lines 24&#xA;logging enable&#xA;logging console warnings&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-733.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (inside,any) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 no-proxy-arp&#xA;!&#xA;object network obj-192.168.0.0&#xA; nat (inside,outside) dynamic interface&#xA;object network obj-10.0.0.0&#xA; nat (inside,outside) dynamic interface&#xA;access-group inside_access_in in interface inside&#xA;access-group outside_access_in in interface outside&#xA;route outside 0.0.0.0 0.0.0.0 45.99.208.1 1&#xA;route inside 10.0.0.0 255.0.0.0 192.168.49.3 1&#xA;route inside 10.0.0.0 255.255.252.0 192.168.49.3 1&#xA;route inside 10.0.8.0 255.255.252.0 192.168.49.3 1&#xA;route inside 10.0.16.0 255.255.252.0 192.168.49.3 1&#xA;route inside 10.0.24.0 255.255.252.0 192.168.49.3 1&#xA;route inside 10.0.32.0 255.255.252.0 192.168.49.3 1&#xA;route inside 10.1.2.0 255.255.255.0 192.168.49.3 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA; webvpn&#xA;  file-browsing enable&#xA;  file-entry enable&#xA;  http-proxy enable&#xA;  url-entry enable&#xA;aaa-server domain protocol nt&#xA;aaa-server domain (inside) host 192.168.254.111&#xA; timeout 5&#xA; nt-auth-domain-controller dc-us&#xA;aaa-server domain (outside) host 172.16.254.8&#xA; nt-auth-domain-controller dc-uk&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set isr-vpn-set esp-des esp-md5-hmac&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA&#xA;crypto map outside_map 1 match address outside_1_cryptomap&#xA;crypto map outside_map 1 set pfs group1&#xA;crypto map outside_map 1 set peer 29.135.92.8&#xA;crypto map outside_map 1 set ikev1 transform-set ESP-AES-256-SHA&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map outside_map interface outside&#xA;crypto ca trustpoint ASDM_TrustPoint0&#xA; enrollment self&#xA; subject-name CN=usvpn&#xA; proxy-ldc-issuer&#xA; crl configure&#xA;crypto ca trustpool policy&#xA;crypto ca certificate chain ASDM_TrustPoint0&#xA; certificate f8674d&#xA;    &amp;lt;removed&amp;gt;&#xA;  quit&#xA;crypto ikev2 remote-access trustpoint ASDM_TrustPoint0&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 ipsec-over-tcp port 10000&#xA;crypto ikev1 policy 10&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;vpn-sessiondb max-anyconnect-premium-or-essentials-limit 25&#xA;&#xA;dhcpd address 192.168.200.100-192.168.200.150 inside&#xA;dhcpd dns 192.168.254.111 172.16.254.8 interface inside&#xA;dhcpd lease 14400 interface inside&#xA;dhcpd domain inside.testco.com interface inside&#xA;dhcpd option 3 ip 192.168.254.107 interface inside&#xA;dhcpd option 60 ip 192.168.254.130 interface inside&#xA;dhcpd enable inside&#xA;!&#xA;threat-detection statistics&#xA;threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200&#xA;ssl trust-point ASDM_TrustPoint0 inside&#xA;ssl trust-point ASDM_TrustPoint0 outside&#xA;webvpn&#xA; enable inside&#xA; enable outside&#xA; anyconnect-essentials&#xA; anyconnect image disk0:/anyconnect-dart-win-2.5.6005-k9.pkg 1 regex &quot;Windows NT&quot;&#xA; anyconnect image disk0:/anyconnect-macosx-i386-2.5.6005-k9.pkg 2 regex &quot;Intel Mac OS X&quot;&#xA; anyconnect enable&#xA; tunnel-group-list enable&#xA; cache&#xA;  disable&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless&#xA;group-policy GroupPolicy_anyconnect internal&#xA;group-policy GroupPolicy_anyconnect attributes&#xA; wins-server none&#xA; dns-server value 192.168.254.111 172.16.254.8&#xA; vpn-tunnel-protocol ssl-client&#xA; default-domain value inside.testco.com&#xA;group-policy testcostaffvpn internal&#xA;group-policy testcostaffvpn attributes&#xA; wins-server none&#xA; dns-server value 192.168.254.111 172.16.254.8&#xA; vpn-access-hours none&#xA; vpn-simultaneous-logins 2&#xA; vpn-idle-timeout none&#xA; vpn-session-timeout none&#xA; vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless&#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value testcostaffvpn_splitTunnelAcl&#xA; default-domain value inside.testco.com&#xA; split-dns value dfw1.rlocal lon1.rlocal testcopub.com testcopub.co.uk testco.com&#xA; vlan none&#xA; webvpn&#xA;  url-list none&#xA;  filter none&#xA;  http-proxy enable&#xA;  customization value DfltCustomization&#xA;  hidden-shares none&#xA;  file-entry enable&#xA;  file-browsing enable&#xA;  url-entry enable&#xA;tunnel-group DefaultRAGroup ppp-attributes&#xA; no authentication chap&#xA; no authentication ms-chap-v1&#xA; authentication ms-chap-v2&#xA;tunnel-group 29.135.92.8 type ipsec-l2l&#xA;tunnel-group 29.135.92.8 ipsec-attributes&#xA; ikev1 pre-shared-key &amp;lt;removed&amp;gt;&#xA;tunnel-group testcostaffvpn type remote-access&#xA;tunnel-group testcostaffvpn general-attributes&#xA; address-pool vpnips&#xA; authentication-server-group domain&#xA; default-group-policy testcostaffvpn&#xA;tunnel-group testcostaffvpn ipsec-attributes&#xA; ikev1 pre-shared-key &amp;lt;removed&amp;gt;&#xA; isakmp keepalive threshold 30 retry 2&#xA;tunnel-group testcostaffvpn ppp-attributes&#xA; no authentication chap&#xA; no authentication ms-chap-v1&#xA; authentication ms-chap-v2&#xA;tunnel-group anyconnect type remote-access&#xA;tunnel-group anyconnect general-attributes&#xA; address-pool vpnips&#xA; authentication-server-group domain&#xA; default-group-policy testcostaffvpn&#xA;tunnel-group anyconnect webvpn-attributes&#xA; group-alias anyconnect enable&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc&#xA;  inspect xdmcp&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect ip-options&#xA;  inspect icmp&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;hpm topN enable&#xA;Cryptochecksum:d20c924a5c39211877c10cb6e61359fe&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14053" LastEditorUserId="8499" LastEditDate="2016-04-06T21:59:49.393" LastActivityDate="2016-04-06T21:59:49.393" Title="ASA 5505 Post-Upgrade One-Way Traffic Flow" Tags="|cisco-asa|firewall|tunnel|split-tunneling|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16893" PostTypeId="2" ParentId="16496" CreationDate="2015-02-24T21:38:01.670" Score="1" Body="&lt;p&gt;Justin, I'm not aware of any feature from a switch vendor that will inspect the layer 2 traffic on a VLAN to enforce layer 3 addressing.  If you assign Virtual Ethernet interfaces (Brocade name equivalent to the Cisco SVI, basically a routed interface into the VLAN) to these VLANs, other devices on the VLAN would only be able to use IP addresses within the same subnet as the VE IP address to be able to use the switch as a default gateway and get routing services off of that subnet &amp;amp; VLAN.  This would not prevent two or more devices on the VLAN from using a separate IP subnet and being able to communicate with any other device in the same subnet on the same VLAN.  However, these devices will not be all that useful, as they will not be able to reach any other services, as they won't have a valid default gateway to allow them to talk to other subnets, servers, the Internet, etc.  &lt;/p&gt;&#xA;" OwnerUserId="3651" LastActivityDate="2015-02-24T21:38:01.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16894" PostTypeId="1" AcceptedAnswerId="16902" CreationDate="2015-02-24T22:01:29.840" Score="2" ViewCount="223" Body="&lt;p&gt;I have a Juniper 3200 with a few different vlans, &lt;strong&gt;10.0.0.0&lt;/strong&gt;, &lt;strong&gt;10.100.0.0&lt;/strong&gt; and a &lt;strong&gt;10.1.0.0&lt;/strong&gt;. the 10.0.0.0 and 10.100.0.0 are on the LAN side of the firewall and can talk to each other, but 10.1.0.0 needs to talk through the firewall. I'm trying to have them talk through a firewall with an access port plugged into port 33 for the LAN and 34 for the DMZ. How would I set the routing with out breaking the other VLANs? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route 10.0.0.0/24 next-hop 10.1.0.5 &#xA;route 10.1.0.0/24 next-hop 10.0.0.5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there an option for adding a route only to a specific VLAN? IE &lt;code&gt;route vlan.10 10.0.0.0/24 next-hop 10.1.0.5&lt;/code&gt; (I know that's wrong, I guess that is what I would be looking for in a solution).&lt;/p&gt;&#xA;" OwnerUserId="8713" LastActivityDate="2015-02-25T13:08:09.950" Title="Adding a route to a VLAN" Tags="|routing|vlan|juniper-ex|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16895" PostTypeId="2" ParentId="16881" CreationDate="2015-02-24T22:31:46.797" Score="2" Body="&lt;p&gt;I'm not sure how this will work with the BlueCoat, but there is a 'tunneled' keyword that can be added to a static default route on the ASA that will be used for traffic exiting a VPN tunnel, instead of the normal default route that is responsible for the hairpin that you are seeing.  There are some other restrictions that apply to using this configuration as noted &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/route_static.html#wp1121567&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; (ASA version 8.2).  This presumably would require the proxy to be able to handle in some fashion all traffic exiting the VPN tunnel, not just 80/443, in that traffic that will not be proxied by the BlueCoat would essentially need to be 'routed' by it back to the ASA, where it would pass through using the standard default route out to the Internet.&lt;/p&gt;&#xA;" OwnerUserId="3651" LastActivityDate="2015-02-24T22:31:46.797" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16899" PostTypeId="2" ParentId="16872" CreationDate="2015-02-25T09:27:34.987" Score="1" Body="&lt;p&gt;in elevated mode, run the command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;packet-tracer input LAN tcp 192.168.35.203 80 192.168.99.2 80 detailed&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and have a look through the output. It should give you an idea why the packets are being dropped, if indeed there is a problem with the configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also run an capture on both interfaces to check if the packets are getting where you think they should be going by setting up an access list which matches the packets you want to capture, and applying to an interface as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;capture {capture-name} interface {interface-name} access-list {access-list name}&lt;/p&gt;&#xA;" OwnerUserId="8305" LastEditorUserId="775" LastEditDate="2015-02-25T14:14:20.413" LastActivityDate="2015-02-25T14:14:20.413" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16902" PostTypeId="2" ParentId="16894" CreationDate="2015-02-25T13:01:38.227" Score="2" Body="&lt;p&gt;I think you are looking for routing-instances. &#xA;You could create a new routing instance as type virtual router and add the vlan interface, then you will have a completely separated routing table.&lt;/p&gt;&#xA;" OwnerUserId="419" LastEditorUserId="775" LastEditDate="2015-02-25T13:08:09.950" LastActivityDate="2015-02-25T13:08:09.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16903" PostTypeId="2" ParentId="16881" CreationDate="2015-02-25T13:08:34.800" Score="-1" Body="&lt;p&gt;After talking to Cisco yesterday, it doesn't look like WCCP will work in this scenario. The &quot;route interface x.x.x.x x.x.x.x tunneled&quot; command as mentioned by Eric is an option, however, I don't want the proxy server to be the default gateway for all VPN traffic. It also doesn't allow me to load balance traffic to both proxy servers. In the event that it went down, VPN traffic would be black-holed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In doing my initial research, I came across a set of commands that are applied to group-policy that allow you to set the proxy server in Internet Explorer by manipulating the registry. The commands are &quot;msie-proxy method use-server&quot; and &quot;msie-proxy server value FQDN/IP address:port&quot;. The downside to this is that you can only specify one FQDN or IP. However I can get around this by specifying a FQDN that is load balanced using DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A note: During my testing, AnyConnect 2.5 did not allow me to change the proxy settings in IE. Once I upgraded to 3.1, it worked just fine. I'm aware that 2.5 is EoL and becoming EoS in June 2015. It is also affected by several security vulnerabilities such as POODLE, but I have to work with what I have at the moment. It's on my to-do list to get everyone upgraded.&lt;/p&gt;&#xA;" OwnerUserId="146" LastActivityDate="2015-02-25T13:08:34.800" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16907" PostTypeId="1" CreationDate="2015-02-25T15:39:40.770" Score="4" ViewCount="4539" Body="&lt;p&gt;I have factory reset my Motorola rfs6000 by using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;cli&#xA;Username: restore&#xA;Password: restoreDefaultPassword&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which then asked me if i wanted to wipe the device etc etc.&#xA;But then after doing this, it comes up with the following;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ABS01-DEPOT-111412 Logon:&#xA;Password:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After looking around online, I was told to use the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Username:admin&#xA;Password:Symbol&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I have tried this to no joy, as every time it tells me I have got an incorrect logon.&#xA;Help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="13529" LastActivityDate="2017-02-15T11:45:12.720" Title="Default Username and password for motorola rfs6000 after factory reset" Tags="|ieee-802.11|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="16908" PostTypeId="2" ParentId="11097" CreationDate="2015-02-25T16:57:52.627" Score="0" Body="&lt;p&gt;This is really just an expanded explanation of things that have been touched on in the other two answer, but with a little more depth.  My apologies for the length, but I was trying not to gloss over any obvious details/assumptions, as that is usually where the problem lies.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, let's start with the selection of the source IP for data that is originated from the router, such as your pings, traceroutes, syslog, etc.  So most router software will do a routing lookup on the destination address, and then use the local interface that is closest to the destination as the source.  So in this case, other than for traffic onto the local LAN (10.5.0.1/23), the traffic will exit the router on the PPP interface so the source IP will be 208.46.133.130.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, without looking at all of the devices in the path, I can't say this for sure, but just based on the fact that these routers only have static and connected routes, I'm assuming that a device in the traffic path does not have a 'complete' routing table.  So I'll give you one scenario that I've seen that will result in this sort of behavior.  So let's say that this 10.0.1.11 IP is your syslog server, and it has as a default gateway a seperate layer 3 switch or router in the hub site that is at 10.0.1.1, and then the firewall to the Internet is at 10.0.1.2, and let's put the MPLS router at 10.0.1.3.  So if you only have static routes throughout the network, one possibility would be that the firewall at 10.0.1.2 does have a static route for the 208.46.133.128/30 network, or some larger aggregate of it that points back to the MPLS router.  But if the server's gateway only the static routes for the LAN addresses (10.5.0.0/23, etc.) that point back to the MPLS and a default route to the firewall, what happens then? The return traffic from the server will go to it's default gateway, and then the default route from there will go to the firewall, and it doesn't know to go back to the MPLS cloud for the ISP/uplink side of the remote MPLS router, but it does when traffic is sourced from the LAN side of the router or the LAN itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So long description short, based on using only static routes, there are probably 'holes' in the routing tables of various devices, and because only an admin has access to the router, missing routes for these 'infrastructure' IP addresses are usually not noticed.  The way to track this down is to go to every single hop in the path and look at the routing table for the source and destination addresses.  At some point you'll find a device that has a route back to the 10 address, and doesn't have a route for the 208 address, or just a default route that points in the wrong direction.  My longer term suggestion would be to implement some form of dynamic routing. With statics keeping track of whether or not all the needed routes are added to every new device, or that each new subnet has a route added to all the existing devices is tedious and error prone, and you very quickly lose any advantage/simplicity that was the supposed reason to avoid dynamic routing in the first place.&lt;/p&gt;&#xA;" OwnerUserId="3651" LastActivityDate="2015-02-25T16:57:52.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16909" PostTypeId="1" AcceptedAnswerId="18897" CreationDate="2015-02-25T17:40:17.740" Score="5" ViewCount="1990" Body="&lt;pre&gt;&lt;code&gt;Router# show ip bgp 10.3.3.3 255.255.255.255&#xA;BGP routing table entry for 10.3.3.3/32, version 35&#xA;Paths: (3 available, best #2, table default)&#xA;Multipath: eBGP&#xA;Flag: 0x860&#xA;  Advertised to update-groups:&#xA;     1&#xA;  200&#xA;    10.71.8.165 from 10.71.8.165 (192.168.0.102)&#xA;      Origin incomplete, localpref 100, valid, external, backup/repair&#xA;      Only allowed to recurse through connected route&#xA;  200&#xA;    10.71.11.165 from 10.71.11.165 (192.168.0.102)&#xA;      Origin incomplete, localpref 100, weight 100, valid, external, best&#xA;      Only allowed to recurse through connected route&#xA;  200&#xA;    10.71.10.165 from 10.71.10.165 (192.168.0.104)&#xA;      Origin incomplete, localpref 100, valid, external,&#xA;      Only allowed to recurse through connected route &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Above is sample output of &quot;show ip bgp x.x.x.x&quot;.  This particular BGP router has learned multiple paths to get to the 10.3.3.3/32 host, and is listing each entry.  Of the three that were learned, the 2nd one is the best -- and therefor the entry that makes it to the actual Route table (RIB).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, does the order in which the three paths to the target appear in the output of this command indicate something?  If so, what does it mean?&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="775" LastEditDate="2015-02-25T18:43:03.413" LastActivityDate="2015-07-04T19:03:50.097" Title="Order of entries in &quot;show ip bgp x.x.x.x&quot;" Tags="|cisco|bgp|cisco-commands|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16910" PostTypeId="1" AcceptedAnswerId="25080" CreationDate="2015-02-25T17:53:34.910" Score="4" ViewCount="3986" Body="&lt;p&gt;Is there a comment character or do-nothing command in the HP CLI environment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for an equivalent of the exclamation mark (!) in Cisco IOS.&lt;/p&gt;&#xA;" OwnerUserId="14068" LastActivityDate="2021-06-01T11:34:53.750" Title="HP Networking Switch CLI Comments?" Tags="|switch|hp-procurve|cli|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16911" PostTypeId="2" ParentId="16910" CreationDate="2015-02-25T18:11:21.967" Score="3" Body="&lt;p&gt;I'm sorry to tell you that I believe the answer is no; you can't just insert a comment wherever you want on Procurves.  However, for what it's worth, there is a handy way to &lt;a href=&quot;http://techblog.rezitech.com/how-to-view-and-set-port-names-on-hp-procurve-switch/&quot; rel=&quot;nofollow&quot;&gt;configure &quot;friendly&quot; port names&lt;/a&gt; so you can at least add what amounts to a comment for each port or group of ports.  I use this frequently.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2015-02-25T18:11:21.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16913" PostTypeId="1" CreationDate="2015-02-25T18:43:07.633" Score="2" ViewCount="252" Body="&lt;p&gt;What would be the easiest was to accomplish this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find all ports that do not have 'switchport port-security'&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show run | exclude ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't have a swicth with me and packet tracer does not have the commands avaliable.&lt;/p&gt;&#xA;" OwnerUserId="1592" LastEditorUserId="13986" LastEditDate="2015-02-26T23:36:01.853" LastActivityDate="2015-02-26T23:36:01.853" Title="List ports which do not have a given property" Tags="|cisco|cisco-commands|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16914" PostTypeId="2" ParentId="16913" CreationDate="2015-02-25T18:56:10.263" Score="0" Body="&lt;p&gt;I can't see a way to make exclude work in this situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could try something like the below which will show all the interfaces port-security lines (you would just need to find interfaces with none of those - i.e. where you have two interface lines in a row):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; show run | include (^interface|port-security)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or, if this is the specific case you are trying to achieve, a simple &lt;code&gt;show port-security&lt;/code&gt; will list all the ports that have port-security enabled.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-02-25T18:56:10.263" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16916" PostTypeId="2" ParentId="16913" CreationDate="2015-02-25T19:17:32.367" Score="2" Body="&lt;p&gt;Another option if you're willing to use a python script, use &lt;a href=&quot;http://pennington.net/py/ciscoconfparse/api_CiscoConfParse.html&quot; rel=&quot;nofollow&quot;&gt;ciscoconfparse.find_parents_wo_child()&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, usage would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from ciscoconfparse import CiscoConfParse&#xA;&#xA;parse = CiscoConfParse('/path/to/configuration/file')&#xA;missing = parse.find_parents_wo_child('^interface', 'switchport port-security$')&#xA;for intf in missing:&#xA;    print(intf)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Save that script to a file and run it (after you install ciscoconfparse).  That script will print interfaces without port-security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the github link to the library: &lt;a href=&quot;https://github.com/mpenning/ciscoconfparse&quot; rel=&quot;nofollow&quot;&gt;ciscoconfparse&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full disclosure: I am the author of the library&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-02-25T19:24:32.017" LastActivityDate="2015-02-25T19:24:32.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16919" PostTypeId="2" ParentId="16496" CreationDate="2015-02-25T20:08:11.590" Score="1" Body="&lt;p&gt;I don't think there's a way to enforce client IP addressing at the switch, however if you have control of the clients, you could prevent them from statically assigning their IP's and stand up a DHCP server on the VLAN that only hands out approved IP's.&lt;/p&gt;&#xA;" OwnerUserId="14052" LastActivityDate="2015-02-25T20:08:11.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16923" PostTypeId="1" CreationDate="2015-02-26T00:34:53.927" Score="2" ViewCount="2297" Body="&lt;p&gt;I've just bought a switch dell N2024. I have some trouble with inter-vlan routing. basically , i have two vlan, with an interface in each and an ip address configured. I'm not able to ping from a vlan to the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the switch Dell N2024 able to route betwen the vlan ? &lt;/p&gt;&#xA;" OwnerUserId="14076" LastEditorUserId="775" LastEditDate="2015-02-26T02:41:51.523" LastActivityDate="2016-06-14T20:46:51.203" Title="Dell N2024 Inter vlan routing" Tags="|powerconnect|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16925" PostTypeId="2" ParentId="16923" CreationDate="2015-02-26T03:41:38.557" Score="2" Body="&lt;p&gt;Never having worked on one, I took a look at the documentation and would have to say that yes it can, at least in some limited fashion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the &lt;a href=&quot;http://i.dell.com/sites/doccontent/shared-content/data-sheets/en/Documents/Dell_Networking_N2000_Series_SpecSheet_EN_1_0.pdf&quot; rel=&quot;nofollow&quot;&gt;spec sheet&lt;/a&gt; for this product line, it would seem to indicate it can as it supports static routes, dynamic routes, and specifies &quot;Line-rate Layer 3 routing&quot; as well as the number of RIP and VLAN routing interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both the &lt;a href=&quot;http://downloads.dell.com/Manuals/all-products/esuprt_ser_stor_net/esuprt_networking/esuprt_net_fxd_prt_swtchs/networking-n2000-series_Deployment%20Guide9_en-us.pdf&quot; rel=&quot;nofollow&quot;&gt;User Configuration Guide&lt;/a&gt; and the &lt;a href=&quot;http://downloads.dell.com/Manuals/all-products/esuprt_ser_stor_net/esuprt_networking/esuprt_net_fxd_prt_swtchs/networking-n2000-series_Deployment%20Guide3_en-us.pdf&quot; rel=&quot;nofollow&quot;&gt;CLI Reference Guide&lt;/a&gt; seem to provide the information needed to configure routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it is marketed as a L2 or L2+ switch rather than a L3 switch.  It doesn't support OSPF and is limited in the number of routes it can handle.  In the &lt;a href=&quot;http://i.dell.com/sites/doccontent/shared-content/data-sheets/en/Documents/Dell_Networking_Quick_Reference_Guide.pdf&quot; rel=&quot;nofollow&quot;&gt;Dell Networking Product Portfolio Guide&lt;/a&gt;, it indicates the N2000 series switches are not meant as aggregation/L3 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So while it appears to have the functionality, the features and possibly the performance may not meet the expectations of a modern network.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-02-26T03:41:38.557" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16929" PostTypeId="2" ParentId="16909" CreationDate="2015-02-26T11:00:58.550" Score="1" Body="&lt;p&gt;The order means nothing.&#xA;It's just the way the data was retrieved from internal structures or (may be) sorted to be smoother.&lt;/p&gt;&#xA;" OwnerUserId="14080" LastActivityDate="2015-02-26T11:00:58.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16930" PostTypeId="2" ParentId="16872" CreationDate="2015-02-26T11:02:53.760" Score="2" Body="&lt;p&gt;Perhaps try a standard permit any any to see if you get some movement. If you do, then we can take a few steps at moving closer to your end goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Give this a try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list ACL_INSIDE_TO_OUTSIDE extended permit ip any any&#xA;access-group ACL_INSIDE_TO_OUTSIDE in interface LAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And for your computer that you have on the WAN side... if you're using Windows firewall or some other similar firewall on the computer, to disable it. =)&lt;/p&gt;&#xA;" OwnerUserId="5601" LastActivityDate="2015-02-26T11:02:53.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16931" PostTypeId="2" ParentId="16809" CreationDate="2015-02-26T16:03:31.063" Score="4" Body="&lt;p&gt;While UDP is not reliable, a lot of protocols use it as a base and add reliability at application level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would determine what features you would need, and what you would implement:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Connection handling (keep track of a connection)&lt;/li&gt;&#xA;&lt;li&gt;Sequencing (to rely on order of frames)&lt;/li&gt;&#xA;&lt;li&gt;Acknowledgement (to make sure all frames are received)&lt;/li&gt;&#xA;&lt;li&gt;Flow control (throttle the flow of data)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Sometimes you will only need a few traits and not all. Although if you use all features, refrain of building it yourself: TCP will cramp this all in only a few extra header bytes and some handshaking packets ;)&lt;/p&gt;&#xA;" OwnerUserId="7527" LastActivityDate="2015-02-26T16:03:31.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16932" PostTypeId="1" CreationDate="2015-02-26T16:14:11.587" Score="1" ViewCount="73" Body="&lt;p&gt;Perhaps this sounds like a dumb question but hear me out: I'd like to determine who the service provider is for a given public IP address. I'm not talking about who owns it–that information is readily available–but instead who is actually using it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take Netflix for example: if I see a stream of packets to a Netflix server and look up the owner of that destination IP I will invariably get Amazon because Netflix (like many service providers) run on Amazon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could I identify that it is Netflix who is providing the service without doing DPI on the TLS handshake? (you can guess the service provider pretty well from the raw data stream as the server's hostname will be there in plain text)&lt;/p&gt;&#xA;" OwnerUserId="14084" LastActivityDate="2015-02-27T06:17:47.283" Title="How can I determine who is using a given public IP address without DPI?" Tags="|network-discovery|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16933" PostTypeId="1" CreationDate="2015-02-26T16:16:29.983" Score="1" ViewCount="1163" Body="&lt;p&gt;I know traceroute in BSD uses UDP by default and gets ICMP error message from intermediate hops when TTL is decremented and found to be 0. &#xA;My question is - what if we trace route to next-hop router:&#xA;- Should the router respond with port unreachable message?&lt;/p&gt;&#xA;" OwnerUserId="3327" LastEditorUserId="775" LastEditDate="2015-03-09T09:55:18.970" LastActivityDate="2015-03-10T14:40:10.830" Title="&quot;Trace route&quot; to Next-hop as destination" Tags="|traceroute|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16934" PostTypeId="1" AcceptedAnswerId="17187" CreationDate="2015-02-26T17:56:33.203" Score="7" ViewCount="18768" Body="&lt;p&gt;I currently admin a small network, it has two separate sites (site1 site2). Each site has independent internet, and a Sonic NSA 220 Firewall. There is currently VPN connecting the two Sonic firewalls, so the sites can communicate without any issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our ISP has just installed a 'router' at each site (ISP Router 1 &amp;amp; 2), so it now presents two ports...Internet Port (ISP-WAN) and a inter-site port (ISP-LAN). This is so we can eliminate the VPN, and route traffic direct through the ISP cloud (ISP-LAN)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wanting to know how to set up the ports routing, so I can tell the firewall to route internal traffic through this new ISP-LAN port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each site has a DC (same domain) and a separate DHCP (sites have different IP ranges).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking I could connect port X6 on each firewall to the ISP-LAN port, this would connect the two sites (Blue Line), but not sure how to configure the routing/rules.&#xA;Everything has the Sonic WAN port as its default gateway. I don't want the DHCP traffic etc broadcasting between sites.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/eU7dm.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look forward to any help on this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="14087" LastActivityDate="2016-11-21T21:21:51.003" Title="Routing traffic between two subnets" Tags="|routing|firewall|subnet|sonicwall|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16938" PostTypeId="2" ParentId="16340" CreationDate="2015-02-26T19:10:42.453" Score="0" Body="&lt;p&gt;You could use a routing protocol like BGP and create a relationship with your router. Give your router preference to the VM, and let the routing protocol handle it.&lt;/p&gt;&#xA;" OwnerUserId="14052" LastActivityDate="2015-02-26T19:10:42.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16939" PostTypeId="1" AcceptedAnswerId="16941" CreationDate="2015-02-26T19:40:15.823" Score="2" ViewCount="1758" Body="&lt;p&gt;We have a connection between our Vyatta Router to our MPLS VPN Service Provider  which is a Cisco device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We would like to know how to filter the OSPF advertisement routes on Brocade Vrouter 5400 (Vyatta). We are open to any other free or lowcost option. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to find a solution, we tried to simulate it with GNS3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are trying to filter from the vyatta to Cisco. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The big picture : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UXgv4.png&quot; alt=&quot;topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vyatta VPN_2 configuration :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    ethernet eth0 {&#xA;        address 10.0.0.5/24&#xA;        duplex auto&#xA;        smp_affinity auto&#xA;        speed auto&#xA;    }&#xA;    ethernet eth1 {&#xA;        duplex auto&#xA;        smp_affinity auto&#xA;        speed auto&#xA;        vif 1419 {&#xA;            address 10.14.250.249/29&#xA;            description VLAN-VPN_2&#xA;        }&#xA;    }&#xA;}&#xA;policy {&#xA;    access-list 10 {&#xA;        rule 5 {&#xA;            action permit&#xA;            source {&#xA;                inverse-mask 0.0.255.255&#xA;                network 10.14.0.0&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;protocols {&#xA;    ospf {&#xA;        access-list 10 {&#xA;            import&#xA;        }&#xA;        area 0 {&#xA;            network 10.14.250.248/29&#xA;            network 10.0.0.0/24&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But we are still getting the routes from the vyatta, as we can see on CE_1 routing table. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CE_1#show ip route vrf VPN_2&#xA;&amp;lt;ommited&amp;gt; &#xA;     10.0.0.0/8 is variably subnetted, 11 subnets, 4 masks&#xA;O       10.0.0.0/24 [110/2] via 10.14.250.249, 00:27:11, FastEthernet0/0.1419&#xA;O E2    10.15.10.146/32 &#xA;           [110/100] via 10.14.250.249, 00:27:11, FastEthernet0/0.1419&#xA;O       10.25.250.0/29 &#xA;           [110/3] via 10.14.250.249, 00:27:11, FastEthernet0/0.1419&#xA;C       10.19.144.72/30 is directly connected, FastEthernet1/0.1224&#xA;B       10.14.250.0/29 [20/0] via 10.19.144.73, 01:03:31&#xA;O E2    10.11.248.0/29 &#xA;           [110/100] via 10.14.250.249, 00:27:12, FastEthernet0/0.1419&#xA;O       10.11.249.0/24 &#xA;           [110/3] via 10.14.250.249, 00:27:12, FastEthernet0/0.1419&#xA;C       10.14.250.248/29 is directly connected, FastEthernet0/0.1419&#xA;O       10.23.13.38/32 &#xA;           [110/4] via 10.14.250.249, 00:27:13, FastEthernet0/0.1419&#xA;B       10.23.18.55/32 [20/0] via 10.19.144.73, 01:03:33&#xA;O E2    10.25.250.248/29 &#xA;           [110/100] via 10.14.250.249, 00:27:13, FastEthernet0/0.1419&#xA;CE_1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Don't understand why I'm getting from the Vyatta_VPN_2 the routes 10.25.250.0/29 and&#xA;10.11.249.0/24 on CE_1 and CE_2 which are redistributed on MPLS VPN.&lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2015-02-27T06:40:47.887" LastActivityDate="2015-02-28T14:07:24.797" Title="OSPF route filtering on Vyatta device" Tags="|cisco|routing|ospf|route-filter|vyatta|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16941" PostTypeId="2" ParentId="16939" CreationDate="2015-02-26T22:04:57.603" Score="6" Body="&lt;p&gt;Every OSPF router in an area has a full topology map so it can calculate the shortest path to every network.  If you attempt to filter routes, you break the router's ability to calculate the path.  While some routers will let you filter routes (and not all do), it's a bad idea to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to filter routes between your MPLS cloud and data center, I recommend you use a protocol like BGP; it was designed to do that sort of thing.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-02-26T22:04:57.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16942" PostTypeId="1" AcceptedAnswerId="16950" CreationDate="2015-02-27T02:02:48.130" Score="3" ViewCount="8177" Body="&lt;p&gt;We've been having an issue for the last few weeks on a relatively small network. The issue started when we swapped a specific Cisco 3750 for a 2960G (there were some other changes), exactly since then we now get the following notifications all day long:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;019534: Feb 27 01:28:39: %SW_MATM-4-MACFLAP_NOTIF: Host 0016.3e64.98e2 in vlan 100 is flapping between port Gi0/22 and port Gi0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We get this on multiple mac addresses and multiple vlans, the above is the most common one we see (there are thousands per day).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mac address in question is for a VM on a server, obviously the server does not move and is physically located on another switch directly connected to Gi0/24.&#xA;Gi0/22 is the uplink to the central router (there are other switches upstream, non if which are logging flaps), so the questions follows - how is this switch learning the VM's mac on Gi0/22 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously the first thing was to eliminate a L2 loop, we have looked into this many times, rebuilding diagrams from scratch using both cdp and physical tracing and we absolutely cannot find a loop anywhere. Additionally, STP is not reporting any blocked paths, confirming that no loop has been detected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help or tips on how to debug this would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="14091" LastActivityDate="2015-03-04T23:17:18.203" Title="MAC Flapping on Cisco 2960G" Tags="|cisco|cisco-catalyst|spanning-tree|mac-address|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16945" PostTypeId="2" ParentId="16932" CreationDate="2015-02-27T06:17:47.283" Score="2" Body="&lt;p&gt;The simple answer is you can't do this reliably without DPI and often not then. You might be able to watch DNS queries to get at some info, but I would consider that DPI. And, you maybe able to get some identifying information from some IP assignments through watching Radius. Again, that's DPI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I say maybe not even with DPI is because so much stuff is encrypted now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that people who lease or assign IPs are required to retain identifying information for law enforcement purposes. But, that is done using back office systems, nothing in band. That's why Tor networking and other anonymity techniques have developed.&lt;/p&gt;&#xA;" OwnerUserId="13390" LastActivityDate="2015-02-27T06:17:47.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16946" PostTypeId="2" ParentId="16942" CreationDate="2015-02-27T06:36:52.280" Score="-1" Body="&lt;p&gt;Usually it's because of a misconfigured port channel, e.g. etherchannell configured at one side only.&lt;/p&gt;&#xA;" OwnerUserId="14095" LastActivityDate="2015-02-27T06:36:52.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16947" PostTypeId="1" AcceptedAnswerId="16952" CreationDate="2015-02-27T10:17:09.020" Score="14" ViewCount="54746" Body="&lt;p&gt;DHCP OFFER is a layer3 broadcast because the server doesn't know the client's IP, &lt;em&gt;&lt;strong&gt;but&lt;/strong&gt;&lt;/em&gt; the server knows the client's MAC address. So why does it send the OFFER as L2 broadcast?&lt;/p&gt;&#xA;&lt;p&gt;If anyone ask me about this - how should I answer? Can I say its layer3 broadcast and layer2 unicast?&lt;/p&gt;&#xA;" OwnerUserId="6195" LastEditorUserId="53804" LastEditDate="2023-07-21T22:23:02.187" LastActivityDate="2023-07-21T22:23:02.187" Title="Is a DHCP offer packet a broadcast or unicast?" Tags="|protocol-theory|dhcp|udp|broadcast|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16948" PostTypeId="2" ParentId="16947" CreationDate="2015-02-27T11:07:08.850" Score="3" Body="&lt;p&gt;A DHCP server is answering with a DHCP OFFER to provide an IP address.&#xA;It knows the target MAC and IP, hence will use a unicast IP packet, toward the&#xA;originating Ethernet address, hence a unicast Ethernet frame too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see it for real, just enter the following command on your DHCP server:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;    tcpdump -i&lt;/code&gt;&lt;em&gt;my_ethernet_device&lt;/em&gt;&lt;code&gt;-e src port bootps&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where &lt;em&gt;my_ethernet_device&lt;/em&gt; is the name of the Ethernet interface on which your DHCP server is replying to your network.&lt;/p&gt;&#xA;" OwnerUserId="13986" LastActivityDate="2015-02-27T11:07:08.850" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="16950" PostTypeId="2" ParentId="16942" CreationDate="2015-02-27T11:22:23.750" Score="2" Body="&lt;p&gt;Hunt for an L2 loop or a software misbehaviour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start at 2960G/Gi0/22, and go to the upstream router let's say &lt;strong&gt;R1&lt;/strong&gt;.&#xA;Search on which port is the @MAC: 00:16:3e:64:98:e2, let's say R1/Gi0/7.&#xA;Go to the network equipment connect on R1/Gi0/7, and go ahead until you&#xA;reach the final port which says it sees this @MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this isn't a physical connection to the same machine,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;check for an L2 wireless loop (through a wireless access point),&lt;/li&gt;&#xA;&lt;li&gt;check for a VLAN L2 loop (same VLAN trunked on 2 different ports),&lt;/li&gt;&#xA;&lt;li&gt;check for a rogue repeater, switch or AP,&lt;/li&gt;&#xA;&lt;li&gt;check for a ghost value at the CAM level (clear the port).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13986" LastEditorUserId="13986" LastEditDate="2015-03-01T15:32:14.723" LastActivityDate="2015-03-01T15:32:14.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16951" PostTypeId="1" AcceptedAnswerId="17002" CreationDate="2015-02-27T12:21:02.410" Score="7" ViewCount="5216" Body="&lt;p&gt;On physical layer AUX port works on asynchronous serial RS-232 protocol. However, one can specify various application layer protocols like telnet or SSH as allowed input protocols under AUX line configuration. Am I correct that those protocols are specified only to enable or disable reverse-telnet or reverse-SSH?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="775" LastEditDate="2015-03-02T13:00:44.943" LastActivityDate="2015-03-04T07:14:56.350" Title="&quot;transport input&quot; for AUX port in Cisco routers" Tags="|cisco|cisco-commands|management|cisco-isr|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16952" PostTypeId="2" ParentId="16947" CreationDate="2015-02-27T12:32:33.437" Score="15" Body="&lt;p&gt;Be aware of the broadcast flag, see &lt;a href=&quot;https://www.ietf.org/rfc/rfc2131.txt&quot; rel=&quot;noreferrer&quot;&gt;RFC2131&lt;/a&gt; (page 24):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A client that cannot receive unicast IP datagrams until its&#xA;  protocol&#xA;      software has been configured with an IP address SHOULD set the&#xA;      BROADCAST bit in the 'flags' field to 1 in any DHCPDISCOVER or&#xA;      DHCPREQUEST messages that client sends.  The BROADCAST bit will&#xA;      provide a hint to the DHCP server and BOOTP relay agent to broadcast&#xA;      any messages to the client on the client's subnet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A client that can receive unicast IP datagrams before its protocol software has been configured SHOULD clear the BROADCAST bit to 0. The BOOTP clarifications document discusses the ramifications of the use of the BROADCAST bit.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Added the rest of the RFC. According to the entire paragraph, it could be &lt;strong&gt;&lt;em&gt;either broadcast, or unicast or even both&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13967" LastEditorUserId="37879" LastEditDate="2018-08-20T04:04:05.753" LastActivityDate="2018-08-20T04:04:05.753" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="16953" PostTypeId="1" AcceptedAnswerId="16955" CreationDate="2015-02-27T13:25:27.367" Score="1" ViewCount="432" Body="&lt;p&gt;Will a broadcast on a supernet broadcast address reach all the subnets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if I sent a broadcast to the address 10.172.255.255, would it affect the clients in the subnet 10.172.2.0/24?&lt;/p&gt;&#xA;" OwnerUserId="3688" LastEditorUserId="33" LastEditDate="2015-02-27T14:03:21.850" LastActivityDate="2015-02-27T14:03:21.850" Title="Broadcast to subnet" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16954" PostTypeId="2" ParentId="16947" CreationDate="2015-02-27T13:59:16.787" Score="14" Body="&lt;p&gt;The answer is that it can be either broadcast or unicast - and in some cases both unicast and broadcast before it reaches the client when an &lt;code&gt;ip helper-address&lt;/code&gt; is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A client doesn't actually have an IP address until the DISCOVER-OFFER-REQUEST-ACK exchange is completed.  It is possible (although &lt;em&gt;very&lt;/em&gt; unlikely) to have a situation arise where the server will resond to the REQUEST with a NAK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since unicast is generally preferred over broadcast, many clients will accept a unicast reply that matches their L2 address.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-02-27T13:59:16.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16955" PostTypeId="2" ParentId="16953" CreationDate="2015-02-27T14:02:25.233" Score="4" Body="&lt;p&gt;No, directed broadcast only works on the layer-2 segment that it ends up at. A packet to &lt;code&gt;10.172.255.255&lt;/code&gt; would end up as a broadcast to for example &lt;code&gt;10.172.255.0/24&lt;/code&gt; or &lt;code&gt;10.172.255.128/25&lt;/code&gt; or &lt;code&gt;10.172.254.0/23&lt;/code&gt; or ... etc ... depending on which subnet ends at that address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And that is assuming that a subnet ends there! If the subnet is &lt;code&gt;10.172.0.0/15&lt;/code&gt; then &lt;code&gt;10.172.255.255&lt;/code&gt; is just a normal address in the middle of the subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because causing broadcasts in a remote network is a great way to do a denial of service attack most networks have disabled directed broadcasts. IPv6 doesn't even have them anymore.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-02-27T14:02:25.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16956" PostTypeId="1" AcceptedAnswerId="16959" CreationDate="2015-02-27T15:17:39.363" Score="4" ViewCount="1710" Body="&lt;p&gt;When a host is disconnected, the assigned IP remains unavailable until the end of &quot;lease time&quot; or immediately becomes available to be reassigned?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How DCHP manages this? &lt;/p&gt;&#xA;" OwnerUserId="13851" LastActivityDate="2015-03-02T23:30:11.733" Title="DHCP - Address management during a disconnection" Tags="|dhcp|ip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16957" PostTypeId="1" CreationDate="2015-02-27T16:46:29.193" Score="2" ViewCount="48" Body="&lt;p&gt;If we encrypt the signaling between the phones and call manager but not the voice packets, can the call still be intercepted, reassembled and listened to?&lt;/p&gt;&#xA;" OwnerUserId="14103" LastEditorUserId="13986" LastEditDate="2015-02-27T23:48:02.037" LastActivityDate="2015-02-27T23:48:02.037" Title="Phone signaling encryption" Tags="|security|voice|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16958" PostTypeId="2" ParentId="16873" CreationDate="2015-02-27T17:10:24.883" Score="0" Body="&lt;p&gt;Have you considered requesting a default route only from the ISP?&#xA;This way you do not have to worry with the hardware limitations of receiving large routing tables.&lt;/p&gt;&#xA;" OwnerUserId="14105" LastActivityDate="2015-02-27T17:10:24.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16959" PostTypeId="2" ParentId="16956" CreationDate="2015-02-27T18:47:03.713" Score="7" Body="&lt;p&gt;&lt;strong&gt;If&lt;/strong&gt; the client disconnect &lt;strong&gt;correctly&lt;/strong&gt; through a DHCP Release (Graceful shutdown),&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;then&lt;/strong&gt; the lease ends upon receipt at the DHCP server,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;else&lt;/strong&gt; the lease will expire upon the end of its actual &quot;lease time&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This last case is the most frequent one (due to OS crashing, IP stack misbehaving and terminal leaving the scope of a wireless network).&lt;/p&gt;&#xA;" OwnerUserId="13986" LastEditorUserId="13986" LastEditDate="2015-03-02T23:30:11.733" LastActivityDate="2015-03-02T23:30:11.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16960" PostTypeId="2" ParentId="16957" CreationDate="2015-02-27T19:18:06.067" Score="3" Body="&lt;p&gt;If the voice (also called the &quot;bearer&quot;) traffic is unencrypted, it can  be recovered and decoded.  There are lots of tools to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Signalling traffic flows between the Call Manager an phone (or gateway), while bearer traffic flows directly between phones (or phones and gateways).  They are two separate communication streams.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-02-27T19:18:06.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16963" PostTypeId="2" ParentId="16956" CreationDate="2015-02-28T03:07:09.790" Score="3" Body="&lt;p&gt;&lt;strong&gt;During the DHCP &lt;em&gt;BOUND&lt;/em&gt; state where the client has already obtained an IP address from the server, no further communication will occur between client and server until either...&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The client renewal timer triggers, and the client attempts to extend its lease (DHCPREQUEST during RENEWING state); or,&lt;/li&gt;&#xA;&lt;li&gt;The client releases its lease (DHCPRELEASE during BOUND state).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In both cases, the onus is on the client to initiate the action&lt;/strong&gt;.  The size of the pool of addresses in the DHCP scope, the lease duration, and the churn of clients must be considered so that all addresses are not exhausted.  Reservations should also be considered because those addresses will never be available for the general subnet population.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the event that the client is &lt;strong&gt;unable&lt;/strong&gt; to reach the DHCP server to renew its lease, the client may end up obtaining a different lease from another DHCP server.  The initial server that held the client lease will continue to do so until the lease expires.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2015-02-28T03:12:37.353" LastActivityDate="2015-02-28T03:12:37.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16965" PostTypeId="2" ParentId="13277" CreationDate="2015-02-28T13:46:00.987" Score="3" Body="&lt;p&gt;The use of secondary IP interface addresses on Cisco routers at least do not seem to have major pitfalls necessarily but moreover some limitations I've found it is useful to be aware of.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A flat network using secondary addresses/multiple subnets will avoid the need employ dot1q trunking but will generate more broadcast traffic (if the purpose is to be able to increase the number of hosts).  Depending on design this can impact upon network performance, specifically the hosts/clients.&lt;/li&gt;&#xA;&lt;li&gt;Routing protocols:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In EIGRP neighbour adjacencies will not form on secondary ip addresses full stop.&lt;/li&gt;&#xA;&lt;li&gt;In OSPF then secondary addressed networks are considered as stubs so no hello packets are sent on them and will not form adjacencies either.&lt;/li&gt;&#xA;&lt;li&gt;In BGP then since it acts as an application on top of TCP then its doesn't seem to care if they are primary or secondary due to the TCP process just attempting to match a source address received with an available BGP peer to form neighborship...  So this can work but be careful not to mismatch primary and secondary.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Packets sourced from the router will be from the primary interface address (Routers on a segment should normally agree on what the primary subnet is).&lt;/li&gt;&#xA;&lt;li&gt;Multicast PIM interface configuration needs routers that connect to each other  to use the same subnet as the primary address as opposed to secondary. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To avoid issues then I'll use primary addressing wherever possible and secondary in corner case scenarios.&lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2015-02-28T13:46:00.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16966" PostTypeId="2" ParentId="16939" CreationDate="2015-02-28T14:07:24.797" Score="2" Body="&lt;p&gt;Indeed, you can't filter routes learned from Type 1 LSAs (intra-area routes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A solution would be to filter the routes to get to the rib on the cisco device. This is done with distribute lists. But I guess this is not what you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another solution would be to make the Vyatta routers OSPF ABRs. This way you will be able to filter the Datacenter routes to get advertised to the Cisco routers, because you can filter Type 3 LSAs on ABRs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&#xA;Please let me know if futher clarifications are needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Silviu&lt;/p&gt;&#xA;" OwnerUserId="12080" LastActivityDate="2015-02-28T14:07:24.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16967" PostTypeId="1" CreationDate="2015-02-28T15:17:26.687" Score="2" ViewCount="1876" Body="&lt;p&gt;I am having some trouble figuring out what the most secure method is to secure a Cisco IP Phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find information on how to properly secure the Link between a switchport and a Cisco IP Phone, with a daisy chained computer to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing that I am specifically afraid of is how to secure against Double VLAN tagging and CDP attacks on that port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have searched whichever possible ressource for the answer and haven't found anything useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have a question in terms of port security on a switch: Can you set a minimum amount of Active MAC adresses and then limit the Aging period on MAC adresses on a specific switchport , such that if someone disconnects the phone and sets up a Cisco switch or another Rogue device, then the port should become Shutdown within the aging period.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know, what you would suggest to best secure the line between the Cisco IP phone and the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Casper.&lt;/p&gt;&#xA;" OwnerUserId="14115" LastActivityDate="2015-02-28T21:03:23.527" Title="Switchport security best practises for Cisco IP Phones (Not subjective)" Tags="|vlan|cisco-catalyst|cdp|port-security|cisco-7900-ip-phones|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16968" PostTypeId="2" ParentId="16967" CreationDate="2015-02-28T16:49:38.040" Score="3" Body="&lt;p&gt;I'm not overly familiar with the IP phones other than I know they have the ability to pass traffic to a workstation beyond it, so while I'm pretty sure this answer will work, I offer no guarantees.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How to secure against Double VLAN tagging and CDP attacks on that&#xA;  port.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your easiest way to protect against Double VLAN tagging, is to properly configure your switch. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Don't use VLAN1 for any of your ports. &lt;/li&gt;&#xA;&lt;li&gt;Change the native VLAN on all your trunk ports to an unused VLAN ID. (I personally use VLAN999)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt;For CDP attacks, the easiest way (to me) is to disable CDP on the interface.&lt;/strike&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt;switch(config-if)# no cdp enable &lt;/strike&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;As Mike mentioned in the comments to this answer, Cisco IP phones require CDP to operate.  After looking a little into it, it looks like the general consensus to this fact is while leaving CDP running technically leaves you open to attack, the threat is heavily mitigated through best port security practices.  So make sure your ports are protected from rogue devices and you theoretically should never have an issue.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can you set a minimum amount of Active MAC addresses and then limit&#xA;  the Aging period on MAC addresses on a specific switchport...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For each switch port going to your phones (and workstation)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config-if)# switchport port-security&#xA;switch(config-if)# switchport port-security maximum #&#xA;switch(config-if)# switchport port-security mac-address sticky&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you know how many devices you are going to have you can set the maximum to that; If you know you the actual mac-address of the devices you can set those manually as well.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config-if)# switchport port-security mac-address sticky AAAA.BBBB.CCCC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...such that if someone disconnects the phone and sets up a Cisco switch&#xA;  or another Rogue device, then the port should become Shutdown within&#xA;  the aging period.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To protect against a rogue switch, I use the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config-if)# spanning-tree port fast bpduguard&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This puts the port into err-disabled as soon as it detects a BPDU, which should only be coming from a switch.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Of course best practice is to have strong physical control over your equipment, but I'm sure we all know that is nigh impossible sometimes.  As I said, I'm not familiar with IP phone setups, so this whole answer may be wrong.  If I find something refuting this answer or other wise, I'll update as necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="13998" LastEditorUserId="13998" LastEditDate="2015-02-28T17:06:56.730" LastActivityDate="2015-02-28T17:06:56.730" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="16969" PostTypeId="2" ParentId="16967" CreationDate="2015-02-28T21:03:23.527" Score="2" Body="&lt;p&gt;Whenever someone asks what is the most secure way to do something, I always wonder if that's what they would really want if they consider the costs of doing so.   Implementing security controls have a cost associated with them -- the additional time and effort it takes to implement, maintain and troubleshoot the security features, along with the effects they have on productivity, reliability, and availability. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not always clear that the benefits of the added security are worth the costs of implementing them.  For example, consider the mac-address sticky command. It sounds good at first blush, but what happens when the phone or PC is moved?  Someone has  to change the config on the switch.  Depending on the size of the organization, that can take a while.  I've seen office moves that were not coordinated with the network team.  As a result, dozens of people couldn't do their work until the switch was reconfigured.  The helpdesk took a lot of angry phone calls that day. Do you think the office moving team took the blame?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The maximum mac address value is usually set too low (IMO).  The purpose of the command is to prevent address table overflows. But many administrators set it very low (3, for example) to limit what can be plugged into a port.  Again, if someone moves a computer, or replaces a phone, they're locked out and the helpdesk has to intervene.  If you set the maximum to something like 10, you still protect the switch from overflows, but you also eliminate most of the headaches and user complaints. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not saying one shouldn't use these commands.  But rather, you should consider if the protection you're getting is worth the cost to your users. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-02-28T21:03:23.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16970" PostTypeId="2" ParentId="13277" CreationDate="2015-02-28T21:09:31.033" Score="2" Body="&lt;p&gt;In addition to and in support of the existing answer's conclusion:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondary addresses do not support DHCP if the Cisco router is acting as the DHCP relay agent.  The router will insert it's primary interface IP address into the DHCP request and the remote server will never see a request for the secondary subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding the secondary IP address can change well-known/default behaviors, some IOS and IOS/hardware combinations will disable IP redirects or enable specific CEF functions to support the secondary address feature. Also removing the secondary address will automatically re-enable IP redirects, even if the command was specifically configured on the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sourcing packets from the secondary address can also be problematic (either for management or troubleshooting), as some commands do not support the &lt;code&gt;source-address&lt;/code&gt; option and only offer &lt;code&gt;source-interface&lt;/code&gt; which will use the primary interface IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally semi-technical customer admins/users can become easily confused if the network or server is described generally (as in 'vlan ## can't reach server xxx' or 'server yyy is on vlan ##') since the vlan has two subnets attached.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-02-28T21:09:31.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16971" PostTypeId="1" AcceptedAnswerId="16975" CreationDate="2015-02-28T21:18:14.217" Score="6" ViewCount="9120" Body="&lt;p&gt;I recently acquired a Juniper EX2200-24T-4G switch, but I have some issues getting it up and running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I power on the switch the boot process looks normal, but after some time it suddenly turns up with some errors and after that it automatically reboots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to reinstall Junos through the &lt;code&gt;loader&amp;gt;&lt;/code&gt; prompt, but it just fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Software version installed is 12.3R7.7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no clue, why it's doing this, can someone explain how to solve the problem?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;---------- BOOT PROCESS ----------&#xA;&#xA;U-Boot 1.1.6 (Nov 22 2009 - 07:01:21)&#xA;&#xA;Board: EX2200-24T-4G 4.12&#xA;EPLD:  Version 04.100311 (0x02)&#xA;DRAM:  Initializing (512MB)&#xA;Flash: 8 MB&#xA;USB:   scanning bus for devices... 3 USB Device(s) found&#xA;       scanning bus for storage devices... 1 Storage Device(s) found&#xA;&#xA;ELF file is 32 bit&#xA;Consoles: U-Boot console&#xA;&#xA;FreeBSD/arm U-Boot loader, Revision 1.0&#xA;(Wed Nov 18 14:02:39 PST 2009)&#xA;Memory: 512MB&#xA;Loading /boot/defaults/loader.conf&#xA;/kernel data=0x885980+0xdde78 syms=[0x4+0xf0b60+0x4+0xc81f4]&#xA;&#xA;&#xA;Hit [Enter] to boot immediately, or space bar for command prompt.&#xA;Booting [/kernel]...&#xA;Kernel entry at 0x1400100 ...&#xA;GDB: debug ports: uart&#xA;GDB: current port: uart&#xA;KDB: debugger backends: ddb gdb&#xA;KDB: current backend: ddb&#xA;Copyright (c) 1996-2014, Juniper Networks, Inc.&#xA;All rights reserved.&#xA;Copyright (c) 1992-2006 The FreeBSD Project.&#xA;Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994&#xA;    The Regents of the University of California. All rights reserved.&#xA;JUNOS 12.3R7.7 #0: 2014-06-12 14:14:29 UTC&#xA;    /volume/build/junos/12.3/release/12.3R7.7/obj-arm/junos/bsd/kernels/JUNIPER-EX-2200/kernel&#xA;can't re-use a leaf (all_slot_serialid)!&#xA;CPU: Feroceon 88FR131 rev 1 (Marvell core)&#xA;cpu53: Feroceon 88FR131 revision   WB enabled EABT branch prediction enabled&#xA;  16KB/32B 4-way Instruction cache&#xA;  16KB/32B 4-way write-back-locking-C Data cache&#xA;real memory  = 536870912 (512 MB)&#xA;avail memory = 503222272 (479 MB)&#xA;SOC: Marvell 88F6281 rev A0, TClock 200MHz&#xA;Security policy loaded: Junos MAC/veriexec (mac_veriexec)&#xA;MAC/veriexec fingerprint module loaded: SHA256&#xA;MAC/veriexec fingerprint module loaded: SHA1&#xA;ETHERNET SOCKET BRIDGE initialising&#xA;Initializing EXSERIES properties ...&#xA;mbus0: &amp;lt;Marvell Internal Bus (Mbus)&amp;gt; on motherboard&#xA;ic0: &amp;lt;Marvell Integrated Interrupt Controller&amp;gt; at mem 0xf1020200-0xf102023b on mbus0&#xA;timer0: &amp;lt;Marvell CPU Timer&amp;gt; at mem 0xf1020300-0xf102032f irq 1 on mbus0&#xA;gpio0: &amp;lt;Marvell Integrated GPIO Controller&amp;gt; at mem 0xf1010100-0xf101011f irq 35,36,37,38,39,40,41 on mbus0&#xA;uart0: &amp;lt;16550 or compatible&amp;gt; at mem 0xf1012000-0xf101201f irq 33 on mbus0&#xA;uart0: console (9600,n,8,1)&#xA;uart1: &amp;lt;16550 or compatible&amp;gt; at mem 0xf1012100-0xf101211f irq 34 on mbus0&#xA;ehci0: &amp;lt;88F5XXX Integrated USB 2.0 controller&amp;gt; at mem 0xf1050000-0xf1050fff irq 48,19 on mbus0&#xA;usb0: EHCI version 1.0&#xA;usb0 on ehci0&#xA;usb0: USB revision 2.0&#xA;uhub0: Marvell EHCI root hub, class 9/0, rev 2.00/1.00, addr 1&#xA;uhub0: 1 port with 1 removable, self powered&#xA;uhub1: vendor 0x04cc product 0x1520, class 9/0, rev 2.00/2.00, addr 2&#xA;uhub1: single transaction translator&#xA;uhub1: 2 ports with 2 removable, self powered&#xA;umass0: STMicroelectronics ST72682  High Speed Mode, rev 2.00/2.10, addr 3&#xA;mge0: &amp;lt;Marvell Gigabit Ethernet controller&amp;gt; at mem 0xf1072000-0xf1073fff irq 12,13,14,11,46 on mbus0&#xA;miibus0: &amp;lt;MII bus&amp;gt; on mge0&#xA;e1000phy0: &amp;lt;Marvell 88E1118 Gigabit PHY&amp;gt; on miibus0&#xA;e1000phy0:  10baseT, 10baseT-FDX, 100baseTX, 100baseTX-FDX, 1000baseTX-FDX, auto&#xA;i2c0: &amp;lt;Marvell I2C ARM OnChip Controller&amp;gt; at mem 0xf1011000-0xf101101f irq 29 on mbus0&#xA;syspld0: &amp;lt;SYSPLD&amp;gt; on i2c0&#xA;8564 rtc0: &amp;lt;8564 RTC&amp;gt; on i2c0&#xA;poe0: &amp;lt;POE&amp;gt; on i2c0&#xA;poe_attach: re-types method failed&#xA;device_attach: poe0 attach returned 19&#xA;cfi0: &amp;lt;SPI flash - 8MB&amp;gt; at mem 0xf1010600-0xf101062f,0xf8000000-0xf87fffff irq 23 on mbus0&#xA;mpfe0: &amp;lt;Juniper EX-series Packet Forwarding Engine&amp;gt; at mem 0xf4000000-0xf7ffffff irq 113 on mbus0&#xA;pcib0: &amp;lt;Marvell 88F6281 PCI-Express host controller&amp;gt; at mem 0xf1040000-0xf1041fff,0xe8000000-0xefffffff irq 9 on mbus0&#xA;pci0: &amp;lt;PCI bus&amp;gt; on pcib0&#xA;Initializing product: 75 ..&#xA;bmeb: bmeb_lib_init done 0xc3386800, addr 0xc1d5d7a4&#xA;bme0:Virtual BME driver initializing&#xA;Timecounter &quot;CPU Timer&quot; frequency 200000000 Hz quality 1000&#xA;###PCB Group initialized for udppcbgroup&#xA;###PCB Group initialized for tcppcbgroup&#xA;da0 at umass-sim0 bus 0 target 0 lun 0&#xA;da0: &amp;lt;ST ST72682 2.10&amp;gt; Removable Direct Access SCSI-2 device&#xA;da0: 40.000MB/s transfers&#xA;da0: 1000MB (2048000 512 byte sectors: 64H 32S/T 1000C)&#xA;Kernel thread &quot;wkupdaemon&quot; (pid 42) exited prematurely.&#xA;Trying to mount root from ufs:/dev/da0s2a&#xA;Invalid time in real time clock.&#xA;Check and reset the date immediately!&#xA;Attaching /packages/jbase via /dev/mdctl...&#xA;Mounted jbase package on /dev/md0...&#xA;Verified manifest signed by PackageProduction_12_3_0&#xA;Verified jboot signed by PackageProduction_12_3_0&#xA;Verified jbase-ex-12.3R7.7 signed by PackageProduction_12_3_0&#xA;Mounted fips-mode-arm package on /dev/md1...&#xA;Verified manifest signed by PackageProduction_12_3_0&#xA;Verified fips-mode-arm-12.3R7.7 signed by PackageProduction_12_3_0&#xA;Mounted jcrypto-ex package on /dev/md2...&#xA;Verified manifest signed by PackageProduction_12_3_0&#xA;Verified jcrypto-ex-12.3R7.7 signed by PackageProduction_12_3_0&#xA;Mounted jdocs-ex package on /dev/md3...&#xA;Verified manifest signed by PackageProduction_12_3_0&#xA;Verified jdocs-ex-12.3R7.7 signed by PackageProduction_12_3_0&#xA;Mounted jkernel-ex-2200 package on /dev/md4...&#xA;Verified manifest signed by PackageProduction_12_3_0&#xA;Verified jkernel-ex-2200-12.3R7.7 signed by PackageProduction_12_3_0&#xA;Mounted jpfe-ex22x package on /dev/md5...&#xA;Verified manifest signed by PackageProduction_12_3_0&#xA;Verified jpfe-ex22x-12.3R7.7 signed by PackageProduction_12_3_0&#xA;Mounted jroute-ex package on /dev/md6...&#xA;Verified manifest signed by PackageProduction_12_3_0&#xA;Verified jroute-ex-12.3R7.7 signed by PackageProduction_12_3_0&#xA;Mounted jswitch-ex package on /dev/md7...&#xA;Verified manifest signed by PackageProduction_12_3_0&#xA;Verified jswitch-ex-12.3R7.7 signed by PackageProduction_12_3_0&#xA;Mounted jweb-ex package on /dev/md8...&#xA;Verified manifest signed by PackageProduction_12_3_0&#xA;Verified jweb-ex-12.3R7.7 signed by PackageProduction_12_3_0&#xA;Executing /packages/mnt/jweb-ex-12.3R7.7/mount.post..&#xA;Automatic reboot in progress...&#xA;Media check on da0 on ex platforms&#xA;camcontrol: error sending command&#xA;(pass0:umass-sim0:0:0:0): Vendor Specific Command. CDB: f1&#xA;(pass0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(pass0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(pass0:umass-sim0:0:0:0): DATA PROTECT asc:27,0&#xA;(pass0:umass-sim0:0:0:0): Write protected&#xA;camcontrol: error sending command&#xA;** /dev/da0s2a&#xA;FILE SYSTEM CLEAN; SKIPPING CHECKS&#xA;clean, 37042 free (10 frags, 4629 blocks, 0.0% fragmentation)&#xA;(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 1a 5e 80 0 0 20 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): DATA PROTECT asc:27,0&#xA;(da0:umass-sim0:0:0:0): Write protected&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;** /dev/da0s3e&#xA;** Last Mounted on /var&#xA;** Phase 1 - Check Blocks and Sizes&#xA;PARTIALLY TRUNCATED INODE I=12363&#xA;SALVAGE? yes&#xA;&#xA;&#xA;CANNOT WRITE BLK: 194176&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 194176, 194177, 194178, 194179, 194180, 194181, 194182, 194183, 194184, 194185, 194186, 194187, 194188, 194189, 194190, 194191, 194192, 194193, 194194, 194195, 194196, 194197, 194198, 194199, 194200, 194201, 194202, 194203, 194204, 194205, 194206, 194207,&#xA;-1 BAD I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;1 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;2 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;3 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;4 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;5 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;6 DUP I=12363&#xA;UNE(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 1a 5e 54 0 0 1 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): DATA PROTECT asc:27,0&#xA;(da0:umass-sim0:0:0:0): Write protected&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;XPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;-1 BAD I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;1 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;2 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;3 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;4 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;5 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;EXCESSIVE DUP BLKS I=12363&#xA;CONTINUE? yes&#xA;&#xA;INCORRECT BLOCK COU(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 1a 5e 55 0 0 1 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): ILLEGAL REQUEST asc:20,0&#xA;(da0:umass-sim0:0:0:0): Invalid command operation code&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;NT I=12363 (2592 should be 472)&#xA;CORRECT? yes&#xA;&#xA;INTERNAL ERROR: dups with -p&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;** Phase 1b - Rescan For More DUPS&#xA;&#xA;CANNOT WRITE BLK: 192096&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 192096, 192097, 192098, 192099, 192100, 192101, 192102, 192103, 192104, 192105, 192106, 192107, 192108, 192109, 192110, 192111, 192112, 192113, 192114, 192115, 192116, 192117, 192118, 192119, 192120, 192121, 192122, 192123, 192124, 192125, 192126, 192127,&#xA;1 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;2 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;3 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;4 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;5 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;6 DUP I=12363&#xA;UNEXPECTED SOFT UPDATE INCONSISTENC(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 1a 5e 57 0 0 1 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): DATA PROTECT asc:27,0&#xA;(da0:umass-sim0:0:0:0): Write protected&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;Y&#xA;&#xA;** Phase 2 - Check Pathnames&#xA;DIRECTORY CORRUPTED  I=12481  OWNER=39 MODE=40775&#xA;SIZE=512 MTIME=Sep 30 09:15 2014&#xA;DIR=?&#xA;&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;SALVAGE? yes&#xA;&#xA;MISSING '.'  I=12481  OWNER=39 MODE=40775&#xA;SIZE=512 MTIME=Sep 30 09:15 2014&#xA;DIR=?&#xA;&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;FIX? yes&#xA;&#xA;DIRECTORY CORRUPTED  I=12484  OWNER=0 MODE=41777&#xA;SIZE=512 MTIME=Sep 30 09:15 2014&#xA;DIR=?&#xA;&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;SALVAGE? yes&#xA;&#xA;MISSING '.'  I=12484  OWNER=0 MODE=41777&#xA;SIZE=512 MTIME=Sep 30 09:15 2014&#xA;DIR=?&#xA;&#xA;UNEXPECTED SOFT(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 17 6c c0 0 0 20 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): ILLEGAL REQUEST asc:20,0&#xA;(da0:umass-sim0:0:0:0): Invalid command operation code&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA; UPDATE INCONSISTENCY&#xA;&#xA;FIX? yes&#xA;&#xA;&#xA;CANNOT WRITE BLK: 194128&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 194128, 194129, 194130, 194131,&#xA;&#xA;CANNOT WRITE BLK: 194132&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 194132, 194133, 194134, 194135,&#xA;DUP/BAD  I=12363  OWNER=0 MODE=100640&#xA;SIZE=1297280 MTIME=Sep 30 10:01 2014&#xA;FILE=/log/chassisd&#xA;&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;REMOVE? yes&#xA;&#xA;MISSING '..'  I=12481  OWNER=39 MODE=40775&#xA;SIZE=512 MTIME=Sep 30 09:15 2014&#xA;DIR=/log/ext&#xA;&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;FIX? yes&#xA;&#xA;DIRECTORY CORRUPTED  I=12481  OWNER=39 MODE=40775&#xA;SIZE=512 MTIME=Sep 30 09:15 2014&#xA;DIR=?&#xA;&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;SALVAGE? yes&#xA;&#xA;MISSING '..'  I=12484  OWNER=0 MODE=41777&#xA;SIZE=51(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 17 6c c1 0 0 1 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): DATA PROTECT asc:27,0&#xA;(da0:umass-sim0:0:0:0): Write protected&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;2 MTIME=Sep 30 09:15 2014&#xA;&#xA;CANNOT WRITE BLK: 255976&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 255976, 255977, 255978, 255979,&#xA;&#xA;CANNOT WRITE BLK: 194128&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 194128, 194129, 194130, 194131,&#xA;DIR=/log/ggsn&#xA;&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;FIX? yes&#xA;&#xA;DIRECTORY C(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 17 6c c2 0 0 1 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): ILLEGAL REQUEST asc:20,0&#xA;(da0:umass-sim0:0:0:0): Invalid command operation code&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;ORRUPTED  I=12484  OWNER=0 MODE=41777&#xA;SIZE=512 MTIME=Sep 30 09:15 2014&#xA;DIR=?&#xA;&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;SALVAGE? yes&#xA;&#xA;** Phase 3 - Check Connectivity&#xA;UNREF DIR  I=12485  OWNER=0 MODE=41777&#xA;SIZE=512 MTIME=Sep 30 09:15 2014&#xA;(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 17 6c c4 0 0 1 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): DATA PROTECT asc:27,0&#xA;(da0:umass-sim0:0:0:0): Write protected&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;RECONNECT? yes&#xA;&#xA;&#xA;CANNOT WRITE BLK: 194132&#xA;UNEXPECTED SOFT UPWARNING: /var was not properly dismounted&#xA;DATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 194132, 194133, 194134, 194135,&#xA;DIR I=12485 CONNECTED. PARENT WAS I=12484&#xA;&#xA;** Phase 4 - Check Reference Counts&#xA;BAD/DUP FILE I=12363  OWNER=0 MODE=100640&#xA;SIZE=1297280 MTIME=Sep 30 10:01 2014&#xA;CLEAR? yes&#xA;&#xA;&#xA;CANNOT WRITE BLK: 1216&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 1216, 1217, 1218, 1219, 1220, 1221, 1222, 1223, 1224, 1225, 1226, 1227, 1228, 1229, 1230, 1231, 1232, 1233, 1234, 1235, 1236, 1237, 1238, 1239, 1240, 1241,(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 17 6c 60 0 0 4 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): ILLEGAL REQUEST asc:20,0&#xA;(da0:umass-sim0:0:0:0): Invalid command operation code&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA; 1242, 1243, 124g_vfs_done():da0s3e[WRITE(offset=573440, length=2048)]error = 22&#xA;4, 1245, 1246, 1247,&#xA;LINK COUNT DIR I=12484  OWNER=0 MODE=41777&#xA;SIZE=512 MTIME=Sep 30 09:15 2014  COUNT 3 SHOULD BE 2&#xA;ADJUST? yes&#xA;&#xA;** Phase 5 - Check Cyl groups&#xA;FREE BLK COUNT(S) WRONG IN SUPERBLK&#xA;SALVAGE? yes&#xA;&#xA;SUMMARY INFORMATION BAD&#xA;SALVAGE? yes&#xA;&#xA;BLK(S) MISSING IN BIT MAPS&#xA;SALVAGE? yes&#xA;&#xA;&#xA;CANNOT WRITE BLK: 64&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 64, 65, 66, 67, 68, 69, 70, 71,&#xA;1107 files, 2485 used, 60417 free (265 frags, 7519 blocks, 0.4% fragmentation)&#xA;&#xA;CANNOT WRITE BLK: 16&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31,&#xA;&#xA;CANNOT WRITE BLK: 1120&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 1120, 1121, 1122, 1123,&#xA;&#xA;CANNOT WRITE BLK: 192064&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 192064, 192065, 192066, 192067, 192068, 192069, 192070, 192071,&#xA;&#xA;CANNOT WRITE BLK: 197208&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 197208, 197209, 197210, 197211,&#xA;&#xA;CANNOT WRITE BLK: 96&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 96, 97, 98, 99, 100, 101, 102, 103, 104, 105, 106, 107, 108, 109, 110, 111, 112, 113, 114, 115, 116, 117, 118, 119, 120, 121, 122, 123, 124, 125, 126, 127,&#xA;&#xA;CANNOT WRITE BLK: 192096&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 192096, 192097, 192098, 192099, 192100, 192101, 192102, 192103, 192104, 192105, 192106, 192107, 192108, 192109, 192110, 192111, 192112, 192113, 192114, 192115, 192116, 192117, 192118, 192119, 192120, 192121, 192122, 192123, 192124, 192125, 192126, 192127,&#xA;&#xA;CANNOT WRITE BLK: 192128&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 192128, 192129, 192130, 192131, 192132, 192133, 192134, 192135, 192136, 192137, 192138, 192139, 192140, 192141, 192142, 192143, 192144, 192145, 192146, 192147, 192148, 192149, 192150, 192151, 192152, 192153, 192154, 192155, 192156, 192157, 192158, 192159,&#xA;&#xA;***** FILE SYSTEM STILL DIRTY *****&#xA;&#xA;***** PLEASE RERUN FSCK *****&#xA;Computing slice and partition sizes for /dev/da0 ...&#xA;savecore: could not be determined&#xA;No dump exists&#xA;(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 17 6c 60 0 0 4 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): DATA PROTECT asc:27,0&#xA;(da0:umass-sim0:0:0:0): Write protected&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;** /dev/da0s3d&#xA;&#xA;CANNOT READ BLK: 128&#xA;CONTINUE? yes&#xA;&#xA;THE FOLWARNING: /var/tmp was not properly dismounted&#xA;LOWING DISK SECTORS COULD NOT BE READ:&#xA;** Last Mounted on /var/tmp&#xA;** Phase 1 - Check Blocks and Sizes&#xA;** Phase 2 - Check Pathnames&#xA;** Phase 3 - Check Connectivity&#xA;** Phase 4 - Check Reference Counts&#xA;** Phase 5 - Check Cyl groups&#xA;10 files, 69 used, 188785 free (33 frags, 23594 blocks, 0.0% fragmentation)&#xA;&#xA;CANNOT WRITE BLK: 16&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31,&#xA;&#xA;CANNOT WRITE BLK: 3104&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 3104, 3105, 3106, 3107,&#xA;&#xA;***** FILE SYSTEM MARKED CLEAN *****&#xA;(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 b b1 10 0 0 4 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): DATA PROTECT asc:27,0&#xA;(da0:umass-sim0:0:0:0): Write protected&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;** /dev/da0s4d&#xA;&#xA;CANNOT READ BLK: 128&#xA;CONTINUE? yes&#xA;&#xA;THE FOLWARNING: /config was not properly dismounted&#xA;LOWING DISK SECTORS COULD NOT BE READ:&#xA;** Last Mounted on /config&#xA;** Phase 1 - Check Blocks and Sizes&#xA;** Phase 2 - Check Pathnames&#xA;** Phase 3 - Check Connectivity&#xA;** Phase 4 - Check Reference Counts&#xA;** Phase 5 - Check Cyl groups&#xA;42 files, 49 used, 31557 free (37 frags, 3940 blocks, 0.1% fragmentation)&#xA;&#xA;CANNOT WRITE BLK: 16&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? yes&#xA;&#xA;THE FOLLOWING SECTORS COULD NOT BE WRITTEN: 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31,&#xA;&#xA;CANNOT WRITE BLK: 608&#xA;UNEXPECTED SOFT UPDATE INCONSISTENCY&#xA;&#xA;CONTINUE? (da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 1b 53 60 0 0 4 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): DATA PROTECT asc:27,0&#xA;(da0:umass-sim0:0:0:0): Write protected&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;yes&#xA;&#xA;THE FOLLOg_vfs_done():da0s4d[WRITE(offset=311296, length=2048)]error = 13&#xA;WING SECTORS COULD NOT BE WRITTEN: 608, 609, 610, 611,&#xA;&#xA;***** FILE SYSTEM MARKED CLEAN *****&#xA;(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 17 6d 60 0 0 20 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): ILLEGAL REQUEST asc:20,0&#xA;(da0:umass-sim0:0:0:0): Invalid command operation code&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;initiate_write_filepage: already started&#xA;initiate_write_filepage: already started&#xA;(da0:umass-sim0:0:0:0): WRITE(10). CDB: 2a 0 0 18 66 6c 0 0 4 0&#xA;(da0:umass-sim0:0:0:0): CAM Status: SCSI Status Error&#xA;(da0:umass-sim0:0:0:0): SCSI Status: Check Condition&#xA;(da0:umass-sim0:0:0:0): DATA PROTECT asc:27,0&#xA;(da0:umass-sim0:0:0:0): Write protected&#xA;(da0:umass-sim0:0:0:0): Unretryable error&#xA;g_vfs_done():da0s3e[WRITE(offset=33978368, length=2048)]error = 5&#xA;panic: initiate_write_inodeblock_ufs1: already started&#xA;Uptime: 5m14s&#xA;Cannot dump. No dump device defined.&#xA;Automatic reboot in 15 seconds - press a key on the console to abort&#xA;Rebooting...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13421" LastEditorUserId="775" LastEditDate="2015-02-28T21:54:48.590" LastActivityDate="2015-05-20T15:45:58.553" Title="Juniper EX2200 can't boot" Tags="|switch|troubleshooting|juniper-junos|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16972" PostTypeId="2" ParentId="16390" CreationDate="2015-02-28T21:20:33.003" Score="2" Body="&lt;p&gt;If you are specifically looking to speed convergence or lower CPU usage, then asking your providers if they offer a customers+peers+default route option would be the simple solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your full-table convergence time/CPU load is acceptable, configuring an as-path-list to limit the number of prefixes you use by AS-Path count provides you more flexibility in the future without involving your provider(s).  This can be simpler to support as the providers are providing you full information and limits the number of changes you need to request from third parties (especially important if you scale past 2 providers...) if you ever do need additional/different routing information.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-02-28T21:20:33.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16974" PostTypeId="2" ParentId="3781" CreationDate="2015-02-28T23:56:03.500" Score="0" Body="&lt;p&gt;Here's an example of whe LSA 2 could be useful (not found in the original answer):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1----|----R2----|----R3 - all connected on broadcast medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say R3 link goes down:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1----|----R2----|&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2 will detect R3 going down when the dead timer expires. But how does R1 find out about R3 going down, because R2 will not change it's type 1 LSA (R2's link towards R3 is still up). The answer is that R2 will flood a type 2 LSA in which it says R3 is not part of the pseudonode anymore. Upon receiving this update, R1 will delete the routes that used R3 as transit. Interestingly, R1 still has R3 type 1 LSA. It just sees that the graph is interrupted (from the type 2 lsa sent by R2).&lt;/p&gt;&#xA;" OwnerUserId="12080" LastActivityDate="2015-02-28T23:56:03.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16975" PostTypeId="2" ParentId="16971" CreationDate="2015-03-01T00:03:14.227" Score="4" Body="&lt;p&gt;All the SCSI errors indicate a broken disk, or a disk about to break. Request an RMA at JTAC if you have support. If not, you may be able to find some hints on the internet on how to replace the disk, I personally haven't tried that.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-03-01T00:03:14.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="16976" PostTypeId="1" AcceptedAnswerId="16977" CreationDate="2015-03-01T00:04:40.927" Score="3" ViewCount="606" Body="&lt;p&gt;If I want to advertise an OSPF default into an NSSA, why does the area need explicit configuration to advertise a default route:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A Totally Stubby NSSA (advertise a Type 3 summary LSA default route via the &lt;code&gt;no-summary keyword&lt;/code&gt; on the ABR)&lt;/li&gt;&#xA;&lt;li&gt;The ABR / ASBR (advertise a Type 7 LSA default route - &lt;code&gt;default-information-originate keyword&lt;/code&gt; on the ABR)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is in contrast with the a stub area where the ABR advertises the Type 3 summary LSA default route without extra config.&lt;/p&gt;&#xA;" OwnerUserId="12080" LastEditorUserId="775" LastEditDate="2015-03-01T01:14:31.880" LastActivityDate="2015-03-01T02:31:59.190" Title="stub vs nssa ospf" Tags="|routing|ospf|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16977" PostTypeId="2" ParentId="16976" CreationDate="2015-03-01T02:31:59.190" Score="4" Body="&lt;p&gt;The reason you need to explicitly inject a default route into a NSSA area is because the external route(s) you are injecting could also be (and often is) a default route.  If you redistribute a default route (for example, a static route) into an NSSA, that would conflict with the type 3 default route from the ABR.  To avoid that problem, the type 3 default route is optional.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-01T02:31:59.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16979" PostTypeId="1" AcceptedAnswerId="16992" CreationDate="2015-03-01T07:56:06.913" Score="4" ViewCount="584" Body="&lt;p&gt;Consider the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show ip bgp vpnv4 rd 300:1  5.5.5.5/26&#xA;BGP routing table entry for 300:1:5.5.5.5/26, version 538213&#xA;Paths: (2 available, best #2, no table)&#xA;  Advertised to update-groups:&#xA;     1&#xA;  Refresh Epoch 1&#xA;  Local, (Received from a RR-client)&#xA;    8.20.2.1 (metric 30) from 8.20.2.1 (8.20.2.1)&#xA;      Origin incomplete, metric 5222400, localpref 100, valid, internal&#xA;      Extended Community: SoO:80:13 RT:300:1&#xA;        Cost:pre-bestpath:129:5222400 (default-2142261247) 0x8800:0:0&#xA;        0x8801:80:258560 0x8802:65281:25600 0x8803:1:1500 0x8804:0:60293292&#xA;        0x8805:3:0&#xA;      Connector Attribute: count=1&#xA;       type 1 len 12 value 300:1:8.20.2.1&#xA;      mpls labels in/out nolabel/24059&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 1&#xA;  Local, (Received from a RR-client)&#xA;    8.20.2.2 (metric 30) from 8.20.2.2 (8.20.2.2)&#xA;      Origin incomplete, metric 107520, localpref 100, valid, internal, best&#xA;      Extended Community: SoO:80:13 RT:300:1 Cost:pre-bestpath:129:107520&#xA;        0x8800:0:0 0x8801:80:2816 0x8802:65281:25600 0x8803:1:1500&#xA;        0x8804:0:60293292 0x8805:3:0&#xA;      Connector Attribute: count=1&#xA;       type 1 len 12 value 300:1:8.20.2.2&#xA;      mpls labels in/out nolabel/24056&#xA;      rx pathid: 0, tx pathid: 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm redistributing from EIGRP to iBGP here and by putting delay on a specific interface within the LAN, I've changed the metric value for 3.20.2.1 to &lt;strong&gt;metric 5222400&lt;/strong&gt;&#xA;The path for 8.20.2.2 is then set as best since it has a smaller metric of &lt;strong&gt;metric 107520&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How exactly is the metric there calculated? I'm assuming its part of some eigrp to bgp delay formula but I cannot find any specific information to how it relates on Cisco's documentation so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="343" LastEditorUserId="775" LastEditDate="2015-03-02T00:15:13.250" LastActivityDate="2015-03-02T00:15:13.250" Title="EIGRP to iBGP metric calculation" Tags="|cisco|bgp|eigrp|mpls-vpn|redistribution|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16984" PostTypeId="2" ParentId="16390" CreationDate="2015-03-01T15:18:52.420" Score="1" Body="&lt;p&gt;I would suggest you to accept a full BGP feed from your providers since one day or another you might need to access a route which is a /24 prefix and announced by only one of your neighbours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just need to insure you have a full visibility of the 400k routes of the Internet here is a personal receipe I would try to reduce your router convergence time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say you have 2 BGP neighbours AS1 and AS2.&#xA;For the 2 feeds, define a prefix-list so as to reject any route that will contain the other BGP neighbour AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In front of AS1, reject every AS path that will contain AS2.&#xA;In front of AS2, reject every AS path that will contain AS1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence an AS path which is provided by your 2 neighbours will never lead to a&#xA;computation.&#xA;A route accessible through only one of your neighbours will never be eliminated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The risk is that a route like: AS1 - AS2 - AS3, which is a shorter route than the one: AS2 - AS3, will be rejected. But this &quot;coming from behind&quot; route being the best is a rare practical case.&lt;/p&gt;&#xA;" OwnerUserId="13986" LastActivityDate="2015-03-01T15:18:52.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16990" PostTypeId="1" AcceptedAnswerId="16991" CreationDate="2015-03-01T21:55:58.453" Score="0" ViewCount="2374" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/FGItk.jpg&quot; alt=&quot;this is my network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this network, but actually pinging between vlans never works.  Vlan 10 can ping between its pcs; the same is true for vlan 20, but I can't ping between pcs in different vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if I forgot any command or made a mistake, I'm confused.  How can I fix this problem?&lt;/p&gt;&#xA;" OwnerUserId="14133" LastEditorUserId="8499" LastEditDate="2018-12-21T05:22:12.257" LastActivityDate="2018-12-21T05:22:12.257" Title="Inter vlan can not ping each other" Tags="|cisco|routing|switch|router|ping|" AnswerCount="1" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16991" PostTypeId="2" ParentId="16990" CreationDate="2015-03-01T23:05:33.427" Score="0" Body="&lt;p&gt;I configured switch 0 with vtp mode server and set a domain name and password ,&#xA;and configured switches 1 and 2 as vtp clients with same domain name and password &#xA;it works :) , thanks for you all..&lt;/p&gt;&#xA;" OwnerUserId="14133" LastActivityDate="2015-03-01T23:05:33.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16992" PostTypeId="2" ParentId="16979" CreationDate="2015-03-02T00:05:27.847" Score="5" Body="&lt;p&gt;Since Cisco controls the EIGRP spec, they automatically provide additional information to BGP when EIGRP is advertised/redistributed into an MPLS VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This excerpt from Cisco's &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/seipecec.html&quot; rel=&quot;noreferrer&quot;&gt;MPLS VPN support for EIGRP&lt;/a&gt; page gives the following details (emphasis mine):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP Connectivity Between VPN Client Sites over a Service Provider Backbone&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Figure 1, the EIGRP routes in Site 1 are carried through the BGP core network as iBGP routes. &lt;strong&gt;The EIGRP routes in &quot;Site 1&quot; and &quot;Site 2&quot; are converted to iBGP routes and EIGRP extended community attributes are appended to the iBGP routes.&lt;/strong&gt; (See Table 1 for a description of these attributes.) &lt;strong&gt;The EIGRP extended community attributes are appended to the EIGRP routes when they are redistributed into BGP as iBGP routes, and VPN routing information is redistributed between the PE routers by multiprotocol BGP.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routes that originate in &quot;Site 1&quot; travel to the PE router that is connected to the CE router in &quot;Site 2&quot; of the VPN and are then converted back to EIGRP routes using the EIGRP extended community attributes. EIGRP routes are treated the same in &quot;Site 1&quot; and &quot;Site 2.&quot; If the route is internal in &quot;Site 1&quot;, it will be internal in &quot;Site 2&quot;, and if the route is external in &quot;Site 1&quot;, it will be external in &quot;Site 2.&quot; &lt;strong&gt;All EIGRP metrics are preserved, and EIGRP metric information, along with the autonomous system, tag, and external data, is carried across the VPN over the BGP core network.&lt;/strong&gt; &lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-03-02T00:05:27.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16993" PostTypeId="2" ParentId="3364" CreationDate="2015-03-02T00:57:17.693" Score="-1" Body="&lt;p&gt;I been through the same phase recently, without looking for issues for configuration above, 3 things I want to say if you have no clue what you are doing and want to connect ASA to internet &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Restore the device to default (you probably have lot of misconfiguration) Using console connection type &lt;code&gt;http 0.0.0.0 0.0.0.0 INSIDE&lt;/code&gt; and &lt;code&gt;http 0.0.0.0 0.0.0.0 OUTSIDE&lt;/code&gt;, so you can access the ASA with ASDM&lt;/li&gt;&#xA;&lt;li&gt;With Base License you will have 2 VLANs (ONE Side will be internet other can be your home network side) By default Int F0/0 will be internet side (VLAN 2) when you do the restore, know the Sub-network information for each VLAN. YES IT WILL BE DIFFERENT for each, you calculate this. &lt;/li&gt;&#xA;&lt;li&gt;Create Default route on ASA using guide type 0.0.0.0 0.0.0.0  X.X.X.X (INTERNETMODEADDRESS, the next hop)&lt;/li&gt;&#xA;&lt;li&gt;Create Access-list Rule on outside interface to allow ICMP replices, if you don't do this, THERE IS NO WAY YOUR PING TO 8.8.8.8 going to reply back to you.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hope someone finds this helpful. This is my 2 days of discovery process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;:)&lt;/p&gt;&#xA;" OwnerUserId="14136" LastEditorUserId="775" LastEditDate="2015-03-02T06:07:22.603" LastActivityDate="2015-03-02T06:07:22.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16996" PostTypeId="1" AcceptedAnswerId="16999" CreationDate="2015-03-02T03:18:59.310" Score="10" ViewCount="88334" Body="&lt;p&gt;I've read that the session layer is also called the ports layer, and a CBT nugget video implied ports were a layer 5 thing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I always thought they were layer 4, just because I guess. (well and tcp and udp have the ports)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Strangely I don't get much for results on this, maybe it doesn't matter.&lt;/p&gt;&#xA;" OwnerUserId="14138" LastActivityDate="2015-03-06T03:39:56.597" Title="What layer of the OSI model deals with ports?" Tags="|osi|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16997" PostTypeId="2" ParentId="16996" CreationDate="2015-03-02T04:27:36.153" Score="-4" Body="&lt;p&gt;Layer 4 in the TCP/IP model, but of layer 5 in the OSI model.&lt;/p&gt;&#xA;" OwnerUserId="14139" LastActivityDate="2015-03-02T04:27:36.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="16998" PostTypeId="2" ParentId="16798" CreationDate="2015-03-02T04:50:44.850" Score="3" Body="&lt;p&gt;Try something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mls qos&#xA;&#xA;ip access-list extended ACL_SLAP&#xA; permit ip any any&#xA;&#xA;&#xA;class-map match-all CLASS_SLAP&#xA;  match access-group name ACL_SLAP&#xA;&#xA;&#xA;policy-map POLICY_SLAP&#xA;  class CLASS_SLAP&#xA;    police 8000000 100000 exceed-action drop&#xA;&#xA;&#xA;interface GigabitEthernet0/2&#xA; service-policy input POLICY_SLAP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14139" LastEditorUserId="509" LastEditDate="2015-03-02T09:40:41.080" LastActivityDate="2015-03-02T09:40:41.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="16999" PostTypeId="2" ParentId="16996" CreationDate="2015-03-02T04:57:58.207" Score="11" Body="&lt;p&gt;TCP or UDP ports are defined in either layer 4 of the OSI model or layer 3 of the TCP/IP model, both are defined as the 'transport' layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSI layer 5 'session layer' uses the ports defined in layer 4 to create sockets and sessions between communicating devices/programs/etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result I got from Google that actually mentioned 'Ports Layer' is a completely incorrect page on a known link-farming site, so take it with a grain of salt. I don't know why CBT would refer to layer 5 with that name, but I don't have the video to watch.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-03-02T04:57:58.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17002" PostTypeId="2" ParentId="16951" CreationDate="2015-03-02T08:47:52.173" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;On physical layer AUX port works on asynchronous serial RS-232 protocol. However, one can specify various application layer protocols like telnet or SSH as allowed input protocols under AUX line configuration. Am I correct that those protocols are specified only to enable or disable reverse-telnet or reverse-SSH?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Short Answer&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On an aux line, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_ssh/configuration/15-mt/sec-usr-ssh-15-mt-book/sec-rev-ssh-enhanmt.html#GUID-4EE79965-9220-499C-8D06-DC91855D0AC2&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;transport input&lt;/code&gt;&lt;/a&gt; tells the router what protocols are permitted to reverse-telnet on the aux line.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;&lt;em&gt;Example&lt;/em&gt;:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I have the following lab setup...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  lab-rt1                                       sw1&#xA;+--------+ aux                           con +-------+&#xA;|  c1841 |-------{rolled serial cable}-------| c3560 |&#xA;+--------+                                   +-------+&#xA;           speed 115200                  speed 115200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A &quot;rolled cable&quot; is just a normal Cisco console cable, which has&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;pin 8 connected to 1&lt;/li&gt;&#xA;&lt;li&gt;pin 7 connected to 2&lt;/li&gt;&#xA;&lt;li&gt;etc...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you have some older Cisco cables lying around, it usually looks like this...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sQKuq.jpg&quot; alt=&quot;console cable&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days, Cisco doesn't ship rolled cables with two RJ45 connectors; now they have DB9 on one end.  I made my rolled cable with some crimpers.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;&lt;em&gt;Lab Configuration&lt;/em&gt;:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I have the following configured on a Cisco 1841 lab router (&lt;code&gt;transport input none&lt;/code&gt; is default on aux in my IOS)...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lab-rt1#sh runn | b line aux&#xA;line aux 0&#xA; no exec&#xA; exec-timeout 15 0&#xA; speed 115200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;aux&lt;/code&gt; reverse-telnet port is tcp/2001 on the c1841 (you have to add 2000 to whatever line is shown below)...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lab-rt1#sh line | i CTY|AUX&#xA;      0    0 CTY              -    -      -    -    -     0      0    0/0      -&#xA;      1    1 AUX 115200/115200-    -      -    -    -     5      5    3/0      -&#xA;lab-rt1#&#xA;lab-rt1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;&lt;em&gt;Example 1 (without &lt;code&gt;transport input ...&lt;/code&gt;)&lt;/em&gt;:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If I try to telnet to that router &lt;em&gt;without&lt;/em&gt; &lt;code&gt;transport input telnet&lt;/code&gt;, then it fails...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami]$ telnet rt1 2001&#xA;Trying 172.16.1.210...&#xA;telnet: Unable to connect to remote host: Connection refused&#xA;[mpenning@tsunami]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;&lt;em&gt;Example 2 (using &lt;code&gt;transport input ...&lt;/code&gt;)&lt;/em&gt;:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;However, if I configure this on the c1841's aux port, reverse-telnet and reverse-ssh work...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lab-rt1(config)#line aux 0&#xA;lab-rt1(config-line)#transport input telnet ssh&#xA;lab-rt1(config-line)#end&#xA;lab-rt1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I telnet again to port 2001...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami]$ telnet rt1 2001&#xA;Trying 172.16.1.210...&#xA;Connected to rt1-lo0.lab.pennington.net.&#xA;Escape character is '^]'.&#xA;&#xA;&#xA;User Access Verification&#xA;&#xA;Username: mpenning&#xA;Password:&#xA;&#xA;&#xA;sw1 con0 is now available&#xA;&#xA;&#xA;Press RETURN to get started.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SSH reverse telnet is a little strange... &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You might be tempted to ssh to port 2001 on the terminal router (i.e. &lt;code&gt;ssh -p 2001 rt1&lt;/code&gt;), but that fails; use port 22 and see the next bullet.&lt;/li&gt;&#xA;&lt;li&gt;You also have to mangle your username as &lt;code&gt;&amp;lt;username&amp;gt;:&amp;lt;line_number&amp;gt;&lt;/code&gt;... in my case, I have to use line 1 to get to the aux (from &lt;code&gt;show line&lt;/code&gt;, above)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Example... I have username &lt;code&gt;mpenning&lt;/code&gt; configured on rt1, and I'm making a reverse-ssh to aux 0 (which is line number 1)...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami]$ ssh -l mpenning:1 rt1&#xA;Password:&#xA;&#xA;sw1 con0 is now available&#xA;&#xA;&#xA;Press RETURN to get started.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-03-02T09:16:02.563" LastActivityDate="2015-03-02T09:16:02.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17005" PostTypeId="1" AcceptedAnswerId="17013" CreationDate="2015-03-02T11:41:07.940" Score="2" ViewCount="12102" Body="&lt;p&gt;&lt;strong&gt;Aim&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The aim is to setup LACP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;/etc/modprobe.d/bonding.conf&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alias bond0 bonding&#xA;options bond0 miimon=100 mode=4 lacp_rate=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;/etc/sysconfig/network-scripts/ifcfg-bond0&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ONBOOT=yes&#xA;BOOTPROTO=static&#xA;USERCTL=no&#xA;DEVICE=bond0&#xA;IPADDR=X&#xA;GATEWAY=Y&#xA;PREFIX=24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;/etc/sysconfig/network-scripts/ifcfg-eth0&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ONBOOT=yes&#xA;BOOTPROTO=static&#xA;USERCTL=no&#xA;DEVICE=eth0&#xA;MASTER=bond0&#xA;SLAVE=yes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Etherchannel&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#show etherchannel X summary&#xA;Flags:  D - down        P - bundled in port-channel&#xA;        I - stand-alone s - suspended&#xA;        H - Hot-standby (LACP only)&#xA;        R - Layer3      S - Layer2&#xA;        U - in use      f - failed to allocate aggregator&#xA;&#xA;        M - not in use, minimum links not met&#xA;        u - unsuitable for bundling&#xA;        w - waiting to be aggregated&#xA;        d - default port&#xA;&#xA;&#xA;Number of channel-groups in use: 3&#xA;Number of aggregators:           3&#xA;&#xA;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+-----------------------------------------------&#xA;X     PoX(SD)        LACP        Gi0/A(I)   Gi0/B(I)   Gi0/C(I)&#xA;                                 Gi0/D(I)&#xA;&#xA;interface Port-channelX&#xA; switchport mode access&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Ports&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/A&#xA; switchport access vlan X&#xA; switchport mode access&#xA; channel-protocol lacp&#xA; channel-group X mode active&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Log&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mar  2 11:17:50.529: %SW_MATM-4-MACFLAP_NOTIF: Host &amp;lt;MAC_ADDRESS&amp;gt; in vlan X is flapping&#xA;between port Gi0/Y and port Gi0/Z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Questions&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the network service has been restarted on the Linux server the slave ethernet adapters are up and the system is still accessible:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why does the Cisco log indicate that the host is flapping between the ports?&lt;/li&gt;&#xA;&lt;li&gt;Why could the system be accessed while the portchannel is down?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="5282" LastEditorUserId="5282" LastEditDate="2015-03-02T12:29:10.553" LastActivityDate="2015-03-04T22:34:22.410" Title="Why does the host in VLAN X flap between ports if LACP is configured?" Tags="|cisco|linux|ieee-802.1ax|etherchannel|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17006" PostTypeId="2" ParentId="16996" CreationDate="2015-03-02T11:50:21.520" Score="-2" Body="&lt;p&gt;This is my own understanding regarding Ports: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ports are defined in the 5th layer of the OSI model which establishes and controls the dialogue between the source and destination. Port definition is done in the diaogue establishment process. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the TCP/IP model, Layers 5,6 and 7 of the OSI model are included into one Layer (Layer 4 of the TCP/IP model). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to answer your question, it all depends on the model you are considering. if you are using the OSI model, &quot;Port&quot; is a layer 5 definition, otherwise if you are using the TCP/IP model it will be considered as a layer 4 entity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: for a more specific and maybe more correct answer you should take a look at the OSI model basic definitions in the ISO/IEC 7498-1 (Link &lt;a href=&quot;http://standards.iso.org/ittf/PubliclyAvailableStandards/s020269_ISO_IEC_7498-1_1994(E).zip&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;" OwnerUserId="14143" LastActivityDate="2015-03-02T11:50:21.520" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17008" PostTypeId="1" AcceptedAnswerId="17032" CreationDate="2015-03-02T12:06:39.600" Score="1" ViewCount="1243" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mFgg6.jpg&quot; alt=&quot;enter image description here&quot;&gt;&#xA;I just configured PAT in a router but it doesn't work ,,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I write this commands in R1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    access-list 4 permit 172.16.0.0 0.0.255.255&#xA;    ip nat pool AdeNet 80.80.10.20 80.80.10.20 netmask 255.255.255.255&#xA;    ip nat inside source list 4 pool AdeNet overload&#xA;&#xA;    int s0/0/0&#xA;ip address 172.16.15.21 255.255.255.252&#xA;    ip nat outside&#xA;&#xA;    int s0/0/1&#xA;ip address 172.16.15.2 255.255.255.252&#xA;    ip nat inside&#xA;&#xA;    int s0/1/0&#xA;ip address 172.16.15.10 255.255.255.252&#xA;    ip nat inside&#xA;&#xA;    int s0/1/1&#xA;ip address 172.16.15.17 255.255.255.252&#xA;    ip nat inside&#xA;&#xA;    int f0/0&#xA;ip address 172.16.0.150 255.255.248.0&#xA;    ip nat inside&#xA;    exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are the ISP router ip address&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int s0/0/0&#xA;ip address 172.16.15.22 255.255.255.252&#xA;int f0/0&#xA;ip address 10.10.1.1 255.255.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;80.80.10.20/32 is the public IP address for the NAT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the result of Show Run commands in 3 routers,, I hope it to be useful &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP&#xA;&#xA;FastEthernet0/0        10.10.1.1/16&#xA;&#xA;Serial0/0/0            172.16.15.22/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;=========================================&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1&#xA;&#xA;interface FastEthernet0/0&#xA; ip address 172.16.0.150 255.255.248.0&#xA; ip nat inside&#xA;&#xA;interface FastEthernet0/1&#xA; no ip address&#xA;&#xA;interface FastEthernet0/1.10&#xA; encapsulation dot1Q 10&#xA; ip address 192.168.1.10 255.255.255.0&#xA;&#xA;interface FastEthernet0/1.20&#xA; encapsulation dot1Q 20&#xA; ip address 192.168.2.10 255.255.255.0&#xA;&#xA;interface FastEthernet0/1.30&#xA; encapsulation dot1Q 30&#xA; ip address 192.168.3.10 255.255.255.0&#xA;&#xA;interface FastEthernet0/1.40&#xA; encapsulation dot1Q 40&#xA; ip address 192.168.4.10 255.255.255.0&#xA;&#xA;interface Serial0/0/0&#xA; ip address 172.16.15.21 255.255.255.252&#xA; ip nat outside&#xA; clock rate 2000000&#xA;&#xA;interface Serial0/0/1&#xA; ip address 172.16.15.2 255.255.255.252&#xA; ip nat inside&#xA; clock rate 64000&#xA;&#xA;interface Serial0/1/0&#xA; ip address 172.16.15.10 255.255.255.252&#xA; ip nat inside&#xA; clock rate 64000&#xA;&#xA;interface Serial0/1/1&#xA; ip address 172.16.15.17 255.255.255.252&#xA; ip nat inside&#xA; clock rate 64000&#xA;&#xA;router ospf 12&#xA;&#xA; network 172.16.0.0 0.0.7.255 area 0&#xA; network 172.16.15.0 0.0.0.3 area 0&#xA; network 172.16.15.8 0.0.0.3 area 0&#xA; network 172.16.15.16 0.0.0.3 area 0&#xA; network 172.16.15.20 0.0.0.3 area 0&#xA; network 192.168.0.0 0.0.7.255 area 0&#xA;exit&#xA;ip nat pool AdeNet 80.80.10.20 80.80.10.20 netmask 255.255.255.255&#xA;ip nat inside source list 4 pool AdeNet overload&#xA;ip route 0.0.0.0 0.0.0.0 Serial0/0/0 &#xA;access-list 4 permit 172.16.0.0 0.0.255.255&#xA;access-list 4 permit 192.168.0.0 0.0.7.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;=========================&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 172.16.8.150 255.255.252.0&#xA;&#xA;interface Serial0/0/0&#xA; ip address 172.16.15.1 255.255.255.252&#xA; clock rate 2000000&#xA;&#xA;interface Serial0/0/1&#xA; ip address 172.16.15.5 255.255.255.252&#xA; clock rate 64000&#xA;&#xA;router ospf 12&#xA; passive-interface FastEthernet0/0&#xA; network 172.16.8.0 0.0.3.255 area 0&#xA; network 172.16.15.0 0.0.0.3 area 0&#xA; network 172.16.15.4 0.0.0.3 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I ospf area 0 to conncet all WAN networks and connected, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and static routing between ISP and the R1 router and default routing between ISP and R1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so , is there any thing missing , that prevent WANs from connecting the internet &lt;/p&gt;&#xA;" OwnerUserId="14133" LastEditorUserId="21048" LastEditDate="2016-05-19T14:14:56.657" LastActivityDate="2016-05-19T14:14:56.657" Title="ISP router unreachable by PAT" Tags="|cisco|routing|nat|troubleshooting|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="17013" PostTypeId="2" ParentId="17005" CreationDate="2015-03-02T14:16:11.470" Score="3" Body="&lt;p&gt;If the port channel is DOWN, then the Cisco device doesn't see it bundled together. As your display shows, each port are Stand-Alone (as indicated by the &quot;I&quot; status), meaning they're seen as separate entities to the switch with regards to MAC table, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This point to something wrong in your channel config and/or capabilities (mismatch between the linux box and the switch)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've often seen this with vMware servers that has some problems with their network config, the VMs are often balanced between their link using the DST IP, the switch seeing the VM's MAC on one interface, then another, and another, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Cisco side, you can try to look-up some debug to help you (&quot;&lt;strong&gt;debug etherchannel ?&lt;/strong&gt;&quot;)&lt;/p&gt;&#xA;" OwnerUserId="1645" LastActivityDate="2015-03-02T14:16:11.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17018" PostTypeId="1" AcceptedAnswerId="17090" CreationDate="2015-03-02T17:37:34.057" Score="3" ViewCount="1868" Body="&lt;p&gt;We are running into a situation where we are seeing a large number of broadcasts received on interfaces that are home to servers. I know this is not normal behavior; ARP cache should remember 100 addresses and the switch is set to remember ARP for 4 hours. Below is the amount of broadcasts we are seeing on two particular ports after 2 days.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/7 is up, line protocol is up (connected)&#xA;     Received 47681 broadcasts (0 multicast)&#xA;FastEthernet0/8 is up, line protocol is up (connected)&#xA;     Received 6321 broadcasts (0 multicast)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And they are configured the same way:&#xA;interface FastEthernet0/7&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switchport access vlan X&#xA; switchport mode access&#xA; switchport port-security&#xA; switchport port-security maximum 2&#xA; switchport port-security mac-address sticky&#xA; spanning-tree portfast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how to troubleshoot? The issue is widespread on almost all interfaces that house servers in the company.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-03-06T19:19:40.350" Title="Large Number of Received Broadcasts on Layer 2 Interfaces" Tags="|cisco|switch|cisco-catalyst|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17021" PostTypeId="2" ParentId="17018" CreationDate="2015-03-02T20:42:18.507" Score="4" Body="&lt;p&gt;It's hard not to be caught by the &lt;a href=&quot;http://en.wikipedia.org/wiki/Streetlight_effect&quot; rel=&quot;nofollow&quot;&gt; Streetlight effect&lt;/a&gt; when troubleshooting performance problems. You have a performance problem, and a limited number of metrics, and you attempt to relate one to the other. Very dangerous, if you have no baseline figures to compare to. It's not even clear that you have a problem with the network at all: often when people report a slow network it's a server problem and vice versa. Keep an open mind on what the root cause is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you think you are seeing excessive broadcasts then take a dump with a mirror port and tcpdump/dumpcap; then you can get an idea what kind of packets they are. If they are windows servers, could easily be some sort of service announcement. Unless they are really bursty, it's hard to see how they are related to your problem, though. And that they are the same pretty much everywhere tends to suggest there isn't a particular system with a badly behaved OS or application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good hunting!&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2015-03-02T20:42:18.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17024" PostTypeId="2" ParentId="17008" CreationDate="2015-03-03T04:13:13.643" Score="1" Body="&lt;p&gt;Change the static routes on the ISP router to use the next hop address 172.16.15.21 instead of the interface.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-03T04:13:13.643" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="17026" PostTypeId="1" CreationDate="2015-03-03T12:24:58.783" Score="0" ViewCount="146" Body="&lt;p&gt;I am creating a raytracer to model the propagation of radio waves from a simple router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming that the rays have a frequency of 2.4GHz and a velocity of the speed of light. The router has an initial power of 1mW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For simplicity I use FSPL (free-space path loss) to model the degradation of the signal over distance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When one ray intersects a point, it is easy to calculate the RSS (received signal strength) in dBm. You take the distance the ray has traveled, plug it into FSPL, and convert the result from watts to dBm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it is unclear how to resolve the effects of multipath interference when 2 or more rays intersect at a given point. I am not sure, for example what the amplitude of the radio waves are, or if there any dampening effects. Can someone explain how to model this phenomenon accurately?&lt;/p&gt;&#xA;" OwnerUserId="10099" LastEditorUserId="775" LastEditDate="2015-03-03T13:10:30.507" LastActivityDate="2016-02-27T13:34:31.067" Title="Resolving multipath interference when modelling radio wave propagation" Tags="|routing|router|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17027" PostTypeId="2" ParentId="17026" CreationDate="2015-03-03T15:00:05.993" Score="2" Body="&lt;p&gt;When two waves arrive at the same point the resulting signal is the addition of two electromagnetic waves. The resulting signal depends of the phase difference between signals.&#xA;This phase difference is equal to the path length difference in unit of the wave length of the signal λ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, lets consider a one dimensional case of 2 electromagnetic signals interfering together.&#xA;If λ = 12,5 cm (this is the wave length of a 2,4 GHz signal), and if the lengths of the paths from the emitting antenna are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;l₁ = 120 m&#xA;l₂ = 123 m&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then Δl = 300 cm&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then Δφ = 2π(Δl/λ) mod 2π = 2π(300/12,5) mod 2π = 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the 2 signals will fully add and the resulting signal amplitude is twice the original signal amplitude.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If on the other hand:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;l₁ = 120 m&#xA;l₂ = 120,0625 m&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then Δl = 6,25 cm&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then Δφ = 2π(Δl/λ) mod 2π = 2π(6,25/12,5) mod 2π = π&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the 2 signals are in phase opposition and will cancel each others. The resulting signal amplitude will be 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To compute a real case which is 4 dimensionnal (interference with the previous waves after reflections should be computed),&lt;/p&gt;&#xA;&#xA;&lt;p&gt;consider this basic documentation:&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Interference_%28wave_propagation%29&quot; rel=&quot;nofollow&quot;&gt;Interference (wave propagation)&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and look toward ray tracing computation:&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Ray_tracing_%28physics%29&quot; rel=&quot;nofollow&quot;&gt;Ray tracing (physics)&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13986" LastEditorUserId="13986" LastEditDate="2015-03-04T08:29:36.890" LastActivityDate="2015-03-04T08:29:36.890" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17028" PostTypeId="1" CreationDate="2015-03-03T15:54:37.287" Score="2" ViewCount="1069" Body="&lt;p&gt;If I successfully Man in the Middle attack an IPv6 Address of my victim can I also sniff its IPv4 packets? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attacks like Neighbor Advertisement Spoofing or Last Hop Router?&lt;/p&gt;&#xA;" OwnerUserId="13772" LastActivityDate="2016-01-04T16:35:57.917" Title="Man In The Middle on IPv6, are IPv4 packets affected?" Tags="|ipv4|ipv6|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17029" PostTypeId="2" ParentId="17028" CreationDate="2015-03-03T20:25:24.530" Score="3" Body="&lt;p&gt;IPv4 and IPv6 are separate protocols, so attacking one doesn't directly affect the other.  That said, the techniques for NA spoofing and ARP spoofing are very similar.  If you have the capability to do one, you certainly could do the other.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-03T20:25:24.530" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17030" PostTypeId="1" AcceptedAnswerId="17031" CreationDate="2015-03-03T21:42:41.503" Score="8" ViewCount="5795" Body="&lt;p&gt;Here are Cisco's definitions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Signaling&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The physical layer must generate the electrical, optical, or wireless&#xA;  signals that represent the &quot;1&quot; and &quot;0&quot; on the media. The method of&#xA;  representing the bits is called the signaling method.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Encoding&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Encoding or line encoding is a method of converting a stream of data&#xA;  bits into a predefined &quot;code”. Codes are groupings of bits used to&#xA;  provide a predictable pattern that can be recognized by both the&#xA;  sender and the received. In the case of networking, encoding is a&#xA;  pattern of voltage or current used to represent bits; the 0s and 1s.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't understand the difference between these two. When I describe line encoding in my own words, I would say encoding means putting the 1's and 0's in a certain pattern, so both nodes can understand that pattern. The encoding-protocol used defines that pattern. Is this correct? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not understand the definition of signaling...   These two terms are explained on the same page in my cisco book, but to me signaling seems very similar to encoding. I can't differentiate the two.&lt;/p&gt;&#xA;" OwnerUserId="13978" LastEditorUserId="8499" LastEditDate="2016-11-29T01:55:03.293" LastActivityDate="2021-05-30T20:36:22.970" Title="Signaling vs encoding" Tags="|layer1|terminology|" AnswerCount="7" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17031" PostTypeId="2" ParentId="17030" CreationDate="2015-03-03T22:03:20.403" Score="6" Body="&lt;p&gt;Click &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17030/signaling-vs-encoding#comments-17030&quot;&gt;here&lt;/a&gt; to view Ron's comment. Here is what he said:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Signaling is the method by which you define what a one or zero is.&#xA;  Encoding is how you use the 1s and 0s to represent information.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Just posting it as an answer since Ron didn't.&lt;/p&gt;&#xA;" OwnerUserId="13978" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-11-29T01:55:35.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17032" PostTypeId="2" ParentId="17008" CreationDate="2015-03-03T23:00:41.150" Score="1" Body="&lt;p&gt;I write a default routing command in the R2 and it start ping to the ISP server ,, &#xA;ip route 0.0.0.0 0.0.0.0 Serial0/0/0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;may I should write in all other routers , still don't understand why !! while I'm using OSPF protocol between routers , except ISP router ..&lt;/p&gt;&#xA;" OwnerUserId="14133" LastActivityDate="2015-03-03T23:00:41.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17034" PostTypeId="1" AcceptedAnswerId="17040" CreationDate="2015-03-04T05:22:31.460" Score="4" ViewCount="645" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JOY6G.jpg&quot; alt=&quot;network&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a consultant setup a basic network for a small office but I have some questions regarding the best way to implement this.  We are using a Cisco 1921 router connected to a Catalyst 3750 as the main switch.  Two more Catalyst 3750's branch off from the main switch for different suites.  VLAN's are trunked through to the main 3750 where the gateways for each vlan/subnet reside (192.168.x.1).  The router is performing NAT with the public IP on the outside interface connected to the ISP modem and a private IP on the inside interface facing the switched network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The things I am wondering about:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Should the gateways of each subnet/vlan reside on the main L3 switch?&lt;/li&gt;&#xA;&lt;li&gt;Do I need to trunk any VLAN's to the router?&lt;/li&gt;&#xA;&lt;li&gt;Is there any double NAT happening?...cable modem is in bridge mode&lt;/li&gt;&#xA;&lt;li&gt;Should I configure default gateways on my switches?&lt;/li&gt;&#xA;&lt;li&gt;Any other suggestions such as changing the addressing scheme?..router not being .1 bugs me&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Some technician from the VoIP company was claiming that there is double NAT since he saw two private ip addresses in a trace route.  To my knowledge that is not true and the there are two hops because the packet hits the gateway on the L3 switch and then hits the inside router interface before going out to the internet.  Please correct me if I am mistaken.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute to 39.419.1.25 (74.115.98.25), 64 hops max, 52 byte packets&#xA; 1  192.168.4.1 (192.168.4.1)  0.739 ms  3.157 ms  0.516 ms  &amp;lt;---Gateway on L3 switch&#xA; 2  192.168.1.2 (192.168.1.2)  0.573 ms  0.488 ms  0.466 ms  &amp;lt;---Router Inside Interface&#xA; 3  * * *                                                    &amp;lt;---Cable Modem???&#xA; 4  ip43-52-53-43.blah.blah.blah.net (43.52.53.43)  9.125 ms  14.633 ms  9.812 ms&#xA; 5  * * *&#xA; 6  blah.blah.blah.net (45.2.4.90)  30.010 ms  19.896 ms  29.781 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 5879 bytes&#xA;!&#xA;! Last configuration change at 00:33:56 UTC Sun Mar 1 2015 by noc&#xA;! NVRAM config last updated at 20:45:24 UTC Mon Mar 2 2015 by noc&#xA;! NVRAM config last updated at 20:45:24 UTC Mon Mar 2 2015 by noc&#xA;version 15.2&#xA;service timestamps debug datetime&#xA;service timestamps log datetime&#xA;no service password-encryption&#xA;!&#xA;hostname ROUTER-1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;logging buffered 64000&#xA;logging console emergencies&#xA;!&#xA;no aaa new-model&#xA;!&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip name-server 8.8.8.8&#xA;ip name-server 8.8.4.4&#xA;no ipv6 cef&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp mss 1492&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description WAN&#xA; ip address x.x.x.x 255.255.255.240&#xA; ip access-group 101 in&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description LAN&#xA; ip address x.x.x.x 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;!&#xA;ip dns server&#xA;ip nat inside source list 7 interface GigabitEthernet0/0 overload&#xA;ip route 0.0.0.0 0.0.0.0 184.191.183.49&#xA;ip route 192.168.2.0 255.255.255.0 192.168.1.1&#xA;ip route 192.168.3.0 255.255.255.0 192.168.1.1&#xA;ip route 192.168.4.0 255.255.255.0 192.168.1.1&#xA;!&#xA;access-list 7 permit 192.168.1.0 0.0.0.255&#xA;access-list 7 permit 192.168.2.0 0.0.0.255&#xA;access-list 7 permit 192.168.3.0 0.0.0.255&#xA;access-list 7 permit 192.168.4.0 0.0.0.255&#xA;access-list 23 permit 10.10.10.0 0.0.0.7&#xA;access-list 101 remark Standardized inbound anti-spoofing list&#xA;access-list 101 deny   ip 192.168.0.0 0.0.255.255 any&#xA;access-list 101 deny   ip 172.16.0.0 0.15.255.255 any&#xA;access-list 101 deny   ip 10.0.0.0 0.255.255.255 any&#xA;access-list 101 deny   ip 127.0.0.0 0.255.255.255 any&#xA;access-list 101 deny   ip 255.0.0.0 0.255.255.255 any&#xA;access-list 101 deny   ip 224.0.0.0 7.255.255.255 any&#xA;access-list 101 deny   ip 14.0.0.0 0.255.255.255 any log&#xA;access-list 101 deny   ip 169.254.0.0 0.0.255.255 any log&#xA;access-list 101 deny   ip 198.18.0.0 0.0.255.255 any log&#xA;access-list 101 deny   ip host 0.0.0.0 any&#xA;access-list 101 deny   ip 50.202.143.128 0.0.0.31 any&#xA;access-list 101 deny   udp any any eq snmp log&#xA;access-list 101 deny   udp any any eq snmptrap log&#xA;access-list 101 deny   tcp any any range 135 139 log&#xA;access-list 101 deny   udp any any range 135 netbios-ss log&#xA;access-list 101 deny   tcp any any eq 6666 log&#xA;access-list 101 deny   tcp any any eq 6667 log&#xA;access-list 101 deny   tcp any any eq 445 log&#xA;access-list 101 deny   udp any any eq 445 log&#xA;access-list 101 permit ip any any&#xA;access-list 101 deny   ip any any log&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;scheduler allocate 20000 1000&#xA;ntp server 128.138.141.172&#xA;ntp server 216.228.192.69&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Distribution Switch&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 9859 bytes&#xA;!&#xA;! Last configuration change at 20:27:24 UTC Mon Mar 2 2015&#xA;! NVRAM config last updated at 20:45:03 UTC Mon Mar 2 2015&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SWITCH-1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;switch 1 provision ws-c3750g-48ps&#xA;system mtu routing 1500&#xA;ip routing&#xA;no ip dhcp use vrf connected&#xA;ip dhcp excluded-address 192.168.1.1 192.168.1.100&#xA;ip dhcp excluded-address 192.168.2.1 192.168.2.100&#xA;ip dhcp excluded-address 192.168.3.1 192.168.3.100&#xA;ip dhcp excluded-address 192.168.4.1 192.168.4.100&#xA;!&#xA;ip dhcp pool VLAN10&#xA;   network 192.168.1.0 255.255.255.0&#xA;   default-router 192.168.1.1 &#xA;   dns-server 8.8.8.8 &#xA;!&#xA;ip dhcp pool VLAN20&#xA;   network 192.168.2.0 255.255.255.0&#xA;   default-router 192.168.2.1 &#xA;   dns-server 8.8.8.8&#xA;!         &#xA;ip dhcp pool VLAN30&#xA;   network 192.168.3.0 255.255.255.0&#xA;   default-router 192.168.3.1 &#xA;   dns-server 8.8.8.8&#xA;!&#xA;ip dhcp pool VLAN40&#xA;   network 192.168.4.0 255.255.255.0&#xA;   default-router 192.168.4.1 &#xA;   dns-server 8.8.8.8&#xA;!    &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode rapid-pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;ip ssh version 2&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description ROUTER&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; description TRUNK-SWITCH-2&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 911&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA; description TRUNK-SWITCH-3&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 911&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA; description WLC&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 20&#xA; switchport mode trunk&#xA;! &#xA;interface GigabitEthernet1/0/5&#xA; description AP-401&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 20&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/6&#xA; description AP-402&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 20&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/7&#xA; description SERVER-1&#xA; switchport access vlan 40&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/8&#xA; description SERVER-2&#xA; switchport access vlan 40&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/9&#xA; description ADT-DVR&#xA; switchport access vlan 30&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/10&#xA; description ADT&#xA; switchport access vlan 30&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/11&#xA; description Printer-402&#xA; switchport access vlan 30&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/12&#xA; description Printer-401&#xA; switchport access vlan 30&#xA; switchport mode access&#xA; duplex full&#xA;!&#xA;interface GigabitEthernet1/0/13&#xA; switchport access vlan 30&#xA; switchport mode access&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.1.1 255.255.255.0&#xA;!&#xA;interface Vlan20&#xA; ip address 192.168.2.1 255.255.255.0&#xA;!&#xA;interface Vlan30&#xA; ip address 192.168.3.1 255.255.255.0&#xA; ip access-group 101 in&#xA;!&#xA;interface Vlan40&#xA; ip address 192.168.4.1 255.255.255.0&#xA;!&#xA;!         &#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 192.168.1.2&#xA;no ip http server&#xA;ip http secure-server&#xA;!&#xA;access-list 101 permit udp any eq bootpc any eq bootps&#xA;access-list 101 deny   ip any 192.168.1.0 0.0.0.255&#xA;access-list 101 deny   ip any 192.168.2.0 0.0.0.255&#xA;access-list 101 deny   ip any 192.168.4.0 0.0.0.255&#xA;access-list 101 permit ip any any&#xA;!&#xA;!&#xA;!&#xA;ntp clock-period 36029145&#xA;ntp server 128.138.141.172&#xA;ntp server 216.228.192.69&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14175" LastEditorUserId="775" LastEditDate="2015-03-05T14:50:24.483" LastActivityDate="2015-03-06T16:18:54.287" Title="How should the router be integrated into the LAN?" Tags="|switch|router|vlan|nat|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17035" PostTypeId="2" ParentId="16951" CreationDate="2015-03-04T07:14:56.350" Score="1" Body="&lt;p&gt;You can make it do more fun stuff like having it talk IP: &lt;a href=&quot;https://glennmatthys.wordpress.com/2012/11/02/using-a-cisco-routers-aux-port-to-talk-ip/&quot; rel=&quot;nofollow&quot;&gt;https://glennmatthys.wordpress.com/2012/11/02/using-a-cisco-routers-aux-port-to-talk-ip/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2015-03-04T07:14:56.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17036" PostTypeId="2" ParentId="17028" CreationDate="2015-03-04T08:12:02.893" Score="3" Body="&lt;p&gt;&lt;strong&gt;An attacker on the path&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to perform a MITM attack is by having access to a node which is on the legitimate path between the two endpoints or a node directly connected to an Ethernet segment used by the legitimate path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the legitimate path used between the two endpoints is identical for IPv4 and IPv6, then an attacker will be just as close to the IPv4 path as to the IPv6 path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the attacker controls a node on the path, then the attacker can obviously MITM both protocols. If the attacker only control a node connected to the same Ethernet segment as a hop used by the legitimate path, it takes a bit more work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case MAC spoofing would work equally well for attacking both IPv4 and IPv6. But it is difficult to both capture the packet that way and then pass it on to the legitimate destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the attack is performed by spoofing at a higher layer, then attacks are possible against both IPv4 and IPv6, but it is different packets which need to be spoofed in the two cases. In case of IPv4 it is ARP packets, in case of IPv6 it is neighbor discovery packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Certain switches have features to protect against the above spoofing attacks. However if the switch was designed to protect against ARP spoofing but has no protection against neighbor discovery spoofing, then the attacker would only be able to MITM the IPv6 traffic and not the IPv4 traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BGP attacks&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without being anywhere near the path between the two endpoints, it is possible to perform MITM attacks through some &lt;a href=&quot;https://www.youtube.com/watch?v=IDoivWHVrGI&quot; rel=&quot;nofollow&quot;&gt;BGP trickery&lt;/a&gt;. Even if the legitimate path is identical for IPv4 and IPv6, it is still possible that prefix lengths and route origin authorization is different enough between the two, that the attack is not equally efficient against IPv4 and IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Influencing the choice of IPv4 vs IPv6&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should an attacker somehow control only IPv6 and not IPv4, the attacker may obviously have an interest in influencing the client to transmit traffic over IPv6 rather than IPv4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the client is using the happy eyeballs approach, then it will usually use the fastest of the two connections. A MITM simply forwarding packets between client and server can be expected to increase latency, thus the client is more likely to chose the connection not under attack. However if the MITM instead of forwarding packets decide to terminate the TCP connection and run another TCP connection towards the server, then it is possible that the MITM can achieve a better latency from the client's perspective than the legitimate path. The exact details of the algorithm vary between implementations, for example it is possible to give one protocol a head start (measured in milliseconds), and if that head start is large enough variations in latency introduced by the MITM may not affect the outcome.&lt;/p&gt;&#xA;" OwnerUserId="5842" LastEditorUserId="5842" LastEditDate="2016-01-04T16:35:57.917" LastActivityDate="2016-01-04T16:35:57.917" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17037" PostTypeId="1" CreationDate="2015-03-04T09:28:32.657" Score="4" ViewCount="310" Body="&lt;p&gt;I have two Ruckus Outdoor APs, Model ZF7363. One has already been configured, and the other is not configured. I am using ZoneDirector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I copy the configuration from the one already setup to the empty one?&lt;/p&gt;&#xA;" OwnerUserId="14178" LastEditorUserId="8499" LastEditDate="2016-04-04T00:58:15.593" LastActivityDate="2018-07-24T22:00:17.850" Title="How to copy a Ruckus ZF7363 configuration?" Tags="|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17039" PostTypeId="2" ParentId="17034" CreationDate="2015-03-04T12:21:56.877" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;Yes. And they probably are.&lt;/li&gt;&#xA;&lt;li&gt;No.  &lt;/li&gt;&#xA;&lt;li&gt;Can't tell without seeing the L3 configuration, but unlikely.&lt;/li&gt;&#xA;&lt;li&gt;If you only access the managemnt interface from devices on VLAN 10, then no.  If you want to access them from other VLANs, or from the Internet (via a VPN or something similar), then yes.&lt;/li&gt;&#xA;&lt;li&gt;Routers don't have egos, so they don't have to be number one ;)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I trust that your router has some firewall features enabled.  If you post the router and L3 switch configurations, we can give more definite answers.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-04T12:21:56.877" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17040" PostTypeId="2" ParentId="17034" CreationDate="2015-03-04T12:25:36.263" Score="4" Body="&lt;p&gt;1.) Yes, the gateways should reside on the L3 switch. If you were running Routing on a Stick, you would instead house their gateways on the Router. Your current configuration is inline with what is called a &quot;collapsed core&quot; design. Where the L3 core performs both switching and VLAN routing and acts as a distribution layer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) No, your L3 routing should be occuring on your 3750.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.)If the cable modem is in bridge mode, there should be no double NAT. Bridge mode should disable all the routing features and leave the cable modem as just a cable modem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.) I would, just so you can hit devices on the seperate VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5.) The address of the inside interface of the Cable modem may be .1. Leave it as it is. Like Ron said, it doesn't need to be changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can we see the NAT configuration of your router? It will be helpful in identifying your NAT issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;****EDIT****&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This link may be helpful: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13772-12.html#topic2&quot; rel=&quot;nofollow&quot;&gt;Configuring NAT&lt;/a&gt; I failed to take note of the NAT statement you had originally. This brings into question the claims made by your ISP. You're both able to hit the internet and your being PAT'd with the correct commands. Are you experiencing any problems?&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="4634" LastEditDate="2015-03-06T16:18:54.287" LastActivityDate="2015-03-06T16:18:54.287" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17045" PostTypeId="2" ParentId="17005" CreationDate="2015-03-04T22:34:22.410" Score="2" Body="&lt;p&gt;Your etherchannel is setup incorrectly. If you look in the logs, you'll see a configuration mismatch because the PoX and G0/X interfaces do not have identical functional configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Start over.&lt;/em&gt; Delete PoX. Default the G0/X interfaces. The &lt;strong&gt;ONLY&lt;/strong&gt; thing you configure on the member interfaces is the &lt;code&gt;channel-group&lt;/code&gt;. &lt;em&gt;Then&lt;/em&gt; setup everything on &lt;code&gt;Port-channelX&lt;/code&gt;; those elements will be copied to all member ports.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-04T22:34:22.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17047" PostTypeId="2" ParentId="16942" CreationDate="2015-03-04T23:17:18.203" Score="2" Body="&lt;p&gt;Possibilities...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;undetected L2 loop (physical, or &lt;em&gt;logical&lt;/em&gt;)&lt;/li&gt;&#xA;&lt;li&gt;VM running in more than one host (HA?)&lt;/li&gt;&#xA;&lt;li&gt;host connected to multiple switches&lt;/li&gt;&#xA;&lt;li&gt;LACP misconfiguration&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You've given very little information on the network and VM infrastructure. It's possible something is causing a &lt;em&gt;logical&lt;/em&gt; loop -- eg. VM copying traffic. I don't know what that VM is, how it's connected, or what it's doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I've had this problem with the Alteon virtual appliance. It's HA is done via a hacked (&quot;customized&quot;) VRRP that always uses a VRID of 1. More than one VA HA pair in a network causes MAC flaps. (until you &lt;em&gt;manually&lt;/em&gt; change the VRID) Also, if the same network is attached to more than one vNIC, it'll &quot;self loop&quot;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-04T23:17:18.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17048" PostTypeId="1" AcceptedAnswerId="17272" CreationDate="2015-03-05T00:27:58.980" Score="2" ViewCount="12331" Body="&lt;p&gt;I have the current rules in an attempt to open port 5060 and 10000-20000 for my VoIP provider.  We are on a Cisco 1921 router.  This ACL is applied to the WAN port on the router facing the ISP.  Nmap port scan shows these ports as closed.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Can anyone help verify my ACL and correct my rule if necessary?&lt;/li&gt;&#xA;&lt;li&gt;Do I need an outbound ACL to open up the port as well since this is for a hosted VoIP PBX?&lt;/li&gt;&#xA;&lt;li&gt;Is Nmap not detecting the open port because I am not the specific host for the ACL?  I tried some other ports that are not specific to a public IP and Nmap also shows as closed.&lt;/li&gt;&#xA;&lt;li&gt;Do my L3 switches behind the router also need an ACL to open ports if they are between the PC and the router?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router Config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description WAN&#xA; ip address x.x.x.x 255.255.255.240&#xA; ip access-group 101 in&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description LAN&#xA; ip address 192.168.1.2 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;access-list 101 permit udp host x.x.x.x any eq 5060&#xA;access-list 101 permit udp host x.x.x.x any range 10000 20000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Nmap Port Scan&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-04 16:24 PST&#xA;Nmap scan report for&#xA;Host is up (0.022s latency).&#xA;PORT     STATE  SERVICE&#xA;5060/udp closed sip&#xA;&#xA;Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-04 16:24 PST&#xA;Nmap scan report for &#xA;Host is up (0.023s latency).&#xA;PORT      STATE  SERVICE&#xA;10000/udp closed ndmp&#xA;&#xA;&#xA;Starting Nmap 6.47 ( http://nmap.org ) at 2015-03-04 16:24 PST&#xA;Nmap scan report for wsip-184-191-183-54.sd.sd.cox.net (184.191.183.54)&#xA;Host is up (0.026s latency).&#xA;PORT      STATE  SERVICE&#xA;20000/udp closed unknown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14175" LastEditorUserId="509" LastEditDate="2015-08-16T21:42:35.347" LastActivityDate="2015-10-15T22:25:34.000" Title="Correct ACL rule to open UDP ports for VoIP" Tags="|cisco|router|firewall|voip|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="17051" PostTypeId="2" ParentId="2364" CreationDate="2015-03-05T03:20:49.140" Score="2" Body="&lt;p&gt;Unfortunately the mgmt0/0 interface on an ASA is often misused.  It should only be used for management of the admin/system context of an ASA in multi-context mode, or for a dedicated management subnet that uses the ASA as its default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to do is remove the IP address from the mgmt0/0 interface on the ASA itself (NOT THE IPS!!) and everything should work as expected as long as the management subnet is routed out the correct interface on the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is happening with the ASA having an interface into the management subnet (192.168.25.0/24 in this case) is all packets from that subnet that use an internal gateway (L3 switch) and then try and forward packets through the &lt;code&gt;inside&lt;/code&gt; interface are failing the reverse-path-forwarding (RPF) check and being dropped as spoofed traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual traffic flow that you are seeing is IPS&gt;L3 Switch&gt;ASA&gt;Bit Bucket(RPF Failure), until you re-address the IPS, disable RPF checking (not advised) or remove the IP from the ASA's management0/0 interface you will continue to see this behavior.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="3912" LastEditDate="2015-06-04T03:47:29.857" LastActivityDate="2015-06-04T03:47:29.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17052" PostTypeId="2" ParentId="16996" CreationDate="2015-03-05T03:36:34.610" Score="1" Body="&lt;p&gt;I believe that after watching some more vids (Keith Barker), that it's one of those things that doesn't fit perfectly into the OSI model.  I'm still leaning towards layer 4 as the primary layer for dealing with ports, but layer 5 definitely has a role there.&lt;/p&gt;&#xA;" OwnerUserId="14138" LastActivityDate="2015-03-05T03:36:34.610" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17053" PostTypeId="1" CreationDate="2015-03-05T03:59:15.043" Score="0" ViewCount="888" Body="&lt;p&gt;I'm getting the small picture stuff, but there's this big picture I don't understand. Vids and Network+ materials talk about frame relay and MPLS as WAN technologies.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first thought is... isn't the WAN just another name for the internet/cloud?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I think, isn't the internet just a bunch of routers running BGP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where does ATM, frame relay, and MPLS fit into the big picture? &lt;/p&gt;&#xA;" OwnerUserId="14138" LastActivityDate="2015-03-09T08:48:23.163" Title="How does frame relay and MPLS fit in with BGP and WAN/internet/cloud routing?" Tags="|mpls|wan|" AnswerCount="2" CommentCount="0" ClosedDate="2015-03-12T02:05:43.373" ContentLicense="CC BY-SA 3.0" />
  <row Id="17054" PostTypeId="2" ParentId="17053" CreationDate="2015-03-05T05:27:42.113" Score="2" Body="&lt;p&gt;Cloud is a marketing term, use it with caution. The normal use of a WAN (ATM/FR/MPLS/managed or dark fiber/etc.) is to provide a network where a single entity controls access. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This provides a more-secure (not totally secure...) transport for internal communications and/or a limited number of exit points to the full Internet that can be monitored for policy compliance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other technologies (SSL-VPN/DMVPN/FlexVPN/etc.) can be used to leverage the cost-savings of internet transport and still provide the expected privacy of a WAN.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-03-05T05:27:42.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17056" PostTypeId="1" AcceptedAnswerId="17064" CreationDate="2015-03-05T10:08:00.720" Score="4" ViewCount="1148" Body="&lt;p&gt;I have a following topology where Internet service providers for both sites provide 10Mbps connection:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JsTa4.png&quot; alt=&quot;QoS for GRE tunnel keepalives&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a GRE tunnel between the sites and I would like to ensure that this tunnel is up even in case the connection is congested. First measure is that LAN facing interfaces have CAR set to 9.5Mbps in both directions. However, I would like to ensure that GRE keepalive messages are handled as fast as possible once they reach the Fa0/0 interface Rx ring buffer. What are the methods to achieve this? I guess I should use some other Rx queue strategy than FIFO on Fa0/0 ports?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-03-05T17:27:41.697" Title="QoS between two sites" Tags="|cisco|cisco-ios|qos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17060" PostTypeId="1" AcceptedAnswerId="17076" CreationDate="2015-03-05T14:49:35.177" Score="3" ViewCount="3798" Body="&lt;p&gt;I just rented a desk in an office. They have a LAN connected to the internet, and it’s shared among everyone in the (small) building.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a few network devices I want to connect, but I don’t want them to be visible to everyone on the shared LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’d like to create my own LAN with all my devices (Laptop, NAS, IP phones) connected to it. But I also want to use the internet connection available in the main LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a diagram of what exists (LAN 1) and what I want to add (LAN 2). Will that work? If not, then how do I do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/U5UzD.png&quot; alt=&quot;Network diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14199" LastActivityDate="2015-03-06T03:30:09.123" Title="Create LAN B, and use LAN A’s internet connection" Tags="|internet|lan|" AnswerCount="3" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17061" PostTypeId="2" ParentId="17060" CreationDate="2015-03-05T15:21:13.253" Score="2" Body="&lt;p&gt;If you want to seperate LAN2 from LAN1 solution here would be use of VLANs on the switch. LAN1 would be one VLAN and LAN2 second one. I don't know if you are using managed switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another solution would be to use classic routing, however someone has to configure the router in LAN 1 with static routing (or dynamic, but in this situation it would be waste). To restrict the access to your LAN you can then use firewall on your router (you will add rule that traffic from LAN1 clients will be restricted)&lt;/p&gt;&#xA;" OwnerUserId="13329" LastActivityDate="2015-03-05T15:21:13.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17063" PostTypeId="2" ParentId="17060" CreationDate="2015-03-05T15:47:11.143" Score="2" Body="&lt;p&gt;I have this setup and it works fine with simple home router. From your routers perspective, lan1 is the same as the Internet. Where it gets trickier, is if something in lan1 as to enter lan2, like printer advertisement or you want network discovery to browse you co-workers fileshare.&lt;/p&gt;&#xA;" OwnerUserId="14200" LastActivityDate="2015-03-05T15:47:11.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17064" PostTypeId="2" ParentId="17056" CreationDate="2015-03-05T17:27:41.697" Score="8" Body="&lt;p&gt;I'd recommend migrating from old-school CAR to modern config of CBWFQ.  When you do that, you can nest QoS policies together to accomplish more complicated QoS scenarios.  Per &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/P2P_GRE_IPSec/P2P_GRE_IPSec/2_p2pGRE_Phase2.html&quot;&gt;this Cisco doc&lt;/a&gt;, GRE keepalives are marked with CS6.  The keepalive is also a part of the GRE packets, not the inner IP packets that are being sent &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/63760-gre-keepalives-63760.html&quot;&gt;(source)&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map CM-CS6&#xA; match cs6&#xA;!&#xA;policy-map PM-FA0/0-QUEUE-OUT&#xA; class CM-CS6&#xA;  priority percent 5&#xA;!&#xA;policy-map PM-FA0/0-SHAPER-OUT&#xA; class class-default&#xA;  shape average 9500000&#xA;  service-policy PM-FA0/0-QUEUE-OUT&#xA;!&#xA;interface tunnel 100&#xA; qos pre-classify&#xA;!&#xA;interface Fa0/0&#xA; service-policy output PM-FA0/0-SHAPER-OUT&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, we create a class-map to match our GRE keepalives.  Note that this will actually over-match and includes all CS6 traffic.  This likely includes other routing/bridging protocols.  Not necessarily a bad thing, since the failure of the routing control-plane would bring the path down completely.  You might consider also prioritizing other high-CS classes for control-plane or voice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, we create a queuing policy-map for Fa0/0.  This will control how each class of traffic is treated during congestion.  In this case, the only class we define a policy for is CS6 (GRE keepalives and other control-plane traffic).  We say that CS6 traffic is allocated 5% of the available bandwidth in a priority queue.  That means that if there is CS6 traffic queued, it will always be sent on the link first (up to 5% of the link bandwidth).  Any traffic above that 5% will be sent best-effort with the rest of the traffic.  (See &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-packet-marking/10100-priorityvsbw.html&quot;&gt;this doc&lt;/a&gt; for more information on priority vs bandwidth allocation.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now it's time to replace your ancient 1962 Pinto CAR!  Create a policy-map for shaping on Fa0/0.  We want this shaper to apply to all traffic, so we only define a policy for class-default.  Shape to 9.5 Mbps.  Then nest our queuing policy.  This means that traffic will be sent FIFO as long as there is bandwidth available.  As soon as traffic reaches 95Mbps, the router will start queuing packets and will dequeue them according to PM-FA0/0-QUEUE-OUT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, we do a little future-proofing.  By default, the service-policy on the interface will inspect already-encapsulated traffic.  The router will copy the DSCP marking from the inner IP packet into the outer GRE header, so you'll still be able to read those.  But if you ever implement more complicated class-maps (using access lists or NBAR), the router will be blind to the internal contents of the GRE packets.  &quot;qos pre-classify&quot; makes a copy of the packet before encapsulation and uses that for QoS inspection rather than the GRE-encapsulated packet (&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/10106-qos-tunnel.html#qoscomm&quot;&gt;more reading&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, your complete QoS policy is applied to the physical interface (not the tunnel!).  Applying the shaper ensures your traffic is queued at 9.5 Mbps, and that any queued traffic is dealt with according to the queue policy you setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Side note:&#xA;There is no benefit in rate-limiting your traffic inbound.  You are only attached to one other endpoint, and you know for a fact that its shaping to 9.5Mbps.  Assuming there's not more to your topology, its safer to not try to control the inbound traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2015-03-05T17:27:41.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17065" PostTypeId="1" CreationDate="2015-03-05T19:06:47.200" Score="2" ViewCount="7175" Body="&lt;p&gt;Is it possible to have the VPN Server behind NAT and SSL/IPSec clients connect to it ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which ports will I have to forward ?&lt;/p&gt;&#xA;" OwnerUserId="14204" LastActivityDate="2016-02-14T10:46:26.863" Title="VPN SSL/IPsec Server Behind NAT" Tags="|vpn|nat|" AnswerCount="3" CommentCount="3" ClosedDate="2019-03-25T00:57:21.150" ContentLicense="CC BY-SA 3.0" />
  <row Id="17066" PostTypeId="1" AcceptedAnswerId="46561" CreationDate="2015-03-05T20:13:48.880" Score="1" ViewCount="4828" Body="&lt;p&gt;i am trying to understand when we can use hybrid ports on a huawei switch. i understand the difference between Trunk and Hybrid port, but so far I've been unable to find a scenario where i can see and understand better the use of Hybrid ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what i know:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hybrid ports can carry multiple untagged vlan traffic, while trunk ports can only carry untagged traffic for the default vlan. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone enlighten me where one can use a hybrid port?&lt;/p&gt;&#xA;" OwnerUserId="13605" LastActivityDate="2017-12-22T20:22:12.830" Title="Huawei switch Hybrid port" Tags="|switch|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17067" PostTypeId="1" AcceptedAnswerId="17070" CreationDate="2015-03-05T20:23:28.610" Score="5" ViewCount="19999" Body="&lt;p&gt;How would I go about converting a RTP stream from a pcap file to wav format with a command-line tool such as sox?&lt;/p&gt;&#xA;" OwnerUserId="1453" LastActivityDate="2022-12-16T12:50:00.857" Title="Converting PCAP to WAV" Tags="|voip|pcap|media-conversion|" AnswerCount="2" CommentCount="0" ClosedDate="2022-12-16T18:21:24.547" ContentLicense="CC BY-SA 3.0" />
  <row Id="17068" PostTypeId="1" AcceptedAnswerId="17071" CreationDate="2015-03-05T20:41:05.330" Score="-1" ViewCount="1193" Body="&lt;p&gt;what pattern does ttl usually follows? &#xA;working with a task where the ttl increments by 1 for every  3 packets. In the other task the ttl does not have any clear pattern. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Info: I am doing traceroute from: 192.168.2.2 to 198.38.88.104&lt;/p&gt;&#xA;" OwnerUserId="14206" LastEditorUserId="14206" LastEditDate="2015-03-10T00:32:23.920" LastActivityDate="2015-03-10T00:32:23.920" Title="Wireshark time to live pattern question" Tags="|tcp|wireshark|packet-analysis|ip|udp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17069" PostTypeId="1" AcceptedAnswerId="17075" CreationDate="2015-03-05T20:57:09.000" Score="2" ViewCount="734" Body="&lt;p&gt;Context: I understand the first two MAC addresses in a WiFi setting are for source (UE) and destination (AP) with the third address used to signify the layer-3 next-hop. The fourth address may be involved in the answer to this question (if so, the &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.11#Layer_2_.E2.80.93_Datagrams&quot; rel=&quot;nofollow&quot;&gt;Wikipedia entry on 802.11&lt;/a&gt; should be updated with any information on the fourth address!) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[UE] ~~ [Booster] ~~ [AP] -- [Switch] -- [Router] -- [The Internets]&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;UE: User Equipment, such as a laptop&lt;/li&gt;&#xA;&lt;li&gt;Booster: Signal boosting device&lt;/li&gt;&#xA;&lt;li&gt;AP: Access point out of range of UE without the aid of the booster&lt;/li&gt;&#xA;&lt;li&gt;Switch: Simple Ethernet switch&lt;/li&gt;&#xA;&lt;li&gt;Router: First-hop connection to the remainder of internet&lt;/li&gt;&#xA;&lt;li&gt;~~ Wireless (WiFi)&lt;/li&gt;&#xA;&lt;li&gt;-- Ethernet cable&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Suppose the booster isn't needed or used for a moment:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;MAC Address 1 is the receiver, the AP.&lt;/li&gt;&#xA;&lt;li&gt;MAC Address 2 is the transmitter, the UE.&lt;/li&gt;&#xA;&lt;li&gt;MAC Address 3 is the layer-3 first-hop, the Router.&lt;/li&gt;&#xA;&lt;li&gt;MAC Address 4 is probably unused.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now with the booster in the situation what happens? How are the addresses used differently after the frame reaches the booster (if at all)? &lt;/p&gt;&#xA;" OwnerUserId="13476" LastActivityDate="2015-03-06T02:43:27.943" Title="Which WiFi MAC addresses do signal boosters use?" Tags="|mac-address|layer2|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17070" PostTypeId="2" ParentId="17067" CreationDate="2015-03-05T21:01:39.257" Score="11" Body="&lt;p&gt;Here you go!&lt;br&gt;&#xA; 1. Enter &lt;code&gt;RTP&lt;/code&gt; in the display filter in Wireshark when the capture is open.&lt;br&gt;&#xA; 2. Now select an RTP packet in any stream and click on the menu option &lt;code&gt;Telephony&lt;/code&gt;.&lt;br&gt;&#xA; 3. Go to &lt;code&gt;RTP&lt;/code&gt;&gt;&lt;code&gt;Stream Analysis&lt;/code&gt; and click on &lt;code&gt;Save Payload&lt;/code&gt; button.&lt;br&gt;&#xA; 4. Change the format to &lt;code&gt;.au&lt;/code&gt; and choose a name (lets say &lt;code&gt;test.au&lt;/code&gt;) and location for your file.&lt;br&gt;&#xA; 5. Play it using your favorite audio player.&lt;br&gt;&#xA;OR&lt;br&gt;&#xA; 5. Run the following command to convert the &lt;code&gt;.au&lt;/code&gt; file to &lt;code&gt;.wav&lt;/code&gt; if you like &lt;code&gt;.wav&lt;/code&gt; files better: &lt;code&gt;sox test.au  -V -t wav -b 16 -c 2 test.wav&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps!&lt;/p&gt;&#xA;" OwnerUserId="14162" LastEditorUserId="14162" LastEditDate="2015-03-05T21:27:34.737" LastActivityDate="2015-03-05T21:27:34.737" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17071" PostTypeId="2" ParentId="17068" CreationDate="2015-03-05T21:25:11.403" Score="1" Body="&lt;p&gt;Like I mentioned in my comment above, this 3-packet TTL increment is typical of traceroute application. Since you're doing a traceroute from a Windows machine(192.168.2.2), it sends 3 ICMP packets with &lt;code&gt;TTL=1&lt;/code&gt; to the remote IP 198.38.88.104 and then keeps on incrementing by 1 after every 3 packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since your question is about the TTL value in the replies it receives from the devices in the path, please read the following:&lt;br&gt;&#xA;There's no global standard TTL value across all vendors but usually it is a multiple of 2. So, the TTL value in a capture on the client will usually follow the pattern: &lt;code&gt;(2^x)-n&lt;/code&gt;, where &lt;code&gt;n&lt;/code&gt; is the number of hops and &lt;code&gt;x&lt;/code&gt; could be any positive integer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the device that is 3 hops away (see packet #27) has the IP 193.212.176.97 and the TTL it sends is: &lt;code&gt;(2^8)-3&lt;/code&gt;, i.e. 253.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps!&lt;/p&gt;&#xA;" OwnerUserId="14162" LastActivityDate="2015-03-05T21:25:11.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17075" PostTypeId="2" ParentId="17069" CreationDate="2015-03-06T02:43:27.943" Score="4" Body="&lt;p&gt;You are a bit confused about the nature of addresses in 802.11 frames. Since your question isn't actually about the address fields, let me address that first and then go into the details on the address fields later in my answer if you are interested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most devices to which you are referring (whether they are call boosters, repeaters, extenders, etc) don't actually play a part in 802.11 as either a station or part of the distribution system (DS, also most commonly the access point or AP).  They are simply devices that listen for and then repeat a signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, let's say Bob and Bill need to pass a message by radio.  Unfortunately, they are too far apart (or maybe there is a mountain range in between) so they cannot reach each other directly.  Ben happens to be in the middle (or on the top of the mountain) and since Bob and Bill can't directly talk to each other, Ben offers to repeat their messages so they can communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when Bob says &quot;Hey, Bill, how are you?&quot; on his radio, Ben hears it and then repeats it back into the air and Bill then gets the message. Any replies from Bill are handled the same way. Ben is not the source, the destination, or the intended receiver of the message.  He doesn't &lt;em&gt;really&lt;/em&gt; directly play a part in the conversation at all.  This is the same process a &quot;booster&quot; will typically use on a 802.11 network.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The way the address fields are used in an 802.11 header is determined by the status of the &quot;To DS&quot; and &quot;From DS&quot; flags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Address 1 will always be the receiver address (RA) and address 2 will always be the transmitter address (TA).  This provides a consistent way for radios to easily determine if they need to receive the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If neither of the &quot;To DS&quot; or &quot;From DS&quot; flags are set, this is a management or &quot;station to station&quot; frame.  In these cases, address 1 is is the destination address (DA) in addition to the RA.  Address 2 is the source address (SA) in addition to the TA.  Address 3 would contain the BSSID (so radios not in the BSS can filter it) or be set to broadcast (all F's).  Address 4 is unused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If only the &quot;To DS&quot; flag is set, this is a frame bound from a station to a DS.  In this case, address 1 is both the RA and the BSSID, address 2 will be both the TA and the SA, and address 3 will be the DA.  This makes sense as while the station needs to send the frame to the DS, it is actually destined for some other host on the network and not for the DS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If only the &quot;From DS&quot; flag is set, this would be a frame from the DS (or AP) to a station.  Address 1 will be both the RA and the DA, address 2 will be both the TA and BSSID, and address 3 will be the SA.  Again this makes sense as while the DS is transmitting the frame, it was sourced from another device on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If both the &quot;To DS&quot; and &quot;From DS&quot; flags are set, this would be frames sent from one DS to another DS, such as you would find when using wireless access points to bridge traffic for other devices.  Address 1 will only be the RA, address 2 will only be the TA, address 3 will only be the DA and address 4 will only be the SA.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-03-06T02:43:27.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17076" PostTypeId="2" ParentId="17060" CreationDate="2015-03-06T03:30:09.123" Score="3" Body="&lt;p&gt;Yes, this will certainly work.  The router in &lt;code&gt;LAN 2&lt;/code&gt; will separate the differing network segments, creating a distinctly different LAN.&lt;/p&gt;&#xA;" OwnerUserId="14187" LastActivityDate="2015-03-06T03:30:09.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17077" PostTypeId="2" ParentId="16996" CreationDate="2015-03-06T03:39:56.597" Score="8" Body="&lt;p&gt;&lt;em&gt;Layer 4 - Transport layer&lt;/em&gt;.  This is the layer charged with handling end-to-end communication; be it reliable or unreliable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll frequently find that &lt;a href=&quot;https://networkengineering.stackexchange.com/a/6381/14187&quot;&gt;most networking concepts don't fit neatly into the OSI model&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14187" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-03-06T03:39:56.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17078" PostTypeId="1" AcceptedAnswerId="18098" CreationDate="2015-03-06T09:27:33.537" Score="2" ViewCount="2418" Body="&lt;p&gt;How can I get in a straight-forward way the bandwidth policed on a certain interface on IOS-XR. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IOS, I execute &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show policy-map interface Gi1/1.1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I get clearly the BW policed on interface &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; GigabitEthernet1/1.1000&#xA;&#xA;  Service-policy output: cos-REF0186382&#xA;&#xA;    class-map: class-default (match-any)&#xA;      Match: any &#xA;      police :&#xA;        10600000 bps 1250000 limit 1250000 extended limit&#xA;      Earl in slot 1 :&#xA;        0 bytes&#xA;        30 second offered rate 0 bps&#xA;        aggregate-forwarded 0 bytes action: transmit&#xA;        exceeded 0 bytes action: drop&#xA;        aggregate-forward 0 bps exceed 0 bps &#xA;      Earl in slot 5 :&#xA;        1111006353149 bytes&#xA;        30 second offered rate 204584 bps&#xA;        aggregate-forwarded 1082398797572 bytes action: transmit&#xA;        exceeded 28607555577 bytes action: drop&#xA;        aggregate-forward 210768 bps exceed 0 bps   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I get similar information on IOS-XR. &#xA;By similar command, I get counters but no info about configured policed BW. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:PE2#show policy-map interface Te0/0/0/1.1000&#xA;TenGigE0/0/0/1.1000 direction input: Service Policy not installed&#xA;&#xA;TenGigE0/0/0/1.1000 output: cos-REF123456789&#xA;&#xA;Class class-default&#xA;  Classification statistics          (packets/bytes)     (rate - kbps)&#xA;    Matched             :                   0/0                    0&#xA;    Transmitted         :                   0/0                    0&#xA;    Total Dropped       :                   0/0                    0&#xA;    Policy cos-po2-REF123456789 Class cos-vo-1&#xA;      Classification statistics          (packets/bytes)     (rate - kbps)&#xA;        Matched             :                   0/0                    0&#xA;        Transmitted         :                   0/0                    0&#xA;        Total Dropped       :                   0/0                    0&#xA;      Policing statistics                (packets/bytes)     (rate - kbps) &#xA;        Policed(conform)    :                   0/0                    0&#xA;        Policed(exceed)     :                   0/0                    0&#xA;        Policed(violate)    :                   0/0                    0&#xA;        Policed and dropped :                   0/0                  &#xA;        Policed and dropped(parent policer)  : N/A&#xA;      Queueing statistics&#xA;        Queue ID                             : 65744 &#xA;        High watermark                       : N/A &#xA;        Inst-queue-len  (packets)            : 0&#xA;        Avg-queue-len                        : N/A &#xA;        Taildropped(packets/bytes)           : 0/0&#xA;        Queue(conform)      :                   0/0                    0&#xA;        Queue(exceed)       :                   0/0                    0&#xA;        RED random drops(packets/bytes)      : 0/0&#xA;&#xA;    Policy cos-po2-REF123456789 Class cos-nm-1&#xA;      Classification statistics          (packets/bytes)     (rate - kbps)&#xA;        Matched             :                   0/0                    0&#xA;        Transmitted         :                   0/0                    0&#xA;        Total Dropped       :                   0/0                    0&#xA;      Queueing statistics&#xA;        Queue ID                             : 65746 &#xA;        High watermark                       : N/A &#xA;        Inst-queue-len  (packets)            : 0&#xA;        Avg-queue-len                        : N/A &#xA;        Taildropped(packets/bytes)           : 0/0&#xA;        Queue(conform)      :                   0/0                    0&#xA;        Queue(exceed)       :                   0/0                    0&#xA;        RED random drops(packets/bytes)      : 0/0&#xA;&#xA;        WRED profile for WRED Curve 1&#xA;        RED Transmitted (packets/bytes)            : N/A&#xA;        RED random drops(packets/bytes)            : 0/0&#xA;        RED maxthreshold drops(packets/bytes)      : N/A &#xA;        RED ecn marked &amp;amp; transmitted(packets/bytes): N/A &#xA;    Policy cos-po2-REF123456789 Class class-default&#xA;      Classification statistics          (packets/bytes)     (rate - kbps)&#xA;        Matched             :                   0/0                    0&#xA;        Transmitted         :                   0/0                    0&#xA;        Total Dropped       :                   0/0                    0&#xA;      Queueing statistics&#xA;        Queue ID                             : 65747 &#xA;        High watermark                       : N/A &#xA;        Inst-queue-len  (packets)            : 0&#xA;        Avg-queue-len                        : N/A &#xA;        Taildropped(packets/bytes)           : 0/0&#xA;        Queue(conform)      :                   0/0                    0&#xA;        Queue(exceed)       :                   0/0                    0&#xA;        RED random drops(packets/bytes)      : 0/0&#xA;&#xA;        WRED profile for WRED Curve 1&#xA;        RED Transmitted (packets/bytes)            : N/A&#xA;        RED random drops(packets/bytes)            : 0/0&#xA;        RED maxthreshold drops(packets/bytes)      : N/A &#xA;        RED ecn marked &amp;amp; transmitted(packets/bytes): N/A &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="206" LastActivityDate="2015-04-25T05:59:37.670" Title="IOS-XR - How to get bandwidth policed on an interface" Tags="|qos|policing|cisco-ios-xr|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17079" PostTypeId="1" AcceptedAnswerId="17261" CreationDate="2015-03-06T09:36:58.767" Score="0" ViewCount="371" Body="&lt;p&gt;I have 4 networks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A: 10.10.1.0/24  --\&#xA;B: 10.10.2.0/24  ---\  Juniper SSG-350M&#xA;C: 10.10.3.0/24  ---/ &#xA;D: 10.10.4.0/24  --/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a FreeBSD host in network D with an OpenVPN server working in tunnel mode with this segment: &lt;code&gt;172.16.13.0/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Route rule applied after clients connect:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route add -net 10.10.0.0 172.16.13.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Clients connected to the OpenVPN can ping/access hosts from all other networks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172.16.13.X --&amp;gt; 172.16.13.1 (openvpn gw) --&amp;gt; 10.10.X.1 (A,B,C.D gw) --&amp;gt; 10.10.X.X&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But for some reason can not &lt;strong&gt;ping&lt;/strong&gt; / &lt;strong&gt;telnet&lt;/strong&gt; the gateways (&lt;code&gt;10.10.X.1&lt;/code&gt;) from a connected client:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172.16.13.X --&amp;gt; 172.16.13.1(openvpn gw) --&amp;gt; 10.10.X.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I enable &lt;strong&gt;NAT&lt;/strong&gt; on the OpenVPN host, I do can ping/telnet the gateways, and continue to have access to the other hosts, therefore I would like to know, why is that I cannot ping the gateways when not using NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently OpenVPN is working fine only using routes not need to do NAT, but just would like to know why ping/telnet not working on the gateways and does work for the host.&lt;/p&gt;&#xA;" OwnerUserId="13950" LastEditorUserId="8499" LastEditDate="2018-12-21T05:26:27.537" LastActivityDate="2018-12-21T05:26:27.537" Title="can ping hosts but not gateways (no NAT)" Tags="|router|vpn|nat|ping|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17081" PostTypeId="2" ParentId="17066" CreationDate="2015-03-06T11:13:15.263" Score="1" Body="&lt;p&gt;imagine you want to seperate ipv4 and ipv6 traffic with different vlans,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you could use protocol based vlans (ethernetii etype 806) on hybrid ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;since they're carrying two untagged vlans no further configuration is neccesary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/j&lt;/p&gt;&#xA;" OwnerUserId="14215" LastActivityDate="2015-03-06T11:13:15.263" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17082" PostTypeId="2" ParentId="17065" CreationDate="2015-03-06T11:15:29.613" Score="0" Body="&lt;p&gt;For sslvpn that really depends on your vendor, but i'd say TCP/10443 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;because that's the most used port for sslvpn by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPsec you'd want UDP/500 and UDP/1500&lt;/p&gt;&#xA;&#xA;&lt;p&gt;j,&lt;/p&gt;&#xA;" OwnerUserId="14215" LastActivityDate="2015-03-06T11:15:29.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17083" PostTypeId="1" AcceptedAnswerId="17088" CreationDate="2015-03-06T11:22:21.510" Score="1" ViewCount="182" Body="&lt;p&gt;I have a LAN 10.0.0.0/255.255.252.0 (10.0.0.0-10.0.3.255) and want to separate clients (10.0.3.x) from the servers (10.0.0.x and 10.0.1.x) with a firewall in front of the servers.&#xA;My problem is, i cant change address ranges nor subnets.&#xA;Is this doable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: @HAL I looked up on vlsm and it looks exactly like what I need. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="14217" LastEditorUserId="14217" LastEditDate="2015-03-06T16:42:31.763" LastActivityDate="2015-03-09T05:59:17.463" Title="How to segment lan" Tags="|routing|firewall|lan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17087" PostTypeId="1" AcceptedAnswerId="17093" CreationDate="2015-03-06T17:17:38.240" Score="4" ViewCount="17872" Body="&lt;p&gt;Ports in my network on random switches(connected to Windows 7 workstations) are going into err-disable because of dynamic arp inspection. Ports are going into err-disable because there are too many arp requests packets per second. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please see output from the log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mar  2 13:14:35 EST: %SW_DAI-4-PACKET_RATE_EXCEEDED: 21 packets received in 922 milliseconds &#xA;on Gi1/0/6.&#xA;Mar  2 13:14:35 EST: %PM-4-ERR_DISABLE: arp-inspection error detected on Gi1/0/6, putting &#xA;Gi1/0/6 in err-disable state&#xA;Mar  2 13:14:36 EST: %LINEPROTO-5-UPDOWN: Line protocol on Interface &#xA;GigabitEthernet1/0/6, changed state to down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was able to capture port going into error disable (through SPAN). Please see attached capture:&#xA;&lt;a href=&quot;https://app.box.com/s/2ow0tlutzxwk5odk0zuqhug1kgqlykbd&quot; rel=&quot;nofollow&quot;&gt;https://app.box.com/s/2ow0tlutzxwk5odk0zuqhug1kgqlykbd&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IP address of the workstation that is on port gig1/0/6 is 151.121.79.89.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I see there are many ARP requests for 151.121.79.89 from random workstations at 13:14:34 and that is causing port to go into err-disable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am working with a Cisco &lt;code&gt;WS-C2960S-48FPS-L&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port configuration is standard for all access ports:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport access vlan 79&#xA;switchport mode access&#xA;switchport voice vlan 3001&#xA;switchport port-security maximum 3&#xA;switchport port-security&#xA;switchport port-security aging time 2&#xA;switchport port-security violation restrict&#xA;ip arp inspection limit rate 20&#xA;srr-queue bandwidth share 1 30 35 5&#xA;queue-set 2&#xA;priority-queue out&#xA;mls qos trust device cisco-phone&#xA;mls qos trust cos&#xA;spanning-tree portfast&#xA;service-policy input AUTOQOS-SRND4-CISCOPHONE-POLICY&#xA;ip dhcp snooping limit rate 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm also including the arp inspection config (the dhcp-snooping config on vlan 79 is typical): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip arp inspection vlan 79&#xA;ip arp inspection validate src-mac ip&#xA;ip arp inspection log-buffer entries 1024&#xA;ip arp inspection log-buffer logs 1024 interval 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am wondering why would random workstations try to resolve ip address of workstation connected to the 1/0/6 in less than a second?&lt;/p&gt;&#xA;" OwnerUserId="4608" LastEditorUserId="775" LastEditDate="2015-03-07T23:09:20.513" LastActivityDate="2015-10-23T13:51:14.763" Title="Dynamic ARP Inspection ports err-disable with %SW_DAI-4-PACKET_RATE_EXCEEDED" Tags="|cisco|arp|port-security|dhcp-snooping|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17088" PostTypeId="2" ParentId="17083" CreationDate="2015-03-06T19:13:01.370" Score="1" Body="&lt;p&gt;&lt;code&gt;Variable Length subnetting&lt;/code&gt; is the process by which you'd divide up the LAN adress into segments. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a previous answer that may assist you in the task. You can find it &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/8245/how-to-separate-a-network-in-3-subnetworks/8247#8247&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-03-06T19:13:01.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17090" PostTypeId="2" ParentId="17018" CreationDate="2015-03-06T19:19:40.350" Score="1" Body="&lt;p&gt;We sat a computer on the switches that were going through heavy broadcast traffic and ran wireshark. What we noticed was a high volume of NetBios traffic and repeated ARP requests where the same host was ARP'ing multiple times for the same target in a matter of minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NetBios was supposed to have been disabled on our network; after turning off NetBios services on the endpoints we were able to substantially reduce the amount of Broadcast traffic. NetBios is extremely chatty and continued to reach out for workgroup information before being disabled. &lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-03-06T19:19:40.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17092" PostTypeId="1" AcceptedAnswerId="17137" CreationDate="2015-03-06T19:56:34.923" Score="2" ViewCount="2911" Body="&lt;p&gt;We have a system using Windows 7 that connects to a piece of equipment directly using a crossover cable on NIC1 and it connects to the network on NIC2. It seems to communicate with everything it is supposed to just fine with the exception of one thing. The problem is a support program on the computer is supposed to communicate with the company that supports that piece of equipment over the internet. It uses three services:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;An XMPP Service - Netstat shows it connecting&lt;/li&gt;&#xA;&lt;li&gt;An RDP Service - Not connecting. I think this is initiated by the support end.&lt;/li&gt;&#xA;&lt;li&gt;A Telemetry service - I don't know if this has to be initiated by support.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The support company says they can't see the computer on our end. After a lot of troubleshooting they say, it is our firewall because it isn't allowing ACK packets to come back through. This worked when it was running on Windows XP so, I really don't think that is the issue. I did try this with the Windows firewall disabled with no luck.  My understanding with the following output is, ACKs are coming back through. According to our network manager ACKs aren't allowed to come back through. I can't get a packet capture on the other side of the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get the following output (sanitized) in wireshark&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z4e7o.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking for two things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Firewalls are a week area for me, can someone explain to me about ACK's not being allow back through and how that works or why that is a security risk if allowed?&lt;/li&gt;&#xA;&lt;li&gt;What do you suggest the next step to be?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The support company has the following in their documentation:&#xA; Equipment requires outbound communication on port 443 TLS. Incoming ports don't need to be opened. IP ACK messages much be allowed back through the firewall. No VPN Required due to TSL over 443.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Addendum:&#xA;I forgot to mention a couple of things. All of the packets look like they are appropriately ACK'ed in order. I think Wireshark is just calling it SSL traffic because it is using port 443. It looks more like unencrypted jabber (XMPP) traffic, so I am really confused by that. I was going to upload another screen capture of the wireshark output with all three streams in it but I think the frame numbers might confuse things. There are three streams in this capture and they all have the same data in them. There aren't any retransmits. I did a 20 minute capture that has a few in them but that was probably due to bandwidth congestion on our internet connection (time of day thing). I am going to get with the Support Company tomorrow and get them to look at what you all said. I think it will be very useful.&lt;/p&gt;&#xA;" OwnerUserId="14227" LastEditorUserId="8499" LastEditDate="2018-02-16T04:25:32.237" LastActivityDate="2018-02-16T04:25:32.237" Title="Firewalls and ACKs" Tags="|cisco|firewall|tcp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17093" PostTypeId="2" ParentId="17087" CreationDate="2015-03-06T21:03:07.277" Score="3" Body="&lt;p&gt;&lt;code&gt;ip arp inspection limit rate 20&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;20 packets per second is &lt;em&gt;really&lt;/em&gt; low. If there's a server on that port (or more than one system), 20 pps is nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know what any hosts are on your network (who's talking to who, and why), but for the minute at 13:14:34, 15 hosts asked who 89 was. And 89 asked who 5 hosts were. The request ~0.1sec before this period runs the total to 21pps. [filter: arp &amp;amp;&amp;amp; (eth.src == 10:1f:74:f5:be:36)]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Note: Cisco's default is even worse at &lt;em&gt;15&lt;/em&gt;.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-03-07T02:03:02.627" LastActivityDate="2015-03-07T02:03:02.627" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17094" PostTypeId="2" ParentId="10058" CreationDate="2015-03-06T22:05:30.463" Score="2" Body="&lt;p&gt;You have to allow DNS through.  Without DNS resolution, the http(s) requests will not finish and trigger the redirect to the login page.  What I did was add a rule that permitted DNS for All as the first rule, then everything else permitted for Trusted Users.&lt;/p&gt;&#xA;" OwnerUserId="14229" LastActivityDate="2015-03-06T22:05:30.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17095" PostTypeId="2" ParentId="17092" CreationDate="2015-03-06T22:40:18.727" Score="1" Body="&lt;p&gt;When you say &quot;The support company says they can't see the computer on our end&quot; do you mean the support company is initiating traffic from their end (possibly for the RDP connection you mention earlier)?  If this is the case I'm curious if the IP on the server is the same.  If it has changed, the required access may need to be adjusted on the firewall to allow the connection from support to the new server IP.  I still have to dive into Wireshark so I wouldn't be able to give you suggestions there.  If you can browse to an HTTPS website from the server or telnet to the support IP on port 443, that would be easy confirmation that HTTPS outbound is allowed (though not exact).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, for port 443, most firewalls (stateful) would allow the return traffic as long as the initiating traffic was allowed via access list rules.&lt;/p&gt;&#xA;" OwnerUserId="14230" LastActivityDate="2015-03-06T22:40:18.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17100" PostTypeId="1" AcceptedAnswerId="17103" CreationDate="2015-03-07T16:36:04.973" Score="11" ViewCount="14750" Body="&lt;p&gt;How can my wifi board detect wireless networks that are in range? What protocol is used to communicate with the devices in the area to announce a wifi AP? Does every router transmit on its own frequency and my wifi board scans &quot;every&quot; frequency to detect one?&lt;/p&gt;&#xA;" OwnerUserId="14198" LastEditorUserId="775" LastEditDate="2015-03-07T22:56:40.203" LastActivityDate="2015-03-12T02:42:18.653" Title="How do wifi clients detect SSIDs from APs?" Tags="|protocol-theory|ieee-802.11|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17103" PostTypeId="2" ParentId="17100" CreationDate="2015-03-07T16:57:48.530" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How can my wifi board detect wireless networks that are in range?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your client has a radio which listens to the wifi 802.11 frequencies for the country configured in the radio.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What protocol is used to communicate with the devices in the area to announce a wifi AP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Wifi APs are configured with an SSID; those SSIDs are known via &lt;a href=&quot;http://en.wikipedia.org/wiki/Beacon_frame&quot; rel=&quot;noreferrer&quot;&gt;beacon frames&lt;/a&gt;; by default beacon frames are sent every 102.4 milliseconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://mrncciew.com/2014/10/08/802-11-mgmt-beacon-frame/&quot; rel=&quot;noreferrer&quot;&gt;beacon frame format&lt;/a&gt; includes an &lt;a href=&quot;http://en.wikipedia.org/wiki/Service_set_%28802.11_network%29#Service_set_identification_.28SSID.29&quot; rel=&quot;noreferrer&quot;&gt;SSID&lt;/a&gt; field, and the beacon interval.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The radio in your AP is configured for a specific &lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_WLAN_channels&quot; rel=&quot;noreferrer&quot;&gt;channel&lt;/a&gt;.  Those beacon frames are transmitted on the AP's channel. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does every router transmit on its own frequency and my wifi board scans &quot;every&quot; frequency to detect one?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Every wireless AP can select from a pre-defined list of &lt;a href=&quot;http://en.wikipedia.org/wiki/List_of_WLAN_channels&quot; rel=&quot;noreferrer&quot;&gt;wireless channels&lt;/a&gt;, and it chooses one channel to announce the SSID.  Your wifi client constantly walks (or scans through) all those channels to figure out which SSIDs are available.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-03-07T16:57:48.530" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17107" PostTypeId="2" ParentId="17087" CreationDate="2015-03-07T23:37:04.743" Score="2" Body="&lt;p&gt;user4608 &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17087/dynamic-arp-inspection-ports-err-disable-with-sw-dai-4-packet-rate-exceeded#comment25106_17093&quot;&gt;said&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I was aware that rate limit is 20. What value would you recommend?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no one good answer to this question; you need to know your environment pretty well to know where to set the threshold.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Arguably, if you're still seeing err-disables at 50 DAI inspections per second, I'd keep bumping it in increments of 25 until you find something that works.  You might consider using this as a workaround until you find a value that works for all ports in your environment...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;errdisable recovery interval 30&#xA;errdisable recovery cause arp-inspection&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This doesn't fix the problem, but it keeps your help-desk from getting a lot of calls from users who get err-disabled while you figure out what the right DAI thresholds are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just don't care about ARP rate-limits you could configure your ports like this...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw1(config-if)#ip arp inspection limit none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I would rather deal with a little bit of pain so ports with unusual arp rates get flagged.  There is plenty of misbehavior that happens with ARP, so I'd rather have a chance of knowing that people are doing something strange.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can just grep through your syslogs for &lt;code&gt;SW_DAI-4-PACKET_RATE_EXCEEDED&lt;/code&gt; until you find values that work for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bonus material (dhcp snooping)&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, strictly speaking, this isn't what you asked about, but if you haven't already, I'd set up an alert in your syslogs when you get &lt;code&gt;%DHCP_SNOOPING-5-DHCP_SNOOPING_UNTRUSTED_PORT&lt;/code&gt; messages (ref &lt;a href=&quot;http://packetpushers.net/five-things-to-know-about-dhcp-snooping/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethan Banks' blog&lt;/a&gt;).  That could indicate someone is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Trying to operate their own DHCP server on your network (naturally this isn't good, but it's not always malicious)&lt;/li&gt;&#xA;&lt;li&gt;Trying to spoof DHCP OFFER packets (that's bad, for instance they could assign themselves as the client's gateway in preparation for a MITM attack)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-03-07T23:37:04.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17109" PostTypeId="2" ParentId="14939" CreationDate="2015-03-08T06:40:50.053" Score="2" Body="&lt;p&gt;1:1 NAT (under Configure &gt; Firewall) is the right way to route multiple public IP addresses.  &lt;a href=&quot;https://kb.meraki.com/knowledge_base/configuring-11-nat&quot; rel=&quot;nofollow&quot;&gt;https://kb.meraki.com/knowledge_base/configuring-11-nat&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14243" LastActivityDate="2015-03-08T06:40:50.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17110" PostTypeId="2" ParentId="12752" CreationDate="2015-03-08T07:00:13.957" Score="1" Body="&lt;p&gt;I think you're understanding the configuration correctly! The Internet Port IP address is the address of the physical port. If your ISP router/modem is in pass-thru mode, then the Public IP address will be the same as the Internet Port IP address. But, since your Internet port IP address is a private IP address, the Public IP address will reflect the public address assigned by your ISP as detected by the Meraki Cloud Controller.&lt;/p&gt;&#xA;" OwnerUserId="14243" LastActivityDate="2015-03-08T07:00:13.957" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17115" PostTypeId="1" CreationDate="2015-03-08T18:20:35.023" Score="7" ViewCount="70983" Body="&lt;p&gt;I understand that Firewalls may operate on different OSI layers depends on the firewall itself.&#xA;but how can I know if I install specific firewall at what OSI Layer(s) it does operate ?&lt;/p&gt;&#xA;" OwnerUserId="14248" LastActivityDate="2018-10-11T18:56:44.203" Title="How to know at what OSI Layer(s) does a firewall operate" Tags="|firewall|osi|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17116" PostTypeId="2" ParentId="2836" CreationDate="2015-03-08T18:49:55.163" Score="0" Body="&lt;p&gt;If you own the device you want to sniff (and if you don't, maybe you shouldn't do it) then there is the option of creating a wifi hotspot on your mac and connect your mobile device to the hotspot.  This lets you see all the traffic going thru your mac without any wifi-related encryption.  Of course, ssl encryption remains.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to be otherwise connected by ethernet.&lt;/p&gt;&#xA;" OwnerUserId="14249" LastActivityDate="2015-03-08T18:49:55.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17117" PostTypeId="1" CreationDate="2015-03-08T21:38:43.817" Score="0" ViewCount="1030" Body="&lt;p&gt;Why do TMAs have to be mounted near the antenna of the basestation? Is there any technical restrictions for mounting the TMA near the BTS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have never seen a TMA inside the shelter near the BTS; all are mounted high on the mast next to the antenna. This way, they are difficult to service, especially in bad weather.&lt;/p&gt;&#xA;" OwnerUserId="5576" LastEditorUserId="8499" LastEditDate="2016-03-17T00:50:22.150" LastActivityDate="2016-03-17T00:50:22.150" Title="Why is a TMA always mounted near the antenna?" Tags="|wireless|mobile|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17118" PostTypeId="2" ParentId="17115" CreationDate="2015-03-08T21:39:13.150" Score="15" Body="&lt;p&gt;Since firewalls essentially filter data, the answer depends on what kind of filtering you do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you filter based on IP address (for example), you can say that your firewall is filtering at layer 3.  If you filter specific ports, you can say you're filtering at layer 4.  If your firewall inspects specific protocol states or data, you can say it operates at layer 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The truth is that most firewalls do all these things in combination.  So practically speaking there really is no useful answer to your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;May I suggest you also read &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6380/osi-model-and-networking-protocols-relationship?rq=1&quot;&gt;this question about the OSI model&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-03-08T21:39:13.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17121" PostTypeId="2" ParentId="6720" CreationDate="2015-03-09T03:29:37.230" Score="2" Body="&lt;p&gt;Re: Can you have subnet overlap if the subnet is a smaller subnet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot configure overlapping subnets on a Cisco router. IOS issues error message when you attempt to enter the offending IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While not recommended, you can configure a subnet on one router that overlaps with a subnet on another (different) router. For example, router R1 has 10.1.1.1/24 and R2 has 10.1.1.129/25. But this will create problems - often intermittent but problems nonetheless. Not recommended.&lt;/p&gt;&#xA;" OwnerUserId="14253" LastActivityDate="2015-03-09T03:29:37.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17123" PostTypeId="2" ParentId="12889" CreationDate="2015-03-09T04:19:26.533" Score="0" Body="&lt;p&gt;In addition to the VLAN tagging issue above, You may want to look at you access point in more detail. The L2 switch should be fine as long as your VLAN tags match up, but you may find that depending on how your AP handles traffic (what is it, router? Dumb Cisco AP?), it may need some sort of &lt;a href=&quot;http://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#DHCP_relaying&quot; rel=&quot;nofollow&quot;&gt;DHCP Relay&lt;/a&gt; or a settings adjustment to place it into AP mode.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-03-09T04:19:26.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17124" PostTypeId="2" ParentId="17115" CreationDate="2015-03-09T04:31:10.900" Score="1" Body="&lt;p&gt;Unless your firewall uses the OSI model, it is of little value to speak about it in these terms. You should bear in mind that the TCP/IP model only has &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_protocol_suite#Layer_names_and_number_of_layers_in_the_literature&quot; rel=&quot;nofollow&quot;&gt;five layers&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, it largely depends on if your firewall is capable of doing Deep Packet Inspection. If it is, it operates at L3/L4 and at the Application Layer. Otherwise, it only filters at the IP and Transport layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, it &quot;Operates&quot; at all layers except for the application layer. It must have a physical connection, provide a data link/Network connection and enforce NAT policies and firewall rules at the IP layer and Transport layer. If it didn't it would not be a functioning firewall. &lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-03-09T04:31:10.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17128" PostTypeId="2" ParentId="17092" CreationDate="2015-03-09T05:05:44.700" Score="0" Body="&lt;p&gt;In the pcap you provide a screenshot of, you establish a connection and then send 2 packets. Only 1 ACK is recieved. This is not abnormal as TCP uses window scaling, but in the 6th frame, it might be helpful to know what frame this is an ACK to. If you click on this frame, Wireshark has a SEQ/ACK analysis section. If this is an ACK to frame 5, then the support company has no leg to stand on. If it is an ACK to frame 4, the you might be missing the ACK to frame 5, but it is doubtful that you are blocking ACKs as you received an ACK to frame 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like the telemetry service is HTTPS based. Based on this, it looks like a failed SSL handshake.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastEditorUserId="14254" LastEditDate="2015-03-09T06:01:22.820" LastActivityDate="2015-03-09T06:01:22.820" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17129" PostTypeId="2" ParentId="10058" CreationDate="2015-03-09T05:13:48.170" Score="0" Body="&lt;p&gt;Based on this, it sounds like you are working with SSLVPN for SonicWALL. This, and the login page are the only things SonicWALL uses a redirect rule for. If this is what you are having trouble with and you have licensed you SonicWALL, you should contact SonicWALL support. I have always received world class support from them and they can help you locate the issue in your specific case. I can't speak highly enough of their support.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-03-09T05:13:48.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17133" PostTypeId="2" ParentId="16933" CreationDate="2015-03-09T05:45:34.497" Score="-4" Body="&lt;p&gt;Traceroute is used to find the hops between you and the destination. In between the hop count whatever the number of hops the TTL is not affected, TTL is concerned with routing protocols. If you do a traceroute and you get unreachable that means you will have a connection problem between you ( the host) and the destination. try checking the physical layer, layer 2 and of course layer 3 ( because I doubt that you can even ping).&lt;/p&gt;&#xA;" OwnerUserId="14255" LastActivityDate="2015-03-09T05:45:34.497" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17135" PostTypeId="2" ParentId="17083" CreationDate="2015-03-09T05:59:17.463" Score="-1" Body="&lt;p&gt;No. The problem is that based on your subnet any devices on the network will bypass the default gateway and communicate directly with their peer. If you want to establish a DMZ in this manner, a subnet update on each client is mandatory.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-03-09T05:59:17.463" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17137" PostTypeId="2" ParentId="17092" CreationDate="2015-03-09T07:22:38.623" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It is non-standard (and in fact, counter-productive) for a firewall to not allow an ACK back through the Firewall if the original SYN or Data packet that caused the ACK was permitted through.  &lt;strong&gt;TCP Requires ACKs to even form a connection.&lt;/strong&gt;  Your Network Manager is misinformed or confused.  ACK's do not pose a security risk.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Your next step is to prove your Firewall is receiving the initial SYN, and returning the SYN ACK.  If the packet capture in your picture is captured from your Firewall, then you have sufficient proof of this fact.  Specially if this capture is from the outside interface of your Firewall (the one facing the Internet)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;@Karyhead made a great point that something tricky is going on with the &quot;SSL Handshake&quot; (it will make sense why that is in quotes when you finish reading this post).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Almost every type of SSL Handshake will always start with a Client Hello (sent from the Client), followed immediately by a Server Hello (sent by the server).  Instead, your packet capture is indicating that immediately following the Three Way Handshake (these are the packets labeled &lt;code&gt;[SYN] [SYN,ACK] [ACK]&lt;/code&gt;) the Client is sending two packets.  We can learn a few things from these two packets:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Based on the Time Delta, the 2nd packet is sent .000002 seconds after the 1st, which tells us &lt;strong&gt;this is not a re-transmitted packet&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;The next two packets in the capture from the server include an ACK# of 156 and 173.  Which means the first packet was &lt;em&gt;probably&lt;/em&gt; 155 bytes, and the 2nd packet was &lt;em&gt;probably&lt;/em&gt;  17 bytes.  I say probably because I don't have access to the PCAP to validate definitively, and there may be some other strangeness going on.  Either way, the one thing we know for sure is &lt;strong&gt;these first two packets from the Client were 172 bytes &lt;em&gt;combined&lt;/em&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;These are &lt;em&gt;not&lt;/em&gt; a Client Hello&lt;/strong&gt;.  I compared to a few sample captures on my laptop, most Client Hellos were around 200+~ bytes.  I didn't see any less than 200.  Moreover, if it were a Client Hello, Wireshark would have interpreted it as such.  Additionally, you can see in the first and second packet that the MSS gets set to 1432, which means it isn't a case of the 172 byte Client Hello having to be fragmented into two packets.  &lt;/li&gt;&#xA;&lt;li&gt;The server sends no data to the client.  You can tell because when the server sends its FIN in the 2nd to last packet, the Sequence number is just 1.  Which means the only item that was sent by the Server that required an acknowledgement was the Server's &quot;SYN&quot; from its original &quot;SYN/ACK&quot;.  What this tells us is &lt;strong&gt;this is definitely &lt;em&gt;not&lt;/em&gt; a SSL/TLS handshake&lt;/strong&gt;.  Every SSL/TLS handshake requires information from &lt;em&gt;both sides&lt;/em&gt; of the conversation.  Even an abbreviated handshake requires confirmation from both parties that they still have the necessary authentication and keying material.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note: For the sake of this post, SSL and TLS are completely identical and can be &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end, you are probably looking at someone tunneling data through port 443.  Its impossible to tell what data it might be from just what you sent, but if that conversation came across &lt;em&gt;my&lt;/em&gt; Firewall that was supposedly only letting SSL-encrypted-HTTP over port 443 through (aka, HTTPS), I would definitely take a closer look at the content to figure out what that might be.  It could be malicious, but it could be harmless.  And even if its harmless, I would want to know what is ... and why they feel they need to tunnel their traffic over TCP/443 instead of request an another application port be opened through.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-03-09T07:22:38.623" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17139" PostTypeId="2" ParentId="17065" CreationDate="2015-03-09T08:18:27.367" Score="1" Body="&lt;p&gt;Really need more detail to answer definitively, but generally...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPsec, you will need to forward ISAKMP (UDP/500) and NAT-T (UDP/4500).  Potentially other ports if you've configured your VPN to tunnel on other, non-standard, ports than these two.  Also worth pointing out, most IPsec implementations today use ESP (IP Protocol 50), which &lt;em&gt;is able&lt;/em&gt; to pass through NAT.  Unlike its counter-part AH (IP Protocol 51), which is entirely incompatible with &lt;em&gt;any&lt;/em&gt; sort of NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For SSL/TLS, you will need to forward TCP/443 through your NAT device.  Unless, again, your implementation is specifically listening on another port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the above is assuming your SSL Server/VPN Termination point is behind a PAT IP (many to one NAT).  If, however, you are simply behind a PAT and making connections outbound to a static/public VPN/SSL IP, then you typically won't have to do anything special, unless your IT/Network administrators lock down your outbound traffic as well (which isn't terribly uncommon, but I wouldn't quite call it common).&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-03-09T08:18:27.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17142" PostTypeId="2" ParentId="17053" CreationDate="2015-03-09T08:42:53.687" Score="0" Body="&lt;p&gt;&lt;strong&gt;WAN Intro&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On WANs or wide area network is the connection that spans over geographic regions. In order to obtain such a connection the LAN must go through a telecom provider who creates these links thanks to the telecom leased Lines(PPP, HDLC, SDLC technology). Now very long ago Leased lines were very expensive. Enter WAN technology, which provides such connections but at much cheaper prices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Different WAN Types&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Frame Relay which is such a technology . Which provided a much cheaper connection mainly because one could do point to multipoint thus organizations could expand without fearing costs, however frame relay was replaced (just like it replaced x.25) by ATM technology. &#xA;  After some time because ATM provided more overhead than framerelay many network engineers agreed that ATM should be replaced with a protocol that requires less overhead, while providing connection-oriented services for variable-length frames. MPLS is currently replacing some of these technologies in the marketplace. It is highly possible that MPLS will completely replace these technologies in the future thus new types of services such as VPLS, L2VPN, L3VPN can be adopted for an organizations needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BGP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP is a routing protocol like any routing protocol shares its routing tables but between different AS ( autonomous systems). Thus with Routers knowing the routing tables of others are able to know the source IP and Destination IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So first you need to provide a connection ( MPLS/ATM/FRAMERELAY)&#xA;Then you choose your Routing Protocol that will work among the routers (BGP/Exterior EIGRP between AS  OSPF/EIGRP for interior networks).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Notes&lt;/strong&gt;&#xA;You can read all of this in any ccna book where it gives you a more detailed history on these technologies. &lt;/p&gt;&#xA;" OwnerUserId="14255" LastEditorUserId="14255" LastEditDate="2015-03-09T08:48:23.163" LastActivityDate="2015-03-09T08:48:23.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17145" PostTypeId="2" ParentId="2836" CreationDate="2015-03-09T10:02:43.900" Score="0" Body="&lt;p&gt;Before running any trafic analysis tool, just run a basic in Terminal window 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ifconfig en0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to get the default configuration of your Wi-Fi interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then in another Terminal window 2 start a:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/usr/bin/sudo tcpdump -i en0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Back in Terminal window 1, run once more:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ifconfig en0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you should see that now your Wi-Fi interface is in promiscuous mode (&lt;code&gt;PROMISC&lt;/code&gt; flag):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;en0: flags=8963&amp;lt;UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST&amp;gt; mtu 1500&#xA;    ether zz:yy:xx:ww:vv:uu &#xA;    inet 192.168.2.2 netmask 0xffffff00 broadcast 192.168.2.255&#xA;    media: autoselect&#xA;    status: active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If your version of MacOS X doesn't behave exactly as this, please add the output of the above basic test within your OQ, and specify which version of MacOS X you are running.&lt;/p&gt;&#xA;" OwnerUserId="13986" LastActivityDate="2015-03-09T10:02:43.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17146" PostTypeId="1" AcceptedAnswerId="17149" CreationDate="2015-03-09T10:20:38.840" Score="2" ViewCount="559" Body="&lt;p&gt;I configured an asa 5505 to limit users to only access only company resources and skype. &#xA;I got skype working but the company sites in the ACLs aren't accessible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 8.2(5)&#xA;!&#xA;firewall transparent&#xA;hostname ciscoasa&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA; switchport access vlan 3&#xA;!&#xA;interface Ethernet0/2&#xA; shutdown&#xA;!&#xA;interface Ethernet0/3&#xA; shutdown&#xA;!&#xA;interface Ethernet0/4&#xA; shutdown&#xA;!&#xA;interface Ethernet0/5&#xA; shutdown&#xA;!&#xA;interface Ethernet0/6&#xA; shutdown&#xA;!&#xA;interface Ethernet0/7&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no nameif&#xA; no security-level&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA;!&#xA;interface Vlan3&#xA; nameif inside&#xA; security-level 100&#xA;!&#xA;ftp mode passive&#xA;object-group network LIMITED_USERS&#xA; network-object 192.168.108.64 255.255.255.192&#xA;object-group network ESSENTIALS&#xA; network-object 196.33.158.28 255.255.255.255&#xA; network-object 212.22.161.2 255.255.255.255&#xA; network-object 196.30.251.214 255.255.255.255&#xA; network-object 212.22.179.162 255.255.255.255&#xA; network-object 41.78.37.84 255.255.255.255&#xA; network-object 91.190.216.21 255.255.255.255&#xA;object-group service SKYPE&#xA; service-object tcp-udp gt 1024&#xA;access-list LIMIT_TRAFFIC extended permit ip object-group LIMITED_USERS object-group ESSENTIALS&#xA;access-list LIMIT_TRAFFIC extended permit object-group SKYPE object-group LIMITED_USERS any&#xA;pager lines 24&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;ip address 192.168.108.6 255.255.255.0&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;access-group LIMIT_TRAFFIC in interface inside&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;aaa authentication telnet console LOCAL&#xA;aaa authentication ssh console LOCAL&#xA;aaa authentication http console LOCAL&#xA;http server enable&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;telnet 192.168.108.0 255.255.255.0 inside&#xA;telnet timeout 5&#xA;ssh 0.0.0.0 0.0.0.0 inside&#xA;ssh timeout 5&#xA;console timeout 0&#xA;dhcpd dns 8.8.8.8 8.8.4.4&#xA;dhcpd option 3 ip 192.168.108.4&#xA;!&#xA;dhcpd address 192.168.108.65-192.168.108.96 inside&#xA;dhcpd enable inside&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc&#xA;  inspect xdmcp&#xA;  inspect sip&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect ip-options&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;Cryptochecksum:ed62961c9bc8bc367be20c8c498bb290&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output of &lt;code&gt;capture DENY type asp-drop all real-time trace&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1: 00:58:52.033079 802.1Q vlan#2 P0 192.168.108.9.63084 &amp;gt; 239.255.255.250.3702:  udp 656&#xA;   2: 00:58:55.155570 802.1Q vlan#2 P0 fe80::49d5:e406:d284:1d36.546 &amp;gt; ff02::1:2.547:  udp 88 [hlim 1]&#xA;   3: 00:58:55.988291 802.1Q vlan#3 P0 192.168.108.65.63090 &amp;gt; 8.8.8.8.53:  udp 36&#xA;   4: 00:58:55.988397 802.1Q vlan#3 P0 192.168.108.65.63090 &amp;gt; 8.8.4.4.53:  udp 36&#xA;   5: 00:58:58.135643 802.1Q vlan#3 P0 192.168.108.65.51399 &amp;gt; 8.8.4.4.53:  udp 43 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule&#xA;   6: 00:58:59.134789 802.1Q vlan#3 P0 192.168.108.65.51399 &amp;gt; 8.8.8.8.53:  udp 43&#xA;   7: 00:59:00.035337 802.1Q vlan#3 P0 192.168.108.65.62398 &amp;gt; 8.8.4.4.53:  udp 36&#xA;   8: 00:59:00.134499 802.1Q vlan#3 P0 192.168.108.65.51399 &amp;gt; 8.8.4.4.53:  udp 43 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule&#xA;   9: 00:59:01.034406 802.1Q vlan#3 P0 192.168.108.65.62398 &amp;gt; 8.8.8.8.53:  udp 36 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule&#xA;  10: 00:59:02.034132 802.1Q vlan#3 P0 192.168.108.65.62398 &amp;gt; 8.8.4.4.53:  udp 36&#xA;  11: 00:59:02.134072 802.1Q vlan#3 P0 192.168.108.65.51399 &amp;gt; 8.8.8.8.53:  udp 43 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule&#xA;  12: 00:59:02.134163 802.1Q vlan#3 P0 192.168.108.65.51399 &amp;gt; 8.8.4.4.53:  udp 43 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule&#xA;  13: 00:59:03.117791 802.1Q vlan#3 P0 192.168.108.65.49972 &amp;gt; 79.119.88.88.1: S 3455399371:3455399371(0) win 8192 &amp;lt;mss 1460,nop,                      wscale 2,nop,nop,sackOK&amp;gt; Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;  14: 00:59:03.616728 802.1Q vlan#3 P0 192.168.108.65.49972 &amp;gt; 79.119.88.88.1: S 3455399371:3455399371(0) win 8192 &amp;lt;mss 1460,nop,                      wscale 2,nop,nop,sackOK&amp;gt;&#xA;  15: 00:59:04.033750 802.1Q vlan#3 P0 192.168.108.65.62398 &amp;gt; 8.8.8.8.53:  udp 36 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule&#xA;  16: 00:59:04.033857 802.1Q vlan#3 P0 192.168.108.65.62398 &amp;gt; 8.8.4.4.53:  udp 36 Drop-reason: (acl-drop) Flow is denied by conf                      igured rule&#xA;  17: 00:59:04.116647 802.1Q vlan#3 P0 192.168.108.65.49972 &amp;gt; 79.119.88.88.1: S 3455399371:3455399371(0) win 8192 &amp;lt;mss 1460,nop,                      nop,sackOK&amp;gt; Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;  18: 00:59:04.296585 802.1Q vlan#2 P0 fe80::9fd:d9c5:9aaf:6667.546 &amp;gt; ff02::1:2.547:  udp 82 [hlim 1]&#xA;  19: 00:59:06.134346 802.1Q vlan#3 P0 192.168.108.65.51399 &amp;gt; 8.8.8.8.53:  udp 43&#xA;  20: 00:59:06.134468 802.1Q vlan#3 P0 192.168.108.65.51399 &amp;gt; 8.8.4.4.53:  udp 43&#xA;  21: 00:59:08.033949 802.1Q vlan#3 P0 192.168.108.65.62398 &amp;gt; 8.8.8.8.53:  udp 36&#xA;  22: 00:59:08.034055 802.1Q vlan#3 P0 192.168.108.65.62398 &amp;gt; 8.8.4.4.53:  udp 36 Drop-reason: (acl-drop) Flow is denied by conf  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14264" LastEditorUserId="775" LastEditDate="2015-03-09T11:41:36.567" LastActivityDate="2015-03-09T11:46:13.830" Title="How do I configure an asa 5505 to limit users to only access only company resources and Skype?" Tags="|cisco|cisco-asa|acl|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17147" PostTypeId="2" ParentId="17037" CreationDate="2015-03-09T10:25:38.023" Score="2" Body="&lt;p&gt;If the AP's are connected with Flex-Master[Ruckus Management Software], then you can push the AP configuration templates from one standalone to another. &lt;/p&gt;&#xA;" OwnerUserId="14255" LastEditorUserId="453" LastEditDate="2018-03-26T07:18:01.117" LastActivityDate="2018-03-26T07:18:01.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17149" PostTypeId="2" ParentId="17146" CreationDate="2015-03-09T11:46:13.830" Score="2" Body="&lt;p&gt;There are two problems in that capture...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;DNS traffic is denied...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;15: 00:59:04.033750 802.1Q vlan#3 P0 192.168.108.65.62398 &amp;gt; 8.8.8.8.53:  udp 36 Drop-reason: (acl-drop) Flow is denied by configured rule&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;16: 00:59:04.033857 802.1Q vlan#3 P0 192.168.108.65.62398 &amp;gt; 8.8.4.4.53:  udp 36 Drop-reason: (acl-drop) Flow is denied by configured rule&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;One of your clients is trying to go to 79.119.88.88.1, but it's denied...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;17: 00:59:04.116647 802.1Q vlan#3 P0 192.168.108.65.49972 &amp;gt; 79.119.88.88.1: S 3455399371:3455399371(0) win 8192 &amp;lt;mss 1460,nop,nop,sackOK&amp;gt; Drop-reason: (acl-drop) Flow is denied by configured rule&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;More than likely, your clients are using hostnames to go to some resource, and need to allow DNS traffic to 8.8.8.8 and 8.8.4.4 in &lt;code&gt;object-group network ESSENTIALS&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, it's best just to make a rule that allows all DNS (i.e. destination udp/53), since DNS queries may recurse through other resolvers.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-03-09T11:46:13.830" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17150" PostTypeId="1" AcceptedAnswerId="17151" CreationDate="2015-03-09T11:51:49.177" Score="4" ViewCount="25133" Body="&lt;p&gt;I have a Cisco ASA, which is denying traffic from 172.16.1.5 to 4.2.2.2 on tcp/9000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I diagnose why this is happening from the Cisco ASA CLI?&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2016-07-01T08:16:54.960" Title="How should I diagnose why my Cisco ASA denies traffic?" Tags="|cisco|cisco-asa|firewall|security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17151" PostTypeId="2" ParentId="17150" CreationDate="2015-03-09T11:51:49.177" Score="5" Body="&lt;p&gt;The easiest way to figure out why your ASA drops traffic:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If it's a routed ASA firewall, use &lt;a href=&quot;https://supportforums.cisco.com/document/29601/troubleshooting-access-problems-using-packet-tracer&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;packet-tracer&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Both routed and transparent ASA firewalls can use &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118097-configure-asa-00.html#anc13&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;capture [NAME] asp-drop&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Using &lt;code&gt;packet-tracer&lt;/code&gt; (only on routed ASA firewalls):&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Routed firewalls give us the most information when we need to figure out why something was dropped; it's best to use &lt;code&gt;packet-tracer&lt;/code&gt; to figure out why the routed firewall dropped something (although it won't catch every possible case).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming 172.16.1.5's source port is 1024 for the purposes of getting a diagnosis...  The syntax is &lt;code&gt;packet-tracer input INSIDE tcp [SRC_HOST] [SRC_PORT] [DST_HOST] [DST_PORT]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa-fw# packet-tracer input INSIDE tcp 172.16.1.5 1024 4.2.2.2 9000&#xA;&#xA;!!! output truncated&#xA;&#xA;Phase: 4&#xA;Type: ACCESS-LIST&#xA;Subtype: log&#xA;Result: DROP                                            &amp;lt;---- ASA Dropped the traffic&#xA;Config:&#xA;access-group INSIDE_in in interface INSIDE&#xA;access-list INSIDE_in extended deny ip any4 any4 log    &amp;lt;---- This rule denied the traffic&#xA;Additional Information:&#xA;&#xA;Result:&#xA;input-interface: INSIDE&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: OUTSIDE&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: drop&#xA;Drop-reason: (acl-drop) Flow is denied by configured rule   &amp;lt;----&#xA;&#xA;asa-fw#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Using &lt;code&gt;capture [NAME] asp-drop&lt;/code&gt; (routed or transparent ASA firewalls):&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Transparent firewalls are trickier to diagnose, but you can still get some useful information with the &lt;code&gt;capture ... asp-drop&lt;/code&gt; command.  The ASP is the ASA's &quot;Accelerated Security Path&quot;; this is where many drops happen.  I have seen some dropped traffic that doesn't show in &lt;code&gt;asp-drop&lt;/code&gt;, but usually that's because of an overwhelmed backplane in the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are four steps...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Configure a packet capture buffer on the ASA.  For tcp traffic, the syntax is &lt;code&gt;capture [CAPTURE_NAME] type asp-drop all buffer [BUFFER_SIZE] match tcp host [SRC_HOST] host [DST_HOST] eq [DST_PORT]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Wait for the denied traffic&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;show capture [NAME] trace&lt;/code&gt; to understand why the traffic was denied.&lt;/li&gt;&#xA;&lt;li&gt;Remove the capture with &lt;code&gt;no capture [CAPTURE_NAME]&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is an example which shows traffic to 4.2.2.2 on tcp/9000 is denied by a configured firewall rule.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa-fw# capture DENY type asp-drop all buffer 500000 match tcp host 172.16.1.5 host 4.2.2.2 eq 9000&#xA;&#xA;&#xA;asa-fw# sh capture DENY trace&#xA;&#xA;1 packet captured&#xA;&#xA;   1: 06:13:43.434761       802.1Q vlan#200 P0 172.16.1.5.33489 &amp;gt; 4.2.2.2.9000: S &#xA;   884023774:884023774(0) win 14600 &amp;lt;mss 1460,sackOK,timestamp 67442169 0,nop,wscale 7&amp;gt; &#xA;   Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^&#xA;&#xA;1 packet shown&#xA;asa-fw# no capture DENY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you finish, be sure to unconfigure the capture with &lt;code&gt;no capture DENY&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-03-09T12:02:12.890" LastActivityDate="2015-03-09T12:02:12.890" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17153" PostTypeId="2" ParentId="12752" CreationDate="2015-03-09T12:15:14.460" Score="2" Body="&lt;p&gt;Meraki devices should be configured and managed remotely by a controller located in the cloud &lt;a href=&quot;https://account.meraki.com/secure/login/dashboard_login&quot; rel=&quot;nofollow&quot;&gt;Meraki Dashboard Login&lt;/a&gt;. Locally you have access to limited information like the connectivity info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your modem provide Internet access on LAN and gives private address through DHCP, you should not configure a public IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't own a meraki dashboard account and the device is not attached to your account, you will not be able to manage the device. &lt;/p&gt;&#xA;" OwnerUserId="206" LastActivityDate="2015-03-09T12:15:14.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17154" PostTypeId="1" AcceptedAnswerId="17157" CreationDate="2015-03-09T14:33:58.313" Score="3" ViewCount="3840" Body="&lt;p&gt;On juniper switches is something like root user. Are there any things that must be done from that user?&#xA;For what root user can be usefull? Or isn't  usefull, and can be safetly disabled?&lt;/p&gt;&#xA;" OwnerUserId="14268" LastEditorUserId="2142" LastEditDate="2015-03-09T15:54:49.207" LastActivityDate="2015-07-02T09:07:35.687" Title="Is the root user on juniper switches useful?" Tags="|switch|juniper-junos|access-control|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17156" PostTypeId="2" ParentId="17154" CreationDate="2015-03-09T15:12:25.370" Score="4" Body="&lt;p&gt;The &lt;code&gt;root&lt;/code&gt; user for any *nix platform is capable of performing any functions on the system they want - and I mean &lt;strong&gt;anything&lt;/strong&gt;.  I'd suggest you &lt;a href=&quot;http://en.wikipedia.org/wiki/Superuser&quot; rel=&quot;nofollow&quot;&gt;look into a wiki article&lt;/a&gt; on this as it is a little beyond the scope of this SE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is good practice to disable root access to your juniper devices.  Most environments disable it in a few different ways.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;blank out the root password&lt;/li&gt;&#xA;&lt;li&gt;disable ssh root-login&lt;/li&gt;&#xA;&lt;li&gt;disable root-login tampering on user-accounts&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2015-03-09T15:12:25.370" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17157" PostTypeId="2" ParentId="17154" CreationDate="2015-03-09T15:38:18.513" Score="7" Body="&lt;p&gt;Ryan is correct, you can do absolutely anything from root.  JUNOS is built on FreeBSD and inherits that behavior.  But to be honest, it's rarely used directly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The biggest &lt;strong&gt;practical&lt;/strong&gt; example I can think of offhand would be to collect core files from devices without another type of authentication, whether its due to a configuration issue or maybe you have redundant routing engines or a virtual chassis setup.  Non-master members don't authenticate with the network, so should you need to get into a member device to collect files, you could use root access in the shell to get those files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you first start up any Juniper device, you CANNOT commit your first configuration without root-authentication set, so you are forced to have a root password set.  I guess you could think of it as a failsafe, should everything break.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you can disable your users from starting a shell with root privileges with login classes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.juniper.net/techpubs/software/junos-es/junos-es93/junos-es-admin-guide/login-classes.html&quot;&gt;https://www.juniper.net/techpubs/software/junos-es/junos-es93/junos-es-admin-guide/login-classes.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a couple of ways to do it, but one example would be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;set system login class &lt;strong&gt;class_name&lt;/strong&gt; deny-commands &quot;(^start shell$)&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;set system login class &lt;strong&gt;class_name&lt;/strong&gt; permissions &lt;strong&gt;permission_bits_to_set&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you EXCLUDE &lt;em&gt;&quot;maintenance&quot;&lt;/em&gt; as a permission bit, they will not be able to become the superuser (root).&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2015-03-09T15:49:24.723" LastActivityDate="2015-03-09T15:49:24.723" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17159" PostTypeId="1" AcceptedAnswerId="17171" CreationDate="2015-03-09T15:54:25.743" Score="1" ViewCount="1914" Body="&lt;p&gt;I'm attempting to build a system to Auto-WOL devices when plugged into HP ProCurve switches (2510G and 2530G models). This is on a completely flat network, no VLANs or subnet routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'd like to know my reason why, we have thousands of devices coming in to be network imaged in our facility. Each device by default has WOL-to-PXE on, and an automated WOL system can save minutes of time per machine (which adds up to quite a lot if we could optimize the process).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment, I can successfully scrape the MAC Address list of the switch and send WOL packets to the addresses (this is in a Windows environment, by the way).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I'm currently stuck is that the HP ProCurve switch does not learn the MAC Address upon a device (with power, but off) plugged in. This breaks my flow, and I believe some vendors do learn the MAC of an offline device plugged in (I can't confirm this- HP shop here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now on a test device, I can send a directed WOL and it wakes up, switch learns the MAC Address, all is well. I believe this involves an ARP request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I understanding the technology correctly, that what I'm looking to do is send a Gratuitous ARP (via say a Cygwin port of ARPing) to the broadcast address FFFFFF-FFFFFF? I read some data here - &lt;a href=&quot;http://wiki.wireshark.org/Gratuitous_ARP&quot; rel=&quot;nofollow&quot;&gt;http://wiki.wireshark.org/Gratuitous_ARP&lt;/a&gt; - but I get the impression that this is the wrong solution (pushing the MAC of the machine out to all others versus causing the others to report back). I've tried to do a ping against the IP Broadcast address as well to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess what I'm asking for is, does a solution exist where a single host can cause an unknown NIC MAC Address to respond so as to populate the switch MAC Table? Or another solution that could get this data?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I've setup a CentOS box to run arp-scan but it didn't trigger anything (&lt;a href=&quot;http://linux.die.net/man/1/arp-scan&quot; rel=&quot;nofollow&quot;&gt;http://linux.die.net/man/1/arp-scan&lt;/a&gt;) and neither did arping. Brute forcing the OUI would be 16 million per OUI (if we locked it down to just HP, for example, they have multiple entries). I bring it up as a note in case a Linux box would be needed, I have one available.&lt;/p&gt;&#xA;" OwnerUserId="14269" LastEditorUserId="14269" LastEditDate="2015-03-09T18:55:14.980" LastActivityDate="2015-03-09T23:06:18.003" Title="HP ProCurve Auto WOL MAC Address of offline devices" Tags="|mac-address|arp|hp-procurve|broadcast|wake-on-lan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17160" PostTypeId="2" ParentId="13338" CreationDate="2015-03-09T16:17:15.350" Score="2" Body="&lt;p&gt;You can think of HSPA as an upgraded version of UMTS which gives you the ability to use higher data speeds. HSPA is like a feature of the 3G network which improves data speeds by giving you a channel with higher capacity. It has own transport layer channel and 3 physical layer channels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HSPA uses better modulations in good radio conditions to deliver higher speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HSPA is part of the UMTS and it and it is only for data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UMTS uses for data the lower speed R99 data channel but it ca also carry channel switched voice and video. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Operator offer both UMTS data and HSPA data for backward compatibility, not all handsets support HSPA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A user cannot choose which technology to use. The user equipment (the handset) automatically selects which technology to use according to the radio conditions and the network settings. You can only choose between 2G and 3G or automatic, this is the only setting I have seen.&lt;/p&gt;&#xA;" OwnerUserId="5576" LastEditorUserId="5576" LastEditDate="2015-04-08T17:27:56.557" LastActivityDate="2015-04-08T17:27:56.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17164" PostTypeId="1" CreationDate="2015-03-09T20:04:17.203" Score="0" ViewCount="946" Body="&lt;p&gt;From network address 10.0.0.0/10 i have to create 150 subnets with minimal number of bits borrowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is: should i borrow 8 bits or 6 bits from host part. An online subnet calculator borrowed 6 bits because 2 were already borrowed so I'm a bit confused.&lt;/p&gt;&#xA;" OwnerUserId="14272" LastActivityDate="2015-03-10T03:52:41.260" Title="Subnet a network address" Tags="|subnet|" AnswerCount="2" CommentCount="0" ClosedDate="2015-03-12T02:00:41.047" ContentLicense="CC BY-SA 3.0" />
  <row Id="17166" PostTypeId="1" AcceptedAnswerId="17169" CreationDate="2015-03-09T20:20:37.593" Score="1" ViewCount="306" Body="&lt;p&gt;Are hub and repeaters the same? And the same applies for switched and bridges? Since I am finding hub/repeaters and switch/bridge in some books while hubs/switch in others. Also in which layers do they operate?&lt;/p&gt;&#xA;" OwnerUserId="14274" LastEditorUserId="775" LastEditDate="2015-03-10T00:34:47.440" LastActivityDate="2015-03-10T00:34:47.440" Title="Internetworking devices" Tags="|switch|ethernet|bridge|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17167" PostTypeId="2" ParentId="17159" CreationDate="2015-03-09T20:28:48.113" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;an automated WOL system can save minutes of time per machine&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't see how. Let's suppose a person carries the machine in, sets on desk, plugs in power, plugs in network. After all that, how hard is it to &lt;em&gt;push the power button&lt;/em&gt;?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Where I'm currently stuck is that the HP ProCurve switch does not learn the MAC Address upon a device (with power, but off) plugged in&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As expected. Until the system sends a frame, the switch will not know what's attached to it, and you won't know the MAC to wake it up. So we're back to the minion who plugged in the cables turning it on. (or keying in a MAC and hoping they never get it wrong.)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;does a solution exist where a single host can cause an unknown NIC MAC Address to respond so as to populate the switch MAC Table&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As there is no OS running, NO. WOL, at the most basic, is the NIC firmware waiting for a specific bit pattern. There's otherwise nothing to talk to. If the system (&quot;server&quot;) has a management engine, then maybe, as that would be an embedded OS with network support (ping, telnet, ssh, ipmi, web, ...)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="775" LastEditDate="2015-03-09T22:48:12.537" LastActivityDate="2015-03-09T22:48:12.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17169" PostTypeId="2" ParentId="17166" CreationDate="2015-03-09T20:32:32.653" Score="1" Body="&lt;p&gt;A &lt;strong&gt;Ethernet Repeater&lt;/strong&gt; extends the usable range of ethernet cabling so it is not the same as a hub. This is a layer 1 device. You might be getting confused with the name &quot;Repeater&quot; and the function of a hub. Or you could be referring to &lt;strong&gt;Multiport Repeater&lt;/strong&gt; which is just another name for a &lt;strong&gt;Hub&lt;/strong&gt; function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;Hub&lt;/strong&gt; is also a layer 1 device. It repeats data out from a source port out every other port. Collision is heavy on a hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bridges&lt;/strong&gt; are layer 2 devices. They exist to physically seperate LAN segments. One of the only decisions a bridge makes is whether to forward or drop a frame. They are different than a &lt;strong&gt;switch&lt;/strong&gt; as a &lt;strong&gt;switch&lt;/strong&gt; can separate LAN segments on the same hardware using VLANs.&lt;strong&gt;Switches&lt;/strong&gt; generally consist of a multitude of ports, while a bridge may only have one.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-03-09T20:32:32.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17170" PostTypeId="1" AcceptedAnswerId="17172" CreationDate="2015-03-09T22:59:57.433" Score="3" ViewCount="878" Body="&lt;p&gt;I am currently researching jumbo ethernet frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a lot of articles, etc. out there that explain what jumboframes are and how to enable them, but there seem to be no statistics on how widely they are used. Personally I have never seen them used in a real setting so I am wondering if I am just watching the wrong networks, or if jumboframes are generally not used (and then: why? Are devices unable to handle jumbo frames still an issue today?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are jumbo frames limited to 9000 Bytes? I think i read something about this being related to limitations of the 32 Bit CRC sum (not sure where I read that), but the way I see it one is already changing the frame format to use jumboframes and could just as well change the length of the checksum too, to overcome this limitation.&lt;/p&gt;&#xA;" OwnerUserId="14276" LastEditorUserId="36720" LastEditDate="2023-10-22T11:45:30.243" LastActivityDate="2023-10-22T11:45:30.243" Title="statistics on usage of jumbo Ethernet frames and size of jumbo frames" Tags="|ethernet|mtu|checksum|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17171" PostTypeId="2" ParentId="17159" CreationDate="2015-03-09T23:06:18.003" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I guess what I'm asking for is, does a solution exist where a single host can cause an unknown NIC MAC Address to respond so as to populate the switch MAC Table? Or another solution that could get this data?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Let's step back for a moment and think about how switches work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a switch doesn't know the destination mac-address in a frame, the switch floods the frame with the unknown destination mac out all ports in that vlan; thus you do not need the switch to know the mac-address of the hosts while the host is powered down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you do need to know the mac-address of all PCs in question; that mac-address is embedded in the WOL frame.  Quite honestly, knowing the list of macs is pretty simple... just poll your edge router for arp entries for the Vlan(s) in question every five minutes, and &lt;em&gt;store the results somewhere&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now when you're ready to wake computers up, build a unique list of macs from your archived ARP tables and send a WOL frame to each unique mac; and if you send a WOL frame to a printer that's already up, who cares?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI, I built a python &lt;a href=&quot;https://github.com/mpenning/wakeonlan&quot; rel=&quot;nofollow noreferrer&quot;&gt;WOL packet crafter&lt;/a&gt; if it's at all helpful... you'll need linux or another *nix to use it though.  Run in cygwin or a VM if you like...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really hate the idea of scraping and archiving your ARP table, another option is HP Port-Security with Static mac-learning... that makes the switch remember the mac it learned on a port and then it saves the mac in the running / startup configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZQsVF.png&quot; alt=&quot;HP Port-security Static&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-03-09T23:06:18.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17172" PostTypeId="2" ParentId="17170" CreationDate="2015-03-09T23:52:45.690" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Personaly i have never seen them used in a real setting so i am&#xA;wondering if i am just watching the wrong networks, or if jumboframes are&#xA;generally not used (and then: why? Are devices unable to handle jubo frames&#xA;still an issue today?).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Jumbo frames are practically non-existent on the internet at large; however, many companies make heavy use of jumbo frames in private LAN and WANs.  The most common application is for database / storage traffic to make the links / servers more efficient.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Links get more effective capacity with jumbo frames&lt;/li&gt;&#xA;&lt;li&gt;CPU load on servers &lt;a href=&quot;https://blogs.oracle.com/glennf/entry/jumbo_frames_with_oracle_rac&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Oracle 10g RAC example&quot;&gt;can be significantly lower with Jumbo frames&lt;/a&gt;; depending on use of &lt;a href=&quot;http://lwn.net/Articles/358910/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GRO&lt;/a&gt;, TSO and LRO options in the NIC HW.  I've heard that &lt;a href=&quot;http://blog.delphix.com/seb/2013/03/15/lso/&quot; rel=&quot;nofollow noreferrer&quot;&gt;some applications&lt;/a&gt; don't do well with TSO / LRO turned on.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The max link efficiency at 1500 byte MTUs is about 95% (assuming TCP traffic) vs 99% at 9000 byte MTUs:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ethernet includes 20 bytes of framing overhead (Preamble + SFD + IPG)&lt;/li&gt;&#xA;&lt;li&gt;The ethernet header is 18 bytes&lt;/li&gt;&#xA;&lt;li&gt;IP and TCP transmit an additional 40+ bytes of headers (20 Bytes for IP header and at least 20 bytes for TCP header)&lt;/li&gt;&#xA;&lt;li&gt;CRC is 4 bytes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;Ethernet payload efficiency at 1500-byte MTUs&lt;/h3&gt;&#xA;&lt;p&gt;The efficiency at 1500 bytes (without VLAN tag, TCP over IPv4) is: 94.93%&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(data_size) / (ethernet_frame_size_on_wire)&#xA;(1500 - 40) / (18 + 1500 + 4 + 20) = 1460 / 1538 = 0.949284&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h3&gt;Ethernet payload efficiency at 9000-byte MTUs&lt;/h3&gt;&#xA;&lt;p&gt;The efficiency at 9000 bytes (without VLAN tag, TCP over IPv4) is: 99.14%&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;(data_size) / (ethernet_frame_size_on_wire)&#xA;(9000 - 40) / (18 + 9000 + 4 + 20) = 8960 / 9038 = 0.99136977&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;At GigabitEthernet rates you're getting about 42Mbps more with Jumbo frames (assuming the link operates at max capacity).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Why are jumbo frames limited to 9000 Bytes? I think i read something about this being related to limitations of the 32 Bit CRC sum&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As you asserted in your question, it's mostly due to the &lt;a href=&quot;http://en.wikipedia.org/wiki/Jumbo_frame#Error_detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;math of a 32-bit CRC&lt;/a&gt;.  Changing the CRC is pretty radical, since your switches and all NICs would need to use the same CRC calculation.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="36720" LastEditDate="2023-10-22T09:06:52.377" LastActivityDate="2023-10-22T09:06:52.377" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17173" PostTypeId="2" ParentId="17170" CreationDate="2015-03-09T23:52:56.987" Score="3" Body="&lt;p&gt;It's hard to research because jumbo frames don't exist on the internet. (Internet2, maybe, but that's not a global, public network.) The &lt;em&gt;primary&lt;/em&gt; industry use for jumbo frames is large bulk data transfers -- i.e. SAN infrastructure. Use of jumbo on a network connected to the internet is asking for problems -- PMTUd &lt;em&gt;should&lt;/em&gt; allow it to work, but there are plenty of networks that will break it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The frame size isn't limited to 9000. In fact, there is &lt;strong&gt;no standard&lt;/strong&gt; defining jumbo frames. (for backward compatibility reasons, it will never be part of any 802 standard) I have gear that allows 16k frames. And I have some gear that will only do 5000 -- it's limitation is buffer space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Longer frames statistically increase the probability of bit errors going undetected. The length of the checksum &lt;em&gt;cannot be altered&lt;/em&gt;. It is a fundamental part of ethernet.If you change the FCS algorithm, it will no longer be ethernet.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-09T23:52:56.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17174" PostTypeId="2" ParentId="17164" CreationDate="2015-03-10T01:20:47.783" Score="-2" Body="&lt;p&gt;10.0.0.0 is a Class A Network with a Natural Mask of 255.0.0.0.  The /10 Mask is 255.192.0.0, 2 bits were borrowed to create 4 subnets. If you want 250 subnets you will want to borrow 8 bits from the natural mask to create 256 subnets.  The mask would be 255.255.0.0 .&lt;/p&gt;&#xA;" OwnerUserId="14277" LastActivityDate="2015-03-10T01:20:47.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17175" PostTypeId="2" ParentId="17164" CreationDate="2015-03-10T03:52:41.260" Score="1" Body="&lt;p&gt;10.0.0.0/10 is the first of 4 subnets created from 10.0.0.0/8.&lt;br&gt;&#xA;2 to the power of 8 = 256 subnets.&#xA;To have at least 150 subnets a Net Mask of 255.255.192.0 would have to be used.  &lt;/p&gt;&#xA;" OwnerUserId="14277" LastActivityDate="2015-03-10T03:52:41.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17176" PostTypeId="2" ParentId="16546" CreationDate="2015-03-10T03:54:34.853" Score="2" Body="&lt;p&gt;It sounds like what you are really after is bandwidth shaping. You may wish to read the &lt;a href=&quot;https://doc.pfsense.org/index.php/Traffic_Shaping_Guide&quot; rel=&quot;nofollow&quot;&gt;PFsense documentation&lt;/a&gt; on configuring this.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-03-10T03:54:34.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17177" PostTypeId="2" ParentId="16934" CreationDate="2015-03-10T03:57:39.063" Score="0" Body="&lt;p&gt;I am not too sure but I think I can help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if I understand correctly you want to use the blue lines ( ISP-LAN) instead of the red lines ( VPN). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should configure the firewalls so that they are in VRRP (Virtual Routing Redundancy protocol) with each other. Then have your equipment point to the virtual IP of the VRRP, also you would want to contact the ISP and have them also configure their router point to the virtual gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will probably have to configure 2 different vrrp groups if you want to do load balancing : lets say vrrp group1 and vrrp group2. Where vrrp group1 is master for site1 and has site2 as backup. and vrrp group2 is master for site2 and backup for site1. In this case load balancing can be done. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before you use the new connection shut off the vpn. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to read more on this please read vrrp.&lt;/p&gt;&#xA;" OwnerUserId="14255" LastEditorUserId="14255" LastEditDate="2015-03-10T04:43:34.207" LastActivityDate="2015-03-10T04:43:34.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17178" PostTypeId="1" AcceptedAnswerId="17181" CreationDate="2015-03-10T04:38:48.430" Score="5" ViewCount="701" Body="&lt;p&gt;How a particular ISP get it's IP ? Is there any centralized authority to distribute IP s ?&lt;/p&gt;&#xA;" OwnerUserId="14279" LastActivityDate="2015-03-10T06:23:38.710" Title="Who assigns IP s to the ISP s?" Tags="|ipv4|ip|isp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17180" PostTypeId="2" ParentId="16933" CreationDate="2015-03-10T04:52:02.527" Score="0" Body="&lt;p&gt;The router will do whatever it is configured to do. ICMP messages are a courtesy and traffic can be silently discarded or an ICMP response can be provided. This is an optional part of the protocol. There are two schools of thought on whether a router &lt;em&gt;should&lt;/em&gt; send the ICMP response. The first is that it allows visibility into the network and allows you to troubleshoot problems, while the second regards it as a security risk believing that obscuring your visibility of the device provides security.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-03-10T04:52:02.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17181" PostTypeId="2" ParentId="17178" CreationDate="2015-03-10T06:23:38.710" Score="10" Body="&lt;p&gt;&lt;a href=&quot;http://iana.org&quot;&gt;IANA&lt;/a&gt; is responsible for the assignment of IP-blocks and AS-numbers to &lt;a href=&quot;http://en.wikipedia.org/wiki/Regional_Internet_Registry&quot;&gt;regional internet registries&lt;/a&gt; (RIRs). There are 5 RIR's: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ripe.net&quot;&gt;RIPE&lt;/a&gt; (Europe, Middle East, Central Asia)  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://afrinic.net/&quot;&gt;AfriNIC&lt;/a&gt; (Africa)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.apnic.net/&quot;&gt;APNIC&lt;/a&gt; (Asia-Pacific)  &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.arin.net/&quot;&gt;ARIN&lt;/a&gt; (North America)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.lacnic.net/&quot;&gt;LACNIC&lt;/a&gt; (Latin America)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Each of these RIRs is responsible for assignments to ISPs in the region they service. They all have their own rules and procedures for obtaining IP-addresses.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-03-10T06:23:38.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17183" PostTypeId="1" AcceptedAnswerId="17296" CreationDate="2015-03-10T11:39:31.807" Score="4" ViewCount="2606" Body="&lt;p&gt;This is a follow-up question based on &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/16461/&quot;&gt;this original question&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following topology is present:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gJQxU.png&quot; alt=&quot;Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco ASA is our Internet firewall, as well as VPN gateway, terminating VPN connections. The ASA performs RRI, to add those VPN routes into the OSPF domain. Both the ASA and the MLS are in OSPF Process 2 Area 0, and exchange routes. The OSPF setup is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default behaviour of RRI is to set the next-hop of the generated static route to the default gateway of the ASA interface where the crypto map is applied (which is outside in our case). In our case, it is xx.xx.192.21, which is the interface of the MLS. Hence, the route on the ASA looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S xx.xx.202.13 255.255.255.255 [1/0] via xx.xx.192.21, outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those routes are redistributed into OSPF via the &lt;code&gt;redistribute static&lt;/code&gt; command in &lt;code&gt;router ospf 2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the MLS however, the routes are in database, but not in the routing table. The Type 5 LSA looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Routing Bit Set on this LSA&#xA;  LS age: 1887&#xA;  Options: (No TOS-capability, DC)&#xA;  LS Type: AS External Link&#xA;  Link State ID: xx.xx.202.5 (External Network Number )&#xA;  Advertising Router: xx.xx.192.20&#xA;  LS Seq Number: 80000001&#xA;  Checksum: 0x8147&#xA;  Length: 36&#xA;  Network Mask: /32&#xA;        Metric Type: 2 (Larger than any link state path)&#xA;        TOS: 0&#xA;        Metric: 20&#xA;        Forward Address: xx.xx.192.21&#xA;        External Route Tag: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hence, the ASA sets the Forward Address to the next hop of the outside interface. According to &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13682-10.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Documentation&lt;/a&gt;, a non-zero forwarding address is set, if the following conditions are met:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;OSPF is enabled on the ASBR’s next hop interface AND&#xA;  ASBR’s next hop interface is non-passive under OSPF AND&#xA;  ASBR’s next hop interface is not point-to-point AND&#xA;  ASBR’s next hop interface is not point-to-multipoint AND&#xA;  ASBR’s next hop interface address falls under the network range specified in the router ospf command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As we need the ASA and the MLS to participate in OSPF routing, we cannot prohibit the ASA to set the forward address, if I understand that correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MLS however does not install the LSA into the routing table, as the forward address is not an OSPF O or O IA route, it is its own interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration of the ASA&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; router ospf 2&#xA;  ! External Routing Process&#xA;  router-id xx.xx.192.20&#xA;  network xx.xx.192.0 255.255.255.224 area 0&#xA;  area 0 authentication message-digest&#xA;  log-adj-changes&#xA;  redistribute static subnets route-map STATIC-&amp;gt;OSPF2&#xA;&#xA; route-map STATIC-&amp;gt;OSPF2 permit 10&#xA;  match ip address prefix-list STATIC-&amp;gt;OSPF2&#xA;&#xA; ! Both prefixes are used in the VPN pools&#xA; prefix-list STATIC-&amp;gt;OSPF2 seq 5 permit xx.xx.202.0/24 ge 32&#xA; prefix-list STATIC-&amp;gt;OSPF2 seq 15 permit xx.xx.37.0/24 ge 32&#xA;&#xA; crypto dynamic-map VPN-dynamic 10 set reverse-route&#xA; crypto map VPN 111 ipsec-isakmp dynamic VPN-dynamic&#xA; crypto map VPN interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the question now is: How can the situation be solved to allow the MLS to add the routes into the routing table?&lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-05-15T17:44:11.783" Title="Cisco ASA RRI and OSPF redistribution" Tags="|cisco|routing|cisco-asa|cisco-ios|ospf|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17184" PostTypeId="2" ParentId="16461" CreationDate="2015-03-10T12:38:39.347" Score="1" Body="&lt;p&gt;As pointed out by DanielDib, the problem is the wrong forward address set in the type 5 LSA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13682-10.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco documentation&lt;/a&gt;, the forward address is basically set, if the next hop Interface of the static route generated by RRI participates in the OSPF routing process. Further details can be found in the linked documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next-hop of the RRI static routes is set to the default gateway of the ASA interface where the crypto map is applied, in our case the outside interface pointing to the MLS. This next-hop IP is the IP of the interface of the MLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the MLS, the forward address of the LSA (xx.xx.192.21) is an IP address of one of its own interfaces. As the foward address needs to be known as internal OSPF route, the route is not considered to be added to the routing table. The solution hence may be either to have a correct forward address, or to supress the forward address, if required. &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17183/cisco-asa-rri-and-ospf-redistribution&quot;&gt;This question&lt;/a&gt; may include further details on this solution. &lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-07-25T08:13:54.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17185" PostTypeId="2" ParentId="16933" CreationDate="2015-03-10T14:40:10.830" Score="3" Body="&lt;p&gt;As Ron said, this is a pretty simple thing to test - you should give it a try if you haven't already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In BSD systems traceroute will use a range of high, unregistered UDP port numbers as well as TTL.  The device originating the probes will send 3 probes, they will look like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; The port numbers won't necessarily be exact in your tests.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Probe 1:&lt;/strong&gt; TTL = 1 UDP Port = 33434&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Probe 2:&lt;/strong&gt; TTL = 1 UDP Port = 33435&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Probe 3:&lt;/strong&gt; TTL = 1 UDP Port = 33436&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In the condition that the we're &lt;strong&gt;NOT&lt;/strong&gt; tracerouting to the next-hop, you will see the following message from the next device:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Time to Live Exceeded&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what we would expect, to see as traceroute progresses, the next device's probes would look like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Probe 1:&lt;/strong&gt; TTL = 2 UDP Port = 33437&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Probe 2:&lt;/strong&gt; TTL = 2 UDP Port = 33438&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Probe 3:&lt;/strong&gt; TTL = 2 UDP Port = 33439&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now let's say that second set of probes will reach our intended destination.  The response we will get is (and this is a portion directly from tcpdump):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;udp port 33437 unreachable&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what does this mean?  It means we've reached our destination, because only our destination can say &quot;No this port is not available&quot; (as we would expect from the higher unregistered UDP port range).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is - what if we trace route to next-hop router: - Should the router respond with port unreachable message?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The cool thing about traceroute is that, it has no idea if you're trying to hit something 20 hops away, or just 1 hop away - it needs to be able to adapt to any of those situations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it will behave no differently than it would at the last hop in a 20 hop traceroute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you traceroute your next hop, your probes would look the same:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Probe 1:&lt;/strong&gt; TTL = 1 UDP Port = 33434&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Probe 2:&lt;/strong&gt; TTL = 1 UDP Port = 33435&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Probe 3:&lt;/strong&gt; TTL = 1 UDP Port = 33436&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But the different here is, a TTL of 1 is enough to get to your next hop.  So you would see the &lt;strong&gt;&quot;udp port XXXXX unreachable&quot;&lt;/strong&gt; message right away, implying that the traceroute has completed.  Instead of seeing the &lt;strong&gt;&quot;Time to Live Exceeded&quot;&lt;/strong&gt; messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps clear things up, if you have any other questions related to this - leave a comment and I'll be happy to update my answer.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-03-10T14:40:10.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17186" PostTypeId="2" ParentId="17117" CreationDate="2015-03-10T15:17:49.170" Score="3" Body="&lt;p&gt;In theory the TMA can be mounted near the BTS, but you risk that the signal is attenuated too much by the cable. Also most BTS have a amplifier built in, which makes a TMA mounted next to it redundant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the name Tower Mounted Amplifier implies, the whole point is to amplify the signal as close to the source as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://en.wikipedia.org/wiki/Tower_Mounted_Amplifier&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Tower_Mounted_Amplifier&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14290" LastActivityDate="2015-03-10T15:17:49.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17187" PostTypeId="2" ParentId="16934" CreationDate="2015-03-10T16:22:12.527" Score="2" Body="&lt;p&gt;You are correct, if you have a free interface (eg. X6) on each router connect ISP-LAN at each site to that interface. I don't know if the SonicWALLs support VRRP but it is not needed. DHCP will not cross subnets unless you enable an IP Helper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP-LAN connection replaces your VPN but you will need to add some routes (which would have been implied or created previously due to the VPN). I'm guessing your ISP will refer to this has a managed VPN, an MPLS or a VLAN network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However you will need to know what IPs/network your ISP has assigned to each ISP-LAN (where you have &quot;???&quot; in your picture).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First Case:&lt;/strong&gt;&#xA;IF your ISP has given you IPs on your subnets at each site (eg. 10.10.1.254 at Site 1 and 192.168.1.254 at Site 2) then you can route via these IPs. Assign (or leave) X6 on the LAN (same as X2/X3/etc). Then go to Network | Routing. You will need to create a route on each site (or you could use RIP, but not needed for 2 sites). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At Site 1 your route will be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source: Any&#xA;Destination: Site2 Subnet (192.168.1.0 / 255.255.255.0)&#xA;Service: Any&#xA;Gateway: ISP-LAN IP (10.10.1.254)&#xA;Interface: LAN/X0  (since it's on the LAN)&#xA;Metric: 20 (should be fine)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Create a similar route at Site 2 (but Destination of Site 1's Network using the Gateway of ISP-LAN at Site 2 [192.168.1.254]). I've done this for clients when this is how the ISP has configured things (used IPs on the local LAN to provide access via &quot;the cloud&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second Case:&lt;/strong&gt;&#xA;HOWEVER, if the ISP has used a &lt;em&gt;DIFFERENT&lt;/em&gt; subnet for the ISP-LAN connection (such as 172.16.1.x or something) then you will need to configure X6 to be on that subnet, you won't need NAT. I've also done this for clients (where the ISP provides a 3rd subnet to join to 2 sites) -- in this case X6 will be on that 3rd subnet and the routes will be created automatically [just allow access with firewall rules].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So a &lt;strong&gt;QUESTION&lt;/strong&gt; for you: What is the IP/subnet of the ISP-LAN at each site? Is it as you have in your picture (the X6 / ??? IPs) or is it something else?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;  &lt;em&gt;(since I can't add a comment)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm glad that helped. You would have DHCP traversing if the ISP configured the link as a Layer 2 link (essentially a VLAN) between the 2 ISP routers -- DHCP wouldn't cross Layer 3 without assistance but will Layer 2 (like on a switch). Now that you have added a different subnet to the link (your 10.0.0.1/30 subnet) you should be fine (the routers won't pass DHCP broadcast traffic beyond the subnet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can configure the routes with Probes so that they will deactivate if something fails, if you convert your VPN from an IPsec Policy VPN to a Tunnel Based VPN (which uses routes for the VPN) you can have it fail-over if you wanted. &lt;em&gt;BUT&lt;/em&gt; since the ISP's VLAN and the Internet based VPN are running through the same ISP router the chance of only ONE failing is slim. (if you had a different back-up ISP then having a backup VPN would be a good idea)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the speed issue, I would check if you have BWM enabled on either router, other than that contact your ISP.&lt;/p&gt;&#xA;" OwnerUserId="2702" LastEditorUserId="2702" LastEditDate="2015-03-11T04:33:09.657" LastActivityDate="2015-03-11T04:33:09.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17188" PostTypeId="1" AcceptedAnswerId="19778" CreationDate="2015-03-10T17:47:36.157" Score="6" ViewCount="1910" Body="&lt;p&gt;Having a tough time here getting &lt;strong&gt;EAP-TLS&lt;/strong&gt; to work. I am converting from a EAP-PEAP solution to &lt;strong&gt;EAP-TLS&lt;/strong&gt; and have done the steps required for PKI so as to be not a certificate issue. (server and client certs signed by same CA) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe there is an issue with MTU sizes based on the logs below and the following Cisco Forums I've found. Listed below are the posts. However after performing the &lt;strong&gt;Framed-MTU = 1344&lt;/strong&gt; and changing it to different sizes, I see no difference on the Cisco 3750s logs. Always errors with I&lt;strong&gt;nvalid Eapol Packet length = 1492.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone run into this before? I am using Win2008R2 NPS &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Framed-MTU&lt;/strong&gt; workaround = &lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc771164%28WS.10%29.aspx&quot;&gt;https://technet.microsoft.com/en-us/library/cc771164%28WS.10%29.aspx&lt;/a&gt; and &lt;a href=&quot;https://supportforums.cisco.com/discussion/11087011/eap-tls-authentication-failure&quot;&gt;https://supportforums.cisco.com/discussion/11087011/eap-tls-authentication-failure&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why I'm thinking this is a Fragmentation issue = &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/118634-technote-eap-00.html#anc18&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/118634-technote-eap-00.html#anc18&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically my set-up = &lt;a href=&quot;http://networklessons.com/wireless/peap-and-eap-tls-on-server-2008-and-cisco-wlc/&quot;&gt;http://networklessons.com/wireless/peap-and-eap-tls-on-server-2008-and-cisco-wlc/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mar 10 17:33:08.889: dot1x-packet(Gi1/0/7): Received an EAPOL frame&#xA;Mar 10 17:33:08.889: dot1x-ev(Gi1/0/7): Received pkt saddr =f0de.f17b.4d9f , daddr = 0180.c200.0003, pae-ether-type = 888e.0100.0006&#xA;Mar 10 17:33:08.889: dot1x-packet(Gi1/0/7): Received an EAP packet&#xA;Mar 10 17:33:08.889: EAPOL pak dump rx&#xA;Mar 10 17:33:08.889: EAPOL Version: 0x1  type: 0x0  length: 0x0006&#xA;Mar 10 17:33:08.889: dot1x-packet(Gi1/0/7): Received an EAP packet from f0de.f17b.4d9f&#xA;Mar 10 17:33:08.889: dot1x-ev(Gi1/0/7): dot1x_sendRespToServer: Response sent to the server from 0x9C000260 (f0de.f17b.4d9f)&#xA;Mar 10 17:33:08.897: dot1x-ev(Gi1/0/7): Sending EAPOL packet to f0de.f17b.4d9f&#xA;Mar 10 17:33:08.897: dot1x-ev(Gi1/0/7): Role determination not required&#xA;Mar 10 17:33:08.897: dot1x-ev(Gi1/0/7): Sending out EAPOL packet&#xA;Mar 10 17:33:08.897: EAPOL pak dump Tx&#xA;Mar 10 17:33:08.897: EAPOL Version: 0x3  type: 0x0  length: 0x029B&#xA;Mar 10 17:33:08.897: EAP code: 0x1  id: 0x5  length: 0x029B type: 0xD&#xA;Mar 10 17:33:08.897: dot1x-packet(Gi1/0/7): EAPOL packet sent to client 0x9C000260 (f0de.f17b.4d9f)&#xA;Mar 10 17:33:08.923: dot1x-ev(Gi1/0/7): Role determination not required&#xA;Mar 10 17:33:08.923: dot1x-packet(Gi1/0/7): Queuing an EAPOL pkt on Authenticator Q&#xA;Mar 10 17:33:08.923: dot1x-ev:Enqueued the eapol packet to the global authenticator queue&#xA;Mar 10 17:33:08.923: EAPOL pak dump rx&#xA;Mar 10 17:33:08.923: EAPOL Version: 0x1  type: 0x0  length: 0x05D4&#xA;Mar 10 17:33:08.923: dot1x-ev:&#xA;dot1x_auth_queue_event: Int Gi1/0/7 CODE= 2,TYPE= 13,LEN= 1492&#xA;&#xA;Mar 10 17:33:08.923: dot1x-packet(Gi1/0/7): Received an EAPOL frame&#xA;Mar 10 17:33:08.923: dot1x-ev(Gi1/0/7): Received pkt saddr =f0de.f17b.4d9f , daddr = 0180.c200.0003, pae-ether-type = 888e.0100.05d4&#xA;Mar 10 17:33:08.923: dot1x-err(Gi1/0/7): Invalid Eapol packet length = 1492&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2017-07-28T04:19:32.900" Title="Cisco 3750 802.1x -- Invalid Eapol packet length" Tags="|mtu|radius|ieee-802.1x|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17189" PostTypeId="1" AcceptedAnswerId="17190" CreationDate="2015-03-10T18:01:44.240" Score="1" ViewCount="103" Body="&lt;p&gt;My question may seem odd, but please entertain me:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I SHOW RUN on my HP switch, there is zero configuration information for, let's use in this example, LLDP (link layer discovery protocol).  However, it's enabled on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would think any switch/router/etc. would have a feature list, but most everything is turned off unless appearing in the configuration file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I determine what else might be enabled on my device?  Perhaps other protocols/features which aren't necessary intrinsic to basic operation (such as ARP, I wouldn't expect to &quot;enable ARP&quot;)?  I think, as a curious admin, it's good to know.&lt;/p&gt;&#xA;" OwnerUserId="10416" LastActivityDate="2015-03-10T19:32:27.080" Title="Switch features enabled, but not showing in configuration" Tags="|switch|hp|network-discovery|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17190" PostTypeId="2" ParentId="17189" CreationDate="2015-03-10T19:32:27.080" Score="1" Body="&lt;p&gt;You would have to check your vendors documentation as to what is enabled or disabled by default. On Cisco devices for example CDP is enabled, but LLDP is not enabled by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some protocols which have become enabled or disabled by default differently as OS versions. For instance Finger, you used to have to manually disable this but now it is disabled by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this is part based on how much configuration is necessary for the protocol and it's popularity or use.&lt;/p&gt;&#xA;" OwnerUserId="1613" LastActivityDate="2015-03-10T19:32:27.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17192" PostTypeId="2" ParentId="16934" CreationDate="2015-03-10T22:02:14.747" Score="0" Body="&lt;p&gt;thanks for your help with this. I have implemented the following, and it is kind of working, at least with the test machines I am using.&#xA;I have set up pretty much what I think you described @PSaul.&#xA;I have set port X6 on each firewall to a new zone (Interoffice, Trusted) and given them a static IP, 10.0.0.1/30 and 10.0.0.2/30.&#xA;I then set up a route (as you described @PSaul) on each firewall that sends any traffic going to the other subnet to the X6 IP address on the far ends firewall, and send it through the local X6 port.&#xA;The ISP had set the interoffice link (between their two routers as a Layer 2 connection, so was sending everything across.&#xA;I found I was getting DHCP traffic across the networks, so not sure what I have in the network that is helping it traverse the subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not disabled the VPN yet, and have just set this up for test machines with a very low metric, so they are using this link before the VPN (I like that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not sent all traffic over the link yet, as I have one weird thing, but maybe a different question.&#xA;I get nice fast traffic in one direction, but traffic in the opposite direction is about 1/3 the speed pretty consistently. It doesn't quite look like traffic shaping, but something odd going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, I learnt more so that's good. Thanks for your help. Just need to figure out the issue with the speed in one direction.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/DeeKn.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14087" LastActivityDate="2015-03-10T22:02:14.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17194" PostTypeId="1" CreationDate="2015-03-10T23:05:14.967" Score="8" ViewCount="23089" Body="&lt;p&gt;I need to divide a network &lt;code&gt;172.16.0.0/12&lt;/code&gt; into 3 different subnets for different purposes. One of them needs 6 host addresses, another 85 host addresses and the last 100 host addresses. It should be done so that as few addresses as possible goes unused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the first subnet is easy, I can make a subnet &lt;code&gt;172.16.0.0/29&lt;/code&gt; which has 2&lt;sup&gt;3&lt;/sup&gt; - 2 = 6 usable host addresses. I'm not sure how to approach the next subnet though. Is it possible to make a subnet from say &lt;code&gt;172.16.0.8-172.16.0.127&lt;/code&gt;? And perhaps continuing with the third from &lt;code&gt;128-255&lt;/code&gt; (last octet)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My second guess would be to divide the smallest subnet as before, then make the next subnet at &lt;code&gt;172.16.0.1/25&lt;/code&gt; and the last at &lt;code&gt;172.16.0.2/25&lt;/code&gt;. This way the amount of unused addresses would be higher, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should also mention that the subnets should have access to the Internet. How can this be assured? I read that the whole &lt;code&gt;172.16.0.0/12&lt;/code&gt; address range is private and thus they do not work in the Internet. Is this true?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;This was what I had in mind:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2YDPC.png&quot; alt=&quot;http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13788-3.html&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that I cannot subnet my network in the same way they have done here because two of my subnets has to reserve an address space of 128 hosts. This means that I could create subnets &lt;code&gt;172.16.0.0/25&lt;/code&gt;,&lt;code&gt;172.16.0.128/25&lt;/code&gt; and &lt;code&gt;172.16.1.0/29&lt;/code&gt;. What I am wondering now is: does the space in &quot;reserved for future use&quot; count as some sort of subnet, or can they be used as normal addresses? &lt;/p&gt;&#xA;" OwnerUserId="14295" LastEditorUserId="33968" LastEditDate="2018-03-26T09:48:23.387" LastActivityDate="2018-03-26T09:48:23.387" Title="How to divide an IPv4 network into subnets of different sizes as efficiently as possible?" Tags="|ipv4|subnet|internet|lan|" AnswerCount="4" CommentCount="2" ClosedDate="2018-03-26T14:04:27.677" ContentLicense="CC BY-SA 3.0" />
  <row Id="17195" PostTypeId="1" AcceptedAnswerId="40794" CreationDate="2015-03-10T23:15:58.783" Score="5" ViewCount="17454" Body="&lt;p&gt;Suppose I want to determine if an IP is located in my country, without a third-party servvice. Could I estimate that to a certain degree by measuring ping times? Or is it better to look at the number of hops in the trace route? Or something else?&lt;/p&gt;&#xA;" OwnerUserId="14296" LastActivityDate="2019-01-13T20:50:38.013" Title="Are ping-times directly related to location/distance?" Tags="|tcp|wan|ping|traceroute|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17196" PostTypeId="2" ParentId="17195" CreationDate="2015-03-10T23:21:41.343" Score="3" Body="&lt;p&gt;Short answer: No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer: IP addresses aren't determined by geographical reason insomuch as the geographical region simply might only have a certain block assigned to it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: North Korea has a relatively small block of IP addresses, which makes it easy to tell when someone from that country has visited your website. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of the USA, France, Germany, South Korea, Japan or others, the number of IP blocks assigned to their ISPs is much greater, so simply glancing at an IP to see if it starts with a certain number won't necessarily guarantee that that entire network is assigned to a single geographical region. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With regards to ping times, ping time is determined by a great number of factors, including but not limited to:    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    - Number of routers between you and the target you are pinging&#xA;    - Networking problems in-between you and the target&#xA;    - Excessive traffic / congestion between you and the target&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example: I can ping Google's root DNS server 8.8.8.8 from my home internet and get about 40ms, through 12 (!) hops, yet I get a under-1ms ping to 8.8.8.8 from another location in the same city, from a different ISP, on a faster connection, through only four hops. &lt;/p&gt;&#xA;" OwnerUserId="2912" LastActivityDate="2015-03-10T23:21:41.343" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17197" PostTypeId="2" ParentId="17194" CreationDate="2015-03-11T01:17:51.833" Score="0" Body="&lt;p&gt;You could use &lt;code&gt;172.16.0.128/25&lt;/code&gt; and then &lt;code&gt;172.16.1.0/25&lt;/code&gt; for the next. I like to avoid zero subnets though, but it is a valid range. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do the math you would see that the network address for 172.16.0.8/25 is actually 172.16.0.0. If you need 100 hosts and want to use a /25 subnet then you would have to start at 172.16.0.0 and count increments of 128.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are correct that &lt;code&gt;172.16.0.0/12&lt;/code&gt; is private address space. As long as you ensure that your internet router/firewall is performing some type of NAT your private addresses will be translated to a public IP address to reach the internet.&lt;/p&gt;&#xA;" OwnerUserId="1613" LastActivityDate="2015-03-11T01:17:51.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17203" PostTypeId="1" CreationDate="2015-03-11T12:35:31.273" Score="2" ViewCount="517" Body="&lt;p&gt;This article &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=345618&amp;amp;seqNum=3&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscopress.com/articles/article.asp?p=345618&amp;amp;seqNum=3&lt;/a&gt;&#xA;describes TCP intercept mode:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;One limitation of intercept mode is that any TCP options that are&#xA;  negotiated between the external user and the router (which normally&#xA;  are to the end-server device), such as RFC1323 window scaling, are not&#xA;  passed from the router to the internal TCP server. This is because the&#xA;  router does not know these options until the first three-way handshake&#xA;  completes with the external user and the router begins the second&#xA;  three-way handshake with the internal TCP server. Typically, this is&#xA;  not a problem because TCP allows for the dynamic negotiation of these&#xA;  parameters during the normal operation of the session.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What is dynamic negotiation TCP options? How can i use it? I have some TCP  options that i want to work in tcp intercept mode and i don't want to use VPN softwares.&lt;/p&gt;&#xA;" OwnerUserId="14304" LastEditorUserId="8499" LastEditDate="2015-11-06T22:17:48.747" LastActivityDate="2015-11-06T22:17:48.747" Title="Dynamic negotiation of TCP options" Tags="|tcp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17204" PostTypeId="2" ParentId="17203" CreationDate="2015-03-11T14:02:52.210" Score="1" Body="&lt;p&gt;According to the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7323#section-2&quot; rel=&quot;nofollow noreferrer&quot;&gt;current RFC&lt;/a&gt;, window scaling cannot be negotiated dynamically. The RFC explicitly states:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A Window Scale option in a segment without a SYN bit MUST be ignored.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I think the author of the page you quote is simply mistaken.&lt;/p&gt;&#xA;" OwnerUserId="5842" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-03-11T14:02:52.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17207" PostTypeId="2" ParentId="13396" CreationDate="2015-03-11T14:39:03.797" Score="1" Body="&lt;p&gt;Going forward I'd really, really recommend using BGP neighbor descriptions as part of your customer provisioning process, maybe tag it with the customer or VRF name, and the interface.  Obviously it's prone to human error, so some automation would be best.  But if you're absolutely contingent upon one command pulling your information, here's an idea:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-instance CUSTOMER-A protocols bgp group CUST-A-EBGP neighbor 192.168.100.0 description CUSTOMER_A/fe-1/2/0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you could use the following command to pull all of the information you require.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show bgp neighbor | match &quot;Local:|Descr|Interface&quot;&#xA;&#xA;Peer: 192.168.100.0+49829 AS 100 Local: 192.168.100.1+179 AS 6996&#xA;  Description: CUSTOMER_A/fe-1/2/0.0&#xA;  Local Interface: fe-1/2/0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Otherwise, I'm afraid as ryanklein said, there just isn't a way to do it in a single show command.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-03-11T14:39:03.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17209" PostTypeId="1" CreationDate="2015-03-11T16:55:52.663" Score="1" ViewCount="506" Body="&lt;p&gt;I'm taking a networks class and am a little confused about the role of BGP speakers vs peering points and I'm having trouble finding consistent / reliable resources by using google.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone give a pretty simple explaination of the concept of peering points and BGP speakers and how they are different / the same?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="13277" LastActivityDate="2015-11-23T15:38:38.710" Title="BGP - Peering points vs BGP speakers?" Tags="|bgp|peering|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17212" PostTypeId="1" AcceptedAnswerId="17268" CreationDate="2015-03-11T17:50:39.887" Score="1" ViewCount="2706" Body="&lt;p&gt;Finding conflicting information online.  Looks like Cisco Nexus switches are cut-through by default and can be changed.  Also looks like IOS switches are store-and-forward by default and some can be changed and some can't (like a 3750 switch).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone shed some light on this please?  Thanks.&lt;/p&gt;&#xA;" OwnerUserId="13969" LastActivityDate="2015-03-14T18:42:59.783" Title="store-and-forward or cut-through switching default for cisco switches?" Tags="|cisco-ios|switching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17214" PostTypeId="2" ParentId="17209" CreationDate="2015-03-11T18:11:34.657" Score="3" Body="&lt;p&gt;Peering Points are just points where two autonmous networks connect to each other, like at an &lt;a href=&quot;http://www.bgp4.as/internet-exchanges&quot; rel=&quot;nofollow&quot;&gt;Internet Exchange&lt;/a&gt;, but not limited to only public internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP speakers are the actual devices that can participate in BGP. This includes routers which are carrying traffic, as well as route reflector servers which help ease BGP peering or are used for information gathering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 BGP speakers would connect at a peering point.&lt;/p&gt;&#xA;" OwnerUserId="1613" LastActivityDate="2015-03-11T18:11:34.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17221" PostTypeId="1" CreationDate="2015-03-11T20:55:33.367" Score="1" ViewCount="114" Body="&lt;p&gt;I am trying to set up a new WiFi AP in our HR building.  There is a closet in the HR building, with a switch connected by fiber to our main network closet, then to another network closet where the FiOS is at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set up a &quot;no switchport&quot; interface on the switch that is directly connected to the Sonicwall with IP 10.0.8.247.  I've created the VLAN on our VTP server switch, and I created the route on the switch directly connected to the Sonicwall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the switch in the HR building I am able to ping the 10.0.8.247 interface, but not the Sonicwall interface of 10.0.8.1, and I am able to ping the Sonicwall from the directly connected switch.  I've included a map of how I have it set up, still very new with Cisco and have been struggling with this for a few days.  Any help would be greatly appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/mXJrtDWp&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Middle Switch&quot;&gt;Middle Switch&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://pastebin.com/bQLGJm34&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Bottom Switch&quot;&gt;Bottom Switch&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/pZQuR.png&quot; alt=&quot;Network Map&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14318" LastEditorUserId="14318" LastEditDate="2015-03-12T15:51:10.347" LastActivityDate="2015-03-12T15:51:10.347" Title="Setting up WiFi with new Sonicwall across existing network" Tags="|routing|cisco-catalyst|sonicwall|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17222" PostTypeId="1" CreationDate="2015-03-12T01:30:55.577" Score="1" ViewCount="842" Body="&lt;p&gt;What is the best way to manage multiple (~50) Cisco Wireless Lan Controllers (5508, 4402) from one application without having to loggin to each controller through the web browser?&#xA;I know Cisco used to have Cisco Wireless Control System Navigator - but its end of life. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Cisco Prime infrastructure is not an option)&lt;/p&gt;&#xA;" OwnerUserId="2024" LastActivityDate="2015-03-12T02:24:40.850" Title="Best way to manage multiple Cisco Wireles Lan Controllers" Tags="|cisco|wireless|management|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17223" PostTypeId="2" ParentId="17222" CreationDate="2015-03-12T02:09:13.113" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the best way to manage multiple (~50) Cisco Wireless Lan Controllers (5508, 4402) from one application without having to loggin to each controller through the web browser?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;One option to consider: use the &lt;a href=&quot;https://networkengineering.stackexchange.com/q/2579/775&quot;&gt;AIRESPACE-WIRELESS-MIB&lt;/a&gt;; this gives you full control over the LWAPs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you go this route, you probably would want to write scripts to manage them over the long term... I almost never touch Prime Infra... everything I do uses &lt;code&gt;AIRESPACE-WIRELESS-MIB&lt;/code&gt; in a script.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-03-12T02:24:40.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17224" PostTypeId="2" ParentId="17222" CreationDate="2015-03-12T02:13:56.603" Score="2" Body="&lt;p&gt;Wireless Control System (WCS) had it's functionality extended to start managing switches as well and became Network Control System (NCS).  The community tended to like this solution better then Ciscoworks/LMS, and so Cisco rolled it all into the one package and this is now Cisco Prime Infrastructure.  There is no longer a WCS product and there will not be anytime in the near future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you have ruled out the Cisco provided product, you have a couple of options.  Find a non-Cisco solution that will work with Cisco controllers.  I have heard of several organizations that have used Aruba's Airwave product with their Cisco controllers, but I can't speak personally to what features/capabilities you may be lacking if you use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second option is that you can &quot;roll your own&quot; solution.  Most of the Cisco controller features can be managed via SNMP.  You can create your own management system based off of scripts/code that uses SNMP and SSH/telnet to both configure and pull information from the controllers you manage.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-03-12T02:13:56.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17225" PostTypeId="2" ParentId="17100" CreationDate="2015-03-12T02:42:18.653" Score="16" Body="&lt;p&gt;The IEEE 802.11 standards define two methods for a client device to discover wireless networks in the area.  Both methods are based on using 802.11 management frames as defined in these standards.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first method is a passive method.  All 802.11 infrastructure devices will send out a &lt;strong&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Beacon_frame&quot; rel=&quot;noreferrer&quot;&gt;beacon frame&lt;/a&gt;&lt;/strong&gt; approximately every 100ms (this is the default for many devices, but often can be configured either higher or lower) for each wireless network it is provide service for at the time.  These beacon frames will contain information about the wireless network such as the SSID (aka network name), encryption details (if any), supported data rates, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireless clients that are in the area will be able to &quot;hear&quot; the beacon and know the network is in the area, adding it to any &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second method is an active method, and is the one most often used by operating systems.  The client device can send a &lt;strong&gt;probe request&lt;/strong&gt; frame either generally (&quot;Is anyone out there?&quot;) or to a specific network (&quot;Hey, Bill, are you out there?&quot;).  An access point (any in the first case, matching ones in the second) will respond to this probe request with a &lt;strong&gt;probe response&lt;/strong&gt; that will contain information similar to a beacon frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This probe request/probe response process is also part of the association process by which a station joins a wireless network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason that the active method is generally preferred by most operating systems is obvious when one sits down to think about it.  To discover a network passively, the device will have to listen on a channel long enough to stand a good chance of hearing a beacon frame.  Since a beacon is only sent every period of time, a device may have to listen (and only listen) for 200ms or more to make sure they hear all the networks.  If you only consider 2.4GHz, that is at least 11 channels...do the math.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The active method allows a station to switch to a channel, send a probe request, pause briefly (less than 100ms) and then move to the next channel.  This makes this a faster process while still being fairly confident it has found the networks on that channel.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-03-12T02:42:18.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17233" PostTypeId="1" CreationDate="2015-03-12T12:58:05.773" Score="2" ViewCount="132" Body="&lt;p&gt;I have a cisco switch 2960S with 2 vlans 2001 and 2002. On vlan 2001 runs a DHCP server (Windows Server 2012 R2) with ip 10.0.100.10 and a scope for vlan 2001 (10.0.100.50-99/24) and 2002 (10.0.200.1-99/24). For testing I used the following configuration (simplyfied):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;vlan 2001,2002&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description *** Client network ***&#xA; switchport access vlan 2001&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/2&#xA; description *** FEMTO indoor box ***&#xA; switchport access vlan 2002&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/3&#xA; description *** Uplink router ***&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; no ip route-cache&#xA;!&#xA;interface vlan 2001&#xA; ip address 10.0.100.1 255.255.255.0&#xA;!&#xA;interface vlan 2002&#xA; description *** DHCP relay ***&#xA; no ip address&#xA; ip helper-address 10.0.100.10&#xA; no ip route-cache&#xA;!&#xA;ip default-gateway 10.0.100.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I have a real strange situation, if I connect a notebook or pc to port 2 on the switch - I get an ip address from the DHCP server in range 10.0.200.1. That works like designed but if I connect the FEMTO indoor box to the same port on the switch I dont get any ip address. I reset the FEMTO indoor box like the supporter told me but I still unable to receive any DHCP information. When I mirror the port and capture the traffic I only see some dhcp discovers entries from the FEMTO indoor box but no request/offer/ack entries. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few day ago all the FEMTO indoor boxes were running without any problems, after I configured a new vlan (2002) they did not receive any DHCP informations until now. But why can I receive from any other client an ip address except the FEMTO indoor box and why are there no replies from the DHCP server to the DHCP discovers from the FEMTO indoor box?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has someone any idea why this happens?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;kind regards, Maede&lt;/p&gt;&#xA;" OwnerUserId="10260" LastActivityDate="2015-09-05T00:53:54.747" Title="DHCP Issue with FEMTO indoor box" Tags="|cisco|dhcp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17240" PostTypeId="2" ParentId="17233" CreationDate="2015-03-12T20:17:16.877" Score="2" Body="&lt;p&gt;The 2960S is not a full layer-3 switch. (but it does play one on TV.) The issue is the lack of an IP on VLAN2002. The dhcp-relay agent will have no information to forward to the DHCP server about which network the client belongs.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-12T20:17:16.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17241" PostTypeId="1" AcceptedAnswerId="17249" CreationDate="2015-03-12T22:01:45.687" Score="2" ViewCount="166" Body="&lt;p&gt;I set up a port based VLAN on the first few ports of a 10GbE switch for broadcasting a UDP data stream. The data stream should use maybe 1/4 of that bandwidth. The switch is a netgear M7100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is I am losing about 25% of the packets when broadcasting. I've tested it with unicast on the VLAN and didn't lose anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've wired two server's NICs together directly and sent the stream to the broadcast address and do not lose a single packet either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked at wireshark and I dont see anything that pops out. It shows it sending all the packets but the receiver only sees 3/4 of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've increased the kernel network buffer sizes in &lt;code&gt;sysctl.conf&lt;/code&gt; and it didn't make much difference.&lt;/p&gt;&#xA;" OwnerUserId="14338" LastActivityDate="2015-03-13T02:17:47.343" Title="Losing data when broadcasting over switch" Tags="|switch|vlan|broadcast|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17244" PostTypeId="2" ParentId="16558" CreationDate="2015-03-12T23:18:19.090" Score="1" Body="&lt;p&gt;As @YLearn has pointed out:  you have to destinguish between frame loss (on wireless MAC layer) and packet loss (IP layer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IEEE 802.11 has a retransmission scheme for the wireless link to compensate for the high frame loss rate compared to wire bound networks.&#xA;Only if a frame has failed to be acknowledged on the wireless link for a number of times,  the packet encapsulated in that frame gets lost.&#xA;The number of retransmissions is adapted by a vendor specific algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a linux system you can use e.g. &lt;code&gt;iwconfig&lt;/code&gt; to obtain the number of lost packets caused by excessive retries on the wireless link:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ /sbin/iwconfig wlan0&#xA;wlan0     IEEE 802.11abg  ESSID:&quot;XXX&quot;  &#xA;          Mode:Managed  Frequency:2.412 GHz  Access Point: aa:bb:cc:dd:ee:ff&#xA;          Bit Rate=54 Mb/s   Tx-Power=15 dBm&#xA;          Retry short limit:7   RTS thr:off   Fragment thr:off&#xA;          Power Management:off&#xA;          Link Quality=62/70  Signal level=-48 dBm&#xA;          Rx invalid nwid:0  Rx invalid crypt:0  Rx invalid frag:0&#xA;          Tx excessive retries:26  Invalid misc:1830   Missed beacon:0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So if you are interested in the number of IP packets that are lost on the uplink (laptop→access point) of the wireless link, then &lt;em&gt;Tx excessive retries&lt;/em&gt; is what you are looking for.&lt;/p&gt;&#xA;" OwnerUserId="14339" LastActivityDate="2015-03-12T23:18:19.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17245" PostTypeId="2" ParentId="16558" CreationDate="2015-03-12T23:50:48.193" Score="0" Body="&lt;p&gt;Signal levels can also help you figure out wireless interference, as can channel assignments of APs around you. For free, you can use vistumbler if on Windows, or InSSIDer (which isn't free anymore I don't think).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Mac, you have some options in the App Store, but I prefer NetSpot which has a free version and also has some site surveying options included in it.&lt;/p&gt;&#xA;" OwnerUserId="14321" LastActivityDate="2015-03-12T23:50:48.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17246" PostTypeId="1" AcceptedAnswerId="17250" CreationDate="2015-03-13T00:19:15.880" Score="2" ViewCount="204" Body="&lt;p&gt;I'm trying to figure out how the multimode fibre optic really work, I looked in many sites but didn't really found an answer to my question;&#xA;let's take an example this picture:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/BQ0Av.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;in the multimode, are the 3 lights, the green, blue and red, are sent SIMULTANEOUSLY or these are the paths that could be taken?&lt;/p&gt;&#xA;" OwnerUserId="14341" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-03-31T13:54:46.950" Title="Fiber Optic Multimode principle" Tags="|fiber|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17247" PostTypeId="2" ParentId="3440" CreationDate="2015-03-13T00:34:36.973" Score="1" Body="&lt;p&gt;Airmax is about the time slots, and can help you maximize them and not allow lower quality clients to use up all the time by (re)transmitting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your purpose, turn it off I think. There's always the debate about airmax on or off on PtP (point to point) links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use AP-WDS and STATION-WDS modes on the devices. This will make the point to point connections function similarly to if you were running ethernet between each point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want to optimize noise floor and CCQ %. This will help the most in throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, some questions. The rocket at A, does it have an omni antenna or a sector or a dish?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why not a rocket at the other end of the PtP link between A and B? That seems like your &quot;backhaul&quot; link?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are all of these devices M series, the older models, or the new AC models?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I work for an ISP that uses Ubiquiti as part of our product mix. Although not an expert I think I can help you in this scenario.&lt;/p&gt;&#xA;" OwnerUserId="14321" LastActivityDate="2015-03-13T00:34:36.973" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17249" PostTypeId="2" ParentId="17241" CreationDate="2015-03-13T02:17:47.343" Score="4" Body="&lt;p&gt;&quot;1/4 of that bandwidth&quot; would be 2.5Gbps. That's &lt;em&gt;a lot&lt;/em&gt; of broadcast traffic. Managed switches have a safety system to prevent broadcast floods (&quot;&lt;em&gt;storm-control&lt;/em&gt;&quot;.) First guess, you've exceeded the storm-control limit by many orders of magnitude.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-13T02:17:47.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17250" PostTypeId="2" ParentId="17246" CreationDate="2015-03-13T02:27:31.803" Score="3" Body="&lt;p&gt;That's not &quot;three lights&quot; (that's DWDM.) The colors are there to delineate &lt;em&gt;three photons&lt;/em&gt;. In single-mode fiber, the photons flow perfectly parallel down the center of the fiber. In multi-mode, the light isn't as &quot;perfect&quot; and the fiber diameter is much wider. As a result, the photons don't flow perfectly parallel -- nor are they necessarily fired straight into the center of the fiber. Thus, the path of some photons are more oblique than others. The net result is a pulse of light entering in one end does not all reach the other end at the same time -- some paths are longer. This is known as &quot;mode dispersion&quot;; the longer the cable, the worse it gets.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-13T02:27:31.803" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17252" PostTypeId="1" CreationDate="2015-03-13T11:25:31.290" Score="0" ViewCount="5437" Body="&lt;p&gt;I am having trouble connecting to a Windows file server via Fortigate SSL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I enter the host name of my file server in Connection Tool section of my SSL portal and then a window asking for log in credentials pops up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I enter them and click &lt;code&gt;Login&lt;/code&gt; after what I get an error with &lt;code&gt;Invalid HTTP request&lt;/code&gt;. This server is a domain member and uses AD DS for authentication so I enter credentials in this form: &lt;code&gt;fname.lname@domain.com&lt;/code&gt;. But even if I leave them blank and click login, still... the same thing happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/cFfJj.png&quot; alt=&quot;Error&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried a different server that is not a domain member (linux server) and has anonymous login, I just left credentials blank and it connected just fine to the server.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The UTM device is Fortigate 300D&lt;/li&gt;&#xA;&lt;li&gt;Firmware version is the newest one v5.2 (was the same with v5.0)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What could be wrong? Doesn't it work with servers that are domain members?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Update&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I was actually able to login by specifying an IP address instead of a DNS name when connecting. Also I had to use &lt;code&gt;DOMAIN\user&lt;/code&gt; notation to login, otherwise it does not work. The DNS is reachable for sure as it works with the other server&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="2093" LastEditDate="2015-03-13T12:34:51.557" LastActivityDate="2019-06-19T23:25:23.460" Title="Error on Fortigate SSL when connecting to CIFS file server" Tags="|fortigate|sslvpn|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17254" PostTypeId="1" AcceptedAnswerId="17255" CreationDate="2015-03-13T14:59:07.260" Score="2" ViewCount="212" Body="&lt;p&gt;In the topology, I have all internal Peers (Site A,B,C) in AS 65002. these peers are connected through the transit ATT router (using AS number 1500 as in topology). The problem is, site C can ping only to the advertised networks from site A (10.2.254.9) and site B(10.11.254.9). It doesn't see the  network segment between site A and site B i.e. the 10.10.254.x network even thou these are all being advertised. However, the ATT router could see it with no issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;img src=&quot;https://i.stack.imgur.com/JLCxm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14354" LastEditorUserId="8007" LastEditDate="2016-06-12T08:31:23.473" LastActivityDate="2016-06-12T09:19:52.407" Title="BGP peer not advertising routes" Tags="|bgp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17255" PostTypeId="2" ParentId="17254" CreationDate="2015-03-13T15:03:44.767" Score="4" Body="&lt;p&gt;ATT router will advertise the route to router C, but the path will contain AS 65002 (from A).&lt;br&gt;&#xA;C will see that as a routing loop (since its AS is also 65002) and discard the route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can, change the AS number of C to something else.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-13T15:03:44.767" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17261" PostTypeId="2" ParentId="17079" CreationDate="2015-03-13T22:16:56.613" Score="0" Body="&lt;p&gt;Obvious answer: (a) no route, (b) ACL&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router (actually &quot;firewall&quot; -- &lt;em&gt;Secure Services Gateway&lt;/em&gt;) has no route for 172.16.13.0/24? But that should also prevent access through the router to the other LANs. Which leaves only an explicit or built-in ACL blocking access to the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Check the config, logs, etc.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-13T22:16:56.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17263" PostTypeId="1" AcceptedAnswerId="17265" CreationDate="2015-03-14T02:31:29.630" Score="0" ViewCount="537" Body="&lt;p&gt;In My Cisco Router i configured the following OSPF interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   interface eth1/0&#xA;      description link to net0 10.19.0.0/24 area 0 &#xA;      ip address 10.19.0.1 255.255.255.0&#xA;      ip ospf authentication message-digest&#xA;      ip ospf message-digest-key 1 md5 appropriate-password&#xA;      ip ospf cost 5000&#xA;&#xA;interface eth1/1&#xA;      description link to p2p2 10.19.1.192/30 area 1 &#xA;      ip address 10.19.1.193 255.255.255.252&#xA;      ip ospf authentication message-digest&#xA;      ip ospf message-digest-key 1 md5 appropriate-password&#xA;      ip ospf cost 5000&#xA;&#xA;    interface eth1/2&#xA;      description link to net3 10.19.2.0/24 area 0 &#xA;      ip address 10.19.2.1 255.255.255.0&#xA;      ip helper-address 10.19.0.20&#xA;      ip ospf authentication message-digest&#xA;      ip ospf message-digest-key 1 md5 appropriate-password&#xA;      ip ospf cost 5000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then i have added the following interfaces &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface eth1/3&#xA;  description link to newnet4 10.19.16.0/23 area 2&#xA;  ip address 10.19.16.1 255.255.254.0&#xA;      ip helper-address 10.19.0.20&#xA;  ip ospf authentication message-digest&#xA;      ip ospf message-digest-key 1 md5 appropriate-password&#xA;  ip ospf cost 5000&#xA;&#xA;interface eth1/4&#xA;  description link to newnet5 10.19.18.0/23 area 2&#xA;  ip address 10.19.18.1 255.255.254.0&#xA;      ip helper-address 10.19.0.20&#xA;  ip ospf authentication message-digest&#xA;      ip ospf message-digest-key 1 md5 appropriate-password&#xA;  ip ospf cost 5000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;i want to put eth1/3 and eth1/4 into area 2 and aggregate area 2's announcement to the core to only advertise an appropriate /22 for the two interfaces.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I Have configured it as follow, but i coulden't get the expected behavior:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA;    router-id 10.19.1.193&#xA;    log-adjacency-changes &#xA;&#xA;    network 10.19.1.0  0.0.0.255 area 0&#xA;    network 10.19.1.192  0.0.0.3  area 1&#xA;    network 10.19.2.0  0.0.0.255  area 0&#xA;&#xA;    network 10.19.16.0  0.0.1.255 area 2&#xA;    network 10.19.18.0  0.0.1.255 area 2&#xA;&#xA;    area 2   range 10.19.16.0  0.0.3.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Could anyone please tell me what is wrong with my config ??&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="5020" LastActivityDate="2015-03-14T03:23:39.540" Title="OSPF Aggregation and advertisement" Tags="|cisco|router|cisco-ios|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17265" PostTypeId="2" ParentId="17263" CreationDate="2015-03-14T03:23:39.540" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Could anyone please tell me what is wrong with my config&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Simple. You used &lt;em&gt;wildcards&lt;/em&gt; instead of &lt;em&gt;netmasks&lt;/em&gt;. Also, you didn't enable authentication in the routing process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Cisco Reference: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7039-1.html#t28&quot; rel=&quot;nofollow&quot;&gt;OSPF Design Guide&lt;/a&gt;]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-14T03:23:39.540" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17267" PostTypeId="2" ParentId="11059" CreationDate="2015-03-14T10:13:13.287" Score="0" Body="&lt;p&gt;Try the command '&lt;code&gt;show chassis pic fpc-slot slot-number pic-slot slot-number&lt;/code&gt;':&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos13.1/topics/reference/command-summary/show-chassis-pic.html&quot; rel=&quot;nofollow&quot; title=&quot;&amp;#39;show chassis pic&amp;#39; in Junos 13.1&quot;&gt;&lt;code&gt;show chassis pic&lt;/code&gt; command reference&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14364" LastEditorUserId="775" LastEditDate="2015-03-14T12:58:28.000" LastActivityDate="2015-03-14T12:58:28.000" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17268" PostTypeId="2" ParentId="17212" CreationDate="2015-03-14T18:42:59.783" Score="2" Body="&lt;p&gt;I'm not aware of any IOS switches that can be set to cut-through.  My impression was that they were all store-and-forward.  As an example, a quick google search reveals cisco pages that state fixed store-and-forward behavior for &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_58_se/configuration/guide/3750xscg/swadmin.html&quot; rel=&quot;nofollow&quot;&gt;3750-X and 3560-X&lt;/a&gt;, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/configuration/guide/2960scg/swadmin.html&quot; rel=&quot;nofollow&quot;&gt;2960 and 2960-S&lt;/a&gt;, etc.  I think the reasons for this are two-fold.  First, ASICs have sped up switches so much that any gains from cut-through are small.  And second, Cisco switches are purchased at least in part due to their wide range of features - many of which probably require reading the whole frame.  Certainly, QoS requires store-and-forward, as well as, I would expect, layer 3 security features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also saw the documentation that you probably did regarding the Nexus switches.  Their intended use is very different than the typical IOS based switch.  They are used in server farms that require high bandwidth, low latency connections among the servers, storage area networks, and other data center elements.  So it is expected that the very low latency gains do help in some of these scenarios, while advanced security and QoS type features are occurring at the edge of the data center rather than in the middle of it where cut-through is useful. &lt;/p&gt;&#xA;" OwnerUserId="14368" LastActivityDate="2015-03-14T18:42:59.783" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17269" PostTypeId="2" ParentId="16606" CreationDate="2015-03-14T18:49:37.943" Score="1" Body="&lt;p&gt;If a new host takes over an IP address it should announce it with a Gratuitous ARP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You said some hosts didn't pick it up because they were not connected, but that's not how it works. If those hosts were not connected, they shouldn't have an ARP table in the first place. As they don't have any entries for that IP address at all, they should ask for it with a broadcast ARP query (who's got x.x.x.x? tell y.y.y.y).&lt;/p&gt;&#xA;" OwnerUserId="444" LastActivityDate="2015-03-14T18:49:37.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17270" PostTypeId="1" AcceptedAnswerId="17271" CreationDate="2015-03-14T19:19:24.723" Score="3" ViewCount="7331" Body="&lt;p&gt;how do I count LANs and WANs given a network topology? The question is quite straightforward. I find it difficult to know when something is a LAN or when it isn't. Same goes for WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example where I would like to count the LANs and WANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8KasC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="13978" LastActivityDate="2023-01-03T00:05:54.327" Title="how do I count LANs and WANs given a network topology?" Tags="|lan|wan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17271" PostTypeId="2" ParentId="17270" CreationDate="2015-03-14T19:39:28.533" Score="5" Body="&lt;p&gt;As per wikipedia, LANs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&quot;A local area network (LAN) is a computer network that interconnects computers within a limited area such as a home, school, computer laboratory, or office building, using network media.[1] The defining characteristics of LANs, in contrast to wide area networks (WANs), include their smaller geographic area, and non-inclusion of leased telecommunication lines.&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would add that Cisco Academy describes LANs similar to the above but also as controlled by by a single organization (i.e. one business, one school, one government department). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and for WANs, wikipedia says:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&quot;A wide area network (WAN) is a network that covers a broad area (i.e., any telecommunications network that links across metropolitan, regional, national or international boundaries) using leased telecommunication lines.&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice you can usually identify WANs in diagrams by clouds or lightning bolt-like connections (WAN links).  LANs are then the groups of switches and end-user devices that separated by the WAN links.  Usually routers are used to separate LANs.  So for the given diagram, 2 LANs and one WAN (WAN implied by the WAN link).&lt;/p&gt;&#xA;" OwnerUserId="14368" LastActivityDate="2015-03-14T19:39:28.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17272" PostTypeId="2" ParentId="17048" CreationDate="2015-03-14T20:47:01.310" Score="2" Body="&lt;p&gt;You should not need an outbound ACL, based on the configuration shown the outbound path is not restricted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You quote two lines of the inbound ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit udp host x.x.x.x any eq 5060&#xA;access-list 101 permit udp host x.x.x.x any range 10000 20000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I assume the external IP X.X.X.X can reach any internal IP, using 5060 or 10000-20000 as the &lt;strong&gt;internal destination's port&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that's correct then that's fine (it's not clear to me from the question).  However, if it's &lt;strong&gt;the source port&lt;/strong&gt; (on the external server) that's using 5060 or 10000 to 20000 and the destination port doesn't happen to be the same then you'd need something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit udp host x.x.x.x eq 5060 any&#xA;access-list 101 permit udp host x.x.x.x  range 10000 20000 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, I would refer to the hosted PBX's instructions on NAT because if they are trying to reach into VoIP devices on your network without them first reaching out, then there may be issues.&lt;/p&gt;&#xA;" OwnerUserId="14368" LastEditorUserId="775" LastEditDate="2015-03-14T21:00:34.923" LastActivityDate="2015-03-14T21:00:34.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17273" PostTypeId="2" ParentId="16878" CreationDate="2015-03-14T21:11:15.003" Score="2" Body="&lt;p&gt;You do not need DHCP snooping or DAI running on the 3750 core switch in order use those features on the 2960 access switches.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the 2960s just enable DHCP snooping and DAI globally for the needed VLANs and then trust the trunk ports for both snooping and DAI.  The commands will probably look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Global commands on the 2960s&#xA;ip dhcp snooping&#xA;ip dhcp snooping vlan 1-4094&#xA;ip arp inspection vlan 1-4094&#xA;&#xA;! Trunk Port on the 2960&#xA;int Gi0/1&#xA;ip dhcp snooping trust&#xA;ip arp inspection trust&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that if you have VLANs with statically instead of DHCP assigned IPs, you will need to exclude them from the VLAN lists, trust the ports with static assigned IPs (not preferred if they really aren't trusted ports), or exclude the vlan from DHCP snooping and use ARP ACLs for that VLAN for DAI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if this is a network already in production make sure the DHCP snooping database has any existing leases already collected, before implementing the DAI commands otherwise some legitimate ARP requests will be blocked (or configure everything during a service window that allows re-triggering DHCP lease requests for all effected clients).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swdynarp.html&quot; rel=&quot;nofollow&quot;&gt;Cisco documentation for DAI is here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14368" LastEditorUserId="14368" LastEditDate="2015-03-14T21:59:57.397" LastActivityDate="2015-03-14T21:59:57.397" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17276" PostTypeId="1" AcceptedAnswerId="17277" CreationDate="2015-03-15T18:19:07.727" Score="2" ViewCount="2769" Body="&lt;p&gt;Hi lately I was reading about IP addresses, how it is assigned to a system&lt;b&gt;(using DHCP)&lt;/b&gt; n how they communicate in a &lt;b&gt;LAN(via ARP)&lt;/b&gt;, but i am not able to understand how Router is managing to send a packet frame to a particular address when there are billion of ip's are there.&lt;br/&gt;&#xA;Then I figured out that Router do not stores all the IPs rather they have frequently used IPs as dynamic IP n a &lt;b&gt;default IP(0.0.0.0)&lt;/b&gt;. &lt;br&gt; &lt;b&gt;When a request come for unknown address it is transfered to default Ip,But again a next hop can also be not directly connected to destination so again it will send to 0.0.0.0. &lt;br/&gt;&#xA;So my question is How this continous loop is finally broken and how router narrows it down to a particular server or device??&lt;/b&gt;&lt;br&gt;&#xA;Thanks in advance &lt;/p&gt;&#xA;" OwnerUserId="14374" LastActivityDate="2015-12-15T17:30:58.463" Title="How router send packets to other network" Tags="|routing|router|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17277" PostTypeId="2" ParentId="17276" CreationDate="2015-03-15T20:32:13.953" Score="2" Body="&lt;p&gt;You may have already learned that network addresses (routes) can be summarized.  That is, many network addresses can be summarized (represented) by a single network address (i.e a route). A default route can be considered a summary route that contains all network addresses.  Because routes can be summarized, routers  may not have complete information about the entire internet, but they may have a route to a large summary network that contains the destination.  That is, they know enough to forward the packet to another router that will have more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you send me data, your provider may not know where my IP address is located.  But it may know that my IP is in the range of addresses that are located in the United States.   So all your ISP needs to know is how to forward it to a router closer to the US.  That router will have more information to get the packet closer to me.  It in turn will forward to another router with more specific information, until the data gets to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Tier 1 and Tier 2 providers that make up the backbone of the Internet have routers that carry routes to all the networks connected to the Internet (currently more than 500,000 routes).  Your IP packet will eventually be forwarded to a router that does know to get to the destination network.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-15T20:32:13.953" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17284" PostTypeId="1" CreationDate="2015-03-16T05:03:24.670" Score="4" ViewCount="869" Body="&lt;p&gt;Please excuse my ignorance &amp;amp; noobishness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a switch which has two different point to point connections, these both plug into access ports &amp;amp; have their own VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two point to point connections are coming from the same ISP which is causing the port to close.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm no expert in spanning-tree loops, and I'm scared of causing any issues. How should I manage these ports? Or is something my ISP has to handle?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar 15 03:58:23 UTC: %SPANTREE-7-RECV_1Q_NON_TRUNK: Received 802.1Q BPDU on non trunk GigabitEthernet1/0/1 VLAN2050.&#xA;*Aug 15 03:58:23 UTC: %SPANTREE-7-BLOCK_PORT_TYPE: Blocking GigabitEthernet1/0/1 on VLAN2050. Inconsistent port type.&#xA;*Aug 15 03:58:24 UTC: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to up&#xA;*Aug 15 03:58:25 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to up&#xA;*Aug 15 03:58:39 UTC: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet1/0/1, changed state to down&#xA;*Aug 15 03:58:40 UTC: %LINK-3-UPDOWN: Interface GigabitEthernet1/0/1, changed state to down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help, totally clueless over here.&lt;/p&gt;&#xA;" OwnerUserId="14042" LastActivityDate="2018-04-10T19:03:57.047" Title="Cisco / Spanning Tree on Access Ports from ISP" Tags="|cisco|spanning-tree|isp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17286" PostTypeId="2" ParentId="17284" CreationDate="2015-03-16T08:12:12.103" Score="5" Body="&lt;p&gt;In my opinion, you've set things up &quot;wrong&quot;. (and so has the ISP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Never, EVER, trust what the ISP puts on your link. If you're running a metro-e interface into a switch, everything possible should be shut off on that port -- VTP, CDP, LLDP, spanning-tree, etc. The ISP isn't part of your &quot;enterprise&quot;, so there's no reason to exchange such information with them. Plus, CDP/LLDP will attempt to ensure port settings (including VLAN assignments) are the same.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-16T08:12:12.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17288" PostTypeId="1" CreationDate="2015-03-16T13:30:38.253" Score="0" ViewCount="1124" Body="&lt;p&gt;I am sorry for if the question is vague or not up-to standards, but i need some opinions before I proceed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to design a video streaming service (minimum 720p qualitity) over lan network with wireless APs? I know it's possible over lan only, I am asking if it is possible over wireless with wireless APs? How many TVs can I support this way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I have 1 host PC connected to a switch. To this switch I connect multiple wireless APs distributed all over (up to 1000ft away from the switch). Near each AP I place a monitor connected to a zero-client (VGA over LAN) which in turn connected to wireless AP set in client mode. So each monitor is connected to LAN through wireless AP set in client mode. Each wireless AP pair is configured to be one-to-one and on separate channel from other AP pairs. To visualize example please look at the image:&#xA; &lt;img src=&quot;https://i.stack.imgur.com/0GzHc.jpg&quot; alt=&quot;enter image description here&quot;&gt; &lt;/p&gt;&#xA;" OwnerUserId="14387" LastActivityDate="2015-03-17T13:11:59.787" Title="Is it possible to design HD video streaming over wireless?" Tags="|wireless|design|lan|video|streaming|" AnswerCount="2" CommentCount="1" ClosedDate="2015-03-17T14:52:26.827" ContentLicense="CC BY-SA 3.0" />
  <row Id="17290" PostTypeId="1" CreationDate="2015-03-16T14:33:43.357" Score="0" ViewCount="86" Body="&lt;p&gt;Me and a few classmates have been assigned a project on campus. The goal is to come up with a way to transmit information from a camera that's in a bat house about 500 yards away from the closest building. My group decided to go with an directional antenna. Any ideas on what eco-friendly technology to use? How would you go about it?&lt;/p&gt;&#xA;" OwnerUserId="14390" LastActivityDate="2015-03-16T20:47:36.410" Title="Network Project" Tags="|wireless|" AnswerCount="3" CommentCount="3" ClosedDate="2015-03-16T23:35:04.333" ContentLicense="CC BY-SA 3.0" />
  <row Id="17292" PostTypeId="1" CreationDate="2015-03-16T15:05:56.987" Score="1" ViewCount="759" Body="&lt;p&gt;I realize the F5 community might be the right place for this question, but this concerns routing design as opposed to an ADC design. We are planning to use F5's CGNAT module for NAT'ing our campus traffic. These will be two devices in an inter-site geo-redundant configuration. The F5's are not inline with our PE routers and are more like in a router-on-a-stick setup. We have a BGP/MPLS IP VPN backbone and would like to utilize that by attracting traffic from (say) VRF-A to NAT-1 device and VRF-B to NAT-2 device. F5's routing module ZebOS has no MPLS capabilities, instead they use something similar called Route Domains (&lt;a href=&quot;https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-ip-routing-administration-11-2-0/2.html&quot; rel=&quot;nofollow&quot;&gt;https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/tmos-ip-routing-administration-11-2-0/2.html&lt;/a&gt;), using route-domain ids to seperate VRFs as opposed to route-distinguishers in MPLS VPNs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd would like to know if the following is possible:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming we have two VRFs (VRF-A and VRF-B) in our backbone, create two route domains (RD-A and RD-B) on each F5. Advertise a default from each route domain for the corresponding VRF on the PE router. Configure BGP local-pref for the default route higher for VRF-A that VRF-B on one PE router and the opposite on the other PE, and advertise the modified defaults across the rest of the backbone. I believe this way we can attract traffic for one VRF to a particular NAT device and the other VRF to the other NAT device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is how do we associate route domains on F5 to the VRFs on our PE routers, so that the default from one route domain ends up only in one of the VRFs. Is this something that can be done on the F5 or needs to be done on the PE routers, or something that will happen automatically as a part of the MPLS backbone when the defaults are advertised from the F5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would really appreciate any inputs on the above or other design recommendations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIA !&lt;/p&gt;&#xA;" OwnerUserId="12034" LastEditorUserId="12034" LastEditDate="2015-03-16T21:04:03.813" LastActivityDate="2015-03-16T21:04:03.813" Title="MPLS L3 VPNs and F5 Route Domains" Tags="|bgp|nat|juniper-junos|mpls-vpn|f5|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17295" PostTypeId="2" ParentId="17288" CreationDate="2015-03-16T16:17:30.833" Score="2" Body="&lt;p&gt;There are a few things where this can/will go wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of the 1000ft Cat5E is to long.. it's about 3times the Max lentgh(&lt;a href=&quot;https://www.google.nl/?q=100m+%3D+ft&quot; rel=&quot;nofollow&quot;&gt;https://www.google.nl/?q=100m+%3D+ft&lt;/a&gt;). So place a bridge or repeater/another switch every 100M(328ft). Or you should take a look @ Fiber optics.&#xA;So lets say you went with fiber. Its expensive but will give you the length needed without any issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So next up are the Wireless Access points with clients. That could work if you have the capable hardware. This depends on what bitrate you are streaming the HD Video. looking at the AC specification i don't think that will become a problem(&lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.11ac&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/IEEE_802.11ac&lt;/a&gt;) unless the distance/interference is so big your transfer speed gets cut down. Sidenote: the AC specification say's it uses the 5Ghz band, that inturn has less problem's with interference but distance is more the factor here. So i would suggest a test with a simple client and access point to get some readouts on the bandwidth available at those distances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So lets say you did all that and still haven't found a problem. Well where is the server ? A C75 need a server if i'm reading the website right.. It needs resources from a server to operate ? Is that also on the &quot;HD Streaming Host&quot; ? if so you need to find out how much bandwidth that requires..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond that i would say it's possible in theory. ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What goal are you trying to fulfill ?&lt;/p&gt;&#xA;" OwnerUserId="14392" LastActivityDate="2015-03-16T16:17:30.833" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17296" PostTypeId="2" ParentId="17183" CreationDate="2015-03-16T16:30:46.647" Score="3" Body="&lt;p&gt;At the risk of another down-voted answer because I can't comment I'm going to propose a possible solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Problem:&lt;/strong&gt; &lt;BR&gt;&#xA;The forwarding address of the Type5 LSA is non-zero. According to the Cisco docs and &lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow&quot;&gt;RFC2328&lt;/a&gt;: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the forwarding address is non-zero, look up the forwarding address&#xA;  in the routing table.[24] The matching routing table entry must&#xA;  specify an intra-area or inter-area path; if no such path exists, do&#xA;  nothing with the LSA and consider the next in the list.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[24]When the forwarding address is non-zero, it should point to a&#xA;  router belonging to another Autonomous System.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I believe when it does that look-up and sees the next-hop address is a connected route it is skipping the LSA and not installing it into the route table. I think this is quite a literal interpretation; I would consider a connected route as intra-area. However since it is all a single area it is still flooding the LSA on to your external router, where it sees the LSA's next-hop as an OSPF route advertised by the MLS and therefore installs the LSA into the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to your post and &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13682-10.html#topic1&quot; rel=&quot;nofollow&quot;&gt;the Cisco doc&lt;/a&gt;: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;These conditions set the forwarding address field to a non-zero&#xA;  address:&lt;BR&gt;&#xA;      OSPF is enabled on the ASBR's next hop interface AND&lt;BR&gt;&#xA;      ASBR's next hop interface is non-passive under OSPF AND&lt;BR&gt;&#xA;      ASBR's next hop interface is &lt;em&gt;not&lt;/em&gt; point-to-point AND&lt;BR&gt;&#xA;      ASBR's next hop interface is &lt;em&gt;not&lt;/em&gt; point-to-multipoint AND&lt;BR&gt;&#xA;      ASBR's next hop interface address falls under the network range specified in the router ospf command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Possible Solution:&lt;/strong&gt;&lt;BR&gt;&#xA;So according to this information if the ospf network type is set to &lt;code&gt;point-to-point&lt;/code&gt; between the ASA the MLS then the LSA's next-hop &lt;em&gt;should&lt;/em&gt; be set to zero. This could be checked beforehand by &lt;code&gt;show ip ospf interface&lt;/code&gt;; it is probably at &lt;code&gt;broadcast&lt;/code&gt; currently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On both devices you would need to set the interface OSPF network type to point-to-point and also statically define the neighbor under the OSPF config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should then see the Type5 LSA next-hop address set to zero and &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the forwarding address is set to 0.0.0.0, packets should be sent to&#xA;  the ASBR itself.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1613" LastActivityDate="2015-03-16T16:30:46.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17297" PostTypeId="2" ParentId="17290" CreationDate="2015-03-16T16:31:45.533" Score="1" Body="&lt;p&gt;Two options come to mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One: Get a cable(Fiber probebly) up there..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two: Call NASA(&lt;a href=&quot;http://en.wikipedia.org/wiki/Laser_Communications_Relay_Demonstration&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Laser_Communications_Relay_Demonstration&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;:P&lt;/p&gt;&#xA;" OwnerUserId="14392" LastActivityDate="2015-03-16T16:31:45.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17298" PostTypeId="1" AcceptedAnswerId="17301" CreationDate="2015-03-16T16:55:12.943" Score="10" ViewCount="5880" Body="&lt;p&gt;If one tries to configure the neighbor adjacencys  without matching MTU, The routers fail to become neighbors.  I assume this is to protect the routing protocol from it self but I don't understand what it is saving itself from?  What would(Could) the consequence be without matching MTU?&lt;/p&gt;&#xA;" OwnerUserId="784" LastEditorUserId="775" LastEditDate="2019-05-04T14:36:29.963" LastActivityDate="2019-05-04T14:36:29.963" Title="Why does the MTU need to match on interior link state routing protocols like EIGRP and OSPF?" Tags="|routing|ospf|eigrp|mtu|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17299" PostTypeId="2" ParentId="17298" CreationDate="2015-03-16T18:24:47.453" Score="5" Body="&lt;p&gt;According to the &lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;noreferrer&quot;&gt;OSPF RFC 2328&lt;/a&gt; (10.6):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the Interface MTU field in the Database Description packet&#xA;  indicates an IP datagram size that is larger than the router can&#xA;  accept on the receiving interface without fragmentation, the Database&#xA;  Description packet is rejected.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The simple answer is that the standard was designed to just drop datagrams which are too large instead of fragmenting them. Fragmented traffic increases the CPU burden of a device and decreases performance because of the need for the &lt;em&gt;fragmentation needed&lt;/em&gt; extra traffic. Considering the goal of a dynamic routing protocol is it be a stable and fast converging protocol, anything contrary to those goals should be eliminated. Setting the requirement for the MTUs to match helps enforce this performance requirement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More from the OSPF RFC:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4.3.  Routing protocol packets&#xA;&#xA;    The OSPF protocol runs directly over IP, using IP protocol 89.&#xA;    OSPF does not provide any explicit fragmentation/reassembly&#xA;    support.  When fragmentation is necessary, IP&#xA;    fragmentation/reassembly is used.  OSPF protocol packets have&#xA;    been designed so that large protocol packets can generally be&#xA;    split into several smaller protocol packets.  This practice is&#xA;    recommended; IP fragmentation should be avoided whenever&#xA;    possible.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1613" LastEditorUserId="1613" LastEditDate="2015-03-16T21:47:33.613" LastActivityDate="2015-03-16T21:47:33.613" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="17300" PostTypeId="1" AcceptedAnswerId="17305" CreationDate="2015-03-16T19:12:11.270" Score="2" ViewCount="1660" Body="&lt;p&gt;If I have two nodes/computers connected to each other on the same range of IPs. Say:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Node A: 192.168.0.1/30&#xA;Node B: 192.168.0.2/30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to know (from Node A) if B is connected directly to it (via the same switch) or not (via multiple hops)?&lt;/p&gt;&#xA;" OwnerUserId="13402" LastEditorUserId="775" LastEditDate="2015-05-04T11:15:47.240" LastActivityDate="2015-05-04T11:15:47.240" Title="Is there any way to know if two nodes are connected to the same switch or not?" Tags="|ipv4|ethernet|ip|" AnswerCount="6" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17301" PostTypeId="2" ParentId="17298" CreationDate="2015-03-16T19:13:09.463" Score="12" Body="&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17298/why-does-the-mtu-need-to-match-on-interior-link-state-routing-protocols-like-eig#comment25399_17298&quot;&gt;Pete said&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I can't think of a situation where you would need this. I just wanted to know what the logic was that makes this an explicit check in these routing protocols.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h1&gt;Short answer&lt;/h1&gt;&#xA;&lt;p&gt;Routing protocols are some of the most fundamental building blocks on the internet; we need them to be very reliable in every possible case.  It does no good to bring up an OSPF or EIGRP adjacency on a mismatched MTU.&lt;/p&gt;&#xA;&lt;p&gt;Routing protocols must remove any potential mismatched MTUs from the router's forwarding path.&lt;/p&gt;&#xA;&lt;h1&gt;Long answer&lt;/h1&gt;&#xA;&lt;p&gt;I can think of three possible situations where you'd find mismatched IGP MTUs...&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;em&gt;Unintentional MTU mismatch&lt;/em&gt; at Layer2 (for instance, if someone accidentally mismatched MTUs on a serial line, or different vendors had &lt;a href=&quot;http://www.net-gyver.com/?p=1086&quot; rel=&quot;nofollow noreferrer&quot;&gt;different default MTUs&lt;/a&gt; on the same media)&lt;/li&gt;&#xA;&lt;li&gt;Matching Layer2 MTUs, but a the router implementation has &lt;a href=&quot;https://tools.cisco.com/bugsearch/bug/CSCse01519&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Some old versions of IOS didn't handle GRE Tunnel MTUs correctly&quot;&gt;&lt;em&gt;bug&lt;/em&gt; which miscalculates the required interface IP MTU&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Intentional MTU mismatch&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;IP MTUs are directly correlated to Layer2 MTUs (at least for Case 1, above).  No matter what we do, we are always at the mercy of mitigating the problems from unintentional Layer2 MTU mismatches, since there is no Layer2 MTU discovery mechanism (unlike IP, which has ICMP error messages).&lt;/p&gt;&#xA;&lt;p&gt;This means that we have to do everything possible to avoid Layer2 MTU mismatches, even if Cases 2 and 3 above are casualties of mitigating problems with Case number 1.  Case 1 has colossal implications unless we solve it; i.e. black-holing all traffic just because we permitted mismatched MTUs.&lt;/p&gt;&#xA;&lt;p&gt;We're always limited to the least common denominator on the link.  Frames larger than the receive MTU of an interface are silently discarded, and the router has &lt;em&gt;no way of knowing&lt;/em&gt; whether the MTU was intentionally mismatched, or whether it happened accidentally.&lt;/p&gt;&#xA;&lt;p&gt;Consequently, EIGRP and OSPF require valid Layer2 adjacencies &lt;sup&gt;Note 1&lt;/sup&gt; (including MTUs).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What would(Could) the consequence be without matching MTU?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Quoting &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2329#page-4&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;RFC 2329, Page 4&quot;&gt;John Moy (OSPF's author) in RFC 2329 Page 4&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Problems with all IP forwarding&lt;/li&gt;&#xA;&lt;li&gt;OSPF Problems&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Also quoting him from the &lt;a href=&quot;http://marc.info/?l=ms-ospf&amp;amp;m=103430314528495&amp;amp;w=2&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSPF mailing list&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://marc.info/?l=ms-ospf&amp;amp;m=103430314528495&amp;amp;w=2&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DhFT1.png&quot; alt=&quot;John Moy - OSPF MTU mismatches&quot; title=&quot;John Moy commenting on MTU mismatches&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;sup&gt;Note 1&lt;/sup&gt; some people misunderstand the meaning of adjacency as strictly an IP routing protocol concept.  This assertion misses the reality that everything (including IP) &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7285/775&quot;&gt;requires matching layer2 MTUs&lt;/a&gt;, for Layer2 domains to work properly.&lt;/p&gt;&#xA;&lt;p&gt;One of the most important functions of a routing protocol is building a valid FIB / CEF / forwarding table.  That table maps the information learned via routing protocols to &lt;a href=&quot;https://networkengineering.stackexchange.com/a/1528/775&quot;&gt;layer2 rewrite info&lt;/a&gt;.   Those Layer2 relationships on the same physical link are what Cisco also calls adjacencies.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-03-17T15:24:31.647" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17302" PostTypeId="1" AcceptedAnswerId="17303" CreationDate="2015-03-16T19:25:57.480" Score="6" ViewCount="18258" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jdm1E.png&quot; alt=&quot;Switch&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;Is it possible to place a switch in one of the four/five wires of an Ethernet cable that will disable it?&lt;/p&gt;&#xA;&lt;p&gt;For my hardware project I would like the user to be able to disable the internet connection at the flick of a switch!&lt;/p&gt;&#xA;&lt;h2&gt;Notes&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I am aware that it will affect the speed and signal quality but with the hardware I am using it shouldn't matter.&lt;/li&gt;&#xA;&lt;li&gt;I know there are commercial options available on the market, but at $50 and in a bulky branded box they are not suitable for my project!&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="14397" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2024-01-24T12:19:32.680" Title="Toggle Switch for an Ethernet Cable" Tags="|switch|ethernet|security|hardware|safety|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="17303" PostTypeId="2" ParentId="17302" CreationDate="2015-03-16T19:44:28.690" Score="7" Body="&lt;p&gt;Have you got a physical switch that is rated for Cat5 cabling?  The answer to your question is the same as the answer to my question.&lt;/p&gt;&#xA;&lt;p&gt;More than likely you need to buy:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;An ethernet optical isolator / optocoupler and drop the power to the isolator&lt;/li&gt;&#xA;&lt;li&gt;An ethernet relay rated for Cat5e or higher&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2024-01-24T12:19:32.680" LastActivityDate="2024-01-24T12:19:32.680" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="17304" PostTypeId="2" ParentId="17302" CreationDate="2015-03-16T19:49:16.473" Score="0" Body="&lt;p&gt;Check out the &lt;a href=&quot;http://en.wikipedia.org/wiki/Ethernet_over_twisted_pair#Cabling&quot; rel=&quot;nofollow&quot;&gt;cabling for Ethernet of twisted pair&lt;/a&gt;. If you're using 1000BASE-T (1 gig ethernet) then all four pairs are used for communication, so technically killing one pair would disable &lt;em&gt;1GE&lt;/em&gt; communication. However 10BASE-T or 100BASE-T (10/100mb ethernet) only require two pairs for communication, which could lead to a situation of you killing the wrong pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 8 wires, configured in 4 pairs.&lt;/p&gt;&#xA;" OwnerUserId="1613" LastEditorUserId="1613" LastEditDate="2015-03-16T20:02:22.297" LastActivityDate="2015-03-16T20:02:22.297" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17305" PostTypeId="2" ParentId="17300" CreationDate="2015-03-16T19:57:48.600" Score="4" Body="&lt;p&gt;Since switches generally do not rewrite the Ethernet frame, you can't tell from inspecting the data.  You might be able to infer something based on timing (delays), but I suspect that would be unreliable.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-16T19:57:48.600" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17306" PostTypeId="1" AcceptedAnswerId="20582" CreationDate="2015-03-16T20:14:54.497" Score="3" ViewCount="1206" Body="&lt;p&gt;I'm encountering some unexpected behavior when trying to reference object-groups in an access-list on my Catalyst 4500.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Goal:&lt;/strong&gt; Restrict a VLAN from accessing other privately addressed subnets (Internet access only), except for a local DNS server in another subnet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IOS-XE Version:&lt;/strong&gt; 03.03.00.XO RELEASE SOFTWARE (fc2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;General Config:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network subnet_privateClassA &#xA; 10.0.0.0 255.0.0.0&#xA;!&#xA;object-group network subnet_privateClassB &#xA; 172.16.0.0 255.240.0.0&#xA;!&#xA;object-group network subnet_privateClassC &#xA; 192.168.0.0 255.255.0.0&#xA;!&#xA;object-group network subnet_rfc1918All &#xA; group-object subnet_privateClassA&#xA; group-object subnet_privateClassB&#xA; group-object subnet_privateClassC&#xA;!&#xA;!&#xA;&#xA;...&#xA;&#xA;interface Vlan70&#xA; ip address 10.10.70.254 255.255.255.0&#xA; ip access-group publicVlan_in in&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following access-list blocks access to private IP ranges, except for the desired DNS server (10.16.4.10), but also blocks access to public IPs. So, DNS is able resolve google.com, but pings fail.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended publicVlan_in&#xA; permit ip any host 10.32.4.10&#xA; deny ip any object-group subnet_rfc1918All ! (I've also tried just subnet_privateClassA)&#xA; permit ip any any&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The next access list works exactly how I want - local DNS works and I can access the Internet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended publicVlan_in&#xA; permit ip any host 10.32.4.10&#xA; deny   ip any 10.0.0.0 0.255.255.255&#xA; deny   ip any 172.16.0.0 0.15.255.255&#xA; deny   ip any 192.168.0.0 0.0.255.255&#xA; permit ip any any&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem seems to be the use of object-groups. What am I missing here?&lt;/p&gt;&#xA;" OwnerUserId="14399" LastEditorUserId="14399" LastEditDate="2015-03-17T14:55:12.383" LastActivityDate="2015-08-12T15:03:31.177" Title="Unexpected behavior referencing object-groups in access-lists on Catalyst 4500" Tags="|cisco-catalyst|acl|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="17307" PostTypeId="2" ParentId="17290" CreationDate="2015-03-16T20:21:36.587" Score="0" Body="&lt;p&gt;You have several ways to do that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) MW antenna or unidirectional of other type with a ptp link. This could be eco-friendly since the signal has to meet allowed power limits and it's spreaded in a single directiob and a close angle of transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) LTE modems with site-to-site vpn (ipsec or open vpn) with static ip from your ISP or  myddns domain on your dynamic public IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But these are general ways, knowing what's in the middle between these two points could bring elements to create alternate solutions.&lt;/p&gt;&#xA;" OwnerUserId="14400" LastActivityDate="2015-03-16T20:21:36.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17308" PostTypeId="2" ParentId="17290" CreationDate="2015-03-16T20:47:36.410" Score="1" Body="&lt;p&gt;Cool project. The first thing that comes to my mind is combining an 802.11 device with a directional antenna and a solar panel. Ubiquiti makes some inexpensive 802.11 equipment aimed at the Wireless ISP market that would be perfect for your project. Specifically, their airMax product line is well suited for creating bridges over long distances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out this link: &lt;a href=&quot;http://disastersolar.com/30w-22ah-solar-ubiquiti-radio/&quot; rel=&quot;nofollow&quot;&gt;Using a 30W solar panel and 22Ah Battery to power a Ubiquiti radio &lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Loco M2 referenced in the link above would probably be more than enough for your application. You would need one on each end of the connection.&lt;/p&gt;&#xA;" OwnerUserId="14399" LastActivityDate="2015-03-16T20:47:36.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17311" PostTypeId="2" ParentId="17302" CreationDate="2015-03-16T22:07:47.527" Score="3" Body="&lt;p&gt;Partially serious, partially making light of the question, you could try a 4 pole, 2 throw (4PDT) switch like &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B001TJ6O9M&quot; rel=&quot;nofollow&quot;&gt;this one on Amazon&lt;/a&gt; and solder the switch in place in one of the wires in each pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In all seriousness though, Mike Pennington has the best solution with a button connected to a relay.  Add a few RJ-45 jacks and the aforementioned items to a project box, and you've got a nice little physical network kill switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Had poles and throws mixed up.  Updated Amazon link accordingly.  Added edit edit.&lt;/p&gt;&#xA;" OwnerUserId="2865" LastEditorUserId="2865" LastEditDate="2015-03-17T21:42:17.617" LastActivityDate="2015-03-17T21:42:17.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17313" PostTypeId="2" ParentId="17300" CreationDate="2015-03-16T23:23:48.887" Score="4" Body="&lt;p&gt;Not unless the switch is identifying itself via CDP or LLDP. Even then, there can be technology along the path that won't be detectable. (i.e. in a metro-e setup you may have two ports on the same layer-2 device that follow different layer-1 paths.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Timing measurements will ultimately be inconclusive. Different switches process at different rates, and the load on the switch can lead to variability in switching rates. Plus, do you have the gear to time things down to the micro- or nano-second?&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-16T23:23:48.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17314" PostTypeId="2" ParentId="17288" CreationDate="2015-03-16T23:52:17.600" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to design a video streaming service&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Anything is &quot;&lt;em&gt;possible&lt;/em&gt;&quot;. How many million do you want to invest? (BTW, you aren't the first to attempt something like this.)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(minimum 720p qualitity)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;720p is a frame size, not a quality. I can compress a 720p feed to 1Mbps. It'll look like s*** but it's still &quot;720p&quot;. What bit rate do you intend to support? At what encoding? (For reference, Uverse is ~5Mbps MPEG4 and widely touted as &quot;poor&quot;, watchable none the less.)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is possible over wireless with wireless APs? How many TVs can I support this way?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Depends entirely on your choice of hardware and method(s) of distribution. Again, Uverse does this for their &quot;wireless STB&quot;. Uverse video distribution is done via multicast (wired) which is a problem for commodity WiFi gear. That's why they use a dedicated wireless gateway programmed to deal with that failing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it were unicast, which wouldn't be an issue for any WiFi gear, you'd have to have dedicated bandwidth for every receiver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(clearly, you've got a lot more planning to do)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="775" LastEditDate="2015-03-17T13:11:59.787" LastActivityDate="2015-03-17T13:11:59.787" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17315" PostTypeId="2" ParentId="17300" CreationDate="2015-03-16T23:54:16.627" Score="2" Body="&lt;p&gt;The easiest and most reliable method is to physically trace out the network cables from the respective clients.&lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2015-03-16T23:54:16.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17316" PostTypeId="1" AcceptedAnswerId="17322" CreationDate="2015-03-17T00:08:29.077" Score="1" ViewCount="562" Body="&lt;p&gt;I get the reasoning why there is only a single port for http connections, but why was the number chosen to be 80?  Why not 76, or 111 or 2?  What is the reason behind the number 80?  (Or why 443 for https?  Or 21 for ftp?)  &lt;/p&gt;&#xA;" OwnerUserId="14404" LastEditorUserId="8499" LastEditDate="2018-02-16T04:08:53.260" LastActivityDate="2019-01-19T00:03:58.173" Title="Why is HTTP Port 80?" Tags="|tcp|" AnswerCount="1" CommentCount="1" ClosedDate="2019-01-20T01:25:38.367" ContentLicense="CC BY-SA 3.0" />
  <row Id="17317" PostTypeId="2" ParentId="12449" CreationDate="2015-03-17T00:28:56.233" Score="2" Body="&lt;p&gt;Long story short, while it is possible to do what you are requesting, it is inadvisable.&lt;/p&gt;&#xA;&lt;p&gt;With the broad range of the 172.16.0.0 to 172.31.255.255 (1,048,576 total IP addresses) there is really no reason to not further subnet your network and avoid any potential routing issues.&lt;/p&gt;&#xA;&lt;p&gt;A better setup might be to split the network into 172.16.0.0/25 and 172.16.0.128/25.&lt;/p&gt;&#xA;&lt;p&gt;Trying to make the current setup work is simply adding more complexity to the system, rather than fixing the underlying issue which is a flawed initial design.&lt;/p&gt;&#xA;&lt;p&gt;The following document might be sixteen years old, but pretty much everything in it still rings true.  &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1925&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Twelve Networking Truths&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14403" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-03-17T01:12:34.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17319" PostTypeId="2" ParentId="16322" CreationDate="2015-03-17T00:53:55.137" Score="2" Body="&lt;p&gt;This is a common issue with a simple fix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;config terminal&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;ip routing&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;end&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;copy run start&lt;/strong&gt;&lt;br&gt;&#xA;(You don't want to lose your configuration change and have to fix it again after a reboot.)&lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2015-03-17T00:53:55.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17322" PostTypeId="2" ParentId="17316" CreationDate="2015-03-17T02:13:26.560" Score="3" Body="&lt;p&gt;Tim Berners Lee (aka TBL) &lt;a href=&quot;https://lists.w3.org/Archives/Public/www-talk/1992NovDec/0149.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;choose port 80&lt;/a&gt; in the early 1990s; at one time, TCP port 2784 was used, but TBL deprecated it in favor of using port 80.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TBL came up with &lt;a href=&quot;http://en.wikipedia.org/wiki/ENQUIRE&quot; rel=&quot;nofollow noreferrer&quot;&gt;ENQUIRE&lt;/a&gt;, which was the building block for hypertext &lt;a href=&quot;http://en.wikipedia.org/wiki/History_of_the_World_Wide_Web#1980.E2.80.931991:_Invention_and_Implementation_of_the_Web&quot; rel=&quot;nofollow noreferrer&quot;&gt;in 1980&lt;/a&gt;, but it took almost a decade for the protocol to mature.  One might speculate that 80 is a reference to 1980, but that's pure speculation AFAICT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no real reason we have to choose port 80, other than the need to have a &lt;a href=&quot;https://networkengineering.stackexchange.com/a/1986/775&quot;&gt;well-known port&lt;/a&gt;, and that IANA standardized on port 80 so long ago.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2019-01-19T00:03:58.173" LastActivityDate="2019-01-19T00:03:58.173" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17324" PostTypeId="1" AcceptedAnswerId="19353" CreationDate="2015-03-17T09:10:03.673" Score="3" ViewCount="215" Body="&lt;p&gt;I am currently trying to understand MPLS and its component.&#xA;So I read myself through a few book, took a look at the question on &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5761/how-are-the-lers-determined-in-an-mpls-lsp-using-ldp&quot;&gt;how to determine the LER&lt;/a&gt; and the there suggested &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/mpls/4649-mpls-faq-4649.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS FAQ For Beginners&lt;/a&gt; as well as &lt;a href=&quot;http://www.nanog.org/meetings/nanog49/presentations/Sunday/mpls-nanog49.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;MPLS For Dummies&quot;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, I also found this picture: &lt;img src=&quot;https://i.stack.imgur.com/vffC1.png&quot; alt=&quot;enter image description here&quot;&gt; from this &lt;a href=&quot;http://www.itwissen.info/definition/lexikon/customer-edge-CE-CE-Router.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;site&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now I am confused, because I thought from what I read the LER is part of the MPLS Net(MPLS-Netz in the picture), and the PER are also the LER (or at least a router, which is part of the MPLS-Net). The next thing is the Router in the middle of the net is also a PE-Router and not the one on the right, which isn't labeled at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But instead of asking for every component, let me put my question like this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does the picture show a valid configuration of a MPLS net or is my&#xA;  understanding of the topic plainly wrong and I should take a closer&#xA;  look at my sources again?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="14411" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-06-19T15:18:46.920" Title="Is this MPLS Router configuration correct?" Tags="|mpls|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17327" PostTypeId="1" AcceptedAnswerId="17328" CreationDate="2015-03-17T14:27:20.797" Score="2" ViewCount="1586" Body="&lt;p&gt;I have a device that failed to its DHCP query. If I change its MAC address it works. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect a MAC address is already registered somewhere on the network. I know that during a DHCP request the DHCP server test if somebody answer to the registered MAC before the re-affectation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can we simply check if a MAC address is already registered on the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course I don't have access to the DHCP server neither the network switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried &lt;code&gt;arp -a&lt;/code&gt; which gives me a big list of IP, but I doubt it's all the IP addresses of my network.&lt;/p&gt;&#xA;" OwnerUserId="14415" LastEditorUserId="14415" LastEditDate="2015-03-17T14:50:25.767" LastActivityDate="2015-03-17T14:52:37.190" Title="Check if mac address is registered" Tags="|dhcp|mac-address|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17328" PostTypeId="2" ParentId="17327" CreationDate="2015-03-17T14:52:37.190" Score="2" Body="&lt;p&gt;Based on your comment it sounds like some other device on your network has the MAC address that you would like to use for the device you have access to. Finding that other device in the physical world will probably be very difficult to impossible without access to any switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB: If you did have access to the switches, you could follow the MAC tables to a switch port number and from there do a physical cable trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To confirm that there is actually another device with the same mac address, you could try using a network auditing tool and attempt to discover all devices on the same broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is another set of possibilities that involve either static MAC entries either on the DHCP server(s) or some device(s) on the network, or some kind of port security or MAC filtering. It's a little odd to be trying to solve a problem of this nature without access to the switches or servers or access to someone who has access, although not at all unheard of on secure networks.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-03-17T14:52:37.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17329" PostTypeId="1" AcceptedAnswerId="19084" CreationDate="2015-03-17T16:32:53.147" Score="1" ViewCount="1353" Body="&lt;p&gt;I'm configuring a clientless VPN on an ASA 5505, and have a few questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I assume that, when accessing CIFS, if they delete a file it just goes bye-bye?  (i.e. no recycle bin equivalent on the client side... I also can't find one on the server side for a regular Windows file server.  Noticed a few NASs have some sort of CIFS recycle bin feature, but don't see a way to turn this on for Windows.)  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it possible to have some sort of confirmation dialog before they can delete?  I know they're irritating, but with no trash it seems a reasonable precaution.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I can add individual Windows file servers as CIFS addresses, and that works fine.  However, if I click the &quot;Network&quot; button, I get the error &quot;Failed to retrieve domains&quot;.  Where would I start to look for this issue?  It's definitely using the LDAP logins fine, seeing the files according to the user's permissions, etc... so I'm not sure where else to look to rectify this.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a way to have links to pages on the VPN home page that don't get accessed through the VPN?  One example would be our OWA.  We use Office365 for our Exchange server.  I'd like to have a link for the OWA login for this, that would ideally use SSO (but that might not be possible in this scenario).  I want to have the SSL VPN be basically be a portal for them to see all of the links to our resources, and not have to log in multiple times, but not use our bandwidth when it's not necessary.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ETA&lt;/strong&gt;: To clarify, by clientless VPN I'm referring to the Cisco VPN usable through a web browser - almost a sort of portal page.  The one that looks basically like this, although the appearance has been updated slightly since - &lt;a href=&quot;http://goo.gl/xPd2CB&quot; rel=&quot;nofollow&quot;&gt;Cisco example screenshot&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14417" LastEditorUserId="14417" LastEditDate="2015-03-17T22:00:52.783" LastActivityDate="2015-06-10T00:16:55.153" Title="Cisco ASA5505 Clientless VPN/CIFS config questions" Tags="|cisco-asa|vpn|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17332" PostTypeId="1" AcceptedAnswerId="17336" CreationDate="2015-03-17T18:29:54.287" Score="1" ViewCount="663" Body="&lt;p&gt;Have an existing ASA that has a config I inherited.  Looking at the firewall I do not see a rule that allows traffic of a certain pattern to traverse the firewall.  I do see the pattern applied for NAT'ing reasons and I'm curious, if you have a NAT policy defined, is that traffic able to bypass the firewall?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I have one access list defined as:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;access-list policy-nat extended permit udp object-group MY_OBJ any eq snmp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and another as&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;access-list firewall-list extended permit udp host 1.2.3.4 host 6.7.8.9 eq snmp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both ACL's are applied to the same interface as such:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;nat (my-int) 22 access-list policy-nat&#xA;access-group firewall-list in interface my-int&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will any traffic patterns that conform to the NAT rules bypass the access-group entries?  &lt;/p&gt;&#xA;" OwnerUserId="11938" LastActivityDate="2015-03-17T21:01:08.403" Title="Are NAT rules not subjected to firewall / policy group rules on an ASA?" Tags="|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17333" PostTypeId="1" AcceptedAnswerId="17337" CreationDate="2015-03-17T18:32:05.470" Score="0" ViewCount="488" Body="&lt;p&gt;Recently I was reading about how IPs are assigned to a new system (DHCP) and how systems communicates in LAN (ARP). But I am not able to understand how wifi actually works? What I understand is WiFi router uses radio waves (not sure) and it is having transmitter and receiver which transmits only Yes/No Signal, and it is having frequency 2.4 GHz or 5 GHz&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So Can anybody answer following questions&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;what signal pattern is actually used?&lt;/li&gt;&#xA;&lt;li&gt;is the connection between system &amp;amp; router continuous -- i.e router continuously sends signal or at regular interval?&lt;/li&gt;&#xA;&lt;li&gt;when a router is switched off, how is a laptop/system notified? Does router sends any special signal?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="14374" LastEditorUserId="619" LastEditDate="2015-03-17T20:40:55.900" LastActivityDate="2015-03-17T20:56:15.830" Title="How Wifi connection is maintained" Tags="|router|wireless|ieee-802.11|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ClosedDate="2015-03-18T10:36:03.290" ContentLicense="CC BY-SA 3.0" />
  <row Id="17336" PostTypeId="2" ParentId="17332" CreationDate="2015-03-17T19:31:32.513" Score="2" Body="&lt;p&gt;nope, traffic that matches a NAT rule will not bypass the firewall rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rules are applied in the following order:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Incoming ACL on the incoming interface&lt;/li&gt;&#xA;&lt;li&gt;NAT rules&lt;/li&gt;&#xA;&lt;li&gt;Outgoing ACL on the outbound interface&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You may find a graphic representation of the process here:&#xA;&lt;a href=&quot;http://www.tunnelsup.com/cisco-asa-order-of-operation&quot; rel=&quot;nofollow&quot;&gt;http://www.tunnelsup.com/cisco-asa-order-of-operation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps!&lt;/p&gt;&#xA;" OwnerUserId="14263" LastEditorUserId="619" LastEditDate="2015-03-17T21:01:08.403" LastActivityDate="2015-03-17T21:01:08.403" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17337" PostTypeId="2" ParentId="17333" CreationDate="2015-03-17T20:55:45.090" Score="2" Body="&lt;p&gt;In WiFi, there are two types of devices: Access Point (ap), and Station (sta). In simple terms, &quot;router&quot; would be the AP, and the client systems are STA. Stations know an AP exists and is in range because the AP broadcasts &quot;beacons&quot; -- by default every 100ms (10 beacons per second.) Within the beacon there's an (optional) informational element listing the SSIDs the AP handles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only one radio (transmitter) can be active at a time. So there is no &quot;continuous&quot; signal. This is true of any RF system... CB radio, walkie-talkie, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the beacons stop, clients know the AP is dead -- or rapidly moved out of range. If the AP is rebooted or otherwise gracefully shutdown, it can send &quot;deauth&quot; frames to each station to force them to disassociate (disconnect) from the AP.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-17T20:55:45.090" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17338" PostTypeId="2" ParentId="17333" CreationDate="2015-03-17T20:56:15.830" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;Wifi uses the 802.11 protocol.  You can find numerous sources to study about it on the Internet.&lt;/li&gt;&#xA;&lt;li&gt;Wifi communication is half-duplex, meaning the router (actually, an Access Point) and the laptop take turns talking.&lt;/li&gt;&#xA;&lt;li&gt;No special signal.  The protocol defines who can talk and when.  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;From a high level point of view, wifi works the same way as Ethernet or frame relay or any number of media types.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-17T20:56:15.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17339" PostTypeId="1" CreationDate="2015-03-17T23:21:30.367" Score="2" ViewCount="19849" Body="&lt;p&gt;This might seem silly but I can't find the MAC address table in my Cisco ASR1001. Look:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh mac?&#xA;macdb  &#xA;&#xA;#sh macdb&#xA;&#xA;                      Software MAC database&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It must be another command, but I can't find it. Google didn't help.&lt;/p&gt;&#xA;" OwnerUserId="14427" LastActivityDate="2015-03-18T00:26:41.920" Title="MAC address table in Cisco ASR1001" Tags="|cisco|mac-address|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17341" PostTypeId="2" ParentId="17339" CreationDate="2015-03-18T00:06:35.627" Score="3" Body="&lt;p&gt;It's a router not a switch, so no MAC table is needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, the ARP table--show ip arp--may be what you want.&lt;/p&gt;&#xA;" OwnerUserId="8079" LastActivityDate="2015-03-18T00:06:35.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17342" PostTypeId="2" ParentId="17339" CreationDate="2015-03-18T00:26:41.920" Score="3" Body="&lt;p&gt;Use &lt;code&gt;show bridge-domain [bridge-domain-number]&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RTI-MPLS-SAB-01#show bridge-domain 4010&#xA;Bridge-domain 4010 (3 ports in all)&#xA;State: UP                    Mac learning: Enabled&#xA;Aging-Timer: 300 second(s)&#xA;    BDI4010  (up)&#xA;    GigabitEthernet0/0/4 service instance 4010&#xA;    vfi OCTEY neighbor 10.23.32.79 11&#xA;   AED MAC address    Policy  Tag       Age  Pseudoport&#xA;   0   0024.E64F.9A87 forward dynamic   292  GigabitEthernet0/0/4.EFP4010&#xA;   -   881D.F3D4.293F to_bdi  static    0    BDI4093&#xA;   0   0022.1A5F.166B forward dynamic   279  GigabitEthernet0/0/4.EFP4010&#xA;   1   FFFF.FFFF.FFFF flood   static    0    OLIST_PTR:0x2edad820&#xA;   -   0000.0007.AC01 to_bdi  static    0    BDI4010&#xA;   0   001B.2C3F.EDA8 forward dynamic   286  GigabitEthernet0/0/4.EFP4010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If they are secured... &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/cether/configuration/xe-3s/asr1000/ce-xe-3s-asr1000-book/ce-mac-addlmt-bdsin.html#GUID-6EF071BF-F18C-4093-80C6-FE2D01A50FC9&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;show bridge-domain [bridge-domain-number] mac security address&lt;/code&gt;&lt;/a&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# show bridge-domain 730 mac security address&#xA;Port                  MAC Address       Type      Rem. Age(min)&#xA;Gi1/0/0 ServInst 1    0001.0001.0001    static    74      &#xA;Gi1/0/0 ServInst 1    0001.0001.0002    static    74      &#xA;Gi1/0/0 ServInst 1    0001.0001.aaaa    dynamic   74      &#xA;Gi1/0/0 ServInst 1    0001.0001.aaab    dynamic   74      &#xA;Gi1/0/0 ServInst 2    0002.0002.0002    static    -       &#xA;Gi1/0/0 ServInst 2    0002.0002.0003    static    -       &#xA;Gi1/0/0 ServInst 2    0002.0002.0004    static    -       &#xA;Gi1/0/0 ServInst 2    0002.0002.aaaa    dynamic   -       &#xA;Gi1/0/0 ServInst 2    0002.0002.bbbb    dynamic   -       &#xA;Gi1/0/0 ServInst 2    0002.0002.cccc    dynamic   - &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-03-18T00:26:41.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17344" PostTypeId="1" AcceptedAnswerId="17345" CreationDate="2015-03-18T02:26:46.757" Score="1" ViewCount="453" Body="&lt;p&gt;While going through flow/error control in the data link layer which is done using sliding window protocols I realised, one requires sequence numbers for frames to implement these protocols. I see that the Ethernet frame or a PPP frame does not have a sequence number in their header. But I see a 2bit seq no in a 802.11 mac frame and a 4 bit for GFC(General Flow Control) on a ATM frame. So does this mean that not all layer 2 technologies implement error/flow control?Is there any particular reason for this? How is it compensated for if its not used?&lt;/p&gt;&#xA;" OwnerUserId="14429" LastActivityDate="2015-03-18T03:52:59.307" Title="How is the flow/error control using sliding window implemented in data link layer?" Tags="|ethernet|design|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17345" PostTypeId="2" ParentId="17344" CreationDate="2015-03-18T03:52:59.307" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So does this mean that not all layer 2 technologies implement&#xA;  error/flow control?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are a lot of L2 technologies/protocols, and at least some of them do not have error detection and/or flow control.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any particular reason for this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The same reason it is not used in UDP or other protocols that lack these features.  Less overhead and less complexity.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How is it compensated for if its not used?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It would rely on the application or another layer of the networking stack to compensate for these features, if they were deemed necessary by the network and/or application.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-03-18T03:52:59.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17349" PostTypeId="2" ParentId="12449" CreationDate="2015-03-18T11:39:37.540" Score="0" Body="&lt;p&gt;You would definitely want to break it down further for routing purposes -- you can create a GRE tunnel between R0 and R2, however, to access private ip addresses (and advertise routes) through a public network -- wouldn't really matter if R1 was, in that case, the internet, for example, and R0 was in Australia and R2 was in Canada, for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with your proposed setup would be R0, for example, receiving a packet for the same subnet that is behind it...then expecting it to route it out the outside interface instead of the inside interface.  That's where an IPSec s2s VPN could come into play, where you could encapsulate any traffic that matches the destinations on the other side, then appropriately route them through the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="14384" LastActivityDate="2015-03-18T11:39:37.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17350" PostTypeId="1" CreationDate="2015-03-18T12:58:59.957" Score="1" ViewCount="4437" Body="&lt;p&gt;I am working on a project in which I need to add some options in the IPv4 header field. I am following &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-yi-manet-pc-00#page-12&quot; rel=&quot;nofollow noreferrer&quot;&gt;this draft&lt;/a&gt; for the implementation. I have a doubt!&lt;/p&gt;&#xA;&lt;p&gt;As the above mentioned draft says, I need to add atleast 32*5 = 160 bits to the&#xA;header of IP packet but as far as I know the Options field in the IP header is only limited to 32 bits. How can I add options which have length more than 32bits? Also what should be the right approach for adding options if there are some options already present in the header!&lt;/p&gt;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="14440" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2015-03-18T14:51:59.863" Title="How to add Options in IPv4 Header" Tags="|ipv4|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17351" PostTypeId="2" ParentId="17350" CreationDate="2015-03-18T14:00:04.033" Score="3" Body="&lt;p&gt;Both your questions can be answered by reading &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791&lt;/a&gt; on the Internet Protocol.&lt;/p&gt;&#xA;&lt;p&gt;First of all, where did you get that Options field size? An IPv4 header can contain up to 40 bytes (320 bits) of options.&lt;/p&gt;&#xA;&lt;p&gt;The length of the IP header is indicated in the &lt;em&gt;Internet Header Length&lt;/em&gt; (IHL) field. It uses 32 bit words as the unit of length, so the total size of the header is the value of IHL times 32 bits.&lt;/p&gt;&#xA;&lt;p&gt;Since the IHL is a 4 bit field, the maximum value is 15. This results in a maximum header size of 15 x 32, or 480 bits.&lt;/p&gt;&#xA;&lt;p&gt;A minimal IP header without options is 160 bits (IHL = 5). This leaves 480-160, or 320 bits for options.&lt;/p&gt;&#xA;&lt;p&gt;As for your second question, the structure of the option field is not free, it should contain an option list as defined on &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791#page-15&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791, page 15&lt;/a&gt;. If options are present, you should add yours behind them, at the end of the list.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2015-03-18T14:51:59.863" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17352" PostTypeId="1" CreationDate="2015-03-18T15:07:02.933" Score="3" ViewCount="3148" Body="&lt;p&gt;I am new to networking and I have recently purchased a 1950 switch and 1841 router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am trying to do, is to use VLANS to segregate my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From whaty I have read I think I need to configure 2 VLAN's on my switch, say VLAN-1 and VLAN-2, assign switch ports to the VLAN's and then configure one of the ports on the switch to &quot;trunk&quot; to the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I am ok with that config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am not sure is, what needs to be configured on the Router. I would like to have 2 separate networks, both with DCHP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that possible, can anyone help with some example configuration?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="14442" LastActivityDate="2015-09-14T01:54:27.260" Title="VLAN routing using Cisco 2950 Switch and Cisco 1841 Router" Tags="|cisco|vlan|trunk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17353" PostTypeId="1" AcceptedAnswerId="17398" CreationDate="2015-03-18T15:44:13.223" Score="5" ViewCount="2527" Body="&lt;p&gt;What is the reason for U/L bit in MAC address? Or is it solely for identifying if MAC address is locally generated or not and technically it is not used anywhere?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-03-20T14:41:57.843" Title="Reason for U/L bit in MAC address" Tags="|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17354" PostTypeId="1" AcceptedAnswerId="17371" CreationDate="2015-03-18T16:32:34.263" Score="3" ViewCount="915" Body="&lt;p&gt;Is it possible to capture only the first 10k of data in a TCP flow and discard the rest at capture time?  I have a large number of TCP sessions where each session starts with some metadata and then proceeds with an enormous binary dump.  I suspect an occasional problem in the metadata portion of the flow and want to capture it for study, but don't have enough resources to keep all of the bulk data segments around.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would you set up such a capture?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found filters for segment length and total reassembled length, but the former is effectively just packet size and the latter doesn't increment each time the window is updated, it's calculated once for the entire flow.  Maybe there is a way to do the math for the sequence numbers?  I don't know how to do that in a capture filter though, not even in Wireshark's more powerful display filters.  Maybe there is a better tool?  I'm working on a Linux machine.  &lt;/p&gt;&#xA;" OwnerUserId="14446" LastActivityDate="2015-07-17T13:19:51.170" Title="Wireshark capturing the start of a flow" Tags="|tcp|wireshark|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17355" PostTypeId="1" AcceptedAnswerId="17359" CreationDate="2015-03-18T17:06:13.853" Score="7" ViewCount="7297" Body="&lt;p&gt;Does setting a custom MTU on the host side of a LACP bond require also customizing the MTU on the switch side?&lt;/p&gt;&#xA;" OwnerUserId="14448" LastEditorUserId="775" LastEditDate="2015-03-18T18:59:20.107" LastActivityDate="2015-03-29T02:00:21.800" Title="Do LACP MTUs (or other link-level MTUs) need to match?" Tags="|vlan|ethernet|mtu|ieee-802.1ax|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17359" PostTypeId="2" ParentId="17355" CreationDate="2015-03-18T18:41:50.987" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does setting a custom MTU on the host side of a LACP bond require also customizing the MTU on the switch side?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your data-link MTUs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;On servers the data-link should &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7260/how-is-ieee-802-1ad-aka-vlan-tagging-qinq-valid-when-the-packets-are-too-lar/7285#7285&quot;&gt;&lt;em&gt;always&lt;/em&gt; match&lt;/a&gt; between servers within the same broadcast domain, or vlan.  This isn't critical for TCP services because of TCP MSS negotiation, but UDP services need matched MTUs if they send large packets.&lt;/li&gt;&#xA;&lt;li&gt;On switch interfaces &lt;em&gt;facing your servers&lt;/em&gt;, the data-link MTU must be at least as large as your host / router MTUs in that vlan&lt;/li&gt;&#xA;&lt;li&gt;On other switch to switch / switch to router links, the data-link MTU must be at least large enough for your server MTUs + any other services added by your routers (such as IPSec, MPLS, etc...).  By way of example, if your transit switched MTUs are not large enough it can cause strange issues getting &lt;a href=&quot;https://unix.stackexchange.com/questions/99417/hang-during-touch-operation-on-nfs-mount#comment151796_99418&quot;&gt;network file systems to work correctly&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;On router to router links&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The routers' data-link MTUs should match your other routers, or you could wind up with strange IGP peering problems.&lt;/li&gt;&#xA;&lt;li&gt;The IP MTU on routed interfaces should be the same size as your server's IP MTUs that must transit them.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If all that looks like jibberish, then just do the simple thing and ensure all your data-link MTUs are the same in your network; however, if you need jumbo or baby-jumbo frames, this can get complicated quickly unless you limit the places where jumbos go.  One of the biggest challenges with deploying jumbos is inconsistent jumbo frame support in various network devices; however, most decent enterprise switches will support baby jumbos (for instance, MTUs large enough for MPLS tag stacks two deep).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;&lt;em&gt;Detecting MTU problems&lt;/em&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Ping something in the same vlan (with DF-set in the IP header) to test your MTU configuration between those hosts.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Linux example, with an 1500 byte MTU...&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you have linux use: &lt;code&gt;ping -M do -s &amp;lt;icmp-payload-size&amp;gt; &amp;lt;some pingable ip address in the same vlan&amp;gt;&lt;/code&gt;... This is success, pinging something in the same vlan...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ ifbrief&#xA;eth0      Link encap:Ethernet  HWaddr 80:ee:de:ad:be:ef&#xA;          inet addr:172.16.1.5  Bcast:172.16.1.255  Mask:255.255.255.0&#xA;&#xA;[mpenning@tsunami ~]$ ping -M do -s 1472 -c 1 172.16.1.1&#xA;                                 ^^^^^^^&#xA;PING 172.16.1.1 (172.16.1.1) 1472(1500) bytes of data.&#xA;1480 bytes from 172.16.1.1: icmp_req=1 ttl=255 time=1.30 ms&#xA;&#xA;--- 172.16.1.1 ping statistics ---&#xA;1 packets transmitted, 1 received, 0% packet loss, time 0ms &amp;lt;------&#xA;rtt min/avg/max/mdev = 1.305/1.305/1.305/0.000 ms&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is failure, because we exceed the MTU by one byte...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ ping -M do -s 1473 -c 1 172.16.1.1&#xA;                                 ^^^^^^^&#xA;PING 172.16.1.1 (172.16.1.1) 1473(1501) bytes of data.&#xA;From 172.16.1.5 icmp_seq=1 Frag needed and DF set (mtu = 1500) &amp;lt;--------&#xA;&#xA;--- 172.16.1.1 ping statistics ---&#xA;0 packets transmitted, 0 received, +1 errors&#xA;&#xA;[mpenning@tsunami ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Windows example, with an 1300 byte MTU...&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C07ll.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C07ll.png&quot; alt=&quot;Ping-windows-DF&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;View your windows mtus with &lt;code&gt;netsh interface ipv4 show subinterfaces&lt;/code&gt; and modify with &lt;code&gt;netsh interface ipv4 set subinterface &quot;[windows-intf-name]&quot; mtu=[MTU-size] store=persistent&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-03-29T02:00:21.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17360" PostTypeId="2" ParentId="17352" CreationDate="2015-03-18T19:09:12.477" Score="3" Body="&lt;p&gt;Vlan 10 - 10.0.10.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan 20 - 10.0.20.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfdhcp.html&quot; rel=&quot;nofollow&quot;&gt;CONFIGURE DHCP&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This assumes first available IP is gateway and gives a simple setup.  You can configure further by setting lease time, dns server, excluded addresses etc.  Other configurations include setting manual bindings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan 10:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool VLAN10-POOL&#xA;network 10.0.10.0 255.255.255.0&#xA;default-router 10.0.10.1&#xA;dns-server 8.8.8.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Vlan 20:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool VLAN20-POOL&#xA;network 10.0.20.0 255.255.255.0&#xA;default-router 10.0.20.1&#xA;dns-server 8.8.8.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;CONFIGURE INTER-VLAN ON ROUTER:&#xA;Many examples online, simply Google &quot;router on a stick&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We'll assume fastethernet 0/0 is the connected interface to your switch.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface fastethernet 0/0&#xA;no ip address&#xA;duplex auto&#xA;speed auto&#xA;&#xA;interface fastethenet 0/0.10&#xA;description VLAN10&#xA;encapsulation dot1q 10&#xA;ip address 10.0.10.1 255.255.255.0&#xA;&#xA;interface fastethernet 0/0.20&#xA;description VLAN20&#xA;encapsulation dot1q 20&#xA;ip address 10.0.20.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14230" LastEditorUserId="33" LastEditDate="2015-03-18T20:17:47.930" LastActivityDate="2015-03-18T20:17:47.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17362" PostTypeId="1" AcceptedAnswerId="17368" CreationDate="2015-03-19T00:05:23.747" Score="1" ViewCount="1240" Body="&lt;p&gt;edit: Simplified (drastically) question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem:&lt;/strong&gt;&#xA;I have a Cisco IE3000 L2 switch with SVI and DHCP support that needs to be connected to our LAN via the uplink port and to field equipment via the downlink? ports.  I need the equipment connected to the downlink ports to ignore the upstream DHCP server and only receive ip addresses from the switch itself.  I also need the switch to 'switch' network traffic between the uplink and downlink ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, the only way i can do this is by disconnecting the uplink while the switch and downstream equipment boots up and assigns/receives IP addresses from the switch DHCP server.  Then I reconnect the uplink and all is good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I leave the uplink connected while switch and downlink equipment boots, the downlink equipment receives ip addresses from the upstream DHCP server.  This is a problem.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;side question - when uplink is connected, what mechanism allows upstream dhcp server to override the local switch dhcp server?  why doesn't the switch dhcp answer/assign an ip address to the downlink ports before main dhcp server does?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I also tried assigning all the downlink ports to a separate VLAN on the switch.  This allowed the downlink ports to get proper IP addresses from the switch, even with the uplink connected, but obviously communication between the uplink port and downlink ports is not possible because they are on separate VLANS.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The vendor's solution is to put their dual-homed application computer between the field equipment switch and rest of the upstream network, but that seems a bit of a hack, and the field equipment environment is not conducive to PC longevity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;obviously any other methods are welcome if they achieve the same end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch does not support inter-vlan communication/SVI routing but even if it did I think I would end up with the same result as option 1.&lt;/p&gt;&#xA;" OwnerUserId="14455" LastEditorUserId="8499" LastEditDate="2019-12-26T19:50:51.690" LastActivityDate="2019-12-26T19:50:51.690" Title="ignore/block upstream DHCP, instead use switch DHCP?" Tags="|cisco|switch|vlan|dhcp|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17363" PostTypeId="2" ParentId="17302" CreationDate="2015-03-19T00:08:20.783" Score="0" Body="&lt;p&gt;A four Pole Single Throw or 4 Pole Double Throw (4PST or 4PDT) will work to disable any ethernet. Be sure to switch one wire in each pair, preferably the white with colored stripe. Here is a $3.55 switch that fits the bill. &lt;a href=&quot;http://www.ebay.com/itm/1-MINI-TRAIN-TOGGLE-4PDT-4P2T-ON-ON-4-POLE-SWITCH-125-V-/380289420533?pt=LH_DefaultDomain_0&amp;amp;hash=item588b040cf5&quot; rel=&quot;nofollow&quot;&gt;http://www.ebay.com/itm/1-MINI-TRAIN-TOGGLE-4PDT-4P2T-ON-ON-4-POLE-SWITCH-125-V-/380289420533?pt=LH_DefaultDomain_0&amp;amp;hash=item588b040cf5&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is a '2 Throw' or'DT' you could even wire another ethernet network to the unused poles to connect up to. &lt;/p&gt;&#xA;" OwnerUserId="14456" LastActivityDate="2015-03-19T00:08:20.783" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17365" PostTypeId="2" ParentId="17354" CreationDate="2015-03-19T02:28:03.350" Score="-2" Body="&lt;p&gt;The display and capture filters from Wireshark will only display or capture packets that match a certain size (or threshold), as you discoverred.  What you want, is to capture only the first N bytes from &lt;em&gt;each&lt;/em&gt; packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, you want to catch just the headers, which will typically be the first 54 bytes:  18 for Ethernet, 20 for IP, 20 for TCP.  (If you're receiving VLAN tagged packets, add another 4 for the 802.1q header, making a total of 58 bytes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way to do that in &lt;a href=&quot;http://www.tcpdump.org/manpages/tcpdump.1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;tcpdump&lt;/a&gt; is to use the -s option:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-s snaplen&lt;BR /&gt;&#xA;  --snapshot-length=snaplen&lt;BR /&gt;&#xA;  &lt;BR /&gt;&#xA;  Snarf snaplen bytes of data from each packet rather than the default of 65535 bytes. Packets truncated because of a limited snapshot are indicated in the output with ``[|proto]'', where proto is the name of the protocol level at which the truncation has occurred. Note that taking larger snapshots both increases the amount of time it takes to process packets and, effectively, decreases the amount of packet buffering. This may cause packets to be lost. You should limit snaplen to the smallest number that will capture the protocol information you're interested in. Setting snaplen to 0 sets it to the default of 65535, for backwards compatibility with recent older versions of tcpdump.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This way, you capture all the &quot;important stuff&quot;, and avoid capturing the long streams of binary data.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also find additional useful information on &lt;a href=&quot;https://serverfault.com/questions/253613/tcpdump-how-do-i-use-it-to-capture-all-traffic-headers&quot;&gt;this post&lt;/a&gt; over at Server Fault.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-03-19T02:28:03.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17368" PostTypeId="2" ParentId="17362" CreationDate="2015-03-19T06:08:41.553" Score="6" Body="&lt;p&gt;Your scenario is somewhat confuse. If I uderstand well you want to filtered DHCP request on L2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can achieve it by using the function DHCP Snooping features available on your platform. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could set all ports in untrusted mode so only DHCP reply from the switch will be accepted.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/cisco_ie3000/software/release/15-0_2_se/configuration/guide/scg_ie3000/swdhcp82.html#wp1078853&quot;&gt;DHCP Snooping - configuration guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;DHCP snooping acts like a firewall between untrusted hosts and DHCP servers. You use DHCP snooping to differentiate between untrusted interfaces connected to the end user and trusted interfaces connected to the DHCP server or another switch. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which is what you are looking, filtering DHCP communication between your hosts and upstream DHCP.   &lt;/p&gt;&#xA;" OwnerUserId="206" LastEditorUserId="206" LastEditDate="2015-03-19T09:35:08.210" LastActivityDate="2015-03-19T09:35:08.210" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17371" PostTypeId="2" ParentId="17354" CreationDate="2015-03-19T11:49:29.963" Score="2" Body="&lt;p&gt;Wireshark and other capture tools are not aware of TCP streams during capture. They would have to save tcp stream state in memory to do that which would reduce troughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said there might be a way. If your packets have metadata there might be some sort of identifier (header, string, etc.) that is in all the packets with metadata? If so you could filter these with &lt;code&gt;iptables&lt;/code&gt; and feed them to a NFLOG target which can be captured with &lt;code&gt;dumpcap&lt;/code&gt;, a tool that is shipped with wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if all your metadata packets have a &quot;X-Metadata&quot; string in them, and you capture them on &lt;code&gt;eth0&lt;/code&gt; you could do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables -A INPUT -i eth0 -m string --algo bm --string &quot;X-Metadata&quot; -j NFLOG --nflog-group 1&#xA;dumpcap -i nflog:1 -w test.pcap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will save all packets with &quot;X-Metadata&quot; in them in the &lt;code&gt;test.pcap&lt;/code&gt; file. Mind you, if there is some other way to identify packets with metadata, &lt;code&gt;iptables&lt;/code&gt; might be able to do that. There are many filters/extensions.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2015-03-19T11:49:29.963" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17372" PostTypeId="1" AcceptedAnswerId="17373" CreationDate="2015-03-19T12:59:37.250" Score="4" ViewCount="22315" Body="&lt;p&gt;I configured aaa using Tacacs+ on a switch and a router but when I try to connect to the switch through SSH it just accept Tacacs+ users when I try to use local DB user I got &amp;quot;% Authorization failed.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;following are the aaa configuration:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;aaa new-model&lt;/p&gt;&#xA;&lt;p&gt;aaa authentication login default local&lt;/p&gt;&#xA;&lt;p&gt;aaa authorization exec default group tacacs+ local&lt;/p&gt;&#xA;&lt;p&gt;aaa authorization commands 15 default group tacacs+&lt;/p&gt;&#xA;&lt;p&gt;aaa accounting exec default start-stop group tacacs+&lt;/p&gt;&#xA;&lt;p&gt;aaa accounting commands 15 default start-stop group tacacs+&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8366" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-01-06T07:34:33.930" Title="% Authorization failed. message appear when I try to connect to the switch using local DB user name" Tags="|cisco-ios|cisco-catalyst|aaa|authorization|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17373" PostTypeId="2" ParentId="17372" CreationDate="2015-03-19T13:49:37.940" Score="5" Body="&lt;p&gt;You are authenticating correctly, but the command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authorization exec default group tacacs+ local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;means that in order to start an exec sesion (i.e. a command line shell), the switch will check the Tacacs server for your credentials. Since presumably they're not there, the authorization is failing. It will only use the local database when the Tacacs server is unavailable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A helpful tip:  If you have (read) access to the Tacacs server, check the &quot;failed attempts&quot; log or the Tacacs Events log (depending on the ACS version).  It will tell you why the event failed, so you can go fix it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-19T13:49:37.940" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17376" PostTypeId="1" AcceptedAnswerId="17386" CreationDate="2015-03-19T16:14:18.050" Score="0" ViewCount="608" Body="&lt;p&gt;I wonder if there is necessary to create two VLANS to have two separate networks in a single switch. &#xA;i.e. Having:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Host A: 192.168.1.20 connected on port 1 &lt;/li&gt;&#xA;&lt;li&gt;Host B: 192.168.1.21 connected on port 2 &lt;/li&gt;&#xA;&lt;li&gt;Host C: 172.100.1.40 connected on port 3 &lt;/li&gt;&#xA;&lt;li&gt;Host D: 172.100.1.41 connected on port 4&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;WITHOUT VLAN, isn't there any problems between network A-B and network C-D?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="14468" LastEditorUserId="509" LastEditDate="2015-03-19T16:19:26.150" LastActivityDate="2015-03-19T21:25:29.273" Title="Two networks without VLAN. Is is possible?" Tags="|vlan|" AnswerCount="2" CommentCount="0" ClosedDate="2015-03-20T05:47:11.600" ContentLicense="CC BY-SA 3.0" />
  <row Id="17377" PostTypeId="2" ParentId="17376" CreationDate="2015-03-19T16:20:33.887" Score="0" Body="&lt;p&gt;This will work without any problems, but of course A and C cannot reach eachother as well as B and D, unless there's a router connected to both IP networks.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-03-19T16:20:33.887" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17378" PostTypeId="1" CreationDate="2015-03-19T16:34:10.793" Score="2" ViewCount="1342" Body="&lt;p&gt;I have a relatively large layer 2 network where port flapping is not uncommon. I am using Juniper EX 2200 switches, which clear out the mac-forwarding table on a topology change. It is not uncommon for ports to flap in our network, devices reboot, etc.. Each time a port flaps, a TC is sent throughout the network and all of my EX switches flush out the ethernet-switching tables. This creates a pretty large flood while the switches re-learn. Has anyone experienced an issue similar to this? Do you have any suggestions to limit the flooding that happens after an STP TC? Is there anything that I can configure on the EX switches to limit the flood?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="13689" LastActivityDate="2015-12-08T17:36:46.557" Title="Juniper EX Flooding on STP Topology Change" Tags="|spanning-tree|juniper-junos|switching|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17379" PostTypeId="2" ParentId="16698" CreationDate="2015-03-19T17:48:18.103" Score="0" Body="&lt;p&gt;In the NAT statement you are indicating the SOURCE port is 22 on the internal address, yet on your ACL you put the &quot;eq 22&quot; on the DESTINATION side. Try either removing &quot;eq 22&quot; from your routemap ACL entirely, or put it on the correct side (source) to match your NAT statement.&lt;/p&gt;&#xA;" OwnerUserId="14472" LastActivityDate="2015-03-19T17:48:18.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17381" PostTypeId="2" ParentId="17362" CreationDate="2015-03-19T18:13:15.160" Score="2" Body="&lt;p&gt;As I understand it, you want your LAN to receive IP address assignments only from the IE3000 switch. If there is an IP helper address set up in your running-config, you should disable that as a first step. That might clear up the issue by itself, and keep things simple.&lt;/p&gt;&#xA;" OwnerUserId="2375" LastActivityDate="2015-03-19T18:13:15.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17382" PostTypeId="2" ParentId="17378" CreationDate="2015-03-19T19:34:47.813" Score="6" Body="&lt;p&gt;TCNs are only generated from non-edge ports when they receive a BPDU. Verify that your access ports are configured as edge ports under your spanning-tree config. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set protocols rstp interface ge-0/0/0 edge&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1613" LastEditorUserId="10496" LastEditDate="2015-12-08T17:36:46.557" LastActivityDate="2015-12-08T17:36:46.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17383" PostTypeId="1" AcceptedAnswerId="17384" CreationDate="2015-03-19T19:52:54.193" Score="5" ViewCount="2297" Body="&lt;p&gt;I was searching for an easy way to do this over the last few days and found that there wasn't a &lt;strong&gt;SIMPLE&lt;/strong&gt; way to do this.  The majority of the answers were:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Too complex for the problem at hand.&lt;/li&gt;&#xA;&lt;li&gt;Difficult to understand without prior knowledge of SLAX.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3075" LastEditorDisplayName="user36472" LastEditDate="2018-02-18T08:30:46.253" LastActivityDate="2018-02-18T08:30:46.253" Title="How do you alias a command in JunOS?" Tags="|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17384" PostTypeId="2" ParentId="17383" CreationDate="2015-03-19T19:52:54.193" Score="5" Body="&lt;p&gt;I was working with a customer who was implementing OAM in JunOS, the show commands to display statistics are unwieldy.  They wanted a way not to have to type the full command everytime they needed to retrieve statistics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here's what I mean:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show oam ethernet connectifity-fault-management sla-iterator-statistics sla-iterator ITERATOR maintenance-domain MD maintenance-association MA local-mep 100 remote-mep 101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see why this would get pretty annoying, so how can we turn that into a much shorter one-liner?  JunOS doesn't have the ability to alias a command built into the OS.  What we can do, is use a SLAX script.  It's a bit more obnoxious at first, but it's kind of nice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The &quot;script&quot;:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll use a much more basic command to keep everything short, but you can replace the show command you see in the code with any other show command you would want to use.  Feel free to also make the variables a more coherent name for your use case.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 1.0;&#xA;ns junos = &quot;http://xml.juniper.net/junos/*/junos&quot;;&#xA;ns xnm = &quot;http://xml.juniper.net/xnm/1.1/xnm&quot;;&#xA;ns jcs = &quot;http://xml.juniper.net/junos/commit-scripts/1.0&quot;;&#xA;import &quot;../import/junos.xsl&quot;;&#xA;&#xA;match / {&#xA;    &amp;lt;op-script-results&amp;gt; {&#xA;&#xA;        var $variable1 = &amp;lt;rpc&amp;gt; {&#xA;            &amp;lt;command format=&quot;text&quot;&amp;gt; &quot;show interfaces terse&quot;;&#xA;        }&#xA;&#xA;        var $variable2 = jcs:invoke($variable1);&#xA;&#xA;    &amp;lt;output&amp;gt; $variable2;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Running the Script:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Your script (filename) must end in &lt;code&gt;.slax&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Your script must be located in &lt;code&gt;/var/db/scripts/op/&lt;/code&gt; on the box.  If you are using redundant routing engines, it must be present on both RE's in the same directory mentioned above.  Here's how you copy a file from one RE to another:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;file copy re0:/var/db/scripts/op/filename.slax re1:/var/db/scripts/op/filename.slax&#xA; file list re1:/var/db/scripts/op/&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Once your file(s) are copied, you must enable them.  This prevents anyone who can copy files to the device from executing potentially destructive scripts.  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1# set system scripts op file filename.slax&#xA; R1# show | compare&#xA; R1# commit and-quit&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;If you're using multiple RE's:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1# commit synchronize and-quit&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;At the operational mode prompt:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1&amp;gt; op filename.slax&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And you're done, I hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2015-06-25T14:30:02.617" LastActivityDate="2015-06-25T14:30:02.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17386" PostTypeId="2" ParentId="17376" CreationDate="2015-03-19T21:25:29.273" Score="0" Body="&lt;p&gt;You can do that.. but it is a realy realy bad set up.. and u should never ever ever do something like that.. it is a waste of router interfaces if you do that. &lt;/p&gt;&#xA;" OwnerUserId="13605" LastActivityDate="2015-03-19T21:25:29.273" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17387" PostTypeId="2" ParentId="17300" CreationDate="2015-03-19T21:37:57.583" Score="2" Body="&lt;p&gt;From the host it self as said before you cannot check that.. but you can check it if you have access to the switch where host A is connect to.. and check the mac-address table. If the mac-adress of host B is showing on a trunk port then you know is on another switch.&lt;/p&gt;&#xA;" OwnerUserId="13605" LastActivityDate="2015-03-19T21:37:57.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17388" PostTypeId="1" AcceptedAnswerId="17391" CreationDate="2015-03-19T21:50:00.223" Score="3" ViewCount="664" Body="&lt;p&gt;Okay guys I have a conundrum on my network, I do not know how it is working, I just know it does. I have a Juniper SSG firewall with 3 different ISPs. I have traffic coming in through the 3 interfaces, but somehow all outgoing traffic is sent through interface 1. How can this be possible?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example:&lt;/strong&gt;&#xA;Client A sends a packet to Server B behind Juniper ethernet 0/1 ISP. Server B responds to Client A but the response is sent to Client A via ethernet 0/0. How does Client A know the response is valid if the response came from a different public IP? The same exact path is provided to the other ISP on ethernet 0/2, any signals that come in to the Juniper SSG on ethernet 0/2 are replied to through ethernet 0/0. These &quot;servers&quot; are alarm Receivers communicating to alarm panels on the field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, if the ISP for ethernet 0/0 goes down (it is set as our primary for outbound), and Server B starts to reply to Client A on ethernet 0/1 or ethernet 0/2 they start screaming. (alarm signal receivers talking to panels on the field)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have tested this and this is the way it appears to work. We do not understand why or how. Has anyone seen this before?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason we are asking is because we are looking to replace the Juniper SSG with a different product and we would like to replicate this same   &lt;/p&gt;&#xA;" OwnerUserId="14372" LastActivityDate="2015-12-23T17:27:28.403" Title="Juniper SSG and multiple interfaces" Tags="|routing|nat|juniper-junos|isp|interface|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17389" PostTypeId="2" ParentId="17300" CreationDate="2015-03-19T22:58:41.993" Score="-2" Body="&lt;p&gt;You can execute the traceroute command from node A to trace the route of an IP packet sent to node B.&#xA;If the two nodes are connected to the same switch traceroute output will shows only one hop.&#xA;Run this in a windows terminal &lt;code&gt;tracert 192.168.0.2&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14476" LastActivityDate="2015-03-19T22:58:41.993" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17391" PostTypeId="2" ParentId="17388" CreationDate="2015-03-20T01:53:35.420" Score="1" Body="&lt;p&gt;This issue occurs with your Quad Zero route.  You have routes bound to interfaces and if you are fulfilling requests from a priv or dmz interface and you have a 0.0.0.0 route offered on that interface that is the path the return traffic will take to get back to the requesting source.  If you need the traffic to return from the interface it was received from your will need to redo your routing on the device.&lt;/p&gt;&#xA;&lt;h1&gt;Suggestion&lt;/h1&gt;&#xA;&lt;p&gt;If you have a service window you can schedule.&lt;/p&gt;&#xA;&lt;p&gt;Research how you would like your 0.0.0.0 routing to work per interface.  I would imagine you might have some end user requests for Internet passing through the device too and that would need to be taken into consideration.&lt;/p&gt;&#xA;&lt;p&gt;Modify your txt config file to what you believe is functional and load it up during your service window.&lt;/p&gt;&#xA;&lt;p&gt;Have your testing regiment planned out and try and hit every item.  If you fall into an abyss, load your config that you know is functional and return to a steady state and revisit the issue during your next window.  Plan it, test it, nail it.  Good luck.&lt;/p&gt;&#xA;" OwnerUserId="13479" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-12-23T17:27:28.403" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17394" PostTypeId="2" ParentId="7297" CreationDate="2015-03-20T05:14:24.370" Score="1" Body="&lt;p&gt;You need to specify -u UDP &quot;datagram-oriented&quot; mode if not using iperf3.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CLIENT SPECIFIC OPTIONS&#xA;   -b, --bandwidth n[KM]&#xA;          set  target  bandwidth to n bits/sec (default 1 Mbit/sec).  This&#xA;          setting requires UDP (-u).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://manpages.ubuntu.com/manpages/precise/en/man1/iperf.1.html&quot; rel=&quot;nofollow&quot;&gt;http://manpages.ubuntu.com/manpages/precise/en/man1/iperf.1.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14479" LastActivityDate="2015-03-20T05:14:24.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17395" PostTypeId="1" AcceptedAnswerId="18588" CreationDate="2015-03-20T08:28:12.310" Score="2" ViewCount="1952" Body="&lt;p&gt;I'm having some difficulty with this scenario.  I have an &quot;Internet Edge&quot; whereby all of my regular traffic is firewalled, NATed and sent on it's way.  I also have a &quot;Wan Aggregation&quot; layer where a router connects via various WAN technologies to other branch offices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of these branches happens to be a floating branch, whose public ip address changes periodically, and is connected via IPSEC VTI.  The trouble lies in that, while the tunnel comes up, the wan aggregation router is actually sending it's ISAKMP and ESP packets out it's default route, instead of out it's configured public ip address.  I can't change the default route because then all branch traffic would exit on that ip address as well (and not be filtered/firewalled/etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default (and all other) routes are propagated through OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MrocI.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I considered doing something with VRF, but I want to add TEST-MDF's networks OSPF, and it looks to be a huge pain to leak routes into the global routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also played around with policy based routing by creating an access list permitting esp, isakmp, and non500-isakmp from any to any and applying it to just about every interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the relevant config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TEST-MDF:&#xA;    crypto isakmp policy 1&#xA;     encr aes&#xA;     authentication pre-share&#xA;     group 2&#xA;    crypto isakmp key cisco address 0.0.0.0 0.0.0.0&#xA;    !&#xA;    crypto ipsec transform-set TSET esp-aes esp-sha-hmac &#xA;    !&#xA;    crypto ipsec profile VTI&#xA;     set transform-set TSET &#xA;    !&#xA;    interface Loopback0&#xA;     ip address 10.9.8.1 255.255.255.0&#xA;     ip ospf network point-to-point&#xA;     ip ospf 1 area 9&#xA;    !&#xA;    interface Tunnel0&#xA;     ip unnumbered Loopback0&#xA;     ip ospf 1 area 9&#xA;     tunnel source FastEthernet0/0&#xA;     tunnel destination 1.1.1.5&#xA;     tunnel mode ipsec ipv4&#xA;     tunnel protection ipsec profile VTI&#xA;    !&#xA;    interface FastEthernet0/0&#xA;     ip address 1.2.1.2 255.255.255.0&#xA;    !&#xA;    router ospf 1&#xA;     log-adjacency-changes&#xA;    !&#xA;    ip route 0.0.0.0 0.0.0.0 1.2.1.1&#xA;&#xA;CNT-MDF-WANAGG#&#xA;    crypto isakmp policy 1&#xA;     encr aes&#xA;     authentication pre-share&#xA;     group 2&#xA;    crypto isakmp key cisco address 0.0.0.0 0.0.0.0&#xA;    crypto isakmp profile IKE-DEFAULT&#xA;       keyring default&#xA;       match identity address 0.0.0.0 &#xA;       virtual-template 1&#xA;    !&#xA;    !&#xA;    crypto ipsec transform-set TSET esp-aes esp-sha-hmac &#xA;    !&#xA;    crypto ipsec profile VTI&#xA;     set transform-set TSET &#xA;     set isakmp-profile IKE-DEFAULT&#xA;    !&#xA;    interface Loopback0&#xA;     ip address 10.0.0.5 255.255.255.255&#xA;     ip policy route-map RM-VPN&#xA;     ip ospf network point-to-point&#xA;     ip ospf 1 area 0&#xA;    !&#xA;    interface Loopback100&#xA;     ip address 10.4.8.1 255.255.255.0&#xA;     ip ospf network point-to-point&#xA;     ip ospf 1 area 4&#xA;    !&#xA;    interface FastEthernet0/0&#xA;     ip address 10.255.0.1 255.255.255.254&#xA;     ip policy route-map RM-VPN&#xA;     ip ospf 1 area 0&#xA;    !&#xA;    interface FastEthernet0/1&#xA;     ip address 1.1.1.5 255.255.255.0&#xA;     ip policy route-map RM-VPN&#xA;    !         &#xA;    interface Virtual-Template1 type tunnel&#xA;     ip unnumbered Loopback0&#xA;     ip virtual-reassembly&#xA;     ip policy route-map RM-VPN&#xA;     ip ospf 1 area 9&#xA;     tunnel source FastEthernet0/1&#xA;     tunnel mode ipsec ipv4&#xA;     tunnel protection ipsec profile VTI&#xA;    !&#xA;    router ospf 1&#xA;     log-adjacency-changes&#xA;    !&#xA;    ip local policy route-map RM-VPN&#xA;    !&#xA;    ip access-list extended VPN&#xA;     permit esp any any&#xA;     permit gre any any&#xA;     permit udp any any eq isakmp&#xA;     permit udp any any eq non500-isakmp&#xA;    !&#xA;    route-map RM-VPN permit 1&#xA;     match ip address VPN&#xA;     set ip default next-hop 1.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5595" LastEditorUserId="5595" LastEditDate="2015-03-20T09:23:52.027" LastActivityDate="2015-05-19T19:02:31.533" Title="Change default route only for IPSEC packets" Tags="|cisco|routing|vpn|ipsec|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17398" PostTypeId="2" ParentId="17353" CreationDate="2015-03-20T14:41:57.843" Score="6" Body="&lt;p&gt;Ref IEEE 802.3 section 3.2.3 Address fields&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second bit shall be used to distinguish between locally or globally administered addresses. For globally administered (or U, universal) addresses, the bit is set to 0. If an address is to be assigned locally, this bit is set to 1. Note that for the broadcast address, this bit is also a 1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Administered is the keyword here. You, as a network administrator, are responsible for using nodes with unique addresses in the broadcast domains of your network. Using ready made NICs (with build in MAC addresses) is easy (the manufacturer takes care of unique address assignment), but if you assign your own addresses, you may not be sure you are globally unique. That's what this bit says, you are out of the way of globally assigned addresses and take care of unique assignments in your broadcast domains. &lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2015-03-20T14:41:57.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17400" PostTypeId="1" AcceptedAnswerId="17408" CreationDate="2015-03-20T16:28:59.293" Score="1" ViewCount="2175" Body="&lt;p&gt;AFAIK Local link addresses are addresses that can only talk to devices within its own subnet. Routers will not forward packets that come from local link addresses. Local link addresses are defined in the address block &lt;code&gt;169.254.0.0/16&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco says the following about the L code when using &lt;code&gt;show ip route&lt;/code&gt;. &quot;Identifies that this is a link local route. Link local routes are automatically created when an interface is configured with an IP address and activated.&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example output of me using &lt;code&gt;show ip route&lt;/code&gt; in a packet tracer excercise. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 10.0.0.0/8 is variably subnetted, 5 subnets, 3 masks&#xA;C       10.10.1.0/30 is directly connected, Serial0/0/0&#xA;L       10.10.1.2/32 is directly connected, Serial0/0/0&#xA;C       10.10.1.8/30 is directly connected, Serial0/0/1&#xA;L       10.10.1.9/32 is directly connected, Serial0/0/1&#xA;D       10.10.1.16/28 [90/2170112] via 10.10.1.10, 02:09:24, Serial0/0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is:&lt;/strong&gt; The ip adresses mentioned in &lt;code&gt;show ip route&lt;/code&gt; are the addresses of the NICs in each route, right? Then why do the L routes show ip addresses that arent in the address block previously mentioned? Clearly &lt;code&gt;10.10.1.2/32&lt;/code&gt; is not in the address block &lt;code&gt;169.254.0.0/16&lt;/code&gt;. Or does local link have multiple definitions?&lt;/p&gt;&#xA;" OwnerUserId="13978" LastEditorUserId="632" LastEditDate="2015-03-20T19:06:28.940" LastActivityDate="2015-03-20T19:09:59.863" Title="What's the difference between a local-link address and a local-link route?" Tags="|ipv4|subnet|ip-link-local|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17401" PostTypeId="2" ParentId="17400" CreationDate="2015-03-20T16:53:52.860" Score="1" Body="&lt;p&gt;/32 means full subnet mask.&#xA;Those are the address you put on the interfaces. so yes you are right on the first part. but i'm sry you are wrong on the second part. Network with ID 10.10.1.8/30 has 4 adresses a IPv4 has 32 bits. So 2 bits left(32-30=2) 2^2 = 4 combinations equals 4 addresses in IPv4 space.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;10.10.1.8 = Network ID&lt;/li&gt;&#xA;&lt;li&gt;10.10.1.9 = Host#1 (Your Device)&lt;/li&gt;&#xA;&lt;li&gt;10.10.1.10 = Host#2&lt;/li&gt;&#xA;&lt;li&gt;10.10.1.11 = Broadcast ID&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The first subnet is the Same&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;10.10.1.0 = Network ID&lt;/li&gt;&#xA;&lt;li&gt;10.10.1.1 = Host#1&lt;/li&gt;&#xA;&lt;li&gt;10.10.1.2 = Host#2 (Your Device)&lt;/li&gt;&#xA;&lt;li&gt;10.10.1.3 = Broadcast ID&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;On your last question you are correct. i don't know a 100% why it places a L there.. but i know that we netwerk engineers use /30 adressen in IPv4 to create peer 2 peer connection between 2 devices..&lt;/p&gt;&#xA;" OwnerUserId="14392" LastActivityDate="2015-03-20T16:53:52.860" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17403" PostTypeId="2" ParentId="17395" CreationDate="2015-03-20T17:10:00.493" Score="0" Body="&lt;p&gt;you could make a router-map to first filter out the branches with the ip you know and then set interface out/next-hop on the different path you want it 2 take.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or have the floating branch office connect on a second wan ip ?&lt;/p&gt;&#xA;" OwnerUserId="14392" LastActivityDate="2015-03-20T17:10:00.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17404" PostTypeId="2" ParentId="16252" CreationDate="2015-03-20T17:21:59.713" Score="4" Body="&lt;p&gt;If you receive a packet on frequency X, you can't also transmit the same info on that same frequency. So you need to wait. that's why if you use the newer 802.11 protocol's who use more then one frequency you are going to have less interference(its not really interference its more like a busy phone line :P).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A side from Co-Channel interference(&lt;a href=&quot;http://www.metageek.com/support/why-channels-1-6-and-11/&quot; rel=&quot;nofollow&quot;&gt;http://www.metageek.com/support/why-channels-1-6-and-11/&lt;/a&gt;) that's why they accept 50% lose of transmit bandwidth.. its not the rate that's slowing its the wireless bandwidth that's getting cut in about half :(&lt;/p&gt;&#xA;" OwnerUserId="14392" LastEditorUserId="14392" LastEditDate="2015-03-20T17:36:20.537" LastActivityDate="2015-03-20T17:36:20.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17405" PostTypeId="1" CreationDate="2015-03-20T18:13:36.040" Score="2" ViewCount="1398" Body="&lt;p&gt;I am by no means an expert when it comes to networking but I recently inherited a network setup which is using wireless &lt;code&gt;Access Points&lt;/code&gt; that clients can connect to (usually via a wireless device used in &lt;code&gt;station mode&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is the existing setup is not using VLANs to break down broadcast domains. I would like to introduce them, but I am not really sure how to tackle it.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Network diagram&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;In simplified form, the network looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7jbYx.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Network is using static IPs (3 subnets)&lt;/li&gt;&#xA;&lt;li&gt;I have very little to no access to the Access Points to modify any settings&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I have very little to no access to the devices used by clients to connect to Access Points&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;FreeBSD router (&lt;code&gt;Fa0/0&lt;/code&gt;) &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10.10.10.1 netmask 255.255.255.0&lt;/li&gt;&#xA;&lt;li&gt;10.10.20.1 netmask 255.255.255.0 alias&lt;/li&gt;&#xA;&lt;li&gt;10.10.30.1 netmask 255.255.255.0 alias&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;L3 Switch_1&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;supports 802.1Q VLAN&lt;/li&gt;&#xA;&lt;li&gt;supports Private VLAN&lt;/li&gt;&#xA;&lt;li&gt;supports Port Isolation (is it the same thing as Port-VLAN?)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;L2 Switch_1&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;supports 802.1Q VLAN &lt;/li&gt;&#xA;&lt;li&gt;supports Port-VLAN&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;L2 Switch_2&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;supports 802.1Q VLAN &lt;/li&gt;&#xA;&lt;li&gt;supports Port Isolation (is it the same thing as Port-VLAN?)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;What I want to do&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Ideally I don't want any subnet to see one another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can easily setup VLANs in the FreeBSD router (instead of using ip aliases (or secondary ips depending on the terminology)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN10 for 10.10.10.0/24 &lt;/li&gt;&#xA;&lt;li&gt;VLAN20 for 10.10.20.0/24&lt;/li&gt;&#xA;&lt;li&gt;VLAN30 for 10.10.30.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then I can setup port &lt;code&gt;Fa0/4&lt;/code&gt;, &lt;code&gt;Fa0/3&lt;/code&gt; and &lt;code&gt;Fa0/2&lt;/code&gt; on &lt;code&gt;L3_SWITCH_1&lt;/code&gt; to be a &lt;code&gt;trunk&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But at this point I seem to get stuck and have no idea what to do. Both &lt;code&gt;L2_SWITCH_1&lt;/code&gt; and &lt;code&gt;L2_SWITCH_2&lt;/code&gt;&#xA;can carry traffic from any subnet on each port (because any client can connect to any Access Point).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;L1_SWITCH_1&lt;/code&gt; port &lt;code&gt;Fa0/1&lt;/code&gt; and port &lt;code&gt;Fa0/2&lt;/code&gt; is carrying traffic from potentially all 3 subnets at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same situation is with &lt;code&gt;L2_SWITCH_2&lt;/code&gt; port &lt;code&gt;Fa0/1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So would I potentially need to setup every existing port in each switch to be a trunk for VLAN10, VLAN20 and VLAN30?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But does it still make sense to do it that way? Would I still benefit from VLANs? (Isolation, separate Broadcast domains, etc.)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do?&lt;/p&gt;&#xA;" OwnerUserId="14486" LastEditorUserId="14486" LastEditDate="2015-03-20T18:18:48.143" LastActivityDate="2021-01-26T09:41:35.770" Title="How can I introduce VLANs to an existing setup with wireless Access Points?" Tags="|routing|switch|wireless|vlan|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17406" PostTypeId="2" ParentId="17405" CreationDate="2015-03-20T18:25:47.837" Score="2" Body="&lt;p&gt;You would need your APs to support VLANs, and extend a trunk to them. Then operate a different SSID per VLAN/broadcast domain, or use 802.1x for VLAN assignment.&lt;/p&gt;&#xA;" OwnerUserId="14479" LastActivityDate="2015-03-20T18:25:47.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17408" PostTypeId="2" ParentId="17400" CreationDate="2015-03-20T19:09:59.863" Score="2" Body="&lt;p&gt;The &lt;code&gt;L&lt;/code&gt; stands for local, meaning the address of the interface of the router itself within the subnet. It is unrelated to the concept of link-local addressing which indeed uses special addresses.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-03-20T19:09:59.863" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17409" PostTypeId="2" ParentId="17300" CreationDate="2015-03-20T20:52:17.770" Score="1" Body="&lt;p&gt;To piggy back on Ricky's answer if you can access PC A and B but not any of the switches inbetween you could use Wireshark to capture any CDP or LLDP packets that come your way. Using the device name and other information in these packets you could at least confirm whether they are 1 switch hop apart, or 2 (or more) switch hops away from each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Expanded the original answer below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would be able to capture CDP or LLDP packets which, if enabled on the switches are sent out every 60 and 30 seconds respectively. These types of packets both have switch information inside them. For example: You enable Wireshark on PC A to capture packets. You receive an LLDP (or CDP) packet there, you expand the details in Wireshark and you will see System Name: Cisco-3750-London-1 or you could look at the System ID: de:ad:01:01:be:ef. On PC B you could do the same and see if they are the same or different System Names and IDs. Does PC B receive CDP/LLDP packets that contain System Name: Cisco-3750-London1 and de:ad:01:01:be:ef, or will it be Cisco-3550-London-Building2 with a System ID of 0c:07:08:de:ab:45? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will only tell you for sure if it is one switch as if the Names or IDs differ then it could be 2 or 3 or 50 hops in between. It also depends on the network to have CDP or LLDP compatible switches and for it to be enabled on the host ports.&lt;/p&gt;&#xA;" OwnerUserId="13792" LastEditorUserId="13792" LastEditDate="2015-03-20T22:50:34.083" LastActivityDate="2015-03-20T22:50:34.083" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17411" PostTypeId="1" AcceptedAnswerId="17421" CreationDate="2015-03-21T00:18:49.443" Score="2" ViewCount="253" Body="&lt;p&gt;In a given setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                  -&amp;gt; device 1&#xA;modem -&amp;gt; router -|&#xA;                  -&amp;gt; device 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Device 1 is wired and Device 2 is wireless.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does modem know the MAC addresses of devices 1 &amp;amp; 2?&lt;/li&gt;&#xA;&lt;li&gt;Does modem know the IP addresses of devices?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;I am a beginning networking student.&lt;/p&gt;&#xA;" OwnerUserId="14489" LastEditorUserId="775" LastEditDate="2015-03-21T12:37:13.603" LastActivityDate="2023-03-20T21:01:42.350" Title="What does a modem actually know?" Tags="|mac-address|docsis|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17414" PostTypeId="2" ParentId="17405" CreationDate="2015-03-21T03:52:17.823" Score="1" Body="&lt;p&gt;Throwing in different ideas:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If there is no need for the clients behind each access point to get an IP address from different subnets, you can have the ports connected to the APs to be in different VLANs.&lt;/li&gt;&#xA;&lt;li&gt;If all you have is three different subnets, you can consider one other option of having three different SSIDs for the three subnets.&lt;/li&gt;&#xA;&lt;li&gt;If you have access to more APs, you can have 3 APs each one dedicated for each subnet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="14490" LastActivityDate="2015-03-21T03:52:17.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17416" PostTypeId="2" ParentId="10410" CreationDate="2015-03-21T04:07:52.253" Score="0" Body="&lt;p&gt;When you are upgrading your switch, you need to understand your current usage, ask more questions, collect more data.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How many users are there in your network? [Mac table size]&lt;/li&gt;&#xA;&lt;li&gt;Are you planning to expand your network in the future? [Do you need a topology where you can accommodate FEXs] &lt;/li&gt;&#xA;&lt;li&gt;What is your network topology? [9K switch is deployed in the core]&lt;/li&gt;&#xA;&lt;li&gt;Do you just need 10G connectivity between your IT servers? [If all you have is few servers, you can buy an less expensive box]&lt;/li&gt;&#xA;&lt;li&gt;Do you have Servers running VMs?&lt;/li&gt;&#xA;&lt;li&gt;How much of High Availability is needed in your environment? Are you running banking servers behind these boxes?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Because I had worked in N7K software development team, I have an idea how these boxes are deployed by different customers.&lt;/p&gt;&#xA;" OwnerUserId="14490" LastActivityDate="2015-03-21T04:07:52.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17418" PostTypeId="2" ParentId="17362" CreationDate="2015-03-21T04:18:40.883" Score="-1" Body="&lt;p&gt;Not sure why you would want to ignore the upstream DHCP server? Can't you disable the switch's DHCP and use only the upstream? You just want the downstream clients to get the IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did you try static routing between the two VLANs? You don't need to enable routing.&lt;/p&gt;&#xA;" OwnerUserId="14490" LastActivityDate="2015-03-21T04:18:40.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17420" PostTypeId="2" ParentId="17411" CreationDate="2015-03-21T05:04:54.053" Score="2" Body="&lt;p&gt;The subnet and any broadcast domain will end at the router, and the modem and any device upstream will not see any MAC addresses from device 1 or 2. It will only see a MAC address for the router. MAC addresses are used at layer 2, and only known inside a given broadcast domain. There are exceptions, such as proxy-arp, but under normal circumstances the router will be segmenting broadcast domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://study-ccna.com/collision-broadcast-domain&quot; rel=&quot;nofollow&quot;&gt;http://study-ccna.com/collision-broadcast-domain&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the IP address, the modem is more of a &quot;Layer 2 bridge&quot; so if it has any awareness of a route to those devices IPs, it would be purely for management. Not a matter of function.&lt;/p&gt;&#xA;" OwnerUserId="14479" LastEditorUserId="14479" LastEditDate="2015-03-21T18:48:08.367" LastActivityDate="2015-03-21T18:48:08.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17421" PostTypeId="2" ParentId="17411" CreationDate="2015-03-21T08:47:10.273" Score="2" Body="&lt;p&gt;Q1: The &lt;strong&gt;modem does not see the MAC addresses&lt;/strong&gt; of the devices connected to the router. When a packet is routed from a device to the modem, the router will create a new ethernet frame to forward the packet to the modem, using its own MAC as the source address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2: If the router is doing &lt;strong&gt;only routing&lt;/strong&gt;, the &lt;strong&gt;modem will see the IP addresses&lt;/strong&gt; of the devices since source and destination IP addresses in the packet remain unchanged. But if your router is performing &lt;strong&gt;network address translation&lt;/strong&gt; (NAT), it will replace the source IP address on the outgoing packets to the router with a different address, &lt;strong&gt;hiding the IP addresses&lt;/strong&gt; of the devices (the original source addresses) from the modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that the modem can see IP addresses does not mean it looks at them or uses them in any way, that depends on the type of modem and what other features are in the device called a modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be sure on Q2, you would have to look at the specs of your modem and router and possibly check their configuration or default behaviour.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-03-21T08:47:10.273" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17423" PostTypeId="1" AcceptedAnswerId="17428" CreationDate="2015-03-21T13:32:28.750" Score="0" ViewCount="838" Body="&lt;p&gt;When making a phone-call these day - the datastream is divided into packages, isnt it? But which protocol-stack is used then? VOIP is using tcp-ip but but what about cell-phones? For instance - the header of a package in a certain layer should use the phonenumber to route the package to the right destination?&lt;/p&gt;&#xA;" OwnerUserId="14425" LastActivityDate="2015-03-22T07:45:49.187" Title="Cell-phones and protocol-stack" Tags="|tcp|voip|telephony|" AnswerCount="1" CommentCount="0" ClosedDate="2015-03-24T01:32:08.493" ContentLicense="CC BY-SA 3.0" />
  <row Id="17426" PostTypeId="1" CreationDate="2015-03-22T04:56:07.090" Score="10" ViewCount="16445" Body="&lt;p&gt;PPTP, L2TP, PPPOE - these are tunneling protocols. And they are Data link Layer protocols. Why?&#xA;As I understood, Layer2 protocols work only in same subnet. They don't use IP addresses and cannot be routed. They operate only with MAC addresses. &#xA;These Layer2 members: LACP, WOL, CDP, Trunk/VLAN don't use IP addresses! Ofcource some of them could be routed using some broadcasting technologies. However, PPTP, PPPOE and L2TP protocols use IP addresses. Moreover, they use TCP ports, higher OSI layer. Why?&lt;/p&gt;&#xA;" OwnerUserId="14498" LastActivityDate="2022-04-30T15:44:57.487" Title="Why PPTP, L2TP, PPPOE are in OSI Layer2?" Tags="|layer2|pppoe|osi|l2tp|ppp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17427" PostTypeId="2" ParentId="17426" CreationDate="2015-03-22T07:12:13.000" Score="6" Body="&lt;p&gt;Note that layer three and above protocols can be encapsulated inside the protocols you mention but not layer two (or below). One way to look at it is that you build a protocol stack from the bottom up. So first we put down layers 1, 2, and 3. Then for layer 4 we put PPTP (for example) and that starts a NEW layer 2 on top of (inside of) the &quot;real&quot; layers 1, 2, and 3. Then you can put yet another layer 3 on top of the new PPTP layer two and go on up from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's not exactly what's going on but remember that the OSI model is only a MODEL. And technically the OSI model was meant to be used with OSI protocols, which most commonly used protocols are not. As a way to understand networking in general, the OSI model helps a lot, even with non-OSI protocols, which is why it is used by so many networking professionals in many areas. But again, it's only a model, so it helps us get a grip on what's happening but it does not rigidly define what is happening, nor does it 100% reflect what is happening.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-03-22T07:12:13.000" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17428" PostTypeId="2" ParentId="17423" CreationDate="2015-03-22T07:45:49.187" Score="3" Body="&lt;p&gt;(Assuming North America as our venue) The voice part of a mobile connection, like non-mobile ISDN voice network, has been circuit switched up until LTE. LTE is only packet switched, so either Voice over LTE is used (sort of like VoIP) or voice is sent circuit switched separately from the packet switched data. It turns out that right now, that for most networks, the phone falls back to 2G/3G service when there is a voice call in progress, due to the difficulties in rolling out VoLTE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/LTE_(telecommunication)&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/LTE_(telecommunication)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like voice traffic is modeled in three layers: Physical, Media Access Control, and the &quot;call-processing state machine&quot; (which seems to be more like a layer 7 application than anything else from the OSI model). Layer 3 turns analog audio from the microphone into a digital stream, Layer 2 creates frames that combine the voice data with internet data and signaling. And layer 1, which carries the layer 2 frames of course, is where the fancy radio frequency modulation goes on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/IS-95&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/IS-95&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to be blown away by what are essentially mathematical tricks used more and more in signaling over the last 20 - 30 years, delve into layer 1 for both mobile communications and high-speed internet starting with DSL. QPSK and QAM alone are really fascinating.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-03-22T07:45:49.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17429" PostTypeId="2" ParentId="10410" CreationDate="2015-03-22T08:25:46.027" Score="0" Body="&lt;p&gt;We ended up actually getting 2x9508, each with 2 36-port 40GbE line-cards. With breakouts, this gives us 144 * 4 10GbE ports. Ought to be enough for a while :-)&lt;/p&gt;&#xA;" OwnerUserId="7647" LastActivityDate="2015-03-22T08:25:46.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17430" PostTypeId="1" CreationDate="2015-03-22T09:56:47.440" Score="4" ViewCount="543" Body="&lt;p&gt;I'm trying to learn more about MPLS-TE, specifically how packets are routed once the TE LSP is set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the examples I could find that include the MPLS label stack shown are examples for Fast Reroute, e.g. link/node protection. For example, if we have Router A -&gt; Router B with the label 10 being pushed to get the packet from A -&gt; B, with the protection LSP being A -&gt; C -&gt; B, when the A -&gt; B link fails, we have another label, say 20, pushed on top of the label 10, so that traffic now goes through the protected LSP A -&gt; C -&gt; B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do all TE routes work this way? Does the original LSP path (w/o TE) have to be only one hop away? This is the part that confuses me - if it's multiple hops away, how would the head-end know which label to push to get to the tail-end after the packet exits the TE LSP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if my original LSP is A -&gt; B -&gt; C -&gt; D -&gt; E, and I have TE LSPs B -&gt; F -&gt; D and B -&gt; G -&gt; D, how would B know to push which LSP label onto the packet before it enters either TE LSPs so that when it gets to D, it can continue to E? There are 2 labels, the top one being the TE label, and the bottom one being the LSP label, right?&lt;/p&gt;&#xA;" OwnerUserId="8424" LastEditorUserId="775" LastEditDate="2015-03-22T16:14:46.097" LastActivityDate="2015-03-22T16:14:46.097" Title="MPLS-TE backup LSP protection behavior" Tags="|cisco|routing|mpls|mpls-te|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17433" PostTypeId="2" ParentId="17430" CreationDate="2015-03-22T16:11:26.987" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Do all TE routes work this way? Does the original LSP path (w/o TE) have to be only one hop away?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No the original LSP path can be multiple hops away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MPLS TE is a very complicated subject, and I can hardly do justice to the nuances in a reasonable-sized answer.  These are some of MPLS TE &lt;a href=&quot;http://en.wikipedia.org/wiki/MPLS_local_protection&quot; rel=&quot;noreferrer&quot;&gt;protection models&lt;/a&gt; for a primary LSP path along &lt;code&gt;A -&amp;gt; B -&amp;gt; C -&amp;gt; D -&amp;gt; E&lt;/code&gt;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; /------I-----\&#xA;/              \&#xA;A  --&amp;gt;  B  --&amp;gt;  C  --&amp;gt;  D  --&amp;gt;  E&#xA; \     /\                      /&#xA;  \-H-/  \----------J---------/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A-B &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/mpls/configuration/guide/15_0s/mp_15_0s_book/mp_link_node_prot.html#wp1064798&quot; rel=&quot;noreferrer&quot;&gt;Link protection model&lt;/a&gt;, as you described:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Option 1 (if A has a direct link to C): Backup LSP via &lt;code&gt;A -&amp;gt; C -&amp;gt; B&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Option 2: Backup LSP via &lt;code&gt;A -&amp;gt; H -&amp;gt; B&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;B-failure &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/mpls/configuration/guide/15_0s/mp_15_0s_book/mp_link_node_prot.html#wp1054037&quot; rel=&quot;noreferrer&quot;&gt;Node protection model&lt;/a&gt;: Backup LSP via &lt;code&gt;A -&amp;gt; I -&amp;gt; C&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/mpls/configuration/guide/15_0s/mp_15_0s_book/mp_te_path_prot.html&quot; rel=&quot;noreferrer&quot;&gt;Path Protection model&lt;/a&gt;: &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Primary TE LSP and Backup TE LSP share the same head and tail, but they must follow diverse physical paths&lt;/li&gt;&#xA;&lt;li&gt;Primary LSP: &lt;code&gt;B -&amp;gt; C -&amp;gt; D -&amp;gt; E&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Backup LSP: &lt;code&gt;B -&amp;gt; J -&amp;gt; E&lt;/code&gt; (both the primary and backup paths begin at B and end at E)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Please note that by default, MPLS TE tunnels are not advertised in the IGP, unless you configure a &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2s/feature/guide/fstefa_3.html&quot; rel=&quot;noreferrer&quot;&gt;Forwarding Adjacency&lt;/a&gt;, which allows OSPF or ISIS to treat the tunnels as a routed link (although IGP adjacencies still don't form over the tunnel).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For example, if my original LSP is A -&gt; B -&gt; C -&gt; D -&gt; E, and I have TE LSPs B -&gt; F -&gt; D and B -&gt; G -&gt; D, how would B know to push which LSP label onto the packet before it enters either TE LSPs so that when it gets to D, it can continue to E?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It sounds like you're asking about node protection.  This slide from Cisco Live 2011 BRKMPL-2104 does a good job explaining details of how labels are pushed.  See the picture, below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The normal MPLS TE LSP path is shown in yellow, R1 -&gt; R2 -&gt; R4 -&gt; R6 -&gt; R7, but R4 goes down.  The original MPLS TE LSP signaled for R4 to swap label 22 (from R2) with label 36 as the LSP forwards through R6 to R7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When R4 goes down, R2 (also called the PLR, point of local repair) now pushes two labels {25, 36} as it uses the green backup tunnel through R3.  Since R3 is the penultimate hop of the backup tunnel it received an &quot;implicit null&quot; (i.e send no label) from R6 when the backup path was set up. Therefore, R3 strips label 25 off, and label 36 is still sent to R6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yFhxW.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yFhxW.png&quot; alt=&quot;mpls te node protection&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-03-22T16:11:26.987" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17434" PostTypeId="2" ParentId="9759" CreationDate="2015-03-22T17:12:16.253" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The isolated loss of a probe packet (with or without an ICMP Packet Too Big message) is treated as an indication of an MTU limit, and not as a congestion indicator.  In this case alone, the Packetization Protocol is permitted to retransmit any missing data without adjusting the congestion window.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As those probe messages are reliable (entirely delivered) and large enough. It makes no sense to send arbitrary data?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Answer&lt;/strong&gt;: Real data are sent.&lt;/p&gt;&#xA;" OwnerUserId="14493" LastActivityDate="2015-03-22T17:12:16.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17435" PostTypeId="1" CreationDate="2015-03-22T19:57:07.197" Score="1" ViewCount="253" Body="&lt;p&gt;I have ordered an ASA5505 sec appliance for my business network. I am replacing my SonicWall due to VPN tunnels dropping and to match my managed ISP provider that uses ASA5505’s. We need highly secure network to meet HIPAA compliance. My question is, do I need to have a router in-line with the ASA5505 or can I use the ASA5505 as my interface to both my VP tunnels and public internet via my switches? &lt;/p&gt;&#xA;" OwnerUserId="14507" LastEditorUserId="267" LastEditDate="2015-03-23T10:52:45.703" LastActivityDate="2015-03-23T12:17:15.647" Title="ASA5505 Sec topology setup" Tags="|cisco-asa|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17436" PostTypeId="2" ParentId="17435" CreationDate="2015-03-22T21:13:17.017" Score="2" Body="&lt;p&gt;The ASA 5505 can do NAT &amp;amp; Extended ACL's in addition to the VPN functionality you desire. There is no reason that the 5505 couldn't replace a basic SOHO router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just keep in mind the 3 VLAN limitation on a Base license 5505.&lt;/p&gt;&#xA;" OwnerUserId="274" LastActivityDate="2015-03-22T21:13:17.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17437" PostTypeId="1" CreationDate="2015-03-23T00:20:21.707" Score="2" ViewCount="248" Body="&lt;p&gt;Dear all Communications Experts, I am wondering whether we can know the information of both incoming and outgoing route of a packet from/to a particular server or not? In other words, is there any way for me to know on which route (through which IP addresses, which Autonomous Systems did a packet traverse to reach to my PC) and vice-versa? Knowing that in order to know via which IP addresses a packet is sent from my PC to a server, I can run &quot;traceroute&quot;. However, what I also want to know is via which IP addresses did the server send the ACK to my PC.(As you also might know that the incoming and outgoing route not always symmetric, especially for those long-enough route).&lt;/p&gt;&#xA;" OwnerUserId="14512" LastActivityDate="2015-03-23T07:37:12.660" Title="Can a PC know information about the incoming and outgoing route of packet?" Tags="|traceroute|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17439" PostTypeId="1" AcceptedAnswerId="17440" CreationDate="2015-03-23T05:37:04.407" Score="19" ViewCount="9279" Body="&lt;p&gt;Suppose I have a network of 2 computers, each having a private network address of 192.168.1.101 and 192.106.1.102. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For my public ip address, it is 10.2.10.172.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I make a http request to google.com, my computer will send out a packet with source ip address of 192.168.1.101 to the router and the NAT will change it to 10.2.10.172. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, when google.com gets the request, and sends the reply back to 10.2.10.172, how does the router knows which computer to route to? (192.168.1.101 or 192.168.1.102). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking about port number at first but I think that we could be browsing on the same website at the same time so I have no idea how it works here.&lt;/p&gt;&#xA;" OwnerUserId="14515" LastEditorUserId="36720" LastEditDate="2018-01-28T14:56:46.847" LastActivityDate="2018-01-28T14:56:46.847" Title="How does the router know how to route the packets to my terminal?" Tags="|routing|nat|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17440" PostTypeId="2" ParentId="17439" CreationDate="2015-03-23T06:41:33.053" Score="12" Body="&lt;p&gt;&lt;b&gt;NAT&lt;/b&gt;&lt;br&gt;&#xA;If you are using static (one-to-one) &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_address_translation#Basic_NAT&quot; rel=&quot;noreferrer&quot;&gt;NAT&lt;/a&gt;, the router will assign the &lt;code&gt;11.2.10.172&lt;/code&gt; public IP to the first PC ( for example &lt;code&gt;192.168.1.101&lt;/code&gt; ) trying to reach google.com. In this case, the two PC will not be able to communicate with google.com at once, because the only available public IP is already distributed.&lt;br&gt;&#xA;The NAT table in the router:&lt;br&gt;&#xA;&lt;code&gt;11.2.10.172 -&amp;gt; 192.168.1.101&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;PAT&lt;/b&gt;&lt;br&gt;&#xA;In your case &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_address_translation#Port_address_translation&quot; rel=&quot;noreferrer&quot;&gt;PAT&lt;/a&gt; ( NAT overloading ) is the solution.&lt;br&gt;&#xA;With PAT, multiple addresses can be mapped to one private IP. When a device initiates a TCP/IP session, it generates a TCP or UDP source port number to uniquely identify the session. When the router receives this packet it uses that source port number to uniquely identify the translation.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Example&lt;/b&gt;&lt;br&gt;&#xA;PC1 (&lt;code&gt;192.168.1.101&lt;/code&gt;) makes an HTTP request to google.com (&lt;code&gt;64.233.161.1&lt;/code&gt;) with a random source port number (1444). PC1 will send a packet with &lt;code&gt;DA: 64.233.161.1:80 | SA: 192.168.1.101:1444&lt;/code&gt;. When the router receives this packet it inserts &lt;code&gt;11.2.10.172:1444 -&amp;gt; 192.168.1.101:1444&lt;/code&gt; to the NAT table then changes the L3 addressing of the packet to &lt;code&gt;DA: 64.233.161.1:80 | SA: 11.2.10.172:1444&lt;/code&gt; and forwards it to google.com.&lt;br&gt;&#xA;Google responds with &lt;code&gt;DA: 11.2.10.172:1444 | SA: 64.233.161.1:80&lt;/code&gt;. The router receives this packet and translates it to &lt;code&gt;DA: 192.168.1.101:1444 | SA: 64.233.161.1:80&lt;/code&gt; then forwards it to PC1.&lt;br&gt;&#xA;&lt;br&gt;&#xA;If PC2 (&lt;code&gt;192.168.1.102&lt;/code&gt;) sends a packet with the same source port number as PC1 did , the router simply increases the port number by 1. In that case the NAT table would look like this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;11.2.10.172:1444 -&amp;gt; 192.168.1.101:1444&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;11.2.10.172:1445 -&amp;gt; 192.168.1.102:1444&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope it helps a bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;UPDATE&lt;/b&gt;&lt;br&gt;&#xA;As @CraigConstantine noticed, &lt;code&gt;10.2.10.172&lt;/code&gt; is still in the &lt;a href=&quot;http://en.wikipedia.org/wiki/Private_network#Private_IPv4_address_spaces&quot; rel=&quot;noreferrer&quot;&gt;private address space&lt;/a&gt; so I have changed it to &lt;code&gt;11.2.10.172&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13520" LastEditorUserId="13520" LastEditDate="2015-03-24T05:37:55.480" LastActivityDate="2015-03-24T05:37:55.480" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="17441" PostTypeId="2" ParentId="17437" CreationDate="2015-03-23T07:37:12.660" Score="2" Body="&lt;p&gt;It is impossible to know the route for sure. You can try to guess the path with traceroute, but as you already noted, the return path may be asymmetric. The internet routing infrastructure is extremely dynamic. It cannot even be guaranteed that the same path will be taken from one packet to the next. Furthermore, with traceroute, devices can be configured not to respond to these probes so you also will frequently find blind spots with this tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way you can be sure is if you control or have configuration information for all the devices in the equation and are able to determine the paths based on configuration.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-03-23T07:37:12.660" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17442" PostTypeId="1" AcceptedAnswerId="17444" CreationDate="2015-03-23T10:33:51.970" Score="1" ViewCount="386" Body="&lt;p&gt;Suppose I have a 10 Gbps interface in a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does that mean the maximum amount of traffic I can send through the interface will be some combination of input/output rates up to 10 Gbps, or can I have up to 10 Gbps in each direction (input and output at 10G)?&lt;/p&gt;&#xA;" OwnerUserId="11938" LastEditorUserId="775" LastEditDate="2015-03-23T10:47:12.743" LastActivityDate="2015-03-23T10:47:12.743" Title="Is an interface's limit independent of input/output?" Tags="|router|throughput|interface|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17443" PostTypeId="2" ParentId="17442" CreationDate="2015-03-23T10:38:26.753" Score="3" Body="&lt;p&gt;If we assume 10G Ethernet which is full duplex, then yes, 10G and 10G out.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-23T10:38:26.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17444" PostTypeId="2" ParentId="17442" CreationDate="2015-03-23T10:43:42.320" Score="4" Body="&lt;p&gt;It depends™. Normally for a 10GBit/s interface it means 10GBit/s &lt;strong&gt;full-duplex&lt;/strong&gt;, meaning you can receive and send at 10GBit/s at the same time. Sometimes marketing gets in the way and you get stuff like &quot;This linecard does 260GBit/s&quot; just to realize (before buying it, hopefully) that they meant 130GBit/s in and 130Gbit/s out. But for a single interface it should always be full-duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said the practical maximum speed of the interface will depend on a whole bunch of factors, for example the speed of the backplane, oversubscription of the linecard (and utilisation of the other ports on the linecard), amount of packets (many small packets are much more &quot;expensive&quot; to handle than fewer, bigger packets with the same amount of GBit/s), etc.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2015-03-23T10:43:42.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17446" PostTypeId="2" ParentId="17435" CreationDate="2015-03-23T12:17:15.647" Score="1" Body="&lt;p&gt;The 5505 doesn't have any routing features beyond what the SonicWALL has (and vice versa), so if you need a router now, you'll almost certainly need a router with the 5505. At the same time, if you don't have a router now, you won't need to add one.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-03-23T12:17:15.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17448" PostTypeId="1" CreationDate="2015-03-23T14:10:31.257" Score="2" ViewCount="842" Body="&lt;p&gt;We have a ME-3600 we're seeing a strange issue with. The device has an SVI which is used within a full-mesh metro ethernet network. The SVI is used for management and is also the peering source for the routing protocols. For no (apparent) reason the SVI is going down, it is only tied to one interface and we are not seeing the physical interface going down. We've tried pinning the SVI to another interface to keep it up, which would keep the SVI up but we still would see all of the routing protocols bounce.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;problemchild uptime is 5 weeks, 2 days, 11 hours, 47 minutes&#xA;System returned to ROM by power-on&#xA;System restarted at 19:01:24 MST Fri Feb 13 2015&#xA;System image file is &quot;flash:/me360x-universalk9-mz.153-3.S1a/me360x-universalk9-mz.153-3.S1a.bin&quot;&#xA;Last reload reason: Reload Command&#xA;&#xA;License Level: AdvancedMetroIPAccess&#xA;License Type: Permanent&#xA;Next reload license Level: AdvancedMetroIPAccess&#xA;&#xA;cisco ME-3600X-24FS-M (PowerPC8572) processor (revision A0) with 983040K/65528K bytes of memory.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Relevant log messages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mar 19 20:51:32.090 MDT: %LDP-5-GR: GR session 10.255.10.63:0 (inst 93): completed graceful recovery&#xA;Mar 19 20:51:32.102 MDT: %LDP-5-GR: GR session 10.255.10.47:0 (inst 94): completed graceful recovery&#xA;Mar 19 20:51:32.102 MDT: %LDP-5-GR: GR session 10.255.10.50:0 (inst 95): completed graceful recovery&#xA;Mar 20 03:28:22.614 MDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan105, changed state to down&#xA;Mar 20 03:28:22.630 MDT: %OSPF-5-ADJCHG: Process 1, Nbr 10.255.0.17 on Vlan105 from 2WAY to DOWN, Neighbor Down: Interface down or detached&#xA;Mar 20 03:28:22.630 MDT: %OSPF-5-ADJCHG: Process 1, Nbr 10.255.0.33 on Vlan105 from FULL to DOWN, Neighbor Down: Interface down or detached&#xA;Mar 20 03:28:22.634 MDT: %OSPF-5-ADJCHG: Process 1, Nbr 10.255.0.49 on Vlan105 from FULL to DOWN, Neighbor Down: Interface down or detached&#xA;....continued....&#xA;Mar 20 03:28:50.091 MDT: %BGP_SESSION-5-ADJCHANGE: neighbor 10.255.0.2 VPNv4 Unicast topology base removed from session  BGP Notification sent&#xA;Mar 20 03:28:52.815 MDT: %LINEPROTO-5-UPDOWN: Line protocol on Interface Vlan105, changed state to up&#xA;Mar 20 03:28:57.611 MDT: %OSPF-5-ADJCHG: Process 1, Nbr 10.255.0.33 on Vlan105 from LOADING to FULL, Loading Done&#xA;Mar 20 03:28:57.875 MDT: %OSPF-5-ADJCHG: Process 1, Nbr 10.255.0.49 on Vlan105 from LOADING to FULL, Loading Done&#xA;Mar 20 03:29:08.727 MDT: %LDP-5-NBRCHG: LDP Neighbor 10.255.0.33:0 (1) is UP&#xA;Mar 20 03:29:08.727 MDT: %LDP-5-NBRCHG: LDP Neighbor 10.255.0.49:0 (2) is UP&#xA;Mar 20 03:29:08.727 MDT: %LDP-5-NBRCHG: LDP Neighbor 10.255.0.17:0 (3) is UP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interface Details:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;problemchild#sh vlan id 105&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;105  xxxxxxxxx                         active    Gi0/24&#xA;&#xA;&#xA;problemchild#sh run int gi0/24&#xA;interface GigabitEthernet0/24&#xA; description metroE circuit&#xA; switchport trunk allowed vlan 1,105,144,145,170&#xA; switchport mode trunk&#xA; mtu 1522&#xA; bandwidth 40000&#xA; service-policy output xxx-OUT&#xA;end&#xA;&#xA;problemchild#sh run int vl105&#xA;interface Vlan105&#xA; description EVC mgmt interface&#xA; mtu 1522&#xA; bandwidth 40000&#xA; ip address 10.15.0.22 255.255.254.0&#xA; ip ospf message-digest-key 1 md5 xxxx&#xA; ip ospf priority 0&#xA; ip ospf mtu-ignore&#xA; mpls ip&#xA;end&#xA;&#xA;problemchild#sh int gi0/24&#xA;GigabitEthernet0/24 is up, line protocol is up (connected)&#xA;  Hardware is Gigabit Ethernet, address is 24b6.5732.2098 (bia 24b6.5732.2098)&#xA;  Description: metroE circuit&#xA;  MTU 1522 bytes, BW 40000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 76/255, rxload 32/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not set&#xA;  Full-duplex, 1000Mb/s, media type is SX&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output 00:00:00, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 5w2d&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 1785964&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 5020000 bits/sec, 1398 packets/sec&#xA;  5 minute output rate 12010000 bits/sec, 2241 packets/sec&#xA;     1820442136 packets input, 922204069899 bytes, 0 no buffer&#xA;     Received 58765981 broadcasts (58764761 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 58764761 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     1422024326 packets output, 852355101625 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output policy-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;problemchild#sh policy-map int gi0/24&#xA; GigabitEthernet0/24&#xA;&#xA;  Service-policy output: xxx-OUT&#xA;&#xA;    Class-map: class-default (match-any)&#xA;      1402564353 packets, 839023628650 bytes&#xA;      5 minute offered rate 3498000 bps, drop rate 0000 bps&#xA;      Match: any&#xA;  Traffic Shaping&#xA;    Average Rate Traffic Shaping&#xA;    Shape 40000 (kbps)&#xA;      Output Queue:&#xA;        Default Queue-limit 49152 bytes&#xA;        Tail Packets Drop: 418017&#xA;        Tail Bytes Drop: 373661094&#xA;&#xA;      Service-policy : All_Agency_CBWFQ&#xA;&#xA;        Class-map: xxxx_Q1 (match-any)&#xA;          0 packets, 0 bytes&#xA;          5 minute offered rate 0000 bps, drop rate 0000 bps&#xA;          Match:  precedence 5&#xA;          Match:  dscp cs5 (40) 41  42  43  44  45  ef (46) 47&#xA;          police:&#xA;            cir 9950000 bps, bc 310937 bytes&#xA;            conform-action transmit&#xA;            exceed-action drop&#xA;          conform: 0 (packets) 0 (bytes)&#xA;          exceed: 0 (packets) 0 (bytes)&#xA;          conform: 0 bps, exceed: 0 bps&#xA;          Strict Priority&#xA;          Queue-limit 32000 bytes&#xA;          Queue-limit current-queue-depth 0 bytes&#xA;              Output Queue:&#xA;                Default Queue-limit 49152 bytes&#xA;                Tail Packets Drop: 0&#xA;                Tail Bytes Drop: 0&#xA;&#xA;        Class-map: xxxx_Q2 (match-any)&#xA;          0 packets, 0 bytes&#xA;          5 minute offered rate 0000 bps, drop rate 0000 bps&#xA;          Match:  precedence 4&#xA;          Match:  precedence 6&#xA;          Match:  precedence 7&#xA;          Match:  dscp cs4 (32) 33  af41 (34) 35  af42 (36) 37  af43 (38) 39&#xA;          Match:  dscp cs6 (48) 49  50  51  52  53  54  55&#xA;          Match:  dscp cs7 (56) 57  58  59  60  61  62  63&#xA;          Bandwidth 8950 (kbps)&#xA;          Queue-limit 32000 bytes&#xA;          Exp-weighted-constant 9&#xA;          Random_detect prec&#xA;          4 6 7         28000  32000  bytes 10&#xA;&#xA;&#xA;          Queue-limit current-queue-depth 0 bytes&#xA;              Output Queue:&#xA;                Default Queue-limit 49152 bytes&#xA;                Tail Packets Drop: 0&#xA;                Tail Bytes Drop: 0&#xA;&#xA;        Class-map: xxxx_Q3 (match-any)&#xA;          1022048 packets, 301438609 bytes&#xA;          5 minute offered rate 0000 bps, drop rate 0000 bps&#xA;          Match:  precedence 2&#xA;          Match:  precedence 3&#xA;          Match:  dscp cs2 (16) 17  af21 (18) 19  af22 (20) 21  af23 (22) 23&#xA;          Match:  dscp cs3 (24) 25  af31 (26) 27  af32 (28) 29  af33 (30) 31&#xA;          Bandwidth 8950 (kbps)&#xA;          Queue-limit 32000 bytes&#xA;          Exp-weighted-constant 9&#xA;          Random_detect prec&#xA;          2 3   28000  32000  bytes 10&#xA;&#xA;          Queue-limit current-queue-depth 0 bytes&#xA;              Output Queue:&#xA;                Default Queue-limit 49152 bytes&#xA;                Tail Packets Drop: 0&#xA;                Tail Bytes Drop: 0&#xA;&#xA;        Class-map: xxxx_Q4 (match-any)&#xA;          779962 packets, 76289466 bytes&#xA;          5 minute offered rate 0000 bps, drop rate 0000 bps&#xA;          Match:  precedence 0&#xA;          Match:  precedence 1&#xA;          Match:  dscp default (0) 1  2  3  4  5  6  7&#xA;          Match:  dscp cs1 (8) 9  af11 (10) 11  af12 (12) 13  af13 (14) 15&#xA;          Bandwidth 11950 (kbps)&#xA;          Queue-limit 64000 bytes&#xA;          Exp-weighted-constant 9&#xA;          Random_detect prec&#xA;          0 1   58000  64000  bytes 10&#xA;&#xA;          Queue-limit current-queue-depth 0 bytes&#xA;              Output Queue:&#xA;                Default Queue-limit 49152 bytes&#xA;                Tail Packets Drop: 0&#xA;                Tail Bytes Drop: 0&#xA;&#xA;        Class-map: class-default (match-any)&#xA;          1400762343 packets, 838645900575 bytes&#xA;          5 minute offered rate 3496000 bps, drop rate 0000 bps&#xA;          Match: any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1613" LastEditorUserId="1613" LastEditDate="2015-03-23T17:41:13.297" LastActivityDate="2015-08-22T01:24:46.057" Title="SVI on ME-3600 Going Down No Apparent Reason" Tags="|cisco|vlan|metro-ethernet|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17449" PostTypeId="1" CreationDate="2015-03-23T16:09:37.537" Score="3" ViewCount="2373" Body="&lt;p&gt;I'm looking for a particular AS-PATH regex that match the following case:&#xA;&quot;accept ONLY neighbour and it's direct peers&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e., my neighbour is AS 20, and has 101, 102 as direct peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the as-path &quot;20+ .?&quot; correctly matches the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20&#xA;20 101&#xA;20 102&#xA;20 20 20 101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it does not work if AS 101 is doing AS-prepending (i.e. 20 101 101 101).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to achieve that? (if I remember well, in Cisco IOS I can use the \1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&#xA;stefano&lt;/p&gt;&#xA;" OwnerUserId="1969" LastActivityDate="2015-05-29T08:36:12.083" Title="Junos AS-PATH regex" Tags="|bgp|juniper-junos|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17450" PostTypeId="1" CreationDate="2015-03-23T16:24:38.610" Score="1" ViewCount="220" Body="&lt;p&gt;I've recently helped my friend start his business and now he wants me to take control of the IT side of things, I graduated university recently so my experience isn't so great, I was wondering if you could take a look at my somewhat &quot;diagram&quot; and give me comments and question just to make sure I have thought of everything . . . as in after I've configured the router and switch to serve their basic functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;* UPDATED DIAGRAM *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/RE8kA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14524" LastEditorUserId="14524" LastEditDate="2015-03-26T14:19:47.253" LastActivityDate="2015-03-26T17:37:14.067" Title="New Small Business, New IT Engineer, Need help on design and hardware" Tags="|cisco|routing|switch|ethernet|internet|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17451" PostTypeId="2" ParentId="17450" CreationDate="2015-03-23T17:20:33.967" Score="1" Body="&lt;p&gt;Well, 172.160.0.0/26 isn't going to work - that's only 62 usable IPs. So what you're looking to do is create 5 VLANs? If you have a L3 switch, this will work fine and you can make each VLAN a /24. Is this what you're trying to accomplish? &lt;/p&gt;&#xA;" OwnerUserId="14525" LastActivityDate="2015-03-23T17:20:33.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17452" PostTypeId="2" ParentId="17450" CreationDate="2015-03-23T18:25:20.320" Score="1" Body="&lt;p&gt;This might not be what you're looking for, but I have comments on the diagram itself. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &quot;End Users&quot; (no apostrophe) might be better represented as five clouds, one for each VLAN &amp;amp; subnet.&lt;/li&gt;&#xA;&lt;li&gt;Since it's a diagram of network objects, it would be better to call the nodes at the bottom &quot;Workstations&quot; or &quot;Computers&quot; or &quot;End User Nodes&quot; since typically the word &quot;User&quot; refers to a person or a set of credentials, neither of which would be connected to a network.&lt;/li&gt;&#xA;&lt;li&gt;I would omit the patch panel entirely, unless you really want to reflect the premise wiring in which case I would add in a cloud (or something) of faceplates or drops between the patch panel and the workstations.&lt;/li&gt;&#xA;&lt;li&gt;The most confusing thing to me is the arrow to the &quot;Fiber Connected by SFP Module&quot; box. It looks like network traffic is being split off and sent one-way out to some other device. If that's meant to be a callout with details of the connection betweent the switch and the router, the arrow head should be pointing at the connection and not touching it. Another way to do that would be to change the line style or color for that connection and have a key in a corner indicating that the line style or color means fiber.&lt;/li&gt;&#xA;&lt;li&gt;You'll thank yourself later if you put as much detail as possible in there. What is the model number of the switch? The make and model of the router? The actual ISP? Maybe you removed those before posting for security. If not, adding them will make the diagram a lot more useful.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Not related to the diagram itself:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find the IP information confusing, like greyaxe90. A 26-bit subnet mask is two bits longer than 255.255.255.0. Did you mean 172.16.0.0/&lt;strong&gt;16&lt;/strong&gt; and then each of the other ranges would be 172.16.x.0/24? (A network address would not end with a 1 for the last octet with those subnet masks, BTW)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a lot of unanswered questions in what you have there. How is routing being done? What IP addresses are assigned to the router interfaces? What address(es) (if any) will be assigned to the switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more thought: Even though he's a friend, you should still do all the paperwork for your business relationship with him. Definitely make monthly invoices for your work, unless he will be issuing a 1099 (or W-2) for you at the end of year. If you're not a full employee (W-2), keep track of all the time you work and what you do, even the work you don't charge for (if any). You might want to write a contract just in case. Totally outside of the realm of this StackExchange but having been down that road I couldn't not write something about it.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-03-23T18:25:20.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17454" PostTypeId="1" AcceptedAnswerId="17458" CreationDate="2015-03-23T21:08:55.110" Score="5" ViewCount="1534" Body="&lt;p&gt;I'm planning to run BGP with my upstream provider and advertise our global IPv6 prefixes.  I'd like to use only link-local addresses between the ISP's router and my border router to make the border router &quot;invisible&quot; to the Internet and thereby reduce the attack surface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone else tried this?  Are there pitfalls I should be aware of?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="8499" LastEditDate="2022-10-08T00:41:29.177" LastActivityDate="2023-03-13T17:11:50.847" Title="IPv6 BGP peering via link-local addresses" Tags="|routing|ipv6|security|bgp-ipv6|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17455" PostTypeId="2" ParentId="17449" CreationDate="2015-03-23T21:54:42.963" Score="1" Body="&lt;p&gt;So, correct me if I'm wrong in interpreting your question, or if it doesn't make sense - I'll be happy to update my answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want to match on, your neighbor (AS20) whether AS20 does prepending or not, and ANY neighbor of AS20.  Your regex would need to be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20+ .*  ## Path of any length that begins with 1 or more occurrences of AS20.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To break it down:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20+     ## One or more occurrences of AS20.&#xA;.*      ## Any length AS_Path, of any AS number.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's what you had, you were close:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20+     ## One or more occurrences of AS20.&#xA;.?      ## Zero or one occurrences of any AS number (after the first statement).  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;.?&lt;/code&gt; was why you couldn't see if AS20's neighboring AS's were pre-pending.  &lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-03-23T21:54:42.963" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17457" PostTypeId="1" CreationDate="2015-03-24T02:16:14.893" Score="2" ViewCount="5504" Body="&lt;p&gt;I am having an issue where WiFi client on the main SSID can't not communicate with each other if they are wireless.  The CAN communicate with LAN resources. Just not Wifi client to Wifi client.  I know some router calls this AP Isolation.  But I can't find anything like that on the Sonicwall TZ-200.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, a laptop client on WIFI can't communicate a WIFI Printer.  BUT as soon as the SAME laptop client is wired in via ethernet it can communicate with the WIFI Printer.&lt;/p&gt;&#xA;" OwnerUserId="14535" LastActivityDate="2016-01-18T11:08:51.863" Title="Sonicwall TZ-200 Can't communicate with other WIFI client on the same SSID" Tags="|sonicwall|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17458" PostTypeId="2" ParentId="17454" CreationDate="2015-03-24T03:09:51.367" Score="3" Body="&lt;p&gt;I discussed this with some peers, and the consensus is that it won't work with BGP since BGP is not an interface-oriented routing protocol like the IGPs.  The IGPs are enabled on an interface so they know which interface has the peer's link-local address.  In fact, IGPs they use the link-local address to connect to a peer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP, on the other hand, is not enabled by interface; it is given a neighbor address.  BGP cannot tell which interface has the link-local neighbor address since all the IPv6 interfaces have the same link-local subnet (fe80::/10).  BGP connects via TCP (Layer-4) so it needs a distinct address with which to peer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without trying it, I can't tell, but it may be possible to set a static route to the peer's link-local address, but I seriously doubt an ISP would go to that effort for a non-standard configuration on a POP router that may have multiple WAN terminations from multiple customers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-03-24T03:09:51.367" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17460" PostTypeId="1" CreationDate="2015-03-24T04:15:12.717" Score="1" ViewCount="2156" Body="&lt;p&gt;If I know the public IP address of a network, I can talk to the router for that network.. But how would I specify to the router which device in the network I want to start talking to? What I'm asking is pretty much this: How does a router know which device to send a received packet to, if the sending device hasn't setup a connection with the receiving device..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that in the IP header of a packet resides the destination address, that is the public IP address. And when this packet is sent, it arrives at different networking devices on its journey, asking each if they contain the destination address, and if not the packet hops to another device until it finds the destination address. Once it reaches the device with the public IP address, it is forwarded to the router. Say this packet was meant for 192.168.0.7 on a device behind that router and say a connection hasn't been established prior to sending this packet, how does the router know to send the packet to 192.168.0.7? How and at which point is this specified?&lt;/p&gt;&#xA;" OwnerUserId="14250" LastEditorUserId="14250" LastEditDate="2015-03-24T12:14:42.390" LastActivityDate="2015-03-24T12:14:42.390" Title="How packets know which device on another lan to go to" Tags="|router|ipv4|" AnswerCount="1" CommentCount="1" ClosedDate="2015-03-24T11:29:39.047" ContentLicense="CC BY-SA 3.0" />
  <row Id="17461" PostTypeId="2" ParentId="17460" CreationDate="2015-03-24T05:16:18.713" Score="4" Body="&lt;p&gt;During the construction of a packet, your computer must first resolve any hostname used (eg, google.com) using the &lt;a href=&quot;http://en.wikipedia.org/wiki/Domain_Name_System&quot; rel=&quot;nofollow&quot;&gt;Domain Name System&lt;/a&gt;. Your computer will then have the destination IP address and you know know where to send the packet to, but do not know the route. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to determine this information, Every router maintains routing tables and one or more protocols are then used in order to determine the path of the packet. Typically, for small offices and homes, the protocol used is &lt;a href=&quot;http://en.wikipedia.org/wiki/Routing_Information_Protocol&quot; rel=&quot;nofollow&quot;&gt;RIPv2&lt;/a&gt;. For the most simple setups, there is only one route - the &lt;a href=&quot;http://en.wikipedia.org/wiki/Default_route&quot; rel=&quot;nofollow&quot;&gt;default route&lt;/a&gt; which will route traffic through the &lt;a href=&quot;http://en.wikipedia.org/wiki/Default_gateway&quot; rel=&quot;nofollow&quot;&gt;default gateway&lt;/a&gt; of your firewall/router. At this point, you then reach an  ISP router/cable modem. These will typically forward you via similar methods to a large router which use the &lt;a href=&quot;http://en.wikipedia.org/wiki/Border_Gateway_Protocol&quot; rel=&quot;nofollow&quot;&gt;BGP protocol&lt;/a&gt;. This is a much more complicated routing method in which large tables of routes are maintained which direct large public subnets assigned by companies like &lt;a href=&quot;http://en.wikipedia.org/wiki/American_Registry_for_Internet_Numbers&quot; rel=&quot;nofollow&quot;&gt;ARIN&lt;/a&gt; to designated routers. In the BGP protocol, these routes are updated by peers and expire and are refreshed periodically. For routing in between small and large scales (eg, within a large office or campus or an ISP, alternate protocols such as &lt;a href=&quot;http://en.wikipedia.org/wiki/Enhanced_Interior_Gateway_Routing_Protocol&quot; rel=&quot;nofollow&quot;&gt;EIGRP&lt;/a&gt; or &lt;a href=&quot;http://en.wikipedia.org/wiki/Open_Shortest_Path_First&quot; rel=&quot;nofollow&quot;&gt;OSPF&lt;/a&gt; may be used&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the packet leaves your router, the source address is changed to be your router's public IP address. Thus when the packet reaches it's destination, the receiving server simply responds back to your router's address. It is then up to your router to track and maintain &lt;a href=&quot;http://en.wikipedia.org/wiki/Stateful_firewall&quot; rel=&quot;nofollow&quot;&gt;stateful connections&lt;/a&gt; - that is which source IPaddress:port and destination IPaddress:port combinations were communicating with each other. The creation, lifespan and teardown of these connections are maintained by your router based on it's firewall rules, &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_address_translation&quot; rel=&quot;nofollow&quot;&gt;NAT policies&lt;/a&gt; and other firewall settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a lower level, network devices maintain ARP tables of which IP addresses should be sent to which MAC address connected to the device which maintains the table. So for example, with a home router, it knows to send the packet to the MAC address of your workstation or laptop and for all other traffic, it knows to send the packet to your cable modem or ISP router. To look up an address that has never before been seen, an &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_Resolution_Protocol#ARP_probe&quot; rel=&quot;nofollow&quot;&gt;ARP probe&lt;/a&gt; is broadcast and used to populate the table. This only tells each device it's next hop and ARP has no visibility to the next device (typically). (Eg, your workstation, will not know the MAC address of your Cable Modem/ISP Router. Only your router/WAP would.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-03-24T05:16:18.713" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="17463" PostTypeId="2" ParentId="17457" CreationDate="2015-03-24T06:02:55.060" Score="3" Body="&lt;p&gt;On SonicWALLS, in version 5.x (and 6 too, I imagine) this is known as &quot;Interface Trust&quot;. To adjust this setting, go to Network -&gt; Zones and check the box to &quot;Allow Interface Trust&quot; to resolve this issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will caution you however that if you are using the WLAN zone which has interface trust disabled by default, and you are using a SonicPoint with version 5.x you are doing it wrong. The wireless configuration of SonicPoints is extremely arduous and I cannot disrecommend this product enough. If you can return these, do. They are a major headache. I love their firewall, but hate their SonicPoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To properly configure them, the SonicPoints should be the only thing in the WLAN zone which should be on an untagged VLAN. You should then create another zone (with interface trust enabled). You then need to go to Network -&gt; Interfaces and click &quot;Add Interface&quot; and create an interface with a VLAN tag other than 1 with a parent interface of whatever the SonicPoint is plugged into and you need to select your newly created zone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, navigate to SonicPoint -&gt; Virtual Access Point and create a Virtual Access Point Group (VAP group) and then create a Virtual Access point. The Virtual Access Point (VAP) needs to be set to the same VLAN tag you used earlier. Then you need to edit the VAP Group and add the VAP to it. Finally, you are ready to go to SonicPoint -&gt; SonicPoints and edit the SonicPoint in the middle section. You then can assign the VAP group to the WAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also need to ensure that the WAP is either plugged directly into the SonicWALL or that you have a switch that supports VLAN tagging. If you go the switch route, you need to have the untagged VLAN assigned to the port you connect the WAP(s) to and tag or trunk each of the VLANs on the port on the switch using the same VLAN tag/number you used on the SonicWALL - otherwise you will run into issues. If you need to connect more than one WAP directly to the SonicWALL, you can use PortShield groups to have 2 ports on the same WLAN zone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do not do this, you will find weird issues like being unable to talk to the other computers on the network, but getting internet access or getting spotty internet access which will work great for awhile and then drop out all of the sudden inexplicably.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you should note that you will need to configure firewall rules between the zone you created and the LAN zone in order to talk to your wired printer and other devices on the LAN. You should also note that you will be unable to discover that printer automagically using Windows because the WAP is not on the same zone as the printer (no matter what you do) and that Bonjour (if you use a mac) will not discover properly unless you configure multicasting and adjust some other specialized settings in an advanced configuration page and configure mDNS in IP Helper. You may also need to make some special adjustments for IPv6. You can however specify the IP address manually to print to the printer.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-03-24T06:02:55.060" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17464" PostTypeId="2" ParentId="17439" CreationDate="2015-03-24T06:12:04.257" Score="6" Body="&lt;p&gt;Your router knows where to route traffic because it maintains a table of &lt;a href=&quot;http://en.wikipedia.org/wiki/Stateful_firewall&quot; rel=&quot;noreferrer&quot;&gt;stateful connections&lt;/a&gt; which are source IPaddress:port and destination IPaddress:port relationships. These are established based on your firewall rules, NAT policies, and a few other settings (like TCP and UDP timeout). There are 4 possible states: NEW, RELATED, ESTABLISHED and INVALID. Based on your firewall rules, your firewall determines what state a connection should be in. So typically, you can make NEW connections outbound by default, but only RELATED or ESTABLISHED connections are allowed inbound if you create a NAT or PAT rule and matching firewall policy to allow this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, either based on the rules you have configured (for the case of a NEW connection) or the existing connection table (for the case of an ESTABLISHED connection) a packet will be allowed or disallowed through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, an [ARP] table is maintained which helps to firewall to know what physical &lt;a href=&quot;http://en.wikipedia.org/wiki/MAC_address&quot; rel=&quot;noreferrer&quot;&gt;MAC address&lt;/a&gt; an IP address corresponds to.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-03-24T06:12:04.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17465" PostTypeId="1" AcceptedAnswerId="17468" CreationDate="2015-03-24T07:52:39.647" Score="1" ViewCount="318" Body="&lt;p&gt;What happens on a recieving device, when not all the fregments are recived? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last fragment has the &quot;more fragment&quot; flag set to 1, meaning there should be another fragment after. But somewhere along the way it was discarded and lost. What does the device do ? Does it descard all the fragments before that?&lt;/p&gt;&#xA;" OwnerUserId="13770" LastActivityDate="2015-03-24T14:11:51.363" Title="IP packet fragmentation - not all fragments recieved" Tags="|ipv4|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17466" PostTypeId="2" ParentId="17465" CreationDate="2015-03-24T08:27:28.440" Score="2" Body="&lt;p&gt;Yes, if a fragment cannot be reassembled it will be dropped after some time.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-03-24T08:27:28.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17467" PostTypeId="1" AcceptedAnswerId="17471" CreationDate="2015-03-24T11:23:45.223" Score="0" ViewCount="629" Body="&lt;p&gt;When I go in to the switching&gt;lag area of the netgear web portal, I get this&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ZJM9u.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it says that ports 22 23 and 24 are configured for the lag, but I only need ports 23 and 24. When I click to configure the lag it gives me this; &lt;img src=&quot;https://i.stack.imgur.com/aInGP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And it says that port 21 is configured, and none of the ones that are shown as being configured are actually selected. When I set it to how I want it to be, it makes no difference. Does anyone know how to solve this?&lt;/p&gt;&#xA;" OwnerUserId="13529" LastActivityDate="2015-04-23T21:09:16.113" Title="Problem when trying to set up lag on netgear switch" Tags="|switch|netgear-prosafe|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17468" PostTypeId="2" ParentId="17465" CreationDate="2015-03-24T14:11:51.363" Score="2" Body="&lt;p&gt;Depending upon the protocol used, the device that received the fragmented packet will either request a retransmission of the fragmented packet in its entirety (TCP) or will simply drop the packet (UDP) and not bother to continue assembling it.  What protocol are you using in this particular case?&lt;/p&gt;&#xA;" OwnerUserId="14542" LastActivityDate="2015-03-24T14:11:51.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17469" PostTypeId="1" AcceptedAnswerId="17479" CreationDate="2015-03-24T14:18:42.077" Score="3" ViewCount="806" Body="&lt;p&gt;I have some legacy Juniper routers.  One set has firewall rules written as such:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set firewall filter ....&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the other set has rules written as:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set firewall family inet...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the second one is specific to inet traffic, but other than that is there any different between the two?  If not, why have two different ways to write firewall rules on MX routers?&lt;/p&gt;&#xA;" OwnerUserId="11938" LastActivityDate="2015-03-24T17:59:34.147" Title="What is the differenence between set firewall filter and set firewall family" Tags="|firewall|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17471" PostTypeId="2" ParentId="17467" CreationDate="2015-03-24T14:33:32.323" Score="0" Body="&lt;p&gt;Looks like when you're going to your Lag Membership page, the page is calling your ch1 LAG.  It's bugs like these that make me less and less of a fan of Netgear equipment.  I'd give the switch a reboot and try again.  If you're still having issues, it could be completely GUI related.  Try the CLI if at all possible.&lt;/p&gt;&#xA;" OwnerUserId="14542" LastActivityDate="2015-03-24T14:33:32.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17472" PostTypeId="1" AcceptedAnswerId="17481" CreationDate="2015-03-24T14:33:53.467" Score="1" ViewCount="1013" Body="&lt;p&gt;Networking beginner here, trying to understand the output of the tcpdump tool using a captured router advertisement packet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -i wlp4s0 -nn -t -c1 -vvv -X -s0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Based on what I've found online, it seems that the router advertisement message is supposed to begin with the value 134 (0x86) as the first byte:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/dx9JJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the tcpdump output, I don't see 0x86 (134) anywhere at all. Here is the first line of the hex/ascii output obtained using the -X option:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x0000:  6000 0000 0068 3aff fe80 0000 0000 0000  `....h:.........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Shouldn't the first byte be equal to 0x86? Where do I begin looking for the data shown in the diagram?&lt;/p&gt;&#xA;" OwnerUserId="14543" LastEditorUserId="3075" LastEditDate="2015-03-24T20:10:23.037" LastActivityDate="2015-03-24T20:10:23.037" Title="router advertisement packet" Tags="|ipv6|packet-analysis|icmpv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17473" PostTypeId="2" ParentId="17448" CreationDate="2015-03-24T14:39:52.763" Score="1" Body="&lt;p&gt;I noticed that you've got exactly 30 seconds from the time the link goes down until it comes back up again.  OSPF Hellos are 30 seconds default on a non-broadcast link.  What's your hold timer set to?  &lt;/p&gt;&#xA;" OwnerUserId="14542" LastActivityDate="2015-03-24T14:39:52.763" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17475" PostTypeId="1" CreationDate="2015-03-24T16:08:45.070" Score="-1" ViewCount="106" Body="&lt;p&gt;I'm impressed on the amount of channels of a television satellite. &#xA;In Europe, for example, Hotbird 13 supply 1000+ television channel, Astra 19.2 and Astra 28 others 2000 or 3000 channels, some in HD. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is possible ? Why Satellite has so much bandwidth compared to a dvb-t transmission antenna ?&lt;/p&gt;&#xA;" OwnerUserId="4349" LastActivityDate="2015-03-24T16:59:51.300" Title="What is the bandwidth (in Gbps) of a today Tv telecommunication satellite?" Tags="|bandwidth|" AnswerCount="1" CommentCount="1" ClosedDate="2015-03-25T01:21:42.093" ContentLicense="CC BY-SA 3.0" />
  <row Id="17476" PostTypeId="1" CreationDate="2015-03-24T16:58:52.537" Score="0" ViewCount="3064" Body="&lt;p&gt;was wondering if there is a way for me to actually see which ip/hostname/ and/or mac address is connected to a certain port of a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;lets say I have a 50 port switch, and a cable is going bad and/or upload download speed is going slow&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;what is the best way to check if packets are being lost to a specific host&lt;/li&gt;&#xA;&lt;li&gt;if you can use a terminal from a linux machine to see which host or ip is      connected to a certain port on a switch (say port 8)&lt;/li&gt;&#xA;&lt;li&gt;if i were to go into conf t in a cisco switch, what would be the best command to display what hosts are connect to what port&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="14548" LastActivityDate="2015-03-24T18:07:34.100" Title="how can you see what ip/mac/hostname is connected to a switch port" Tags="|switch|cisco-ios|linux|packet-loss|" AnswerCount="1" CommentCount="2" ClosedDate="2015-03-25T01:10:43.357" ContentLicense="CC BY-SA 3.0" />
  <row Id="17477" PostTypeId="2" ParentId="17475" CreationDate="2015-03-24T16:59:51.300" Score="1" Body="&lt;p&gt;Not sure if this one goes in network engineering, but I'll take a shot. I was Navy comms for 7 years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SATCOM, along with utilizing different spectrums for different purposes (UHF, SHF, EHF) also have different transmission and band usage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the most direct answer, SATCOM uses either TDMA (Time Division Multiple Access) or FDMA (Frequency Division Multiple Access).  This allows individual &quot;channels&quot; that you would receive at a cable box to fit into their own particular piece of the SATCOM link pie.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TDMA allows for more versatility because more individual channels can be added within the aggregate and are timed in their transmission unlike FDMA where each has their own dedicated piece of the aggregate link.&lt;/p&gt;&#xA;" OwnerUserId="14542" LastActivityDate="2015-03-24T16:59:51.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17478" PostTypeId="2" ParentId="17476" CreationDate="2015-03-24T17:11:22.500" Score="1" Body="&lt;p&gt;To check packet loss the show interface command contains a lot of information regarding errors, CRC's, and other useful information to check if any errors have occurred on the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a Linux machine arp will output a list of Ethernet address their associated IP's and which interface they are on. If the switch is not a Linux device but a separate managed switch, I would suggest just remoting into the device and listing said devices mac address table&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mac table would show you all the attached devices (assuming they have sent at least one packet)&#xA;the do command will allow you to do enabled commands from conf t&#xA;ex: &quot;do show mac address-table&quot;&#xA;If you are looking for a specific mac address you can pipe to include&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ex: &quot;do show mac address-table | include xxxx.xxxx.xxxx &quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;here xxxx.xxxx.xxxx is your desired mac address,&#xA;Example output &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Vlan    Mac Address       Type        Ports&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;----    -----------       --------    -----&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;900    0022.90b9.xxxx    DYNAMIC     Gi0/2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In this case the cevice with the mac address 0022.90b9.xxxx is on the interface Gigabit 0/2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to check whats connected on a specific interface pipe through to include just that interface &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ex: &quot;do show mac address-table | include Gi0/1&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4946" LastEditorUserId="4946" LastEditDate="2015-03-24T18:07:34.100" LastActivityDate="2015-03-24T18:07:34.100" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17479" PostTypeId="2" ParentId="17469" CreationDate="2015-03-24T17:23:44.610" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I know the second one is specific to net traffic, but other than that is there any difference between the two?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jhead@R1# set firewall ?&#xA;Possible completions:&#xA;&amp;gt; filter               Define an IPv4 firewall filter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Contains IPv4 (protocol family inet).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jhead@R1# set firewall family ?&#xA;Possible completions:&#xA;&amp;gt; inet                 Protocol family IPv4 for firewall filter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also contains IPv4 (protocol family inet).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If not, why have two different ways to write firewall rules on MX routers?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Older version of JUNOS used to only have &lt;code&gt;&quot;set firewall filter&quot;&lt;/code&gt;, and the newer versions contain &lt;code&gt;&quot;set firewall family&quot;&lt;/code&gt; as well.  So it was decided that it should stay for those who don't need to specify a family other than IPv4 (inet). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does seem a bit backwards, but if you're not already, I would advise sticking to one style just to keep configuration as clear as possible.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2015-03-24T17:59:34.147" LastActivityDate="2015-03-24T17:59:34.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17481" PostTypeId="2" ParentId="17472" CreationDate="2015-03-24T19:28:18.913" Score="4" Body="&lt;p&gt;From the tcpdump manual page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-X     When parsing and printing, in addition to printing the headers of each packet, print the data of each packet (minus its link level header).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So you're looking at the IPv6 header, which starts with 6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The header is 40 bytes long, so in your example you see only a portion of the IPv6 header and nothing of the payload. But it is enough to tell that there are no extension headers as the Next Header field (7th byte) is 0x3a = 58, which indicates ICMPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ICMPv6 header is 8 bytes long, so if you want to see the raw RA data, then you need to display a few lines more (the RA will be from byte 0x0030 onwards).&lt;/p&gt;&#xA;" OwnerUserId="7756" LastActivityDate="2015-03-24T19:28:18.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17482" PostTypeId="1" CreationDate="2015-03-24T19:37:29.263" Score="4" ViewCount="1352" Body="&lt;p&gt;I have LAN that must not be on Internet. I have a lot of switches. How to make core switch 4500 series to be some kind of NTP server, and all other switches to adjust their time with this core? Goal would be to set manual time only on core, and all other switches to adjust time with the core.&#xA;Does anyone know syntax for core and access switches?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastActivityDate="2015-04-29T04:08:25.817" Title="Time synchronization on cisco switches" Tags="|cisco|ntp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17484" PostTypeId="1" CreationDate="2015-03-24T20:29:30.560" Score="3" ViewCount="344" Body="&lt;p&gt;Is there a way to detect and more importantly block a malicious client from running a dhcpd instance after authenticating to the wireless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a wlc but the APs are in L3 capwap mode with local routing. No tunnelling of the client traffic through the wlc. Reason is should the wan towards the remote site fail, the remote clients could still use the wireless network at their site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port-sec/source-guard/dai is implemented on the L2 switches access ports but the wireless trunks have been trusted as the wireless clients could not effectively roam between the access points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would really appreciate some help.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="775" LastEditDate="2015-03-27T16:34:48.533" LastActivityDate="2015-03-27T16:34:48.533" Title="Blocking rogue/malicious dhcpd servers connected via wireless" Tags="|cisco|wireless|rogue|mitm|dhcp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17485" PostTypeId="2" ParentId="17467" CreationDate="2015-03-24T20:40:59.157" Score="0" Body="&lt;p&gt;This probably has nothing to do with it, but what's up with Lag 1?  It has only one port, which makes for a pretty lonely aggregated link. I have found that the netgear web gui is often temperamental but usually trying to tell me something (I use a bunch of GS728s and similar). LAG has always worked for me on Netgear but I did run into an issue with port mirroring via the GUI almost exactly like this. Maybe try clearing all the ports out of both LAGs and setting up the ones you need from scratch?  Also, the firmware notes are often mentioning GUI fixes so if you aren't running the latest that should be a consideration. &lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-03-24T20:40:59.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17486" PostTypeId="2" ParentId="17484" CreationDate="2015-03-24T20:55:17.593" Score="2" Body="&lt;p&gt;One sure (but possibly not optimal/practical) way is to always have a faster dhcp service in place so that even if they try to offer DHCP responses, yours will get to the clients first and theirs will be ignored.  Without the wlc there aren't a lot of filtering options at your disposal. The &quot;right&quot; option would be to drop either DHCP-REQUEST outbound the AP WLAN, or DHCP-OFFER in on the AP WLAN (either would stop a wifi dhcp service from being useful but not stop normal dhcp client traffic) but I have never seen that done at that level.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-03-24T20:55:17.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17487" PostTypeId="1" AcceptedAnswerId="17648" CreationDate="2015-03-24T21:04:08.043" Score="1" ViewCount="165" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Monitor_mode&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt; states that &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Monitor mode is one of the six modes that 802.11 wireless cards can operate in.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I headed over to the &lt;a href=&quot;http://standards.ieee.org/about/get/802/802.11.html&quot; rel=&quot;nofollow&quot;&gt;IEEE&lt;/a&gt; site and downloaded the linked &lt;em&gt;IEEE 802.11™-2012&lt;/em&gt; document, but I cannot find the terms &lt;em&gt;Managed Mode&lt;/em&gt; or &lt;em&gt;Monitor Mode&lt;/em&gt; in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where are these modes described officially?&lt;/p&gt;&#xA;" OwnerUserId="14552" LastActivityDate="2016-03-28T05:58:04.790" Title="Where does the standard describe the modes WNICs can operate in?" Tags="|standardisation|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17490" PostTypeId="1" AcceptedAnswerId="17518" CreationDate="2015-03-25T02:33:13.593" Score="1" ViewCount="502" Body="&lt;p&gt;For router with route switch processor (RSP), if an IP address is configured for the RSP interface and the IP is pinged, is the ping forwarded to the main CPU (control plane)? Or the CPU of RSP will not forward to the main CPU and reply the ICMP itself?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="775" LastEditDate="2015-03-26T10:46:40.577" LastActivityDate="2015-03-26T10:46:40.577" Title="Does RSP forward ICMP ping to IP of its interface to CPU on control plane or not?" Tags="|cisco|packet-path|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17492" PostTypeId="1" AcceptedAnswerId="17495" CreationDate="2015-03-24T16:51:57.480" Score="4" ViewCount="4618" Body="&lt;p&gt;I have a Wireshark .pcap Capture of around 500k packets and I would like to enumerate a Network Diagram with all the Routers, Switches, PCs etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is Wireshark capable of such procedure or is there any other way that I could use to automatically generate one?&lt;/p&gt;&#xA;" OwnerUserId="14560" OwnerDisplayName="Jonathan Davies" LastEditorUserId="-1" LastEditDate="2015-03-25T06:04:09.670" LastActivityDate="2020-10-20T17:21:06.707" Title="Creating a Network Diagram with .pcap" Tags="|wireshark|pcap|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17493" PostTypeId="1" AcceptedAnswerId="17494" CreationDate="2015-03-25T08:10:15.143" Score="0" ViewCount="260" Body="&lt;p&gt;I have a newbie question on multicast delivery times.&#xA;In &lt;a href=&quot;https://www.usenix.org/legacy/events/osdi02/tech/full_papers/elson/elson.pdf&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; article on clock synchronisation they claim that the propagation time on a local network is close to zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the propagation time of multicast messages on a local ethernet network, wired or wireless?&lt;/p&gt;&#xA;" OwnerUserId="14558" LastEditorUserId="775" LastEditDate="2015-03-25T12:06:57.603" LastActivityDate="2015-03-25T12:06:57.603" Title="What factors affect propagation time for wired / wifi multicast messages?" Tags="|ethernet|multicast|lan|ieee-802.11|latency|" AnswerCount="1" CommentCount="6" ClosedDate="2015-03-27T04:31:46.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="17494" PostTypeId="2" ParentId="17493" CreationDate="2015-03-25T10:54:24.770" Score="1" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;What is the propagation time of multicast messages on a local network, wired or wireless?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&amp;quot;it depends, especially on wireless&amp;quot;, wired latency is normally in the low to mid-hundreds of microseconds range, depending on your specific switch hardware.  If there are any ethernet frames queued ahead of your traffic, latency increases based on the serialization time of those frames ahead of yours in the queue.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17493/propagation-time-for-multicast-messages?noredirect=1#comment25735_17493&quot;&gt;Mellson asked&lt;/a&gt; @MikePennington you say &amp;quot;It depends, especially on wireless&amp;quot; - I guess I am looking for something like that. It depends on what? I need to multicast because I am constructing a synchronisation algorithm and I want to eliminate the senders delay (something similar to the work presented in the article).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Wifi latency depends on:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Carrier_sense_multiple_access_with_collision_avoidance&quot; rel=&quot;nofollow noreferrer&quot;&gt;CSMA/CA&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;wifi channel &lt;a href=&quot;http://en.wikipedia.org/wiki/Bit_error_rate&quot; rel=&quot;nofollow noreferrer&quot;&gt;bit error rate&lt;/a&gt; (because the 802.11 data-link layer retransmits several times upon CRC errors, which effectively increases propagation time).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;In the face of high channel utilization and error rates, I have literally seen wifi ping round-trip times exceed &lt;em&gt;30 seconds&lt;/em&gt; to go to an AP 50 feet away.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17493/propagation-time-for-multicast-messages?noredirect=1#comment25734_17493&quot;&gt;Mellson asked&lt;/a&gt; I am mainly just trying to expand the claim from the mentioned article, which claims that the propagation time on a local network (wired and wireless) is close to zero. This to me seems like a bold claim, but I do not know where to look for evidence. I am trying to test this myself, but even if I time stamp incoming packets I have the problem of each machines clock not being in perfect sync. So it is really hard to test this claim myself. NTP and PTP does not provide a strong enough synchronisation to test the claim. Any ideas?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As for how to test propagation across any channel (wired / wifi): test equipment vendors &lt;a href=&quot;http://www.ixiacom.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ixia&lt;/a&gt;, &lt;a href=&quot;http://www.spirent.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Spirent&lt;/a&gt;, etc... all offer precision timestamping assuming you have a good clock reference for the test set.&lt;/p&gt;&#xA;&lt;p&gt;This equipment is expensive (and complicated).  Bottom line if you want precision, you will pay for it... fortunately, you can &lt;a href=&quot;https://www.microlease.com/us/ixia/&quot; rel=&quot;nofollow noreferrer&quot;&gt;lease this equipment&lt;/a&gt;.  I used to do this as part of my $dayjob, but it's been quite a while and I've lost touch with capabilities and model numbers.  Call Ixia or Spirent and tell them what you are trying to do; you'll get good guidance.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-03-25T11:05:20.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17495" PostTypeId="2" ParentId="17492" CreationDate="2015-03-25T12:15:47.963" Score="6" Body="&lt;p&gt;If you have captured the packets from a single point in the network, then the answer is &lt;strong&gt;no&lt;/strong&gt;.  You can tell which hosts are on your network, but there is no topology information that would tell you the route from A to B.  If you have some prior knowledge of the addressing scheme, you &lt;em&gt;might&lt;/em&gt; be able to infer subnets, but even that is doubtful.  Switches and other devices that operate at layer 2 would be invisible to you (except for the ones directly connected to you).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine you were at the post office sorting mail.  You can tell by looking at the addresses on the envelopes who is talking to whom, but you would have no idea how many hands it passed through to get to you, or how many more until it gets to the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are systems/applications that map networks, but they do so by probing for devices, examining routing/forwarding tables on them to discover new devices, then repeating that process until it finds (mostly) everything.  They don't capture network traffic.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-03-25T12:19:20.167" LastActivityDate="2015-03-25T12:19:20.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17498" PostTypeId="1" AcceptedAnswerId="26801" CreationDate="2015-03-25T15:18:10.980" Score="8" ViewCount="1379" Body="&lt;p&gt;We are operating several Cisco 2960S stacks here and, for some time, are experiencing regular Spanning Tree TCNs (Topology Change Notifications).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using &lt;em&gt;show spanning-tree detail&lt;/em&gt; to get to the source of the TCN, they originate from different 2960S stack members.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the config has been transferred from older switches, the ports are configured as trunks, with the data VLAN being the native VLAN and the VoIP VLANs being included as tagged in the trunk. I know, today the correct configuration would be &lt;em&gt;switchport mode access&lt;/em&gt; combined with &lt;em&gt;switchport voice vlan&lt;/em&gt; - but at the moment it is at it is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part of the problem was based on the fact that some ports were only configured as &lt;em&gt;portfast&lt;/em&gt;, not &lt;em&gt;portfast trunk&lt;/em&gt;, so this has to be fixed, as the &lt;em&gt;portfast&lt;/em&gt; only command is not applied to ports in trunk mode.&#xA;However, some ports are configured as &lt;em&gt;portfast trunk&lt;/em&gt;, which as of my understanding of Cisco documentation, should avoid generating TCNs on link changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sadly, they do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Executing &lt;em&gt;show spanning-tree interface Gi1/0/x portfast&lt;/em&gt; shows portfast enabled for all VLANs on that interface, but &lt;em&gt;show spanning-tree detail&lt;/em&gt; together with &lt;em&gt;show logging&lt;/em&gt; shows that these interfaces are indeed the source for the Spanning Tree changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is made sure that there are no &quot;special&quot; devices connected to those ports, just VoIP phones and desktop workstations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The version run is 12.2(55)SE3, the devices are 2960S-48LPS-L and 2960S-48FPS-L.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking for known bugs, there was a bug in a 12.1 release for 3550 switches that caused such behaviour, but this is the wrong device and a much older version, and I guess somebody should have experienced that bug before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea where to look, what to try?&lt;/p&gt;&#xA;" OwnerUserId="14263" LastActivityDate="2016-02-13T23:50:34.593" Title="Cisco 2960 Portfast ports generate Spanning Tree TCN" Tags="|cisco|spanning-tree|cisco-2960|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17499" PostTypeId="1" AcceptedAnswerId="17543" CreationDate="2015-03-25T16:01:37.007" Score="6" ViewCount="1702" Body="&lt;p&gt;I am trying to terminate an L2VPN on an MX480 but it's not working...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology: 7206 trunk vlanid 555 &gt; MX80&gt; MPLS CLOUD &gt; MX480.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7206 (192.168.254.2)  not pinging lt-interface on MX480 (192.168.254.1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MX480 config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE_MX80&amp;gt; show configuration routing-instances&#xA;L2VPN_LT {&#xA;    instance-type l2vpn;&#xA;    interface ge-1/0/9.555;&#xA;    route-distinguisher 172.16.16.7:555;&#xA;    vrf-target target:65000:555;&#xA;    protocols {&#xA;        l2vpn {&#xA;            encapsulation-type ethernet-vlan;&#xA;            interface ge-1/0/9.555;&#xA;            site TEST {&#xA;                site-identifier 101;&#xA;                interface ge-1/0/9.555 {&#xA;                    remote-site-id 100;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;&#xA;PE_MX80&amp;gt; show configuration interfaces ge-1/0/9.555&#xA;encapsulation vlan-ccc;&#xA;vlan-id 555;&#xA;&#xA;PE_MX80&amp;gt;&#xA;&#xA;&#xA;PE_MX80&amp;gt; show l2vpn connections instance L2VPN_LT&#xA;Layer-2 VPN connections:&#xA;&#xA;Legend for connection status (St)&#xA;EI -- encapsulation invalid      NC -- interface encapsulation not CCC/TCC/VPLS&#xA;EM -- encapsulation mismatch     WE -- interface and instance encaps not same&#xA;VC-Dn -- Virtual circuit down    NP -- interface hardware not present&#xA;CM -- control-word mismatch      -&amp;gt; -- only outbound connection is up&#xA;CN -- circuit not provisioned    &amp;lt;- -- only inbound connection is up&#xA;OR -- out of range               Up -- operational&#xA;OL -- no outgoing label          Dn -- down&#xA;LD -- local site signaled down   CF -- call admission control failure&#xA;RD -- remote site signaled down  SC -- local and remote site ID collision&#xA;LN -- local site not designated  LM -- local site ID not minimum designated&#xA;RN -- remote site not designated RM -- remote site ID not minimum designated&#xA;XX -- unknown connection status  IL -- no incoming label&#xA;MM -- MTU mismatch               MI -- Mesh-Group ID not available&#xA;BK -- Backup connection          ST -- Standby connection&#xA;PF -- Profile parse failure      PB -- Profile busy&#xA;RS -- remote site standby        SN -- Static Neighbor&#xA;LB -- Local site not best-site   RB -- Remote site not best-site&#xA;VM -- VLAN ID mismatch&#xA;&#xA;Legend for interface status&#xA;Up -- operational&#xA;Dn -- down&#xA;&#xA;Instance: L2VPN_LT&#xA;  Local site: TEST (101)&#xA;    connection-site           Type  St     Time last up          # Up trans&#xA;    100                       rmt   Up     Mar 25 16:38:52 2014           1&#xA;      Remote PE: 172.16.16.2, Negotiated control-word: Yes (Null)&#xA;      Incoming label: 800007, Outgoing label: 800022&#xA;      Local interface: ge-1/0/9.555, Status: Up, Encapsulation: VLAN&#xA;&#xA;PE_MX80&amp;gt;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;P_480&amp;gt; show configuration routing-instances L2VPN_LT &#xA;instance-type l2vpn;&#xA;interface lt-1/1/0.1;&#xA;route-distinguisher 172.16.16.2:555;&#xA;vrf-target target:65000:555;&#xA;protocols {&#xA;    l2vpn {&#xA;        encapsulation-type ethernet-vlan;&#xA;        interface lt-1/1/0.1;&#xA;        site TEST {&#xA;            site-identifier 100;&#xA;            interface lt-1/1/0.1 {&#xA;                remote-site-id 101;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;P_480&amp;gt; show configuration interfaces lt-1/1/0 &#xA;unit 1 {&#xA;    encapsulation vlan-ccc;&#xA;    vlan-id 555;&#xA;    peer-unit 2;&#xA;    family ccc;&#xA;}&#xA;unit 2 {&#xA;    encapsulation vlan;&#xA;    vlan-id 555;&#xA;    peer-unit 1;&#xA;    family inet {&#xA;        address 192.168.254.1/30;&#xA;    }&#xA;}&#xA;&#xA;&#xA;P_480&amp;gt; show configuration chassis &#xA;aggregated-devices {&#xA;    ethernet {&#xA;        device-count 5;&#xA;    }&#xA;}&#xA;fpc 1 {&#xA;    pic 1 {&#xA;        tunnel-services;&#xA;    }&#xA;    sampling-instance IPFIX_TEST;&#xA;}&#xA;network-services enhanced-ip;&#xA;&#xA;P_480&amp;gt; &#xA;P_480&amp;gt; show l2vpn connections instance L2VPN_LT &#xA;Layer-2 VPN connections:&#xA;&#xA;Legend for connection status (St)   &#xA;EI -- encapsulation invalid      NC -- interface encapsulation not CCC/TCC/VPLS&#xA;EM -- encapsulation mismatch     WE -- interface and instance encaps not same&#xA;VC-Dn -- Virtual circuit down    NP -- interface hardware not present &#xA;CM -- control-word mismatch      -&amp;gt; -- only outbound connection is up&#xA;CN -- circuit not provisioned    &amp;lt;- -- only inbound connection is up&#xA;OR -- out of range               Up -- operational&#xA;OL -- no outgoing label          Dn -- down                      &#xA;LD -- local site signaled down   CF -- call admission control failure      &#xA;RD -- remote site signaled down  SC -- local and remote site ID collision&#xA;LN -- local site not designated  LM -- local site ID not minimum designated&#xA;RN -- remote site not designated RM -- remote site ID not minimum designated&#xA;XX -- unknown connection status  IL -- no incoming label&#xA;MM -- MTU mismatch               MI -- Mesh-Group ID not available&#xA;BK -- Backup connection          ST -- Standby connection&#xA;PF -- Profile parse failure      PB -- Profile busy&#xA;RS -- remote site standby        SN -- Static Neighbor&#xA;LB -- Local site not best-site   RB -- Remote site not best-site&#xA;VM -- VLAN ID mismatch&#xA;&#xA;Legend for interface status &#xA;Up -- operational           &#xA;Dn -- down&#xA;&#xA;Instance: L2VPN_LT&#xA;  Local site: TEST (100)&#xA;    connection-site           Type  St     Time last up          # Up trans&#xA;    101                       rmt   Up     Mar 25 16:39:24 2015           1&#xA;      Remote PE: 172.16.16.7, Negotiated control-word: Yes (Null)&#xA;      Incoming label: 800022, Outgoing label: 800007&#xA;      Local interface: lt-1/1/0.1, Status: Up, Encapsulation: VLAN&#xA;&#xA;P_480&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;add info INF and BGP&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MX80_PE&amp;gt; show configuration protocols bgp&#xA;group MPLS-VPN {&#xA;    type internal;&#xA;    family inet {&#xA;        unicast;&#xA;    }&#xA;    family inet-vpn {&#xA;        unicast;&#xA;    }&#xA;    family l2vpn {&#xA;        signaling;&#xA;    }&#xA;    neighbor 172.16.16.6 {&#xA;        local-address 172.16.16.7;&#xA;        export NHS;&#xA;    }&#xA;    neighbor 172.16.16.2 {&#xA;        local-address 172.16.16.7;&#xA;        export NHS;&#xA;    }&#xA;}&#xA;&#xA;&#xA;&#xA;&#xA;MX480&amp;gt; show configuration protocols bgp group MPLS-VPN &#xA;type internal;&#xA;local-address 172.16.16.2;&#xA;family inet {&#xA;    unicast {&#xA;        rib-group AGGREGATE_TO_NAT_TABLE;&#xA;    }&#xA;    multicast;&#xA;}&#xA;family inet-vpn {&#xA;    unicast;&#xA;}&#xA;family l2vpn {&#xA;    signaling;&#xA;}&#xA;......................&#xA;neighbor 172.16.16.7 {&#xA;    description MX80_Mitishi;&#xA;    export EXPORT_TO_PE;&#xA;}&#xA;&#xA;&#xA;MX480&amp;gt; &#xA;&#xA;&#xA;interface:&#xA;&#xA;MX480&amp;gt; show configuration interfaces lt-1/1/0 &#xA;unit 1 {&#xA;    encapsulation vlan-ccc;&#xA;    vlan-id 555;&#xA;    peer-unit 2;&#xA;    family ccc;&#xA;}&#xA;unit 2 {&#xA;    encapsulation vlan;&#xA;    vlan-id 555;&#xA;    peer-unit 1;&#xA;    family inet {&#xA;        address 192.168.254.1/30;&#xA;    }&#xA;}&#xA;&#xA;=============================&#xA;&#xA;7206 interface facing to MX80&#xA;&#xA;interface GigabitEthernet0/1.555&#xA; description test l2vpn&#xA; encapsulation dot1Q 555&#xA; ip address 192.168.254.2 255.255.255.252&#xA; ip flow ingress&#xA; ip flow egress&#xA;&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14564" LastEditorUserId="14564" LastEditDate="2015-03-26T09:34:10.530" LastActivityDate="2015-03-27T18:14:45.563" Title="Terminating an L2VPN on JunOS router" Tags="|juniper-junos|mpls|juniper-mx|l2vpn|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17503" PostTypeId="1" AcceptedAnswerId="17649" CreationDate="2015-03-25T19:03:49.243" Score="2" ViewCount="321" Body="&lt;p&gt;I'd like to know if the distribution system allowing roaming between access points is considered as being a part of the ESS (extended service set).&lt;/p&gt;&#xA;" OwnerUserId="14568" LastEditorUserId="775" LastEditDate="2015-03-25T23:16:10.823" LastActivityDate="2015-04-02T23:52:57.130" Title="Wifi roaming terminology" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17504" PostTypeId="1" AcceptedAnswerId="17506" CreationDate="2015-03-25T19:45:56.297" Score="1" ViewCount="21483" Body="&lt;p&gt;I know that 192.168.0.0/16 are adresses reserved for private networks. What about 192.169.0.0/16 addresses and other.. in 192.0.0.0/8. Are they routable in the &quot;Internet&quot; or are they also private?&lt;/p&gt;&#xA;" OwnerUserId="14569" LastEditorUserId="775" LastEditDate="2015-03-25T20:24:46.907" LastActivityDate="2021-03-11T16:08:10.700" Title="Is a 192.169.0.0/16 a private address range?" Tags="|routing|ipv4|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17505" PostTypeId="2" ParentId="17504" CreationDate="2015-03-25T19:56:36.010" Score="1" Body="&lt;p&gt;192.168.0.0/16 is the only &lt;strong&gt;private&lt;/strong&gt; address space in 192.0.0.0/8. 192.0.0.0/24 is used by IANA, 192.0.2.0/24 is reserved for documentation and examples, and 192.88.99.0/24 is for 6to4 anycast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See:&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Reserved_IP_addresses&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Reserved_IP_addresses&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.arin.net/knowledge/address_filters.html&quot; rel=&quot;nofollow&quot;&gt;https://www.arin.net/knowledge/address_filters.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4889" LastEditorUserId="4889" LastEditDate="2015-03-25T20:06:12.443" LastActivityDate="2015-03-25T20:06:12.443" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17506" PostTypeId="2" ParentId="17504" CreationDate="2015-03-25T19:57:59.793" Score="10" Body="&lt;p&gt;These reserved IP-ranges for private networks are defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt;. 192.169.0.0/16 is not in them. You can verify using a WHOIS service that this /16 is divided into a number of smaller assignments to various networks.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-03-25T19:57:59.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17507" PostTypeId="2" ParentId="17504" CreationDate="2015-03-25T19:59:00.617" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;What about 192.169.0.0/16?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This is valid address space, and the addresses are routable, they are NOT private.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What about other addresses in 192.0.0.0/8?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You'd have to verify with WHOIS, some of the networks other than 192.168.0.0/16 within the 192.0.0.0/8 range are also private.&lt;/p&gt;&#xA;&lt;p&gt;You could check anything you like in the future from just about an Linux distribution command line via the WHOIS tool:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;whois 192.0.0.0/8&#xA;whois x.x.x.x/yy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Example of valid address space:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;NetRange:       192.0.0.0 - 192.255.255.255&#xA;CIDR:           192.0.0.0/8&#xA;NetName:        NET192&#xA;NetHandle:      NET-192-0-0-0-0&#xA;Parent:          ()&#xA;NetType:        Early Registrations, Maintained by ARIN&#xA;OriginAS:&#xA;Organization:   Various Registries (Maintained by ARIN) (VR-ARIN)&#xA;RegDate:        1993-05-01&#xA;Updated:        2010-06-30&#xA;Ref:            http://whois.arin.net/rest/net/NET-192-0-0-0-0&#xA;&#xA;OrgName:        Various Registries (Maintained by ARIN)&#xA;OrgId:          VR-ARIN&#xA;Address:        3635 Concord Parkway, Suite 200&#xA;City:           Chantilly&#xA;StateProv:      VA&#xA;PostalCode:     20151&#xA;Country:        US&#xA;RegDate:        1993-05-01&#xA;Updated:        2011-09-24&#xA;Comment:        Address space was assigned by the InterNIC regardless of&#xA;Comment:        geographic region.  The registrations are now being maintained&#xA;Comment:        by various registries, and the in-addr.arpa delegations are&#xA;Comment:        being maintained by ARIN.&#xA;Ref:            http://whois.arin.net/rest/org/VR-ARIN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Example of private address space:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Internet Assigned Numbers Authority PRIVATE-ADDRESS-CBLK-RFC1918-IANA-RESERVED (NET-192-168-0-0-1) 192.168.0.0 - 192.168.255.255&#xA;Various Registries (Maintained by ARIN) NET192 (NET-192-0-0-0-0) 192.0.0.0 - 192.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt; Section 3:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   The Internet Assigned Numbers Authority (IANA) has reserved the&#xA;   following three blocks of the IP address space for private internets:&#xA;&#xA;     10.0.0.0        -   10.255.255.255  (10/8 prefix)&#xA;     172.16.0.0      -   172.31.255.255  (172.16/12 prefix)&#xA;     192.168.0.0     -   192.168.255.255 (192.168/16 prefix)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-03-26T13:47:09.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17508" PostTypeId="2" ParentId="17504" CreationDate="2015-03-25T20:01:28.507" Score="6" Body="&lt;p&gt;No it isn't. See RFC6890 for all Special-Purpose IP Address Ranges (IPv4 and IPv6)&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="8499" LastEditDate="2021-03-11T16:08:10.700" LastActivityDate="2021-03-11T16:08:10.700" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="17518" PostTypeId="2" ParentId="17490" CreationDate="2015-03-26T05:31:38.823" Score="3" Body="&lt;p&gt;As Mike correctly states, it depends on the specific platform you're asking about.  On the 7500, VIP2/VIP4 cards will reply to ICMP packets locally on the VIP.  On non-VIP 7500 linecards, the ICMP will be forwarded to the RSP and processed there.&lt;br&gt;&#xA;The GSR (Cisco 12000) did all ICMP processing on the linecards, and to be really pedantic only had an &quot;RP&quot; (route processor) and not an RSP (route-switch processor).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the ASR 9000, ICMP was handled strictly on the linecards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have enough background on the 7600 to answer authoritatively, but the general answer is that any linecard that has its own CPU and runs its own instance of IOS/IOS-XR would handle ICMP locally on those linecard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should say here that to be super super accurate there were almost always some very unique or specific cases where you could force packets to be punted all the way to the main RSP (or RP) but on more recent platforms those cases are more and more rare.&lt;/p&gt;&#xA;" OwnerUserId="13955" LastActivityDate="2015-03-26T05:31:38.823" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17521" PostTypeId="1" AcceptedAnswerId="17523" CreationDate="2015-03-26T14:32:40.100" Score="4" ViewCount="8991" Body="&lt;p&gt;When researching something, I often try to come to my own conclusions based on the information I take in. I have tried to answer my own question but just want clarification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ports are needed so that traffic coming from different applications on different sources can simultaneously reach the same host. For example, http traffic on one port (port 80) and telnet traffic on another (port 23). And when there is more than one source of a particular type of traffic for one host, then a new port is created for that traffic that will only link to that host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right? Wrong?&lt;/p&gt;&#xA;" OwnerUserId="14250" LastActivityDate="2015-03-27T02:13:07.263" Title="Why are ports needed?" Tags="|router|internet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17523" PostTypeId="2" ParentId="17521" CreationDate="2015-03-26T15:21:30.773" Score="7" Body="&lt;p&gt;The simplest explanation is that ports identify what process on the host the received traffic should be sent to.  A computer can have multiple simultaneous connections, all receiving data for different processes (mail, web, database, etc) on that computer. How does the computer tell which data goes where?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the computer receives data, the port information allows it to give the data to the correct process.  For example, data with port 80 should go to the http process.  Data with port 25 should go to the mail process, and so on.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, the IP address identifies the computer host, and the port number specifies the particular process running on that host.  It's like a street address identifies a building, but the room number identifies a particular apartment or office.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-26T15:21:30.773" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="17524" PostTypeId="1" CreationDate="2015-03-26T15:41:51.017" Score="0" ViewCount="586" Body="&lt;p&gt;First post here.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In brief I have VLAN 1102 which is used as a multicast source VLAN.  This has an IP multicast boundary to only allow out multicasts to receivers in VLAN 1101.  The reason for doing this was to try and stop the flooding of multicast traffic in 1101 but this hasn't solved the issue and I'm trying to find out why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have had a quick look and cant really find what exactly the number of matches in the brackets means.  In the permit case, does the match number indicate the number IGMP requests allowed?  In the deny case, is it the number of multicast addresses blocked by the ACL?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the ACL.  Any help would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Standard IP access list IGMP1102  &#xA;    10 permit 235.0.0.32 (37414 matches)  &#xA;    20 permit 235.0.0.11 (9366 matches)  &#xA;    30 permit 235.0.0.10 (9470 matches)  &#xA;    40 permit 235.0.0.9 (16170 matches)  &#xA;    50 permit 235.0.0.8 (916206 matches)  &#xA;    60 permit 235.0.0.15 (9374 matches)  &#xA;    70 permit 235.0.0.14 (11422 matches)  &#xA;    80 permit 235.0.0.13 (15910 matches)  &#xA;    90 permit 235.0.0.12 (1674290 matches)  &#xA;    100 permit 235.0.0.3 (837286 matches)  &#xA;    110 permit 235.0.0.2 (1809784 matches)  &#xA;    120 permit 235.0.0.1 (9555 matches)  &#xA;    130 permit 235.0.0.7 (11983 matches)  &#xA;    140 permit 235.0.0.6 (9460 matches)  &#xA;    150 permit 235.0.0.5 (9422 matches)  &#xA;    160 permit 235.0.0.4 (835030 matches)  &#xA;    170 permit 235.0.0.27 (261335 matches)  &#xA;    180 permit 235.0.0.26 (11554 matches)  &#xA;    190 permit 235.0.0.25 (489305 matches)  &#xA;    200 permit 235.0.0.24 (840658 matches)  &#xA;    210 permit 235.0.0.31 (8 matches)  &#xA;    220 permit 235.0.0.30 (10 matches)  &#xA;    230 permit 235.0.0.29 (54430 matches)  &#xA;    240 permit 235.0.0.28 (114074 matches)  &#xA;    250 permit 235.0.0.19 (45032 matches)  &#xA;    260 permit 235.0.0.18 (842938 matches)  &#xA;    270 permit 235.0.0.17 (698826 matches)  &#xA;    280 permit 235.0.0.16 (935768 matches)  &#xA;    290 permit 235.0.0.23 (129761 matches)  &#xA;    300 permit 235.0.0.22 (115088 matches)  &#xA;    310 permit 235.0.0.21 (539982 matches)  &#xA;    320 permit 235.0.0.20 (431177 matches)  &#xA;    330 deny   any (2066969 matches)  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14588" LastEditorUserId="8499" LastEditDate="2017-08-11T14:54:22.520" LastActivityDate="2017-08-11T14:54:22.520" Title="ACLs - what does the number of matches mean?" Tags="|acl|multicast|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17525" PostTypeId="2" ParentId="17524" CreationDate="2015-03-26T15:48:14.350" Score="4" Body="&lt;p&gt;The number is the number of packets that matched the particular ACE (line).&#xA;So for example, there were 37,414 packets that matched line 10.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-03-26T15:48:14.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17526" PostTypeId="2" ParentId="17450" CreationDate="2015-03-26T17:37:14.067" Score="2" Body="&lt;p&gt;Your IP address range (172.16.0.0/24) is not big enough to include all the address ranges which you wish to use.  You will need, at least, 172.16.0.0/21 to encompass the listed ranges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your Cisco switch, layer-3 or not, doesn't do NAT which you seem to require.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are at all concerned about security, you need to include a firewall between you and the ISP.  Also, for layer-2 security, I would recommend you not use VLAN 1 (shut it down and manually prune it), or any native VLAN.  Start your VLAN numbers higher than 1, remove VLAN 1 from the allowed trunk VLANs, and do not define any other untagged VLAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-03-26T17:37:14.067" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17527" PostTypeId="1" CreationDate="2015-03-26T19:24:20.470" Score="4" ViewCount="1238" Body="&lt;p&gt;Made a diagram for a new network we are going to be laying out here.  I have never done this before, and i'm still fairly new to Cisco / Networking, so does anyone see any issues with the way I have it laid out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are moving to an ERP platform for all business operations soon, and it is a web driven app that we will be hosting, so performance for that is probably the most critical thing I am worried about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/eiksg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/N2a9H.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14318" LastEditorUserId="14318" LastEditDate="2015-03-27T15:45:35.207" LastActivityDate="2015-03-27T15:45:35.207" Title="Network Layout and Design" Tags="|cisco|design|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="17528" PostTypeId="2" ParentId="17527" CreationDate="2015-03-26T19:58:56.340" Score="4" Body="&lt;p&gt;You should remove the 3750G (not much flash size for future IOS upgrades) as your core and replace it with two 3750X (or better) stacked together. Also implement stack-power should one of the power supplies fail. Make the core your spanning-tree root if not already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of your distribution switches should directly dual-connect to the core 3750x stack to provide redundancy. Use etherchannels :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dual-connect your access switches to the two distribution switches (with etherchannels if you can), that way should one of the distribution switches fail and they do, the network will suffer from a very minimal outage while spanning tree recalculates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your servers connectivity could be improved by connecting them to a dedicated datacentre switch. Some of the Dell powerconnect switches are very popular and more affordable in some instances. They should also be in their own private vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't forget to add a good network UPS to your individual switches and servers, should power fail, you would have time to save your data and perform graceful shutdowns if required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are quite a few more suggestions to add to your design such as QoS for VoiP, etc , but I guess it is a starting point to provide redundancy and uptime to your clients :-)&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2015-03-26T19:58:56.340" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17531" PostTypeId="1" AcceptedAnswerId="17533" CreationDate="2015-03-26T22:40:18.660" Score="4" ViewCount="10466" Body="&lt;p&gt;Is there a way to get physical location of computer through MAC address?, I know switch's address and computer's mac address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All this on a LAN network&lt;/p&gt;&#xA;" OwnerUserId="14595" LastEditorUserId="33" LastEditDate="2015-06-25T18:17:57.847" LastActivityDate="2015-06-26T21:52:24.573" Title="Is there a way to get physical location of computer through MAC address?" Tags="|switch|mac-address|ip|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17532" PostTypeId="2" ParentId="17527" CreationDate="2015-03-26T22:41:40.637" Score="2" Body="&lt;p&gt;I would either eliminate VLAN 1 if you can, or let VLAN 1 just be for cisco and networking traffic and put all other traffic on other VLANs. Also I would make a VLAN just to be the native VLAN on trunks between switches or have no native VLAN on inter-switch links. And make a separate VLAN for servers and ideally one more for management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See: &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=2181837&amp;amp;seqNum=11&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscopress.com/articles/article.asp?p=2181837&amp;amp;seqNum=11&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4889" LastEditorUserId="4889" LastEditDate="2015-03-27T01:46:24.357" LastActivityDate="2015-03-27T01:46:24.357" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="17533" PostTypeId="2" ParentId="17531" CreationDate="2015-03-27T00:14:01.680" Score="6" Body="&lt;p&gt;No, there is not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC address are issued in blocks to network device builders and thats (usually) what you can infer from MAC addresses (who build the device), and thats all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP's on the other hand, can point to the &lt;strong&gt;general area&lt;/strong&gt; where a computer may be connected to the internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Blocks of IPs are sold to Internet Service Providers and you can infer from the ISP where the device is connected to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is something called a GeoIP database, that can correlate IP blocks (networks) to geografical locations. You might want to check with one.&lt;/p&gt;&#xA;" OwnerUserId="14596" LastEditorUserId="619" LastEditDate="2015-03-27T00:51:29.260" LastActivityDate="2015-03-27T00:51:29.260" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17534" PostTypeId="2" ParentId="14695" CreationDate="2015-03-27T00:35:07.923" Score="1" Body="&lt;p&gt;Definitely you need a route both on both ends (192.168.2.x AND 192.168.30.x) or a automated way to propagante routes between both ends of the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a textbook case of routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As both sides (192.168.30.x and 192.168.16.x) are connected directly, a route is automatically generated (on most operating systems that i know of) for routes directly accessible. But for routes that need to traverse another router (in other words, indirectly connected) you need to provide a route, either manually or via a routing protocol (RIP, OSPF whatever).&lt;/p&gt;&#xA;" OwnerUserId="14596" LastActivityDate="2015-03-27T00:35:07.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17535" PostTypeId="2" ParentId="17531" CreationDate="2015-03-27T00:49:35.103" Score="5" Body="&lt;p&gt;As in locate a random internet device given it's MAC? &lt;em&gt;Not a chance.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A MAC is a layer-2 address. Nothing beyond the local LAN (layer-2) segment knows, or &lt;em&gt;cares&lt;/em&gt;, what that address is. For example, you have no idea what the MAC is of my computer. And even if I told you, there's no way to locate it on the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Locating a single device within an enterprise network? The MAC can be found in switch tables localizing where it may be. Plugged into a specific port gives you a place to start &lt;em&gt;physically&lt;/em&gt; looking, but patches can snake a connection all over the place.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-27T00:49:35.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17536" PostTypeId="1" AcceptedAnswerId="17538" CreationDate="2015-03-27T01:35:33.347" Score="1" ViewCount="3217" Body="&lt;p&gt;The following command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping www.yesshou.com&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;gives the IP address of this website as 118.126.13.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, while I can access this website using the URL, I cannot access it using the IP address directly. Aren't they equivalent when accessing a website?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="14597" LastEditorUserId="8499" LastEditDate="2018-02-16T04:08:20.693" LastActivityDate="2018-02-16T04:08:20.693" Title="Can access website with URL but not IP" Tags="|ipv4|" AnswerCount="1" CommentCount="3" ClosedDate="2015-03-27T10:47:12.220" ContentLicense="CC BY-SA 3.0" />
  <row Id="17537" PostTypeId="2" ParentId="17521" CreationDate="2015-03-27T01:41:53.130" Score="1" Body="&lt;p&gt;The keyword here is socket.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A socket is one endpoint of a two-way communication link between two programs running on the network. A socket is bound to a port number so that the TCP layer can identify the application that data is destined to be sent to.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;On most operating systems, &lt;strong&gt;SOCKETS&lt;/strong&gt; are identified by a number, similar to a file descriptor, that index a single entry into a table containing information about a connection. This information is usually in the following format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SOURCEIP:SOURCEPORT DESTINATIONIP:DESTINATIONPORT PROTOCOL STATE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This table can be accessed, generally, via the NETSTAT command (or its equivalent) on most operating systems. In no event you can have two entries on such table with equal values (in other words: two entries with the exact same sourceip, sourceport, destinationip, destinationport and protocol at the same time). You can have two entries with same destination ports, source ports etc, any value, but never exact same values on two or more entries. And each entry is indexed (identified) by a single socket number. (There are exceptions to this rule)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This socket number is returned when you issue a SOCKET() function call. (on linux/freebsd/windows). Later, your program will decide what to do with the socket requested from the operating system. It can issue a CONNECT() call and connect this socket into a remote machine or a BIND() and LISTEN() calls to use it to wait for inbound connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that two processes CAN share a port, if they happen to share the SOCKET associated to the port. This is even a common way to do network programming. You can fork or spawn another process when your listening socket receives a connection request and you call ACCEPT() to accept it. ACCEPT() will return a socket number that will identify a new SOCKET created for that incomming connection, you will then pass the socketnum to the spawned/forked process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example on Windows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The WSADuplicateSocket function is introduced to enable socket sharing across processes. A source process calls WSADuplicateSocket to obtain a special WSAPROTOCOL_INFO structure for a target process identifier. It uses some interprocess communications (IPC) mechanism to pass the contents of this structure to a target process. The target process then uses the WSAPROTOCOL_INFO structure in a call to WSPSocket. The socket descriptor returned by this function will be an additional socket descriptor to an underlying socket which thus becomes shared. Sockets can be shared among threads in a given process without using the WSADuplicateSocket function because a socket descriptor is valid in all threads of a process.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In other words, ports are used to help identify &lt;strong&gt;SOCKETS&lt;/strong&gt; on a computer, which are single connections between TWO hosts on the network. This is true for both TCP and UDP protocols. They do not, usually, identify processes and most operating systems wont bother if two processes act on the same port. The keyword here is &lt;strong&gt;SOCKET&lt;/strong&gt;, not process. Sockets are the things that must be unique, because they identify a unique connection between two hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, answering your question. Why are ports needed ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because if there were no ports, the table i refered to in the start of the text would be limited to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SOURCEIP DESTINATIONIP PROTOCOL STATE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In other words, you could have only a single SOCKET for each host accessible to your computer, wich is not very usefull at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sources:&lt;br/&gt;&#xA;&lt;a href=&quot;https://docs.oracle.com/javase/tutorial/networking/sockets/definition.html&quot; rel=&quot;nofollow&quot;&gt;What Is a Socket?&lt;/a&gt;&lt;br/&gt;&#xA;&lt;a href=&quot;http://www.cs.rpi.edu/~moorthy/Courses/os98/Pgms/socket.html&quot; rel=&quot;nofollow&quot;&gt;Sockets Tutorial&lt;/a&gt;&lt;br/&gt;&#xA;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms740478%28v=vs.85%29.aspx&quot; rel=&quot;nofollow&quot;&gt;Shared Sockets&lt;/a&gt;&lt;br/&gt;&lt;/p&gt;&#xA;" OwnerUserId="14596" LastEditorUserId="14596" LastEditDate="2015-03-27T02:13:07.263" LastActivityDate="2015-03-27T02:13:07.263" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17538" PostTypeId="2" ParentId="17536" CreationDate="2015-03-27T01:55:41.220" Score="5" Body="&lt;p&gt;[&lt;code&gt;http://...&lt;/code&gt; is a URL, not a hostname (or address.) &lt;code&gt;ping&lt;/code&gt; should respond with &lt;code&gt;unknown host&lt;/code&gt;]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue you have is due to &lt;em&gt;virtual hosts&lt;/em&gt;. The http request will include a &lt;code&gt;Host: www.yesshou.com&lt;/code&gt; header telling the server which site you are requesting. If you use the IP address, the server doesn't know which of the sites (potentially hundreds) you wish to access.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-27T01:55:41.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17539" PostTypeId="1" CreationDate="2015-03-27T03:04:54.903" Score="3" ViewCount="295" Body="&lt;p&gt;I recently started using OpenNMS to monitor our LAN. I found this broadcast packets graph on several devices. I'm trying understand the consistency (shape) of these data. Most other graphs, for any type of data, rarely look this &quot;pretty&quot;, so this strikes me as atypical. My questions are: Does anyone recognize the pattern? What might be the source?&#xA;&lt;img src=&quot;https://i.stack.imgur.com/PIIJ2.png&quot; alt=&quot;graph&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14599" LastActivityDate="2015-04-26T17:39:54.543" Title="broadcast packets snmp graph shape" Tags="|snmp|broadcast|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17541" PostTypeId="2" ParentId="17539" CreationDate="2015-03-27T16:12:16.640" Score="1" Body="&lt;p&gt;It's all in the fuzzy math. The Y axis is packets per second, and the range is from 0 to 4 millipackets.  Since you either move a packet or you don't, millipackets is a useless measuring unit.  You are probably sampling every 5 minutes and that leaves 300 seconds for a packet to go or not go.  1 packet every 5 minutes is 1/300 or 0.0033.  Whats the max reading you saw?  3.3 millipackets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would bet that one broadcast packet is the arp traffic to find the host you are interrogating, and the diamond shape is a side effect of how the value is stored/averaged by OpenNMS and RRDtool.  It is intriguing that for some reason the two samples have an inverse relationship that inverts every 6 hours, but when you are dealing with tiny floats, artifacts are common.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastEditorUserId="6361" LastEditDate="2015-03-27T16:41:49.480" LastActivityDate="2015-03-27T16:41:49.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17542" PostTypeId="2" ParentId="17484" CreationDate="2015-03-27T16:34:08.143" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a way to detect and more importantly block a malicious client from running a dhcpd instance after authenticating to the wireless.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is not a perfect solution, but use the WLC to push an ACL to the AP's wireless radio interfaces; the ACL should block all traffic sourced from port udp/67.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't want to do this with an autonomous access point's BVI interface for all the obvious reasons.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-03-27T16:34:08.143" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17543" PostTypeId="2" ParentId="17499" CreationDate="2015-03-27T18:14:45.563" Score="3" Body="&lt;p&gt;Pretty sure you need to add &lt;code&gt;family ccc&lt;/code&gt; to the interface on the PE_MX80.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces ge-1/0/9 unit 555 family ccc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-03-27T18:14:45.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17547" PostTypeId="1" AcceptedAnswerId="18144" CreationDate="2015-03-27T21:00:56.053" Score="4" ViewCount="1748" Body="&lt;p&gt;Will the following work?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static 1.1.1.1 2.2.2.2 route-map x&#xA;ip nat inside source static 1.1.1.1 2.2.2.3 route-map x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(say the remote net is 20.20.20.0 in both cases)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm not sure about is if the reply to an access from outside can be translated properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client 20.20.20.1:1234 sends a packet to Server 2.2.2.2:5678 which internally becomes 1.1.1.1:5678.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Server 1.1.1.1:5678 then sends a reply packet to 20.20.20.1:1234.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does the router do with this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will it translate the reply's source address to 2.2.2.2 or 2.2.2.3?&#xA;From the above, at first sight both are possible.&#xA;Does it take the initial socket into account and reply using the address on which it was contacted in the first place?&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2015-04-27T20:39:18.443" Title="IOS NAT: Inside static NAT mapping one internal IP to multiple external ones" Tags="|nat|cisco-ios|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17548" PostTypeId="2" ParentId="17547" CreationDate="2015-03-27T21:16:36.417" Score="2" Body="&lt;p&gt;You are correct. The device will respond with a source address of the original request. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the client contacts 2.2.2.2, the reply will be from 2.2.2.2.  &lt;/li&gt;&#xA;&lt;li&gt;If the client contacts 2.2.2.3, the reply will be from 2.2.2.3.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="274" LastActivityDate="2015-03-27T21:16:36.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17549" PostTypeId="1" AcceptedAnswerId="17550" CreationDate="2015-03-27T23:02:24.337" Score="0" ViewCount="326" Body="&lt;p&gt;I'm looking for a better method to connect two PC directly using a cable (ethernet, USB, or something else). I want to do this, because this should improve the connection speed and the privacy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help.&lt;/p&gt;&#xA;" OwnerUserId="14641" LastActivityDate="2015-03-27T23:32:33.050" Title="Which is the better wired method to interconnect two PC directly?" Tags="|ethernet|" AnswerCount="1" CommentCount="2" ClosedDate="2015-03-31T01:59:23.140" ContentLicense="CC BY-SA 3.0" />
  <row Id="17550" PostTypeId="2" ParentId="17549" CreationDate="2015-03-27T23:32:33.050" Score="3" Body="&lt;p&gt;You need a crossover cable. Most network cards today can detect direct connection and automatically crossover the signals - Allowing the usage of a straight thru cable. But, if your computer is older, it might not work with a straight-thru cable so you will need a crossover cable. Building one is easy :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/O9X0U.gif&quot; alt=&quot;crossover cable&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14596" LastActivityDate="2015-03-27T23:32:33.050" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17553" PostTypeId="1" CreationDate="2015-03-28T04:12:56.603" Score="1" ViewCount="2005" Body="&lt;p&gt;Hey guys maybe you could help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have one main site is a clinic where we have a PACS server. So we have 3 more clinics around the country  with VPN to send  pictures to the server. Now we have  4 NSA 220  one in each site. The VPN is working  but  one of the sites is really slow. We have 1MB dedicated line in each site. In the main site we have 10MB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I want to apply some kind of Qos to the VPN to guarantee at least 50% of the bandwidth. however I dont know if this going to work because the topology in this clinic is like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                          Clinic Network  --------Switch                 &#xA;                                                    --&#xA;                                                    --&#xA;         PC with PACS Client-----Sonicwall------Internet router&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So they share the same exit to the internet with all the traffic in the clinic. The only traffic who  pass through the Sonicwall is the PACS traffic. So probably we have a bottleneck in the internet exit. But that network is beyond my control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So at least I need to try the Qos. But I don't how to Qos my VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea or suggestion?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="14378" LastActivityDate="2015-03-28T06:02:46.870" Title="QoS for site to site VPN" Tags="|vpn|qos|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17554" PostTypeId="2" ParentId="743" CreationDate="2015-03-28T05:30:18.073" Score="2" Body="&lt;p&gt;Western Digital did in the late 80's cards from Ireland and the USA occasionally used the same mac address, I know, as I had to debug a very weird issue which in the end came back to duplicate mac addresses on said cards&lt;/p&gt;&#xA;" OwnerUserId="14612" LastActivityDate="2015-03-28T05:30:18.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17555" PostTypeId="2" ParentId="17553" CreationDate="2015-03-28T06:02:46.870" Score="2" Body="&lt;p&gt;You need to create a Bandwidth Management Rule (BWM) Rule and apply it to a LAN &gt; VPN firewall rule or DMZ &gt; VPN if you have it in the DMZ. You can customize it for each individual site connection through source and destination or VPN connections as a whole.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BWM Rule should be set to advanced for this to work. If you need further help I recommend looking up implementing BWM on a Sonicwall, or just message me and I'll be glad to help more.&lt;/p&gt;&#xA;" OwnerUserId="14613" LastActivityDate="2015-03-28T06:02:46.870" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17560" PostTypeId="1" AcceptedAnswerId="17562" CreationDate="2015-03-28T19:14:38.417" Score="1" ViewCount="58" Body="&lt;p&gt;As you may know that due to the dynamic in Internet Infrastructure, the request packet and return packet are not guaranteed to be sent and came back on the same route, which is called asymmetric property of the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is that: Is it correct to conclude that shorter route will be less asymmetric than longer route? For instance, if 2 ends of a route are located in same Autonomous System, then it is quite sure that request and return packets will traverse over the same route (aka, symmetric route)&lt;/p&gt;&#xA;" OwnerUserId="14512" LastActivityDate="2015-03-28T19:48:46.800" Title="Will shorter route be less asymmetric than longer route?" Tags="|asymmetric-routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17561" PostTypeId="1" AcceptedAnswerId="17563" CreationDate="2015-03-28T19:46:13.843" Score="1" ViewCount="2997" Body="&lt;p&gt;I have configured EIGRP and STATIC protocols between two areas and both protocols at Area border router. unfortunately I'm unable to ping between two areas, the networks are configured correctly and the communication between networks within an area taking place easily,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have written the following commands &lt;strong&gt;as taught me&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router eigrp 99&#xA;redistribute static metric 10000 10 255 100 1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 255.255.255.255 124.29.242.38&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and yes the via route &lt;code&gt;124.29.242.38&lt;/code&gt; in static is correct and up. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yKJ2I.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The highlighted top most router is the area boundary router with EIGRP at right and STATIC at its left&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the &lt;code&gt;sh running-configuration&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh running-config &#xA;Building configuration...&#xA;&#xA;.&#xA;.&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 124.29.242.37 255.255.255.252&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 180.92.128.193 255.255.255.252&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/1/0&#xA; ip address 124.29.242.33 255.255.255.252&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/1/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router eigrp 99&#xA; redistribute static metric 10000 10 255 100 1000 &#xA; network 180.92.0.0&#xA; network 124.0.0.0&#xA; no auto-summary&#xA;!&#xA;ip classless&#xA;ip route 124.29.242.40 255.255.255.248 124.29.242.38 &#xA;ip route 124.29.242.48 255.255.255.252 124.29.242.38 &#xA;ip route 124.29.242.52 255.255.255.252 124.29.242.38 &#xA;ip route 124.29.242.56 255.255.255.252 124.29.242.38 &#xA;ip route 192.168.10.0 255.255.255.0 124.29.242.38 &#xA;ip route 192.168.20.0 255.255.255.0 124.29.242.38 &#xA;ip route 192.168.30.0 255.255.255.0 124.29.242.38 &#xA;ip route 0.0.0.0 0.0.0.0 124.29.242.38 &#xA;!&#xA;.&#xA;.&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sh running-configuration&lt;/code&gt; for left router &lt;strong&gt;STATIC&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh running-config &#xA;Building configuration...&#xA;&#xA;.&#xA;.&#xA;interface FastEthernet0/0&#xA; ip address 124.29.242.41 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 124.29.242.38 255.255.255.252&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 124.29.242.49 255.255.255.252&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/1/0&#xA; ip address 124.29.242.53 255.255.255.252&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/1/1&#xA; ip address 124.29.242.57 255.255.255.252&#xA; clock rate 64000&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;ip route 192.168.10.0 255.255.255.0 124.29.242.50 &#xA;ip route 192.168.20.0 255.255.255.0 124.29.242.54 &#xA;ip route 192.168.30.0 255.255.255.0 124.29.242.58 &#xA;!&#xA;.&#xA;.&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sh running-configuration for right router &lt;strong&gt;EIGRP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh running-config &#xA;Building configuration...&#xA;&#xA;.&#xA;.&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 180.92.128.201 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/1/0&#xA; ip address 180.92.128.194 255.255.255.252&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/1/1&#xA; ip address 180.92.128.198 255.255.255.252&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/2/0&#xA; ip address 180.92.128.209 255.255.255.252&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/2/1&#xA; ip address 180.92.128.213 255.255.255.252&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/3/0&#xA; ip address 180.92.128.217 255.255.255.252&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/3/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router eigrp 99&#xA; network 180.92.0.0&#xA; no auto-summary&#xA;!&#xA;ip classless&#xA;!&#xA;.&#xA;.&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14624" LastEditorUserId="14624" LastEditDate="2015-03-29T03:29:19.900" LastActivityDate="2017-08-11T14:52:06.953" Title="Redistribution between EIGRP and Static routing protocols" Tags="|eigrp|redistribution|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17562" PostTypeId="2" ParentId="17560" CreationDate="2015-03-28T19:48:46.800" Score="3" Body="&lt;p&gt;Asymmetry may occur on two levels:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;source -&gt; dest takes a different AS-path than dest -&gt; source, so there's a difference in networks traversed&lt;/li&gt;&#xA;&lt;li&gt;within each AS on the path (both source -&gt; dest and dest -&gt; source) different routes can be chosen&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For each given source and destination, asymmetry can occur on both levels. As a result, it's very hard to answer your question. It may be true (since there could be less networks and hops involved), but it's hard to give an answer which applies to the general case. Also, anything which may seem to be nearby looking from one end may be further away looking from the other end.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-03-28T19:48:46.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17563" PostTypeId="2" ParentId="17561" CreationDate="2015-03-28T21:26:39.087" Score="3" Body="&lt;p&gt;It is hard to tell from your description and lack of &lt;code&gt;sh run&lt;/code&gt; from the other two routers, but I believe this portion of the configuration is the problem: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 255.255.255.255 124.29.242.38&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should be a default route statement. Currently it is routing packets with the destination IP address of &lt;code&gt;0.0.0.0&lt;/code&gt; only instead of acting as a default route. To do so you will have to replace it or add the following static route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 124.29.242.38&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can test your routing paths with show &lt;code&gt;ip route $interfaceip&lt;/code&gt; on both sides to confirm this route selection.&lt;/p&gt;&#xA;" OwnerUserId="13792" LastEditorUserId="8499" LastEditDate="2017-08-11T14:52:06.953" LastActivityDate="2017-08-11T14:52:06.953" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17565" PostTypeId="1" CreationDate="2015-03-29T01:21:32.463" Score="0" ViewCount="689" Body="&lt;p&gt;Dear fellow network engineers, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of my friends has asked me to help him with his small office network.&#xA;It's a small accounting firm that has about 5 PC (desktops and laptops). They also have a 4TB NAS drive hooked up to the ISP router that they were provided. Here is a rough outline of the current office network setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/CW45C.png&quot; alt=&quot;Current Office Setup&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have the exact specs of the modem, but it's a low-end Huawei modem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Their current problem comes from the fact that all traffic is handled by the small modem and when two or more devices attempt to backup data to the NAS drive, the modem overloads and restarts itself thus interrupting all backups in progress. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently wondering as to how to remedy the situation. I am thinking of the following options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Purchase a new better WiFi router with built-in ethernet switch that can handle the LAN traffic appropriately, but I how should I go about choosing a specific device?&lt;/li&gt;&#xA;&lt;li&gt;Purchase an ethernet switch that can handle the traffic. This solution seems cheaper, but WiFi traffic is still going to be congested during backups?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is there any other way to tackle this? Any advice would be appreciated. &lt;/p&gt;&#xA;" OwnerUserId="14628" LastActivityDate="2015-03-29T01:40:41.827" Title="Small office network - overload problem" Tags="|routing|switch|router|wireless|ethernet|" AnswerCount="1" CommentCount="1" ClosedDate="2015-03-31T17:57:21.477" ContentLicense="CC BY-SA 3.0" />
  <row Id="17566" PostTypeId="2" ParentId="17565" CreationDate="2015-03-29T01:40:41.827" Score="3" Body="&lt;p&gt;A decent switch should solve your problem.  If everything is on the same VLAN, the traffic from a PC doing a backup will not impede any other PC trying to send traffic through the router since the traffic destined for the NAS will not flow through the router unless they are on different VLANs.  I assume they share a single VLAN based on your description of the low-end router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding an AP that connects to the switch will solve your Wi-Fi problem for all but the Wi-Fi devices.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-03-29T01:40:41.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17567" PostTypeId="2" ParentId="10148" CreationDate="2015-03-29T03:47:33.303" Score="-2" Body="&lt;p&gt;XS708E is an unmanaged switch so there would be no VLANS&lt;/p&gt;&#xA;" OwnerUserId="14630" LastActivityDate="2015-03-29T03:47:33.303" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17568" PostTypeId="2" ParentId="17503" CreationDate="2015-03-29T12:35:54.743" Score="3" Body="&lt;p&gt;A group of access points (APs) connected via a distribution system (DS) all sharing the same SSID would be considered Extended Service Set (ESS).  The DS is usually a wired network (like Ethernet) but could be wireless as in a &quot;wireless backhaul&quot; or a mesh of APs. In &quot;standard&quot; 802.11 infrastructure implementations (and leaving out other topics such as AP &quot;forced&quot; load balancing) the mobile station (MS) is ultimately responsible for handoff between APs, the DS is used by the AP to forward any packets already buffered at the previous AP to the new destination AP.  The protocol on the DS for inter-AP communication is vendor proprietary so for an &quot;optimized&quot; DS you don't want to mix APs from different vendors on an ESS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to look at this (with respect to infrastructure networks):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A BSSID is the MAC Address of the AP.&lt;/li&gt;&#xA;&lt;li&gt;The SSID is the name of the wireless network that the MS uses connect to that network.  Think of the SSID when you think of one AP with one or more MSs.&lt;/li&gt;&#xA;&lt;li&gt;A ESS is when multiples APs look like one big distributed wireless network all connected to each other by the DS. The name of this distributed wireless network is termed the ESSID.  One or more MSs can connect to this network and roam between APs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="14633" LastActivityDate="2015-03-29T12:35:54.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17569" PostTypeId="1" AcceptedAnswerId="17696" CreationDate="2015-03-29T13:44:50.663" Score="2" ViewCount="11108" Body="&lt;p&gt;Here s a pic from packet tracer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/osVDI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm trying to do is to ping Router3's Se2/0 interface from PC0.(Or Router2's Se2/0 interface from PC1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the ping message gets only as far as the Router2's Ethernet interface &#xA;Shouldn't the ping work since ROUTER3's serial interface is connected to the WAN, which is directly connected to ROUTER2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some configuration info&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP : 195.10.10.2&lt;br&gt;&#xA;Default gateway: 195.10.10.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fast Ethernet interface IP: 195.10.10.1&lt;br&gt;&#xA;Serial interface IP: 195.10.30.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Serial interface IP: 195.10.30.2   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnet Masks are all 255.255.255.0 &lt;/p&gt;&#xA;" OwnerUserId="14634" LastEditorUserId="14634" LastEditDate="2015-03-29T15:38:34.767" LastActivityDate="2020-06-21T06:27:58.583" Title="Can't ping a router's interface which is in a WAN directly connected to my router- (Packet tracer)" Tags="|router|wan|ping|cef|packet-tracer|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17574" PostTypeId="2" ParentId="17482" CreationDate="2015-03-30T03:41:58.203" Score="2" Body="&lt;p&gt;The following is an example of how to configure your devices to point to your 4500 for NTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few things that you have to ensure you have on hand:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Know what time-zone the devices are operating in.&lt;/li&gt;&#xA;&lt;li&gt;Know the local time (or whatever time your equipment is set to according to policy).&lt;/li&gt;&#xA;&lt;li&gt;A refreshing beverage (in a non-spillable container of course.)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Configs:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;4500# config t&lt;br&gt;&#xA;  4500(config)#ntp master&lt;br&gt;&#xA;  4500(config)#ntp authenticate&#xA;  4500(config)#ntp authentication-keys &lt;strong&gt;1&lt;/strong&gt; md5 &lt;strong&gt;password&lt;/strong&gt;&#xA;  4500(config)#int lo0&lt;br&gt;&#xA;  4500(config-int)#ip address 10.0.0.1 255.255.255.255&lt;br&gt;&#xA;  4500(config-int)#no shut&lt;br&gt;&#xA;  4500(config-int)#description Loopback_for_NTP&lt;br&gt;&#xA;  4500(config-int)#end&lt;br&gt;&#xA;  4500#clock set &lt;strong&gt;hh:mm:ss&lt;/strong&gt; &lt;strong&gt;day&lt;/strong&gt; &lt;strong&gt;name of month&lt;/strong&gt; &lt;strong&gt;year&lt;/strong&gt;&lt;br&gt;&#xA;  4500#clock timezone &lt;strong&gt;number of hours you are offset from UTC&lt;/strong&gt;&lt;br&gt;&#xA;  4500# copy run start&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Client#clock set &lt;strong&gt;hh:mm:ss&lt;/strong&gt; &lt;strong&gt;day&lt;/strong&gt; &lt;strong&gt;name of month&lt;/strong&gt; &lt;strong&gt;year&lt;/strong&gt;&lt;br&gt;&#xA;  Client#clock timezone &lt;strong&gt;number of hours you are offset from UTC&lt;/strong&gt;&lt;br&gt;&#xA;  Client#config t&lt;br&gt;&#xA;  Client(config)#ntp authenticate&lt;br&gt;&#xA;  Client(config)#ntp authentication-key &lt;strong&gt;1&lt;/strong&gt; md5 &lt;strong&gt;password&lt;/strong&gt;&lt;br&gt;&#xA;  Client(config)#ntp server 10.0.0.1 key 1&lt;br&gt;&#xA;  Client(config)#end&#xA;  Client#copy run start&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If I missed anything or someone sees and issue with my configuration, please let me know.&lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2015-03-30T03:41:58.203" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17575" PostTypeId="2" ParentId="743" CreationDate="2015-03-30T04:17:37.177" Score="0" Body="&lt;p&gt;&quot;MAC address exhaustion is unlikely to ever be a problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the short term, 281 trillion addresses, even with a low fill rate, are a lot to work with. Even at 10% fill, that is 4k devices per person alive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the long term, if we arrive at a situation where all of the shirt buttons of the average Indian peasant are individually networked, MAC address shortage is easily addressed: MAC addresses only need to be unique locally, on a given LAN, and they don't need any particular structure. At the point when we are out of three-bytes prefixes to assign or recycle, we switch to the following algorithm:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every device generates a random MAC on boot.&#xA;Every device, when it detects MAC collision, switches to a randomly generated MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the collision will hardly ever happen, since the average number of devices on a LAN needed for a collision is 2^24, or nearly 17 million (cf What is the birthday problem?). Having 17 million hosts on the same broadcast domain is a bad idea, since Address Resolution Protocol traffic will be too high.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Stanislav Shalunov&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://www.quora.com/Will-MAC-Addresses-ever-be-exhausted&quot; rel=&quot;nofollow&quot;&gt;http://www.quora.com/Will-MAC-Addresses-ever-be-exhausted&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14643" LastActivityDate="2015-03-30T04:17:37.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17576" PostTypeId="1" AcceptedAnswerId="17591" CreationDate="2015-03-30T05:19:19.880" Score="1" ViewCount="77" Body="&lt;p&gt;I just check BGP toolkit of a particular IP and found that it's announced by two different ASes (AS42708 and AS37560). Here: &lt;a href=&quot;http://bgp.he.net/ip/46.246.63.251&quot; rel=&quot;nofollow&quot;&gt;http://bgp.he.net/ip/46.246.63.251&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, AS37560 with more specific prefix is widely accepted. For instance, I check it with &lt;a href=&quot;https://asn.cymru.com/&quot; rel=&quot;nofollow&quot;&gt;https://asn.cymru.com/&lt;/a&gt;, the result returns only AS37560 instead of both or AS42708.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is that will route to 46.246.63.251 from the entire Internet change to use path via AS42708 if AS37560 went down? Or the IP 46.246.63.251 just becomes inaccessible if  AS37560 went down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="14512" LastActivityDate="2015-03-30T19:41:32.550" Title="Will ASes path change if a particular AS went down?" Tags="|routing|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17582" PostTypeId="1" CreationDate="2015-03-30T12:30:02.733" Score="4" ViewCount="47439" Body="&lt;p&gt;Is it possible to find out the MAC Addr of AP the device used to connect the network? I can get the MAC address and IP address of the device(maybe notebook or smartphone), and I have to check the MAC address of the wifi device. (I'm not saying about the gateway address) There are lots of AP with same ESSID and different channels here, and I want to get which AP was used.&lt;/p&gt;&#xA;" OwnerUserId="14647" LastActivityDate="2019-05-17T23:08:37.840" Title="Finding out which wifi AP the device used to access the network" Tags="|ieee-802.11|" AnswerCount="5" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17583" PostTypeId="1" AcceptedAnswerId="17584" CreationDate="2015-03-30T12:36:13.977" Score="4" ViewCount="2934" Body="&lt;p&gt;I'm pretty sure you can do this in the Cisco world, but haven't found a way to do this on a Juniper device.  Is there a way to restrict local accounts from being accessed if the router has access to TACACS?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;More specifically, is there a way to configure the router so it behaves in the following way:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If the router can authenticate a user via TACACS, the username/password stored on the device is not accessible. &lt;/li&gt;&#xA;&lt;li&gt;If TACACS is not available, the local account is then accesible.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="11938" LastEditorUserId="11938" LastEditDate="2015-03-31T09:40:19.300" LastActivityDate="2020-02-11T14:36:09.593" Title="Can you only allow local login when TACACS is unavailable on a Juniper?" Tags="|security|juniper-junos|tacacs|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17584" PostTypeId="2" ParentId="17583" CreationDate="2015-03-30T13:10:56.417" Score="6" Body="&lt;p&gt;This is actually default behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way a local login will even be attempted is if &lt;strong&gt;all&lt;/strong&gt; other authentication types fail (TACACS and/or RADIUS). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in your case, the only time your local password database will be consulted is if the TACACS server(s) fail to respond to any requests.  If you attempt to login, but TACACS rejects your password, the local database is &lt;strong&gt;NOT&lt;/strong&gt; consulted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;From:&lt;/strong&gt; &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos14.2/topics/concept/authentication-order-authentication-methods-overview.html&quot; rel=&quot;noreferrer&quot;&gt;Juniper Authentication Order Methods&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The password authentication method is not explicitly configured as one of the authentication methods in the authentication-order authentication-methods statement. In this case, the password authentication method is tried only if all configured authentication methods fail to respond. It is not consulted if any configured authentication method returns a reject response because of an incorrect username or password.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you're seeing different behavior, check for the following configuration statement (be aware it has sub-options, for more info see &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos14.2/topics/task/configuration/authentication-order-authentication-methods-configuring.html&quot; rel=&quot;noreferrer&quot;&gt;Configuring Authentication Order&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1&amp;gt; show configuration system authentication-order&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If this is configured in the right way, the authentication database &lt;strong&gt;WILL&lt;/strong&gt; be consulted if the TACACS server fails to respond &lt;strong&gt;OR&lt;/strong&gt; rejects a password attempt.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The password authentication method (password) is explicitly configured as one of the authentication methods in the [authentication-order authentication-methods] statement. In this case, the password authentication method is tried if no previous authentication accepts the logon credentials. This is true whether the previous authentication method fails to respond or returns a reject response because of an incorrect username or password.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So to be extra clear, you do not want &lt;code&gt;authentication-order&lt;/code&gt; configured at all to achieve the default behavior.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-03-30T13:10:56.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17585" PostTypeId="1" AcceptedAnswerId="17628" CreationDate="2015-03-30T13:36:02.757" Score="11" ViewCount="10804" Body="&lt;p&gt;As I understand, Cisco IOS CAR(Committed Access Rate) is based on &lt;em&gt;leaky bucket algorithm&lt;/em&gt;(idea is exactly the same as &lt;em&gt;token bucket algorithm&lt;/em&gt;) and the amount of bits I configure as average rate, is the amount of &quot;water constantly leaking the bucket&quot;. For example here the average input rate-limit rate is 5Mbps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 10.10.10.2 255.255.255.0&#xA; rate-limit input 5000000 937500 1875000 conform-action transmit exceed-action drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if traffic rate is below the average rate, then it is always conformed. Am I correct that &quot;normal burst&quot; determines how large the traffic bursts can be before exceed-action is applied? So in case of example above, if there has been constant traffic rate of 5Mbps(625000 bytes in the bucket), then I could send for one second 7.5Mbps(adds additional 312500 bytes to bucket) of traffic and not a single bit is dropped? And if bytes in bucket are between the normal burst and maximum burst, then bytes are dropped based on RED-like algorithm until all the new packets are dropped if maximum burst is also full?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2017-09-28T11:02:39.630" Title="How to understand &quot;normal burst&quot; and &quot;maximum burst&quot; in Cisco CAR?" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17586" PostTypeId="2" ParentId="3148" CreationDate="2015-03-30T14:50:41.777" Score="3" Body="&lt;p&gt;Part of it comes down to what's supported, you might have PE's running older code that don't support FEC129.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;FEC128&lt;/strong&gt; multihoming was introduced in Junos 7.5 (see &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos11.4/topics/reference/configuration-statement/multi-homing-edit-protocols-vpls.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;FEC129&lt;/strong&gt; multihoming was introduced in Junos 12.3 (see &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/configuration-statement/multi-homing-edit-routing-instances-protocols-vpls.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It's not necessarily that a single VPLS domain ONLY signals with BGP and ONLY discovers with LDP, it's the fact that you can interoperate within the FEC 128 standard (and FEC129).  I definitely think you're usually going to select one and run with it, but there are all kinds of environments out there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FEC128 on Junos will support running individual mesh groups inside of a single VPLS instances (1 or more group of LDP signaled PE's, 1 group for BGP signaled PE's).  You can configure them to interoperate by configuring a border PE to be a member of both the BGP signaled group, and LDP signaled group.  That way if you are signaling with LDP in one area, and you want to introduce BGP in another - both can work together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's some extra material/examples, if you're interested:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.1/topics/task/configuration/vpls-bgp-ldp-signaling-solutions.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/en_US/junos13.1/topics/task/configuration/vpls-bgp-ldp-signaling-solutions.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos14.1/topics/usage-guidelines/vpns-configuring-interoperability-between-bgp-signaling-and-ldp-signaling-in-vpls.html#jd0e120&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/en_US/junos14.1/topics/usage-guidelines/vpns-configuring-interoperability-between-bgp-signaling-and-ldp-signaling-in-vpls.html#jd0e120&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-03-30T14:50:41.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17591" PostTypeId="2" ParentId="17576" CreationDate="2015-03-30T19:41:32.550" Score="4" Body="&lt;p&gt;Traffic always follows the most specific (longest) route entry to its destination. So, any network knowing both the 46.246.32.0/19 route from AS37560 and the 46.246.0.0/17 route from AS42708 will prefer the former.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the route from AS37560 gets withdrawn for some reason, the remaining route (via AS42708) will become the preferred route, assuming no other more-specific routes are available.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2015-03-30T19:41:32.550" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17594" PostTypeId="1" AcceptedAnswerId="17601" CreationDate="2015-03-30T22:27:14.997" Score="1" ViewCount="2109" Body="&lt;p&gt;Level 3 has recently installed a dedicated internet conection (10 Mbps 1:1) in my company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I use speedtest.net or any other test website, speed values are vey poor (1.56 for download, and 2.39 for upload). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I claimed Level 3 for not providing the agreed bandwidth, but they said they performed a &quot;saturation test&quot; in which bandwidth reaches 10 Mbps. They also said their test is accurate because it doesn't depend on a test server like speedtest.net&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How can I know they are telling the truth?.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the image:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6DG1r.png&quot; alt=&quot;Level3 test report&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is their report:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet4 is up, line protocol is up&#xA;  Hardware is PQII_PRO_UEC, address is b838.61ac.b57c (bia b838.61ac.b57c)&#xA;  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,&#xA;     reliability 255/255, txload 25/255, rxload 25/255&#xA;  Encapsulation 802.1Q Virtual LAN, Vlan ID  1., loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 100Mb/s, 100BaseTX/FX&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:00, output 00:00:00, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 00:42:18&#xA;  Input queue: 4/75/0/0 (size/max/drops/flushes); Total output drops: 335&#xA;  Queueing strategy: Class-based queueing&#xA;  Output queue: 64/1000/0 (size/max total/drops)&#xA;  30 second input rate 10060000 bits/sec, 832 packets/sec&#xA;  30 second output rate 10038000 bits/sec, 829 packets/sec&#xA;     1085479 packets input, 1634002628 bytes&#xA;     Received 220 broadcasts (0 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog&#xA;     0 input packets with dribble condition detected&#xA;     1083785 packets output, 1632163458 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14468" LastEditorUserId="619" LastEditDate="2015-03-31T00:16:29.740" LastActivityDate="2015-03-31T08:13:31.933" Title="How test dedicated bandwidth - 10 Mbps" Tags="|bandwidth|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17595" PostTypeId="1" AcceptedAnswerId="17598" CreationDate="2015-03-30T23:47:20.627" Score="2" ViewCount="8413" Body="&lt;p&gt;I understand the differences between a switch and a router, but I don't understand the supposedly common practice of using a switch to extend/expand the number of ports provided by a router and where each device connected to the switch gets its own LAN IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch and router operate on different layers (assuming the switch is not multi-layered) and hence I don't understand how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Picture this scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router connects LAN to the WAN (public internet).&#xA;Switch is connected to one of the router LAN ports.&#xA;Devices (e.g. computers, laptops, etc.) are connected to the switch.&#xA;Say there is device A connected to the switch and it wants to talk to device B (also connected to the switch). I understand that a switch allows the two devices to communicate without involving the router, but that is via MAC addresses (data-link layer). What if I want them to communicate using their LAN IP addresses, i.e. so I can use simple TCP socket programming?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Device A could send some data to Device B via a TCP socket, but how does the data get from Device A to the router and back to Device B, via the switch in both cases? The switch only knows MAC addresses, not IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="14657" LastEditorUserId="14657" LastEditDate="2015-03-31T01:18:22.903" LastActivityDate="2015-03-31T01:18:34.960" Title="How to communicate between devices on a switch via IP addresses" Tags="|switch|router|mac-address|ip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17596" PostTypeId="2" ParentId="17594" CreationDate="2015-03-31T00:20:01.137" Score="1" Body="&lt;p&gt;No one can guarantee bandwidth once it leaves their network. These sorts of line qualification tests are done to server(s) within the ISP network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not saying you don't have an issue with L3. However, random speedtest sites are not always going to be indicative of reality.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-03-31T00:20:01.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17597" PostTypeId="2" ParentId="11283" CreationDate="2015-03-31T01:09:10.587" Score="2" Body="&lt;p&gt;I had a similar issue using a Static VTI IPSec tunnel.&#xA;Initially the tunnel interface IP MTU was set to 1400 bytes with the &quot;Crypto IPSec DF-bit clear&quot; command set under the global configuration.&#xA;The expected behaviour was for packets received (being forwarded to the VTI) should have the DF bit cleared and allow the packet to be fragmented before encryption is required. We found that any packets arriving with DF bit set that exceeded the tunnel IP MTU were being dropped and not switched to the tunnel interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a long discussion with Cisco TAC it was explained that that VTI tunnels do not support fragmentation before encryption (as per bug ID CSCsr97396/CSCsh30577), This is apparently undocumented in any publically available Cisco documents including configuration guides... poor show Cisco considering this bug has been known since 2007!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fix is to ensure the tunnel interface IP MTU is large enough (changed IP MTU to 1500) not to cause fragmentation. In the solution we deployed the egress interface is a point to point ATM interface (OC12/STM4 ATM SPA) with a default MTU of 4470 so no post encryption fragmentation will occur.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, we are using ASR1006 router with ESP-10, RP2 with IOS-XE 3.13 if that helps.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/HwqPG.png&quot; alt=&quot;Cisco Bug CSCsh30577&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14658" LastActivityDate="2015-03-31T01:09:10.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17598" PostTypeId="2" ParentId="17595" CreationDate="2015-03-31T01:18:34.960" Score="4" Body="&lt;p&gt;This is a simplified version of what happens:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch (assuming not a layer-3 switch) only involves itself with MAC addresses.  This is where ARP comes into play.  The sending PC will ARP, using the layer-3 address, and the receiving PC with that layer-3 address will respond with its layer-2 address.  The sending PC then encapsulates the layer-3 packets into layer-2 frames, and the switch will switch the layer-2 frames.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-03-31T01:18:34.960" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17599" PostTypeId="2" ParentId="17594" CreationDate="2015-03-31T04:27:03.487" Score="2" Body="&lt;p&gt;Can you do another test to speedtest.net or similar from outside your network?  Just connect a laptop directly to the WAN uplink for a moment after hours or something and see what you can get without involving your firewall or anything else behind it.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2015-03-31T04:27:03.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17601" PostTypeId="2" ParentId="17594" CreationDate="2015-03-31T08:13:31.933" Score="2" Body="&lt;p&gt;You can do some testing with IPERF (&lt;a href=&quot;http://en.wikipedia.org/wiki/Iperf&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Iperf&lt;/a&gt;)&#xA;There are public servers on the wiki page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tests can be done for UDP and TCP traffic.&#xA;This will give you an insight on the speed of your connection.&lt;/p&gt;&#xA;" OwnerUserId="2693" LastActivityDate="2015-03-31T08:13:31.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17603" PostTypeId="1" AcceptedAnswerId="17616" CreationDate="2015-03-31T08:29:56.810" Score="4" ViewCount="2805" Body="&lt;p&gt;I am trying to do an ISSU on Cisco 4k switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I booted both of the supervisor of the switch with the same image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) I also used the &lt;code&gt;boot system bootflash&lt;/code&gt; command with both of the image names, setting the boot variable. So when I do &lt;code&gt;sh bootvar&lt;/code&gt; from privilege mode I am getting both of the images name in the bootvar variable and the value of  the conf-reg as 2922&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) I have loaded both of the image the one which switch is running and the one to which i want to upgrade in the bootflash of the switch and also in the slave bootflash which may not be necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) I have also set one rommon mode variable &lt;code&gt;IssuSkipMatrixLookup=1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5) When i do &lt;code&gt;show redundancy&lt;/code&gt; the switch is in the SSO mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6) When i do &lt;code&gt;sh bootvar&lt;/code&gt; it contains only two images the one which is running and the one to which i want to upgrade.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7) I have also set the switch to be in auto-boot mode one of the pre-requisite of ISSU, From the &lt;code&gt;configure terminal&lt;/code&gt; mode I have used the command &lt;code&gt;conf-reg 0x2102&lt;/code&gt; but it is taking the value as 2922 by itself which I am unable to figure out, but i guess that must be fine cause the last value is 2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I run the &lt;code&gt;issu loadversion&lt;/code&gt;command I get this message&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;%Active boot variable is Invalid.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I resolve this problem?&lt;/p&gt;&#xA;" OwnerUserId="14661" LastEditorUserId="775" LastEditDate="2015-03-31T09:21:59.120" LastActivityDate="2016-05-25T20:16:11.723" Title="Conf-reg and ISSU" Tags="|cisco|switch|cisco-4500|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17604" PostTypeId="1" CreationDate="2015-03-31T09:42:15.733" Score="8" ViewCount="2292" Body="&lt;p&gt;I have a Juniper MX router that is accepting SNMP requests.  Problem is I am sending UDP requests to one interface, and it is replying on another.  The target IP is that which is assigned to lo0.1 but the router is replying on lo0.0.  This is problematic as the IP address for lo0.0 is what is specified on an exterior firewall.  Is there a way to define what interface needs to reply to the snmp requests?&lt;/p&gt;&#xA;" OwnerUserId="11938" LastEditorUserId="11938" LastEditDate="2015-03-31T13:58:40.383" LastActivityDate="2016-02-12T04:10:24.990" Title="Determine what interface is replying to snmp replies" Tags="|snmp|juniper-junos|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17610" PostTypeId="1" AcceptedAnswerId="17613" CreationDate="2015-03-31T17:56:29.463" Score="2" ViewCount="4470" Body="&lt;p&gt;This is my Cisco ASA 5505 &quot;show run&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;:&#xA;ASA Version 8.2(5) &#xA;!&#xA;hostname LAB-ASA&#xA;domain-name TEST.com&#xA;enable password X encrypted&#xA;passwd X encrypted&#xA;names&#xA;name 192.168.1.0 AsusWireless&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 172.16.1.1 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address xx.xx.xx.xx 255.255.255.248 &#xA;!&#xA;ftp mode passive&#xA;dns domain-lookup inside&#xA;dns domain-lookup outside&#xA;dns server-group DefaultDNS&#xA; domain-name TEST.com&#xA;object-group protocol DM_INLINE_PROTOCOL_1&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_2&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_3&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_4&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;access-list TUNNEL_LIST standard permit 172.16.1.0 255.255.255.0 &#xA;access-list TUNNEL_LIST standard permit 172.16.16.0 255.255.255.0 &#xA;access-list outside_in extended permit icmp any host xx.xx.xx.xx &#xA;access-list outside_in extended permit ip 172.16.16.0 255.255.255.0 any &#xA;access-list outside_in extended permit ip 172.16.1.0 255.255.255.0 any &#xA;access-list inside_in extended permit icmp any any log &#xA;access-list inside_in extended permit tcp any any log &#xA;access-list inside_in extended permit udp any any log &#xA;access-list inside_in extended permit ip any any log &#xA;access-list inside_in extended permit ip 172.16.16.0 255.255.255.0 any &#xA;access-list inside_in extended permit ip 172.16.1.0 255.255.255.0 any &#xA;access-list inside_in extended permit object-group DM_INLINE_PROTOCOL_1 interface inside any &#xA;access-list inside_in extended permit object-group DM_INLINE_PROTOCOL_3 AsusWireless 255.255.255.0 any &#xA;access-list inside_out extended permit icmp any any log &#xA;access-list inside_out extended permit tcp any any log &#xA;access-list inside_out extended permit udp any any log &#xA;access-list inside_out extended permit ip any any log &#xA;access-list inside_out extended permit object-group DM_INLINE_PROTOCOL_2 172.16.1.0 255.255.255.0 any &#xA;access-list inside_out extended permit object-group DM_INLINE_PROTOCOL_4 AsusWireless 255.255.255.0 any &#xA;access-list outside_out extended permit icmp any any log &#xA;access-list outside_out extended permit tcp any any log &#xA;access-list outside_out extended permit udp any any log &#xA;access-list outside_out extended permit ip any any log &#xA;pager lines 24&#xA;logging console debugging&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;ip local pool VPN_CLIENTS 172.16.16.16-172.16.16.64 mask 255.255.255.0&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 0 172.16.1.0 255.255.255.0 outside&#xA;nat (inside) 0 AsusWireless 255.255.255.0 outside&#xA;access-group inside_in in interface inside&#xA;access-group inside_out out interface inside&#xA;access-group outside_in in interface outside&#xA;access-group outside_out out interface outside&#xA;route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA; description &quot;AnyConnectACL&quot;&#xA; network-acl inside_in&#xA; network-acl inside_out&#xA;aaa authentication ssh console LOCAL &#xA;aaa authentication telnet console LOCAL &#xA;http server enable&#xA;http 172.16.1.0 255.255.255.0 inside&#xA;http AsusWireless 255.255.255.255 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map outside_map interface outside&#xA;crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map inside_map interface inside&#xA;crypto isakmp enable inside&#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 10&#xA; authentication crack&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 20&#xA; authentication rsa-sig&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 30&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 40&#xA; authentication crack&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 50&#xA; authentication rsa-sig&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 60&#xA; authentication pre-share&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 70&#xA; authentication crack&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 80&#xA; authentication rsa-sig&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 90&#xA; authentication pre-share&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 100&#xA; authentication crack&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 110&#xA; authentication rsa-sig&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 120&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 130&#xA; authentication crack&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 140&#xA; authentication rsa-sig&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 150&#xA; authentication pre-share&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh 172.16.1.0 255.255.255.0 inside&#xA;ssh AsusWireless 255.255.255.255 inside&#xA;ssh timeout 5&#xA;console timeout 0&#xA;management-access inside&#xA;dhcp-client update dns server both&#xA;dhcpd address 172.16.1.5-172.16.1.36 inside&#xA;dhcpd dns 8.8.8.8 8.8.4.4 interface inside&#xA;dhcpd enable inside&#xA;!&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA; enable inside&#xA; enable outside&#xA; anyconnect-essentials&#xA; svc image disk0:/anyconnect-win-3.1.05187-k9.pkg 1&#xA; svc image disk0:/anyconnect-linux-64-3.1.05187-k9.pkg 2&#xA; svc image disk0:/anyconnect-linux-3.1.05187-k9.pkg 3&#xA; svc image disk0:/anyconnect-macosx-i386-3.1.05187-k9.pkg 4&#xA; svc enable&#xA; tunnel-group-list enable&#xA;group-policy DfltGrpPolicy attributes&#xA; dns-server value 172.16.1.2&#xA; vpn-tunnel-protocol webvpn&#xA; split-tunnel-network-list value TUNNEL_LIST&#xA; split-tunnel-all-dns enable&#xA; webvpn&#xA;  svc rekey method ssl&#xA;  svc compression deflate&#xA;group-policy GroupPolicy1 internal&#xA;group-policy GroupPolicy1 attributes&#xA; wins-server none&#xA; dns-server value 172.16.1.2 8.8.4.4&#xA; vpn-filter value inside_in&#xA; vpn-tunnel-protocol IPSec l2tp-ipsec svc &#xA; group-lock value AnyConnectProfile&#xA; split-tunnel-policy tunnelall&#xA; split-tunnel-network-list value TUNNEL_LIST&#xA; default-domain value TEST.com&#xA;&#xA;tunnel-group AnyConnectProfile type remote-access&#xA;tunnel-group AnyConnectProfile general-attributes&#xA; address-pool VPN_CLIENTS&#xA; authorization-server-group LOCAL&#xA; default-group-policy GroupPolicy1&#xA;tunnel-group AnyConnectProfile webvpn-attributes&#xA; group-alias AnyConnectProfile enable&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect ip-options &#xA;  inspect netbios &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect skinny  &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect sunrpc &#xA;  inspect tftp &#xA;  inspect sip  &#xA;  inspect xdmcp &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;Cryptochecksum:e09e55d66228358f8038da3c81d19847&#xA;: end&#xA;asdm location AsusWireless 255.255.255.0 inside&#xA;no asdm history enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was playing with ASDM and now no one has internet in whole network, there is AsusWireless (wireless router) which assigns people with IP addresses such as 192.168.1.X, none of those and non of people connected directly to Cisco ASA (172.16.1.X) and none of people who connected through AnyConnect (172.16.16.X) does have internet. No internet at all.&#xA;But when I go to ssh of Cisco router and when I ping Google servers, it's connected and does have internet. What's wrong? What did I do wrong?&lt;/p&gt;&#xA;" OwnerUserId="14663" LastActivityDate="2015-03-31T22:31:17.940" Title="Cisco ASA 5505 doesn't allow internet connection" Tags="|cisco|router|cisco-asa|firewall|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17611" PostTypeId="1" CreationDate="2015-03-31T19:11:01.567" Score="1" ViewCount="285" Body="&lt;p&gt;Does the DHCPv6 LEASEQUERY-REPLY message contain the DUID (or MAC) of the client whose information we are requesting from the server?&lt;/p&gt;&#xA;" OwnerUserId="14667" LastActivityDate="2015-03-31T19:49:25.883" Title="content of dhcp lease-query message" Tags="|dhcpv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17612" PostTypeId="2" ParentId="17611" CreationDate="2015-03-31T19:49:25.883" Score="1" Body="&lt;p&gt;Looks like it carries the DUID.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;From - &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5007#section-4.3.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5007 Section 4.3.3&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;4.3.3.  Receipt of LEASEQUERY-REPLY&#xA;&#xA;   A successful LEASEQUERY-REPLY is one without an OPTION_STATUS_CODE&#xA;   option (or an OPTION_STATUS_CODE option with a success code).  There&#xA;   are three variants:&#xA;&#xA;   1.  If the server had bindings for the requested client, the message&#xA;       includes an OPTION_CLIENT_DATA option and the requestor extracts&#xA;       the client data from the LEASEQUERY-REPLY and updates its binding&#xA;       information database.  If the OPTION_CLIENT_DATA contains no&#xA;       OPTION_CLT_TIME, the requestor SHOULD silently discard the&#xA;       OPTION_CLIENT_DATA option.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;If we look at the details of how &amp;quot;OPTION_CLIENT_DATA&amp;quot; is constructed in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5007#section-4.4.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5007 Section 4.4.2&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;4.4.2.  Constructing the Client's OPTION_CLIENT_DATA&#xA;&#xA;   An OPTION_CLIENT_DATA option in a LEASEQUERY-REPLY message MUST&#xA;   minimally contain the following options:&#xA;   1.  OPTION_CLIENTID&#xA;   2.  OPTION_IAADDR and/or OPTION_IAPREFIX&#xA;   3.  OPTION_CLT_TIME&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Now we can look at the details of &amp;quot;OPTION_CLIENTID&amp;quot; in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3315#section-22.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3315 Section 22.2&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;22.2. Client Identifier Option&#xA;&#xA;   The Client Identifier option is used to carry a DUID (see section 9)&#xA;   identifying a client between a client and a server.  The format of&#xA;   the Client Identifier option is:&#xA;&#xA;       0                   1                   2                   3&#xA;       0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;      |        OPTION_CLIENTID        |          option-len           |&#xA;      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;      .                                                               .&#xA;      .                              DUID                             .&#xA;      .                        (variable length)                      .&#xA;      .                                                               .&#xA;      +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&#xA;      option-code   OPTION_CLIENTID (1).&#xA;&#xA;      option-len    Length of DUID in octets.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-03-31T19:49:25.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17613" PostTypeId="2" ParentId="17610" CreationDate="2015-03-31T22:01:53.087" Score="2" Body="&lt;p&gt;The problem is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside) 0 172.16.1.0 255.255.255.0 outside&#xA;nat (inside) 0 AsusWireless 255.255.255.0 outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&quot;nat 0&quot; tells the firewall not to do translation.  you should say &quot;nat 1&quot; to associate the nat with the&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global (outside) 1 interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;command.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-03-31T22:31:17.940" LastActivityDate="2015-03-31T22:31:17.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17614" PostTypeId="1" AcceptedAnswerId="36649" CreationDate="2015-03-31T22:11:55.843" Score="4" ViewCount="1556" Body="&lt;p&gt;As a student employee I've done some research on 802.11k and I understand that it's intended to help with devices roaming and also helping the client decide on the best (B)SSID to join. In practice for large-scale networks it would be beneficial, especially in areas where Wi-Fi signals &quot;bleed&quot; between floors due to a high volume of access points. The access point would inform the client of nearby BSSIDs that it may join and report the &quot;best&quot; one to request authentication with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have not yet found is how well 802.11k actually &lt;em&gt;performs&lt;/em&gt;. I cannot find any reports of problems when enabled in large-scale networks or issues with certain vendor products. So I'd like to ask, &lt;strong&gt;what are some, if any, known implications that 802.11k causes on a wireless network when enabled?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Does 802.11k cause connectivity problems with older devices that do not support it?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Does 802.11k cause problems with load-balancing, WMM, 802.11h? (We had to disable 802.11h due to Yosemite connection issues)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Does it rely on other neighbor-detecting protocols (CDP, LLDP)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do switches and routers need to be configured to aide 802.11k?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Does it throw clients into a loop by frequently pointing them to different APs to connect to?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In advance, thank you for any comments you make.&lt;/p&gt;&#xA;" OwnerUserId="14048" LastEditorUserId="775" LastEditDate="2015-04-02T05:03:25.537" LastActivityDate="2016-11-20T17:13:13.520" Title="How well does 802.11k actually perform on large-scale networks?" Tags="|wireless|ieee-802.11|performance|access-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17615" PostTypeId="1" AcceptedAnswerId="17724" CreationDate="2015-04-01T00:48:33.747" Score="1" ViewCount="1880" Body="&lt;p&gt;I am trying to configure a policy based route on a brocade VDX (NOS operating system) to direct traffic based on destination subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want traffic going from 10.5.2.0/23 to 10.5.1.0/25 to be routed by the VE configured on the switch (10.5.2.1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want traffic going from 10.5.2.0/23 to anywhere ELSE to go through a pfsense box which is a firewall/router. (10.5.2.2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do this I have configured two ACLS specifying source and destination networks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first says permit traffic from 10.5.2.0/23 to 10.5.1.0/25&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show access-list ip emgap01ToStorage in&#xA;ip access-list emgap01ToStorage on Ve 3020 at Ingress (From PBR)&#xA;seq 10 permit ip 10.5.2.0 255.255.254.0 10.5.1.0 255.255.255.128 (Active)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The next says permit traffic from 10.5.2.0/23 to ANY&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show access-list ip emgap01ToFirewall in&#xA;ip access-list emgap01ToFirewall on Ve 3020 at Ingress (From PBR)&#xA;seq 10 permit ip 10.5.2.0 255.255.254.0 any (Active)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then apply a route map to these two rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First is sequence 10, if traffic matches the first ACL, route normally through the VE assigned&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If traffic is not going to the network specified in that acl, it should go to seq 20 which sets the next hop to 10.5.2.2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show route-map emgap&#xA;Interface Ve 3020&#xA;ip policy route-map emgap permit 10 (Active)&#xA;match ip address acl emgap01ToStorage&#xA;set ip next-hop 10.5.2.1&#xA;Policy routing matches: 0 packets     Note: Counter values are partial&#xA;&#xA;Interface Ve 3020&#xA;ip policy route-map emgap permit 20 (Active)&#xA;match ip address acl emgap01ToFirewall&#xA;set ip next-hop 10.5.2.2 (selected)&#xA;Policy routing matches: 0 packets     Note: Counter values are partial&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this configuration, the route does not seem to be applied, traffic is never passed to the firewall (10.5.2.2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I may have two problems here&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I simply wrote the ACLS wrong (Possible because the PBR shows 0 packets matching the policy?)&lt;/li&gt;&#xA;&lt;li&gt;The router is not sending traffic to the firewall because it is unaware that 10.5.2.2 is a router. Since it's a pfsense box, the brocade is somehow unaware that 10.5.2.2 can route things.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is the running config for the route map&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map emgap permit 10&#xA;match ip address acl emgap01ToStorage&#xA;set ip next-hop 10.5.2.1&#xA;!&#xA;route-map emgap permit 20&#xA;match ip address acl emgap01ToFirewall&#xA;set ip next-hop 10.5.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And a basic picture of my desired topology&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6dscY.png&quot; alt=&quot;topology&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10240" LastActivityDate="2015-04-06T20:19:40.997" Title="Brocade PBR next hop to firewall based on network destination" Tags="|routing|brocade|pbr|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17616" PostTypeId="2" ParentId="17603" CreationDate="2015-04-01T06:37:09.200" Score="2" Body="&lt;p&gt;Hi Guys though I posted the question looking for the answer but I found the answer myself &#xA;To set the boot system variable I was using the statement &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config)# boot system bootflash:Image.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Instead of that the command to set the boot variable is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config)# boot system flash bootflash:Image.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then everything worked fine.&lt;/p&gt;&#xA;" OwnerUserId="14661" LastEditorUserId="509" LastEditDate="2015-07-30T13:46:25.360" LastActivityDate="2015-07-30T13:46:25.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17618" PostTypeId="1" AcceptedAnswerId="18162" CreationDate="2015-04-01T07:58:51.087" Score="3" ViewCount="2881" Body="&lt;p&gt;What is the reason for only part of the 3G data traffic to be going through the 3G Direct Tunnel and another part is going through the SGSN. There are counters for traffic in IuPS interface which still show there is data traffic in the SGSN. The greater part of the traffic is going through the Direct Tunnel, but not all.&#xA;The Iu user plane traffic should go through the Direct tunnel and the Iu control plane traffic should go to the SGSN. And counters still show user pane traffic going through the SGSN. There must be a reason for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sw6zE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5576" LastEditorUserId="775" LastEditDate="2015-04-01T08:31:09.887" LastActivityDate="2018-03-22T06:08:26.360" Title="Why not all data traffic is going through the 3GDT in 3G data network" Tags="|mobile|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17620" PostTypeId="1" CreationDate="2015-04-01T10:28:00.100" Score="2" ViewCount="954" Body="&lt;p&gt;Given the local IP-network 10.173.128.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking at a wireshark and there is an ARP for 10.173.128.255.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why would a network client ever ARP for a broadcast address?  &lt;/li&gt;&#xA;&lt;li&gt;Does this indicate a misconfigured network client?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="14678" LastActivityDate="2015-04-02T22:44:59.533" Title="Arping for local broadcast address" Tags="|ipv4|arp|broadcast|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17621" PostTypeId="2" ParentId="17620" CreationDate="2015-04-01T11:58:42.540" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Given the local IP-network 10.173.128.0/24&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;I am looking at a wireshark and there is an ARP for 10.173.128.255.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Why would a network client ever ARP for a broadcast address?&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A misconfigured mask on the client (for instance the client has a /23 mask instead of a /24) is one possible reason&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Does this indicate a misconfigured network client?&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's certainly not the only reason... Another possible reason is a human could manually generate the ARP as well for a number of reasons which are not worth speculating about.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-04-02T22:44:59.533" LastActivityDate="2015-04-02T22:44:59.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17622" PostTypeId="1" CreationDate="2015-04-01T13:11:00.093" Score="4" ViewCount="10926" Body="&lt;p&gt;I have a following &lt;em&gt;CBWFQ&lt;/em&gt; configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;ip access-list extended GRE-traffic-ACL&#xA; permit ip host 10.10.11.2 host 10.10.11.1&#xA;!&#xA;!&#xA;class-map match-all GRE-traffic&#xA; match access-group name GRE-traffic-ACL&#xA;!&#xA;policy-map prioritize-GRE-traffic&#xA; class GRE-traffic&#xA;  priority 500&#xA;policy-map traffic-policer&#xA; class class-default&#xA;  shape average 19500000&#xA;  service-policy prioritize-GRE-traffic&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Policy-map &lt;code&gt;traffic-policer&lt;/code&gt; is applied to Fa0/1 interface in outgoing direction. Now if I execute &lt;code&gt;sh policy-map interface Fa0/1&lt;/code&gt; command, I see the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r3#sh policy-map interface Fa0/1&#xA; FastEthernet0/1 &#xA;&#xA;  Service-policy output: traffic-policer&#xA;&#xA;    Class-map: class-default (match-any)&#xA;      545169 packets, 822918951 bytes&#xA;      30 second offered rate 7706000 bps, drop rate 5871000 bps&#xA;      Match: any &#xA;      Queueing&#xA;      queue limit 64 packets&#xA;      (queue depth/total drops/no-buffer drops) 0/415024/0&#xA;      (pkts output/bytes output) 130144/195409677&#xA;      shape (average) cir 19500000, bc 78000, be 78000&#xA;      target shape rate 19500000&#xA;&#xA;      Service-policy : prioritize-GRE-traffic&#xA;&#xA;        queue stats for all priority classes:&#xA;&#xA;          queue limit 64 packets&#xA;          (queue depth/total drops/no-buffer drops) 0/0/0&#xA;          (pkts output/bytes output) 890/49840&#xA;&#xA;        Class-map: GRE-traffic (match-all)&#xA;          890 packets, 43610 bytes&#xA;          30 second offered rate 0 bps, drop rate 0 bps&#xA;          Match: access-group name GRE-traffic-ACL&#xA;          Priority: 500 kbps, burst bytes 12500, b/w exceed drops: 0&#xA;&#xA;&#xA;        Class-map: class-default (match-any)&#xA;          544279 packets, 822875341 bytes&#xA;          30 second offered rate 7706000 bps, drop rate 5870000 bps&#xA;          Match: any &#xA;&#xA;          queue limit 64 packets&#xA;          (queue depth/total drops/no-buffer drops) 0/415024/0&#xA;          (pkts output/bytes output) 129254/195359837&#xA;r3#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;1) Am I correct that &quot;30 second offered rate&quot; is a bandwidth which comes into service-policy named &lt;code&gt;traffic-policer&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Why there are two lines &quot;shape (average) cir&quot; and &quot;target shape rate&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Am I correct that this part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;queue stats for all priority classes:&#xA;&#xA;  queue limit 64 packets&#xA;  (queue depth/total drops/no-buffer drops) 0/0/0&#xA;  (pkts output/bytes output) 190/10640&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;..is only for &lt;code&gt;GRE-traffic&lt;/code&gt; traffic-class as it is the only one with &lt;code&gt;priority&lt;/code&gt; configuration?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Am I correct that this 19.5Mbps(&lt;code&gt;shape average 19500000&lt;/code&gt;) is shared between all the traffic classes specified in child service-policies? &lt;code&gt;class-default&lt;/code&gt; and &lt;code&gt;GRE-traffic&lt;/code&gt; in my case.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-05-05T18:43:26.250" Title="Understand the output of &quot;sh policy-map int&quot; in Cisco IOS" Tags="|cisco|qos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17623" PostTypeId="1" CreationDate="2015-04-01T14:14:25.600" Score="1" ViewCount="2355" Body="&lt;p&gt;Our wireless in our NYC office has a guest SSID that has no auth.  Understandably, we get a LOT of users on this network.  Lately, our IP space has been filling very fast at events and I'd like to step down our DHCP lease time so that older addresses are aged out faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our current lease time is 8 hours, but I'm thinking of dropping that down to 30 minutes.  My concern is that doing that will prompt the server to begin handing out IP addresses that the clients still believe they're entitled to, since DHCP T1 timeout hasn't elapsed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the proper procedure for making this change so as to ensure minimal network interruption?  Should I progressively halve the lease time so that the T1 timer coincides with maximum lease age?&lt;/p&gt;&#xA;" OwnerUserId="154" LastActivityDate="2015-04-01T14:14:25.600" Title="What is the safest method to decrease DHCP lease time while not risking clients receiving already-used IP addresses?" Tags="|dhcp|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17625" PostTypeId="1" AcceptedAnswerId="17627" CreationDate="2015-04-01T15:21:03.910" Score="2" ViewCount="1511" Body="&lt;p&gt;I am a software developer who moves changes to a customer's environment regularly. To move the solution to their server, I connect via VPN and copy in Windows Explorer from my publish folder to a staging folder on their server. The download speeds start out alright, hundreds of Kb/s, but they diminish over time. Near the end of the transfer, it is moving at only 15 Kb/s and the entire copy takes over 20 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today I attempted to copy it over in pieces, one folder at a time. This did not improve my situation. The first piece moved quickly, but subsequent pieces got slower and slower.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What sorts of things can cause this to happen? Does file type play a factor? Any ability to point me in the right direction would be appreciated. Thank you&lt;/p&gt;&#xA;" OwnerUserId="14682" LastActivityDate="2015-04-01T16:46:00.610" Title="Why do copy speeds slow down over time?" Tags="|vpn|" AnswerCount="1" CommentCount="1" ClosedDate="2015-04-02T05:49:46.860" ContentLicense="CC BY-SA 3.0" />
  <row Id="17627" PostTypeId="2" ParentId="17625" CreationDate="2015-04-01T16:46:00.610" Score="3" Body="&lt;p&gt;If you are using SMB (windows file sharing) there are a few network related reasons for a file to go much slower than the actual link speed.  Here is a link to a similar question at Server Fault: &lt;a href=&quot;https://serverfault.com/questions/4409/windows-networking-performance-smb-cifs&quot;&gt;https://serverfault.com/questions/4409/windows-networking-performance-smb-cifs&lt;/a&gt; that lists a few high level ways to try to improve SMB speed.  On the network side, the TCP algorithm only allows for so many bytes in-flight before an ACK is seen, and this can cause high latency links to have an artificial bandwidth limitation.  Here is an article that gets into more detail about how/why: &lt;a href=&quot;http://www.lovemytool.com/blog/2010/08/the-network-is-slow-by-mike-canney.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.lovemytool.com/blog/2010/08/the-network-is-slow-by-mike-canney.html&lt;/a&gt;.  &lt;/p&gt;&#xA;" OwnerUserId="6361" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-04-01T16:46:00.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17628" PostTypeId="2" ParentId="17585" CreationDate="2015-04-01T16:56:02.293" Score="12" Body="&lt;p&gt;Let's calculate what we're dealing with here.  CAR is basically the older version of IOS policing, so all these concepts apply to both.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Committed Information Rate (CIR) = 5,000,000 (5Mbps)&#xA;Burst Commit Bucket (Bc) = 937,500&#xA;Burst Excess Bucket (Be) = 1,875,000&#xA;Time Interval (Tc) = Bc / CIR = 0.1875 s = 187.5 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The rate we want to restrict flows to is 5Mbps.  The Commit Bucket is 937,500 bytes.  The Burst Bucket is 1,875,000 bytes.  And the buckets are refilled every 187.5 ms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you mentioned, IOS uses a bucket mechanism to restrict how much traffic can pass.  &lt;em&gt;It does not smooth the traffic to X% of interface bandwidth over an arbitrary time period!&lt;/em&gt;  Instead, it allows full access to the bandwidth of the interface as long as you have the tokens to pay for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, since this is policing, RED/WRED are not in play.  RED only happens when there is a queue to manage.  &lt;em&gt;There is no buffering/queuing in policing, only in shaping.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's deal with the Commit Bucket (Bc) first.  Assume that there is no Excess Bucket (Be) for now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;* Commit Bucket Only (Two-Color Policer) *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a very strict policer that will only let you send within the CIR exactly; no bursting above.  There is only one bucket, Bc.  There are two &quot;colors&quot; for traffic, &lt;em&gt;conforming&lt;/em&gt; and &lt;em&gt;exceeding&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Time = 0 ms --&lt;/em&gt;&lt;/strong&gt; The bucket starts out full, with 937,500 bytes worth of tokens in it.  Let's say you send 7,500 bytes across the interface.  Now IOS decrements the bucket by 7,500 bytes, and the bucket now has 930,000 bytes worth of tokens in it.  The traffic sent is considered &quot;conforming&quot; and has the &quot;conform-action&quot; applied to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Time = 187.5 ms --&lt;/em&gt;&lt;/strong&gt; We hit the Tc now, and refill the Bc bucket.  937,500 bytes worth of tokens are added.  Any extra tokens spill out and are lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Time = 190 ms --&lt;/em&gt;&lt;/strong&gt; The commit bucket has 937,500 tokens in it.  We receive 2,000,000 bytes of traffic.  The first 937,500 bytes are transferred fine as the bucket has tokens for it.  The remaining traffic is considered &quot;exceeding&quot; and is treated according to the &quot;exceed-action&quot;.  Remeber, there is no buffering in policing (that's called shaping) - you either transmit, remark and transmit, or drop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Time = 375 ms --&lt;/em&gt;&lt;/strong&gt; We hit Tc again, and the Bc bucket is refilled with 937,500 tokens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;* Commit Bucket with Excess Bucket (Three-Color Policer) *&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can optionally add an Excess Bucket (Be).  This allows the traffic to  exceed the Bc bucket on a temporary basis.  The overall CIR should stay the same.  This is a three &quot;color&quot; policer: &lt;em&gt;conforming, exceeding, and violating&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Time = 0 ms --&lt;/em&gt;&lt;/strong&gt; Both buckets (Bc and Be) start out full.  Bc has 937,500 tokens, Be has 1,875,000 tokens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Time = 50 ms --&lt;/em&gt;&lt;/strong&gt; 2,000,000 bytes of traffic arrives.  The router first decrements the Bc bucket tokens.  It reduces the Bc bucket to zero.  The 937,500 bytes of traffic covered by Bc is considered &quot;conforming&quot; and has the &quot;conform-action&quot; applied to it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That leaves 1,062,500 bytes of traffic that doesn't have tokens yet.  Now the router dips into the Be bucket, and subtracts 1,062,500 tokens to cover the rest of the traffic.  These bytes are considered &quot;exceeding&quot; and will have the &quot;exceed-action&quot; applied to it.  In your example, the traffic would be dropped, but you could potentially remark or just transmit it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're keeping score at home, Bc now has zero tokens, Be has 812,500 tokens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Time = 75 ms --&lt;/em&gt;&lt;/strong&gt; Now, the router receives another 1,200,000 bytes of traffic.  The Bc bucket is empty, so no help there.  The Be bucket can help, so it covers the first 812,500 bytes of traffic with its tokens, and is now empty.  This traffic is considered &quot;exceeding&quot; and will have the &quot;exceed-action&quot; applied to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the buckets are dry, but there are still 387,500 bytes left to deal with.  This traffic is considered &quot;violating&quot; and is always dropped with CAR (You can do other things with it using MQC and the police command with &quot;violate-action&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Time = 187.5 ms --&lt;/em&gt;&lt;/strong&gt; Now we arrive at the first Tc interval, time to fill up our buckets.  A key point is that only &lt;strong&gt;&lt;em&gt;Bc&lt;/em&gt;&lt;/strong&gt; worth of tokens are refilled!  The Bc bucket is filled up first to 937,500.  The Be bucket REMAINS EMPTY.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Time = 375 ms --&lt;/em&gt;&lt;/strong&gt; It's been quiet, and we make it to the next Tc interval.  Bc worth of tokens are added to the Bc bucket.  Since the Bc bucket is already full, the excess tokens aren't lost - they're &quot;spilled over&quot; to the Be bucket instead.  Now the Bc bucket is full with 937,500 tokens and the Be bucket is partially full with 937,500 tokens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Time = 562.5 ms --&lt;/em&gt;&lt;/strong&gt; Quiet still, and we're at the next Tc.  Bc worth of tokens are added to the Bc bucket, which is already full.  All of it spills over into the Be bucket (which already has 937,500 tokens).  The Be fills all the way up to 1,875,000 tokens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;* Final Notes *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Your configuration isn't making use of the Be bucket.  You are&#xA;rate-limiting/policing using only the Bc bucket, which may have&#xA;unintended side effects if the policer/shaper sending data to you&#xA;isn't configured identically and isn't in sync Tc-wise.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;CAR/rate-limit is very old and deprecated.  Consider switching to MQC&#xA;and modern QoS to implement this, as it will give you more&#xA;information and options.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I totally ignore serialization delay (the time it takes to transmit&#xA;data on the line) above, and I'm quite sure the math doesn't work out&#xA;in a real scenario.  But the concepts are solid regardless of the&#xA;exact numbers in use.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;* MQC Example *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map PM-FA0/0-IN&#xA; class class-default&#xA;  police cir 5000000 bc 937500 be 1875000&#xA;!&#xA;interface Fa0/0&#xA; service-policy input PM-FA0/0-IN&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;* Sources *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;INE CCIE Training Material&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;CCIE #38955&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="155" LastEditorUserId="630" LastEditDate="2015-04-11T01:29:48.927" LastActivityDate="2015-04-11T01:29:48.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17631" PostTypeId="1" CreationDate="2015-04-01T18:32:02.983" Score="1" ViewCount="2444" Body="&lt;p&gt;A coworker and I recently migrated a core from old Dell switches to two &lt;code&gt;HP 5700&lt;/code&gt; running Comware 7 and IRF. What we have noticed is that every 5 days, the user accounts no longer accept the passwords. Even if no unsuccessful attempts were made whatsoever, all of the accounts lock every 5 days. We only have HTTPS and SSH protocols enabled for remote access over the VTY lines. What we find is that, when we enter the wrong password, it asks us to re-enter the correct one. However, once we do, it simply terminates the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way that I have found to fix it is by getting physical, console access, deleting the accounts, and re-creating them. Is there a way to fix this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, this is a sensitive client, so I will not be able to post the entire configuration, but I can post certain parts upon request:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VTY Line configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line vty 0 4&#xA;  authentication-mode scheme&#xA;  user-role network-admin&#xA;  user-role network-operator&#xA;  set authentication password hash $h$6$[password omitted]&#xA;  protocol inbound ssh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Local User Admin:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;local-user admin class manage&#xA;  access-limit 100&#xA;  service-type ssh terminal https&#xA;  authorization-attribute user-role network-admin&#xA;  authorization-attribute user-role network-operator&#xA;  password-control aging 90&#xA;  password-control login-attempt 10 exceed lock-time 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Local User User1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Local-user user1 class manage&#xA;  access-limit 3&#xA;  service-type ssh terminal https&#xA;  authorization-attribute user-role network-admin&#xA;  authorization-attribute user-role network-operator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Local User User2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;local-user user2 class manage&#xA;  service-type ssh https&#xA;  authorization-attribute user-role network-admin&#xA;  authorization-attribute user-role network-operator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="3836" LastEditorUserId="36720" LastEditDate="2020-01-02T13:57:46.620" LastActivityDate="2020-01-02T13:57:46.620" Title="Comware 7 - User Accounts Close Every 5 Days" Tags="|authentication|3-com|hp-comware|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17642" PostTypeId="1" CreationDate="2015-04-02T20:21:44.487" Score="1" ViewCount="11993" Body="&lt;p&gt;I want to route all internet traffic of people who connect to my ASA, through ASA, so anyone who connects, their internet IP will be my router IP. &#xA;This is my running config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;:&#xA;ASA Version 8.2(5) &#xA;!&#xA;hostname XXXXXXXXXXX&#xA;domain-name XXXXXX.com&#xA;names&#xA;name 192.168.1.0 AsusWireless&#xA;name 172.16.1.1 VPNGateway description VPNGateway&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address VPNGateway 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address xx.xx.xx.xx 255.255.255.248 &#xA;!&#xA;ftp mode passive&#xA;dns domain-lookup inside&#xA;dns domain-lookup outside&#xA;dns server-group DefaultDNS&#xA; domain-name XXXXXX.com&#xA;object-group protocol DM_INLINE_PROTOCOL_1&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_2&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_3&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group network DM_INLINE_NETWORK_2&#xA; network-object 172.16.1.0 255.255.255.0&#xA; network-object 172.16.16.0 255.255.255.0&#xA; network-object AsusWireless 255.255.255.0&#xA;object-group network DM_INLINE_NETWORK_1&#xA; network-object 172.16.1.0 255.255.255.0&#xA; network-object 172.16.16.0 255.255.255.0&#xA; network-object AsusWireless 255.255.255.0&#xA;object-group network DM_INLINE_NETWORK_3&#xA; network-object 172.16.1.0 255.255.255.0&#xA; network-object 172.16.16.0 255.255.255.0&#xA; network-object AsusWireless 255.255.255.0&#xA;object-group network DM_INLINE_NETWORK_4&#xA; network-object 172.16.1.0 255.255.255.0&#xA; network-object 172.16.16.0 255.255.255.0&#xA; network-object AsusWireless 255.255.255.0&#xA;object-group protocol DM_INLINE_PROTOCOL_4&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_5&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_6&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_7&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_8&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group network DM_INLINE_NETWORK_5&#xA; network-object 172.16.1.0 255.255.255.0&#xA; network-object 172.16.16.0 255.255.255.0&#xA; network-object AsusWireless 255.255.255.0&#xA;object-group network DM_INLINE_NETWORK_6&#xA; network-object 172.16.1.0 255.255.255.0&#xA; network-object 172.16.16.0 255.255.255.0&#xA; network-object AsusWireless 255.255.255.0&#xA; network-object xx.xx.xx.xx 255.255.255.248&#xA;object-group protocol DM_INLINE_PROTOCOL_10&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA; protocol-object igrp&#xA;object-group protocol DM_INLINE_PROTOCOL_9&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_11&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_12&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_1 object-group DM_INLINE_NETWORK_1 any &#xA;access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_8 xx.xx.xx.xx 255.255.255.248 any &#xA;access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_4 any object-group DM_INLINE_NETWORK_3 &#xA;access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_5 any xx.xx.xx.xx 255.255.255.248 &#xA;access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_10 xx.xx.xx.xx 255.255.255.248 object-group DM_INLINE_NETWORK_6 &#xA;access-list inside_access_in extended permit ip any any &#xA;access-list TUNNEL_LIST standard permit 172.16.1.0 255.255.255.0 &#xA;access-list TUNNEL_LIST standard permit 172.16.16.0 255.255.255.0 &#xA;access-list inside_in extended permit ip 172.16.16.0 255.255.255.0 any &#xA;access-list inside_out extended permit icmp any any log &#xA;access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_3 object-group DM_INLINE_NETWORK_4 any &#xA;access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_7 any xx.xx.xx.xx 255.255.255.248 &#xA;access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_2 any object-group DM_INLINE_NETWORK_2 &#xA;access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_6 xx.xx.xx.xx 255.255.255.248 any &#xA;access-list outside_access_in extended permit ip any any &#xA;access-list outside_access_in extended permit object-group DM_INLINE_PROTOCOL_11 172.16.16.0 255.255.255.0 172.16.1.0 255.255.255.0 &#xA;access-list inside_access_out extended permit object-group DM_INLINE_PROTOCOL_9 object-group DM_INLINE_NETWORK_5 any &#xA;access-list inside_access_out extended permit ip any any &#xA;access-list NO_NAT extended permit ip 172.16.1.0 255.255.255.0 172.16.16.0 255.255.255.0 &#xA;access-list NO_NAT extended permit ip any 172.16.16.16 255.255.255.248 &#xA;access-list outside_access_out extended permit ip any any &#xA;access-list outside_access_out extended permit object-group DM_INLINE_PROTOCOL_12 172.16.16.0 255.255.255.0 172.16.1.0 255.255.255.0 &#xA;access-list outside_access_out extended permit ip 172.16.16.0 255.255.255.0 any &#xA;access-list MyTunnel standard permit 172.16.1.0 255.255.255.0 &#xA;access-list MyTunnel standard permit host xx.xx.xx.xx &#xA;access-list MyTunnel standard permit host VPNGateway &#xA;access-list MyTunnel standard permit 172.16.16.0 255.255.255.0 &#xA;access-list inside_nat0_outbound extended permit ip 172.16.16.0 255.255.255.0 interface inside &#xA;access-list outside_in extended permit icmp any host xx.xx.xx.xx &#xA;access-list outside_in extended permit tcp host 24.44.185.66 host xx.xx.xx.xx eq ssh &#xA;access-list outside_in extended permit tcp host 67.81.133.13 host xx.xx.xx.xx eq ssh &#xA;access-list outside_in extended permit tcp 192.149.224.0 255.255.255.0 host xx.xx.xx.xx eq ssh &#xA;access-list outside_in extended permit ip 172.16.16.0 255.255.255.0 any log &#xA;access-list inside_nat_outbound extended permit ip 172.16.16.0 255.255.255.0 any &#xA;pager lines 24&#xA;logging console debugging&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;ip local pool VPN_CLIENTS 172.16.16.16-172.16.16.23 mask 255.255.255.0&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 0 access-list NO_NAT&#xA;nat (inside) 0 access-list inside_nat0_outbound outside&#xA;nat (inside) 1 access-list inside_nat_outbound&#xA;nat (inside) 1 172.16.1.0 255.255.255.0&#xA;nat (inside) 1 172.16.16.0 255.255.255.0&#xA;nat (inside) 1 AsusWireless 255.255.255.0&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;nat (outside) 0 172.16.16.0 255.255.255.0&#xA;nat (outside) 0 0.0.0.0 0.0.0.0&#xA;access-group inside_access_in in interface inside&#xA;access-group inside_access_out out interface inside&#xA;access-group outside_in in interface outside&#xA;access-group outside_access_out out interface outside&#xA;route outside 0.0.0.0 0.0.0.0 xx.xx.xx.xx 3&#xA;route inside 0.0.0.0 0.0.0.0 VPNGateway tunneled&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA; description &quot;AnyConnectACL&quot;&#xA; network-acl inside_in&#xA; network-acl inside_out&#xA;aaa authentication ssh console LOCAL &#xA;aaa authentication telnet console LOCAL &#xA;http server enable&#xA;http 172.16.1.0 255.255.255.0 inside&#xA;http AsusWireless 255.255.255.255 inside&#xA;http 172.16.16.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac &#xA;crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map outside_map interface outside&#xA;crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map inside_map interface inside&#xA;crypto isakmp enable inside&#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 10&#xA; authentication crack&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 20&#xA; authentication rsa-sig&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 30&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 40&#xA; authentication crack&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 50&#xA; authentication rsa-sig&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 60&#xA; authentication pre-share&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 70&#xA; authentication crack&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 80&#xA; authentication rsa-sig&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 90&#xA; authentication pre-share&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 100&#xA; authentication crack&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 110&#xA; authentication rsa-sig&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 120&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 130&#xA; authentication crack&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 140&#xA; authentication rsa-sig&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 150&#xA; authentication pre-share&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 170&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 5&#xA; lifetime 86400&#xA;vpn-addr-assign local reuse-delay 5&#xA;telnet 172.16.1.0 255.255.255.0 inside&#xA;telnet 172.16.16.0 255.255.255.0 inside&#xA;telnet timeout 5&#xA;ssh scopy enable&#xA;ssh 172.16.1.0 255.255.255.0 inside&#xA;ssh AsusWireless 255.255.255.255 inside&#xA;ssh 172.16.16.0 255.255.255.0 inside&#xA;ssh timeout 5&#xA;console timeout 0&#xA;management-access inside&#xA;dhcp-client update dns server both&#xA;dhcpd address 172.16.1.5-172.16.1.36 inside&#xA;dhcpd dns 8.8.8.8 8.8.4.4 interface inside&#xA;dhcpd enable inside&#xA;!&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;webvpn&#xA; enable inside&#xA; enable outside&#xA; anyconnect-essentials&#xA; svc image disk0:/anyconnect-win-3.1.05187-k9.pkg 1&#xA; svc image disk0:/anyconnect-linux-64-3.1.05187-k9.pkg 2&#xA; svc image disk0:/anyconnect-linux-3.1.05187-k9.pkg 3&#xA; svc image disk0:/anyconnect-macosx-i386-3.1.05187-k9.pkg 4&#xA; svc enable&#xA; tunnel-group-list enable&#xA;group-policy DefaultRAGroup internal&#xA;group-policy DefaultRAGroup attributes&#xA; dns-server value 172.16.1.2&#xA; vpn-tunnel-protocol l2tp-ipsec &#xA; default-domain value XXXXXX.com&#xA;group-policy TELECOMMUTERS internal&#xA;group-policy TELECOMMUTERS attributes&#xA; dns-server value 8.8.8.8 8.8.4.4&#xA; vpn-tunnel-protocol svc &#xA; default-domain value XXXXXX.com&#xA; address-pools value VPN_CLIENTS&#xA; webvpn&#xA;  svc ask enable default svc timeout 10&#xA;group-policy DfltGrpPolicy attributes&#xA; dns-server value 172.16.1.2&#xA; vpn-tunnel-protocol webvpn&#xA; split-tunnel-network-list value TUNNEL_LIST&#xA; split-tunnel-all-dns enable&#xA; webvpn&#xA;  svc rekey method ssl&#xA;  svc compression deflate&#xA;group-policy GroupPolicy1 internal&#xA;group-policy GroupPolicy1 attributes&#xA; wins-server none&#xA; dns-server value 172.16.1.2 8.8.4.4&#xA; vpn-filter value inside_in&#xA; vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn&#xA; group-lock value AnyConnectProfile&#xA; split-tunnel-policy tunnelall&#xA; split-tunnel-network-list value MyTunnel&#xA; default-domain value XXXXXX.com&#xA;tunnel-group DefaultRAGroup general-attributes&#xA; address-pool VPN_CLIENTS&#xA; default-group-policy DefaultRAGroup&#xA;tunnel-group DefaultRAGroup ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group AnyConnectProfile type remote-access&#xA;tunnel-group AnyConnectProfile general-attributes&#xA; address-pool VPN_CLIENTS&#xA; authorization-server-group LOCAL&#xA; default-group-policy GroupPolicy1&#xA;tunnel-group AnyConnectProfile webvpn-attributes&#xA; group-alias AnyConnectProfile enable&#xA;tunnel-group AnyConnectProfile ppp-attributes&#xA; no authentication chap&#xA; no authentication ms-chap-v1&#xA; authentication ms-chap-v2&#xA;tunnel-group TELECOMMUTERS type remote-access&#xA;tunnel-group TELECOMMUTERS general-attributes&#xA; address-pool VPN_CLIENTS&#xA; default-group-policy TELECOMMUTERS&#xA;tunnel-group TELECOMMUTERS webvpn-attributes&#xA; group-alias TELECOMMUTERS enable&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect ip-options &#xA;  inspect netbios &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect skinny  &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect sunrpc &#xA;  inspect tftp &#xA;  inspect sip  &#xA;  inspect xdmcp &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;Cryptochecksum:161562eb1de604fe1da262fe933267a3&#xA;: end&#xA;asdm location AsusWireless 255.255.255.0 inside&#xA;asdm location VPNGateway 255.255.255.255 inside&#xA;no asdm history enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I prefer doing things in ASDM as I'm familiar with it, but if you tell me SSH commands, I'll figure out and I'll do it. what I'm doing wrong. Full-tunnel is enabled, I have access to local LAN computers (which is necessary and I need it), but I also want everyones internet IP to be my gateway IP. Please advice &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not duplicate, I don't want to let users use their internet IP and split tunneling. I want full tunnel and their Internet IP should be my router IP.&lt;/p&gt;&#xA;" OwnerUserId="14663" LastEditorUserId="14663" LastEditDate="2015-04-02T20:47:29.560" LastActivityDate="2015-06-02T14:37:12.723" Title="Cisco ASA Full Tunnel Internet through VPN" Tags="|cisco|routing|cisco-asa|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17643" PostTypeId="2" ParentId="17642" CreationDate="2015-04-02T20:53:12.093" Score="0" Body="&lt;p&gt;I'll provide a simple example that should help you along:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! start&#xA;!&#xA;!&#xA;! FIRST LETS CREATE OBJECT GROUPS THAT REFERENCE&#xA;! AN INTERNAL NETWORK AND THEN THE VPN NET&#xA;!&#xA;object-group network GRP_INTERNAL_NET&#xA; network-object 10.0.0.0 255.0.0.0&#xA;!&#xA;object-group network GRP_VPN_REMOTE_ACCESS_NET&#xA; network-object 10.10.0.0 255.255.255.0&#xA;! &#xA;!&#xA;!&#xA;! NOW LETS CREATE THE ACLS TO PERMIT ACCESS&#xA;! TO THE INTERNAL NET AND THEN ALLOW INTERNET ACCESS&#xA;access-list VPN_REMOTE_ACCESS_PERMISSIONS extended permit ip object-group GRP_VPN_REMOTE_ACCESS_NET object-group GRP_INTERNAL_NET&#xA;access-list VPN_REMOTE_ACCESS_PERMISSIONS extended permit ip object-group GRP_VPN_REMOTE_ACCESS_NET any &#xA;!&#xA;!&#xA;!&#xA;! CREATE A LOCAL DHCP POOL FOR VPN IP ASSIGNMENT&#xA;!&#xA;ip local pool VPN_IP_POOL 10.10.0.1-10.10.0.250 mask 255.255.255.0&#xA;!&#xA;!&#xA;!&#xA;! CREATE THE POLICY TO TUNNEL EVERYTHING&#xA;!&#xA;group-policy TUNNEL_EVERYTHING internal&#xA;group-policy TUNNEL_EVERYTHING attributes&#xA; vpn-filter value VPN_REMOTE_ACCESS_PERMISSIONS&#xA; vpn-tunnel-protocol svc &#xA; split-tunnel-policy tunnelall&#xA; webvpn&#xA;  svc ask enable default svc&#xA;!&#xA;!&#xA;!&#xA;! CREATE THE TUNNEL GROUP AND DON'T FORGET TO ADD&#xA;! YOUR AUTHENTICATION MECHANISM AND THEN ASSIGN THE &#xA;! TUNNEL-EVERYTHING POLICY&#xA;!&#xA;tunnel-group TUNNEL_EVERYTHING type remote-access&#xA;tunnel-group TUNNEL_EVERYTHING general-attributes&#xA; address-pool VPN_IP_POOL&#xA; authentication-server-group ZZQQ_ADD_YOUR_AUTHENTICATION_MECHANISM&#xA; default-group-policy TUNNEL_EVERYTHING&#xA;!&#xA;!&#xA;!&#xA;! DEFINE A URL FOR THE ANYCONNECT CLIENT TO REFERENCE&#xA;! THIS TUNNEL EVERYTHING POLICY&#xA;!&#xA;tunnel-group TUNNEL_EVERYTHING webvpn-attributes&#xA; group-url https://ZZQQ_YOUR_DOMAIN.COM/all enable&#xA;!&#xA;!&#xA;! end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5601" LastActivityDate="2015-04-02T20:53:12.093" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17645" PostTypeId="2" ParentId="17620" CreationDate="2015-04-02T22:02:39.447" Score="2" Body="&lt;p&gt;Looks like the most likely culprit is gratuitous ARP and that's how Wireshark reports the IP. Look at the end of the examples section on this page:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://wiki.wireshark.org/Gratuitous_ARP&quot; rel=&quot;nofollow&quot;&gt;https://wiki.wireshark.org/Gratuitous_ARP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-04-02T22:02:39.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17647" PostTypeId="1" AcceptedAnswerId="17652" CreationDate="2015-04-02T23:38:59.710" Score="1" ViewCount="749" Body="&lt;p&gt;Note: the below examples are probably not realistic but work with the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say I am attempting to plan for the future and I allocate a 10.1.0.0/16 for a certain floor of a building but do not subnet it, because I am unsure of what devices are going to be used because manglement. So people start moving into the floor and hooking up devices. At a certain point I can get a general idea of the device distribution and decide to split this subnet into 2, one for PC's and one for IP phones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible to do on a running network without having to change the existing client's configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, how easy is it to do in an environment with static addressing vs DHCP addressing?&lt;/p&gt;&#xA;" OwnerUserId="4869" LastActivityDate="2015-04-03T05:30:35.220" Title="splitting an already in use subnet" Tags="|ipv4|subnet|design|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17648" PostTypeId="2" ParentId="17487" CreationDate="2015-04-02T23:47:12.030" Score="2" Body="&lt;p&gt;Keep in mind that while Wikipedia is good for &quot;general&quot; understanding, it isn't always fully accurate and is never a definitive source for anything since it is user created/maintained.  The more technical or specialized the topic (which often goes along with fewer knowledgeable users), the more likely the existence of errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, the quoted statement from Wikipedia does go on to list the  &quot;six modes&quot; of operation but of the six modes listed, it doesn't include &quot;promiscuous mode&quot; which is referenced in the two or three sentences immediately preceeding the quote.  So is this a seventh mode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, none of the six listed modes references WiFi Direct, so would that provide additional &quot;modes&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;six modes of operation&quot; could be based off of terminology used in driver development.  Specifically, the &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/ff547678.aspx&quot; rel=&quot;nofollow&quot; title=&quot;DOT11_CURRENT_OPERATION_MODE structure&quot;&gt;Microsoft miniport driver documentation&lt;/a&gt; lists six possible modes of operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also appeas that some Linux or open source drivers reference at least &quot;Master Mode,&quot; &quot;Ad Hoc Mode,&quot; and/or &quot;Monitor Mode&quot; in some of their documentation and/or correspondence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK, the IEEE 802.11-2012 standard only uses the &quot;ad hoc&quot; and &quot;mesh&quot; terminology that are listed as modes of operation in this Wikipeida article.  However, it doesn't reference them as &quot;modes of operation&quot; and generally doesn't use them in the same way.  For instance, the standard uses the term IBSS (or independent BSS) instead of ad hoc and defines ad hoc as:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Often used as a venacular (&lt;a href=&quot;http://en.wikipedia.org/wiki/Sic&quot; rel=&quot;nofollow&quot;&gt;sic&lt;/a&gt;) term for an independent basic service set (IBSS)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-04-02T23:47:12.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17649" PostTypeId="2" ParentId="17503" CreationDate="2015-04-02T23:52:57.130" Score="2" Body="&lt;p&gt;To directly answer your question, I will provide a quote directly from the 802.11-2012 standard:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An ESS is the union of the infrastructure BSSs with the same SSID connected by a DS. The ESS does not include the DS.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This makes it very clear that while the DS is essential to the establishment of the ESS, the DS is not part of the ESS.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-04-02T23:52:57.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17650" PostTypeId="2" ParentId="17647" CreationDate="2015-04-02T23:55:49.817" Score="0" Body="&lt;p&gt;If two subnet's is what you need, why not use 10.1.0.0 /17 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That way, you can have 10.1.0.0 /17 for PC's and 10.1.128.0 /17 for IP phones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll have 32766 hosts in each subnet.&lt;/p&gt;&#xA;" OwnerUserId="14703" LastActivityDate="2015-04-02T23:55:49.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17651" PostTypeId="1" CreationDate="2015-04-03T05:08:27.923" Score="0" ViewCount="2389" Body="&lt;p&gt;I desire to have a transparent bridge between two locations, so i bought these two UBNT devices and use as such:&#xA;Language: english, Country: nepal&#xA;Version: Nanostation M5, XW.v5.5.9, build 21734 (latest)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC#1: 172.31.1.1/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;|&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NSM5#1 - WDS Bridge AP mode 172.31.2.1/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...... (-50db indoor testing at this time, dbm is ~20 to keep not so hot))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NSM5#2 - WDS Bridge Station mode 172.31.2.2/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;|&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC#2: 172.31.1.2/16&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;i can ping from PC#1 to both NSM5#1 and NSM5#2&lt;/li&gt;&#xA;&lt;li&gt;i can ping from PC#2 to both NSM5#1 and NSM5#2&lt;/li&gt;&#xA;&lt;li&gt;i can web manage from PC#1 to both NSM5#1 and NSM5#2&lt;/li&gt;&#xA;&lt;li&gt;i can web manage from PC#2 to both NSM5#1 and NSM5#2&lt;/li&gt;&#xA;&lt;li&gt;from PC#1 i can not ping PC#2. (but the arp request is correct and sends ICMP via wireshark, PC#2 does not see the ICMP)&lt;/li&gt;&#xA;&lt;li&gt;from PC#2 i can not ping PC#1.  (but the arp request is correct and sends ICMP via wireshark, PC#1 does not see the ICMP)&lt;/li&gt;&#xA;&lt;li&gt;I have disabled IP Auto Alias, STP, Discovery and CDP to make the wireshark packets less. I do see a proprietary UBNT &quot;LOOP&quot; packet at some regular interval, i supose to detect in the bridge has a loop or not. It would be nice to disable this, in order to easier debug this issue.&lt;/li&gt;&#xA;&lt;li&gt;there is no overlapping networks defined in the windows 7 PCs being used.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Appreciate your timinely help to get this simple transparent bridge to work. Strange the ARPs work, but the packets do not seem to be transparently bridged?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is pics of the NSM5-AP:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/z3aer.jpg&quot; alt=&quot;NSM5.Wireless.Tab.AP&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/QIOVy.jpg&quot; alt=&quot;NSM5.Network.Tab.AP&quot;&gt;&#xA;Here is pics of the NSM5-Station:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/rFIpp.jpg&quot; alt=&quot;NSM5.Wireless.Tab.Station&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/I21s5.jpg&quot; alt=&quot;NSM5.Network.Tab.Station&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14705" LastActivityDate="2016-10-12T05:55:29.760" Title="Transparent WDS Bridging not working as expected NanoStation M5 devices" Tags="|wireless|layer2|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17652" PostTypeId="2" ParentId="17647" CreationDate="2015-04-03T05:30:35.220" Score="1" Body="&lt;p&gt;In Theory&amp;trade;, and In Practice&amp;trade;, this never goes well. Presumably devices of both types are scattered across the entire /16. Thus the devices within the LAN will have to be reconfigured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they &lt;em&gt;all&lt;/em&gt; use DHCP, then it's a fairly simple process of changing the DHCP setup. &lt;em&gt;First&lt;/em&gt;, drop the lease time to something unreasonably low to speed up convergence to the new subnets -- if your current lease is 1 week, you'll have a mess for at least a week before everything is forced to new settings; if the lease time has been dropped to 15min, it won't take so long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, no real world network is 100% DHCP. There are always static devices. So they will have to be changed manually. Which means you have to know well in advance which machines need attention.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;A word on mis-matched subnet masks. This is, as a rule, &lt;strong&gt;to be avoided&lt;/strong&gt;. However, in instances such as this, it will happen, however briefly. In the given example -- splitting a /16 into smaller subnets (2 /17's), the router between those two new subnets can facilitate &quot;off-network&quot; access through the practice of &lt;em&gt;proxy-arp&lt;/em&gt;. Please note, this is the only acceptable exception for when proxy-arp should be allowed; and then, &lt;em&gt;as a temporary measure&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the device still has to be in the correct subnet. The router interfaces will be /17's. A host in the wrong new subnet will be ignored by the router.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-03T05:30:35.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17656" PostTypeId="1" CreationDate="2015-04-03T06:29:39.717" Score="1" ViewCount="117" Body="&lt;p&gt;When a source node sends a packet to  a unicast destination, what will be the entry in the frame destination address(layer2 mac address)? will it be default router's mac address?&lt;/p&gt;&#xA;" OwnerUserId="14707" LastActivityDate="2016-05-13T10:53:17.433" Title="When a source node sends a packet to a unicast destination, what will be the entry in the frame destination address(layer2 mac address)?" Tags="|switch|router|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17659" PostTypeId="2" ParentId="17656" CreationDate="2015-04-03T09:07:59.037" Score="2" Body="&lt;p&gt;It's depends whether the destination is within the subnet or not. If it's within the subnet, it'll put the destination device's MAC itself (assuming ARP has already done it's job). If the device is outside the network, then packet will be forwarded to the default gateway, hence, the MAC address of the default gateway. &lt;/p&gt;&#xA;" OwnerUserId="14703" LastEditorUserId="14703" LastEditDate="2015-04-03T09:13:17.687" LastActivityDate="2015-04-03T09:13:17.687" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17661" PostTypeId="2" ParentId="17651" CreationDate="2015-04-03T10:11:12.190" Score="1" Body="&lt;p&gt;After a variety of setting changing, i discovered that the real culprit was Norton firewall. Setting up trust exception for the opposite MAC fixed this issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only other issues have also been with Java 8 not allowing me to see airView, because UBNT does not have a valid cert in the web server. I had to back down to java 7.x and set security to medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you. but this question is answered by myself.&lt;/p&gt;&#xA;" OwnerUserId="14705" LastActivityDate="2015-04-03T10:11:12.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17663" PostTypeId="1" AcceptedAnswerId="17669" CreationDate="2015-04-03T12:08:41.880" Score="1" ViewCount="341" Body="&lt;p&gt;I have been tasked with a DC installation of ten servers. I myself, am a software engineer and not a network engineer (welcome to enterprise!), so I am a bit puzzled over this. I have been assigned the IP ranges, but these are two separate ones. To be precise (where the first 3 octets are the same for each):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;xxx.xxx.xxx.32/29&lt;/li&gt;&#xA;&lt;li&gt;xxx.xxx.xxx.48/29&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have been told the usable range in each of these is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;.33 – .38&lt;/li&gt;&#xA;&lt;li&gt;.49 - .54&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My question: Presumably, do I now have two default gateways that I need to configure. Some servers connected to xxx.xxx.xxx.32 and others xxx.xxx.xxx.48? The only network equipment at my disposal is an L2 switch. Is it just as simple as linking my equipment up to the L2 switch (some servers configured on one gateway and some another) and then on to the upstream switch/router? Will my switch support what is essentially 2 different subnets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I sense I am missing a piece of crucial information to get this question answered.&lt;/p&gt;&#xA;" OwnerUserId="14712" LastActivityDate="2015-04-03T16:15:16.667" Title="Multiple IP ranges at DC, how do I set this up?" Tags="|routing|switch|subnet|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17667" PostTypeId="2" ParentId="17663" CreationDate="2015-04-03T14:48:54.057" Score="2" Body="&lt;p&gt;To the question of default gateways: yes there will need to be a different gateway for each subnet, and that info should have been provided.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To the question of whether or not you can plug it in to one switch and expect it to work: there is no reason a L2 switch cannot carry two IP subnets (since it doesn't care about subnets at all) but in most enterprises, it is not done this way.  More commonly, a switch will have ports assigned to a VLAN and thereby two subnets will exist on specific ports on the switch.  If you were given specific switch port assignments for your servers, you will need to heed those with precision.  If you are providing your own unmanaged switch and you only have one port assigned from your enterprise, then it is probably a mixed subnet.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-04-03T14:48:54.057" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17669" PostTypeId="2" ParentId="17663" CreationDate="2015-04-03T16:15:16.667" Score="3" Body="&lt;p&gt;The configuration on the switch depends on the router configuration.  If the router is configured with a logical interface (sub-interface) for each subnet, then you need to configure a VLAN for each subnet and trunk both VLANs to the router.  That means the uplink to the router will have both VLANs on it, using tagging to keep them separate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, if the router interface is configured with a primary and secondary IP address, then you do not need any configuration on the switch - a single VLAN will do.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In either case, there will be a default gateway for each subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage of the first method is that it gives you a mechanism to handle the two subnets differently.  For example, perhaps you want to apply a different security or QoS policy for each subnet.  If that's not the case (nor ever will be), then it really doesn't matter.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-04-03T16:15:16.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17672" PostTypeId="2" ParentId="3843" CreationDate="2015-04-03T18:02:59.903" Score="-1" Body="&lt;p&gt;vSwitch-&gt;Promiscuous-Mode-&gt;Accept&#xA;volia&lt;/p&gt;&#xA;" OwnerUserId="14720" LastActivityDate="2015-04-03T18:02:59.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17673" PostTypeId="1" CreationDate="2015-04-03T18:35:06.780" Score="3" ViewCount="8086" Body="&lt;p&gt;I'm currently setting up my new network using D-Link DGS-1510 series gigabit stackable smart managed switches. It is the first time i use this L2 &amp;amp; L3 switches and I'm trying to setup the following scenario:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;    Internet&#xA;       |&#xA;       |&#xA;    firewall&#xA;       | (internal IP: 192.168.1.254)&#xA;       |&#xA;       |&#xA;+-------------+&#xA;| L3 - switch |&#xA;+-------------+&#xA;   |       |&#xA;   |       |&#xA;   |       | (subnet: 192.168.5.0/24)&#xA;   |   +-----------+&#xA;   |   | L2-switch |&#xA;   |   +-----------+&#xA;   |      |  |  |  |  (connections to client computers)&#xA;   |&#xA;   |&#xA;   | (subnet: 192.168.9.0/24)&#xA;+-----------+ &#xA;| L2-switch |&#xA;+-----------+&#xA;  |  |  |  |  (connections to servers)&#xA;&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The L2 &amp;amp; L3 switches are all DGS-1510 series devices. Each computer located in the two subnets, should be able to access the internet. Also should it be possible that the clients can access the servers, and the servers should be allowed to access the clients. Also the servers should be able to talk to other servers in the same network and the client should be able to access all other clients in the same network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore I created 2 VLANs on the L3 switch. The first one for the 192.168.9.0 network. I gave the port, where the L2 switch was connected, the IP Address 192.168.9.254. On the L2-Switch I added this IP Address as Gateway. For the other network i created the same configuration except that the 9 was replaced by the 9.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally I added the IP 192.168.1.254 (firewall) as gateway to the L3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was enough, that the each computer from each network was able to access the internet. But I was not able to send a ping from network 9 to network 5 and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my first VLAN and routing configuration and I cannot find suitable tutorials for my problems. Is there someone who can help me with my configuration or does know some good tutorials.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&#xA;Andi&lt;/p&gt;&#xA;" OwnerUserId="14719" LastActivityDate="2017-07-05T20:11:02.750" Title="D-Link L2 &amp; L3 Network Setup" Tags="|routing|subnet|layer2|layer3|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17674" PostTypeId="1" AcceptedAnswerId="17675" CreationDate="2015-04-03T18:43:18.940" Score="2" ViewCount="157" Body="&lt;p&gt;In a network with a layer 2 switch between the devices and the router, are the packets MAC addresses set to that of the port on the switch that they are connected to? and if so, how does the switch know to forward the packet to the MAC address of the router?&lt;/p&gt;&#xA;" OwnerUserId="14250" LastActivityDate="2015-04-03T18:56:56.313" Title="What modifications in regards to the destination MAC address do layer 2 switches make?" Tags="|router|mac-address|layer2|osi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17675" PostTypeId="2" ParentId="17674" CreationDate="2015-04-03T18:56:56.313" Score="2" Body="&lt;p&gt;Layer 2 switches are also called transparent bridges (OK, a long time ago), which means they do not modify the frame.  They examine the destination MAC address and forward it based on their forwarding table.  It is up to the sender to determine the destination MAC address.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-04-03T18:56:56.313" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17676" PostTypeId="1" AcceptedAnswerId="17677" CreationDate="2015-04-03T19:19:17.893" Score="2" ViewCount="340" Body="&lt;p&gt;I understand how to configure VLSM, but I'm still confused why it would be needed if we have Network Address Translation. My understanding is that a local area network can use NAT to have a user or a large amount of users with private IP addresses, but still use a single unique public IP address for all those users.&#xA;So what if 10-242 private addresses are wasted? They are free aren't they?&#xA;Where does my logic fall apart?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Artekis&lt;/p&gt;&#xA;" OwnerUserId="14714" LastActivityDate="2015-04-03T19:29:14.150" Title="How does VLSM save addresses if we can just use NAT?" Tags="|nat|subnet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17677" PostTypeId="2" ParentId="17676" CreationDate="2015-04-03T19:29:14.150" Score="2" Body="&lt;p&gt;Variable Length Subnet Masks was an effort to enable more &lt;em&gt;efficient&lt;/em&gt; use of public address space. NAT enables us to use &lt;em&gt;fewer&lt;/em&gt; public addresses, (by enabling usage of private addresses internally.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the two ideas aren't directly related, even though both help reduce public address space waste.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2015-04-03T19:29:14.150" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17679" PostTypeId="1" AcceptedAnswerId="17690" CreationDate="2015-04-03T23:11:13.700" Score="2" ViewCount="180" Body="&lt;p&gt;Hi Network engineering,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having an issue with my network design.  My goal is to have two networks behind a gateway device.  &quot;Circle1&quot; would contain my internet facing proxy servers and &quot;Circle2&quot; would contain any number of app servers.  &quot;Cirle1&quot; should connect to &quot;Circle2&quot; directly.  This works great in most cases.  I am however running into an issue where any packets originating from &quot;Circle2&quot; with a destination of the PUBLIC interface of a machine on &quot;Circle1&quot; seem to fall off somewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The frusterating thing is that my packet captures of all points show the packet at the very least leaving the gateway server bound for 172.16.0.100 but &lt;strike&gt;do not show any packets coming into that server&lt;/strike&gt; they didn't show up in &lt;code&gt;stdout&lt;/code&gt; when running &lt;code&gt;tcpdump&lt;/code&gt; but they do show up when looking at the dump after using wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this the result of my network architecture or configuration issue?  Are packets not permitted to enter an interface for a machine for which the machine already has a different interface listening on that source network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some quick notes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;all hosts are running CentOS 7&lt;/li&gt;&#xA;&lt;li&gt;SELinux is disabled for troubleshooting purposes&lt;/li&gt;&#xA;&lt;li&gt;iptables have been flushed with the exception of the gateway which contains 1 rule (&lt;code&gt;iptables -t nat -I POSTROUTING -s 10.0.0.0/8 -o enp0s3 -j MASQUERADE&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;I'm running on virtualbox and have not attempted to confirm this configuration on physical hosts :-/ sorry not enough machines.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/PqDvO.png&quot; alt=&quot;quick network diagram&quot;&gt;&#xA;&lt;strong&gt;Note:&lt;/strong&gt; the red addresses should would be replaced with public facing ip addresses in a non-lab environment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem:&lt;/strong&gt;&#xA;Traffic from 10.1.0.0/24 to 172.16.0.100 is not recieved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debugging steps:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Setup a network similar to the one presented in the diagram above.&lt;/li&gt;&#xA;&lt;li&gt;Execute &lt;code&gt;ping 172.16.0.100&lt;/code&gt; from the app server at 10.1.0.101.&lt;/li&gt;&#xA;&lt;li&gt;Traffic too and from all networks to ensure there is no routing errors.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Expected results:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The app server will send the ICMP packet to the web proxy server (172.16.0.100) via the default gateway (10.1.0.1)&lt;/li&gt;&#xA;&lt;li&gt;The default gateway will send the packet to the web proxy server (172.16.0.100)&lt;/li&gt;&#xA;&lt;li&gt;The web proxy server will accept the ICMP packet [source-ip 10.1.0.101; destination-ip 172.16.0.100]&lt;/li&gt;&#xA;&lt;li&gt;The web proxy server will generate an ICMP reply packet [source-ip 172.16.0.100; destination-ip 10.1.0.101]&lt;/li&gt;&#xA;&lt;li&gt;The web proxy server will send the generated packet directly to the app server via enp0s8&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Actual results:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The app server sends the ICMP packet to the web proxy server (172.16.0.100) via the default gateway (10.1.0.1)&lt;/li&gt;&#xA;&lt;li&gt;The default gateway sends the packet to the web proxy server (172.16.0.100)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strike&gt; The web proxy doesn't seem to recieve the packet (&lt;code&gt;tcpdump -i enp0s3&lt;/code&gt; does not show any packets entering the system)&lt;/strike&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;EDIT FOR STEP 3&lt;/strong&gt;  It looks like packet does make it to the proxy server but the &lt;code&gt;tcpdump&lt;/code&gt; command doesn't show it in stdout, it does show it when using the &lt;code&gt;-w&lt;/code&gt; option.  I'm baffled.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Debugging tool outputs:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Script &lt;code&gt;ip addr &amp;amp;&amp;amp; ip route&lt;/code&gt; output &lt;a href=&quot;http://pastebin.com/raw.php?i=rX3exndR&quot; rel=&quot;nofollow noreferrer&quot;&gt;app-server&lt;/a&gt;, &lt;a href=&quot;http://pastebin.com/raw.php?i=SS66Bfaa&quot; rel=&quot;nofollow noreferrer&quot;&gt;gateway-server&lt;/a&gt;, &lt;a href=&quot;http://pastebin.com/raw.php?i=sBEaEF2P&quot; rel=&quot;nofollow noreferrer&quot;&gt;proxy-server&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Wireshark compatible packet captures&#xA;&lt;a href=&quot;http://owncloud-special-public.s3-website-us-east-1.amazonaws.com/proxy-enp0s3.cap&quot; rel=&quot;nofollow noreferrer&quot;&gt;proxy-enp0s3&lt;/a&gt;, &lt;a href=&quot;http://owncloud-special-public.s3-website-us-east-1.amazonaws.com/proxy-enp0s8.cap&quot; rel=&quot;nofollow noreferrer&quot;&gt;proxy-enp0s8&lt;/a&gt; (empty), &lt;a href=&quot;http://owncloud-special-public.s3-website-us-east-1.amazonaws.com/gateway-enp0s8.cap&quot; rel=&quot;nofollow noreferrer&quot;&gt;gateway-enp0s8&lt;/a&gt;, &lt;a href=&quot;http://owncloud-special-public.s3-website-us-east-1.amazonaws.com/gateway-enp0s9.cap&quot; rel=&quot;nofollow noreferrer&quot;&gt;gateway-enp0s9&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks to those of you who've taken the time to try and help me.  I do apologize about the rather verbose format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;more testing due to confusion caused by tcpdump&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tcpdump -w cap&lt;/code&gt; does show all of the packets I'm expecting while &lt;code&gt;tcpdump&lt;/code&gt; does not show any via stdout.  It does however show a large number of packets dropped by kernel.  This occurs regardless of run time or use of &lt;code&gt;-B 4096&lt;/code&gt; to expand the tcpdump buffer.  It seems pretty obvious that the OS is rejecting the packets but I'm not sure why.  (tcpdump hangs briefly when closing after piping to stdout but I'm not sure if that is related)&lt;/p&gt;&#xA;" OwnerUserId="14724" LastEditorUserId="14724" LastEditDate="2015-04-03T23:47:38.853" LastActivityDate="2015-04-04T22:46:55.407" Title="What happens to this packet? (routed to machine on local network)" Tags="|routing|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17681" PostTypeId="1" CreationDate="2015-04-04T09:29:17.397" Score="1" ViewCount="1228" Body="&lt;p&gt;&lt;strong&gt;MY QUESTIONS ARE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What could be the cause of this nondeterministic HP switch behaviour&#xA;?! &lt;/li&gt;&#xA;&lt;li&gt;Why sometimes devices make 100Mb link and sometimes 1Gb ?!&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UUP6S.png&quot; alt=&quot;HP 1810-24G and Mikrotik CloudCore1036 - 1Gb link negotiation problem between &quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At above picture You can see part of my network scheme. Main router based on &lt;strong&gt;Mikrotik CloudCore1036&lt;/strong&gt; within one bridge and &lt;strong&gt;HP 1810-24G&lt;/strong&gt; switches within default VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to make bonding between them using &lt;strong&gt;802.3ad&lt;/strong&gt; protocol because I know that my &lt;strong&gt;HP&lt;/strong&gt; support this old one and I didn't have time to make additional experimental configuration (&lt;strong&gt;balanced-rr&lt;/strong&gt; doesn't work because makes huge issue with ARP broadcasting along the whole network !!!). I noticed that bonding didn`t work properly because of links speeds between devices:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;CC1036&lt;/strong&gt; announce to the &lt;strong&gt;HP&lt;/strong&gt; all full-duplex link speeds like 10/100/1000,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;HP&lt;/strong&gt; announce only full-duplex 10/100 at &lt;strong&gt;E23&lt;/strong&gt; but at &lt;strong&gt;E24&lt;/strong&gt; also 1000 for example.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What is more strange sometimes &lt;strong&gt;HP&lt;/strong&gt; gives to the LAN hosts 100Mb speed and sometimes 1Gb speed at the same ports - hosts always have 1Gb NICs. All &lt;strong&gt;HP&lt;/strong&gt; ports are at admin mode and they have &lt;strong&gt;Autonegotiation&lt;/strong&gt; enabled - &lt;strong&gt;CC1036&lt;/strong&gt; also. I cheked whole wiring between &lt;strong&gt;CC1036&lt;/strong&gt; and &lt;strong&gt;HP&lt;/strong&gt; and all strands are ok. Top cable lenght is about 11m Cat5E.&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="8499" LastEditDate="2018-02-14T16:47:19.223" LastActivityDate="2018-02-14T16:47:19.223" Title="HP 1810-24G and Mikrotik CloudCore1036 - 1Gb link negotiation problem between" Tags="|switch|hp|etherchannel|autonegotiation|" AnswerCount="1" CommentCount="5" ClosedDate="2017-03-02T12:09:21.673" ContentLicense="CC BY-SA 3.0" />
  <row Id="17682" PostTypeId="1" CreationDate="2015-04-04T11:25:20.953" Score="2" ViewCount="9145" Body="&lt;p&gt;&lt;strong&gt;MY QUESTIONS ARE&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why configuration at layer 2 at layer 3 device at different site of&#xA;LAN caused problem at another part of the network ?!&lt;/li&gt;&#xA;&lt;li&gt;What kind of mechanism at CC1036 has been activated that cause gaps&#xA;in the ARP tables across the entire network many devices further ?!&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XNXlZ.png&quot; alt=&quot;ARP issue among whole network caused by MikroTik CloudCore1036 router and HP 1810-24G switch missconfiguration&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At above picture You can see part of my network scheme. Main router based on Mikrotik &lt;strong&gt;CloudCore1036&lt;/strong&gt; within one bridge and &lt;strong&gt;HP&lt;/strong&gt; switches &lt;strong&gt;1810-24G&lt;/strong&gt; and &lt;strong&gt;1810-8G&lt;/strong&gt; - all default configured within default VLAN. All &lt;strong&gt;CC1036&lt;/strong&gt; interfaces were &lt;strong&gt;arp-proxy&lt;/strong&gt; and &lt;strong&gt;arp-enabled&lt;/strong&gt; mode.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;CloudCore 1036&lt;/strong&gt; - main router with one bridge and included one link bond (causing issue &lt;strong&gt;balanced-rr&lt;/strong&gt; and not causing issue &lt;strong&gt;802.3ad&lt;/strong&gt;,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;swt-d-x&lt;/strong&gt; switches - my distribution layer switches; all &lt;strong&gt;HP 1810-24G - J9803A&lt;/strong&gt; with one default VLAN,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;swt-a-x&lt;/strong&gt; switches - my acces layer switches; all &lt;strong&gt;HP 1810-8G - J9802A&lt;/strong&gt; with one default VLAN,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Server NAS&lt;/strong&gt;- my local storage server,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Local station x&lt;/strong&gt; - hosts connected to the network using &lt;strong&gt;DHCP server&lt;/strong&gt; defined at &lt;strong&gt;CC1036&lt;/strong&gt; MikrotikRouter,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Bonding-1&lt;/strong&gt; - I bounded 3 links between &lt;strong&gt;CC1036&lt;/strong&gt; and &lt;strong&gt;swt-d-1&lt;/strong&gt; switch; at &lt;strong&gt;swt-d-1&lt;/strong&gt; I used &lt;strong&gt;trunks&lt;/strong&gt; at &lt;strong&gt;E22&lt;/strong&gt;,&lt;strong&gt;E23&lt;/strong&gt;,&lt;strong&gt;E24&lt;/strong&gt; interfaces and at &lt;strong&gt;CC1036&lt;/strong&gt; at &lt;strong&gt;E1&lt;/strong&gt;,&lt;strong&gt;E2&lt;/strong&gt;,&lt;strong&gt;E3&lt;/strong&gt; I used &lt;strong&gt;balanced-rr&lt;/strong&gt; protocol and I add that Bond to the bridge.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Root cause analysis:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first look everything was fine - all hosts had access to the Internet and between them along the LAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First symptom was loosing connectivity to the &lt;strong&gt;NAS server&lt;/strong&gt; from whole LAN site and from Internet using VPN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also some host from &lt;strong&gt;Local station 3&lt;/strong&gt; site couldn't localized LAN printers at &lt;strong&gt;Local station 1&lt;/strong&gt; - there was PING problems, etc. . The same was when I tried to connecto to different hosts at &lt;strong&gt;Local station 3&lt;/strong&gt; LAN site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also &lt;strong&gt;ARP tables&lt;/strong&gt; at hosts at &lt;strong&gt;Local station 3&lt;/strong&gt; wasn't complete !!! They didn't know about MAC addresses of their closest neighbors !!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspected that there is problem with &lt;strong&gt;swt-d-3&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I disconnected at &lt;strong&gt;swt-d-3&lt;/strong&gt; switch link &lt;strong&gt;E23&lt;/strong&gt; to the &lt;strong&gt;CC1036&lt;/strong&gt; trying to replace that switch - monitoring server showed that problem disappear immediately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It was strange because problem was isolated to the &lt;strong&gt;Local station 3&lt;/strong&gt; LAN part. Theoretically frames and packets shouldn't leave &lt;strong&gt;swt-d-3&lt;/strong&gt; switch because problematic traffic was limited to hosts connected to this switch ports.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;When I reconfigured &lt;strong&gt;CC1036&lt;/strong&gt; and changed bonding protocol from &lt;strong&gt;balanced-rr&lt;/strong&gt; to the &lt;strong&gt;802.3ad&lt;/strong&gt; between &lt;strong&gt;CC1036&lt;/strong&gt; and &lt;strong&gt;swt-d-1&lt;/strong&gt; the entire network began working well !!! All hosts began see each other, connectivity problems with &lt;strong&gt;Nas server&lt;/strong&gt; disappeared, and all &lt;strong&gt;ARP tables&lt;/strong&gt; have become complete.&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="8499" LastEditDate="2018-02-14T16:47:06.983" LastActivityDate="2018-02-14T16:47:06.983" Title="ARP issue among whole network caused by MikroTik CloudCore1036 router and HP 1810-24G switch missconfiguration" Tags="|arp|hp|etherchannel|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-09T23:53:30.170" ContentLicense="CC BY-SA 3.0" />
  <row Id="17683" PostTypeId="2" ParentId="17682" CreationDate="2015-04-04T12:40:17.813" Score="1" Body="&lt;p&gt;With my knowledges and my Mikrotik adventures I advice to you :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use &lt;strong&gt;mode 802.3ad&lt;/strong&gt; instead of balanced-rr if there's no major cause. If you read on &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Interface/Bonding#balance-rr&quot; rel=&quot;nofollow&quot;&gt;Mikrotik WIKI - Bonding&lt;/a&gt; they say that its mode isn't 100% compatible with all of other networking products&lt;/li&gt;&#xA;&lt;li&gt;ARP table not need to be always full, may have only inputs from ip/mac targets which the host needs to talk&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;My diagnostics is mode balanced-rr is the root of your network problems&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="14727" LastEditorUserId="14727" LastEditDate="2015-04-04T12:51:04.173" LastActivityDate="2015-04-04T12:51:04.173" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17685" PostTypeId="1" CreationDate="2015-04-04T13:23:19.083" Score="0" ViewCount="1347" Body="&lt;p&gt;&lt;strong&gt;My question is it possible to configure CC1036 like a DHCP server which would be able to:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;gives to specified host (for example Local Station 5) same &lt;strong&gt;IPv4&lt;/strong&gt; address based on his &lt;strong&gt;MAC LAN&lt;/strong&gt; and &lt;strong&gt;MAC WLAN&lt;/strong&gt; address - it means that no matter of how host connect using his &lt;strong&gt;WLAN NIC&lt;/strong&gt;  or &lt;strong&gt;LAN NIC&lt;/strong&gt; (through switch or AP) it receive &lt;strong&gt;same&lt;/strong&gt; IPv4 address ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/EJkBa.png&quot; alt=&quot;Mikrotik CloudCore1036 static DHCP configuration using multiple NIC - LAN and WLAN&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At above picture You can see part of my network scheme. Main router based on Mikrotik &lt;strong&gt;CloudCore1036&lt;/strong&gt; within one bridge and &lt;strong&gt;HP&lt;/strong&gt; switches &lt;strong&gt;1810-24G&lt;/strong&gt; and &lt;strong&gt;1810-8G&lt;/strong&gt; - all default configured within default VLAN. All &lt;strong&gt;CC1036&lt;/strong&gt; interfaces were &lt;strong&gt;arp-proxy&lt;/strong&gt; and &lt;strong&gt;arp-enabled&lt;/strong&gt; mode.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;CloudCore 1036&lt;/strong&gt; - main router with one bridge and included one link bond using &lt;strong&gt;802.3ad&lt;/strong&gt; protocol,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;rtr-a-x&lt;/strong&gt; - &lt;strong&gt;MikroTik 2011 UiAS-2HnD-IN (WiFi)&lt;/strong&gt; router configured as &lt;strong&gt;ap-bridge&lt;/strong&gt; without any &lt;strong&gt;DHCP&lt;/strong&gt; server,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;swt-d-x&lt;/strong&gt; switches - my distribution layer switches; all &lt;strong&gt;HP 1810-24G - J9803A&lt;/strong&gt; with one default VLAN,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;swt-a-x&lt;/strong&gt; switches - my acces layer switches; all &lt;strong&gt;HP 1810-8G - J9802A&lt;/strong&gt; with one default VLAN,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Server NAS&lt;/strong&gt;- my local storage server,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Local station x&lt;/strong&gt; - hosts connected to the network using &lt;strong&gt;DHCP server&lt;/strong&gt; defined at &lt;strong&gt;CC1036&lt;/strong&gt; MikrotikRouter,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Bonding-1&lt;/strong&gt; - I bounded 3 links between &lt;strong&gt;CC1036&lt;/strong&gt; and &lt;strong&gt;swt-d-1&lt;/strong&gt; switch; at &lt;strong&gt;swt-d-1&lt;/strong&gt; I used &lt;strong&gt;trunks&lt;/strong&gt; at &lt;strong&gt;E22&lt;/strong&gt;,&lt;strong&gt;E23&lt;/strong&gt;,&lt;strong&gt;E24&lt;/strong&gt; interfaces and at &lt;strong&gt;CC1036&lt;/strong&gt; at &lt;strong&gt;E1&lt;/strong&gt;,&lt;strong&gt;E2&lt;/strong&gt;,&lt;strong&gt;E3&lt;/strong&gt; I used &lt;strong&gt;balanced-rr&lt;/strong&gt; protocol and I add that Bond to the bridge,&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Bonding-2&lt;/strong&gt; - I bounded 2 links between &lt;strong&gt;CC1036&lt;/strong&gt; and &lt;strong&gt;swt-d-3&lt;/strong&gt; switch; at &lt;strong&gt;swt-d-3&lt;/strong&gt; I used &lt;strong&gt;trunks&lt;/strong&gt; at &lt;strong&gt;E23&lt;/strong&gt;,&lt;strong&gt;E24&lt;/strong&gt; interfaces and at &lt;strong&gt;CC1036&lt;/strong&gt; at &lt;strong&gt;E7&lt;/strong&gt;,&lt;strong&gt;E6&lt;/strong&gt; I used &lt;strong&gt;802.3ad&lt;/strong&gt; protocol and I add that Bond to the bridge.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="8499" LastEditDate="2018-02-14T16:46:52.380" LastActivityDate="2018-02-14T16:46:52.380" Title="Mikrotik CloudCore1036 static DHCP configuration using multiple NIC - LAN and WLAN" Tags="|wireless|ipv4|dhcp|mac-address|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-09T23:53:05.877" ContentLicense="CC BY-SA 3.0" />
  <row Id="17690" PostTypeId="2" ParentId="17679" CreationDate="2015-04-04T22:34:07.210" Score="3" Body="&lt;p&gt;I spent a few more hours googling and found the appropriate support document on Red Hat's site:&#xA;&lt;a href=&quot;https://access.redhat.com/solutions/53031&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/solutions/53031&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It turns out Red Hat 6+ will filter asymmetrically routed packets by default.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The solution is to  To make this behaviour persistent across reboots,&#xA;  modify /etc/sysctl.conf and make the following change prior to reboot:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;net.ipv4.conf.default.rp_filter = 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="14724" LastEditorUserId="14724" LastEditDate="2015-04-04T22:46:55.407" LastActivityDate="2015-04-04T22:46:55.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17696" PostTypeId="2" ParentId="17569" CreationDate="2015-04-05T07:57:28.350" Score="1" Body="&lt;p&gt;First of all that You have route from PC0 to PC1 doesn't mean that You have route from PC1 to PC0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Thats are Zinin’s 3 routing principles:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&quot;Every router makes its decision alone, based on the&#xA;information it has in its own routing table.“&lt;/li&gt;&#xA;&lt;li&gt;&quot;The fact that one router has certain information in&#xA;its routing table does not mean that other routers have the same&#xA;information.“&lt;/li&gt;&#xA;&lt;li&gt;&quot;Routing information about a path from one network to&#xA;another does not provide routing information about the reverse, or&#xA;return path.&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;That means all routers must have full routing table to all networks - R1 to networks beyond R3 and R3 to all networks beyond R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides R3 probably don't have any information about networks at the other site of R2. You can check it showing R3 routing table - &lt;code&gt;show ip route&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="6417" LastEditorUserId="6417" LastEditDate="2015-04-05T08:03:08.513" LastActivityDate="2015-04-05T08:03:08.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17702" PostTypeId="1" CreationDate="2015-04-05T16:12:38.460" Score="1" ViewCount="130" Body="&lt;p&gt;First off, I assume this is a simple question, but I do not have a background in networking.  Nonetheless, I am responsible for setup and maintenance.  I would appreciate any help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following network layout in one building:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/y2Xpn.png&quot; alt=&quot;network layout&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I go about facilitating direct communications between the individual networks?  I.e. devices on the VOIP network can communicate with devices on the LAN network without going over the WAN connections?  And all devices have access to the DCs and DNS servers located on the 172.19.1.0 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The part that confuses me is I need to maintain the WAN separation transparently to the devices.  I.e. the stationary phones need to use WAN-1.  The stationary desktops need to use WAN-2.  The travelling devices need to connect over WAN-3.  I am guessing this is achieved by the gateway address passed out by the router dhcp?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you recommend any specific cost effective hardware to make this happen for a small user base?  Each network uses a Ubiquiti EdgeRouter Lite as the router/gateway if that helps with recommendations.&lt;/p&gt;&#xA;" OwnerUserId="14742" LastActivityDate="2015-04-05T16:48:37.403" Title="How do I create hard wired communications between multiple lans with individual wan connecitons" Tags="|bridge|" AnswerCount="2" CommentCount="0" ClosedDate="2015-04-06T20:51:47.897" ContentLicense="CC BY-SA 3.0" />
  <row Id="17703" PostTypeId="2" ParentId="17702" CreationDate="2015-04-05T16:45:13.580" Score="1" Body="&lt;p&gt;This could easily be achieved with VRFs (Cisco, in combination with route leaking) or policy based routing. Using VRF will give you the performance advantage over policy based routing, but is more complex to configure. My blog[1] has an article on policy based routing and there are plenty of VRF examples on the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[1] &lt;a href=&quot;https://glennmatthys.wordpress.com/2012/04/24/policy-based-routing-example-route-one-subnet-via-isp-a-and-another-via-isp-b/&quot; rel=&quot;nofollow&quot;&gt;https://glennmatthys.wordpress.com/2012/04/24/policy-based-routing-example-route-one-subnet-via-isp-a-and-another-via-isp-b/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1959" LastActivityDate="2015-04-05T16:45:13.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17704" PostTypeId="2" ParentId="17702" CreationDate="2015-04-05T16:48:37.403" Score="2" Body="&lt;p&gt;If your existing WAN routers have extra interfaces then you can connect them to each other and configure either static routes or a routing protocol so those networks can communicate with each other. If the existing WAN routers do not have any additional capacity, then either an additional router with the capability to connect to all of the networks or maybe even better a layer 3 switch that can connect to all the networks and route between them should do it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you configured all the existing WAN routers yourself then you can probably do it no problem, you will just want to update the routing tables on the existing WAN routers to have routes to each of the other networks, once you have things all connected.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-04-05T16:48:37.403" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17705" PostTypeId="2" ParentId="17622" CreationDate="2015-04-05T17:36:08.740" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;1) Am I correct that &quot;30 second offered rate&quot; is a bandwidth which comes into service-policy named traffic-policer?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;30 second offered rate is based on load-interval command, you can change it under interface configuration. Default is 5 minutes. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# interface FastEthernet 0&#xA;Router(config-if)# load-interval 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is a length of time for which are data used to compute load statistics. So simply said, you can imagine it as the average traffic for 30 sec interval. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the all traffic which is processed by policy-map traffic-policer is specify above that line in class class-default (545169 packets, 822918951 bytes) &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2) Why there are two lines &quot;shape (average) cir&quot; and &quot;target shape rate&quot;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is really good question. Many people are confused, I think that it has something in common that Cisco does not have a good explanation about it in any book.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will never see different values between Shape average and target shape as long as you use shape average command. In case you will configure your shaping map by &lt;strong&gt;shape peak&lt;/strong&gt; command instead of &lt;strong&gt;shape average&lt;/strong&gt; your shaper will starts to use PIR instead of CIR. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What PIR means? How will change it your shaping? That's quite long story. I am apologize but I am not going into any explanations but you can find answer to your questions here:&#xA;&lt;a href=&quot;http://blog.ine.com/2008/08/26/understanding-the-shape-peak-command/&quot; rel=&quot;nofollow&quot;&gt;http://blog.ine.com/2008/08/26/understanding-the-shape-peak-command/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;3) Am I correct that this part: &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;queue stats for all priority classes:&#xA;    queue limit 64 packets   (queue depth/total drops/no-buffer drops)&#xA;  0/0/0   (pkts output/bytes output) 190/10640&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;..is only for GRE-traffic traffic-class as it is the only one with&#xA;  priority configuration?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;These are statistics for &lt;strong&gt;priority&lt;/strong&gt; low latency queues. And you're right. As long as you use only one class (GRE-traffic) configured as priority, statistics are recorded only from mentioned traffic.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;4) Am I correct that this 19.5Mbps(shape average 19500000) is shared&#xA;  between all the traffic classes specified in child service-policies?&#xA;  class-default and GRE-traffic in my case.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're indeed right, CIR 19.5Mbps is shared by all child classes that you're configured in policy-map prioritize-GRE-traffic.&lt;/p&gt;&#xA;" OwnerUserId="10520" LastEditorUserId="10520" LastEditDate="2015-04-05T17:49:51.720" LastActivityDate="2015-04-05T17:49:51.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17708" PostTypeId="1" AcceptedAnswerId="17721" CreationDate="2015-04-05T20:40:04.093" Score="4" ViewCount="4355" Body="&lt;p&gt;When the receiving end of a TCP connection sends its SYN/ACK packet(s?), are they sent separately? As in does the receiver send a packet with the control bit as SYN, with the receiving ends ISN, then a packet with the control bit set as ACK and its prediction of the senders next sequence number? Or can a packet contain both the SYN and ACK control bits with both the ISN and acknowledgement number?&lt;/p&gt;&#xA;" OwnerUserId="14250" LastActivityDate="2015-04-06T17:21:17.417" Title="SYN/ACK packet(s?) sent as one or two packets in TCP connection initialisation?" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17713" PostTypeId="1" AcceptedAnswerId="17716" CreationDate="2015-04-06T04:54:24.970" Score="3" ViewCount="4594" Body="&lt;p&gt;I'm not a network engineer, so this must be a noob question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XZEdS.jpg&quot; alt=&quot;Network setup&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My task is simple, I need all clients to have internet access. Both EX2200 were configured before as layer 2 switches, so i assume their configuration is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On SRX240 i was able to setup internet access. If i connect my laptop to it, the internet works fine. But connection to EX2200 doesn't work. I tried different guides from the internet, but nothing seems to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should i configure SRX240, so all EX2200 clients have internet access. Ideally, i would love all clients to get ip from SRX240 DHCP and be in the same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX240&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 11.2R4.3;&#xA;system {&#xA;    name-server {&#xA;        208.67.222.222;&#xA;        208.67.220.220;&#xA;    }&#xA;    services {&#xA;        ssh;&#xA;        telnet;&#xA;        xnm-clear-text;&#xA;        web-management {&#xA;            http {&#xA;                interface vlan.0;&#xA;            }&#xA;            https {&#xA;                system-generated-certificate;&#xA;                interface vlan.0;&#xA;            }&#xA;        }&#xA;        dhcp {&#xA;            router {&#xA;                192.168.1.1;&#xA;            }&#xA;            pool 192.168.1.0/24 {&#xA;                address-range low 192.168.1.2 high 192.168.1.254;&#xA;            }&#xA;            propagate-settings ge-0/0/0.0;&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        archive size 100k files 3;&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any critical;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands error;&#xA;        }&#xA;    }&#xA;    max-configurations-on-flash 5;&#xA;    max-configuration-rollbacks 5;&#xA;    license {&#xA;        autoupdate {&#xA;            url https://ae1.juniper.net/junos/key_retrieval;&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                dhcp;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/4 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/5 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/6 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/7 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/8 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/9 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/10 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/11 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/12 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/13 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/14 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/15 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 192.168.1.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop 10.129.152.129;&#xA;    }&#xA;}&#xA;protocols {&#xA;    stp;&#xA;}&#xA;security {&#xA;    screen {&#xA;        ids-option untrust-screen {&#xA;            icmp {&#xA;                ping-death;&#xA;            }&#xA;            ip {&#xA;                source-route-option;&#xA;                tear-drop;&#xA;            }&#xA;            tcp {&#xA;                syn-flood {&#xA;                    alarm-threshold 1024;&#xA;                    attack-threshold 200;&#xA;                    source-threshold 1024;&#xA;                    destination-threshold 2048;&#xA;                    timeout 20;&#xA;                }&#xA;                land;&#xA;            }&#xA;        }&#xA;    }&#xA;    nat {&#xA;        source {&#xA;            rule-set trust-to-untrust {&#xA;                from zone trust;&#xA;                to zone untrust;&#xA;                rule source-nat-rule {&#xA;                    match {&#xA;                        source-address 0.0.0.0/0;&#xA;                    }&#xA;                    then {&#xA;                        source-nat {&#xA;                            interface;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    policies {&#xA;        from-zone trust to-zone untrust {&#xA;            policy trust-to-untrust {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    zones {&#xA;        security-zone trust {&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                vlan.0;&#xA;            }&#xA;        }&#xA;        security-zone untrust {&#xA;            screen untrust-screen;&#xA;            interfaces {&#xA;                ge-0/0/0.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            dhcp;&#xA;                            tftp;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;vlans {&#xA;    vlan-trust {&#xA;        vlan-id 3;&#xA;        l3-interface vlan.0;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EX2200 - 24&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 11.4R7.5;&#xA;system {&#xA;    ports {&#xA;        console {&#xA;            log-out-on-disconnect;&#xA;            type vt100;&#xA;        }&#xA;    }&#xA;    login {&#xA;        user admin {&#xA;            uid 2000;&#xA;            class super-user;&#xA;        }&#xA;    }&#xA;    services {&#xA;        ssh {&#xA;            root-login allow;&#xA;        }&#xA;        telnet;&#xA;    }&#xA;    syslog {&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any notice;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands any;&#xA;        }&#xA;    }&#xA;}&#xA;chassis {&#xA;    alarm {&#xA;        management-ethernet {&#xA;            link-down ignore;&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/4 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/5 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/6 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/7 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/8 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/9 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/10 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/11 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/12 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/13 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/14 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/15 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/16 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/17 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/18 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/19 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/20 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/21 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members public-eth;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/22 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members all;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/23 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members all;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/1/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 10 {&#xA;            family inet {&#xA;                address 192.168.1.2/24;&#xA;            }&#xA;        }&#xA;        unit 100 {&#xA;            family inet {&#xA;                address 10.129.152.135/25;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;snmp {&#xA;    community school-ro {&#xA;        authorization read-only;&#xA;        clients {&#xA;            10.143.255.0/24;&#xA;        }&#xA;    }&#xA;    trap-group ESMA {&#xA;        targets {&#xA;            10.143.255.2;&#xA;            10.143.255.6;&#xA;            10.143.255.10;&#xA;            10.143.255.14;&#xA;            10.143.255.42;&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop 10.129.152.129;&#xA;    }&#xA;}&#xA;protocols {&#xA;    igmp-snooping {&#xA;        vlan all;&#xA;    }&#xA;    rstp;&#xA;    lldp {&#xA;        interface all;&#xA;    }&#xA;    lldp-med {&#xA;        interface all;&#xA;    }&#xA;}&#xA;ethernet-switching-options {&#xA;    storm-control {&#xA;        interface all;&#xA;    }&#xA;}&#xA;vlans {&#xA;    management {&#xA;        vlan-id 10;&#xA;        l3-interface vlan.10;&#xA;    }&#xA;    private-eth {&#xA;        vlan-id 20;&#xA;    }&#xA;    public-eth {&#xA;        vlan-id 30;&#xA;    }&#xA;    wan {&#xA;        vlan-id 100;&#xA;        l3-interface vlan.100;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14749" LastEditorUserId="14749" LastEditDate="2015-04-06T04:59:34.730" LastActivityDate="2015-04-06T09:28:23.443" Title="Juniper SRX240 and EX2200 network" Tags="|juniper-junos|juniper-srx|juniper-ex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17715" PostTypeId="1" CreationDate="2015-04-06T08:57:11.680" Score="3" ViewCount="113" Body="&lt;p&gt;Let's say I want:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routing-options {&#xA;  forwarding-table {&#xA;    export SORTER&#xA;  }&#xA;}&#xA;&#xA;policy-options {&#xA;  policy-statement SORTER {&#xA;    term by-Comm {&#xA;      to community Comm-list;&#xA;      then {&#xA;        destination-class FOO;&#xA;        accept;&#xA;      }&#xA;    }&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An I can't get it working. Is it ever possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read the docs thouroughly and &lt;code&gt;set accounting destination-class-usage&lt;/code&gt; properly I do believe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An I have &lt;code&gt;from community Comm-list&lt;/code&gt; and &lt;code&gt;then source-class&lt;/code&gt; working (in the opposite direction) --- &lt;strong&gt;UPDATE&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my setup is like this: I have an MX80, a bunch of clients behind it, connection to the Internet, BGP peering with a core router (cisco let's say). My junos router already has loaded with fullview, there are communities &lt;code&gt;&amp;lt;ASN&amp;gt;:1&lt;/code&gt; --- these prefixes are &quot;the wild world&quot; --- and &lt;code&gt;&amp;lt;ASN:2&amp;gt;&lt;/code&gt; --- these are &quot;to local IX networks&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have defined the &lt;code&gt;SORTER&lt;/code&gt; and community lists like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-options {&#xA;  policy-statement SORTER {&#xA;    term World {&#xA;      from community World;&#xA;      then {&#xA;        source-class World;&#xA;        accept;&#xA;      }&#xA;    }&#xA;  }&#xA;&#xA;  ...&#xA;  community Exchange members &amp;lt;ASN&amp;gt;:2;&#xA;  community World members &amp;lt;ASN&amp;gt;:1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this statements --- and, of course, appropriate &lt;code&gt;accounting { source-class-usage { ... } }&lt;/code&gt; in appropriate places --- I can see counters on clients' interfaces (defined as VLAN units under some &lt;code&gt;xe-0/0/0&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I really can see these counters, they're correct (I'm using them for downstream traffic policing, I can graph them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this I've &lt;code&gt;set interface xe-0/0/0 unit &amp;lt;OUTPUT_VID&amp;gt; family inet accounting destination-class-usage&lt;/code&gt; and defined a policy as I've described above (the very first code fragment), with &lt;code&gt;to community World then destination-class World&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I want to see that counter working .)&lt;/p&gt;&#xA;" OwnerUserId="12084" LastEditorUserId="12084" LastEditDate="2015-04-06T17:36:07.163" LastActivityDate="2015-04-06T17:36:07.163" Title="JunOS: match &quot;to community&quot; to set destination-class in policy-statement?" Tags="|juniper-junos|policing|" AnswerCount="0" CommentCount="6" ClosedDate="2015-04-30T04:05:59.877" ContentLicense="CC BY-SA 3.0" />
  <row Id="17716" PostTypeId="2" ParentId="17713" CreationDate="2015-04-06T09:28:23.443" Score="2" Body="&lt;p&gt;To answer this question, I'll go through your configuration piece by piece.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your SRX240 configuration is essentially correct and should work, with one small issue, that is your WAN/Internet interface (ge-0/0/0) appears to be using DHCP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                dhcp;&#xA;            }&#xA;        }&#xA;    }&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While you've got a default gateway defined:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop 10.129.152.129;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Likely, your default gateway is provided by DHCP, so you probably don't need/want to define it statically. If 10.129.152.129 is not in your dhcp address/netmask though, JunOS is probably ignoring it, and since you also said that you were able to successfully get Internet connectivity when directly plugged into the SRX, this is probably not causing a problem. To get rid of this for cleanliness, issue the following commands on the SRX240:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure&#xA;delete routing-options static&#xA;commit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On to the switches. You didn't tell us which port on the SRX240 is connected to which port on the EX2200, so this is hard to answer, but based on the configuration provided I can deduce that your WAN/Internet link is ge-0/0/0 on the SRX240, and that at least one switch is plugged into one of the other interfaces on the SRX (ge-0/0/1 through 15.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the configuration you provided (for only the EX2200-24, and not the EX2200-48), your topology should work as long as port ge-0/0/0 through 21 are connected to the SRX. If, however the SRX is plugged into ports 22 or 23 on the the EX, you have a problem, because those ports are in trunk mode and the SRX isn't configured for or expecting VLAN-tagged ethernet frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;[...]&#xA;    ge-0/0/22 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members all;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/23 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members all;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, if all you really wanted was a flat L2 topology, you have some configuration left over from someone that didn't:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ge-0/0/XX {&#xA;    unit 0 {&#xA;        family ethernet-switching {&#xA;            vlan {&#xA;                members public-eth;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlans {&#xA;    management {&#xA;        vlan-id 10;&#xA;        l3-interface vlan.10;&#xA;    }&#xA;    private-eth {&#xA;        vlan-id 20;&#xA;    }&#xA;    public-eth {&#xA;        vlan-id 30;&#xA;    }&#xA;    wan {&#xA;        vlan-id 100;&#xA;        l3-interface vlan.100;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;[...]&#xA;    vlan {&#xA;        unit 10 {&#xA;            family inet {&#xA;                address 192.168.1.2/24;&#xA;            }&#xA;        }&#xA;        unit 100 {&#xA;            family inet {&#xA;                address 10.129.152.135/25;&#xA;            }&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can see several IP addresses, vlans and such configured. To get back to the most basic of L2 functionality, we should remove some of that old unnecessary configuration (as long as you're sure that this is &lt;em&gt;your&lt;/em&gt; network and you're not a rogue going against the wishes of your network admin.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure&#xA;delete interfaces ge-0/0/0&#xA;delete interfaces ge-0/0/1&#xA;delete interfaces ge-0/0/2&#xA;delete interfaces ge-0/0/3&#xA;delete interfaces ge-0/0/4&#xA;delete interfaces ge-0/0/5&#xA;delete interfaces ge-0/0/6&#xA;delete interfaces ge-0/0/7&#xA;delete interfaces ge-0/0/8&#xA;delete interfaces ge-0/0/9&#xA;delete interfaces ge-0/0/10&#xA;delete interfaces ge-0/0/11&#xA;delete interfaces ge-0/0/12&#xA;delete interfaces ge-0/0/13&#xA;delete interfaces ge-0/0/14&#xA;delete interfaces ge-0/0/15&#xA;delete interfaces ge-0/0/16&#xA;delete interfaces ge-0/0/17&#xA;delete interfaces ge-0/0/18&#xA;delete interfaces ge-0/0/19&#xA;delete interfaces ge-0/0/20&#xA;delete interfaces ge-0/0/21&#xA;delete interfaces ge-0/0/22&#xA;delete interfaces ge-0/0/23&#xA;set interfaces ge-0/0/0.0 family ethernet-switching&#xA;set interfaces ge-0/0/1.0 family ethernet-switching&#xA;set interfaces ge-0/0/2.0 family ethernet-switching&#xA;set interfaces ge-0/0/3.0 family ethernet-switching&#xA;set interfaces ge-0/0/4.0 family ethernet-switching&#xA;set interfaces ge-0/0/5.0 family ethernet-switching&#xA;set interfaces ge-0/0/6.0 family ethernet-switching&#xA;set interfaces ge-0/0/7.0 family ethernet-switching&#xA;set interfaces ge-0/0/8.0 family ethernet-switching&#xA;set interfaces ge-0/0/9.0 family ethernet-switching&#xA;set interfaces ge-0/0/10.0 family ethernet-switching&#xA;set interfaces ge-0/0/11.0 family ethernet-switching&#xA;set interfaces ge-0/0/12.0 family ethernet-switching&#xA;set interfaces ge-0/0/13.0 family ethernet-switching&#xA;set interfaces ge-0/0/14.0 family ethernet-switching&#xA;set interfaces ge-0/0/15.0 family ethernet-switching&#xA;set interfaces ge-0/0/16.0 family ethernet-switching&#xA;set interfaces ge-0/0/17.0 family ethernet-switching&#xA;set interfaces ge-0/0/18.0 family ethernet-switching&#xA;set interfaces ge-0/0/19.0 family ethernet-switching&#xA;set interfaces ge-0/0/20.0 family ethernet-switching&#xA;set interfaces ge-0/0/21.0 family ethernet-switching&#xA;set interfaces ge-0/0/22.0 family ethernet-switching&#xA;set interfaces ge-0/0/23.0 family ethernet-switching&#xA;delete interfaces vlan.100&#xA;delete vlans&#xA;delete snmp&#xA;rename interfaces vlan.10 to unit 0&#xA;set vlans default l3-interface vlan.0&#xA;set vlans default vlan-id 1&#xA;delete routing-options&#xA;set routing-options static route 0.0.0.0/0 next-hop 192.168.1.1&#xA;&#xA;commit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above commands do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Clear the current configuration of each of the interfaces on the switch&lt;/li&gt;&#xA;&lt;li&gt;Create new blank/default configuration for each of the same interfaces&lt;/li&gt;&#xA;&lt;li&gt;Get rid of the probably unused IP address on vlan 100&lt;/li&gt;&#xA;&lt;li&gt;Remove SNMP configuration (which is not relevant to your stated goal)&lt;/li&gt;&#xA;&lt;li&gt;Consolidate everything to the default VLAN (all of the interfaces are automatically members of &quot;default&quot; if another VLAN isn't specified.)&lt;/li&gt;&#xA;&lt;li&gt;Change the Management VLAN to the default VLAN, as it normally would be on a factory-fresh JunOS install&lt;/li&gt;&#xA;&lt;li&gt;Set the default gateway to be the Firewall, which is not strictly necessary in this topology since the EX is just acting as a layer 2 switch in this case, but at least you'll be able to ping hosts on the internet from the switch if everything is working.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You'll probably want to do something similar for the EX2200-48 that you didn't give the configuration for, but hopefully you can look at the commands above and perform a similar procedure. If you flatten the topology as I've described, all of your clients will get their IP addresses from the SRX240 and will get internet access.&lt;/p&gt;&#xA;" OwnerUserId="1701" LastActivityDate="2015-04-06T09:28:23.443" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17719" PostTypeId="1" AcceptedAnswerId="17743" CreationDate="2015-04-06T14:57:38.880" Score="2" ViewCount="13555" Body="&lt;p&gt;I have a following very minimalistic AAA configuration in ISR router with IOS 12.4(22)T:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;aaa authentication login default group tacacs+ enable&#xA;aaa authentication enable default group tacacs+ enable&#xA;aaa authorization exec default group tacacs+ &#xA;aaa session-id common&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After authentication I end up in privilege level 15. Now if execute commands like &lt;code&gt;conf t&lt;/code&gt; or &lt;code&gt;show ver&lt;/code&gt;, the router does not consult with TACACS+ server(I run a packet capture on TACACS+ server TCP port 49). What exactly the &lt;code&gt;aaa authorization exec default group tacacs+&lt;/code&gt; does? When does the command authorization happen?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2019-09-27T01:18:33.100" Title="Reason of &quot;aaa authorization exec default group tacacs+&quot; command in Cisco IOS?" Tags="|cisco-ios|aaa|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17720" PostTypeId="2" ParentId="17719" CreationDate="2015-04-06T16:24:06.550" Score="5" Body="&lt;p&gt;The statement&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authorization exec default group tacacs+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;allows you to start a CLI session (a command shell).  Without it, you can't get a command prompt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see more information &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/command/reference/fsecur_r/srfauth.html&quot; rel=&quot;nofollow&quot;&gt;here.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;From: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_cfg_authorizatn.html#wp1058237&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_cfg_authorizatn.html#wp1058237&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;AAA Authorization Types&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Cisco IOS software supports five different types of authorization:&#xA;  •Auth-proxy—Applies specific security policies on a per-user basis.&#xA;  See &quot;Related Documents&quot; section for more information about where to&#xA;  find authentication proxy configuration documentation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Commands—Applies to the EXEC mode commands a user issues. Command&#xA;  authorization attempts authorization for all EXEC mode commands,&#xA;  including global configuration commands, associated with a specific&#xA;  privilege level.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•EXEC—Applies to the attributes associated with a user EXEC terminal&#xA;  session.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Network—Applies to network connections. This can include a PPP, SLIP,&#xA;  or ARAP connection.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Reverse Access—Applies to reverse Telnet sessions.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Configuration—Applies to downloading configurations from the AAA&#xA;  server.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•IP Mobile—Applies to authorization for IP mobile services.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think the confusion comes from the difference in how different TACACS daemons respond.  Cisco ACS may respond differently than your Shrubbery daemon or tacacs.net.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is some more reference material, although not exactly what you're asking for:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/12_2sx/sec_securing_user_services_12-2sx_book/sec_tacacs_attr_vp.html#wp1058789&quot; rel=&quot;nofollow&quot;&gt;TACACS Attribute-Value Pairs&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-04-09T12:17:04.180" LastActivityDate="2015-04-09T12:17:04.180" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17721" PostTypeId="2" ParentId="17708" CreationDate="2015-04-06T17:21:17.417" Score="9" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Transmission_Control_Protocol#Connection_establishment&quot; rel=&quot;noreferrer&quot;&gt;Three-way handshake&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;1. step&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client begins the three-way handshake by sending a segment with the synchronize sequence number (SYN) control flag set, which indicates an initial value in the sequence number field. This value is known as the initial sequence number (ISN). The ISN is randomly chosen and is increased by one for each byte of data sent from the client to the server.&lt;br&gt;&#xA;&lt;code&gt;ACK : not set | SYN : set&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;2. step&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server must acknowledge the receipt of the SYN segment, so it sends a segment back with the ACK flag set. The client recognizes this as an acknowledgement that the server received the SYN from the client.&#xA;The value of the ACK number field is the ISN + 1.&lt;br&gt; The server also must initiate a response to the client. To achieve that the server uses the SYN flag in the same way that the client did. (So it is one segment)&lt;br&gt;&#xA;&lt;code&gt;ACK : set | SYN : set&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;3. step&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client responds with a segment containing ACK that is the response to the SYN sent by the server. There is no user data in this segment. The ACK field contains one more than the ISN received from the server.&lt;br&gt;&#xA;After both sessions are established between client and server, all segments exchanged will have the ACK flag set.&lt;br&gt;&#xA;&lt;code&gt;ACK : set | SYN : not set&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;i&gt;(Note: the whole conversation between the client and the server is actually two one-way sessions)&lt;/i&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nYfsp.png&quot; alt=&quot;Three-way handshake picture from Cisco ICND1 chapter 7.2.1.3&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="13520" LastActivityDate="2015-04-06T17:21:17.417" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17722" PostTypeId="1" AcceptedAnswerId="17725" CreationDate="2015-04-06T17:45:15.487" Score="3" ViewCount="3695" Body="&lt;p&gt;Is it possible to detect if any cable was connected/disconnected in real time via Telnet session on Cisco Catalyst 4506?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I have an IBM Switch EN94093R that does it by default, when I unplug and then plug again a cable from the switch, it shows up on the SSH/Telnet session instantly, as shown below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/elR5t.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a similar way to do this on the Cisco Switch? It is really useful on cases like mine where you don't know the mac or IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="14758" LastActivityDate="2015-04-07T00:27:54.647" Title="How to detect port changes in real time on Cisco 4506" Tags="|switch|cisco-catalyst|ssh|cli|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17724" PostTypeId="2" ParentId="17615" CreationDate="2015-04-06T20:19:40.997" Score="1" Body="&lt;p&gt;Turns out that in NOS 4.1.2 PBR is broken if your next hop traverses  port-channel or VLAG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case the 10.5.2.2 router is accessed over an LACP trunk from 10.5.2.1 router, which breaks the PBR&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is fixed in firmware 4.1.3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7rrjr.png&quot; alt=&quot;brocade-bug&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10240" LastActivityDate="2015-04-06T20:19:40.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17725" PostTypeId="2" ParentId="17722" CreationDate="2015-04-07T00:27:54.647" Score="4" Body="&lt;p&gt;From configuration mode, type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging monitor info&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then from enable mode type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;term[inal] mon[itor]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this will send console messages to your vty session.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-04-07T00:27:54.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17727" PostTypeId="1" CreationDate="2015-04-07T03:31:14.653" Score="0" ViewCount="2086" Body="&lt;p&gt;I'm writing a program that detects ARP poisoning. What I want to do is somehow clear my routers ARP cache, so that it can force send an ARP request, so then I can check the source address of the packet and see if it's from somewhere other than my default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've just got a question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of somehow clearing my routers arp cache, could I just request a new DHCP IP address. Would this force the router to send an ARP request for the new IP address when it's receiving packets from the internet?&lt;/p&gt;&#xA;" OwnerUserId="14765" LastActivityDate="2015-04-12T06:16:51.850" Title="Forcing an ARP request" Tags="|routing|ipv4|arp|packet-analysis|" AnswerCount="2" CommentCount="4" ClosedDate="2015-04-14T15:05:29.407" ContentLicense="CC BY-SA 3.0" />
  <row Id="17729" PostTypeId="1" AcceptedAnswerId="17734" CreationDate="2015-04-07T08:53:58.033" Score="6" ViewCount="4373" Body="&lt;p&gt;For example if I enable AAA(&lt;code&gt;aaa new-model&lt;/code&gt;) in IOS router with default configuration and try to log in over console line(&lt;em&gt;cty&lt;/em&gt;), then there is no authentication. However, if I try to log in over telnet(&lt;em&gt;vty&lt;/em&gt;), then I'm authenticated against local user database. Now if I specify TACACS+ server with &lt;code&gt;tacacs-server host 10.10.10.3 key passwd&lt;/code&gt; and enable TACACS+ authentication with &lt;code&gt;aaa authentication login default group tacacs+&lt;/code&gt;, then both &lt;em&gt;cty&lt;/em&gt; and &lt;em&gt;vty&lt;/em&gt; start using TACACS+ authentication. Now if I disable AAA(&lt;code&gt;no aaa new-model&lt;/code&gt;), then &lt;em&gt;vty&lt;/em&gt; expects me to have at least line password while &lt;em&gt;cty&lt;/em&gt; has no authentication by default. As this isn't already confusing enough, the enable mode over console line requires no authentication by default while in case of telnet is does. This all makes me wonder if there is a show command which displays authentication method for different lines? For example in case the AAA is enabled but no TACACS+ authentication is configured, it would show with &lt;code&gt;sh line vty 0 auth&lt;/code&gt; that &lt;em&gt;vty&lt;/em&gt; lines expect local user database authentication while at the same time &lt;code&gt;sh line console 0 auth&lt;/code&gt; would show that no authentication is required. However, I'm afraid that such &lt;code&gt;show&lt;/code&gt; command does not exist and one has to check the configuration and know the defaults by heart.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="775" LastEditDate="2015-04-07T09:36:39.780" LastActivityDate="2015-04-07T10:14:41.087" Title="How to view default authentication method for different lines(cty, vty, aux, tty) in IOS?" Tags="|cisco|cisco-ios|security|authentication|aaa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17730" PostTypeId="2" ParentId="17727" CreationDate="2015-04-07T09:54:42.887" Score="0" Body="&lt;p&gt;If your PC changes IP address, then yes, the router will need to ARP for it when next it needs to send you traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply renewing your IP Address via DHCP is unlikely to change anything, as most DHCP servers will simply re-allocate you the same address you have already leased which your router will already have stored in ARP cache.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-04-07T09:54:42.887" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17733" PostTypeId="1" AcceptedAnswerId="17761" CreationDate="2015-04-07T10:07:14.580" Score="3" ViewCount="630" Body="&lt;p&gt;We have a project where we need to terminate a large number of IPSec VPN peers. At the moment we are using Cisco ASA 5555-X appliances with VPN Premium license. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We terminate at the moment about 2000 IPSec VPN connection but we are in full deployment and we get about 2000 new peers per year. The maximum amount of VPN peers is 5000 with this platform, according to Cisco website. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All connections are very low bandwidth and we don't use any kind of fancy features on the ASA. CPU usage is less than 2% and memory usage less than 25%. Technically I am pretty sure we can easily support 6000 connections, resource-wise. The license is another issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to extend the license of the ASA 5555-X to support more than 5000 IPSec VPN peers ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The alternative would be to go to the next level, ASA 5585-X which supports up to 10000 VPN peers but that's quite more expensive. Adding another ASA 5555-X would also work but that's not very scalable and would make the whole setup more complex. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What other choices to I have for terminating 5000+ IPSec VPN peers ? What do other people use in such large scale projects while keeping things scalable ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards,&#xA;Stefan&lt;/p&gt;&#xA;" OwnerUserId="714" LastActivityDate="2015-04-08T19:40:50.093" Title="Cisco ASA - terminate more than 5000 IPSec VPN connections" Tags="|cisco|cisco-asa|vpn|ipsec|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17734" PostTypeId="2" ParentId="17729" CreationDate="2015-04-07T10:14:41.087" Score="4" Body="&lt;p&gt;I can sympathize, IOS authentication mechanisms are not simple to understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The closest command that does what you want is &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/s1/sec-s1-cr-book/sec-cr-s2.html#wp1219751920&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;show aaa method-lists authentication&lt;/code&gt;&lt;/a&gt;.  However, this command is not really bullet-proof for the purposes of auditing system login authentication methods.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Example usage&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, let's suppose we have a switch with the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username cisco password cisco&#xA;aaa new-model&#xA;aaa authentication login default local&#xA;aaa authorization exec default local if-authenticated&#xA;!&#xA;line con 0&#xA; exec-timeout 15 0&#xA;!&#xA;line vty 0 4&#xA; exec-timeout 15 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run &lt;code&gt;show aaa method-lists authentication&lt;/code&gt;, I see that the &lt;code&gt;default&lt;/code&gt; method is the only one used, but it doesn't enumerate console, aux, or line vty...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rt#sh aaa method-lists authentication&#xA;authen queue=AAA_ML_AUTHEN_LOGIN&#xA;  name=default valid=TRUE id=0 :state=ALIVE : LOCAL&#xA;  ^^^^^^^^^^^^       ^^^^                     ^^^^^&#xA;authen queue=AAA_ML_AUTHEN_ENABLE&#xA;authen queue=AAA_ML_AUTHEN_PPP&#xA;authen queue=AAA_ML_AUTHEN_SGBP&#xA;authen queue=AAA_ML_AUTHEN_ARAP&#xA;authen queue=AAA_ML_AUTHEN_DOT1X&#xA;authen queue=AAA_ML_AUTHEN_8021X&#xA;authen queue=AAA_ML_AUTHEN_EAPOUDP&#xA;permanent lists&#xA;  name= Permanent Enable None valid=TRUE id=0 :state=ALIVE : ENABLE  NONE &#xA;  name= Permanent Enable valid=TRUE id=0 :state=ALIVE : ENABLE &#xA;  name= Permanent None valid=TRUE id=0 :state=ALIVE : NONE &#xA;  name= Permanent Local valid=TRUE id=0 :state=ALIVE : LOCAL &#xA;  name= Permanent rcmd valid=TRUE id=0 :state=ALIVE : RCMD &#xA;&#xA;rt#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we can go in and configure a bogus login method on &lt;code&gt;line con 0&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rt1#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;rt1(config)#line con 0&#xA;rt1(config-line)#login authentication FOOBAR&#xA;AAA: Warning authentication list &quot;FOOBAR&quot; is not defined for LOGIN.&#xA;&#xA;rt1(config-line)#do show aaa method-lists authentication | i FOOBAR&#xA;rt1(config-line)#  ! &amp;lt;-------------  *Nothing here*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, if I now configure that auth list, it shows up...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rt1(config)#aaa authentication login FOOBAR local&#xA;rt1(config)#do show aaa method-lists authentication | i FOOBAR&#xA;  name=FOOBAR valid=TRUE id=6F000002 :state=ALIVE : LOCAL &#xA;rt1(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All that to say, you're mostly out of luck for a one-command does-it-all solution.  The best thing you could do is write an audit script; &lt;a href=&quot;https://github.com/mpenning/ciscoconfparse&quot; rel=&quot;nofollow&quot;&gt;ciscoconfparse&lt;/a&gt; can assist with these kind of tasks (full-disclosure, I wrote that library for exactly this kind of problem).&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-04-07T10:14:41.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17737" PostTypeId="1" CreationDate="2015-04-07T11:39:36.617" Score="1" ViewCount="4879" Body="&lt;p&gt;I'm building a bit more advanced network at home since I'm moving parts of my work to my residence and felt the need for better stuff. I have several servers, virtualized and physical. Ubiquiti Wireless AP's and Zyxel managed switches. What I need is a better router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I've been looking in products at this class&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.ubnt.com/edgemax/edgerouter/&quot; rel=&quot;nofollow&quot;&gt;Ubiquiti Edgerouter 8Xge Port Router&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/rv325-dual-gigabit-wan-vpn-router/index.html&quot; rel=&quot;nofollow&quot;&gt;Cisco RV325 Dual Gigabit WAN VPN Router&lt;/a&gt;, &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/rv325-dual-gigabit-wan-vpn-router/datasheet-c78-729726.html&quot; rel=&quot;nofollow&quot;&gt;More&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both systems seems to have all the VPN/IPSec technologies that one may need for coming years. I like the looks and abilities of EdgeOS but the capabilities of the Cisco Router are equally compentent by specification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco has double wan ports with builtin failover to a 4G usb stick, it seems as if this is doable in the EdgeRouters as well but requires some extra work and the 4G option can only be obtained using a 4G router modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any of these devices and can give me some pros / cons?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="14769" LastActivityDate="2017-01-27T14:16:15.857" Title="Ubiquiti Edgerouter vs Cisco RV325" Tags="|cisco|router|" AnswerCount="3" CommentCount="1" ClosedDate="2017-08-11T15:03:45.437" ContentLicense="CC BY-SA 3.0" />
  <row Id="17739" PostTypeId="2" ParentId="17737" CreationDate="2015-04-07T12:42:44.987" Score="1" Body="&lt;p&gt;Looking at the specs and knowing EdgeOS I would say EdgeMax would be more flexible choice if you do not mind using CLI. Personally I would go with EdgeMax for flexibility and Cisco for peace of mind when having less flexible needs.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2015-04-07T12:42:44.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17743" PostTypeId="2" ParentId="17719" CreationDate="2015-04-07T16:18:31.740" Score="2" Body="&lt;p&gt;It seems to me that &lt;code&gt;aaa authorization exec default group tacacs+&lt;/code&gt; command forces TACACS+ client(Cisco ISR router in my case) to take account the &lt;code&gt;service = exec&lt;/code&gt; configuration snippet in TACACS+ daemon(&lt;code&gt;tac_plus&lt;/code&gt; from &lt;a href=&quot;http://www.shrubbery.net/tac_plus/&quot; rel=&quot;nofollow&quot;&gt;http://www.shrubbery.net/tac_plus/&lt;/a&gt;) configuration file. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;service = exec {&#xA;  priv-lvl = 15&#xA;  autocmd = &quot;show version&quot;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I remove the &lt;code&gt;aaa authorization exec default group tacacs+&lt;/code&gt; command I end up in IOS shell in privilege level 1 and &lt;code&gt;show version&lt;/code&gt; is not automatically executed. However, I would like to have an authoritative answer and does this command have any other purpose?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-04-07T16:18:31.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17747" PostTypeId="2" ParentId="17733" CreationDate="2015-04-07T20:05:42.467" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any way to extend the license of the ASA 5555-X to support more than 5000 IPSec VPN peers?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. That is the licensed limit for the 5555-X platform. Only Cisco can change that &quot;hard&quot; limit. (and why would they when there's a more expensive &quot;upgrade&quot;)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What other choices to I have...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Non-Cisco technology. (Checkpoint, pfsense, etc.) It's hard to ask this without it being a shopping question. (&lt;em&gt;What VPN concentrator / firewall can handle more than 5000 peers?&lt;/em&gt;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-07T20:05:42.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17748" PostTypeId="2" ParentId="10265" CreationDate="2015-04-07T21:47:54.477" Score="2" Body="&lt;p&gt;You can download the 802.11-2012 standard from the &lt;a href=&quot;http://standards.ieee.org/about/get/802/802.11.html&quot; rel=&quot;nofollow&quot;&gt;IEEE web page&lt;/a&gt;.  On page 429 you can find the the information contained in the probe request body, none of which contain a time stamp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you will note that the final element is defined as &quot;Vendor Specific.&quot;  It would be possible to add a time stamp in this this element.  This would typically require that you modify the code of the driver on the client device.  Any device not running your customized driver would not be sending this time stamp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want the access point to recognize this and act on it, then you would need to modify the access point as well.  If it would suffice for your needs, you would be able to view the contents of this element if you were doing something like a packet capture as probe requests are not encrypted. &lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-04-07T21:47:54.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17749" PostTypeId="1" AcceptedAnswerId="17754" CreationDate="2015-04-08T00:30:12.357" Score="3" ViewCount="11778" Body="&lt;p&gt;I have a situation where I have a switch with 2 vlans, that needs to connect to an upstream router -- which does not and will not know abut my VLANS (this is in a datacenter, where I cant change this directly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 vlans:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;VLAN 1 - Internal management traffic&lt;/li&gt;&#xA;&lt;li&gt;VLAN 24 - External traffic&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Essentially, I want the port which connects upstream to&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Assign untagged incoming traffic as VLAN 24.&lt;/li&gt;&#xA;&lt;li&gt;Untag all outgoing traffic (only VLAN24, VLAN1 can be dropped).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have read many conflicting things online as to what happens when untagged traffic arrives on an ACCESS or TRUNK port. How does this behave for each?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I currently have this set to ACCESS UNTAGGED with a PVID of 24. Is this correct?&lt;/p&gt;&#xA;" OwnerUserId="14712" LastActivityDate="2016-07-02T03:24:21.060" Title="Behaviour of untagged traffic on TRUNK and ACCESS VLAN ports" Tags="|switch|vlan|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17754" PostTypeId="2" ParentId="17749" CreationDate="2015-04-08T12:56:38.910" Score="2" Body="&lt;p&gt;As Adam stated, generally in a well designed network, you should not be receiving untagged frames on a trunk port.  Based on your description, you only want and expect to send and receive VLAN 24 on the uplink port.  Thus, configure the port as an access port in VLAN 24:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gig0/1&#xA; switchport access vlan 24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If for whatever reason this needs to remain a trunk port, but you still only want VLAN 24 (untagged), then configure as a trunk, but set the native VLAN to 24:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gig0/1&#xA; switchport trunk encapsulation dot1q  !may not be necessary depending on hardware&#xA; switchport mode trunk&#xA; switchport trunk native vlan 24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2015-04-08T12:56:38.910" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17756" PostTypeId="1" AcceptedAnswerId="17757" CreationDate="2015-04-08T15:31:31.240" Score="2" ViewCount="161" Body="&lt;p&gt;When calculating the load for a network, Data leaving the pc is always going to be less than the data from the internet and servers. So is it safe to assume that if you work out the load with data coming to the PC you will produce valid network design?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have another question in relation to duplex media. Assume the links between the PC and Switch are running at near full capacity 900Mbps Switch to the PC, and 900Mbps out of the pc towards the switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this switch:  Prosafe GS728TPS 24 port - 48 auto-sensing RJ45 ports – rated at 1 Gigabit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be able to handle 900Mbps to the pc and 900Mbps from the pc to the switch concurrently?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a diagram to help picture what i'm trying to ask questions about:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ADG8E.png&quot; alt=&quot;Diagram Network&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14786" LastActivityDate="2015-04-08T15:46:30.737" Title="Network load and capacity design - Full Duplex Media?" Tags="|design|duplex|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17757" PostTypeId="2" ParentId="17756" CreationDate="2015-04-08T15:46:30.737" Score="1" Body="&lt;p&gt;For your first question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So is it safe to assume that if you work out the load with data coming to the PC you will produce valid network design?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm going to say &quot;No&quot; because there are too many other factors that could affect the overall performance. Typically when you start putting a lot of devices on an Ethernet switch, it's actually the backplane speed that becomes an important factor. That measures the maximum total data that can be going through the switch. If you have several different servers and clients, then each one can take a piece of that backplane up to the maximum link speed of the slowest link, so the more links you have the more hit you can put on the backplane.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With just one server and lots of clients, usually you want to maximize the speed of the link the server has to the switch. Rarely are clients connected on too slow a link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would it be able to handle 900Mbps to the pc and 900Mbps from the pc to the switch concurrently?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In short, &quot;Yes&quot;. A PC connected to a 1 Gbps full-duplex port can recieve up to 1 Gbps from the switch at the same time it is sending up to 1 Gbps to the switch. Sometimes network card drivers or other problems on the PC (or less likely, the switch) can prevent actually acheiving these numbers, but that is what full-duplex operation is meant to allow.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-04-08T15:46:30.737" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17758" PostTypeId="1" CreationDate="2015-04-08T15:50:06.910" Score="3" ViewCount="5998" Body="&lt;p&gt;I have a &lt;em&gt;Juniper SRX240H2&lt;/em&gt;(JUNOS 12.1X44-D20.3) firewall cluster in flow mode with interface &lt;code&gt;reth2.1&lt;/code&gt; facing Internet and interface &lt;code&gt;reth1.1&lt;/code&gt; facing LAN. I have a problem with one particular source and destination IP pair. Source sends TCP SYN packet over the Internet to destination which is behind NAT, NAT translation occurs fine and destination in LAN will reach the packet. However, reply(TCP SYN+ACK) will be dropped in firewall because previous flow is not found:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Apr  8 15:08:04 15:08:07.821685:CID-1:RT:  reth1.1:10.70.50.201/515-&amp;gt;104.236.80.115/1021, tcp, flag 12 syn ack&#xA;Apr  8 15:08:04 15:08:07.821685:CID-1:RT: find flow: table 0x5115c900, hash 880(0xffff), sa 10.70.50.201, da 104.236.80.115, sp 515, dp 1021, proto 6, tok 9&#xA;Apr  8 15:08:04 15:08:07.821685:CID-1:RT:  no session found, start first path. in_tunnel - 0x0, from_cp_flag - 0&#xA;Apr  8 15:08:04 15:08:07.821685:CID-1:RT:  packet dropped, first pak not sync&#xA;Apr  8 15:08:04 15:08:07.821685:CID-1:RT:  flow find session returns error.&#xA;Apr  8 15:08:04 15:08:07.821685:CID-1:RT: ----- flow_process_pkt rc 0x7 (fp rc -1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Latency between the firewall and destination in LAN is ~20ms so it should not be because flow timeouts. How does the TCP SYN checking work in SRX? Does it expect the TCP SYN+ACK use the same egress interface where the initial TCP SYN came in from?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="630" LastEditDate="2015-04-11T10:28:58.120" LastActivityDate="2015-04-13T23:38:39.293" Title="How to understand Juniper SRX flow creation?" Tags="|juniper-srx|juniper-junos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17761" PostTypeId="2" ParentId="17733" CreationDate="2015-04-08T19:40:50.093" Score="3" Body="&lt;p&gt;You can ask Your partner for CTMP, and get better pricing (deeper discount) for 5585-X in exchange for your 5555-X. The other option (as clustering doesn't support remote VPNs) is to have some load-balancer in front of set of ASAs doing the hard job of splitting the load.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2015-04-08T19:40:50.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17762" PostTypeId="2" ParentId="16547" CreationDate="2015-04-08T20:14:14.570" Score="1" Body="&lt;p&gt;An EVC is a service providing ethernet connectivity between two or&#xA;more user-network interfaces across a metro ethernet network.  It can&#xA;be point-to-point, point-to-multipoint (tree topology), or&#xA;multipoint-to-multipoint (LAN topology).  It provides security,&#xA;ensuring that traffic on the EVC doesn't get mixed up with that on&#xA;other connections in the network; and it may optionally provide guaranteed quality of service.&#xA;See &lt;a href=&quot;http://www.metroethernetforum.org/Assets/Technical_Specifications/PDF/MEF_12.2.pdf&quot; rel=&quot;nofollow&quot;&gt;MEF 12.2&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An ESP is a &lt;em&gt;unidirectional&lt;/em&gt; connection within a provider backbone&#xA;bridge network.  ESPs can be used to route traffic in an EVC, if&#xA;the provider's network supports it, but there are also other routing&#xA;technologies that can be used instead.  The user is not typically aware of&#xA;the particular method used.  See &lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.1Qay-2009.pdf&quot; rel=&quot;nofollow&quot;&gt;IEEE 802.1Qay-2009&lt;/a&gt; for the formal&#xA;ESP definition.&lt;/p&gt;&#xA;" OwnerUserId="14789" LastActivityDate="2015-04-08T20:14:14.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17763" PostTypeId="2" ParentId="17737" CreationDate="2015-04-08T20:22:14.557" Score="5" Body="&lt;p&gt;I do not have the 8 port edgerouter, but I have used quite a few of the ERL and POE versions. I feel that they are very stable and consistent, and a great product. The Cisco &quot;RV&quot; series are from the Linksys &quot;business class&quot; hardware, and I have never felt that this line was a good product from a performance or stability POV.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I'd go with the edgerouter. The CLI commands are pretty easy once you get started and the Ubiquiti community is way better for knowledge than Linksys support techs.&lt;/p&gt;&#xA;" OwnerUserId="14321" LastActivityDate="2015-04-08T20:22:14.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17764" PostTypeId="1" AcceptedAnswerId="18876" CreationDate="2015-04-08T21:04:31.340" Score="2" ViewCount="2763" Body="&lt;p&gt;I work at a school with a mid-sized ShoreTel deployment; two ShoreGear T1 trunk units and 15 ShoreGear 120/24 switches. We have a couple hundred IP phones and a couple hundred analog extensions (dorms).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We currently have two PRI trunks through CenturyLink, but honestly, we're paying them far too much and using it far too little. Nobody seems to care much about landlines phones. I'd like to switch to SIP trunking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've talked to several vendors, and some strongly recommend an Ingate SIParator session border controller in addition to the FortiGate, but for nebulous reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a FortiGate 200B running FortiOS 4.0 MR2, which is a pretty fancy firewall (pre-dates me here). Does anyone know how well FortiOS handles Application Layer Gateway for SIP? I have a block of public IPv4 addresses, some of which are unused. Surely I can dedicate one to SIP traffic and use the FortiOS's built-in SIP functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the reasons given for needing an SBC like the Ingate SIParators is security, since SIP constantly opens and closes a vast range of random ports. One vendor I spoke with addresses this by creating an IPSec tunnel between my gateway and their voice switches. That sounds perfect to me, and they say I don't need an SBC. Other vendors were adamant that I will not be satisfied unless I buy an SBC (and they're not cheap), and that I'll have wonky problems without one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that Stack Exchange wants questions that can be answered, not just discussed, so I'll phrase it this way: Has anyone successfully configured native SIP trunking in ShoreTel with just a FortiOS firewall and no dedicated SBC?&lt;/p&gt;&#xA;" OwnerUserId="8633" LastActivityDate="2015-07-01T12:54:04.250" Title="Dedicated SBC really required for SIP trunking through a FortiGate 200B firewall?" Tags="|fortigate|sip|telephony|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17765" PostTypeId="1" AcceptedAnswerId="17768" CreationDate="2015-04-08T21:51:01.057" Score="3" ViewCount="717" Body="&lt;p&gt;As the topic says, I'm investigating NAT on a clients ASA - it's running old 7.2 train code - I execute '&lt;strong&gt;sh run global&lt;/strong&gt;' and '&lt;strong&gt;sh run nat&lt;/strong&gt;' - the latter command only returns a single nat 0 line.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I do a '&lt;strong&gt;sh run | b static&lt;/strong&gt;' (which I thought would've shown up under one of the previous two commands!) I get a long list of policy based nat in the format of '&lt;strong&gt;static (outside,inside) x.x.x.x access-list &lt;/strong&gt;'  Which is what I would expect to have seen from one of those previously attempted commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What commands need to be run to see &lt;em&gt;everything&lt;/em&gt; involving nat on a 7.2 ASA?  I am not seeing any kind of DST nat (which I expect in this particular case) for the tunnel I'm looking at, but yet the tunnel is up and passing traffic, so it's happening somewhere!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2015-04-09T02:11:35.853" Title="'sh run global' and 'sh run nat' yield no output but a ton of NAT in 'sh run'" Tags="|cisco|cisco-asa|vpn|nat|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17766" PostTypeId="2" ParentId="17765" CreationDate="2015-04-08T22:08:49.707" Score="3" Body="&lt;p&gt;'show run static' is a usable show command as well.&lt;/p&gt;&#xA;" OwnerUserId="14230" LastActivityDate="2015-04-08T22:08:49.707" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17767" PostTypeId="2" ParentId="3198" CreationDate="2015-04-09T00:59:24.437" Score="0" Body="&lt;p&gt;Correct, however provided you have a secure process for enrollment, in a way the mobile phone becomes the physical key fob. Duo also offers the UX flexibility of the app push or sms code. The internal CA on the ASA is great too but not an option if you run in HA pairs or multi-context. As suggested, use the MS/Dogtag CA or Duo. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMO, you get the most coverage by configuring the vpn group as such:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Factor 1 - Use Certificates (MS/Dogtag/ASA onboard for CA) - can use ldap/AD user to gen the cert. (Best done locally, OpSec best practice must be followed in delivering/installing the cert.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Factor 2 - FreeRADIUS or Duo proxy with secure enrollment for token/OTP fob or mobile device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way, if a user is targeted, the attacker must obtain a.) a copy of the certificate which should only exist in the laptop/endpoint keystore  b.) the users AD / radius username/password  c.) the fob (rsa/yubikey) or mobile device (DuoSec)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This also limits liability for lost/stolen devices. I believe duo also offers a way to manage the users via your AD as well which makes the whole setup easy to manage. Your gear must allow for timeout/retry adjustments to support the out-of-band user interaction during authentication. (Unlocking phone/pulling fob from pocket/etc. - allow at least 30sec radius timeout)&lt;/p&gt;&#xA;" OwnerUserId="14791" LastEditorUserId="14791" LastEditDate="2015-04-09T01:32:35.830" LastActivityDate="2015-04-09T01:32:35.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17768" PostTypeId="2" ParentId="17765" CreationDate="2015-04-09T02:11:35.853" Score="2" Body="&lt;p&gt;&lt;code&gt;show global&lt;/code&gt;&lt;br/&gt;&#xA;&lt;code&gt;show nat&lt;/code&gt;&lt;br/&gt;&#xA;&lt;code&gt;show static&lt;/code&gt;&lt;br/&gt;&#xA;&lt;code&gt;show conduit&lt;/code&gt; (unless you've switched to ACLs)&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, that's going to be 90% of the entire configuration anyway. (more if pdm isn't enabled, thus flooding the config with &lt;em&gt;pdm location ...&lt;/em&gt;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-09T02:11:35.853" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17773" PostTypeId="1" CreationDate="2015-04-09T07:12:55.293" Score="1" ViewCount="623" Body="&lt;p&gt;I am using a Cisco 1841 router and I have 2 sub interfaces configured. F0/1.10 and 1.20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to stop the devices on VLAN 10 accessing VLAN 20 and visa versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 10 is on 10.10.10.1 and VLAN 20 10.10.20.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured the following access control lists&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 19 deny 10.10.10.0 0.0.0.255&#xA;access-list 19 permit any&#xA;&#xA;access-list 29 deny 10.10.20.0 0.0.0.255&#xA;access-list 29 permit any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And applied them to the outbound side of the sub interfaces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface f0/1.10&#xA;ip access-group 29 out&#xA;&#xA;interface f0/1.20&#xA;ip access-group 19 out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The trouble is I can still ping across the networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help greatly appreciated, full configuration is below if you need it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;ip cef&#xA;!&#xA;!&#xA;ip dhcp use vrf connected&#xA;ip dhcp excluded-address 10.10.10.201 10.10.10.255&#xA;ip dhcp excluded-address 10.10.20.201 10.10.20.255&#xA;!&#xA;ip dhcp pool 10.10.10.0/24&#xA; network 10.10.10.0 255.255.255.0&#xA; default-router 10.10.10.1 &#xA;   dns-server 8.8.8.8 8.8.4.4 &#xA;!&#xA;ip dhcp pool 10.10.20.0/24&#xA;   network 10.10.20.0 255.255.255.0&#xA;   default-router 10.10.20.1 &#xA;   dns-server 8.8.8.8 8.8.4.4 &#xA;!&#xA;!&#xA;vpdn enable&#xA;!&#xA;&#xA;!&#xA;interface FastEthernet0/0&#xA; description Fibre WAN Interface&#xA; no ip address&#xA; ip broadcast-address 0.0.0.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no ip mroute-cache&#xA; duplex auto&#xA; speed auto&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 1&#xA; no cdp enable&#xA;!&#xA;interface FastEthernet0/1&#xA; description LAN Interface&#xA; no ip address&#xA; ip broadcast-address 10.10.10.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip nat inside&#xA; no ip mroute-cache&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA;!&#xA;interface FastEthernet0/1.10&#xA; encapsulation dot1Q 10&#xA; ip address 10.10.10.1 255.255.255.0&#xA; ip access-group 29 out&#xA; ip nat inside&#xA; no cdp enable&#xA;!&#xA;interface FastEthernet0/1.20&#xA; encapsulation dot1Q 20&#xA; ip address 10.10.20.1 255.255.255.0&#xA; ip access-group 19 out&#xA; ip nat inside&#xA; no cdp enable&#xA;!&#xA;interface Serial0/0/0&#xA; no ip address&#xA; ip broadcast-address 0.0.0.0&#xA; shutdown&#xA; no fair-queue&#xA; clock rate 2000000&#xA;!&#xA;interface Dialer1&#xA; description ADSL WAN Dialer&#xA; ip address negotiated&#xA; no ip unreachables&#xA; ip mtu 1492&#xA; ip nat outside&#xA; encapsulation ppp&#xA; ip tcp adjust-mss 1452&#xA; no ip mroute-cache&#xA; dialer pool 1&#xA; dialer-group 1&#xA; no cdp enable&#xA; ppp chap hostname bne001-indigointegrated@surfdsluk&#xA; ppp chap password 0 T57Gfc09Hjd5SQw&#xA; ppp ipcp route default&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip nat inside source list 10 interface Dialer1 overload&#xA;!&#xA;access-list 10 permit 10.10.10.0 0.0.0.255&#xA;access-list 10 permit 10.10.20.0 0.0.0.255&#xA;access-list 19 deny   10.10.10.0 0.0.0.255&#xA;access-list 19 permit any&#xA;access-list 20 permit 10.10.10.0 0.0.0.255&#xA;access-list 29 deny   10.10.20.0 0.0.0.255&#xA;access-list 29 permit any&#xA;dialer-list 1 protocol ip permit&#xA;no cdp run&#xA;&#xA;control-plane&#xA;&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA; access-class 20 in&#xA; login&#xA;!&#xA;scheduler allocate 20000 1000&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14442" LastActivityDate="2015-04-09T23:08:39.817" Title="Segregate Cisco network using ACL's" Tags="|cisco|acl|ip|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17774" PostTypeId="2" ParentId="17773" CreationDate="2015-04-09T07:47:38.550" Score="2" Body="&lt;p&gt;You're using a &lt;strong&gt;standard access list&lt;/strong&gt;, so only &lt;em&gt;source&lt;/em&gt; addresses are referenced.  Going out of VLAN 10, for example, your source addresses are 10.10.10.0, but its access list has 10.10.20.0 which won't match and doesn't do what you think. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need &lt;strong&gt;extended access lists&lt;/strong&gt; to specify the destinations which is one option keeping with the access lists idea.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 119 extended deny ip any 10.10.10.0 0.0.0.255&#xA;access-list 119 extended permit ip any any&#xA;access-list 129 extender deny ip any 10.10.20.0 0.0.0.255&#xA;access-list 129 extended permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Standard IP ACLs: 1 to 99 and 1300 to 1999&lt;/li&gt;&#xA;&lt;li&gt;Extended IP ACLs: 100 to 199 and 2000 to 2699&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Another option if you need complete routing isolation between interfaces is to use &lt;strong&gt;VRF-lite&lt;/strong&gt; if your software supports it.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="775" LastEditDate="2015-04-09T10:36:17.263" LastActivityDate="2015-04-09T10:36:17.263" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17775" PostTypeId="1" AcceptedAnswerId="23131" CreationDate="2015-04-09T08:32:27.113" Score="1" ViewCount="250" Body="&lt;p&gt;I was just wondering if upgrading an RFS 6000 from 4.3 to Wing would wipe the configuration that is already set up the RFS, i've looked around online but cant seem to find anything. &lt;/p&gt;&#xA;" OwnerUserId="13529" LastActivityDate="2015-10-07T07:54:35.850" Title="Will Upgrading an RFS6000 from 4.3 to wing 5" Tags="|switch|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17781" PostTypeId="1" CreationDate="2015-04-09T13:54:31.110" Score="3" ViewCount="1070" Body="&lt;p&gt;Having difficulty grasping STP and if we would need it with the topology we have.  The diagram is a top down view of our layout, and each &quot;layer&quot; is a different building connected by fiber, orange links are fiber, blue are Cat5e.  In my rookie opinion, it doesn't look like we have anywhere that would cause a broadcast storm, am I wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/xLMeH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14318" LastActivityDate="2015-04-11T23:36:39.157" Title="STP Needed with this layout?" Tags="|spanning-tree|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17782" PostTypeId="2" ParentId="17781" CreationDate="2015-04-09T14:29:27.430" Score="3" Body="&lt;p&gt;You are correct that STP is not needed in this setup, as you have no physical (or logical) loops.  However, run it anyway to protect yourself from yourself and others.  If a user were to accidentally connect two wall jacks together, you'd introduce a storm without STP.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastEditorUserId="2104" LastEditDate="2015-04-09T18:13:30.697" LastActivityDate="2015-04-09T18:13:30.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17783" PostTypeId="1" CreationDate="2015-04-09T14:34:13.437" Score="4" ViewCount="1001" Body="&lt;p&gt;I'm trying to configure a ZyXEL USG40 to act as a switch that can physically separate 3 vlans from each other. I was told this product would be sufficient to setup a company network with 3 separate vlans. However, after helping me configure the vlans, they told me I'd need an additional switch that allows me to bind each vlan to one or more physical ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering whether it would be possible to assign each physical port on the ZyXEL USG40 to a vlan, so that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;LAN1 (P2) &gt;&gt; 10.0.200.1 (vlan2)&lt;/li&gt;&#xA;&lt;li&gt;LAN2 (P3) &gt;&gt; 10.0.300.1 (vlan3)&lt;/li&gt;&#xA;&lt;li&gt;DMZ (P4) &gt;&gt; 10.0.400.1 (vlan4)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The WAN port would be connected directly to the modem. Under each vlan we plan to add a switch for VoIP (on .200), a switch with local workstations and servers (on .300) and a guest wireless AP (on .400).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The web interface seemingly allows for something like this, by assigning each ethernet interface to its own zone, and then adding a vlan on that zone and base port. However, that doesn't seem to work. Granted, I'm very new to all of this and I don't really know whether I'm doing this correctly.&lt;/p&gt;&#xA;" OwnerUserId="14797" LastActivityDate="2018-11-24T13:00:55.127" Title="Is it possible to assign each vlan to a physical port on the ZyXEL USG40?" Tags="|vlan|lan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17785" PostTypeId="1" CreationDate="2015-04-09T16:18:17.720" Score="1" ViewCount="1712" Body="&lt;p&gt;Sonicwall NSA-240 - Fully patched and updated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X0=LAN             192.168.1.0 (primary site)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X1-WAN1            10.10.10.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X2-WAN2            70.151.12.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X1-WAN1            192.168.100.0  (secondary site)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now have a new ATT MPLS circuit on WAN1. Traffic from our secondary site that is destined for our X0 subnet is routed over WAN1 via ATT cloud based firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to allow all traffic from 192.168.100.0 on WAN1 access to the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am thinking transparent or L2 bridge mode?  Any help appreciated.&lt;/p&gt;&#xA;" OwnerUserId="14799" LastActivityDate="2015-04-10T12:01:27.857" Title="Allow WAN to LAN traffic" Tags="|sonicwall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17786" PostTypeId="1" CreationDate="2015-04-09T17:47:23.340" Score="2" ViewCount="163" Body="&lt;p&gt;I am trying to practice some scenarios on a GNS3 lab that i am doing on my spare time (just doing a very very basic firewall for now since this is new to me)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;currently my scenerios I am trying to accomplish is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. Allow SSH (tcp destined to port 22) from &#xA;    10.0.0.0/8&#xA;    131.11.11.11/32 (fake ip)&#xA;   into my entire network (10.25.0.0/16). &#xA;&#xA;2  Disallow all other SSH (tcp destined to port 22) to MY network.&#xA;3  Allow all other traffic inbound to my network.&#xA;&#xA;   and I am implementing this on my border routers&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so in my cisco switch (my ABR is called R2)&#xA;I am using this format for firewall that i found online&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;#SEQUENCENUM (permit/deny) PROTO SRCIPADDRESS SRCWILDCARD [OPERATOR] [PORT] DESTIPADDRESS DESTNETMASK [OPERATOR] [PORT]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have in my 'show access-list'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extended IP access list 100&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;100 permit tcp 10.0.0.0 0.255.255.255 host 10.25.0.0 eq 22&#xA;&#xA;200 permit tcp host 131.11.11.11 host 10.25.0.0 eq 22&#xA;&#xA;300 deny tcp any host 10.25.0.0 eq 22&#xA;&#xA;400 permit ip any host 10.25.0.0&#xA;&#xA;999 permit ip any 10.25.0.0 0.0.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for 400 - would this be correct syntax to allow all other traffic inbound to my network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and for 999 - I want to permit all other traffic (that is not tcp to port 22 to your network) is this correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks a bunch guys&lt;/p&gt;&#xA;" OwnerUserId="14548" LastEditorUserId="509" LastEditDate="2015-04-09T18:20:32.263" LastActivityDate="2015-04-10T11:52:45.310" Title="confused about cisco firewall configuration when allowing all other traffic on certain ports (src dst)" Tags="|cisco|firewall|cisco-ios|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17787" PostTypeId="2" ParentId="17786" CreationDate="2015-04-09T22:55:54.763" Score="2" Body="&lt;p&gt;Your &quot;host 10.25.0.0&quot; construct is wrong - you're referring to network here, not single host, so use &quot;10.25.0.0 0.0.255.255&quot; (inverse mask, without 'host' prefix) in 100, 200, 300 and 400. 999 is good.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2015-04-09T22:55:54.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17788" PostTypeId="2" ParentId="17785" CreationDate="2015-04-09T23:03:35.810" Score="2" Body="&lt;p&gt;You do not need transparent mode.  Your firewall will forward traffic from the WAN1 to the LAN interfaces, assuming your policies allow it. To configure these policies, you will need to create firewall rules for the LAN to WAN and also be sure to add routes to this firewall and the firewall at your secondary site for 192.168.100.0/24 and 192.168.1.0/24 (respectively) so that traffic will route through the correct gateway. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="14254" LastEditDate="2015-04-10T12:01:27.857" LastActivityDate="2015-04-10T12:01:27.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17789" PostTypeId="2" ParentId="17773" CreationDate="2015-04-09T23:08:39.817" Score="2" Body="&lt;p&gt;So, first of all - if ACLs are being asked for, ACLs should be at least referenced first. VRFs are wonderful, but quite complex if you're having problem with ACLs :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I personally never used ACLs in 'out' direction as in early versions of IOS (11.x, 12.0, 12.1) there were a lot of exceptions, bugs and generally things you had to debug just to make sure it works as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ACLs given by 'generalnetworkerror' are correct, as using standard ACLs won't work in the scenario. I'd however apply them in the 'in' direction and get rid of the 'out' at all. So:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1.10&#xA; ip address 10.10.10.1 255.255.255.0&#xA; no ip access-group 29 out&#xA; ip access-group 129 in&#xA;!&#xA;interface FastEthernet0/1.20&#xA; ip address 10.10.20.1 255.255.255.0&#xA; no ip access-group 19 out&#xA; ip access-group 119 in&#xA;! (for the completness sake, generalnetworkerror ACLs reproduced):&#xA;access-list 119 extended deny ip any 10.10.10.0 0.0.0.255&#xA;access-list 119 extended permit ip any any&#xA;access-list 129 extender deny ip any 10.10.20.0 0.0.0.255&#xA;access-list 129 extended permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just for good measure I'd also add:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1.10&#xA; ip verify unicast source reachable-via rx&#xA;interface FastEthernet0/1.20&#xA; ip verify unicast source reachable-via rx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="286" LastActivityDate="2015-04-09T23:08:39.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17793" PostTypeId="1" AcceptedAnswerId="30760" CreationDate="2015-04-10T07:28:13.053" Score="2" ViewCount="854" Body="&lt;p&gt;I am looking for SNMP OIDs giving all information about the topology status. If directly connecting to the switch, I can find the following information :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Unit  MAC Address        Software    Master    Uplink     Downlink   Status&#xA;    ----  -----------------  ----------  --------  ---------  ---------  -------&#xA;    1     d0:d0:d0:d0:d0:d0  4.1.0.16    Enabled   2          2          master&#xA;    2     d0:d0:d0:d0:d0:d0  4.1.0.16    Enabled   1          1          backup&#xA;    Topology is Ring&#xA;    Stack image auto synchronization is enabled&#xA;&#xA;    Unit Unit Id After Reset&#xA;    ---- -------------------&#xA;     1            0&#xA;     2            0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that I can find the main information with the sub-tree :&#xA;.1.3.6.1.4.1.89.53.4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, so far, I didn't find any OID to get the topology and the image synchronization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="14810" LastActivityDate="2016-05-27T14:44:00.867" Title="Dell PowerConnect 5524 - SNMP OID for stack topology" Tags="|switch|snmp|monitoring|stacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17794" PostTypeId="2" ParentId="17685" CreationDate="2015-04-10T08:26:41.997" Score="1" Body="&lt;p&gt;You can do it if client provides the same clientid and you have static configuration for the client on the dhcp server already. Do not forget to delete mac address for the static configuration and leave the clientid part. Also lower the lease time as dhcp server will not check the ip if is it statically configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Server&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Server&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2015-04-10T08:26:41.997" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17795" PostTypeId="5" CreationDate="2015-04-10T08:31:43.957" Score="0" Body="&lt;p&gt;Unfortunately, MikroTik does not offer optional, paid support, which is a requirement for Network Engineering. Questions about MikroTik equipment are off-topic for Network engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MikroTik is manufacturer of computer networking equipment. It sells wireless products and routers. The company was founded in 1995, with the intent to sell in the emerging wireless technology market. The company's products are known for being low-priced alternatives to expensive routers and Ethernet radio relay lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions related to RouterOS and SwOS belong here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.mikrotik.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Official site of MikroTik&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/MikroTik&quot; rel=&quot;nofollow noreferrer&quot;&gt;MikroTik on wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8057" LastEditorUserId="8499" LastEditDate="2018-01-22T16:09:59.163" LastActivityDate="2018-01-22T16:09:59.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17796" PostTypeId="4" CreationDate="2015-04-10T08:31:43.957" Score="0" Body="MikroTik is manufacturer of computer networking equipment and RouterOS.&#xD;&#xA;&#xD;&#xA;Unfortunately, MikroTik does not offer optional, paid support, which is a requirement for Network Engineering. Questions about MikroTik equipment are off-topic for Network engineering." OwnerDisplayName="user16223" LastEditorUserId="8499" LastEditDate="2018-01-22T16:09:59.163" LastActivityDate="2018-01-22T16:09:59.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17801" PostTypeId="1" AcceptedAnswerId="17865" CreationDate="2015-04-10T11:31:26.710" Score="4" ViewCount="5811" Body="&lt;p&gt;Being in SP field I sometimes hear folks say &quot;we do not need QoS, just let's make sure we have enough bandwidth&quot;.&#xA;This has always been bothering me, because currently we have a network without any QoS in the core and there are no problems with services (Internet, IPTV, VPN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The core links (bundled 10Gs) are utilized in 50%-70% at peak time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Correct me if I'm wrong, but I think that we are just lucky enough to carry traffic that is not that bursty to fill up the links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is that because of bursty nature of IP traffic QoS should be implemented on core links regardless of their utilization, or in the worst case, &#xA;when the utilization reaches 50%. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your comments. Actually my primary concern are microbursts. &#xA;I understand the result of a microburst as a packet drop which occur when there is no noticeable congestion on an interface. I also understand that microbursts happen in every packet network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was curious if there is any &quot;magic&quot; link utilization percentage below which microbursts are harmless? (and we should be safe without QoS). &#xA;I think I saw 50% as a best practice in some QoS book, but I don't remember the details.&lt;/p&gt;&#xA;" OwnerUserId="970" LastEditorUserId="970" LastEditDate="2015-04-13T12:14:24.810" LastActivityDate="2016-08-28T08:35:48.220" Title="QoS or more bandwidth?" Tags="|qos|bandwidth|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17803" PostTypeId="1" AcceptedAnswerId="17804" CreationDate="2015-04-10T14:07:09.397" Score="2" ViewCount="3994" Body="&lt;p&gt;Is there a command to view maximum number of MAC address entries in CAM table in Catalyst series switches? I have usually found this information from release notes.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-04-10T14:18:28.000" Title="max number of supported MAC addresses in Catalyst series switch" Tags="|cisco-catalyst|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17804" PostTypeId="2" ParentId="17803" CreationDate="2015-04-10T14:18:28.000" Score="6" Body="&lt;p&gt;Yes, but this might be platform dependent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, on Cisco 4900M:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4900M#show mac address-table count &#xA;MAC Entries for all vlans:&#xA;Dynamic Unicast Address Count:                  8507&#xA;Static Unicast Address (User-defined) Count:    130&#xA;Static Unicast Address (System-defined) Count:  18&#xA;Total Unicast MAC Addresses In Use:             8655&#xA;Total Unicast MAC Addresses Available:          55000&#xA;Multicast MAC Address Count:                    28&#xA;Total Multicast MAC Addresses Available:        32768&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco 3560G:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3560#show mac address-table count &#xA;Mac Entries for Vlan 738:&#xA;---------------------------&#xA;Dynamic Address Count  : 1&#xA;Static  Address Count  : 0&#xA;Total Mac Addresses    : 1&#xA;[...]&#xA;Total Mac Address Space Available: 5894&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="970" LastActivityDate="2015-04-10T14:18:28.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17807" PostTypeId="1" CreationDate="2015-04-10T18:05:06.953" Score="2" ViewCount="344" Body="&lt;p&gt;I'm having a bit of trouble getting my routing right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an HP v1910 switch with a a few VLAN interfaces. Let's take the first VLAN, VLAN10, which runs all my laptops etc... All VLANs connect via a trunk port to my router (Draytek Vigor 2920). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my routing table I have a route that successfully sends data out to the internet. I know it works because I can access the internet. However, when trying to run a traceroute, I get the first IP (my VLAN interface) then *'s followed by my ISPs gateway IP address. I cannot work out why - I even SSH'd into the router and enabled ICMP echoing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Surely the router should show up in my traceroute?&lt;/p&gt;&#xA;" OwnerUserId="14816" LastActivityDate="2015-04-11T07:49:33.660" Title="Asterix in the traceroute" Tags="|routing|vlan|traceroute|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17808" PostTypeId="2" ParentId="17807" CreationDate="2015-04-10T18:45:15.623" Score="3" Body="&lt;p&gt;traceroute (on *NIX systems) is using UDP to send out messages and the answers are icmp  time exceeded. If your router dose not send these (or you block them on your side) you'll only see *. . tracert on Windows uses ICMP to send out packets. On *NIX you can switch to ICMP by using traceroute -I.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another reason you may see * in a traceroute is that the router is just to busy sending out ICMP messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already explained traceroute in more detail &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/16530/traceroute-doesnt-print-entire-route-sometimes&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-04-11T07:49:33.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17809" PostTypeId="1" CreationDate="2015-04-10T21:55:30.920" Score="0" ViewCount="181" Body="&lt;p&gt;I have a modem and router on one side of a building. I want to string ethernet from my router, out through a window, along the outside of the building, and through another window in another room.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to get a special ethernet cord or surge protection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The distance of the ethernet cable is no more than 150 feet and will not be a heavily used line with most of the time only 3 to 5 clients. The setup will only be used for a year or two so it does not have to withstand the outside elements for a long period.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The outside climate is rather temperate, being in central California. Temperatures go no lower than 35°F at night (but usually closer to 45°F) and as high as 110°F. We do not need to worry about snow, ice, or a lot of humidity, only the occasional rain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I believe that a normal Cat5 or Cat5e would be suitable, but there are special weather-proof cables with extra shielding. Do I need that or is it overkill?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need some sort of surge protector to avoid damage to my router?&lt;/p&gt;&#xA;" OwnerUserId="14824" LastActivityDate="2015-04-11T00:14:54.573" Title="Outdoor ethernet to connect two sides of a building" Tags="|ethernet|" AnswerCount="1" CommentCount="6" ClosedDate="2015-04-12T03:38:12.487" ContentLicense="CC BY-SA 3.0" />
  <row Id="17810" PostTypeId="1" CreationDate="2015-04-10T22:19:11.200" Score="7" ViewCount="11711" Body="&lt;p&gt;To make my question as simple as possible, I put together a quick scenario:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Area 0 spans two data centers with multiple routers/networks in each.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Area 0 has two ABR's connected to area 1 that connect to the same router in area 1.  One area 0,1 ABR is in each data center.  These ABR's also happen to be WAN routers, so they are used to interconnect the data centers as well in area 0.  Area 1 is a standard area.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Area 0 becomes partitioned (split) due to WAN/MAN link(s) between the data centers going down.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;See diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QVeUt.jpg&quot; alt=&quot;Area 0 Split&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on reading the OSPFv2 RFC and a lot of other info on the Internet, I assume the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A.  A partitioned backbone acts as two separate area 0's and they no longer know about each other.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;B.  Each area 0 is fully functional for intra-area routing within its own partition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C.  Functionality between each area 0 and area 1 is fully functional.  Area 1 gets area 0 summaries from each partition and the ABR's send area 1 summaries into each area 0 partition.  External routes from each area 0 partition also flood into area 1, along with type 4 LSA's for ASBR's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D.  Routers in area 0 A can't get to networks in area 0 B, and vice versa because there is no virtual link through area 1.  Since there is no virtual link, no routing information from area 0 A will be shared with area 0 B that an ABR learns in area 1 (and vice versa).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct, or am I misunderstanding something?  My assumptions are based on the distance vector / split-horizon behavior between areas.  In the quick drawing I did, that means that R1 will flood area 0 summaries into area 1, which R4 will learn in area 1, but R4 will assume the area 0 it is directly connected to is the only area 0, so it won't even think about sending any routing info from those summaries &quot;back into area 0&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously this isn't desired behavior for a working design, but if I'm understanding correctly, then this is how I want my network to fail if my two data centers lose connectivity between each other.  I've inherited a single area OSPF domain and I want to break all branch site routers off into a separate area so that if area 0 splits, traffic between data centers won't traverse branch site WAN links through routers that are connected to both data centers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also do some OSPF to BGP redistribution and I don't want an ASBR at one data center redistributing routes from networks at the other data center if its only path to them requires it to transit a dual homed branch office on a slow link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any insight.&lt;/p&gt;&#xA;" OwnerUserId="14825" LastEditorUserId="8499" LastEditDate="2018-12-27T01:32:28.483" LastActivityDate="2019-08-19T23:52:42.300" Title="Split OSPF Area 0 Behavior - What happens?" Tags="|ospf|protocol-theory|rfc|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="17811" PostTypeId="1" AcceptedAnswerId="17812" CreationDate="2015-04-10T23:28:51.953" Score="2" ViewCount="2907" Body="&lt;p&gt;I have some nodes (An) connected to switch A and others (Bm) connected to switch B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should Bm nodes receive LLDP packets from switch A?&lt;/p&gt;&#xA;" OwnerUserId="13402" LastActivityDate="2015-04-10T23:40:13.093" Title="Does LLDP packet traverse switches?" Tags="|switch|lldp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17812" PostTypeId="2" ParentId="17811" CreationDate="2015-04-10T23:40:13.093" Score="8" Body="&lt;p&gt;802.1AB defines several (3) multicast addresses for LLDP that a compliant switch should not forward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, an unmanaged switch with no specific handling for multicast will very likely treat LLDP (and any multicast traffic) as broadcast and spam it to every port.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-10T23:40:13.093" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17813" PostTypeId="2" ParentId="17809" CreationDate="2015-04-11T00:14:54.573" Score="2" Body="&lt;p&gt;As someone who has done lots of crazy things to get equipment installed on ships at sea: I wouldn't quite call it insane.  Improper, yes.  Completely crazy (for a temporary solution), no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a long run of &lt;a href=&quot;https://www.ubnt.com/accessories/toughcable/&quot; rel=&quot;nofollow&quot;&gt;Ubiquiti Toughcable&lt;/a&gt; going from a wiring closet, through a conduit and waterproof gland onto my company's rooftop which connects to a microwave radio link.  It's been in place for nearly three years without any issues.  I think I am using the Toughcable Pro - no braiding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A surge protector isn't going to help you here, but it would be wise to ground equipment well at both ends, if applicable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I must ask, why not run the link through your building?  Even if you have brick walls in the way or something, it still seems like it'll be easier and maybe quicker in the end.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2015-04-11T00:14:54.573" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="17814" PostTypeId="1" AcceptedAnswerId="17815" CreationDate="2015-04-11T01:12:46.970" Score="-2" ViewCount="487" Body="&lt;p&gt;I wanna know what is difference Between Wireless &amp;amp; Wi-Fi ?&#xA;Does it same Wireless jamming and Wi-fi jamming ?&lt;/p&gt;&#xA;" OwnerUserId="14826" LastActivityDate="2015-04-11T01:38:18.367" Title="Difference Between Wireless &amp; Wi-Fi" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="1" ClosedDate="2015-04-14T15:08:15.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="17815" PostTypeId="2" ParentId="17814" CreationDate="2015-04-11T01:38:18.367" Score="2" Body="&lt;p&gt;&lt;strong&gt;Wireless&lt;/strong&gt; and &lt;strong&gt;Wi-Fi&lt;/strong&gt; are used interchangeably for the same concept, but Wi-Fi (often abbreviated to just WiFi) is actually trademarked by the Wi-Fi Alliance non-profit for promoting interoperability with vendors implementing the various 802.11 wireless standards.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-04-11T01:38:18.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17816" PostTypeId="1" AcceptedAnswerId="17823" CreationDate="2015-04-11T04:10:50.813" Score="0" ViewCount="170" Body="&lt;p&gt;A strange thing happened recently. I have a few servers that have statics IP's and I can not longer access the servers. I cannot ping or trace them. However, I can go to their web portals. Each server has a web portal on a different port and I can access the server fine. I also noticed that any new IP's are not accessible either. I have tried rebooting the router, rebooting the switch, and shut down everything. I am at a loss right now. What would cause me to stop having access to IP's?&lt;/p&gt;&#xA;" OwnerUserId="14827" LastActivityDate="2015-04-11T14:34:32.890" Title="Host Not Accessible" Tags="|ipv4|" AnswerCount="1" CommentCount="5" FavoriteCount="0" ClosedDate="2015-04-14T02:41:36.540" ContentLicense="CC BY-SA 3.0" />
  <row Id="17818" PostTypeId="1" AcceptedAnswerId="17820" CreationDate="2015-04-11T10:42:08.030" Score="1" ViewCount="7126" Body="&lt;p&gt;&lt;em&gt;I have added some context to my question incase this is helpful but please feel free to just answer the question at the bottom.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;I have a TP-Link router that keeps crashing but in two stages, first the DHCP, web management and remote log saving become nonfunctional then about 2 hours after this the router becomes of less use than a lobster, that is it responds to no form of outside input that I could think of, until it is rebooted.&lt;/p&gt;&#xA;&lt;p&gt;Immediately before the first stage of the crash the router logs the following events (captured using the remote save system log function:&lt;img src=&quot;https://i.stack.imgur.com/PyYo4.png&quot; alt=&quot;&quot; /&gt;)&lt;/p&gt;&#xA;&lt;p&gt;11/04/2015 11:25:27 &amp;lt;13&amp;gt; DHCPC: Send DISCOVER with request ip 0.0.0.0 and unicast flag 1&#xA;11/04/2015 11:25:30 &amp;lt;13&amp;gt; DHCPC: Send DISCOVER with request ip 0.0.0.0 and unicast flag 1&#xA;11/04/2015 11:25:33 &amp;lt;13&amp;gt; DHCPC: Send DISCOVER with request ip 0.0.0.0 and unicast flag 1&#xA;11/04/2015 11:25:38 &amp;lt;13&amp;gt; DHCPC: Send DISCOVER with request ip 0.0.0.0 and unicast flag 0&#xA;11/04/2015 11:25:41 &amp;lt;13&amp;gt; DHCPC: Send DISCOVER with request ip 0.0.0.0 and unicast flag 0&#xA;11/04/2015 11:25:44 &amp;lt;13&amp;gt; DHCPC: Recv no OFFER, DHCP Service unavailable&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;My Question is: Can/Should a DHCP server send a DISCOVER message?&lt;/strong&gt; As it was my understanding based on &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2131&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2131&lt;/a&gt; that servers should only receive DISCOVER.&lt;/p&gt;&#xA;&lt;p&gt;Many thanks in advance for any help.&lt;/p&gt;&#xA;" OwnerUserId="14830" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2015-04-11T12:33:46.823" Title="Can/Should a DHCP server send a DHCPDISCOVER message?" Tags="|dhcp|" AnswerCount="1" CommentCount="5" ClosedDate="2015-04-11T14:40:43.257" ContentLicense="CC BY-SA 3.0" />
  <row Id="17819" PostTypeId="2" ParentId="17681" CreationDate="2015-04-11T11:48:28.530" Score="0" Body="&lt;p&gt;[ this solution is for Mikrotik part of your setup, but the principle is the same of any decent equipment ]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can specify what capabilities your Mikrotik device will present to the other side (HP switch in your case). If you go (in Winbox) to Interfaces-&gt;Ethernet and select the port you are interested in, you can specify under Ethernet tab whether you allow auto negotiation and what do you advertise. In case of such issues I usually keep autonegotiation and specify only highest speed available on both sides - in your case you would specify only &quot;1000M full&quot; - being 1000Mbps with full duplex. This way HP will have only one option to negotiate on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can, of course, also set things statically, but limited auto-negotiation always worked good in my experience.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2015-04-11T11:48:28.530" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17820" PostTypeId="2" ParentId="17818" CreationDate="2015-04-11T12:33:46.823" Score="1" Body="&lt;p&gt;It's acting as a dhcp relay agent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a feature that is used to offer IP addresses for subnets that the current DHCP server is not offering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This feature should generally have an off or on setting and is generally something a router does. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is useful if the actual DHCP server for a segment is, for example, on a different VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is a server answering the DHCPDISCOVER message a DHCPOFFER is sent unicast to the DHCP-relay on port 67 UDP. The DHCP-relay agent then broadcasts the DHCPOFFER to a subnet using UDP port 68. &lt;/p&gt;&#xA;" OwnerUserId="2566" LastActivityDate="2015-04-11T12:33:46.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17823" PostTypeId="2" ParentId="17816" CreationDate="2015-04-11T14:34:32.890" Score="0" Body="&lt;p&gt;Depending on your host operating systems check if they block ICMP traffic. On GNU/Linux add two rules to your firewall rules:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables -A INPUT -p icmp -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT&#xA;iptables -A OUTPUT -p icmp -m state --state ESTABLISHED,RELATED -j ACCEPT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Adapt as needed.&lt;/p&gt;&#xA;" OwnerUserId="5926" LastActivityDate="2015-04-11T14:34:32.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17827" PostTypeId="1" AcceptedAnswerId="19161" CreationDate="2015-04-11T22:27:03.670" Score="3" ViewCount="280" Body="&lt;p&gt;According to CCIE R&amp;amp;S Official Cert Guide vol. 2, &quot;if the ASN of the eBGP peer is in the current AS_PATH, the private ASNs will not be removed, either.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please explain what is the point of this restriction, since an eBGP peer will discard a prefix anyway if it sees its own AS number in the AS-PATH?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks, &#xA;Cristian&lt;/p&gt;&#xA;" OwnerUserId="14837" LastActivityDate="2017-05-02T22:33:21.917" Title="Removing Private ASNs restriction" Tags="|bgp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17828" PostTypeId="2" ParentId="17781" CreationDate="2015-04-11T23:36:39.157" Score="1" Body="&lt;p&gt;Your setup should not need STP but it is there and as the administrator, you must protect your network from the &quot;morons&quot; as Tom mentioned above. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also some network attacks that will bring down your network...&#xA;&lt;a href=&quot;http://www.techrepublic.com/blog/it-security/myth-or-not-most-security-breaches-originate-internally/&quot; rel=&quot;nofollow&quot;&gt;http://www.techrepublic.com/blog/it-security/myth-or-not-most-security-breaches-originate-internally/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually you would want to keep STP and it's modern variants (RSTP, MSTP) away from the core(s) and configure your distribution switches as your designated spanning-tree primary and secondary roots.&#xA;Note:- Your distribution switches appear to be access switches and I don't think they would support an IGP routing protocol such as OSPF to connect to your core switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This leaves your only core switch (spanning-tree root) subject to whatever nightmares your clients will bring to the network... and you don't want that phone call on a Friday afternoon telling you the network is down while you should be going fishing for the weekend!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a bit of work to do to protect your clients from themselves and you may have to do it in approved Change Management windows (ITSM)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the root trunks investigate &quot;spanning-tree guard root&quot; and other features such as UDLD. &lt;a href=&quot;https://supportforums.cisco.com/discussion/10707896/spanning-tree-guard-root-command&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/10707896/spanning-tree-guard-root-command&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the access switches at the switchports, possibly plan to roll out port security and if required &quot;IP DHCP Snooping&quot; and possibly DAI &lt;a href=&quot;http://packetpushers.net/yes-we-really-need-dynamic-arp-inspection/&quot; rel=&quot;nofollow&quot;&gt;http://packetpushers.net/yes-we-really-need-dynamic-arp-inspection/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not already, use a syslog server (some Linux virtual machine) to log what happens on your network for if you have to investigate/fix what caused a network outage, it will help. &lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2015-04-11T23:36:39.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17830" PostTypeId="2" ParentId="17727" CreationDate="2015-04-12T06:16:51.850" Score="1" Body="&lt;p&gt;&lt;em&gt;The OP's approach seems backwards to me or I am really misreading the question.  I would never taken an approach that attempts to force the router to clear its cache to aid some external monitoring.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're trying to confirm the IP-MAC of the router being spoofed, who cares about the ARP for your client?  If you already know the router IP-MAC to confirm from the client, &lt;strong&gt;the client [program] should be the one sending out an ARP for its gateway (IP) and confirm the unicast response containing the gateway's MAC address.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming you don't know the gateway's IP-MAC initially, you'll have to take the first one seen on faith, then monitor all other ARP requests from that gateway to detect a change that would trigger some sort of alert by your program.  On Cisco devices, the default ARP aging is 240 min, so you'll see at least one ARP per client every 4 hours to generate these requests organically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To really spot ARP poisoning, &lt;strong&gt;Gratuitious ARPs&lt;/strong&gt; would most like come into play.  These should be monitored as well.  Your program could become a change detector for ARPs in that you persist the IP-MAC mappings seen for the life of your program and you don't clear that mapping every 4 hours the way ARP aging does and blindly accepts the next ARP response as valid.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-04-12T06:16:51.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17831" PostTypeId="1" CreationDate="2015-04-12T06:29:43.670" Score="1" ViewCount="3159" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/yYszk.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;hello everyone&#xA;attached is my diagram in which i am facing problem as you can see i have two internet links from two ISPs in which i want failover between two ISPs without using BGP or NAT because i am also going to configure Site-to-Site VPN over the two ASA which also needs to be in failover for each other can anyone please give an opinion regarding this problem&lt;/p&gt;&#xA;" OwnerUserId="14840" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-04-12T06:29:43.670" Title="Dual Internet connections in active/standby mode without BGP" Tags="|cisco|routing|switch|cisco-asa|firewall|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17832" PostTypeId="2" ParentId="17582" CreationDate="2015-04-12T06:35:00.427" Score="0" Body="&lt;p&gt;The &lt;strong&gt;BSSID&lt;/strong&gt; (basic service set identifier) is what you seek.  Numerous wireless troubleshooting apps (e.g., Wifi Analyzer) will show the associated BSSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under Windows, you could locate the BSSID with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;netsh wlan show networks mode=Bssid&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-04-12T06:35:00.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17833" PostTypeId="1" AcceptedAnswerId="17835" CreationDate="2015-04-12T12:21:19.233" Score="1" ViewCount="1757" Body="&lt;p&gt;What's the maximum amount of MPLS VPNs a router can provide?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it 2^20 = ~1 million = the maximum amount of different MPLS labels?&lt;/p&gt;&#xA;" OwnerUserId="4957" LastEditorUserId="775" LastEditDate="2015-04-28T00:27:34.097" LastActivityDate="2015-04-28T00:27:34.097" Title="Maximum number of MPLS VPNs provided by a router?" Tags="|cisco|protocol-theory|mpls|mpls-vpn|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17834" PostTypeId="2" ParentId="17582" CreationDate="2015-04-12T13:35:38.660" Score="0" Body="&lt;p&gt;Use below steps on User's Windows Machine as requested by member&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The BSSID (basic service set identifier) is what you seek. Numerous wireless troubleshooting apps (e.g., Wifi Analyzer) will show the associated BSSID.&#xA;Under Windows, you could locate the BSSID with:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;netsh wlan show networks mode=Bssid&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will get below output. Copy Mac address from output &amp;amp; use coffer website to find which Access point vendor like how I used which can be seen in below coffer snap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mine is &lt;strong&gt;Aruba networks&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kindly use the link below to know your Access point vendor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://coffer.com/mac_find/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://coffer.com/mac_find/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/xoeMR.png&quot; alt=&quot;enter image description here&quot;&gt;---&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/e3Xst.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="8498" LastEditorUserId="8498" LastEditDate="2015-04-12T13:41:06.113" LastActivityDate="2015-04-12T13:41:06.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17835" PostTypeId="2" ParentId="17833" CreationDate="2015-04-12T16:10:17.273" Score="4" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;What's the maximum amount of MPLS VPNs a &lt;em&gt;router&lt;/em&gt; can provide?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Short answer&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;it depends&amp;quot;.  To be honest, it sounds like you're getting in way over your head, but I'll answer the question as best I can.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Long answer&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17833/maximum-of-mpls-vpn-provided-by-service-provider#comment26380_17833&quot;&gt;Sam said&lt;/a&gt;... I would still be specifically interested in how service providers handle the separation of different customer's MPLS VPN.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Why do you think that the answer is different when comparing how a router separates customers in an MPLS VPN vs a service provider separating customers in an MPLS VPN?&lt;/p&gt;&#xA;&lt;p&gt;A router is the most basic building block for MPLS VPN network.   Functionally, service providers use many routers to deploy MPLS VPNs.  MPLS VPN customer separation can be implemented &lt;em&gt;within the same router&lt;/em&gt;, or &lt;em&gt;between different routers&lt;/em&gt;; it doesn't matter.&lt;/p&gt;&#xA;&lt;p&gt;The difference in asking for how many VPNs a service provider can offer vs what a router can offer is: &lt;em&gt;we can answer how many MPLS VPNs a router can offer in a normal-sized Stack Exchange answer&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If we start talking about how many VPNs a service provider can offer with many routers, that introduces too many variables... such as how many MPLS labels the service provider uses for &lt;em&gt;other MPLS services&lt;/em&gt; (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5036&quot; rel=&quot;nofollow noreferrer&quot;&gt;LDP&lt;/a&gt;, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4664&quot; rel=&quot;nofollow noreferrer&quot;&gt;L2VPN&lt;/a&gt;, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2702&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS TE&lt;/a&gt;, etc...).  This is relevant because you're asking about large numbers of VPNs, and large Service Providers offer all the aforementioned services.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What's the maximum amount of MPLS VPNs a &lt;em&gt;router&lt;/em&gt; can provide?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Speaking practically, It depends on what hardware / software is providing the VPNs and how they are being used.&lt;/p&gt;&#xA;&lt;p&gt;For instance, MPLS VPN under Cisco IOS binds labels per-&lt;a href=&quot;http://en.wikipedia.org/wiki/Virtual_routing_and_forwarding&quot; rel=&quot;nofollow noreferrer&quot;&gt;VRF&lt;/a&gt;, and per-non-connected prefix so the total number of VPNs is reduced for every route you advertise into MPLS VPN from a CE router.   There are &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/mpls/configuration/guide/15_0s/mp_15_0s_book/mp_vpn_per_vrf_lbl.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;features to bind labels per-VRF&lt;/a&gt; on some platforms.  However, you did not tell us what hardware platform you're asking about, so this is all pointless other than to demonstrate that you're making far too many assumptions.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Is it 2^20 = ~1 million = the maximum amount of different MPLS labels?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;That's not a practical constraint.  There are theoretical numbers and real numbers; let's live in reality.  Remember how MPLS VPN is used...&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A unique MPLS VPN instance is bound to a router's physical interface or subinterface&lt;/li&gt;&#xA;&lt;li&gt;MPLS VPNs can contain overlapping routes between each other, MPLS VPN makes those routes  unique with &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4364#section-4.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Route Distinguishers&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Because MPLS VPNs are bound to interface / subinterfaces; one possible limit is the number of possible interfaces / subinterfaces in the router.  On Cisco platforms, the maximum number of subinterfaces is constrained by the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-122-mainline/15096-idb-limit.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;max number of software IDBs&lt;/a&gt;.  Consider the ASR1000, which supports up to 65,535 IDBs.  This means any one router cannot terminate more than 64K MPLS VPNs.&lt;/p&gt;&#xA;&lt;p&gt;Furthermore, it's possible to dump more routes in a router than the FIB can hold... some platforms are limited by memory required (particularly if you put full / partial BGP tables in a VRF... that explodes your memory requirements).  If people are doing reasonable things (i.e. not dumping many thousands of routes into a single VPN), then this is not a big problem.&lt;/p&gt;&#xA;&lt;p&gt;All that said, real per-router MPLS Scalability numbers are &lt;em&gt;not&lt;/em&gt; constrained by:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Number of MPLS labels (as you mentioned, roughly 2**20)&lt;/li&gt;&#xA;&lt;li&gt;Number of possible BGP Route Targets (2**48)&lt;sup&gt;Note 1&lt;/sup&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr&gt;&#xA;&lt;p&gt;&lt;sup&gt;Note 1&lt;/sup&gt;Routes are marked for inclusion in a specific MPLS VPN by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4364#section-4.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;setting a Route Target&lt;/a&gt; on the route; &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4360#section-4&quot; rel=&quot;nofollow noreferrer&quot;&gt;route targets are 48-bits wide&lt;/a&gt;, which gives you up to 2**48 possible route-targets&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-04-12T16:10:17.273" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17839" PostTypeId="1" AcceptedAnswerId="17840" CreationDate="2015-04-13T02:54:24.497" Score="5" ViewCount="5683" Body="&lt;p&gt;I hear both terms used, sometimes in conjunction, sometimes seemingly as synonyms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the technical difference between these types of devices if they are in fact different?&lt;/p&gt;&#xA;" OwnerUserId="14848" LastActivityDate="2015-04-13T06:07:52.743" Title="Is a VPN concentrator different from a VPN gateway?" Tags="|vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17840" PostTypeId="2" ParentId="17839" CreationDate="2015-04-13T06:07:52.743" Score="5" Body="&lt;p&gt;&lt;strong&gt;Yes&lt;/strong&gt;, though they are often used interchangeably.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;A VPN gateway may refer to a router, firewall, or VPN Concentrator that provides Virtual Private Networks.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;A VPN Concentrator is a dedicated [VPN gateway] appliance (physical or virtual).&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;All VPN Concentrators are VPN Gateways, but not all VPN Gateways are VPN Concentrators.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-04-13T06:07:52.743" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17841" PostTypeId="1" AcceptedAnswerId="17842" CreationDate="2015-04-13T08:11:26.887" Score="4" ViewCount="203" Body="&lt;p&gt;Am I correct that if one has not specified a named authentication list(&lt;code&gt;login authentication ...&lt;/code&gt; under line configuration), authorization list(&lt;code&gt;authorization ..&lt;/code&gt; under line configuration) or accounting list(&lt;code&gt;accounting commands 15 ..&lt;/code&gt; under line configuration) then the default authentication/authorization/accounting list on all lines is named &lt;code&gt;default&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="775" LastEditDate="2015-04-13T09:03:10.817" LastActivityDate="2015-04-13T09:03:10.817" Title="Default authentication/authorization/accounting list on all lines?" Tags="|cisco|cisco-ios|aaa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17842" PostTypeId="2" ParentId="17841" CreationDate="2015-04-13T09:02:59.923" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;the default authentication/authorization/accounting list on all lines is named default?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, 100% correct; quoting Cisco's docs...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_cfg_authentifcn.html#wp1076037&quot; rel=&quot;nofollow&quot;&gt;Authentication&lt;/a&gt;: &lt;em&gt;The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined.&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_cfg_authorizatn.html#wp1057392&quot; rel=&quot;nofollow&quot;&gt;Authorization&lt;/a&gt;: Once defined, method lists must be applied to specific lines or interfaces before any of the defined methods are performed. &lt;em&gt;The only exception is the default method list (which is named &quot;default&quot;). If the aaa authorization command for a particular authorization type is issued without a named method list specified, the default method list is automatically applied to all interfaces or lines except those that have a named method list explicitly defined.&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/sec_user_services/configuration/guide/15_0s/sec_securing_user_services_15_0S_book/sec_cfg_accountg.html#wp1052893&quot; rel=&quot;nofollow&quot;&gt;Accounting&lt;/a&gt;: Named accounting method lists allow particular security protocol to be designated and used on specific lines or interfaces for accounting services. &lt;em&gt;The only exception is the default method list (which is named &quot;default&quot;). The default method list is automatically applied to all interfaces except those that have a named method list explicitly defined.&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-04-13T09:02:59.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17843" PostTypeId="1" CreationDate="2015-04-13T12:40:10.137" Score="4" ViewCount="27817" Body="&lt;p&gt;As I understand, by default, IOS has three privilege levels: 0, 1 and 15. Privilege level 0 has six available commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r1&amp;gt;?&#xA;Exec commands:&#xA;  &amp;lt;1-99&amp;gt;   Session number to resume&#xA;  disable  Turn off privileged commands&#xA;  enable   Turn on privileged commands&#xA;  exit     Exit from the EXEC&#xA;  help     Description of the interactive help system&#xA;  logout   Exit from the EXEC&#xA;&#xA;r1&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Privilege level 1 has few dozen available commands and privilege level 15 has all the possible commands for particular IOS release.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, is my understanding of privilege levels as I outlined so far correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are all the commands by default divided by those three privilege levels?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does privilege level 1 include all the commands in privilege level 0 and privilege level 15 includes all the commands in privilege level 1?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="8499" LastEditDate="2016-03-15T23:20:56.140" LastActivityDate="2016-10-12T01:59:00.760" Title="Command associations with privilege levels in Cisco IOS" Tags="|cisco-ios|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17844" PostTypeId="1" CreationDate="2015-04-13T13:36:42.760" Score="0" ViewCount="165" Body="&lt;p&gt;I have come across a strange issue, and even as I type the question here, I wonder if folks will simply reject it as &quot;impossible&quot;, but still, the experts here may have some inputs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently I had been out of town, where I had to use a wifi dongle (MTS, in India, in case that matters). For web browsing and such, it worked fine. To connect to my office network, I used the normal vpn and then I could ssh to a server in US.&#xA;Next day, I started the ssh connection before connecting to vpn. Strangely, I got the username/password prompts, but even if I gave the correct password, it reported &quot;Access Denied&quot; consistently. That was when I noticed that I had not used the vpn. I quickly checked Ping and was shocked to see the responses.&#xA;After connecting to the vpn, it was business as usual.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the evening, I again tried ssh without vpn, and again I got the username/password prompts + &quot;Access Denied&quot;. With vpn, it worked fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is : &lt;strong&gt;How did ssh (and ping) get connected to the US server, but access was refused ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;One possibility&lt;/strong&gt; was : Some sort of vpn cache was stored in the dongle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Another possibility&lt;/strong&gt; was : MTS was connecting to some other server where my username was invalid. I think this is more likely. If this is the case , then the local client will warning about the remote server host key change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am no longer out of town, so not able to analyse further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most probable situation seems to be &quot;Another possibility&quot; given above&#xA; (supported by @YLearn &amp;amp; @toddWilcox) because the remote IP was 10.72.X.y in the private range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mean-while @generalnetworkerror has given the following :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Yet another possibility&lt;/strong&gt; was : The remote server is reachable without vpn, but the authentication requires that the source IP Address belong to my company, not some outside IP address.&lt;/p&gt;&#xA;" OwnerUserId="14851" LastEditorUserId="14851" LastEditDate="2016-02-24T03:35:35.717" LastActivityDate="2016-02-24T03:35:35.717" Title="Is &quot;Partial Connection&quot; without VPN possible?" Tags="|vpn|nat|firewall|ieee-802.11|ssh|" AnswerCount="1" CommentCount="5" ClosedDate="2015-04-14T15:07:58.107" ContentLicense="CC BY-SA 3.0" />
  <row Id="17845" PostTypeId="1" AcceptedAnswerId="17847" CreationDate="2015-04-13T15:02:30.467" Score="16" ViewCount="16027" Body="&lt;p&gt;I have a question about BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When exactly is BGP needed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remember reading that BGP is needed for communication between autonomous systems, but is this always true?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in packet tracer I can have a single autonomous system running EIGRP, but I can simply just use a static route to connect that autonomous system to the local ISP routers that are running OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm struggling to see where BGP is needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Artekis&lt;/p&gt;&#xA;" OwnerUserId="14714" LastActivityDate="2020-12-31T15:46:50.533" Title="When is BGP needed?" Tags="|routing|bgp|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17847" PostTypeId="2" ParentId="17845" CreationDate="2015-04-13T16:29:13.650" Score="12" Body="&lt;p&gt;The generic statement that BGP is required when you need to route between two autonomous systems is fairly misleading.  There are a lot of scenarios in which you may choose to use BGP, or it might even be required.&lt;/p&gt;&#xA;&lt;p&gt;In the service provider world, BGP is used heavily, as it is &lt;em&gt;the&lt;/em&gt; routing protocol of the Internet—but it sounds like your question is regarding the enterprise.  In that case, you may be required to use BGP when interfacing with service providers for Internet and sometimes WAN connectivity, or you may choose to run BGP internally due to it being the most flexible routing protocol as far as routing policy goes.&lt;/p&gt;&#xA;&lt;p&gt;Some examples of its use in the enterprise:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Your enterprise controls a block of portable public IP space.  &amp;quot;Portable&amp;quot; in this case means that the space is registered to your organization by a Regional Internet Registry, like ARIN.  Your organization hosts internet accessible services that utilize addressing from this address space.  You typically have two options for letting the world know how to get to you:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Your service provider could advertise this space to the Internet via BGP and static route back to your environment.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You could peer with your service provider and advertise the space to them via BGP.  In the case where you have more than one ISP, this is the only option.  You'd advertise the space to both service providers and then use various policies or manipulation of attributes to control the paths incoming traffic takes.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;In this scenario, the service providers may each advertise a default route to you (rather than the full internet routing table) and you may want to load balance your outbound Internet traffic across ISPs.  In this case, you might need to manipulate BGP to ensure traffic takes the path you want it to and return traffic is influenced back through the same ISP it left on.  This is super high level, but hopefully you get the picture.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Most of the time when you have MPLS links for WAN connectivity, you're not actually doing anything with MPLS.  MPLS will terminate on the service provider's Provider Edge (PE) router and they will connect to your Customer Edge (CE) router with a regular ethernet link on a /30 point to point connection.  In this case, you'll typically have to redistribute your IGP (internal gateway protocol e.g. OSPF, EIGRP, etc.) routes into BGP to share with the service provider.  They will pass those routes through their MPLS network to their PE at your remote site, which will BGP peer with your CE at that site, at which point, you will learn the routes there and redistribute them again back into the IGP at your remote site.  The same thing will happen in the other direction.&lt;/p&gt;&#xA;&lt;p&gt;BGP isn't a requirement here, but it's typically what the service provider will want to run to keep things consistent across all of their connections to customers.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As said above, you may run BGP inside of your network, which is known as IBGP.  It's actually the same exact protocol, but when you run BGP between routers in the same AS, a couple of the behaviors of BGP will change.  Anyway, this is really all about control.  You may have layer 2 virtual networks for WAN connectivity or even VPN links that you could run OSPF over, but in some designs, you may need more control over routing policy to achieve the behavior you want over these paths, in which case, BGP might be the right tool for the job.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Sorry to be somewhat broad, but every case is really different.  When you're just learning networking, especially from Cisco, they will simplify everything to help you understand the concepts.  In a way, I think they go too far in insinuating that certain generic statements are &amp;quot;rules&amp;quot; and even test you on them as if they are 100% strict rules.&lt;/p&gt;&#xA;&lt;p&gt;The best advice I can give is to learn it their way to get down the concepts and pass your certs, but keep your mind wide open.  If you want to add something a bit less formal and a bit more real world to your network learning and training, definitely pick up some O'Reilly books (related to the topics you're studying) with the animals on them.  You can get them pretty cheap used on the Internet.&lt;/p&gt;&#xA;" OwnerUserId="14825" LastEditorUserId="72908" LastEditDate="2020-12-25T23:42:49.940" LastActivityDate="2020-12-25T23:42:49.940" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17850" PostTypeId="1" AcceptedAnswerId="17853" CreationDate="2015-04-13T18:18:09.883" Score="3" ViewCount="2764" Body="&lt;p&gt;I have been given 2 cisco 2950 switch and a cisco 1841 router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to set up two different networks...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1st one&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address 10.22.227.X&#xA;default gateway 10.22.227.254&#xA;DNS1 8.8.8.8&#xA;DNS2 8.8.4.4*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2nd Netowrk&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ip address 10.22.226.x&#xA;default gateway 10.22.226.254 &#xA;DNS1 8.8.8.8&#xA;DNS2 8.8.4.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to link both networks together using the cisco 1841&#xA;I have ran what i thought was the right setup on the rougher (i will post the info below) but it does not work. like i said i am all new to this and i was given this assignment to learn on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be great!&#xA;The 10.22.227.X network is the network that the internet resides on i will also need to five the 226 network internet as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to pictures i have attached so you can see how i set up my computers to the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/c786I.png&quot; alt=&quot;first image&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/7jzAo.png&quot; alt=&quot;second image&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)&#xA;Technical Support: &#xA;Copyright (c) 2006 by cisco Systems, Inc.&#xA;PLD version 0x10&#xA;GIO ASIC version 0x127&#xA;c1841 platform with 131072 Kbytes of main memory&#xA;Main memory is configured to 64 bit mode with parity disabled&#xA;&#xA;&#xA;Readonly ROMMON initialized&#xA;program load complete, entry point: 0x8000f000, size: 0xcb80&#xA;program load complete, entry point: 0x8000f000, size: 0xcb80&#xA;&#xA;program load complete, entry point: 0x8000f000, size: 0xe08298&#xA;Self decompressing the image : #################################################&#xA;################################################################################&#xA;############ [OK]&#xA;&#xA;Smart Init is enabled&#xA;smart init is sizing iomem&#xA;  ID            MEMORY_REQ         TYPE&#xA;                0X003AA110 public buffer pools&#xA;                0X00211000 public particle pools&#xA;                0X000021B8 Onboard USB&#xA;&#xA;If any of the above Memory Requirements are&#xA;&quot;UNKNOWN&quot;, you may be using an unsupported&#xA;configuration or there is a software problem and&#xA;system operation may be compromised.&#xA;&#xA;Allocating additional 7679733 bytes to IO Memory.&#xA;PMem allocated: 117440512 bytes; IOMem allocated: 16777216 bytes&#xA;&#xA;              Restricted Rights Legend&#xA;&#xA;Use, duplication, or disclosure by the Government is&#xA;subject to restrictions as set forth in subparagraph&#xA;(c) of the Commercial Computer Software - Restricted&#xA;Rights clause at FAR sec. 52.227-19 and subparagraph&#xA;(c) (1) (ii) of the Rights in Technical Data and Computer&#xA;Software clause at DFARS sec. 252.227-7013.&#xA;&#xA;           cisco Systems, Inc.&#xA;           170 West Tasman Drive&#xA;           San Jose, California 95134-1706&#xA;&#xA;&#xA;&#xA;Cisco IOS Software, 1841 Software (C1841-IPBASE-M), Version 12.4(3i), RELEASE SO&#xA;FTWARE (fc2)&#xA;Copyright (c) 1986-2007 by Cisco Systems, Inc.&#xA;Compiled Wed 28-Nov-07 18:17 by stshen&#xA;Image text-base: 0x6008873C, data-base: 0x61484470&#xA;&#xA;Port Statistics for unclassified packets is not turned on.&#xA;Cisco 1841 (revision 7.0) with 114688K/16384K bytes of memory.&#xA;Processor board ID FTX1242W01Q&#xA;2 FastEthernet interfaces&#xA;DRAM configuration is 64 bits wide with parity disabled.&#xA;191K bytes of NVRAM.&#xA;31360K bytes of ATA CompactFlash (Read/Write)&#xA;&#xA;&#xA;         --- System Configuration Dialog ---&#xA;&#xA;Would you like to enter the initial configuration dialog? [yes/no]: n&#xA;&#xA;&#xA;Press RETURN to get started!&#xA;&#xA;&#xA;*Apr 13 16:23:37.867: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state&#xA;to administratively down&#xA;*Apr 13 16:23:37.991: %SYS-5-RESTART: System restarted --&#xA;Cisco IOS Software, 1841 Software (C1841-IPBASE-M), Version 12.4(3i), RELEASE SO&#xA;FTWARE (fc2)&#xA;Copyright (c) 1986-2007 by Cisco Systems, Inc.&#xA;Compiled Wed 28-Nov-07 18:17 by stshen&#xA;*Apr 13 16:23:37.991: %SNMP-5-COLDSTART: SNMP agent on host Router is undergoing&#xA; a cold start&#xA;*Apr 13 16:23:38.007: %LINK-5-CHANGED: Interface FastEthernet0/1, changed state&#xA;to administratively down&#xA;*Apr 13 16:23:38.867: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthern&#xA;et0/0, changed state to down&#xA;*Apr 13 16:23:39.007: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthern&#xA;et0/1, changed state to down&#xA;Router&amp;gt;&#xA;Router&amp;gt;enable&#xA;Router#show ip int&#xA;FastEthernet0/0 is administratively down, line protocol is down&#xA;  Internet protocol processing disabled&#xA;FastEthernet0/1 is administratively down, line protocol is down&#xA;  Internet protocol processing disabled&#xA;Router#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;Router(config)#interface fa0/0&#xA;Router(config-if)#description 10.22.227.254 network&#xA;Router(config-if)#ip address 10.22.227.252 255.255.255.0&#xA;Router(config-if)#no shut&#xA;Router(config-if)#&#xA;*Apr 13 16:42:52.367: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state t&#xA;o up&#xA;*Apr 13 16:42:53.367: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthern&#xA;et0/0, changed state to updo&#xA;*Apr 13 16:42:59.963: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthern&#xA;et0/0, changed state to do wr&#xA;% Ambiguous command:  &quot;d wr&quot;&#xA;Router(config-if)#do wr&#xA;% Ambiguous command:  &quot;do wr&quot;&#xA;Router(config-if)#do wright&#xA;wright&#xA;   ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;Router(config-if)#do write&#xA;Building configuration...&#xA;[OK]&#xA;Router(config-if)#&#xA;Router(config-if)#exit&#xA;Router(config)#show ip interface&#xA;                 ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;Router(config)#show ip in&#xA;Router(config)#show ip inter&#xA;Router(config)#show ip interface&#xA;Router(config)#show ip interface&#xA;                 ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;Router(config)#exit&#xA;Router#show&#xA;*Apr 13 16:46:43.543: %SYS-5-CONFIG_I: Configured from console by consol&#xA;% Type &quot;show ?&quot; for a list of subcommands&#xA;Router#show ip interface&#xA;FastEthernet0/0 is up, line protocol is down&#xA;  Internet address is 10.22.227.252/24&#xA;  Broadcast address is 255.255.255.255&#xA;  Address determined by setup command&#xA;  MTU is 1500 bytes&#xA;  Helper address is not set&#xA;  Directed broadcast forwarding is disabled&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;  Proxy ARP is enabled&#xA;  Local Proxy ARP is disabled&#xA;  Security level is default&#xA;  Split horizon is enabled&#xA;  ICMP redirects are always sent&#xA;  ICMP unreachables are always sent&#xA;  ICMP mask replies are never sent&#xA;  IP fast switching is enabled&#xA;  IP fast switching on the same interface is disabled&#xA;  IP Flow switching is disabled&#xA;  IP CEF switching is enabled&#xA;  IP CEF Fast switching turbo vector&#xA;  IP multicast fast switching is enabled&#xA;  IP multicast distributed fast switching is disabled&#xA;  IP route-cache flags are Fast, CEF&#xA;  Router Discovery is disabled&#xA;  IP output packet accounting is disabled&#xA;  IP access violation accounting is disabled&#xA;  TCP/IP header compression is disabled&#xA;  RTP/IP header compression is disabled&#xA;  Policy routing is disabled&#xA;  Network address translation is disabled&#xA;  BGP Policy Mapping is disabled&#xA;FastEthernet0/1 is administratively down, line protocol is down&#xA;  Internet protocol processing disabled&#xA;Router#&#xA;Router#&#xA;Router#&#xA;Router#&#xA;Router#interf t&#xA;        ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;Router#enable&#xA;Router#inter f&#xA;Translating &quot;inter&quot;...domain server (255.255.255.255)&#xA;&#xA;Translating &quot;inter&quot;...domain server (255.255.255.255)&#xA; (255.255.255.255)&#xA;Translating &quot;inter&quot;...domain server (255.255.255.255)&#xA;% Unknown command or computer name, or unable to find computer address&#xA;Router#&#xA;Router#&#xA;Router#conf t&#xA;Router(config)#interface fa0/1&#xA;Router(config-if)#description 10.22.226.254 network&#xA;Router(config-if)#ip address 10.22.226.254 255.255.255.0&#xA;Router(config-if)#no shutdown&#xA;Router(config-if)#&#xA;*Apr 13 16:52:02.779: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state t&#xA;o up&#xA;*Apr 13 16:52:03.779: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthern&#xA;et0/1, changed state to up&#xA;*Apr 13 16:52:10.087: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthern&#xA;et0/1, changed state to down&#xA;Router(config-if)#do write&#xA;Building configuration...&#xA;[OK]&#xA;Router(config-if)#&#xA;Router(config-if)#exit&#xA;Router(config)#exit&#xA;Router#&#xA;*Apr 13 16:52:51.499: %SYS-5-CONFIG_I: Configured from console by console&#xA;Router#exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14856" LastActivityDate="2015-04-14T00:13:35.057" Title="Setting up my first Cisco router to two different networks." Tags="|cisco|switch|router|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="17851" PostTypeId="1" CreationDate="2015-04-13T20:08:32.747" Score="3" ViewCount="864" Body="&lt;p&gt;I'm having trouble wrapping my head around DSCP AF Classes and what--all else being equal--gets dropped first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand packets are given a Class, 1-4. The &lt;em&gt;higher&lt;/em&gt; the Class number, the &lt;em&gt;higher&lt;/em&gt; priority that packet gets. I must assume that higher priority means &lt;em&gt;lower&lt;/em&gt; chance of being dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is this assumption correct: Higher Class = Higher Priority = Lower chance of being dropped?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also understand that packets are given a drop precedence, 1-3... and in this case the &lt;em&gt;lower&lt;/em&gt; the drop precedence, the &lt;em&gt;lower&lt;/em&gt; the chance of being dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;During congestion, does higher Class traffic have precedence over lower Class traffic, regardless of Drop Priority?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, this leads to the absolutely counter-intuitive scenario where, while AF32 is less likely to be dropped than AF13 (32 &gt; 13), AF32 is &lt;em&gt;more&lt;/em&gt; likely to be dropped than AF31 (despite 32 &gt; 31)... and that's &lt;em&gt;really&lt;/em&gt; throwing me for a loop!&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2015-04-14T02:09:29.463" Title="QoS DSCP AF Class Comparisons" Tags="|qos|dscp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17852" PostTypeId="2" ParentId="17850" CreationDate="2015-04-13T21:07:36.527" Score="0" Body="&lt;p&gt;You need to configure router interface ip address with subnet masks. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;1st network   - if this resides on the interface 1 &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;2nd network - if this is on interface 2, please add the following commands&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Config commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t &#xA;! &#xA;int Fa0/1 &#xA;ip address 10.22.227.254 255.255.255.0 &#xA;!&#xA;int Fa0/2&#xA;ip address 10.22.227.254 255.255.255.0 &#xA;!&#xA;wr&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14858" LastEditorUserId="775" LastEditDate="2015-04-14T00:13:35.057" LastActivityDate="2015-04-14T00:13:35.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17853" PostTypeId="2" ParentId="17850" CreationDate="2015-04-13T21:09:02.997" Score="2" Body="&lt;p&gt;From the config you posted it looks like the changes you made are gone. There are no IP addresses on your interfaces. run the below commands again and see if you have connectivity between the networks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  enable&#xA;  configure terminal&#xA;  interface fa0/0&#xA;  description 10.22.227.254 network&#xA;  ip address 10.22.227.254 255.255.255.0&#xA;  no shutdown&#xA;&#xA;  interface fa0/1&#xA;  description 10.22.226.254 network&#xA;  ip address 10.22.226.254 255.255.255.0&#xA;  no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can you also post the output of show version? I'm Specifically interested in the value you have for the config-register.&lt;/p&gt;&#xA;" OwnerUserId="80" LastActivityDate="2015-04-13T21:09:02.997" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17854" PostTypeId="2" ParentId="17844" CreationDate="2015-04-13T21:14:08.247" Score="1" Body="&lt;p&gt;Your server is obviously reachable over the Internet without VPN as evident by you receiving a username/password prompt over SSH.  &lt;strong&gt;I can only speculate that the &quot;Access Denied&quot; resulted from whatever authentication method is employed that checked your source IP address and refused to grant entry from a public IP.&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Had you been on VPN, assuming either split-tunnel or full-tunnel mode forced your access to that server through your company's internal network or back out through the Internet from a known location, the authentication would have permitted what was now seen as the source address belonging to your company, not where you sat [publically] on the Internet.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-04-13T21:14:08.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17855" PostTypeId="2" ParentId="17843" CreationDate="2015-04-13T21:39:06.837" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cfg/configuration/15-sy/sec-usr-cfg-15-sy-book/sec-cfg-sec-4cli.html#GUID-77BB1E82-CF2A-4173-A138-29505E289C89&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS 15SY, User Security Config Guide&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Cisco IOS Privilege Levels&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The default configuration for Cisco IOS software-based networking devices uses privilege level 1 for user EXEC mode and privilege level 15 for privileged EXEC. The commands that can be run in user EXEC mode at privilege level 1 are a subset of the commands that can be run in privileged EXEC mode at privilege 15.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So Priv 15 can do anything. Priv 1 can do anything that doesn't require enable mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand this is a roundabout, reversed answer to your question, but it's the standard one. I know of no canonical list for either category.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To give a little more info, here's what I get from my C2960 running IOS Version 12.2(50r)SE1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Device&amp;gt;?&#xA;Exec commands:&#xA;  &amp;lt;1-99&amp;gt;           Session number to resume&#xA;  access-enable    Create a temporary Access-List entry&#xA;  access-profile   Apply user-profile to interface&#xA;  clear            Reset functions&#xA;  connect          Open a terminal connection&#xA;  crypto           Encryption related commands.&#xA;  disable          Turn off privileged commands&#xA;  disconnect       Disconnect an existing network connection&#xA;  enable           Turn on privileged commands&#xA;  exit             Exit from the EXEC&#xA;  help             Description of the interactive help system&#xA;  lock             Lock the terminal&#xA;  login            Log in as a particular user&#xA;  logout           Exit from the EXEC&#xA;  name-connection  Name an existing network connection&#xA;  ping             Send echo messages&#xA;  rcommand         Run command on remote switch&#xA;  release          Release a resource&#xA;  renew            Renew a resource&#xA;  resume           Resume an active network connection&#xA;  set              Set system parameter (not config)&#xA;  show             Show running system information&#xA;  ssh              Open a secure shell client connection&#xA;  systat           Display information about terminal lines&#xA;  tclquit          Quit Tool Command Language shell&#xA;  telnet           Open a telnet connection&#xA;  terminal         Set terminal line parameters&#xA;  traceroute       Trace route to destination&#xA;  tunnel           Open a tunnel connection&#xA;  where            List active connections&#xA;&#xA;Device&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2015-04-13T21:39:06.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17856" PostTypeId="1" CreationDate="2015-04-13T22:09:50.003" Score="2" ViewCount="18319" Body="&lt;p&gt;Consider a router that interconnects three subnets: Subnet1, Subnet2, and Subnet3. Suppose all of the interfaces in each of these three subnets are required to have the prefix 223.1.17/24. Also suppose that Subnet #1 is to support at least 60 interfaces Subnet #2 is to support at least 90 interfaces Subnet #3 is to support at least 12 interfaces. Provide three network addresses (of the form a.b.c.d/x) that satisfy these constraints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Subnet1 we have to support at least 60 interfaces and 2^6 &gt;= 60 so the prefix for subnet1 is 32-6 = 26 for subnet1  = 223.1.17.x/26 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Subnet2 we have to support at least 90 interfaces and 2^7 &gt;= 90 so the prefix for subnet2 is 32-7 = 25 , and so subnet2 = 223.1.17.y/25&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Subnet3 we have to support at least 12 interfaces and 2^4 &gt;= 12 so the prefix for subnet3 is 32-4 = 28 , and so subnet3 = 223.1.17.z/28&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my problem is working the values for x,y and z.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that for subnet1 (I have 2^6 different values) and for subnet2 (I have 2^7) and for subnet3 (I have 2^4). I also know that all these subnets are not allowed to overlap. So how should I figure out the value for x,y,z ?&lt;/p&gt;&#xA;" OwnerUserId="14861" LastActivityDate="2015-04-14T04:13:02.043" Title="Subnetting Question" Tags="|ipv4|subnet|interface|" AnswerCount="2" CommentCount="7" ClosedDate="2015-04-14T15:11:36.910" ContentLicense="CC BY-SA 3.0" />
  <row Id="17857" PostTypeId="2" ParentId="17856" CreationDate="2015-04-13T22:27:12.137" Score="1" Body="&lt;p&gt;Generally when subnetting using requirements like these, it is easiest to start by organizing the subnets from largest to smallest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, you have a /24 to work with and need to fit a /25 (&lt;em&gt;y&lt;/em&gt;), a /26 (&lt;em&gt;x&lt;/em&gt;), and a /28 (&lt;em&gt;z&lt;/em&gt;) into that range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A /24 is easily separated into two /25s.  The first of these becomes your &lt;em&gt;y&lt;/em&gt; subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second /25 can in turn be separated into two /26s.  Similarly, the first /26 becomes your &lt;em&gt;x&lt;/em&gt; subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, it should be easy to figure out &lt;em&gt;z&lt;/em&gt; from the remaining IP addresses in your original /24. The unused IP addresses could then be reserved for future use.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-04-13T22:58:18.090" LastActivityDate="2015-04-13T22:58:18.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17858" PostTypeId="2" ParentId="17758" CreationDate="2015-04-13T23:38:39.293" Score="2" Body="&lt;p&gt;TCP handshake timeout on the SRX is 20 seconds by default and you can't manually set it lower than 4 seconds, so that's definitely not the issue.&lt;/p&gt;&#xA;&lt;p&gt;Did you do the security flow trace in the other direction?  It would be nice to see the session initiation (the SRX processing the initial TCP SYN) to see what the initial session actually looks like.  That might shine some light on why the return traffic doesn't match the session.&lt;/p&gt;&#xA;&lt;p&gt;To answer your question though, in checking to see if a session is already established, the SRX will look at six match criteria:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;To determine if a packet belongs to an existing flow, the device attempts to match the packet’s information to that of an existing session based on the following six match criteria:&lt;/p&gt;&#xA;&lt;p&gt;• Source address&lt;/p&gt;&#xA;&lt;p&gt;• Destination address&lt;/p&gt;&#xA;&lt;p&gt;• Source port&lt;/p&gt;&#xA;&lt;p&gt;• Destination port&lt;/p&gt;&#xA;&lt;p&gt;• Protocol&lt;/p&gt;&#xA;&lt;p&gt;• Unique token from a given zone and virtual router&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Sources:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1x47/information-products/pathway-pages/security/security-processing-flow-based.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.juniper.net/techpubs/en_US/junos12.1x47/information-products/pathway-pages/security/security-processing-flow-based.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/information-products/topic-collections/security/software-all/security/junos-security-swconfig-security.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.juniper.net/techpubs/en_US/junos12.1/information-products/topic-collections/security/software-all/security/junos-security-swconfig-security.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Specific ingress/egress interfaces do not have to be the same as the initial session creation as long as they are in the same security zones as the interfaces used to set up the session.&lt;/p&gt;&#xA;&lt;p&gt;Source:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB21983&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB21983&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;*see the note, just above purpose.&lt;/p&gt;&#xA;&lt;p&gt;Also - if interfaces/zones were an issue, you'd typically get specific output based on that.  In my experience, I've seen drops in security flow traces that referenced the reason being that the egress interface (in the return direction) was not in the same security zone that the initial ingress traffic that established the session came in on.  It's pretty verbose for the most part.&lt;/p&gt;&#xA;&lt;p&gt;Even with a chassis cluster, not much should be different as far as &amp;quot;session&amp;quot; matching goes, although there are some extra things that happen in some cases.&lt;/p&gt;&#xA;&lt;p&gt;If you're running an active/active cluster, where forwarding redundancy groups are primary/active on different nodes, you could end up with z-mode traffic.  So if the ingress is on node 0 and the egress is on node 1, the active session will be maintained on node 1 (egress of the initial sync) and the backup session will be maintained on node 0.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;With Z-mode processing, the first packet of a sessionis received on one cluster node (the ingress node). When flow determinesthat the egress interface is located on the second node, the packet is forwarded over the fabric link with a forward session setup on the ingress node. The packetis then processed by the second node upon which anActive session is installed and the packet is forwarded out the egress link.  Finally a backup session is created for the Active session in the initial ingress node.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Source:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://kb.juniper.net/library/CUSTOMERSERVICE/GLOBAL_JTAC/NT260/SRX_HA_Deployment_Guide.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://kb.juniper.net/library/CUSTOMERSERVICE/GLOBAL_JTAC/NT260/SRX_HA_Deployment_Guide.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Unless you're doing this with asymmetric routing and the return traffic is leaving an interface on node 1 and returning on node 0 (or vice versa), then we don't have to explore this further - although I believe the backup session can be used and if the zones match and the traffic should still pass.  I'll have to explore that more if that's what's going on.&lt;/p&gt;&#xA;" OwnerUserId="14825" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-04-13T23:38:39.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17860" PostTypeId="2" ParentId="17851" CreationDate="2015-04-14T02:09:29.463" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I understand packets are given a Class, 1-4. The higher the Class&#xA;  number, the higher priority that packet gets. I must assume that&#xA;  higher priority means lower chance of being dropped.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Is this assumption correct: Higher Class = Higher Priority = Lower&#xA;  chance of being dropped?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;During congestion, does higher Class traffic have precedence over&#xA;  lower Class traffic, regardless of Drop Priority?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Both of these are incorrect.  Each class has a minimum amount of resources (e.g., bandwidth) allocated to it.  Different classes will have different amounts.  So for example, Class 4 may have 30% of the link bandwidth allocated to it, while class 3 has only 10%.  That means during congestion, class 4 is guaranteed a minimum of 30% of the link bandwidth.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that class 4 doesn't have higher priority than 3, it just means it has a different amount of resources available to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within each class, the drop priority indicates the probability that the traffic would be dropped.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-04-14T02:09:29.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17862" PostTypeId="2" ParentId="17856" CreationDate="2015-04-14T04:13:02.043" Score="0" Body="&lt;p&gt;Wouldn't x, y and z be 0, 64 and 192? Since, for subnet1 you can have 64 addresses in total, so the network address for the first subnet would be 223.1.17.0, and the broadcast address would be 223.1.17.63 - this gives 62 (64 - 2) &lt;strong&gt;usable&lt;/strong&gt; addresses. The network address for subnet2 would be the one after where subnet 1 left off - 223.1.17.64, and the CIDR prefix allows 128 hosts for this subnet so the broadcast address would be 223.1.17.191 - giving 126 (128 - 2) &lt;strong&gt;usable&lt;/strong&gt; addresses. Finally for subnet 3 you can have 16 addresses in total, similarly, we start from where subnet2 left off, so 223.1.17.192 for the network address for subnet 3, and 223.1.17.207 for the broadcast address. This gives 14 (16 - 2) &lt;strong&gt;usable&lt;/strong&gt; addresses.&lt;/p&gt;&#xA;" OwnerUserId="14250" LastActivityDate="2015-04-14T04:13:02.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17864" PostTypeId="2" ParentId="17801" CreationDate="2015-04-14T05:02:28.553" Score="-1" Body="&lt;p&gt;QoS is complicated.  It requires absolutely correct marking across the entire edge of your network and correct trust/queueing internal to your network to guarantee operation.  Additionally the software/hardware operating in your network require different syntax and can affect QoS capabilities and operation.  This is not to say that QoS is not a valid solution when you cannot afford to increase link capacity.  Also with jitter-sensitive SLA-based traffic (SIP trunk/hosted VoIP) it is usually worthwhile to configure a priority queue in addition to a 'standard' queue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding bandwidth solves the long-term problem of insufficient capacity without the complications involved in configuring and monitoring QoS performance, and then still having to add bandwidth when the link is over-saturated in some shorter-than-expected time period.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-04-14T05:02:28.553" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17865" PostTypeId="2" ParentId="17801" CreationDate="2015-04-14T07:33:59.190" Score="4" Body="&lt;p&gt;There are at least two questions in your one question :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Throwing more bandwidth&quot; at the problem doesn't solve anything, it just hides the problem. In IP network you should always prepare baseline QoS architecture to guarantee delivery of critical traffic and manage other traffic parameters (like jitter or delay) for different classes of traffic. You can take a look into NANOG presentation archives for extensive amount of material generated in that kind of discussions, with usual outcome being &quot;yeah, maybe we should do QoS&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traditionally, QoS is perceived as the &quot;hard thing to do right&quot; as the PHB model for IP network is indeed quite complex to plan and implement right. Historically, it was usually also connected with specific hardware requirements, architectures and configuration complexity which didn't help. But when you look at traditional SPs and their networks - they generally implement at least 3-4 classes of traffic and QoS policies to manage traffic flow within their networks. Throught last couple of years traditional certification testing tends to move from testing 4 classes and queues to 8-16 for transport network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OTOH, not having any QoS in the network usually also means those saying &quot;QoS is not needed, I don't have it and everything works OK&quot; have no actual means of monitoring how the network behaves and what is the actual environment applications have for their own use. TCP has great adaptability to network conditions and sometimes problems are not visible with &quot;naked&quot; eye, but become painfully obvious when we dig into details and bit flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the second part of your question - there is nothing that can help you to fight with microburst apart from having deep enough buffers to accomodate them. Which leads almost immediately to things like buffer bloat and additional delays on the path if you tend to simplify and throw packet buffers with memory fast enough to actually deal with microburst (which is not simple and cheap). QoS unfortunately (at least - the mechanisms available in the usual toolset of networking gear) doesn't help 'control' microburst. Good news however is that You'll find microburst dangerous or damaging usually only in HPC and generally DC environments, not in typical transport networks.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2015-04-14T07:33:59.190" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17869" PostTypeId="1" CreationDate="2015-04-14T14:09:21.263" Score="1" ViewCount="3270" Body="&lt;p&gt;I encounter a network problem. My clients can ping the Oracle ERP server but experience frequently session timeout when access to the ERP application.&#xA;I have configured two port channel to the oracle switches and the two port-channel are configured in the same setting.&#xA;I have found that message in the cisco siwtch log,&lt;code&gt;%SW_MATM-4-MACFLAP_NOTIF: Host 0010.e05c.ac14 in vlan 3 is flapping between port Po4 and port Po5&lt;/code&gt; (core switch)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UeHpV.png&quot; alt=&quot;Network diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running config on cisco core switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface &#xA;&#xA;Port-channel4&#xA;&#xA;description To Oracle Switch 2&#xA;&#xA;switchport mode trunk&#xA;&#xA;!&#xA;&#xA;interface &#xA;&#xA;Port-channel5&#xA;&#xA;description To Oacle Switch 1&#xA;&#xA;switchport mode trunk&#xA;&#xA;!&#xA;&#xA;interface GigabitEthernet1/0/11&#xA;&#xA; description To Oracle switch 1 &#xA;&#xA; switchport mode trunk&#xA;&#xA; channel-group 5 mode active&#xA;&#xA;!&#xA;&#xA;interface GigabitEthernet1/0/12&#xA;&#xA; description To Oracle Switch 2 &#xA;&#xA; switchport mode trunk&#xA;&#xA; channel-group 4 mode active&#xA;&#xA;!&#xA;&#xA;interface GigabitEthernet2/0/11&#xA;&#xA; description To Oracle switch 1 &#xA;&#xA; switchport mode trunk&#xA;&#xA; channel-group 5 mode active&#xA;&#xA;!&#xA;&#xA;interface GigabitEthernet2/0/12&#xA;&#xA; description To Oracle Switch 2 &#xA;&#xA; switchport mode trunk&#xA;&#xA; channel-group 4 mode active&#xA;&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I deal with the mac address flapping problem?&#xA;I appreciate any suggestions and response:)&lt;/p&gt;&#xA;" OwnerUserId="14872" LastEditorUserId="76" LastEditDate="2015-04-14T19:19:26.987" LastActivityDate="2015-12-12T09:05:52.777" Title="VM Mac address flapping between two port channel on Cisco switch" Tags="|cisco|ieee-802.1ax|vmware|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17871" PostTypeId="2" ParentId="17810" CreationDate="2015-04-14T16:12:24.127" Score="3" Body="&lt;p&gt;After more thoroughly combing through the RFC, I'm certain that the expected behavior I mentioned in my post is accurate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Intra-area routing within each area (area 1, area 0(a), and area 0(b)) will work as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Area 0 summaries will still flood to area 1 from each area 0 partition, giving area 1 all necessary routing information for both area 0 partitions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Area 1 summaries will still flood to both area 0 partitions from area 1, allowing both area 0 partitions to know about area 1 routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Area 1 will not send area 0 summaries back into area 0, so split area 0 partitions will no longer know about each other and will not try to transit area 1 to get to each other (unless a virtual link through area 1 is created).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my desired behavior for a failure scenario based on my circumstances.  If all of the redundant links between my data centers go down, or I need to perform certain types of maintenance, I don't want data center to data center traffic (mostly backups / off-site replication) saturating my branch site WAN links.  I could apply policing on the WAN links for transit traffic between data centers, but the little bit of bandwidth I could give that traffic would be useless anyway - and that would require my team to maintain more config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone has any questions about this, feel free to comment and I will try to find the answers.&lt;/p&gt;&#xA;" OwnerUserId="14825" LastActivityDate="2015-04-14T16:12:24.127" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17873" PostTypeId="1" CreationDate="2015-04-14T18:20:20.890" Score="0" ViewCount="3182" Body="&lt;p&gt;I am new to Dell switches and have recently joined a company. There are two IP addresses configured on a 5548 PowerConnect.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address 192.168.0.5 255.255.252.0&#xA;ip address 192.168.137.17 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and default gateway is mentioned as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip default-gateway 192.168.137.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However we are not using the 192.168.137.x subnet. Are these ip addresses default configuration already present on switches?&lt;/p&gt;&#xA;" OwnerUserId="14877" LastEditorUserId="33" LastEditDate="2015-04-17T05:01:06.600" LastActivityDate="2015-04-17T05:01:06.600" Title="Default Configuration in Dell 5548" Tags="|dell|powerconnect|" AnswerCount="1" CommentCount="1" ClosedDate="2015-04-22T19:39:33.337" ContentLicense="CC BY-SA 3.0" />
  <row Id="17876" PostTypeId="1" CreationDate="2015-04-14T19:04:05.443" Score="2" ViewCount="266" Body="&lt;p&gt;I have been trying to learn how to use the 2950's switch and the 1841 router by Cisco. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yesterday i finally got my router (some what) set up to where i can connect my 10.22.227.x network to 10.22.226.x network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem i seam to have now is that when i connect the router to my 10.22.227.x network (our main network that we have had for about a year now) it makes the network extremely slow and or we loose internet all together. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to everyone here (&lt;a href=&quot;http://goo.gl/mfNWau&quot; rel=&quot;nofollow&quot;&gt;http://goo.gl/mfNWau&lt;/a&gt;) i was able to get it all set up to get thus far. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how i have the router set up right now. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enable&#xA;  configure terminal&#xA;  interface fa0/0&#xA;  description 10.22.227.254 network&#xA;  ip address 10.22.227.254 255.255.255.0&#xA;  no shutdown&#xA;&#xA;  interface fa0/1&#xA;  description 10.22.226.254 network&#xA;  ip address 10.22.226.254 255.255.255.0&#xA;  no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A few people were telling me and from what i have read. I am going to neet to set up a outing protocol?......how do i do this?....and would this keep it from wiping out our network?&lt;/p&gt;&#xA;" OwnerUserId="14856" LastEditorUserId="509" LastEditDate="2015-04-23T20:13:09.887" LastActivityDate="2015-04-23T20:13:09.887" Title="Cisco 1841 router killing network" Tags="|cisco|switch|router|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="17877" PostTypeId="2" ParentId="17869" CreationDate="2015-04-14T19:10:12.047" Score="0" Body="&lt;p&gt;Can you run a &lt;strong&gt;&lt;em&gt;show port-channel summary&lt;/em&gt;&lt;/strong&gt; from the cisco switch and see if the port actually came up?  You may need to &lt;strong&gt;&lt;em&gt;interface port-channel#&lt;/em&gt;&lt;/strong&gt;  and then &lt;strong&gt;&lt;em&gt;no shutdown&lt;/em&gt;&lt;/strong&gt;  (for each interface).  If the interface is up, make sure that you're using the same type of aggregation that the oracle switch expects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From your diagram it's also possible that your cross-connect is to blame.  How are you managing failover on the Oracle switches?  If all the links are live then that can cause your flapping problem.&lt;/p&gt;&#xA;" OwnerUserId="14879" LastActivityDate="2015-04-14T19:10:12.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17878" PostTypeId="2" ParentId="17869" CreationDate="2015-04-14T20:38:17.850" Score="2" Body="&lt;p&gt;This is entirely due to the host side redundant configuration. In this mode, &lt;em&gt;only one NIC&lt;/em&gt; can be in use at a time. If it balances traffic across both NICs using the same MAC, you will have this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I'm pretty sure your hardware doesn't support &lt;em&gt;Multi-chassis LACP&lt;/em&gt;.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-14T20:38:17.850" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17879" PostTypeId="2" ParentId="17873" CreationDate="2015-04-14T21:22:36.760" Score="3" Body="&lt;p&gt;There's no default gw defined by default on Powerconnect 5500 series switches.  Use &lt;code&gt;no ip default-gateway&lt;/code&gt; command to remove or &lt;code&gt;ip default-gateway &amp;lt;gw address&amp;gt;&lt;/code&gt; to change.  The CLI manual is &lt;a href=&quot;http://downloads.dell.com/Manuals/Common/PowerConnect5500_CLIRef_en-us.pdf&quot; rel=&quot;nofollow&quot; title=&quot;here&quot;&gt;here.&lt;/a&gt;  Sounds like it would be a good thing to read up on.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2015-04-14T21:22:36.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17880" PostTypeId="1" AcceptedAnswerId="17883" CreationDate="2015-04-14T21:27:20.463" Score="3" ViewCount="10915" Body="&lt;p&gt;Today I had a POTS line installed to my 66 block/DEMARC.  I need to hook-up a phone for this line for my boss.  I'm assuming I can just wire the appropriate patch cable into the 66 block, patch it to his phone port and plug the phone in on the other end in his office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After inspecting the 66 block in the telco room I realize I don't really understand how it works.  Here's an image of the 66 block, where the phone line has been installed into 'slot #2'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/aw7Rl.jpg&quot; alt=&quot;punch down box&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the patch cable I want to use.  It's just 4 wires, open on one end, and an RJ45 on the other. (Image because the colors look atypical)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/I52PC.jpg&quot; alt=&quot;patch cable&quot;&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is my assumption in how to hook up this line correct? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, &lt;strong&gt;which wires do I put into which terminals specifically?&lt;/strong&gt; (That's what I don't understand.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional note: I do not have any sort of tone/dial tone detection equipment, the line is installed to &quot;slot #2.&quot;&lt;/p&gt;&#xA;" OwnerUserId="14654" LastEditorUserId="14654" LastEditDate="2015-04-15T16:20:51.993" LastActivityDate="2015-04-15T16:20:51.993" Title="How to connect to a POTS line via a 66 block?" Tags="|telephony|patch-panel|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17881" PostTypeId="1" AcceptedAnswerId="17884" CreationDate="2015-04-14T21:33:12.303" Score="2" ViewCount="3496" Body="&lt;p&gt;While troubleshooting a problem that a client reported I came across the IOS interface setting &lt;code&gt;bandwidth&lt;/code&gt;. For whatever reason their interface was set to &lt;code&gt;bandwidth 20&lt;/code&gt;. I understand that it doesn't limit actual bandwidth on the port like &lt;code&gt;srr-queue&lt;/code&gt; does but it's a bit confusing for someone like me who works mostly on Layer 2. Cisco says it's a bandwidth limitation for communication with higher protocols such as EIGRP. &lt;a href=&quot;http://www.techrepublic.com/article/clarifying-the-cisco-ios-bandwidth-command/&quot; rel=&quot;nofollow&quot;&gt;This article&lt;/a&gt; goes into some detail about how it's used for calculating across interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a command that should be used only on interfaces where backbone devices are connected, ex. a Ten Gig link between a building switch and a main router? Does it affect clients if &lt;code&gt;bandwidth&lt;/code&gt; is set fairly low on an interface they're connected to, such as reaching intranet servers or external devices?&lt;/p&gt;&#xA;" OwnerUserId="14048" LastEditorUserId="619" LastEditDate="2015-04-14T22:44:08.223" LastActivityDate="2015-04-14T23:20:53.053" Title="How exactly does &quot;bandwidth&quot; in the Cisco IOS affect network performance?" Tags="|routing|bandwidth|eigrp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17883" PostTypeId="2" ParentId="17880" CreationDate="2015-04-14T22:34:34.347" Score="4" Body="&lt;p&gt;The black and yellow pair should be terminated on the pins just to the right of where the phone company terminated the pair. You can look at the pair above the pair you want and see someone has terminated something right above where you want to terminate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's called a 66 block and it has 50 rows of terminals by four columns. Each row in the left two columns are connected and each row in the right two columns is connected, but the left and right half are not connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you need to go to the second column from the left and the third and fourth rows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now it sort of matters which one you terminate on the third row and which one you terminate on the fourth, but for your situation it's not worth worrying about.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-04-14T22:34:34.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17884" PostTypeId="2" ParentId="17881" CreationDate="2015-04-14T23:20:53.053" Score="5" Body="&lt;p&gt;It's a little complex, and also platform specific in some cases.  The most general answer is that the bandwidth statement is used as an input to the &lt;a href=&quot;https://learningnetwork.cisco.com/thread/7133&quot; rel=&quot;noreferrer&quot;&gt;EIGRP routing protocol&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also cases where the bandwidth command can be applied on a main or subinterface and impact QoS calculations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, unless you're running EIGRP and specifically need it, my advice would be to not use the command at all.&lt;/p&gt;&#xA;" OwnerUserId="13955" LastActivityDate="2015-04-14T23:20:53.053" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17885" PostTypeId="1" CreationDate="2015-04-14T23:32:29.363" Score="2" ViewCount="517" Body="&lt;p&gt;Consider an application (mostly TCP/UDP, but not strictly so) where the packet sizes vary, and may be very long.  The use case / problem statement is to identify duplicate frames that are collected at multiple points in the network.  (Meaning that if we collect a frame from router X, and a frame from router Y, how can we determine with high probability that these are or are not the same frame)...  Further assume that we can create a (good) hash on the first NNN bytes of the frame relatively cheaply.   In my mind I'm thinking that the hash could be generated on somewhere in the neighborhood of the first 100-200 bytes.  This is certainly enough to get the {L2, IP, TCP|UDP} headers, as well as most common application protocols where those headers are directly after the L4 headers (HTTP, VOIP, streaming video, etc).  As long as we can get the headers AND at least a little bit of the payload &quot;data&quot; I can mostly convince myself that this hash will accurately identify uniqueness.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone think of specific applications where the hash on just the early part of the frame would &lt;strong&gt;NOT&lt;/strong&gt; be a good indicator of uniqueness?  Anyone have a compelling argument as to how deep that hash would need to be?  (i.e. is 128B sufficient for most cases?)&lt;/p&gt;&#xA;" OwnerUserId="13955" LastActivityDate="2015-05-15T01:35:20.953" Title="hashing part of a packet/frame to identify duplicate packets" Tags="|monitoring|packet-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17886" PostTypeId="2" ParentId="17885" CreationDate="2015-04-15T01:32:41.833" Score="2" Body="&lt;p&gt;Unless you truly capture the frames on the same ethernet segment, the frames will be different after your routers rewrite mac addresses, decrement the IP TTLs, and recalculates checksums.  And with VLAN tagging, frame sizes may vary depending on exactly where in the network they are pulled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ignoring the effects of NAT/PAT rewrites of IP addresses and ports, or firewalls changing TCP sequence numbers, I suggest the following fields to derive the canonical frames for the largest LAN diameter:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;5-tuple (src ip &amp;amp; port, dst ip &amp;amp; port, proto)&lt;/li&gt;&#xA;&lt;li&gt;tcp sequence number&lt;/li&gt;&#xA;&lt;li&gt;tcp acknowledgment number&lt;/li&gt;&#xA;&lt;li&gt;ip total length&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Ideally, to ignore duplicate packets from retransmissions, an &lt;em&gt;ip timestamp option&lt;/em&gt; would be used and could be added to form the canonical. Other custom header options could be introduced into the stream for true fingerprinting of frames.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-04-15T01:32:41.833" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17889" PostTypeId="1" CreationDate="2015-04-15T06:37:49.087" Score="0" ViewCount="114" Body="&lt;p&gt;We are moving our HQ to a new building, I am responsible for designing the network and the data center, I was thinking to make it all wireless, but what about the voice services, can we get a good VoIP and video conferanceing services specially that the wireless is a half duplex only connection, also I am looking to Cisco solutions for the VoIP because we getting a new one, is there any better company do VoIP for wireless ?&lt;/p&gt;&#xA;" OwnerUserId="14870" LastEditorUserId="14870" LastEditDate="2015-04-19T05:32:10.177" LastActivityDate="2015-04-19T05:32:10.177" Title="Is wireless network sutabile for VoIP services?" Tags="|cisco|wireless|design|voip|architecture|" AnswerCount="1" CommentCount="5" ClosedDate="2015-04-15T17:03:21.340" ContentLicense="CC BY-SA 3.0" />
  <row Id="17890" PostTypeId="2" ParentId="7713" CreationDate="2015-04-15T07:14:34.763" Score="0" Body="&lt;p&gt;If you want some video there is a Great explanation here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=JPLn6wfAmZY&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=JPLn6wfAmZY&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14858" LastActivityDate="2015-04-15T07:14:34.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17892" PostTypeId="1" AcceptedAnswerId="17895" CreationDate="2015-04-15T09:01:33.743" Score="1" ViewCount="103" Body="&lt;p&gt;i do some research on graceful restart for OSPF, BGP, LDP. After i read those RFCs for these protocols, i have a question want to ask that if a router really goes down not restart (i.e. power off...), how can it still forward data????&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="14888" LastActivityDate="2015-04-15T13:48:48.567" Title="Question about graceful restart" Tags="|routing|bgp|troubleshooting|redundancy|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17893" PostTypeId="1" CreationDate="2015-04-15T10:40:21.153" Score="5" ViewCount="1853" Body="&lt;p&gt;I can not configure the RSVP between Cisco6509 SUP2T and Juniper MX480.&#xA;Prior to that set up the neighbor 3 without problems. Now that it is impossible ...I do not understand why :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;scheme: Cisco t5/5 trunk &gt; Extreme670&gt; Juniper MX480.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;side MX&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;admin@M10_MX480&amp;gt; show configuration interfaces xe-1/0/2.29 &#xA;vlan-id 29;&#xA;family inet {&#xA;    address 185.13.115.89/31;&#xA;}&#xA;family mpls;&#xA;&#xA;{master}&#xA;admin@M10_MX480&amp;gt; show configuration protocols | display set | match xe-1/0/2.29 &#xA;set protocols rsvp interface xe-1/0/2.29&#xA;set protocols mpls interface xe-1/0/2.29&#xA;set protocols ospf area 0.0.0.0 interface xe-1/0/2.29&#xA;&#xA;{master}&#xA;admin@M10_MX480&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Side Catalyst&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MED-C6509#sh run int vlan 29&#xA;Building configuration...&#xA;&#xA;Current configuration : 155 bytes&#xA;!&#xA;interface Vlan29&#xA; mtu 8978&#xA; ip address 185.13.115.88 255.255.255.254&#xA; ip ospf 1 area 0&#xA; mpls traffic-eng tunnels&#xA; mpls ip&#xA; ip rsvp signalling hello&#xA;end&#xA;&#xA;MED-C6509#sh run | s ospf&#xA;router ospf 1&#xA; router-id 172.16.16.5&#xA; auto-cost reference-bandwidth 1000&#xA; network 172.16.16.5 0.0.0.0 area 0  &amp;lt;&amp;lt;&amp;lt;&amp;lt; Loopback&#xA; network 195.128.59.172 0.0.0.3 area 0&#xA; network 195.128.59.176 0.0.0.3 area 0&#xA; mpls traffic-eng router-id Loopback3&#xA; mpls traffic-eng area 0&#xA;MED-C6509#sh run | s rsvp&#xA; ip rsvp signalling hello&#xA; ip rsvp signalling hello&#xA; ip rsvp signalling hello&#xA; ip rsvp signalling hello&#xA; ip rsvp signalling hello&#xA;ip rsvp signalling hello&#xA;MED-C6509#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but other RSVP-hosts relationships OK&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MED-C6509#sh ip rsvp neighbor &#xA;Neighbor        Encapsulation  Time since msg rcvd/sent&#xA;185.13.115.78   Raw IP         00:00:01   00:00:01  &#xA;185.13.115.82   Raw IP         00:00:01   00:00:01  &#xA;195.128.59.174  Raw IP         00:00:01   00:00:01  &#xA;&#xA;* Neighbors inactive for more than one hour are not shown.&#xA;  Use the &quot;inactive&quot; keyword to display them.&#xA;MED-C6509#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14564" LastActivityDate="2018-03-02T11:16:47.190" Title="RSVP between Cisco and Juniper" Tags="|cisco|juniper-junos|mpls|rsvp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="17895" PostTypeId="2" ParentId="17892" CreationDate="2015-04-15T13:48:48.567" Score="1" Body="&lt;p&gt;Graceful Restart is not designed to maintain forwarding in the event that a router is intentionally shut down; it is only to keep forwarding working long enough to perform a soft reboot on one controller at a time (of two or more controllers), i.e. to let firmware updates take effect.  In effect, the functionality puts a &quot;pause&quot; on routing protocols so that surrounding routers don't panic when a peer isn't responding to BGP/LDP/etc. Then, when the reboot is complete, the peer routers can rebuild just their relationship to get back in sync, instead of reconverging the entire path.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-04-15T13:48:48.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17896" PostTypeId="1" AcceptedAnswerId="17899" CreationDate="2015-04-15T14:32:40.453" Score="1" ViewCount="312" Body="&lt;p&gt;Trying to set up the XML API on an ASR 9K and find myself unable to authenticate with the XML API using Netcat. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've configured the box as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building configuration...&#xA;!! IOS XR Configuration 5.1.2&#xA;!! Last configuration change at Wed Apr 15 07:19:42 2015 by root&#xA;!&#xA;username xml&#xA;group sysadmin&#xA;secret 5 $1$LY8B$39t3eTXf/ajMGWnX99.ux0&#xA;password 7 07182E414C080D1657&#xA;!&#xA;aaa authorization exec default group tacacs+ local&#xA;interface MgmtEth0/RSP0/CPU0/0&#xA;ipv4 address 10.2.100.1 255.255.0.0&#xA;!&#xA;interface MgmtEth0/RSP0/CPU0/1&#xA; shutdown&#xA;!&#xA;interface TenGigE0/0/2/0&#xA; shutdown&#xA;!&#xA;interface TenGigE0/0/2/1&#xA; shutdown&#xA;!&#xA;interface TenGigE0/0/2/2&#xA; shutdown&#xA;!&#xA;interface TenGigE0/0/2/3&#xA; shutdown&#xA;!&#xA;router static&#xA; address-family ipv4 unicast&#xA;  0.0.0.0/0 10.2.0.1&#xA; !&#xA;!&#xA;ssh server v2&#xA;xml agent ssl&#xA;!&#xA;xml agent tty&#xA;!&#xA;xml agent&#xA;iteration on size 100&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and &#xA;    RP/0/RSP0/CPU0:ios# xml echo&#xA;    Wed Apr 15 07:27:10.765 UTC&#xA;    XML&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got two test users, root:root and xml, both of which I can connect to using SSH though the XML interface seems to reject them - using nc:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alexanderturner@Alexanders-MacBook-Pro~/Downloads&amp;gt; nc -v 10.2.100.1 38751&#xA;found 0 associations&#xA;found 1 connections:&#xA;    1:  flags=82&amp;lt;CONNECTED,PREFERRED&amp;gt;&#xA;    outif en0&#xA;    src 10.0.1.40 port 61066&#xA;    dst 10.2.100.1 port 38751&#xA;    rank info not available&#xA;    TCP aux info available&#xA;&#xA;Connection to 10.2.100.1 port 38751 [tcp/*] succeeded!&#xA;&#xA;&#xA;User Access Verification&#xA;&#xA;Username: root&#xA;Password: root&#xA;&#xA;&#xA;User Access Verification&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this not authing against local?&lt;/p&gt;&#xA;" OwnerUserId="14894" LastActivityDate="2016-02-09T21:05:22.220" Title="ASR9K XML API - Can't Authenticate" Tags="|cisco|cisco-ios-xr|cisco-asr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17898" PostTypeId="2" ParentId="17889" CreationDate="2015-04-15T15:04:37.793" Score="1" Body="&lt;p&gt;Recommendations on which manufacturer to use are off-topic here.  But I can tell you from experience that you can reliably do VoWLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the performance of the wireless network is more critical when you're using VoIP. You will need a denser AP deployment than for just data.  You need to make sure they survey takes VoIP into account.  Pay close attention to AP placement and expected user density. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also spend more time testing and tweaking your clients (wireless phones, etc), especially if you're using phones from a different manufacturer.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-04-15T15:04:37.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17899" PostTypeId="2" ParentId="17896" CreationDate="2015-04-15T15:27:10.930" Score="1" Body="&lt;p&gt;Looks like it was an issue with nc, works fine with telnet :/&lt;/p&gt;&#xA;" OwnerUserId="14894" LastActivityDate="2015-04-15T15:27:10.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17900" PostTypeId="1" CreationDate="2015-04-15T19:04:15.780" Score="4" ViewCount="875" Body="&lt;p&gt;I have an HP 4210G, which is a rebranded 3com 4200G.  I have set up DHCP relay on the switch, but I'm only able to select one server group aka one IP at a time. Is it possible to set up multiple DHCP servers?&lt;/p&gt;&#xA;" OwnerUserId="14900" LastEditorUserId="49701" LastEditDate="2018-08-27T05:22:30.600" LastActivityDate="2018-08-27T05:22:30.600" Title="HP 4210G DHCP relay" Tags="|dhcp|hp|3-com|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="17902" PostTypeId="2" ParentId="17900" CreationDate="2015-04-15T21:00:15.200" Score="2" Body="&lt;p&gt;Section &quot;Correlating a DHCP Server Group with a Relay Agent Interface&quot; in the &lt;a href=&quot;http://h20565.www2.hp.com/portal/site/hpsc/template.PAGE/action.process/public/psi/manualsDisplay/?sp4ts.oid=4218284&amp;amp;javax.portlet.action=true&amp;amp;spf_p.tpst=psiContentDisplay&amp;amp;javax.portlet.begCacheTok=com.vignette.cachetoken&amp;amp;spf_p.prp_psiContentDisplay=wsrp-interactionState%3DdocId%253Demr_na-c02586078%257CdocLocale%253Den_US&amp;amp;javax.portlet.endCacheTok=com.vignette.cachetoken&quot; rel=&quot;nofollow&quot;&gt;3Com Switch 4210G Family Configuration Guide&lt;/a&gt; states that: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You can specify up to twenty DHCP server groups on the relay agent and&#xA;  eight DHCP server addresses for each DHCP server group.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A DHCP server group can correlate with one or multiple DHCP relay&#xA;  agent interfaces, while a relay agent interface can only correlate&#xA;  with one DHCP server group.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The command to create a DHCP server group is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dhcp relay server-group group-id ip ip-address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have no 4210G to test, but I guess running this command several times with the same group ID and the IP addresses of your DHCP servers will add the servers to the group. For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dhcp relay server-group 10 ip 10.10.10.1&#xA;dhcp relay server-group 10 ip 10.10.10.2&#xA;dhcp relay server group 10 ip 10.10.10.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then you apply the  server-group to the interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, I have found &lt;a href=&quot;http://blog.patricknielsen.net/2012/01/hp-h3c-switches-dhcp-relay.html&quot; rel=&quot;nofollow&quot;&gt;a configuration example&lt;/a&gt; for H3C switches with the same syntax stated in the 4210G config guide and using a sever group with 2 servers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dhcp enable&#xA;dhcp relay server-group 1 ip x.x.x.x&#xA;dhcp relay server-group 1 ip y.y.y.y&#xA;&#xA;interface vlan-interface 1&#xA;dhcp select relay&#xA;dhcp relay server-select 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="76" LastEditorUserId="76" LastEditDate="2015-05-16T04:09:22.470" LastActivityDate="2015-05-16T04:09:22.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17903" PostTypeId="1" CreationDate="2015-04-15T22:41:59.963" Score="5" ViewCount="9899" Body="&lt;p&gt;I have a Cisco SG200-26, and it appears to cause random network problems like timeouts, etc. Error logs on the switch do not indicate any problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I replaced the switch with a different switch, and the network problems no longer happen. I'd like to extensively test the switch in a way which would really put a big load on all the ports without the need to use 26 computers to flood the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking about using VLANs to create small LAN segments, connecting them with patch cables in daisy chains, and putting one computer on port 1 with a second computer on port 26. I would then copy a big file between the two computers to see how it goes. I don't know how to setup switch ports and VLANs to make it work.  Maybe it is not possible to do; you tell me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To explain in detail, I would set ports 1 and 2 as VLAN 10, connect a computer on port 1, connect a patch cable between ports 2 and 3, which would be VLAN 11. Port 4 would also be VLAN 11, and would be patched to port 5 in VLAN 12. Port 6, also VLAN 12 would be patched to port 7 in VLAN 13... and so on until we reach port 26, where we have the second computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that such a setup will make the traffic between ports 1 and 26 to go through all the ports in between.  How should I do it, and, in case it can't be done, please explain why it can't be done. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="14905" LastEditorUserId="8499" LastEditDate="2018-03-18T21:08:30.970" LastActivityDate="2018-03-18T21:08:30.970" Title="How to extensively test an ethernet switch" Tags="|cisco|switch|vlan|spanning-tree|testing|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17905" PostTypeId="1" CreationDate="2015-04-16T02:16:34.233" Score="1" ViewCount="93" Body="&lt;p&gt;I've got fiber lines coming into my office, with IP setup like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access Network 123.123.123.20/30&lt;br&gt;&#xA;Our Router: 123.123.123.21&lt;br&gt;&#xA;ISP Router: 123.123.123.22&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment the router is taking the fiber in and acting as a gateway, but I'm considering taking an SFP and putting it in a switch before the router [on its own vlan] to make the network more flexible. Are there any dangers to doing so with such a contrained ip space? Is there other benefits for widening this access network? Are ISPs keen on doing so?&lt;/p&gt;&#xA;" OwnerUserId="14908" LastEditorUserId="509" LastEditDate="2015-04-16T06:02:47.780" LastActivityDate="2015-04-16T06:02:47.780" Title="Tradeoffs of an 'access network' with 30 bit subnet mask" Tags="|routing|switch|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17906" PostTypeId="2" ParentId="17905" CreationDate="2015-04-16T03:23:11.707" Score="3" Body="&lt;p&gt;&lt;strong&gt;The /30 only provides two useable host addresses&lt;/strong&gt; and your router and the ISP have consumed them.  This net block is commonly known as the WAN block from your ISP and is used for just that link.  For the access side, you should have a separate (public) LAN block provided to you by the ISP.  This could be as small as a /29 or to a /24 or larger, depending on your needs (with justification).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LAN block is where you should be concentrating your &quot;access network&quot;.  On this side of the fence, you place your firewall or other publicly facing devices here that should be protected from the Internet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user1 \&#xA;user2  -- sw [private lan] -- fw -- [public lan] -- rtr [wan /30] -- ISP -- Internet&#xA;user3 /&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-04-16T03:23:11.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17907" PostTypeId="2" ParentId="17903" CreationDate="2015-04-16T03:50:05.697" Score="4" Body="&lt;p&gt;&lt;em&gt;Judging by your switch, I'd say you don't have the budget for a real ethernet tester like those from Fluke Networks.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your switch is Layer 2 (L2) only and doesn't support &lt;strong&gt;routing&lt;/strong&gt;, so you'd need an external router (L3) to move packets between the VLANs.  I would conjecture that your random network issues were caused by either bad cabling or mismatch on speed/duplex between the switch and your systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can look at using &lt;a href=&quot;http://en.wikipedia.org/wiki/Iperf&quot; rel=&quot;nofollow&quot;&gt;iperf&lt;/a&gt; configured on a server, and then have each of your client computers run a test from their respective ports to the server (one at a time), then look for interface error counters being incremented to help isolate any issues or misconfiguration.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2015-04-16T06:57:08.333" LastActivityDate="2015-04-16T06:57:08.333" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17908" PostTypeId="1" AcceptedAnswerId="17927" CreationDate="2015-04-16T04:43:22.950" Score="6" ViewCount="4125" Body="&lt;p&gt;I have stacked 2960X switches trunked to a single ASA 5515X in routed mode, and I've captured the drops with &lt;code&gt;capture voip type asp-drop l2_acl&lt;/code&gt; after seeing the l2_acl counter incrementing in &lt;code&gt;show asp drop&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the ASA support spanning-tree in routed mode?  Should spanning-tree be disabled on the port-channel on the switch going to the firewall?  Should I add bpdu rootguard to be safe?  &lt;strong&gt;I either want the ASA to handle/ignore the BPDUs silently from the 2960X's or stop the switches from sending them, but add some loop protection.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA asp drop capture -- first three packets shown matching BPDU MAC:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;   1: 23:54:32.662502 5ca4.8a10.5e31 0100.0ccc.cccd 0x8100 Length: 68&#xA;      802.1Q vlan#11 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop&#xA;   2: 23:54:32.662715 5ca4.8a10.5e31 0100.0ccc.cccd 0x8100 Length: 68&#xA;      802.1Q vlan#120 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop&#xA;   3: 23:54:33.665386 5ca4.8a10.5e31 0100.0ccc.cccd 0x8100 Length: 68&#xA;      802.1Q vlan#10 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop&#xA;   4: 23:54:33.666087 5ca4.8a10.5e31 0100.0ccc.cccd 0x8100 Length: 68&#xA;      802.1Q vlan#910 P7 802.3 encap packet Drop-reason: (l2_acl) FP L2 rule drop&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switchport relevant interface config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface GigabitEthernet1/0/49&#xA; switchport access vlan 99&#xA; switchport trunk native vlan 99&#xA; switchport trunk allowed vlan 10-99,120,910,911&#xA; switchport mode trunk&#xA; ip arp inspection trust&#xA; logging event trunk-status&#xA; logging event bundle-status&#xA; logging event spanning-tree&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust cos&#xA; no lldp transmit&#xA; no lldp receive&#xA; channel-protocol lacp&#xA; channel-group 10 mode active&#xA; ip dhcp snooping trust&#xA;... [other phy int not shown] ...&#xA;interface Port-channel10&#xA; description in.fw-kop-105-1&#xA; switchport access vlan 99&#xA; switchport trunk native vlan 99&#xA; switchport trunk allowed vlan 10-99,120,910,911&#xA; switchport mode trunk&#xA; ip arp inspection trust&#xA; spanning-tree portfast trunk&#xA; ip dhcp snooping trust&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASA relevant interface config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface GigabitEthernet0/2&#xA; description g1-0-49.s-kop-105-1&#xA; channel-group 10 mode active&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/3&#xA; description g2-0-49.s-kop-105-2&#xA; channel-group 10 mode active&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Port-channel10&#xA; description gec10.s-kop-105-s1&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Port-channel10.10&#xA; vlan 10&#xA; nameif Inside-am.data&#xA; security-level 100&#xA; ip address 10.x.1.1 255.255.255.0&#xA;... [remaining subint's not shown] ...&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2015-04-18T08:18:49.387" LastActivityDate="2015-04-18T08:18:49.387" Title="Switchport BPDUs dropped at ASA firewall" Tags="|switch|cisco-asa|firewall|cisco-ios-12|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17911" PostTypeId="1" CreationDate="2015-04-16T08:33:29.510" Score="6" ViewCount="262" Body="&lt;p&gt;Does EIGRP have a feature similar to disabling fast fallover in BGP, where we can allow a link to flap for a (hopefully definable) period of time and still leave the EIGRP neighborship up?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is that hold timers mean nothing if the physical link goes down.  The goal here is to prevent exchange storms when older WAN links start flapping/erroring heavily.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="775" LastEditDate="2015-04-16T11:53:30.080" LastActivityDate="2015-09-29T18:05:47.213" Title="Keep EIGRP up even through an interface flaps" Tags="|cisco|eigrp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="17914" PostTypeId="1" CreationDate="2015-04-16T10:49:46.550" Score="0" ViewCount="153" Body="&lt;p&gt;We have two office buildings connected by a WAN. Our primary office has a phone system that requires each handset to be connected to the PBX via cable (it is &lt;strong&gt;NOT&lt;/strong&gt; VOIP compatible). We are setting up some offices in the second building but don't want to upgrade our phone system and I was hoping to find some way of 'mapping' a network connection over the WAN? This might be completely impossible (I'm a novice doing my best to help out with some tech stuff) but along with the server/internet traffic travelling across the WAN I want to send data from the phone port across the WAN and have it sent to the phone handset once received (please excuse lack of jargon).&#xA;If I can clarify further please ask as I don't really know how to explain what I want.&#xA;Thank you very much!&lt;/p&gt;&#xA;" OwnerUserId="14918" LastActivityDate="2015-04-20T18:57:58.867" Title="Direct Phone Connection / Network Port over WAN" Tags="|wan|telephony|" AnswerCount="3" CommentCount="1" ClosedDate="2015-04-22T19:35:35.970" ContentLicense="CC BY-SA 3.0" />
  <row Id="17916" PostTypeId="2" ParentId="13487" CreationDate="2015-04-16T13:26:57.260" Score="2" Body="&lt;p&gt;The RFC (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2328&lt;/a&gt;) does not list a maximum number of routes for Update LSA. (that I've found...)&lt;/p&gt;&#xA;&lt;p&gt;Section A.1 (page 185) states that the maximum size for an OSPF packet is the maximum IP packet size of 65,535 bytes, and recommends that larger packets (it specifically mentions Update packets) be broken down into several smaller OSPF packets to avoid IP fragmentation.&lt;/p&gt;&#xA;" OwnerUserId="14904" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-04-16T13:26:57.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17917" PostTypeId="2" ParentId="17908" CreationDate="2015-04-16T14:46:01.877" Score="6" Body="&lt;p&gt;Cisco ASA doesn't partipate in spanning-tree therefore won't response or handle the BPDU's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exception to this is Cisco ASA5505 whereby I think it allows STP to traverse the interfaces in the same VLAN.. because the 5505 has L2 switch ports rather than &quot;L3 Routed Ports&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to protect somebody plugging into your switch interface and obtaining root-bridge why don't you simply enable STP BPDUGUARD on your interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if it receives a BPDU it will simply disable the interface&#xA;You could also protect yourself by applying ether-channel guard so if it doesn't detect the other device is running a Ether-Channel then it will also disable the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This won't stop STP BPDU's been sent out of the interface but then again why would you want to disable? ( What do you think all your hosts do when it receives a BDPU packet) - Simply discard it &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope the above gives you something to work on / look into&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luke&lt;/p&gt;&#xA;" OwnerUserId="14132" LastEditorUserId="14132" LastEditDate="2015-04-16T15:08:43.997" LastActivityDate="2015-04-16T15:08:43.997" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="17919" PostTypeId="1" CreationDate="2015-04-16T15:53:36.723" Score="1" ViewCount="69" Body="&lt;p&gt;Privilege level 15 in IOS has all the possible commands for particular IOS release enabled. However, for example privilege level 1 has only few dozens of commands available. Now if I want to allow some of the privilege level 15 commands also for privilege level 1, then I could use the &lt;code&gt;privilege exec level 1 &amp;lt;command&amp;gt;&lt;/code&gt; command. For example &lt;code&gt;privilege exec level 1 traceroute&lt;/code&gt;. However, is there a way to do this centrally in TACACS+ server?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-04-17T04:20:37.523" Title="enable additional commands centrally for IOS privilege levels other than 15" Tags="|cisco-ios|aaa|tacacs|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17920" PostTypeId="2" ParentId="17914" CreationDate="2015-04-16T17:48:27.920" Score="0" Body="&lt;p&gt;Your phone system is not VoIP. It &lt;strong&gt;cannot&lt;/strong&gt; be directly bridged by IP. (every digital PBX I know of, does this by installing a VoIP module, and even there, it's a proprietary bridge between two PBX's)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the PBX is pure POTS, then a channel bank (T1) and some circuit emulation trickery &lt;em&gt;could&lt;/em&gt; get that T1 carried across an IP network. But such a hackish solution is a waste of time and money -- even if this stuff is in a box under your desk.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-16T17:48:27.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17922" PostTypeId="2" ParentId="17914" CreationDate="2015-04-16T20:53:29.963" Score="1" Body="&lt;p&gt;Look into Asterisk (&lt;a href=&quot;http://www.asterisk.org&quot; rel=&quot;nofollow&quot;&gt;http://www.asterisk.org&lt;/a&gt;  - free software-based PBX, heavy on VOIP).  It's possible to use a COTS computer with a PCI line card to pair with a PBX.  You configure your PBX to see Asterisk as a partner system and to treat the terminal/port connecting to the line card as an outbound trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At that point you can use VOIP from the Asterisk side to &quot;bridge&quot; your WAN connections.  Possible to use ATA's (Analog Telephone Adapter) on the far end to connect &quot;regular&quot; telephones to the Asterisk PBX.  You can also/instead connect VOIP phones fairly easily if you have them.  (or use software-based phones -- anything supporting SIP will probably &quot;work,&quot; but as always your mileage will vary)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will require some customization in Asterisk and some finagling and it will not work perfectly seamlessly but it IS a solution that would allow you to bridge your phone system across the WAN with a minimum of expense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also an important consideration is QoS on your network.  Newer Cisco switches can use the AutoQos feature to set this up fairly painlessly.  Your WAN QoS scenario will also be a factor.&lt;/p&gt;&#xA;" OwnerUserId="14879" LastActivityDate="2015-04-16T20:53:29.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17924" PostTypeId="2" ParentId="17919" CreationDate="2015-04-16T22:49:54.653" Score="1" Body="&lt;p&gt;Definitely yes.&#xA;I personally prefer this tacacs+ implementation &lt;a href=&quot;http://www.pro-bono-publico.de/projects/tac_plus.html&quot; rel=&quot;nofollow&quot;&gt;http://www.pro-bono-publico.de/projects/tac_plus.html&lt;/a&gt;&#xA;And use setup similar to  &lt;a href=&quot;http://blog.one-it.de/open-source-multidevice-multiuser-tacacs/&quot; rel=&quot;nofollow&quot;&gt;http://blog.one-it.de/open-source-multidevice-multiuser-tacacs/&lt;/a&gt;&#xA;Relevant portion of the config is USERGROUPS.&lt;/p&gt;&#xA;" OwnerDisplayName="user3525" LastActivityDate="2015-04-16T22:49:54.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17926" PostTypeId="1" AcceptedAnswerId="17929" CreationDate="2015-04-17T00:38:54.417" Score="1" ViewCount="47" Body="&lt;p&gt;I want to know if my AP is using 802.11ac or 802.11ac-draft. Can this be determined from information in a beacon?&lt;/p&gt;&#xA;" OwnerUserId="2360" LastEditorUserId="33" LastEditDate="2015-04-20T22:36:52.577" LastActivityDate="2015-04-20T22:36:52.577" Title="Is it possible to determine if an AP is using an 802.11 draft protocol using a sniffer?" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17927" PostTypeId="2" ParentId="17908" CreationDate="2015-04-17T04:07:09.410" Score="6" Body="&lt;p&gt;If you can be sure of your cabling then I would recommend implementing &lt;code&gt;spanning-tree bpdufilter&lt;/code&gt; on the interface towards the firewall since you have already configured the interface as an edge port.  This does not provide any loop protection, but the ASA (non-5505 as indicated) is incapable of creating a L2 loop and your stated goal is to remove BPDU's from the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring root-guard on the interface will not be useful since the ASA can never send any BPDU, and especially not a superior BPDU.  If you do not choose to configure BPDU filtering, then BPDU-Guard should be configured either by default (&lt;code&gt;spanning-tree portfast bpduguard default&lt;/code&gt;) or specifically on the interface.  This will prevent any other spanning-tree capable device from being connected to that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, if you do not have an untagged (native) interface on the firewall, allowing the native vlan on the trunk is not required and your allowed vlan list could be shortened to exclude 99. Also you could set the interface to not negotiate the access/trunking mode with &lt;code&gt;switchport nonegotiate&lt;/code&gt; and remove the configured access vlan.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-04-17T04:07:09.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17928" PostTypeId="2" ParentId="17919" CreationDate="2015-04-17T04:20:37.523" Score="3" Body="&lt;p&gt;Yes, this is the exact purpose of the second &quot;a&quot; in &quot;aaa&quot;.  &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfathor.html&quot; rel=&quot;nofollow&quot;&gt;Authorization&lt;/a&gt; is the process of limiting which commands a user is able to execute based on their user/group profile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many different products that provide aaa services in a centralized manner, some paid and some free.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-04-17T04:20:37.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17929" PostTypeId="2" ParentId="17926" CreationDate="2015-04-17T04:33:35.567" Score="2" Body="&lt;p&gt;No. Beacon frames are essential to the operation of 802.11 networks, but they are not very complex and they must continue to provide backwards compatibility with older devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, any changes to beacon frames are generally relatively minor and simple, making it a change that is both early in the process and agreed upon quickly.  I am not aware of any 802.11ac product (draft or standard) that utilizes a beacon frame that can be differentiated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Differences between drafts and final versions of the standards typically center around technical aspects (often of new features) and areas of contention. In many cases, the differences will be only in optionally supported features.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-04-17T04:33:35.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17935" PostTypeId="1" CreationDate="2015-04-17T09:48:48.620" Score="7" ViewCount="10198" Body="&lt;p&gt;I was reading the site preparation guide for the Cisco NCS 6000 Series routers and I saw this line:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;The Cisco NCS 6000 Series Routers include the Cisco NCS 6008 Line Card Chassis (LCC) and the Cisco NCS 6000 Fabric Card Chassis (FCC).&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are those part of the same machine? What's the difference between fabric and line cards?&lt;/p&gt;&#xA;" OwnerUserId="14934" LastEditorUserId="23603" LastEditDate="2016-03-17T19:47:16.210" LastActivityDate="2016-03-17T19:47:16.210" Title="What is the difference between line cards and fabric cards in a CISCO NCS 6000?" Tags="|cisco|router|line-card|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17943" PostTypeId="2" ParentId="17935" CreationDate="2015-04-17T14:20:12.150" Score="-1" Body="&lt;p&gt;FCC is like a big &quot;card&quot; that can have other more little LCC cards inside. You have a good explanation &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/crs/crs1/mss/16_slot_fc/system_description/reference/guide/sysdesc/msssd1.html#pgfId-1047176&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6183" LastActivityDate="2015-04-17T14:20:12.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17944" PostTypeId="1" AcceptedAnswerId="17945" CreationDate="2015-04-17T16:40:18.670" Score="5" ViewCount="4710" Body="&lt;p&gt;I think it is a similar case like &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6690/configuring-a-cisco-asa-5505-for-routing&quot;&gt;this&lt;/a&gt; one. The only problem is that here I have a dynamic IP from the ISP, which gets updated from dhcp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The asa can ping outside, however the inside hosts on vlan1 cannot ping internet IP addresses (eg. google).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 9.2(3)4&#xA;!&#xA;hostname myname&#xA;enable password aaa encrypted&#xA;passwd aaaa encrypted&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.1.2 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address dhcp setroute&#xA;!&#xA;boot system disk0:/asa923-4-k8.bin&#xA;ftp mode passive&#xA;clock timezone CET 1&#xA;clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;object network obj_any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-741.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL&#xA;http server enable&#xA;http 192.168.1.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpoint _SmartCallHome_ServerCA&#xA; no validation-usage&#xA; crl configure&#xA;crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0&#xA; enrollment self&#xA; fqdn none&#xA; subject-name CN=192.168.1.26,CN=sergioasa&#xA; keypair ASDM_LAUNCHER&#xA; crl configure&#xA;crypto ca trustpool policy&#xA;crypto ca certificate chain _SmartCallHome_ServerCA&#xA; certificate ca ***cert stuff***&#xA;  quit&#xA;crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0&#xA; certificate ***cert stuff***&#xA;  quit&#xA;telnet timeout 5&#xA;ssh stricthostkeycheck&#xA;ssh 0.0.0.0 0.0.0.0 inside&#xA;ssh timeout 5&#xA;ssh version 2&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;&#xA;dhcpd auto_config outside&#xA;!&#xA;dhcprelay server 192.168.1.1 outside&#xA;dhcprelay enable inside&#xA;dhcprelay setroute inside&#xA;dhcprelay timeout 60&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;ssl trust-point ASDM_Launcher_Access_TrustPoint_0&#xA;username sergio password aaaa encrypted&#xA;!&#xA;!&#xA;prompt hostname context&#xA;call-home reporting anonymous&#xA;Cryptochecksum:chesumnumbers&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think probably a route is missing... but how to add a route that sends all the outside traffic to vlan2 instead than to a precise IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After adding:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network obj_any&#xA; nat (inside,outside) dynamic interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;packet-tracer input inside tcp 192.168.1.100 323 8.8.8.8 80 detailed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: Resolve Egress Interface&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   0.0.0.0         0.0.0.0         via 192.168.0.1, outside&#xA;&#xA;Phase: 2&#xA;Type: NAT&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;object network obj_any&#xA; nat (inside,outside) dynamic interface&#xA;Additional Information:&#xA;Dynamic translate 192.168.1.100/323 to 192.168.0.12/323&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0xcd238b10, priority=6, domain=nat, deny=false&#xA;        hits=1, user_data=0xcd02f3c0, cs_id=0x0, flags=0x0, protocol=0&#xA;        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;        input_ifc=inside, output_ifc=outside&#xA;&#xA;Phase: 3&#xA;Type: NAT&#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0xcc34e8e8, priority=0, domain=nat-per-session, deny=false&#xA;        hits=810, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6&#xA;        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;        input_ifc=any, output_ifc=any&#xA;&#xA;Phase: 4&#xA;Type: IP-OPTIONS&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0xcc9bf968, priority=0, domain=inspect-ip-options, deny=true&#xA;        hits=1341, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0&#xA;        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;        input_ifc=inside, output_ifc=any&#xA;&#xA;Phase: 5&#xA;Type: NAT&#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Reverse Flow based lookup yields rule:&#xA; in  id=0xcc34e8e8, priority=0, domain=nat-per-session, deny=false&#xA;        hits=812, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6&#xA;        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;        input_ifc=any, output_ifc=any&#xA;&#xA;Phase: 6&#xA;Type: IP-OPTIONS&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Reverse Flow based lookup yields rule:&#xA; in  id=0xcc9d68d0, priority=0, domain=inspect-ip-options, deny=true&#xA;        hits=1075, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0&#xA;        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;        input_ifc=outside, output_ifc=any&#xA;&#xA;Phase: 7&#xA;Type: FLOW-CREATION&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;New flow created with id 1249, packet dispatched to next module&#xA;Module information for forward flow ...&#xA;snp_fp_tracer_drop&#xA;snp_fp_inspect_ip_options&#xA;snp_fp_tcp_normalizer&#xA;snp_fp_translate&#xA;snp_fp_adjacency&#xA;snp_fp_fragment&#xA;snp_ifc_stat&#xA;&#xA;Module information for reverse flow ...&#xA;snp_fp_tracer_drop&#xA;snp_fp_inspect_ip_options&#xA;snp_fp_translate&#xA;snp_fp_tcp_normalizer&#xA;snp_fp_adjacency&#xA;snp_fp_fragment&#xA;snp_ifc_stat&#xA;&#xA;Result:&#xA;input-interface: inside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: outside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: allow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the ISR(dhcp server) I have the following routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/24 is subnetted, 1 subnets&#xA;C       10.11.0.0 is directly connected, Loopback0&#xA;C    192.168.1.0/24 is directly connected, BVI1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the ASA the routing table is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is 192.168.0.1 to network 0.0.0.0&#xA;&#xA;S*    0.0.0.0 0.0.0.0 [1/0] via 192.168.0.1, outside&#xA;C        192.168.0.0 255.255.255.0 is directly connected, outside&#xA;L        192.168.0.12 255.255.255.255 is directly connected, outside&#xA;C        192.168.1.0 255.255.255.0 is directly connected, inside&#xA;L        192.168.1.2 255.255.255.255 is directly connected, inside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6183" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-04-17T18:50:04.080" Title="ASA not routing with IP from ISP dhcp" Tags="|routing|cisco-asa|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17945" PostTypeId="2" ParentId="17944" CreationDate="2015-04-17T17:11:13.350" Score="5" Body="&lt;p&gt;If the ASA can ping the internet then routing on the firewall is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although I did noticed I can't see a NAT statement to nat your traffic from your inside to the outside address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apply the NAT under your object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;object network obj_any&#xA;&lt;br&gt;&#xA;nat (inside,outside) dynamic interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this doesn't resolve your issue please post the output from the following command&#xA;&lt;br&gt;&#xA;&lt;br&gt;&lt;br&gt;&#xA;packet-tracer input inside tcp 192.168.1.100 323 8.8.8.8 80 detailed&lt;/p&gt;&#xA;" OwnerUserId="14132" LastActivityDate="2015-04-17T17:11:13.350" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="17946" PostTypeId="2" ParentId="17944" CreationDate="2015-04-17T18:44:55.963" Score="3" Body="&lt;p&gt;To fix ICMP try this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       class-map inspection_default&#xA;        match default-inspection-traffic&#xA;       policy-map global_policy&#xA;        class inspection_default&#xA;         inspect icmp&#xA;       service-policy global_policy global&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14132" LastEditorUserId="14132" LastEditDate="2015-04-17T18:50:04.080" LastActivityDate="2015-04-17T18:50:04.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17947" PostTypeId="1" AcceptedAnswerId="17950" CreationDate="2015-04-17T19:09:25.973" Score="0" ViewCount="83" Body="&lt;p&gt;This might be a very noob question. Please forgive me if I'm not clear enough, for I don't thoroughly understand the processes / magic very well behind the network engineering. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible for the Router to change IP  address of the device that is connected to the Router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example : Say I live in Zimbabve,  but i wanna watch Netflix  on my mobile device. I will get a restriction message, If I try to access Netflix with my Zimbabve IP address. Would it be possible for me tweak the router, to make it change to the U.S IP once i connect to it with my mobile device?  I know there are some routers that support dd-wrt firmwares. Would that make any difference?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance and apologies for the noobness again.&lt;/p&gt;&#xA;" OwnerUserId="14943" LastActivityDate="2015-04-18T09:56:32.930" Title="Is it possible for the router to re-direct to another IP?" Tags="|router|ip|" AnswerCount="1" CommentCount="1" ClosedDate="2015-04-18T09:02:47.853" ContentLicense="CC BY-SA 3.0" />
  <row Id="17948" PostTypeId="1" CreationDate="2015-04-17T19:39:09.240" Score="0" ViewCount="3795" Body="&lt;p&gt;In basic networking services, (e.g ssh) why we use statically assigned port number? What are potential problems with allowing services to select their own port in the applications provided by us?&lt;/p&gt;&#xA;" OwnerUserId="14945" LastEditorUserId="775" LastEditDate="2015-04-18T07:27:44.623" LastActivityDate="2015-04-19T16:40:26.707" Title="Static Port VS Dynamic Port" Tags="|tcp|" AnswerCount="3" CommentCount="2" ClosedDate="2015-04-20T14:38:54.757" ContentLicense="CC BY-SA 3.0" />
  <row Id="17949" PostTypeId="2" ParentId="17948" CreationDate="2015-04-17T20:24:19.857" Score="1" Body="&lt;p&gt;Ultimately you are free to do what you like but avoiding common ports is always a plus and stops conflicts of services.&lt;/p&gt;&#xA;" OwnerUserId="14132" LastActivityDate="2015-04-17T20:24:19.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17950" PostTypeId="2" ParentId="17947" CreationDate="2015-04-17T20:32:09.173" Score="1" Body="&lt;p&gt;Simple answer is.. NO&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;DD-WRT might enable you to initiate a VPN from the router but ultimately if you want to watch Netflix with a US IP address so you get more &quot;media&quot; then you need to use either a proxy or a VPN to route your traffic to another service which then sends your traffic out from a IP/Server which is hosted in the U.S.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If Netflix is your issue then their is DNS workarounds to enable you to receive Netflix US (outside of US) but I think these forums aren't to talk about workarounds/hacks its a &quot;Networking forum&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ta&lt;/p&gt;&#xA;" OwnerUserId="14132" LastEditorUserId="14132" LastEditDate="2015-04-18T09:56:32.930" LastActivityDate="2015-04-18T09:56:32.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17952" PostTypeId="2" ParentId="7895" CreationDate="2015-04-17T22:32:14.180" Score="4" Body="&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; description FACING CUSTOMER NETWORK&#xA; switchport trunk allowed vlan none&#xA; switchport mode trunk&#xA; service instance 1 ethernet&#xA;  encapsulation dot1q default&#xA;  bridge-domain 100&#xA;&#xA;interface GigabitEthernet0/2&#xA; description FACING SERVICE PROVIDER CLOUD&#xA; switchport trunk allowed vlan none&#xA; switchport mode trunk&#xA; service instance 1 ethernet&#xA;  encapsulation dot1q 100&#xA;  rewrite ingress tag pop 1 symmetric&#xA;  bridge-domain 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Above should allow any vlan from customer (C-TAG) and add your vlan 100 on top (S-TAG). 'rewrite ingress tag pop 1 symmetric' strips your S-TAG before traffic is delivered to customer-facing interface via bridge-domain and does reverse in other direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Downside is that you need to configure your SP-facing interface to EVC, but honestly with ME3600X this is the only workable way in a long run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above is from my head, if it doesn't work let me know and I'll test it myself.&lt;/p&gt;&#xA;" OwnerUserId="3326" LastActivityDate="2015-04-17T22:32:14.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17953" PostTypeId="2" ParentId="17948" CreationDate="2015-04-18T02:59:35.760" Score="0" Body="&lt;p&gt;Imagine the &lt;strong&gt;World Wide Web&lt;/strong&gt; (www) &lt;em&gt;without&lt;/em&gt; standardization of port [tcp] 80 for &lt;strong&gt;HTTP&lt;/strong&gt; or 443 for &lt;strong&gt;HTTPS&lt;/strong&gt;.  Or email if &lt;em&gt;SMTP&lt;/em&gt; wasn't typically found on port 25.  How would browsers or mail servers know which port to use to reach the multitudes of servers littered all over the internet?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @smithy2k3 noted, you can configure whatever port you want, assuming that port is communicated to the client somehow -- sneakernet or email come to mind -- and you're able to traverse your protocol through firewalls that may be inspecting the traffic on certain ports for rewrite -- &lt;strong&gt;FTP&lt;/strong&gt; on tcp/21 and &lt;strong&gt;SIP&lt;/strong&gt; on udp/5060, for example.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2015-04-18T03:06:29.470" LastActivityDate="2015-04-18T03:06:29.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17956" PostTypeId="1" AcceptedAnswerId="17957" CreationDate="2015-04-18T06:51:28.793" Score="1" ViewCount="72" Body="&lt;p&gt;Is it possible to connect two (not more) ADSL modem together by using RJ11 in a local environment (ie: in a lab) ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; +-------+ RJ45 +--------------+   RJ-11   +--------------+ RJ45 +-------+&#xA; | LAN 1 |======| ADSL MODEM 1 |- - - - - -| ADSL MODEM 2 |======| LAN 2 |&#xA; +-------+      +--------------+   PPPoE   +--------------+      +-------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14955" LastEditorUserId="14955" LastEditDate="2015-04-18T07:44:28.323" LastActivityDate="2015-04-18T08:37:02.013" Title="Link ADSL modem together" Tags="|pppoe|adsl|" AnswerCount="1" CommentCount="2" ClosedDate="2015-04-20T14:37:33.083" ContentLicense="CC BY-SA 3.0" />
  <row Id="17957" PostTypeId="2" ParentId="17956" CreationDate="2015-04-18T08:37:02.013" Score="3" Body="&lt;p&gt;No. ADSL uses different upstream and downstream frequency ranges. As such, a modem is designed to transmit only in a narrow, low frequency range for which is has no receive capability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The much older, SDSL, does work head-to-head.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-18T08:37:02.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17958" PostTypeId="2" ParentId="16375" CreationDate="2015-04-18T09:01:15.710" Score="3" Body="&lt;p&gt;If we are assuming you want to log every session on your device then the &lt;em&gt;apply-groups&lt;/em&gt; statement itself will as you thought only impact the performance of commit's. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is because the system will need to calculate the effect of the applied groups across the rest of the config. The bigger your config gets and the more groups you are applying the longer your commits will start to take.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have committed your config any groups that have been applied are essentially merged into a compiled configuration file: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/var/run/db/juniper.data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once that is done there is no performance impact from the apply-groups statement on the running system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously logging itself will have an impact on the performance of the device. (&lt;em&gt;check out the CPU use for eventd&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I personally use both methods. If the device is a low end device or processing jitter sensitive traffic then I tend to only log in the required policies rather than everything. On other devices I will use the &lt;em&gt;apply-groups&lt;/em&gt; method to globally log everything and then use the &lt;em&gt;apply-groups-except&lt;/em&gt; method where I don't want to log certain traffic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security policies from-zone trust to-zone untrust policy policy-1 apply-groups-except log-all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="139" LastActivityDate="2015-04-18T09:01:15.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17959" PostTypeId="2" ParentId="10493" CreationDate="2015-04-18T17:02:44.290" Score="2" Body="&lt;p&gt;ACL 102 is showing &lt;code&gt;permit ip any any&lt;/code&gt; - are you sure you want to encrypt ALL traffic? And you need to show us debug that Gareth asked for, as the negotiation fails with ISAKMP (&lt;code&gt;debug crypto isakmp&lt;/code&gt; and &lt;code&gt;debug crypto ipsec&lt;/code&gt;), and it's not yet the problem on the traffic/data plane level.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2015-04-18T17:02:44.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17963" PostTypeId="1" AcceptedAnswerId="17966" CreationDate="2015-04-18T20:53:41.547" Score="1" ViewCount="1475" Body="&lt;p&gt;What the switch protocol based layer are? For the packet switching and virtual circuit. The basis of them.&lt;/p&gt;&#xA;" OwnerUserId="14945" LastEditorUserId="14945" LastEditDate="2015-04-20T16:52:18.310" LastActivityDate="2015-04-20T16:52:18.310" Title="What the switch protocol based layer are?" Tags="|osi|" AnswerCount="1" CommentCount="1" ClosedDate="2015-04-20T14:39:49.677" ContentLicense="CC BY-SA 3.0" />
  <row Id="17966" PostTypeId="2" ParentId="17963" CreationDate="2015-04-19T06:08:51.360" Score="2" Body="&lt;p&gt;Just a reminder: The OSI network model is &lt;strong&gt;only a model&lt;/strong&gt;. It was not used to define any of the most common network technologies or protocols. The OSI protocols it was used for are almost entirely unused. TCP/IP was developed using a different model that can be related to the OSI model, but even the TCP/IP model is still just a model. These models are certainly very useful in talking about and understanding how networking works, but many technologies do not fit neatly into any one layer of the OSI model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most classic example of a circuit-switched network is the North American ISDN network for telephony (and of course its analog predecessor, often called &quot;POTS&quot; for &quot;plain old telephone service&quot;). Probably the best layer to think of for ISDN is layer 1. That being said, the generic concept of circuit switching is not layer specific. It would make little sense for a circuit switched protocol to be encapsulated (in layer terms, encapsulation is how one layer rides on top of another layer) in a packet switched protocol, but it is possible for circuit switched protocols to ride on top of other circuit switched protocols, which would be modeled as more the one layer being circuit switched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same goes for packet switching. Again, there are some very famous packet switched protocols, the most famous being TCP/IP and Ethernet. The suite that comprises TCP/IP does not map to a single layer of the OSI model, and is most commonly modeled in layers 3 and 4, while Ethernet is considered a layer 2 protocol. Since those are not the only packet switched protocols, there is no single answer to the question of what network layer packet switching would be done on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Virtual circuit&quot; is a more general term typically used to describe a dedicated connection encapsulated inside a (usually packet) switched protocol. A virtual circuit is meant to behave to the user as if it is either circuit switched or not switched at all (point to point). This is another case where the OSI model does not yield one simple answer. From the provider's standpoint, a virtual circuit would likely be modeled best as a layer 3 or 4 protocol, or at least be encapsulated inside a layer 2 or 3 protocol. Most virtual circuits are meant to operate as layer 1 connections for the end users. This is analogous to a VPN, where one way to look at it is a full OSI stack contained inside a second partial (or possibly full) OSI stack.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-04-19T06:08:51.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17969" PostTypeId="1" AcceptedAnswerId="17972" CreationDate="2015-04-19T10:14:39.650" Score="4" ViewCount="47948" Body="&lt;p&gt;I am having trouble when I am using two Layer 3 switches and two PCs to create a simple network for Inter Vlan routing,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all have a look at this network,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration for PC1 is,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 192.168.10.1&#xA;Default Gateway: 192.168.10.254&#xA;Subnet: 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similarly for PC2,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 192.168.20.1&#xA;Default Gateway: 192.168.20.254&#xA;Subnet: 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1UDRk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for the left Switch, I set the &lt;code&gt;Fa0/1&lt;/code&gt; to &lt;code&gt;trunk&lt;/code&gt; mode, and enabled created a &lt;code&gt;Vlan 10&lt;/code&gt; and moved the Pc1 to that Vlan,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)#vlan 10&#xA;Switch(config-vlan)#name forPC1&#xA;Switch(config-vlan)#exit&#xA;&#xA;Switch(config)#interface vlan 10&#xA;&#xA;&#xA;Switch(config-if)#ip address 192.168.10.254 255.255.255.0&#xA;Switch(config-if)#exit&#xA;&#xA;Switch(config)#ip routing&#xA;&#xA;Switch(config)#interface fastEthernet 0/24&#xA;&#xA;Switch(config-if)#switchport mode access &#xA;&#xA;Switch(config-if)#switchport access vlan 10&#xA;&#xA;&#xA;Switch(config)#interface fastEthernet 0/1&#xA;Switch(config-if)#switchport trunk encapsulation dot1q &#xA;&#xA;Switch(config-if)#switchport mode trunk &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and Similarly, I have done the following configuration for the right switch,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)#vlan 20&#xA;Switch(config-vlan)#name PC2&#xA;Switch(config-vlan)#exit&#xA;&#xA;Switch(config)#interface vlan 20&#xA;&#xA;Switch(config-if)#ip address 192.168.20.254 255.255.255.0&#xA;Switch(config-if)#exit&#xA;&#xA;Switch(config)#ip routing &#xA;Switch(config)#interface fastEthernet 0/1&#xA;Switch(config-if)#switchport trunk encapsulation dot1q &#xA;Switch(config-if)#switchport mode trunk &#xA;Switch(config-if)#exit&#xA;&#xA;&#xA;Switch(config)#interface fastEthernet 0/24&#xA;&#xA;Switch(config-if)#switchport mode access &#xA;Switch(config-if)#switchport access vlan 20&#xA;Switch(config-if)#exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried so many things. before i was not enable &lt;code&gt;ip routing&lt;/code&gt; but even after using &lt;code&gt;ip routing&lt;/code&gt; command i couldn't be able to ping &lt;code&gt;PC1&lt;/code&gt; from &lt;code&gt;PC2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have correctly set the trunk port also, then what is the issue ?&lt;/p&gt;&#xA;" OwnerUserId="14885" LastActivityDate="2021-12-31T20:00:26.037" Title="Intervlan routing using two Layer 3 Switches in Packet Tracer" Tags="|routing|vlan|layer3|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17970" PostTypeId="2" ParentId="17969" CreationDate="2015-04-19T10:53:17.977" Score="2" Body="&lt;p&gt;Im not sure... but...&#xA;the Switch need to know all VLAN's to routing between VLAN's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;with&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;show vlan&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;you can check if the switch has all VLAN's.&lt;/p&gt;&#xA;" OwnerUserId="14971" LastActivityDate="2015-04-19T10:53:17.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17971" PostTypeId="1" CreationDate="2015-04-19T14:33:16.843" Score="4" ViewCount="634" Body="&lt;p&gt;I'm doing some tests in my lab preparing for CCIE R&amp;amp;S and I'm diving into how MPLS works and I ran into a issue with getting traceroute to display the label path in it's output. I have not found out why this is not working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping fine between the CE's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is the setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CE1 - PE1 - P1 - P2 - PE2 - CE2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P1/P2 only have OSPF enabled with OSPF mpls autoconfig for area 0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CE-PE protocol is BGP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the PE2 BGP config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA; bgp router-id 80.2.2.2&#xA; bgp log-neighbor-changes&#xA; no bgp default ipv4-unicast&#xA; neighbor 80.1.1.1 remote-as 100&#xA; neighbor 80.1.1.1 update-source Loopback0&#xA; !&#xA; address-family ipv4&#xA;  redistribute ospf 1&#xA;  neighbor 80.1.1.1 activate&#xA;  neighbor 80.1.1.1 send-community&#xA; exit-address-family&#xA; !&#xA; address-family vpnv4&#xA;  neighbor 80.1.1.1 activate&#xA;  neighbor 80.1.1.1 send-community extended&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf CPE2&#xA;  redistribute connected&#xA;  redistribute ospf 1010&#xA;  neighbor 192.168.99.20 remote-as 20&#xA;  neighbor 192.168.99.20 activate&#xA;  neighbor 192.168.99.20 next-hop-self&#xA; exit-address-family&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IP VRF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf CPE2&#xA; rd 20:20&#xA; route-target export 200:200&#xA; route-target export 700:700&#xA; route-target import 100:100&#xA; route-target import 700:700&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and here are show commands&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE2#show ip bgp vpnv4 vrf CPE2 &#xA;BGP table version is 31, local router ID is 80.2.2.2&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal, &#xA;              r RIB-failure, S Stale, m multipath, b backup-path, f RT-Filter, &#xA;              x best-external, a additional-path, c RIB-compressed, &#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;RPKI validation codes: V valid, I invalid, N Not found&#xA;&#xA;     Network          Next Hop            Metric LocPrf Weight Path&#xA;Route Distinguisher: 20:20 (default for vrf CPE2)&#xA; *&amp;gt;i 192.168.1.0      80.1.1.1                 0    100      0 ?&#xA; *&amp;gt;i 192.168.10.0     80.1.1.1                 0    100      0 10 ?&#xA; *&amp;gt;  192.168.20.0     192.168.99.20            0             0 20 ?&#xA; *&amp;gt;  192.168.99.0     0.0.0.0                  0         32768 ?&#xA; *                    192.168.99.20            0             0 20 ?&#xA; *&amp;gt;i 192.168.100.1/32 80.1.1.1                 0    100      0 10 ?&#xA; *&amp;gt;  192.168.100.2/32 192.168.99.20            0             0 20 ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and here is the mpls forwarding table&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE2# show mpls forwarding-table &#xA;Local      Outgoing   Prefix           Bytes Label   Outgoing   Next Hop    &#xA;Label      Label      or Tunnel Id     Switched      interface              &#xA;1200       Pop Label  10.1.2.2/32      0             Et0/0      10.50.1.2   &#xA;1201       Pop Label  10.10.10.0/24    0             Et0/0      10.50.1.2   &#xA;1202       Pop Label  10.10.8.0/24     0             Et0/0      10.50.1.2   &#xA;1203       Pop Label  10.10.7.0/24     0             Et0/0      10.50.1.2   &#xA;1204       Pop Label  10.10.2.0/24     0             Et0/0      10.50.1.2   &#xA;1205       Pop Label  10.10.1.0/24     0             Et0/0      10.50.1.2   &#xA;1206       202        80.1.1.1/32      0             Et0/0      10.50.1.2   &#xA;1207       203        10.1.1.1/32      0             Et0/0      10.50.1.2   &#xA;1208       204        10.40.2.0/24     0             Et0/0      10.50.1.2   &#xA;1209       205        10.10.9.0/24     0             Et0/0      10.50.1.2   &#xA;1210       206        10.10.6.0/24     0             Et0/0      10.50.1.2   &#xA;1211       207        10.10.5.0/24     0             Et0/0      10.50.1.2   &#xA;1212       208        10.40.1.0/24     0             Et0/0      10.50.1.2   &#xA;1213       No Label   192.168.20.0/24[V]   \&#xA;                                       0             Et1/0      192.168.99.20&#xA;1214       No Label   192.168.99.0/24[V]   \&#xA;                                       3420          aggregate/CPE2 &#xA;1215       No Label   192.168.100.2/32[V]   \&#xA;                                       696           Et1/0      192.168.99.20&#xA;&#xA;PE2# show ip bgp vpnv4 vrf CPE2 192.168.100.2&#xA;BGP routing table entry for 20:20:192.168.100.2/32, version 12&#xA;Paths: (1 available, best #1, table CPE2)&#xA;  Advertised to update-groups:&#xA;     3         &#xA;  Refresh Epoch 2&#xA;  20&#xA;    192.168.99.20 from 192.168.99.20 (192.168.100.2)&#xA;      Origin incomplete, metric 0, localpref 100, valid, external, best&#xA;      Extended Community: RT:200:200 RT:700:700&#xA;      mpls labels in/out 1215/nolabel&#xA;      rx pathid: 0, tx pathid: 0x0&#xA;&#xA;CPE2#traceroute 192.168.100.1 source lo0&#xA;Type escape sequence to abort.&#xA;Tracing the route to 192.168.100.1&#xA;VRF info: (vrf in name/id, vrf out name/id)&#xA;  1 192.168.99.2 1 msec 0 msec 0 msec&#xA;  2  *  *  * &#xA;  3  *  *  * &#xA;  4  *  *  * &#xA;  5 192.168.1.111 [AS 100] 1 msec *  0 msec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the Loopbacks of CE1 / CE2 are 192.168.100.1 and 192.168.100.2&#xA;So you see that I have the local lable for 192.168.100.2 - that is going from PE2-&gt;CE2 non mpls - but what I don't see are labels for the 192.168.100.1 that is going to go over the P routers. the BGP points to 8.1.1.1 and that has a label.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so is this normal - or do I have to make some changes to get the router to create labels for every route - perhaps I'm missing some point here.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;benni&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="14974" LastActivityDate="2015-04-27T12:39:51.720" Title="MPLS lable generation - PE-P-PE routing" Tags="|cisco|bgp|mpls|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17972" PostTypeId="2" ParentId="17969" CreationDate="2015-04-19T14:58:22.190" Score="7" Body="&lt;p&gt;To allow VLAN routing four things are neccessary:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The VLANs you want to route must exist on all switches.&lt;/li&gt;&#xA;&lt;li&gt;The VLANs must be allowed on the trunk between the switches.&lt;/li&gt;&#xA;&lt;li&gt;Interface IPs for each VLAN must be assigned.&lt;/li&gt;&#xA;&lt;li&gt;IP routing enabled.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In your case you need to add the following lines to your config:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch7:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)#vlan 20&#xA;Switch(config-vlan)#name PC2&#xA;Switch(config-vlan)#exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch8:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)#vlan 10&#xA;Switch(config-vlan)#name forPC1&#xA;Switch(config-vlan)#exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is not neccessary to have the same names of the VLANs on both switches but it's a good practice to keep in consistent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To verify that the VLANs are created on both switches you can issue the following command from Privileged EXEC:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show vlan brief&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it should list both VLAN 10 and VLAN 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the other condition it should be said that the default is to allow all vlans on the trunk, but to verify that it is indeed allowed you can issue the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show interfaces fastEthernet 0/1 trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and you should see vlan 10 and 20 listed under &quot;Vlans allowed and active in management domain&quot; aswell as &quot;Vlans in spanning tree forwarding state and not pruned&quot;. &#xA;If it is not listed under the latter one you need to check your spanning-tree configuration but that should not be a problem in this case.&lt;/p&gt;&#xA;" OwnerUserId="14973" LastEditorUserId="630" LastEditDate="2015-04-19T20:47:56.200" LastActivityDate="2015-04-19T20:47:56.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17973" PostTypeId="2" ParentId="17969" CreationDate="2015-04-19T16:32:37.413" Score="2" Body="&lt;p&gt;Set one of your routers as the core router and define both interface vlans there. That way, your fib has all ip/Mac entries&lt;/p&gt;&#xA;" OwnerUserId="14963" LastActivityDate="2015-04-19T16:32:37.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17974" PostTypeId="2" ParentId="17971" CreationDate="2015-04-19T16:35:32.313" Score="-2" Body="&lt;p&gt;I'm certainly nowhere near the IE level yet, but when I've run into this issue at work, it has usually been that &quot;mpls oam&quot; was not enabled. Your label distribution is working as intended, that's the only reason I could imagine you're not seeing the labels&lt;/p&gt;&#xA;" OwnerUserId="14963" LastActivityDate="2015-04-19T16:35:32.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17975" PostTypeId="2" ParentId="17948" CreationDate="2015-04-19T16:40:26.707" Score="0" Body="&lt;p&gt;If you were to allow applications to select ephemeral port numbers at their own discretion, there would be no layer of security at the network level. &lt;/p&gt;&#xA;" OwnerUserId="14963" LastActivityDate="2015-04-19T16:40:26.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17977" PostTypeId="1" CreationDate="2015-04-19T16:53:15.280" Score="0" ViewCount="2261" Body="&lt;p&gt;I am trying to view the HTTP/HTTPS traffic going from my XBOX one so I can see what is being requested.  I started off trying to use Charles proxy like this &lt;a href=&quot;https://www.youtube.com/watch?v=MP4ZcwSHxbw&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=MP4ZcwSHxbw&lt;/a&gt;.  However there is no option to use a proxy on xbox one, so I could not use this method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am now trying to use wireshark, with my xbox connected to my PC's internet using an ethernet cable.  I can see HTTP requests from my xbox, but cannot see any information about HTTPS not even the URL that is being called.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how I can decrypt this traffic in WireShark?  Or a better way of viewing the network traffic from my Xbox One?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="14976" LastActivityDate="2015-04-19T20:21:44.487" Title="Viewing Xbox One Network Traffic" Tags="|wireshark|" AnswerCount="1" CommentCount="1" ClosedDate="2015-04-20T14:22:42.673" ContentLicense="CC BY-SA 3.0" />
  <row Id="17979" PostTypeId="2" ParentId="17977" CreationDate="2015-04-19T20:21:44.487" Score="1" Body="&lt;p&gt;This is the entire point of HTTP&lt;strong&gt;S&lt;/strong&gt;. A man-in-the-middle cannot know what is being passed between systems. A &quot;proxy&quot; will not help if the system is checking the validity of the SSL certificate(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Without the &lt;em&gt;server certificate&lt;/em&gt;, you cannot decode any of that traffic.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-19T20:21:44.487" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17980" PostTypeId="2" ParentId="17969" CreationDate="2015-04-19T20:49:09.430" Score="3" Body="&lt;p&gt;You are missing routing between the two switches. There are two ways to fix this. Either move both vlan interfaces to the same switch and use second switch purely as layer 2 device (similar to what @Solitarium suggested) or create another vlan interface that routes between two switches and configure static routes. Something like this (in addition to current config):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;switch 7:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 30&#xA; name interswitch&#xA;!&#xA;interface vlan 30&#xA; ip address 192.168.30.1 255.255.255.252&#xA;!&#xA;ip route 192.168.20.0 255.255.255.0 192.168.30.2&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;switch 8:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 30&#xA; name interswitch&#xA;!&#xA;interface vlan 30&#xA; ip address 192.168.30.2 255.255.255.252&#xA;!&#xA;ip route 192.168.10.0 255.255.255.0 192.168.30.1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Last thing - you need to ensure vlan 30 is trunked between two switches. In your above config trunk allowed all vlans (default trunk behavior). I would personally limit this (since you no longer need to trunk other two vlans anyway), so I would do this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;switch 7:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Fa0/1&#xA; switchport trunk allowed vlan 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;switch 8:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Fa0/1&#xA; switchport trunk allowed vlan 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you should be able to route between two PCs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enjoy!&lt;/p&gt;&#xA;" OwnerUserId="3326" LastActivityDate="2015-04-19T20:49:09.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17981" PostTypeId="2" ParentId="16760" CreationDate="2015-04-19T21:25:37.187" Score="1" Body="&lt;p&gt;That's an interesting question. Have an idea.. little bit messy, but could potentially do what you need...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Setup dummy secondary IP subnet on your HSRP group (ie. 192.0.2.0/29)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;interface FastEthernet 0/1&#xA;  ip address 192.0.2.2 255.255.255.248 secondary&#xA;  standby X ip 192.0.2.1 secondary&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Reserve static ARP for your &quot;floating IP&quot; towards &lt;strong&gt;&lt;em&gt;physical&lt;/em&gt;&lt;/strong&gt; MAC address of the interface:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;arp 192.0.2.1 xxxx.yyyy.zzzz arpa&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Create (and start) an IP SLA probe to your &quot;floating IP&quot;:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip sla 1&#xA; icmp-echo 192.0.2.1&#xA;    threshold 2000&#xA;    timeout 2000&#xA;    frequency 5&#xA;!&#xA;ip sla schedule 1 life forever start-time now&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Create track object that tracks reachability of your IP SLA:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;track 1 ip sla 1 reachability&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;Finally create your static route tied against the track object:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip route 198.51.100.0 255.255.255.0 203.0.113.1 track 1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't tested this, so give it a go and see if it works..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Intention is that when router in question becomes standby it will stop replying to icmp on active IP (and HSRP peer will also not respond due to static ARP reservation). As a result IP SLA probe will start failing and so track object will get triggered. This in turn will withdraw static route from the table..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again this is subject to testing as I haven't tested it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&lt;/p&gt;&#xA;" OwnerUserId="3326" LastEditorUserId="3326" LastEditDate="2015-04-19T21:38:07.267" LastActivityDate="2015-04-19T21:38:07.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17984" PostTypeId="1" CreationDate="2015-04-20T07:25:01.297" Score="1" ViewCount="199" Body="&lt;p&gt;Is it possible to link two VPS Cloud Servers together to be used as one. If I have two vps cloud servers and each have 80GB of space and 1TB bandwidth can they be linked together as one to have 160GB of space and 2TB of bandwidth?&lt;/p&gt;&#xA;" OwnerUserId="14985" LastActivityDate="2015-04-20T07:25:01.297" Title="Is it possible to link two VPS Cloud servers together?" Tags="|ipv4|" AnswerCount="0" CommentCount="1" ClosedDate="2015-04-20T14:37:57.677" ContentLicense="CC BY-SA 3.0" />
  <row Id="17986" PostTypeId="1" CreationDate="2015-04-20T11:42:15.207" Score="0" ViewCount="48" Body="&lt;p&gt;I'm only provided with one switch port so to provide Internet to two PCs they go into a small managed netgear switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I want to add another PC to be able to communicate with the other PCs but must not have Internet connection so LAN only. By default it gets Internet connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I need to do to make this LAN only.&lt;/p&gt;&#xA;" OwnerUserId="14992" LastActivityDate="2015-04-20T13:25:07.793" Title="LAN only for specific switchport" Tags="|switch|lan|" AnswerCount="1" CommentCount="3" ClosedDate="2015-04-20T14:33:38.107" ContentLicense="CC BY-SA 3.0" />
  <row Id="17989" PostTypeId="2" ParentId="17986" CreationDate="2015-04-20T13:25:07.793" Score="1" Body="&lt;p&gt;simplest way is to remove the gateway. Without Gateway there is no way out of the subnet.&lt;/p&gt;&#xA;" OwnerUserId="14971" LastActivityDate="2015-04-20T13:25:07.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17991" PostTypeId="2" ParentId="13123" CreationDate="2015-04-20T15:06:04.993" Score="0" Body="&lt;p&gt;This information is very dated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/10356006/lldp-info-snmp&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/10356006/lldp-info-snmp&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quick search revealed a LLDP-MIB in the Cisco SNMP Object Navigator.  The above link makes me question which switches, if any, actually support this object.  Perhaps it's worth a look... It may only get your local switch information, not neighbor info.  You could guesstimate as other posters stated above by using SNMP to determine if a port is in trunk mode and combine that with the number of learned MAC addresses per interface to improve your odds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;step=2&amp;amp;mibName=LLDP-MIB&quot; rel=&quot;nofollow&quot;&gt;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;step=2&amp;amp;mibName=LLDP-MIB&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14879" LastActivityDate="2015-04-20T15:06:04.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17992" PostTypeId="1" AcceptedAnswerId="52395" CreationDate="2015-04-20T15:16:02.023" Score="5" ViewCount="592" Body="&lt;p&gt;Will a default-deny rule on incoming connections of an IPv6 firewall negate any advantages that were gained by not having NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, one of the most talked about advantages to IPv6 is that NAT is no longer necessary and endpoint addresses are no longer obfuscated to applications allowing direct connections between endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can understand how this could benefit applications that are sensitive to throughput and/or latency such as voice and video communications.&#xA;However, how would the internal network be protected from unsolicited traffic without breaking such apps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would hole punching (&lt;a href=&quot;http://en.wikipedia.org/wiki/Hole_punching&quot; rel=&quot;noreferrer&quot;&gt;http://en.wikipedia.org/wiki/Hole_punching&lt;/a&gt;) provide a fix for this?&lt;/p&gt;&#xA;" OwnerUserId="3972" LastActivityDate="2018-08-08T16:57:09.790" Title="Will a default-deny rule on incoming connections of an IPv6 firewall negate any advantages that were gained by not having NAT?" Tags="|firewall|ipv6|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17993" PostTypeId="1" AcceptedAnswerId="18004" CreationDate="2015-04-20T15:32:48.857" Score="5" ViewCount="3815" Body="&lt;p&gt;In my network, I need some manageable switches. So, somebody advised me to configure the Lab Linux servers as bridges using &lt;code&gt;brctl&lt;/code&gt;. Those new bridges should act like switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should be the difference between those bridges and manageable switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I know the difference between a switch and a bridge device.&lt;/p&gt;&#xA;" OwnerUserId="13402" LastEditorUserId="35913" LastEditDate="2018-10-19T23:44:09.387" LastActivityDate="2018-10-19T23:44:09.387" Title="Difference between Switch and Linux Bridge" Tags="|switch|linux|bridge|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17996" PostTypeId="2" ParentId="16753" CreationDate="2015-04-20T17:58:16.480" Score="0" Body="&lt;p&gt;hat ultimately depends on what you want to do. The carrier providing Q-in-Q only means that its providing a transparent connection between your sites. You should be designing your network as if the carrier is not even there. Consider the carrier's network a long ethernet cable between your sites, and design accordingly.&lt;/p&gt;&#xA;" OwnerUserId="14963" LastEditorUserId="8499" LastEditDate="2016-03-28T22:46:35.607" LastActivityDate="2016-03-28T22:46:35.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="17997" PostTypeId="1" AcceptedAnswerId="18001" CreationDate="2015-04-20T18:51:08.320" Score="7" ViewCount="2146" Body="&lt;p&gt;We use palo-alto firewall as an internet gateway. We have 16 static ip-addresses. One is used for outbound traffic (users browse internet) . The rest is used for inbound traffic (mail server, webservers, etc). &#xA;For redundant purposes we subscribe to second ISP. We buy 16 new static ip-addresses from new ISP. And here comes the hell with configuration. I've been reading for two days about BGP, PI addresses, AS numbers and other stuff. But I don't understand anything. Theory without practice and overall understanding is nothing. I call to these ISP's, and both providers say they won't configure any routes and won't sell AS numbers, try solve it by your selves. In our small asian country there is no LISP or any other cloud base routing solution. I don't know what to do next. Should I request AS number directly from APNIC? With policy based rules I may only configure outbound traffic redundancy. Is there any reliable solution to make redundant our small hosting? May it is possible to configure BGP without AS numbers and PI addresses?&lt;/p&gt;&#xA;" OwnerUserId="14498" LastActivityDate="2016-06-29T11:02:09.040" Title="Two ISP bgp topology?" Tags="|routing|bgp|redundancy|isp|palo-alto|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="17998" PostTypeId="2" ParentId="17914" CreationDate="2015-04-20T18:57:58.867" Score="0" Body="&lt;p&gt;If your phone system supports extenders over T1 or the two phone systems can be linked by T1 in some fashion, you could look into using something like the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/3700-series-multiservice-access-routers/product_data_sheet09186a00802045f5.html&quot; rel=&quot;nofollow&quot;&gt;Cisco NM-CEM-4TE1 module&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was in an environment where they had an older Avaya system and wanted to install an extender at a remote location.  We used Cisco routers with this module at the time which allowed the Avaya PBX to &quot;hand off&quot; a T1 to the routers  which then encapsulated it as IP traffic to provide a T1 to the extender at the remote location over the WAN link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may have to do some research as it has been awhile and some of the hardware may be end of life at the point, but there should be something similar.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-04-20T18:57:58.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18001" PostTypeId="2" ParentId="17997" CreationDate="2015-04-20T19:59:44.307" Score="7" Body="&lt;p&gt;Even if you could still get PI IPv4 addresses in Asia: if your ISPs don't want to route your IP addresses then there is nothing you can do. Tunnels and LISP could solve some of your problems (I use LISP here), but you already stated that this is not available in your region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP is the protocol that is used to route your IP addresses from an AS. You need both to run BGP. Blocks of 16 addresses are too small to be routed with BGP anyway. Technically you could, but nobody will accept your routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to have your own IP addresses and route them etc. you'll have to make some investments. Because APNIC ran out of IPv4 addresses for normal distribution you'll have to comply with some very strict rules. If I recall correctly the current rules are that you have to be multihomed already, must be able to justify 25% of the addresses (which would be 25% of 256 = 64) immediately and 50% (=128) within a year. Based on your current numbers that seems unlikely. If you could then you'd need to get an AS number from APNIC and you'll have to find ISPs that want to set up BGP sessions with you. This will probably be more expensive than your current contracts. And on top of that you'd have to study a lot to learn how internet routing and BGP works or you'll have to hire someone else to manage it for you. In addition to buying the equipment needed to do all of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short: it's probably not worth it for your case.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-04-20T19:59:44.307" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="18002" PostTypeId="2" ParentId="17993" CreationDate="2015-04-20T20:20:42.533" Score="3" Body="&lt;p&gt;The linux bridge is a pure software switch -- the cpu is involved with every packet. With a &quot;managed switched&quot;, there will be dedicated switching hardware.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-20T20:20:42.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18003" PostTypeId="2" ParentId="16383" CreationDate="2015-04-20T20:31:37.360" Score="0" Body="&lt;p&gt;Please be aware, ICMP is bottom-of-the-barrel traffic. During high utilization, you should expect ICMP to drop. It is set up to be dropped first in almost every single scenario, to make way for real data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how do you test?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.elifulkerson.com/projects/tcping.php&quot; rel=&quot;nofollow&quot;&gt;TCPing&lt;/a&gt; is one way. This sends TCP SYN packets and times how long it takes to get an ACK back. You do need to know an open port on the other side to TCPing, but this gives you a good view of how actual TCP traffic is performing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCPing should tell you end-to-end your performance, but you already know there's some kind of trouble. How do you isolate it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://sourceforge.net/projects/winmtr/files/Latest/&quot; rel=&quot;nofollow&quot;&gt;WinMTR&lt;/a&gt; to the rescue! This basically runs a traceroute constantly, and collects the latency data on each hop. When you see the latency suddenly increase, you've probably got your culprit... especially if it's persistent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are 2 tools I use regularly to help isolate where issues exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you isolate the issue to a device you have SNMP access to, but not CLI/GUI access to, you can use &lt;a href=&quot;http://www.snmpsoft.com/freetools/&quot; rel=&quot;nofollow&quot;&gt;SNMPWalk and SNMPGet&lt;/a&gt; to dig deeper. I recommend this as a last-ditch effort, since the &quot;S&quot; in &quot;SNMP&quot; stands for something it isn't to mere mortals: Simple. But oh, the information you can eventually coax out of it.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2015-04-20T20:31:37.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18004" PostTypeId="2" ParentId="17993" CreationDate="2015-04-20T21:11:00.690" Score="5" Body="&lt;p&gt;The three major differences between a managed switch and using Linux bridge interfaces are performance, port density, and features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most managed switches will embed some of their programmed functionality into specialized hardware.  This is not true in all cases, but this specialized hardware will tend to outperform devices that are purely software based (at least for the functionality embedded in the hardware).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, if port density is of concern, there aren't many server systems where you can pack 12-48 ports into a 1U chassis, and of the ones I have seen they were designed to be a network device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, are the features. Managed switches will typically have features that either are not present on a Linux platform, not as easily configured, or may require additional CPU/memory resources that will further impact performance if you use them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, aside from the differences in the two platform choices, it sounds like you are setting up some sort of lab/test/dev environment. My primary concern would be that you should try to match your actual/production environment as closely as possible.  Your Linux &quot;switches&quot; do not behave the same as your managed switches, so something you implement in the lab may act entirely differently when implemented on your managed switches.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-04-20T21:11:00.690" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18006" PostTypeId="1" AcceptedAnswerId="18751" CreationDate="2015-04-21T09:09:35.370" Score="4" ViewCount="2548" Body="&lt;p&gt;In an office setting, multiple clients (Mac OSX, Ubuntu, iOS, Android and Windows 8) connect to a VPN server in another location. These clients are behind an SRX240B router which is connected to a PPPoE fiber uplink. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SRX240B replaced the previous router, an SRX100H. The SRX100 was completely stable, but the SRX240B has some weird issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When clients connect to VPN, the connection usually works for a couple of minutes, but then &lt;em&gt;all&lt;/em&gt; internet traffic disappears. Every device, every browser, every connection is lost. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can SSH into the router, but pinging external hosts (8.8.8.8 for example) just times out. When a specific VPN connection is disconnected by the user, all internet traffic returns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea what could cause this. The only thing I can imagine is that the SRX runs its own VPN software (and has active listening processes on UDP port 500 and 4500), and this somehow interferes with the client VPN. However, this does not explain why the SRX100 running exactly the same config has no issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For completeness, here is my router config on the SRX100. The only difference with the SRX240 is that all &lt;code&gt;fe-*/*/*.*&lt;/code&gt;-interfaces are replaced with &lt;code&gt;ge-*/*/*.*&lt;/code&gt;-interfaces.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;## Last commit: 2015-02-19 15:37:07 UTC by root&#xA;version 12.1X44-D40.2;&#xA;system {&#xA;    host-name --obscured--;&#xA;    root-authentication {&#xA;        encrypted-password --obscured--;&#xA;    }&#xA;    name-server {&#xA;        8.8.8.8;&#xA;        8.8.4.4;&#xA;    }&#xA;    services {&#xA;        ssh;&#xA;        dns {&#xA;            dns-proxy {&#xA;                propogate-setting enable;&#xA;                interface {&#xA;                    vlan.0;&#xA;                }&#xA;                default-domain * {&#xA;                    forwarders {&#xA;                        --obscured--;&#xA;                        --obscured--;&#xA;                        --obscured--;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;        web-management {&#xA;            http {&#xA;                port 80;&#xA;                interface vlan.0;&#xA;            }&#xA;        }&#xA;        dhcp {&#xA;            pool 192.168.2.0/24 {&#xA;                address-range low 192.168.2.1 high 192.168.2.99;&#xA;                name-server {&#xA;                    192.168.2.254;&#xA;                }&#xA;                router {&#xA;                    192.168.2.254;&#xA;                }&#xA;                propagate-settings vlan.0;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    interface-range interfaces-trust {&#xA;        member fe-0/0/1;&#xA;        member fe-0/0/2;&#xA;        member fe-0/0/3;&#xA;        member fe-0/0/4;&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    fe-0/0/0 {&#xA;        unit 0 {&#xA;            encapsulation ppp-over-ether;&#xA;        }&#xA;    }&#xA;    pp0 {&#xA;        unit 0 {&#xA;            point-to-point;&#xA;            ppp-options {&#xA;                pap {&#xA;                    local-name --obscured--;&#xA;                    local-password --obscured--; ## SECRET-DATA&#xA;                    passive;&#xA;                }&#xA;            }&#xA;            pppoe-options {&#xA;                underlying-interface fe-0/0/0.0;&#xA;                idle-timeout 0;&#xA;                auto-reconnect 10;&#xA;                client;&#xA;            }&#xA;            family inet {&#xA;                mtu 1492;&#xA;                negotiate-address;&#xA;            }&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 192.168.2.254/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;snmp {&#xA;    location --obscured--;&#xA;    contact --obscured--;&#xA;    community public {&#xA;        authorization read-only;&#xA;        clients {&#xA;            192.168.2.0/24;&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 {&#xA;            next-hop pp0.0;&#xA;            metric 0;&#xA;        }&#xA;    }&#xA;}&#xA;security {&#xA;    address-book {&#xA;        global {&#xA;            address --obscured-- --obscured--;&#xA;            address nagios02 192.168.2.249/32;&#xA;            address anywhere 0.0.0.0/0;&#xA;            address jeroen 192.168.2.170/32;&#xA;        }&#xA;    }&#xA;    flow {&#xA;        tcp-mss {&#xA;            all-tcp {&#xA;                mss 1300;&#xA;            }&#xA;        }&#xA;    }&#xA;    screen {&#xA;        ids-option untrust-screen {&#xA;            icmp {&#xA;                ping-death;&#xA;            }&#xA;            ip {&#xA;                source-route-option;&#xA;                tear-drop;&#xA;            }&#xA;            tcp {&#xA;                syn-flood {&#xA;                    alarm-threshold 1024;&#xA;                    attack-threshold 200;&#xA;                    source-threshold 1024;&#xA;                    destination-threshold 2048;&#xA;                    timeout 20;&#xA;                }&#xA;                land;&#xA;            }&#xA;            limit-session {&#xA;                source-ip-based 50000;&#xA;                destination-ip-based 50000;&#xA;            }&#xA;        }&#xA;    }&#xA;    nat {&#xA;        source {&#xA;            rule-set untrust-to-trust {&#xA;                from zone trust;&#xA;                to zone untrust;&#xA;                rule outbound-nat-rule {&#xA;                    match {&#xA;                        source-address 0.0.0.0/0;&#xA;                    }&#xA;                    then {&#xA;                        source-nat {&#xA;                            interface;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;        destination {&#xA;            pool --obscured-- {&#xA;                address 192.168.2.249/32;&#xA;            }&#xA;            pool --obscured-- {&#xA;                address 192.168.2.170/32;&#xA;            }&#xA;            rule-set ruleset-from-untrust {&#xA;                from interface pp0.0;&#xA;                rule --obscured-- {&#xA;                    match {&#xA;                        source-address --obscured--/32;&#xA;                        destination-address --obscured--/32;&#xA;                        destination-port 5666;&#xA;                    }&#xA;                    then {&#xA;                        destination-nat pool --obscured--;&#xA;                    }&#xA;                }&#xA;                rule port_17071 {&#xA;                    match {&#xA;                        destination-address --obscured--/32;&#xA;                        destination-port 17071;&#xA;                    }&#xA;                    then {&#xA;                        destination-nat pool --obscured--;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    policies {&#xA;        from-zone trust to-zone untrust {&#xA;            policy outbound {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone untrust to-zone trust {&#xA;            policy nrpe {&#xA;                match {&#xA;                    source-address --obscured--;&#xA;                    destination-address --obscured--;&#xA;                    application nrpe;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;            policy --obscured-- {&#xA;                match {&#xA;                    source-address anywhere;&#xA;                    destination-address --obscured--;&#xA;                    application --obscured--;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    zones {&#xA;        security-zone untrust {&#xA;            screen untrust-screen;&#xA;            interfaces {&#xA;                pp0.0;&#xA;            }&#xA;        }&#xA;        security-zone trust {&#xA;            interfaces {&#xA;                vlan.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            dhcp;&#xA;                            ssh;&#xA;                            ping;&#xA;                            snmp;&#xA;                            http;&#xA;                            dns;&#xA;                        }&#xA;                        protocols {&#xA;                            all;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;applications {&#xA;    application nrpe {&#xA;        protocol tcp;&#xA;        destination-port 5666;&#xA;    }&#xA;    application --obscured-- {&#xA;        protocol tcp;&#xA;        destination-port 17071;&#xA;    }&#xA;}&#xA;vlans {&#xA;    vlan-trust {&#xA;        vlan-id 10;&#xA;        l3-interface vlan.0;&#xA;    }&#xA;}&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Update 1: Extra information, as requested by Jordan Head in the comments:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The SRX100 runs Junos &lt;code&gt;12.1X44-D40.2&lt;/code&gt;. The SRX240 runs Junos &lt;code&gt;12.1X46-D30.2&lt;/code&gt;, but the problem als occurred with an older version. I don't remember which version exactly, but I believe it was from the &lt;code&gt;11.4&lt;/code&gt;-series.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem occurs with any number of connected VPN clients (varying from 1 to 5 simultaneously).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've checked the logs but nothing stood out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The results of &lt;code&gt;show system license&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;root@router&gt; show system license&#xA;License usage:&#xA;                                 Licenses     Licenses    Licenses    Expiry&#xA;  Feature name                       used    installed      needed&#xA;  dynamic-vpn                           0            2           0    permanent&#xA;  ax411-wlan-ap                         0            2           0    permanent&#xA;&#xA;Licenses installed: none&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Update 2: status when connection is lost&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I needed some time to reproduce the problem because my users are depending on this uplink. I got the following status at the moment the problem occurs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;root@router&gt; show interfaces pp0.0 detail | no-more &#xA;  Logical interface pp0.0 (Index 71) (SNMP ifIndex 548) (Generation 145)&#xA;    Flags: Hardware-Down Point-To-Point SNMP-Traps 0x0 Encapsulation: PPPoE&#xA;    PPPoE:&#xA;      State: SessionDown, Session ID: None,&#xA;      Configured AC name: None, Service name: None,&#xA;      Auto-reconnect timeout: 10 seconds, Idle timeout: Never,&#xA;      Underlying interface: ge-0/0/0.0 (Index 70)&#xA;    Traffic statistics:&#xA;     Input  bytes  :               665311&#xA;     Output bytes  :             41008220&#xA;     Input  packets:                 2442&#xA;     Output packets:               114687&#xA;    Local statistics:&#xA;     Input  bytes  :               665311&#xA;     Output bytes  :               946794&#xA;     Input  packets:                 2442&#xA;     Output packets:                 6297&#xA;    Transit statistics:&#xA;     Input  bytes  :                    0                    0 bps&#xA;     Output bytes  :             40061426                    0 bps&#xA;     Input  packets:                    0                    0 pps&#xA;     Output packets:               108390                    0 pps&#xA;  Keepalive settings: Interval 10 seconds, Up-count 1, Down-count 3&#xA;  Keepalive statistics:&#xA;    Input : 63 (last seen 00:03:17 ago)&#xA;    Output: 191 (last sent 00:03:19 ago)&#xA;  LCP state: Down&#xA;  NCP state: inet: Down, inet6: Down, iso: Not-configured, mpls: Not-configured&#xA;  CHAP state: Closed&#xA;  PAP state: Closed&#xA;    Security: Zone: untrust&#xA;    Flow Statistics :  &#xA;    Flow Input statistics :&#xA;      Self packets :                     2092&#xA;      ICMP packets :                     1385&#xA;      VPN packets :                      0&#xA;      Multicast packets :                5&#xA;      Bytes permitted by policy :        84103935&#xA;      Connections established :          52 &#xA;    Flow Output statistics: &#xA;      Multicast packets :                0&#xA;      Bytes permitted by policy :        39000259 &#xA;    Flow error statistics (Packets dropped due to): &#xA;      Address spoofing:                  0&#xA;      Authentication failed:             0&#xA;      Incoming NAT errors:               0&#xA;      Invalid zone received packet:      0&#xA;      Multiple user authentications:     0 &#xA;      Multiple incoming NAT:             0&#xA;      No parent for a gate:              0&#xA;      No one interested in self packets: 18       &#xA;      No minor session:                  0 &#xA;      No more sessions:                  0&#xA;      No NAT gate:                       0 &#xA;      No route present:                  409 &#xA;      No SA for incoming SPI:            0 &#xA;      No tunnel found:                   0&#xA;      No session for a gate:             0 &#xA;      No zone or NULL zone binding       0&#xA;      Policy denied:                     0&#xA;      Security association not active:   0 &#xA;      TCP sequence number out of window: 1&#xA;      Syn-attack protection:             0&#xA;      User authentication errors:        0&#xA;    Protocol inet, MTU: 1400, Generation: 158, Route table: 0&#xA;      Flags: Sendbcast-pkt-to-re, Protocol-Down, User-MTU, Negotiate-Address&#xA;    Protocol inet6, MTU: 1400, Generation: 159, Route table: 0&#xA;      Flags: Protocol-Down, User-MTU&#xA;      Addresses, Flags: Dest-route-down Is-Preferred Is-Primary&#xA;        Destination: --obscured--/64, Local: --obscured--&#xA;    Generation: 162&#xA;      Addresses, Flags: Dest-route-down Is-Preferred&#xA;        Destination: fe80::/64, Local: fe80::56e0:320f:fcea:9480&#xA;    Generation: 164&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&#xA;root@router&gt; show ethernet-switching table interface &#xA;Ethernet-switching table: 30 entries, 28 learned, 0 persistent entries&#xA;  VLAN              MAC address       Type         Age Interfaces&#xA;  vlan-trust        *                 Flood          - All-members&#xA;  vlan-trust        00:00:aa:c3:3d:c0 Learn          0 ge-0/0/3.0&#xA;  vlan-trust        00:0c:29:c9:4e:ef Learn          0 ge-0/0/3.0&#xA;  vlan-trust        00:0c:29:ea:61:c0 Learn          0 ge-0/0/3.0&#xA;  vlan-trust        00:23:df:f7:e8:aa Learn          0 ge-0/0/3.0&#xA;  vlan-trust        00:25:00:ad:f2:44 Learn          0 ge-0/0/4.0&#xA;  vlan-trust        1c:b0:94:c0:56:51 Learn          0 ge-0/0/4.0&#xA;  vlan-trust        20:a2:e4:62:0d:ec Learn          0 ge-0/0/4.0&#xA;  vlan-trust        30:10:e4:77:da:f8 Learn          0 ge-0/0/4.0&#xA;  vlan-trust        30:19:66:f3:52:de Learn          0 ge-0/0/4.0&#xA;  vlan-trust        40:6c:8f:0a:bc:5f Learn          0 ge-0/0/3.0&#xA;  vlan-trust        40:6c:8f:36:99:0b Learn          0 ge-0/0/3.0&#xA;  vlan-trust        54:e0:32:ea:94:90 Static         - Router&#xA;  vlan-trust        54:e4:3a:2f:81:2b Learn          0 ge-0/0/4.0&#xA;  vlan-trust        68:5b:35:93:b2:ea Learn          0 ge-0/0/2.0&#xA;  vlan-trust        68:5b:35:cb:b8:b4 Learn          0 ge-0/0/1.0&#xA;  vlan-trust        70:de:e2:75:e0:5c Learn          0 ge-0/0/4.0&#xA;  vlan-trust        78:19:f7:85:1e:f0 Learn          0 ge-0/0/3.0&#xA;  vlan-trust        7c:6d:62:72:f8:0d Learn          0 ge-0/0/4.0&#xA;  vlan-trust        7c:c5:37:1b:6d:42 Learn          0 ge-0/0/4.0&#xA;  vlan-trust        8c:fa:ba:7d:81:a3 Learn          0 ge-0/0/4.0&#xA;  vlan-trust        9c:04:eb:b1:92:9f Learn          0 ge-0/0/4.0&#xA;  vlan-trust        ac:87:a3:29:77:57 Learn          0 ge-0/0/3.0&#xA;  vlan-trust        b4:75:0e:60:b1:65 Learn          0 ge-0/0/4.0&#xA;  vlan-trust        b8:09:8a:bd:5d:17 Learn          0 ge-0/0/4.0&#xA;  vlan-trust        bc:30:5b:e0:fa:1b Learn          0 ge-0/0/3.0&#xA;  vlan-trust        bc:5f:f4:3b:6e:8d Learn          0 ge-0/0/3.0&#xA;  vlan-trust        bc:92:6b:0e:44:d9 Learn          0 ge-0/0/4.0&#xA;  vlan-trust        e0:b5:2d:06:93:c6 Learn          0 ge-0/0/4.0&#xA;  vlan-trust        e8:50:8b:05:72:2f Learn          0 ge-0/0/4.0&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;pre&gt;&#xA;root@root&gt; show route &#xA;&#xA;inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;192.168.2.0/24     *[Direct/0] 00:34:54&#xA;                    &gt; via vlan.0&#xA;192.168.2.254/32   *[Local/0] 00:34:54&#xA;                      Local via vlan.0&#xA;&#xA;inet6.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;--obscured--/128&#xA;                   *[Local/0] 00:34:54&#xA;                      Reject&#xA;fe80::56e0:320f:fcea:9480/128&#xA;                   *[Local/0] 00:34:54&#xA;                      Reject&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;update 06 may - ppp logs&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I'm sorry it took me a while to respond, but these are the logs when PPP goes down (at 12:03) and comes back up (at 12:11).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;12:03:49 op change ifl pp0.0 idx 71 devindex 128 flags c010&#xA;12:03:49 op change ifl pp0.0 idx 71 devindex 128&#xA;12:03:49 IFL State TLV:          &#xA;12:03:49  State - Opened         &#xA;12:03:49  Auth Chap flags - 00   &#xA;12:03:49  Auth Pap flags - 0b    &#xA;12:03:49  Options:               &#xA;12:03:49   MRU: 1492             &#xA;12:03:49   Auth proto: PAP       &#xA;12:03:49   Magic Num: 1430297898 &#xA;12:03:49 IFL Config TLV:         &#xA;12:03:49  Media flags - 0000     &#xA;12:03:49  Auth protocol PAP - 0xc023&#xA;12:03:49  PPP flags - 00         &#xA;12:03:49  MRU - 1492             &#xA;12:03:49 pppd_iflm_handle_change: ifl-&gt;ifl_flags 0xc010 iflm-&gt;iflm_flags 0xc010&#xA;12:03:49 pp0.0: Session LCP max configuration request count 254 is set(254 default count)&#xA;12:03:49 pp0.0: pppd_ncp_close_proto&#xA;12:03:49 pp0.0: IPCP - State changed to: Closed&#xA;12:03:49 pp0.0: IFF af inet - Building TLV (changed 0xb)&#xA;12:03:49 pp0.0: IFF af inet - Building flags (0x80000000), cflags (0x1000804)&#xA;12:03:49 pp0.0: IFF af inet - Building NCP, proto 0x8021, len 16&#xA;12:03:49 pp0.0: IFF af inet - Building IFA delete&#xA;12:03:49 Upd iff pp0.0 af inet iflidx 71 devidx 128: done&#xA;12:03:49 pp0.0: pppd_ncp_close_proto&#xA;12:03:49 pp0.0: IPV6CP - Stopping protocol timer [local]&#xA;12:03:49 pp0.0: IPV6CP - State changed to: Closed&#xA;12:03:49 pp0.0: IFF af inet6 - Building TLV (changed 0x3)&#xA;12:03:49 pp0.0: IFF af inet6 - Building flags (0x0), cflags (0x804)&#xA;12:03:49 pp0.0: IFF af inet6 - Building NCP, proto 0x8057, len 16&#xA;12:03:49 Upd iff pp0.0 af inet6 iflidx 71 devidx 128: done&#xA;12:03:49 pp0.0: PAP - Stopping pap_proto timer&#xA;12:03:49 pp0.0: PAP - Stopping answer wait timer&#xA;12:03:49 pp0.0: IFL - Building TLV (changed 0x5)&#xA;12:03:49 pp0.0: IFL - Building flags (0xc011), cflags (0x1)&#xA;12:03:49 pp0.0: IFL - Building AUTH, len 3&#xA;12:03:49 Upd ifl pp0.0 iflidx 71 devidx 128: done&#xA;12:03:49 pp0.0: LCP - State changed to: Closed&#xA;12:03:49 pp0.0: IFL - Building TLV (changed 0x3)&#xA;12:03:49 pp0.0: IFL - Building flags (0xc011), cflags (0x1)&#xA;12:03:49 pp0.0: IFL - Building LCP, len 16&#xA;12:03:49 Upd ifl pp0.0 iflidx 71 devidx 128: done&#xA;12:03:49 pp0.0: Session phase changed Network -&gt; Disabled&#xA;12:03:49 op delete ifa .0 af inet iflidx 71 devindex 128&#xA;12:03:49 Deleting ifa pp0.0 iflidx 71 af inet&#xA;12:03:49 op change ifl pp0.0 idx 71 devindex 128 flags c011&#xA;12:03:49 op change ifl pp0.0 idx 71 devindex 128&#xA;12:03:49 IFL State TLV:          &#xA;12:03:49  State - Closed         &#xA;12:03:49  Auth Chap flags - 00   &#xA;12:03:49  Auth Pap flags - 0a    &#xA;12:03:49  Options:               &#xA;12:03:49   MRU: 1492             &#xA;12:03:49   Magic Num: 2860994156 &#xA;12:03:49 IFL Config TLV:         &#xA;12:03:49  Media flags - 0000     &#xA;12:03:49  Auth protocol PAP - 0xc023&#xA;12:03:49  PPP flags - 00         &#xA;12:03:49  MRU - 1492             &#xA;12:03:49 pppd_iflm_handle_change: ifl-&gt;ifl_flags 0xc011 iflm-&gt;iflm_flags 0xc011&#xA;12:03:49 pp0.0: Session LCP max configuration request count 254 is set(254 default count)&#xA;12:03:49 op change iff pp0.0 af inet iflidx 71 devindex 128&#xA;12:03:49 IFF State TLV:          &#xA;12:03:49  State - Closed         &#xA;12:03:49  Options:               &#xA;12:03:49   Address: local 213.206.222.121, remote 213.207.113.2&#xA;12:03:49 op change iff pp0.0 af inet6 iflidx 71 devindex 128&#xA;12:03:49 IFF State TLV:          &#xA;12:03:49  State - Closed         &#xA;12:03:49  Options:               &#xA;12:03:49   Local interface ID: 56e0:320f:fcea:9480, remote interface ID: 0200:000f:fc00:0000&#xA;12:10:56 op change ifd ge-0/0/0 devidx 134 flags c001&#xA;12:10:56 op change ifd ge-0/0/0 devidx 134 (skipped)&#xA;12:11:00 op change ifd ge-0/0/0 devidx 134 flags c000&#xA;12:11:00 op change ifd ge-0/0/0 devidx 134 (skipped)&#xA;12:11:00 op change ifl pp0.0 idx 71 devindex 128 flags c011&#xA;12:11:00 op change ifl pp0.0 idx 71 devindex 128&#xA;12:11:00 pppd_iflm_handle_change: ifl-&gt;ifl_flags 0xc011 iflm-&gt;iflm_flags 0xc011&#xA;12:11:00 op change ifl pp0.0 idx 71 devindex 128 flags c011&#xA;12:11:00 op change ifl pp0.0 idx 71 devindex 128&#xA;12:11:00 IFL State TLV:          &#xA;12:11:00  State - Closed         &#xA;12:11:00  Auth Chap flags - 00   &#xA;12:11:00  Auth Pap flags - 0a    &#xA;12:11:00  Options:               &#xA;12:11:00   MRU: 1492             &#xA;12:11:00   Magic Num: 2860994156 &#xA;12:11:00 IFL Config TLV:         &#xA;12:11:00  Media flags - 0000     &#xA;12:11:00  Auth protocol PAP - 0xc023&#xA;12:11:00  PPP flags - 01         &#xA;12:11:00  MRU - 1492             &#xA;12:11:00 pppd_iflm_handle_change: ifl-&gt;ifl_flags 0xc011 iflm-&gt;iflm_flags 0xc011&#xA;12:11:00 pp0.0: Session LCP max configuration request count 254 is set(254 default count)&#xA;12:11:00 pp0.0: LCP - Starting protocol timer (3 sec, 0 nsec)&#xA;12:11:00 pp0.0: Sent 18 byte (10 data bytes) PPP packet: 0x21 0xc0 0x13 0x01&#xA;12:11:00 pp0.0: LCP - State changed to: Creq-sent&#xA;12:11:00 pp0.0: Session phase changed Disabled -&gt; Establish&#xA;12:11:00 pp0.0: Received 40 byte PPP packet: 0xc0 0x21 0x01&#xA;12:11:00 pp0.0: Sent 22 byte (14 data bytes) PPP packet: 0x21 0xc0 0x1c 0x02&#xA;12:11:00 pp0.0: LCP - State changed to: Ack-sent&#xA;12:11:00 pppd_msg_input: recvmsg: Resource temporarily unavailable&#xA;12:11:00 pp0.0: Received 40 byte PPP packet: 0xc0 0x21 0x02&#xA;12:11:00 pp0.0: LCP - Stopping protocol timer&#xA;12:11:00 pp0.0: LCP - State changed to: Opened&#xA;12:11:00 pp0.0: IFL - Building TLV (changed 0xa)&#xA;12:11:00 pp0.0: IFL - Building magic 1430297898, len 8&#xA;12:11:00 pp0.0: IFL - Building LCP, len 16&#xA;12:11:00 Upd ifl pp0.0 iflidx 71 devidx 128: done&#xA;12:11:00 pppd_msg_input: recvmsg: Resource temporarily unavailable&#xA;12:11:00 op change ifl pp0.0 idx 71 devindex 128 flags c011&#xA;12:11:00 op change ifl pp0.0 idx 71 devindex 128&#xA;12:11:00 IFL State TLV:          &#xA;12:11:00  State - Opened         &#xA;12:11:00  Auth Chap flags - 00   &#xA;12:11:00  Auth Pap flags - 0b    &#xA;12:11:00  Options:               &#xA;12:11:00   MRU: 1492             &#xA;12:11:00   Auth proto: PAP       &#xA;12:11:00   Magic Num: 1430297898 &#xA;12:11:00 IFL Config TLV:         &#xA;12:11:00  Media flags - 0000     &#xA;12:11:00  Auth protocol PAP - 0xc023&#xA;12:11:00  PPP flags - 01         &#xA;12:11:00  MRU - 1492             &#xA;12:11:00 pppd_iflm_handle_change: ifl-&gt;ifl_flags 0xc011 iflm-&gt;iflm_flags 0xc011&#xA;12:11:00 pp0.0: Session LCP max configuration request count 254 is set(254 default count)&#xA;12:11:00 pp0.0: Sent 32 byte (24 data bytes) PPP packet: 0x23 0xc0 0x14 0x01&#xA;12:11:00 pp0.0: PAP - Stopping pap_proto timer&#xA;12:11:00 pp0.0: PAP - Starting pap_proto timer 2 sec, 0 nsec&#xA;12:11:00 pp0.0: Session phase changed Establish -&gt; Authenticate&#xA;12:11:00 pp0.0: Received 40 byte PPP packet: 0xc0 0x23 0x02&#xA;12:11:00 pp0.0: PAP - PAP Authentication is succesful , ACK received interface pp0.0&#xA;12:11:00 pp0.0: PAP - Stopping pap_proto timer&#xA;12:11:00 pp0.0: PAP - Stopping answer wait timer&#xA;12:11:00 pp0.0: IFL - Building TLV (changed 0x5)&#xA;12:11:00 pp0.0: IFL - Building flags (0xc010), cflags (0x1)&#xA;12:11:00 pp0.0: IFL - Building AUTH, len 3&#xA;12:11:00 Upd ifl pp0.0 iflidx 71 devidx 128: done&#xA;12:11:00 pppd_msg_input: recvmsg: Resource temporarily unavailable&#xA;12:11:01 op change ifl pp0.0 idx 71 devindex 128 flags c010&#xA;12:11:01 op change ifl pp0.0 idx 71 devindex 128&#xA;12:11:01 IFL State TLV:          &#xA;12:11:01  State - Opened         &#xA;12:11:01  Auth Chap flags - 00   &#xA;12:11:01  Auth Pap flags - 0b    &#xA;12:11:01  Options:               &#xA;12:11:01   MRU: 1492             &#xA;12:11:01   Auth proto: PAP       &#xA;12:11:01   Magic Num: 1430297898 &#xA;12:11:01 IFL Config TLV:         &#xA;12:11:01  Media flags - 0000     &#xA;12:11:01  Auth protocol PAP - 0xc023&#xA;12:11:01  PPP flags - 01         &#xA;12:11:01  MRU - 1492             &#xA;12:11:01 pppd_iflm_handle_change: ifl-&gt;ifl_flags 0xc010 iflm-&gt;iflm_flags 0xc010&#xA;12:11:01 pp0.0: Session LCP max configuration request count 254 is set(254 default count)&#xA;12:11:01 pp0.0: IPCP - ADDRESS using local address: 0.0.0.0&#xA;12:11:01 pp0.0: IPCP - Config-Request, Built 6 bytes of PRIMARY DNS at 0x3ffed87e&#xA;12:11:01 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec)&#xA;12:11:01 pp0.0: Sent 26 byte (18 data bytes) PPP packet: 0x21 0x80 0x15 0x01&#xA;12:11:01 pp0.0: IPCP - State changed to: Creq-sent&#xA;12:11:01 pp0.0: IPV6CP - Using interface ID: 56e0:320f:fcea:9480&#xA;12:11:01 pp0.0: IPV6CP - Stopping protocol timer [local]&#xA;12:11:01 pp0.0: IPV6CP - Starting protocol timer (3 sec, 0 nsec) [local]&#xA;12:11:01 pp0.0: Sent 18 byte (10 data bytes) PPP packet: 0x57 0x80 0x16 0x01&#xA;12:11:01 pp0.0: IPV6CP - State changed to: Creq-sent&#xA;12:11:01 pp0.0: Session phase changed Authenticate -&gt; Network&#xA;12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x04&#xA;12:11:01 pp0.0: pppd_ncp_process_nak_rej&#xA;12:11:01 pp0.0: IPCP - Stopping protocol timer&#xA;12:11:01 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec)&#xA;12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable&#xA;12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x57 0x02&#xA;12:11:01 pp0.0: pppd_ncp_process_conf_ack&#xA;12:11:01 pp0.0: IPV6CP - Stopping protocol timer [local]&#xA;12:11:01 pp0.0: IPV6CP - Current state Creq-sent&#xA;12:11:01 pp0.0: IPV6CP - State changed to: Ack-rcvd&#xA;12:11:01 pp0.0: IPV6CP - Starting protocol timer (3 sec, 0 nsec) [local]&#xA;12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable&#xA;12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x01&#xA;12:11:01 pp0.0: pppd_ncp_process_conf_req&#xA;12:11:01 pp0.0: IPCP - Remote peer requesting address 213.207.113.2&#xA;12:11:01 pp0.0: IPCP - Need to negotiate address&#xA;12:11:01 pp0.0: IPCP - Current state Creq-sent&#xA;12:11:01 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x40 0x02&#xA;12:11:01 pp0.0: IPCP - State changed to: Ack-sent&#xA;12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable&#xA;12:11:01 pp0.0: Received 40 byte PPP packet: 0x80 0x57 0x01&#xA;12:11:01 pp0.0: pppd_ncp_process_conf_req&#xA;12:11:01 pp0.0: IPV6CP - Current state Ack-rcvd&#xA;12:11:01 pp0.0: Sent 18 byte (10 data bytes) PPP packet: 0x57 0x80 0xe0 0x02&#xA;12:11:01 pp0.0: IPV6CP - Stopping protocol timer [local]&#xA;12:11:01 pp0.0: IPV6CP - State changed to: Opened&#xA;12:11:01 pp0.0: IFF af inet6 - Building TLV (changed 0x3)&#xA;12:11:01 pp0.0: IFF af inet6 - Building flags (0x0), cflags (0x800)&#xA;12:11:01 pp0.0: IFF af inet6 - Building NCP, proto 0x8057, len 16&#xA;12:11:01 Upd iff pp0.0 af inet6 iflidx 71 devidx 128: done&#xA;12:11:01 pppd_msg_input: recvmsg: Resource temporarily unavailable&#xA;12:11:01 op change iff pp0.0 af inet6 iflidx 71 devindex 128&#xA;12:11:01 IFF State TLV:          &#xA;12:11:01  State - Opened         &#xA;12:11:01  Options:               &#xA;12:11:01   Local interface ID: 56e0:320f:fcea:9480, remote interface ID: 0200:000f:fc00:0000&#xA;12:11:03 pp0.0: IPCP - Timer expired&#xA;12:11:03 pp0.0: IPCP - Proto timeout&#xA;12:11:03 pp0.0: IPCP - ADDRESS using local address: 0.0.0.0&#xA;12:11:03 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec)&#xA;12:11:03 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x17 0x01&#xA;12:11:03 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x03&#xA;12:11:03 pp0.0: pppd_ncp_process_nak_rej&#xA;12:11:03 pp0.0: IPCP - Handling Conf-Nak&#xA;12:11:03 pp0.0: IPCP - Negotiated address&#xA;12:11:03 pp0.0: IPCP - Stopping protocol timer&#xA;12:11:03 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec)&#xA;12:11:03 pppd_msg_input: recvmsg: Resource temporarily unavailable&#xA;12:11:04 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x01&#xA;12:11:04 pp0.0: pppd_ncp_process_conf_req&#xA;12:11:04 pp0.0: IPCP - Remote peer requesting address 213.207.113.2&#xA;12:11:04 pp0.0: IPCP - Need to negotiate address&#xA;12:11:04 pp0.0: IPCP - Current state Ack-sent&#xA;12:11:04 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x41 0x02&#xA;12:11:04 pppd_msg_input: recvmsg: Resource temporarily unavailable&#xA;12:11:06 pp0.0: IPCP - Timer expired&#xA;12:11:06 pp0.0: IPCP - Proto timeout&#xA;12:11:06 pp0.0: IPCP - ADDRESS using local address: 213.206.222.121&#xA;12:11:06 pp0.0: IPCP - Starting protocol timer (3 sec, 0 nsec)&#xA;12:11:06 pp0.0: Sent 14 byte (6 data bytes) PPP packet: 0x21 0x80 0x18 0x01&#xA;12:11:06 pp0.0: Received 40 byte PPP packet: 0x80 0x21 0x02&#xA;12:11:06 pp0.0: pppd_ncp_process_conf_ack&#xA;12:11:06 pp0.0: IPCP - Stopping protocol timer&#xA;12:11:06 pp0.0: IPCP - Current state Ack-sent&#xA;12:11:06 pp0.0: IPCP - State changed to: Opened&#xA;12:11:06 pp0.0: IFF af inet - Building TLV (changed 0x7)&#xA;12:11:06 pp0.0: IFF af inet - Building flags (0x80000000), cflags (0x1000800)&#xA;12:11:06 pp0.0: IFF af inet - Building NCP, proto 0x8021, len 16&#xA;12:11:06 pp0.0: IFF af inet - Building IFA add&#xA;12:11:06 Upd iff pp0.0 af inet iflidx 71 devidx 128: done&#xA;12:11:06 pppd_msg_input: recvmsg: Resource temporarily unavailable&#xA;12:11:06 op change iff pp0.0 af inet iflidx 71 devindex 128&#xA;12:11:06 IFF State TLV:          &#xA;12:11:06  State - Opened         &#xA;12:11:06  Options:               &#xA;12:11:06   Address: local 213.206.222.121, remote 213.207.113.2&#xA;12:11:06 op add ifa pp0.0 af inet iflidx 71 devindex 128&#xA;12:11:06 pp0: Local IP address set to 213.206.222.121/32&#xA;12:11:06 pp0: Remote IP address set to 213.207.113.2/32&#xA;12:11:06 Added ifa pp0.0 iflidx 71 af inet (primary address)&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="15009" LastEditorUserId="15009" LastEditDate="2015-05-06T08:05:01.450" LastActivityDate="2015-05-27T12:55:50.877" Title="Juniper SRX240 unstable uplink when client is connected to VPN" Tags="|juniper-junos|juniper-srx|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="18007" PostTypeId="2" ParentId="12622" CreationDate="2015-04-21T11:57:17.770" Score="1" Body="&lt;p&gt;For Fortigate firewalls running FortiOS 5.0 or newer, it is possible to use the CLI to specifically disable logs for accepted traffic directed to the firewall itself:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Log on to firewall using SSH, then run the following commands (assuming the firewall has a VDOM named 'root')&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config vdom&#xA;edit root&#xA;config log settings&#xA;set local-in-allow disable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This has to be done on a per VDOM basis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once this is done, the firewall keeps logging all denied traffic, without logging accepted pings, SNMP monitoring queries etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortinet has more informationg here: &lt;a href=&quot;http://docs-legacy.fortinet.com/fgt/handbook/cli_html/index.html#page/FortiOS%25205.0%2520CLI/config_log.17.13.html&quot; rel=&quot;nofollow&quot;&gt;http://docs-legacy.fortinet.com/fgt/handbook/cli_html/index.html#page/FortiOS%25205.0%2520CLI/config_log.17.13.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Fortigate firewalls running FortiOS older than 5.0, I suppose the best advice is to upgrade to 5.0 or newer and then apply the setting suggested above.  It seems like the feature 'set local-in-allow disable' is not available before FortiOS 5.0.&lt;/p&gt;&#xA;" OwnerUserId="3306" LastActivityDate="2015-04-21T11:57:17.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18009" PostTypeId="2" ParentId="13134" CreationDate="2015-04-21T14:33:10.163" Score="2" Body="&lt;p&gt;You need to set up split-tunneling on ASA. That will allow you being able to access the Internet whilst using the tunnel. &#xA;By default you shouldn't ever use &quot;Default Gateway on Remote Network&quot;, so untick it.&lt;/p&gt;&#xA;" OwnerUserId="15012" LastActivityDate="2015-04-21T14:33:10.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18010" PostTypeId="1" AcceptedAnswerId="18011" CreationDate="2015-04-21T18:48:00.117" Score="2" ViewCount="287" Body="&lt;p&gt;Current release: 15.0(2)SE4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Latest release: 15.2(2)SE6 ED&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recommended release: 15.0(2)SE6 ED&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What does the 'SE' stand for in the IOS versions?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Where can I find Cisco release notes that speak about the limitations, caveats and restrictions of each release?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance. &lt;/p&gt;&#xA;" OwnerUserId="15017" LastActivityDate="2015-04-21T19:01:52.613" Title="Cisco IOS version" Tags="|cisco-ios|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18011" PostTypeId="2" ParentId="18010" CreationDate="2015-04-21T19:01:52.613" Score="1" Body="&lt;p&gt;The normal place you'd find the release notes for is under the platform itself rather than the code release, though it depends and isn't consistent.  Some release notes are organized by software rather than platform.  ED means early deployment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The release you're mentioning is probably a bugfix release for Cisco 3700 switches.  That information is here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-0_2_se/release/notes/OL25302.html#pgfId-1077264&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-0_2_se/release/notes/OL25302.html#pgfId-1077264&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, you'll look at the main release for the caveats, then follow the train down the bugfix releases.  Usually, a bug scrub is also helpful, e.g. searching the features you're deploying using the Cisco bugsearch tools to determine whether any of them are things you might be concerned about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your Cisco or VAR SEs can also assist in choosing the right release for your needs.&lt;/p&gt;&#xA;" OwnerUserId="43" LastActivityDate="2015-04-21T19:01:52.613" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18013" PostTypeId="1" CreationDate="2015-04-22T00:32:31.587" Score="1" ViewCount="155" Body="&lt;p&gt;I have a lan device with the IP 192.168.1.10 connected to a Linksys E2000 router running DD-WRT with the IP 192.168.1.1 This router is configured as following, WAN Connection Type: Automatic DHCP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This router then is connected to another router provided by my ISP, the IP is 192.168.1.254. This last router is connected to a Optical Network Terminal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, when I arp in 192.168.1.10, only 192.168.1.1 replies. Because all devices connected to it are in it's broadcast domain, so it's normal it can't see 192.168.1.254 right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also does the MAC address of 192.168.1.10 is seen in 192.168.1.254? Or for exemple if I visit Google.com, does Google servers see this device MAC? Is the MAC carried all along the circuit inside the frame?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks, I hope my question isn't too confusing.&lt;/p&gt;&#xA;" OwnerUserId="15023" LastActivityDate="2015-04-22T03:20:03.707" Title="MAC Address doubt" Tags="|mac-address|" AnswerCount="1" CommentCount="1" ClosedDate="2015-04-22T06:00:50.223" ContentLicense="CC BY-SA 3.0" />
  <row Id="18016" PostTypeId="2" ParentId="18013" CreationDate="2015-04-22T03:20:03.707" Score="1" Body="&lt;p&gt;The MAC address is seen only by the two segments connected to each other. So, Google would not be able to see you MAC address. Furthermore, it is appropriate that your firewall would ARP with it's MAC address for the .254 address, because all devices need to first go through the firewall before they can reach the ISP gateway. If 192.168.1.10 saw the real ARP address for 192.168.1.254, then you would wind up with either a loop, the firewall dropping that traffic or your firewall being rendered useless.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2015-04-22T03:20:03.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18019" PostTypeId="1" AcceptedAnswerId="18022" CreationDate="2015-04-22T08:16:14.903" Score="1" ViewCount="1091" Body="&lt;p&gt;We have a VMWare ESXi host with a single network port. It's connected to a Cisco Catalyst 3750 switch port and the configuration of thew switch port is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet 1/0/2&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We need to run a guest on a separate vlan (vlan 11 and 12) and so we change the switch configuration as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet 1/0/2&#xA; switchport trunk encapsulation dot1q &#xA; switchport mode trunk&#xA; switchport trunk native vlan 10&#xA; switchport trunk allowed vlan add 10,11,12&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When this is done we lose access to the host. What is wrong with this configuration?&lt;/p&gt;&#xA;" OwnerUserId="15029" LastEditorUserId="286" LastEditDate="2015-04-22T10:08:51.743" LastActivityDate="2015-04-22T10:29:43.587" Title="Cisco Catalyst 3750 switch port for VMWare ESX" Tags="|cisco-ios|cisco-commands|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18021" PostTypeId="1" CreationDate="2015-04-22T09:33:26.677" Score="2" ViewCount="944" Body="&lt;p&gt;Given the following capture (click to zoom): &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/M2Th5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M2Th5.png&quot; alt=&quot;log&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 3 routers attached to a switch. One of them pings FF02::1 (packet #2). I understand, that the other two routers have to figure out the first one's link-layer address (hence the NS and NA messages #3,4,5,6). After that both of them sends their ping reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, why are those additional NDP messages exchanged (#11-14)? They are coming from the router, which sent the echo request. It should already know about the link-layer addresses of the other two from the Neighbor Solicitation messages. What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="12057" LastEditorDisplayName="user10222" LastEditDate="2015-06-10T07:20:17.473" LastActivityDate="2015-06-10T07:20:17.473" Title="IPv6 Neighbor Discovery procedure with a ping example" Tags="|switch|ipv6|icmpv6|network-discovery|" AnswerCount="0" CommentCount="3" ClosedDate="2019-12-20T00:24:08.230" ContentLicense="CC BY-SA 3.0" />
  <row Id="18022" PostTypeId="2" ParentId="18019" CreationDate="2015-04-22T10:00:58.650" Score="2" Body="&lt;p&gt;ESXi does not support DTP dynamic trunking protocol and portfast trunk should be enabled. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport nonegotiate !Skip DTP negotiation&#xA;spanning-tree portfast trunk !Fast forward STP state&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In addition, do not use the native (untagged) vlan on any portgroups.  Use the native vlan for the management or service-console VMKernel networks which also allow kickstarting for installs over DHCP or BOOTP before tagging can be used. &lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2015-04-22T10:29:43.587" LastActivityDate="2015-04-22T10:29:43.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18026" PostTypeId="1" AcceptedAnswerId="18027" CreationDate="2015-04-22T11:32:25.710" Score="1" ViewCount="2536" Body="&lt;p&gt;I understand that for classful networks in EIGRP we do not need a subnet mask. Why is this?&#xA;When I do a &lt;code&gt;show ip protocols&lt;/code&gt; the routes appear without a subnet mask which looks somewhat odd.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have a 192.168.0.0/16 network and just introduce the network into the EIGRP routing protocol as 192.168.0.0, how will EIGRP know that it is 192.168.0.0/16 and not say 192.168.0.0/24?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or does EIGRP understand the network address from the host addresses assigned to the router's DC interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="10187" LastEditorUserId="4889" LastEditDate="2015-04-23T22:12:24.397" LastActivityDate="2015-04-23T22:12:24.397" Title="Why is no subnet mask required in EIGRP for classful networks?" Tags="|eigrp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18027" PostTypeId="2" ParentId="18026" CreationDate="2015-04-22T11:56:12.210" Score="6" Body="&lt;p&gt;By default EIGRP uses a classful network, meaning that it assumes that an address in the class A range with have an 8-bit subnet mask.  There is no automatic process of checking other than the assumption that if you do not specify the subnet mask in wildcard mask format ( host mask ) then you want to use the default subnet mask for the IP range you've specified.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://study-ccna.com/eigrp-configuration&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://study-ccna.com/eigrp-configuration&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As @Todd Wilcox pointed out below, each address range has a class, originally specified in RFC791 ( &lt;a href=&quot;https://www.ietf.org/rfc/rfc791.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.ietf.org/rfc/rfc791.txt&lt;/a&gt; ), excluding special use addresses ( &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3330&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc3330&lt;/a&gt; ).&lt;/p&gt;&#xA;&lt;p&gt;Basically:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;pre&gt;Class      Sig Bits      Network Mask  Range&lt;/pre&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&#xA;A          0             8             0.0.0.0   - 127.255.255.255&#xA;&#xA;B         10             16            128.0.0.0 - 191.255.255.255&#xA;&#xA;C        110             24            192.0.0.0 - 223.255.255.255&#xA;&#xA;D       1110             undefined     224.0.0.0 - 239.255.255.255&#xA;&#xA;E       1111             undefined     240.0.0.0 - 255.255.255.255&#xA;&lt;/pre&gt;&#xA;&lt;p&gt;So converting the first octet ( first group of decimal digits in an IP address: &lt;em&gt;192&lt;/em&gt;.168.1.0 ) into binary gives us 11000000, matching the MSB ( most significant bits ) of a C class address, implying a default subnet mask of /24 bits or 255.255.255.0.&lt;/p&gt;&#xA;" OwnerUserId="14879" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-04-23T14:19:17.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18028" PostTypeId="2" ParentId="16358" CreationDate="2015-04-22T12:21:39.830" Score="0" Body="&lt;p&gt;I had to migrate a P2P VPN link between a Cisco ASA5515 and an SRX220 to a new FortiGate 500D and the same SRX220.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SRX VPN was configured in routing based mode but because it had to talk to the old ASA, it contained the proxy-identity with local and remote subnets defined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first I thought I had to update the SRX to the beta 12.1x46 firmware that would allow me to specify more than 1 entry for the proxy-identity in order to pass traffic on more than 1 subnets. However, FortiNet support clarifyed that the FortiGate does not require the proxy-identity field and I simply removed it from the SRX config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can confirm that the answer by RobinG is correct. If you omit the proxy-identity option, the local and remote identity will be 0.0.0.0/0. This is the expected behavior as well on the FortiGate. Thank you for posting this question as it has helped my greatly in migrating my VPN.&lt;/p&gt;&#xA;" OwnerUserId="15034" LastActivityDate="2015-04-22T12:21:39.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18034" PostTypeId="1" CreationDate="2015-04-22T15:40:01.443" Score="1" ViewCount="242" Body="&lt;p&gt;At the risk of asking an opinion question, are there any guidelines/practices that specify a threshold where the number of pause frames indicates a problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ratio of transmitted pause frames to received frames is about 3%.  If I assume xon/xoff, that's really about 1.5% of received packets are generating pauses.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to figure out if I have a serious over-subscription problem.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware is Nexus 2232pp, linked to a 5000.  Flow control is the default settings (transmit on).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-04-22T15:40:01.443" Title="Is there an acceptable ratio of pause frames?" Tags="|ethernet|cisco-nexus-2000|fcoe|" AnswerCount="0" CommentCount="3" ClosedDate="2020-12-16T21:26:52.537" ContentLicense="CC BY-SA 3.0" />
  <row Id="18036" PostTypeId="2" ParentId="1472" CreationDate="2015-04-22T16:10:22.763" Score="3" Body="&lt;p&gt;The syntax for sending a test syslog from a Cisco device depends on software version; here are the command syntaxes I've seen, including, where available, the option for setting syslog severity:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most Cisco platforms, if running IOS 12.2(58) and higher:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;send log [severity] [text to send]&#xA;Eg:&#xA;send log&#xA;send log   This message will go to my syslog server.&#xA;send log 5 This message will go to my syslog server.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Most Cisco platforms, if running IOS 12.2(52) and lower:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;send log [text to send]&#xA;Eg:&#xA;send log&#xA;send log   This message will go to my syslog server.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASR1000 running IOS-XE 03.01.00, which is sourced from IOS 15.0(1): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;send log [severity [text to send]]&#xA;Eg:&#xA;send log&#xA;send log 5 This message will go to my syslog server.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASR1000 running other IOS-XE versions (including 02.04.03 from IOS 12.2(33), 03.04.04 from IOS 15.1(3), 03.14.00 from IOS 15.5(1)): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;send log [severity] [text to send]&#xA;Eg:&#xA;send log&#xA;send log   This message will go to my syslog server.&#xA;send log 5 This message will go to my syslog server.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASR9000 running IOS-XR 4.2.1 and higher: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;log &amp;lt;text to send&amp;gt;&#xA;Eg:&#xA;log This message will go to my syslog server.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;WS-C6513 running IOS 12.2(18): No equivalent command; you need to use another method to generate a syslog message.  For example, the following should generate 5 syslogs (interface up, line protocol up, interface down, line protocol down, and configuration changed), depending on your logging settings.  Leave out the 2 interface commands to generate just the one generic configuration-changed syslog.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config t&#xA;interface loopback601&#xA;no interface loopback601&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15040" LastEditorUserId="15040" LastEditDate="2015-04-23T20:37:16.380" LastActivityDate="2015-04-23T20:37:16.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18039" PostTypeId="1" CreationDate="2015-04-22T19:42:15.017" Score="2" ViewCount="823" Body="&lt;p&gt;I've been following several guides online to setup a Cisco Aironet 1602I.&#xA;This AP has 2 radio anthenas and is able to produce several SSIDs via mbssid cisco configuration. My goal is to have 2 different SSIDs on the same radio and have them be separate networks, particularly, I want the second one to be isolated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this purpose I've followed guide on setting up different multiple SSIDs using VLANs. On VLAN1 I'm passing all the data to a different router to serve DHCP and routing to other networks (this part is actually not a problem); and for VLAN2 I want to serve DHCP directly from the AP itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done enough as to configure the SSIDs with their own networks, assign each of them to VLAN1 and VLAN2, and clients are able to see them. Clients are only able to connect to VLAN1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN1 is working without issues. Clients get DHCP from the main router (not the AP) and ping the other networks, etc. VLAN2 though seems to be dropping all packets that arrive to it and doesn't serve DHCP addresses even though we've configured a dhcp pool for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm out of ideas since all of the guides I've found seem to serve the configuration of SSIDs that don't provide DHCP directly from the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also may have done a bad job explaining the issue so apologies for any confusing part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the guides below, although most of the ones online have overall the same steps:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wireless-mobility/service-set-identifier-ssid/116118-configure-ap-ssid-ios.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/wireless-mobility/service-set-identifier-ssid/116118-configure-ap-ssid-ios.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap1#sh ru&#xA;Building configuration...&#xA;&#xA;version 15.3&#xA;hostname ap1&#xA;!&#xA;!&#xA;no aaa new-model&#xA;no ip source-route&#xA;no ip cef&#xA;ip domain name example.com&#xA;ip dhcp excluded-address 172.16.0.1 172.16.0.20&#xA;!&#xA;ip dhcp pool guest-wifi&#xA; import all&#xA; network 172.16.0.0 255.255.255.0&#xA; default-router 172.16.0.1 &#xA; dns-server 4.2.2.2 &#xA;!&#xA;!&#xA;!&#xA;dot11 vlan-name GUEST vlan 2&#xA;dot11 vlan-name MAIN vlan 1&#xA;!&#xA;dot11 ssid TestNetwork&#xA;   vlan MAIN&#xA;   authentication open &#xA;   authentication key-management wpa version 2&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 123456789&#xA;!&#xA;dot11 ssid TestNetwork 5GHz&#xA;   authentication open &#xA;   authentication key-management wpa version 2&#xA;   guest-mode&#xA;   wpa-psk ascii 7 123456789&#xA;!&#xA;dot11 ssid TestingWiFi&#xA;   vlan GUEST&#xA;   authentication open &#xA;   authentication key-management wpa version 2&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 123456789&#xA;!&#xA;!&#xA;bridge irb&#xA;interface Dot11Radio0&#xA; no ip address&#xA; !&#xA; encryption mode ciphers aes-ccm &#xA; !&#xA; encryption vlan GUEST mode ciphers aes-ccm &#xA; !&#xA; encryption vlan MAIN mode ciphers aes-ccm &#xA; !&#xA; broadcast-key change 300&#xA; !&#xA; !        &#xA; ssid TestNetwork&#xA; !&#xA; ssid TestingWiFi&#xA; !&#xA; antenna gain 0&#xA; stbc&#xA; beamform ofdm&#xA; mbssid&#xA; station-role root&#xA; rts threshold 512&#xA; rts retries 128&#xA; no dot11 extension aironet&#xA;!&#xA;interface Dot11Radio0.1&#xA; encapsulation dot1Q 1 native&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;&#xA;interface Dot11Radio0.2&#xA; encapsulation dot1Q 2&#xA; bridge-group 2&#xA; bridge-group 2 subscriber-loop-control&#xA; bridge-group 2 spanning-disabled&#xA; bridge-group 2 block-unknown-source&#xA; no bridge-group 2 source-learning&#xA; no bridge-group 2 unicast-flooding&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; !&#xA; encryption mode ciphers aes-ccm &#xA; !&#xA; broadcast-key change 300&#xA; !&#xA; !&#xA; ssid TestNetwork 5GHz&#xA; !&#xA; antenna gain 0&#xA; peakdetect&#xA; no dfs band block&#xA; stbc&#xA; beamform ofdm&#xA; channel dfs&#xA; station-role root&#xA; rts threshold 512&#xA; rts retries 128&#xA; no dot11 extension aironet&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0.1&#xA; encapsulation dot1Q 1 native&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA;!&#xA;interface GigabitEthernet0.2&#xA; encapsulation dot1Q 2&#xA; bridge-group 2&#xA; bridge-group 2 spanning-disabled&#xA; bridge-group 2 block-unknown-source&#xA; no bridge-group 2 source-learning&#xA;!         &#xA;interface BVI1&#xA; mac-address xxxx.xxxx.xxxx&#xA; ip address 192.168.1.30 255.255.255.128&#xA; ipv6 address dhcp&#xA; ipv6 address autoconfig&#xA; ipv6 enable&#xA;!&#xA;interface BVI2&#xA; mac-address xxxx.xxxx.xxxx&#xA; ip address 172.16.0.30 255.255.255.0&#xA; ip information-reply&#xA; history PPS&#xA;!&#xA;ip default-gateway 192.168.1.1&#xA;ip forward-protocol nd&#xA;bridge 1 priority 1&#xA;bridge 1 protocol ieee&#xA;bridge 1 route ip&#xA;bridge 2 priority 10&#xA;bridge 2 protocol ieee&#xA;bridge 2 route ip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15042" LastEditorUserId="15042" LastEditDate="2015-04-22T22:36:53.867" LastActivityDate="2015-04-22T22:36:53.867" Title="Trying to serve dhcp inside cisco AP with mbssid" Tags="|cisco|vlan|cisco-wireless|" AnswerCount="0" CommentCount="2" ClosedDate="2019-12-20T00:22:18.777" ContentLicense="CC BY-SA 3.0" />
  <row Id="18042" PostTypeId="1" CreationDate="2015-04-23T02:14:55.413" Score="3" ViewCount="1449" Body="&lt;p&gt;I was always taught that a network address (eg. 192.168.1.0) cannot be the IP address of a host? Is there a reason for this? After all it isn't used anywhere else like a broadcast address. &lt;/p&gt;&#xA;" OwnerUserId="15048" LastEditorUserId="619" LastEditDate="2015-04-23T02:47:42.357" LastActivityDate="2015-07-09T10:10:20.967" Title="Network Address used for hosts?" Tags="|router|ipv4|subnet|internet|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18043" PostTypeId="2" ParentId="18042" CreationDate="2015-04-23T02:53:05.813" Score="2" Body="&lt;p&gt;If you are referring the address containing a zero, there's nothing explicitly prohibiting it. The netmask defines what the &quot;network&quot; (&lt;em&gt;all-zeros&lt;/em&gt;) and &quot;broadcast&quot; (&lt;em&gt;all-ones&lt;/em&gt;) addresses are. And those addresses (which aren't necessarily zero, btw) are, in fact, reserved for other purposes -- that being subnet broadcasts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consult &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/11200/what-is-the-purpose-of-network-address-aka-subnet-address&quot;&gt;THIS&lt;/a&gt; for more on the subject.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-04-23T02:53:05.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18044" PostTypeId="2" ParentId="18042" CreationDate="2015-04-23T03:55:51.047" Score="0" Body="&lt;p&gt;It cannot be assigned to a host if the subnet is /24. In that case 192.168.1.0 will be network address, 192.168.1.255 will be broadcast address, and usable addresses that can be assigned to hosts will be 192.168.1.1 to 192.168.1.254.&lt;/p&gt;&#xA;" OwnerUserId="15049" LastActivityDate="2015-04-23T03:55:51.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18045" PostTypeId="2" ParentId="16812" CreationDate="2015-04-23T04:42:03.687" Score="2" Body="&lt;p&gt;One post I ran across indicated they had to configure each VLAN as a DHCP relay and this resolved the issue:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://community.spiceworks.com/topic/195734-cisco-sge2010p-multi-vlan-dhcp-problem&quot; rel=&quot;nofollow&quot;&gt;Cisco SGE2010p, multi vlan, dhcp problem.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Michael9006 Feb 2, 2012 at 6:40 AM&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;I finally figured it out. I need to set up each VLAN as a DHCP relay.&#xA;  Just an FYI in case anyone else runs into this.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="14230" LastEditorUserId="8499" LastEditDate="2016-03-18T14:15:25.833" LastActivityDate="2016-03-18T14:15:25.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18048" PostTypeId="2" ParentId="18042" CreationDate="2015-04-23T08:07:42.683" Score="4" Body="&lt;p&gt;From RFC 1812:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;   o { &amp;lt;Network-prefix&amp;gt;, 0 } is an obsolete form of a network-prefix-&#xA;      directed broadcast address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As was described in that section, packets addressed to any of these&#xA;   addresses SHOULD be silently discarded, but if they are not, they&#xA;   MUST be treated according to the same rules that apply to packets&#xA;   addressed to the non-obsolete forms of the broadcast addresses&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It gives some historical reason in order to NOT use network address. Another possible reason is that network address will be used internally by routers to build routing tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sparing network and broadcast address could be very useful in point-to-point link (/30) but with IPv6 the question is no longer relevant.&lt;/p&gt;&#xA;" OwnerUserId="14771" LastEditorUserId="3955" LastEditDate="2015-07-09T10:10:20.967" LastActivityDate="2015-07-09T10:10:20.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18050" PostTypeId="1" AcceptedAnswerId="18051" CreationDate="2015-04-23T11:05:34.780" Score="0" ViewCount="1093" Body="&lt;p&gt;Suppose that a server and client simultaneously execute &lt;code&gt;send()&lt;/code&gt; — with my knowledge they're both would send a data, next both start waiting for an Ack message, which &lt;em&gt;nobody would send&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But such a problem never appears, so what happens actually?&lt;/p&gt;&#xA;" OwnerUserId="8681" LastActivityDate="2015-04-24T07:43:31.497" Title="TCP: what happens on simultaneous send of peers?" Tags="|tcp|" AnswerCount="2" CommentCount="11" ClosedDate="2015-04-24T02:15:35.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="18051" PostTypeId="2" ParentId="18050" CreationDate="2015-04-23T11:30:14.030" Score="2" Body="&lt;p&gt;&lt;strong&gt;TCP is bidirectional.&lt;/strong&gt;  There are actually two halves of a pipe created between client and server; think of this as being a full-duplex operation in that both sides of the conversation can send and receive simultaneously.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But before any real communication can take place, the client needs to initiate a connection to the server first with a TCP SYNchronize (flag) packet and the server is expected to respond with a TCP SYN toward the client with a piggybacked ACK, and finally the client ACKs the server TCP SYN.  This is the &lt;strong&gt;TCP SYN-SYN/ACK-ACK 3-way handshake.&lt;/strong&gt;   Packets are then free to flow in either direction until the connection is torn down.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2015-04-24T07:43:31.497" LastActivityDate="2015-04-24T07:43:31.497" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="18054" PostTypeId="1" CreationDate="2015-04-23T14:32:25.500" Score="4" ViewCount="2604" Body="&lt;p&gt;I do not have a spanning tree loop. I work in a manufacturing environment and roaming is prevalent. I don't want to see mac flaps or host flap messages on the wireless ports, I only want them for STP. How do I turn off one and not the other. Cisco, 4506&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="15054" LastActivityDate="2022-05-09T15:41:08.747" Title="How do I stop %C4K_EBM-4-HOSTFLAPPING message for wireless ports, but leave on for STP issues?" Tags="|cisco|wireless|spanning-tree|access-point|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18056" PostTypeId="1" AcceptedAnswerId="18057" CreationDate="2015-04-23T15:48:17.557" Score="2" ViewCount="969" Body="&lt;p&gt;We recently had an issue where one 3750 switch of a stack crashed due to a slow memory leak. The slow memory leak has been resolved but we'd like to be notified of it by SNMP if it happens in the future. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the command to enable system crashes to be reported to SNMP?&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-08-21T19:18:03.130" Title="Enabling SNMP traps for Switch Crashes - 3750 stack" Tags="|cisco|snmp|stacking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18057" PostTypeId="2" ParentId="18056" CreationDate="2015-04-23T17:35:18.873" Score="1" Body="&lt;p&gt;Try this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/40360-SNMPcoldStartTraps.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/40360-SNMPcoldStartTraps.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like you'd need to use &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;snmp-server enable traps snmp cluster&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_52_se/configuration/guide/3750scg/swsnmp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_52_se/configuration/guide/3750scg/swsnmp.html&lt;/a&gt; that should give you notifications for cold start, warm start and cluster change - possible changes in the cluster commander or member availability would let you know that you'd lost a switch prior to the warm-start alert.  Don't know if the &lt;em&gt;whyReboot&lt;/em&gt; object is included in the trap or if you'd need to poll that in response to the trap being sent.&lt;/p&gt;&#xA;" OwnerUserId="14879" LastActivityDate="2015-04-23T17:35:18.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18058" PostTypeId="1" AcceptedAnswerId="18061" CreationDate="2015-04-23T18:44:51.463" Score="2" ViewCount="80" Body="&lt;p&gt;Someone can explain me what relation there is between a LIR and an AS? Can LIR assign AS numbers or only RIR can?&lt;/p&gt;&#xA;" OwnerUserId="15063" LastActivityDate="2015-04-23T19:20:26.987" Title="Relation between LIR and an AS" Tags="|routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18059" PostTypeId="1" CreationDate="2015-04-23T19:14:42.353" Score="1" ViewCount="60" Body="&lt;p&gt;Chinese owned/registered IP addresses are appearing within my US ISP routing infrastructure from a trace route. ISP says they are leasing them from China. Has anyone run into this before? With all of IPv4 taken is this &quot;new&quot; normal practice to use foreign registered IP addresses in the US?&lt;/p&gt;&#xA;" OwnerUserId="15065" LastActivityDate="2015-04-23T19:31:29.877" Title="Are US ISPs and firms using Chinese registered IPv4 numbers on their routing infrastructure in the US?" Tags="|router|ip|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18061" PostTypeId="2" ParentId="18058" CreationDate="2015-04-23T19:20:26.987" Score="4" Body="&lt;p&gt;Unless you're talking about the AS-numbers defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6996&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6696&lt;/a&gt; meant for private use (64512 - 65534), all AS-numbers are assigned by RIRs to their LIRs.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-04-23T19:20:26.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18062" PostTypeId="2" ParentId="18059" CreationDate="2015-04-23T19:31:29.877" Score="2" Body="&lt;p&gt;That's becoming more and more normal. IPv4 blocks are being leased and traded all over the world due to the lack of unassigned IPv4 blocks at most RIRs.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-04-23T19:31:29.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18063" PostTypeId="2" ParentId="17876" CreationDate="2015-04-23T19:42:25.130" Score="2" Body="&lt;p&gt;You don't need a routing protocol, but you do need to add some static routes to make things work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't mention what kind of router is your Internet gateway, but assuming it is a Cisco router, you need to add this command on it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.22.226.0 255.255.255.0 10.22.227.84&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This tells the router to forward traffic to the 1841 router to get to the 10.22.226.0 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, you need to add&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 10.22.227.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on your 1841 router.  This forwards all (non-local) traffic to the Internet gateway.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-04-23T19:42:25.130" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="18066" PostTypeId="2" ParentId="11059" CreationDate="2015-04-23T21:44:38.623" Score="3" Body="&lt;p&gt;Post for reference for others: The only way I know of is to log onto pfe.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;MX80 Example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;start shell pfe network tfeb0&lt;/code&gt;&lt;br/&gt;&#xA;&lt;code&gt;show sfp x&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Amongst Output&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SFP Type:            1000BASE-T Copper SFP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;vs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SFP Type:            Tri Rate Copper SFP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sfp index are populated on insertion order -- &lt;code&gt;show sfp list&lt;/code&gt; to work out your index.&lt;/p&gt;&#xA;" OwnerUserId="15070" LastEditorUserId="619" LastEditDate="2015-04-24T01:42:06.433" LastActivityDate="2015-04-24T01:42:06.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18067" PostTypeId="2" ParentId="18050" CreationDate="2015-04-24T01:59:36.540" Score="2" Body="&lt;p&gt;Why do you say neither side sends an ACK? Each side will ACK any and all data that it receives (in order.) Each side maintains it's own count of data sent and received -- the &lt;em&gt;sequence number&lt;/em&gt;. This problem &quot;never appears&quot; because it doesn't exist; state is maintained for each direction, so it doesn't matter who sends what when.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;strong&gt;A&lt;/strong&gt; and &lt;strong&gt;B&lt;/strong&gt; simultaneously send a packet, say 5 bytes at seq:0, then they will each, &lt;em&gt;independently&lt;/em&gt;, acknowledge the 5 bytes they've received. The connection is a full-duplex, bidirectional flow. What &lt;strong&gt;A&lt;/strong&gt; sends to &lt;strong&gt;B&lt;/strong&gt; has no bearing on what &lt;strong&gt;B&lt;/strong&gt; sends to &lt;strong&gt;A&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-24T01:59:36.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18068" PostTypeId="1" CreationDate="2015-04-24T02:21:29.657" Score="-1" ViewCount="94" Body="&lt;p&gt;&lt;a href=&quot;http://pastebin.com/909gfRRL&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/909gfRRL&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming something is messed up with router As's ospf because I can ping everything except pc-A. Only one PC connected to each router. I'm stuck though, any help is greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="15071" LastEditorUserId="775" LastEditDate="2015-04-26T21:27:04.810" LastActivityDate="2015-04-26T21:27:04.810" Title="Cisco Router config help? (probably OSPF related)" Tags="|cisco|" AnswerCount="1" CommentCount="3" ClosedDate="2015-04-25T03:22:08.960" ContentLicense="CC BY-SA 3.0" />
  <row Id="18069" PostTypeId="2" ParentId="18054" CreationDate="2015-04-24T03:49:18.037" Score="1" Body="&lt;p&gt;(I'm not sure what you mean w.r.t. STP vs. any of the other reasons for macflaps.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There doesn't appear to be any way, &lt;em&gt;at all&lt;/em&gt;, to disable this. Roaming wireless clients are simply going to be an unavoidable reality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming you don't have wireless lan controller(s) tunneling traffic back from each AP to the controller. That would, in theory, isolate clients from the switch(es).&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-24T03:49:18.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18070" PostTypeId="1" AcceptedAnswerId="18080" CreationDate="2015-04-23T20:04:02.803" Score="3" ViewCount="5342" Body="&lt;p&gt;There are one or two answers that come close to answering this question but they either fall short or go in straight at the deeper end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, I am interested (for genuinely academic reasons!) in being able to record the number of active devices (cell phones, basically) in different locations in space/time. I absolutely DO NOT want to know what they are doing, who they are, or anything about the users, I just want to know a) how many phones in a given radius and b) if it helps, some sort of signal strength so I can normalise/measure how many devices are present in each locale.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Is this possible? I am half-decent with Linux, a rasp pi and a bit of Python... (factor that in)&#xA;2) What hardware is needed?&#xA;3) Any links to help me out on this topic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not an infosec person at all, so this is a world I know little about... be kind :)&lt;/p&gt;&#xA;" OwnerUserId="15075" OwnerDisplayName="user1992923" LastActivityDate="2015-05-08T07:59:42.710" Title="Detecting 2G/3G/4G Devices" Tags="|mobile|wireless|" AnswerCount="3" CommentCount="2" ClosedDate="2019-06-21T21:28:15.327" ContentLicense="CC BY-SA 3.0" />
  <row Id="18071" PostTypeId="2" ParentId="18070" CreationDate="2015-04-24T01:05:23.420" Score="2" Body="&lt;p&gt;You kind of want to do a site survey of a cell signals, but focus more on the users and not base stations. Yes, this is possible. There are commercial products which the cell phone companies use. There are also so called &quot;&lt;a href=&quot;http://en.wikipedia.org/wiki/Stingray_phone_tracker&quot; rel=&quot;nofollow&quot;&gt;stingrays&lt;/a&gt;&quot;- This is how you hear about police tracking down cell phones, looking for specific devices. Similar technology could be used to map out the usage in an area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also be able to do this by converting a femtocell device. Some cellphone providers sell these to customers to make up for poor coverage. You can search for articles on building and using off the shelf technology to modify to do your site survey. I also recently saw that the Pwnie Express people are coming out with a &lt;a href=&quot;http://arstechnica.com/information-technology/2015/04/this-machine-catches-stingrays-pwnie-express-demos-cellular-threat-detector/&quot; rel=&quot;nofollow&quot;&gt;product that works in this area&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, keep in mind that this is technically possible, but it may not be legal based on municipality or other regulations. For example, operating unlicensed equipment in the cell spectrum may not be allowed (e.g., FCC regulations in USA). The legal issues are out of scope for SEC.SE&lt;/p&gt;&#xA;" OwnerUserId="15087" OwnerDisplayName="Eric G" LastActivityDate="2015-04-24T01:05:23.420" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18072" PostTypeId="2" ParentId="18068" CreationDate="2015-04-24T07:35:32.143" Score="1" Body="&lt;p&gt;It would help with a topology to better understand your setup and to see routing tables and if all the routers respond to ping from every other router. One of the problems seems to be that Serial0/1/1 is shutdown on Router B which I assume is the interface that connects to Router A. Also you have different subnet masks on the two interfaces which you should not have. Serial0/1/1 on Router B has a /25 and Serial0/0/0 on Router A has a /30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router B advertize the network 4.0.0.0 /8 but I can't see that it has any interface connected to it which seems unnecessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might also help to advertize the link networks connecting Router C and D and Router C and B into OSPF to make sure that Router A knows how to get to the other routers. &lt;/p&gt;&#xA;" OwnerUserId="14973" LastActivityDate="2015-04-24T07:35:32.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18073" PostTypeId="1" AcceptedAnswerId="23950" CreationDate="2015-04-24T07:41:47.907" Score="3" ViewCount="1972" Body="&lt;p&gt;Ethernet 1000BASE-T uses a 4D-PAM5 encoding, with 4 lines each transferring 250 Mb/s, thus total of 1000 Mb/s for 1 Gb/s operation.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The descriptions I have found says that 4 of the states in PAM5 is used to transfer the 2 bits for effectively 125 MHz signalling, and the 5th state in PAM5 is used for Forward Error Correction (FEC), but there is no mentioning of frame recovery, like for example made with the 4B5B encoding in 100BASE-TX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if the 5th state in PAM5 of 1000BASE-T is only used for FEC, then how is framing recovered for signalling on the Gigabit Media-Independent Interface (GMII) from the PHY?&lt;/p&gt;&#xA;" OwnerUserId="5892" LastEditorUserId="8499" LastEditDate="2016-11-29T16:02:48.953" LastActivityDate="2016-11-29T16:02:48.953" Title="How does Ethernet 1000BASE-T recover framing if PAM5 is only used for error correction?" Tags="|ethernet|layer1|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18074" PostTypeId="1" AcceptedAnswerId="18088" CreationDate="2015-04-24T08:30:16.233" Score="2" ViewCount="2887" Body="&lt;p&gt;I have 2 gigabit switch hub both have Green(for 1000 mbps) and Orange(for 100 mbps) indicator lights at each port. the distance between two gigabit switch hub is 100 meters. I use CAT5E outdoor cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first hub switch connected to 4 IP camera(720p) and connect to the second hub switch(which is 100 meters away).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My concern is that the first switch hub will not be able to send data or has too many noise when it send data to the second switch hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I check wether the speed and stability between two switch hub will be enough for sending data of 4 cameras or not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can the light on the switch hub Green or Orange help me check that it will be ok or not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't buy the IP camera yet. I want to check the network first&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have attached the diagram with this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7tLKI.png&quot; alt=&quot;Diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="15074" LastEditorUserId="15074" LastEditDate="2015-04-24T08:55:36.277" LastActivityDate="2015-04-24T16:17:29.753" Title="how to check the speed between 2 switch hub" Tags="|switch|ethernet|lan|speed|cable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18075" PostTypeId="2" ParentId="5236" CreationDate="2015-04-24T08:57:23.920" Score="0" Body="&lt;p&gt;Sure you can do this!&#xA;We use it when we need to renumber a vlan! &#xA;for example&#xA;vlan 1 is in use on a location, but we don't want to use vlan 1 for security-reasons!&#xA;So we configure vlan 10, connect a utp-cable between vlan 10 and vlan 1 (access-ports, no cdp ena (cisco switches))&#xA;then reconfigure all clients from vlan 1 to vlan10, and finaly diable the def gateway ( int vlan 1, no ip addre , int vlan 10, ip address x.x.x.x, no shut) and everything works, and can work during I am doing my switchover. Only 5 seconds downtime to replace the default gateway :) &lt;/p&gt;&#xA;" OwnerUserId="15078" LastActivityDate="2015-04-24T08:57:23.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18076" PostTypeId="1" AcceptedAnswerId="18079" CreationDate="2015-04-24T08:57:29.120" Score="15" ViewCount="3917" Body="&lt;p&gt;I made an app in java where a client sends ip-packets to a server via the looback-address 127.0.0.1. A really simple app just to test how things work. At first I thought If I created several client-sessions new loppback-hosts would be created. But instead new sockets are created that is 127.0.0.1:portnumber. But then is my question, since the loopback seem to have a prefix of 8, under what circumstances are several loopback hosts used, that is 127.0.0.1, 127.0.0.2, .. 127.255.255.255?&lt;/p&gt;&#xA;" OwnerUserId="10681" LastEditorUserId="1537" LastEditDate="2015-04-24T16:36:20.720" LastActivityDate="2015-04-24T16:36:20.720" Title="Under what circumstances are multiple loopback (127/8) addresses useful?" Tags="|ipv4|loopback|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18078" PostTypeId="1" AcceptedAnswerId="18136" CreationDate="2015-04-24T10:12:08.563" Score="8" ViewCount="10220" Body="&lt;p&gt;I have two ipsla operations set up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipsla&#xA; operation 10&#xA;  type icmp echo&#xA;   source address 10.0.0.1&#xA;   destination address 10.0.2&#xA;   frequency 30&#xA; operation 11&#xA;  type udp jitter&#xA;   tos 128&#xA;   source address 10.0.0.3&#xA;   destination address 10.0.0.4&#xA;   destination port 10001&#xA;   frequency 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With operation 11, I can SNMP walk &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=1.3.6.1.4.1.9.9.42.1.5.2.1&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&quot;&gt;1.3.6.1.4.1.9.9.42.1.5.2.1&lt;/a&gt; to get the values that match with &lt;code&gt;sh ipsla stats 11&lt;/code&gt;.  However, I cannot find the MIB to walk to get the values for &lt;code&gt;sh ipsla stats 10&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router is running &lt;strong&gt;Cisco IOS XR Software (Cisco ASR9K Series),  Version 4.2.3[Default]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the MIBs for an IPSLA operation configured to use ICMP echo?&lt;/p&gt;&#xA;" OwnerUserId="15080" OwnerDisplayName="John Oxley" LastEditorUserId="15080" LastEditDate="2015-04-27T14:43:23.113" LastActivityDate="2015-04-27T14:51:25.923" Title="What are the SNMP MIBs for Cisco IPSLA ICMP echo" Tags="|cisco|snmp|icmp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18079" PostTypeId="2" ParentId="18076" CreationDate="2015-04-24T10:50:55.787" Score="17" Body="&lt;p&gt;You can use all loopback addresses from 127.0.0.1 upto 127.255.255.254 however you like. According to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3330&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3330&lt;/a&gt;, they are all &amp;quot;looped back inside the host&amp;quot;. Some operating systems respond to all loopback addresses out of the box, on others you have to explicitly define extra addresses on the loopback interface.&lt;/p&gt;&#xA;&lt;p&gt;For most testing, 127.0.0.1/32 is sufficient, but sometimes multiple IPs can be useful or necessary. Examples include:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Testing a web server with IP based virtual hosts, serving different web sites on different IPs.&lt;/li&gt;&#xA;&lt;li&gt;On some mail systems, mail passes multiple MTAs living on the same system. To clearly distinguish them (eg in the mail headers), they can all be running on different local IP address instead of different TCP ports.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;So multiple addresses can be useful, but the decision to allocate over 16 million of them was clearly taken at a time when nobody worried about an address shortage...&lt;/p&gt;&#xA;&lt;p&gt;Note that IPv6 only has one loopback address (::1/128).&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2015-04-24T11:06:28.217" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18080" PostTypeId="2" ParentId="18070" CreationDate="2015-04-24T11:01:06.723" Score="2" Body="&lt;p&gt;You could use one of many IMSI catchers available out there, but that would be quite costly. If you want a more &quot;DIY&quot; approach, you better use a software defined radio card and write some code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://openbts.org/&quot; rel=&quot;nofollow&quot;&gt;OpenBTS&lt;/a&gt; project develops a software defined GSM base station, and their &lt;a href=&quot;http://openbts.org/hardware/&quot; rel=&quot;nofollow&quot;&gt;hardware page&lt;/a&gt; has some links to compatible SDR devices. Buy one and then go through their code to implement your own software defined IMSI catcher (publish the code if possible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modifying an ISP-provided femtocell device is possible in theory, however you'll need to spend ages on reverse-engineering how to talk to the GSM chip - there is no publicly-available documentation and the only thing you'll have to work with is the binary that handles the femtocell stuff.&lt;/p&gt;&#xA;" OwnerDisplayName="user15081" LastActivityDate="2015-04-24T11:01:06.723" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18082" PostTypeId="1" CreationDate="2015-04-24T12:53:21.507" Score="3" ViewCount="1755" Body="&lt;p&gt;My setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L3 Switch(tagged port) --&gt; Unmanaged Switch --&gt; L2 Switch (tagged port)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I had created VLAN and IP addresses for 2, 3, and 4 in the L3 and L2 switches.&lt;/li&gt;&#xA;&lt;li&gt;Ports connecting the L3 switch to the unmanaged switch and unmanaged switch to the L2 switch are tagged.&lt;/li&gt;&#xA;&lt;li&gt;Connected three machines in 2, 3, and 4 VLANs to ports in the L2 switch.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My question is will the PC in the VLAN 2 network reach the L3 switch? Will the packets dropped or flow in this network setup to their respective VLANs?&lt;/p&gt;&#xA;" OwnerUserId="15083" LastEditorUserId="8499" LastEditDate="2016-03-19T22:46:10.237" LastActivityDate="2016-03-19T22:48:25.923" Title="Will the vlan traffic flow or be dropped" Tags="|switch|vlan|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18084" PostTypeId="1" AcceptedAnswerId="18085" CreationDate="2015-04-24T13:20:46.657" Score="2" ViewCount="16149" Body="&lt;p&gt;I'm learning how to make my own Ethernet cables (to get deep understanding of Cisco for their exams), but the cables I am getting have small wires whose colors I cannot distinguish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A person in my organization who is expert at making Ethernet cables insists he can see the colors as they are. Is this another case of what &lt;a href=&quot;http://www.wired.com/2015/02/science-one-agrees-color-dress/&quot; rel=&quot;nofollow noreferrer&quot;&gt;color is that dress&lt;/a&gt;? Seriously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Really, I am so stumped right now, and I've seen two CAT5 cables like this, where the colors are faded and indistinguishable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I create my own Ethernet cables when I cannot figure out the faded color of these wires? Is it that the cables are too old and the colors get faded over time? Is there another solution. I really wish to create Ethernet cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/xSnRm.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I stripped more of the cabling. What is supposed to be brown/white is plain white, and the rest of the white/color combos are plain faded&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jO3wo.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE II&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the cable it is printed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0100 FEET CAT-5e General Cable L CMP (UL) C(UL) 4PR 24AWG GENSPEED 5000 PLENUIM --- VERIFIED (UL)  CAT-5e--- 03-03 100537J1 CAT-5e&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE III&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are wires from another cable, printed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BERK-TEK HYPER-PLUS 24 AWG CMP C(UL) US ETL VERIFIED TIA0568-C.2 CAT 5E &amp;amp; ISO/IEC 11801 CAT 5 26100016 FT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MF80e.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10276" LastEditorUserId="8499" LastEditDate="2018-03-20T23:04:27.823" LastActivityDate="2018-03-20T23:04:27.823" Title="How to create Ethernet cables when I cannot figure out color of cat 5e cable wires?" Tags="|ethernet|layer1|cabling|cable|utp|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="18085" PostTypeId="2" ParentId="18084" CreationDate="2015-04-24T13:50:30.250" Score="10" Body="&lt;p&gt;The colors are just there as an ease-of-use tool.  What really matters from a functional standpoint is what cable is connected in the jack in what position.  Electrically the colors of the wires make no difference.  It will require care, but you can identify the wires per pair by &quot;ringing&quot; them out with a multi-meter with a continutiy check ( the symbol looks like an arrow pointing at a vertical line or a plus sign ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://learn.sparkfun.com/tutorials/how-to-use-a-multimeter/continuity&quot; rel=&quot;noreferrer&quot;&gt;https://learn.sparkfun.com/tutorials/how-to-use-a-multimeter/continuity&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pick a pair and check with test leads on the meter to match them up (holding both ends of the cable together, put one test lead on one wire and one test lead on the other end, testing each wire in turn until you get a reading).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a little bit more work, but you can identify a each wire this way and place them in the appropriate postion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two issues with my original post addressed pointed out by comments below:  You must keep the pairs in the proper relationship to one another and conforming to wiring standards and good practice.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;@Ron has pointed out this answer was unclear (Thanks!).  It's VITALLY important to keep the pairs together as per standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/btwxI.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason this is so important is because using a pair of wires twisted together to carry a signal utilizes the electrical properties of the wire to improve signal strength, reduce attenuation and destructive interference - it's a great trick to make crosstalk work to our advantage! ( &lt;a href=&quot;http://en.wikipedia.org/wiki/Twisted_pair&quot; rel=&quot;noreferrer&quot;&gt;http://en.wikipedia.org/wiki/Twisted_pair&lt;/a&gt; )  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference between CAT5 and CAT3 is the number of twists per inch ( three vs. five, unsurprisingly ).  CAT3 is not rated for speeds over 10Mbps and as a result is mostly seen as legacy POTS/PBX cable, whereas CAT5 is rated up to 100Mbps ( and years ago replaced CAT3 for pretty much all uses ).  CAT5e has a plastic core that keeps the pairs twisted evenly in the cable related to one another and is rated up to 1000Mbps.  ( @YLearn pointed out this is not the case -- CAT5e and CAT6 do &lt;strong&gt;&lt;em&gt;NOT&lt;/em&gt;&lt;/strong&gt; require a spline, however some manufacturers used this as a strategy in production of cables ) You can see that the same basic electrical wiring sees an order of magnitude performance improvement just based increasing the twist of each pair and another order of magnitude based on the way the pairs are twisted together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another poster ( @Jordan Head ) correctly pointed out that while this is a great learning exercise or as an emergency &lt;strong&gt;&lt;em&gt;short-term&lt;/em&gt;&lt;/strong&gt; production fix, it's very important to follow standards - no one wants to have to troubleshoot random wiring pinouts in the middle of the night when there is an outage.  It's an added difficulty that should be avoided in production environments.&lt;/p&gt;&#xA;" OwnerUserId="14879" LastEditorUserId="14879" LastEditDate="2015-04-24T18:35:11.967" LastActivityDate="2015-04-24T18:35:11.967" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="18086" PostTypeId="2" ParentId="18082" CreationDate="2015-04-24T14:23:43.677" Score="0" Body="&lt;p&gt;802.1q VLAN tagging (&lt;a href=&quot;http://en.wikipedia.org/wiki/IEEE_802.1Q&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/IEEE_802.1Q&lt;/a&gt;) is pretty much standard now.  I don't think that Cisco even has switches supporting ISL encapsulation any longer. As a result, unmanaged switches should transmit tagged frames without any issue - it looks just like a regular ethernet frame. Since you're using an unmanaged switch to basically pass traffic between two managed switches, you may need to disable trunk negotiation between the two switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a Cisco switch, &lt;code&gt;switchport mode trunk&lt;/code&gt;, &lt;code&gt;switchport nonegotiate&lt;/code&gt;, and if you want to manage this, &lt;code&gt;switchport trunk vlan allowed #,#,#,#&lt;/code&gt; to specify exactly which VLANs you want to flow on this link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting both L3 managed and L2 managed switch ports to trunk unconditionally will allow traffic to flow transparently to the managed switches.&lt;/p&gt;&#xA;" OwnerUserId="14879" LastEditorUserId="8499" LastEditDate="2016-03-19T22:48:25.923" LastActivityDate="2016-03-19T22:48:25.923" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18087" PostTypeId="2" ParentId="18084" CreationDate="2015-04-24T14:36:10.373" Score="4" Body="&lt;p&gt;Maybe it is the dress thing, but I can make out the four solid colored wires; orange, green, blue and brown.  As you work with cables from different manufacturers, you will find that not all things are the same.  Some will have colors that look a bit more &quot;faded&quot; or even somewhat &quot;translucent.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From there, you need to identify the white/color wires. While most manufacturers do indeed &quot;stripe&quot; the wire in some way, it is not at all uncommon for them to use just a white wire and it is identified by the solid colored wire to which it is twisted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this particular case, it appeaers there is a white/orange mark as well, so I would presume the the other white wires also have markings.  However, the marks could have significant spacing, so you would probably want to strip back more of the outer jacket to expose more of the internal wires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to whether this is fading or something else, but significant fading typically doesn't occur unless exposed to sunlight, chemicals or some other factor.  It is more likely this is just how it was manufactured, but no one could answer that without knowing the manufacturer, product number and possibly manufacturer date or lot number.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-04-24T14:36:10.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18088" PostTypeId="2" ParentId="18074" CreationDate="2015-04-24T16:17:29.753" Score="2" Body="&lt;p&gt;It's either a hub or a switch.  They're not the same thing: switches use packet switching to determine who the recipient is and forward traffic on to that port only.  Hubs offer poorer performance, to say the least, because they repeat all incoming traffic they receive on one port to all the other ports without checking to see who actually wants the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would strongly encourage you to use switches if what you have now are actually hubs.  What are the model numbers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have already answered your own question about the speed.  Plug in your ethernet run to a device at each end and see what speed each hub/switch auto negotiates to.  The different LED colors are there to quickly check what speed a port is running at without having a computer handy- perfect for your needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly,  have a look at &lt;a href=&quot;http://www.stardot.com/bandwidth-and-storage-calculator&quot; rel=&quot;nofollow&quot;&gt;this IP camera bandwidth calculator.&lt;/a&gt;  It may help you decide if you need 1000 mbps.  You may easily get away with a 100 mbps network if all that's connected are the four cameras.  However, I would again encourage you to use switches instead of hubs.  In my experience, it will alleviate many problems and headaches before they even begin, and the price is essentially the same!&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2015-04-24T16:17:29.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18089" PostTypeId="2" ParentId="18054" CreationDate="2015-04-24T18:18:07.827" Score="6" Body="&lt;p&gt;One thing to consider is the rate of flapping.  Having worked with a wireless environment with no channel plan or power adjustments and automatic adjustments and channel selection disabled, constantly seeing MAC flap notifications is indicative of a problem on the wireless side of your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Working with WAPs that allow you to adjust, either manually or automatically, the Tx power settings on your WAPs, you'll want to overlap your wireless coverage areas per WAP, called a cell, by about 40-60% to start out with and then dial that back until you've got effective coverage while minimizing WAP hopping from stationary clients.  What you want to avoid is the overhead of having stationary clients flapping between WAPs, especially WAPs running in &quot;bridge mode&quot; ( Aruba terminology and the default behavior for Aerohive ), and the overhead of switches relearning port associations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not entirely certain, so take this with a grain of salt, but I think that learning MAC addresses is not an ASIC/forwarding plane operation, so you're using CPU cycles when this takes place.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cell tuning can reduce hopping/flapping, but the roaming clients will remain.  Another way to reduce the impact for network monitoring is to send all of your logging back to a syslog server which will allow you greater control over what you're viewing and how and possibly even discard notifications that you don't want to retain.  Having greater flexibility here will make it easier to differentiate between normal roaming and spanning-tree issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this earlier discussion which might be informative: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/91/mac-flap-due-to-roaming-clients-on-wireless&quot;&gt;Mac-flap due to roaming clients on wireless&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14879" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-04-24T18:18:07.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18090" PostTypeId="1" AcceptedAnswerId="18091" CreationDate="2015-04-24T20:10:31.447" Score="0" ViewCount="496" Body="&lt;p&gt;I am connecting through a router in my home, and tunneling all traffic via openvpn through a remote server. When I first connect with dhcpcd, then start openvpn, my routes look like this (on a linux machine)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ip route&#xA;0.0.0.0/1 via 10.8.0.1 dev tun0 &#xA;default via 192.168.1.1 dev wlp4s0  metric 303 &#xA;10.8.0.1 dev tun0  proto kernel  scope link  src 10.8.0.2 &#xA;&amp;lt;my.vpn.server's.ip&amp;gt; via 192.168.1.1 dev wlp4s0 &#xA;128.0.0.0/1 via 10.8.0.1 dev tun0&#xA;192.168.1.0/24 dev wlp4s0  proto kernel  scope link  src    192.168.1.114  metric 303 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;however, if I then restart the dhcpcd service, the routes look like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ip route&#xA;0.0.0.0/1 via 10.8.0.1 dev tun0 &#xA;default via 192.168.1.1 dev wlp4s0  metric 303 &#xA;10.8.0.1 dev tun0  proto kernel  scope link  src 10.8.0.2 &#xA;128.0.0.0/1 via 10.8.0.1 dev tun0 &#xA;192.168.1.0/24 dev wlp4s0  proto kernel  scope link  src 192.168.1.114  metric 303 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the difference being that this line is no longer present&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;my.vpn.server's.ip&amp;gt; via 192.168.1.1 dev wlp4s0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the result of which is that I can no longer access the internet. What is the significance of that line, and why would restarting dhcpcd remove it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;note that my openvpn client config contains&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        remote &amp;lt;my.vpn.server's.hostname&amp;gt;&#xA;        dev tun0&#xA;        ifconfig 10.8.0.2 10.8.0.1&#xA;        secret /root/static.key&#xA;        mtu-test&#xA;        redirect-gateway def1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15094" LastActivityDate="2015-04-25T07:39:18.037" Title="Why does starting openvpn client, then dhcpcd give different routing table than the reverse order?" Tags="|vpn|dhcp|" AnswerCount="2" CommentCount="0" ClosedDate="2015-04-28T11:21:15.180" ContentLicense="CC BY-SA 3.0" />
  <row Id="18091" PostTypeId="2" ParentId="18090" CreationDate="2015-04-24T22:21:30.727" Score="3" Body="&lt;p&gt;The clue is with the routes in your routing table after you start the VPN tunnel and before you restart dhcpd:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ip route&#xA;0.0.0.0/1 via 10.8.0.1 dev tun0 &#xA;default via 192.168.1.1 dev wlp4s0  metric 303 &#xA;10.8.0.1 dev tun0  proto kernel  scope link  src 10.8.0.2 &#xA;&amp;lt;my.vpn.server's.ip&amp;gt; via 192.168.1.1 dev wlp4s0 &#xA;128.0.0.0/1 via 10.8.0.1 dev tun0&#xA;192.168.1.0/24 dev wlp4s0  proto kernel  scope link  src    192.168.1.114  metric 303 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You have two default routes. Firstly you will presumably be receiving one via DHCP from your home router, this one: &lt;code&gt;default via 192.168.1.1 dev wlp4s0  metric 303&lt;/code&gt;. That allows you to access the  Internet without the VPN (otherwise how will your Linux machine know which path to take to connect to the far end of your VPN tunnel).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also have a 2nd default route which is presumably being installed by openvpn when you establish the VPN tunnel, this one: &lt;code&gt;0.0.0.0/1 via 10.8.0.1 dev tun0&lt;/code&gt; (technically speaking that isn't quite a default route, it should be 0.0.0.0/0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the &lt;code&gt;default via 192...&lt;/code&gt; route has a metric of 303 so it will be less preferred than the default route via the tunnel. This causes a problem though:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The preferred default route results in all traffic being forced to be sent via 10.0.8.1 which is connected to interface tun0&lt;/li&gt;&#xA;&lt;li&gt;tun0 is a logical interface not a physical interface, that connects to your remote VPN peer&lt;/li&gt;&#xA;&lt;li&gt;To reach your remote VPN peer (10.18.0.1) you need to make a connection outside of your local subnet (192.168.1.0/24 on dev wlp4s0)&lt;/li&gt;&#xA;&lt;li&gt;Without a more specific route to your remote peer you will use the default route with the lowest metric which is the route &lt;code&gt;0.0.0.0/1...&lt;/code&gt; so you will go back to step 1 in an infinite loop&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It seems your openvpn clients also inserts the following route: &lt;code&gt;&amp;lt;my.vpn.server's.ip&amp;gt; via 192.168.1.1 dev wlp4s0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now all traffic is routed via the default route which points to the vpn tunnel, a second look up is then performed to see that the far end of the VPN &lt;code&gt;&amp;lt;my.vpn.server's.ip&amp;gt;&lt;/code&gt; is reachable by 192.168.1.1 which is presumably your router. Traffic (in theory) should be sent into tun0 which will then be encrypted and sent towards the router to reach the VPN far end. That is all fine and well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we have set the scene, without seeing your dhcpd and router config I would hazard a guess and say that dhcpd flushes your routing table so that important extra route installed by openvpn is cleared out and you go to a state of infinite recursion I described with the numbered steps 1 to 4 above.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2015-04-24T22:21:30.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18092" PostTypeId="1" CreationDate="2015-04-24T22:56:30.213" Score="1" ViewCount="301" Body="&lt;p&gt;We have an issue where the IP phones are getting DHCP IP's from the Data VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data - VLAN 10&lt;br&gt;&#xA;VoIP - VLAN 15&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As of right now, we are just working on one port before deploying a solution to the entire network. This is what we had originall:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface ethernet 3/g46&#xA;switchport mode general&#xA;switchport general pvid 10&#xA;switchport general allowed vlan add 10&#xA;switchport general allowed vlan add 15 tagged&#xA;switchport general allowed vlan remove 1&#xA;exit&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've changed it to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;console#show running-config interface ethernet 3/g46&#xA;switchport mode general&#xA;switchport general allowed vlan add 10&#xA;switchport general allowed vlan remove 1&#xA;voice vlan 15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Help is greatly appreciated. I am much more used to HP style configuration where you work with VLANs, not interfaces...&lt;/p&gt;&#xA;" OwnerUserId="15097" LastEditorUserId="13361" LastEditDate="2015-04-25T07:33:36.833" LastActivityDate="2015-11-21T10:09:54.967" Title="Dell PowerConnect 6224P VoIP" Tags="|switch|dhcp|dell|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18093" PostTypeId="1" AcceptedAnswerId="18095" CreationDate="2015-04-24T23:24:03.747" Score="2" ViewCount="440" Body="&lt;p&gt;I am curious as to what technologies are employed to accomplish this with vendors that provide this service. What kind of LAN subnet restrictions can be imposed so that 2 hosts on the same internal subnet do not communicate with each other? Is there something going on at the layer 2 level? &lt;/p&gt;&#xA;" OwnerUserId="15098" LastActivityDate="2015-04-25T03:54:00.490" Title="How to sandbox internal IPs on the same subnet with one to one NAT" Tags="|routing|nat|subnet|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18095" PostTypeId="2" ParentId="18093" CreationDate="2015-04-25T02:54:49.437" Score="3" Body="&lt;p&gt;There are many ways to restrict Layer 2 traffic between hosts.  VLAN ACLs (VACLs) is one method.  Private VLANs (PVLANs) is another and I'll leave that for others to provide examples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN ACLs can be use in L2 to filter bridged traffic between hosts or to filter L3 traffic routed into or out of the VLAN based on standard/extended IP/MAC ACLs and VLAN access maps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L3 filter of rfc1518 addresses example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;ip access-list extended rfc1518 ! define common rfc1518 networks&#xA; permit ip 10.0.0.0 0.255.255.255 any&#xA; permit ip 172.16.0.0 0.15.255.255 any&#xA; permit ip 192.168.0.0 0.0.255.255 any&#xA;vlan access-map vacl-allow-rfc1518 ! define vlan access match/action&#xA; match ip address rfc1518&#xA; action forward ! forward rfc1518 addresses&#xA;vlan filter vacl-den-rfc1518 vlan-list 10 ! apply to vlan 10&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;L2 filter of two MAC hosts example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;mac host mac1 0000.1111.2222&#xA;mac host mac2 3333.4444.5555&#xA;mac access-list extended good-bad-macs ! the good, the bad, and the ugly&#xA; deny host mac1 host mac2 ! mac1-to-mac2 (ugly)&#xA; deny host mac2 host mac1 ! mac2-to-mac1 (bad)&#xA; permit any any ! all other macs (good)&#xA;vlan access-map mac-talkers&#xA; match mac address good-bad-macs ! let mac acl define who's allowed to talk&#xA; action forward&#xA;vlan filter mac-talkers vlan-list 10&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Implicit drop action at end of &lt;code&gt;vlan access-map&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2015-04-25T03:54:00.490" LastActivityDate="2015-04-25T03:54:00.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18096" PostTypeId="2" ParentId="18092" CreationDate="2015-04-25T04:04:48.647" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.dell.com/downloads/global/products/pwcnt/en/pwcnt_voice_vlan_support.pdf&quot; rel=&quot;nofollow&quot;&gt;VOICE VLAN SUPPORT IN THE DELL™ POWERCONNECT™ 6200&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consult the list of requirements (11 of them) on page 3. Specifically, &lt;code&gt;voice vlan&lt;/code&gt; has to be enabled on the switch, and LLDP-MED has to be enabled (as that's what tells the phone what to use.) &lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-25T04:04:48.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18098" PostTypeId="2" ParentId="17078" CreationDate="2015-04-25T05:59:37.670" Score="2" Body="&lt;p&gt;Sorry I don't have a system actually in front of me to get you actual output, but look for &quot;show qos interface ...&quot; and that should have the configured hardware values for all the QoS parameters.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CLI is going to be &lt;em&gt;something&lt;/em&gt; like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show qos interface gigE 0/0/0/0.101 ingress&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(it might actually be &quot;input&quot; or &quot;output&quot; instead of &quot;ingress&quot; or &quot;egress&quot; but with a little question-mark magic you'll be able to find it.   You'll have a whole bunch of output that shows you all the policer rates, actions, and token bucket depths.  It's actually a very useful little command.   ;-)&lt;/p&gt;&#xA;" OwnerUserId="13955" LastActivityDate="2015-04-25T05:59:37.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18099" PostTypeId="2" ParentId="10515" CreationDate="2015-04-25T06:02:33.930" Score="2" Body="&lt;p&gt;This is correct: the pseudowire switching path does NOT do mac learning, so there's no way to populate that information.  One possible workaround is to build a VFI that only has two ports.  You will effectively end up with the same behavior (frames will just get bridged from one side to the other) but since you've now enabled the mac learning part, the system will store the MAC addresses learned from each side.  One word of caution here: make sure you have enough resources on the system to learn all the MAC addresses.  Most pseudowires don't actually have all that many MAC addresses, but some can/do.&lt;/p&gt;&#xA;" OwnerUserId="13955" LastActivityDate="2015-04-25T06:02:33.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18100" PostTypeId="2" ParentId="17935" CreationDate="2015-04-25T06:07:26.077" Score="5" Body="&lt;p&gt;The NCS6k is designed to operate as both a stand-alone chassis, as well as connect to a separate chassis that holds only switch fabric cards.  As a standalone system, the switch fabric still interconnects all the linecards, but the fabric cards are on the &quot;back&quot; of the chassis and have only internal-facing interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a multi-chassis system you have a set of &quot;linecard chassis&quot; that all interconnect through a different set of fabric cards to the &quot;fabric chassis&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, the fabric chassis allows you to build an even larger system than you could with a single chassis of 8 linecards.  &lt;/p&gt;&#xA;" OwnerUserId="13955" LastActivityDate="2015-04-25T06:07:26.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18102" PostTypeId="2" ParentId="18090" CreationDate="2015-04-25T07:39:18.037" Score="1" Body="&lt;p&gt;Your VPN host route is destroyed every time dhcp resets the interface. I.e. when 192.168.1.114 (your dhcp assigned address) is removed, all routes to 192.168.1.0/24 will be cleared.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either your dhcp setup needs to be taught to deal with this (add the route back), or your VPN needs to be reset anytime the interface resets.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-25T07:39:18.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18104" PostTypeId="1" AcceptedAnswerId="18111" CreationDate="2015-04-25T13:45:14.713" Score="1" ViewCount="6857" Body="&lt;p&gt;Alright, so I have a 2811 router in Packet Tracer 6.1,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I equipped it with what I thought were FastEthernet ports, even though it shows up when I'm cabling them as 'FastEthernetx/x'. &lt;code&gt;**(The equipment being HWIC-4ESW)**&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to set an IPv4 address to said port all I see is something about VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router I have needs 6 FastEthernet ports that can have IPv4 addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is rather frustrating because they only have around 2 default FastEthernet ports for use... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network is currently under a star-topology, so there will be no problems connecting to destination if a link goes down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to use this method to see if it does anything but I have no idea what I am doing: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int vlan 1&#xA;ip address 192.168.1.0 255.255.255.0&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am assuming that has done something as when I checked the port status the IP was there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could place a switch in the fray and connect everything to a switch but that reduces reliability if the switch goes down then the whole network will not be able to connect to anything as the star topology will no longer be there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions? &lt;/p&gt;&#xA;" OwnerUserId="15099" LastActivityDate="2015-04-25T22:07:24.380" Title="Router unable to assign IP addresses to ports" Tags="|routing|ipv4|packet-tracer|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18106" PostTypeId="2" ParentId="18104" CreationDate="2015-04-25T16:03:00.383" Score="3" Body="&lt;p&gt;You've assigned the network address (where all the bits not masked are zero) which is not allowed.  For your subnet, the interface address can be anything OTHER than zero (the last 8 bits are all zero) or 255 (the last 8 bits are all ones).  The most common convention is to have the router be the lowest numbered address of the IP block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int vlan 1&#xA;ip address 192.168.1.1 255.255.255.0&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13955" LastActivityDate="2015-04-25T16:03:00.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18107" PostTypeId="1" AcceptedAnswerId="19228" CreationDate="2015-04-25T17:15:21.340" Score="2" ViewCount="3032" Body="&lt;p&gt;So I was just reading about hole punch techniques for UDP and TCP. I read that TCP hole punch can easily be accomplished if a UDP connection has already been established. So here is my theoretical setup. I have two clients A and B both behind a NAT. They do not have a server to help them with the hole punch. Both have dynamic dns set up so that the other client can be hard coded to point to the others external address, also both are hard coded to use the same internal port, which we will say for example is 22321. Now these clients know that if they are both started and not connected that they want to connect so once every minute on the minute they send a UDP datagram to the other client to every single port, starting with the highest ports since my guess is a NAT will be inclined to use ports above 49152 as those are the dynamic ports. After each has done this there will be a record entered into the NATs state. If the clients are lucky then one of the two clients will hit the others external port after it has been opened by the NAT, and the datagram will get through and the listening client could then notify the sending client of the successful connection. If they were not so lucky then the clients just need to repeat the process, this time each starting from opposite ends to cut the time in half, when one gets through to the other then the receiver notifies the sender that the connection has been established. Could this methodology work? Or perhaps even be simplified by tracking the RST responses from the NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have clients A and B which are behind a NAT and want to communicate.  both clients are listening on UDP port 22321 and both clients know the others global IP address, we will say that A has an ip address of 1.1.1.1 and B has a global ip address of 2.2.2.2.  So A sends a packet to 2.2.2.2 on every single port, the contents of which need be basically nothing, for every single packet that passes through the NAT the NAT will change the outgoing IP from A's local address i.e. 192.168.1.16 to the global address 1.1.1.1. As the NAT forwards this packet to client B it creates a state entry for each of those packets so that if a packet is recieved from 2.2.2.2 on any of those ports it will know to forward it to client A (192.168.1.16) on port 22321. All of those packets would reach B's NAT at 2.2.2.2 and be discarded as unsolicited packets. Client B does the exact same process targeting client A's global ip address 1.1.1.1 when it hits a port on the NAT that client A has sent a packet out of to client B's NAT (basically any of them at this point) it will forward the packet on to client A. and Client A would be able then respond using that connection from then on out.  Now the problem with this is negotiating who goes first and then when the second client should start, so instead they both just start at the exact beginning of a minute and quite likely the first attempt will fail to yield a connection but if they both then immediately repeat the process then there should be 1 or likely even many successful connections, each client could then just discard all but the first connection that succeeded.&lt;/p&gt;&#xA;" OwnerUserId="15106" LastEditorUserId="15106" LastEditDate="2015-06-17T16:40:51.200" LastActivityDate="2015-06-24T03:20:24.737" Title="Is a brute force UDP hole punch possible if both external IPs, and both internal ports are known to each client?" Tags="|nat|security|ip|udp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18108" PostTypeId="1" AcceptedAnswerId="25817" CreationDate="2015-04-25T17:28:59.497" Score="1" ViewCount="8377" Body="&lt;p&gt;The problem is the ikeV2 authentication with the ASA as initiator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the following experimets I set on the ASA the followings PSKs: &lt;code&gt;local: 123, remote: 321&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In case the &lt;strong&gt;ASA is the initiator&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now several combinations in &lt;code&gt;ipsec.secrets&lt;/code&gt; on the StrongSwan side:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;left 123 right 321&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA:Auth exchange failed&#xA;&#xA;SWAN: tried 1 shared key for '%any' - 'XXX', but MAC mismatched&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;left 123 right 123&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA:Failed to authenticate the IKE SA&#xA;&#xA;charon: 11[IKE] authentication of 'a with pre-shared key successful&#xA;charon: 11[IKE] authentication of 'b' (myself) with pre-shared key&#xA;charon: 11[IKE] IKE_SA x[1] established between b[b]...a[a]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;left 321 right 123&lt;/em&gt;&lt;/strong&gt; (should be the working one)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA:Failed to authenticate the IKE SA&#xA;&#xA;charon: 08[IKE] authentication of 'a' with pre-shared key successful&#xA;charon: 08[IKE] authentication of 'b' (myself) with pre-shared key&#xA;charon: 08[IKE] x[1] established between b[b]...a[a]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;left 321 right 321&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA: Auth exchange failed&#xA;&#xA;SWAN: ... but MAC mismatched&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;If I set the two PSKs the same on each side then everything works.&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW what is the point anyway with IKEv2 having two different PSKs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oh, and ASA debugs show the following when it cannot connect:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;REAL Decrypted packet:Data: 8 bytes&#xA;IKEv2-PROTO-5: Parse Notify Payload: AUTHENTICATION_FAILED NOTIFY(AUTHENTICATION_FAILED)  Next payload: NONE, reserved: 0x0, length: 8&#xA;    Security protocol id: Unknown - 0, spi size: 0, type: AUTHENTICATION_FAILED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now with &lt;strong&gt;StrongSwan being the initiator&lt;/strong&gt;: (ASA still &lt;code&gt;local: 123, remote: 321&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;left 123 right 321&lt;/em&gt;&lt;/strong&gt; !!!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SWAN ok&#xA;&#xA;ASA ok&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;left 123 right 123&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SWAN: received AUTHENTICATION_FAILED notify error&#xA;&#xA;ASA: Failed to authenticate the IKE SA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;left 321 right 123&lt;/em&gt;&lt;/strong&gt;  (should be the working one) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SWAN: received AUTHENTICATION_FAILED notify error&#xA;&#xA;ASA: Failed to authenticate the IKE SA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;left 321 right 321&lt;/em&gt;&lt;/strong&gt; !!!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SWAN ok&#xA;&#xA;ASA ok&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here's the &lt;strong&gt;strongswan conf&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# cat /var/lib/strongswan/ipsec.conf.inc&#xA;&#xA;conn TEST&#xA; left=l&#xA; leftsubnet=n/24&#xA; leftid=l&#xA; leftfirewall=yes&#xA; right=r&#xA; rightsubnet=n/24&#xA; rightid=r&#xA; auto=add # or start&#xA; ike=aes256-sha512-modp1024&#xA; esp=aes256-sha1&#xA; keyexchange=ikev2&#xA;        authby=secret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the &lt;strong&gt;ASA conf&lt;/strong&gt;, standard stuff&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tunnel-group x type ipsec-l2l&#xA;tunnel-group x general-attributes&#xA; default-group-policy VPN_x_GP&#xA;tunnel-group x ipsec-attributes&#xA; ikev2 remote-authentication pre-shared-key 321&#xA; ikev2 local-authentication pre-shared-key 123&#xA;group-policy VPN_x_GP internal&#xA;group-policy VPN_x_GP attributes&#xA; vpn-filter value ACL_VPN_x&#xA; vpn-tunnel-protocol ikev2&#xA;crypto ipsec ikev2 ipsec-proposal IKEv2-ESP-AES256-SHA1&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1&#xA;crypto map internet_crypto_map 1 match address internet_cryptomap&#xA;crypto map internet_crypto_map 1 set pfs&#xA;crypto map internet_crypto_map 1 set peer x&#xA;crypto map internet_crypto_map 1 set ikev2 ipsec-proposal IKEv2-ESP-AES256-SHA1&#xA;crypto map internet_crypto_map interface outside&#xA;crypto ikev2 policy 999&#xA; encryption aes-256&#xA; integrity sha512&#xA; group 2&#xA; prf sha512&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 1000&#xA; encryption aes-256&#xA; integrity sha&#xA; group 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;ipsec.secrets&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;left : PSK &quot;321&quot;&#xA;right : PSK &quot;123&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although I currently suspect that is not entirely correct, I believe it would be for ikev1 but I don't find much documentation for ikev2 (multiple PSKs). For now, I'll investigate in that direction.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="2329" LastEditDate="2015-04-25T22:39:45.057" LastActivityDate="2016-01-10T16:10:37.130" Title="IPSec Site-to-site VPN between Cisco ASA 9.0 and StrongSwan 4.4" Tags="|cisco-asa|vpn|ipsec|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18109" PostTypeId="1" AcceptedAnswerId="18114" CreationDate="2015-04-25T18:18:06.247" Score="1" ViewCount="189" Body="&lt;p&gt;I have used the EIGRP protocol to connect the relevant networks but it will refuse to acknowledge the presence of the other network I shall write the map out with the relevant addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Main Router - Switch 1 - Slave Router -(Connected to 4 Switches) - PC's&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The IP addresses for these are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Slave Router contains 4 VLANS I shall post their IPs too:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Main Router: 172.16.1.41 255.255.255.252&#xA;Slave Router: 172.16.0.245 255.255.255.252&#xA;S.R VLAN1: 172.16.0.161/28&#xA;S.R VLAN2: 172.16.0.65/28&#xA;S.R VLAN3: 172.16.0.97/28&#xA;S.R VLAN4: 172.16.0.201/29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The VLAN connections are then connected to PC's but their IPs should be assumed so I will not post anything about the PCs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have managed to get the Slave network connecting too and from each other but when I try and ping the slave router to the main router there is no signal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to use EIGRP protocol on both networks.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eigrp 1&#xA;network 172.16.0.0&#xA;network 172.16.1.0&#xA;no auto-summary&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The commands used on both routers and still no connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions would be helpful as in my mind they should have recognised each other and therefore be able to ping from one end to the other.&lt;/p&gt;&#xA;" OwnerUserId="15099" LastActivityDate="2015-04-26T21:50:51.550" Title="EIGRP protocol not connecting networks together" Tags="|cisco|ipv4|eigrp|packet-tracer|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18110" PostTypeId="2" ParentId="17992" CreationDate="2015-04-25T18:58:18.747" Score="2" Body="&lt;p&gt;In a secure posture your firewall is going to be default deny anyway, whether you use IPv4 or IPv6. Thus inbound traffic will be blocked unless explicitly allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference between IPv4/NAT and IPv6 is that, with the former, you would set up DNAT/SNAT rules (port forwards), while in IPv6 you simply create firewall rules to allow the desired traffic to pass.&lt;/p&gt;&#xA;" OwnerUserId="645" LastActivityDate="2015-04-25T18:58:18.747" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18111" PostTypeId="2" ParentId="18104" CreationDate="2015-04-25T22:07:24.380" Score="2" Body="&lt;p&gt;The two onboard ports of the 2911 are routed ports so assigning them an IPv4 address is perfectly possible. The HWIC ports are layer 2 ports so you will not be able to assign them an IP address. They are not routed interfaces. What you would need to do is to assign the port (or ports) to a VLAN and then create a VLAN interface in which you will be able to assign an IP address. &lt;/p&gt;&#xA;" OwnerUserId="15108" LastActivityDate="2015-04-25T22:07:24.380" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18114" PostTypeId="2" ParentId="18109" CreationDate="2015-04-26T09:35:49.927" Score="3" Body="&lt;p&gt;Main Router: 172.16.1.41 255.255.255.252&#xA;Slave Router: 172.16.0.245 255.255.255.252&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basing from the ip addresses used. you will not be able to connect the 2 routers with the switch. The routers will need to be in the same LAN. I mean there should be a common lan between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Main Router: 172.16.1.41&#xA;Slave Router: 172.16.1.42&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And before you enable EIGRP make sure you ping connectivity for both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If in case the switch in between is layer 3. Then you might be able to connect them because then can enable the routing capability of the switch in between.&lt;/p&gt;&#xA;" OwnerUserId="15114" LastActivityDate="2015-04-26T09:35:49.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18115" PostTypeId="1" CreationDate="2015-04-26T16:04:15.543" Score="1" ViewCount="3481" Body="&lt;p&gt;There are both routing table and forwarding table inside a router. The question is that how do these two tables connect with each other(if they do) and how does the router functions in respect to these two table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a lot of things going inside a router as it directs the flow of packets throughout the network with the help of routing table, forwarding table, VC(Virtual Circuit) table and longest prefix matching. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am interested in knowing how all things stay in sync with each other and work efficiently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A granular view of the situation will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="15118" LastEditorUserId="15118" LastEditDate="2015-04-27T18:43:25.037" LastActivityDate="2015-04-27T18:43:25.037" Title="Router table and forwarding table" Tags="|routing|router|" AnswerCount="1" CommentCount="1" ClosedDate="2015-04-27T12:03:49.713" ContentLicense="CC BY-SA 3.0" />
  <row Id="18116" PostTypeId="2" ParentId="18115" CreationDate="2015-04-26T17:23:53.380" Score="7" Body="&lt;p&gt;In essence, &lt;strong&gt;RIB&lt;/strong&gt; (Routing Information Base) is being built by various routing processes on the node, with information from routing protocols - like OSPF, IS-IS, BGP or even the static entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After out of all routes in &lt;strong&gt;RIB&lt;/strong&gt; the best ones are selected, they are copied to &lt;strong&gt;FIB&lt;/strong&gt; (Forwarding Information Base). The exact means vary from platform to platform. In general, it's either done by some IPC communication, internal network, or simply (in monolitic software solutions) as a copy (data or pointers) between tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, RIB contains all the routes node is willing to keep and the information there is being used by the routing protocols. FIB is used by hardware to physically move the packets in and out of interfaces. Hardware can keep forwarding based on the FIB contents, while RIB is being updated/etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look here for starters: &lt;a href=&quot;http://blog.ipspace.net/2010/09/ribs-and-fibs.html&quot;&gt;http://blog.ipspace.net/2010/09/ribs-and-fibs.html&lt;/a&gt; and then - for example - dig deeper into &lt;a href=&quot;http://networkstatic.net/juniper-and-cisco-comparisons-of-rib-lib-fib-and-lfib-tables/&quot;&gt;http://networkstatic.net/juniper-and-cisco-comparisons-of-rib-lib-fib-and-lfib-tables/&lt;/a&gt; for more detailed RIB/FIB/LFIB illustration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, '&lt;code&gt;A granular view of the situation is required.&lt;/code&gt;' sounds a little rude. It's community portal, if you &lt;code&gt;require&lt;/code&gt; something maybe you should look for commercial ways of gaining this knowledge.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2015-04-26T17:23:53.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18118" PostTypeId="2" ParentId="18078" CreationDate="2015-04-26T18:41:51.163" Score="0" Body="&lt;p&gt;I bet you have no results because your ipsla operation 10 is malformed. You should change destination address from &lt;code&gt;10.0.02&lt;/code&gt; to &lt;code&gt;10.0.0.2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this is why you cannot get stats from operation 10. &lt;/p&gt;&#xA;" OwnerUserId="8284" LastActivityDate="2015-04-26T18:41:51.163" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18122" PostTypeId="2" ParentId="16655" CreationDate="2015-04-26T19:35:03.360" Score="1" Body="&lt;p&gt;You can use something like &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Queues_-_PCQ_Examples&quot; rel=&quot;nofollow&quot;&gt;PCQ&lt;/a&gt; to assign traffic limits.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2015-04-26T19:35:03.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18124" PostTypeId="1" AcceptedAnswerId="18128" CreationDate="2015-04-26T19:54:15.450" Score="2" ViewCount="905" Body="&lt;p&gt;I understand OSPF uses five different packet types. These are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Hello&lt;/li&gt;&#xA;&lt;li&gt;DB descriptor&lt;/li&gt;&#xA;&lt;li&gt;Link state request&lt;/li&gt;&#xA;&lt;li&gt;Link state update&lt;/li&gt;&#xA;&lt;li&gt;Link state acknowledgement&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However, I'm confused which of these can are used to exchange LSA information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please explain it to me or point me to some reading?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Zan&lt;/p&gt;&#xA;" OwnerUserId="15121" LastEditorUserId="189" LastEditDate="2015-04-29T20:50:52.443" LastActivityDate="2015-04-29T20:50:52.443" Title="OSPF packet type and LSA" Tags="|ospf|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18126" PostTypeId="2" ParentId="18109" CreationDate="2015-04-26T21:50:51.550" Score="0" Body="&lt;p&gt;The main router interface and the slave router interface need to be on the same subnet or an EIGRP adjacency will not form :)&#xA;Put the interfaces between main and slave in the same subnet and you should be cooking.&lt;/p&gt;&#xA;" OwnerUserId="15124" LastActivityDate="2015-04-26T21:50:51.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18127" PostTypeId="2" ParentId="483" CreationDate="2015-04-26T21:59:40.030" Score="0" Body="&lt;p&gt;Just came across your question.&#xA;Network command actually takes precedence over Redistribution.&#xA;The reason why the static route appears to be an External EIGRP route is that in EIGRP, Network command can only advertise Static route that is pointing to EXIT Interface! Static route that is point to Next_Hop_Address would never be advertised via Network command.&#xA;Redistribution, however, doesn't have such restriction.&lt;/p&gt;&#xA;" OwnerUserId="15125" LastActivityDate="2015-04-26T21:59:40.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18128" PostTypeId="2" ParentId="18124" CreationDate="2015-04-26T22:27:41.043" Score="2" Body="&lt;p&gt;In the OSPF 'Ex Start' state, the master begins the Database Description (DBD) packets exchange. Following this, through the 'Loading' state, Link State Requests (LSR) and Link State Updates (LSU) are exchanged to get more information on the routes in the DBD.&#xA;The DBD contains abbreviated list of the sending routers Link State Database (LSDB) and is used by the receiving router to check against its own LSDB. Receiving routers can request more information about any entry in the DBD by sending a LSR, for example for new entries or entries with a higher sequence number. The LSU's are used to reply to LSR's.&#xA;Link State Ack's are used to confirm receipt of LSUs.&#xA;- Source: From my own CCNA study, thanks for the revision practice!&#xA;(Maybe try &lt;a href=&quot;https://learningnetwork.cisco.com&quot; rel=&quot;nofollow&quot;&gt;Cisco Learning Network&lt;/a&gt; for more formal explanations.)&lt;/p&gt;&#xA;" OwnerUserId="15124" LastEditorUserId="13520" LastEditDate="2015-04-27T06:06:27.827" LastActivityDate="2015-04-27T06:06:27.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18129" PostTypeId="1" AcceptedAnswerId="18224" CreationDate="2015-04-27T06:07:32.883" Score="1" ViewCount="374" Body="&lt;p&gt;Barring things like &lt;code&gt;sh run | s eigrp&lt;/code&gt; - are there any show commands which will display the configured active timer value for a given eigrp process?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="33" LastEditDate="2015-04-30T23:18:22.180" LastActivityDate="2015-05-01T03:03:06.623" Title="EIGRP active timer" Tags="|cisco|cisco-ios|eigrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18133" PostTypeId="2" ParentId="7684" CreationDate="2015-04-27T11:38:02.153" Score="6" Body="&lt;p&gt;The ME3600s don't support the forwarding of STP or MST frames through EVC. Port based PWE3s will transport STP frames but you will have to chew up a lot of ports. Really you should be engaging your vendor to platform specific questions like this that are &quot;Will the switch support X feature&quot; or &quot;Does your switch forward X traffic&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest also habinga look at a feature backup pseudowires. That removes the loops at layer 2 at least although doesn't address your problem of no support for STP when using EVCs: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/fspseudo.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/fspseudo.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It maybe also be that VPLS is a better way to go if it is a small number of peers and traffic. The ME3600s do support VPLS (I suggest runnnig 15.3(3)S3 at the time of writting).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I wrote this the command is now present to forward L2 PDUs in the EVC however I haven't tested this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ME3600-1(config-if-srv)#l2protocol tunnel ?&#xA;  R4     Reserved Protocol using DA Mac 0180.C200.0004&#xA;  R5     Reserved Protocol using DA Mac 0180.C200.0005&#xA;  R6     Reserved Protocol using DA Mac 0180.C200.0006&#xA;  R8     Reserved Protocol using DA Mac 0180.C200.0008&#xA;  R9     Reserved Protocol using DA Mac 0180.C200.0009&#xA;  RA     Reserved Protocol using DA Mac 0180.C200.000A&#xA;  RB     Reserved Protocol using DA Mac 0180.C200.000B&#xA;  RC     Reserved Protocol using DA Mac 0180.C200.000C&#xA;  RD     Reserved Protocol using DA Mac 0180.C200.000D&#xA;  RF     Reserved Protocol using DA Mac 0180.C200.000F&#xA;  cdp    Cisco Discovery Protocol&#xA;  dtp    Dynamic Trunking Protocol&#xA;  elmi   ELMI Protocol&#xA;  esmc   ESMC Protocol&#xA;  lacp   LACP Protocol&#xA;  lldp   Link Layer Discovery Protocol&#xA;  loam   Link OAM Protocol&#xA;  pagp   Port Aggregation Protocol&#xA;  ptppd  PTP Peer Delay Protocol&#xA;  stp    Spanning Tree Protocol&#xA;  udld   UDLD Protocol&#xA;  vtp    Vlan Trunking Protocol&#xA;  &amp;lt;cr&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2nd Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tested and works! The ME3600X/ME3800X are MEF 2.0 compliant devices so this is a required feature.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2016-02-05T14:35:27.440" LastActivityDate="2016-02-05T14:35:27.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18134" PostTypeId="2" ParentId="17971" CreationDate="2015-04-27T12:39:51.720" Score="3" Body="&lt;p&gt;&lt;code&gt;but what I don't see are labels for the 192.168.100.1 that is going to go over the P routers. the BGP points to 8.1.1.1 and that has a label&lt;/code&gt; - If you have configured PE1 as 8.1.1.1 with &lt;code&gt;next-hop-self&lt;/code&gt; then that is how the routes should look.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggesst you read more about BGP behaviour for MPBGP sessions and sending labeled updates for IPV4 unicast and VPNV4 etc.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2015-04-27T12:39:51.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18136" PostTypeId="2" ParentId="18078" CreationDate="2015-04-27T14:51:25.923" Score="3" Body="&lt;p&gt;I found out the MIBs.  For the IPSLA types, &lt;code&gt;udp jitter&lt;/code&gt;, &lt;code&gt;icmp echo&lt;/code&gt; and &lt;code&gt;icmp path-echo&lt;/code&gt;, the RTT and connection status are stored in the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.42.1.2.10.1&quot; rel=&quot;nofollow&quot;&gt;rttMonLatestRttOperEntry&lt;/a&gt; table&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.42.1.2.10.1.1&quot; rel=&quot;nofollow&quot;&gt;rttMonLatestRttOperCompletionTime&lt;/a&gt; has the average RTT&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.42.1.2.10.1.2&quot; rel=&quot;nofollow&quot;&gt;rttMonLatestRttOperSense&lt;/a&gt; has the connection status (ok/disconected etc.)&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://support.ipmonitor.com/mibs/CISCO-RTTMON-MIB/item.aspx?tid=RttResponseSense&quot; rel=&quot;nofollow&quot;&gt;List of values&lt;/a&gt; for &lt;a href=&quot;https://support.ipmonitor.com/mibs/CISCO-RTTMON-MIB/item.aspx?tid=RttResponseSense&quot; rel=&quot;nofollow&quot;&gt;RttResponseSense&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15080" LastActivityDate="2015-04-27T14:51:25.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18137" PostTypeId="1" AcceptedAnswerId="18143" CreationDate="2015-04-27T15:17:59.740" Score="4" ViewCount="163" Body="&lt;p&gt;In a fully-switched network, switches use a spanning tree to forward frames as you know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;From a machine&lt;/strong&gt; connected physically to any switch (say A), how could I know the frames traversing path from A to a machine connected to another switch (say B) if I have several possible paths between A and B?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As well, shall I know the root switch, or I should determine it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I don't have access to switches.&lt;/p&gt;&#xA;" OwnerUserId="13402" LastEditorUserId="13402" LastEditDate="2015-04-28T06:47:12.903" LastActivityDate="2015-04-28T06:47:12.903" Title="Getting the successor of a switch depending on its spanning tree" Tags="|switch|snmp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18138" PostTypeId="1" CreationDate="2015-04-27T16:12:59.063" Score="1" ViewCount="432" Body="&lt;p&gt;Connecting two SG500X-48's through XG1 on both sides with fiber. When I plug in the connector, the link light blinks rapidly a couple times (varies) then stops and goes dark. No connection, interface status is down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've ran down the obvious so far. Fiber cable is good, and switches are in standalone mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm mainly curious why the link light blinks then stops? Does this indicate a specific issue? (auto-neg failure, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've searched for what this means, if anything, and came up empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="8099" LastEditorUserId="33" LastEditDate="2015-06-26T23:35:32.753" LastActivityDate="2015-06-26T23:35:32.753" Title="SG500X-48 10GB port blinks then stops when fiber plugged in" Tags="|cisco|fiber|cisco-small-business|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18139" PostTypeId="2" ParentId="18137" CreationDate="2015-04-27T16:21:13.007" Score="5" Body="&lt;p&gt;STP has a series of steps it uses to determine which paths are used and not used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your question has already been asked and answered &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/114/how-is-the-stp-root-bridge-and-path-to-the-root-bridge-determined&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Not sure how much you know about switching and spanning tree but basically when starting out all switches claim that they are the root. All switches send BPDUs (Bridge Protocol Data Unit) which contain a priority and the BID (Bridge ID).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The BID is 8 bytes long. 6 bytes is used for the MAC address of the bridge. 12 bits is used to indicate the VLAN, this is called extended system ID. 4 bits are used to set the priority. Lower priority means it is preferred compared to a higher. The priority is set in multiples of 4096.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is a tie in priority then the lowest MAC address will determine which bridge becomes the root.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To select the path to the root the cost to the root is calculated. As the BPDU travels from the root downstream the cost is increased INBOUND. 802.1D-1998 (legacy STP) had a cost of 19 for a FastEthernet interface. The newer standard 802.1D-2004 defines a cost of 200000 for FastEthernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is a tie in cost then choose the BPDU that came from the switch with lowest BID. If that is a tie as well (multiple links to same switch) port ID comes into play. The port ID is from the upstream switch as well and consists of a port priority and port ID which identifies the interface. The default port priority is 128.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a lot to spanning tree but these are the basic steps.&quot;&lt;/p&gt;&#xA;" OwnerUserId="8099" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-04-27T16:21:13.007" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18140" PostTypeId="1" AcceptedAnswerId="18145" CreationDate="2015-04-27T16:31:51.830" Score="2" ViewCount="300" Body="&lt;p&gt;My techs just got a pile of fluke test equipment, which can use LLDP to determine what switchport it is connected to. However, the network guys have disabled lldp / cdp as by default it exposes the specific version of IOS that is running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a Cisco command on C3750E or C3560 series switches on IOS 12.2 to either not supply that specific TLV or have custom response independent of actual IOS version?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found via google references to NX-OS being able to do this with no lldp tlv-select system-desc but nothing for IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure which specific TLV has the IOS version in it - maybe basic TLV type 6 &quot;System Description&quot; or one of the LLDP-MED extensions with OUI 00-12-BB subtypes 6 or 7 (&quot;Inventory - Firmware Revision&quot; and &quot;Inventory - Software Revision&quot; respectively)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks for your input.&lt;/p&gt;&#xA;" OwnerUserId="15132" LastActivityDate="2015-04-28T00:13:26.320" Title="LLDP disable specific TLVs?" Tags="|cisco|lldp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18142" PostTypeId="2" ParentId="18140" CreationDate="2015-04-27T17:32:05.907" Score="0" Body="&lt;p&gt;You can enable lldp while leaving cdp disabled, globally and per interface.  Don't know if lldp will include TLV with IOS version.&lt;/p&gt;&#xA;" OwnerUserId="14879" LastActivityDate="2015-04-27T17:32:05.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18143" PostTypeId="2" ParentId="18137" CreationDate="2015-04-27T18:10:10.010" Score="5" Body="&lt;p&gt;If you can't access the switches there's not much you can do.  Switches don't modify the Ethernet frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you could query snmp mibs (to me, that's called having access), you would have to infer the topology. That isn't always accurate and you'd have to query every device you detect. All ports could be forwarding, but you wouldn't necessarily know which one your data was flowing out of without also querying the forwarding table.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-04-27T18:10:10.010" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18144" PostTypeId="2" ParentId="17547" CreationDate="2015-04-27T20:39:18.443" Score="3" Body="&lt;p&gt;The router looks at the complete socket (protocol, source/destination ip and port) which allows it to have a 1:1 relationship for any connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yes, it does work.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2015-04-27T20:39:18.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18145" PostTypeId="2" ParentId="18140" CreationDate="2015-04-27T20:47:10.920" Score="2" Body="&lt;p&gt;It's there in later versions. 15.0 supports it on my 2960S's. And yes, &lt;code&gt;system-description&lt;/code&gt; is the TLV:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SysDescr: Cisco IOS Software, C2960S Software (C2960S-UNIVERSALK9-M), Version 15.0(2)SE3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm curious why the admins think hiding the IOS version is in any way a security enhancement?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[If I find the specific command reference that lists when it was introduced, I'll add a link.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="775" LastEditDate="2015-04-28T00:13:26.320" LastActivityDate="2015-04-28T00:13:26.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18146" PostTypeId="1" CreationDate="2015-04-27T21:17:03.133" Score="5" ViewCount="54" Body="&lt;p&gt;We have a client that has many 3rd party connections on a daily basis being stood up.  A frequent problem is that the 3rd party will miscommunicate about their P1/P2 settings and during turn-up - lie about what they have configured, leaving us to search around for the right settings by trying different transform-sets / encryption etc etc until we get the right combination at which point they 'realize' the difference in configuration.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way through debugging to know definitively what is configured on the other end as far as P1/P2 settings / SA's?  I have to figure since the boxes must negotiate these SA's there is some way to debug and see this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're looking for the ability to say: &quot;We can see you have X Y Z configured on your P1 (or P2) - and that doesn't match what you submitted in the change documentation of A B C&quot;.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2015-04-27T21:23:50.927" Title="VPN debugging / deep t-shoot questions" Tags="|cisco|vpn|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18147" PostTypeId="2" ParentId="18146" CreationDate="2015-04-27T21:23:50.927" Score="4" Body="&lt;p&gt;Unless things have changed, Cisco's &lt;code&gt;debug&lt;/code&gt; output is intentionally cryptic to &quot;protect&quot; the transaction. Every time I've had to debug this crap, I've used wireshark to see the entire packet. From there, it's easy to see what single-freakin'-bit is different. (by &quot;easy&quot; I mean a tedious task of comparing every single bit in both directions to find the one that isn't matching.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-27T21:23:50.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18148" PostTypeId="2" ParentId="18138" CreationDate="2015-04-27T21:30:31.670" Score="3" Body="&lt;p&gt;XG1 and XG2 aren't native stacking ports by default.  Use XG3 (S1) or XG4 (S2) and I bet it'll stack.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2015-04-27T21:30:31.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18149" PostTypeId="1" AcceptedAnswerId="18150" CreationDate="2015-04-27T21:37:39.843" Score="4" ViewCount="841" Body="&lt;p&gt;I have a &lt;a href=&quot;https://www.dropbox.com/s/d1zc86spst1ixy6/20150428_001334.jpg?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco WS-C412&lt;/a&gt; Ethernet hub. Am I correct that internally all the &lt;em&gt;Rx&lt;/em&gt; and &lt;em&gt;Tx&lt;/em&gt; ports connect to a single wire/bus? Like here, where three NIC's are connected to first, fifth and ninth hub port:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/3HN2C.png&quot; alt=&quot;hub&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2016-05-11T02:44:09.743" Title="How does an Ethernet hub work internally?" Tags="|ethernet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18150" PostTypeId="2" ParentId="18149" CreationDate="2015-04-27T21:43:16.980" Score="2" Body="&lt;p&gt;Yes. A hub is a giant virtual wire. Tx from each port is tied to the Rx of all other ports. (through some rather complicated circuitry that's unimportant to anyone but an EE)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-04-27T21:43:16.980" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18153" PostTypeId="2" ParentId="5057" CreationDate="2015-04-28T01:35:41.383" Score="-4" Body="&lt;p&gt;IP MTU = MSS (Layer 4) &#xA;MTU  =  Interface MTU  (Layer 2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thats the way I interpret it, happy to be corrected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cheers,&#xA;Rey&lt;/p&gt;&#xA;" OwnerUserId="15138" LastActivityDate="2015-04-28T01:35:41.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18162" PostTypeId="2" ParentId="17618" CreationDate="2015-04-28T11:39:49.517" Score="4" Body="&lt;p&gt;Yes, there is a reason to it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be advised that even if the 3GDT is set up between RNC and GGSN, the &quot;&lt;strong&gt;2G non home public&lt;/strong&gt;&quot; users , ie &quot;&lt;strong&gt;2G roamer users&lt;/strong&gt;&quot; only use IuPS on your picture, and don't use 3GDT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We both know that 2G users can access 3G Core network depending on the policy of authorization mode based on IMSI or based on algorithm mode in SGSN.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The SGSN does not enable 3GDT for 2G Data user: for 2G data subscriber, the SGSN sends a RAB message request information containing user-plane IP address and TEID &lt;strong&gt;of the SGSN&lt;/strong&gt;, &lt;strong&gt;not GGSN&lt;/strong&gt; to the RNC. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To do:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Please export the number of 2G Data Subscriber in your&#xA;  network and&#xA;  export also the number of 2G PDP Context, &#xA;  there are chances they will correspond.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15145" LastEditorUserId="15145" LastEditDate="2015-04-28T11:58:07.307" LastActivityDate="2015-04-28T11:58:07.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18165" PostTypeId="1" AcceptedAnswerId="18166" CreationDate="2015-04-28T12:12:01.617" Score="-1" ViewCount="1694" Body="&lt;p&gt;I would like to to login automatically on Mikrotik's hotspot using a router with Tomato Shibby firmware.&lt;/p&gt;&#xA;" OwnerUserId="15151" LastEditorUserId="8499" LastEditDate="2018-02-14T16:46:39.217" LastActivityDate="2018-02-14T16:46:39.217" Title="How to autologin to Mikrotik hotspot with Tomato Shibby?" Tags="|wireless|" AnswerCount="1" CommentCount="2" ClosedDate="2015-04-28T13:37:02.480" ContentLicense="CC BY-SA 3.0" />
  <row Id="18166" PostTypeId="2" ParentId="18165" CreationDate="2015-04-28T12:12:01.617" Score="0" Body="&lt;p&gt;Schedule the following script on &lt;code&gt;Administration&lt;/code&gt;/&lt;code&gt;Scheduler&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/bin/sh -c 'echo &quot;POST /login HTTP/1.1&#xA;User-Agent: Wget/1.16.1 (linux-gnu)&#xA;Accept: */*&#xA;Accept-Encoding: identity&#xA;Host: 10.22.0.1&#xA;Content-Type: application/x-www-form-urlencoded&#xA;Content-Length: 35&#xA;&#xA;username=adrianoimba2&amp;amp;password=5149&quot;| nc 10.22.0.1 80'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15151" LastActivityDate="2015-04-28T12:12:01.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18176" PostTypeId="2" ParentId="13422" CreationDate="2015-04-29T07:14:20.497" Score="1" Body="&lt;p&gt;&quot;hw-module module x shutdown &quot;, this command used to completely power down the particular module. Please do let me know.&lt;/p&gt;&#xA;" OwnerUserId="15164" LastActivityDate="2015-04-29T07:14:20.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18177" PostTypeId="2" ParentId="17449" CreationDate="2015-04-29T07:46:03.197" Score="2" Body="&lt;p&gt;This is not possible on JunOS as the AS-Path regular expressions do not support back references (Inserting (part of) a matched expression back into the regular expression itself).&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2015-04-29T07:46:03.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18178" PostTypeId="2" ParentId="16303" CreationDate="2015-04-29T08:13:37.003" Score="2" Body="&lt;p&gt;You have to set all forwarding-classes to the same code-point:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;set class-of-service rewrite-rules ieee-802.1 all-to-cos-4 forwarding-class assured-forwarding loss-priority low code-point 100&#xA;set class-of-service rewrite-rules ieee-802.1 all-to-cos-4 forwarding-class assured-forwarding loss-priority high code-point 100&#xA;set class-of-service rewrite-rules ieee-802.1 all-to-cos-4 forwarding-class expedited-forwarding loss-priority high code-point 100&#xA;set class-of-service rewrite-rules ieee-802.1 all-to-cos-4 forwarding-class expedited-forwarding loss-priority low code-point 100&#xA;set class-of-service rewrite-rules ieee-802.1 all-to-cos-4 forwarding-class network-control loss-priority low code-point 100&#xA;set class-of-service rewrite-rules ieee-802.1 all-to-cos-4 forwarding-class network-control loss-priority high code-point 100&#xA;set class-of-service rewrite-rules ieee-802.1 all-to-cos-4 forwarding-class best-effort loss-priority high code-point 100&#xA;set class-of-service rewrite-rules ieee-802.1 all-to-cos-4 forwarding-class best-effort loss-priority low code-point 100&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then apply this to the interface(s) you want to change the CoS bits:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;set class-of-service interfaces ge-0/0/0 unit 0 rewrite-rules ieee-802.1 all-to-cos-4&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Mind you that this is only for the default forwarding-classes. If you have defined your own forwarding-classes you have to do it for these as well.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2015-04-29T08:13:37.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18179" PostTypeId="1" CreationDate="2015-04-29T11:04:53.503" Score="0" ViewCount="7826" Body="&lt;p&gt;i have setup 2 VM's on ESXi with FortiGateVM100, and trying to setup HA cluster on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I connected 2 fortis interfaces to same port-groups (same vlans). Then i entered same ha group-name, same password, priority 128 on one, and priority 100 on second, rebooted them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;after reboot both of them appears as master and doesn't see each other in HA status.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if i run sniffer on any of them (diag sniffer packet  none 6) - i see ha packets from both of boxes (i can distinguish it by mac-addresses). So it seems that VM's can talk to each other, but they don't do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where to dig? how to setup HA on FortiGateVM??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[UPDATE]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Config screenshots:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) virtual-machine 01:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ZMzTt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) virtual-machine 02 (same stuff as 01):&#xA;&lt;img src=&quot;https://i.stack.imgur.com/plG0v.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) ha setup on both:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/nd9O9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) ha result (fail):&#xA;&lt;img src=&quot;https://i.stack.imgur.com/mvoSo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="15167" LastEditorUserId="15167" LastEditDate="2015-04-30T08:28:54.803" LastActivityDate="2015-08-28T14:41:46.447" Title="How to setup HA on FortiGate VM?" Tags="|fortigate|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18180" PostTypeId="1" AcceptedAnswerId="25465" CreationDate="2015-04-29T12:30:58.983" Score="7" ViewCount="6167" Body="&lt;p&gt;I should get this figured out by my own, but actually I seem to be a blockedhead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two stacks of Cisco 3750X with two switches in each stack. One Stack is in building A, the other one in Building B. Each stack acts as core switch for the building and as a router for the local traffic. Also, there are some VLANs shared between the two stacks with no routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The stacks are connected with a dark fiber and 1Gbps single mode SFP. This is working like a charm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, we want to install a second uplink between the two stacks for backup. Unfortunately, we could only get a 100 Mbit (STM-100) leased ethernet line between the buildings, so no portchannel/etherchannel is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I thought: Just configure a second port with same settings (trunk) as the first uplink port and plug in the line. Spanning-Tree will disable it because of higher cost and enable it in case the main uplink (Gbit fiber) fails. And there is the problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spanning-Tree (RSTP) has disabled the &quot;new&quot; port, but detected it as &quot;Backup&quot; and made it discard all packets and don't enables it when the main uplinks fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is: How can I make the stacks enable the backup line in case of a main line failure OR if this is not possible, what would be a better approach to reach the same goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a simple drawing to visualize the problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/qAf8N.jpg&quot; alt=&quot;##&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant parts of the running config:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stack in Building A:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/28&#xA; description downlink trunk BldB&#xA; switchport access vlan 666&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 666&#xA; switchport trunk allowed vlan 2-99,101-199,201-4094&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; speed nonegotiate&#xA;end&#xA;&#xA;&#xA;interface GigabitEthernet2/0/28&#xA; description &quot;downlink trunk BldgB 100M-Backup&quot;&#xA; switchport access vlan 666&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 666&#xA; switchport trunk allowed vlan 2-99,101-109,111-4094&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; shutdown&#xA; speed 100&#xA; duplex full&#xA; spanning-tree vlan 99 port-priority 128&#xA; spanning-tree vlan 99 cost 50&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Stack in Building B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/1&#xA; description downlink trunk BldgA&#xA; switchport access vlan 666&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 666&#xA; switchport trunk allowed vlan 2-99,101-199,201-4094&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; speed nonegotiate&#xA; duplex full&#xA;end&#xA;&#xA;interface GigabitEthernet2/0/1&#xA; description &quot;downlink trunk BldgA 100Mbit-Backup&quot;&#xA; switchport access vlan 666&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 666&#xA; switchport trunk allowed vlan 2-99,101-109,111-4094&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; speed 100&#xA; duplex full&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: Added spanning tree information:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bldga-core# show spanning-tree summary&#xA;Switch is in rapid-pvst mode&#xA;Root bridge for: VLAN0099, VLAN0101-VLAN0117, VLAN0200&#xA;Extended system ID           is enabled&#xA;Portfast Default             is disabled&#xA;PortFast BPDU Guard Default  is disabled&#xA;Portfast BPDU Filter Default is disabled&#xA;Loopguard Default            is disabled&#xA;EtherChannel misconfig guard is enabled&#xA;UplinkFast                   is disabled&#xA;Stack port is StackPort1&#xA;BackboneFast                 is disabled&#xA;Configured Pathcost method used is short&#xA;&#xA;&#xA;bldgb-core# show spanning-tree summary&#xA;Switch is in rapid-pvst mode&#xA;Root bridge for: VLAN0100, VLAN0110, VLAN0118, VLAN0200&#xA;EtherChannel misconfig guard is enabled&#xA;Extended system ID           is enabled&#xA;Portfast Default             is disabled&#xA;PortFast BPDU Guard Default  is disabled&#xA;Portfast BPDU Filter Default is disabled&#xA;Loopguard Default            is disabled&#xA;UplinkFast                   is disabled&#xA;Stack port is StackPort1&#xA;BackboneFast                 is disabled&#xA;Configured Pathcost method used is short&#xA;&#xA;&#xA;bldga-core# show spanning-tree vlan 99&#xA;&#xA;VLAN0099&#xA;  Spanning tree enabled protocol rstp&#xA;  Root ID    Priority    99&#xA;             Address     081f.f31e.9c80&#xA;             This bridge is the root&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    99     (priority 0 sys-id-ext 99)&#xA;             Address     081f.f31e.9c80&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  300 sec&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;Po14                Desg FWD 3         128.592  P2p&#xA;Po15                Desg FWD 3         128.600  P2p&#xA;Po17                Desg FWD 3         128.616  P2p&#xA;Po19                Desg FWD 3         128.632  P2p&#xA;Po22                Desg FWD 3         128.656  P2p&#xA;Po23                Desg FWD 3         128.664  P2p&#xA;Po24                Desg FWD 3         128.672  P2p&#xA;Po28                Desg FWD 4         128.704  P2p&#xA;&#xA;bldgb-core#show spanning-tree vlan 99&#xA;&#xA;VLAN0099&#xA;  Spanning tree enabled protocol rstp&#xA;  Root ID    Priority    99&#xA;             Address     081f.f31e.9c80&#xA;             Cost        4&#xA;             Port        616 (Port-channel14)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    4195   (priority 4096 sys-id-ext 99)&#xA;             Address     d072.dc9b.4980&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  300 sec&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;Po14                Root FWD 4         128.616  P2p&#xA;Po15                Desg FWD 4         128.624  P2p&#xA;Po16                Desg FWD 4         128.632  P2p&#xA;Po17                Desg FWD 4         128.640  P2p&#xA;Po18                Desg FWD 4         128.648  P2p&#xA;Po19                Desg FWD 4         128.656  P2p&#xA;Po20                Desg FWD 4         128.664  P2p&#xA;Po21                Desg FWD 4         128.672  P2p&#xA;Po22                Desg FWD 4         128.680  P2p&#xA;Po23                Desg FWD 4         128.688  P2p&#xA;Po25                Desg FWD 4         128.704  P2p&#xA;&#xA;bldga-core#show interfaces gi2/0/28&#xA;GigabitEthernet2/0/28 is administratively down, line protocol is down (disabled)&#xA;  Hardware is Gigabit Ethernet, address is 081f.f31e.c39c (bia 081f.f31e.c39c)&#xA;  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not set&#xA;  Full-duplex, 100Mb/s, link type is force-up, media type is 10/100/1000BaseTX SFP&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 20:35:08, output 20:34:56, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 6039&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     964013646 packets input, 740488440354 bytes, 0 no buffer&#xA;     Received 3529649 broadcasts (2477004 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     12 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 2477004 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     975352039 packets output, 923509356637 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 9 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&#xA;&#xA;bldgb-core#show interfaces gigabitEthernet 2/0/1&#xA;GigabitEthernet2/0/1 is down, line protocol is down (notconnect)&#xA;  Hardware is Gigabit Ethernet, address is 74a0.2f7e.3001 (bia 74a0.2f7e.3001)&#xA;  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not set&#xA;  Full-duplex, 100Mb/s, link type is auto, media type is 10/100/1000BaseTX SFP&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output 20:25:27, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 346&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;     Received 0 broadcasts (0 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     160167 packets output, 19128660 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 2 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&#xA;bldga-core#show etherchannel summary&#xA;Flags:  D - down        P - bundled in port-channel&#xA;        I - stand-alone s - suspended&#xA;        H - Hot-standby (LACP only)&#xA;        R - Layer3      S - Layer2&#xA;        U - in use      f - failed to allocate aggregator&#xA;&#xA;        M - not in use, minimum links not met&#xA;        u - unsuitable for bundling&#xA;        w - waiting to be aggregated&#xA;        d - default port&#xA;&#xA;&#xA;Number of channel-groups in use: 15&#xA;Number of aggregators:           15&#xA;&#xA;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+-----------------------------------------------&#xA;1      Po1(SD)          -&#xA;14     Po14(SU)         -        Gi1/0/14(P) Gi2/0/8(P)&#xA;15     Po15(SU)         -        Gi1/0/15(P) Gi2/0/9(P)&#xA;16     Po16(SD)         -        Gi2/0/16(D)&#xA;17     Po17(SU)         -        Gi1/0/17(P) Gi2/0/17(P)&#xA;18     Po18(SD)         -&#xA;19     Po19(SU)         -        Gi1/0/22(P) Gi2/0/19(P)&#xA;20     Po20(SD)         -&#xA;21     Po21(SD)         -&#xA;22     Po22(SU)         -        Gi1/0/9(P)  Gi2/0/10(P) Gi2/0/14(P)&#xA;                                 Gi2/0/15(P)&#xA;23     Po23(SU)         -        Gi1/0/10(P) Gi1/0/18(P) Gi2/0/11(P)&#xA;                                 Gi2/0/18(P)&#xA;24     Po24(SU)         -        Gi2/0/5(P)  Gi2/0/6(P)&#xA;27     Po27(SD)         -        Gi2/0/23(D)&#xA;28     Po28(SU)         -        Gi1/0/28(P)&#xA;29     Po29(SD)         -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help!&lt;/p&gt;&#xA;" OwnerUserId="2112" LastEditorUserId="2112" LastEditDate="2015-04-30T07:58:10.993" LastActivityDate="2016-02-27T21:19:51.770" Title="Uplinkports between two Cisco stacks gets blocked by RSTP" Tags="|cisco|spanning-tree|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18181" PostTypeId="2" ParentId="18180" CreationDate="2015-04-29T12:56:10.040" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Spanning-Tree (RSTP) has disabled the &quot;new&quot; port, but detected it as &quot;Backup&quot; and made it discard all packets and don't enables it when the main uplinks fails.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;STP should enable it when primary fails. It's normal behaviuor of STP.&#xA;Maybe you didn't enabled Rapid STP, and switching to backup takes about minute (50s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run &quot;show spanning-tree summary&quot; command on both switches and on first line it will show operational mode. It should be &quot;Switch is in rapid-pvst mode&quot;. If no - than do &quot;spanning-tree mode rapid&quot; on both stacks.&lt;/p&gt;&#xA;" OwnerUserId="15167" LastActivityDate="2015-04-29T12:56:10.040" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18183" PostTypeId="1" AcceptedAnswerId="18193" CreationDate="2015-04-29T14:19:41.203" Score="4" ViewCount="396" Body="&lt;p&gt;I'm trying to get the Hardware Board Revision Number from a ~100 cisco 29xx switches, and thought that an snmpwalk might be the quickest way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I'm unable to find a OID for this purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The closest i get is 1.3.6.1.2.1.47.1.1.1.1 which gives me most of the information from &lt;code&gt;show version&lt;/code&gt;, but not the revision number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know the proper one?&lt;/p&gt;&#xA;" OwnerUserId="15170" LastEditorUserId="3075" LastEditDate="2015-04-29T18:42:17.060" LastActivityDate="2015-04-29T19:24:34.057" Title="How to get Hardware Board Revision Number via SNMP" Tags="|cisco-catalyst|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18185" PostTypeId="2" ParentId="13338" CreationDate="2015-04-29T14:55:06.290" Score="2" Body="&lt;p&gt;This is correct, and in addition, the choice of the technology used depends also on the QoS allowed to the subscriber by the operator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a subscriber buy a simcard, this simcard has some uplink bit rate and some downlink bitrate.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if the Qos data subscription of the simcard is very low, let's say the customer bought only 256Kbps for uplink rate, it would be difficult for him to reach HSPA, maybe he will camp on HSDPA depending on the threshold in the network configuration.&lt;/p&gt;&#xA;" OwnerUserId="15145" LastActivityDate="2015-04-29T14:55:06.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18186" PostTypeId="1" CreationDate="2015-04-29T15:11:36.427" Score="0" ViewCount="436" Body="&lt;p&gt;A while back one of our 3925s bit the dust.  I figured I would take it home and see if I can revive it, maybe use it in my lab.  So I connect my console cable, and power up the router.  Everything seems to be fine then I get this message:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;System Bootstrap, Version 15.1(1r)T1, RELEASE SOFTWARE (fc1)&#xA;Technical Support: &lt;a href=&quot;http://www.cisco.com/techsupport&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/techsupport&lt;/a&gt;&#xA;Copyright (c) 2010 by cisco Systems, Inc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Total memory size = 1024 MB - DIMM0 = 512 MB, DIMM1 = 512 MB&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Virtual Private Network (VPN) Module not found&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't remember it having a VPN module in the first place, so I thought this was a little odd.  I pulled out the main board, and I didn't see anything resembling a VPN module.  It seemed to hang on this, though maybe it's search was delaying the boot process.  Anyone familiar with this?  &lt;/p&gt;&#xA;" OwnerUserId="15172" LastActivityDate="2015-11-26T20:23:14.810" Title="Cisco 3925 Virtual Private Network (VPN) Module not found message at boot up" Tags="|cisco|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18190" PostTypeId="2" ParentId="18186" CreationDate="2015-04-29T15:56:04.157" Score="2" Body="&lt;p&gt;The VPN module looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/2cc6a.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and fits into the ISM slot, which is part number 7 below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/TySfJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On some Cisco models there's also an &quot;ISM&quot; LED on the chassis such that you can see without opening it up if the chassis recognizes any module installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I guess the first step is, does the chassis contain a module?  If yes, and you remove it, does it boot fine?&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2015-04-29T16:35:33.903" LastActivityDate="2015-04-29T16:35:33.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18192" PostTypeId="2" ParentId="18179" CreationDate="2015-04-29T16:51:50.953" Score="0" Body="&lt;p&gt;you must define some settings, like heartbeat interface.&#xA;This is a example in CLI:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config system ha&#xA;    set group-name &quot;TEST&quot;&#xA;    set mode a-a&#xA;    set password 123456&#xA;    set hbdev &quot;port3&quot; 100 &quot;port4&quot; 50&#xA;    set arps 10&#xA;    set arps-interval 1&#xA;    set session-pickup enable&#xA;    set override disable&#xA;    set priority 200&#xA;    set schedule leastconnection&#xA;    set monitor &quot;port1&quot; &quot;port2&quot; &quot;wan1&quot; &quot;wan2&quot;&#xA;    set pingserver-monitor-interface &quot;port2&quot; &quot;port1&quot;&#xA;    set pingserver-failover-threshold 20&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can you copy/paste you own ha settings?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to do that, in CLI type config system ha-&gt;show&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and for best practices, is better if hearbeat interfaces are in a vm port group just for this purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hope it helps!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bye!&lt;/p&gt;&#xA;" OwnerUserId="10098" LastActivityDate="2015-04-29T16:51:50.953" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18193" PostTypeId="2" ParentId="18183" CreationDate="2015-04-29T19:24:34.057" Score="2" Body="&lt;p&gt;Unfortunately I don't have a 2900 series to try this against, but give the following OID a shot.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Object Name:&lt;/strong&gt; c2900InfoBoardRevision&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;OID:&lt;/strong&gt; 1.3.6.1.4.1.9.9.87.1.1.1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Sources: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=c2900InfoBoardRevision&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot; rel=&quot;nofollow&quot;&gt;Cisco SNMP MIB Reference&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseMIB.do?local=en&amp;amp;step=2&amp;amp;mibName=CISCO-C2900-MIB&quot; rel=&quot;nofollow&quot;&gt;Cisco MIB Browser&lt;/a&gt; (You'll have to Ctrl+F for the ObjectName)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-04-29T19:24:34.057" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18194" PostTypeId="2" ParentId="18124" CreationDate="2015-04-29T20:49:11.213" Score="1" Body="&lt;p&gt;I think &lt;a href=&quot;https://www.ietf.org/rfc/rfc1583.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 1583&lt;/a&gt; is good reading material, and it seems to answer your question (section A.3, emphasis mine):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;All OSPF packet types (other than the OSPF Hello packets) deal with lists of link state advertisements&lt;/strong&gt;.  For example, Link State Update packets implement the flooding of advertisements throughout the OSPF routing domain.  Because of this, OSPF protocol packets cannot be parsed unless the format of link state advertisements is also understood.  The format of Link state advertisements is described in Section A.4.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-04-29T20:49:11.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18197" PostTypeId="1" AcceptedAnswerId="18212" CreationDate="2015-04-30T06:56:23.050" Score="1" ViewCount="8810" Body="&lt;p&gt;I have this network in which the top switch(one connected to router) is used for routing between all the vlans in the network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OnYo9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have defined &lt;code&gt;vlan interface&lt;/code&gt; in this switch, but I haven't configured anything in a router on a stick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network below the router is working absolutely fine and I can ping every device from every other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the scenario defined above is provided by my professor. Since everything is pinging properly , what am I supposed to configure in router on a stick ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to configure router on a stick using sub-interfaces and everything, but I am already using L3 Switching so why this router is even connected , and what am I supposed to configure in it ?&lt;/p&gt;&#xA;" OwnerUserId="14885" LastActivityDate="2015-04-30T14:18:39.360" Title="Why should I use Router on a Stick If already doing interVlan routing using L3 Switch in same netwrok?" Tags="|routing|layer3|" AnswerCount="3" CommentCount="5" ClosedDate="2015-04-30T19:16:13.627" ContentLicense="CC BY-SA 3.0" />
  <row Id="18198" PostTypeId="2" ParentId="12812" CreationDate="2015-04-30T09:48:23.060" Score="3" Body="&lt;p&gt;In my opinion, S-GW is not required as part of full MVNO LTE architecture.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because, in principle, the S-GW needs to connect to all the LTE Radio Network Coverage (eNodeB) and unfortunately, generally, a MVNO does not have such LTE Radio Network, that's why he is a MVNO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if the full MVNO want to have a S-GW anyway, he can, but he will need to connect to all the LTE eNodeB(all LTE coverage) of the hosting operator....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, commonly, the radio coverage is managed by the hosting Operator, and the S-GW with also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your full MVNO &lt;strong&gt;can&lt;/strong&gt; manage:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;HSS and/or P-GW&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But the hosting operator should manage:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;S-GW (connected to all the LTE eNodeB)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;eNodeB&lt;/li&gt;&#xA;&lt;li&gt;MME (connected to all the eNodeB also)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conclusion:&lt;/strong&gt; Because S-GW needs to be connected to all the eNodeB of the hosting operator, it is preferred to keep S-GW to the hosting operator, not to the MVNO.&lt;/p&gt;&#xA;" OwnerUserId="15145" LastEditorUserId="15145" LastEditDate="2017-01-18T12:27:44.393" LastActivityDate="2017-01-18T12:27:44.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18203" PostTypeId="2" ParentId="18197" CreationDate="2015-04-30T12:11:59.100" Score="1" Body="&lt;p&gt;If you don't have any explicit instructions to configure vlan routing on the multilayered switch or to use a Router-on-a-stick, you can choose the method you prefer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But since the diagram doesn't show that Router 0 is supposed to connect the switches to other networks, I think it's meant to be used as a router-on-a-stick. Hence you should not use the multilayered switch to route the vlans but instead trunk them to the router.&lt;/p&gt;&#xA;" OwnerUserId="14973" LastActivityDate="2015-04-30T12:11:59.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18208" PostTypeId="2" ParentId="18179" CreationDate="2015-04-30T13:35:47.553" Score="1" Body="&lt;p&gt;Solved. One have to switch promiscous mode security setting to accept on the port-group for heart-beat interfaces inside vswitch configuration.&lt;/p&gt;&#xA;" OwnerUserId="15167" LastActivityDate="2015-04-30T13:35:47.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18209" PostTypeId="2" ParentId="18197" CreationDate="2015-04-30T13:38:09.893" Score="0" Body="&lt;p&gt;Your internal LAN will work fine with the multi-layer switch as your trunk. But what is the point if you can't get your devices on the internet to do work? The router is the device that will strip the LAN/VLAN headers and find destinations outside of your LAN. Otherwise you've just created an internal network that is solely used to connect devices to each other. Not very practical in an enterprise or even home environment.&lt;/p&gt;&#xA;" OwnerUserId="15154" LastActivityDate="2015-04-30T13:38:09.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18210" PostTypeId="1" CreationDate="2015-04-30T13:44:52.000" Score="1" ViewCount="1213" Body="&lt;p&gt;we have a test case from the operator that upon expiry of router lifetime the client device supposed to send Router solicitation message to the router. But this is not happening. is this because of some kernel configuration missing ? what could be the reason for this? Usually the router life time is infinite but for this particular test case it is of very low value of 240Seconds.Please help me.&lt;/p&gt;&#xA;" OwnerUserId="15191" LastActivityDate="2015-04-30T15:11:31.747" Title="IPV6 Client Device not sending Router Solicitation upon expiry of Router lifetime" Tags="|ipv6|" AnswerCount="1" CommentCount="1" ClosedDate="2015-05-05T23:52:50.237" ContentLicense="CC BY-SA 3.0" />
  <row Id="18212" PostTypeId="2" ParentId="18197" CreationDate="2015-04-30T14:18:39.360" Score="2" Body="&lt;p&gt;The answer is simple: if you &lt;strong&gt;only&lt;/strong&gt; need to do inter-VLAN routing and you are already doing it with a L3 switch, then you don't &lt;strong&gt;need&lt;/strong&gt; a router. Not to mention that switches are faster than routers at doing this because of ASIC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said this, though, it makes sense to have a router in the picture because that's what you will find in the real world. You use routers to connect remote LANs via WAN links, you use them for QoS, ACLs etc. You need to be able to configure routers even when they are connected to L3 switches which do some of the routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then again, if you just need to configure inter-VLAN routing, you are good to go, no need to configure it on the router as well because the switch is already taking care of it. &lt;/p&gt;&#xA;" OwnerUserId="13443" LastActivityDate="2015-04-30T14:18:39.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18213" PostTypeId="2" ParentId="18210" CreationDate="2015-04-30T15:11:31.747" Score="2" Body="&lt;p&gt;Take a look at &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861#section-6.3.7&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4861&lt;/a&gt;: Router Solicitations should only be sent when connecting to a link. After that the host just listens to the periodic Router Advertisements sent by the router.&lt;/p&gt;&#xA;&lt;p&gt;If something goes wrong this is the router's fault for not sending a new RA in time, not the host's.&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-04-30T15:11:31.747" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18215" PostTypeId="1" CreationDate="2015-04-30T15:50:24.103" Score="3" ViewCount="404" Body="&lt;p&gt;I have a very simple LAN to about 30 users.&#xA;On this LAN I would like to setup a Demo Enviroment with is seperated and trying to do so through VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a Zyxel USG 50 Firewall.&#xA;This has the following ports:&#xA;p1 WAN1 (not in use&#xA;p2 WAN2 (ISP)&#xA;p3 LAN (192.168.1.x no DHCP)&#xA;P4 LAN2 (192.168.2.x with DHCP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I connect our 'demo' servers NIC to P4 of Zyxel I get an IP on server 2012R2 and can access Internet. &#xA;e.g. all is well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need the server on a VLAN because I have 2 other servers which need to be on this segment and approx 5 printers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for that reason:&#xA;in our server rack I have a 24P HP (SS = serverswitch)&#xA;in our switch rack I have a 24P HP (RS = Rack Switch) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My idear would be the following:&#xA;demoserver --&gt; port 10 on SS --&gt; Port 4 on RS --&gt; P4 Zyxel (internet access)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is how to handle the different VLAN settings:&#xA;I can take server NIC (ESXi) and set on VLAN10 but then what to do on the serverswitch, rackswitch ... when do I trunk on which switch, should I use PVID or not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this makes sense and you can help me out ...&lt;/p&gt;&#xA;" OwnerUserId="15192" LastActivityDate="2016-02-24T20:53:54.517" Title="VLAN for demonstration purpose" Tags="|vlan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18216" PostTypeId="2" ParentId="18215" CreationDate="2015-04-30T16:08:35.203" Score="2" Body="&lt;p&gt;Pay attention that if you are going to use different VLANs on ESXi (i.e. some of your VMs should belong to one VLAN and some to another), port 10 on SS should be a trunking to allow tags to go through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If ESXi should only use one VLAN instead, port 10 on SS should be an access port. Consequently, also port 4 on RS should be an access port, if you are connecting port 10 on SS to port 4 on RS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To achieve inter-VLAN routing, if needed, the switch interface going to the router should be a trunking interface.&lt;/p&gt;&#xA;" OwnerUserId="13443" LastActivityDate="2015-04-30T16:08:35.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18217" PostTypeId="2" ParentId="18215" CreationDate="2015-04-30T16:24:39.130" Score="2" Body="&lt;p&gt;Start from your Zyxel and work your way down to the virtual.  Pick a VLAN and new subnet to add to the firewall: you don't need to burn more physical ports if you are implementing a VLAN to facilitate the switch connection anyway.  Then on the RS add that vlan to the trunk going to the Zyxel and the trunk going to the SS.  You shouldn't be altering native vlan tagging (the PVID) for this change (and probably shouldn't be using it at all but that is for a different StackExchange discussion).  Then move to the SS: add the new vlan to the trunk from the RS to the SS and the trunk on the SS going to the ESXi host with the demo server on it.  Finally, set up a new virtual switch in ESXi with that vlan tag and add the demo server to it.  Test by pinging the firewall from the demo VM.  This should conclude your change.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that your firewall might not be already configured to block intra-lan traffic (from the existing LAN segment to this new one you set up) so you are not fully protected (if full protection from production traffic is the goal) until you set up a rule dropping any traffic between the new vlan subnet and the existing one(s).&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-04-30T16:24:39.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18221" PostTypeId="2" ParentId="18129" CreationDate="2015-04-30T23:15:17.673" Score="2" Body="&lt;p&gt;&lt;code&gt;show eigrp address-family timers&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That should display the information that you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think.  I don't typically fiddle with the timers.&lt;/p&gt;&#xA;" OwnerUserId="14403" LastEditorUserId="33" LastEditDate="2015-04-30T23:18:36.133" LastActivityDate="2015-04-30T23:18:36.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18223" PostTypeId="1" CreationDate="2015-05-01T02:02:45.333" Score="-2" ViewCount="89" Body="&lt;p&gt;I have a 150 megabits/sec Comcast pipe that connects to two subnets through two Cisco routers. The bandwidth at the modem is 150 Mb/s. The bandwidth at one router is 96 Mb/s and the other is 96 Mb/s Neither has the full 150 Mb/s. Does the bandwidth divide into two values, or are the routers causing the reduction in bandwidth?&lt;/p&gt;&#xA;" OwnerUserId="15201" LastActivityDate="2020-07-30T17:55:43.390" Title="Does the bandwidth of a Comcast modem divide if it is connected to two routers on two subnets?" Tags="|troubleshooting|" AnswerCount="1" CommentCount="1" ClosedDate="2015-05-04T19:47:31.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="18224" PostTypeId="2" ParentId="18129" CreationDate="2015-05-01T03:03:06.623" Score="3" Body="&lt;p&gt;The EIGRP active timer is displayed using the &lt;code&gt;show ip protocols&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip protocols | i eigrp|Active    &#xA;Routing Protocol is &quot;eigrp 123&quot;&#xA;  Active Timer: 3 min&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2476" LastActivityDate="2015-05-01T03:03:06.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18225" PostTypeId="1" CreationDate="2015-05-01T05:31:34.467" Score="1" ViewCount="215" Body="&lt;p&gt;I have a layer three switch connected to four layer 2 switches with multiple PCs connected to them. Each interface has its own IP assigned as well as an associated DHCP pool, however, the PCs are pulling IPs from random pools. I am running the following config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface FastEthernet0/10&#xA; no switchport&#xA; ip address 192.168.4.1 255.255.255.0 &#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/11&#xA; no switchport&#xA; ip address 192.168.0.1 255.255.254.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/12&#xA; no switchport&#xA; ip address 192.168.6.1 255.255.255.240&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/13&#xA; no switchport&#xA; ip address 192.168.5.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;&#xA;ip dhcp pool HQSwitch1Pool&#xA;network 192.168.4.0 255.255.255.0&#xA;!&#xA;ip dhcp excluded-address 192.168.4.1&#xA;&#xA;ip dhcp pool HQSwitch2Pool&#xA; network 192.168.0.0 255.255.254.0&#xA;!&#xA;ip dhcp excluded-address 192.168.0.1&#xA;&#xA;ip dhcp pool HQSwitch3Pool&#xA; network 192.168.6.0 255.255.255.240&#xA;!&#xA;ip dhcp excluded-address 192.168.6.1&#xA;&#xA;ip dhcp pool HQSwitch4Pool&#xA; network 192.168.5.0 255.255.255.0&#xA;!&#xA;ip dhcp excluded-address 192.168.5.1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated&lt;/p&gt;&#xA;" OwnerUserId="15202" LastActivityDate="2015-08-02T05:23:35.793" Title="DHCP pulling from pools other than within subnet" Tags="|cisco|dhcp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18226" PostTypeId="1" CreationDate="2015-05-01T08:35:00.490" Score="2" ViewCount="960" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/sZgPM.png&quot; alt=&quot;Multi-Node VSS Core&quot;&gt;&#xA;In this diagram we have 4 Cisco 6500 switch, which are connected via standard 10 GB VSL links.  The questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Since we could only have one Active and one Standby, which one of these switches will be VSS Active and which one will be VSS Standby? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Will there be just one Active VSS switch for the all of the 4 switches, or Active/Standby is a per link concept?  For example, between Switch 1 and 2 one will become Active and the other one will become Standby.  Will the same thing take place between the other pair of switches?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If question number 2 is a correct assumption, let's say that between Switch 3 and Switch 4, Switch 4 becomes Active and Switch 3 becomes Standby.  At the same time, if we choose to have Switch 2 as Active between Switch 4 and Switch 2, what will happen then?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How many Active switches is it possible to have here?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the common practice, or your personal experience, with regards to utilizing all these switches in a design like this?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm so sorry, my mind is so puzzled that I asked all these questions in a row.  Actually, it's my new task in hand and I have never ever done such thing before.  Please share any kinda link, web page, or reference which you think may be helpful.  &lt;/p&gt;&#xA;" OwnerUserId="15204" LastEditorUserId="44" LastEditDate="2015-05-02T14:18:25.210" LastActivityDate="2015-05-04T02:45:58.630" Title="Multi-Node VSS core, how to configure?" Tags="|cisco|vss|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18227" PostTypeId="2" ParentId="18225" CreationDate="2015-05-01T09:17:35.960" Score="1" Body="&lt;p&gt;I wish I could comment, as this is not really an answer; more of a troubleshooting technique.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is a multi-layer switch, try moving your IP addressing to virtual interfaces instead of assigning them directly to the switchports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your config would look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 100&#xA; description &quot;HQ-Switch-1 Gateway&quot;&#xA; ip address 192.168.4.1 255.255.255.0&#xA;!&#xA;interface vlan 200&#xA; description &quot;HQ-Switch-2 Gateway&quot;&#xA; ip address 192.168.0.1 255.255.255.0&#xA;!&#xA;interface vlan 300&#xA; description &quot;HQ-Switch-3 Gateway&quot;&#xA; ip address 192.168.6.1 255.255.255.240&#xA;!&#xA;interface vlan 400&#xA; description &quot;HQ-Switch-4 Gateway&quot;&#xA; ip address 192.168.5.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/10&#xA; switchport mode access&#xA; switchport access vlan 100&#xA;!&#xA;interface FastEthernet0/11&#xA; switchport mode access&#xA; switchport access vlan 200&#xA;!&#xA;interface FastEthernet0/12&#xA; switchport mode access&#xA; switchport access vlan 300&#xA;!&#xA;interface FastEthernet0/13&#xA; switchport mode access&#xA; switchport access vlan 400&#xA;!&#xA;ip dhcp excluded-address 192.168.0.1&#xA;ip dhcp excluded-address 192.168.4.1&#xA;ip dhcp excluded-address 192.168.6.1&#xA;ip dhcp excluded-address 192.168.5.1&#xA;!&#xA;ip dhcp pool HQSwitch1Pool&#xA;network 192.168.4.0 255.255.255.0&#xA;!&#xA;ip dhcp pool HQSwitch2Pool&#xA; network 192.168.0.0 255.255.254.0&#xA;!&#xA;ip dhcp pool HQSwitch3Pool&#xA; network 192.168.6.0 255.255.255.240&#xA;!&#xA;ip dhcp pool HQSwitch4Pool&#xA; network 192.168.5.0 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Honestly, assuming f0/10-13 are plugged into other switches, you should use 802.1q trunking instead of running them as access ports (as you are doing currently anyway.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, use your other switches to assign individual ports to the appropriate vlan.  Here the &lt;code&gt;interface range&lt;/code&gt; command is your friend.&lt;/p&gt;&#xA;" OwnerUserId="8251" LastActivityDate="2015-05-01T09:17:35.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18229" PostTypeId="2" ParentId="18226" CreationDate="2015-05-01T12:19:30.593" Score="3" Body="&lt;p&gt;VSS only allows you to aggregate two physical chassis at a time.  Remember there are really only two main drivers to even using VSS (and &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2339/does-cisco-6500-vss-improve-or-hurt-mtbf?rq=1&quot;&gt;many arguments against it&lt;/a&gt; depending on who you ask):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Etherchannel aggregation across multiple physical devices for hardware redundancy.&lt;/li&gt;&#xA;&lt;li&gt;Ease of management/configuration by consolidating the two chassis into a single point of management.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In a &quot;box&quot; design like this, comprising four switches, you would use VSS on each pair separately.  Then use the normal network protocols (Spanning Tree, routing, etc) to manage traffic to/through the other pair.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Based on your questions, I thought it might be good to clarify a few basic components of VSS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, While it does logically aggregate two separate physical chassis, the way it does so for the Data Plane and the Control Plane are different.  In a VSS pair the Data Plane is active on both switches, however from the Control Plane/NMS perspective only one switch is active and responding.  This is what gives VSS it's single point of management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, the VSL interfaces are only used among a single pair of switches.  To cable two pairs of VSS Switches together (for a design like you reference), you would simply use existing ethernet ports and configure 802.1Q trunks or routed interfaces as needed in your design.  Each of the two VSS pairs would appear as independent switches to the other.  No multi-chassis Etherchannel or single point of management functionality is possible between the two VSS pairs, they are for all intents and purposes two separate switches.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-virtual-switching-system-1440/prod_qas0900aecd806ed74b.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this very helpful VSS Q/A document that Cisco has put together&lt;/a&gt;, or the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-virtual-switching-system-1440/product_solution_overview0900aecd806fa5d0.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Solution Overview document for VSS&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-05-02T14:34:45.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18231" PostTypeId="2" ParentId="18225" CreationDate="2015-05-01T15:03:15.837" Score="-1" Body="&lt;p&gt;In addition to what Rowshi said, you could also add the default-router command to your pools. This will point the DHCP request to the virtual interface ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;your config would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 100&#xA;description &quot;HQ-Switch-1 Gateway&quot;&#xA;ip address 192.168.4.1 255.255.255.0&#xA;!&#xA;interface vlan 200&#xA;description &quot;HQ-Switch-2 Gateway&quot;&#xA;ip address 192.168.0.1 255.255.255.0&#xA;!&#xA;interface vlan 300&#xA;description &quot;HQ-Switch-3 Gateway&quot;&#xA;ip address 192.168.6.1 255.255.255.240&#xA;!&#xA;interface vlan 400&#xA;description &quot;HQ-Switch-4 Gateway&quot;&#xA;ip address 192.168.5.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/10&#xA;switchport mode access&#xA;switchport access vlan 100&#xA;!&#xA;interface FastEthernet0/11&#xA;switchport mode access&#xA;switchport access vlan 200&#xA;!&#xA;interface FastEthernet0/12&#xA;switchport mode access&#xA;switchport access vlan 300&#xA;!&#xA;interface FastEthernet0/13&#xA;switchport mode access&#xA;switchport access vlan 400&#xA;!&#xA;ip dhcp excluded-address 192.168.0.1&#xA;ip dhcp excluded-address 192.168.4.1&#xA;ip dhcp excluded-address 192.168.6.1&#xA;ip dhcp excluded-address 192.168.5.1&#xA;!&#xA;ip dhcp pool HQSwitch1Pool&#xA;network 192.168.4.0 255.255.255.0&#xA;default-router 192.168.4.1&#xA;!&#xA;ip dhcp pool HQSwitch2Pool&#xA;network 192.168.0.0 255.255.254.0&#xA;default-router 192.168.0.1&#xA;!&#xA;ip dhcp pool HQSwitch3Pool&#xA;network 192.168.6.0 255.255.255.240&#xA;default-router 192.168.6.1&#xA;!&#xA;ip dhcp pool HQSwitch4Pool&#xA;network 192.168.5.0 255.255.255.0&#xA;default-router 192.168.5.1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15154" LastActivityDate="2015-05-01T15:03:15.837" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18236" PostTypeId="1" CreationDate="2015-05-01T17:04:20.300" Score="2" ViewCount="99" Body="&lt;p&gt;Please consider my network topology:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(Machine A0) --- [Switch A] ============ [Switch B] --- (Machine B0)&#xA;&#xA;                                             |&#xA;&#xA;                                             |&#xA;                                        (Machine B1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you could observe &lt;code&gt;Machine A0&lt;/code&gt; is physically connected to &lt;code&gt;switch A&lt;/code&gt; (respectively &lt;code&gt;machines B0,B1&lt;/code&gt; are physically connected to &lt;code&gt;switch B&lt;/code&gt;). &lt;code&gt;Switches A and B&lt;/code&gt; are connected directly to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Machine A0&lt;/code&gt; multicasts a message &lt;code&gt;m&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should m be dulplicated directly on &lt;code&gt;machine A0&lt;/code&gt;, on &lt;code&gt;switch A&lt;/code&gt; or on &lt;code&gt;switch B&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="13402" LastActivityDate="2015-06-03T19:31:26.493" Title="When do UDP multicast streams/frames diffuse?" Tags="|switch|multicast|udp|" AnswerCount="2" CommentCount="11" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18238" PostTypeId="2" ParentId="18223" CreationDate="2015-05-01T17:15:12.677" Score="2" Body="&lt;p&gt;You have some limitation in your network to 100mb/s as @YLearn said. It is either on the machine interface you are testing, router port or somewhere else.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;A Thumb Rule: A chain is only as strong as its weakest link.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="13402" LastEditorUserId="13402" LastEditDate="2020-07-30T17:55:43.390" LastActivityDate="2020-07-30T17:55:43.390" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18240" PostTypeId="1" CreationDate="2015-05-02T06:04:26.193" Score="2" ViewCount="3786" Body="&lt;p&gt;I need help configuring inter-VLAN routing. I am setting up 2 VLANs plus the admin VLAN 1 as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;RV042 is used as a firewall (i'll probably replace it with something else)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;LAN ip addr 10.1.1.10&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;SG300-10 connected to VLAN1 port&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;SG300-10 is my core switch.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;VLAN 1 (admin) - 10.1.1.1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;VLAN 2 (cameras) - 192.168.200.254&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;VLAN 3 (computers and 1 server) - 192.168.100.254&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ports 8 - 10 trunked&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;GVRP enabled&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;2 dhcp pool network setup on this switch&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;default route 0.0.0.0 0.0.0.0 10.1.1.10&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;SG300-28MP is my POE camera switch&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;VLAN 2 - 10.1.1.3&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;vlans created automatically through gvrp&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;vlans are replicated automatically from SG300-10, but not the names. Just the VLAN #.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ports 27, 28 trunked&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;SG200-50 is my computing lan switch&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;VLAN 3 - 10.1.1.2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;vlans created manually since I could not find anywhere to configure gvrp. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The SG200 switch does not support CLI. It is only configurable through the web interface.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I assume gvrp is not supported on this switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please see the attached image file for more details. I am also attaching the configuration files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help me figure this out please. At this point in time, I am not able to get the 3 SGx00 to route among each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Gdjlq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="15222" LastEditorUserId="15222" LastEditDate="2015-05-02T15:58:28.473" LastActivityDate="2015-05-02T15:58:28.473" Title="How can I configure intervlan routing using SG300-10, SG300-28MP, SG200-50 and RV042" Tags="|cisco|vlan|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18248" PostTypeId="2" ParentId="17642" CreationDate="2015-05-03T14:30:02.623" Score="2" Body="&lt;p&gt;Your configuration does not allow hair pinning. Which means, the traffic is not allowed to leave the ASA over the same interface which has been used to access it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please have a look at the command &quot;same-security-traffic intra-interface&quot; and be sure to include the pool for the VPN clients in the NAT rules. I think it's allready included, but maybe I'm missing something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Details can be found here: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/67986-pix7x-asa-client-stick.html&quot; rel=&quot;nofollow&quot;&gt;PIX/ASA and VPN Client for Public Internet VPN on a Stick Configuration Example&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15232" LastActivityDate="2015-05-03T14:30:02.623" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18255" PostTypeId="1" CreationDate="2015-05-03T18:19:59.903" Score="3" ViewCount="271" Body="&lt;p&gt;Hi I'm trying to sketch a computer network. &#xA;The network include about 50 computers for employees, 20 computers for tech office, a few network printers, a wifi area and every employee has an ipPhone. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MHWRv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MHWRv.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is the sketch I made, but I'm not sure about few things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it correct to link the ip phones to the pc or should they be connected directly to a switch? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is the dmz placed in a correct way? It should just keep a decent security level the mail server. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, is it a good configuration for the network or should I change something? I'm not sure this is the right forum where to ask, if not, can you please suggest me where to ask?&lt;/p&gt;&#xA;" OwnerUserId="15236" LastEditorUserId="16971" LastEditDate="2015-08-01T22:56:27.877" LastActivityDate="2016-01-29T03:15:00.123" Title="dmz and ip-phone on medium network" Tags="|ethernet|security|voip|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18260" PostTypeId="2" ParentId="18226" CreationDate="2015-05-04T02:45:58.630" Score="-5" Body="&lt;p&gt;That design and equipment choice is sub-optimal.  Cisco Nexus and/or 4500x switches are better value for 10G aggregation.  Access cross-chassis etherchannel to core is what you should do.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-04T02:45:58.630" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18261" PostTypeId="2" ParentId="18236" CreationDate="2015-05-04T02:52:21.337" Score="-1" Body="&lt;p&gt;The default behavior for a Layer 2 switch is to forward all multicast traffic to every port that belongs to the destination LAN on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP multicast is not in play unless there is a router (layer 3 device) between these end machines.  So, we are speaking here of Ethernet frames (not IP packets).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-04T02:52:21.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18264" PostTypeId="2" ParentId="7488" CreationDate="2015-05-04T03:24:25.087" Score="0" Body="&lt;p&gt;Looks complicated.  Instead of hairpinned ASA's put them inline (in between yes it doubles physical interface requirements but your company obviously has the money).  Simply have access and aggregation (core) design.  Get routers to route and switches to switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's about all I have...  Hope it helps?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-04T03:24:25.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18265" PostTypeId="2" ParentId="17604" CreationDate="2015-05-04T03:29:54.417" Score="-1" Body="&lt;p&gt;The router is going to reply to the source IP address of the SNMP packet, right?  I imagine that you would look in the routing table for the route to the subnet of the source packet to determine where the response goes.  Normally, this would be the same interface that it received that packet on.  You could always to some type of policy-based routing where you could force traffic desitned to [source address of SNMP packet] out of interface [whichever].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-04T03:29:54.417" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18268" PostTypeId="1" CreationDate="2015-05-04T04:00:51.440" Score="0" ViewCount="2799" Body="&lt;p&gt;My setup is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[internet] - Netgear FVS318N Router - Netgear GS752TP Smart Switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FVS318N port 1 connects to port 39 on GS752 Smart Switch&#xA;WNAP210 connects to port 48 on GS752 Smart Switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On GS752, VLAN10 is set to: port 39 as T, and port 48 as U.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On FVS918, I have configured two subnets with DHCP, one for VLAN1 and another for VLAN10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if I plug in a laptop to port 48 on the switch (as opposed to the WNAP210), the laptop gets an IP in the VLAN10 range and can browse the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I plug in the WNAP210, and connect a laptop to it wirelessly, the laptop gets an IP n the VLAN10 range, but can not browse the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The WNAP210 has a System &gt; Advanced page where the option is to set:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;802.1Q VLAN&lt;/li&gt;&#xA;&lt;li&gt;Untagged VLAN (checked or not), with a VLAN ID&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've tried every combination on that page, and still the same result.  Wondering if I need to configure a route on either the FVS318 or the GS752.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ROUTER&lt;/strong&gt;&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/UtumG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UtumG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/owQlY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/owQlY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/5iiuR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5iiuR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/6tZJI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6tZJI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/HjuMl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HjuMl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SWITCH&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/xAMo4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xAMo4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nfWxZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nfWxZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yrD2p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yrD2p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/I73gu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I73gu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/5Torl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5Torl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SSt9M.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SSt9M.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/zZBR1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zZBR1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;AP&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/p1ROH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p1ROH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kTmp4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kTmp4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/IA0Zg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IA0Zg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/xvvSD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xvvSD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;" OwnerUserId="15153" LastEditorUserId="3191" LastEditDate="2015-05-05T08:05:59.127" LastActivityDate="2015-05-06T18:19:53.710" Title="VLAN: No internet access" Tags="|vlan|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="18280" PostTypeId="1" AcceptedAnswerId="18283" CreationDate="2015-05-04T15:42:54.040" Score="13" ViewCount="57970" Body="&lt;p&gt;As it is clear from the title, why do switches need ARP tables when the translation are done on the machines side?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Roughly saying, why there are two ARP tables on machines and on switches? Is not the one on the switch sufficient?&lt;/p&gt;&#xA;" OwnerUserId="13402" LastEditorUserId="13402" LastEditDate="2015-05-05T06:57:26.557" LastActivityDate="2018-05-05T22:24:21.723" Title="Why do switches need ARP tables when the translation are done on the machines side?" Tags="|switch|arp|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18281" PostTypeId="1" CreationDate="2015-05-04T16:20:12.697" Score="3" ViewCount="1455" Body="&lt;p&gt;&lt;em&gt;Cisco IP phone 7960&lt;/em&gt; has two RJ45 sockets at back panel. One of those ports has &quot;10/100 SW&quot; label above and other port has &quot;10/100 PC&quot; label. According to &quot;Network Port 2 Device Type&quot; under phone &quot;Network Setup&quot; menu it is a &quot;Hub/Switch&quot;. If I view the MAC address table from switch where the phone is connected to, then I see following information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Destination Address  Address Type  VLAN  Destination Port&#xA;-------------------  ------------  ----  --------------------&#xA;000a.b42f.54bb       Dynamic        105  FastEthernet0/2&#xA;0030.94c3.1597       Dynamic        105  FastEthernet0/2&#xA;0030.94c3.1597       Dynamic        909  FastEthernet0/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;000a.b42f.54bb&lt;/em&gt; is the MAC address of my PC and &lt;em&gt;0030.94c3.1597&lt;/em&gt; is the MAC address of the phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct that &lt;em&gt;Cisco IP phone 7960&lt;/em&gt; has a two port switch? Why is there a MAC address table entry for &lt;em&gt;0030.94c3.1597&lt;/em&gt; in VLAN 105 when according to phone the operational VLAN ID is 909?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-05-05T01:21:34.463" Title="Understand the behavior for hub/switch in Cisco IP phone 7960" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18283" PostTypeId="2" ParentId="18280" CreationDate="2015-05-04T17:38:45.463" Score="28" Body="&lt;p&gt;This is a pretty common misconception or more specifically, a terminology problem.  In a layer two switch, there is not an ARP table, only a forwarding table.  The switch records each src MAC address it sees inbound in the forwarding table, and attributes it to the port so frames with a dst MAC will only get sent to the port known for that MAC.  Many people call this an &quot;arp table&quot; or &quot;arp cache&quot; even though it is neither.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a managed layer two switch, there is a forwarding table plus an ARP table but the latter is only used for the management interface to talk to interested hosts (i.e. the PC you are using to configure the switch.)  In a managed layer 3 switch there will be a forwarding table plus an ARP table, since it needs it for the management interface plus router functionality exists to perform forwarding between subnets.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-05-04T17:38:45.463" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18284" PostTypeId="2" ParentId="18280" CreationDate="2015-05-04T17:54:00.433" Score="2" Body="&lt;p&gt;As you probably already know, the purpose of the ARP table is to translate network layer addresses into link layer addresses.  i.e. IP addresses to MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tables you refer to aren't quite complete.  Layer 2 switches also have two kinds of tables:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;an ARP table that's used to communicate with the switch &quot;as a computer&quot; for interfacing with its controls.  Well, it will have this if it's a &lt;em&gt;managed&lt;/em&gt; switch&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;a table that relates switch ports to MAC addresses&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Example1: If a PC launches a packet, it will use the MAC address if the IP address is local (from the ARP table).  When that packet reaches a switch, the switch will move the packet to the appropriate port based on the MAC address (from the switches port/MAC table).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example2: If a switch launches a packet from its management interface then it does the same thing as a PC would do using its ARP table.  But, if a switch launches a packet from its switching function then it is simply moving that packet from one port to another according to its port/MAC table.&lt;/p&gt;&#xA;" OwnerUserId="15237" LastActivityDate="2015-05-04T17:54:00.433" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18285" PostTypeId="2" ParentId="18280" CreationDate="2015-05-04T17:54:24.570" Score="7" Body="&lt;p&gt;Every device utilizing the IP protocol has an ARP table. Since IP is an L3 protocol and requires an underlying L2 protocol, this is a requirement for a device to be able to translate an L3 IP address to its corresponding L2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether your device is communicating to an IP address on the local network or not, it has to send it's L2 traffic (to keep it simple, let's exclude broadcast and multicast from this discussion) to a specific device on the local L2 domain. If the IP address is on the local network, this would be direct to the destination device.  If not, this would be the device functioning as the gateway or router for the local network which can forward the L3 traffic towards its destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a switch isn't using the IP protocol at all (i.e. it doesn't even provide any sort of management over IP, no L3 functionality, etc), then it doesn't need an ARP table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am not aware of an enterprise switch platform that does not utilize the IP protocol. Telnet, SSH, HTTP, HTTPS, and SNMP are just a few examples of the commonly supported services of an enterprise switch that would require access to IP.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2018-05-05T22:24:21.723" LastActivityDate="2018-05-05T22:24:21.723" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18286" PostTypeId="2" ParentId="18281" CreationDate="2015-05-05T01:21:34.463" Score="5" Body="&lt;p&gt;It really is a 3 port switch:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One port connects to the PC &lt;/li&gt;&#xA;&lt;li&gt;One port connects to the upstream switch&lt;/li&gt;&#xA;&lt;li&gt;One port connects internally to the phone&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The reason you see the MAC address on V105 is that the internal switch sends CDP, LLDP, STP, etc on the native VLAN, using that MAC address. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-05T01:21:34.463" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18287" PostTypeId="2" ParentId="5423" CreationDate="2015-05-05T02:28:58.010" Score="2" Body="&lt;p&gt;From EX9000 Series, Juniper does support MC-LAG&lt;/p&gt;&#xA;" OwnerUserId="15259" LastActivityDate="2015-05-05T02:28:58.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18290" PostTypeId="1" AcceptedAnswerId="19363" CreationDate="2015-05-05T05:43:55.423" Score="3" ViewCount="624" Body="&lt;p&gt;I'm working on developing a transport protocol layered directly atop IP and while performing an experiment to see how routers on the internet would react to an undefined protocol I've observed some unusual behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My experiment involves sending a plain IPv4 packet from one host on the public internet to another. Both hosts are typical home-user setups:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;[Host] -&amp;gt; [Router/Modem Billion 7300GRA] -&amp;gt; (Internet)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simple enough right? Well apparently not as what I'm observing is that although the packets are being received, there is a pattern where-in the first 4 bytes of every other packet's payload is being nulled. Below is a sample:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000   00 1c c0 93 6a 7f 00 04 ed 9b 53 26 08 00 45 00  ....j.....S&amp;amp;..E.&#xA;0010   00 1d 37 ff 00 00 70 fd 27 2b 3a a2 ef 6d c0 a8  ..7...p.'+:..m..&#xA;0020   00 02 00 00 00 00 4d 53 47 00 01 aa 00 00 4d 53  ......MSG.....MS&#xA;0030   00 00 00 00 88 64 63 78 00 00 0b 00              .....dcx....&#xA;&#xA;0000   00 1c c0 93 6a 7f 00 04 ed 9b 53 26 08 00 45 00  ....j.....S&amp;amp;..E.&#xA;0010   00 1d 38 08 00 00 70 fd 27 22 3a a2 ef 6d c0 a8  ..8...p.'&quot;:..m..&#xA;0020   00 02 54 45 53 54 4d 53 47 00 02 aa 53 54 4d 53  ..TESTMSG...STMS&#xA;0030   00 00 00 00 88 64 65 78 00 00 0b 00              .....dex....&#xA;&#xA;0000   00 1c c0 93 6a 7f 00 04 ed 9b 53 26 08 00 45 00  ....j.....S&amp;amp;..E.&#xA;0010   00 1d 38 15 00 00 70 fd 27 15 3a a2 ef 6d c0 a8  ..8...p.'.:..m..&#xA;0020   00 02 00 00 00 00 4d 53 47 00 03 aa 00 00 4d 53  ......MSG.....MS&#xA;0030   00 00 00 00 88 64 1e bc 80 00 33 db              .....d....3.&#xA;&#xA;0000   00 1c c0 93 6a 7f 00 04 ed 9b 53 26 08 00 45 00  ....j.....S&amp;amp;..E.&#xA;0010   00 1d 38 21 00 00 70 fd 27 09 3a a2 ef 6d c0 a8  ..8!..p.'.:..m..&#xA;0020   00 02 54 45 53 54 4d 53 47 00 04 aa 53 54 4d 53  ..TESTMSG...STMS&#xA;0030   00 00 00 00 88 64 04 00 00 00 89 ff              .....d......&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This pattern continues seemingly ad infinitum. The payload structure is expected to be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[8 bytes] &quot;TESTMSG\0&quot;&#xA;[1 bytes] A counter incremented per packet (added to verify it wasn't some strange ordering issue)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm also using 0xFD as the transport protocol identifier in the IP header as it's designated by IANA for &quot;experimental use&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've verified it's not a programming error at the sender via Wireshark and I've also reversed the tx/rx roles between hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current hypothesis is that the problem lies with one of the routers of which both hosts sit behind so I'm hoping maybe if someone here has knowledge of their firmware implementation they could shed some light on this. (The fact it's the first 4 bytes suggests to me it may have to do with NAT since that offset correlates with the src/dst ports of TCP/UDP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Matt&lt;/p&gt;&#xA;" OwnerUserId="15260" LastEditorUserId="775" LastEditDate="2015-06-20T09:14:26.310" LastActivityDate="2015-06-22T15:53:09.063" Title="Strange IP packet payload corruption" Tags="|router|ipv4|nat|internet|" AnswerCount="2" CommentCount="7" ClosedDate="2015-06-22T17:24:01.213" ContentLicense="CC BY-SA 3.0" />
  <row Id="18292" PostTypeId="1" CreationDate="2015-05-05T08:37:36.420" Score="1" ViewCount="582" Body="&lt;p&gt;I have created a testing scenario in VMWare for a man in the middle attack using DHCP spoofing. It's for a college project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Windows 8 machine bridged to host adapter&#xA;Kali linux bridged to host adapter&#xA;Host connected to router X.X.X.1/24&#xA;Using ettercap I'm trying to give a fake DHCP lease, pointing to Kali linux ip address X.X.X.161. However Windows 8 refuses to accept the DHCP offer, even tough it arrives before router's offer (tested with wireshark). Tried: ipconfig /release &amp;amp; ipconfig /renew&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read Windows prefer to select a DHCP offer of a previous accepted gateway address. But I tried to disable/reinstall network card and restart Windows. No change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the criteria for select a DHCP offer when there are more than one? I read everywhere that the one wich arrives first is selected, but it doesn't appears to be the case.&lt;/p&gt;&#xA;" OwnerUserId="15262" LastActivityDate="2015-05-05T14:24:51.950" Title="Multiple DHCP Offers - Which is selected?" Tags="|ipv4|protocol-theory|dhcp|security|" AnswerCount="1" CommentCount="1" ClosedDate="2019-06-21T00:21:47.963" ContentLicense="CC BY-SA 3.0" />
  <row Id="18293" PostTypeId="2" ParentId="11059" CreationDate="2015-05-05T09:03:38.383" Score="1" Body="&lt;p&gt;This part number is only 1GE &lt;code&gt;740-038291&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This part number is 10/100/1000 &lt;code&gt;740-013111&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="15264" LastEditorUserId="33" LastEditDate="2015-05-05T18:39:03.900" LastActivityDate="2015-05-05T18:39:03.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18294" PostTypeId="1" CreationDate="2015-05-05T10:48:16.263" Score="1" ViewCount="412" Body="&lt;p&gt;I have a 2851 VoIP router (CME) with four E1 ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One port is configured as normal E1 PRI, and it is connected to PSTN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to configure another E1 port as a CAS signalling E1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to be able to convert (inside the router) the e1 PRI to e1 CAS signalling, and also forward calls that come in in the PRI port to go to the CAS port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, firstly, I need to configure a CAS port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found some examples, but there are a lot of variables, and I am not really sure which ones to use.&lt;/p&gt;&#xA;" OwnerUserId="15266" LastEditorUserId="8499" LastEditDate="2016-03-31T19:19:39.820" LastActivityDate="2016-03-31T19:19:39.820" Title="Configure E1 CAS signalling on a 2851 router" Tags="|cisco|routing|router|telephony|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18295" PostTypeId="2" ParentId="18292" CreationDate="2015-05-05T14:24:51.950" Score="2" Body="&lt;p&gt;I have troubleshooted this in a real scenario. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Windows 7 with Wifi Intel driver, it just gets the first DHCP offer to arrive. &lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2015-05-05T14:24:51.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18296" PostTypeId="1" CreationDate="2015-05-05T15:49:42.947" Score="1" ViewCount="141" Body="&lt;p&gt;I am a beginner in networking. What I do not quite understand about establishing site to site VPN connections is - what happens when you connect 2 networks and 2 servers have identical private IP addresses?&lt;/p&gt;&#xA;" OwnerUserId="15270" LastActivityDate="2015-05-05T16:06:54.703" Title="Understanding site to site VPNs with overlapping IP addresses" Tags="|vpn|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18297" PostTypeId="2" ParentId="18296" CreationDate="2015-05-05T16:06:54.703" Score="3" Body="&lt;p&gt;You end up having to do something called double NAT.  You NAT each side to a different network, tricking the two endpoints to pass traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a bit complicated and not very elegant, but the only way to make it work.&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2015-05-05T16:06:54.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18298" PostTypeId="1" CreationDate="2015-05-05T16:21:05.577" Score="2" ViewCount="1785" Body="&lt;p&gt;Here is the setup I have 2 networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st one (this one is our old one and it is working great.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip address 10.22.227.X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;subnet mask 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DFG 10.22.227.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2nd one (this is our new network that is not working right)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip address 10.22.226.X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;subnet mask 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DFG 10.22.226.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping 10.22.227.131 from the 226 network but i can not ping 10.22.226.66 from the 227 network. (226.66 is my laptop 227.131 is my pc)&#xA;I can see the files on the 227 computer seams as thought i have directional network.... I also have no internet on the 226 network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the running config file from the router that connects the 226 and the 227 network together. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show running-conf&#xA;Building configuration...&#xA;Current configuration : 894 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$ngyI$dZN2sb5gHUYC2A37wLRQM1&#xA;enable password united2315&#xA;!&#xA;no aaa new-model&#xA;!&#xA;resource policy&#xA;!&#xA;mmi polling-interval 60&#xA;no mmi auto-configure&#xA;no mmi pvc&#xA;mmi snmp-timeout 180&#xA;ip subnet-zero&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; description 0/0 10.22.227.254&#xA; ip address 10.22.227.253 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; description 0/1 10.22.226.254&#xA; ip address 10.22.226.254 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;no ip classless&#xA;ip route 10.22.226.0 255.255.255.0 10.22.227.254&#xA;ip route 10.22.227.0 255.255.255.0 10.22.227.254&#xA;!&#xA;no ip http server&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line vty 0&#xA; password cisco&#xA; login&#xA;line vty 1 4&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 227 network is managed by another company  they have provided me with this info.....&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 8.8.4.4 255.255.255.255 10.22.227.253 name TEST-TO-CLIENT-ROUTER       &amp;lt;=-- Added a test route &#xA;ip route 10.22.226.0 255.255.255.0 10.22.227.253 name CLIENT-NETWORK          &amp;lt;=-- Added a route to the clients device &#xA;s1.pryor#&#xA;s1.pryor#ping 10.22.227.253 &amp;lt;=-- I can Ping to the Clients device &#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.22.227.253, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/4/9 ms&#xA;s1.pryor#&#xA;s1.pryor#sho ip arp 10.22.227.253&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  10.22.227.253           1   0023.33e8.5c96  ARPA   Vlan1                                     &amp;lt;=-- Got an ARP and MAC address for the Clients device &#xA;s1.pryor#&#xA;&#xA;&#xA;s1.pryor#ping 8.8.4.4 &amp;lt;=-- Can not ping pass the Clients Device &#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 8.8.4.4, timeout is 2 seconds:&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;s1.pryor-chv.robertsautoctr&#xA;&#xA;================================&#xA;The routes in place I was able to Ping to the clients device but not pass it &#xA;They will re-configure their router and call us back&#xA;Our routes in place&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am i doing wrong that i dont have internet and local network?&#xA;they told me they have routed the internet over to our 226 network all ready as well...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See screen shot for network setup&lt;img src=&quot;https://i.stack.imgur.com/O1qVv.png&quot; alt=&quot;See network setup here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14856" LastEditorUserId="775" LastEditDate="2015-06-20T16:56:45.430" LastActivityDate="2015-06-20T16:56:45.430" Title="Cisco router help! No internet and only can ping one way" Tags="|cisco|routing|router|internet|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18299" PostTypeId="2" ParentId="18298" CreationDate="2015-05-05T16:33:09.880" Score="0" Body="&lt;p&gt;If you can ping one way but not the other. In my experience it has always been a firewall somewhere. Check software firewalls on device, or maybe investigate a firewall you don't know about yet.&lt;/p&gt;&#xA;" OwnerUserId="6273" LastActivityDate="2015-05-05T16:33:09.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18300" PostTypeId="2" ParentId="18298" CreationDate="2015-05-05T16:39:24.993" Score="2" Body="&lt;p&gt;Modern Windows is not pingable by default.  Disable Windows Firewall (or add an ICMP Echo rule) and try again.&lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2015-05-05T16:39:24.993" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18301" PostTypeId="2" ParentId="18294" CreationDate="2015-05-05T17:12:31.107" Score="-2" Body="&lt;p&gt;Couple of potential gotchas are clocking (clock-source) and restrictions on the actual e1 VIC/MFT card.  Have a look at the data sheet or configuration guide or release notes for that model card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/voice/digital-cas/53049-e1-r2-cookbook.html&quot; rel=&quot;nofollow&quot;&gt;see here&lt;/a&gt; for how to configure cas e1 per country.  You might find other docs as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How the PRI is getting terminated is important as well.  Is the PRI D-channel getting back hauled to a callmanager or is it terminated local on the router.  If back hauled you may need to look into cm version configuration or support details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.  Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-05T17:12:31.107" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18303" PostTypeId="2" ParentId="18255" CreationDate="2015-05-05T17:32:10.700" Score="2" Body="&lt;p&gt;Yes the IP phones plug into the wall jack and the computers then plug into (daisy chain) the IP phones.  This reduces the Ethernet ports count, power and cooling cost, wiring cost, and has virtually zero impact on LAN bandwidth.  Your Exchange server goes on the inside network, not the DMZ (see &lt;a href=&quot;https://technet.microsoft.com/en-us/library/bb232184(EXCHG.80).aspx&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-05T17:32:10.700" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18305" PostTypeId="2" ParentId="18290" CreationDate="2015-05-05T23:08:14.600" Score="-2" Body="&lt;p&gt;Reconfigure your ISP modem to assign publicly routable IP addresses to the test computers/routers so to avoid NAT/PAT alltogether.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are you doing this?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-06-22T15:53:09.063" LastActivityDate="2015-06-22T15:53:09.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18306" PostTypeId="2" ParentId="13413" CreationDate="2015-05-05T23:15:02.727" Score="0" Body="&lt;p&gt;You need to syslog the relevant client data to your central management server(s).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-05T23:15:02.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18308" PostTypeId="2" ParentId="17604" CreationDate="2015-05-06T02:46:25.647" Score="0" Body="&lt;p&gt;Not being a JunOS expert, but in Cisco-land the &lt;code&gt;snmp source-address x.x.x.x&lt;/code&gt; command would fix your issue. Here's the JunOS documentation I was able to locate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Syntax&#xA;source-address address;&#xA;Hierarchy Level&#xA;[edit snmp trap-options]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos14.2/topics/reference/configuration-statement/source-address-edit-snmp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/en_US/junos14.2/topics/reference/configuration-statement/source-address-edit-snmp.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-05-06T02:46:25.647" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18309" PostTypeId="2" ParentId="18298" CreationDate="2015-05-06T03:20:59.133" Score="3" Body="&lt;p&gt;These configured routes should be removed from your configuration since they are directly connected:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.22.226.0 255.255.255.0 10.22.227.254&#xA;ip route 10.22.227.0 255.255.255.0 10.22.227.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also you do not have a default route configured, so you probably need this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 10.22.227.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In regards to the other company's testing, since the PC's are using 10.22.227.254 as their gateway, the 'test' route pointing 8.8.4.4 is pointless, if it works it only proves that your router is hairpinning traffic back to its default next-hop.  A better test would be to 10.22.226.254.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="3912" LastEditDate="2015-05-06T03:26:00.397" LastActivityDate="2015-05-06T03:26:00.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18311" PostTypeId="1" AcceptedAnswerId="18326" CreationDate="2015-05-06T07:37:16.400" Score="0" ViewCount="187" Body="&lt;p&gt;My network has a server that does DHCP, and I have a switch that connects multiple computers. Currently I have a wireless backup solution that works subpar and I would like to get ADSL up and running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I plug the router into the network I cannot ping its ip address, however when I directly plug my pc into the router I can ping its ip. Usually it works for less than 5 minutes on the network before I lose internet connection, and cannot ping the router anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I overlooking something simple, or is more info required?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested with multiple ports and network cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/P4v92.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A new router was installed on the network which gave out DHCP which I was not taking into consideration. This caused my issue.&lt;/p&gt;&#xA;" OwnerUserId="15276" LastEditorUserId="15276" LastEditDate="2015-05-07T05:57:56.843" LastActivityDate="2015-05-07T05:57:56.843" Title="Why does my router get kicked off network?" Tags="|switch|router|ipv4|dhcp|" AnswerCount="1" CommentCount="6" ClosedDate="2015-05-07T03:20:33.307" ContentLicense="CC BY-SA 3.0" />
  <row Id="18313" PostTypeId="1" AcceptedAnswerId="18314" CreationDate="2015-05-06T11:35:41.340" Score="2" ViewCount="1434" Body="&lt;p&gt;I am brand new to this (Cisco Log Analysis) and I need some help with the meaning of Cisco Log messages.&#xA;I have read a bit on the Cisco website and got up to speed but I need a bit of fine tuning so please indulge me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, I have two lines pasted below from one of my logs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2463: 006076: Dec 28 22:35:08: %LINK-3-UPDOWN: Interface FastEthernet0/33, changed state to down&#xA;2464: 006077: Dec 28 22:35:12: %LINK-3-UPDOWN: Interface FastEthernet0/33, changed state to up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The way I have understood it is that the first numbers are sequence numbers followed by the date stamp. After the % sign, there is the source, the severity and a mnemonic code that is related to the message, followed by the detailed message itself.&#xA;In this case, severity '3' refers to 'error condition'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question 1 - what would cause the link to change state to 'down' ?&#xA;Question 2 - why should it be an 'error' when the interface changes state from down to up ?&lt;/p&gt;&#xA;" OwnerUserId="15282" LastEditorUserId="59" LastEditDate="2015-05-07T20:11:15.500" LastActivityDate="2015-05-07T20:11:15.500" Title="Interpreting Cisco logs for interface link state change" Tags="|cisco|switch|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18314" PostTypeId="2" ParentId="18313" CreationDate="2015-05-06T12:24:09.970" Score="5" Body="&lt;p&gt;When the link goes down the cable was removed, damaged or the other side shut (disabled) the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The severities are exactly that, Ciscos estimate on how severe a condition is. It may not be an &quot;error&quot; in your case but when a port suddenly goes down (especially without apparent reason) this could be something severe in many situations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't think that this is an error in your setup (for example when the interface connects to a host that is turned off/rebooted regularly) you can always disable logging of this message with the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;conf t&#xA;interface FastEthernet0/33&#xA; no logging event link-status&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="59" LastActivityDate="2015-05-06T12:24:09.970" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18315" PostTypeId="1" AcceptedAnswerId="18325" CreationDate="2015-05-06T13:39:43.343" Score="9" ViewCount="2474" Body="&lt;p&gt;Cisco's &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/QoS_SRND/QoS-SRND-Book.pdf&quot; rel=&quot;noreferrer&quot;&gt;Enterprise QoS Solution Reference Network Design&lt;/a&gt; suggests classifying NTP as network management traffic and marking it as CS2:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When addressing the QoS needs of Network Management traffic, Cisco recommends the following guidelines:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Network Management traffic should be marked to DSCP CS2.&lt;/li&gt;&#xA;&lt;li&gt;Network Management applications should be explicitly protected with a minimal bandwidth guarantee.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Network management traffic is important to perform trend and capacity analysis and troubleshooting. Therefore, &lt;strong&gt;you can provision a separate minimal bandwidth queue for Network Management traffic, which could include SNMP, &lt;em&gt;NTP&lt;/em&gt;, Syslog, NFS and other management applications&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Given that NTP is jitter-sensitive, why isn't NTP marked as Expediated Forwarding and treated the same as voice data?&lt;/p&gt;&#xA;&lt;p&gt;Is there a reason why it should not be placed in the same low latency queue as voice?&lt;/p&gt;&#xA;" OwnerUserId="1911" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-06-05T22:26:00.750" Title="Which QoS classification should be applied to NTP?" Tags="|cisco|qos|best-practices|ntp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18316" PostTypeId="1" CreationDate="2015-05-06T15:30:52.723" Score="2" ViewCount="2404" Body="&lt;p&gt;I have been handed a fun job at work of breaking up a flat network into 4 vlans.  This is my first &quot;beginning to end&quot; network project and I have a pretty good idea of what needs to happen, but its been my experience that what I have learned from books and what actually needs to happen can be different.  My rough plan is below, details left out for brevity.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware involved:&#xA;SG200 switches x 3 (one of these SG200s is acting as an access switch, the other two are &quot;core&quot; switches in the server room).  The &quot;access&quot; switch will have all of its ports in one VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sophos firewall (for routing)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ID nodes via mac address; find this mac address in the switch(s) and&#xA;document which port that mac is associated with, then assign it to a&#xA;VLAN.  &lt;/li&gt;&#xA;&lt;li&gt;Setup Router on a stick using a sophos firewall that is in    place.&#xA;ROAS is due to budget constraints, they turned down the L3    switch&#xA;proposal.  I have setup this config before and don't have any&lt;br&gt;&#xA;questions about this part.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The Microsoft server (2008R2) will handle    DHCP for each vlan.  I&#xA;have a working multi-vlan DHCP server setup I    can clone from&#xA;another client to make this work and it seems pretty    straight&#xA;forward (but again, assumptions like this can be what slows    me&#xA;down).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice on setting this up? Some of my questions and self doubt are below:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I have this feeling I need to put a &quot;gateway of last resort&quot; into the&#xA;switches in order to make this work, but I am uncertain.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I am a little in the dark on what will happen with the access switch.  I know it will need to trunk to the core and the trunk will need to pass the single VLAN needed (which I can configure), can I just leave this as an &quot;open&quot; trunk?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thats the big pieces that I can think of at this time, I need to put it on paper and pick it apart.  I would like to see some feedback from anyone else though, its very helpful when you are starting from nothing.  Any considerations before I go to far down this road...?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A great overview of the process is found here (Evan Anderson's post):&#xA;&lt;a href=&quot;https://serverfault.com/questions/54417/best-way-to-segment-traffic-vlan-or-subnet&quot;&gt;https://serverfault.com/questions/54417/best-way-to-segment-traffic-vlan-or-subnet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it lacks a few of the details that have me worried (gateway of last resort for instance).  &lt;/p&gt;&#xA;" OwnerUserId="15283" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-05-06T18:31:22.747" Title="Splitting up a flat network into VLANs" Tags="|vlan|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18319" PostTypeId="1" AcceptedAnswerId="18335" CreationDate="2015-05-06T16:46:56.430" Score="5" ViewCount="3899" Body="&lt;p&gt;Traditional 802.3ad link aggregation only works when all of the links in the group are going to/from the same devices/switches. So you couldn't have a system with one half of a bonded link going into switch A and the other half going into switch B and expect LACP to work. I suppose STP (if enabled) should block one of them to prevent a loop. Is that correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realise that bonding/trunking can only provide double bandwidth in specific circumstances, e.g. when there are separate communication flows. It wouldn't give double the bandwidth if both source and destination are the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm looking for is a way of connecting 2 switches together with multiple links to provide &lt;code&gt;N&lt;/code&gt; times the bandwidth between them. &#xA;I guess with LACP on the uplink ports between the 2 switches the bandwidth would still be limited to each discrete traffic flow:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;so traffic flows from switch-port &lt;code&gt;A-3&lt;/code&gt; to &lt;code&gt;B-9&lt;/code&gt; and &lt;code&gt;B-4&lt;/code&gt; to &lt;code&gt;A-8&lt;/code&gt; would each be able to hit close to 1Gbps (supposing there are 2 links in LACP)&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;but &lt;code&gt;A-6&lt;/code&gt; to &lt;code&gt;B-3&lt;/code&gt; would not be able to exceed 1Gbps&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is my understanding above all correct?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are there any vendor-specific implementations/extensions that can allow a single physical server to run LACP across 2 switches?&lt;br&gt;&#xA;I suppose this is where stackable switches come in? Multiple physical switches configured as a single logical switch?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are there any vendor-specific implementations/extensions that can increase the bandwidth of a single traffic flow by simultaneously using multiple links?&lt;br&gt;&#xA;EDIT: On further thought this would be useless, as the rate of data going into switch would still only be the bandwidth of a single port. Unless your server was connected to a 1Gbps port but the switches were connected together using a pair of 100Mbps ports.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15284" LastEditorUserId="15284" LastEditDate="2015-05-06T16:53:29.633" LastActivityDate="2015-05-07T01:13:19.080" Title="Bond switch uplinks together for double bandwidth between switches" Tags="|switch|ieee-802.1ax|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18322" PostTypeId="2" ParentId="18319" CreationDate="2015-05-06T17:50:21.210" Score="-1" Body="&lt;p&gt;Many LAN switches have the ability to stack whereby they operate as a single logical device (e.g. some Juniper and Cisco).  In these cases, multi-chassis etherchannel is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your switches cannot be logically converged, operating as a single switch, then you can achieve full link utilization across several links using IP load balancing.  You would configure a unique subnet per uplink then use a routing protocol to balance the traffic across the links.  Of course, this requires layer 3 switches (aka switches with routing capability).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-06T17:50:21.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18323" PostTypeId="2" ParentId="18268" CreationDate="2015-05-06T18:19:53.710" Score="2" Body="&lt;p&gt;You have a gateway (security appliance / router), a switch, and an access point.  You want 4 VLANs - default, voice, video, and guest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to configure each of these VLANs with a unique subnet and IP address in your gateway.  The IP address assigned to the gateway is the default gateway for each VLAN/subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch and AP should have a management IP address assigned to them from the default VLAN/subnet (e.g. 10.0.0.1 in your case) and their default gateway is the IP address of the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.0.0.1/24 = gateway&#xA;10.0.0.2/24 = switch&#xA;10.0.0.3/24 = AP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK, now: how to connect the gateway and AP to the switch.  Trunk ports are necessary to carry the multiple VLANs to the AP and gateway.  The AP needs to see all VLANs so it can assign clients to either default or guest, as does the gateway (so it can route between the VLANs/subnets).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure trunking to both AP and gateway.  802.1q should be an option and your default vlan should be VLAN1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your AP will need to have unique SSID's per VLAN/subnet with each it's own security policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your gateway will need to have NAT/PAT enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does that help?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-06T18:19:53.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18324" PostTypeId="2" ParentId="18316" CreationDate="2015-05-06T18:31:22.747" Score="2" Body="&lt;p&gt;Do you want to multi-home the access switch?  You should, however this complicates the configuration.  Since you did not specify this, I will assume you do not want to multi-home (a link to each core switch from the access switch).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the access switch is flat (single VLAN) therefore no trunking required between it and one of the 2 core switches.  Simply be sure the default VLAN is enabled on the uplink port of each switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The core switches need to be trunking between them to carry frames from each VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The gateway (router +security appliance) needs to be trunking to whichever core switch it plugs into (assuming no dual homing).  The default VLAN should be present on each interface of this uplink, along with all 3 other VLANs.  The gateway needs to be configured with an IP address for each VLAN/subnet so that it can route between them.  Each VLAN/subnet's default gateway address is the address of the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-06T18:31:22.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18325" PostTypeId="2" ParentId="18315" CreationDate="2015-05-06T18:36:48.050" Score="2" Body="&lt;p&gt;Edited answer:  NTP should be placed in the EF class (same as real-time voice packets) according to the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4594#page-50&quot; rel=&quot;nofollow noreferrer&quot;&gt;IETF's RFC 4594 Configuration Guidelines for DiffServ Service Classes&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;5.2.  Mapping for NTP&lt;br&gt; &lt;br&gt;    From tests that were performed, indications are that precise time    distribution requires a very low&#xA;packet delay variation (jitter)    transport.  Therefore, we suggest&#xA;that the following guidelines for    Network Time Protocol (NTP) be&#xA;used:&lt;br&gt; &lt;br&gt;    o  When NTP is used for providing high-accuracy&#xA;timing within an&#xA;administrator's (carrier's) network or to end users/clients, the&#xA;Telephony service class should be used, and NTP packets should be&#xA;marked with EF DSCP value.&lt;br&gt;&lt;br&gt;    o  For applications that require &amp;quot;wall clock&amp;quot; timing accuracy, the&#xA;Standard service class should be used, and packets should be&#xA;marked with DF DSCP.&lt;br&gt; &lt;br&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-06-05T22:26:00.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18326" PostTypeId="2" ParentId="18311" CreationDate="2015-05-06T18:43:52.670" Score="2" Body="&lt;p&gt;The new DSL router/modem has 2 interfaces - LAN and WAN.  Out of the box, it is likely providing DHCP services on to the LAN (serving up IP addresses).  You need to log in to the management GUI on that new DSL router and turn this off.  You then need to assign a static IP address to the LAN interface - an address that is on the subnet/VLAN switchport that it plugs into.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, the new DSL router needs to be told of the other private IP address subnets that exist on your network so that devices on other subnets can be reached by the new DSL router.  This is probably as easy as adding routes to the routing table telling it that these are reachable via the primary gateways IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, how to handle the switching of the default gateway between primary and secondary (new DSL router) if primary WAN is down.  That is doable in a number of standards-based ways but alot of times your gateway will have some proprietary method of doing this.  It can be simple of very complex config becuase remember, sometimes a primary WAN outage is NOT accompanied by a link outage.  You want to research alternate routing, failover routing in the devices documentation to get sample configs.  Or, post the device make/model here.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-06T18:43:52.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18327" PostTypeId="1" AcceptedAnswerId="18328" CreationDate="2015-05-06T18:48:33.367" Score="1" ViewCount="736" Body="&lt;p&gt;We have been recently assigned new public IPs by ARIN but we have been having trouble with IP Geolocation. Some services block our IPs saying they are outside the US, others locate us in the geographic center of the US, not anywhere near where we are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our WhoIS records for our IPs and AS number all have our correct address and the location for our BGP peers is correct, so it would seem all the necessary information is available. Is there anything that can be done to update the various 3rd party IP Geolocation databases?&lt;/p&gt;&#xA;" OwnerUserId="15289" LastActivityDate="2015-05-06T19:06:17.027" Title="Update IP Geolocation for new public IPs" Tags="|ipv4|" AnswerCount="1" CommentCount="0" ClosedDate="2019-06-21T21:24:26.223" ContentLicense="CC BY-SA 3.0" />
  <row Id="18328" PostTypeId="2" ParentId="18327" CreationDate="2015-05-06T19:06:17.027" Score="1" Body="&lt;p&gt;Unfortunately as you encounter situations where geolocation is incorrect you have to track down the geolocation provider and ask them to update their database. Some provide web forms for this purpose.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;MaxMind: &lt;a href=&quot;https://www.maxmind.com/en/correction&quot; rel=&quot;nofollow&quot;&gt;https://www.maxmind.com/en/correction&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Google: &lt;a href=&quot;https://support.google.com/websearch/contact/ip&quot; rel=&quot;nofollow&quot;&gt;https://support.google.com/websearch/contact/ip&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2015-05-06T19:06:17.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18330" PostTypeId="1" AcceptedAnswerId="18331" CreationDate="2015-05-06T22:20:14.700" Score="9" ViewCount="30805" Body="&lt;p&gt;Is there any impact on bandwidth when choosing fast (1s) LACPDU timing rather than slow (30s)?&lt;br&gt;&#xA;Anyone ever bothered to measure?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've always assumed it's negligable, with the simple act of bonding probably adding more overhead than any LACPDUs&lt;/p&gt;&#xA;" OwnerUserId="15284" LastActivityDate="2016-10-22T00:35:36.300" Title="LACP rate slow vs fast... impact on bandwidth?" Tags="|ieee-802.1ax|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18331" PostTypeId="2" ParentId="18330" CreationDate="2015-05-07T00:32:11.110" Score="13" Body="&lt;p&gt;An LACP PDU is around 110 &lt;strong&gt;&lt;em&gt;bytes&lt;/em&gt;&lt;/strong&gt;, so running them every second isn't likely to even register on an Ethernet link of any speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend running in &quot;fast&quot; mode at all times for rapid detection of faults.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-05-07T00:32:11.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18332" PostTypeId="1" CreationDate="2015-05-07T00:44:42.980" Score="0" ViewCount="357" Body="&lt;p&gt;There are two parts to my question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, I am a novice networking enthusiast at best. I studied programming in school so I have a technical backbone. However I am  finding myself increasingly lost in the IT world especially when it comes to networking. I want to change that. If anyone can recommend some good resources a beginner can use to crawl out of ignorance I would greatly appreciate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that...I am attempting to setup dedicated guest access for our customers at my family business. I have an Asus RT-N66U router and a TpLink WA901ND which I planned to use as an access point for customers and employees. The business intranet is on a LAN connected over CAT5es. The problem is I don't want our customers peeking into our network and using our resources. Turns out the AP firmware doesnt have the guest access feature. so my setup is bunk. Is it enough to password secure the file sharing and printers for our workgroup through windows 7 or am I asking for trouble by leaving that AP open to the business network? What options do i have with the hardware I have?&lt;/p&gt;&#xA;" OwnerUserId="15293" LastActivityDate="2015-05-07T16:56:22.430" Title="Securing my intranet" Tags="|router|wireless|access-point|" AnswerCount="2" CommentCount="1" ClosedDate="2015-05-08T03:43:14.350" ContentLicense="CC BY-SA 3.0" />
  <row Id="18333" PostTypeId="1" AcceptedAnswerId="18336" CreationDate="2015-05-07T00:53:12.643" Score="0" ViewCount="85" Body="&lt;p&gt;Please look at the attached topology&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/HabRb.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am studying for CCNP with ine.com, and I have got a lab switch they say is possible, I say it is not (with the current config)&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;SW-3 config&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Fa 0/15&#xA;no switchport&#xA;ip address 1.1.1.33&#xA;&#xA;Fa 0/14&#xA;switchport trunk encapsulation dot1q&#xA;switchoort mode trunk&#xA;&#xA;Fa 0/3&#xA;switchport mode access&#xA;switchport access vlan 111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;SW-1 config&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Fa 0/15&#xA;switchport mode access&#xA;switchport access vlan 111&#xA;&#xA;Fa 0/11&#xA;switchport mode access &#xA;switchport access vlan 111&#xA;&#xA;Fa 0/14&#xA;switchport trunk encapsulation dot1q&#xA;switchoort mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;SW-2 config&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Fa 0/11&#xA;no switchport&#xA;ip address 1.1.1.22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;R3&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Fa 0/1&#xA;ip address 1.1.1.111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;The problem&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;SW-3 Fa0/15 generates an icmp packet headed for 1.1.1.111 (which is R3), it never makes it. (This is indicated by the red line)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW-2 Fa0/11 generates an icmp packet headed for 1.1.1.111 (which is R3), it makes it. (This is indicated by the blue line)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW-1, SW-3, SW-2 all have ip routing enabled. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If R3 generates the packet, heading for 1.1.1.33 (SW-3 int Fa 0/15) when the packet gets to SW-3, I believe the switch looks at its cef table and sees that 1.1.1.33/32 has received beside it not attached. So it thinks that the packet is for itself, and does not attempt to forward it out any interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this is somehow causing conflict, as the packet needs to be forwarded out Fa 0/14 and then back in Fa 0/15 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone could point me in the right direction I would be very grateful.&lt;/p&gt;&#xA;" OwnerUserId="8109" LastEditorDisplayName="user10222" LastEditDate="2015-06-07T20:52:34.593" LastActivityDate="2015-07-07T23:16:28.187" Title="Looping back through switches?" Tags="|switching|cef|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18335" PostTypeId="2" ParentId="18319" CreationDate="2015-05-07T01:06:22.967" Score="6" Body="&lt;ol&gt;&#xA;&lt;li&gt;Yes, if I am reading things correctly it appears your understanding is correct.&lt;/li&gt;&#xA;&lt;li&gt;Yes, there are implementations that will allow you to do link aggregation between a host and two switches. Switch stacking will allow a stack of individual switches to be managed as one device.  Typically one of switches in the stack becomes the &lt;em&gt;master&lt;/em&gt; for the stack allowing it to manage link aggregation across multiple switches. A second option is virtual switching which also allows this functionality across multiple switches even if they are not stacked. This typically requires higher end hardware, specific software versions and additional requirements in order to implement.  Examples are &lt;em&gt;virtual switching system&lt;/em&gt; (VSS)/&lt;em&gt;multichassis EtherChannel&lt;/em&gt; (MEC)/&lt;em&gt;virtual port channel&lt;/em&gt; (VPC) from Cisco or &lt;em&gt;virtual chassis&lt;/em&gt; from Juniper.&lt;/li&gt;&#xA;&lt;li&gt;No. One of the hard invariants (i.e. absolute requirements) for L2 networking is the sequential delivery of frames. In link aggregation this is enforced by requiring a flow to traverse only one link in the group. If there is any sort of delay on that link, this invariant can still be maintained. If a flow were traversing two links and one of the links were to experience a delay (even a very short one), this could result in frames being delivered out of order violating this invariant.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Ultimately, if you are running into a need to exceed the speed of a link for a single flow, you would need to upgrade your interfaces to the next available speed technology (i.e. 1G to 10G, 10G to 40G, etc). Cisco is also spearheading a push for *multigigabit&quot; providing speeds of 2.5G or 5G across Cat5e/6 cabling at distances up to 100 meters.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-05-07T01:13:19.080" LastActivityDate="2015-05-07T01:13:19.080" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18336" PostTypeId="2" ParentId="18333" CreationDate="2015-05-07T02:59:53.147" Score="0" Body="&lt;p&gt;Im sure this is a limitation with the 3550. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW-3 is the 3550, i have just used a 3560 and it works fine. &lt;/p&gt;&#xA;" OwnerUserId="8109" LastActivityDate="2015-05-07T02:59:53.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18337" PostTypeId="1" AcceptedAnswerId="18339" CreationDate="2015-05-07T06:01:42.050" Score="1" ViewCount="781" Body="&lt;p&gt;I am scripting a scapy probe request scanner using python 2.x. I can scan for probes and list the mac address, manufacturer and ssid being probed for.&#xA;How can I now discover the device name for these devices (ex: Gio's iPhone 5)?? I am aware that this cannot be done through probe requests alone. But what kind of connection and packet will I have to send the device for it to divulge its device name?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is the script in question if anyone is interested: &lt;a href=&quot;https://github.com/localtracker/pyrobe&quot; rel=&quot;nofollow&quot;&gt;https://github.com/localtracker/pyrobe&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15297" LastActivityDate="2015-05-07T12:01:00.940" Title="how can I discover device name through probe requests?" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-08T03:43:00.787" ContentLicense="CC BY-SA 3.0" />
  <row Id="18338" PostTypeId="1" AcceptedAnswerId="18357" CreationDate="2015-05-07T11:23:17.763" Score="1" ViewCount="1767" Body="&lt;p&gt;I can't setup forwarding of all zero (unknown, I assume)/multicast ethernet frames to multiple unicast IPs (virtual tunnel endpoints), although it seems that it should be supported (also mentioned &lt;a href=&quot;http://events.linuxfoundation.org/sites/events/files/slides/2013-linuxcon.pdf&quot; rel=&quot;nofollow&quot;&gt;here on page 8&lt;/a&gt;) in kernel since version 3.8.0 when the Dove extension was merged into mainline.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# bridge fdb add 00:00:00:00:00:00 dev vxlandev dst 10.0.1.1&#xA;# bridge fdb add 00:00:00:00:00:00 dev vxlandev dst 10.0.1.2&#xA;RTNETLINK answers: File exists&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to use original Linux bridge, not Openvswitch or anything else.&lt;/p&gt;&#xA;" OwnerUserId="15299" LastEditorUserId="15299" LastEditDate="2015-05-07T11:55:33.390" LastActivityDate="2015-05-08T14:02:30.743" Title="setup VXLAN forwarding to multiple destination on Linux" Tags="|linux|bridge|vxlan|" AnswerCount="1" CommentCount="0" ClosedDate="2019-06-21T21:28:32.470" ContentLicense="CC BY-SA 3.0" />
  <row Id="18339" PostTypeId="2" ParentId="18337" CreationDate="2015-05-07T12:01:00.940" Score="0" Body="&lt;p&gt;The device name won't be given up until it does a DHCP request and passes up its name.  You could try to put up a SSID that the device will connect to (since you know what it's probing for) and then wait for the DHCP packet to come in after it associates.  This will only work if you use an SSID that the device doesn't think there are security requirements for, so its best to try public ones like Starbucks, Mcdonalds, etc.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-05-07T12:01:00.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18340" PostTypeId="1" AcceptedAnswerId="18341" CreationDate="2015-05-07T12:13:02.670" Score="0" ViewCount="6291" Body="&lt;p&gt;I am moving my company to a leased line and in their brochure they have mentioned that I will be getting a /29 IPs. When I wanted to lookup how many IP addresses that will be, this page &lt;a href=&quot;http://www.aelius.com/njh/subnet_sheet.html&quot; rel=&quot;nofollow&quot;&gt;http://www.aelius.com/njh/subnet_sheet.html&lt;/a&gt; , I found this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Addresses   Hosts   Netmask         Amount of a Class C&#xA;/30     4       2       255.255.255.252     1/64&#xA;/29     8       6       255.255.255.248     1/32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While I understand how I get 8 addresses, (since a /29 means 3-bits for addresses, given me 2^3 = 8 addresses), I don't understand what does &quot;6 Hosts&quot; mean? What is the differentiation between a host and an address in this case? How does it affect me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if someone could clarify what &quot;Amount of a class C&quot; means. I am thinking it means the ratio of addresses in a particular subnet to the total addresses in a class C network. Is this right?&lt;/p&gt;&#xA;" OwnerUserId="8599" LastActivityDate="2015-05-07T12:36:18.827" Title="Why do I get 8 addresses and 6 hosts on a /29 subnet?" Tags="|ip|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-09T08:50:44.377" ContentLicense="CC BY-SA 3.0" />
  <row Id="18341" PostTypeId="2" ParentId="18340" CreationDate="2015-05-07T12:36:18.827" Score="7" Body="&lt;p&gt;Like you said, a /29 leaves 3 bits for addresses.  However, the first address is the network address and cannot be used for a host.  Likewise, the last address is the broadcast address and also cannot be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your class C question, see &lt;a href=&quot;https://en.wikipedia.org/wiki/Classful_network&quot;&gt;https://en.wikipedia.org/wiki/Classful_network&lt;/a&gt;.  However, the class A, B, and C terms are often used incorrectly to denote /8, /16, and /24, respectively.  More than likely, that's what is meant when they are referring to the &quot;amount of a class C&quot;.  They are referring to a /24, which has 256 addresses - 254 which are usable for hosts.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2015-05-07T12:36:18.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18342" PostTypeId="2" ParentId="18332" CreationDate="2015-05-07T16:37:36.760" Score="2" Body="&lt;p&gt;You absolutely do NOT want to just push forward as-is without addressing the very real security concerns.  Small businesses often compromise in areas like this because they view themselves as small targets.  The question isn't how much you imagine someone else has to gain, it's how much you have to lose.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That out of the way, it really shouldn't be too hard to get something reasonable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, unless I strongly misunderstand what you're trying to do, &lt;a href=&quot;http://www.asus.com/us/Networking/RTN66U/specifications/&quot; rel=&quot;nofollow&quot;&gt;it looks like the Asus unit supports what you need&lt;/a&gt; without involving the TP-Link at all.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need the coverage of a second AP, etc... that might be another story.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So key to understanding this is understanding the processes beneath it.  So &quot;guest wifi&quot; is more than just another SSID (typically).  I couldn't find detailed enough documentation on how the Asus implements it, but it &lt;em&gt;should&lt;/em&gt; be a separate network to itself.  So something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[modem]-------[asus]  &#xA;               |  |  &#xA;  {guest ssid}--  --{business ssid}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It &lt;em&gt;ought&lt;/em&gt; to treat the two networks as wholly separate.   Different address space, etc...   This can be easily verified.  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Setup the first network (internal).&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Attach two PCs to the network and make sure that you can ping/access them from eachother.  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Once you know that works when it &lt;em&gt;should&lt;/em&gt;, you'll be able to know for sure if/when the AP starts blocking that traffic.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Next, create the 2nd network(guest) and move one of the PCs to that network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Chances are different address spaces will be used (192.168.1.x vs. 192.168.10.x, or something).  Either way, go ahead and try to ping from the one to the other.  If it works, then it's not filtering properly.&lt;/li&gt;&#xA;&lt;li&gt;If it &lt;em&gt;Doesn't&lt;/em&gt; work, you still need to double check something else.  Take the PC on the guest network and, instead of using DHCP, manually assign it a valid address in the range used by the first network (using the settings from the other PC as a template).  THEN try to access the other pc.  If &lt;em&gt;THAT&lt;/em&gt; doesn't work you know that the AP is doing at the very least a reasonable job of segregating the traffic.  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There's still other ways that it could be doing a poor job, but at this point you've certainly done your due diligence for a small business.  If you're handling HIPAA data or something, you need more than this, but if that's the case you need to stop right now and go hire a pro who's willing to take responsibility for ensuring you're up to code anyway, as there's simply too much at stake to screw around on your own.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if the data sheet I linked to is wrong, or the Asus fails the above tests, you might need more hardware.  Remember, this is actually a big deal.  You want to offer your customers free wifi, and that's great.  Go ahead and ask them how comfortable with your OTHER customers accessing their account information on your network.  Probably not at all, right?  Last thing you need is some kid screwing around with his laptop in the parking lot, finding your network, and throwing all your customer's data up on on pastebin &quot;for the lulz&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this &lt;em&gt;NEEDS&lt;/em&gt; to happen, and if the asus doesn't do what you need, you need a new router(or firewall).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether this new router/firewall also handles your WiFi and replaces the ASUS, or is just a router unto itself and you still allow the Asus and tp-link handle the wireless is up to you.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll either setup something like I described with the Asus above, or something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[modem]---------------[new router]&#xA;                         |  |&#xA; {internal ssid}----[asus]  [tp-link]----{guest ssid}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The key point here is that the router will actually be routing between three networks.  So where on the back of the Asus unit all the interfaces on the back are part of one network ('broadcast domain' in network speak), here each interface will be it's own network.  (That may not be the default, but it should absolutely be possible... verify this before purchasing).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So then your asus bridges your internal SSID to the internal network created by the New Router (NR).  The TP-Link bridges your guest SSID to the guest network created by NR.  NR is responsible for ensuring that traffic is not permitted between the two networks (and you are responsible for testing/verifying this).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are more implementation details that may not be obvious, but this is long enough for here, and should be enough to at least tell you if you need more hardware.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;one final caveat is that if the ASUS fails the above tests, you still might be able to get away with using it in the way I described using NR above, &lt;strong&gt;IF&lt;/strong&gt; you can get it to treat the interfaces on the back as &quot;routed&quot; interfaces instead of &quot;switched&quot; interfaces, or at least will put all of them on a different network than the WiFi.  I didn't get the feeling it supports that based off of the documentation, but it's worth looking into.&lt;/p&gt;&#xA;" OwnerUserId="15300" LastActivityDate="2015-05-07T16:37:36.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18343" PostTypeId="2" ParentId="18332" CreationDate="2015-05-07T16:56:22.430" Score="-1" Body="&lt;p&gt;What you have is two multilayer (layer 3+) access points - one manufactured by Asus and the other by TP-link.  Both support multiple SSID's  (&lt;a href=&quot;http://www.tp-link.com/lk/products/details/?model=TL-WA901ND#fea&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You simply need to configure 2 SSID's on the TP-link - one guest SSID with or without basic password, the other (inside/protected) SSID being secured with WPA and not broadcast/advertised is typical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TP-link AP does not appear to support trunking so the routing between SSID's (subnets inside-tp and guest-tp) is going to take place on the tp link AP itself.  Then you will have 2 separate SSID for the Asus and be sure the channels don't overlap.  Basically you have 2 separate AP's and 4 separate WiFi subnets.  The TP-Link plugs in to the Asus for Internet/wired network access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should get some Meraki AP's and your life would be much easier.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-07T16:56:22.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18346" PostTypeId="1" AcceptedAnswerId="18348" CreationDate="2015-05-07T20:22:15.867" Score="1" ViewCount="644" Body="&lt;p&gt;all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have  two Cisco ASA 5512-X in Active/Active faiover pair. And four context on them. Usually to edit configuration I go to admin context via SSH, than issue command &quot;changeto context CONTEXTNAME&quot;, edit configuration of context, save it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now I want to  allocate context to different ASAs. Problem appears when I try to go from admin context to context, with active on different ASA. In this case, when I issue command &quot;configure terminal&quot;, I will see warning about &quot;config not replicating from standby unit to active&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, how can i edit configuration of this kind of contexts. Do I need to open ssh on every context?&lt;/p&gt;&#xA;" OwnerUserId="15304" LastActivityDate="2015-05-07T21:30:51.760" Title="How to manage Cisco ASA context in Active/Active failover" Tags="|cisco-asa|failover|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18347" PostTypeId="1" AcceptedAnswerId="18349" CreationDate="2015-05-07T20:45:12.697" Score="1" ViewCount="3135" Body="&lt;p&gt;I have this case:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my Company we have 2 Internet Access in production R1-A router and R2-B router they are both in separate networks, R2-B have the highest priority which it use to Call Center.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;were i Want to focus on R1-A that router is a Cisco Router 829F is currently performing NAT Overload to a Huawei HG8245H (Modem ISP) then the hole company connects to a 24-Port Gigabit Rackmount Switch TL-SG1024 (Non Administrable Switch).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All network infracture in the internal network IP adress is 192.168.1.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My internet bandwidth is 10/10 mpbs &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Modem--&amp;gt; Router Cisco 829F--&amp;gt; Switch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do i preform a bandwidth control to specific department or specific host?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What topic or subject i should research? (VLAN,Inter-Vlan Routing)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best approach or solution? &lt;/p&gt;&#xA;" OwnerUserId="15303" LastActivityDate="2015-05-07T22:34:48.693" Title="How to limit the internet bandwidth to specific department in my company, using a Cisco Router?" Tags="|cisco|cisco-ios|bandwidth|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18348" PostTypeId="2" ParentId="18346" CreationDate="2015-05-07T21:30:51.760" Score="2" Body="&lt;p&gt;Yes, you need to SSH into each context. Contexts were intended to be configured by different administrators. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-07T21:30:51.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18349" PostTypeId="2" ParentId="18347" CreationDate="2015-05-07T22:34:48.693" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/10118-cbpcar.html&quot; rel=&quot;nofollow&quot;&gt;Class-Based Policing&lt;/a&gt;.  Since you cannot administer the switch, you will likely have to match traffic based on IP access list with can be processor intensive.  In any case search cisco.com for class-based policing for additional configuration examples.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Router(config)# class-map access-match&#xA;     Router(config-cmap)# match access-group 1&#xA;     Router(config-cmap)# exit&#xA;     Router(config)# policy-map police-setting&#xA;     Router(config-pmap)# class access-match&#xA;     Router(config-pmap-c)# police 8000 1000 conform-action transmit exceed-action drop&#xA;     Router(config-pmap-c)# exit&#xA;     Router(config-pmap)# exit&#xA;     Router(config)# interface fastethernet 0/0&#xA;     Router(config-if)# service-policy output police-setting&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-07T22:34:48.693" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18353" PostTypeId="2" ParentId="18070" CreationDate="2015-05-08T07:59:42.710" Score="2" Body="&lt;p&gt;One cheap way - but only for GSM:&#xA;Buy a RTL SDR stick (about 15€) and &lt;a href=&quot;https://github.com/ptrkrysik/gr-gsm&quot; rel=&quot;nofollow&quot;&gt;trace the GSM traffic&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the traffic you will find the &lt;a href=&quot;http://www.etsi.org/deliver/etsi_gts/04/0408/05.03.00_60/gsmts_0408v050300p.pdf&quot; rel=&quot;nofollow&quot;&gt;Paging Requests (GSM 04.08 section 7.1.1)&lt;/a&gt;.  Paging requests are send from time to time from the base station to all GSM phones in the appropriate cell.  The phone is either identified by the IMSI or the TMSI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to add some evaluation, statistics and heuristics (e.g. the TMSI is only temporary - and will be reused from time to time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also evaluate the 'Immediate Assignment' packets: those packets are send from the base station that a phone should ask for a channel.  If you count these, you could do some statistics comparing the number of phones in the cell against number of activities per hour or so.&#xA;Disadvantage: there is no IMSI or TMSI in this packets (the correlation is done using some traffic that is send via the uplink channel).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are lucky and find a cell without channel hopping, it is also easy to trace 'CM Service Requests'.  Here you can get information about ongoing traffic channel setup (e.g. TCH / SACCH) - it is even possible to see if there will be a SMS delivered or a voice call starting.  These packets contain the IMSI or TMSI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This solution has the advantage that it is cheap, everything you need is send unencrypted, it is easy to build up and there is no need to send anything. It should be legal: your GSM phone listens the whole day for these packets.&lt;/p&gt;&#xA;" OwnerUserId="15309" LastActivityDate="2015-05-08T07:59:42.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18354" PostTypeId="1" CreationDate="2015-05-08T08:41:08.643" Score="0" ViewCount="1015" Body="&lt;p&gt;I am confused, how come this is not working.. only thing i want to access the asa management from 10.109.32.6.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have remote asa.there is a mpls link between both sites. I am behind 10.109.32.6 and asa is behind 10.109.35.11.asa and mpls route is connected (VLAN2 10.4.1.0) see below configuration, any suggestion what i am doing wrong?  I have added additional config to allow ping and ssh from my site &lt;br/&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh VLAN12 255.255.255.0 inside&#xA;ssh 10.109.32.6 255.255.255.192  MPLS  http server enable&#xA;http VLAN12 255.255.255.0 inside &#xA;http 10.109.32.6 255.255.255.192 MPLS  icmp permit any inside &#xA;icmp permit any MPLS &#xA; inspect icmp &#xA;  inspect icmp error &#xA;    name x.x.x.x InternetGateway description Internet Gateway &#xA;    name x.x.x.x IS description Fidelity Information Systems MPLS IP Range &#xA;    name 10.109.0.0 MPLS description MPLS IP Range &#xA;    name 10.4.3.3 MPLSGateway description MPLS Gateway &#xA;    name 10.5.1.0 VLAN12 description Internal user LAN &#xA;    name 10.4.3.0 VLAN80 description MPLS third party network &#xA;    ! &#xA;    interface Ethernet0/0 &#xA;    !  &#xA;    interface Ethernet0/1 &#xA;     switchport access vlan 3 &#xA;    !&#xA;    interface Ethernet0/2 &#xA;     switchport access vlan 2 &#xA;    !  &#xA;    interface Ethernet0/3 &#xA;    !&#xA;    interface Ethernet0/4 &#xA;    !&#xA;    interface Ethernet0/5 &#xA;    !&#xA;    interface Ethernet0/6 &#xA;    !&#xA;    interface Ethernet0/7 &#xA;    !&#xA;    interface Vlan1 &#xA;     description Internal LAN &#xA;     nameif inside &#xA;     security-level 100 &#xA;     ip address 10.5.1.1 255.255.255.0 &#xA;    ! &#xA;    interface Vlan2  &#xA;     description Internet Access &#xA;     nameif outside &#xA;     security-level 0 &#xA;     ip address x.x.x.x x.x.x.x &#xA;    ! &#xA;    interface Vlan3 &#xA;     description LaSer Group MPLS &#xA;     no forward interface Vlan2 &#xA;     nameif MPLS &#xA;     security-level 0 &#xA;     ip address 10.4.1.4 255.255.255.0 &#xA;    ! &#xA;    ftp mode passive &#xA;    clock timezone GMT/BST 0 &#xA;    clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00 &#xA;    dns server-group DefaultDNS &#xA;     domain-name X.X.X.X &#xA;    object-group network gMPLS &#xA;     description MPLS Destinations &#xA;     network-object MPLS 255.255.0.0 &#xA;     network-object IS 255.255.0.0 &#xA;    access-list inside_nat_outbound_1 remark Traffic to internet hidden behind  X.X.X.X &#xA;    access-list inside_nat_outbound_1 extended permit ip VLAN12 255.255.255.0 any &#xA;    access-list inside_nat_outbound remark Traffic to MPLS hidden behind  10.109.35.11 &#xA;    access-list inside_nat_outbound extended permit ip VLAN12 255.255.255.0  object-group gMPLS &#xA;    pager lines 24&#xA;    logging asdm informational &#xA;    mtu inside 1500 &#xA;    mtu outside 1500 &#xA;    mtu MPLS 1500  &#xA;    icmp unreachable rate-limit 1 burst-size 1&#xA;    no asdm history enable &#xA;    arp timeout 14400  &#xA;    global (outside) 1 X.X.X.X netmask 255.0.0.0 &#xA;    global (MPLS) 2 10.109.35.11 netmask 255.0.0.0 &#xA;    nat (inside) 2 access-list inside_nat_outbound &#xA;    nat (inside) 1 access-list inside_nat_outbound_1 &#xA;    route outside 0.0.0.0 0.0.0.0 InternetGateway 1 &#xA;    route outside 0.0.0.0 255.255.255.255 InternetGateway 255 &#xA;    route MPLS MPLS 255.255.0.0 10.4.1.1 1&#xA;    route MPLS IS 255.255.0.0 10.4.1.1 1&#xA;    timeout xlate 3:00:00 &#xA;    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 &#xA;    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 &#xA;    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute &#xA;    timeout tcp-proxy-reassembly 0:01:00 &#xA;    timeout floating-conn 0:00:00 &#xA;    dynamic-access-policy-record DfltAccessPolicy&#xA;    aaa authentication ssh console LOCAL &#xA;    http server enable &#xA;    http VLAN12 255.255.255.0 inside &#xA;    no snmp-server location &#xA;    no snmp-server contact &#xA;    snmp-server enable traps snmp authentication linkup linkdown coldstart &#xA;    crypto ipsec security-association lifetime seconds 28800 &#xA;    crypto ipsec security-association lifetime kilobytes 4608000 &#xA;    telnet timeout 5 &#xA;    ssh VLAN12 255.255.255.0 inside &#xA;    ssh 10.109.32.6 255.255.255.192 MPLS &#xA;    ssh timeout 5 &#xA;    console timeout 0 &#xA;&#xA;    dhcpd auto_config outside &#xA;    !&#xA;    dhcpd address 10.5.1.5-10.5.1.254 inside &#xA;    dhcpd dns 1.1.1.1 1.1.1.1 interface inside &#xA;    dhcpd domain xxxx interface inside &#xA;    dhcpd enable inside &#xA;    !&#xA;&#xA;    threat-detection basic-threat &#xA;    threat-detection statistics access-list &#xA;    no threat-detection statistics tcp-intercept &#xA;&#xA;    !&#xA;    class-map inspection_default &#xA;     match default-inspection-traffic &#xA;    !&#xA;    !&#xA;    policy-map type inspect dns preset_dns_map &#xA;     parameters&#xA;      message-length maximum client auto &#xA;      message-length maximum 512 &#xA;    policy-map global_policy &#xA;     class inspection_default &#xA;      inspect dns preset_dns_map &#xA;      inspect ftp &#xA;      inspect h323 h225 &#xA;      inspect h323 ras &#xA;      inspect rsh &#xA;      inspect rtsp &#xA;      inspect esmtp &#xA;      inspect sqlnet &#xA;      inspect skinny &#xA;      inspect sunrpc &#xA;      inspect xdmcp &#xA;      inspect sip &#xA;      inspect netbios &#xA;      inspect tftp &#xA;      inspect ip-options &#xA;    ! &#xA;    service-policy global_policy global &#xA;    prompt hostname context &#xA;    no call-home reporting anonymous&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15310" LastEditorUserId="3075" LastEditDate="2015-05-08T14:10:03.353" LastActivityDate="2015-07-07T19:10:12.153" Title="Missing something in config not able to access ssh/ping from other vlan or network" Tags="|cisco|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18357" PostTypeId="2" ParentId="18338" CreationDate="2015-05-08T14:02:30.743" Score="2" Body="&lt;p&gt;I found answer myself - unlike with ip command, you have to use &lt;code&gt;append&lt;/code&gt; keyword, not &lt;code&gt;add&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;therefore it should be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# bridge fdb add 00:00:00:00:00:00 dev vxlandev dst 10.0.1.1&#xA;# bridge fdb append 00:00:00:00:00:00 dev vxlandev dst 10.0.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15299" LastActivityDate="2015-05-08T14:02:30.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18358" PostTypeId="2" ParentId="18354" CreationDate="2015-05-08T14:16:58.773" Score="1" Body="&lt;p&gt;This is directly from cisco's website:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; hostname(config)# crypto key generate rsa modulus 1024&#xA; hostname(config)# write memory&#xA; hostname(config)# aaa authentication ssh console LOCAL&#xA; WARNING: local database is empty! Use 'username' command to define local users.&#xA; hostname(config)# username exampleuser1 password examplepassword1&#xA; hostname(config)# ssh 192.168.1.2 255.255.255.255 inside&#xA; hostname(config)# ssh timeout 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You have to generate a crypto key AND an allowed IP address for SSH in order to access a firewall via SSH. On routers, you have to create a username and password and create an SSH key. I do not see a crypto-key. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is your IP address? You say you are &quot;behind&quot; 10.109.32.6 but unless you have that address or are part of VLAN12, you will not be able to access the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_management.html#wp1503771&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_management.html#wp1503771&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-05-08T14:16:58.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18359" PostTypeId="2" ParentId="653" CreationDate="2015-05-08T14:46:29.700" Score="-1" Body="&lt;p&gt;I think you are looking for a sum of based on the status? at least it sounds like your question. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interfaces status | count notconnect|connected&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;give you a nice count of what is either connected or not. &lt;/p&gt;&#xA;" OwnerUserId="15312" LastEditorUserId="509" LastEditDate="2015-05-09T08:47:21.003" LastActivityDate="2015-05-09T08:47:21.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18360" PostTypeId="2" ParentId="3237" CreationDate="2015-05-08T15:04:03.650" Score="-1" Body="&lt;p&gt;It'll be matching 12 AS-path list. But, I think a more appropriate way of matching it would be ^[0-9]+_[0-9]+_[0-9]+_[0-9]+_[0-9]+_[0-9]+_[0-9]+_[0-9]+_[0-9]+_[0-9]+_[0-9]+_[0-9]+$, because the expression you mentioned might just match any character ie. special characters and alphabets included.&lt;/p&gt;&#xA;" OwnerUserId="15313" LastEditorUserId="47013" LastEditDate="2018-05-02T11:55:58.780" LastActivityDate="2018-05-02T11:55:58.780" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="18361" PostTypeId="2" ParentId="9389" CreationDate="2015-05-08T15:12:10.283" Score="3" Body="&lt;p&gt;A little late to the party on this one, but just came across this myself today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plug the VoIP phone into the PoE switch like normal. Then have the port from your VoIP phone that is labeled &quot;PC&quot; connect to your non-PoE switch and distribute to the rest of your PCs with the rest of the open ports from your non-PoE switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may be what PsychoData is saying, but it wasn't clear to me. So kudos to you if it was :)&lt;/p&gt;&#xA;" OwnerUserId="15314" LastActivityDate="2015-05-08T15:12:10.283" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18363" PostTypeId="1" CreationDate="2015-05-08T16:35:05.290" Score="1" ViewCount="466" Body="&lt;p&gt;At the company I just started working for, all of the computers are set up as dual boot Windows/CentOS due to needing tools from both operating systems.&#xA;95% of the users are Linux users, but quite a few of them legitimately need to use Windows sometimes (thanks Adobe).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently the DHCP server is pfsense and the switches are HP ProCurve 3800, however we've now implemented Active Directory and the plan is to move DHCP over to that at some point in the future, before doing so we wanted to create 2 new VLANs, one for Linux one for Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've been asked to set up, is some way for the OS to get a DHCP address in it's respective VLAN.&#xA;My first thought was that most of the machines are pretty high end with 2 NIC's so just disable one NIC in Linux and disable the other NIC in Windows and reserve the addresses based on MAC.&#xA;But this will just create too many connections on a network that we already push to the max.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My only other thought on doing this is if the NIC's (most of which I believe will be Intel) have VLAN tagging enabled I could set this up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any experience in a situation like this?&lt;/p&gt;&#xA;" OwnerUserId="15316" LastActivityDate="2015-05-11T05:56:50.577" Title="Dual Booting in to different VLAN DHCP servers for different OS's" Tags="|vlan|dhcp|linux|hp-procurve|" AnswerCount="3" CommentCount="3" ClosedDate="2015-05-18T19:11:41.493" ContentLicense="CC BY-SA 3.0" />
  <row Id="18364" PostTypeId="1" AcceptedAnswerId="18371" CreationDate="2015-05-08T16:52:37.277" Score="3" ViewCount="708" Body="&lt;p&gt;I understand the principle of collision domains and how they are issues in hubs. I also get how switches are actually creating its own collision domain on each port.&#xA;Therefore Port to Port communication creates a collision domain and takes care of collisions. It is all find and dandy here. &#xA;What about the situation when I have two switches -- let's assume 48 ports each, daisy-chained together? &#xA;What will happen when 48 ports on switch1 will receive transmissions at the same time and need to resend it to 48 ports on switch2? I assume that all 48 signals should be transferred over the SINGLE daisy-chain link. Will that one link introduce ONE collision domain for all 48 ports? I logically assume that it won't, but I don't understand how. &lt;/p&gt;&#xA;" OwnerUserId="2043" LastActivityDate="2022-10-13T14:13:28.913" Title="How collisions are handled in the daisy-chained switches?" Tags="|switch|ethernet|osi|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18365" PostTypeId="1" AcceptedAnswerId="18367" CreationDate="2015-05-08T16:55:21.820" Score="2" ViewCount="406" Body="&lt;p&gt;I have a c3750g running three groups of ether channels, each with 4x1g interfaces.&#xA;I basically have my upstream connect to the switch via optical, then I take that to my router via 4 bonded port, then out again with 4 ports.&#xA;Then four more ports connect to a distribution CCR and I give to my clients via gepon and switch.&#xA;Now that the scenario has possibly confused you, the question is, why is my speed limited to 2.3 Gbps? 4 ports at 75% is 3.5g roughly.&#xA;Load balance is src-dst-ip, lacp passive.&#xA;Switch cpu at 5%&lt;/p&gt;&#xA;" OwnerUserId="15317" LastActivityDate="2015-05-08T18:36:57.593" Title="Lacp limitations" Tags="|cisco|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18367" PostTypeId="2" ParentId="18365" CreationDate="2015-05-08T18:36:57.593" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;why is my speed limited to 2.3 Gbps?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because LACP isn't &quot;&lt;em&gt;additive&lt;/em&gt;&quot;, it's a load balancing mechanism. The &lt;em&gt;src-dst-ip&lt;/em&gt; hash will select only a single link, and all of the traffic between that src and dst will cross it. Thus, if you don't have a perfect distribution of src/dst pairs, some links will be more utilized than others.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-08T18:36:57.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18368" PostTypeId="2" ParentId="18363" CreationDate="2015-05-08T18:37:45.687" Score="-2" Body="&lt;p&gt;DHCP Options, namely 43 and 60.  Search for examples of how to setup option 43 and or option 60 (e.g. &lt;a href=&quot;http://blogs.technet.com/b/troubleshooting_walk_through/archive/2013/11/01/what-comes-with-option-43-and-configuring-in-dhcp.aspx&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-08T18:37:45.687" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18369" PostTypeId="2" ParentId="18364" CreationDate="2015-05-08T18:40:57.743" Score="-2" Body="&lt;p&gt;Frames are passed over Ethernet.  A single broadcast frame is all that is required to tell switch 2 to propagate the broadcast to all of its 48 access ports, not 48 individual frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that what you were looking for?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-08T18:40:57.743" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18370" PostTypeId="2" ParentId="18354" CreationDate="2015-05-08T18:47:58.317" Score="0" Body="&lt;p&gt;I do not believe ping will ever work.  It is disabled on these security devices by design.  As for SSH, it is possible to do from the OUTSIDE - connect to the public IP of the device.  You simply need to configure it.  Tons of config examples online, e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118075-configure-asa-00.html&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;.  If all fails, reboot the thing and try it then (5 max concurrent connections may be hung sessions?)&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-08T18:47:58.317" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18371" PostTypeId="2" ParentId="18364" CreationDate="2015-05-08T18:51:49.913" Score="6" Body="&lt;p&gt;If all 48 ports attempt to TX to the same &quot;port&quot; at the same time, it will most likely overrun the internal buffer space and &quot;no buffer&quot; (in cisco circles) drop the frame(s). As this is all at layer-2, no error is communicated to anyone; the frames just don't get there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(This is all part of the &lt;em&gt;store-and-forward&lt;/em&gt; processing of switches.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-08T18:51:49.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18374" PostTypeId="2" ParentId="18364" CreationDate="2015-05-08T20:45:52.837" Score="2" Body="&lt;p&gt;Back all the way up to the premise of the question.  A collision, as it were, can only happen in a half duplex situation when &quot;the wire&quot; is common to both receive and transmit, and both sides try to transmit at once making the output from the wire unusable.  So, even between two PCs attached to the same switch that communicate with each other, the two ports are not a collision domain as long as both hosts are linked at full duplex.  If two hosts do happen to be both half duplex, then there is a collision domain between the switch and the host, which will be arbitrated by the efficacy of the carrier sense logic of each.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-05-08T20:45:52.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18381" PostTypeId="2" ParentId="18363" CreationDate="2015-05-09T12:06:03.883" Score="0" Body="&lt;p&gt;I don't know about VLAN settings on Windows, so I would recommend leaving win stations at native VLAN and on Linux machines you can easily setup interfaces to tag all traffic to desired VLAN id. All switch ports set as trunk. Then just make sure to set up routing properly on your gateways.&lt;/p&gt;&#xA;" OwnerUserId="15299" LastActivityDate="2015-05-09T12:06:03.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18384" PostTypeId="1" AcceptedAnswerId="20719" CreationDate="2015-05-09T17:19:25.527" Score="2" ViewCount="1398" Body="&lt;p&gt;Is the loop back test effective placed on switch fiber port when trying to determine if CRC errros are due to the faulty port or this is pointless as there is no real traffic? &lt;/p&gt;&#xA;" OwnerUserId="15326" LastActivityDate="2015-08-18T20:25:55.850" Title="CRC errors on the switch port" Tags="|switch|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18387" PostTypeId="1" CreationDate="2015-05-10T01:51:54.717" Score="1" ViewCount="718" Body="&lt;p&gt;I figured out that ARP table for hosts is a little bit different from those for routers.&#xA;Routers ARP table only map MAC addresses to IP addresses belonging to the subnets witch router is connected to with its interfaces.&#xA;for example if router is connected to 2 subnets: 200.1.1.0 255.255.255.0 and 200.1.2.0 255.255.255.0, you can only find IPs 200.1.1.xxx and 200.1.2.xxx in its ARP table whereas in hosts you can find every possible IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: when a router is forwarding a packet if it needs to find MAC address of next-hop, which IP will fill the destination IP of ARP packet?&#xA;next-hop IP or Original packets destination IP?&lt;/p&gt;&#xA;" OwnerUserId="15331" LastEditorUserId="15331" LastEditDate="2015-05-10T02:33:22.453" LastActivityDate="2015-05-11T20:35:21.050" Title="ARP packet's destination IP sent by routers" Tags="|router|arp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18388" PostTypeId="2" ParentId="18387" CreationDate="2015-05-10T05:16:30.940" Score="2" Body="&lt;p&gt;Routers doesn't do arp for each packet they forward, instead they rely on the routing table (or fib table for cef) in order to find the correct gateway for each destination.&#xA;They only do arp for gateway addresses for the very first packet or when entries are removed from arp table due to aging.  &lt;/p&gt;&#xA;" OwnerUserId="14095" LastActivityDate="2015-05-10T05:16:30.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18389" PostTypeId="2" ParentId="18387" CreationDate="2015-05-10T05:59:35.487" Score="2" Body="&lt;p&gt;ARP packets are not forwarded at Layer 3, they are only useful on the local network since mac-addresses are only significant on the local L2 network. Also ARP packets are an L2 packet they have only L2 destination/source addresses in the frame headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For further information about when normal packets (not ARP) are forwarded at Layer 3 (routers, L3 switches, firewalls, etc.): the forwarding decision is based on the destination IP address included in the packet.  Only the destination mac-address of the packet is changed as the packet is forwarded to the next router in the path, this ensures the receiving router can correctly direct the packet on its way.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastEditorUserId="3912" LastEditDate="2015-05-10T06:08:13.977" LastActivityDate="2015-05-10T06:08:13.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18391" PostTypeId="1" AcceptedAnswerId="18431" CreationDate="2015-05-10T08:37:09.377" Score="2" ViewCount="6959" Body="&lt;p&gt;I want to theoretically understand the general relationship between the PSTN (public switched telephone network), cellular networks, and the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that the PSTN provides the infrastructure that ISPs buy in order to offer provide internet subscribers with shared lines. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about cellular networks and how Internet is accessed over a mobile phone? Are cellular networks, with all their stations and satellites, also ultimately connected underground with the PSTN? Is the PSTN therefore the lowest level of communication for all networks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is it that cellular networks are independent of the underground telephone lines and exists fine even without it? &lt;/p&gt;&#xA;" OwnerUserId="15335" LastActivityDate="2015-05-11T20:53:16.640" Title="Relationship between cellular networks and PSTN - especially in relation to the internet" Tags="|wireless|internet|telephony|" AnswerCount="5" CommentCount="1" ClosedDate="2015-05-12T22:16:53.450" ContentLicense="CC BY-SA 3.0" />
  <row Id="18392" PostTypeId="1" AcceptedAnswerId="18435" CreationDate="2015-05-10T08:50:22.007" Score="1" ViewCount="2519" Body="&lt;p&gt;Please overlook any oversight. I couldn't find much recent material on the internet, and just had a networks course this semester.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The wiki page mentions that as of 2013, it's usage has largely been absent. &#xA;But I found a stack exchange thread dated 2011 that the WAP 2.0 is still in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As of 2015, with the current crop of smartphones and high-speed 3g/4g services provided by the operators, is WAP still supported or used? And what version(s) exactly?&lt;/p&gt;&#xA;" OwnerUserId="15336" LastActivityDate="2015-05-12T09:30:35.000" Title="Is WAP still a relevant protocol stack?" Tags="|wireless|protocol-theory|transport-protocol|" AnswerCount="2" CommentCount="0" ClosedDate="2015-05-13T11:11:52.860" ContentLicense="CC BY-SA 3.0" />
  <row Id="18393" PostTypeId="2" ParentId="18391" CreationDate="2015-05-10T08:57:02.637" Score="1" Body="&lt;p&gt;PSTN is only used for dial up and DSL services. Other access technologies use cable, fiber, radio waves, etc. Typically, cellular network stations are connected using one of the latter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's no such thing as one lowest form of communication in terms of a specific type of carrier. Each one has its advantages and disadvantages when it comes to distance, price, capacity, etc. But you can be sure that most communication between networks isn't done on PSTN, it's mostly fiber.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-05-10T08:57:02.637" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18396" PostTypeId="1" CreationDate="2015-05-10T10:14:06.587" Score="2" ViewCount="1761" Body="&lt;p&gt;I want to make a file in Cisco flash to use as static mapping file for the DHCP , how can i do this?&#xA;is there any command to create a text file in IOS&lt;/p&gt;&#xA;" OwnerUserId="15323" LastActivityDate="2015-05-10T23:04:07.780" Title="how to create a file in Cisco IOS" Tags="|cisco|ipv4|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18397" PostTypeId="1" CreationDate="2015-05-10T12:38:38.197" Score="0" ViewCount="171" Body="&lt;p&gt;&quot;IP addresses are used on layer 3 to identify machines throughout different networks&quot; is this technically incorrect since you would also need a MAC address to identify the machines within the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addresses are used on layer 3 to identify networks and MAC addresses are use to identify machines in that network. Is this correct?&lt;/p&gt;&#xA;" OwnerUserId="15338" LastActivityDate="2015-05-12T22:41:27.003" Title="IP address technicality" Tags="|mac-address|ip|" AnswerCount="4" CommentCount="1" ClosedDate="2015-05-13T11:08:56.510" ContentLicense="CC BY-SA 3.0" />
  <row Id="18399" PostTypeId="2" ParentId="18396" CreationDate="2015-05-10T13:18:45.493" Score="3" Body="&lt;p&gt;Create the text file on a computer then copy it to the IOS device (router or switch).  Typically &lt;code&gt;copy tftp flash&lt;/code&gt; is used to copy the file over.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="775" LastEditDate="2015-05-10T23:04:07.780" LastActivityDate="2015-05-10T23:04:07.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18400" PostTypeId="2" ParentId="18397" CreationDate="2015-05-10T13:24:13.003" Score="-4" Body="&lt;p&gt;Network is the keyword.  A network can be a higher-level concept, as in social network.  So, technically (as in semantics) the first sentence of your post is correct.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-10T13:24:13.003" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18401" PostTypeId="2" ParentId="18391" CreationDate="2015-05-10T13:31:49.137" Score="0" Body="&lt;p&gt;Internet Protocol is currently the network that the vast majority of telecommunications services depend on.  Even dial tone circuits (PSTN) are converted to IP on the carriers network.  The PSTN provides dial tone, the Cell towers provide 3g/4g access, and ISPs provide Internet access.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-10T13:31:49.137" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18410" PostTypeId="2" ParentId="18397" CreationDate="2015-05-10T20:43:46.677" Score="4" Body="&lt;p&gt;IP address take you to the network. and MAC will take you to Computer/node. and Port will take you to process. These all layers are required for communication for internet, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Better to make your Question more clear. What you really want to ask. &lt;/p&gt;&#xA;" OwnerUserId="14024" LastActivityDate="2015-05-10T20:43:46.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18411" PostTypeId="1" CreationDate="2015-05-10T21:29:17.107" Score="1" ViewCount="152" Body="&lt;p&gt;There is an explanation given to the above question on this link but I am not understanding that how it will create a loop. I would appreciate if someone can explain this with the help of diagrams of an OSPF network. &lt;a href=&quot;http://www.networkworld.com/article/2348778/cisco-subnet/my-favorite-interview-question.html&quot; rel=&quot;nofollow&quot;&gt;http://www.networkworld.com/article/2348778/cisco-subnet/my-favorite-interview-question.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15344" LastActivityDate="2015-05-10T22:10:33.663" Title="Why does OSPF require all traffic between non-backbone areas to pass through a backbone area (area 0)?" Tags="|routing|ospf|" AnswerCount="0" CommentCount="2" ClosedDate="2015-05-12T15:11:14.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="18414" PostTypeId="1" AcceptedAnswerId="48611" CreationDate="2015-05-11T01:10:26.187" Score="5" ViewCount="21651" Body="&lt;p&gt;I'm having an oddball issue with HTTP/HTTPS traffic through my FG-100A running 4 MR3 Patch 18. The basic architecture is Internet&amp;lt;-&gt;Modem&amp;lt;-&gt;FG-100A&amp;lt;-&gt;Switch+WAP&amp;lt;-&gt;Clients. The switch is wired into the &quot;internal&quot; port of the FG-100A (physically into port 1). The 100A's &quot;dmz1&quot; port is connected to a WAP. 95% of the time everything works perfectly. The rest of the time, sporadically and without any notice (that I'm aware of), all web traffic (HTTP/HTTPS) to LAN stops working. Below are my observations:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DNS/PING/SNMP still works - I can resolve and ping IPs both locally (private IP space) as well as globally on the Internet (e.g. 8.8.8.8 or google.com)&lt;/li&gt;&#xA;&lt;li&gt;FG100A's administrative interface becomes inaccessible (SSH/Telnet too), but SNMP/PING seems to continue to work just fine&lt;/li&gt;&#xA;&lt;li&gt;SNMP shows that my CPU is far below 20% and memory is sitting at around 40-50%&lt;/li&gt;&#xA;&lt;li&gt;IPSec tunnels still working (but haven't checked web traffic through the tunnel)&lt;/li&gt;&#xA;&lt;li&gt;Number of connections/sec is &amp;lt;10/s and total connections is &amp;lt;1000 &lt;/li&gt;&#xA;&lt;li&gt;Logs show nothing out of the ordinary - usual messages from when my system is working normally&lt;/li&gt;&#xA;&lt;li&gt;Seems to happen randomly and isn't triggered by any specific site or class of sites&lt;/li&gt;&#xA;&lt;li&gt;I'm not using any IPS/Web Filter/AV or other UTM features, i.e. no policy has UTM enabled&lt;/li&gt;&#xA;&lt;li&gt;SSL-VPN clients can VPN in from remote sites and are able to connect to the Internet and &lt;em&gt;browse normally&lt;/em&gt;!&lt;/li&gt;&#xA;&lt;li&gt;curl &lt;a href=&quot;http://x.y.z.com&quot; rel=&quot;nofollow&quot;&gt;http://x.y.z.com&lt;/a&gt; works just fine - even when this issue is active&lt;/li&gt;&#xA;&lt;li&gt;curl &lt;a href=&quot;http://x.y.z.com/blah.blah.html&quot; rel=&quot;nofollow&quot;&gt;http://x.y.z.com/blah.blah.html&lt;/a&gt; will just hang until the connection times out or is reset by peer (normally the first)&lt;/li&gt;&#xA;&lt;li&gt;All LAN clients are always accessible fully&lt;/li&gt;&#xA;&lt;li&gt;Issue happens any time of day, but once it happens, is likely to recur in quick succession for the next several hours up to a day&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Once &quot;resolved&quot;, it will generally not recur for several days, sometimes nearly 2 weeks&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;The modem remains accessible and is working through all of this (tested by directly connecting a client to the modem during an outage)&lt;/li&gt;&#xA;&lt;li&gt;Clients on the WAP connected to the &quot;dmz1&quot; port are unaffected&lt;/li&gt;&#xA;&lt;li&gt;No policy or dynamic routes (only statics)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've tried a few things over the span of a couple of months to try to get to the root of the problem:&#xA; - I disabled all UTM (AV/IPS/DoS) references from my policies&#xA; - Moved switch&amp;lt;-&gt;FG-100A uplink from port 1/internal to port 2/internal&#xA; - Tried running traces to identify the issue via SSH, but SSH drops when the issue kicks up&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only solution I have to this right now is a reboot, either via a physical power cycle, or accessing the administrative interface via SSL-VPN for a CLI/GUI reboot. I don't have a console cable, so that's my next step - wire the console into a client and take a look when things go awry next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone run into such an issue or have any insights given some of the parameters above? Based on the curl tests, it looks like the Fortigate is proxying HTTP connections and perhaps that proxy process has a software defect? Reaching here...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some more debugging seems to show that curl always seems to work with &quot;simple&quot; web pages, i.e. text-only pages with no HTML formatting. A simple HTML web page with an included embed (Flash) wouldn't work when this problem occurs. I haven't tried a straight HTML page &lt;em&gt;yet&lt;/em&gt;. I'm suspecting some sort of IPS/AV is still active despite my setup not having them enabled. I think I've gone through all the nooks and crannies of the config, but if anyone knows of a definitive, perhaps CLI based way, of debugging the status of the UTM system, I'd certainly appreciate a pointer.&lt;/p&gt;&#xA;" OwnerUserId="15347" LastEditorUserId="15347" LastEditDate="2015-05-11T06:54:17.967" LastActivityDate="2020-04-13T23:05:46.320" Title="Fortigate: HTTP/HTTPS Traffic Connections Timeout" Tags="|fortigate|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="18415" PostTypeId="2" ParentId="18391" CreationDate="2015-05-11T03:30:19.857" Score="0" Body="&lt;p&gt;i think this is good link and explain  relationship between the PSTN (public switched telephone network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/File:Gsm_structures.svg&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/File:Gsm_structures.svg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15360" LastActivityDate="2015-05-11T03:30:19.857" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18416" PostTypeId="2" ParentId="18363" CreationDate="2015-05-11T05:56:50.577" Score="2" Body="&lt;p&gt;There are several ways to address this. The one you enumerated requires doubling the network infrastructure -- leaving half of it unused &lt;em&gt;all the time&lt;/em&gt;, which is not workable for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could go &lt;em&gt;totally hands on&lt;/em&gt; by directly configuring every device in the network to know into which network it should go -- OS level VLAN tagging. But as I said in comments, that's a lot of work, it's impossible to technically enforce, and some of your users &lt;em&gt;will&lt;/em&gt; break it. I, personally, would avoid this path given Windows does not have native VLAN support; you're are the mercy of NIC driver and other 3rd party software to get there. Yes, you could make &quot;windows&quot; the default native VLAN, but then everything would fall into the windows network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.1x (EAPOL) would be the only technically feasible solution as it's the only currently supported means of dynamic VLAN assignment, &lt;em&gt;at the network layer&lt;/em&gt;. It does still require admin configuration of systems, but it's a method that can be controlled and monitored. EAPOL can be set to either isolate non-authenticated ports, or block them entirely. (I'd go with the former as it makes machine setup easier.) The windows machines can be authenticated by AD using the machine's domain credentials. The linux machines can be handled however you want.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-11T05:56:50.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18418" PostTypeId="1" AcceptedAnswerId="18421" CreationDate="2015-05-11T07:58:29.733" Score="4" ViewCount="10647" Body="&lt;p&gt;I'm having a bit of trouble grasping this, but it is probably me being a moron.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've recently had to familiarise myself with &lt;code&gt;NAT overload&lt;/code&gt; for some network changes we have planned at work. Diving in to it, I can honestly say that I see no difference between NAT overload and standard &lt;code&gt;NAT&lt;/code&gt; though? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It shows a pretty diagram on &lt;a href=&quot;http://www.orbit-computer-solutions.com/NAT-Overload.php&quot; rel=&quot;nofollow&quot;&gt;orbit-computer-solutions.com&lt;/a&gt; that it gets internal IPs, sends them to a router, which then uses NAT overload to send it off in to the web. But, isn't this the regular functionality of NAT in a router? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any key difference between the functionality of NAT overload and regular NAT through a router? I've seen a few things about PAT, but I thought that PAT fell under regular NAT too?&lt;/p&gt;&#xA;" OwnerUserId="15350" LastActivityDate="2016-06-17T10:36:06.517" Title="Difference between NAT overload and regular NAT?" Tags="|router|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18419" PostTypeId="2" ParentId="18391" CreationDate="2015-05-11T07:58:51.817" Score="0" Body="&lt;p&gt;The cellular network towers have connections to fetch data from the Internet, but these connections can use many different technologies. In the early days of mobile communication these connections were mainly leased lines from the PSTN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now these lines can't provide sufficient capacity for the broadband data connectivity offered to the users. New technologies are used such as fiber optics, microwave lines or other depending on different factors (distance, price, capacity, location, legalization ...). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PSTN lines are still used but very rare on place where another alternative is difficult to be implemented. They remain for the GSM mobile networks. Fot UMTS and LTE networks the backhaul consists mainly of IP data network with fiber optics as physical media. An IP bases fiber backhaul can offer much more capacity for the mobile towers.&lt;/p&gt;&#xA;" OwnerUserId="5576" LastActivityDate="2015-05-11T07:58:51.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18421" PostTypeId="2" ParentId="18418" CreationDate="2015-05-11T08:35:10.497" Score="16" Body="&lt;p&gt;Strictly speaking, when performing (pure) NAT, only IP addresses are translated, and every internal IP address has to be translated to a different external IP address. This can be a static one-on-one mapping in the case of &lt;strong&gt;&lt;em&gt;static NAT&lt;/em&gt;&lt;/strong&gt;, or a dynamic mapping with a pool of public addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With &lt;strong&gt;&lt;em&gt;dynamic NAT&lt;/em&gt;&lt;/strong&gt;, the router selects one IP address from the NAT pool when an internal hosts wants to connect to the internet. When a second host sends traffic to the internet, a second external IP from the pool is used. This works just fine, but the number of hosts that can use the internet is limited by the number of external addresses available in the NAT pool. When the 11th host behind a NAT router with a pool of 10 addresses wants to set up a connection, the connection will be refused (until one of the previous mapping times out).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NAT overload&lt;/em&gt;&lt;/strong&gt; overcomes this limitation by allowing internal hosts to share external IP addresses. To keep the connections apart, in addition to swapping the internal IP for an external one, the router can change the source port of the outgoing traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because NAT overload is used most often, it is sometimes considered the default and just called NAT. Other terms include &lt;strong&gt;&lt;em&gt;Port Address Translation&lt;/em&gt;&lt;/strong&gt; (PAT) and &lt;strong&gt;&lt;em&gt;Network Address Port Translation&lt;/em&gt;&lt;/strong&gt; (NAPT). In Linux iptables, it is called masquerading.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-05-11T08:35:10.497" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18423" PostTypeId="1" CreationDate="2015-05-11T12:01:06.797" Score="1" ViewCount="1089" Body="&lt;p&gt;I am seeing the MAC address table is getting full  and there are no more MAC address spaces to give.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Device Model:WS-C3750X-48P&#xA;IOS: c3750e-ipbasek9-mz.150-2.SE4.bin &#xA;Total Mac Address Space Available: 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to increase the number of MAC addresses supported on this device?&lt;/p&gt;&#xA;" OwnerUserId="15353" LastEditorUserId="220" LastEditDate="2015-05-11T17:34:04.837" LastActivityDate="2015-05-12T06:15:03.203" Title="How to increase the number of MAC addresses supported on 3750X?" Tags="|cisco|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18424" PostTypeId="2" ParentId="18423" CreationDate="2015-05-11T12:57:22.700" Score="9" Body="&lt;p&gt;MAC addresses aren't stored in RAM, but in TCAM. You can adjust the Resource Allocation of your TCAM by using a different SDM profile. The default is 6K unicast MAC addresses. The only profile that offers more space for is the VLAN profile, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_53_se/configuration/guide/3750xscg/swsdm.html#wp1104164&quot; rel=&quot;nofollow&quot;&gt;which offers 12K address, but reduces the number of routes you can use to 0&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having 6K MAC addresses is indicative of a different problem though. When you see that many MAC addresses on a switch, you might be looking at Layer 2 segments that are too large. When you have too many hosts in the same Layer two segment, you have a lot of overhead of all those chatty hosts. Also, if anything bad happens on the network, and there is no segmentation, everything will be affected.&#xA;Also, seeing so many MAC addresses on the 3750X probably means that your network is very oversubscribed, making the 3750X a huge bottleneck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the better question to ask yourself first is: Why are there so many unicast MAC addresses on this switch, and how can this be reduced?&lt;/p&gt;&#xA;" OwnerUserId="220" LastEditorUserId="220" LastEditDate="2015-05-12T06:15:03.203" LastActivityDate="2015-05-12T06:15:03.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18426" PostTypeId="2" ParentId="18397" CreationDate="2015-05-11T13:09:20.993" Score="0" Body="&lt;p&gt;The definition is correct. On layer 3, IP addresses are used to identify machines &lt;strong&gt;throughout different networks&lt;/strong&gt;. Basically you can think of it like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;An IP address is used to identify a host across multiple networks.  &lt;/li&gt;&#xA;&lt;li&gt;A MAC address plus IP address is used to identify a host within a network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you are talking to a machine on a different network, you only need to know the IP address. If you are communicating with a machine on your local network segment, you need to know the IP address and the MAC address. &lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2015-05-11T13:09:20.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18429" PostTypeId="2" ParentId="18387" CreationDate="2015-05-11T20:35:21.050" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;in hosts you can find every possible IP address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Only if they've been manually added to the table, or a (static) route indicates the target is &quot;local&quot; (i.e. &quot;on the wire&quot;.) And that can be done to routers, too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router and host use the exact same logic to resolve layer-2 addresses for layer-3 addresses. At layer-2 the src is the device asking, and the dst is the broadcast address (ff:ff:ff:ff:ff:ff). The layer-3 information in the ARP request will be similar -- src ip/mac is the interface address(es) of the device asking, dst ip will be the target desired and mac will be zero because that's what it's looking for.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-11T20:35:21.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18431" PostTypeId="2" ParentId="18391" CreationDate="2015-05-11T20:53:16.640" Score="1" Body="&lt;p&gt;PSTN == ancient circuit switched analog voice communication network. It has been increasingly converted to digital carrier over the decades. But, the &quot;last mile&quot; is still analog, and entirely digital everywhere else -- even transported by IP in many cases. It's only relation to &quot;the internet&quot; was by use of dialup modems. Today DSL rides on the same physical infrastructure, but is &lt;em&gt;not&lt;/em&gt; part of the PSTN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cellular == in it's early days, basically a wireless version of the PSTN. Today it's a totally digital packet switched system. In this sense, data is data. Internet and voice are just streams of 1's and 0's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Internet is a global packet switched communication network crisscrossing a multitude of technologies, some wired (dialup modems, DSL, cable, fiber, etc) and some not (terrestrial microwave, laser, satellite, shortwave radio, IR, ultrasonic, etc)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-11T20:53:16.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18432" PostTypeId="1" CreationDate="2015-05-12T02:34:28.103" Score="6" ViewCount="1150" Body="&lt;p&gt;I'm trying to get some sweet prefix delegation working on my SRX. My provider offers DHCPv6-PD and gives out /56 addresses. I have done setups using cisco routers and am trying to replicate it onto a juniper. My issue is that on Juniper it seems that I cannot define what prefix out of the /56 goes onto each interface. It appears to use the same /64 for every interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# run show interfaces terse                           &#xA;Interface               Admin Link Proto    Local                 Remote&#xA;pp0.0                   up    up   inet     X.X.X.X       --&amp;gt; ISP.ISP.ISP.ISP&#xA;                                   inet6    XXXX:YYYY:a000:c000:1::1/64&#xA;                                            fe80::de38:e10f:fc78:b2c0&#xA;vlan.0                  up    up   inet     10.10.10.1/24   &#xA;                                   inet6    XXXX:YYYY:a000:c000:2::1/64&#xA;                                            fe80::de38:e1ff:fe78:b2c8/64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Relevant configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces pp0 unit 0 family inet6 dhcpv6-client client-type statefull&#xA;set interfaces pp0 unit 0 family inet6 dhcpv6-client client-ia-type ia-pd&#xA;set interfaces pp0 unit 0 family inet6 dhcpv6-client update-router-advertisement interface pp0.0&#xA;set interfaces pp0 unit 0 family inet6 dhcpv6-client update-router-advertisement interface vlan.0&#xA;set interfaces pp0 unit 0 family inet6 dhcpv6-client client-identifier duid-type duid-ll&#xA;set interfaces pp0 unit 0 family inet6 dhcpv6-client req-option domain&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now like I said I am trying to replication configuration from how cisco do it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Dialer10&#xA; ipv6 address prefix-from-provider ::1/64&#xA; ipv6 enable&#xA; ipv6 dhcp client pd prefix-from-provider&#xA;interface GigabitEthernet0/1&#xA; ipv6 address prefix-from-provider ::1:0:0:0:1/64&#xA; ipv6 enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GigabitEthernet0/1         [up/up]&#xA;    FE80::5257:A8FF:FE55:9A81&#xA;    XXXX:YYYY:A000:F201::1&#xA;Dialer10                   [up/up]&#xA;    FE80::5257:A8FF:FE55:9A80&#xA;    XXXX:YYYY:A000:F200::1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't work out for the life of me how to set what assignment each interface should get. Or even what prefix length should be given. It seems to be stuck giving addresses out of the same /64. Any help would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="11927" LastEditorUserId="11927" LastEditDate="2015-05-12T02:39:48.750" LastActivityDate="2021-12-28T06:47:01.520" Title="Juniper SRX IPv6-PD update-router-advertisement issues" Tags="|ipv6|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18434" PostTypeId="1" AcceptedAnswerId="18438" CreationDate="2015-05-12T03:39:32.620" Score="1" ViewCount="596" Body="&lt;p&gt;What is the difference between ISL (inter switch link) on Fiber Channel and trunk links on Ethernet switching?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are they essentially the same thing?&lt;/p&gt;&#xA;" OwnerUserId="15363" LastActivityDate="2015-05-13T01:01:25.923" Title="ISL vs ethernet trunking" Tags="|vlan|ethernet|fiber|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18435" PostTypeId="2" ParentId="18392" CreationDate="2015-05-12T08:02:49.340" Score="1" Body="&lt;p&gt;WAP is still used. I don't know which version it is. It's usage is really small. In our network it generates 200-300 times smaller traffic compared to the other mobile Internet traffic (http, ftp and other). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know why it is still used. Maybe some companies have old devices which are using this protocol - like taxi, tracking, cash terminals, or other similar devices (this is just an example - I'm not sure if these devices actually use WAP).&lt;/p&gt;&#xA;" OwnerUserId="5576" LastActivityDate="2015-05-12T08:02:49.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18436" PostTypeId="2" ParentId="18392" CreationDate="2015-05-12T09:30:35.000" Score="1" Body="&lt;p&gt;Yes and No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Definitely still being use even though it is on a decreasing trend..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding on to @goelakash, reason being used are mostly due to old devices and how much / well the IT OR the business view the IT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For most businesses, if there are no incident, they will not invest in IT no matter how much we warn them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for no, it is because network devices are being upgraded over time for whatever reasons, be it wear and tear or simply because somebody kick the network device (it happens). Thus, IT personnel will take this chance to upgrade to a more relevant device .&lt;/p&gt;&#xA;" OwnerUserId="15368" LastActivityDate="2015-05-12T09:30:35.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18437" PostTypeId="1" AcceptedAnswerId="19335" CreationDate="2015-05-12T12:29:07.583" Score="6" ViewCount="258" Body="&lt;p&gt;I have always been told during my network education that the Internet (and any computer network) is and should be designed so that the intelligence is not located on the core of the network. The core should only have the &quot;dumb&quot; objective to only deliver the data.&#xA;That means no big firewall on the center, no content-serving, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I completely agree with this design, I'm looking at the &quot;why?&quot;.&#xA;Why is this the best design? Is there some kind of literature (RFC, etc.) about that ?&#xA;I'm looking for rational arguments in favor of this design. &lt;/p&gt;&#xA;" OwnerUserId="564" LastActivityDate="2015-06-19T01:01:08.553" Title="Why is the design &quot;intelligence on the edge&quot; better for a computer network?" Tags="|design|internet|rfc|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18438" PostTypeId="2" ParentId="18434" CreationDate="2015-05-12T12:38:47.227" Score="3" Body="&lt;p&gt;ISL on Fiber Channel networks has nothing to do with the &lt;em&gt;ISL trunking protocol&lt;/em&gt; known on Ethernet networks. In Fiber Channel networks, it is simply a way to describe the connection between two Fiber Channel switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Ethernet networks it's a trunking protocol tagging frames with the appropriate VLAN information (as 802.1Q does, which is actually the standard). ISL is a Cisco proprietary trunking protocol pre-dating 802.1Q; it's deprecated and is already removed from the newest switches.&lt;/p&gt;&#xA;" OwnerUserId="15370" LastEditorUserId="619" LastEditDate="2015-05-12T20:00:24.027" LastActivityDate="2015-05-12T20:00:24.027" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18440" PostTypeId="1" CreationDate="2015-05-12T14:25:06.240" Score="2" ViewCount="3657" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/k5JOK.jpg&quot; alt=&quot;network design&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to design a fault tolerant topology. I will be stacking all switches with the appropriate stacking cables, my main concern is if I can use the other SFP ports to create the redundant links between floors? &lt;/p&gt;&#xA;" OwnerUserId="15374" LastActivityDate="2017-10-01T17:09:08.893" Title="creating redundant links using Cisco SG500 series switches" Tags="|cisco|switching|redundant-routes|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18441" PostTypeId="2" ParentId="18437" CreationDate="2015-05-12T15:06:32.453" Score="2" Body="&lt;p&gt;The 'Intelligence at the Edge' design is misleading in light of where the computer networking industry has evolved, and is evolving, to - SDN fashioned architectures where the intelligence is now &lt;em&gt;centralized&lt;/em&gt; ¹ in the controllers.  In a cloud networking, or SDN fashioned architecture, you find &lt;a href=&quot;https://en.wikipedia.org/wiki/Software-defined_networking#Concept&quot; rel=&quot;nofollow&quot;&gt;'intelligent' controllers&lt;/a&gt; and separation of control and data planes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original idea behind 'Intelligence at the Edge' was that required deep packet inspection / manipulation would not be practical at the core where gazillions of pps are processed/forwarded.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Deep packet inspection/modification still occurs at the edge but the decision on what to inspect and what to do with the packets is made and pushed out to the edge from network 'controllers'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;¹ &lt;em&gt;centralized controllers are likely physically distributed across data centers or physical locations for redundancy purposes.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-06-19T01:01:08.553" LastActivityDate="2015-06-19T01:01:08.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18445" PostTypeId="1" AcceptedAnswerId="18446" CreationDate="2015-05-12T17:48:07.957" Score="2" ViewCount="117" Body="&lt;p&gt;Let me start by saying that I am not looking to load balance between 2 ISPs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a site where we get an MPLS ethernet handoff from our ISP. For some reason, our marketing dept. gave a contract company the green light to have their own service dropped in to support a contractor for the next 2 years. I'm still fighting to get my supervisor to shut this down and just let the contractor run on our network as we currently do, but I need to have a solution in hand in case I can't win this battle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am thinking of doing is running their internet connection into my switch stack in order to get from MPOE to contractor cubicles. (company will not pay for cabling) I obviously need a separate IP scope for this VLAN. My thoughts on this are that I should be able to make it work with a unique IP scope, a static route and maybe a couple of ACLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Short version:new network on my equipment, separate ISP/gateway, unique IP scope, new vlan, no intervlan routing.&lt;/p&gt;&#xA;" OwnerUserId="1068" LastActivityDate="2015-05-12T17:52:27.263" Title="configuring 3750x to handle 2nd ISP, for a separate customer/not load balancing" Tags="|cisco|routing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18446" PostTypeId="2" ParentId="18445" CreationDate="2015-05-12T17:52:27.263" Score="5" Body="&lt;p&gt;If you put their L3 interfaces in a separate VRF you would not need ACLs. No need to even mix the routing tables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However you would need to be running IP Services IOS. &lt;/p&gt;&#xA;" OwnerUserId="1613" LastActivityDate="2015-05-12T17:52:27.263" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18448" PostTypeId="1" AcceptedAnswerId="18457" CreationDate="2015-05-12T19:34:06.453" Score="0" ViewCount="1216" Body="&lt;p&gt;I'm trying to figure out if there's a likely scenario where users connected to a virtual switch would have an occasion to need TFTP services to be forwarded over the WAN connection.  Wouldn't it be more likely they would use FTP instead?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my situation, I have some additional information:&#xA;My user-base would consist of hotel guests that would probably only be using web access, but I ask because I'm not sure how common tftp use is over the internet. I didn't want to go blocking things if someome could plausibly need it, but if the usage scenario for tftp is loading firmware, it's well outside of my realm of concern. &lt;/p&gt;&#xA;" OwnerUserId="15376" LastEditorUserId="15376" LastEditDate="2015-05-13T19:05:08.540" LastActivityDate="2015-05-13T19:05:08.540" Title="TFTP over the WAN - would this matter?" Tags="|switch|wan|tftp|" AnswerCount="1" CommentCount="6" ClosedDate="2015-05-13T11:11:19.157" ContentLicense="CC BY-SA 3.0" />
  <row Id="18452" PostTypeId="1" AcceptedAnswerId="18453" CreationDate="2015-05-12T22:13:06.757" Score="4" ViewCount="10704" Body="&lt;p&gt;Ok, I have a cable between two cisco switches. The port on switch A is configured as switchport access vlan 2 and the port on switch B is configured as switchport access vlan 3. For the sake of the current question let's say I cannot change the number of these access vlans. Also, because these are access ports, traffic should be untagged and a trunk is not formed.  Traffic is successfully transferred between switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am getting a &quot;Native Vlan Mismatch&quot; error.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aren't these mismatches generally shown only when a trunk is formed?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the same problems associated with trunks and a native vlan mismatch occur?&lt;/p&gt;&#xA;" OwnerUserId="4547" LastActivityDate="2015-05-12T22:16:43.873" Title="Native VLAN Mismatch between two access ports on cisco switches" Tags="|cisco|vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18453" PostTypeId="2" ParentId="18452" CreationDate="2015-05-12T22:16:43.873" Score="3" Body="&lt;p&gt;CDP (LLDP) lists how the each port is configured. Cisco, in their infinite wisdom, thinks access ports in different VLANs are an error. They aren't, but it could be a misconfiguration. Disable CDP and the switch will shut up about it.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-12T22:16:43.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18454" PostTypeId="2" ParentId="18397" CreationDate="2015-05-12T22:41:27.003" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;IP addresses are used on layer 3 to identify machines throughout different networks&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a correct statement.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is this technically incorrect since you would also need a MAC address to identify the machines within the network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, MAC addresses do not exist at layer 3, therefore they cannot carry any consideration at layer 3.  If you were discussing networking in general or were including layer 2, then you might have some basis behind your statement. But the original statement specifically identifies this as layer 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, MAC addresses are not required at all if the layer 2 protocol doesn't need them. So while layer 2 MAC addresses exist in the vast majority of cases, you could have an IP address without a MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The use of technologies like NAT can muddy the issue a bit, but the general principle still holds true.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IP addresses are used on layer 3 to identify networks and MAC addresses are use to identify machines in that network. Is this correct?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. IP addresses are used to identify devices or hosts, not networks.  Therefore they do not identify networks.  However, IP address ranges can be used to identify networks.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-05-12T22:41:27.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18455" PostTypeId="2" ParentId="18434" CreationDate="2015-05-13T01:01:25.923" Score="-3" Body="&lt;p&gt;Essentially ISL in fiber channel and trunk link on ethernet channel carry same task... but difference is its two type of reduntet path of data transmission. ISL in fiber channel is its own path of data transmission which connect two fiber links and trunk link in ethernet switching is its path of data transmission, which use the TCP/IP protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The path of network changes according to the network and protocol. FSPF(fabric shortest path first) is the protocol of fiber link and TCP/IP for ethernet link. &lt;/p&gt;&#xA;" OwnerUserId="15366" LastActivityDate="2015-05-13T01:01:25.923" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18457" PostTypeId="2" ParentId="18448" CreationDate="2015-05-13T02:44:41.730" Score="1" Body="&lt;p&gt;In general, it's &lt;em&gt;probably&lt;/em&gt; safe to block on the WAN. I wouldn't be surprise to find an application is using TFTP over the internet, but it would be &lt;em&gt;rare&lt;/em&gt;.[*]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real question is &lt;em&gt;do you know what your users need&lt;/em&gt;? Will those users understand why Application Foo is broken because TFTP is blocked? (do they know what TFTP &lt;em&gt;is&lt;/em&gt;?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[*] Netopia used to &quot;support&quot; this. I always thought it was stupid, and rarely worked, but you &lt;em&gt;could&lt;/em&gt; tell your netopia device to fetch images directly from netopia.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-13T02:44:41.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18459" PostTypeId="1" AcceptedAnswerId="18473" CreationDate="2015-05-13T10:25:05.657" Score="1" ViewCount="305" Body="&lt;p&gt;Does the Cable types determine which type of frame it will carry? Just for a example can't i use a fiber cable to create a star topology which carry ethernet frame? I know this might sound bizzare  that why some one will use a fiber cable that in start topology but just to clear the concepts ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example the LAN is a network which is in the close geographical location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what i get from this is any network which is established in a small geograohical location is  a LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A physical topology is the way devices are connected physically so are there any standard topology which we follow while establishing out a LAN like star,ring,mesh,bus ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And what are the roles of cables which we use to establish a network ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the frame type is decided by the type of cables which we use to establish a network ? and does the topogy is dependt on the type of cable which we use in establishing the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help though i understand the topogy, network and cables differently but don't know how they amalgamate in a network ?&lt;/p&gt;&#xA;" OwnerUserId="15390" LastActivityDate="2015-05-13T21:35:28.287" Title="Cabling and Topology Confusion" Tags="|ethernet|cabling|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18460" PostTypeId="2" ParentId="18459" CreationDate="2015-05-13T11:15:08.910" Score="3" Body="&lt;p&gt;LAN/WAN/MAN have no effect with cabling. In LAN cable can be optical. But in real life it is not used in LAN because of cost and some other issues like performance, equipment etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which type of cable will be used it depend on bandwidth, length, cost etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And again you can make any topology using any cable. if you dont concern about performance.  &lt;/p&gt;&#xA;" OwnerUserId="14024" LastActivityDate="2015-05-13T11:15:08.910" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18461" PostTypeId="1" CreationDate="2015-05-13T11:49:05.847" Score="3" ViewCount="10932" Body="&lt;p&gt;Sorry for the simplicity of the question, I just need some help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say I have a NAT rule on my firewall that translates a public IP into a private one (say 195.111.111.2 to 10.1.1.10)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can understand how the packet traverses the internal network, but lets say an application wants to send a response back. It will have the &quot;source address&quot; and so knows where to send the packet, and will most likely hit some default routes on the way back out until it hits my firewall. How does my firewall know to inject the 195.111.111.2 source address back into the packet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do i have to set up two NATs for every NAT or is the one NAT rule implying the reverse translation will be done?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel this may be unclear, but hopefully it isn't.&lt;/p&gt;&#xA;" OwnerUserId="15391" LastActivityDate="2015-05-14T11:15:21.200" Title="Very simple NAT question. How does a packet get back out?" Tags="|routing|nat|firewall|" AnswerCount="3" CommentCount="2" ClosedDate="2015-05-14T15:14:21.300" ContentLicense="CC BY-SA 3.0" />
  <row Id="18462" PostTypeId="2" ParentId="18461" CreationDate="2015-05-13T12:28:10.570" Score="0" Body="&lt;p&gt;Are you coding firewall ? &#xA;This may be helpful&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One option can be maintain tables that will contain detail so you will require 4 fields, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;source IP, Source Port, Dest IP, Dest Por&lt;/code&gt;t. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When packet will entered then fields may be like &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;201.1.1.10, 80, 195.111.111.2 , 2345&lt;/code&gt;  &lt;strong&gt;let (201.1.1.10, 80 are IP and port of default internet)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then your firewall will change it to like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;195.111.111.2, Port of firewall, 10.1.1.10, port of host&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and when packet will get back to your firewall &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.1.10, port of host, 195.111.111.2, Port of firewall&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14024" LastActivityDate="2015-05-13T12:28:10.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18463" PostTypeId="1" CreationDate="2015-05-13T13:43:28.137" Score="2" ViewCount="1290" Body="&lt;p&gt;I am aware that &lt;code&gt;ICMP &quot;echo request&quot;&lt;/code&gt; messages addressed to router are handled in process switching in case or routers running IOS. However, what about Cisco ASR9K routers running IOS-XR? Is the handling of &lt;code&gt;ICMP &quot;echo request&quot;&lt;/code&gt; messages exactly like in software-routers running IOS?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-05-19T18:29:14.810" Title="ICMP &quot;echo request&quot; handling on routers running Cisco IOS-XR" Tags="|icmp|cisco-ios-xr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18466" PostTypeId="2" ParentId="18463" CreationDate="2015-05-13T17:15:40.530" Score="5" Body="&lt;p&gt;On ASR9k running IOS-XR ICMP packets destined to the router are handled by LTPS (Local Packet Transport System). I believe that under normal circumstances the entire processing of such packet is done on ingress linecard CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the NP on ingress LC detects the packet is for-us, it hands it over to LTPS. LTPS will perform policing, conforming packets are then passed either to LC CPU or RP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The counters for different kinds of traffic for particular LC can be checked with following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:ASR9006#show lpts pifib hardware police location 0/1/CPU0&#xA;Tue May 19 11:03:19.188 UTC&#xA;-------------------------------------------------------------&#xA;                Node 0/1/CPU0:&#xA;-------------------------------------------------------------&#xA; Burst = 100ms for all flow types &#xA;-------------------------------------------------------------&#xA;FlowType               Policer Type    Cur. Rate  Def. Rate  Accepted             Dropped              TOS Value &#xA;---------------------- ------- ------- ---------- ---------- -------------------- -------------------- ----------&#xA;unconfigured-default   100     Static  2500       2500       0                    0                    01234567            &#xA;L2TPv2-fragment        185     Static  10000      10000      0                    0                    01234567            &#xA;Fragment               101     Static  2500       2500       0                    0                    01234567            &#xA;OSPF-mc-known          102     Static  2000       2000       356486               0                    01234567            &#xA;OSPF-mc-default        103     Static  1500       1500       0                    0                    01234567            &#xA;OSPF-uc-known          104     Static  2000       2000       81                   0                    01234567            &#xA;OSPF-uc-default        105     Static  1000       1000       0                    0                    01234567            &#xA;ISIS-known             143     Static  2000       2000       0                    0                    01234567            &#xA;ISIS-default           144     Static  1500       1500       0                    0                    01234567            &#xA;BFD-known              150     Static  9600       9600       0                    0                    01234567            &#xA;BFD-default            160     Static  45340      9600       0                    0                    01234567            &#xA;BFD-MP-known           178     Static  11520      11520      0                    0                    01234567            &#xA;BFD-MP-0               179     Static  128        128        0                    0                    01234567            &#xA;BFD-BLB-known          183     Static  11520      11520      0                    0                    01234567            &#xA;BFD-BLB-0              184     Static  128        128        0                    0                    01234567            &#xA;BFD-SP-0               182     Static  512        512        0                    0                    01234567            &#xA;BGP-known              106     Static  2500       2500       1424782              0                    01234567            &#xA;BGP-cfg-peer           107     Static  2000       2000       8                    0                    01234567            &#xA;BGP-default            108     Static  1500       1500       87                   0                    01234567            &#xA;PIM-mcast-default      109     Static  2000       2000       0                    0                    01234567            &#xA;PIM-mcast-known        176     Static  2000       2000       0                    0                    01234567            &#xA;PIM-ucast              110     Static  1500       1500       0                    0                    01234567            &#xA;IGMP                   111     Static  3000       3000       0                    0                    01234567            &#xA;ICMP-local             112     Static  1500       1500       17                   0                    01234567            &#xA;ICMP-app               152     Static  1500       1500       0                    0                    01234567            &#xA;ICMP-control           140     Static  1000       1000       0                    0                    01234567            &#xA;ICMP-default           153     Static  1500       1500       2                    0                    01234567            &#xA;ICMP-app-default       152     Static  1500       1500       0                    0                    01234567            &#xA;LDP-TCP-known          113     Static  2500       2500       56736                0                    01234567            &#xA;LDP-TCP-cfg-peer       114     Static  2000       2000       0                    0                    01234567            &#xA;LDP-TCP-default        115     Static  1500       1500       0                    0                    01234567            &#xA;LDP-UDP                116     Static  2000       2000       401486               0                    01234567            &#xA;All-routers            117     Static  1000       1000       0                    0                    01234567            &#xA;LMP-TCP-known          168     Static  2500       2500       0                    0                    01234567            &#xA;LMP-TCP-cfg-peer       169     Static  2000       2000       0                    0                    01234567            &#xA;LMP-TCP-default        170     Static  1500       1500       0                    0                    01234567            &#xA;LMP-UDP                171     Static  2000       2000       0                    0                    01234567            &#xA;RSVP-UDP               118     Static  2000       2000       0                    0                    01234567            &#xA;RSVP-default           154     Static  500        500        0                    0                    01234567            &#xA;RSVP-known             177     Static  7000       7000       0                    0                    01234567            &#xA;IKE                    119     Static  100        100        0                    0                    01234567            &#xA;IPSEC-known            120     Static  400        400        0                    0                    01234567            &#xA;IPSEC-default          121     Static  100        100        0                    0                    01234567            &#xA;MSDP-known             122     Static  300        300        0                    0                    01234567            &#xA;MSDP-cfg-peer          123     Static  200        200        0                    0                    01234567            &#xA;MSDP-default           124     Static  100        100        0                    0                    01234567            &#xA;SNMP                   125     Static  300        300        221047               0                    01234567            &#xA;SSH-known              127     Static  300        300        597                  0                    01234567            &#xA;SSH-default            128     Static  200        200        218                  0                    01234567            &#xA;HTTP-known             129     Static  400        400        0                    0                    01234567            &#xA;HTTP-default           130     Static  200        200        0                    0                    01234567            &#xA;SHTTP-known            161     Static  400        400        0                    0                    01234567            &#xA;IFIB_FT_SHTTP_DEFAULT  162     Static  200        200        0                    0                    01234567            &#xA;TELNET-known           131     Static  200        200        0                    0                    01234567            &#xA;TELNET-default         132     Static  200        200        0                    0                    01234567            &#xA;CSS-known              133     Static  200        200        0                    0                    01234567            &#xA;CSS-default            134     Static  200        200        0                    0                    01234567            &#xA;RSH-known              135     Static  200        200        0                    0                    01234567            &#xA;RSH-default            136     Static  200        200        0                    0                    01234567            &#xA;UDP-known              137     Static  2500       2500       0                    0                    01234567            &#xA;UDP-listen             138     Static  2500       2500       0                    0                    01234567            &#xA;UDP-cfg-peer           155     Static  2500       2500       0                    0                    01234567            &#xA;UDP-default            163     Static  3500       3500       2396                 0                    01234567            &#xA;TCP-known              156     Static  2500       2500       0                    0                    01234567            &#xA;TCP-listen             157     Static  2500       2500       0                    0                    01234567            &#xA;TCP-cfg-peer           158     Static  2000       2000       0                    0                    01234567            &#xA;TCP-default            164     Static  2000       2000       72                   0                    01234567            &#xA;Mcast-known            159     Static  2500       2500       0                    0                    01234567            &#xA;Mcast-default          165     Static  2000       2000       0                    0                    01234567            &#xA;Raw-listen             166     Static  2500       2500       0                    0                    01234567            &#xA;Raw-default            167     Static  2500       2500       0                    0                    01234567            &#xA;Ip-Sla                 139     Static  1000       1000       0                    0                    01234567            &#xA;EIGRP                  145     Static  1500       1500       0                    0                    01234567            &#xA;RIP                    146     Static  1500       1500       0                    0                    01234567            &#xA;L2TPv3                 141     Static  400        400        0                    0                    01234567            &#xA;PCEP                   142     Static  200        200        0                    0                    01234567            &#xA;GRE                    147     Static  10000      10000      0                    0                    01234567            &#xA;VRRP                   148     Static  1000       1000       0                    0                    01234567            &#xA;HSRP                   149     Static  400        400        0                    0                    01234567            &#xA;MPLS-oam               151     Static  250        250        0                    0                    01234567            &#xA;L2TPv2-default         172     Static  2000       2000       0                    0                    01234567            &#xA;L2TPv2-known           181     Static  2500       2500       0                    0                    01234567            &#xA;DNS                    173     Static  2000       2000       0                    0                    01234567            &#xA;RADIUS                 174     Static  2000       2000       0                    0                    01234567            &#xA;TACACS                 175     Static  2000       2000       0                    0                    01234567            &#xA;NTP-default            126     Static  200        200        0                    0                    01234567            &#xA;NTP-known              180     Static  200        200        0                    0                    01234567            &#xA;AMT                    186     Static  4000       4000       0                    0                    01234567            &#xA;MIPv6                  188     Static  0          0          0                    0                    01234567            &#xA;SDAC-TCP               187     Static  5000       5000       0                    0                    01234567            &#xA;ONEPK                  189     Static  0          0          0                    0                    01234567 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="970" LastEditorUserId="970" LastEditDate="2015-05-19T18:29:14.810" LastActivityDate="2015-05-19T18:29:14.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18470" PostTypeId="1" CreationDate="2015-05-13T21:17:52.453" Score="0" ViewCount="74" Body="&lt;p&gt;I have a question regarding connections within a university setting. In my room I have two network points. One for my pc and one for my voip phone. Each network port is restricted to one mac address, switches and hubs are blocked. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to connect three devices using only two ports, without the use of hubs, switches or routers? For example I would like to have two pcs and one voip phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each device on the network must have it's mac address registered and is assigned an ip via dhcp. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it's possible to spoof mac addresses of registered devices on to non registered devices etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate the help and apologies if this is a silly question!&lt;/p&gt;&#xA;" OwnerUserId="15405" LastEditorUserId="509" LastEditDate="2015-08-16T21:43:38.203" LastActivityDate="2015-08-16T21:43:38.203" Title="Port restrictions and MACs" Tags="|ipv4|dhcp|mac-address|" AnswerCount="1" CommentCount="7" ClosedDate="2015-05-13T22:33:46.003" ContentLicense="CC BY-SA 3.0" />
  <row Id="18472" PostTypeId="2" ParentId="18461" CreationDate="2015-05-13T21:24:10.343" Score="1" Body="&lt;p&gt;The NAT'ing device keeps a table of mappings.  As packets are returned to the original sender (the routable IP address that sent them) the NAT device does a lookup in that table to re-address the destination packet with the inside private IP.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-13T21:24:10.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18473" PostTypeId="2" ParentId="18459" CreationDate="2015-05-13T21:35:28.287" Score="3" Body="&lt;p&gt;The topology is independent of the framing type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Frame type is defined at the data link layer of the OSI model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cable type is defined at the physical layer of the OSI model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rjqEf.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-13T21:35:28.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18475" PostTypeId="2" ParentId="18470" CreationDate="2015-05-13T22:24:38.057" Score="1" Body="&lt;p&gt;Install a second Ethernet NIC card on the machine that has wired network access.  This NIC card can be setup with services such as DHCP server and default gateway with PAT to enable other devices behind it wired network access.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-13T22:24:38.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18477" PostTypeId="1" CreationDate="2015-05-14T06:34:14.520" Score="4" ViewCount="1333" Body="&lt;p&gt;I currently have two internet connections coming into my main office. The primary connection is regular static IP cable service and the secondary is a dedicated MPLS Ethernet connection. The primary cable internet terminates at an ASA 5510 (192.168.0.5) and the secondary internet connection terminates at an ASA 5550 (192.168.0.7). Both reside on the 192.168.0.0/24 network and are connected to a 4500-e switch with a 6L-E supervisor. The 192.168.0.0/24 network uses an ISR 2851 (192.168.0.1) router as the default gateway providing connectivity to 3 other offices through private IP service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NE0Vt.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a few years now all I had in the way of internet service was the static IP cable service. I had a default route in the 2851 gateway router &quot;ip route 0.0.0.0 0.0.0.0 192.168.0.5&quot; and all hosts on the 192.168.0.0/24 network were able to access the internet. However now I've come across a situation where I have one specific server (192.168.0.100) that needs to exclusively use my new secondary MPLS internet connection. For the life of me I cannot figure out how to get this to work. I only have limited access to the network settings on this server and can only configure things like the IP/mask and default gateway. I've tried adding a second default route on the gateway router but that didn't work. Any help would be much appreciated as I think I'm in over my head on this one. Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="15408" LastEditorUserId="775" LastEditDate="2015-05-20T11:05:40.680" LastActivityDate="2015-06-19T16:49:34.150" Title="How to use secondary internet exclusively for one host?" Tags="|routing|cisco-asa|cisco-ios|internet|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="18479" PostTypeId="1" AcceptedAnswerId="18484" CreationDate="2015-05-14T09:38:30.647" Score="2" ViewCount="199" Body="&lt;p&gt;I have a Cisco ASR-9001 router running IOS-XR version 4.2.3 and its interface Gi0/0/0/5.1 has following &lt;code&gt;service-policy&lt;/code&gt; applied in ingress direction:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;policy-map bw-cir-50Mbps&#xA; class class-default&#xA;  police rate 50 mbps burst 937500 bytes &#xA;   exceed-action drop&#xA;  !&#xA; !&#xA; end-policy-map&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if I execute the &lt;code&gt;sh policy-map interface Gi0/0/0/5.1 input&lt;/code&gt; command I can see that that the policer has dropped &lt;code&gt;26472&lt;/code&gt; packets and &lt;code&gt;37176528&lt;/code&gt; bytes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:r1#sh policy-map interface Gi0/0/0/5.1 input | i dropped&#xA;    Policed and dropped :               26472/37176528           &#xA;RP/0/RSP0/CPU0:r1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if I search through the whole SNMP OID tree of SNMP agent in r1 router, I receive following results:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ snmpwalk -v 2c -c public r1 iso | grep -E &quot;26472|37176528&quot;&#xA;CISCO-SMI::ciscoMgmt.166.1.15.1.1.13.1846028775.1748208914 = Counter32: 26472&#xA;CISCO-SMI::ciscoMgmt.166.1.15.1.1.14.1846028775.1748208914 = Counter64: 26472&#xA;CISCO-SMI::ciscoMgmt.166.1.15.1.1.16.1846028775.1748208914 = Counter32: 37176528&#xA;CISCO-SMI::ciscoMgmt.166.1.15.1.1.17.1846028775.1748208914 = Counter64: 37176528&#xA;CISCO-SMI::ciscoMgmt.166.1.17.1.1.9.1846028775.1163943827 = Counter32: 26472&#xA;CISCO-SMI::ciscoMgmt.166.1.17.1.1.10.1846028775.1163943827 = Counter64: 26472&#xA;CISCO-SMI::ciscoMgmt.166.1.17.1.1.12.1846028775.1163943827 = Counter32: 37176528&#xA;CISCO-SMI::ciscoMgmt.166.1.17.1.1.13.1846028775.1163943827 = Counter64: 37176528&#xA;$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As seen above, there are two &quot;sections&quot;, i.e. &lt;code&gt;CISCO-SMI::ciscoMgmt.166.1.15&lt;/code&gt;(&lt;em&gt;cbQosClassMapStats&lt;/em&gt;) and &lt;code&gt;CISCO-SMI::ciscoMgmt.166.1.17&lt;/code&gt;(&lt;em&gt;cbQosPoliceStats&lt;/em&gt;). What is the difference between the two? Under which circumstances &lt;em&gt;cbQosClassMapStats&lt;/em&gt; differs from &lt;em&gt;cbQosPoliceStats&lt;/em&gt;?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-05-14T12:44:05.643" Title="difference between Cisco &quot;cbQosClassMapStats&quot; and &quot;cbQosPoliceStats&quot; SNMP objects" Tags="|snmp|cisco-ios-xr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18480" PostTypeId="1" CreationDate="2015-05-14T09:57:50.133" Score="0" ViewCount="344" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/eh7Ep.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WIRELESS HTTP TRAFFIC INJECTION &lt;a href=&quot;https://twitter.com/konklone/status/598696478018666496/photo/1&quot; rel=&quot;nofollow noreferrer&quot;&gt;(from this tweet)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How it possible? with a network middleware for adapters or what?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read a lot about Packet Injection, i've tried libraries like JNetPCap and others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any programmatically solution to do it with Java or Python?&lt;/p&gt;&#xA;" OwnerUserId="15411" LastActivityDate="2015-05-14T15:00:54.100" Title="How this wifi http injection works?" Tags="|wireless|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-20T05:29:03.953" ContentLicense="CC BY-SA 3.0" />
  <row Id="18481" PostTypeId="2" ParentId="18461" CreationDate="2015-05-14T11:15:21.200" Score="3" Body="&lt;p&gt;I thought I would answer my own question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was referring to DNAT (Destination NAT) where the destination IP is modified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a simple explanation of what happens to a packet, taken from &lt;a href=&quot;http://www.mad-hacking.net/documentation/linux/security/iptables/nat.xml&quot; rel=&quot;nofollow&quot;&gt;http://www.mad-hacking.net/documentation/linux/security/iptables/nat.xml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A packet arrives at the public address with that address set as its destination address and its source address set to that of the originating host.&lt;/li&gt;&#xA;&lt;li&gt;A DNAT rule is encountered where the destination address of the packet is modified to the internal IP.&lt;/li&gt;&#xA;&lt;li&gt;The firewall host makes a routing decision and sends the packet out of the correct interface destined for the address which was just rewritten. The packet's source address is unchanged and still represents the originating host.&lt;/li&gt;&#xA;&lt;li&gt;The packet arrives at the host we specified. This host then generates a response packet which it sends back to the originating host. As the source address was unchanged it should be sent back via the default gateway which will be the firewall host in the previous step.&lt;/li&gt;&#xA;&lt;li&gt;The packet is received by the firewall host which sees that it is destined for the same host which it just performed the DNAT operation for. It therefore modifies the source address of the returning packet so that it looks like it came from the address it was destined for before it was DNATed in step two.&lt;/li&gt;&#xA;&lt;li&gt;The packet arrives at the host which requested it and, as its source address is the same as that to which the original request was sent, is gratefully received.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In scenarios where default route would send the packet out of a different interface from which it was received, double NATing is the answer. For example this resource &lt;a href=&quot;http://www.fwbuilder.org/4.0/docs/users_guide5/double_nat.shtml&quot; rel=&quot;nofollow&quot;&gt;http://www.fwbuilder.org/4.0/docs/users_guide5/double_nat.shtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15391" LastActivityDate="2015-05-14T11:15:21.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18484" PostTypeId="2" ParentId="18479" CreationDate="2015-05-14T12:44:05.643" Score="4" Body="&lt;p&gt;Class-maps can be used for much more than just policing traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The more general &quot;cbQOSClassMapStats&quot; would show a different count if you were also taking other actions than just &quot;police&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if in the same class map you were also queueing, you'd need to look at the &quot;cbQOSQueueingStats&quot; OID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd recommend reading through &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.166.1#oidContent&quot; rel=&quot;nofollow&quot;&gt;Cisco's MIB object navigator for CISCO-CLASS-BASED-QOS-MIB&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2015-05-14T12:44:05.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18486" PostTypeId="2" ParentId="18480" CreationDate="2015-05-14T14:55:06.307" Score="1" Body="&lt;p&gt;This is more a function of injecting data into the HTTP stream than it is of specifically injecting packets into the TCP/IP stream  (although depending on how much data is being injected into HTTP, it might call for additional packets).  Whether your client is connected via Wire or Wireless is irrelevant in this particular case (although its probably fair to assume something like this would happen more often over a WiFi connection -- but it can happen to both).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since HTTP is unencrypted, anyone between you and the end-server you're talking to can see the data being sent back and forth.  A device can be configured to intercept the incoming HTTP, add the relevant code that creates the Southwest drop down page menu, then send both the original HTTP and the new code along to the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of load balancers these days have the ability to inject HTTP data or cookies into HTTP conversations.  A lot of Firewalls/Loadbalancers have the ability to redirect HTTP connections through a Proxy service which in turn can modify or add to the HTTP conversation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're concerned about how the &quot;new injected HTTP&quot; works with the &quot;original HTTP website&quot; in so far as styling and HTML code itself.  Or even how to replicate this with a Linux box using Python/Perl/etc, then that question might be better asked on a more appropriate Stack Exchange community, since that answer wouldn't really fall within the realms of Network Engineering.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2015-05-14T15:00:54.100" LastActivityDate="2015-05-14T15:00:54.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18487" PostTypeId="1" CreationDate="2015-05-14T15:07:42.783" Score="2" ViewCount="563" Body="&lt;p&gt;I have a server connected to Cisco &lt;em&gt;WS-C3560G-24TS&lt;/em&gt; switch GigE port. I need to check if the server creates few seconds &gt;500Mbps traffic bursts. The server is not under my management. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first, I made a simple script which stores the interface ingress bytes into a variable (&lt;code&gt;bps1&lt;/code&gt;), sleeps one second, stores the ingress bytes into another variable (&lt;code&gt;bps2&lt;/code&gt;), calculates the amount of bits received, stores it in variable named &lt;code&gt;delta&lt;/code&gt;, and prints a log message if &lt;code&gt;delta&lt;/code&gt; is larger than 500Mbps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;while :; do&#xA;  for i in {1..2}; do&#xA;    declare bps&quot;$i&quot;=$(snmpwalk -Ov -v 2c -c public switch ifHCInOctets.10101 | sed 's/^.* //');&#xA;    sleep 1;&#xA;  done;&#xA;  delta=$(( (bps2 - bps1)*8 ));&#xA;  echo &quot;$bps1&quot; &quot;$bps2&quot; &quot;$delta&quot;;&#xA;  (( delta &amp;gt; 500000000 )) &amp;amp;&amp;amp; printf '%s\n' &quot;$(date -u &quot;+%d.%m.%y %H:%M:%S&quot;) UTC ingress traffic from customer was &quot;$delta&quot; bps&quot;;&#xA;done | tee -a bps.log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;echo &quot;$bps1&quot; &quot;$bps2&quot; &quot;$delta&quot;;&lt;/code&gt; line above is just for troubleshooting purposes. Cisco IOS updates the &lt;code&gt;ifHCInOctets&lt;/code&gt; counter with 1ts interval.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as one while loop takes longer to complete than exactly one second, then occasionally the script reports bps of two intervals. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;155268562689729 155268611695817 392048704&#xA;155268714010296 155268764441853 403452456&#xA;155268862787657 155268910277237 379916640&#xA;155269008492724 155269103039983 756378072&#xA;14.05.15 14:59:19 UTC ingress traffic from customer was 756378072&#xA;155269148645940 155269195558201 375298088&#xA;155269295068336 155269395399778 802651536&#xA;14.05.15 14:59:26 UTC ingress traffic from customer was 802651536&#xA;155269492138530 155269538915854 374218592&#xA;155269631823265 155269679591240 382143800&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I guess such a method works only for longer polling periods? What are the other possibilities to detect short traffic bursts? Policer with counters in switch/router? Some other clever method?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="8499" LastEditDate="2016-03-12T05:00:23.887" LastActivityDate="2016-06-10T07:55:42.560" Title="Reliable method to detect short traffic bursts" Tags="|cisco|snmp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18489" PostTypeId="1" CreationDate="2015-05-14T15:24:41.363" Score="4" ViewCount="1611" Body="&lt;p&gt;Recently I installed a Cisco ASA 5512-X, and have successfully set it up for traffic to the outside, and traffic going out from the Exchange server is fine.  But incoming traffic and access to the OWA web portal, I cannot get configured so that it will work properly.  Any assistance would be greatly appreciated.  Not sure where I have missed the correct setting to allow the traffic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Hardware:   ASA5512, 4096 MB RAM, CPU Clarkdale 2792 MHz, 1 CPU (2 cores)&#xA;:&#xA;ASA Version 9.2(3)4 &#xA;!&#xA;interface GigabitEthernet0/0&#xA; nameif Outside&#xA; security-level 0&#xA; ip address xxx.xxx.xxx.163 255.255.255.248 &#xA;!&#xA;interface GigabitEthernet0/1&#xA; description Inside IP's&#xA; nameif Inside&#xA; security-level 100&#xA; ip address 192.168.0.1 255.255.255.0 &#xA; ipv6 enable&#xA; dhcprelay information trusted&#xA;!&#xA;interface GigabitEthernet0/2&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/4&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/5&#xA; description Client WiFi&#xA; nameif Client&#xA; security-level 0&#xA; ip address 172.16.0.1 255.255.255.0 &#xA;!&#xA;interface Management0/0&#xA; management-only&#xA; nameif management&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0 &#xA; dhcprelay information trusted&#xA;!&#xA;ftp mode passive&#xA;dns domain-lookup Outside&#xA;dns domain-lookup Inside&#xA;dns server-group DefaultDNS&#xA; name-server 192.168.0.8&#xA; name-server 192.168.0.144&#xA; domain-name xxx.xxx.xxx&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network ClientGateway&#xA; host 172.16.0.1&#xA; description ClientGateway&#xA;object network EmpGateway&#xA; host 192.168.0.1&#xA; description EmpGateway&#xA;object network xxxxx-VPN-IPs&#xA; range 192.168.0.235 192.168.0.254&#xA; description xxxxx-VPN-IPs&#xA;object network obj-172.16.0.0&#xA; subnet 172.16.0.0 255.255.255.0&#xA;object network obj-192.168.0.0&#xA; subnet 192.168.0.0 255.255.255.0&#xA;object network Exchange-Int&#xA; host 192.168.0.16&#xA;access-list outside_access_in extended permit tcp any object Exchange-Int eq https &#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;logging recipient-address xxxxxx@xxxxxx.org level critical&#xA;mtu Outside 1500&#xA;mtu Inside 1500&#xA;mtu Client 1500&#xA;mtu management 1500&#xA;ip verify reverse-path interface Inside&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-741.bin&#xA;asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (any,Outside) source dynamic ClientGateway interface&#xA;nat (any,Outside) source dynamic EmpGateway interface&#xA;nat (Client,Outside) source dynamic obj-172.16.0.0 interface&#xA;nat (Inside,Outside) source dynamic obj-192.168.0.0 interface&#xA;nat (any,Outside) source dynamic any interface&#xA;!&#xA;object network Exchange-Int&#xA; nat (Inside,Outside) static interface service tcp https https &#xA;!&#xA;nat (management,Outside) after-auto source dynamic any interface&#xA;route Outside 0.0.0.0 0.0.0.0 209.50.114.166 1&#xA;route Outside 192.168.0.0 255.255.255.0 209.50.114.166 1&#xA;route Outside xxx.xxx.xxx.160 255.255.255.248 xxx.xxx.xxx.166 1&#xA;route Inside 0.0.0.0 0.0.0.0 xxx.xxx.xxx.164 tunneled&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;aaa-server xxxx protocol ldap&#xA;aaa-server xxxx (Inside) host 192.168.0.8&#xA; server-type auto-detect&#xA;aaa-server xxxx (Inside) host 192.168.0.9&#xA; server-type auto-detect&#xA;aaa-server xxxx (Inside) host 192.168.0.15&#xA; server-type auto-detect&#xA;aaa-server xxxx (Inside) host 192.168.0.16&#xA; server-type auto-detect&#xA;aaa-server xxxx (Inside) host 192.168.0.17&#xA; server-type auto-detect&#xA;aaa-server xxxx (Inside) host 192.168.0.130&#xA; server-type auto-detect&#xA;aaa-server xxxx (Inside) host 192.168.0.144&#xA; server-type auto-detect&#xA;user-identity default-domain LOCAL&#xA;http server enable&#xA;http 192.168.1.0 255.255.255.0 management&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map Inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map Inside_map interface Inside&#xA;crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map Outside_map interface Outside&#xA;crypto ca trustpoint Exchange&#xA; enrollment terminal&#xA; keypair Exchange&#xA; crl configure&#xA;crypto ca trustpoint ASDM_TrustPoint0&#xA; keypair Exchange&#xA; crl configure&#xA;crypto ca trustpool policy&#xA;crypto ca server &#xA; shutdown&#xA; keysize 2048&#xA; keysize server 2048&#xA; smtp from-address xxxxx@xxxxx.org&#xA;crypto ca certificate chain ASDM_TrustPoint0&#xA; certificate 048dada87796c4&#xA;    308205ad 30820495 a0030201 02020704 8dada877 96c4300d 06092a86 4886f70d &#xA;    01010b05 003081b4 310b3009 06035504 06130255 53311030 0e060355 04081307 &#xA;    4172697a 6f6e6131 13301106 03550407 130a5363 6f747473 64616c65 311a3018 &#xA;    06035504 0a131147 6f446164 64792e63 6f6d2c20 496e632e 312d302b 06035504 &#xA;    0b132468 7474703a 2f2f6365 7274732e 676f6461 6464792e 636f6d2f 7265706f &#xA;    7369746f 72792f31 33303106 03550403 132a476f 20446164 64792053 65637572 &#xA;    65204365 72746966 69636174 65204175 74686f72 69747920 2d204732 301e170d &#xA;    31343035 32373137 33383134 5a170d31 35303730 37323034 3335365a 30453121 &#xA;    301f0603 55040b13 18446f6d 61696e20 436f6e74 726f6c20 56616c69 64617465 &#xA;    64312030 1e060355 04031317 6d61696c 2e6e6173 6876696c 6c656361 7265732e &#xA;    6f726730 82012230 0d06092a 864886f7 0d010101 05000382 010f0030 82010a02 &#xA;    82010100 c89353e0 a6e285f2 ae21dbe6 e038bfbd 0a2e6e05 1e157419 b995b5e4 &#xA;    c3c77496 dda2adfe c15c507b 5b11a7bd e20a215b bd7f6d42 f7e6b436 88d82cd6 &#xA;    2a0e0185 06569d86 7456d15b 0b6bec6d 71cd58bb 227a5aa4 7bf7ce0e 6e9fc90e &#xA;    c04f183c a910b2ba 26be014d 141ea9cd 9ff05b70 86079b62 5bfc2790 24522e35 &#xA;    c3196ba8 86029121 fbba5312 685d4d4d e97f7201 6e7e989d 961bc60c 6a5ac576 &#xA;    186af6ad 2fc7ba6a 431620e0 9ca33681 c9f5bd2f 03659421 bb79d546 7cd805dc &#xA;    d062f1c1 694ceba4 b725c631 69a1cab9 3f524b8d 8014503b de8b7c20 fdbc08b1 &#xA;    f60fca3b 647054b5 504df86b f9627784 5c847858 b6c18502 04c099ed 9879ca16 &#xA;    50d0a41f 02030100 01a38202 30308202 2c300c06 03551d13 0101ff04 02300030 &#xA;    1d060355 1d250416 30140608 2b060105 05070301 06082b06 01050507 0302300e &#xA;    0603551d 0f0101ff 04040302 05a03036 0603551d 1f042f30 2d302ba0 29a02786 &#xA;    25687474 703a2f2f 63726c2e 676f6461 6464792e 636f6d2f 67646967 3273312d &#xA;    36362e63 726c3053 0603551d 20044c30 4a304806 0b608648 0186fd6d 01071701 &#xA;    30393037 06082b06 01050507 0201162b 68747470 3a2f2f63 65727469 66696361 &#xA;    7465732e 676f6461 6464792e 636f6d2f 7265706f 7369746f 72792f30 7606082b &#xA;    06010505 07010104 6a306830 2406082b 06010505 07300186 18687474 703a2f2f &#xA;    6f637370 2e676f64 61646479 2e636f6d 2f304006 082b0601 05050730 02863468 &#xA;    7474703a 2f2f6365 72746966 69636174 65732e67 6f646164 64792e63 6f6d2f72 &#xA;    65706f73 69746f72 792f6764 6967322e 63727430 1f060355 1d230418 30168014 &#xA;    40c2bd27 8ecc3483 30a233d7 fb6cb3f0 b42c80ce 3081a706 03551d11 04819f30 &#xA;    819c8217 6d61696c 2e6e6173 6876696c 6c656361 7265732e 6f726782 1b777777 &#xA;    2e6d6169 6c2e6e61 73687669 6c6c6563 61726573 2e6f7267 821f6175 746f6469 &#xA;  quit&#xA;crypto ikev1 enable Outside&#xA;crypto ikev1 enable Inside&#xA;crypto ikev1 policy 10&#xA; authentication crack&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 20&#xA; authentication rsa-sig&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 30&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 40&#xA; authentication crack&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 50&#xA; authentication rsa-sig&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 60&#xA; authentication pre-share&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 70&#xA; authentication crack&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 80&#xA; authentication rsa-sig&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 90&#xA; authentication pre-share&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 100&#xA; authentication crack&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 110&#xA; authentication rsa-sig&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 120&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 130&#xA; authentication crack&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 140&#xA; authentication rsa-sig&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 150&#xA; authentication pre-share&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;no ssh stricthostkeycheck&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;dhcpd address 192.168.1.2-192.168.1.254 management&#xA;!&#xA;dhcprelay server 192.168.0.144 Inside&#xA;dhcprelay enable Outside&#xA;dhcprelay timeout 60&#xA;threat-detection basic-threat&#xA;threat-detection statistics&#xA;threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA; class class-default&#xA;  user-statistics accounting&#xA;!&#xA;service-policy global_policy global&#xA;smtp-server 192.168.0.16&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;hpm topN enable&#xA;Cryptochecksum:242a0ffb5b165b6ba5b3e0a5ae2e7d1e&#xA;: end&#xA;asdm image disk0:/asdm-741.bin&#xA;asdm history enable&#xA;&#xA; - &#xA;&#xA;List item&#xA;---------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15419" LastEditorUserId="509" LastEditDate="2015-05-14T21:08:49.687" LastActivityDate="2017-09-25T04:31:04.133" Title="Cisco ASA 5512-x, problem with incoming traffic to Exchange server and access to https:/xxx.xxx/owa" Tags="|cisco-asa|firewall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18490" PostTypeId="2" ParentId="18487" CreationDate="2015-05-14T15:35:07.357" Score="0" Body="&lt;p&gt;Cisco IOS &lt;a href=&quot;http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-embedded-event-manager-eem/index.html&quot; rel=&quot;nofollow&quot;&gt;Embedded Event Manager (EEM)&lt;/a&gt; might be of help to you.  Seems like a traffic policer, for example, could detect the burst event you describe and the EEM could then email you?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-06-14T18:52:46.697" LastActivityDate="2015-06-14T18:52:46.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18492" PostTypeId="2" ParentId="18440" CreationDate="2015-05-14T16:04:11.740" Score="0" Body="&lt;p&gt;I assume you mean the SG500X-48P based on your diagram having 10GB between the switches. The SG500X has enough ports to accomplish your desired topology, and you can use standard SFP ports to suport your fiber connections between floors. Lesser 500 models do not have enough SFP ports to support stacking and fiber interconnections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out the &lt;a href=&quot;https://supportforums.cisco.com/sites/default/files/legacy/2/5/0/139052-500_Series_Admin_Guide.pdf&quot; rel=&quot;nofollow&quot;&gt;500 Series Admin Guide&lt;/a&gt; for more information on the ports or stacking topologies.&lt;/p&gt;&#xA;" OwnerUserId="1613" LastActivityDate="2015-05-14T16:04:11.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18493" PostTypeId="1" AcceptedAnswerId="18525" CreationDate="2015-05-14T16:55:39.040" Score="2" ViewCount="170" Body="&lt;p&gt;I have two networks. 10.22.227.X the 227 network has the internet connection on it, I also have 10.22.226.X Network as of right now this network has no internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the relevant configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;interface FastEthernet0/0&#xA;ip address 10.22.227.1 255.255.255.0&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA;ip address 10.22.226.1 255.255.255.0&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface Vlan1&#xA;no ip address&#xA;shutdown&#xA;!&#xA;ip classless&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As of right now i can not communicate between the two networks. What i mean by this is... I can not access files off my computer on the 227 net work from the 226 network and visa-versa. I am using Cisco packet tracer (that's where i got my configuration file from above.) and the network work great! But when i copy it to my router it doesn't work!!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help my out! I have been trying for weeks to make this work.&lt;/p&gt;&#xA;" OwnerUserId="14856" LastEditorUserId="775" LastEditDate="2015-06-20T16:56:18.627" LastActivityDate="2015-06-20T16:56:18.627" Title="Cisco Networking Router Configuration Help" Tags="|cisco|routing|switch|router|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="18494" PostTypeId="1" AcceptedAnswerId="18495" CreationDate="2015-05-14T21:07:24.033" Score="2" ViewCount="1716" Body="&lt;p&gt;Error Secure VPN Connection terminated locally by the Client. Reason 412: The remote peer is no longer responding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i get this error while attempting connection to cisco vpn client program.&lt;/p&gt;&#xA;" OwnerUserId="15423" LastEditorUserId="775" LastEditDate="2015-06-20T16:55:57.047" LastActivityDate="2015-06-20T16:55:57.047" Title="Error Secure VPN Connection terminated locally by the Client. Error 412" Tags="|cisco|vpn|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18495" PostTypeId="2" ParentId="18494" CreationDate="2015-05-14T21:38:38.123" Score="1" Body="&lt;p&gt;Wrong password.  Also you can try tweaking the connection settings (port number, etc.).  Otherwise, contact your network administrator.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-14T21:38:38.123" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18496" PostTypeId="2" ParentId="18489" CreationDate="2015-05-14T21:46:11.827" Score="1" Body="&lt;pre&gt;&lt;code&gt;no http server enable&#xA;http server enable 8181&#xA;access-list outside_access_in extended permit tcp any interface outside eq https&#xA;static (inside,outside) tcp interface https 192.168.69.26 https netmask 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="8499" LastEditDate="2016-04-02T19:22:25.003" LastActivityDate="2016-04-02T19:22:25.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18497" PostTypeId="2" ParentId="18489" CreationDate="2015-05-14T21:56:38.563" Score="2" Body="&lt;p&gt;This NAT statement looks good:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network Exchange-Int&#xA;nat (Inside,Outside) static interface service tcp https https &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This ACL allowing access to the exchange server from outside interface looks attractive. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_access_in extended permit tcp any object Exchange-Int eq https &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it doesn't seem to applied to the outside interface.&#xA;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-group outside_access_in in interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looks like you have enabled the http server which listens on port 443 on the ASA interfaces. This allows access via the ASDM.  You're also using the outside interface to NAT for port 443 with your Exchange server.  You may want to change the port on the the http server listens to. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;http server enable 4443   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should free up the port and not a cause a port conflict.&lt;/p&gt;&#xA;" OwnerUserId="2231" LastActivityDate="2015-05-14T21:56:38.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18499" PostTypeId="1" AcceptedAnswerId="18508" CreationDate="2015-05-15T04:00:32.930" Score="3" ViewCount="320" Body="&lt;p&gt;I am having trouble on how should I identify which port will be blocked and which will be the designated, since both BID and Cost are the same for the ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for first port, the output of  &lt;code&gt;show spanning-tree&lt;/code&gt; is,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Spanning tree enabled protocol rstp&#xA;Root ID Priority 24984&#xA;Address 00D0.58AC.C607&#xA;Cost 9&#xA;Port 28(Port-channel 2)&#xA;Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec&#xA;&#xA;Bridge ID Priority 33176 (priority 32768 sys-id-ext 408)&#xA;Address 0001.43C6.4D81  &#xA;Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec&#xA;Aging Time 20&#xA;&#xA;Interface Role Sts Cost Prio.Nbr Type&#xA;--------- ---- --- ---- -------- ----&#xA;Fa0/1     Desg FWD  19  128.1    P2p&#xA;Po1       Desg FWD  9   128.27   Shr&#xA;Po2       Root FWD  9   128.28   Shr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and on the second, the output is,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Spanning tree enabled protocol rstp&#xA;Root ID Priority 24984&#xA;Address 00D0.58AC.C607&#xA;Cost 9&#xA;Port 28(Port-channel 2)&#xA;Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec&#xA;&#xA;Bridge ID Priority 33176 (priority 32768 sys-id-ext 408)&#xA;Address 0002.16C9.4B1D &#xA;Hello Time 2 sec Max Age 20 sec Forward Delay 15 sec&#xA;Aging Time 20&#xA;&#xA;Interface Role Sts Cost Prio.Nbr Type&#xA;--------- ---- --- ---- -------- ----&#xA;Fa0/1     Desg FWD  19  128.1    P2p&#xA;Po1       Altn BLK  9   128.27   Shr&#xA;Po2       Root FWD  9   128.28   Shr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The cost in both the cases is &lt;code&gt;9&lt;/code&gt;&#xA;and the &lt;code&gt;BID&lt;/code&gt; of the ports are &lt;code&gt;33176&lt;/code&gt; because both are using same VLAN numbers,&#xA;but how come the first one is assigned as &lt;code&gt;designated&lt;/code&gt; and the other is &lt;code&gt;blocked&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I understand is that it depends on the lower MAC address but how come &lt;code&gt;show spanning-tree&lt;/code&gt; commands show two address in both ports i.e &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address 00D0.58AC.C607  (same in both ports),&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the other one which is different on both ports,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port1,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bridge ID Priority 33176 (priority 32768 sys-id-ext 408)&#xA;Address 0001.43C6.4D81  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Port2,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bridge ID Priority 33176 (priority 32768 sys-id-ext 408)&#xA;Address 0002.16C9.4B1D &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can someone please explain why there are two different addresses for each port and spanning tree is really calculating the designated port using the address if cost and BID are the same ?&lt;/p&gt;&#xA;" OwnerUserId="14885" LastEditorUserId="619" LastEditDate="2015-05-15T06:03:28.703" LastActivityDate="2015-05-15T11:02:41.793" Title="Identifying Designated port in STP when Cost and BID are the same?" Tags="|spanning-tree|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18501" PostTypeId="1" CreationDate="2015-05-15T07:58:19.073" Score="1" ViewCount="58" Body="&lt;p&gt;If I execute the &lt;code&gt;snmpwalk -v 2c -On -c public IOS-XR-router .1.3.6.1.4.1.9.9.166.1.17.1.1.9&lt;/code&gt; command I receive the list of &lt;code&gt;cbQosPoliceExceededPkt&lt;/code&gt;(32 bits count of packets treated as non-conforming by the policing feature) objects for all the interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ snmpwalk -v 2c -On -c public IOS-XR-router .1.3.6.1.4.1.9.9.166.1.17.1.1.9        &#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.33939721.372808280 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.102008393.975936877 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.202106522.1856909852 = Counter32: 5003&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.240900878.497875428 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.260148678.721345944 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.482088944.1031735842 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.683352142.2105749243 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.710279877.1618983151 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.720156245.1259602979 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.722287380.1469694376 = Counter32: 3613&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.808980780.1628785777 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.969060048.1892486036 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.1256901827.699601203 = Counter32: 50868&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.1265105847.595091350 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.1369606127.7660493 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.1391464972.909798245 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.1408499934.2009269877 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.1754292523.1069220732 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.1835241439.1897653915 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.1846028775.1163943827 = Counter32: 26472&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.2030356433.1030288340 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.2038932423.882247250 = Counter32: 0&#xA;.1.3.6.1.4.1.9.9.166.1.17.1.1.9.2041219745.566624230 = Counter32: 0&#xA;$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I map integers(for example &lt;code&gt;33939721.372808280&lt;/code&gt; or &lt;code&gt;102008393.975936877&lt;/code&gt;) to interfaces or &lt;code&gt;ifIndex&lt;/code&gt;? For example &lt;code&gt;ifIndex&lt;/code&gt; of interface which dropped 26472 packets is &lt;code&gt;508&lt;/code&gt;, but I can not see a correlation between &lt;code&gt;1846028775.1163943827&lt;/code&gt; and &lt;code&gt;508&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-05-15T08:50:31.060" Title="map integers after SNMP &quot;cbQosPoliceExceededPkt&quot; object to interface" Tags="|snmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18502" PostTypeId="2" ParentId="18501" CreationDate="2015-05-15T08:50:31.060" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;This table contains statistical information only, no configuration information associated with it. Therefore, it is indexed by the instance specific IDs,  such as &lt;strong&gt;cbQosPolicyIndex&lt;/strong&gt; and &lt;strong&gt;cbQosObjectsIndex&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;cbQosServicePolicyTable&lt;/code&gt; is indexed by &lt;code&gt;cbQosPolicyIndex&lt;/code&gt; (i.e. the &quot;meaningless&quot; numbers you quoted) &lt;code&gt;CbQosServicePolicyEntry&lt;/code&gt; contains &lt;code&gt;cbQosIfIndex&lt;/code&gt; which is the ifIndex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may need to look through &lt;code&gt;ciscoCBQosMIB&lt;/code&gt; to find the full picture. Honestly, it'd be faster and make more sense to telnet in and run CLI commands to get data. :-)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-15T08:50:31.060" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18504" PostTypeId="1" CreationDate="2015-05-15T09:53:14.340" Score="4" ViewCount="3524" Body="&lt;p&gt;I have three switches connected to each other with two links (one of them is a redundant link using STP), but I have configured EtherChannel so that both the links work together as a bundle,&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ilPzP.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;What i know about EtherChannel is, if we bundle two 100Mbps links together, the speed of the bundle will be 200MBps, but the initial status of both the links must be the same.&lt;/p&gt;&#xA;&lt;p&gt;Now, Before configuring EtherChannel, the speed of each single Fast Ethernet link was 100Mbps and all links were in full-duplex mode,&lt;/p&gt;&#xA;&lt;p&gt;but after I configured the links to work as a bundle, the mode of each port-channel interface is changed to half-duplex and the speed is changed to &lt;code&gt;300mbps&lt;/code&gt; instead of &lt;code&gt;200Mbps&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;As you can see in the following output,&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;show interfaces port-channel 1&#xA;Port-channel 1 is up, line protocol is up (connected)&#xA;  Hardware is EtherChannel, address is 0030.f22d.b05d (bia 0030.f22d.b05d)&#xA;  Description: Trunking with SW_Access1&#xA;  MTU 1500 bytes, BW 300000 Kbit, DLY 1000 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Half-duplex, 300Mb/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;before configuring the etherchannel, the speed and duplex mode of individual links were 100Mbps, and full-duplex respectively.&lt;/p&gt;&#xA;&lt;p&gt;Why the mode is changed to half-duplex from full-duplex after configuring EtherChannel ? and how come the speed is 3 times of 100Mbps instead of 2 ?&lt;/p&gt;&#xA;" OwnerUserId="14885" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-10-19T19:39:09.717" Title="Ethernet Channel bundling changes Full-duplex links to Half-duplex" Tags="|etherchannel|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18505" PostTypeId="1" CreationDate="2015-05-15T09:59:20.690" Score="1" ViewCount="2858" Body="&lt;p&gt;Is there any command to send 20 packets per second. I have one switch and two hosts. M looking to send 20 packets within seconds, for stats of Latency. I am using packet tracer 6.2.  I want to ping 192.168.1.30 to 192.168.1.40 ,and there is switch between them.&lt;/p&gt;&#xA;" OwnerUserId="15434" LastEditorUserId="3191" LastEditDate="2015-06-14T18:39:17.110" LastActivityDate="2015-06-18T07:52:07.757" Title="How to send 20 packets using ping or any other command in Packet tracer?" Tags="|ping|packet-tracer|" AnswerCount="1" CommentCount="1" ClosedDate="2015-06-16T09:57:26.037" ContentLicense="CC BY-SA 3.0" />
  <row Id="18506" PostTypeId="2" ParentId="18505" CreationDate="2015-05-15T10:02:35.343" Score="0" Body="&lt;p&gt;Assuming you are using GNU/Linux to send the ping:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping -i 0.05 &amp;lt;target ip&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5926" LastActivityDate="2015-05-15T10:02:35.343" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18508" PostTypeId="2" ParentId="18499" CreationDate="2015-05-15T11:02:41.793" Score="4" Body="&lt;p&gt;As Ricky says, the first address is the root ID:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Root ID Priority 24984 &#xA;Address 00D0.58AC.C607&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the second the local bridge ID:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bridge ID Priority 33176 (priority 32768 sys-id-ext 408)&#xA;Address 0001.43C6.4D81&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bridge ID Priority 33176 (priority 32768 sys-id-ext 408)&#xA;Address 0002.16C9.4B1D&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The full bridge ID is formed of the Priority and the MAC Address, so it's 33176.0001.43C6.4D81 or 33176.0002.16C9.4B1D (with apologies for mixing radices). So, there should never be a tie with different bridges.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2015-05-15T11:02:41.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18509" PostTypeId="1" AcceptedAnswerId="18514" CreationDate="2015-05-15T12:08:59.203" Score="0" ViewCount="3087" Body="&lt;p&gt;I would like to know which could be a more reliable topology for both as well as the cost of implementing it or an estimated if possible.&lt;/p&gt;&#xA;" OwnerUserId="15423" LastEditorUserId="775" LastEditDate="2015-06-20T16:55:05.287" LastActivityDate="2015-06-20T16:55:05.287" Title="Best network topology for a large business and a small one" Tags="|design|" AnswerCount="1" CommentCount="1" ClosedDate="2015-05-15T19:59:52.440" ContentLicense="CC BY-SA 3.0" />
  <row Id="18510" PostTypeId="1" AcceptedAnswerId="18516" CreationDate="2015-05-15T12:43:37.703" Score="3" ViewCount="2828" Body="&lt;p&gt;In 5-layer model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why we need additional transport layer? I read these two points&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Users who interact with software have no control over the sub-net;&#xA;  Transport Service can provide a more reliable service than any the&#xA;  underlying Network Service might, because IP is not reliable protocol.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now my doubt is why can't we directly interact with the IP layer from application layer.If we interact what would be the problem that we face?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why can't we implement process-process communications &amp;amp; reliability everything in application layer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the high level languages doesn't support to implement protocols?&lt;/p&gt;&#xA;" OwnerUserId="6195" LastEditorUserId="8499" LastEditDate="2018-10-26T19:11:35.787" LastActivityDate="2018-10-26T19:11:35.787" Title="What is the need for transport Layer?" Tags="|tcp|protocol-theory|osi|layer4|transport-protocol|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18511" PostTypeId="1" AcceptedAnswerId="18513" CreationDate="2015-05-11T23:33:47.330" Score="9" ViewCount="196" Body="&lt;p&gt;To multiplex upstream and downstream traffic typically frequency multiplexing or time multiplexing is used. E.g. an ADSL connection may use FDM and use 25kHz to 138kHz for upstream and 138kHz to 1104kHz for downstream connections. In this case the downstream has a substantially larger band of frequencies available and can thus reach larger transmission speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However while most users use downstream more than upstream most of the time it is not like that all the time. E.g. online backup services need upstream most of the time. In that case it would be desirable that the frequency division is realigned to put an emphasis on upstream traffic. Not only is such a dynamic allocation of frequencies not possible with ADSL (or I have not found anyone offering that) but I cannot even call my ISP and tell them that I seldomly need downstream anyway and I would like to have a lot of upstream and I am very willing to sacrifice downstream for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For LTE I could not figure out how the duplexing is actually performed but the specification allows for larger download rates (300 Mbit/s) than upload rates (75 Mbit/s) rather than a combined connection speed which can be divided as needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does this happen? Is this for marketing business reasons or are there actually physical problem with dynamic allocation? In the later case: What are those reasons?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;(I think server fault is the best place to ask because it is about networks but it the answer to my question has to do with physics or signal processing it may also be better on one of those sites. I am happy to migrate the question if in which direction I need to look for the answer)&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="10631" OwnerDisplayName="yankee" LastActivityDate="2015-05-19T12:51:42.087" Title="Why many of our WANs use fixed bandwith division between up- and downstream?" Tags="|adsl|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18512" PostTypeId="2" ParentId="18511" CreationDate="2015-05-15T12:15:56.230" Score="0" Body="&lt;p&gt;I'm no expert here, but I would assert that this is primarily because of business reasons. A DSL is basically symmetric in that you have a wire and two boxes on both ends of the connection that share the same medium. (Unlike, for example in case of WiFi, or WiMAX, etc.). Having said that the difference in price and hence quality of the equipment on both sides may be a factor here.&#xA;(Sorry if I did not clarify this better, but I seem to be the only one with at least a vague answer so I decided to post an answer. Also, my 15-year-old experience with telcos would suggest that this is a human factor, as they tend to avoid per-user solutions, and concentrate on mass markets).&lt;/p&gt;&#xA;" OwnerUserId="15440" OwnerDisplayName="Konrad Gajewski" LastActivityDate="2015-05-15T12:15:56.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18513" PostTypeId="2" ParentId="18511" CreationDate="2015-05-15T13:38:26.823" Score="3" Body="&lt;p&gt;One reason is that &lt;a href=&quot;http://www.google.com/patents/US6175550&quot; rel=&quot;nofollow&quot;&gt;although it is possible to do dynamic frequency allocation&lt;/a&gt;, it is more resource intensive, and as a result more costly because it has to be negotiated on both sides, which leads to a higher cost for the ISP and as a result, the end user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, In order to multiplex traffic both sides have to agree on a frequency band &lt;em&gt;before&lt;/em&gt; the data is transmitted, like any bidirectional protocol. The processors will have to translate that into new transfer functions and adjust the filters accordingly. This can be verified by the fact that ISPs typically have to &quot;reboot&quot; your modem after a package upgrade. The type of dynamic FDM you're referring to would likely require more hardware than just negotiating frequencies on rare occasion, like what is currently done. Since this would likely drive up modem costs, and since the average residential consumer is only interested in &lt;em&gt;consuming&lt;/em&gt; (&lt;em&gt;downloading&lt;/em&gt;) the internet, I have to guess that it benefits the business more to standardize the bandwidth in &lt;em&gt;blocks&lt;/em&gt; (10 down/2up, 20 down/4 up, etc.) than to offer dynamic allocation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, TDM is better suited for what you are attempting to do. I read it stated that &lt;a href=&quot;http://www.differencebetween.net/technology/difference-between-fdm-and-tdm/&quot; rel=&quot;nofollow&quot;&gt;&quot;TDM signals use all of the bandwidth some of the time, FDM signals use some of the bandwidth all of the time.&quot;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not just theory, ISPs such as &lt;a href=&quot;http://www.merit.edu/meritformichigan/faq/&quot; rel=&quot;nofollow&quot;&gt;Merit&lt;/a&gt; give you the amount of bandwidth you pay for, and you can use it however you want. I don't know the specifics but that sounds like a practical use of TDM vs. FDM.&lt;/p&gt;&#xA;" OwnerUserId="283" LastEditorUserId="283" LastEditDate="2015-05-18T15:05:35.407" LastActivityDate="2015-05-18T15:05:35.407" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18514" PostTypeId="2" ParentId="18509" CreationDate="2015-05-15T15:02:49.030" Score="0" Body="&lt;p&gt;Networks are typically segregated between access and core/distribution devices.  Access switches that operate together as a single logical switch are dual homed (2 uplinks or more) to the core/distribution pair of networking devices, which themselves operate as a single logical device.  This design allows for no interruption of network service in case of a single uplink or single switch outage, with the exception of the devices plugged in to an access switch that might fail.  Servers are typically dual homed to a pair of access switches themselves as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the best design no matter the size.  Basically you want everything redundant - redundant networking devices, redundant uplinks between networking devices, and even redundant applications/servers.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-15T15:02:49.030" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18515" PostTypeId="1" AcceptedAnswerId="18518" CreationDate="2015-05-15T16:13:23.620" Score="-1" ViewCount="1312" Body="&lt;p&gt;I am looking for information on what each part of a remote log(syslog) entry is from a Dell PowerConnect or Dell N series switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following log entry of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;190&amp;gt; May 15 11:06:19 10.10.9.1-1 CLI_WEB[89546900]: cmd_logger_api.c(260) 8930 %% [WEB:admin:10.11.11.127] User has succesfully logged in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I see it goes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;PRI&lt;/li&gt;&#xA;&lt;li&gt;Month&lt;/li&gt;&#xA;&lt;li&gt;Day&lt;/li&gt;&#xA;&lt;li&gt;Time&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;(Outgoing host IP or lowest IP on switch) ?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Component&lt;/li&gt;&#xA;&lt;li&gt;PID&lt;/li&gt;&#xA;&lt;li&gt;Executable&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;(Unknown number after executable) ?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;(Unknown number) ?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Message&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Anyone be able to shed a little better light on this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a few more entries from some other switches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;190&amp;gt; May 15 11:36:12 10.11.9.1-1 UNITMGR[842641108]: unitmgr.c(6794) 7803 %% Copy of running configuration to backup unit complete&#xA;&amp;lt;190&amp;gt; May 15 11:43:34 10.10.9.1-1 CLI_WEB[89546900]: cmd_logger_api.c(260) 8937 %% [WEB:admin:10.10.10.12] Disconnected due to Idle Timeout&#xA;&amp;lt;189&amp;gt; MAY 15 08:08:49 10.10.50.30-1 TRAPMGR[152633056]: traputil.c(611) 8151 %% 1/0/42 is transitioned from the Learning state to the Forwarding state in instance 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3449" LastActivityDate="2015-05-15T17:59:41.157" Title="Dell switch Remote Log output structure" Tags="|switch|syslog|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18516" PostTypeId="2" ParentId="18510" CreationDate="2015-05-15T16:17:54.393" Score="6" Body="&lt;p&gt;Of course you can directly interact with the IP layer.&#xA;The question is not about &quot;why you can't&quot;, but about &quot;why you wouldn't want/need to&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you mention higher level languages, the reason why they exist is the same as the reason the transport layer exists. A higher level language makes things easier by providing abstraction. You can code your application in an assembly language, but you will be spending a lot of effort on problems that have been hidden by higher level languages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most applications will benefit from a network which provides features like process identification, reliable communication, in order delivery or flow control. So it makes sense implementing these features once in a standardized protocol, instead of having to include custom solutions in every application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are situations in which designing your own solution can be beneficial or even necessary, but in most cases using TCP or UDP will just work and save you a lot of hassle. Doing it yourself can also be very educational and make you appreciate the work that has been done by others. &lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2016-12-19T00:13:00.390" LastActivityDate="2016-12-19T00:13:00.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18518" PostTypeId="2" ParentId="18515" CreationDate="2015-05-15T17:59:41.157" Score="4" Body="&lt;p&gt;Found the manual that shows the format. The format is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PRI Timestamp HostIP Address StackID Component Name Thread ID File name line number sequence number message&lt;/p&gt;&#xA;" OwnerUserId="3449" LastActivityDate="2015-05-15T17:59:41.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18520" PostTypeId="1" CreationDate="2015-05-15T22:01:02.833" Score="0" ViewCount="95" Body="&lt;p&gt;I'm a volunteer working with a hospital in an underdeveloped area in west Africa. The hospital has access to slow (2G) cell phone service. Recently we were able to provide the hospital with slow internet access so they can access  email and text chat using this device called a globesurfer and a directional antenna: &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B00266Z9F2&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/Option-GlobeSurfer-III-HSPA-Router/dp/B00266Z9F2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a simplified network layout&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Local hospital LAN &amp;lt;-&gt; Globesurfer &amp;lt;-&gt; Cell Phone Network&#xA;        192.168.x.x            10.x.x.x      &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the Globesurfer has been assigned a private network ip address in the 10.x.x.x range by the cell phone network, we cannot connect to servers on the hospital LAN via the internet. Keep in mind that the infrastructure and technical support is hard to come by in this area, so we have to work with what's available. There is some talk that they will upgrade to 3G some time in the near future. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any device that we could put on the hospital network that could initiate a connection to another device on a network with a public/routeable IP address here in the US to establish a VPN from the US end to the hospital campus network? In other words the session would originate from the hospital network and would be kept open from that end. We could then connect to the device on the US end to get into the hospital network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not a network guy, so I hope the question is clear. We don't have a much of a budget so we need a solution that is economical. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="15447" LastActivityDate="2015-05-16T02:45:13.413" Title="How do we access servers located at remote west Africa hospital that uses a cell phone network and private ip addresses?" Tags="|routing|vpn|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18521" PostTypeId="2" ParentId="18504" CreationDate="2015-05-15T22:36:48.327" Score="1" Body="&lt;p&gt;&lt;code&gt;interface po1&lt;/code&gt; defines the link(s) to be &lt;code&gt;half-duplex&lt;/code&gt;. (&lt;em&gt;show run int po1&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's 300Mbps because you have &lt;em&gt;three links&lt;/em&gt; assigned (and active) in the channel-group. (&lt;em&gt;show etherchannel 1 port-channel&lt;/em&gt;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-15T22:36:48.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18522" PostTypeId="2" ParentId="18520" CreationDate="2015-05-16T02:45:13.413" Score="3" Body="&lt;p&gt;Indeed, a hospital originated VPN would be the only way to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What device and where it connects would be &quot;too broad&quot; for NE, but many routers (even &quot;home&quot; hardware) support IPSec -- from what I can tell, the GlobeSurfer does as well. In general, when network management is outsourced, the VPN would naturally terminate with the company doing that management.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-16T02:45:13.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18525" PostTypeId="2" ParentId="18493" CreationDate="2015-05-16T12:32:00.307" Score="2" Body="&lt;p&gt;As @jordanhead points out, the default gateway on your PCs on the 226 network is incorrect.  The gateway address should be the address of the router interface - 10.22.226.1  in your case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The gateway address is where the PC should forward packets if they are not destined for the local network.  So if a PC on the 226 network wants to send traffic to the Internet, for example, it must first forward the traffic to 10.22.226.1 so that the router can forward it to your provider (or wherever else it has to go).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that is only half your problem.  Assuming this is a continuation of your &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17876/cisco-1841-router-killing-network&quot;&gt;earlier questions&lt;/a&gt;, the 226 network will not be able to reach the Internet until you configure your Internet router with a static route for 10.22.226.0/24 pointing to 10.22.227.1.  This tells the Internet router and all PCs on the 227 network that to reach the 226 network, the packet has to be sent to 10.22.227.1 - i.e. the router interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can't add a route to the Internet router, then you can't do what you're trying to do.  Maybe a different approach to the problem is called for.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-05-16T23:31:30.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18526" PostTypeId="1" AcceptedAnswerId="18544" CreationDate="2015-05-16T14:30:08.933" Score="4" ViewCount="4671" Body="&lt;p&gt;I have a small company and we just started out. Given our size, we really can't get a dedicated network guy for now. Recently, we moved to a lease line of our own for reliability. This is the information I was provided with (the addresses mentioned here are just examples, obviously):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP Address WAN: 35.34.33.70&#xA;SUBNET MASK   : 255.255.255.252&#xA;GATEWAY       : 35.34.33.69&#xA;&#xA;LAN POOL IP   : 35.34.33.88/ 29&#xA;START IP      : 35.34.33.90&#xA;END IP        : 35.34.33.94&#xA;BROADCAST IP  : 35.34.33.95&#xA;SUBNET MASK : 255.255.255.248&#xA;GATEWAY :106.51.238.89&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I setup my router, to basically have a NAT, which assigns all devices that connect to the router to get a &lt;code&gt;192.168.1.X&lt;/code&gt; IP address. The router's IP is set to the &lt;code&gt;IP Address WAN&lt;/code&gt; given above and the gateway/subnet mask that was provided for the WAN. Everything is fine, and all devices have internet connectivity and local networking is working just fine. This is how my setup looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-------------+     +--------+     +---------+&#xA;| Set-top box | --- | Router | --- | Devices |&#xA;+-------------+     +--------+     +---------+&#xA;                        |          +---------+&#xA;                        +--------- | Devices |&#xA;                                   +---------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;set-top box&lt;/code&gt; has only 1 ethernet cable. I have a couple of questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are the 'LAN pool ips' publically accessible (it looks to me that they are).&lt;/li&gt;&#xA;&lt;li&gt;Can I give one of the devices connected to my router one of these public ips? One of the device uses &lt;code&gt;192.168.1.187&lt;/code&gt; and we use it from external networks by setting up port-forwarding on the router.&lt;/li&gt;&#xA;&lt;li&gt;What is the exact distinction between the &lt;code&gt;LAN POOL&lt;/code&gt; and the &lt;code&gt;WAN&lt;/code&gt;. I am not sure I entirely understand this distinction. The last part of the IP in WAN is '70', in gateway is '69', and in the pool, the IPs are from 90-94 with 95 as broadcast. The remaining part is exactly the same for all the IP addresses. What is the significance of this?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Sorry about the long post, and thank you for helping me out!&lt;/p&gt;&#xA;" OwnerUserId="8599" LastEditorUserId="775" LastEditDate="2015-06-20T16:54:37.733" LastActivityDate="2016-03-26T01:33:50.933" Title="Using a public IP for select hosts in a LAN" Tags="|subnet|ip|lan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18527" PostTypeId="1" CreationDate="2015-05-16T15:54:31.197" Score="2" ViewCount="1208" Body="&lt;p&gt;I have a 1500' fiber run to make for data 10/100. The interface on each end is multi-mode, but the cable I have is single mode. Can this be done? I'm new to fiber so be gentle with me. &lt;/p&gt;&#xA;" OwnerUserId="15454" LastEditorUserId="8499" LastEditDate="2016-04-05T13:52:27.970" LastActivityDate="2016-04-05T13:52:27.970" Title="Single-mode cable to multi-mode interface" Tags="|fiber|layer1|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18528" PostTypeId="2" ParentId="13293" CreationDate="2015-05-16T18:40:51.403" Score="2" Body="&lt;p&gt;Have you tried Mikrotik's graphing? (&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Tools/Graphing&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Manual:Tools/Graphing&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need more detailed information i suggest you to use &quot;traffic flow&quot;&#xA;(&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Manual:IP/Traffic_Flow&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.it.paessler.com/prtg&quot; rel=&quot;nofollow&quot; title=&quot;PRTG&quot;&gt;PRTG&lt;/a&gt; or &lt;a href=&quot;http://www.cacti.net/&quot; rel=&quot;nofollow&quot; title=&quot;Cacti&quot;&gt;Cacti&lt;/a&gt; are great products but IMHO are an overkill in your scenario&lt;/p&gt;&#xA;" OwnerUserId="219" LastActivityDate="2015-05-16T18:40:51.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18529" PostTypeId="2" ParentId="10872" CreationDate="2015-05-16T18:43:47.813" Score="1" Body="&lt;p&gt;You can use &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Webfig&quot; rel=&quot;nofollow&quot; title=&quot;Webfig&quot;&gt;Webfig&lt;/a&gt; to create an interface for a certain user where he can  only access certain areas of the router management (tools in your scenario).&lt;/p&gt;&#xA;" OwnerUserId="219" LastActivityDate="2015-05-16T18:43:47.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18530" PostTypeId="1" AcceptedAnswerId="18531" CreationDate="2015-05-16T20:39:40.607" Score="0" ViewCount="2069" Body="&lt;p&gt;I have a home network with a managed switch. For better security, I'd like to put the DSL modem/gateway my ISP gave me on a separate VLAN, then do NAT for my local network on another machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the DSL modem, I think this just means I'll put it on one VLAN (this should mean I can put it in routing mode where it exposes my public IP). For other machines, I put them on another (or can I just leave them on the default VLAN?). For the NAT machine, things are a little more complicated. Do I configure the switch to have that port on both VLANs, then set up subinterfaces in the OS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main goal is that all machines other than the NAT box shouldn't be aware they're even on a VLAN, and plugging in a device to a switch port other than the NAT box's or the modem's should be like plugging into a normal home network.&lt;/p&gt;&#xA;" OwnerUserId="15456" LastActivityDate="2015-05-16T21:16:45.427" Title="VLAN setup for DSL modem and NAT box" Tags="|vlan|" AnswerCount="1" CommentCount="3" ClosedDate="2015-05-18T23:04:00.453" ContentLicense="CC BY-SA 3.0" />
  <row Id="18531" PostTypeId="2" ParentId="18530" CreationDate="2015-05-16T21:16:45.427" Score="3" Body="&lt;p&gt;Without knowing the details of which switch you're using, the general approach to solve this would be to stick your DSL modem on a port in access mode (untagged/tagging removed packets from a single VLAN only) with a VLAN membership say of 1000, while all your internal machines would have a different VLAN membership (say 1001). Your NAT box would then connect into your switch in trunk mode, with membership in both VLANs. You could opt to make one VLAN the default untagged one, or neither - your choice (if your switch permits this). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within the OS of your NAT box, setup for routing between the VLAN interfaces. For Linux, assuming that you're using tagged VLANs as described above for the trunk port which is on eth0, you will have to perform NAT on the eth0.1001/eth0.1000 interfaces. If you choose to make, say VLAN 1001, the default untagged VLAN for that trunk port, then you will need to NAT eth0/eth0.1000.&lt;/p&gt;&#xA;" OwnerUserId="15347" LastActivityDate="2015-05-16T21:16:45.427" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18532" PostTypeId="1" AcceptedAnswerId="18547" CreationDate="2015-05-16T22:04:10.350" Score="1" ViewCount="3439" Body="&lt;p&gt;I am new here and hope I can get some help! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently I have been learning the Physical Layer PHY specifications of IEEE.802.11 i.e the WLAN standards. A tutorial I have used defines the general PHY packet structure that has a Long training field, short training field, signal field, data field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also defines three different types of frames: Management, Control and Data frames. And that each frame consists of MAC header, payload and frame check sequence. &#xA;One example of frame is beacon frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Confusion is, what is the difference between packet and frame? I am totally confused. Does anyone have a clear explanation and understand of each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="15457" LastEditorUserId="15457" LastEditDate="2015-05-17T15:18:23.450" LastActivityDate="2019-02-27T09:43:04.170" Title="Difference between Frame and packets in IEEE 802.11" Tags="|ieee-802.11|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18534" PostTypeId="2" ParentId="18532" CreationDate="2015-05-17T02:01:49.707" Score="2" Body="&lt;p&gt;The terms frame and packet are essentially agnostic of the communication medium (physical layer/PHY - wireless in this case). Referring to the &lt;a href=&quot;http://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow&quot;&gt;OSI 7-layer model&lt;/a&gt;, a frame is a collection of data that is used to communicate on &lt;a href=&quot;http://en.wikipedia.org/wiki/Data_link_layer&quot; rel=&quot;nofollow&quot;&gt;layer 2&lt;/a&gt; of the OSI model, while packets perform the same function on &lt;a href=&quot;http://en.wikipedia.org/wiki/Network_layer&quot; rel=&quot;nofollow&quot;&gt;layer 3&lt;/a&gt;. The layer 3 packet, is encapsulated within a layer 2 frame as the payload. Take a look at the first table here: &lt;a href=&quot;http://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/OSI_model&lt;/a&gt; .&lt;/p&gt;&#xA;" OwnerUserId="15347" LastActivityDate="2015-05-17T02:01:49.707" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18539" PostTypeId="1" AcceptedAnswerId="18572" CreationDate="2015-05-17T11:35:24.130" Score="1" ViewCount="580" Body="&lt;p&gt;I have a couple of dedicated servers in Europe. Lately I started to notice high jitter for traffic coming from USA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After couple of MTRs and trace routes, I found that the source of the jitter (and sometimes packet loss) is one of the routes of tier1 (5th hop is multiple different IPs belongs to level3, one of them add high jitter and some packet loss).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Created support issue with the hosting company, but they are clueless. Moving from this hosting company to another one doesn't guarantee a solution because Level3 is used everywhere (and same problem can happen with other tier1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any recommendations to solve this problem? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to tell my packets (UDP) to prevent this bad link?&#xA;Can I talk to tier1 directly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Running voip and audio streaming servers; which are sensitive to jitter.&lt;/li&gt;&#xA;&lt;li&gt;Jitter is sometimes acceptable (less than 50ms), but it many times jump to 200ms and occasionally reaches 500ms. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;EDIT3:&#xA; - After trying MTR over and over, I noticed that sometimes packets pass through different tier1 networks (sometimes teliasonera and sometimes level3). And jitter increases when this happens. It seems that there is big difference is speed between providers.&lt;/p&gt;&#xA;" OwnerUserId="10403" LastEditorUserId="10403" LastEditDate="2015-05-18T09:45:27.197" LastActivityDate="2015-05-19T02:35:18.447" Title="What to do when there is high jitter in tier one connection(s)" Tags="|packet-analysis|packet-path|" AnswerCount="2" CommentCount="7" ClosedDate="2019-06-22T00:20:07.573" ContentLicense="CC BY-SA 3.0" />
  <row Id="18541" PostTypeId="1" AcceptedAnswerId="18542" CreationDate="2015-05-17T13:27:19.650" Score="8" ViewCount="8956" Body="&lt;p&gt;In 1000Base-T Ethernet connection, why is there a 100 m link length limit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CSMA/CD links normally are limited to a few hundred meters because of the limitations that CSMA/CD implies (collision domain size). But with full duplex point-to-point links, no limitation other than damping is implied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, where does the 100 m limitation come from? When using 1000Base-T in full duplex mode, can this be ignored?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="8475" LastEditorUserId="8499" LastEditDate="2018-03-02T22:42:02.970" LastActivityDate="2018-03-02T22:42:02.970" Title="1000Base-T Ethernet limited to 100 m, why?" Tags="|ethernet|layer1|cable|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18542" PostTypeId="2" ParentId="18541" CreationDate="2015-05-17T15:01:57.350" Score="7" Body="&lt;p&gt;The 100 meter limitation comes from physics and the installed base of cabling.  One hundred meters is a convenient length due to legacy specifications (10Base-T and 100Base-TX) since the installed cable base was already limited to 100 meters (CSMA/CD, as you pointed out, limited 10Base-T to 100 meters). You may have noticed that every twisted-pair standard strives to meet the 100 meter length for this reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The medium, twisted pairs of copper wire in this case, has certain properties that have inherent limitations due to electromagnetism.  This is a large subject, but a simple search will yield a lot of results.  Basically, you have external and internal noise that will degrade the signal.  The longer the run, the worse it is, and this problem gets worse at higher bandwidths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It becomes a tradeoff: it is better to specify a fixed length and increase the speed rather than keep the speed the same and increase the length.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-05-17T15:01:57.350" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18544" PostTypeId="2" ParentId="18526" CreationDate="2015-05-17T17:24:29.223" Score="3" Body="&lt;p&gt;Answers to your questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, they are public IPs&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, you create a static translation between 192.168.1.187 and one of your pool addresses.  The details depend on the specific hardware you have.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The IP address WAN and gateway are the network that connects you to your provider.   The WAN pool is a network of IP addresses that you can use for your devices.  They are two separate networks.  Although it usually doesn't matter,  you would normally translate your internal addresses to one of the WAN pool addresses.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-17T17:24:29.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18545" PostTypeId="1" AcceptedAnswerId="18553" CreationDate="2015-05-17T17:50:32.280" Score="6" ViewCount="2087" Body="&lt;p&gt;I need to replace some ethernet cables with optical fiber (to limit damage from thunder strikes etc.), and I've got some Zyxel switches in both ends with SFP ports I want to fill with SFP-modules for optical fiber. In this particular case it's a Zyxel GS1910-24 in either end. The range is quite short, but different buildings; approximately 20 meters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I can't find any information on whether Zyxel enforces only &quot;Zyxel-made&quot; SFP:s or not. I've found out what applies to a couple of other manufacturers, but nothing about Zyxel. To be specific: I've found no information that says that Zyxel switches only approve Zyxel's SFPs, neither no information that says that Zyxel switches will approve every SFP, independent of manufacturer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyone who knows anything about what SFPs Zyxel switches approve?&lt;/p&gt;&#xA;" OwnerUserId="15465" LastActivityDate="2015-05-18T06:28:17.120" Title="Zyxel switch &amp; SFP compatibility" Tags="|sfp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18547" PostTypeId="2" ParentId="18532" CreationDate="2015-05-17T19:26:48.753" Score="1" Body="&lt;p&gt;The term packet can be ambiguous, so the standards often use 'acronym soup' to avoid such ambiguity. In particular, often 'packet' is taken to be the layer above 'frame' (i.e. level 3 of the OSI model).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as you have found out, that's not always so. Here the discussion is about physical (layer 1) IEEE 802.11 packets. So the frame is encapsulated within the data field of the packet, not the other way round.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2015-05-17T19:26:48.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18549" PostTypeId="1" CreationDate="2015-05-17T20:22:01.150" Score="1" ViewCount="41" Body="&lt;p&gt;We have a wireless SSID for Managers which I need to secure using one time authentication. Currently we are using MAC filtering but it is insecure. So I am wondering if there is a certificate based authentication or any one time authentication as it will be inconvenience to enter a password in every connection. &lt;/p&gt;&#xA;" OwnerUserId="8366" LastActivityDate="2015-05-17T20:22:01.150" Title="Securing WLAN using one time authentication" Tags="|wireless|security|cisco-wireless|" AnswerCount="0" CommentCount="2" ClosedDate="2019-06-22T00:17:26.963" ContentLicense="CC BY-SA 3.0" />
  <row Id="18551" PostTypeId="1" AcceptedAnswerId="18977" CreationDate="2015-05-18T02:31:37.963" Score="4" ViewCount="486" Body="&lt;p&gt;When Switch A's port is configured to access mode from trunk mode, Switch B's port stays in trunk mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch A is DTP disabled (#switchport nonegotiate). Switch B has default configuration which is dynamic auto and DTP enabled. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this normal?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-06-05T07:19:51.060" Title="Neighbor switch's port doesn't change to access mode" Tags="|trunk|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18553" PostTypeId="2" ParentId="18545" CreationDate="2015-05-18T06:28:17.120" Score="5" Body="&lt;p&gt;I have used a variety of SFP modules (including Ciena, Finisar, Cisco, Fiberstore.com...) in a Zyxel MGS-3712F without any issues.&lt;/p&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2015-05-18T06:28:17.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18554" PostTypeId="2" ParentId="18541" CreationDate="2015-05-18T07:04:10.503" Score="-3" Body="&lt;p&gt;To use 1000Base-T modules at 1Gb/s you also need Cat 5e or Cat 6 ethernet cable else there is no guarantee that this will work at 1Gb/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also a 1Gb/s link uses all 8 wires in the cable where as a 100Mb/s link only uses 4, in case you have some wires damaged inside the cable it might work well at 100 Mb/s but not at 1Gb/s.&lt;/p&gt;&#xA;" OwnerUserId="15472" LastActivityDate="2015-05-18T07:04:10.503" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="18555" PostTypeId="1" CreationDate="2015-05-18T09:19:47.997" Score="1" ViewCount="198" Body="&lt;p&gt;Reading the MSDC design guide, it was indicated that OSPF is used for the routing and ECMP for supporting equal cost paths.&#xA;Who does the actual routing, is it OSPF using ECMP or the other way arround? And how are they actually interacting?&#xA;And it is indicated that the routing decision is made in the leaf node. Does that mean that the routing protocole is being executed only in the leaf nodes? &lt;/p&gt;&#xA;" OwnerUserId="15474" LastActivityDate="2015-05-18T15:16:38.657" Title="How do ECMP and OSPF collaborate within Cisco's MSDC network?" Tags="|cisco|ospf|ecmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18556" PostTypeId="1" CreationDate="2015-05-18T10:21:54.850" Score="2" ViewCount="284" Body="&lt;pre&gt;&lt;code&gt;      area0                     area0  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;CE1----------PE1-----------PE2-------------CE2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     N1                       N2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;CE1,CE2 are same customer edge routers. PE1,PE2 are provider Edge routers of same ISP. and they connected as show in image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;we are running OSPF between PE,CE for BGP/MPLS IP VPNs. PE1-CE1 (Network N1) &amp;amp; PE2-CE2 (Network N2) links are in area0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF on PE1,PE2 have same domain ID configured to make OSPF routes from one CE to other treated as IA routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the N1 is connected network to PE1 and Administrative distance for connected is higher than OSPF. so,PE1 will have N1 as connected route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we have only choice to redistribute the N1 to CE2 is by enabling 'redistribute connected' in BGP of PE1. As the domain ID will not be inserted when redistributing connected routes, CE2 will treat it as External Type 2 Network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doesn't it wrong to treat a network of same area/domain as external..?&lt;/p&gt;&#xA;" OwnerUserId="15476" LastEditorUserId="15476" LastEditDate="2015-05-19T10:17:25.060" LastActivityDate="2015-06-18T10:21:51.977" Title="using OSPF over PE-CE Links in VPNs" Tags="|vpn|bgp|ospf|vrf|mpls-vpn|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18558" PostTypeId="2" ParentId="18556" CreationDate="2015-05-18T11:27:14.817" Score="2" Body="&lt;p&gt;Since you have enabled OSPF on the connected interface, it will be an internal route for the networks behind the CE1.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But all OSPF routes on the CE1 side will be external routes on the CE2 side, because they all are redistributed to/from mBGP.  To make them internal, you need a sham link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Administrative distance doesn't really come into play here.  AD affects how the router forwards packets, but not necessarily what the routing protocol does.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-18T11:27:14.817" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18560" PostTypeId="2" ParentId="18555" CreationDate="2015-05-18T15:16:38.657" Score="2" Body="&lt;p&gt;All that we mean by &quot;ECMP&quot; is literally &quot;Equal Cost, Multi Path&quot;.  The router installs two same-cost paths to a given next-hop, and they are used equally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF makes the routing decisions for the network based on its LSA database.  If there are two paths that have the exact same cost from OSPF's perspective, it will consider them both &quot;best&quot;.  The router installs both equal-cost paths into the routing table, and the concept of &quot;ECMP&quot; occurs.  Half of all flows will be sent one way, half go the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the benefits of EIGRP is that it supports unequal-cost multipathing via the &quot;variance&quot; command.  OSPF, IS-IS, and all other IGP protocols I know of in the Cisco world only do equal-cost multipathing.&lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2015-05-18T15:16:38.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18561" PostTypeId="1" AcceptedAnswerId="18568" CreationDate="2015-05-18T15:56:26.397" Score="2" ViewCount="280" Body="&lt;p&gt;According to Cisco IOS documentation, &lt;code&gt;show subsys&lt;/code&gt; command displays the subsystem information which doesn't tell much. Is it basically a feature list for particular IOS image similar to one in &lt;em&gt;Cisco Feature Navigator&lt;/em&gt;? What is the practical usage of &lt;code&gt;show subsys&lt;/code&gt; command?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Few examples with &lt;code&gt;c1841-spservicesk9-mz.124-22.T.bin&lt;/code&gt; can be seen below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;c1841#show subsys name bfd*&#xA;Name                Class     Version   &#xA;bfd                 Protocol    1.000.001     &#xA;bfd_registry        Registry    1.000.001     &#xA;c1841#show subsys name tcl &#xA;Name                Class     Version   &#xA;tcl                 Library     2.000.001     &#xA;c1841#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-05-18T21:46:00.747" Title="What exactly does the &quot;show subsys&quot; command show?" Tags="|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18562" PostTypeId="1" CreationDate="2015-05-18T16:48:40.217" Score="1" ViewCount="151" Body="&lt;p&gt;Good evening,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone have any idea about what could be the reason I can't ping from one subnet to another in this scheme?&#xA;&lt;img src=&quot;https://i.stack.imgur.com/EFQkI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No ACL are defined in the 6509 and the sh ip route command displays both subnets as Directly connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping IP addresses defined in the 6509: 172.20.X.2 and 172.20.Y.2 for example :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ping 172.20.X.2 source 172.20.Y.1 It works&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ping 172.20.X.1 source 172.20.Y.1 It doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PIM sparse-mode is enabled at 172.20.X.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="775" LastEditDate="2015-06-20T16:53:33.183" LastActivityDate="2015-06-20T16:53:33.183" Title="Cisco 6509 route ports" Tags="|cisco|cisco-6500|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="18566" PostTypeId="1" AcceptedAnswerId="18567" CreationDate="2015-05-18T18:37:53.147" Score="2" ViewCount="754" Body="&lt;p&gt;I realise BOOTP is a legacy system, but this is for my reading for my studies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider a client, C, that is bootstrapping itself. It sends a BOOTP request to the server—obviously because it does not know its server location yet. C sends a BOOTP request with all the usual information: its hardware address, the (blank) IP, the transaction ID, the server IP address, the gateway IP address, etc., etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its server, S, receives the BOOTP request whilst listening at port 67. In the datagram, S finds the hardware address of C. S already knows the network location of C, which is 135.135.10.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that S knows the hardware address of C, why can't the server just send the BOOTP reply to C using the hardware address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My textbook says this isn't possible, because if S did try to do this, the server's host (whatever that is—if someone could explain I would be grateful) would broadcast an ARP request to C, which doesn't know its IP and would respond with an ICMP error (I'm assuming).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would this mysterious host decide to do this? Why can't S just send the thing to C with the hardware address it has been given? What's the point of sending a hardware address if it can't?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to everyone that took the time to read this!&lt;/p&gt;&#xA;" OwnerUserId="15481" LastEditorUserId="15481" LastEditDate="2015-05-19T11:19:24.347" LastActivityDate="2015-05-19T11:19:24.347" Title="Why does a sever's host automatically broadcast an ARP request after a server attempts to reply to a BOOTP request?" Tags="|dhcp|mac-address|broadcast|hardware|network-discovery|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18567" PostTypeId="2" ParentId="18566" CreationDate="2015-05-18T21:37:47.157" Score="1" Body="&lt;p&gt;(BOOTP exists within DHCP these days)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The process starts with the client sending a broadcast request as it generally will not know any server address(es) -- src ip will be zero, since it doesn't have an address yet. The server will look up the MAC within the request to form an answer. How that answer gets back requires a bit more thought. If the server sends a simple unicast reply, it will need an arp cache entry to know where to send it. The normal ARP discovery mechanism won't work because the client doesn't have its address yet. So, the server must either update it's ARP cache prior to sending the answer, &lt;em&gt;or&lt;/em&gt; send the answer as a broadcast message. (or bypass the host layer-3/4 processing by forming it's own layer-2 packet and sending it directly)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, the server cannot assume the client is on the same wire. So, the answer must be sent to where ever the request came from -- i.e. any possible relay agent, not the hardware address within the request.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-18T21:37:47.157" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18568" PostTypeId="2" ParentId="18561" CreationDate="2015-05-18T21:46:00.747" Score="2" Body="&lt;p&gt;They are software component versions. Unless you're Cisco, the information is 99% meaningless.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-18T21:46:00.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18572" PostTypeId="2" ParentId="18539" CreationDate="2015-05-19T01:38:14.593" Score="4" Body="&lt;p&gt;You cannot tell your packets to avoid one specific hop in a different provider's network. You also probably can't talk to the different provider directly unless you have a business relationship with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful when using per-hop latency from MTR or traceroute to make a determination. There are many reasons why a router will show elevated latency or even packet loss on traffic &lt;em&gt;to&lt;/em&gt; the router (such as traceroute) when traffic &lt;em&gt;through&lt;/em&gt; the router is not affected (see &lt;a href=&quot;https://www.nanog.org/meetings/nanog45/presentations/Sunday/RAS_traceroute_N45.pdf&quot; rel=&quot;nofollow&quot;&gt;slides from a talk at NANOG 45&lt;/a&gt;, slide 28+).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your traffic is especially sensitive to network conditions you should consider moving (or adding) servers closer to users to reduce latency and reduce the number of places where things can go wrong. &lt;/p&gt;&#xA;" OwnerUserId="1563" LastActivityDate="2015-05-19T01:38:14.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18573" PostTypeId="2" ParentId="18539" CreationDate="2015-05-19T02:35:18.447" Score="-3" Body="&lt;p&gt;A tier 1 connection is one where your carrier owns the plumbing from end to end without riding a 3rd party network.  A tier 2 connection is one where your carrier has to ride another carriers network at some point.  On and on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I highly doubt that Level3 is the source of significant delay or jitter.  The most likely culprit is the access circuit(s).  Try using an Internet friendly codec for your VoIP such as iLBC.  As for audio streaming, proper buffering will solve any delay/jitter issues.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-19T02:35:18.447" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18574" PostTypeId="1" AcceptedAnswerId="18575" CreationDate="2015-05-19T03:53:02.143" Score="0" ViewCount="747" Body="&lt;p&gt;I have got a new Cisco 867vae and connected to ADSL 2+. The connection is working well, I just dont seem to have the routing right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the router I can Ping 8.8.8.8 but from the computer I can only ping the router not anything outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want is everything that is not internal to go out the Dialer1 interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building configuration...&#xA;&#xA;Current configuration : 5743 bytes&#xA;!&#xA;! Last configuration change at 03:05:21 UTC Tue May 19 2015 by admin&#xA;!&#xA;version 15.4&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname yourname&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;logging buffered 51200 warnings&#xA;!&#xA;no aaa new-model&#xA;wan mode dsl&#xA;!&#xA;!&#xA;ip dhcp excluded-address 10.10.10.1&#xA;!&#xA;ip dhcp pool DHCP-Pool&#xA; import all&#xA; network 10.10.10.0 255.255.255.0&#xA; default-router 10.10.10.1 &#xA; dns-server 10.10.10.1 8.8.8.8 &#xA;!&#xA;!&#xA;ip domain name yourdomain.com&#xA;ip name-server 8.8.8.8&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;controller VDSL 0&#xA; operating mode adsl2+ &#xA;no cdp run&#xA;!&#xA;! &#xA;interface ATM0&#xA; no ip address&#xA; no atm ilmi-keepalive&#xA;!&#xA;interface ATM0.1 point-to-point&#xA; description PrimaryWANDesc_ADSL&#xA; pvc 8/35 &#xA;  pppoe-client dial-pool-number 1&#xA; !&#xA;!&#xA;interface Ethernet0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA;!&#xA;interface FastEthernet1&#xA; no ip address&#xA;!&#xA;interface FastEthernet2&#xA; no ip address&#xA;!&#xA;interface FastEthernet3&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1&#xA; no ip address&#xA; ip tcp adjust-mss 1412&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; description $ETH_LAN$&#xA; ip address 10.10.10.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; ip tcp adjust-mss 1412&#xA;!&#xA;interface Dialer1&#xA; ip address negotiated&#xA; ip mtu 1452&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; encapsulation ppp&#xA; dialer pool 1&#xA; dialer-group 1&#xA; ppp authentication chap pap callin&#xA; ppp chap hostname *****&#xA; ppp chap password 0 *****&#xA; ppp pap sent-username ***** password 0 *****&#xA; ppp ipcp dns request&#xA; no cdp enable&#xA;!&#xA;ip forward-protocol nd&#xA;ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;!&#xA;!&#xA;ip nat inside source list nat-list interface Dialer1 overload&#xA;ip route 10.10.10.0 255.255.255.0 Dialer1&#xA;!&#xA;dialer-list 1 protocol ip permit&#xA;!&#xA;access-list 23 permit 10.10.10.0 0.0.0.7&#xA;!&#xA;banner exec ^C&#xA;% Password expiration warning.&#xA;-----------------------------------------------------------------------&#xA;&#xA;Cisco Configuration Professional (Cisco CP) is installed on this device &#xA;and it provides the default username &quot;cisco&quot; for  one-time use. If you have &#xA;already used the username &quot;cisco&quot; to login to the router and your IOS image &#xA;supports the &quot;one-time&quot; user option, then this username has already expired. &#xA;You will not be able to login to the router with this username after you exit &#xA;this session.&#xA;&#xA;It is strongly suggested that you create a new username with a privilege level &#xA;of 15 using the following command.&#xA;&#xA;username &amp;lt;myuser&amp;gt; privilege 15 secret 0 &amp;lt;mypassword&amp;gt;&#xA;&#xA;Replace &amp;lt;myuser&amp;gt; and &amp;lt;mypassword&amp;gt; with the username and password you &#xA;want to use.&#xA;&#xA;-----------------------------------------------------------------------&#xA;^C&#xA;banner login ^C&#xA;-----------------------------------------------------------------------&#xA;Cisco Configuration Professional (Cisco CP) is installed on this device. &#xA;This feature requires the one-time use of the username &quot;cisco&quot; with the &#xA;password &quot;cisco&quot;. These default credentials have a privilege level of 15.&#xA;&#xA;YOU MUST USE CISCO CP or the CISCO IOS CLI TO CHANGE THESE  &#xA;PUBLICLY-KNOWN CREDENTIALS&#xA;&#xA;Here are the Cisco IOS commands.&#xA;&#xA;username &amp;lt;myuser&amp;gt;  privilege 15 secret 0 &amp;lt;mypassword&amp;gt;&#xA;no username cisco&#xA;&#xA;Replace &amp;lt;myuser&amp;gt; and &amp;lt;mypassword&amp;gt; with the username and password you want &#xA;to use. &#xA;&#xA;IF YOU DO NOT CHANGE THE PUBLICLY-KNOWN CREDENTIALS, YOU WILL &#xA;NOT BE ABLE TO LOG INTO THE DEVICE AGAIN AFTER YOU HAVE LOGGED OFF.&#xA;&#xA;For more information about Cisco CP please follow the instructions in the &#xA;QUICK START GUIDE for your router or go to http://www.cisco.com/go/ciscocp &#xA;-----------------------------------------------------------------------&#xA;^C&#xA;!&#xA;line con 0&#xA; login local&#xA; no modem enable&#xA;line aux 0&#xA;line vty 0 4&#xA; access-class 23 in&#xA; privilege level 15&#xA; login local&#xA; transport input telnet ssh&#xA;!&#xA;scheduler allocate 60000 1000&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15485" LastEditorUserId="619" LastEditDate="2015-05-19T04:31:53.807" LastActivityDate="2015-05-19T04:31:53.807" Title="Cisco 867vae not routing properly" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18575" PostTypeId="2" ParentId="18574" CreationDate="2015-05-19T04:09:20.880" Score="2" Body="&lt;p&gt;It looks like you're referencing a non-existing access list in your NAT configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list nat-list interface Dialer1 overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should define the access list &quot;nat-list&quot; to include your local network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended nat-list&#xA; permit 10.10.10.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13772-12.html&quot; rel=&quot;nofollow&quot;&gt;Cisco documentation&lt;/a&gt; for everything about Netwok Address Translation (NAT).&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2015-05-19T04:09:20.880" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18577" PostTypeId="1" AcceptedAnswerId="18578" CreationDate="2015-05-19T09:18:53.047" Score="2" ViewCount="7567" Body="&lt;p&gt;I have this multimode transceiver product:&#xA;&lt;a href=&quot;http://www8.hp.com/h20195/v2/gethtml.aspx?docname=c04168409&amp;amp;search=J4858C&quot; rel=&quot;nofollow&quot;&gt;http://www8.hp.com/h20195/v2/gethtml.aspx?docname=c04168409&amp;amp;search=J4858C&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am going to use it on the following switch:&#xA;&lt;a href=&quot;http://www8.hp.com/h20195/v2/gethtml.aspx?docname=c04111401&amp;amp;search=J9727A&quot; rel=&quot;nofollow&quot;&gt;http://www8.hp.com/h20195/v2/gethtml.aspx?docname=c04111401&amp;amp;search=J9727A&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if I could use the following fiber optic cable to connect to a same configuration at 200 meter distance (which has been cabled by an electrician and it is a multimode type but I don't know about the OM number) :&#xA;&lt;strong&gt;LC-LC 0200 50/125µ OM3 Duplex 2m&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the limitations in terms of bandwidth/distance?&#xA;I really don't understand the MHz*km bandwidth thing.&lt;/p&gt;&#xA;" OwnerUserId="15491" LastEditorUserId="8499" LastEditDate="2018-12-21T04:37:59.220" LastActivityDate="2023-11-24T20:20:46.370" Title="Can I use an OM3 fiber optics cable on 1gb transceiver J4858C?" Tags="|layer1|fiber|optics|transceiver|optical|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18578" PostTypeId="2" ParentId="18577" CreationDate="2015-05-19T11:35:38.413" Score="11" Body="&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; Fixing answer now that I'm on a real laptop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, OM3 is just &quot;laser optimized&quot; multimode, it will work with both your optic and distance.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What are the limitations in terms of bandwidth/distance?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Max Distance @ 1Gbit/s&lt;/strong&gt; (per the product page): 550m&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This also lines up with the OM3 specification&#xA;&lt;a href=&quot;http://en.m.wikipedia.org/wiki/Multi-mode_optical_fiber#Types&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://en.m.wikipedia.org/wiki/Multi-mode_optical_fiber#Types&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I really don't understand the MHz*km bandwidth thing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is called modal dispersion, it's an inherent property of multimode fiber - it's basically the relationship between distance and bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So first you need to understand that &lt;strong&gt;multi&lt;/strong&gt;mode fiber is named that way for a reason.  There are multiple modes of light that are sent over the cable, so when light is transmitted it looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/pxTXU.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of those lines are the &quot;modes&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because they're using the entire width of the fiber, they &quot;bounce&quot; from &quot;top to bottom&quot; as you see in the picture.  Modes traveling at the boundaries of the fiber travel faster, and modes traveling at the center travel a little bit slower.  If you look at the picture where it says &quot;Dispersion&quot; you see that they don't quite arrive at the same time, this is a very very minute amount of time, however its enough to reduce bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for something like 1GB, because it doesn't need to carry as much data, it has much more tolerance for distance (550m).  If you want it to carry 10GB, you need to compensate by shortening the distance because of this dispersion.  I hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="36720" LastEditDate="2017-10-29T11:25:47.420" LastActivityDate="2017-10-29T11:25:47.420" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18579" PostTypeId="2" ParentId="18511" CreationDate="2015-05-19T12:51:42.087" Score="3" Body="&lt;p&gt;&lt;em&gt;I think you have missed something more fundamental that has lead you to ask your question, but in fact the question isn't really valid.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ADSL isn't for hosting providers or people with large uploads requirements. It’s a cheap service aimed at home users and small businesses that can be quickly and cheaply deployed, it has low overheads, and works over a variety of physical line qualities and lengths. So that makes it great for domestic roll out, home users can't afford to have their street dug up to lay fibres.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You mentioned frequency division multiplexing, the division of frequencies can be moved with ADSL. With ADSL2+ for example Annex M reallocates some of the downstream frequency range for use as upstream frequencies sacrificing download speed to improve upload speed. Also with ADSL2+ the line speed can and will fluctuate through the day or weak as the physical line is susceptible to interface and the attenuation rate fluctuates. As a result the frequencies used by an ADSL2+ line for upload and download will be changing (more acccuractly, they will reduce to cope with periods of high interferance).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But like I said ADSL/SDSL/ISDN/3G/4G/LTE are cheap services (if you live in a developing country they maybe the best money can buy, I'm of course talking relatively within the scope of available technologies, relatively these are for home users or small offices at best).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are products that bring symmetrical bandwidths to home users like EFM (bonded SDSL). VDSL brings asymmetric high bandwidths to home users here in the UK, up to 80Mbps download and 20Mbps upload delivered over the same telephone line that would have been used for ADSL/ADSL2+ previously but with a new modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are a hosting provider for example and need symmetrical bandwidth you can pay for, and this is the crux of my argument, &lt;strong&gt;FULL DUPLEX&lt;/strong&gt; connectivity (probably Ethernet based). ADSL and as per you example use FDM so that it can be full duplex. These days 100BaseTX, 1000BaseTX, 1000BaseSX/LX etc 10GBaseSX and so on all have and transmit paths in both direction so they have full duplex communications and there is no need for FDM or TDM so “split” the physical bearer channel into an “upstream” and “downstream” path like ADSL. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The old saying, you get what you pay for. If you pay peanuts which home users tend to do, you get a single copper pair that has to use FDM to achieve bidirectional communications that is only asymmetric in available bandwidth. If you pay more money you get bidirectional high speed low latecny connectivity.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does this happen? Is this for marketing business reasons or are&#xA;  there actually physical problem with dynamic allocation? In the later&#xA;  case: What are those reasons?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So to be clear; both products are available, symmetric connections and asymmetric. Symmetric connections tend to be more expensive but it sounds like you are approaching this from a home user / small office point of view. Anyone with the money to spend who also has the need for lots of bandwidth isn't going to be using ADSL (or LTE). ADSL is everywhere because that’s what people can afford. There is no limitation here as such. Its more about what is commercially viable.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2015-05-19T12:51:42.087" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18580" PostTypeId="2" ParentId="18527" CreationDate="2015-05-19T13:06:21.903" Score="2" Body="&lt;p&gt;The scenario you are asking about will not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer is in the name - &quot;multimode&quot; fibre carries multiple modes of light. &quot;Singlemode&quot; fibre carries only a single mode. So you can not carry multiple modes of light down a fibre that only supports a mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use multimode fibre to connect singlemode interfaces but this will only work over a short distance. Soon you will encounter some sort of dispertion so its not really recommend but it will work as a last resort.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2015-05-19T13:06:21.903" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18581" PostTypeId="1" CreationDate="2015-05-19T13:57:22.717" Score="5" ViewCount="1806" Body="&lt;p&gt;Why are both flow control and congestion control procedures required in a TCP connection - What mechanisms does the TCP protocol use to implement these?&lt;/p&gt;&#xA;" OwnerUserId="15494" LastActivityDate="2015-05-20T13:39:54.477" Title="Why are both flow control and congestion control procedures required in a TCP connection?" Tags="|congestion|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18582" PostTypeId="2" ParentId="18581" CreationDate="2015-05-19T14:11:13.033" Score="2" Body="&lt;p&gt;Flow control is used to help prevent overloading the receiver with too much data. Flow control uses a sliding window in which the receiver states how much they are able to receive and buffer so that the sender does not send to much data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Congestion control, or congestion avoidance, is used to help avoid the congestion that could occur in the event of packet loss; the packet loss or packet re-ordering could lead to duplicate ACKs being received. Congestion control uses a window similar to flow control in order to limit the number of unacknowledged packets sent.&lt;/p&gt;&#xA;" OwnerUserId="1613" LastActivityDate="2015-05-19T14:11:13.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18586" PostTypeId="1" AcceptedAnswerId="18602" CreationDate="2015-05-19T16:50:53.763" Score="1" ViewCount="625" Body="&lt;p&gt;My apologies is this question is stupid. I am in learning phase of IEE 802.11.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The figure below illustrates the single user packet structure of IEEE 802.11ac. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It consists of preamble and data part as you can see. It is known that this packet structure supports bandwidths of 20, 40, 80 , 160 MHz. Therefore as you can see there is a part that is duplicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is I don't understand why the duplicate portion of the preamble is stacked on top of each other. How does one stack bits on top of each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts.&lt;/p&gt;&#xA;" OwnerUserId="15457" LastEditorUserId="15457" LastEditDate="2015-06-17T14:09:48.803" LastActivityDate="2015-06-17T14:09:48.803" Title="packet structure of IEEE 802.11 WLAN?" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18587" PostTypeId="2" ParentId="18527" CreationDate="2015-05-19T18:10:41.073" Score="2" Body="&lt;p&gt;Multimode and Singlemode fibres have very different dispersion characteristics, so they are not directly interoperable. In the unlikely event that you can make it work, don't count on it being reliable. You will need a suitable &lt;a href=&quot;http://lmgtfy.com/?q=singlemode%20to%20multimode%20converter&quot; rel=&quot;nofollow&quot;&gt;converter&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15502" LastActivityDate="2015-05-19T18:10:41.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18588" PostTypeId="2" ParentId="17395" CreationDate="2015-05-19T19:02:31.533" Score="2" Body="&lt;p&gt;You were right with your assumption about VRFs. Use them.  F-VRF, I-VRF coined per Cisco&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/document/51931/vrf-aware-ipsec-cheat-sheet#Tunnel-protection_with_ivrfcust1-vrf_and_fvrfinternet-vrf_&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/document/51931/vrf-aware-ipsec-cheat-sheet#Tunnel-protection_with_ivrfcust1-vrf_and_fvrfinternet-vrf_&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3980" LastActivityDate="2015-05-19T19:02:31.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18589" PostTypeId="1" CreationDate="2015-05-19T19:30:33.840" Score="5" ViewCount="1987" Body="&lt;p&gt;I have 4 VLANs set up for our network.  VLAN 50 for Servers / Firewall, VLAN 100 for Workstations, VLAN 150 for VOIP, and VLAN 200 for WiFi.  What is the best practice for setting the trunk links VLAN membership?  Is there a difference between the &quot;trunk native vlan&quot; command, and &quot;switchport access vlan XXX&quot;?  Should I make the native VLAN for trunk links the Servers VLAN, or a completely separate VLAN?&lt;/p&gt;&#xA;" OwnerUserId="14318" LastActivityDate="2015-05-19T20:46:23.200" Title="What VLAN to set as trunk's native VLAN" Tags="|vlan|trunk|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18590" PostTypeId="2" ParentId="18527" CreationDate="2015-05-19T19:54:50.170" Score="2" Body="&lt;p&gt;No, you can't use multimode transceivers with a singlemode fiber plant. This simply will not work as desired.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to use singlemode transceivers with a multimode fiber plant. This can be more complicated to avoid problems and/or damage to your optic and may require the use of a &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/transceiver-modules/product_bulletin_c25-530836.html&quot; rel=&quot;nofollow&quot;&gt;Mode Conditioning Patch Cable&lt;/a&gt;. Make sure to do your research before trying to implement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if you are only talking about Gig speeds, in my opinion it isn't worth looking into the MCP cables as they can cost more than buying SX transceivers themselves.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-05-19T19:54:50.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18591" PostTypeId="2" ParentId="18589" CreationDate="2015-05-19T20:46:23.200" Score="3" Body="&lt;p&gt;A trunk's native vlan is the vlan to which untagged traffic belongs. &lt;em&gt;switchport access&lt;/em&gt; applies only to ports in access mode -- while in trunk mode, those commands do nothing at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which vlan is &quot;native&quot; (and this not tagged) is a matter of personal preference. You could leave it at &quot;1&quot; and not allow &quot;1&quot; on the port (&lt;em&gt;switchport trunk allowed vlan&lt;/em&gt;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-19T20:46:23.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18592" PostTypeId="1" CreationDate="2015-05-19T21:28:44.603" Score="6" ViewCount="5554" Body="&lt;p&gt;I am trying to familiarize myself at the moment with the  Ethernet network protocol. However, when looking at the standard a Ethernet frame needs a destination MAC address, and the source address MAC is usually programmed onto the device. My questions is how does the a device get that initial destination address. Such as when you plugin a computer into the network first time how does it discover it's neighbors MAC addresses. Like you need to talk with default gateway to get an IP address to send data outside of the network. I have tried looking at the the standards, and I am not sure to exactly search for. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this wiki article &lt;a href=&quot;http://en.wikipedia.org/wiki/Link_Layer_Discovery_Protocol&quot; rel=&quot;nofollow&quot;&gt;Link Layer Discovery Protocol&lt;/a&gt;, but it looks to be standardized in 2005 and Ethernet is older than that. So what was done before that? It also seems to be a bit more than just give MAC address.&lt;/p&gt;&#xA;" OwnerUserId="15505" LastEditorUserId="775" LastEditDate="2015-06-20T16:53:01.503" LastActivityDate="2015-06-20T16:53:01.503" Title="Ethernet Neighbor Discovery?" Tags="|ethernet|mac-address|layer2|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18593" PostTypeId="2" ParentId="18592" CreationDate="2015-05-19T21:49:02.003" Score="5" Body="&lt;p&gt;To get the MAC address for a given IP(v4) address, your computer will use the &lt;a href=&quot;http://en.wikipedia.org/wiki/Address_Resolution_Protocol&quot; rel=&quot;noreferrer&quot;&gt;Address Resolution Protocol&lt;/a&gt;. For IPv6, the &lt;a href=&quot;http://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol&quot; rel=&quot;noreferrer&quot;&gt;Neighbor Discovery Protocol&lt;/a&gt; does the same thing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of LLDP is to discover other devices on the network, and the messages are always sent from your own MAC address to well known destination MAC addresses.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-05-19T21:49:02.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18594" PostTypeId="2" ParentId="18592" CreationDate="2015-05-19T21:50:56.140" Score="3" Body="&lt;p&gt;Ethernet relies on a destination MAC address for frame delivery. The source MAC address will be the MAC address of the outgoing interface which sent the frame. This outgoing interface could be that of the originating node, or of an intermediate router between the originating node and the destination node.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;neighbor discovery&quot; you're referring to, on an IP network, is the ARP process. Using the term &quot;neighbor discovery&quot; is somewhat of a misnomer here, because there could be multiple devices on the same physical segment that the end host or node is connected to. It all depends on what source host wants to send data to what destination host. All hosts will maintain an ARP table which is essentially a mapping of IP addresses to MAC addresses, which the host will use to send frames to, including that of a gateway, which is used to get traffic off of the local segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest reading more about how ARP works on an Ethernet network. This is essentially an on-demand process that is used to determine the destination MAC address (which is used by Ethernet) that is associated with a given destination IP address in order to pass frames from one host to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LLDP is used to provide additional information (other than information that would normally be obtained via the ARP process) between two directly connected nodes, whether it be switch to switch, host to switch, host to router, host to host, etc.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2015-05-19T21:50:56.140" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18595" PostTypeId="1" CreationDate="2015-05-20T01:02:51.940" Score="1" ViewCount="746" Body="&lt;p&gt;I have a pair of Dell PowerConnect 2808 managed switches. I am attempting to enable syslog on them, but not having any luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have searched the web interface, used telnet to log into the CLI interface, and cannot find the syslog functionality. I know that it is keeping a log (I assume in flash) because when I enter (from the CLI) &quot;show tech-support config&quot; I can see section being reported that looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;------------------ show logging ------------------&#xA;Logging is enabled.&#xA;Console Logging: Level info. Console Messages: 0 Dropped.&#xA;Buffer Logging: Level info. Buffer Messages: 20 Logged, 20 Displayed, 20 Max.&#xA;File Logging: Level error. File Messages: 0 Logged, 35 Dropped.&#xA;2 messages were not logged&#xA;&#xA;Application filtering control&#xA;Application                 Event                       Status&#xA;--------------------        --------------------        ---------&#xA;AAA                         Login                       Enabled&#xA;File system                 Copy                        Enabled&#xA;&#xA;01-Jan-2000 00:02:24 :%INIT-I-Startup: Warm Startup&#xA;(...other log entries follow...)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried the following commands, but no luck:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;console# show logging&#xA;% Unrecognized command&#xA;console# show logging file&#xA;% Unrecognized command&#xA;console# show syslog&#xA;% Unrecognized command&#xA;console# show syslog-servers&#xA;% Unrecognized command&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The firmware on them is current, and they are vanilla, right out of the box, so nothing &quot;weird&quot; has been done to them. I would just like them to report the same way that their big brothers do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a secret or alternate way to enable this basic functionality in these switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="15508" LastActivityDate="2015-05-20T01:02:51.940" Title="PowerConnect 2808 and syslog" Tags="|switch|cli|dell|powerconnect|syslog|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18597" PostTypeId="1" CreationDate="2015-05-20T02:29:52.067" Score="2" ViewCount="75" Body="&lt;p&gt;I am looking at buying some managed switches, a router and a firewall for a laboratory LAN. I am trying to put together some quotes for analyzing my budget and am looking at Cisco and Juniper for now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides the device itself (e.g. router, switch, security appliance), what else should I be looking to include in my shopping list? Do the vendors like Cisco/Juniper provide rack mounts, console cables, power cables, and everything needed to install and setup the devices with the equipment itself? Do I need to be looking for that separately?&lt;/p&gt;&#xA;" OwnerUserId="15510" LastActivityDate="2015-05-20T02:41:09.317" Title="Network Equipment: What is NOT in the box with the equipment?" Tags="|cisco|juniper-junos|" AnswerCount="1" CommentCount="2" ClosedDate="2015-05-21T09:39:50.490" ContentLicense="CC BY-SA 3.0" />
  <row Id="18598" PostTypeId="2" ParentId="18597" CreationDate="2015-05-20T02:41:09.317" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;... and everything needed to install and setup the devices with the equipment itself?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can only speak for Cisco, &lt;em&gt;YES&lt;/em&gt;. You can get everything except a trunk monkey to actually install it. (for larger kit, you'll need to specifically add the necessary rack mounting kit to your order -- 19&quot;, 23&quot;, cable management, etc. But I'm guessing this lab won't be using a 6509 or 7513)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-20T02:41:09.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18601" PostTypeId="1" AcceptedAnswerId="18615" CreationDate="2015-05-20T04:28:38.890" Score="4" ViewCount="111" Body="&lt;p&gt;Ive noticed that Modern switching equipment will auto sense whether it should be DTE or DCE. It will also auto sense whether the line can be in full duplex mode, or if it must be in half duplex. Ive been thing about stuff and I was wondering how does this auto sensing happen? What is the scheme or technology that it is using?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance :D&lt;/p&gt;&#xA;" OwnerUserId="15511" LastActivityDate="2015-05-20T20:32:30.917" Title="Auto Sensing in Modern Switching Equipment" Tags="|switch|switching|duplex|automation|half-duplex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18602" PostTypeId="2" ParentId="18586" CreationDate="2015-05-20T05:04:15.417" Score="2" Body="&lt;p&gt;I believe you are misinterpreting the diagram.  This is a rather simple way of trying to show how the RF is used over time to clear the frequency, establish timing, and set any parameters necessary for the information to be transmitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11ac has to remain backwards compatible with previous 802.11 standards so they can see and avoid transmitting on the RF for the time specified. While 802.11n offered three PHY formats (legacy, mixed and green field modes), 802.11ac was simplified and only offers one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The legacy training fields and signal fields need to be sent in a format that will be recognized by legacy devices (i.e. 802.11a and 802.11n) which means that they can only occupy a 20MHz channel. As the legacy fields can not set the VHT parameters, the initial VHT fields must follow this as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that point, the rest of the VHT communication can take up the entire channel width if it is larger than the initial 20MHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But consider, what happens if you only transmit those initial fields on the first 20MHz but your channel is 40MHz (or larger)? Legacy devices operating on those channels will not receive the information they need to avoid using the channel for the time specified and they could then create a collision outside of that first 20MHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to avoid this potential problem, the same initial fields are duplicated and sent out on the second (and successive) 20MHz channels as well. It is only once these initial fields are sent and the VHT transmission starts that it can utilize the full width of the 40MHz (or larger) channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it helps, think of the diagram as illustrating lanes on a road. If you want to send an &quot;escort vehicle&quot; ahead to clear the route, you would need to send one down all the lanes at the same time to ensure they were clear and that no other vehicle merged into the &quot;gap.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For bonus points, I should point out that 802.11 doesn't really transmit bits, it transmits symbols. The number of bits transmitted per symbol is determined by the modulation and coding rate. So in a sense, bits are always stacked on top of each other.  For example, 802.11a BPSK R=1/2 (6 Mbps data rate) can transmit 24 bits per symbol.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-05-20T05:04:15.417" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="18603" PostTypeId="1" AcceptedAnswerId="42671" CreationDate="2015-05-20T09:32:05.423" Score="2" ViewCount="604" Body="&lt;p&gt;I am using an embedded Wi-Fi module (ESP8266) to act as a logger to find devices that are using my LAN network. I can get this module to sniff Wi-Fi packets promiscuously, but now I need to decode the raw packets so that I know the IP and MAC address from devices in my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to make sure that these packets do contain IP and MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also attached the hex dump log here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/NGlAK.jpg&quot; alt=&quot;promiscuous sniff 1&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/8Fl2Q.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: is there any method to decode these hex values to get the MAC and IP addresses of devices in the network? I tried to use Wireshark -&gt; Import Hex Dump -&gt; use encapsulation type ranging from Ethernet, 802.11 Wireless LAN, 802.11 Wireless LAN with radio information but it returns empty.&lt;/p&gt;&#xA;" OwnerUserId="15515" LastEditorUserId="8499" LastEditDate="2017-07-19T16:14:07.453" LastActivityDate="2017-07-19T16:14:07.453" Title="Decode promiscuous Wi-Fi Packets offline" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18604" PostTypeId="1" CreationDate="2015-05-20T09:42:22.020" Score="1" ViewCount="883" Body="&lt;p&gt;How does L3 Switch deal with broadcast communication such as ARP,DHCP or Broadcast storm? Is it the same that router deal with such as blocking a broadcast communication or ip address &quot;255.255.255.255&quot;?&lt;/p&gt;&#xA;" OwnerUserId="7897" LastEditorUserId="8499" LastEditDate="2018-03-21T01:07:18.133" LastActivityDate="2018-03-21T01:07:18.133" Title="the difference in dealing of Layer 3 Switch and Router with broadcast communication" Tags="|switch|router|layer3|broadcast|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18605" PostTypeId="2" ParentId="18477" CreationDate="2015-05-20T11:02:36.670" Score="4" Body="&lt;p&gt;&lt;strong&gt;ip policy route-map&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that command permit to create differentiate policy to the routing table:&lt;br&gt;&#xA; &lt;a href=&quot;http://www.ciscozine.com/pbr-route-a-packet-based-on-source-ip-address/&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscozine.com/pbr-route-a-packet-based-on-source-ip-address/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;create an acl to define the traffic to internet that shall pass on ASA7&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2851(config)# ip access-list exended SERVER&#xA;2851(config-ext-nacl)# deny ip any 192.168.0.0 0.0.3.255&#xA;2851(config-ext-nacl)# permit ip host 192.168.0.100 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;create a route-map to ASA7 destination&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2851(config)# route-map ASA7&#xA;2851(config-route-map)# match ip address SERVER&#xA;2851(config-route-map)# set ip next-hop 192.168.0.7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;apply the route-map to the correct interface (the one pointing to the asa)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2851(config)#interface fa0/0&#xA;2851(config-if)#ip policy route-map ASA7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I never try this command before, neither packet tracer permit me a simulation, so no refound if don't work correctly! ;)&lt;/p&gt;&#xA;" OwnerUserId="8727" LastEditorUserId="8727" LastEditDate="2015-05-20T12:50:17.630" LastActivityDate="2015-05-20T12:50:17.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18607" PostTypeId="2" ParentId="18604" CreationDate="2015-05-20T12:52:13.210" Score="3" Body="&lt;p&gt;By default, a layer 3 switch will treat broadcasts like a layer 2 switch at the layer 2 level.  IOW, it will forward the broadcast throughout the VLAN.  By default, it will treat broadcasts like a router at the layer 3 level.  IOW, it will not forward broadcasts across layer 3 boundaries.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2015-05-20T12:52:13.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18608" PostTypeId="2" ParentId="18581" CreationDate="2015-05-20T13:39:54.477" Score="5" Body="&lt;p&gt;In short: Flow control makes sure that the receiver is never overloaded with more data it can handle whereas congestion control is used to avoid congesting the network between sender and receiver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flow control: each ACK the receiver sends to the sender includes the current size of the receive window, which states how many more bytes fit into the receive buffer. This procedure is called the &lt;a href=&quot;http://en.wikipedia.org/wiki/Sliding_window_protocol&quot; rel=&quot;noreferrer&quot;&gt;sliding window protocol&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Congestion control: after TCP was introduced, it was noticed, that too much traffic resulted in a so-called congestion of the network: not all packages could be delivered when the network bandwidth was exceeded. The TCP implementation reacts to missing ACKs by sending these packets again, which however only makes the situation worse, as the network becomes even more congested. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer to this problem is the congestion control. It is quite complex, but basically what happens is, that as soon as a message can't be delivered (when a message isn't acknowledged after a certain timeout, it is considered that the message couldn't be delivered), it is assumed that the package was lost because of a congestion in the network, and the sending rate is reduced. This is also implemented using a sliding window, the congestion window. The actual algorithm is more complex, it nowadays includes the slow-start, congestion avoidance, fast retransmit, and fast recovery algorithms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At any given moment, a TCP implementation is allowed to send at most &lt;code&gt;min(receive window, congestion window)&lt;/code&gt; unacknowledged packets to respect both the flow control and the congestion control. &lt;/p&gt;&#xA;" OwnerUserId="15520" LastActivityDate="2015-05-20T13:39:54.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18610" PostTypeId="2" ParentId="16971" CreationDate="2015-05-20T14:51:49.583" Score="-2" Body="&lt;p&gt;You can flash from TFTP or USB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also you can try to umount filesystems and run&#xA;fsck -f -y&#xA;on these failing filesystem.&lt;/p&gt;&#xA;" OwnerUserId="15523" LastEditorUserId="15523" LastEditDate="2015-05-20T15:45:58.553" LastActivityDate="2015-05-20T15:45:58.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18612" PostTypeId="1" AcceptedAnswerId="18613" CreationDate="2015-05-20T17:16:20.723" Score="3" ViewCount="105" Body="&lt;p&gt;Reading &lt;strong&gt;IEEE 802® Standard for Local and Metropolitan Area Networks: Overview and Architecture&lt;/strong&gt; document&#xA;i came upon thins:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An IEEE 802 LAN is a peer-to-peer communication network that enables&#xA;  stations to communicate directly on a point-to-point, or&#xA;  point-to-multipoint, basis &lt;em&gt;without requiring them to communicate with&#xA;  any intermediate stations that perform forwarding or filtering above&#xA;  the PHY&lt;/em&gt;. LAN communication takes place at moderate to high data rates&#xA;  and with short transit delays, on the order of a few milliseconds or&#xA;  less.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I couldn't understand the PHY part. Given that switches forward packets at the DLL, am I right to conclude that a network switch could separate my home network in two LANs?&lt;/p&gt;&#xA;" OwnerUserId="15525" LastActivityDate="2015-05-23T18:08:16.033" Title="IEEE 802 Standard LAN can't require DLL processing?" Tags="|lan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18613" PostTypeId="2" ParentId="18612" CreationDate="2015-05-20T18:32:19.237" Score="3" Body="&lt;p&gt;It is saying that you can write your own networking stack to the IEEE 802 LAN specification.  Your stack need not include anything to do with the OSI model, or any other existing model.  If you are successful in your programming efforts, the IEEE 802 LAN compliant hardware will transport your data from one device running your stack to another directly connected device running your stack.  The PHY doesn't deal with switch or router specifications or functions.  A dumb repeater (hub) would work with your stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, the PHY is completely independent of any layers above it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-05-20T18:32:19.237" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18614" PostTypeId="1" AcceptedAnswerId="18618" CreationDate="2015-05-20T19:50:28.387" Score="1" ViewCount="1782" Body="&lt;p&gt;I read some explanations on the Internet on the topic and also BIND and DNS 4th Edition chapters 4.2 (Setting Up Zone Data) and 8.4 (Changing TTLs).&#xA;Still I have some doubts.&#xA;A brief refresh first of all. ;-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Refresh time&lt;/strong&gt; is the interval time between two queries done by the slave to check if the serial number of a zone on the primary DNS (or upstream server, correct me if I'm wrong) has changed or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TTL&lt;/strong&gt; is the time during which a slave DNS server caches an entry (A or AAAA normally) before refreshing its value retrieved from the master.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's use a practical example: the refresh value on the secondary is 7200 (3hours) and the TTL is 86400 (1day), regardless if they're in use or not in the real world. Let's say pippo.example.com resolves into 192.0.2.98.&#xA;Imagine the slave has just retrieved this entry and hence the entry's lifetime has few seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now pippo.example.com changes from 192.0.2.98 to 192.0.2.78 on the primary. On the primary we'll change the serial number too and when after three hours the slave queries the master it'll see a higher serial number and it'll retrieve the full zone and hence also the new IP address for pippo.example.com.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;QUESTION 1:&#xA;From my understanding the TTL is not respected. Am I right?&#xA;I mean why the slave would keep the old cached entry if that entry's got a new value on the primary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;QUESTION 2: if what I wrote above is true, why everybody uses the tecnique of lowering the TTL before replacing an IP address of a FQDN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess my first reasoning is not correct and it might be that I'm missing something obvious but that at the moment I can't answer by myself. Thanks in advance to anyone who clarifies and/or to points me to docs that explain that.&lt;/p&gt;&#xA;" OwnerUserId="15526" LastEditorUserId="33" LastEditDate="2015-05-26T18:08:50.847" LastActivityDate="2015-05-26T18:08:50.847" Title="DNS: retry and TTL values" Tags="|dns|" AnswerCount="1" CommentCount="4" ClosedDate="2015-05-22T21:06:35.113" ContentLicense="CC BY-SA 3.0" />
  <row Id="18615" PostTypeId="2" ParentId="18601" CreationDate="2015-05-20T20:32:30.917" Score="4" Body="&lt;p&gt;This (autonegotiation) is explained in various sections of the IEEE 802.3 specifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Auto-MDIX is mostly a function of gigabit interfaces being able to TX and RX on all four pairs. I don't recall this being part of 802.3, but the logic for it (looking for carrier signal, and/or link pulses) is simple enough that anything capable of gig will support it.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-20T20:32:30.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18618" PostTypeId="2" ParentId="18614" CreationDate="2015-05-20T20:47:02.287" Score="2" Body="&lt;p&gt;For some zone, a DNS server can have different responsibilities:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Master&lt;/em&gt;&lt;/strong&gt; (aka &lt;strong&gt;&lt;em&gt;primary&lt;/em&gt;&lt;/strong&gt;) server: authoritative server for the zone&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Slave&lt;/em&gt;&lt;/strong&gt; (aka &lt;strong&gt;&lt;em&gt;secondary&lt;/em&gt;&lt;/strong&gt;) server: authoritative server for the zone which gets its data from another authoritative source (a master) through a zone transfer  &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Caching&lt;/em&gt;&lt;/strong&gt; server (aka &lt;strong&gt;&lt;em&gt;resolver&lt;/em&gt;&lt;/strong&gt;): any DNS server which receives a query about the zone and gets records from an authoritative source for this zone, chaching the records for a faster response on future queries.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You seem to be confusing slaves and caching servers. Note that, unlike the masters and slaves, the caching servers are not operated by or on behalf of the owner of the zone, but can be any DNS server in the world that has obtained information about the zone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;refresh time&lt;/em&gt; tells a &lt;em&gt;slave&lt;/em&gt; when to check for new information from the master server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;TTL&lt;/em&gt; is meant for &lt;em&gt;caching servers&lt;/em&gt;, telling them for how long information can be cached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;QUESTION 1:&lt;/em&gt; Yes, a slave server will update its zone information through a zone transfer after refresh_time seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;QUESTION 2:&lt;/em&gt; Lowering the TTL before a DNS change prevents DNS servers around the world from caching the old IP address after it has been changed. Slave servers can be explicitly notified of a change, but sending a low TTL with responses is the only way to incluence the behavior of caching servers.  &lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-05-20T20:47:02.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18620" PostTypeId="1" AcceptedAnswerId="18621" CreationDate="2015-05-20T23:17:17.120" Score="1" ViewCount="87" Body="&lt;p&gt;im having troubles with raspbian (raspberry's debian) while trying to route two networks.&#xA;My network configuration is this (/etc/network/interfaces):   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto lo&#xA;iface lo inet loopback&#xA;&#xA;auto eth0&#xA;iface eth0 inet static&#xA;        address 192.168.81.3&#xA;        netmask 255.255.255.248&#xA;        network 192.168.81.0&#xA;        broadcast 192.168.81.7&#xA;        gateway 192.168.81.1&#xA;&#xA;iface eth1 inet static&#xA;        address 10.0.0.1&#xA;        netmask 255.255.255.0&#xA;        network 10.0.0.0&#xA;        broadcast 10.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is what route prints:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@raspberrypi:~# route&#xA;Kernel IP routing table&#xA;Destination     Gateway         Genmask         Flags Metric Ref    Use Iface&#xA;default         192.168.81.1    0.0.0.0         UG    0      0        0 eth0&#xA;10.0.0.0        *               255.255.255.0   U     0      0        0 eth1&#xA;192.168.81.0    *               255.255.255.248 U     0      0        0 eth0&#xA;&#xA;root@raspberrypi:~# route -C&#xA;Kernel IP routing cache&#xA;Source          Destination     Gateway         Flags Metric Ref    Use Iface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I execute &quot;cat /proc/sys/net/ipv4/ip_forward&quot; it returns 1, so I assume ipForwarding is running. But the problem is that it is not forwarding packets between network adapters..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping between devices on the same network, but when I try to contact with hosts on the other network it fails...&#xA;I don't know what im missing or why is my routing cache empty. Someone knows?&lt;/p&gt;&#xA;" OwnerUserId="5961" LastActivityDate="2015-05-21T00:34:19.360" Title="Routing/bridge issues" Tags="|router|linux|" AnswerCount="1" CommentCount="4" ClosedDate="2015-05-22T10:16:53.870" ContentLicense="CC BY-SA 3.0" />
  <row Id="18621" PostTypeId="2" ParentId="18620" CreationDate="2015-05-21T00:34:19.360" Score="2" Body="&lt;p&gt;Fixed!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was so much focused on raspbian, thinking that the issue should be there, and found that my internet (gateway) router on 192.168.81.1 wasnt redirecting 10.0.0.0 back to 192.168.81.3 (raspbian).&#xA;So, I manually added the route in 192.168.81.1 and fixed!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems that my raspberry was succesfully configured, and I was so blind looking at it that forgot to configure my main gateway (the one who exits to internet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im feeling so damn dumb now for that noob fail... T_T&lt;/p&gt;&#xA;" OwnerUserId="5961" LastActivityDate="2015-05-21T00:34:19.360" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18623" PostTypeId="1" AcceptedAnswerId="18625" CreationDate="2015-05-21T08:19:19.817" Score="1" ViewCount="188" Body="&lt;p&gt;I have this configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;r1 is RR of r2 and R5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;r3 is RR of r2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;r3 is connected with r4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;r4 is connected with r5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: what r2 and r1 know? For example i'm sure that r1 knows r2 and r5 but it knows also r3?&lt;/p&gt;&#xA;" OwnerUserId="15063" LastActivityDate="2015-05-21T09:06:12.707" Title="Ibgp routing table" Tags="|routing|bgp|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18625" PostTypeId="2" ParentId="18623" CreationDate="2015-05-21T09:06:12.707" Score="2" Body="&lt;p&gt;In your case, these are the iBGP routes known:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;R1 knows routes from R2 (Direct) and R5 (Direct)&lt;/li&gt;&#xA;&lt;li&gt;R2 knows routes of R1 (Direct), R3 (Direct), R4 (Reflected by R3) and R5 (Reflected by R1 and R3)&lt;/li&gt;&#xA;&lt;li&gt;R3 knows routes of R2 (Direct) and R4 (Direct)&lt;/li&gt;&#xA;&lt;li&gt;R4 knows routes of R3 (Direct) and R5 (Direct)&lt;/li&gt;&#xA;&lt;li&gt;R5 knows routes of R1 (Direct), R2 (Reflected by R1) and R4 (Direct)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The rules are as simple:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A BGP route will not readvertise iBGP learned routes to other iBGP&#xA;  neighbors, unless they are configured as a Route Reflector for that&#xA;  particular neigbor. So, to get full connectivity between iBGP neighbors, you&#xA;  need either a full mesh between all routers, or a full mesh between&#xA;  the Route Reflectors and all the other iBGP routers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;NB: For the reflection to happen, the RR does not have to be able to route to the destined networks. All calculations and validation of what goes into the routing table, will be done at each router individually.&lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2015-05-21T09:06:12.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18626" PostTypeId="1" CreationDate="2015-05-21T12:19:30.970" Score="2" ViewCount="940" Body="&lt;p&gt;I am in bad situation where I was allowed to build wireless network for my company, I did so using WLC-2504 with 7 APs registered, but I was not aware of the limitations of generating random username and password with in WLC, I worked alot for this with cisco and other but could not get(cisco has option to generate 1 username/password for guest single point of time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please help me get any additional component/license/tool where I can intergrate with my wireless setup and can generate ramdom username &amp;amp; password for our guest internet users. I came to know ISE can be used for that but still do not have much idea over it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks and regards&lt;/p&gt;&#xA;" OwnerUserId="15541" LastActivityDate="2018-10-11T19:08:13.957" Title="Cisco Wireless Guest user management" Tags="|wlc|cisco-ise|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18627" PostTypeId="1" AcceptedAnswerId="18628" CreationDate="2015-05-21T16:34:45.903" Score="4" ViewCount="1217" Body="&lt;p&gt;I am currently working on an assignment that asks me to either aggregate four given IP addresses &lt;em&gt;or state why they cannot be aggregated&lt;/em&gt;. I did calculate an IP address from which I believe that it summarizes the given four addresses, however, I am sure there's a catch. They wouldn't ask so shady if there wasn't. How can I find out whether I have a set of addresses that cannot be summarized? Could you provide a concrete example?&lt;/p&gt;&#xA;" OwnerDisplayName="user15544" LastEditorUserId="775" LastEditDate="2015-06-20T16:52:37.893" LastActivityDate="2015-06-20T16:52:37.893" Title="CIDR: When can IP addresses not be aggregated?" Tags="|routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18628" PostTypeId="2" ParentId="18627" CreationDate="2015-05-21T16:48:22.847" Score="3" Body="&lt;p&gt;If the aggregate network is not contiguously used then aggregating the subnets would hijack and blackhole some traffic. For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.1.0.0/24 - Site A&lt;br&gt;&#xA;10.1.1.0/24 - Site A&lt;br&gt;&#xA;10.1.2.0/24 - Site B&lt;br&gt;&#xA;10.1.3.0/24 - Site A  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aggregating 10.1.0.0/22 to Site A would steal the 10.1.2.0/24 traffic from Site B and route it to Site A. That's not to say you can't aggregate the traffic, but doing so would be unwise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also a large disparity in the subnets would make them unfeasible to aggregate, 172.16.1.0/24 and 192.168.1.0/24 for instance.&lt;/p&gt;&#xA;" OwnerUserId="1613" LastActivityDate="2015-05-21T16:48:22.847" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="18630" PostTypeId="2" ParentId="13134" CreationDate="2015-05-21T17:10:53.190" Score="2" Body="&lt;p&gt;Looking over the config you provided, it appears that your split tunnel ACL is only allowing connection to the 192.168.20.x adresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.20.0 255.255.255.0&#xA;access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.20.0 255.255.255.224&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your ACL should have an entry for every network to which your remote access is allowed to connect. For example, should you wish to have your RA users connect to your &quot;inside&quot; network, you would configure the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.0.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Correcting your split tunnel ACL and disabling &quot;use default gateway on remote network&quot; on the NIC should correct your issue.&lt;/p&gt;&#xA;" OwnerUserId="15546" LastActivityDate="2015-05-21T17:10:53.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18632" PostTypeId="1" CreationDate="2015-05-21T22:09:59.390" Score="0" ViewCount="402" Body="&lt;p&gt;The pass point protocol can it be implemented on the application layer of any  mobile device or does it require compatible wifi routers and access points as well.&lt;/p&gt;&#xA;" OwnerUserId="15548" LastActivityDate="2015-05-22T14:12:04.393" Title="Implementing pass point protocol" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="0" ClosedDate="2015-05-25T05:47:04.867" ContentLicense="CC BY-SA 3.0" />
  <row Id="18634" PostTypeId="1" CreationDate="2015-05-22T08:39:00.027" Score="5" ViewCount="484" Body="&lt;p&gt;What is the difference between Unicast RPF and Reverse Path Forwarding? They both verify the source address of each packet before forwarding it to the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is Reverse Path Forwarding used only when the network wants to build a shared tree of multicast communication and then we need to use Unicast RPF after the shared tree is created?&lt;/p&gt;&#xA;" OwnerUserId="7897" LastEditorUserId="220" LastEditDate="2015-05-22T16:40:29.877" LastActivityDate="2015-05-22T16:40:29.877" Title="What is the difference between Unicast RPF and Reverse Path Forwarding?" Tags="|routing|ipv4|multicast|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18635" PostTypeId="1" CreationDate="2015-05-22T08:39:18.890" Score="1" ViewCount="4374" Body="&lt;p&gt;I have been using GET and POST methods to communicate with my web server, but now I just need to send data only and receive, as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance I want to send &quot;abcd&quot; string only. &lt;/p&gt;&#xA;" OwnerUserId="15556" LastActivityDate="2015-06-06T03:22:59.740" Title="Is it possible to directly send data through TCP connection?" Tags="|tcp|" AnswerCount="3" CommentCount="2" ClosedDate="2015-06-08T13:48:05.753" ContentLicense="CC BY-SA 3.0" />
  <row Id="18636" PostTypeId="2" ParentId="18634" CreationDate="2015-05-22T08:59:52.993" Score="7" Body="&lt;p&gt;Both Reverse Path Forwarding and Unicast Reverse path Forwarding do basically the same thing: Verify that the data is coming from the same direction you would expect it to come from. Their function is slightly different though:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;'Normal' RPF will check the source of &lt;strong&gt;multicast&lt;/strong&gt; traffic, to avoid network loops.&lt;/li&gt;&#xA;&lt;li&gt;uRPF will check the source of &lt;strong&gt;unicast&lt;/strong&gt; traffic, to mitigate IP spoofing.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="220" LastActivityDate="2015-05-22T08:59:52.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18637" PostTypeId="2" ParentId="18635" CreationDate="2015-05-22T10:05:19.933" Score="2" Body="&lt;p&gt;In answer to the question &lt;code&gt;Is it possible to directly send data through TCP connection?&lt;/code&gt; - The answer is Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to expand and that and enquire as to how to do that, you could write a program yourself or use a packet crafter like &lt;a href=&quot;http://www.secdev.org/projects/scapy/&quot; rel=&quot;nofollow&quot;&gt;Scapy&lt;/a&gt; or &lt;a href=&quot;https://code.google.com/p/ostinato/&quot; rel=&quot;nofollow&quot;&gt;Ostianto&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously though, if you are going to step out of the usual behaviour of the 7 layer OSI model know that the communications you desire might not strictly work depending on how the network stack on the operating systems behaves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are considering with a web server on TCP port 80 without using the proceedures defined within the HTTP protocol your results might not be what you expect. Keep in mind that a standard web server will be expecting communication that is adhearing to the rules of HTTP conversations.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2015-05-22T10:55:02.693" LastActivityDate="2015-05-22T10:55:02.693" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18638" PostTypeId="1" AcceptedAnswerId="18640" CreationDate="2015-05-22T10:10:43.827" Score="1" ViewCount="3029" Body="&lt;p&gt;I have the following situation.&#xA;There is a ethernet network on the 10th, we want to expand it to the 5th.&#xA;We hired somebody, they setup the patchbox and the cables in the 5th to each office. They wouldn't mess with the fiber optics stuff because they didn't have experience and the fiber optics cable is more fragile. So we found an electrician who would; he purchased the cable, with 8 LC connectors on each end, and instaled it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I contacted an IT shop, to get a matching switch for those connectors but he called me back, telling me that LC connectors are out-dated technology and that acquiring switches and/or fiber media converters would be nigh impossible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, what would be the best solution?&#xA;- hunt down a switch with LC connectors?&#xA;- search for LC media converters, from LC to SC or whatever?&#xA;- tell the company made the cable that they chose the &quot;wrong&quot; connectors and ask them to cut the LC connectors and replace them with the &quot;right&quot; ones?&#xA;- do I really need to use all of the 8 connectors? The man from the IT shop said that I would need 8 of those media converters and they would take up 8 slots from a 24-port switch, is that true?&#xA;- is there another, better option that I haven't thought of?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I may be using this site wrong and ask too many questions at once, but I really need a competent answer and it doesn't seem I will be getting it from local vendors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: here are some pictures of the connectors i.imgur.com/EuQ2IDf.jpg i.imgur.com/6vAxeJC.jpg also the &quot;Test Sheet&quot; I received says the cable is 50/125 which apparently means its a 50micron cable.&lt;/p&gt;&#xA;" OwnerUserId="15557" LastEditorUserId="15557" LastEditDate="2015-05-24T11:20:40.110" LastActivityDate="2015-05-24T11:20:40.110" Title="How to connect two networks via fiber optics (LC Connectors)" Tags="|fiber|optics|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18640" PostTypeId="2" ParentId="18638" CreationDate="2015-05-22T10:54:21.590" Score="5" Body="&lt;p&gt;Go find another &quot;IT Shop.&quot;  LC connectors are arguably the most common fiber connector in use today.  It's not clear from your question where you've run these fibers, but one fiber run (really a pair of fibers with an LC on each end) is all you need to connect two floors.  You can either use media converters on each end to plug into simple Ethernet switches, or get switches that have LC port on them (more expensive). &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-22T10:54:21.590" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18644" PostTypeId="2" ParentId="18632" CreationDate="2015-05-22T14:12:04.393" Score="1" Body="&lt;p&gt;It requires devices (access points and mobile devices) which support IEEE 802.11u/Hotspot 2.0. Wi-Fi.org provides a &lt;a href=&quot;http://www.wi-fi.org/product-finder-results?capabilities=1&amp;amp;items=30&quot; rel=&quot;nofollow&quot;&gt;product finder&lt;/a&gt; which provides a list of certified products. Though not on the certified product list a quick Google reveals Apple iOS 7 supports Hotspot 2.0 as well.&lt;/p&gt;&#xA;" OwnerUserId="1613" LastActivityDate="2015-05-22T14:12:04.393" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18648" PostTypeId="2" ParentId="18638" CreationDate="2015-05-22T19:02:14.700" Score="0" Body="&lt;p&gt;You can get SC-LC adapters quite easily and in-expensively, search for 'sc-lc adapter duplex', Corning makes very good products. Then use a short LC-LC jumper to connect to your current-model switch optics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or even this jumper from Amazon: &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B002DG18MI&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/Fiber-Adapter-Female-Multimode-Duplex/dp/B002DG18MI&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jason.&lt;/p&gt;&#xA;" OwnerUserId="10660" LastActivityDate="2015-05-22T19:02:14.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18650" PostTypeId="1" CreationDate="2015-05-22T21:16:45.173" Score="2" ViewCount="144" Body="&lt;p&gt;I currently have a single network 192.168.1.0/24 and I am running out of IP addresses. I have a ASA 5505 connecting us to the outside world. I would like to be able to add a subnet say 192.168.20.0/24 on the same switches throughout the plant by just having a windows or linux based router with and IP on both networks. I have tried doing this with very limited success. I have a windows machine with two ips. One on 192.168.1.0/24 and one on 192.168.20.0/24 put a route to 192.168.20.0/24 on that machine. Then use that machine's 192.168.20.0/24 ip as the default gateway for the other 192.168.20.0/24 machines. I then have added a route on the asa for 192.168.20.0/24 network back to the windows machine for the inside interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping both sides of the windows machine from the 192.168.20.0/24 clients but no other machines on the 192.168.1.0/24 network. I can ping both networks from the asa. I have network access from the 192.168.1.0/24 network but not from the 192.168.20.0/24 network. I cannot ping the 192.168.20.0/24 network from any machines on the 192.168.1.0/24 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any recommendations would be helpful.&lt;/p&gt;&#xA;" OwnerUserId="15567" LastEditorUserId="775" LastEditDate="2015-06-20T16:49:52.940" LastActivityDate="2015-06-20T16:49:52.940" Title="How to add IP address space to internal network" Tags="|cisco|routing|cisco-asa|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18651" PostTypeId="2" ParentId="18638" CreationDate="2015-05-22T21:23:10.297" Score="2" Body="&lt;p&gt;For me, I find this an non-issue. IMHO, if it is infrastructure cabling it should terminate into a fiber tray. So ideally, I would acquire a fiber tray for each end of the connection with SC couplers (based on OP's comments, the connectors are SC not LC).  The infrastructure cabling would plug into the back side of the couplers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, simply get the appropriate SC-to-[SC|LC] fiber patch cables to connect from the fiber tray to your equipment. In the future, if the type of connector required by your equipment changes, you just also then need to replace the fiber patch cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Naturally though, I would check the statement of work and/or quote provided to/by your contractor. If a certain type of connector other than SC was specified, then I would make them resolve the issue (I would still use a fiber tray even if this is the case). However based on your post, I assume no one specified the type of connector at any point. If you did, I would also check to see if installation in a fiber tray was also specified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would be more concerned with the type of fiber installed though.  Is it singlemode or multimode? If multimode, is it 62.5micron or 50micron. This will impact the type of transceivers you will be able to use. For instance, if you wanted 10G and it is MM/62.5, then you may not be able to use 10GBase-SR as the distance limitation is only 33 meters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for needing all 8 strands, odds are you will not.  Most Ethernet over fiber will use two strands of fiber. Typically infrastructure fiber cable will contain multiple strands of fiber (6, 8, 12, 24, etc). That doesn't mean you need to use all of them, but you are welcome to do so if you like (multiple links, connecting multiple sets of devices, etc).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-05-22T21:23:10.297" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18653" PostTypeId="2" ParentId="18650" CreationDate="2015-05-22T22:15:18.123" Score="2" Body="&lt;p&gt;Just because you have two interfaces on a server in different subnets doesn't mean that the server will route packets between the two.  Think of what a huge security hole it would be if that's how it worked!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you have an ASA and what sounds like managed switches, I'd highly recommend segmenting the network into two VLANs, doing a 802.1q trunk to the ASA, and having the ASA route between the two subnets on the two VLANs.  You'd just have all your PCs point to the ASA interface on its local VLAN as its default (all addresses) gateway.&lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2015-05-22T22:15:18.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18654" PostTypeId="2" ParentId="18650" CreationDate="2015-05-23T04:11:55.513" Score="0" Body="&lt;p&gt;Implement Ethernet subinterfaces on the ASA, an 802.1q trunk to the LAN.  Both subnets can exist on a single VLAN or your can deploy 2 VLANs on the LAN.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-23T04:11:55.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18658" PostTypeId="1" AcceptedAnswerId="18663" CreationDate="2015-05-23T07:31:34.283" Score="0" ViewCount="3434" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/17s29.png&quot; alt=&quot;1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zwYt9.png&quot; alt=&quot;2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip: 10.5.2.1&#xA;&lt;br&gt;&#xA;subnetmask: 255.255.255.240&#xA;&lt;br&gt;&#xA;{10.5.2.1/28}&#xA;&lt;br&gt;&#xA;what is correct maximum subnetworks ???? &lt;br&gt;&#xA;What are the differences between classful and CIDR subnetting????&lt;/p&gt;&#xA;" OwnerUserId="15570" LastEditorUserId="15570" LastEditDate="2015-05-24T13:42:20.980" LastActivityDate="2015-05-24T13:42:20.980" Title="What are the differences between classful and classless subnetting?" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ClosedDate="2015-05-25T14:46:18.290" ContentLicense="CC BY-SA 3.0" />
  <row Id="18663" PostTypeId="2" ParentId="18658" CreationDate="2015-05-23T14:50:37.180" Score="1" Body="&lt;p&gt;The difference in how the two calculate the number of networks is that the classful calculation is based on the classful network. Based on the network range it falls in, the base network that is subnetted is 10.0.0.0/8, allowing for 1,048,576 /28 networks within it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on CIDR, where classes don't exist, generally a tool like this will base it's calculations on a /24 giving 10.5.2.0/24 16 available networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to which is correct, both depending on the context, but classful networking hasn't been widely used in networking for nearly two decades.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-05-23T14:50:37.180" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="18664" PostTypeId="1" CreationDate="2015-05-23T16:08:05.427" Score="1" ViewCount="890" Body="&lt;p&gt;I keep hearing that a network should be managed. What's an unmanaged network and what makes it risky?&lt;/p&gt;&#xA;" OwnerUserId="15575" LastActivityDate="2015-05-27T00:51:10.590" Title="What are the issues with having an unmanaged network?" Tags="|management|lan|" AnswerCount="5" CommentCount="1" ClosedDate="2015-05-27T02:55:10.953" ContentLicense="CC BY-SA 3.0" />
  <row Id="18665" PostTypeId="2" ParentId="18664" CreationDate="2015-05-23T16:41:22.823" Score="1" Body="&lt;p&gt;I am answering under the presumption that you are asking about the equipment and not a managed service (i.e. you are paying someone else to manage the network for you).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many reasons why managed network equipment is much better than unmanaged equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This borders on being a question that is too broad, but in summary with unmanaged equipment you have no visibility or control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a couple of basic questions you can answer on a managed network equipment that cannot be answered with unmanaged equipment. Knowing the answers to these questions can allow you to address problems within the network.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can you tell which network links are over (or under) utilized on your network? Can you collect this information over time for trending analysis?&lt;/li&gt;&#xA;&lt;li&gt;Can you tell which interfaces are incrementing errors? What type of errors?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Access to logs and statistics can help you isolate a wide range of problems that you might otherwise be unaware of or faster in cases where you are aware of them.  An example would be a switching loop. With managed network equipment, you can more quickly and easily identify which ports are involved based on the statistics. On unmanaged equipment, this is a process of trial and error while manually disconnecting cables, potentially creating further unnecessary disruptions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for control, managed network equipment typically give you many additional features to control your network. From the use of VLANs to features like port security and DHCP snooping, you can make your network more secure and resilient to potential problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also control the performance of the network with features such as QoS, policing and/or shaping. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could keep citing examples, but hopefully this should be enough to illustrate the differenes.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-05-23T16:41:22.823" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18666" PostTypeId="2" ParentId="18664" CreationDate="2015-05-23T16:47:09.060" Score="-6" Body="&lt;p&gt;The term managed switch is entirely meaningless to a network professional yet conveys a type of value to an end user.  Basically, it is a marketing term.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-23T16:47:09.060" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18667" PostTypeId="2" ParentId="18612" CreationDate="2015-05-23T18:08:16.033" Score="0" Body="&lt;p&gt;The 802 Committe in the IEEE is not referring to switches, or bridges, or routers.  They are talking bits, not frames or packets.  Think hub or repeater.  Frames are not relevant at this physical layer.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-23T18:08:16.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18668" PostTypeId="2" ParentId="18664" CreationDate="2015-05-23T19:15:39.340" Score="3" Body="&lt;p&gt;An unmanaged network is analogous to a car that has no gauges and you never have it serviced -- until it stops working.  You don't know if it's going too fast, too slow, is about to run out of gas, etc.  The fan belts could be frayed, your tires could be bald, or your brakes could be worn, but you wouldn't know until something bad happens.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-23T19:15:39.340" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18676" PostTypeId="1" CreationDate="2015-05-24T10:41:50.993" Score="1" ViewCount="355" Body="&lt;p&gt;I know that a routing metric can take into account several statistics, for example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;measuring link utilisation (using SNMP)&lt;/li&gt;&#xA;&lt;li&gt;number of hops (hop count)&lt;/li&gt;&#xA;&lt;li&gt;speed of the path&lt;/li&gt;&#xA;&lt;li&gt;packet loss (router congestion/conditions)&lt;/li&gt;&#xA;&lt;li&gt;latency (delay)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How are these metrics actually assembled? What metrics are actually widely used in routing nowadays?&lt;/p&gt;&#xA;" OwnerUserId="15586" LastActivityDate="2015-05-25T03:03:54.597" Title="How do routing metrics work?" Tags="|routing|" AnswerCount="3" CommentCount="0" ClosedDate="2015-05-27T02:55:32.203" ContentLicense="CC BY-SA 3.0" />
  <row Id="18678" PostTypeId="5" CreationDate="2015-05-24T13:52:02.573" Score="0" Body="&lt;p&gt;Internet Protocol (IP) is an OSI layer-3 network protocol which encapsulates, addresses, and delivers datagrams from higher layer protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two current IP versions in use: IPv4 and IPv6.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-10T23:04:44.150" LastActivityDate="2015-11-10T23:04:44.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18679" PostTypeId="4" CreationDate="2015-05-24T13:52:02.573" Score="0" Body="For questions about Internet Protocol (IP), an OSI layer-3 network protocol. There are two current IP versions in use: IPv4 and IPv6." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-10T23:04:47.370" LastActivityDate="2015-11-10T23:04:47.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18682" PostTypeId="2" ParentId="18676" CreationDate="2015-05-24T15:39:12.440" Score="4" Body="&lt;p&gt;Let's take some common routing protocols in use today:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP -- uses a combination of bandwidth and total delay (also by default a function of bandwidth).  EIGRP can optionally use other criteria, such as load, reliability and MTU size, but in 99.9% of networks, these are not used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF -- uses a single metric. In the Cisco world, it is bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP -- Everything else being equal, BGP uses hop count, but for BGP a &quot;hop&quot; is an entire autonomous system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since IS-IS seems to be making a comeback, I'll include it as well.  IS-IS uses an static administrative metric.  In other words, the metric is whatever you set it to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link utilization and other &quot;transient&quot; values cause more problems than they solve.  And in modern networks, it just isn't important enough to bother with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that these are the default values.  You as the network administrator can change them to suit your needs.  BGP in particular is designed to allow more administrative control over the path selection.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-24T15:39:12.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18683" PostTypeId="2" ParentId="18676" CreationDate="2015-05-24T15:49:16.003" Score="-7" Body="&lt;p&gt;The metrics are only part of the routing process.  The longest prefix match always wins among the routes actually installed in the routing table, while the routing protocol with the lowest administrative distance always wins when installing routes into the routing table.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-24T15:49:16.003" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18684" PostTypeId="1" AcceptedAnswerId="33722" CreationDate="2015-05-24T21:54:15.793" Score="10" ViewCount="1055" Body="&lt;p&gt;I am trying to push out IPv6 unnumbered to an interface via radius. I am trying to do it in a similar fashion to how you would for IPv4:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco-AVPair += &quot;ip:vrf-id=vrf-name&quot;,&#xA;Cisco-AVPair += &quot;ip:ip-unnumbered=Loopback301&quot;,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to assign a user into a VRF and of course that part is easy, but when you put a VRF on an interface it gets rid of any IP addressing, hence the need for the unnumbered interface commands. I can push the IPv6 configuration easily with the &lt;code&gt;lcp:interface-config&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco-AVPair += &quot;lcp:interface-config#1=ipv6 unnumbered loopback301&quot;,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But that has the adverse side effect of needing to support sub-interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%FMANRP_ESS-4-FULLVAI: Session creation failed due to Full Virtual-Access Interfaces not being supported. Check that all applied Virtual-Template and RADIUS features support Virtual-Access sub-interfaces. swidb= 0x7FF07FD32098, ifnum= 91&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would rather avoid enabling this functionality for the sake of the scalability drop that occurs on the BRAS. (I do know how, if it does come to that! :))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering if anyone knows a way of pushing out the above IPv4 unnumbered command for IPv6 so I can keep using full virtual access interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I do know that for IPv6, I don't technically need an address on the BRAS side of things, or CPE for that matter, as it works over the link-local. In this case, I do need an address as DHCPv6 seems to only work when one is configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: This is on a Cisco ASR platform running XE.&lt;/p&gt;&#xA;" OwnerUserId="11927" LastEditorUserId="8499" LastEditDate="2016-03-29T01:46:40.690" LastActivityDate="2017-05-31T04:15:23.217" Title="Cisco IPv6 BNG Radius Attributes" Tags="|cisco|ipv6|pppoe|radius|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18685" PostTypeId="1" AcceptedAnswerId="18692" CreationDate="2015-05-25T01:26:48.863" Score="2" ViewCount="2556" Body="&lt;p&gt;Okay this one has had me stumped for days on end, I've looked around the internet, I can hardly find coherent information pertaining to my problem and/or links to irrelevant information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a very small network for demonstrative purposes - `2 routers - 2 switches (2 VLANS on each connected to a PC each).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can get one VLAN connected to the second router on the alternate network but the other has problems even pinging to its default gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the switch I have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;VLAN20: IP Address - 192.168.1.65/30&#xA;VLAN30: IP Address - 192.168.1.29/30&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each VLAN is connected to a PC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I shall assume you can assume the PC IP scheme as it is very basic knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The commands entered on the switch are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;the link going to the router is using a trunk port allowing vlans of 1-100&lt;/code&gt;&#xA;&lt;code&gt;FastEthernet 0/2 is using switchport access VLAN 20&lt;/code&gt;&#xA;&lt;code&gt;FastEthernet 0/3 is using switchport access VLAN 30&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 0/2 connects to the main router as well as connects to the second router &lt;code&gt;using OSPF&lt;/code&gt; but the 0/3 does not connect even though the IP scheme is correct, default gateway is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have searched through many commands on the switch but none seem to work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;**The switch CAN ping to the PC but the PC cannot ping out not even to the switch**&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I am using a layer 2 switch so &lt;code&gt;ip routing&lt;/code&gt; will not work. &lt;/p&gt;&#xA;" OwnerUserId="15592" LastEditorUserId="15592" LastEditDate="2015-05-25T01:34:58.253" LastActivityDate="2015-05-25T07:02:26.370" Title="VLANs not connecting properly to switch/router" Tags="|routing|vlan|cisco-commands|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18686" PostTypeId="1" AcceptedAnswerId="18748" CreationDate="2015-05-25T01:27:02.730" Score="3" ViewCount="1606" Body="&lt;p&gt;&lt;strong&gt;Can one set a link's cost to zero in OSPF?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This could be desirable to force load-balancing in certain cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, suppose there are four routers &lt;strong&gt;A&lt;/strong&gt;, &lt;strong&gt;B&lt;/strong&gt;, &lt;strong&gt;C&lt;/strong&gt;, and &lt;strong&gt;D&lt;/strong&gt;, and two hosts &lt;strong&gt;X&lt;/strong&gt; and &lt;strong&gt;Y&lt;/strong&gt;, with the following connections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    /----A-----10Mbps-----C----\&#xA;   /     |                |     \&#xA;X-1Gbps 1Gbps           1Gbps  1Gbps--Y&#xA;   \     |                |     /&#xA;    \----B-----10Mbps-----D----/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;X&lt;/strong&gt; and &lt;strong&gt;Y&lt;/strong&gt; are workstations, so they are only configured with static routing. Say &lt;strong&gt;A&lt;/strong&gt; is &lt;strong&gt;X&lt;/strong&gt;'s default gateway and &lt;strong&gt;C&lt;/strong&gt; is &lt;strong&gt;Y&lt;/strong&gt;'s default gateway. Between the four routers, OSPF is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now &lt;strong&gt;X&lt;/strong&gt; initiates two flows to &lt;strong&gt;Y&lt;/strong&gt;, each of which needs 9Mbps. With OSPF, we get the &lt;strong&gt;A-C&lt;/strong&gt; link selected as the best path and the &lt;strong&gt;B-C&lt;/strong&gt; link goes unused. I would like to administratively set the &lt;strong&gt;A-B&lt;/strong&gt; and &lt;strong&gt;C-D&lt;/strong&gt; links as zero cost so that OSPF will load-balance across the two lower-speed 10Mbps links.&lt;/p&gt;&#xA;" OwnerUserId="13935" LastEditorUserId="13935" LastEditDate="2015-05-25T12:21:12.413" LastActivityDate="2015-05-27T12:13:49.777" Title="How to set a zero cost link in OSPF" Tags="|ospf|load-balancing|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18688" PostTypeId="2" ParentId="18676" CreationDate="2015-05-25T03:03:54.597" Score="-1" Body="&lt;p&gt;wrote an article explaining routing protocols and selection&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.slideshare.net/shaun_hummel/routing-protocols-31653494&quot; rel=&quot;nofollow&quot;&gt;http://www.slideshare.net/shaun_hummel/routing-protocols-31653494&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15593" LastActivityDate="2015-05-25T03:03:54.597" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18690" PostTypeId="2" ParentId="18664" CreationDate="2015-05-25T03:13:15.473" Score="1" Body="&lt;p&gt;it would be useful for you to go through the Cisco Prime Infrastructure data sheet for instance. It discusses the 5 management groups (FCAPS) to understand what a typical management platform does. there are aspects if troubleshooting, capacity planning, dynamic performance management, security management, configuration  etc.&lt;/p&gt;&#xA;" OwnerUserId="15593" LastActivityDate="2015-05-25T03:13:15.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18691" PostTypeId="1" AcceptedAnswerId="18872" CreationDate="2015-05-25T05:50:12.590" Score="3" ViewCount="1400" Body="&lt;p&gt;When a company is setting up a PBX and wants to use a SIP trunk, why does it have to buy it? Is there no way to provide itself with one on its own?&lt;/p&gt;&#xA;" OwnerUserId="15594" LastEditorUserId="775" LastEditDate="2015-06-20T16:51:39.330" LastActivityDate="2015-06-20T16:51:39.330" Title="What is the exact engineering involved behind creating a SIP trunk for any customer?" Tags="|voip|sip|voice|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18692" PostTypeId="2" ParentId="18685" CreationDate="2015-05-25T07:02:26.370" Score="1" Body="&lt;p&gt;You need to make use of sub-interfaces on the router commonly known as router on a stick. This means that one connection to the router will have multiple IP addresses representing the IP addresses in these subnets. The switch will not be doing any routing,it will instead send the packets to the router which will then find the route and send data back to the switch in an encapsulated manner that will then send to the other VLAN. This is also called InterVLAN routing.&lt;br&gt;&lt;br&gt;Very good tutorials by &lt;a href=&quot;https://www.youtube.com/user/danscourses&quot; rel=&quot;nofollow&quot;&gt;danscourses&lt;/a&gt; found them useful through out my CCNA training.&lt;br&gt;&lt;br&gt;&#xA;Also take note the link between router and switch is a trunk,take a look at this manual from &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/14976-50.html&quot; rel=&quot;nofollow&quot;&gt;CISCO&lt;/a&gt;.&lt;br&gt;Let me know if this was useful&lt;/p&gt;&#xA;" OwnerUserId="15536" LastActivityDate="2015-05-25T07:02:26.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18693" PostTypeId="2" ParentId="18686" CreationDate="2015-05-25T07:12:21.950" Score="3" Body="&lt;p&gt;The formula for calculating an OSPF cost is &lt;b&gt;(10^8) / Bandwidth&lt;/b&gt; ,especially on CISCO routers. So there is no way of dividing by zero you get infinity.&lt;br&gt;However you can manually set a cost on a particular interface by entering a cost between 1 - 65535:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Router(config-if)#ip ospf cost ?&lt;br&gt;&#xA;  &amp;lt;1-65535&gt;  Cost&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;Let me know if this was useful&#xA;&lt;br&gt;&lt;b&gt;EDIT&lt;/b&gt;&#xA;If I'm not wrong since the route supplied by a router with a higher router-id is chosen, you can make use of the priority command and make them the same on each link to force equal load balancing:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Router(config)#int fa0/0 &lt;br&gt;&#xA;  Router(config-if)#ip ospf pr&lt;br&gt;&#xA;  Router(config-if)#ip ospf priority ? &lt;br&gt;&#xA;    &amp;lt;0-255&gt;  Priority&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15536" LastEditorUserId="15536" LastEditDate="2015-05-25T15:32:41.677" LastActivityDate="2015-05-25T15:32:41.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18694" PostTypeId="1" AcceptedAnswerId="18697" CreationDate="2015-05-25T08:37:54.493" Score="1" ViewCount="151" Body="&lt;p&gt;I am not a Network administrator, but i am having a IP Conflict in one of the system that uses Static IP (A Application Server), other systems are given Dynamic IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to know which PC is causing IP Conflict so that i could just switch it off till the Network administrator comes and remove the error, and I could continue my development work.&lt;/p&gt;&#xA;" OwnerUserId="15595" LastActivityDate="2015-05-25T09:37:08.913" Title="IP Conflict in the Network" Tags="|ipv4|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18695" PostTypeId="1" CreationDate="2015-05-25T08:57:23.257" Score="-1" ViewCount="221" Body="&lt;p&gt;I am having a problem with my network. I have a router (R1) connected to another router (R2) R1 is connected to a switch. R1 switch has two PC's connected to it. the PC IP's are 128.107.35.10 and 192.31.7.10. The default gateway is 198.133.220.1. when i ping from the R1 PC's i get request timed out. when i ping from R2 PC's i get destination host unreachable. I have OSPF and RIP v2 on both routers.&#xA;Does anyone know why this is happening?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Show ip route R1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks&#xA;&#xA;R       10.0.0.0/8 [120/1] via 198.133.219.1, 00:00:09, Serial0/0/0&#xA;&#xA;O       10.255.1.0/30 [110/192] via 198.133.219.1, 00:19:49, Serial0/0/0&#xA;&#xA;O       10.255.1.4/30 [110/128] via 198.133.219.1, 00:19:49, Serial0/0/0&#xA;&#xA;     192.168.20.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;R       192.168.20.0/24 [120/1] via 198.133.219.1, 00:00:09, Serial0/0/0&#xA;&#xA;O       192.168.20.0/30 [110/128] via 198.133.219.1, 00:19:49, Serial0/0/0&#xA;&#xA;     192.168.21.0/30 is subnetted, 1 subnets&#xA;O       192.168.21.0 [110/256] via 198.133.219.1, 00:19:49, Serial0/0/0&#xA;&#xA;     198.133.219.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C       198.133.219.0/30 is directly connected, Serial0/0/0&#xA;&#xA;C       198.133.219.1/32 is directly connected, Serial0/0/0&#xA;&#xA;     198.133.220.0/27 is subnetted, 1 subnets&#xA;C       198.133.220.0 is directly connected, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Show IP route for R2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     10.0.0.0/8 is variably subnetted, 5 subnets, 4 masks&#xA;&#xA;C       10.10.10.64/27 is directly connected, FastEthernet0/1&#xA;&#xA;R       10.10.10.96/28 [120/1] via 10.255.1.2, 00:00:20, Serial0/1/0&#xA;&#xA;C       10.255.1.0/30 is directly connected, Serial0/1/0&#xA;&#xA;C       10.255.1.4/30 is directly connected, Serial0/0/0&#xA;&#xA;C       10.255.1.5/32 is directly connected, Serial0/0/0&#xA;     192.168.20.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;R       192.168.20.0/24 [120/1] via 10.255.1.5, 00:00:28, Serial0/0/0&#xA;&#xA;O       192.168.20.0/30 [110/128] via 10.255.1.5, 00:28:51, Serial0/0/0&#xA;     192.168.21.0/30 is subnetted, 1 subnets&#xA;O       192.168.21.0 [110/128] via 10.255.1.2, 00:28:51, Serial0/1/0&#xA;&#xA;     198.133.219.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;R       198.133.219.0/24 [120/1] via 10.255.1.5, 00:00:28, Serial0/0/0&#xA;&#xA;O       198.133.219.0/30 [110/128] via 10.255.1.5, 00:24:26, Serial0/0/0&#xA;&#xA;     198.133.220.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;R       198.133.220.0/24 [120/2] via 10.255.1.5, 00:00:28, Serial0/0/0&#xA;&#xA;O IA    198.133.220.0/27 [110/129] via 10.255.1.5, 00:24:16, Serial0/0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Start up config for R1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 12.4&#xA;&#xA;no service timestamps log datetime msec&#xA;&#xA;no service timestamps debug datetime msec&#xA;&#xA;no service password-encryption&#xA;!&#xA;&#xA;hostname internet&#xA;&#xA;!&#xA;!&#xA;!&#xA;enable secret 5 REMOVED&#xA;&#xA;enable password REMOVED&#xA;&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip cef&#xA;&#xA;no ipv6 cef&#xA;&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain-lookup&#xA;&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA;&#xA; no ip address&#xA;&#xA; duplex auto&#xA;&#xA; speed auto&#xA;&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1&#xA;&#xA; ip address 198.133.220.1 255.255.255.224&#xA;&#xA; duplex auto&#xA;&#xA; speed auto&#xA;&#xA;!&#xA;interface Serial0/0/0&#xA;&#xA; ip address 198.133.219.2 255.255.255.252&#xA;&#xA; encapsulation ppp&#xA;&#xA;!&#xA;interface Serial0/0/1&#xA;&#xA; no ip address&#xA;&#xA; clock rate 2000000&#xA;&#xA; shutdown&#xA;&#xA;!&#xA;interface Serial0/1/0&#xA;&#xA; no ip address&#xA;&#xA; clock rate 2000000&#xA;&#xA; shutdown&#xA;&#xA;!&#xA;&#xA;interface Serial0/1/1&#xA;&#xA; no ip address&#xA;&#xA; clock rate 2000000&#xA;&#xA; shutdown&#xA;&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 1&#xA;&#xA; log-adjacency-changes&#xA;&#xA; network 198.133.219.0 0.0.0.3 area 0&#xA;&#xA; network 10.255.1.4 0.0.0.3 area 0&#xA;&#xA; network 10.255.1.0 0.0.0.3 area 0&#xA;&#xA; network 192.168.20.0 0.0.0.3 area 0&#xA;&#xA; network 192.168.21.0 0.0.0.3 area 0&#xA;&#xA; network 10.10.10.0 0.0.0.3 area 0&#xA;&#xA; network 10.255.0.0 0.0.0.3 area 0&#xA;&#xA; network 10.10.10.64 0.0.0.15 area 51&#xA;&#xA; network 10.10.10.96 0.0.0.15 area 51&#xA;&#xA; network 10.10.10.0 0.0.0.15 area 51&#xA;&#xA; network 198.133.220.0 0.0.0.15 area 51&#xA;&#xA;!&#xA;router rip&#xA;&#xA; version 2&#xA;&#xA; network 10.0.0.0&#xA;&#xA; network 192.168.20.0&#xA;&#xA; network 192.168.21.0&#xA;&#xA; network 198.133.219.0&#xA;&#xA; network 198.133.220.0&#xA;&#xA;!&#xA;ip classless&#xA;&#xA;!&#xA;ip flow-export version 9&#xA;&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Start up config for R2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 12.4&#xA;&#xA;no service timestamps log datetime msec&#xA;&#xA;no service timestamps debug datetime msec&#xA;&#xA;service password-encryption&#xA;!&#xA;hostname south&#xA;!&#xA;!&#xA;!&#xA;enable secret 5 REMOVED&#xA;&#xA;enable password 7 REMOVED&#xA;&#xA;!&#xA;!&#xA;ip dhcp excluded-address 10.10.10.65&#xA;&#xA;!&#xA;ip dhcp pool South&#xA;&#xA; network 10.10.10.64 255.255.255.224&#xA;&#xA; default-router 10.10.10.65&#xA;&#xA;ip dhcp pool LAN&#xA;&#xA; network 10.10.10.64 255.255.255.224&#xA;&#xA; default-router 10.10.10.65&#xA;&#xA;!&#xA;&#xA;!&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain-lookup&#xA;&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA;&#xA; no ip address&#xA;&#xA; duplex auto&#xA;&#xA; speed auto&#xA;&#xA; shutdown&#xA;&#xA;!&#xA;interface FastEthernet0/1&#xA;&#xA; ip address 10.10.10.65 255.255.255.224&#xA;&#xA; duplex auto&#xA;&#xA; speed auto&#xA;&#xA;!&#xA;interface Serial0/0/0&#xA;&#xA; ip address 10.255.1.6 255.255.255.252&#xA;&#xA; encapsulation ppp&#xA;&#xA; clock rate 128000&#xA;&#xA;!&#xA;interface Serial0/0/1&#xA;&#xA; no ip address&#xA;&#xA; clock rate 2000000&#xA;&#xA; shutdown&#xA;&#xA;!&#xA;interface Serial0/1/0&#xA;&#xA; ip address 10.255.1.1 255.255.255.252&#xA;&#xA; clock rate 128000&#xA;&#xA;!&#xA;interface Serial0/1/1&#xA;&#xA; no ip address&#xA;&#xA; clock rate 2000000&#xA;&#xA;!&#xA;interface Vlan1&#xA;&#xA; no ip address&#xA;&#xA; shutdown&#xA;&#xA;!&#xA;router ospf 1&#xA;&#xA; log-adjacency-changes&#xA;&#xA; network 10.255.1.0 0.0.0.3 area 0&#xA;&#xA; network 198.133.219.0 0.0.0.3 area 0&#xA;&#xA; network 192.168.20.0 0.0.0.3 area 0&#xA;&#xA; network 10.255.1.4 0.0.0.3 area 0&#xA;&#xA; network 10.255.0.0 0.0.0.3 area 0&#xA;&#xA; network 10.10.10.0 0.0.0.15 area 51&#xA;&#xA; network 198.133.220.0 0.0.0.15 area 51&#xA;&#xA;!&#xA;router rip&#xA;&#xA; version 2&#xA;&#xA; network 10.0.0.0&#xA;&#xA; network 192.168.20.0&#xA;&#xA; network 198.133.219.0&#xA;&#xA; network 198.133.220.0&#xA;&#xA;!&#xA;ip classless&#xA;&#xA;!&#xA;ip flow-export version 9&#xA;&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15583" LastEditorUserId="3191" LastEditDate="2015-05-25T14:47:23.317" LastActivityDate="2015-06-27T07:16:07.323" Title="network problems" Tags="|switch|router|ospf|troubleshooting|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="18696" PostTypeId="1" AcceptedAnswerId="18698" CreationDate="2015-05-25T09:30:05.757" Score="6" ViewCount="5612" Body="&lt;p&gt;I understand the meaning of this field, and how it is used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I can't find an example for when it is needed, I read that it is used in Telnet, why?&lt;br&gt;&#xA;When do I need this flag?&lt;/p&gt;&#xA;" OwnerUserId="13770" LastEditorUserId="25249" LastEditDate="2020-03-24T21:57:36.540" LastActivityDate="2020-03-24T21:57:36.540" Title="TCP - Urgent flag, when is it needed?" Tags="|tcp|protocol-theory|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="18697" PostTypeId="2" ParentId="18694" CreationDate="2015-05-25T09:37:08.913" Score="2" Body="&lt;p&gt;Since you're not mentioning what kind of hardware you're using, I can only give a general way of approaching this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try finding out the MAC addresses of the hosts using the duplicate IP address. You can sometimes find this in log entries of the host which address has been 'stolen' or in router logs. If this doesn't work you can try looking in ARP tables of various machines in your network and compare the output for the problematic IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, you should have two different MAC addresses claiming to belong to the same IP address. You do a vendor lookup on a site like &lt;a href=&quot;http://www.coffer.com/mac_find/&quot; rel=&quot;nofollow&quot;&gt;http://www.coffer.com/mac_find/&lt;/a&gt;. This can help you identify the brand of the two hosts, which may help you to narrow down your search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have managed switches, you can do lookups on these switches to find out on which port these MAC addresses are being used by looking at the forwarding tables. This should help you find the port to which the problematic host is connected.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-05-25T09:37:08.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18698" PostTypeId="2" ParentId="18696" CreationDate="2015-05-25T10:51:10.837" Score="5" Body="&lt;p&gt;It is essentially obsolete.  But Jeremy Stretch has a &lt;a href=&quot;http://packetlife.net/blog/2011/mar/2/tcp-flags-psh-and-urg/&quot; rel=&quot;noreferrer&quot;&gt;good write-up&lt;/a&gt; about it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-25T10:51:10.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18699" PostTypeId="2" ParentId="18650" CreationDate="2015-05-25T11:02:53.987" Score="1" Body="&lt;p&gt;The problem with your configuration is that the default gateway for PCs on the 192.168.1.0 network is the ASA.  So they have no route to the 192.168.20 network.  To make this work:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Change the default gateway of all the PCs on the 192.168.1.0 network to be the IP of the server.&lt;/li&gt;&#xA;&lt;li&gt;Create a static default route on the server pointing to the ASA&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However, I agree with the other answers that this is not a good option and that using sub-interfaces and VLANs is a better way to go. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-25T11:02:53.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18700" PostTypeId="2" ParentId="18696" CreationDate="2015-05-25T11:23:31.140" Score="0" Body="&lt;p&gt;I found the answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because telnet is connecting to a remote computer, we want to be able to have the commands we type executed right after we typed them.&#xA;That is why they are flagged with URG flag.&lt;/p&gt;&#xA;" OwnerUserId="13770" LastActivityDate="2015-05-25T11:23:31.140" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18703" PostTypeId="2" ParentId="18695" CreationDate="2015-05-25T22:03:20.107" Score="-1" Body="&lt;p&gt;You have no interfaces on your router?  They should show up in the show run or write term output.  In any case, you need to enable a routing protocol or code in static routes.  It is a routing issue.  I do not see RIP configured in your output.  Configure RIPv2 if you would like.  Documentation is online.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ADDED----&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try adding&lt;br&gt; &#xA;no auto-summarize&lt;br&gt;&#xA;redistribute connected&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfrip.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfrip.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-05-26T01:11:43.893" LastActivityDate="2015-05-26T01:11:43.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18705" PostTypeId="2" ParentId="18691" CreationDate="2015-05-25T22:13:54.977" Score="1" Body="&lt;p&gt;Telephone numbers are part of the Public Switched Telephone Network (PSTN) which has been around since the advent of telephones.  The only reason companies with PBX's lease PSTN circuits is to have their own telephone numbers, and the ability to dial other telephone numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A company leases PSTN access, whether analog lines, SIP, PRI, or T1.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-05-27T21:38:16.677" LastActivityDate="2015-05-27T21:38:16.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18706" PostTypeId="2" ParentId="14695" CreationDate="2015-05-26T03:00:01.387" Score="-1" Body="&lt;p&gt;Tell router 184.164.128.134 that 192.168.2.x is available via router 63.229.183.186/192.168.16.42.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-26T03:00:01.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18710" PostTypeId="1" AcceptedAnswerId="18767" CreationDate="2015-05-26T07:10:24.817" Score="0" ViewCount="1064" Body="&lt;p&gt;I am looking to do the following setup found &lt;a href=&quot;http://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Scenario4.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; but I want to make sure the hardware I am looking to purchase will be compatible. The requirements of the hardware are listed &lt;a href=&quot;http://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/Introduction.html#CGRequirements&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; and the device I am looking at is the &lt;strong&gt;SonicWall TZ SOHO&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first guess would be that they are but I have never done a VPN before.&lt;/p&gt;&#xA;" OwnerUserId="15607" LastActivityDate="2015-05-27T16:48:12.443" Title="AWS hardware VPN access support" Tags="|vpn|ipsec|sonicwall|" AnswerCount="2" CommentCount="2" ClosedDate="2015-05-29T21:35:27.650" ContentLicense="CC BY-SA 3.0" />
  <row Id="18711" PostTypeId="1" AcceptedAnswerId="18718" CreationDate="2015-05-26T08:39:59.893" Score="-2" ViewCount="1026" Body="&lt;p&gt;I am running OpenVPN server on my DD-WRT router at home. When I ssh into a home server, which is running an OpenVPN client behind that home router and disable ARP on it (ip link set dev  arp off, arptables), the server is no more accessible. The SSH tunnel just hangs, no HTTP is served anymore, it doesn't even respond to ping. Why is that? Can it be worked around?&lt;/p&gt;&#xA;" OwnerUserId="14986" LastActivityDate="2015-05-28T16:36:25.443" Title="Disabling ARP blocks OpenVPN" Tags="|vpn|arp|linux|" AnswerCount="1" CommentCount="2" ClosedDate="2015-05-26T22:17:26.357" ContentLicense="CC BY-SA 3.0" />
  <row Id="18712" PostTypeId="1" AcceptedAnswerId="18728" CreationDate="2015-05-26T10:37:36.643" Score="3" ViewCount="91" Body="&lt;p&gt;A DHCP client can send continous DHCPREQUEST requests with a changing MAC address. In a small network it could teoretically cause problems, when a dynamic IP addresses pool is small. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How are computer networks protected against such actions?&lt;/p&gt;&#xA;" OwnerUserId="15586" LastEditorUserId="775" LastEditDate="2015-06-20T16:49:20.937" LastActivityDate="2015-06-20T16:49:20.937" Title="How are computer networks protected against continous DHCPREQUEST requests?" Tags="|dhcp|security|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18713" PostTypeId="1" CreationDate="2015-05-26T11:06:39.670" Score="2" ViewCount="3302" Body="&lt;p&gt;Normally we are facing abnormal traffic targeting specific servers. My question is How can I know which private IP address is targeted since we are using Dynamic NAT on Cisco ASA 5508 Firewall?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="8366" LastEditorDisplayName="user36472" LastEditDate="2018-02-14T16:39:07.123" LastActivityDate="2020-12-25T14:56:50.653" Title="How can I find which natted private IP address is communicating on Cisco ASA 5508" Tags="|cisco-asa|firewall|security|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18714" PostTypeId="1" AcceptedAnswerId="18744" CreationDate="2015-05-26T12:06:07.990" Score="5" ViewCount="653" Body="&lt;p&gt;An ISP came and set up their radios the other day. After connecting my router to the radio and configuring it with the IP address, netmask, and gateway which they specified, I can't ping their gateway (it doesn't even answer ARP queries).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, doing a packet trace on the radio's Ethernet port, I can see a constant stream of frames with EtherType 9C9D. They are directed to 2 specific MAC addresses, and it seems that something is sending them once per second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an excerpt from &lt;code&gt;tcpdump&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;11:57:58.401652 00:15:67:64:f5:55 (oui Unknown) &amp;gt; 00:00:07:d6:c4:f3 (oui Unknown), ethertype Unknown (0x9c9d), length 62:&#xA;        0x0000:  8d00 1000 8b00 1065 8d00 1000 0000 002a  .......e.......*&#xA;        0x0010:  0260 d742 0000 0000 0000 0000 0000 0000  .`.B............&#xA;        0x0020:  0000 0007 0000 0015 6764 f555 0103 f2f2  ........gd.U....&#xA;11:57:58.901660 00:15:67:64:f5:55 (oui Unknown) &amp;gt; 00:15:67:00:00:02 (oui Unknown), ethertype Unknown (0x9c9d), length 62:&#xA;        0x0000:  8d00 1000 8b00 1065 8d00 1000 0000 002a  .......e.......*&#xA;        0x0010:  0260 d746 0000 0000 0000 0000 0000 0000  .`.F............&#xA;        0x0020:  0000 0007 0000 0015 6764 f555 0103 f2ee  ........gd.U....&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google is failing me here. Does anyone know what those frames are???&lt;/p&gt;&#xA;" OwnerUserId="5478" LastEditorUserId="5478" LastEditDate="2015-05-27T06:45:44.093" LastActivityDate="2020-10-20T05:59:55.147" Title="What is EtherType 9C9D?" Tags="|ethernet|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18715" PostTypeId="2" ParentId="17845" CreationDate="2015-05-26T12:20:32.830" Score="0" Body="&lt;p&gt;Keeping it succinct, BGP is needed primarily in a multi-homed scenario that is when you connect to two providers and want to achieve failover as well as apply policy maps. It works as a EGP (eBGP) and in fact it is the only EGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other scenario is using BGP as IGP (iBGP) that is establishing peering with router within same AS but that is not suggested for the routing complexity and resources burden. Only in specific cases iBGP is required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Coming to packet tracer example, it's different than real world where connecting to ISP isn't the conclusion of routing. It's merely the starting, then comes applying policies, tuning the performance of link with QoS, prioritizing traffic, and more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you work in a small organization with sole objective of forwarding any type of traffic to ISP without advance routing, you may not want to rely on static routes and EIGRP.&lt;/p&gt;&#xA;" OwnerUserId="15609" LastActivityDate="2015-05-26T12:20:32.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18716" PostTypeId="1" CreationDate="2015-05-26T13:52:19.600" Score="0" ViewCount="488" Body="&lt;p&gt;We recently ran a independent fiber network for a deployment of around 150 IP cameras around our property.  Needing something to pass out IP addresses, and enable access from our current LAN, I was debating on whether or not to put it on a separate firewall to lessen the impact on our main firewall.  If I just connect it to a different interface on our Sonicwall NSA2600, will it impact the firewall performance much?  All the traffic would be on the new fiber LAN, and would be recording to the NVR.  Would I be better off setting up a different firewall?  Or should the impact be minimal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/DCWzN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14318" LastEditorUserId="775" LastEditDate="2015-06-20T16:48:04.057" LastActivityDate="2018-08-08T01:53:55.303" Title="Impact on Firewall with IP camera network attached" Tags="|firewall|sonicwall|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18717" PostTypeId="1" AcceptedAnswerId="18742" CreationDate="2015-05-26T14:06:00.283" Score="7" ViewCount="8093" Body="&lt;p&gt;&lt;strong&gt;My initial problem:&lt;/strong&gt; I’ve run out of physical ports on my ASA 5525-X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My initial solution:&lt;/strong&gt; Create sub-interfaces on a port-channel and use a switch to aggregate my VLANs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The subsequent issue:&lt;/strong&gt; How do I move the names assigned to the original interfaces to the new sub-interfaces while keeping the rest of my configuration in place?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I issue a ‘&lt;em&gt;no nameif&lt;/em&gt;’ directive on the original interface prior to reassigning the name, the ASA will delete every configuration element that referenced that name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I reissue the ‘&lt;em&gt;nameif&lt;/em&gt;’ directive to rename the interface to something temporary prior to reassigning the original name, all of the configuration elements that referenced the original name will be updated to reflect the new name. In the end, I’m no closer to my goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only solution I’ve fund so far is the obvious one - edit the startup-config offline and reload the firewall with my changes already in place. What I don’t like about this is the reload time – the ASA doesn’t boot quickly. I won’t be able to sneak the downtime into a small maintenance window at the end of the day (is the internet down? Huh, it’s back up now - must have been me). Instead, I’ll will have to schedule a longer maintenance window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: Please check out the related question, &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/18879/cisco-asa-startup-config-command-ordering-for-sub-interfaces&quot;&gt;Cisco ASA startup-config command ordering for sub-interfaces&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there another way to ‘move’ a name from one interface to a new interface while keeping everything else in place?&lt;/p&gt;&#xA;" OwnerUserId="14399" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2019-08-14T17:53:56.533" Title="Moving interface names on a Cisco ASA while maintaining the rest of the configuration in place" Tags="|cisco-asa|" AnswerCount="5" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18718" PostTypeId="2" ParentId="18711" CreationDate="2015-05-26T14:15:19.967" Score="2" Body="&lt;p&gt;Because ARP is what is needed at the link layer of your network to find your server, so you have to keep it on. ARP is used to resolve an IP adresse to a MAC address on the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit by OP: the reason was really ARP, but the fact the server's ARP cache was being flushed right away.&lt;/p&gt;&#xA;" OwnerUserId="15612" LastEditorUserId="14986" LastEditDate="2015-05-28T16:36:25.443" LastActivityDate="2015-05-28T16:36:25.443" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18720" PostTypeId="2" ParentId="18713" CreationDate="2015-05-26T15:19:02.247" Score="2" Body="&lt;p&gt;I'm not entirely sure if I understand your question, but I believe you want to take a look at the &lt;code&gt;show xlate&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;myfirewall1/act/pri# show xlate&#xA;732 in use, 3000 most used&#xA;Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,&#xA;       s - static, T - twice, N - net-to-net&#xA;NAT from inside:172.16.8.0/24, 172.16.5.0/24, 172.17.60.0/24,&#xA;  172.17.10.0/24, 172.17.50.0/24, 172.16.4.0/24,&#xA;  172.16.6.0/24, 172.16.7.0/24, 172.17.40.0/24,&#xA;  172.17.30.0/24 to outside:172.16.8.0/24, 172.16.5.0/24,&#xA;  172.17.60.0/24, 172.17.10.0/24, 172.17.50.0/24,&#xA;  172.16.4.0/24, 172.16.6.0/24, 172.16.7.0/24,&#xA;  172.17.40.0/24, 172.17.30.0/24&#xA;  flags sIT idle 0:00:00 timeout 0:00:00&#xA;&#xA;[output cut...]&#xA;&#xA;TCP PAT from inside:172.16.8.54/53008 to outside:177.36.241.90/53008 flags ri idle 0:32:23 timeout 0:00:30&#xA;TCP PAT from inside:172.16.4.52/20592 to outside:177.36.241.90/20592 flags ri idle 0:14:26 timeout 0:00:30&#xA;TCP PAT from inside:172.16.6.61/49776 to outside:177.36.241.90/49776 flags ri idle 0:00:16 timeout 0:00:30&#xA;TCP PAT from inside:172.16.6.61/63274 to outside:177.36.241.90/63274 flags ri idle 0:53:37 timeout 0:00:30&#xA;...&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can pipe the output to &lt;code&gt;include&lt;/code&gt; to filter on the IP addresses in question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;myfirewall1/act/pri# show xlate | include 172.16.5.56&#xA;TCP PAT from inside:172.16.5.56/59970 to outside:177.36.241.72/59970 flags ri idle 0:00:05 timeout 0:00:30&#xA;TCP PAT from inside:172.16.5.56/59958 to outside:177.36.241.72/59958 flags ri idle 0:00:29 timeout 0:00:30&#xA;TCP PAT from inside:172.16.5.56/59914 to outside:177.36.241.72/59914 flags ri idle 0:00:54 timeout 0:00:30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or you can narrow the scope with the global, gport, interface, local, lport options.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ncapfw1/act/pri# show xlate ?&#xA;&#xA;  count      Show translation count&#xA;  global     Enter this keyword to specify global ip range&#xA;  gport      Enter this keyword to specify global port(s)&#xA;  interface  Enter this keyword to specify an interface&#xA;  local      Enter this keyword to specify local ip range&#xA;  lport      Enter this keyword to specify local port(s)&#xA;  type       Enter this keyword to specify xlate type&#xA;  |          Output modifiers&#xA;  &amp;lt;cr&amp;gt;&#xA;myfirewall1/act/pri#&#xA;myfirewall1/act/pri#    &#xA;myfirewall1/act/pri# show xlate global 177.36.241.72&#xA;863 in use, 3000 most used&#xA;Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,&#xA;       s - static, T - twice, N - net-to-net&#xA;&#xA;TCP PAT from inside:172.16.5.61/38464 to outside:177.36.241.72/38464 flags ri idle 0:29:30 timeout 0:00:30&#xA;TCP PAT from inside:172.16.5.61/36269 to outside:177.36.241.72/36269 flags ri idle 0:29:30 timeout 0:00:30&#xA;TCP PAT from inside:172.16.5.61/57396 to outside:177.36.241.72/57396 flags ri idle 0:29:33 timeout 0:00:30&#xA;TCP PAT from inside:172.16.5.61/42706 to outside:177.36.241.72/42706 flags ri idle 0:55:22 timeout 0:00:30&#xA;...&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="14399" LastActivityDate="2015-05-26T15:19:02.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18721" PostTypeId="2" ParentId="18714" CreationDate="2015-05-26T15:32:08.663" Score="0" Body="&lt;p&gt;The Ethertype bytes will get altered to something unique if additional VLAN tagging is in use on the link.  This might also explain your lack of connectivity.  Perhaps the vendor requires a specific VLAN for normal traffic?&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-05-26T15:32:08.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18722" PostTypeId="2" ParentId="18716" CreationDate="2015-05-26T15:32:53.550" Score="3" Body="&lt;p&gt;I understand that most of the CCTV traffic will be confined to the LAN under X6 traffic because communication is between your cameras and the recording device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I understand that the only traffic that will flow throught X6 will be things like camera control, DNS, updating firmware, etc. I mean, there are no heavy traffic from CCTV LAN to the rest of Firewalls interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this two suppositions are correct, your firewall won't notice the new X6 LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this two suppositions are incorrect, comment what it's different.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2015-05-26T15:32:53.550" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18723" PostTypeId="2" ParentId="17845" CreationDate="2015-05-26T15:36:28.583" Score="-6" Body="&lt;p&gt;In the context of Enterprise (non carrier) networks, BGP is primarily used when you have more than one Internet link for your organization's offices to use.  BGP is required to steer &lt;em&gt;inbound&lt;/em&gt; traffic towards your organization in case of primary Internet link outage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other reason you see BGP in Enterprise networks is MPLS WAN's.  However, most MPLS providers do offer IGP's also, and even if they refused an overlay such as DMVPN could be used on top of the MPLS to allow an IGP to make WAN routing decisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Carriers primarily use BGP to direct traffic as BGP is purpose built for this.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-09-27T00:38:47.287" LastActivityDate="2016-09-27T00:38:47.287" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="18724" PostTypeId="2" ParentId="18712" CreationDate="2015-05-26T15:49:06.917" Score="1" Body="&lt;p&gt;Some more sophisticated DHCP solutions will use ping or other activity metrics to gauge actual lease usage, instead of always reserving the address for the entire lease (counting on poorly behaved clients, like you pose).  This would allow them to verify and maintain leases still in use and reclaim leases that were issued to a malicious actor.  Most (especially basic ones) will simply get to the end of the reservation block and stop answering requests until the leases expire.  So, yes a DOS based on lease exhaustion is quite possible on most networks.  But, other forms of DOS are more mischievous (such as sucking up all uplink bandwidth, or attacking actual hosts) so most attackers don't bother causing problems for DHCP, and therefore mitigation countermeasures are rarely ever considered.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-05-26T15:49:06.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18725" PostTypeId="2" ParentId="18710" CreationDate="2015-05-26T16:04:14.937" Score="0" Body="&lt;p&gt;You are going to want a virtual router (or a pair) such as &lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/cloud-services-router-1000v-series/index.html&quot; rel=&quot;nofollow&quot;&gt;Cisco CSR 1000v&lt;/a&gt; on the AWS side and a physical router (or a pair, sized &lt;a href=&quot;https://supportforums.cisco.com/sites/default/files/legacy/0/3/8/142830-white_paper_c11_595485.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;) on the remote office side.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-26T16:04:14.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18726" PostTypeId="2" ParentId="18716" CreationDate="2015-05-26T16:06:57.257" Score="1" Body="&lt;p&gt;A firewall is typically not used as a network core/aggregation device.  Idustry practise is to use a multilayer switch to act as the core/aggregation point for your different networks/subnetworks.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-26T16:06:57.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18728" PostTypeId="2" ParentId="18712" CreationDate="2015-05-26T20:11:07.177" Score="3" Body="&lt;p&gt;In a managed Cisco wired solution you commonly find ip dhcp snooping used in combination with ip arp inspection and ip source guard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Though while googling for the same solution some time ago, I viewed other vendors also providing excellent protection against dhcp starvation attacks, mac address spoofing and cam table overflow attack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Guess one the answers would be a combination of many factors such as a manageable enterprise access switch, a well patched/configured dhcpd server and a good syslog server that can record what is going on in your network.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2015-05-26T20:11:07.177" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18730" PostTypeId="2" ParentId="17845" CreationDate="2015-05-26T20:53:22.127" Score="11" Body="&lt;p&gt;Instead of describing where you would use BGP, let me describe why:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other protocols like EIGRP or OSPF assume the best way to get somewhere is the fastest link -- i.e. the link with the highest bandwidth.  As such, they have a simple metric for selecting routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In many situations, especially between different organizations (autonomous systems), the reason for choosing a particular path may have nothing to do with bandwidth.  It may be due to a pre-arranged agreement on who will carry what traffic, or based on some financial agreement.  You may want to route some traffic to one neighbor, but different traffic to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main advantage of BGP is that it gives you much more control over what routes you advertise and what advertisements you accept from your neighbors.  BGP gives you more control over route selection and your neighbor's route selection.  That's one of the major reasons BGP is The Routing Protocol for the Internet.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-26T20:53:22.127" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18731" PostTypeId="2" ParentId="18717" CreationDate="2015-05-26T21:00:22.210" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;edit the startup-config offline and reload&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's the only way.  Internally, the name is tracked with a unique ID. There's no way to &quot;move&quot; the name to a different interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One &lt;em&gt;possible&lt;/em&gt; alternative would be to update the startup-config, then remove the names and &quot;&lt;em&gt;copy start run&lt;/em&gt;&quot; to put everything back. But you're asking for a major mess, and it will still break every existing connection. (I'd give it 1 in 5 of crashing the system in the process.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the time to reload, I've never seen an ASA take more than a few minutes (under 5) to reload.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-26T21:00:22.210" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18732" PostTypeId="2" ParentId="18713" CreationDate="2015-05-26T21:15:40.880" Score="1" Body="&lt;p&gt;After searching the best way is to use the following command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Firewall# show local-host connection | i 5.5.5.5&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where 5.5.5.5 is the attacker IP &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can also use the following command to see all outside IP addresses communicating with the organization devices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Firewall# show local-host connection | i outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;still need to now the flag values and the 0 bytes meaning:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;bytes 2179, flags UfFRIOB&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;bytes 0, flags saA&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;bytes 1095819866, flags UIOB&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8366" LastActivityDate="2015-05-26T21:15:40.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18734" PostTypeId="1" AcceptedAnswerId="19880" CreationDate="2015-05-26T21:25:49.527" Score="3" ViewCount="2001" Body="&lt;p&gt;I currently have 2 Internet links, from different carriers. Our primary link currently has our VPN connections running over it. I want to add another VPN connection over the 2nd carrier. &#xA;So I have 2 cisco 5545x's(Active/Standby) with carrier 1 on the OUTSIDE interface and carrier 2 coming over the OUTSIDE_1 interface. I have a cert for vpn.mysite.com that is associated to the OUTSIDE interface. I would like to associate vpn3.mysite.com to the OUTSIDE_1. &#xA;Currently OUTSIDE_1 is not carrying any traffic at this time. &#xA;Users are coming in with cisco anyconnect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to re-engineer my Firewall setup to achieve this?&#xA;Is it even possible to run that over an Active/Standby configuration?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I think of it, I think the only way to do it is to make a cluster with a master and users pointing to a VIP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated, thanks. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh run ssl  &#xA;ssl encryption 3des-sha1 aes128-sha1 aes256-sha1 dhe-aes128-sha1 dhe-aes256-sha1 rc4-md5 rc4-sha1&#xA;ssl trust-point ASDM_TrustPoint7 OUTSIDE_1&#xA;ssl trust-point vpn.mysite.com_trustpoint OUTSIDE&#xA;sh run webvpn&#xA;webvpn&#xA; enable OUTSIDE&#xA; enable OUTSIDE_1&#xA; anyconnect-essentials&#xA; anyconnect image disk0:/anyconnect-win-3.1.01065-k9.pkg 1&#xA; anyconnect enable&#xA; tunnel-group-list enable&#xA; certificate-group-map DefaultCertificateMap 20 USER-SSL-VPN&#xA; certificate-group-map DefaultCertificateMap 30 DefaultRAGroup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15621" LastEditorUserId="15621" LastEditDate="2015-05-27T20:01:53.323" LastActivityDate="2016-03-07T00:08:12.983" Title="Multiple VPN setup on Cisco ASA 5545x" Tags="|cisco-asa|vpn|" AnswerCount="3" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18736" PostTypeId="2" ParentId="18664" CreationDate="2015-05-27T00:51:10.590" Score="0" Body="&lt;p&gt;Broadcast storms will play tricks on your network and you will never know why.  When users complain all they will get is a shrug of the shoulders.&lt;/p&gt;&#xA;" OwnerUserId="14175" LastActivityDate="2015-05-27T00:51:10.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18738" PostTypeId="2" ParentId="18734" CreationDate="2015-05-27T03:56:45.177" Score="0" Body="&lt;p&gt;Terminate your ISP connections on a router, or routers.  These routers plug into an outside switch/VLAN which plugs in to your security appliance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;rtrs---switch(outside)---firewall---switch(inside)&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-27T03:56:45.177" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18739" PostTypeId="2" ParentId="18717" CreationDate="2015-05-27T04:51:24.500" Score="0" Body="&lt;p&gt;That's my way:&#xA;Issue a show run | include &quot;interface name&quot;&#xA;Paste to notepad all the lines with &quot;interface name&quot;&#xA;Add on top the commands to move the name to the new interface&#xA;Since now you worked offline, so no running config change at all&#xA;Now starts the real game, copy and paste the whole lines to asa, configuration is changed and new one is running in a few seconds&#xA;However you need to double check the configuration lines prior to start and be sure not to loose the asa once you delete the name on the original interface.&lt;/p&gt;&#xA;" OwnerUserId="14095" LastActivityDate="2015-05-27T04:51:24.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18740" PostTypeId="2" ParentId="18650" CreationDate="2015-05-27T05:32:15.887" Score="0" Body="&lt;p&gt;Simply use IP network 192.168.0.0/16 instead of /24. It's a matter of changing some configuration but it can be done very quickly.&lt;/p&gt;&#xA;" OwnerUserId="15612" LastActivityDate="2015-05-27T05:32:15.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18742" PostTypeId="2" ParentId="18717" CreationDate="2015-05-27T05:53:15.600" Score="2" Body="&lt;p&gt;Leave the physical port you are using as the untagged VLAN.  You can direct that traffic to a VLAN# on your switch by setting the Native VLAN the VLAN# you want that traffic to be on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then for every new VLAN you are adding to your ASA, make that a sub interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have an ASA to validate this code, but it will look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gig0/0&#xA;  nameif ORIGINAL-NAMEIF&#xA;  security-level 100&#xA;&#xA;interface gig0/0.20&#xA;  vlan 20&#xA;  nameif NEW-VLAN-2&#xA;  security-level 20&#xA;&#xA;interface gig0/0.30&#xA;  vlan 30&#xA;  nameif NEW-VLAN-3&#xA;  security-level 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;etc.  It should allow you to add new sub interfaces without making any changes to your original interface.  The &quot;root&quot; interface doesn't include a VLAN tag, so that traffic is unchanged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can run it this way indefinitely, or change it so everything is using VLAN tags at a later date when its more convenient for you to bring the network down. &lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="14399" LastEditDate="2015-06-16T21:04:48.500" LastActivityDate="2015-06-16T21:04:48.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18743" PostTypeId="2" ParentId="18734" CreationDate="2015-05-27T05:56:49.737" Score="0" Body="&lt;p&gt;Create a new trustpoint, and apply it to your OUTSIDE_1 interface.  &lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-05-27T05:56:49.737" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18744" PostTypeId="2" ParentId="18714" CreationDate="2015-05-27T07:24:06.077" Score="2" Body="&lt;p&gt;Those look like some sort of topology discovery mechanism (like cdp or lldp.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(It's as if it's searching for an NMS or link-partner to know how to configure itself. But I'm not familiar with how Radwin's gear works. I would hope your ISP has any required documentation and experience with this stuff.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-27T07:24:06.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18745" PostTypeId="1" AcceptedAnswerId="18787" CreationDate="2015-05-27T07:47:08.600" Score="2" ViewCount="7173" Body="&lt;p&gt;I can successfully programmatically download the config from Juniper network devices using SCP - I'd like to do the same for a Cisco router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SSH access is already working, and I've enabled SCP using &lt;code&gt;ip scp server enable&lt;/code&gt;. Problem is that I don't know the name or location of the file I need to download, and GUI tools like WinSCP don't seem to work (complains that I need a BASH shell).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible for Cisco devices?&lt;/p&gt;&#xA;" OwnerUserId="15626" LastActivityDate="2015-05-28T09:52:33.987" Title="Download startup config from Cisco device using SCP" Tags="|cisco|cisco-ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18746" PostTypeId="2" ParentId="18745" CreationDate="2015-05-27T08:41:04.280" Score="4" Body="&lt;p&gt;&lt;code&gt;scp &amp;lt;user&amp;gt;@&amp;lt;router&amp;gt;:startup-config&lt;/code&gt; (or &lt;code&gt;running-config&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or the full pathname of whatever file you want, like &lt;em&gt;nvram:/startup-config&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[there's also the &lt;code&gt;CONFIG-COPY-MIB&lt;/code&gt; to initiate a copy by SNMP. It's come up many times before, so go &lt;a href=&quot;http://checkforbees.com/router-backup/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-27T08:41:04.280" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18747" PostTypeId="1" AcceptedAnswerId="18749" CreationDate="2015-05-27T08:56:47.733" Score="6" ViewCount="1193" Body="&lt;p&gt;I am developing a program that creates random MAC addresses. I understand that in order to avoid collisions with OUI addresses, my addresses should &quot;locally-administered&quot; addresses, by setting the second least-significant bit of the first byte (the msb byte) to 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many code samples that I found simply set the first byte to 0x02, i.e. set the address to be locally-administered and unicast, and avoid choosing random values for the other bits of the first byte (to keep the code simple by avoiding bit operations).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I found a list of standard OUI address prefixes &lt;a href=&quot;http://standards-oui.ieee.org/oui.txt&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, in which some prefixes begin with 0x02 and 0xAA (the lower two bits of 0xAA are also 0b10):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;3COM CORPORATION: 02-60-8C, 02-C0-8C&lt;/li&gt;&#xA;&lt;li&gt;CARDIAC RECORDERS INC.: 02-9D-8E&lt;/li&gt;&#xA;&lt;li&gt;COMMUNICATION MACHINERY CORP.: 02-CF-1C&lt;/li&gt;&#xA;&lt;li&gt;DATA RECALL LTD: 02-70-B3&lt;/li&gt;&#xA;&lt;li&gt;DIGITAL EQUIPMENT CORPORATION: AA-00-00, AA-00-01, AA-00-02, AA-00-03, AA-00-04&lt;/li&gt;&#xA;&lt;li&gt;LOGIC REPLACEMENT TECH. LTD.: 02-60-86&lt;/li&gt;&#xA;&lt;li&gt;M/A-COM INC. COMPANIES: 02-70-B0&lt;/li&gt;&#xA;&lt;li&gt;NIXDORF COMPUTER CORPORATION: 02-E6-D3&lt;/li&gt;&#xA;&lt;li&gt;OCTOTHORPE CORP.: 02-BB-01&lt;/li&gt;&#xA;&lt;li&gt;OLIVETTI TELECOMM SPA (OLTECO): 02-AA-3C&lt;/li&gt;&#xA;&lt;li&gt;PERQ SYSTEMS CORPORATION: 02-1C-7C&lt;/li&gt;&#xA;&lt;li&gt;RACAL-DATACOM: 02-07-01, 02-70-01&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Does anyone have an explanation for this?&lt;/p&gt;&#xA;" OwnerUserId="15628" LastEditorUserId="775" LastEditDate="2015-06-20T16:25:25.947" LastActivityDate="2015-06-20T16:25:25.947" Title="Differentiating OUI MAC addresses from random MAC addresses" Tags="|mac-address|standardisation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18748" PostTypeId="2" ParentId="18686" CreationDate="2015-05-27T09:03:56.983" Score="5" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Can one set a link's cost to zero in OSPF?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes and no... you can't manually set a link's cost to 0, but if you have a Designated Router election on the network, the cost from the DR to any attached router on the same Broadcast / NBMA network is considered 0.&lt;/p&gt;&#xA;&lt;p&gt;As such, be sure that the A-B and C-D links are OSPF broadcast networks; this forces a DR election and will make the cost of A-B and C-D zero.  The DR is sometimes referred to as a pseudonode in OSPF.&lt;/p&gt;&#xA;&lt;p&gt;Once you make the A-B and C-D links zero cost in OSPF (by virtue of a DR election), A-C and B-D links should be set to the same cost if you want equal-cost load-balancing.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This could be desirable to force load-balancing in certain cases.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;If you want a generalized solution to this problem (without dependencies the topology or type of OSPF network involved), you are making one of the classic cases for MPLS TE; OSPF supports MPLS TE (see &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3630&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3630&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;Let's assume:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You are running Cisco IOS&lt;/li&gt;&#xA;&lt;li&gt;You only need load-balancing in a single OSPF area&lt;/li&gt;&#xA;&lt;li&gt;You are not trying to deal with NIC-level failovers on the hosts (which can still be managed with MPLS TE, but I'm not illustrating here for brevity)&lt;/li&gt;&#xA;&lt;li&gt;My configuration below has no errors (&lt;em&gt;caveat emptor: I did not lab test my config below, and it's been close to a decade since I seriously needed MPLS TE&lt;/em&gt;); however, even if I have to fix an error in the config, the concept of solving your problem with equal-cost load-balancing through MPLS TE tunnels is correct.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Topology&lt;/h2&gt;&#xA;&lt;p&gt;Assume all IP addresses in the diagram are taken from 10.1.x.x...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;          1.1/30   1.2/30&#xA;          g1/1     g1/1&#xA;         A-------------C&#xA;     g1/2|             |g1/2&#xA; 2.253/24|             |3.253/24&#xA;         |             |&#xA;         |             |&#xA; 2.252/24|             |3.253/24&#xA;     g1/2|             |g1/2&#xA;         B-------------D&#xA;          g1/1     g1/1&#xA;          1.5/30   1.6/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h2&gt;MPLS TE Tunnels&lt;/h2&gt;&#xA;&lt;p&gt;Build the following tunnels so we can use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipswitch_cef/configuration/xe-3s/isw-cef-xe-3s-book/isw-cef-load-balancing.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ECMP&lt;/a&gt; to meet your requirements.  Each tunnel interface will have the same OSPF cost.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Tunnels from head-end Router A&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Tunnel0&lt;/code&gt;: Path A -&amp;gt; C&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Tunnel1&lt;/code&gt;: Path A -&amp;gt; B -&amp;gt; D -&amp;gt; C&lt;/li&gt;&#xA;&lt;li&gt;Tunnels from head-end Router C&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Tunnel0&lt;/code&gt;: Path C -&amp;gt; A&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Tunnel1&lt;/code&gt;: Path C -&amp;gt; D -&amp;gt; B -&amp;gt; A&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Loopbacks&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A:Lo0   10.0.0.1/32&lt;/li&gt;&#xA;&lt;li&gt;B:Lo0   10.0.0.2/32&lt;/li&gt;&#xA;&lt;li&gt;C:Lo0   10.0.0.3/32&lt;/li&gt;&#xA;&lt;li&gt;D:Lo0   10.0.0.4/32&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Router A's configuration (you can derive all others from this example)&lt;/h2&gt;&#xA;&lt;p&gt;Reference links:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/multiprotocol-label-switching-mpls/mpls/13731-mpls-te-ospf.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS TE w/ OSPF Ref&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Interface MTUs: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/newmtu.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;CCO MTU Link 1&lt;/a&gt;, &lt;a href=&quot;https://supportforums.cisco.com/discussion/10782566/mpls-mtu-vs-mtu-mpls-interface&quot; rel=&quot;nofollow noreferrer&quot;&gt;CCO MTU Link 2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://wiki.nil.com/Autoroute_%28MPLS_TE%29_basics&quot; rel=&quot;nofollow noreferrer&quot;&gt;MPLS TE Autoroute info&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;mpls traffic-eng tunnels&#xA;!&#xA;interface Loopback0&#xA; ip address 10.0.0.1 255.255.255.255&#xA;!&#xA;interface Tunnel0&#xA; ip unnumbered Loopback0&#xA; tunnel destination 10.0.0.3&#xA; tunnel mode mpls traffic-eng&#xA; tunnel mpls traffic-eng autoroute announce&#xA; tunnel mpls traffic-eng bandwidth 10000&#xA; tunnel mpls traffic-eng path-option 1 explicit name A_C&#xA; !!! NOTE: Keep the tunnel up if path-option 1 fails&#xA; tunnel mpls traffic-eng path-option 2 dynamic&#xA;!&#xA;interface Tunnel1&#xA; ip unnumbered Loopback0&#xA; tunnel destination 10.0.0.3&#xA; tunnel mode mpls traffic-eng&#xA; tunnel mpls traffic-eng autoroute announce&#xA; tunnel mpls traffic-eng bandwidth 10000&#xA; tunnel mpls traffic-eng path-option 1 explicit name A_B_D_C&#xA; !!! NOTE: Keep the tunnel up if path-option 1 fails&#xA; tunnel mpls traffic-eng path-option 2 dynamic&#xA;!&#xA;interface GigabitEthernet1/1&#xA; description [A -&amp;gt; C]&#xA; mtu 1524&#xA; mpls mtu 1524&#xA; ip mtu 1500&#xA; ip address 10.1.1.1 255.255.255.252&#xA; ip rsvp bandwidth 10000 10000&#xA; mpls traffic-eng tunnels&#xA;!&#xA;interface GigabitEthernet 1/2&#xA; description [A -&amp;gt; B]&#xA; mtu 1524&#xA; switchport&#xA; switchport mode access&#xA; switchport access vlan 10&#xA;!&#xA;interface Vlan10&#xA; mtu 1524&#xA; mpls mtu 1524&#xA; ip mtu 1500&#xA; ip address 10.1.2.253 255.255.255.0&#xA; standby 10 ip 10.1.2.254&#xA; standby 10 priority 105&#xA; standby 10 timers msec 200 750&#xA; ip rsvp bandwidth 1000000 1000000&#xA; mpls traffic-eng tunnels&#xA;!&#xA;router ospf 10&#xA; router-id 10.0.0.1&#xA; log-adjacency-changes&#xA; network 10.0.0.0 0.255.255.255 area 0&#xA; mpls traffic-eng router-id Loopback0&#xA; mpls traffic-eng area 0&#xA;!&#xA;ip explicit-path name A_C enable&#xA; next-address 10.1.1.2&#xA;! &#xA;ip explicit-path name A_B_D_C enable&#xA; next-address 10.1.2.252&#xA; next-address 10.1.1.6&#xA; next-address 10.1.3.253&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-05-27T12:13:49.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18749" PostTypeId="2" ParentId="18747" CreationDate="2015-05-27T09:10:16.267" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;NOTE – A very small number of assignments made prior to adoption of IEEE 802 standards have the X bit equal to one (BlockID assignments). These assignments are documented in the CID registry.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://standards.ieee.org/develop/regauth/tut/eui.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://standards.ieee.org/develop/regauth/tut/eui.pdf&lt;/a&gt; , p.4&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-27T09:10:16.267" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18750" PostTypeId="1" AcceptedAnswerId="18754" CreationDate="2015-05-27T11:46:06.030" Score="2" ViewCount="204" Body="&lt;p&gt;I know that the data is sent only from the forth segment forward, but theoretically can data be carried in the first segment ?&lt;/p&gt;&#xA;" OwnerUserId="13770" LastActivityDate="2015-05-27T13:50:09.550" Title="TCP - can the first segment of the 3-way handshake carry data?" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18751" PostTypeId="2" ParentId="18006" CreationDate="2015-05-27T12:55:50.877" Score="3" Body="&lt;p&gt;With help from our service provider we've been able to localise the problem. The idea I had in my &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/18006/juniper-srx240-unstable-uplink-when-client-is-connected-to-vpn#comment27223_18006&quot;&gt;last comment&lt;/a&gt; proved correct: the difference between fast ethernet and gigabit ethernet was the source of the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for dropping connections, undeliverable packets and segmented packets was a mismatch in link mode between the fiber switch and the SRX - they hardcoded their port to 100m full duplex, but the SRX had automatic negotiation, which resolved to 100m half duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem was further complicated by Juniper's odd configuration of speed and link mode. Just setting these configuration options wasn't enough:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;speed 100m;&#xA;link-mode full-duplex;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This configuration was accepted, but when running &lt;code&gt;show interfaces ge-0/0/0&lt;/code&gt;, it still showed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Link-level type: Ethernet, MTU: 1514, Link-mode: Half-duplex, Speed: 100mbps,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Apparently, you have to explicitly disable auto-negotiation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;speed 100m;&#xA;link-mode full-duplex;&#xA;gigether-options {&#xA;    no-auto-negotiation;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the end, I found that &lt;a href=&quot;http://www.myteneo.net/blog/-/blogs/juniper-ex-switch-auto-negotiate-gotcha/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this guy&lt;/a&gt; had the exact same problem (and the solution!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for all your help.&lt;/p&gt;&#xA;" OwnerUserId="15009" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-05-27T12:55:50.877" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18752" PostTypeId="1" CreationDate="2015-05-27T13:14:40.253" Score="0" ViewCount="2218" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/v0YwK.png&quot; alt=&quot;Network map&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I ping the default gateway from PC2?&#xA;I have tried &lt;code&gt;IP &amp;lt;address&amp;gt; [/&amp;lt;mask&amp;gt;] [&amp;lt;gateway&amp;gt;]&lt;/code&gt; command for R1, but is says &quot;not in subnet&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And when I tried the same command for R3, it works but I still can't ping R1 and I don't know why.&lt;/p&gt;&#xA;" OwnerUserId="15632" LastEditorUserId="44" LastEditDate="2015-06-28T16:00:56.683" LastActivityDate="2015-06-29T00:37:35.697" Title="How to ping default gateway from a pc?" Tags="|routing|gns3|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18754" PostTypeId="2" ParentId="18750" CreationDate="2015-05-27T13:50:09.550" Score="2" Body="&lt;p&gt;By RFC a payload may be present and then would theoretically be passed down after the handshake complets.  But it could also likely cause an error or be ignored, e.g.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=1314&amp;amp;signatureSubId=0&amp;amp;softwareVersion=6.0&amp;amp;releaseVersion=S272&quot; rel=&quot;nofollow&quot;&gt;http://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=1314&amp;amp;signatureSubId=0&amp;amp;softwareVersion=6.0&amp;amp;releaseVersion=S272&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RFC where this is defined:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793.txt&quot; rel=&quot;nofollow&quot;&gt;https://www.rfc-editor.org/rfc/rfc793.txt&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15549" LastActivityDate="2015-05-27T13:50:09.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18756" PostTypeId="2" ParentId="18752" CreationDate="2015-05-27T13:58:39.490" Score="2" Body="&lt;ul&gt;&#xA;&lt;li&gt;PC2 needs a route for 144.120.8.1 (or default route) that points at R3&lt;/li&gt;&#xA;&lt;li&gt;R3 needs a route for 144.120.8.1 (or default route) that points at R2&lt;/li&gt;&#xA;&lt;li&gt;R2 needs a route for PC2 (or default route) that points at R3&lt;/li&gt;&#xA;&lt;li&gt;R1 needs a route for PC2 (or default route) that points at R2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Check the routing tables on these devices to confirm these routes exist.&lt;/p&gt;&#xA;" OwnerUserId="15549" LastActivityDate="2015-05-27T13:58:39.490" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="18759" PostTypeId="1" AcceptedAnswerId="18764" CreationDate="2015-05-27T14:26:29.433" Score="1" ViewCount="6287" Body="&lt;p&gt;I have some devices that are only accessible via RS-232 cables. The problem is that I have no RS-232 to USB adapters so I can't access them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I &lt;em&gt;do&lt;/em&gt; have is a bunch of serial cables, most interestingly Cisco RJ45 (8P8C) to RJ45, that happen to fit in ethernet ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found &lt;a href=&quot;http://blog.philippklaus.de/2011/08/make-rs232-serial-devices-accessible-via-ethernet/&quot; rel=&quot;nofollow&quot;&gt;this article&lt;/a&gt; that points out that you can use &lt;code&gt;socat&lt;/code&gt; (installable via Homebrew) to open a &lt;code&gt;PTY&lt;/code&gt; to work with serial over Ethernet, but it doesn't go into any detail on how that would work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also points to Multicom, but again, without any useful setup instructions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is using a serial cable even the correct one for Serial via Ethernet?&lt;/p&gt;&#xA;" OwnerUserId="399" LastActivityDate="2015-05-27T15:26:33.297" Title="Serial connection via Ethernet port on Mac OS X" Tags="|ethernet|" AnswerCount="1" CommentCount="1" ClosedDate="2019-06-23T00:10:39.533" ContentLicense="CC BY-SA 3.0" />
  <row Id="18761" PostTypeId="2" ParentId="18691" CreationDate="2015-05-27T14:51:05.110" Score="6" Body="&lt;p&gt;You're buying SIP Trunking from a provider, so that you don't have to do all the work yourself of connecting to the global telephone network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to &quot;roll your own&quot; SIP trunking service connected to the PSTN, you certainly could.  It would just be extremely cost prohibitive if that was not what you were in business to do.  In 99% of cases it is simply not your core business, so it doesn't make any sense to waste resources creating that connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only real times where you don't buy SIP trunking, is when you are connecting systems that you control. For example to connect your PBX to your voice mail system.  In most other cases, you purchase the SIP trunk capacity from someone who has already done the work of connecting their systems to the PSTN.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2015-05-27T14:51:05.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18762" PostTypeId="1" AcceptedAnswerId="18765" CreationDate="2015-05-27T14:59:51.330" Score="2" ViewCount="2985" Body="&lt;p&gt;I have an interface that is Gigabit connecting to an interface on a carrier ATT router. The bandwidth of the ethernet circuit connecting to this interface is 10mbs. Is there a way to set the speed of the interface to match the bandwidth of the circuit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If QoS is then applied to my gigabit interface, will it be applied and aware of the 10mb rate limit?&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-05-27T15:42:14.650" Title="Interface speed is Gigabit but Circuit is 10mbs - How do I set the interface to the circuit bandwidth?" Tags="|cisco|router|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18764" PostTypeId="2" ParentId="18759" CreationDate="2015-05-27T15:26:33.297" Score="5" Body="&lt;p&gt;Just because it &lt;em&gt;fits&lt;/em&gt; doesn't make it a serial port. (Fibre Channel uses DB-9, but that's not RS-232 either!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need to find a USB/Serial adapter. Or find a &quot;serial console server&quot; (aka &quot;terminal server&quot;) that is an ethernet device. (Digi PortServer, for example. Lots of people still make 'em.) In a pinch, you could use ye'old &lt;em&gt;Cisco reverse telnet&lt;/em&gt; to make the &lt;em&gt;aux&lt;/em&gt; port a &quot;network serial port&quot;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-27T15:26:33.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18765" PostTypeId="2" ParentId="18762" CreationDate="2015-05-27T15:42:14.650" Score="3" Body="&lt;pre&gt;&lt;code&gt;! Assign a bandwidth of 10Mbps to the interface&#xA;! This doesn't shape or police, it's just an administrative bandwidth&#xA;interface Gi0/0&#xA; bandwidth 10000&#xA;&#xA;! Create a policy-map to shape to 95% of an interface's bandwidth&#xA;! 95% to allow room for overhead or differences between your shaper and their policer&#xA;policy-map PM.WAN.OUT&#xA; class class-default&#xA;  shape average percent 95&#xA;&#xA;! Apply the policy-map to the interface in the outbound direction&#xA;! Inbound your options are policing or letting the carrier shape/police the traffic&#xA;interface Gi0/0&#xA; service-policy output PM.WAN.OUT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="155" LastActivityDate="2015-05-27T15:42:14.650" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18767" PostTypeId="2" ParentId="18710" CreationDate="2015-05-27T16:48:12.443" Score="1" Body="&lt;p&gt;It should work. The new TZ SOHO is in the same class as the TZ 105/205/100/200 range of products. SonicWALL has a technote detailing how to create a STATIC VPN tunnel for an Amazon VPC (Virtual Private Cloud) on AWS:&#xA;&lt;a href=&quot;https://support.software.dell.com/kb/sw10169&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw10169&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(points to a PDF to download, latest release is &quot;D&quot;, which mentions the TZ 10x/20x line). It also mentions needing SonicOS 5.8, 5.9, 6.1 or 6.2, of certain sub-revisions, the SOHO will be either 5.9 or a 6.x SonicOS I believe. A new device will allow at least 90 days to download firmware updates. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the TZ series doesn't support BGP it will only be a Static IPSec VPN tunnel (must be in Tunnel not Policy mode). In your second link select &quot;Example: Generic Customer Gateway (without BGP)&quot; on the left as that is what you will be configuring to get an overview. Amazon will request some IP info from your side and then provide you with the specifics you will use. Then follow the PDF in the above link which shows how to configure the SonicWALL (see the section under &quot;Configuring Amazon VPC with a Policy-Based VPN&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Others have done this, see: &#xA;&lt;a href=&quot;https://forums.aws.amazon.com/thread.jspa?messageID=381356#381356&quot; rel=&quot;nofollow&quot;&gt;https://forums.aws.amazon.com/thread.jspa?messageID=381356#381356&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have never configured VPNs before then I would suggest setting up a basic site-to-site VPN (between a SonicWALL and another SonicWALL perhaps) just to become familiar with what needs to be done (preferably in routed tunnel mode). The PDF has many screen shots and should be fairly easy to follow if you have configured a VPN on a SonicWALL before or if you're at least somewhat familiar with SonicWALL management and willing to try.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted a Dynamic BGP VPC to AWS you would either need a higher end SonicWALL or a different device (a Juniper/NetScreen SSG-5 is low-end but still supports BGP and works with Amazon for example).&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-05-27T16:48:12.443" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18770" PostTypeId="1" CreationDate="2015-05-27T18:25:40.200" Score="1" ViewCount="271" Body="&lt;p&gt;We have a SCADA system that needed to pool stations via fixed IP addresses.&#xA;Our station does not assign fixed IP, so we would like to use DDNS to resolve this issue.&#xA;However the SCADA system does not support entering domain name in its GUI! It just manages IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how we can use the SCADA system with DDNS?&lt;/p&gt;&#xA;" OwnerUserId="15640" LastEditorUserId="775" LastEditDate="2015-05-31T14:25:20.967" LastActivityDate="2015-05-31T14:25:20.967" Title="How to use DDNS with scada systems that does not support domain names" Tags="|ip|dns|" AnswerCount="2" CommentCount="5" ClosedDate="2019-06-24T00:23:14.400" ContentLicense="CC BY-SA 3.0" />
  <row Id="18771" PostTypeId="1" AcceptedAnswerId="18802" CreationDate="2015-05-27T20:44:22.070" Score="3" ViewCount="2614" Body="&lt;p&gt;I have a modem-router device, the device is connected to a DSL phone line to connect its router to the internet, the device in this setting has a public ip address (provided by the ISP) and a local subnet 10.0.0.0/24 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now any PC can connect to internet through this device by connecting an Ethernet cable and obtaining a local IP address from its subnet. Simple....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The problem,&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a SonicWall NSA 220 device that I need to install behind the modem-router device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to have my local network connected to the SonicWall then in turn have the SonicWall connected to the modem-router device to access the internet. How do I configure the SonicWall WAN port to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I managed to configure a SonicWall interface to LAN zone, and now I have local network with subnet 192.168.168.0/24, so the question in other words, how do I get this network connected to the internet?&lt;/p&gt;&#xA;" OwnerUserId="14326" LastActivityDate="2015-05-28T16:09:22.370" Title="SonicWall : Configuring WAN X1" Tags="|sonicwall|wan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18774" PostTypeId="1" CreationDate="2015-05-27T21:41:34.453" Score="-1" ViewCount="850" Body="&lt;p&gt;I am running a web server on my local machine. If I reference the page using &quot;localhost&quot; I can retrieve the page. However, if I use my ip address instead, I get a 404.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got my ip address from ifconfig:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;eth0      Link encap:Ethernet  HWaddr fc:aa:14:86:fa:7d&lt;br&gt;&#xA;          inet addr:10.3.1.189  Bcast:10.3.1.255  Mask:255.255.255.0&#xA;          inet6 addr: fe80::feaa:14ff:fe86:fa7d/64 Scope:Link&#xA;          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1&#xA;          RX packets:164372 errors:0 dropped:0 overruns:0 frame:0&#xA;          TX packets:63584 errors:0 dropped:0 overruns:0 carrier:0&#xA;          collisions:0 txqueuelen:1000 &#xA;          RX bytes:68190717 (68.1 MB)  TX bytes:15708817 (15.7 MB)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;lo        Link encap:Local Loopback&lt;br&gt;&#xA;          inet addr:127.0.0.1  Mask:255.0.0.0&#xA;          inet6 addr: ::1/128 Scope:Host&#xA;          UP LOOPBACK RUNNING  MTU:65536  Metric:1&#xA;          RX packets:21861 errors:0 dropped:0 overruns:0 frame:0&#xA;          TX packets:21861 errors:0 dropped:0 overruns:0 carrier:0&#xA;          collisions:0 txqueuelen:0 &#xA;          RX bytes:2552283 (2.5 MB)  TX bytes:2552283 (2.5 MB)&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my netstat, grepping for the port is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dev@c1:~/tempdel$ netstat -atn | grep 63342&#xA;tcp        0      0 127.0.0.1:63342         0.0.0.0:*               LISTEN   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so, if I try &lt;code&gt;http://localhost:63342/test&lt;/code&gt;, it works, but if I try &lt;code&gt;http://10.3.1.189:63342/test&lt;/code&gt; I get an error (&lt;code&gt;Connecting to 10.3.1.189:63342... failed: Connection refused.&#xA;&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why can't I open the file with my 10.3.1.189 address, but I can with 127.0.0.1?&lt;/p&gt;&#xA;" OwnerUserId="15647" LastEditorUserId="775" LastEditDate="2015-06-20T16:24:35.120" LastActivityDate="2015-06-20T16:24:35.120" Title="netstat localhost and ifconfig ip address" Tags="|linux|" AnswerCount="2" CommentCount="1" ClosedDate="2015-05-29T21:28:29.867" ContentLicense="CC BY-SA 3.0" />
  <row Id="18775" PostTypeId="2" ParentId="18774" CreationDate="2015-05-27T21:45:58.937" Score="2" Body="&lt;p&gt;A 404 is an application specific error/response code which means immediately this is not a networking issue.  A networking issue would be a timeout or a reset or some sort of error like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means the first place to look is your web server logs.  Especially anything related to virtual hosts or listeners.  You want to make sure the ip 10.3.1.189 is registered to your application.&lt;/p&gt;&#xA;" OwnerUserId="15549" LastActivityDate="2015-05-27T21:45:58.937" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18776" PostTypeId="2" ParentId="18774" CreationDate="2015-05-27T21:53:10.073" Score="2" Body="&lt;p&gt;Your webserver isn't listening on 10.3.1.189, only on 127.0.0.1. The solution (which probably is off topic here) is to fix the webserver configuration so it's listening on that IP address.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-05-27T21:53:10.073" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18777" PostTypeId="1" CreationDate="2015-05-27T21:53:28.970" Score="1" ViewCount="857" Body="&lt;p&gt;I have two Dell switches and its a classical VLAN Scenario that does not want to work. &#xA;PowerConnect 6248 is connected to the outside world and from there i like to bring new subnet ( this is already done via ISP ) to new infrastructure that is connect to the other switch N3048. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP =====(port48) PowerConnect (port 11 and 12 as trunk)=====(port 11 and as trunk)N3048====(as access belong to VLAN 25)Servers.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So PowerConnect have many VLANs and works excellent, i have create this new VLAN 25 and this trunk ports. Also on port 48 i have enabled/allowed this new VLAN to go out to public. Make port 11 and 12 as trunks.&#xA;On the other switch port 11 and 12 are configured as trunks, and 20,21,22,23 are configured as access and assigned to VLAN 25 as it created. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So can somebody give some hints or tell me what is wrong with this scenario that does not work ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;simple configuration that i have on both switches&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface ethernet 1/g11&#xA;switchport mode trunk&#xA;&#xA;interface ethernet 1/g12&#xA;switchport mode trunk&#xA;&#xA;interface Gi1/0/11&#xA;switchport mode trunk&#xA;&#xA;interface Gi1/0/12&#xA;switchport mode trunk&#xA;&#xA;&#xA;interface Gi1/0/20,21,22,23 &#xA;switchport access VLAN 25 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also i have put this servers directly to the PowerConnect and they work excellent, so port 48 and ISP are ok. &lt;/p&gt;&#xA;" OwnerUserId="8017" LastEditorUserId="76" LastEditDate="2015-05-27T22:05:25.350" LastActivityDate="2015-05-27T22:05:25.350" Title="Dell Switch N3048 with PowerConnect 6248" Tags="|switch|vlan|dell|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18778" PostTypeId="1" AcceptedAnswerId="18816" CreationDate="2015-05-27T23:55:47.467" Score="0" ViewCount="6784" Body="&lt;p&gt;guys!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm noob to MikroTik's RouterBOARD and RouterOS and ended up finding it a bit confusing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I need is as simple as the title says: I need to create a website White-list; just that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to be able to block &lt;strong&gt;all websites&lt;/strong&gt; except those that are on the proposed White-list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15649" LastEditorUserId="8499" LastEditDate="2018-02-14T16:46:14.593" LastActivityDate="2018-02-14T16:46:14.593" Title="Mikrotik Website Whitelist" Tags="|firewall|" AnswerCount="2" CommentCount="2" ClosedDate="2017-08-09T23:52:44.327" ContentLicense="CC BY-SA 3.0" />
  <row Id="18781" PostTypeId="2" ParentId="18695" CreationDate="2015-05-28T07:11:12.200" Score="1" Body="&lt;p&gt;Not a lot of info here, but here goes...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot have a PC with an IP address of 128.107.33.10 and a PC with an IP address of 192.31.7.10 use a default gateway of 198.133.220.1/27.  Most operating systems will complain that the default gateway is not within the same network as the PC, but then I have no idea of the netmask on your PCs.  You have two easy options (without changing the config on R2 or using a massive subnet mask that encompasses both PCs):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you absolutely MUST keep the same IP addresses on the PCs...&#xA;You change the primary IP address on the FastEthernet 1 interface on R1 to be in the same network as the first PC and add a secondary IP address to the FastEthernet 1 to match the networks as defined on the second PC.  You would then need to add these networks into RIP and/or OSPF to distribute them to R2 (if you use both, the OSPF routes will show up and the RIP ones will be ignored, but that will still be OK).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You change the PCs to be in the range of 198.133.220.2 to 198.133.220.14 with the netmask 255.255.255.224.  You will also need to add a network statement to RIP and/or OSPF to advertise the 198.133.220.0/27 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are also best to change the serial interface that is connected between R1 and R2 to have both sides in the same subnet (though as it is, the magical PPP may make this work, it is not recommended and traceroutes will look strange).  I would also not run two routing protocols for no real reason and I would tidy the entire thing up (it needs a network redesign!), but I am assuming there are good reasons for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-- Ben&lt;/p&gt;&#xA;" OwnerUserId="15652" LastActivityDate="2015-05-28T07:11:12.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18782" PostTypeId="2" ParentId="9574" CreationDate="2015-05-28T07:57:35.830" Score="-2" Body="&lt;p&gt;On config line 12, the ACL specifying the tunnel end points should be of just 2 lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On config line 16, the tunnel peer specification should be the other&#xA;end @IP not an ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see the rules enabling &lt;code&gt;esp&lt;/code&gt; to pass.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This isn't really a network engineering problem.&lt;/p&gt;&#xA;" OwnerUserId="13986" LastActivityDate="2015-05-28T07:57:35.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18786" PostTypeId="1" CreationDate="2015-05-28T08:52:00.617" Score="1" ViewCount="1349" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/v7MEt.png&quot; alt=&quot;Topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is R1 successfully redirects www (port 80) packets to the Proxy1, i already setup the Host3 as Client with gateway 192.168.60.4/24(port fa1/0.60 on R1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i'm working with different VLANs so i'm following the explanation from this link &lt;a href=&quot;https://supportforums.cisco.com/discussion/11927251/squid-wccp-different-vlans&quot; rel=&quot;nofollow noreferrer&quot;&gt;WCCP with different VLANs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so i applied this config to the R1 port f1/0.60 - (Connected to VLAN 60/Client VLAN) : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet1/0.60&#xA; encapsulation dot1Q 60&#xA; ip address 192.168.60.4 255.255.255.0&#xA; ip wccp web-cache redirect in&#xA; ip nat inside&#xA; standby 60 ip 192.168.60.2&#xA; standby 60 priority 170&#xA; standby 60 preempt delay minimum 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here's the f/10.20 (Connected to VLAN 20/Proxy1) config :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet1/0.20&#xA; encapsulation dot1Q 20&#xA; ip address 100.10.20.1 255.255.255.0&#xA; ip nat inside&#xA; standby 20 ip 100.10.20.2 &#xA; standby 20 priority 120&#xA; standby 20 preempt delay minimum 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this is the ACL I used to determine the Proxy network and Client network&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 10 permit 100.10.30.3&#xA;access-list 10 permit 100.10.20.3&#xA;access-list 120 permit tcp any any eq www&#xA;access-list 120 deny   ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Proxy1 had an ip address 100.10.20.3 and here's the squid.conf config :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;http_port 3128 transparent&#xA;wccp2_router 100.10.20.1&#xA;wccp2_forwarding_method gre&#xA;wccp2_return_method gre&#xA;wccp2_assignment_metod hash&#xA;wccp2_service standard 0&#xA;acl localnet src 192.168.60.0/24, 100.10.20.0/28, 10.42.12.0/24, 120.100.10.0/28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem is, Router R1 doesn't redirects any packet to Proxy1 while I'm trying to access any website on internet via Host3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tech Specs : Mac OS X 10.9.5 - GNS3 1.3.3 - 3600 IOS Cisco Router&lt;/p&gt;&#xA;" OwnerUserId="15654" LastEditorUserId="3191" LastEditDate="2015-06-05T21:35:32.703" LastActivityDate="2015-06-05T21:35:32.703" Title="Cisco router doesn't redirects packets to proxy server - (working on GNS3 with 3600 routers + Ubuntu 14.04 + Squid 3.3)" Tags="|cisco|vlan|gns3|" AnswerCount="0" CommentCount="3" ClosedDate="2020-12-16T21:33:21.660" ContentLicense="CC BY-SA 3.0" />
  <row Id="18787" PostTypeId="2" ParentId="18745" CreationDate="2015-05-28T09:52:33.987" Score="2" Body="&lt;p&gt;I finally figured it out - I was quoting the filename, which seems to work just fine for other devices, such as Juniper devices, but not for Cisco IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was doing this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;scp -f &quot;system:running-config&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this is what works:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;scp -f system:running-config&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="15626" LastActivityDate="2015-05-28T09:52:33.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18792" PostTypeId="2" ParentId="17117" CreationDate="2015-05-28T13:52:33.147" Score="0" Body="&lt;p&gt;to avoid cable loss caused by feeder&lt;/p&gt;&#xA;" OwnerUserId="15661" LastActivityDate="2015-05-28T13:52:33.147" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18797" PostTypeId="2" ParentId="6934" CreationDate="2015-05-28T15:04:43.030" Score="0" Body="&lt;p&gt;Default configuration of a VLAN interface is &lt;code&gt;no ip address&lt;/code&gt;. Thus, by default the switch is not a DHCP client. (it has no address at all.) &lt;code&gt;ip address dhcp&lt;/code&gt; is the configuration to use DHCP.&lt;/p&gt;&#xA;" OwnerUserId="15663" LastEditorUserId="619" LastEditDate="2015-05-29T00:30:52.857" LastActivityDate="2015-05-29T00:30:52.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18798" PostTypeId="2" ParentId="18778" CreationDate="2015-05-28T15:25:07.290" Score="-1" Body="&lt;p&gt;You can try to use the integrated HTTP proxy in transparent mode&lt;/p&gt;&#xA;" OwnerUserId="1969" LastActivityDate="2015-05-28T15:25:07.290" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18800" PostTypeId="1" CreationDate="2015-05-28T15:32:28.660" Score="2" ViewCount="118" Body="&lt;p&gt;The context of my question is actually another question which is &quot;Why isn't ingress shaping possible?&quot;. So yes, I get the whole &quot;you can't affect packets you haven't received yet&quot; idea, but we can't drop a packet before we get it either, yet we are able to do so with policing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="14777" LastActivityDate="2015-05-29T00:18:20.253" Title="Signals wise, how does dropping an ingress packet due to policing look like?" Tags="|qos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18802" PostTypeId="2" ParentId="18771" CreationDate="2015-05-28T16:09:22.370" Score="2" Body="&lt;p&gt;The best answer will be to ask your ISP to either exchange your modem-router combo device for a modem-only device OR see if they can switch it into Bridge mode (where it becomes only a modem and no longer acts as a router). [I have a Cisco modem-router device from my cable ISP that is like that, I called them and they did something on their end then had me reboot it and it was no longer a router]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you CAN'T do that (or if you need to get up and running fast) then you CAN connect your SonicWALL behind the modem-router device, it will be double-NAT. Some services will be less happy about that but most won't care.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Just configure X1/WAN with an IP on the 10.0.0.0/24 subnet.&lt;/strong&gt; Your LAN clients (on 192.168.168.0/24) will be NAT'd by the SonicWALL to a 10.0.0.x IP and then NAT'd again by the modem-router device to your actual public IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For outbound this isn't an issue. For &lt;strong&gt;INBOUND&lt;/strong&gt; you will need to open ports on your modem-router (pointing to your X1/WAN IP) as well as create NAT rules on your SonicWALL. Or you can look for a &quot;DMZ&quot; option in the modem-router which forwards all ports to the specified IP (basically a wide-open ANY/ANY/ANY NAT rule) -- common on consumer grade routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Some of these modem-router combo devices (which, to be honest are not great, and not designed for business use) will only perform NAT/pass-traffic for IPs it has assigned by DHCP, in that case you may need to set X1/WAN to DHCP and have it obtain an IP from the modem-router device. If yours is a 2wire brand this may be the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured a SonicWALL NSA 240 (the precursor to the 220) behind another router doing NAT and it wasn't a problem, I just had to create rules on both. The only limitation is that the SonicWALL won't allow the same subnet on two interfaces so you can't also use 10.0.0.0/24 for your LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But if I were you I would contact the ISP and ask to either get them to switch it to Bridge Mode (if possible) or exchange it for an actual DSL modem: so the SonicWALL gets the Public IP on the X1/WAN IP (using Static, PPPoE, DHCP, etc).&lt;/strong&gt; If not you will be limited by the speed/resources/abilities of the combo device which I suspect are not nearly as robust as the NSA 220.&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-05-28T16:09:22.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18803" PostTypeId="1" AcceptedAnswerId="18805" CreationDate="2015-05-28T16:09:48.977" Score="0" ViewCount="223" Body="&lt;p&gt;Honestly, I just know some basics about subnetting and hosts, but how can you determine how many hosts would be in the following IP 10.10.0.0/22?&lt;/p&gt;&#xA;" OwnerUserId="15666" LastActivityDate="2015-05-28T16:41:32.280" Title="How many hosts are in the following IP?" Tags="|subnet|ip|" AnswerCount="1" CommentCount="4" ClosedDate="2015-05-28T17:14:25.567" ContentLicense="CC BY-SA 3.0" />
  <row Id="18805" PostTypeId="2" ParentId="18803" CreationDate="2015-05-28T16:41:32.280" Score="2" Body="&lt;p&gt;for any host x.x.x.x/n&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you have 32 - n bits available&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which means&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2^(32 - n)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but one of these needs to be a broadcast ip and one of them needs to be a netowrk ip, so&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2^(32 - n) - 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for your specific question&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/22 = 2^10 - 2 = 1022&lt;/p&gt;&#xA;" OwnerUserId="15549" LastActivityDate="2015-05-28T16:41:32.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18808" PostTypeId="1" CreationDate="2015-05-28T21:12:58.960" Score="3" ViewCount="160" Body="&lt;p&gt;(newbie Cisco here)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an IPSEC vpn site to site tunnel between two ASAs. I have a set of networks in each location protected by the VPN tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, so good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to also protect traffic originated by the remote ASA, because I have an authentication server on this side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15671" LastEditorUserId="13479" LastEditDate="2015-05-29T09:32:35.350" LastActivityDate="2015-06-15T20:44:57.963" Title="Protect traffic originated in remote Cisco ASA" Tags="|cisco|cisco-asa|vpn|ipsec|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18809" PostTypeId="2" ParentId="18800" CreationDate="2015-05-29T00:18:20.253" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I get the whole ...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Apparently not. Your router cannot do anything with or about a packet until it has crossed the wire and arrived at the router. At &lt;em&gt;that&lt;/em&gt; point, it can drop it. However, at that point, bandwidth has already been used. &quot;Policing&quot; doesn't change that.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-29T00:18:20.253" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18811" PostTypeId="2" ParentId="18808" CreationDate="2015-05-29T01:04:31.980" Score="2" Body="&lt;p&gt;&lt;code&gt;management-access    Configure management access interface&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, that's a the global configuration command to tell the system what interface is used for management (i.e. any traffic generated by the ASA itself.) Cisco's documentation fails to mention that, btw.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-05-29T01:04:31.980" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18816" PostTypeId="2" ParentId="18778" CreationDate="2015-05-29T08:02:59.993" Score="1" Body="&lt;p&gt;On the mikrotik wiki there are lot of examples on how to use the http proxy feature.&#xA;Anyway:&#xA;On the IP/Proxy menu you can set the options of the embedded http proxy: in the &quot;&lt;em&gt;/ip proxy access&lt;/em&gt;&quot; part you can define you access policies in terms of http host names or ip addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, you have two options to make it working as a trasparent proxy.&#xA;A fully trasparent proxy means that the users do not have to configure it in their browser.&#xA;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/How_to_make_transparent_web_proxy&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/How_to_make_transparent_web_proxy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BUT, doing so, you cannot filter HTTPS protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to filter also https using your proxy, I can advise to use a &quot;proxy auto-discover&quot; mechanism, like WPAD.&#xA;&lt;a href=&quot;http://findproxyforurl.com/wpad-introduction/&quot; rel=&quot;nofollow&quot;&gt;http://findproxyforurl.com/wpad-introduction/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this enough to start?&lt;/p&gt;&#xA;" OwnerUserId="1969" LastActivityDate="2015-05-29T08:02:59.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18818" PostTypeId="1" CreationDate="2015-05-29T10:57:04.807" Score="1" ViewCount="596" Body="&lt;p&gt;I would like to know which network protocols are used for media streaming by online music and video sites ?&lt;/p&gt;&#xA;" OwnerUserId="15677" LastEditorUserId="775" LastEditDate="2015-06-20T16:24:00.183" LastActivityDate="2015-06-20T16:24:00.183" Title="Which network protocol is used for media streaming from online music or video sites?" Tags="|layer3|transport-protocol|streaming|" AnswerCount="2" CommentCount="2" ClosedDate="2015-05-29T20:50:13.653" ContentLicense="CC BY-SA 3.0" />
  <row Id="18819" PostTypeId="2" ParentId="18770" CreationDate="2015-05-29T11:08:14.317" Score="0" Body="&lt;p&gt;Stations are connected to internal network or into a public network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a) Internal network: just configure your DHCP server to assign fixed IP address to station by binding a specific IP to the MAC of your station.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b) Public network: If the station is connected to public network through a router you should check if you can establish a site2site VPN. Is possible that you have to configure a different network for each station.&lt;/p&gt;&#xA;" OwnerUserId="14771" LastActivityDate="2015-05-29T11:08:14.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18820" PostTypeId="2" ParentId="3602" CreationDate="2015-05-29T11:29:56.110" Score="5" Body="&lt;p&gt;Yes, the Fortigate FG-60D and it's sibling FortiWifi FWF-60D are both fanless. I've seen and sold a lot of them.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2015-05-29T11:29:56.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18821" PostTypeId="2" ParentId="18818" CreationDate="2015-05-29T13:29:17.047" Score="0" Body="&lt;p&gt;If by music and video sites, you mean web servers you can access with a web browser, then the protocol in use is the one you see at the beginning of the URL within your web browser, ex.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;https://www.spotify.com/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;. It is plain HTTP (i.e. 80/tcp) or HTTPS (i.e. 443/tcp).&lt;/p&gt;&#xA;" OwnerUserId="13986" LastActivityDate="2015-05-29T13:29:17.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18822" PostTypeId="2" ParentId="18770" CreationDate="2015-05-29T13:46:22.180" Score="1" Body="&lt;p&gt;Before looking at your addressing plan managment through DDNS, I advise you to look at something much more traditionnal and which works with sone SCADA networks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure a DHCP server on your SCADA supervision server or on a completly independant server dedicated to the adressing plan managment and the static IP broadcasting.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Collect all the @MAC of your SCADA clients and enter them within the DHCP configuration file.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Next, if you want to differientate different classes of SCADA clients through names, I suggest you start up on the same addressing plan managment server a DNS server so as to be able to name clients through names like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;02-RC.ddc-4000.scada.mydomain&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13986" LastActivityDate="2015-05-29T13:46:22.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18825" PostTypeId="1" CreationDate="2015-05-29T15:03:22.747" Score="0" ViewCount="85" Body="&lt;p&gt;I have a client-server network in which the client has two interfaces on two different network. Say that ethO has ip address 10.0.0.10 and eth1 20.0.0.10&lt;br&gt;&#xA;The client has two gateways 10.0.0.1 and 20.0.0.1 respectively (two routing tables). eth0 and eth1 is connected to the router through link 0 and link 1 resp. &#xA;The server has ip address 30.0.0.10&lt;br&gt;&#xA;I want the router to be able to route packets to eth1 through link 0 (for e.g when link 1 is broken). Is it possible to do dynamically ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;client   (link 0)      Router&amp;nbsp;&amp;nbsp;&amp;nbsp;        Server&lt;br&gt;&#xA;|eth0  |---------|++|---------| |&lt;br&gt;&#xA;|eth1  |---------|++|&lt;br&gt;&#xA;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;         (link 1)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(note : I'm using MPTCP both on client &amp;amp; server)&lt;/p&gt;&#xA;" OwnerUserId="10654" LastActivityDate="2015-05-29T16:02:07.087" Title="multipath routing" Tags="|routing|tcp|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-11T17:01:34.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="18826" PostTypeId="2" ParentId="18825" CreationDate="2015-05-29T16:02:07.087" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Set the router ip address on interface vlan or some logical interface that have the ability to 'reach' the two interfaces toward client.&lt;/li&gt;&#xA;&lt;li&gt;Set br0 interface and add eth0 and eth1 to this interface on client side.&lt;/li&gt;&#xA;&lt;li&gt;Ensure STP is allowed on the vlan used for this router-client connectivity.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This way if eth0 going down eth1 will become the active port. Else eth0 is active and eth1 is in STP blocking state.&lt;/p&gt;&#xA;" OwnerUserId="15573" LastActivityDate="2015-05-29T16:02:07.087" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18827" PostTypeId="2" ParentId="18818" CreationDate="2015-05-29T16:15:44.833" Score="0" Body="&lt;p&gt;There are many network protocols at play.  Some at the network layer (IP), some at the transport layer (TCP / UDP).  Then there are formats or codecs for the media such as mp3 and mp4 and webm.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-29T16:15:44.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18828" PostTypeId="1" AcceptedAnswerId="18829" CreationDate="2015-05-29T16:49:04.010" Score="2" ViewCount="382" Body="&lt;p&gt;I have a Cisco router with NM-16ESW switch module (all virtual, on GNS3). Switch is connected to a router and two hosts and there is heavy simulated traffic passing through the switch. However, interface counters show zero input and output. What could be the cause of this issue?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ESW3#show int counters&#xA;&#xA;Port            InOctets   InUcastPkts   InMcastPkts   InBcastPkts&#xA;Fa1/0                  0             0             0             0&#xA;Fa1/1                  0             0             0             0&#xA;Fa1/2                  0             0             0             0&#xA;Fa1/3                  0             0             0             0&#xA;Fa1/4                  0             0             0             0&#xA;Fa1/5                  0             0             0             0&#xA;Fa1/6                  0             0             0             0&#xA;Fa1/7                  0             0             0             0&#xA;Fa1/8                  0             0             0             0&#xA;Fa1/9                  0             0             0             0&#xA;Fa1/10                 0             0             0             0&#xA;Fa1/11                 0             0             0             0&#xA;Fa1/12                 0             0             0             0&#xA;Fa1/13                 0             0             0             0&#xA;Fa1/14                 0             0             0             0&#xA;Fa1/15                 0             0             0             0&#xA;&#xA;Port           OutOctets  OutUcastPkts  OutMcastPkts  OutBcastPkts&#xA;Fa1/0                  0             0             0             0&#xA;Fa1/1                  0             0             0             0&#xA;Fa1/2                  0             0             0             0&#xA;Fa1/3                  0             0             0             0&#xA;Fa1/4                  0             0             0             0&#xA;Fa1/5                  0             0             0             0&#xA;Fa1/6                  0             0             0             0&#xA;Fa1/7                  0             0             0             0&#xA;Fa1/8                  0             0             0             0&#xA;Fa1/9                  0             0             0             0&#xA;Fa1/10                 0             0             0             0&#xA;Fa1/11                 0             0             0             0&#xA;Fa1/12                 0             0             0             0&#xA;Fa1/13                 0             0             0             0&#xA;Fa1/14                 0             0             0             0&#xA;Fa1/15                 0             0             0             0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15681" LastActivityDate="2015-05-29T20:35:56.133" Title="Cisco switch showing zero input/output while there is traffic" Tags="|cisco|switch|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18829" PostTypeId="2" ParentId="18828" CreationDate="2015-05-29T17:33:04.543" Score="4" Body="&lt;p&gt;The cause of this is most likely GNS3.  Virtual/emulated platforms simply won't have all the same characteristics and behaviors as real hardware.&lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2015-05-29T17:33:04.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18831" PostTypeId="2" ParentId="18828" CreationDate="2015-05-29T20:35:56.133" Score="4" Body="&lt;p&gt;While GNS3 can somewhat emulate a switch functionality by utilizing the NM-16ESW, it cannot do so fully because of the same reasons it can't emulate a switch.  Many of the features are simply embedded into the hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since switch forwarding is often done only in hardware, the processes to provide statistics about that traffic are also in hardware. Without those processes to feed the data back to the router, you end up with no statistics for those ports.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-05-29T20:35:56.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18832" PostTypeId="1" CreationDate="2015-05-29T23:28:05.743" Score="0" ViewCount="197" Body="&lt;p&gt;I can't seem to figure out the difference between the ssh options -L -D -W and -w .. They all appear to offer some variation of tunneling, but I'm not too proficient in networking, and the manpage doesn't offer much.  Can somebody point me in the direction of a thorough layman's explanation of this, or offer one here?&lt;/p&gt;&#xA;" OwnerUserId="15684" LastActivityDate="2015-05-30T08:06:40.173" Title="explanation of ssh tunnel and forwarding options" Tags="|ssh|tunnel|" AnswerCount="1" CommentCount="0" ClosedDate="2015-06-02T12:51:24.313" ContentLicense="CC BY-SA 3.0" />
  <row Id="18833" PostTypeId="1" CreationDate="2015-05-30T00:25:01.530" Score="2" ViewCount="3031" Body="&lt;p&gt;I am learning about OSPF Routing which is a dynamic routing protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/h5fet.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have questions with regards to commands on the router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do the commands end with &lt;code&gt;0.0.0.255 area 0&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does &lt;code&gt;0.0.0.255&lt;/code&gt; mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does &lt;code&gt;area 0&lt;/code&gt; mean?&lt;/p&gt;&#xA;" OwnerUserId="3723" LastEditorUserId="8499" LastEditDate="2018-12-22T02:35:40.843" LastActivityDate="2018-12-22T02:35:40.843" Title="Why do OSPF route commands end with 0.0.0.255" Tags="|cisco|routing|router|ospf|cisco-commands|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18834" PostTypeId="2" ParentId="18833" CreationDate="2015-05-30T00:32:42.750" Score="5" Body="&lt;p&gt;An OSPF domain is broken up into areas, and every area connects to area 0.  The area portion of the command tells OSPF which area to put the interface(s) using address(es) in that range into.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;0.0.0.255&quot; is a wildcard mask (inverse of the prefix mask).  It tells OSPF the range to use for selecting the interfaces for that network statement.  The &quot;network 10.0.1.0 0.0.0.255 area 0&quot; means any interfaces in the 10.0.1.0/24 prefix will be in area 0.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-05-30T00:56:32.897" LastActivityDate="2015-05-30T00:56:32.897" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18837" PostTypeId="2" ParentId="18832" CreationDate="2015-05-30T07:27:55.910" Score="2" Body="&lt;p&gt;Here are some example use cases. I have used the first and the second, and think I understand the third. The last one is new to me, but this seems roughly right for it.&lt;/p&gt;&#xA;&lt;h2&gt;ssh -D 1234 tess@remotecomputer&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Connect to remotecomputer and log in as me.&lt;/p&gt;&#xA;&lt;p&gt;SSH Client opens port 1234 on my local workstation and starts listening as a &lt;a href=&quot;http://en.wikipedia.org/wiki/SOCKS&quot; rel=&quot;nofollow noreferrer&quot;&gt;SOCKS&lt;/a&gt; proxy.&lt;/p&gt;&#xA;&lt;p&gt;I open FireFox on my local workstation and configure it to use a SOCKS proxy, &amp;quot;localhost:1234&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Browsing the web, Firefox connects to my local workstation port 1234, SSH client accepts the connection. Passes the traffic over the SSH tunnel to the remotecomputer. SSH Server on remotecomputer sends the traffic out to any destination website I want to get to (that's the 'Dynamic' destination).&lt;/p&gt;&#xA;&lt;p&gt;Return traffic comes back to the SSH server on remotecomputer, which returns it over the SSH connection, SSH Client returns it to FireFox.&lt;/p&gt;&#xA;&lt;p&gt;Only applications that can use the SOCKS protocol as a proxy can make use of this method, but they can use it to connect to anywhere.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h2&gt;ssh -L 1234:server2:3389 tess@remotecomputer&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Connect to remotecomputer and log in as me.&lt;/p&gt;&#xA;&lt;p&gt;SSH Client opens port 1234 on my local workstation as a basic TCP network listening socket.&lt;/p&gt;&#xA;&lt;p&gt;I open Remote Desktop Client on my local workstation and connect to &lt;em&gt;localhost:1234&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;SSH client answers the connection and sends the data over the SSH tunnel.&lt;/p&gt;&#xA;&lt;p&gt;SSH server on remotecomputer sends the traffic to &lt;em&gt;server2&lt;/em&gt; port &lt;em&gt;3389&lt;/em&gt; (the remote desktop port). Return trafic comes back to SSH Server and back over the SSH tunnel and out to the RDP client.&lt;/p&gt;&#xA;&lt;p&gt;This configuration is not dynamic, traffic can only go to the host and port I specified on the command line - however almost any program that uses standard TCP/IP can use this method to connect through an SSH tunnel.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h2&gt;ssh -W mail:25 tess@remotecomputer&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Connect to remotecomputer and authenticate as me, but don't login - don't start the bash shell, don't run any logon scripts.&lt;/p&gt;&#xA;&lt;p&gt;Open a TCP connection from SSH Server on remotecomputer to host &amp;quot;mail&amp;quot; port 25 (SMTP)&lt;/p&gt;&#xA;&lt;p&gt;Send anything I type (or anything from my standard input) over the SSH tunnel to remotecomputer, and out to the SMTP listener on &amp;quot;mail&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Anything it returns comes back to SSH Server on remotecomputer, back over the SSH tunnel and straight to my screen / standard output.&lt;/p&gt;&#xA;&lt;p&gt;This method is tunnelling unix pipes on the local side, and connecting them to network sockets on the remote side.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h2&gt;ssh -w 5:5 tess@remotetecomputer&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Connect to remotecomputer and log in as me.&lt;/p&gt;&#xA;&lt;p&gt;SSH Client on my local workstation creates a new virtual network interface, like eth0 is a physical network interface. The new one is called tun5.&lt;/p&gt;&#xA;&lt;p&gt;I can configure tun5 like any other interface, give it an IP address.&lt;/p&gt;&#xA;&lt;p&gt;SSH Server on remotecompter also creates a new virtual network interface, tun5, which I can configure.&lt;/p&gt;&#xA;&lt;p&gt;Configure them both on the same subnet and they can talk IP over the SSH tunnel.&lt;/p&gt;&#xA;&lt;p&gt;Now I can use routing with them, use firewall rules, it looks like a VPN between the two computers / two sides, but requiring more configuration (e.g. IP routing) on the computers to make use of. The combined advantages of the -D dynamic-forwarding and the -L any-network-program-can-use-this-limited-forwarding.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2880" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-05-30T08:06:40.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18838" PostTypeId="1" CreationDate="2015-05-30T09:16:31.667" Score="3" ViewCount="477" Body="&lt;p&gt;I have watched a video &lt;a href=&quot;https://www.youtube.com/watch?v=PJ67X_RTlLM&quot; rel=&quot;nofollow noreferrer&quot;&gt;explaining assymetric routing&lt;/a&gt; today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this video, two solutions to AR (among others) are shown:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First solution:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4UPfT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second solution:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/kTgOG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the advantages of the second solution exactly? Why do firewalls &lt;em&gt;often care about Session State&lt;/em&gt;?&lt;/p&gt;&#xA;" OwnerUserId="15586" LastEditorUserId="15586" LastEditDate="2015-05-30T11:55:03.127" LastActivityDate="2015-06-13T19:21:51.903" Title="What are the advantages of having a router instead of a firewall in this case?" Tags="|routing|firewall|asymmetric-routing|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18839" PostTypeId="1" CreationDate="2015-05-30T09:53:32.543" Score="4" ViewCount="5456" Body="&lt;p&gt;1) I am able to create VLAN on Juniper QFX5100 but when I am assigning     interface to that VLAN it is showing an error &quot;family ethernet-switching and other families are mutually exclusive&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Command used is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vlans Customer1 vlan-id 11&#xA;&#xA;set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members Customer1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On this interface I have already configured IP address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) But when I am creating vlans on some other port with nothing configured on it, I am able to create the vlan &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Command used is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vlans Customer1 vland-id 11&#xA;&#xA;Set interfaces ge-0/0/20.0 family ethernet-switching vlan members Customer1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This interface does not have any IP address configured on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And 1 more thing I would like to add is in 2nd query in commands if I am not adding .0 to the interface (i.e. ge-0/0/20.0) it will not showing me option of family after interface ge-0/0/20.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help me to resolve this issue as i am just new to Juniper.&lt;/p&gt;&#xA;" OwnerUserId="15690" LastEditorUserId="2461" LastEditDate="2015-05-30T14:19:03.460" LastActivityDate="2015-07-06T14:36:18.047" Title="VLAN Creation on Juniper QFX5100" Tags="|vlan|juniper-junos|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18841" PostTypeId="2" ParentId="18838" CreationDate="2015-05-30T10:59:24.707" Score="3" Body="&lt;p&gt;I watched the video and thought it only explained a very specific case of AR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A stateful firewall enforces the TCP protocol rules.  If, for example, I want my internal users to browse to the Internet, but no one from the Internet can connect to my internal systems, I can use a stateful firewall to enforce the rule that when packet is received from the Internet, it must match an already existing connection.  That is, the internal and external devices have already established a TCP connection by following the protocol rules known as the &quot;3-way handshake.&quot; Further, the firewall doesn't allow a packet with the SYN flag set to enter from the Internet (because I don't want connections originating from the Internet).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firewall enforces these rules by monitoring the &quot;state&quot; of each data flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem of asymmetrical routing can occur when I have two connections to the Internet and two firewalls.   Packets may leave through firewall A, but return through firewall B.  In that case, firewall A sees the SYN packet go out and will monitor that state of that connection.  But when firewall B sees the SYN-ACK reply packet come in form the outside, it has nothing to match it against. It doesn't know about the packet that firewall A saw, so it treats the SYN-ACK packet as a protocol violation and drops it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the 2nd solution, all packets pass through the firewall, so it can correctly monitor the state of each connection.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-05-30T10:59:24.707" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18842" PostTypeId="1" AcceptedAnswerId="18845" CreationDate="2015-05-30T13:52:07.813" Score="1" ViewCount="409" Body="&lt;p&gt;I need to create a (fictional) network for a 3 storey office building. According to the EU-norms there should be 2 RJ-45 sockets for 10m2 of the office space. I've already designed structured cabling, so I know that there will be 58 RJ-45 sockets on each floor. I decided that this is going to be a Gigabit ethernet in the building, because this would give ca. 20Mb/s per socket which is enough for this project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I need to choose devices for this project. From what I've learned I decided that there should be one MDF on the ground floor and IDF's on other floors. &#xA;In the MDF I need a router which would handle 4Gb/s and a core switch from which the network will be distributed to the IDFs on the other floors.&#xA;In IDFs I need two routers with 48 ports (since I haven't found anything with more ports).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to pick devices by myself, but for a noob like me it's a little bit like magic. I've picked following devices, but I guess that these are much too expensive and &quot;too good&quot; for this network.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switches for IDFs: 2xCisco WS-C3650-48TS-S &lt;/li&gt;&#xA;&lt;li&gt;Switch for MDF: Cisco&#xA;WS-C3650-48TQ-S &lt;/li&gt;&#xA;&lt;li&gt;Router for MDF: Cisco Catalys 6503-E&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How can I optimize the cost of this network and which devices (or devices families) I should pick from?&lt;/p&gt;&#xA;" OwnerUserId="15693" LastActivityDate="2015-05-30T16:36:47.610" Title="Which network devices should I use in a small office network for ~200 users?" Tags="|cisco|switch|router|ethernet|lan|" AnswerCount="1" CommentCount="1" ClosedDate="2015-06-01T20:53:40.587" ContentLicense="CC BY-SA 3.0" />
  <row Id="18843" PostTypeId="1" CreationDate="2015-05-30T15:21:42.810" Score="3" ViewCount="37926" Body="&lt;p&gt;Why does most routers has default ip gateway 192.168.1.1? How do I change the gateway? If it gets changed, does every pc connected get a modified ip?&lt;/p&gt;&#xA;" OwnerUserId="15695" LastEditorUserId="-1" LastEditDate="2021-11-11T13:19:38.533" LastActivityDate="2021-11-11T13:19:38.533" Title="Why is 192.168.1.1 the most common default router gateway?" Tags="|router|ip|" AnswerCount="3" CommentCount="1" ClosedDate="2015-06-02T12:03:26.517" ContentLicense="CC BY-SA 4.0" />
  <row Id="18845" PostTypeId="2" ParentId="18842" CreationDate="2015-05-30T16:36:47.610" Score="1" Body="&lt;p&gt;Access: 4x (or 5x) Cisco WS-C2960X-48TS-LL&lt;br&gt;&#xA;Core: 2x Cisco WS-C3850-12S-E&lt;br&gt;&#xA;SFPs: double the uplink count&lt;br&gt;&#xA;deploy aqua colored OM3-OM4 fiber between floors for future 10G&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-30T16:36:47.610" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18846" PostTypeId="2" ParentId="18838" CreationDate="2015-05-30T16:45:32.177" Score="0" Body="&lt;p&gt;The second diagram is shows a misconfigured network.  The packets should not be traversing a default gateway on the same LAN/subnet as the true gateway to the destination.  If the WAN router is in fact behind the LANs DG then the link should reflect that and not be connected to the switch but to the router.  The WAN router should be on a different subnet than the LAN DG.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-30T16:45:32.177" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18847" PostTypeId="2" ParentId="18180" CreationDate="2015-05-30T16:48:26.653" Score="-1" Body="&lt;p&gt;STP could work but I would probably use &lt;a href=&quot;http://www.manualslib.com/manual/791538/Cisco-Catalyst-3750-X.html?page=825&quot; rel=&quot;nofollow&quot;&gt;EEM&lt;/a&gt; and script up a custom solution.  You should be able to beat STP in terms of failover and failback speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe use &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/address-resolution-protocol-arp/118630-technote-ipdt-00.html&quot; rel=&quot;nofollow&quot;&gt;IP Device Tracking&lt;/a&gt; to detect the switch peer across the primary link and upon failure detection admin up the backup link.  Maybe you could kick start the re-routing of frames by scripting in the MAC address of the remote backup link to the CAM table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have a lab so...  ...just an idea.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-12-27T01:50:43.677" LastActivityDate="2015-12-27T01:50:43.677" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18849" PostTypeId="2" ParentId="18186" CreationDate="2015-05-30T17:00:49.557" Score="0" Body="&lt;p&gt;Data Sheet says: Embedded IP Security with Secure Sockets Layer (IPSec/SSL) VPN hardware acceleration&lt;br&gt;&#xA;●  Embedded hardware encryption acceleration is enhanced to provide higher scalability, which, combined with an optional Cisco IOS Software Security license, enables WAN link security and VPN services (both IPSec and SSL acceleration).&lt;br&gt;&#xA;●  The onboard encryption hardware outperforms the advanced integration modules (AIMs) of previous generations.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-30T17:00:49.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18852" PostTypeId="1" AcceptedAnswerId="18899" CreationDate="2015-05-30T17:52:54.183" Score="1" ViewCount="1087" Body="&lt;p&gt;I have built a MultiVRF test scenario, it's working as intended but my question is, how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a tricky scenario, the VRFs between CE and PE have different RT and RD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gJys4.jpg&quot; alt=&quot;Sceneario&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the configs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf RED&#xA; rd 65000:1&#xA; route-target export 65000:1&#xA; route-target import 65000:1  &#xA;!&#xA;interface Loopback900&#xA; ip vrf forwarding RED&#xA; ip address 1.1.1.1 255.255.255.255&#xA;!&#xA;&#xA;interface FastEthernet0/0.900&#xA; encapsulation dot1Q 900&#xA; ip vrf forwarding RED&#xA; ip address 192.168.0.2 255.255.255.252&#xA;!&#xA;&#xA;router bgp 65000&#xA; address-family ipv4 vrf RED&#xA;  neighbor 192.168.0.1 remote-as 3352&#xA;  neighbor 192.168.0.1 activate&#xA; neighbor 192.168.0.1 send-community extended&#xA;&#xA;  no synchronization&#xA;  network 1.1.1.1 mask 255.255.255.255&#xA; exit-address-family&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf RED&#xA; rd 3352:50&#xA; route-target export 3352:50&#xA; route-target import 3352:50&#xA;!&#xA;&#xA;interface Loopback900&#xA; ip vrf forwarding RED&#xA; ip address 2.2.2.2 255.255.255.255&#xA;!&#xA;&#xA;interface FastEthernet0/0.900&#xA; encapsulation dot1Q 900&#xA; ip vrf forwarding RED&#xA; ip address 192.168.0.1 255.255.255.252&#xA;!&#xA; address-family ipv4 vrf RED&#xA;  neighbor 192.168.0.2 remote-as 65000&#xA;  neighbor 192.168.0.2 activate&#xA;  neighbor 192.168.0.2 send-community extended&#xA;  no synchronization&#xA;  network 2.2.2.2 mask 255.255.255.255&#xA; exit-address-family&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh ip bgp vpnv4 all 2.2.2.2&#xA;BGP routing table entry for 65000:1:2.2.2.2/32, version 6&#xA;Paths: (1 available, best #1, table RED)&#xA;Flag: 0x820&#xA;  Not advertised to any peer&#xA;  3352&#xA;    192.168.0.1 from 192.168.0.1 (2.2.2.2)&#xA;      Origin IGP, metric 0, localpref 100, valid, external, best&#xA;      Extended Community: **RT:65000:1**&#xA;      mpls labels in/out 16/nolabel&#xA;&#xA;R1#ping vrf RED 2.2.2.2&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 2.2.2.2, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 16/28/36 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sh ip bgp vpnv4 all 1.1.1.1&#xA;BGP routing table entry for 3352:50:1.1.1.1/32, version 5&#xA;Paths: (1 available, best #1, table RED)&#xA;Flag: 0x820&#xA;  Not advertised to any peer 65000&#xA;    192.168.0.2 from 192.168.0.2 (172.16.1.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external, best&#xA;      Extended Community: RT:3352:50&#xA;      mpls labels in/out 18/nolabel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So from R2's perspective I see 1.1.1.1 with 3352:50 even though R1 is exporting the route with 65000:1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do I see on each router the vpn4 route with its own RD and RT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe there is something obvious I'm missing but I can't seem to find the answer.&lt;/p&gt;&#xA;" OwnerDisplayName="user15697" LastEditorDisplayName="user10222" LastEditDate="2015-06-01T20:54:04.693" LastActivityDate="2015-06-02T05:22:14.080" Title="MultiVRF (Cisco) Scenario - Route Target Imports" Tags="|cisco|bgp|vrf|vrf-lite|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18853" PostTypeId="2" ParentId="18843" CreationDate="2015-05-30T19:04:57.007" Score="8" Body="&lt;p&gt;There are various non-routable (private) address ranges.  See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc1918&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Private_network&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://en.wikipedia.org/wiki/Private_network&lt;/a&gt; for details.  The various ranges allow for varying numbers of subnets and hosts within a subnet.  The reason 192.168.1.1 is so common is that it falls within the smallest private address space (192.168.0.0 - 192.168.255.255)... home networks, relative to business networks, are very typically small so the larger private address spaces (172.16.0.0 - 172.31.255.255 and 10.0.0.0 - 10.255.255.255).&lt;/p&gt;&#xA;&lt;p&gt;It's not possible to provide specific assistance with changing the configuration of your router without knowing what make/model it is (and version of software it is running). I can simply suggest you to look into changing its &amp;quot;internal&amp;quot; interface IP address.  The configuration of the interface/network will determine the clients' configurations.&lt;/p&gt;&#xA;&lt;p&gt;For example, in a typical residential broadband connection, if you change your internal interface from 192.168.1.1 (subnet mask 255.255.255.0, network 192.168.1.0, broadcast 192.168.1.255) to 10.0.0.1 (subnet mask 255.0.0.0, network 10.0.0.0, broadcast 10.255.255.255) the clients' gateways will be 10.0.0.1.&lt;/p&gt;&#xA;&lt;p&gt;Your questions are actually very broad so I hope the above helps and gets you started searching further.&lt;/p&gt;&#xA;" OwnerUserId="6317" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-05-31T07:35:23.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18854" PostTypeId="2" ParentId="18843" CreationDate="2015-05-30T20:10:51.163" Score="-1" Body="&lt;p&gt;I believe is because it's easy for remembering - knowing that the router is part of the C network (if we speak for home or small business network), you can easily guess what is his default gateway - they are usually 192.168.0.1/1.1 or 2.1; and yes, you can change it by the router settings, under LAN settings menu.&lt;/p&gt;&#xA;" OwnerUserId="15483" LastActivityDate="2015-05-30T20:10:51.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18855" PostTypeId="1" AcceptedAnswerId="18856" CreationDate="2015-05-30T20:19:46.650" Score="0" ViewCount="96" Body="&lt;p&gt;When exactly does a Dynamic DNS client update IP on the Dynamic DNS provider?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible that for some short period of time (after the IP from the ISP has changed) the DNS hostname would not be linked to the correct IP?&lt;/p&gt;&#xA;" OwnerUserId="15586" LastEditorUserId="775" LastEditDate="2015-05-31T14:24:39.040" LastActivityDate="2015-05-31T14:24:39.040" Title="How does Dynamic DNS know when to update IP address in the Dynamic DNS provider?" Tags="|dns|" AnswerCount="1" CommentCount="1" ClosedDate="2015-06-02T02:30:43.987" ContentLicense="CC BY-SA 3.0" />
  <row Id="18856" PostTypeId="2" ParentId="18855" CreationDate="2015-05-30T20:44:40.523" Score="1" Body="&lt;p&gt;Whenever you configure it to. Yes, that's possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally the client is integrated into a router, and at the point it receives an IP from the ISP it can trigger an update, but if it's running on a computer inside the network all it can do is check regularly, and it can be wrong until the next check.&lt;/p&gt;&#xA;" OwnerUserId="2880" LastActivityDate="2015-05-30T20:44:40.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18857" PostTypeId="1" AcceptedAnswerId="18961" CreationDate="2015-05-30T20:48:17.933" Score="4" ViewCount="5756" Body="&lt;p&gt;I have connected my SonicWall NSA220 to LDAP and obtained available user accounts, now I would like to give every user/group BW rules, for example&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set user for guaranteed speed of 1Mb and max speed of 2Mb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I would like to know if I can set a user for 1Mb of speed with maximum of 2 GB of download per day then have it reduced automatically to 256Kb after consuming his 2 GB for the day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I would like to know if I can put such rules on applications instead of users.&lt;/p&gt;&#xA;" OwnerUserId="14326" LastActivityDate="2015-06-04T18:04:46.563" Title="SonicWall : Bandwidth Management Per User" Tags="|sonicwall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18858" PostTypeId="2" ParentId="18843" CreationDate="2015-05-31T01:37:33.383" Score="-1" Body="&lt;p&gt;like user1801810 said 192.168.xxx.xxx /24  (255.255.255.0) is a class C private address (this means that it can be used by anyone, on a private network such as a home or a office) this traditonally gave 254 usable address e.g. 192.168.0.1 to 192.168.0.254 where 192.168.0.0 was the network address (mainly requried for DCHP (Dynamic Contol Host Protocol)(what assigns your IP addresses)). And 192.168.0.255 is your broadcast address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where through the usage of VLSM (Variable length subnet masks), the class-full system is all but obsolete, the base addressing scheme e.g. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Name   Address range   Number of addresses     Classful description    Largest CIDR block&#xA;  24-bit block   10.0.0.0–10.255.255.255     16777216    Single Class A  10.0.0.0/8&#xA;  20-bit block   172.16.0.0–172.31.255.255   1048576     Contiguous range of 16 Class B blocks   172.16.0.0/12&#xA;  16-bit block   192.168.0.0–192.168.255.255     65536   Contiguous range of &gt;256 Class C blocks     192.168.0.0/16&#xA;  (&lt;a href=&quot;https://en.wikipedia.org/wiki/IPv4#Private_networks&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/IPv4#Private_networks&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;simple example (N = network section H = host section) &#xA;NNN | HHH HHH HHH    Legacy Class A 10.0.0.0 to 10.255.255.255 (address range) /8 (cidre = 255.0.0.0 - subnet mask = 0.255.255.255 - wild card (only used when configuring certain routing protocols e.g. OSPF and EIGRP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NNN NNN | HHH HHH    Legacy Class B 172.16.000.000 to 172.31.255.255 (address range) / 16 (cider = 255.255.0.0 - subnet mask = 0.0.255.255 - wild card mask)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NNN NNN NNN | HHH Legacy Class C 192.168.0.0 to 192.168.255.255 (address range) /24 (cidre = 255.255.255.0 - subnet mask = 0.0.0.255 wild card mask)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;wikipedia has good articles on both subnet masks and wild card masks &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These (address if not in totality due to VLSM (variable length subnet masks) are still used by network admins, to help predetermine the size of network which they are dealing with.  I hope this answers question 1 of 3 which you asked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as for question 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;each router is different, there should be no reason you could not change what address range it distributes (as long as it co insides with the above range).  however with out the actual router make and model I can not advice up on that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as for question 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;every pc typically will get their IP address from the router via protocol called DCHP, when your PC is connect to a network it will send a DHCP request using UDP, to ask for a IP address.  If a DCHP server hears this request and has address left in its pool then it will temporally reserve an address and offer this address to the client in this case the PC.  the DCHP address pool is configured upon what the addressing system has been set to. e.g. 192.168.0.0 /24 then it will release an address between the ranges of 192.168.0.1 to 192.168.0.254 (inclusive)  however they may be (almost certainly) &quot;reserved addresses&quot; which are address which should not be sent via DCHP, these are typically the address of any routers (default gateway), manages switches and servers which are on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TLDR;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;the default gateway address comes from the old class-full addressing system&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;it should be possible look in your router's setting&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the address come from a protocol called DCHP&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="15566" LastActivityDate="2015-05-31T01:37:33.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18859" PostTypeId="2" ParentId="18280" CreationDate="2015-05-31T02:58:55.153" Score="-1" Body="&lt;p&gt;Switches have mac-address tables.&lt;br&gt;&#xA;Endpoints such as PCs have arp tables.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-31T02:58:55.153" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18860" PostTypeId="2" ParentId="493" CreationDate="2015-05-31T03:06:39.357" Score="-3" Body="&lt;p&gt;Single Mode Fiber, SMF, is typically used for cable runs measured in miles, or kilometers.  The laser-based optics are relatively expensive.  SMF is typically used by carriers and on very large campuses, industrial plants.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multimode Fiber, MMF, is used for cable runs measured in hundreds of feet or meters.  The LED-based optics are relatively affordable.  MMF is typically used in multistory buildings and on smaller campuses such as high schools.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2017-08-22T20:08:04.870" LastActivityDate="2017-08-22T20:08:04.870" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18861" PostTypeId="2" ParentId="1328" CreationDate="2015-05-31T03:29:18.793" Score="-3" Body="&lt;p&gt;You need a wired network (Ethernet switches) and a wireless network along with a security appliance / multilayer gateway (ALG).  The ISP/WAN is Ethernet handoff.&lt;br&gt;&#xA;BYOD, LAN Management, IPS/NGFW&lt;br&gt;&lt;br&gt;&#xA;Controller-based WLANs are outdated.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Biased answer from a Cisco-centric integrator)&lt;br&gt;&#xA;Get a &lt;a href=&quot;https://meraki.cisco.com/products/appliances/mx100&quot; rel=&quot;nofollow&quot;&gt;Meraki MX100&lt;/a&gt;, Cisco WS-C2960X-48TS-LL, and (3) &lt;a href=&quot;https://meraki.cisco.com/products/wireless/mr32&quot; rel=&quot;nofollow&quot;&gt;Meraki MR32 APs&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-31T03:29:18.793" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="18862" PostTypeId="2" ParentId="1029" CreationDate="2015-05-31T03:33:07.470" Score="-1" Body="&lt;p&gt;VLANs carve a switch into multiple virtual switches.&lt;br&gt;&#xA;Subnets carve an IP network address into multiple smaller network addresses.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-05-31T03:33:07.470" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18865" PostTypeId="1" CreationDate="2015-05-31T10:52:50.117" Score="4" ViewCount="1453" Body="&lt;p&gt;Yesterday we measured a network with a Fluke network tester.&#xA;Almost all cables failed the test, because of a too high return loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we tested one of the failed cables using a 'real world' test. Transferring an ISO to a server. We got a steady 110MB/s&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes me wonder how signal return loss affects the network performance.&lt;/p&gt;&#xA;" OwnerUserId="15702" LastEditorUserId="775" LastEditDate="2015-06-20T16:23:04.313" LastActivityDate="2017-09-29T08:03:28.420" Title="How does signal return loss affect network performance" Tags="|ethernet|throughput|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18867" PostTypeId="2" ParentId="7488" CreationDate="2015-05-31T16:06:19.477" Score="2" Body="&lt;p&gt;Maybe I read it wrong, you allow users and internal servers in same security zone,  all you need is users and internal servers in different layer 2 domain? Don't create vrf and routing between vrf just for that purpose. There must be simpler way to do it, for example different layer3 Vlans + ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On 7K you give 1 vlan 100  for users and 1 vlan 200 for internal servers, on the users vlan interface, you can just add ACL to allow only where you want users to reach. It is possible to setup in my opinion, if you see anything in your environment does not support this, tell me and we can discuss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to run fabric path, you can use 4 5k-7k links to run your fabric path, you can add one more link just for trunk vlan 100 and 200 between 5k and 7K.&lt;/p&gt;&#xA;" OwnerUserId="5262" LastEditorUserId="5262" LastEditDate="2015-05-31T16:16:59.623" LastActivityDate="2015-05-31T16:16:59.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18869" PostTypeId="1" CreationDate="2015-05-31T20:24:43.313" Score="3" ViewCount="3725" Body="&lt;p&gt;I've been wondering if there's a possibility to find the IP addresses of all the nodes connected to a particular LAN without assigning your NIC an IP address.Taking under consideration that some nodes are on different IP subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware of tools such as angryipscanner, nmap, arp-scan and etc, but they all need an IP address assigned to you NIC in turn to use then.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking if there's a way to use libpcap or another tool in turn to forge an ARP-request frame and make all the nodes within the LAN answer to the broadcast address ( so you could sniff it) or to the port where my NIC is connected to.&lt;/p&gt;&#xA;" OwnerUserId="15705" LastEditorUserId="8499" LastEditDate="2018-03-19T18:06:57.157" LastActivityDate="2018-03-19T18:06:57.157" Title="Finding all used IP addresses within a LAN without assigning an IP address to your NIC" Tags="|ipv4|ip|arp|ip-address|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18870" PostTypeId="2" ParentId="1328" CreationDate="2015-05-31T20:57:04.453" Score="0" Body="&lt;p&gt;I echo bigmstone 's suggestion of Ubiquiti Networks for your WLAN. I've deployed them at multiple sites, and they work really well. They offer multiple versions, but I would really recommend the &lt;a href=&quot;https://rads.stackoverflow.com/amzn/click/com/B0089QB1SC&quot; rel=&quot;nofollow noreferrer&quot; rel=&quot;nofollow noreferrer&quot;&gt;UAP-PRO&lt;/a&gt; because it uses true 802.3af (versus passive POE in the lower end models) (see the difference &lt;a href=&quot;http://www.passivepoe.com/faq.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;p&gt;If you go with ubiquity APs, you might also want to look into their EdgeSwitch. It supports 802.3af POE as well as passive POE (which as I mentioned, their cheaper APs use.) the support for passive POE is great, because then you don't need all those gangly POE adapters.&lt;/p&gt;&#xA;&lt;p&gt;Like bigmstone said, you don't need a controller to use the APs, but you do need one to set the APs up initially. Luckily, the controller software is free and very easy to use, and if you're ambitious, for a cheap permanent controller, the Raspberry Pi works very well!&lt;/p&gt;&#xA;" OwnerUserId="15698" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-05-31T20:57:04.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18872" PostTypeId="2" ParentId="18691" CreationDate="2015-05-31T21:24:47.513" Score="2" Body="&lt;p&gt;To &quot;roll your own&quot; SIP trunking, you need some sort of PSTN interface. Often this is a PRI for larger businesses. I will use PRI as an example in this situation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Needs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) PRI&#xA;2) PRI interface&#xA;3) SIP server&#xA;4) SIP client&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To obtain a PRI, you need to contact your phone company, and they will install one on your premises. Once they have installed the PRI, you will connect it to your SIP server with your PRI interface. PRI interfaces come in many forms, but for simplicity, let's assume that you are using a PCI based PRI card. You would install this into your server, and then begin installing your SIP server software. Personally, I recommend Elastix, FreePBX, or basically anything based on Asterisk. There are other options out there, but I think Elastix is probably the best for ease of use. The actual procedure for creating SIP trunks is out of the scope of this post, but hopefully this is a good start for you!&lt;/p&gt;&#xA;" OwnerUserId="15698" LastActivityDate="2015-05-31T21:24:47.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18873" PostTypeId="1" AcceptedAnswerId="18877" CreationDate="2015-06-01T04:16:55.813" Score="67" ViewCount="79902" Body="&lt;p&gt;In context of networking I keep running into statements such as &quot;east-west traffic is larger than north-south traffic&quot;. I have tried a bit of googling but have not been able to locate an authoritative answer to understand the origin of these terms.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is the definition of north-south traffic?&lt;/li&gt;&#xA;&lt;li&gt;What is the definition of east-west traffic? &lt;/li&gt;&#xA;&lt;li&gt;What is the origin of these terms? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15708" LastEditorUserId="775" LastEditDate="2015-06-20T16:22:17.170" LastActivityDate="2021-08-03T17:35:47.380" Title="What is the meaning / origin of the terms north-south and east-west traffic?" Tags="|terminology|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18875" PostTypeId="2" ParentId="18869" CreationDate="2015-06-01T09:45:37.767" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I was thinking if there's a way to use libpcap or another tool in turn to forge an ARP-request frame and make all the nodes within the LAN answer to the broadcast address ( so you could sniff it) or to the port where my NIC is connected to.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It doesn't have to be that complicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as your switch isn't using a feature similar to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/dynarp.html&quot; rel=&quot;noreferrer&quot;&gt;Dynamic ARP Inspection&lt;/a&gt;, the simple way to detect addresses is to use &lt;a href=&quot;http://linux.die.net/man/8/arping&quot; rel=&quot;noreferrer&quot;&gt;&lt;code&gt;arping&lt;/code&gt;&lt;/a&gt;... you can find this in most linux distributions (although CLI options sometimes vary depending on what &lt;code&gt;arping&lt;/code&gt; build you have).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@home ~]$ sudo arping -c 2 -S 0.0.0.0 -D -i eth0 172.16.100.40&#xA;ARPING 172.16.100.40&#xA;60 bytes from 00:ae:de:ad:be:ef (172.16.100.40): index=0 time=3.513 msec&#xA;60 bytes from 00:ae:de:ad:be:ef (172.16.100.40): index=1 time=2.778 msec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can write a script to cycle through as many addresses as you like; usually it's a good idea to sniff with wireshark and see what subnets could be used in that vlan (i.e. by looking at the source address in ARP requests).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Dynamic ARP Inspection&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you are running Dynamic ARP Inspection (DAI), you can't detect addresses like this as long as DAI checks IP address validity... I tested this on a Cisco 2960 running this configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip arp inspection vlan 100&#xA;ip arp inspection validate src-mac dst-mac ip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I used &lt;code&gt;arping&lt;/code&gt; as shown above, the switch noticed the invalid &lt;code&gt;0.0.0.0&lt;/code&gt; source IP address in the ARP frame, and dropped it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jun  1 04:05:29.561 CDT: %SW_DAI-4-INVALID_ARP: 1 Invalid ARPs (Req) on Gi0/1, &#xA;vlan 100.([0024.1bde.add7/0.0.0.0/0000.0000.0000/172.16.100.40/04:05:28 CDT &#xA;Mon Jun 1 2015])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-06-01T09:45:37.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18876" PostTypeId="2" ParentId="17764" CreationDate="2015-06-01T12:08:18.060" Score="1" Body="&lt;p&gt;The Fortigate has the most advanced SIP protection of any firewall I have seen.  It does remove the need for an SBC if your concerns are solely security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What a Fortigate will not do, which an SBC does, is to transcode the voice codecs, but this is probably not needed in your environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two SIP ALGs in the FortiGate,  one is a basic session helper and is on by default.  This takes care of any NAT problems but does not address security.  The second is to apply a VoiP profile to your SIP traffic.  With this VoiP profile you have a huge amount of granularity on what you can do in the way of protection, but this granularity is only visible and settable via CLI.&lt;/p&gt;&#xA;" OwnerUserId="15713" LastActivityDate="2015-06-01T12:08:18.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18877" PostTypeId="2" ParentId="18873" CreationDate="2015-06-01T12:47:21.730" Score="88" Body="&lt;p&gt;The terms are usually used in the context of data centers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, &quot;east-west&quot; traffic refers to traffic within a data center -- i.e. server to server traffic.  &quot;North-south&quot; traffic is client to server traffic, between the data center and the rest of the network (anything outside the data center).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the terms have come into use from the way network diagrams are typically drawn, with servers or access switches spread out horizontally, and external connections at the top or bottom.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-06-01T12:47:21.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18879" PostTypeId="1" AcceptedAnswerId="19251" CreationDate="2015-06-01T14:48:01.697" Score="6" ViewCount="1216" Body="&lt;p&gt;In relation to another question on this forum, &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/18717/moving-interface-names-on-a-cisco-asa-while-maintaining-the-rest-of-the-configur&quot; title=&quot;Moving interface names on a Cisco ASA while maintaining the rest of the configuration in place&quot;&gt;Moving interface names on a Cisco ASA while maintaining the rest of the configuration in place&lt;/a&gt;, I modified the startup-config on my Cisco ASA 5525-X from...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!    &#xA;interface GigabitEthernet0/0    &#xA; channel-group 1 mode active    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA;!    &#xA;interface GigabitEthernet0/1    &#xA; channel-group 1 mode active    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA;!    &#xA;interface GigabitEthernet0/2    &#xA; channel-group 2 mode active    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA;!    &#xA;interface GigabitEthernet0/3    &#xA; channel-group 2 mode active    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA;!    &#xA;interface GigabitEthernet0/4    &#xA; channel-group 3 mode active    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA;!    &#xA;interface GigabitEthernet0/5    &#xA; channel-group 3 mode active    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA;!    &#xA;interface GigabitEthernet0/6    &#xA; description LAN Failover Interface    &#xA;!    &#xA;interface GigabitEthernet0/7    &#xA; description STATE Failover Interface    &#xA;!    &#xA;interface Management0/0    &#xA; management-only    &#xA; nameif management    &#xA; security-level 75    &#xA; no ip address    &#xA;!    &#xA;interface Port-channel1    &#xA; lacp max-bundle 8    &#xA; nameif outside    &#xA; security-level 0    &#xA; ip address xxx.xxx.xxx.xxx 255.255.255.xxx standby xxx.xxx.xxx.xxx     &#xA;!    &#xA;interface Port-channel2    &#xA; lacp max-bundle 8    &#xA; nameif DMZ    &#xA; security-level 50    &#xA; ip address xxx.xxx.xxx.xxx 255.255.255.xxx standby xxx.xxx.xxx.xxx     &#xA;!    &#xA;interface Port-channel3    &#xA; lacp max-bundle 8    &#xA; nameif inside    &#xA; security-level 100    &#xA; ip address xxx.xxx.xxx.xxx 255.255.255.xxx standby xxx.xxx.xxx.xxx     &#xA;!    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!    &#xA;interface GigabitEthernet0/0    &#xA; channel-group 1 mode active    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA;!    &#xA;interface GigabitEthernet0/1    &#xA; channel-group 1 mode active    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA;!    &#xA;interface GigabitEthernet0/2    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA; shutdown    &#xA;!    &#xA;interface GigabitEthernet0/3    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA; shutdown    &#xA;!    &#xA;interface GigabitEthernet0/4    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA; shutdown    &#xA;!    &#xA;interface GigabitEthernet0/5    &#xA; no nameif    &#xA; no security-level    &#xA; no ip address    &#xA; shutdown    &#xA;!    &#xA;interface GigabitEthernet0/6    &#xA; description LAN Failover Interface    &#xA;!    &#xA;interface GigabitEthernet0/7    &#xA; description STATE Failover Interface    &#xA;!    &#xA;interface Port-channel1    &#xA; lacp max-bundle 8    &#xA; nameif outside    &#xA; security-level 0    &#xA; ip address xxx.xxx.xxx.xxx 255.255.255.xxx standby xxx.xxx.xxx.xxx     &#xA;!    &#xA;interface Port-channel1.60    &#xA; nameif DMZ    &#xA; security-level 50    &#xA; ip address xxx.xxx.xxx.xxx 255.255.255.xxx standby xxx.xxx.xxx.xxx    &#xA; vlan 60    &#xA;!    &#xA;interface Port-channel1.40    &#xA; nameif inside    &#xA; security-level 100    &#xA; ip address xxx.xxx.xxx.xxx 255.255.255.xxx standby xxx.xxx.xxx.xxx    &#xA; vlan 40    &#xA;!    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After reloading the ASAs, the sub-interfaces were created successfully. However, whereas my config file specified names for the sub-interfaces, the running config displayed a &lt;code&gt;no nameif&lt;/code&gt; directive and all of the corresponding configuration elements had been removed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some research, I believe my problem lies in the ordering of commands within my startup-config. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! WRONG&#xA;interface Port-channel1.60    &#xA; nameif DMZ    &#xA; security-level 50    &#xA; ip address xxx.xxx.xxx.xxx 255.255.255.xxx standby xxx.xxx.xxx.xxx    &#xA; vlan 60    &#xA;!    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Should have been...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! CORRECT&#xA;interface Port-channel1.60    &#xA; vlan 60&#xA; nameif DMZ    &#xA; security-level 50    &#xA; ip address xxx.xxx.xxx.xxx 255.255.255.xxx standby xxx.xxx.xxx.xxx    &#xA;!    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is the ordering of commands my problem or am I missing something else - such as an inherent limitation of the 5525-X?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running ASA version 9.3 (2)&lt;/p&gt;&#xA;" OwnerUserId="14399" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-06-16T17:49:19.990" Title="Cisco ASA startup-config command ordering for sub-interfaces" Tags="|cisco-asa|interface|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18880" PostTypeId="1" AcceptedAnswerId="18886" CreationDate="2015-06-01T14:50:53.160" Score="0" ViewCount="747" Body="&lt;p&gt;We have a 172.20.0.0/* LAN at workplace. I have a Computer in this LAN with IP 172.20.164.174. This Computer has both Internet connection and workplace network access. I also have a Computer in home with IP 10.0.0.50 from my ISP. It is connected directly to ISP network and has ADSL Internet connection. Also, I have a VPS (Virtual Private Server) which has a public valid IP address. It will be my shared point for my home and workplace PCs talks ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I need to proxy my workplace LAN to my home's PC via my workplace's PC and my VPS. I mean I would like to install some services on these three computers which enables me to work at home just like that I'm at workplace. i.e. the workplace network know me as 172.20.164.174 transparently while I'm at home!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know VPN (e.g. OpenVPN) but I don't have access to any PC at my workplace with public valid IP address as an VPN server. I just have my own VPS on Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which open source software can help me to achieve this possibility? I searched a lot with no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="15715" LastActivityDate="2015-06-01T18:59:28.250" Title="Proxying a private network (Ethernet LAN) at workplace to home via a VPS" Tags="|ethernet|lan|isp|proxy|" AnswerCount="1" CommentCount="2" ClosedDate="2015-06-02T01:57:34.133" ContentLicense="CC BY-SA 3.0" />
  <row Id="18881" PostTypeId="2" ParentId="8224" CreationDate="2015-06-01T16:32:31.840" Score="1" Body="&lt;p&gt;This is achieved through using a base configuration for whatever IOS images you want to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that base configuration, all you're doing is changing the line speed of the console port to something that's faster than 9600 (maximum line speed is 115200).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.pluralsight.com/gns3-initial-configuration&quot; rel=&quot;nofollow&quot;&gt;This blog post&lt;/a&gt; does a good job of explaining how to set said base configurations.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2015-06-01T16:32:31.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18882" PostTypeId="1" AcceptedAnswerId="19009" CreationDate="2015-06-01T17:41:33.670" Score="4" ViewCount="8541" Body="&lt;p&gt;I've seen twice, an organization's network exhausts its dhcp range.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;What to do when a network approaches/hits DHCP exhaustion?&lt;/h1&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h3&gt;The first case I've seen:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Their solution was to put the wifi network on its own subnet with very short dhcp lease times, eg somewhere in the 2hr ~ 8hr ~ 12hr range.&#xA;This approach means that the daily capacity of the wifi network is that of its dhcp range; but does not handle any more, and can still congest/deny service.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;The second case I've seen:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Their solution was again to provision a separate subnet, this time for dedicated devices, but separate from the primary subnet with its dedicated devices as well as occasional wifi usage.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Neither of what I've seen in practice seems like a great solution.&lt;/p&gt;&#xA;" OwnerUserId="12058" LastActivityDate="2015-06-06T05:17:20.863" Title="Options when facing DHCP Exhaustion?" Tags="|dhcp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18886" PostTypeId="2" ParentId="18880" CreationDate="2015-06-01T18:59:28.250" Score="2" Body="&lt;p&gt;You'll have to use some sort of tunnel here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option A would be setting up openVPN on your VPS and then connect both clients (home &amp;amp; work) to it. OpenVPN is quite stable and usually reconnects quickly after an interruption (e.g. ISP initiated an IP change).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option B would be building an SSH tunnel with the VM acting as some sort of bridge. SSH tunnels work quite well and there are also helpful scripts to automate tunnel building and upkeep. Nevertheless I think I'd choose openVPN.&lt;/p&gt;&#xA;" OwnerUserId="15718" LastActivityDate="2015-06-01T18:59:28.250" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18889" PostTypeId="7" CreationDate="2015-06-01T20:02:00.810" Score="0" Body="&lt;p&gt;&#xA;    On Stack Exchange, we believe the core moderators should come &lt;i&gt;from&lt;/i&gt; the community, and be elected by the community itself through popular vote. We hold regular elections to determine who these community moderators will be.&lt;/p&gt;&#xA;&lt;p&gt;&#xA;    Community moderators are &lt;a href=&quot;http://blog.stackoverflow.com/2009/05/a-theory-of-moderation/&quot;&gt;accorded the highest level of privilege on our community&lt;/a&gt;, and should themselves be exemplars of positive behavior and leaders within the community.&lt;/p&gt;&#xA;&lt;p&gt;&#xA;    Our general criteria for moderators is as follows:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;    &lt;li&gt;patient and fair&lt;/li&gt;&#xA;    &lt;li&gt;leads by example&lt;/li&gt;&#xA;    &lt;li&gt;shows respect for their fellow community members in their actions and words&lt;/li&gt;&#xA;    &lt;li&gt;open to some light but firm moderation to keep the community on track and resolve (hopefully) uncommon disputes and exceptions&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&#xA;    Every election has three phases:&#xA;&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;    &lt;li&gt;Nomination&lt;/li&gt;&#xA;    &lt;li&gt;Primary&lt;/li&gt;&#xA;    &lt;li&gt;Election&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&#xA;    Please participate in the moderator elections by voting, and perhaps even by nominating yourself to be a community moderator!&#xA;&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="14653" LastEditDate="2022-02-15T15:46:43.500" LastActivityDate="2022-02-15T15:46:43.500" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="18890" PostTypeId="1" AcceptedAnswerId="18896" CreationDate="2015-06-01T21:21:06.507" Score="0" ViewCount="1044" Body="&lt;p&gt;Today i had an issue with my ping, usually i get around 80-100 ms on yahoo.com and in worst cases with hosts that are far from me i get max of 250ms. But today i just had a weird problem that my ping suddenly goes up to a range from 500 to 600 ms. This is really weird now the internet is really slow facebook and all other websites are too slow to browse and load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did a tracert though the ping goes high not from my ISP gateway but from another hop so what does this mean? here is example of ping and tracert&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Pinging fd-fp3.wg1.b.yahoo.com [46.228.47.114] with 32 bytes of data:&#xA;Reply from 46.228.47.114: bytes=32 time=576ms TTL=47&#xA;Reply from 46.228.47.114: bytes=32 time=609ms TTL=47&#xA;Reply from 46.228.47.114: bytes=32 time=551ms TTL=47&#xA;Request timed out.&#xA;Reply from 46.228.47.114: bytes=32 time=563ms TTL=47&#xA;Reply from 46.228.47.114: bytes=32 time=557ms TTL=47&#xA;Reply from 46.228.47.114: bytes=32 time=590ms TTL=47&#xA;Reply from 46.228.47.114: bytes=32 time=604ms TTL=47&#xA;Reply from 46.228.47.114: bytes=32 time=583ms TTL=47&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tracing route to fd-fp3.wg1.b.yahoo.com [46.228.47.114]&#xA;over a maximum of 30 hops:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  1    &amp;lt;1 ms    &amp;lt;1 ms    &amp;lt;1 ms  router.asus.com [192.168.1.1]&#xA;  2     1 ms     1 ms     1 ms  79.134.128.129&#xA;  3     1 ms     1 ms     1 ms  172.16.0.1&#xA;  4     1 ms     1 ms     1 ms  172.16.4.1&#xA;  5     2 ms     1 ms     2 ms  172.31.255.1&#xA;  6     2 ms     1 ms     1 ms  178.20.184.57&#xA;  7   506 ms   513 ms   501 ms  83.244.54.205&#xA;  8   487 ms   492 ms   497 ms  82.213.5.138&#xA;  9   471 ms     *      514 ms  xe-11-2-2.edge7.Frankfurt1.Level3.net [195.16.16&#xA;1.53]&#xA; 10     *        *        *     Request timed out.&#xA; 11   534 ms   501 ms   560 ms  YAHOO-INC.edge5.Frankfurt1.Level3.net [195.16.16&#xA;0.54]&#xA; 12   527 ms   532 ms   513 ms  so-2-0-0.pat1.ams.yahoo.com [66.196.65.144]&#xA; 13   535 ms   561 ms   553 ms  ae-5.pat1.iry.yahoo.com [216.115.104.64]&#xA; 14   549 ms   529 ms   525 ms  ae-2.msr1.ir2.yahoo.com [66.196.65.157]&#xA; 15     *      516 ms   521 ms  xe-5-3-0.msr1.ir2.yahoo.com [217.146.185.163]&#xA; 16   503 ms   502 ms   493 ms  ir2.fp.vip.ir2.yahoo.com [46.228.47.114]&#xA;&#xA;Trace complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15724" LastActivityDate="2015-06-02T02:24:19.820" Title="Suddenly high ping" Tags="|ping|packet-loss|" AnswerCount="2" CommentCount="0" ClosedDate="2015-06-02T12:49:50.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="18891" PostTypeId="2" ParentId="18890" CreationDate="2015-06-01T23:21:07.527" Score="-3" Body="&lt;p&gt;A possible explanation is that ICMP (ping) packets destined to large providers equipment may not accurately reflect the condition of the underlying circuit(s).  Control plane policing (memory/processor priority) may be treating your ping packets with a very low priority in order to preserve their equipment's performance for higher priority traffic.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-01T23:21:07.527" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18893" PostTypeId="1" AcceptedAnswerId="18901" CreationDate="2015-06-02T00:38:27.107" Score="6" ViewCount="3230" Body="&lt;p&gt;I'm on a consulting engagement with a new client whose network infrastructure is comprised of slightly non-standard equipment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;During discovery, I inquired about the switching equipment and network topology. I was surprised to find that the main switches were running &lt;strong&gt;&lt;em&gt;Debian&lt;/em&gt;&lt;/strong&gt;, in the form of &lt;a href=&quot;http://cumulusnetworks.com/cumulus-linux/overview/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cumulus Linux&lt;/a&gt;, atop Whitebox switch hardware (&lt;a href=&quot;http://whiteboxswitch.com/products/edge-core-as5610-52x&quot; rel=&quot;nofollow noreferrer&quot;&gt;Edge-Core AS5610-52X&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uQdJY.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uQdJY.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The infrastructure is relatively small, but needs to run some critical public-facing applications and will also be moving to a VMware vSphere virtualization solution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm in the picture because the environment hasn't been documented by its previous on-staff sysadmins. I'm working on my list of recommendations/risks, and I can't shake the feeling that the Cumulus Linux and Whitebox switch combination isn't a good idea. Granted, I come from a Cisco/HP/Arista background, but is it reasonable to suggest that the relatively low mindshare and vendor presence is a potential operational risk?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the &lt;a href=&quot;http://onie.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;Open Network Install Environment&lt;/a&gt; (ONIE) really gaining traction in the Network Engineering space? Is it the best choice for an environment that doesn't have the staff with the knowledge to maintain it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd appreciate any thoughts on this.&lt;/p&gt;&#xA;" OwnerUserId="548" LastEditorUserId="35913" LastEditDate="2018-10-19T23:43:54.227" LastActivityDate="2020-03-25T09:40:46.063" Title="Cumulus Linux and Whitebox switch hardware?" Tags="|switch|linux|sdn|hardware|" AnswerCount="3" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="18894" PostTypeId="1" AcceptedAnswerId="18902" CreationDate="2015-06-02T01:27:16.217" Score="2" ViewCount="450" Body="&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing&quot; rel=&quot;nofollow&quot;&gt;Classless Inter Domain Routing&lt;/a&gt; (CIDR) is a method to allocate IP addresses and route IP packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand how it saves IP address space but I dont understand how it helps the routing process , Can someone enlightened me ??&lt;/p&gt;&#xA;" OwnerUserId="3723" LastActivityDate="2015-06-02T08:44:53.563" Title="How does CIDR help in routing" Tags="|routing|ipv4|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18895" PostTypeId="2" ParentId="7350" CreationDate="2015-06-02T02:10:04.580" Score="2" Body="&lt;p&gt;To answer your question: it is possible to run a SIP trunk under your circumstances because your circumstances are no different than those of any other cable subscriber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DOCSIS is a Layer 1 &amp;amp; 2 protocol, while SIP trunks essentially operate over IP &amp;amp; UDP which are Layer 3 protocols. I don't think it helps to mix them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With most SIP trunking providers, when the PBX on your LAN registers with the SBC, the SBC uses NAT punching techniques to find the right private IP, if there is a NAT to cross. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your deployment concerns are going to be:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Making sure your router doesn't interfere with SIP traffic (disable SIP ALGs - most implementations break SIP)&lt;/li&gt;&#xA;&lt;li&gt;Hoping that your ISP doesn't traffic shape SIP&lt;/li&gt;&#xA;&lt;li&gt;Checking that your connection to the SBC is solid enough (&amp;lt;30ms RTT, &amp;lt;1% packet loss, &amp;lt;10ms jitter)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since you are concerned about QOS - this is something that is simply not possible with packets over the internet. Many SIP trunking providers will sell a managed service product that comes with private data T1 connectivity to their backbone - so essentially they're taking &amp;amp; owning the QOS problem.&lt;/p&gt;&#xA;" OwnerUserId="6402" LastActivityDate="2015-06-02T02:10:04.580" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18896" PostTypeId="2" ParentId="18890" CreationDate="2015-06-02T02:24:19.820" Score="0" Body="&lt;p&gt;Understand that ICMP traffic (of which ping is part) can often be limited or dropped on the Internet. However, in most of these cases this will affect the processing of such traffic by the devices and not the forwarding of the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at this specific output, there could be several options but I would suspect there is a possible problem between VTEL and PATEL. As an end user there is nothing you can do yourself to resolve this issue, leaving you two options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Contact your ISP to inform them of the problem so they can look into it and hopefully fix it.&lt;/li&gt;&#xA;&lt;li&gt;You can switch to a different ISP (if available) and hope they do not experience the same issue.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-06-02T02:24:19.820" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18897" PostTypeId="2" ParentId="16909" CreationDate="2015-06-02T02:46:32.703" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is, does the order in which the three paths to the target&#xA;  appear in the output of this command indicate something? If so, what&#xA;  does it mean?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The order of received prefixes listed by the &lt;code&gt;show ip bgp&lt;/code&gt; or &lt;code&gt;show ip bgp x.x.x.x&lt;/code&gt; command varies depending on your BGP configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the following topology. The BGP speaker &lt;code&gt;R6&lt;/code&gt; is aggregating eBGP neighborships for BGP ASN 888.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASN 123, 1581 and 1771 are all originating the same network prefixes in order to demonstrate the behavior of the &lt;code&gt;show ip bgp&lt;/code&gt; output.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                   +-------+                &#xA;                   | AS 888|                &#xA;                   |  (R6) |                &#xA;172.16.13.1        +-+-+-+-+&#xA;172.16.13.3          | | |&#xA;172.16.26.2          | | |        172.30.4.10&#xA;           \         | | |       /           &#xA;   +--------+        | | |       +---------+&#xA;   | AS 123 +--------+ | +-------+ AS 1771 |&#xA;   +--------+          |         +---------+&#xA;                       |                    &#xA;                  +----+----+               &#xA;                  | AS 1581 | \             &#xA;                  +---------+  172.40.10.10   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Below is the initial view of Router 6's BGP table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R6#show ip bgp 10.101.1.1/32&#xA;BGP routing table entry for 10.101.1.1/32, version 9&#xA;Paths: (5 available, best #5, table default)&#xA;  Advertised to update-groups:&#xA;     1&#xA;  Refresh Epoch 1&#xA;  1771&#xA;    172.30.4.10 from 172.30.4.10 (172.30.4.10)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 1&#xA;  1581&#xA;    172.40.10.10 from 172.40.10.10 (172.40.10.10)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 1&#xA;  123&#xA;    172.16.13.1 from 172.16.13.1 (172.16.101.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 1&#xA;  123&#xA;    172.16.13.3 from 172.16.13.3 (172.16.103.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 1&#xA;  123&#xA;    172.16.26.2 from 172.16.26.2 (172.16.102.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external, best&#xA;      rx pathid: 0, tx pathid: 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These routes can be re-ordered in the &lt;code&gt;show ip bgp x.x.x.x&lt;/code&gt; output by controlling the order that they're learned. Below, all eBGP neighbors advertising the 10.101.1.1/32 prefix are administratively shutdown and brought up one at a time.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R6(config)#router bgp 888&#xA;R6(config-router)#neighbor 172.16.13.1 shutdown&#xA;R6(config-router)#neighbor 172.16.13.3 shutdown&#xA;R6(config-router)#neighbor 172.16.26.2 shutdown&#xA;R6(config-router)#neighbor 172.30.4.10 shutdown&#xA;R6(config-router)#neighbor 172.40.10.10 shutdown&#xA;R6(config-router)#no neighbor 172.40.10.10 shutdown&#xA;*Jun  2 01:39:47.750: %BGP-5-ADJCHANGE: neighbor 172.40.10.10 Up&#xA;R6(config-router)#no neighbor 172.16.26.2 shutdown&#xA;*Jun  2 01:40:31.929: %BGP-5-ADJCHANGE: neighbor 172.16.26.2 Up&#xA;R6(config-router)#no neighbor 172.30.4.10 shutdown&#xA;*Jun  2 01:40:49.400: %BGP-5-ADJCHANGE: neighbor 172.30.4.10 Up&#xA;R6(config-router)#no neighbor 172.16.13.3 shutdown&#xA;*Jun  2 01:41:05.853: %BGP-5-ADJCHANGE: neighbor 172.16.13.3 Up&#xA;R6(config-router)#no neighbor 172.16.13.1 shutdown&#xA;*Jun  2 01:41:19.225: %BGP-5-ADJCHANGE: neighbor 172.16.13.1 Up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp1.html#wp1113816&quot; rel=&quot;nofollow&quot;&gt;deterministic MED&lt;/a&gt; is not enabled, then prefixes are listed in chronological order, regardless of originating AS, from youngest to oldest (top to bottom).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R6(config-router)#do show ip bgp 10.101.1.1/32&#xA;BGP routing table entry for 10.101.1.1/32, version 52&#xA;Paths: (5 available, best #5, table default)&#xA;  Advertised to update-groups:&#xA;     3&#xA;  Refresh Epoch 2&#xA;  123&#xA;    172.16.13.1 from 172.16.13.1 (172.16.101.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 2&#xA;  123&#xA;    172.16.13.3 from 172.16.13.3 (172.16.103.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 1&#xA;  1771&#xA;    172.30.4.10 from 172.30.4.10 (172.30.4.10)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 2&#xA;  123&#xA;    172.16.26.2 from 172.16.26.2 (172.16.102.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 1&#xA;  1581&#xA;    172.40.10.10 from 172.40.10.10 (172.40.10.10)&#xA;      Origin IGP, metric 0, localpref 100, valid, external, best&#xA;      rx pathid: 0, tx pathid: 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If deterministic MED is enabled, the prefixes are grouped by ASN. The prefixes are still listed in chronological order from youngest to oldest within their respective ASN group and the ASN group order is displayed from youngest to oldest with the eldest prefix of each group being compared.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R6(config-router)#bgp deterministic-med&#xA;R6(config-router)#do show ip bgp 10.101.1.1/32&#xA;BGP routing table entry for 10.101.1.1/32, version 52&#xA;BGP Bestpath: deterministic-med&#xA;Paths: (5 available, best #4, table default)&#xA;  Advertised to update-groups:&#xA;     3&#xA;  Refresh Epoch 2&#xA;  123&#xA;    172.16.13.1 from 172.16.13.1 (172.16.101.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 2&#xA;  123&#xA;    172.16.13.3 from 172.16.13.3 (172.16.103.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 2&#xA;  123&#xA;    172.16.26.2 from 172.16.26.2 (172.16.102.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 1&#xA;  1581&#xA;    172.40.10.10 from 172.40.10.10 (172.40.10.10)&#xA;      Origin IGP, metric 0, localpref 100, valid, external, best&#xA;      rx pathid: 0, tx pathid: 0x0&#xA;  Refresh Epoch 1&#xA;  1771&#xA;    172.30.4.10 from 172.30.4.10 (172.30.4.10)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The BGP neighbors that belong to AS 1581 and 1771 can be forced to flap and reorder the ASN groups. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R6(config-router)#neighbor 172.30.4.10 shutdown&#xA;R6(config-router)#neighbor 172.40.10.10 shutdown&#xA;R6(config-router)#no neighbor 172.40.10.10 shutdown&#xA;R6(config-router)#no neighbor 172.30.4.10 shutdown&#xA;*Jun  2 02:23:33.407: %BGP-5-ADJCHANGE: neighbor 172.30.4.10 Up&#xA;*Jun  2 02:32:09.242: %BGP-5-ADJCHANGE: neighbor 172.40.10.10 Up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The eldest route below is from ASN 123 causing the ASN group to be listed at the bottom of the &lt;code&gt;show ip bgp x.x.x.x&lt;/code&gt; output.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R6(config-router)#do show ip bgp 10.101.1.1/32&#xA;BGP routing table entry for 10.101.1.1/32, version 10&#xA;BGP Bestpath: deterministic-med&#xA;Paths: (5 available, best #5, table default)&#xA;  Advertised to update-groups:&#xA;     1&#xA;  Refresh Epoch 1&#xA;  1581&#xA;    172.40.10.10 from 172.40.10.10 (172.40.10.10)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 1&#xA;  1771&#xA;    172.30.4.10 from 172.30.4.10 (172.30.4.10)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 2&#xA;  123&#xA;    172.16.13.1 from 172.16.13.1 (172.16.101.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 2&#xA;  123&#xA;    172.16.13.3 from 172.16.13.3 (172.16.103.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 2&#xA;  123&#xA;    172.16.26.2 from 172.16.26.2 (172.16.102.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, external, best&#xA;      rx pathid: 0, tx pathid: 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After your BGP table has sorted with deterministic MED enabled, removing deterministic MED will not return your BGP table to standard formatting until routes are removed/cleared and relearned.&lt;/p&gt;&#xA;" OwnerUserId="2476" LastEditorUserId="2476" LastEditDate="2015-07-04T19:03:50.097" LastActivityDate="2015-07-04T19:03:50.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18898" PostTypeId="2" ParentId="18865" CreationDate="2015-06-02T04:16:11.853" Score="3" Body="&lt;p&gt;A failure in the return loss measurement means that you have excess reflection energy from the cable configuration due to impedance mismatch. This failure means that a standards compliant transceiver is not guaranteed to work at IEEE BER requirements - but it is not guaranteed to fail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reflection energy can limit performance since some aspects of efficient physical layer chip design (i.e. chip area/power/cost) depend upon predictable cable system behavior, including acceptable return loss performance (e.g. number of taps in equalizers and echo cancellers). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, depending upon how much link margin you have due to other factors - e.g. noise, crosstalk, insertion loss - the link can still operate okay without errors even with a RL failure, though in some cases it may result in very infrequent errors that will not show up in short tests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that there is some margin built into IEEE compliant systems - many systems companies won't accept physical layer systems that only just meet the standard requirements. Therefore you may not see any bit errors with marginal cable test failures but it is safer not to rely on this fact.&lt;/p&gt;&#xA;" OwnerUserId="15512" LastActivityDate="2015-06-02T04:16:11.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18899" PostTypeId="2" ParentId="18852" CreationDate="2015-06-02T05:22:14.080" Score="1" Body="&lt;p&gt;The behavior you are seeing is expected, since you're not using MPLS-tagged interfaces and the vpnv4 address family. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you are using standard iBGP the extended communities attached to the routes are only informational, not used for actual route importation. Also the link between PE and CE is normally plain IP traffic (not MPLS tagged), so it looks like the lab you are working from might be confusing several different steps.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2015-06-02T05:22:14.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18901" PostTypeId="2" ParentId="18893" CreationDate="2015-06-02T06:15:41.880" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;is it reasonable to suggest that the relatively low mind share and vendor presence is a potential operational risk?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is always an issue. Products from a small vendor could (and more often than not, &lt;em&gt;do&lt;/em&gt;) end up abandoned. As long as they continue to function, there's little to worry about. But when they break, there's nowhere to go but somewhere else.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the Open Network Install Environment (ONIE) really gaining traction in the Network Engineering space?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not in any professional spaces that I'm aware of. HP has &quot;OpenFlow&quot; SDN hardware, but it's all HP software, backed by HP.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it the best choice for an environment that doesn't have the staff with the knowledge to maintain it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's a &lt;em&gt;universal&lt;/em&gt; NO. It's never wise to bank on hardware/software no one in the organization understands. Being able to &quot;bring someone in&quot; may sound like an option, but there's a good chance you'll be calling them more than you think. (I've been on both sides of that coin.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-02T06:15:41.880" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18902" PostTypeId="2" ParentId="18894" CreationDate="2015-06-02T07:07:42.197" Score="5" Body="&lt;p&gt;In the classful times when an organisation needed 4000 IPv4 addresses there were basically two options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Give them a class B address block with 65536 addresses. This wastes many addresses but is only one route in the routing table's&lt;/li&gt;&#xA;&lt;li&gt;Give them 16 class C address blocks with 4096 addresses in total. This doesn't waste addresses but it does use 16 routing table entries.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;With CIDR (classless inter domain routing) we got rid of those classes and started using all prefix lengths. So instead of only being able to give them a /16 or a sixteen /24s it became possible to give them a /20: the required number of addresses in one single routing table entry.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-06-02T07:07:42.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18905" PostTypeId="2" ParentId="18894" CreationDate="2015-06-02T08:44:53.563" Score="0" Body="&lt;p&gt;Sanders has captured the RFC4632 in a simple manner. You can however, check this &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4632&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4632&lt;/a&gt; on why CIDR was implemented.&lt;/p&gt;&#xA;" OwnerUserId="15735" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-06-02T08:44:53.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18911" PostTypeId="1" CreationDate="2015-06-02T13:23:25.563" Score="4" ViewCount="119" Body="&lt;p&gt;I have a simple L2 network consisting of two chained wireless PtP links. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[LOC A] -------&amp;gt; [LOC B] -------&amp;gt; [LOC C]&#xA;&#xA;         .4ms             .7ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is a list of the PtP bandwidths:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A -&gt; B    300Mbps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B -&gt; A    300Mbps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B -&gt; C    300Mbps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C -&gt; B    300Mbps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when we test the network (using iperf, 10 parallel threads) from A -&gt; C, we see the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A -&gt; C    130Mbps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C -&gt; A    130Mbps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link from A -&gt; B is a microwave link operating at 23GHz&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link from B -&gt; C is a 5GHz PtP radio. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we test the links individually, they look OK, passing 300Mbps as they should be. However, when we test the network end-to-end, from A -&gt; C, we never see more than 50% of the bandwidth we expect, and usually see closer to 33%. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of these links are passing customer traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this network congestion? Could it be caused by the two links operating with different latencies? Would this difference in latency cause buffers to fill up on one of the radios? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="13689" LastEditorUserId="775" LastEditDate="2015-06-20T16:21:50.160" LastActivityDate="2018-06-11T08:32:43.447" Title="Chained wireless links, low network bandwidth" Tags="|switch|wireless|tcp|layer2|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18912" PostTypeId="1" AcceptedAnswerId="19651" CreationDate="2015-06-02T13:25:05.333" Score="1" ViewCount="426" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QQSoB.png&quot; alt=&quot;Configuration&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a layer 3 3750 advertising its vlan interfaces via EIGRP to two routers. R1 and R2 connect to MPLS via 2 different carriers using BGP. R1 is the preferred path. My question is, how do I configure a default route for Core1 using EIGRP that will be aware of failures on either of these carriers.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-07-02T20:58:29.673" Title="Choosing Default Route for Multi-Homed L3 C3750" Tags="|cisco|bgp|eigrp|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="18915" PostTypeId="2" ParentId="18912" CreationDate="2015-06-02T18:32:46.020" Score="-1" Body="&lt;p&gt;You can't achieve the function you want with just a default route on Core1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might inject BGP routes within EIGRP on routers R1 &amp;amp; R2, and define a different weight to these 2 EIGRP neighbours at the Core1 level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If either R1 or R2 fails or their BGP neighbour fails, then all the traffic will use the remaining one once EIGRP will have updated its routes table. &lt;/p&gt;&#xA;" OwnerUserId="13986" LastActivityDate="2015-06-02T18:32:46.020" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18917" PostTypeId="2" ParentId="18912" CreationDate="2015-06-02T20:01:48.447" Score="1" Body="&lt;p&gt;Perhaps you could investigate using ip sla for your needs.&#xA;These links may not be exactly what you are searching for but it could help with searching on ip sla.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ciscozine.com/using-ip-sla-to-change-routing/&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscozine.com/using-ip-sla-to-change-routing/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://paulbeyer.wordpress.com/2013/09/14/configuring-cisco-ip-sla-and-object-tracking/&quot; rel=&quot;nofollow&quot;&gt;https://paulbeyer.wordpress.com/2013/09/14/configuring-cisco-ip-sla-and-object-tracking/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.geekmungus.co.uk/cisco-and-networking/failoverinternetconnectionusingipslatrackingandeigrproutingforinter-sitelinks&quot; rel=&quot;nofollow&quot;&gt;http://www.geekmungus.co.uk/cisco-and-networking/failoverinternetconnectionusingipslatrackingandeigrproutingforinter-sitelinks&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2015-06-02T20:01:48.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18918" PostTypeId="2" ParentId="18893" CreationDate="2015-06-02T21:02:42.187" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;is it reasonable to suggest that the relatively low mind share and vendor presence is a potential operational risk?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is the potential for both risks and rewards with choosing such a solution. Will the company disappear leaving the product abandoned? Possibly. Are there greater chances of bugs/problems with the code that aren't resolved in a timely fashion? Likely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But on the other hand, you could be on the cutting edge of new features, performance or other benefits. Larger vendors acquire smaller companies all the time to acquire innovative technology and intellectual property they develop. You could benefit from this innovation before it makes a wider impact on the industry. Even if it never does, there are many examples of technologies that may have been better but fade away due to other market considerations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, most of these types &quot;commodity&quot; or &quot;merchant&quot; silicone products are delivering high performance devices at much lower costs than the more established players in the market. Each organizations needs to balance their costs vs. their risks and make their own judgement.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the Open Network Install Environment (ONIE) really gaining traction in the Network Engineering space?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;ONIE really only applies to installing the OS on whitebox switches. As such, it likely isn't going to gain any real traction in more mainstream channels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there are some large Internet based companies that use ONIE or their own version of such software to install the OS on their own network infrastructure, usually along with having the hardware manufactured for them.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it the best choice for an environment that doesn't have the staff with the knowledge to maintain it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Frankly, there is no good choice in an environment that doesn't have the staff with the knowledge to maintain it. Without knowledgeable staff, even the best and most mainstream equipment will fail spectacularly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where I am personally split on solutions such as Cumulus Linux. It is marketed as fitting within potential *nix skill sets that may already exist in an organization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While this is true, I have my concerns. While most of the good *nix admins I have worked with have at least a decent understanding of networking, they aren't network engineers. Same as most of the good network engineers I know have a decent understanding of *nix. That doesn't mean I want a network engineer designing, implementing, operating, and troubleshooting my *nix environment, nor do I want a *nix admin doing the same for my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The flip side is that if you only have the resources to hire one or the other, it is the organization that has to make the decision on which is more important. If they do choose the *nix admin, then perhaps Cumulus Linux may be a better platform for them to operate than having to learn a new OS.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-06-02T21:02:42.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18928" PostTypeId="1" AcceptedAnswerId="18931" CreationDate="2015-06-03T14:52:31.163" Score="2" ViewCount="1335" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/7DP5e.png&quot; alt=&quot;Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The core1 is able to reach R1 and R2 connected interface and loopback0 interfaces. The problem is that R1 cannot reach R2's loopback and vice versa. Each device is able to hit each others physical interfaces.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    R1 - loopback0 10.x.x.1/32&#xA;    Router EIGRP 1&#xA;    network 10.x.x.1 0.0.0.0&#xA;    network 10.x.x.2 0.0.0.0&#xA;    network 10.x.x.3 0.0.0.0&#xA;eigrp router-id 10.x.x.1&#xA;    no auto-summary&#xA;&#xA;    R2 - loopback0 10.x.x.2/32&#xA;    Router EIGRP 1&#xA;    network 10.x.x.1 0.0.0.0&#xA;    network 10.x.x.2 0.0.0.0&#xA;    network 10.x.x.3 0.0.0.0&#xA;eigrp router-id 10.x.x.2&#xA;    no auto-summary&#xA;&#xA;    Core1 - loopback0 10.x.x.3/32&#xA;    Router EIGRP 1&#xA;    network 10.x.x.1 0.0.0.0&#xA;    network 10.x.x.2 0.0.0.0&#xA;    network 10.x.x.3 0.0.0.0&#xA;    eigrp stub connected summary&#xA;eigrp router-id 10.x.x.3&#xA;    no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems to me that Core1 is not passing its knowledge of R1 and R2's loopbacks.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="4634" LastEditDate="2015-06-03T14:57:57.847" LastActivityDate="2015-06-03T22:12:28.797" Title="EIGRP- Core not passing Loopback information of connected Routers" Tags="|cisco|eigrp|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18929" PostTypeId="2" ParentId="12557" CreationDate="2015-06-03T15:03:09.387" Score="2" Body="&lt;p&gt;Tested on one Archlinux i686 with namespace within VirtualBox:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables 1.6.1-1&#xA;iproute2 4.11.0-1&#xA;linux 4.10.13-1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Perform following on your App server, assuming your client IP from the right is 192.168.1.100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if your app server is at 192.168.1.1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip ro add 192.168.1.100/32 via 192.168.3.1&#xA;iptables -t nat -A PREROUTING  -i eth0 -s 192.168.1.100/32 -d 192.168.3.10 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if a standalone server 192.168.1.48 is sitting on the same network as eth1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sysctl net.ipv4.ip_forward=1&#xA;ip ro add 192.168.1.100/32 via 192.168.3.1&#xA;iptables -t nat -A PREROUTING  -i eth0 -s 192.168.1.100/32 -d 192.168.3.10 -p tcp --dport 80 -j DNAT --to-destination 192.168.1.48&#xA;iptables -t nat -A POSTROUTING -o eth1 -s 192.168.1.100/32 -d 192.168.1.48 -p tcp --dport 80 -j SNAT --to-source 192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tune IP/range/PAT as you see fit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nice ASCII btw.&lt;/p&gt;&#xA;" OwnerUserId="1554" LastEditorUserId="1554" LastEditDate="2017-05-28T04:37:35.217" LastActivityDate="2017-05-28T04:37:35.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18930" PostTypeId="1" AcceptedAnswerId="18932" CreationDate="2015-06-03T15:44:58.370" Score="5" ViewCount="2882" Body="&lt;p&gt;I've got a Ubiquiti EdgeRouter PoE (5 port) which I'm setting up just now. I'm trying to achieve a solution where the single UniFi AP can hand out IP addresses in the 10.0.2.0/23 space, while devices in the office which require a cable connection can get IPs in 10.0.0.0/23. So far I have set up:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Port 0 with address 192.168.1.1, patched directly to a port in the office so that I can still log into manage the router regardless of the other port settings.&lt;/li&gt;&#xA;&lt;li&gt;Port 1 connected to the internet line using DHCP&lt;/li&gt;&#xA;&lt;li&gt;Port 2, &quot;LAN&quot;, configured with an address of 10.0.0.1/23&lt;/li&gt;&#xA;&lt;li&gt;Port 3, &quot;WLAN&quot;, configured with an address of 10.0.2.1/23&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've set up two DHCP pools - one for 10.0.0.0/23, which correctly hands out IPs when you connected to the LAN port, and one for 10.0.2.0/23, which also correctly hands out IPs when you connect to the WLAN port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LAN port is connected to a switch, managed by the company above us who own the racks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now, I've connected the AP to the WLAN port, and I can see in the EdgeRouter UI that it has obtained a DHCP lease for 10.0.1.10 (yes, I would prefer to manually assign this outside of the DHCP range, but I don't think it affects this). However, when I run the UniFi controller on my laptop, connected via the switch to the LAN port, it can't see the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get the controller to see the AP, keep the LAN and WLAN DHCP pools separate, and still maintain routing between the two? I'm reading a lot about UniFi having issues when not connected to the same switch, which it isn't, but I don't see anything concrete about how to solve the problem! I'm wondering if I need to connect everything through the switch and use VLANs, but I've not used VLANs before and I don't know if that would just amount to the same setup! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've actually made some progess, in that I went with Jim G's &quot;Option 3&quot;, and I've at least got &lt;em&gt;some&lt;/em&gt; WiFi working. I have set up two SSIDs, one which applies the VLAN tag and one which leaves the traffic untagged. Untagged traffic through the AP successfully gets an IP in the 10.0.0.0 network and can access the internet. However traffic on the tagged SSID, which is the setup I really want, sees the same problem - an IP is handed out but there is no network access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some investigation with ping led me to see that initially after the DHCP lease is assigned, I &lt;em&gt;can&lt;/em&gt; ping the router and use the internet on the VLAN. However the response times from ping are around 5-7 &lt;em&gt;seconds&lt;/em&gt;, and then they start timing out and only come back occasionally (but they &lt;em&gt;do&lt;/em&gt; come back for the odd response). Given that they &lt;em&gt;do&lt;/em&gt; come back, the timing of just having connected may be insignificant though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit - here's the ping times and pattern:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;PING 10.0.2.1 (10.0.2.1): 56 data bytes&#xA;Request timeout for icmp_seq 0&#xA;Request timeout for icmp_seq 1&#xA;Request timeout for icmp_seq 2&#xA;Request timeout for icmp_seq 3&#xA;Request timeout for icmp_seq 4&#xA;64 bytes from 10.0.2.1: icmp_seq=0 ttl=64 time=5696.117 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=1 ttl=64 time=4987.305 ms&#xA;Request timeout for icmp_seq 7&#xA;Request timeout for icmp_seq 8&#xA;64 bytes from 10.0.2.1: icmp_seq=2 ttl=64 time=7390.786 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=3 ttl=64 time=6985.669 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=4 ttl=64 time=6236.806 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=5 ttl=64 time=5840.661 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=6 ttl=64 time=5108.968 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=7 ttl=64 time=4186.371 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=8 ttl=64 time=3535.087 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=9 ttl=64 time=2627.659 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=10 ttl=64 time=1683.275 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=11 ttl=64 time=776.689 ms&#xA;64 bytes from 10.0.2.1: icmp_seq=18 ttl=64 time=1878.685 ms&#xA;Request timeout for icmp_seq 20&#xA;Request timeout for icmp_seq 21&#xA;Request timeout for icmp_seq 22&#xA;Request timeout for icmp_seq 23&#xA;Request timeout for icmp_seq 24&#xA;Request timeout for icmp_seq 25&#xA;Request timeout for icmp_seq 26&#xA;Request timeout for icmp_seq 27&#xA;Request timeout for icmp_seq 28&#xA;Request timeout for icmp_seq 29&#xA;Request timeout for icmp_seq 30&#xA;Request timeout for icmp_seq 31&#xA;Request timeout for icmp_seq 32&#xA;^C&#xA;--- 10.0.2.1 ping statistics ---&#xA;34 packets transmitted, 13 packets received, 61.8% packet loss&#xA;round-trip min/avg/max/stddev = 776.689/4379.544/7390.786/2045.686 ms&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="15766" LastEditorUserId="15766" LastEditDate="2015-06-06T16:43:56.133" LastActivityDate="2015-06-06T16:43:56.133" Title="New Ubiquiti EdgeRouter and UniFi AP - keeping networks separate but reachable" Tags="|dhcp|subnet|lan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18931" PostTypeId="2" ParentId="18928" CreationDate="2015-06-03T16:39:36.880" Score="2" Body="&lt;p&gt;Remove the &lt;code&gt;eigrp stub connected summary&lt;/code&gt; from the Core1 router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An EIGRP stub router should not be a router that carries transit traffic (from R1 to R2). The options you specify on the stub command 'connected' and 'summary' mean that it will only advertise connected routes (the physical) and summary routes (which you don't specify having configured). &lt;/p&gt;&#xA;" OwnerUserId="1613" LastEditorUserId="1613" LastEditDate="2015-06-03T16:50:52.087" LastActivityDate="2015-06-03T16:50:52.087" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="18932" PostTypeId="2" ParentId="18930" CreationDate="2015-06-03T17:40:54.053" Score="4" Body="&lt;p&gt;By design, the two networks are segregated and can't communicate with each other.  You have a few options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;put the unifi controller on the WLAN network (not that great of an option)&lt;/li&gt;&#xA;&lt;li&gt;change the firewall/routing rules to allow the AP to communicate with the LAN (a bit of a security risk)&lt;/li&gt;&#xA;&lt;li&gt;put the AP on the LAN and use a VLAN for the WLAN traffic&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Option 3 is the cleanest, IMO.  All of the management traffic is on the LAN, but any wireless clients are put on the wireless VLAN.&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2015-06-03T17:40:54.053" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="18934" PostTypeId="2" ParentId="18236" CreationDate="2015-06-03T19:31:26.493" Score="3" Body="&lt;p&gt;In the absences of a feature like IGMP snooping, a L2 device will flood a copy of the frame out every active interface besides the one on which it was received. In your example, this means that both &lt;em&gt;SwA&lt;/em&gt; and &lt;em&gt;SwB&lt;/em&gt; will send the multicast traffic out every one of their active ports besides the receiving port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IGMP snooping is a feature on most modern enterprise switches which allows the switch to learn which devices are joined to which multicast groups and only forward the frame to those destination ports. In your example (assuming both &lt;em&gt;MachineB0&lt;/em&gt; and &lt;em&gt;MachineB1&lt;/em&gt; had joined the multicast group and are the only devices besides &lt;em&gt;MachineA0&lt;/em&gt; to do so), &lt;em&gt;SwA&lt;/em&gt; would send a copy to &lt;em&gt;SwB&lt;/em&gt; and &lt;em&gt;SwB&lt;/em&gt; will send a copy out the ports going to &lt;em&gt;MachineB0&lt;/em&gt; and &lt;em&gt;MachineB1&lt;/em&gt;. The frame would not be sent out any other active ports.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-06-03T19:31:26.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18935" PostTypeId="6" CreationDate="2015-06-03T19:33:07.517" Score="0" Body="&lt;p&gt;I debated nominating myself since the process started, but as the only current moderator active on the site most days I feel it is important to provide some continuity moving forward with the site. While I don't always have a lot of spare time, I do spend a fair amount of it here when I do have it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know how I moderate and my thoughts on the position, there should be ample information in the answers I have provided on &lt;a href=&quot;http://meta.networkengineering.stackexchange.com/&quot;&gt;meta&lt;/a&gt; for you to get a good feel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any questions, feel free to ask.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-06-03T19:33:07.517" LastActivityDate="2015-06-03T19:33:07.517" CommentCount="0" CommunityOwnedDate="2015-06-03T19:33:07.517" ContentLicense="CC BY-SA 3.0" />
  <row Id="18936" PostTypeId="1" CreationDate="2015-06-03T21:55:03.860" Score="2" ViewCount="138" Body="&lt;p&gt;I am not sure if this is the right place to ask this question. We have an overlapping in the responsibilities between the following departments: Network Admins, Server Admins, and Information Security. The main overlapping is in the F5 and Firewalls devices. I want to ask if there is a standard or best practice for the IT departments responsibilities which we can refer to when we have such overlapping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards, &lt;/p&gt;&#xA;" OwnerUserId="8366" LastEditorUserId="775" LastEditDate="2015-06-20T16:21:18.750" LastActivityDate="2015-09-18T19:20:24.177" Title="IT departments responsiblities standards (Network Admins, System Admins, and Information Security)" Tags="|firewall|f5|" AnswerCount="3" CommentCount="2" ClosedDate="2015-09-19T05:30:45.800" ContentLicense="CC BY-SA 3.0" />
  <row Id="18937" PostTypeId="2" ParentId="18928" CreationDate="2015-06-03T22:07:43.707" Score="0" Body="&lt;p&gt;You can overcome this by using a leak map. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list LEAKED_ROUTES permit x.x.x.x/x&#xA;route-map EIGRPSTUB_LEAK permit 10&#xA;match ip address prefix-list LEAKED_ROUTES&#xA;router eigrp 1&#xA;eigrp stub connected leak-map EIGRPSTUB_LEAK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15770" LastEditorUserId="33" LastEditDate="2015-06-03T22:12:28.797" LastActivityDate="2015-06-03T22:12:28.797" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18939" PostTypeId="2" ParentId="18936" CreationDate="2015-06-03T22:21:53.797" Score="-2" Body="&lt;p&gt;NERC / FERC / HIPAA / PCI are all authoritative bodies detailing secure administration of IT systems.  If different departments need different types of access to these devices, look for a multi-level administration facility/feature on these products and TACACS which enables logging of activity per username (RADIUS does not provide this functionality).  Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-03T22:21:53.797" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18942" PostTypeId="2" ParentId="7106" CreationDate="2015-06-03T23:19:46.737" Score="20" Body="&lt;p&gt;The answer above hits the nail on the head perfectly. However, when I first started out, it took me a few different examples from a couple of sources for it to really hit home. Therefore, if you're interested in other examples, I wrote a few blog posts on the subject - &lt;a href=&quot;http://www.oznetnerd.com/category/subnetting/&quot;&gt;http://www.oznetnerd.com/category/subnetting/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Admins, if this post is considered spam, please feel free to delete it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: As per YLearn's suggestion, I'll try to grab the relevant parts from Part 1 of my series, without pasting the whole entry here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's use 195.70.16.159/30 as an example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it is a /30, we know the host portion is going to be in the fourth octet. Let's convert that to binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128 64 32 16  8  4 2 1&#xA;SN  SN SN SN SN SN H H&#xA; 1   0  0  1  1  1 1 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now to find out the network address all we do is add the SN bits that have a 1 underneath them, together. (128 + 16 + 8 + 4 = 156).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you add this 156 to the first three octets of the address, we’re left with the &lt;strong&gt;Network Address&lt;/strong&gt; 195.70.16.156.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, as we know that the &lt;strong&gt;first usable address is always the Network Address plus one,&lt;/strong&gt; all we need to do is perform the following calculation: (156 + 1 = 157).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This gives us a &lt;strong&gt;First Usable Address&lt;/strong&gt; of 195.70.16.157.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let’s skip the Last Usable Address for a moment and find the Broadcast Address. To find out what it is, all we need to do is add all of the H bits together (regardless of whether they are a 1 or a 0) and then add this number to the Network Address. (2 + 1 + 156 = 159).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This gives us a &lt;strong&gt;Broadcast Address&lt;/strong&gt; of 195.70.16.159.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And finally, let’s work out the last usable address. This process is similar to finding the First Usable Address, however, instead of adding one to the network address, we actually subtract one from the Broadcast Address. (159 – 1 = 158).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This gives us a &lt;strong&gt;Last Usable Address&lt;/strong&gt; of 195.70.16.158.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And there we have it! Our temaplte is complete. For easy reference, here it is again:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Network Address:&lt;/strong&gt; 195.70.16.156&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;First Usable Address:&lt;/strong&gt; 195.70.16.157&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Last Usable Address:&lt;/strong&gt; 195.70.16.158&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Broadcast Address:&lt;/strong&gt; 195.70.16.159&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As a shortcut, you can also use this formula. It works on subnets of any size:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;First Usable Address&lt;/strong&gt; = Network Address + 1 &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Broadcast Address&lt;/strong&gt; = Next Network Address – 1&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Last Usable Address&lt;/strong&gt; = Broadcast Address – 1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2015-06-04T04:36:18.013" LastActivityDate="2015-06-04T04:36:18.013" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18943" PostTypeId="2" ParentId="18869" CreationDate="2015-06-03T23:46:36.080" Score="0" Body="&lt;p&gt;Mario, you mentioned:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Taking under consideration that some nodes are on different IP subnets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Unfortunately you cannot traverse subnets without an IP address. arping will do exactly what you want, except only on a single subnet/VLAN. If you'd like to scan the next network, you'll need to change the VLAN your &quot;scanning&quot; PC is on then re-run arping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a large amount of VLANs and the above solution would be too time consuming, you could either:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Install Angry IP (or any other IP scanner) on an existing server&#xA;which has an IP address. &lt;/li&gt;&#xA;&lt;li&gt;Find a spare IP on any subnet and assign it to a spare PC or server. You can then use this PC/server to perfom scans.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Doing either of these two things will allow you to scan all subnets without having to move your PC/server from VLAN to VLAN.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-06-03T23:46:36.080" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18945" PostTypeId="6" CreationDate="2015-06-04T04:15:16.937" Score="0" Body="&lt;p&gt;This stack needs some new blood in the moderation pool.  The Pro Tem mods have done a &lt;strong&gt;excellent&lt;/strong&gt; job of taking care of this site so far, but having some fresh talent might be a welcome change of pace.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not to mention it might be nice for some of the provisionals to take a breather - namely YLearn, &lt;a href=&quot;http://meta.networkengineering.stackexchange.com/questions/439/can-we-have-a-third-moderator-again#comment691_440&quot;&gt;who has been the solo moderator lately&lt;/a&gt;.  I'd like to help this stack grow and offload some of the moderating tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lately, I've been a little preoccupied with a move from England to Colorado, but I fully intend on getting back to the parent site as soon as I settle in (i.e. as soon as I close on my new house!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if you have any questions about how I operate.  I'd be happy to oblige.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2015-06-04T04:15:16.937" LastActivityDate="2015-06-04T04:15:16.937" CommentCount="0" CommunityOwnedDate="2015-06-04T04:15:16.937" ContentLicense="CC BY-SA 3.0" />
  <row Id="18946" PostTypeId="2" ParentId="18882" CreationDate="2015-06-04T05:11:36.863" Score="1" Body="&lt;p&gt;If I'm reading what you wrote correctly, both of those solutions appear to be pretty standard.  If you're working with a fixed amount of addresses, then you're left with 2 options - NAT or assign only when necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming your routers are capable of handling however many clients you need to NAT, then this option is totally viable.  Probably the easiest too.  You translate your addresses from an large scope to publicly routable addresses. Changing the DHCP lease duration might even become unnecessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have devices that absolutely need addressing from a predefined subnet, then you can always hand out this address range to the devices that &lt;strong&gt;need&lt;/strong&gt; it.  Oftentimes, phones and printers &lt;em&gt;don't&lt;/em&gt; fall into that category.  You stand to reduce address consumption by a significant margin if you get stingy with addresses.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2015-06-04T05:11:36.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18947" PostTypeId="1" CreationDate="2015-06-04T07:51:47.340" Score="6" ViewCount="18578" Body="&lt;p&gt;For a long time now we've been having huge connection problems at work.&#xA;The Internet connection is bad, for sure, but I don't think they are the main problem, they don't see any packet loss on their end and it's clearly happening every morning between 8 and 10, give or take half an hour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have three netgear GS724T plugged in a fortinet with two WAN ports. Looks like changing the WAN used doesn't change much, but the second connection, usually only used for VoIP, is so weak that it's hard to tell if it's the same problem or just if the connection is too slow for our needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just ran &lt;code&gt;get system performance status&lt;/code&gt; on the fortinet and I get the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU states: 0% user 6% system 0% nice 92% idle&#xA;Memory states: 56% used&#xA;Average network usage: 7137 kbps in 1 minute, 5229 kbps in 10 minutes, 4067 kbps in 30 minutes&#xA;Average sessions: 2471 sessions in 1 minute, 2542 sessions in 10 minutes, 2279 sessions in 30 minutes&#xA;Virus caught: 0 total in 1 minute&#xA;IPS attacks blocked: 0 total in 1 minute&#xA;Uptime: 238 days,  19 hours,  24 minutes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those stats seems a little high, I don't understand what is eating so much bandwith. Any way to know which IP is downloading?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fortinet is quite outdated I believe, running Fortigate-60 3.00,build0753,100217&lt;/p&gt;&#xA;" OwnerUserId="8085" LastEditorUserId="3191" LastEditDate="2015-06-05T04:00:22.120" LastActivityDate="2015-06-06T11:11:15.683" Title="How do I pinpoint bandwidth consumers on my Fortigate?" Tags="|troubleshooting|fortinet|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18948" PostTypeId="1" CreationDate="2015-06-04T08:32:13.087" Score="0" ViewCount="1958" Body="&lt;p&gt;I have a Mikrotik 750 router. I have an SVN server set up to run over https on server 192.168.1.111. I am going to have multiple machines using the standard ssl port so I decided to use port forwarding. From outside the firewall something would hit my public ip via svn.mydomain.com:5555 and it would forward to my machine 192.168.1.111:443&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using Rule:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;chain=dstnat action=dst-nat to-addresses=192.168.1.111 to-ports=443 &#xA; protocol=tcp in-interface=ether1-gateway dst-port=5555&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything works fine until I try use SVN behind the firewall. Of course I can access the server directly; however, that would mean changing the configuration every time I want to commit as I work from in and out of the network. I would rather be able to hit svn.mydomain.com:5555 from behind the firewall. What rule am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:Rules added&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I'm using master/slave configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;;; hairpin rule (not sure if to port is causing problems) &#xA;chain=srcnat action=masquerade to-ports=443 protocol=tcp &#xA;  src-address=192.168.1.0/24 dst-address=192.168.1.111&#xA;  out-interface=ether2-master-local dst-port=5555&#xA;&#xA;;;; another rule I tried&#xA;chain=dstnat action=dst-nat to-addresses=192.168.1.111 to-ports=443 &#xA;  protocol=tcp dst-address=192.168.1.111 dst-address-type=local &#xA;  in-interface=ether2-master-local dst-port=5555&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15773" LastEditorUserId="8499" LastEditDate="2018-02-14T16:46:01.693" LastActivityDate="2018-02-14T16:46:01.693" Title="Mikrotic 750 port forwarding behind firewall" Tags="|routing|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-09T23:52:27.733" ContentLicense="CC BY-SA 3.0" />
  <row Id="18949" PostTypeId="1" AcceptedAnswerId="19155" CreationDate="2015-06-04T09:18:55.337" Score="2" ViewCount="9741" Body="&lt;p&gt;I would like to know how to block routing between subnets on my Ubiquiti EdgeRouter. These subnets are on 6 different VLANs, and the layout goes like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 1    -  10.0.0.1/24 (management)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 100 - 10.1.1.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 200 - 10.2.1.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 300 - 10.3.1.1/24 (guest network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 400 - 10.4.1.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 450 - 10.4.2.1/24 (guest network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want VLAN 1 to have access into all the other networks, since it is the management network, and access to it is heavily secured, but I do not want any of the other networks to be able to talk to each other at all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also like to allow a group of admin computers access to any subnet either from VLAN 200's subnet, &lt;em&gt;or ideally,&lt;/em&gt; from any subnet (based on MAC address I suppose..)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel like this should be fairly simple to implement via some form of ACLs or Firewall rules, but I do not have a strong enough grasp of these concepts to implement this at this point in time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for your help!&lt;/p&gt;&#xA;" OwnerUserId="15698" LastActivityDate="2015-06-11T21:14:59.993" Title="Block Inter-Subnet Routing -Ubiquiti Edge Router" Tags="|routing|router|vlan|firewall|acl|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18951" PostTypeId="2" ParentId="18936" CreationDate="2015-06-04T11:55:51.803" Score="0" Body="&lt;p&gt;There are many documents on the roles of the IT department.  Some are informative and others are just worth the paper it was written on.  I have spent many years with the military and they have documents that define all roles.  You can use it as a base line for you discussion.  Most security roles start with Network Admins.  The server admins were involved when products like F5 started securing the Application layer of communications.  But most all security personnel were at one time a network person.  They were the ones that blocked all IP's on the router,  then it became a firewall appliance (PIX), now we have several vendors that have similar devices that are basically  the same.&lt;/p&gt;&#xA;" OwnerUserId="15780" LastActivityDate="2015-06-04T11:55:51.803" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18953" PostTypeId="2" ParentId="18936" CreationDate="2015-06-04T13:08:42.037" Score="0" Body="&lt;p&gt;There will always be overlap between these departments, nearly without exception.  How much that overlap is depends greatly on what the organization is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would your IAO &lt;em&gt;not&lt;/em&gt; be concerned with what the configuration of your networking equipment looks like?  Insecure SSH configurations, absent port-security config statements, and switch/router versions are all things a security professional's job entails.  The same can be said about servers.  On the flip side, there are portions of the Firewall that might be prudent for your network admins to get involved in (such as passively monitoring traffic).&lt;sup&gt;1&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IT field is one that requires a great deal of lateral affluence, so everyone is usually all up in everyone else's cool-aid.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt;&lt;sub&gt; In any case, &lt;em&gt;&quot;Responsibility&quot;&lt;/em&gt; is &lt;strong&gt;not&lt;/strong&gt; synonymous with &lt;em&gt;&quot;Unlimited Access&quot;&lt;/em&gt;.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2015-06-04T17:09:48.223" LastActivityDate="2015-06-04T17:09:48.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18954" PostTypeId="1" AcceptedAnswerId="18956" CreationDate="2015-06-04T14:04:26.223" Score="1" ViewCount="2060" Body="&lt;h1&gt;Context&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I am currently setting up a little cluster. For now, I only have one node configured and running (CentOS 7) : a management node. All the other nodes (compute nodes) aren't configured yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GQrxA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compute nodes run on RedHat 6, and I am trying to use Cobbler on my management node to provision them with Centos 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have installed Cobbler and configured it to PXE-boot one of my compute nodes and install Centos 7 on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The management node is on subnet 10.10.3.64/26, on VLAN n° 1301. The compute nodes' have to be provisionned with ip adresses in that subnet too.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Cobbler configuration&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I have cobbler configured to manage dns &amp;amp; dhcp. I have created a system object representing the node I want to provision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;/etc/cobbler/modules.conf&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[dhcp]&#xA;module = manage_isc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(whole file &lt;a href=&quot;https://gist.github.com/WinstonSureChill/0cca58ff1126101870ea&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;/etc/cobbler/settings&lt;/strong&gt; (relevant settings / settings I have changed)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;manage_dhcp: 1&#xA;manage_dns: 1&#xA;bind_master: 10.10.3.65&#xA;manage_forward_zones: ['linuxrt']&#xA;manage_reverse_zones: ['10.10.3']&#xA;next_server: 10.10.3.65&#xA;restart_dns: 1&#xA;restart_dhcp: 1&#xA;server: 10.10.3.65&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(whole file &lt;a href=&quot;https://gist.github.com/WinstonSureChill/0249e7d578d96acf4d1e&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(can't post more than 2 links, other configuration files linked in commentary)&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Problem&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;When I'm booting the compute node on PXE, it starts looking for the DHCP server, and then I get that error :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PXE-E51: No DHCP or proxyDHCP offers were received.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No dhcp logs are generated in /var/log/messages. I also tried to sniff for incoming packages on the management node with &lt;code&gt;tcpdump&lt;/code&gt;, but I see nothing coming from the compute-node. It seems like the node's dhcp queries don't reach the management node.&lt;/p&gt;&#xA;" OwnerUserId="15636" LastEditorUserId="15636" LastEditDate="2015-06-04T14:37:30.507" LastActivityDate="2015-06-04T14:55:02.210" Title="Cobbler PXE boot : dhcp issue" Tags="|dhcp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="18955" PostTypeId="6" CreationDate="2015-06-04T14:46:52.587" Score="0" Body="&lt;p&gt;My activities here speak for themselves. (For those not familiar with the SE navigation, you can &lt;a href=&quot;http://networkengineering.stackexchange.com/users/49/craig-constantine?tab=activity&quot;&gt;view all of my activities&lt;/a&gt; on my user page.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Several community members, myself included, have noted my degree of presence here is least-of-the-three of the temporary moderators. If elected, my time commitment would remain the same. I've done my best to be consistent in my &lt;strong&gt;moderation&lt;/strong&gt; work for my temporary term. The fact that I spend all of my availabe-here time on moderation activities makes my commitment patently obvious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe that a moderator is only a tool that acts on behalf of the community. We've had several calls for being more &quot;open&quot; or &quot;newbie Q&quot; friendly, and I think we can improve in that direction without going down the slippery slope to chaos. To improve, we'll need additional community members to participate in discussion and work in Meta to hammer out what exactly we should change and how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I invite you to ask questions of me in Meta. ...and frankly, if you're that involved, you should probably nominate yourself too. :)&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="49" LastEditDate="2015-06-04T14:46:52.587" LastActivityDate="2015-06-04T14:46:52.587" CommentCount="1" CommunityOwnedDate="2015-06-04T14:46:52.587" ContentLicense="CC BY-SA 3.0" />
  <row Id="18956" PostTypeId="2" ParentId="18954" CreationDate="2015-06-04T14:55:02.210" Score="2" Body="&lt;p&gt;Make sure the switchports of the DHCP server and the clients are in the same VLAN, or use a DHCP helper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DHCP protocol by default relies on the server and clients being in the same broadcast domain. If they're not, DHCP requests won't reach the server unless you define a DHCP helper address. &lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-06-04T14:55:02.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18957" PostTypeId="2" ParentId="18947" CreationDate="2015-06-04T15:25:26.923" Score="0" Body="&lt;p&gt;Have you tried using fortigate datasets? They allow you to create custom queries to report various logs from the system. An example from the fortigate manual: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This calculates an “hourstamp” to indicate the bandwidth per hour. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config report dataset&#xA;edit appctrl.Count.Bandwidth.Top10.Apps&#xA;set query “select (timestamp-timestamp%3600)&#xA;as hourstamp”&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15735" LastActivityDate="2015-06-04T15:25:26.923" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18958" PostTypeId="1" AcceptedAnswerId="18962" CreationDate="2015-06-04T16:07:40.633" Score="2" ViewCount="771" Body="&lt;p&gt;Is it possible for the throughput to be greater than the bandwidth of the cable ?Is it normal to have an average throughput of 10.401 Mbits/s on a cable of 10Mbits/s ?&lt;/p&gt;&#xA;" OwnerUserId="10654" LastActivityDate="2015-06-04T18:07:45.437" Title="can average througput be greater than bandwidth?" Tags="|bandwidth|throughput|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18959" PostTypeId="1" CreationDate="2015-06-04T16:18:23.423" Score="5" ViewCount="1543" Body="&lt;p&gt;I have configured a virtual network in azure that is linked back to our on premise Cisco ASA 5505 device. After setting up in Azure, I used the VPN device script which is provided by Microsoft through the Azure portal for our selected device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using putty, I logged onto the box using SSH and tried running the script but in the section:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! ACL and NAT rules&#xA;! &#xA;! Proper ACL and NAT rules are needed for permitting cross-premise network traffic.&#xA;! You should also allow inbound UDP/ESP traffic for the interface which will be used for the IPSec tunnel.&#xA;object-group network azure-networks&#xA;  network-object 10.100.1.0 255.255.255.0&#xA;exit&#xA;object-group network onprem-networks&#xA;  network-object 172.16.55.0 255.255.255.0&#xA;  network-object 172.16.129.0 255.255.255.0&#xA;exit&#xA;access-list azure-vpn-acl extended permit ip object-group onprem-networks object-group azure-networks&#xA;nat (inside,outside) source static onprem-networks onprem-networks destination static azure-networks azure-networks&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I encountered an error while trying to enter the final line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside,outside) source static onprem-networks onprem-networks destination static azure-networks azure-networks&#xA;                             ^&#xA;ERROR: % Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the marker between s^tatic&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While my gateway is showing in the Azure portal as connected, I have 300 Kb of data coming out but no data going in. I have tried pinging from within my local network, but I am experiencing 100% packet loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would the failure of the line above be accounting for this issue? How can I resolve it?&lt;/p&gt;&#xA;" OwnerUserId="15785" LastEditorUserId="8499" LastEditDate="2016-03-18T00:17:19.653" LastActivityDate="2018-08-05T19:01:46.950" Title="Azure Virtual network connection to Cisco ASA 5505" Tags="|cisco-asa|vpn|nat|firewall|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18961" PostTypeId="2" ParentId="18857" CreationDate="2015-06-04T18:04:46.563" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Set user for guaranteed speed of 1Mb and max speed of 2Mb.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is absolutely possible.  Dell has an article outlining this specifically; &lt;a href=&quot;https://support.software.dell.com/kb/sw12385&quot; rel=&quot;nofollow&quot;&gt;How To Configure Bandwidth Management with limits Per IP (SW12385)&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Enable &lt;code&gt;Advanced Bandwidth Management&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Activate bandwidth management on WAN interface and declare the interface speed&lt;/li&gt;&#xA;&lt;li&gt;Generate a new bandwidth object and configure it for &lt;code&gt;Per-IP Bandwidth Management&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Edit your default &lt;code&gt;any -&amp;gt; any&lt;/code&gt; firewall rule and enable the bandwidth object you created earlier for both ingress and egress.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also I would like to know if I can set a user for 1Mb of speed with&#xA;  maximum of 2 GB of download per day then have it reduced automatically&#xA;  to 256Kb after consuming his 2 GB for the day.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can't find any documentation that says you can do this, so I would imagine per-ip based bandwidth management is about as close as you can get to evening the playing field for everyone.  This is usually sufficient as you wouldn't stand to benefit much from limiting someone who has reached this limit if they aren't effecting anyone else (because you're already guaranteeing bandwidth evenly).  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also I would like to know if I can put such rules on applications&#xA;  instead of users.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes this is certainly possible, but is accomplished in a couple different areas.  It's slightly more involved, too, since you setup everything manually versus the per-IP based solution which works across the board.  Dell has another write-up for that, as well; &lt;a href=&quot;https://support.software.dell.com/kb/sw11515&quot; rel=&quot;nofollow&quot;&gt;UTM: Configuring Bandwidth Management for HTTP Websites using App Rules feature (SW11515)&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create &lt;code&gt;Bandwidth&lt;/code&gt; object&lt;/li&gt;&#xA;&lt;li&gt;Create &lt;code&gt;Action&lt;/code&gt; object&lt;/li&gt;&#xA;&lt;li&gt;Match that Action object to the sites you want (or don't want)&lt;/li&gt;&#xA;&lt;li&gt;Map the &lt;code&gt;Bandwidth&lt;/code&gt; object to the &lt;code&gt;Action&lt;/code&gt; object with an &lt;code&gt;App Rule&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Since this is all performed under the &lt;code&gt;Firewall&lt;/code&gt; section, it should just begin working across the board.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2015-06-04T18:04:46.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18962" PostTypeId="2" ParentId="18958" CreationDate="2015-06-04T18:07:45.437" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible for the throughput to be greater than the bandwidth of the cable ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Like many things, the devil is often in the details. Depending on how the measurement is taken, then yes it is possible. For instance, if you are using some sort of &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wan/data-compression/14156-compress-overview.html&quot; rel=&quot;noreferrer&quot;&gt;data compression&lt;/a&gt; and an application is measuring the amount of actual (uncompressed) data sent between two end points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With no data compression, the same means of measuring can produce a lower throughput than the actual number of bits sent across the medium. This is because overhead (such as frame or packet headers for example) may not be counted. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it normal to have an average throughput of 10.401 Mbits/s on a cable of 10Mbits/s ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In my experience, no it is not normal to expect compression on a network link. However it is fairly common for forms of compression to exist at higher levels of the OSI model, such as &lt;a href=&quot;http://en.wikipedia.org/wiki/HTTP_compression&quot; rel=&quot;noreferrer&quot;&gt;HTTP compression&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-06-04T18:07:45.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18965" PostTypeId="1" CreationDate="2015-06-04T19:01:35.640" Score="3" ViewCount="4761" Body="&lt;p&gt;Is there an equivalent command/function either from CLI or SmartDashboard similar to the ASA 'packet-tracer' command?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For those unfamiliar with 'packet-tracer' - in the ASA CLI we are able to test flows in this manner:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;packet-tracer input INSIDE tcp 172.16.23.5 1025 8.8.8.8 80 det&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where the RFC1918 address is the source, and 8.8.8.8 is the destination.  This command is used to verify rule input and assess which rules a given flow is either being allowed or denied by.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastEditorUserId="1353" LastEditDate="2015-06-04T20:34:49.050" LastActivityDate="2020-12-05T20:21:00.797" Title="Checkpoint equivalent of Cisco ASA packet-tracer?" Tags="|checkpoint|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18966" PostTypeId="6" CreationDate="2015-06-04T19:51:33.587" Score="0" Body="&lt;p&gt;Although I've been in doubt if I should nominate myself for this position, I think it's in the best interest of this SE to do so. My doubt was mostly related to &lt;a href=&quot;http://meta.networkengineering.stackexchange.com/questions/467/why-did-mike-pennington-quit-as-a-moderator&quot;&gt;Mike's 2nd reason for stepping down&lt;/a&gt;. However, since I'm one of the most active people in reviewing posts at this moment I think I should consider stepping forward, encouraged by Mike's words. Also, by stepping forward as a 4th person, people actually have something to chose now, which I think is a good thing (even though the current moderators do a great job).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's obvious that this SE needs more than one active moderator, so I think it's a good thing this election is coming. Since I'm already doing a lot of the reviews, it would be a logical step to become one of the moderators. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any questions, feel free to ask!&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2015-06-04T19:51:33.587" LastActivityDate="2015-06-04T19:51:33.587" CommentCount="2" CommunityOwnedDate="2015-06-04T19:51:33.587" ContentLicense="CC BY-SA 3.0" />
  <row Id="18967" PostTypeId="2" ParentId="18551" CreationDate="2015-06-04T20:19:55.347" Score="3" Body="&lt;p&gt;Depending on when the commands were typed in, this sounds like the expected behaviour.  If &lt;code&gt;Switch A&lt;/code&gt; were plugged into &lt;code&gt;Switch B&lt;/code&gt;, and &lt;code&gt;Switch A&lt;/code&gt; moved to the trunk state, then DTP on &lt;code&gt;Switch B&lt;/code&gt; would have negotiated trunk mode.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how DTP &lt;em&gt;normally&lt;/em&gt; negotiates the interface mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Table 3-8 DTP Negotiated Interface Modes&#xA;&#xA;                Dynamic       Dynamic     Trunk        Access&#xA;                Auto          Desirable&#xA;&#xA;Dynamic Auto    Access        Trunk       Trunk        Access &amp;lt;-- Should be here&#xA;&#xA;&#xA;Dynamic         Trunk         Trunk       Trunk        Access&#xA;Desirable&#xA;&#xA;Trunk           Trunk         Trunk       Trunk        Limited &#xA;                                                   connectivity&#xA;&#xA;Access          Access        Access      Limited      Access&#xA;                                      connectivity&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=2181837&amp;amp;seqNum=8&quot; rel=&quot;nofollow&quot;&gt;Cisco Press, Cisco Networking Academy's Introduction to VLANs, Table 3-8&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you disabled DTP on &lt;code&gt;Switch A&lt;/code&gt;, then &lt;code&gt;Switch B&lt;/code&gt; would have no further knowledge of any changes in interface changes on &lt;code&gt;Switch A&lt;/code&gt;.  So moving &lt;code&gt;Switch A&lt;/code&gt; to access will not be conveyed to &lt;code&gt;Switch B&lt;/code&gt;, as it would have normally expected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you reset the connection between them, &lt;code&gt;Switch B&lt;/code&gt; would have never changed it's mode to trunk and remain in access mode.  Then you'd be having the total opposite problem (&lt;code&gt;Switch B&lt;/code&gt; not turning into a trunk).&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2015-06-04T20:19:55.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18968" PostTypeId="1" AcceptedAnswerId="18972" CreationDate="2015-06-04T20:34:35.637" Score="3" ViewCount="1562" Body="&lt;p&gt;What is the command to use to disable ping replies from a brocade switch? Baasically, I am trying to disable any outbound ping messages to inbound ICMP request messages. I stumbled upon &lt;a href=&quot;http://www.brocade.com/downloads/documents/html_product_manuals/NI_05700b_SWITCHING/GUID-8A988E76-5D12-408A-BA11-E162D32216D0.html&quot; rel=&quot;nofollow&quot;&gt;brocade-broadcast-requests&lt;/a&gt; but this still allows the brocade switch to be pingable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Brocade switch: NetIron CES 2024C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Software version: 5.3.0T185&lt;/p&gt;&#xA;" OwnerUserId="10254" LastEditorUserId="10254" LastEditDate="2015-06-04T21:05:46.340" LastActivityDate="2016-01-03T08:00:47.583" Title="Disable ping replies on brocade switch" Tags="|switch|brocade|ping|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="18970" PostTypeId="2" ParentId="18562" CreationDate="2015-06-04T21:06:19.600" Score="2" Body="&lt;p&gt;As I wrote in my comment, the problem is at the remote (from the 6509) end of one or both links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your comment, this appears to have been the case (application problem).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-06-04T21:06:19.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18972" PostTypeId="2" ParentId="18968" CreationDate="2015-06-04T23:06:03.513" Score="2" Body="&lt;p&gt;You would need to create an ACL to filter the ICMP traffic (edit: referring to ping here - it's generally not advisable to filter all ICMP), and apply it to the desired interfaces, including the management interface. You would specify host addresses that match your router's management interface, as well as any addresses of routed interfaces.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list 666 deny any x.x.x.x icmp echo&#xA;ip access-list 666 deny any x.x.x.x icmp echo-reply&#xA;ip access-list 666 deny any y.y.y.y icmp echo&#xA;ip access-list 666 deny any y.y.y.y icmp echo-reply&#xA;ip access-list 666 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;x.x.x.x&lt;/code&gt; and &lt;code&gt;y.y.y.y&lt;/code&gt; would represent your addresses that you wish to filter. Continue to add addresses as you see fit. Don't forget the explicit &lt;code&gt;permit&lt;/code&gt; at the end. Once you have the ACL created, you would then apply it to your desired interfaces in the inbound direction.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-group 666 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ETA: the &lt;code&gt;echo-reply&lt;/code&gt; rules may be superfluous, since one shouldn't be generated if the original &lt;code&gt;echo&lt;/code&gt; is filtered by the ACL. I don't have a Brocade at hand to test.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2015-06-04T23:21:42.957" LastActivityDate="2015-06-04T23:21:42.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18975" PostTypeId="2" ParentId="18947" CreationDate="2015-06-05T03:58:16.277" Score="4" Body="&lt;p&gt;This sounds like a case study for &lt;a href=&quot;http://en.wikipedia.org/wiki/SFlow&quot; rel=&quot;nofollow&quot;&gt;sFlow&lt;/a&gt;.  The best way for you to figure out what's going wrong is to figure out who's talking to who - and how much.  Just spin up your favorite sFlow analyzer and start tracking the bandwidth consumption of individual users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example sFlow configuration pulled from sflow.com that you'd put on your WAN interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config system sflow&#xA;   set collector-ip 10.X.X.X&#xA;   set collector-port 6343&#xA;end&#xA;&#xA;config sys interface&#xA;    edit&#xA;       set sflow-sampler enable&#xA;       set sample-rate 64&#xA;       set sample-direction both&#xA;       set polling-interval 30&#xA;    next&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Configuration snippet pulled from &lt;a href=&quot;http://blog.sflow.com/2010/04/configuring-fortigate-appliances.html&quot; rel=&quot;nofollow&quot;&gt;sflow.com, Configuring FortiGate appliances&lt;/a&gt;.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2015-06-05T03:58:16.277" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="18976" PostTypeId="1" CreationDate="2015-06-05T04:34:00.790" Score="6" ViewCount="586" Body="&lt;p&gt;On the SG300-52, I've noticed that SNMP monitoring of LAGs versus regular switch ports give incorrect (way too large and unrealistic) values for the octets transferred. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For simplicities sake, let's say I have two devices connected a SG300-52 switch. One of these devices is using LAG (802.3ad) with GigE ports while one is not (vanilla GigE). Transferring data from device 2 (non-LAG) to device 1 (LAG) shows an average rate of ~80MB/s on device 2 and device 1 using software interface monitoring tools. Monitoring SNMP ifOutOctets the LAG port for device 1 shows an average bandwidth (so the derivative of the raw SNMP value) of ~320MB/s. Looking at ifInOctets for the non-LAG device 2 port shows an average bandwidth of ~80MB/s. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even ignoring the implausibly large value for bandwidth of the LAG device, communication to this device is only from the non-LAG device, i.e. there aren't other devices on this switch that are communicating with the LAG device at the same time as this test.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using ifHC*Octets yields even more ridiculous results for the LAG group, while non-LAG ports still report bandwidth correctly. Has anyone else come across this?&lt;/p&gt;&#xA;" OwnerUserId="15347" LastEditorUserId="8499" LastEditDate="2016-10-30T05:41:55.997" LastActivityDate="2018-06-22T16:13:47.647" Title="Cisco SG300-52 SNMP ifInOctets Values Unreasonable" Tags="|cisco|snmp|ieee-802.1ax|cisco-sg300|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18977" PostTypeId="2" ParentId="18551" CreationDate="2015-06-05T07:19:51.060" Score="1" Body="&lt;p&gt;DTP by default has 300 seconds of Dynamic Trunk timeout. So, Switch B will change its port operational mode to &quot;static access&quot; if it will have not received any DTP advertisement to trunk in the next 300 seconds [after it changes the port operational mode to &quot;static access&quot; or since the receive of the DTP advertisement to trunk].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested and the Switch B's port operational mode was changed from &quot;trunk&quot; to &quot;static access&quot; after 300 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: The statement in [ ] is not confirmed. It is supposed to be either one.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-06-05T07:19:51.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18978" PostTypeId="1" AcceptedAnswerId="19151" CreationDate="2015-06-05T07:58:54.083" Score="7" ViewCount="2297" Body="&lt;p&gt;According to Cisco SNMP object navigator, &lt;code&gt;ifCounterDiscontinuityTime&lt;/code&gt;(1.3.6.1.2.1.31.1.1.1.19) counter is the value of &lt;code&gt;sysUpTime&lt;/code&gt; on the most recent occasion at which any one or more of this interfaces counters suffered a discontinuity. How to cause this discontinuity? I have tried to disable router interface(&quot;shutdown&quot; and &quot;no shutdown&quot; for five seconds), removing physical cable for five seconds from router port, but still the value of &lt;code&gt;ifCounterDiscontinuityTime&lt;/code&gt; is zero:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# snmpwalk -v 2c -c public 192.168.1.1 1.3.6.1.2.1.31.1.1.1.19&#xA;iso.3.6.1.2.1.31.1.1.1.19.1 = Timeticks: (0) 0:00:00.00&#xA;iso.3.6.1.2.1.31.1.1.1.19.2 = Timeticks: (0) 0:00:00.00&#xA;iso.3.6.1.2.1.31.1.1.1.19.3 = Timeticks: (0) 0:00:00.00&#xA;iso.3.6.1.2.1.31.1.1.1.19.4 = Timeticks: (0) 0:00:00.00&#xA;iso.3.6.1.2.1.31.1.1.1.19.5 = Timeticks: (0) 0:00:00.00&#xA;# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I even caused &lt;code&gt;Counter32&lt;/code&gt; type counter to wrap, but the &lt;code&gt;ifCounterDiscontinuityTime&lt;/code&gt; stayed zero:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ snmpwalk -v 2c -c public 192.168.1.1 ifInOctets.10107&#xA;IF-MIB::ifInOctets.10107 = Counter32: 4278115545&#xA;$ snmpwalk -v 2c -c public 192.168.1.1 1.3.6.1.2.1.31.1.1.1.19.10107&#xA;IF-MIB::ifCounterDiscontinuityTime.10107 = Timeticks: (0) 0:00:00.00&#xA;$ snmpwalk -v 2c -c public 192.168.1.1 ifInOctets.10107&#xA;IF-MIB::ifInOctets.10107 = Counter32: 18656065&#xA;$ snmpwalk -v 2c -c public 192.168.1.1 1.3.6.1.2.1.31.1.1.1.19.10107&#xA;IF-MIB::ifCounterDiscontinuityTime.10107 = Timeticks: (0) 0:00:00.00&#xA;$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;192.168.1.1&lt;/code&gt; is a Cisco switch and &lt;code&gt;10107&lt;/code&gt; is a SNMP &lt;code&gt;ifIndex&lt;/code&gt; for port Gi0/7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When does the SNMP &lt;code&gt;ifCounterDiscontinuityTime&lt;/code&gt; counter change in Cisco IOS?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="3620" LastEditDate="2015-06-10T15:11:45.950" LastActivityDate="2015-06-15T04:21:23.883" Title="When does the Cisco IOS SNMP &quot;ifCounterDiscontinuityTime&quot; counter change?" Tags="|cisco|snmp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18979" PostTypeId="1" AcceptedAnswerId="18989" CreationDate="2015-06-05T08:18:01.210" Score="7" ViewCount="1005" Body="&lt;p&gt;Under which circumstances Cisco IOS interface SNMP counters(for example &lt;code&gt;ifHCOutOctets&lt;/code&gt; or &lt;code&gt;ifInErrors&lt;/code&gt;) start from zero? I am aware that &lt;code&gt;clear counters&lt;/code&gt; does not affect SNMP counters. In addition, as far as I know, it is not possible to clear SNMP counters from CLI or with &lt;code&gt;snmpset&lt;/code&gt;. However, reloading the router will. In addition, counter wrap(for example &lt;code&gt;ifOutOctets&lt;/code&gt; will get larger than 4294967295) will cause SNMP counters to start from zero. Are there any other circumstances where Cisco IOS interface SNMP counters can start from zero?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-06-05T13:30:59.107" Title="Under which circumstances Cisco IOS interface SNMP counters start from zero?" Tags="|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18981" PostTypeId="2" ParentId="18965" CreationDate="2015-06-05T09:25:40.117" Score="2" Body="&lt;p&gt;Checkpoint has the &lt;em&gt;fw monitor&lt;/em&gt; command which should provide similar informations. &lt;a href=&quot;http://yurisk.info/2009/12/12/fw-monitor-command-reference/&quot; rel=&quot;nofollow&quot;&gt;This reference&lt;/a&gt; looks pretty good.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2015-06-05T09:25:40.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18982" PostTypeId="1" CreationDate="2015-06-05T11:34:58.993" Score="2" ViewCount="2144" Body="&lt;p&gt;&lt;code&gt;Jun  5 16:48:44.567 IST: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up&#xA;Jun  5 16:48:45.725 IST: %SW_MATM-4-MACFLAP_NOTIF: Host 001c.c45b.9dd4 in vlan 102 is flapping between port Gi0/1 and port Fa0/2&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;interface FastEthernet0/2&#xA; description &quot;Connected to SI01TTS1-T1-2For Data &quot;&#xA; port-type nni&#xA; switchport access vlan 102&#xA; spanning-tree portfast&#xA;end&#xA;interface GigabitEthernet0/1&#xA; description &quot; connecting to SDC-SWH-IVRS-6 GI 0/2&quot;&#xA; port-type nni&#xA; switchport trunk allowed vlan 102,200&#xA; switchport mode trunk&#xA;end&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="15806" LastEditorUserId="33" LastEditDate="2015-06-05T15:47:08.207" LastActivityDate="2015-06-05T15:47:08.207" Title="VLAN Flapping Betwen trunk port and access port" Tags="|switching|" AnswerCount="0" CommentCount="2" ClosedDate="2015-06-05T15:51:50.037" ContentLicense="CC BY-SA 3.0" />
  <row Id="18983" PostTypeId="1" AcceptedAnswerId="18987" CreationDate="2015-06-05T11:44:44.860" Score="12" ViewCount="89927" Body="&lt;p&gt;I've recently been taking over an OpenStack environment that makes use of neutron networking with the use of GRE tunneling. We had a problem with network performance and I determined it to be an issue with the MTU setting in certain VM instances being set to the default 1500, whereas they really needed to be set lower, to say 1456 to allow for the encapsulation of the packets within packets over GRE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While researching this I came upon these 2 sites:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://techbackground.blogspot.co.uk/2013/06/path-mtu-discovery-and-gre.html&quot; rel=&quot;noreferrer&quot;&gt;Path MTU discovery and GRE&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://packetlife.net/blog/2008/aug/18/path-mtu-discovery/&quot; rel=&quot;noreferrer&quot;&gt;Path MTU Discovery&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;On the second URL there was this diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;img src=&quot;https://i.stack.imgur.com/cALxm.png&quot; alt=&quot;img1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does the F0/0 and F0/1 notation around the router in that diagram mean?&lt;/p&gt;&#xA;" OwnerUserId="5483" LastEditorUserId="56030" LastEditDate="2020-07-03T14:05:24.477" LastActivityDate="2020-07-03T14:05:24.477" Title="What does the notation F0/0 and F0/1 mean in this diagram?" Tags="|routing|mtu|gre|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18984" PostTypeId="2" ParentId="18983" CreationDate="2015-06-05T12:05:41.597" Score="9" Body="&lt;p&gt;F0/0 and F0/1 look to be router interface notations to highlight a physical connection into the router from the two respective hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically they could be:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Fa: FastEthernet&lt;/li&gt;&#xA;&lt;li&gt;Gi: GigabitEthernet&lt;/li&gt;&#xA;&lt;li&gt;Ten: Ten GigabitEthernet&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15807" LastEditorUserId="5483" LastEditDate="2015-06-05T13:14:19.267" LastActivityDate="2015-06-05T13:14:19.267" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18985" PostTypeId="1" AcceptedAnswerId="19091" CreationDate="2015-06-05T12:16:49.800" Score="4" ViewCount="369" Body="&lt;p&gt;Am I correct that minimum interval for IOS &lt;code&gt;kron&lt;/code&gt; for reoccurring tasks is 1 minute(&lt;code&gt;kron occurrence test in 1 recurring&lt;/code&gt;)?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-06-10T10:01:12.787" Title="What is the minimum interval for IOS kron?" Tags="|cisco-ios|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18986" PostTypeId="2" ParentId="18947" CreationDate="2015-06-05T12:31:25.057" Score="1" Body="&lt;p&gt;I found FirePlotter, with the trial license it's able to generate graph per service and source IP, it's pretty good. Just needs an ssh access to the router.&#xA;Tried it this morning, nothing really strange in the list, but we didn't have much problems compared to yesterday. I guess I'll try again monday but it looks like the problem really isn't on the fortinet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What seems strange is it's almost all morning, and then the rest of the day it works mostly fine. Guess I'll ask the ISP again if they see a problem !&lt;/p&gt;&#xA;" OwnerUserId="8085" LastActivityDate="2015-06-05T12:31:25.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18987" PostTypeId="2" ParentId="18983" CreationDate="2015-06-05T12:33:52.563" Score="17" Body="&lt;p&gt;@3iron's answer gave me the hint that I needed. The notation is denoting that there are multiple NIC interfaces on the router in the diagram and it's making reference to this.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;F0/0 - interface #1&lt;/li&gt;&#xA;&lt;li&gt;F0/1 - interface #2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; The F indicates that the NIC/port is most likely a Fast Ethernet type of connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/3725-multiservice-access-router/62611-c2800-62611.html&quot; rel=&quot;noreferrer&quot;&gt;This diagram from the Cisco website&lt;/a&gt; shows them as well. Here's the referenced as Fa 0/1, which I believe is the more typical notation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;nbsp;&amp;nbsp;&lt;img src=&quot;https://i.stack.imgur.com/jA2yh.png&quot; alt=&quot;ss#1&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other interesting take away is that the notation may sometimes include a 3rd digit to denote that the interface being referenced is not built into the Motherboard of the networking gear. The above diagram shows some examples of this, ie. T1 1/0/1. &lt;strong&gt;NOTE:&lt;/strong&gt; The 3rd digit prefixes, and indicates which &quot;slot&quot; on the Motherboard a port is coming from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again the Cisco reference describes these slots like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;img src=&quot;https://i.stack.imgur.com/VWfe6.png&quot; alt=&quot;ss#2&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was also able to dig up this reference: &lt;a href=&quot;http://computernetworkingnotes.com/cisco-devices-administration-and-configuration/router-switch-nomenclature.html&quot; rel=&quot;noreferrer&quot;&gt;Interface Nomenclature Guide of Router and Switch&lt;/a&gt; which describes the reference of F0/0 like so. Take note that there are 2 types of situations:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Fixed interface series router&lt;/li&gt;&#xA;&lt;li&gt;Modular interface series router&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This notation was originally used for fixed types of routers:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In fixed interface series router, the interface nomenclature is type slot_#/ port_#.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But with the advent of modular routers, that did not denote which addon card (WIC) was being referenced. So the notation was expanded:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;New naming convention only for WIC slots (WAN Interface Card) is type slot_#/subslot_#/ port_#.&lt;/li&gt;&#xA;  &lt;li&gt;Ports installed directly on chassis still use classic convention that is type slot_#/ port_#.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Incidentally that same site had this table which describes the F0/0 notation like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;nbsp;&amp;nbsp;&amp;nbsp;&lt;img src=&quot;https://i.stack.imgur.com/Yup0Q.png&quot; alt=&quot;ss#3&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional searches did turn up this URL: &lt;a href=&quot;http://www.dummies.com/how-to/content/standard-router-ports.html&quot; rel=&quot;noreferrer&quot;&gt;Standard Router Ports&lt;/a&gt; which had these types of ports listed:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Aux port:&lt;/strong&gt; This auxiliary port is used to connect a modem to the router, which can then be used to remotely modify the configuration on the router.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Attachment Unit Interface (AUI) port:&lt;/strong&gt; Before the WIC became a standard for providing expansion through an add-on port, the AUI allowed transceivers to be used, providing you with the ability to add various types of network connections, such as fiber or copper Ethernet connections.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Serial:&lt;/strong&gt; Connects a modem or other serial device to allow a WAN network interface to be used on the router.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Ethernet/Fast Ethernet/Gigabit Ethernet:&lt;/strong&gt; Standard network interfaces used to connect different network segments.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Console:&lt;/strong&gt; Serial configuration port for command-line access to router management and configuration. Refer to Figure 3-1 to see the console port.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;WAN Interface Card (WIC) port:&lt;/strong&gt; Because a wide variety of WAN connectivity options are available (for example, T1, ISDN, ADSL), you can use this port to add different interfaces to a standard router.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Hardware WAN Interface Card (HWIC) port:&lt;/strong&gt; With the integration of services into routers, the WIC interface became too limiting. The HWIC interface was created to support a wider variety of hardware expansion options, such as switches and service cards. This port is backward compatible with most older WIC hardware.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As well as this URL: &lt;a href=&quot;http://www.omnisecu.com/cisco-certified-network-associate-ccna/different-types-of-interfaces-in-a-cisco-router.php&quot; rel=&quot;noreferrer&quot;&gt;Different types of interfaces in a Cisco Router&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Ethernet&lt;/strong&gt; - Ethernet is typically Ethernet IEEE 802.3 standard based physical interface, which operates at 10 Mbps speed. The media standard used is 10BaseT.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Fast Ethernet&lt;/strong&gt; - Fast Ethernet is typically Ethernet IEEE 802.3u standard based physical interface which operates at 100 Mbps speed. The media standard used is 100BaseT.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Gigabit Ethernet&lt;/strong&gt; - Gigabit Ethernet is typically Ethernet IEEE 802.3ab standard based physical interface which operates at 1000 Mbps speed. The media standard used is 1000BASE-T&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Serial&lt;/strong&gt; - Serial interfaces are typically used for WAN connections from ISP (Internet Service Providers) for connectivity types like Frame Relay, T1, T3, etc.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;FDDI Fiber Distributed Data Interface&lt;/strong&gt; - FDDI networks operates at 100 Mbps speed and uses a token-passing mechanism to prevent collisions.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Token Ring&lt;/strong&gt; - Token Ring interfaces can operate at either 4 Mbps or 16 Mbps. In Token Ring networks a token is passed around the network (configured in ring topology), allowing the owner of the token to transmit a frame, to avoid collision.Token Ring networks vanished from networking industry long way back. New Cisco routers do not have a Token Ring interface.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Only 10Mbps Ethernet interface has a name &quot;Ethernet&quot; in a Cisco Router. A 100Mbps Ethernet interface is called a &quot;FastEthernet&quot; interface and a 1000Mbps Ethernet interface is called a &quot;GigabitEthernet&quot; interface.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That last bit is a bit more telling. Since Ethernet would historically been used for 10MBps interfaces, the &quot;F&quot; in my &quot;F0/0&quot; &amp;amp; &quot;F0/1&quot; diagram would seem to imply that the interface is a FastEthernet capable connection (10/100MBps). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, more recently, Ethernet can also be used interchangeably on Gigabit Ethernet as well as 10G Ethernet ports, so you need to pay special attention to the actual equipment that's been referenced by a diagram.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;References&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/3725-multiservice-access-router/62611-c2800-62611.html&quot; rel=&quot;noreferrer&quot;&gt;Interface and Line Numbers in Cisco 1800, 2800 and 3800 Series Routers&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.dummies.com/how-to/content/standard-router-ports.html&quot; rel=&quot;noreferrer&quot;&gt;Standard Router Ports&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.omnisecu.com/cisco-certified-network-associate-ccna/different-types-of-interfaces-in-a-cisco-router.php&quot; rel=&quot;noreferrer&quot;&gt;Different types of interfaces in a Cisco Router&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="5483" LastEditorUserId="5483" LastEditDate="2015-06-05T16:50:02.013" LastActivityDate="2015-06-05T16:50:02.013" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="18988" PostTypeId="1" CreationDate="2015-06-05T12:39:06.990" Score="2" ViewCount="83" Body="&lt;p&gt;We are having some touch panels put in that will control a new refrigeration system we are having put in.  These panels can be set up for remote access, so if an alarm goes off they can make any adjustments via the iOS app or through a web browser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way I can use only one external IP, and then point them to the different hosts via what port it's coming in on or anything?  We have a Cisco ASA5510 as our firewall.  Or will I have to use a separate IP address for all 5 panels?  Thank you.&lt;/p&gt;&#xA;" OwnerUserId="14318" LastEditorUserId="8499" LastEditDate="2018-02-16T04:08:06.650" LastActivityDate="2018-02-16T04:08:06.650" Title="Single IP address pointing to multiple different hosts?" Tags="|firewall|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="18989" PostTypeId="2" ParentId="18979" CreationDate="2015-06-05T13:30:59.107" Score="6" Body="&lt;p&gt;SNMP counters will not be cleared while the device is up. The idea is that the software polling the counters will keep a tally of the current counter and simply looks at the delta since the last poll. See also &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/26007-faq-snmpcounter.html&quot; rel=&quot;noreferrer&quot;&gt;this Cisco FAQ about SNMP counters&lt;/a&gt;, which says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Q. How do I poll queue limit drops on a router?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;A. With the use of SNMP, there is no way for the show interfaces command to break out the individual elements that go into the output drops.&lt;/p&gt;&#xA;&lt;p&gt;Consider this new information about what goes into the output drops counter:&lt;/p&gt;&#xA;&lt;p&gt;Input drops = Queue limit drops + Throttling drops + SMT queue full drops + RSRB drops + no buffer drops&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;In addition, SNMP counters are never cleared, even if the interfaces are cleared.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="220" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-06-05T13:30:59.107" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="18991" PostTypeId="2" ParentId="18988" CreationDate="2015-06-05T14:17:41.100" Score="-1" Body="&lt;p&gt;If the touch panels can be forced to listen to their remote access on a different port than the default, you can set each one up on a separate port then create NAT rules in the ASA to map (example:) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;external_ip:5555-&gt;panel_1_ip:5555&lt;/p&gt;&#xA;&#xA;&lt;p&gt;external_ip:5556-&gt;panel_2_ip:5556&lt;/p&gt;&#xA;&#xA;&lt;p&gt;etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they can't, you can set up NAT rules with different five different ports on the outside IP and map them to the different internal panel IPs like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;external_ip:5555 -&gt; panel_1_ip:3389&lt;/p&gt;&#xA;&#xA;&lt;p&gt;external_ip:5556 -&gt; panel_2_ip:3389&lt;/p&gt;&#xA;&#xA;&lt;p&gt;external_ip:5557 -&gt; panel_3_ip:3389&lt;/p&gt;&#xA;&#xA;&lt;p&gt;etc.&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-06-05T14:17:41.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18992" PostTypeId="1" AcceptedAnswerId="18996" CreationDate="2015-06-05T15:37:24.023" Score="10" ViewCount="10072" Body="&lt;p&gt;If I'm sending traffic from host A to B by a switch, will enabling a mirror/SPAN port increase the time it takes for my frames to get from A to B?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nb: I'm not worried about the time it takes for the mirrored frame to reach my monitoring host. Just wondering if it will affect the network performance in a time-critical environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone tested this? (I would also welcome any links to a post/paper on this)&lt;/p&gt;&#xA;" OwnerUserId="8852" LastActivityDate="2015-06-05T18:02:33.057" Title="Does port mirroring cause additional latency?" Tags="|switch|mirror|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="18994" PostTypeId="1" CreationDate="2015-06-05T16:01:58.367" Score="2" ViewCount="360" Body="&lt;p&gt;My team has 100 developers. They each have a computer and on that computer, they have two nics facing our router. WiFi and their virtual machine (VMWare nic). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have a network inside of my network that is only comprimised of virtual machines. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Traffic from host -&amp;gt; main network -&amp;gt; internet&#xA;Traffic from VM   -&amp;gt; Virtual Network -&amp;gt; No internet connection&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way, my developers can have their virtual machines talking to each other (TCP/IP) yet their dev machines (virtual) don't have to be managed by IT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think VLans could be used in this way. &lt;/p&gt;&#xA;" OwnerUserId="5439" LastActivityDate="2015-06-05T16:31:03.320" Title="Virtual Machines on a seprate vlan" Tags="|vlan|private-vlan|" AnswerCount="1" CommentCount="0" ClosedDate="2019-06-25T00:14:00.000" ContentLicense="CC BY-SA 3.0" />
  <row Id="18995" PostTypeId="2" ParentId="18994" CreationDate="2015-06-05T16:31:03.320" Score="1" Body="&lt;p&gt;Yes, VLANs can be used this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'd do given that you have separate NICs for the VMs themselves, I'd set all switchports on the switch(es) as access ports to the new VLAN that connect to the VM NICs. This way, you don't have to reconfigure each VM/hypervisor to trunk mode on the specific VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That will allow all VMs to inter-communicate (depending on network security configuration of course) by default, pending a changing of IP addresses if the VM subnet is not currently separate from the main network's subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll then have to trunk all switches together for the new VLAN, and depending on how you have the default gateway set up, you'll have to likely make changes to your router(s) as well, and transfer the default gw IP to the VLAN interface of the new VLAN.&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-06-05T16:31:03.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18996" PostTypeId="2" ParentId="18992" CreationDate="2015-06-05T16:42:37.287" Score="7" Body="&lt;p&gt;Typically, according to Cisco, &quot;The impact on the high-speed switching fabric is negligible&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This of course depends on your switch, its fabric and the load on the switch itself. The port that is being sent the copied data could drop packets however, if it's oversubscribed too heavily. Personally, I've never experienced any sort of detriment by using mirroring or SPAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a doc from Cisco directly about the subject on some of their cat lines: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html#anc48&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html#anc48&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-06-05T16:42:37.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="18997" PostTypeId="1" AcceptedAnswerId="18999" CreationDate="2015-06-05T17:14:46.473" Score="10" ViewCount="27985" Body="&lt;p&gt;The &lt;a href=&quot;http://www.linfo.org/mtu.html&quot;&gt;maximum size is 1500 Bytes&lt;/a&gt;.  Is there a lower limit? 1? 64?  Must it be a multiple of two?  Is there somewhere I can look to learn more?&lt;/p&gt;&#xA;" OwnerUserId="15812" LastActivityDate="2022-05-31T19:26:56.943" Title="What is the minimum MTU size?" Tags="|mtu|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="18999" PostTypeId="2" ParentId="18997" CreationDate="2015-06-05T17:53:16.413" Score="8" Body="&lt;p&gt;Yes, &lt;strong&gt;IPv4 implementations&lt;/strong&gt; require a minimum MTU of 68 bytes per &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;See Peter's answer for more detail.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-07T21:17:53.720" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19000" PostTypeId="2" ParentId="18992" CreationDate="2015-06-05T18:02:33.057" Score="3" Body="&lt;p&gt;It is possible to affect the sources (i.e. monitored ports) if the aggregate traffic exceeds the capability of the destination (i.e the monitoring port). I don't have the reference I was initially thinking of, but here's another: &lt;a href=&quot;https://supportforums.cisco.com/discussion/11840451/back-pressure-span-port&quot; rel=&quot;nofollow&quot;&gt;Back pressure from a SPAN port&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So imagine you have server on a ten-gig port that you want to SPAN to a packet capture device (or IDS/IPS, etc.). The monitoring device is also on a ten-gig interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that when you set up a SPAN, you have the option of SPANning transmit (out of the switch interface towards the server), or receive (from the server into the switch) , or both. Normally we would want to see both sides of a conversation, so we'd choose to SPAN both the transmit and received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now imagine that the server is very busy, and both it's transmit and receive streams are quite full, consistently above 5-gig in each direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You now want to send TWO, greater-than-5-gig streams to the monitoring device via the SPAN destination port. The total traffic being sent towards the SPAN destination is greater than 10-gig. But, that interface is ONLY 10-Gig towards the monitoring device. So what happens? I recall that Cisco's docs said that initially, packets would be dropped from the transmit buffer of the interface towards the monitoring device (i.e. the SPAN destination transmit buffer). However, in the case of long-duration, sustained traffic streams, eventually the ability of the switch to drop excess traffic from the transmit buffer will be exhausted (which does not, and did not at the time, make sense to me), and then the switch will begin to use other mechanisms to decrease the flow, including 'back pressure' using 802.3x PAUSE frames being sent to the source ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And you have now impacted your source traffic. Bad things happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This problem is/was especially significant to a large, high-speed very low latency network, that had many sources for the SPAN. Which was a major consideration and resulted in replacing the use of SPAN sessions having many sources for optical TAPS, feeding aggregation switches with inbound ACLs (filtering for interesting traffic), then trunking that inbound traffic to multiple 10-Gig specialized packet consumers (for data archive and analysis needs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moral of the story: if you are intending to use many SPAN sources, be confident that the aggregate bandwidth of BOTH tx and rx is less than the bandwidth to your capture device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.lovemytool.com/blog/2007/08/span-ports-or-t.html&quot; rel=&quot;nofollow&quot;&gt;Here's a decent treatise on using SPAN ports&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10660" LastActivityDate="2015-06-05T18:02:33.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19001" PostTypeId="2" ParentId="18635" CreationDate="2015-06-05T19:29:20.240" Score="3" Body="&lt;p&gt;It is absolutely possible to communicate through a TCP connection, and as jwbensley mentioned, Scapy is an excellent tool for packet manipulation.  However, in your instance, I would stick with something like &lt;a href=&quot;http://nc110.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;netcat&lt;/a&gt;. Netcat is a low overhead tool that allows you to read/write data over the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple implementation of a TCP connection might look a lot like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Zgrkpnr@server:~$ netcat -l 4444&#xA;&#xA;Zgrkpnr@client:~$ netcat server_ip 4444&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More examples can be found over at &lt;a href=&quot;http://www.thegeekstuff.com/2012/04/nc-command-examples/&quot; rel=&quot;nofollow&quot;&gt;The Geek Stuff&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2015-06-05T19:29:20.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19002" PostTypeId="2" ParentId="18978" CreationDate="2015-06-05T19:57:37.747" Score="3" Body="&lt;p&gt;I think discontinuity refers to an abnormality. I found &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.31.1.1.1.19#oidContent&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The value of sysUpTime on the most recent occasion at which any one or&#xA;  more of this interface's counters suffered a discontinuity. The&#xA;  relevant counters are the specific instances associated with this&#xA;  interface of any Counter32 or Counter64 object contained in the&#xA;  ifTable or ifXTable. If no such discontinuities have occurred since&#xA;  the last re- initialization of the local management subsystem, then&#xA;  this object contains a zero value.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;to me, that implies that &quot;discontinuity&quot; is related to bit-size-integer-rollover.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you see the sysTime change, you know that counters that are now showing smaller-than-last-time-checked values have, in fact, wrapped around, as if you had rebooted.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2015-06-05T19:57:37.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19003" PostTypeId="2" ParentId="18635" CreationDate="2015-06-05T20:12:22.627" Score="-1" Body="&lt;p&gt;&lt;del&gt;If you simply want to send datagrams, &lt;a href=&quot;https://api.jquery.com/jquery.get/&quot; rel=&quot;nofollow&quot;&gt;jQuery AJAX&lt;/a&gt; should work fine?&lt;/del&gt; (AJAX uses HTTP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.npmjs.com/package/raw-socket&quot; rel=&quot;nofollow&quot;&gt;Raw sockets&lt;/a&gt; on top of node.js.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to develop something:&lt;br&gt;&#xA;I use &lt;a href=&quot;http://en.wikipedia.org/wiki/Node.js&quot; rel=&quot;nofollow&quot;&gt;node.js&lt;/a&gt;.  You can craft anything you can imagine.  &lt;a href=&quot;https://cloud.google.com/&quot; rel=&quot;nofollow&quot;&gt;Google Cloud Platform&lt;/a&gt;, for example, offers a free 60-day trial of up to (30) VMs w pubic ip addresses that you can develop/test on.  Alternatively, you could get a $50 rasperry pi and network it (provided your ISP allows you to map/have a routable public IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.hacksparrow.com/node-js-udp-server-and-client-example.html&quot; rel=&quot;nofollow&quot;&gt;Here's an example&lt;/a&gt; UDP server and client.  Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-06-06T03:22:59.740" LastActivityDate="2015-06-06T03:22:59.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19004" PostTypeId="2" ParentId="18315" CreationDate="2015-06-05T20:29:57.060" Score="3" Body="&lt;p&gt;NTP isn't particularly jitter-sensitive because it uses &lt;code&gt;originate&lt;/code&gt; and &lt;code&gt;transmit&lt;/code&gt; timestamps to keep track of delay.  &lt;a href=&quot;http://www.ntp.org/ntpfaq/NTP-s-algo.htm#Q-ALGO-BASIC-SYNC&quot; rel=&quot;nofollow&quot;&gt;Ntp.org explains in detail how it keeps delay in check&lt;/a&gt;, but here's a snippet:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Synchronizing a client to a network server consists of several packet&#xA;  exchanges where each exchange is a pair of request and reply. When&#xA;  sending out a request, the client stores its own time (originate&#xA;  timestamp) into the packet being sent. When a server receives such a&#xA;  packet, it will in turn store its own time (receive timestamp) into&#xA;  the packet, and the packet will be returned after putting a transmit&#xA;  timestamp into the packet. When receiving the reply, the receiver will&#xA;  once more log its own receipt time to estimate the traveling time of&#xA;  the packet. The traveling time (delay) is estimated to be half of &quot;the&#xA;  total delay minus remote processing time&quot;, assuming symmetrical&#xA;  delays.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The reason this isn't in the same category as network control is because this isn't directly responsible for the operation of routing/forwarding of packets.  All of the things in the network management category are not critical components of the networking system as a whole.  If you lost any packets related to SNMP, syslog, or NTP, you likely wouldn't even notice.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SNMP would simply retransmit that information since it's TCP based.  Even if the connection dropped all together, nothing catastrophic would happen; you might just get a &lt;em&gt;snmp agent not responding&lt;/em&gt; and then try again.  If you lost syslog traffic (UDP), you would simply lose a blip of logging information, which is probably still contained within the buffer or in a log file on the device.  Since NTP calculates delay based on previous packets, while also accounting for the maximum offset error, you really aren't running into any issues.  Worst case scenario, your time drifts by a few picoseconds…&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you lost a packet related to routing, even for a second, you may be facing the entire system going down; rendering any other markings worthless.  At that point, NTP would simply fall totally out of sync and rely on it's local ticker to keep time.&lt;/p&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2015-06-05T20:29:57.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19005" PostTypeId="6" CreationDate="2015-06-05T21:13:58.917" Score="0" Body="&lt;p&gt;I followed this site through its Area 51 phase, doing my best to keep the proposal alive and making sure that it graduates to beta phase. We've come a long way since and the site is about to graduate again. I put a lot of time into it because it struck me that this site would fill a niche that no other Q&amp;amp;A site fills right now. There are vendor-forums and mailinglists but no easy-to-google place for network engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my mind moderators are a necessary function but moderation should only happen when it supports the community. We need more active users with high reputation and I hope to support the site to get there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The final reason for this nomination is simple: Give people more choice. Please look at all candidates and look at what each one has to say. Make a choice for this election but more importantly: Keep asking and answering questions. Help to grow the site and make it a great place to find answers for all the networking people around the world.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2015-06-05T22:35:25.553" LastActivityDate="2015-06-05T22:35:25.553" CommentCount="4" CommunityOwnedDate="2015-06-05T21:13:58.917" ContentLicense="CC BY-SA 3.0" />
  <row Id="19006" PostTypeId="2" ParentId="18839" CreationDate="2015-06-05T21:28:21.160" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; family ethernet-switching and other families are mutually exclusive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're using too many parameters under the &lt;code&gt;family&lt;/code&gt; stanza.  This extra parameter is &lt;code&gt;family inet&lt;/code&gt; based on this: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;”On this interface I have already configured IP address.”&lt;/em&gt; &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Run &lt;code&gt;user@qfx5100# delete interfaces ge-0/0/0.0 family inet&lt;/code&gt;.  Optionally, you could delete all of ge-0/0/0.0 with &lt;code&gt;user@qfx5100# delete interfaces ge-0/0/0.0&lt;/code&gt; and then put your configurations back in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When running &lt;code&gt;show interfaces&lt;/code&gt; and &lt;code&gt;show vlans&lt;/code&gt;, you should see this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members Customer1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/20 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members Customer1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }    &#xA;}&#xA;vlans {&#xA;    Customer1 {&#xA;        vland-id 11;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2015-07-06T14:36:18.047" LastActivityDate="2015-07-06T14:36:18.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19007" PostTypeId="2" ParentId="18983" CreationDate="2015-06-05T21:59:33.240" Score="0" Body="&lt;p&gt;Short Answer: F0/0 and F0/1 are the &quot;names&quot; of the interfaces in the examples. Since they're names, it can be dangerous to infer anything from them (see below).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Longer Answer:&#xA;This naming nomenclature is common in Cisco switches and as such has been cloned by many other switch providers to prevent having to train engineers on two different naming methodologies.  This means that both the vendor and when the device was made may impact how the term is applied.  In some devices it may indicate expansion card and port capabilities while others just hardcode names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are going to try and determine actual product capabilities it would be best to use something like Link Layer Discovery Protocol (LLDP) or something similar which is a little more rigorously defined and based on current operating conditions of your network.&lt;/p&gt;&#xA;" OwnerUserId="15821" LastActivityDate="2015-06-05T21:59:33.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19009" PostTypeId="2" ParentId="18882" CreationDate="2015-06-05T23:44:09.457" Score="4" Body="&lt;p&gt;If you are running out of IP address in a DHCP pool, you really only have four options to address the problem:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Return unused address to the pool faster&lt;/strong&gt;: this is done by reducing the lease time. This is a popular option for situations like wireless networks at EDUs where they may have hundreds of devices moving in/out of a building as classes change. This will not help if you don't have devices moving on/off the network fairly frequently.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Add additional IP addresses to the pool&lt;/strong&gt;: The simplest way to do this is to check any static DHCP assignments (or reserved ranges of IPs) to make sure they are current and remove any outdated/unused/unneeded assignments releasing those IP addresses back into the pool. If not, or this was already done, two additional ways to do this would be to increase the size of the subnet (i.e. moving from a /24 to a /23) or to add an additional subnet to the pool; both of these options may require addition configuration on the network or individual devices (i.e. ones that may be configured to not use DHCP).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Remove devices from the pool&lt;/strong&gt;: by reducing the number of devices requesting addresses, this should make more available. Remove old/unused devices from the network or if the pool is shared by both wired and wireless devices, ensure that a device isn't requesting an address on both at the same time (allowing one device to take up two IP addresses from the pool).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Create a new pool&lt;/strong&gt;: this can almost be viewed as part of #3 as some devices will need to be moved to this new pool. However it is a bit more involved as it requires additional configuration of the DHCP server (or a second server), typically additional configuration on the router/gateway devices, and usually a new VLAN/subnet which may mean additional configuration changes through the network.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I think that covers just about every solution to this problem that I have worked with in my career. Which actual solution will work best in any given situation is highly dependent on that environment.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-06-06T05:17:20.863" LastActivityDate="2015-06-06T05:17:20.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19013" PostTypeId="2" ParentId="14944" CreationDate="2015-06-06T04:40:39.480" Score="3" Body="&lt;p&gt;The operating temperature is advertised to be sufficient  (14 to 131° F) per the &lt;a href=&quot;http://dl.ubnt.com/datasheets/unifi/UniFi_AP_DS.pdf&quot; rel=&quot;nofollow&quot;&gt;data sheet&lt;/a&gt; but the antennas are integrated omni-directional.  A common approach to warehouses is to use directional antennae to direct the signal down aisles (along with adjusting the power level of the radios).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to answer your question, no those are not the right AP's.  A better way is go use directional antennae.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-06T04:40:39.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19014" PostTypeId="1" AcceptedAnswerId="19017" CreationDate="2015-06-06T10:02:04.667" Score="0" ViewCount="194" Body="&lt;p&gt;I'm having trouble figuring setup for my network, have done quite some reading and testing already, yet still, some solutions remain unclear to me and I hope to find an answer for these here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I need to achieve is &lt;strong&gt;setup a classless configuration for a private, C-type network of a minimum of 15 sub-networks&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I have read, a &lt;strong&gt;class network&lt;/strong&gt; with sub-networks has fixed mask, which remains the same for each an every sub-network, making the whole setup inefficient. A classless network has a variable mask, allowing IP address to be divided into hosts and network parts according to current requirements. Having that in mind I'm doing the following calculations which were described as classless IP assignment:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP: 192.168.1.0/24&#xA;2^4=4 networks available (2 bits taken from the hosts part)&#xA;2^6-2=62 hosts in each max (6 bits left)&#xA;New mask: 26 =&gt; 255.255.255.192&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1st network&#xA;Subnet: 192.168.1.0&#xA;First address: 192.168.1.1&#xA;Last address: 192.168.1.62&#xA;Broadcast: 192.168.1.63&#xA;&#xA;2nd network&#xA;Subnet: 192.168.1.64&#xA;First address: 192.168.1.65&#xA;Last address: 192.168.1.126&#xA;Broadcast: 192.168.1.127&#xA;&#xA;    etc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How is the above different from regular sub-networks division? It seems to be the same as the mask does not change. Is VLSM a way to go here? What is the real difference between class and classless network? How should the proper setup look like?&lt;/p&gt;&#xA;" OwnerUserId="15825" LastEditorUserId="42290" LastEditDate="2017-12-13T10:57:53.810" LastActivityDate="2017-12-13T10:57:53.810" Title="classless network" Tags="|ipv4|" AnswerCount="1" CommentCount="5" ClosedDate="2015-06-06T16:19:13.060" ContentLicense="CC BY-SA 3.0" />
  <row Id="19015" PostTypeId="2" ParentId="18947" CreationDate="2015-06-06T11:11:15.683" Score="3" Body="&lt;p&gt;Some advice that comes to my mind:&lt;br&gt;&#xA;1. The FG-60 is quite old, right, but it's &lt;em&gt;nowhere&lt;/em&gt; from being overloaded. Watch the memory consumption (preferably in the CLI, &lt;code&gt;get sys perf stat&lt;/code&gt;) - if it crosses the 70% line you will have problems. None if below.&lt;br&gt;&#xA;2. During the morning rush it might be that the &lt;em&gt;upload&lt;/em&gt; capacity of your link is overloaded while there still is plenty of download BW. That of course only applies if your line is asymmetrical (ADSL).&lt;br&gt;&#xA;3. FOS doesn't have sflow support until (guess) v4.3. I doubt if it could tell you more than polling by &lt;strong&gt;SNMP&lt;/strong&gt; which is fully supported. For a graphical frontend to SNMP you've already found Fireplotter but there is e.g. &lt;strong&gt;Splunk&lt;/strong&gt; with a Fortinet add-on module. Splunk allows for long term surveillance of virtually any counter available through SNMP, along with graphs etc. Or you could use &lt;strong&gt;Cacti&lt;/strong&gt; for monitoring, again using SNMP. Splunk and Cacti are Open Source. &#xA;4. Please do a reboot of the FGT after, say, 2-3 months. As in every piece of software there are memory leaks in FortiOS which might lead to really strange behavior.&lt;br&gt;&#xA;5. Before investing in a new Fortigate (what else?) your local Fortinet partner should provide a &lt;strong&gt;demo unit&lt;/strong&gt; for 2 weeks. This is standard procedure with Fortinet. It will take some effort to convert your configuration to the new FortiOS version (currently v5.0 or v5.2) but that is inevitable.&lt;br&gt;&#xA;A model FG-60D should suffice by far. Even your boss will have to admit that his company's needs have risen 10fold over the last 10 years or so, and we are talking (only) about $1500 here, hardware, contract and work included.&lt;br&gt;&#xA;FortiOS v5, and especially v5.2, will give you excellent, realtime graphs with drilldown capabilities, down to a session or a source host.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2015-06-06T11:11:15.683" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19016" PostTypeId="2" ParentId="7037" CreationDate="2015-06-06T11:27:11.270" Score="2" Body="&lt;p&gt;(This question seems to be stale but might be found while searching anyway.)&lt;br&gt;&#xA;The debug message indicates that the Fortigate drops this traffic as being from an unknown source net. This is called the Reverse Path Check or anti-spoofing feature. The absence of other messages here signifies that a route to the source network for this packet is missing, which can be&lt;br&gt;&#xA;- either a directly connected subnet on a port or&#xA;- a route statically assigned or learned by a routing protocol&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So your first action would be to look into the Routing Monitor (not the routing table!) which is showing the active routes. You can access it either from the GUI (System&gt;Router&gt;Monitor) or from the CLI with the command listed above by @Puglet.&lt;br&gt;&#xA;If there is a route back to the source subnet then check if there is a valid policy to allow this traffic.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can research these symptoms in the Fortinet Knowledgebase which is publically accessible at &lt;a href=&quot;http://kb.fortinet.com&quot; rel=&quot;nofollow&quot;&gt;http://kb.fortinet.com&lt;/a&gt;. For instance, look up &lt;a href=&quot;http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&amp;amp;docType=kc&amp;amp;externalId=FD35076&quot; rel=&quot;nofollow&quot;&gt;http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&amp;amp;docType=kc&amp;amp;externalId=FD35076&lt;/a&gt; for RPF.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2015-06-06T11:27:11.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19017" PostTypeId="2" ParentId="19014" CreationDate="2015-06-06T12:38:49.970" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How is the above different from regular sub-networks division?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well, Classless Inter-Domain Routing (CIDR) is about reclaiming unused address space.  Take a classful Class A network for instance - 1.0.0.0/8.  Below is from an IP Address calculator on Linux:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Address:   1.0.0.0              00000001. 00000000.00000000.00000000&#xA;Netmask:   255.0.0.0 = 8        11111111. 00000000.00000000.00000000&#xA;Wildcard:  0.255.255.255        00000000. 11111111.11111111.11111111&#xA;=&gt;&#xA;Network:   1.0.0.0/8            00000001. 00000000.00000000.00000000&#xA;HostMin:   1.0.0.1              00000001. 00000000.00000000.00000001&#xA;HostMax:   1.255.255.254        00000001. 11111111.11111111.11111110&#xA;Broadcast: 1.255.255.255        00000001. 11111111.11111111.11111111&#xA;Hosts/Net: 16777214              Class A&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Look at the output above, you can see that this customer has at their disposal &gt;16 million IP Addresses - it's just ridiculously ludicrous!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, ARIN (American Registry of Internet Numbers) can walk up to this customer and tell them, look here, you only have 20 employees - do you really need over 16 million IP Address (or 838,860 IP Addresses per employee)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARIN can then reduce this customers waste and make it available to others needing it more and cuts down this customers' Network from a classful Class A network to a classless network of 1.0.0.0/24:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Address:   1.0.0.0              00000001.00000000.00000000. 00000000&#xA;Netmask:   255.255.255.0 = 24   11111111.11111111.11111111. 00000000&#xA;Wildcard:  0.0.0.255            00000000.00000000.00000000. 11111111&#xA;=&gt;&#xA;Network:   1.0.0.0/24           00000001.00000000.00000000. 00000000&#xA;HostMin:   1.0.0.1              00000001.00000000.00000000. 00000001&#xA;HostMax:   1.0.0.254            00000001.00000000.00000000. 11111110&#xA;Broadcast: 1.0.0.255            00000001.00000000.00000000. 11111111&#xA;Hosts/Net: 254                   Class A&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please note that although the designation is still a Class A network (this is solely inferred by the fact that the 1st bit (from the left - aka the most significant bit) is a 0), the IP Address usage has been reduced significantly - from 16,777,214 IP Address per network, to just 254!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just remember though, that having too many networks just for the sake of it could also be wasteful as you lose 2 IP Address for every network!&lt;/p&gt;&#xA;" OwnerUserId="9963" LastActivityDate="2015-06-06T12:38:49.970" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19020" PostTypeId="1" AcceptedAnswerId="19062" CreationDate="2015-06-07T02:45:56.260" Score="2" ViewCount="450" Body="&lt;p&gt;I'm working on replicating some research wherein users were profiled based on the SSIDs they asked for when sending out 802.11 probe requests. I only captured probe requests, so information from clients rather than APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each probe request contains the sender's MAC address, as well as the SSID they're looking for. I gathered about 200,000 probes from around the city where I live, and over 70% of the probes I gathered had a MAC address that wasn't listed in the IEEE OUI database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About half of those MAC addresses had the self-assigned bit set, which I would expect for iOS8 devices sending probe requests, but I don't think I would expect that proportion of devices to be iPhones, given their market share relative to Android.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The statistics I have from that data set are 9% Apple, 36% invalid OUI without the self-assigned bit set, 34% invalid with the self-assigned bit set, and 20% valid vendors other than Apple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plausibly, the 43% of users either self-assigned or specifically Apple could be iOS users, taking into account the number of unique MAC addresses being higher if a new one is being randomly generated for each probe request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'm still not sure why there would be such a large proportion of invalid OUIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find any sources on widespread adoption of randomised MAC addresses in any OS; someone suggested that several &quot;small name&quot; vendors might be generating invalid/random MACs to prevent having to buy their own OUI, but I wouldn't have thought they would be such a high proportion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So, in conclusion:&lt;/strong&gt; 70% of MAC addresses sampled had an invalid OUI when sending probe requests, and only around half of those had the &quot;self-assigned&quot; bit set, hence leaving about half who are invalid for no reason I can find; does anyone know why this might be?&lt;/p&gt;&#xA;" OwnerUserId="15838" LastEditorUserId="15838" LastEditDate="2015-06-09T03:44:58.727" LastActivityDate="2018-12-14T07:08:20.933" Title="Why do the majority of probe requests captured have an invalid OUI in their MAC address?" Tags="|mac-address|mobile|ieee-802.11|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19022" PostTypeId="1" AcceptedAnswerId="19023" CreationDate="2015-06-07T11:10:24.927" Score="3" ViewCount="3404" Body="&lt;p&gt;I am not sure how to configure HSRP in my scenario:&#xA;I have 2 distribution 2950 switches, each connected to two core  3560 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Distribution switches work in VTP transparent mode and (for now) all access ports on Access switches are in VLAN 100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default gateway address is 192.168.1.1 for HSRP virtual IP address. I basically have two pairs of links, from each Distribution switch. Should I configure two separate HSRP groups for each switch connected to Core layer, let's say:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Group 1&#xA;Core 1 - Port 0/1 - IP 192.168.1.2 - priority 105 connected to Distribution 1&#xA;Core 2 - Port 0/1 - IP 192.168.1.3 - priority 100 connected to Distribution 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Group 2&#xA;Core 1 - Port 0/2 - IP 192.168.1.4 - priority 105 connected to Distribution 2&#xA;Core 2 - Port 0/2 - IP 192.168.1.5 - priority 100 connected to Distribution 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;? Should they all have standby IP address set to 192.168.1.1??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GCotV.png&quot; alt=&quot;Full topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I need to set up HSRP for Distribution 1 &amp;amp; 2, based on that example I can handle the rest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would you suggest using SVIs?&lt;/p&gt;&#xA;" OwnerUserId="4392" LastEditorUserId="4392" LastEditDate="2015-06-07T11:59:51.767" LastActivityDate="2015-06-07T14:16:02.913" Title="Cisco HSRP with redundant links" Tags="|cisco|redundancy|hsrp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19023" PostTypeId="2" ParentId="19022" CreationDate="2015-06-07T14:16:02.913" Score="3" Body="&lt;p&gt;I would use SVIs for the L3 interfaces at core instead of assigning the IP configuration to physical ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way, having VLAN 100 allowed in all links between Core1, Core2, Distribution1 and Distribution2 the Spanning Tree protocol will manage which of the available uplinks will be used to forward traffic between distribution and core. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A config sample for HSRP with SVI would be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Core1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 100 &#xA;  ip address 192.168.1.2 255.255.255.0&#xA;  standby version 2&#xA;  standby 100 ip 192.168.1.1&#xA;  standby 100 priority 105&#xA;  standby 100 preempt&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Core2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 100&#xA;  ip address 192.168.1.3 255.255.255.0&#xA;  standby version 2&#xA;  standby 100 ip 192.168.1.1&#xA;  standby 100 preempt&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Should you need more information regarding the configuration options for HSRP in your 3560´s you can check the 3560 configuration guide for the software release you are using. For instace: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swhsrp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swhsrp.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2015-06-07T14:16:02.913" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19024" PostTypeId="1" AcceptedAnswerId="19026" CreationDate="2015-06-07T15:29:08.160" Score="4" ViewCount="28810" Body="&lt;p&gt;i have a question/problem. i have a local router with default-gateway 192.168.3.254, now on my layer 3 switch 3560 i configure 3 vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vlan 10 - data /ip address 192.168.10.254 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vlan 20 - server /ip address 192.168.20.254 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vlan 30 - mgt /ip address 192.168.30.254 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pc1 connected to gig0/5 vlan 10 ip address 192.168.10.5 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pc2 connected to gig0/10 vlan 20 ip address 192.168.20.10 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pc3 connected to gig0/20 vlan 30 ip address 192.168.30.20 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on switchport gig0/1 which the router is connected i issued no switchport command and give it ip 192.168.3.90 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;enable ip routing&#xA;ip route 0.0.0.0 0.0.0.0 192.168.3.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;inter-vlan routing on all pc's are working fine, but neither of the 3 pc is unable to connect to internet..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pls guide me, thank you.&lt;/p&gt;&#xA;" OwnerUserId="15845" LastEditorUserId="8499" LastEditDate="2018-12-21T04:51:04.307" LastActivityDate="2021-04-23T06:17:41.280" Title="Inter VLAN routing working, but VLANs can't access Internet" Tags="|routing|vlan|layer3|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19026" PostTypeId="2" ParentId="19024" CreationDate="2015-06-07T16:12:10.197" Score="7" Body="&lt;p&gt;Your router doesn't know how to route to your 3 vlans.  When it receives a packet for 192.168.10.5, for example, it doesn't know where to forward it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to configure static routes on your router like this (exact syntax depends on your model of router):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 192.168.10.0 255.255.255.0 192.168.3.90&#xA;ip route 192.168.20.0 255.255.255.0 192.168.3.90&#xA;ip route 192.168.30.0 255.255.255.0 192.168.3.90&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="20201" LastEditDate="2016-08-13T22:54:58.387" LastActivityDate="2016-08-13T22:54:58.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19028" PostTypeId="2" ParentId="18976" CreationDate="2015-06-07T20:23:29.830" Score="1" Body="&lt;p&gt;The thing is, Cisco is kind of notorious for wrong counters, be it interfaces or other stuff, especially &quot;virtual&quot; interfaces like LAGs. &lt;strong&gt;Maybe&lt;/strong&gt; you're hitting a bug. You could try another IOS version or look for a Cisco bug report for this. You could also open a TAC case to have them look at it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also try looking at the counters for the physical member interfaces of the LAG. See if they in sum are correct / divert from the LAG counter.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2015-06-07T20:23:29.830" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19029" PostTypeId="1" AcceptedAnswerId="19163" CreationDate="2015-06-08T01:10:21.220" Score="1" ViewCount="502" Body="&lt;p&gt;I do a static route on my local router &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router&#xA;default-gateway 192.168.3.254&#xA;&#xA;static route on router&#xA;192.168.10.0 255.255.255.0 192.168.3.95&#xA;192.168.80.0 255.255.255.0 192.168.3.95&#xA;192.168.100.0 255.255.255.0 192.168.3.95&#xA;&#xA;3560-switch&#xA;&#xA;gig0/1 no switchport&#xA;ip address 192.168.3.95 255.255.255.0&#xA;&#xA;vlan 10&#xA;ip address 192.168.10.254 255.255.255.0&#xA;vlan 80&#xA;ip address 192.168.80.254 255.255.255.0&#xA;vlan 100&#xA;ip address 192.168.100.254 255.255.255.0&#xA;&#xA;gig0/12&#xA;switchport mode access&#xA;switchport access vlan 100&#xA;&#xA;pc1 ip address 192.168.100.1 255.255.255.0 192.168.100.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above configuration is good, I can now access my router from pc1 on vlan 100, internet access display on my LAN but unfortunately I cannot access any WWW site. &#xA;Please guide me, I'm still a newbie on this matter.&lt;/p&gt;&#xA;" OwnerUserId="15845" LastEditorDisplayName="user10222" LastEditDate="2015-06-08T01:57:53.373" LastActivityDate="2015-06-12T04:35:04.473" Title="Can't access world wide web from PC on VLANs" Tags="|vlan|internet|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19031" PostTypeId="2" ParentId="7331" CreationDate="2015-06-08T01:45:13.420" Score="0" Body="&lt;p&gt;Matt, you need to internetwork your different private networks/locations together with a VPN.  Once you have a VPN nailed up, you will be able to www/http into 192.168.1.3 from any of the locations.  Specifically, you will be configuring a site-to-site VPN.  Looks like you may need the Enterprise License according to the &lt;a href=&quot;https://cradlepoint.com/products/arc-mbr1400&quot; rel=&quot;nofollow&quot;&gt;CradlePoint page&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-08T01:45:13.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19032" PostTypeId="1" CreationDate="2015-06-08T01:45:39.000" Score="1" ViewCount="2454" Body="&lt;p&gt;I'm getting this on my ASA, and im' not sure why the remote tunnel won't work.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7|Jun 07 2015|20:03:19|713236|||||IP = remoteIP, IKE_DECODE SENDING Message (msgid=5b87b9d6) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80&#xA;7|Jun 07 2015|20:03:19|715046|||||Group = remoteip, IP = remoteip, constructing qm hash payload&#xA;7|Jun 07 2015|20:03:19|715046|||||Group = remoteip, IP = remoteip, constructing blank hash payload&#xA;7|Jun 07 2015|20:03:19|715036|||||Group = remoteip, IP = remoteip, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x7056e351)&#xA;7|Jun 07 2015|20:03:19|715075|||||Group = remoteip, IP = remoteip, Received keep-alive of type DPD R-U-THERE (seq number 0x7056e351)&#xA;7|Jun 07 2015|20:03:19|715047|||||Group = remoteip, IP = remoteip, processing notify payload&#xA;7|Jun 07 2015|20:03:19|715047|||||Group = remoteip, IP = remoteip, processing hash payload&#xA;7|Jun 07 2015|20:03:19|713236|||||IP = remoteip, IKE_DECODE RECEIVED Message (msgid=696d6f13) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 80&#xA;7|Jun 07 2015|20:03:19|713906|||||IKE Receiver: Packet received on localip:500 from remoteip:500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm getting phase 1 and phase 2 completion on the other ASA 5505.&lt;/p&gt;&#xA;" OwnerUserId="15850" LastEditorUserId="775" LastEditDate="2015-06-20T16:19:27.430" LastActivityDate="2015-08-19T17:08:57.553" Title="Having trouble getting site to site VPN work using ASA 5505" Tags="|cisco|cisco-asa|vpn|tunnel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19033" PostTypeId="2" ParentId="19032" CreationDate="2015-06-08T05:14:10.470" Score="1" Body="&lt;p&gt;What you are seeing is fully expected of an operational Site-Site VPN.  The key lies here:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Group = remoteip, IP = remoteip, Sending keep-alive of type DPD R-U-THERE-ACK (seq number 0x7056e351)&#xA;Group = remoteip, IP = remoteip, Received keep-alive of type DPD R-U-THERE (seq number 0x7056e351)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;These messages are a part of what is known as &lt;strong&gt;Dead Peer Detection&lt;/strong&gt;, or &lt;strong&gt;DPD&lt;/strong&gt;.  DPD sends periodic keep alive messages (known as &amp;quot;&lt;em&gt;R-U-THERE&lt;/em&gt;&amp;quot; messages) to the opposing peer.  Upon reception of such a message, the other peer will respond with a keep alive acknowledgement (known as &amp;quot;&lt;em&gt;R-U-THERE-ACK&lt;/em&gt;&amp;quot;).  This informs the original peer that full, two way connectivity between the peers is working just fine.  The operation of DPD is described in more detail in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3706&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3706&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;For what its worth, your log messages are backwards.  The bottom message is the oldest, and the top message is the newest.&lt;/p&gt;&#xA;&lt;p&gt;That said, DPD on the ASA is sent only when no active traffic is detected.  Because if traffic is detecting &lt;em&gt;going both directions&lt;/em&gt;, that intrinsically confirms the tunnel is up, so no additional verification is necessary.  The ASA only starts sending DPD keep alives, if no traffic has been seen recently.&lt;/p&gt;&#xA;&lt;p&gt;So in the end, you've shown us the debug of a fully working tunnel.  Nothing in what you posted indicated a problem.  So if a Problem does exist, you'll have to provide much more debugs and context, maybe even sample configurations.  I would also suggest the output of &lt;code&gt;show ipsec sa&lt;/code&gt; and show &lt;code&gt;vpn-sessiondb&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-06-08T05:14:10.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19035" PostTypeId="1" AcceptedAnswerId="19039" CreationDate="2015-06-08T13:06:54.473" Score="1" ViewCount="102" Body="&lt;p&gt;I have read and learnt the fundamentals about the OSI model and its layers but just wondering is there a difference between the OSI model and IP networking or is it covered by OSI model?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bit confused with the terminology than anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also my final question actual software say a browser like chrome, is that considered part of the application layer in the OSI model or are the HTTP and other functions served by the layer only included. I am going with the latter option hence the word 'served'. Just want to know in case I get asked in a test to draw some sort of diagram...&lt;/p&gt;&#xA;" OwnerUserId="15859" LastActivityDate="2015-06-08T15:37:36.420" Title="What is IP networking used for? Also does the application layer include the actual software?" Tags="|ip|osi|" AnswerCount="1" CommentCount="0" ClosedDate="2015-06-08T18:17:54.213" ContentLicense="CC BY-SA 3.0" />
  <row Id="19036" PostTypeId="1" AcceptedAnswerId="19044" CreationDate="2015-06-08T13:22:10.313" Score="1" ViewCount="88" Body="&lt;p&gt;Let's say I have a network to design and a portion of it is far away, say in another city. I bought or rent a wired connection. How should be my subnetwork configuration, do I need to use a subnetwork or IP for the wire(!) I used? Also, can someone explain what this long range cable(!) is? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15861" LastActivityDate="2015-06-08T17:00:27.997" Title="Do I need an IP address or subnetwork for the long wire?" Tags="|ip|" AnswerCount="2" CommentCount="1" ClosedDate="2015-06-08T17:16:10.500" ContentLicense="CC BY-SA 3.0" />
  <row Id="19037" PostTypeId="2" ParentId="19036" CreationDate="2015-06-08T15:15:59.060" Score="-1" Body="&lt;p&gt;You do not need a network address for the wire.  The wire is going to be a particular type of data link, probably Ethernet on both ends.  The long range cable is single mode fiber.  It could also be wireless microwave.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-08T15:15:59.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19039" PostTypeId="2" ParentId="19035" CreationDate="2015-06-08T15:37:36.420" Score="1" Body="&lt;p&gt;In addition to the OSI model, there is the &lt;a href=&quot;http://en.wikipedia.org/wiki/Internet_protocol_suite&quot; rel=&quot;nofollow&quot;&gt;Internet protocol suite model&lt;/a&gt;.  The OSI model would place IP networking at layer 3, the network layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A web browser is going to have components of the transport layer and all layer above it as they include TCP/port numbers functionality, http session, encryption, ECMA/Javascripting, etc.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-08T15:37:36.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19040" PostTypeId="1" CreationDate="2015-06-08T15:42:09.487" Score="0" ViewCount="160" Body="&lt;p&gt;I'm fairly new to Cisco IOS configuration. I have an 800-series router and, long story short, I'd like to limit the incoming and outgoing bandwidth allocated to some iCloud servers to prevent transmissions to/from iCloud photos from saturating our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm just flummoxed as how to approach the problem—especially having only a domain name to match on and not IP addresses or ports.&lt;/p&gt;&#xA;" OwnerUserId="15863" LastActivityDate="2015-06-08T15:59:03.923" Title="Cisco IOS limit bandwidth to domain (wildcard)" Tags="|cisco-ios|bandwidth|" AnswerCount="1" CommentCount="4" ClosedDate="2019-06-25T00:25:28.160" ContentLicense="CC BY-SA 3.0" />
  <row Id="19041" PostTypeId="1" AcceptedAnswerId="19046" CreationDate="2015-06-08T15:42:22.637" Score="2" ViewCount="405" Body="&lt;p&gt;Does the Cisco 3560-CX support Layer 3 Etherchannel?  I can see from the specs that this switch supports Layer 2 Etherchannel and that it is a layer 3 compact switch. However, it doesn't have the full feature set of a regular 3560 switch, which makes me hesitate on whether it supports &lt;strong&gt;Layer 3&lt;/strong&gt; Etherchannel.  Does anyone that has one of these know? Or can someone point me to some documentation that gives a definitive answer to this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: We don't currently own this switch, I am asking because of an upcoming purchasing decision.&lt;/p&gt;&#xA;" OwnerUserId="4547" LastEditorUserId="8499" LastEditDate="2018-03-21T00:04:37.947" LastActivityDate="2018-03-21T00:04:37.947" Title="Does the Cisco 3560-CX support Layer 3 Etherchannel?" Tags="|cisco|switch|cisco-catalyst|layer3|etherchannel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19042" PostTypeId="2" ParentId="19040" CreationDate="2015-06-08T15:59:03.923" Score="1" Body="&lt;p&gt;Traffic shaping is how you would do the limiting.  This will require classifying traffic to be shaped (limited).  I did find a doc, &lt;a href=&quot;https://support.apple.com/en-us/HT202944&quot; rel=&quot;nofollow&quot;&gt;TCP and UDP ports used by Apple software products&lt;/a&gt;, but &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/configuration/15-mt/qos-nbar-15-mt-book/clsfy-traffic-nbar.html&quot; rel=&quot;nofollow&quot;&gt;NBAR&lt;/a&gt; may be a better way to match/classify the iCloud photo sharing.  Like you said, if you can determine a particular destination domain then &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_nbar/configuration/15-mt/qos-nbar-15-mt-book/clsfy-traffic-nbar.html#GUID-282B8171-F2C0-4083-B0B7-E723DB4F725C&quot; rel=&quot;nofollow&quot;&gt;NBAR can match that way&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-08T15:59:03.923" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19043" PostTypeId="2" ParentId="19041" CreationDate="2015-06-08T16:11:56.137" Score="-2" Body="&lt;p&gt;The easiest way to find out is to use the CLI and look for the relevant commands.  If they are there then it should work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if your box does not support that you can do &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/modules/ps2033/prod_technical_reference09186a00800afeb7.html&quot; rel=&quot;nofollow&quot;&gt;load balancing over parallel links&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-08T16:11:56.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19044" PostTypeId="2" ParentId="19036" CreationDate="2015-06-08T17:00:27.997" Score="2" Body="&lt;p&gt;Disclaimer: I'm assuming you're acquiring a private a point-to-point link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand you correctly, you're asking if you need an IP address on each end of the new connection. That depends on whether you are bridging (Layer-2) or routing (Layer-3) this connection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, a fibre provider will leave a fibre-to-ethernet converter that simply bridges the connection. If you want to keep the new location as an extension of your existing local network, you don't need to do anything (other than perhaps some switch config and merging the two networks into one subnet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you are routing the two networks (both on different subnets), you'll need an intermediary subnet for both end devices connected to the fibre, typically a /30, like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;local LAN (10.0.1.0/24)-&gt;fibre int(192.168.0.1/30)-&gt;NEW_FIBRE-&gt;fibre int(192.168.0.2/30)-&gt;remote LAN (172.16.1.0/24)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then on the local side, you'd have a route pointing 172.16.1.0/24 to 192.168.0.2, and on the remote side, 10.0.1.0/24 to 192.168.0.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that it's often beneficial to have an address on the external side of any connection for troubleshooting purposes.&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-06-08T17:00:27.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19046" PostTypeId="2" ParentId="19041" CreationDate="2015-06-08T17:35:50.003" Score="3" Body="&lt;p&gt;The best way to find out is to determine the version of IOS that your switch is running. &lt;code&gt;show version&lt;/code&gt; will get you this information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then look up the version of IOS using &lt;a href=&quot;http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp&quot; rel=&quot;nofollow&quot;&gt;Cisco's Feature Navigator&lt;/a&gt;. You will be able to determine what exactly your version of code supports and what it does not.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2015-06-08T17:35:50.003" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19047" PostTypeId="2" ParentId="17682" CreationDate="2015-06-08T17:47:14.663" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why configuration at layer 2 at layer 3 device at different site of LAN caused problem at another part of the network ?!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First, to be clear, since you mentioned that you are bridging the interfaces on the Cloud Core, this is part of the same L2 LAN, not a &quot;different site.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, misconfiguring a network device can create all sorts of unintended problems. Part of being a good network troubleshooter is being able to separate the actual problem from the symptoms.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What kind of mechanism at CC1036 has been activated that cause gaps in the ARP tables across the entire network many devices further ?!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In your fix, you only mention changing the Cloud Core from balance-rr to 802.3ad. Did you change anything on swt-d-1? If so, what?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that you had a problem with STP, which can happen when you don't configure your link aggregations properly on both sides. Problems I have seen when this happen are L2 loops or situations where one device is sending traffic to the second while the second device has the port in a STP blocking state.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-06-08T17:47:14.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19048" PostTypeId="1" AcceptedAnswerId="19066" CreationDate="2015-06-08T18:16:19.470" Score="2" ViewCount="4714" Body="&lt;p&gt;I believe I know the answer to my dilemma, but wanted to pick the NetworkStackExchange community brain. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We currently perform Twice NAT'ing for a affiliate we have a peer exchange point with using a Palo Alto security device, their device is a straight leg into a router. We do Twice NAT'ing to make it easier for them to distribute a single route-able subnet with in their network to reach our network and vice versa. The issue of overlapping subnets is coming up, and we are currently having issues with because we are using a single security device to perform the NAT'ing. I believe the issue is because the security device makes it's routing decision pre-NAT, based on the documentation found in Palo Alto's &lt;a href=&quot;https://live.paloaltonetworks.com/servlet/JiveServlet/previewBody/1517-102-7-11647/Understanding_NAT-4.1-RevC.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding and Configuring NAT&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is the only way around overlapping IPs is to do source NAT'ing for each side on two devices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/E2Qv9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/E2Qv9.jpg&quot; alt=&quot;network diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if I initiate a ICMP ping like the depiction below I see the echo reply being routed back out the same interface it came in on.&lt;/p&gt;&#xA;" OwnerUserId="3528" LastEditorUserId="3191" LastEditDate="2015-06-10T16:29:24.807" LastActivityDate="2016-03-01T05:09:32.153" Title="Twice NAT'ing and overlapping subnets" Tags="|routing|nat|firewall|palo-alto|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19049" PostTypeId="1" AcceptedAnswerId="19050" CreationDate="2015-06-08T18:27:51.410" Score="4" ViewCount="868" Body="&lt;p&gt;Received Signal Strength Indicator (RSSI) is a measure of the received signal power at the antenna and is usually a negative number expressed in dbm for IEEE 802.11 devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Does RSSI take account the power of noise? Or is it just power of the signal? If it doesn't take into account power of noise, then how can one distinguish whether there is noise or not?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Does RSSI take into account the transmit and receive antenna gain?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="15457" LastEditorUserId="54588" LastEditDate="2019-12-10T22:24:46.720" LastActivityDate="2019-12-10T22:24:46.720" Title="General questions about RSSI for wireless devices" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19050" PostTypeId="2" ParentId="19049" CreationDate="2015-06-08T19:00:15.800" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;does RSSI take account the power of noise? or is it just power of the signal? If it doesnt take into account power of noise, then how can one distinguish whether there is noise or not?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is simply an indication of signal strength. Noise is a separate measure and not all 802.11 devices are capable of detecting or providing this information. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that in 802.11, the standard does not define any relationship between RSSI and any specific value, such as mW or dBm. Vendors are free to use whichever arbitrary scale the choose to represent RSSI, although many of them have chosen to represent this in dBm.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does RSSI take into account the transmit and receive antenna gain?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. It is measure of the strength of the signal it receives. A higher gain antenna would simply result in a higher RSSI as the signal would be stronger.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-06-08T19:05:16.853" LastActivityDate="2015-06-08T19:05:16.853" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="19051" PostTypeId="1" AcceptedAnswerId="19059" CreationDate="2015-06-08T20:05:19.357" Score="5" ViewCount="11455" Body="&lt;p&gt;So I never knew this till today but I thought you needed CAT5 for VoIP but this business is running VoIP on CAT3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't you need the extra wires for the voice, data and power?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="8499" LastEditDate="2018-12-20T21:20:00.110" LastActivityDate="2019-07-12T20:17:07.813" Title="How is it possible to run VoIP on CAT3. Do you not need CAT5 for the voice data?" Tags="|layer1|cable|voip|hardware|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19052" PostTypeId="1" CreationDate="2015-06-08T20:08:29.517" Score="3" ViewCount="297" Body="&lt;p&gt;I am troubleshooting intermittent connectivity issues towards a WLC connected to a stack made of three 3750G switches. Part-number and software version of the switches are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch   Ports  Model              SW Version              SW Image&#xA;------   -----  -----              ----------              ----------&#xA;     1   12     WS-C3750G-12S      12.2(35)SE5             C3750-IPBASE-M&#xA;*    2   52     WS-C3750G-48TS     12.2(35)SE5             C3750-IPBASE-M&#xA;     3   52     WS-C3750G-48TS     12.2(35)SE5             C3750-IPBASE-M&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;WLC has LAG enabled, so Po4 has been configured in the stack including 4 ports to connect the 4 physical ports of the WLC: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW#show etherchannel 4 summary&#xA;Flags:  D - down        P - in port-channel&#xA;        I - stand-alone s - suspended&#xA;        H - Hot-standby (LACP only)&#xA;        R - Layer3      S - Layer2&#xA;        U - in use      f - failed to allocate aggregator&#xA;        u - unsuitable for bundling&#xA;        w - waiting to be aggregated&#xA;        d - default port&#xA;&#xA;&#xA;Number of channel-groups in use: 4&#xA;Number of aggregators:           4&#xA;&#xA;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+-----------------------------------------------&#xA;4      Po4(SU)          -        Gi2/0/51(P) Gi2/0/52(P) Gi3/0/51(P)&#xA;                                 Gi3/0/52(P)&#xA;&#xA;SW#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configuration of the physical and portchannel interfaces is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet2/0/51&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA; mls qos trust cos&#xA; channel-group 4 mode on&#xA;end&#xA;!&#xA;interface GigabitEthernet2/0/52&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA; mls qos trust cos&#xA; channel-group 4 mode on&#xA;end&#xA;!&#xA;interface GigabitEthernet3/0/51&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA; mls qos trust cos&#xA; channel-group 4 mode on&#xA;end&#xA;!&#xA;interface GigabitEthernet3/0/52&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA; mls qos trust cos&#xA; channel-group 4 mode on&#xA;end&#xA;!&#xA;interface Port-channel4&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ethernchannel load-balance is done based on source and destination IP addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW#show etherchannel load-balance&#xA;EtherChannel Load-Balancing Configuration:&#xA;        src-dst-ip&#xA;&#xA;EtherChannel Load-Balancing Addresses Used Per-Protocol:&#xA;Non-IP: Source XOR Destination MAC address&#xA;  IPv4: Source XOR Destination IP address&#xA;  IPv6: Source XOR Destination IP address&#xA;&#xA;SW#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;During troubleshooting, I have tried disabling 2 of the 4 ports of the etherchannel and have found that sometimes the switch is trying to forward traffic through ports that are disabled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW#show etherchannel 4 summary&#xA;Flags:  D - down        P - in port-channel&#xA;        I - stand-alone s - suspended&#xA;        H - Hot-standby (LACP only)&#xA;        R - Layer3      S - Layer2&#xA;        U - in use      f - failed to allocate aggregator&#xA;        u - unsuitable for bundling&#xA;        w - waiting to be aggregated&#xA;        d - default port&#xA;&#xA;Number of channel-groups in use: 4&#xA;Number of aggregators:           4&#xA;&#xA;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+-----------------------------------------------&#xA;4      Po4(SU)          -        Gi2/0/51(D) Gi2/0/52(D) Gi3/0/51(P) &#xA;                                 Gi3/0/52(P)&#xA;SW#&#xA;SW#&#xA;SW#&#xA;SW#test etherchannel load-balance interface Po4 ip 10.0.1.254 10.0.1.251&#xA;Would select Gi2/0/52 of Po4  &#xA;SW#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand etherchannel load-balance should never try to forward traffic through ports being down or disabled, even if the ports are configured to be part of the etherchannel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does any of you know any good reason for this behaviour? &lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2015-07-08T10:25:24.343" Title="Etherchannel trying to forward traffic through disabled ports" Tags="|etherchannel|cisco-3750|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19053" PostTypeId="2" ParentId="19051" CreationDate="2015-06-08T20:11:45.480" Score="5" Body="&lt;p&gt;VoIP runs over IP, so it is independent of layer-1.  The only sort of restriction based on layer-1 would be the bandwidth required.  Voice is not separate from data on the wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be meaning a VoIP phone, which may be powered by PoE, but most have wall-warts, too. If the Category-3 cable has all four pairs, there is no real reason the it couldn't support PoE, too.  Most copper PHY can support 10/100/1000 GB.  If you have a PoE 10/100/100 port, you could run it at 10 Mb with PoE.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-06-08T20:11:45.480" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19059" PostTypeId="2" ParentId="19051" CreationDate="2015-06-08T23:41:56.653" Score="2" Body="&lt;p&gt;&lt;strong&gt;Ethernet&lt;/strong&gt; specifications state &lt;em&gt;four pairs&lt;/em&gt;, even if only two are used. The &lt;em&gt;category&lt;/em&gt; rating system is a set of signal specifications, independent of the number of pairs. (there are 25, 100, etc. -- even &lt;em&gt;500&lt;/em&gt; -- pair CAT3 trunk cables.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as there are four pairs, a VoIP phone can be powered and connected over a CAT3 ethernet cable.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-08T23:41:56.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19062" PostTypeId="2" ParentId="19020" CreationDate="2015-06-09T03:45:27.107" Score="4" Body="&lt;p&gt;It turns out the database I was working with was incomplete. I was using &quot;python-netaddr&quot; on Ubuntu 14.04, and this was significantly smaller than the Wireshark combined IEEE+misc database. After I fixed this, all but a very few MACs had valid vendors, which is the result I was expecting.&lt;/p&gt;&#xA;" OwnerUserId="15838" LastActivityDate="2015-06-09T03:45:27.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19064" PostTypeId="1" AcceptedAnswerId="19074" CreationDate="2015-06-09T06:40:44.050" Score="2" ViewCount="88" Body="&lt;p&gt;Let's say a network admin is provided a /24 IP address and asked to create a network that involves two different subnetworks that are distant to each other. I have learned that I need to assign a subnetwork to the ppp connection. However, I need to be more economical about the number of subnetworks since we need to assign 40-50 host per each subnetwork. Is there a way to assign the rented ppp connection to be in the distant LAN so that I do not use a new subnetwork to assign to the connection of these two networks? &#xA;PS: I also need to do that because I have a router firewall and as I know, these firewall needs to be assigned an IP from each subnetwork. If I start the new network from the other place, I can more easily give these IPs to the firewall.&lt;/p&gt;&#xA;" OwnerUserId="15861" LastActivityDate="2015-06-09T19:21:20.530" Title="Can I assign a ppp serial link to a subnetwork that is also being used?" Tags="|firewall|ip|ppp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19066" PostTypeId="2" ParentId="19048" CreationDate="2015-06-09T08:29:56.797" Score="2" Body="&lt;p&gt;I recommend you to print page 4 of this document because it's a handy tool for troubleshooting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About packet flow in Palo Alto, &lt;a href=&quot;http://packetsanalyzed.blogspot.com.es/2012/03/palo-alto-packet-processing.html&quot; rel=&quot;nofollow&quot;&gt;check this grahp&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, points of interest could summarize as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;PBF is checked.&lt;/li&gt;&#xA;&lt;li&gt;Routing table lookup.&lt;/li&gt;&#xA;&lt;li&gt;DST Nat rule checked.&lt;/li&gt;&#xA;&lt;li&gt;Routing table lookup.&lt;/li&gt;&#xA;&lt;li&gt;SRC Nat rule checked.&lt;/li&gt;&#xA;&lt;li&gt;Security policy checked.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is the only way around overlapping IPs is to do source&#xA;  NAT'ing for each side on two devices?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;We have to understand your network to propose a different approach. Maybe you could get same results with PBF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, I think NAT it's the best approach. In this cases, I always use a 2 rule NAT in one of the peers (or reflexive policy in older PANOS versions). What's the problem with using NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought you just had overlapping network in both sides but onlye one networks wants to communicate with the other peer. The real scenario is that you have overlapping and you want communication between the two overlapping networks. This is a problem related with IP and not Palo Alto at all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this particular scenario I can't imagine other solution than tweak destination IP and make a NAT in Palo Alto device. Or obviously, you always can change IP adressing on one of the 2 overlapping networks :).&lt;/p&gt;&#xA;" OwnerUserId="3949" LastEditorUserId="3949" LastEditDate="2015-06-10T11:06:26.277" LastActivityDate="2015-06-10T11:06:26.277" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19067" PostTypeId="1" CreationDate="2015-06-09T09:03:09.800" Score="4" ViewCount="1040" Body="&lt;p&gt;Topology:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw3560  gig0/23 ---&amp;gt; fa0/24  sw2960&#xA;sw3560  gig0/24 ---&amp;gt; gig0/2  sw2960 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a question regarding to STP load balancing, on my switch 3560 I configure the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet0/23&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 200&#xA; switchport mode trunk&#xA; spanning-tree vlan 10,20,30,40,50,60 port-priority 16&#xA;!&#xA;interface GigabitEthernet0/24&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 200&#xA; switchport mode trunk&#xA; spanning-tree vlan 70,80,90,100,150 port-priority 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is this a right configuration??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0001&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32769&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19        128.23   P2p&#xA;         Gi0/24              Root FWD 4         128.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0010&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32778&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32778  (priority 32768 sys-id-ext 10)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19         16.23   P2p&#xA;         Gi0/24              Root FWD 4         128.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0020&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32788&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32788  (priority 32768 sys-id-ext 20)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19         16.23   P2p&#xA;         Gi0/24              Root FWD 4         128.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0030&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32798&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32798  (priority 32768 sys-id-ext 30)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19         16.23   P2p&#xA;         Gi0/24              Root FWD 4         128.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0040&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32808&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32808  (priority 32768 sys-id-ext 40)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19         16.23   P2p&#xA;         Gi0/24              Root FWD 4         128.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0050&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32818&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32818  (priority 32768 sys-id-ext 50)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19         16.23   P2p&#xA;         Gi0/24              Root FWD 4         128.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0060&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32828&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32828  (priority 32768 sys-id-ext 60)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19         16.23   P2p&#xA;         Gi0/24              Root FWD 4         128.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0070&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32838&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32838  (priority 32768 sys-id-ext 70)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19        128.23   P2p&#xA;         Gi0/24              Root FWD 4          16.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0080&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32848&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32848  (priority 32768 sys-id-ext 80)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19        128.23   P2p&#xA;         Gi0/24              Root FWD 4          16.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  VLAN0090&#xA;    Spanning tree enabled protocol ieee&#xA;    Root ID    Priority    32858&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32858  (priority 32768 sys-id-ext 90)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19        128.23   P2p&#xA;         Gi0/24              Root FWD 4          16.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0100&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32868&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32868  (priority 32768 sys-id-ext 100)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/12              Desg FWD 19        128.12   P2p&#xA;         Gi0/23              Altn BLK 19        128.23   P2p&#xA;         Gi0/24              Root FWD 4          16.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  VLAN0150&#xA;    Spanning tree enabled protocol ieee&#xA;    Root ID    Priority    32918&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32918  (priority 32768 sys-id-ext 150)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19        128.23   P2p&#xA;         Gi0/24              Root FWD 4          16.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN0200&#xA;   Spanning tree enabled protocol ieee&#xA;   Root ID    Priority    32968&#xA;         Address     0018.18da.8b80&#xA;         Cost        4&#xA;         Port        24 (GigabitEthernet0/24)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;         Bridge ID  Priority    32968  (priority 32768 sys-id-ext 200)&#xA;         Address     0019.5601.7600&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time  300 sec&#xA;&#xA;         Interface           Role Sts Cost      Prio.Nbr Type&#xA;         Gi0/23              Altn BLK 19        128.23   P2p&#xA;         Gi0/24              Root FWD 4         128.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15845" LastEditorUserId="3191" LastEditDate="2015-06-09T16:27:57.043" LastActivityDate="2015-06-09T17:38:38.997" Title="STP load balancing" Tags="|spanning-tree|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="19068" PostTypeId="1" CreationDate="2015-06-09T10:16:42.047" Score="0" ViewCount="203" Body="&lt;p&gt;I have a Raspberry Pi physically between my switch and my client. The switch uses 802.1x authentication with an radius server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I setup my Raspberry in transparent bridging mode everything works fine. I can authenticate my client with the router and access the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now I want to have access with the raspberry as well, impersonating the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore I gave my bridge an IP (192.254.66.66), added the route for my network 192.168.x.0/24 and added the default gateway 192.168.x.254.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also added ebtable and iptable entries to SNAT the outgoing traffic to appear to be from the client:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ebtables -t nat -A POSTROUTING -s (Mac from eth0) -o eth0 -j snat --to-src (Mac from my client)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iptables -t nat -A POSTROUTING -o br0 -s 192.254.66.66 -p tcp -j SNAT --to&#xA;(IP from my client 192.168.x.17 with high, mostly unused ports)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iptables -t nat -A POSTROUTING -o br0 -s 192.254.66.66 -p udp -j SNAT --to&#xA;(IP from my client 192.168.x.17 with high, mostly unused ports)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iptables -t nat -A POSTROUTING -o br0 -s 192.254.66.66 -p icmp -j SNAT --to&#xA;(IP from my client 192.168.x.17)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try to ping google.com I get an error: ping: unkown host google.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try to ping my gateway 192.168.x.254 I can see the ECMP echo request and replies in tcpdump, but they are (of course) addressed to 192.168.x.17 and therefore my Raspberry isn't realizing the answer is for him. Shouldnt iptables track the connection and decide to either forward the packets if they come from the client or take them if they come from the bridge?&lt;/p&gt;&#xA;" OwnerUserId="15875" LastActivityDate="2016-07-22T04:40:00.447" Title="SNAT packages to the wrong destination while bridging" Tags="|bridge|snat|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-11T17:09:02.253" ContentLicense="CC BY-SA 3.0" />
  <row Id="19069" PostTypeId="1" CreationDate="2015-06-09T14:59:43.070" Score="2" ViewCount="769" Body="&lt;p&gt;I have a Cisco &lt;code&gt;WS-C3750G-12S&lt;/code&gt; switch physically connected with ports &lt;code&gt;Gi1/0/1&lt;/code&gt; and &lt;code&gt;Gi1/0/11&lt;/code&gt; to Cisco &lt;code&gt;WS-C3750G-24TS&lt;/code&gt; ports &lt;code&gt;Gi1/0/1&lt;/code&gt; and &lt;code&gt;Gi1/0/27&lt;/code&gt; respectively. Ports have different LACP port-priority:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WS-C3750G-12S#sh lacp internal &#xA;Flags:  S - Device is requesting Slow LACPDUs &#xA;        F - Device is requesting Fast LACPDUs&#xA;        A - Device is in Active mode       P - Device is in Passive mode     &#xA;&#xA;Channel group 1&#xA;                            LACP port     Admin     Oper    Port        Port&#xA;Port      Flags   State     Priority      Key       Key     Number      State&#xA;Gi1/0/1   SA      bndl      1             0x1       0x1     0x102       0x3D  &#xA;Gi1/0/11  SA      bndl      2             0x1       0x1     0x10C       0x3D  &#xA;WS-C3750G-12S#&#xA;&#xA;WS-C3750G-24TS#sh lacp internal&#xA;Flags:  S - Device is requesting Slow LACPDUs&#xA;        F - Device is requesting Fast LACPDUs&#xA;        A - Device is in Active mode       P - Device is in Passive mode&#xA;&#xA;Channel group 1&#xA;                            LACP port     Admin     Oper    Port        Port&#xA;Port      Flags   State     Priority      Key       Key     Number      State&#xA;Gi1/0/1   SA      bndl      1             0x1       0x1     0x102       0x3D&#xA;Gi1/0/27  SA      bndl      2             0x1       0x1     0x11C       0x3D&#xA;WS-C3750G-24TS#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As seen above, ports have different LACP priorities, but are still bundled. Same can be seen with &lt;code&gt;sh etherchannel 1 summary&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WS-C3750G-12S#sh etherchannel 1 summary &#xA;Flags:  D - down        P - bundled in port-channel&#xA;        I - stand-alone s - suspended&#xA;        H - Hot-standby (LACP only)&#xA;        R - Layer3      S - Layer2&#xA;        U - in use      f - failed to allocate aggregator&#xA;&#xA;        M - not in use, minimum links not met&#xA;        u - unsuitable for bundling&#xA;        w - waiting to be aggregated&#xA;        d - default port&#xA;&#xA;&#xA;Number of channel-groups in use: 1&#xA;Number of aggregators:           1&#xA;&#xA;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+-----------------------------------------------&#xA;1      Po1(SU)         LACP      Gi1/0/1(P)  Gi1/0/11(P) &#xA;&#xA;WS-C3750G-12S#&#xA;&#xA;&#xA;WS-C3750G-24TS#sh etherchannel 1 summary &#xA;Flags:  D - down        P - bundled in port-channel&#xA;        I - stand-alone s - suspended&#xA;        H - Hot-standby (LACP only)&#xA;        R - Layer3      S - Layer2&#xA;        U - in use      f - failed to allocate aggregator&#xA;&#xA;        M - not in use, minimum links not met&#xA;        u - unsuitable for bundling&#xA;        w - waiting to be aggregated&#xA;        d - default port&#xA;&#xA;&#xA;Number of channel-groups in use: 1&#xA;Number of aggregators:           1&#xA;&#xA;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+-----------------------------------------------&#xA;1      Po1(SU)         LACP      Gi1/0/1(P)  Gi1/0/27(P) &#xA;&#xA;WS-C3750G-24TS#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does &lt;code&gt;lacp port-priority&lt;/code&gt; not work on Cisco Catalyst 3750 series? Or am I doing something wrong?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-06-09T15:53:23.890" Title="Does &quot;lacp port-priority&quot; not work on Cisco Catalyst 3750 series?" Tags="|ieee-802.1ax|cisco-3750|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19070" PostTypeId="2" ParentId="19067" CreationDate="2015-06-09T15:25:20.627" Score="-9" Body="&lt;p&gt;The configuration is outdated because STP Is outdated, replaced by 802.1q-2014(.aq Shortest Path Bridging, SPB).&lt;br&gt;&lt;br&gt;&#xA;* Don't Deploy STP&lt;br&gt;&#xA;MLAG Multi-Chassis Link Aggregation Groups&lt;br&gt;&#xA;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;VSS&lt;br&gt;&#xA;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;Cross-Stack Etherchannel&lt;br&gt;&#xA;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;FabricPath (uses IS-IS at layer 2)&lt;br&gt;&#xA;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;VPC (Virtual Port Channel) &lt;br&gt;&#xA;&amp;nbsp;&amp;nbsp;&amp;nbsp;&amp;nbsp;Brocade’s VCS (Virtual Cluster Switching)   &lt;br&gt;&#xA;IETF TRILL (Transparent Interconnection of Lots of Links)&lt;br&gt;&#xA;IEEE 802.1aq (Shortest Path Bridging – SPB)&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-09T15:25:20.627" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="19071" PostTypeId="1" AcceptedAnswerId="19123" CreationDate="2015-06-09T15:35:50.547" Score="6" ViewCount="3175" Body="&lt;p&gt;this is my first question over here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a question about using &lt;code&gt;channel-group mode on&lt;/code&gt; or &lt;code&gt;channel-group mode active&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a core 3750x with 2 stacked SFPs nodes. Each pair of ports of a node with the same port number is an etherchannel:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Gi1/0/1 + Gi2/0/1 = &lt;strong&gt;Po1&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Gi1/0/2 + Gi2/0/2 = &lt;strong&gt;Po2&lt;/strong&gt; &lt;/li&gt;&#xA;&lt;li&gt;and so on&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These etherchannel connects to the 2960 switches, where they have a SFP module, using 2 SFPs ports to connect to the 3750x. Those two ports are also an etherchannel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the Po's interfaces are in &lt;code&gt;channel-group mode on&lt;/code&gt; on &lt;strong&gt;both sides&lt;/strong&gt;.&#xA;The Po interfaces are ok, all UP and not giving me errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I'd like to know: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is this a good pratice?&lt;/li&gt;&#xA;&lt;li&gt;Is it better to use LACP? Why?&lt;/li&gt;&#xA;&lt;li&gt;Any of you guys ever had any problem using mode on?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thank you very much!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obs.:&#xA;I read the article &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1390/preventing-stp-loops-in-etherchannels-configurations&quot;&gt;Preventing STP loops in etherchannels configurations&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in my case I know and I manage both sides of the connection&lt;/p&gt;&#xA;" OwnerUserId="15878" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-06-11T06:39:25.950" Title="Using channel-group mode on in my full Cisco enviroment" Tags="|cisco|ieee-802.1ax|etherchannel|cisco-3750|cisco-2960|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19072" PostTypeId="2" ParentId="19069" CreationDate="2015-06-09T15:36:15.823" Score="3" Body="&lt;p&gt;This looks normal to me. I think you may have a misunderstanding about the nature of this command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should help, from &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/commmand/reference/3750cr/cli1.html#&quot; rel=&quot;nofollow&quot;&gt;Cisco documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The lacp port-priority interface configuration command determines which ports are bundled and which ports are put in hot-standby mode when there are more than eight ports in an LACP channel group.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-06-09T15:53:23.890" LastActivityDate="2015-06-09T15:53:23.890" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19073" PostTypeId="2" ParentId="17685" CreationDate="2015-06-09T15:36:34.373" Score="0" Body="&lt;p&gt;Yes.  You will need to &lt;a href=&quot;http://visihow.com/Change_the_MAC_address_of_your_Wireless_Adapter&quot; rel=&quot;nofollow&quot;&gt;override the mac address on the endpoints wifi adapter&lt;/a&gt; using the same mac address as the wired nic.  Then, configure static DHCP as &lt;a href=&quot;http://www.mikrotik.com/testdocs/ros/2.8/ip/dhcp.php&quot; rel=&quot;nofollow&quot;&gt;shown here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-09T15:36:34.373" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19074" PostTypeId="2" ParentId="19064" CreationDate="2015-06-09T15:41:22.590" Score="2" Body="&lt;p&gt;Yes. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/hot-standby-router-protocol-hsrp/13786-20.html&quot; rel=&quot;nofollow&quot;&gt;IP unnumbered&lt;/a&gt; allows for this type of configuration on Cisco devices.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ip unnumbered configuration command allows you to enable IP processing on a serial interface without assigning it an explicit IP address. The ip unnumbered interface can &quot;borrow&quot; the IP address of another interface already configured on the router, which conserves network and address space.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="49" LastEditDate="2015-06-09T19:21:20.530" LastActivityDate="2015-06-09T19:21:20.530" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19077" PostTypeId="2" ParentId="19067" CreationDate="2015-06-09T17:38:38.997" Score="3" Body="&lt;p&gt;For lack of a question, I'll assume the following.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is this working the way I intend on making it work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, it's not.  Spanning-tree has selected &lt;code&gt;Gi0/24&lt;/code&gt; on each port because it's a lower root path cost, so it isn't taking the spanning-tree port-priority into account.  When STP making it's calculations, it follows these orders.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Root Bridge Identifier, the Bridge Identifier of the Bridge believed to be the Root by the transmitter  &lt;strong&gt;&lt;/li&gt;&#xA;  &lt;li&gt;Root Path Cost, to that Root Bridge from the transmitting Bridge  &lt;/li&gt;&#xA;  &lt;li&gt;Bridge Identifier, of the transmitting Bridge  &lt;/li&gt;&#xA;  &lt;li&gt;Port Identifier, of the Port through which the message was transmitted  &lt;/li&gt;&#xA;  &lt;li&gt;Port Identifier, of the Port through which the message was received (where relevant)&lt;/strong&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Info derived from IEEE Standard 802.1D - 2004, Media Access Control (MAC) Bridges, section 17.5 Spanning tree priority vectors&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since &lt;code&gt;Gi0/23&lt;/code&gt; is connected to a FastEthernet port, it inherently has a lower speed (resulting in a higher cost).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     Interface           Role Sts Cost      Prio.Nbr Type&#xA;     Gi0/23              Altn BLK 19        128.23   P2p&#xA;     Gi0/24              Root FWD 4         128.24   P2p&#xA;                                  ^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to load balance across these links with STP, you would also need to add the following configurations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/24&#xA; spanning-tree vlan 70,80,90,100,150 cost 4&#xA;interface GigabitEthernet0/23&#xA; spanning-tree vlan 10,20,30,40,50,60 cost 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastActivityDate="2015-06-09T17:38:38.997" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19079" PostTypeId="1" AcceptedAnswerId="19080" CreationDate="2015-06-09T18:44:39.940" Score="1" ViewCount="174" Body="&lt;p&gt;I have a little embedded device directly connected to a laptop via a crossover cable. I'm monitoring the traffic between the two using Wireshark and I witness a TTL of 30 for TCP packets coming from the device (when they reach the laptop).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the device's initial TTL? I'm thinking it could either 30 or 32?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess my question is does the hop count decrease over a cross over (I suspect it does but not sure)?&lt;/p&gt;&#xA;" OwnerUserId="8852" LastEditorUserId="775" LastEditDate="2015-06-20T16:18:34.313" LastActivityDate="2015-06-20T19:32:28.023" Title="Does the TTL decrease over a crossover cable?" Tags="|ethernet|ip|traceroute|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19080" PostTypeId="2" ParentId="19079" CreationDate="2015-06-09T19:00:15.673" Score="5" Body="&lt;p&gt;Unless there is forwarding going on prior to delivery (i.e. the laptop has two interfaces and it crosses between them because its destination is not the port it came in on) then the TTL should not be altered.  The source can set a TTL of whatever it likes up to a maximum of 255, and if you are watching it arrive from the device with a TTL of 30 and it only traversed a patch cable, then it quite certainly started with 30.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastEditorUserId="10323" LastEditDate="2015-06-20T19:32:28.023" LastActivityDate="2015-06-20T19:32:28.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19082" PostTypeId="1" CreationDate="2015-06-09T21:23:08.077" Score="2" ViewCount="494" Body="&lt;p&gt;I'm essentially looking for a tool that has this functionality: &lt;a href=&quot;http://safemap.sourceforge.net/demo/index-no-refresh.html&quot; rel=&quot;nofollow&quot;&gt;SMART&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tool was written by Cisco but hasn't been updated in almost a decade. I tried running it and while it works for small pcap files, it throws segmentation faults when you feed it something substantial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is anyone aware of another tool that could draw this kind of graph from a pcap?&lt;/p&gt;&#xA;" OwnerUserId="8852" LastEditorUserId="13986" LastEditDate="2015-06-10T07:47:33.640" LastActivityDate="2015-06-10T07:47:33.640" Title="Do tools for building a traffic map from a pcap capture exist?" Tags="|monitoring|network-discovery|" AnswerCount="0" CommentCount="5" ClosedDate="2015-06-09T22:51:49.270" ContentLicense="CC BY-SA 3.0" />
  <row Id="19083" PostTypeId="1" AcceptedAnswerId="19102" CreationDate="2015-06-09T21:49:56.637" Score="2" ViewCount="13752" Body="&lt;p&gt;I have two interfaces on NSA 220 configured as follows&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Real interface X2&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN Zone&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Virtual interface X2:V1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.2.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN ID 100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN Zone&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this configuration computers in any of the subnets above can successfully reach each others, what I need to do is to block traffic between these two subnets? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I do this?&lt;/p&gt;&#xA;" OwnerUserId="14326" LastActivityDate="2015-06-10T14:20:25.173" Title="SonicWall : Blocking Access Between Different Subnets or Interfaces" Tags="|subnet|sonicwall|interface|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19084" PostTypeId="2" ParentId="17329" CreationDate="2015-06-10T00:16:55.153" Score="2" Body="&lt;p&gt;After a long period of experimentation and follow-up with Cisco, I've got the following answers:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;There is no recycle bin equivalent when deleting CIFS files from a Windows server via the clientless VPN.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There is no way to enable any kind of confirmation dialogue for file deletions at this point in time.  So people can be trying to click the &quot;favourite&quot; button, be off by a millimetre, and accidentally delete with no confirmation and no trash to recover from.  :-(  They've put in the ability to turn on confirmations as a feature request, but there's no timeline on when it might be implemented.  So guess we won't be using this feature, which is sad.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I added our nbns server to the Cisco config, and now clicking the Browse entire network button shows me the domain.  However, when I click on the domain, it says &quot;Failed to retrieve servers&quot;.  A had a support tech look at this, and he said the config all looks fine, and he found a few other instances of this for other users.  He said he'd investigate and get back to me.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;While waiting, I disabled file browsing.  A few days later, when he wanted me to show him the issue, I turned it back on and it was working!  (There's still a second domain showing in there that isn't on my nbns server...still no idea what the deal is with that.  But the real domain is working.)  So I don't know if the browsing just basically needed a kick in the pants after I added the nbns server config?  No idea.  But it's okay now.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Having some links that use the clientless VPN and some that don't is in fact possible through content-rewrite rules (&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/asdm64/configuration_guide/asdm_64_config/vpn_clientless_ssl.html#wp2389515&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/asdm64/configuration_guide/asdm_64_config/vpn_clientless_ssl.html#wp2389515&lt;/a&gt;)  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&quot;By default, the security appliance rewrites, or transforms, all clientless traffic. You might not want some applications and web resources (for example, public websites) to go through the ASA. The ASA therefore lets you create rewrite rules that let users browse certain sites and applications without going through the ASA. This is similar to split-tunneling in an IPSec VPN connection.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However - and I have confirmation of this from a Cisco support rep to back up my test results - this does not work in combination with SSO.  If you're using the rewrite rules you cannot send parameters of any kind.&lt;/p&gt;&#xA;" OwnerUserId="14417" LastActivityDate="2015-06-10T00:16:55.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19089" PostTypeId="1" CreationDate="2015-06-10T08:10:30.410" Score="5" ViewCount="84" Body="&lt;p&gt;I'm working with one of the network engineers to customise our login screens for the Cisco clientless VPN, which, apart form time consuming, has been fine (knowledge gap on both of our parts). As part of the initial login routine for first time users, they need to reset their password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The password change screen (&lt;code&gt;password_new.html&lt;/code&gt;) displays a message about password strength which we need to alter, but we can't seem to find anything in the documentation about how to configure this screen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wondered if anyone knew from where it pulls the information, or can the &lt;code&gt;password_new.html&lt;/code&gt; file itself be directly modified?&lt;/p&gt;&#xA;" OwnerUserId="15890" LastEditorUserId="8499" LastEditDate="2016-04-02T19:04:15.597" LastActivityDate="2020-04-07T14:51:24.953" Title="Customising Cisco Clientless VPN Password Change Screen ASA5525" Tags="|cisco|cisco-asa|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19090" PostTypeId="1" AcceptedAnswerId="19096" CreationDate="2015-06-10T09:45:11.643" Score="6" ViewCount="5329" Body="&lt;p&gt;Data sheets of optical transceivers often specify the receiver maximum input power. In addition, non-volatile memory of transceivers often seem to hold this data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@MX240&amp;gt; show interfaces diagnostics optics xe-11/3/0 | match &quot;laser rx&quot;&#xA;    Laser rx power                            :  0.7614 mW / -1.18 dBm&#xA;    Laser rx power high alarm                 :  Off&#xA;    Laser rx power low alarm                  :  Off&#xA;    Laser rx power high warning               :  Off&#xA;    Laser rx power low warning                :  Off&#xA;    Laser rx power high alarm threshold       :  1.2589 mW / 1.00 dBm&#xA;    Laser rx power low alarm threshold        :  0.0050 mW / -23.01 dBm&#xA;    Laser rx power high warning threshold     :  1.1220 mW / 0.50 dBm&#xA;    Laser rx power low warning threshold      :  0.0063 mW / -22.01 dBm&#xA;&#xA;root@MX240&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am aware that too strong Rx signal can saturate it for photodiode and as a result cause bit errors, but has anyone permanently damaged an optical transceiver(GBIC, SFP, XFP, SFP+) because of too strong Rx signal?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="775" LastEditDate="2015-06-15T11:25:50.040" LastActivityDate="2016-12-27T00:01:07.130" Title="Is it possible to permanently damage optical transceiver if Rx signal is too strong?" Tags="|fiber|optics|transceiver|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19091" PostTypeId="2" ParentId="18985" CreationDate="2015-06-10T09:54:37.913" Score="6" Body="&lt;p&gt;I looked this up in the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/cns/configuration/15-s/cns-15-s-book/cns-cmd-sched.html&quot;&gt;Cisco documentation&lt;/a&gt; and I tested this in IOS 15.3. The smallest reoccurrence for kron is 1 minute.  I tried setting a lower value, but decimal points were not accepted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1(config)#kron occurrence test in 1 recurring&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this resulted in kron running every minute:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show kron schedule &#xA;Kron Occurrence Schedule&#xA;test inactive, will run again in 0 days 00:00:00 &#xA;&#xA;R1#show kron schedule &#xA;Kron Occurrence Schedule&#xA;test inactive, will run again in 0 days 00:00:59 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="220" LastEditorUserId="220" LastEditDate="2015-06-10T10:01:12.787" LastActivityDate="2015-06-10T10:01:12.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19092" PostTypeId="1" AcceptedAnswerId="19093" CreationDate="2015-06-10T10:37:10.657" Score="2" ViewCount="4768" Body="&lt;p&gt;I would like to ask something. Probably, that was a simple thing but I'm new at network business so thanks for your kindness. In the topology image given below, the router &amp;quot;Router1&amp;quot; has an input address 10.2.2.1 and its neighbor is the switch with 192.168.2.1. Can someone explain how the router can change the address like that? I'm familiar with VLSM but no expert.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/7SJXS.jpg&quot; alt=&quot;The image&quot; /&gt;&lt;/p&gt;&#xA;" OwnerUserId="15861" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-08-16T00:52:26.553" Title="How can a router change the IP address like that?" Tags="|router|ipv4|ip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19093" PostTypeId="2" ParentId="19092" CreationDate="2015-06-10T10:57:23.697" Score="4" Body="&lt;p&gt;&lt;em&gt;Your picture can't be viewed but if you have both networks directly connected to your router that networks are tipically used to explain Network Address Translation (NAT) Protocol.&#xA;&lt;a href=&quot;http://en.wikipedia.org/wiki/Network_address_translation&quot; rel=&quot;nofollow&quot;&gt;http://en.wikipedia.org/wiki/Network_address_translation&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is not NAT, is just a normal router connection. The goal of a router is interconnecting networks. The router you comment, for example, have this configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface            IP&#xA;Serial0/0/0          10.2.2.1&#xA;FastEthe0/0          192.168.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And it knows that each network is on that interfaces.&#xA;But how can reach PC1 to PC0? Because there are static or dynamic routing: Router 1 have a sentence like that.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.0 255.255.255.0 10.2.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That means:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole network 192.168.1.0/24 can be reached with next hop 10.2.2.2 (The other side of your Serial Interface).&lt;/p&gt;&#xA;" OwnerUserId="6193" LastEditorUserId="6193" LastEditDate="2015-06-10T11:14:48.723" LastActivityDate="2015-06-10T11:14:48.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19094" PostTypeId="2" ParentId="19083" CreationDate="2015-06-10T11:15:49.187" Score="3" Body="&lt;p&gt;By default, communication intra-zone is allowed. You just enter in Firewall-&gt;Access rules, select LAN-&gt;LAN and unmark the last rule wich allow intra-zone connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion, if you don't want communication at all, put X2 and X2:V1 in different zones.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2015-06-10T11:15:49.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19095" PostTypeId="2" ParentId="19092" CreationDate="2015-06-10T11:20:06.407" Score="2" Body="&lt;p&gt;In this picture, when PC0 sends a packer to PC1, it will send a packet with source IP address 192.168.1.10 (it's own) and destination address 192.168.2.20 (PC2's address). PC1 knows that PC2 is not on the local network, so it will hand this packet off to his default gateway, Router2. It does this by sending this IP packet with source MAC address his own MAC address and destination MAC address the address of Router2. Router2 will look up where to reach 192.168.2.20, which is through Router0. Router will replace the MAC addresses (source MAC: Router2, destination MAC Router0), but not change the IP addresses. Router0 will forward the packet the packet to Router1 in the same way as Router2 did. Finally, Router1 knows that the packet is local for him. So he forwards on the packet, which will end up having:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source IP: 192.168.1.10&lt;/li&gt;&#xA;&lt;li&gt;Destination IP: 192.168.2.20&lt;/li&gt;&#xA;&lt;li&gt;Source MAC: Router2's MAC address&lt;/li&gt;&#xA;&lt;li&gt;Destination MAC: PC2's MAC address&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The switches in this picture only need to know on what port to forward the packet to the next hop, but they don't alter the MAC address.&lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2015-06-10T11:20:06.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19096" PostTypeId="2" ParentId="19090" CreationDate="2015-06-10T11:47:21.087" Score="8" Body="&lt;p&gt;Your biggest risk comes from Single Mode ER (40 Km) and ZX (80 Km) optics, which can overdrive and even burn inputs without sufficient attenuation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no risk of burning Multi Mode optics, as long as you're connecting MM to MM.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2015-06-15T10:37:00.650" LastActivityDate="2015-06-15T10:37:00.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19099" PostTypeId="1" AcceptedAnswerId="19100" CreationDate="2015-06-10T13:55:41.820" Score="3" ViewCount="5492" Body="&lt;p&gt;Hi I have seen someone do this a while back but for the life of me cant figure out the quick way to match on multiple strings easily. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;objective is to display any lines of config that matches either abc or xyz &lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g &lt;code&gt;show conf | match 'abc||xyz'&lt;/code&gt;  ( &amp;lt;--this line obviously doesn't work in Junos )&lt;/p&gt;&#xA;" OwnerUserId="1092" LastEditorUserId="3191" LastEditDate="2015-06-10T14:14:20.670" LastActivityDate="2015-06-10T14:14:36.430" Title="Junos cli regex requirement" Tags="|juniper-junos|cli|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19100" PostTypeId="2" ParentId="19099" CreationDate="2015-06-10T14:04:23.207" Score="7" Body="&lt;p&gt;It's just slightly different syntax, if you're trying to match lines containing specific strings, you'd use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show configuration | match &quot;abc|xyz&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, here's the documentation in case you want to get fancier: &lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junos14.2/topics/concept/junos-cli-regular-expressions-with-pipe-usage-overview.html#id-10886237&quot; rel=&quot;noreferrer&quot;&gt;JUNOS Command Regex&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3191" LastEditDate="2015-06-10T14:14:36.430" LastActivityDate="2015-06-10T14:14:36.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19102" PostTypeId="2" ParentId="19083" CreationDate="2015-06-10T14:20:25.173" Score="3" Body="&lt;p&gt;By default the LAN Zone has &lt;strong&gt;Interface Trust&lt;/strong&gt; enabled, which means all interfaces within the same Zone trust each other (pass traffic). Go to &lt;strong&gt;Network&lt;/strong&gt;, &lt;strong&gt;Zones&lt;/strong&gt;, and &lt;em&gt;Edit the Zone&lt;/em&gt; in question (LAN) and remove the checkmark from &lt;strong&gt;Allow Interface Trust&lt;/strong&gt;. This will remove the auto-added LAN&amp;lt;-&gt;LAN Allow ANY/ANY/ANY rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively if these are NOT really both part of the same Zone (security context) then either change one of the interfaces &lt;em&gt;to a different Zone&lt;/em&gt; (eg. DMZ) or create a new Zone. By default traffic between Zones is only allowed from &quot;more trusted&quot; to &quot;less trusted&quot; (but not the other way. Eg. from LAN to DMZ but not DMZ to LAN).&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-06-10T14:20:25.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19103" PostTypeId="1" CreationDate="2015-06-10T16:39:55.050" Score="5" ViewCount="431" Body="&lt;p&gt;In 802.11, I have been studying different types of CSMA/CA. And I come across the following &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;DCF - Distributed Coordination Function&lt;/h2&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Relies on the ability of computers to physically listen before they transmit&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;When a node wants to send a message:&lt;br&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;First listens to make sure that the transmitting node has finished, then &lt;/li&gt;&#xA;  &lt;li&gt;Waits a period of time longer&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;Each frame is sent using stop&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;By waiting, the listening node can detect that the sending node has finished and &lt;/li&gt;&#xA;  &lt;li&gt;Can then begin sending its transmission&lt;/li&gt;&#xA;  &lt;li&gt;ACK/NAK sent a short time after a frame is received, &lt;/li&gt;&#xA;  &lt;li&gt;Message frames are sent a somewhat longer time after (ensuring that no collision will occur)&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;a href=&quot;http://web.csulb.edu/~hchuynh/is355/topic-8-Wi-Fi.pdf&quot; rel=&quot;nofollow&quot;&gt;California State University, Long Beach, IS 355 - Wi-Fi LAN&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have few questions regarding DCF and its relationship with Clear Channel Assessment (CCA) (the threshold that indicates that the channel is busy)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is DCF implemented using Energy detection or is it using preamble detection?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;does the node that wish to transmit, detect energy at its antenna and then defer transmission? Is there a certain gain threshold (CCA threshold) in dbm that nodes should compare to and how do they calculate it?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks, looking forward for your discussion or references.&lt;/p&gt;&#xA;" OwnerUserId="15457" LastEditorUserId="8499" LastEditDate="2016-11-29T16:10:11.353" LastActivityDate="2016-11-29T16:10:11.353" Title="DCF and its relationship with Clear Channel Assesment (CCA) in IEEE802.11" Tags="|ieee-802.11|layer1|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19109" PostTypeId="1" AcceptedAnswerId="19111" CreationDate="2015-06-10T19:35:33.660" Score="8" ViewCount="1068" Body="&lt;p&gt;I am load balancing traffic on dual, same size links aggregating to the same VRF on the PE router (Juniper MX5 JunOS 11.4). Traffic from the CE (Cisco) is balancing nicely but I need get the reverse right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not NATing inside the multi-site network, the only NATing happens on the edge firewall to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured the VRF as follows on the Juniper PE router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show routing-instances {client}&#xA;instance-type vrf;&#xA;.&#xA;.&#xA;vrf-export {client}-load-balance;&#xA;.&#xA;.&#xA;routing-options {&#xA;    static {&#xA;        .&#xA;        .&#xA;        route 10.0.0.0/24 next-hop [ 196.33.144.11 196.33.144.3 ];&#xA;        .&#xA;        .&#xA;    }&#xA;}&#xA;forwarding-options {&#xA;    load-balance {&#xA;        indexed-next-hop;&#xA;        per-flow {&#xA;            hash-seed;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and in the main configuration this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show policy-options policy-statement {client}-load-balance&#xA;then {&#xA;     load-balance per-packet;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show forwarding-options hash-key&#xA;family inet {&#xA;    layer-3;&#xA;    layer-4;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The router still chooses only the 196.33.144.3 hop to route the subnet's (10.0.0.0/24) traffic to and not balancing over both links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some checks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# run show route forwarding-table table {client}&#xA;Routing table: {client}.inet&#xA;Internet:&#xA;Destination        Type RtRef Next hop           Type Index NhRef Netif&#xA;default            user     0 8:5b:e:84:4c:b0    ucst   561     3 ge-1/1/2.3017&#xA;default            perm     0                    rjct   961     1&#xA;0.0.0.0/32         perm     0                    dscd   959     1&#xA;10.0.0.0/24        user     0 196.33.144.3       ucst   589     5 ge-1/1/5.2100&#xA;10.0.0.55/32       user     0                    ucst   645     6 gr-1/1/10.1&#xA;10.0.0.210/32      user     0                    ucst   645     6 gr-1/1/10.1&#xA;10.0.6.0/24        user     0                    ucst   921     3 gr-1/1/10.16&#xA;.&#xA;.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# run show route 10.0.0.0 table {client}.inet.0&#xA;&#xA;{client}.inet.0: 19 destinations, 20 routes (19 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.0.0.0/24        *[Static/5] 3d 07:43:36&#xA;                    &amp;gt; to 196.33.144.3 via ge-1/1/5.2100&#xA;                      to 196.33.144.11 via gr-1/1/10.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# run show route table {client}.inet.0 detail&#xA;&#xA;{client}.inet.0: 19 destinations, 20 routes (19 active, 0 holddown, 0 hidden)&#xA;.&#xA;.&#xA;10.0.0.0/24 (1 entry, 1 announced)&#xA;        *Static Preference: 5&#xA;                Next hop type: Router, Next hop index: 1048574&#xA;                Address: 0xb6b407c&#xA;                Next-hop reference count: 3&#xA;                Next hop: 196.33.144.3 via ge-1/1/5.2100, selected&#xA;                Next hop: 196.33.144.11 via gr-1/1/10.1&#xA;                State: &amp;lt;Active Int Ext&amp;gt;&#xA;                Age: 3d 7:46:23&#xA;                Task: RT&#xA;                Announcement bits (2): 0-RT 2-KRT&#xA;                AS path: I&#xA;                AS path: Recorded&#xA;&#xA;10.0.0.55/32 (1 entry, 1 announced)&#xA;        *Static Preference: 5&#xA;.&#xA;.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are guides explaining this using the default inet.0 instance of the router but I can't find examples of this being done inside a VRF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying the &lt;em&gt;vrf-export&lt;/em&gt; command as an alternative for &quot;forwading-table export load-balance-policy-name&quot; because the VRF does not have the forwarding-table option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas what I can try?&lt;/p&gt;&#xA;" OwnerUserId="1985" LastActivityDate="2015-06-10T23:30:11.777" Title="Junos VRF equal-cost, multi-next-hop static routes not balancing" Tags="|juniper-junos|vrf-lite|load-balancing|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="19111" PostTypeId="2" ParentId="19109" CreationDate="2015-06-10T20:53:32.683" Score="5" Body="&lt;p&gt;It appears that you're applying the load balancing policy to the &lt;code&gt;routing-instance&lt;/code&gt;.  It needs to be applied to the &lt;code&gt;forwarding-table&lt;/code&gt; in order for it to perform ECMP on the forwarding plane.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routing-options {&#xA;     forwarding-table {&#xA;          export load-balancing-policy;&#xA;     }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To confirm it's working, you should see something similar to this.  Note the additional entry on the forwarding table for entry &lt;code&gt;10.0.0.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# run show route forwarding-table table {client}&#xA;Routing table: {client}.inet&#xA;Internet:&#xA;Destination        Type RtRef Next hop           Type Index NhRef Netif&#xA;default            user     0 8:5b:e:84:4c:b0    ucst   561     3 ge-1/1/2.3017&#xA;default            perm     0                    rjct   961     1&#xA;0.0.0.0/32         perm     0                    dscd   959     1&#xA;10.0.0.0/24        user     0 196.33.144.3       ucst   589     5 ge-1/1/5.2100 *&#xA;10.0.0.0/24        user     0 196.33.144.11      ucst   645     6 gr-1/1/10.1   *&#xA;10.0.0.55/32       user     0                    ucst   645     6 gr-1/1/10.1&#xA;10.0.0.210/32      user     0                    ucst   645     6 gr-1/1/10.1&#xA;10.0.6.0/24        user     0                    ucst   921     3 gr-1/1/10.16&#xA;.&#xA;.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="3191" LastEditDate="2015-06-10T23:30:11.777" LastActivityDate="2015-06-10T23:30:11.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19112" PostTypeId="2" ParentId="19048" CreationDate="2015-06-10T21:55:47.747" Score="0" Body="&lt;p&gt;If the routing decision is pre-NAT, then I think it should work. (Exactly like you have on the ping diagram). If the ping is exiting on the same interface it goes in, it's because the routing is being executed after-NAT. Do you have the same result when ping is initiated by other side also?&lt;/p&gt;&#xA;" OwnerUserId="15900" LastEditorUserId="15900" LastEditDate="2015-06-10T22:01:16.600" LastActivityDate="2015-06-10T22:01:16.600" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19113" PostTypeId="1" CreationDate="2015-06-10T23:20:43.220" Score="0" ViewCount="626" Body="&lt;p&gt;My LAN is completely and constantly overwhelmed from some host in the network. The network is shared and I have no accesso to all its branches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping to &lt;em&gt;WAN&lt;/em&gt; addresses should be &lt;strong&gt;15ms&lt;/strong&gt; usually but 90% of the time it is &lt;strong&gt;100-500ms&lt;/strong&gt; (is a 5MB DSL connection).&#xA;I suspect someone is downloading over P2P (probably &lt;em&gt;BitTorrent&lt;/em&gt;) continuously stealing all the bandwitdth and filling the &lt;em&gt;NAT&lt;/em&gt; (so making all the other host's packets delayed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I don't know which host is the responsible&lt;/li&gt;&#xA;&lt;li&gt;I'm in a switched network; so I cannot run &lt;em&gt;Wireshark&lt;/em&gt; to find the culprit &lt;/li&gt;&#xA;&lt;li&gt;I don't have access to the router and/or firewall; otherwise I would have set traffic filters, &lt;em&gt;QoS&lt;/em&gt; or blocked torrent ports (or, at least, checked the logs).&lt;/li&gt;&#xA;&lt;li&gt;I had not luck in &quot;human indagation&quot; and have no other chances that relying on technical analyzing for finding that host.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;How could I detect the computer that is causing all this connectivity slowdown on the LAN?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Probably the host is using a &lt;em&gt;VPN&lt;/em&gt; to download: would it limit my chances to detect it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;relying on &lt;em&gt;LDP&lt;/em&gt; from BitTorrent protocol and listen for broadcast torrent packets (but I'm not having luck with it).&lt;/li&gt;&#xA;&lt;li&gt;sniff traffic on &lt;em&gt;LAN&lt;/em&gt; (but, as mentioned, Wireshark is limited by the switch that delimit my network segment)&lt;/li&gt;&#xA;&lt;li&gt;use some tool for discovering &lt;em&gt;Torrent&lt;/em&gt; clients (basing on broadcast packets, open ports, or other ways). But have no clue of which tools, or what I would need to do to achieve the analysis.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What methods would you suggest to discover it? What could be other paths to follow?&lt;/p&gt;&#xA;" OwnerUserId="15901" LastActivityDate="2015-06-11T03:35:19.883" Title="Discover Torrent hosts on LAN stealing internet bandwidth" Tags="|lan|network-discovery|" AnswerCount="1" CommentCount="3" ClosedDate="2015-06-11T05:02:31.683" ContentLicense="CC BY-SA 3.0" />
  <row Id="19114" PostTypeId="1" AcceptedAnswerId="19137" CreationDate="2015-06-11T01:17:31.973" Score="5" ViewCount="2018" Body="&lt;p&gt;I am trying to monitor a Cisco process memory usage. This is what I get with the command line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show system internal processes memory | inc PID|ipfib&#xA; PID TTY      STAT     TIME MAJFLT  TRS   RSS    VSZ %MEM COMMAND&#xA; 6069 ?        Ssl  00:14:01      0    0 169480 532812  1.0 /lc/isan/bin/ipfib&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to use my SNMP poller to get this information, so far I have only found &#xA;1.3.6.1.4.1.9.9.109.1.2.1.1 has all the process names, pid, process usage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I need is the memory usage, but I can't find it.&lt;/p&gt;&#xA;" OwnerUserId="15905" LastEditorUserId="3191" LastEditDate="2015-06-11T01:29:22.910" LastActivityDate="2015-06-11T11:55:11.787" Title="Cisco process memory usage" Tags="|cisco|cisco-ios|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19115" PostTypeId="1" CreationDate="2015-06-11T01:51:22.933" Score="3" ViewCount="432" Body="&lt;p&gt;I hope can someone help me with my problem on my Cisco 2960 switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is this: when I configure the Gig0/1 port on my client 2960 switch as trunk, and connect it to my server 3560 switch on port Gig0/24 with &lt;code&gt;switchport trunk encapsulation dot1q&lt;/code&gt; and &lt;code&gt;switchport mode trunk&lt;/code&gt;, there is no connection running on either port, and when I check the status of the of my 2960 port, this is what I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GigabitEthernet0/1 is down, line protocol is down (notconnect)&#xA;Hardware is Gigabit Ethernet, address is 0018.18da.8b81 (bia 0018.18da.8b81)&#xA;MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,&#xA; reliability 255/255, txload 1/255## Heading ##, rxload 1/255&#xA;Encapsulation ARPA, loopback not set&#xA;Keepalive set (10 sec)&#xA;Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX&#xA;input flow-control is off, output flow-control is unsupported&#xA;ARP type: ARPA, ARP Timeout 04:00:00&#xA;Last input never, output never, output hang never&#xA;Last clearing of &quot;show interface&quot; counters never&#xA;Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;Queueing strategy: fifo&#xA;Output queue: 0/40 (size/max)&#xA;5 minute input rate 0 bits/sec, 0 packets/sec&#xA;5 minute output rate 0 bits/sec, 0 packets/sec&#xA; 0 packets input, 0 bytes, 0 no buffer&#xA; Received 0 broadcasts (0 multicast)&#xA; 0 runts, 0 giants, 0 throttles&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I connect Gig0/24 to another port on my 2960, for example port gig0/2, and configure it as trunk, it status connected, and there is a connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a bad port?&lt;/p&gt;&#xA;" OwnerUserId="15845" LastEditorUserId="8499" LastEditDate="2016-04-02T19:00:54.127" LastActivityDate="2024-03-10T03:02:20.277" Title="Switchport fail (edited)" Tags="|cisco|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="19118" PostTypeId="2" ParentId="19113" CreationDate="2015-06-11T03:35:19.883" Score="1" Body="&lt;p&gt;&lt;strong&gt;If it's your network that you are responsible for managing&lt;/strong&gt;, then you can setup a SPAN port and analyze using wireshark from there.  This is by far your best option.  If you don't have a switch capable of doing that, then there are other options.  I only give you these options in the case that a MSP or VOIP provider manages your router but you are an on site tech, which I have seen with some SMB clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use a hub or hardware passive ethernet tap(easy to make if you google it) between your switch uplink to the router, and plug in to that with your wireshark machine.  Another option is to do arp poisoning from a linux box to sniff a switched network.  The problem with these issues is that you can cause some pretty annoying network issues while you are analyzing the traffic.  You can also end up in some trouble with the law if it isn't your network and you shouldn't really be analyzing the traffic.  You won't be able to open the packets up if they are using encrypted bittorrent or going through a VPN, but you will see who's eating up all of your bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry, I didn't give explicit instructions on how to do everything, because I don't feel like writing a novel.  This post is already long.  You should be able to google the options that I've listed though.  Also, keep in mind that DSL will be asymmetrical, so 5m down and probably 768k up(if that), which doesn't take much to saturate.  15ms pings out to the internet is also VERY optimistic on your part, unless you pay a ton of money which I doubt since it's DSL.&lt;/p&gt;&#xA;" OwnerUserId="15906" LastActivityDate="2015-06-11T03:35:19.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19119" PostTypeId="2" ParentId="19071" CreationDate="2015-06-11T03:47:34.337" Score="-1" Body="&lt;p&gt;Yes, it is good practice to use mode on in my opinion.  Why bother negotiating if the end result is to create an etherchannel.  This is like statically setting a port to access or trunk and not using DTP.  Just make sure to set it on both sides.  The only advantage to using LACP is if you want to connect to non Cisco gear, which is not what you are doing.&lt;/p&gt;&#xA;" OwnerUserId="15906" LastActivityDate="2015-06-11T03:47:34.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19123" PostTypeId="2" ParentId="19071" CreationDate="2015-06-11T06:39:25.950" Score="7" Body="&lt;p&gt;LACP gives you a significant advantage in that it verifies connectivity in both directions over each link.  You can think of it as also combining the features of UDLD with link aggregation.  For example, imagine you have the links configured in &quot;mode on&quot;.  Now lets say one of the links from the 3750 to the 2960 fails but in only one direction, say the direction toward the 2960 (lets say the fiber got kinked and only one of the two strands has broken).  The 3750 will still see link on both ports (because the direction from the 2960 to the 3750 is fine) and it will still try to use the failed path because it does not know that the 2960 has lost link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you configure &quot;mode active&quot; the LACP packets must flow over the link in both directions between the 3750 and the 2960.  If the link fails in one direction, LACP fails to work and the 3750 stops forwarding over the failed link even though it still has light from the 2960.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So -- using LACP gives you protection against unidirectional link failure.  It also gives you protection against plugging the link into the wrong port.  If you accidentally plug the link into the wrong port, LACP will fail, the 3750 will not bring that link up, and you have protected yourself against a problem that is difficult to troubleshoot.&lt;/p&gt;&#xA;" OwnerUserId="15910" LastActivityDate="2015-06-11T06:39:25.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19124" PostTypeId="1" CreationDate="2015-06-11T06:49:35.077" Score="4" ViewCount="10411" Body="&lt;p&gt;Why is eBGP receiving updates with &lt;code&gt;Origin IGP&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this normal or just an OS bug?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show version&#xA;Cisco IOS Software, 3700 Software (C3745-ADVIPSERVICESK9-M), Version 12.4(25d), &#xA;RELEASE SOFTWARE (fc1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Dt9vB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="775" LastEditDate="2015-06-11T09:05:53.227" LastActivityDate="2024-04-02T07:30:00.903" Title="Why is eBGP receiving updates with `Origin IGP`?" Tags="|cisco|routing|router|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19126" PostTypeId="2" ParentId="6686" CreationDate="2015-06-11T07:26:53.687" Score="2" Body="&lt;p&gt;Might be related to this known bug?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tools.cisco.com/quickview/bug/CSCua02927&quot; rel=&quot;nofollow&quot;&gt;https://tools.cisco.com/quickview/bug/CSCua02927&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15910" LastActivityDate="2015-06-11T07:26:53.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19127" PostTypeId="2" ParentId="13554" CreationDate="2015-06-11T08:05:54.253" Score="2" Body="&lt;p&gt;Currently unit numbers above 16K are reserved for special purpose use only. Not possible to allow these units for regular interfaces. Please contact your Juniper SE if you need higher number available to work on a enhancement request.&lt;/p&gt;&#xA;" OwnerUserId="1092" LastActivityDate="2015-06-11T08:05:54.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19129" PostTypeId="1" CreationDate="2015-06-11T08:39:56.170" Score="4" ViewCount="1902" Body="&lt;p&gt;Apple announced at WWDC that they are starting to randomize MAC addresses of &lt;em&gt;location scans&lt;/em&gt; and &lt;em&gt;auto join scans&lt;/em&gt; in iOS 9, in addition to Unassociated PNO and ePNO scans (see &lt;a href=&quot;https://developer.apple.com/videos/wwdc/2015/?id=703&quot; rel=&quot;noreferrer&quot; title=&quot;Apple Session: Privacy and your app&quot;&gt;the video&lt;/a&gt; around 8:00 for details).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While PNO and ePNO scans are well-defined, I could not find any details on &lt;em&gt;location scans&lt;/em&gt; and &lt;em&gt;auto join scans&lt;/em&gt; – they don't seem to be any official (IEEE) terms.&#xA;They sound like scans to determine location or automatically join known networks – but from what I understood, this is precisely what PNO scans and ePNO scans are used for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone please clarify these terms for me?&lt;/p&gt;&#xA;" OwnerUserId="15914" LastActivityDate="2016-04-15T14:47:23.090" Title="What are wifi location scans and auto join scans?" Tags="|mac-address|ieee-802.11|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19130" PostTypeId="2" ParentId="19124" CreationDate="2015-06-11T08:59:12.387" Score="7" Body="&lt;h2&gt;Reason for &lt;code&gt;Origin IGP&lt;/code&gt;:&lt;/h2&gt;&#xA;&lt;p&gt;Routes show up as &lt;code&gt;Origin IGP&lt;/code&gt; for one of these reasons:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you use a &lt;code&gt;network x.x.x.x&lt;/code&gt; command under the bgp process, the routes naturally show up as &lt;code&gt;Origin IGP&lt;/code&gt;.  This makes sense, because bgp typically finds those routes in the IGP (of course they could be statics as well)&lt;/li&gt;&#xA;&lt;li&gt;Someone redistributed the routes directly from an IGP into BGP (nominally receiving an incomplete Origin code); then they manually converted &lt;code&gt;Origin incomplete&lt;/code&gt; to &lt;code&gt;Origin IGP&lt;/code&gt; using a route-map&lt;/li&gt;&#xA;&lt;li&gt;BGP Origin code was manually set in a policy&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Why does the BGP Origin code matter?&lt;/h2&gt;&#xA;&lt;p&gt;So the question might be asked, &amp;quot;who cares what the BGP Origin code is?&amp;quot;; the Origin code matters in certain cases. If you look at the &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP Path Selection algorithm&lt;/a&gt;, origin code is considered at step 6 of the 10-step algorithm; &lt;code&gt;Origin IGP&lt;/code&gt; is considered the lowest if the weight, local-preference, and AS-path length are all the same.&lt;/p&gt;&#xA;&lt;p&gt;BGP admins typically set &lt;code&gt;Origin IGP&lt;/code&gt; on all ingress prefixes to avoid routes with &lt;code&gt;Origin incomplete&lt;/code&gt;.  If you have routes with &lt;code&gt;Origin incomplete&lt;/code&gt;, it potentially short-cuts these decision points: lowest MED, EBGP vs IBGP, lowest IGP cost to the BGP next-hop, and lowest BGP router-id.&lt;/p&gt;&#xA;&lt;p&gt;So the short answer is people manually force &lt;code&gt;Origin IGP&lt;/code&gt; so bgp behaves more rationally.  For instance, setting all routes to &lt;code&gt;Origin IGP&lt;/code&gt; helps facilitate &lt;a href=&quot;http://en.wikipedia.org/wiki/Hot-potato_and_cold-potato_routing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hot Potato Routing&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP Path Selection Algorithm&lt;/a&gt;:&lt;/h2&gt;&#xA;&lt;p&gt;Just for grins, I'm including the BGP path selection algorithm below... notice that the Origin code is at step 6, but there are very relevant decision points below.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If the path specifies a next hop that is inaccessible, drop the update.&lt;/li&gt;&#xA;&lt;li&gt;Prefer the path with the &lt;em&gt;largest weight&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;If the weights are the same, prefer the path with the &lt;em&gt;largest local preference&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;If the local preferences are the same, prefer the path that was originated by BGP running on this router (&lt;em&gt;self-originated&lt;/em&gt;).&lt;/li&gt;&#xA;&lt;li&gt;If no route was self-originated, prefer the route that has the &lt;em&gt;shortest AS_path&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;If all paths have the same AS_path length, prefer the path with the &lt;em&gt;lowest origin type&lt;/em&gt; (where IGP is lower than EGP, and EGP is lower than incomplete).&lt;/li&gt;&#xA;&lt;li&gt;If the origin codes are the same, prefer the path with the &lt;em&gt;lowest MED&lt;/em&gt; attribute.&lt;/li&gt;&#xA;&lt;li&gt;If the paths have the same MED, &lt;em&gt;prefer the external path&lt;/em&gt; over the internal path.&lt;/li&gt;&#xA;&lt;li&gt;If the paths are still the same, prefer the path through the &lt;em&gt;closest IGP neighbor&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Prefer the path with the &lt;em&gt;lowest BGP Router ID&lt;/em&gt; (IP address)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="775" LastEditorUserId="775" LastEditDate="2020-12-30T20:42:42.480" LastActivityDate="2020-12-30T20:42:42.480" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19131" PostTypeId="1" AcceptedAnswerId="19135" CreationDate="2015-06-11T09:10:59.043" Score="4" ViewCount="6499" Body="&lt;p&gt;is it possible to mix OM-2 with OM-3/4 Patchcords or installed Fiber.&#xA;As far as i know, they are the same diameter of 50µm, they only have different bandwith caracteristics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other reason to don't do that? (except for the orange/aqua mess in the racks ;))&lt;/p&gt;&#xA;" OwnerUserId="15915" LastEditorUserId="8499" LastEditDate="2018-03-07T23:48:33.563" LastActivityDate="2018-03-07T23:48:33.563" Title="Mixing OM-2 with OM-3/4 Patchcords/Installation Fibers" Tags="|fiber|layer1|cabling|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19133" PostTypeId="2" ParentId="19131" CreationDate="2015-06-11T09:42:47.340" Score="3" Body="&lt;p&gt;The main problem is that you are wasting your OM3/4 fiber introducing a physical bottleneck with OM2 segment. It's like the typical scenario where you have cat6 accross all the building and your users connect their workstations with cat5e.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, It will work? In my experience, it works on most of the scenarios. Is it a good idea? Totally no, do it only if you have no other option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an additional tip, remember never mix singlemode and multimode.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastEditorUserId="619" LastEditDate="2015-06-11T22:00:16.140" LastActivityDate="2015-06-11T22:00:16.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19135" PostTypeId="2" ParentId="19131" CreationDate="2015-06-11T11:39:35.160" Score="5" Body="&lt;p&gt;If you have OM2 in the walls, it makes no difference, and if you have a mixture of OM2/3/4 in the walls, it's probably a good idea to use (only) patch cords that match the highest grade fiber in the walls, as they won't hurt the lower grade runs, though it does run a risk of making the uninformed think that all the cables in the wall are OM4 when they are not. But the uninformed are rather hard to sort out in any case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have OM3/4 in the walls, it's &lt;strong&gt;not a good idea&lt;/strong&gt;, though it may &quot;work&quot; for some value of &quot;work.&quot; But it's a terrible place to &quot;save&quot; a few bucks while wasting/degrading a few kilobucks of installed fiber plant.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-06-11T11:39:35.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19136" PostTypeId="1" CreationDate="2015-06-11T11:44:17.993" Score="1" ViewCount="219" Body="&lt;p&gt;I have configured ACL for NAT and PFR purpose.&#xA;ios c1841-adventerprisek9-mz.151-4.M4.bin&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ip access-list extended PFR&#xA; permit ip 192.168.0.0 0.0.7.255 any log&#xA;&#xA;route-map isp2 permit 10&#xA; match ip address PFR&#xA; match interface Serial0/0/0&#xA;!&#xA;route-map isp1 permit 10&#xA; match ip address PFR&#xA; match interface FastEthernet0/0&#xA;!&#xA;&#xA;ip nat inside source route-map isp1 interface FastEthernet0/0 overload oer&#xA;ip nat inside source route-map isp2 interface Serial0/0/0 overload oer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where 192.168.1.0 255.255.248.0 inside network(fa0/1), 213.70.2.0 fa0/0 - outside, 80.4.5.0 s0/0/0 - outside. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/0            213.70.2.2      &#xA;FastEthernet0/1            192.168.1.1    &#xA;Serial0/0/0                80.4.5.2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But local addresses are not matched. &#xA;Also I tried to rewrite it by how it was told in Cisco manual &quot;Performance Routing Configuration Guide, Cisco IOS Release 15M&amp;amp;T&quot;, but :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; office(config)#ip nat inside source route-map PFR1 pool isp1 oer&#xA;                                                                  ^&#xA;    % Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both oer and pfr options are unavailable.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;here is the new config:&#xA;&#xA;ip nat pool isp1 213.70.2.2 213.70.2.2 prefix-length 30&#xA;ip nat pool isp2 80.4.5.2 80.4.5.2 prefix-length 30&#xA;&#xA;access-list 1 permit 192.168.0.0 0.0.255.255 log&#xA;&#xA;route-map PFR1 permit 10&#xA; match ip address 1&#xA; match interface FastEthernet0/0&#xA;!&#xA;route-map PFR2 permit 10&#xA; match ip address 1&#xA; match interface Serial0/0/0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I write overload oer, the command is accepted.&#xA;What is wrong with config and why my ios doesn't have option as it was written ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. The funniest thing is that it had worked before I had a business trip&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Pro Inside global      Inside local       Outside local      Outside global&#xA;icmp 213.70.2.2:1      192.168.1.3:1      192.168.176.63:1   192.168.176.63:1&#xA;office#wr &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7766" LastActivityDate="2015-06-11T11:44:17.993" Title="NAT is not working because of ACL and CLI command unavailable" Tags="|nat|acl|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19137" PostTypeId="2" ParentId="19114" CreationDate="2015-06-11T11:55:11.787" Score="3" Body="&lt;p&gt;I don't have a device with an ipfib process available, but assuming you're running IOS, the principles are the same no matter what the process name is...&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Find the index for the process in question:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;First, walk &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.109.1.2.1.1.2&quot; rel=&quot;nofollow&quot; title=&quot;cpmProcessName: 1.3.6.1.4.1.9.9.109.1.2.1.1.2&quot;&gt;cpmProcessName&lt;/a&gt; and find the index... for instance, I'll look for &quot;ARP Input&quot;...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(py27_test)[mpenning@tsunami fast]$ snmpbulkwalk -v 2c -c public 10.1.1.1  \&#xA;  .1.3.6.1.4.1.9.9.109.1.2.1.1.2 | grep &quot;ARP Input&quot;&#xA;CISCO-PROCESS-MIB::cpmProcessName.1.12 = STRING: ARP Input&#xA;CISCO-PROCESS-MIB::cpmProcessName.1.239 = STRING: RARP Input&#xA;(py27_test)[mpenning@tsunami fast]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see the index for the &quot;ARP Input&quot; process is 1.12... &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;All memory allocated:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Now let's find all the memory that was ever allocated to this process.  We will do an &lt;code&gt;snmpget&lt;/code&gt; on &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=cpmProcExtMemAllocatedRev&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot; rel=&quot;nofollow&quot; title=&quot;cpmProcExtMemAllocatedRev: 1.3.6.1.4.1.9.9.109.1.2.3.1.1&quot;&gt;cpmProcExtMemAllocatedRev&lt;/a&gt;... be sure to append 1.12 to the cpmProcExtMemAllocatedRev OID...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(py27_test)[mpenning@tsunami fast]$ snmpget -v 2c -c public 10.1.1.1 \&#xA;  .1.3.6.1.4.1.9.9.109.1.2.3.1.1.1.12&#xA;CISCO-PROCESS-MIB::cpmProcExtMemAllocatedRev.1.12 = Gauge32: 1259940452 bytes&#xA;(py27_test)[mpenning@tsunami fast]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=cpmProcExtMemAllocatedRev&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot; rel=&quot;nofollow&quot; title=&quot;cpmProcExtMemAllocatedRev: 1.3.6.1.4.1.9.9.109.1.2.3.1.1&quot;&gt;cpmProcExtMemAllocatedRev&lt;/a&gt; is the sum of &lt;em&gt;all memory ever allocated&lt;/em&gt; to the process; that means you'll have to subtract all memory that was ever freed from the process.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;All memory freed:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To find all the memory that was ever freed, poll the &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=cpmProcExtMemFreedRev&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot; rel=&quot;nofollow&quot; title=&quot;cpmProcExtMemFreedRev: 1.3.6.1.4.1.9.9.109.1.2.3.1.2&quot;&gt;cpmProcExtMemFreedRev&lt;/a&gt; OID, and append the index (1.12)...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(py27_test)[mpenning@tsunami fast]$ snmpget -v 2c -c public 10.1.1.1 \&#xA;  .1.3.6.1.4.1.9.9.109.1.2.3.1.2.1.12&#xA;CISCO-PROCESS-MIB::cpmProcExtMemFreedRev.1.12 = Gauge32: 1259931892 bytes&#xA;(py27_test)[mpenning@tsunami fast]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Totals / math:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;So the total memory used by my &quot;ARP Input&quot; process is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AllocatedMem - FreedMem   = MemoryUsed&#xA;&#xA;1259940452   - 1259931892 = *8560 Bytes*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-06-11T11:55:11.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19138" PostTypeId="1" AcceptedAnswerId="19139" CreationDate="2015-06-11T15:09:58.167" Score="3" ViewCount="11814" Body="&lt;p&gt;What is the length of &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=sysUpTime&quot; rel=&quot;nofollow&quot;&gt;Cisco SNMP sysUpTime counter&lt;/a&gt;? 32 bits?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2016-05-02T19:00:18.417" Title="What is the length of SNMP sysUpTime counter?" Tags="|cisco|snmp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19139" PostTypeId="2" ParentId="19138" CreationDate="2015-06-11T15:39:42.983" Score="5" Body="&lt;p&gt;Did a quick test and it looks like the data is a type 'Timeticks' which is a 32 bit integer. From the RFC:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;The TimeTicks type represents a non-negative integer which represents&#xA;the time, modulo 2^32 (4294967296 decimal), in hundredths of a second&#xA;between two epochs.  When objects are defined which use this ASN.1&#xA;type, the description of the object identifies both of the reference&#xA;epochs.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2578#section-7.1.8&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2578#section-7.1.8&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[user@host ~]$ snmpwalk -v 2c -c $COMMUNITY $DEVICE sysUpTime&#xA;DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (1342832478) 155 days, 10:05:24.78&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10323" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-06-11T15:39:42.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19140" PostTypeId="2" ParentId="18437" CreationDate="2015-06-11T16:13:57.087" Score="7" Body="&lt;p&gt;The Core layer is responsible for fast transportation across a network. The more intelligent routing you try and perform there the more you slow down the rate of packet flow. You don't want to have a WAN Router also be doing VLAN routing, if you don't have to. You want it receive traffic not bound for the LAN and send it out over the internet or MPLS network. If you had the Core layer do the routing, you'd essentially have all L3 traffic hit it first and be sent back in to the LAN. This is inefficient and causes load on the router that could easily be handled by a layer 3 switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The distribution layer, however, is where intelligent routing should occur. If I have a group of access switches, each accessing different VLANs, do I want that traffic to have to cross both a distribution switch and then hit a sub interface on the WAN router? No. Shortest, quickest path is from the Host to the Access Switch to the Distribution switch and then to whatever the traffic is bound on the LAN. &lt;a href=&quot;http://www.mcmcse.com/cisco/guides/hierarchical_model.shtml&quot;&gt;Additional Reading&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not to throw a wrench in the above, but Collapsed Core configurations are becoming more and more common. In a collapsed core configuration, you combine both the Distribution layer and the Core layer into one. You will see this in small enterprises. Your WAN router is still a different device, but instead of having a &quot;dumb&quot; core, you have a core that runs EIGRP, and learns and shares the networks it &quot;knows&quot;. &#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Small_Enterprise_Design_Profile/SEDP/chap2.html&quot;&gt;Additional Reading&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-06-11T16:13:57.087" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19142" PostTypeId="2" ParentId="19131" CreationDate="2015-06-11T16:18:01.790" Score="3" Body="&lt;p&gt;The rating of a cable plant is determined by the lowest rating of any link in the cable plant.  If you have OM4, and you use lower rated patch cords, the rating of the cable plant is the rating of the patch cords.  The same thing applies to copper cabling.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-06-11T16:18:01.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19143" PostTypeId="2" ParentId="19138" CreationDate="2015-06-11T16:20:55.870" Score="6" Body="&lt;p&gt;sysUpTime is a 32-bit counter and will roll over after 496 days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;snmpEngineTime (.1.3.6.1.6.3.10.2.1.3) which returns the uptime in seconds and should not roll over for 135 years.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpwalk -v2c -c xx 10.xx.xxx.xxx .1.3.6.1.6.3.10.2.1.3&#xA;SNMP-FRAMEWORK-MIB::snmpEngineTime.0 = INTEGER: 1701562 seconds&#xA;&#xA;snmpwalk -v2c -c xx 10.xx.xxx.xxx sysUpTime&#xA;DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (170158257) 19 days, 16:39:42.57&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1592" LastEditorUserId="-1" LastEditDate="2016-05-02T19:00:18.417" LastActivityDate="2016-05-02T19:00:18.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19144" PostTypeId="2" ParentId="18437" CreationDate="2015-06-11T16:24:01.743" Score="1" Body="&lt;p&gt;You certainly can ask 10 people and get 10 different answers.  Mainframe salesmen aside, you will probably find a majority who will favor something between balanced and fully distributed.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;A defense of distributed processing&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The key advantage that moving the processing away from the core creates is a more peer-oriented topology where outages do not affect entire services.  If you put your firewalls at the edge of your network, and you have 5 peering points, then you have (ideally) 5 redundant points so losing one of them does not affect more than a small portion of your services, and ideally they are laid out so that a failure in one cause the others to automatically take over the traffic.  In addition this scales gracefully because if you need to expand from 5 to 6 peering points, you will likely only need to invest in one small piece of equipment, vs outgrowing a single core device and having to scrap it in favor of one that offers a little more capacity.  When dealing with intelligent devices, scale capability is often all-or-nothing.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2015-06-11T16:24:01.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19146" PostTypeId="1" AcceptedAnswerId="19148" CreationDate="2015-06-11T16:45:20.270" Score="3" ViewCount="1885" Body="&lt;p&gt;I need to generate a notification for APs that have lost connectivity so that we can proactively dispatch a tech to troubleshoot. We have about 150 APs on our controller. Looked into Cacti and PRTG, but they don't seem to be able generate notifications for the subordinate &quot;objects&quot;. I have looked into Zabbix, but haven't been able to spend the time to learn it yet. Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="15924" LastActivityDate="2015-06-11T19:50:34.340" Title="What is the best way to monitor individual APs on an Cisco 5508 WLC?" Tags="|cisco|monitoring|wlc|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19148" PostTypeId="2" ParentId="19146" CreationDate="2015-06-11T17:03:54.913" Score="1" Body="&lt;p&gt;If you're open to a commercial solution, SolarWinds has a fairly good wireless monitoring portion in its Network Performance Monitor product that includes a pre-built alert for thin AP's going down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some information on its wireless monitoring is &lt;a href=&quot;http://www.solarwinds.com/solutions/wireless-network-monitor.aspx&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15926" LastActivityDate="2015-06-11T17:03:54.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19149" PostTypeId="1" AcceptedAnswerId="19154" CreationDate="2015-06-11T17:08:58.440" Score="3" ViewCount="6215" Body="&lt;p&gt;0&#xA;down vote&#xA;favorite&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok, I was trying to connect routers in a parallel topology , as shown in the figure&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jxZE7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've configured the IP addresses for the fast Ethernet and serial interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the static IP routes for each router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router-1 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20.0.0.0/8 via 192.168.1.2&#xA;30.0.0.0/8 via 192.168.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router-2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.0/8 via 192.168.2.2&#xA;30.0.0.0/8 via 192.168.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router-3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.0/8 via 192.168.3.2&#xA;20.0.0.0/8 via 192.168.3.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for the Router 0 my static IP routes are&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.0/8 via 192.168.1.1&#xA;20.0.0.0/8 via 192.168.2.1&#xA;30.0.0.0/8 via 192.168.3.1&#xA;192.168.1.0/24 via 192.168.1.1&#xA;192.168.2.0/24 via 192.168.2.1&#xA;192.168.3.0/24 via 192.168.3.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this I had configured the IP , mask and default Gateway for the PC's .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I try to send the packet from PC0-&gt;PC1 and hence all the other combinations of 2 PC's. And I get packet Failed in the PDU list window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where am I going wrong ? How can I successfully send packets from PC's to PC's ?&lt;/p&gt;&#xA;" OwnerUserId="15927" LastEditorUserId="33" LastEditDate="2015-06-11T19:51:50.077" LastActivityDate="2023-03-30T22:28:02.083" Title="Packets failed to send to destination in static routing for parallel router topology in Cisco packet tracer" Tags="|cisco|routing|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19150" PostTypeId="2" ParentId="18504" CreationDate="2015-06-11T17:18:23.953" Score="1" Body="&lt;p&gt;I suspect you have two separate problems:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A: You have accidentally put 3 ports into the same Port-Channel interface&#xA;B: One or more of the three is configured to auto-negotiate speed/duplex and one or more of the three is hard set speed/duplex at the other end with negotiation disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This causes negotiation to fail so the switch reverts to half-duplex.  If both ends are set to auto-negotiate, my next question is if the problem switch is also connected to a Cisco switch on the other side.  If it is not, Cisco has a protocol turned on by default that can foil speed/duplex negotiation with non-Cisco equipment and is generally the reason people hard set links.  Cisco by default uses a protocol called DTP to try to determine if the link is a trunk or not on the switch it is talking to.  DTP can confuse speed/duplex negotiation with non-Cisco gear and results in people hard setting speed/duplex settings when they don't have to.  Since I have no need for DTP in my networks, I turn it off with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;switchport nonegotiate (which is sort of confusing because it has NOTHING to do with speed/duplex negotiation and only turns off DTP TRUNK negotiation) and when you turn that off, suddenly you find that speed/duplex negotiation suddenly starts working rock solid where it used to fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DTP was created so that I could take an unconfigured Cisco switch right out of the shipping box, plug it in to a trunk port on an existing switch, and it would learn it was plugged into a trunk port and set itself accordingly.  If you do not need that feature, turn it off as it intermittently breaks speed/duplex negotiation in random ways when inter-operating with non-Cisco gear (or NICs on edge devices).&lt;/p&gt;&#xA;" OwnerUserId="15910" LastActivityDate="2015-06-11T17:18:23.953" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19151" PostTypeId="2" ParentId="18978" CreationDate="2015-06-11T17:49:57.463" Score="6" Body="&lt;p&gt;The ifCounterDiscontinuityTime is triggered when interfaces are dynamically removed from a device and then that same interface is dynamically re-added. I tested this using a loopback interface but I believe the behavior would be the same for modular interface whose existence would change based on whether or not the module was present. The steps to reproduce this are below and there is some further reading on this topic in the RFC here: &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2863#section-3.1.5&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2863#section-3.1.5&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;1. Create loopback 100 and find it's ifindex&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;router1#conf t&#xA;router1(config)#int loopback100&#xA;router1(config-if)#end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;pre&gt;&lt;code&gt;[user@host logs]$ snmpwalk -v 2c -c $COMMUNITY router1 .1.3.6.1.2.1.2.2.1.2 | grep Loopback&#xA;IF-MIB::ifDescr.67 = STRING: Loopback100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;2. Check the current value of ifCounterDiscontinuityTime for Loopback100&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[user@host logs]$ snmpwalk -v 2c -c $COMMUNITY router1 1.3.6.1.2.1.31.1.1.1.19.67&#xA;IF-MIB::ifCounterDiscontinuityTime.67 = Timeticks: (0) 0:00:00.00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;3. Remove Loopback100 and check the value of ifCounterDiscontinuityTime&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;router1(config)#no int loopback 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;hr /&gt;&#xA;&lt;pre&gt;&lt;code&gt;[user@host logs]$ snmpwalk -v 2c -c $COMMUNITY router1 1.3.6.1.2.1.31.1.1.1.19.67&#xA;IF-MIB::ifCounterDiscontinuityTime.67 = No Such Instance currently exists at this OID&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;4. Re-add Loopback100 and check the value of ifCounterDiscontinuityTime&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;router1(config)#int loopback 100&#xA;&#xA;[user@host logs]$ snmpwalk -v 2c -c $COMMUNITY router1 1.3.6.1.2.1.31.1.1.1.19.67&#xA;IF-MIB::ifCounterDiscontinuityTime.67 = Timeticks: (111308186) 12 days, 21:11:21.86&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10323" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-06-11T17:49:57.463" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19153" PostTypeId="2" ParentId="19146" CreationDate="2015-06-11T19:50:34.340" Score="2" Body="&lt;p&gt;As @Mike Pennington suggested, &lt;strong&gt;Cisco Prime&lt;/strong&gt; would be the best all-around-solution for monitoring Cisco LWAPs connected to Wireless LAN Controllers as you gain much more than just a simple ping alert mechanism.  &lt;strong&gt;Wireless requires a systemic view&lt;/strong&gt; that considers not only individual APs going up and down -- and any good wireless deployment has allowances for that to prevent a single AP being so disruptive to the system -- but includes the ability to see AP coverage and overlap as well as interference.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since wireless is inherently a dynamic system responding to environmental changes -- bodies moving about, different reflections of signals from static objects moved on occasion, and AP power adjustments from detection of surrounding friendly or rogue APs -- you need a platform that deals with all this (as the WLCs do) and a network management system that shows you this system view with the ability to alert when issues arise.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-06-11T19:50:34.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19154" PostTypeId="2" ParentId="19149" CreationDate="2015-06-11T19:53:12.047" Score="4" Body="&lt;p&gt;The default gateway of each PC needs to be the same as the subnet router port IP in its network.  So the subnet router port in the first network would have the address 10.0.0.1 and the PC would have 10.0.0.2 and the default gateway would point to 10.0.0.1.  This tells the PC &quot;when I have a packet that must go to a destination that is not on my own network, send it to 10.0.0.1, and that device will know what to do with it&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;default gateway&quot; is really just a route to 0.0.0.0/0 which means &quot;the rest of the IP address space that I don't have a more specific route for&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, you can eliminate the routes on the subnet routers, too, and just give them a default gateway to the central router.  So instead of having a route to 20/8 and 30/8 on the subnet routers, you could just put a route to 0.0.0.0/0 pointing to 192.168.1.2 on the first router, 192.168.2.2 on the second one, and 192.168.3.2 on the third.  The only router that needs to know explicitly how to reach any of the 10.x.x.x routes is the central router at the top of your diagram.  All of the rest can just have default routes.&lt;/p&gt;&#xA;" OwnerUserId="15910" LastEditorUserId="15910" LastEditDate="2015-06-11T19:58:19.717" LastActivityDate="2015-06-11T19:58:19.717" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19155" PostTypeId="2" ParentId="18949" CreationDate="2015-06-11T20:57:43.713" Score="2" Body="&lt;p&gt;Chapter 5 of the manual &lt;a href=&quot;http://dl.ubnt.com/guides/edgemax/EdgeOS_UG.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; should get you started. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you want to do is: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Allow traffic from your admin computers to anywhere in 10.0.0.0/8&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Deny all traffic from 10.0.0.0/8 to 10.0.0.0/8&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Permit all traffic to 0.0.0.0/0  (assuming those other vlans are allowed to reach the Internet).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Rules are processed in order and the first rule they hit will be the effective one so your management computers will &quot;hit&quot; the first rule and be allowed.  Other computers trying to reach other vlans will &quot;hit&quot; the second rule.  Traffic that is not destined to other vlans (source and destination not both within 10.0.0.0/8) will be allowed (internet traffic). &lt;/p&gt;&#xA;" OwnerUserId="15910" LastEditorUserId="3191" LastEditDate="2015-06-11T21:14:59.993" LastActivityDate="2015-06-11T21:14:59.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19158" PostTypeId="2" ParentId="19138" CreationDate="2015-06-11T21:54:19.677" Score="3" Body="&lt;p&gt;Cisco v1 MIBs import the definition of &lt;code&gt;TimeTicks&lt;/code&gt; from RFC1155-SMI. This mib is part of standard snmp utils (i.e. not included in the Cisco mib tarballs). Within RFC1155-SMI, &lt;code&gt;TimeTicks&lt;/code&gt; is defined as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   TimeTicks ::=&#xA;       [APPLICATION 3]&#xA;           IMPLICIT INTEGER (0..4294967295)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-11T21:54:19.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19161" PostTypeId="2" ParentId="17827" CreationDate="2015-06-12T02:17:23.730" Score="3" Body="&lt;p&gt;It is to prevent routing loops due to bad practice or configuration errors.  Example:  Jackweasel.COM is single-homed to some transit provider Victim.NET who has assigned them a private ASN, say 65000.  Someone at Jackweasel.COM decides to initiate a peering session with Clueless.ORG who has a public ASN, and has agreed to peer with Jackweasel using the private ASN that Jackweasel has (it would surprise you how many people would not notice off that bat that they are setting up a peering session with someone who is using a private ASN and might also peer with someone else).  Now Jackweasel announces routes learned from Clueles to Victim.  Victim will now keep that full path in its route announcements to prevent a loop just like it does with regular BGP announcements using public ASNs.  Basically it is a matter of &quot;someone is multihomed with a private ASN so I now have to treat the path the same as I do with public ASNs to prevent routing loops in other networks&quot;.  It also might break connectivity to the announced routes for everyone else on the planet using that same private ASN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also be surprised at how many people accept routes with their own ASN because their network is not fully meshed.  They have a colo in Virginia and one in California and they are each announcing a different /24 using the same ASN so they allow announcements carrying their own ASN to be installed so the two colos can talk to each other.  But it also helps protect the Jackweasel who did this because they now see THEIR own private ASN in route announcements from Clueless (and who knows how many other peers they might have set up that way) that they sent to Victim.&lt;/p&gt;&#xA;" OwnerUserId="15910" LastActivityDate="2015-06-12T02:17:23.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19162" PostTypeId="2" ParentId="17997" CreationDate="2015-06-12T03:15:43.833" Score="1" Body="&lt;p&gt;You can configure a Palo Alto Networks firewall to fail over to the other ISP.  You need to set up two sets of NATs -- one for one ISP and one for the other -- or set two DMZs, one for one ISP and one for the other (or overlay two subnets on one interface).  It will use both for inbound and will fail over to the second for outbound when one fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can start &lt;a href=&quot;https://live.paloaltonetworks.com/docs/DOC-3579&quot; rel=&quot;nofollow&quot;&gt;reading here&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="15910" LastEditorUserId="15910" LastEditDate="2015-06-12T03:24:27.263" LastActivityDate="2015-06-12T03:24:27.263" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="19163" PostTypeId="2" ParentId="19029" CreationDate="2015-06-12T04:35:04.473" Score="1" Body="&lt;p&gt;When configure Static Routing and you want to access the internet from your VLANs, on the above configuration PC1 is connected to VLAN100 and give a static ip with a default-gateway VLAN IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure DNS-server to that VLAN with your router default-gateway will solve the problem and now access the internet.&lt;/p&gt;&#xA;" OwnerUserId="15845" LastActivityDate="2015-06-12T04:35:04.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19164" PostTypeId="2" ParentId="6831" CreationDate="2015-06-12T07:24:01.260" Score="0" Body="&lt;p&gt;To have the two routes from the two sites be installed simultaneously in remotes sites, the typical solution for MPLS VPNs is to use distinct Route Distinguishers on the PEs attaching your site. This is a way to have the BGP subsystem consider the two routes distinct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use distinct &lt;code&gt;as:number&lt;/code&gt; RDs, or you can use &lt;code&gt;PE-loopback:local-id&lt;/code&gt; RDs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do the latter, on JunOS, you can let JunOS automatically assign a &lt;code&gt;PE-loopback:local-id&lt;/code&gt; RD, by simply specifying &lt;code&gt;route-distinguisher-id 1.2.3.4&lt;/code&gt; under &lt;code&gt;routing-options&lt;/code&gt; in the global config (with 1.2.3.4 your PE loopback), and not specify &lt;code&gt;route-distinguisher&lt;/code&gt; in the routing instances configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Another way is to enable add path extension, but for MPLS VPNs, using distinct RDs is simpler)&lt;/p&gt;&#xA;" OwnerUserId="513" LastActivityDate="2015-06-12T07:24:01.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19165" PostTypeId="2" ParentId="17827" CreationDate="2015-06-12T07:48:55.847" Score="1" Body="&lt;p&gt;You can override the path loop protection (on Cisco this would be the &lt;code&gt;neighbor ... allowas-in X&lt;/code&gt; command). &lt;code&gt;X&lt;/code&gt; stands for the number of times your own AS is allowed in the path. So if you strip private AS from the path the eBGP neighbor may not see it's own AS (when it is a private AS) and there would be an unrestricted loop.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2015-06-12T07:48:55.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19166" PostTypeId="1" AcceptedAnswerId="19170" CreationDate="2015-06-12T11:17:47.613" Score="1" ViewCount="556" Body="&lt;p&gt;I need to design a network. I'm a newbie and going step-by-step. Let me briefly explain my little &quot;project&quot; to you: I'm designing a network to a company. This company has two offices at two distant cities and leased a serial line to connect these two. The network administrator is given an IP 10.1.1.0/24. The network is needed to design to follow these specifications:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- The company's headquarters should have two different sub-networks with 30 hosts  capacity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- The branch office should have 14 hosts capacity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3- The leased serial line should have 2 IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4- The internet should be provided from the HQ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5- A hardware firewall with no routing ability should be installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6- RIPv2 should be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, I have learned how to use VLSM and given the IP addresses to the hosts. I guess now I should move into the physical topology, however I have no information about how to design such a network. Where to start, or where to look into for these information? Thanks for all your help.&lt;/p&gt;&#xA;" OwnerUserId="15861" LastActivityDate="2015-06-12T14:19:19.720" Title="How to design a physical topology?" Tags="|routing|router|ipv4|firewall|subnet|" AnswerCount="1" CommentCount="7" ClosedDate="2015-06-13T11:49:21.090" ContentLicense="CC BY-SA 3.0" />
  <row Id="19167" PostTypeId="1" AcceptedAnswerId="19244" CreationDate="2015-06-12T11:47:52.957" Score="5" ViewCount="1323" Body="&lt;p&gt;If I poll over SNMP for example Cisco IOS interface &lt;code&gt;ifHCInOctets&lt;/code&gt; counter and last reading is lower than previous reading, then I know that either the device has reloaded, &lt;code&gt;ifHCInOctets&lt;/code&gt; counter has wrapped, there was an online hardware insertion/removal(OIR) which affected this particular interface or interface was deleted and recreated(this is possible in case of VLAN interface, Port-Channel interface, etc). Now I would like to distinguish between router reload and all those other possibilities for &lt;code&gt;ifHCInOctets&lt;/code&gt; to start from zero. At first &lt;code&gt;snmpEngineTime&lt;/code&gt;(range 0 - 2147483647 according to Cisco SNMP object navigator) seemed to be a perfect solution as this counter wraps after 68 years, but it also starts from zero if SNMP agent is restarted, i.e. stopped(&lt;code&gt;no snmp-server&lt;/code&gt;) and started(&lt;code&gt;snmp-server community public RO&lt;/code&gt;). This means that one still needs to check &lt;code&gt;sysUpTime&lt;/code&gt;, which as far as I know, starts from zero &lt;strong&gt;only&lt;/strong&gt; in case system is restarted, but unfortunately wraps after every 497 days. This means that simple algorithm seen below would not work if &lt;code&gt;sysUpTime&lt;/code&gt; wraps between the same checks when &lt;code&gt;ifHCInOctets&lt;/code&gt; becomes zero:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if (( prev_ifHCInOctets &amp;gt; cur_ifHCInOctets )); then&#xA;  if (( prev_sysUpTime &amp;gt; cur_sysUpTime )); then&#xA;    echo &quot;router reloaded&quot;&#xA;  else&#xA;    echo &quot;counter wrapped, OIR or interface recreated&quot;&#xA;  fi&#xA;fi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It would be perfection itself if there is a &quot;&lt;code&gt;sysUpHCTime&lt;/code&gt;&quot; counter, but looks like there is not. What options do I have? I guess one possibility is simply to ignore this highly unlikely situation where both &lt;code&gt;cur_ifHCInOctets&lt;/code&gt;(current reading of &lt;code&gt;ifHCInOctets&lt;/code&gt; counter) and &lt;code&gt;cur_sysUpTime&lt;/code&gt;(current reading of &lt;code&gt;sysUpTime&lt;/code&gt; counter) are smaller than previous readings because both counters wrapped within the same polling interval. However, just out of interest, what would be the options here? I guess at least one possible option is not to check if &lt;code&gt;prev_sysUpTime &amp;gt; cur_sysUpTime&lt;/code&gt;, but to check if delta between &lt;code&gt;prev_sysUpTime&lt;/code&gt; and &lt;code&gt;cur_sysUpTime&lt;/code&gt; is roughly equivalent to script check interval? I mean for example let's imagine a situation where &lt;code&gt;prev_sysUpTime&lt;/code&gt; variable was 42949500 and script knows that it got this value 300 seconds ago. Now the &lt;code&gt;cur_sysUpTime&lt;/code&gt; read by script is 128. As a next step script checks if &lt;code&gt;cur_sysUpTime&lt;/code&gt;+(42949672-&lt;code&gt;prev_sysUpTime&lt;/code&gt;) is around 300(for example within range 295 - 305) and if it is, then it is 100% sure that &lt;code&gt;sysUpTime&lt;/code&gt; started from zero because of counter wrap and not because device reload. 42949672 used in this formula is the maximum value of SNMP &lt;code&gt;sysUpTime&lt;/code&gt; counter if milliseconds are not included, i.e. maximum value of SNMP &lt;code&gt;sysUpTime&lt;/code&gt; is 2^32, but last two digits represent milliseconds so for example 4294967296 is 42949672 seconds(about 497 days) and 96 milliseconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for the long post and please let me know if anything is unclear.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="3620" LastEditDate="2015-06-18T06:49:10.667" LastActivityDate="2015-06-18T06:49:10.667" Title="Distinguish between router reload and &quot;sysUpTime&quot; SNMP counter wrap" Tags="|cisco-ios|snmp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19168" PostTypeId="2" ParentId="16611" CreationDate="2015-06-12T13:43:13.960" Score="0" Body="&lt;p&gt;If I understand what you're asking correctly...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) get the IP for the router interface that faces the switch: &lt;code&gt;sh ip int brief&lt;/code&gt; or on some models &lt;code&gt;sh int ip brief&lt;/code&gt; eg: lets say the IP is 10.0.0.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) connect to the switch, and: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;int fa0/7&#xA;ip address 10.0.0.254 255.255.255.0 ; use any unused IP in your network&#xA;exit&#xA;ip default-gateway 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) now apply the same 10.0.0.1 IP as the default gateway on your PCs&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-06-12T13:43:13.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19170" PostTypeId="2" ParentId="19166" CreationDate="2015-06-12T14:19:19.720" Score="0" Body="&lt;p&gt;1) Two VLANs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; /27 is 30 IPs, less one for the gw IP&#xA;vlan10: 192.168.0.0/27&#xA;vlan 20: 192.168.0.32/27&#xA;192.168.0.64/26 (192.168.0.64-128)(unused, reserved for future use in HQ or elsewhere)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) Single network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; /28 is 14 IPs, less one for the gw IP&#xA;&#xA;192.168.0.224/28&#xA;192.168.0.240/28 (1928.168.240-256)(unused, reserved for future expansion)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) Point-to-Point link&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HQ end: 192.168.254.253/30&#xA;Remote end: 192.168.254.254/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4) Route Internet through HQ&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HQ router redistributes 0.0.0.0 0.0.0.0 in RIP to remote&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;5) Firewall&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Install a firewall in bridged/transparent mode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;6) RIPv2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HQ advertises 192.168.0.0/26 and 0.0.0.0/0 to Remote over PtP link&#xA;Remote advertises 192.168.0.224/28 (expand to /27 if you use the expansion block) to HQ over serial link&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's a quick and dirty physical map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      Internet&#xA;         |&#xA;         |&#xA;     inline fw&#xA;         |&#xA;         |&#xA;       router~~~~~ serial ptp ~~~~~ remote router&#xA;         |                               |&#xA;         |&amp;lt;- trunks vlan 10,20           |&#xA;         |                               |&#xA;         |                               |&#xA;     48port sw                    24 port sw, no vlans&#xA;     |       |&#xA;     |       |&#xA;     |       | &amp;lt;-vlan 10 access ports&#xA;     |&#xA;     |&amp;lt;-vlan 20 access ports&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-06-12T14:19:19.720" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19172" PostTypeId="2" ParentId="9618" CreationDate="2015-06-12T17:07:15.800" Score="5" Body="&lt;p&gt;This is for Cisco but I would imagine it applies to others as well:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Whenever there is a change in the routing policy, the BGP session must&#xA;  be reset (cleared) for the new policy to take effect and the routing&#xA;  table to be reconfigured. Using a hard reset to clear a BGP session&#xA;  causes cache invalidation and results in a negative impact on network&#xA;  operation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Soft reset is recommended because it allows routing table policies to&#xA;  be reconfigured and activated without clearing the BGP session. Soft&#xA;  reset is done on a per-neighbor basis. Soft resets can be inbound or&#xA;  outbound:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But the same document also says:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This feature provides an additional method for soft reset that allows&#xA;  the dynamic exchange of route refresh requests and routing information&#xA;  between BGP routers, and the subsequent re-advertisement of the&#xA;  respective outbound routing table. Soft reset using the route refresh&#xA;  capability does not require preconfiguration and consumes no&#xA;  additional memory resources.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;To use this new method, both BGP peers must support the soft route&lt;/strong&gt;&#xA;  &lt;strong&gt;refresh capability, which is advertised in the OPEN message&lt;/strong&gt; sent when&#xA;  a peer sends its routing table update.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since you say you see no capabilities, there is no &quot;route refresh&quot; capability being advertised so there is no choice but to reset the BGP session in order to effect the change in routing policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;References:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/en/US/products/ps6599/products_data_sheet09186a0080087b3a.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco soft reset enhancement&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.bgp4.as/bgp-capability-codes&quot; rel=&quot;noreferrer&quot;&gt;BGP Capability Codes&lt;/a&gt; (see codes 2 and 70)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15910" LastEditorUserId="15910" LastEditDate="2015-06-12T17:13:42.420" LastActivityDate="2015-06-12T17:13:42.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19173" PostTypeId="2" ParentId="7762" CreationDate="2015-06-12T17:51:58.950" Score="2" Body="&lt;p&gt;Brocade with their VDX line of ethernet switching gear uses it.  But the thing to keep in mind is that different vendors implement TRILL in different ways and they don't necessarily interoperate. The standard is so loose that two vendor versions can claim to be standards compliant but be completely incompatible.&lt;/p&gt;&#xA;" OwnerUserId="15910" LastActivityDate="2015-06-12T17:51:58.950" CommentCount="0" CommunityOwnedDate="2015-06-12T17:51:58.950" ContentLicense="CC BY-SA 3.0" />
  <row Id="19175" PostTypeId="1" CreationDate="2015-06-12T20:45:17.693" Score="2" ViewCount="518" Body="&lt;p&gt;I'm very inexperienced in networking, so please pardon any idiocy. We are mechanical engineers trying to connect weird hardware that talks on Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a device A that can only send UDP broadcast packets.&#xA;We have a device B that cannot read UDP broadcast packets. (Due to a silly firmware limitation...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our current workaround is to have device B set its IP address to 255.255.255.255, so it will read UDP broadcast packets as it thinks it is unicast to itself. We are in the process of adding new devices to the network, and would like to not have this hack, as we are afraid it will cause problems down the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So: Is there a way to copy a UDP broadcast packet to a UDP unicast packet to a selected IP address? We still want to be able to read the broadcast from other devices on the network. What kind of latency could we expect from something like this? We would be worried about anything greater than 1ms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other ideas/suggestions/thoughts would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="15944" LastEditorUserId="8499" LastEditDate="2018-03-19T19:14:40.333" LastActivityDate="2018-03-19T19:14:40.333" Title="'Copying' UDP Broadcast to Specific IP Address?" Tags="|ethernet|ipv4|ip-address|udp|broadcast|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19176" PostTypeId="2" ParentId="19115" CreationDate="2015-06-12T21:00:59.450" Score="-1" Body="&lt;p&gt;Sound's like a layer 1 problem as pointed out by mrlayance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking into consideration one of the switchports isn't faulty, try a Cat5E or Cat6 cross-over cable between the two switches. &#xA;Then try these commands on the trunk interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;int gi0/x&#xA;shut&#xA;no mdix auto&#xA;speed 1000&#xA;duplex full&#xA;switchport nonegotiate&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These links should assist you further:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://learningnetwork.cisco.com/thread/21541&quot; rel=&quot;nofollow&quot;&gt;https://learningnetwork.cisco.com/thread/21541&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://cciepursuit.wordpress.com/2007/07/08/switch-cabling-and-auto-mdix/&quot; rel=&quot;nofollow&quot;&gt;https://cciepursuit.wordpress.com/2007/07/08/switch-cabling-and-auto-mdix/&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="8499" LastEditDate="2015-07-11T22:05:03.047" LastActivityDate="2015-07-11T22:05:03.047" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19178" PostTypeId="2" ParentId="19167" CreationDate="2015-06-12T21:58:01.177" Score="2" Body="&lt;p&gt;What you want is the SNMP equiv of: &lt;code&gt;System restarted at 15:12:52 EDT Wed Jun 3 2015&lt;/code&gt; from &lt;code&gt;show hardware&lt;/code&gt;. However, I am unaware of any MIB exporting that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option would be tracking the syslog message counts. I don't know which routers actually support that; my 3745 running 12.4T doesn't.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-12T21:58:01.177" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19179" PostTypeId="2" ParentId="19175" CreationDate="2015-06-12T22:14:40.677" Score="1" Body="&lt;p&gt;(If it lets you set the address to &quot;all-ones&quot;, it is, &lt;em&gt;indeed&lt;/em&gt;, broken.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need is an application taking the broadcast frames and forwarding them as unicast to whatever needs it. No router or switch will do this in the manner you need. (Cisco's &quot;helper address&quot; might work for one device, but not for 2+)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-12T22:14:40.677" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19180" PostTypeId="2" ParentId="13563" CreationDate="2015-06-13T04:49:40.350" Score="2" Body="&lt;p&gt;Generally an IP address conflict is logged.  Do &quot;show log&quot;.  You will see something like &lt;code&gt;Duplicate address 10.25.32.15 on Vlan25 sourced by 0011.2233.4455&lt;/code&gt; and there will be another message with the other mac address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you show the mac address-table to see what port that mac address is connected to. ( &lt;code&gt;show mac-address-table address 0011.2233.4455&lt;/code&gt; )&lt;/p&gt;&#xA;" OwnerUserId="15910" LastEditorUserId="775" LastEditDate="2015-06-13T06:26:10.367" LastActivityDate="2015-06-13T06:26:10.367" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19181" PostTypeId="1" AcceptedAnswerId="19218" CreationDate="2015-06-13T05:09:25.033" Score="3" ViewCount="4423" Body="&lt;p&gt;JUNOS has functions for either limiting the number of mac addresses on a port or locking a port to particular mac addresses. I know that I can set filters as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@switch# set interface all allowed-mac 00:05:85:3A:82:80&#xA;user@switch# set interface all allowed-mac 00:05:85:3A:82:81&#xA;user@switch# set interface all allowed-mac 00:05:85:3A:82:83&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But how can I list these via a show command? &lt;/p&gt;&#xA;" OwnerUserId="4051" LastActivityDate="2015-06-15T14:00:52.257" Title="How can I view a list of which MACs an interface is restricted to on a Juniper SRX?" Tags="|router|juniper-junos|juniper-srx|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19182" PostTypeId="2" ParentId="6376" CreationDate="2015-06-13T05:27:31.203" Score="3" Body="&lt;p&gt;I can't figure out why you are running two instances of OSPF on the the 2900's. This looks way more complicated than it needs to be.  You can run OSPF in passive mode on the firewall and distribute a default route from the 2900's.  You put a static route on the 2900's for your /24 pointed at your firewall outside IP.  Since this is active/standby, if the firewall fails over, the IP address moves with the active firewall.  There really is no need to announce anything from the firewall, it is just listening for a default.  If you are announcing a default, there is really no need for HSRP either, that can go away.  The firewall will just send the traffic to where it hears the default.  It might well load balance to both 2900's, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems you are making it a lot more complicated than it needs to be.  There is only ONE firewall address in this configuration so a static route will work just fine.  Even so, there is no need for more than one OSPF instance and the only thing you are using that for is to handle the case where a router dies.  Then the firewall uses the remaining path where it hears the remaining default route.&lt;/p&gt;&#xA;" OwnerUserId="15910" LastActivityDate="2015-06-13T05:27:31.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19184" PostTypeId="2" ParentId="19175" CreationDate="2015-06-13T07:00:16.970" Score="2" Body="&lt;p&gt;There are many switches / routers that have a &quot;helper&quot; feature that will forward UDP packets. On &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos12.3/topics/reference/configuration-statement/port-edit-forwarding-options-helpers.html&quot; rel=&quot;nofollow&quot;&gt;Juniper EX switches&lt;/a&gt; for example you have &lt;code&gt;forwarding-options helpers&lt;/code&gt; statement which is able to forward broadcast packets to other addresses. Still, you have only one address to forward when not doing bootp/dhcp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has something like this with the &lt;code&gt;ip helper&lt;/code&gt; feature but the last time I saw that it was limited to bootp/dhcp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are probably other Vendors which have gear that has similar features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you find a good reseller/partner they might let you try it out before buying.&lt;/p&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2015-06-13T08:05:20.707" LastActivityDate="2015-06-13T08:05:20.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19188" PostTypeId="2" ParentId="18440" CreationDate="2015-06-13T17:06:08.517" Score="0" Body="&lt;p&gt;Ideally, you want each etherchannel to span 2 separate switches on each end and you want each closet to home run to the pair of MDF/core switches.  A pair of UPS/power source in each closet.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-13T17:06:08.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19192" PostTypeId="2" ParentId="18838" CreationDate="2015-06-13T19:21:51.903" Score="0" Body="&lt;p&gt;To answer the first question of the OP: there are no advantages to the AR scenario. On the contrary, the routing is misconfigured (I agree with Ron) but will get corrected by ICMP messages on session setup.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make it right in the second diagram, the route to the remote LAN should specify the WAN router as gateway, and should be present on each host or server which needs access to the remote LAN. As this involves a lot of effort the first scenario is preferable, with the route to the remote LAN in a central place.&lt;br&gt;&#xA;Firewall newer than, say, 10 years are of the stateful kind, and for good reasons.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2015-06-13T19:21:51.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19193" PostTypeId="1" AcceptedAnswerId="19197" CreationDate="2015-06-13T20:56:59.703" Score="1" ViewCount="1298" Body="&lt;p&gt;I'm reading Cisco CCENT/CCNA guide for Interconnecting Cisco Network Devices 1 100-101 (Odem)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chapter 6 explains that Campus LAN with 2 Distribution Switches and 40 Access switches uses 4 * 40 = 160 cables, but without Distribution Switches, the Access switches use 780 links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand how they got 780 links. If it's relevant, the 40 access switches connect to 1000 PCs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been wracking my mind over this .... help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VISvR.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="15960" LastEditorUserId="775" LastEditDate="2015-06-14T02:57:10.400" LastActivityDate="2015-06-14T02:57:10.400" Title="Full-mesh of Access Switches vs. Uplinking to Distribution Switches" Tags="|switch|lan|wan|uplinks|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19194" PostTypeId="1" AcceptedAnswerId="19196" CreationDate="2015-06-13T21:41:21.203" Score="1" ViewCount="2716" Body="&lt;p&gt;I have the native VLAN on my trunk links set to VLAN 10 which is my management VLAN that spans the entire network. We have one WLC and Access Points connected on a trunk link set to native VLAN20 which is the wireless VLAN. I was wondering if I should have all network devices on the same Native VLAN to avoid any mismatch issues for cisco and other protocols that run untagged over the network?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a lot of Apple and L2 devices on the network that would like to utilize protocols wired or wireless.  I have configured mDNS on the WLC but still having issues with basic print jobs.  I was planning on moving the WLC to the VLAN10 but I have read articles that recommend different ways of deploying the controller.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    VLAN 10 - Management&#xA;    VLAN 20 - Wireless&#xA;    VLAN 60 - Hosts&#xA;&#xA;    Router (10.0.1.2) - access port, VLAN 10&#xA;&#xA;    c3750 (10.0.1.1) - you name it we probably got it plugged in&#xA;    wlc (10.0.2.3) - trunk port, native VLAN 20&#xA;&#xA;    ==3 switches on trunk links running back to 10.0.1.1 ==&#xA;    c3750(10.0.1.3) - trunk port, native VLAN 10&#xA;    c3750(10.0.1.4) - trunk port, native VLAN 10&#xA;    c3750(10.0.1.5) - trunk port, native VLAN 10                 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14175" LastEditorUserId="8499" LastEditDate="2018-12-12T05:12:14.130" LastActivityDate="2018-12-12T05:12:14.130" Title="Should I use the same Native VLAN for the management traffic network-wide?" Tags="|cisco|vlan|cisco-ios|network-core|cisco-wireless|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19195" PostTypeId="2" ParentId="12456" CreationDate="2015-06-13T22:09:01.050" Score="4" Body="&lt;p&gt;It will work.  You will get more loss at the splice than if you were splicing like fiber but you can do it.  You can even mix the fiber types in longer runs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference:  &lt;a href=&quot;http://www.sterliteoptical.com/pdf/Knowledgecenter/Mixing%20of%20G655%20and%20G652%20Optical%20Fibers.pdf&quot; rel=&quot;nofollow&quot;&gt;Mixing of G655 and G652 Fibers in a Network&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15910" LastActivityDate="2015-06-13T22:09:01.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19196" PostTypeId="2" ParentId="19194" CreationDate="2015-06-14T00:11:25.117" Score="3" Body="&lt;p&gt;Untagged (native) VLANs don't really offer you any benefit over tagged VLANs, and they present a certain level of security risk.  There is no real reason to use untagged VLANs when tagged VLANs are available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some people prefer to use a network-wide VLAN for management, one for printers, etc.  This scenario presents both security and operational risks.  Cisco has been recommending one access switch per VLAN (an access swtich can have multiple VLANs, but those VLANs don't extend to any other access switch), and, if you can, use layer-3 connections to the access switches instead of trunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a book published by Cisco Press, &quot;LAN Switch Security: What Hackers Know About Your Switches&quot; by Eric Vyncke and Christopher Paggen that explains a lot of these sorts of things.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-06-14T00:11:25.117" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19197" PostTypeId="2" ParentId="19193" CreationDate="2015-06-14T02:53:50.007" Score="4" Body="&lt;p&gt;To calculate the number of links in a fully meshed topology of N devices, the formula is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Full-mesh links = (N)*(N-1)/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Substituting numbers...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                = 40*39/2&#xA;                = 780&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, you'd only have one link to every switch if calculated thusly.  If you assume 4 links per switch, it's technically 4*780, or 3120 uplinks.&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2015-06-14T02:53:50.007" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19201" PostTypeId="1" AcceptedAnswerId="19202" CreationDate="2015-06-14T12:56:13.283" Score="1" ViewCount="220" Body="&lt;p&gt;I recently started to learn how IPv4 works.&#xA;I know how to divide a given address range in smaller ones and set up a network in that way (at least in Netsim K).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I wanted to do a bit of something else. Let's say I have 2 IP addresses, P1 and P2 and a netmask M. How can I determine the smallest range that contains both P1 and P2. &#xA;I can start by doing P1 &amp;amp; M to determine P1's network and P2 &amp;amp; M for P2's. If these networks are the same I should just try to divide that range into smaller ones.&#xA;But what if they are different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I have the netmask: 255.255.192.0 (/18) and the IPs: 193.231.20.17 and 193.230.14.208.&#xA;This gives me: 193.231.0.0 and 193.230.0.0 for the network addresses.&#xA;Doing IP or not netmask gives: 193.231.63.255 and 193.230.63.255 as broadcast addresses. What should I do now? It seems like I did something wrong. But assuming I didn't, should I try to merge 193.230.0.0 / 18 with the above range and so on until I have those 2 IPs in the same network? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: after the answer, here is the way I did this for the above example (just in case someone else stumbles upon this in the future).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;193.230.014.208 and 193.231.020.017 have 15 bits in common.&#xA;In base 2:&#xA;193.11100110.don't care (also, don't care about 193)&#xA;193.11100111. &#xA;This means that the network these 2 share has a /15 netmask. Doing a logical and between any of the addresses and this new netmask will give us the desired network. &lt;/p&gt;&#xA;" OwnerUserId="15965" LastEditorUserId="15965" LastEditDate="2015-06-14T17:32:13.790" LastActivityDate="2015-06-14T17:32:13.790" Title="Determine the minimum address range that contains some given IPs" Tags="|ipv4|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19202" PostTypeId="2" ParentId="19201" CreationDate="2015-06-14T14:23:42.153" Score="0" Body="&lt;p&gt;Remove a bit from the mask (expand the range) and try again to see if you get the same network for both.  Keep doing that until the networks ANDed with the mask are the same.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-06-14T14:23:42.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19203" PostTypeId="1" CreationDate="2015-06-14T14:33:30.517" Score="1" ViewCount="192" Body="&lt;p&gt;I need to create an overlay network with potential of hundreds of servers (each is an hypervisor and running a open vswitch).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm going to use ovswitch and connect each server to all other servers using GRE. Now as I understand connecting all servers and configure spanning tree can be expensive. So my plan is to not use spanning tree, because I already know all the virtual machines running (and their IP, MAC and switch port) I'm going to fill the flow table of each switch will all the possible routes using Openflow or OVSDB (so any not local MAC address will be route to the correct GRE port).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, is there a downside for this approach? (performance issue?) the flow table is going to be populated with all possible routes, is this too expensive? what other downside can be?&lt;/p&gt;&#xA;" OwnerUserId="15964" LastActivityDate="2015-06-14T14:33:30.517" Title="Overlay network with GRE without spanning tree" Tags="|spanning-tree|gre|openflow|" AnswerCount="0" CommentCount="6" ClosedDate="2020-02-06T22:08:19.233" ContentLicense="CC BY-SA 3.0" />
  <row Id="19208" PostTypeId="2" ParentId="510" CreationDate="2015-06-15T04:09:21.000" Score="5" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6286&quot; rel=&quot;nofollow noreferrer&quot;&gt;Autonomous-System-Wide Unique BGP Identifier for BGP-4&lt;/a&gt; answers your question.&#xA;Basically BGP Identifier need only to be unique within your AS since 2011.&lt;/p&gt;&#xA;" OwnerUserId="15972" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-06-15T04:09:21.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19211" PostTypeId="2" ParentId="19181" CreationDate="2015-06-15T05:35:58.390" Score="-2" Body="&lt;p&gt;ctote, i haven't restricted MAC before but you could check in your configuration like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show configuration | display set | match allowed-mac&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That would show all configuration lines with their complete stanza location that has allowed-mac, which in this instance would list all allowed MAC you have configured.&lt;/p&gt;&#xA;" OwnerUserId="15974" LastActivityDate="2015-06-15T05:35:58.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19213" PostTypeId="2" ParentId="17582" CreationDate="2015-06-15T08:06:26.890" Score="0" Body="&lt;p&gt;You may be able to go the the MAC table of the switch that your access points are using. If the MAC address of the device you are seeking shows up on a port that has one of your APs, then you're in luck, and have found the device you're looking for!&lt;/p&gt;&#xA;" OwnerUserId="15698" LastActivityDate="2015-06-15T08:06:26.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19214" PostTypeId="1" AcceptedAnswerId="19216" CreationDate="2015-06-15T09:18:28.050" Score="5" ViewCount="14992" Body="&lt;p&gt;I have a Cisco Router 1900 series and I would like to limit the bandwidth used by a subnet/subinterface. This subnet/subinterface (192.168.10.*) uses most of the bandwidth making it useless for other subnets/subinterfaces and would like to limit their total bandwidth consumption to like 2MB out of whatever total bandwidth we might be assigned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read some resources on Class Based Shaping but not getting the idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont have any certification on Cisco but I learn as I proceed with their range of products.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Awaiting responses.&lt;/p&gt;&#xA;" OwnerUserId="3869" LastEditorUserId="3869" LastEditDate="2015-06-15T09:54:07.447" LastActivityDate="2017-03-30T19:22:24.520" Title="How To Limit a VLAN to a Specific Bandwidth Quota" Tags="|cisco|cisco-ios|management|bandwidth|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19215" PostTypeId="1" CreationDate="2015-06-15T10:26:46.547" Score="2" ViewCount="4413" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QB9l6.jpg&quot; alt=&quot;Different VLAN and unmanaged switch&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to configure a network like shown in above diagram? I want to have 3 VLAN connected a unmanaged switch which is connected to a managed switch. I have created VLANs in this Multilayer switch, but I am not sure about the switchport mode of the connected Ethernet port. &lt;/p&gt;&#xA;" OwnerUserId="15976" LastActivityDate="2015-06-15T19:18:45.930" Title="VLANs with managed and unmanaged switch" Tags="|switch|vlan|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19216" PostTypeId="2" ParentId="19214" CreationDate="2015-06-15T11:06:38.183" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I have a Cisco Router 1900 series and I would like to limit the bandwidth used by a subnet/subinterface. This subnet/subinterface (192.168.10.*) uses most of the bandwidth making it useless for other subnets/subinterfaces and would like to limit their total bandwidth consumption to like 2MB out of whatever total bandwidth we might be assigned.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I will give you a policy that I run myself...  I took the liberty of prioritizing traffic within that 2MB class, since it's a common need once you start limiting the bandwidth of certain people&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First I define a couple of ACL objects:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;Q_CBWFQ_net&lt;/code&gt; is used to define what traffic will be shaped; traffic will match this object if the IP matches either the source or destination address.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Q_LLQ_net&lt;/code&gt; is used to define what traffic will be prioritized into a low latency (i.e. high priority) queue.  Up to 200Kbps of traffic (10% of 2Mbps) will be prioritized like this.  Traffic will match this object if the IP matches either the source or destination address.  &lt;code&gt;Q_LLQ_net&lt;/code&gt; traffic can go above 10% of the circuit with this configuration (subject to not competing with other non-LLQ traffic).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network Q_CBWFQ_net&#xA; 192.168.10.0 /24&#xA;!&#xA;object-group network Q_LLQ_net&#xA; host 198.137.202.19&#xA;!&#xA;!&#xA;ip access-list extended CBWFQ&#xA; permit ip any object-group Q_CBWFQ_net&#xA; permit ip object-group Q_CBWFQ_net any&#xA;ip access-list extended LLQ&#xA; permit ip object-group Q_LLQ_net any&#xA; permit ip any object-group Q_LLQ_net&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I define classes to match against those ACLs...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all C_LLQ&#xA; match access-group name LLQ&#xA;class-map match-all C_CBWFQ&#xA; match access-group name CBWFQ&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&#xA;&#xA;&lt;p&gt;This is where the guts of the policy are implemented...  I use &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5316/how-are-weighted-fair-queuing-and-weighted-random-early-detection-related/5318#5318&quot;&gt;WRED&lt;/a&gt; to manage the non-LLQ traffic.  WRED helps ensure that your shaped traffic behaves well (assuming it is mostly TCP traffic).&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;policy-map Q_CBWFQ_to_inet&#xA; class C_LLQ&#xA;  priority percent 10&#xA; class C_CBWFQ&#xA;  bandwidth remaining percent 90&#xA;  random-detect&#xA;!&#xA;policy-map Q_CBWFQ_from_inet&#xA; class C_LLQ&#xA;  priority percent 10&#xA; class C_CBWFQ&#xA;  bandwidth remaining percent 90&#xA;  random-detect&#xA;!&#xA;policy-map Q_shape_from_inet&#xA; class class-default&#xA;  shape average 2000000&#xA;  service-policy Q_CBWFQ_from_inet&#xA;!&#xA;policy-map Q_shape_to_inet&#xA; class class-default&#xA;  shape average 2000000&#xA;  service-policy Q_CBWFQ_to_inet&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now apply the policies to your ingress and egress interfaces / subinterfaces...&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; description [Interface to LAN, via sw1]&#xA; bandwidth qos-reference 100000&#xA; ip address 10.1.5.5 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; arp timeout 240&#xA; service-policy output Q_shape_from_inet&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA; description [Uplink to internet, via fw]&#xA; bandwidth qos-reference 100000&#xA; ip address 10.1.2.2 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; arp timeout 240&#xA; service-policy output Q_shape_to_inet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please keep in mind that traffic shaping is not exact... you'll get up to 2Mbps for a single TCP flow, but the actual transfer rate could be anywhere between 1.5Mbps and 1.9Mbps at any given point in time.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-06-15T11:24:17.580" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19217" PostTypeId="2" ParentId="19215" CreationDate="2015-06-15T11:55:19.327" Score="1" Body="&lt;p&gt;Sadly, no.  The unmanaged switch doesn't have the ability to create or trunk VLANs (if it did, it would be a managed switch).  It will treat all the PCs as if they were on the same VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it were a mananged switch, you would configure the 3560 port as a trunk port.  But your unmanaged switch will not understand VLAN tagging.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-06-15T11:55:19.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19218" PostTypeId="2" ParentId="19181" CreationDate="2015-06-15T12:51:23.477" Score="6" Body="&lt;p&gt;You can use show &lt;code&gt;ethernet switching table&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is taken from, &lt;a href=&quot;https://www.juniper.net/documentation/en_US/junos12.1/topics/example/layer-2-mac-limit-port-security-configuring.html#jd0e104&quot; rel=&quot;noreferrer&quot;&gt;Configuring MAC Limiting&lt;/a&gt; (Official Juniper Documentation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configure:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit ethernet-switching-options secure-access-port]&#xA;user@host# set interface all allowed-mac 00:05:85:3A:82:80&#xA;user@host# set interface all allowed-mac 00:05:85:3A:82:81&#xA;user@host# set interface all allowed-mac 00:05:85:3A:82:83&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Verify:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@host&amp;gt; show ethernet-switching table&#xA;Ethernet-switching table: 7 entries, 6 learned&#xA;VLAN MAC address Type Age Interfaces&#xA;employee-vlan * Flood - ge-0/0/2.0&#xA;employee-vlan 00:05:85:3A:82:77 Learn 0 ge-0/0/1.0&#xA;employee-vlan 00:05:85:3A:82:79 Learn 0 ge-0/0/1.0&#xA;employee-vlan 00:05:85:3A:82:80 Learn 0 ge-0/0/2.0&#xA;employee-vlan 00:05:85:3A:82:81 Learn 0 ge-0/0/2.0&#xA;employee-vlan 00:05:85:3A:82:83 Learn 0 ge-0/0/2.0&#xA;employee-vlan 00:05:85:3A:82:85 Learn 0 ge-0/0/2.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also too, since you're configuring the MAC's to be allowed on any of the interfaces in that VLAN, if you wanted to know which interface had a specific MAC entry - you'd use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ethernet switching table | match &quot;$mac-address&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously replacing &lt;em&gt;$mac-address&lt;/em&gt; with the appropriate MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to view the configured MAC addresses vs. what is actually being learned (or not learned) by each interface, you would have to use (as @ParlorTricks mentioned):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show configuration | display set | match allowed-mac&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2015-06-15T14:00:52.257" LastActivityDate="2015-06-15T14:00:52.257" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19220" PostTypeId="1" CreationDate="2015-06-15T15:22:42.880" Score="3" ViewCount="9440" Body="&lt;p&gt;Since I'm a noob, I'm unable to post a follow up question on the following question...&#xA;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6483/why-and-how-are-ethernet-vlans-tagged&quot;&gt;Why and how are Ethernet Vlans tagged?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/iA00T.jpg&quot; alt=&quot;Tagged&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my image, I believe I have correctly depicted how tagged networking works, going from the switch to a device.  If v10, v20, and v30 are tagged, then that traffic is allowed to pass through to the client device.  Since, v50 isn't tagged on this port, it's traffic would not be allowed to pass. The client device would, then, determine how to handle the traffic of the different vlans (such as an Access Point that has multiple SSID's for multiple vlans or a Host running virtual computers and the guest computers are on different vlans).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since many devices (such as our home computers) do not (to the best of my limited knowledge) have the ability to apply the 802.1Q tagged header to their traffic (basically setting the computer's network card to where it sends it's traffic using a tagged network, such as the v10, v20, or v30), the traffic coming from the computer would be rejected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/uCLpO.jpg&quot; alt=&quot;Untagged&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this instance, an untagged network is required.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could still pass traffic on the v10, v20, or v30, but it would require that...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.A That the vlan be untagged at the switch (such as v20)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.A The device has the proper IP address (such as 10.0.20.XXX)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OR&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.B The device is able to tag it's traffic (such as a VoIP Phone)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.B The device has the proper IP address (such as 10.0.20.XXX)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/senZw.jpg&quot; alt=&quot;Tagged &amp;amp; Untagged&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this final image, I believe I have depicted how a tagged &amp;amp; untagged switch set up functions correctly.  The switch has 3 tagged and 1 untagged networks.  The host computer's traffic travels on the untagged network (such as acquiring an Auto DHCP, Internet, etc).  The host computer, through user set up, uses the tag within the header to route the traffic correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The guest networks then send their tagged traffic back through to the host server, who then relay's their traffic to the switch.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does this accurately depict (in basic terms) how tagged &amp;amp; untagged traffic works? &lt;/li&gt;&#xA;&lt;li&gt;If this is all true, then how does the host computer send tagged traffic to the switch? Does it...&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A. Send it via the untagged network and the switch routes the tagged traffic accordingly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B. Send it via the tagged network not utilizing the untagged network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If B is correct, then (in this scenario) does the host computer have to have an untagged network for the guest computers to pass traffic?  Could the host computer have no tagged or untagged networks and still be able to pass the tagged traffic from the guest servers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help with this!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kevin&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: The system is requesting that I update this question addressing why this is different than the &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6483/why-and-how-are-ethernet-vlans-tagged&quot;&gt;Why and how are Ethernet Vlans tagged?&lt;/a&gt;.  I would have added a comment to that question, but being a noob I don't have enough reputation points to post on it.  While it does address my questions to some degree, part of this was trying to clarify my understanding and to ask a follow up question.&lt;/p&gt;&#xA;" OwnerUserId="15979" LastEditorUserId="8499" LastEditDate="2019-01-04T06:08:03.677" LastActivityDate="2019-01-04T06:08:03.677" Title="Tagged vs Untagged Question" Tags="|switch|vlan|trunk|" AnswerCount="3" CommentCount="1" ClosedDate="2015-06-16T22:08:11.457" ContentLicense="CC BY-SA 3.0" />
  <row Id="19221" PostTypeId="1" AcceptedAnswerId="19225" CreationDate="2015-06-15T15:41:17.943" Score="4" ViewCount="3823" Body="&lt;p&gt;I'm a beginning learner of DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some days ago I built a authoritative name server. Writing zone files, I had wondered why the right side of a NS record is specified not in an IP address but in a domain name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IP address of the delegated authoritative for next-level domains is eventually provided in the additional section. &#xA;If so, it's straightforward to give the IP address in a NS record directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please tell me reasons.&lt;/p&gt;&#xA;" OwnerUserId="15981" LastActivityDate="2015-06-15T17:12:02.900" Title="Why does a NS record need a domain name, not an IP address?" Tags="|dns|" AnswerCount="1" CommentCount="1" ClosedDate="2015-06-16T10:01:11.673" ContentLicense="CC BY-SA 3.0" />
  <row Id="19222" PostTypeId="2" ParentId="19220" CreationDate="2015-06-15T15:51:15.613" Score="5" Body="&lt;p&gt;Tags are only attached to frames on trunk ports.  Access ports, while members of a VLAN, do not tag frames as they exit the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, end devices are attached to access ports, so they do not receive frames with tags.  There are exceptions to this since some servers can deal with tags and are attached via a trunk port.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-06-15T15:51:15.613" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19223" PostTypeId="2" ParentId="14876" CreationDate="2015-06-15T17:06:56.757" Score="4" Body="&lt;p&gt;&quot;The literatures says that because NA and NB randomly assign external ports anytime their respective clients initiate a new connection (even if the destination address is the same) the external port information that rendezvous server S swaps between its connecting clients is effectively useless.&quot;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Wrong. Most of the cheaper (more commen) symmetric NAT's, like the ones in university networks, are predictable in their port mapping scheme. My university's symmetric NAT always bumps up the port number by 1 for every new connection. See &lt;a href=&quot;http://tools.ietf.org/id/draft-takeda-symmetric-nat-traversal-00.txt&quot; rel=&quot;nofollow&quot;&gt;http://tools.ietf.org/id/draft-takeda-symmetric-nat-traversal-00.txt&lt;/a&gt; for predictive symmetric NAT traversal techniques.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&quot;What i'm wondering is why is it not possible for clients A and B to try the external port information provided by S first and then, if that fails try repeatedly guessing/brute-forcing the external ports.&quot;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It is possible if you like playing the lottery. My JVM can handle over 1000 threads. Each thread can be assigned a UDP socket. If the port mapping it truely random (it appears this way on cell phone towers, but there would likely be a bias toward certain numbers), then in theory you could send 1000 packets from 1000 threads concurrently and then wait on all 1000 of those sockets, listening for a reply. If there are 65535 possible ports, then you have a 1000/65535 chance, or 1.52% chance. Note that some symmetric NAT will change your public IP address if they run out of ports (PAT with Multiple IP Addresses), see &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/26704-nat-faq-00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/26704-nat-faq-00.html&lt;/a&gt;. All in all, given that the symmetric NAT can take up more than 65535 ports (up to 65535 ports per public IP address, but your cell phone tower might have more than 1 ip address), you would have to go through 65535*n ports, where n is the number of IP addresses. And if you do take up that many ports, &quot;If no ports are available, the packet is dropped, unless another IP address is available in the pool.&quot; which would most likely result in a denial of service of everyone using that NAT/router. If you repeatedly tried 1000 ports at a time, you would have to make a mean of 1 / .0152, or 66 attempts on average. If you wait maybe .5 seconds between each attemp, you're looking at 33 seconds to make a connection, on average.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&quot;Is it possible&quot;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Yes, but it is not practical.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15975" LastActivityDate="2015-06-15T17:06:56.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19224" PostTypeId="1" AcceptedAnswerId="19227" CreationDate="2015-06-15T17:10:08.773" Score="2" ViewCount="141" Body="&lt;p&gt;On one of the configs backed up by RANCID, it has switched two lines. Lines 241 and 242, for example, have been swapped. It does this every time the backup is grabbed, and it only happens on this single switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the (brocade) switch itself, the config is correct, both the running config and the boot config.&lt;/p&gt;&#xA;" OwnerUserId="15983" LastActivityDate="2015-06-15T17:38:00.627" Title="RANCID saving config lines out of order" Tags="|switch|brocade|backups|rancid|" AnswerCount="1" CommentCount="0" ClosedDate="2015-06-16T19:35:04.647" ContentLicense="CC BY-SA 3.0" />
  <row Id="19225" PostTypeId="2" ParentId="19221" CreationDate="2015-06-15T17:12:02.900" Score="6" Body="&lt;p&gt;MX, CNAME, PTR, and NS records point to hostnames.  A records point to IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Putting an IP address in an NS record is a pretty common DNS misconfiguration. One reason is that you might have NS records pointing to servers outside of your domain for someone doing secondary DNS for you.  That remote domain might change the IP address of the server (but leave the hostname alone).  &lt;/p&gt;&#xA;" OwnerUserId="15910" LastActivityDate="2015-06-15T17:12:02.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19226" PostTypeId="2" ParentId="19220" CreationDate="2015-06-15T17:37:18.133" Score="1" Body="&lt;p&gt;When an Ethernet frame traverses a trunk link, a special VLAN tag is added to the frame and sent across the trunk link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it arrives at the end of the trunk link the tag is removed and the frame is sent to the correct access link port according to the switch's table, so that the receiving end is unaware of any VLAN information.&lt;/p&gt;&#xA;" OwnerUserId="15943" LastActivityDate="2015-06-15T17:37:18.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19227" PostTypeId="2" ParentId="19224" CreationDate="2015-06-15T17:38:00.627" Score="4" Body="&lt;p&gt;This was due to the ACLSORT option in the RANCID config.&lt;/p&gt;&#xA;" OwnerUserId="15983" LastActivityDate="2015-06-15T17:38:00.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19228" PostTypeId="2" ParentId="18107" CreationDate="2015-06-15T17:53:23.363" Score="2" Body="&lt;p&gt;Yes. Yes it is possible. The network has to be able to handle all the packets (without exceptions - packet loss means death), the machines have to be able to send out packets fast enough, the other end must not have &quot;flooding protection&quot; and the address has to not change every time you open a new connection. This method managed to connect my laptop behind my University's WiFi with my friends laptop behind his WiFi and it sent a packet from my home WiFi through my University's symmetric NAT. If you're using a phone, you should probably send packets as fast as possible because phones are slow but with laptops you can synchronize the barrage of UDP packets with Thread.sleep()&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/**&#xA; * Shoots empty UDP packets at every port between &quot;start&quot; and &quot;end&quot;.&#xA; */&#xA;public static void sendBarrage(int start, int end, InetAddress target) {&#xA;&#xA;    final ByteBuffer to_send = ByteBuffer.allocate(0);&#xA;&#xA;    // Start at a random value to avoid re-traversing failed paths on repeated attempts.&#xA;    final int starting_point = start + generator.nextInt(end - start);&#xA;&#xA;    // Go from starting_point down to 1024. &#xA;    for (int port = starting_point; port &amp;gt;= start; --port) { &#xA;        try {&#xA;            if (made_connection == false) {&#xA;                myChannel.send(to_send, new InetSocketAddress(target, port));&#xA;            } else {&#xA;                break;&#xA;            }&#xA;        } catch (java.nio.channels.ClosedChannelException cce) {&#xA;            Application.printerr(&quot;Channel closed while on port: &quot; + port);&#xA;            break;&#xA;        } catch (IOException e) {&#xA;            Application.printerr(&quot;Error sending in port: &quot; + port);&#xA;            continue;&#xA;        }&#xA;    }&#xA;&#xA;    // Go from 65535 down to say starting_point, not including starting_point.&#xA;    for (int port = end - 1; port &amp;gt; starting_point; --port) { &#xA;        try {&#xA;            if (made_connection == false) {&#xA;                myChannel.send(to_send, new InetSocketAddress(target, port));&#xA;            } else {&#xA;                break;&#xA;            }&#xA;        } catch (java.nio.channels.ClosedChannelException cce) {&#xA;            Application.printerr(&quot;Channel closed while on port: &quot; + port);&#xA;            break;&#xA;        } catch (IOException e) {&#xA;            Application.printerr(&quot;Error sending in port: &quot; + port);&#xA;            continue;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;^ Make sure you call this method in a loop, it might take a few attempts. Keep in mind that this method does NOT work with cell phone tower networks (unless you get insanely lucky and the public ip address does not change). It might work better if one side holds the port open while the other guesses rather than having them both brute force both sides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if only one side holds the ports open, this method might be good: &lt;a href=&quot;https://www.goto.info.waseda.ac.jp/~wei/file/wei-apan-v10.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.goto.info.waseda.ac.jp/~wei/file/wei-apan-v10.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15975" LastEditorUserId="15975" LastEditDate="2015-06-24T03:20:24.737" LastActivityDate="2015-06-24T03:20:24.737" CommentCount="22" ContentLicense="CC BY-SA 3.0" />
  <row Id="19229" PostTypeId="2" ParentId="19220" CreationDate="2015-06-15T18:31:50.867" Score="2" Body="&lt;p&gt;No, that does not accurately reflect how tagged and untagged traffic works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off, 802.1q VLAN tagging is done on layer 2 in Ethernet frames, so IP addresses have no bearing on the behavior of tagged or untagged frames. Second, tagging is not a system for allowing or denying traffic to or from specific VLANs. A frame should not generally be rejected simply because it has or does not have a tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN tags are only a way for frame to specify what VLAN it is intended for. That's pretty much it (there are other things but let's get the basics down for now).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For an interface that does not process VLAN tags (or has the processing of tags disabled), all frames coming into that interface are considered to be on the same VLAN. For devices that do not understand VLANs, frames coming into any interfaces are just on the one network (VLAN) that the device sees.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For interfaces that do process VLAN tags, the tag tells the interface what VLAN the frame is for. Most of the time, when an interface is configured to process VLAN tags, one of the VLANs available on that interface is configured to be the destination for any frames that do not have a tag. That VLAN is often called the &quot;untagged VLAN&quot;, &quot;default VLAN&quot;, or &quot;native VLAN&quot;. Untagged packets arriving at an interface with a default VLAN configured &lt;em&gt;will be accepted and passed on to that VLAN&lt;/em&gt;. Not having a tag does not necessarily result in the frame being rejected or dropped. Sometimes for security purposes, there will be no default VLAN for an interface, or untagged packets will be explicitly dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, VLANs are not entirely tagged or untagged. Interfaces are configured to use tags on all or all but one of the VLANs available on that interface, but which VLAN frames are tagged can vary from interface to interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose you have two VLANs, VLAN 10 and VLAN 20, one switch that supports tagging, one firewall that supports tagging, and two computers that do not support tagging. On the switch, you can configure port 1 to be on VLAN 10 only with VLAN 10 as the default VLAN, port 2 to be on VLAN 20 only with VLAN 20 to be the default vlan, and port 3 to be on both VLAN 10 and 20 with VLAN 10 as the default VLAN and 802.1q tagging configured for VLAN 20 on port 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you could configure the firewall to have two virtual interfaces on its &quot;inside&quot; port. One virtual interface could be configured untagged and on VLAN 10, and the other virtual interface tagged for VLAN 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plug computer A into port 1 and computer B into port 2. Now when computer A sends a frame to the switch, the switch accepts it on port 1 and therefore knows it's for VLAN 10 and sends it out of port 3 without a VLAN tag. The firewall gets the frame on its &quot;inside&quot; port and since it has no tag, assumes it's for VLAN 10 and processes it using the VLAN 10 virtual interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When computer B sends a frame to the switch, the switch accepts it on port 2 and knows it's for VLAN 20 and sends it out of port 3 &lt;em&gt;with a VLAN tag added to it for VLAN 20&lt;/em&gt;. The firewall gets the frame, sees the tag and knows the frame is for VLAN 20 and therefore processes the frame using the VLAN 20 virtual interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully that clears it up a little bit.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-06-15T18:31:50.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19230" PostTypeId="2" ParentId="19215" CreationDate="2015-06-15T19:18:45.930" Score="1" Body="&lt;p&gt;It depends on the device you have. I know some cheap switches (~10-15 USD), that are &quot;transparent&quot; for vlans. In that case every vlan must be tagged on both sides (managed switch and computer).&lt;/p&gt;&#xA;" OwnerUserId="15977" LastActivityDate="2015-06-15T19:18:45.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19231" PostTypeId="1" CreationDate="2015-06-15T19:23:40.953" Score="2" ViewCount="353" Body="&lt;p&gt;I have an Arista switch (EOS) and I'm having trouble allowing outgoing connection from the switch to the outside. Using tcpdump I can see that no packets are being allowed. This has an impact on DNS resolution, email alerts, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I allow the switch to make external connections?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my current access-list (default):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP Access List default-control-plane-acl [readonly]&#xA;    statistics per-entry&#xA;    10 permit icmp any any&#xA;    20 permit ip any any tracked&#xA;    30 permit udp any any eq bfd ttl eq 255&#xA;    40 permit udp any any eq bfd-echo ttl eq 254&#xA;    50 permit ospf any any&#xA;    60 permit tcp any any eq ssh telnet www snmp bgp https msdp&#xA;    70 permit udp any any eq bootps bootpc snmp rip ntp&#xA;    80 permit tcp any any eq mlag ttl eq 255&#xA;    90 permit udp any any eq mlag ttl eq 255&#xA;    100 permit vrrp any any&#xA;    110 permit ahp any any&#xA;    120 permit pim any any&#xA;    130 permit igmp any any&#xA;    140 permit tcp any any range 5900 5910&#xA;    150 permit tcp any any range 50000 50100&#xA;    160 permit udp any any range 51000 51100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10004" LastEditorUserId="775" LastEditDate="2015-06-16T10:22:34.800" LastActivityDate="2015-06-16T10:22:34.800" Title="Allow outgoing connections" Tags="|switch|troubleshooting|acl|arista|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19232" PostTypeId="2" ParentId="18808" CreationDate="2015-06-15T20:44:57.963" Score="1" Body="&lt;p&gt;There was a missing NAT line in the config, so traffic wasn't properly protected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;:-(&lt;/p&gt;&#xA;" OwnerUserId="15671" LastActivityDate="2015-06-15T20:44:57.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19235" PostTypeId="2" ParentId="19231" CreationDate="2015-06-16T02:30:43.287" Score="-2" Body="&lt;p&gt;&lt;strong&gt;DNS Workaround&lt;/strong&gt;&lt;br&gt;&#xA;ip host mail.example.com 1.1.1.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/nxCoJ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-16T02:30:43.287" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="19236" PostTypeId="2" ParentId="17306" CreationDate="2015-06-16T02:44:39.870" Score="-3" Body="&lt;p&gt;Use a policy routing instead.  Two line to ACL deny any to inside DNS server then allow all else inside.  Set the next hop to the ISP interface's IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Router(config-route-map)# set ip next-hop ip-address [ip-address]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifies the next hop to which the packet will be routed, and the next hop must be an adjacent interface of the next router.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="8499" LastEditDate="2015-06-16T10:01:47.913" LastActivityDate="2015-06-16T10:01:47.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19237" PostTypeId="2" ParentId="17903" CreationDate="2015-06-16T03:19:07.483" Score="1" Body="&lt;p&gt;Networking equipment is not typically stress tested for throughput by end users, rather POST test are done.  Power On Self Test, or burn in's are done.  Basically, you plug in the power supplies and let the things run for 24 or 48 hours.  Interface hw errors typically show themselves immediately upon install.  If there are problems with non-power related hardware, the device will typically simply not function properly.  Most hardware problems are from shipping and most gear is stress tested for throughput at the manufacturing stage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Software can have issues such as memory leaks and bugs which are typically known and documented, provided that you are not running bleeding edge code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, try and run tried and tested code and POST test your gear.  That's what I have seen done in practice.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-16T03:19:07.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19238" PostTypeId="1" CreationDate="2015-06-16T03:58:01.620" Score="2" ViewCount="1769" Body="&lt;p&gt;This question is regarding RSSI. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, my understanding is that the RSSI is measured after reception at the antenna and after the ADC (analog to digital converter) and after the Low Noise Amplifier at the receiver. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When calculating RSSI, do we divide by the gain of the amplifier and the gain of the antenna?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;lets take an example, if an Access Point sent a packet to a Station, the stations performs RSSI measurement, is it fed back to the AP, or what is used for&#xA;?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Can anyone help! Thanks!&lt;/p&gt;&#xA;" OwnerUserId="15989" LastEditorUserId="15989" LastEditDate="2015-06-17T01:47:51.990" LastActivityDate="2021-05-17T11:51:22.730" Title="Received Signal Strength Indication RSSI" Tags="|ieee-802.11|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19239" PostTypeId="2" ParentId="17903" CreationDate="2015-06-16T04:00:53.530" Score="3" Body="&lt;p&gt;There are a few problems with your premise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, connecting switch ports to switch ports will either end up disabling the switch ports or causing a spanning-tree loop.  Switches send BPDUs to determine the switch topology.  Properly configured switches will have the access ports set to &lt;code&gt;portfast&lt;/code&gt; and &lt;code&gt;bpduguard&lt;/code&gt;.  This configuration will disable the ports in order to prevent spanning-tree loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As suggested by @generalnetworkerror, bad cabling or duplex mismatch are good places to investigate.  Be sure to clear the counters, test the switch with some sort of traffic generator(s) on the original cabling, then look at the individual interface counters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is also very possible that you have one of the counterfeit Cisco products that are far more pervasive than anyone wants to believe.  It doesn't matter that you bought this switch as new from a reputable Cisco dealer since these fakes have found their way far deeper into the distribution pipeline than anyone will admit.  The counterfeiters have done a very good job at copying all the telltales, including the chip stamps and holograms.  Many counterfeit devices are out in production networks, running things just fine, but some cause these sorts of problems until they are sent back to Cisco for warranty work, where they are discovered as fakes.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-06-16T04:00:53.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19240" PostTypeId="2" ParentId="19238" CreationDate="2015-06-16T04:06:29.443" Score="0" Body="&lt;p&gt;RSSI is arbitrarily defined by manufacturer.  There is no defined standard for where or how to calculate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple Google search will provide you with very different ways.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-06-16T04:06:29.443" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19243" PostTypeId="1" CreationDate="2015-06-16T12:01:27.127" Score="2" ViewCount="7237" Body="&lt;p&gt;We have a product that considers installing on a client’s room a Mikrotik RouterBoard 951G 2HnD hosting a wifi network with WPA2 PSK security connected to our client’s network and an Android tablet connected to the Mikrotik’s wifi network. This solution has been installed on dozens of our clients’ sites and we have never had any issues before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two weeks ago the all the rooms (four) inside one of our client’s building started to have wifi problems. After working great for several hours, each tablet would disconnect (¿or be dropped?) from the RouterBoard 951G 2HnD’s wifi network and then immediately connect. After the first disconnection (or being dropped) and reconnection the tablet would keep disconnecting (or being dropped) and reconnecting from the wifi for several minutes, which would end in a final disconnection and then no more reconnection intents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution worked great for months but after we changed the tablet this started happening. At the beginning we thought this was because we had changed the tablet but after trying with another Android tablets and an Android cell phone even, the problem would still occur. We also replaced the RouterBoard 951G 2HnD with one that was working great at another office and it also started to show this unusual behaviour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, we took one of the four room’s Android tablet and RouterBoard 951G 2HnD, and installed them on one of our laboratories without modifying any configuration on both of them. After almost 24 hours the problem has not replicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought activating the Wireless Debug Logs would us show more relevant information and help us focus our investigation on the right direction but it didn’t. Next are the log records:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jan/01/1970 20:03:17 interface,info ether1_Conexion_Hacia_LAN link up (speed 100M, full duplex) &#xA;jan/01/1970 20:03:17 interface,info ether2_Conexion_Hacia_terminal_VC link up (speed 100M, full duplex) &#xA;jan/01/1970 20:04:00 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jan/01/1970 20:04:01 dhcp,info dhcp1_My_Companys_Name assigned 192.168.89.2 to 0C:B3:19:29:08:13 &#xA;jan/01/1970 20:04:09 system,error,critical router was rebooted without proper shutdown &#xA;jan/01/1970 20:04:20 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: sending station leaving (3) &#xA;jan/01/1970 20:04:29 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jan/01/1970 20:07:28 interface,info ether4_Conexion_Hacia_dispositivos_internos link up (speed 100M, full duplex) &#xA;jan/01/1970 20:07:41 system,info,account user admin logged in via winbox &#xA;jan/01/1970 20:17:48 system,info,account user admin logged in via winbox &#xA;jan/01/1970 20:17:50 system,info,account user admin logged out via winbox &#xA;jan/01/1970 20:19:01 system,info,account user admin logged in via local &#xA;jan/01/1970 20:19:28 system,info nat rule added by admin &#xA;jan/01/1970 20:19:31 system,info nat rule added by admin &#xA;jan/01/1970 20:19:31 system,info nat rule added by admin &#xA;jan/01/1970 20:19:31 system,info nat rule added by admin &#xA;jan/01/1970 20:22:51 interface,info ether4_Conexion_Hacia_dispositivos_internos link down &#xA;jan/01/1970 20:22:52 system,info,account user admin logged out via winbox &#xA;jan/01/1970 20:22:52 system,info,account user admin logged out via local &#xA;jan/01/1970 20:33:20 interface,info ether2_Conexion_Hacia_terminal_VC link down &#xA;jan/01/1970 20:33:23 interface,info ether2_Conexion_Hacia_terminal_VC link up (speed 100M, full duplex) &#xA;jan/01/1970 23:59:08 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jan/01/1970 23:59:08 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jan/01/1970 23:59:08 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jan/02/1970 00:02:09 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jan/02/1970 00:02:09 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jan/02/1970 00:02:09 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jan/02/1970 00:05:29 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jan/04/1970 15:20:45 system,info,account user admin logged in from 10.252.163.33 via winbox &#xA;jan/04/1970 15:37:52 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jan/04/1970 23:03:37 system,info,account user admin logged in from 10.252.163.33 via winbox &#xA;jan/04/1970 23:03:48 system,info log rule added by admin &#xA;jan/04/1970 23:04:07 system,info,account user admin logged out from 10.252.163.33 via winbox &#xA;jan/04/1970 23:07:23 system,info SNTP client configuration changed by admin &#xA;jun/15 15:53:43 system,info SNTP client configuration changed by admin &#xA;jun/15 18:09:25 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:09:41 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:09:41 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:09:41 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:15:29 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:15:29 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:15:29 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:15:29 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:15:29 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:17:11 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:17:15 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:17:15 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:17:15 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:17:20 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:17:20 wireless,info wlan1_My_Companys_Name: data from unknown device 0C:B3:19:29:08:13, sent deauth &#xA;jun/15 18:17:20 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:17:20 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:17:20 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:23:12 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:23:12 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:23:12 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:23:12 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:23:12 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:23:37 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:23:37 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:23:37 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:23:37 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:23:37 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:25:42 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:25:42 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:25:42 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:25:42 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:25:42 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:27:00 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:27:00 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:27:00 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:27:00 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:27:00 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:27:58 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:27:58 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:27:58 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:27:58 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:27:58 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:28:04 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:28:07 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:28:07 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:28:07 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:32:53 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:32:57 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:32:57 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:32:57 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:33:36 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:33:36 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:33:36 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:33:36 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:33:36 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:33:46 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:33:50 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:33:50 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:33:50 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:33:56 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, extensive data loss &#xA;jun/15 18:33:56 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:33:56 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:33:56 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:34:15 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:34:15 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:34:15 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:34:15 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:34:15 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:34:54 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:34:54 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:34:54 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:34:54 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:34:54 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:35:16 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:35:16 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:35:16 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:35:16 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:35:16 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:37:17 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:37:17 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:37:17 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:37:17 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:37:17 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:37:23 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:37:27 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:37:27 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:37:27 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:38:00 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:38:04 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:38:04 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:38:04 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:38:35 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:38:35 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:38:35 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:38:35 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:38:35 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:38:41 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:38:41 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:38:41 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:38:41 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:41:52 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:41:52 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:41:52 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:41:52 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:41:52 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:41:58 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:41:58 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:41:58 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:41:58 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:41:58 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:43:05 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:43:06 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:43:06 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:43:06 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:44:32 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:44:32 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:44:32 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:44:32 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:44:32 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:45:10 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:45:10 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:45:10 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:45:10 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:45:10 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:47:24 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:47:24 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:47:24 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:47:24 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:47:24 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:47:25 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:47:25 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:47:25 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:47:25 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:47:25 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:47:25 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 2 frame received (6) &#xA;jun/15 18:47:29 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:47:29 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:47:29 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:48:13 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:48:13 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:48:13 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:48:13 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:48:13 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:48:33 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:48:33 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:48:33 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:48:33 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:48:33 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:48:56 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:49:00 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:49:00 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:49:00 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:50:45 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:50:45 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:50:45 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:50:45 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:50:45 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:51:28 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:51:28 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:51:28 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:51:28 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:51:28 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:51:35 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:51:39 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:51:39 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:51:39 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:52:02 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:52:02 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:52:02 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:52:02 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:52:02 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:52:09 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:52:09 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:52:09 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:52:09 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:52:34 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:52:38 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:52:38 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:52:38 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:52:57 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:52:57 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:52:57 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:52:57 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:52:57 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:53:56 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:53:56 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:53:56 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:53:56 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:53:56 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:54:08 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:54:09 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:54:09 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:54:09 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:55:14 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:55:14 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:55:14 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:55:14 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:55:14 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:55:19 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:55:19 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:55:19 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:55:19 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:56:43 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;jun/15 18:56:47 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:56:47 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:56:47 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:57:02 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:57:02 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:57:02 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:57:02 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:57:02 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:57:03 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 attempts to associate &#xA;jun/15 18:57:03 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: reassociating &#xA;jun/15 18:57:03 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, ok &#xA;jun/15 18:57:03 wireless,debug wlan1_My_Companys_Name: 0C:B3:19:29:08:13 in local ACL, accept &#xA;jun/15 18:57:03 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: connected &#xA;jun/15 18:57:03 wireless,info 0C:B3:19:29:08:13@wlan1_My_Companys_Name: disconnected, received deauth: class 3 frame received (7) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, we did a spectrum analisis showing the usage of each channel (&lt;strong&gt;but only with networks with visible SSIDs&lt;/strong&gt;) and the result was the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rM4hg.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/f4pTU.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the image shows we are currently working on channel 4 but previously when the problem started happening we were on channel 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have no idea where to keep looking and why is this problem happening. Any help or guidance will be deeply appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Upate&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to add more detailed information about the usage of the wifi spectrum. At the beggining we were on channel one. Then we changed to channel 3 (see image on first post) but after using InSSIDer we ended changing to channel 10. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next is the image of the test results when channel 3 was being used:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/WbEA5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next is the image of the test results after selecting the best wifi channel (which was channel 10):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xw9Lz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would love to hear more comments and thought. Everything that makes us do something we have not yet done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EVEN MORE UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next image presents the DHCP packets sent between the tablets and the Mikrotik router installed on one room:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/cNGne.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DHCP Discover and DHCP Request packets are sent from the tablets to the DHCP server (supposedly the Microtik's), which are not beeing answered with a DHCP Offer or a DHCP ACK. One could get confuzed and think that the packets #997, #995, #999 y #1004 respond to the requests that appear before but their transaction ID shows that they are from another set of requests. Same happens with the DHCP NAK. On the DHCP protocol the different messages from one communication flow will keep the transaction ID as shown in the next image:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/P8pXN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking deeper on the DHCP Request messages sent by the tablets, we found one (packet #785) asking for the IP 172.22.198.134 to the DHCP server with the IP address 152.141.217.7, which is very weird because the only Wi-Fi network registrated on the test devices was the one with SSID CVNET62710 owned by the Mikrotik.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, the ARP packets were analized and we found that the device with a MAC address 00:00:0c:07:ac:64, that appears as All-HSRP-routers_64, reports that he has the IP address 172.22.198.1 and the IP address 192.168.89.1, being this last one the IP address of the Mikrotik's Wi-Fi interface that holds the DHCP server. Next you can see the evidence:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qpggd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking this duplicated IP is the reason the problem of the disconnection and reconnection on of the tablet of this room. Sadly, I haven't been able to take captures on the other rooms so I can't assure or discard that this could be happening on every one of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, today in the morning when we went to configure the IP address of the tablet (of the current room) as a static one, when we selected manual IP address we found that it was set to 192.168.1.128, which is not from the ranged delivered by the Mikrotik (192.168.89.X). It seems that it took the IP address of another network even though the only registrated Wi-Fi network is CVNET62710.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to hear your thoughts on the matter and see if you think this could be causing the recurrent disconnection and reconnection of the devices.&lt;/p&gt;&#xA;" OwnerUserId="15992" LastEditorUserId="8499" LastEditDate="2018-02-14T16:45:35.570" LastActivityDate="2018-02-14T16:45:35.570" Title="Tablets disconnecting and reconnecting &quot;randomly&quot; from RouterBoard 951G 2HnD WIFI network" Tags="|wireless|" AnswerCount="1" CommentCount="9" ClosedDate="2017-08-09T23:51:33.230" ContentLicense="CC BY-SA 3.0" />
  <row Id="19244" PostTypeId="2" ParentId="19167" CreationDate="2015-06-16T13:47:37.953" Score="2" Body="&lt;p&gt;I would approach it this way: fetch sysuptime, then calculate the boot date/time and the predicted next wrap date/time. Write both to the log. Calculate the next poll time and if it is after the predicted next wrap date/time by a little margin, write a 'wrap expected' bit to the log.  Next time you fetch, look at the 'wrap expected' bit and the predicted next wrap time from the log, and if the bit is 1 and if the predicted wrap time and current boot times are pretty close (extremely close if your server and router are both using NTP) then you know it has wrapped and not rebooted.  If not, you know it rebooted.  If the wrap expected bit wasn't set, simply go back to the main script logic and calculate the new boot time and predicted wrap time, make your wrap prediction bit, and write it all to the log.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are trying to guard against a reboot false positive by not anticipating the uptime wrap, AND a reboot true negative by assuming the counter wrapped when it actually rebooted.  To do both you need pretty careful timing, and even then it just reduces the probability (down past 1 in 1,000,000), but it doesn't eliminate them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to go full tilt, you can do something like adding a second detection layer on top.  For example look at the UDP traffic counter: since you are polling via snmp you will be constantly incrementing it a tiny bit.  Since there probably arent many other SNMP polls taking place, it will not likely wrap very often (if at all compared to reboots for other reasons) so if you looked at sysuptime going down AND udp traffic count going down you can increase the confidence that you caught a reboot.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastEditorUserId="6361" LastEditDate="2015-06-17T14:33:19.660" LastActivityDate="2015-06-17T14:33:19.660" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19248" PostTypeId="1" CreationDate="2015-06-16T14:37:28.367" Score="1" ViewCount="271" Body="&lt;p&gt;I'm trying to set up outside access for a couple machines here using VNC.  They can both be accessed locally, and I was able to configure the first one for external access, but when trying to configure the second I get the error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The server address configuration overlaps with an existing translation rule.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would like to use the same domain name to connect to, but differentiate based on port number.  So mydomain.com:5902 would go to one PC and mydomain.com:5903 would go to another.  I'm using a Cisco ASA 5510 with ASDM 6.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set the DNS record up on our name server, and it works for the first one, but I keep getting the conflict error when trying to set the second one up through the &quot;Public Servers&quot; option in ASDM.  Is there something I am doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OmRR2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="14318" LastEditorUserId="14318" LastEditDate="2015-06-16T15:09:29.287" LastActivityDate="2015-09-25T05:17:54.630" Title="Configuring remote access on two different PCs behind one external IP" Tags="|cisco|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19249" PostTypeId="2" ParentId="19243" CreationDate="2015-06-16T15:39:44.690" Score="1" Body="&lt;p&gt;Based on your description and images, I suspect radio interference.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You replaced all your hardware and have the same problem.  You moved the hardware to your &quot;lab,&quot; and the problem went away.  That strongly implicates your environment as the issue.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't say where you did the measurement sample in relation to your receivers, but a 12-15 db SNR isn't very good.    Also, I would move your frequency to channel 1,6 or 11.  If you're listening on channel 3, you are getting interference from both channel 1 and 6 that your receiver doesn't deal with very well.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may seem counter-intuitive, but your radio can deal with interference better if it's on the same channel.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-06-16T15:39:44.690" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="19251" PostTypeId="2" ParentId="18879" CreationDate="2015-06-16T17:49:19.990" Score="3" Body="&lt;p&gt;There is no inherent limitation regarding the use of sub-interfaces on an ASA 5525-X  except for the overall limitation on the number of interfaces allowed. According to page 10-10 of the document, &quot;Cisco ASA Series General Operations CLI Configuration Guide&quot;, the base license for the ASA 5525-X allows for a combined sum of 1,316 interfaces across all types - VLANs, physical, redundant, bridge groups, EtherChannel, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I encountered was the result of command ordering, as suspected:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! WRONG&#xA;interface Port-channel1.60    &#xA; nameif DMZ    &#xA; security-level 50    &#xA; ip address xxx.xxx.xxx.xxx 255.255.255.xxx standby xxx.xxx.xxx.xxx    &#xA; vlan 60    &#xA;!    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Should have been...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! CORRECT&#xA;interface Port-channel1.60    &#xA; vlan 60&#xA; nameif DMZ    &#xA; security-level 50    &#xA; ip address xxx.xxx.xxx.xxx 255.255.255.xxx standby xxx.xxx.xxx.xxx    &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14399" LastActivityDate="2015-06-16T17:49:19.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19252" PostTypeId="1" AcceptedAnswerId="19258" CreationDate="2015-06-16T18:56:57.210" Score="0" ViewCount="123" Body="&lt;p&gt;I'm new to the Network Engineering community. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also relatively new to the vSphere product line (and networking in general). I was hoping I would be able to interface multiple ESXi hosts on vCenter such that their VMs would be able to communicate with one another across a virtual switch. Is there any way I would be able to do this? If so, how would I go about doing so? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks,&#xA;akratix&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qfa16.png&quot; alt=&quot;A layout of the ESXi servers and how the VMs would interact.&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="15996" LastActivityDate="2015-06-17T00:42:23.293" Title="VMWare vCenter Configuration of Virtual Switches" Tags="|switch|switching|vmware|" AnswerCount="1" CommentCount="1" ClosedDate="2015-06-18T15:18:58.977" ContentLicense="CC BY-SA 3.0" />
  <row Id="19253" PostTypeId="1" AcceptedAnswerId="19257" CreationDate="2015-06-16T19:30:47.623" Score="3" ViewCount="96" Body="&lt;p&gt;I have a quick question. This is more of a concept question than an actual problem, but basically what I'm trying to do is set up a malware analysis lab on one of my company's computers. I already have a Base Windows machine with a bunch of VMs for analyzing the malware. Where my problem comes in is that I want the malware I'm analyzing to be able to go out to the internet so it can function properly, but have no chance of reaching the internal network. I am using the Watchguard XTM 2 Series firewall, and would like some input on how I can achieve this. What is the best way to go about doing this? Something like a DMZ so malware traffic can go in and out on the internet, but not come into our main network? I couldnt find any tutorials on how to configure it correctly, but I can do some more searching once I know what I want to do is right. Thank you!&lt;/p&gt;&#xA;" OwnerUserId="15998" LastEditorUserId="775" LastEditDate="2015-06-20T16:12:50.283" LastActivityDate="2015-06-20T16:12:50.283" Title="Malware lab with watchguard firewall" Tags="|firewall|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19254" PostTypeId="1" AcceptedAnswerId="19280" CreationDate="2015-06-16T19:38:42.057" Score="0" ViewCount="858" Body="&lt;p&gt;In place where I'm living now, I have a poor internet connection. My download speed is not bad, but upload is poor. I have two broadband providers. First is DSL, or isdn I'm not sure, but I know one think working on annex b. My second provider is LTE -- its a typical SIM card. Several weeks ago I found this &lt;a href=&quot;http://speedify.com&quot; rel=&quot;nofollow&quot;&gt;website&lt;/a&gt;, and now I'm wondering on one thing: is it possible to connect (to unite) two different technologies in one? For example, connect DSL and LTE in one to have the combined download and upload speed? If this is possible what sort of router and dongle for SIM card would I need?&lt;/p&gt;&#xA;" OwnerUserId="15997" LastEditorUserId="619" LastEditDate="2015-06-16T20:30:31.093" LastActivityDate="2015-06-17T10:23:26.597" Title="How to connect two different technologies in one LTE and DSL" Tags="|router|adsl|" AnswerCount="3" CommentCount="2" ClosedDate="2015-06-17T13:53:56.693" ContentLicense="CC BY-SA 3.0" />
  <row Id="19255" PostTypeId="2" ParentId="19254" CreationDate="2015-06-16T20:35:09.983" Score="0" Body="&lt;p&gt;The term is &lt;em&gt;bonding&lt;/em&gt;. And no, you, the end user, cannot combine the connections from two different ISPs into one larger pipe. You can load balance between the two, but the speed will be limited to the connection selected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, there are ways to get the same net effect using a 3rd party service. Sort of a &quot;multilink VPN&quot;, but I wouldn't recommend it.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-16T20:35:09.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19256" PostTypeId="1" AcceptedAnswerId="19260" CreationDate="2015-06-16T20:51:21.300" Score="1" ViewCount="88" Body="&lt;p&gt;Is There any difference between them? For example, about ISDN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;To suporte application requiring high-speed voice, video, and data communication&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;When you need both a consistent and very high rate of data speed and transfer&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;both sounds like? &lt;/p&gt;&#xA;" OwnerUserId="14008" LastActivityDate="2015-06-16T21:30:47.593" Title="High-speed vs High Rate" Tags="|wan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19257" PostTypeId="2" ParentId="19253" CreationDate="2015-06-16T20:51:37.917" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;have no chance of reaching the internal network&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To the letter, that means a 100%, completely separate network. Cables, switches, router, &lt;em&gt;everything&lt;/em&gt;. Short of a physical cabling mistake, there's no chance of the test environment touching the internal network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I understand how that can be unattainable. So, you'd then fall back to using VLANs to create &quot;virtual&quot; isolation, and either a DMZ VLAN subinterface, or secondary real interface, at the firewall/router -- &lt;em&gt;or a second firewall&lt;/em&gt;. The firewall/router would then require ACLs and/or other security rules to prevent the internal and DMZ networks from interacting -- beyond what very limited access you may want for management access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot overstate the need for as much &lt;em&gt;physical&lt;/em&gt; isolation as possible. Even your VM host is a possible vector into your internal network -- don't count on the &quot;VM&quot; staying inside it's container.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I've not touched a Watchguard in eons, so I cannot give you any details on how to configure yours.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-16T20:51:37.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19258" PostTypeId="2" ParentId="19252" CreationDate="2015-06-16T21:01:21.143" Score="1" Body="&lt;p&gt;vSwitch is a logical switch within a single host. It's defined individually on each host. If it isn't given a physical link, it will not have any connectivity beyond the host, even if it's defined on multiple hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A vSphere Distributed Switch (vDS or dvs - depending on the age of the document) is defined by vcenter and applied across a cluster of hosts. Once the vDS is defined, adding a host to it applies all of the vDS networks to that host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a lot of hosts and/or networks, a vDS may be less work. I script all of my ESX deployments, so it's the same either way for me.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-06-17T00:42:23.293" LastActivityDate="2015-06-17T00:42:23.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19259" PostTypeId="2" ParentId="2078" CreationDate="2015-06-16T21:07:14.387" Score="0" Body="&lt;p&gt;&quot;The answer is through the use of phantom power—power sent over the same wire pairs used for data. When the same pair is used for both power and data, the power and data transmissions don’t interfere with each other. Because electricity and data function at opposite ends of the frequency spectrum, they can travel over the same cable. Electricity has a low frequency of 60 Hz or less, and data transmissions have frequencies that can range from 10 million to 100 million Hz&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://learningnetwork.cisco.com/thread/43939&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-16T21:07:14.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19260" PostTypeId="2" ParentId="19256" CreationDate="2015-06-16T21:14:24.767" Score="1" Body="&lt;p&gt;All data bits flow at exactly the same speed down the wire (the speed of light in the medium of travel).  So a bit of data travelling 1000 miles down a 10 meg circuit arrives at the other end at exactly the same time as a bit travelling down a 100Gig connection.  The difference is the RATE at which the signal can transition state between 1 and 0.  The faster you can transition the state of the signal, the faster you can send the next bit.  So -- basically there is no such thing as &quot;speed&quot; because it all operates at the same speed (the speed of light), what differs is the RATE of data bits you can send.  That is the &quot;bandwidth&quot;.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The faster I am able to flip the state of the signal from 1 to 0 and back again, the more data I can send in a given amount of time.  Imagine two signalmen using old time semaphore flags.  One signals quickly, one signals slowly.  The actual light reaching your eye is arriving at the same speed in both cases but one can send a lot more data in a given time than the other.  That signalman has more bandwidth and can send more data in a given period of time.  The data doesn't travel faster, but that one can pack more data into a given slice of time.&lt;/p&gt;&#xA;" OwnerUserId="15910" LastActivityDate="2015-06-16T21:14:24.767" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19261" PostTypeId="2" ParentId="16135" CreationDate="2015-06-16T21:23:18.343" Score="0" Body="&lt;p&gt;Virtual chassis' are an improvement over chassis based switches primarily because of &lt;a href=&quot;https://en.wikipedia.org/wiki/MC-LAG&quot; rel=&quot;nofollow&quot;&gt;MLAG&lt;/a&gt; support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Redundancy improvement is true only insofar as passive metal is a point of failure.  This is a matter of probability and is quote low.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scalability is not significantly improved.  In fact, 48-port linecards are often cheaper than 48 port switches.  So, as you get very large chassis, the cost per port actually decreases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Management is improved only insofar as a campus or org-wide virtual chassis is deployed.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-16T21:23:18.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19262" PostTypeId="2" ParentId="19254" CreationDate="2015-06-16T21:27:39.810" Score="0" Body="&lt;p&gt;I agree with Ricky Beam that bonding cannot be accomplished with discimilar WAN technologies from different providers. However, you can do some load balancing with fail-over if your firewall is intelligent enough. &#xA;Here is a how-to from the pfsense people should give some fairly good insight:&#xA;&lt;a href=&quot;https://doc.pfsense.org/index.php/Multi-WAN&quot; rel=&quot;nofollow&quot;&gt;Multi-WAN&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said all of that, it appears your greatest desire is to increase your individual download speeds and this will not address that directly as  Multi-WAN operates on a connection-based round robin basis. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-06-16T21:27:39.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19263" PostTypeId="2" ParentId="19256" CreationDate="2015-06-16T21:30:47.593" Score="0" Body="&lt;p&gt;Not in the context of ISDN links.  In terms of networking device throughput there is a differentiation of packets-per-second and switching capacity (Gbps).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why we need pps is that switch/router's packet processing capability depends on packet size. That is, switch/router can't do wire speed for all packets size, but should be able to process most packet sizes at line rate.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-16T21:30:47.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19264" PostTypeId="1" CreationDate="2015-06-16T22:52:30.140" Score="2" ViewCount="555" Body="&lt;p&gt;When I am trying to configure tacacs hostname I have this message . I can't find solution for this problem. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)#tacacs-server host 192.168.20.1&#xA;Warning: The cli will be deprecated soon 'tacacs-server host 192.168.20.1' Please move to 'tacacs server &amp;lt;name&amp;gt;' CLI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16000" LastEditorUserId="619" LastEditDate="2015-06-17T00:43:53.207" LastActivityDate="2015-06-17T00:46:10.637" Title="tacacs server hostname problem" Tags="|cisco|cisco-commands|tacacs|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19265" PostTypeId="2" ParentId="19264" CreationDate="2015-06-17T00:46:10.637" Score="3" Body="&lt;p&gt;It's a warning that you are using an old, soon to be removed, configuration syntax, and gives you the new command.  There are plenty of guides on the subject; Ron pointed out one of them.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-17T00:46:10.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19270" PostTypeId="1" AcceptedAnswerId="71581" CreationDate="2015-06-17T06:54:38.077" Score="2" ViewCount="79" Body="&lt;p&gt;I am working on heterogeneous networking in wireless networks, and the IEEE Std 802.21 (Media Independent Handover) seems to tackle some of the problems I am facing. However, I could not find information on someone actually using it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: What is the state of IEEE 802.21 adoption? It seems that the actual handover functionality for technologies like IEEE 802.11 is not part of the standard, so the benefits of using it instead of implementing a lightweight alternative may be small.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the standard already obsolete? Would it make sense to integrate it into a new prototype implementation?&lt;/p&gt;&#xA;" OwnerUserId="16004" LastActivityDate="2020-12-16T21:41:57.870" Title="What is the state of IEEE 802.21 adoption?" Tags="|wireless|standardisation|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19272" PostTypeId="2" ParentId="19238" CreationDate="2015-06-17T07:30:27.373" Score="2" Body="&lt;p&gt;The IEEE Std 802.11-2012 says in Table 20-1:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;RSSI - The allowed values for the RSSI parameter are in the range from 0 to RSSI&#xA;  maximum. This parameter is a measure by the PHY of the power observed&#xA;  at the antennas used to receive the current PPDU. RSSI shall be measured&#xA;  during the reception of the PLCP preamble. In HT-mixed format, the&#xA;  reported RSSI shall be measured during the reception of the HT-LTFs.&#xA;  RSSI is intended to be used in a relative manner, and it shall be a&#xA;  monotonically increasing function of the received power.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While is is not required to have a precise relationship between physical measurements and RSSI magnitudes, my experience from experiments is that there is often a strong correlation between received power (dBm) and the RSSI. The manufacturers take care of the implementation details, they probably factor out details like amplifier gains. However some receivers just measure in-band power, so good RSSI does not imply a good signal-to-noise ratio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RSSI is used for example for clear channel assessment (CCA) or the signal quality indicator you see in your OS, as mandated by IEEE 802.11. The manufacturers implement RSSI to be fit for these purposes, it should not be confused with a precise measurement. This indicator was never intended for such a purpose.&lt;/p&gt;&#xA;" OwnerUserId="16004" LastActivityDate="2015-06-17T07:30:27.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19274" PostTypeId="1" AcceptedAnswerId="19281" CreationDate="2015-06-17T08:57:52.573" Score="1" ViewCount="633" Body="&lt;p&gt;I would like to ask how can I configure a dhcp to work from 192.168.0.2 - 192.168.255.255 for example. Is this a software or hardware tweak? Also do I need a special server/router/software? Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="16006" LastActivityDate="2015-06-17T11:55:56.030" Title="DHCP on multiple ranges?" Tags="|dhcp|" AnswerCount="2" CommentCount="2" ClosedDate="2015-06-18T15:19:43.823" ContentLicense="CC BY-SA 3.0" />
  <row Id="19277" PostTypeId="1" AcceptedAnswerId="19303" CreationDate="2015-06-17T09:19:15.383" Score="1" ViewCount="895" Body="&lt;p&gt;I have configured PNAT on my router. Everything seems fine. I have static NAT set for port forwarding for servers behind the NAT router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have setup ACLs to open the ports that are being forwarded on the Ext. Interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but when I do a port scan, only ssh is open, the rest of the ports are closed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does any one have an idea as to why this is so? Thx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname OME-GW&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;dot11 syslog&#xA;ip source-route&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ip bootp server&#xA;ip domain name *******&#xA;ip name-server [x.x.x.x]&#xA;ip name-server [x.x.x.x]&#xA;ip name-server 8.8.8.8&#xA;ip name-server 8.8.4.4&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO1841 sn XXXXXXX&#xA;&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;ip ssh port 22 rotary 1&#xA;!&#xA;class-map match-all win_kasp_updates_allow&#xA; match protocol http url &quot;/.geo.kaspersky.com&quot;&#xA; match protocol http url &quot;/.windowsupdate.com&quot;&#xA; match protocol http url &quot;/update.windows.com&quot;&#xA; match protocol http url &quot;/windowsupdate.microsoft.com&quot;&#xA; match protocol http url &quot;/downloads4.kaspersky-labs.com&quot;&#xA; match access-group 10&#xA;class-map match-all everything_else&#xA; match any&#xA;!&#xA;!&#xA;policy-map win_kasp_updates_allow_policy&#xA; class win_kasp_updates_allow&#xA;   drop&#xA; class everything_else&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.1.21 255.255.255.0&#xA; ip access-group 103 in&#xA; ip flow ingress&#xA; ip flow egress&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA; !&#xA; service-policy input win_kasp_updates_allow_policy&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address [Public_IP] 255.255.255.252&#xA; ip access-group 102 in&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA; !&#xA;!&#xA;interface Serial0/1/0&#xA; no ip address&#xA; shutdown&#xA; no fair-queue&#xA; clock rate 2000000&#xA; !&#xA;!&#xA;interface Serial0/1/1&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA; !&#xA;!&#xA;ip default-gateway [ISP_P2P_IP]&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip flow-export version 5&#xA;ip flow-export destination 192.168.1.151 9991&#xA;ip flow-top-talkers&#xA; top 10&#xA; sort-by bytes&#xA;!&#xA;ip dns server&#xA;ip nat inside source list 1 interface FastEthernet0/1 overload&#xA;ip nat inside source static tcp 192.168.1.20 25 [Public_IP] 25 extendable&#xA;ip nat inside source static tcp 192.168.1.20 25 [Public_IP] 26 extendable&#xA;ip nat inside source static tcp 192.168.1.20 53 [Public_IP] 53 extendable&#xA;ip nat inside source static udp 192.168.1.20 53 [Public_IP] 53 extendable&#xA;ip nat inside source static tcp 192.168.1.20 110 [Public_IP] 110 extendable&#xA;ip nat inside source static udp 192.168.1.20 1194 [Public_IP] 1194 extendable&#xA;ip route 0.0.0.0 0.0.0.0 [ISP_P2P_IP]&#xA;!&#xA;access-list 1 permit 192.168.1.0 0.0.0.255&#xA;access-list 10 deny   192.168.1.22&#xA;access-list 10 permit 192.168.1.0 0.0.0.255&#xA;access-list 102 permit tcp any any eq pop3&#xA;access-list 102 permit tcp any any eq smtp&#xA;access-list 102 permit tcp any any eq 1194&#xA;access-list 102 permit udp any any&#xA;access-list 102 permit tcp any any&#xA;access-list 102 permit icmp any [ISP_P2P_IP] 0.0.0.3 echo&#xA;access-list 102 permit icmp any [ISP_P2P_IP] 0.0.0.3 echo-reply&#xA;access-list 102 deny   ip host 195.154.109.72 any&#xA;access-list 102 deny   ip 192.168.0.0 0.0.255.255 any&#xA;access-list 102 deny   ip 172.16.0.0 0.15.255.255 any&#xA;access-list 102 deny   ip 10.0.0.0 0.255.255.255 any&#xA;access-list 102 deny   ip 127.0.0.0 0.255.255.255 any&#xA;access-list 102 deny   ip 255.0.0.0 0.255.255.255 any&#xA;access-list 102 deny   ip 224.0.0.0 31.255.255.255 any&#xA;access-list 102 deny   ip host 0.0.0.0 any&#xA;access-list 103 deny   ip host 192.168.1.9 any&#xA;access-list 103 deny   ip host 192.168.1.35 any&#xA;access-list 103 permit ip any any&#xA;access-list 103 permit tcp 192.168.1.0 0.0.0.255 any&#xA;access-list 103 permit udp host 192.168.1.26 eq domain any&#xA;access-list 103 permit tcp host 192.168.1.26 eq domain any&#xA;access-list 103 permit udp 192.168.1.0 0.0.0.255 any&#xA;no cdp run&#xA;&#xA;!&#xA;!&#xA;!&#xA;!&#xA;snmp-server community secret RO 90&#xA;!&#xA;!&#xA;control-plane&#xA; !&#xA;!&#xA;&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA; exec-timeout 5 0&#xA; login local&#xA; rotary 1&#xA; transport input ssh&#xA;!&#xA;scheduler allocate 20000 1000&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Show ip nat translations&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Pro Inside global         Inside local          Outside local         Outside global&#xA;udp [Public_IP]:137    192.168.1.16:137      192.168.255.255:137   192.168.255.255:137&#xA;udp [Public_IP]:138    192.168.1.16:138      192.168.255.255:138   192.168.255.255:138&#xA;tcp [Public_IP]:25     192.168.1.20:25       ---                   ---&#xA;tcp [Public_IP]:53     192.168.1.20:53       ---                   ---&#xA;udp [Public_IP]:53     192.168.1.20:53       ---                   ---&#xA;tcp [Public_IP]:110    192.168.1.20:110      ---                   ---&#xA;udp [Public_IP]:1194   192.168.1.20:1194     ---                   ---&#xA;tcp [Public_IP]:38682  192.168.1.52:38682    196.0.3.118:80        196.0.3.118:80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16007" LastEditorUserId="16007" LastEditDate="2015-06-18T04:40:02.370" LastActivityDate="2015-06-18T05:26:52.147" Title="Port forwarding is failing on Cisco router 1841" Tags="|cisco|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="19279" PostTypeId="2" ParentId="19274" CreationDate="2015-06-17T09:45:29.803" Score="-3" Body="&lt;p&gt;I do not think that would be possible. Remember that is a class C address range which defaults to a 255.255.255.0 subnet mask. &#xA;For 192.168.0.2 the end would be 192.168.0.254. So you would most likely define different ranges I think.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.0.2 to 192.168.0.254&#xA;192.168.1.1 to 192.168.1.254 and so on&lt;/p&gt;&#xA;" OwnerUserId="16007" LastActivityDate="2015-06-17T09:45:29.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19280" PostTypeId="2" ParentId="19254" CreationDate="2015-06-17T10:23:26.597" Score="2" Body="&lt;p&gt;&lt;strong&gt;Multipath TCP&lt;/strong&gt; (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6824&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6824&lt;/a&gt;) could be a solution to explore. In my understanding you can split a single session across different technologies, so it should be possible to divide up- and downlink and spread it across different links. That being said, it is an ongoing effort so actually using it requires to employ an experimental Linux kernel module (&lt;a href=&quot;http://www.multipath-tcp.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;download and documentation here&lt;/a&gt;) and to build a Linux router that operates that way.&lt;/p&gt;&#xA;" OwnerUserId="16004" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-06-17T10:23:26.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19281" PostTypeId="2" ParentId="19274" CreationDate="2015-06-17T11:55:56.030" Score="2" Body="&lt;p&gt;Just configure your DHCP server with scope 192.168.0.2 - 192.168.255.254 and subnet mask 255.255.0.0. Here's an example how to do it with Microsoft DHCP server:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/VdBB8.jpg&quot; alt=&quot;DHCP scope on MS server&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.255.255 is the broadcast address, so that cannot be assigned to a device. &lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2015-06-17T11:55:56.030" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19282" PostTypeId="1" AcceptedAnswerId="19291" CreationDate="2015-06-17T13:38:50.653" Score="3" ViewCount="9589" Body="&lt;p&gt;Reason why I'm asking this is because I want to know why mobile phones cannot discover ad-hoc networks created by laptops or PCs?&lt;/p&gt;&#xA;" OwnerUserId="15143" LastActivityDate="2015-06-17T19:49:36.877" Title="Difference between ad-hoc and wifi hotspots" Tags="|ieee-802.11|ad-hoc-wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19283" PostTypeId="1" AcceptedAnswerId="42246" CreationDate="2015-06-17T15:12:00.910" Score="1" ViewCount="496" Body="&lt;h1&gt;&lt;strong&gt;The problem&lt;/strong&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Roaming from the RT-AC68U (we can’t roam between the WLR-4004, which may won’t work too) to the Archer C5 doesn’t work properly, but backwards it works properly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, we have to wait for a few minutes and restart Wi-Fi on the roaming phone/notebook (which may not be required, but this seems to speed it up). On my Android phone, I won’t get an IP address or a connection to the rest of the network. I’m only able to ping to the Archer C5 and not the RT-AC68U or Google’s DNS when this happens.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;&lt;strong&gt;Things tried&lt;/strong&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Removing the switch between the RT-AC68U and the Archer C5: Didn’t seems to effect anything, still the same problem as explained above.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;&lt;strong&gt;Network configuration&lt;/strong&gt;&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ground floor: Asus RT-AC68U (our main router)&lt;/li&gt;&#xA;&lt;li&gt;2th floor (attic): TP-Link Archer C5 (configured as AP, no DHCP/NAT)&lt;/li&gt;&#xA;&lt;li&gt;Garden: Sitecom WLR-4004 (configured as AP, no DHCP/NAT)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There is 1 unmanaged switch (TP-link TL-SG108) between the RT-AC68U and the Archer C5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All AP’s are configured to use a separate channel (1, 6, 11), with the same SSID’s.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Why can't I roam from RT-AC68U to the Archer C5 and what/where could be the problem? &lt;/p&gt;&#xA;" OwnerUserId="16008" LastActivityDate="2017-06-28T16:01:06.897" Title="Problem while roaming between AP's" Tags="|wireless|access-point|" AnswerCount="1" CommentCount="2" ClosedDate="2017-06-28T16:04:28.897" ContentLicense="CC BY-SA 3.0" />
  <row Id="19285" PostTypeId="2" ParentId="14763" CreationDate="2015-06-17T16:54:03.153" Score="0" Body="&lt;p&gt;ISE is a RADIUS server.  A TACACS+ server such as Cisco ACS is required for the command level AAA you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RADIUS - &lt;em&gt;Remote&lt;/em&gt; Authentication Dial In &lt;em&gt;User&lt;/em&gt; Service is primarily used for network access AAA.&lt;br&gt;&#xA;TACACS+ - &lt;em&gt;Terminal Access&lt;/em&gt; Controller Access-Control System is primarily used for Device Administration AAA.&lt;br&gt;&#xA;&lt;br&gt;&#xA;TACACS+ provides for separate and modular authentication, authorization, and accounting facilities enabling more granular AAA, for example the ability to log each command entered by the different users and defining what commands a user may run.  RADIUS cannot do this.&lt;br&gt;&#xA;&lt;br&gt;&#xA;RADIUS encrypts only the password in the access-request packet, from the client to the server.  TACACS+ encrypts the entire body of the packet.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-17T16:54:03.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19286" PostTypeId="1" CreationDate="2015-06-17T17:10:12.003" Score="1" ViewCount="475" Body="&lt;p&gt;I was wondering why the performance would decrease when streaming a high quality video to my iphone over a long distance, when you use an end-end congestion control with TCP? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking, TCP has bandwidth control and divides the bandwidth equally over the current connections. So, when a video travels over a long distance, there will probably be a connection where there is too much bandwidth used and therefore the streamed video will lose some of its data. That's what I think, but is this correct? Or is there another reason why congestion control of TCP would decrease the performance of this setup? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks!&lt;/p&gt;&#xA;" OwnerUserId="16017" LastActivityDate="2015-07-06T15:12:10.400" Title="Congestion control in combination with streaming a video" Tags="|tcp|congestion|streaming|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19287" PostTypeId="1" AcceptedAnswerId="19289" CreationDate="2015-06-17T17:14:03.383" Score="12" ViewCount="55909" Body="&lt;p&gt;I was reading over some JNCIS-SP documentation on provider bridging and it had this to say regarding the TPID field for QinQ: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IEEE 802.1ad has reserved a TPID of 0x88a8 for the S-TAG however&#xA;  the JUNOS operating system default behavior is to set the TPID equal&#xA;  to 0x8100.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Wikipedia has the following listed for the notable protocols for these TPID values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0x8100  VLAN-tagged frame (IEEE 802.1Q) &amp;amp; Shortest Path Bridging IEEE 802.1aq&#xA;0x88A8  Provider Bridging (IEEE 802.1ad) &amp;amp; Shortest Path Bridging IEEE 802.1aq&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the functional difference between these two TPID values? &#xA;Why would Juniper use a different default TPID than the IEEE reserved TPID for the S-TAG?&lt;/p&gt;&#xA;" OwnerUserId="10323" LastEditorUserId="10323" LastEditDate="2015-06-17T17:23:42.707" LastActivityDate="2023-05-10T11:47:10.300" Title="What's the difference between TPID of 0x88a8 or 0x8100" Tags="|juniper-junos|qinq|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19289" PostTypeId="2" ParentId="19287" CreationDate="2015-06-17T17:48:51.003" Score="13" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;What is the functional difference between these two TPID values?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;0x8100&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This TPID is used in &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1Q&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.1Q&lt;/a&gt; - its your average, everyday VLAN tagging.  A common use for VLANs is for enterprises to organize their network into functional groups (like research, finance, or management).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;0x88a8&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This TPID is used in &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1ad&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.1ad&lt;/a&gt; - its used for provider bridging (also known as QinQ, stacked VLANs, or double tagging). QinQ allows multiple VLAN tags in an Ethernet frame.&lt;/p&gt;&#xA;&lt;p&gt;QinQ is used when a customer has to transport VLAN tagged traffic across a service provider network.  The service provider will have its own set of VLAN tags, perhaps a tag per customer.  So we have customer VLAN tags, and service provider VLAN tags, appropriately called C-TAGs and S-TAGs.&lt;/p&gt;&#xA;&lt;p&gt;S-TAGs are correlated with the &lt;em&gt;0x88a8&lt;/em&gt; TPID to signify the existence of the inner C-TAG which uses TPID &lt;em&gt;0x8100&lt;/em&gt; (S-TAGs are inserted before C-TAGs).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Why would Juniper use a different default TPID than the IEEE reserved TPID for the S-TAG?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;They're not, here is a list of the common &lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType#Examples&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE TPIDs&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;To be more specific, the default is 0x8100 because 802.1Q is used &lt;strong&gt;WAY&lt;/strong&gt; more commonly than 802.1ad/Provider Bridging.&lt;/p&gt;&#xA;&lt;p&gt;To be even more specific to what I assume is a quote from the JNCIS documentation, is just really poor wording.  I believe it's saying that the default TPID is 0x8100 (to imply that 802.1q is default).&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="-1" LastEditDate="2021-05-26T11:34:40.993" LastActivityDate="2021-05-26T11:34:40.993" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19291" PostTypeId="2" ParentId="19282" CreationDate="2015-06-17T19:49:36.877" Score="3" Body="&lt;p&gt;Wi-Fi has two working modes - IBSS (ad-hoc) and BSS (infrastructure mode). The main difference between these two modes is access-point. This kind of device is available only in infrastructure mode. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In ad-hoc mode when station A wants to transmit a frame to station B it just transmits this frame to station B.&lt;/li&gt;&#xA;&lt;li&gt;In infrastructure mode, station A at first transmits this frame to access-point, and access point retransmits this frame to station B.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And why your mobile phone can't connect with ad-hoc networks? I believe here is the answer: &lt;a href=&quot;https://stackoverflow.com/questions/5100928/how-to-connect-android-wifi-to-adhoc-wifi&quot;&gt;https://stackoverflow.com/questions/5100928/how-to-connect-android-wifi-to-adhoc-wifi&lt;/a&gt; (at least for Android).&lt;/p&gt;&#xA;" OwnerUserId="15977" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2015-06-17T19:49:36.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19292" PostTypeId="2" ParentId="19286" CreationDate="2015-06-17T20:36:43.030" Score="2" Body="&lt;p&gt;The codec, the format, and the underlying network determine the quality of the video played out to your viewport/monitor.  In case of &lt;a href=&quot;https://en.wikipedia.org/wiki/Dynamic_Adaptive_Streaming_over_HTTP&quot; rel=&quot;nofollow&quot;&gt;adaptive bitrate streaming&lt;/a&gt;, this quality may change mid stream as the network load changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transmission Control Protocol (TCP) uses a network congestion-avoidance algorithm but this does not necessarily result in equal division of link bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-17T20:36:43.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19296" PostTypeId="2" ParentId="6785" CreationDate="2015-06-18T01:32:55.287" Score="2" Body="&lt;p&gt;Came across this, and not sure if you ever got this working, but I was just working on the same thing, trying to get TWC working with an SRX. After some debugging, I found this in the traces:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jun 17 20:50:41 [DEBUG][default:default][N/A][INET6][ge-0/0/0.0] dhcpv6_client_validate_msgs: Server does not have rapid commit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had it working on a Cisco where I had to have rapid commit enabled to get anything from TWC, but apparently it doesn't work at all on the SRX. As soon as I removed the rapid-commit line from the config, bam, got an address!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm still hitting issues with the fact the SRX doesn't have any support for IA_PD hints, and TWC will not hand out a prefix larger than /64 unless you request it via hint, but at least it works now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After quite a bit of not very useful searching on the Internet, if anyone else needs to run traces on the dhcpv6 client, you need to enable traceoptions under system processes dhcp-service.&lt;/p&gt;&#xA;" OwnerUserId="16025" LastActivityDate="2015-06-18T01:32:55.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19300" PostTypeId="1" AcceptedAnswerId="19310" CreationDate="2015-06-18T04:04:15.583" Score="1" ViewCount="5687" Body="&lt;p&gt;In 3GPP spesification vocabulary document &lt;a href=&quot;http://www.3gpp.org/DynaReport/21905.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.3gpp.org/DynaReport/21905.htm&lt;/a&gt;. I could not find definition for abbreviation definition for &quot;SA&quot;, SA1 and soon that occur in 3GPP specification such as in Release document &lt;a href=&quot;http://www.3gpp.org/DynaReport/29274.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.3gpp.org/DynaReport/29274.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are these abbreviation stand for ?&lt;/p&gt;&#xA;" OwnerUserId="6260" LastActivityDate="2015-06-19T08:04:41.380" Title="What is SA, SA1, SA2, SA3, SA4 stand for in 3GPP Spesifications" Tags="|mobile|standardisation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19302" PostTypeId="1" AcceptedAnswerId="19307" CreationDate="2015-06-18T05:05:36.880" Score="3" ViewCount="869" Body="&lt;p&gt;I can't find any documentation supporting spanning-tree capabilities on SRX devices. I'm running a virtual image, which I thought was more-or-less the vSRX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root&amp;gt; show version           &#xA;Model: firefly-perimeter&#xA;JUNOS Software Release [12.1X47-D20.7]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But no commands like &lt;code&gt;show spanning-tree bridge&lt;/code&gt; are available. So either (a) I have the wrong virtual image, or (b) the SRX doesn't support spanning-tree features, which I kind of find hard to believe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;... or (c) I just don't know what command I &lt;em&gt;really&lt;/em&gt; want.&lt;/p&gt;&#xA;" OwnerUserId="4051" LastActivityDate="2015-07-09T19:16:00.470" Title="Does the Juniper SRX have spanning-tree capabilities?" Tags="|juniper-junos|spanning-tree|juniper-srx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19303" PostTypeId="2" ParentId="19277" CreationDate="2015-06-18T05:26:52.147" Score="0" Body="&lt;p&gt;@Ricky Beam. Man you so through the problem to the solution. I could not see that because I thought the host and the gateway being on the same LAN would be just fine. I was still having my mail server connected to the old ISP until I had sorted out the port forwarding issue. Thank you man and whoever has taken their time to look into my problem. I am so grateful.  Solution was to have my server to point to 192.168.1.21 as its gateway. Problem solved&lt;/p&gt;&#xA;" OwnerUserId="16007" LastActivityDate="2015-06-18T05:26:52.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19305" PostTypeId="1" AcceptedAnswerId="19318" CreationDate="2015-06-18T05:58:34.583" Score="4" ViewCount="4777" Body="&lt;p&gt;I'm trying to display all firewall rule associated with a specific interface. However, the best I can find is &lt;code&gt;show interfaces filters&lt;/code&gt;. I'm assuming since these are called &quot;filters&quot;, they're not the same as the &quot;rules&quot; from &lt;code&gt;show security application-firewall rule-sets all&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone enlighten me here?&lt;/p&gt;&#xA;" OwnerUserId="4051" LastActivityDate="2015-06-18T15:19:06.523" Title="Juniper SRX - interface filters vs firewall rules?" Tags="|juniper-junos|juniper-srx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19306" PostTypeId="1" AcceptedAnswerId="19309" CreationDate="2015-06-18T06:57:52.080" Score="3" ViewCount="1082" Body="&lt;p&gt;Let's say we have network 1.0.0.0/16.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shorter prefixs than /16 are /0-/15. How about smaller prefix? The term &quot;smaller prefix&quot; is found in BGP-related documents.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-06-18T07:25:55.130" Title="Shorter prefix vs smaller prefix" Tags="|bgp|prefix|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19307" PostTypeId="2" ParentId="19302" CreationDate="2015-06-18T06:58:13.720" Score="3" Body="&lt;p&gt;The vSRX doesn't support switching features, so the answer is: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(b) the SRX doesn't support spanning-tree features.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;vSRX is designed to be a virtual firewall, therefore it doesn't need &quot;switching&quot;. It's only the physical SRX devices, that support switching. &#xA;Take a look at &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/firefly12.1x47/information-products/topic-collections/firefly-perimeter/12.1X47/firefly-perimeter-release-notes.pdf&quot; rel=&quot;nofollow&quot;&gt;this product datasheet from Juniper&lt;/a&gt;, it lists all of the available features on that platform.&lt;/p&gt;&#xA;" OwnerUserId="13421" LastEditorUserId="3191" LastEditDate="2015-07-09T19:16:00.470" LastActivityDate="2015-07-09T19:16:00.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19308" PostTypeId="1" AcceptedAnswerId="19330" CreationDate="2015-06-18T07:10:58.430" Score="2" ViewCount="33254" Body="&lt;p&gt;I've been bashing my head against this for far to long. I'm hoping someone can help me out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm rebuilding a clients network and this is my first kick at routing. I decided to keep things simple. We are using 3x HP ProCurve 2920's. Two of them service user connections and the third one will act as our router and be where our server and other network uplink to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my VLAN layout:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN1 - Legacy / 192.168.11.0/24&#xA;VLAN10 - General Students / 10.0.0.0/23&#xA;VLAN11 - General Staff / 10.0.20.0/23&#xA;VLAN20 - Staff Wireless / 10.0.100.0/23&#xA;VLAN21 - Student Wireless / 10.0.120.0/23&#xA;VLAN22 - Public Wireless / 10.0.140.0/23&#xA;VLAN30 - Servers / 10.0.200.0/23&#xA;VLAN40 - Management / 10.0.220.0/23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VLAN1 is the existing flat network. I am trying not to disrupt network outages while I get things working so I've left it in place on the new ProCurves. VLAN1 is currently working just fine but I suspect that is because DHCP is still handing out the firewalls IP as the default gateway and not the new .254 address I've created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our firewall is a Cisco RV016 and is currently in gateway mode with RIP disabled. Once I get inter-VLAN routing working I suspect I either need to create a static route that points to the Cisco for 0.0.0.0/0.0.0.0 or enable RIP routing on the firewall. For now I want to get inter-VLAN routing work and I'll tackle the firewall after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done the following on all three switches:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Enabled Routing&lt;/li&gt;&#xA;&lt;li&gt;Defined VLANs&lt;/li&gt;&#xA;&lt;li&gt;Configured tagging for the VLANs on the uplink ports&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've done the following on our routing switch:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Given each VLAN an IP address to act as the VLANs gateway (all end in .254)&lt;/li&gt;&#xA;&lt;li&gt;Enabled RIPv2 on all VLANs (including VLAN1)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here is the switch config of our routing switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; J9729A Configuration Editor; Created on release #WB.15.16.0008&#xA;; Ver #06:0c.fc.f3.ff.37.2d:e0&#xA;&#xA;hostname &quot;LKS-S-04&quot;&#xA;module 1 type j9729a&#xA;trunk 45-46 trk1 lacp&#xA;trunk 47-48 trk2 lacp&#xA;sntp 300&#xA;sntp server priority 1 192.168.11.10&#xA;no telnet-server&#xA;time timezone -480&#xA;no web-management&#xA;ip routing&#xA;interface 45&#xA;   flow-control&#xA;   name &quot;LKS-S-02:45&quot;&#xA;   exit&#xA;interface 46&#xA;   flow-control&#xA;   name &quot;LKS-S-02:46&quot;&#xA;   exit&#xA;interface 47&#xA;   flow-control&#xA;   name &quot;LKS-S-03:47&quot;&#xA;   exit&#xA;interface 48&#xA;   flow-control&#xA;   name &quot;LKS-S-03:48&quot;&#xA;   exit&#xA;no snmp-server enable&#xA;oobm&#xA;   ip address 192.168.11.251 255.255.255.0&#xA;   ip default-gateway 192.168.11.1&#xA;   exit&#xA;router rip&#xA;   redistribute connected&#xA;   enable&#xA;   exit&#xA;vlan 1&#xA;   name &quot;VLAN1 - School Scope (LEGACY)&quot;&#xA;   untagged 1-44,A1-A2,B1-B2,Trk1-Trk2&#xA;   ip address 192.168.11.254 255.255.255.0&#xA;   ip rip 192.168.11.254&#xA;   exit&#xA;vlan 10&#xA;   name &quot;VLAN10 - General Students&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.1.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   ip rip 10.0.1.254&#xA;   exit&#xA;vlan 11&#xA;   name &quot;VLAN11 - General Staff&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.21.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   ip rip 10.0.21.254&#xA;   exit&#xA;vlan 20&#xA;   name &quot;VLAN20 - Staff Wireless&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.101.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   ip rip 10.0.101.254&#xA;   exit&#xA;vlan 21&#xA;   name &quot;VLAN21 - Student Wireless&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.121.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   ip rip 10.0.121.254&#xA;   exit&#xA;vlan 22&#xA;   name &quot;VLAN22 - Public Wireless&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.141.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   ip rip 10.0.141.254&#xA;   exit&#xA;vlan 30&#xA;   name &quot;VLAN30 - Servers&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.201.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   ip rip 10.0.201.254&#xA;   exit&#xA;vlan 40&#xA;   name &quot;VLAN40 - Management&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.221.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   ip rip 10.0.221.254&#xA;   exit&#xA;spanning-tree Trk1 priority 4&#xA;spanning-tree Trk2 priority 4&#xA;no tftp server&#xA;no autorun&#xA;no dhcp config-file-update&#xA;no dhcp image-file-update&#xA;password manager&#xA;password operator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and here is one of my client access switches&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; J9729A Configuration Editor; Created on release #WB.15.16.0008&#xA;; Ver #06:0c.fc.f3.ff.37.2d:e0&#xA;&#xA;hostname &quot;LKS-S-02&quot;&#xA;module 1 type j9729a&#xA;trunk 45-46 trk1 lacp&#xA;sntp 300&#xA;sntp server priority 1 192.168.11.10&#xA;no telnet-server&#xA;time timezone -480&#xA;no web-management&#xA;ip routing&#xA;interface 45&#xA;   flow-control&#xA;   name &quot;LKS-S-04:45&quot;&#xA;   exit&#xA;interface 46&#xA;   flow-control&#xA;   name &quot;LKS-S-04:46&quot;&#xA;   exit&#xA;no snmp-server enable&#xA;oobm&#xA;   ip address 192.168.11.253 255.255.255.0&#xA;   ip default-gateway 192.168.11.1&#xA;   exit&#xA;router rip&#xA;   no redistribute connected&#xA;   enable&#xA;   exit&#xA;vlan 1&#xA;   name &quot;DEFAULT_VLAN&quot;&#xA;   untagged 1-44,47-48,A1-A2,B1-B2,Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 10&#xA;   name &quot;VLAN10 - General Students&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 11&#xA;   name &quot;VLAN11 - General Staff&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 20&#xA;   name &quot;VLAN20 - Staff Wireless&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 21&#xA;   name &quot;VLAN21 - Student Wireless&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 22&#xA;   name &quot;VLAN22 - Public Wireless&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 30&#xA;   name &quot;VLAN30 - Servers&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 40&#xA;   name &quot;VLAN40 - Management&quot;&#xA;   tagged Trk1&#xA;   ip address 10.0.220.2 255.255.254.0&#xA;   exit&#xA;spanning-tree Trk1 priority 4&#xA;no tftp server&#xA;no autorun&#xA;no dhcp config-file-update&#xA;no dhcp image-file-update&#xA;password manager&#xA;password operator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I give a client a static IP on any of the new VLANs it can ping it's default gateway regardless of which switch it's physically plugged into. It can't go any further than that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a 'show ip route' from the routing switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LKS-S-04(config)# show ip route&#xA;&#xA;                                                                     IP Route Entries&#xA;&#xA;  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.&#xA;  ------------------ --------------- ---- --------- ---------- ---------- -----&#xA;  10.0.0.0/23        VLAN10 - Gen... 10   connected            1          0&#xA;  10.0.20.0/23       VLAN11 - Gen... 11   connected            1          0&#xA;  10.0.100.0/23      VLAN20 - Sta... 20   connected            1          0&#xA;  10.0.120.0/23      VLAN21 - Stu... 21   connected            1          0&#xA;  10.0.140.0/23      VLAN22 - Pub... 22   connected            1          0&#xA;  10.0.200.0/23      VLAN30 - Ser... 30   connected            1          0&#xA;  10.0.220.0/23      VLAN40 - Man... 40   connected            1          0&#xA;  127.0.0.0/8        reject               static               0          0&#xA;  127.0.0.1/32       lo0                  connected            1          0&#xA;  192.168.11.0/24    VLAN1 - Scho... 1    connected            1          0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and from a client access switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LKS-S-02(config)# show ip route&#xA;&#xA;                                                                     IP Route Entries&#xA;&#xA;  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.&#xA;  ------------------ --------------- ---- --------- ---------- ---------- -----&#xA;  10.0.220.0/23      VLAN40 - Man... 40   connected            1          0&#xA;  127.0.0.0/8        reject               static               0          0&#xA;  127.0.0.1/32       lo0                  connected            1          0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routes aren't being picked up by the client access switches is my guess but I thought the whole point of RIP was that it took care of that for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any assistance would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 1 - 2015-06-18 @ 15:24&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've disabled routing on the two user access switches and disabled RIP on my RS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like I can put myself on any of those VLANs and ping any of the other new VLANs gateways but not other hosts that are currently on the new VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I still cannot get out to the internet (even with a default route on the RS to my firewall) AND I cannot access my 192.168.11.0 legacy network with or with out a static route to it assigned to my RS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the new config for the RS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; J9729A Configuration Editor; Created on release #WB.15.16.0008&#xA;; Ver #06:0c.fc.f3.ff.37.2d:e0&#xA;&#xA;hostname &quot;LKS-S-04&quot;&#xA;module 1 type j9729a&#xA;trunk 45-46 trk1 lacp&#xA;trunk 47-48 trk2 lacp&#xA;sntp 300&#xA;sntp server priority 1 192.168.11.10&#xA;no telnet-server&#xA;time timezone -480&#xA;no web-management&#xA;ip route 0.0.0.0 0.0.0.0 192.168.11.1&#xA;ip route 192.168.11.0 255.255.255.0 192.168.11.1&#xA;ip routing&#xA;interface 45&#xA;   flow-control&#xA;   name &quot;LKS-S-02:45&quot;&#xA;   exit&#xA;interface 46&#xA;   flow-control&#xA;   name &quot;LKS-S-02:46&quot;&#xA;   exit&#xA;interface 47&#xA;   flow-control&#xA;   name &quot;LKS-S-03:47&quot;&#xA;   exit&#xA;interface 48&#xA;   flow-control&#xA;   name &quot;LKS-S-03:48&quot;&#xA;   exit&#xA;no snmp-server enable&#xA;oobm&#xA;   ip address 192.168.11.251 255.255.255.0&#xA;   ip default-gateway 192.168.11.1&#xA;   exit&#xA;vlan 1&#xA;   name &quot;VLAN1 - School Scope (LEGACY)&quot;&#xA;   no untagged 8-9&#xA;   untagged 1-7,10-44,A1-A2,B1-B2,Trk1-Trk2&#xA;   ip address 192.168.11.254 255.255.255.0&#xA;   exit&#xA;vlan 10&#xA;   name &quot;VLAN10 - General Students&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.1.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   exit&#xA;vlan 11&#xA;   name &quot;VLAN11 - General Staff&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.21.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   exit&#xA;vlan 20&#xA;   name &quot;VLAN20 - Staff Wireless&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.101.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   exit&#xA;vlan 21&#xA;   name &quot;VLAN21 - Student Wireless&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.121.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   exit&#xA;vlan 22&#xA;   name &quot;VLAN22 - Public Wireless&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.141.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   exit&#xA;vlan 30&#xA;   name &quot;VLAN30 - Servers&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.201.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   exit&#xA;vlan 40&#xA;   name &quot;VLAN40 - Management&quot;&#xA;   untagged 8-9&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.221.254 255.255.254.0&#xA;   ip helper-address 192.168.11.10&#xA;   exit&#xA;vlan 99&#xA;   name &quot;ROUTING&quot;&#xA;   tagged Trk1-Trk2&#xA;   ip address 10.0.250.4 255.255.255.0&#xA;   exit&#xA;spanning-tree Trk1 priority 4&#xA;spanning-tree Trk2 priority 4&#xA;no tftp server&#xA;no autorun&#xA;no dhcp config-file-update&#xA;no dhcp image-file-update&#xA;password manager&#xA;password operator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and here is one of the client switches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;; J9729A Configuration Editor; Created on release #WB.15.16.0008&#xA;; Ver #06:0c.fc.f3.ff.37.2d:e0&#xA;&#xA;hostname &quot;LKS-S-02&quot;&#xA;module 1 type j9729a&#xA;trunk 45-46 trk1 lacp&#xA;sntp 300&#xA;sntp server priority 1 192.168.11.10&#xA;no telnet-server&#xA;time timezone -480&#xA;no web-management&#xA;interface 45&#xA;   flow-control&#xA;   name &quot;LKS-S-04:45&quot;&#xA;   exit&#xA;interface 46&#xA;   flow-control&#xA;   name &quot;LKS-S-04:46&quot;&#xA;   exit&#xA;no snmp-server enable&#xA;oobm&#xA;   ip address 192.168.11.253 255.255.255.0&#xA;   ip default-gateway 192.168.11.1&#xA;   exit&#xA;vlan 1&#xA;   name &quot;DEFAULT_VLAN&quot;&#xA;   no untagged 47&#xA;   untagged 1-44,48,A1-A2,B1-B2,Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 10&#xA;   name &quot;VLAN10 - General Students&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 11&#xA;   name &quot;VLAN11 - General Staff&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 20&#xA;   name &quot;VLAN20 - Staff Wireless&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 21&#xA;   name &quot;VLAN21 - Student Wireless&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 22&#xA;   name &quot;VLAN22 - Public Wireless&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 30&#xA;   name &quot;VLAN30 - Servers&quot;&#xA;   tagged Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 40&#xA;   name &quot;VLAN40 - Management&quot;&#xA;   untagged 47&#xA;   tagged Trk1&#xA;   ip address 10.0.220.2 255.255.254.0&#xA;   exit&#xA;vlan 99&#xA;   name &quot;ROUTING&quot;&#xA;   tagged Trk1&#xA;   ip address 10.0.250.2 255.255.255.0&#xA;   exit&#xA;spanning-tree Trk1 priority 4&#xA;no tftp server&#xA;no autorun&#xA;no dhcp config-file-update&#xA;no dhcp image-file-update&#xA;password manager&#xA;password operator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and routes on the RS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.&#xA;  ------------------ --------------- ---- --------- ---------- ---------- -----&#xA;  0.0.0.0/0          192.168.11.1    1    static               1          1&#xA;  10.0.0.0/23        VLAN10 - Gen... 10   connected            1          0&#xA;  10.0.20.0/23       VLAN11 - Gen... 11   connected            1          0&#xA;  10.0.100.0/23      VLAN20 - Sta... 20   connected            1          0&#xA;  10.0.120.0/23      VLAN21 - Stu... 21   connected            1          0&#xA;  10.0.140.0/23      VLAN22 - Pub... 22   connected            1          0&#xA;  10.0.200.0/23      VLAN30 - Ser... 30   connected            1          0&#xA;  10.0.220.0/23      VLAN40 - Man... 40   connected            1          0&#xA;  10.0.250.0/24      ROUTING         99   connected            1          0&#xA;  127.0.0.0/8        reject               static               0          0&#xA;  127.0.0.1/32       lo0                  connected            1          0&#xA;  192.168.11.0/24    VLAN1 - Scho... 1    connected            1          0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and from the firewall: &lt;a href=&quot;https://img.fizi.ca/di/DMIC/firewallRoutes.png&quot; rel=&quot;nofollow&quot;&gt;https://img.fizi.ca/di/DMIC/firewallRoutes.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and a sample static routes I've configured on the firewall to access the new VLANs: &lt;a href=&quot;https://img.fizi.ca/di/24OO/staticRoutes.png&quot; rel=&quot;nofollow&quot;&gt;https://img.fizi.ca/di/24OO/staticRoutes.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So close!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update - 2015-06-18 @ 16:49&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Progress. I found the error I made configuring the routes on the RV016. I should have set the gateway to 192.168.11.254 (the IP for VLAN 1 that resides on my RS). That looks like it fixed everything.&lt;/p&gt;&#xA;" OwnerUserId="16030" LastEditorUserId="775" LastEditDate="2015-06-20T16:11:47.203" LastActivityDate="2015-06-20T16:11:47.203" Title="Inter-VLAN Routing on a ProCurve 2920" Tags="|routing|switch|vlan|hp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19309" PostTypeId="2" ParentId="19306" CreationDate="2015-06-18T07:25:55.130" Score="4" Body="&lt;p&gt;I would assume /17 to /32 are the smaller prefixes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Prefix is used as a synonym (1) for network in this case. The prefixes are longer, thus the networks they describe are smaller. I can see this could indeed be considered confusing, smaller as the opposite of shorter, but that's natural languages for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(1) It's probably a metonym, but that's a discussion for a different stack exchange site...&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-06-18T07:25:55.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19310" PostTypeId="2" ParentId="19300" CreationDate="2015-06-18T08:03:53.230" Score="1" Body="&lt;p&gt;SA is the 3GPP Technical Specification Group on &lt;strong&gt;&lt;em&gt;Service and System Aspects&lt;/em&gt;&lt;/strong&gt;. There are subgroups on different topics:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SA1: Services&lt;/li&gt;&#xA;&lt;li&gt;SA2: Architecture&lt;/li&gt;&#xA;&lt;li&gt;SA3: Security&lt;/li&gt;&#xA;&lt;li&gt;SA4: Codec&lt;/li&gt;&#xA;&lt;li&gt;SA5: Telecom Management&lt;/li&gt;&#xA;&lt;li&gt;SA6: Mission-critical Applications&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can find more info on the &lt;a href=&quot;http://www.3gpp.org/specifications-groups/sa-plenary&quot; rel=&quot;nofollow&quot;&gt;3GPP website&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2015-06-19T08:04:41.380" LastActivityDate="2015-06-19T08:04:41.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19311" PostTypeId="1" AcceptedAnswerId="19345" CreationDate="2015-06-18T09:30:53.567" Score="1" ViewCount="599" Body="&lt;p&gt;Using a 2900 series router and I encounter the following issue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname#show flow monitor&#xA;  Flow Monitor TESTFLOW:&#xA;  Description:       User defined&#xA;  Flow Record:       TESTFLOW&#xA;  Flow Exporter:     TESTFLOW (inactive)&#xA;  Cache:&#xA;    Type:              normal&#xA;    Status:            allocated&#xA;    Size:              4096 entries / 10404496 bytes&#xA;    Inactive Timeout:  15 secs&#xA;    Active Timeout:    1800 secs&#xA;    Update Timeout:    1800 secs&#xA;&#xA;&#xA;hostname#show flow exporter&#xA;Flow Exporter TESTFLOW:&#xA;  Description:              User defined&#xA;  Export protocol:          NetFlow Version 9&#xA;  Transport Configuration:&#xA;    Destination IP address: 192.168.x.x&#xA;    Source IP address:      172.16.x.x&#xA;    Source Interface:       GigabitEthernet0/0&#xA;    Transport Protocol:     UDP&#xA;    Destination Port:       3008&#xA;    Source Port:            61496&#xA;    DSCP:                   0x0&#xA;    TTL:                    255&#xA;    Output Features:        Used&#xA;  Options Configuration:&#xA;    exporter-stats (timeout 100 seconds)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why does the &lt;code&gt;Flow Exporter:     TESTFLOW (inactive)&lt;/code&gt; appear?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I set it to active?&lt;/p&gt;&#xA;" OwnerUserId="1690" LastEditorUserId="3191" LastEditDate="2015-07-19T18:13:05.257" LastActivityDate="2017-08-14T11:31:04.920" Title="cisco flow vs ip flow" Tags="|cisco|cisco-ios|netflow|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19314" PostTypeId="1" AcceptedAnswerId="19315" CreationDate="2015-06-18T13:40:36.407" Score="10" ViewCount="12138" Body="&lt;p&gt;When I googled I found a lot statements about this. Like..&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Ethernet is not an application protocol. But I'd still give it the description &quot;protocol&quot;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A network protocol defines rules and conventions for communication between network devices.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Ethernet is an entire communication stack&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Ethernet is a family of computer networking technologies for LANs and MANs&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Ethernet is just the Physical layer and the Data Link layer.  By itself Ethernet does nothing; it’s just the “pipe.”  &lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Wholehearted agreement that Ethernet is NOT a protocol. Ethernet is not much different than say RS-485. I use the analogy that Ethernet is the express service for sending packages while serial is dial-up modem or truck transport. The Sea Container or pallet (the packet) is oblivious to how it is being carried.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm confused by reading these all. Can just help me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can we say Ethernet as a protocol?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="16027" LastEditorUserId="775" LastEditDate="2015-06-20T16:10:56.930" LastActivityDate="2022-11-20T14:07:03.727" Title="Is Ethernet a protocol?" Tags="|ethernet|protocol-theory|lan|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19315" PostTypeId="2" ParentId="19314" CreationDate="2015-06-18T14:04:58.860" Score="10" Body="&lt;p&gt;Well, it (obviously) depends on how you define a protocol.  If we take Wikipedia's definition:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In telecommunications, a communication protocol is a system of rules&#xA;  that allow two or more entities of a communication system to&#xA;  communicate between them to transmit information via any kind of&#xA;  variation of a physical quantity. These are the rules or standard that&#xA;  defines the syntax, semantics and synchronization of communication and&#xA;  possible error recovery methods. Protocols may be implemented by&#xA;  hardware, software, or a combination of both.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;then I think it's safe to say Ethernet meets those criteria.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this boils down to a semantic issue, and nothing generates more debate than a philosophical argument, let the flaming begin ;-)&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="10539" LastEditDate="2015-07-14T15:01:23.090" LastActivityDate="2015-07-14T15:01:23.090" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19317" PostTypeId="2" ParentId="19314" CreationDate="2015-06-18T15:05:19.310" Score="3" Body="&lt;p&gt;It depends on how you use the word.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to engineer to it, there is an Ethernet Protocol to follow (802.3 or Ethernet II).  You can use the Ethernet Protocol on top of other protocols (PPPoE is an example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the time when I use the word Ethernet, I am not talking about a protocol, I am talking about a whole system or an general concept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Miriam-Webster says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ETHERNET&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;:  a computer network architecture consisting of various specified&#xA;  local-area network protocols, devices, and connection methods&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, ETHERNET is not equal to ETHERNET PROTOCOL&lt;/p&gt;&#xA;" OwnerUserId="16033" LastActivityDate="2015-06-18T15:05:19.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19318" PostTypeId="2" ParentId="19305" CreationDate="2015-06-18T15:19:06.523" Score="3" Body="&lt;p&gt;You are correct, these are not the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&quot;Interface Filters&quot; / Firewall Filters&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;show interfaces filters&lt;/code&gt; command is used to show what &lt;strong&gt;firewall filters&lt;/strong&gt; are applied to each interface, and in which direction.  Firewall filters are supported on just about every Juniper hardware platform.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jhead@MX-WS-ZT-1&amp;gt; show interfaces filters ge-0/0/0&#xA;Interface       Admin Link Proto Input Filter         Output Filter&#xA;ge-0/0/0        up    up&#xA;ge-0/0/0.0      up    up   inet  MGMT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In a general sense, firewall filters are far less robust than the application firewall feature.  They cannot do deep packet inspection (they operate on Layers 3 and 4), they can see things like source/destination IP or source/destination port.  The most common use for firewall filters is to protect your control/management plane on a Juniper device, here's a very basic example on how to only allow SSH.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; Firewall filters are generally called ACL's by other vendors and the industry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; Firewall filters can also be used in CoS configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jhead@SRX1&amp;gt; show configuration firewall&#xA;    family inet {&#xA;        filter MGMT {&#xA;            term SSH {&#xA;                from {&#xA;                    port 22;&#xA;                }&#xA;                then accept;&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;jhead@SRX1&amp;gt; show configuration interfaces ge-0/0/0&#xA;unit 0 {&#xA;    family inet {&#xA;        filter {&#xA;            input MGMT;&#xA;        }&#xA;        address 172.16.67.2/24;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want some good information, check out the &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.1/information-products/pathway-pages/config-guide-firewall-filter/config-guide-firewall-filter.html&quot; rel=&quot;nofollow&quot;&gt;Juniper Documentation&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Application Firewall&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other command you referenced, &lt;code&gt;show security application-firewall rule-sets all&lt;/code&gt; relates to SRX's application firewall feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The full feature set of application firewalls can get pretty unwieldy, but in short they do a much more thorough analysis of the traffic.  If you check out the &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/concept/application-firewall-overview.html&quot; rel=&quot;nofollow&quot;&gt;Application Firewall Overview&lt;/a&gt; you'll see the following text:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Many dynamic applications use HTTP static ports to tunnel non-HTTP&#xA;  traffic through the network. Such applications can send traffic that&#xA;  might not be adequately controlled by standard network firewall&#xA;  policies, leading to a security threat. &lt;strong&gt;Standard policies function&#xA;  based on IP address and port and therefore are not effective with&#xA;  these dynamic applications.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The reference to &quot;standard network firewall policies&quot; is pretty much a direct comparison to the above mentioned &quot;firewall filters&quot;.  Let me know if this isn't clear, and I'll happily edit my answer.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-06-18T15:19:06.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19321" PostTypeId="1" AcceptedAnswerId="19323" CreationDate="2015-06-18T17:00:55.563" Score="10" ViewCount="1764" Body="&lt;p&gt;Is SDN a buzzword or is it a protocol, standard, or recommendation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What differentiates SDN from VMware NSX, for example?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="33" LastEditDate="2015-06-22T19:20:09.567" LastActivityDate="2023-11-10T17:29:31.787" Title="What Exactly is SDN?" Tags="|architecture|sdn|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19322" PostTypeId="1" AcceptedAnswerId="19333" CreationDate="2015-06-18T17:17:15.990" Score="2" ViewCount="146" Body="&lt;p&gt;One of my branch sites far out of town experiences primary link failure from time to time which is very disruptive. All they have in terms of connectivity is a T1 for data and PRI for voice.  Would it be possible for me to configure a backup link for data (not voice) traffic using my Callmanager's PRI?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-06-19T01:07:41.357" LastActivityDate="2015-06-19T01:07:41.357" Title="Branch Site Network Redundancy w/ ISDN PRIs" Tags="|backups|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19323" PostTypeId="2" ParentId="19321" CreationDate="2015-06-18T17:29:52.723" Score="6" Body="&lt;p&gt;I am assuming you are talking about Software Defined Networking. Currently state of the art networks make forwarding decisions within your networking infrastructure. Example - bridge tables are built dynamically from source MAC packets - routing decisions are made off of route tables built from dynamic routing protocol (eigrp/ospf/etc.).&#xA;In SDN the network infrastructure is simply viewed as a forwarding plane and takes forwarding direction from a central controller (the control plane, an application running on a server somewhere). So each networking device layer2/layer3 would query the controller for forwarding decisions.&lt;/p&gt;&#xA;&lt;p&gt;This is a decent article on the subject:&#xA;&lt;a href=&quot;http://searchsdn.techtarget.com/definition/software-defined-networking-SDN&quot; rel=&quot;nofollow noreferrer&quot;&gt;SDN&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The Wikipedia page goes into a more in-depth discussion of the history and motives:&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Software-defined_networking&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15982" LastEditorUserId="36720" LastEditDate="2023-11-10T17:29:31.787" LastActivityDate="2023-11-10T17:29:31.787" CommentCount="11" ContentLicense="CC BY-SA 4.0" />
  <row Id="19325" PostTypeId="2" ParentId="19314" CreationDate="2015-06-18T18:07:33.520" Score="0" Body="&lt;p&gt;It's a &lt;em&gt;standard&lt;/em&gt;.  The &lt;a href=&quot;http://www.ieee802.org/&quot; rel=&quot;nofollow&quot;&gt;IEEE 802® LAN/MAN Standards Committee&lt;/a&gt; develops LAN and metropolitan area network (MAN) standards.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-18T18:07:33.520" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19326" PostTypeId="1" CreationDate="2015-06-18T18:35:17.140" Score="1" ViewCount="1181" Body="&lt;p&gt;Re posting from Unix forum as it may be appropriate for networking forum&#xA;I have the following setup&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Linux1--------------------------------------------Linux2&#xA;eth0 10.10.10.30                                  eth0 10.10.10.10&#xA;eth0.50 20.20.20.30                               eth0.50 20.20.20.20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to enable DSCP to p bit mapping for all packets going out from Linux1 to Linux2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ping i used on Linux1 is from busybox ( doesnt have -Q option).I have to use iptables to set dscp&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i use the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# iptables -t mangle -A POSTROUTING -p icmp -j DSCP --set-dscp 49&#xA;iptables: No chain/target/match by that name.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do not know what could be wrong. I read online that i have to set DSCP and SKB priority and then map skb priority to pbits, I also use the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vconfig set_egress_map eth0.50 49 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This always sets the PRI bit to 3. But i do not see the DSCP value set in the outgoing packets IP header.&lt;/p&gt;&#xA;" OwnerUserId="16038" LastEditorUserId="16038" LastEditDate="2015-06-18T19:26:40.530" LastActivityDate="2015-06-18T19:26:40.530" Title="DSCP to p bit mapping in Linux" Tags="|dscp|" AnswerCount="0" CommentCount="1" ClosedDate="2015-06-20T19:47:16.747" ContentLicense="CC BY-SA 3.0" />
  <row Id="19328" PostTypeId="2" ParentId="19322" CreationDate="2015-06-18T20:18:51.010" Score="3" Body="&lt;p&gt;If you're not using all your bearer channels for voice, you can provision some of them for data.  Practically speaking, you would need to use at least half (12 channels).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming that if the office is small enough that a data T1 is sufficient, you don't need very many bearer channels for voice.  The channels have to be one or the other.   I suppose if it's a call center or something similar, that assumption doesn't hold.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-06-18T20:18:51.010" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19329" PostTypeId="2" ParentId="19322" CreationDate="2015-06-18T20:19:06.017" Score="2" Body="&lt;p&gt;Dial backup is (almost) always an option, either to a dailup ISP or direct to one of your other sites. This depends on the capability of your router(s) and PBX(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simplest is an external analog modem connected to one of the router's serial ports. (commonly done on a Cisco AUX port, but there are limitations there.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more complex, and expensive option -- if your PBX can do it -- is an ISDN BRI. That can be directly to the router, or again, through an external &quot;modem&quot; (TA).&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-18T20:19:06.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19330" PostTypeId="2" ParentId="19308" CreationDate="2015-06-18T21:01:46.740" Score="1" Body="&lt;p&gt;Your access switches operate at layer-2 -- they're &quot;just switches&quot;. At layer-2, everything funnels back to the routing-switch. The routing switch then moves (&quot;routes&quot;) traffic between vlans. All of this looks fine, so far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is, you cannot ping anything in 192.168.11.0/24 from any of the other VLANs? (i.e. the firewall and thus the path to the internet) That's because nothing else in the network knows about the other networks. Traffic is getting &lt;em&gt;to&lt;/em&gt; 192.168.11.0/24, but the reply will follow the default route to the firewall, or if you ping the firewall, it's default towards the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to talk to things in the other vlans from any of the new vlans, because they're default gateway is the routing-switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(also, I cannot recommend the use of RIP. EVER. Your network is tiny and (mostly) static, so it's unnecessary. The firewall is the only thing that needs to know about the other networks.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-18T21:01:46.740" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19331" PostTypeId="2" ParentId="667" CreationDate="2015-06-18T21:52:42.983" Score="2" Body="&lt;p&gt;The purpose of the messy wiring on the right is to degrade service on the lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I kid... slightly. That's the result. The purpose is to save time. The excess ends (you can see a green wire pointing up from the metal bracket going nowhere) are sometimes called &quot;pigtails.&quot; Some current can bounce back off of these and degrade service. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The proper thing to do is to trim the excess ends where you punched them down. The proper thing to do is to organize your wiring, and perform preventative maintenance including trimming the ends someone else failed to, organizing their wiring, tagging unidentified lines, etc... but these telco techs get ridden pretty damn hard in most places. Clients escalate everything, salesmen cut deals, bosses cut opex, and maintenance manning is considered a cost centre so while it may take 6 dudes to properly wire and maintain your area, you've got to do it with 3. You're going to leave pigtails, some wires won't get tagged, and the whole thing is going to be a mess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;... and I'm not one of these guys. I've just had to deal with the good and bad ones.&lt;/p&gt;&#xA;" OwnerUserId="7869" LastActivityDate="2015-06-18T21:52:42.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19332" PostTypeId="1" AcceptedAnswerId="19344" CreationDate="2015-06-18T22:22:24.237" Score="4" ViewCount="1546" Body="&lt;p&gt;Is there any way to detect full DHCP pool just from DHCP traffic?? &#xA;I assume for simplicity just one DHCP server in network.&#xA;I have found in &lt;strong&gt;RFC 2131&lt;/strong&gt;, that DHCP NAK is sent only in this case:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;Server to client indicating client's notion of network&#xA;                     address is incorrect (e.g., client has moved to new&#xA;                     subnet) or client's lease as expired.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I suppose DHCP NAK is not sent, when DHCP pool is full. But definitely it goes with full DHCP pool.&#xA;I have also found in this topic &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2814/best-practice-using-ciscos-ip-helper-for-dhcp&quot;&gt;Best practice using Cisco&amp;#39;s &amp;quot;ip-helper&amp;quot; for DHCP?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If a DHCP server's scope is full, it won't reply with a DHCPOffer...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I think when DHCP pool is full, clients will retransmit many DHCP DISCOVER, because of retransmitting algorithm defined in &lt;strong&gt;RFC 2131&lt;/strong&gt;. I don't see better way to detect full DHCP pool from DHCP traffic. If anyone have better idea to detect it just from sent packets I would be really glad. Thanks in advance. &lt;/p&gt;&#xA;" OwnerUserId="16041" LastEditorUserId="8499" LastEditDate="2018-12-26T05:30:58.690" LastActivityDate="2018-12-26T05:30:58.690" Title="Detect DHCP pool is full from monitored DHCP traffic" Tags="|dhcp|protocol-theory|rfc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19333" PostTypeId="2" ParentId="19322" CreationDate="2015-06-18T22:45:06.427" Score="-1" Body="&lt;p&gt;It's called &lt;strong&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/voice/isdn/configuration/15-mt/vi-15-mt-book/vi-pri-if-msar.html#GUID-C1A7C96A-7F2B-4AAB-AF1F-9B1086FB18CC&quot; rel=&quot;nofollow noreferrer&quot;&gt;Integrated Services for Multiple Call Types&lt;/a&gt;&lt;/strong&gt;.  This IOS feature is 10 years old or so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ySiwg.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISDN interfaces can support both data calls and voice calls. Typically, this is done using one interface for data and another for voice. This feature enables data (dial-in, dial-on-demand routing [DDR], and DDR backup) and voice call traffic to occur simultaneously from the supported ISDN PRI interfaces. To enable integrated services, the interface used for incoming voice calls is configured to accept multiple voice call types.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-18T22:45:06.427" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19334" PostTypeId="2" ParentId="17388" CreationDate="2015-06-18T22:55:53.947" Score="0" Body="&lt;p&gt;It turns out that all traffic is going back out the same interface it came in on. So, traffic that did not have a VIP or other policy took the default route out to the internet. So if traffic came in to looking for IP ABC.ABC.ABC.ADF went back out the same way ignoring the default gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the claims that when Client A contacted Client be out interface 0/1 and Client B responded through interface 0/0 were completely false.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regardles, I had some great feedback from everyone, Thanks everyone!&lt;/p&gt;&#xA;" OwnerUserId="14372" LastActivityDate="2015-06-18T22:55:53.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19335" PostTypeId="2" ParentId="18437" CreationDate="2015-06-18T22:56:04.123" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;While I completely agree with this design, I'm looking at the &quot;why?&quot;. Why is this the best design?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Think about it in simple practical terms. What kinds of intelligence are we talking about?  Two concrete examples that often come quickly to mind would be the processing of ACLs (or the like) and QoS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now consider what happens if you place this intelligence at the core. Data will have to be carried over &quot;some number&quot; of links and devices before it reaches the core to be processed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of traffic that would be dropped by ACL, this traffic is now carried further into the network and takes up resources (whether these are bandwidth, CPU cycles, memory, or anything else) that may be needed by other legitimate traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of QoS, unless you trust end devices to properly mark traffic (bad idea), traffic would have to travel some distance unmarked until it reaches the core. If there is link congestion on the way to the core, any priority traffic will be treated the same as your best effort traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't take a RFC or standard to see it is better to do this type of processing as close to the edge as possible.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-06-18T22:56:04.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19336" PostTypeId="2" ParentId="19321" CreationDate="2015-06-18T23:15:24.490" Score="-2" Body="&lt;h3&gt;SDN, software defined networking&lt;/h3&gt;&#xA;&lt;p&gt;SDN, software defined networking, is defined by the Open Networking Foundation (ONF) as&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The physical separation of the network control plane from the&#xA;forwarding plane, and where a control plane controls several devices. [...and...] the OpenFlow® protocol is a foundational element for building SDN&#xA;solutions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Where Open SDN &lt;a href=&quot;https://www.opennetworking.org/openflow-conformance-certification&quot; rel=&quot;nofollow noreferrer&quot;&gt;favors OpenFlow®&lt;/a&gt;, commercial networking incumbents market their own flavors of SDN fashioned programmable network systems, e.g. Cisco ACI™ and VMware NSX® (the &lt;em&gt;Software-Defined Data Center, SDDC&lt;/em&gt;).  Cisco's Meraki cloud managed devices utilize, but make no mention of, an underlying SDN architecture.  Lastly, the Term SDN was first mentioned in an MIT Academic Article on OpenFlow Greene, K. 2009. TR10: software-defined networking.&lt;/p&gt;&#xA;&lt;h3&gt;SDN and Cloud Computing&lt;/h3&gt;&#xA;&lt;p&gt;Whereas SDN is an architecture for a programmable &lt;em&gt;network&lt;/em&gt;; OpenStack, Eucalyptus, vCloud Air™, and Apache CloudStack™ are architectures for programmable &lt;em&gt;clouds&lt;/em&gt; (i.e. network, memory, i/o, and storage). Programmable cloud compute systems may or may not use SDN.  For example, OpenStack's Neutron element&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;can be viewed as orthogonal to SDN since it can integrate with&#xA;traditional networks with existing protocols [&lt;a href=&quot;https://www.sdxcentral.com/cloud/open-source/definitions/openstack-networking/&quot; rel=&quot;nofollow noreferrer&quot;&gt;What is OpenStack Networking?&lt;/a&gt;].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;The Benefit&lt;/h3&gt;&#xA;&lt;p&gt;Automated distributed smart ports.  Today, you link to a wired or wireless LAN which may include networking control features such as routing, firewall, optimizing, VLAN's etc.  With SDN, these control features are available at the NIC/vNIC and are programmable via the SDN controller.&lt;/p&gt;&#xA;&lt;h3&gt;The Driver&lt;/h3&gt;&#xA;&lt;p&gt;SDN architectures are being adopted and driven by the deployment of private clouds such as OpenStack, Eucalyptus, vCloud Air™, and Apache CloudStack™.&lt;/p&gt;&#xA;&lt;p&gt;OpenStack's Neutron project, providing networking as a service between interface devices (e.g., vNICs), recognizes SDN as a possible networking solution for OpenStack Clouds [&lt;a href=&quot;https://www.openstack.org/summit/openstack-summit-hong-kong-2013/session-videos/presentation/opendaylight-an-open-source-sdn-for-your-openstack-cloud&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenDaylight: An Open Source SDN for Your OpenStack Cloud&lt;/a&gt;].&lt;/p&gt;&#xA;&lt;p&gt;Eucalyptus Virtual Private Cloud (VPC) support is implemented with a Software-Defined Networking (SDN) technology [&lt;a href=&quot;https://docs.hpcloud.com/eucalyptus/4.3.0/install-guide/preparing_vpc_midonet.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding VPC and MidoNet&lt;/a&gt;].&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-11-17T01:16:31.407" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="19337" PostTypeId="2" ParentId="6938" CreationDate="2015-06-18T23:27:00.613" Score="0" Body="&lt;p&gt;The problem is, if you DO use Channel 3, you will still get interference from the channels you think you're avoiding.&#xA;Channel 3 will get interference from channels 1 &amp;amp; 6.  Interference from an adjacent channel is more disruptive to both you and your neighbours than same channel.&lt;/p&gt;&#xA;" OwnerUserId="16042" LastActivityDate="2015-06-18T23:27:00.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19340" PostTypeId="2" ParentId="19332" CreationDate="2015-06-19T01:20:51.950" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://dhcpd-pools.sourceforge.net/&quot; rel=&quot;nofollow&quot;&gt;ISC dhcpd lease analysis and reporting&lt;/a&gt; on sourceforge.net?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-19T01:20:51.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19341" PostTypeId="2" ParentId="7014" CreationDate="2015-06-19T01:41:47.753" Score="0" Body="&lt;p&gt;It likely hangs because upon pasting &amp;quot;the first statement is put into effect, and the implicit deny statement that follows could cause you immediate access problems.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Helpful Hints for Creating IP Access Lists&lt;/strong&gt; ¹&lt;/p&gt;&#xA;&lt;p&gt;•Create the access list before applying it to an interface. An interface with an empty access list applied to it permits all traffic.&lt;/p&gt;&#xA;&lt;p&gt;•Another reason to configure an access list before applying it is because if you applied a nonexistent access list to an interface and then proceed to configure the access list, the first statement is put into effect, and the implicit deny statement that follows could cause you immediate access problems.&lt;/p&gt;&#xA;&lt;p&gt;¹ &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2s/feature/guide/fsaclseq.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;source Cisco&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-06-19T01:41:47.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19343" PostTypeId="2" ParentId="17324" CreationDate="2015-06-19T07:15:03.137" Score="4" Body="&lt;p&gt;No, the picture does not use LER in the right place. In MPLS networks carrying MPLS VPNs, the PE is actually the first router doing MPLS, and is thus the one called Label Edge Router.&lt;/p&gt;&#xA;" OwnerUserId="513" LastActivityDate="2015-06-19T07:15:03.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19344" PostTypeId="2" ParentId="19332" CreationDate="2015-06-19T08:30:55.350" Score="2" Body="&lt;p&gt;You are correct, just by looking at a bit of DHCP traffic, it is impossible to determine if a server is out of addresses. You cannot distinguish an empty pool from a crashed server, since in both cases the server will not respond to a DHCPREQUEST.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Theoretically, if you have access to &lt;strong&gt;all&lt;/strong&gt; of the server's DHCP traffic &lt;strong&gt;from the very start&lt;/strong&gt;, and have some info about its configuration, you could keep track of all the leases it hands out and completely emulate its bookkeeping. This would allow you to know when the server has allocated all available addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you would need some knowledge about the DHCP pool. A DHCP range is often a subset of a subnet, so you would need to know which addresses are available. Also, when the admin sets up stuff like addresses to be handed out to specific MAC addresses, things become even more complicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm afraid the best place to determine if a server is out of addresses still is... the server itself.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2015-06-20T14:33:29.320" LastActivityDate="2015-06-20T14:33:29.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19345" PostTypeId="2" ParentId="19311" CreationDate="2015-06-19T08:34:09.963" Score="2" Body="&lt;p&gt;Solved: netflow record size was too big.&lt;/p&gt;&#xA;" OwnerUserId="1690" LastActivityDate="2015-06-19T08:34:09.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19346" PostTypeId="1" CreationDate="2015-06-19T08:35:41.610" Score="1" ViewCount="62" Body="&lt;p&gt;I currently have a catalyst switch configured with private VLANs and would like to mirror that traffic to an external system. I have tried creating a monitor session for the VLANs involved but that does not seem to help since I dont see any unicast traffic.&#xA;Has anyone done this before?&#xA;The issue is also that the firewall is a module in the same switch and hence I cannot mirror the port going to a firewall either. But perhaps there are other solutions to this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers.&lt;/p&gt;&#xA;" OwnerUserId="3124" LastActivityDate="2015-06-19T08:35:41.610" Title="Mirroring private vlan on catalyst switches" Tags="|cisco|cisco-catalyst|private-vlan|mirror|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19347" PostTypeId="1" AcceptedAnswerId="19785" CreationDate="2015-06-19T08:54:24.373" Score="1" ViewCount="72" Body="&lt;p&gt;We've started deploying cisco routers in pairs (867VAE-K9 in particular) to offer office sites failover using ip sla and HSRP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In testing I've been using 1841s and running the dialer over ethernet instead of adsl to confirm it works 95% but I don't have spare dsl lines to confirm it works with the comlete config that gets deployed so we test with PPPoE dialer and then adjust slightly when installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an 1841 set up to act as PPPoE server and that works peachy. I'd like to use the same box to simulate a dsl line instead and I kind of think you can do some back to back stuff with a WIC 1SHDSL V3. But it looks like I need to use the same card at each end. I want to be able to configure a wic-1adsl at the other end or use the built in dsl connection on one of the 867s. Is it possible and can someone point to a suitable reference to do this? Or does it need to be shdsl cards at both ends for a back to back?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="106" LastActivityDate="2015-11-05T10:13:23.203" Title="Testing PPPoA using WICs" Tags="|cisco|adsl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19350" PostTypeId="1" AcceptedAnswerId="19351" CreationDate="2015-06-19T10:23:10.407" Score="1" ViewCount="10306" Body="&lt;p&gt;I have a network designed in the image given below which is configured with RIPv2. I need to connect this network to the internet in simulation. How to simulate internet in cisco packet tracer? Thanks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jlxHV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jlxHV.png&quot; alt=&quot;network digram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16052" LastEditorUserId="3191" LastEditDate="2015-06-19T13:35:19.203" LastActivityDate="2015-06-19T13:35:19.203" Title="How to simulate the Internet in Cisco Packer Tracer?" Tags="|cisco|internet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19351" PostTypeId="2" ParentId="19350" CreationDate="2015-06-19T10:36:10.627" Score="1" Body="&lt;p&gt;Previously in packet tracer I have setup an additional router simulating google dns as the IP address (8.8.8.8) to act as the internet based location. This has helped as a simple simulation allowing test ACL's and routing.&lt;/p&gt;&#xA;" OwnerUserId="15807" LastActivityDate="2015-06-19T10:36:10.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19352" PostTypeId="1" AcceptedAnswerId="19361" CreationDate="2015-06-19T10:57:07.460" Score="2" ViewCount="1667" Body="&lt;p&gt;In Cisco IOS each interface has unique &lt;code&gt;ifIndex&lt;/code&gt; which is an integer &gt;0(AFAIK usually starts from 1). If &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/28420-ifIndex-Persistence.html&quot; rel=&quot;nofollow&quot;&gt;snmp-server ifindex persist&lt;/a&gt; is not used, then it is possible that &lt;code&gt;ifIndexes&lt;/code&gt; are mapped differently than before. Under which circumstances SNMP &lt;code&gt;ifIndex&lt;/code&gt; in Cisco IOS might change? I know that reload is one possible reason. Are there any other reasons which might cause SNMP &lt;code&gt;ifIndex&lt;/code&gt; to change?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-06-19T19:47:12.033" Title="Under which circumstances SNMP interface index(ifIndex) in Cisco IOS changes?" Tags="|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19353" PostTypeId="2" ParentId="17324" CreationDate="2015-06-19T15:18:46.920" Score="5" Body="&lt;p&gt;Let's clear up some terminology first, sorry if I repeat some things that you already know:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;LER:&lt;/strong&gt; This is a &quot;Label Edge Router&quot;.  These terminate MPLS LSP's.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;LSR:&lt;/strong&gt; This is a &quot;Label Switching Router&quot;.  This is &lt;strong&gt;ANY&lt;/strong&gt; router participating in MPLS.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;PE:&lt;/strong&gt; This is a &quot;Provider Edge&quot;.  This is the device that is controlled by the service provider, closest to the customer equipment.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;P:&lt;/strong&gt; This is a &quot;Provider&quot; router.  Because PEs are at the edge of a network, you might have routers connect between PEs in a provider network, that's what P routers do (transit).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;CE:&lt;/strong&gt; This is a &quot;Customer Edge&quot; router.  This is the device that is controlled by the customer, these connect to PEs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;The more appropriate topology would look like this:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/LbPXG.png&quot; alt=&quot;basic-mpls-network&quot;&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example, each device has the following roles in MPLS:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;CE1:&lt;/strong&gt; This is just a customer edge.  Typically, CE1 will use BGP to peer with PE1, though other options are available.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;PE1:&lt;/strong&gt; This router is an LER as it is the ingress router (first router in the MPLS network) for the LSP that carries CE1's traffic into the service providers network.  This is also an LSR, as it performs a role in MPLS.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;P:&lt;/strong&gt; This router is an LSR, it participates in MPLS.  This router is NOT an LER, as it does not &lt;strong&gt;TERMINATE&lt;/strong&gt; an LSP.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;PE2:&lt;/strong&gt; This router is also an LER as it is the egress router (last router in the MPLS LSP) for the LSP that carries traffic from CE1 to CE2 across the service providers network.  This is also an LSR as it performs a role in MPLS.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;CE2:&lt;/strong&gt; This is just a customer edge, just like CE1 it's probably going to be using BGP to peer with PE2.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You also had switches in the network, looking at your diagram it looks like your average switch, these will not participate directly in MPLS, and therefore are transparent to the network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This barely scratches the surface, if you want to learn more about MPLS you can start reading &lt;a href=&quot;http://www.juniper.net/assets/us/en/local/pdf/study-guide/study-guide-jncia.pdf&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt; in addition to the other resources you listed.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-06-19T15:18:46.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19354" PostTypeId="1" AcceptedAnswerId="19357" CreationDate="2015-06-19T15:36:48.183" Score="1" ViewCount="160" Body="&lt;p&gt;Out of my element here, but...imagine one person lives 100 miles away from the nearest internet exchange point, while another person lives 200 miles away, would there be a measurable difference on internet speed?&lt;/p&gt;&#xA;" OwnerUserId="16054" LastActivityDate="2015-06-19T16:53:46.097" Title="Does distance to nearest IXP affect download speeds?" Tags="|internet|route-server|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19356" PostTypeId="2" ParentId="19354" CreationDate="2015-06-19T16:40:30.643" Score="0" Body="&lt;p&gt;Practically, you would not be able to perceive a 100 mile difference as the &lt;a href=&quot;https://en.wikipedia.org/wiki/Transmission_time&quot; rel=&quot;nofollow&quot;&gt;transmission times&lt;/a&gt; are near the speed of light (186,000 mi/sec).  Technically, there is a difference in transmission time though.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-19T16:40:30.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19357" PostTypeId="2" ParentId="19354" CreationDate="2015-06-19T16:53:46.097" Score="3" Body="&lt;p&gt;When you say &quot;speed,&quot; I assume you really mean &quot;throughput&quot; (&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/10387/what-is-difference-between-goodput-throughput-and-data-rate&quot;&gt;Here's the difference).&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we assume the same bandwidth connection to the IXP (e.g., both have a 1 gigabit connection), and the same network conditions (link utilization, error rates, etc), then then the throughput will be the same.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of the longer distance, the first bit will arrive faster to the person 100 miles away than the other one at 200 miles.  Given the propagation of light/electricity through fiber or copper, the funny cat video will start about one millisecond sooner for the first person, but it will play at the same rate.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-06-19T16:53:46.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19358" PostTypeId="2" ParentId="99" CreationDate="2015-06-19T17:11:18.323" Score="0" Body="&lt;p&gt;By and large, copper is preferred because the interfaces are less expensive and copper has the ability to deliver power concurrent with the transmission of data.  Always run copper to endpoints unless it is not possible.  As far as the links between networking devices it could be copper or fiber and like you said link distance is the primary determinant.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-19T17:11:18.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19359" PostTypeId="2" ParentId="667" CreationDate="2015-06-19T17:26:19.560" Score="5" Body="&lt;p&gt;The &quot;caps&quot; on the splitter/amplifier block (the thing all the black cables are attached to) are terminators.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RF signals hate un-terminated cabling. Leaving one of the un-used RF connectors 'open' would cause interference for all the other connections (signal reflections from un-terminated connections can be problematic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cap essentially contains a resistor between the shield and the center conductor.&#xA;Typically you see the termination caps on any distribution block installed by the provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Technically, you should use termination caps on all un-terminated connections. This includes those in your home in your bedroom that no longer has a TV or cable box, etc. connected because you only get your video entertainment form the Interwebs now....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jason&lt;/p&gt;&#xA;" OwnerUserId="10660" LastActivityDate="2015-06-19T17:26:19.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19361" PostTypeId="2" ParentId="19352" CreationDate="2015-06-19T19:47:12.033" Score="5" Body="&lt;ul&gt;&#xA;&lt;li&gt;Adding or removing physical interfaces&lt;/li&gt;&#xA;&lt;li&gt;Adding or removing logical interfaces (vlan, dialer, tunnel, etc.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In short, anything that changes the number (or order) of IDB entries. The index starts at one and always increments. The enumeration process starts fresh when the system boots. (if persistence isn't enabled, or someone deletes the database -- it's a file in nvram.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-19T19:47:12.033" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19363" PostTypeId="2" ParentId="18290" CreationDate="2015-06-20T03:57:04.827" Score="2" Body="&lt;p&gt;Turns out that one of the routers (a Billion 7300GRA) was to blame; its handling of packets with a protocol ID of 0xFD is what was responsible for the observed behavior and after simply using a different ID (0x8F only tested) the problem ceased.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I should've updated this question earlier. Sorry about that)&lt;/p&gt;&#xA;" OwnerUserId="15260" LastEditorUserId="15260" LastEditDate="2015-06-20T04:16:31.637" LastActivityDate="2015-06-20T04:16:31.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19365" PostTypeId="1" AcceptedAnswerId="19366" CreationDate="2015-06-20T11:29:33.967" Score="7" ViewCount="302" Body="&lt;p&gt;In general, links among data centers are shared (having shared network infrastructure). Thus, I can't detect the available bandwidth in between two data centers that may vary &lt;em&gt;every while and through the way&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consecutively, I am unable to throttle the network by submitting my &lt;em&gt;UDP&lt;/em&gt; packets among such links because I worry about packet drops and message losses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to detect instantly and repeatedly the available bandwidth between two data centers so that I could throttle it with my packets?&lt;/p&gt;&#xA;" OwnerUserId="13402" LastEditorUserId="13402" LastEditDate="2016-02-04T11:56:19.037" LastActivityDate="2016-02-04T11:56:19.037" Title="Throttling among Data Centers" Tags="|qos|bandwidth|udp|throughput|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19366" PostTypeId="2" ParentId="19365" CreationDate="2015-06-20T11:59:31.993" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am unable to throttle the network by submitting my UDP packets among such links because I worry about packet drops and message losses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;At first blush, this sounds more like a design problem with the application, not the network:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Networks are not reliable.&lt;/li&gt;&#xA;&lt;li&gt;UDP was never intended to transport messages reliably without adding application layer loss detection and retransmission.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If the application requires reliable messaging, many people use TCP (for unicast endpoints) or TIBCO RV (multicast endpoints).  The devil is always in the details and there is no one size fits all solution.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any way to detect instantly and repeatedly the available bandwidth between two data centers, So that I could throttle it with my packets?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You are essentially asking for what is traditionally called &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17801/qos-or-more-bandwidth&quot;&gt;QoS&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you build rules to classify and prioritize your traffic, you can use QoS disciplines such as &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_0t/12_0t5/feature/guide/cbwfq.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;CBWFQ&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Low-latency_queuing&quot; rel=&quot;nofollow noreferrer&quot;&gt;LLQ&lt;/a&gt; to prioritize your most important traffic classes in the face of congestion (i.e low available bandwidth).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can use QoS to shape certain traffic classes to an average rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, UDP traffic classes are considered more loss sensitive than TCP classes.  There are always exceptions to this rule of course; for instance TIBCO RV is commonly based on UDP multicast, but TIBCO includes sequence numbers to detect the need for retransmission.  Depending on the applications, you may or may not need to prioritize UDP TIBCO classes over other TCP traffic.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I didn't find how to detect the available bandwidth.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends on the specific type of QoS, but in general:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;QoS classes monitor the average utilization within the traffic class&lt;/li&gt;&#xA;&lt;li&gt;QoS watches the interface queues for congestion and &lt;em&gt;only&lt;/em&gt; prioritizes when the interface has a non-zero queue size (i.e. congestion).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/19214/how-to-limit-a-vlan-to-a-specific-bandwidth-quota/19216#19216&quot;&gt;This answer&lt;/a&gt; illustrates one kind of QoS configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Final notes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;There are limits to the amount of oversubscription that QoS can reasonably handle; &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17801/qos-or-more-bandwidth#comment29136_17801&quot;&gt;a full buffer always drops packets, even with QoS in the buffer&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;QoS capabilities are heavily dependent on your network hardware, and may need substantial testing before you implement it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-06-22T07:37:51.067" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19367" PostTypeId="1" AcceptedAnswerId="19368" CreationDate="2015-06-20T15:10:09.310" Score="7" ViewCount="4117" Body="&lt;p&gt;First, I'm adding this question and answering myself because this type of behavior was absolutely no where to be found, hopefully it will help someone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We use auto bandwidth to handle the bandwidth subscriptions for our LSPs.  The LSPs are equal cost and appear in our forwarding/routing tables appropriately as available next hops for each destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However for a single destination, the 4 equal cost LSPs are not load balancing equally (or even close to equally).  We understand that JUNOS uses a per-flow load balancing algorithm despite the statement &quot;per-packet&quot; in the policy to enable load-balancing.  But that does not explain the major difference between each subscription for the LSP (this subscription imbalance happens multiple times per day, it is not a one off occurrence), like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jhead@R1&amp;gt; show route protocol rsvp 1.1.1.1 detail&#xA;&#xA;1.1.1.1/32 (2 entries, 1 announced)&#xA;        State: &amp;lt;FlashAll&amp;gt;&#xA;        *RSVP   Preference: 7/1&#xA;                Next hop: 192.168.1.1 via xe-0/0/0.0 weight 0x1 balance 35%, selected&#xA;                Label-switched-path LSP1&#xA;                Next hop: 192.168.1.2 via xe-1/0/0.0 weight 0x1 balance 35%&#xA;                Label-switched-path LSP2&#xA;                Next hop: 192.168.1.3 via xe-0/0/1.0 weight 0x1 balance 26%&#xA;                Label-switched-path LSP3&#xA;                Next hop: 192.168.1.4 via xe-0/0/0.0 weight 0x1 balance 5%&#xA;                Label-switched-path LSP4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1-R4 are MX480's and CORE-R1-R4 are MX960's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are graphs comparing RSVP subscription and utilization of the LSP.  Red is subscription, green is utilization.  You can see that the utilization follows the reservation almost exactly throughout the day.  We &lt;em&gt;should&lt;/em&gt; see subscriptions be very close to each other between the LSPs toward the same destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bJo2q.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/UKnU7.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/zGgbP.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/qB0H3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Topology:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 - R4 are ingress routers for all of the LSP's, they have either 2 or 4 LSP's toward each core router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZEPGD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LSP configuration is a single destination from R1, just as an example.  All LSP's are configured exactly the same way (again, with either 2 or 4).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit protocols mpls]&#xA;    statistics {&#xA;        file mpls-stats;&#xA;        interval 300;&#xA;        auto-bandwidth;&#xA;    }&#xA;    traffic-engineering bgp;&#xA;    label-switched-path LSP1 {&#xA;        to 1.1.1.1;&#xA;        optimize-timer 300;&#xA;        auto-bandwidth {&#xA;            adjust-interval 7200;&#xA;            adjust-threshold 10;&#xA;            minimum-bandwidth 100m;&#xA;            maximum-bandwidth 4g;&#xA;            adjust-threshold-overflow-limit 2;&#xA;            adjust-threshold-underflow-limit 4;&#xA;        }&#xA;        primary primary-loose;&#xA;    }&#xA;    label-switched-path LSP2 {&#xA;        to 1.1.1.1;&#xA;        optimize-timer 300;&#xA;        auto-bandwidth {&#xA;            adjust-interval 7200;&#xA;            adjust-threshold 10;&#xA;            minimum-bandwidth 100m;&#xA;            maximum-bandwidth 4g;&#xA;            adjust-threshold-overflow-limit 2;&#xA;            adjust-threshold-underflow-limit 4;&#xA;        }&#xA;        primary primary-loose;&#xA;    }&#xA;    label-switched-path LSP3 {&#xA;        to 1.1.1.1;&#xA;        optimize-timer 300;&#xA;        auto-bandwidth {&#xA;            adjust-interval 7200;&#xA;            adjust-threshold 10;&#xA;            minimum-bandwidth 100m;&#xA;            maximum-bandwidth 4g;&#xA;            adjust-threshold-overflow-limit 2;&#xA;            adjust-threshold-underflow-limit 4;&#xA;        }&#xA;        primary primary-loose;&#xA;    }&#xA;    label-switched-path LSP4 {&#xA;        to 1.1.1.1;&#xA;        optimize-timer 300;&#xA;        auto-bandwidth {&#xA;            adjust-interval 7200;&#xA;            adjust-threshold 10;&#xA;            minimum-bandwidth 100m;&#xA;            maximum-bandwidth 4g;&#xA;            adjust-threshold-overflow-limit 2;&#xA;            adjust-threshold-underflow-limit 4;&#xA;        }&#xA;        primary primary-loose;&#xA;    }&#xA;&#xA;[edit protocols rsvp]&#xA;load-balance bandwidth&#xA;interface xe-0/0/0.0 {&#xA;    bandwidth 9g;&#xA;}&#xA;interface xe-0/0/1.0 {&#xA;    bandwidth 9g;&#xA;}&#xA;interface xe-1/0/0.0 {&#xA;    bandwidth 9g;&#xA;}&#xA;&#xA;[edit routing-options forwarding-table]&#xA;export load-balance;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2015-06-20T16:53:20.247" LastActivityDate="2016-02-18T17:18:27.720" Title="Why are my equal cost LSP's not load balancing equally when using auto-bandwidth?" Tags="|juniper-junos|mpls|juniper-mx|ecmp|rsvp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19368" PostTypeId="2" ParentId="19367" CreationDate="2015-06-20T16:52:35.303" Score="9" Body="&lt;p&gt;The problem is the:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit protocols rsvp]&#xA;load-balance bandwidth&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you look at the Juniper documentation for &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.1/information-products/topic-collections/nog-mpls-frr/index.html?topic-19850.html&quot; rel=&quot;noreferrer&quot;&gt;Unequal Cost Load Balancing RSVP LSPs&lt;/a&gt;, it states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For uneven load balancing using bandwidth to work, you must have at least two equal-cost LSPs toward the same egress router and at least one of the LSPs must have a bandwidth value configured at the [edit protocols mpls label-switched-path lsp-path-name] hierarchy level. &lt;strong&gt;If no LSPs have bandwidth configured, equal distribution load balancing is performed. If only some LSPs have bandwidth configured, the LSPs without any bandwidth configured do not receive any traffic.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This implies that regardless of that feature being configured, that no equal cost load balancing will happen if you do not statically set a bandwidth value on an individual LSP, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit protocols mpls label-switched-path LSP1]&#xA;bandwidth 2g&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, auto-bandwidth does in fact count as setting a bandwidth value, despite it not being present in the configuration.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When auto bandwidth is enabled, RPD will begin monitoring bandwidth consumption.  It will assign bandwidth values based on utilization, and then the &quot;load-balance bandwidth&quot; statement in RSVP will immediately begin attempting to keep the traffic ratios within those subscriptions (35, 35, 26, 5 respectively).  The problem with this is that it never gives auto-bandwidth the chance to adjust evenly, because the &quot;load-balance bandwidth&quot;s goal, is to keep the traffic as close to those ratios as possible.  This makes sense when they're  set of something like, 10, 30, 20, 40.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is essentially a race condition between &quot;load-balance bandwidth&quot; and &quot;auto-bandwidth&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After removing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[edit protocols rsvp]&#xA;load-balance bandwidth&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic adjusted (with a slight hiccup, seen below):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; This is an example from a different router that was affected by the same issue.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jhead@R1&amp;gt; show log mpls-stats&#xA;&#xA;LSP1 (LSP ID 3388, Tunnel ID 2646)    177150801 pkt   155450491134 Byte 178572 pps 152286259 Bps Util 228.46% Reserved Bw 66660264 Bps&#xA;LSP2 (LSP ID 3393, Tunnel ID 2647)            0 pkt              0 Byte      0 pps        0 Bps Util  0.00% Reserved Bw 116698880 Bps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since you remove the ability to load-balance (for RSVP), the PFE will reprogram to only a single path until an auto-bandwidth adjust occurs automatically, or you can force an adjustment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;request mpls lsp adjust-autobandwidth&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And below, are the bandwidth adjusts for 2 LSP's with the same symptoms, the configurations change and adjustments happened mid-day Friday, you can see the different in subscriptions almost immediately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/By3XY.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ZE1XO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-06-20T16:52:35.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19375" PostTypeId="1" AcceptedAnswerId="19380" CreationDate="2015-06-21T16:17:13.680" Score="2" ViewCount="471" Body="&lt;p&gt;I've been looking up how ISPs manage to cap a user's network speed given the theoretical limit of the infrastructure is usually much higher than the speed ISP's sell. I've stumbled across the TCP slow-start algorithm and it got me thinking that an ISP might kill a few ACKs to force the TCP stack into linear growth mode and eventually into near-zero growth once the contractual speed limit is reached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is my theory correct? If so, how do you limit an ACK-less protocol such as UDP?&lt;/p&gt;&#xA;" OwnerUserId="16079" LastActivityDate="2015-06-23T08:59:49.197" Title="Is the Slow-Start algorithm responsible for ISP speed throttling?" Tags="|tcp|isp|speed|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19377" PostTypeId="1" AcceptedAnswerId="19379" CreationDate="2015-06-21T21:10:04.777" Score="19" ViewCount="87009" Body="&lt;p&gt;... or does the &quot;default VLAN&quot; have some wider meaning?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, can it / should it be changed?  For instance, if a switch is going into part of a network that is only one VLAN and it's not VLAN 1, is it possible to make the &quot;default&quot; / native VLAN on all ports a particular VLAN using one global command, or is the preferred method to make all ports access ports and set the access VLAN to 10 on each of them?&lt;/p&gt;&#xA;" OwnerUserId="16081" LastActivityDate="2020-06-23T11:10:12.697" Title="Is the &quot;default VLAN&quot; simply the default native (untagged) VLAN on all interfaces that have no configuration?" Tags="|cisco|vlan|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19378" PostTypeId="2" ParentId="19377" CreationDate="2015-06-21T23:47:38.490" Score="1" Body="&lt;p&gt;The native VLAN is only relevant to 802.1q, yes it is untagged by default, but can be tagged if required. Ports will be assigned to the native VLAN if no other config is present. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's ok to keep it as VLAN 1, but it can be changed, you just have to remember to shut down unused ports. What I mean by this, if I plugged my evil hacker laptop into a working port that was left as VLAN 1, I could potentially be able to span across your entire network, whereas you could change the native VLAN to VLAN 10, and then not assign VLAN 10 to any ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISL has no concept of a native VLAN.&lt;/p&gt;&#xA;" OwnerUserId="8109" LastEditorDisplayName="user10222" LastEditDate="2016-06-24T06:06:40.980" LastActivityDate="2016-06-24T06:06:40.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19379" PostTypeId="2" ParentId="19377" CreationDate="2015-06-22T02:54:41.273" Score="31" Body="&lt;p&gt;This is an often confused point for people new to the Networking, in particular to people coming up the Cisco track, due to Cisco's over emphasis on this point.  It is more or less just a terminology thing.  Let me explain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 802.1q standard defines a method of &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans/#tagged-untagged&quot; rel=&quot;noreferrer&quot;&gt;tagging&lt;/a&gt; traffic between two switches to distinguish which traffic belongs to which VLANs.  In Cisco terms, this is what happens on a &quot;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans/#trunk_port&quot; rel=&quot;noreferrer&quot;&gt;trunk&lt;/a&gt;&quot; port.  I've seen other vendors refer to this as a &quot;tagged&quot; port.  In this context, it means the same:  &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans/#dot1q-tag&quot; rel=&quot;noreferrer&quot;&gt;adding an identifier to frames&lt;/a&gt; to indicate what VLAN the frame belongs to.  Terminology aside, the main thing to keep in mind is a VLAN tag is necessary, because often the traffic traversing two switches belongs to multiple VLANs, and there must be a way to determine which 1's and 0's belong to which VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what happens if a trunk port, who is expecting to receive traffic that includes the VLAN tag, receives traffic with no tag?  In the predecessor to 802.1q, known as ISL (cisco proprietary, but archaic, no one supports it anymore, not even Cisco), untagged traffic on a trunk would simply be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.1q however, provided for a way to not only receive this traffic, but also associate it to a VLAN of your choosing.  This method is known as setting a &lt;strong&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans/#native-vlan&quot; rel=&quot;noreferrer&quot;&gt;Native VLAN&lt;/a&gt;&lt;/strong&gt;.  Effectively, you configure your trunk port with a Native VLAN, and whatever traffic arrives on that port without an existing VLAN tag, gets associated to your Native VLAN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As with all configuration items, if you do not explicitly configure something, usually some sort of default behavior exists.  In the case of Cisco (and most vendors), the &lt;strong&gt;Default &lt;em&gt;Native&lt;/em&gt; VLAN&lt;/strong&gt; is VLAN 1.  Which is to say, if you do not set a Native VLAN explicitly, any &lt;em&gt;untagged&lt;/em&gt; traffic received on a trunk port is automatically placed in VLAN 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The trunk port is the &quot;opposite&quot; (sort of) from what is known as an &lt;strong&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans/#access_port&quot; rel=&quot;noreferrer&quot;&gt;Access Port&lt;/a&gt;&lt;/strong&gt;.  An access port sends and expects to receive traffic with no VLAN tag.  The way this can work, is that an access port also only ever sends and expects to receive traffic &lt;em&gt;belonging to one VLAN&lt;/em&gt;.  The access port is statically configured for a particular VLAN, and any traffic received on that port is internally associated on the Switch itself as belonging to a particular VLAN (despite not tagging traffic for that VLAN when it leaves the switch port). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, to add to the confusing mix.  Cisco books will often refer to the &quot;default VLAN&quot;.  The &lt;strong&gt;Default VLAN&lt;/strong&gt; is simply the VLAN which all Access Ports are assigned to until they are explicitly placed in another VLAN.  In the case of Cisco switches (and most other Vendors), the Default VLAN is usually VLAN 1.  Typically, this VLAN is only relevant on an Access port, which is a port that sends and expects to receive traffic without a VLAN tag (also referred to an 'untagged port' by other vendors).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to summarize:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/configuring-vlans/#trunk_native&quot; rel=&quot;noreferrer&quot;&gt;The &lt;strong&gt;Native VLAN&lt;/strong&gt; can change&lt;/a&gt;.  You can set it to anything you like.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/configuring-vlans/#access_vlan&quot; rel=&quot;noreferrer&quot;&gt;The &lt;strong&gt;Access Port VLAN&lt;/strong&gt; can change&lt;/a&gt;.  You can set it to anything you like. &lt;/li&gt;&#xA;&lt;li&gt;The &lt;strong&gt;Default Native VLAN&lt;/strong&gt; is always 1, this can not be change, because its set that way by Cisco&lt;/li&gt;&#xA;&lt;li&gt;The &lt;strong&gt;Default VLAN&lt;/strong&gt; is always 1, this can not be changed, because it is set that way by Cisco&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;edit:  forgot your other questions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, can it / should it be changed?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is largely an opinion question.  I tend to agree with this school of thought:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All unused ports should be in a specific VLAN.  All active ports should be explicitly set on to a particular VLAN.  Your switch should then prevent traffic from traversing the uplink into the rest of your network if the traffic belongs on VLAN1, or the VLAN you are using for unused ports.  Everything else should be allowed up the uplink.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there are many different theories behind this.  As well as differing requirements which would prevent having such a restricted switch policy (scale, resources, etc).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For instance, if a switch is going into part of a network that is only&#xA;  one VLAN and it's not VLAN 1, is it possible to make the &quot;default&quot; /&#xA;  native VLAN on all ports a particular VLAN using one global command,&#xA;  or is the preferred method to make all ports access ports and set the&#xA;  access VLAN to 10 on each of them?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can not change the default Cisco configurations.  You can use the &quot;interface range&quot; to put all ports in a different VLAN in one go.  You don't really need to change the Native VLAN on the uplink trunk, so long as the other switch is using the same Native VLAN.  If you really want to spare the switch from adding the VLAN Tag, you could get creative and do the following (although, its probably not recommended).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Leave all access ports in the VLAN1.  Leave the Native VLAN at its default (VLAN1).  On the uplink switch, set the port as a trunk port.  And set its Native VLAN to the VLAN you want the lower switch to be a part of.  Since the lower switch will send traffic to the upper switch untagged, the upper switch will receive it and associate it with what &lt;em&gt;it considers&lt;/em&gt; the Native VLAN.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2019-04-14T13:17:51.257" LastActivityDate="2019-04-14T13:17:51.257" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="19380" PostTypeId="2" ParentId="19375" CreationDate="2015-06-22T03:13:47.467" Score="8" Body="&lt;p&gt;&lt;strong&gt;Short answer&lt;/strong&gt;: &lt;em&gt;No, ISPs do not use TCP Slow-Start as the main way to throttle customer bandwidth&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Long answer&lt;/strong&gt;: There are many ways that an ISP can throttle the bandwidth a particular customer gets allotted, but in my experience tweaking TCP knobs is very far down the list of possible methods.  If you are an ISP, you can control the traffic volume at a lower network layer, (as opposed to controlling it via the specific behavior of &lt;strong&gt;ONE&lt;/strong&gt; layer 4 protocol).  It is usually cheaper and faster to munge about with traffic at layers 2 and 3, and so it makes more sense to do so there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to learn more about this topic, I would recommend reading about Quality of Service (QOS).  First, &lt;a href=&quot;https://en.wikipedia.org/wiki/Quality_of_service&quot; rel=&quot;nofollow&quot;&gt;check out the Wikipedia Article on QOS&lt;/a&gt; and get a good grasp of the basic concepts and terminology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, when you're ready to dive deeper, read the &lt;a href=&quot;http://docwiki.cisco.com/wiki/Quality_of_Service_Networking&quot; rel=&quot;nofollow&quot;&gt;Cisco DocWiki article on QOS&lt;/a&gt;.  This goes much deeper on the specific technologies and mechanisms of the QOS implementation on Cisco IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, if you want a really DENSE presentation with lots of good information about Service Provider QOS, read this wonderful presentation from Cisco: &lt;a href=&quot;http://www.cisco.com/c/dam/en/us/products/collateral/ios-nx-os-software/quality-of-service-solutions-service-providers/prod_presentation0900aecd803decfb.pdf&quot; rel=&quot;nofollow&quot;&gt;Optimizing the Service Provider Network for Voice, Video, and Data&lt;/a&gt;.  However, depending on your current level of expertise, expect to do much &#xA;Googling and learning related to the terms and technologies being used.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2015-06-23T00:40:04.593" LastActivityDate="2015-06-23T00:40:04.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19382" PostTypeId="1" CreationDate="2015-06-22T04:49:26.170" Score="0" ViewCount="72" Body="&lt;p&gt;Can I have a domain hosted with two different IP addresses? I recently was trying to get my domain hosting company to allocate two different IP addresses to my domain and I was told this was not possible. I wanted to transition from one ISP to another without having service downtime or any problems so that I could fall back in case of any challenges.&lt;/p&gt;&#xA;" OwnerUserId="16007" LastActivityDate="2015-06-22T05:20:11.147" Title="Domain hosting IP address" Tags="|dns|" AnswerCount="2" CommentCount="1" ClosedDate="2018-03-10T04:31:59.200" ContentLicense="CC BY-SA 3.0" />
  <row Id="19384" PostTypeId="2" ParentId="19382" CreationDate="2015-06-22T05:03:55.027" Score="-1" Body="&lt;p&gt;The short answer is no. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When an IP application does a dns lookup the server can only return one IP address. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-06-22T05:03:55.027" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19386" PostTypeId="2" ParentId="19382" CreationDate="2015-06-22T05:20:11.147" Score="2" Body="&lt;p&gt;Yes.  It is absolutely possible for a single domain to be hosted on two different IP addresses.  For example, take google.com:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ dig www.google.com +noall +answer&#xA;www.google.com.         29      IN      A       64.233.168.106&#xA;www.google.com.         29      IN      A       64.233.168.147&#xA;www.google.com.         29      IN      A       64.233.168.99&#xA;www.google.com.         29      IN      A       64.233.168.103&#xA;www.google.com.         29      IN      A       64.233.168.104&#xA;www.google.com.         29      IN      A       64.233.168.105&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You're probably running into issues with your DNS host having a policy against it.  And/or your web host thinking you mean to have two different IP addresses pointing to the same web server (which doesn't make sense, or accomplish anything).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do happen to get your DNS host to advertise two IP addresses for two different Web Servers hosted at two different companies for your single domain, keep in mind the toll that will play on the users session.  Approximately half your &lt;em&gt;connections&lt;/em&gt; will go to one host, and the other half will go to the other.  Notice I said &lt;em&gt;connections&lt;/em&gt;, not &lt;em&gt;users&lt;/em&gt;.  It is very possible (and likely) that even a single user's session will end up sending packets to both web servers.  Which means every few clicks your users will loose all their session information (shopping carts, log in cookies, etc)&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-06-22T05:20:11.147" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19387" PostTypeId="1" CreationDate="2015-06-22T08:31:58.723" Score="3" ViewCount="4446" Body="&lt;p&gt;My switch model is: SG500-28-K9-G5 to be precise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have four switches in stacking mode in my setup, and I want to upgrade them to a higher level firmware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it recommended that I remove the switches from stacking and upgrade individual switches, or can I upgrade just the master and expect it to pass on the firmware change to others? After all, they work as one switch in stacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if it is just the master I must upgrade, then do I have to change the boot code on others and just upgrade the firmware on the master? I got something like this from a website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have ended here after sifting through lot of manuals etc. &lt;/p&gt;&#xA;" OwnerUserId="15569" LastEditorUserId="8499" LastEditDate="2016-03-24T17:45:45.730" LastActivityDate="2016-07-22T21:15:21.190" Title="Upgrading Cisco 500 series stackable switches in stacking mode" Tags="|cisco|switching|stacking|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19389" PostTypeId="1" AcceptedAnswerId="19391" CreationDate="2015-06-22T10:46:06.623" Score="1" ViewCount="102" Body="&lt;p&gt;I have an installation that utilizes Cisco Catalyst C3524-XL switches to connect different buildings to a site network. I need to connect POE cameras to this network. I would like to utilize a Trendnet POE switch such as TPE-S44 to feed the cameras. Can I connect my cameras to the TPE-S44, connect the TPE-S44 to any open and configured port on the C3524-XL and have my camera footage viewable on the network?&lt;/p&gt;&#xA;" OwnerUserId="16090" LastActivityDate="2015-06-22T11:19:10.217" Title="Can a POE switch connect to port on Cisco C3524-XL switch?" Tags="|cisco|switch|power-over-ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19391" PostTypeId="2" ParentId="19389" CreationDate="2015-06-22T11:19:10.217" Score="1" Body="&lt;p&gt;Yes.  This is how a lot of companies do it.  &lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-06-22T11:19:10.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19392" PostTypeId="1" CreationDate="2015-06-22T11:38:20.380" Score="0" ViewCount="187" Body="&lt;p&gt;So i have nine 3com 4500G 24-port switches and i need a way to scan the interfaces on the switches and tell me info on the devices connected to them (EG: ip, mac, hostname) is there any such way to do this on 3com switches or from a client pc ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried Spiceworks, Nagios and Nmap but cant get any of them to work the way i want them to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note the reason I need to do this is the switches in question aren't counting traffic properly, there is a PC on the interface below that is used daily but the count shows no traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any assistance. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; port: GigabitEthernet1/0/2&#xA;&#xA; Input (total):  0 packets, 0 bytes&#xA;     0 broadcasts, 0 multicasts&#xA; Input (normal):  - packets, - bytes&#xA;     - broadcasts, - multicasts&#xA; Input:  0 input errors, 0 runts, 0 giants, - throttles&#xA;     0 CRC, - frame, - overruns, 0 aborts&#xA;     - ignored, - parity errors&#xA; Output (total): 0 packets, 0 bytes&#xA;     0 broadcasts, 0 multicasts, 0 pauses&#xA; Output (normal): - packets, - bytes&#xA;     - broadcasts, - multicasts, - pauses&#xA; Output: 0 output errors, - underruns, - buffer failures&#xA;     0 aborts, 0 deferred, 0 collisions, 0 late collisions&#xA;     0 lost carrier, - no carrier&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16092" LastEditorUserId="16092" LastEditDate="2015-06-23T09:40:00.673" LastActivityDate="2015-11-20T18:00:34.100" Title="Scanning switch interfaces" Tags="|switch|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19393" PostTypeId="1" CreationDate="2015-06-22T12:31:15.627" Score="1" ViewCount="1124" Body="&lt;p&gt;I'm trying to figure out why I am unable to ping an IP associated with a VLAN in a VRF from my VM's directly attached to the same VLANs.  I can ping each interface on the switch directly using ping vrf centos 10.1x.1.1.  I can see the mac addresses in the vlan on the 3750X stack as well so I know there is connectivity.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip vrf centos&#xA;rd 10.10.1.253:1&#xA;!&#xA;!&#xA;interface Vlan3011&#xA;ip vrf forwarding centos&#xA;ip address 10.11.1.1 255.255.255.0&#xA;!&#xA;interface Vlan3012&#xA; ip vrf forwarding centos&#xA; ip address 10.12.1.1 255.255.255.0&#xA;!&#xA;interface Vlan3013&#xA; ip vrf forwarding centos&#xA; ip address 10.13.1.1 255.255.255.0&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's a bit more on the config - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VMware Hosts attached via DVS to trunk ports on Cisco 5548's which are connected via port channel trunk to a 3750X Stack.  the VRF config is on the 3750X stack since the 5548's do not have L3 enabled or licensed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="16093" LastActivityDate="2015-06-22T12:31:15.627" Title="Unable to Ping SVI IP (VRF) interface from VM" Tags="|cisco|vlan|vrf|" AnswerCount="0" CommentCount="3" ClosedDate="2020-12-16T21:48:39.533" ContentLicense="CC BY-SA 3.0" />
  <row Id="19394" PostTypeId="1" AcceptedAnswerId="19395" CreationDate="2015-06-22T13:22:58.827" Score="2" ViewCount="5332" Body="&lt;p&gt;This maybe a dumb question but is it possible to determine the range of addresses in a dhcp pool without access to the dhcp server? I.e. from a client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a private network on a managed internal network in the range 10.100.19.0 255.255.255.0 and I'd like to set some ip addresses statically, but don't know which addresses are not included in the dhcp pool, and don't have access to the dhcp server, do I have any option other than wait for the admin to get back to me?&lt;/p&gt;&#xA;" OwnerUserId="16094" LastActivityDate="2015-06-22T13:53:22.077" Title="Determine dhcp pool range" Tags="|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19395" PostTypeId="2" ParentId="19394" CreationDate="2015-06-22T13:53:22.077" Score="1" Body="&lt;p&gt;No, not without seeing the configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You receiving an address inside of 10.100.19.0 255.255.255.0 doesn't mean the entire range is going to be used.  The administrator could have done any range within that subnet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example:&lt;/strong&gt; 10.100.19.10 - 20, or 10.100.19.100-254.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically one or more addresses will be reserved for network connectivity for that subnet.  i.e. the typical &quot;.1&quot; you use for your gateway, or if he has something like VRRP setup, maybe he has .1 .2 and .3 reserved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if you're looking to take some IP's from that pool, definitely have him assign the addresses to you.  If you set 10.100.19.25 for your device, and it goes down later, theres nothing preventing the DHCP server from giving that address away to something else.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-06-22T13:53:22.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19396" PostTypeId="1" AcceptedAnswerId="19397" CreationDate="2015-06-22T15:05:29.190" Score="8" ViewCount="1227" Body="&lt;p&gt;I know that MST using regions so that it doesn't have to run multiple instances of spanning tree.&#xA;However on a trunk are the BPDUs no longer tagged (dot1q) and sent to the neighbor device. i.e are they only sent untagged ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="1689" LastActivityDate="2016-03-21T23:45:17.693" Title="MST Spanning Tree BPDU`s" Tags="|spanning-tree|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19397" PostTypeId="2" ParentId="19396" CreationDate="2015-06-22T15:22:35.177" Score="6" Body="&lt;p&gt;The short answer is that MSTP actually uses a special instance in addition to the user defined ones to handle all MSTP control traffic, called the Internal Spanning Tree instance (IST0).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From: &lt;a href=&quot;http://blog.ine.com/2010/02/22/understanding-mstp/&quot;&gt;http://blog.ine.com/2010/02/22/understanding-mstp/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The IEEE 802.1s implementation does not send BDPUs for every active STP instance separately, nor does it encapsulate VLAN numbers list configuration messages. Instead, a special STP instance number 0 called Internal Spanning Tree (IST aka MSTI0, Multiple Spanning Tree Instance 0) is designated to carry all STP-related information. The BPDUs for IST contain all standard RSTP-style information for the IST itself, as well as carry additional informational fields. Among those fields are configuration name, revision number and a hash value calculated over VLANs to MSTI mapping table contents. Using just this condensed information switches may detect mis-configuration in VLAN mappings by comparing the hash value received from the peer with the local value.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You should definitely check out the rest of that white paper, it's a great resource.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-06-22T15:22:35.177" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19399" PostTypeId="2" ParentId="19392" CreationDate="2015-06-22T16:08:18.157" Score="1" Body="&lt;p&gt;The only information that the switch is going to collect on particular machines is the MAC address - either via the bridge table layer2 or the arp table layer 3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the switch in question part of a &quot;stack&quot;? I know there is a way of stacking these switches with a proprietary 10 Gig connection (I think they call it a CX4 connector) to create one logical switch out of a stack with a master/subordinate relationship between them. Could it be that the data you are looking for is only accessible via the master switch in the stack? &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-06-22T16:08:18.157" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19402" PostTypeId="2" ParentId="19387" CreationDate="2015-06-22T20:26:43.593" Score="0" Body="&lt;p&gt;Not too sure towards the 500 series switches but in practice best that you install the new code on all the switches within the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some nice commands to upgrade the images on the 2960, 3560, 3750, etc switches but not quite sure if the 500 series supports them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a cli on the switches, verify the bin image with the &quot;verify /md5 flash:/&quot;image-path.bin&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next in config mode configure the stack to boot from the new bin image &#xA;&quot;#boot system flash:/&quot;path-to-image.bin&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Very important is that you have access to the console port of the switch for emergency access. &#xA;If the switches are at a remote site, perform a test upgrade in your lab/office to ensure the upgrade path is successful first.&#xA;It's quite a straightforward procedure performed hundreds of times by network admins bust always best to be prepared with eventualities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reload at a convenient time where the users will not be impacted as much :-)&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2015-06-22T20:26:43.593" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19403" PostTypeId="2" ParentId="17448" CreationDate="2015-06-22T23:18:39.053" Score="0" Body="&lt;p&gt;You can configure the &quot;no auto-state&quot; command under the vlan interface to disable the up/down feature of SVIs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan105&#xA; no auto-state&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope this solves it. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;H&lt;/p&gt;&#xA;" OwnerUserId="11927" LastActivityDate="2015-06-22T23:18:39.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19404" PostTypeId="1" AcceptedAnswerId="19407" CreationDate="2015-06-22T23:22:37.470" Score="2" ViewCount="234" Body="&lt;p&gt;I have two switchs cisco 2960 (sw-120 and IDF1-SW) and router cisco 1841 (IDF1-R). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fa0/24 at sw-120 connected via fa0/7 at IDF1-SW  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fa0/7 and fa0/24 at IDF1-SW switched to trunk mode &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fa0/24 at sw-120 switched to trunk mode too&lt;/p&gt;&#xA;&#xA;&lt;p&gt;fa0/1 at sw-120 switched to access to vlan 120&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router(IDF1-R) configured to accept traffic from vlan 120 by subinterface fa0/1.120&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IDF1-R(config-subif)#encapsulation dot1q 120&#xA;IDF1-R(config-subif)#ip ad 10.6.1.26 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Laptop3 configuration is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP : 10.6.1.25   &#xA;Subnetmask : 255.255.255.252&#xA;Gateway : 10.6.1.26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem : I can not ping gateway(10.6.1.26) from Laptop&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/URN4G.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/URN4G.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7XUyS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7XUyS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw-120#show spanning-tree vlan 120&#xA;VLAN0120&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    32888&#xA;             Address     0007.EC16.0917&#xA;             This bridge is the root&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32888  (priority 32768 sys-id-ext 120)&#xA;             Address     0007.EC16.0917&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  20&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Fa0/24           Desg FWD 19        128.24   P2p&#xA;&#xA;sw-120#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Update 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is  IDF1-SW running config&#xA;    IDF1-SW#sh ru&#xA;    Building configuration...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1118 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname IDF1-SW&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA; switchport access vlan 120&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is  sw-120 running config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw-120&amp;gt;en&#xA;sw-120#sh ru&#xA;Building configuration...&#xA;&#xA;Current configuration : 1430 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname sw-120&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 120&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 119&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 118&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport access vlan 117&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/5&#xA; switchport access vlan 116&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport access vlan 114&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/7&#xA; switchport access vlan 113&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16103" LastEditorUserId="21048" LastEditDate="2017-10-20T12:25:53.933" LastActivityDate="2017-10-20T12:25:53.933" Title="Cannot ping gateway" Tags="|cisco|routing|vlan|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19406" PostTypeId="2" ParentId="19375" CreationDate="2015-06-23T08:59:49.197" Score="4" Body="&lt;p&gt;&lt;em&gt;@Machinarius&lt;/em&gt;, &lt;em&gt;@Brett Lykins&lt;/em&gt; has pretty much answered your question but without mentioning any techniques specifically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted some further clarification then two main techniques very commonly used are &lt;strong&gt;shaping&lt;/strong&gt; and &lt;strong&gt;policing&lt;/strong&gt; depending on the service being contracted and the customer requirements. You will read about these in the links provided by &lt;em&gt;@Brett Lykins&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To give you a simple practical example, let’s say our example customer takes a 10Mbps connection but the physical link can run at 100Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using shaping, if the customer traffic tries to exceed 10Mbps, traffic starts to be queued up in a buffer (assume an infinite buffer size) and slowly let out at a rate no faster than 10Mbps. So what this means is that the customer doesn’t have any packet loss but their latency/RTT will increase because they are trying to send more traffic than they have been given, so it’s being queued up. Protocols like TCP will slow down the transmission speed as ACKs take longer to be send/received when traffic is being buffered without packet loss. However devices don’t have infinite amounts of RAM so there will be a point where even with shaping packet loss will occur because the buffers become full.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you read through the links &lt;em&gt;@Brett Lykins&lt;/em&gt; provided you will see that traffic can be classified and marked, then processed in accordance with a QoS policy such that “important” traffic coming in is less likely to be dropped than less important traffic when congestion occurs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Policing or “rate-limiting” is just a case of setting a hard 10Mbps limit on the connection, if the traffic passing through tries to exceed this hard limit that then packets will be dropped according to whatever algorithm is in use as as WRED/RED/Tail-drop. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As above, when using policing one could set up multiple queues and split the 10Mbps allowance across different traffic priorities etc. The main difference to note is that policing is generally a hard limit while shaping will try to buffer traffic at the expense of RTT.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2015-06-23T08:59:49.197" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19407" PostTypeId="2" ParentId="19404" CreationDate="2015-06-23T10:43:28.653" Score="1" Body="&lt;p&gt;Solved. The solution is VTP domains. You should create VTP domains. IDF1-SW should be in mode vtp-server and sw-120 in mode vtp-client&lt;/p&gt;&#xA;" OwnerUserId="16103" LastActivityDate="2015-06-23T10:43:28.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19409" PostTypeId="1" CreationDate="2015-06-23T13:01:50.007" Score="2" ViewCount="852" Body="&lt;p&gt;I want to understand differences with hosts transmitting data to another host within a &lt;em&gt;local LAN&lt;/em&gt; and hosts sending data to another host in a &lt;em&gt;remote LAN&lt;/em&gt;. A book I was reading quoted this&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;...understand that routers, which work at Network layer, don't care about where a particular house is located. They're only concerned about where networks are located and the best way to reach them.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another part says:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;...Each time a packet is sent between routers, the Data link layer uses hardware addressing. Each time a packet is sent between routers, it's framed with control information at the Data Link later. However, that information is stripped off at the receiving router &amp;amp; only the original packert is left completely intact. This framing of the packet continues for each hop until the packet is finally delivered to the correct receiving host.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bmtXc.jpg&quot; alt=&quot;Self drawn network diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the diagram above as reference, I have some questions in mind:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it correct to say that, when Alice wants to transmit data to Charlie, the process is as such:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Alice's packet will contain Alice IP address (SOURCE), and Charlie's IP address (DESTINATION). This info is passed onto the data link layer.&lt;/li&gt;&#xA;&lt;li&gt;At the Data link layer, Alice MAC addresses (SOURCE) and Charlie's MAC address (DESTINATION) are added.&lt;/li&gt;&#xA;&lt;li&gt;The data will be transmitted to SWITCH A. SWITCH A checks the destination MAC address and since SWITCH A knows where Charlie is located, it passes the data to the respective interface that Charlie is connected to. &lt;/li&gt;&#xA;&lt;li&gt;Charlie will inspect the destination MAC address to see if its correct. If it's correct it will pass the data to the network layer&lt;/li&gt;&#xA;&lt;li&gt;At the network layer, the DATA LINK layer information is being stripped off and Charlie check the Destination IP address. If it's correct Charlie will accept the data. &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is that correct?&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;When Alice wants to send data to a host in a remote LAN, in this case, Bob, &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Does Alice put the DESTINATION IP ADDRESS as the ROUTER A IP ADDRESS (Router A is the default gateway)? Because Alice does not know the IP Address of Bob, and only the remote router B knows it. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is the destination MAC address the MAC address of BOB's Computer? or MAC address of the interface of switch A that Alice is connected to? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Does that mean that when the Data is transmit from Router A to Router B, the MAC Addresses in the data is ignored, and the router cares about the IP address, to know where to route the data to? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I hope my questions make sense. I'm trying to get my fundamental right before going to advance topic. Sorry if my English is bad. &lt;/p&gt;&#xA;" OwnerUserId="16111" LastEditorUserId="8499" LastEditDate="2018-03-10T04:32:40.247" LastActivityDate="2019-03-11T15:23:17.873" Title="OSI layer : Ethernet and IP address" Tags="|switch|router|ip|osi|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19412" PostTypeId="2" ParentId="19409" CreationDate="2015-06-23T15:25:17.903" Score="0" Body="&lt;p&gt;In 1):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Alice looks at the dst IP/prefix, and if it deems it the local subnet, will look in her ARP lookup table table for a MAC for Charlie's IP&lt;/li&gt;&#xA;&lt;li&gt;if it has one, data is sent&lt;/li&gt;&#xA;&lt;li&gt;if it doesn't, Alice sends out an ARP broadcast ie: &quot;who has the MAC of Charlie's IP?&quot;&lt;/li&gt;&#xA;&lt;li&gt;Charlie responds with his MAC and data is sent&lt;/li&gt;&#xA;&lt;li&gt;if the MAC data is incorrect, Charlie will never receive the frame&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In 2):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Alice puts dst address in the IP packet. The src and dst addresses never changes (unless you're doing NAT or other trickery)&lt;/li&gt;&#xA;&lt;li&gt;Alice puts the MAC address of her default gateway into the Ethernet Frame&lt;/li&gt;&#xA;&lt;li&gt;for simplicity sake, we'll just say that Alice's default gateway (rtr A) will have a route in its routing table saying &quot;the subnet Bob is on is through the IP address of router B&quot;&lt;/li&gt;&#xA;&lt;li&gt;rtr A will then use the same MAC lookup scenario for rtr B's IP as Alice's computer did when looking for Charlie, and once found, the packet is sent from rtr A to rtr B&lt;/li&gt;&#xA;&lt;li&gt;the far side of rtr B is on the same subnet as Bob, so the MAC lookup is done again, and finally rtr B sends the packet on to Bob&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;EDIT: Example for ARP lookup on local subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I look in my local machine's (10.0.48.1) ARP table and see there's no entry for 10.0.0.7:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ arp | grep 10.0.0.7&#xA;# no output&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So then while listening on the wire with &lt;code&gt;tcpdump&lt;/code&gt; (using my local MAC as src and dst (to capture both the outgoing frame and incoming frame)), I ping 10.0.0.7 from my local machine in a different terminal window. The first ping sometimes fails as it has to do the ARP lookup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ping 10.0.0.7&#xA;PING 10.0.0.2 (10.0.0.7) 56(84) bytes of data.&#xA;64 bytes from 10.0.0.7: icmp_seq=1 ttl=64 time=0.430 ms&#xA;^C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the &lt;code&gt;tcpdump&lt;/code&gt; window, you can see what happens after I started the ping:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo tcpdump -nn -i eth0 arp and ether src a0:d3:c1:0e:73:68 or ether dst a0:d3:c1:0e:73:68&#xA;&#xA;10:23:55.576782 ARP, Request who-has 10.0.0.7 tell 10.0.48.1, length 28&#xA;10:23:55.576950 ARP, Reply 10.0.0.7 is-at 00:21:9b:65:c9:b9, length 46&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first line after the command starts, my computer sends out a &quot;who-has 10.0.0.7 tell 10.0.48.1&quot;. 10.0.48.1 is my computer. Thereafter, the remote computer responds back with its MAC address &quot;10.0.0.7 is-at ...&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the lookup and reply, my local ARP table is updated. This entry will stay present and won't need to do another lookup for that IP's MAC until the ARP cache timeout occurs for that IP (default is 60 seconds on Ubuntu):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ arp -a | grep 10.0.0.7&#xA;? (10.0.0.7) at 00:21:9b:65:c9:b9 [ether] on eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15782" LastEditorUserId="15782" LastEditDate="2015-06-23T16:31:54.463" LastActivityDate="2015-06-23T16:31:54.463" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="19414" PostTypeId="2" ParentId="19409" CreationDate="2015-06-23T16:23:13.560" Score="4" Body="&lt;p&gt;First off - your English appears to me to be excellent. Secondly your summation of bridging (question 1) and consequently your understanding of the subject are very good. I would probably word some of that slightly different but your summation is fair and it appears that your understanding is good. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's make one assumption at this point to keep things simple - this is all Ethernet and IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that there are two steps that I would add to your bridging summation that might clear up your understanding of routing (question 2) a little:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;when your network stack is handed data to transmit there is a route table look up done &lt;em&gt;(every device on an IP network contains a route table - to see it from a command prompt - on linux type &quot;route&quot;, on windows type &quot;route print&quot;.)&lt;/em&gt; to determine two things: &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;a) which interface to transmit the data out &lt;/p&gt;&#xA;&#xA;&lt;p&gt;b) if the destination is directly reachable or is remote (beyond a router).&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Once the route is determined the network stack will ARP for a MAC address. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So when Alice is sending data to Charlie she does a route lookup - it is determined that his machine is directly accessible on the LAN. She then ARPs for his MAC address. Once the route has been determined and the MAC address has been acquired the network stack can then assemble the packet for transmission. This particular conversation as you mentioned only traverses switch A as it inspects the destination MAC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that we have fleshed out question one a little better let's apply some of these concepts to question 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Alice desires to send data to Bob the first step is a route lookup. It is determined that Bob is not on the LAN. Thus the route to Bob is the default route (assuming Router A is configured as such). &lt;em&gt;(As your book points out Router A - and by extension Alice - don't know where Bob is. They only know the general direction - or &quot;route&quot;.)&lt;/em&gt; So Alice ARPs for Router A. Then assembles the packet with destination IP address(network layer) of Bob and MAC address(datalink layer) of Router A. Upon receiving this packet Router A 1)strips off the MAC address(datalink layer) of Alice 2)does a route lookup 3)ARPs for router B 4)then reassembles the packet with MAC address of Router B. Router B repeats these steps ARPing for Bob and forwards the packet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the network layer is assembled at the start - source Alice and destination Bob - and never changes. The datalink layer on the other hand is deleted and reassembled each and every leg of the trip. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-06-23T16:23:13.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19415" PostTypeId="1" AcceptedAnswerId="19417" CreationDate="2015-06-23T17:15:58.083" Score="8" ViewCount="43877" Body="&lt;p&gt;I have one question about IP addresses. If I have address &lt;code&gt;172.18.230.127./29&lt;/code&gt; how should I know what type of address is this one. It could be: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Network address, &lt;/li&gt;&#xA;&lt;li&gt;Host address,&lt;/li&gt;&#xA;&lt;li&gt;Loopback address&lt;/li&gt;&#xA;&lt;li&gt;Broadcast address&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What are differences between these addresses above?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="16117" LastActivityDate="2015-06-23T19:49:24.500" Title="What are the differences between network, host, loopback and broadcast address?" Tags="|ip|" AnswerCount="1" CommentCount="1" ClosedDate="2015-07-02T19:24:36.250" ContentLicense="CC BY-SA 3.0" />
  <row Id="19416" PostTypeId="1" CreationDate="2015-06-23T17:49:17.477" Score="1" ViewCount="850" Body="&lt;p&gt;I am using an Ryu controller (3.22) to monitor switches (Open vSwitch 2.0.2, supporting Open Flow 1.3), which are a part of virtual network created using mininet (2.1.0). It is a tree topology with depth = 2 and fanout = 5. I am using &lt;a href=&quot;https://github.com/osrg/ryu-book/blob/master/en/source/sources/simple_monitor.py&quot; rel=&quot;nofollow&quot;&gt;switch_monitor.py&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the help of the controller, I can get port statistics using the &lt;code&gt;EventOFPPortStatsReply&lt;/code&gt; decorator. I can get values of &lt;code&gt;rx_packets&lt;/code&gt;, &lt;code&gt;rx_bytes&lt;/code&gt;, &lt;code&gt;rx_errors&lt;/code&gt;, &lt;code&gt;tx_packets&lt;/code&gt;, &lt;code&gt;tx_bytes&lt;/code&gt;, &lt;code&gt;tx_errors&lt;/code&gt;, &lt;code&gt;rx_dropped&lt;/code&gt;, &lt;code&gt;tx_dropped&lt;/code&gt; etc., but the values of &lt;code&gt;rx_dropped&lt;/code&gt;, &lt;code&gt;tx_dropped&lt;/code&gt; always come out to be &lt;strong&gt;zero&lt;/strong&gt;, even when the switches are actually dropping packets, as reported by qdisc (linux command).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How do I get packet loss statistics from an Open Flow switch?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;How to get a non zero value?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Is there any alternate way?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="16119" LastEditorUserId="8499" LastEditDate="2016-03-20T05:25:02.817" LastActivityDate="2016-04-19T05:49:31.650" Title="Get packet loss from Open Flow switch" Tags="|packet-loss|openflow|mininet|sdn|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19417" PostTypeId="2" ParentId="19415" CreationDate="2015-06-23T17:57:29.607" Score="10" Body="&lt;p&gt;An IP address can be broken down into two parts, namely the Network Address and Host Address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, /29 refers to the Subnet Mask which means the 29 bits of the total 32 bits from MSB to LSB are all 1's, i.e., 255.255.255.248 . This will allow for 8 addresses per subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first address in the subnet, 178.18.230.120 is the Network Address in this case and - the last address, which is all 1's - i.e., 172.18.230.127 is the Broadcast Address. The host address can range anywhere between the Network and Broadcast Address, i.e., 172.18.230.121 to 172.18.230.126 .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can arrive at these addresses by performing an logical AND on the IP address and the Subnet Mask. The first IP address is usually reserved for the Network address and the last one in that block is for the Broadcast address, while the remaining ones can be used as Host addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Loopback address is a special reserved IP address, usually referred to as the localhost - 127.0.0.1 and is used to communicate with the localhost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Edited:&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can convert IP addresses into the binary form and perform logical AND. But, it's much easier and less time consuming to have them in Decimal representation. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                       178.18.230.127&#xA;&#xA;              (AND)    255.255.255.248 &#xA;                     --------------------&#xA;                       **178.18.230.120**  -----&amp;gt; **Network Address**&#xA;                     --------------------&#xA;&#xA;                       178.18.230.127&#xA;&#xA;              (AND)    255.255.255.255 &#xA;                     --------------------&#xA;                       **178.18.230.127**  -----&amp;gt; **Broadcast Address**&#xA;                     --------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that the first and last one in a block are always Network and Broadcast Addresses(reserved).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Host Addresses:&lt;/strong&gt;&#xA;Any other address lying between the Network and Broadcast Addresses are Host Addressable, which means they can be assigned to a Host and are NOT reserved for any specific purpose, unlike the Network and Broadcast Addresses.&lt;/p&gt;&#xA;" OwnerUserId="4094" LastEditorUserId="4094" LastEditDate="2015-06-23T19:49:24.500" LastActivityDate="2015-06-23T19:49:24.500" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19419" PostTypeId="2" ParentId="19321" CreationDate="2015-06-23T18:06:54.333" Score="0" Body="&lt;p&gt;Separating a network's control logic from the underlying physical routers and switches that forward traffic allows network operators to write high-level control programs that specify the behavior of an entire network, in contrast to conventional networks, whereby network operators must codify functionality in terms of low-level device configuration.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logically centralized network control makes it possible for operators to specify more complex tasks that involve integrating many disjoint network functions (e.g., security, resource control, prioritization) into a single control framework, allowing network operators to create more sophisticated policies, and making network configurations easier to configure, manage, troubleshoot, and debug&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Simply put, Software-defined networking (SDN) is an approach to networking in which control is decoupled from the physical infrastructure&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Arxiv: &lt;a href=&quot;http://arxiv.org/abs/1406.0440&quot; rel=&quot;nofollow noreferrer&quot;&gt;Software-Defined Networking: A Comprehensive Survey&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is separating the network's control logic from the underlying routers and switches, promoting (logical) centralization of network control, and introducing the ability to program the network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wikipedia:&#xA;Software-defined networking (SDN) is an approach to computer networking that allows network administrators to manage network services through abstraction of lower-level functionality. This is done by decoupling the system that makes decisions about where traffic is sent (the control plane) from the underlying systems that forward traffic to the selected destination (the data plane). The inventors and vendors of these systems claim that this simplifies networking.&lt;/p&gt;&#xA;" OwnerUserId="16119" LastEditorUserId="31801" LastEditDate="2019-05-12T21:31:32.563" LastActivityDate="2019-05-12T21:31:32.563" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19420" PostTypeId="1" CreationDate="2015-06-23T18:10:26.620" Score="3" ViewCount="4750" Body="&lt;p&gt;I'm working on creating a monitor script for some access layer switches. I've gotten it to work with some Cisco 3750s, but when I try it on a Cisco 3560, it says the OID object not found. After looking at Cisco's MIB locator, it is the same for both platforms. Am I missing something here?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;montorbox# snmpget -v1 -c public 10.x.x.x 1.3.6.1.4.1.9.9.13.1.3.1.3&#xA;Error in packet&#xA;Reason: (noSuchName) There is no such variable name in this MIB.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've added my monitor server to the SNMP server host group. Do I have to load something additional onto the switch?&lt;/p&gt;&#xA;" OwnerUserId="3528" LastEditorUserId="8499" LastEditDate="2016-04-05T14:41:25.953" LastActivityDate="2017-03-07T03:06:09.367" Title="Cisco 3560 snmpget OID temperature not found?" Tags="|cisco|cisco-ios|cisco-catalyst|snmp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19421" PostTypeId="1" AcceptedAnswerId="19431" CreationDate="2015-06-23T19:14:06.637" Score="2" ViewCount="101" Body="&lt;p&gt;I have 4 IDFs(cisco 3560)  and one MDF(cisco 3560). IDFs are connected via fa0/24 to MDF. Every fa0/24 is in mode trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at the picture &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/aZWlA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fa0/1-4 on MDF is in mode trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem : I cannot ping any IDF from any other.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if I set IP for their from same network -- it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I confugure to correct routing ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is cite from config IDF4&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname IDF4&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; no switchport&#xA; ip address 10.6.64.1 255.255.224.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;ip route 10.6.0.0 255.255.224.0 FastEthernet0/24 &#xA;ip route 10.6.32.0 255.255.224.0 FastEthernet0/24 &#xA;ip route 10.6.96.0 255.255.224.0 FastEthernet0/24 &#xA;ip route 0.0.0.0 0.0.0.0 FastEthernet0/24 &#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And config of IDF5&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;hostname IDF5&#xA;!&#xA;ip routing&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; no switchport&#xA; ip address 10.6.96.1 255.255.224.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router rip&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 FastEthernet0/24 &#xA;ip route 10.6.0.0 255.255.224.0 FastEthernet0/24 &#xA;ip route 10.6.32.0 255.255.224.0 FastEthernet0/24 &#xA;ip route 10.6.64.0 255.255.224.0 FastEthernet0/24 &#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Update 2.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MDF(config)#int range  fa0/1-4&#xA;MDF(config-if-range)#no switchport&#xA;MDF(config-if-range)#&#xA;MDF(config-if-range)#exit&#xA;MDF(config)#interface FastEthernet0/1&#xA;MDF(config-if)#no ip address&#xA;MDF(config-if)#&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down&#xA;&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to up&#xA;&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to down&#xA;&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/2, changed state to up&#xA;&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to down&#xA;&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/3, changed state to up&#xA;&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to down&#xA;&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/4, changed state to up&#xA;ip address 10.6.31.254 255.0.0.0&#xA;MDF(config-if)#ip address 10.6.31.254 255.255.224.0&#xA;MDF(config-if)#&#xA;MDF(config-if)#exit&#xA;MDF(config)#interface FastEthernet0/1&#xA;MDF(config-if)#&#xA;MDF(config-if)#exit&#xA;MDF(config)#interface FastEthernet0/2&#xA;MDF(config-if)#ip address 10.6.63.254 255.255.224.0&#xA;MDF(config-if)#&#xA;MDF(config-if)#exit&#xA;MDF(config)#interface FastEthernet0/3&#xA;MDF(config-if)#ip address 10.6.95.254 255.255.224.0&#xA;MDF(config-if)#&#xA;MDF(config-if)#exit&#xA;MDF(config)#interface FastEthernet0/4&#xA;MDF(config-if)#ip address 10.6.128.126 255.255.224.0&#xA;MDF(config-if)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And after add route&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IDF1(config)#ip route 10.6.32.0 255.255.224.0 fa0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IDF23(config)#ip route 10.6.0.0 255.255.224.0 fa0/24&#xA;IDF23(config)#end&#xA;IDF23#&#xA;%SYS-5-CONFIG_I: Configured from console by console&#xA;&#xA;IDF23#&#xA;IDF23#&#xA;IDF23#ping 10.6.0.1&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.6.0.1, timeout is 2 seconds:&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16103" LastEditorUserId="16103" LastEditDate="2015-06-23T22:21:22.013" LastActivityDate="2015-06-23T22:21:22.013" Title="Routing between several nets" Tags="|routing|vlan|trunk|network-core|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19422" PostTypeId="1" CreationDate="2015-06-23T19:19:52.117" Score="3" ViewCount="458" Body="&lt;p&gt;I have 5 Cisco switches (two SG500, two SG220, and one 2960 where the other switches are connected) used for camera surveillance connected to each other using optical fibre. I need to monitor the traffic generated between the switches.  As I am not allowed to install any software on my NVR, I need to know the console commands, or if I can monitor it from another PC with any auxiliary software. Any suggestions? &lt;/p&gt;&#xA;" OwnerUserId="16123" LastEditorUserId="8499" LastEditDate="2016-03-20T07:21:11.807" LastActivityDate="2017-12-11T10:36:16.940" Title="Traffic consumption between switches for CCTV systems" Tags="|cisco|cisco-catalyst|cisco-small-business|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19423" PostTypeId="1" CreationDate="2015-06-23T19:51:40.367" Score="2" ViewCount="8091" Body="&lt;p&gt;We've got two HP2920-48G PoE switches connected together via a simple 1Gb cable (SW2:48 -&gt; SW1:01), and then SW1:A1 fiber-channel to a central switch (SW9:A1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All switches are untagged in the DEFAULT_VLAN (one /19 broadcast domain).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have PoE Cisco phones plugged into SW2 and basically PCs/Macs plugged into SW1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we do a &lt;code&gt;clear arp&lt;/code&gt; in SW2, it seems to be able to ping everything in the network (as expected), but moments later it loses its ability to connect to certain IP addresses within the broadcast domain, including SW1 which is the switch it directly connects to. However, all the phones still work, and anything running ethernet still switches correctly. Its only the access to and from SW2:DEFAULT_VLAN address that seems to go bad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are not network engineers, but we know our way around switches a bit. What would be causing bad ARP entries, or why would &lt;code&gt;clear arp&lt;/code&gt; fix it momentarily, but only for the moment?&lt;/p&gt;&#xA;" OwnerUserId="16118" LastEditorUserId="8499" LastEditDate="2016-03-21T01:22:15.170" LastActivityDate="2017-09-02T01:09:14.473" Title="HP 2920-48G PoE daisy-chain ARP cache problem" Tags="|arp|hp-procurve|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19424" PostTypeId="2" ParentId="19422" CreationDate="2015-06-23T20:30:05.337" Score="0" Body="&lt;p&gt;It appears from your question that the 2960 is the &quot;core&quot; or central switch.  The most straightforward answer is to create a SPAN port on the central 2960 and feed it into your other PC.  Then you can use a tool like Wireshark to look at the data.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Monitor source is all the ports connected to your other switches&#xA;monitor session 1 source interface Gi0/1, Gi0/2, Gi0/3, Gi0/4&#xA;! Monitor destination is your PC that's capturing the data&#xA;monitor session 1 destination interface Gi0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="155" LastActivityDate="2015-06-23T20:30:05.337" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19427" PostTypeId="2" ParentId="19423" CreationDate="2015-06-23T20:55:19.717" Score="2" Body="&lt;p&gt;ARP is a layer-3 (&quot;IP&quot;) technology. Under normal conditions an ethernet switch should have nothing at all in it's arp cache, because 100% of what it does is layer-2 (&quot;ethernet&quot;) switching. The only arp entries would be for management access (eg. the MAC of your machine would be known to it while you have a connection to it.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the UI is going away but it's otherwise still passing traffic, that sounds like something is attacking the switch, or otherwise overloading it (eg. thinking it's a router, or other server.)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hp-2810-1# show arp&#xA;&#xA; IP ARP table&#xA;&#xA;  IP Address      MAC Address       Type    Port&#xA;  --------------- ----------------- ------- ----&#xA;  192.168.0.1     000423-c6a4ec     Dynamic Trk1 (the router)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;vs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hp-2810-1# show mac-address &#xA;&#xA; Status and Counters - Port Address Table&#xA;&#xA;  MAC Address   Located on Port&#xA;  ------------- ---------------&#xA;  000423-c6a4ec Trk1           &#xA;  000423-c6a4ed Trk1           &#xA;  .... (many pages, in fact)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Despite the volume of broadcast traffic through the switch, very little (none) is in the management vlan (10 in my case.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hp-2810-1# show cpu&#xA;&#xA;4 percent busy, from 178 sec ago&#xA;1 sec ave: 3 percent busy&#xA;5 sec ave: 2 percent busy&#xA;1 min ave: 5 percent busy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-23T20:55:19.717" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19430" PostTypeId="2" ParentId="19416" CreationDate="2015-06-23T21:23:53.873" Score="1" Body="&lt;p&gt;qdisc reports what the &lt;em&gt;kernel&lt;/em&gt; is dropping, not what the &lt;em&gt;network&lt;/em&gt; is dropping. You're getting zero's because the switch isn't dropping frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I don't know if your virtual network system supports simulating frame drops.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-23T21:23:53.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19431" PostTypeId="2" ParentId="19421" CreationDate="2015-06-23T21:59:12.070" Score="2" Body="&lt;p&gt;You made one network on layer 2, but put each switch in a different layer 3 network, so your MDF is a switch and it should be a router with the IP addresses you configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution is to make each port towards an IDF a routed port on the MDF, and thus giving the MDF an IP address in each network, or have the MDF configured as a switch and put all IDF's in the same network.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-06-23T21:59:12.070" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19435" PostTypeId="5" CreationDate="2015-06-24T02:25:32.860" Score="0" Body="" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-06-24T02:25:32.860" LastActivityDate="2015-06-24T02:25:32.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19436" PostTypeId="4" CreationDate="2015-06-24T02:25:32.860" Score="0" Body="A tag for questions related to Cisco's small business line of products." OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-06-24T02:25:32.860" LastActivityDate="2015-06-24T02:25:32.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19438" PostTypeId="1" AcceptedAnswerId="23279" CreationDate="2015-06-24T02:48:24.990" Score="5" ViewCount="1598" Body="&lt;p&gt;I have a Juniper EX4300 switch that is connected to a firewall which in turn connects to the WAN. I have an Aruba 7010 Controller that I would like to connect to the Juniper switch. On the Juniper switch I have 4 VLANS that each correspond to a single subnet in the following format:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN Name - VLAN ID - IP RANGE&lt;/li&gt;&#xA;&lt;li&gt;UserLAN   -    1    - 172.0.0.1/22&lt;/li&gt;&#xA;&lt;li&gt;Guest     -    2    - 172.0.4.1/22&lt;/li&gt;&#xA;&lt;li&gt;UserWiFi  -    3    - 172.0.8.1/22&lt;/li&gt;&#xA;&lt;li&gt;DevLAN    -    4    - 172.0.12.1/22&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have connected the Aruba Controller to port ge-0/0/10 on the Juniper switch and configured that port as a trunk port with the native VLAN being UserLAN and the member VLANs as the rest of the VLANs. Juniper port ge-0/0/0 is also configured as a trunk port on the UserLAN VLAN and connects to my firewall that has an IP of 172.0.0.2/22. I can ping public addresses such as 8.8.8.8 from all devices and I have inter-VLAN communication working but I just wanted to ask if this is the correct way to configure these devices? I also wanted to know if this configuration can support using the same VLANs across the Juniper and Aruba devices. From the Aruba documentation they say you must create the same VLANs with the same name and IDs on both devices, but I cannot remove VLAN ID 1 on the Aruba device. Any thoughts?&lt;/p&gt;&#xA;" OwnerDisplayName="user16129" LastActivityDate="2016-03-09T17:10:26.030" Title="Proper connection and VLAN configuration between Juniper EX4300 and Aruba 7010 Controller?" Tags="|vlan|juniper-junos|juniper-ex|aruba|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19441" PostTypeId="1" CreationDate="2015-06-24T05:33:18.863" Score="1" ViewCount="163" Body="&lt;p&gt;I have a project that includes a firewall and two routers. I have created two subnetworks with VLSM for both routers and I have a cable that represents a serial connection between them. The firewall should be between the internet and the first router that I have used. I have no trouble about pinging routers' ethernet interfaces and serial connections, I think my network is working well. However, I can connect to the Internet from firewall but cannot access it from the other routers. Here is my firewall and network configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firewall:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Ethernet 0/1 is connected to the router-1 with a cat5 cable. This port's IP address is 10.1.1.30(You'll see it is a part of the network that is created for router-1)&#xA;-Ethernet 0/0 is connected to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router-1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Ethernet 0/0 port has the IP 10.1.1.1/27&#xA;-Serial 0/0 port has the IP 10.1.1.81/30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router-2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Ethernet 0/0 port has the IP 10.1.1.65/28&#xA;-Serial 0/0 port has the IP 10.1.1.82/30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS:I have used RIPv2 on all devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like I said, I can connect to the Internet from the fw but cannot from the routers. Thanks ^_^.&lt;/p&gt;&#xA;" OwnerUserId="16052" LastActivityDate="2015-12-21T20:56:28.140" Title="A question about firewall usage" Tags="|router|ipv4|firewall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19445" PostTypeId="1" AcceptedAnswerId="19450" CreationDate="2015-06-24T12:10:53.300" Score="19" ViewCount="46938" Body="&lt;p&gt;According to wikipedia host is&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A network host is a &lt;strong&gt;&lt;em&gt;computer or other device&lt;/em&gt;&lt;/strong&gt; connected to a computer network. A network host &lt;strong&gt;&lt;em&gt;may offer information resources, services&lt;/em&gt;&lt;/strong&gt;, and applications to users or other nodes on the network. A network host is a network node that is assigned a &lt;strong&gt;&lt;em&gt;network layer host address&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Computer is a host.&#xA;Printers also provide services and have ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in these which are really host?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;router,&lt;/li&gt;&#xA;&lt;li&gt;printer,&lt;/li&gt;&#xA;&lt;li&gt;&quot;Camera in network&quot;,&lt;/li&gt;&#xA;&lt;li&gt;switch&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm totally confused with these things.&#xA;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="16027" LastEditorUserId="33" LastEditDate="2015-06-24T14:43:13.300" LastActivityDate="2018-01-24T15:55:08.870" Title="What is real difference between host and node in network" Tags="|lan|network-access|" AnswerCount="8" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19446" PostTypeId="2" ParentId="19445" CreationDate="2015-06-24T12:17:10.647" Score="4" Body="&lt;p&gt;The way I have seen it used (and try to enforce myself to more effectively communicate) is that a host is any device that is an endpoint for communication, like a PC, storage, printer, etc.  Node, like the &lt;a href=&quot;https://en.wikipedia.org/wiki/Node_(networking)&quot; rel=&quot;nofollow&quot;&gt;wikipedia&lt;/a&gt; article suggests, is a more general term for any defineable point on the network where information might start, sit, or change directions; so this includes hosts along with switches and other devices that only serve to move the data, they don't &quot;host&quot; it themselves.  I try to use the term host where possible, and use the term node when a device is not a host or not doing host-like duties.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastEditorUserId="6361" LastEditDate="2015-06-24T12:18:53.460" LastActivityDate="2015-06-24T12:18:53.460" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19448" PostTypeId="1" AcceptedAnswerId="19468" CreationDate="2015-06-24T13:26:16.010" Score="1" ViewCount="3263" Body="&lt;p&gt;I have the need to mirror/monitor a port on a HP A5800 AF, but to send the mirrored data for packet capturing to a host which is a virtual server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking of having the mirrored traffic dumped on a temporary VLAN which is in the trunk to the ESX host and add that vlan to the guest machine as secondary NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the documentation it seems I can mirror a vlan, but the &quot;monitor&quot; host has to be directly connected to a physical interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is a remote datacentre I'm currently not in a condition to have a physical machine connected to the switch as recipient for the packet capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch's OS is ComWare v5.20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion is greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="16138" LastEditorUserId="36720" LastEditDate="2020-01-02T13:58:51.833" LastActivityDate="2020-01-02T13:58:51.833" Title="HP A5800 Switch remote port mirror to a virtual host" Tags="|switching|mirror|hp-comware|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19450" PostTypeId="2" ParentId="19445" CreationDate="2015-06-24T13:54:49.117" Score="23" Body="&lt;p&gt;I actually like the way the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2460#section-2&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPv6 RFC&lt;/a&gt; defines it:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;2.  Terminology&#xA;&#xA;   node        - a device that implements IPv6.&#xA;&#xA;   router      - a node that forwards IPv6 packets not explicitly&#xA;                 addressed to itself.&#xA;&#xA;   host        - any node that is not a router.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So in your list:&lt;br /&gt;&#xA;router,&#xA;printer,&#xA;&amp;quot;Camera in network&amp;quot;,&#xA;switch&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A router is a node, a router, and a host&lt;/li&gt;&#xA;&lt;li&gt;A printer is a node, and a host*&lt;/li&gt;&#xA;&lt;li&gt;A Camera is a node, and a host*&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;*(&lt;em&gt;Provided that it as an IP address configured)&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;A switch is tricky, because it comes down to how it is configured:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A switch &lt;em&gt;without&lt;/em&gt; an IP address configured, is neither a host, nor a router, nor a node&lt;/li&gt;&#xA;&lt;li&gt;A switch &lt;em&gt;with&lt;/em&gt; an IP address configured is a node and a host &lt;em&gt;for the interface/vlan with the configured IP&lt;/em&gt;.  For all the other ports, it can be considered a switch without an IP address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;sup&gt;&lt;em&gt;(Both bullet points above consider a switch that is not participating in IP routing.  If it is, then you could consider it a Router, and the bullet points above these two can be applied)&lt;/em&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-06-24T13:54:49.117" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19451" PostTypeId="2" ParentId="19445" CreationDate="2015-06-24T13:59:13.567" Score="2" Body="&lt;p&gt;In my understanding, a host is an end system/device, which can host /run applications. A host could be a Client or a Server. The type of application differs in both these cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The nodes will not know much about the applications. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your question, &lt;strong&gt;router&lt;/strong&gt; and &lt;strong&gt;switch&lt;/strong&gt; are &lt;strong&gt;nodes&lt;/strong&gt;, while a &lt;strong&gt;camera&lt;/strong&gt; and &lt;strong&gt;printer&lt;/strong&gt; can be considered as &lt;strong&gt;hosts&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4094" LastActivityDate="2015-06-24T13:59:13.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19452" PostTypeId="1" CreationDate="2015-06-24T14:03:36.507" Score="1" ViewCount="682" Body="&lt;p&gt;interesting traceroute I am getting thru a firewall where we are NAT'ing both Source and Destination. I am wondering if it is possible to get this to work. We are trying to set up a traceroute monitor to trace routes out on the far end of our firewall. We are using Nagios to report &#xA;back if the last hop changes to gives us an idea of any fluctuations. I have the Nagios script working internally, however when I cross to a Host on the far end of the Firewall. I am receiving werid info back from the trace route command. I've tried both ICMP and TCP traceroutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I am getting.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute to 10.255.1.166 (10.255.1.166), 30 hops max, 60 byte packets&#xA; 1  10.1.0.2  0.532 ms  0.753 ms 10.1.0.3  0.619 ms&#xA; 2  10.54.4.13  1.844 ms 10.253.4.23  1.994 ms  2.048 ms&#xA; 3  10.67.29.3  1.993 ms  1.988 ms  1.968 ms&#xA; 4  10.255.1.166  2.167 ms  2.178 ms  2.172 ms&#xA; 5  10.255.1.166  2.754 ms  2.257 ms  2.761 ms&#xA; 6  10.255.1.166  2.460 ms  2.749 ms  2.839 ms&#xA; 7  10.255.1.166  3.105 ms  2.923 ms  2.979 ms&#xA; 8  10.255.1.166  3.420 ms  3.508 ms  3.398 ms&#xA; 9  10.255.1.166  3.092 ms  2.997 ms  2.936 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is a linux box with IP of 10.1.0.55, which we Source NAT to 10.99.99.55 when traversing&lt;/li&gt;&#xA;&lt;li&gt;The 10.255.1.166 is the NAT of the Host on the far end of the Firewall, the translation to it's real is 10.21.3.4&lt;/li&gt;&#xA;&lt;li&gt;The Firewall is a Palo Alto running code v6.1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3528" LastEditorUserId="3528" LastEditDate="2015-06-24T14:11:37.120" LastActivityDate="2016-10-24T23:38:35.167" Title="traceroute through Twice NAT'ing" Tags="|firewall|nat|ping|icmp|traceroute|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19453" PostTypeId="2" ParentId="19441" CreationDate="2015-06-24T14:20:46.840" Score="1" Body="&lt;p&gt;Just for clarity I am assuming your layout is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet - FW - 10.1.1.0/27 - r1 - 10.1.1.80/30 - r2 - 10.1.1.64/28&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You mention that you are running a routing protocol (RIPv2) on all devices. Assuming that includes the firewall and all things are configured correctly the firewall should have a route back to the other 2 networks (10.1.1.80 &amp;amp; 10.1.1.64). Can you confirm that you can ping these from the firewall? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;You state that you can ping all interfaces on both routers but you don't specify the source you are pinging from.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't mention a default route in your routers so I will guess that is where the problem lies. If your routing protocol is operating properly your firewall is going to be a node hanging off of the 10.1.1.0 network. If you don't specifically tell R1 and R2 to utilize it as the default they won't. &#xA;Here is a document on the Cisco website on the subject:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/16448-default.html&quot; rel=&quot;nofollow&quot;&gt;Gateway of last resort.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-06-24T14:20:46.840" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19456" PostTypeId="1" AcceptedAnswerId="19464" CreationDate="2015-06-24T16:11:34.160" Score="4" ViewCount="257" Body="&lt;p&gt;I was watching a Meraki AP presentation, and one of the features they showed was an analytic tab, which showed the number of devices that passed by, visitors, and connected to the AP, as well as many other things. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming passerby is defined as devices that are within the range of connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps my understanding of AP isn't correct, but I thought a WAP would be something like my wireless router, that allows devices to connect to a network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the reason I'm not able to see devices that are &quot;passerbys&quot; in my router that my router doesn't have that feature?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does a WAP see a passerby? Like is a mobile emitting something that the router can pick up?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, is it possible for a device to hide itself from WAPs?&lt;/p&gt;&#xA;" OwnerUserId="16145" LastEditorUserId="33" LastEditDate="2015-06-24T19:06:22.560" LastActivityDate="2015-06-24T21:46:42.977" Title="Can access points recognize who passes by?" Tags="|wireless|ieee-802.11|access-point|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19457" PostTypeId="1" CreationDate="2015-06-24T16:23:02.877" Score="1" ViewCount="425" Body="&lt;p&gt;We are on the final developing stages of an in browser mobile app (webApp) which will run in a non internet environment (underwater submarine). We are running a local server inside the submarine (windows 8 laptop with node.js), the app runs in node.js. We have a wireless router through which the server and clients connect, the server is assigned a static IP address (reserved IP address linked to it's mac address) all other connections are handled by DHCP with in an IP range. Right now we can access the app from mobile devices through the browser by typing in the IP address of the server, what we want to accomplish is to have a captive portal that every time a device is connected to the wireless network, the browser will automatically redirects it to the servers ip address, we don't what users to have to type an IP address on they're browsers. We now have a Linksys router with CoovaAp firmware but are not sure how to proceed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your time!   &lt;/p&gt;&#xA;" OwnerUserId="16146" LastActivityDate="2015-06-24T16:23:02.877" Title="Local web application as a captive portal with out authentication?" Tags="|routing|wireless|" AnswerCount="0" CommentCount="3" ClosedDate="2015-06-27T07:24:27.233" ContentLicense="CC BY-SA 3.0" />
  <row Id="19459" PostTypeId="2" ParentId="19456" CreationDate="2015-06-24T17:28:44.170" Score="3" Body="&lt;p&gt;Access points can be configured to broadcast their SSIDs, or they can be configured to only listen for connections from devices that know a given SSID exists.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Virtually all wifi client devices (laptops, mobile phones, tablets, etc) will broadcast at least some information on a periodic basis.  This is the information that a listening access point (or maybe more generally called an analytics gathering station) will hear and use to build maps and data sets of which devices are in the area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How much or how little (or how often) any given device is broadcasting information or attempting to access the network is highly dependent on the individual device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a reasonably good introduction to how this stuff works, may I suggest:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Media_access_control&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Media_access_control&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Wireless_LAN&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Wireless_LAN&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Carrier_sense_multiple_access_with_collision_avoidance&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Carrier_sense_multiple_access_with_collision_avoidance&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13955" LastActivityDate="2015-06-24T17:28:44.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19461" PostTypeId="1" AcceptedAnswerId="19466" CreationDate="2015-06-24T18:18:25.993" Score="6" ViewCount="1158" Body="&lt;p&gt;I have a question regarding a hierarchical design of a campus network.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Take a look at this image: &#xA;&lt;img src=&quot;https://i.stack.imgur.com/1YBhV.png&quot; alt=&quot;OSPF Area diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly the links between each &lt;strong&gt;Area Border Router&lt;/strong&gt; and &lt;strong&gt;BBone router&lt;/strong&gt; are point-to-point Layer 3 connections. With every point-to-point link in it's own subnet (probably a /30).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I was wondering if, for example, links going from &lt;strong&gt;ABR-1&lt;/strong&gt; &amp;amp; &lt;strong&gt;ABR-2&lt;/strong&gt; to &lt;strong&gt;BB-R1&lt;/strong&gt; go to a switch, would this break the &quot;L3 down to the access level&quot; design idea? If so, why's that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would look like:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ptNi9.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;Switch now drawn- The green lines represent one subnet, and the red one a different subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help!&lt;/p&gt;&#xA;" OwnerUserId="16149" LastEditorUserId="33" LastEditDate="2015-06-24T21:12:38.357" LastActivityDate="2015-06-25T11:42:06.570" Title="OSPF backbone area design" Tags="|routing|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19462" PostTypeId="1" CreationDate="2015-06-24T18:27:35.963" Score="1" ViewCount="98" Body="&lt;p&gt;While load testing our website through Soasta we found that the API calls were performing consistently without any degrade in performance (thanks to larger Ec2's serving them and the Elastic Load Balancer who is balancing the load appropriately), but the CDN calls (we use Akamai) (js, css, images ) started slowing down after some time. The difference was as large as 10 times e.g. an image which usually takes 100 ms took 1 second on few instances. I am curious to find out what could lead to this, because if the image is already cached at nearest location then why would it get slow during the repeated download? could it be due to heavy TCP traffic congestion (due to load testing) to the requesting server. &lt;/p&gt;&#xA;" OwnerUserId="16152" LastEditorDisplayName="user36472" LastEditDate="2018-02-16T16:49:49.900" LastActivityDate="2018-02-16T16:49:49.900" Title="CDN performance degrading during load testing" Tags="|performance|" AnswerCount="0" CommentCount="7" ClosedDate="2015-06-24T19:09:17.447" ContentLicense="CC BY-SA 3.0" />
  <row Id="19464" PostTypeId="2" ParentId="19456" CreationDate="2015-06-24T19:03:35.897" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the reason I'm not able to see devices that are &quot;passerbys&quot; in my router that my router doesn't have that feature?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. By router I am assuming you mean some sort of consumer gateway device with built in 802.11 wireless (hereafter just &quot;wireless&quot;). These devices will not have many of the features found in enterprise solutions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any wireless device has to be at least somewhat aware of the other wireless devices operating around it, if only to avoid collisions when transmitting.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How does a WAP see a passerby? Like is a mobile emitting something that the router can pick up?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you want to connect to a wireless network on your device, it generally will provide you a list of nearby networks. There are two ways that a device can discover this information, one active and one passive, however the active probe request is typically more common. Most devices will check fairly frequently for networks in the area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more detail on those processes, you may want to check &lt;a href=&quot;https://networkengineering.stackexchange.com/a/17225/33&quot;&gt;my answer to another question&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from that, if your device is communicating on the same channel (even with a different wireless network), nearby devices will be able to detect and record their presence. A common misconception is that if you use an encrypted wireless network, this entirely protects you. However the truth is that only the data portion of the 802.11 frame is encrypted, the headers still need to be sent in the clear.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Lastly, is it possible for a device to hide itself from WAPs?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Possible, yes. Although, this is unlikely as it would require that your device make no transmissions at all. A device that doesn't transmit at all isn't very useful to most people.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-06-24T19:03:35.897" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19466" PostTypeId="2" ParentId="19461" CreationDate="2015-06-24T19:44:07.667" Score="6" Body="&lt;p&gt;The idea behind &quot;L3 to the access layer&quot; is to avoid blocked links that would occur when STP blocks L2 loops, and allow multiple paths for increased bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your second drawing (assuming the link between the two ABRs in area 120 is not in the same VLAN), you don't have any L2 loops, so you don't have that problem.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there's no significant disadvantage in having the links in the same VLAN.  Technically you do have a designated router to deal with, but that shouldn't cause you to change your design. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you're using an external switch (your backbone and area 120 ABRs connect to a common switch, each with a single connection), then you lose the bandwidth (and redundancy) that you would have with a separate physical link to each router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Edited to add designated router info)&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-06-25T11:42:06.570" LastActivityDate="2015-06-25T11:42:06.570" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="19467" PostTypeId="2" ParentId="19456" CreationDate="2015-06-24T21:46:42.977" Score="3" Body="&lt;p&gt;The Meraki AP's (the higher end ones) have 3 radios: 2.4GHz, and 5GHz for traffic, and a third &quot;maintenance radio&quot;. That 3rd radio is what does all the spectrum monitoring and &quot;security&quot; scanning. It is that radio that can hear the non-associated devices within range of it, as long as they're speaking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The primary reason is to find/use the least congested channel(s). But it can also be used to find rogue devices. Call up anyone in Meraki Sales and they'll talk your ear off about it.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-24T21:46:42.977" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19468" PostTypeId="2" ParentId="19448" CreationDate="2015-06-24T22:08:11.783" Score="2" Body="&lt;p&gt;You want what Cisco calls &lt;em&gt;rspan&lt;/em&gt;. Someone put together a comparison of the ways to do this with comware, cisco, and provision: &lt;a href=&quot;http://h30499.www3.hp.com/hpeb/attachments/hpeb/switching-a-series-forum/3662/1/Port%20mirroring.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(switch with traffic of interest)&#xA;[Comware5]mirroring-group 1 remote-source&#xA;[Comware5]vlan 960&#xA;[Comware5]mirroring-group 1 remote-probe vlan 960&#xA;[Comware5]mirroring-group 1 mirroring-port g1/0/18 both&#xA;[Comware5]mirroring-group 1 monitor-egress g1/0/6&#xA;&#xA;(switch where analyzer is connected)&#xA;[Comware52]vlan 960&#xA;[Comware52]interface g1/0/1&#xA;[Comware52-GigabitEthernet1/0/1]port link-type trunk&#xA;[Comware52-GigabitEthernet1/0/1]port trunk permit vlan 960&#xA;[Comware52]mirroring-group 1 remote-destination&#xA;[Comware52]mirroring-group 1 remote-probe vlan 960&#xA;[Comware52]mirroring-group 1 monitor-port g1/0/2&#xA;&#xA;[*]display mirroring-group 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-24T22:08:11.783" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19469" PostTypeId="1" AcceptedAnswerId="22427" CreationDate="2015-06-25T01:01:54.027" Score="1" ViewCount="18475" Body="&lt;p&gt;I need to be able to ping a DMZ host from an INSIDE host and visa versa. I have tried configuring a static nat as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static (INSIDE,DMZ) 192.168.10.0 192.168.10.0 netmask 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I created an access-list called EXEMPT which permits any any. I know this is not the most secure option but at this point I just need it to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help and insight into this would be amazing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config of my device.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface Vlan1&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Vlan3002&#xA; nameif OUTSIDE&#xA; security-level 0&#xA; ip address 157.201.226.6 255.255.255.252 &#xA;!&#xA;interface Vlan3022&#xA; nameif INSIDE&#xA; security-level 50&#xA; ip address 192.168.10.1 255.255.255.0 &#xA;!&#xA;interface Vlan3052&#xA; nameif DMZ   &#xA; security-level 50&#xA; ip address 192.168.50.1 255.255.255.0 &#xA;!&#xA;interface Ethernet0/0&#xA; shutdown&#xA;!&#xA;interface Ethernet0/1&#xA; switchport access vlan 3022&#xA;!&#xA;interface Ethernet0/2&#xA; shutdown&#xA;!&#xA;interface Ethernet0/3&#xA; shutdown&#xA;!&#xA;interface Ethernet0/4&#xA; shutdown&#xA;!&#xA;interface Ethernet0/5&#xA; shutdown&#xA;!&#xA;interface Ethernet0/6&#xA; shutdown&#xA;!             &#xA;interface Ethernet0/7&#xA; switchport trunk allowed vlan 3002,3022,3052&#xA; switchport mode trunk&#xA;!&#xA;ftp mode passive&#xA;dns domain-lookup OUTSIDE&#xA;dns domain-lookup INSIDE&#xA;dns domain-lookup DMZ&#xA;same-security-traffic permit intra-interface&#xA;access-list OUTSIDE_access_in extended permit ip any any &#xA;access-list INSIDE extended permit ip any any &#xA;access-list OUTSIDE extended permit tcp any any eq 3389 &#xA;access-list OUTSIDE extended permit udp any any eq 3389 &#xA;access-list OUTSIDE extended permit tcp any any eq www &#xA;access-list OUTSIDE extended permit udp any any eq www &#xA;access-list OUTSIDE extended permit tcp any any eq https &#xA;access-list OUTSIDE extended permit udp any any eq 443 &#xA;access-list OUTSIDE extended permit tcp any any eq ssh &#xA;access-list OUTSIDE extended permit udp any any eq 22 &#xA;access-list OUTSIDE extended permit tcp any any eq 1 &#xA;access-list OUTSIDE extended permit udp any any eq 1 &#xA;access-list OUTSIDE extended permit icmp any any &#xA;access-list OUTSIDE extended permit tcp any any eq 50 &#xA;access-list OUTSIDE extended permit tcp any any eq 51 &#xA;access-list OUTSIDE extended permit udp any any eq isakmp &#xA;access-list OUTSIDE extended permit tcp any any eq ftp &#xA;access-list DMZ extended permit ip any any &#xA;access-list INSIDE_access_in extended permit ip any any &#xA;access-list from-dmz extended permit ip any any &#xA;access-list DMZ_access_in extended permit ip any any &#xA;access-list dmz-acl extended permit ip any any &#xA;access-list EXEMPT extended permit ip any any &#xA;access-list DMZ_nat0_outbound_1 extended permit ip any any &#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu OUTSIDE 1500&#xA;mtu INSIDE 1500&#xA;mtu DMZ 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-647.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (OUTSIDE) 1 interface&#xA;nat (INSIDE) 1 0.0.0.0 0.0.0.0&#xA;static (DMZ,OUTSIDE) 157.201.226.72 192.168.50.2 netmask 255.255.255.255 &#xA;static (DMZ,OUTSIDE) 157.201.226.73 192.168.50.3 netmask 255.255.255.255 &#xA;static (DMZ,OUTSIDE) 157.201.226.75 192.168.50.5 netmask 255.255.255.255 &#xA;static (INSIDE,OUTSIDE) 157.201.226.74 192.168.10.74 netmask 255.255.255.255 &#xA;static (INSIDE,DMZ) 192.168.10.0 192.168.10.0 netmask 255.255.255.0 dns &#xA;access-group OUTSIDE in interface OUTSIDE&#xA;access-group EXEMPT in interface INSIDE&#xA;access-group EXEMPT in interface DMZ&#xA;access-group EXEMPT out interface DMZ&#xA;route OUTSIDE 0.0.0.0 0.0.0.0 157.201.226.5 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;aaa-server Duo-Radius protocol radius&#xA;aaa-server Duo-Radius (DMZ) host 192.168.50.4&#xA; timeout 20&#xA; key cuddlypuppies&#xA; authentication-port 1812&#xA; accounting-port 1813&#xA; no mschapv2-capable&#xA;aaa authentication ssh console LOCAL &#xA;http server enable&#xA;http 0.0.0.0 0.0.0.0 OUTSIDE&#xA;snmp-server host DMZ 192.168.50.5 community public&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server community *****&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;no sysopt connection permit-vpn&#xA;crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map OUTSIDE_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map OUTSIDE_map interface OUTSIDE&#xA;crypto map INSIDE_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map INSIDE_map interface INSIDE&#xA;crypto map DMZ_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map DMZ_map interface DMZ&#xA;crypto isakmp enable OUTSIDE&#xA;crypto isakmp enable INSIDE&#xA;crypto isakmp enable DMZ&#xA;crypto isakmp policy 10&#xA; authentication crack&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 20&#xA; authentication rsa-sig&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 30&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 40&#xA; authentication crack&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 50&#xA; authentication rsa-sig&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 60&#xA; authentication pre-share&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 70&#xA; authentication crack&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 80&#xA; authentication rsa-sig&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 90&#xA; authentication pre-share&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 100&#xA; authentication crack&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 110&#xA; authentication rsa-sig&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 120&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 130&#xA; authentication crack&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 140&#xA; authentication rsa-sig&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 150&#xA; authentication pre-share&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 65535&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh 0.0.0.0 0.255.255.255 OUTSIDE&#xA;ssh 10.0.0.0 255.0.0.0 OUTSIDE&#xA;ssh 0.0.0.0 0.0.0.0 OUTSIDE&#xA;ssh timeout 30&#xA;console timeout 0&#xA;threat-detection basic-threat&#xA;threat-detection statistics port&#xA;threat-detection statistics protocol&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;tftp-server INSIDE 192.168.10.2 asdm-647.bin&#xA;webvpn&#xA; anyconnect-essentials&#xA;group-policy DfltGrpPolicy attributes&#xA; dns-server value 8.8.8.8&#xA; vpn-tunnel-protocol IPSec l2tp-ipsec &#xA;username team1 password 6cSlCtoGgNx3QZLp encrypted&#xA;tunnel-group DefaultRAGroup general-attributes&#xA; authentication-server-group Duo-Radius&#xA;tunnel-group DefaultRAGroup ipsec-attributes&#xA; pre-shared-key *&#xA;tunnel-group DefaultWEBVPNGroup general-attributes&#xA; authentication-server-group Duo-Radius&#xA; authentication-server-group (DMZ) Duo-Radius&#xA; secondary-authentication-server-group Duo-Radius use-primary-username&#xA; authorization-server-group Duo-Radius&#xA; accounting-server-group Duo-Radius&#xA;tunnel-group DefaultWEBVPNGroup ipsec-attributes&#xA; pre-shared-key *&#xA;!&#xA;!&#xA;prompt hostname context &#xA;Cryptochecksum:15266ece8259e82ee10eca7f9e72a029&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16164" LastEditorUserId="44" LastEditDate="2015-06-25T01:57:33.463" LastActivityDate="2015-09-12T15:37:52.847" Title="Traffic Between INSIDE and DMZ Cisco ASA" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19470" PostTypeId="1" CreationDate="2015-06-25T01:23:28.520" Score="5" ViewCount="50406" Body="&lt;p&gt;REF: &lt;a href=&quot;https://superuser.com/questions/932293/motorola-sbg6580-cable-modem-into-bridge-mode-on-bright-house-networks-does-not&quot;&gt;https://superuser.com/questions/932293/motorola-sbg6580-cable-modem-into-bridge-mode-on-bright-house-networks-does-not&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question being, with cable based connections where your incoming cable can split 3+ ways to TV, phones and an internet modem, do they relay on MAC addresses for routing and assigning IP information hence why you generally need to clone MAC Address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or am I wrong. Basically, Why and when is it required?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2021-06-30T12:26:17.390" Title="MAC Address cloning. Why and when is it required?" Tags="|mac-address|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19471" PostTypeId="1" AcceptedAnswerId="19494" CreationDate="2015-06-25T03:29:50.187" Score="1" ViewCount="1353" Body="&lt;p&gt;Is it correct to assume that MPLS edge routers can route packets into and through third party networks?  By this I mean, networks that are not label switched networks.  The diagrams they show of the big cloud in between edge routers suggests that there is some transparency over arbitrary networks.  The edge router sets up a pseudo wire to the destination router, but this can traverse arbitrary routers.  How is this accomplished?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/XCy1c.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16165" LastEditorUserId="3075" LastEditDate="2015-06-25T21:01:31.363" LastActivityDate="2015-06-25T21:57:51.980" Title="MPLS routing: how are packets routed in the interior network (third party equipment)" Tags="|routing|mpls|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19473" PostTypeId="1" AcceptedAnswerId="20238" CreationDate="2015-06-25T04:26:23.047" Score="4" ViewCount="2604" Body="&lt;p&gt;From what I have found on the internet, there is confusion about the role of MTU in EIGRP metric calculation.&lt;/p&gt;&#xA;&lt;p&gt;I performed an experiment in GNS with few routers. I was not able to find any change in path cost after the change in MTU value. This was obvious since MTU is not included in the formula of calculating the cost in EIGRP.&lt;/p&gt;&#xA;&lt;p&gt;Recently I found a &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-savage-eigrp-00&quot; rel=&quot;nofollow noreferrer&quot;&gt;&amp;quot;draft-savage-eigrp-00&amp;quot;&lt;/a&gt; on ietf explaining the EIGRP protocol. Yet this document also presents some sort of confusion.&lt;/p&gt;&#xA;&lt;p&gt;Under &lt;strong&gt;'EIGRP Metric Calculation'&lt;/strong&gt; on page 33, it states that&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The composite metric is based on bandwidth, delay, load, and&#xA;reliability. MTU is not an attribute for calculating the composite&#xA;metric.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Again on page 35 under &lt;strong&gt;'Wide Metric Vectors'&lt;/strong&gt; it states that&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;EIGRP uses five 'vector' metrics: minimum throughput, latency, load,&#xA;reliability, and maximum transmission unit (MTU).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;From my own practical observation I was able to deduce that &amp;quot;MTU is not even used as tie breaking when comparing equal cost paths&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;This whole adds up to my confusion. I am not able to deduce the meaning of &lt;strong&gt;MTU is a vector and an attribute in EIGRP metric calculation&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I accept that if its not an attribute, it has nothing to do with cost estimation. Hence it is not included in the formula for metric.&lt;/p&gt;&#xA;&lt;p&gt;metric = {K1&lt;em&gt;BW + [(K2&lt;/em&gt;BW)/(256-load)]+(K3&lt;em&gt;delay)}&lt;/em&gt;{K5/(reliability+K4)}&lt;/p&gt;&#xA;&lt;p&gt;If it is considered as one the vectors in find the path, the change in MTU of successor must trigger some sort of process (an update of path if it is too low as compared to feasible successor). But my observation says it does not.&lt;/p&gt;&#xA;&lt;p&gt;Can someone please help me.&lt;/p&gt;&#xA;" OwnerUserId="10317" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2018-07-21T09:01:07.660" Title="Role of MTU in EIGRP metric calculation!" Tags="|cisco|eigrp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19474" PostTypeId="2" ParentId="19470" CreationDate="2015-06-25T05:04:08.240" Score="5" Body="&lt;p&gt;The only reason to clone a MAC in this context, is because the ISP limits connectivity to that registered MAC. That would typically be the router supplied by the ISP -- you'd clone it's MAC onto the router of your choosing. Since the modem is the router these days (i.e. SBG6580), and few (if any?) ISPs still restrict connectivity to a &quot;registered MAC&quot;, it's rarely done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I do it to keep the same IP, and not have to reset the modem &lt;em&gt;if&lt;/em&gt; I change routers. The modem &lt;em&gt;does&lt;/em&gt; enforce a limited number of devices behind it -- (1) for most residential settings, (4) or more in business settings.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-25T05:04:08.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19475" PostTypeId="2" ParentId="19469" CreationDate="2015-06-25T05:20:58.237" Score="1" Body="&lt;p&gt;Traffic between two interfaces of the same security level is dropped.  This is the innate behavior of the ASA.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be overridden by applying &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa81/command/ref/refgd/s1.html#wp1383263&quot; rel=&quot;nofollow&quot;&gt;this command&lt;/a&gt;:  &lt;code&gt;same-security-traffic permit inter-interface&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not to be confused with &quot;same-security-traffic permit &lt;em&gt;intra&lt;/em&gt;-interface&quot;.  Which allows traffic to flow in and back out the same interface.  I saw you had this one applied, and you might actually need it.  But you will definitely need to apply the other one as well (&lt;code&gt;inter&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Better yet, you could also change the Inside's security level to 100 (or really any value &lt;em&gt;more&lt;/em&gt; than that of your DMZ, which is currently 50).  &lt;em&gt;If I were you, that is what I would do.&lt;/em&gt;  Since you have them separated, you may as well consider one more secure than the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR /&gt;&#xA;Additionally, you will want to apply NAT Exemption properly.  Trying to do it with this catch all Static NAT will work... until you want traffic to flow from the Inside to the Outside interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static (INSIDE,DMZ) 192.168.10.0 192.168.10.0 netmask 255.255.255.0 dns &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remove this static statement.  And apply NAT Exemption in a way where it will ONLY apply to traffic between the Inside and DMZ interface.  Which means you have to do a Policy NAT Exemption (aka, NAT Exemption with an ACL).  It will look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list NONAT permit ip 192.168.10.0 255.255.255.0 192.168.50.0 255.255.255.0&#xA;nat (inside) 0 access-list NONAT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way, when your Inside hosts are speaking to the Internet, it won't match the NAT Exemption and will be processed via your regular Static statements.  But when your Inside hosts are trying to speak to your DMZ hosts, the NAT Exemption will take precedence over your Static statement, and let the traffic proceed without the need for NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A further note:  NAT Exemption is bi-directional innately, so you do not need to apply an ACL entry for traffic in the other direction.  *So long as you apply the ACL from the perspective of traffic initiated from the higher security level, as above.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-06-25T05:20:58.237" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19476" PostTypeId="1" CreationDate="2015-06-25T06:15:08.607" Score="0" ViewCount="1032" Body="&lt;p&gt;I've been learning how to use ASA5505 but I faced this thing: When I try to assign Ethernet0/1 with vlan 1, which is the inside network, I see no change in the answer of &lt;code&gt;sh int ip bri&lt;/code&gt; or &lt;code&gt;sh run&lt;/code&gt;. Why this could be happening? I do not see anything wrong with my firewall.&lt;/p&gt;&#xA;" OwnerUserId="16052" LastEditorUserId="619" LastEditDate="2015-06-25T06:40:41.893" LastActivityDate="2015-07-25T07:38:58.540" Title="ASA5505 switchport command" Tags="|cisco-asa|firewall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19477" PostTypeId="2" ParentId="19476" CreationDate="2015-06-25T06:40:16.067" Score="1" Body="&lt;p&gt;VLAN 1 (&lt;code&gt;switchport access vlan 1&lt;/code&gt;) is the default. As such, it will not normally show in the config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show switch vlan&lt;/code&gt; is the command to see what vlans are defined, and what ports are assigned to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interface list will never show any IP configuration for the ethernet ports because they are part of a switch. (and you cannot &lt;code&gt;no switchport&lt;/code&gt; them into routed interfaces.) All layer-3 configuration is via VLAN interfaces.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-06-25T06:51:24.943" LastActivityDate="2015-06-25T06:51:24.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19479" PostTypeId="2" ParentId="19473" CreationDate="2015-06-25T09:03:43.077" Score="2" Body="&lt;p&gt;The MTU metric is only used as a tie-breaker. The formula doesn't calculate MTU value. The MTU is used if the router has to choose between routes (theory). &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;EIGRP routing updates are triggered only by a change in network&#xA;  topology (interface up/down event, IP addressing change or configured&#xA;  bandwidth/delay change) and not by change in interface load or&#xA;  reliability. The load/reliability numbers are thus a snapshot taken at&#xA;  the moment of the topology change and should be ignored.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think that MTU make part like load/reliability procedure, and doesn't triggers route update&lt;/p&gt;&#xA;" OwnerUserId="15277" LastActivityDate="2015-06-25T09:03:43.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19481" PostTypeId="1" AcceptedAnswerId="19488" CreationDate="2015-06-25T10:54:47.070" Score="2" ViewCount="1710" Body="&lt;p&gt;I've very green with cisco devices so I apologize upfront should this be a 'silly' question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've setup a cisco 2504 wireless controller (WLC) and enabled the DHCP server feature so I could distribute IPs to any devices connected to it. &#xA;The WLC is not connected to a WAN; only LAN devices are connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect my computer to the WLC to configure it, I am able to access it through the web interface and send ping packets. &#xA;When I then connect a cisco AP to the WLC, both the AP and the computer fail to communicate with the WLC.&#xA;Basically, only 1 device can be connected to the WLC at any given time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me get to the bottom of this please ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards and thanks in advance,&#xA;J&lt;/p&gt;&#xA;" OwnerUserId="16177" LastActivityDate="2015-06-25T15:21:39.507" Title="Cisco wireless controller 2504" Tags="|cisco|wireless|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19482" PostTypeId="1" AcceptedAnswerId="19489" CreationDate="2015-06-25T12:51:01.353" Score="1" ViewCount="10135" Body="&lt;p&gt;I'm Java developer and sometimes I need to test the development using the database of the client. So they give access using Windows and Mac by a program called &lt;code&gt;Palo Alto Global Protect&lt;/code&gt; where I need to put my login, password and address of the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I tried to configure the settings by myself but I couldn't connect. I asked the support team to configure it, they tried but it doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have one virtual machine using &lt;code&gt;Virtual Box&lt;/code&gt; that I can install the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there is one way to get the access to this &lt;code&gt;VPN&lt;/code&gt; or configure it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using &lt;code&gt;Linux Mint&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16179" LastEditorUserId="13402" LastEditDate="2015-06-25T14:58:28.653" LastActivityDate="2015-06-25T15:35:07.597" Title="Access a Palo Alto VPN using Mint" Tags="|vpn|linux|palo-alto|" AnswerCount="1" CommentCount="7" ClosedDate="2015-06-26T23:31:55.540" ContentLicense="CC BY-SA 3.0" />
  <row Id="19484" PostTypeId="1" CreationDate="2015-06-25T13:49:35.717" Score="1" ViewCount="928" Body="&lt;p&gt;I encountered a problem configuring a Cisco Catalyst 3560.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a trunk interface connected to a Linux server that operates services on different VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to ping the router on 192.168.1.182 from a machine in VLAN 110, it works, but when I try for VLAN 98 to ping a host, even the Cisco can't ping itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I looked at the network packets, the router sent ARP requests with a wrong tag and the wrong source address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;who has 192.168.3.2? Tell 192.168.1.182&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The command &lt;code&gt;show interfaces&lt;/code&gt; showed the VLAN interface connected sometimes (I can't manage to find out how it is decided to be set 98 up or down). In both cases it didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only difference between those VLANs is VLAN 110 has others ports in access mode. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/3&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 98,110&#xA; switchport mode trunk&#xA; shutdown&#xA;!&#xA;&#xA;[...]&#xA;&#xA;interface GigabitEthernet0/11&#xA; switchport access vlan 110&#xA; switchport mode access&#xA;&#xA;[...]&#xA;&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan98&#xA; ip address 192.168.3.1 255.255.255.252&#xA;!&#xA;interface Vlan110&#xA; ip address 192.168.2.182 255.255.255.240&#xA;!&#xA;ip classless&#xA;ip http server&#xA;!&#xA;!&#xA;ip sla enable reaction-alerts&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea?&lt;/p&gt;&#xA;" OwnerUserId="16181" LastEditorUserId="8499" LastEditDate="2016-03-23T01:04:57.810" LastActivityDate="2016-03-23T01:04:57.810" Title="Cisco 3560, SVI and VLAN tagging" Tags="|cisco|vlan|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19485" PostTypeId="1" AcceptedAnswerId="19499" CreationDate="2015-06-25T14:07:29.300" Score="5" ViewCount="3779" Body="&lt;p&gt;I am using a Cayalyst 2960-X series Cisco Switch, Whose 2 SFPs are connecting between 2 hosts (A,B). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A,B are connected to the switch's 1,2 ports respectively.&#xA;The host communicates using an l2tp based protocol. As you know &lt;a href=&quot;https://en.wikipedia.org/wiki/Layer_2_Tunneling_Protocol&quot; rel=&quot;nofollow&quot;&gt;l2tp&lt;/a&gt; is a link layer protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As part of the l2tp traffic sourced at host A whose destination is B, there are few packets I want to deny from getting to port 2 / Host B. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packets that I want to drop have a source MAC address of &lt;code&gt;88:77:66:55:44:33&lt;/code&gt; in their Ethernet 2 metadata, which is part of the whole l2tp packet (see the byte layout bellow). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to set a rule or an access list that drops the l2tp packet by inspecting its Ethernet 2 attribute and in case the specific &lt;code&gt;88:77:66:55:44:33&lt;/code&gt; MAC address appears in the SA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am familiar with the &lt;code&gt;mac access-list&lt;/code&gt; command but every manual I had seen explicitly says that ACLs filter only &lt;code&gt;non-IP protocols&lt;/code&gt;. In spite of that I tried to use &lt;code&gt;mac access-list&lt;/code&gt; and indeed it didn't help. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, I found the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/security/configuration_guide/b_sec_152ex_2960-x_cg.pdf&quot; rel=&quot;nofollow&quot;&gt;Catalyst 2960-X Switch Security Configuration Guide, Cisco IOS&#xA;Release 15.0(2)EX&lt;/a&gt;, and under the &lt;code&gt;Restrictions for Configuring Network Security with ACLs&lt;/code&gt; section it says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You cannot apply named MAC extended ACLs to Layer 3 interfaces.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Isn't it feasible to filter ip protocols by drill down and inspecting their Ethernet 2 Mac addresses data?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;By sniffing the traffic between the 2 hosts, I can tell the packets has the following byte layout (As I see on Wireshark):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 0                   1                   2                   3&#xA;    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |        Ethernet 2 (14 Bytes)     |       IP(20 Bytes)         |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   | IP  |L2TP 4B|HDLC 4B| Data                                    |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16182" LastEditorUserId="16182" LastEditDate="2019-02-04T06:40:35.597" LastActivityDate="2019-02-04T06:40:35.597" Title="Cisco Switch (Cayalyst 2960-X): How to add a rule to the access list that filters out l2tp packet when a specific MAC address appears in it?" Tags="|cisco|ipv4|cisco-catalyst|ip|cisco-commands|" AnswerCount="3" CommentCount="14" ContentLicense="CC BY-SA 4.0" />
  <row Id="19488" PostTypeId="2" ParentId="19481" CreationDate="2015-06-25T15:21:39.507" Score="1" Body="&lt;p&gt;For anyone unable to connect a cisco access point in lightweight mode to the Wireless controller, this did the trick for me:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Step 1&lt;/strong&gt; &lt;br&gt;Follow these steps to disable the 802.11a and 802.11b/g networks as follows: a.          Choose Wireless&gt; 802.11a/n &gt; Network.&#xA;  b.          Unselect the 802.11a Network Status check box. c.&lt;br&gt;&#xA;  Click Apply to commit your changes. d.          Choose Wireless &gt;&#xA;  802.11b/g/n &gt; Network. e.          Unselect the 802.11b/g Network Status check box. f.          Click Apply to commit your changes.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Step 2&lt;/strong&gt;&lt;br&gt; Choose Wireless &gt; Country to open the Country page&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Step 3&lt;/strong&gt; &lt;br&gt; Select the check box for each country where your access points are installed. If you selected more than one check box,&#xA;  a message appears indicating that RRM channels and power levels are&#xA;  limited to common channels and power levels.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Step 4&lt;/strong&gt;&lt;br&gt; Click OK to continue or Cancel to cancel the operation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Step 5&lt;/strong&gt;&lt;br&gt; Click Apply to commit your changes.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Step 6&lt;/strong&gt;&lt;br&gt; Reenable the 802.11a and 802.11b/g networks&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See more at: &lt;a href=&quot;https://supportforums.cisco.com/discussion/11420901/issue-connecting-1131ag-regulatory-domain-check-has-failed-ap#sthash.riTr9kdw.dpuf&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/11420901/issue-connecting-1131ag-regulatory-domain-check-has-failed-ap#sthash.riTr9kdw.dpuf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16177" LastActivityDate="2015-06-25T15:21:39.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19489" PostTypeId="2" ParentId="19482" CreationDate="2015-06-25T15:35:07.597" Score="4" Body="&lt;p&gt;The thing is that you are not using the official Global Protect client so you need and extra configuration step in the firewall. You need to define X-Auth support (on the firewall) and all related fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, you can use any SSL VPN Standard client. I confirm it works for me in Linux and IOS (the iphone thing, not the Cisco :P).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This link would be quite useful for you. &lt;a href=&quot;http://blog.webernetz.net/2014/03/31/palo-alto-globalprotect-for-linux-with-vpnc/&quot; rel=&quot;nofollow&quot;&gt;http://blog.webernetz.net/2014/03/31/palo-alto-globalprotect-for-linux-with-vpnc/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2015-06-25T15:35:07.597" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="19491" PostTypeId="1" CreationDate="2015-06-25T17:17:05.330" Score="0" ViewCount="694" Body="&lt;p&gt;I'm dealing with the following situation: I have 2 servers running Windows 2012 R2 and 1 server running Windows 2008 R2. I need to build a Microsoft Network LoadBalancer cluster using the 3 servers; servers are connected to a cisco Nexus Switch; servers are using Intel as well as Broadcom Nic cards. The servers are in the same subnet and the Network LoadBalancer VIP of the newly formed cluster is also in the same subnet. As long as wireshark is running on the servers the cluster is working (setting the nic interfaces to promiscuous mode) - members are detecting / seeing each other and passing each other the Primary / Master role when configured via the Network Load Balancer UI. How can this be possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another strange thing: if I take one of the member offline from the cluster and run a Wireshark capture, I can see the Microsoft Network Load Balancer heartbeat broadcast messages being received from that host; nevertheless, as soon as I add the host again in the cluster, and I restart Wireshark, then the Network Load balancer cluster is working but in the Wireshark capture, I don't see any Network Load Balancer hearthbeat messages received any longer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, each time I take any host offline from the Network Load Balancer cluster or add it to the Network Load Balancer cluster, Wireshark stops the formerly ongoing capture and displays a notification message stating that the ongoing capture cannot continue as the NIC formerly in use is no longer available.&lt;/p&gt;&#xA;" OwnerUserId="16189" LastEditorDisplayName="user16223" LastEditDate="2015-06-28T19:55:20.300" LastActivityDate="2015-06-28T19:55:20.300" Title="Microsoft load balancer heartbeat" Tags="|cisco|wireshark|load-balancer|" AnswerCount="1" CommentCount="3" ClosedDate="2015-06-29T21:20:47.157" ContentLicense="CC BY-SA 3.0" />
  <row Id="19492" PostTypeId="2" ParentId="19491" CreationDate="2015-06-25T18:29:35.667" Score="1" Body="&lt;p&gt;Are the servers virtualized? If VMWare, then there are specific considerations for configuring monitoring, search VMWare's documentation site for packet capture on vSwitch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a link to a Cisco document on configuring NLB for Cisco 6500 series and 4948 switches. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/107995-configure-nlb-00.html?mdfid=270638922&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/107995-configure-nlb-00.html?mdfid=270638922&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this in the release notes for 9000 series running 7.0(3)l1(1), dated 01Feb2015 at &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/release/notes/70311_nxos_rn.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/6-x/release/notes/70311_nxos_rn.html&lt;/a&gt;, under &quot;Limitations&quot;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Cisco NX-OS Release 6.1(2)I2(2b) supports flooding for Microsoft Network Load Balancing (NLB) unicast mode on Cisco Nexus 9500 Series switches but not on Cisco Nexus 9300 Series switches. NLB is not supported in max-host system routing mode. NLB multicast mode is not supported on Cisco Nexus 9500 or 9300 Series switches.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are the switches 9300s?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VMWare has instructions for implementing MS NLB in unicast mode: &lt;a href=&quot;http://www.vmware.com/files/pdf/implmenting_ms_network_load_balancing.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.vmware.com/files/pdf/implmenting_ms_network_load_balancing.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Microsoft's MSDN web page on the topic: &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/bb742455.aspx?f=255&amp;amp;MSPPError=-2147217396&quot; rel=&quot;nofollow&quot;&gt;https://msdn.microsoft.com/en-us/library/bb742455.aspx?f=255&amp;amp;MSPPError=-2147217396&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Microsoft TechNet page about this topic &lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc732592(WS.10).aspx#BKMK_B&quot; rel=&quot;nofollow&quot;&gt;https://technet.microsoft.com/en-us/library/cc732592(WS.10).aspx#BKMK_B&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH, Jason&lt;/p&gt;&#xA;" OwnerUserId="10660" LastActivityDate="2015-06-25T18:29:35.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19493" PostTypeId="2" ParentId="19445" CreationDate="2015-06-25T20:28:40.693" Score="1" Body="&lt;p&gt;Hosts are computers whereas nodes are all devices that have network addresses assigned.  So, a router is not a host but is a node.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Node (networking)&lt;/strong&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/Node_(networking)#Computer_network_nodes&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;&lt;br&gt;&#xA;In data communication, a physical network node may either be a data communication equipment (DCE) such as a modem, hub, bridge or switch; or a data terminal equipment (DTE) such as a digital telephone handset, a printer or a host computer, for example a router, a workstation or a server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the network in question is the Internet or an Intranet, many physical network nodes are host computers, also known as Internet nodes, identified by an IP address, and all hosts are physical network nodes. However, some datalink layer devices such as switches, bridges and WLAN access points do not have an IP host address (except sometimes for administrative purposes), and are not considered to be Internet nodes or hosts, but as physical network nodes and LAN nodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Host (network)&lt;/strong&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/Host_(network)&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;&lt;br&gt;&#xA;Every network host is a physical network node (i.e. a network device), but not every physical network node is a host. Network devices such as modems, hubs and network switches are not assigned host addresses (except sometimes for administrative purposes), and are consequently not considered to be network hosts. Devices such as network printers and hardware routers have IP addresses, but since they are not general-purpose computers, they are sometimes not considered to be hosts.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-25T20:28:40.693" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19494" PostTypeId="2" ParentId="19471" CreationDate="2015-06-25T20:32:59.627" Score="2" Body="&lt;p&gt;In the diagram you posted, the provider network is in fact a label switched network.  The &quot;P&quot; designation on the routers usually implies that they are LSRs.  It is depicted as a cloud because from the customer's point of view, the physical connections between the provider routers are unimportant.  Pseudowires and other tunneling modes are accomplished through label switching.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-06-25T21:57:51.980" LastActivityDate="2015-06-25T21:57:51.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19495" PostTypeId="2" ParentId="19485" CreationDate="2015-06-26T01:40:25.480" Score="-2" Body="&lt;pre&gt;&lt;code&gt;Switch# configure terminal&#xA;Switch(config)# mac access-list extended maclist1&#xA;Switch(config-ext-macl)# deny 8877.6655.4433 any&#xA;Switch(config-ext-macl)# deny any 8877.6655.4433&#xA;Switch(config-ext-macl)# permit any any&#xA;Switch(config-ext-macl)# end&#xA;Switch(config)# interface gigabitethernet1/0/1&#xA;Switch(config-if)# mac access-group mac1 out&#xA;Switch(config)# interface gigabitethernet1/0/2&#xA;Switch(config-if)# mac access-group mac1 out&#xA;Switch(config-if)# end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-06-29T01:32:24.660" LastActivityDate="2015-06-29T01:32:24.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19496" PostTypeId="1" CreationDate="2015-06-26T01:55:38.347" Score="2" ViewCount="1654" Body="&lt;p&gt;While testing network stability with ping, requests timed out before MAX-TIME-TO-WAIT for each reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noted the lines that timed out before 500ms.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;COMMAND&amp;gt;ping google.com -n 20 -w 500&#xA;&#xA;Pinging google.com [&amp;lt;google-ip&amp;gt;] with 32 bytes of data: &#xA;Reply from &amp;lt;google-ip&amp;gt;: bytes=32 time=21ms TTL=55 &#xA;Reply from &amp;lt;google-ip&amp;gt;: bytes=32 time=13ms TTL=55 &#xA;Reply from &amp;lt;google-ip&amp;gt;: bytes=32 time=18ms TTL=55 &#xA;Reply from &amp;lt;google-ip&amp;gt;: bytes=32 time=16ms TTL=55 &#xA;Reply from &amp;lt;google-ip&amp;gt;: bytes=32 time=10ms TTL=55 &#xA;Reply from &amp;lt;google-ip&amp;gt;: bytes=32 time=17ms TTL=55 &#xA;Reply from &amp;lt;google-ip&amp;gt;: bytes=32 time=20ms TTL=55 &#xA;Request timed out. &#xA;Request timed out. &#xA;Reply from &amp;lt;google-ip&amp;gt;: bytes=32 time=117ms TTL=55&#xA;Request timed out.      &amp;lt;---***timed out before 500ms***&#xA;Request timed out.      &amp;lt;---***timed out before 500ms***&#xA;Request timed out.      &amp;lt;---***timed out before 500ms***&#xA;Request timed out.      &amp;lt;---***timed out before 500ms***&#xA;Request timed out.      &amp;lt;---***timed out before 500ms***&#xA;Request timed out.      &amp;lt;---***timed out before 500ms***&#xA;Request timed out.&#xA;Request timed out. &#xA;Reply from &amp;lt;google-ip&amp;gt;: bytes=32 time=453ms TTL=55 &#xA;Reply from &amp;lt;google-ip&amp;gt;: bytes=32 time=23ms TTL=55&#xA;&#xA;Ping statistics for &amp;lt;my-ip-addr&amp;gt;:&#xA;    Packets: Sent = 20, Received = 10, Lost = 10 (50% loss), &#xA;Approximate round trip times in milli-seconds:&#xA;    Minimum = 10ms, Maximum = 453ms, Average = 70ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you for the edit @YLearn, and sorry for that, first ever question on this forum. About the IP addresses, I mistakenly replaced all (using &amp;lt;*.*.*.*&gt;). And about the timeouts,  I was keenly observing them and I am certain &lt;strong&gt;they all&lt;/strong&gt; occurred in a blink, which should not happen since -w is set to  500ms, which is humanly noticable. Point taken about testing stability with ping for external networks. Now, my confusion is that what led the requests to timeout before 500 ms. Is there some mechanism by which routers in the path,  nearer to the destination, can inform the source about packet loss, resulting in timeout?&lt;/p&gt;&#xA;" OwnerUserId="16194" LastEditorUserId="16194" LastEditDate="2015-06-26T18:28:33.933" LastActivityDate="2015-06-29T21:09:06.113" Title="What can we say about the stability of the network with this information?" Tags="|ping|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19498" PostTypeId="1" CreationDate="2015-06-26T03:33:42.483" Score="6" ViewCount="2409" Body="&lt;p&gt;I have got an issue where &lt;strong&gt;SPOKE 1&lt;/strong&gt; and &lt;strong&gt;SPOKE 2&lt;/strong&gt; cannot communicate with each other. However, &lt;strong&gt;SPOKE 1 and SPOKE 2&lt;/strong&gt; can communicate with &lt;strong&gt;HUB&lt;/strong&gt;. Please see configuration below for spoke and hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SPOKE 1  (Cisco SRST881, v. 12.4)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SPOKE 2  (Cisco 887VA, v.12.4(22r)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;HUB          (ASA5525, v.8.6(1)2)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;** Spoke 1 (Cisco SRST881, v. 12.4) **&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ikev2 proposal AES256-192-128-PROPOSAL&#xA; encryption aes-cbc-256 aes-cbc-192 aes-cbc-128&#xA; integrity sha1&#xA; group 2&#xA;&#xA;crypto ikev2 policy IKEv2-Policy&#xA; proposal AES256-192-128-PROPOSAL&#xA;&#xA;crypto ikev2 keyring VPN-KEYS&#xA; peer ASA-DC&#xA;  address 200.200.200.1&#xA;  pre-shared-key local 12345678&#xA;  pre-shared-key remote 12345678&#xA;&#xA;crypto ikev2 profile ASA-DC&#xA; match identity remote address 200.200.200.1 255.255.255.255&#xA; identity local address 50.50.50.1&#xA; authentication local pre-share&#xA; authentication remote pre-share&#xA; keyring VPN-KEYS&#xA;&#xA;crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac&#xA;&#xA;crypto map SPOKE1-ASA 10 ipsec-isakmp&#xA; set peer 200.200.200.1&#xA; set transform-set ESP-AES256-SHA&#xA; set ikev2-profile ASA-DC&#xA; match address SPOKE1-VPN-ACL&#xA;&#xA;interface FastEthernet4&#xA; ip address dhcp&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; crypto map SPOKE1-ASA&#xA;&#xA;interface Vlan1&#xA; ip address 192.168.210.225 255.255.255.224&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;&#xA;ip nat inside source list NONAT interface FastEthernet4 overload&#xA;ip route 0.0.0.0 0.0.0.0 50.50.50.1&#xA;&#xA;ip access-list extended NONAT&#xA; deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255&#xA; permit ip 192.168.210.64 0.0.0.31 any&#xA;&#xA;ip access-list extended SPOKE1-VPN-ACL&#xA; permit ip 192.168.210.224 0.0.0.31 172.16.0.0 0.0.255.255&#xA; permit ip 192.168.210.224 0.0.0.31 192.168.210.64 0.0.0.31&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;** SPOKE 2 (Cisco 887VA, v.12.4(22r) **&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ikev2 proposal AES256-192-128-PROPOSAL&#xA; encryption aes-cbc-256 aes-cbc-192 aes-cbc-128&#xA; integrity sha1&#xA; group 2&#xA;&#xA;crypto ikev2 policy IKEv2-Policy&#xA; proposal AES256-192-128-PROPOSAL&#xA;&#xA;crypto ikev2 keyring VPN-KEYS&#xA; peer ASA-DC&#xA;  address 200.200.200.1&#xA;  pre-shared-key local 12345678&#xA;  pre-shared-key remote 12345678&#xA;&#xA;crypto ikev2 profile ASA-DC&#xA; match identity remote address 200.200.200.1 255.255.255.255&#xA; identity local address 100.100.100.1&#xA; authentication local pre-share&#xA; authentication remote pre-share&#xA; keyring VPN-KEYS&#xA;&#xA;crypto ipsec transform-set ESP-AES256-SHA esp-aes 256 esp-sha-hmac&#xA;&#xA;crypto map SPOKE2-ASA 10 ipsec-isakmp&#xA; set peer 200.200.200.1&#xA; set transform-set ESP-AES256-SHA&#xA; set ikev2-profile ASA-DC&#xA; match address SPOKE2-VPN-ACL&#xA;&#xA;interface Vlan1&#xA; ip address 192.168.210.65 255.255.255.224&#xA; ip helper-address 172.16.5.32&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;&#xA;interface Dialer1&#xA; ip address negotiated&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; encapsulation ppp&#xA; dialer pool 1&#xA; ppp chap hostname zzz@zzz.com&#xA; ppp chap password 7 zzzzzzzzz&#xA; crypto map SPOKE2-ASA&#xA;&#xA;ip nat inside source list NONAT interface Dialer1 overload&#xA;ip route 0.0.0.0 0.0.0.0 Dialer1&#xA;&#xA;ip access-list extended SPOKE2-VPN-ACL&#xA; permit ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255&#xA; permit ip 192.168.210.64 0.0.0.31 192.168.210.224 0.0.0.31&#xA;&#xA;ip access-list extended NONAT&#xA; deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255&#xA; permit ip 192.168.210.64 0.0.0.31 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;** HUB (ASA5525, v.8.6(1)2) **&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network SPOKE1&#xA; subnet 192.168.210.224 255.255.255.224&#xA;&#xA;object network SPOKE2&#xA; subnet 192.168.210.64 255.255.255.224&#xA;&#xA;object-group network INSIDE-SUBNET&#xA; network-object 172.16.0.0 255.255.0.0&#xA;&#xA;&#xA;access-list VPN-SPOKE1 extended permit ip object-group INSIDE-SUBNET object SPOKE1&#xA;access-list VPN-SPOKE1 extended permit ip object SPOKE2 object SPOKE1&#xA;access-list VPN-SPOKE2 extended permit ip object-group INSIDE-SUBNET object SPOKE2&#xA;access-list VPN-SPOKE2 extended permit ip object SPOKE1 object SPOKE2&#xA;&#xA;nat (inside,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE1 SPOKE1 no-proxy-arp route-lookup&#xA;nat (inside,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE2 SPOKE2 no-proxy-arp route-lookup&#xA;nat (any,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE1 SPOKE1 no-proxy-arp&#xA;nat (any,outside) source static inside-subnet-source INSIDE-SUBNET destination static SPOKE2 SPOKE2 no-proxy-arp&#xA;&#xA;route outside 192.168.210.64 255.255.255.224 200.200.200.1 1&#xA;route outside 192.168.210.224 255.255.255.224 200.200.200.1 1&#xA;&#xA;crypto ipsec ikev2 ipsec-proposal AES256-192-128-PROPOSAL&#xA; protocol esp encryption aes-256 aes-192 aes&#xA; protocol esp integrity sha-1&#xA;&#xA;crypto map ASA-VPN-SITE 10 match address VPN-SPOKE1&#xA;crypto map ASA-VPN-SITE 10 set peer 50.50.50.1&#xA;crypto map ASA-VPN-SITE 20 set ikev2 ipsec-proposal AES256-192-128-PROPOSAL&#xA;&#xA;crypto map ASA-VPN-SITE 20 match address VPN-SPOKE2&#xA;crypto map ASA-VPN-SITE 20 set peer 100.100.100.1&#xA;crypto map ASA-VPN-SITE 20 set ikev2 ipsec-proposal AES256-192-128-PROPOSAL&#xA;&#xA;tunnel-group 50.50.50.1 type ipsec-l2l&#xA;tunnel-group 50.50.50.1 ipsec-attributes&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;&#xA;tunnel-group 100.100.100.1 type ipsec-l2l&#xA;tunnel-group 100.100.100.1 ipsec-attributes&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;&#xA;same-security-traffic permit intra-interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Thanks for the quick reply Brett. Please see the result below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ciscoasa# packet-tracer input outside icmp 192.168.210.65 8 0 192.168.210.225&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 1&#xA;Type: CAPTURE&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;MAC Access list&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 2&#xA;Type: ACCESS-LIST&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Implicit Rule&#xA;Additional Information:&#xA;MAC Access list&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 3&#xA;Type: UN-NAT&#xA;Subtype: static&#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside,any) source static obj-192.168.0.0-nonat obj-192.168.0.0-nonat destination static obj-192.168.0.0-nonat obj-192.168.0.0-nonat no-proxy-arp&#xA;Additional Information:&#xA;NAT divert to egress interface inside&#xA;Untranslate 192.168.210.225/0 to 192.168.210.225/0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 4&#xA;Type: ACCESS-LIST&#xA;Subtype: log&#xA;Result: ALLOW&#xA;Config:&#xA;access-group outside in interface outside&#xA;access-list outside extended permit icmp any any&#xA;Additional Information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 5&#xA;Type: IP-OPTIONS&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 6&#xA;Type: INSPECT&#xA;Subtype: np-inspect&#xA;Result: ALLOW&#xA;Config:&#xA;class-map inspection_default&#xA;match default-inspection-traffic&#xA;policy-map global_policy&#xA;class inspection_default&#xA;  inspect icmp&#xA;service-policy global_policy global&#xA;Additional Information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 7&#xA;Type: INSPECT&#xA;Subtype: np-inspect&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 8&#xA;Type: VPN&#xA;Subtype: ipsec-tunnel-flow&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 9&#xA;Type: NAT&#xA;Subtype: rpf-check&#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside,any) source static obj-192.168.0.0-nonat obj-192.168.0.0-nonat destination static obj-192.168.0.0-nonat obj-192.168.0.0-nonat no-proxy-arp&#xA;Additional Information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 10&#xA;Type: IP-OPTIONS&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase: 11&#xA;Type: VPN&#xA;Subtype: encrypt&#xA;Result: DROP&#xA;Config:&#xA;Additional Information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result:&#xA;input-interface: outside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: inside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: drop&#xA;Drop-reason: (acl-drop) Flow is denied by configured rule&lt;/p&gt;&#xA;" OwnerUserId="16196" LastEditorUserId="49" LastEditDate="2016-03-29T15:59:24.380" LastActivityDate="2018-11-15T23:02:10.387" Title="ASA VPN communication issue" Tags="|cisco-asa|vpn|errors|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19499" PostTypeId="2" ParentId="19485" CreationDate="2015-06-26T05:20:41.930" Score="5" Body="&lt;p&gt;There seems to be some confusion about this topic for you. Let's begin by clearing up a few details.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I am familiar with the mac access-list command but every manual I had seen explicitly says that ACLs filter only non-IP protocols.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you think about this a bit, it makes sense. An IP packet doesn't contain a MAC addresses, so this would be difficult.  However, IP traffic is encapsulated in a L2 protocol, typically Ethernet which does utilize MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You cannot apply named MAC extended ACLs to Layer 3 interfaces.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Again, this is natural. Since MAC ACLs function on L2, they wouldn't really need/want them on a L3 interface anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, by default interfaces on a 2960-X are layer 2 interfaces, so you can apply a MAC access-list to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, this series of commands should provide the result you want (using the first SFP port on a WS-C2960X-48FPS-L so adjust as necessary):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Create the ACL&#xA;mac access-list extended TestACL&#xA;deny host 8877.6655.4433 any&#xA;permit any any&#xA;&#xA;! Now apply to the interface&#xA;interface Gi1/0/49&#xA;mac access-group TestACL in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit based on comments&lt;/strong&gt;: if you want to rule out the source port being incorrect, you can use the following with the above ACL to block all traffic from that MAC going out the second SFP port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! Now apply to the interface&#xA;interface Gi1/0/50&#xA;mac access-group TestACL out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If that doesn't work, then the MAC address has to be incorrect and you need to provide more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ACL will work no matter if the MAC address table is updated dynamically or if you add a static entry. However, if the dynamic entry for this MAC is flapping between different ports, that could explain why the ACL didn't work as intended.  Additionally, without additional features configured, the static entry will not have an effect on traffic arriving on a port, only on the destination port used for the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And finally, the packet being highlighted in red by Wireshark doesn't tell me much. Different versions of Wireshark have used different coloring rules, the default rules typically include a number of matches that get colored red, and many of us use our own custom rules. You would need to provide more detail or the actual capture for us to know what exactly that means.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-06-29T17:34:18.900" LastActivityDate="2015-06-29T17:34:18.900" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="19500" PostTypeId="1" AcceptedAnswerId="19506" CreationDate="2015-06-26T05:31:08.567" Score="4" ViewCount="650" Body="&lt;p&gt;Why is flow control implemented in both transport and data link layer?&#xA;If it is already implemented in the data link layer then what is the need to implement it again in the transport layer.&lt;/p&gt;&#xA;" OwnerUserId="16198" LastEditorUserId="8499" LastEditDate="2017-07-09T07:41:59.063" LastActivityDate="2017-07-09T07:41:59.063" Title="Flow control in networks" Tags="|ethernet|tcp|protocol-theory|transport-protocol|layer4|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19501" PostTypeId="1" CreationDate="2015-06-26T08:06:25.473" Score="4" ViewCount="1621" Body="&lt;p&gt;At one of our offices, a new ISP recently installed an Internet connection via Radwin microwave radios, going to an E1 line back to the capital where their routing equipment is. There is a very strange problem which has prevented us from using the Internet connection, and neither our technicians nor the ISP's have been able to resolve it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a laptop computer is connected to the Radwin, it can use the Internet connection. However, when we go from Radwin to our router (Linux-based) through a switch (HP 3500-24G-PoE+ yl), the connection is not usable. Our router ARPs for the GW, but never receives any replies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;mirror&lt;/code&gt; and &lt;code&gt;monitor&lt;/code&gt; commands to mirror traffic from various switchports to another switchport where a laptop is running Wireshark, I can see ARP replies from the ISP reaching the ingress switchport. But the ARP replies are not visible on the egress switchport (to the router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Wireshark, I can see that the destination MAC addresses on these ARP packets is the router's address. I can also see the router's address in the switch's MAC address table. The switch &lt;em&gt;should&lt;/em&gt; forward those packets to the egress switchport! But it doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both switchports are on the same VLAN (ingress is untagged, egress is tagged). We are not using anything like &lt;code&gt;arp-protect&lt;/code&gt;. No &lt;code&gt;lockout-mac&lt;/code&gt;, no &lt;code&gt;dhcp-snooping&lt;/code&gt;, no &lt;code&gt;spanning-tree&lt;/code&gt;. The config is almost minimal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The obvious conclusion is that the switch itself could be defective. But I have tried another HP switch &lt;em&gt;and&lt;/em&gt; a Cisco SF302, with the same results in each case. I have also tried updating the firmware in the original HP 3500. All 3 of these switches have been successfully used elsewhere. Everything on our LAN works through any one of them. And the secondary Internet connection which is being used right now works through them as well, just not the new primary connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also interesting is that I &lt;em&gt;can&lt;/em&gt; ARP-ping (and ICMP ping) the management interfaces on the Radwins, from the router, through the switch. &lt;em&gt;Those&lt;/em&gt; ARP replies pass through the switch just fine. But the ones from the GW do not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have experimented with manually setting MDIX, port speed, and duplex settings on the relevant switch ports; no difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also interesting: the GW's MAC address does &lt;em&gt;not&lt;/em&gt; appear in the switch's MAC address table. The MAC addresses of the Radwins and the router do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any ideas why on earth these switches would behave this way???&lt;/p&gt;&#xA;" OwnerUserId="5478" LastEditorUserId="775" LastEditDate="2015-06-26T09:56:44.170" LastActivityDate="2015-06-26T18:59:13.377" Title="How to troubleshoot reason why ARP replies from ISP are not forwarded through our switch?" Tags="|switch|ethernet|troubleshooting|arp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="19502" PostTypeId="1" CreationDate="2015-06-26T08:22:52.410" Score="0" ViewCount="1019" Body="&lt;p&gt;Using any protocol to transfer files on web.For example when a client is sending a request to www.google.com, the requested page will be given to the client, in this case he/she did not use a port numbr wen writing. So my question is that why we do not specify a port number when sending request? &lt;/p&gt;&#xA;" OwnerUserId="16200" LastEditorUserId="16200" LastEditDate="2015-06-26T08:39:31.533" LastActivityDate="2015-06-29T13:43:47.943" Title="Why the port number can not be specified when sending a request to a server?" Tags="|protocol-theory|" AnswerCount="1" CommentCount="5" ClosedDate="2019-06-30T00:47:44.593" ContentLicense="CC BY-SA 3.0" />
  <row Id="19503" PostTypeId="1" CreationDate="2015-06-26T08:48:28.250" Score="2" ViewCount="2810" Body="&lt;p&gt;First of all, I have fairly basic knowledge of Cisco ASAs, but I'm attempting to look into something that is bugging me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am working through the ASDM as opposed to the CLI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a Cisco ASA5505 router that has 192.168.1.x network on linking on Ethernet Port 0. We also have a set of switches which are linked to the ASA through Ethernet Port 3 on 192.168.71.x.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The connectivity between the 2 is functioning without a hitch. My issue is currently with users that VPN in. When users VPN in they obtain a 192.168.73.x address given by the ASA. They are able to access anything on the 192.168.1.x through Ethernet 0 but unable to access anything on the 192.168.71.x network through Ethernet 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in a brief summary, no issues talking to either network when inside of the ASA but when connecting to the ASA through VPN only access to 192.168.1.x network on Ethernet 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers or information on where I should be looking for answers would be much appreciated, and if you need any more information to help, then by all means I can try and explain as best I can!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Visit www.fresh.co.uk/CiscoConfiguration/Cisco.txt for Configuration of Cisco ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, have an issue on here which could well be part of the issue. Under VPN &gt; Connection Gateway, there is an Entry in there for the 71.x network (the network needed access) which is pointing to the incorrect gateway. I attempted to change this to the correct gateway (71.253), but an error for  &lt;code&gt;Cannot Remove Connected route&lt;/code&gt; and &lt;code&gt;Cannot add route, Connected route exists&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16201" LastEditorUserId="8499" LastEditDate="2016-03-26T15:41:21.270" LastActivityDate="2017-03-22T11:52:33.247" Title="Cisco ASA 5505 - VPN not able to access certain network" Tags="|cisco|cisco-asa|vpn|firewall|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19504" PostTypeId="1" AcceptedAnswerId="19513" CreationDate="2015-06-26T09:59:17.813" Score="2" ViewCount="410" Body="&lt;p&gt;I know this shouldn't work but using Cisco's Packet Tracer, I'm able to send a ping from PC2 to PC1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in reality, PC2 is on a different network and thinks that PC1 is on the same network, thus, sending an ARP requesting the mac of 10.0.9.7 using a broadcast. this should fail. am I right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can PC2 from 10.0.8.2 send a ping to 10.0.9.7? it's working on packet tracer and I don't know why.&lt;/p&gt;&#xA;" OwnerUserId="16185" LastEditorUserId="16185" LastEditDate="2015-06-27T08:59:11.447" LastActivityDate="2015-06-27T08:59:11.447" Title="Can PC2 on subnet mask /23 send a ping to PC1 (both connected on different router ports/networks)" Tags="|ipv4|subnet|arp|ping|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19506" PostTypeId="2" ParentId="19500" CreationDate="2015-06-26T11:00:23.770" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is flow control implemented in both transport and data link layer?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because flow control is not implemented in &lt;em&gt;all&lt;/em&gt; transport layer protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP may be popular, but there are a non-trivial number of people using UDP applications, or completely non-IP applications (such as &lt;a href=&quot;http://www.t11.org/fcoe&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Fiber Channel over Ethernet&quot;&gt;FCOE&lt;/a&gt;, which heavily depends on flow control in &lt;a href=&quot;https://en.wikipedia.org/wiki/Data_center_bridging&quot; rel=&quot;nofollow noreferrer&quot;&gt;DCB / Lossless ethernet&lt;/a&gt;)&lt;sup&gt;Note 1&lt;/sup&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add to this &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/19500/flow-control-in-networks/19506#comment29425_19500&quot;&gt;cpt_fink's comment&lt;/a&gt; that data-link flow-control can be implemented as &lt;a href=&quot;https://en.m.wikipedia.org/wiki/Per-hop_behaviour&quot; rel=&quot;nofollow noreferrer&quot;&gt;per-hop behavior&lt;/a&gt; (which basically goes back to my first point).  By definition, transport flow control cannot be implemented thusly.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Note 1&lt;/sup&gt;  I'm personally not fond of the notion of &quot;lossless ethernet&quot;, but I can't change the reality that people use that term.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-06-27T00:58:00.767" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19507" PostTypeId="1" AcceptedAnswerId="19516" CreationDate="2015-06-26T11:09:53.893" Score="2" ViewCount="651" Body="&lt;p&gt;Am I correct that HC SNMP interface counters like &lt;code&gt;ifHCInOctets&lt;/code&gt;/&lt;code&gt;ifHCOutOctets&lt;/code&gt; or &lt;code&gt;ifHCInUcastPkts&lt;/code&gt;/&lt;code&gt;ifHCOutUcastPkts&lt;/code&gt; wrap after such a long period that applications using those counters do not need to take this wrapping into account (not including situations where the counters might reset such as a switch reloading). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, even if 100GigE interface is fully utilized 24/7, the counter would wrap after 46 years and 9 months:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ echo &quot;((2^64-1)/(100*10^9/8))/60/60/24/365&quot; | bc -l&#xA;46.79539338840576259512&#xA;$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="775" LastEditDate="2015-06-26T13:04:15.207" LastActivityDate="2015-06-27T03:26:30.583" Title="Wrapping of high capacity (HC) counters" Tags="|ethernet|snmp|management|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19509" PostTypeId="2" ParentId="19502" CreationDate="2015-06-26T13:17:53.530" Score="5" Body="&lt;p&gt;Actually the port can be specified. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there are some standard ports&#xA;80 =&gt; HTTP&#xA;443 =&gt; HTTPS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you don't enter anything into your browser (eg. &lt;a href=&quot;http://www.google.com&quot; rel=&quot;nofollow&quot;&gt;http://www.google.com&lt;/a&gt;) your browser is really requesting (&lt;a href=&quot;http://www.google.com:80&quot; rel=&quot;nofollow&quot;&gt;http://www.google.com:80&lt;/a&gt;) - the port number is just implied. Likewise, when you view &lt;a href=&quot;https://www.google.com&quot; rel=&quot;nofollow&quot;&gt;https://www.google.com&lt;/a&gt; your browser is really making a request to &lt;a href=&quot;https://www.google.com:443&quot; rel=&quot;nofollow&quot;&gt;https://www.google.com:443&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="16147" LastEditorUserId="16147" LastEditDate="2015-06-29T13:43:47.943" LastActivityDate="2015-06-29T13:43:47.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19510" PostTypeId="2" ParentId="17531" CreationDate="2015-06-26T14:15:18.993" Score="1" Body="&lt;p&gt;If you have the ip address and it's on a LAN, look at the ARP Table of the gateway router to find the MAC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then with the mac address, find the source port of the mac, follow along and you will reach the switch it connects to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find the port on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follow the cable.&lt;/p&gt;&#xA;" OwnerUserId="16205" LastActivityDate="2015-06-26T14:15:18.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19511" PostTypeId="1" AcceptedAnswerId="19512" CreationDate="2015-06-26T16:00:36.437" Score="5" ViewCount="1020" Body="&lt;p&gt;I am working with both older Foundry switches, and Catalyst 3560s, and trying to document the spanning tree topology. The Foundry switches show me the root port and root bridge as you would expect, but the ports that are blocked also show the designated bridge, or in other words, the switch that would take over if the root port failed. The Cisco switches show me the root port and root bridge, and also the alternate/blocked ports, but they don't show what the designated bridge is for those ports. I am trying to figure out how to get this information out of Cisco IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the Foundry switch for an example, I am presented with the root port, the designated root (the root switch of the STP domain), and the designated bridge (which is the current STP root for the root port). The alternate blocked port shows the designated root (the root switch of the STP domain), and the designated bridge (which is the &quot;secondary&quot; root or the switch that would take over as the root).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the last piece of the puzzle, the designated bridge or rather the switch that would take over and make the alternate port become the root port if there was a failure upstream that I can't seem to figure out from Cisco IOS. I have been through several spanning tree show and debug commands, but I haven't been able to find the answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how spanning tree works, and I do know the manual process of calculating the different switches and ports, but the issue is that the topology I am working on has many switches, many VLANs, and several different STP root switches. There doesn't seem to be a completely consistent pattern of configuration. I have been assigned the task of documenting the physical and logical topology so we can get things straightened out. There is a pair of Cat6500s acting as the core, with one of the 6500s acting as the STP root for the majority of the VLANs, but not all. The second 6500 is the root for a few VLANs, and then the remaining VLANs have roots on other switches dispersed throughout the network. The reason I can't simply look at each VLAN and simply determine the root and secondary is because nearly all of the Foundry switches are configured to operate only in VLAN1, despite their upstream switches being configured for particular VLANs. In other words, they participate in STP, but not in the VLAN structure.&lt;/p&gt;&#xA;" OwnerUserId="572" LastActivityDate="2015-06-26T17:33:27.913" Title="How can I determine the STP designated bridge on Cisco IOS?" Tags="|spanning-tree|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19512" PostTypeId="2" ParentId="19511" CreationDate="2015-06-26T17:33:27.913" Score="7" Body="&lt;p&gt;Found the answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show spanning-tree interface INT detail&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This command goes deeper than the regular &quot;show spanning-tree&quot; and displays the designated bridge as well as root bridge.&lt;/p&gt;&#xA;" OwnerUserId="572" LastActivityDate="2015-06-26T17:33:27.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19513" PostTypeId="2" ParentId="19504" CreationDate="2015-06-26T18:38:00.280" Score="2" Body="&lt;p&gt;If your router is running Proxy ARP (and I think Cisco does by default), it will answer ARP requests, even for IPs that don't properly belong to the router, and then forward the IP packet based on its routing table. It's probably answering PC2's ARP query, and once PC2 sends the ICMP packet to Router0 (thinking that Router0 has the MAC address for 10.0.9.7), then Router0 forwards the packet appropriately.&lt;/p&gt;&#xA;" OwnerUserId="16207" LastActivityDate="2015-06-26T18:38:00.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19514" PostTypeId="2" ParentId="19484" CreationDate="2015-06-26T18:49:48.227" Score="1" Body="&lt;p&gt;G0/3 appears to be shut down. I suspect that SVI VLAN 110 is up because it exists on another port (G0/11) that is not shut down, and thus spanning-tree for VLAN 110 is up, while it is down for VLAN 98. You can confirm that by issuing the commands 'show spanning-tree vlan 110' and 'show spanning-tree vlan 98'. You'll probably get something like &quot;Spanning tree instance(s) for vlan 98 does not exist.&quot;&lt;/p&gt;&#xA;" OwnerUserId="16207" LastActivityDate="2015-06-26T18:49:48.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19515" PostTypeId="2" ParentId="19501" CreationDate="2015-06-26T18:59:13.377" Score="2" Body="&lt;p&gt;What does the switch port configuration look like? Access, trunk, something else? Have you asked your ISP what their port configuration (not on the Radwin, but on their router/switchport facing you) looks like? Is spanning-tree forwarding facing the Radwin link in both directions? It kind of sounds like a VLAN mismatch or something along those lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it work if you plug that laptop into the switch? That would likely rule out the router config.&lt;/p&gt;&#xA;" OwnerUserId="16207" LastActivityDate="2015-06-26T18:59:13.377" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="19516" PostTypeId="2" ParentId="19507" CreationDate="2015-06-26T19:26:35.197" Score="3" Body="&lt;p&gt;&lt;strong&gt;Need to&lt;/strong&gt;? Not in a day-to-day sense, but you're going to have some serious unhappy customers if your widget fails to deal with it properly. There are plenty of examples of &quot;&lt;em&gt;shouldn't happen&lt;/em&gt;&quot; events programmers ignore that &lt;em&gt;do&lt;/em&gt; happen and breaks all kinds of things. (you if you're Tivo, the system crashes/panics/etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I know, one cannot program for every possibility, but this isn't one of those times. Counter overflows / resets WILL happen; be prepared for it.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-26T19:26:35.197" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19519" PostTypeId="2" ParentId="17531" CreationDate="2015-06-26T21:52:24.573" Score="0" Body="&lt;p&gt;You can do that by finding port of switch from which it's learning that mac address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sh mac address-table d | in MAC-ADDRESS (in xxx.xxx.xxx format)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On JunOS switch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show ether-switcthing-table mac XX:XX:XX:XX:XX:XX&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and this will give you physical port. You can trace cable from it to the system then. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this will help. &lt;/p&gt;&#xA;" OwnerUserId="16211" LastActivityDate="2015-06-26T21:52:24.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19521" PostTypeId="2" ParentId="19500" CreationDate="2015-06-27T01:43:05.220" Score="4" Body="&lt;p&gt;Actually, you must take into account that the TCP/IP protocol was not built to run over ethernet exclusively. There are various link-layers that might be used with TCP/IP. Some might provide a local link-only flow control (like between two serial ports using XON/XOFF) or something like that. Thats why the TCP protocol ended up providing a flow control mechanism that works at a much higher level and is generic enough to traverse multiple different types of networking links.&lt;/p&gt;&#xA;" OwnerUserId="14596" LastActivityDate="2015-06-27T01:43:05.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19522" PostTypeId="2" ParentId="19496" CreationDate="2015-06-27T01:49:57.350" Score="2" Body="&lt;p&gt;We can say that a network with 50% packet loss is not stable at all, at least not stable enough to support healthy internet use. If your link is wireless, this is still too high a loss to be acceptable. If you use only ethernet cables then you are far above what is normal for a cabled ethernet to be acceptable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a short answer : Your network is not stable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I infer from what you pasted ? You are using a WiFi network under far from ideal conditions. If youre using cables, you have a malfunctioning switch around (maybe faulty - dried up capacitors in its supply filtering part ?) or your connectors are too rusty. This might be caused by network cards with faulty transformers (the other symptom in this case is that the card connection icon keeps appearing and disappearing on windows - &quot;network cable unplugged&quot; message or something like that). You might have network cable run too long for the ethernet standard, but in that case this is your fault.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, you asked about a tool to check this out. Do you know about traceroute/tracert command ?&lt;/p&gt;&#xA;" OwnerUserId="14596" LastEditorUserId="14596" LastEditDate="2015-06-27T02:01:28.247" LastActivityDate="2015-06-27T02:01:28.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19523" PostTypeId="2" ParentId="19500" CreationDate="2015-06-27T03:02:21.590" Score="2" Body="&lt;p&gt;Flow control at the data link layer extends only as far as the layer2 link.  There are typically several layer 2 hops between IP endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flow control at the transport layer (TCP) extends end-to-end and accommodates communication between NICs/endpoints with different throughput/speed.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-27T03:02:21.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19524" PostTypeId="2" ParentId="19507" CreationDate="2015-06-27T03:26:30.583" Score="-4" Body="&lt;p&gt;An SNMP object defined as a Counter must abide by &lt;a href=&quot;https://www.ietf.org/rfc/rfc1155.txt&quot; rel=&quot;nofollow&quot;&gt;RFC1155&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;3.2.3.3. Counter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This application-wide type represents a non-negative integer which monotonically increases until it reaches a maximum value, when it wraps around and starts increasing again from zero. This memo specifies a maximum value of 2^32-1 (4294967295 decimal) for counters.&quot;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-27T03:26:30.583" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19525" PostTypeId="2" ParentId="19503" CreationDate="2015-06-27T03:41:29.563" Score="0" Body="&lt;p&gt;Have a look at your &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/asdm64/configuration_guide/asdm_64_config/wizard_vpn.html#wp1052935&quot; rel=&quot;nofollow&quot;&gt;IPSec settings (optional)&lt;/a&gt;.  You probably need to tweak the 'interface' and/or 'exempt networks' - which network(s) are subject to NAT and which are not.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-27T03:41:29.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19526" PostTypeId="1" CreationDate="2015-06-27T09:39:21.123" Score="6" ViewCount="2849" Body="&lt;p&gt;Is it possible to perform the following configurations on Cisco routers, and are there any challenges with these types of configurations (mainly #3)?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Match an OSPF route tag of 12000 (Definitely Possible)&lt;/li&gt;&#xA;&lt;li&gt;Redistribute OSPF into BGP (Definitely Possible)&lt;/li&gt;&#xA;&lt;li&gt;Set BGP AS Prepend towards a next-hop router (Challenge)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/4Wj3t.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DMVPN hub will be learning specific and summary routes from the DMVPN spoke via EIGRP 100 (DMVPN Tunnel 100). The DMVPN hub will redistribute these routes into OSPF, and tag them with a value of 12000. To prevent routing loops, or any abnormal routing behavior, I'm trying to prevent any routes with a tag of 12000 from being redistributed into the MPLS.&lt;/p&gt;&#xA;" OwnerUserId="16215" LastEditorUserId="8499" LastEditDate="2016-03-27T20:10:37.893" LastActivityDate="2016-03-27T20:10:37.893" Title="OSPF Route Tagging and BGP AS Prepend" Tags="|cisco|routing|bgp|ospf|redistribution|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19529" PostTypeId="1" AcceptedAnswerId="19740" CreationDate="2015-06-27T20:56:52.720" Score="1" ViewCount="656" Body="&lt;p&gt;I'm studying the OSI architecture model and I have doubts about the role of the SAP (Service Access Point). From what I'm getting it's an interface between the (N+1)-PDU and the (N)-SDU but does it also offer some sort of &quot;virtual&quot; connection between the same layers of two systems?&#xA;Can you clarify this aspect?&lt;/p&gt;&#xA;" OwnerUserId="16228" LastActivityDate="2015-07-07T01:43:05.620" Title="OSI model, clarification about the role of SAP" Tags="|osi|architecture|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19530" PostTypeId="2" ParentId="16483" CreationDate="2015-06-27T21:40:40.737" Score="2" Body="&lt;p&gt;If the provider agrees then you would need an ASN besides their written permission and BGP setup in your local / destination site. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setup a router and announce that address space to upstream with your ASN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this will help. &lt;/p&gt;&#xA;" OwnerUserId="16211" LastActivityDate="2015-06-27T21:40:40.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19531" PostTypeId="2" ParentId="13053" CreationDate="2015-06-28T07:48:16.167" Score="0" Body="&lt;p&gt;I have used EX4200 with IPv6 static routing. Works fine with default license. You can put /64 per VLAN and allocate each VLAN for each server. That will just do the required trick. And yes you do not need to exchange subnet info since servers will have default pointed towards switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say you have got: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;xxxx:xxxx:xxYY::/42&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can slice a /48 and eventually /64 from it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;xxxx:xxxx:xxYY::/42 &gt; (take /48 slice off) &gt; xxxx:xxxx:xxa1::/48&lt;/p&gt;&#xA;&#xA;&lt;p&gt;xxxx:xxxx:xxa1::/48 &gt; (take /64 slice off) &gt; xxxx:xxxx:xxa1:a::/64&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for your servers you can use:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;xxxx:xxxx:xxa1:a::/64&#xA;xxxx:xxxx:xxa1:b::/64&#xA;xxxx:xxxx:xxa1:c::/64&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now for this you can put say xxxx:xxxx:xxa1:a::1 / 64 on say VLAN 100. So xxxx:xxxx:xxa1:a::1 will become GW and you can point server's default ::/0 towards it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this will help. &lt;/p&gt;&#xA;" OwnerUserId="16211" LastActivityDate="2015-06-28T07:48:16.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19532" PostTypeId="1" CreationDate="2015-06-28T08:30:09.213" Score="0" ViewCount="310" Body="&lt;p&gt;If we have mobile network with working 3GDT then a big part of the 3G data traffic goes through the direct tunnel. This is for offloading the SGSN. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        Iu&#xA;RNC-------------SGSN&#xA; |                |&#xA; |                | Gn&#xA; |                |&#xA; +--------------GGSN--------Internet&#xA;    3gdt               Gi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was wondering if only the user plane traffic is going through the direct tunnel or a part of the control plane is going through it, too.&#xA;More specifically I want to know if all the &lt;strong&gt;PDP Context activations&lt;/strong&gt; are counted in the SGSN.&lt;/p&gt;&#xA;" OwnerUserId="5576" LastActivityDate="2015-08-18T18:07:19.067" Title="Is only user plane traffic going through 3GDT in UMTS/HSPA network" Tags="|mobile|network-core|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19534" PostTypeId="1" CreationDate="2015-06-28T21:15:33.637" Score="0" ViewCount="1213" Body="&lt;p&gt;I have been learning about the WLAN technology and I couldn't understand the logic behind the choice of the Clear Channel Assessment thresholds protocol used in CSMA/CA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 802.11ac for WLAN, a device attempting to transmit over a 20 MHz subchannel should make sure the channel is idle. &#xA;The threshold at which this device decides whether it should transmit or not is -82 dbm. If a device wants to transmit over primary 40 MHz channel the threshold at which it decides if it can or it can't transmit is -79 dbm (+3db wrt to -82 dbm because we doubled the bandwidth).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Why is that a 3db difference in threshold exists, there must be logical explanation for such?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am just looking for some logical interpretation of why these concepts are made?&#xA;Thank you&lt;/p&gt;&#xA;" OwnerUserId="15457" LastEditorUserId="15457" LastEditDate="2015-07-01T22:10:25.103" LastActivityDate="2017-08-04T22:18:43.773" Title="Clear Channel Assessment and sensitivity thresholds in WLAN 802.11ac" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19535" PostTypeId="2" ParentId="18752" CreationDate="2015-06-29T00:37:35.697" Score="0" Body="&lt;p&gt;Configure a &lt;a href=&quot;https://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/sag_tcpip_pro_addstaticroute.mspx?mfr=true&quot; rel=&quot;nofollow&quot;&gt;host route on your PC&lt;/a&gt; telling it that the PC's default gateway is R3.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-29T00:37:35.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19536" PostTypeId="1" AcceptedAnswerId="19541" CreationDate="2015-06-29T03:44:17.017" Score="2" ViewCount="298" Body="&lt;p&gt;Why can't distance vector and link state routing be used as internetwork routing algorithm? That is apart from the high convergence time of Distance vector routing is there any other reason we cannot use it as an exterior routing algorithm?&lt;/p&gt;&#xA;" OwnerUserId="16198" LastActivityDate="2015-06-29T11:24:22.500" Title="Intra and internetwork routing" Tags="|routing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19537" PostTypeId="2" ParentId="19498" CreationDate="2015-06-29T04:19:32.697" Score="2" Body="&lt;p&gt;Your NAT Exemptions on the Spokes are messed up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you have the Spoke 2 address as the source on Spoke 1, and you're missing Spoke 2 altogether:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended NONAT&#xA;deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255&#xA;permit ip 192.168.210.64 0.0.0.31 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You need to have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended NONAT&#xA;deny   ip 192.168.210.224 0.0.0.31 172.16.0.0 0.0.255.255&#xA;deny   ip 192.168.210.224 0.0.0.31 192.168.210.64 0.0.0.31&#xA;permit ip 192.168.210.224 0.0.0.31 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;And then on Spoke 2 you have the right source, but are just missing an entry for Spoke 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended NONAT&#xA;deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255&#xA;permit ip 192.168.210.64 0.0.0.31 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This needs to have the Spoke 1 segment added as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended NONAT&#xA;deny   ip 192.168.210.64 0.0.0.31 172.16.0.0 0.0.255.255&#xA;deny   ip 192.168.210.64 0.0.0.31 192.168.210.224 0.0.0.31&#xA;permit ip 192.168.210.64 0.0.0.31 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastActivityDate="2015-06-29T04:19:32.697" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19538" PostTypeId="2" ParentId="19536" CreationDate="2015-06-29T08:20:03.243" Score="4" Body="&lt;p&gt;There's saying, documented in RFC 1925:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(3) With sufficient thrust, pigs fly just fine.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With sufficient CPU power, you can run link state in Internet, and you'd do probably fine. But that's neither elegant nor scaleable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP was invented to provide scale - by limiting number of unnecessary things internetworking protocol would need to deal with and focusing on things, that on the internetwork scale are important (like AS_PATH, which shows on a Internet scale how AS interconnect).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link-state protocols for example, are focused on links, not prefixes or AS_PATHs. Why would you like to keep link state information across all links in the Internet? Can you do it? Yeah, probably. Will it run on processors that were available 20 years ago? No. Would it be really wise to do it today from engineering perspective? Again, probably not - at least not on every node.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the era of SDN controllers, more and more horse power will be available to provide large-scale calculations across or even for entire Internet. That doesn't however mean this should be executed on a per-node basis.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2015-06-29T08:20:03.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19539" PostTypeId="1" AcceptedAnswerId="19542" CreationDate="2015-06-29T08:38:22.870" Score="2" ViewCount="2148" Body="&lt;p&gt;We have two HP 2920-48G. Our vendor told us, that we should create a virtual switch that extends over both physical switches. That way I don't have to manage two physical switches, but only one virtual switch &lt;strong&gt;and&lt;/strong&gt; I could create a LACP with 8 ports, having 4 ports on each switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I could find in the manual was how to stack both switches using stacking modules. Out vendor told us, that stacking modules are not required to create a virtual switch with both 2920's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't find the 'virtual switch' thing he was talking about. Is his statement even right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there is a similar question &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6950/hp-2920-can-stack-without-stacking-module&quot;&gt;HP 2920 - Can stack without stacking module?&lt;/a&gt;, but my vendor explicitly stated that stacking would be something different. The other thing about that question is that one persons answers it with &quot;yes&quot; and another person with &quot;no&quot;.&lt;/p&gt;&#xA;" OwnerUserId="16240" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-06-29T11:38:08.693" Title="Creating one virtual switch that extends over two HP 2920-48G?" Tags="|hp|hp-procurve|stacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19541" PostTypeId="2" ParentId="19536" CreationDate="2015-06-29T11:24:22.500" Score="6" Body="&lt;p&gt;Someone once wrote this as an answer to a &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17845/when-is-bgp-needed/18730#18730&quot;&gt;similar question&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Other protocols like EIGRP or OSPF assume the best way to get&#xA;  somewhere is the fastest link -- i.e. the link with the highest&#xA;  bandwidth. As such, they have a simple metric for selecting routes.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In many situations, especially between different organizations&#xA;  (autonomous systems), the reason for choosing a particular path may&#xA;  have nothing to do with bandwidth. It may be due to a pre-arranged&#xA;  agreement on who will carry what traffic, or based on some financial&#xA;  agreement. You may want to route some traffic to one neighbor, but&#xA;  different traffic to another.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The main advantage of BGP is that it gives you much more control over&#xA;  what routes you advertise and what advertisements you accept from your&#xA;  neighbors. BGP gives you more control over route selection and your&#xA;  neighbor's route selection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-06-29T11:24:22.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19542" PostTypeId="2" ParentId="19539" CreationDate="2015-06-29T11:38:08.693" Score="2" Body="&lt;p&gt;Actually your definition of stacking is correct, and your vendor's not. However he might be referring to traditional HP Stacking, which indeed isn't &quot;true&quot; stacking at all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bigger HP switches are stacked with iRF, which 2920 doesn't do. You do need the stacking kits to create a single virtual switch out of 2 physical ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://h20195.www2.hp.com/v2/getpdf.aspx/4AA5-7121ENW.pdf?ver=1.0&quot; rel=&quot;nofollow&quot;&gt;HP Whitepaper on 2920 stacking&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2015-06-29T11:38:08.693" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19544" PostTypeId="1" CreationDate="2015-06-29T13:28:23.460" Score="1" ViewCount="235" Body="&lt;p&gt;WiFi has 20 MHz channel. So, channel 1 has frequencies 2400-2420MHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for simplicity sake, let's just say we have an 8Hz channel. So, we have frequencies 1-8Hz or in other words we have 8 different frequencies in that channel for data transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1Hz has one cycle, 2Hz has two cycles, 3Hz has three cycles and so on. With each frequency has its own cycle, how they are combined together as a channel for data transmission?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-06-30T17:00:02.900" Title="How data is transmitted through a wireless channel (combination of different frequencies)?" Tags="|wireless|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19545" PostTypeId="1" AcceptedAnswerId="19761" CreationDate="2015-06-29T14:35:09.200" Score="1" ViewCount="202" Body="&lt;p&gt;In TCP/IP protocol the IP layer gives the minimum functionlity .It does not provide any flow control or doesn't have provision for acknowledgement. Why is this done ?why is the functionality of IP kept at a bare minimum?&lt;/p&gt;&#xA;" OwnerUserId="16198" LastEditorUserId="8499" LastEditDate="2018-12-22T02:40:22.330" LastActivityDate="2018-12-22T02:40:22.330" Title="IP protocol functionality" Tags="|ip|tcp|protocol-theory|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19546" PostTypeId="2" ParentId="19545" CreationDate="2015-06-29T14:55:42.887" Score="1" Body="&lt;p&gt;The IP protocol defines the network addressing.  The TCP protocol is one of many protocols that can ride on top of the IP protocol.  TCP and UDP are the two most talked about layer-4 protocols that ride on the layer-3 IP protocol, but there are others.  This provides flexibility in networking that would otherwise be unavailable.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-06-29T14:55:42.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19548" PostTypeId="2" ParentId="19545" CreationDate="2015-06-29T16:02:04.647" Score="2" Body="&lt;p&gt;IP just gives you the address to get a packet to it's destination. The next layer handles the specifics on what should happen when it gets there. Also, Not every packet needs to be acknowledged..&lt;/p&gt;&#xA;" OwnerUserId="6000" LastActivityDate="2015-06-29T16:02:04.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19550" PostTypeId="2" ParentId="19545" CreationDate="2015-06-29T16:32:10.800" Score="0" Body="&lt;p&gt;TCP/IP is synonymous with &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_protocol_suite&quot; rel=&quot;nofollow&quot;&gt;Internet protocol suite&lt;/a&gt;.  Notice the 4 conceptual layers of the protocol suite and that IP is at the Internet layer while TCP, which does have flow control and acknowledgements, is at the transport layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clear separation of functionality between layers is key to the architecture.  The network layer is said to be encapsulated by the transport layer.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-29T16:32:10.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19551" PostTypeId="2" ParentId="19485" CreationDate="2015-06-29T16:54:37.493" Score="0" Body="&lt;p&gt;I used &lt;code&gt;mac address-table static&lt;/code&gt; in order to drop the packets with the &lt;code&gt;8877.6655.4433&lt;/code&gt; MAC address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently working with static address table entries is more robust way of doing such things. &lt;/p&gt;&#xA;" OwnerUserId="16182" LastActivityDate="2015-06-29T16:54:37.493" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19554" PostTypeId="2" ParentId="19496" CreationDate="2015-06-29T21:09:06.113" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What can we say about the stability of the network with this information?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since you are using a resource outside the network you control as your ICMP echo destination, the best you can say is that you &lt;em&gt;may&lt;/em&gt; have an unstable connection. You would need to do additional testing, and possibly with tools other than ping, to make a real determination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ICMP ping is only a reliable tool for determining unstable connections within a network that you control and know how it handles ICMP. When you get outside your network, the only way it can be used reliably is to show that a connection is stable (i.e. good results would indicate a stable connection).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While output like the above may indicate an unstable connection, it may also be the result of normal operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason that ICMP is not reliable to identify an unstable connection when used like above is that often ICMP echo/reply messages are given lower priority or rate limited, creating additional latency or dropped messages. Historically, ICMP has been used in a number of different attacks which has caused many providers to implement such measures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This typically happens most frequently at the destination of your pings, but can also happen anywhere along the path to the destination depending on how the devices are configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These limits or rules could be based on a total aggregate amount of all ICMP passing through that device (from any source) or it could be based on the traffic from a single host (or both). They can also use a number of other factors, such as the total amount of ICMP traffic your host has sent in some previous time period, the number of different destinations your host has sent ICMP traffic, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example, the volume of ICMP traffic appears to be fairly low and would ideally not experience such problems when the ICMP traffic is not considered in aggregate with other traffic.  However there are a number of ways that the same host may appear to be sending more ICMP traffic than the single ping output provided, which may cause it to exceed limits:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The host you are running the ping from is also running additional pings from other windows or processes either with or without your knowledge.&lt;/li&gt;&#xA;&lt;li&gt;If your host is behind a network device that is performing NAT, other hosts on the network could also be sending ICMP traffic. In this case, all the traffic would appear to be coming from a single host.&lt;/li&gt;&#xA;&lt;li&gt;Your ISP could be implementing some form of carrier grade NAT (CGN), meaning that many of their customers can be located behind a single IP.  All ICMP traffic from that IP would be viewed as one host by other devices on the internet.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In any case, I do know that Google does limit the amount of ICMP traffic arriving on their servers and this can causes false positives with people who monitor their Internet links by using ICMP to Google servers (I have seen this in at least three different locations in my personal experience).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there some mechanism by which routers in the path, nearer to the destination, can inform the source about packet loss, resulting in timeout?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not really.  You can get a response from a router along the way, but those responses will result in other messages than &quot;Request timed out.&quot; For example, you may get a &quot;Destination unreachable&quot; message as a response.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-06-29T21:09:06.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19556" PostTypeId="1" AcceptedAnswerId="19564" CreationDate="2015-06-29T22:45:14.927" Score="2" ViewCount="922" Body="&lt;p&gt;I'm new in the IPv6 Topic and Yesterday I was performing some testing on Cisco IOS and Cisco Routers of the addressing type in IPv6 with RIPng, i was testing the following:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Global Unicast Address&lt;/li&gt;&#xA;&lt;li&gt;Link-Local Address&lt;/li&gt;&#xA;&lt;li&gt;Anycast Address&lt;/li&gt;&#xA;&lt;li&gt;Unique Local Address (which I have a confusion also, but I will post it in other time occasion and question)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Here is a picture of my network topology&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/jHlxl.jpg&quot; alt=&quot;IPv6 Testing Topology&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;The testing occurs in Cisco Packet Tracer 6.2 version.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Objective: What I want to achieve is to use the Anycast Address to 2 DNS server on the Network, 1 on under R1 LAN and 2 under R2 LAN and the rest of the LAN use the Global Unicast for their respective networks and allow end devices  to keep sending request to the DNS's if any of them fails.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;For some reason that I still don't understand is that the Router pick up the Anycast address for the Internal LAN, instead of the Global Unicast Address when I do Stateless Auto configuration on the host or end devices.&lt;/p&gt;&#xA;&lt;p&gt;During my research I watch the following YouTube video &lt;a href=&quot;https://youtu.be/5nC2G58qo_s&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPv6-07 Cisco IPv6 Anycast&lt;/a&gt; which is why it inspired me to do my testing on my own.&lt;/p&gt;&#xA;&lt;p&gt;I know that by doing VLAN’s in a L3 Switch it does what I want, but let’s skip that and pretend that I have a plain LAN.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When I do &lt;em&gt;Show IPv6 Interface g0/0&lt;/em&gt; on R1&lt;/p&gt;&#xA;&lt;p&gt;This is the output that I receive&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; R1#show int g0/0&#xA;GigabitEthernet0/0 is up, line protocol is up (connected)&#xA;  Hardware is CN Gigabit Ethernet, address is 00d0.ff96.cd01 (bia 00d0.ff96.cd01)&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 100Mb/s, media type is RJ45&#xA;  output flow-control is unsupported, input flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00, &#xA;  Last input 00:00:08, output 00:00:05, output hang never&#xA;  Last clearing of &amp;quot;show interface&amp;quot; counters never&#xA;  Input queue: 0/75/0 (size/max/drops); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue :0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 149 bits/sec, 0 packets/sec&#xA;     3 packets input, 224 bytes, 0 no buffer&#xA;     Received 0 broadcasts, 0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;     0 watchdog, 1017 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     73 packets output, 39144 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 1 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;This is the show ipv6 interface brief and show running-config&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;GigabitEthernet0/0         [up/up]&#xA;    FE80::1&#xA;    2001:DB8:22::1&#xA;    2345::&#xA;GigabitEthernet0/1         [administratively down/down]&#xA;GigabitEthernet0/2         [administratively down/down]&#xA;Serial0/0/0                [up/up]&#xA;    FE80::1&#xA;    2001:DB8:1::1&#xA;Serial0/0/1                [administratively down/down]&#xA;Serial0/1/0                [administratively down/down]&#xA;Serial0/1/1                [administratively down/down]&#xA;Vlan1                      [administratively down/down]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;Show run&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;R1#show run &#xA;Building configuration...&#xA;&#xA;Current configuration : 1287 bytes&#xA;!&#xA;version 15.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip cef&#xA;ipv6 unicast-routing&#xA;!&#xA;no ipv6 cef&#xA;!&#xA;ipv6 dhcp pool R1&#xA; dns-server 2345::9&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO2911/K9 sn FTX1524RD6F&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; ipv6 address FE80::1 link-local&#xA; ipv6 address 2001:DB8:22::/64 eui-64&#xA; ipv6 address 2345::/64 anycast&#xA; ipv6 nd other-config-flag&#xA; ipv6 rip RIP1 enable &#xA; ipv6 dhcp server R1&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/2&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/0/0&#xA; no ip address&#xA; ipv6 address FE80::1 link-local&#xA; ipv6 address 2001:DB8:1::1/64&#xA; ipv6 rip RIP1 enable &#xA; clock rate 128000&#xA;!&#xA;interface Serial0/0/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Serial0/1/0&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Serial0/1/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ipv6 router rip RIP1&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;P.S:I need Clarification with Link-Local Address, Why i can put the link local on the same device in all it interface many times?&#xA;It confuse me since R2 have and other link-local address that i can also put on all it interfaces&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="15303" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-02-15T05:23:09.907" Title="IPv6 Testing Addressing Type Confusions" Tags="|ipv6|anycast|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19557" PostTypeId="1" AcceptedAnswerId="19558" CreationDate="2015-06-29T23:07:34.130" Score="29" ViewCount="102698" Body="&lt;p&gt;Our new router is asking if we want IGMP snooping enabled. Not being familiar with this, I looked to the internet and got the following &lt;a href=&quot;https://en.wikipedia.org/wiki/IGMP_snooping&quot; rel=&quot;noreferrer&quot;&gt;wiki description&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IGMP snooping is the process of listening to Internet Group Management Protocol (IGMP) network traffic. The feature allows a network switch to listen in on the IGMP conversation between hosts and routers. By listening to these conversations the switch maintains a map of which links need which IP multicast streams. Multicasts may be filtered from the links which do not need them and thus controls which ports receive specific multicast traffic.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But what are the benefits? And what considerations (security, performance, etc) need to be taken into account before enabling it? My view is - if it's safe, then why isn't just on by default?&lt;/p&gt;&#xA;" OwnerUserId="16252" LastEditorUserId="8499" LastEditDate="2018-03-19T15:42:23.057" LastActivityDate="2023-10-29T02:31:53.760" Title="What are the benefits and cons of IGMP snooping?" Tags="|router|security|multicast|igmp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19558" PostTypeId="2" ParentId="19557" CreationDate="2015-06-30T00:48:51.370" Score="21" Body="&lt;p&gt;IGMP Snooping is a feature for &lt;em&gt;switches&lt;/em&gt; to learn what multicast groups are needed on which ports. &lt;em&gt;Routers&lt;/em&gt; not handling &lt;em&gt;multicast routing&lt;/em&gt; don't care.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, without an &lt;em&gt;mrouter&lt;/em&gt; in the network, you need to configure one (or more) &lt;em&gt;igmp querier&lt;/em&gt;s. This ensures group membership reports are flood through the network periodically to keep the forwarding information up-to-date; otherwise it expires and traffic is either dropped, or floods everywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The benefit is that multicast traffic goes only where it belongs. If nothing on that port has joined that group, the switch will prune it. In a cascaded environment, that can significantly reduce inter-switch traffic. And likewise keep access links clear of traffic hosts don't want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't know it's enabled, situations may arise wherein traffic may appear to be &quot;missing&quot; on the wire, because it's being pruned. (&lt;em&gt;fast-leave&lt;/em&gt;, no querier, no joins, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, it's rarely enabled by default.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-06-30T00:59:15.737" LastActivityDate="2015-06-30T00:59:15.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19560" PostTypeId="2" ParentId="9356" CreationDate="2015-06-30T03:08:28.240" Score="2" Body="&lt;p&gt;The real answer is simple. Ethernet is a differential line technology. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two ways to transmit information on a transmission line : Balanced(Analog)/Differential(Digital) or Unbalanced(Analog)/Single ended(Digital) line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A differential transmission line is one where the signal is transmitted at two opossite polarities thru two lines. To represent a bit 1 you might send, lets say, +12V in a conductor and -12V on the other (Fast/Giga Ethernet is more complicated than that). Why this is done so ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because on a single-ended line, interference induced on the cable cannot be distinguised from a legitimate signal. If you put +12V on a single a conductor and receive, due to attenuation, +2V on the other side, this +2V might not be enough to prevent interference from destroying your signal, and if this does happen you cannot recover (you can, by higher abstraction means, but lets ignore this for a while) your information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you send the information on two conductors, by transmitting the oposite signals on each one, a interference that causes a, lets say, +5V spike on the line will interfere with BOTH conductors at the same time on the same way. If you send +12V on a conductor and -12V on the other, you might get on the other side +17V and -7V on the other. The voltages are wrong, but if you compare +17V to -7V (=24V) you get the same value as if you compare +12V to -12V (=24V difference). Think of this difference not as a normal subtraction but as a comparision of the linear distance of both points on a line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, a differential signal line will have higher immunity from noise. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what does this means ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the ethernet connector of the network adapter, differential signals are paired on a very specific way. If you are dealing with Fast Ethernet, they are present on the pins 0-1 and 3-6. If you simply put the cables color paired side by side, you will produce not a differential line but two sepparate single-ended transmission lines (Part of the signal will go via Pair 2, part via Pair 3). Pin 3 will go thru a pair and Pin 5 will go thru another pair. They wont match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will cause all sort of effects. First they are not twisted togheter, they have a higher probability of receiving different kinds of interference values. They are not paired, so they will provide a totally different charactheristic impedance than what is expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a historical reference, we starter using twisted pair cables to reuse twisted pair cables used for telecom. Twisted pair provided a cheaper way to install ethernet on older buildings that had already telephony equipment. Under such circunstance, you might use the two left-over pairs to transmit two telephone lines. They can - if done correctly - provide one more Fast-Ethernet connection (Yes, you can use a single cable to transmit two ethernet runs). Under a gigabit standard (not all of them, there are various standards for gigabit) all pairs are used so you have no such possibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DL&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The standard is set that way because ethernet is a differential transmission line technology and you must match the output/input differential pins on the adapter to the pairs on the cable. Thats why orange/light orange conductors jump over (usually) blue/light blue (or something like that) pair at the center.&lt;/p&gt;&#xA;" OwnerUserId="14596" LastEditorUserId="14596" LastEditDate="2015-06-30T03:31:19.740" LastActivityDate="2015-06-30T03:31:19.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19561" PostTypeId="1" AcceptedAnswerId="19562" CreationDate="2015-06-30T05:04:54.560" Score="3" ViewCount="9283" Body="&lt;p&gt;I didn't find any information about this on the Internet, because every website was just stating that it is in there, but never why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thought I had is that the router can identify in which network segment the sender is, so it can redirect the packet faster, but I don't know if that's true...&lt;/p&gt;&#xA;" OwnerUserId="16256" LastEditorUserId="3232" LastEditDate="2015-06-30T20:39:29.010" LastActivityDate="2015-06-30T20:39:29.010" Title="Why is there the source IP address in an IPv4 header?" Tags="|ipv4|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19562" PostTypeId="2" ParentId="19561" CreationDate="2015-06-30T05:09:25.623" Score="17" Body="&lt;p&gt;So the destination node knows which address to specify in the destination field when responding to the sender.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-30T05:09:25.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19563" PostTypeId="2" ParentId="19561" CreationDate="2015-06-30T05:15:19.510" Score="11" Body="&lt;p&gt;Primarily, so nodes along the path know where to send any error messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the most part, IP is a bidirectional protocol. As such, there must be a sender and receiver.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-30T05:15:19.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19564" PostTypeId="2" ParentId="19556" CreationDate="2015-06-30T05:41:06.357" Score="3" Body="&lt;p&gt;There are two different types of anycast. The most common one is where you have multiple routes for the same prefix going to different locations. The routing protocol will choose the best router and the traffic end up at the closest server. One way to do this is to let the DNS servers participate in the routing protocol (RIP in this case) and give them a separate prefix, for example &lt;code&gt;2001:db8:dddd::/64&lt;/code&gt;. Both DNS servers run their own RIP daemon to advertise that prefix. The DNS service is run on i.e. &lt;code&gt;2001:db8:dddd::1&lt;/code&gt;. If a DNS server falls the route it advertised will disappear and the routing protocol will route the traffic to the other DNS server. This works for both IPv4 and IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 has a second type of anycast: anycast addresses. They are normal address but configured in such a way that you can have one address  on the same LAN configuredon multiple devices. So you can have two DNS servers connected to one LAN with the same addres.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-06-30T05:41:06.357" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="19565" PostTypeId="2" ParentId="19561" CreationDate="2015-06-30T05:43:37.367" Score="6" Body="&lt;p&gt;Both Ricky and Ron are correct. IP packets have a source and a destination. The device at the destination uses the source address to determine where to send replies to, and if there is an error along the way the routers will use the source address of the packet to send error messages to.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-06-30T05:43:37.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19567" PostTypeId="1" AcceptedAnswerId="19571" CreationDate="2015-06-30T08:44:00.973" Score="3" ViewCount="593" Body="&lt;p&gt;What exactly do these terms mean?  I intuitively understand them to mean airflow direction can be reversed or changed.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Cisco 3900 Series routers ship with a default fan assembly that&#xA;  drives “business-to-bezel” airflow in the router chassis. An&#xA;  alternate, optional fan assembly provides a “bezel-to-business”&#xA;  airflow and includes an air filter appropriate for dusty operation&#xA;  environments or Network Equipment Building Standards (NEBS)&#xA;  installations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Source:  &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/1900-series-integrated-services-routers-isr/ordering_guide_c07_557736.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/routers/1900-series-integrated-services-routers-isr/ordering_guide_c07_557736.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-06-30T11:05:31.803" Title="What does &quot;business-to-bezel” and &quot;bezel-to-business&quot; airflow mean?" Tags="|cisco|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19568" PostTypeId="1" AcceptedAnswerId="19575" CreationDate="2015-06-30T09:07:47.880" Score="5" ViewCount="12968" Body="&lt;p&gt;Here is the &lt;code&gt;ip -6 route&lt;/code&gt; result of my working OpenWRT system.  I find that this is quite different to the route table of ipv4.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    default from :: via fe80::3e8a:b0ff:fe86:f870 dev eth0.2  proto static  metric 1024&#xA;    default from 2402:f000:5:8401::/64 via fe80::3e8a:b0ff:fe86:f870 dev eth0.2  proto static  metric 1024&#xA;    default from fc00:101:101::/64 via fe80::3e8a:b0ff:fe86:f870 dev eth0.2  proto static  metric 1024&#xA;    2402:f000:5:8401::/64 dev eth0.2  proto static  metric 256&#xA;    fc00:101:101::/64 dev br-lan  proto kernel  metric 256&#xA;    fda0:52f6:20cb::/64 dev br-lan  proto static  metric 1024&#xA;    fe80::/64 dev eth0  proto kernel  metric 256&#xA;    fe80::/64 dev eth0.2  proto kernel  metric 256&#xA;    fe80::/64 dev br-lan  proto kernel  metric 256&#xA;    fe80::/64 dev wlan1  proto kernel  metric 256&#xA;    fe80::/64 dev wlan0  proto kernel  metric 256&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First, why IPv6 has multiple default routing entries?  Second, I found that all the ipv6 routing entries do not specify the source IP of the interface (in ipv4, the route table has a column like &lt;code&gt;src xxx.xxx.xxx.xxx&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="14126" LastActivityDate="2015-07-01T05:14:34.827" Title="How to understand the IPv6 route table" Tags="|routing|ipv6|" AnswerCount="2" CommentCount="4" ClosedDate="2015-07-02T19:25:27.907" ContentLicense="CC BY-SA 3.0" />
  <row Id="19570" PostTypeId="1" AcceptedAnswerId="19576" CreationDate="2015-06-30T10:55:59.380" Score="2" ViewCount="611" Body="&lt;p&gt;This is a rather simple question but I cannot seem to find a resource that explains what this feature is for (without it simply saying &quot;this is to configure an IP interface&quot;....very helpful)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone tell me what the purpose of the interface configuration is under IP Routing? I &quot;think&quot; that it allows me to provide the switch itself with a secondary IP address for another subnet (a bit like sticking a second NIC into a server so it can connect to different IP ranges once assigned). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I completely barking up the wrong tree here?&lt;/p&gt;&#xA;" OwnerUserId="16263" LastActivityDate="2015-06-30T16:50:40.853" Title="Dell 6248P Powerconnect Switch - Routing IP Configuration - What is it for?" Tags="|routing|ip|interface|dell|powerconnect|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19571" PostTypeId="2" ParentId="19567" CreationDate="2015-06-30T11:05:31.803" Score="7" Body="&lt;p&gt;The bezel is the decorated plastic panel making your router or switch look nice in the data center. Here's an drawing from &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/access/2600/hardware/installation/notes/bezlinst.html#wp23518&quot; rel=&quot;noreferrer&quot;&gt;Cisco&lt;/a&gt;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/5tUGa.jpg&quot; alt=&quot;Cisco 2600 Bezel&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the bezel side of a device is often called the front. The back, containing all the interfaces is in this case called the &quot;business side&quot;, because it is the important side. You bought the device to connect stuff to, not for its decorative appeal...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fans blowing &quot;business to bezel&quot; will take air in at the business/back side and blow it out the front/bezel side. A correct airflow direction is important for cooling, and depends on how your datacenter is cooled and how the device is put in the rack.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-06-30T11:05:31.803" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19572" PostTypeId="1" CreationDate="2015-06-30T12:11:41.787" Score="1" ViewCount="2657" Body="&lt;p&gt;1) How many virtual routers can be created on a Juniper QFX5100?&lt;br&gt;&#xA;2) How many virtual route forwards (VRFs) can be created on a Juniper MX480?&lt;br&gt;&#xA;3) What is the difference between FPC, MPC, SPC and NPC?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Acronym Definitions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FPC: Flexible PIC Connector&lt;br&gt;&#xA;MPC: Modular Port Connector&lt;br&gt;&#xA;NPC: Network Processing Card&lt;br&gt;&#xA;SPC: Service Processing Card&lt;/p&gt;&#xA;" OwnerUserId="15690" LastEditorUserId="15866" LastEditDate="2015-06-30T19:05:41.670" LastActivityDate="2015-06-30T19:05:41.670" Title="What are the virtual router capabilities of Juniper QFX5100 and MX480?" Tags="|juniper|vrf|juniper-mx|" AnswerCount="1" CommentCount="1" ClosedDate="2015-07-02T19:24:49.210" ContentLicense="CC BY-SA 3.0" />
  <row Id="19574" PostTypeId="2" ParentId="19572" CreationDate="2015-06-30T16:18:29.720" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;1) How many virtual router [routing instances] can be created on the QFX5100? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The QFX5100 platform currently supports up to &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos15.1/topics/concept/bridging-vrf-qfx-series.html&quot; rel=&quot;nofollow&quot;&gt;512&lt;/a&gt; virtual router routing instances. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2) How many VRF [routing instances] can be created on the MX480? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are a few variables you may want to consider, (both software and hardware) namely the number of routes, routing protocol adjacency limits, and memory. There is very little documentation about the hard/soft limit, but it appears that the MX platform can support a maximum of 8,000 VPLS routing instances. Your actual mileage will likely vary. &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.1/topics/reference/general/mx-series-vpls-faq.html&quot; rel=&quot;nofollow&quot;&gt;Read more&lt;/a&gt;...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;3) What are the differences between the FPC, MPC, SPC and NPC.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;A Flexible Pic Concentrator (FPC) is a slot card for MX/M/T series platforms that you can install physical interface cards into. An FPC can also refer to an EX switch or virtual chassis member switch. There are many types of FPCs that vary from platform to platform.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A Modular Port Concentrator (&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/release-independent/junos/topics/concept/mpc-mx-series-overview.html&quot; rel=&quot;nofollow&quot;&gt;MPC&lt;/a&gt;) is a high performance/density slot insert for the MX platform and are either modular or fixed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A Service Processing Card (&lt;a href=&quot;https://www.juniper.net/techpubs/hardware/junos-srx/srx3000/srx3000-spc/services-processing-cards.html&quot; rel=&quot;nofollow&quot;&gt;SPC&lt;/a&gt;) is an expansion card that increases the amount of traffic you can push through your &lt;a href=&quot;https://www.juniper.net/techpubs/software/junos-es/junos-es92/junos-es-swconfig-security/understanding-sessions.html&quot; rel=&quot;nofollow&quot;&gt;SPU&lt;/a&gt;(s).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A Network Processing Card (&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/release-independent/junos/topics/reference/general/npc-srx3k-npc.html&quot; rel=&quot;nofollow&quot;&gt;NPC&lt;/a&gt;) directs/buffers/queues traffic between the IO card(s) and the SPC(s).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2476" LastEditorUserId="2476" LastEditDate="2015-06-30T16:27:56.717" LastActivityDate="2015-06-30T16:27:56.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19575" PostTypeId="2" ParentId="19568" CreationDate="2015-06-30T16:36:20.153" Score="4" Body="&lt;p&gt;First let's explain the address prefixes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;fe80::/10&lt;/strong&gt; - Link Local&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2000::/3&lt;/strong&gt;  -  global Unicast (2402:f000:5:8401::/64 in your example)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;fc00::/7&lt;/strong&gt;  - unique local (RFC4193) (fc00:101:101::/64 and  fda0:52f6:20cb::/64 in your example)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link-Local addresses are valid on the link olny (e.g. the VLAN your are currently connected to), global unicast is globally reachable (at least if there is no firewall / acl blocking traffic) and unique-local addresses  globally unique (at least in theory) and used for local communications and not routed on the internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An interface has always one link-local address and can have one or more global addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You see a route for each of these prefix types (first three lines) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An address from 2402:f000:5:8401::/64 is assigned to eht0.2 and fc00:101:101::/64 / fda0:52f6:20cb::/64 to your br-lan interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thr rest are the link-local entries for the different interfaces.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2015-06-30T16:36:20.153" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19576" PostTypeId="2" ParentId="19570" CreationDate="2015-06-30T16:50:40.853" Score="3" Body="&lt;p&gt;The Dell 6248P is actually a Layer 3 switch, which means it can also act as a router. If you are simply using it as a Layer 2 switch, you should be able to just ignore those settings.&lt;/p&gt;&#xA;" OwnerUserId="16207" LastActivityDate="2015-06-30T16:50:40.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19577" PostTypeId="2" ParentId="19544" CreationDate="2015-06-30T17:00:02.900" Score="2" Body="&lt;p&gt;Wifi (aka 802.11x) uses something called Direct Sequence Spread Spectrum (DSSS). More details are here: &lt;a href=&quot;https://en.wikipedia.org/wiki/Direct-sequence_spread_spectrum&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Direct-sequence_spread_spectrum&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In essence, it's not multiple 1Mhz (or, especially 1Hz) frequencies all transmitted as individual channels, but a single transmission channel that is 20MHz wide, meaning its center frequency is 2410MHz (in your example), but that channel is actually spread from 2400Mhz - 2420MHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's a pretty basic explanation, and there are certainly more complicated ways of transmitting a wireless signal, but if you're interested, that link is a pretty good starting point.&lt;/p&gt;&#xA;" OwnerUserId="16207" LastActivityDate="2015-06-30T17:00:02.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19578" PostTypeId="1" AcceptedAnswerId="19776" CreationDate="2015-06-30T17:43:47.210" Score="4" ViewCount="1007" Body="&lt;p&gt;I have been having network issues. The users report to me problems with the internet, but actually the problem is on my network. I have a sonicwall firewall and the device logs indicate posible tcp attacks like tcp flood, tcp syn and others. I have many APs and the users (Teachers and students) use their own devices, the I don't have control like a good antivirus in those pcs because I work for a college.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/08KFh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/08KFh.png&quot; alt=&quot;log&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second image with the ping output is the outcome of to do ping to my LAN interface. When the problem happens on my network I have seen that the times they are very high, sometime there is too packet loss and in this case the time is like a loop. For example, It start at 200ms and decreases, but again the time become to be high. The time must be just 2 ms because is between 2 devices in my LAN network, my pc and the LAN interface on the firewall&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been reading about attacks. Smurf attack symptoms in certain aspects match with the problems in my network. Also some persons have said me could be a broadcast storm and this generate many traffic and this cause saturation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll be grateful for your opinion&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gTf97.png&quot; alt=&quot;ping output&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16271" LastEditorUserId="16271" LastEditDate="2015-07-09T20:08:18.580" LastActivityDate="2015-07-09T20:08:18.580" Title="How can I know about if there is a smurf attack on my network?" Tags="|security|troubleshooting|sonicwall|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19579" PostTypeId="2" ParentId="19561" CreationDate="2015-06-30T17:47:57.230" Score="9" Body="&lt;p&gt;In addition to what Ron and Ricky have mentioned (the recipient needing to know who to respond to and nodes along the way needing to know where to send any ICMP messages,) TCP connections are identified by the unique 4-tuple of &lt;strong&gt;source IP address, destination IP address, source port number, and destination port number&lt;/strong&gt;. Without the source IP address, the receiver's TCP stack wouldn't know which stream a particular incoming packet belonged to. The same is true, of course, for UDP or any other transport-layer protocol that supports having multiple remote hosts sending packets to the same transport-layer protocol and transport-layer protocol stream identifier (e.g. port number.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider, for example, a web server. It listens for incoming packets on the server's TCP port 80. However, &lt;em&gt;all&lt;/em&gt; of the clients connected to that server will be sending their packets to port 80 on the IP address of the web server. Additionally, there's no guarantee that the source port number will be different between clients on different computers. As such, without the source IP address being in the packet, the TCP stack doesn't know which of the connections to port 80 any given incoming packet belongs to and, thus, doesn't know which stream (socket) its payload should be delivered to. Additionally, it wouldn't know which receive window, etc. to use, since it wouldn't be able to uniquely identify which connection the packet belongs to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, while this is not the reason for the design, an additional place where this becomes useful is in NATs. NATs use a 5-tuple to uniquely identify which connection incoming packets belong to, source IP address, source port, destination IP address, destination port, and transport-layer protocol (e.g. TCP or UDP.) Again, without all of that information, the NAT would be unable to uniquely identify the stream and, thus, wouldn't know which internal address/port it should forward the packet to.&lt;/p&gt;&#xA;" OwnerUserId="4882" LastEditorUserId="4882" LastEditDate="2015-06-30T18:02:38.910" LastActivityDate="2015-06-30T18:02:38.910" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19580" PostTypeId="1" CreationDate="2015-06-30T19:01:03.453" Score="3" ViewCount="1954" Body="&lt;p&gt;My internet has an upload limit of 1 Mb/s. If I am in a UDP multicast group with 10 people and I send something to the group at a rate of .1 Mb/s, will my upload rate be 0.1 Mb/s or 1.0 Mb/s? Assume all people are on the public internet.&lt;/p&gt;&#xA;" OwnerUserId="15975" LastActivityDate="2015-07-01T00:36:30.997" Title="If I UDP multicast to 10 listeners in a multicast group, will my upload bandwidth usage increase by 10 fold?" Tags="|multicast|bandwidth|udp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19581" PostTypeId="1" AcceptedAnswerId="19718" CreationDate="2015-06-30T21:08:07.257" Score="16" ViewCount="34930" Body="&lt;p&gt;I found that the reason the active closer enters TIME WAIT is to make sure that the final ACK is not lost. But how does it know if the final ACK is lost? Will the passive closer resend the FIN and then the active closer knows the ACK was lost? Here is a picture of the TCP FSM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://jose-manuel.me/wp-content/uploads/2011/09/connection-fsm.gif&quot; alt=&quot;TCP FSM&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16275" LastEditorUserId="-1" LastEditDate="2017-03-10T09:42:47.063" LastActivityDate="2015-07-07T21:00:28.650" Title="What is the purpose of TIME WAIT in TCP connection tear down?" Tags="|tcp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19582" PostTypeId="2" ParentId="19580" CreationDate="2015-06-30T21:08:15.083" Score="0" Body="&lt;p&gt;The sender will not duplicate the content so your rate will remain .1.  You will need to tunnel your multicast traffic across the Internet.  Specifically, you may want to &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/ip-multicast/43584-mcast-over-gre.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;tunnel multicast over a GRE tunnel&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/pmgnF.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-06-30T21:08:15.083" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19583" PostTypeId="1" CreationDate="2015-06-30T21:16:59.410" Score="1" ViewCount="2206" Body="&lt;p&gt;After configuring Tacacs+ cannot access throught tacacs or telnet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;!&#xA;!&#xA;aaa group server tacacs+ TACACS+CG&#xA; server [server ip address]&#xA; server [server ip address]&#xA;!&#xA;aaa authentication login default group TACACS+CG enable&#xA;aaa authentication enable default group TACACS+CG enable&#xA;aaa authorization exec default group TACACS+CG if-authenticated &#xA;aaa authorization commands 0 default group TACACS+CG if-authenticated &#xA;aaa authorization commands 1 default group TACACS+CG if-authenticated &#xA;aaa authorization commands 15 default group TACACS+CG if-authenticated &#xA;!&#xA;aaa session-id common&#xA;!&#xA;tacacs-server host [server ip address] timeout 3 key 7 [key]&#xA;tacacs-server host [server ip address] timeout 3 key 7 [key]&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am i doing wrong? help is appreciated. &lt;/p&gt;&#xA;" OwnerUserId="13605" LastActivityDate="2015-07-31T13:03:24.257" Title="After configuring tacacs cannot access to cli" Tags="|aaa|tacacs|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19584" PostTypeId="2" ParentId="19583" CreationDate="2015-06-30T23:22:12.280" Score="1" Body="&lt;p&gt;The instant you enter &lt;code&gt;aaa authorization commands&lt;/code&gt;, TACACS applies to &lt;em&gt;every&lt;/em&gt; command you enter. If you aren't authenticated by TACACS, you will be unable to do anything. If the tacacs server(s) aren't reachable, there can be significant delays for each command as it tries to authorize them.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-06-30T23:22:12.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19586" PostTypeId="2" ParentId="19581" CreationDate="2015-07-01T00:13:12.070" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But how does it know if the final ACK is lost?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because it didn't receive it within the timeout period. I know that's a &quot;duh&quot; answer, but that's exactly why these states and timeouts exist.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Will the passive closer resend the FIN&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. Not unless further packets arrive for that stream, and that would result in &quot;RST&quot; (reset) being sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole process is complicated state machine to execute an orderly shutdown despite the possibility of network failures. Networks break, links experience errors, links become saturated and have to drop packets, devices fail, etc.  As an exercise, run the state tree for an active connection when one of the endpoints just disappears (eg. power failure.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR That state tree is designed to handle every possible failure mode.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-01T00:13:12.070" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19587" PostTypeId="2" ParentId="19580" CreationDate="2015-07-01T00:36:30.997" Score="1" Body="&lt;p&gt;Multicast is a special case of broadcast. It is a &lt;em&gt;one-to-many&lt;/em&gt; mechanism. The sender sends a single packet and the &lt;em&gt;network&lt;/em&gt; copies it everywhere it needs to go.  To a switch or WiFi access-point, it's handled just like broadcast traffic&lt;sup&gt;[1]&lt;/sup&gt;, 'tho multicast filtering may apply. To a router that isn't configured for multicast routing (which is basically every router, ever), it's random broadcast noise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this to work, the various routers between you and your targets would have to be configured for multicast routing. This is unlikely. While it is, in theory, possible within a single ISP network, across the internet would be unmanageable. (not to mention &lt;em&gt;immediately&lt;/em&gt; abused)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;[1]&lt;/sup&gt; This is why Uverse uses a dedicated AP for their wireless set-top boxes. Those APs run special software that handles the multicast video stream(s) like unicast. Wifi broadcasts go out at a basic rate (a minimum every associated client can handle) that's just far too slow.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-01T00:36:30.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19588" PostTypeId="2" ParentId="19578" CreationDate="2015-07-01T00:51:22.190" Score="2" Body="&lt;p&gt;It is all to common (sadly) for firewalls to flag things a little aggressively. You'll need to use something like wireshark and/or netflow to watch and monitor what's actively flowing through the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problems with WiFi can be as simple as too many clients associated generating too much traffic for the available bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-01T00:51:22.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19592" PostTypeId="2" ParentId="19568" CreationDate="2015-07-01T05:14:34.827" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;why [does] IPv6 has multiple default routing entries?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Simple. You have three (3) prefixes -- a &quot;/0&quot; (traditional default), and two &quot;/64&quot;s.  IPv6 supports multiple routers (and thus prefixes) per interface. In this case, they do all go to the same place.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-01T05:14:34.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19593" PostTypeId="2" ParentId="19526" CreationDate="2015-07-01T06:19:26.143" Score="0" Body="&lt;p&gt;What you are asking to do is impossible with BGP as there is no TAG support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you trying to build an overlay network on top of your existing BGP environment? Our you terminating eBGP on the MPLS side of your DMVPN spoke? Are you advertising all networks on each side of your drawing? (All remote networks to DMVPN spoke and listed BGP router)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without more information I don't really see any possibility of a routing loop. Your advertised routes on the BGP side will have a lower Administrative Distance and would be preferred by the other routers on the network by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll leave you with one last question. Why not handle this with the OSPF redistribution to the BGP router in question? You could easily create a prefix-list and route-map to block the networks of concern from being learned by the BGP router. If you need assistance with this let me know and I will update the post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best of luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Daniel &lt;/p&gt;&#xA;" OwnerUserId="16282" LastActivityDate="2015-07-01T06:19:26.143" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19594" PostTypeId="2" ParentId="19583" CreationDate="2015-07-01T06:36:02.730" Score="0" Body="&lt;p&gt;It will not let me add a comment to the above answer. :( What Ricky has posted is correct. Does your enable password work for the login? You do have that set as the backup for your login in the configuration above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen this more than once in my time. The best advice that I can give you is to do the following two things in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add &quot;local&quot; to the end of your AAA commands&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication login default group TACACS+CG enable local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do not add the AAA authorization commands until you know that the more basic items are functioning properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let us know about the enable password. You should be able to access your configuration at that point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Daniel&lt;/p&gt;&#xA;" OwnerUserId="16282" LastEditorUserId="509" LastEditDate="2015-07-01T06:46:59.287" LastActivityDate="2015-07-01T06:46:59.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19596" PostTypeId="1" AcceptedAnswerId="19654" CreationDate="2015-07-01T09:04:06.547" Score="0" ViewCount="187" Body="&lt;p&gt;We're moving to a new office that has no cables installed and we're wondering if using a powerline solution would be adequate. It's a small office with 5 users, 1 server, and some additional devices (printers, smartphones, etc...), which total about 10 simultaneous devices connected.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the major drawbacks in connecting multiple devices to one powerline adapter, via wi-fi or through cable?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used a similar solution at home, with great success, but I'm wondering if having more simultaneous devices connected will create us problems regarding contention ratio or other issues.&lt;/p&gt;&#xA;" OwnerUserId="16286" LastActivityDate="2015-07-02T22:27:46.373" Title="Small office networking via powerline" Tags="|ethernet|congestion|" AnswerCount="2" CommentCount="6" ClosedDate="2019-06-30T00:52:57.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="19597" PostTypeId="2" ParentId="7187" CreationDate="2015-07-01T09:28:25.190" Score="3" Body="&lt;p&gt;I am using the following interface configuration, although this is platform depending. This is a 7600 with LAN cards, on some ASR9Ks and ME3800s the timers are lower due to the better hardware support so you need to tune this to your own requirements:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;&#xA; ip routing protocol purge interface &#xA;&#xA; int te6/5&#xA;  carrier-delay up 5&#xA;  carrier-delay down 0&#xA;  dampening&#xA;  bfd interval 500 min_rx 500 multiplier 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I couldn't find any information in any Cisco docs and that doesn't recommend combining these commands. I did find this thread in which a Cisco employee has contributed to saying that one can mix them and it is recommended: &#xA;&lt;a href=&quot;http://www.gossamer-threads.com/lists/cisco/nsp/161219&quot; rel=&quot;nofollow&quot;&gt;http://www.gossamer-threads.com/lists/cisco/nsp/161219&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BFD is performing rapid link down detection. When that happens the link will go straight down. When the link comes back up, the carrier-delay will hold it back from being signal as UP to the routing protocol for 5 seconds. Dampening is also enabled such that if this link continues to flap and violates the damping threshold it will be supressed from being signalled to the routing protocol(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is recommend you tune the damping values to your needs: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/s_ipevdp.html#wp1027265&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/s_ipevdp.html#wp1027265&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2015-07-01T09:28:25.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19598" PostTypeId="2" ParentId="19129" CreationDate="2015-07-01T10:54:10.517" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://support.apple.com/en-gb/HT203033&quot; rel=&quot;nofollow&quot;&gt;This document from Apple KB&lt;/a&gt; provides some background on Location scans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like that part of iOS is scanning for WiFi networks in the background and sending this data to Apple, enabling them to crowdsource a geo tagged map of WiFi access points to help with positioning accuracy in other apps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EG: Your phone is at GPS co-ordinates Latitude:37.330558° and -122.029675° and reports to apple that it can see 8 wifi networks which it has discovered via the Location services scan. The phone then reports this data to Apple which it will compare to other devices data from the same area and, probably using signal strength data, will tri-laterate the AP location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why? So they can use the location of WiFi AP's to enhance positioning data so your apps/device can use that to send you useful data/ads/services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Auto Join scans (I'm making an educated guess here) will be the scans that the device performs in order to discover commonly used and remembered networks eg; ClemensimHomeWiFi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically it looks like Apple are extending the conditions when the device will use an obfuscated MAC address in these scans. Following the original release of this functionality in iOS8 &lt;a href=&quot;http://blog.airtightnetworks.com/ios8-mac-randomization-analyzed/&quot; rel=&quot;nofollow&quot;&gt;it was discovered that randomisation only occurred under a VERY specific set of circumstances&lt;/a&gt; that most users would not enable/experience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has to use it's real mac address as soon as authentication occurs in order to maintain compatibility with WiFi standards that rely on mac filtering/auth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As one of those people who is measuring foot traffic via the standard WiFi probes that Apple is altering this is an area of significant interest. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing is clear, Apple intend to aggressively pursue this path as a way to increase use of iBeacon and Apple services for advertisers wishing to reach consumers, it is NOT about user privacy. However, there is only so much they can do until the consequences start affecting performance on different WiFi networks and/or breaking the 802.11 specification.&lt;/p&gt;&#xA;" OwnerUserId="16288" LastActivityDate="2015-07-01T10:54:10.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19599" PostTypeId="2" ParentId="19583" CreationDate="2015-07-01T12:07:39.400" Score="0" Body="&lt;p&gt;To be able to debug allow local login, then login and observe with &lt;code&gt;debug tacacs&lt;/code&gt;  what is happening when you log in with a tacacs login id on second telnet session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Paste into config after saving original.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!    &#xA;username test privilege 15 password test&#xA;!&#xA;aaa authentication login default local group TACACS+CG enable&#xA;no aaa authentication enable default group TACACS+CG enable&#xA;aaa authorization exec default if-authenticated &#xA;aaa authorization commands 0 default  if-authenticated &#xA;aaa authorization commands 1 default  if-authenticated &#xA;aaa authorization commands 15 default  if-authenticated&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after logging in as test user&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;debug tacacs&#xA;terminal monitor&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then try and login using a tacacs account on second telnet session.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-01T12:07:39.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19602" PostTypeId="1" CreationDate="2015-07-01T13:36:47.007" Score="1" ViewCount="1126" Body="&lt;p&gt;Due to the scope of a current project, I need to setup VLANs in a few small locations. I don't have a lot experience, and even less time, so any help will be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Netgear SRX5308 [DHCP] =&amp;gt; Netgear GS728TSB =&amp;gt; Netgear GS110TP =&amp;gt; Netgear GS105E =&amp;gt; various devices&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are quite a few GS105Es, and each has connected a Wi-Fi AP connected, broadcasting a tagged SSID. Also, there is a smart TV and an Apple TV connected to each as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to have each port to have a different default (native/management) VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for ports on the GS105Es, I created VLANs 101, 102, 103, 104, and 201:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;101 - port setup Untagged - port1, Tagged -port5 (leading to GS110TP)&lt;/li&gt;&#xA;&lt;li&gt;102 - port setup Untagged - port2, Tagged -port5 (leading to GS110TP)&lt;/li&gt;&#xA;&lt;li&gt;103 - port setup Untagged - port3, Tagged -port5 (leading to GS110TP)&lt;/li&gt;&#xA;&lt;li&gt;104 - port setup Untagged - port4, Tagged -port5 (leading to GS110TP)&lt;/li&gt;&#xA;&lt;li&gt;201 - port setup Tagged - port 1 and port 5 ( for tagged SSID)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and changed the PVID:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;port1 - PVID 101&lt;/li&gt;&#xA;&lt;li&gt;port2 - PVID 102&lt;/li&gt;&#xA;&lt;li&gt;port3 - PVID 103&lt;/li&gt;&#xA;&lt;li&gt;port4 - PVID 104&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have different a DHCP scope for each, so, for example. 192.168.101.x for VLAN 101.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will VLAN unaware devices on different ports be able to talk to one to another since they will be on different subnets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something? Is there a different way of separating them?&lt;/p&gt;&#xA;" OwnerUserId="4956" LastEditorUserId="8499" LastEditDate="2016-04-05T01:32:54.223" LastActivityDate="2020-06-11T10:31:09.787" Title="Netgear VLANs' setup with PVID" Tags="|vlan|netgear-prosafe|" AnswerCount="1" CommentCount="1" ClosedDate="2020-06-11T11:40:03.583" ContentLicense="CC BY-SA 3.0" />
  <row Id="19603" PostTypeId="1" CreationDate="2015-07-01T16:13:58.450" Score="4" ViewCount="14107" Body="&lt;p&gt;In a similar vein as &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3012/cable-colors-and-purpose&quot;&gt;this question&lt;/a&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any conventions or standards that recommend a color scheme for the colors of Ethernet keystone jacks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OFEP4.jpg&quot; alt=&quot;colored jacks&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16295" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-08-03T01:52:44.280" Title="Ethernet keystone jack color conventions?" Tags="|ethernet|cabling|best-practices|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="19604" PostTypeId="1" CreationDate="2015-07-01T16:21:45.990" Score="0" ViewCount="144" Body="&lt;p&gt;Let's say there is an application server that runs multiple web applications. Some of these applications are accessible directly from the Internet, however a specific application requires single-sign-on, which is implemented via a reverse proxy solution that adds the proper HTTP headers. This reverse proxy implementation is running on a different box inside the company network. What are the typical ways to enforce that this particular application only processes request that are &quot;through the SSO&quot; (through the reverse proxy), but not the ones coming directly from the internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some ideas:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Simply check the request IP and see if that matches the proxy's&lt;/li&gt;&#xA;&lt;li&gt;Require an SSL client sertificate to be sent by the reverse proxy&lt;/li&gt;&#xA;&lt;li&gt;Do not care about the source of the incoming HTTP request, but check with the SSO if the HTTP headers included are for a valid SSO session or not&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What are the pros and cons of each approach? How did you implement something similar? The particular SSO implementation is IBM WebSeal, but I'm also interested in how you've solved the problem with any other product as well. thanks!&lt;/p&gt;&#xA;" OwnerUserId="16297" LastEditorDisplayName="user36472" LastEditDate="2018-02-16T16:56:45.553" LastActivityDate="2018-02-16T16:56:45.553" Title="Authentication of reverse proxy" Tags="|authentication|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19605" PostTypeId="1" AcceptedAnswerId="19620" CreationDate="2015-07-01T18:05:13.497" Score="2" ViewCount="1050" Body="&lt;p&gt;i would like to know how i can configure juniper &quot;SRX100&quot; switch such that there i can connect two LAN's for inbound traffic and one outbound traffic.&lt;/p&gt;&#xA;" OwnerUserId="16300" LastActivityDate="2015-07-03T02:36:42.480" Title="How to configure 2 LAN as input and one output ports in juniper switch" Tags="|switch|juniper|juniper-junos|juniper-srx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19606" PostTypeId="1" CreationDate="2015-07-01T18:08:49.257" Score="1" ViewCount="352" Body="&lt;p&gt;I bought some old network gear for a lab and now trying to set it up with a connection to my Comcast modem. I have a business class modem in bridged mode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0/0 - Global IP (Vlan2)&#xA;0/1 - 192.168.1.1 (Vlan10). DHCP is used on this device.&#xA;Static route 0.0.0.0 0.0.0.0 (Global IP Gateway).&#xA;Router EIGRP 90 (network 172.16.100.0 0.0.0.255)&#xA;&#xA;&#xA;&#xA;Connected to port 0/1 of the 5505 is a Cisco 2811 Router&#xA;Port 0/0 is assigned 192.168.1.254.&#xA;Port 0/1 is assigned 172.16.100.1&#xA;Static Route of 0.0.0.0 0.0.0.0 192.168.1.1&#xA;&#xA;Connected to port 0/1 of the 2811 is a Cisco 3550&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See configs below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is I can traceroute from the 3550 and only get as far as 172.16.100.1&#xA;If I traceroute on the 2811 to outside, I can get anywhere I want. This would seem to lead me to believe there is an issue on the 2811 router. What am I missing? Is DHCP an issue on the 5505?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cisco 2811&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0  &#xA; ip address 192.168.1.254 255.255.255.0  &#xA; duplex full  &#xA; speed auto  &#xA; no mop enabled  &#xA;!  &#xA;interface FastEthernet0/1  &#xA; ip address 172.16.100.1 255.255.255.0  &#xA; duplex auto  &#xA; speed auto  &#xA;!  &#xA;interface Serial0/0/0    &#xA;no ip address  &#xA;shutdown  &#xA;!  &#xA;router eigrp 90  &#xA; network 172.16.100.0 0.0.0.255  &#xA;!  &#xA;ip forward-protocol nd  &#xA;!  &#xA;no ip http server  &#xA;no ip http secure-server  &#xA;!  &#xA;ip route 0.0.0.0 0.0.0.0 192.168.1.1  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cisco 3550&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no service pad  &#xA;service timestamps debug datetime msec  &#xA;service timestamps log datetime msec  &#xA;service password-encryption  &#xA;!  &#xA;hostname Corp3550  &#xA;!  &#xA;!  &#xA;username admin privilege 15 secret 5 $1$2wiI$fG1Ywcao.75bbnacN.REI0  &#xA;!  &#xA;!  &#xA;no aaa new-model  &#xA;clock timezone EST -5  &#xA;clock summer-time EDT recurring  &#xA;authentication mac-move permit  &#xA;mls qos  &#xA;ip subnet-zero  &#xA;ip routing  &#xA;!  &#xA;!  &#xA;spanning-tree mode pvst  &#xA;spanning-tree etherchannel guard misconfig  &#xA;spanning-tree extend system-id  &#xA;!  &#xA;vlan internal allocation policy ascending  &#xA;!  &#xA;interface FastEthernet0/1  &#xA; description Edge Port to Corp-2811  &#xA; switchport access vlan 25  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA; spanning-tree bpduguard enable  &#xA;!  &#xA;interface Vlan1  &#xA; ip address dhcp &#xA; ip address shutdown   &#xA;!  &#xA;interface Vlan10  &#xA; description Vuepc Server Network  &#xA; ip address 192.168.100.1 255.255.255.0  &#xA; ip helper-address 192.168.100.3  &#xA;!  &#xA;interface Vlan25  &#xA; description Transit Network  &#xA; ip address 172.16.100.254 255.255.255.0  &#xA;!  &#xA;interface Vlan35  &#xA; description Management Network  &#xA; ip address 192.168.102.1 255.255.255.0  &#xA;!  &#xA;router eigrp 90  &#xA; network 172.16.100.0 0.0.0.255  &#xA; network 192.168.20.0  &#xA; network 192.168.100.0  &#xA; network 192.168.101.0  &#xA; network 192.168.102.0  &#xA; eigrp stub connected summary  &#xA;!  &#xA;ip classless  &#xA;ip route 0.0.0.0 0.0.0.0 172.16.100.1  &#xA;ip route 0.0.0.0 0.0.0.0 192.168.1.1 254  &#xA;ip http server  &#xA;ip http authentication local  &#xA;!  &#xA;ip radius source-interface Vlan10   &#xA;!  &#xA;ip sla enable reaction-alerts  &#xA;!  &#xA;control-plane  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16298" LastEditorUserId="2142" LastEditDate="2015-07-01T20:25:12.017" LastActivityDate="2016-06-26T02:02:54.293" Title="ASA 5505+Cisco 2811 router" Tags="|routing|cisco-asa|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19607" PostTypeId="2" ParentId="19603" CreationDate="2015-07-01T19:43:31.990" Score="2" Body="&lt;p&gt;My personal experience is that we use whatever color matches the paint in the room its in, unless it is one of the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Red: Hospital Monitoring Equipment&lt;br/&gt;&#xA;Blue: Security Cameras&lt;br/&gt;&#xA;Green: Any separate LAN or VLAN connection (ie. radiology has a few of these)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't believe there is a specific standard for them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Correction: as Comments state below talk to your AHJ&lt;/p&gt;&#xA;" OwnerUserId="16304" LastEditorUserId="16304" LastEditDate="2015-07-01T22:45:43.457" LastActivityDate="2015-07-01T22:45:43.457" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19608" PostTypeId="1" CreationDate="2015-07-01T21:16:39.593" Score="2" ViewCount="1871" Body="&lt;p&gt;Here is an example use case; I am curious to see how this is suppose to work and why:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone has a NAT router from their ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Behind the router are 2 PCs running Linux and using ntpd.&#xA;ntpd sends UDP messages to servers with source and destination port both set to 123.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the packets come out of the router (WAN port) and go to the NTP server, what should their src port be? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the router suppose to map the src on the LAN to a different src on the WAN so it knows how to map the responses? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, and they carry src 123 out to the internet, how does the router know which PC to send the reply to?&lt;/p&gt;&#xA;" OwnerUserId="16306" LastEditorUserId="16306" LastEditDate="2015-07-07T18:27:43.110" LastActivityDate="2021-01-29T05:51:58.710" Title="How are UDP source ports mapped on a NAT?" Tags="|routing|router|nat|udp|ntp|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19609" PostTypeId="2" ParentId="19608" CreationDate="2015-07-01T22:03:50.323" Score="3" Body="&lt;p&gt;This depends on the NAT implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, most NAT engines prefer to make as few modifications as necessary. So, the first one there gets to keep their src port. The second one is &quot;the loser&quot; and has it changed. The map entry doesn't depend on anything changing; it tracks whatever is used, changed or not. As long as they aren't both talking to the same server, they can both use the same src port, because the map includes the destination:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[(inside){src}PC A:123 {dst}Server A:123 :: (outside){src}ISP:123 {dst}Server A:123]&#xA;[(inside){src}PC B:123 {dst}Server B:123 :: (outside){src}ISP:123 {dst}Server B:123]&#xA;                                                     ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The outside details are different, thus a unique key to find the inside match.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-01T22:03:50.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19610" PostTypeId="2" ParentId="19606" CreationDate="2015-07-01T22:08:42.400" Score="2" Body="&lt;p&gt;The 5505 doesn't know anything about 172.16.100.0/24. Add a static route or fix your EIGRP configuration so the router tells it about it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IGRP or EIGRP sends updates to the interfaces in the specified networks. Also, if the network of an interface is not specified, it will not be advertised in any IGRP or EIGRP update.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;[&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfeigrp.html#wp1031063&quot; rel=&quot;nofollow&quot;&gt;EIGRP Commands&lt;/a&gt;]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-01T22:08:42.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19611" PostTypeId="2" ParentId="19596" CreationDate="2015-07-01T22:29:48.993" Score="0" Body="&lt;p&gt;Faster? Maybe. More reliable? My money is on &quot;no.&quot; It will, however, be much harder to troubleshoot, and depending on the wiring setup (same phase?, same circuit?) it may not work at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the long run, you're much better off paying someone to string some wires.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-01T22:29:48.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19612" PostTypeId="2" ParentId="13417" CreationDate="2015-07-01T23:37:25.843" Score="27" Body="&lt;p&gt;The answer is simple: whenever the host pleases. Really. It's that simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The explanation below assumes an IPv4-only environment, since IPv6 does away with fragmentation in the routers (forcing the host to always deal with fragmentation and MTU discovery).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no strict rule that governs when (or even if) a host does Path MTU Discovery. The reason that PMTUD surfaced is that &lt;a href=&quot;http://www.hpl.hp.com/techreports/Compaq-DEC/WRL-87-3.pdf&quot;&gt;fragmentation is considered harmful&lt;/a&gt; for various reasons. To avoid packet fragmentation, the concept of PMTUD was brought to life as a workaround. Of course, a nice operating system &lt;em&gt;should&lt;/em&gt; use PMTUD to minimize fragmentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, naturally, the exact semantics of when PMTUD is used depend on the sender's operating system - in particular, the socket implementation. I can only speak for the specific case of Linux, but other UNIX variants are probably not very different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Linux, PMTUD is controlled by the &lt;code&gt;IP_MTU_DISCOVER&lt;/code&gt; socket option. You can retrieve its current status with &lt;code&gt;getsockopt(2)&lt;/code&gt; by specifying the level &lt;code&gt;IPPROTO_IP&lt;/code&gt; and the &lt;code&gt;IP_MTU_DISCOVER&lt;/code&gt; option. This option is valid for &lt;code&gt;SOCK_STREAM&lt;/code&gt; sockets only (a &lt;code&gt;SOCK_STREAM&lt;/code&gt; socket is a two-way, connection-oriented, reliable socket; in practice it's a TCP socket, although other protocols are possible), and when set, Linux will perform PMTUD exactly as defined in RFC 1191.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that in practice, PMTUD is a continuous process; packets are sent with the DF bit set - including the 3-way handshake packets - you can think of it as a connection property (although an implementation may be willing to accept a certain degree of fragmentation at some point and stop sending packets with the DF bit set). Thus, PMTUD is just a consequence of the fact that everything on that connection is being sent with DF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What if you don't set &lt;code&gt;IP_MTU_DISCOVER&lt;/code&gt;?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a default value. By default, &lt;code&gt;IP_MTU_DISCOVER&lt;/code&gt; is enabled on &lt;code&gt;SOCK_STREAM&lt;/code&gt; sockets. This can be read or changed by reading &lt;code&gt;/proc/sys/net/ipv4/ip_no_pmtu_disc&lt;/code&gt;. A zero value means that &lt;code&gt;IP_MTU_DISCOVER&lt;/code&gt; is enabled by default in new sockets; a non-zero means the opposite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What about connectionless sockets?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is tricky because connectionless, unreliable sockets do not retransmit lost segments. It becomes the user's responsibility to packetize the data in MTU-sized chunks. Also, the user is expected to make the necessary retransmits in case of a &lt;em&gt;Message too big&lt;/em&gt; error. So, essentially user code must reimplement PMTUD. Nevertheless, if you're up for the challenge, you can force the DF bit by passing the &lt;code&gt;IP_PMTUDISC_DO&lt;/code&gt; flag to &lt;code&gt;setsockopt(2)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The bottomline&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The host decides when (and if) to use PMTUD&lt;/li&gt;&#xA;&lt;li&gt;When it uses PMTUD, it's like a connection attribute, it happens continuously (but at any point the implementation is free to stop doing so)&lt;/li&gt;&#xA;&lt;li&gt;Different operating systems use different approaches, but usually, reliable, connection-oriented sockets perform PMTUD by default, whereas unreliable, connectionless sockets don't&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16308" LastActivityDate="2015-07-01T23:37:25.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19615" PostTypeId="1" AcceptedAnswerId="19623" CreationDate="2015-07-02T02:48:16.577" Score="1" ViewCount="1999" Body="&lt;p&gt;I am starting the design stage of a project dealing with Internet of Things (IoT) devices based on the recent ESP8266 serial to WiFi module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As part of the test environment I will need to setup, I would like to create a separate &quot;area&quot; for all ESP8266 based devieces on the network. I am not sure if subnet is the correct term here. The regular devices (servers, workstations, printers, etc) on the network should have their own IP address range, and the IoT devices another. To get a better understanding, here are my requirements:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Regular network clients have their own IP address range managed by DHCP. No more than 254 clients. Also has the internet gateway on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) IoT devices have their own IP address range - no more than 254 devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) IoT network area will also have a Raspberry Pi webserver&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) All regular network clients should be able to communicate with all IoT devices, especially the Raspberry pi server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5) Raspberry Pi must be able to multicast to IoT devices, but not regular clients&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6) IoT and Raspberry Pi must have internet access through internet gateway&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first thought was to stick a router between the regular clients and IoT devices, with the WAN port connected to my normal network and use the routers Virtual Server feature to access the Raspberry Pi, however, this wouldn't satisfy requirement 4 completely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a very limited budget, so business networking hardware is out of the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Matt&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the request of a more specific question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding my requirements, how would I implement such a network? Is this possible with consumer hardware, or is this limited to business/enterprise hardware?&lt;/p&gt;&#xA;" OwnerUserId="16312" LastEditorUserId="16312" LastEditDate="2015-07-02T04:05:57.320" LastActivityDate="2015-07-02T08:50:57.023" Title="Network partitioning for separate Internet of Things (IoT) subnet" Tags="|routing|subnet|" AnswerCount="2" CommentCount="2" ClosedDate="2015-07-02T14:09:14.947" ContentLicense="CC BY-SA 3.0" />
  <row Id="19617" PostTypeId="2" ParentId="19615" CreationDate="2015-07-02T04:44:51.923" Score="0" Body="&lt;p&gt;It sounds like you want to implement virtual LANs, VLANs.  You will want a multilayer (often called layer 3) switch to do this.  If you need more than 48 wired Ethernet ports, get a switch that is capable of stacking into a virtual/logical switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for IoT, that is a marketing term, not a technical term.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-02T04:44:51.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19618" PostTypeId="1" CreationDate="2015-07-02T05:47:28.717" Score="1" ViewCount="3869" Body="&lt;p&gt;I have a dumb question regarding VLAN and switching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I have a switch that receives some incoming packets which are tagged with different VLANs. The packets' destinations are to the router which is connected to the switch also:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host ----&gt; Switch --(trunk)---&gt; Router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why the host send out the packets with different kind of VLAN is that the Host has a lot of VMs inside and the VM are connected with different sub-interfaces internally&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is that how does the switch treats the incoming packet if they are tagged with VLAN? Will the switch drops the packets or will the switch forward it to the router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="16318" LastActivityDate="2016-01-28T11:02:01.827" Title="How does switch treat ingress tagged packet?" Tags="|switch|vlan|" AnswerCount="2" CommentCount="4" ClosedDate="2019-03-28T00:35:46.170" ContentLicense="CC BY-SA 3.0" />
  <row Id="19619" PostTypeId="2" ParentId="19618" CreationDate="2015-07-02T06:54:22.757" Score="2" Body="&lt;p&gt;In a perfect world, the switch should only pass Ethernet frames that are tagged if it is specifically configured with those VLAN IDs trunked on that interface, or if a VLAN with a matching VLAN ID is the native/access VLAN on that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Frames with tags that are unknown to the switch should be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However: on some unmanaged switches I have seen instances where the switch will completely ignore the Ethertype (indicating a tagged frame) and simply forward based on Destination MAC, passing the frame through the switch  and maintaining the 802.1Q header (essentially acting as a hub with MAC learning).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, your router should then drop the tagged frame if is not configured to receive one, even if the frame was destined for a local MAC address.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-02T06:54:22.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19620" PostTypeId="2" ParentId="19605" CreationDate="2015-07-02T07:11:55.113" Score="3" Body="&lt;p&gt;The basic process is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure your VLANs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vlans v100-INTERNAL1 vlan-id 100&#xA;set vlans v101-INTERNAL2 vlan-id 101&#xA;set vlans v102-EXTERNAL vlan-id 102&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Attach VLANs to switch ports&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces fe-0/0/0 unit 0 family ethernet-switching vlan-members v100-INTERNAL1&#xA;set interfaces fe-0/0/1 unit 0 family ethernet-switching vlan-members v101-INTERNAL2&#xA;set interfaces fe-0/0/2 unit 0 family ethernet-switching vlan-members v102-EXTERNAL&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure IP Interfaces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces vlan unit 100 family inet address 192.168.100.1/24&#xA;set interfaces vlan unit 101 family inet address 192.168.101.1/24&#xA;set interfaces vlan unit 102 family inet address 192.168.102.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Attach IP interfaces to VLANs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vlans v100-INTERNAL1 l3-interface vlan.100&#xA;set vlans v101-INTERNAL2 l3-interface vlan.101&#xA;set vlans v102-EXTERNAL l3-interface vlan.102&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure a default route&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-options static route 0.0.0.0/0 next-hop 192.168.102.254&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Create Security Zones&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security zones security-zone INTERNAL host-inbound-traffic system-services all&#xA;set security zones security-zone EXTERNAL host-inbound-traffic ping&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Attach IP Interfaces to Security Zones&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security zones security-zone EXTERNAL interfaces vlan.102&#xA;set security zones security-zone INTERNAL interfaces vlan.100&#xA;set security zones security-zone INTERNAL interfaces vlan.101&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Create security policies &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security policies from-zone INTERNAL to-zone EXTERNAL policy PERMIT-OUTBOUND match source-address any destination-address any application any&#xA;set security policies from-zone INTERNAL to-zone EXTERNAL policy PERMIT-OUTBOUND then permit&#xA;set security policies from-zone INTERNAL to-zone INTERNAL policy PERMIT-INTERNAL match source-address any destination-address any application any&#xA;set security policies from-zone INTERNAL to-zone INTERNAL policy PERMIT-INTERNAL then permit&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hopefully the topology is fairly self-explanatory - just substitute the IP Addresses you wish to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are connecting to the Internet on the EXTERNAL network, I would recommend tightening up the security policies to only allow specific subnets out, and specific applications&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="3191" LastEditDate="2015-07-03T02:36:42.480" LastActivityDate="2015-07-03T02:36:42.480" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19621" PostTypeId="2" ParentId="17154" CreationDate="2015-07-02T07:44:33.053" Score="1" Body="&lt;p&gt;There are a couple of things that you may require root access for from time-to-time - an example that comes to mind is that if you attach a USB storage device and need to mount it to copy files off, you will need root privelige to execute the &lt;code&gt;mount_msdosfs&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As others have suggested - the best method of dealing with the root account is the way good SysAdmins would - disable all remote access to root, limit access to shell via RBAC and login roles, and then only when absolutely necessary, use &lt;code&gt;su&lt;/code&gt; from shell to elevate an authorised account.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-02T07:44:33.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19622" PostTypeId="2" ParentId="19618" CreationDate="2015-07-02T08:28:59.007" Score="0" Body="&lt;p&gt;All packets internal to a switch is associated with a vlan id.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They get the vlan id in one of two ways, &#xA;1. when entering on a normal access port, the port is associated with a vlan, default 1, but this can be changed.&#xA;2. when entering on a trunk/tagged port the packet arrives with a vlan id.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When packets leave a switch port there is again 2 choices.&#xA;1. on a access port, only packets that match the port vlan is allowed out, and the vlan id is stripped and only a plain Ethernet packet leave.&#xA;3. on a trunk/tagged port, the packet is transmitted with it's vlan tag (for native vlan it is also stripped)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer the question we would have to guess some of the information not provided.&#xA;Senario A: both ports on the switch are access port on same vlan.&#xA;Tagged packet arrives on VM-in port, and get sent out Router-out port with vlan tag.  Possible problems with mtu as vlan tag increase's packet length and for maximum size frames could be dropped.&#xA;(Inside the switch the packet will have double vlan tags, but only single original vlan tag when leaving.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Senario B: Switch is properly configured with trunk ports for VM-in and Router out.&#xA;Packets from VM will hit switch with vlan tag, tag preserved in switch and packets out to router will be tagged, router will need vlan sub-interfaces for each vlan to accept packets.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-02T08:28:59.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19623" PostTypeId="2" ParentId="19615" CreationDate="2015-07-02T08:50:57.023" Score="0" Body="&lt;h2&gt;I make the assumption that&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the IOT devices has fixed IP's.&lt;/li&gt;&#xA;&lt;li&gt;the Rasberry Pi is linux and can do routing.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Summary.&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use two ip subnets on same network, let Rasberry Pi route between&#xA;subnets (or Www GW if it can)&lt;/li&gt;&#xA;&lt;li&gt;On Internet gw device add static route pointing to Rasberry Pi for&#xA;the IOT subnet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Answering questions&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;1) Regular network clients have their own IP address range managed by DHCP. No more than 254 clients. Also has the internet gateway on it.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Only need a fixed IP for Rasberry Pi in client range, and static route on internet gateway pointing new IOT subnet to Rasberry Pi fixed ip.&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;2) IoT devices have their own IP address range - no more than 254 devices.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Fixed ip's, also one ip on Rasberry Pi&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;3) IoT network area will also have a Raspberry Pi webserver&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;OK ?  2nd Raspberry Pi ?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;4) All regular network clients should be able to communicate with all IoT devices, especially the Raspberry pi server&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;They will send traffic to GW that will route back to Rasberry Pi&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;5) Raspberry Pi must be able to multicast to IoT devices, but not regular clients&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;No problem if they are same physical network&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;6) IoT and Raspberry Pi must have internet access through internet gateway1&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Fine if IOT has Raspberry Pi as default GW and Raspberry Pi has default route pointing to Internet GW&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The other option is to do the inter-subnet routing on the Internet GW if it is capable of taking a secondary IP in the IOT subnet. In this case just make this ip the default GW on all the IOT devices.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-02T08:50:57.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19625" PostTypeId="2" ParentId="17154" CreationDate="2015-07-02T09:07:35.687" Score="1" Body="&lt;p&gt;To complete previous answers, I will point out two practical scenarios where I have to access as root to JunOS recently.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Collecting log items from multiple members in a Virtual Chassis. You have to access the shell to tar /var/log foldeer.&lt;/li&gt;&#xA;&lt;li&gt;Recovering a switch from a zombie status. A couple of EX4200 got stuck in &quot;Loading JunOS&quot; so I have to access the shell for some maintenance process.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you can see, this is not usual but sometimes you will need this shell access.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2015-07-02T09:07:35.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19628" PostTypeId="1" CreationDate="2015-07-02T11:20:41.457" Score="2" ViewCount="1245" Body="&lt;p&gt;We have bought two new switches that will be used as the core in our network. They will be directly connect with some LACP link. The aggregation layer consists of 5 L3 switches that will have one direct link to each of the core switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how to best set up the vlans between core and aggregation. My first idea was to have one vlan for each link and have ptp connections between all agg-switches and the two core switches. But say I want some vlan to span the entire network I then have the problem of loops in the network if I want to use both links. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;Right now I have three scenarios in my head for the setup. And I want your opinion on the best way to setup a OSPF network with the structure shown in the diagram below. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;All router links are p2p. (/30 link nets)&lt;/li&gt;&#xA;&lt;li&gt;All router links are on the same subnet (and then using MC-LAG (DELL VLT) for redudancy and avoid loops)&lt;/li&gt;&#xA;&lt;li&gt;Stack the two core switches and use regular LAG for all links.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Network diagram:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/DFe0b.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16331" LastEditorUserId="16331" LastEditDate="2015-07-09T20:22:20.060" LastActivityDate="2015-07-09T20:22:20.060" Title="Designing OSPF mesh network" Tags="|routing|vlan|ospf|switching|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19629" PostTypeId="1" AcceptedAnswerId="19637" CreationDate="2015-07-02T13:14:50.233" Score="0" ViewCount="129" Body="&lt;p&gt;I've been running my own name servers (bind9) for many years in Linux boxes, and I have several in my office served by Verizon FiOS. This morning I discovered that I could no longer resolve anything in the google.com domain. Other domain lookups continued to work. I verified that my root server tables are current.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unable to identify a misconfiguration, and noticing the problem did not exist with a name server in a VPS on a Linode, I tried a work-around. That VPS is on a layer 2 VPN with my office network, so I switched my default route on some of the affected office systems such that all traffic to the Internet went through the VPS. After this switch, name service is OK, resolving google.com.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See demo below. Note that 192.168.10.87 is one of my internal routers that does NAT to the Version FiOS interface. 192.168.10.78 is functioning as a router on the VPN at a remote site, effectively providing a tunnel for my named processes (and everything else unfortunately) to get to the Internet after I change the default route. The behavior is consistent on three separate computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have some half-baked theories about what is going on, but I can't decide how to diagnose this further.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@flipper:~# host google.com&#xA;;; connection timed out; no servers could be reached&#xA;root@flipper:~# host yahoo.com&#xA;yahoo.com has address 206.190.36.45&#xA;yahoo.com has address 98.138.253.109&#xA;yahoo.com has address 98.139.183.24&#xA;yahoo.com has IPv6 address 2001:4998:44:204::a7&#xA;yahoo.com has IPv6 address 2001:4998:c:a06::2:4008&#xA;yahoo.com has IPv6 address 2001:4998:58:c02::a9&#xA;yahoo.com mail is handled by 1 mta5.am0.yahoodns.net.&#xA;yahoo.com mail is handled by 1 mta7.am0.yahoodns.net.&#xA;yahoo.com mail is handled by 1 mta6.am0.yahoodns.net.&#xA;root@flipper:~# ip ro del default via 192.168.10.87&#xA;root@flipper:~# ip ro add default via 192.168.10.78&#xA;root@flipper:~# host google.com&#xA;google.com has address 216.58.219.206&#xA;google.com has IPv6 address 2607:f8b0:4006:80e::200e&#xA;google.com mail is handled by 30 alt2.aspmx.l.google.com.&#xA;google.com mail is handled by 40 alt3.aspmx.l.google.com.&#xA;google.com mail is handled by 10 aspmx.l.google.com.&#xA;google.com mail is handled by 20 alt1.aspmx.l.google.com.&#xA;google.com mail is handled by 50 alt4.aspmx.l.google.com.&#xA;root@flipper:~# cat /etc/resolv.conf &#xA;# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)&#xA;#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN&#xA;nameserver 127.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16326" LastActivityDate="2015-07-02T16:22:29.827" Title="bind9 selective failure to resolve with particular default route" Tags="|dns|" AnswerCount="2" CommentCount="2" ClosedDate="2015-07-02T19:26:10.080" ContentLicense="CC BY-SA 3.0" />
  <row Id="19630" PostTypeId="2" ParentId="19628" CreationDate="2015-07-02T13:48:12.357" Score="2" Body="&lt;p&gt;If your two core switches support vss, vpc, or mlag, you could simplify the network as the two core switches will look like one switch with a LACP ether-channel to the aggregation layer switches.&lt;/p&gt;&#xA;&lt;h1&gt;EDIT:&lt;/h1&gt;&#xA;&lt;p&gt;This will eliminate loops to the aggregation layer as each aggregation switch will have a single ether-channel link, while still allowing VLAN's to span all aggregation switches.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-07-03T13:08:39.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19631" PostTypeId="1" CreationDate="2015-07-02T14:07:26.670" Score="5" ViewCount="642" Body="&lt;p&gt;I inherited a bit of a mess.   And I'm not all that experienced with cabling, so I was hoping to get some advice on where to start when it comes to organizing things.  In the image, patch panels are on top, switches are in the middle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or maybe I should just forget about it since everything is working?  I hate to look at it though.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/ae1Gf.jpg&quot; alt=&quot;My switches&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16327" LastActivityDate="2015-07-02T18:10:07.243" Title="Where should I start when it comes to organizing my switches?" Tags="|switch|cabling|patch-panel|" AnswerCount="2" CommentCount="4" ClosedDate="2015-07-02T19:22:13.227" ContentLicense="CC BY-SA 3.0" />
  <row Id="19632" PostTypeId="2" ParentId="19629" CreationDate="2015-07-02T14:09:40.473" Score="0" Body="&lt;p&gt;I'm having a similar problem running DJBDNS on several Centos 6 systems. I ended up redirecting all lookups for the following domains out to the Fios dns cache server at 71.150.0.12 and now the names resolve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;googleapis.com&#xA;google.com&#xA;googlemail.com&#xA;googleusercontent.com&#xA;gstatic.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Prior to the redirection, all of the lookups done by the caching server were either getting no responses or server failures but manual lookups using dig would resolve. Used tshark to monitor the packet flow to see this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if the following domain is related but it had the same behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;llnwd.net&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the fact that we're using different software, I think the problem must be external but I have no idea what is causing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;update: just had to add youtube.com ytimg.com ggpht.com and google-analytics.com&lt;/p&gt;&#xA;" OwnerUserId="16328" LastEditorUserId="16328" LastEditDate="2015-07-02T14:19:51.207" LastActivityDate="2015-07-02T14:19:51.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19633" PostTypeId="1" CreationDate="2015-07-02T14:39:34.673" Score="1" ViewCount="135" Body="&lt;p&gt;The scenario: I work in a MSP that manages all the IT enviroment of 50 customers. Some customers are full managed by us (servers, network, firewall, etc). Others are partially managed (just the database server or just the web server). We access those clients in different ways, like a SSH, TS, Citrix, VPN client, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we want to do is: Connect to our customers with VPNs site-to-site (using IPSec). We have a Sonicwall firewall that can have up to 80 IPSec tunnels. By doing this, we will be able to use centralized management tools like Puppet, SCCM, logging, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem: We have a range like 192.168.0.0/24. Other customers have this range too. Other 3-5 customers also have a 192.168.1.0/24 range. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the question is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How can we manage this VPN with overlap address? How NAT would help me with this?&lt;/li&gt;&#xA;&lt;li&gt;Is this a good way to work? Do you guys have similar scenarios?&lt;/li&gt;&#xA;&lt;li&gt;If it's not, what could we do? What you guys suggest?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thank you very much!&lt;/p&gt;&#xA;" OwnerUserId="15878" LastEditorUserId="15878" LastEditDate="2015-07-02T14:44:43.537" LastActivityDate="2015-09-30T22:16:22.013" Title="Connecting to our customers with VPNs" Tags="|vpn|nat|sonicwall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19635" PostTypeId="2" ParentId="19633" CreationDate="2015-07-02T16:00:21.507" Score="1" Body="&lt;p&gt;I would start by limiting your exposure to these kinds of conflicts by using a less common RFC 1918 local network. I have rarely seen 172.24.0.0 - 172.31.0.0 used in smaller networks. Most fall in to the 192.168.0.0 range that you have listed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your current predicament Source NAT is really the only viable option with that configuration. You would need to Source NAT your customers overlapping network to an unused internal network. For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.0.0/24 -&gt; Source Nat -&gt; 10.240.0.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0/24 -&gt; Source Nat -&gt; 10.240.1.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an older article that walks through the configuration with a Cisco &lt;a href=&quot;http://www.packetu.com/2012/01/02/asa-vpn-with-address-overlap/&quot; rel=&quot;nofollow&quot;&gt;ASA&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other options but this is pretty standard when you only control one side of the address scheme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Daniel&lt;/p&gt;&#xA;" OwnerUserId="16282" LastActivityDate="2015-07-02T16:00:21.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19636" PostTypeId="2" ParentId="19631" CreationDate="2015-07-02T16:10:46.263" Score="1" Body="&lt;p&gt;If it works don't mess with it, save yourself the headache. Looking at this I sincerely doubt there is any extensive documentation behind it. If I were in your position I would begin planning for the upgrade of this switch stack. You can define your cable color scheme, include cable management, and any other items that you deem important! Save all of this for when the upgrade takes place and then implement it at that time.&lt;/p&gt;&#xA;" OwnerUserId="16282" LastActivityDate="2015-07-02T16:10:46.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19637" PostTypeId="2" ParentId="19629" CreationDate="2015-07-02T16:22:29.827" Score="0" Body="&lt;p&gt;The problem has resolved itself.  Bottom line is that DNS queries from my recursive servers for names associated with Google did not resolve for at least a couple of hours, but only when originating from my FiOS line.  I guess there was a broken route to a required DNS server via Verizon.  I did not bother to packet trace or traceroute, nor was there anything informative in syslog.  It's working now, and I suppose the cause will remain a mystery.&lt;/p&gt;&#xA;" OwnerUserId="16326" LastActivityDate="2015-07-02T16:22:29.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19639" PostTypeId="2" ParentId="19628" CreationDate="2015-07-02T16:38:53.393" Score="2" Body="&lt;p&gt;Don't do either of those. If you need to pass VLANs between the switches then they should be Layer 2 Trunks between the switches. If you need to exchange routing information you should connect P2P links between the switches and have them participate in your routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are all of your Aggregation switches connected in a mesh or are they in a series? What topology has you using 5 - 10 Aggregation switches? If you need this many switches you probably need a bigger switch. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an idea scenario you would have 2 - 4 aggregation switches hosting the SVIs for your local data center. These numbers are fully dependent on the number of downstream switches that are required in each row. Then these aggregation switches would connect up to your core switches via Layer 3 Links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will run in to all sorts of issues if you try to implement what you are describing. Let us know more information about your scenario and we may be able to assist you further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Update-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason the switch models matter is because a detailed design will always be limited by the functionality of the devices that will be implemented. After doing some quick research on the Dell website I see that the S6000 switches are both stack and VLT capable. So here we have two paths to a more flexible and maintainable design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you stack the S6000 switches in the core they will become one switch with multiple modules. (Similar to a chassis switch, see &lt;a href=&quot;https://en.wikipedia.org/wiki/Stackable_switch&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;.) At this point you can configure links from both core switches to each aggregation switch in a non-blocking manner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_Link_Trunking&quot; rel=&quot;nofollow&quot;&gt;VLT&lt;/a&gt; on the S6000 series you are able to configure an LACP Port-Channel from both of the core switches to each of the aggregation switches. They will appear to each aggregation switch as a single switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your goal is to achieve Layer 3 at the &quot;Aggregation&quot; layer that you have described then the stack is your only option. You will not be able to create Layer 3 Port-Channel interfaces using VLT.&lt;/p&gt;&#xA;" OwnerUserId="16282" LastEditorUserId="16282" LastEditDate="2015-07-08T21:35:28.003" LastActivityDate="2015-07-08T21:35:28.003" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="19641" PostTypeId="1" CreationDate="2015-07-02T17:58:06.957" Score="1" ViewCount="2217" Body="&lt;p&gt;We're running PFSense Version: 2.2.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On our LAN the PFSense box is our default gateway, so it goes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;USER PC -&gt; PFSense Box -&gt; Firewall -&gt; Internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've set allow ANY ANY rules on the firewall of the PFSense Box, which we've had to leave enabled because we do traffic shaping on the box. However, something is causing issues when uploading files (small or large) or submitting form data on certain sites, so far all sites are SSL using port 443. For example, uploading to dropbox.com or slack.com does not work, it will sit there and then time out, same with Gmail attachments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is NOTHING in the firewall logs, or any other logs for that matter, which leaves me to believe that it's not the firewall blocking (not to mention the ANY ANY rules), but I've got no idea what other settings I should be looking at to see what could be causing this. If we remove the PFSense box from the equation (make the firewall the default gateway) everything is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any ideas of what I could check out? I did a packet capture, however I'm not too knowledgeable in what to look for, but it looked like all the communication was one way, USER PC -&gt; website, with no replies coming back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: Upon more testing any files smaller then 50kb get uploaded just fine, as soon as you pass that 50kb file size they will not upload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE 2: Attached is a capture of me trying to upload a file to dropbox unsuccessfully: &lt;a href=&quot;https://www.dropbox.com/s/23tjggy5lxzm3nj/dropboxreview.pcapng?dl=0&quot; rel=&quot;nofollow&quot;&gt;https://www.dropbox.com/s/23tjggy5lxzm3nj/dropboxreview.pcapng?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16333" LastEditorUserId="16333" LastEditDate="2015-07-06T14:02:08.640" LastActivityDate="2016-09-30T14:07:33.030" Title="File Uploads to Internet not working with PF Sense as Gateway" Tags="|router|firewall|pfsense|" AnswerCount="2" CommentCount="9" ClosedDate="2019-02-23T00:25:50.067" ContentLicense="CC BY-SA 3.0" />
  <row Id="19642" PostTypeId="2" ParentId="19631" CreationDate="2015-07-02T18:10:07.243" Score="0" Body="&lt;p&gt;If and only if every walljack is patched into a switchport, invest the time in cleaning up the cabling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a subset of walljacks are patched in, do not invest the time to clean it up as you will end up having to unplug and move cables among the patch panel and switch ports.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-02T18:10:07.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19644" PostTypeId="2" ParentId="19641" CreationDate="2015-07-02T18:59:29.213" Score="1" Body="&lt;p&gt;Have you done any captures on your client machines that you are testing with? That is the first place that I would start. Is other non-encrypted traffic working?&lt;/p&gt;&#xA;" OwnerUserId="16282" LastActivityDate="2015-07-02T18:59:29.213" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19645" PostTypeId="1" CreationDate="2015-07-02T19:00:04.250" Score="2" ViewCount="1415" Body="&lt;p&gt;I will have a routed network with both public and private subnets routed with OSPF. There will be two core routers that both have a default route to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is how I make sure that no traffic with a private src-addr is routed outside my OSPF-area and also how I NAT this traffic. My idea right now is to have a specific NAT-router set up in the network and then do policy based routing on the core routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;We are using L3 switches of different brands. The aggregation layer is mostly HP5400 and the core layer will be Dell S6000-ON. In the diagram you can see a simplyfied picture of our network. Right now we plan to have a dedicated NAT router (probably a linux machine) which lives on both private and public adresses to which we direct traffic from the core switches with PBR&#xA;&lt;img src=&quot;https://i.stack.imgur.com/auifK.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16331" LastEditorUserId="16331" LastEditDate="2015-07-03T07:29:12.813" LastActivityDate="2016-09-02T15:44:40.460" Title="Private and Public IPs in the same OSPF area" Tags="|nat|ospf|pbr|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19646" PostTypeId="1" AcceptedAnswerId="19758" CreationDate="2015-07-02T19:38:42.113" Score="0" ViewCount="2309" Body="&lt;p&gt;I would like to make a presence detection application which would be able to detect when a known device connects to the local Wifi network.&#xA;So basically I would know the MAC address of the device, but the IP is dynamically assigned so it can change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I can only rely on the known MAC to determine if the device is here or not, how can I do that ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have thought about one possibility :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;do a broadcast ping on my network (ping the 255 possibly IPs).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;then do a arp request and look into the ARP table and try to find the&#xA;known MAC&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if I find it, the device is here and I can see the IP, if      the&#xA;MAC is not there then the device is not on the network&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This could possibly work but it is not smart and requiers a permanent ping broadcast which can be slow in some cases according to my experiments. And it would not be energy efficient as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am from Electrical Engineering and don't have a huge background into networks, so please pardon my maybe dumb question.&#xA;Hope somebody will be wiling to help me :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="16335" LastEditorUserId="33" LastEditDate="2015-07-02T20:11:55.530" LastActivityDate="2021-04-13T05:31:34.550" Title="How to detect the presence of a known MAC address on the .local ? (and get IP)" Tags="|mac-address|ip|ip-link-local|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="19647" PostTypeId="2" ParentId="19633" CreationDate="2015-07-02T19:57:20.040" Score="1" Body="&lt;p&gt;I agree with Daniel here. The best way to stay out of these kind of conflicts is to use a less common private ip range. I tend to use ranges from 172.16.0.0/12&lt;/p&gt;&#xA;" OwnerUserId="16331" LastActivityDate="2015-07-02T19:57:20.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19648" PostTypeId="5" CreationDate="2015-07-02T20:11:18.083" Score="0" Body="" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-07-02T20:11:18.083" LastActivityDate="2015-07-02T20:11:18.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19649" PostTypeId="4" CreationDate="2015-07-02T20:11:18.083" Score="0" Body="Not to be confused with mac-address tag, Media Access Control is a sublayer of the OSI data link layer that provides addressing and channel access control mechanisms. It resides between the LLC sublayer and the physical layer." OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-07-02T20:11:18.083" LastActivityDate="2015-07-02T20:11:18.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19651" PostTypeId="2" ParentId="18912" CreationDate="2015-07-02T20:58:29.673" Score="1" Body="&lt;p&gt;We advertised a default originate out of our home location to the remote sites. As long as the carrier is advertising routes, the routes will be preferred from the mpls branches. &lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-07-02T20:58:29.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19652" PostTypeId="2" ParentId="19646" CreationDate="2015-07-02T21:37:07.867" Score="0" Body="&lt;p&gt;The simplest, passive method would be listen to ARP traffic (broadcast) to detect when a device is on the network. A more involved method would be to add some form of &quot;agent&quot; on the AP to be notified of all associations/disassociations. If you're using DHCP, you could watch there as well.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-02T21:37:07.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19654" PostTypeId="2" ParentId="19596" CreationDate="2015-07-02T22:27:46.373" Score="0" Body="&lt;p&gt;I wouldn't use powerlines for business network..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use wifi for what you can, even the usb sticks for the desktops. Place the server near the router and run cable and if you really have to, run long cables, as out-of-the-way as much as you can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is the quick solution. eventually run cable properly throughtout the building.&lt;/p&gt;&#xA;" OwnerUserId="16338" LastActivityDate="2015-07-02T22:27:46.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19659" PostTypeId="1" AcceptedAnswerId="19660" CreationDate="2015-07-03T03:12:56.817" Score="1" ViewCount="831" Body="&lt;p&gt;When I request a A record for a domain, eg: &lt;code&gt;host google.com&lt;/code&gt; and display packets by tcpdump. I notice that my system also requested a PTR record for DNS nameserver (8.8.8.8 in this case). &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;09:53:42.775298 IP markstevens-Linux-System.local.9455 &amp;gt; google-public-dns-a.google.com.domain: 43173+ A? google.com. (28)&#xA;09:53:42.775318 IP markstevens-Linux-System.local.9455 &amp;gt; google-public-dns-b.google.com.domain: 43173+ A? google.com. (28)&#xA;09:53:42.775910 IP markstevens-Linux-System.local.51957 &amp;gt; google-public-dns-a.google.com.domain: 59481+ PTR? 8.8.8.8.in-addr.arpa. (38)&#xA;09:53:42.871087 IP google-public-dns-a.google.com.domain &amp;gt; markstevens-Linux-System.local.9455: 43173 12/0/0 A 113.171.252.231, A 113.171.252.210, A 113.171.252.217, A 113.171.252.251, A 113.171.252.223, A 113.171.252.238, A 113.171.252.245, A 113.171.252.230, A 113.171.252.244, A 113.171.252.237, A 113.171.252.216, A 113.171.252.224 (220)&#xA;09:53:42.871781 IP markstevens-Linux-System.local.11540 &amp;gt; google-public-dns-a.google.com.domain: 30293+ AAAA? google.com. (28)&#xA;09:53:42.877560 IP google-public-dns-a.google.com.domain &amp;gt; markstevens-Linux-System.local.51957: 59481 1/0/0 PTR google-public-dns-a.google.com. (82)&#xA;09:53:42.877843 IP markstevens-Linux-System.local.49496 &amp;gt; google-public-dns-a.google.com.domain: 34137+ PTR? 2.1.168.192.in-addr.arpa. (42)&#xA;09:53:42.880061 IP google-public-dns-b.google.com.domain &amp;gt; markstevens-Linux-System.local.9455: 43173 16/0/0 A 113.171.246.104, A 113.171.246.123, A 113.171.246.118, A 113.171.246.109, A 113.171.246.84, A 113.171.246.93, A 113.171.246.88, A 113.171.246.119, A 113.171.246.114, A 113.171.246.94, A 113.171.246.103, A 113.171.246.108, A 113.171.246.98, A 113.171.246.99, A 113.171.246.89, A 113.171.246.113 (284)&#xA;09:53:42.969118 IP google-public-dns-a.google.com.domain &amp;gt; markstevens-Linux-System.local.11540: 30293 1/0/0 AAAA 2404:6800:4005:809::200e (56)&#xA;09:53:42.969505 IP markstevens-Linux-System.local.16015 &amp;gt; google-public-dns-a.google.com.domain: 5941+ MX? google.com. (28)&#xA;09:53:42.975088 IP google-public-dns-a.google.com.domain &amp;gt; markstevens-Linux-System.local.49496: 34137 NXDomain 0/0/0 (42)&#xA;09:53:43.075493 IP google-public-dns-a.google.com.domain &amp;gt; markstevens-Linux-System.local.16015: 5941 5/0/0 MX alt4.aspmx.l.google.com. 50, MX aspmx.l.google.com. 10, MX alt3.aspmx.l.google.com. 40, MX alt1.aspmx.l.google.com. 20, MX alt2.aspmx.l.google.com. 30 (136)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to ask why it must requests a PTR request for DNS nameserver when It could sends a request to exact nameserver before (two first lines) as I configure in network-manager. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/rdYmg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Addition, in dumpfile, I notice that my system also requested a PTR record for my local IP (192.168.1.2), why it requests that? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;09:53:42.877843 IP markstevens-Linux-System.local.49496 &amp;gt; google-public-dns-a.google.com.domain: 34137+ PTR? 2.1.168.192.in-addr.arpa. (42)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;thanks for reading !&lt;/p&gt;&#xA;" OwnerUserId="16341" LastActivityDate="2015-07-03T03:31:18.823" Title="Request a PTR record for google DNS (8.8.8.8)" Tags="|ip|network-discovery|tcpdump|" AnswerCount="1" CommentCount="1" ClosedDate="2015-07-06T18:32:56.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="19660" PostTypeId="2" ParentId="19659" CreationDate="2015-07-03T03:31:18.823" Score="3" Body="&lt;p&gt;Given that tcpdump is printing host names, you didn't run it with the &lt;code&gt;-n&lt;/code&gt; flag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, it tries to resolve the source and destination IP addresses of packets when it prints them - and, as it's printing host names, it succeeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to do that, it calls routines that...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I want to ask why it must requests a PTR request for DNS nameserver&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;I notice that my system also requested a PTR record for my local IP (192.168.1.2)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;...send out PTR requests for the IP addresses in question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I.e., the &quot;it&quot; that's requesting that is tcpdump, and it's doing so because you ran it without the &lt;code&gt;-n&lt;/code&gt; flag and it's seeing network traffic to or from 8.8.8.8 and traffic to or from 192.168.1.2.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2015-07-03T03:31:18.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19664" PostTypeId="1" AcceptedAnswerId="19667" CreationDate="2015-07-03T08:13:44.630" Score="1" ViewCount="888" Body="&lt;p&gt;I've configured an IPSec VPN on an ASA 5505 with the mind that all traffic (besides http/s) has to go through this VPN to access the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also allowed tcp/3389 to pass through the VPN and in doing this, I can connect to 192.168.1.2 using Window's remote desktop client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I configure tcp/ftp and tcp/ftp-data in the same way, I'm still unable to connect to 192.168.1.2 with FileZilla.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any special steps I need to take to configure FTP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: I'm using ASDM&lt;/p&gt;&#xA;" OwnerUserId="16343" LastActivityDate="2015-10-31T13:20:38.430" Title="How to configure FTP over VPN on an ASA 5505?" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19666" PostTypeId="2" ParentId="16438" CreationDate="2015-07-03T10:15:16.843" Score="6" Body="&lt;p&gt;I would like to add one benefit with fiber connections. Consider a connection between two buildings with different ground potential. If you where to use copper in this situation you could end up with current leakage and possibly a dangerous situation. This is not the case with fiber because it isn't a conductor.&lt;/p&gt;&#xA;" OwnerUserId="16331" LastActivityDate="2015-07-03T10:15:16.843" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19667" PostTypeId="2" ParentId="19664" CreationDate="2015-07-03T10:33:54.640" Score="0" Body="&lt;p&gt;It turns out the ASA was configured correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used the packet trace tool to determine where it was falling over. It's some quirk in IIS. FileZilla Server worked fine though once it was configured for passive mode.&lt;/p&gt;&#xA;" OwnerUserId="16343" LastActivityDate="2015-07-03T10:33:54.640" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19668" PostTypeId="1" CreationDate="2015-07-03T12:06:34.833" Score="1" ViewCount="1761" Body="&lt;p&gt;Related to my other questions: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/19628/designing-ospf-mesh-network&quot;&gt;Designing OSPF mesh network&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/19645/private-and-public-ips-in-the-same-ospf-area&quot;&gt;Private and Public IPs in the same OSPF area&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is you opinion on having both the private ip subnets and the public ip subnets on the same vlan? (and thus removing the need for vlans at the access-layer, only needing two IP-addresses on the same interface of a certain host). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the two situations to the left and right in this picture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/kXyuC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16331" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-07-03T14:28:51.287" Title="Multiple ip ranges on single subnet" Tags="|routing|vlan|design|switching|" AnswerCount="2" CommentCount="3" ClosedDate="2015-07-06T18:19:16.683" ContentLicense="CC BY-SA 3.0" />
  <row Id="19670" PostTypeId="2" ParentId="19668" CreationDate="2015-07-03T13:25:37.110" Score="1" Body="&lt;p&gt;Having two IP's on a host on the same interface is never a good idea.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;When sending packets out which IP will be used as source ip ? &lt;/li&gt;&#xA;&lt;li&gt;What if 172.x is used for talking to the internet ? &lt;/li&gt;&#xA;&lt;li&gt;When using the wrong src/dst combination for local traffic it needs &#xA;to hairpin through a l3/router.&lt;/li&gt;&#xA;&lt;li&gt;DHCP will not be a option any more, so only applicable to a very small setup.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A better/standard approach is to use private ip's 10/8, 172.16/12 for the host IP's, then on the upstream router do a 1 to 1 nat to the public IP, for outgoing and incoming traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you then ever change ISP and get new public IP's is simple to change them in one place.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-03T13:25:37.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19672" PostTypeId="2" ParentId="7629" CreationDate="2015-07-03T14:19:48.887" Score="1" Body="&lt;h2&gt;Technically there is not a direct link between VLAN and Subnet.&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Assume I have 10 big offices.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think this may be the confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have offices connected with routers, the traffic flows through a L3 device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two network's on different sides of a L3 device is on different VLAN's(Physical) networks.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They may have the same vlan ID but they are not the same vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this was not the case every vlan in every company in the world would be the same vlan if they had the same vlan ID.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-03T14:19:48.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19673" PostTypeId="2" ParentId="19668" CreationDate="2015-07-03T14:28:51.287" Score="0" Body="&lt;h2&gt;Only ease of use deployment, no control over router, no separation&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Use public ip's, (only public ip, no private ip) on hosts that need them. Statical configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use private 172.x private IP's on the rest of the hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routing between public and private can then be done by a L3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ask the provider that manages the router to only nat/hide the private IP's when they leave for the internet, but let the public ip's straight through.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-03T14:28:51.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19674" PostTypeId="2" ParentId="13266" CreationDate="2015-07-03T14:44:01.940" Score="3" Body="&lt;p&gt;When you specify &quot;-s 1490&quot; you set size of ICMP packet to 1490 bytes. Then the IP stack of your system adds ICMP and IP headers which equals to 28 bytes. So in this case while specifying size of 1490 bytes in fact your system tries to send IP packet of size 1490 + 28 = 1518 bytes. I assume that your PC has MTU 1500 on interface and as you already prohibited your system doing fragmentation it reports to you that packet is too big to be sent through interface with lower MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your attempt of checking server's MTU size. Because of concerns above you will not be able to send IP packet bigger than 1500 bytes, so if server has higher MTU you won't be able to find this out from this PC. &lt;/p&gt;&#xA;" OwnerUserId="16345" LastEditorUserId="16370" LastEditDate="2015-07-06T07:57:46.857" LastActivityDate="2015-07-06T07:57:46.857" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19676" PostTypeId="2" ParentId="16204" CreationDate="2015-07-03T20:15:04.180" Score="1" Body="&lt;p&gt;So we got CenterHubx1-&gt;RegionHubx5-&gt;Spokesx4-&gt;Computer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer pings -&gt; Hub ,&#xA;does nhrp lookup on Spoke, set's up new tunnel to CenterHub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem Spoke vpn in subnet 172.16.1/24 and Hub 172.16.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Spoke should not try to setup the direct connection to the CenterHub, only to other spokes of it's RegionHub &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To prevent this &lt;strong&gt;use different NHRP network-id&lt;/strong&gt;'s for different tunnel subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;NHRP network ID is used to define the NHRP domain for an NHRP&#xA;  interface&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-03T20:15:04.180" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19677" PostTypeId="2" ParentId="19645" CreationDate="2015-07-03T20:36:22.517" Score="1" Body="&lt;p&gt;Core Switch is ON -&gt; Open network, i would guess they run Cumulus Operating system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just do the Nat on the L3 core switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Match private IP's leaving for the Upstream router and nat them as required.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-03T20:36:22.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19678" PostTypeId="1" CreationDate="2015-07-03T20:59:31.817" Score="2" ViewCount="413" Body="&lt;p&gt;I need to do RFC2544 tests of about 70 links, in different locations, before July ends and I only have about 11 JDSUs, so for some of this tests I won't have 2 JDSU available where I need them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to emulate the behaviour of the JDSU working as a loopback with a Cisco router and do the test with only one JDSU?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could use C1921 or get a couple of 2900/3900 series if required.&lt;/p&gt;&#xA;" OwnerUserId="16350" LastEditorUserId="21926" LastEditDate="2016-01-16T16:31:54.140" LastActivityDate="2016-01-16T16:31:54.140" Title="Can I do an RFC2544 test with a JDSU SmartClass Ethernet and a C1921?" Tags="|cisco|throughput|metro-ethernet|rfc|" AnswerCount="0" CommentCount="0" ClosedDate="2019-12-20T00:19:07.690" ContentLicense="CC BY-SA 3.0" />
  <row Id="19683" PostTypeId="1" CreationDate="2015-07-04T05:35:01.263" Score="2" ViewCount="5849" Body="&lt;p&gt;I just start on Juniper 's world, However, I stuck at begin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I run Junos on GNS3 with very  simple topology like &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Junos1-me0)----------------------(me0-Junos2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Junos1: set interfaces me0 unit 0 family inet address 10.10.10.1/30&#xA;Junos2: set interfaces me0 unit 0 family inet address 10.10.10.2/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Junos1: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root&amp;gt; show interfaces terse&#xA;&#xA;Interface               Admin Link Proto    Local                 Remote&#xA;&#xA;cbp0                    up    up&#xA;demux0                  up    up&#xA;dsc                     up    up&#xA;em0                     up    up    &amp;lt;&amp;lt;// There is no em0.0 and protocol field&#xA;em1                     up    down&#xA;em2                     up    down&#xA;em3                     up    down&#xA;em4                     up    down&#xA;em5                     up    down&#xA;gre                     up    up&#xA;ipip                    up    up&#xA;irb                     up    up&#xA;lo0                     up    up&#xA;lo0.16384               up    up   inet     127.0.0.1           --&amp;gt; 0/0&#xA;lo0.16385               up    up   inet     128.0.0.4           --&amp;gt; 0/0&#xA;                                   inet6    fe80::a00:270f:fc83:f167&#xA;lsi                     up    up&#xA;mtun                    up    up&#xA;pimd                    up    up&#xA;pime                    up    up&#xA;pip0                    up    up&#xA;pp0                     up    up&#xA;tap                     up    up&#xA;&#xA;Junos2: &#xA;&#xA;root&amp;gt; show interfaces terse&#xA;Interface               Admin Link Proto    Local                 Remote&#xA;cbp0                    up    up&#xA;demux0                  up    up&#xA;dsc                     up    up&#xA;em0                     up    up    &amp;lt;&amp;lt;// There is no em0.0 and protocol field&#xA;em1                     up    up&#xA;em2                     up    down&#xA;em3                     up    down&#xA;em4                     up    down&#xA;em5                     up    down&#xA;gre                     up    up&#xA;ipip                    up    up&#xA;irb                     up    up&#xA;lo0                     up    up&#xA;lo0.16384               up    up   inet     127.0.0.1           --&amp;gt; 0/0&#xA;lo0.16385               up    up   inet     128.0.0.4           --&amp;gt; 0/0&#xA;                                   inet6    fe80::a00:270f:fc37:7cc4&#xA;lsi                     up    up&#xA;mtun                    up    up&#xA;pimd                    up    up&#xA;pime                    up    up&#xA;pip0                    up    up&#xA;pp0                     up    up&#xA;tap                     up    up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can not ping p2p, The result as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Junos1&amp;gt; ping 10.10.10.2&#xA;PING 10.10.10.2 (10.10.10.2): 56 data bytes&#xA;ping: sendto: Can't assign requested address&#xA;ping: sendto: Can't assign requested address&#xA;ping: sendto: Can't assign requested address&#xA;^C&#xA;--- 10.10.10.2 ping statistics ---&#xA;3 packets transmitted, 0 packets received, 100% packet loss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, I tried to assign the other unit on the me0 interface, but it fail, The system info &quot;Can not&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone can help me fix this issue? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no route table on router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root&amp;gt; show route table ?&#xA;Possible completions:&#xA;  &amp;lt;table&amp;gt;              Name of routing table&#xA;&#xA;&#xA;&#xA; root&amp;gt; show route table inet.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank in advance&lt;/p&gt;&#xA;" OwnerUserId="13751" LastActivityDate="2015-07-04T14:07:48.080" Title="Juniper begin: Can't assign protocol inet and ping point2point" Tags="|juniper-junos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19685" PostTypeId="2" ParentId="19604" CreationDate="2015-07-04T08:41:04.490" Score="1" Body="&lt;p&gt;From a &lt;em&gt;networking perspective&lt;/em&gt;, the app that requires access only from your reverse proxy should ideally be running on a system (internal subnet/vlan) not accessible from the Internet directly.  In fact, my preference would be to have &lt;strong&gt;all the apps behind the load balancer&lt;/strong&gt; so that there is no direct path to the servers.  If the app is tied to the code base used for all apps, you might be able to duplicate all the apps on an internal system that effectively only runs the SSO site (since it only receives those requests from the reverse proxy) and somehow render the SSO-site on the directly accessible system useless.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another viable solution is to have an ACL on the site so that only the load-balancer can make requests to the app.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A solution not viable from a security POV would be to have public and private subnets mixed on your web host for handling your two use-cases.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-07-04T08:41:04.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19686" PostTypeId="2" ParentId="10070" CreationDate="2015-07-04T09:36:14.207" Score="3" Body="&lt;p&gt;First the bad news; as a fiber network engineer for the last 20 years and a technician for 10 before that, hearing these comments and answers is painful, and a bit frustrating. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should be a clue that either a lot more research and investigation needs to be done, or hire someone to do it that knows what is going on. This is assuming the network you are talking about campus LAN or bigger.  Anything smaller and the installation cost to do anything with fiber will always outweigh the overall  benefit with regards to both performance or budget. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone mentioned DWDM? DWDM is strictly carrier class, long haul, single-mode fiber (and a very specific type of single-mode fiber at that), and more complicated than newcomers will conceive of, before thinking your gonna whip up this DWDM network. I highly doubt the network in which this person is asking advice about comes close the required performance of DWDM equipment (and correct fiber specs), I say that because if it was, he would never need to ask any of these questions and would rather be already very knowledgeable about fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is truly an instance where it is almost necessary that you know as much about installing the fiber, splicing it, terminating it, and testing it, as the vendor you will hire to do this work. The install, configuration, and turn up of the equipment isn't even practical to get involved with to deep, it takes years of experience installing and troubleshooting these systems to do it right, and right the first time. and if you really want to install some fiber or build your fiber network as you said, you can do this yourself with not a fraction of the fiber knowledge needed for wan, metro, long haul, and sub-oceanic systems. there really isn't a lot of trouble you can get into. Install a 6 or 12 strand single-mode fiber optic cable between every switch, hub and router in your network. direct terminate sc connectors or splice sc pigtails to each fiber strand in a mounted fiber panel and test. this work you will need to hire a vendor for. You design, purchase and install new switches or other equipment your replacing, and turn up the new service all yourself very, very, easily. 6-12 strand fiber cables are very easy and usually done very well (ie., the polish, the quality of test results, etc). not a lot of babysitting of fiber technicians to make absolutely sure they are installing the correct equipment at the this level is what I'm getting at. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not like your doing a live mid-sheath splice on a 120 strand fiber cable working off a detailed splice schematic put together well before your planned event network outage, counting on it being created and printed correctly. these are typical tasks on systems requiring anything like DWDM or larger networks. anyway best of luck and take my advice, my take on it here wont differ much between anyone that really knows what they're doing with fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've worked on every phase of just about the most technically advanced fiber networks that are in service today; as well as design from small campus LAN to extended long haul networks covering the united states and sub-oceanic systems.  To some it up in one sentence I would say if it is a small network in physical size (single building or one level), short distances between switches and hubs, and satisfactory reports from end users with regards to speed, then don't worry about fiber; stick with copper and wireless and put the money somewhere else. like network documentation software, and maps where it will help tremendously during future localized network outages!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If its that larger metro or campus network, then just hire someone to do the fiber. your only job here is to get that deeper knowledge of fiber and manage the vendors. Once again, its only in the case your network is reasonably small, along with the stubborn idea that you absolutely must have fiber for the this small network that I tell you just go ahead its safe to do it yourself.&lt;/p&gt;&#xA;" OwnerUserId="16358" LastEditorUserId="775" LastEditDate="2015-07-04T11:42:35.303" LastActivityDate="2015-07-04T11:42:35.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19688" PostTypeId="2" ParentId="6301" CreationDate="2015-07-04T12:38:22.417" Score="5" Body="&lt;h1&gt;Change the L2 links to L3 for the offices. ( Get help if needed)&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;This will prevent one of the uplinks to the offices blocking and provide double the bandwidth. (Assuming that there is a link from each DC the same size)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There is no chance of a spanning tree loop at a branch affecting the DC's&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Broadcasts from any device on any site does not travel to all the ports on all the sites using the same vlan.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Traceroute will actually show the path packets are taking through your network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you do have problems with a spanning-tree loop, it will be localized to a single site.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Problem: Branch camera vlan protected by firewall&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;As vlan's will end at branch a new solution need to be implemented for the camera vlan, here is a couple of options&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Small FW at each branch&lt;/li&gt;&#xA;&lt;li&gt;ACL on Cam vlan only allowing cam IP's to talk to FW and subnet behind FW&lt;/li&gt;&#xA;&lt;li&gt;More exotic options, GRE, MPLS, vrf-light&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2019-04-03T03:24:03.240" LastActivityDate="2019-04-03T03:24:03.240" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19689" PostTypeId="2" ParentId="18948" CreationDate="2015-07-04T12:40:50.723" Score="1" Body="&lt;p&gt;Based on the rule you posted, it only applies to packets coming from &lt;code&gt;ether1-gateway&lt;/code&gt;. Which means that Mikrotik will never port-forward your packets when they are coming from your LAN (assuming it's on a different interface).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the problem is that even if you change the rule to also apply to packets coming from your LAN, it still wouldn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say your workstation IP is &lt;code&gt;192.168.1.200&lt;/code&gt; and you make a request to &lt;code&gt;svn.mydomain.com:5555&lt;/code&gt;. That means that svn.mydomain.com will resolve to your public IP (assuming that this IP is &lt;strong&gt;on&lt;/strong&gt; the mikrotik itself) and the request packets will leave your workstation with a source address of &lt;code&gt;192.168.1.200&lt;/code&gt; and a destination address &lt;code&gt;your public ip&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now Mikrotik will match those packets and try to port-forward them to &lt;code&gt;192.168.1.111:443&lt;/code&gt;.&lt;br&gt;&#xA;&lt;code&gt;192.168.1.111&lt;/code&gt; will happily accept then packets, process them and then send a reply to the source address &lt;code&gt;192.168.1.200&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here starts the problem. Your workstation send the packets to your public IP, but the replies are coming from an 'unknown' IP (as far as your workstation is concerned) thus it simply drops them.&lt;br&gt;&#xA;What you need is the packets coming back from the public IP not &lt;code&gt;192.168.1.111&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in order for this to work you need to add an extra src-nat rule &lt;em&gt;after&lt;/em&gt; the one you already made on your mikrotik that will match and do the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;If&lt;/strong&gt; the source address is your LAN subnet   &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;And&lt;/strong&gt; the destination address and port are 192.168.1.111:443&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Then&lt;/strong&gt; do a src-nat and set the IP address to the Mikrotik's address (say for example &lt;code&gt;192.168.1.1&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This way the SVN server will send the replies back to mikrotik and Mikrotik will send the replies back to your workstation with the public IP as the source address and everything should work ok.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now take into consideration that with this method, all the requests coming to the SVN server from your LAN will have the source IP of Mikrotik instead of the actual PC that made the request. So all the logs will only show Mikrotik's IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your setup and amount of users this might not work for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So another approach would be to simply add on your hosts file the following:&lt;br&gt;&#xA;&lt;code&gt;192.168.1.111 svn.mydomain.com&lt;/code&gt; and reconfigure your SVN server to also listen to port 5555.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or if your LAN uses Mikrotik as the DNS server you could simple add a static dns record on Mikrotik (&lt;code&gt;/ip dns static&lt;/code&gt;) so that every PC on your LAN would resolve svn.mydomain.com to the internal IP while everyone else outside your LAN will resolve to the public IP as before.&lt;/p&gt;&#xA;" OwnerUserId="1418" LastActivityDate="2015-07-04T12:40:50.723" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19690" PostTypeId="2" ParentId="16351" CreationDate="2015-07-04T13:08:39.327" Score="1" Body="&lt;p&gt;I prefer scenario 2, extend area 0 into the branch, and then stub area into branch to l3 switch for vlan routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Making the branch router ABR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason is that we need high availability for the branches, with a couple of redundant links from different providers, as well as 3G, and dial-up backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bigger branches also have dual routers to cater for a router failure, here we do provision a area 0 link between the routers, using a vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Allowing Area 0 up to the edge of the branch allows for better routing decisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are also able to deploy links between branches that are close together, using the area 0 interface on each branch router, this would not be possible if each branch was in a different area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dialup / DMVPN etc also causes problems if the branches routers are only in a area &gt;1  as the central router now needs to have the template/mutipoint-gre in more than one area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Summary:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the WAN should be in area 0, if the wan is not extremely simple/standard with just one or two links to each site.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-04T13:08:39.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19691" PostTypeId="2" ParentId="19683" CreationDate="2015-07-04T14:07:48.080" Score="1" Body="&lt;p&gt;Which interfaces did you link in GNS3?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually the em interfaces are used. You won't have unit 0 defined by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Move your interfaces from me0 to em0 on the respective devices. This is assuming that your GNS3 links are setup to map em0 on both devices as a connected link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;set interface em0 unit 0 family inet address x.x.x.x/x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually with Junos Olive\GNS3 you will not use ME0... the only interfaces that should be used are emX or fxpX depending on what kind of emulated interface you're using. Ideally if you use Intel Pro MT series then emX interfaces will appear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have no active interfaces or routes then no table will exist, default Junos behaviour.&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2015-07-04T14:07:48.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19692" PostTypeId="2" ParentId="16351" CreationDate="2015-07-04T14:59:41.067" Score="1" Body="&lt;p&gt;Scenario 1 would be better in this case since WAN bandwidth will be reduced by a bit and and R2 would be spared of spending its resources if it would be an ABR (scenario 2).&lt;/p&gt;&#xA;" OwnerUserId="16363" LastActivityDate="2015-07-04T14:59:41.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19696" PostTypeId="2" ParentId="13266" CreationDate="2015-07-05T07:06:14.490" Score="13" Body="&lt;p&gt;Running &quot;ping -M do -s 1490 example.com&quot; says that the ICMP data size is 1490 bytes and fragmentation is not allowed. For this size of ICMP data, ICMP size (i.e., header + data) is 1498 bytes. Adding IP header, frame size becomes 1518 bytes. Frame size can't exceed MTU size of the interface. As from the error message, MTU for the interface is 1500 bytes. So, there are extra 18 bytes in the frame. Without fragmentation, this message can't be sent. Since fragmentation is not allowed, ping fails saying message is too long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't need remote server's MTU size. In networking, MTU sizes are needed only for the next hop (unless the destination is the next hop). Reading &lt;a href=&quot;https://en.wikipedia.org/wiki/IP_fragmentation&quot; rel=&quot;noreferrer&quot;&gt;https://en.wikipedia.org/wiki/IP_fragmentation&lt;/a&gt; helps.&lt;/p&gt;&#xA;" OwnerUserId="16370" LastActivityDate="2015-07-05T07:06:14.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19701" PostTypeId="1" CreationDate="2015-07-05T18:45:54.137" Score="3" ViewCount="135" Body="&lt;p&gt;I'm studying basics of inter-datacenter network. &#xA;I know the ECMP idea and it's popular to combine ECMP and MPLS. &#xA;I want to know the motivation of load-balancing all the LSPs. &#xA;I think the reason is that evenly splitting the traffic to the LSPs will minimum the network congestion. &#xA;But if assume we have a central controller for TE, will it be better that we use uneven bandwidth for the LSPs such that we can globally optimize the whole network traffic?&lt;/p&gt;&#xA;" OwnerUserId="16380" LastActivityDate="2016-06-06T01:58:56.550" Title="Why we need traffic be evenly distributed to LSPs in MPLS-TE?" Tags="|mpls|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19702" PostTypeId="2" ParentId="13206" CreationDate="2015-07-05T19:30:30.560" Score="0" Body="&lt;p&gt;Im not sure this is exactly what you're after but where I work we have a physically separate color coded network for management which is connected to every machine in the network. The layout is pretty parallell to our &quot;regular&quot; network, just slower bandwidth. The problem with switches is that many of them don't have a dedicated management port but you can always dedicate e.g. port 1 on every switch for management. Servers is easy because they all have a mgt-port so we just have a second network in parallell.&lt;/p&gt;&#xA;" OwnerUserId="16331" LastActivityDate="2015-07-05T19:30:30.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19703" PostTypeId="1" CreationDate="2015-07-05T19:30:54.377" Score="3" ViewCount="1669" Body="&lt;p&gt;Ok, lets try again. It seems Im having problem asking the right questions so lets take it from the beginning. I work at a HPC center at a university. We have a number of small (&amp;lt;300 nodes) clusters and a few storage systems. To our site we get a statically routed /22 network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today we have the whole /22 in a single broadcast domain and we have decided to redesign and renumber the network for better scalability and performance. To do this we have bought two new L3 switches (Dell s6000-on) to use as our backbone. Connected to these we will have the aggregation switches of the individual clusters (which are HP 5400) and it will look something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/hdjDv.png&quot; alt=&quot;Network layout&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we want to renumber the hosts with private IP-adresses (one net per cluster) and use OSPF internally, to reach the internet we still use a default route to some central university router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One important thing is that we still need to have some hosts with public IPs reachable from the internet (a few login nodes per cluster and some other services).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;My first question has to do with the links between Core and aggregation. I could use MC-LAG (Dell VLT), Stacking or just OSPF everywhere.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;With MC-LAG I can have all links on the same vlan and its very easy to have other vlans span the whole network&lt;/li&gt;&#xA;&lt;li&gt;But it feels to me that ptp-links and OSPF eclb is more robust and scalable.&lt;/li&gt;&#xA;&lt;li&gt;Or I can use switch stacking which gives me a virtual chassi and get rid of the need for MC-LAG. But I don't really trust the stability of such a technique.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The machines on private IP-adresses still need internet, so I want to NAT them out. But our new core switches doesn't support NAT (as far as I know) so we are setting up a NAT-router on the side. Is there some smart way in OSPF to redirect traffic from privates IPs to the nat-router? Or should I use PBR?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do you have any solution for the public IPs? They are sort of scattered throughout the datacenter so there is not a single access point for these machines. It would be very helpful to have a large vlan with a /24 or so that spanned the whole network, see question 1. But maybe the best way is to just split up the network into smaller ones and route them with OSPF as needed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Some of you say its a bad idea to have both public and private IPs in the same OSPF area. If this is so, what do you think we should do instead?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I hope this makes it more clear what Im after. Please feel free to ask for clarifications&lt;/p&gt;&#xA;" OwnerUserId="16331" LastEditorUserId="16331" LastEditDate="2015-07-09T20:30:30.870" LastActivityDate="2015-07-09T20:30:30.870" Title="How to design a good (small) OSPF network" Tags="|routing|switch|nat|ospf|pbr|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19705" PostTypeId="2" ParentId="19703" CreationDate="2015-07-05T20:12:22.480" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;My first question has to do with the links between Core and&#xA;aggregation. I could use MC-LAG or pure OSPF. With MC-LAG I can have&#xA;all links on the same vlan and its very easy to have other vlans&#xA;span the whole network, but on the other hand, it feels to me that&#xA;ptp-links and OSPF eclb is more robust and scalable.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Go for ospf L3 links, better stability, and scales better, easier to monitor and trouble shoot.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;The machines on private IP-adresses still need internet, so I want&#xA;to NAT them out. But our new core switches doesn't support NAT (as&#xA;far as I know) so we are setting up a NAT-router on the side. Is&#xA;there some smart way in OSPF to redirect traffic from privates IPs&#xA;to the nat-router? Or should I use PBR?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Opt1: PBR - is messy, and hard to maintain, single nat device is single point of failure.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Opt2: central NAT on outgoing university router&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Opt3: get two routers/firewalls/devices that can sit between your core switch and the University network that can do the NAT for you&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Do you have any solution for the public IPs? They are sort of&#xA;scattered throughout the datacenter so there is not a single access&#xA;point for these machines. It would be very helpful to have a large&#xA;vlan with a /24 or so that spanned the whole network, see question&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;With the L3 recommended option, there can be smaller public IP vlan/subnets in each area.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;take your public /22 and subnet with /28(64net x 14hosts) or /26(16Net x 64hosts) each, then have a vlan in each cluster for public IP machines. Also easier to filter/protect in future&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But maybe the best way is to just split up the network into smaller ones and route them with OSPF as needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Agreed&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Some of you say its a bad idea to have both public and private IPs&#xA;in the same OSPF area. If this is so, what do you think we should do&#xA;instead?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This comes from a corporate mindset where security is high on the priority list if not on top.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In corporates NO external access is allowed to internal machines,  all public facing/accessible machines are in a DMZ behind FW controlling inside and outside access.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Access to internal machines would be provided to staff through a 2 factor authenticated VPN link in most cases, no need for public IP's on internal machines.&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you opt for the recommended NAT capable devices between core and rest of Campus network, you can do one-to-one nat there as required and all internal hosts can have private ip's.  This also provides the possibility for better security as only specific services can be allowed inbound to hosts.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-05T20:12:22.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19713" PostTypeId="1" CreationDate="2015-07-06T00:54:54.453" Score="3" ViewCount="1088" Body="&lt;p&gt;I have an ipv6 address FC00::50, and the subnet mask length is 64. How to calculate an subnet address? I want address FC00::50 in the scope of this calculated subnet address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Here is the description:&#xA;&#xA;Description: The subnet address is specified by the IP address together with the Subnet mask length. For user equipments in this subnet, the SGC uses the associated media site profile (see Section 4.10.1.1) to select a BGF for media.&#xA;&#xA;Default IPv4 subnet address is 0.0.0.0.&#xA;&#xA;Note:&#xA;The default subnet address can be used to catch all addresses not covered by the configured IP address mappings.&#xA;&#xA;Default IPv6 subnet address is 0000:0000:0000:0000:0000:0000:0000:0000.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8082" LastEditorUserId="8082" LastEditDate="2015-07-06T01:02:58.250" LastActivityDate="2015-07-06T13:28:44.240" Title="How to calculate the Subnet address?" Tags="|subnet|ipv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19714" PostTypeId="2" ParentId="19713" CreationDate="2015-07-06T01:03:57.510" Score="3" Body="&lt;p&gt;Since there are 128 bits in an IPv6 network address, it is easy.  IPv6 addresses, with a few exceptions, have a 64-bit network portion and a 64-bit interface (host) portion.  Basically, you are taking the first half (high-order bits) of the address for the network portion, and the second half (low-order bits) of the address for the interface portion.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;The general format for IPv6 Global Unicast addresses is as follows:&#xA;&#xA;|         n bits         |   m bits  |       128-n-m bits         |&#xA;+------------------------+-----------+----------------------------+&#xA;| global routing prefix  | subnet ID |       interface ID         |&#xA;+------------------------+-----------+----------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;RFC 4291, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291&quot; rel=&quot;nofollow noreferrer&quot;&gt;IP Version 6 Addressing Architecture&lt;/a&gt; will give you the basics, and RFC 5952, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5952&quot; rel=&quot;nofollow noreferrer&quot;&gt;A Recommendation for IPv6 Address Text Representation&lt;/a&gt; will give you the canonical representation.&lt;/p&gt;&#xA;&lt;p&gt;FYI, the IPv6 address &lt;code&gt;0000:0000:0000:0000:0000:0000:0000:0000&lt;/code&gt; is canonically represented as &lt;code&gt;::&lt;/code&gt; and is called the Unspecified address.  Also, the address you list, &lt;code&gt;FC00::50&lt;/code&gt; is in the part of the Unique Local address range that is currently undefined; &lt;code&gt;FD00::50&lt;/code&gt; would be in the part of the Unique Local address range that is defined, but it would be missing the required Global ID.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-07-06T13:28:44.240" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19718" PostTypeId="2" ParentId="19581" CreationDate="2015-07-06T12:12:12.590" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Will the passive closer resend the FIN and then the active closer&#xA;  knows the ACK was lost?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. Quoting from &lt;em&gt;TCP/IP Illustrated Volume 1&lt;/em&gt;, in the TCP Connection Management section:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;3&quot;&gt;&#xA;  &lt;li&gt;To complete the close, the final segment contains an ACK for the last FIN. Note that if a FIN is lost, it is retransmitted until an ACK&#xA;  for it is received.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is a timeout. When in &lt;code&gt;LAST_ACK&lt;/code&gt;, the passive closer will resend &lt;code&gt;FIN&lt;/code&gt; when there is a timeout, assuming that it was lost. If it was indeed lost, then the active closer will eventually receive the retransmitted &lt;code&gt;FIN&lt;/code&gt; and enter &lt;code&gt;TIME_WAIT&lt;/code&gt;. If the &lt;code&gt;FIN&lt;/code&gt; was not lost but the final &lt;code&gt;ACK&lt;/code&gt; was lost, then the active closer is in &lt;code&gt;TIME_WAIT&lt;/code&gt; and receives &lt;code&gt;FIN&lt;/code&gt; again. When this happens - receiving a &lt;code&gt;FIN&lt;/code&gt; in &lt;code&gt;TIME_WAIT&lt;/code&gt; - the &lt;code&gt;ACK&lt;/code&gt; is retransmitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The timeout value in &lt;code&gt;TIME_WAIT&lt;/code&gt; is &lt;em&gt;NOT&lt;/em&gt; used for retransmission purposes. When there is a timeout in &lt;code&gt;TIME_WAIT&lt;/code&gt;, it is assumed that the final &lt;code&gt;ACK&lt;/code&gt; was successfully delivered because the passive closer didn't retransmit &lt;code&gt;FIN&lt;/code&gt; packets. So, the timeout in &lt;code&gt;TIME_WAIT&lt;/code&gt; is just an amount of time after which we can safely assume that if the other end didn't send anything, then it's because he received the final &lt;code&gt;ACK&lt;/code&gt; and closed the connection.&lt;/p&gt;&#xA;" OwnerUserId="16308" LastActivityDate="2015-07-06T12:12:12.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19719" PostTypeId="1" AcceptedAnswerId="19720" CreationDate="2015-07-06T12:54:10.123" Score="-1" ViewCount="1425" Body="&lt;p&gt;I am learning about traceroute and have some question want to ask about it. &#xA;When I run &lt;code&gt;traceroute 8.8.8.8&lt;/code&gt; and dump traffics by &lt;code&gt;tcpdump -i wlan0 'udp or icmp' -n -v&lt;/code&gt;, I confuse something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Why my system send packets with different TTL (TTL=1, TTL=2, TTL=3) without wait for receive &lt;strong&gt;TTL time exceeded message&lt;/strong&gt;?. I mean send three IP packets with TTL=1 then wait for TTL time exceeded message response and then send three IP packets with TTL=2 and so on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part of dump file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;19:03:42.106216 IP (tos 0x0, ttl 1, id 10914, offset 0, flags [none], proto UDP &#xA;(17), length 60)&#xA;    192.168.1.6.49812 &amp;gt; 8.8.8.8.33434: UDP, length 32&#xA;19:03:42.106257 IP (tos 0x0, ttl 1, id 10915, offset 0, flags [none], proto UDP &#xA;(17), length 60)&#xA;    192.168.1.6.52790 &amp;gt; 8.8.8.8.33435: UDP, length 32&#xA;19:03:42.106272 IP (tos 0x0, ttl 1, id 10916, offset 0, flags [none], proto UDP (17), length 60)&#xA;    192.168.1.6.55112 &amp;gt; 8.8.8.8.33436: UDP, length 32&#xA;19:03:42.106285 IP (tos 0x0, ttl 2, id 10917, offset 0, flags [none], proto UDP (17), length 60)&#xA;    192.168.1.6.53449 &amp;gt; 8.8.8.8.33437: UDP, length 32&#xA;19:03:42.106297 IP (tos 0x0, ttl 2, id 10918, offset 0, flags [none], proto UDP (17), length 60)&#xA;    192.168.1.6.42008 &amp;gt; 8.8.8.8.33438: UDP, length 32&#xA;19:03:42.106308 IP (tos 0x0, ttl 2, id 10919, offset 0, flags [none], proto UDP (17), length 60)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) Response packets contain data of request packet but I notice that it have different TTL value with TTL value in request packet. Like this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Request packet has ttl=4&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;19:03:42.106381 IP (tos 0x0, ttl 4, id 10925, offset 0, flags [none], proto UDP (17), length 60)&#xA;    192.168.1.6.38055 &amp;gt; 8.8.8.8.33445: UDP, length 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Response packet has ttl=1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;19:03:42.159000 IP (tos 0x0, ttl 251, id 4287, offset 0, flags [DF], proto ICMP (1), length 56)&#xA;    123.29.10.178 &amp;gt; 192.168.1.6: ICMP time exceeded in-transit, length 36&#xA;    IP (tos 0x0, *ttl 1*, id 10925, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8f05 (-&amp;gt;bd46)!)&#xA;    192.168.1.6.38055 &amp;gt; 8.8.8.8.33445: UDP, length 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So why does ttl value change?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;3) From Eddie's answer. I saw more and noticed that, 'ICMP unreachable message' response has TTL~=1 and first 'ICMP unreachable message' response has ttl value =2. So why?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33466 unreachable, length 36&#xA;    IP (tos 0x80, ttl 2, id 10956, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8d66 (-&amp;gt;bba7)!)&#xA;    192.168.1.6.33995 &amp;gt; 8.8.8.8.33466: UDP, length 32&#xA;19:03:42.346002 IP (tos 0x0, ttl 46, id 0, offset 0, flags [none], proto ICMP (1), length 56)&#xA;    8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33467 unreachable, length 36&#xA;    IP (tos 0x80, ttl 3, id 10957, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8c65 (-&amp;gt;baa6)!)&#xA;    192.168.1.6.49358 &amp;gt; 8.8.8.8.33467: UDP, length 32&#xA;19:03:42.348871 IP (tos 0x0, ttl 46, id 0, offset 0, flags [none], proto ICMP (1), length 56)&#xA;    8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33468 unreachable, length 36&#xA;    IP (tos 0x80, ttl 2, id 10959, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8d63 (-&amp;gt;bba4)!)&#xA;    192.168.1.6.44693 &amp;gt; 8.8.8.8.33468: UDP, length 32&#xA;19:03:42.362155 IP (tos 0x0, ttl 46, id 0, offset 0, flags [none], proto ICMP (1), length 56)&#xA;    8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33469 unreachable, length 36&#xA;    IP (tos 0x80, ttl 2, id 10962, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8d60 (-&amp;gt;bba1)!)&#xA;    192.168.1.6.43577 &amp;gt; 8.8.8.8.33469: UDP, length 32&#xA;19:03:42.362185 IP (tos 0x20, ttl 47, id 0, offset 0, flags [none], proto ICMP (1), length 56)&#xA;    8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33470 unreachable, length 36&#xA;    IP (tos 0x80, ttl 3, id 10963, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8c5f (-&amp;gt;baa0)!)&#xA;    192.168.1.6.60249 &amp;gt; 8.8.8.8.33470: UDP, length 32&#xA;19:03:42.382381 IP (tos 0x0, ttl 46, id 0, offset 0, flags [none], proto ICMP (1), length 56)&#xA;    8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33471 unreachable, length 36&#xA;    IP (tos 0x80, ttl 3, id 10965, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8c5d (-&amp;gt;ba9e)!)&#xA;    192.168.1.6.33430 &amp;gt; 8.8.8.8.33471: UDP, length 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks for reading !&lt;/p&gt;&#xA;" OwnerUserId="16341" LastEditorUserId="16341" LastEditDate="2015-07-06T15:16:18.947" LastActivityDate="2015-07-06T15:16:18.947" Title="Different TTL in ICMP response (Traceroute)" Tags="|routing|packet-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19720" PostTypeId="2" ParentId="19719" CreationDate="2015-07-06T13:28:31.377" Score="1" Body="&lt;p&gt;Part of the ICMP TTL Expired in Transit message is a copy of the original packet which caused for the ICMP error message to be sent &lt;em&gt;as seen by the Router&lt;/em&gt; sending the ICMP TTL Expired message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you sent the packet, it started with a TTL of 4.  But every router in the path towards the destination decremented the TTL by one, until it finally got to the router with the IP &lt;code&gt;123.29.10.178&lt;/code&gt;.  When that Router received it, it had a TTL of 1.  And as it should, it reduce the TTL upon receiving the packet to 0, which triggered dropping the packet and responding with the ICMP TTL Expired message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it is including a copy of the packet &lt;em&gt;as it saw it&lt;/em&gt; in its ICMP TTL Expired message, and it saw the TTL as 1 when that particular router received the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will see a TTL of 1 in all of the &quot;duplicate packets&quot; within the &quot;TTL Expired&quot; message, because by definition they are only sent when a packet with a TTL is received at 1, and decremented to 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to learn more, there is some good information on &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/12496&quot;&gt;this thread about Traceroute and the TTL&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-07-06T13:28:31.377" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19721" PostTypeId="1" CreationDate="2015-07-06T13:31:39.613" Score="4" ViewCount="27242" Body="&lt;p&gt;I have two ISP connections on two Cisco 2901 routers, in front of Cisco ASA-5515 firewall. I need to configure failover load balancing network.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Two Cisco 2901 router with dual (different ISP) connections.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;One Cisco ASA 5515 firewall behind Cisco 2901 routers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Please suggest me how to design the network, and then configure routers and firewall. A sample network diagram is attached below. I don't know if this is the correct way, please advise me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/GJN3a.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16394" LastEditorUserId="286" LastEditDate="2015-07-06T23:03:41.647" LastActivityDate="2016-10-10T13:26:11.640" Title="Load balancing with multiple ISP, two routers and firewall" Tags="|cisco|router|cisco-asa|failover|load-balancing|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19723" PostTypeId="2" ParentId="19721" CreationDate="2015-07-06T14:25:26.537" Score="2" Body="&lt;p&gt;You could configure a floating static route. This is a method in which two default routes are configured one with a higher AD than the other so that when one link goes down the route would be removed and the backup inserted to take over. For this to work the 2901's would have to be plugged directly into the firewall to detect the link is down and therefor remove the primary route from the routing table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route outside 0.0.0.0 0.0.0.0 192.168.1.1 1&#xA;route outsidebackup 0.0.0.0 0.0.0.0 192.168.2.1 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;P.S. In the question you say you use a 5505 and a 5515, which one is it? The only reason I ask is that the 5505 can have some limitations when it comes to named interfaces. &lt;/p&gt;&#xA;" OwnerUserId="16398" LastEditorUserId="509" LastEditDate="2015-07-06T20:33:58.117" LastActivityDate="2015-07-06T20:33:58.117" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19725" PostTypeId="1" AcceptedAnswerId="19727" CreationDate="2015-07-06T15:09:44.173" Score="0" ViewCount="119" Body="&lt;p&gt;I've just moved into a new build apartment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each room has a female telephone port (431A?), connected to a female telephone port in my electricity cupboard. My BT telephone line then comes into the same cupboard into another female telephone port, and a phone cable runs between the 2 to route the phone line to the rest of my rooms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, could I put my ADSL router in the cupboard, connected up to my telephone line, then take an ethernet/rj45 cable out and in to the female telphone port that supplies the rest of the apartment? Using some of these adapters? - &lt;a href=&quot;http://www.amazon.co.uk/Rj45-Socket-Bt-431a-Plug/dp/B0042K50UO/ref=sr_1_1?ie=UTF8&amp;amp;qid=1436194276&amp;amp;sr=8-1&amp;amp;keywords=431A+rj45&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.co.uk/Rj45-Socket-Bt-431a-Plug/dp/B0042K50UO/ref=sr_1_1?ie=UTF8&amp;amp;qid=1436194276&amp;amp;sr=8-1&amp;amp;keywords=431A+rj45&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's possible, would I be able to get cat5e/6 equivalent gigabit speeds?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help greatly appreciated!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="16399" LastEditorUserId="8499" LastEditDate="2019-01-02T23:08:46.007" LastActivityDate="2019-01-02T23:08:46.007" Title="Using home phone cabling as home network" Tags="|routing|ethernet|layer1|cable|cabling|" AnswerCount="1" CommentCount="10" ClosedDate="2015-07-06T18:30:42.620" ContentLicense="CC BY-SA 3.0" />
  <row Id="19726" PostTypeId="2" ParentId="19286" CreationDate="2015-07-06T15:12:10.400" Score="0" Body="&lt;p&gt;I'll focus on the long-distance with TCP part of your question and specifically how you say &quot;divide the bandwidth equally&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP bandwidth sharing has a well known bias towards favoring streams with low RTTs. All else being equal, longer distance means higher RTT and therefore less bandwidth. This is one benefit of a CDN (they reduce RTT through geographic diversity).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://intronetworks.cs.luc.edu/current/html/dynamics.html&quot; rel=&quot;nofollow&quot;&gt;http://intronetworks.cs.luc.edu/current/html/dynamics.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2015-07-06T15:12:10.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19727" PostTypeId="2" ParentId="19725" CreationDate="2015-07-06T15:16:24.913" Score="3" Body="&lt;p&gt;The odds of the telephone cabling working are very small.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, standard telephone cabling is Category-3 that would top out at 10 Mb.  Likely, it only has one or two pairs in the cable, but gigabit requires all four pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tolerances for anything over 10Base-T are pretty tight, and standard telephone cabling is just not designed for network use above 10 Mb.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-07-06T15:16:24.913" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19729" PostTypeId="1" AcceptedAnswerId="19734" CreationDate="2015-07-06T12:23:56.343" Score="1" ViewCount="751" Body="&lt;p&gt;I've recently become network administrator in a small office. In this office, there are 3 people which are leasing a shared space; each person is an independent entity requiring segregated networking from the other entities. They asked to have a private subnet for each of them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In total, we have 4 subnets:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;primary company, so it uses internal email traffic, file sharing along with confidential clients' information&lt;/li&gt;&#xA;&lt;li&gt;independent company 1&lt;/li&gt;&#xA;&lt;li&gt;independent company 2&lt;/li&gt;&#xA;&lt;li&gt;independent company 3&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;An external company configured a Watchguard Firebox to provide these subnets (it firewalls all of the subnets so that they can't see each other, it only allows WAN access for the Internet), so this problem is solved. My task is to provide the 3 additional subnets to the 2nd floor, one per wall plug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st floor rack is composed of: Firebox, 2 fiber-optic-linked Netgear GS748T (managed switches) and some patch panels.&#xA;2nd floor rack is composed of: 2 linked hubs and 2 patch panels. In one of the hubs, 2 cables are incoming from the 1st floor (I don't know why they're 2).&#xA;At the moment, there's only a single VLAN set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: can I provide access to the other three subnets in the leased room using the current cables? The obvious solution would be putting a cable between a Firebox port and the patch panel, repeated three times, bypassing switches which are for the &quot;real&quot; office subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/JSZtN.jpg&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I omitted first floor patch panels as they're not relevant to my question. Red wire is for primary company's subnet.&#xA;I don't know if it's all clear. Let me know :)&lt;/p&gt;&#xA;" OwnerUserId="16407" OwnerDisplayName="LivingSilver94" LastEditorUserId="16407" LastEditDate="2015-07-12T09:35:39.477" LastActivityDate="2015-07-12T09:35:39.477" Title="Would I need three other cables if I wanted to have 4 subnets on the 2nd floor?" Tags="|switch|vlan|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19730" PostTypeId="2" ParentId="19729" CreationDate="2015-07-06T13:00:00.240" Score="0" Body="&lt;p&gt;A subnet is a logical segregation of traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This isn't something simply achieved by the number of network cables you have.  This is something you have to plan and configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your description of the problem, there is no reasoning behind segregating the traffic; technically speaking, all computers are on their own subnets (/32).  They are also on the same subnet that allows the computers to communicate with each other, the server(s) and the Internet(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you desperately want to give each person their own subnet, you can, but depending on your network switch/router, it could be a lot of work for no reason; and if you don't know what you're doing on the switch/router, you could mute traffic for one or all of your users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since it sounds like you don't what a subnet is, I'll put it in terms you might be able to understand, with very basic and very simple examples.  If you bring up your network settings, either through the operating system's GUI or command prompt/terminal, you should see something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP Address: 192.168.1.29&#xA;Subnet Mask: 255.255.255.0&#xA;Gateway: 192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This configuration shows that the device is on the subnet &lt;code&gt;192.168.1.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the configuration was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP Address: 192.168.2.20&#xA;Subnet Mask: 255.255.255.0&#xA;Gateway: 192.168.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the subnet would be &lt;code&gt;192.168.2.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: the &lt;code&gt;/24&lt;/code&gt; is a denotation of the subnet size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at both configurations, you'll notice that each configuration has a different &lt;code&gt;Gateway&lt;/code&gt; address.  Every subnet needs a gateway, so it knows how to send traffic.  If a subnet doesn't have a gateway, it won't be able to route traffic.  However, every gateway needs a physical address; this mean it needs to be tied to a NIC/port, unless your switch/router can generate virtual NIC/ports. If I've lost you here, it means you need to read several books on networking or get Network+ certified before you go any further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could go the easy way, and get every person one of those home routers, then plug those home routers to your main switch.  This would effectively give everyone their own subnet (both physically and logically), like they asked, but they wouldn't be able to work together or share local resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt;: Your users don't know what they're talking about, asking for different subnets.  I think everyone involved has watched a little too much TV.&lt;/p&gt;&#xA;" OwnerDisplayName="CIA" LastActivityDate="2015-07-06T13:00:00.240" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="19734" PostTypeId="2" ParentId="19729" CreationDate="2015-07-06T18:29:22.860" Score="3" Body="&lt;p&gt;Without knowing what, exactly, has been done by &quot;outside vendor&quot; I'm going to guess that each &quot;company&quot; has a separate VLAN (virtual LAN.) That is the most common way to isolate entities that should not have the ability to snoop on each other's network traffic that share infrastructure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have the password to access the switches you should be able to see if that is the case by examining the switch setup and mapping the port destination to any defined VLANs on the switch ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, you should be able to make access to any VLAN from any port. Keep your most ethical self in control when doing this. Hmm - actually, if you have &quot;dumb hubs&quot; on the second floor, you may need to upgrade those to a &quot;smart switch&quot; for proper VLAN handling. Or, if there is adequate cabling in the patch between first and second, and switch ports on the first, you just patch on the second floor, using switch ports on the first floor. To know what your options are, you really need to know (or describe) what you actually have, cable-wise. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a VLAN-capable switch on the second floor, one wire can carry 4 VLANs between floors and then the switch can deliver them to the proper wall jacks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK. If you only have two cables (which for some reason are both connected from down to up on the &quot;main company - building owner&quot; network, and if you get a smart/managed/vlan capable switch for upstairs (probably only need one, really, at least for the scale of the problem so far) then you will need to set up VLANs on a downstairs switch for the building owner and each client. You'd plug each client into an &quot;untagged&quot; port on the downstairs switch assigned to their VLAN;  on (at least one of) the lines running between down and up you have a port on a downstairs switch that is assigned to all 4 VLANS, &lt;strong&gt;tagged&lt;/strong&gt; (which is how one wire carries 4 networks) and that connects to a port on the upstairs switch which also has all 4 of those VLANs, &lt;strong&gt;tagged.&lt;/strong&gt; Then on the upstairs switch you break out the 3 &quot;customer&quot; VLANs to &lt;strong&gt;untagged&lt;/strong&gt; ports which you patch to their assigned wall ports, and the company VLAN to the other ports (or to only the actual ports in use, as a better &quot;best practice&quot; which does require remembering that you need to reconfigure the switch when/if you move cables around.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With smart/managed switches, the two lines from downstairs to upstairs can be configured as a LACP so that data can move twice as fast over the pair of cables.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2015-07-07T13:03:11.433" LastActivityDate="2015-07-07T13:03:11.433" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19735" PostTypeId="2" ParentId="19721" CreationDate="2015-07-06T19:18:56.770" Score="0" Body="&lt;p&gt;The load balancing can be done via subnet or vlan or any criteria that you can think of with an ACL, provided your switch is a layer 3 switch.  Simply match the traffic and apply a route map to policy route said traffic thru 2901 corresponding to ISP1, and ISP2 respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If switch is layer 2 only, move the firewall to the other side of the 2901's and have the 2901 be the default gateway per VLAN/subnet.  You can then load balance ISP per VLAN.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-06T19:18:56.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19736" PostTypeId="2" ParentId="19646" CreationDate="2015-07-06T22:40:20.140" Score="0" Body="&lt;p&gt;So I have continued to search how to solve my problem, and I found that using the tcpdump tool could help me a lot.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;sudo tcpdump -e -f&lt;/em&gt; can listen to all data transferred through wifi, and read the header of packets as they are usually not cryptic. And the -e option show me the MAC address.&lt;/p&gt;&#xA;&lt;p&gt;It works well, but I would like to narrow the results to display only the interesting MAC address. I tried &lt;em&gt;sudo tcpdump -e -f src myMacAddress&lt;/em&gt; where myMacAddress is the interesting MAC, but it returns me an error and stop the execution&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;tcpdump: pktap_filter_packet: pcap_add_if_info(en0, 1) failed:&#xA;pcap_add_if_info: pcap_compile_nopcap() failed&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16335" LastEditorUserId="36720" LastEditDate="2021-04-13T05:31:34.550" LastActivityDate="2021-04-13T05:31:34.550" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="19737" PostTypeId="1" AcceptedAnswerId="19741" CreationDate="2015-07-07T00:53:35.587" Score="43" ViewCount="174345" Body="&lt;p&gt;I would like to display all traffic for or from a specific MAC address.&#xA;For that I tried &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo tcpdump host aa:bb:cc:11:22:33&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It does not work and returns me an error&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump: pktap_filter_packet: pcap_add_if_info(en0, 1) failed: pcap_add_if_info: pcap_compile_nopcap() failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know how to interpret this error message and I don't know how to solve the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help ?&lt;/p&gt;&#xA;" OwnerUserId="16335" LastEditorUserId="33" LastEditDate="2015-07-07T02:09:54.190" LastActivityDate="2019-12-18T15:07:31.770" Title="TCPDump - Filter by MAC Address" Tags="|mac-address|ip|tcpdump|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19740" PostTypeId="2" ParentId="19529" CreationDate="2015-07-07T01:43:05.620" Score="1" Body="&lt;p&gt;Each layer adds header during &quot;send&quot; operation. The corresponding layer in the destination (or next hop) reads the contents of that header during &quot;receive&quot; operation. We can see this as a virtual connection between layers of those two hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an image from Wikipedia illustrating this concept: &lt;a href=&quot;https://en.m.wikipedia.org/wiki/File:OSI-model-Communication.svg&quot; rel=&quot;nofollow&quot;&gt;https://en.m.wikipedia.org/wiki/File:OSI-model-Communication.svg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16370" LastActivityDate="2015-07-07T01:43:05.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19741" PostTypeId="2" ParentId="19737" CreationDate="2015-07-07T02:08:47.110" Score="61" Body="&lt;p&gt;You have used the following as your packet filter: &lt;code&gt;host aa:bb:cc:11:22:33&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it stands, this is looking for an IP or hostname but you are giving it a MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To use a MAC address, you need to include the &lt;code&gt;ether&lt;/code&gt; packet filter primitive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, the following should work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo tcpdump ether host aa:bb:cc:11:22:33&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or, if it needs you to specify the interface, then it would be something like: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo tcpdump -i eth0 ether host aa:bb:cc:11:22:33&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-07-07T02:08:47.110" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="19743" PostTypeId="2" ParentId="18042" CreationDate="2015-07-07T02:24:48.837" Score="2" Body="&lt;p&gt;What you were taught is right or wrong, depending on the network mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0 is a valid host address for:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.0.0.0/8 (and smaller masks)&lt;/li&gt;&#xA;&lt;li&gt;192.0.0.0/9&lt;/li&gt;&#xA;&lt;li&gt;192.0.0.0/10&lt;/li&gt;&#xA;&lt;li&gt;192.0.0.0/11&lt;/li&gt;&#xA;&lt;li&gt;192.0.0.0/12&lt;/li&gt;&#xA;&lt;li&gt;192.0.0.0/13&lt;/li&gt;&#xA;&lt;li&gt;192.0.0.0/14&lt;/li&gt;&#xA;&lt;li&gt;192.0.0.0/15&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0/16&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0/17&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0/18&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0/19&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0/20&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0/21&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0/22&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0/23&lt;/li&gt;&#xA;&lt;li&gt;192.168.1.0/31&lt;/li&gt;&#xA;&lt;li&gt;192.168.1.0/32&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0 is not a valid host address for:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.1.0/24&lt;/li&gt;&#xA;&lt;li&gt;192.168.1.0/25&lt;/li&gt;&#xA;&lt;li&gt;192.168.1.0/26&lt;/li&gt;&#xA;&lt;li&gt;192.168.1.0/27&lt;/li&gt;&#xA;&lt;li&gt;192.168.1.0/28&lt;/li&gt;&#xA;&lt;li&gt;192.168.1.0/29&lt;/li&gt;&#xA;&lt;li&gt;192.168.1.0/30&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-07-07T02:43:57.240" LastActivityDate="2015-07-07T02:43:57.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19745" PostTypeId="1" AcceptedAnswerId="19750" CreationDate="2015-07-07T03:34:35.407" Score="1" ViewCount="1179" Body="&lt;p&gt;Can someone enlighten me on how the below is possible?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I have a remote site, L2 connection to HQ. Clients are configured like this...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Client (rc01) IP address 10.1.1.1/24&lt;/li&gt;&#xA;&lt;li&gt;Gateway 10.1.1.254/24 (The catch: I have no access or control of this device)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;HQ Edge firewall details...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;internal 192.168.1.1/24&lt;/li&gt;&#xA;&lt;li&gt;external 100.1.0.1/30&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;HQ example server...let's call it hq01&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.1.2/24&lt;/li&gt;&#xA;&lt;li&gt;Gateway 192.168.1.1/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;When I run a tracert from rc01 -&gt; hq01 the first response is from hq01. But if I do the reverse (hq01 -&gt; rc01) the first response is from the internal interface of the hq firewall as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is rc01 finding hq01 without first going through a gateway?&lt;/p&gt;&#xA;" OwnerUserId="16409" LastEditorUserId="49" LastEditDate="2015-07-08T16:43:38.120" LastActivityDate="2015-07-09T18:41:57.507" Title="Tracert first hop different subnet" Tags="|routing|ipv4|tcp|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19746" PostTypeId="1" AcceptedAnswerId="19748" CreationDate="2015-07-07T05:49:48.910" Score="1" ViewCount="504" Body="&lt;p&gt;I think when a hop (including destination hop) reply a UDP request (by traceroute) always has ttl=1 as in this &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/12496/traceroute-every-packet-has-ttl-1&quot;&gt;link&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I see ttl isn't equal 1 in ICMP Port Unreachable message responses from destination hop. like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33466 unreachable, length 36&#xA;    IP (tos 0x80, ttl 2, id 10956, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8d66 (-&amp;gt;bba7)!)&#xA;    192.168.1.6.33995 &amp;gt; 8.8.8.8.33466: UDP, length 32&#xA;19:03:42.346002 IP (tos 0x0, ttl 46, id 0, offset 0, flags [none], proto ICMP (1), length 56)&#xA;    8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33467 unreachable, length 36&#xA;    IP (tos 0x80, ttl 3, id 10957, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8c65 (-&amp;gt;baa6)!)&#xA;    192.168.1.6.49358 &amp;gt; 8.8.8.8.33467: UDP, length 32&#xA;19:03:42.348871 IP (tos 0x0, ttl 46, id 0, offset 0, flags [none], proto ICMP (1), length 56)&#xA;    8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33468 unreachable, length 36&#xA;    IP (tos 0x80, ttl 2, id 10959, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8d63 (-&amp;gt;bba4)!)&#xA;    192.168.1.6.44693 &amp;gt; 8.8.8.8.33468: UDP, length 32&#xA;19:03:42.362155 IP (tos 0x0, ttl 46, id 0, offset 0, flags [none], proto ICMP (1), length 56)&#xA;    8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33469 unreachable, length 36&#xA;    IP (tos 0x80, ttl 2, id 10962, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8d60 (-&amp;gt;bba1)!)&#xA;    192.168.1.6.43577 &amp;gt; 8.8.8.8.33469: UDP, length 32&#xA;19:03:42.362185 IP (tos 0x20, ttl 47, id 0, offset 0, flags [none], proto ICMP (1), length 56)&#xA;    8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33470 unreachable, length 36&#xA;    IP (tos 0x80, ttl 3, id 10963, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8c5f (-&amp;gt;baa0)!)&#xA;    192.168.1.6.60249 &amp;gt; 8.8.8.8.33470: UDP, length 32&#xA;19:03:42.382381 IP (tos 0x0, ttl 46, id 0, offset 0, flags [none], proto ICMP (1), length 56)&#xA;    8.8.8.8 &amp;gt; 192.168.1.6: ICMP 8.8.8.8 udp port 33471 unreachable, length 36&#xA;    IP (tos 0x80, ttl 3, id 10965, offset 0, flags [none], proto UDP (17), length 60, bad cksum 8c5d (-&amp;gt;ba9e)!)&#xA;    192.168.1.6.33430 &amp;gt; 8.8.8.8.33471: UDP, length 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could you explain why is that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for reading !&lt;/p&gt;&#xA;" OwnerUserId="16341" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-10-05T09:22:44.360" Title="TTl !=1 value in ICMP Port Unreachable message (traceroute)" Tags="|routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19748" PostTypeId="2" ParentId="19746" CreationDate="2015-07-07T07:33:32.700" Score="2" Body="&lt;p&gt;The ICMP response is an entirely separate unicast message from a router to the original source used in the traceroute.  The formation of the ICMP error packet is independent of the original traceroute packet headers that triggered the error except in determining where to send the error message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If TTL=1 for each of the ICMP messages trying to get back to your traceroute client, only the message from the first hop would make it back.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-07-07T07:33:32.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19750" PostTypeId="2" ParentId="19745" CreationDate="2015-07-07T13:47:20.730" Score="2" Body="&lt;p&gt;Firewalls can be setup to not decrement the ttl(time to live) as a weak security feature, to make them invisible. This is the default on the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Explanation for your scenario, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FW(10.1.1.254) has a interface in the server range 192.168.1.0/24. Then traceroute with ttl=1 will hit hq01 and get a response as FW delivers packet to directly connected subnet without decrementing the ttl.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the reverse direction your server hq01 uses a real router, and sees it as the first hop, the FW is again hidden (no ttl decrement) and you see the pc next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.nanog.org/meetings/nanog47/presentations/Sunday/RAS_Traceroute_N47_Sun.pdf&quot; rel=&quot;nofollow&quot;&gt;Traceroute Overview&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2015-07-09T18:41:57.507" LastActivityDate="2015-07-09T18:41:57.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19751" PostTypeId="1" CreationDate="2015-07-07T14:31:17.523" Score="0" ViewCount="403" Body="&lt;p&gt;This question is related to Wifi devices and is of two parts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering if one buys a 802.11n conforming station, does it mean that it is able to behave as a 802.11g or 802.11a station if it exisits within 802.11a or g basic service set?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, can someone explain or give me references why?&lt;/p&gt;&#xA;" OwnerUserId="15457" LastActivityDate="2015-07-07T21:32:42.563" Title="Wifi devices 802.11n acting as legacy 802.11 devices" Tags="|ieee-802.11|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19752" PostTypeId="2" ParentId="19751" CreationDate="2015-07-07T14:52:30.267" Score="3" Body="&lt;p&gt;First of all 802.11&lt;strong&gt;g&lt;/strong&gt; is 2.4Ghz only and 802.11&lt;strong&gt;a&lt;/strong&gt; is 5GHz only. If you don't have a dual band client (a+g) it can only connect to &lt;strong&gt;g&lt;/strong&gt; OR &lt;strong&gt;a&lt;/strong&gt; depending on what band your client supports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11n can do both 2.4GHz (&lt;strong&gt;gn&lt;/strong&gt;) and 5GHz (&lt;strong&gt;an&lt;/strong&gt;) depending on your AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A 2.4GHz 802.11&lt;strong&gt;n&lt;/strong&gt; (&lt;strong&gt;gn&lt;/strong&gt;) device can always behave as a 802.11g device because the &lt;strong&gt;n&lt;/strong&gt; only means bigger channel width (40MHz) and up to four spatial streams. But it can revert back to using just one spatial stream if there is a 802.11g client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same is true for a 5GHz 802.11&lt;strong&gt;n&lt;/strong&gt; (&lt;strong&gt;an&lt;/strong&gt;) device, it can also revert back to fewer streams if needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please have a look at: &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.11n-2009&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/IEEE_802.11n-2009&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16331" LastEditorUserId="16331" LastEditDate="2015-07-07T19:05:40.983" LastActivityDate="2015-07-07T19:05:40.983" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19753" PostTypeId="2" ParentId="19751" CreationDate="2015-07-07T15:25:34.677" Score="0" Body="&lt;p&gt;In order to be considered Wi-Fi gear, the wireless LAN equipment must pass inspection / testing ensuring backwards compatability with legacy standards.  So, when you see the Wi-Fi logo, you know it is backward compatable.  More at &lt;a href=&quot;http://www.wi-fi.org/certification/benefits&quot; rel=&quot;nofollow noreferrer&quot;&gt;Certification Benefits&lt;/a&gt;.&#xA;&lt;br&gt;&lt;br&gt;&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/wMx4C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-07-07T15:33:45.423" LastActivityDate="2015-07-07T15:33:45.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19755" PostTypeId="2" ParentId="19729" CreationDate="2015-07-07T16:00:41.443" Score="0" Body="&lt;p&gt;You want to create a VLAN per subnet.  These additional VLANs should be configured on all switches that have ports connecting devices for respective VLAN.  This VLAN configuration can be done manually per switch or dynamically/automatically via a trunking protocol like VTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, the link between switches will need to be a trunk link - meaning it carries frames for all VLANs.  Finally, you will need a layer 3 device (perhaps your switches are layer 3) to act as default gateway for each VLAN and provide routing.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-07T16:00:41.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19756" PostTypeId="2" ParentId="9886" CreationDate="2015-07-07T16:01:26.947" Score="2" Body="&lt;p&gt;I dont think it possible : &#xA;Pfsense doc : Both locations must be using non-overlapping LAN IP subnets.&#xA;And no &quot;ip virtual-reassembly&quot; seen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;btw, pfsense 2.0.1 is outdated, and more recent support IPSec+L2TP&lt;/p&gt;&#xA;" OwnerUserId="16421" LastActivityDate="2015-07-07T16:01:26.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19758" PostTypeId="2" ParentId="19646" CreationDate="2015-07-07T17:28:09.253" Score="1" Body="&lt;p&gt;Filter the output of &lt;code&gt;tcpdump&lt;/code&gt; by MAC address:&lt;br&gt;&#xA;&lt;code&gt;sudo tcpdump ether host A1:B2:C3:D4:E5:F6&lt;/code&gt;&lt;br&gt;&#xA;Add other options as needed.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2015-07-07T17:28:09.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19759" PostTypeId="1" CreationDate="2015-07-07T18:11:21.263" Score="1" ViewCount="147" Body="&lt;p&gt;So it's the usual Server vs Network battle. What's the best way to check if it's our Proxy Server that's slowing our Internet connection? I do not have access to the Proxy Server. I can only access the networking devices and it looks good at least up to Layer 3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can use Wireshark or tcpdump but what are the red flags that I should be looking for to nail the Proxy Server?&lt;/p&gt;&#xA;" OwnerUserId="14170" LastActivityDate="2015-11-05T00:11:27.980" Title="Is it the Proxy Server slowing us?" Tags="|wireshark|proxy|" AnswerCount="1" CommentCount="1" ClosedDate="2019-01-29T05:52:13.513" ContentLicense="CC BY-SA 3.0" />
  <row Id="19760" PostTypeId="1" AcceptedAnswerId="19911" CreationDate="2015-07-07T18:53:21.033" Score="3" ViewCount="574" Body="&lt;p&gt;When using an SRX (we have a 1400) to protect a server we can create an application-ddos rule for DNS, but what if we want to protect it against SQL exploit attempts like &quot;SaAdmin&quot; login attempts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the JUNOS guide, it states, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Note: Application-level denial-of-service (application-level DDoS)&#xA;  detection will not work if two rules with different application-level&#xA;  DDoS applications process traffic going to a single destination&#xA;  application server.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's almost as if you can protect a server from only one protocol's exploits at a time. If that's not the case, how is it done? I haven't seen a single configuration for SRX IDP that shows a specific destination protected for more than a single application/protocol. What happens if you want to protect your webserver from HTTP and FTP exploits? &lt;/p&gt;&#xA;" OwnerUserId="3958" LastEditorDisplayName="user36472" LastEditDate="2018-02-18T09:08:55.090" LastActivityDate="2018-02-18T09:08:55.090" Title="How to get around &quot;configure one application-ddos definition for each protected server&quot; in Juniper SRX IDP?" Tags="|juniper|juniper-junos|srx|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19761" PostTypeId="2" ParentId="19545" CreationDate="2015-07-07T20:03:03.700" Score="1" Body="&lt;p&gt;IP only does a minimum amount of work because sometimes you only want a minimum amount of work to be done.  For example, you talked about flow control and acknowledgement in your question, but neither of these make sense for a number of networking protocols.  Nor do they make sense for most Multicast traffic.  If IP had this functionality, you would have to explicitly disable the functionality for this traffic.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of loading down the packets with overhead for functionality they may not be using, IP takes the approach of allowing you to layer on functionality as you need it.  If you want flow control and retransmissions and guarantees about the order of packet delivery, layer TCP on top of your IP.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, internet routers only need to care about the relatively simple IP protocol and are free to ignore everything above it.  This allows vendors to build specialized hardware that is very fast and relatively affordable and not waste silicon on handling special cases in IP.  (note: IP options make a mess of this last point, but that's why major routers have a software process that can handle those rare packets where the options are set).  &lt;/p&gt;&#xA;" OwnerUserId="14446" LastActivityDate="2015-07-07T20:03:03.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19762" PostTypeId="2" ParentId="19641" CreationDate="2015-07-07T20:19:54.810" Score="0" Body="&lt;p&gt;The first thing I notice about your capture is that you have TCP Sequence Offloading (TSO) enabled.  This isn't inherently a problem, but it could be masking whatever is causing your connection to stall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see anything else suspicious in the PCAP, but a lot of the interaction is hidden behind your card's TSO feature.  I would try turning off TSO and making another capture to see if there is anything suspicious going on.  &lt;/p&gt;&#xA;" OwnerUserId="14446" LastActivityDate="2015-07-07T20:19:54.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19763" PostTypeId="1" AcceptedAnswerId="19910" CreationDate="2015-07-07T20:51:38.670" Score="3" ViewCount="2184" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;While the industry is preaching cloud in every market, and users, whether eagerly, reluctantly or unwittingly start falling in line&#xA;  everywhere, few seem to talk about the actual fabric of the Internet&#xA;  and the ever remaining complexity that undeniably sits between a&#xA;  customer and their mission critical cloud services.&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;As a result there is precious little acceptance left for connectivity issues of any kind; never mind that even a fairly large service&#xA;  provider in the northern outskirts of Europe, can influence the global&#xA;  flow of traffic between backbone providers or alleviate transatlantic&#xA;  congestion, to about the same extent as the nearby conference hotel,&#xA;  where said service provider host their customer training sessions, can&#xA;  keep United Airlines (Only due to a &quot;pressing, unforeseen and&#xA;  otherwise undisclosed matter of passenger safety&quot;, of course. I'm sure&#xA;  you understand.) from cancelling the customer team's outbound flight,&#xA;  despite the hotel's obvious and undisputed obligation to make good the&#xA;  non-refundable room reservations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In slightly simpler terms&lt;/strong&gt;, customers increasingly expect that service providers take it upon them to ensure continuous service availability and performance, at least beyond the customer's own Internet uplink. With the competition never being further away than one click of the mouse, I feel multihoming is rapidly becoming an absolute requirement for even the smallest provider of SaaS or other Internet dependant service - Save being built on top of third party infrastructure, in which case the same requirement falls to said third party.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, &lt;strong&gt;BGP&lt;/strong&gt; is as complex, cumbersome and scary as ever, and just does not seem like a good fit for a relatively small operation without a team of dedicated wan people. As such, I've been looking hard for a fairly &lt;strong&gt;robust, simple and inexpensive solution that will allow dynamic routing via two Internet Service Providers without running full BGP&lt;/strong&gt; from your own AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I think I finally have an idea for a usable design that will at least keep dynamic routing protocols at an arms length, and for the most part, within the respective domain of the two ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MehSS.png&quot; alt=&quot;Outline of suggested network design&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup makes use of a couple of notable mechanics of the &lt;code&gt;BGP routing protocol&lt;/code&gt; and the &lt;code&gt;F5 Networks BigIP appliance&lt;/code&gt;. First out, BGP will give heed to the &lt;strong&gt;most specific&lt;/strong&gt; applicable &lt;strong&gt;route&lt;/strong&gt; object. This allows both ISPs to announce the larger &lt;code&gt;/22 route&lt;/code&gt; in addition to a more specific &lt;code&gt;/23 route&lt;/code&gt; each, effectively cutting the block into two halfs during normal operation. As the two &lt;code&gt;/23 routes&lt;/code&gt; combined account for the entire &lt;code&gt;/22 block&lt;/code&gt;; as long as both ISPs are reachable, the &lt;code&gt;/22 routes&lt;/code&gt; should be ignored, thus letting traffic flow according to the &lt;code&gt;/23 routes&lt;/code&gt; to each of the sites along the green markers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, say, the link to &lt;code&gt;ISP 2&lt;/code&gt; goes down, AS 200 should withdraw both routes (or withdraw the small route and downgrade the other, as they can still announce on behalf of it's peer &lt;code&gt;AS 1000&lt;/code&gt;) and traffic will start to flow to the &lt;code&gt;/22 route&lt;/code&gt; already announced by &lt;code&gt;AS 1000&lt;/code&gt;, with any luck, following the red marker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since both &lt;code&gt;BigIP appliances&lt;/code&gt; are reachable from both &lt;code&gt;ISP gateways&lt;/code&gt; in the same layer 2 segment, the rerouted traffic will be bridged across the &lt;code&gt;Lan 2 Lan&lt;/code&gt; links, and end up at the same &lt;code&gt;BigIP appliance&lt;/code&gt; as before, although they will arrived on one of the two ports facing the &lt;code&gt;Lan 2 Lan&lt;/code&gt; rather than the one facing the &lt;code&gt;ISP 2 gateway&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the &lt;strong&gt;second&lt;/strong&gt; of he two mentioned &lt;strong&gt;mechanics&lt;/strong&gt; come into play. &lt;code&gt;BigIP&lt;/code&gt; will by default transmit replies on the network port where a given request &lt;strong&gt;originated&lt;/strong&gt;, and similarly (or so I hope) direct traffic to the originating gateway. Admittedly, I have not yet tested the part about replies being forwarded to the originating router; I suppose it could be necessary with some sort of rule to update the &lt;code&gt;static gateway route entry&lt;/code&gt;, maybe use a simple local routing protocol or perhaps even let a &lt;code&gt;VIP interface&lt;/code&gt; on &lt;code&gt;BigIP&lt;/code&gt; (or if possible, on the remaining healthy &lt;code&gt;ISP gateway&lt;/code&gt;) take over the IP address of the unhealthy &lt;code&gt;ISP gateway&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this specific layout, the fact that the two ISPs already have direct peering seem to add to the robustness of the solution. Most likely these are already announcing our routes to their respective peers on behalf of each other. This can both help reduce the immediate impact of an outage and speed up propagation of changes necessary to regain full reach-ability. If the &lt;code&gt;AS 200&lt;/code&gt; of &lt;code&gt;ISP 2&lt;/code&gt; becomes mostly unavailable, though somehow maintains connectivity to &lt;code&gt;Site B&lt;/code&gt; as well as the &lt;code&gt;BGP session&lt;/code&gt; to &lt;code&gt;ISP 1&lt;/code&gt;, any traffic destined for &lt;code&gt;ISP 2&lt;/code&gt; that arrives at &lt;code&gt;AS 1000&lt;/code&gt; will simply be forwarded to &lt;code&gt;AS 200&lt;/code&gt; and join the path of the green marker from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if any of these scenarios are reversed and faults occur on the &lt;code&gt;ISP 1&lt;/code&gt; side instead, effects mirroring those previously outlined should present themselves, and traffic should similarly start to flow along the path of the blue marker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the rest of the design, it should be possible, beneficial even, to combine this with &lt;code&gt;DNS round-robin&lt;/code&gt; to distribute initial requests across the two sites. The setup is also meant to &lt;code&gt;tolerate&lt;/code&gt; failure of any internal component up to and including a full site blackout. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So. Think this should work ok? Any reason it should not be done this way? Did I miss any big gotchas? See any possible improvements? Or perhaps even have an altogether better alternative? I am, as they say, all ears :)&lt;/p&gt;&#xA;" OwnerUserId="1947" LastEditorUserId="1947" LastEditDate="2015-07-08T02:24:29.463" LastActivityDate="2015-07-12T05:11:19.243" Title="Multihomed Internet edge without BGP. Overlapping routes, a viable design?" Tags="|routing|internet|isp|network-access|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19764" PostTypeId="2" ParentId="19581" CreationDate="2015-07-07T21:00:28.650" Score="2" Body="&lt;p&gt;The purpose of TIME_WAIT is to allow the networking to distinguish packets that arrive as belong to the 'old, existing' connection from a new one.  The recommendation is to set the TIME_WAIT timer to twice the Maximum Segment Lifetime (MSL), on my system the MSL is 1 minute, so connections linger in the TIME_WAIT state for 2 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this amount of time any packets that arrive are no longer associated with the old connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIME_WAIT is not directly waited to sending ACK packets; that is driven by the CLOSE_WAIT and FIN_WAIT states.  When you get to TIME_WAIT state the socket is already closed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;References: &lt;a href=&quot;http://www.tcpipguide.com/free/t_TCPConnectionTermination-3.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.tcpipguide.com/free/t_TCPConnectionTermination-3.htm&lt;/a&gt; &lt;a href=&quot;https://en.wikipedia.org/wiki/Maximum_segment_lifetime&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Maximum_segment_lifetime&lt;/a&gt; &lt;a href=&quot;http://www.lognormal.com/blog/2012/09/27/linux-tcpip-tuning/&quot; rel=&quot;nofollow&quot;&gt;http://www.lognormal.com/blog/2012/09/27/linux-tcpip-tuning/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="999" LastActivityDate="2015-07-07T21:00:28.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19765" PostTypeId="2" ParentId="19759" CreationDate="2015-07-07T21:23:28.707" Score="1" Body="&lt;p&gt;The simplest way would be to allow one PC to go directly to the Internet, bypassing the proxy, and then compare that to using the proxy.  Make several connections to account for momentary congestion somewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another idea:  check the interface counters on your switches and look for output drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes, perceived &quot;slowness&quot; while browsing the Internet is actually a DNS issue, where names are slow to resolve.  You can try using an external nameserver (Google, for example) and see if that makes a difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You say you don't have access to the proxy server.  Ultimately, you will need to somehow get that administrator's cooperation if you are going to fully resolve this.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-07-07T21:23:28.707" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19766" PostTypeId="2" ParentId="19763" CreationDate="2015-07-07T21:32:30.813" Score="1" Body="&lt;p&gt;As long as you are fully meshed and the you can backhaul your own traffic arriving at one site but destined to the other, sure, it will work.  So if your peering session drops with either ISP, your more specific will be withdrawn (you HOPE!) and the traffic will flow to the aggregate route on the other ISP and you can then backhaul the traffic to the other site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most frustrating problem I see is network providers that advertise unreachable routes.  Either through some screwup internally or whatever, they announce a route to their peers that they can not actually reach inside their network.  There isn't much of a workaround for those cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the F5 handing reply traffic back via the interface on which it was received, most load balancers can do that. I don't specifically know if the F5 will but I know Citrix Netscaler will and A10 will so it seems to be a rather standard feature.&lt;/p&gt;&#xA;" OwnerUserId="15910" LastEditorUserId="15910" LastEditDate="2015-07-07T21:57:07.523" LastActivityDate="2015-07-07T21:57:07.523" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19767" PostTypeId="2" ParentId="19751" CreationDate="2015-07-07T21:32:42.563" Score="2" Body="&lt;p&gt;First, to clarify, the 802.11 standards are proposed and maintained by the &lt;a href=&quot;https://en.wikipedia.org/wiki/Institute_of_Electrical_and_Electronics_Engineers&quot; rel=&quot;nofollow&quot;&gt;IEEE&lt;/a&gt;, specifically the 802.11 working group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wi-Fi is a trademark of the &lt;a href=&quot;https://en.wikipedia.org/wiki/Wi-Fi_Alliance&quot; rel=&quot;nofollow&quot;&gt;Wi-Fi Alliance&lt;/a&gt; which provides a voluntary certification program for devices to be &lt;em&gt;Wi-Fi Certified&lt;/em&gt;. Devices do not need to be &lt;em&gt;Wi-Fi Certified&lt;/em&gt; to operate as 802.11 devices.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I am wondering if one buys a 802.11n conforming station, does it mean that it is able to behave as a 802.11g or 802.11a station if it exisits within 802.11a or g basic service set?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It should definitely be able to operate in a 802.11g environment as 802.11n requires 2.4GHz support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, 802.11a operates in 5GHz and 802.11n made 5GHz support optional, so there are two possibilities: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you have a single band (only supports 2.4GHz) 802.11n client, it would not be able to operate in an 802.11a environment.&lt;/li&gt;&#xA;&lt;li&gt;If you have a dual band (supports both 2.4GHz and 5GHz) 802.11n client, then it would be able to operate in an 802.11a environment.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I will throw out the caveat that some drivers will allow you to specify which band or bands in which a device will operate. So it logically follows that if you have configured your 802.11n dual band device to only operate in 5GHz, it won't be able to operate in an 802.11g environment (and vice versa).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If yes, can someone explain or give me references why?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Technically speaking, when you see something like 802.11g or 802.11n, these are amendments to the main 802.11 standard. They are typically not standards in and of themselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Periodically, the IEEE will incorporate these amendments into the main standard as a maintenance release. The current standard is 802.11-2012, which actually started with the 802.11-2007 standard and incorporated 10 additional amendments, including 802.11n.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to answer your question as to why, it is because 802.11a, 802.11g, 802.11n and 802.11ac are all amendments to the standard and need to take into account the standard when written/designed. This includes interoperability with previous devices that adhere to the standard.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-07-07T21:32:42.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19768" PostTypeId="1" AcceptedAnswerId="19784" CreationDate="2015-07-07T22:30:54.077" Score="3" ViewCount="15173" Body="&lt;p&gt;&lt;a href=&quot;http://www.clear.com&quot; rel=&quot;nofollow&quot;&gt;CLEAR&lt;/a&gt;, the major &lt;a href=&quot;https://en.wikipedia.org/wiki/WiMAX&quot; rel=&quot;nofollow&quot;&gt;WiMAX&lt;/a&gt; provider in the United States is shutting down its WiMAX service and radio towers in November 2015.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any use for their &lt;a href=&quot;http://www.clear.com/support&quot; rel=&quot;nofollow&quot;&gt;existing WiMAX modems&lt;/a&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is WiMAX used anywhere else? If so, might these modems be compatible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or do all these devices go to the recycling center/trash heap?&lt;/p&gt;&#xA;" OwnerUserId="16425" LastActivityDate="2022-12-11T01:09:23.930" Title="Any use for old CLEAR (WiMAX) modems?" Tags="|wireless|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19770" PostTypeId="2" ParentId="19721" CreationDate="2015-07-08T02:14:17.067" Score="2" Body="&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Previously Mentioned &quot;Floating Static Route&quot;&#xA;Yes, as described this will work. However, what if the connection between the routers and the ISP goes down? The ASA would not know about this and thus traffic would be dropped at that router. Further, what if the ISP is having an internal issue and the router, the links and even the routers next hop to the internet stay up? Again, the ASA would not know about this and traffic would then be dropped at that router. I would advise you steer away from this solution in a production network. Please do not take offense to this, just wanted to provide some feedback.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Missing Information:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Where will NAT be performed?&lt;/li&gt;&#xA;&lt;li&gt;Curious why you are using routers and not connecting each ISP into the ASA directly&lt;/li&gt;&#xA;&lt;li&gt;Plans to run BGP with your ISP&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Option 1:&lt;/strong&gt; ASA Handles Failover (IP SLA and Floating Static Route)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The below config sets up IP SLA to ping 8.8.8.8. &#xA;Then we start the sla monitor and set it to run forever. Then we verify (show commands) that the status shows OK and config looks correct. &#xA;If status is OK, then we add the floating static routes (like previously mentioned) but we add a track on this such that when we can no longer ping 8.8.8.8, the static route comes out and the only remaining default route is the route to the second router. &#xA;The below config assumes that your nameif for ISP1 is outside and your nameif for ISP2 is backup. You must replace x.x.x.x and y.y.y.y with the next-hop IP for the router. &#xA;I'm also assuming you want to run dynamic NAT off the ASA's interface that faces the routers.&#xA;ASA Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sla monitor 99&#xA; type echo protocol ipIcmpEcho 8.8.8.8 interface outside&#xA; num-packets 3&#xA; frequency 10&#xA;!&#xA;sla monitor schedule 99 life forever start-time now&#xA;!&#xA;track 99 rtr 99 reachability&#xA;!&#xA;show run sla monitor&#xA;!&#xA;show run track&#xA;!&#xA;show sla monitor operational-state 99 | include operation&#xA;!&#xA;show sla monitor operational-state 99&#xA;!&#xA;route outside 0.0.0.0 0.0.0.0 x.x.x.x 1 track 99&#xA;route backup 0.0.0.0 0.0.0.0 y.y.y.y 254&#xA;!&#xA;object network isp1-nat&#xA; subnet a.b.c.0 255.255.255.0&#xA; nat (inside,outside) dynamic interface&#xA;!&#xA;object network isp2-nat&#xA; subnet a.b.c.0 255.255.255.0&#xA; nat (inside,backup) dynamic interface&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Option 2:&lt;/strong&gt; HSRP and a Switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say you are not going to NAT on the ASA or you could NAT on the ASA and on the router. I'd suggest picking one place closest to the &quot;inside&quot; network you want to translate (NAT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connect the Routers inside interface and just the &quot;outside&quot; interface of the ASA into a switch, place each of these ports into their own VLAN.&#xA;Configure HSRP on the routers and point the ASA's default route to the HSRP VIP.&#xA;&lt;strong&gt;NOTE&lt;/strong&gt;: GLBP load balancing (round robin) will not work here as the source MAC address will not change, thus you'll be locked to one of the routers all the time. VRRP is also acceptable here, whichever one you feel comfortable with.&#xA;Use &quot;Track&quot; with HSRP to track the interface BUT also setup IP SLA, like we did on the ASA on the primary router connected to the primary ISP. I would also suggest, adjusting HSRP timeouts and setting an HSRP password for added security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Learn more:&lt;/em&gt; &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp/configuration/15-s/iap-15-s-book/iap-eot.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp/configuration/15-s/iap-15-s-book/iap-eot.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router1:&#xA;interface gi0/0&#xA; description outside&#xA; ip address x.x.x.x x.x.x.x&#xA; ip nat outside&#xA; no shutdown&#xA;!&#xA;ip sla 99&#xA; icmp-echo 8.8.8.8 source-interface GigabitEthernet0/0&#xA; request-data-size 1&#xA; tos 160&#xA; timeout 2000&#xA; threshold 2000&#xA; frequency 15&#xA; hours-of-statistics-kept 8&#xA;!&#xA;ip sla schedule 99 life forever start-time now&#xA;!&#xA;track 99 ip sla 99 reachability&#xA; delay down 40&#xA;!&#xA;interface gi0/1&#xA; description inside HSRP VIP: a.b.c.1&#xA; ip address a.b.c.11 255.255.255.0&#xA; standby 1 ip a.b.c.1&#xA; standby 1 preempt&#xA; standby 1 priority 105&#xA; standby 1 track 99&#xA; ip nat inside&#xA;!&#xA;ip access-list standard NAT&#xA; permit a.b.c.0 0.0.0.255&#xA;!&#xA;ip nat inside source list NAT interface gi0/0 overload&#xA;&#xA;&#xA;router2:&#xA;interface gi0/0&#xA; description outside&#xA; ip address x.x.x.x x.x.x.x&#xA; ip nat outside&#xA; no shutdown&#xA;!&#xA;interface gi0/1&#xA; description inside HSRP VIP: a.b.c.1&#xA; ip address a.b.c.12 255.255.255.0&#xA; standby 1 ip a.b.c.1&#xA; ip nat inside&#xA; no shutdown&#xA;!&#xA;ip access-list standard NAT&#xA; permit a.b.c.0 0.0.0.255&#xA;!&#xA;ip nat inside source list NAT interface gi0/0 overload&#xA;&#xA;&#xA;ASA config:&#xA;route outside 0.0.0.0 0.0.0.0 a.b.c.1 1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Option 3:&lt;/strong&gt; Dynamic Routing Foo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everybody has their reasons for not to do this, but this is still an option. Although you could run other routing protocols, running EIGRP would be an acceptable solution here I think.&#xA;You could connect the 2 routers and the ASA to a switch and place them in their own VLAN. Then you could fire up EIGRP, advertise a default route from both routers to the ASA and you'll have redundant paths (load balancing). However load balancing in this scenario may yield undesirable results, so just adjust the metric (Bandwidth or Delay) on the ISP2 router and voila. &#xA;I'm not going to write up a config for this as it is pretty straightforward to do.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Closing:&lt;/strong&gt;&#xA;I do not believe there is one right answer, however there are options to accomplish the task you desire. I would look at the options and weigh the pro's and con's. Besides you can always revert your changes and tweak things to get them working the way you want. &#xA;I would also suggest taking a look at hardening those routers. This guide is old but has helped me many times in the past. You may have to translate some commands over to newer version of IOS but still good reading here: &lt;a href=&quot;http://www.sans.org/reading-room/whitepapers/firewalls/cisco-router-hardening-step-by-step-794&quot; rel=&quot;nofollow&quot;&gt;http://www.sans.org/reading-room/whitepapers/firewalls/cisco-router-hardening-step-by-step-794&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Happy Networking to you!&lt;/p&gt;&#xA;" OwnerUserId="881" LastEditorUserId="881" LastEditDate="2015-07-08T02:21:12.883" LastActivityDate="2015-07-08T02:21:12.883" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19772" PostTypeId="1" AcceptedAnswerId="19797" CreationDate="2015-07-08T03:34:42.367" Score="1" ViewCount="2829" Body="&lt;p&gt;I'm having a modem with a built-in router, that connects to the internet through the 4g-network (productname: &lt;code&gt;Huawai&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To this modem, I have a router connected in Lan1 (productname: &lt;code&gt;ZyXEL&lt;/code&gt;). So my Huawai gets the internet and passes it on to my ZyXEL. I'm connected to the wireless-LAN on the ZyXEL. I'm using this setup, since the wireless-signal on the ZyXEL is stronger than on the Huawai (and the ZyXEL can't connect to the internet). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an IP-camera connected to the ZyXEL, that I would like to be able to access from an external IP-address. &#xA;   I've Googled around, and it looks like, that I should do a port-forwarding to the given IP-address, in the router. I assume, that I have to do it in the Huawai-router, since that's the most-outer point of my network. However... I can access my Huawai-router by going to a browser and going to this IP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I can access my ZyXEL-router by going to a browser and going to this IP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see that my own IP is 10.0.0.35 (which makes sense, since I'm connected to the ZyXEL-router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Can I change the IP of the ZyXEL-router to be 192.168.1.2, so that the two routers are in the same IP-range? Or would that reck something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Would it be better (and possible), if I just do a port-forward from my Huawai-router to the IP-cameras IP (which is 10.0.0.33, since that is connected to the ZyXEL). I mean, is that possible, since it's a different IP-range, or am I getting this all wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Or am I trying to do something idiotic this way, by having two routers? Would it be better to simply throw the ZyXEL-router out, live with 2 bars instead of 4 and then set it all up with a single router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) And how do I know, which port it would be smart to do the forwarding from. I can find several articles on Google, that I should choose the port that I forward with caution - but I can find nothing about, which one(s) to choose?&lt;/p&gt;&#xA;" OwnerUserId="16430" LastActivityDate="2019-01-09T23:36:11.043" Title="Can two routers be in same IP-range?" Tags="|router|ipv4|lan|" AnswerCount="1" CommentCount="4" ClosedDate="2015-07-08T23:01:47.050" ContentLicense="CC BY-SA 3.0" />
  <row Id="19773" PostTypeId="2" ParentId="19763" CreationDate="2015-07-08T04:18:04.747" Score="2" Body="&lt;p&gt;Regarding availability, depending on your SLA requirements, the manual failover from one ISP to another by calling the ISP and requesting the route be removed sounds like a procedure that would exceed an SLA. BGP routes do not change rapidly like internal routing protocols which makes me worried as to how long the change is going to take. Further if a ISP is having issues the reality they'll have staff available to satisfy your request in a timely manner also sounds risky to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on SLA's I would want to have both ISP1 and ISP2 at both SiteA and SiteB. I would then want to run BGP with both ISP's. This would allow for automatic failover. However, it sounds like the option we all want to see is out of scope/budget.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would just suggest monitoring the BGP paths with something like thousandeyes.com. You can set this up to send you email alerts should a path change, which may allow you to detect an issue before the ISP reports this to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The diagram you have up, looks like you have Cisco ASR which makes me think ASR1001 or something similar. If so, that's a great device to run BGP w/ your service provider. The only other device I see you could run BGP on (not sure how well it works) is the F5. This is with the mindset of keeping costs low.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The unique challenge here is a different ISP at each location and attempting a level of redundancy for inbound traffic to your SaaS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another idea would be to advertise only one prefix from one ISP and another prefix from another ISP. Setup the F5 with a VIP in each prefix at their respective locations prefix A at Site A with ISP1 and then prefix B at Site B with ISP2. Then use DNS to fail clients or load balance clients to your SaaS. If you set the TTL value on your DNS entries to 30 seconds, this could be near automatic. DynDNS has a load balancing option and a certain health check (is the server up, if not change DNS to the standby IP). Further you could write your own health checks to DynDNS's API and make the change that way should your script detect an event that would execute a command to change DNS. I would see making a DNS change as being much quicker versus calling your ISP to have BGP routes removed from being advertised because ISP's can be challenging to get things done and BGP does not converge fast at all.&lt;/p&gt;&#xA;" OwnerUserId="881" LastEditorUserId="881" LastEditDate="2015-07-08T04:23:41.670" LastActivityDate="2015-07-08T04:23:41.670" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19775" PostTypeId="2" ParentId="6212" CreationDate="2015-07-08T05:13:45.040" Score="0" Body="&lt;p&gt;I suspect that Split Tunneling may not be supported with L2TP over IPSec. Could you try the following for me?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;!&#xA;same-security-traffic permit intra-interface&#xA;!&#xA;object network vpn_nat&#xA; nat (outside,outside) dynamic interface&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also noticed the DNS server configuration is missing in your updated Group Policy.&lt;/p&gt;&#xA;" OwnerUserId="881" LastEditorUserId="881" LastEditDate="2015-07-08T05:22:18.757" LastActivityDate="2015-07-08T05:22:18.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19776" PostTypeId="2" ParentId="19578" CreationDate="2015-07-08T05:47:05.023" Score="2" Body="&lt;p&gt;I agree with Ricky Beam. You'll have to get a packet capture of the Firewall to see if you are receiving responses for a spoofed broadcast request not made by the SonicWall. Only then would we see if a Smurf / Fraggle attack is happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would check performance statistics and logs on the AP's (wireless) and the SonicWall Firewll. I'd get SNMP setup to look at bandwidth utilization. Start ruling things out.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What does your bandwidth utilization look like on the SonicWall when users report the time they experienced this issue? What's the SonicWall's bandwidth capability? Does the utilization supersede the capability?&lt;/li&gt;&#xA;&lt;li&gt;If you suspect a Smurf/Fraggle DDoS attack, configure the SonicWall to not respond to ICMP requests or broadcasts. Look in logs and packet captures to find the bogus broadcast replies.&lt;/li&gt;&#xA;&lt;li&gt;Configure SonicWall to not forward packets directed to a broadcast addresses.&lt;/li&gt;&#xA;&lt;li&gt;SNMP of SonicWall, look at CPU/RAM utilization. When it is high, is traffic being dropped?&lt;/li&gt;&#xA;&lt;li&gt;Setup Splunk free version to start capturing logs and have a look at what is happening.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="881" LastEditorUserId="881" LastEditDate="2015-07-08T05:54:27.157" LastActivityDate="2015-07-08T05:54:27.157" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19777" PostTypeId="2" ParentId="17498" CreationDate="2015-07-08T06:14:16.083" Score="2" Body="&lt;p&gt;This post is older in age so I'm not sure if you are still experiencing this problem. I would like to see the documentation you are referring too regarding the portfast trunk command. The portfast trunk configuration should be applied to hosts that you are trunking with, for example an ESX host or a Load Balancer. For switch to switch, this configuration should not be there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a lot of information I would need to see to better understand the topology and what spanning-tree mode you are running in (PVST+, RPVST+ or MST). I suspect from what I've read you are running PVST+. I would like to first start with the output of show spanning-tree vlan x detail and a snippet of this TCN you are seeing. I would also like to see show run | i spanning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect you may have a port(s) that is flapping and the TCN message should lead us directly to the culprit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you have a VoIP phone plugged into a switchport that is configured switchport access vlan  and computers/hosts plugged into other switchports with switchport access vlan ? Yeah you know you can set it up for switchport voice vlan. However being setup without the switchport voice vlan, I do not see this being an issue with TCN's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCN's are generated when a port transitions from one state to another assuming you are not changing the priority values.&lt;/p&gt;&#xA;" OwnerUserId="881" LastActivityDate="2015-07-08T06:14:16.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19778" PostTypeId="2" ParentId="17188" CreationDate="2015-07-08T06:33:50.410" Score="2" Body="&lt;p&gt;Could you test this out, after hours, requires a switch reboot?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch Config:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;!&#xA;system mtu jumbo 9000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Windows Server 2008R2 config:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;adjust MTU to 9000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This may help. Take a look at this article if you haven't already figured this out: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/118634-technote-eap-00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/8021x/118634-technote-eap-00.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="881" LastActivityDate="2015-07-08T06:33:50.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19779" PostTypeId="2" ParentId="16698" CreationDate="2015-07-08T06:58:22.147" Score="1" Body="&lt;p&gt;I realize this post is old but I wanted to follow up on this one, just in case you have this issue hanging out there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just curious if the IP address you are trying this NAT on, outside global, is also on the same VRF as the client. If so, you may want to try: match-in-vrf&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static tcp 10.1.10.201 22 x.x.x.x 22 vrf Customer1-vrf route-map Customer1-portforwarding match-in-vrf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would also try two other methods:&#xA;1.) modify your ACL for the route-map, to have the same source as the IP you want to NAT them too. If we read left to right on the NAT rules it may not analyze this until after the translation occurs.&#xA;2.) try ip nat outside source static tcp...&#xA;I'm not sure which one would work but it'd be good to see a debug like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 99 permit host 10.1.10.201&#xA;access-list 99 permit host x.x.x.x&#xA;!&#xA;debug ip nat 99&#xA;!&#xA;terminal length 0&#xA;!&#xA;show log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="881" LastActivityDate="2015-07-08T06:58:22.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19783" PostTypeId="2" ParentId="1657" CreationDate="2015-07-08T07:36:17.350" Score="0" Body="&lt;p&gt;Set up the DHCP on the router's gateway interface or use 'ip helper' to direct requests to DHCP server. The more centralized your network, the easier it is to manage as it grows.&lt;/p&gt;&#xA;" OwnerUserId="16432" LastActivityDate="2015-07-08T07:36:17.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19784" PostTypeId="2" ParentId="19768" CreationDate="2015-07-08T07:46:50.110" Score="5" Body="&lt;p&gt;To be accurate, &lt;em&gt;Sprint&lt;/em&gt; is shutting down WiMax to use the spectrum for LTE. They were, to my knowledge, the only WiMax operator in the US.  If you read the wiki article you linked, you'd see the &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_WiMAX_networks&quot; rel=&quot;noreferrer&quot;&gt;List of WiMAX networks&lt;/a&gt;. However, that list doesn't mean there are (or were) &lt;em&gt;operational&lt;/em&gt; networks -- some of the entries list &quot;spectrum licenses&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other countries do still have WiMax networks, but I doubt you could recode the modem to work on those networks. The clearwire branded gear have 802.1x certificates specific to the Clear network, and no interface for the user to mess with them. A big enough operator might be able to reset them, but why would they bother? (I'd like to see them reused, too. But they're 99% e-waste now.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-08T07:46:50.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19785" PostTypeId="2" ParentId="19347" CreationDate="2015-07-08T08:28:02.583" Score="0" Body="&lt;p&gt;This can't be done - I misunderstood DSL technologies. It's not like Ethernet / FastEthernet / GigE where they all work together at different rates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 x SHDSL cards can be configured as a back to back connection but ADSL won't co-operate on a line with SHDSL.&lt;/p&gt;&#xA;" OwnerUserId="106" LastActivityDate="2015-07-08T08:28:02.583" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19786" PostTypeId="2" ParentId="16062" CreationDate="2015-07-08T08:38:46.313" Score="-1" Body="&lt;p&gt;If you want &quot;hot swappable,&quot; the device names will have to be independent of their location. You'll need to keep track of device MAC addresses on a chart with an easy corresponding Minion name like &quot;Bob.&quot; Then configure the device with that name or description &quot;Bob.&quot; This way when network monitoring reports issues only the description or name matters to check the chart. You just have to keep track on the chart where you put the devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches are more concerned with physical addresses than ip addresses. However, each floor could use its own vlan with its own dhcp server. Then you can create a named vlan for each floor like &quot;grow_rooms_1-12&quot; with /28 subnet mask. You can also give each port a description like &quot;to grow room 1.&quot; These are great management aids if you are watching your network via command line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also alter size of rooms to improve efficiency of lighting, humidity, and temperature which could also reduce monitoring devices.&lt;/p&gt;&#xA;" OwnerUserId="16432" LastActivityDate="2015-07-08T08:38:46.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19787" PostTypeId="2" ParentId="596" CreationDate="2015-07-08T08:47:10.713" Score="0" Body="&lt;p&gt;The CAM table on the switch matches the MAC address to the device port. Use 'show mac address-table' on the switch. You can also configure port descriptions to help find devices later too.&lt;/p&gt;&#xA;" OwnerUserId="16432" LastActivityDate="2015-07-08T08:47:10.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19788" PostTypeId="2" ParentId="1592" CreationDate="2015-07-08T09:10:56.310" Score="0" Body="&lt;p&gt;Switches forward one packet at a time as they enter switch so no collisions. Then PC3 will process packets from PC1 &amp;amp; PC2 dividing its cpu time. Windowing and buffering will control communication flow.&lt;/p&gt;&#xA;" OwnerUserId="16432" LastActivityDate="2015-07-08T09:10:56.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19789" PostTypeId="2" ParentId="19532" CreationDate="2015-07-08T09:29:03.130" Score="2" Body="&lt;p&gt;Yes, only user plane traffic (GTP-U) is offloaded directly from RNC to GGSN with 3GDT. Signalling (GTP-C) on Iu-C and Gn-C interfaces is as normal.&lt;/p&gt;&#xA;" OwnerUserId="672" LastEditorUserId="672" LastEditDate="2015-08-18T18:07:19.067" LastActivityDate="2015-08-18T18:07:19.067" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19790" PostTypeId="2" ParentId="19578" CreationDate="2015-07-08T10:07:38.013" Score="1" Body="&lt;p&gt;If this was an attack, your network was used as one of many launching pads. The port 80 is http and 443 is https. Your private network was going out to:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;173.252.103.15:443 FACEBOOK-INC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;190.248.95.111:443 EPM Telecomunicaciones&lt;/p&gt;&#xA;&#xA;&lt;p&gt;31.13.73.3:443 Facebook, Inc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;65.55.68.119:443 Microsoft&lt;/p&gt;&#xA;&#xA;&lt;p&gt;65.55.223.47:80 Microsoft&lt;/p&gt;&#xA;&#xA;&lt;p&gt;151.227.234.156:6419 Sky Broadband&lt;/p&gt;&#xA;&#xA;&lt;p&gt;132.245.3.210:443 Microsoft&lt;/p&gt;&#xA;&#xA;&lt;p&gt;203.104.160.11:443 Naver Business Platform&lt;/p&gt;&#xA;&#xA;&lt;p&gt;74.125.21.94:443 Google&lt;/p&gt;&#xA;&#xA;&lt;p&gt;158.85.58.10:5222 SoftLayer Technologies Inc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;201.232.123.21:80 lacnic.net&lt;/p&gt;&#xA;&#xA;&lt;p&gt;54.191.205.188:80 Amazon.com, Inc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;64.236.122.15:80 AOL Transit Data Network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;65.55.68.119:443  MICROSOFT&lt;/p&gt;&#xA;" OwnerUserId="16432" LastActivityDate="2015-07-08T10:07:38.013" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19791" PostTypeId="2" ParentId="19052" CreationDate="2015-07-08T10:25:24.343" Score="-1" Body="&lt;p&gt;Traffic will still go through the 2 ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;speed/duplex match&lt;/p&gt;&#xA;&#xA;&lt;p&gt;protocols match&lt;/p&gt;&#xA;&#xA;&lt;p&gt;one side initiates protocol communication&lt;/p&gt;&#xA;" OwnerUserId="16432" LastActivityDate="2015-07-08T10:25:24.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19793" PostTypeId="2" ParentId="12455" CreationDate="2015-07-08T10:51:22.080" Score="1" Body="&lt;p&gt;To be honest I barely understand what you want or trying to accomplish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in any case, you can only have one static lease per MAC Address or IP Address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to have more than one is to disable the current lease and add the new one. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then disable/enable whichever lease you need each time.&lt;/p&gt;&#xA;" OwnerUserId="1418" LastActivityDate="2015-07-08T10:51:22.080" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19794" PostTypeId="1" CreationDate="2015-07-08T11:50:20.187" Score="1" ViewCount="68" Body="&lt;p&gt;I would like to express that I do IP spoofing, but do not use it for an attack. Since IP spoofing seems to be always used in combination with performing an attack, I wonder if there is a word with the same meaning, but without the negative&lt;/p&gt;&#xA;" OwnerUserId="16441" LastEditorUserId="3191" LastEditDate="2015-07-08T12:02:11.617" LastActivityDate="2015-08-08T09:44:15.470" Title="IP spoofing not used for attacking - wording?" Tags="|ip|terminology|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19797" PostTypeId="2" ParentId="19772" CreationDate="2015-07-08T13:08:59.940" Score="4" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Change your Zytel routers IP to 192.168.1.2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Disable the DHCP on the Zytel and enable it on the Huawei.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This will allow the Huawei to handout/assign IP's + dns and gateway settings.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Your camera will also get a new ip in the 192.168.1.x range.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now do the port forwarding for the new Cam ip on the Huawei.  Remember to consider security/access control.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;If your Camera is wireless, you might also consider connecting it directly to the Huawei on a different wifi channel+ssid and leave your other devices on the Zytel.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2019-01-09T23:36:11.043" LastActivityDate="2019-01-09T23:36:11.043" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19798" PostTypeId="1" CreationDate="2015-07-08T13:39:04.077" Score="0" ViewCount="1047" Body="&lt;p&gt;I've read through some of the differences between a subnet and VLAN but I'm having a hard time figuring out if I'm actually utilizing a VLAN properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My switch by default is on the 10.0.0.0/24 network. It is considered an untagged network because there's no VLAN on it. Any computer can join this subnet and read broadcast traffic. Am I correct to assume the last sentence is right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then create on the switch say VLAN 10 with a network of 10.0.10.0/24. I set a static IP of 10.0.10.11/24 on my computer and 10.0.10.12/24 on another computer. Lets say both are Mac running OS X 10.10. The switch port for both Macs are set to all (4096).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I did not &quot;tag&quot; the NIC of either Mac, how am I still able to talk to the other Mac through file sharing, SSH, etc? Isn't this VLAN 10 I created on 10.0.10.0/24 required to have both Mac's tagged to access it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now lets say if I add a third device, a linux box, with its interface tagged for VLAN 10. It has an IP of 10.0.10.13/24. Can I ssh into either Mac?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the difference between tagging a switch port vs NIC? Can a tagged NIC still talk on the same subnet of other untagged devices?&lt;/p&gt;&#xA;" OwnerUserId="16447" LastActivityDate="2015-07-08T16:55:22.177" Title="Am I on a vlan or virtual subnet?" Tags="|vlan|subnet|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="19800" PostTypeId="2" ParentId="19798" CreationDate="2015-07-08T14:03:05.573" Score="3" Body="&lt;p&gt;Let's see if I can make things clearer.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, VLANs are a layer 2 construct, and subnets are a layer 3 construct.  It is true that in most cases there is a 1:1 relationship between them (i.e., one VLAN per subnet, and vice versa), but that doesn't mean they are the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches, being a layer two device, forward packets based on MAC addresses and never look at IP addresses.  So in the context of a switch, it's wrong to say that a VLAN has a particular subnet on it.  The switch doesn't know or care.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the end devices (hosts or routers) on a VLAN that define the IP subnet. If they're all configured for the 10.0.10.0/24 network , then that's what it is.  If you change the IP subnet on your hosts, you have changed the subnet for that VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The term &quot;tagging&quot; applies to the 802.1q protocol, which is a variation of &quot;standard&quot; ethernet protocol.  In fact most PCs, Macs, etc, can not understand the 802.1q protocol -- they simply ignore it.  So when you say &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My Mac is tagged on VLAN 10&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That doesn't quite make sense.  The switch port your Mac is plugged into accepts untagged frames, and if you've configured it, also tagged frames (802.1q frames).  Your Mac however only sends and receives untagged frames, regardless of how many different VLANs are tagged on that port.  In other words, it is unaware that there are tagged frames being sent out that port, because it doesn't understand them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whatever VLAN is untagged on the port you MAC is plugged into, is the VLAN your MAC is on.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for example, unless you've changed the configuration, VLAN 1 is untagged on all ports.  So, by default, any port you plug a MAC or PC into will send and receive frames on VLAN 1, because that VLAN is untagged on all the ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you want to create a new VLAN (10), and only have some devices use it, you will set those ports to send VLAN 10 untagged (In the Cisco world, you set VLAN 10 as the &quot;native&quot; VLAN on the ports).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If two PCs are on switch ports 1 and 2, and you set only those ports to have VLAN 10 untagged, then they will only be able to send frames to each other.  All other ports will still use VLAN 1 (untagged).  Hosts on VLAN 1 and hosts on VLAN 10 can't talk to each other&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default VLAN (usually VLAN 1) is still a VLAN, and has the same properties as any other.  VLANS are tagged or untagged when one talks about port configuration. The same VLAN can be tagged on one port and untagged on another.  There is no such thing as a &quot;tagged&quot; or &quot;untagged&quot; network.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-07-08T16:55:22.177" LastActivityDate="2015-07-08T16:55:22.177" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19801" PostTypeId="1" AcceptedAnswerId="19808" CreationDate="2015-07-08T14:32:16.593" Score="2" ViewCount="864" Body="&lt;p&gt;So I have a rudimentary understanding of working with basic networking tools, things like using &lt;code&gt;nmap&lt;/code&gt; to scan ports and find IP addresses on internal networks, and &lt;code&gt;ssh&lt;/code&gt; for connecting to various devices. I am a bit confused about how all of this will change with the transition from IPv4 to IPv6. I understand that IPv6 addresses will look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FE80:0000:0000:0000:0202:B3FF:FE1E:8329&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which seems a lot longer than IPv4 addresses like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;202.202.0.113&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;although IPv6 addresses can be collapsed by using the &lt;code&gt;::&lt;/code&gt; to represent two to eight contiguous blocks of zeroes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The architecture change from IPv4 to IPv6 is obviously unavoidable for the global internet to continue to function, but will internal networks (like the familiar &lt;code&gt;192.168.x.x&lt;/code&gt; addresses in most home routers) transition to IPv6 alongside the rest of the internet, or are internal networks more likely to stick with IPv4, and have the network translate outgoing and incoming packets between IPv4 and IPv6?&lt;/p&gt;&#xA;" OwnerUserId="16448" LastEditorUserId="8499" LastEditDate="2015-07-08T16:53:55.490" LastActivityDate="2015-07-08T19:19:38.843" Title="Will home networks migrate to ipv6?" Tags="|ipv4|ipv6|ip|ipv6-transition|" AnswerCount="1" CommentCount="5" ClosedDate="2015-07-10T05:19:35.900" ContentLicense="CC BY-SA 3.0" />
  <row Id="19802" PostTypeId="1" AcceptedAnswerId="19806" CreationDate="2015-07-08T17:04:43.080" Score="4" ViewCount="17995" Body="&lt;p&gt;This thread is to continue &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/19737/tcpdump-filter-by-mac-address&quot;&gt;my previous one, where I was talking about the TCPDump command.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is still something I don't get.  According to &lt;a href=&quot;http://www.ihtb.org/security/tcpdump-explained.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;this website&lt;/a&gt; (and some others), and according to my tests, one of the goals of TCPDump is exactly to intercept and display the communications of another user or&#xA;computer. So basically it can sniff everything on the network, and when&#xA;data are not encrypted we should be able to read them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please tell me if I am right about the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's talk about a wireless network where devices A, B, and C are connected to a WiFi access point. A, B, and C are all on the same network, let say 10.11.204.__ where A is 10, B is 20, and C is 30 for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Situation 1)&lt;/strong&gt; In normal times if A wants to communicate with B, it will&#xA;send out a packet with the IP Address of B in the header.  So if the third&#xA;device, C, is on the same network it will receive the packet addressed&#xA;to B, but will see that the IP address is different that its own and will&#xA;drop the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Situation 2)&lt;/strong&gt; When using TCPDump in the exact same situation (A sends a&#xA;packet to B, with B IP in the header), C will receive the packet and will&#xA;see that it is not addressed to him but will not drop it.  And we will&#xA;be able to read any part of the packet that is not encrypted. (So&#xA;usually it is only the header).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it work like that?  If it does, I don't understand why I can&#xA;not read packets on my computer when I surf the web with my iPhone.  I have also some issues with certain Android devices, for these devices I can only read &quot;Echo&quot; requests and &quot;Echo&quot; responses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is blurred in my mind, I like networking and I would like to&#xA;understand that point. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="16335" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-07-09T02:04:34.007" Title="TCPDump and listening to wifi traffic of others" Tags="|ieee-802.11|tcpdump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19804" PostTypeId="1" AcceptedAnswerId="19809" CreationDate="2015-07-08T17:16:02.533" Score="1" ViewCount="2600" Body="&lt;p&gt;&lt;strong&gt;Hello,&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am in the process of configuring a new network layout for my computer repair business using a Cisco RV320 Router, SMC SMCGS26C-Smart managed switch and a D-Link DAP-2660 WAP.  My goal is to have 2 separate VLANs, one for internal business computers and one for computers being serviced so that I can have the service computers connect to the internet without having access to my business' systems.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I have been able to get the Router and WAP to separate connected devices into their appropriate VLANs based on the SSID that the client system connects to.  I am now trying to do the same with the SMC managed switch, but I am running into a wall with it.  I am new to VLANs and I think I am just having a mental block with the terminologies that SMC uses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my current configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;VLANs&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN ID 1 is default&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN ID 1001 is for internal business computers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN ID 1002 is for service computers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco RV320&lt;/p&gt;&#xA;&#xA;&lt;p&gt;D-Link WAP is connected to LAN Port 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SMC Switch is connected to LAN Port 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs are configured as described in the VLAN information above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN ID 1 DHCP is set to assign 192.168.100.X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN ID 1001 DHCP is set to assign 192.168.0.X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN ID 1002 DHCP is set to assign 192.168.1.X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/0pZZE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I am able to connect on ports 1 and 2 of the switch on the default VLAN ID 1 and get IP addresses automatically assigned in the 192.168.100.x range.  If I connect to any of the other ports I am unable to get an IP address assigned from the router.  My end goal is to have ports 3-6 on VLAN ID 1001 and have the router automatically assign an IP in the 192.168.0.x range and for connections on ports 7-26 on VLAN ID 1002 with the router automatically assigning in the IP range of 192.168.1.X range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SMC SMCGS26C-Smart&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Manual can be downloaded here: &lt;a href=&quot;http://www.smc.com/en-global/download/downloadFile/353&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.smc.com/en-global/download/downloadFile/353&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs are configured as described in the VLAN section above&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port 1 is intended to be a management port&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port 2 is connected to the Router (on Router LAN Port 2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ports 3-6 are for internal business computers on VLAN ID 1001&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ports 7-26 are for service systems on VLAN ID 1002&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/eLqxX.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure my settings on this page are where my problem lies.  I'm just not sure what I have configured incorrectly.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/WD8He.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help that anybody here can provide would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="16449" LastActivityDate="2017-12-09T08:08:53.910" Title="Need Help Configuring VLANs on SMC Managed Switch" Tags="|switch|vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19805" PostTypeId="2" ParentId="10560" CreationDate="2015-07-08T17:30:13.427" Score="0" Body="&lt;p&gt;you cannot put 2 default route on ASA &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# route Outside-ISP1 0.0.0.0 0.0.0.0 1.1.1.1&#xA;ciscoasa(config)#&#xA;ciscoasa(config)#&#xA;ciscoasa(config)# route Outside-ISP2 0.0.0.0 0.0.0.0 2.1.1.2&#xA;ERROR: Cannot add route entry, conflict with existing routes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can use 1 default and and others specific rote to other isp&lt;/p&gt;&#xA;" OwnerUserId="16450" LastEditorUserId="509" LastEditDate="2015-07-08T20:39:12.010" LastActivityDate="2015-07-08T20:39:12.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19806" PostTypeId="2" ParentId="19802" CreationDate="2015-07-08T18:36:52.897" Score="8" Body="&lt;p&gt;A standard TCPDump, without any modifications to the mode of the Wireless NIC, will not display ALL frames traversing the wireless network.  It will only display frames directed at (and capable of being received by) your station.  TCPDump is just grabbing the information that is specifically delivered to your station, decrypted, and presented to the OS at the normal Ethernet/IP level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To listen to ALL frames reaching your station on the wireless network, you'll need have a NIC capable of running in Monitor mode, and then put your NIC into Monitor mode.  While in Monitor mode, you won't be able to send traffic, only to observe all frames on the channel.  This is done similarly to the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iw phy phy0 interface add wlan2 type monitor&#xA;iw dev wlan2 set freq 2412&#xA;ifconfig wlan2 up&#xA;&#xA;tcpdump -i wlan2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://wireless.wiki.kernel.org/en/users/documentation/iw&quot; rel=&quot;noreferrer&quot;&gt;Read the documentation&lt;/a&gt; on &lt;code&gt;iw&lt;/code&gt; for more information, and &lt;a href=&quot;http://sandilands.info/sgordon/capturing-wifi-in-monitor-mode-with-iw&quot; rel=&quot;noreferrer&quot;&gt;also, see &lt;strong&gt;this&lt;/strong&gt; page for some good information&lt;/a&gt; on using &lt;code&gt;iw&lt;/code&gt; for monitoring, with an example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As noted by @ylearn in the comments, your station will only be able to capture frames under specific circumstances (Some more obvious than others):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Be in range of the sending station (duh)&lt;/li&gt;&#xA;&lt;li&gt;Be of the same type as the sending station (single vs multiple spacial streams for example)&lt;/li&gt;&#xA;&lt;li&gt;Be listening to the same channel/frequency as the sending station (listening to 2.4 GHz channels won't help you capture 5Ghz traffic, etc)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And there are more conditions, but the bottom line is that wireless networks are wireless, so there's no guarantee of delivery of traffic and therefore no guarantee of receipt on your Monitoring station. :)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now with all of that said, you may have all the frames that are being transmitted, but you would still need to decrypt the frames.  This a large topic in and of itself, however the basics are this: the frames that any 802.11 station sends into the air are sent encrypted so that not just anyone can sniff all connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://wiki.wireshark.org/HowToDecrypt802.11&quot; rel=&quot;noreferrer&quot;&gt;Wireshark has a nice intro page on Decyrypting 802.11&lt;/a&gt;.  I recommend reading that, understanding it, and moving on from there.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit to respond to your comments, @phenetas:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, as alluded to in my response, I was assuming your OS was Linux in my answer so I recommended using &lt;code&gt;iw&lt;/code&gt;.  If you're serious about learning more about penetrating 802.11 networks, I'd recommend looking into a linux distro such as &lt;a href=&quot;https://www.kali.org/&quot; rel=&quot;noreferrer&quot;&gt;Kali Linux, which is designed for exactly that purpose&lt;/a&gt;.  (Use this power only for good please; with great power comes great responsibility, etc, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you're insistent on using MAC OSX, you have other options as well to put the NIC into monitor mode (including just using &lt;a href=&quot;https://www.wireshark.org/download.html&quot; rel=&quot;noreferrer&quot;&gt;Wireshark&lt;/a&gt; instead of TCPDump).  Some Googling around for MAC OSX monitor mode should help you there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, I would look into reading more about &lt;a href=&quot;https://en.wikipedia.org/wiki/Broadcast_address&quot; rel=&quot;noreferrer&quot;&gt;IP Broadcasts&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Multicast_DNS&quot; rel=&quot;noreferrer&quot;&gt;mDNS (Multicast DNS)&lt;/a&gt; as that is what you're seeing initially from the other devices.  These are not &quot;intercepted&quot; packets, this &lt;strong&gt;IS&lt;/strong&gt; traffic destined to your device, that is why TCPDump is displaying the packets.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2015-07-09T01:59:18.040" LastActivityDate="2015-07-09T01:59:18.040" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19807" PostTypeId="1" AcceptedAnswerId="19813" CreationDate="2015-07-08T18:40:15.480" Score="0" ViewCount="792" Body="&lt;p&gt;We will rebuild our network in a few months and have installed a &quot;network rack&quot; with patch panels where our switches also will be mounted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will have 96 10GE switch ports and 96 ports in the patch panels. But how do you best manage the optical cables so it won't end up like this: &#xA;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/19631/where-should-i-start-when-it-comes-to-organizing-my-switches&quot;&gt;Where should I start when it comes to organizing my switches?&lt;/a&gt; :)&lt;/p&gt;&#xA;" OwnerUserId="16331" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-07-09T19:28:51.160" Title="Best practice when it comes to cable management of optical fibers" Tags="|switch|cabling|patch-panel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19808" PostTypeId="2" ParentId="19801" CreationDate="2015-07-08T19:19:38.843" Score="3" Body="&lt;p&gt;Home networks and mobile devices are usually the first to get IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is because the devices running those networks are often provided and managed by the ISP. ISPs use lots of IPv4 addresses so they feel the pain of running out. They will need to share IPv4 addresses (NAT, CGN) between their customers to be able to provide connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those big central NAT boxes are expensive, and by providing IPv6 as well as IPv4+NAT they can lower the load on those NAT boxes and reduce their dependency on them. That will lower their cost so they have an incentive to provide IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Translating outgoing connections from IPv4 devices to IPv6 servers on the internet isn't possible either. An IPv6 address is 128 bits long, an IPv4 address only 32 bits. An IPv4 connection therefore only has 32 bits to use as the destination, and there is no way fit in all possible IPv6 destinations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other way around does work, and is used in many mobile networks. Every device get IPv6-only connectivity and the DNS server for that network puts the 32 bits of IPv4 destinations inside a special block of 128 bit IPv6 addresses. The client connects to that IPv6 address and a special NAT box in the network recognises the special block, extracts the original 32 bit IPv4 destination address, and makes the IPv4 connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So keeping home and mobile clients on IPv4-only won't work. Making them IPv6-only can work in specific cases like mobile devices. Unfortunately there are still some devices that need IPv4 in a home (not that many really. PCs, tablets, phones and printers are usually fine without IPv4, but e.g. game consoles like the PS3, PS4, Wii and Wii-U currently still need IPv4) so IPv4 will be around for a little while longer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So home networks will be among the first to get IPv6 next to IPv4, mostly to keep the IPv4 cost down and to avoid performance and dependency problems with large scale NAT devices inside the ISP network. IPv4 will start disappearing in homes once the last devices like game consoles update their firmware to add IPv6 support. Mobile networks have already dropped IPv4 connectivity to the device and make it possible to connect to IPv4-only destinations with a DNS64+NAT64 setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: The Xbox One is the happy exception on the home network. It is built completely around IPv6 and will use backward-compatibility tricks to work on network with just IPv4.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-07-08T19:19:38.843" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19809" PostTypeId="2" ParentId="19804" CreationDate="2015-07-08T20:15:56.557" Score="0" Body="&lt;p&gt;I finally ended up figuring this out through trial and error.  Below are the correct VLAN port configuration settings for anybody who may come to this thread looking for an answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this configuration connections on ports 3-6 are tagged with VLAN ID 1001 and automatically get a 192.168.0.X IP address from the RV320. Connections to ports 7-24 are tagged with VLAN ID 1002 and automatically get a 192.168.1.X IP address from the RV320. Connections on Port 1 are tagged with VLAN ID 1 and automatically get a 192.168.100.X IP address from the RV320.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/miTH3.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="16449" LastActivityDate="2015-07-08T20:15:56.557" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19811" PostTypeId="1" AcceptedAnswerId="19817" CreationDate="2015-07-08T20:39:37.730" Score="1" ViewCount="1633" Body="&lt;p&gt;We are about to implement PVLANs into our environment however I had a couple of questions for anyone who has production experience with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network will be set up as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hosts     Hosts&#xA; |          |&#xA;SW1 (N)    SW2 (S)&#xA;    \     /&#xA;      SW3 (Core SW)&#xA;       |&#xA;    Firewall&#xA;       |&#xA;    Internet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is which VLAN would the IP address go on? The primary? If so, all the other switches have the same primary VLAN but separate IP addresses, would that not create a conflict?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help guys!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an idea of my current config:&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;PVLAN config for 11 N 3560x&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;vtp mode transparent&#xA;feature private-vlan&#xA;vlan 2&#xA;private-vlan primary&#xA;exit&#xA;vlan 3&#xA;private-vlan isolated&#xA;exit&#xA;vlan 2&#xA;private-vlan associated add 3&#xA;exit&#xA;int gi0/1 - gi0/23&#xA;switchport mode private-vlan host&#xA;switchport private-vlan host-association 2 3&#xA;spanning-tree portfast&#xA;int gi0/24&#xA;description to core switch&#xA;switchport mode private-vlan promiscuous&#xA;switchport private-vlan mapping 2 add 3&#xA;spanning-tree portfast&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;show vlan primary&lt;/h1&gt;&#xA;&#xA;&lt;h1&gt;show int gi0/1 - gi0/23 switch | beg private&lt;/h1&gt;&#xA;&#xA;&lt;h1&gt;PVLAN config for 11 S 3560x&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;vtp mode transparent&#xA;feature private-vlan&#xA;vlan 2&#xA;private-vlan primary&#xA;exit&#xA;vlan 5&#xA;private-vlan isolated&#xA;exit&#xA;vlan 2&#xA;private-vlan associated add 5&#xA;exit&#xA;int gi0/1 - gi0/23&#xA;switchport mode private-vlan host&#xA;switchport private-vlan host-association 2 5&#xA;spanning-tree portfast&#xA;int gi0/24&#xA;description to core switch&#xA;switchport mode private-valn promiscuous&#xA;switchport private-vlan mapping 2 add 5&#xA;spanning-tree portfast&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;show vlan primary&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;PVLAN config for core switch&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;vtp mode transparent&#xA;feature private-vlan&#xA;vlan 2&#xA;private-vlan primary&#xA;exit&#xA;vlan 7&#xA;private-vlan isolated&#xA;exit&#xA;vlan 2&#xA;private-vlan associated add 7&#xA;exit&#xA;int gi0/1 - gi0/23&#xA;switchport mode private-vlan host&#xA;switchport private-vlan host-association 2 7&#xA;spanning-tree portfast&#xA;int gi0/24&#xA;description to fortinet&#xA;switchport mode private-valn promiscuous&#xA;switchport private-vlan mapping 2 add 7&#xA;spanning-tree portfast&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;show vlan primary&lt;/h1&gt;&#xA;&#xA;&lt;h1&gt;show vlan private-vlan type&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;Configuring trunk ports one device not aware of pvlan&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int gi0/24&#xA;switchport mode private-vlan trunk secondary&#xA;switchport private-vlan trunk native vlan 3&#xA;switchport private-vlan trunk allowed 3, 7&#xA;switchport private-vlan association trunk 2 3   #primary, secondary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;show int gi0/24 switchport&lt;/h1&gt;&#xA;&#xA;&lt;h2&gt;Configuring trunk ports both devices aware of pvlan&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int gi0/24&#xA;switchport mode private-vlan trunk promiscuous&#xA;switchport private-vlan trunk native vlan 3&#xA;switchport private-vlan trunk allowed vlan 3, 7 #core switch vlan&#xA;switchport private-vlan mapping trunk 2 add 3, 7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13800" LastEditorUserId="16331" LastEditDate="2015-07-08T21:43:00.383" LastActivityDate="2015-07-08T23:20:25.740" Title="Configuring PVLANs across 3 switches" Tags="|ip|private-vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19812" PostTypeId="1" AcceptedAnswerId="19814" CreationDate="2015-07-08T20:59:19.730" Score="0" ViewCount="419" Body="&lt;p&gt;I need to set up the following on Several Nortel Baystack's (5530/5520):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Assign a priority to DXL VoIP traffic with a DSCP priority level which will be co-exist with the rest of the real-time traffic on your system. For most cases a priority level of “Expedited” (ef) can be used for VoIP traffic.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's easier I can prioritize specific ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are using the java device manager for Nortel devices and have yet to successfully implement QOS. We have found various settings but not a way to apply it to an actual port or type of traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am familiar with Cisco QOS but not Nortel. I have failed to find appropriate documentation and I can't call support (Nortel doesn't exist anymore). This would be taking place on a security network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Background information: We have intercoms on a Nortel network that are only working one-way, when they need to be both. On our cisco network the intercoms work both ways without issue (no QOS is configured on Cisco). Our support rep for the intercoms (Harding) suggests that we require QOS on the network. Since my coworkers and myself have hit a wall, we have come here for help. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="10348" LastActivityDate="2015-07-08T21:30:53.410" Title="QOS on Nortel Devices" Tags="|qos|dscp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19813" PostTypeId="2" ParentId="19807" CreationDate="2015-07-08T21:01:23.410" Score="2" Body="&lt;p&gt;If you are going to have structured cabling and equipment all in the same rack I recommend&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;keeping them separate and not intermingling. For example if you structured cabling is coming into the rack from the top then keep all of it together in the top portion of the rack and install equipment starting from the bottom. Reserving the very bottom being UPS. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Install horizontal cable management between equipment as well as between structured cable patch panels. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Install double sided vertical cable management on the sides of the rack. Double sided contains a forward facing trough for patch cables to be routed through and a rear facing trough for structured cabling. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Only utilize patch cables (fiber or cat5) that are exactly the correct size. (Trouble starts when you use a 6 ft. cable for a 4 ft. patch or vice versa.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="15982" LastEditorUserId="16331" LastEditDate="2015-07-08T21:13:30.580" LastActivityDate="2015-07-08T21:13:30.580" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19814" PostTypeId="2" ParentId="19812" CreationDate="2015-07-08T21:30:53.410" Score="0" Body="&lt;p&gt;[&lt;a href=&quot;http://support.avaya.com/css/P8/documents/101011400&quot; rel=&quot;nofollow&quot;&gt;Configuring Quality of Service on Avaya Ethernet Routing Switch 5900 Series&lt;/a&gt;]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ignore that it's for a 5900, the 5500 line was retired a while ago. It's still the same CLI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show running-config verbose module qos&lt;/code&gt; will dump the (almost) entire system configuration for QoS. Take note of the &lt;code&gt;qos if-assign port ... name allQoSPolicyIfcs&lt;/code&gt; line as that's how a policy is attached to a port. Defining the other 1000's of things I'll leave to you.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, one-way-voice problems are rarely the fault of QoS. This is almost always a routing (nat, or security) issue where the stream of traffic in one direction is blocked. Inspecting traffic flow should indicate where the breakdown is occurring.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-08T21:30:53.410" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19815" PostTypeId="2" ParentId="10560" CreationDate="2015-07-08T21:52:06.497" Score="2" Body="&lt;p&gt;The current answer provides you with a good solution. However, I would advise against using a single switch to connect all of these devices. If you do this you end up with an additional failure domain with a single point of failure. I see two options here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use a switch stack to implement this recommendation. (Eliminates the single point of failure)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Directly connect links from each 2911 to each ASA. (Depends on port utilization)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also recommend enabling an IGP such as OSPF or EIGRP between your 2911 and ASA devices. If you are going to use static routes make sure that you implement the appropriate tracking configuration. The switch/es would mask link down thus preventing the route from being removed on the ASA. You could also implement HSRP on the 2911 routers and point the ASA 0.0.0.0/0 to the HSRP address.&lt;/p&gt;&#xA;" OwnerUserId="16282" LastActivityDate="2015-07-08T21:52:06.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19817" PostTypeId="2" ParentId="19811" CreationDate="2015-07-08T22:43:46.403" Score="2" Body="&lt;p&gt;You would put the IP address on the primary VLAN SVI. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface vlan2&#xA; private-VLAN mapping 3,5,7&#xA; ip address x.x.x.x x.x.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would suggest running VTPv3 which supports pvlans. That way all switches will have the same VLAN configuration (VLAN.dat file) added on them. Also, vtpv3 supports extended range vlans. Further having different pvlan per switch is not needed, especially since they are isolated. Think, 1 primary VLAN, 1 isolated VLAN and 1 VLAN per pvlan community. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not analyzed your config but a quick skim over this looks correct. I'd just have the same pvlan numbers across all switches. &lt;/p&gt;&#xA;" OwnerUserId="881" LastEditorUserId="881" LastEditDate="2015-07-08T22:49:28.387" LastActivityDate="2015-07-08T22:49:28.387" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19818" PostTypeId="2" ParentId="19811" CreationDate="2015-07-08T23:11:27.460" Score="0" Body="&lt;p&gt;1) Yes the Primary vlan is the entity that homes the shared subnet for community and isolated vlans. Why would each switch have their own Primary vlan address? (Is your switch management vlan the same vlan as the Primary vlan?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus I imagine your core switch is performing MLS(Multi-Layer Switching) and homes the Primary Vlan SVI?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) You don't need to define three different isolated vlans. The purpose of the isolated vlan is to only allow communication between an isolated port and promiscuous port. By definition the isolated host will not be able to communicate with any other type of port other than the promiscuous port. Just trunk one isolated vlan through the pvlan domain and utilize it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another note is that a Primary Vlan can be associated with at most one isolated vlan and many community vlans. Likewise a Promiscuous port can only served one primary vlan, one isolated vlan and many community vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Why do you need to trunk the vlans through to your fortinet firewall? If it isn't absolutely necessary I'd turn this into a routed link between the core switch and the fortinet. If your core switch is L3 capable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Just use a Promiscuous-PVlan trunk for the link to devices that don't support PVLAN or protected ports. This will ensure secondary vlan tagged frames are rewritten with the primary vlan tag when crossing the trunk. Although if you make 3) happen then this may not be necessary anymore AIUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH. Feel free to ask for clarification. &lt;/p&gt;&#xA;" OwnerUserId="168" LastEditorUserId="168" LastEditDate="2015-07-08T23:20:25.740" LastActivityDate="2015-07-08T23:20:25.740" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19823" PostTypeId="2" ParentId="17618" CreationDate="2015-07-09T04:47:09.910" Score="1" Body="&lt;p&gt;SGSN does have data traffic on IuPS interface with 3GDT implemented . This payload is 3G inroamer subscriber , as inroamer subscriber would go to thier home ggsn and not visited plmn ggsn (if vplmn not allowed) . &lt;/p&gt;&#xA;" OwnerUserId="16459" LastActivityDate="2015-07-09T04:47:09.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19824" PostTypeId="1" AcceptedAnswerId="19825" CreationDate="2015-07-09T05:13:12.460" Score="-2" ViewCount="1455" Body="&lt;p&gt;I have couple of questions related to IP addressing. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The public IP for a company is 190.28.0.0. &#xA;&#xA;a)This is a class B address, right? CIDR value is /16?&#xA;&#xA;b)If the company wants to have 8 subnets, how do I find the subnet mask?&#xA;&#xA;c)What is the maximum number of hosts?&#xA;&#xA;d)What are the IP ranges for the 8 subnets?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16453" LastEditorUserId="16331" LastEditDate="2015-07-09T21:07:33.050" LastActivityDate="2015-07-09T21:07:33.050" Title="Find the subnet mask,number of hosts and IP ranges?" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="1" ClosedDate="2015-07-09T10:28:35.220" ContentLicense="CC BY-SA 3.0" />
  <row Id="19825" PostTypeId="2" ParentId="19824" CreationDate="2015-07-09T05:36:22.920" Score="1" Body="&lt;p&gt;In classful networks the class is determined by the leading four bits in the ip-address. B-networks start with 10 (binary). So, in fact 190.28.0.0 is a Class B network. &lt;a href=&quot;https://en.wikipedia.org/wiki/Classful_network&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Classful_network&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to CIDR you can say nothing about the size of a network from just 190.28.0.0. But 190.28.0.0/16 tells me there is 16 bits in the network part of the address and the remaining 16 are host bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since ip-address calculations are performed in binary, to find a netmask that will divide a /16 into 8 subnets you do the calculation 2^x = 8 (looking for how many digits you need in a binary number to have 8 combinations) which is 3. So, a /16 can be divided into 8 /19.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000&#xA;001&#xA;010&#xA;011&#xA;100&#xA;101&#xA;110&#xA;111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you divide your network into eight /19 you have 32-19 bits remaining for hosts. To find the number of hosts you calculate 2^(32-19) = 8192.&#xA;But remember that the first and the last address are reserved for network and broadcast-addresses. That gives you 8190 usable IP-addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find the ranges you set the host part of the address to all zeros to find the network address (first address) and to all ones to find the broadcast address (last address)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit (Working example)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ip 190.28.0.0 is 10111110.00011100.00000000.00000000 in binary. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let say i choose the subnet 010 to get a /19 network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This gives me the network address 10111110.00011100.&lt;strong&gt;010&lt;/strong&gt;00000.00000000 which translates to 190.28.64.0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find the broadcast address of the same network we set all remaining bits to 1: 10111110.00011100.010&lt;strong&gt;11111.11111111&lt;/strong&gt; which translates to 190.28.95.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then do the same calculations for all eight subnets i mentioned above.&lt;/p&gt;&#xA;" OwnerUserId="16331" LastEditorUserId="16331" LastEditDate="2015-07-09T06:38:00.810" LastActivityDate="2015-07-09T06:38:00.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19828" PostTypeId="1" AcceptedAnswerId="19834" CreationDate="2015-07-09T07:44:24.387" Score="1" ViewCount="3990" Body="&lt;p&gt;I have the following subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.1.80  255.255.255.240&#xA;10.1.1.96  255.255.255.240&#xA;10.1.1.112 255.255.255.240&#xA;10.1.1.128 255.255.255.192&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I combine all these subnets to form one single subnet so that the first usable address in the subnet is 10.1.1.81 and the last usable one is 10.1.1.190?&lt;/p&gt;&#xA;" OwnerUserId="15854" LastEditorUserId="619" LastEditDate="2015-07-09T09:03:25.270" LastActivityDate="2015-07-09T11:28:48.453" Title="How do I combine subnets?" Tags="|subnet|" AnswerCount="1" CommentCount="5" ClosedDate="2015-07-09T19:56:51.333" ContentLicense="CC BY-SA 3.0" />
  <row Id="19830" PostTypeId="2" ParentId="19794" CreationDate="2015-07-09T09:18:42.860" Score="1" Body="&lt;p&gt;Spoofing is sourcing traffic with an address that you aren't. Masquerading is &lt;em&gt;changing&lt;/em&gt; the source to an address that you represent. (i.e. NAT)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spoofing is &lt;em&gt;highly&lt;/em&gt; discouraged, and often out-right denied by network security constraints. &lt;em&gt;HOWEVER&lt;/em&gt;, there are load balancing systems that use an asymmetric process whereby the answering server directly answers requests forwarded from the load balancing device. (browser sends to LB address, LB forwards to actual server, actual server replies with the LB's address directly to the internet bypassing the LB. This means the LB doesn't have to process as much traffic.) I seem to recall this being called &lt;em&gt;Global Mode&lt;/em&gt; load balancing.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-09T09:18:42.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19831" PostTypeId="1" AcceptedAnswerId="19832" CreationDate="2015-07-09T10:50:03.697" Score="6" ViewCount="60127" Body="&lt;p&gt;This may be a dumb question.  Actually I'm sure of it, but i'd like a thorough explanation for it so i can wrap my head around it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;consider a switch with two (or more) connected devices, with similar IP addresses but different subnet MASKS.  No gateways/routers/vlans.  Pure layer 2.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A: 1.1.1.1/24 (255.255.255.0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B: 1.1.1.2/22 (255.255.252.0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C: 1.1.1.3/21 (255.255.248.0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(assume only the digits in the last octet of the IP address change.  all IP addresses are &quot;/24&quot; ip addresses (10.3.2.x) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can A and B (and/or C) communicate?  notice the subnet masks are /24, /22, /21, but the IP addresses themselves could be said to follow the /24 paradigm (only the last octet is different per IP address)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is the subnet mask irrelevant in this case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what effect is had on the broadcast domains?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;any other effects?  UDP vs TCP?&lt;/p&gt;&#xA;" OwnerUserId="14455" LastEditorUserId="14455" LastEditDate="2015-07-09T17:07:05.647" LastActivityDate="2018-11-06T00:48:17.557" Title="Communication between different subnet MASKS with IP address that works for either" Tags="|subnet|" AnswerCount="6" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19832" PostTypeId="2" ParentId="19831" CreationDate="2015-07-09T11:16:14.517" Score="2" Body="&lt;p&gt;Edit: Re-do the answer as the IP's in the question changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note1: It is &lt;strong&gt;WRONG&lt;/strong&gt; to route different subnet masks in the same network/vlan this is just a explanations as to why it work's in &lt;strong&gt;certain cases&lt;/strong&gt; for certain specific IP's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note2: Even if the subnets provided were in different vlans, it would be a &lt;strong&gt;Broken&lt;/strong&gt; configuration as the subnet's overlap&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP routing on a host is configured with three pieces of information.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;IP Address&lt;/li&gt;&#xA;&lt;li&gt;Mask&lt;/li&gt;&#xA;&lt;li&gt;Gateway.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The Mask splits the IP into a upper and lower half (In binary format).  The first half (where the mask is all ones) is the network and the second half is the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All IP's in the same network  IP/mask  can talk to each other directly, if the network portion does not match the Gateway is used to router the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A: 1.1.1.1/24 (255.255.255.0)&#xA;Network 1.1.1.0    Host 0.0.0.1 (HostRange 0.0.0.1-0.0.0.254)&#xA;IpRange 1.1.1.1 - 1.1.1.254 (Excluding network and broadcast)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B: 1.1.1.2/22 (255.255.252.0)&#xA;Network 1.1.0.0    Host 0.0.1.2   (HostRange 0.0.0.1-0.0.3.254)&#xA;IpRange 1.1.0.1 - 1.1.3.254 (Excluding network and broadcast)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C: 1.1.1.3/21 (255.255.248.0)&#xA;Network 1.1.0.0    Host 0.0.1.3   (HostRange 0.0.0.1-0.0.7.254)&#xA;IpRange 1.1.0.1 - 1.1.7.254 (Excluding network and broadcast)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mask is a binary mask, all ones and then all zeros, total length for IPv4 is 8x4=32 bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answer: If you have a host1 talking to a Host2 and according to host 1, host 2 is in the same Network(IP/mask) it will send packets directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the provided example, although misconfiguration the Network portion of ip A, B and C matches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would break down if i chose in the same subnets different IP's, they would not be able to ping each other with out the assistance of a L3/Router to route between the subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AA. 1.1.1.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BB. 1.1.2.2/22&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CC. 1.1.7.1/21&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2015-07-09T18:39:52.927" LastActivityDate="2015-07-09T18:39:52.927" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19834" PostTypeId="2" ParentId="19828" CreationDate="2015-07-09T11:28:48.453" Score="1" Body="&lt;p&gt;The lowest ip is 10.1.1.80, and the highest is &#xA;10.1.1.191 (from 10.1.1.128/26)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The smallest subnet (bigest mask) to cover both is &lt;strong&gt;10.1.1.0/24&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you sub-dived the subnet 10.1.1.0/24, by increasing the mask to /25 you get two subnets, not one can covers all the subnets in the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.1.1.0/25 (Range 10.1.1.0-127)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.1.1.128/25 (Range 10.1.1.128-255)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ranges you provided is not continuous, and the answer &lt;strong&gt;10.1.1.0/24&lt;/strong&gt; covers them all and the network in between and at the start and end of the ranges.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-09T11:28:48.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19835" PostTypeId="2" ParentId="19831" CreationDate="2015-07-09T11:41:06.200" Score="0" Body="&lt;p&gt;&quot;but the IP addresses could be said to follow the /24 paradigm.&quot;. That is the irrelevant statement. In Classless Inter-Domain Routing, as is common these days, the actual values in the IPv4 address are irrelevant for network address determination. Only the netmask is relevant to determine what part of the IP address is the network address and what part is the host address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A: 10.3.2.1/24 is on net 10.3.2.0 &lt;/li&gt;&#xA;&lt;li&gt;B: 20.3.2.2/22 is on net 20.3.0.0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you state these are on the same switch, but you don't specify a VLAN assignment or otherwise, so I assume the broadcast domain is still the whole network. What you basically have is an overlay network, in which two IP networks share the same broadcast domain. In itself not a problem, but does cause additional traffic. Any host on IP network A that wants to communicate with a host on IP network B has to go through the router between the two (yes, this router must have multiple addresses on the same network interface, one for network A and one for network B). Even though they are in the same broadcast domain, the IP addressing prevents them from communicating directly.&lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2015-07-09T11:41:06.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19837" PostTypeId="2" ParentId="9620" CreationDate="2015-07-09T15:13:13.997" Score="2" Body="&lt;p&gt;This is a bug in Cisco ASA 9.2(2) and may not be Splunk&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tools.cisco.com/quickview/bug/CSCur17006&quot; rel=&quot;nofollow&quot;&gt;https://tools.cisco.com/quickview/bug/CSCur17006&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16472" LastActivityDate="2015-07-09T15:13:13.997" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19838" PostTypeId="1" AcceptedAnswerId="19898" CreationDate="2015-07-09T16:15:50.320" Score="0" ViewCount="3608" Body="&lt;p&gt;I have a brand new 1941 router that is supposedly still running the cisco default login credentials (cisco/cisco) however I am getting login invalid. There have only been 2 people in contact with this router, the sys admin and myself and the former insists he did not change the login credentials. I have found a lot of information regarding resetting priv exec mode and the like however I cannot find anything that shows me how to reset the login credentials. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="13800" LastActivityDate="2015-07-12T10:58:48.243" Title="Cisco 1941 router default credentials not working" Tags="|router|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19840" PostTypeId="1" AcceptedAnswerId="19854" CreationDate="2015-07-09T18:40:27.363" Score="26" ViewCount="10715" Body="&lt;p&gt;I am still struggling to understand to what extent CIDR really renders IP address classes obsolete. Here's what I understood so far:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It's ridiculously inefficient (and impossible, too) to assign every organization that needs to address more than 255 hosts a class B address, which could technically address 65535 hosts.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;However, if such an organization needed to address, say, approximately 700 hosts, one could just assign three (preferably contiguous) class C network addresses to that organization. E.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.42.42&#xA;192.42.43&#xA;192.42.44&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Problem: For that &lt;em&gt;one&lt;/em&gt; organization, routers would have to store &lt;em&gt;three&lt;/em&gt; entries in their forwarding tables, which won't scale.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;CIDR solves this problem by introducing route summarization/aggregation, enabling the ISP that assigned the three class C networks to the organization to advertise only &lt;em&gt;one&lt;/em&gt; prefix to the rest of the world. E.g.,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.42.42.0/21&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So far, so good. However, I just can't grasp why every resource I touch claims that classful addressing is &quot;a thing of the past&quot;. After all, the ISP &lt;em&gt;is&lt;/em&gt; in charge of, say, class C network addresses, and &lt;em&gt;does&lt;/em&gt; assign these to its customers. CIDR just fixes the problem of multiple entries in the forwarding tables, right? Thus, IP address classes are still around, are they not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exam's coming up, so help is much appreciated. :P &lt;/p&gt;&#xA;" OwnerDisplayName="user15544" LastEditorUserId="286" LastEditDate="2015-07-10T07:50:50.340" LastActivityDate="2022-05-21T11:14:32.037" Title="Does CIDR really &quot;do away&quot; with IP address classes?" Tags="|routing|ipv4|ip|route-summarization|" AnswerCount="7" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19841" PostTypeId="2" ParentId="19840" CreationDate="2015-07-09T18:54:44.447" Score="17" Body="&lt;p&gt;&lt;strong&gt;Classful addressing&lt;/strong&gt; only supports 3 masks for unicast: /8, /16/, /24.&#xA;It is &lt;strong&gt;not used anymore&lt;/strong&gt;, except to refer to class [A,B,C] == [/8,/16,/24] when describing a block of IP's&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;CIDR&lt;/strong&gt; allows the mask to be any value from /0 to /32.&#xA;Specified at end of IP with /&amp;lt;bit#&amp;gt;&lt;/p&gt;&#xA;&lt;p&gt;Think of a point-to-point serial: that would have &lt;strong&gt;wasted a classfull class C&lt;/strong&gt; /24 (256 xIPs) with a classful setup before; with &lt;strong&gt;CIDR&lt;/strong&gt; it only needs /30 (4 xIPs) or /31 (2 xIPs).&lt;/p&gt;&#xA;&lt;p&gt;Most ISPs will now only assign a /28 block of public IP's to a customer providing 14 IPs, or even less. (&lt;strong&gt;CIDR&lt;/strong&gt;)&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;The two modes of operation are not compatible&lt;/strong&gt; as one (classful) guesses the mask from the IP, and the other (CIDR) specifies it precisely.  CIDR has replaced classfull.&lt;/p&gt;&#xA;&lt;p&gt;See &lt;a href=&quot;https://en.wikipedia.org/wiki/Classful_network&quot; rel=&quot;nofollow noreferrer&quot;&gt;the Wikipedia article “Classful Network”&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2022-05-21T11:14:32.037" LastActivityDate="2022-05-21T11:14:32.037" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="19844" PostTypeId="1" AcceptedAnswerId="19847" CreationDate="2015-07-09T19:24:48.663" Score="0" ViewCount="886" Body="&lt;p&gt;I read this article - &lt;a href=&quot;https://rescomp.stanford.edu/~cheshire/rants/Latency.html&quot; rel=&quot;nofollow&quot;&gt;https://rescomp.stanford.edu/~cheshire/rants/Latency.html&lt;/a&gt;&#xA;I have a 2 Mbps private link. This means that I can transfer at the rate of 2*10^6 bits per second ~= 250*10^3 bytes per second ~= 250 bytes per millisecond. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if I have sent one packet of size 250 bytes, will the next packet, sent nearly simultaneously wait for the previous packet and thus incur the delay of 1 milliseconds. Consider me a newbie and help me out.&lt;/p&gt;&#xA;" OwnerUserId="16479" LastActivityDate="2015-07-12T04:28:45.930" Title="Meaning of 2 Mbps" Tags="|ethernet|bandwidth|latency|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19845" PostTypeId="2" ParentId="19807" CreationDate="2015-07-09T19:28:51.160" Score="0" Body="&lt;p&gt;Have a look at mtp/mpo fiber SM or MM multi-fiber ribbon cables, 12 or 14 cores in a single connector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They allow for easy movement and addition of fibers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.flukenetworks.com/datacom-cabling/fiber-testing/multifiber-pro-optical-power-meter-and-fiber-testing-kits&quot; rel=&quot;nofollow&quot;&gt;Fluke Tester&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.sumitomoelectric.com/mpo-cassettes.html&quot; rel=&quot;nofollow&quot;&gt;MPO Cassette&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cablesys.com/c/26/mpo-cassettes&quot; rel=&quot;nofollow&quot;&gt;MPO Cassettes&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cablestogo.com/category/fiber/mtp-fiber&quot; rel=&quot;nofollow&quot;&gt;MTP-fiber&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-09T19:28:51.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19846" PostTypeId="1" CreationDate="2015-07-09T19:45:17.210" Score="5" ViewCount="6584" Body="&lt;p&gt;You may or may not know the app &quot;Fing&quot;. It is a bunch of network tools, available on Android and iOS at least and maybe on others devices but not sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main goal of this tool is to browse for everything connected on the same WiFi network, and display some informations such as MAC addresses, IP addresses, names of devices, brand/model/manufacturer (if available). It is really powerful even in its free version and I would really like to know how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing that is interesting me is that is it able to detect devices even when they are sleeping and I really don't know how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have observed/tried this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have a sleeping iPhone on IP XX.XX.XX.200 (on subnet 255.255.255.0)&lt;/li&gt;&#xA;&lt;li&gt;I ping this iPhone with my laptop (Mac OSx Yosemite), no response at all, the phone seems to sleep&lt;/li&gt;&#xA;&lt;li&gt;I download and install the app &quot;Fing&quot; on an Android device (new installation from scratch, on a new device which has never talked with the iPhone)&lt;/li&gt;&#xA;&lt;li&gt;Launch the app, and ... it finds my phone on XX.XX.XX.200, it finds its brand and model, and MAC address&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(during the whole test, no response at all to my ping request on the Mac) This really intrigues me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can this work ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have continued my investigations, and I got the idea of sniffing what is coming from this application.&#xA;I have set up a TCPDump listener on the Mac, and launch the app again. So I have sniffed everything going from the app to my laptop. And here is what I obtained :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/SnsJ3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is only a partial screenshot as there are more sniffed packets. It continues in the terminal but the rest looks the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering two things. If we randomly observe one line, for example this one :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;11:47:23.914998 IP 10.11.204.34.mdns &gt; 224.0.0.251.mdns: 0 PTR (QM)? 22.204.11.10.in-addr.arpa. (43)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I understand that the app with the IP 10.11.204.34, sends a multicasted message to 224.0.0.251. But &lt;strong&gt;what is this message&lt;/strong&gt; ? And &lt;strong&gt;what is 22.204.11.10.in-addr.arpa. (43)&lt;/strong&gt; ? And why are they so many packets to or from XX.204.11.10.in-addr.arpa. ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a long question, and I thank you in advance for reading everything. And thank you for having reached this line.&lt;/p&gt;&#xA;" OwnerUserId="16335" LastEditorUserId="16335" LastEditDate="2015-07-09T21:14:11.460" LastActivityDate="2016-04-14T06:55:49.620" Title="Network discovery. How does Fing work? (a network tool)" Tags="|tcpdump|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19847" PostTypeId="2" ParentId="19844" CreationDate="2015-07-09T20:01:38.383" Score="4" Body="&lt;p&gt;Well, every link transmits only either 0 or 1 at any specific moment. So if your router connected to 2Mbit/s link receives first 250 bytes packet, and assuming that it doesn't have anything at the moment to send, it will pass the 250 bytes into the interface driver, and then serialize it (meaning put 0s and 1s) onto a link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next packet, even if it's just milisecond later, will wait for the first packet to be transmitted. This may incur delay in sending (alone) of 1 milisecond, but that's just theory - in reality, there will be some additional, minimal delay depending on the way your router works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look &lt;a href=&quot;https://www.cisco.com/application/pdf/en/us/guest/netsol/ns407/c654/ccmigration_09186a008091d542.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for additional writeup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are techniques to fight with serialization delay (take a look &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcflem.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;), but in todays networks and with your 2Mbit/s link, you may find them unnecessary. You shouldn't have to use them, as even with 1500 bytes segments, with proper priority queue implementation, this link shouldn't incur delay that's visible for typical IP-based applications.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="286" LastEditDate="2015-07-10T07:44:59.770" LastActivityDate="2015-07-10T07:44:59.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19849" PostTypeId="1" CreationDate="2015-07-09T20:22:59.827" Score="3" ViewCount="27178" Body="&lt;p&gt;Classic story I.T. guy left now, no documentation indicating config on the switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have Zyxel ES2024 connected to in the middle of the network passing traffic to various VLANs however I cannot get on the switch itself.It looks like management VLAN has been changed, the IP of the switch is problem - the guy was lazy all the switches has standard password. Reset is not an option as I dont have access to console cable here and I cannot really wait to get it delivered.&#xA;Any tips, advices greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="4956" LastActivityDate="2015-09-08T03:31:59.403" Title="How to find IP address of switch" Tags="|switch|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19850" PostTypeId="2" ParentId="19840" CreationDate="2015-07-09T20:27:05.063" Score="33" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;classful addressing is &quot;a thing of the past&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is true because &lt;em&gt;nothing&lt;/em&gt; in the modern internet does classful addressing&lt;sup&gt;[1]&lt;/sup&gt;. With classful addressing, the netmask is a fixed value based on the address. In your example, you cannot &quot;merge&quot; three class C ranges to have 700 hosts in one LAN. The netmask for each range is &lt;em&gt;automatically&lt;/em&gt; 24 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CIDR fixed this by abolishing the rules whereby the address dictates the mask. Thus, a LAN can be any size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You (and a lot of other people) are still hung up on the words &quot;Class C&quot;, &quot;Class B&quot;, and &quot;Class A&quot;. Those constructs no longer exist; and haven't for decades. What people &lt;em&gt;mean&lt;/em&gt; when they use the term is the netmask size of 24, 16, and 8 respectively. They don't mean class semantics are being applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;[1] 10.0.0.1/24 is an invalid configuration in a classful system.&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-09T20:27:05.063" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19851" PostTypeId="2" ParentId="19831" CreationDate="2015-07-09T20:47:31.870" Score="0" Body="&lt;p&gt;Why? Because &lt;em&gt;subnet math&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.1/24 can talk to anything in 1.0/24 because the mask says they are &quot;local&quot; (&quot;on the wire&quot;). If 1.1/24 tried to talk to 2.1/23, it fails: &quot;2&quot; is outside the 1.0/24 range; and fwiw, &quot;1&quot; is outside 2.0/23's range. 3.1/22 would be able to send to 1.1/24 -- /22 covers 0-3 -- but 1.1/24 wouldn't be able to answer.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-09T20:47:31.870" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19852" PostTypeId="2" ParentId="19849" CreationDate="2015-07-09T20:52:20.057" Score="1" Body="&lt;p&gt;Broadcast ping (&lt;code&gt;ping -b 255.255.255.255&lt;/code&gt;) within the management VLAN, and hope it answers. Of course, that requires knowing the management VLAN, and what port(s) are in the management VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why I hate hardware that doesn't have a physical console.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-09T20:52:20.057" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19853" PostTypeId="2" ParentId="19831" CreationDate="2015-07-09T21:25:57.527" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;For reference:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Host A:&lt;/strong&gt; 1.1.1.1/24 (subnet 1.1.1.0/24, range 1.1.1.0 - 1.1.1.255)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Host B:&lt;/strong&gt; 1.1.1.2/22 (subnet 1.1.0.0/22, range 1.1.0.0 - 1.1.3.255)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Host C:&lt;/strong&gt; 1.1.1.3/21 (subnet 1.1.0.0/21, range 1.1.0.0 - 1.1.7.255)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Example communication: Host A to Host B&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;In this example, Host A and Host B have never communicated with each other nor the switch between them. Also, Host A is female and Host B is male so I can avoid ambiguous use of the pronoun &quot;it&quot;.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Host A (1.1.1.1) determines she needs to talk to 1.1.1.2.&lt;/li&gt;&#xA;&lt;li&gt;Host A determines that the destination IP (1.1.1.2) is in the same subnet range as Host A, so this whole communication should only need to happen over Layer 2. &lt;em&gt;&lt;a href=&quot;https://serverfault.com/a/397361&quot;&gt;If the destination IP weren't in Host A's subnet, Host A would send the packet to her default gateway to be routed.&lt;/a&gt;&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;Host A sends an ARP request asking &quot;Who has 1.1.1.2? Tell 1.1.1.1.&quot;&lt;/li&gt;&#xA;&lt;li&gt;The switch broadcasts Host A's ARP request. The switch doesn't care about IP addresses or subnet masks.&lt;/li&gt;&#xA;&lt;li&gt;Host B sees the ARP request, knows that he has 1.1.1.2, and sends an ARP response that includes his MAC address. Something like &quot;I have 1.1.1.2, my MAC address is BB&quot;.&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;ARP requests do not include any data about subnet masks, so there is no way for Host B (or A) to know that the other host has a different subnet mask at this point.&lt;/em&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Host A now has Host B's MAC address, and will send a layer 2 frame with her MAC address as the source and his MAC as the destination, which the switch will happily pass along.&lt;/li&gt;&#xA;&lt;li&gt;Future communication between Host A and Host B will be through the switch via MAC addresses. Host B will likely also do an ARP request to associate Host A's MAC with her IP address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Side note: I skipped a few details about the ARP request process that aren't super relevant here.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Communication between A and C, as well as B and C, should follow the same kind of process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, because (1) the hosts are on the same L2 segment and (2) they all see each other's IP addresses as being in their own subnet, &lt;strong&gt;they will communicate through the switch using MAC addresses as if they were in the same subnet&lt;/strong&gt;, initially making ARP requests to match up the other devices' IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also agree with the other answers that say this is a bad configuration. If another host is added to the switch and has an address outside of Host A's subnet but inside B and C's subnets, it could take some time to troubleshoot.&lt;/p&gt;&#xA;" OwnerUserId="13243" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-07-09T21:25:57.527" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19854" PostTypeId="2" ParentId="19840" CreationDate="2015-07-09T21:30:04.030" Score="28" Body="&lt;p&gt;Address delegation really used to happen in three sizes: class A, B and C. Class A delegations would be given from a certain address range, class B delegations from a different range etc. Because the different classes used different address ranges you could determine the class by looking at the first part of an address. And this was built into the routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class A delegations contained 16777216 addresses each&lt;/li&gt;&#xA;&lt;li&gt;Class B delegations contained 65536 addresses each&lt;/li&gt;&#xA;&lt;li&gt;Class C delegations contained 256 addresses each&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This was very inefficient for networks that didn't fit these sizes. A network that needed 4096 addresses would either get sixteen Class C delegations (which would be bad for the global routing table because each of them would have to be routed separately: the class size was built into the protocol) or they would get one Class B delegation (which would waste a lot of addresses).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 1993 CIDR was introduced. The protocols were adjusted to be able to deal with prefixes of different sizes and it became possible to route (both internally and externally) prefixes like a /30 or a /21 or a /15 etc etc. Anything between /0 and /32 became possible. Organisations that needed 2048 addresses could get a /21: exactly what they would need. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way you could internally subdivide those addresses was also limited. There were rules on how you could subnet. Originally each subnet within your classful network had to be the same size. You need one subnet with 128 addresses and another subnet with 16 addresses: too bad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Variable Length Subnet Masking (VLSM) is the internal-network equivalent of CIDR. VLSM has existed longer than CIDR. It was already mentioned in 1985. So CIDR is basically extending VLSM to inter-domain routing. With VLSM your subnets don't all have to be the same size anymore. You can assign a different number of addresses for each subnet, depending on your needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days all routing on the internet is done without classes. A prefix in the routing table might by coincidence (or because of history) match the classful structure, but protocols will no longer assume they can deduce the prefix length (subnet mask) from the first part of the address. All prefix lengths are explicitly communicated: classless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Saying that an ISP is in charge of a Class C network is similarly obsolete. Addresses are distributed completely classless by the RIRs (&lt;a href=&quot;https://www.nro.net/about-the-nro/regional-internet-registries&quot;&gt;Regional Internet Registries&lt;/a&gt;, the organisations responsible for delegating addresses to ISPs and businesses with their own independent addresses).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv4 addresses classes really don't exist anymore, and have been deprecated in 1993. If you look at old obsolete routing protocols you can of course still see the assumptions they made based on address class, but that was 20 years ago...&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-07-09T21:30:04.030" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19856" PostTypeId="1" CreationDate="2015-07-09T22:28:37.380" Score="4" ViewCount="3831" Body="&lt;p&gt;I have got a simple question, I am doing a broadcasted ping request on my local network, using a Mac with the latest Yosemite 10.10.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I &lt;code&gt;ping 255.255.255.255&lt;/code&gt;, I get responses from a bunch of devices ( all on the local 10.11.204.XX network, with 255.255.255.0 mask). But if I look into the ARP table with &lt;code&gt;arp -a&lt;/code&gt;, I can not see any of the devices that responded to my ping request. I only can see the broadcast IP and MAC address in the table (10.11.204.255 | ff:ff:ff:ff:ff:ff).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I ping individually each device, then they appear into the ARP table.&#xA;Why is this behavior ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, if I leave the ping request looping, I will see after a while and only sometimes, some of the devices's IPs. This is really strange for me.&lt;/p&gt;&#xA;" OwnerUserId="16335" LastEditorUserId="16335" LastEditDate="2015-07-09T23:18:45.200" LastActivityDate="2016-09-20T05:44:16.437" Title="ARP table does not store devices responding to a broadcasted ping request" Tags="|mac-address|arp|ping|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19857" PostTypeId="2" ParentId="19856" CreationDate="2015-07-09T23:10:22.410" Score="3" Body="&lt;p&gt;Your (unspecified OS) is apparently only populating it's cache based on hosts it has directly contacted. As it send a frame to FF:FF:FF:FF:FF:FF, none of the previously unknown responding nodes will be learned.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-09T23:10:22.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19858" PostTypeId="1" AcceptedAnswerId="43256" CreationDate="2015-07-10T00:03:02.263" Score="4" ViewCount="1286" Body="&lt;p&gt;Other devices (MickoTik, Windows Laptop with builtin PPPoE client) seem able to connect to the NTU's PPPoE with no issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sanitized router configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;! Last configuration change at 06:55:18 UTC Thu Jul 9 2015&#xA;version 15.3&#xA;service config&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname router1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;aqm-register-fnf&#xA;!&#xA;enable secret 5 ########################&#xA;enable password ###########&#xA;!&#xA;no aaa new-model&#xA;no process cpu extended history&#xA;no process cpu autoprofile hog&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;license udi pid C891F-K9 sn ##########&#xA;!&#xA;!&#xA;interface BRI0&#xA; no ip address&#xA; encapsulation hdlc&#xA; shutdown&#xA; isdn termination multidrop&#xA; no cdp enable&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet1&#xA; no ip address&#xA; shutdown&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet2&#xA; no ip address&#xA; shutdown&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet3&#xA; no ip address&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 1&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet4&#xA; no ip address&#xA; shutdown&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet5&#xA; no ip address&#xA; shutdown&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet6&#xA; no ip address&#xA; shutdown&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet7&#xA; no ip address&#xA; shutdown&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet8&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA;!&#xA;interface Vlan1&#xA; mtu 1492&#xA; ip address 10.10.30.247 255.255.255.0&#xA;!&#xA;interface Async3&#xA; no ip address&#xA; encapsulation slip&#xA;!&#xA;interface Dialer1&#xA; mtu 1492&#xA; ip address negotiated&#xA; encapsulation ppp&#xA; ip tcp adjust-mss 1436&#xA; dialer pool 1&#xA; dialer-group 1&#xA; ppp authentication chap pap callin&#xA; ppp chap hostname ##########@###.###.###.##&#xA; ppp chap password 0 #########&#xA; ppp pap sent-username ##########@###.###.###.## password 0 #########&#xA; no cdp enable&#xA;!&#xA;ip forward-protocol nd&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;no service-routing capabilities-manager&#xA;no cdp run&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;mgcp behavior rsip-range tgcp-only&#xA;mgcp behavior comedia-role none&#xA;mgcp behavior comedia-check-media-src disable&#xA;mgcp behavior comedia-sdp-force disable&#xA;!&#xA;mgcp profile default&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; no modem enable&#xA;line aux 0&#xA;line 3&#xA; modem InOut&#xA; speed 115200&#xA; flowcontrol hardware&#xA;line vty 0 4&#xA; password ##########&#xA; login&#xA; transport input all&#xA;!&#xA;scheduler allocate 20000 1000&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The GigabitEthernet interfaces are the only ones the came up as a valid option for configuring PPPoE in CCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also &lt;code&gt;debug pppoe events&lt;/code&gt; is just giving: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Jul  9 23:56:36.089:  padi timer expired&#xA;*Jul  9 23:56:36.089:  Sending PADI: Interface = GigabitEthernet3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how to go forward with this to get this working.&lt;/p&gt;&#xA;" OwnerUserId="16484" LastEditorUserId="8499" LastEditDate="2016-04-02T18:34:03.340" LastActivityDate="2017-08-15T02:50:43.017" Title="Issue getting Cisco 891 to connect to NTU via PPPoE" Tags="|cisco|pppoe|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19859" PostTypeId="2" ParentId="19858" CreationDate="2015-07-10T00:57:18.037" Score="1" Body="&lt;p&gt;You need to do a few things here. You will need to configure a VPDN group, dialer interface, assign that dialer interface to a dialer-group, and then implement that dialer-group on your interface. Follow the guide here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/routers/access/800/850/software/configuration/guide/pppoenat.html&quot; rel=&quot;nofollow&quot;&gt;Configuring PPP over Ethernet with NAT&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Configuration Example&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following configuration example shows a portion of the&#xA;  configuration file for the PPPoE scenario described in this chapter.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The VLAN interface has an IP address of 192.168.1.1 with a subnet mask&#xA;  of 255.255.255.0. NAT is configured for inside and outside&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt; Commands marked by &quot;(default)&quot; are generated automatically when you run the show running-config command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpdn enable &#xA;vpdn-group 1 &#xA;request-dialin &#xA;protocol pppoe &#xA;! &#xA;interface vlan 1 &#xA;ip address 192.168.1.1 255.255.255.0 &#xA;no ip directed-broadcast (default) &#xA;ip nat inside &#xA;&#xA;interface FastEthernet 4 &#xA;no ip address  &#xA;no ip directed-broadcast (default) &#xA;ip nat outside &#xA;pppoe enable group global &#xA;pppoe-client dial-pool-number 1 &#xA;no sh &#xA;&#xA;! &#xA;interface dialer 1 &#xA;ip address negotiated &#xA;ip mtu 1492 &#xA;encapsulation ppp &#xA;ppp authentication chap &#xA;dialer pool 1 &#xA;dialer-group 1 &#xA;! &#xA;dialer-list 1 protocol ip permit &#xA;ip nat inside source list 1 interface dialer 0 overload &#xA;ip classless (default) &#xA;ip route 10.10.25.2 255.255.255.255 dialer 0 &#xA;&#xA;ip nat pool pool1 192.168.1.0 192.168.2.0 netmask 255.255.252.0 &#xA;ip nat inside source list acl1 pool pool1&#xA;&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16282" LastEditorUserId="8499" LastEditDate="2016-04-02T18:36:57.367" LastActivityDate="2016-04-02T18:36:57.367" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19860" PostTypeId="2" ParentId="19856" CreationDate="2015-07-10T01:59:51.433" Score="1" Body="&lt;p&gt;What you want to do is ping the broadcast ip for the network (subnet) you are on. For example x.x.x.0/24 would have a network address of x.x.x.0 and a broadcast of x.x.x.255. If you ping the x.x.x.255 instead of the 255.255.255.255, you'll start receiving responses and when you issue the arp -a from terminal.app on your Mac, you'll see the entries. Keep in mind you may need to let your ping run for a bit so you can capture everybody. I'd open two terminal windows, ping the broadcast IP address for the subnet I'm on and run a loop to check ARP table: while true; do date; arp -a; sleep 10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Subnet = 10.0.0.0/24&#xA;Network Address = 10.0.0.0&#xA;Broadcast Address = 10.0.0.255&#xA;Range of available IP addresses: 10.0.0.1 to 10.0.0.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="881" LastActivityDate="2015-07-10T01:59:51.433" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19861" PostTypeId="2" ParentId="19849" CreationDate="2015-07-10T02:24:21.520" Score="2" Body="&lt;p&gt;You may have some options and without knowing more information, we cannot tell you which way is best.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I agree with Ricky, getting on management VLAN and pinging the broadcast address, looking at your computers ARP table and see which MAC is a Zyxel MAC.&lt;/li&gt;&#xA;&lt;li&gt;You could run an application like NMAP, maybe even LAN Sweeper, that can scan your management VLAN and give you information about the hosts it can detect. &lt;/li&gt;&#xA;&lt;li&gt;If the switch has a trunk interface setup, plug your laptop into it and open wire shark, you'll see what VLANs, IPs and MACs are out there &lt;/li&gt;&#xA;&lt;li&gt;If you have DHCP on the management VLAN or any VLANs, take a look at leases and reservations. If nothing there, look at reserved space. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would look at DHCP first. If I didn't see a lease or reservation (which I wouldn't expect to see), I would then use the scan tools for the reserved range of IPs in the DHCP scope. The fewer hosts you scan the faster the scan. I would also scan with an ssh username/password (default you said) and that makes me think that the snmp community is also set to &quot;public&quot;. Which you could also scan for. I'd also scan for port 443 and 80, as it appears the management Web interface operates on these ports but I'd double check the documentation first and scan those ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Happy hunting!&lt;/p&gt;&#xA;" OwnerUserId="881" LastActivityDate="2015-07-10T02:24:21.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19862" PostTypeId="1" CreationDate="2015-07-10T03:08:22.813" Score="0" ViewCount="223" Body="&lt;p&gt;Hoping to get some help regarding a small office network being set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've got a modem/router that's handling DHCP connected to an AirPort Time Capsule which is bridged/handling the wireless network side of things. The modem/router is connected to the APTC via 100mbit ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, does that mean local traffic on the Wi-Fi connection is limited to 100mbit? Will internal traffic move from the AP back to the router because it is the one handling DHCP? Or is it smart enough to happen on the AirPort? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just wondering as all devices are Wireless AC!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="16487" LastActivityDate="2015-10-08T04:32:44.707" Title="Does internal traffic go back to modem router?" Tags="|wireless|ethernet|dhcp|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-11T18:40:22.963" ContentLicense="CC BY-SA 3.0" />
  <row Id="19863" PostTypeId="2" ParentId="19862" CreationDate="2015-07-10T03:28:57.000" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Wi-Fi connection is limited to 100mbit?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. That's the AP's only access to anything else.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Will internal traffic move from the AP back to the router because it is the one handling DHCP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. Any traffic between wireless clients will only pass through the AirPort.  Traffic will flow back to the router because that's what the AP is connected to -- assuming there's any non-wireless nodes in your network, and it's the path to the internet.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-10T03:28:57.000" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19864" PostTypeId="2" ParentId="19856" CreationDate="2015-07-10T04:56:26.973" Score="3" Body="&lt;p&gt;If a broadcast relied on ARP then how could it have ARP'd in the first place? You are basically sending all packets to FF:FF:FF:FF:FF:FF. Since you have the source mac address your computer wouldn't ARP. &lt;/p&gt;&#xA;" OwnerUserId="15842" LastActivityDate="2015-07-10T04:56:26.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19865" PostTypeId="2" ParentId="19840" CreationDate="2015-07-10T06:54:32.180" Score="0" Body="&lt;p&gt;As you correctly described, classfull addressing is not efficient compared to classless addressing, since a lot of IP addresses remain wasted inside the subnets with classfull addressing.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I just can't grasp why every resource I touch claims that classful&#xA;  addressing is &quot;a thing of the past&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's true that IPs might handle a C-class network, but this is not true for all ISPs. Furthermore, in the previous era, classfull addressing was used in all subnets (even for home subnets, or corporate subnets), where nowadays only classless addressing is used (if not NAT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the reason classfull addressing is a thing from the past.&lt;/p&gt;&#xA;" OwnerUserId="16477" LastActivityDate="2015-07-10T06:54:32.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19866" PostTypeId="2" ParentId="19846" CreationDate="2015-07-10T07:01:31.630" Score="3" Body="&lt;p&gt;The last part of your question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is&#xA;11:47:23.914998 IP 10.11.204.34.mdns &gt; 224.0.0.251.mdns: 0 PTR (QM)? 22.204.11.10.in-addr.arpa. (43)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a multicast DNS lookup, the ip at the end is a reverse lookup IP-&gt;Name the ip is specified in revese order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus the device 10.11.204.34 is trying to find a dns name for 10.11.204.22.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Multicast_DNS&quot; rel=&quot;nofollow&quot;&gt;Multicast_DNS&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-10T07:01:31.630" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19868" PostTypeId="1" CreationDate="2015-07-10T08:01:38.930" Score="3" ViewCount="1031" Body="&lt;p&gt;Is it possible to translate one local source IP address to different glabal addresses, with translation being based on destination port number?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco 3825 and PIX 501 are available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within a concrete task, I need to send HTTPS requests from my client program to an outside web server, periodically changing a global address used by the program. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have got a pool of 64 internet addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can change sent packets destination port number programmatically, and I hope to use these changed port numbers as a criterion when translating the source IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am about to revert the destination port number back to 443 after changing the global source IP address.&lt;/p&gt;&#xA;" OwnerUserId="16492" LastEditorUserId="8499" LastEditDate="2016-04-05T00:50:30.423" LastActivityDate="2017-08-28T19:44:05.533" Title="NAT based on destination port number" Tags="|nat|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19869" PostTypeId="1" CreationDate="2015-07-10T09:30:02.340" Score="7" ViewCount="65588" Body="&lt;p&gt;I'm testing a network and I use the vlan among 20 vlan but in this packet tracer I just use 10 Vlan on my network,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, I use the DHCP server on my multilayer switch, not on my router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so on the port on multilayer swith to switch layer 2 I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for the DHCP server on multilayer switch I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool vlan1&#xA;network 192.168.0.0 255.255.255.0&#xA;default-router 192.168.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the same for other vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have add the vlan and the IP address like on the picture&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/K8gnl.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but when I config on the all switch layer 2, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;on fa0/1 who connected to multilayerswitch I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and port fa0/2-3 who connected to PC I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode access&#xA;switchport access vlan &amp;lt;VLANID&amp;gt;&#xA;! VLANID == VLAN for respective switch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But there's some thing weird,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On VLAN 1 and 2 it's almost connected and get the dhcp ip success but on the other PC I cannot get the DHCP IP it's remarks &quot;dhcp failed. apipa is being used&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please help, &lt;/p&gt;&#xA;" OwnerUserId="16495" LastEditorUserId="33" LastEditDate="2015-11-09T23:34:29.033" LastActivityDate="2018-03-16T18:08:22.340" Title="dhcp failed. apipa is being used" Tags="|vlan|dhcp|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19870" PostTypeId="2" ParentId="19868" CreationDate="2015-07-10T09:32:24.003" Score="2" Body="&lt;p&gt;From a support forum &lt;a href=&quot;https://supportforums.cisco.com/document/11011/how-configure-static-nat-static-pat-command-pix-asa-and-fwsm&quot; rel=&quot;nofollow&quot;&gt;static-pat-pix&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note: You &lt;strong&gt;cannot use&lt;/strong&gt; the same real or mapped address in &lt;strong&gt;multiple&#xA;  static commands between the same two interfaces&lt;/strong&gt;. Do not use a mapped&#xA;  address in the static command that is also defined in a global command&#xA;  for the same mapped interface.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Thus it seems we have two options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;NAT on the router; not recommended as it would be difficult&#xA;to get through the PIX.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Change the IP address (private) on the host, and have a PIX rule for each private IP address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;As you did not give any real IP addresses, I will create a example.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;On the hosts, use 10.0.0.1-10.0.0.15/28.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On the PIX, NAT to 196.0.0.1 - 196.0.0.1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global (outside) 1 196.0.0.1-196.0.0.15 netmask 255.255.255.240&#xA;nat (inside) 1  10.0.0.0  255.255.255.240  0  0&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Or you can NAT, one by one, with:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static (inside,outside) 10.0.0.1 196.0.0.1 netmask  255.255.255.255&#xA;static (inside,outside) 10.0.0.2 196.0.0.2 netmask  255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, every time you need to change your external IP address, just change the internal source IP address.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="8499" LastEditDate="2016-04-05T00:47:38.793" LastActivityDate="2016-04-05T00:47:38.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19871" PostTypeId="2" ParentId="19840" CreationDate="2015-07-10T09:37:54.940" Score="7" Body="&lt;p&gt;As many answers already explain, classes are a thing of the past because they do not allow subnet masks other then /8, /16 and /24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These specific subnet masks are still very popular, especially /24, because they are the easiest on us humans. For these masks, the end of the subnet part of the address lines up with a dot in the (dotted-decimal) IP address. Thus it is visually clear if two IP addresses are in the same subnet or not, no calculations required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why the class A, B and C terms stick around, they still align with the most common subnet masks. But they do not make sense anymore, and saying 10.11.12.0/24 is a class C is simply wrong. The first octet of a C class was by definition between 192 and 223.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-07-10T09:37:54.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19872" PostTypeId="1" CreationDate="2015-07-10T09:59:45.953" Score="0" ViewCount="10398" Body="&lt;p&gt;I'm trying to use VMware Workstation 6.0, I have installed EXSI hypervisor 6.0 in a system successfully. I also installed VMware vSphere 6.0 successfully in window 7 and window XP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried connecting from window 7 VMware Client to Hypervisor it able to connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While connecting from Window XP , I have found below error :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;vSphere Client could not connect to &quot;&quot; An unknown connection error occurred. (The Client could not send a complete request to the server. (The underlying connection was closed: An unexpected error occurred on a send.))&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does WMware Client have compatibility for WindowXP ?? Do we have work around for windowXP ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="16498" LastActivityDate="2015-07-10T13:09:41.950" Title="VMware vSphere Client connecting VMware 6.0 -ERROR :vsphere client could not connect to “&lt;ip_add&gt;”" Tags="|vmware|" AnswerCount="1" CommentCount="2" ClosedDate="2015-07-10T20:39:16.710" ContentLicense="CC BY-SA 3.0" />
  <row Id="19873" PostTypeId="1" CreationDate="2015-07-10T13:02:33.207" Score="0" ViewCount="71" Body="&lt;p&gt;On AWS, I noticed that their CloudWatch tool cannot see memory utilization of EC2 instances. I can, on the other hand, see CPU utilization, network metrics, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is it that a hypervisor can see the CPU but not the RAM utilization of instances?&lt;/p&gt;&#xA;" OwnerUserId="15270" LastActivityDate="2015-07-10T14:18:38.033" Title="Why can the hypervisor not see RAM utilization?" Tags="|cpu|" AnswerCount="1" CommentCount="0" ClosedDate="2015-07-10T19:38:34.417" ContentLicense="CC BY-SA 3.0" />
  <row Id="19874" PostTypeId="2" ParentId="19872" CreationDate="2015-07-10T13:09:41.950" Score="1" Body="&lt;p&gt;Windows XP is not &lt;a href=&quot;http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&amp;amp;cmd=displayKC&amp;amp;externalId=2005083&quot; rel=&quot;nofollow&quot;&gt;supported&lt;/a&gt; for the client in 5.x or 6.x. As a side note they are moving away from the Windows client and only adding new features to the web client. Unfortunately you need to install vCenter to take advantage of this new web based client.&lt;/p&gt;&#xA;" OwnerUserId="16282" LastActivityDate="2015-07-10T13:09:41.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19875" PostTypeId="1" CreationDate="2015-07-10T13:10:26.763" Score="1" ViewCount="148" Body="&lt;p&gt;I have two ASAs that have publicly routable ipv6 addresses, and a /56 at each site.  Since we're going to be rolling out ipv6 internally at some point for all users, I'd really like to prevent packets from going out of the ASA unencrypted if the traffic matches a cryptomap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not actually tested this scenario, but in the event that the IPSec SA is not nailed up, would the packets route out the outside interface without being encrypted?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know on ScreenOS there was a way to ensure this didn't happen by null-routing the opposing side subnet on the outbound interface, but I've not tried this on an ASA yet and am curious if anyone else has input.  In ScreenOS, the vpn becomes an interface, so it was easier to say &quot;Null route the subnet on the outside&quot;, but I'm wondering if doing that would cause the ASA to route the packets to Null0 before it hits the ipsec engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: the reason why I cannot yet test this is due to a bug that I need to upgrade our ASA versions to resolve (CSCuj23318)&lt;/p&gt;&#xA;" OwnerUserId="154" LastActivityDate="2015-07-10T14:10:24.113" Title="Will an asa pass traffic that matches a crypto map entry if Phase 2 is not completed?" Tags="|cisco-asa|ipv6|ipsec|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19876" PostTypeId="2" ParentId="3107" CreationDate="2015-07-10T13:55:46.713" Score="2" Body="&lt;p&gt;@Mud, you've pretty much got the answer to your question spread over several comments so I'm merely consolidating it here in a single answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the 7600s/6500s you can filter BFD (control-plane traffic) at the interface level just like any other traffic (transit traffic passing through the device).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you apply an ACL to a port on the line card its applied to all traffic on that interface. Traffic that needs to be process by the RSP or DFCs if you are using them needs to be punted there which is after the ACL is processed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a rule of thumb I have been including control-plane traffic in QoS policies of late, such as the following where &quot;class NC&quot; matches CS6 &amp;amp; CS7 only:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map QoS-Example&#xA; class NC&#xA;  bandwidth percent 2&#xA; !&#xA; class REALTIME&#xA;  police rate percent 10&#xA;   conform-action transmit&#xA;   exceed-action drop&#xA;  !&#xA;  priority level 1&#xA; !&#xA; class 1&#xA;  bandwidth percent 22&#xA; !&#xA; class 2&#xA;  bandwidth percent 24&#xA; !&#xA; class 3&#xA;  bandwidth percent 12&#xA; ....... and so on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you write a CoPP policy for your 7600s/6500s you need to write ACLs that match all your relevant kinds of control-plane traffic. So you can also match BFD traffic by matching traffic to/from UDP port 3784 (and lock that down further to your interface IP if possible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @ytti said you need to be wary of the BFD timers on your setup, if you haven't got DFCs your running BFD on the RSP/CPU power. In that case you might also want to look at tweaking you &quot;process-max-time&quot; global command and the process schedule &quot;scheduler allocate xxx xxx&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco recommended minimum is &lt;code&gt;bfd interval 100 min_rx 100 multiplier 3&lt;/code&gt; but on some production boxes without DFCs I am actually running &lt;code&gt;bfd interval 500 min_rx 500 multiplier 3&lt;/code&gt; which has been fine, I think on the boxes with DFCs which I don't have access to right now I'm running the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see these references for more info, which cover BFD tuning and ACLs for control plane traffic (both CoPP and interface ACLs), and also some control-plane tuning that is generally good practice, also QoS behaviour with control-plane traffic:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/7600/troubleshoot/guide/7600_Trouble_Shooting.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/routers/7600/troubleshoot/guide/7600_Trouble_Shooting.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/7600/ios/12-2SR/configuration/guide/swcg/dos.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/routers/7600/ios/12-2SR/configuration/guide/swcg/dos.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-congestion-management-queueing/18664-rtgupdates.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-congestion-management-queueing/18664-rtgupdates.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2015-07-10T14:00:54.203" LastActivityDate="2015-07-10T14:00:54.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19877" PostTypeId="2" ParentId="19875" CreationDate="2015-07-10T14:10:24.113" Score="4" Body="&lt;p&gt;If the traffic matches a Crypto ACL, the ASA will attempt to bring up Phase 2 (and Phase 1 if it isn't already up).  If the build attempt fails, no traffic will make it to the outside interface.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-07-10T14:10:24.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19878" PostTypeId="1" CreationDate="2015-07-10T14:18:13.143" Score="1" ViewCount="71" Body="&lt;p&gt;Something like &lt;a href=&quot;http://netfee.ustc.edu.cn/dns/&quot; rel=&quot;nofollow&quot;&gt;http://netfee.ustc.edu.cn/dns/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Showing top DNS queries and top clients etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not seeing any open source projects doing exactly the same thing, &lt;a href=&quot;https://www.nanog.org/meetings/nanog55/presentations/Tuesday/Creyts.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.nanog.org/meetings/nanog55/presentations/Tuesday/Creyts.pdf&lt;/a&gt; is somewhere close but still not quite there yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I build a DNS monitoring system like this with BIND? Packet capturing seems quite inefficient.&lt;/p&gt;&#xA;" OwnerUserId="34" LastActivityDate="2015-07-11T01:58:41.320" Title="DNS analytics solutions?" Tags="|dns|" AnswerCount="1" CommentCount="1" ClosedDate="2015-07-12T11:23:48.350" ContentLicense="CC BY-SA 3.0" />
  <row Id="19879" PostTypeId="2" ParentId="19873" CreationDate="2015-07-10T14:18:38.033" Score="3" Body="&lt;p&gt;When ram is allocated to a VM(Guest), the VM is using it.  The host does not know if the values stored in the ram is relevant or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OS running in a VM keeps track of Ram assigned, but it does not have to ask the Host for ram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is easy for the host to keep track of stats for things entering or leaving the VM e.g. Network packets or Disk read's and writes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with ram is that for the time slice the VM has the CPU it can read/modify/write to it's allocated ram without any visibility by the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is also the reason that changing the RAM dynamically is not really a option.  One way around this is with a baloon driver loaded in the Guest, it can then chat with a back channel to the Host, asking for ram from the Guest where it runs, and then informing the Host it is locked and can be removed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the user then decides to add more ram, the balloon driver informs the guest it does not need the ram it was holding.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-10T14:18:38.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19880" PostTypeId="2" ParentId="18734" CreationDate="2015-07-10T15:40:36.113" Score="1" Body="&lt;p&gt;For the scenario I wanted, it can only be done in a multi-homed environment. You need to have an AS to accomplish this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution was to advertise your AS via BGP and then you can use any ISP you like. They will route back to your VPN addresses. In this case you only need 1 VPN address. &lt;/p&gt;&#xA;" OwnerUserId="15621" LastActivityDate="2015-07-10T15:40:36.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19881" PostTypeId="1" AcceptedAnswerId="19888" CreationDate="2015-07-10T16:54:08.853" Score="9" ViewCount="99092" Body="&lt;p&gt;I am using Linux. I read somewhere on the internet that pinging the address 255.255.255.255 will ping everyone in the network segment. And it will return every IP addresses in that subnet. But when I tried&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ashokkrishna@ashokkrishna-Lenovo-B560:~$ ping -b 255.255.255.255&#xA;WARNING: pinging broadcast address&#xA;PING 255.255.255.255 (255.255.255.255) 56(84) bytes of data.&#xA;64 bytes from 192.168.1.220: icmp_seq=1 ttl=64 time=100 ms&#xA;64 bytes from 192.168.1.220: icmp_seq=1 ttl=64 time=100 ms (DUP!)&#xA;64 bytes from 192.168.1.220: icmp_seq=2 ttl=64 time=128 ms&#xA;64 bytes from 192.168.1.220: icmp_seq=2 ttl=64 time=130 ms (DUP!)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I only get the reply from one IP.&lt;/p&gt;&#xA;&lt;p&gt;How to get every IP? I know how to get every IP with Nmap but what I read in the internet is totally opposite to my results, why?&lt;/p&gt;&#xA;&lt;p&gt;Same with&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ashokkrishna@ashokkrishna-Lenovo-B560:~$ ping -b 192.168.1.255&#xA;WARNING: pinging broadcast address&#xA;PING 192.168.1.255 (192.168.1.255) 56(84) bytes of data.&#xA;64 bytes from 192.168.1.220: icmp_seq=1 ttl=64 time=55.2 ms&#xA;64 bytes from 192.168.1.220: icmp_seq=1 ttl=64 time=66.6 ms (DUP!)&#xA;64 bytes from 192.168.1.220: icmp_seq=2 ttl=64 time=78.5 ms&#xA;64 bytes from 192.168.1.220: icmp_seq=2 ttl=64 time=79.2 ms (DUP!)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6195" LastEditorUserId="43734" LastEditDate="2023-04-11T14:50:53.390" LastActivityDate="2023-04-11T20:30:59.647" Title="Pinging broadcast address" Tags="|ping|broadcast|icmp|network-discovery|" AnswerCount="6" CommentCount="3" ClosedDate="2022-09-25T23:01:25.330" ContentLicense="CC BY-SA 4.0" />
  <row Id="19882" PostTypeId="2" ParentId="19838" CreationDate="2015-07-10T18:14:59.293" Score="1" Body="&lt;p&gt;You guys probably missed something. Cisco CP must be installed on your device, so this feature requires you change the username and password (cisco/cisco) the first time you log into your router, if not, you won't be able to log in again after you have logged off.&lt;/p&gt;&#xA;" OwnerUserId="16510" LastActivityDate="2015-07-10T18:14:59.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19883" PostTypeId="2" ParentId="19881" CreationDate="2015-07-10T19:34:16.430" Score="-1" Body="&lt;p&gt;Why do you use the bounds option (-b) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try without this option, it should work unless your router blocks the broadcasted ping requests.&lt;/p&gt;&#xA;" OwnerUserId="16335" LastActivityDate="2015-07-10T19:34:16.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19884" PostTypeId="1" CreationDate="2015-07-10T21:14:22.687" Score="1" ViewCount="511" Body="&lt;p&gt;I have a situation where I need 2 LANs to use the same ISP Gateway and ISP IP, but the LANs cannot be able to interact with each other. I am guessing I need two DHCP servers at the same scope. I have already tried having a DCHP server under the other DHCP server scope (but with a static IP) and setting up the nested DHCP server to use the upper DHCP server as the gateway and I could access the internet, except any device on the nested DHCP could interact with the entire LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I can't just hook up 2 DHCP's to the modem and share the same ISP IP and ISP Gateway, do I need to have a router setup up as a gateway (by this I mean just take create a LAN, will turn off any DHCP and statically assign IPs) that which will use the ISP IP and Gateway, then have 2 DHCP's connected to that router and point them at the router for the gateway to the outside internet? If I do this, will one device on a DHCP not be able to see interact with a device on the other DHCP? Also, if I do this will I be able to setup a virtual server 'chain' so I could remotely SSH into a device under one of the DHCP's?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I could do this with an linux based router firmware with a single router rather than 3? I'd prefer to do it in wrt if at all possible, but I wonder if I could do this in IPFire?&lt;/p&gt;&#xA;" OwnerUserId="16513" LastActivityDate="2015-07-11T01:59:32.587" Title="Best Way to Separate 2 LANs under a single ISP IP" Tags="|dhcp|lan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19887" PostTypeId="2" ParentId="19840" CreationDate="2015-07-11T00:10:07.090" Score="2" Body="&lt;p&gt;In &lt;a href=&quot;https://en.wikipedia.org/wiki/Classful_network&quot; rel=&quot;nofollow&quot;&gt;Classful routing&lt;/a&gt;, the netmask is implied by the top bits of the address, and is not stored in routing tables; the class is a property of each address, not just of the routing topology.  A Class C network cannot be a subset of a Class B network, because the top bits cannot match both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your hypothetical organization with 3 Class C networks would have to pay attention to which computers got addresses in which of the 3 networks.  With CIDR routing, they can use a netmask that allows all of their computers to be in the same subnet.&lt;/p&gt;&#xA;" OwnerUserId="4286" LastActivityDate="2015-07-11T00:10:07.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19888" PostTypeId="2" ParentId="19881" CreationDate="2015-07-11T01:54:43.087" Score="17" Body="&lt;p&gt;Not all machines will answer a broadcast ping. (all broadcast -- 255.255.255.255, or subnet broadcast -- eg. x.x.x.255) Some see it as a &quot;security feature&quot;, because one could spoof the origin to flood any host on the network.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-11T01:54:43.087" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19889" PostTypeId="2" ParentId="19878" CreationDate="2015-07-11T01:58:41.320" Score="3" Body="&lt;p&gt;Study BIND's &lt;em&gt;logging&lt;/em&gt; clause.&lt;sup&gt;[&lt;a href=&quot;ftp://ftp.isc.org/isc/bind/cur/9.9/doc/arm/Bv9ARM.ch06.html#id2574875&quot; rel=&quot;nofollow&quot;&gt;1&lt;/a&gt;][&lt;a href=&quot;http://www.zytrax.com/books/dns/ch7/logging.html&quot; rel=&quot;nofollow&quot;&gt;2&lt;/a&gt;][&lt;a href=&quot;http://docstore.mik.ua/orelly/networking_2ndEd/dns/ch07_05.htm&quot; rel=&quot;nofollow&quot;&gt;3&lt;/a&gt;]&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I've used for decades:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging {&#xA;        channel syslog_debug {&#xA;                syslog daemon;&#xA;                severity debug;&#xA;                print-category yes;&#xA;                print-severity yes;&#xA;        };&#xA;        channel statistics_log {&#xA;                file &quot;logs/statistics&quot; versions 5 size 10M;&#xA;                severity debug;&#xA;                print-time yes;&#xA;        };&#xA;        channel query_log {&#xA;                file &quot;logs/querylog&quot; versions 25 size 10M;&#xA;                severity debug;&#xA;                print-time yes;&#xA;        };&#xA;        category security       { syslog_debug; };&#xA;        category xfer-in        { syslog_debug; };&#xA;        category xfer-out       { syslog_debug; };&#xA;        category load           { syslog_debug; };&#xA;        category statistics     { syslog_debug; statistics_log; };&#xA;        category queries        { query_log; };&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-11T01:58:41.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19890" PostTypeId="2" ParentId="19884" CreationDate="2015-07-11T01:59:32.587" Score="2" Body="&lt;p&gt;You can logically create virtual LANs (VLANs) with each having a unique subnet and default gateway.  Each of these LANs default gateway can be the same physical device.  Typically, a trunk interface (802.1q) plugs into an Ethernet switch that has both VLANs configured, along with the trunk interface that plugs into the default gateway device which will likely be running NAT/PAT.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-11T01:59:32.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19891" PostTypeId="1" AcceptedAnswerId="19895" CreationDate="2015-07-11T08:16:11.277" Score="2" ViewCount="582" Body="&lt;p&gt;Hi not sure where to ask this thought this would be the best place, i was just wondering if it was at all possible to have a single connection get the benefit of multiple internet connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example lets say my standard upload for 1 internet connection is only 100kb/s but i have a second line that is also 100kb/s up, and i would like to combine them to get a total upload of 200kb/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously i know this wouldn't normally be possible, like how would the server know both connections were for the same data, unless of course it was specifically designed like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But hear me out what if i had some kind of modified router that was able to balance the single connection over both the internet connections, then sending these connections to a server somewhere which could combine these separate connections back into the original one, then sending it on it is was, the server would essentially be acting as a proxy/vpn i guess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But does anything like this exist? Surely there must be something. I tried doing some googling but didnt come up with much, i understand it is possible to balance multiple connections over multiple internet connections, but how about what i describe, just one connection, in my mind it makes sense lol&lt;/p&gt;&#xA;" OwnerUserId="16520" LastActivityDate="2015-07-11T12:02:27.727" Title="single connection over multiple internet connections" Tags="|tcp|internet|udp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19892" PostTypeId="1" AcceptedAnswerId="27854" CreationDate="2015-07-11T09:20:10.187" Score="4" ViewCount="16672" Body="&lt;p&gt;After talking to a few hosted VoIP providers, they all state that &quot;ALG&quot; or SIP inspection in the case of the Cisco firewall should be disabled.  &lt;strong&gt;How is SIP not broken after leaving the firewall over the public Internet when being NAT'd&lt;/strong&gt; from a private to public address if the SIP payload contains a private address that inspection would normally fixup -- using the older inspection terminology there ;-) ?  Is STUN or TURN the &lt;strong&gt;only&lt;/strong&gt; way preventing this breakage and can I assume that these providers support that or does that have to be confirmed?  Is it not better to have inspection?  I know that certain SIP implementations don't add addressing in the application layer, but in the these cases they do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have &lt;strong&gt;SIP inspection enabled and don't see any issues&lt;/strong&gt; with it and I gain the benefit of not only being able to do a &lt;em&gt;show SIP&lt;/em&gt; but the necessary pinholes are dynamically created instead of opening wide static holes these providers often request, but the providers still insist having ALG creates more problems.&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="630" LastEditDate="2015-07-11T17:45:13.800" LastActivityDate="2019-10-28T04:29:38.383" Title="SIP through ASA without inspection" Tags="|cisco-asa|firewall|sip|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19893" PostTypeId="1" AcceptedAnswerId="19908" CreationDate="2015-07-11T09:48:59.190" Score="5" ViewCount="350" Body="&lt;p&gt;&lt;em&gt;This Q. is really confirmation to what I already suspect.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a single physical interface with a carrier that uses two dot1q logical sub interfaces to handle DIA and L3VPN,&#xA;I suspect any &lt;strong&gt;usage of DIA for data from branch offices (BOs)  instead of backhauling renders QoS for voice (SIP and RTP) packets over L3VPN moot when it's needed.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although I can mark voice packets for QoS over VPN, DIA traffic competes with that without DSCP so the physical circuit can be saturated and priority not given to voice.  And since the congestion is already at the doorstep, not much can be done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are these assumptions true?  &lt;strong&gt;Would it be better to just backhaul data over VPN so end-to-end QoS is unaffected as long as sufficient branch office bandwidth exists?&lt;/strong&gt;  BO DIA could still exist as a backup.  What other viable and proven options exist to this classic problem? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All BO sites are part of full mesh MPLS-VPN and were required to have DIA before voice came into picture.  Hosted VoIP provider can tie into this VPN or use SIP trunks from HQ.  Provider is recommending uncompressed codec that eats up 90Kbps over compressed one at 30Kbps.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-07-12T04:20:27.383" Title="VoIP QoS over DIA/L3VPN physical circuit" Tags="|qos|voip|mpls-vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19894" PostTypeId="2" ParentId="19891" CreationDate="2015-07-11T10:00:52.423" Score="3" Body="&lt;p&gt;You're looking for &lt;strong&gt;per-packet load balancing&lt;/strong&gt; where packets get round-robin'd over interfaces of equal cost, but the issue becomes out of order arrival of packets which could lead to bigger problems.  Usually, per-flow load balancing is performed which can send separate conversations over different links though this depends on load balancing algorithm chosen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/modules/ps2033/prod_technical_reference09186a00800afeb7.html&quot; rel=&quot;nofollow&quot;&gt;Cisco load balancing with CEF&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-07-11T10:00:52.423" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19895" PostTypeId="2" ParentId="19891" CreationDate="2015-07-11T12:02:27.727" Score="2" Body="&lt;p&gt;The problem with separate providers is that you have different external IP's.&lt;/p&gt;&#xA;&lt;p&gt;To balance a single connection over the two links your options are.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Dual tunnels to external server, as you suggested, then you do per  load-balancing over the two tunnels, and at the external server you are hidden(Nated or web proxy) behind a new public IP.&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This will work, but you could generate additional re-transmissions as packet delivery might not always be in order&lt;/li&gt;&#xA;&lt;li&gt;Quite complex as you will need two tunnels, with routing and per packet loadbalancing.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Use a protocol built for this &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4960&quot; rel=&quot;nofollow noreferrer&quot;&gt;SCTP&lt;/a&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Will need both endpoints to support it.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Wait for new protocols e.g. &lt;a href=&quot;http://www.networkworld.com/article/2602109/lan-wan/ucla-cisco-more-join-forces-to-replace-tcpip.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;NDN-cisco&lt;/a&gt; forwarding is designed to enable multi-path routing.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In the Future.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Use a web downloader that breaks a single file download into a lot of smaller download pieces.  As each piece is a separate connections they could loadbalance over different links/providers.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Will work with big downloads from websites.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;Use torrent downloader, or syncing software e.g. &lt;a href=&quot;https://www.getsync.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;sync 2.0&lt;/a&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Also needs support on both ends.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2015-07-11T12:02:27.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19898" PostTypeId="2" ParentId="19838" CreationDate="2015-07-11T14:22:17.190" Score="1" Body="&lt;p&gt;Here's the reference may can be usefull&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-123-mainline/46509-factory-default.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-123-mainline/46509-factory-default.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enter rommon mode :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Reload,&#xA;Ctrl+break&#xA;confreg 0x2142&#xA;Reset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Login again (cisco/cisco)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Conf t&#xA;Config-register 0x2102&#xA;Do wr&#xA;Reload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16524" LastEditorUserId="509" LastEditDate="2015-07-12T10:58:48.243" LastActivityDate="2015-07-12T10:58:48.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19902" PostTypeId="2" ParentId="1345" CreationDate="2015-07-11T18:14:41.690" Score="2" Body="&lt;p&gt;Since you are wanting to measure a layer 2 circuit, I'd like to shamelessly push some free software that I have been writing. It's still in beta but does exactly what you want based on the information in your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike nuttcp, iPerf, jPerf et al, Etherate runs directly over layer 2 designed specifically for Ethernet testing. Like the others a laptop on each is all that is required and my Intel i3 laptop can max out a gig link with ease.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since it’s in beta stage the more advanced features aren’t ready yet like MPLS testing but throughput, latency and MTU testing (all directly on layer 2 Ethernet) are implemented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/jwbensley/etherate&quot; rel=&quot;nofollow&quot;&gt;https://github.com/jwbensley/etherate&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2015-07-11T18:14:41.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19903" PostTypeId="2" ParentId="1217" CreationDate="2015-07-11T18:22:51.803" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/jwbensley/etherate&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Etherate&quot;&gt;Etherate&lt;/a&gt; enables you to test QoS down to layer 2 directly over Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using it you can generate layer 2 Ethernet traffic in a controlled manner which you can measure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can specify traffic flow duration, frame size, bits per second / bytes per second, total bytes to transfer, ethertype, VLAN ID, and PCP value. You can also ACK the layer 2 frames if you want to test loss down at layer 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the test is complete the Rx host displays a count of test frames received, non-test frames received, test frames received in order and test frames received out of order (early or late).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to get some helpful information from all of that!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/jwbensley/etherate&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/jwbensley/etherate&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="31801" LastEditDate="2019-04-21T19:52:22.653" LastActivityDate="2019-04-21T19:52:22.653" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19904" PostTypeId="2" ParentId="9488" CreationDate="2015-07-11T18:28:46.903" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://github.com/jwbensley/etherate&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Etherate&quot;&gt;Etherate&lt;/a&gt; enables you to measure throughput, latency and packet (frame) loss down at layer 2 directly over Ethernet (which sounds like what you are looking for). It doesn’t measure jitter at present but it will do in the future. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using it you can generate layer 2 Ethernet traffic in a controlled manner which you can measure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can specify traffic flow duration, frame size, bits per second / bytes per second, total bytes to transfer, ethertype, VLAN ID, and PCP value. You can also ACK the layer 2 frames if you want to test loss down at layer 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the test is complete the Rx host displays a count of test frames received (if this is less that the number of frames sent from the Tx host, that gives you the frame loss figure), non-test frames received, test frames received in order and test frames received out of order (early or late).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/jwbensley/etherate&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/jwbensley/etherate&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="31801" LastEditDate="2019-04-18T08:43:34.147" LastActivityDate="2019-04-18T08:43:34.147" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19905" PostTypeId="2" ParentId="9367" CreationDate="2015-07-11T19:30:21.043" Score="-1" Body="&lt;p&gt;What you need is ip source guard combined with ip dhcp snooping. IP dhcp snooping protects against rouge dhcp servers by shutting down the port of the rouge dhcp server:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;combine ip dhcp snooping with ip source guard, you can prevent someone from changing their ip from the DHCP assigned one to a manual one:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/ipsrcgrd.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/ipsrcgrd.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16531" LastActivityDate="2015-07-11T19:30:21.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19908" PostTypeId="2" ParentId="19893" CreationDate="2015-07-12T04:20:27.383" Score="2" Body="&lt;p&gt;For ingress traffic into your CE/BO devices, you are correct - your markings are largely pointless, as ingress traffic is serviced on a first-come/first-serve basis and congestion will be already in play by that point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be possible for your provider to enforce egress prioritisation between their PE interface and each of your CEs to give your voice traffic priority over any Internet downloads, but this would depend on how well provisioned their network is and the type of service you have purchased.  Some charge extra to &quot;enable qos&quot;.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-12T04:20:27.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19909" PostTypeId="2" ParentId="19844" CreationDate="2015-07-12T04:28:45.930" Score="1" Body="&lt;p&gt;Adding to Łukasz Bromirski's answer - it will also depend on the physical speed of your interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your 2Mbps link is (say) an E1 serial link, then your maths holds up, however if you have an Ethernet connection that is &lt;em&gt;rate-limited&lt;/em&gt; to 2Mbps, then you will actually be transmitting at the speed of the underlying physical interface (say 10/100/1000Mbps), and some form of statistical shaper/policer will kick-in once you've exceeded your allocated rate for that &lt;strong&gt;second&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-12T04:28:45.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19910" PostTypeId="2" ParentId="19763" CreationDate="2015-07-12T05:11:19.243" Score="3" Body="&lt;p&gt;Your thinking around the external BGP advertisements is sound, although as other have suggested, I'd highly recommend you run BGP with your providers for automated route-withdrawal on failure.  Consider also the need to take a site offline for maintenance, or the need to add, move or migrate providers in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, how about an alternative design:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Rather than de-aggregating your prefixes and further polluting the already bloated DFZ, advertise the same /22 out both providers. (Search: BGP Anycast)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Rather than stretching a layer 2-domain across two physically separate sites, make each of those links routed, using something like OSPF and BFD, so that your fail-overs are faster (sub-second), having your sites go split-brain doesn't affect anything and when the day comes that you move one of your sites to a location that is too far away for Layer 2 adjacency, your design will still stand-up.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure both your BIG-IP LTMs with the same VIPs, so that either will function, regardless of what is happening with your upstream service-provider(s).  Consider having secondary server pools from the neighbouring site so that in the event of maintenance on the back-end, the LTMs can happily continue sending clients to the other site.  The VIP subnet would be advertised into OSPF/BGP (preferably from the BIG-IP) making the local LTM the preferred target for traffic from either ISP Gateway.  During a maintenance window, this route would be withdrawn but the BIG-IP, and the neighbour site would take over (Search: F5 Route Health Injection)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I don't see anything between the LTMs and the ISP Gateways that is stateful (unless the ISP Gateways themselves are), so return traffic can leave via the nearest ISP gateway regardless of where it originated.  For bonus points, if you take a limited BGP feed from each provider (only their customers and local peers) and share that between your Internet Gateways you will provide the best performance to those clients.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;BGP doesn't have to be a complex beast, and like any design: Good documentation should address any concerns about supportability into the future.  If your management aren't supportive of building it &lt;strong&gt;right&lt;/strong&gt;, then I'd advise that SaaS is not a space they should be getting into.  Outsource to a player like AWS and make it &lt;em&gt;Someone Else's Problem™&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-12T05:11:19.243" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="19911" PostTypeId="2" ParentId="19760" CreationDate="2015-07-12T05:59:25.343" Score="3" Body="&lt;p&gt;I would recommend not using AppDDoS moving forward.  Juniper announced its deprecation some time ago, and this is probably the reason you can't find many solid examples of its use:&#xA;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB28592&amp;amp;actp=search&amp;amp;viewlocale=en_US&amp;amp;searchid=1374905420170&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB28592&amp;amp;actp=search&amp;amp;viewlocale=en_US&amp;amp;searchid=1374905420170&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ironically, that KB recommends using the DDos Secure Product which has also been canned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To somewhat reproduce AppDDoS behaviour, you can do the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create a custom-attack referencing the protocol you are specifically hunting (e.g.: SQL), and just pick a context to match a normal operation (e.g.: mssql-login).  You can then apply &lt;code&gt;time-binding count 100&lt;/code&gt; to it, which basically means - if you see 100 of these within a minute, this is an attack.  The scope variable determines: from a single &lt;code&gt;source&lt;/code&gt; to multiple destinations (DoS), from multiple sources to a single &lt;code&gt;destination&lt;/code&gt; (DDoS), or just a single a single &lt;code&gt;peer&lt;/code&gt; to a single destination.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole thing looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;custom-attack SQL-DDOS {&#xA;    recommended-action drop;&#xA;    severity major;&#xA;    time-binding {&#xA;        count 100;&#xA;        scope destination;&#xA;    }&#xA;    attack-type {&#xA;        signature {&#xA;            context mssql-login;&#xA;            direction client-to-server;&#xA;            protocol {&#xA;                tcp {&#xA;                    destination-port {&#xA;                        match equal;&#xA;                        value 1433;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reference your attack(s) in an IPS policy, and make the &lt;code&gt;then&lt;/code&gt; term something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;idp-policy FRONTEND-SERVICS {&#xA;   rulebase-ips {&#xA;        rule SQL-SERVER {&#xA;            match {&#xA;                application junos-ms-sql;&#xA;                attacks {&#xA;                    custom-attacks SQL-DDOS;&#xA;                }&#xA;            }&#xA;            then {&#xA;                action {&#xA;                    drop-connection;&#xA;                }&#xA;                ip-action {&#xA;                    ip-block;&#xA;                    target source-address;&#xA;                    log;&#xA;                    timeout 60;&#xA;                    refresh-timeout;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will put in an ip-block action against any source addresses that trigger this attack for 1 minute, and if any further attacks from the same source are detected (e.g.: it's a dumb bot), keep restarting the 60-second timer every time you see one.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-12T05:59:25.343" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19914" PostTypeId="2" ParentId="19869" CreationDate="2015-07-12T11:07:37.323" Score="1" Body="&lt;p&gt;Friend use configuration as below as  you should have be sound basic knowledge&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Lab-R1&amp;gt; ena&#xA;&#xA;Lab-R1# config t&#xA;&#xA;Lab-R1(config)# ip dhcp pool myLAN&#xA;&#xA;Lab-R1(dhcp-config)# network 192.168.0.0 255.255.255.0&#xA;&#xA;Lab-R1(dhcp-config)# domain-name mydomain.lan&#xA;&#xA;Lab-R1(dhcp-config)# default-router 192.168.0.1&#xA;&#xA;Lab-R1(dhcp-config)# dns-server 192.168.0.2&#xA;&#xA;Lab-R1(dhcp-config)# exit&#xA;&#xA;Lab-R1(config)# ip dhcp excluded-address 192.168.0.1 192.168.0.120&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;at L2 sw&lt;/p&gt;&#xA;&#xA;&lt;p&gt;create vlan as 1 to 20 everyone have ip address with in same range as specified in router with each vlan have four ip address &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int vlan 1&#xA;ip address  192.168.0.5 255.255.255.0&#xA;&#xA;int vlan 2&#xA;ip address  192.168.0.10 255.255.255.0&#xA;&#xA;.&#xA;..&#xA;..&#xA;.&#xA;.&#xA;&#xA;int vlan 20 ip address  192.168.0.100 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it's working &lt;/p&gt;&#xA;" OwnerUserId="8007" LastEditorUserId="509" LastEditDate="2015-07-12T11:24:42.787" LastActivityDate="2015-07-12T11:24:42.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19917" PostTypeId="1" AcceptedAnswerId="19919" CreationDate="2015-07-12T14:37:51.913" Score="0" ViewCount="132" Body="&lt;p&gt;E.g. is there some scheduling going on at the hardware level that sends whole packets one after another in bit-streams to prevent individual ones being broken up, or if they are split up while being transferred over a network (into odd bits here and there) how would they be reconstructed?&lt;/p&gt;&#xA;" OwnerUserId="16546" LastEditorUserId="3782" LastEditDate="2015-07-13T05:16:20.197" LastActivityDate="2015-07-13T05:16:20.197" Title="How is a single physical packet of data kept together?" Tags="|ethernet|hardware|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19918" PostTypeId="1" CreationDate="2015-07-12T14:39:48.767" Score="3" ViewCount="4354" Body="&lt;p&gt;I'm running the following command on my backbone to monitor multicast traffic. I'm new to tcpdump usage and looking for some help:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo tcpdump -i eth1 -n -p multicast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I see a output like this - this is only part of it. I really don't know how to interpret this output. Can someone shed some light please. The first few lines I see seem to be normal traffic, but then I see the rest and I don't know what to make of it. And why is it only showing ARP? Sorry if some of those questions seem basic. Thank you in advance.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;22:18:22.038264 ARP, Request who-has 10.147.0.62 tell 10.147.0.64, length 46&#xA;22:18:22.244856 ARP, Request who-has 10.147.0.64 tell 10.147.0.61, length 46&#xA;22:18:22.245149 ARP, Request who-has 10.147.0.61 tell 10.147.0.64, length 46&#xA;22:18:22.888851 b4:99:ba:02:18:66 &amp;gt; Broadcast, ethertype Unknown    (0xcafe), length 90:&#xA;        0x0000:  0500 0100 0900 0000 0100 ffff 0c00 0002  ..... ...........&#xA;        0x0010:  4c00 0000 0000 0000 8300 0080 0000 0000  L...............&#xA;       0x0020:  0000 0000 4a59 7a55 ffff ffff 0000 0000  ....JYzU........&#xA;       0x0030:  8002 c000 0620 b499 ba02 1866 0103 0300  ...........f....&#xA;       0x0040:  0101 0402 515d 7303 7cda ca52            ....Q]s.|..R&#xA;       22:18:22.888860 b4:99:ba:02:18:66 &amp;gt; Broadcast, ethertype Unknown (0xcafe), length 90:&#xA;        0x0000:  0500 0100 0961 0200 0100 ffff 0c00 3a02  .....a........:.&#xA;        0x0010:  4c00 0000 0000 0000 8300 0080 0000 0000  L...............&#xA;        0x0020:  0000 0000 4a59 7a55 ffff ffff f74a 1789  ....JYzU.....J..&#xA;        0x0030:  5010 c000 0614 b499 ba02 1866 0a0a 0a00  P..........f....&#xA;        0x0040:  0101 0402 0000 0000 7cda ca52            ........|..R&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16547" LastEditorUserId="8499" LastEditDate="2018-03-19T19:35:56.633" LastActivityDate="2018-03-19T19:35:56.633" Title="TCPDUMP Output analysis" Tags="|multicast|packet-analysis|tcpdump|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19919" PostTypeId="2" ParentId="19917" CreationDate="2015-07-12T15:43:36.573" Score="2" Body="&lt;p&gt;Start with the &lt;a href=&quot;http://www.webopedia.com/quick_ref/OSI_Layers.asp&quot; rel=&quot;nofollow&quot;&gt;7 osi layers&lt;/a&gt; this will give you a understanding of how data travels between applications layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a summary, each tcp packet contains a sequence number, at the receiving end they are all put together, and if one is missing it is requested from the source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Q - The actual packet at layer 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All modern networks use full duplex ethernet, a single IP packet is sent in one go at the maximum transmission speed of the physical cable e.g. 1Gbits/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data is interleaved at the packet level, not at the bit level. Thus packet 1, normally &amp;lt;1500bytes * 8bit = 12kbit is sent in one burst. (On Gigabit link this takes 12k/1Gb/s= 12uS, on 256kBit link 47mS)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is also why routers and switches have buffers to hold packets until they can be transmitted out congested ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At slower link speeds you have to contend with serialization delay for voice traffic, even if the VoiP packet is marked as high priority if it arrives at a link that just started sending another packet it has to wait for the packet to leave before being rushed out the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On really slow serial links &amp;lt;1Mbit running ppp, link fragmentation can be employed to ensure the serialization delay does not cause to much jitter for VoiP traffic stuck behind a big packet being transmitted.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2015-07-12T18:56:03.423" LastActivityDate="2015-07-12T18:56:03.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19921" PostTypeId="2" ParentId="19917" CreationDate="2015-07-12T16:57:28.987" Score="0" Body="&lt;p&gt;If I understand correctly, the so called &quot;bits&quot; you are talking about, are nothing more than an electrical signal. Meaning, when the data is sent through the cables, it is merely a signal, then at the receiving end it is read (in a way that i don't quite understand myself).&lt;/p&gt;&#xA;" OwnerUserId="13770" LastActivityDate="2015-07-12T16:57:28.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19922" PostTypeId="2" ParentId="19917" CreationDate="2015-07-12T17:03:59.270" Score="5" Body="&lt;p&gt;First, packets are anything but physical ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you actually mean Ethernet frames (not packets) A simplified explanation: the ethernet hardware receives an entire frame in a queue structure, fetches one byte at a time,  and clocks it out the interface one bit at a time.  Then it fetches the next byte, and so on until the frame is complete.    Because the ethernet hardware operates on one frame at a time, there's no possibility of interleaving two partial frames.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-07-12T17:03:59.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19924" PostTypeId="1" AcceptedAnswerId="19926" CreationDate="2015-07-13T00:30:49.607" Score="1" ViewCount="1133" Body="&lt;p&gt;How many hello packets get exchanged between routers in ospf to go from DOWN state to 2-way state?&#xA;ONLY From Down to 2-way.&#xA;It will be very helpful if you could explain full procedure packet by packet from down state?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take any two routers connected by FastEthernet 0/0 and 10.1.1.0/32 ?&lt;/p&gt;&#xA;" OwnerUserId="15438" LastActivityDate="2015-07-13T01:53:06.017" Title="2-way state in OSPF" Tags="|cisco|routing|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19926" PostTypeId="2" ParentId="19924" CreationDate="2015-07-13T01:53:06.017" Score="6" Body="&lt;p&gt;Three.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router A sends a hello to router B.   Router B lists A as Init&#xA;Router B sends a hello to A, listing A as its neighbor.  Router A lists B as 2-way&#xA;Router A sends a hello to B listing B as its neighbor.  Router B lists A as 2-way&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-07-13T01:53:06.017" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19927" PostTypeId="1" AcceptedAnswerId="19932" CreationDate="2015-07-13T04:05:24.820" Score="3" ViewCount="147" Body="&lt;p&gt;Based on this page: &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB16490&quot; rel=&quot;nofollow&quot;&gt;How to use predefined policy templates in an IDP policy in SRX and J-series devices&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to download these templates to read through them, but from my desktop. I couldn't find anywhere online to grab these.. only through the update commands they give in the doc above.&lt;/p&gt;&#xA;" OwnerUserId="4051" LastActivityDate="2015-07-13T12:17:10.923" Title="Can I download Juniper predefined security templates for view, outside of my router?" Tags="|router|juniper|juniper-junos|juniper-srx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19929" PostTypeId="1" AcceptedAnswerId="19959" CreationDate="2015-07-13T09:33:47.933" Score="1" ViewCount="90" Body="&lt;p&gt;Currently i am using a MiroTik router, that has build in a data trafic graph.&#xA;Its werry well working, but it cant be saved and it shows only last 24h/ last week/ mounth /year.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have some data when and how much is the network in use.I use wireshark to scan the network for trafic/packages. Now i would like somehow to get a graph of average data usage per minute/hour/day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wiki.mikrotik.com/images/thumb/a/a4/Graphing-mem.png/650px-Graphing-mem.png&quot; rel=&quot;nofollow&quot;&gt;MikroTik Graph&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16557" LastEditorUserId="8499" LastEditDate="2018-02-14T16:15:38.050" LastActivityDate="2018-02-14T16:15:38.050" Title="Get Avarage network trafic data in MB" Tags="|wireshark|packet-tracer|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-09T23:51:09.493" ContentLicense="CC BY-SA 3.0" />
  <row Id="19930" PostTypeId="2" ParentId="19918" CreationDate="2015-07-13T09:42:11.250" Score="2" Body="&lt;p&gt;Basic information about how to interpret tcpdump output can be found in the tcpdump man page. Just do &lt;code&gt;man tcpdump&lt;/code&gt; on your machine and read (and make some notes, there's a lot of stuff there). Next, you may find google and query &lt;code&gt;tcpdump tutorial&lt;/code&gt; helpful, as again - a lot of information shown by tcpdump will be protocol-specific. Couple of good, introductory tutorials:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://danielmiessler.com/study/tcpdump/&quot; rel=&quot;nofollow&quot;&gt;https://danielmiessler.com/study/tcpdump/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://dillonhale.com/blog/linux-tutorials/tcpdump-primer/&quot; rel=&quot;nofollow&quot;&gt;http://dillonhale.com/blog/linux-tutorials/tcpdump-primer/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You may also find Wireshark, an GUI tool built on tcpdump fundamentals a good resource to use in daily work and as a base reference for protocol decoding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answering your specific question: why you're trying to monitor multicast on this specific node? If you want to monitor multicast in core of the network, you should SPAN/RSPAN your traffic to this host and then sniff it using favorite tool - be it tcpdump. If that's a switched network you're connected to, you'll see few if any multicast packets - your station doesn't have (by default) means to become active destination of all multicast traffic unless it registers to be it (and that requires additional work, besides running sniffer alone).&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="286" LastEditDate="2016-01-11T07:32:35.677" LastActivityDate="2016-01-11T07:32:35.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19932" PostTypeId="2" ParentId="19927" CreationDate="2015-07-13T12:17:10.923" Score="3" Body="&lt;p&gt;I've uploaded the template output for you here: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/iBx30XP7&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/iBx30XP7&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-13T12:17:10.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19933" PostTypeId="2" ParentId="19438" CreationDate="2015-07-13T12:42:11.360" Score="1" Body="&lt;p&gt;VLAN &quot;Names&quot; are locally significant to devices and different devices will allow different length strings to name them, so no need for them to match (although it helps when troubleshooting if they are at least similar).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as your VLAN 1 is native on the Aruba port and matches the correct subnet on your firewall, this topology should work just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a general rule though, I tend to avoid using VLAN 1 on any device in the network, due to various vendor-specific quirks that it often comes with. &lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-13T12:42:11.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19934" PostTypeId="2" ParentId="6723" CreationDate="2015-07-13T12:51:13.590" Score="1" Body="&lt;p&gt;This is expected behaviour - see reference: &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB12985&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB12985&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google junos auto-export for policy-based solutions&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-13T12:51:13.590" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19936" PostTypeId="1" AcceptedAnswerId="19937" CreationDate="2015-07-13T18:05:57.250" Score="0" ViewCount="348" Body="&lt;p&gt;The whole functionality of computers (and software in general) is based on binary system. Everything is &quot;translated&quot; in low-level as 0 and 1 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When coming inside the field of networks, where data are transmitted through physical means, the range 0-2 volts represents bit 0, while the range of 3-5 volts represents bit 1. So, in theory, the digital signal consists of 2 possible values 0 and 5 volts that correspond to bits 0 and 1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After investigating some network protocols (such as Ethernet) that are using carrier sense, I found out that the channel is &quot;listened&quot; and if no other node is not transmitting, the transmission begins. However, there could be nodes transmitting 0 bits during this specific moment, that could not be detected. For this reason, the carrier sense is being executed for a sequence of 96 bits, and if both bits were 0 then, this is accepted as a fact that no one is transmitting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;THE QUESTION :&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If (for example) the selected signals were 5 volts for 0 bit, and 10 volts for 1 bit, then there could be a significant performance boost in those protocols, that could complete the carrier sense in only 1 bit duration (1/96 of the current needed time). Is that true, and if yes, then why wasn't that considered from the beginning as a solution ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The only reason I know, behind the choice of 0 volts, is that 0 volts correspond to ground, which is a reliable absolute scale.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="16477" LastActivityDate="2015-07-13T18:34:25.867" Title="Why is zero bit transmitted as zero voltage ? Are there performance tradeoffs?" Tags="|ethernet|transport-protocol|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19937" PostTypeId="2" ParentId="19936" CreationDate="2015-07-13T18:26:48.780" Score="2" Body="&lt;p&gt;It seems like your real question is &quot;Why is the interframe gap in Ethernet so long?&quot; The answer to that question has nothing to do with the voltages used to transmit symbols. &lt;a href=&quot;https://superuser.com/questions/650910/regarding-ethernet-why-is-the-interframe-gap-96-bits-long&quot;&gt;This answer&lt;/a&gt; on SuperUser quotes a Google hit which I will re-quote here:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The sole reason for the 9.6 microsecond interframe gap is to allow the station that last transmitted to cycle its circuitry from transmit mode to receive mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here's the original link: &lt;a href=&quot;http://www.wildpackets.com/resources/compendium/ethernet/interframe_gap&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.wildpackets.com/resources/compendium/ethernet/interframe_gap&lt;/a&gt;&#xA;Regarding the persistence of the interframe gap in modern, switched, full-duplex Ethernet connections: &lt;a href=&quot;https://www.safaribooksonline.com/library/view/ethernet-the-definitive/1565926609/ch04.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.safaribooksonline.com/library/view/ethernet-the-definitive/1565926609/ch04.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Providing the interframe gap ensures that the interfaces at each end of the link can keep up with the full frame rate of the link.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4889" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2015-07-13T18:34:25.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19940" PostTypeId="1" AcceptedAnswerId="19941" CreationDate="2015-07-13T20:26:59.137" Score="18" ViewCount="21318" Body="&lt;p&gt;Half-duplex connections were popular at the time of 10Mbps and 100Mbps &lt;em&gt;Ethernet&lt;/em&gt;, and, according to standards, it is allowed also in case of 1Gbps &lt;em&gt;Ethernet&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct that half-duplex mode support in &lt;em&gt;Ethernet&lt;/em&gt; chipsets was crucial in case either a network hub (hub is internally a single wire) or some other shared &lt;em&gt;Ethernet&lt;/em&gt; medium (for example, 10BASE-5) was used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any reasons for half-duplex connections in &lt;em&gt;Ethernet&lt;/em&gt; environments where twisted-pair cabling is used and hubs are not used?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="8499" LastEditDate="2017-09-11T18:10:57.957" LastActivityDate="2017-09-11T18:10:57.957" Title="Reason for half-duplex mode in Ethernet?" Tags="|ethernet|protocol-theory|layer1|" AnswerCount="6" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19941" PostTypeId="2" ParentId="19940" CreationDate="2015-07-13T20:33:56.330" Score="21" Body="&lt;p&gt;The reasons for half-duplex ethernet are as you understand them.  In fact, there was a movement to not include half-duplex for 1000Base-T, but it still made it into the standard.  For 10 Gb ethernet, half-duplex was dropped so there is no such thing as 10 Gbps half-duplex ethernet as a standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you still have a hub (they are still around) or a device that doesn't support full-duplex (they exist, especially for 10Base-T), 10Base-T or 100Base-TX on UTP don't really need half-duplex.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-07-13T20:33:56.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19942" PostTypeId="1" CreationDate="2015-07-13T23:03:45.967" Score="1" ViewCount="595" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ACulP.jpg&quot; alt=&quot;enter image description here&quot;&gt;I've written the below config for the following network topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6509 switch acting as collapsed core for data access switches, voice access switches and wifi access switches. The 6509 then connects to a cisco edge router which then connects to the ISP MPLS network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to first mark voice packets coming from the access switch, then prioritise them as they pass through the 6509 up to the router and then prioritise them once more while they pass through the router and onto the mpls network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will my code work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Marking the voice packets on the core switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all Mark_Voice  &#xA; match access-group 107  &#xA;!  &#xA;policy-map MARK_VOIP  &#xA; class Mark_Voice  &#xA;  set ip dscp ef  &#xA;!  &#xA;int port-channel 2  &#xA;service-policy input MARK_VOIP  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then on the router facing interface of the core switch I want to prioritise VOICE packets:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all SWITCH_to_ROUTER_Voice  &#xA; match  dscp ef  &#xA;!  &#xA;policy-map Voice  &#xA; class SWITCH_to_ROUTER_Voice  &#xA;    priority 6200  &#xA;  set ip dscp ef  &#xA; class class-default  &#xA;    fair-queue  &#xA;     random-detect  &#xA;!  &#xA;int gi 1/1/1:  &#xA;service-policy output Voice  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally when the voice packets get to the WAN interface of the Router, prioritise again:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all MPLS_Voice  &#xA; match  dscp ef  &#xA;!  &#xA;policy-map MPLS_Voice  &#xA; class MPLS_Voice  &#xA;    priority 6200  &#xA;  set ip dscp ef  &#xA; class class-default  &#xA;    fair-queue  &#xA;     random-detect  &#xA;!  &#xA;int gi 0/0/0:  &#xA;service-policy output MPLS_Voice  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3846" LastEditorUserId="3846" LastEditDate="2015-07-14T17:22:22.370" LastActivityDate="2015-07-14T17:22:22.370" Title="Verify my cisco QoS script" Tags="|cisco|qos|" AnswerCount="0" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="19943" PostTypeId="1" AcceptedAnswerId="19965" CreationDate="2015-07-13T23:38:36.537" Score="9" ViewCount="26981" Body="&lt;p&gt;I have a question that I am having a very hard time wrapping my mind around, and I think you might be able to square me away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When applying an access list to a VLAN interface (VLAN 32) in a L3 switch, for clients that are in VLAN 32 subnet, are they seen as coming into VLAN 32 on the way to being routed, or is the traffic coming out (exiting) the VLAN 32 interface?  What about traffic coming from another VLAN? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to sort this out for the purpose of deciding on applying an access list to &quot;in&quot; or &quot;out&quot; traffic against the VLAN 32 interface.&lt;/p&gt;&#xA;" OwnerUserId="7534" LastEditorUserId="7534" LastEditDate="2015-07-13T23:58:41.043" LastActivityDate="2023-10-29T09:05:41.347" Title="Access-Lists and VLAN and understanding traffic flow" Tags="|cisco|vlan|acl|cisco-ios-12|cisco-ios-15|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19944" PostTypeId="2" ParentId="19943" CreationDate="2015-07-13T23:55:52.910" Score="0" Body="&lt;p&gt;Imagine yourself as the router. &quot;In&quot; is traffic you receive; &quot;out&quot; is traffic you transmit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip access-group foo in&lt;/code&gt; applies to traffic &lt;em&gt;received&lt;/em&gt; on an interface. &lt;code&gt;... out&lt;/code&gt; applies to traffic being &lt;em&gt;transmit&lt;/em&gt; on an interface.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-07-14T08:01:30.230" LastActivityDate="2015-07-14T08:01:30.230" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19945" PostTypeId="2" ParentId="19940" CreationDate="2015-07-14T01:21:31.993" Score="4" Body="&lt;p&gt;In the case of partial wiring damage, half duplex can be the difference between a slower connection and NO connection (until the damage is repaired.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That can be a BIG difference.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-07-14T01:21:31.993" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="19946" PostTypeId="2" ParentId="19940" CreationDate="2015-07-14T02:46:36.270" Score="10" Body="&lt;p&gt;Ethernet was derived from &lt;a href=&quot;https://en.wikipedia.org/wiki/ALOHAnet&quot;&gt;https://en.wikipedia.org/wiki/ALOHAnet&lt;/a&gt; which used UHF radio; an inherently half-duplex medium when operating on the same frequency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Early wired networks used a coaxial bus until well into the 1980s.&lt;/p&gt;&#xA;" OwnerUserId="16570" LastActivityDate="2015-07-14T02:46:36.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19947" PostTypeId="1" CreationDate="2015-07-14T04:04:31.963" Score="3" ViewCount="63635" Body="&lt;p&gt;I recently sniffed with Tcpdump a packet &quot;&lt;code&gt;ARP, Request who-has 192.168.2.3 tell 192.168.2.2, length 28&lt;/code&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I would like to reproduce this message&lt;/strong&gt;, and to send an ARP request from my laptop to any IP I would decide. &lt;strong&gt;How can I do this ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would be interested as well in forcing refreshing the whole ARP table. I know that deleting the table will renew it but only laptop this operation is really slow and it can take up to 1/2/5 minutes to rebuild the complete ARP table. &lt;strong&gt;Is there a way to force rebuilding the table, by sending a broadcasted ARP request ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using a Mac with the latest OS Yosemite 10.10.4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="16335" LastActivityDate="2019-07-09T13:18:39.430" Title="How to send an ARP request manually?" Tags="|mac-address|ip|arp|tcpdump|" AnswerCount="2" CommentCount="1" ClosedDate="2015-07-14T13:14:39.597" ContentLicense="CC BY-SA 3.0" />
  <row Id="19949" PostTypeId="1" AcceptedAnswerId="19958" CreationDate="2015-07-14T06:37:51.763" Score="0" ViewCount="101" Body="&lt;p&gt;Network noob here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to get my DHCP server to issue leases across 2 switches using VLAN 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With GNS3, I have 1 VirtualBox guest running isc-dhcp and 2 Cisco switches running IOS 12.4 in a configuration like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[dhcp_server]-(eth1) &amp;lt;--&amp;gt; (fa1/0)[switch_1](fa1/1) &amp;lt;--&amp;gt; (fa1/0)[switch_2]  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VLAN 1 is the only VLAN I've configured on both switches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch_1# conf t&#xA;switch_1# int vlan 1&#xA;switch_1# ip address dhcp&#xA;switch_1# no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the same on switch_2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch_2# conf t&#xA;switch_2# int vlan 1&#xA;switch_2# ip address dhcp&#xA;switch_2# no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This successfully configures switch_1 with an ip address from the DHCP server, but switch_2 is unable to get an ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried connecting another guest VM to switch_1, and it's also unable to get an ip address from the DHCP server.&lt;/p&gt;&#xA;" OwnerUserId="16575" LastActivityDate="2015-07-14T11:43:42.133" Title="Networking 2 Cisco switches on default VLAN 1" Tags="|switch|dhcp|gns3|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19950" PostTypeId="2" ParentId="19940" CreationDate="2015-07-14T06:56:53.743" Score="3" Body="&lt;p&gt;The reason for half duplex, was due to cost, initial 10Meg ethernet shared the same coax cable only two conductors &lt;a href=&quot;https://en.wikipedia.org/wiki/10BASE2&quot; rel=&quot;nofollow&quot;&gt;10Base2&lt;/a&gt;. At the time it was not imagined that any thing as fast as 10Mbit/s could be transmitted on a unshielded cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One port on a switch/hub could have 20 pc's connected in daisy chain, thus CDMA was used to listen for traffic, start sending, back-off for random time if someone started transmitting at the same instance and send again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is also the reason for the length restriction and minimum packet size, as you had to be sure before the last bit was sent that someone on the other end of the same cable did not also start to transmit at the same instant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As electronics became faster and cheaper, we moved to Cat5, individual cables/ports for each pc, and then to switches, where the packet can be stored and forwarded in both directions at the same time (Full Duplex)&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-14T06:56:53.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19951" PostTypeId="2" ParentId="19947" CreationDate="2015-07-14T07:15:47.337" Score="0" Body="&lt;p&gt;If your need is to reproduce the same (getting same packet again), capture the packet into a file using &lt;a href=&quot;http://www.tcpdump.org/&quot; rel=&quot;nofollow&quot;&gt;tcpdump&lt;/a&gt; (at the receiving end) and replay the captured packets using &lt;a href=&quot;http://tcpreplay.synfin.net/&quot; rel=&quot;nofollow&quot;&gt;tcpreplay&lt;/a&gt; tool (at the sending end).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While capturing packet(s) using tcpdump, use the &quot;-w &quot; option to save packet(s) into a file. The captured packet(s) in the file can be replayed using tcpreply.&lt;/p&gt;&#xA;" OwnerUserId="16370" LastEditorUserId="16370" LastEditDate="2015-07-14T09:10:02.913" LastActivityDate="2015-07-14T09:10:02.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19952" PostTypeId="2" ParentId="19943" CreationDate="2015-07-14T07:16:52.573" Score="4" Body="&lt;p&gt;Think of all the ports in the vlan as being one port, traffic between them never hit the vlan-L3 interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only traffic flowing between vlan's hit the vlan-32 ACL.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus traffic from vlan-X to vlan-32-host will be seen as outbound by the vlan-32 ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And traffic from a host in vlan32, that hits the GW on it's way somewhere else will be inbound.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-14T07:16:52.573" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="19953" PostTypeId="1" CreationDate="2015-07-14T07:43:38.693" Score="4" ViewCount="547" Body="&lt;p&gt;I have a VPN connecting two virtual interfaces of two hosts. Both VPN interfaces have MAC addresses 00:00:00:00:00:00, as the OS (Linux) assigns link-local IPv6 address based on MAC address. So the link-local IPv6 addresses are identical for both peers. This breaks OSPFv3 (at least).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the right way to obtain IPv6 addresses, which would be unique on the link, for such interfaces? I expect that I'd not need to configure a new IPv6 network and manually assign addresses from it to VPN endpoints.&lt;/p&gt;&#xA;" OwnerUserId="15275" LastEditorUserId="15275" LastEditDate="2015-07-16T06:27:51.547" LastActivityDate="2015-07-16T06:27:51.547" Title="IPv6 link-local addresses for virtual interfaces are identical - how to assign &quot;link-unique&quot;?" Tags="|ipv6|ip-link-local|" AnswerCount="0" CommentCount="9" ClosedDate="2015-07-15T10:32:51.453" ContentLicense="CC BY-SA 3.0" />
  <row Id="19955" PostTypeId="1" AcceptedAnswerId="19961" CreationDate="2015-07-14T08:17:52.077" Score="3" ViewCount="955" Body="&lt;p&gt;I have to confess that I am by no means a network engineer I am a software engineer with a reasonable grasp of networking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my dilemma...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 20 iPads that I want to put onto a wireless network that has no internet connection. These iPads are connected to a Macbook Pro using Bonjour and they have data pushed/broadcast to them from said Macbook.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I create a network with a home based wireless router/switch the devices all communicate flawlessly and the data is pushed to the iPads with ease and with an almost instant response time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But... If I create a wireless mesh with 3 UniFi Access points which are connected to a Pro Curve switch. I can get all the iPads to connect to the network with static IPs but when I broadcast data to them the response is very slow. Some of the iPads randomly drop connection and ping times between devices can range from 100ms to 600ms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume I possibly need something on the network to possibly help route the traffic but this is where my knowledge runs short.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone point me in the right direction? What am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ben&lt;/p&gt;&#xA;" OwnerUserId="16577" LastActivityDate="2015-07-14T16:18:53.673" Title="Creating an offline wireless network using UniFi UAP access points for use by iPads" Tags="|routing|wireless|ethernet|hp-procurve|access-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19956" PostTypeId="2" ParentId="19947" CreationDate="2015-07-14T08:17:59.223" Score="3" Body="&lt;h2&gt;First of all lets have a look at why we actually need ARP.&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Computers on the same subnet communicate directly with each other using a layer 2 MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you try to contact a computers IP-address your computer calculates if the computer is on the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the computer is on the same network your computer checks if its arp table already contains the MAC address of the target host. If the table does not contain the MAC address your computer needs to obtain it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is done via ARP-requests (who has 192.168.2.2, send MAC address to 192.168.2.2 from your example output).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;So how can you issue ARP-requests on your own?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;By using what we know from above we can make your computer do so:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;delete your ARP table (sudo arp -ad on Mac OS X)&lt;/li&gt;&#xA;&lt;li&gt;contact other computers on your local network (eg ping 192.168.2.2).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The underlying network stack will check if it knows the MAC address (which it does not) and issue an ARP-request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no need to have a complete arp table already before you actually need it when communicating with other hosts, but if you explicitly want to have it you could ping all hosts in your network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for i in {1..254}; do ping -c 1 192.168.2.$i &amp;gt; /dev/null &amp;amp;; done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This command&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;pings every host in your network (192.168.2.{1..254})&lt;/li&gt;&#xA;&lt;li&gt;once (-c 1)&lt;/li&gt;&#xA;&lt;li&gt;and outputs the results to /dev/null&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You should have all active hosts on your network in your arp table afterwards.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Using tools&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You could also use &lt;a href=&quot;https://github.com/ThomasHabets/arping&quot; rel=&quot;nofollow noreferrer&quot;&gt;arping&lt;/a&gt; to issue ARP-requests for IP-addresses from your command line.&lt;/p&gt;&#xA;" OwnerUserId="16574" LastEditorUserId="40328" LastEditDate="2019-07-09T13:18:39.430" LastActivityDate="2019-07-09T13:18:39.430" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="19957" PostTypeId="1" CreationDate="2015-07-14T11:36:55.467" Score="1" ViewCount="129" Body="&lt;p&gt;I have been researching about prevention of &lt;strong&gt;ARP&lt;/strong&gt; spoofing in an individual's device (smart phone or laptop) in a public network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we save the MAC address of the default gateway at the time of connection establishment by checking the ARP table for the entry corresponding to the IP of the default gateway, and then monitor any changes in that address in the ARP table periodically will we be able to secure our device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any corner cases or special cases that this method is missing out on. Also will simply securing the connection to the gateway like this be enough for a general public wireless LAN network.&lt;/p&gt;&#xA;" OwnerUserId="16583" LastActivityDate="2015-07-15T07:39:05.813" Title="Opinion on techinique to solve arp poisoning" Tags="|security|arp|ieee-802.11|" AnswerCount="1" CommentCount="1" ClosedDate="2019-12-18T18:52:02.733" ContentLicense="CC BY-SA 3.0" />
  <row Id="19958" PostTypeId="2" ParentId="19949" CreationDate="2015-07-14T11:43:42.133" Score="2" Body="&lt;p&gt;This problem was apparent with GNS3 v0.8.4 from the Ubuntu apt repositories.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution was upgrading to v1.3.7 on Windows x64 with VirtualBox v5.0.0. Now everything works as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using the same EtherSwitch IOS image (NM-16ESW).&lt;/p&gt;&#xA;" OwnerUserId="16575" LastActivityDate="2015-07-14T11:43:42.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19959" PostTypeId="2" ParentId="19929" CreationDate="2015-07-14T14:46:21.287" Score="0" Body="&lt;p&gt;There are numerous solutions out there for monitoring.&lt;br&gt;&#xA;You can use &lt;a href=&quot;http://www.cacti.net/&quot; rel=&quot;nofollow&quot;&gt;Cacti&lt;/a&gt;, &lt;a href=&quot;http://oss.oetiker.ch/mrtg/&quot; rel=&quot;nofollow&quot;&gt;MRTG&lt;/a&gt;, &lt;a href=&quot;https://www.paessler.com/prtg&quot; rel=&quot;nofollow&quot;&gt;PRTG&lt;/a&gt;, or &lt;a href=&quot;https://en.wikipedia.org/wiki/Comparison_of_network_monitoring_systems&quot; rel=&quot;nofollow&quot;&gt;any other solution&lt;/a&gt; out there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most common method of statistics collection is via SNMP but also NetFlow is supported on MikroTik RouterOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's up to you really to choose whatever solution fits your need better.&lt;/p&gt;&#xA;" OwnerUserId="1418" LastActivityDate="2015-07-14T14:46:21.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19961" PostTypeId="2" ParentId="19955" CreationDate="2015-07-14T16:18:53.673" Score="2" Body="&lt;p&gt;Unifi are wireless Access Points (only) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mesh is an inaccurate term for how they work, by the way(unless you put non-factory firmware on them). They CAN be configured in a &quot;single-leaf&quot; wireless uplink mode, but should not be (it cuts throughput by at least half .vs. wiring them all.) You seem to be saying they are all wired into a switch, so there is no &quot;mesh&quot; going on, simply provision of the SSID over multiple devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common problem (not clear from the level of detail in your question) is people deploying them with WAY too much power and overloading the input stages of the client devices (especially if they get the UAP-LR because it's advertised to have &quot;more range&quot;) - in MANY cases, performance is improved by turning power &lt;strong&gt;down.&lt;/strong&gt; The link does not work unless the radio can also hear the client device, and UAP-LRs have a VERY small field of appropriate application.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;That's one fork of possible issues/resolutions. The other is:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;A &quot;home type router/switch&quot; is a wireless access point, a switch, and a router, typically including a DHCP server, DNS Server, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if it works better with a &quot;home-type router/switch&quot; you might need a device to play the role of &quot;router&quot; though in fact your issue may be more DHCP/DNS than &quot;actual routing.&quot; I'd suggest pfSense for the role, but there are many possible options.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-07-14T16:18:53.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19962" PostTypeId="1" AcceptedAnswerId="19964" CreationDate="2015-07-14T17:14:44.117" Score="1" ViewCount="3373" Body="&lt;p&gt;We are planning to buy a new switch, we have few access points with the POE+ logo on their Ethernet ports, when surveying the market for the switches we also found multiple switch models some have POE ports and others have POE+ ports. This left us wondering, if we bought switch that only has POE ports, would it be able to power up our POE+ access points?&lt;/p&gt;&#xA;" OwnerUserId="14326" LastActivityDate="2015-07-16T11:01:56.213" Title="Does POE+ devices run on POE switches?" Tags="|switch|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19963" PostTypeId="2" ParentId="19962" CreationDate="2015-07-14T17:17:10.500" Score="2" Body="&lt;p&gt;The similar question was asked and answered in detail here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1470/poe-poe-upoe&quot;&gt;POE, POE+, UPOE&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to check what's the actual requirement of device, aside the name &quot;PoE+&quot;. The specific information about power requirement and capability to gracefully degrade service (offer less throughput in case of APs, or less power to antennas) should be clearly documented in the device technical documentation.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-07-14T17:17:10.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="19964" PostTypeId="2" ParentId="19962" CreationDate="2015-07-14T17:56:30.207" Score="2" Body="&lt;p&gt;No a POE switch does not deliver enough power to run a POE+ device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having plugged a Cisco 1500 AP into a normal poe switch and then struggling for a day to get a ptp link-up I can say first-hand that it is a bad idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device booted up and I could log in but the Radio was stuck in reset, thinking it was a config or antenna problem, I wasted a lot of time, before finding the small message in the log, that there was not enough power to powerup the wifi module.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-14T17:56:30.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19965" PostTypeId="2" ParentId="19943" CreationDate="2015-07-14T18:26:51.567" Score="7" Body="&lt;p&gt;This is often a confusing topic for users new to SVIs as it does seem to work a bit counter intuitively. Most people have a tendency to look at the SVI as some sort of &quot;gateway&quot; and that traffic leaving the VLAN should be outbound and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it actually works in the opposite way because the SVI is a virtual router interface. It can help to think of the SVI as a physical interface on a physical router connected to the VLAN. From the perspective of this router, traffic arriving on the interface (the SVI) from the VLAN is inbound.  Traffic from the rest of the network to the VLAN would be going out (or outbound) from the perspective of this interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, take for instance the following SVI:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan10&#xA; ip address 10.1.1.1 255.255.255.0&#xA; ip access-group VLAN10_IN in&#xA; ip access-group VLAN10_OUT out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, let's say I want to prevent any traffic with spoofed IP addresses from leaving this VLAN. My access list may look like the below. Notice that while this traffic is outbound from the VLAN, it is inbound to the interface and as such is an inbound ACL.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sw6500#sh ip access-lists VLAN10_IN&#xA;Extended IP access list VLAN10_IN&#xA;    10 permit ip 10.1.1.0 0.0.0.255 any&#xA;    20 deny ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I want to limit access to this VLAN so that devices with 192.168.1.0/24 addresses are blocked but all other 192.168.0.0/16 addresses are allowed, the ACL would look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sw6500#sh ip access-lists VLAN10_OUT&#xA;Extended IP access list VLAN10_OUT&#xA;    10 deny ip 192.168.1.0 0.0.0.255 any&#xA;    20 permit ip 192.168.0.0 0.0.255.255 any&#xA;    30 deny ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Please Note&lt;/strong&gt;: These are not a complete working access lists; they are meant only as examples. While they may work in certain environments, it may create problems if you try to use it.  For instance, it will not allow traffic such as DHCP if the DHCP server is on a different VLAN.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;One parting note, that may seem obvious but I have seen trip people up before. If the SVI has multiple subnets associated with it, you need to make sure your ACLs take this into account as traffic that passes between these subnets will be processed by the ACL even though it stays within the VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as you keep the concept that the SVI is an interface, this should be easy to accomplish.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-07-14T18:26:51.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19966" PostTypeId="2" ParentId="19940" CreationDate="2015-07-14T18:58:52.013" Score="4" Body="&lt;p&gt;Rich Seifert gives the answer (for Gigabit Ethernet) in his book &quot;Gigabit Ethernet&quot; and in an &lt;a href=&quot;https://groups.google.com/forum/#!msg/comp.dcom.lans.ethernet/TY4728G5398/qtLEuJlYAagJ&quot; rel=&quot;nofollow&quot;&gt;usenet post&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quote: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The answer is more political than technical. Gigabit Ethernet was&#xA;  developed under the auspices of the IEEE 802.3 Working Group. By&#xA;  definition, 802.3 networks must include the capability of CSMA/CD&#xA;  operation. [Note: This was true at the time of the writing of the&#xA;  Gigabit Ethernet stamdard; it is no longer the case.] If Gigabit&#xA;  Ethernet offered a full-duplex-only solution, it would have been&#xA;  difficult to justify its development within the IEEE 802.3 Working&#xA;  Group. [...]&lt;/p&gt;&#xA;  &#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;The resulting standard would have had difficulty calling itself&#xA;  “Ethernet,” since it would not use CSMA/CD (even as an option) and it&#xA;  would not have been developed as part of IEEE 802.3, the recognized&#xA;  “owner” of the Ethernet name.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="16594" LastEditDate="2015-07-14T21:39:30.960" LastActivityDate="2015-07-14T21:39:30.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19971" PostTypeId="2" ParentId="19957" CreationDate="2015-07-14T23:05:23.337" Score="-1" Body="&lt;p&gt;EDIT: Clarified options to follow the flow of the question.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It is not possible to protect against arp spoofing on a public network if the identity of the AP can't be established and the traffic is open and not encrypted.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What if the first arp request is spoofed, how would you prevent this ?&lt;/li&gt;&#xA;&lt;li&gt;What if the AP is a fake ? &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Connecting and then runnig all traffic through a VPN tunnel would be the safest way to consume the public wifi, but introduces complexity and delay depending on breakout.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The most pragmatic approach would be to only use &lt;strong&gt;SSL/TLS&lt;/strong&gt;, the internet scale companies is working hard to make this more secure to protect there clients for snooping etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The point is that it is impossible to protect against a fake arp/gateway at a public Wifi hotspot, you need to protect the traffic, and ensure you don't have a active MITM, event if the correct GW is used there can be a attack on the traffic stream behind the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some Quotes related to SSL/TLS and newer HSTS protection.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security&quot; rel=&quot;nofollow&quot;&gt;HSTS&lt;/a&gt; is a security policy mechanism where a Web server tells a&#xA;  supporting browser that it can only connect to it over secure&#xA;  connections (i.e., SSL). HSTS allows website operators to force secure&#xA;  connections with users that are using an HSTS-supporting browser.&#xA;  Supporting browsers include:  Google Chrome 4+, Firefox 4+ and Opera&#xA;  12.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;simplifies protection against cookie hijacking. e.g. Fire Sheep&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;the most important security vulnerability that HSTS can fix is&#xA;  SSL-stripping man-in-the-middle attacks&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;HSTS is supported/implemented for a lot of the major internet sites, including Google, Gmail, Facebook, Twitter, Paypal. &lt;a href=&quot;http://trends.builtwith.com/docinfo/HSTS&quot; rel=&quot;nofollow&quot;&gt;HSTS Statistics&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2015-07-15T07:39:05.813" LastActivityDate="2015-07-15T07:39:05.813" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19972" PostTypeId="1" AcceptedAnswerId="19973" CreationDate="2015-07-15T01:36:57.120" Score="1" ViewCount="1948" Body="&lt;p&gt;I'm working with a new client who has an existing Cisco ASA 5512-X firewall in their environment (model: ASA5512-K7). They're interested in establishing a routine site-to-site VPN to my co-location facility. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went in to configure this and realized that the system appears to be missing &lt;strong&gt;all&lt;/strong&gt; VPN functionality. The crypto command set is abbreviated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# crypto ?&#xA;&#xA;configure mode commands/options:&#xA;  ca   Certification authority&#xA;  key  Long term key operations�&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &quot;Remote Access&quot; and &quot;Site-to-Site&quot; menus are missing in the ASDM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the output of &lt;code&gt;sh version&lt;/code&gt; makes no mention of VPN peers.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco Adaptive Security Appliance Software Version 9.0(3) &#xA;Device Manager Version 7.1(3)&#xA;&#xA;Compiled on Fri 19-Jul-13 17:16 PDT by builders&#xA;System image file is &quot;disk0:/asa903-smp-k8.bin&quot;&#xA;Config file at boot was &quot;startup-config&quot;&#xA;&#xA;Ambro-ASA-01 up 21 days 2 hours&#xA;&#xA;Hardware:   ASA5512-K7, 4096 MB RAM, CPU Clarkdale 2793 MHz, 1 CPU (2 cores)&#xA;            ASA: 2048 MB RAM, 1 CPU (1 core)&#xA;Internal ATA Compact Flash, 4096MB&#xA;BIOS Flash MX25L6445E @ 0xffbb0000, 8192KB&#xA;&#xA;Encryption hardware device : Cisco ASA-55xx on-board accelerator (revision 0x1)&#xA;                             Boot microcode        : CNPx-MC-BOOT-2.00&#xA;                             Management microcode  : CNPx-MC-SSL-PLUS-T020&#xA;                             Number of accelerators: 1&#xA;Baseboard Management Controller (revision 0x1) Firmware Version: 2.4&#xA;&#xA;Licensed features for this platform:&#xA;Maximum Physical Interfaces       : Unlimited      perpetual&#xA;Maximum VLANs                     : 50             perpetual&#xA;Inside Hosts                      : Unlimited      perpetual&#xA;Failover                          : Disabled       perpetual&#xA;DES                               : Enabled        perpetual&#xA;3DES-AES                          : Enabled        perpetual&#xA;Security Contexts                 : 0              perpetual&#xA;GTP/GPRS                          : Disabled       perpetual&#xA;Botnet Traffic Filter             : Disabled       perpetual&#xA;IPS Module                        : Disabled       perpetual&#xA;Cluster                           : Disabled       perpetual&#xA;&#xA;This platform has a Base license.&#xA;&#xA;Serial Number: FCH1727J1WN&#xA;Running Permanent Activation Key: 0xe81ac966 0x18d906cc 0x8d629524 0xf75824f8 0x8815f292 &#xA;Configuration register is 0x1&#xA;Configuration last modified by enable_15 at 10:12:14.570 EDT Tue Jul 14 2015&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's going on with this unit? The 5512-K7 should have 250 VPN peers. Is there something wrong with how this ASA was deployed?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So I called Cisco to inquire if there's a method to enable VPN on a No Payload Encryption (NPE) platform. They couldn't/wouldn't answer.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unfortunately, TAC is unable to assist in any way without the device&#xA;  being under contract. I recommend contacting a Cisco partner and&#xA;  seeing if they’re able to answer the question. Would you like this&#xA;  case to be closed?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, since VPN is a customer requirement here, we are going to trash this ASA 5512-X, since it doesn't appear to have a path to the necessary functionality.&lt;/p&gt;&#xA;" OwnerUserId="548" LastEditorUserId="548" LastEditDate="2015-09-25T16:04:05.223" LastActivityDate="2015-09-25T16:04:05.223" Title="Cisco ASA 5512-X has no VPN capabilities" Tags="|cisco-asa|firewall|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19973" PostTypeId="2" ParentId="19972" CreationDate="2015-07-15T02:17:18.293" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Cisco ASA 5512-X Firewall Edition; includes firewall services, 250 IPsec VPN peers, 2 SSL VPN peers, 6 copper GE data ports, 1 copper GE management port, 1 AC power supply, &lt;strong&gt;no payload encryption&lt;/strong&gt; (ASA5512-K7)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-x-series-next-generation-firewalls/data-sheet-c78-729807.html&quot;&gt;Cisco ASA 5500-X Series Next Generation Firewalls Data Sheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;No Payload Encryption Models&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can purchase some models with No Payload Encryption. For export to some countries, payload encryption cannot be enabled on the Cisco ASA 5500 series. The ASA software senses a No Payload Encryption model, and disables the following features:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Unified Communications&lt;/li&gt;&#xA;  &lt;li&gt;VPN&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;You can still install the Strong Encryption (3DES/AES) license for use with management connections. For example, you can use ASDM HTTPS/SSL, SSHv2, Telnet and SNMPv3. You can also download the dynamic database for the Botnet Traffic Filer (which uses SSL).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When you view the license (see the &quot;Monitoring Licenses&quot; section), VPN and Unified Communications licenses will not be listed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/intro_license.html#wp1430306&quot;&gt;Managing Feature Licenses&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there something wrong with how this ASA was deployed?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would say the problem is in how it was &lt;em&gt;ordered&lt;/em&gt;. The &quot;-K7&quot; has no crypto capability. You'll have to contact Cisco to correct that. (i.e. buy a crypto license.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-07-15T02:25:16.157" LastActivityDate="2015-07-15T02:25:16.157" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="19976" PostTypeId="1" AcceptedAnswerId="19979" CreationDate="2015-07-15T04:57:46.263" Score="11" ViewCount="27551" Body="&lt;p&gt;Corresponding this topic:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/3613989/what-of-traffic-is-network-overhead-on-top-of-http-s-requests&quot;&gt;https://stackoverflow.com/questions/3613989/what-of-traffic-is-network-overhead-on-top-of-http-s-requests&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The maximum segment size (which does not include the TCP or IP&#xA;  headers) is typically negotiated between the layers to the size of the&#xA;  MTU minus the headers size. For Ethernet MTU is usually configured at&#xA;  1500 bytes. The TCP header is 160 bits, or 20 bytes. The fixed part of&#xA;  the IPv4 header is 160 bits, or 20 bytes as well. ... . Thus:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;for HTTP over TCP/IPv4&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;overhead = TCP + IP = 40 bytes&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;payload = 1500 - 40 = 1460 bytes&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;overhead % = 2% (40 * 100 / 1460)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here's 100 Mbit and 1Gbit iperf results in TCP mode with default Debian distros:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[  5] local 10.0.51.1 port 5001 connected with 10.0.51.20 port 45009&#xA;[  5]  0.0-10.0 sec   112 MBytes  94.1 Mbits/sec&#xA;[  4] local 10.0.51.1 port 5001 connected with 10.0.51.94 port 35065&#xA;[  4]  0.0-10.0 sec  1.10 GBytes   941 Mbits/sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can lower it to almost 2% overhead by raising MTU to 9000 :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[ ID] Interval       Transfer     Bandwidth&#xA;[  4]  0.0-10.0 sec  1.14 GBytes   982 Mbits/sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But shouldn't it be even less?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;overhead = TCP + IP = 40 bytes&#xA;payload = 9000 - 40 = 8960 bytes&#xA;overhead % = 0.4% (40 * 100 / 8960)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why actual &quot;bandwidth loss&quot; is notably greater than the theoretical?&#xA;If formula missing something valuable?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="16605" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2019-03-11T20:18:01.583" Title="Trying to find out exact TCP overhead cost" Tags="|tcp|bandwidth|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19977" PostTypeId="1" AcceptedAnswerId="19980" CreationDate="2015-07-15T06:40:47.910" Score="0" ViewCount="1592" Body="&lt;p&gt;So, if one PC will use another PC's IP address for ARP resolution, how does the PC sending the ARP Request even know which IP address to call for in the first place? What happens in a scenario where the PCs are directly connected (i.e. there is no intermediary network device like a switch)?&lt;/p&gt;&#xA;" OwnerUserId="16607" LastActivityDate="2015-07-15T20:12:03.703" Title="How do 2 PCs learn each other's IP addresses for ARP resolution?" Tags="|mac-address|ip|arp|" AnswerCount="3" CommentCount="7" ClosedDate="2015-07-17T18:20:45.680" ContentLicense="CC BY-SA 3.0" />
  <row Id="19978" PostTypeId="2" ParentId="19977" CreationDate="2015-07-15T07:47:30.820" Score="0" Body="&lt;p&gt;The ip is configured into the application that does the connection as either a dns name(resolved to ip via dns server) or as a IP static IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also auto-discovery protocols that utilise broadcasts and multi casts to advertise and find services. e.g. &lt;a href=&quot;http://www.avahi.org/&quot; rel=&quot;nofollow&quot;&gt;avahi&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If pc's are auto configured using DHCP, the dhcp lease includes information such as DNS server ip, GW-ip, and can even include additional auto configuration information.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-15T07:47:30.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19979" PostTypeId="2" ParentId="19976" CreationDate="2015-07-15T10:20:36.003" Score="17" Body="&lt;p&gt;&lt;strong&gt;Ethernet packets 1.5k&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1500 - 20 B (IPv4) - 20 B (TCP+checksum) = 1460 B DATA (and 40 B Overhead)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add 40 B + 14 B (Ethernet) + 4 B (FCS) + 12 B (Interframe gap) + 8 B (preamble) = 78 B Overhead&lt;/p&gt;&#xA;&#xA;&lt;p&gt;78 / 1460 * 100 = &lt;strong&gt;5.34% overhead&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1460 / ( 1460 + 78) * 100 = &lt;strong&gt;94.93%&lt;/strong&gt; Throughput/Goodput&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1,000,000,000(1Gbit) * 94.93% = &lt;strong&gt;949Mbit/s&lt;/strong&gt;(0.949Gbit/s)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you measured 941Mbit/s that gives (949 - 941) / 949 * 100 = &lt;strong&gt;0.84 % error&lt;/strong&gt; between theoretical and actual.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Jumbo packets 9k - Theoretical max&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(9000-40) / ( 9000 - 40 + 78 ) *100 = 99.14%  (Overhead 0.86%)  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;1,000,000,000(1Gbit) * 99.14% = &lt;strong&gt;991Mbit/s&lt;/strong&gt;(0.99Gbit/s)&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2019-03-11T20:18:01.583" LastActivityDate="2019-03-11T20:18:01.583" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="19980" PostTypeId="2" ParentId="19977" CreationDate="2015-07-15T10:42:46.460" Score="1" Body="&lt;p&gt;You're correct in thinking that the two machines will have no way of knowing each other's IP addresses initially, and there are a few different ways in which this problem can be solved.&lt;/p&gt;&#xA;&lt;p&gt;In a directly connected scenario in a home network with windows PCs, chances are that NetBIOS will be used for name resolution. You can find out more about this protocol in the appropriate RFC, here: &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1001&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc1001&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can think of this as working in a similar way to ARP, insofar as the computer who wants to find out the IP address associated with a certain name will send out a broadcast message to every device on its subnet to find out if any of them have the name in question.&lt;/p&gt;&#xA;&lt;p&gt;Once the target device has replied, the original machine then knows which IP to use for this name, and also vice versa, since the NetBIOS broadcast contains the same information about the sender.&lt;/p&gt;&#xA;&lt;p&gt;There's good answer with details about NetBIOS here as well: &lt;a href=&quot;https://serverfault.com/questions/352305/why-can-windows-machines-resolve-local-names-when-linux-cant&quot;&gt;https://serverfault.com/questions/352305/why-can-windows-machines-resolve-local-names-when-linux-cant&lt;/a&gt; . I don't know much about apple devices, but I believe that they use a similar protocol called &amp;quot;bonjour&amp;quot;, although someone may correct me on this, and on linux, you're likely to come across Avahi (&lt;a href=&quot;http://www.avahi.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.avahi.org/&lt;/a&gt;) as the solution to this problem.&lt;/p&gt;&#xA;&lt;p&gt;In a non-windows situation, or in a large business network where NetBIOS is likely to be disabled because of security concerns, name resolution is likely to be controlled via DNS. Servers may have their DNS server addresses hard coded, and workstations are likely to receive their DNS server information via DHCP. Quite often the DNS and DHCP servers will be running on the same host.&lt;/p&gt;&#xA;&lt;p&gt;DNS is pretty complicated. If you want to REALLY understand how it works, the rfc is here: &lt;a href=&quot;https://www.ietf.org/rfc/rfc1035.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.ietf.org/rfc/rfc1035.txt&lt;/a&gt; , however the wikipedia article is probably good enough for a basic understanding.&lt;/p&gt;&#xA;&lt;p&gt;The basic idea though, is that if a computer doesn't know what IP address is associated with a given name, it can ask it's DNS server. Assuming that your network is set up correctly, when a DHCP lease if given out, or a static IP address is assigned to a machine, a DNS record should also be created on the DNS server.&lt;/p&gt;&#xA;&lt;p&gt;Finally, most operating systems have a &amp;quot;hosts&amp;quot; file, which contains a list of names and associated IP addresses. If there is an entry in this file for a given name, then the OS will just use that IP address and be done with it. On a windows machine, this is located at C:\windows\system32\drivers\etc\hosts. By default it's pretty empty, you just have one entry mapping &amp;quot;localhost&amp;quot; to 127.0.0.1.&lt;/p&gt;&#xA;" OwnerUserId="8305" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-07-15T10:47:51.290" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19982" PostTypeId="1" AcceptedAnswerId="20136" CreationDate="2015-07-15T14:23:51.187" Score="2" ViewCount="2854" Body="&lt;p&gt;I have been trying to diagnoise this problem for a while (slow 10Gb connection). I thought it might be firmware or settings related(MTU). How ever while looking through some SNMP stuff I discovered that the switch (Quanta LB4M) is reporting the speed as much lower then 10Gb. Why is it doing this? The switch is attached to a Dell PE2950 using a DAC. The Dell is reporting a 10Gb link, as is the switch in the port config section. Only in the SNMP am I seeing the 4.3 Gbps, and in real world testing that is where were hitting a wall, about at 550MB's. This was with raw packet generators and testing file transfer speeds with RAM disk on each system.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZIMHP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZIMHP.png&quot; alt=&quot;router config&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ni9ae.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ni9ae.png&quot; alt=&quot;SNMP report&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Levi&lt;/p&gt;&#xA;" OwnerUserId="16612" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2019-02-18T13:02:19.557" Title="Why is 10Gb SFP+ port showing 4.3Gbps Speed?" Tags="|switch|bandwidth|sfp|10gbase|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="19983" PostTypeId="2" ParentId="19982" CreationDate="2015-07-15T14:28:14.720" Score="0" Body="&lt;p&gt;In my experience issues such as this usually come down to hardware. More specifically, hard drives. You can only read/write as fast as the hard drive can perform those operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switch and the NIC are in fact capable of pushing the full 10Gb but you're capping at 4.3Gb, it may very well be server side.&lt;/p&gt;&#xA;" OwnerUserId="2073" LastActivityDate="2015-07-15T14:28:14.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19984" PostTypeId="1" AcceptedAnswerId="19992" CreationDate="2015-07-15T15:10:17.707" Score="4" ViewCount="4250" Body="&lt;p&gt;I got a Juniper EX2200 switch which is unable to boot, prior to a corrupted flash. The JTAC support is expired and i tried almost everything to get it working again.&#xA;I read an article about &quot;Running JunOS directly from an USB stick&quot;, but there was no explanation/instructions on how to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to do this and how?&lt;/p&gt;&#xA;" OwnerUserId="13421" LastActivityDate="2015-07-15T19:44:27.230" Title="Running Junos directly from a USB stick" Tags="|switch|juniper|juniper-junos|juniper-ex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19985" PostTypeId="1" CreationDate="2015-07-15T15:17:32.913" Score="1" ViewCount="24471" Body="&lt;p&gt;how can i configure access list to permit specific ip range 192.168.1.101 to 200? because i don't want to configure 100 times for every ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your reply!&lt;/p&gt;&#xA;" OwnerUserId="13597" LastActivityDate="2015-07-15T16:34:36.733" Title="how to configure access list to match specific ip range?" Tags="|cisco|switch|router|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19986" PostTypeId="2" ParentId="19985" CreationDate="2015-07-15T15:59:57.367" Score="2" Body="&lt;p&gt;If you are limited to just IP/Mask combinations, this is the least amount of entries to get exactly the IP addresses 192.168.1.101 through 192.168.1.200 (inclusive):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.101/32&#xA;192.168.1.102/31&#xA;192.168.1.104/29&#xA;192.168.1.112/28&#xA;192.168.1.128/26&#xA;192.168.1.192/29&#xA;192.168.1.200/32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you are using an ASA with code version 8.3+, you can create a &quot;Range&quot; type object, and apply the object in an ACL directly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network MYRANGE&#xA;  range 192.168.1.100 192.168.1.200&#xA;&#xA;access-list MYACL permit ip object MYRANGE any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-07-15T15:59:57.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19987" PostTypeId="1" AcceptedAnswerId="19988" CreationDate="2015-07-15T16:01:00.837" Score="2" ViewCount="9659" Body="&lt;p&gt;I entered &lt;code&gt;set interfaces eth0 disabled&lt;/code&gt; which worked. &lt;code&gt;show interfaces&lt;/code&gt; shows that the interface is administratively down. However I can figure out how to bring it back up.&lt;/p&gt;&#xA;" OwnerUserId="16614" LastActivityDate="2015-07-15T16:10:35.100" Title="I disabled an interface in vyatta, how do I enable it?" Tags="|interface|vyatta|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19988" PostTypeId="2" ParentId="19987" CreationDate="2015-07-15T16:10:35.100" Score="2" Body="&lt;pre&gt;&lt;code&gt;delete interfaces eth0 disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="11947" LastActivityDate="2015-07-15T16:10:35.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19989" PostTypeId="2" ParentId="19985" CreationDate="2015-07-15T16:34:36.733" Score="3" Body="&lt;p&gt;To permit a range of IP addresses you need to apply the proper inverse mask. The concepts are covered in &#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html&quot; rel=&quot;nofollow&quot;&gt;Configuring IP Access Lists&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However your range of addresses is dictated by the mask you choose. You cannot pick a range that crosses mask boundaries like you are requesting. So an ACL for a range of 100 addresses could be 0.0.0.127. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: permit ip 192.168.1.0 0.0.0.127&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This permit statement will give you the number of addresses you require but it dictates that the available range is 192.168.1.1 - 192.168.1.127.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you absolutely must use the range of addresses that you laid out you could permit in several smaller masked ranges. For instance - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;permit ip 192.168.1.128 0.0.0.63&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;will permit the range 192.168.1.128 - 192.168.1.191.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You could then - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;permit ip 192.168.1.113 0.0.0.15&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;this will permit the range 192.168.1.112 - 192.168.1.127&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Eventually you would wind up permitting individual addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-07-15T16:34:36.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19991" PostTypeId="1" AcceptedAnswerId="20004" CreationDate="2015-07-15T18:00:46.320" Score="3" ViewCount="12085" Body="&lt;p&gt;How can I ping a specific IP on a network which only contain switches while switches as far as I know don't understand IPs but only MAC!&lt;/p&gt;&#xA;" OwnerUserId="16616" LastActivityDate="2019-08-17T11:25:55.627" Title="ping in pure layer 2 LAN" Tags="|ping|layer2|" AnswerCount="2" CommentCount="2" ClosedDate="2015-07-20T15:07:55.130" ContentLicense="CC BY-SA 3.0" />
  <row Id="19992" PostTypeId="2" ParentId="19984" CreationDate="2015-07-15T19:44:27.230" Score="2" Body="&lt;p&gt;Yes, you can boot JUNOS from a USB drive, and an EX2200 will work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos14.2/topics/task/installation/ex-series-software-installing-booting-from-usb.html&quot; rel=&quot;nofollow&quot;&gt;Booting an EX Series Switch Using a Software Package Stored on a USB Flash Drive&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follow the documentation and it should work fine.  Chances are your flash isn't permanently corrupt so you can reinstall JUNOS and get everything back in working order.  &lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-07-15T19:44:27.230" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="19994" PostTypeId="2" ParentId="19991" CreationDate="2015-07-15T20:02:01.527" Score="0" Body="&lt;p&gt;It might be helpful for you to start a packet trace (with something like wireshark) you will see that the first thing your local machine does when you issue the ping command is broadcast an APR packet (assuming it isn't already in the arp table) to the IP address you are trying to reach. Example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IntelCor_00:00:88    Broadcast   ARP 42  Who has 10.1.0.1?  Tell 10.1.0.2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Once your local machine has the MAC address of the device your trying to reach it then assembles an ICMP (ping) packet with the destination MAC/IP combination. So your correct that the destination packet is a particular IP but that packet is then wrapped in a MAC frame and sent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-07-15T20:02:01.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19995" PostTypeId="2" ParentId="19977" CreationDate="2015-07-15T20:12:03.703" Score="0" Body="&lt;p&gt;&lt;em&gt;Your initial question seems to be about name resolution, but on your comment bellow you ask&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How ARP resolution is performed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I'll try to address that question.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A brief explanation of ARP resolution&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a network device needs to find the MAC address of an IP it will send a packet with destination MAC address &lt;code&gt;FF:FF:FF:FF:FF:FF&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is considered a broadcast mac address so the switch will simply flood the packet to all ports (if vlans are used then only to the ports belonging to the same vlan).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The broadcast packet is an &lt;code&gt;ARP Request&lt;/code&gt; message, essentially asking every device on the network 'Who has this IP?'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the devices will receive the ARP Request and the one that has the IP configured will reply back with an &lt;code&gt;ARP Reply&lt;/code&gt; message from its MAC Address to the device's MAC address that sent the ARP Request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it receives the reply and adds the IP &amp;lt;&gt; MAC pair to it's ARP table cache.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For as long as the entry is in cache, whenever it needs to communicate with that device it will know how to send the packets directly to its MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the entry is expired, it will re-sent an &lt;code&gt;ARP Request&lt;/code&gt; message and the process starts from the beginning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a very crude explanation of course. There are many tutorials explaining this in great detail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a quick google search I came up with a nice one with graphs and all :)&lt;br&gt;&#xA;&lt;a href=&quot;http://www.omnisecu.com/tcpip/address-resolution-protocol-arp.php&quot; rel=&quot;nofollow&quot;&gt;http://www.omnisecu.com/tcpip/address-resolution-protocol-arp.php&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.tummy.com/articles/networking-basics-how-arp-works/&quot; rel=&quot;nofollow&quot;&gt;http://www.tummy.com/articles/networking-basics-how-arp-works/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, to answer your question regarding 2 devices directly connected, the same principle applies in that case too.&#xA;ARP resolution works the same way weather it's a direct connection or using a switch with tens of devices.&lt;/p&gt;&#xA;" OwnerUserId="1418" LastActivityDate="2015-07-15T20:12:03.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="19996" PostTypeId="1" CreationDate="2015-07-15T22:19:23.863" Score="0" ViewCount="3588" Body="&lt;p&gt;I am using nmap to scan open ports of a device (Android smartphone), and nmap returns me that all 1000 scanned ports are closed. Right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in the same time I can ping the device. I thought that pinging a device would send a ICMP &quot;echo&quot; message to it, which is using port 7 if I am good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;So, two questions :&lt;/em&gt;&lt;/strong&gt;&#xA;Why does nmap say that all ports are closed (meaning that the remote computer rejected my connection attempt with a RST packet Filtered), if I can ping on port 7 ?&#xA;Why does nmap only scan 1000 ports and not 65K ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="16335" LastEditorUserId="509" LastEditDate="2015-07-15T22:31:40.957" LastActivityDate="2015-07-16T04:34:45.863" Title="I can ping but ports are closed" Tags="|ping|icmp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="19997" PostTypeId="2" ParentId="19996" CreationDate="2015-07-15T22:31:23.410" Score="8" Body="&lt;p&gt;TCP port 7 ('echo') and ICMP echo request messages are two very different things. Ping uses ICMP echo messages, which (since it's ICMP) do not use TCP. So this has nothing to do with TCP ports being open or closed, you can't &quot;ping&quot; TCP ports using the ping utility. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess would be that nmap scans 1000 ports by default because those are most of the well known ports, and to reduce runtime. You can always specify all ports using &lt;code&gt;-p 0-65535&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-07-15T22:31:23.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20001" PostTypeId="2" ParentId="19972" CreationDate="2015-07-16T02:51:32.703" Score="0" Body="&lt;p&gt;You just need to download the correct software.  Once you do that, the features will be there.  The price is no different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/rGPup.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-16T02:51:32.703" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20002" PostTypeId="2" ParentId="19996" CreationDate="2015-07-16T04:34:45.863" Score="1" Body="&lt;p&gt;You will notice in your NMap scan results that it states that ping was successful, and yet still that all ports it scanned are closed.  This is because they are two very different things, in fact ICMP is in a diferent OSI layer than TCP/UDP.  So it follows that two different layers are checked in two different ways.&lt;/p&gt;&#xA;" OwnerUserId="7534" LastActivityDate="2015-07-16T04:34:45.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20003" PostTypeId="1" CreationDate="2015-07-16T06:18:23.677" Score="3" ViewCount="447" Body="&lt;p&gt;I have a Juniper EX switch, which receives 3 subnets (192.168.1~3.0/24) from a untagged port of upstream switch (I don't have access to that switch). Is it possible to configure the EX switch to put different subnets onto different VLANs ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have hosts on my side on all 3 subnets under my switch, they are all connected to access port of VLAN 10. (And the upstream port is also configured as access port VLAN 10)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have, for instance, VLAN 11 that contains only 192.168.1.0/24 traffic, VLAN 12 that contains only 192.168.2.0/24 traffic, etc. I guess this requires the switch to act as a gateway? I'm not sure how to configure it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ps. My EX switch is not the gateway of these 3 subnets.&lt;/p&gt;&#xA;" OwnerUserId="16626" LastEditorUserId="16626" LastEditDate="2015-07-16T08:54:29.943" LastActivityDate="2015-07-21T03:08:11.120" Title="Segregate VLAN based on L3 subnet" Tags="|juniper-ex|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20004" PostTypeId="2" ParentId="19991" CreationDate="2015-07-16T08:04:45.707" Score="6" Body="&lt;p&gt;You are correct the switch only knows/cares about the MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you send a ping, host#1 first generates a arp asking for the MAC of a specific ip_dst(host#2) with a MAC_dst(ffff.ffff.ffff),MAC_src(Host#1) broadcast that the switch then forwards to all ports .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the destination host#2 receives the broadcast, the host#2 will see that it is a ARP for it's own IP(host#2), and using the MAC from the received packet, reply back to the original host#1, using known MAC's as src(Host#2) and dst(Host#1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the host#1 receives the ARP reply back, it has the MAC(host#2) and will cache the mapping of IP-MAC in the ARP table, it then send's the rest of the packet e.g. ping's using the destination MAC_dst(host#2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches don't care that it is a ping or any other packet type it only uses the MAC_dst.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2019-08-17T11:25:55.627" LastActivityDate="2019-08-17T11:25:55.627" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="20005" PostTypeId="2" ParentId="19982" CreationDate="2015-07-16T08:15:13.483" Score="11" Body="&lt;p&gt;Just to address the SNMP portion of your question, I'm guessing that you are seeing the 4.3Gbps result from querying the SNMP object 'ifSpeed'. If so, you are simply getting back the maximum value that is possible from a 32-bit object (i.e. 2^32-1). This is the expected behaviour for a 10Gbps interface. You will need to query 'ifHighSpeed' for the interface instead; more explanation is in RFC2863 &amp;amp; RFC3635.&lt;/p&gt;&#xA;" OwnerUserId="16627" LastActivityDate="2015-07-16T08:15:13.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20007" PostTypeId="2" ParentId="19962" CreationDate="2015-07-16T11:01:56.213" Score="0" Body="&lt;p&gt;PoE (802.3af) provides up to 15.4W power.&#xA;PoE+ (802.3at) provides up to 25.5W power. How much power does your device need?&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Power_over_Ethernet&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Power_over_Ethernet&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16630" LastActivityDate="2015-07-16T11:01:56.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20010" PostTypeId="1" AcceptedAnswerId="20011" CreationDate="2015-07-16T13:48:41.583" Score="0" ViewCount="87" Body="&lt;p&gt;I have done some search and I found that there is two series of cisco firewalls : Cisco ASA 5500 series and Cisco PIX 500 series firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do all Cisco Firewalls support IPSec configuration? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="16632" LastActivityDate="2015-07-16T15:20:49.940" Title="Can I configure IPSec on any Cisco Firewall?" Tags="|cisco|ipsec|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20011" PostTypeId="2" ParentId="20010" CreationDate="2015-07-16T15:20:49.940" Score="3" Body="&lt;p&gt;IPSEC is supported on all of the PIX and ASA models. Your image and &lt;a href=&quot;https://supportforums.cisco.com/document/67701/asa-versions-image-names-and-licensing#Free_3DESAES_license&quot; rel=&quot;nofollow&quot;&gt;license&lt;/a&gt; will determine which types of encryption you can use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PIX series is no longer being produced. It is fairly rare to see them in any production system at this point. There are two series of ASAs currently. You have the X and non X series. The X series is the newest and introduces faster hardware and support for &lt;a href=&quot;http://www.cisco.com/c/en/us/products/security/asa-firepower-services/index.html&quot; rel=&quot;nofollow&quot;&gt;FirePOWER&lt;/a&gt; services. (Cisco purchased Sourcefire and integrated this in to their newer ASA products) Newer versions of the ASA software also support SMP for the RX and TX Rings. This allows multiple processor cores to service the rings, improving overall system performance.&lt;/p&gt;&#xA;" OwnerUserId="16282" LastActivityDate="2015-07-16T15:20:49.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20014" PostTypeId="2" ParentId="14734" CreationDate="2015-07-16T18:50:54.877" Score="0" Body="&lt;p&gt;So in the old switches you would have to go to the locations of the switch login to the command line and then configure it through the command line. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With open flow enabled switches you could program the switch by sending commands through openflow messages. SDN controller helps you to program the switches. In other words, SDN controller uses openflow and gives you an interface to program the switched. &lt;/p&gt;&#xA;" OwnerUserId="16639" LastActivityDate="2015-07-16T18:50:54.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20015" PostTypeId="1" CreationDate="2015-07-16T19:04:30.710" Score="2" ViewCount="1135" Body="&lt;p&gt;I have an AXIS 211M webcam that I was reconfiguring for our school network. I changed the network settings from using a fixed IP address to using DHCP. Now I can no longer access the camera, as I don't know it's new IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How might I go about finding the new IP of the camera (or otherwise accessing its config page) so I can set it back to a fixed IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally I would plug this into my router and look at the router's status page to list connected devices. I don't have access to another router right now, though, and there's no way I would be able to isolate the device on the school's router. I tried directly connecting it to my Mac (via TBolt-Ethernet bridge) but I can't figure out how to ping it.&lt;/p&gt;&#xA;" OwnerUserId="16640" LastActivityDate="2016-03-13T20:29:50.160" Title="Lost webcam on network" Tags="|dhcp|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20017" PostTypeId="2" ParentId="14734" CreationDate="2015-07-16T19:43:08.220" Score="6" Body="&lt;p&gt;A normal switch works independently of the rest of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A OpenFlow/SDN switch, when it receives a packet, that it does not have a flow for (Match + exit port) will contact a SDN controller (Server) and ask what must it do with this packet.  The controller can then download a flow to the switch, possibly including some packet manipulation.  Once the flow is downloaded to the switch it will switch similar packets at wire-speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why is centralizing the decision such a big deal?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having a central server that knows the network layout and can make all the switching decisions and build the paths gives us new capabilities.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The SDN controller could route non-critical/bulk traffic on longer routes that are not fully utilized.&lt;/li&gt;&#xA;&lt;li&gt;The SDN controller could send the initial couple of packets to a firewall, and once the firewall is happy/accepts the flow, the SDN controller can bypass the firewall thus removing the load from it and allowing multi-gigabit data centers to be fire-walled.&lt;/li&gt;&#xA;&lt;li&gt;The SDN controller can easily implement load-balancing also at high data rates by just directing different flows to different hosts, only doing the set-up of the initial flows.&lt;/li&gt;&#xA;&lt;li&gt;Traffic can be isolated without the need for VLANs, the SDN controller can just refuse certain connections.&lt;/li&gt;&#xA;&lt;li&gt;Setup a network TAP/Sniffer easily for any port or even specific traffic by programming the network to send a duplicate stream to a network monitoring device.&lt;/li&gt;&#xA;&lt;li&gt;It allows for the development of new services and ideas all in software on the SDN controller. &lt;a href=&quot;http://flowgrammable.org/sdn/openflow/actions/#tab_ofp_1_4&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenFlow-Actions&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="49204" LastEditDate="2018-08-06T00:00:05.083" LastActivityDate="2018-08-06T00:00:05.083" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20019" PostTypeId="2" ParentId="20015" CreationDate="2015-07-16T20:55:00.443" Score="1" Body="&lt;p&gt;A couple of ideas;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When connected to your MAC, run wireshark and look for the DHCP requests.  That will give you the MAC address, which you can then look up in your DHCP server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Copy the MAC table from your router, and &lt;a href=&quot;https://www.wireshark.org/tools/oui-lookup.html&quot; rel=&quot;nofollow&quot;&gt;lookup the OUI name,&lt;/a&gt; which will likely give you a few candidates that you can then look up in your DHCP server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When you find it, you should create a DHCP reservation for that MAC  address, so you always know what the IP is.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-07-16T20:55:00.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20020" PostTypeId="1" AcceptedAnswerId="20033" CreationDate="2015-07-16T21:37:54.133" Score="0" ViewCount="627" Body="&lt;p&gt;My goal is to have a optical LINC switch running and use Ryu-oe to control it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I receive the following error when I try to run Ryu-Oe instruction from &lt;a href=&quot;https://github.com/o3project/ryu-oe&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ryu-oe is just ryu controller with some optical extensions. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    File &quot;/usr/local/bin/ryu-manager&quot;, line 5, in &amp;lt;module&amp;gt;&#xA;    from pkg_resources import load_entry_point&#xA;  File &quot;/usr/lib/python2.7/dist-packages/pkg_resources.py&quot;, line 2749, in &amp;lt;module&amp;gt;&#xA;    working_set = WorkingSet._build_master()&#xA;  File &quot;/usr/lib/python2.7/dist-packages/pkg_resources.py&quot;, line 446, in _build_master&#xA;    return cls._build_from_requirements(__requires__)&#xA;  File &quot;/usr/lib/python2.7/dist-packages/pkg_resources.py&quot;, line 459, in _build_from_requirements&#xA;    dists = ws.resolve(reqs, Environment())&#xA;  File &quot;/usr/lib/python2.7/dist-packages/pkg_resources.py&quot;, line 628, in resolve&#xA;    raise DistributionNotFound(req)&#xA;pkg_resources.DistributionNotFound: msgpack-python&amp;gt;=0.4.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Anyone knows how I can solve the error?&lt;/p&gt;&#xA;" OwnerUserId="16639" LastEditorUserId="775" LastEditDate="2015-07-17T11:31:05.543" LastActivityDate="2015-07-17T14:56:11.737" Title="pkg_resources.DistributionNotFound in Ryu-oe" Tags="|sdn|" AnswerCount="1" CommentCount="1" ClosedDate="2015-07-20T15:09:19.920" ContentLicense="CC BY-SA 3.0" />
  <row Id="20026" PostTypeId="1" CreationDate="2015-07-17T08:30:44.143" Score="3" ViewCount="62" Body="&lt;p&gt;I am currently thinking about performing a wifi site survey and I wonder how a default setup should look like. Somebody suggested to use one access point and one client, then setting up the access point, walk around and do the measuring. Then move the access point and measure at some other location but don't go back to where you've performed measuring already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder whether that is a good approach because as far as I understand it, what you're trying to find out is the attenuation of the site. But the scenario above would only measure that for one direction, so it might be that a room has a concrete wall to the left and a glass wall to the other side. If I put the access point behind the concrete I might get shockingly bad results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, don't I need more than one access point for every measurement, or if I only have one, don't I have to measure at some places twice?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank y'all for your help and have a great day!&#xA;Alex &lt;/p&gt;&#xA;" OwnerUserId="16652" LastActivityDate="2015-07-17T12:43:13.400" Title="Setup for proper wifi site survey" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20027" PostTypeId="2" ParentId="7175" CreationDate="2015-07-17T08:33:34.327" Score="0" Body="&lt;p&gt;-- at the running configuration in the line vty interface check if the &lt;code&gt;transport input&lt;/code&gt; is set... if it says &lt;code&gt;tansport input none&lt;/code&gt;, then go to the line vty interface and write the following command &lt;code&gt;transport input telnet&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16653" LastEditorUserId="775" LastEditDate="2015-07-17T09:31:11.043" LastActivityDate="2015-07-17T09:31:11.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20029" PostTypeId="1" AcceptedAnswerId="20039" CreationDate="2015-07-17T11:08:55.957" Score="4" ViewCount="3289" Body="&lt;p&gt;I'm not very familiar with routers, and my searches have proven a bit futile currently. I was tasked to create a monitor for our router. I've used the following OID's to obtain the relevant information on the different interfaces I wanted to monitor&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.3.6.1.2.1.2.2.1.10&#xA;1.3.6.1.2.1.2.2.1.16&#xA;1.3.6.1.2.1.2.2.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I figured out that you have to add the interface index at the end of the OID to get a specific interface's information (eg. &lt;code&gt;1.3.6.1.2.1.2.2.1.10.2&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem that I'm having at this point is that the interface of the other router I have to monitor have subinterfaces configured on a physical interface. When I &lt;code&gt;sh int&lt;/code&gt; I can see the subinterfaces on the interface. Here is the information&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/0/0 is up, line protocol is up&#xA;  Hardware is FastEthernet, address is&#xA;  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,&#xA;     reliability 255/255, txload 1/255, rxload 6/255&#xA;  Encapsulation 802.1Q Virtual LAN, Vlan ID  1., loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 100Mb/s, 100BaseTX/FX&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:01, output 00:00:00, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 2505000 bits/sec, 364 packets/sec&#xA;  5 minute output rate 631000 bits/sec, 282 packets/sec&#xA;     5907895 packets input, 630428948 bytes&#xA;     Received 8168 broadcasts (0 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog&#xA;     0 input packets with dribble condition detected&#xA;     5162711 packets output, 1548903164 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 2 interface resets&#xA;     1135 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     1 lost carrier, 0 no carrier&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;FastEthernet0/0/0.10 is up, line protocol is up&#xA;  Hardware is FastEthernet, address is &#xA;  Description: VodacomPTP&#xA;  Internet address is &#xA;  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,&#xA;     reliability 255/255, txload 1/255, rxload 6/255&#xA;  Encapsulation 802.1Q Virtual LAN, Vlan ID  10.&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Keepalive set (10 sec)&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;FastEthernet0/0/0.20 is up, line protocol is up&#xA;  Hardware is FastEthernet, address is &#xA;  Description: Vodacom2Mbps&#xA;  Internet address is &#xA;  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,&#xA;     reliability 255/255, txload 1/255, rxload 6/255&#xA;  Encapsulation 802.1Q Virtual LAN, Vlan ID  20.&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Keepalive set (10 sec)&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;FastEthernet0/0/0.30 is up, line protocol is up&#xA;  Hardware is FastEthernet, address is &#xA;  Description: Vodacom4Mbps&#xA;  Internet address is &#xA;  MTU 1500 bytes, BW 100000 Kbit/sec, DLY 100 usec,&#xA;     reliability 255/255, txload 1/255, rxload 6/255&#xA;  Encapsulation 802.1Q Virtual LAN, Vlan ID  30.&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Keepalive set (10 sec)&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I found in MIB on this forum for &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.31.1.1.1.6#oidContent&quot; rel=&quot;nofollow&quot;&gt;ifHCInOctets&lt;/a&gt; and &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.2.1.31.1.1.1.10#oidContent&quot; rel=&quot;nofollow&quot;&gt;ifHCOutOctets&lt;/a&gt;, but I'm not sure how I should interrogate this. Because to start the MIB is already longer than the normal &lt;code&gt;ifInOctets&lt;/code&gt; MIB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to enable SNMP for say &lt;code&gt;FastEthernet0/0/0.20&lt;/code&gt;. What MIB do I have to use to get the &lt;code&gt;InOctets&lt;/code&gt; information for instance. And lastly do I still have to add a &lt;code&gt;.1&lt;/code&gt; in the index for the &lt;code&gt;1.3.6.1.2.1.31.1.1.1.6&lt;/code&gt; MIB.&lt;/p&gt;&#xA;" OwnerUserId="11889" LastActivityDate="2015-07-17T23:44:47.390" Title="How do I monitor traffic on a subinterface Cisco 1941W" Tags="|cisco|snmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20030" PostTypeId="2" ParentId="20026" CreationDate="2015-07-17T12:43:13.400" Score="2" Body="&lt;p&gt;Wi-Fi surveying is as much art as science, but generally speaking, the goal is to determine the cell edges in order to place the APs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One AP, that can be easily moved around is all you need.  You can buy or build a portable setup that lets you reposition the AP and has a battery to power it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simplified plan:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set the AP in a candidate location and walk around until you&#xA;determine the cell edge (where the signal strength drops to -67 dBm)&#xA;at several places.&lt;/li&gt;&#xA;&lt;li&gt;Move the AP so that it is 80-90% of the cell diameter away from the&#xA;first location and measure that, adjusting the location as&#xA;necessary.  &lt;/li&gt;&#xA;&lt;li&gt;Repeat until you cover the entire space.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The idea is to have the cells overlap by 10-20% so that clients can roam smoothly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are commercial products that help you do this and plot coverage maps onto floor plans.  Some people like them, some don't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a more &lt;a href=&quot;http://www.wi-fiplanet.com/tutorials/article.php/3761356&quot; rel=&quot;nofollow&quot;&gt;detailed explanation.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-07-17T12:43:13.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20031" PostTypeId="1" AcceptedAnswerId="20040" CreationDate="2015-07-17T12:56:19.690" Score="4" ViewCount="1408" Body="&lt;p&gt;As stated in &lt;a href=&quot;http://standards.ieee.org/about/get/802/802.3.html&quot; rel=&quot;nofollow&quot;&gt;IEEE 802.3&lt;/a&gt; section 3.2.6 the former Ethertype field can be used as a length field with a value &amp;lt;= 1500. Now I wonder how such packets are handled regarding the upper next layer. Can Ethernet frames, with the length field used, still contain e.g. an IP packet? If yes, how can a router or PC detect this? And what will a router typically do with a frame using length instead of Ethertype?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or more generally asked: How will the receiver decide on how to handle the payload data if no Ethertype but length is specified?&lt;/p&gt;&#xA;" OwnerUserId="16659" LastEditorUserId="16659" LastEditDate="2015-07-21T12:42:12.417" LastActivityDate="2015-07-21T12:42:12.417" Title="Ethernet SNAP frames - decision of type for upper layer still possible?" Tags="|ethernet|protocol-theory|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20033" PostTypeId="2" ParentId="20020" CreationDate="2015-07-17T14:56:11.737" Score="0" Body="&lt;p&gt;Ok it seems that the problem is solved. To be honest I don't know how it was solved. Here are some of the commands I ran: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure you are in ryu-oe directory.&#xA;&lt;code&gt;&#xA;sudo -H ./run_tests.sh &#xA;sudo ./run_tests.sh &#xA;sudo -H python ./setup.py install&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and then I ran &lt;code&gt;sudo ryu-manager ~/ryu-oe/ryu/app/ofctl_rest.py&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know which one worked for you so that we come up with a better answer. &lt;/p&gt;&#xA;" OwnerUserId="16639" LastActivityDate="2015-07-17T14:56:11.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20035" PostTypeId="1" CreationDate="2015-07-17T15:57:16.283" Score="1" ViewCount="810" Body="&lt;p&gt;Could anyone explain Radius COA in layman language?&#xA;I know only one feature where the radius assigns the VLAN. &#xA;Appreciate your time on this.&lt;/p&gt;&#xA;" OwnerUserId="16669" LastActivityDate="2015-07-18T21:44:32.753" Title="COA: Radius authentication" Tags="|radius|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20036" PostTypeId="2" ParentId="20031" CreationDate="2015-07-17T19:42:48.887" Score="-1" Body="&lt;p&gt;When a MAC frame has a length field (L/T &amp;lt;= 05-DC) the payload is sent to the LLC layer, not to IP. It is used for the MAC control plane, e.g. for spanning tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards,&#xA;Michel  &lt;/p&gt;&#xA;" OwnerUserId="13762" LastActivityDate="2015-07-17T19:42:48.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20039" PostTypeId="2" ParentId="20029" CreationDate="2015-07-17T23:44:47.390" Score="5" Body="&lt;pre&gt;&lt;code&gt;rtr1841#show snmp mib ifmib ifindex &#xA;Loopback1: Ifindex = 10&#xA;Tunnel0: Ifindex = 5&#xA;Serial0/0/0: Ifindex = 7&#xA;FastEthernet0/1: Ifindex = 2&#xA;FastEthernet0/0.2: Ifindex = 8&#xA;Loopback0: Ifindex = 6&#xA;Null0: Ifindex = 3&#xA;NVI0: Ifindex = 4&#xA;FastEthernet0/0: Ifindex = 1&#xA;FastEthernet0/0.3: Ifindex = 9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's the quickest way to find the correct ifIndex for an interface on an IOS router. (That information is also found in the IF-MIB tables.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: make sure &lt;code&gt;snmp-server ifindex persist&lt;/code&gt; is in your config, or the indexs &lt;em&gt;could&lt;/em&gt; change after a reload.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-17T23:44:47.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20040" PostTypeId="2" ParentId="20031" CreationDate="2015-07-18T04:01:04.083" Score="4" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Can Ethernet frames, with the length field used, still contain e.g. an IP packet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, you're asking about IP over 802.3 SNAP frames, which is covered in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1042&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;RFC 1042: A Standard for the Transmission of IP Datagrams over IEEE 802 Networks&quot;&gt;RFC 1042&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;A 802.3 SNAP IPv4 frame looks like this...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;+----+----+----+----+----+----+----+----+---------+-----+&#xA;| DA | SA |  L | DS | SS | CL | OI | ET | Payload | FCS |&#xA;+----+----+----+----+----+----+----+----+---------+-----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;DA&lt;/code&gt;: Destination Mac Addr (6 Bytes)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;SA&lt;/code&gt;: Source Mac Addr (6 Bytes)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;L&lt;/code&gt;: Length (2-Bytes); (Length &amp;lt;= 0x05DC hex, or 1500 decimal)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;DS&lt;/code&gt;: DSAP (1-Byte); (DSAP == 0xAA hex, or 170 decimal)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;SS&lt;/code&gt;: SSAP (1-Byte); (SSAP == 0xAA hex, or 170 decimal)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;CL&lt;/code&gt;: Control (1-Byte); (Control == 0x03 hex, or 3 decimal)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;OI&lt;/code&gt;: Organizationally Unique Identifier (3-Bytes); (OUI == 0x000000 hex, or 0 decimal)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ET&lt;/code&gt;: Ethertype (2-Bytes); (Ethertype == 0x0800 hex, or 2048 decimal)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Payload&lt;/code&gt;: Ethernet Payload (Ethernet Payload &amp;lt;= 1492 Bytes); this payload size &lt;em&gt;includes&lt;/em&gt; the size of the IPv4 header.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;FCS&lt;/code&gt;: Frame Checksum (4-Bytes)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If yes, how can a router or PC detect this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;By &amp;quot;detect this&amp;quot;, I assume you mean IP over 802.3 SNAP; the SNAP frame is first distinguished from an Ether II / ARPA frame because Type / Length &amp;lt;= 0x05DC hex.  Then the router looks at the other fields specified above...&lt;/p&gt;&#xA;&lt;p&gt;Computers have to be explicitly configured with SNAP encapsulation, to include a lower-than normal MTU (IP MTU &amp;lt;= 1492 bytes).  While it's theoretically possible to include 802.3 SNAP IPv4 in the broadcast domain as &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc894&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethernet II (ARPA)&lt;/a&gt;, most people would think you're crazy to do so.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;And what will a router typically do with a frame using length instead of Ethertype?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;There aren't many 802.3 IP SNAP networks left... Cisco IOS used to &lt;a href=&quot;https://supportforums.cisco.com/document/11816/high-cpu-utilization-cisco-catalyst-3550-switch-running-cisco-ios&quot; rel=&quot;nofollow noreferrer&quot;&gt;process IPv4 over SNAP in the punt path&lt;/a&gt;; but I haven't looked at this in depth in a long time.&lt;/p&gt;&#xA;&lt;p&gt;To test with recent Cisco IOS, I attempted to ping one of my Cisco 3560 switches (&lt;code&gt;debug ip icmp&lt;/code&gt; enabled) with an 802.3 SNAP IPv4 frame, but the switch just gave me dumb looks...&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[mpenning@tsunami ~]$ sudo python&#xA;Python 2.7.3 (default, Jan  2 2013, 13:56:14)&#xA;[GCC 4.7.2] on linux2&#xA;Type &amp;quot;help&amp;quot;, &amp;quot;copyright&amp;quot;, &amp;quot;credits&amp;quot; or &amp;quot;license&amp;quot; for more information.&#xA;&amp;gt;&amp;gt;&amp;gt; from scapy.all import SNAP, Dot3, LLC, IP, ICMP&#xA;&amp;gt;&amp;gt;&amp;gt; from scapy.all import srp1&#xA;&amp;gt;&amp;gt;&amp;gt; pak = Dot3(dst=&amp;quot;64:ae:de:ad:be:ef&amp;quot;, src=&amp;quot;80:ee:73:20:00:00&amp;quot;) / LLC() / SNAP() / IP(src=&amp;quot;10.0.0.5&amp;quot;, dst=&amp;quot;10.0.0.1&amp;quot;) / ICMP()&#xA;&amp;gt;&amp;gt;&amp;gt; pak&#xA;&amp;lt;Dot3  dst=64:ae:de:ad:be:ef src=80:ee:73:20:00:00 |&#xA;&amp;lt;LLC  dsap=0xaa ssap=0xaa ctrl=3 |&amp;lt;SNAP  code=0x800 |&#xA;&amp;lt;IP  frag=0 proto=icmp dst=10.0.0.1 |&amp;lt;ICMP  |&amp;gt;&amp;gt;&amp;gt;&amp;gt;&amp;gt;&#xA;&amp;gt;&amp;gt;&amp;gt; srp1(pak)&#xA;Begin emission:&#xA;Finished to send 1 packets.&#xA;...................^C&#xA;Received 19 packets, got 0 answers, remaining 1 packets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Christian &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/20031/ethernet-frame-length-decision-of-type-for-upper-layer-still-possible#comment30445_20031&quot;&gt;said&lt;/a&gt;: The background for this question is this: I would like to implement a proprietary protocol on top of 802.3 MAC frames and use the length field. So, what will using the length field imply for other hard- and software? E.g. will it be safe to send such frames to cots systems, which will not know about my protocol inside.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I personally would discourage you from implementing a private ethernet protocol; people did this kind of thing all the time twenty or thirty years ago, but it's increasingly rare to find custom protocols today.&lt;/p&gt;&#xA;&lt;p&gt;Why?  It just doesn't make sense for the exactly the reason you're asking.  Practically the entire world uses &amp;quot;something&amp;quot; on top of IPv4 or IPv6.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;UDP is available if you want a &amp;quot;connectionless&amp;quot; service&lt;/li&gt;&#xA;&lt;li&gt;TCP or SCTP are good choices for &amp;quot;connection-oriented&amp;quot; services&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;What happens if you build your own protocol?&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;It's hard to talk to anything else, even on the same ethernet &lt;a href=&quot;https://networkengineering.stackexchange.com/q/7157/775&quot;&gt;broadcast domain&lt;/a&gt;... because other things invariably are using IP and ethertype (RFC 894) frames.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You've got no routing (i.e. the capability to send traffic across multiple ethernet broadcast domains, such as the networks people build between cities and countries); this also means you could be doing stuff like bridging across the internet, which requires building IP tunnels.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do you want network services?  Guess what you get to build:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Want file transfers?  Build your own FTP or TFTP&lt;/li&gt;&#xA;&lt;li&gt;Want name resolution?  Build your own DNS&lt;/li&gt;&#xA;&lt;li&gt;Want network errors and monitoring?  Build your own ICMP protocols&lt;/li&gt;&#xA;&lt;li&gt;Want security?  Build your own firewalls, encryption, and PKI (ick)&lt;/li&gt;&#xA;&lt;li&gt;Want to talk to other computers?  Build kernel drivers for those operating systems (see below)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Speaking broadly, custom ethernet protocols require a kernel driver for all operating systems in question; do you really want to build and distribute a kernel driver?  If you use IP it's simpler, because you can have services listening on top of an existing IP kernel driver; just bind to a port number and leverage the built-in IP kernel drivers.&lt;/p&gt;&#xA;&lt;p&gt;However, building with IP comes at the cost of using &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc894&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethernet II (ARPA) encapsulation&lt;/a&gt; (i.e. &lt;em&gt;no length field in the ethernet frame&lt;/em&gt;).&lt;/p&gt;&#xA;&lt;p&gt;Maybe you still want to use your own custom ethernet protocol; at least by now you understand more about the associated tradeoffs.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-07-21T10:06:46.433" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20043" PostTypeId="1" AcceptedAnswerId="20044" CreationDate="2015-07-18T13:19:10.023" Score="0" ViewCount="120" Body="&lt;p&gt;I am very new to this subject. If i have a data packet that is 75 bytes long, the frame layer tells me that the size of the packet is 75 bytes, the size of the ethernet frame layer is 14 bytes, the IP header is 20 bytes but the IP datagram has length 61. The TCP segment is 21 in length and the TCP header is 20 bytes in length. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to figure of where the actual file data is. According to my textbook question, there is 21 byes of file data. If i remove the TCP/IP headers i am left with 22 bytes. Is the extra byte for the port number? leaving 21 byes of file data, this data is all stored in the IP datagram. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then have to explain why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There seems to be no information on this in the textbook i have, if i am in the wrong place to be asking this question could someone kindly point me in the correct direction. &lt;/p&gt;&#xA;" OwnerDisplayName="user16675" LastActivityDate="2015-07-21T15:16:05.447" Title="Where is file data is kept in a packet?" Tags="|packet-analysis|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20044" PostTypeId="2" ParentId="20043" CreationDate="2015-07-18T14:30:47.703" Score="1" Body="&lt;p&gt;The IP datagram size includes the header, but the TCP segment size does not.&#xA;The port numbers are contained within the TCP header&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   75 Frame size&#xA;  - 14 Ethernet&#xA;  - 20 IP header&#xA;  - 20 TCP header&#xA;&#xA;leaves 21 bytes of data.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT:  Perhaps I should be more precise and say &quot;payload&quot; instead of data.  In fact, each layer's PDU is &quot;data&quot; to the layer below it.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-07-18T18:08:36.197" LastActivityDate="2015-07-18T18:08:36.197" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="20047" PostTypeId="2" ParentId="20035" CreationDate="2015-07-18T15:10:08.510" Score="1" Body="&lt;p&gt;Originally with RADIUS AAA a client would authenticate and be granted access/authority via a policy. However if during this session the endpoints were to experience some changes that affected authorization there was no way to reauthenticate/re-apply policy/change policy without disconnection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The outcome ended up being that a client would be disconnected and then have to reconnect to receive an altered AAA policy/profile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus with CoA, changes can be made to authorization within a current AAA session. Using your vlan example - a client could authenticate and be placed in a walled garden VLAN, once NAC or some other system determines the device to be clean then a CoA can be sent to the network device which triggers a VLAN change for the client to an unrestricted VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was largely exposed to CoA at my previous job for an ISP. CoA was used to trigger shaping QoS policies in-flight for users that had breached their download quota limit. This meant no disconnections for users just to apply a new QoS policy to their virtual interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH.&lt;/p&gt;&#xA;" OwnerUserId="168" LastEditorUserId="168" LastEditDate="2015-07-18T21:44:32.753" LastActivityDate="2015-07-18T21:44:32.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20053" PostTypeId="1" AcceptedAnswerId="20054" CreationDate="2015-07-19T08:12:52.203" Score="6" ViewCount="1833" Body="&lt;p&gt;In current networks, OSPF ,RIP,etc determine the path taken by a packet. In SDN, the OpenFlow protocol sets the flow tables of the forwarding units. Can someone be very clear that how does OpenFlow decide which path to set for a flow?&lt;/p&gt;&#xA;" OwnerUserId="16689" LastActivityDate="2015-12-17T18:28:00.423" Title="How does Openflow decide which path to use?" Tags="|openflow|sdn|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20054" PostTypeId="2" ParentId="20053" CreationDate="2015-07-19T09:05:14.510" Score="5" Body="&lt;p&gt;&lt;strong&gt;Short version:&lt;/strong&gt; it doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Longer version:&lt;/strong&gt;&#xA;Openflow is just a protocol for communicating between the 'forwarding units' and a controller. It is the controller itself that determines what to do with packets, and it can do this in any way it likes. You can implement most of the current routing protocols in an OpenFlow controller, see for instance &lt;a href=&quot;http://routeflow.github.io/RouteFlow/&quot; rel=&quot;noreferrer&quot;&gt;RouteFlow&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the OpenFlow protocol is not used to determine which paths to take, it is just a means of installing the flows in the flow tables. In this sense you can see it as analogous to SNMP and friends (although somewhat more powerful). &lt;/p&gt;&#xA;" OwnerUserId="16691" LastActivityDate="2015-07-19T09:05:14.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20057" PostTypeId="1" AcceptedAnswerId="20058" CreationDate="2015-07-19T15:37:00.133" Score="3" ViewCount="909" Body="&lt;p&gt;Actually I'm doing an online course and in the Address Resolution Protocol video lecture, this statement is made in the following context.&#xA;&lt;img src=&quot;https://i.stack.imgur.com/YB3nD.png&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/QyblB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here's what the instructor says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It needs to because of the concept&#xA;  of a netmask. For example, look at this hypothetical setup. The gateway, in the middle, has a single&#xA;  IP address: 192.168.0.1. It has two network cards, one connecting it to the destination&#xA;  171.43.22.5, one connecting it to the source, 192.168.0.5.&#xA;  &lt;strong&gt;The address 192.168.0.1 can really only be in one of these networks, the source network.&lt;/strong&gt;&#xA;  The netmask needed for 192.168.0.1 to be in the same network as 171.43.22.5 is 128.0.0.0,&#xA;  or just one bit of netmask! &lt;strong&gt;But it can’t be that all IP addresses whose first bit is&#xA;  1 are in the same network as 171.43.22.5 -- 192.168.0.5, for example, needs to be reached through the&#xA;  gateway.&lt;/strong&gt;&#xA;  So instead we often see setups like this, where the gateway or router has multiple interfaces,&#xA;  each with their own link layer address to identify the card, and also each with their&#xA;  own network layer address to identify the host within the network that card is part&#xA;  of. For the gateway, the left interface has IP address 192.168.0.1, while the right interface&#xA;  has IP address 171.43.22.8.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I specially don't understand the bold statements. Why can't 192.168.0.1 be in both networks? &lt;/p&gt;&#xA;" OwnerUserId="16695" LastEditorUserId="16695" LastEditDate="2015-07-19T15:58:13.663" LastActivityDate="2015-07-20T04:50:04.807" Title="What does it mean when we say that a single host can have multiple IP addresses" Tags="|arp|" AnswerCount="3" CommentCount="3" ClosedDate="2015-07-20T15:10:40.287" ContentLicense="CC BY-SA 3.0" />
  <row Id="20058" PostTypeId="2" ParentId="20057" CreationDate="2015-07-19T17:40:27.410" Score="1" Body="&lt;p&gt;For my explanation lets assume the mask on both subnet's is /24 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On any single subnet, all the hosts (including the gateway) must have the same network portion (as defined by the mask), else they are not on the same subnet.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;net1: 192.168.0.0/24  range of ip's 192.168.0.1 - 192.168.0.254 in subnet.&lt;/li&gt;&#xA;&lt;li&gt;net2: 171.43.22.0/24  range of ip's 171.43.22.1 - 171.43.22.254&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thus if a GW/Router has interfaces in different subnet's it needs a IP on each interface that is from that subnet, to allow it to talk to the hosts in the subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, if the Gateway only had ip 192.168.0.1 it would not be able to talk to 171.43.22.5 directly, as 172.43.22.5 would refuse to send packets to a ip not on its subnet, and rather forward them to it's configured gw(who has to be in the 171.43.22.0/24 subnet)&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-19T17:40:27.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20059" PostTypeId="2" ParentId="20053" CreationDate="2015-07-19T17:49:16.413" Score="0" Body="&lt;p&gt;As stated by @nik, OpenFlow is just the protocol the controller uses to setup the flows on the network equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the SDN controller is aware of all packets entering the equipment it controls, it can build a map of ports/mac/ip as devices start to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is nothing preventing the controller from running a routing protocol; it could be running OSPF, and have all the devices under it's control look like one huge single router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example scenarios:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The SDN controller could have any incoming OSPF packet's on the edge forwarded to itself for OSPF processing and respond to them.&lt;/li&gt;&#xA;&lt;li&gt;The controller could just switch the OSPF traffic to a actual router, thus the devices under it's control just act's as a big switch.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2015-07-19T18:06:43.373" LastActivityDate="2015-07-19T18:06:43.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20061" PostTypeId="1" CreationDate="2015-07-19T19:17:44.743" Score="3" ViewCount="19512" Body="&lt;p&gt;I have setup a lab to play with DMVPN and EIGRP. Everything works perfectly fine until I test things by shutting down redundant ports. Once I do that the DMVPNs never recover even after restoring all ports. I get the error shown below from each &quot;site&quot; on each Hub every minute(rate limited to 1 minute iirc). I understand that this is because ipsec SAs are out of sync but I would think there would be a way for them to recover automatically. What can be done to synchronize these?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%CRYPTO-4-RECVD_PKT_INV_SPI: decaps: rec'd IPSEC packet has invalid spi for destaddr=1.1.1.2, prot=50, spi=0xE6F73833(3874961459), srcaddr=2.200.2.200&#xA;&#xA;&#xA;&#xA;crypto isakmp policy 10&#xA; encr aes&#xA; authentication pre-share&#xA;crypto isakmp key test address 0.0.0.0 0.0.0.0&#xA;crypto isakmp invalid-spi-recovery&#xA;crypto ipsec transform-set DefaultCrypto esp-aes&#xA;crypto ipsec profile DMVPN&#xA; set transform-set DefaultCrypto&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2428" LastEditorUserId="509" LastEditDate="2016-03-31T20:14:28.403" LastActivityDate="2021-07-01T20:25:46.267" Title="rec'd IPSEC packet has invalid spi" Tags="|vpn|ipsec|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20063" PostTypeId="1" CreationDate="2015-07-19T19:37:06.853" Score="15" ViewCount="79500" Body="&lt;p&gt;My Router's WAN IP is a public IP - 172.100.x.x&#xA;And my public IP is - 182.x.x.x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do I have 2 public IP's? Does this probably mean that my router is behind another router? But then what is the use of configuring 2 public IP's?&lt;/p&gt;&#xA;" OwnerUserId="16698" LastActivityDate="2021-08-02T18:26:04.763" Title="Why is my Router's WAN IP different from public IP?" Tags="|router|ipv4|wan|" AnswerCount="2" CommentCount="4" ClosedDate="2021-08-02T18:30:23.533" ContentLicense="CC BY-SA 3.0" />
  <row Id="20064" PostTypeId="2" ParentId="20057" CreationDate="2015-07-19T19:55:29.487" Score="0" Body="&lt;p&gt;Each port of router MUST BE connected to a different network. If we connect the ports of the router to the same network, then the router will discard any incoming packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if we assume a mask of 24, then the left side is in the network 192.168.0.0 and the right side is in the network 171.43.22.0. So if you try to configure 192.168.0.1 for the right network, then you are connecting both ports of the router to the same network, which you must not.&lt;/p&gt;&#xA;" OwnerUserId="16698" LastActivityDate="2015-07-19T19:55:29.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20067" PostTypeId="2" ParentId="20063" CreationDate="2015-07-19T21:07:42.260" Score="16" Body="&lt;p&gt;I can see two possible explanations:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Your WAN address is your public address, but &lt;em&gt;&lt;strong&gt;you are yourself using something that makes it look like you are accessing the internet somewhere else&lt;/strong&gt;&lt;/em&gt;. One example is a proxy server which uses the 182-address to access the internet. A website telling you what your public IP is would see the 182 address. Often these sites will also tell you there is a proxy in play if the proxy sets the HTTP X-Forwarded-For header. Another possibility is a (VPN-)tunnel.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Your router is indeed &lt;em&gt;&lt;strong&gt;behind another router performing address translation&lt;/strong&gt;&lt;/em&gt;. Chances are your internet provider is doing &lt;a href=&quot;https://en.wikipedia.org/wiki/Carrier-grade_NAT&quot; rel=&quot;nofollow noreferrer&quot;&gt;carrier-grade nat&lt;/a&gt;. As to 'why?', ISPs do this to overcome an IPv4 address shortage. This way, they can provide internet access to many customers using just one public IP.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Assuming you are not using a proxy, something's off... It is indeed strange that a 172.100 address is being assigned to customers, which are then hidden behind some 182 network. 172.100 was assigned by ARIN, 182 by APNIC...&lt;/p&gt;&#xA;&lt;p&gt;Assigning RFC1918 private addresses to customers when using carrier-grade NAT can cause problems when the same network is in use inside the customer's network. The right thing to do (according to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6598&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6598&lt;/a&gt;) would be using addresses from 100.64.0.0/10. Using (parts of) 172.100 avoids possible conflicts with private addresses, but could make (parts of) the hosts rightfully using 172.100 addresses unreachable for you. Also, using 172.100 creates a risk of these routes being leaked into the global BGP table.&lt;/p&gt;&#xA;&lt;p&gt;This is speculation, but since your WAN IP starts with 172, someone could be assuming the whole 172.0.0.0/8 range is private (but actually only 172.16.0.0/12 is private). Otherwise, someone is knowingly squatting IP space.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-07-20T03:25:46.880" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20068" PostTypeId="5" CreationDate="2015-07-19T22:47:08.480" Score="0" Body="&lt;p&gt;Software-defined networking (SDN) is a way of organising networks in which the data and control planes are fully decoupled. This allows the logic and intelligence of the control plane to be implemented in external software controllers, while abstracting away the complexities of the physical forwarding plane.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In software-defined networks the state of the network, rather than being&#xA;distributed across network elements such as routers and switches, is cen-&#xA;tralised in a software-based controller. Unlike traditional routing protocols, where each network element generally only sees the subset of the network state that is needed to route packets to the next element, in a software-defined network it is possible to build up a global view of the entire network state in a centralised location. This allows for radically new approaches to networking problems, such as routing, load balancing and security enforcement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the control logic is implemented in software rather than firmware or&#xA;hardware ASICs, it makes implementing new features and services much&#xA;easier than with traditional networking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several implementations of SDN architectures, the most prominent being &lt;a href=&quot;https://opennetworking.org&quot; rel=&quot;nofollow&quot;&gt;OpenFlow&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="16691" LastEditorUserId="16691" LastEditDate="2015-07-20T05:46:26.200" LastActivityDate="2015-07-20T05:46:26.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20069" PostTypeId="4" CreationDate="2015-07-19T22:47:08.480" Score="0" Body="For questions about Software-defined networking (SDN), an approach to networking architecture that separates the control plane from the forwarding plane, with the network control logic implemented in software-based controllers." OwnerUserId="16691" LastEditorUserId="8499" LastEditDate="2016-11-29T21:24:44.960" LastActivityDate="2016-11-29T21:24:44.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20071" PostTypeId="2" ParentId="20057" CreationDate="2015-07-20T04:50:04.807" Score="0" Body="&lt;p&gt;Okay so lets start off with what a Network mask is. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most people are familiar with 192.168.1.1 or sometimes we see 192.168.0.1, now the network mask you typically see for this is 255.255.255.0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Evert time you see a 255, that part of the Ip/address is part of the &quot;network&quot; address. Every time you see a 0. That part is part of the &quot;host&quot; address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so for 192.168.0.1 with a net mask of 255.255.255.0 the network part is 192.168.0 (and we would actually say the network is 192.168.0.0) and the host part is just .1  if we compare this to 192.168.44.111 we look at the network part and we see that they are in 2 different networks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for 171.43.22.8 with a netmask of 255.255.255.0 (also called /24 and ill get to that) the network part is 171.43.22 (remember that network is 171.43.22.0) and the host part is .8  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now because the netmask is /24 (255.255.255.0)   only the last part can be used for host,  .1-.254 (.255 is your broadcast address)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what if the mask changes? 255.255.0.0 or /16 ? well lets look again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168 is now network and the rest will point to host. so 192.168.44.111 and 192.168.0.1 are now in the same network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so what's all the /16 and /24? it's just another way to express the netmask. Each 255 in binary is 8 bit's of all 11111111's so if I say a netmask of /8 it means 255.0.0.0 and /16 255.255.0.0 and /24 255.255.255.0  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now this was just a primer, lots more to learn about netmask and how to apply them using ACL's and stuff's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now you can answer your own question =) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each NIC can only be in one network. And since 192.168.0.5 has a gateway of 192.168.0.1 we know the netmask to be /24. If you apply the /24 to 171.43.22.5 it's easy to see they are not in the same network and will need a router to route the packets for them from network to network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good Luck with your studies =)&lt;/p&gt;&#xA;" OwnerUserId="16612" LastActivityDate="2015-07-20T04:50:04.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20073" PostTypeId="1" AcceptedAnswerId="20077" CreationDate="2015-07-20T08:57:16.543" Score="2" ViewCount="2818" Body="&lt;p&gt;I have two mikrotik routers to use in order to connect two locations : &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Office 1 - Static IP with a NAT to the ISP, a mikrotik Router can be the DMZ.&lt;/li&gt;&#xA;&lt;li&gt;Office 2 - Dynamic IP with a NAT to the ISP.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is it possible to connect the two so boxes behind both of the mikrotiks will be in the same LAN (ARPing each other)? How would you go about doing this? What is the recommended protocol to use?&lt;/p&gt;&#xA;" OwnerUserId="16705" LastEditorUserId="8499" LastEditDate="2018-02-14T16:44:20.350" LastActivityDate="2018-02-14T16:44:20.350" Title="Is it possible to connect two networks using Mikrotik RouterOS when both are behind a NAT?" Tags="|vpn|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-09T23:50:55.043" ContentLicense="CC BY-SA 3.0" />
  <row Id="20077" PostTypeId="2" ParentId="20073" CreationDate="2015-07-20T11:04:30.363" Score="2" Body="&lt;p&gt;Since you don't have any static IPs on both sites then you will need to use Dynamic DNS to be able to have both mikrotik routers 'find' each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mikrotik supports its own Dynamic DNS out of the box (it's not easy to remember, but it does the job and works out of the box). Check IP &gt; Cloud to enable it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, on Office 1 since it can be DMZ will be the VPN server. Mikrotik supports PPTP, L2TP, OpenVPN, SSTP. Use which-ever works better for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Office 2 which will be the 'client' side of the VPN you create a vpn client interface connecting to Office's 1 dynamic DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure to use the latest version of Mikrotik so the above features are fully supported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next step, now that you have a vpn connection, is to create an EoIP tunnel over the VPN you created. This will allow you to have both sites talk to each other as if they where on the same physical location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally you bridge the EoIP tunnel interface on both sites with your LAN interface(s) and you should be able to talk from one site to another with full ethernet frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, beware that this approach has a lot of overhead due to double encapsulation of packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another approach would be to enable DMZ on Office 2 as well, and have both Mikrotik routers use only an EoIP tunnel that will connect directly without any VPN under it.&lt;br&gt;&#xA;In this case you will need some scripting that will detect your public IP on both sites and update the EoIP interface when the IPs change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I use the second solution to reduce the overhead as much as possible. For security I use IPsec (since EoIP does not encrypt anything on its own). Be careful about IPsec since it uses a lot of CPU (I wouldn't recommend it on a MIPSBE routerboard).&lt;/p&gt;&#xA;" OwnerUserId="1418" LastActivityDate="2015-07-20T11:04:30.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20079" PostTypeId="1" AcceptedAnswerId="20080" CreationDate="2015-07-20T14:51:01.690" Score="1" ViewCount="85" Body="&lt;p&gt;We have a Cisco ASA 5505 box. We are trying to connect to a stock exchange server through a VPN. I set up a site to site VPN from our network to the exchange. All traffic for the 206.200.0.0/16 net goes through the VPN. This appears to be working correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next step is that I have to set up something so that traffic from our internal fixed IP address of 192.168.45.100 appears to the server on the other end to come from a 10.9.100.113 address. We only want this rule to apply when traffic is coming inside from 192.168.45.100 bound for 206.200.0.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this set up as a static NAT? Very new to this Cisco world.&lt;/p&gt;&#xA;" OwnerUserId="16711" LastActivityDate="2015-07-20T16:31:53.570" Title="Need help with unusual NAT rule" Tags="|cisco|cisco-asa|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20080" PostTypeId="2" ParentId="20079" CreationDate="2015-07-20T16:31:53.570" Score="1" Body="&lt;p&gt;What you're asking for is called Policy NAT.  You use an access list to define what traffic gets NATed.   I don't have your configuration, so here is a sample of what you need to do.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended SE-VPN permit ip host 192.168.45.100 206.200.0.0 255.255.0.0&#xA;global (outside) 100 10.9.100.113&#xA;nat (inside) 100 access-list SE-VPN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-07-20T16:31:53.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20081" PostTypeId="1" AcceptedAnswerId="71582" CreationDate="2015-07-20T18:21:22.737" Score="2" ViewCount="225" Body="&lt;p&gt;In traceroute, when a * is recieved, it could mean the router didn't reply due to various reasons- either the router is busy processing other packets or ICMP is blocked. I think few ISPs configure some routers on the Internet to filter ICMP as ICMP traffic is the least priority of all the Internet traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But eventually after a while, I'm able to get to the next hop and the destination- how will that be possible when an intermediate router is busy? Does it mean when a * is received at the source, the source increments the TTL by 1 and sends a trace probe packet and the intermediate router that was busy just decrements the TTL of that packet and forwards the packet to the next hop router?  &lt;/p&gt;&#xA;" OwnerUserId="4094" LastEditorUserId="8499" LastEditDate="2020-12-16T22:00:48.317" LastActivityDate="2020-12-18T07:47:17.170" Title="Traceroute probes" Tags="|router|icmp|traceroute|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20086" PostTypeId="1" AcceptedAnswerId="20088" CreationDate="2015-07-21T01:19:58.677" Score="1" ViewCount="332" Body="&lt;p&gt;I've currently got 15 computers plugged into a switch along with a cable modem providing internet access.  They all receive their DHCP addresses from the cable modem.  I'd like to segregate the computers so they can't get to each other.  I thought I'd be able to do this with VLANs, but I'm new to managed switches and I'm having trouble figuring out the configuration.  I've currently got a Dell Powerconnect 3524.  Any help would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="16720" LastActivityDate="2015-07-21T01:39:39.890" Title="segregating computers on a network" Tags="|vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20087" PostTypeId="2" ParentId="20086" CreationDate="2015-07-21T01:37:21.757" Score="0" Body="&lt;p&gt;This use case is covered by &lt;strong&gt;Private Vlan&lt;/strong&gt;. I only have direct experience with Cisco, however the documentation for your switch, &lt;a href=&quot;http://downloads.dell.com/Manuals/all-products/esuprt_ser_stor_net/esuprt_powerconnect/powerconnect-3524_User%27s%20Guide_en-us.pdf&quot; rel=&quot;nofollow&quot;&gt;Dell™ PowerConnect™ 35xx Systems&#xA;User’s Guide&lt;/a&gt;, shows that this feature is available. Page 297 has the port options, the option that should suit your needs is on page 300:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Private VLAN Edge (PVE)— Indicates the Private VLAN Edge (PVE) group&#xA;  to which the LAG is configured. A port defined as PVE is protected by&#xA;  an uplink, so that it is isolated from other ports within the same&#xA;  VLAN. The uplink must be a GE port.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I said, I don't have direct experience with Dell, so you should lab this.&lt;/p&gt;&#xA;" OwnerUserId="16722" LastActivityDate="2015-07-21T01:37:21.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20088" PostTypeId="2" ParentId="20086" CreationDate="2015-07-21T01:39:39.890" Score="1" Body="&lt;p&gt;What you want is called &quot;port isolation&quot;. Dell PowerConnect switches do this via &lt;em&gt;Private VLAN Edge&lt;/em&gt; (PVE). Under the port configuration (near the bottom) is the selector for the &quot;uplink&quot;. Unfortunately, it has to be a gig port, but that shouldn't be much of an issue. Attach the cablemodem to &quot;g1&quot; and set all ports to PVE uplink of &quot;g1&quot;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-21T01:39:39.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20089" PostTypeId="1" CreationDate="2015-07-21T02:14:44.193" Score="1" ViewCount="317" Body="&lt;p&gt;I would like to know how the below situation is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have four desktop computers and a server connected to a switch.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;comp1 IP: 10.4.2.8&lt;/li&gt;&#xA;&lt;li&gt;comp2 IP: 10.4.11.4&lt;/li&gt;&#xA;&lt;li&gt;comp3 IP: 10.4.24.4&lt;/li&gt;&#xA;&lt;li&gt;comp4 IP: 10.4.2.102&lt;/li&gt;&#xA;&lt;li&gt;server IP: 10.4.2.251&lt;/li&gt;&#xA;&lt;li&gt;server subnet mask: 255.0.0.0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Why is it that the server can ping all four computers? Aren't all the computers on a different subnet from the server (except comp4)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another question is, leaving everything the same, but changing the server's IP to 10.4.24.251, I can ping comp2 and comp3, but not comp1 or comp4. Why is this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="16723" LastEditorUserId="509" LastEditDate="2015-07-21T05:25:18.837" LastActivityDate="2015-11-12T14:23:45.033" Title="How does subnetting work here?" Tags="|subnet|lan|" AnswerCount="3" CommentCount="2" ClosedDate="2015-08-21T21:01:38.850" ContentLicense="CC BY-SA 3.0" />
  <row Id="20092" PostTypeId="2" ParentId="20003" CreationDate="2015-07-21T03:08:11.120" Score="3" Body="&lt;p&gt;It sounds like you're in a bad situation there, and trying to make it worse.  Heck, I'm game - the following should get you halfway there:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;firewall {&#xA;    family ethernet-switching {&#xA;        filter SUBNET-TRAFFIC {&#xA;            term SUBNET-11 {&#xA;                from {&#xA;                    source-address {&#xA;                        192.168.1.0/24;&#xA;                    }&#xA;                }&#xA;                then vlan v11-NET11;&#xA;            }&#xA;            term SUBNET-12 {&#xA;                from {&#xA;                    source-address {&#xA;                        192.168.2.0/24;&#xA;                    }&#xA;                }&#xA;                then vlan v12-NET12;&#xA;            }&#xA;            term SUBNET-13 {&#xA;                from {&#xA;                    source-address {&#xA;                        192.168.3.0/24;&#xA;                    }&#xA;                }&#xA;                then vlan v13-NET13;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                filter {&#xA;                    input SUBNET-TRAFFIC;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming your uplink interface is ge-0/0/1, the above firewall filter should catch &lt;strong&gt;ingress&lt;/strong&gt; traffic and send it to the correct VLAN (remember to move all your attached devices into their correct VLANs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for egress traffic, that won't be so easy.  Junos won't allow you to pop tags for multiple VLANs on a single egress interface (which makes sense since you'd have no idea which VLAN to send ingress traffic).&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-21T03:08:11.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20093" PostTypeId="2" ParentId="20089" CreationDate="2015-07-21T04:20:23.393" Score="1" Body="&lt;p&gt;Question number 1- The reason the server can ping all the other computers is because with that subnet mask (255.0.0.0 or /8) you are saying to the computer that the first octet (thats the the first section of your Ip address octet.octet.octet.octet you know like 10.4.11.4, 10 is in the first octet) is the network part of the address and the rest is just the host part of the address. So to the server they are all on the same network, network 10. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question 2- Well it depends on what subnet mask your other computers have that will determine who they can and can't talk to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a better explanation of subnets here &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/20057/what-does-it-mean-when-we-say-that-a-single-host-can-have-multiple-ip-addresses/20071#20071&quot;&gt;What does it mean when we say that a single host can have multiple IP addresses&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should have just copied and paste. &lt;/p&gt;&#xA;" OwnerUserId="16612" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-07-21T04:20:23.393" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20094" PostTypeId="1" CreationDate="2015-07-21T04:34:03.690" Score="4" ViewCount="1121" Body="&lt;p&gt;I am working with Open Daylight Hydrogen controller and I want to know which routing protocol does it use by default to set the path for a flow. Is it possible to know those paths?&#xA;What about other controllers as well like POX, Floodlight, etc?&lt;/p&gt;&#xA;" OwnerUserId="16689" LastEditorUserId="16689" LastEditDate="2015-07-21T04:39:52.757" LastActivityDate="2018-05-29T11:15:28.020" Title="Default routing protocol used by SDN controllers" Tags="|routing|openflow|sdn|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20095" PostTypeId="1" AcceptedAnswerId="20110" CreationDate="2015-07-21T06:54:32.677" Score="6" ViewCount="8044" Body="&lt;p&gt;This question is fairly basic to those in this community...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Is &lt;code&gt;192.168.X.X/24 (255.255.255.0)&lt;/code&gt; a class C private address?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If so, can someone explain how is it possible to have a subnet mask greater than&#xA;&lt;code&gt;255.255.0.0&lt;/code&gt;? I thought &lt;code&gt;255.255.0.0&lt;/code&gt; was the default/natural mask of a class C private?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have some understanding that CIDR is different from classful. In this example, however, my professor went on to subnet the networks, separating them by &lt;code&gt;192.168.10.0&lt;/code&gt; and &lt;code&gt;192.168.20.0&lt;/code&gt; which made no sense to me considering the original question was written with &lt;code&gt;/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If it is of the private class C range, why would the 3rd octet be usable?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;While I know this question is outdated, I'm studying for Net+/CCNA so I need to know, unfortunately.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="16726" LastEditorUserId="16726" LastEditDate="2015-07-21T07:24:59.987" LastActivityDate="2019-04-17T18:52:11.860" Title="Does a subnet mask indicate the class of a Private IP?" Tags="|subnet|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20096" PostTypeId="2" ParentId="20095" CreationDate="2015-07-21T08:11:34.747" Score="0" Body="&lt;p&gt;See &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/19840&quot;&gt;questions/19840&lt;/a&gt; for CIDR discussion. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is 192.168.X.X/24 (255.255.255.0) a class C private address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Yes that is private address space, and Yes a mask of /24 is called a class C mask.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;explain how is it possible to have a subnet mask greater than&#xA;  255.255.0.0?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Classfull subnetting is not used any more, although a lot of people still refer to a 255.255.255.0 mask as a ClassC subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With CIDR taking any network with a mask /x you can subdivide it with a mask /y as long as y&gt;x up to /32 the host mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking your example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.X.X/24 can not be sub divided into more /24 networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.X.X/24 does indicate that you are talking about one of 256 possible networks, 192.168.0-255.x/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network 192.168.0.0/16 can be sub-netted into 192.168.10.0/24 and 192.168.20.0/24&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-07-21T18:45:13.433" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="20097" PostTypeId="1" CreationDate="2015-07-21T08:54:45.347" Score="3" ViewCount="1163" Body="&lt;p&gt;has anyone on here been able to successfully create a GRE tunnel or any kinda of tunnelling mechanism between an Alcatel router and a Cisco router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been struggling with this and for a while and I can't seem to figure it out. Any help would be much appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here is what I have so far:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried configuring a GRE tunnel between the SROS1 and R1 device. I've attached relevant config and outputs to this post. I can show more if needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created an epipe between the devices but because the epipe is basic Layer 2,there's actually not an argument to create an IP address that'll match with the Ip address of the GRE tunnel on the Cisco device,so I tried creating an IES(config is also in the attached notepad file)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Xpzlt.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xpzlt.jpg&quot; alt=&quot;pic1&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/v1YJx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v1YJx.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="16727" LastEditorUserId="16727" LastEditDate="2015-07-22T11:56:17.230" LastActivityDate="2019-01-31T22:49:31.500" Title="GRE tunnel(or even any tunnelling technique) between Alcatel 7750 and a Cisco Router" Tags="|gre|l2tp|alcatel-lucent-7750|" AnswerCount="0" CommentCount="4" ClosedDate="2019-12-19T09:07:15.020" ContentLicense="CC BY-SA 3.0" />
  <row Id="20100" PostTypeId="1" CreationDate="2015-07-21T11:18:14.077" Score="1" ViewCount="314" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I know that NAT is used to map Private IP addresses to Public IP addresses. But can we also map Public IP addresses to Public IP addresses? And does this serve any useful purpose?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can the Router's WAN Port have Private IP when we use Double NAT?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can we have Multi Level NAT? And can this, at least in theory, solve the problem of IP address exhaustion?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="16698" LastActivityDate="2015-07-21T14:12:29.793" Title="Some questions about NAT" Tags="|router|ipv4|nat|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20102" PostTypeId="2" ParentId="20100" CreationDate="2015-07-21T13:14:48.937" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, you can NAT any IP to any IP (as long as you own the IP or it's a private block).  I've NAT public to public before to deal with weird asymmetric routing issues as an alternative to policy routing.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, this type of scenario (where the router has private IPs but NATs public ones) typically occurs in large enterprise and campus networks, where you route a public IP block to a router and the router NATs these blocks without having an IP address on them.  It works, but it's very confusing for people unfamiliar with it or if it's poorly documented.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, carrier-grade NAT (CGNAT) but it will break applications which depend on consistent source port mappings as well as make it extremely difficult to implement destination PAT.  No, this won't solve IP exhaustion, and it will make everyone's (developers and infrastructure) life difficult.  IPv6 is the only answer to IP address exhaustion.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="16733" LastActivityDate="2015-07-21T13:14:48.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20104" PostTypeId="1" AcceptedAnswerId="20115" CreationDate="2015-07-21T13:51:20.717" Score="7" ViewCount="13743" Body="&lt;p&gt;I am using a Traffic Generator for setting up a TCP connection that should pass a Cisco ASA firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My topology looks like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                     +------------------+                      &#xA;                     |  CISCO ASA       |                      &#xA;+------------+       |                  |                      &#xA;|  Client    +-------+Outside           |                      &#xA;|  10.1.202.1|       |10.1.202.254      |                      &#xA;|            |       |                  |        +------------+&#xA;+------------+       |            Inside|        |Server      |&#xA;                     |      10.1.102.254+--------+10.1.102.19 |&#xA;                     |                  |        |            |&#xA;                     +------------------+        +------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The connection should be established from one host in the external network (10.1.202.1/24) to a server in the internal network (10.1.102.19/24).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see in Wireshark that the &lt;code&gt;SYN&lt;/code&gt; passes the firewall (10.1.(1/2)02.254), the SYN-ACK does not pass and is dropped (see captures: &lt;a href=&quot;https://www.cloudshark.org/captures/7ca7c51b6456&quot; rel=&quot;nofollow&quot;&gt;inside-interface&lt;/a&gt; and the &lt;a href=&quot;https://www.cloudshark.org/captures/0b9a65f1db9f&quot; rel=&quot;nofollow&quot;&gt;outside-interface&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;code&gt;show asp drop&lt;/code&gt; I am informed that frames are dropped due to the following reason:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TCP failed 3 way handshake (tcp-3whs-failed)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am not using ARP, but use the MAC address of the firewall interface, which is the default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I create the &lt;code&gt;SYN&lt;/code&gt;, &lt;code&gt;SYN-ACK&lt;/code&gt; and &lt;code&gt;ACK&lt;/code&gt; like the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SYN:&lt;/strong&gt; (Client (outside) to server (inside))&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**Ethernet**&#xA;Destination MAC: &amp;lt;Mac Address of the Firewall-Interface&amp;gt;&#xA;Source MAC: &amp;lt;Mac Address of the Sending Device-Interface&amp;gt;&#xA;&#xA;**IP**&#xA;Source IP: 10.1.202.1&#xA;Destination IP: 10.1.102.19&#xA;Default Gateway: 10.1.202.254&#xA;&#xA;**TCP**&#xA;Source Port: 9000&#xA;Destination Port: 8000&#xA;Sequence number: 0&#xA;Acknowledgement number: 0&#xA;Synchronize: 1&#xA;Acknowledgement: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SYN-ACK:&lt;/strong&gt; (Server (inside) to client (outside)) &lt;strong&gt;(this does not pass the firewall)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**Ethernet**&#xA;Destination MAC: &amp;lt;Mac Address of the Firewall-Interface&amp;gt;&#xA;Source MAC: &amp;lt;Mac Address of the Sending Device-Interface&amp;gt;&#xA;&#xA;**IP**&#xA;Source IP: 10.1.102.19&#xA;Destination IP: 10.1.202.1&#xA;Default Gateway: 10.1.102.254&#xA;&#xA;**TCP**&#xA;Source Port: 8000&#xA;Destination Port: 9000&#xA;Sequence number: 0&#xA;Acknowledgement number: 1&#xA;Synchronize: 1&#xA;Acknowledgement: 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ACK:&lt;/strong&gt; (Client (outside) to server (inside))&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**Ethernet**&#xA;Destination MAC: &amp;lt;Mac Address of the Firewall-Interface&amp;gt;&#xA;Source MAC: &amp;lt;Mac Address of the Sending Device-Interface&amp;gt;&#xA;&#xA;**IP**&#xA;Source IP: 10.1.202.1&#xA;Destination IP: 10.1.102.19&#xA;Default Gateway: 10.1.202.254&#xA;&#xA;**TCP**&#xA;Source Port: 9000&#xA;Destination Port: 8000&#xA;Sequence number: 1&#xA;Acknowledgement number: 1&#xA;Synchronize: 0&#xA;Acknowledgement: 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Furthermore, my topology is like following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The traffic generator client (outside network) is connected to a switch on which a VLAN is added. The switch is connected to the outside firewall interface.&#xA;On the inside network, traffic generator is connected to the switch where VLAN tags are added and the switch is connected to the inside interface of the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone tell me why the ASA drops the &lt;code&gt;SYN-ACK&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;As suggested by Ron Trunk, I disabled the randomization of sequence numbers by using:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;random-sequence-number disable&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Added capture of the &lt;a href=&quot;https://www.cloudshark.org/captures/7ca7c51b6456&quot; rel=&quot;nofollow&quot;&gt;inside-interface&lt;/a&gt; and the &lt;a href=&quot;https://www.cloudshark.org/captures/0b9a65f1db9f&quot; rel=&quot;nofollow&quot;&gt;outside-interface&lt;/a&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Updated the capture files&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16734" LastEditorUserId="16734" LastEditDate="2015-07-30T12:13:02.750" LastActivityDate="2020-08-25T09:48:39.920" Title="TCP Handshake fails on Cisco ASA" Tags="|cisco-asa|firewall|tcp|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="20105" PostTypeId="1" AcceptedAnswerId="20107" CreationDate="2015-07-21T13:59:41.523" Score="2" ViewCount="142" Body="&lt;p&gt;I want to set up my Raspberry pi as a proxy server for one pc on my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the scenario: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a virgin media superhub (UK), I want any device that can connect to this with the wifi to have a normal connection not through the proxy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the hub, I have a switch which extends a wired connection to one pc running ubuntu. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the user of this pc to have root access and be able to change anything on their computer, but I want any web connection to go through a raspberry pi. This raspbery pi would then block access to certain websites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Complications. The pc is used as a webserver and I want to make sure people can access that computer through ssh and things like teamviewer from external sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I physically set up the network? I need to make sure that the ubuntu pc cant just change a setting to directly access the internet through the router. So I am assuming that just plugging the pi into the switch might not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the network is physically set up, what would be the software configuration to enable this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize this will not be completely secure because the user of the pc could use a vpn to tunnel their connection past the proxy, but I want to ignore this possibility at the moment.&lt;/p&gt;&#xA;" OwnerUserId="16735" LastActivityDate="2015-07-21T14:22:19.237" Title="Network layout and configuration" Tags="|proxy|" AnswerCount="2" CommentCount="3" ClosedDate="2019-01-29T05:38:45.283" ContentLicense="CC BY-SA 3.0" />
  <row Id="20106" PostTypeId="2" ParentId="20100" CreationDate="2015-07-21T14:12:29.793" Score="1" Body="&lt;p&gt;&quot;And does this serve any useful purpose?&quot;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, if you bought 3 static ip's from your IP, you could use 1 for a router to do NAT and act like a gateway to the internet for most of your network. You could use the other 2 to give them to computers to make them public on the internet. Like a web server for example.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This isn't double nat, but yes you can assign an IP to the device so you can access it's configuration options.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes ISP could use a much smaller portion of the Ip's they currently use by giving out private address's and using CGNAT. Like Quailman pointed out, you wouldn't be able to run any services from inside your network to the Internet, it would however help with IP exhaustion.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="16612" LastActivityDate="2015-07-21T14:12:29.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20107" PostTypeId="2" ParentId="20105" CreationDate="2015-07-21T14:19:34.380" Score="1" Body="&lt;p&gt;Go to your edge-router/firewall. Block the Ubuntu system from having access to TCP 80 and 443. Permit the proxy server to access TCP 80 and 443. Then the Ubuntu system will only work when it access the proxy. The admin can of course change the config, but then they get NO web access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setup up the rest (access to the web server, sshd etc on the Ubuntu) system as usual for exposing internal services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you can block outgoing VPN tunneling on your edge to stop that too.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2015-07-21T14:19:34.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20108" PostTypeId="2" ParentId="20105" CreationDate="2015-07-21T14:22:19.237" Score="1" Body="&lt;p&gt;If all your trying to do is block certain websites you can do that much easier with a Host file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend a pc instead of a pi but here is the gist of things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take your pi and get a wifi card. Connect the pi to the wifi and make sure it has internetz. Then attach your ubuntu pc to the pi using a ethernet cable. Install and setup a transparent proxy on your pi. That's about it really.&lt;/p&gt;&#xA;" OwnerUserId="16612" LastActivityDate="2015-07-21T14:22:19.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20110" PostTypeId="2" ParentId="20095" CreationDate="2015-07-21T14:48:45.287" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is 192.168.X.X/24 (255.255.255.0) a class C private address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You got it and you usually see it like this because of it being the default on so many home routers.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If so, can someone explain how is it possible to have a subnet mask&#xA;  greater than 255.255.0.0? I thought 255.255.0.0 was the&#xA;  default/natural mask of a class C private?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Greater as in 255.0.0.0 or 255.255.255.0? It's possible because you have 4 octet's in a Ip4 address. Which gives you 4 octets to mask. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In this example, however, my professor went on to subnet the networks,&#xA;  separating them by 192.168.10.0 and 192.168.20.0 which made no sense&#xA;  to me considering the original question was written with /24.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ahh this is where you got confused. A subnet mask will tell you what part of an ip address is the network part. So if you have 192.168.XXX.XXX /16 or 255.255.0.0 we can see that only the first 2 octets are part of the network address and the last 2 octets are part of the host address. so any Ip's that start with 192.168 are now part of the same network and anything in the third octet is only used to identify a host. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if you take 192.168.10.xxx and 192.168.20.xxx /16 they are in the same network (192.168.xxx.xxx) if you change the mask to /24 (255.255.255.0) the first 3 octet's are now Network's and have to match. So 192.168.10.xxx and 192.168.20.xxx 10 and 20 don't match, they are different networks, and only the last octet is used to identify host on the network (255.255.255.0 255 is for networks, 0 is for host), and this gets much more advanced so get a good understanding of it now while you can. For instance you can use a ACL to route traffic to one host only. say 192.168.10.123 all you have to do is set the netmask to 255.255.255.255 and it will make sure it only goes to the host that matchs ever number in every octet.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If it is of the private class C range, why would the 3rd octet be&#xA;  usable?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now you know it's because of the netmask /24 =)&lt;/p&gt;&#xA;" OwnerUserId="16612" LastEditorUserId="2142" LastEditDate="2019-04-17T18:52:11.860" LastActivityDate="2019-04-17T18:52:11.860" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20111" PostTypeId="2" ParentId="20061" CreationDate="2015-07-21T15:10:34.493" Score="1" Body="&lt;p&gt;Enabling the invalid SPI recovery command only works with static crypto maps (and VTI) where the VPN peer is defined. It doesn't work with dynamic crypto maps or mGRE with dynamic NHRP (DMVPN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the problem persists, run ISAKMP and IPsec debug at each VPN peer and examine the router logs for specifics. Consider Cisco Embedded Event Manager (EEM) as well for troubleshooting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note as well for routing issues: there could be multiple instances of the same error message for the same VPN flow. The convergence time as a result is affected by SA expire setting from the source. In addition the Dead Peer Detection could affect routing convergence and VPN connectivity.&lt;/p&gt;&#xA;" OwnerUserId="15593" LastEditorUserId="8499" LastEditDate="2016-03-28T22:22:25.440" LastActivityDate="2016-03-28T22:22:25.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20112" PostTypeId="1" AcceptedAnswerId="20116" CreationDate="2015-07-21T15:13:50.923" Score="6" ViewCount="4861" Body="&lt;p&gt;I'm using SNMP to poll switches for data. I'm trying to retrieve the MAC address table (&lt;code&gt;sho mac address-table&lt;/code&gt;) to view what devices are connected to various ports but I seem to have encountered a problem. In all other posts, questions, and guides the general consensus is to use &lt;code&gt;BRIDGE-MIB::dot1dTpFdbTable&lt;/code&gt; or another within that MIB. For whatever reason I cannot use this OID on our equipment. It always spits back &amp;quot;No Such Object available on this agent at this OID.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;Requesting the parent object &lt;code&gt;snmpbulkwalk BRIDGE-MIB::dot1dBridge&lt;/code&gt; appears to give settings and misc. data but no MAC entries are shown. It's the same across all of our equipment such as C3750, C3850, and C4506. Here's some sample output (C3560E, iOS ver. c3560e-universalk9-mz.122-55.SE3):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;BRIDGE-MIB::dot1dBaseBridgeAddress.0 = STRING: 30:f7:d:4b:c8:0&#xA;BRIDGE-MIB::dot1dBaseNumPorts.0 = INTEGER: 6 ports&#xA;BRIDGE-MIB::dot1dBaseType.0 = INTEGER: transparent-only(2)&#xA;BRIDGE-MIB::dot1dBasePort.25 = INTEGER: 25&#xA;BRIDGE-MIB::dot1dBasePort.26 = INTEGER: 26&#xA;BRIDGE-MIB::dot1dBasePort.27 = INTEGER: 27&#xA;BRIDGE-MIB::dot1dBasePort.28 = INTEGER: 28&#xA;BRIDGE-MIB::dot1dBasePort.29 = INTEGER: 29&#xA;BRIDGE-MIB::dot1dBasePort.30 = INTEGER: 30&#xA;BRIDGE-MIB::dot1dBasePortIfIndex.25 = INTEGER: 10125&#xA;BRIDGE-MIB::dot1dBasePortIfIndex.26 = INTEGER: 10126&#xA;BRIDGE-MIB::dot1dBasePortIfIndex.27 = INTEGER: 10127&#xA;BRIDGE-MIB::dot1dBasePortIfIndex.28 = INTEGER: 10128&#xA;BRIDGE-MIB::dot1dBasePortIfIndex.29 = INTEGER: 10201&#xA;BRIDGE-MIB::dot1dBasePortIfIndex.30 = INTEGER: 10202&#xA;BRIDGE-MIB::dot1dBasePortCircuit.25 = OID: SNMPv2-SMI::zeroDotZero&#xA;BRIDGE-MIB::dot1dBasePortCircuit.26 = OID: SNMPv2-SMI::zeroDotZero&#xA;BRIDGE-MIB::dot1dBasePortCircuit.27 = OID: SNMPv2-SMI::zeroDotZero    &#xA;BRIDGE-MIB::dot1dBasePortCircuit.28 = OID: SNMPv2-SMI::zeroDotZero&#xA;BRIDGE-MIB::dot1dBasePortCircuit.29 = OID: SNMPv2-SMI::zeroDotZero&#xA;BRIDGE-MIB::dot1dBasePortCircuit.30 = OID: SNMPv2-SMI::zeroDotZero&#xA;BRIDGE-MIB::dot1dBasePortDelayExceededDiscards.25 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortDelayExceededDiscards.26 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortDelayExceededDiscards.27 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortDelayExceededDiscards.28 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortDelayExceededDiscards.29 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortDelayExceededDiscards.30 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortMtuExceededDiscards.25 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortMtuExceededDiscards.26 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortMtuExceededDiscards.27 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortMtuExceededDiscards.28 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortMtuExceededDiscards.29 = Counter32: 0&#xA;BRIDGE-MIB::dot1dBasePortMtuExceededDiscards.30 = Counter32: 0&#xA;BRIDGE-MIB::dot1dTpLearnedEntryDiscards.0 = Counter32: 0&#xA;BRIDGE-MIB::dot1dTpAgingTime.0 = INTEGER: 300 seconds&#xA;BRIDGE-MIB::dot1dTpPort.25 = INTEGER: 25 BRIDGE-MIB::dot1dTpPort.26 =&#xA;    INTEGER: 26 BRIDGE-MIB::dot1dTpPort.27 = INTEGER: 27&#xA;BRIDGE-MIB::dot1dTpPort.28 = INTEGER: 28 BRIDGE-MIB::dot1dTpPort.29 =&#xA;    INTEGER: 29 BRIDGE-MIB::dot1dTpPort.30 = INTEGER: 30&#xA;BRIDGE-MIB::dot1dTpPortMaxInfo.25 = INTEGER: 1510 bytes&#xA;BRIDGE-MIB::dot1dTpPortMaxInfo.26 = INTEGER: 1510 bytes&#xA;BRIDGE-MIB::dot1dTpPortMaxInfo.27 = INTEGER: 1510 bytes&#xA;BRIDGE-MIB::dot1dTpPortMaxInfo.28 = INTEGER: 1510 bytes&#xA;BRIDGE-MIB::dot1dTpPortMaxInfo.29 = INTEGER: 1510 bytes&#xA;BRIDGE-MIB::dot1dTpPortMaxInfo.30 = INTEGER: 1510 bytes&#xA;BRIDGE-MIB::dot1dTpPortInFrames.25 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInFrames.26 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInFrames.27 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInFrames.28 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInFrames.29 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInFrames.30 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortOutFrames.25 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortOutFrames.26 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortOutFrames.27 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortOutFrames.28 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortOutFrames.29 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortOutFrames.30 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInDiscards.25 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInDiscards.26 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInDiscards.27 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInDiscards.28 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInDiscards.29 = Counter32: 0 frames&#xA;BRIDGE-MIB::dot1dTpPortInDiscards.30 = Counter32: 0 frames&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I know for a fact that the switch is correctly collecting MAC addresses because via CLI it reports back with this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;All    0100.0ccc.cccc    STATIC      CPU&#xA;All    0100.0ccc.cccd    STATIC      CPU&#xA;All    0180.c200.0000    STATIC      CPU&#xA;All    0180.c200.0001    STATIC      CPU&#xA;All    0180.c200.0002    STATIC      CPU&#xA;All    0180.c200.0003    STATIC      CPU&#xA;All    0180.c200.0004    STATIC      CPU&#xA;All    0180.c200.0005    STATIC      CPU&#xA;All    0180.c200.0006    STATIC      CPU&#xA;All    0180.c200.0007    STATIC      CPU&#xA;All    0180.c200.0008    STATIC      CPU&#xA;All    0180.c200.0009    STATIC      CPU&#xA;All    0180.c200.000a    STATIC      CPU&#xA;All    0180.c200.000b    STATIC      CPU&#xA;All    0180.c200.000c    STATIC      CPU&#xA;All    0180.c200.000d    STATIC      CPU&#xA;All    0180.c200.000e    STATIC      CPU&#xA;All    0180.c200.000f    STATIC      CPU&#xA;All    0180.c200.0010    STATIC      CPU&#xA;All    ffff.ffff.ffff    STATIC      CPU&#xA;100    001e.4a92.5c59    DYNAMIC     Gi0/24&#xA;100    0024.c33c.719d    DYNAMIC     Gi0/24&#xA;100    0024.c3a8.9c00    DYNAMIC     Gi0/24&#xA;100    b000.b4bf.9798    DYNAMIC     Gi0/24&#xA;200    0024.c33c.719d    DYNAMIC     Gi0/24&#xA;200    0024.c3a8.9c00    DYNAMIC     Gi0/24&#xA;500    0080.7752.bbb6    DYNAMIC     Gi0/1&#xA;200    2c27.d720.3e4d    DYNAMIC     Gi0/24&#xA;200    3417.eb98.f48e    DYNAMIC     Gi0/24&#xA;200    b8a3.8607.a6ef    DYNAMIC     Gi0/24&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Is there a setting within the configs that I need to add in order to make the data available? Has this OID been deprecated and no longer available?&lt;/p&gt;&#xA;&lt;hr&gt;&#xA;&lt;h1&gt; Solution &lt;/h1&gt;&#xA;&lt;p&gt;There was a minor detail omitted in one of the SNMP implementations displayed in other locations. I didn't recognize it but it's likely because I'm either not familiar enough with SNMP or because of how subtle it is.&lt;/p&gt;&#xA;&lt;p&gt;When polling for the &lt;code&gt;BRIDGE-MIB::dot1dTpFdbTable&lt;/code&gt; OID you must append to the community string which VLAN you're looking for. I had not noticed this in the solution because, well, normally said community strings are generic.&lt;/p&gt;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;snmpbulkwalk -v2c -cpublic hostname BRIDGE-MIB::dot1dTpFdbTable&lt;/code&gt; will return with a &amp;quot;No Such Instance currently exists at this OID&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;snmpbulkwalk -v2c -cpublic@vlan hostname BRIDGE-MIB::dot1dTpFdbTable&lt;/code&gt; will return all MAC addresses within this VLAN. Note the added &lt;strong&gt;@vlan&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14048" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-07-21T18:00:02.790" Title="Unable to fetch Mac-Address table via SNMP. Is there a command/setting I need to enable?" Tags="|snmp|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20114" PostTypeId="2" ParentId="4974" CreationDate="2015-07-21T15:50:20.217" Score="2" Body="&lt;p&gt;end to end is a common term used in the context of network performance, qos, security and network management. consider as well the endpoint is often a server however now includes video and voip phones, wireless and any device with TCP/IP connectivity. so the question gets more complex as well when considering network latency and what is end to end. is it to the primary web server or to the backend cloud database servers ?&lt;/p&gt;&#xA;" OwnerUserId="15593" LastActivityDate="2015-07-21T15:50:20.217" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20115" PostTypeId="2" ParentId="20104" CreationDate="2015-07-21T15:59:21.080" Score="3" Body="&lt;p&gt;By default, the ASA randomizes the sequence numbers in the handshake (to prevent session hijacks).  So your sequence numbers don't actually match.   You can turn off that feature.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;random-sequence-number disable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-07-21T15:59:21.080" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20116" PostTypeId="2" ParentId="20112" CreationDate="2015-07-21T16:21:14.547" Score="3" Body="&lt;p&gt;Mike answered this pretty well here &gt;&gt; &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2900/using-snmp-to-retrieve-the-arp-and-mac-address-tables-from-a-switch&quot;&gt;Using SNMP to retrieve the ARP and mac-address tables from a switch&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please have a read of that and if you still need help get back to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also some Cisco documentation which points to a different OID tree which could be of some help &gt;&gt; &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/13492-cam-snmp.html#mibvaroid&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/13492-cam-snmp.html#mibvaroid&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="168" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-07-21T16:21:14.547" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20117" PostTypeId="2" ParentId="20061" CreationDate="2015-07-21T16:46:03.723" Score="1" Body="&lt;p&gt;What happens if you manually clear the SPI from the CLI on the devices that are experiencing the invalid SPI? Do the SAs recover automatically then?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clear crypto sa entry 1.1.1.2 esp $spi&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Replace $spi with the SPI value found from &lt;code&gt;show crypto ipsec sa&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My hunch is that the SAs are getting out of sync but have lengthy default timers (isakmp is 24h by default, ipsec sa is 8h by default) thus they won't clear unless manual intervention is executed before those default timers expire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please post your full config and also provide IPSec outputs &lt;code&gt;show crypto sa&lt;/code&gt;, etc.&lt;/p&gt;&#xA;" OwnerUserId="168" LastEditorUserId="8499" LastEditDate="2016-03-28T22:24:53.390" LastActivityDate="2016-03-28T22:24:53.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20118" PostTypeId="2" ParentId="20094" CreationDate="2015-07-21T18:20:30.720" Score="-1" Body="&lt;p&gt;An SDN controller will utilize the &lt;a href=&quot;https://www.opennetworking.org/sdn-resources/openflow&quot; rel=&quot;nofollow&quot;&gt;openflow&lt;/a&gt; protocol to communicate with networking devices, whether they are physical or virtual.  Openflow is not a routing protocol.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-21T18:20:30.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20119" PostTypeId="2" ParentId="20094" CreationDate="2015-07-21T20:47:15.460" Score="6" Body="&lt;p&gt;No routing protocol is used.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of routing protocols is to tell other routers which paths are available, so the other routers can make a good forwarding decision.  In SDN, the controller has a complete view of the network -- it already knows all the paths.  The controller calculates the best path for a particular kind of data, and then uses a protocol like OpenFlow to tell the network devices how to forward data.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-07-21T20:47:15.460" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20123" PostTypeId="1" AcceptedAnswerId="20124" CreationDate="2015-07-22T01:54:41.003" Score="2" ViewCount="3653" Body="&lt;p&gt;As part of the push to conserve internet addresses, my ISP again asked me to change the IP address of my host - an ASA 5505.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is: how do I, without out-of-band access do this without locking myself out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bearing in mind that the change entails, changing the external IP of the device AND changing the default route?&lt;/p&gt;&#xA;" OwnerUserId="16740" LastActivityDate="2015-07-22T02:08:08.953" Title="Changing the IP address of a Cisco ASA 5505 Remotely" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20124" PostTypeId="2" ParentId="20123" CreationDate="2015-07-22T02:08:08.953" Score="4" Body="&lt;p&gt;I am posting this on stack exchange as I was unable to find an answer on the 'net:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where the new subnet is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;A.B.C.0&lt;/code&gt; (gateway=&lt;code&gt;A.B.C.1&lt;/code&gt;, host ip=&lt;code&gt;A.B.C.2&lt;/code&gt;) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and the old subnet is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;P.Q.R.0&lt;/code&gt; (gateway=&lt;code&gt;P.Q.R.1&lt;/code&gt;, host ip=&lt;code&gt;P.Q.R.2&lt;/code&gt;).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. Save the existing configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy running-config startup-config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. Set a reload timeout (for 10 minutes) - in case you do lock yourself out.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;reload in 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Add a same-priority default route alongside the existing one:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 A.B.C.1 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;4. Now the moment of truth, change the outside address:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan2&#xA;  ip address A.B.C.2 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;at this point, your connection should drop, and you should reconnect to the new address... if not, wait for the reload, and try again :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;5. Clear up the old configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip route 0.0.0.0 0.0.0.0 P.Q.R.1&#xA;reload cancel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;6. Save the new configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy running-config startup-config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16740" LastActivityDate="2015-07-22T02:08:08.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20125" PostTypeId="2" ParentId="20095" CreationDate="2015-07-22T02:49:31.357" Score="2" Body="&lt;p&gt;Levi and Pieter both have the right idea. The Internet Engineering Task Force (IETF) discusses IPv4 Private Address Space here:&#xA;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc1918&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;The Internet Assigned Numbers Authority (IANA) has reserved the&#xA;following three blocks of the IP address space for private internets:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; 10.0.0.0        -   10.255.255.255  (10/8 prefix)&#xA; 172.16.0.0      -   172.31.255.255  (172.16/12 prefix)&#xA; 192.168.0.0     -   192.168.255.255 (192.168/16 prefix)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;We will refer to the first block as &amp;quot;24-bit block&amp;quot;, the second as&#xA;&amp;quot;20-bit block&amp;quot;, and to the third as &amp;quot;16-bit&amp;quot; block. Note that (in&#xA;pre-CIDR notation) the first block is nothing but a single class A&#xA;network number, while the second block is a set of 16 contiguous&#xA;class B network numbers, and third block is a set of 256 contiguous&#xA;class C network numbers.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;So, with a network of 192.168.0.0/24, you are specifying a different network than 192.168.10.0/24 or 192.168.20.0/24. If the network is 192.168.0.0/16 as rfc1918 specifies, all three of these addresses would be on the same network.&lt;/p&gt;&#xA;" OwnerUserId="16741" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-07-22T02:49:31.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20126" PostTypeId="2" ParentId="20089" CreationDate="2015-07-22T03:09:03.087" Score="0" Body="&lt;p&gt;You will need to change the subnet mask to 255.255.255.128 on your server in order to be on a different network than the other listed computers, although it also matters what networks your other listed computers are on as determined by their IP addresses and subnet masks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the subnet mask is 255.0.0.0 your network is 10.0.0.0/8, which includes all of the listed computers. If your subnet mask were 255.255.0.0, you would also be on the same network as all of the other computers as the network would be 10.4.0.0. Likewise, if your server subnet mask were 255.255.255.0, you would be on the same network as comp1 and comp4, which is 10.4.2.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to your second question, you must have a different subnet mask on comp1 and comp4 than you have on your server.&lt;/p&gt;&#xA;" OwnerUserId="16741" LastActivityDate="2015-07-22T03:09:03.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20128" PostTypeId="1" CreationDate="2015-07-22T08:08:47.653" Score="1" ViewCount="908" Body="&lt;p&gt;I am currently migrating from an best-effort line to a dedicated line and I have decided to change the hardware used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The access to the ISP's line will be through a cat5e cable, which is connected to a Mikrotik RouterBoard. No settings was made on this piece of hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have purchased a UniFi Security Gateway as I was told that the ISP will not provide a router, a UniFi Switch for switching and about 10 wireless APs to provide internet access to guest and employees. The employees network will have a different SSID using WPA-Enterprise whereas the guest network will use password authentication through a guest server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have initially configured the network within the same subnet using UniFi Controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Initial Configuration:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Qm16o.jpg&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I wish to configure the network into this:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/y9Kin.jpg&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: The UniFI Security Gateway has been removed due to the wider capabilities of the Mikrotik RouterBoard&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Employees Network (VLAN 80):&#xA;10.88.80.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Guest Network (VLAN 90):&#xA;10.88.90.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the problem comes. The portal server is at VLAN 80, in which guests (VLAN 90) needs to authenticate against in order to access the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, how can I ensure that the Mikrotik allows my guests to access my server at certain ports (through inter subnets) and how do I set the users connected by Ethernet and RADIUS to use my server as a DNS and DHCP? And is there a way to log the router's traffic?&lt;/p&gt;&#xA;" OwnerUserId="16747" LastEditorUserId="8499" LastEditDate="2018-02-14T16:44:09.463" LastActivityDate="2018-02-14T16:44:09.463" Title="Inter-Subnet and VLANs" Tags="|router|vlan|subnet|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-09T23:50:39.033" ContentLicense="CC BY-SA 3.0" />
  <row Id="20133" PostTypeId="1" CreationDate="2015-07-22T12:40:48.837" Score="3" ViewCount="253" Body="&lt;p&gt;Dell 6224 is L3 switch: Does L3 switch have unique MAC address for different port?&lt;/p&gt;&#xA;" OwnerUserId="2716" LastActivityDate="2016-06-02T18:31:16.790" Title="Unique MAC address in L3 switch" Tags="|dell|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20136" PostTypeId="2" ParentId="19982" CreationDate="2015-07-22T15:32:37.137" Score="5" Body="&lt;p&gt;Little late to the website so you may have moved on but, We use Solarwinds. Under the edit node properties there is a check box for 64-bit counters. It is probably not checked. Seen the problem you've described for some non-Cisco products in Solarwinds. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also from the manual for some manufacturers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the added node supports 64-bit counters and you want to use them, check Allow 64-bit counters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Orion support the use of 64-bit counters. However, these high capacity counters can exhibit erratic behavior depending on manufacturer implementation. If you notice peculiar results when using these counters, use the Node Detail View to disable the use of 64-bit counters for the device and contact the hardware manufacturer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some vendors we have had to submit the mibs to Solarwinds support and they compile them into the mibs database that you can download and import into Orion.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-07-22T15:32:37.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20138" PostTypeId="1" CreationDate="2015-07-22T16:34:56.397" Score="10" ViewCount="1124" Body="&lt;p&gt;I have a bunch of Cisco routers and switches in our buildings. Basically, every building has one router and one or more switches. I use just two VLANs for each building: VLAN1 is the data VLAN (native as well) and VLAN200 is the voice VLAN. Each switch’s VLAN is “connected” to a subinterface on its respective building’s router (802.1q), and on every switch, the port connected to the router’s subinterface is configured as a trunk port, so we have two VLANs adjacency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is, I noticed, switches with  IOS 12.2, can “choose” the correct VLAN interface when I try to reach (ping) a remote subnet. All switches have &lt;code&gt;192.168.X.0/24&lt;/code&gt; for data and &lt;code&gt;10.10.X.0 /24&lt;/code&gt; for voice, so if I try to ping &lt;code&gt;192.168.1.2&lt;/code&gt;, the switch uses the VLAN interface (&lt;code&gt;192.168.20.2&lt;/code&gt;) as its source ping’s interface, and if I try to ping my Call Manager (&lt;code&gt;10.10.254.1&lt;/code&gt;), the switch uses VLAN interface &lt;code&gt;10.10.248.2&lt;/code&gt; as its source. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches with IOS 15 (new ones), with the same configuration and connected to the same kind of routers (like switches with IOS 12.2), don’t use the correct VLAN interface. They always use the voice VLAN interface (200 in my case), so I have to choose the source interface if I want to expect a reply from the remote device (of course depending on the remote destination subnet). Strange behavior since I am using basically the same configuration but in different places. New switches use “dual-ipv4-and-ipv6” template and the old ones (12.2) use “desktop default” template. Computers behind the switches do not have any connectivity issue because the router routes the packets to the correct destination, but why the switches do not?  Any idea?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure if my switches support routing, below the result of the command &quot;sh sdm prefer&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  default             Default bias&#xA;  dual-ipv4-and-ipv6  Support both IPv4 and IPv6&#xA;  lanbase-routing     Supports both IPv4 and IPv6 Static Routing&#xA;  qos                 QoS bias&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the switch configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 9403 bytes&#xA;!&#xA;! Last configuration change at 00:09:28 UTC Mon Jun 27 2011 by admin&#xA;! NVRAM config last updated at 23:32:34 UTC Sun Jun 26 2011 by admin&#xA;!&#xA;version 15.0&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 *Removed*&#xA;!&#xA;username admin privilege 15 secret 5 *Removed*&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;!&#xA;!&#xA;ip domain-name lvdomain.local&#xA;ip name-server 192.168.0.43&#xA;ip name-server 192.168.0.45&#xA;!&#xA;mls qos map cos-dscp 0 8 16 24 32 46 48 56&#xA;mls qos srr-queue input bandwidth 70 30&#xA;mls qos srr-queue input threshold 1 80 90&#xA;mls qos srr-queue input priority-queue 2 bandwidth 30&#xA;mls qos srr-queue input cos-map queue 1 threshold 2 3&#xA;mls qos srr-queue input cos-map queue 1 threshold 3 6 7&#xA;mls qos srr-queue input cos-map queue 2 threshold 1 4&#xA;mls qos srr-queue input dscp-map queue 1 threshold 2 24&#xA;mls qos srr-queue input dscp-map queue 1 threshold 3 48 49 50 51 52 53 54 55&#xA;mls qos srr-queue input dscp-map queue 1 threshold 3 56 57 58 59 60 61 62 63&#xA;mls qos srr-queue input dscp-map queue 2 threshold 3 32 33 40 41 42 43 44 45&#xA;mls qos srr-queue input dscp-map queue 2 threshold 3 46 47&#xA;mls qos srr-queue output cos-map queue 1 threshold 3 4 5&#xA;mls qos srr-queue output cos-map queue 2 threshold 1 2&#xA;mls qos srr-queue output cos-map queue 2 threshold 2 3&#xA;mls qos srr-queue output cos-map queue 2 threshold 3 6 7&#xA;mls qos srr-queue output cos-map queue 3 threshold 3 0&#xA;mls qos srr-queue output cos-map queue 4 threshold 3 1&#xA;mls qos srr-queue output dscp-map queue 1 threshold 3 32 33 40 41 42 43 44 45&#xA;mls qos srr-queue output dscp-map queue 1 threshold 3 46 47&#xA;mls qos srr-queue output dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23&#xA;mls qos srr-queue output dscp-map queue 2 threshold 1 26 27 28 29 30 31 34 35&#xA;mls qos srr-queue output dscp-map queue 2 threshold 1 36 37 38 39&#xA;mls qos srr-queue output dscp-map queue 2 threshold 2 24&#xA;mls qos srr-queue output dscp-map queue 2 threshold 3 48 49 50 51 52 53 54 55&#xA;mls qos srr-queue output dscp-map queue 2 threshold 3 56 57 58 59 60 61 62 63&#xA;mls qos srr-queue output dscp-map queue 3 threshold 3 0 1 2 3 4 5 6 7&#xA;mls qos srr-queue output dscp-map queue 4 threshold 1 8 9 11 13 15&#xA;mls qos srr-queue output dscp-map queue 4 threshold 2 10 12 14&#xA;mls qos queue-set output 1 threshold 1 100 100 50 200&#xA;mls qos queue-set output 1 threshold 2 125 125 100 400&#xA;mls qos queue-set output 1 threshold 3 100 100 100 400&#xA;mls qos queue-set output 1 threshold 4 60 150 50 200&#xA;mls qos queue-set output 1 buffers 15 25 40 20&#xA;mls qos&#xA;!&#xA;crypto pki trustpoint TP-self-signed-3287232768&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-3287232768&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-3287232768&#xA;!&#xA;!&#xA;crypto pki certificate chain TP-self-signed-3287232768&#xA; certificate self-signed 01&#xA;  *Removed*&#xA;        quit&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;class-map match-all AutoQoS-VoIP-RTP-Trust&#xA;  match ip dscp ef&#xA;class-map match-all AutoQoS-VoIP-Control-Trust&#xA;  match ip dscp cs3  af31&#xA;!&#xA;policy-map AutoQoS-Police-CiscoPhone&#xA; class AutoQoS-VoIP-RTP-Trust&#xA;   set dscp ef&#xA;  police 1000000 8000 exceed-action policed-dscp-transmit&#xA; class AutoQoS-VoIP-Control-Trust&#xA;   set dscp cs3&#xA;  police 1000000 8000 exceed-action policed-dscp-transmit&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/2&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/3&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/4&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/5&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/6&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/7&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/8&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/9&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/10&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/11&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface FastEthernet0/12&#xA; description *****IP PHONES and PC*****&#xA; switchport voice vlan 200&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos trust&#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description *****Trunk to FRIAS.3580.1941*****&#xA; switchport mode trunk&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust cos&#xA; auto qos trust&#xA;!&#xA;interface GigabitEthernet0/2&#xA; description *****Trunk to FRIAS.3580.1941*****&#xA; switchport mode trunk&#xA; srr-queue bandwidth share 1 30 35 5&#xA; queue-set 2&#xA; priority-queue out&#xA; mls qos trust cos&#xA; auto qos trust&#xA;!&#xA;interface Vlan1&#xA; description *****3580 Data VLAN 1*****&#xA; ip address 192.168.26.2 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;interface Vlan200&#xA; description *****3580 Voice VLAN 200*****&#xA; ip address 10.10.253.2 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;ip http server&#xA;ip http authentication local&#xA;ip http secure-server&#xA;!&#xA;!&#xA;snmp-server community public RO&#xA;!&#xA;ipv6 access-list IPv6_In_Traffic_Shutdown&#xA; deny ipv6 any any&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; logging synchronous&#xA; login local&#xA; length 0&#xA;line vty 5 15&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16762" LastEditorUserId="4994" LastEditDate="2016-04-11T21:17:52.047" LastActivityDate="2017-09-21T20:52:20.600" Title="Strange 2960 behavior on my network" Tags="|cisco-catalyst|" AnswerCount="4" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="20139" PostTypeId="2" ParentId="20089" CreationDate="2015-07-22T16:41:48.320" Score="1" Body="&lt;p&gt;1.) Simplified: The mask 255.0.0.0 means L3 devices will only care about the first octet of the IP address when routing the message (at least when determining which network ID the IP address is using), as only the first octet of the subnet has value, and it's maxed out (255 being the largest number possible for every octet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More in-depth:&#xA;This can be calculated by binary ANDing (though it isn't necessary in this case, and there's a far easier method for calculating this known as the &quot;&lt;a href=&quot;http://www.techexams.net/forums/ccna-ccent/67245-quick-subnetting-all-your-head.html&quot; rel=&quot;nofollow&quot;&gt;Magic Number&lt;/a&gt;&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But with ANDing, you convert the subnet to binary, in this case it is:&lt;br&gt;&#xA;255.0.0.0 = 11111111.00000000.00000000.00000000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then convert the IP address to binary, in this case, the server is:&lt;br&gt;&#xA;10.4.2.251 = 00001010.00000100.00000010.11111011&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next you AND the two binary numbers (meaning if there's a '1' over a '1', you carry the '1' down. If there isn't a '1' over a '1', then you write a '0'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00001010.00000100.00000010.11111011 AND&lt;/p&gt;&#xA;&#xA;&lt;p&gt;11111111.00000000.00000000.00000000 =&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00001010.00000000.00000000.00000000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you convert this binary number back to an IP address:&#xA;10.0.0.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This proves that the subnet mask 255.0.0.0 means ONLY the first octet will be taken into account in determining what network an IP address is in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) That being said, I think the first thing you should do is check to make sure all of your endpoints are using the same subnet mask (255.0.0.0, would work if you wanted all the addresses you listed to be able to communicate. 255.255.0.0 would also work with the addresses you gave. You could even do 255.255.128.0 or 255.255.192.0 or 255.255.224.0).&lt;/p&gt;&#xA;" OwnerUserId="16755" LastEditorUserId="16755" LastEditDate="2015-11-12T14:23:45.033" LastActivityDate="2015-11-12T14:23:45.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20140" PostTypeId="1" CreationDate="2015-07-22T19:30:55.367" Score="1" ViewCount="483" Body="&lt;p&gt;I'm currently deploying a new site with an IP address range of 172.22.101.0 - 172.22.160.0 and wondering is it best to go with the subnet mask of /16 or /24? Each subnet will have no more than 2 or 3 hosts connected to a maximum of 100 hosts at this site. Each subnet is also on its own vlan so for example subnet 172.22.101.0 is vlan 101. At another site I have deployed I'm using the IP range of 172.23.101.0 - 172.23.160.0 with a /24 subnet and it is ok on that network there is the about 150 hosts connected what is the implications of using a /24 compared to a /16 subnet mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks for your reply in advance.&lt;/p&gt;&#xA;" OwnerUserId="16770" LastEditorUserId="16770" LastEditDate="2015-07-22T21:29:50.480" LastActivityDate="2015-08-21T23:18:11.617" Title="IP Addressing Schema" Tags="|subnet|ip|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20141" PostTypeId="1" AcceptedAnswerId="39728" CreationDate="2015-07-22T21:04:23.840" Score="3" ViewCount="590" Body="&lt;p&gt;I am building a custom layer 1 (using rf radios).  I am building a tap/tun solution running on Linux on both sides of the radio link so I can get internet over my link.  Due to the nature of radio link (packet length etc), my MTU is fairly small (500 or less sometimes).  But it's also changing with time and signal conditions.  Is it bad / will programs complain if an interface has an MTU that is constantly changing?  Is this bad practice?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so should I be handling this internally myself? For instance if Linux think's the MTU is 1000 bytes but my link only supports 500 bytes, should I just do the work to glue 2 packets together myself to ensure the MTU is changing less often?  Thanks&lt;/p&gt;&#xA;" OwnerUserId="16771" LastEditorUserId="16771" LastEditDate="2017-03-15T07:33:14.577" LastActivityDate="2017-03-15T16:29:27.810" Title="Changing MTU constantly" Tags="|linux|mtu|" AnswerCount="1" CommentCount="6" ClosedDate="2019-02-09T00:51:44.367" ContentLicense="CC BY-SA 3.0" />
  <row Id="20142" PostTypeId="1" CreationDate="2015-07-22T22:14:57.883" Score="1" ViewCount="478" Body="&lt;p&gt;I was wondering if it is possible to have guest WiFi network on subnet 192.168.1.0/24 and Access Points to that WiFi on subnet 10.0.0.0/24. What I am trying to do is to block WiFi users access to AP configuration sites. &lt;/p&gt;&#xA;" OwnerUserId="16736" LastActivityDate="2015-08-25T09:37:24.653" Title="AP Management Vlan" Tags="|vlan|access-point|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20143" PostTypeId="1" AcceptedAnswerId="20259" CreationDate="2015-07-22T22:15:14.363" Score="7" ViewCount="729" Body="&lt;p&gt;We have an existing fiber infrastructure that's several years old.  I can't for the life of me read the jacket to get the core size of the fiber, and was wondering if there was a way to measure it without depending on the markings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fiber is for sure multimode, but I'm more concerned if it's 62.5 or 50 micron as we're looking to do 10GBASE-SR over them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="5595" LastEditorUserId="5595" LastEditDate="2015-07-28T18:16:23.157" LastActivityDate="2015-07-29T03:11:28.753" Title="Determine Core Size of Fiber Run" Tags="|fiber|cabling|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20144" PostTypeId="2" ParentId="20140" CreationDate="2015-07-22T22:25:15.593" Score="2" Body="&lt;p&gt;A /16 would not work, unless you want to take the entire 172.22.0.0 range.  It would be easiest to manage with a single /24, but I would also suggest additional /24s be created for stuff like phones, wireless, servers, etc:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172.22.101.0/24 VOICE&#xA;172.22.102.0/24 DATA&#xA;172.22.103.0/24 WIRELESS&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you are unfamiliar as to why one should separate voice and data traffic, take a look at a tool called &lt;a href=&quot;http://vomit.xtdnet.nl/&quot; rel=&quot;nofollow&quot;&gt;VOMIT&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past, Cisco didn't recommend any more than 200 hosts per subnet--  I'm not sure if this has changed (I'm not a CCDA/CCDE).  With that being said /23 and /22s are used in production environments all the time with little to no consequence.  Modern computers handle broadcast traffic much more efficiently than the old stuff.&lt;/p&gt;&#xA;" OwnerUserId="5595" LastActivityDate="2015-07-22T22:25:15.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20150" PostTypeId="1" CreationDate="2015-07-23T07:16:23.900" Score="3" ViewCount="2443" Body="&lt;p&gt;I have an application that requires users who share a 3G or 4G network access point (same public IP address) to communicate directly through their local IP addresses rather than trying to traverse their global IP addresses, but the local network addresses on my T-mobile 3G and 4G network are not like normal local IP addresses on most routers - they never start with &lt;code&gt;192&lt;/code&gt;, &lt;code&gt;172&lt;/code&gt;, or &lt;code&gt;10&lt;/code&gt;. Instead, they start with other numbers - for example, my phone now says that my private IP address is &lt;code&gt;21.48.25.107&lt;/code&gt;. How do you tell if an IP address is a local address when the IP address originates from a cellular network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Clarification:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am implementing a peer to peer NAT traversal solution for cellular applications. I avoid using the public IP address when the devices share a common public IP address because most routers do not support hairpin translation.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Hairpin is a behavior where a NAT device forwards packets from a host&#xA;  in an internal network (lets call it host A) back to some other host&#xA;  (host B) in the same internal network when it detects that the&#xA;  (public IP address) destination of the packet is actually a mapped IP&#xA;  address that was created for the internal host (host B). This is a&#xA;  desirable behavior of a NAT, but, unfortunately, not all NAT devices&#xA;  support this. Lacking this behavior, two (internal) hosts behind the&#xA;  same NAT will not be able to communicate with each other if they&#xA;  exchange their public addresses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is why they must exchange and use their local IP addresses if they share a public IP address.&lt;/p&gt;&#xA;" OwnerUserId="16777" LastEditorUserId="8499" LastEditDate="2016-03-20T00:05:40.240" LastActivityDate="2016-11-15T03:59:39.247" Title="What IP address ranges are used for local addresses on cellular internet networks?" Tags="|router|wireless|ipv4|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="20154" PostTypeId="1" AcceptedAnswerId="20188" CreationDate="2015-07-23T09:36:50.443" Score="3" ViewCount="5385" Body="&lt;p&gt;These two commands seems similar when I configure a DMVPN Spoke. What is the difference?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel1&#xA; ip address 192.168.88.2 255.255.255.248&#xA; no ip redirects&#xA; **ip nhrp map 192.168.88.1 10.0.1.1**&#xA; ip nhrp map multicast 10.0.1.1&#xA; ip nhrp network-id 1&#xA; **ip nhrp nhs 192.168.88.1**&#xA; tunnel source FastEthernet0/0&#xA; tunnel mode gre multipoint&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16778" LastActivityDate="2015-07-24T15:35:44.017" Title="What is the difference between ip nhrp nhs and ip nhrp map?" Tags="|tunnel|gre|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20155" PostTypeId="1" AcceptedAnswerId="20167" CreationDate="2015-07-23T10:01:48.637" Score="2" ViewCount="97" Body="&lt;p&gt;Would there be any noticeable difference (or any) if one was to use fiber cables for their LAN even if there was a standard copper connection coming into the network? &lt;/p&gt;&#xA;" OwnerUserId="5461" LastActivityDate="2015-07-28T14:46:35.257" Title="impacts of Fiber on a LAN with external copper connection" Tags="|lan|fiber|speed|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20156" PostTypeId="1" CreationDate="2015-07-23T10:54:27.910" Score="1" ViewCount="480" Body="&lt;p&gt;I was wondering if someone would be able to tell me when is the status code option (OPTION_STATUS_CODE) added to the options field of a OPTION_IAADDR or OPTION_IAPREFIX (RFC3633). The RFC seems to give examples of when it should be included in an IA_TD/IA_NA option but not the address' sub-option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RFC specifically allows the status code to be added to an address' options field:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RFC 3315 states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The status of any operations involving this IA Address is indicated in&#xA;  a Status Code option in the IAaddr-options field.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;RFC 3633 states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The status of any operations involving this IA_PD Prefix option is&#xA;  indicated in a Status Code option in the IAprefix-options field.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, I cannot seem to find an appropriate scenario for this to occur.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, a RENEW request by a client with an unrecognised address (per 3315):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the server finds that any of the addresses are not appropriate for&#xA;  the link to which the client is attached, the server returns the&#xA;  address to the client with lifetimes of 0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A DECLINE request by a client with an unrecognised address (per 3315):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the server finds that any of the addresses are no longer&#xA;  appropriate for the link to which the client is attached, the server&#xA;  returns the address to the client with lifetimes of 0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A REQUEST by a client with an inappropriate address (per 3315):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the server finds that the prefix on one or more IP addresses in any&#xA;  IA in the message from the client is not appropriate for the link to&#xA;  which the client is connected, the server MUST return the IA to the&#xA;  client with a Status Code option with the value NotOnLink.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In the case of the REQUEST statement above I find it stange that the NotOnLink status is added to the IA option, not the inner OPTION_IAADDR which would make more sense to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After going over the RFC a few times, it appears to me that the status code for OPTION_IAADR is just an &quot;optional&quot; extra - which I am assuming can be set along with returning a lifetime of 0 to a client in the case of a RENEW message with an inappropriate address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would anyone know if my assumptions are correct or if I am missing a documented use case somewhere (or real world example) for a status code option in the IA Address option field?&lt;/p&gt;&#xA;" OwnerUserId="16768" LastEditorUserId="8499" LastEditDate="2018-12-26T04:35:38.383" LastActivityDate="2018-12-26T04:35:38.383" Title="DHCPv6 - When is the Status Code Option added to the options field of an IA Address Option?" Tags="|ipv6|protocol-theory|rfc|dhcpv6|" AnswerCount="0" CommentCount="0" ClosedDate="2020-02-24T22:45:09.843" ContentLicense="CC BY-SA 3.0" />
  <row Id="20158" PostTypeId="1" CreationDate="2015-07-23T14:25:14.983" Score="5" ViewCount="10973" Body="&lt;p&gt;We just bought a DGS-1210-28P smart switch, it is my first experience with a business class switch, however I found a pretty weird behavior. The switch loses all of its configurations, even management ip address and password, when it is disconnected from power! a complete factory reset happens! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this normal?! Am I missing something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does business switches board has batteries that I should check?&lt;/p&gt;&#xA;" OwnerUserId="14326" LastEditorUserId="13630" LastEditDate="2018-02-02T11:57:46.740" LastActivityDate="2019-03-19T14:27:25.183" Title="DLink switch loses configuration on power off!" Tags="|switch|troubleshooting|management|interface|hardware|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="20159" PostTypeId="2" ParentId="20155" CreationDate="2015-07-23T14:32:15.510" Score="1" Body="&lt;p&gt;Not if the speed of the links are the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ps. You might notice a cost difference&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-07-23T14:32:15.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20160" PostTypeId="2" ParentId="20150" CreationDate="2015-07-23T14:47:00.307" Score="2" Body="&lt;p&gt;It doesn't answer your question, but may answer your need:&#xA;I fear the only option would be to have all peers register their local IP addresses on a server directly connected to the Internet (without NAT).&#xA;Each peer could then query the server for the local and translated IP addresses of others. If their translated public IP addresses are in the same range (allocated in the same AS), they could then try a direct connection through their local IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, with end-to-end IPv6 connectivity, there would be no issue...&lt;/p&gt;&#xA;" OwnerUserId="18916" LastEditorUserId="8499" LastEditDate="2016-03-20T00:08:58.240" LastActivityDate="2016-03-20T00:08:58.240" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20162" PostTypeId="2" ParentId="20150" CreationDate="2015-07-23T17:02:22.323" Score="0" Body="&lt;p&gt;You can't figure out what local address ranges will be used, but you can use the link-local IPv6 addresses to communicate locally in case hairpin translation is unavailable. &lt;/p&gt;&#xA;" OwnerUserId="16777" LastActivityDate="2015-07-23T17:02:22.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20163" PostTypeId="1" CreationDate="2015-07-23T18:31:11.157" Score="1" ViewCount="550" Body="&lt;p&gt;I hope someone out there can help me since SonicWALL support is horrible; three days, and still no response back from them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two NSA 3600 SonicWALLs, one at each of two different sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have introduced more subnets on each network, and I added them to the group associated with the current site-to-site VPN tunnel that is working, but the connections will not light up green; only the original one stays green.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the current setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Site 1 VPN Setup:&#xA;  Local Networks &#xA;    --- Selected Group: Site 1 Local Networks &#xA;    ---- Group Members: 192.168.214.0/255.255.255.0&#xA;                        192.168.240.0/255.255.254.0&#xA;  Remote Networks &#xA;    --- Selected Group: Site 2 Local Networks&#xA;    ---- Group Members: 192.168.202.0/255.255.255.0&#xA;                        192.168.198.0/255.255.255.0&#xA;                        192.168.114.0/255.255.255.0&#xA;&#xA;Site 2 VPN Setup:&#xA;  Local Networks&#xA;    --- Selected Group: Site 2 Local Networks&#xA;    ---- Group Members: 192.168.202.0/255.255.255.0&#xA;                        192.168.198.0/255.255.255.0&#xA;                        192.168.114.0/255.255.255.0&#xA;  Remote Networks&#xA;    --- Selected Group: Site 1 Local Networks&#xA;    ---- Group Members: 192.168.214.0/255.255.255.0&#xA;                        192.168.240.0/255.255.254.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything looks good to me but the only subnet which turn green are as follows, these of which were already working before adding more subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Site 1: 192.168.202.0&#xA;Site 2: 192.168.240.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only thing I did on both SonicWALLs was edit the groups that were already configured for the 192.168.202.0 and 192.168.240.0, and add in my other subnets that are required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone has any insight into this, that would be great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Strange. I enabled Keep-Alive on the advanced tab of the policy, and it started working. I noticed my other policies have this enabled.&lt;/p&gt;&#xA;" OwnerUserId="8029" LastEditorUserId="8499" LastEditDate="2016-04-04T21:21:42.087" LastActivityDate="2016-04-04T21:21:42.087" Title="SonicWALL Site-to-Site Subnet Not Lighting Up" Tags="|vpn|subnet|sonicwall|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20165" PostTypeId="2" ParentId="20158" CreationDate="2015-07-23T18:36:30.927" Score="3" Body="&lt;p&gt;I have seen this behavior with D-Link's in the past, it is hit and miss with their switches. If I saved from the web GUI, it wouldn't actually save, but saving using the CLI seemed to have always worked. Try it and let us know.&lt;/p&gt;&#xA;" OwnerUserId="8029" LastEditorUserId="40371" LastEditDate="2017-10-21T17:20:43.070" LastActivityDate="2017-10-21T17:20:43.070" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20166" PostTypeId="1" CreationDate="2015-07-23T18:41:12.453" Score="1" ViewCount="637" Body="&lt;p&gt;I want to ask whether all the user traffic goes through root switch. If there is redundant link available stp (Spanning Tree Protocol) block that link for loop prevention. So there is no option left the traffic will go through the other way only which is left. But you said that no traffic goes through root switch. &lt;/p&gt;&#xA;" OwnerUserId="16789" LastEditorUserId="16971" LastEditDate="2015-08-01T22:56:16.190" LastActivityDate="2015-08-02T10:30:39.190" Title="I want to discuss about stp (Spanning Tree Protocol)" Tags="|switch|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20167" PostTypeId="2" ParentId="20155" CreationDate="2015-07-23T20:41:11.687" Score="1" Body="&lt;p&gt;Not on a &quot;human scale&quot;. Copper interfaces tend to be microscopically faster (nanosecond scale) because the signal is already electrical. An optical interface, however, has to go through additional logic to make it electrical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I've heard of pure optical switching, but that was only a lab experiment.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-23T20:41:11.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20169" PostTypeId="1" AcceptedAnswerId="20175" CreationDate="2015-07-23T23:47:51.003" Score="6" ViewCount="2783" Body="&lt;p&gt;Forgive me if this sounds a little amateurish, or if this is the wrong stackexchange, but...most of my entirely life I've had ipv4 behind a NAT router.  I've been told that this was a hack; simply because the Internet was running out of ipv4 addresses.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the concepts of ip address, routers, subnets, routes (between subnets), ports, and I'm beginning to understand bridges; but I do not understand how the Internet is to work without a being behind a nat router...having not lived before NAT I do not understand why it is a hack...does an IPv6 Internet without NAT just mean that everybody gets an ip and there's no need for a  NAT router in between with a single unifying ip address protecting all the machines on the network from being accessed?  It sounds to me like instead of a single firewall on a single router, each machine will have to fend for itself with its' own firewall.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why is NAT a hack and how did things work before that hack was implemented?  Also what was so great about it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I live in the USA, so we don't have alot of choice when it comes to internet and most of the ISPs are ipv4 (or at least they are where I live).&lt;/p&gt;&#xA;" OwnerUserId="16753" LastActivityDate="2017-09-19T13:11:40.420" Title="How is NAT a hack?" Tags="|router|ipv4|nat|ipv6|ipv6-transition|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20171" PostTypeId="1" CreationDate="2015-07-24T07:11:44.397" Score="0" ViewCount="133" Body="&lt;p&gt;I want to know how a portfast will cause loop. I tried connecting a switch with portfast . As soon as another switch connected it enter to normal switch and has the block port. &lt;/p&gt;&#xA;" OwnerUserId="16798" LastActivityDate="2015-07-25T16:18:54.163" Title="portfast uses enabled does not producing loop" Tags="|spanning-tree|" AnswerCount="3" CommentCount="2" ClosedDate="2015-07-27T17:38:24.177" ContentLicense="CC BY-SA 3.0" />
  <row Id="20173" PostTypeId="1" CreationDate="2015-07-24T09:34:50.387" Score="1" ViewCount="76" Body="&lt;p&gt;Suppose you have 4 processes inside one network (no firewalls) and you see (hostnames A,B,C,D):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;From A:1 -&amp;gt; C:3&#xA;From B:2 -&amp;gt; D:4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Therefore you know A is communicating with C and B with D.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now suppose A,B are in Datacentrum 1 (D1) and C,D are in Datacentrum 2 (D2). D1 and D2 both have firewall. Now they are communicating, but you cannot see the link from netstat because there is something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;From A:1 -&amp;gt; D1 Firewall:X&#xA;From D2 Firewall:Q -&amp;gt; C:3&#xA;From B:2 -&amp;gt; D1 Firewall:Y&#xA;From D2 Firewall:W -&amp;gt; D:4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A is still communicating with C (port 1 to 3) and B with D (port 2 to 4). I would like to see &quot;translated&quot; version in netstat (A:1-C:3 amd B:2-D:4). I want to do this in my own code so I cannot use some other enterprise network software and no access to firewall is possible. Is this doable? Can I somehow extract this information from netstat?&lt;/p&gt;&#xA;" OwnerUserId="16803" LastActivityDate="2016-07-18T21:08:02.240" Title="Pair two communicating processes separated by two firewalls" Tags="|nat|firewall|ip-forwarding-table|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20175" PostTypeId="2" ParentId="20169" CreationDate="2015-07-24T10:58:55.813" Score="12" Body="&lt;p&gt;Before NAT every device connected to the internet had its own IP address. That was how the internet was designed. This gives you great flexibility and visibility. If you have a firewall then it can filter traffic for each address, protocol, port etc individually if you want. Because the source address and port (if applicable, not all protocols have ports) and destination address and port do not change between the sender and the receiver it is much much easier to debug. And if you want to let a device look after its own security that is possible too: just tell the firewall not to filter anything on that address, or not use a firewall device at all. Your choice :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's look at the simplest case of NAT: When you ISP only gives you one address you can only connect one device to the internet. This is not what most people want: they need to connect multiple devices. So that single device performs a masquerading trick so that to the outside world it looks like that single device is doing all the internet communication, while behind that device there can be multiple devices that think they have a normal connection to the internet while not really having one. The trick that that single device with a real internet address uses is NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT can only do its 'multiplexing' for protocols that use port numbers. For protocols without port numbers a connection is defined by the addresses. As you only have one 'real' address you can only have one connection. For protocols with port numbers like UDP and TCP a connection is usually defined by both addresses and ports. So &lt;code&gt;37.77.56.75:12345 &amp;lt;-&amp;gt; 94.142.242.216:80&lt;/code&gt; can be one connection and &lt;code&gt;37.77.56.75:23456 &amp;lt;-&amp;gt; 94.142.242.216:80&lt;/code&gt; another. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;37.77.56.75&lt;/code&gt; was a NAT device (it's not, it is my own PC's address, I don't use NAT here) it could have an internal state table that remembers that &lt;code&gt;37.77.56.75:12345&lt;/code&gt; corresponds to internal address &lt;code&gt;192.168.0.11:32431&lt;/code&gt;. Outgoing packets get their original source address and port (&lt;code&gt;192.168.0.11:32431&lt;/code&gt;) replaced with the NAT device's own (&lt;code&gt;37.77.56.75:12345&lt;/code&gt;), and the reverse is done for incoming packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What often causes some confusion with NAT and (stateful) firewalling is that both of those functions need to remember state: who is talking to whom?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A stateful firewall also has to keep track of who is talking to whom. So both a NAT device and a firewall need to remember that there is a session &lt;code&gt;37.77.56.75:12345 &amp;lt;-&amp;gt; 94.142.242.216:80&lt;/code&gt;. A NAT device also has to remember that &lt;code&gt;37.77.56.75:12345&lt;/code&gt; is really &lt;code&gt;192.168.0.11:32431&lt;/code&gt;. A firewall does some extra filtering and inspections to the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A NAT device without a firewall function will let unwanted traffic through if it happens to match something in its state table. A firewall will apply inspections to prevent that. But a firewall can also do that if the addresses of incoming and outgoing packets aren't changed: it doesn't need NAT to be able to perform its function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT is considered a hack because it makes the internet more complex. Addresses and ports are being changed, a NAT device has to remember what the original addresses and ports were, it has to actually understand all transport protocols it is applying NAT to so it prevents new transport protocols from being deployed (nobody will use new transport protocols because no NAT device will support them, and NAT devices won't support them because nobody uses them) etc.&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="632" LastEditDate="2017-09-19T10:35:38.350" LastActivityDate="2017-09-19T10:35:38.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20176" PostTypeId="2" ParentId="20169" CreationDate="2015-07-24T11:07:39.070" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I've been told that this was a hack; simply because the Internet was&#xA;  running out of ipv4 addresses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's correct. The original concept of IPv4 was to provide end-to-end connectivity so that each device could connect to any other device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT is a crutch for various reasons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;it is a bottleneck&lt;/li&gt;&#xA;&lt;li&gt;diagnosing network problems doesn't get easier&lt;/li&gt;&#xA;&lt;li&gt;several protocols at higher levels carry IP addresses for various reasons in their payload. For instance, for VoIP with SIP+RDP the IP address of the caller is transmitted to the callee in the SDP payload of a SIP signalling message. NAT breaks this, so further crutches are needed (e.g. STUN and/or TURN) to remediate this. The complexity is thus further increased.&lt;/li&gt;&#xA;&lt;li&gt;When using one-to-many NAT (a.k.a. &quot;Cone NAT&quot;) the addresses of the stub network are mapped to the external address of the NAT gateway.  More precisely, addr_in/portnum in the stub net are mapped to addr_ex/portnum for a &lt;em&gt;fixed&lt;/em&gt; addr_ex. Now there are only 65535 ports for TCP, UDP, or SCTP, so this limits the number of connections that can be NATed concurrently. As a private user in a class C stub net (e.g. 192.168.xx.0/24) you barely notice this limit, but some ISPs use &quot;Carrier Grade NAT&quot; (CGN), which is simply double NAT. At this point, the mentioned limitation becomes a serious problem.&lt;/li&gt;&#xA;&lt;li&gt;Another problem with CGN is blacklisting. If you manage to get yourself on an address based blacklist, then so are all your NAT &quot;neighbors&quot;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;does an IPv6 Internet without NAT just mean that everybody gets an ip and there's no need for a NAT router in between with a single unifying ip address protecting all the machines on the network from being accessed? It sounds to me like instead of a single firewall on a single router, each machine will have to fend for itself with its' own firewall.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is a myth ineradicable as weeds that (a) NAT is a security mechanism and (b) that with IPv6 every machine can connect to every other machine. First, yes, NAT acts somehow like a very rudimentary packet filter, but is not a substitute for a real packet filter. Second, you can protect entire IPv6 networks with a packet filter as before with IPv4, thus you don't need to protect each host individually.&lt;/p&gt;&#xA;" OwnerUserId="7756" LastActivityDate="2015-07-24T11:07:39.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20178" PostTypeId="2" ParentId="20171" CreationDate="2015-07-24T11:21:58.667" Score="2" Body="&lt;p&gt;Portfast is applied to final stations ports because you suppose that only one host will be connected. In this case, the host will go to Forwading state inmediately after getting link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If porfast is not applied, final station has to transition from all STP states (blocking, listening, learning, etc. Depends on STP version.). The consequence is that the host spend about 45 seconds to have connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is porfast causing the loop? NO but it amplifies consequences. The L2 loop will exist in both cases but with porfast enabled you will have immediately consequences.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastEditorUserId="3949" LastEditDate="2015-07-25T16:18:54.163" LastActivityDate="2015-07-25T16:18:54.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20180" PostTypeId="2" ParentId="20166" CreationDate="2015-07-24T12:20:11.107" Score="3" Body="&lt;p&gt;Depending on topology and endpoints, user traffic does not &lt;em&gt;need&lt;/em&gt; to traverse the root bridge (eg: two endpoints on the same or adjacent switches that is/are not the root bridge).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The root bridge is however the basis for which the active link between all bridges is determined.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-24T12:20:11.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20181" PostTypeId="1" AcceptedAnswerId="20200" CreationDate="2015-07-24T12:44:56.453" Score="3" ViewCount="1803" Body="&lt;p&gt;When designing a network incorporating IEEE-1588 (PTP), packet-delay variation (PDV) is a significant source of timing error. Both boundary clocks (network nodes which act as a slave clock to upstream nodes and as a master clock to downstream nodes) and transparent clocks (nodes which measure the delay of timing packets so downstream slave clocks can compensate) can effectively minimize error due to PDV &lt;a href=&quot;https://wiki.metroethernetforum.com/pages/viewpage.action?pageId=29230774&quot; rel=&quot;nofollow&quot;&gt;[1]&lt;/a&gt;, &lt;a href=&quot;http://www4.evaluationengineering.com/articles/201001/improving-synchronization-with-1588-transparent-clocks.php&quot; rel=&quot;nofollow&quot;&gt;[2]&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the differences in network performance for implementing a transparent clock vs. implementing a boundary clock, for minimizing the impact of PDV?&lt;/p&gt;&#xA;" OwnerUserId="15866" LastEditorUserId="775" LastEditDate="2015-07-25T10:57:39.460" LastActivityDate="2015-07-25T10:57:39.460" Title="When should a transparent clock or boundary clock be used when designing a network supporting clock synchronization?" Tags="|switch|latency|" AnswerCount="1" CommentCount="11" ClosedDate="2015-07-28T19:15:18.740" ContentLicense="CC BY-SA 3.0" />
  <row Id="20182" PostTypeId="1" CreationDate="2015-07-24T13:27:39.710" Score="1" ViewCount="257" Body="&lt;p&gt;How cable internet providers limit their bandwith? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are they using SFTP service? If yes, how does all that work?&lt;/p&gt;&#xA;" OwnerUserId="16810" LastEditorUserId="34855" LastEditDate="2017-03-01T20:44:50.790" LastActivityDate="2017-03-01T20:44:50.790" Title="How do cable internet providers limit user bandwith?" Tags="|internet|bandwidth|cable|speed|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20183" PostTypeId="2" ParentId="20171" CreationDate="2015-07-24T13:46:25.777" Score="0" Body="&lt;p&gt;You should only use Portfast on either A)A port that will only have a single device connected to it, or B) if you know EXACTLY what you are doing, and have planned accordingly. Otherwise, loops can happen, and potentially knock down your network. In this case, Portfast just makes the port go instantly to forwarding, but it still sees the BPDUs coming from your other switch, which makes the port go into 'blocking' state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd recommend that you remove the portfast command on the port facing another switch, and configure those ports (on Switch A and B) as trunk ports, then run Rapid Spanning Tree.&lt;/p&gt;&#xA;" OwnerUserId="16207" LastActivityDate="2015-07-24T13:46:25.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20184" PostTypeId="2" ParentId="20182" CreationDate="2015-07-24T14:12:17.190" Score="0" Body="&lt;p&gt;A subscriber delivery engine (SDE) is commonly used to control traffic to individual subscribers.&lt;/p&gt;&#xA;" OwnerUserId="15866" LastActivityDate="2015-07-24T14:12:17.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20185" PostTypeId="2" ParentId="20182" CreationDate="2015-07-24T14:12:56.197" Score="1" Body="&lt;p&gt;Simplistically: Cable networking, a true broadband, uses multiple channels that get aggregated to provide your overall bandwidth.  The more channels, the higher the bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-07-24T14:12:56.197" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20186" PostTypeId="2" ParentId="20173" CreationDate="2015-07-24T14:43:09.210" Score="1" Body="&lt;p&gt;If your firewall does NAT (it really doesn't have to do that to provide security! &lt;strong&gt;NAT != Security&lt;/strong&gt;) then your session will look different on every segment:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In the first data centre you will have A:1 as source and D2-Firewall:Q as destination&lt;/li&gt;&#xA;&lt;li&gt;After you pass D1-Firewall with NAT you will see D1-Firewall:X as source and D2-Firewall:Q as destination&lt;/li&gt;&#xA;&lt;li&gt;After you pass D2-Firewall with NAT you will see D1-Firewall:X as source and C:3 as destination&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;NAT really messes up debugging and visibility. Depending on where you look the source and destination addresses and ports will be completely different... From D1 you will only see the D2 NAT box and everything behind it will be hidden, and vice versa.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-07-24T14:43:09.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20188" PostTypeId="2" ParentId="20154" CreationDate="2015-07-24T15:35:44.017" Score="1" Body="&lt;p&gt;Thanks to &lt;a href=&quot;http://packetlife.net/blog/2008/jul/23/dynamic-multipoint-vpn-dmvpn/&quot; rel=&quot;nofollow&quot;&gt;PacketLife.net&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming router &lt;strong&gt;foo&lt;/strong&gt; is configured as the Next-Hop Server, has a physical interface with IP address 10.0.1.1, and a tunnel interface with IP address 192.168.88.1 whose source is the 10.0.1.1 interface, then&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;ip nhrp nhs 192.168.88.1&lt;/em&gt; designates router &lt;strong&gt;foo&lt;/strong&gt; as the Next-Hop Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;ip nhrp map 192.168.88.1 10.0.1.1&lt;/em&gt; statically maps 192.168.88.1 to &lt;strong&gt;foo&lt;/strong&gt;'s physical address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, it's a chicken-and-the-egg problem. Normally, you'd query the NHS for a tunnel endpoint's physical address, but you need to know the NHS's physical address in order to query it. Thus, the static mapping.&lt;/p&gt;&#xA;" OwnerUserId="271" LastActivityDate="2015-07-24T15:35:44.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20190" PostTypeId="1" AcceptedAnswerId="20215" CreationDate="2015-07-24T16:36:30.623" Score="2" ViewCount="3188" Body="&lt;p&gt;I am having trouble with configuring &lt;code&gt;LACP&lt;/code&gt; and &lt;code&gt;RSTP&lt;/code&gt; on a (&lt;code&gt;TPLINK TL-SG3424&lt;/code&gt;) switch. If I reboot the &lt;code&gt;VM Server&lt;/code&gt; or unplug one of the &lt;code&gt;LACP&lt;/code&gt; ports it causes a &lt;code&gt;RSTP&lt;/code&gt; topology change that pauses packet forwarding on the swtich for around ~6 seconds. (E.g I can't reach the internet from &lt;code&gt;PC&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly if I unplug my &lt;code&gt;PC&lt;/code&gt; it has no effect whatsoever on anything connected to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering what can be wrong because it seems not to be working right. I wouldn't expect to see a topology change if I unplug a LACP port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         ((internet))&#xA;              |&#xA;              | WAN&#xA;              | &#xA;        (Mikrotik ROUTER)  &#xA;              | 10.10.10.1/24  (router is selected as root bridge)&#xA;              | LAN&#xA;              | Port 2&#xA;        (TL-SG3424 SWITCH) &#xA;    Port 4 |          || LACP&#xA;           |          || Port 10,12&#xA;           |          ||&#xA;          (PC)    (VM SERVER - proxmox)&#xA;  10.10.10.2/24     10.10.10.3/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A &lt;code&gt;mikrotik&lt;/code&gt; router is connected to the internet via the WAN port. The LAN ports run &lt;code&gt;RSTP&lt;/code&gt; and I have set a &lt;code&gt;priority&lt;/code&gt; of &lt;code&gt;0&lt;/code&gt; to ensure it is selected as the &lt;code&gt;root bridge&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have enabled &lt;code&gt;RSTP&lt;/code&gt; on all the ports of the switch (&lt;code&gt;TPLINK TL-SG3424&lt;/code&gt;).&#xA;Following the TPLINK user guide, I have set the following stp security features on the switch ports:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RgFdw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RgFdw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stp summary:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/PYGDz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PYGDz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network configuration on the VM server is set to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto lo&#xA;iface lo inet loopback&#xA;&#xA;iface eth0 inet manual&#xA;&#xA;iface eth1 inet manual&#xA;&#xA;auto bond0&#xA;iface bond0 inet manual&#xA;        slaves eth0 eth1&#xA;        bond_miimon 100&#xA;        bond_mode 802.3ad&#xA;&#xA;auto vmbr0&#xA;iface vmbr0 inet static&#xA;        address  10.10.10.3&#xA;        netmask  255.255.255.0&#xA;        gateway  10.10.10.1&#xA;        bridge_ports bond0&#xA;        bridge_stp off&#xA;        bridge_fd 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16598" LastEditorUserId="16598" LastEditDate="2015-07-25T07:56:36.280" LastActivityDate="2015-07-26T11:22:40.710" Title="Configuring RSTP and LACP. Unplugging a LACP port causes a topology change and pauses all switch traffic" Tags="|switch|spanning-tree|layer2|ieee-802.1ax|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="20191" PostTypeId="2" ParentId="20166" CreationDate="2015-07-24T16:58:01.993" Score="1" Body="&lt;p&gt;See Per-VLAN Spanning Tree (&lt;strong&gt;PVST&lt;/strong&gt;) and Per-VLAN Spanning Tree Plus (&lt;strong&gt;PVST+&lt;/strong&gt;).  This would allow you send some traffic across the redundant layer 2 link.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NOTES:    &#xA;Spanning Tree Protocol - (IEEE)&#xA;    802.1D STP (Spanning Tree Protocol)&#xA;    801.1s MSTP (Multiple Spanning Trees Protocol)&#xA;    802.1w RSTP (Rapid Spanning Tree Protocol)&#xA;&#xA;    Permits only a single path toward the root bridge&#xA;    Is outdated, replaced by 802.1q-2014(.aq Shortest Path Bridging, SPB)&#xA;&#xA;    Path Cost determined by the access speeds of the links determine the path cost&#xA;&#xA;    * Don't Deploy STP&#xA;    MLAG Multi-Chassis Link Aggregation Groups&#xA;        VSS&#xA;        Cross-Stack Etherchannel&#xA;        FabricPath (uses IS-IS at layer 2)&#xA;        VPC (Virtual Port Channel) &#xA;        Brocade’s VCS (Virtual Cluster Switching)   &#xA;    IETF TRILL (Transparent Interconnection of Lots of Links)&#xA;    IEEE 802.1aq (Shortest Path Bridging – SPB)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-24T16:58:01.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20192" PostTypeId="2" ParentId="20169" CreationDate="2015-07-24T17:18:24.503" Score="4" Body="&lt;p&gt;Network Address Translation (NAT) and Port Address Translation (PAT) have been widely deployed since the early days of the Web.  It may be misleading to characterize NAT/PAT as a hack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Restoring end-to-end connectivity is a design goal of IPv6 where NAT is not commonly deployed &lt;a href=&quot;https://en.wikipedia.org/wiki/Network_address_translation#NAT_in_IPv6&quot; rel=&quot;nofollow&quot;&gt;¹&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firewall, and current next-generation firewalls, are dedicated network-based devices that perform deep packet inspection which is outside the role of NAT/PAT.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-07-24T21:16:33.593" LastActivityDate="2015-07-24T21:16:33.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20197" PostTypeId="5" CreationDate="2015-07-24T20:32:16.323" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2015-07-24T20:32:16.323" LastActivityDate="2015-07-24T20:32:16.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20198" PostTypeId="4" CreationDate="2015-07-24T20:32:16.323" Score="0" Body="PTP or Precision Time Protocol (IEEE 1588) is a protocol to synchronize clocks in a network. It can achieve higher accuracy than the more commonly used NTP, but requires PTP support in network devices. " OwnerUserId="189" LastEditorUserId="189" LastEditDate="2015-07-24T20:38:02.323" LastActivityDate="2015-07-24T20:38:02.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20199" PostTypeId="2" ParentId="20171" CreationDate="2015-07-24T23:44:30.123" Score="0" Body="&lt;p&gt;Portfast just makes the port basically bypass the blocking listening and learning phases of stp and goes straight to forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Always use &quot;bpdu guard&quot; in conjunction with porfast on your access interfaces, this will protect your network from loops, if a rogue switch is connected, by immediately putting the interface into error disabled state.&lt;/p&gt;&#xA;" OwnerUserId="3846" LastActivityDate="2015-07-24T23:44:30.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20200" PostTypeId="2" ParentId="20181" CreationDate="2015-07-25T00:39:22.127" Score="1" Body="&lt;p&gt;If you have heavy jitter or significant load, boundary clock.  But optimizing for PDV alone will impact clock quality eventually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not:&#xA;Assuming this is decision for a single piece of equipment and not an overall network design: (i.e. not considering overall quality of the clock at a particular hop)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your particular gear has a path from the net interface that bypasses input queuing (&quot;priority-queue &lt;em&gt;in&lt;/em&gt;&quot; behavior) before sending the sync to the PTP controller then boundary.  Otherwise transparent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose some QoS could be applied to put PTP into the same queue as, say, voice traffic, but that still won't get rid of delay variation as calls get made and hung up. &lt;/p&gt;&#xA;" OwnerUserId="8079" LastActivityDate="2015-07-25T00:39:22.127" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20201" PostTypeId="2" ParentId="20143" CreationDate="2015-07-25T00:53:00.587" Score="4" Body="&lt;p&gt;If you have a light meter, get some readings over the fiber as a baseline.  Then, connect a 50 micron patch cord at one end and take readings again &lt;strong&gt;in both directions&lt;/strong&gt;.  If you see much more loss than expected (assuming the label that came with the patch cord shows the real loss over that cord), then the fiber is 62.5 micron.  If not, try it with a 62.5 patch cord at one end, repeat the readings.  Basically, if there's a mismatch between the patch cord and the fiber you should see 4 dB loss in one direction, with the matching patch cord giving the expected loss in both directions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if it's only a few years old it's &lt;strong&gt;probably&lt;/strong&gt; 50.&lt;/p&gt;&#xA;" OwnerUserId="8079" LastEditorUserId="8079" LastEditDate="2015-07-29T01:55:57.513" LastActivityDate="2015-07-29T01:55:57.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20205" PostTypeId="1" CreationDate="2015-07-25T17:56:23.363" Score="1" ViewCount="346" Body="&lt;p&gt;I have my modem configured for bridge mode. I get one &lt;strong&gt;IPv4&lt;/strong&gt; for my router and one goes to my server for public access. If I static assigned these &lt;strong&gt;IPv4&lt;/strong&gt; address would I keep them as long as no one else ended up with them?&lt;/p&gt;&#xA;&lt;p&gt;How does &lt;strong&gt;DHCP&lt;/strong&gt; work from the &lt;strong&gt;ISP&lt;/strong&gt; side. I assume it is just like any other DHCP server?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="70383" LastEditDate="2020-10-20T12:32:22.000" LastActivityDate="2020-10-20T12:32:22.000" Title="Can you keep DHCP addresses from your ISP" Tags="|ipv4|dhcp|ipv6|isp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20206" PostTypeId="2" ParentId="20205" CreationDate="2015-07-25T18:27:25.410" Score="2" Body="&lt;p&gt;Yes: it's normal DHCP as far as you are concerned. They might have different server software with different provisioning tools. You just have to stick to what the DHCP protocol provides you. That includes only using the IP addresses you get for as long as the lease time is and refreshing that lease before it expires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just statically configuring an address and not getting/extending the lease with DHCP will not work. It might work if what you configure matches a still active DHCP lease but it will stop working once that lease exires. &lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-07-25T18:27:25.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20211" PostTypeId="2" ParentId="20205" CreationDate="2015-07-26T03:05:06.117" Score="1" Body="&lt;p&gt;The IP address you are assigned by your ISP may change over time.  You should be able to contact your provider and ask for a static IP address.  They may charge you more though...&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-26T03:05:06.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20212" PostTypeId="2" ParentId="20205" CreationDate="2015-07-26T04:19:38.383" Score="1" Body="&lt;p&gt;Depending on the type of ISP (COMCAST/others) and business or residential. My IP at home haven't been changed 2 months now. The IP at the office changes every 48 hours (Comcast wanted $$$ =) ). &lt;/p&gt;&#xA;" OwnerUserId="16837" LastActivityDate="2015-07-26T04:19:38.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20214" PostTypeId="1" CreationDate="2015-07-26T08:55:57.660" Score="2" ViewCount="495" Body="&lt;p&gt;I would like to be able to capture an MPDU Delimiter that is part of an A-MPDU, and see the contents of those 4 bytes displayed on the image below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zw3yk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zw3yk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do this in, for example, Wireshark and can someone provide the instructions and perhaps a .pcap file.&lt;/p&gt;&#xA;" OwnerUserId="16839" LastActivityDate="2020-08-26T01:04:50.487" Title="How do I capture an 802.11 MPDU Delimiter field?" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20215" PostTypeId="2" ParentId="20190" CreationDate="2015-07-26T11:22:40.710" Score="1" Body="&lt;p&gt;It turns out the web configuration page of the tplink switch renders options incorrectly (they are offset by one column) which lead me to believe that the edge ports are activated but in reality they were not. Activating the edge ports fixed the issue. &lt;/p&gt;&#xA;" OwnerUserId="16598" LastActivityDate="2015-07-26T11:22:40.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20216" PostTypeId="2" ParentId="20128" CreationDate="2015-07-26T13:34:19.697" Score="2" Body="&lt;p&gt;If the only router in your network is the Routerboard shown on the diagram, then in terms of routing both VLANs should be reachable from one to another without any other configuration as long as the devices on both VLANs have a default gateway to the routerboard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default mikrotik comes with a pre-configured firewall only on the &lt;code&gt;Input chain&lt;/code&gt;.&lt;br&gt;&#xA;So it doesn't block anything between vlans or any other interface unless you configure it to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To allow &lt;strong&gt;only&lt;/strong&gt; certain ports to be accessed from VLAN90 to VLAN80 you need to set up some firewall rules on &lt;code&gt;IP &amp;gt; Firewall &amp;gt; Filter&lt;/code&gt; on the &lt;code&gt;Forward chain&lt;/code&gt;.&lt;br&gt;&#xA;The rules depend on what you need to allow apparently.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the Ethernet users can you be more specific? It doesn't sound like a Routerboard/Mikrotik issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding logging the router's traffic, there are various ways to do that.&lt;br&gt;&#xA;Mikrotik itself has a graphs function that logs historical traffic data for each configured interface (&lt;code&gt;Tools &amp;gt; Graphs&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this feature is quite basic. The most standard way to measure the traffic is via SNMP (&lt;code&gt;IP &amp;gt; SNMP&lt;/code&gt;) using any solution that suits you.&lt;br&gt;&#xA;Check this thread: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/19929/get-avarage-network-trafic-data-in-mb/19959#19959&quot;&gt;Get Avarage network trafic data in MB&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1418" LastActivityDate="2015-07-26T13:34:19.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20217" PostTypeId="1" CreationDate="2015-07-26T18:12:30.617" Score="0" ViewCount="2695" Body="&lt;p&gt;So, recently, I've  run into a few issues with Python TCP/IP sockets. Basically, I can't make,and neither can Python's IDLE (a Python file editor) program itself, since it requires a connection at startup, any TCP communication endpoints using the Python &lt;code&gt;socket&lt;/code&gt; module. So, I asked what was going on with my Python over on StackOverflow, and I got an answer telling me I should use Wireshark to figure out from where a RST signal is being sent to my program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've learned the basics of capturing. My only problem is I am not sure for which program I am looking. I am not sure at which packets I should be looking, and how I am supposed to go about finding from where the RST is coming? So, if anyone could walk me through this, that would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="16846" LastEditorUserId="8499" LastEditDate="2016-03-24T23:56:59.613" LastActivityDate="2016-07-27T16:00:03.827" Title="Trying to capture a RST on a TCP/IP program using Wireshark" Tags="|tcp|wireshark|" AnswerCount="3" CommentCount="2" ClosedDate="2019-03-04T00:37:00.447" ContentLicense="CC BY-SA 3.0" />
  <row Id="20219" PostTypeId="1" CreationDate="2015-07-26T19:24:12.470" Score="1" ViewCount="1784" Body="&lt;p&gt;I am currently working on a project using Vsat technology (internet) to link 10 branch offices located in different remotes areas to the head office. on each of the site, I have a 2921 Cisco router, 2960 Cisco switch respectively. In addition to this, the client requested we install microwave radio in each of the site including the head office. and all the microwave radios should be on the same LAN so as all the remote sites can communicate as if they are on the same location. though the Vsat will still be a source of internet to all these locations. My question is what is the best way to configure this radio link? Should I directly connect a microwave radio to an interface on a Cisco switch and create a vlan on the switch for traffic for microwave link traffic? Please advice.&lt;/p&gt;&#xA;" OwnerUserId="16850" LastActivityDate="2016-02-22T05:13:35.737" Title="integration of Microwave radio into a network" Tags="|switch|router|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20221" PostTypeId="2" ParentId="20219" CreationDate="2015-07-26T23:29:33.510" Score="1" Body="&lt;p&gt;The new microwave links will terminate via Ethernet.  Plug that into your switch.  Each site &lt;em&gt;requires&lt;/em&gt; a unique private subnet(s), if that is not already configured.  Create a unique point to point subnet/VLAN per microwave link (/30 bit masked network).  The 2921 should trunk .1q to the switch.  Now the 2921's can route.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Under normal operation each site has its own ISP/Sat link however if &#xA;that were to go down it is possible to re-route each site via&#xA;microwave to the HQ/Neighboring site for Internet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Also, realistically, the customer may want to enable a VPN WAN backup&#xA;over the ISP/Sat links in case the microwave link fails, which&lt;br&gt;&#xA;complicates the config further, but this is the how it should be&lt;br&gt;&#xA;done.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Be sure and test each scenario at &lt;em&gt;each site&lt;/em&gt; and pay attention to failover and failback times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a great routing job.  Hub and spoke, or ring?  You can do it.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-26T23:29:33.510" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="20224" PostTypeId="1" CreationDate="2015-07-27T04:26:59.647" Score="0" ViewCount="690" Body="&lt;p&gt;I have an issue where my users are unable to access a particular web service (hosted app on AWS) because of an http 302 redirect pointing us to an incorrect port and address.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It works ok from other networks.&lt;/li&gt;&#xA;&lt;li&gt;Packet capture on our edge firewall shows&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the internal interface receiving the correct request&lt;/li&gt;&#xA;&lt;li&gt;the external interface receiving the 302 packet from AWS server&lt;/li&gt;&#xA;&lt;li&gt;the internal interface receiving the new and incorrect request as per the 302 redirect&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;edge firewall is a microsoft tmg server. Forgive me....I'm getting it replaced :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone confirm whether or not I'm right in saying this is 100% out of my control and push back on the service provider? They think it's my firewall/proxy but since I can see the 302 packet coming in on the external interface I fail to see how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other insights into how this could be occurring also appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="16409" LastEditorUserId="8499" LastEditDate="2018-02-16T04:07:54.927" LastActivityDate="2018-02-16T04:07:54.927" Title="HTTP 302 Redirect - Is this my problem?" Tags="|network|" AnswerCount="1" CommentCount="6" ClosedDate="2015-07-27T17:36:13.413" ContentLicense="CC BY-SA 3.0" />
  <row Id="20226" PostTypeId="2" ParentId="20224" CreationDate="2015-07-27T07:25:45.997" Score="1" Body="&lt;p&gt;Confirmed that this redirect is originating outside my environment. Had my ISP run the same test.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks all&lt;/p&gt;&#xA;" OwnerUserId="16409" LastActivityDate="2015-07-27T07:25:45.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20227" PostTypeId="1" AcceptedAnswerId="20233" CreationDate="2015-07-27T08:21:58.787" Score="3" ViewCount="20557" Body="&lt;p&gt;is it possible to see the used SSL-Version in a TCP-dump in an established TCP-connection without killing the connection and re-establishing it to capture the &quot;Client Hello&quot;?&#xA;If yes, where can I find it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BR and thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="16856" LastEditorUserId="8499" LastEditDate="2018-02-16T04:25:20.110" LastActivityDate="2018-02-16T04:25:20.110" Title="Find SSL version in TCP-packets in established TCP-connection" Tags="|tcp|tcpdump|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20228" PostTypeId="1" CreationDate="2015-07-27T09:15:06.393" Score="2" ViewCount="2460" Body="&lt;p&gt;I have a Cisco 1900 Series router running and I have issued whereby clients running torrents take all the bandwidth for their own use while business users suffer the damage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried setting up nbar using the config as stated below;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ip cef&#xA;  class-map match-any LIMIT-TOR&#xA;  match protocol bittorrent&#xA;  exit&#xA;  policy-map QOS-LIMIT-TOR-POLICY&#xA;  class LIMIT-TOR&#xA;  police cir 2000000&#xA;  confirm-action drop&#xA;  exceed-action drop&#xA;  exit&#xA;  exit&#xA;  exit&#xA;  int gig 0/1&#xA;  ip nbar protocol-discovery&#xA;  service-policy input QOS-LIMIT-TOR-POLICY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where the Interface Gigabit 0/1 is the LAN Interface on the Router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed nothing changed as I was still able to use Utorrent and I changed the policy map from what i have up there to this;&#xA;      policy-map QOS-LIMIT-TOR-POLICY&#xA;      class LIMIT-TOR&#xA;      exit&#xA;And I an still having same issue.... I could still use Utorrent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did a show state on the recent configuration and got this&#xA;       RouterName#show policy-map int gig0/1&#xA;       GigabitEthernet0/1 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Service-policy input: QOS-LIMIT-TOR-POLICY&#xA;&#xA;      Class-map: LIMIT-TOR (match-any)&#xA;        9245 packets, 1103711 bytes&#xA;        5 minute offered rate 5000 bps, drop rate 5000 bps&#xA;        Match: protocol bittorrent&#xA;          9245 packets, 1103711 bytes&#xA;          5 minute rate 5000 bps&#xA;        Match: protocol gnutella&#xA;          0 packets, 0 bytes&#xA;          5 minute rate 0 bps&#xA;        drop&#xA;&#xA;Class-map: class-default (match-any)&#xA;  771180 packets, 134837021 bytes&#xA;  5 minute offered rate 875000 bps, drop rate 0 bps&#xA;  Match: any &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong please?&lt;/p&gt;&#xA;" OwnerUserId="3869" LastEditorUserId="3869" LastEditDate="2015-07-29T10:57:11.040" LastActivityDate="2015-07-29T10:57:11.040" Title="How to Block Torrents Using NBAR" Tags="|cisco|cisco-ios|cisco-commands|bandwidth|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20229" PostTypeId="2" ParentId="20228" CreationDate="2015-07-27T09:18:34.767" Score="3" Body="&lt;p&gt;Thanks all. It has been rectified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I changed the code from&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int gig 0/1&#xA;  ip nbar protocol-discovery&#xA;  service-policy input QOS-LIMIT-TOR-POLICY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to (by adding the additional line of code)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  int gig 0/1&#xA;  ip nbar protocol-discovery&#xA;  service-policy input QOS-LIMIT-TOR-POLICY&#xA;  service-policy output QOS-LIMIT-TOR-POLICY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3869" LastEditorUserId="3869" LastEditDate="2015-07-28T06:55:52.700" LastActivityDate="2015-07-28T06:55:52.700" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="20230" PostTypeId="1" CreationDate="2015-07-27T09:30:12.743" Score="4" ViewCount="936" Body="&lt;p&gt;I am configuring the AppFw on a SRX240 chassis this works fine to block Facebook or Twitter or whatever application. I also configured a custom block message to redirect a user to a specific web page when the policy is met.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that this block message does not work with either Facebook or Twitter, the content is blocked (thus the policy must be met?) but the connection times out in stead of redirecting the user to the configured block-message. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I configure another application like Reuters, it all works flawless. I'm mainly puzzled why this happens and of course it would be excellent if anyone knows how to show the block message or redirect!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per request my AppFw test config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;application-firewall {&#xA;    profile test_block_msg {&#xA;        block-message {&#xA;            type {&#xA;                custom-redirect-url {&#xA;                    content http://www.justasite.nl;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    rule-sets test-apfw {&#xA;        rule 1 {&#xA;            match {&#xA;                dynamic-application-group junos:web:social-networking:facebook;&#xA;            }&#xA;            then {&#xA;                deny;&#xA;            }&#xA;        }&#xA;        rule 2 {&#xA;            match {&#xA;                dynamic-application [ junos:TWITTER junos:TWITTER-UPDATE junos:TWITVID junos:TWITTER-SSL ];&#xA;            }&#xA;            then {&#xA;                deny;&#xA;            }&#xA;        }&#xA;        default-rule {&#xA;            permit;&#xA;        }&#xA;        profile test_block_msg;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And my policies:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policies {&#xA;    from-zone Inside to-zone Outside {&#xA;        policy test-apfw-pol {&#xA;            match {&#xA;                source-address any;&#xA;                destination-address any;&#xA;                application any;&#xA;            }&#xA;            then {&#xA;                permit {&#xA;                    application-services {&#xA;                        application-firewall {&#xA;                            rule-set test-apfw;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;        policy in-to-out {&#xA;            match {&#xA;                source-address any;&#xA;                destination-address any;&#xA;                application any;&#xA;            }&#xA;            then {&#xA;                permit;&#xA;            }&#xA;        }&#xA;    }&#xA;    from-zone Outside to-zone Inside {&#xA;        policy Outside-to-IIS {&#xA;            match {&#xA;                source-address IIS_Ext_permitted;&#xA;                destination-address IIS_Test;&#xA;                application HTTP;&#xA;            }&#xA;            then {&#xA;                permit;&#xA;                log {&#xA;                    session-init;&#xA;                    session-close;&#xA;                }&#xA;            }&#xA;        }&#xA;        policy my-ssh {&#xA;            match {&#xA;                source-address any;&#xA;                destination-address any;&#xA;                application my-ssh;&#xA;            }&#xA;            then {&#xA;                permit;&#xA;            }&#xA;        }&#xA;        policy dyn-vpn-SECPOL {&#xA;            match {&#xA;                source-address any;&#xA;                destination-address any;&#xA;                application any;&#xA;            }&#xA;            then {&#xA;                permit {&#xA;                    tunnel {&#xA;                        ipsec-vpn SRX100;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="16857" LastEditorUserId="16857" LastEditDate="2015-07-28T07:19:54.257" LastActivityDate="2016-02-23T22:29:39.523" Title="SRX240 AppFw block message" Tags="|juniper-srx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20232" PostTypeId="2" ParentId="20217" CreationDate="2015-07-27T09:58:29.917" Score="0" Body="&lt;p&gt;Assuming that you are able to capture this traffic it comes down to mapping the parameters of your connection to the packets found in the capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all you state using TCP, so applying the display filter 'tcp' should get rid of all the other packets. If you are seeing still more than one TCP session you can filter even more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You know which TCP port you are connecting to, so applying the display filter 'tcp.port == &amp;lt;your port#&amp;gt;' should get rid of all the other packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you should be able to tell if the service process indeed sends you tcp RST.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for finding the service process you'll have to go look at the open port list on the platform hosting the service. 'netstat -lp --tcp' comes to mind.&lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2015-07-27T09:58:29.917" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20233" PostTypeId="2" ParentId="20227" CreationDate="2015-07-27T12:48:51.010" Score="7" Body="&lt;p&gt;Yes, absolutely, that is possible. The TLS record header is not encrypted. The two-octet version field is located at offset 1 in the TLS record header. Assuming a TLS record was not split into multiple TCP segments (which in practice is usually the case but cannot be relied upon), the second and third byte within the TCP payload indicate the TLS version used, e.g. &lt;code&gt;0x03 0x01&lt;/code&gt; for TLS 1.0 or &lt;code&gt;0x03 0x03&lt;/code&gt; for TLS 1.2. For more details, refer to the respective RFCs, e.g. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5246#section-6.2.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5246 6.2.3&lt;/a&gt; for the format of the TLS 1.2 record layer for encrypted payloads.&lt;/p&gt;&#xA;&lt;p&gt;Wireshark and its command line companion &lt;code&gt;tshark&lt;/code&gt; will show you the decoded TLS version of any given TLS record as you would expect. To show that using &lt;code&gt;tcpdump&lt;/code&gt;, you can use &lt;code&gt;-x&lt;/code&gt; to get a hex dump and find offset 1 within the TCP data after removing the IP and TCP headers.&lt;/p&gt;&#xA;" OwnerUserId="16588" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-07-27T12:48:51.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20234" PostTypeId="1" CreationDate="2015-07-27T13:46:56.700" Score="1" ViewCount="1954" Body="&lt;p&gt;how to authenticate bgp peer between cisco asr and juniper ACX 2200 ?&#xA;Need juniper ACX2200 configuration commands?&#xA;urgent needed&lt;/p&gt;&#xA;" OwnerUserId="16863" LastActivityDate="2015-07-27T18:17:29.787" Title="how to authenticate bgp peer between cisco asr and juniper ACX 2200?" Tags="|juniper|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20235" PostTypeId="2" ParentId="20104" CreationDate="2015-07-27T17:12:43.567" Score="-1" Body="&lt;p&gt;You are describing normal/defaul operation of the ASA.  Only established TCP connections are allowed from OUTSIDE to INSIDE.  You can disable this by configuring &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa93/asdm73/firewall/asa-firewall-asdm/conns-connlimits.html#pgfId-1295884&quot; rel=&quot;nofollow&quot;&gt;TCP State Bypass&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Step 1 Choose Configuration &amp;gt; Firewall &amp;gt; Service Policy.&#xA;&#xA;Step 2 Click Add &amp;gt; Add Service Policy Rule.&#xA;&#xA;Alternatively, if you already have a rule for the hosts, edit the rule.&#xA;&#xA;Step 3 Select whether to apply the rule to a specific interface or globally to all interfaces, and click Next.&#xA;&#xA;Step 4 For Traffic Classification, select Source and Destination IP Addresses (uses ACL) and click Next.&#xA;&#xA;Step 5 For the ACL rule, enter the IP addresses of the hosts on each end of the route in Source and Destination, and specify the protocol as TCP. Click Next when finished.&#xA;&#xA;For example, if you want to bypass TCP state checking between 10.1.1.1 and 10.2.2.2, enter:&#xA;&#xA;Source = 10.1.1.1&#xA;Destination = 10.2.2.2&#xA;Destination Protocol = tcp&#xA;Step 6 On the Rule Actions page, click the Connection Settings tab and select TCP State Bypass.&#xA;&#xA;Step 7 Click Finish to save the rule, and Apply to update the device.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-27T17:12:43.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20236" PostTypeId="2" ParentId="20234" CreationDate="2015-07-27T17:15:44.103" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/topic-map/bgp-authentication.html&quot; rel=&quot;nofollow&quot;&gt;Example: Configuring [Juniper] BGP Route Authentication&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CLI Quick Configuration&lt;/strong&gt;&lt;br&gt;&#xA;To quickly configure this example, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, and then copy and paste the commands into the CLI at the [edit] hierarchy level.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols bgp group ext type external&#xA;set protocols bgp group ext peer-as 65530&#xA;set protocols bgp group ext neighbor 172.16.2.1&#xA;set routing-options autonomous-system 65533&#xA;set protocols bgp group ext authentication-key-chain bgp-auth&#xA;set protocols bgp group ext authentication-algorithm md5&#xA;set security authentication-key-chains key-chain bgp-auth tolerance 30&#xA;set security authentication-key-chains key-chain bgp-auth key 0 secret this-is-the-secret-password&#xA;set security authentication-key-chains key-chain bgp-auth key 0 start-time 2011-6-23.20:19:33-0700&#xA;set security authentication-key-chains key-chain bgp-auth key 1 secret this-is-another-secret-password&#xA;set security authentication-key-chains key-chain bgp-auth key 1 start-time 2012-6-23.20:19:33-0700&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-27T17:15:44.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20237" PostTypeId="2" ParentId="20234" CreationDate="2015-07-27T18:17:29.787" Score="1" Body="&lt;p&gt;I've run into issues with this, unfortunately Ron's solution probably won't work in terms of interoperability with an ASR (sorry to be the guy who links to his own question).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/16758/bgp-authentication-key-chain-vs-authentication-key&quot;&gt;BGP authentication-key-chain vs. authentication-key&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot use the &lt;em&gt;&quot;authentication-key-&lt;strong&gt;chain&lt;/strong&gt;&quot;&lt;/em&gt; option here, you'll need to use &lt;em&gt;&quot;authentication-key&quot;&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;protocols {&#xA;    bgp {&#xA;        group PEERS {&#xA;            neighbor 1.2.3.4 {&#xA;                    authentication-key YOURPASSWORDHERE; ## SECRET-DATA&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Set Syntax:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols bgp group Peers neighbor 1.2.3.4 authentication-key YOURPASSWORDHERE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It issues with using &quot;authentication-key-chain&quot; have to do with how the options are conveyed to the neighbor via the TCP header.  &lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-07-27T18:17:29.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20238" PostTypeId="2" ParentId="19473" CreationDate="2015-07-27T18:43:22.977" Score="3" Body="&lt;p&gt;The MTU field in EIGRP is informational in nature, it is not used in any path selection algorithms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It was most likely put in to the scope of the protocol as a way to pass values through route redistribution. This is pure speculation as I was not there myself. :) You could always reach out to your local SE and press the issue if you want more information.&lt;/p&gt;&#xA;" OwnerUserId="16282" LastActivityDate="2015-07-27T18:43:22.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20240" PostTypeId="2" ParentId="20104" CreationDate="2015-07-27T21:21:29.723" Score="3" Body="&lt;p&gt;In your &lt;a href=&quot;https://www.cloudshark.org/captures/9f1507f3cf85?filter=!stp&quot; rel=&quot;nofollow&quot;&gt;inside capture&lt;/a&gt;, there are two packets going from the Server (10.1.102.19) to the Client (10.1.202.1), but they are coming from different MAC addresses. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#23 Ethernet II, Src: 00:10:94:00:00:01 (00:10:94:00:00:01), Dst: 00:19:55:07:12:ca (00:19:55:07:12:ca)&#xA;    Internet Protocol Version 4, Src: 10.1.102.19 (10.1.102.19), Dst: 10.1.202.1 (10.1.202.1)&#xA;    Transmission Control Protocol, Src Port: 8000 (8000), Dst Port: 9000 (9000), Seq: 0, Ack: 19112639, Len: 0&#xA;&#xA;#25 Ethernet II, Src: 00:10:94:00:00:02 (00:10:94:00:00:02), Dst: 00:19:55:07:12:ca (00:19:55:07:12:ca)&#xA;    Internet Protocol Version 4, Src: 10.1.102.19 (10.1.102.19), Dst: 10.1.202.1 (10.1.202.1)&#xA;    Transmission Control Protocol, Src Port: 8000 (8000), Dst Port: 9000 (9000), Seq: 0, Ack: 1, Len: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That seems weird, but is probably not your problem.  As far as I can interpret it, your problem is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like the server itself naturally responds to your crafted SYN packet with the RST-ACK in packet#23 (of the inside cap, see above) -- probably because port 8000 is closed.  This will prompt the Firewall to forward the RST to the Outside (Packet#23 in Outside cap), and purge this connection from its state table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But your crafted SYN-ACK packet fires off in #25 (of the inside cap), prompting a RST from the Firewall (#26) because there is no entry in the connection table related to this flow.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-07-27T21:21:29.723" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20244" PostTypeId="2" ParentId="20182" CreationDate="2015-07-28T03:52:03.580" Score="4" Body="&lt;p&gt;The DOCSIS Service Profile within the configuration downloaded when it registers on the network tells the modem (and headend) how much bandwidth an individual modem is allowed. Exactly how the modem (or headend) polices this is &lt;em&gt;implementation specific&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-28T03:52:03.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20245" PostTypeId="1" CreationDate="2015-07-28T05:33:46.370" Score="4" ViewCount="2175" Body="&lt;p&gt;I'm using a Juniper vSRX image in GNS3.&lt;/p&gt;&#xA;&lt;p&gt;Here is my output before entering into config mode:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/FMcRm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FMcRm.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;And after entering into config mode:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/OrL4h.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OrL4h.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Why can I see my &lt;code&gt;ge0/0/0&lt;/code&gt; in config mode, but not outside of?&lt;/p&gt;&#xA;" OwnerUserId="4051" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-07-28T12:36:46.407" Title="Why do some interfaces not display unless I'm in config mode?" Tags="|router|juniper|juniper-junos|gns3|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20246" PostTypeId="1" AcceptedAnswerId="20247" CreationDate="2015-07-28T05:34:50.693" Score="2" ViewCount="8250" Body="&lt;p&gt;I searched a google lot but am not able to find topic which can tell me the difference betweens inner vlans and outer vlans.  Or Atleast find more detail about them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone please explain on this or at least give me some links to read about them&lt;/p&gt;&#xA;" OwnerUserId="4968" LastActivityDate="2018-10-03T16:52:49.277" Title="What is the difference between inner and outer vlans" Tags="|cisco|switch|vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20247" PostTypeId="2" ParentId="20246" CreationDate="2015-07-28T05:50:46.233" Score="6" Body="&lt;p&gt;When working with Q-in-Q, where there's an 802.1q tag within a tag, the &lt;em&gt;inner&lt;/em&gt; and &lt;em&gt;outer&lt;/em&gt; vlans are the inner most and outer most tags.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-28T05:50:46.233" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20249" PostTypeId="1" CreationDate="2015-07-28T09:15:11.180" Score="1" ViewCount="76" Body="&lt;p&gt;I'm interested in TCP connection between mobile unit which is connected over GPRS to server on public network. I need to keep open, so I will send periodically keep-alive packets for hold session. Trouble is, that I must have a long-term period of sending keepalive packets for minimal data traffic, but I need to get to know that session is broken as fast as possible. How I tested on a few operators, NAT boxes don't send any information, such as TCP-RST or any ICMP message, that mapping is cancelled.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone advise me how could mobile unit get to know that session is broken?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much&lt;/p&gt;&#xA;" OwnerUserId="16879" LastActivityDate="2015-07-28T09:15:11.180" Title="Broken session detection in mobile network" Tags="|tcp|mobile|" AnswerCount="0" CommentCount="3" ClosedDate="2020-12-16T22:03:38.717" ContentLicense="CC BY-SA 3.0" />
  <row Id="20250" PostTypeId="1" AcceptedAnswerId="20257" CreationDate="2015-07-28T09:35:11.000" Score="2" ViewCount="98" Body="&lt;p&gt;Hello for a project i need to test the behavior an application for mobile phone in situation there is no cellular data available. in some cases i have successfully been able to test this in the lift at my work place, however at home i cant do the test as there is no lift :). i tried to recreate this situation by wrapping a box with aluminum foils without success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion how i can create a box in which there will be no cellular network inside ?&lt;/p&gt;&#xA;" OwnerUserId="16880" LastActivityDate="2015-07-28T13:37:28.010" Title="Create a service proof box to test mobile without network available" Tags="|wireless|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20251" PostTypeId="2" ParentId="20250" CreationDate="2015-07-28T10:24:33.243" Score="0" Body="&lt;p&gt;Have you tried enabling Airplane mode? Most modern phones support airplane mode which disabled cellular data and wi-if.&lt;/p&gt;&#xA;" OwnerUserId="16882" LastActivityDate="2015-07-28T10:24:33.243" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20252" PostTypeId="1" AcceptedAnswerId="20254" CreationDate="2015-07-28T10:25:23.100" Score="1" ViewCount="716" Body="&lt;p&gt;I have two openbsd servers with 6 NIC cards each.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;lspci | grep -i ether&#xA;01:00.0 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet (rev 20)&#xA;01:00.1 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet (rev 20)&#xA;02:00.0 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet (rev 20)&#xA;02:00.1 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet (rev 20)&#xA;04:00.0 Ethernet controller: Intel Corporation 82576 Gigabit Network Connection (rev 01)&#xA;04:00.1 Ethernet controller: Intel Corporation 82576 Gigabit Network Connection (rev 01)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Out of these, one nic on the first one, and two on the second one are unplugged, and the remaining nics except one is connected via a switch. The last nic on server1 is connected to the second server directly via a crossover cable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I identify which interface is the one that is connected directly to the other server, and not via switch? I tried arping and ping and analyzing the tcpdump, hoping the ones connected to switch would show the switch's mac-id, but everything showed the machine's nic mac-id. &lt;/p&gt;&#xA;" OwnerUserId="16881" LastEditorUserId="33" LastEditDate="2015-07-28T19:23:56.413" LastActivityDate="2015-07-28T19:23:56.413" Title="How to identify a crossover connected and a switch connected NICs between two servers" Tags="|switch|ethernet|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20253" PostTypeId="2" ParentId="20250" CreationDate="2015-07-28T10:30:55.543" Score="1" Body="&lt;p&gt;Finally i decided to look for an old phone and will just remove the antenna&lt;/p&gt;&#xA;" OwnerUserId="16880" LastActivityDate="2015-07-28T10:30:55.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20254" PostTypeId="2" ParentId="20252" CreationDate="2015-07-28T11:32:17.963" Score="1" Body="&lt;p&gt;Short answer: you can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches do not modify Ethernet frames, so there's no difference between one that was sent directly from the server and one that passed through the switch.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-07-28T11:32:17.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20256" PostTypeId="2" ParentId="20245" CreationDate="2015-07-28T12:36:46.407" Score="1" Body="&lt;p&gt;You're likely emulating using the wrong NICs. If the correct NICs are used the ge interfaces should appear in 'show interfaces terse'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring them is one thing... but having them actually present within the virtualized device is entirely different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using virtualbox to run the vSRX image then try - paravirtualized network (virtio-net) NIC. I believe that should help.&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2015-07-28T12:36:46.407" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20257" PostTypeId="2" ParentId="20250" CreationDate="2015-07-28T13:37:28.010" Score="3" Body="&lt;p&gt;You want a &lt;a href=&quot;https://en.wikipedia.org/wiki/Faraday_cage&quot; rel=&quot;nofollow&quot;&gt;Faraday Cage&lt;/a&gt;. Connect your aluminum foil box to an electrical ground, and that will prevent cellular signals from passing in/out of the box.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2015-07-28T13:37:28.010" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20258" PostTypeId="2" ParentId="20155" CreationDate="2015-07-28T14:46:35.257" Score="2" Body="&lt;p&gt;Depends on the LAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In mine, there is a huge, noticeable difference, because the LAN extends across multiple buildings scattered over 1/2 mile, and served by different power lines. When it was copper it did not cover as many buildings, because copper would not reach, and burnt out ports were a common result of thunderstorms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With fiber, thunderstorms cause no problems to the network at all, and even on the wimpiest (singlemode) SFPs link length is 10 kilometers, so nothing anywhere on campus is out of reach, no matter how convoluted the run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your LAN is not hampered by 100 meter length limits and is within one building, there will be virtually no noticeable difference. &lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-07-28T14:46:35.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20259" PostTypeId="2" ParentId="20143" CreationDate="2015-07-28T14:55:10.033" Score="7" Body="&lt;p&gt;If you have a fiber scope (you really should, to check if connections are clean) the core size (but not OM level) is obvious by inspection, especially if you look at a known connector and then the unknown connector (or better yet, two known connectors, one of each size.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Image from theFOA.org&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zVtEV.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zVtEV.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2015-07-28T16:06:22.323" LastActivityDate="2015-07-28T16:06:22.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20260" PostTypeId="1" CreationDate="2015-07-28T15:27:29.370" Score="0" ViewCount="3225" Body="&lt;p&gt;I'm working with a customer to resolve some issues with their network, and I have a hunch that their issues is that their firewall is just overwhelmed. However, I've never actually found any information on exactly what to look for to diagnose an overwhelmed firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any sources or just knowledge of what this looks like? The symptoms they are having is that their external clients are suffering from intermittent connectivity, the PAs are HA paired, but one of them is dead and a reboot of the firewall temporarily solves this issue. However, it's strange that only their external clients would suffer from this issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They have larger firewalls scheduled to upgrade the older ones, but logistics have prevented this from happening just yet, so here I am.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do overworked firewalls look like?&lt;/p&gt;&#xA;" OwnerUserId="16885" LastActivityDate="2015-07-28T18:32:57.557" Title="Symptoms of an overworked firewall?" Tags="|firewall|palo-alto|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20261" PostTypeId="1" CreationDate="2015-07-28T16:19:00.523" Score="0" ViewCount="499" Body="&lt;p&gt;Sanity check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have customer in a very remote location with a DSL router/modem with a /30 subnet assigned to it's WAN interface.  The upper of the two available IP addresses is used for the router and the lower for the ISP's gateway on the other side of the DSL link.  The LAN network is on a private range using NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to change the router/modem to use only public IP addresses and have another Ethernet router behind that router which has more features (i.e. IPSec etc.) and put the private network on the LAN port of the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've come to do so and I now think it is impossible because a /30 does not give me enough IP addresses.  Is this correct?&lt;/p&gt;&#xA;" OwnerUserId="16886" LastActivityDate="2015-07-30T13:12:32.173" Title="Networking with a /30" Tags="|routing|ipv4|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20262" PostTypeId="2" ParentId="20261" CreationDate="2015-07-28T16:22:53.067" Score="2" Body="&lt;p&gt;Connect the expensive router to the DSL modem and switch all routing as well as internet connectivity setup off on the router/modem. Then the modem will not use any IP. Most devices (home routers) provide such features, often called &lt;em&gt;PPPoE pass-through&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then let the expensive router establish the PPPoE connection to the ISP via the external modem. If you provide more details about the involved devices, we might figure out more details.&lt;/p&gt;&#xA;" OwnerUserId="7533" LastActivityDate="2015-07-28T16:22:53.067" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20263" PostTypeId="2" ParentId="20252" CreationDate="2015-07-28T16:32:04.767" Score="1" Body="&lt;p&gt;The buzzword that you're looking for is &lt;a href=&quot;https://en.wikipedia.org/wiki/Medium-dependent_interface&quot; rel=&quot;nofollow&quot;&gt;MDI-X&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Linux systems, you can use &lt;code&gt;ethtool&lt;/code&gt; to retrieve such information (it might not be supported with every NIC):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ethtool eth0&#xA;Settings for eth0:&#xA;  Speed: 100Mb/s&#xA;  Duplex: Full&#xA;  ...&#xA;  MDI-X: off&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am not sure, what an equivalent of &lt;code&gt;ethtool&lt;/code&gt; for OpenBSD is or if it available there. Sorry, if not. But theoretically, you can retrieve such information from the interface state, but not from the traffic.&lt;/p&gt;&#xA;" OwnerUserId="7533" LastActivityDate="2015-07-28T16:32:04.767" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20264" PostTypeId="2" ParentId="20252" CreationDate="2015-07-28T17:58:50.457" Score="0" Body="&lt;p&gt;While you can't directly tell which interfaces connect to a switch and which connect the two servers directly, there may be ways to do this indirectly. Namely, look for the type of traffic that is generally produced by a switch and not by a server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you have the servers configured to participate in STP (i.e. generally only a concern if you are bridging or running virtualization with a switch/bridge), they don't tend to send out BPDUs like a switch will if running STP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use tcpdump to capture these frames if present (substituting the appropriate interface):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -nn -v -i eth0 -c 1 'stp'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If your servers are using STP or your switches are not, then you can look at other options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they are Cisco switches, by default they will be using a process called CDP (Cisco Discovery Protocol). This is often disabled in some environments so you may need to consider enabling it to test. Some other vendors also support CDP as well, but it may be disabled by default. You can capture these with tcpdump as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -nn -v -i eth0 -c 1 'ether[20:2] == 0x2000'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The standard based version of CDP is LLDP (link layer discovery protocol). If the vendor's switches support it, they may have this on by default while others have it off. Here is the tcpdump command to capture this traffic:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -nn -v -i eth0 -c 1 'ether proto 0x88cc'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There may be other options, but these are the ones I would expect a good chance of seeing from a switch in a business environment.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-07-28T17:58:50.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20265" PostTypeId="1" AcceptedAnswerId="25873" CreationDate="2015-07-28T17:59:42.897" Score="8" ViewCount="92480" Body="&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;:&#xA;I Have found that Nmap can work in unprivileged mode. A question related to that &#xA;can be found &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/20272/nmap-only-works-in-unprivilged-mode&quot;&gt;here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recently installed NMap 6.49BETA4, and the ZenMap GUI, on my Windows 7 Home Premium x64. I'm not familiar with NMap at all, so I expect this to be a very simple solution. When I ran the default scanme.nmap.org, scan, I received this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Starting Nmap 6.49BETA4 ( https://nmap.org ) at 2015-07-28 13:26 Eastern Daylight Time&#xA;NSE: Loaded 122 scripts for scanning.&#xA;NSE: Script Pre-scanning.&#xA;Initiating NSE at 13:27&#xA;Completed NSE at 13:27, 0.00s elapsed&#xA;Initiating NSE at 13:27&#xA;Completed NSE at 13:27, 0.00s elapsed&#xA;Initiating Ping Scan at 13:27&#xA;dnet: Failed to open device eth1&#xA;QUITTING!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run --&lt;code&gt;iflist&lt;/code&gt;, I get this return:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;***********************INTERFACES************************&#xA;DEV  (SHORT) IP/MASK                      TYPE        UP   MTU  MAC&#xA;eth0 (eth0)  fe80::a167:b6ca:c16f:282b/64 ethernet    down 1500 66:6D:57:28:DB:41&#xA;eth0 (eth0)  169.254.40.43/4              ethernet    down 1500 66:6D:57:28:DB:41&#xA;eth1 (eth1)  fe80::f4e6:8b28:e268:72f0/64 ethernet    up   1500 44:6D:57:28:DB:41&#xA;eth1 (eth1)  192.168.1.6/24               ethernet    up   1500 44:6D:57:28:DB:41&#xA;eth2 (eth2)  fe80::581e:d69e:7f23:7640/64 ethernet    down 1500 24:00:04:18:00:22&#xA;eth2 (eth2)  169.254.118.64/4             ethernet    down 1500 24:00:04:18:00:22&#xA;lo0  (lo0)   ::1/128                      loopback    up   -1&#xA;lo0  (lo0)   127.0.0.1/8                  loopback    up   -1&#xA;tun0 (tun0)  (none)/0                     point2point down 1280&#xA;tun1 (tun1)  fe80::5efe:c0a8:106/128      point2point down 1280&#xA;tun2 (tun2)  (none)/0                     point2point down 1280&#xA;tun3 (tun3)  fe80::e0:0:0:0/64            point2point down 1280&#xA;tun4 (tun4)  (none)/0                     point2point down 1280&#xA;tun5 (tun5)  (none)/0                     point2point down 1280&#xA;DEV  WINDEVICE&#xA;eth0 none&#xA;eth0 none&#xA;eth1 none&#xA;eth1 none&#xA;eth2 none&#xA;eth2 none&#xA;lo0  none&#xA;lo0  none&#xA;tun0 none&#xA;tun1 none&#xA;tun2 none&#xA;tun3 none&#xA;tun4 none&#xA;tun5 none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm almost positive that the lack of a WINDEVICE linked with eth1 is the problem, but I'm blank on how to fix it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Addition Information:&#xA;Wireless Adapter: Atheros AR5B125 Wireless Network Adapter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beginning of &lt;code&gt;ipconfig /all&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Windows IP Configuration&#xA;&#xA;  Host Name . . . . . . . . . . . . : MyName-PC&#xA;  Primary Dns Suffix  . . . . . . . :&#xA;  Node Type . . . . . . . . . . . . : Broadcast&#xA;  IP Routing Enabled. . . . . . . . : Yes&#xA;  WINS Proxy Enabled. . . . . . . . : No&#xA;  DNS Suffix Search List. . . . . . : home&#xA;&#xA;Wireless LAN adapter Wireless Network Connection:&#xA;&#xA;  Connection-specific DNS Suffix  . : home&#xA;   Description . . . . . . . . . . . : Atheros AR5B125 Wireless Network Adapter&#xA;   Physical Address. . . . . . . . . : 44-6D-57-28-DB-41&#xA;   DHCP Enabled. . . . . . . . . . . : Yes&#xA;   Autoconfiguration Enabled . . . . : Yes&#xA;   Link-local IPv6 Address . . . . . : fe80::f4e6:8b28:e268:72f0%25(Preferred)&#xA;   IPv4 Address. . . . . . . . . . . : 192.168.1.6(Preferred)&#xA;   Subnet Mask . . . . . . . . . . . : 255.255.255.0&#xA;   Lease Obtained. . . . . . . . . . : Tuesday, July 28, 2015 11:53:44 AM&#xA;   Lease Expires . . . . . . . . . . : Tuesday, July 28, 2015 2:28:11 PM&#xA;   Default Gateway . . . . . . . . . : 192.168.1.1&#xA;   DHCP Server . . . . . . . . . . . : 192.168.1.1&#xA;   DHCPv6 IAID . . . . . . . . . . . : 457469271&#xA;   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-17-28-44-78-E8-40-F2-BE-96-&amp;gt;45&#xA;   DNS Servers . . . . . . . . . . . : 192.168.1.1&#xA;   NetBIOS over Tcpip. . . . . . . . : Enabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sorry for the long question. &lt;/p&gt;&#xA;" OwnerUserId="16888" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2021-06-08T18:54:14.153" Title="NMap: Failed to open device eth1" Tags="|ethernet|" AnswerCount="5" CommentCount="14" ClosedDate="2021-06-08T20:30:35.433" ContentLicense="CC BY-SA 3.0" />
  <row Id="20266" PostTypeId="2" ParentId="20252" CreationDate="2015-07-28T18:10:39.020" Score="1" Body="&lt;p&gt;You've got several options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Option 1&lt;/strong&gt;. Record the IP and MAC address of the directly connected server's NIC (the &quot;other&quot; server, as you call it). From your original server ping that IP address and use the &lt;strong&gt;&lt;em&gt;arp&lt;/em&gt;&lt;/strong&gt; command to check on which interface does the MAC address of the &quot;other&quot; server appear. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Option 2&lt;/strong&gt;. Generate traffic via the switches, e.g. ping multiple servers on your network that you know are connected via the switch ports. Run &lt;strong&gt;&lt;em&gt;arp&lt;/em&gt;&lt;/strong&gt;, and if there's more than one MAC address to a port, then this interface is connected to a switch port (multiple MAC addresses are a give-away).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Option 3.&lt;/strong&gt; Check you server's routing table. You should be able to see which route is for the directly connected server, and where it goes, e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;netstat -rn&#xA;&#xA;Kernel IP routing table&#xA;Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface&#xA;10.10.1.2        0.0.0.0         255.255.255.255 UH        0 0          0 eth0&#xA;10.10.2.0        10.8.0.2        255.255.255.0   UG        0 0          0 eth1&#xA;60.60.60.0      0.0.0.0         255.255.255.0   U         0 0          0 eth2&#xA;10.254.254.0     0.0.0.0         255.255.0.0     U         0 0          0 eth3&#xA;0.0.0.0         60.60.60.1      0.0.0.0         UG        0 0          0 eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All of this depends on some details, e.g. whether any of these interfaces uses teaming/bonding, or some level of aggregation, whether the server has bridged interfaces, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet switches typically work using something called &lt;strong&gt;transparent&lt;/strong&gt; bridging - emphasis on transparent, meaning they're usually somewhat invisible to the end hosts (bar things like STP/CDP). &lt;strong&gt;So never expect to see a switch MAC address in a host's ARP table!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope you find these useful :-)&lt;/p&gt;&#xA;" OwnerUserId="16887" LastActivityDate="2015-07-28T18:10:39.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20267" PostTypeId="2" ParentId="20260" CreationDate="2015-07-28T18:29:07.663" Score="3" Body="&lt;p&gt;I assume from the provided tag that it's a Palo Alto.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Check for high CPU utilization, having it consistently work above 80% is a sign that things are bad in that department. CLI command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;code&gt;show running resource-monitor&lt;/code&gt;&lt;/em&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check out for packet drops:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;code&gt;show counter global | match drop&lt;/code&gt;&lt;/em&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check for high concurrent sessions, CPS:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;code&gt;show session info&lt;/code&gt;&lt;/em&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For more info and tips, check out &lt;a href=&quot;http://digitalscepter.com/palo-alto-networks/useful-palo-alto-networks-cli-commands/&quot; rel=&quot;nofollow&quot;&gt;this cheat-sheet of really useful PaloAlto commands&lt;/a&gt; to help troubleshooting an &quot;overworked&quot; firewall.&lt;/p&gt;&#xA;" OwnerUserId="16887" LastActivityDate="2015-07-28T18:29:07.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20268" PostTypeId="2" ParentId="20260" CreationDate="2015-07-28T18:32:57.557" Score="1" Body="&lt;p&gt;&lt;code&gt;show system resources&lt;/code&gt; is another useful command. Baseline performance during a time when you know the system is operating to spec, and compare to when your users are dropping. &lt;a href=&quot;https://live.paloaltonetworks.com/docs/DOC-4649&quot; rel=&quot;nofollow&quot;&gt;Here's Palo Alto's KB article&lt;/a&gt; on interpreting the output.&lt;/p&gt;&#xA;" OwnerUserId="973" LastActivityDate="2015-07-28T18:32:57.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20269" PostTypeId="2" ParentId="20230" CreationDate="2015-07-28T18:39:55.843" Score="1" Body="&lt;p&gt;It looks like the usual problem where HTTP redirect works (Reuters), but HTTPS doesn't (Facebook and Twitter).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To display a &quot;this page is blocked&quot; message when it's a HTTPS connection, you'll need a MITM, because you'll need not to break the TLS handshake (which is happening right now).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run the test - try connecting to a HTTP site that you've blocked, and then try an HTTPS version of the same site (just make sure it's not a site that redirects from HTTP to HTTPS like Facebook and Twitter do).&lt;/p&gt;&#xA;" OwnerUserId="16887" LastActivityDate="2015-07-28T18:39:55.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20272" PostTypeId="1" CreationDate="2015-07-28T22:26:30.953" Score="3" ViewCount="1247" Body="&lt;p&gt;This question originated from an earlier NMap question &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/20265/nmap-failed-to-open-device-eth1&quot;&gt;here&lt;/a&gt;. Anyways, my NMap will only work inside --unprivileged mode. How can I make NMap operate outside --unprivileged? The same thing persist across Cygwin, ZenMap,and NMap CMD. Information about --iflist, versions, adapters, ect. can be found at the original question.&lt;/p&gt;&#xA;" OwnerUserId="16888" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-01-11T11:31:32.967" Title="NMap only works in --unprivilged mode?" Tags="|ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20273" PostTypeId="1" CreationDate="2015-07-28T23:44:53.617" Score="4" ViewCount="426" Body="&lt;p&gt;I have a network that is comprised of a main office and multiple branch offices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main office houses the servers and each branch office has an IPsec tunnel to the main office. There are no tunnels between the branch offices directly. So Branch Office 1 and Branch Office 2 can communicate with Main Office but not directly with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without changing any configurations on the routers at any location would it be possible for computers at the branch offices to communicate with each other by routing their traffic through the Main Office somehow?&lt;/p&gt;&#xA;" OwnerUserId="16893" LastEditorUserId="8499" LastEditDate="2016-03-21T18:33:58.437" LastActivityDate="2017-02-15T07:27:48.380" Title="IPsec tunnel configuration question" Tags="|vpn|ipsec|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20275" PostTypeId="2" ParentId="20143" CreationDate="2015-07-29T03:11:28.753" Score="3" Body="&lt;p&gt;We have a large quantity mix of fiber types in our network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the fiber is only a few years old as others have mention it is most likely 50u. With that said on the jacket should have at least have the manufacturer name and part number. I know what you are saying in that many jackets do not have a 50 or 62.5 stamped on it. Best is by name and part number and look that up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The poor man's way to make an educated guess is one I have used many times over the years at many installations and is generally pretty accurate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most fiber installers are generally smart enough to match the patch cords to the fiber that has been pulled to the closet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is one guideline to use if there truly isn't any manufacturer name and/or part number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Color coding, If the patch cords and many times the jacketing are orange then there is a high possibly that it is 62.5 OM2 cabling. There are rare exceptions and that is usually done by a 3rd tier fiber manufacturer. Grey can also be 62.5, especially if it is the patch cords. You can technically run 10GB upto 80 meters on 62.5 but in a darken room you will see alot of light leaking around the connectors. Also will see a lot of crc errors under the show int status.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aqua color for patch cord and jacketing of the fiber runs is almost always 50u OM3 &amp;amp; OM4.  I doubt you have OM4 if it is several years old unless your employer paid the higher price at the time. About the same price now but not several years ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doubt you have indoor single mode but if you do then generally it's yellow patch cords.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These suggestions are for indoor fiber. Outside plant can and in many cases are black jacketed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Others many not agree but this has been my experience and I've done my share of indoor and outside plants when I worked for Ciena Communications selling fiber transmission gear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would highly suggest lifting some ceiling tiles and try to locate the manufacturer name and part number. That is going to be the most accurate way.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-07-29T03:11:28.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20276" PostTypeId="1" AcceptedAnswerId="28103" CreationDate="2015-07-29T05:28:31.233" Score="3" ViewCount="405" Body="&lt;p&gt;I'm trying to launch a few vSRX devices through GNS3 (and VirtualBox). The issue that I'm running into (&lt;em&gt;I think&lt;/em&gt;) is that my interfaces seem to not properly initialize if I don't start the instances with at least 1024 MB of RAM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on a lightweight laptop, and was hoping to run a few instances at 512 MB or somewhere along those lines. From the troubleshooting I've done over the past couple nights though, it seems as though you can in fact launch the instances with less than the recommended RAM, but it doesn't necessarily mean everything is going to be initialized properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, if I launch with 1024 MB of RAM, I can do: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;root@vsrx-a&amp;gt; show interfaces ge0/0/0 terse&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;.. and have my interface displayed properly. However, launching with a lower amount of RAM doesn't show any physical interfaces (in this case, &lt;code&gt;ge*&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are my assumptions here accurate, or could there be something else going on that I'm now aware of?&lt;/p&gt;&#xA;" OwnerUserId="4051" LastEditorUserId="8499" LastEditDate="2016-02-23T21:58:42.833" LastActivityDate="2016-02-23T22:01:34.067" Title="Could launching a virtual router with less-than-recommened RAM cause interfaces to not initialize?" Tags="|router|juniper|juniper-junos|juniper-srx|gns3|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20282" PostTypeId="1" AcceptedAnswerId="33844" CreationDate="2015-07-29T14:23:33.243" Score="2" ViewCount="17704" Body="&lt;p&gt;We have a BT 21CN fibre connection into our firewall - it's just one patch cable into the X1 WAN port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The connection has 5 public IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For testing purposes, I need my machine, which is behind the firewall, to use one of those public IP addresses, which is not assigned to X1, as a gateway to the Internet. This is because we've set up special access rules for our default Internet IP address to one of our web servers somewhere else. There are also a few other times where this might be useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it is, our firewall only knows that the X1 has one public WAN IP address. How do I go about telling it there are several WAN IP addresses, and how on earth can I then configure a new gateway on it which I can specify manually on my workstation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do, of course, want to leave the 'default' WAN gateway well alone as we have a network full of users using it.&lt;/p&gt;&#xA;" OwnerUserId="16904" LastEditorUserId="8499" LastEditDate="2016-03-11T02:05:29.647" LastActivityDate="2016-08-08T14:43:09.690" Title="Using multiple WAN IP addresses with a Dell SonicWALL TZ 600" Tags="|routing|firewall|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20283" PostTypeId="1" CreationDate="2015-07-29T19:47:51.660" Score="1" ViewCount="74" Body="&lt;p&gt;If the subnet mask is 255.255.252.0, then would 10.10.12.1 be on the same network as 10.10.14.1? Or would they require a NAT to communicate?&lt;/p&gt;&#xA;" OwnerUserId="16911" LastActivityDate="2015-07-29T22:54:40.600" Title="Are these IPs connected on a 22 Bit Subnet?" Tags="|nat|subnet|ip|" AnswerCount="2" CommentCount="2" ClosedDate="2015-08-11T10:09:19.873" ContentLicense="CC BY-SA 3.0" />
  <row Id="20284" PostTypeId="2" ParentId="20283" CreationDate="2015-07-29T20:06:04.990" Score="2" Body="&lt;p&gt;Yes they are because when you do &lt;code&gt;and operation&lt;/code&gt; of both IPs with the subnet mask you will get the same result &lt;code&gt;10.10.12.0&lt;/code&gt; so they belongs to same network &lt;code&gt;10.10.12.0&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="14476" LastActivityDate="2015-07-29T20:06:04.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20287" PostTypeId="1" CreationDate="2015-07-29T21:17:24.953" Score="1" ViewCount="708" Body="&lt;p&gt;So, my Netgear switch died, and after factory resetting it, I noticed that I was unable to connect to it. The Netgear was configured for &lt;code&gt;192.168.0.239/24&lt;/code&gt;, and I configured my windows PC to &lt;code&gt;192.168.0.240/24&lt;/code&gt; with a default gateway of &lt;code&gt;192.168.0.1&lt;/code&gt; (just because I assumed I had to fill the DG parameter since it is Windows).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran Wireshark to sniff my laptop's interface, and I noticed the only traffic was a DHCP Discover message.  I changed the default gateway to &lt;code&gt;192.168.0.239&lt;/code&gt;, and then I was able to connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand why this is necessary. &lt;strong&gt;Since both devices (the switch and my laptop) were on the same broadcast domain, then there is no need for a default gateway&lt;/strong&gt;. Specifically, my laptop should have sent out an ARP request when I attempted to connect to the Netgear switch via HTTP, which should have been received by the switch since it would have been broadcasted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question: Am I wrong? (And this would mean my understanding of very fundamental networking is wrong?)&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="13969" LastEditorUserId="8499" LastEditDate="2016-03-26T15:51:32.820" LastActivityDate="2016-09-22T20:29:52.157" Title="Netgear switch required default gateway for point-to-point link" Tags="|arp|layer2|layer3|point-to-point|netgear-prosafe|" AnswerCount="2" CommentCount="3" ClosedDate="2017-04-23T14:23:27.127" ContentLicense="CC BY-SA 3.0" />
  <row Id="20290" PostTypeId="2" ParentId="20283" CreationDate="2015-07-29T22:54:40.600" Score="2" Body="&lt;p&gt;I find that an easy way to calculate this is if you recall your mask combinations against their powers of 2 within the binary 8 bits of an octet:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zDfLD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zDfLD.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example where you have 4 aligned to 252 (/22 mask = 255.255.252.0), then you have a range of 4 networks counting up from the network number. The octet where your mask changes from .255 will correspond to the octet of your host address.&#xA;In this instance it is in the 3rd octet so you will have a range from 10.10.12.1 - 10.10.15.255/22, so yes they are within the same subnet.&lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2015-07-29T22:54:40.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20291" PostTypeId="2" ParentId="20287" CreationDate="2015-07-29T23:15:33.770" Score="-1" Body="&lt;p&gt;You state Netgear switch however what you describe is for L3 routing.  If configured correctly the router will respond to an arp request which is broadcast onto the lan segment with the mac address of all FF's but the router will only reply with its own mac-address if the ip it finds encapsulated in the frame is configured on one of its interfaces.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are still telling your host device to send packets towards a different ip of 192.168.0.1 that effectively doesn't exist then it will not work.&lt;/p&gt;&#xA;" OwnerUserId="109" LastEditorUserId="109" LastEditDate="2015-07-30T06:11:21.420" LastActivityDate="2015-07-30T06:11:21.420" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20292" PostTypeId="1" AcceptedAnswerId="20294" CreationDate="2015-07-30T04:59:55.097" Score="1" ViewCount="444" Body="&lt;p&gt;I am working on project to establish system that can only send data (using Ethernet fakeout). Can we send ethernet frames on &quot;Unidirectional link&quot; or physical layer requires two way communication ? &lt;/p&gt;&#xA;" OwnerUserId="16916" LastActivityDate="2015-07-30T06:56:10.507" Title="Ethernet Frames on Unidirectional Link" Tags="|ethernet|" AnswerCount="1" CommentCount="0" ClosedDate="2015-08-05T21:00:00.980" ContentLicense="CC BY-SA 3.0" />
  <row Id="20293" PostTypeId="1" AcceptedAnswerId="20295" CreationDate="2015-07-30T06:53:19.153" Score="0" ViewCount="54" Body="&lt;p&gt;I'm pretty new at this so please forgive me if some parts of my explanation are lacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance for taking your time to read my question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I want to do:&lt;/strong&gt;&lt;br&gt;&#xA;Access a server from a remote terminal via an ISDN connection and windows remote access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My (simplified) environment:&lt;/strong&gt;&lt;br&gt;&#xA;The environment consists of a remote terminal an ISDN router, a switch, and a server. The remote terminal and the ISDN router will only be used to access the server and nothing else. Changing any IP or any settings on the switch are out of the question.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Remote Terminal]&#xA; 168.192.0.2/24&#xA;       |  &#xA;&quot;ISDN connection&quot;  &#xA;       |  &#xA;   [Router]  &#xA; 192.168.1.10/24  &#xA;       |&#xA;&quot;Network segment A&quot;  &#xA;       |  &#xA; 192.168.1.254/24   &#xA;    [L3 Switch]  &#xA; 192.168.2.254/24   &#xA;       |&#xA;&quot;Network Segment B&quot;  &#xA;       |&#xA;192.168.2.10/24    &#xA;    [Server]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My problem:&lt;/strong&gt;&lt;br&gt;&#xA;The switch between network segment A and B blocks all packets to and from IPs that aren't local (including the remote terminal's) so the remote terminal can't connect to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My questions:&lt;/strong&gt;&lt;br&gt;&#xA;Would a 1:1 NAT rule (168.192.0.2/24=192.168.1.10/24) set on the router be a possible choice to solve my problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would setting a NAT rule for the routers only internal IP have any caveats I should be aware of?&lt;/p&gt;&#xA;" OwnerUserId="16919" LastActivityDate="2015-07-30T07:02:03.280" Title="Could NAT solve my problem?" Tags="|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20294" PostTypeId="2" ParentId="20292" CreationDate="2015-07-30T06:56:10.507" Score="0" Body="&lt;p&gt;It is possible to have a uni-directional link - hence the need for protocols such as UDLD (Uni-directional Link Detection) and CFM (Connectivity Fault Management) on Ethernet switches to detect and remedy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Unidirectional_Link_Detection&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Unidirectional_Link_Detection&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1ag&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/IEEE_802.1ag&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to simulated this quite easily on some switches with fibre optic connections when you disconnect one of the connectors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure that this will be possible on copper links though, as a port won't come up unless auto-negotiation has succeeded, which requires bi-directional communication:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Autonegotiation&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Autonegotiation&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-30T06:56:10.507" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20295" PostTypeId="2" ParentId="20293" CreationDate="2015-07-30T07:02:03.280" Score="2" Body="&lt;p&gt;Yes, NAT should work just fine, however I don't think a 1:1 nat is what you want, because you're mapping to a real interface address on the router (your router may not let you do this, and if it did, traffic destined for the router may be inadvertently mapped to your remote terminal)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source NAT (sometimes called hide NAT) would be a better solution - translating any traffic from 168.192.0.2 to 192.168.1.10, but any traffic directed to the router would be delivered correctly.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-07-30T07:02:03.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20296" PostTypeId="1" CreationDate="2015-07-30T07:43:39.123" Score="3" ViewCount="1469" Body="&lt;p&gt;I'd like to write a proxy software to manipulate incoming and outgoing packets from/to a specific device. For incoming packets, it is easy: Add a PREROUTING iptables entry for packets going to the device's IP and route them to another IP:Port. There I can modify the packets and forward them to the real destination (my device). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what do I do with outgoing packets? When I try the following&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;iptables -t nat -I PREROUTING -p udp -s 10.0.0.10 -j DNAT --to-destination 10.0.0.20:13000&lt;/code&gt; (with 10.0.0.10 being the device I want to monitor and 10.0.0.20 my computer which monitors)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then I'll get all the packets send by the client, but I have no clue about their real destination because the destination IP in the IP header gets rewritten ...&lt;/p&gt;&#xA;" OwnerUserId="15880" LastEditorUserId="3782" LastEditDate="2015-07-30T08:04:57.003" LastActivityDate="2017-03-22T13:58:48.217" Title="iptables DNAT original destination" Tags="|routing|nat|linux|" AnswerCount="2" CommentCount="0" ClosedDate="2017-03-22T14:44:51.447" ContentLicense="CC BY-SA 3.0" />
  <row Id="20297" PostTypeId="2" ParentId="20296" CreationDate="2015-07-30T07:58:33.540" Score="0" Body="&lt;p&gt;NAT on a stateful firewall only needs one rule to match the initial connection, and takes care of the return packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only requirement is that the device that receives the final packet after the dNAT, must route the return traffic back through the stateful firewall to allow it to do the reverse NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the FW is your GW it is normally not a problem, if it is not, you could add a masquerade on the FW to also hide the src (after it changed the destination) thus forcing your PC to respond back to the FW.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="8499" LastEditDate="2015-10-28T14:27:09.340" LastActivityDate="2015-10-28T14:27:09.340" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20298" PostTypeId="1" AcceptedAnswerId="21072" CreationDate="2015-07-30T08:08:45.940" Score="1" ViewCount="473" Body="&lt;p&gt;I have 40 or 50 tunnels with over 200 SAs active on a 7204VXR with NPE-G1 using the software crypto engine (no VAS card installed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The working config was transferred over from a 2821 with AIM-VPN hardware crypto.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything was fine for a while then one day all tunnels were down and debug messages were showing &lt;strong&gt;Unable to generate DH phase I values!&lt;/strong&gt; almost identical to &lt;a href=&quot;https://supportforums.cisco.com/discussion/9547761/cannot-create-vpn-tunnel&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; unresolved issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IOS was (C7200-ADVENTERPRISEK9-M), Version 15.2(4)M4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After trying all manner of things to get it back it was ultimately a reload that resolved things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of days later the same issue occurred again, reload and then a couple of hours later again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then upgraded to the latest (C7200-ADVENTERPRISEK9-M), Version 15.2(4)M8 and it's been ok for 4 days and the issue has occurred again with a slightly different error string &lt;strong&gt;Unable to generate DH phase 2 parameters!&lt;/strong&gt;  I'm guessing they changed the string rather than it being a different error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone experienced this before or have any pointers of something that may have been missed?&lt;/p&gt;&#xA;" OwnerUserId="16945" LastActivityDate="2015-09-01T12:23:27.233" Title="All tunnels down on Cisco 7204VXR with debug message &quot;Unable to generate DH phase 2 parameters!&quot;" Tags="|cisco|ipsec|cisco-ios-15|errors|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20300" PostTypeId="1" CreationDate="2015-07-30T10:24:28.817" Score="3" ViewCount="897" Body="&lt;p&gt;I have a Cisco ASR1002 WAN router with multiple vrfs per department. Each vrf has a loopback interface on the router, which can be used as an NTP server for remote devices in the respective vrf/department.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to configure NTP authentication on specific vrfs? I do not want to enable it globally as this would entail configuring all departments to use NTP authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;J Mullan&lt;/p&gt;&#xA;" OwnerUserId="16925" LastActivityDate="2015-07-31T16:23:09.437" Title="NTP Authentication within a vrf" Tags="|cisco|vrf|ntp|vrf-lite|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20302" PostTypeId="1" AcceptedAnswerId="20309" CreationDate="2015-07-30T11:16:11.320" Score="2" ViewCount="472" Body="&lt;p&gt;I know that I can exclude a range of ip addresses from a DHCP servers pool with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address 192.168.3.1 192.168.3.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but how do I re-include these addresses into the DHCP pool?&lt;/p&gt;&#xA;" OwnerUserId="14662" LastActivityDate="2015-07-30T13:04:44.910" Title="Cisco Switch Catalyst 3750: &quot;re-include&quot; ip address in DHCP pool" Tags="|cisco|switch|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20304" PostTypeId="1" AcceptedAnswerId="20306" CreationDate="2015-07-30T11:51:54.100" Score="3" ViewCount="5834" Body="&lt;p&gt;I am connected to a distant box in my vlan using ssh (This openwrt box is in cascade with a router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I ping the default gateway, it won't work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route&#xA;Kernel IP routing table&#xA;Destination     Gateway         Genmask         Flags Metric Ref    Use Iface&#xA;default         10.14.164.126   0.0.0.0         UG    0      0        0 eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ping: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping 10.14.164.126&#xA;PING 10.14.164.126 (10.14.164.126): 56 data bytes&#xA;^C&#xA;--- 10.14.164.126 ping statistics ---&#xA;11 packets transmitted, 0 packets received, 100% packet loss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the same time traceroute is using the default gateway and it can go out to reach Internet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute google.com&#xA;traceroute to google.com (173.194.40.128), 30 hops max, 38 byte packets&#xA; 1  10.14.164.126 (10.14.164.126)  0.359 ms  0.706 ms  0.349 ms&#xA; 2  172.24.120.93 (172.24.120.93)  2.318 ms  2.809 ms  2.417 ms&#xA;..etc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like to know why the ping is not working !&lt;/p&gt;&#xA;" OwnerUserId="16927" LastActivityDate="2015-07-30T14:19:19.467" Title="Can't ping default gateway but have internet connection" Tags="|routing|router|subnet|ping|" AnswerCount="3" CommentCount="1" ClosedDate="2016-02-16T22:01:53.003" ContentLicense="CC BY-SA 3.0" />
  <row Id="20306" PostTypeId="2" ParentId="20304" CreationDate="2015-07-30T12:02:24.800" Score="3" Body="&lt;p&gt;Is your default gateway configured to respond to pings?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can ping through the DG (eg. to google.com) but can't ping it, then the routing is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="16925" LastActivityDate="2015-07-30T12:02:24.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20308" PostTypeId="2" ParentId="20304" CreationDate="2015-07-30T12:34:35.240" Score="1" Body="&lt;p&gt;Your default gateway is cofigured to block all ICMP messages including ping but to allow other traffic to cross its outside interface.&lt;/p&gt;&#xA;" OwnerUserId="14476" LastActivityDate="2015-07-30T12:34:35.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20309" PostTypeId="2" ParentId="20302" CreationDate="2015-07-30T13:04:44.910" Score="2" Body="&lt;p&gt;Simply remove the excluded-address command by negating the existing line of config:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;no ip dhcp excluded-address 192.168.3.1 192.168.3.10&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Make sure your network statement within the dhcp block of config covers these addresses in terms of the subnet mask it is using and the addresses should get assigned going fwd.&lt;/p&gt;&#xA;" OwnerUserId="109" LastActivityDate="2015-07-30T13:04:44.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20310" PostTypeId="2" ParentId="20261" CreationDate="2015-07-30T13:12:32.173" Score="1" Body="&lt;p&gt;If the DSL modem doesn't provide PPPoE pass-trough but does have a &quot;DMZ&quot; option, I.E. forwarding all incoming traffic to an internal IP, you can also use double-NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You set a fixed private IP on the WAN interface of the new router and forward all incoming traffic to it, and set another private network on the LAN side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The new router will NAT all traffic with it's WAN private IP then forward it to the DSL router which will NAT it again with the public IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.0.0.0/24 network -&gt; (0.0.0.254/24 - New router - 192.168.0.2/24) -&gt; (192.168.0.1./24 - DSL router - public IP) -&gt; the Internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that IPSEC doesn't work well with NAT, if you need it you have to enable ipsec NAT traversal.&#xA;(or you may use another kind of VPN like OpenVPN)&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-07-30T13:12:32.173" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20311" PostTypeId="1" AcceptedAnswerId="20362" CreationDate="2015-07-30T13:14:18.033" Score="5" ViewCount="755" Body="&lt;p&gt;I have a pair of ASR9k's that I plan on migrating to Juniper MX960's.  Below is a piece of the configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;l2vpn&#xA; bridge group VPLS_1&#xA;  bridge-domain 101&#xA;   interface TenGigE0/2/0/0.101&#xA;   !&#xA;   vfi 101&#xA;    neighbor 1.1.1.1 pw-id 101&#xA;    !&#xA;   !&#xA;   routed interface BVI101&#xA;  !&#xA;  bridge-domain 202&#xA;   interface TenGigE0/2/0/0.202&#xA;   !&#xA;   neighbor 3.3.3.3 pw-id 3003&#xA;    pw-class ro-7450c-1&#xA;   !&#xA;   neighbor 3.3.3.4 pw-id 3003&#xA;    pw-class ws-7450a-2&#xA;   !&#xA;   vfi 202&#xA;    neighbor 2.2.2.2 pw-id 202&#xA;    !&#xA;   !&#xA;   routed interface BVI202&#xA;  !&#xA;  bridge-domain 11&#xA;   interface TenGigE0/1/0/6.11&#xA;   !&#xA;   interface TenGigE0/2/0/0.11&#xA;   !&#xA;   vfi 11&#xA;    neighbor 11.11.11.11 pw-id 11&#xA;    !&#xA;   !&#xA;  !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where I'm confused is the multiple instances of &lt;code&gt;bridge-domain&lt;/code&gt; inside a single &lt;code&gt;bridge-group&lt;/code&gt; (I do have multiple &lt;code&gt;bridge-groups&lt;/code&gt; that aren't shown.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What purpose does each &lt;code&gt;bridge-domain&lt;/code&gt; serve &lt;strong&gt;while inside&lt;/strong&gt; a single &lt;code&gt;bridge-group&lt;/code&gt;?  Does this break the split horizon rule for VPLS?  Couldn't I just make multiple VPLS instances in JUNOS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know if anyone needs clarification.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-08-02T10:56:01.450" Title="LDP VPLS - Packet behavior within bridge-groups and bridge-domains" Tags="|cisco|juniper|mpls|vpls|pseudowire|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20312" PostTypeId="2" ParentId="20304" CreationDate="2015-07-30T14:19:19.467" Score="-1" Body="&lt;p&gt;Yep I agree ICMP message blocks are being used in this instance.&lt;/p&gt;&#xA;" OwnerUserId="16899" LastActivityDate="2015-07-30T14:19:19.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20313" PostTypeId="1" AcceptedAnswerId="20319" CreationDate="2015-07-30T14:47:07.547" Score="6" ViewCount="1846" Body="&lt;p&gt;I am currently working on MiTM attacks and defenses in a virtual environment  using GNS3 and an IOS c3725 (&lt;code&gt;c3725-adventerprisek9-mz.124-15.T14&lt;/code&gt;) image to emulate some topology.&lt;/p&gt;&#xA;&lt;p&gt;The current experiment regards CAM table overflow, and works great with a standard GNS3 switch, but when I use the c3725, the result is quite unexpected. I should be able to completely fill the CAM table on the device. However, as you can see from the following figure, it is not the case:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/X63n6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/X63n6.png&quot; alt=&quot;Attacked device: CAM table&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;There is always room &amp;quot;reserved&amp;quot;, that I cannot fill. As I need STP and some other protocols, I cannot use the regular GNS3 switch. There is no security enabled on the device. Is there a native security feature, setting, or anything I am no aware of?&lt;/p&gt;&#xA;&lt;p&gt;Thanks for your help!&lt;/p&gt;&#xA;" OwnerUserId="16931" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-07-01T13:56:22.540" Title="How to run a CAM Table Overflow attack in GNS3 using Cisco 3725 routers?" Tags="|cisco-ios|gns3|mitm|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20314" PostTypeId="1" AcceptedAnswerId="20317" CreationDate="2015-07-30T15:00:22.710" Score="1" ViewCount="5858" Body="&lt;p&gt;First off; I'm not a networking expert so forgive me if anything I ask here is blindingly obvious, or I use the terminology incorrectly :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My company has recently moved office to a new building where internet access is included in the rent. However, from what I can gather all machines in the building simply connect to one big switch (I can see lots of unknown machines on the network, and presumably they can also see our machines).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the record, we have about six Windows 7 machines, a Windows Server 2008 machine and some printers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to create an isolated network for the company but still maintain access to the internet. How can I achieve this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a couple of off-the-shelf routers that were used in our previous office - will we need to buy additional hardware to create the setup we want (a managed switch and/or firewall, for example?)&lt;/p&gt;&#xA;" OwnerUserId="16932" LastActivityDate="2015-07-30T16:00:04.360" Title="Creating an isolated subnet" Tags="|switch|subnet|internet|lan|" AnswerCount="1" CommentCount="0" ClosedDate="2015-08-05T21:00:49.747" ContentLicense="CC BY-SA 3.0" />
  <row Id="20315" PostTypeId="1" AcceptedAnswerId="20339" CreationDate="2015-07-30T15:24:39.920" Score="2" ViewCount="606" Body="&lt;p&gt;I'm considering to set-up a hotspot(With Mikrotik RB951) in a place that has 4 floors so I should extend the wireless signal. &#xA;I bought 4 wireless Routers (TP-Link WR841HP) That I want to put in each floor (200 square-meter) and I need roaming as well. &#xA;with two solutions, I can implement it :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;by cabling the routers together    &lt;/li&gt;&#xA;&lt;li&gt;using WDS&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;it is better that I cabling but performance is more important.&#xA;less that 200 users use this hotspot to connect max 8Mbps internet connection. &#xA;My questions listed below :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Apparantly WDS is not wifi Certified and it has come with some issues. does it mean I cannot trust this protocol? (by knowing that all router are the same)&lt;/li&gt;&#xA;&lt;li&gt;If my first (main) router is in the first floor and I want to connect fourth floor router to it, can I just connect it to the third floor and it direct me to the main router (1st) or I should see the signal of first router directly? if I can how about performance?&lt;/li&gt;&#xA;&lt;li&gt;comparison between these solutions?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would appreciate if you help me to find a good practice? &#xA;Tnx&lt;/p&gt;&#xA;" OwnerUserId="16934" LastEditorUserId="8499" LastEditDate="2018-02-14T16:43:55.663" LastActivityDate="2018-02-14T16:43:55.663" Title="Comparison between WDS and Wired Router" Tags="|router|wireless|ieee-802.11|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-09T23:50:05.123" ContentLicense="CC BY-SA 3.0" />
  <row Id="20317" PostTypeId="2" ParentId="20314" CreationDate="2015-07-30T16:00:04.360" Score="3" Body="&lt;p&gt;There is several different approaches you could take. The best solution depends on your needs. In my answers I assume that your office has wall-mounted ethernet sockets, that currently connect directly to the central switch(es).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can use one of your off-the-shelf routers and configure it to provide a different subnet on it's LAN interfaces, connect it's WAN interface to one of the ethernet sockets in the office, and run your own cabling to the PCs in your office (or alternatively have them connect wirelessly).&lt;/li&gt;&#xA;&lt;li&gt;If you have access to the networking equipment in the building, you can buy a new switch and router, and have it set up alongside the other equipment. Then it's a simple matter of moving the patch cables in the switching rack from the old switch to your new one. Usually a switching rack will have a few patch panels where you can connect a patch cable from a switch to one of said patch sockets, that will then connect to one of the ethernet sockets in the office. These are usually labelled both on the wall socket and on the patch panel.&lt;/li&gt;&#xA;&lt;li&gt;You could have whoever currently administers the networking equipment create a separate VLAN for your office on the existing switch, and configure the existing router to serve a new subnet only to that VLAN.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the most control over your networking environment, I'd say get your own switch and router in the rack and have the ISP assign you a new public IP for your office only. But then, it really depends on your needs.&lt;/p&gt;&#xA;" OwnerUserId="16936" LastActivityDate="2015-07-30T16:00:04.360" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20319" PostTypeId="2" ParentId="20313" CreationDate="2015-07-30T17:19:21.707" Score="7" Body="&lt;p&gt;Well, you're hitting that space where emulation and physical world interconnect. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First, let us cover the basics&lt;/strong&gt;: 3725 is a router, and it has some limited switching capabilities, because it could (in real world) use switching modules, and the switching code was needed in IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you write 'standard GNS3 switch' I assume you mean NM-16ESW module emulated by the dynamips? If so, that's exactly the module and code you're using anyway with 3725.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For any security type of testing, including CAM exhaust attacks and even port security, I'd do testing only in real environment. Emulated/interpreted in run time setup doesn't always provide the same (or repetable) results for multiple of reasons, and it's plainly visible in any time-bound features, like QoS and some parts of security mechanisms (that count on proper timing and order of events triggering in IOS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now, going back to your question&lt;/strong&gt;: there are two parts of answer:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;First, the code that manages the CLI output for &quot;software switching&quot; IOS code that was added back when the NM-16ESW was introduced, underwent a lot of changes during the product lifetime. One of the extensions was to add 'backpressure' to allow faster MAC aging when there's flood of new addresses, the same code was also present in the standalone switches of that time (Catalyst 2950 and later models - 2960, 3560 and 3750). You may be hitting this exact feature, as you're using pretty new IOS (12.4(15)T). So, the switch may simply fast-age old MACs that it didn't saw any traffic to/from, and install new entries you're flooding - how fast BTW is your flood?&lt;/li&gt;&#xA;&lt;li&gt;The other part of the answer is that this command was fixed multiple times as it wasn't always giving current situation, but some older, cached one gathered from the ASICs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Again, doing that kind of testing with simulated environment just pushes it too far, I'd go back to some hardware setup and test/lab it to reflect real scenario. Even if you hit success, you may not be able to repeat it in predictable manner later on.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="286" LastEditDate="2015-07-30T18:39:37.853" LastActivityDate="2015-07-30T18:39:37.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20320" PostTypeId="1" AcceptedAnswerId="20321" CreationDate="2015-07-30T18:06:31.673" Score="1" ViewCount="736" Body="&lt;p&gt;This is probably a two- or three-part question. Let's set a sample environment first:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;We're using one AP&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One 2x2 radio antenna&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Omnidirectional&lt;/li&gt;&#xA;&lt;li&gt;802.11n (2.4GHz)&lt;/li&gt;&#xA;&lt;li&gt;Up to 30 client devices&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Mounted to suspended ceiling; center of the room&lt;/li&gt;&#xA;&lt;li&gt;No 2.4GHz interference is occurring&lt;/li&gt;&#xA;&lt;li&gt;A threshold RSSI of -65dBm is set for clients in order to associate&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Signal has been measured and shows that coverage is guaranteed up to 40ft&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Clients use the same USB Wi-Fi dongle (802.11n)&lt;/li&gt;&#xA;&lt;li&gt;SSID is open, no authentication&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Assume five devices are initially associated with the AP:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;two are under 8 feet away (-35dBm RSSI)&lt;/li&gt;&#xA;&lt;li&gt;two are around 15 feet away (-46dBm RSSI)&lt;/li&gt;&#xA;&lt;li&gt;one device failed to connect 42 ft away (-68 dBm). They are now sitting at 37 ft away (-62 dBm RSSI) and have associated &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Everything is within spec and OK.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;We know that as a client device moves further away from the AP their throughput rate will decrease. We also know that as multiple clients connect to the AP their bandwidth will decrease since it shared across all devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, assume ten clients entered the network and settled within 10 feet of the AP.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Would the furthest client see a dip in its RSSI? Would this be more drastic if the density of clients moved even closer to the AP?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;e.g. Has our effective range dropped to some measurement below 40ft?&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Does the throughput/transmit rate (not bandwidth) of the furthest client drop as the number of clients increases? If so, is this impacted more severely as the density of clients moves closer towards the AP?&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="14048" LastActivityDate="2015-07-30T18:48:52.177" Title="Wireless throughput decreases over distance. Does the signal's effective range decrease as more clients connect?" Tags="|wireless|throughput|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20321" PostTypeId="2" ParentId="20320" CreationDate="2015-07-30T18:48:52.177" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Would the furthest client see a dip in its RSSI? Would this be more&#xA;  drastic if the density of clients moved even closer to the AP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The position of other clients has no influence on the received signal strength indicator unless they are attenuating the signal by obstructing it etc. and therefore causing the client to receive a weaker signal.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does the throughput/transmit rate (not bandwidth) of the furthest&#xA;  client drop as the number of clients increases? If so, is this&#xA;  impacted more severely as the density of clients moves closer towards&#xA;  the AP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The Tx rate of a client may drop if the signal to noise ratio is degraded, or if airtime consumption increases.  A high density of clients moving closer to the AP may improve performance since they may make more effective use of the airtime, by utilising more efficient modulation at higher data rates.&lt;/p&gt;&#xA;" OwnerUserId="798" LastActivityDate="2015-07-30T18:48:52.177" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20322" PostTypeId="1" AcceptedAnswerId="20327" CreationDate="2015-07-30T19:53:25.580" Score="0" ViewCount="3423" Body="&lt;p&gt;I always thought the Interface VLAN number had to match the VLAN number that the interface was to belong to. However, recently I saw that it isn't in one instance. Can anyone confirm a) if interface VLAN num should = VLAN num, or b) they are mapped to each other in another way? They've always worked properly when I gave them the same number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Confusing Example:&#xA;          PC&amp;lt;---&gt;[L2 Switch]&amp;lt;----&gt;[L2/L3 Switch] ---&gt; Cloud&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC is connected to VLAN10 access port on L2 switch. PC IP is 192.168.200.5/24. PC gateway is 192.168.200.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L2 switch is connected to L2/L3 switch over trunk containing VLAN 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L2/L3 switch has Interface VLAN 20 with the IP 192.168.200.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PC can communicate with the gateway and the rest of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, Interface VLAN 20 can be a part of VLAN 10?!?!?! I thought the numbers had to match and the SVI&amp;lt;-&gt;VLAN = 1:1.&lt;/p&gt;&#xA;" OwnerDisplayName="user16942" LastActivityDate="2015-08-31T13:30:38.717" Title="Does Interface VLAN number have to match the VLAN number that the SVI belongs to?" Tags="|vlan|" AnswerCount="2" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20323" PostTypeId="1" AcceptedAnswerId="20341" CreationDate="2015-07-30T21:09:39.280" Score="0" ViewCount="583" Body="&lt;p&gt;Is there a way to encode the data sent over 4 ethernet cables into one cable and then decode them back to 4 cables?&#xA;I'm trying to send many ethernet cables over a long distance on one cable and then getting back the 4 cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application I'm working on forces me to get the cables back because I have some converted USB signals that I need to convert back to USB after receiving the Ethernet signal.&lt;/p&gt;&#xA;" OwnerUserId="16943" LastActivityDate="2015-07-31T15:26:25.193" Title="Encoding and decoding ethernet" Tags="|ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20324" PostTypeId="1" CreationDate="2015-07-30T21:15:23.177" Score="3" ViewCount="287" Body="&lt;p&gt;I wanted to understand how redundancy works when we implement Frame Relay to connect between different office locations. Consider the &lt;a href=&quot;https://drive.google.com/file/d/0B35koXMc7gZReHdUb1BnVnlVRkE/view&quot; rel=&quot;nofollow&quot;&gt;topology&lt;/a&gt; here I have two sites A and B each has a pair of Routers (R1, R2), (R3, R4) each belonging to each site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1, R2 pair is connected to R3, R4 pair over Frame relay such that R1 can connect to R3 (via dlci 103) and R4 (via dlci 104) similarly R2 can connect to R3 (via dlci 203) and R4 (via dlci 204) and vice versa using point to point links, all the routers R1 through R4 belongs to same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the internal network of R1, R2 pair they are running HSRP for redundacy similarly R3 and R4 as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is in such a scenario where R1 or R2 fails how does R3 or R4 route the traffic which is meant for R1/R2 network (I understand we can use Routing protocols such as EIGRP to detect if R1/R2 are down). Is there any other parameters we consider apart from routing protocols?&lt;/p&gt;&#xA;" OwnerUserId="16944" LastActivityDate="2017-07-20T09:16:33.463" Title="Redundancy with Frame Relay" Tags="|wan|frame-relay|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20325" PostTypeId="2" ParentId="20324" CreationDate="2015-07-30T21:49:57.737" Score="1" Body="&lt;p&gt;A router failure is a clean down/down scenario whereby routing protocols will handle updating of reachability and HSRP will take care of routing for the local subnet(s) as well as provide the WAN connectivity to the remote site.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-07-30T21:49:57.737" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20327" PostTypeId="2" ParentId="20322" CreationDate="2015-07-31T00:42:49.463" Score="3" Body="&lt;p&gt;Yes, the layer 2 VLAN ID must match the layer 3 SVI interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be proxy ARP at work. (On by default in most if not all 6500 code)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at the ARP table on the PC and the MAC address that corresponds to, presumably on the 6500.  If that MAC is for the VLAN 10 interface and that interface doesn't have the 192.168.200.1 address then it's proxying it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;no ip proxy-arp&quot; under the VLAN 10 interface would disable this behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, something else has the .1 IP and you're hitting that.  The ARP table on the PC would be the first place to look.&lt;/p&gt;&#xA;" OwnerUserId="8079" LastActivityDate="2015-07-31T00:42:49.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20330" PostTypeId="2" ParentId="20104" CreationDate="2015-07-31T06:24:40.483" Score="1" Body="&lt;p&gt;Can you run the following on your ASA please:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;// Enable all capturing for all asp drops&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA# capture asp-drop type asp-drop all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;// Show capture buffer which should identify why the handshake is failing&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA# sh capture asp-drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Should show something similar to the following but for your specific kind of drop:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   2 packets captured&#xA;   1: 15:15:00.682154 197.2.1.29.2616 &amp;gt; 87.200.42.101.443: S 1239395083:1239395083(0) win 65535 &amp;lt;mss 1260,nop,nop,sackOK&amp;gt; Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;   4: 15:15:00.750830 10.70.0.162.3812 &amp;gt; 168.252.3.41.15: S 3523756300:3523756300(0) win 65535 &amp;lt;mss 1360,nop,nop,sackOK&amp;gt; Drop-reason: (rpf-violated) Reverse-path verify failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that one basic rule for the ASA is that to initiate traffic from a lower-security interface(Outside) to a higher security interface(Inside) there must be a explicit ACL entry to allow this traffic through. Without seeing your ASA configuration it is hard to tell what could be causing the problems. &lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2015-07-31T06:24:40.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20332" PostTypeId="1" CreationDate="2015-07-31T08:53:27.797" Score="0" ViewCount="214" Body="&lt;p&gt;I have a connection of 500Mbps. I clock speeds of 460-480Mbps when plugged in (Ethernet, Cat5e).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I’m on Wi-Fi (even positioned above the router, 5GHz dual-channel 802.11ac) I clock speeds of only 260-280Mbps on an iPhone 6 (802.11ac).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is if I double my ISP connection to 1000Mbps, will the max. Wi-Fi speed of 260-280Mbps I get on my iPhone 6 double or stay the same?&lt;/p&gt;&#xA;" OwnerUserId="16955" LastActivityDate="2015-08-04T02:47:51.340" Title="If I double ISP speed will it double Wi-Fi speed?" Tags="|wireless|ieee-802.11|speed|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20333" PostTypeId="2" ParentId="20332" CreationDate="2015-07-31T11:05:52.000" Score="1" Body="&lt;p&gt;No. Not at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The speeds you get are the ones you are getting thru your network. By increasing the speed of your WAN, you are not incresing the bandwidth in your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine a funnel: If the funnel has a width of 2 cm and you are dumping 50 liters of water into it, water will still only flow thru those 2 cms. If you dump 2000 liters into it, it will still flow 2 cms. The only way to see a difference is increasing those 2 cm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if you have a funnel that is 10000km width (obviously exageration) and dump 50 liters, you will get that speed. But if you dump 50000 liters, you will obviously see a higher flow and speed of water.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that clears it up.&lt;/p&gt;&#xA;" OwnerUserId="6161" LastActivityDate="2015-07-31T11:05:52.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20336" PostTypeId="1" AcceptedAnswerId="20340" CreationDate="2015-07-31T12:02:42.357" Score="2" ViewCount="644" Body="&lt;p&gt;&lt;strong&gt;What I want to do:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's small business network setup. I need two separate LANs (LAN1 for developers, LAN2 for marketing and managers). A wifi access is also needed. All network should have access internet. The security policies are as follow: 1- LAN1 host cannot see or communicate with LAN2 hosts. 2- LAN2 can communicate with LAN1 hosts and read or write on their disks. 3- WLAN has only internet access and no access no any LANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;AS the first solution:&lt;/strong&gt; I though of using a &lt;strong&gt;L2&lt;/strong&gt; manageable switch (like D-Link DGS-1210-28 (L2) or D-Link DGS-3620-28SC (L3)) and create two VLANs on it by port-based VLANs. Then use a simple ADSL wifi modem-router (like asus rt-n66u or cisco RV series routers) to share internet and create WLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But I have few questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Doest this work? IF yes, the routing between two VLANs is performed by L2 switch itself? can I set those security rules on VLANs using the switch configuration?&lt;/li&gt;&#xA;&lt;li&gt;Or I should go for buying a more advanced router and create the two real LANs?&#xA;I have also budget problem. So a less expensive solution which works is best for me.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Many thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PS:&lt;/strong&gt; I don not if I should mention that there will be a HP server and NAS storage probably on LAN1.&lt;/p&gt;&#xA;" OwnerUserId="16950" LastActivityDate="2015-07-31T14:44:58.403" Title="Routing policies between VLANs by L2 switches" Tags="|cisco|switch|router|vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20337" PostTypeId="2" ParentId="20332" CreationDate="2015-07-31T12:02:48.330" Score="0" Body="&lt;p&gt;&lt;strong&gt;This answered the title, not the OPs actual question. Look to the edit at the bottom for the direct answer to OPs question.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, it could, just indirectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Technically the answer is no, because the wireless devices you have (let's assume wireless 802.11N) are all communicating at that protocols fastest speed already. Which can be anywhere between 50-300Mbps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if your ISP was previously at 10Mbps and you were trying to download something from the Internet, not from another device connected to your LAN, it will be stuck downloading at 10Mbps even though your wireless is capable of higher speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you upgraded your ISP speed, let's say to 50 Mbps, you are now able to download that much faster, over the wireless too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But keep in mind, your wireless speed isn't technically getting faster, just your ISP speed. But because your speed is determined by the slowest point in the network, (in this case your ISP speed) then anything you do over your wireless network accessing the Internet will be faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is only true of course if your ISP is the slowest link in the network. If your devices are performing at their spec protocol speed and that speed is less then your ISP speed, these rules do not apply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: after reviewing the question in its entirety, the answer is no. Your iPhones speed is now limited to that speed not because your ISP speed but your wireless setup that you have. Adding a faster, better router might help, testing on a non iPhone 6 might also show different results. It's possible that if you tested this on a full fleged laptop that you might see sub 500mbps speeds. At this point, your ISP speed is absolutely not a factor in getting your wireless devices to talk faster to the router.&lt;/p&gt;&#xA;" OwnerUserId="16957" LastEditorUserId="16957" LastEditDate="2015-07-31T12:10:32.467" LastActivityDate="2015-07-31T12:10:32.467" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20339" PostTypeId="2" ParentId="20315" CreationDate="2015-07-31T14:38:46.530" Score="1" Body="&lt;p&gt;Maybe this will help you &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Wireless_WDS_Mesh&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Wireless_WDS_Mesh&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I prefer cabling everything and use Wifi strictly for user's traffic not 'backbone' traffic, thus eliminating any lost performance due to that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Forget connecting routers from first floor to forth floor wirelessly. It will never work properly when you have tons of concrete and metal in between.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use ethernet to connect all routers together. Also, while maybe desirable, you don't need to connect everything to the main router. You can 'daisy chain' the boards together from one floor to another to reduce the cabling, and use bridges to make everything look as if they where all connected to a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding WDS, I've never had a problem with it, but I haven't used it extensively either. Since you are using Mikrotik on all routers/access points you won't have any compatibility issues. WDS works just fine on Mikrotik.&lt;/p&gt;&#xA;" OwnerUserId="1418" LastActivityDate="2015-07-31T14:38:46.530" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20340" PostTypeId="2" ParentId="20336" CreationDate="2015-07-31T14:44:58.403" Score="2" Body="&lt;p&gt;An L2 device can not route, so no, inter-vlan routing can not occur on it directly, and aggregating the VLANs on the modem would require that the modem device can trunk and route VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd recommend getting a used cheap Cisco L3 (or equivalent) switch, enable inter-vlan routing, and create VLAN Access Control Lists to define who can see what from where. You'd have three VLANs... marketing, dev and WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'd allow both VLANs access to WAN (stateful), marketing/management stateful access to dev, and block all inbound from dev to marketing (and likewise block WAN to either internal).&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-07-31T14:44:58.403" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20341" PostTypeId="2" ParentId="20323" CreationDate="2015-07-31T15:26:25.193" Score="3" Body="&lt;p&gt;If I understand what you are asking for then you could do the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create 4 different vlans in two different switches trunk them over the one cable that you have available. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Architecture would look like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;---4 Ethernet connections - switch(A) with 4 vlans - single Ethernet trunk connection - switch(B) with same 4 vlans - 4 Ethernet connections ---&lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-07-31T15:26:25.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20342" PostTypeId="2" ParentId="20300" CreationDate="2015-07-31T16:23:09.437" Score="1" Body="&lt;p&gt;The NTP server can't force clients to use authentication, and will gladly serve up NTP to clients not using authentication.  The NTP client determines whether or not authentication is used.  If the NTP client wants to use authentication, the NTP server must have the authentication key configured, else the NTP client will refuse to accept NTP from the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for this is that it is only important to the NTP client that the NTP data are correct.  By configuring NTP authentication on a router, you are configuring it to use authentication as an NTP client, not an NTP server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish NTP authentication be used on some NTP clients, you must configure the NTP key on the router that is the NTP server, but this will not, and cannot, require any NTP client to use NTP authentication.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-07-31T16:23:09.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20345" PostTypeId="1" CreationDate="2015-07-31T21:57:00.353" Score="1" ViewCount="94" Body="&lt;p&gt;I recently had two switches from different vendors, one was an HP 5412 Chassis running ProCurve and the other is an Alcatel 4-Switch stack, have a LACP misconfiguration which brought down a portion of the network via a switching loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LACP configurations were correct at first, but one of the switches (Alcatel stack) was restarted for maintenance, and the startup configuration was not saved correctly. This meant that the traffic was not handling 802.1q tagged packets on the correct VLANs and were all on the native VLAN (in this case, VLAN 2). The other side, however, attempted to negotiate LACP and, since there is no spannign tree within the network (not my design, I assure you), it created a switching loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is why LACP does not detect this mis-match and automatically disable the ports? Or rather why is it allowed to forward traffic if it has not negotiated a LACP LAG?&lt;/p&gt;&#xA;" OwnerUserId="3836" LastActivityDate="2015-07-31T23:20:54.787" Title="Half-Open LACP Implications" Tags="|hp|ieee-802.1ax|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20346" PostTypeId="1" AcceptedAnswerId="20348" CreationDate="2015-07-31T22:53:50.990" Score="4" ViewCount="310" Body="&lt;p&gt;I've currently got a network setup like this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 1&#xA;2 cable modems -&gt; Peplink Load Balancer 1 -&gt; 192.168.4.0/24 for wifi and clients&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 2&#xA;1 connection from the Peplink + Fiber -&gt; Peplink Load Balancer 2 -&gt; 192.168.0.0/24 for all wired clients and phones&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want drop one of the cable modems and get everything on one router and use vlans to segregate everything. I'd like the phones on one vlan or subnet, wifi on another, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I built this network I was in a rush to get it done quick so I did it like this and its been fine. The problem is that we are running out of ips on both networks. The issue though, is that I dont think I can get a budget large enough to replace all of my unmanaged switches at once. We have a bunch of little 8 port switches through out the office and not everything runs back to the network room.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the routers is a 100mb max thoroughput and the other is a gigabit balance one. We have 150/50 cable now and we really dont need 2 cable modems that we got when we could only get 50/1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct that I will need to replace every single network switch if I want to have this happen? How would you approach making this network more efficent? &lt;/p&gt;&#xA;" OwnerUserId="10008" LastActivityDate="2015-08-01T00:47:01.653" Title="Moving to vlans from a basic network" Tags="|vlan|lan|load-balancer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20347" PostTypeId="2" ParentId="20345" CreationDate="2015-07-31T23:20:54.787" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;[W]hy LACP does not detect this mis-match and automatically disable the ports?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because LACP doesn't do that.  If a port fails to setup a LAG, the ports function as normal ports.  I am unaware of any switches that can be configured to &quot;require&quot; LACP.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-07-31T23:20:54.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20348" PostTypeId="2" ParentId="20346" CreationDate="2015-08-01T00:47:01.653" Score="3" Body="&lt;p&gt;If the problem is MOSTLY running out of addresses, all you need to do is move to larger subnets - go from /24 to /22 and you have 4x (+6) the addresses you had on /24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to move to VLANs you will need to replace some or all switches - whether that's &quot;some&quot; or &quot;all&quot; depends on the other infrastructure you have - if a &quot;dumb switch&quot; and its connected clients are all on the same VLAN, you don't have to replace it, you just need to make sure that the VLAN-Capable switch port it connects to (or connects to, eventually) has the proper VLAN as its PVID so that untagged traffic becomes traffic in the correct VLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the described setup you already have two different networks running separately, so only the new criterion of separating the phones from the wired clients would seem incompatible with &quot;each dumb switch is within a single VLAN&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is insufficient information about how the current network is laid out to know what must be replaced to achieve the end goal stated. But you may not have to replace all the little dumb switches, at least not in one fell swoop.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-08-01T00:47:01.653" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20351" PostTypeId="1" CreationDate="2015-08-01T17:02:27.523" Score="1" ViewCount="1804" Body="&lt;p&gt;Is there a way to make the Fortigate 60D act as a VPN &lt;em&gt;client&lt;/em&gt; connecting to an ASA IPSec VPN without setting up a site-to-site VPN? In other words, have the Fortinet act as a typical PC would connecting to a VPN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, could anyone provide guidance?&lt;/p&gt;&#xA;" OwnerUserId="646" LastActivityDate="2015-08-01T23:08:22.177" Title="Fortinet 60D acting as IPSec VPN Client?" Tags="|vpn|ipsec|fortinet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20355" PostTypeId="2" ParentId="20351" CreationDate="2015-08-01T23:08:22.177" Score="2" Body="&lt;p&gt;Yes, one of the ways to set up an IPsec VPN is to create a &quot;dial-up VPN&quot;. This is exactly the same as what a (software) VPN client does.&lt;br&gt;&#xA;The exact configuration steps depend on the version of FortiOS you're using (v4.3, v5.0, v5.2). If v5.2, you could use the VPN assistant which guides you through the steps necessary (phase1, phase2, policy - no routes). But even doing it manually in the CLI is not difficult. Get the &quot;FortiOS Cookbook&quot; from docs.fortinet.com where you find lots of real world example setups.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully you have a good reason to try to do it this way. Cisco VPN usually uses a self-configuration mode for VPN clients (modconfig). FortiOS supports this but probably only by enabling it in the CLI.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2015-08-01T23:08:22.177" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20356" PostTypeId="2" ParentId="17030" CreationDate="2015-08-02T00:48:17.610" Score="5" Body="&lt;p&gt;Signaling defines method (voltage, current, RF, light) will be used to represent a 1 or 0. For example; if I say a 1 is 5 volts and a 0 is 0 volts, this is signaling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Encoding is how the 1s and 0s will be used. For example; if I say a 1 means &quot;On&quot; and a 0 means &quot;Off&quot;, this is encoding.&lt;/p&gt;&#xA;" OwnerUserId="16979" LastEditorUserId="8499" LastEditDate="2016-07-05T05:04:47.950" LastActivityDate="2016-07-05T05:04:47.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20357" PostTypeId="2" ParentId="16795" CreationDate="2015-08-02T01:16:53.317" Score="0" Body="&lt;p&gt;Bandwidth (technically speaking), is the amount of data the physical media can carry.  A physical media will have at least 1 channel, but can have more than 1 channel, for example 2 channels on 1 media (copper wire).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each channel will have its own channel-bandwidth (throughput).  The combined throughput of all the channels on that media is the media-bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VLAN is a layer 2 (Data-link layer) feature &amp;amp;/or function.  Interface-VLAN is a layer 3 (Network layer) feature &amp;amp;/or function.  There is a difference that most text books do not specifically/directly address.&lt;/p&gt;&#xA;" OwnerUserId="16979" LastActivityDate="2015-08-02T01:16:53.317" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20358" PostTypeId="1" AcceptedAnswerId="20364" CreationDate="2015-08-02T07:28:52.130" Score="4" ViewCount="229" Body="&lt;p&gt;Got a question about ethernet capacity that I'm unsure of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moving into a new office, and a problem I phase is that there is only 1 ethernet wall plug on the complete floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So only way would be to put a router/wifi network there and then have 30 workstations run on that ( add printers, mobile phones, etc etc ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first question is a noob : one single ethernet plug can handle with no problem almost a complete (almost) network? ( maybe 100 IP addresses out of 255 ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess I'm doing the same at home where I also only have 1 plug, but a bit more units here that are why I'm interested in what the problems are with this, maybe what ways to consider making a stable network based on this single socketor floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And since I probably have to do wifi, is there any units that can go from wifi-&gt; ethernet? For the places on the floor where I would need an extra physical ethernet slot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could put up an access point and use the slots in that I guess, but am so afraid of creating a networking monster that becomes unreliable.&lt;/p&gt;&#xA;" OwnerUserId="16986" LastEditorUserId="42290" LastEditDate="2017-12-14T08:08:50.580" LastActivityDate="2017-12-14T08:08:50.580" Title="One ethernet plug, one floor ( 30 workstations )" Tags="|ethernet|ieee-802.11|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20359" PostTypeId="1" AcceptedAnswerId="20360" CreationDate="2015-08-02T07:39:13.240" Score="1" ViewCount="658" Body="&lt;p&gt;what is the exact difference between network architecture and network design?&#xA;can I call the whole company network design as a network architecture.?&#xA;why network architecture needed?&lt;/p&gt;&#xA;" OwnerUserId="6195" LastActivityDate="2015-08-03T18:44:48.973" Title="what is a Network Architecture" Tags="|design|network-core|architecture|" AnswerCount="2" CommentCount="0" ClosedDate="2015-08-05T06:37:27.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="20360" PostTypeId="2" ParentId="20359" CreationDate="2015-08-02T09:44:38.687" Score="2" Body="&lt;p&gt;I tend to think of a network architecture as spelling out what it is you want to achieve with the network (linking together discrete areas of functionality/locations in a business) - and is written in a way that a non-technical person can understand it.  It will talk more about functionality (connect to AWS, fail-over between data centres, security zones etc) than necessarily how this functionality will be achieved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, a network design is more the nuts and bolts you will use to make the architecture happen (specific devices you use, routing protocol configuration, firewall rules etc.) and is targeted at a technical audience.  I tend to work on the principle that the network design should contain enough detail that a Network Engineer should be able to take the design and build the complete network from just your document.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the purpose of the architecture, it's to capture the business requirements of the network without going into detail as to exactly how they are going to be achieved.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I like the phrase &quot;Architecture is about doing the right things, Design is about doing things right&quot;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-08-02T09:44:38.687" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20361" PostTypeId="2" ParentId="20166" CreationDate="2015-08-02T10:30:39.190" Score="1" Body="&lt;p&gt;It's not necessarily true all user traffic will go through the root before reaching its destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each switch or vlan will just have one best path to get to the root. If you set is up and look at each path you will see where the &quot;tree&quot; comes from in STP.&lt;/p&gt;&#xA;" OwnerUserId="15842" LastActivityDate="2015-08-02T10:30:39.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20362" PostTypeId="2" ParentId="20311" CreationDate="2015-08-02T10:56:01.450" Score="3" Body="&lt;p&gt;My background is mostly from the Junos side, but I think you are correct in your assumptions - your configuration is best served by multiple VPLS instances - particularly since there are multiple &lt;code&gt;vfi&lt;/code&gt; statements, each with distinct pseudowire neighbors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to the purpose of the &lt;code&gt;bridge group&lt;/code&gt; statement on the ASR, after much trawling, I came across the following link:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/asr-9000-series-aggregation-services-routers/116500-problemsolution-product-00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/routers/asr-9000-series-aggregation-services-routers/116500-problemsolution-product-00.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The Bridge Group (BG) is a non-functional configuration hierarchy that ties several &#xA;BDs together in part of the same functional group.  It functions just as the &#xA;creation of multiple individual groups with their domains does, as opposed to one &#xA;group with multiple domains.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I read that as it being 'decorative' ;)&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-08-02T10:56:01.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20363" PostTypeId="2" ParentId="11399" CreationDate="2015-08-02T11:00:34.823" Score="4" Body="&lt;p&gt;A VPLS does not map IP addresses - it is a Layer 2 service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you may be seeing in command output is MAC addresses mapped to the IPs of the specific remote PEs they were learnt from.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-08-02T11:00:34.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20364" PostTypeId="2" ParentId="20358" CreationDate="2015-08-02T12:39:02.737" Score="1" Body="&lt;p&gt;&lt;strong&gt;You can add a &lt;em&gt;32 port switch&lt;/em&gt;. 1 port connects to the cable from the wall, the other ports connect to your devices.&lt;/strong&gt; &lt;br/&gt;&#xA;By adding the switch in your office space instead of connecting back to larger building switch, you would be creating your own network that simply connects to another via the Ethernet cable. The fact remains that you are in the same logical space/IP address range, so everything should talk to each other without causing any problem.&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The drawback is everything talks back to the rest of the network over one wire, limited to the port speed, instead of the switch speed, so your devices will &lt;strong&gt;share&lt;/strong&gt; a gigabit cable back to your router.&#xA;So in order to connect to space outside office in reliable manner you have to have really fast Ethernet connection coming into your office.&lt;/p&gt;&#xA;" OwnerUserId="16916" LastActivityDate="2015-08-02T12:39:02.737" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="20366" PostTypeId="1" AcceptedAnswerId="20978" CreationDate="2015-08-02T15:31:30.080" Score="1" ViewCount="8057" Body="&lt;p&gt;I have a failing Cisco ASA 5505 that is being replaced under a support contract. It is a single-point-of-failure in production at a branch office that can tolerate downtime.  I will physically replace the device at that site myself.  Prior to the hardware failure the configuration was just fine.  My goal is to get back to the working state prior to the hardware failure.&lt;/p&gt;&#xA;&lt;p&gt;While I have worked a fair amount with Cisco ASAs, I have never had to perform a hardware replacement so this is new territory for me.  What I am looking for is a checklist, &amp;quot;runbook&amp;quot;, or procedure to serve the following purpose:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Help to ensure I don't miss some critical configuration step.&lt;/li&gt;&#xA;&lt;li&gt;Help to avoid some critical configuration error.&lt;/li&gt;&#xA;&lt;li&gt;Aid in advance preparation to reduce the downtime while the hardware swap takes place.&lt;/li&gt;&#xA;&lt;li&gt;Provide some advance insight into how long this is likely to take.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Off the top of my head the following things that I ought to consider come to mind:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Document cable connections.&lt;/li&gt;&#xA;&lt;li&gt;Export the current &lt;code&gt;running-config&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Document the old ASA's firmware version.&lt;/li&gt;&#xA;&lt;li&gt;Change the new ASA's firmware to the same version as the old one.&lt;/li&gt;&#xA;&lt;li&gt;Do admin passwords need to be set separately from the config?&lt;/li&gt;&#xA;&lt;li&gt;Where are VPN user passwords stored?&lt;/li&gt;&#xA;&lt;li&gt;What about certificates?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Things start to get pretty vague near the bottom of that list.  I also feel like I might be missing some important items entirely.&lt;/p&gt;&#xA;&lt;p&gt;What are all the things that need to be done when replacing failed Cisco ASA hardware?&lt;/p&gt;&#xA;" OwnerUserId="2662" LastEditorUserId="85262" LastEditDate="2022-09-23T16:10:38.003" LastActivityDate="2022-09-23T16:10:38.003" Title="Is there a checklist for replacing failed ASA hardware?" Tags="|cisco-asa|hardware|" AnswerCount="3" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="20368" PostTypeId="1" AcceptedAnswerId="20372" CreationDate="2015-08-02T17:07:46.363" Score="1" ViewCount="5167" Body="&lt;p&gt;I just got some already configured switches that are giving a lot of problems on the network with port shutdowns due to storm control policies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally after dumping the running-config. I've saw extremely tight broadcast and multicast storm control policies, as low as 2 percent on a distribution switch, even on the trunk ports.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/1&#xA; speed 100&#xA; storm-control broadcast level 2.00&#xA; storm-control multicast level 2.00&#xA; storm-control action shutdown&#xA; no cdp enable&#xA; spanning-tree portfast&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those are the configurations on &lt;strong&gt;all&lt;/strong&gt; switchports of a 2960 model, and as I said, those guys act as a distribution switch, so some ports are plain access ports and others have switches attached to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole point here is: why using storm control on distribution switches and why using with this low threshold. I've seen a good practice being 5 to 10 percent of broadcast/multicast storm control, but never 2 percent. And why it was enabled on trunk ports? This makes no sense for me, since trunk ports will be receiving a lot more broadcasts then other ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: Just in case, this network is huge and badly deployed, so it's a /20 network running with more than 2000+ devices, so I'm expecting huge broadcast traffic on the devices, which causes problem with this storm control policy.&lt;/p&gt;&#xA;" OwnerUserId="10528" LastEditorUserId="33" LastEditDate="2015-08-02T17:34:51.630" LastActivityDate="2015-08-02T20:37:00.523" Title="Cisco: broadcast and multicast storm control on distribution switches" Tags="|cisco|multicast|broadcast|storm-control|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20369" PostTypeId="1" CreationDate="2015-08-02T17:33:26.727" Score="0" ViewCount="1083" Body="&lt;p&gt;I know the http is stateless protocol? but HTTP uses TCP which is connection-oriented protocol. so can I say http is a connection-oriented and stateless protocol?&lt;/p&gt;&#xA;" OwnerUserId="6195" LastEditorUserId="8499" LastEditDate="2018-02-16T04:07:32.947" LastActivityDate="2018-02-16T04:07:32.947" Title="Is http connection-oriented?" Tags="|tcp|protocol-theory|" AnswerCount="1" CommentCount="3" ClosedDate="2015-08-03T05:22:16.497" ContentLicense="CC BY-SA 3.0" />
  <row Id="20371" PostTypeId="2" ParentId="20366" CreationDate="2015-08-02T18:00:05.083" Score="0" Body="&lt;p&gt;You need to check which module (hardware or software) is installed on the asa with the command &quot;show module all&quot;. The hardware module can be the IDS/IPS, the SSM, the CX or the FIREpower and the software module can be the CX or the  FIREpower. Each module need a specific backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the backup of the asa:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;starting from version 9.3 you can use the command &quot;backup&quot;&lt;/li&gt;&#xA;&lt;li&gt;before version 9.3 you can use the graphically asdm backup feature TOOLS -&gt; Backup Configurations or using the cli backup all the options present on the asdm backup.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.networkworld.com/article/2928247/network-security/backup-and-restore-on-the-cisco-asa-9-3.html&quot; rel=&quot;nofollow&quot;&gt;Reference&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16991" LastEditorUserId="2662" LastEditDate="2015-08-03T21:55:26.347" LastActivityDate="2015-08-03T21:55:26.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20372" PostTypeId="2" ParentId="20368" CreationDate="2015-08-02T20:37:00.523" Score="3" Body="&lt;p&gt;The interface you are showing is a gigabit port that is configured to run at 100Mbps due to the &lt;code&gt;speed 100&lt;/code&gt;.  This means the port will shut down if there is more than &lt;strong&gt;2Mbps&lt;/strong&gt; of broadcast or multicast in any 1-second period, which given the size of the subnet is a very real possibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would definitely be increasing these values on uplink ports considering the size of your network - start by increasing to &lt;code&gt;10.0&lt;/code&gt; and seeing if this alleviates your issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A real broadcast storm is going to generate a lot more than 10Mbps, so setting the level higher is not that big of a deal. &lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-08-02T20:37:00.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20373" PostTypeId="1" AcceptedAnswerId="20374" CreationDate="2015-08-02T22:48:07.947" Score="7" ViewCount="14209" Body="&lt;p&gt;What is the best mask to use to allow computers to use the multicast IP address 224.0.0.0?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've only seen IP addresses using the lower 8 bits, in my case I just see 22 and 251.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my firewall uses an entry as follow:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-A INPUT -i eth1 -p udp -m udp -s 192.168.0.0/16 -d 224.0.0.0/24 -j ACCEPT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I have found other definitions that use a mask as small as 4 or 5 for the 224.0.0.0 address. What is the right mask according to the use of the 224.0.0.0 address scope definition?&lt;/p&gt;&#xA;" OwnerUserId="16992" OwnerDisplayName="Alexis Wilke" LastEditorUserId="8499" LastEditDate="2018-03-11T01:51:08.513" LastActivityDate="2018-03-11T01:51:08.513" Title="What is the correct mask to use with 224.0.0.0?" Tags="|ipv4|ip|subnet|multicast|ip-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20374" PostTypeId="2" ParentId="20373" CreationDate="2015-08-02T23:04:54.893" Score="12" Body="&lt;p&gt;You can't use any addresses from 224.0.0.0 (except for multicast) through 255.255.255.254, and 255.255.255.255 is a Limited Broadcast address.&lt;/p&gt;&#xA;&lt;p&gt;Multicast addresses are 224.0.0.0/4.  Masks are not used in multicast; you subscribe, individually, to multicast groups.&lt;/p&gt;&#xA;&lt;p&gt;Reserved addresses are 240.0.0.0/4.  While named &amp;quot;&lt;a href=&quot;https://en.wikipedia.org/wiki/Classful_network&quot; rel=&quot;nofollow noreferrer&quot;&gt;Class E&lt;/a&gt;&amp;quot; in the old class routing scheme, their use is undefined (they can't be used as source or destination addresses, and they can't be forwarded, per &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6890&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6980&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-08-03T04:19:09.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20375" PostTypeId="2" ParentId="20366" CreationDate="2015-08-03T01:21:45.087" Score="4" Body="&lt;p&gt;One thing to add to the things collected is the licensed features (&lt;code&gt;show activation-key detail&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all depends on the asa model and running version. Some parts will be in the config, others in flash files, and yet others in &quot;private&quot; flash files. The quickest and most complete procedure would be to swap the compact flash. Keep in mind the activation key is stored there as well, so get that from the new system &lt;em&gt;before&lt;/em&gt; the swap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, my ASA has webvpn configuration components that aren't in the running config, or visible flash filesystem.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For all models, you'll have to open the case to get the CF. ASA5505, it's along the edge of the board, visible from the outside, but not removable until the cover is lifted. ASA5510/20/... the CF is on a board near the external CF.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-08-03T01:21:45.087" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20377" PostTypeId="2" ParentId="19603" CreationDate="2015-08-03T01:52:44.280" Score="0" Body="&lt;p&gt;Here is the standard I use across our WAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We also use a color coding standard for the cables.&#xA;- Blue cables for data&#xA;- Yellow cables for Voice and phones&#xA;- Green for Audio/Video (Televisions, cable boxes, etc.)&#xA;- Purple for Wireless access points&#xA;- Black for security cameras&#xA;- Red is reserved for Fire systems and alarms&lt;/p&gt;&#xA;" OwnerUserId="16882" LastActivityDate="2015-08-03T01:52:44.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20379" PostTypeId="2" ParentId="20369" CreationDate="2015-08-03T02:25:08.210" Score="1" Body="&lt;p&gt;&lt;code&gt;HTTP&lt;/code&gt; is not a transport protocol like &lt;code&gt;TCP&lt;/code&gt; or &lt;code&gt;UDP&lt;/code&gt;. It operates on higher layers of the &lt;code&gt;ISO/OSI&lt;/code&gt; model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus there is no connection that can be set up.&lt;/p&gt;&#xA;" OwnerUserId="16734" LastActivityDate="2015-08-03T02:25:08.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20387" PostTypeId="1" CreationDate="2015-08-03T12:42:59.863" Score="0" ViewCount="818" Body="&lt;p&gt;i have mikrotik cloud router switch . &#xA;First of all i want to set vlanning for layer2 separating in all IPs (clients) qua all clients can't access to another. For the 2nd step i want to have an central accounting for user managing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;note&lt;/strong&gt; : already i configured usermanager and hotspot without vlanning that isn't my purpose . because i bridged client interfaces together that separating failed .&lt;/p&gt;&#xA;" OwnerUserId="3985" LastEditorUserId="8499" LastEditDate="2018-02-14T16:40:35.333" LastActivityDate="2018-02-14T16:40:35.333" Title="Mikrotik CRS vlaning and accounting" Tags="|vlan|layer2|accounting|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-09T23:49:47.123" ContentLicense="CC BY-SA 3.0" />
  <row Id="20389" PostTypeId="2" ParentId="20359" CreationDate="2015-08-03T18:44:48.973" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Engineer&quot; rel=&quot;nofollow&quot;&gt;Engineer&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Architect&quot; rel=&quot;nofollow&quot;&gt;architect&lt;/a&gt; are well established titles with accompanying testing, recognition, and requirements.  These titles often have special legal protections.  It is unfortunate that the I.T. industry has co-opted these titles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding network architecture and network design, you will not find an authoritative and recognized differentiation.  They mean the same thing.  Since network design does not infringe upon the architecture industry, I prefer to use the term network design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's my 2 cents...&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-08-03T18:44:48.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20390" PostTypeId="1" AcceptedAnswerId="20391" CreationDate="2015-08-03T19:52:09.030" Score="2" ViewCount="3075" Body="&lt;p&gt;I need to broadcast an ipcamera to many different spot.&#xA;Now the system is alredy working but every client read the streaming directly via network. &#xA;I want to reduce the traffic by sending just one &quot;flow&quot; throw a server ( still don't know which kind of technology) so the client could read the streaming from it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking about a webpage that embed a video player, so I can reach the streaming via browser. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my question is, if multiple browser open the website, the webserver open just one connection throw the ipcamera or one for each http request?&lt;/p&gt;&#xA;" OwnerUserId="16009" LastEditorUserId="8499" LastEditDate="2018-02-16T04:07:20.360" LastActivityDate="2018-02-16T04:07:20.360" Title="Streaming ip camera to many client monitor, udp/rtsp" Tags="|udp|streaming|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20391" PostTypeId="2" ParentId="20390" CreationDate="2015-08-03T21:47:06.327" Score="3" Body="&lt;p&gt;The correct path here is &lt;em&gt;multicast&lt;/em&gt; -- one sender, many receivers. But that may not be supported by the camera, your network (read: wifi), or clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all you want is to reduce the traffic and processing load on the camera, a &quot;video proxy&quot; application may fit the bill. (Something like shoutcast, but for video.) Make one connection to the camera, and let the app/server copy the stream to how ever many clients want it. (product recommendation are off-topic, btw.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-08-03T21:47:06.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20392" PostTypeId="1" AcceptedAnswerId="20393" CreationDate="2015-08-04T00:50:41.530" Score="3" ViewCount="144" Body="&lt;p&gt;When  cell phone try to connect AP, it sends probe request and it include all  past SSID history in it. Strangely enough, when I run a MAC-built-in data packet sniffing program, called  Wifi-Diagnostic, it show only two ssid which I had connected 6 monthes ago. I want to know why. Thanks^^&lt;/p&gt;&#xA;" OwnerUserId="17016" LastActivityDate="2015-09-03T02:55:01.727" Title="Why does a smartphone include its very few past SSID history lists in a probe request?" Tags="|ieee-802.11|pcap|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20393" PostTypeId="2" ParentId="20392" CreationDate="2015-08-04T01:56:16.217" Score="4" Body="&lt;p&gt;This is generally the case because they want to simplify the UI, specifically avoiding options that many users don't really understand or can cause them problems. The 802.11 feature that leads to the SSID being part of the probe request is the ability to provide a non-broadcast SSID (i.e. hidden SSID). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a client to connect to an SSID that is non-broadcast, it has to specifically know the SSID name. Many people use this believing it to be some sort of security feature, but anyone who wants to figure out the SSID can do so with almost no effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking probe requests, while always broadcast, function in one of two ways. They can send out a generic request (&quot;Hey, is anybody out there?&quot;) or a more specific request (&quot;Hey, is Bob out there?&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some operating systems, you can specify that the probe request should include the latter by selecting some sort of &quot;Connect even if the network is not broadcasting its name (SSID)&quot; (Windows 7 example) so that it can connect to a non-broadcast SSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However in some operating systems and many mobile devices, they streamline the UI for connecting to an 802.11 network. The reasoning goes like so:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A client device can connect to a broadcast SSID with either type of probe.&lt;/li&gt;&#xA;&lt;li&gt;A client device requires the more specific probe to connect to a non-broadcast SSID.&lt;/li&gt;&#xA;&lt;li&gt;By using the more specific probe, the device will be able to connect to either type of network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;End result is that is what they have the device do by default, leaving one less option that may confuse or cause problems for a user.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-08-04T01:56:16.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20394" PostTypeId="1" CreationDate="2015-08-04T02:01:13.987" Score="2" ViewCount="2445" Body="&lt;p&gt;OK so I hope I explain this correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have the following network setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/B7Oy0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B7Oy0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is that None of the IP phones can ping the computers and vice versa. The reason the phones are on the seperate internet connection is so that if we eat all the bandwidth on the EdgeMAX which only have like 20MBPS it doesn't degrade the phones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this going to be possible to have both networks even see each other? I thought it would have been fairly basic... but I feel like i'm missing some core networking knowledge for this setup... possibly in the ability for the TP links ability to see read routing packets through it's LAn ports but I'm a bit clueless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions as to what's doing wrong and how I could go about repairing it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: switch1 and switch 2 are connected to each other (oopse on the diagram)&lt;/p&gt;&#xA;" OwnerUserId="17017" LastEditorUserId="17017" LastEditDate="2015-08-04T02:47:06.927" LastActivityDate="2015-08-04T19:27:18.787" Title="Vlans can't see each other" Tags="|vlan|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20395" PostTypeId="2" ParentId="20332" CreationDate="2015-08-04T02:47:51.340" Score="0" Body="&lt;p&gt;Based on the information provided, no increasing your ISP speed will not increase your 802.11 wireless speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you are looking at this type of question you are really asking, &quot;where is the bottleneck&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you tested wired out through your router to the internet, you achieved approximately what you expect to see based on your 500Mbps of available bandwidth (460-480Mbps). This establishes that you can get at least 460Mbps along that path of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you extend your network over your 802.11 wireless, you get speeds of 260-280Mbps. This is where your bottleneck resides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of this as a (simplistic) highway...if you have to get cars from point A to point C along a highway and A-&gt;B has two open lanes that can allow 2 cars per second while B-C has four lanes where you can allow 4 cars per second, where would you want to increase the traffic flow? Clearly you would want to increase the cars per second on the A-&gt;B section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for what would increase your wireless speed, there are many factors that contribute to this and would make this much too broad to answer. In general terms though, it is based on the capabilities of the wireless client, the capabilities of the access point and how the wireless network is configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the current time, the best wireless devices widely available cannot support more than 4 spatial streams and 80MHz wide channels, giving a top data rate of 1300Mbps under ideal conditions. Many devices do not even have this capability (mainly because of a need for less battery drain or cheaper chipsets).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is half-duplex and management traffic will take up a portion of the bandwidth, expect real world performance less than half the data rate. This will continue to decrease as you move the client device further from the AP, introduce noise into the environment (interference), add client devices, neighboring networks, and a number of other factors.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-08-04T02:47:51.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20399" PostTypeId="1" AcceptedAnswerId="20402" CreationDate="2015-08-04T07:32:07.697" Score="1" ViewCount="2143" Body="&lt;p&gt;I read from &lt;a href=&quot;http://www.csd.uoc.gr/~hy556/material/tutorials/cs556-3rd-tutorial.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; that sockets are uniquely identified by an end-to-end protocol. What does &quot;end-to-end&quot; mean, generally, in networks?&lt;/p&gt;&#xA;" OwnerUserId="16810" LastEditorUserId="49" LastEditDate="2015-08-04T13:46:36.373" LastActivityDate="2017-02-13T11:21:56.707" Title="End to end protocol?" Tags="|tcp|ip|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20400" PostTypeId="1" AcceptedAnswerId="20417" CreationDate="2015-08-04T12:24:23.053" Score="1" ViewCount="185" Body="&lt;p&gt;(warning: this is an old exam question, for which I don't have a solution):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume 2 local networks LAN1 and LAN2, with Endsystems A,C in LAN1 and B,D in LAN2. The networks are coupled with a bridge. &#xA;Assume A wants to send a TCP Frame to B. Which address information does it need to contain? List all headers of OSI Layers 2-4, take sender and receiver into account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What my solution would be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP Port A -&gt; IP-A -&gt; Mac-A -&gt; Mac-Bridge -&gt; Mac-B -&gt; IP-B -&gt; TCP-Port-B&#xA;is that correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I used a Router instead of the bridges and LAN1 and LAN2 are seperate IP-Subnetworks, would the difference be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP Port A -&gt; IP-A -&gt; Mac-A -&gt; Mac-Bridge -&gt; IP-Bidge-&gt; Mac-Bridge -&gt; Mac-B -&gt; IP-B -&gt; TCP-Port-B?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or what would change here? Am I understanding this correctly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="17026" LastActivityDate="2015-08-04T18:22:59.917" Title="Difference between coupling with bridge and router" Tags="|router|tcp|lan|bridge|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20402" PostTypeId="2" ParentId="20399" CreationDate="2015-08-04T12:39:56.187" Score="4" Body="&lt;p&gt;An end-to-end protocol is responsible for delivering messages to one or multiple network endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Referring to the &lt;a href=&quot;https://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow noreferrer&quot;&gt;ISO/OSI model&lt;/a&gt;, end-to-end protocols work on the Transport Layer (Layer 4), i.e. UDP or TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMHO, the &lt;a href=&quot;https://en.wikipedia.org/wiki/End-to-end_principle&quot; rel=&quot;nofollow noreferrer&quot;&gt;end-to-end principle&lt;/a&gt; basically is about the communication between two or more processes in the network.&lt;/p&gt;&#xA;" OwnerUserId="16734" LastEditorUserId="16734" LastEditDate="2017-02-13T11:21:56.707" LastActivityDate="2017-02-13T11:21:56.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20404" PostTypeId="2" ParentId="20272" CreationDate="2015-08-04T12:48:51.527" Score="1" Body="&lt;p&gt;Use command line and Run with administrator account and type --privilege to run in privilege mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex: &lt;code&gt;nmap --privilege -sP 10.x.x.x&lt;/code&gt; &lt;/p&gt;&#xA;" OwnerUserId="17018" LastEditorUserId="509" LastEditDate="2015-08-14T08:20:19.783" LastActivityDate="2015-08-14T08:20:19.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20406" PostTypeId="2" ParentId="20394" CreationDate="2015-08-04T13:38:51.020" Score="1" Body="&lt;p&gt;One way to enable traffic flow between the two VLANs would to have both the switches connect to the same router (or a layer 3 switch),because traffic between different VLANs needs to be routed.Remember that the ports between the switch and the router should be trunk ports and be enabled for both VLANs.&lt;/p&gt;&#xA;" OwnerUserId="17024" LastActivityDate="2015-08-04T13:38:51.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20407" PostTypeId="2" ParentId="20394" CreationDate="2015-08-04T14:21:17.240" Score="0" Body="&lt;p&gt;If your routers are connected directly together through separate ports outside of 192.168.1 and 192.168.2, assign a new subnet between them (eg: 172.16.31.1/30 on router A and 172.16.31.2/30 on router B). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then on the 192.168.1.0/24 router, add a route: 192.168.2.0/24 --&gt; 172.16.31.2. On the 192.168.2.0/24 router, add: 192.168.1.0/24 --&gt; 172.16.31.1.&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-08-04T14:21:17.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20409" PostTypeId="1" AcceptedAnswerId="20410" CreationDate="2015-08-04T14:59:53.327" Score="3" ViewCount="955" Body="&lt;p&gt;This's my Topology! Routes and the communication between then its working&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5PtBR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5PtBR.png&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP 1&#xA;&#xA;interface FastEthernet0/1&#xA; ip address 192.168.0.10 255.255.255.248&#xA; ip nat inside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 172.16.0.1 255.255.255.252&#xA; ip nat outside&#xA; clock rate 64000&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP 2&#xA;&#xA;interface FastEthernet0/1&#xA; ip address 192.168.0.26 255.255.255.252&#xA; ip nat inside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/1/0&#xA; ip address 172.16.0.2 255.255.255.252&#xA; ip nat outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I configured a Point-to-Point Address 172.16.0.0/30, That's will be a NAT Address? Or I can use another Address? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before, I used a &lt;code&gt;debug ip packet&lt;/code&gt; and I saw the data flow normally, without change my source address. As I was bothere redid the entire project :/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That are the commands: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static 192.168.0.0 172.16.0.1&#xA;ip nat inside source static 192.168.0.16 172.16.0.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Well, I'm using the network address with a static configuration.. Mehh, that's wrong right? Should I use a dynamic NAT for that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I know whether it's working?&lt;/p&gt;&#xA;" OwnerUserId="14008" LastActivityDate="2015-09-03T16:28:14.030" Title="Why my NAT is not working?" Tags="|cisco|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20410" PostTypeId="2" ParentId="20409" CreationDate="2015-08-04T15:32:34.390" Score="3" Body="&lt;p&gt;&lt;strong&gt;ip nat inside source static&lt;/strong&gt; &lt;em&gt;local-ip-address global-ip-address [group group-id]&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I shoud use local ip address and not network address! That was my error&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static 192.168.0.2 172.16.0.1&#xA;ip nat inside source static 192.168.0.18 172.16.0.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, When the request out from PC 1 toward ISP 2 or beyond, the static configuration it's working! &lt;/p&gt;&#xA;" OwnerUserId="14008" LastActivityDate="2015-08-04T15:32:34.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20411" PostTypeId="1" CreationDate="2015-08-04T16:14:35.100" Score="4" ViewCount="3861" Body="&lt;p&gt;I have a couple cheap  external wireless APs that like to reboot themselves constantly if they get even a few broadcast packets (i am ~90% certain this is the cause, after some testing with wireshark and cisco storm-control).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have already replaced one of the APs with a super nice Cisco AP that works like a champ, but I can't replace the other one yet.  For the time being, i need to reliably block ALL broadcast packets EXITING a single switchport (that the AP is connected to) on a Catalyst 2960-x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand, Cisco Storm-Control works on switch port ingress, and rather than 'throttling' based on the set threshold (% or pps), it just starts blocking packets until the packets drop below the threshold. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also understand that 'switchport block unicast/multicast' works on switchport egress, and unfortunately there is no 'switchport block broadcast' command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I have had some success if I use storm-control to completely block broadcast packets coming in on the uplink port, but of course this causes problems for anything on the uplink side trying to communicate with the devices connected to the switch, and also initial connectivity to the AP after a reboot (i have to temporarily turn off storm-control in order to re-connect to the AP web interface after the AP reboots, since my workstation is on the uplink side of the switch)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought perhaps just putting another small cisco switch in between the 2960-x and the AP, and setting IT to block all ingress broadcast packets  on the uplink port via storm-control, but I am hoping there is another way.  &lt;/p&gt;&#xA;" OwnerUserId="14455" LastEditorUserId="14455" LastEditDate="2015-08-04T16:19:57.717" LastActivityDate="2023-01-19T12:34:16.570" Title="How to block broadcast packets EXITING a single switchport" Tags="|broadcast|storm-control|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20412" PostTypeId="1" AcceptedAnswerId="20413" CreationDate="2015-08-04T17:14:53.310" Score="3" ViewCount="2534" Body="&lt;p&gt;To everyone who takes the time to read below, thank you very much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to start this off with the very general question and then give my exact situation.  I really don't understand the terminology 'tag egress packets' vs 'untag egress packets' when it comes to setting up VLANs.  As far as I was always concerned, tag meant that the switch was manually enforcing a VLAN tag on every packet that came into that port (placing the tag on itself) and untag meant that it wasn't.  This goes back to one of my first bosses, who told me you could only have one tagged VLAN per port.  I'm pretty sure this is wrong now, but I wouldn't mind figuring out exactly what that refers to.  I'm currently operating under the assumption that tag means it accepts tagged packets for that VLAN and untagged means that it accepts untagged packets and places it into that VLAN (Probably the Primary VLAN ID).  Of course, that could be complete bunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My Situation/Problem&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network infrastructure is currently running all NetGear Prosafe switches (not my choice, but until we do the upgrade later this month, I get to work with them) as well as one NetGear router.  We are using Aerohive Access points to create a Campus wireless network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm basically going through, ripping out the existing SSIDs on the Aerohives and looking to replace them with a better option.  The aerohives aren't the problem, I can configure them with my eyes closed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I do have is three VLANs I want to create, to separate three different classes of users onto three different subnets.  The Aerohives will assign 2220, 1135, and 2135 based on the user and SSID used.  For right now, I'm focusing on 2220 as a test case.  I have configured a new DHCP scope on the DHCP server (192.168.5.0/24) and have configured every port along the path with the tag egress packets option for the new VLAN.  I have also added in a special routing port (even though I have high doubts it's needed at all).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Problem&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't receive DHCP on the network and when I do a VLAN probe for 2220 it shows up as not having a subnet.  I really just don't know enough about VLAN routing and especially these NetGears to get why the DHCP requests do not get to the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Clarification&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For right now there are only two switches between the DHCP server and the access point.  The DHCP server, being on a different subnet, likely isn't contacted directly, but I'd likely expect the following to happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AP &gt; Switch 1 &gt; Router &gt; Switch 2 &gt; DHCP server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, the router port I setup for the new VLAN is connected to the same switch as the AP is.  Ideally, for this test case, I think I would only need to configure about 3-5 ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading the below answers I tried the following and wanted to add a bit more clarification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch 1 - Port 03&lt;/strong&gt;  VLAN 3030 untagged, VLAN 2220 tagged, Primary VLAN 3030&#xA;3030 is the management interface VLAN and is needed for the AP to communicate so I can't really change the primary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch 1 - Port 09&lt;/strong&gt; VLAN 2220 untagged, Primary VLAN 2220&#xA;This heads off to the router.  I get the feeling I should be able to just tag all three VLANs on this one port eventually and have the router deal with them in trunk mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router - Port 05&lt;/strong&gt; VLAN 2220 untagged, Primary VLAN 2220.  VLAN routing interface 192.168.5.1, 255.255.255.0.  DHCP helper relay is setup for the DHCP server.  For reference, the DHCP server is on the 192.168.1.0/24 subnet.  Note: This model of netgear does not let me configure an IP for the physical port, just for routing ports you create.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch 2 - Port 05&lt;/strong&gt; This is the Hyper V host port and where I start getting confused.  We have another subnet setup exactly the same way (not created by me).  The port itself has only VLAN 1 untagged and primary.  So, I don't think I need anything configured on the port.  I just don't know if I'm missing something or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DHCP still does not seem to work.&lt;/p&gt;&#xA;" OwnerUserId="17031" LastEditorUserId="17031" LastEditDate="2015-08-04T18:47:43.270" LastActivityDate="2015-08-04T18:47:43.270" Title="VLAN tagging, routing, and general pain" Tags="|routing|switch|vlan|subnet|dhcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20413" PostTypeId="2" ParentId="20412" CreationDate="2015-08-04T17:46:33.910" Score="2" Body="&lt;p&gt;&lt;strong&gt;Basics&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you tag a VLAN on a port, it will send out the traffic on that port with the VLAN tag, when the port receives traffic it looks for the tag and places the traffic into that VLAN. You can have multiple tagged VLANs on one port (sometimes called trunk).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you send out a VLAN untagged on a port it will not add the VLAN tag to the packet and when receiving packets without a VLAN tag it will be placed into that VLAN (on Netgear and others you have to set PVID (Primary VLAN ID))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;To your problem&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you are not far away...&#xA;- Router port connected to Switch1 should have IP within VLAN 2220.&#xA;- DHCP Server should have different IP from different Subnet!&#xA;- Router port Connected to Switch2 should have IP in Subnet of DHCP Server&#xA;- You should define a DHCP Helper on Router port connected to Switch1 so DHCP Request get forwarded to DHCP Server. Hot to do that is described here: &lt;a href=&quot;http://kb.netgear.com/app/answers/detail/a_id/21990/~/how-do-i-configure-a-dhcp-l3-relay-using-the-web-interface-on-my-managed-switch%3F&quot; rel=&quot;nofollow&quot;&gt;http://kb.netgear.com/app/answers/detail/a_id/21990/~/how-do-i-configure-a-dhcp-l3-relay-using-the-web-interface-on-my-managed-switch%3F&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you a little bit further. If not, please post a more detailed network diagram with VLAN IDs and IPs.&lt;/p&gt;&#xA;" OwnerUserId="13745" LastActivityDate="2015-08-04T17:46:33.910" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20414" PostTypeId="2" ParentId="20411" CreationDate="2015-08-04T17:52:49.437" Score="3" Body="&lt;p&gt;If you have analysed the traffic already with wireshark you can probably create a L2 ACL outbound on the cisco switch. Be sure to not block ARP traffic (also Broadcast) else you will not be able to use IPv4!&lt;/p&gt;&#xA;" OwnerUserId="13745" LastActivityDate="2015-08-04T17:52:49.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20415" PostTypeId="2" ParentId="20412" CreationDate="2015-08-04T18:00:28.250" Score="2" Body="&lt;p&gt;Yes you can have packet tagged for different VLANs on the same port (more often on uplink ports that connect together two switches).  This is generally referred as &amp;quot;trunk&amp;quot; mode (altough there's no such terminology on netgear switches and &amp;quot;trunk&amp;quot; has a totally different meaning on HP procurve).&lt;/p&gt;&#xA;&lt;p&gt;To apprehend vlan tagging you have to distinguish what happens when the switch receive a packet and what will the switch decide when it will send the packet on the destination port.&lt;/p&gt;&#xA;&lt;p&gt;A basic setup is to have a PC connected for example in VLAN 10 on a port of switch A, Port 7 and a router connected on switch B port 1 that will perform the routing for all VLAN.&#xA;Switch A &amp;amp; B are connected together with an uplink on both ports 48.&lt;/p&gt;&#xA;&lt;p&gt;To achieve this you have the following configuration&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switch A port 7 configured with PVID 10 ; VLAN 10 untaged for this port&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;interface 1/0/10&lt;/p&gt;&#xA;&lt;p&gt;vlan pvid 10&lt;/p&gt;&#xA;&lt;p&gt;vlan participation include 10&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switch A port 48, switch B port 48 &amp;amp; 1, VLAN 10 tagged&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;interface 1/0/48&lt;/p&gt;&#xA;&lt;p&gt;vlan pvid 10&lt;/p&gt;&#xA;&lt;p&gt;vlan participation include 10&lt;/p&gt;&#xA;&lt;p&gt;vlan tagging 10&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;And of course the router must have a interface vlan 10 configured.&lt;/p&gt;&#xA;&lt;p&gt;Now what happens when the PC send a packet to the router :&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The PC send a untagged packet. The switch receive the packet on its port 7. Since the packet is not tagged and the port is configured with PVID 10, the switch now that this packet belong to vlan 10&lt;/li&gt;&#xA;&lt;li&gt;Looking up its mac table and the destination mac in the packet the switch decide to send the packet trough port 48. It's a packet belonging to vlan 10 and the port is configured with &amp;quot;tagging&amp;quot; for this vlan. So the switch A send the packet with vlan 10 tag in the header&lt;/li&gt;&#xA;&lt;li&gt;The switch B receive the the packet tagged for vlan 10. Since it has vlan10 configured on this port (vlan participation include vlan 10) it accepts the packet and it knows it belong to vlan 10.&lt;/li&gt;&#xA;&lt;li&gt;the switch B send the packet to the router on port 1, once again tagged.&lt;/li&gt;&#xA;&lt;li&gt;the router received the packet tagged for vlan 10, since it has an interface on this vlan, it routes the packet.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Now for the response.&#xA;It goes from router , sent tagged, on switch B port 1 , and travel, always tagged until it is send to the PC trough switch A port 7.&lt;/p&gt;&#xA;&lt;p&gt;When the switch is about to send the packet trough port 7, in the configuration it has &amp;quot;vlan participation include 10&amp;quot; so it is ok , but it doesn't have &amp;quot;vlan tagging 10&amp;quot; so the packet is sent untagged.&#xA;The PC receive the packet without vlan tag and process it.&lt;/p&gt;&#xA;&lt;p&gt;So :&lt;/p&gt;&#xA;&lt;p&gt;PVID apply only to packet received on the port&lt;/p&gt;&#xA;&lt;p&gt;VLAN tagging apply to :&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;packet received tagged on the port&lt;/li&gt;&#xA;&lt;li&gt;packet sent trough the port to decide if it must be sent tagged or not.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;If a switch receive a packet tagged for a particular vlan but this vlan is not configured on the port the switch will discard the packet.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-08-04T18:00:28.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20417" PostTypeId="2" ParentId="20400" CreationDate="2015-08-04T18:22:59.917" Score="2" Body="&lt;p&gt;The packet will contain&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Case 1 - No routing - PC A send packet directly to PC B&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;source TCP port&lt;/li&gt;&#xA;&lt;li&gt;destination TCP port&lt;/li&gt;&#xA;&lt;li&gt;source IP address :  IP address of A&lt;/li&gt;&#xA;&lt;li&gt;destination IP address : IP address of B&lt;/li&gt;&#xA;&lt;li&gt;source MAC addres : MAC address of A&lt;/li&gt;&#xA;&lt;li&gt;destination MAC address: MAC address of B (obtained trough an ARP request on B IP address)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Case 2 - With router - the PC A send the packet to its gateway (I.E. the router)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;source TCP port&lt;/li&gt;&#xA;&lt;li&gt;destination TCP port&lt;/li&gt;&#xA;&lt;li&gt;source IP address :  IP address of A&lt;/li&gt;&#xA;&lt;li&gt;destination IP address : IP address of B&lt;/li&gt;&#xA;&lt;li&gt;source MAC addres : MAC address of A&lt;/li&gt;&#xA;&lt;li&gt;destination MAC address: MAC address of the router (obtained trough an ARP request on the router IP address. I.E. the IP configured as defaut gateway on A)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-08-04T18:22:59.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20419" PostTypeId="1" AcceptedAnswerId="20421" CreationDate="2015-08-04T18:58:46.543" Score="0" ViewCount="2136" Body="&lt;p&gt;I have a working configuration on two Juniper Netscreen devices that I'm trying to replicate on an ASA 5505. Here's the scenario:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----+   77.77.77.77   +-----+ 10.20.0.0/24 *******&#xA;| WAN | =============== | ASA | ------------ * DMZ *&#xA;+-----+                 +-----+    VLAN 20   *******&#xA;                           |&#xA;                           |  10.30.0.0/24   ***********&#xA;                           +---------------- * Clients *&#xA;                                VLAN 30      ***********&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm trying to perform PAT on both internal subnets (i.e. so all internal clients can access the internet). However, when I try to configure the NAT rules using ASDM, it says that there's a PAT range overlap. There must be some way to configure the NAT rules such that both zones/subnets can share an external PAT IP (just like in ScreenOS), but I haven't found it yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, ordering extra external IPs isn't an option at the moment, so I hope there's a way to do this without purchasing any more gear. &lt;/p&gt;&#xA;" OwnerUserId="4074" LastActivityDate="2015-08-04T20:27:30.033" Title="How can I NAT/PAT two internal subnets to one single WAN IP on an ASA?" Tags="|cisco-asa|nat|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20420" PostTypeId="2" ParentId="20394" CreationDate="2015-08-04T19:27:18.787" Score="0" Body="&lt;p&gt;Question.... why do you have the AP plugged into the router? You're wasting a good FE port. Your AP's should be on the switch plugged into a separate VLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure your ports are trunked. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try InterVlan Routing, that should be your fix.&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/tech/lan-switching/inter-vlan-routing/index.html&quot; rel=&quot;nofollow&quot;&gt;CISCO&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17035" LastActivityDate="2015-08-04T19:27:18.787" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="20421" PostTypeId="2" ParentId="20419" CreationDate="2015-08-04T20:27:30.033" Score="2" Body="&lt;p&gt;I think that should do it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  object-group FOO&#xA;    network-object 10.30.0.0 255.255.255.0&#xA;    network-object 10.20.0.0 255.255.255.0&#xA;&#xA;  object network BAR&#xA;    host 77.77.77.77&#xA;&#xA;  nat (inside,any) source dynamic FOO BAR&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5337" LastActivityDate="2015-08-04T20:27:30.033" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20422" PostTypeId="1" AcceptedAnswerId="20424" CreationDate="2015-08-04T21:36:24.607" Score="3" ViewCount="18020" Body="&lt;p&gt;In the 21st video of the F5 video series in CBT Nuggets, Keith Barker explains that the way to make the F5 &quot;route&quot; is by creating an IP Forwarding Virtual Server. This server would have the following settings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dst IP: 0.0.0.0/0&#xA;Service port: * (all)&#xA;Type: Forwarding (IP)&#xA;Protocol Profile: fastL4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is: Why does Keith Barker recommend doing this instead of simply creating a static default route on the F5 appliance pointing to the next hop?&#xA;I have attempted to google this as well as look in devcentral and I can't seem to find the answer.&lt;/p&gt;&#xA;" OwnerUserId="889" LastEditorUserId="44" LastEditDate="2015-08-05T04:00:07.180" LastActivityDate="2019-11-07T23:47:15.190" Title="F5 Routing - Default Route or IP Forwarding Virtual Server?" Tags="|routing|load-balancer|f5|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20423" PostTypeId="1" CreationDate="2015-08-05T01:52:15.137" Score="3" ViewCount="2917" Body="&lt;p&gt;Hi i am trying to copy an image from my ftp server onto a nexus 3500 switch (N3K-C3048TP-1GE) but the switch will not let me access the bootflash at all, is there anything I can do to recover the bootflash or boot into the device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/A0TnX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/A0TnX.png&quot; alt=&quot;Screenshot&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17037" LastEditorUserId="17037" LastEditDate="2015-08-05T02:18:47.977" LastActivityDate="2018-11-16T02:03:05.710" Title="How to copy an image to a corrupt bootflash?" Tags="|cisco-nexus|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20424" PostTypeId="2" ParentId="20422" CreationDate="2015-08-05T03:58:55.457" Score="3" Body="&lt;p&gt;You're not alone, there is often confusion about the Forwarding Virtual Server, and what role it serves in an F5 LTM.  Not having watched the video in question, I can only speculate on exactly what Keith Barker said/why he said it.  However, knowing the high quality of his other training videos, I can assume that the following is what he was driving at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, think of it this way:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All forwarding and policy decisions are made by the LTM services (Virtual Servers, SNAT, and NAT).  These configurations act on the traffic at &lt;strong&gt;ingress&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Final routing decisions are made by the routing table of the device, once the LTM services are done with a particular piece of traffic.  The routing table acts on the traffic at &lt;strong&gt;egress&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;See this very &lt;a href=&quot;https://devcentral.f5.com/s/feed/0D51T00006pXhi5SAC&quot; rel=&quot;nofollow noreferrer&quot;&gt;helpful diagram of the traffic flow through an F5 LTM&lt;/a&gt;.  You will notice that new traffic is matched against Virtual Servers, SNAT, and NAT for all actions.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Remember what the F5 LTM is for, &lt;strong&gt;it is a Load Balancer&lt;/strong&gt; and is designed to explicitly proxy connections through it's Virtual Server constructs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to have it simply pass traffic, you can configure a &quot;Default&quot; Forwarding Virtual Server that listens on all addresses and on all ports.  This allows you to somewhat cheat the system, and have it transfer traffic through the device, but not to a pool of servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is commonly used to allow traffic to flow from the servers behind the LTM, outbound to the world for patching, etc.  In addition, if you wanted to do more than simply route that traffic (for example to apply any of the dozens of wonderful &quot;knobs&quot; that the LTM provides such as TCP fixup or an iRule), you could do that on a Forwarding Virtual Server.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;You can certainly configure a standard static IP route with the following command in TMSH:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;create net route &amp;lt;route destination/mask&amp;gt; gw &amp;lt;IP addres&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, without LTM configuration of some sort (Virtual Server, Forwarding Virtual Server, SNAT, or NAT), the traffic would simply be dropped and never even reach the point of doing a route-lookup against the routing table.  &lt;strong&gt;The F5 LTM is a Default Deny device&lt;/strong&gt;, it will not forward traffic that you have not explicitly permitted/configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, for more information on Forwarding Virtual Servers, read &lt;a href=&quot;https://support.f5.com/kb/en-us/solutions/public/7000/500/sol7595.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SOL7595&lt;/a&gt; and for more information on Static Routing on the LTM, read &lt;a href=&quot;https://support.f5.com/kb/en-us/solutions/public/13000/800/sol13833.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SOL13833&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="-1" LastEditDate="2019-11-07T23:47:15.190" LastActivityDate="2019-11-07T23:47:15.190" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="20426" PostTypeId="1" CreationDate="2015-08-05T07:12:32.420" Score="3" ViewCount="1130" Body="&lt;p&gt;I couldn't find the answer from Google search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The closest was: &lt;a href=&quot;https://en.wikipedia.org/wiki/U-NII&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/U-NII&lt;/a&gt;&#xA;(The Unlicensed National Information Infrastructure (U-NII) radio band is part of the radio frequency spectrum used by IEEE-802.11a devices and by many wireless ISPs.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the column for Korea, there are 'No' and 'Yes'. I assume they just indicate whether it is a DFS channel or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the CAC time of waiting for each of these radar channels in Korea?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want some more reliable official source about this regulation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Wikipedia reference link &lt;a href=&quot;http://www.rra.go.kr/join/databoard/law/view.jsp?lw_type=3&amp;amp;lw_seq=187&quot; rel=&quot;nofollow&quot;&gt;http://www.rra.go.kr/join/databoard/law/view.jsp?lw_type=3&amp;amp;lw_seq=187&lt;/a&gt; (Korea Frequency Distribution Table 2008.12.31 (in Korean)) is broken.&lt;/p&gt;&#xA;" OwnerUserId="2974" LastActivityDate="2017-06-28T10:17:26.443" Title="What are the Korean DFS Radar Wi-Fi channels regulations?" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="1" ClosedDate="2017-06-28T13:54:17.727" ContentLicense="CC BY-SA 3.0" />
  <row Id="20429" PostTypeId="1" AcceptedAnswerId="20431" CreationDate="2015-08-05T10:45:19.563" Score="1" ViewCount="1066" Body="&lt;p&gt;I want my network to handle only static addresses. Consequently i turned the DHCP server off on my Edge router. The problem is that if someone tries to connect with automatically obtaining parameters, he gets everything (ip, net mask,gateway,...).&lt;br/&gt;Since the DHCP server is inactive, it shouldn't be possible, should it? Can anyone help me in preventing automatically giving someone connexion parameters? i don't want any dynamic addressing on my network (restricted access)&lt;br/&gt;By the way this is my router model :&lt;strong&gt;Ubiquiti EdgeMax EdgeRouter Lite ERLite-3 512MB Memory 3 Ethernet Ports Router&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="17044" LastEditorUserId="509" LastEditDate="2015-08-05T21:59:11.723" LastActivityDate="2015-08-06T20:43:20.827" Title="DHCP off but still dynamic addressing" Tags="|dhcp|ip|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20431" PostTypeId="2" ParentId="20429" CreationDate="2015-08-05T11:40:34.627" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;Killing DHCP does &lt;strong&gt;not&lt;/strong&gt; make a network secure (or &quot;restricted&quot;) against people connecting to it. Look at something like &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1X&quot; rel=&quot;nofollow&quot;&gt;802.1X&lt;/a&gt; and Remote Authentication Dial In User Service &lt;a href=&quot;https://en.wikipedia.org/wiki/RADIUS&quot; rel=&quot;nofollow&quot;&gt;RADIUS&lt;/a&gt; for that application. It's trivial for an attacker with physical access to connect to the network, gain the general parameters by examination, and assign themselves an address.&lt;/li&gt;&#xA;&lt;li&gt;You evidently have more than one DHCP server on the network, if you turned one off and one is still running.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2015-08-05T22:11:30.777" LastActivityDate="2015-08-05T22:11:30.777" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20432" PostTypeId="1" CreationDate="2015-08-05T12:38:19.120" Score="1" ViewCount="197" Body="&lt;p&gt;With a figure showing a communication between a network and a server, does that indicate a single network address or can it include multiple network addresses?  Is a single network address the same as an IP address ?  Does a patent figure showing a communication between a network and a server indicated an IP address or can it accommodate multiple IP addresses?  &lt;/p&gt;&#xA;" OwnerUserId="17047" LastEditorUserId="17047" LastEditDate="2015-08-05T12:57:49.393" LastActivityDate="2015-11-03T21:48:43.867" Title="Is a network connection always a single network address?" Tags="|authentication|" AnswerCount="2" CommentCount="2" ClosedDate="2015-11-03T22:05:46.037" ContentLicense="CC BY-SA 3.0" />
  <row Id="20433" PostTypeId="1" AcceptedAnswerId="20438" CreationDate="2015-08-05T13:03:10.410" Score="5" ViewCount="934" Body="&lt;p&gt;I have two computers: PC1 and PC2. PC1 has an IP address of 10.0.0.1/30, and PC2 has an IP address of 10.0.0.6/30. They are connected directly to each other with a crossover cable. My understanding is that they should not be able to ping each other, but I just tested it, and they can both ping each other. Have I misunderstood something about how subnets work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I can change the IP addresses and subnet masks to anything I want, and they can still ping. &lt;/p&gt;&#xA;" OwnerUserId="17050" LastEditorUserId="8499" LastEditDate="2018-12-11T00:43:57.560" LastActivityDate="2018-12-11T00:43:57.560" Title="Pinging across different subnets? This shouldn't work but it does" Tags="|subnet|arp|ping|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20435" PostTypeId="1" AcceptedAnswerId="20437" CreationDate="2015-08-05T14:53:22.820" Score="1" ViewCount="82" Body="&lt;p&gt;My ISP (Internet Service Provider) tells me that my Down speed is 10 Mbps (Megabits per second) and Up speed 1 Mbps. But when I'm searching for a wifi router, the average speed is 300 - 400 Mbps... Do I benefit from this extra 290-390 Mbps, if I'm on the internet?&lt;/p&gt;&#xA;" OwnerUserId="17055" LastActivityDate="2015-08-05T15:55:47.667" Title="Wifi speed 30 fold higher then actual speed coming in from ISP?" Tags="|ieee-802.11|isp|speed|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20436" PostTypeId="2" ParentId="20435" CreationDate="2015-08-05T15:31:11.323" Score="0" Body="&lt;p&gt;No but you will benefit from the additional bandwidth on your local area network.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-08-05T15:31:11.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20437" PostTypeId="2" ParentId="20435" CreationDate="2015-08-05T15:55:47.667" Score="1" Body="&lt;p&gt;Wifi is a bit of a finicky beast.  There are a few important things to consider, not just the internet speed.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Wifi is by design, half duplex.  Believe it or not, this leads to tons of communication problems.  The extra bandwidth and speed helps to allieviate bottlenecks.  &lt;/li&gt;&#xA;&lt;li&gt;Wifi routers have a lot of overhead to deal with.  They have to broadcast SSIDs and deal with responding to broadcast requests.  Once again, this adds to bandwidth utilization.&lt;/li&gt;&#xA;&lt;li&gt;Range.  The listed maximums are at the best antenna rate and sitting right next to the AP.  You will never get those listed maximums, and any device (like a phone) that transmits at lower data rates or from further away will use up more airtime.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, no, you will never see any use of the 300Mb/s from your 10Mb/s internet.  However, if you have 4 or 5 devices all communicating with the wireless AP from different distances and on different speeds, you can easily start seeing wireless congestion without ever even maxing out your internet bandwidth.  Just some food for thought.&lt;/p&gt;&#xA;" OwnerUserId="17031" LastActivityDate="2015-08-05T15:55:47.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20438" PostTypeId="2" ParentId="20433" CreationDate="2015-08-05T16:43:30.043" Score="5" Body="&lt;p&gt;I have seen this before on other host types.  Putting in default gateway addresses should prevent this behavior.  Without a default gateway, the host sends an ARP for the other host's layer-3 address, and it receives a reply because the hosts are on the same layer-2 domain.  With a default gateway, the host would ARP for the gateway's layer-3 address, not the other host's layer-3 address, but there is no gateway address for which to ARP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-08-05T16:43:30.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20439" PostTypeId="1" AcceptedAnswerId="20476" CreationDate="2015-08-05T16:46:11.843" Score="0" ViewCount="3196" Body="&lt;p&gt;Using this scenery, How Can I deny private address, but in this case, 192.168.0.0/24 network to going out without use a public address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Traffic will only be allowed if they're translated, in this case, 10.0.0.1 addr&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/V3ZXb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V3ZXb.png&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enterprise Router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;ip dhcp pool VLAN2&#xA; network 192.168.0.0 255.255.255.192&#xA; default-router 192.168.0.1&#xA;ip dhcp pool VLAN3&#xA; network 192.168.0.64 255.255.255.224&#xA; default-router 192.168.0.65&#xA;ip dhcp pool VLAN4&#xA; network 192.168.0.96 255.255.255.248&#xA; default-router 192.168.0.97&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; ip nat inside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/0.2&#xA; encapsulation dot1Q 2&#xA; ip address 192.168.0.1 255.255.255.192&#xA;!&#xA;interface FastEthernet0/0.3&#xA; encapsulation dot1Q 3&#xA; ip address 192.168.0.65 255.255.255.224&#xA;!&#xA;interface FastEthernet0/0.4&#xA; encapsulation dot1Q 4&#xA; ip address 192.168.0.97 255.255.255.248&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 10.0.0.1 255.255.255.252&#xA; ip nat outside&#xA; clock rate 2000000&#xA;!&#xA;!&#xA;ip nat inside source list 100 interface Serial0/0/0 overload&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 10.0.0.2 &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;disregard this line &quot;ip nat inside sourcer list 100..&quot; I removed an ACL.. &lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="14008" LastEditDate="2015-08-05T20:36:32.943" LastActivityDate="2015-08-06T17:24:32.817" Title="Using ACL for deny private address" Tags="|cisco|nat|acl|packet-tracer|" AnswerCount="2" CommentCount="6" ClosedDate="2015-08-10T14:38:13.413" ContentLicense="CC BY-SA 3.0" />
  <row Id="20440" PostTypeId="1" CreationDate="2015-08-05T17:03:12.450" Score="2" ViewCount="85" Body="&lt;p&gt;Silvia Hagen wrote in one of her books (ISBN:9783952294222, page 463) the following (free translation from german):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Tunneling, an essential element of IPsec [...], is problematic for&#xA;  existing firewalls and security gateways on the border to the company&#xA;  LAN. It's impossible to control traffic with an IPsec-tunnel, which&#xA;  has to be defined end-to-end, on the firwall. To solve the problem&#xA;  there has to be defined end-to-security-gateway SAs instead of&#xA;  end-to-end SAs. Therefor exists no standard at the moment.[...]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My question: Any idea what she does mean? I can't see a problem to establish a tunnel from endpoint to security gateway. Or does she mean, that it is a problem, because the traffic wouldn't be encypted in the LAN (from security gateway to endpoint)?&lt;/p&gt;&#xA;" OwnerUserId="16844" LastActivityDate="2016-03-02T23:07:52.293" Title="IPsec tunnel with IPv6 and security gateways" Tags="|firewall|ipv6|security|ipsec|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20441" PostTypeId="2" ParentId="20440" CreationDate="2015-08-05T17:43:46.680" Score="1" Body="&lt;p&gt;The issue is in policing the traffic at the border of your network. If you allow an inside host to form an IPSec (encrypted) tunnel to any outside host, the firewall &lt;em&gt;cannot&lt;/em&gt; inspect what flows within the tunnel.  At best, the firewall can prevent such tunnels from forming (or try to.) This could allow outsiders past your security measures, or allow information to move beyond your borders.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-08-05T17:43:46.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20444" PostTypeId="1" CreationDate="2015-08-05T18:16:30.327" Score="3" ViewCount="366" Body="&lt;p&gt;I have host which is connected to a switch. I need to establish a communication with a server which is not in my network. So I am using two routers(gateways) ,configured with HSRP, between my host and the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I send a ARP request for the MAC address of the server, I receive HSRP virtual MAC as an ARP response. Hence HSRP virtual MAC is resolved for an IP of the server in the ARP table and also this HSRP virtual MAC gets added to the switch CAM table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I start sending packets to the server (HSRP MAC as the destination MAC) and I am receiving the response from the server. But on analyzing the response from the server, I found out that the packet has source MAC as that of one of the physical router's (gateway's) MAC address but not the HSRP virtual MAC. I was expecting that the packet I received will have the source MAC as HSRP MAC, since I was sending all the packet to HSRP MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since packets are received with physical router's MAC and no packet is received with HSRP virtual MAC as source MAC after the initial ARP response, hence once the switch's CAM aging interval is expired, switch's CAM table entry corresponding to HSRP MAC is removed. Therefore all the packets designed to HSRP MAC are now getting broadcasted by the switch. Which is causing a huge increase in my network traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So are the routers configured correctly with HSRP? Is it the right behavior that in case of HSRP, host will send packet to HSRP MAC but will receive the packet from physical router MAC? Is there any way to configure routers so that packets are received with HSRP virtual MAC&lt;/p&gt;&#xA;" OwnerUserId="17061" LastEditorUserId="8499" LastEditDate="2020-02-09T21:06:53.670" LastActivityDate="2020-02-09T21:06:53.670" Title="HSRP causing switch CAM entries to expire" Tags="|cisco|switch|router|hsrp|fhrp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20445" PostTypeId="2" ParentId="20444" CreationDate="2015-08-05T18:23:17.603" Score="3" Body="&lt;p&gt;The HSRP behavior is normal; that's how HSRP works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't say what kind of switch you are using, but most Cisco switches can change the CAM aging interval.  They have something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mac address-table aging-time &amp;lt;time&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some Cisco switches with different IOS versions may have the dashes different from this.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-08-05T18:34:01.597" LastActivityDate="2015-08-05T18:34:01.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20447" PostTypeId="2" ParentId="20432" CreationDate="2015-08-05T19:01:47.667" Score="0" Body="&lt;p&gt;My understanding is that unless you have multiple NICs sending data to the server there would only be 1 network address. If you were to unplug from the network there is a possibility that when you plug back up that you would obtain a different IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If only one device is connected to the server then I would think that there would only be 1 IP address.&lt;/p&gt;&#xA;" OwnerUserId="17063" LastActivityDate="2015-08-05T19:01:47.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20448" PostTypeId="2" ParentId="20432" CreationDate="2015-08-05T19:34:23.877" Score="0" Body="&lt;p&gt;Generally, if we are talking about a continuous stream of information, then it has to be a single IP address.  The packet has to use the IP address for translation purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, even with a single port NIC or a single port on a switch, you can configure multiple IP addresses for it, but any single stream for a specific application or use will translate to only one IP address.  Of course, there is NIC teaming, but that isn't really what you are asking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to diagrams, they usually define the network at an instant or for a specific event.  For instance, a DHCP request or a single IP packet.  In those cases, yes, the single connection translates to a single IP address as they only ever have a single destination (even broadcast is a single destination, just switches then flood the broadcast packet).  Basically, the fact that your server, workstation or other has multiple IP addresses has very little effect on the transmission of single things.&lt;/p&gt;&#xA;" OwnerUserId="17031" LastActivityDate="2015-08-05T19:34:23.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20449" PostTypeId="2" ParentId="5236" CreationDate="2015-08-05T21:18:24.290" Score="2" Body="&lt;p&gt;Yes, this is possible and a common configuration for many &quot;inline&quot; services like load-balancers, security appliances, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll be able to do this on Cisco, Juniper and other common switches but, as of this writing, the Arista series switches are not compatible with VLAN bridging &lt;strong&gt;WHEN&lt;/strong&gt; you are also routing on one of those VLANs through the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, the Arista switch will drop its own MAC address on the second VLAN.&lt;/p&gt;&#xA;" OwnerUserId="17065" LastActivityDate="2015-08-05T21:18:24.290" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20450" PostTypeId="1" AcceptedAnswerId="20639" CreationDate="2015-08-05T22:34:56.570" Score="2" ViewCount="784" Body="&lt;p&gt;I'm trying to setup a network configuration in my company like the one in the picture below. A web server publicly accessible in the DMZ but insulated from the internal LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the firewall I'm using the Cisco RVS4000 4-Port Gigabit Security Router with VPN router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v2zXo.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v2zXo.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before setting the DMZ configuration on the router, I was able to ping and ssh back and forth from the LAN host to the server, which I understand as &quot;the server is in the LAN&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After configuring the router to set the server into the DMZ, I'm still able to ping and ssh in both directions on both hosts and I expected to not being able to ping from the server to the host on LAN, which leads to my question:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Do I need to configure ACL or NAT rules to insulate the server to create connections to the LAN host? If yes, then what is the DMZ setting doing?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The DMZ was not supposed to setup the router to block access to the internal LAN?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated. Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="16792" LastActivityDate="2015-09-14T11:32:05.963" Title="Do I need to setup NAT or ACL configurations for my DMZ setup?" Tags="|cisco|routing|security|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20451" PostTypeId="1" AcceptedAnswerId="20453" CreationDate="2015-08-05T23:57:47.283" Score="2" ViewCount="1368" Body="&lt;p&gt;Here is what I do and what happens :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Let assume I have a device A with IP X.X.X.200 connected to the network&lt;/li&gt;&#xA;&lt;li&gt;I use Nmap to ping my local network, with the command &quot;&lt;em&gt;nmap --send-ip -sP 192.168.1.1/24&lt;/em&gt;&quot;&lt;/li&gt;&#xA;&lt;li&gt;Look at the arp table using &quot;&lt;em&gt;arp -a&lt;/em&gt;&quot;, the device A is displayed with his MAC, no problem&lt;/li&gt;&#xA;&lt;li&gt;Now I change manually the IP for A, I set the static IP to X.X.X.201&lt;/li&gt;&#xA;&lt;li&gt;I use the same Nmap command &quot;&lt;em&gt;nmap --send-ip -sP 192.168.1.1/24&lt;/em&gt;&quot;&lt;/li&gt;&#xA;&lt;li&gt;Look at the arp table with &quot;&lt;em&gt;arp -a&lt;/em&gt;&quot;, and then A appears 2 times. One for IP X.X.X.200 and one for IP X.X.X.201&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So the Nmap command did not refresh the IP X.X.X.200, that means it does not really ping all IPs. Because if I ping manually X.X.X.200, then it would get no response and disappear from the arp table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I would like to know how to use this tool, to really refresh an re-populate the arp table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="16335" LastEditorUserId="8499" LastEditDate="2019-04-15T13:15:04.627" LastActivityDate="2019-04-15T13:15:04.627" Title="ARP table is not updated with NMAP" Tags="|ip|ipv4|mac-address|arp|ping|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20452" PostTypeId="2" ParentId="5236" CreationDate="2015-08-06T01:20:28.500" Score="-1" Body="&lt;p&gt;The best and easiest way to make two VLANS communicate is to set up InterVLAN routing. &lt;/p&gt;&#xA;" OwnerUserId="17035" LastActivityDate="2015-08-06T01:20:28.500" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20453" PostTypeId="2" ParentId="20451" CreationDate="2015-08-06T01:27:38.930" Score="6" Body="&lt;p&gt;What happens is desirable. It would not be desirable for an interface with multiple IP addresses to have the ARP cache changed every time one of the different addresses is used. The ARP cache will naturally timeout MAC addresses. You can probably clear the ARP cache, and it will get rebuilt naturally. &lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-08-06T01:27:38.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20454" PostTypeId="2" ParentId="20451" CreationDate="2015-08-06T01:34:07.540" Score="2" Body="&lt;p&gt;Further to Ron's answer - you are confusing your Protocol Layers - NMAP (and ping and other applications) do not populate the ARP cache - your system OS does this via your IP stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ARP cache does not indicate the liveness of a MAC to IP mapping, it merely tells the host that at some point within the last $arp_cache_timeout seconds, this MAC responded to an ARP request for this IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example case when nmap tries to connect to x.x.x.200, the IP stack in your OS sees that there is an entry already in the ARP cache, and simply builds an Ethernet frame destined for the cached MAC Address (which happens to be your local MAC) and sends it.  The lack of response received is because your IP stack no longer responds on that IP address.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-08-06T01:34:07.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20456" PostTypeId="1" CreationDate="2015-08-06T03:05:48.860" Score="3" ViewCount="6513" Body="&lt;p&gt;In my working company we have a 3 Internet providers and interconnected with each other through switches. Every time some PC's suddenly can't browse to the internet but they have connection. I try to ping test the IP of 3 internet providers on each PC's and i get a good result(no request time out). Sometimes all PC's can browse/use the internet and some are not. Also the WIFI sometimes we can connect but sometimes can't. Our main connection is around 4mpbs and the 2 cisco wifi connected there(1st flr and 2nd flr). I don't know what to do. this is my everyday problem. &lt;/p&gt;&#xA;" OwnerUserId="17068" LastActivityDate="2015-10-18T09:00:42.910" Title="Network fluctuation problem" Tags="|internet|lan|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20458" PostTypeId="2" ParentId="20429" CreationDate="2015-08-06T06:20:57.407" Score="1" Body="&lt;p&gt;on a windows machine, in command prompt&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ipconfig /all&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;will give you the IP address of the DHCP server that gave you the dhcp lease.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also most modern operating systems support Automatic Private IP addressing (&quot;APIPA&quot;) that will give a network config if there's no DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the IP address you get begin with 169.254. then it's an APIPA address and there's no rogue DHCP server.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-08-06T06:20:57.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20461" PostTypeId="2" ParentId="20429" CreationDate="2015-08-06T07:52:05.403" Score="1" Body="&lt;p&gt;I have had lots of trouble with the EdgeRouter DHCP server. It is pretty half baked, and does things like this to me often. I'd recommend completely deleting the DHCP server and checking your config to ensure its removal. After that, completely reboot your EdgeRouter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this doesn't fix it, try plugging a device directly onto the LAN of your EdgeRouter. If you still get a valid DHCP address, you should upgrade to the latest firmware, and restore to factory defaults. If you don't get an address when plugged straight into the LAN, you have another DHCP server on your network. &lt;/p&gt;&#xA;" OwnerUserId="15698" LastActivityDate="2015-08-06T07:52:05.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20463" PostTypeId="1" AcceptedAnswerId="20466" CreationDate="2015-08-06T10:12:09.560" Score="3" ViewCount="464" Body="&lt;p&gt;Let us say I create a valid packet (contains telnet request) with TTL value less than the TTL value required to reach the destination IP. Will the computer that receive the IP packet with TTL=1 (become 0 after decrement) in the path to the destination IP send any ICMP response to me?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-08-06T10:27:46.230" Title="ICMP response to source IP when the payload of IP packet is not ICMP?" Tags="|icmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20464" PostTypeId="1" AcceptedAnswerId="20468" CreationDate="2015-08-06T10:12:40.650" Score="1" ViewCount="2045" Body="&lt;p&gt;I am trying to detect if a netcam is connected to my network on an Android app. To do so, I have found that I need to ping every IP on the network in order to get the active devices or somehow send an ARP request. The problem is that this only gets the IP and MAC address of the device, and I would like to get some more details like the manufacturer and model, for instance. How can I do so programmatically?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is certainly something network related that I'm not understanding because this does not appear to be a problem to some networking tools like Fing for Android, which are able to get all details on every device on a network. How do they do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not require a code answer, a theoretical answer should suffice.&lt;/p&gt;&#xA;" OwnerUserId="17075" LastActivityDate="2016-09-13T03:21:50.370" Title="Get details of device connected to a network" Tags="|wireless|arp|ping|network-discovery|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20465" PostTypeId="2" ParentId="20439" CreationDate="2015-08-06T10:18:05.827" Score="0" Body="&lt;p&gt;Put the NAT statement back:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list 100 interface Serial0/0/0 overload&#xA;access-list 100 permit ip 192.168.0.0 0.0.255.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-08-06T10:18:05.827" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="20466" PostTypeId="2" ParentId="20463" CreationDate="2015-08-06T10:27:46.230" Score="8" Body="&lt;p&gt;Yes, the router that decrements the TTL to 0 will discard the packet and send an ICMP time exceeded message (type 11) to the source. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-08-06T10:27:46.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20467" PostTypeId="1" CreationDate="2015-08-06T11:04:15.743" Score="2" ViewCount="1433" Body="&lt;p&gt;Can you use dual-WAN with Active/Passive failover on any of the TZ SonicWALL models? &lt;/p&gt;&#xA;" OwnerUserId="17079" LastEditorUserId="8499" LastEditDate="2016-04-02T16:35:17.197" LastActivityDate="2018-06-22T05:06:33.187" Title="Dell SonicWALL - TZ series Dual Wan" Tags="|wan|failover|dell|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20468" PostTypeId="2" ParentId="20464" CreationDate="2015-08-06T11:17:30.687" Score="3" Body="&lt;p&gt;You can find the vendor of the NIC from the &lt;a href=&quot;http://standards-oui.ieee.org/oui.txt&quot; rel=&quot;nofollow&quot;&gt;OUI database&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="7533" LastActivityDate="2015-08-06T11:17:30.687" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20470" PostTypeId="2" ParentId="20467" CreationDate="2015-08-06T11:35:44.080" Score="1" Body="&lt;p&gt;The TZ series can be used for a dual wan connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://support.software.dell.com/kb/sw7588&quot; rel=&quot;nofollow&quot;&gt;Configuring WAN Failover &amp;amp; Load-Balancing in SonicOS Enhanced (5.5 and below) (SW7588)&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Feature:&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;WAN Failover and Load Balancing allows you to designate the one of the&#xA;  user-assigned interfaces as a Secondary or backup WAN port. The&#xA;  secondary WAN port can be used in a simple active/passive setup, where&#xA;  traffic is only routed through the secondary WAN port if the primary&#xA;  WAN port is down and/or unavailable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For Active/Passive, as described by the article, it is possible to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: on the right section, you see on what appliance it is available (Which includes the TZ series)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="17033" LastEditorUserId="8499" LastEditDate="2016-04-02T16:38:24.290" LastActivityDate="2016-04-02T16:38:24.290" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20473" PostTypeId="1" CreationDate="2015-08-06T14:39:41.490" Score="7" ViewCount="7411" Body="&lt;p&gt;Cisco ASR routers use IOS XE software. One can see the received IPv4 unicast prefixes from BGP neighbor before any inbound policies with &lt;code&gt;sh bgp ipv4 unic neigh &amp;lt;neighbor-address&amp;gt; received routes&lt;/code&gt; command. Output of this command is following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best&#xA;              i - internal, r RIB-failure, S stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;   Network            Next Hop            Metric LocPrf Weight Path&#xA;*  10.10.10.0/24    192.168.4.9                           0 65001 65005 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to see communities attached to 10.10.10.0/24 prefix before any inbound policies?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="8499" LastEditDate="2016-03-29T17:52:36.737" LastActivityDate="2021-02-10T21:39:02.530" Title="How to view BGP community attached to prefix in Cisco ASR routers?" Tags="|bgp|cisco-ios-xr|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20475" PostTypeId="2" ParentId="20464" CreationDate="2015-08-06T16:10:25.693" Score="1" Body="&lt;p&gt;Instead of pinging every single device, you could ping the broadcast address, and all devices would reply. For example, if you are on a 192.168.0.0/24 network, your broadcast address would be 192.168.0.255. Then all devices would send out an ARP reply. From here you could run a port scan on the specific IP address that the MAC in question is tied to. If you don't know the MAC address, you're going to have to do a scan on every device that replies. &lt;/p&gt;&#xA;" OwnerUserId="15698" LastActivityDate="2015-08-06T16:10:25.693" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="20476" PostTypeId="2" ParentId="20439" CreationDate="2015-08-06T17:08:07.740" Score="0" Body="&lt;p&gt;If you're trying to block devices that are inside local from reaching the ISP without getting NAT'd first (changed from 192.168.0.x to 10.0.0.x): Create an ACL which either allows all traffic that isn't 192.168.0.x, or only allows 10.0.0.x, and apply it to the outgoing interface of Enterprise Router.&lt;/p&gt;&#xA;&lt;p&gt;Something like this would block 192.168.0.x, but allow everything else:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;ip access-list standard 101&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;deny 192.168.0.0 0.0.0.255&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;permit any&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;And this would allow only the 10.0.0.x network through:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;ip access-list standard 101&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;permit 10.0.0.0 0.0.0.255&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;deny any&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;(You don't need to enter the &amp;quot;deny any&amp;quot; command, as ACLs have an explicit deny command at the end by default)&lt;/p&gt;&#xA;&lt;p&gt;Then apply one of these to the S0/0/0 interface of Enterprise Router:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;interface S0/0/0&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;ip access-group 101 out&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Things to note: This is using a standard ACL rather than an extended one since you just want to permit or deny based on the source IP. If you wanted to filter out based on ports or permit/deny based on &lt;em&gt;source and destination&lt;/em&gt; IP, you would use and extended ACl.&#xA;Also, since this is a standard ACL, it gets put as close to the destination as possible; this way you don't filter out legitimate traffic with the stuff you want to block. This means assigning it as outgoing on the S0/0/0 port in this case.&lt;/p&gt;&#xA;" OwnerUserId="16755" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-08-06T17:24:32.817" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="20477" PostTypeId="1" AcceptedAnswerId="20491" CreationDate="2015-08-06T20:07:30.770" Score="6" ViewCount="25433" Body="&lt;p&gt;I am a newbie at managing my firewall so this is a really basic question.  My firewall is a Cisco 5505.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the appropriate command (or commands) to run on the command line interface to delete an object and remove it from all groups and rules it is part of?&#xA;This is what I have found but it doesn't let you run it until you have removed the object from all groups and rules:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no object network MyComputer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a command that will remove an object from all groups and all rules it is a part of (or a different object delete command that will do this in one step)?&lt;/p&gt;&#xA;" OwnerUserId="17088" LastEditorUserId="509" LastEditDate="2015-08-06T20:27:04.470" LastActivityDate="2018-08-07T22:57:57.307" Title="Correct Cisco ASA CLI Command To Delete Network Objects (force)" Tags="|cisco-asa|cli|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20478" PostTypeId="2" ParentId="20429" CreationDate="2015-08-06T20:43:20.827" Score="1" Body="&lt;p&gt;I see that you prefer to use EdgeRouter, but such case I would handle with Mikrotik where you can tell DHCP server to automatically register clients also in ARP table (option &quot;Add ARP for leases&quot; in DHCP setup - see &lt;a href=&quot;http://mikrotik-learning.blogspot.com/2011/11/mikrotik-blocking-unleased-dhcp-ip.html&quot; rel=&quot;nofollow&quot;&gt;http://mikrotik-learning.blogspot.com/2011/11/mikrotik-blocking-unleased-dhcp-ip.html&lt;/a&gt;) and use reply-only option for ARP on the network interface towards client and use switches where I would configure either dhcp snooping or hard port limit of 1 mac per port with long history. This way it would be way harder to do anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attacker would need to find some valid mac/ip combination and would need unused ports to register with faked mac and faked ip.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2015-08-06T20:43:20.827" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20480" PostTypeId="2" ParentId="14978" CreationDate="2015-08-06T21:29:37.333" Score="2" Body="&lt;p&gt;Maybe it is just that gateway gives most CPU cycles to traffic forwarding as it should and less to admin part. This way denial of service attacks on IP of the gateway itself would be less visible,&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2015-08-06T21:29:37.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20481" PostTypeId="2" ParentId="14978" CreationDate="2015-08-06T22:17:58.007" Score="1" Body="&lt;p&gt;The first edit describes why ping to a VE is slow (expected) but the other issue of ssh/telnet being slow was due to a firmware bug and was solved by an update to a later version of NOS&lt;/p&gt;&#xA;" OwnerUserId="10240" LastActivityDate="2015-08-06T22:17:58.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20482" PostTypeId="1" AcceptedAnswerId="20490" CreationDate="2015-08-06T22:28:20.710" Score="2" ViewCount="2058" Body="&lt;p&gt;I ran a test-setup which caused excessive amount of collisions on Cisco FastHub 400 port. This caused switch to isolate this port. For example in case of port 6, this has happened 766 times:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hub#sh interfaces fastethernet 1/0/6&#xA;FastEthernet 1/0/6 is link-up&#xA;Hardware is built-in 100Base-Tx&#xA;Description: &#xA;Port admin: enabled&#xA;Port partition: not Auto Partitioned&#xA;Port operation: Operational&#xA;Speed admin: Auto Negotiation&#xA;Speed status: 100M&#xA;Last Source MAC Address: 00-1D-09-F0-92-AC&#xA;&#xA;Counters&#xA;--------------------------------------------------------------------&#xA;Bytes Received         1343247196  Frame Received            3719902&#xA;CRC Errors                      0  Alignment Errors                0&#xA;Frame Too Long                  0  Short Events                    0&#xA;Port Runts                      0  Collisions                1145745&#xA;Late Events                     1  Data Rate Mismatches            0&#xA;Auto Partitions               766  Total Errors                    1&#xA;&#xA;Hub#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What was the main reason in hub networks to cause such high amount of collisions that hub had to isolate the port from rest of the network?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="8499" LastEditDate="2019-01-03T02:06:58.897" LastActivityDate="2019-01-03T02:06:58.897" Title="Reason for excessive amount of collisions in hub networks?" Tags="|ethernet|layer1|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20485" PostTypeId="1" AcceptedAnswerId="35149" CreationDate="2015-08-06T23:07:51.840" Score="2" ViewCount="2679" Body="&lt;p&gt;I have a issue with my internet connection and I want to know if the ping response times can be affected by the use of internet. Let me explain, when I turn on my computer and no other device is using the internet connection, and I do nothing more than ping www.google.com y have the next output &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ping www.google.com &#xA;PING www.google.com (173.194.42.113): 48 data bytes&#xA;56 bytes from 173.194.42.113: icmp_seq=0 ttl=49 time=76.820 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=1 ttl=49 time=73.923 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=2 ttl=49 time=87.032 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=3 ttl=49 time=75.011 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=4 ttl=49 time=122.664 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=5 ttl=49 time=76.388 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=6 ttl=49 time=79.530 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=7 ttl=49 time=78.308 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I start using the browser or the mail client or some other thing, lets see.. opening youtube in the browser the ping response times changes abruptly &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;56 bytes from 173.194.42.113: icmp_seq=85 ttl=49 time=214.825 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=86 ttl=49 time=932.497 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=87 ttl=49 time=596.405 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=88 ttl=49 time=299.450 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=89 ttl=49 time=1628.341 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=90 ttl=49 time=1440.310 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=91 ttl=49 time=1219.659 ms&#xA;56 bytes from 173.194.42.113: icmp_seq=92 ttl=49 time=762.968 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And In general the internet experience becomes &quot;slower&quot; for any other activity apart from opening youtube, when youtube is full loaded, the ping times become normal again (under 100 ms)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is just with my computer, just with my browser just using two tabs, youtube and some other random web page just to test, obviously when other host connect to the router and try to reach some page in internet the results are worst, I have reached 4000 ms of ping when a youtube video is playing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question... It is normal for ping response times (to some internet site) to change in that way when internet connection is used ?&lt;/p&gt;&#xA;" OwnerUserId="17094" LastActivityDate="2016-12-21T17:14:37.527" Title="why can ping have an unstable response time?" Tags="|internet|ping|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="20486" PostTypeId="2" ParentId="20482" CreationDate="2015-08-06T23:32:00.687" Score="2" Body="&lt;p&gt;Hubs are inherently half-duplex.  This is part of the ethernet specification, and collisions are to be expected.  An excessive number of collisions may be a symptom of a full-duplex device connected to the hub.  The full-duplex device will not listen to see if there is already traffic on the line before sending, and this will cause excessive collisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not the only possibility, but it is easy to check.  Bad ports or cabling can cause excessive collisions, too, but these are much more difficult to diagnose.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-08-06T23:32:00.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20488" PostTypeId="2" ParentId="16005" CreationDate="2015-08-07T02:20:38.013" Score="0" Body="&lt;p&gt;Shut down 1 of the 2 admin users.cisco's are very watcthful of any,any,any kind of possible hack entry points via connect. With two admins. Connected the cisco will believe that an intruder is also connected and block further progress without proper login.once control is reastablished,you should be able to add admin's&lt;/p&gt;&#xA;" OwnerUserId="17097" LastActivityDate="2015-08-07T02:20:38.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20489" PostTypeId="2" ParentId="20482" CreationDate="2015-08-07T02:54:24.393" Score="1" Body="&lt;p&gt;Port partition:not auto partitioned, is the setting you need to modifiy.partioned to a specific port will enable config. Also your bytes rec. to bytes sent that is dramatic,classic loss of data transfer.you probably had a loss of connectivity with the carrier.&lt;/p&gt;&#xA;" OwnerUserId="17097" LastActivityDate="2015-08-07T02:54:24.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20490" PostTypeId="2" ParentId="20482" CreationDate="2015-08-07T03:41:52.647" Score="3" Body="&lt;p&gt;Ethernet originally utilized CSMA/CD (carrier sense multiple access with collision detection). Note that &quot;collision&quot; is part of the name. CSMA/CD is required in a hubbed environment due to the nature of how a hub operates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hubs operate at the physical layer by repeating a signal received on one port out all the other ports on the device. If a hub receives a signal on two different ports at the same time, the resulting &quot;merged&quot; signal that gets repeated is meaningless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately all this means is that collisions on a hub are to be entirely expected. However in your case, the number of collisions is very high, over 30% of your traffic. So what can create a situation like you are facing? Here is a non-exhaustive list:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Duplex mismatch with a connected device - the connected device would have to be configured for full duplex or auto-negotiation is failing.&lt;/li&gt;&#xA;&lt;li&gt;A loop on the network.&lt;/li&gt;&#xA;&lt;li&gt;Many devices on the collision domain; the more devices you have the greater the chance of collisions occurring.&lt;/li&gt;&#xA;&lt;li&gt;Network design that violates the &lt;a href=&quot;https://en.wikipedia.org/wiki/5-4-3_rule&quot; rel=&quot;nofollow&quot;&gt;5-4-3 rule&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;A device that is defective/malfunctioning.&lt;/li&gt;&#xA;&lt;li&gt;A newer device that does not behave correctly in a half-duplex environment, sometimes related to a driver issue.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-08-07T03:41:52.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20491" PostTypeId="2" ParentId="20477" CreationDate="2015-08-07T04:11:27.883" Score="7" Body="&lt;p&gt;Unfortunately, Cisco has not given us a precise, one-line way to remove a single object or object-group.  This is something that may come in time as the ASA code continues to mature and the ASA's themselves get more CPU resources.  The original ASA line was pathetically underpowered in the CPU department.  Your 5505, for example, was first released in 2006 and has a &lt;code&gt;Pentium 4 Celeron 2000 MHz&lt;/code&gt;!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An intelligent, recursive search through the configuration to remove an object or object-group would require CPU resources that just weren't there when the software was being written.  Especially not if they had to come at the cost of processing traffic.  I work daily on ASAs with thousands of objects and and tens of thousands of ACL lines, and I wish for this feature every day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For now we're left with a manual search process, similar to what I demonstrate below.  This process can certainly be automated in Python, for example, however I give the manual process to illustrate the logic involved.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For this example, I have the following object, object-group, and ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network TEST-OBJECT&#xA; host 10.10.10.10&#xA;&#xA;object-group network TESTING-OBJECT-GROUP&#xA; network-object object TEST-OBJECT&#xA; network-object host 10.10.10.20&#xA;&#xA;access-list TEST-ACL extended permit ip any object-group TESTING-OBJECT-GROUP &#xA;access-list TEST-ACL extended permit ip any object TEST-OBJECT  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I want to remove &lt;code&gt;TEST-OBJECT&lt;/code&gt; and any references to it, as you found out, I can't simply do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa2-local(config)# no object network TEST-OBJECT&#xA;ERROR: unable to delete object (TEST-OBJECT). object is being used.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I now have to search for all instances of the object and remove those lines.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;First, I look at the running-configuration for the object name and for the string &lt;code&gt;p n&lt;/code&gt;, which matches &lt;code&gt;object-group network&lt;/code&gt;.  This gives us the names of all network object-groups, and we now have to simply look for instances of &lt;code&gt;TEST-OBJECT&lt;/code&gt;, then go up to find what object-group it is a member of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa2-local# show run | inc TEST-OBJECT|p n&#xA;object network TEST-OBJECT&#xA;object-group network TESTING-OBJECT-GROUP&#xA; network-object object TEST-OBJECT&#xA;access-list TEST-ACL extended permit ip any object TEST-OBJECT  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So we know we need to remove &lt;code&gt;TEST-OBJECT&lt;/code&gt; from the &lt;code&gt;TESTING-OBJECT-GROUP&lt;/code&gt; object group, and remove a single ACL line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa2-local(config)# object-group network TESTING-OBJECT-GROUP&#xA;asa2-local(config-network-object-group)# no network-object object TEST-OBJECT&#xA;asa2-local(config-network-object-group)# exit&#xA;asa2-local(config)# no access-list TEST-ACL extended permit ip any object TEST-OBJECT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally we can successfully remove the object itself and validate that it is gone:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asa2-local(config)# no object network TEST-OBJECT&#xA;asa2-local(config)# show run object&#xA;asa2-local(config)# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="44" LastActivityDate="2015-08-07T04:11:27.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20495" PostTypeId="1" AcceptedAnswerId="20503" CreationDate="2015-08-07T09:27:09.067" Score="2" ViewCount="552" Body="&lt;p&gt;My company uses the 192.168.10.0/24 subnet and 192.168.10.235 is for all intents and purposes the gateway to the Internet. We have an extra VDSL line with a &quot;home-style&quot; modem/router that we want to connect as a backup. My initial idea was to connect the VDSL modem/router to a spare CISCO 878 router we have, and then connect the 878 to our switch, with an IP of 192.168.10.236, so that a change of default gateway in Windows settings is all it takes to reach the Internet via the VDSL connection, instead of our normal &quot;enterprise&quot; line. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the 878 is designed to route packets from the WAN interface (which is ISDN, so of no use to us) to the 4 LAN interfaces and vice versa. The LAN interfaces are not router ports, but switch ports, all set to VLAN1. I understand, after reading official CISCO documentation, that in any 800 series router it is impossible to route from one LAN interface to another, for the aforementioned reasons. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I want to ask this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to make this work with the equipment I have? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now want to present an idea about a possible solution I have thought about, but please bear with me (it is a bad idea at best, moronic and unworkable at worst):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I can connect the VDSL router to my switch with the 192.168.1.1 IP address, even though everything else is on the 192.168.10.0/24 subnet. If I connect the 878 on the switch, with the 192.168.10.236 IP (as per the original plan), is there a way to use a SINGLE one of its ports to route packets from 192.168.10.0/24 to 192.168.1.0/24? My idea is to be able to change the default gateway from 192.168.10.235 to 192.168.10.236 (the 878 IP address) and then have the CISCO send the packets BACK to the switch, but destined for the 192.168.1.0/24 network. Mind you my main switch is not VLAN capable. I know this is probably a long shot, and far from best practice, but I thought that maybe it could be kludged together, perhaps by setting up multiple IP addresses on VLAN1 on the 878.&lt;/p&gt;&#xA;" OwnerUserId="17104" LastActivityDate="2015-08-07T19:45:04.130" Title="Two network routing with CISCO 878" Tags="|cisco|routing|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20497" PostTypeId="2" ParentId="20485" CreationDate="2015-08-07T14:50:27.853" Score="-2" Body="&lt;p&gt;Since you pinged your router and always had a response time 1 ms it is your connection to the internet that is the bottleneck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the video has to be downloaded, data can only be sent one by one since your connection is limited to 1Mbit/s.&#xA;Your network cannot receive all the requested data in this amount of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At my home, my flatmate had terrible Round-Trip Times or could not even ping any server when I was downloading files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Upgrading your connection&lt;/code&gt; should help solving this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possible solution would be to &lt;code&gt;limit the amount of bandwidth that your browser is allowed to use&lt;/code&gt;. But that leads to a longer waiting time for the Youtube videos.&lt;/p&gt;&#xA;" OwnerUserId="16734" LastActivityDate="2015-08-07T14:50:27.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20503" PostTypeId="2" ParentId="20495" CreationDate="2015-08-07T19:45:04.130" Score="3" Body="&lt;p&gt;The solution you suggest might work as long as you do not need to do NAT on the Cisco. You can simply configure eg 192.168.1.10 on the interface as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FastEthernet X&#xA;  ip address 192.168.1.10 255.255.255.0 secondary&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then add a default route towards your VDSL router.&#xA;Do not forget to also add a static route for you internal network to the VDSL router via the Cisco. If that is not possible you need to do NAT...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another solution would be to define a second VLAN, eg. VLAN 2 on the Cisco&#xA;and place one of the switchport Interfaces into that VLAN and the route between these two interfaces as above. This would also enable you do do NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the relay easiest way would be to just reconfigure your VDSL router's LAN IP to be 192.168.10.236 and disable the DHCP server on it, then connect it to your switch, magic done.&lt;/p&gt;&#xA;" OwnerUserId="13745" LastActivityDate="2015-08-07T19:45:04.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20505" PostTypeId="1" CreationDate="2015-08-08T05:27:39.007" Score="2" ViewCount="460" Body="&lt;p&gt;Why is it possible for me to create a network such as 10.0.0.0/9 which ranges from 10.0.0.0 to 10.127.255.255 but not a network such as 128.0.0.0/2 which should range from 128.0.0.0 to 191.255.255.255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason I am unallowed to create subnet masks with a CIDR value of less than 8. Why is this so?&lt;/p&gt;&#xA;" OwnerUserId="889" LastActivityDate="2018-12-06T15:03:35.727" Title="Why Can't I Subnet the First Octet?" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="6" ClosedDate="2018-12-06T15:46:35.750" ContentLicense="CC BY-SA 3.0" />
  <row Id="20507" PostTypeId="2" ParentId="19321" CreationDate="2015-08-08T10:46:59.630" Score="1" Body="&lt;p&gt;I think SDN has lost it's meaning a bit (i.e. it can mean several different things now) because a lot of vendors have entered this market with several solutions that implement &quot;SDN&quot; in different ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've blogged about SDN and it's origins here: &lt;a href=&quot;http://filipv.net/2014/03/17/on-sdn-nfv-and-openflow/&quot; rel=&quot;nofollow&quot;&gt;http://filipv.net/2014/03/17/on-sdn-nfv-and-openflow/&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you specifically mention VMware NSX in your question and how it contrasts with SDN, I'd say the main difference is that SDN typically also &quot;programs state&quot; in the data plane of the network, by using OpenFlow for example, and also configures physical network devices by using OVSDB for example. Whereas VMware NSX is a network virtualisation solution that does not configure or program forwarding state in physical devices but threats the physical network purely as an underlay to carry the overlay network which it does &quot;program&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: in the next version of NSX-v, there will be OVSDB support so the lines will become more blurry. NSX-MH (the old Nicira NVP product) already had OVSDB support.&lt;/p&gt;&#xA;" OwnerUserId="17118" LastActivityDate="2015-08-08T10:46:59.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20510" PostTypeId="1" AcceptedAnswerId="20511" CreationDate="2015-08-09T00:19:02.487" Score="3" ViewCount="5183" Body="&lt;p&gt;If a router is connected to a switch via LAN to LAN connection, then the router will be the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the question is, if two routers are connected to a switch via LAN-LAN, then which DHCP will work??&lt;/p&gt;&#xA;" OwnerUserId="16870" LastActivityDate="2015-09-08T11:31:56.110" Title="Which DHCP server will work if there are two of them in a network?" Tags="|dhcp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20511" PostTypeId="2" ParentId="20510" CreationDate="2015-08-09T00:53:32.500" Score="10" Body="&lt;p&gt;DHCP (Dynamic Host Configuration Protocol) utilizes four key steps as illustrated below:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;DHCP Discovery (DHCPDISCOVER) -  Sent by the Client seeking a DHCP Server.&lt;/li&gt;&#xA;&lt;li&gt;DHCP Offer (DHCPOFFER) - Sent by the DHCP Server to offer an address (and other DHCP options) to the Client.&lt;/li&gt;&#xA;&lt;li&gt;DHCP Request (DHCPREQUEST) - Sent by the Client to accept the lease for the offered address.&lt;/li&gt;&#xA;&lt;li&gt;DHCP Acknowledgement (DHCPACK) -  Sent by the Server to acknowledge that the Client now has the lease for that address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Diagram of these transactions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Client            DHCP Server&#xA;  |                    |&#xA;  |  DHCPDISCOVER ---&amp;gt; |&#xA;  |                    |&#xA;  |    &amp;lt;--- DHCPOFFER  |&#xA;  |                    |&#xA;  |  DHCPREQUEST ---&amp;gt;  |&#xA;  |                    |&#xA;  |      &amp;lt;--- DHCPACK  |&#xA;  |                    |&#xA;  \/                   \/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each of these messages is a broadcast packet, sent to a destination of 255.255.255.255.  Meaning this will go to all hosts on a particular L2 segment. (By default DHCP is a broadcast centric technology, however you can use DHCP Relay features to cross L3 boundaries.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that DHCP uses UDP ports 67 for the DHCP Server and 68 for the Client.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now, for your answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When there are two (or more) DHCP servers accessible from a particular L2 segment, it becomes a race condition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Client issues a broadcast DHCPDISCOVER and then waits.  Both DHCP Servers receive the message and broadcast DHCPOFFER replies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Whichever DHCP Server's DHCPOFFER packet is received first by the Client will &quot;win&quot;, and that Server will receive a DHCPREQUEST from the Client.&lt;/strong&gt;  This can actually cause a Denial of Service condition depending on the circumstances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a past job, I worked in the NOC of a regional ISP.  We utilized a particular brand of DSLAM which had a software bug that caused it to not filter DHCP messages coming &lt;strong&gt;from&lt;/strong&gt; the customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This meant that anytime a customer plugged their home router in backwards (LAN port to the DSL Modem, instead of WAN port to the DSL Modem), they began to issue DHCPOFFERs to every router attached to a modem on that DSLAM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because this new Rouge DHCP Server was significantly closer to the customers than the actual DHCP server, it won the race every time.  This caused a cascading outage as DHCP leases expired on routers on that DSLAM, and they acquired private addresses from the Rouge DHCP Server.&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2015-09-08T11:31:56.110" LastActivityDate="2015-09-08T11:31:56.110" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20512" PostTypeId="1" CreationDate="2015-08-09T07:19:39.377" Score="2" ViewCount="109" Body="&lt;p&gt;In wireless networking, for power efficiency the access point(AP) sends a beacon to inform the client of pending packets periodically and the client only wakes up every beacon interval (e.g. 100msec) to listen to beacons. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, a client have no idea about the specific time when a beacon arrives. How does it know when to wake up and get the beacon?&lt;/p&gt;&#xA;" OwnerUserId="17126" LastEditorUserId="17126" LastEditDate="2015-08-09T07:33:51.207" LastActivityDate="2015-08-09T14:42:51.747" Title="How does a client know when to wake up and listen to a beacon?" Tags="|wireless|ieee-802.11|mac|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20514" PostTypeId="2" ParentId="20512" CreationDate="2015-08-09T14:42:51.747" Score="1" Body="&lt;p&gt;Beacon frames contain timestamps which the client uses to update its clock. Technically it does know when a beacon arrives due to this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A client is expected to wake up and listen to a minimum of one beacon when the listening time is up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH.&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2015-08-09T14:42:51.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20515" PostTypeId="1" CreationDate="2015-08-09T16:23:48.197" Score="1" ViewCount="415" Body="&lt;p&gt;I have DHCP inplementation in my college hostel. Here we have 5-6 switches to which all hosts are connected and a router. So how is the DHCP reservation implemented if each host is not directly connected to router. Or can I implement DHCP reservation on a switch  &lt;/p&gt;&#xA;" OwnerUserId="17132" LastEditorUserId="509" LastEditDate="2015-08-09T20:29:20.630" LastActivityDate="2015-08-11T06:59:48.763" Title="DHCP Reservation" Tags="|dhcp|" AnswerCount="4" CommentCount="1" ClosedDate="2017-01-29T05:17:16.807" ContentLicense="CC BY-SA 3.0" />
  <row Id="20517" PostTypeId="1" AcceptedAnswerId="20548" CreationDate="2015-08-09T17:54:01.817" Score="1" ViewCount="526" Body="&lt;p&gt;I have a question regarding pipelined HTTP, is that the same thing as a persistent HTTP connection. If not what exactly does it mean?&lt;/p&gt;&#xA;" OwnerUserId="17134" LastEditorUserId="8499" LastEditDate="2018-02-16T04:06:45.013" LastActivityDate="2018-02-16T04:06:45.013" Title="Pipelined / Persistent HTTP" Tags="|network|" AnswerCount="1" CommentCount="1" ClosedDate="2015-08-11T13:14:33.180" ContentLicense="CC BY-SA 3.0" />
  <row Id="20518" PostTypeId="1" CreationDate="2015-08-09T19:25:29.553" Score="2" ViewCount="2323" Body="&lt;p&gt;I am new to networking; so far we learned about the OSI model, packaging stuff, Wireshark, and network troubleshooting. As I have had understood, Wireshark is able to capture all packets by going to promiscuous mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I go to promiscuous or monitor mode I will be disconnected from my router and can't see any traffic except DHCP and such stuff. No relevant TCP, UDP,... stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think of course it's because if someone is not associated to my router he should not be able to see my traffic but what is the promiscuous mode for? When I am not associated to my access point, what's the sense of capturing?&lt;/p&gt;&#xA;" OwnerUserId="17137" LastEditorUserId="3075" LastEditDate="2016-06-22T14:30:18.920" LastActivityDate="2016-06-22T14:30:18.920" Title="Using Wireshark for traffic capturing in promiscuous mode" Tags="|wireshark|monitoring|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20520" PostTypeId="2" ParentId="20518" CreationDate="2015-08-09T21:23:15.000" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But when i go to promiscous or monitor mode i will be disconnected from my router and cant see any traffic except dhcp and such stuff. but no relevant tcp, udp,.. stuff.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For promiscuous mode, which is mainly a wired-network feature (it doesn't work well on Wi-Fi adapters), you won't be &quot;disconnected&quot; in the sense that you will no longer be connected to the network.  However, &lt;a href=&quot;https://wiki.wireshark.org/CaptureSetup/Ethernet#Switched_Ethernet&quot; rel=&quot;nofollow&quot;&gt;Ethernet doesn't generally work the way it originally did&lt;/a&gt;, and promiscuous mode doesn't work as well as it used to.  &lt;a href=&quot;https://en.wikipedia.org/wiki/Promiscuous_mode&quot; rel=&quot;nofollow&quot;&gt;Promiscuous mode is a mode your network adapter works in, in which it hands packets to the host no matter what the destination MAC address&lt;/a&gt;, but if the &lt;em&gt;switch&lt;/em&gt; won't even &lt;em&gt;send&lt;/em&gt; you the packets that aren't broadcast or multicast or addressed to you, there's nothing your adapter can do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For monitor mode, which is a Wi-Fi feature (it doesn't exist on wired adapters), whether you are &quot;disconnected&quot; in monitor mode, in the sense that you will no longer be connected to the network, depends on your network adapter, OS, and driver.  Wi-Fi networks are on a shared medium, unlike switched Ethernet networks, so you'll be able to capture all the packets; however, most Wi-Fi networks are &quot;protected&quot;, using WEP or WPA/WPA2, meaning the traffic is encrypted, and you'll need a tool that can decrypt that traffic (such as Wireshark) &lt;a href=&quot;https://wiki.wireshark.org/HowToDecrypt802.11&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;and&lt;/em&gt; the password for the network &lt;em&gt;and&lt;/em&gt;, for modern networks using WPA or WPA2, the initial connecting-to-the-network handshake for each device whose traffic you want to decrypt&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your problem sounds like &quot;can see only broadcast traffic&quot; (such as broadcast DHCP requests), so you're probably on a switched Ethernet, and will have to use one of the techniques mentioned in &lt;a href=&quot;https://wiki.wireshark.org/CaptureSetup/Ethernet#Switched_Ethernet&quot; rel=&quot;nofollow&quot;&gt;the Wireshark Wiki's page on Ethernet capturing&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you later refer to being associated with the network, which sounds like Wi-Fi.  In that case, promiscuous mode won't help; you'll need monitor mode &lt;em&gt;and&lt;/em&gt; all the stuff necessary for decrypting traffic.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2015-08-09T21:23:15.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20522" PostTypeId="2" ParentId="20510" CreationDate="2015-08-09T22:09:07.167" Score="0" Body="&lt;p&gt;As said already - the fastest one. We did a case for a customer who wanted to have static addresses for hosts, but with dynamic provisioning. We installed two FreeBSD boxes with DHCP server on two different server rooms which received configuration from customers frontend application upon change and included them into isc dhcpd. Both servers had the same config just to insure everything would work in case of failure of one server, server room or something else. It was funny observing how one box was way faster than the other one. Both received DHCPDISCOVER messages and both tried to respond, but one was fastest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This worked for more than 2 years if I remember correctly.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2015-08-09T22:09:07.167" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20523" PostTypeId="2" ParentId="20515" CreationDate="2015-08-09T22:12:05.977" Score="0" Body="&lt;p&gt;You need to do reservation on your DHCP server - which might be running on your router, but not necessarily. Theoretically you could have DHCP server running on switch (on Layer 3 switch), but I guess this is not the case for you. So look at your router for reservations.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2015-08-09T22:12:05.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20524" PostTypeId="2" ParentId="20515" CreationDate="2015-08-09T22:52:01.680" Score="0" Body="&lt;p&gt;DHCP is &quot;implemented&quot; as normal, whether or not the DHCP server is in the device the computer is directly connected to - a discover is sent, an offer is received, a request is sent, an acknowledgement is received. So long as it's all one network (at layer 2) no particular setup is required to manage that - it's supposed to work, and generally does. Many of mine pass through 3 switches to and from the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's not all one network, you get into needing &quot;helpers&quot; to get DHCP requests from a network without DHCP servers to a server that lives elsewhere and hands out the addresses for that other network. This is more complicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting it up in the switches first requires switches that have the capability, and then it requires a fanatical dedication to documentation and management - if every switch is a DHCP server, you have a potential mess, and in most cases it becomes an actual mess. It's much, much less confusing to have a single DHCP server where you managed all the reservations and pools for non-reserved machines. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;strong&gt;usually&lt;/strong&gt; IS the router/firewall in small networks, but it does not NEED to be - it can be a completely different machine, so long as it's on the network.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2015-08-10T00:13:20.020" LastActivityDate="2015-08-10T00:13:20.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20527" PostTypeId="1" CreationDate="2015-08-10T01:32:44.487" Score="1" ViewCount="158" Body="&lt;p&gt;In the next time, I’m connecting to the internet via my neighbor’s router/connection (VDSL) and I want to create a secure/private sub(?)-network between my MacBook, TimeCapsule and the neighbor’s router/the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Apple’s TimeCapsule can’t handle OpenVPN—and a VPN-Service is probably the way to go for creating a secure connection—I thought I’d also have to set up an OpenVPN router—maybe the Netgear R7000 with AdvancedTomato—to handle the OpenVPN connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my humble opinion, this way—MacBook/TimeCapsule to OpenVPN router—I could create a secure connection to the internet. Though, does this also work when there is another router between my OpenVPN router and the router connecting to the internet?&lt;/p&gt;&#xA;" OwnerUserId="17141" LastEditorUserId="17141" LastEditDate="2015-08-10T01:47:47.633" LastActivityDate="2015-08-10T01:47:47.633" Title="Create private sub(?)-network with AdvancedTomato router and Apple Time Capsule …" Tags="|router|vpn|subnet|private-vlan|" AnswerCount="0" CommentCount="2" ClosedDate="2015-08-10T05:27:29.420" ContentLicense="CC BY-SA 3.0" />
  <row Id="20529" PostTypeId="2" ParentId="20515" CreationDate="2015-08-10T10:34:28.423" Score="1" Body="&lt;p&gt;If you're speaking about regular L2 ethernet switches this is not that hard. Forwarding works just because you're still working in a single broadcast domain. The server can differentiate between hosts by using chaddr instead of the MAC address on ethernet layer. Of course this requires the operator to know the MAC address of each student's laptop, which might be tedious.&lt;/p&gt;&#xA;&lt;p&gt;Alternatively (still L2) the switches might intercept DHCP packets and insert &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3046&quot; rel=&quot;nofollow noreferrer&quot;&gt;option-82&lt;/a&gt;, more specifically circuit-id. In this option it can reflect on which circuit (i.e. cable) the packet came in, this will usually translate directly to a room. The DHCP server then does reservations based on this identifier. So then administration is a bit easier and you can just assign addresses per room.&lt;/p&gt;&#xA;&lt;p&gt;If it are L3 switches (basically routers), there are 2 options. Either they do DHCP themselves which returns us to the trivial case. Alternatively, the routers implement DHCP relay where they usually also fill out option-82 with something sensible. Again chaddr and/or option-82 can be used by the server for address reservation.&lt;/p&gt;&#xA;&lt;p&gt;Note that while option 82 is officially called relay agent information, it's often enough inserted/modified by L2 aggregation that don't perform any relay function.&lt;/p&gt;&#xA;" OwnerUserId="2062" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-08-10T10:34:28.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20530" PostTypeId="1" CreationDate="2015-08-10T12:12:26.537" Score="6" ViewCount="6366" Body="&lt;p&gt;I have a C891FW router with IOS 15.4 on which I'm trying to configure a remote access VPN for Android's native VPN client. I'm authenticating with RSA-Sig and XAUTH. The tunnel forms but I can't reach any internal resources, nor can I reach the Internet through the tunnel. Any help with what could be wrong would be much appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've removed parts of the config that I deemed irrelevant or sensitive.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;hostname Skynet&#xA;enable secret 5 xxxxx&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login local_auth local&#xA;aaa authentication login ClientAuth local&#xA;aaa authorization console&#xA;aaa authorization exec local_auth local&#xA;aaa authorization network local_auth local&#xA;aaa authorization network ClientAuth local&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;clock timezone CET 1 0&#xA;clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;!&#xA;crypto pki trustpoint vpn-tp&#xA; usage ike&#xA; revocation-check none&#xA; rsakeypair vpn-tp&#xA;!&#xA;!&#xA;crypto pki certificate chain vpn-tp&#xA; certificate 01&#xA;          xxx&#xA;quit&#xA; certificate ca 00EC7044BAD01A044F&#xA;          xxx&#xA;quit&#xA;no ip source-route&#xA;no ip gratuitous-arps&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;username jimmy privilege 15 secret 5 xxxx&#xA;username vpnuser privilege 0 secret 5 xxxx&#xA;!&#xA;ip ssh time-out 60&#xA;ip ssh authentication-retries 2&#xA;ip ssh version 2&#xA;ip ssh dh min size 4096&#xA;!&#xA;!&#xA;crypto isakmp policy 3&#xA; encr aes&#xA; group 2&#xA;crypto isakmp identity dn&#xA;!&#xA;crypto isakmp client configuration group &amp;lt;group&amp;gt;&#xA; key &amp;lt;secret key&amp;gt;&#xA; dns y.y.y.y&#xA; pool dynpool&#xA; include-local-lan&#xA; netmask 255.255.255.0&#xA;crypto isakmp profile IKE-PROFILE&#xA;   ca trust-point vpn-tp&#xA;   match identity group &amp;lt;group&amp;gt;&#xA;   client authentication list ClientAuth&#xA;   isakmp authorization list ClientAuth&#xA;   client configuration address initiate&#xA;   client configuration address respond&#xA;   virtual-template 1&#xA;!&#xA;!&#xA;crypto ipsec transform-set ESP-3DES-SHA esp-aes 256 esp-sha-hmac&#xA; mode tunnel&#xA;!&#xA;crypto ipsec profile IPSEC_PROFILE1&#xA; set transform-set ESP-3DES-SHA&#xA; set isakmp-profile IKE-PROFILE&#xA;!&#xA;!&#xA;interface GigabitEthernet8&#xA; ip address dhcp client-id FastEthernet0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip nbar protocol-discovery&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; ip verify unicast source reachable-via rx allow-default 100&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA;!&#xA;interface Virtual-Template1 type tunnel&#xA; ip unnumbered GigabitEthernet8&#xA; no ip unreachables&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; tunnel mode ipsec ipv4&#xA; tunnel protection ipsec profile IPSEC_PROFILE1&#xA;!&#xA;interface Vlan1&#xA; ip address 10.0.0.1 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;!&#xA;ip local pool dynpool 192.168.0.100 192.168.0.101 recycle delay 1&#xA;!&#xA;!&#xA;ip pim bidir-enable&#xA;ip nat inside source list NAT2 interface GigabitEthernet8 overload&#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet8&#xA;!&#xA;ip access-list standard ANY&#xA; permit any&#xA;ip access-list standard Deny_RFC1918&#xA; deny   10.0.0.0 0.255.255.255&#xA; deny   172.16.0.0 0.15.255.255&#xA; deny   192.168.0.0 0.0.255.255&#xA; permit any&#xA;!&#xA;ip access-list extended NAT2&#xA; deny   ip 10.0.0.0 0.0.0.255 host 192.168.0.100&#xA; deny   ip 10.0.0.0 0.0.0.255 host 192.168.0.101&#xA; permit ip 10.0.0.0 0.0.0.255 any&#xA; permit ip 192.168.0.0 0.0.0.255 any&#xA;&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14973" LastEditorUserId="46890" LastEditDate="2019-05-16T19:42:24.940" LastActivityDate="2019-05-16T19:42:24.940" Title="How to configure Cisco remote access IPSEC VPN between IOS Router and Android phone" Tags="|cisco|vpn|ipsec|cisco-ios-15|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="20532" PostTypeId="1" AcceptedAnswerId="20533" CreationDate="2015-08-10T15:08:47.170" Score="1" ViewCount="4687" Body="&lt;p&gt;Can someone explain, what is Hidden flows and MegaFlow with examples.&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="17153" LastActivityDate="2015-08-10T16:58:29.823" Title="What is Hidden Flows and MegaFlow in OVS?" Tags="|openflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20533" PostTypeId="2" ParentId="20532" CreationDate="2015-08-10T16:44:20.977" Score="2" Body="&lt;p&gt;Hidden flows in OVS are used by the controller to talk to the switch, you typically won't want these to show up in Netflow hence they are hidden by default. If you use the command; 'ovs-ofctl dump-flows br' you will get all flows except the hidden ones, if you use the command; 'ovs-appctl bridge/dump-flows br' you'll also get the hidden ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Megaflows are a totally different concept and were introduced in OVS 1.11 and are meant to increase performance by being able to match on arbitrary wildcards to populate the cache and thus use the fast-path for forwarding. Before OVS 1.11 flows were only matched on the exact header, so if lot's of traffic came from the same source with different header info (i.e. a port scan for example) it would all be slow-path actions since none matched the cache entries. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For full details on matching flows, including megaflows, see &lt;a href=&quot;http://conferences.sigcomm.org/sigcomm/2014/doc/slides/211.pdf&quot; rel=&quot;nofollow&quot;&gt;http://conferences.sigcomm.org/sigcomm/2014/doc/slides/211.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or listen to packet pushers show 219 which explains it well;&#xA;&lt;a href=&quot;http://packetpushers.net/podcast/podcasts/show-219-open-vswitch-obtains-ludicrous-speed/&quot; rel=&quot;nofollow&quot;&gt;http://packetpushers.net/podcast/podcasts/show-219-open-vswitch-obtains-ludicrous-speed/&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17118" LastEditorUserId="17118" LastEditDate="2015-08-10T16:58:29.823" LastActivityDate="2015-08-10T16:58:29.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20534" PostTypeId="2" ParentId="20142" CreationDate="2015-08-10T18:40:01.673" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I was wondering if it is possible to have guest WiFi network on subnet 192.168.1.0/24 and Access Points to that WiFi on subnet 10.0.0.0/24?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since you asked a general question, yes it is possible. As a matter of fact, I highly recommend this approach and all wireless deployments I have a hand in do this if at all possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it is the &quot;if at all possible&quot; part where we an issue giving a specific answer based on your question as it directly relates to the equipment you have available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I personally don't know of a single device (small business or better) sold as an &quot;access point&quot; that does not have this capability. Beyond that, the question is whether your switches/routers also have this capability. Without knowing more details, no one could give a better answer.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-08-10T18:40:01.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20535" PostTypeId="1" AcceptedAnswerId="29328" CreationDate="2015-08-10T19:00:09.660" Score="2" ViewCount="205" Body="&lt;p&gt;Imagine there is a topology which contains vswitchs on hypervisors and those are some how connected to outside physical network devices(I don't know whether this is possible or not...vswitchs and outsides switches in same topology). Now, does controller aware of these (virtual)devices just like as n OSPF protocol,,SDN controller learns the DOWN of a (virtual)devices and send correct flow entries to (v)devices.&#xA;Note: Think the topology as complex, like vswitches on different hosts and in same host are connected to same SDN controller.&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17153" LastEditorUserId="17153" LastEditDate="2016-06-07T07:06:58.693" LastActivityDate="2016-06-07T07:06:58.693" Title="SDN Controller aware of Vswitchs and physical network devices?" Tags="|openflow|sdn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20537" PostTypeId="1" CreationDate="2015-08-10T20:21:46.153" Score="2" ViewCount="487" Body="&lt;p&gt;I have seen many networks in my years as a Network Engineer and none seem to use multi-area OSPF. I would guess only large SPs that do not use IS-IS run multi-area OSPF. Have you seen it in production before? Would you recommend it in production?&lt;/p&gt;&#xA;" OwnerUserId="889" LastActivityDate="2015-08-11T03:31:42.207" Title="Do modern networks use multi-area OSPF?" Tags="|routing|ospf|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20541" PostTypeId="1" AcceptedAnswerId="20546" CreationDate="2015-08-10T23:50:14.613" Score="2" ViewCount="506" Body="&lt;p&gt;I have been working at layer 2 for a while now, but I might have to solve a layer 3 problem for an application I am currently working on. A client has a very specific need based on some networked equipment, which requires redundancy and some other subnet requirements that I omit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that I have a subnet that is connected to two (OSPF) routers like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router -------- Switch ------ Host ------ Switch ------ Router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and those two routers (which are not connected to each other directly) are connected by other routers to my computer, I am curious about the fail over behavior of the network. If, by default, the route from my computer to the host is routed through the left router and the cable from the left switch to the host fails, will the route fail over and use the right router? Or will the cable from the left router to the left switch have to fail for that to occur? &lt;/p&gt;&#xA;" OwnerUserId="17160" LastActivityDate="2015-08-12T14:43:07.757" Title="Redundancy between hosts on different subnets connected by routers" Tags="|routing|subnet|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20542" PostTypeId="2" ParentId="20537" CreationDate="2015-08-11T03:31:42.207" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Do modern networks use multi-area OSPF?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. Not all of them do (and many shouldn't), but some do.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I would guess only large SPs that do not use IS-IS run multi-area OSPF.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In my experience, this is far more likely in the corporate world. For example, I have seen individual WAN sites operated as OSPF stub areas or different OSPF areas within separate corporate campuses.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Have you seen it in production before?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, but does it really matter? I have known network professionals who haven't run OSPF in any of the networks they managed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What any given network professional has seen or not seen doesn't really make a difference to what makes good network design for a particular network.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would you recommend it in production?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Absolutely, if the the network design called for it. Every network is different, so there may or may not be a need for it. Then again, there may be no need for OSPF at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just because OSPF has been deployed on a network doesn't mean the person(s) who deployed it understood OSPF and as such it is not always deployed correctly for the situation. I have seen single area networks that should have used multiple areas. I have also seen multiple area OSPF deployments that made no sense and should have been run as a single area.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-08-11T03:31:42.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20543" PostTypeId="1" AcceptedAnswerId="20571" CreationDate="2015-08-11T04:35:28.640" Score="0" ViewCount="71" Body="&lt;p&gt;forgive me but i am a novice when it comes to network engineering, and may not be formulating the question to the standards here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i bought 5 edimax pro CAP1200 AP's. even when using a single one, and doing say a a standard speedtest, it would start off fine, then drop entirely, and disconnect, then once again suddenly jump back up to full speed. doing this over and over. running continuous ping results in the same, on-and-off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this happens whether i have a single AP enabled, or all 5. i have the same ssids for 2.4g, and a separate for the 5g. same results when multiple AP's are enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the AP's are connected to a cisco switch, with one one of these PoE injectors inline: &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B0086SQDMM&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/WS-POE-8-48v60w-passive-Ethernet-Injector-cameras/dp/B0086SQDMM/ref=sr_1_1?m=A2SZCFXJT89WME&amp;amp;s=merchant-items&amp;amp;ie=UTF8&amp;amp;qid=1439267639&amp;amp;sr=1-1&lt;/a&gt; -  as opposed to powering each AP individually using the supplied power adapters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i used this guide for the initial setup. and everything seems in order at a glance: &lt;a href=&quot;http://www.edimax.com/edimax/mw/cufiles/files/media/images/edimaxDE/CAP1200/CAP1200_QIG_DE.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.edimax.com/edimax/mw/cufiles/files/media/images/edimaxDE/CAP1200/CAP1200_QIG_DE.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cheers.&lt;/p&gt;&#xA;" OwnerUserId="17161" LastActivityDate="2015-11-10T06:52:10.267" Title="sporadic connectivity drops on AP mesh" Tags="|ping|access-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20544" PostTypeId="1" CreationDate="2015-08-11T06:13:45.030" Score="6" ViewCount="6951" Body="&lt;p&gt;I have created the user in Juniper devices by below commands&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@qfx5100# set system login user RO class super-user&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now the user RO has been created and I have not given any password to it. But when I try to login with RO it asks me for password and when I leave it blank and hit on enter it gives me access denied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What password should I enter in that case so that I can get access to it.&lt;/p&gt;&#xA;" OwnerUserId="15690" LastEditorUserId="509" LastEditDate="2015-08-11T06:36:27.583" LastActivityDate="2016-07-13T06:41:51.923" Title="Juniper user creation and password" Tags="|juniper|juniper-junos|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20545" PostTypeId="2" ParentId="20544" CreationDate="2015-08-11T06:36:14.813" Score="7" Body="&lt;p&gt;I don't think that will work, Juniper will just refuse the login since there's no valid authentication mechanism configured. The only way to do this properly is by actually setting a password:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@juniper# set system login user teun authentication plain-text-password &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and/or a SSH key:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@juniper# set system login user teun authentication ssh-rsa &quot;&amp;lt;public key&amp;gt;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2016-04-10T22:14:25.460" LastActivityDate="2016-04-10T22:14:25.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20546" PostTypeId="2" ParentId="20541" CreationDate="2015-08-11T06:52:22.810" Score="2" Body="&lt;p&gt;As far as the router knows it is still connected to the host network when the cable between host and switch fails, so it will continue to advertise itself as a way to that network. So your computer will continue to use the left router unless the link betwen the switch and router fails aswell meaning that the router has no path to that network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although, if you have a default route on your computer to the left router it won't matter as all traffic will be routed to it and traffic for host network will simply be dropped if no path exists from left router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to achieve that redundancy you would probably need to run a routing protocol on your computer e.g. RIP to get specific information and be able to choose which way to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm assuming you have two NICs since your computer are connected to both routers indirectly but they are not connected to each other.&lt;/p&gt;&#xA;" OwnerUserId="14973" LastActivityDate="2015-08-11T06:52:22.810" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20547" PostTypeId="2" ParentId="20515" CreationDate="2015-08-11T06:59:48.763" Score="0" Body="&lt;p&gt;A Switch typically does not perform DHCP assignment as it is not designed to do so&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming and recommending this is your upstream to downstream connection&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet | ISP Uplink &gt; Router | DHCP Server &gt; (5/6) Switches &gt; Clients&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All clients (I think that hosts is a misleading term here) downstream from the switches will request and pull IPs from your upstream Router | DHCP Server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the capabilities of your Router | DHCP Server &amp;amp; Switches you may be able configure some amount of &lt;a href=&quot;https://superuser.com/a/3845/183467&quot;&gt;Static DHCP&lt;/a&gt; to assign and allocate 'specific' reserved IPs to certain clients/ machines/ switches without having to setup Static IPs on them and centrally managed those IP assignments from the DHCP Provider. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Static DHCP: A DHCP reservation. This is actually a common feature but&#xA;  little-known by most folks. It's quite useful for locking an IP&#xA;  address to a machine, but wanting to keep centralized control over its&#xA;  settings for DNS and default gateway, etc. Very useful.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17163" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2015-08-11T06:59:48.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20548" PostTypeId="2" ParentId="20517" CreationDate="2015-08-11T10:15:40.523" Score="0" Body="&lt;h2&gt;Persistent HTTP&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Reuse your existing TCP connection, so do not open a new TCP connection per resource. This saves you round-trip times for the handshake as you would otherwise have 1 RTT for TCP connection setup and 1 RTT for HTTP request.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Pipelined HTTP&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Send multiple requests to the server in parallel. This requires persistent HTTP. It can further reduce the number of RTTs for retrieving content as the client's idle time reduces (less waiting for responses) and the server's idle time does too (less waiting for requests to respond on it).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Note&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Still you might experience non-ideal behaviour due to loss and TCP retransmit. &lt;a href=&quot;https://en.wikipedia.org/wiki/HTTP/2&quot; rel=&quot;nofollow&quot; title=&quot;HTTP/2&quot;&gt;HTTP/2&lt;/a&gt; (a modification of Google's Spdy) deals with that by distributing requests cleverly over multiple TCP connections.&lt;/p&gt;&#xA;" OwnerUserId="10219" LastEditorUserId="10219" LastEditDate="2015-08-11T10:23:09.447" LastActivityDate="2015-08-11T10:23:09.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20549" PostTypeId="1" AcceptedAnswerId="20554" CreationDate="2015-08-11T10:30:53.193" Score="1" ViewCount="600" Body="&lt;p&gt;For a research project I need low timescale interface utilization measurement on a Cisco Nexus 5000 devices and some fabric extenders.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Background: The switch is used to &quot;simulate&quot; an optical network, and traffic is forced pass this switch. I can then simulate fiber cuts by simply shutting down the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To measure results, I need to measure interface utilization in a rather timescale. Sub-second would be ideal, but is not necessary. Getting utilization in 1 second intervals is however the goal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first idea was to use IFMIB and query the Interface the Byte Counter. Doing this on a regular interval allows me to calculate the average utilization in the last timeframe. I however observed that counters do not get updated in realtime, but instead each 10 seconds or so, which definitely is not fine-grained enough. Further, if the switch even has little load, the SNMP responses may get in irregular time intervals, which distorts the results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another idea was to query the device via Netconf / XML, however the agent is too slow. Second interval polling is not possible here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My final idea is to use ERSPAN and capture the different VLAN traffic and send it to a management station. There, the VLAN tag can be used to distinguish the Interface, and I need to write some utility which actually counts the packet sizes. In my opinion this may allow second level measurements, but represents some overhead on the other hand (additional machine, and I don't know if Nexus will forward ~7GB/s ERSPAN traffic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any other idea how to measure bandwidth on an interface?&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2024-02-08T22:14:37.850" Title="High-Resolution Measurement of link utilization of Cisco (Nexus) Switch Interfaces" Tags="|cisco|snmp|bandwidth|cisco-nexus-5k|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20551" PostTypeId="1" CreationDate="2015-08-11T11:41:30.520" Score="5" ViewCount="338" Body="&lt;p&gt;I recently encountered an issue upgrading from an IOS device to an IOS XE ASR 1000 router concerning Ethernet Over SONET (EOS). VLAN tags are used to map traffic from the hub router to SONET connections to the spokes, after which the hub's SONET box strips the VLAN tag from the frame. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hjrQI.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hjrQI.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IOS device at the hub was functioning correctly in this scenario but when it was replaced with an ASR 1000 EIGRP kept flapping every 120 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem was traced to a difference in the way IOS and the ASR 1000 pad Ethernet frames to get them to the minimum size of 64 Bytes. It appears that IOS pads the untagged Ethernet frame to 64 Bytes before adding the VLAN tag, but that IOS XE adds the VLAN tag and then pads the size to 64 Bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a captured frame from the ASR attempting to initiate a telnet session. Wireshark has the frame size as 62 Bytes, but this excludes the 4 Byte Frame Check Sequence (FCS), so the actual size is 66 Bytes including the VLAN tag. Once the VLAN tag is stripped by the SONET box the frame size is 62 Bytes.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/cu31d.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cu31d.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a similar frame captured from an IOS router. Note that the stated size is 64 Bytes instead of 62 Bytes because the router is adding two bytes of padding (labeled trailer). With the FCS added, this frame will meet the 64 Byte minimum requirement even with the VLAN tag stripped off.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jUpHS.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jUpHS.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the VLAN tag is stripped by the SONET equipment at the hub, the EIGRP UPDATE packets coming from the ASR 1000 were below the minimum frame size and were getting dropped by the far-end SONET box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution used was to not strip the VLAN tags, but pass them through the SONET system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to force IOS XE to pad frames to 64 Bytes before adding the VLAN tag, like IOS? Or, is there a way to set the minimum frame size on IOS XE to 68 Bytes? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only commands I found online (plim min-frame-length 68byte) were for specific line cards and were not accepted on the router's interfaces.&lt;/p&gt;&#xA;" OwnerUserId="1911" LastActivityDate="2015-08-11T11:41:30.520" Title="IOS XE minimum frame size" Tags="|ethernet|cisco-ios|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20552" PostTypeId="1" AcceptedAnswerId="20559" CreationDate="2015-08-11T11:46:25.673" Score="0" ViewCount="805" Body="&lt;p&gt;What happens if someone connects a PoE supplier device in my network (In a single switch port)?&#xA;Does it mean all my network will offer PoE?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to detect a PoE supplier in you network?&lt;/p&gt;&#xA;" OwnerDisplayName="user17165" LastActivityDate="2015-08-11T14:12:16.910" Title="What happens if someone connects a PoE supplier device in my network?" Tags="|power-over-ethernet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20553" PostTypeId="2" ParentId="20552" CreationDate="2015-08-11T12:43:33.560" Score="1" Body="&lt;p&gt;Short answer is no. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The piece of hardware you are referring to is called a PoE injector. It is designed to sit between your network and a the device needing power to inject power for that one device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Non PoE switches do not have the circuitry to pass this electrical current to all ports. So reversing a PoE injector and attempting what you are surmising would probably result in a dead switch. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-08-11T12:43:33.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20554" PostTypeId="2" ParentId="20549" CreationDate="2015-08-11T12:55:37.733" Score="2" Body="&lt;p&gt;Your best bet is to tap the links themselves.  Use an in-line optical tap or a powered copper tap.  This will split the connection off to a secondary cable, which you can then plug into your server for monitoring.  You'll have an instantly-accurate, infinitely-granular picture of what's going across the wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: If you've got too many links to tap, your only other option I can think of is to SPAN all the ports to a single 10G or 40G interface and monitor that.  Keep in mind that you're adding in the processing time for the SPAN, and you may drop traffic depending on oversubscription ratios, etc.  Just depends on how much accuracy you really need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to get a 100% complete, guaranteed measurement of the bandwidth crossing a given link is to tap the link.&lt;/p&gt;&#xA;" OwnerUserId="155" LastEditorUserId="155" LastEditDate="2015-08-11T13:22:18.243" LastActivityDate="2015-08-11T13:22:18.243" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20556" PostTypeId="2" ParentId="5524" CreationDate="2015-08-11T13:23:11.540" Score="1" Body="&lt;p&gt;This has been fixed in upstream and is no longer relevant. I am closing it.&lt;/p&gt;&#xA;" OwnerUserId="399" LastActivityDate="2015-08-11T13:23:11.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20559" PostTypeId="2" ParentId="20552" CreationDate="2015-08-11T14:12:16.910" Score="1" Body="&lt;p&gt;You will not have PoE over your network in that case, the switch does not &quot;redistribute&quot; power to the other ports. If you want PoE, you need either:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One PoE injector for each device that require PoE (the injector is plugged between the switch and the device)&lt;/li&gt;&#xA;&lt;li&gt;A switch that does PoE, in that case, every device connected to this switch will be able to have PoE (or not, you can configure it)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If your switch support PoE this means it is able to power devices, but you might have to configure it, and in that case, there is no need for an additional injector.&lt;/p&gt;&#xA;" OwnerUserId="17170" LastActivityDate="2015-08-11T14:12:16.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20561" PostTypeId="2" ParentId="20530" CreationDate="2015-08-11T17:22:47.077" Score="-1" Body="&lt;p&gt;Go to Google Play and download Cisco Anyconnect Client.  This will enable you to connect to IOS 15.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/security/anyconnect-secure-mobility-client/data_sheet_c78-527494.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/security/anyconnect-secure-mobility-client/data_sheet_c78-527494.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-08-11T17:22:47.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20563" PostTypeId="2" ParentId="5433" CreationDate="2015-08-11T21:04:22.697" Score="0" Body="&lt;p&gt;Have you tried to run &#xA;&lt;strong&gt;show ip bgp x.y.z.0/24&lt;/strong&gt;  ?&#xA;That command shows Community in our environment (15.+ version)&lt;/p&gt;&#xA;" OwnerUserId="17180" LastActivityDate="2015-08-11T21:04:22.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20564" PostTypeId="1" AcceptedAnswerId="20565" CreationDate="2015-08-11T21:13:43.280" Score="1" ViewCount="1007" Body="&lt;p&gt;I have a cisco core switch that is connected directly to our mpls router. It learns about the 172.16.0.0/12 network via iBGP from the mpls router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a lab subnet 172.16.100.0/22 behind a firewall which directly connects to the core switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured a static route on the core switch for the 172.16.100.0/22 network with the next hop of the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot ping anything on the 172.16.100.0/22 network from the core switch. The firewall is open so this is not the reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, a traceroute to 172.16.100.253 shows the route being taken via the mpls router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any reason why the core switch would prefer the iBGP route to 172.16.0.0/12 over the static route to 172.16.100.0/22 ???&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Paul&lt;/p&gt;&#xA;" OwnerUserId="3846" LastActivityDate="2015-08-14T20:30:50.283" Title="Traffic preferring iBGP route over static route" Tags="|cisco|bgp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20565" PostTypeId="2" ParentId="20564" CreationDate="2015-08-11T21:53:29.720" Score="7" Body="&lt;p&gt;Based on the limited information you provided, I'd bet that the next hop in your static route isn't reachable (isn't in the routing table). Is the static route to the lab subnet seen in a &quot;show ip route static&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would need at least partial configs to troubleshoot more. &lt;/p&gt;&#xA;" OwnerUserId="155" LastActivityDate="2015-08-11T21:53:29.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20566" PostTypeId="1" CreationDate="2015-08-11T22:25:08.973" Score="0" ViewCount="73" Body="&lt;p&gt;I read &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0321647416&quot; rel=&quot;nofollow&quot;&gt;Network Maintenance and Troubleshooting Guide&lt;/a&gt; book and in paragraph where Ethernet frame preamble is explained, it says that &lt;em&gt;except for 100BASE-T4, faster versions of Ethernet are synchronous&lt;/em&gt;. Is it possible to keep both data and synchronization signal on the same signal path?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-11-10T00:43:08.270" Title="Data and synchronization signals on the same wire?" Tags="|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20567" PostTypeId="2" ParentId="20566" CreationDate="2015-08-11T22:38:58.533" Score="2" Body="&lt;p&gt;The preamble is simply a series of 1s and 0s that signal the start of a packet. At the end of the preamble is a sfd (start frame delimiter) that signals the actual start of the Ethernet frame. The very next byte is the beginning of the destination MAC address. So yes the synchronization bits (preamble) are on the same signal path. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-08-11T22:38:58.533" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20571" PostTypeId="2" ParentId="20543" CreationDate="2015-08-12T04:37:54.223" Score="0" Body="&lt;p&gt;solved it through basic troubleshooting :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i tried a single AP using the provided power adapter, instead of using the PoE injector, and woila- it worked flawlessly, for a period of time, without any failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the issue turns out was that the poe injector i got was underpowered for the gigabit APs i was using- it was only meant for 10/100. i have now ordered a GPoE (gigabit poe injector).&lt;/p&gt;&#xA;" OwnerUserId="17161" LastActivityDate="2015-08-12T04:37:54.223" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20573" PostTypeId="1" CreationDate="2015-08-12T09:23:30.383" Score="1" ViewCount="60" Body="&lt;p&gt;i mean the following is not possible..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We plan to create different Networks for Subareas with same Address-pools.&#xA;With tricky Routing to use same IP-Settings on the Devices, there were moved around on these subnetworks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device must have Internet (www) connection and Access to the Data server(10.0.0.2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is it possible ? If yes, is the the thinking below correct? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gAO5e.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gAO5e.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17186" LastEditorUserId="509" LastEditDate="2015-08-18T21:57:20.993" LastActivityDate="2015-08-18T21:57:20.993" Title="Possible Network Plan? routed Subnets with www and Mail trunk" Tags="|routing|firewall|subnet|" AnswerCount="0" CommentCount="4" ClosedDate="2020-12-16T22:04:47.083" ContentLicense="CC BY-SA 3.0" />
  <row Id="20575" PostTypeId="1" AcceptedAnswerId="20833" CreationDate="2015-08-12T13:40:51.763" Score="2" ViewCount="662" Body="&lt;p&gt;I'm looking at a network with two independent core routers, each with a different sized uplink, one 50mbps and the other 100mbps to a different ISP. I'm trying to get redundancy as well as load balancing across both links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Predominantly there are service routers connected to the core so I was thinking of doing iBGP in this area and publishing two default routes to access the internet. I thought of using VRRP but that would be more of a master/slave arrangement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a good approach to HA? If so, how could I engineer the traffic flow in this environment?&lt;/p&gt;&#xA;" OwnerUserId="17190" LastActivityDate="2015-09-22T17:40:35.057" Title="Is publishing iBGP default routes a good idea in a multi-router multi-homed environment?" Tags="|routing|bgp|network-core|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20576" PostTypeId="1" CreationDate="2015-08-12T14:08:15.433" Score="2" ViewCount="1555" Body="&lt;p&gt;Lets just say I have three routers in full mesh. R1 has an uplink to an ISP publishing 12.0.0.0/24. Behind each router takes care of a subnet of the public block for web servers connected through a switch in three different locations like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;12.0.0.64/26 - R1 (host gateway is 12.0.0.65)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;12.0.0.128/26 - R2 (host gateway is 12.0.0.129)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;12.0.0.192/26 - R3 (host gateway is 12.0.0.193)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to use BGP to advertise internally where each subnet is at, but from what I understand, its best practice in bgp to assign the IP address for each router to a loopback. This is not going to work because the IP address for each router needs to be on the interface facing the switches for each location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I use private /31 networks between each router so they can talk iBGP or do I have to further subnet my public range to join them all together?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, rather than using up 2 public IP addresses for each sub-network, would it be better to use 12.0.0.0/26 and put them all on the same subnet to talk (.1,.2 and .3) leaving room for .4+ for when I add new sites?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers for reading my Q :)&lt;/p&gt;&#xA;" OwnerUserId="17190" LastEditorUserId="17190" LastEditDate="2015-08-12T15:12:53.193" LastActivityDate="2015-08-12T15:54:41.173" Title="Is it better to use private or public IP addresses for router-to-router links?" Tags="|router|ipv4|bgp|subnet|ip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20577" PostTypeId="2" ParentId="16086" CreationDate="2015-08-12T14:27:43.440" Score="2" Body="&lt;p&gt;To clarify, normally in this situation you will have your /30 subnet being where your /26 and /29 subnet are routed to by upstream.  You bring up your side of the /30, eg xx.yy.81.82/30 and there being only one other available address the gateway is xx.yy.81.81/30 on the provider end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP will typically route xx.yy.81.61/26 and zz.uu.156.48/29 via xx.yy.81.82/30 (aka your side) because its a predictable address. All internet traffic then asks the device which has xx.yy.81.82/30 how to get to the /26 and the /29 if im not mistaken.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you have three options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a) If you want to map a public IP address directly to a server you will need to use one-to-one nat -&gt; &lt;a href=&quot;http://ciscoskills.net/2011/01/21/configuring-nat-one-to-one-mapping/&quot; rel=&quot;nofollow&quot;&gt;http://ciscoskills.net/2011/01/21/configuring-nat-one-to-one-mapping/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b) If you want to do port forwards, put each ip address as a sub-interface on your wan nic and do normal PAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c) If you want to put the public IP address directly on your internal devices and avoid nat altogether you will need to put an ip address on a second nic or a vlan interface on the cisco and plug it into a switch, and connect your servers from there. You may have to exclude these addresses from getting natted perhaps and depends how many nics your cisco has.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully this helps you come to a solution :)&lt;/p&gt;&#xA;" OwnerUserId="17190" LastActivityDate="2015-08-12T14:27:43.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20578" PostTypeId="2" ParentId="20541" CreationDate="2015-08-12T14:43:07.757" Score="0" Body="&lt;p&gt;If you can't stack your switches and you don't have enough ports to plug each router into each switch you might be stuck, especially if you can't run VRRP which is pretty much designed for just this. I'm guessing thats the case given your device doesn't support dynamic routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be able to configure two default gateways on your host perhaps, but thats not ideal i guess.&lt;/p&gt;&#xA;" OwnerUserId="17190" LastActivityDate="2015-08-12T14:43:07.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20580" PostTypeId="2" ParentId="20298" CreationDate="2015-08-12T14:58:43.390" Score="-1" Body="&lt;p&gt;Not sure if this is any help but sounds reminiscent of a flash corruption i had one time, that or local certificates expire/corrupt - in which case i just regen them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;" OwnerUserId="17190" LastActivityDate="2015-08-12T14:58:43.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20581" PostTypeId="2" ParentId="20282" CreationDate="2015-08-12T15:02:09.303" Score="1" Body="&lt;p&gt;You can try one-to-one NAT, I'd start by putting one of the extra 5 IP addresses as subinterfaces on the X1 WAN and seeing if you can ping it from outside.  If so, winner ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if its safe to test this on a live environment, I'd schedule downtime TBH.&lt;/p&gt;&#xA;" OwnerUserId="17190" LastEditorUserId="8499" LastEditDate="2016-03-11T02:08:42.023" LastActivityDate="2016-03-11T02:08:42.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20582" PostTypeId="2" ParentId="17306" CreationDate="2015-08-12T15:03:31.177" Score="2" Body="&lt;p&gt;At long last, an answer. I recently encountered another situation where I had to create access-lists that would benefit from object-group references. After trying several different things to work around the problem, I finally threw in the towel and contacted Cisco technical support (which I'm always loath to do).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After an initial careless and blatantly wrong attempt to answer my question, the Cisco technician came back with the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Matthew,&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;I have reached out to the development team and object group&#xA;  configuration with the 4500 platform does not work as desired given&#xA;  the fact that the feature is not fully supported until code version&#xA;  15.2(3)E2 which will be released around August 2015.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It is possible for the ACL to be configured because they have the same&#xA;  IOS XE base as other devices that support the feature at this time.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, there you go - and it only took Cisco 6 days to come up with this answer (a record).&lt;/p&gt;&#xA;" OwnerUserId="14399" LastActivityDate="2015-08-12T15:03:31.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20583" PostTypeId="2" ParentId="20273" CreationDate="2015-08-12T15:09:03.327" Score="0" Body="&lt;p&gt;Totally possible, comes down to a couple of things, (i set this up regularly).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If its not already happening (im guessing not) you have either:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a) a nat problem where branch A router is configured to only exclude current branch and HO subnets, thus traffic to other branches is trying to go via wan or just getting mangled in nat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b) an access list/firewall issue where the traffic has a path and is being denied by a device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c) a routing issue where the branch A has no path to branch B via any gateway that it has - which you can normally fix with static routing if need be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically these are the problems you face with vpns and hub-spoke vpns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;" OwnerUserId="17190" LastActivityDate="2015-08-12T15:09:03.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20586" PostTypeId="2" ParentId="20576" CreationDate="2015-08-12T15:40:27.403" Score="3" Body="&lt;p&gt;Maybe I missed something, but I'm not sure why you can't subnet your network to get a few /32s and /31s.&#xA;It seems that you have 12.0.0.0/26 available for further subnetting?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would allocate public /32s for loopbacks and advertise them into IGP.&#xA;Links between routers are p2p, so I would address them with public /31s.&#xA;iBGP sessions should survive link failure, so I would source them from loopbacks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not a good idea to use private IP addresses on transit links, because it can cause problems, e.g. break PMTUD.&lt;/p&gt;&#xA;" OwnerUserId="970" LastEditorUserId="970" LastEditDate="2015-08-12T15:54:41.173" LastActivityDate="2015-08-12T15:54:41.173" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20587" PostTypeId="2" ParentId="20298" CreationDate="2015-08-12T15:56:11.297" Score="0" Body="&lt;p&gt;Funny you should mention flash.  I had to reformat the flash recently as it was hurrendously slow to boot. I think I've got a spare CF card I can try.&lt;/p&gt;&#xA;" OwnerUserId="16945" LastActivityDate="2015-08-12T15:56:11.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20589" PostTypeId="1" CreationDate="2015-08-12T22:18:06.283" Score="3" ViewCount="622" Body="&lt;p&gt;&lt;strong&gt;Aim:&lt;/strong&gt; We are creating a cloud server which will collect diagnostic data (like bytes exchanged, SNR) from remote SNMP enabled network devices (like Routers, Switches).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SNMP devices may be located in a private network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We discussed with a cable vendor who quoted,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;SNMP on modems is only accessible via the modem IP, which is&#xA;  traditionally a private IP within an MSO. Companies will generally&#xA;  deploy a probe or agent on-site that collects the SNMP data and&#xA;  delivers it back to their main operation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;SNMP proxies are also a possibility.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;He talks about about &lt;em&gt;deploy probes, proxing, on site agent&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We want to know how those mechanisms are actually implemented in detail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some references or few lines of introduction about the set up would be really helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; We are looking for answers from the perspective of developers of a network monitoring tool.&lt;/p&gt;&#xA;" OwnerUserId="17203" LastEditorUserId="17203" LastEditDate="2015-08-19T16:08:28.860" LastActivityDate="2015-08-19T16:08:28.860" Title="How to set up an end-to-end SNMP data collection system?" Tags="|snmp|" AnswerCount="2" CommentCount="1" ClosedDate="2015-08-19T20:30:46.417" ContentLicense="CC BY-SA 3.0" />
  <row Id="20590" PostTypeId="2" ParentId="20589" CreationDate="2015-08-12T23:32:01.110" Score="0" Body="&lt;p&gt;PRTG is a great example of this.  What you are describing is how I architect my networks for resiliency.  I host my main monitoring server cluster on AWS EC2 and have 'probes' at each site that sit behind the site firewalls, gather SNMP data and send it to the core.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A probe is simply a computer gathering data.  Using SNMP version 2c, you will point the probes at the device ip's you want to monitor and they will gather the data and push to your 'cloud server' for reporting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have questions, ping me.  I am happy to help or have a conversation about best practices in this arena.&lt;/p&gt;&#xA;" OwnerUserId="10822" LastActivityDate="2015-08-12T23:32:01.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20591" PostTypeId="1" CreationDate="2015-08-13T01:05:58.337" Score="4" ViewCount="12964" Body="&lt;p&gt;I'm using OpenVSwitch as my networking layer for KVM virtual machines. I have a main bridge, and each VM has a tap on the bridge. I also have an internal tap on the host machine that's on the same VLAN as the VM taps. I can communicate between the host and the VMs just fine, but I'm having a hard time figuring out how I can use the host to route VM traffic out to the Internet via a physical interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my OVS configuration...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo@bar# ovs-vsctl show&#xA;b9d8798d-5a95-4d96-8df4-690ae9c8bae5&#xA;    Bridge br0   &#xA;        Port br0  &#xA;            Interface br0&#xA;                type: internal&#xA;        Port &quot;br0_tap0&quot;&#xA;            tag: 100     &#xA;            Interface &quot;br0_tap0&quot;&#xA;                type: internal&#xA;        Port &quot;br0_tap1&quot;&#xA;            tag: 100     &#xA;            Interface &quot;br0_tap1&quot;&#xA;        Port &quot;br0_tap2&quot;&#xA;            tag: 100     &#xA;            Interface &quot;br0_tap2&quot;&#xA;    ovs_version: &quot;2.3.1&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here's my interface configuration...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foo@bar# ip addr&#xA;1: lo: &amp;lt;LOOPBACK,UP,LOWER_UP&amp;gt; mtu 65536 qdisc noqueue state UNKNOWN group default&#xA;    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00&#xA;    inet 127.0.0.1/8 scope host lo&#xA;       valid_lft forever preferred_lft forever&#xA;    inet6 ::1/128 scope host&#xA;       valid_lft forever preferred_lft forever&#xA;2: eth0: &amp;lt;BROADCAST,MULTICAST,UP,LOWER_UP&amp;gt; mtu 1500 qdisc mq state UP group default qlen 1000&#xA;    link/ether 3c:07:54:0e:9c:16 brd ff:ff:ff:ff:ff:ff&#xA;    inet 192.168.1.10/24 scope global eth0&#xA;       valid_lft forever preferred_lft forever&#xA;    inet6 2601:140:8000:508b:3e07:54ff:fe0e:9c16/64 scope global mngtmpaddr dynamic&#xA;       valid_lft 345514sec preferred_lft 345514sec&#xA;    inet6 fe80::3e07:54ff:fe0e:9c16/64 scope link&#xA;       valid_lft forever preferred_lft forever&#xA;3: ovs-system: &amp;lt;BROADCAST,MULTICAST&amp;gt; mtu 1500 qdisc noop state DOWN group default&#xA;    link/ether 36:3f:76:54:8c:1a brd ff:ff:ff:ff:ff:ff&#xA;135: br0: &amp;lt;BROADCAST,MULTICAST,UP,LOWER_UP&amp;gt; mtu 1500 qdisc noqueue state UNKNOWN group default    &#xA;    link/ether 8a:c6:9d:08:23:4d brd ff:ff:ff:ff:ff:ff&#xA;    inet6 fe80::88c6:9dff:fe08:234d/64 scope link&#xA;       valid_lft forever preferred_lft forever&#xA;136: br0_tap0: &amp;lt;BROADCAST,MULTICAST,PROMISC,UP,LOWER_UP&amp;gt; mtu 1500 qdisc noqueue state UNKNOWN group default&#xA;    link/ether 82:86:88:2c:6a:56 brd ff:ff:ff:ff:ff:ff&#xA;    inet 192.168.0.1/24 scope global mega_tap0&#xA;       valid_lft forever preferred_lft forever&#xA;    inet6 fe80::8086:88ff:fe2c:6a56/64 scope link&#xA;       valid_lft forever preferred_lft forever&#xA;137: br0_tap1: &amp;lt;BROADCAST,MULTICAST,UP,LOWER_UP&amp;gt; mtu 1500 qdisc pfifo_fast master ovs-system state UP group default qlen 500&#xA;    link/ether 8e:50:e5:4f:1d:60 brd ff:ff:ff:ff:ff:ff&#xA;    inet6 fe80::8c50:e5ff:fe4f:1d60/64 scope link&#xA;       valid_lft forever preferred_lft forever&#xA;138: br0_tap2: &amp;lt;BROADCAST,MULTICAST,UP,LOWER_UP&amp;gt; mtu 1500 qdisc pfifo_fast master ovs-system state UP group default qlen 500&#xA;    link/ether d2:a7:4e:68:51:4c brd ff:ff:ff:ff:ff:ff&#xA;    inet6 fe80::d0a7:4eff:fe68:514c/64 scope link&#xA;       valid_lft forever preferred_lft forever&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tap0&lt;/code&gt; is the internal tap that gives the host an IP address in &lt;code&gt;VLAN 100&lt;/code&gt; so I can communicate with the VMs connected to &lt;code&gt;tap1&lt;/code&gt; and &lt;code&gt;tap2&lt;/code&gt;. I turned on IP port forwarding on the host using &lt;code&gt;sysctl -w net.ipv4.ip_forward=1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VM on &lt;code&gt;tap1&lt;/code&gt; has an IP address of &lt;code&gt;192.168.0.10/24&lt;/code&gt;. From that VM, I'm able to ping the other VM on &lt;code&gt;tap2&lt;/code&gt;, the host's &lt;code&gt;tap0&lt;/code&gt; interface, and the hosts &lt;code&gt;eth0&lt;/code&gt; interface IP address. However, I cannot ping anything outside of the host. My VM has a default gateway of the host's &lt;code&gt;tap0&lt;/code&gt; IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="3028" LastActivityDate="2017-02-09T12:18:04.597" Title="How can I route traffic between an OVS port and a physical interface on a Linux box?" Tags="|sdn|" AnswerCount="3" CommentCount="1" ClosedDate="2017-02-09T15:12:40.607" ContentLicense="CC BY-SA 3.0" />
  <row Id="20594" PostTypeId="1" AcceptedAnswerId="24027" CreationDate="2015-08-13T03:05:13.980" Score="1" ViewCount="566" Body="&lt;p&gt;I have a CentOS server plugged into a Cisco 3048.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use nm-connection-editor to configure a virtual bridge interface, like I've done a thousand times before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every time I enable the bridge, the switch disables the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone experienced this before?&lt;/p&gt;&#xA;" OwnerUserId="17208" LastActivityDate="2015-11-02T23:50:07.607" Title="Cisco disables port on switch when configures linux bridge" Tags="|cisco-catalyst|interface|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20599" PostTypeId="2" ParentId="3107" CreationDate="2015-08-13T06:38:58.320" Score="1" Body="&lt;p&gt;Due to the critical nature of the BFD control packet, it does not go through the egress QoS policy-map on the way out, and is placed in the egress queue directly. Confirmed with TAC.&lt;/p&gt;&#xA;" OwnerUserId="17217" LastActivityDate="2015-08-13T06:38:58.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20601" PostTypeId="2" ParentId="2305" CreationDate="2015-08-13T07:10:36.993" Score="0" Body="&lt;p&gt;The only way I could get hosts to properly communicate through a windows ESXI based machine (I could see traffic tagged frm the ESXI but return traffic was showing up untagged -- without vlan)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Needed to enable Monitor Mode on Windows to not strip the VLAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is how it's done. One entry into the registry and it's all working. &#xA;&lt;a href=&quot;http://www.intel.com/support/network/sb/CS-005897.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.intel.com/support/network/sb/CS-005897.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17218" LastActivityDate="2015-08-13T07:10:36.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20602" PostTypeId="2" ParentId="20594" CreationDate="2015-08-13T07:59:27.433" Score="2" Body="&lt;p&gt;It is possible that you have port-security limiting the number of MAC addresses on that switchport. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure exactly what you're bridging and how it works, but if it is creating a virtual device with another MAC address, then your switchport port-security settings may be shutting down the port once it reaches a defined limit of MAC addresses for that port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is the case, you could either increase the number of MAC addresses allowed (these could be set for static, dynamic, or sticky) or change the violation mode (protect, restrict, or shutdown are options) to something less militant. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Posting your config would be mighty helpful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;--&#xA;Chris &lt;/p&gt;&#xA;" OwnerUserId="15698" LastActivityDate="2015-08-13T07:59:27.433" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20604" PostTypeId="2" ParentId="20591" CreationDate="2015-08-13T13:25:46.033" Score="0" Body="&lt;p&gt;You can route or bridge the traffic to a physical interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To bridge just add the physical interface to the bridge.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# brctrl addif br0 eth0&#xA;or &#xA;# ovs-vsctl add-port br0 eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The move the eth0 ip to the br0 port&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ifconfig eth0 0.0.0.0&#xA;# ifconfig br0 192.168.1.10/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To route, you will have a different subnet for the VM's and the physical interface.  You also need a a route on the external network that routes traffic for the internal subnet to the external IP, probably added on a router.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2015-08-13T18:30:15.867" LastActivityDate="2015-08-13T18:30:15.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20605" PostTypeId="2" ParentId="20591" CreationDate="2015-08-13T13:54:05.887" Score="0" Body="&lt;p&gt;I was able to get things working this morning by also adding in some &lt;code&gt;iptables&lt;/code&gt; rules to NAT traffic between my &lt;code&gt;br0_tap0&lt;/code&gt; interface and my physical &lt;code&gt;eth0&lt;/code&gt; interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone has another way of doing it that doesn't involve IP forwarding or iptables I'd love to see it!&lt;/p&gt;&#xA;" OwnerUserId="3028" LastActivityDate="2015-08-13T13:54:05.887" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20606" PostTypeId="1" AcceptedAnswerId="20680" CreationDate="2015-08-13T14:22:11.343" Score="1" ViewCount="1603" Body="&lt;p&gt;i'm learning L3VPN by myself and route target did confused me a lot. I have a question that i can not find the answer. The question is: &#xA;Does L3VPN work without route target ? &#xA;I have this question because i saw this happened in real life.&lt;br&gt;&#xA;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="14888" LastActivityDate="2015-08-17T16:38:56.807" Title="L3VPN without route target?" Tags="|mpls-vpn|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20608" PostTypeId="1" CreationDate="2015-08-13T21:14:02.947" Score="0" ViewCount="733" Body="&lt;p&gt;I'm have a big question regarding IP forwarding. The current situation is like this: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to send a packet from the client to the server, between them I have two routers, Router1 and Router 2. Where Router1 is the router that is closest to the client and Router2 is the router that is closest to the server. &#xA;The client’s ip address is: 111.222.111.222&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server’s ip address is: 222.222.111.111&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 1's interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface 1: 111.222.111.1&#xA;Interface 2: 111.222.122.1&#xA;Interface 3: 111.222.133.1&#xA;Interface 4: 111.222.144.1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router 1's routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;222.222.0.0/16 over interface 2&#xA;222.222.192.0/18 over interface 3&#xA;222.222.0.0/18 over interface 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router 2's interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface 1: 222.222.111.1&#xA;Interface 2: 222.222.122.1&#xA;Interface 3: 222.222.133.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router 2's routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;111.222.0.0 / 16 over interface 1&#xA;111.222.192.0/18 over interface 2&#xA;222.222.111.0/24 over interface 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this information I connect the client with router1 interface #1 because 111.222.111.1 is the most similar to the client’s ip, I do the same with router2 interface#1 because 222.222.111.1 is the most similar to the server’s ip, is that right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now to the tricky part. How do I connect the routers with each other? If I look at router1 routing table, the only place where (222.222.111.1, 222.222.122.1 or 222.222.133.1) can exist is in interface 2. But how do I know which interface in router2 I should connect to? I have been trying to solve this problem the whole day without any progress. I would REALLY appreciate any help with this, so I really can learn IP forwarding and routers routing tables.&lt;/p&gt;&#xA;" OwnerUserId="17134" LastEditorUserId="2142" LastEditDate="2015-08-14T00:33:53.973" LastActivityDate="2015-11-12T04:14:40.177" Title="Ip forwarding &amp; routing table advanced example!" Tags="|routing|ip|ip-forwarding-table|" AnswerCount="2" CommentCount="2" ClosedDate="2015-11-12T05:48:39.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="20609" PostTypeId="1" AcceptedAnswerId="20789" CreationDate="2015-08-13T21:45:33.267" Score="0" ViewCount="22777" Body="&lt;p&gt;I've got a new Cisco ISR 4431 Router running IOS XE 03.13.02.S and IOS 15.4(3)S2.&#xA;WAN connection is a Metro Ethernet circuit delivered over copper and &lt;strong&gt;ISP has requested that we force the port to 1Gbps Full-Duplex&lt;/strong&gt;. Our internal network is all using default auto-negotiate gig port settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN Port config snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0/0&#xA; description WAN Metro Ethernet Circuit&#xA; ! ...&#xA; speed 1000&#xA; duplex full&#xA; no negotiation auto&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;INSIDE Port config snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0/1&#xA; description INSIDE Router Port&#xA; ! ...&#xA; negotiation auto&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Strange thing is that with the force 1G Full &lt;strong&gt;WAN port, the interface appears to have flow-control (802.3x pause frames) enabled and I can't figure out a command to disable flow-control on the port&lt;/strong&gt;. On my INSIDE (negotiation auto) port, flow-control is disabled which is what I've seen as the default ethernet port setting in other Cisco routers. See the following port status samples for details:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN Port status:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;RTR# show int gig0/0/0&#xA;GigabitEthernet0/0/0 is up, line protocol is up&#xA;  Hardware is ISR4431-X-4x1GE, address is [...]&#xA;  [...]&#xA;  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 3/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not supported&#xA;  &lt;b&gt;Full Duplex, 1000Mbps, link type is force-up, media type is RJ45&lt;/b&gt;&#xA;  &lt;b&gt;output flow-control is on, input flow-control is on&lt;/b&gt;&#xA;  ARP type: ARPA, ARP Timeout 00:05:00&#xA;  [...]&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;LAN Port status:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;RTR#show int gig0/0/1&#xA;GigabitEthernet0/0/1 is up, line protocol is up&#xA;  Hardware is ISR4431-X-4x1GE, address is [...]&#xA;  [...]&#xA;  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 2/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not supported&#xA;  &lt;b&gt;Full Duplex, 1000Mbps, link type is auto, media type is RJ45&lt;/b&gt;&#xA;  &lt;b&gt;output flow-control is off, input flow-control is off&lt;/b&gt;&#xA;  ARP type: ARPA, ARP Timeout 00:05:00&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that &quot;flow-control is off&quot; for the auto-negotiate LAN port, but &quot;flow-control is on&quot; for the force-gig-full WAN port. Neither port has a command applied directly related to 802.3x ethernet flow control. In my attempts to google for a solution, I saw suggestions for a &quot;flowcontrol&quot; and &quot;negotiation forced&quot; IOS interface commands. Neither of these commands was available on the CLI of my 4431 router. Maybe they were for different Cisco hardware, interface type, or software release?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any suggestions for how to disable this please share here. I can always leave it on, but if the ISP has it disabled on their end then I should match by disabling 802.3x pause frames on mine.&lt;/p&gt;&#xA;" OwnerUserId="8441" LastEditorUserId="8441" LastEditDate="2015-08-13T23:34:38.607" LastActivityDate="2015-08-21T00:30:08.583" Title="Cisco ISR 4431 Router GigabitEthernet Flow-control Disable" Tags="|cisco-ios|cisco-isr|ieee-802.3x|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20610" PostTypeId="1" CreationDate="2015-08-13T21:45:39.597" Score="0" ViewCount="356" Body="&lt;p&gt;There is a telco device which can send sip and rtp traffic to only two servers due to its abilities. My goal is to send all the traffic generated by this device to another server located in different site. In order to do that i located a switch between the device and the network which two servers exists and the mirrored the switch port attached to telco device to another switch port attached to router. I would like to ask you that if it is possible to route that mirrored trafic on router? &#xA;&lt;a href=&quot;https://i.stack.imgur.com/n9SeQ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n9SeQ.jpg&quot; alt=&quot;topology&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17227" LastActivityDate="2021-01-30T08:00:05.453" Title="How to route mirrored traffic?" Tags="|routing|mirror|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20611" PostTypeId="2" ParentId="20610" CreationDate="2015-08-13T22:54:53.320" Score="4" Body="&lt;p&gt;&lt;em&gt;Route&lt;/em&gt;? NO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Encapsulate&lt;/em&gt; and send as a stream somewhere else (aka RSPAN)? Yes. (or &lt;em&gt;maybe&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, all you can do with that traffic is look at it. You &lt;em&gt;cannot&lt;/em&gt; pretend to be part of the conversation.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2015-08-14T06:45:21.423" LastActivityDate="2015-08-14T06:45:21.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20612" PostTypeId="1" AcceptedAnswerId="20613" CreationDate="2015-08-14T00:09:54.317" Score="2" ViewCount="3002" Body="&lt;p&gt;Should there be a difference in latency when accessing resources by their public IP address versus their private, internal IP address? And if there is, would (mis)configuration be to blame?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding (probably over-simplified) is the router will be smart enough to know that packets don't need to go out and back in when calling the public IP address and therefore there shouldn't be any performance hit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that accurate?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Context: accessing a web server that is hosted on the internal LAN with a  private address, but is accessible through the firewall via a public IP address on the WAN.  &lt;/p&gt;&#xA;" OwnerUserId="14448" LastEditorUserId="14448" LastEditDate="2015-08-14T00:32:08.117" LastActivityDate="2017-05-10T19:53:00.483" Title="Difference in latency between public and internal IP addresses" Tags="|ipv4|latency|performance|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="20613" PostTypeId="2" ParentId="20612" CreationDate="2015-08-14T00:50:10.293" Score="4" Body="&lt;p&gt;Technically yes there will be a small difference and notability will depend on your devices/configuration. This is because of the different paths the packets have to take, but like i said, depends on how your setup is designed - there are plenty of variables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) If you are on the LAN then your path to the webserver via its private IP is merely just switched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) If you are on the LAN and you try and access the webserver via its public IP then the traffic has to go out through your LAN gateway (which I am assuming is your router with a public ip address on the other side) , get natted out, get natted inbound and forwarded to the private IP address of the server and then return the traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you can see there will be marginally more resources used than  #1&lt;/p&gt;&#xA;" OwnerUserId="17190" LastActivityDate="2015-08-14T00:50:10.293" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="20614" PostTypeId="2" ParentId="20608" CreationDate="2015-08-14T00:58:06.397" Score="0" Body="&lt;p&gt;The short story is that they need to share a subnet between the routers so that they can talk. You can't just just configure a bunch if IPs on one router and totally different IPs on the other without a shared network to bring them together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eg:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.3.3.0/24 R1 -&gt; 1.1.1.1/24 &amp;lt;-- (1.1.1.0/24 shared network ) --&gt; 1.1.1.2/24 R2 4.4.4.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this scenario, 3.3.3.x would contact 4.4.4.x via R1's access to 1.1.1.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;" OwnerUserId="17190" LastActivityDate="2015-08-14T00:58:06.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20615" PostTypeId="2" ParentId="20608" CreationDate="2015-08-14T01:20:49.117" Score="1" Body="&lt;p&gt;Your explanation is missing an important piece of information:  subnet masks for the router (and host) interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But to answer your question generally, if I assume 24-bit masks:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, the routers need to have a subnet in common.  That means the two interfaces that connect them together will be configured with IP addresses in the same IP subnet.  So you will need to change the IP addresses on at least one interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, you need a route on Router 1 that forwards traffic destined to the server to Router 2's address on their common subnet, and the complement on router 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your routing table is missing a &quot;next hop address,&quot; which for R1 will be the address of R2 on the common subnet, and R1's address for R2.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example, connect interface 2 of each router together, and change the IP addresses on those interfaces to 50.50.50.1/24 for R1 and 50.50.50.2/24 for R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, you need the following routes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1:&#xA;222.222.111.0/24 -&gt; 50.50.50.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2: 111.222.111.0/24 -&gt; 50.50.50.1&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-08-14T01:20:49.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20616" PostTypeId="1" CreationDate="2015-08-14T01:30:05.757" Score="10" ViewCount="26173" Body="&lt;p&gt;So the plan is, two core routers each with a eBGP session to one of two ISPs with full routes. Both routers publish their full tables to each other so they can control traffic flow more intelligently via iBGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For argument's sake three access routers have a path to each core router. I was going to configure iBGP and publish a default route from each core router so they have some resilience against hardware failure and use filters to control what routes are actually sent to the access devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have heard that people use OSPF for their IGP generally, of course there's an element of it being case specific.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: What would be the benefit of replacing iBGP with OSPF?&lt;/p&gt;&#xA;" OwnerUserId="17190" LastEditorUserId="8499" LastEditDate="2020-11-27T22:19:59.790" LastActivityDate="2020-11-27T22:19:59.790" Title="OSPF or iBGP for interior routing protocol?" Tags="|routing|router|bgp|ospf|igp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20617" PostTypeId="2" ParentId="20616" CreationDate="2015-08-14T01:56:58.580" Score="11" Body="&lt;p&gt;iBGP requires a full mesh or use of mitigation like confederations or route reflectors, BGP doesn't converge with anything like the speed of OSPF, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each OSPF router would have a full understanding of all the routes that are in the area in which it resides without needing a full mesh, and it converges very, very quickly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using an IGP is recommended with iBGP.  Without the IGP, iBGP must neighbor on external-facing interfaces, with an IGP, iBGP can neighbor on loopback interfaces which never go down, and can have multiple paths to reach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen iBGP-only for local routing, but it is more difficult and fragile.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-08-14T14:42:54.223" LastActivityDate="2015-08-14T14:42:54.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20618" PostTypeId="1" AcceptedAnswerId="20633" CreationDate="2015-08-14T05:46:14.230" Score="5" ViewCount="5880" Body="&lt;p&gt;I believe, tokens are nothing but packets, but my question is, weather these tokens are fixed size? If yes, why fixed packets? Can anyone explain the algorithm clearly with examples.&#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="17153" LastActivityDate="2015-08-14T19:53:46.503" Title="What is a token in token bucket?" Tags="|congestion|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20622" PostTypeId="1" CreationDate="2015-08-14T09:35:34.107" Score="0" ViewCount="165" Body="&lt;p&gt;Do routers update the ARP entry in their ARP-cache table when receiving the gratuitous ARP request/reply from a neighbour host?   &lt;/p&gt;&#xA;" OwnerUserId="2716" LastEditorUserId="509" LastEditDate="2015-08-14T09:55:32.530" LastActivityDate="2015-08-14T10:40:56.990" Title="ARP-cache table update" Tags="|router|arp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20623" PostTypeId="2" ParentId="20622" CreationDate="2015-08-14T10:40:56.990" Score="1" Body="&lt;p&gt;Generally speaking, yes.  Just like every other IP host.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-08-14T10:40:56.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20625" PostTypeId="1" CreationDate="2015-08-14T12:24:50.440" Score="1" ViewCount="144" Body="&lt;p&gt;I configured bandwidth throttling for HTTP and ftp FTP using following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo /sbin/tc qdisc add dev eth0 root handle 1:0 htb default 1&#xA;sudo /sbin/tc class add dev eth0 parent 1:0 classid 1:1 htb rate 5kbps ceil 9kbps prio 0&#xA;tc filter add dev eth0 protocol ip parent 1:0 prio 1 u32 match ip sport 21 0xffff flowid 1:1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I checked with the &lt;code&gt;wget&lt;/code&gt; command by downloading a file from the Internet. (Also checked with port 80 and 21). But the download speed is not changing, e.g. not limiting under the 9 Kbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do? Do I have to configure delay also? If yes, how much?&lt;/p&gt;&#xA;" OwnerUserId="17153" LastEditorUserId="8499" LastEditDate="2016-03-12T21:09:04.010" LastActivityDate="2017-03-09T08:58:10.560" Title="How do I configure bandwidth throttling for all HTTP?" Tags="|congestion|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-06T22:39:33.163" ContentLicense="CC BY-SA 3.0" />
  <row Id="20627" PostTypeId="1" AcceptedAnswerId="20629" CreationDate="2015-08-14T14:32:51.357" Score="2" ViewCount="4648" Body="&lt;p&gt;Most mobile carriers' plans charge voice and data charged separately and differently. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Consider in 2G,3G or 4G networks respectively:&#xA;does it mean that voice and data are transmitted differently at different costs? For example, are they transmitted over different networks, or different channels of the same network, or ...?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If I am correct, in 4G (e.g. LTE, WiMAX), voice is carried as VOIP via data. But why does FreedomPop (using 4G) charge voice and data usages separately and differently?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastEditorUserId="509" LastEditDate="2015-08-14T19:49:32.420" LastActivityDate="2016-05-13T18:43:53.680" Title="Are voice and data transmitted differently?" Tags="|mobile|telephony|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20629" PostTypeId="2" ParentId="20627" CreationDate="2015-08-14T16:46:47.053" Score="2" Body="&lt;p&gt;It's normal for 2G to still go over SDH/PDH networks even if many mobile carriers are upgrading them to ethernet networks. If the same carrier has 3G and 4G technologies thay would most likley be running on ethernet networks or at least the latter. So maintaining two different networks would be expensive and supporting PDH/SDH would probably be more expensive as its getting old.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within the ethernet network data and voice will be treated differently; data will be marked as best effort traffic and voice marked as realtime traffic. Since the network will always prioratize voice over data congestion will not affect the voice traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally i belive most carriers use their LTE for data, GSM for voice and UMTS for both.&lt;/p&gt;&#xA;" OwnerUserId="17191" LastActivityDate="2015-08-14T16:46:47.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20630" PostTypeId="2" ParentId="20616" CreationDate="2015-08-14T17:10:36.653" Score="3" Body="&lt;p&gt;While everything @RonMaupin says is true, &lt;em&gt;in your particular case&lt;/em&gt;, with only five routers, there is not a lot to be gained by adding another routing protocol.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you don't have a full mesh, you will have to configure your core routers as route reflectors.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only real downside is that BGP converges more slowly than OSPF, but there are ways to minimize that deficiency.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-08-15T23:44:58.483" LastActivityDate="2015-08-15T23:44:58.483" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="20631" PostTypeId="1" AcceptedAnswerId="24004" CreationDate="2015-08-14T19:14:10.807" Score="2" ViewCount="815" Body="&lt;p&gt;In my lab network I have a Juniper MX 80 configured as MPLS router. On one site there is a customer connected (simulated by a single PC) and on the other side is an MPLS network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use &lt;a href=&quot;http://tcpreplay.synfin.net/&quot; rel=&quot;nofollow&quot;&gt;tcpreplay&lt;/a&gt; to generate traffic load. The PCAP file I use has been prepared as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Source IP is the IP of the &quot;customer&quot; PC&lt;/li&gt;&#xA;&lt;li&gt;Source MAC is the MAC address of the interface of the customer PC&lt;/li&gt;&#xA;&lt;li&gt;Destination IPs are spread among the test network, but all are existing and there are valid routes&lt;/li&gt;&#xA;&lt;li&gt;Destination MAC is the MAC address of the &quot;customer&quot; interface of the MX80&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The packets do actually arrive at the router. I am sending ~140Mbit/s traffic stream, and SMTP counters show the following (read using SNMP):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.3.6.1.4.1.2636.3.3.1.1.1.517: 0 Mb/s&#xA;1.3.6.1.4.1.2636.3.3.1.1.5.517: 17 Mb/s&#xA;----&#xA;1.3.6.1.4.1.2636.3.3.1.1.1.527: 138 Mb/s&#xA;1.3.6.1.4.1.2636.3.3.1.1.5.527: 0 Mb/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first two rows are in/out of the network facing interface, and the third + fourth row is the customer facing interface. There are no other interfaces and all traffic is supposed to the router via the first interface. Correct routes are in place, OSPF and LDP is up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I am a &quot;Cisco guy&quot;, I do not now too much on Juniper devices. However, as far as I can tell, the router &lt;em&gt;should&lt;/em&gt; be forwarding all the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have one suspicions, though: Roughly 19,278% of the packets in the PCAP file is UDP, while the rest is TCP, making up roughly 10,979% of the total traffic volume. This translates to roughly 15,15Mbps being UDP traffic, which nearly matches the not-dropped packet volume.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the traffic is recorded and later replayed, the packets do not make up correct TCP sessions. Does the router perform some kind of TCP SYN checking? If this is the case, this also would break asynchronous communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos15.1/topics/concept/using-show-commands-for-packet-drops.html&quot; rel=&quot;nofollow&quot;&gt;this article&lt;/a&gt;, but my device does not understand the &quot;set security flow *&quot; commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further I have found and tried the steps from &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos12.2/topics/task/configuration/subscriber-management-ddos-global-disabling.html&quot; rel=&quot;nofollow&quot;&gt;this article&lt;/a&gt;, but traffic is still dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the configuration of the device. So why is the traffic dropped?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 14.2R2.8;&#xA;groups {&#xA;    ffm {&#xA;        system {&#xA;            host-name F-Rtr;&#xA;            root-authentication {&#xA;                encrypted-password &quot;******&quot;;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;apply-groups ffm;&#xA;system {&#xA;    services {&#xA;        ssh;&#xA;    }&#xA;    syslog {&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any notice;                 &#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands any;&#xA;        }&#xA;    }&#xA;    ddos-protection {&#xA;        global {&#xA;            disable-routing-engine;&#xA;            disable-fpc;&#xA;            disable-logging;&#xA;        }&#xA;        protocols {&#xA;            tcp-flags {&#xA;                initial {&#xA;                    disable-routing-engine;&#xA;                    disable-fpc;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {                            &#xA;    ge-1/0/0 {&#xA;        unit 0 {&#xA;            description &quot;Link to F-Core&quot;;&#xA;            family inet {&#xA;                address 10.0.1.30/30;&#xA;            }&#xA;            family mpls;&#xA;        }&#xA;    }&#xA;    ge-1/1/0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.0.0.57/29;&#xA;            }&#xA;        }&#xA;    }&#xA;    lo0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.0.4.117/32;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    router-id 10.0.4.117;&#xA;}&#xA;protocols {&#xA;    mpls {&#xA;        interface ge-1/0/0.0;&#xA;    }&#xA;    ospf {&#xA;        area 0.0.0.0 {&#xA;            interface ge-1/0/0.0 {&#xA;                interface-type p2p;&#xA;            }&#xA;            interface lo0.0 {&#xA;                passive;&#xA;            }&#xA;            interface ge-1/1/0.0 {&#xA;                passive;&#xA;            }&#xA;        }&#xA;    }                                   &#xA;    ldp {&#xA;        transport-address router-id;&#xA;        interface ge-1/0/0.0;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2015-11-02T09:38:09.933" Title="Juniper MX80 drops generated (TCP?) packets" Tags="|juniper|juniper-junos|juniper-mx|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20632" PostTypeId="2" ParentId="20625" CreationDate="2015-08-14T19:53:41.647" Score="0" Body="&lt;p&gt;Port 21 is used FTP Control. You should limit port 20 (FTP Data) if you want to limit FTP traffic, and create a similar rule for port 80 if you want to limit HTTP traffic.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-08-14T19:53:41.647" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20633" PostTypeId="2" ParentId="20618" CreationDate="2015-08-14T19:53:46.503" Score="8" Body="&lt;p&gt;The concept of a token bucket is generic/universal, but the implementations for QoS may use different token units to control traffic flow at a specified rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-policing/19645-policevsshape.html&quot;&gt;Cisco traffic policing&lt;/a&gt; (the most basic QoS token bucket technique), the token bucket size is specified in bytes (each token is one byte). For example, if you want to police traffic at a rate of 100Kbps, you could use a command like &lt;code&gt;police 100000 18750&lt;/code&gt; which sets your &lt;strong&gt;cir&lt;/strong&gt; (committed information rate) to 100 thousand bits per second and your &lt;strong&gt;bc&lt;/strong&gt; (burst committed/token bucket size) to 18,750 bytes. Here is an example of how this token bucket works with some sample traffic (t is the elapsed time in milliseconds):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Policer bucket starts full with 18,750 bytes&lt;/li&gt;&#xA;&lt;li&gt;at t=0ms: 1,500 byte packet is sent leaving 17,250 bytes in bucket&lt;/li&gt;&#xA;&lt;li&gt;at t=100ms: we add 1,250 bytes (tokens) to the bucket (0.1s at 100k) then transmit two 1500 byte packets that just arrived. 17250+1250-3000=15,500 bytes left in bucket&lt;/li&gt;&#xA;&lt;li&gt;at t=200ms: we add 1,250 bytes (tokens) to bucket then transmit three 1500 byte packets that just arrived. 15500+1250-4500=12,250 bytes left in bucket&lt;/li&gt;&#xA;&lt;li&gt;at t=300ms: we add 1,250 bytes (tokens) to bucket then transmit four 1500 byte packets that just arrived. 12250+1250-6000=7,500 bytes (tokens) left in bucket&lt;/li&gt;&#xA;&lt;li&gt;at t=500ms: we add 2,500 bytes (100Kbps for 0.2seconds without traffic) then transmit six 1000 byte newly arrived packets. 7500+2500-6000=4,000 bytes&lt;/li&gt;&#xA;&lt;li&gt;at t=600ms: we add 1,250 bytes (tokens) to bucket then transmit three 1500 byte fresh packets. 4000+1250-4500=750 bytes&lt;/li&gt;&#xA;&lt;li&gt;at t=650ms: we add 625 bytes (tokens) and try to send a just arrived 1500 byte packet but must DROP IT because there are not enough tokens (bytes) in the bucket. 750+625=1375 bytes (not enough tokens, drop 1500 byte packet)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Let me try to describe how the algorithm works. Bucket starts full when first packet arrives we take bytes from bucket. When next packet(s) arrive, we add tokens based on time since last packet(s) processed then transmit as many packets as new bucket size allows. When new packets arrive we always add tokens (bytes) (rate * seconds since last packet(s) / 8bitsperbyte) then transmit as many packets as the bucket will allow. We can NEVER fill bucket beyond the fixed size (bc / bucket size) and we can never take out more tokens to transmit packets at a given instant if the size exceeds tokens IN the bucket.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to think of this is that you turn on a water faucet at a set rate (liters per second) and place a bucket under. You may empty the bucket into your baby pool or other cistern (consume water from token bucket) at a rate of no more than the rate at which water is flowing into the bucket. If you wait too long while the bucket is filling under the faucet, the extra water (tokens) will be lost (wasted/thrown away) due to the fixed size of the bucket. Since packets are measured in fixed bytes, we can compare a byte to a fixed size droplet of water - the token bucket has a maximum capacity measured in number of water droplets (tokens).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this help? See the Cisco article I linked to as well.&lt;/p&gt;&#xA;" OwnerUserId="8441" LastActivityDate="2015-08-14T19:53:46.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20634" PostTypeId="2" ParentId="20564" CreationDate="2015-08-14T20:20:49.983" Score="-4" Body="&lt;p&gt;static routes default administrative distance is 254. ibgp is lower by default. but this is not the issue i misread your question. The issue is that you probably have auto summarization on. so if you look at your routing table they are probably being summarized into the same route. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;also make sure the interface is configured correctly on the firewall and the subnets are the same and your port priveledges are good correct too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;check the arp table on your firewall and see if it see's the switch. check it the other way too. see if your arp table on the switch sees the firewall. if they dont check that all your interfaces are configured correctly and that auto summarization is off. your probably summarizing the 172.16.100.x into the 172.16.x.x route.&lt;/p&gt;&#xA;" OwnerUserId="17254" LastEditorUserId="17254" LastEditDate="2015-08-14T20:30:50.283" LastActivityDate="2015-08-14T20:30:50.283" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="20635" PostTypeId="1" AcceptedAnswerId="20644" CreationDate="2015-08-14T23:11:35.390" Score="0" ViewCount="974" Body="&lt;p&gt;When i add a different source ip (in public range) to the header of a tcp paket will my gateway proceed that paket as i set the source ip even if it is in an unknown subnet or will the gateway add his own real ip anyway? i cant test it because i just have 1 ip. thank you&lt;/p&gt;&#xA;" OwnerUserId="14477" LastEditorUserId="14477" LastEditDate="2015-08-14T23:22:17.363" LastActivityDate="2017-08-23T19:28:10.843" Title="Does a router handle tcp packets with unknown source ip?" Tags="|router|tcp|ip|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20638" PostTypeId="2" ParentId="20635" CreationDate="2015-08-15T11:00:04.893" Score="0" Body="&lt;p&gt;Based on what I know it is possible to do so. This is how DoS amplification is done. Router makes decisions based on the destination IP address of a packet then the destination node would respond to the source IP address of the packet it receives. &lt;/p&gt;&#xA;" OwnerUserId="17257" LastActivityDate="2015-08-15T11:00:04.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20639" PostTypeId="2" ParentId="20450" CreationDate="2015-08-15T11:17:40.973" Score="1" Body="&lt;p&gt;technically speaking , ASA allows traffic from higher security level toward the lower level security area unless if u define an explicit ACL to do so. Your local are security level should have higher level than DMZ and DMZ higher than outside area. IF you follow this rule u should not be able to initiate any traffic from DMZ toward yr local area nodes.  Based on this rule, nobody from outside have access to yr DMZ area so u should define Static NAT or PAT to allow traffic to yr servers from outside area. I hope this will help you. Thank you. &lt;/p&gt;&#xA;" OwnerUserId="17257" LastActivityDate="2015-08-15T11:17:40.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20640" PostTypeId="1" AcceptedAnswerId="20641" CreationDate="2015-08-15T12:53:51.480" Score="4" ViewCount="854" Body="&lt;p&gt;I am learning about route summarization and how it represent different subnets with a single address and single subnet mask,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if i have two subnets,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.1.0 &#xA;10.1.2.0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The summarized subnet with subnet mask is,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.0.0/22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is because, the two left octets in both networks are same while &lt;code&gt;6&lt;/code&gt; bits in both the networks are same as well, so, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;8 + 8 + 6 = 22&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if i try to implement this in Packet tracer,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uQOLC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uQOLC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and enter &lt;code&gt;show ip route&lt;/code&gt; command on the Router, then it gives the following output,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show ip route&#xA;Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area&#xA;       * - candidate default, U - per-user static route, o - ODR&#xA;       P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/24 is subnetted, 2 subnets&#xA;C       10.1.1.0 is directly connected, FastEthernet0/0&#xA;C       10.1.2.0 is directly connected, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, in the third last line it says,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     10.0.0.0/24 is subnetted, 2 subnets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is, why the summarized address is &lt;code&gt;10.0.0.0/24&lt;/code&gt; instead of &lt;code&gt;10.1.0.0/22&lt;/code&gt;. ?&lt;/p&gt;&#xA;" OwnerUserId="14885" LastEditorUserId="8499" LastEditDate="2018-12-22T02:54:33.567" LastActivityDate="2018-12-22T02:54:33.567" Title="incorrect subnet mask for route summarization" Tags="|cisco|routing|router|packet-tracer|route-summarization|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20641" PostTypeId="2" ParentId="20640" CreationDate="2015-08-15T13:37:20.727" Score="3" Body="&lt;p&gt;It's because they are in the 10.0.0.0 network, and they are subnetted as /24.  You are not seeing a route summary.  If you had subnetted one differently than the other, say /25, you would get something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;C       10.1.1.0/25 is directly connected, FastEthernet0/0&#xA;C       10.1.2.0/24 is directly connected, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-08-15T14:29:36.027" LastActivityDate="2015-08-15T14:29:36.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20642" PostTypeId="1" AcceptedAnswerId="20643" CreationDate="2015-08-15T15:21:44.157" Score="2" ViewCount="499" Body="&lt;p&gt;I looked up the public IPv6 addresses on google for two devices on my LAN, and the addresses are unique (only the first 64 bits match).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought that the router connected to the internet has a public IPv6 address that is assigned by the ISP. Then all of the devices on this router's LAN share this public address but have their own private address within the subnet to distinguish themselves.  Can someone please clarify how this works?  Thanks.&lt;/p&gt;&#xA;" OwnerUserId="17262" LastEditorUserId="8499" LastEditDate="2018-12-22T02:55:25.280" LastActivityDate="2018-12-22T02:55:25.280" Title="Do different nodes on a LAN share a public IPv6 address?" Tags="|nat|ipv6|lan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20643" PostTypeId="2" ParentId="20642" CreationDate="2015-08-15T15:24:23.723" Score="1" Body="&lt;p&gt;IPv6 is designed to restore the original IP feature of end-to-end connectivity.  Each host can have a globally unique address.  This fixes the problems caused by NAT use in IPv4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RFC recommends that each person be assigned a /48 (65536 /64 subnets).  Most ISPs actually will only give you something less like a /56.  You can easily get a /48 by requesting it from your RIR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most home routers can't delegate more than a /64, but that is still over 18 quintillion addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-08-15T15:36:49.163" LastActivityDate="2015-08-15T15:36:49.163" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20644" PostTypeId="2" ParentId="20635" CreationDate="2015-08-15T17:03:39.497" Score="-1" Body="&lt;p&gt;My previous answer (which I could not delete ,unfortunately, because it had already been accepted as a correct answer) did not not answer the question,and so here is the edit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If NAT is in operation on the gateway router, yes the IP address you have inserted on the packet will be changed, but it  nevertheless would have been changed by NAT even if it was still the original one.If NAT is not in operation, the packet will be forwarded as is.But it all depends on the configurations you have.&lt;/p&gt;&#xA;" OwnerUserId="17024" LastEditorUserId="17024" LastEditDate="2015-09-16T16:55:23.737" LastActivityDate="2015-09-16T16:55:23.737" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20646" PostTypeId="1" AcceptedAnswerId="24550" CreationDate="2015-08-15T18:40:27.777" Score="2" ViewCount="467" Body="&lt;p&gt;I'm pretty new to IOS and I've been building up a configuration file in Packet Tracer. I still have NAT to setup, as I have to account for a couple of streamers. So, what should I do to configure the security portion of this router? Does this configuration leave the router wide open? The model is the 891F ISR, but I'll also be configuring some 881 routers as well. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;    hostname xxxxxxx&#xA;    !&#xA;    !&#xA;    !&#xA;    enable password secret xxxxxxxx&#xA;    !&#xA;    !&#xA;    ip dhcp excluded-address 192.168.1.1&#xA;    !&#xA;    ip dhcp pool LAN&#xA;     network 192.168.1.0 255.255.255.0&#xA;     default-router 192.168.1.1&#xA;     dns-server 8.8.8.8&#xA;    !&#xA;    !&#xA;    !&#xA;    username xxx privilege 15 password 0 xxxxxxxxxxx&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    ip ssh version 1&#xA;    ip domain-name cisco.com&#xA;    ip name-server 192.168.1.2&#xA;    !&#xA;    !&#xA;    spanning-tree mode pvst&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    interface FastEthernet0/0&#xA;     description ISP connection&#xA;     ip address xxx.xxx.xxx.xxx 255.255.255.0&#xA;     duplex auto&#xA;     speed auto&#xA;    !&#xA;    interface FastEthernet0/1&#xA;     no ip address&#xA;     duplex auto&#xA;     speed auto&#xA;     shutdown&#xA;    !&#xA;    interface FastEthernet0/1/0&#xA;     switchport mode access&#xA;     spanning-tree portfast&#xA;    !&#xA;    interface FastEthernet0/1/1&#xA;     switchport mode access&#xA;     spanning-tree portfast&#xA;    !&#xA;    interface FastEthernet0/1/2&#xA;     switchport mode access&#xA;     spanning-tree portfast&#xA;    !&#xA;    interface FastEthernet0/1/3&#xA;     switchport mode access&#xA;     spanning-tree portfast&#xA;    !&#xA;    interface Vlan1&#xA;     ip address 192.168.1.1 255.255.255.0&#xA;    !&#xA;    ip classless&#xA;    ip route 0.0.0.0 0.0.0.0 xxx.xxx.xxx.xxx&#xA;    !&#xA;    !&#xA;    !&#xA;    banner motd ^CThis router is private property and may not be accessed without permission of the owner^C&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    line con 0&#xA;     exec-timeout 0 0&#xA;     password xxxxxxxx&#xA;     logging synchronous&#xA;     login local&#xA;    line vty 0 4&#xA;     exec-timeout 0 0&#xA;     password xxxxxxx&#xA;     logging synchronous&#xA;     login local&#xA;    line vty 5 15&#xA;     exec-timeout 0 0&#xA;     password xxxxxxxxxxx&#xA;     logging synchronous&#xA;     login local&#xA;    !&#xA;    !&#xA;    !&#xA;    end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17265" LastActivityDate="2015-11-19T02:32:09.743" Title="New to Cisco IOS, how can I improve the security of this configuration?" Tags="|cisco|nat|firewall|security|" AnswerCount="5" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="20649" PostTypeId="2" ParentId="20616" CreationDate="2015-08-15T21:06:40.990" Score="10" Body="&lt;p&gt;First off, I would dispute the assertion that some others have made that OSPF converges faster than BGP, but more on that later.  To answer the OP question first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iBGP is designed to run between loopback interfaces on routers and it doesn't (at least without tweaking and turning some knobs) change any attributes (which includes next-hop) of the routes that it's advertising.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what are the implications of that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's call your border routers router A, and router B and your for-argument's-sake three access routers router 1, router 2, and router 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router's A and B get full Internet feeds from your upstreams, with next-hop set to the upstream's interface address on the interconnecting link.  When those routes get passed on via iBGP, again, unless you tweak, the next-hop of the route that routers 1, 2, and 3 receive is still the IP address on the far side of that interconnect link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers will do a recursive lookup to find the path to that IP address and then use that next-hop when the route is installed in the forwarding table.  &quot;But,&quot; you say, &quot;I'll use next-hop self.&quot;  See the next paragraph for how this works out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;But,&quot; you may also say, &quot;I'm only advertising defaults down to routers 1, 2, and 3.&quot;  OK, but that default route has to come from somewhere...if its an already existing default (say a static) it'll have a next-hop that'll get used.  If its a generated default...it'll probably be using the loopback address that the iBGP session is running on as the next-hop.  Again, this won't be seen as an interface, or directly connected route in routers 1, 2, and 3, so they'll still have to do a recursive lookup to find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you need some sort of IGP running, such as OSPF, IS-IS, or EIGRP, or even just a lot of pain-in-the-backside-to-manage statics, for the reachability to work for the recursive lookups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;But,&quot; you say again, &quot;I'll run the iBGP sessions on the interface addresses rather than the loopbacks.  OK, but now your BGP peering session is dependent on the interface being &quot;up&quot; to work. So, for example, if the interface between router 1 and router A goes down, so does the iBGP peering session running on that interface.  But router 1 still has the ability to send traffic to router A, it just has to do it via router B.  So, you want the iBGP session to stay up, even when those interfaces go down, because your ultimate next-hop is still over yonder, and over yonder is still reachable through another path...OSPF (I use OSPF, but you can sub IS-IS and EIGRP anywhere you see OSPF here) will figure out that other internal path and take care of building the forwarding table correctly in that recursive lookup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, yes, you can probably tweak enough knobs and get a pure iBGP setup working without any IGP setup...but please don't...it'll be a lot of work, it'll almost certainly be flakey.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do yourself a favor and turn on OSPF, or IS-IS, or even EIGRP if you're a pure Cisco shop (but please consider whether you really want to accept that vendor lock-in if you do...consider future potential decisions to use a different vendor's gear...even if only to try to keep Cisco honest on pricing with you).  Turn it on for all of your interfaces between your routers, and also set it up on your upstream connection with the passive setting, and probably on your downstreams from your access routers with the passive setting as well.  Then set up your iBGP peerings between your loopbacks.  Consider route reflectors (probably on routers A and B) to cut down the configuration effort required...it makes sense at about 5 routers to start doing that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It really is the sanest way to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, to protocol convergence speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most people think BGP is slow and OSPF (or whatever) is fast because of the common use cases for these protocols.  People typically pull full Internet, or at least a significant fraction thereof, into BGP, while only handling internal routes in OSPF (10s to 100s, maybe into the low thousands of routes).  So, let's assume you're pulling half of the Internet routes into BGP...try building an OSPF area with 250,000+ routes and let me know how that goes for you.  Let's see if that converges faster than BGP does...or ever unless you have a really beefy control plane on your routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP, for a given situation, can frequently converge, or reconverge, faster than OSPF and others, at least depending on how you measure it.  If you include OSPF's neighbor discovery on a broadcast network, BGP is almost certain to win for a similar mix of routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other difference is that BGP will start putting routes in routing and forwarding tables before its finished (re)converging, which can be a benefit, while OSPF implementations will almost certainly wait until the very end before it starts putting routes in routing and forwarding tables.  Sometimes having a partial route set converged can be useful.  Sometimes not.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2015-08-15T21:06:40.990" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20650" PostTypeId="2" ParentId="20015" CreationDate="2015-08-15T23:10:41.993" Score="2" Body="&lt;p&gt;Many devices have a label with their MAC address printed somewhere. If there is no such label on this particular camera, you can use the ideas in the previous &lt;a href=&quot;https://networkengineering.stackexchange.com/a/20019/5842&quot;&gt;answer&lt;/a&gt; by Ron to find the MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you know the MAC address and need to find the IP address, the next step will depend on whether the device supports IPv6. If the device does support IPv6 there is a good chance it will have a link-local address which was derived from the MAC address. In that case you can compute the IP address directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the device only supports IPv4, you can use tcpdump or Wireshark to listen for traffic from that MAC address to learn its IP address. You may have to ping all devices on the segment in order to force the device to send a packet for you to see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also look in the neighbor cache/ARP cache for the MAC address. But since that cache only contains addresses you have communicated with, you may still have to ping the device first before you will find its MAC in your cache.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A completely different approach is to connect to port 80 on every IP on the LAN (assuming the device has a web server listening on that port), and see if any of them reply with a familiar page. Due to the risk of finding a different device with a similar (or identical) config page instead of the intended device, I would only use this approach as last resort.&lt;/p&gt;&#xA;" OwnerUserId="5842" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-08-15T23:10:41.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20651" PostTypeId="1" AcceptedAnswerId="20652" CreationDate="2015-08-16T00:34:46.867" Score="2" ViewCount="2278" Body="&lt;p&gt;This Topology is simple but my VLAN is not propaganting. I'm following this &lt;a href=&quot;http://www.freeccnaworkbook.com/workbooks/ccna/configuring-vlan-trunking-protocol-vtp&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tutorial&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/y36XG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y36XG.png&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Multilayer Switch0&#xA;&#xA;VTP Version                     : 2&#xA;Configuration Revision          : 2&#xA;Maximum VLANs supported locally : 1005&#xA;Number of existing VLANs        : 6&#xA;VTP Operating Mode              : Server&#xA;VTP Domain Name                 : College&#xA;VTP Pruning Mode                : Disabled&#xA;VTP V2 Mode                     : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;MD5 digest                      : 0x8C 0x34 0x21 0x33 0xEF 0xC7 0x4E 0x26 &#xA;Configuration last modified by 0.0.0.0 at 3-1-93 00:00:37&#xA;&#xA;VTP Password: 123&#xA;&#xA;&#xA;&#xA;Switch1&#xA;&#xA;Switch#sh vtp status&#xA;VTP Version                     : 2&#xA;Configuration Revision          : 0&#xA;Maximum VLANs supported locally : 255&#xA;Number of existing VLANs        : 5&#xA;VTP Operating Mode              : Client&#xA;VTP Domain Name                 : College&#xA;VTP Pruning Mode                : Disabled&#xA;VTP V2 Mode                     : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;MD5 digest                      : 0xE6 0x2A 0x85 0x14 0x05 0x53 0x1C 0xA1 &#xA;Configuration last modified by 0.0.0.0 at 0-0-00 00:00:00&#xA;&#xA;Switch#sh vtp password &#xA;VTP Password: 123&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What the difference to setting VLAN in Global Mode or using &quot;VLAN Database&quot;? &lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="8499" LastEditDate="2019-01-04T06:10:26.267" LastActivityDate="2019-01-04T06:10:26.267" Title="VTP: VLAN is not propagating" Tags="|cisco|vlan|packet-tracer|trunk|vtp|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="20652" PostTypeId="2" ParentId="20651" CreationDate="2015-08-16T01:17:58.463" Score="3" Body="&lt;p&gt;VTP only propagates on trunks, so you must have a trunk link between the switches.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-08-16T01:17:58.463" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20653" PostTypeId="1" CreationDate="2015-08-16T07:33:56.127" Score="1" ViewCount="1007" Body="&lt;p&gt;Cisco introduce OTV as solution to give two physical separate Data centers  l2 connectivity over common L3 network , so why we need that if we have L2 VPN solution ? and what is the benefits of implementing OTV and excluse L2 VPN ?&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2018-06-05T18:06:48.470" Title="Cisco OTV vs L2 VPN" Tags="|cisco|l2vpn|cisco-nexus|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20658" PostTypeId="1" AcceptedAnswerId="22671" CreationDate="2015-08-16T19:19:03.307" Score="1" ViewCount="3339" Body="&lt;p&gt;I have following network diagram&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;              [Core Switch] &amp;lt;-- VLAN 20 external&#xA;                   |&#xA;                   |    &amp;lt;--- VIP &#xA;                  [F5]&#xA;                   |    &amp;lt;--- VLAN 10 (Pool membber)&#xA;                   |&#xA;             --------------&#xA;             |     |      |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As per above diagram VLAN 20 is external public VLAN and VLAN 10 is Internal VLAN for WWW servers.&lt;/p&gt;&#xA;&lt;p&gt;As per above diagram do i need to configure &lt;code&gt;VLAN 20&lt;/code&gt; on my F5 and create &lt;code&gt;SelfIP&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;p&gt;I think i only need to add VLAN 10 on F5 right?&lt;/p&gt;&#xA;&lt;h1&gt;EDIT:&lt;/h1&gt;&#xA;&lt;p&gt;Core switch Interface config&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel1&#xA; description Connected_to_F5&#xA; switchport&#xA; switchport access vlan 2&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20&#xA; switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-09-19T22:57:01.333" Title="F5 VIP required to have on External VLAN?" Tags="|vlan|load-balancer|f5|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="20661" PostTypeId="2" ParentId="20653" CreationDate="2015-08-16T20:34:45.203" Score="2" Body="&lt;p&gt;Here is a short answer:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;OTV allows for more than just two sites.  It prevents bridging loops better than spanning tree.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;OTV controls unknown MAC flooding, and only advertises MACs to other sites as necessary.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;OTV limits &quot;local&quot; protocols like STP, VTP, etc to the local site.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;OTV prevents broadcast storms, L2 loops, etc from affecting more than one location.  With a L2 VPN, all can be affected.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;OTV runs over IP.  You can use it where you can't get a L2VPN.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/nexus-7000-series-switches/white_paper_c11-574984.html&quot; rel=&quot;nofollow&quot;&gt;Here's more info&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-08-16T20:34:45.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20662" PostTypeId="1" AcceptedAnswerId="20671" CreationDate="2015-08-16T21:02:07.210" Score="1" ViewCount="59" Body="&lt;p&gt;Is it possible to pinpoint all the BSSIDs that exist in a building? For instance in the case of other buildings nearby a scan would also find networks of neighboring buildings. Is there a strategy to overcome that?&lt;/p&gt;&#xA;" OwnerUserId="17288" LastActivityDate="2015-08-17T03:57:41.260" Title="Determining the BSSIDs in a building" Tags="|router|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20663" PostTypeId="1" AcceptedAnswerId="20665" CreationDate="2015-08-16T21:13:00.650" Score="4" ViewCount="12979" Body="&lt;p&gt;I read following line from &lt;a href=&quot;https://en.wikipedia.org/wiki/Port_%28computer_networking%29&quot; rel=&quot;nofollow&quot;&gt;port WIKI&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, does it mean that same port, let's say 7001 can be bind to a different IP address or different protocol?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per my knowledge, it cannot be and would result in &quot;port already in use&quot;. But want to confirm.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Common application failures, sometimes called port conflicts, occur&#xA;  when multiple programs attempt to bind to the same port numbers on the&#xA;  same IP address using the same protocol.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17198" LastEditorUserId="8499" LastEditDate="2018-12-22T02:58:56.967" LastActivityDate="2018-12-22T02:58:56.967" Title="Can same port configured for different IP address or different protocol" Tags="|ip|tcp|layer3|transport-protocol|layer4|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20664" PostTypeId="1" AcceptedAnswerId="20666" CreationDate="2015-08-16T21:20:07.763" Score="1" ViewCount="66" Body="&lt;p&gt;Suppose my institution wants to block all incoming HTTP and HTTPS requests, so firewall is configured for blocking access for incoming request to port 80 and 443, but I can configure some other port for my application for listening for HTTP service, let's say 7001. Then in this case how institution would be able to block?&lt;/p&gt;&#xA;" OwnerUserId="17198" LastEditorUserId="509" LastEditDate="2015-08-16T21:23:18.973" LastActivityDate="2015-08-16T21:25:34.733" Title="Port and firewall" Tags="|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20665" PostTypeId="2" ParentId="20663" CreationDate="2015-08-16T21:21:32.110" Score="6" Body="&lt;p&gt;It may help if you think of the port as an extension of the IP address.  Just as two different buildings may have a room 101, the rooms are not the same room.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;10.1.2.3:1234&lt;/code&gt; is a different port than &lt;code&gt;172.16.17.18:1234&lt;/code&gt;. The function of the port may be the same across IP addresses or protocols (e.g., IPv6 ports have the same functions as IPv4 ports, even though they are different protocols).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-08-16T21:28:54.390" LastActivityDate="2015-08-16T21:28:54.390" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="20666" PostTypeId="2" ParentId="20664" CreationDate="2015-08-16T21:25:34.733" Score="1" Body="&lt;p&gt;That depends on your equipment and software.  For instance, many Cisco devices can use NBAR to do deep packet inspection in order to identify upper layer protocols in use.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-08-16T21:25:34.733" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20667" PostTypeId="5" CreationDate="2015-08-16T21:39:41.697" Score="0" Body="" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2015-08-16T21:39:41.697" LastActivityDate="2015-08-16T21:39:41.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20668" PostTypeId="4" CreationDate="2015-08-16T21:39:41.697" Score="0" Body="Port security is a technique for securing switchports by restricting inrgess traffic by limiting the MAC addresses that are allowed to send traffic into the port." OwnerUserId="509" LastEditorUserId="509" LastEditDate="2015-08-16T21:39:41.697" LastActivityDate="2015-08-16T21:39:41.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20671" PostTypeId="2" ParentId="20662" CreationDate="2015-08-17T03:57:41.260" Score="1" Body="&lt;p&gt;&quot;Wireless Heat Mapping&quot; is the usual term. Various &lt;a href=&quot;http://www.ekahau.com/wifidesign/ekahau-heatmapper&quot; rel=&quot;nofollow&quot;&gt;software&lt;/a&gt; exists for doing it; I linked to a free one I'm not in any way associated with. A decent job requires access to the whole building, so if you are merely trolling hallways the results are likely to be much less definitive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A signal from a neighboring building will be generally broad and weak, while signals from within the building will have zones of higher signal that (seen on a heatmap) will indicate where in the building they are coming from.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-08-17T03:57:41.260" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20674" PostTypeId="1" CreationDate="2015-08-17T11:45:01.990" Score="2" ViewCount="355" Body="&lt;p&gt;On my Huawei CE12800 device, I am trying to run this config. Beside a standart BGP process, I am using three community values to control traffic with my upstream provider. With 555 community value, I can block traffic which has an international origin. 10.20.30.3 should be reachable only from my local network and from upstream network. Despite of I can succesfully announce 10.20.30.3 with 555 community, but static ip route to NULL interface blocks the traffic. I need a dummy route entry to bring up BGP announce which doesn't block traffic locally. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, this setup works on my old 3com 8800 device.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&#xA;interface Vlanif1000&#xA; ip address 10.20.30.1 255.255.255.240&#xA;#&#xA;bgp 11111&#xA; group UPSTREAM external&#xA; peer UPSTREAM as-number 22222&#xA; peer 11.22.33.44 as-number 22222&#xA; peer 11.22.33.44 group UPSTREAM&#xA; #&#xA; ipv4-family unicast&#xA;  dampening&#xA;  default-route imported&#xA;  network 10.20.30.0 255.255.255.0&#xA;  network 10.20.30.3 255.255.255.255&#xA;  peer UPSTREAM enable&#xA;  peer UPSTREAM route-policy export_upstream export&#xA;  peer UPSTREAM advertise-community&#xA;  peer 11.22.33.44 enable&#xA;  peer 11.22.33.44 group UPSTREAM&#xA;#&#xA;route-policy export_upstream permit node 5&#xA; if-match ip-prefix black_hole&#xA; apply community 22222:666&#xA;#&#xA;route-policy export_upstream permit node 6&#xA; if-match ip-prefix upstream_int2&#xA; apply community 22222:555&#xA;#&#xA;route-policy export_upstream permit node 7&#xA; if-match ip-prefix upstream_int1&#xA; apply community 22222:444&#xA;#&#xA;route-policy export_upstream permit node 10&#xA; if-match ip-prefix local_upstream&#xA; apply local-preference 25&#xA;#&#xA;ip ip-prefix local_upstream index 84 permit 10.20.30.0 24 greater-equal 24 less-equal 32&#xA;ip ip-prefix black_hole index 10 permit 172.16.0.2 32 greater-equal 32 less-equal 32&#xA;ip ip-prefix upstream_int1 index 10 permit 172.16.0.4 32 greater-equal 32 less-equal 32&#xA;ip ip-prefix upstream_int2 index 10 permit 172.16.0.3 32 greater-equal 32 less-equal 32&#xA;ip ip-prefix upstream_int2 index 34714 permit 10.20.30.3 32&#xA;#&#xA;ip route-static 0.0.0.0 0.0.0.0 11.22.33.44&#xA;ip route-static 10.20.30.0 255.255.255.0 NULL0 description BGPTEST&#xA;ip route-static 10.20.30.3 255.255.255.255 NULL0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17295" LastActivityDate="2024-01-24T15:54:43.007" Title="ip routing preference problem" Tags="|routing|bgp|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20676" PostTypeId="2" ParentId="19846" CreationDate="2015-08-17T13:12:18.457" Score="3" Body="&lt;p&gt;It's likely looking for a .local multicast DNS name for those addresses.&lt;/p&gt;&#xA;&lt;p&gt;See rfc 6762: &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6762&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc6762&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Quote: &amp;quot;Any DNS query for a name ending with &amp;quot;254.169.in-addr.arpa.&amp;quot; MUST&#xA;be sent to the mDNS IPv4 link-local multicast address 224.0.0.251&amp;quot;&lt;/p&gt;&#xA;" OwnerUserId="17297" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2015-08-17T13:12:18.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20678" PostTypeId="1" AcceptedAnswerId="20682" CreationDate="2015-08-17T13:33:07.640" Score="8" ViewCount="6306" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UNW7d.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UNW7d.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;Hi! Could someone explain to me what happens at the time-out? Then the window size completely drops. I thought that at time-out the same thing as in 3 duplicate ACKs would happen; half the cwnd and go into additive increase. Is there a difference in how these indicators of congestion are handled?&lt;/p&gt;&#xA;" OwnerUserId="17298" LastEditorUserId="8499" LastEditDate="2018-10-27T02:30:05.360" LastActivityDate="2018-10-27T02:30:05.360" Title="How exactly does TCP react to a retransmission timeout?" Tags="|tcp|protocol-theory|layer4|transport-protocol|congestion|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20680" PostTypeId="2" ParentId="20606" CreationDate="2015-08-17T14:15:43.980" Score="3" Body="&lt;p&gt;L3VPN has to have their PE (label edge routes) configured with RD, route-target import/export in particular VRFs. That's only for purpose of control plane. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make it clear, let me make brief explanation of RD and route-target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;route distinguisher (RD)&lt;/strong&gt; is used in order discern which prefix belongs to which customer. As you probably know from your own studies, same prefix can be used by multiple customers. E.g. 192.168.0.0/24 can use customer A and also customer B inside their LANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to be aware that The VPNV4 family itself doesn’t run in a VRF. &#xA;So purpose of RD is only to make IPv4 prefixes globally unique, when BGP advertise NLRI to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's 8 bytes long field.&#xA;See it below in blue box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CSDgI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CSDgI.png&quot; alt=&quot;Wireshark capture&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router-target import/export&lt;/strong&gt; is necessary to determine which prefix belongs to which VRF (customer). So when BGP sending update, also include extended community depends on route-target export.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And when particular PE router received that BGP update. He can easily recognize to which VRF prefix belongs, depends on route-target import.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For above image from Wireshark, extended community has been included by PE router (10.0.0.3) depends on route-target export (red box). And will be included into appropriate VRF by another PE router (10.0.0.4) once he received that update, thanks to route-target import. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you will be familiar enough with above. You can study more advance features, like route leaking between routing tables, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I created simple MPLS network, so we can make some practical examples.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Topology contains only one customer CUST_A)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/AcEpO.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AcEpO.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When configuration of VRF for CUST_A is following on both PE routers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE_1#sh run | s ip vrf CUST_A&#xA;ip vrf CUST_A&#xA; rd 10:10&#xA; route-target export 10:10&#xA; route-target import 10:10&#xA;PE_1#&#xA;&#xA;PE_2#sh run | s ip vrf CUST_A&#xA;ip vrf CUST_A&#xA; rd 10:10&#xA; route-target export 10:10&#xA; route-target import 10:10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;CE_2 router has network 192.168.0.0/24 known from CE_1 in his routing table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CE_2#sh ip ro | b Gateway&#xA;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/30 is subnetted, 2 subnets&#xA;C       10.4.6.0 is directly connected, FastEthernet0/0&#xA;B       10.3.5.0 [20/0] via 10.4.6.1, 00:48:52&#xA;B    192.168.0.0/24 [20/0] via 10.4.6.1, 00:48:52&#xA;C    192.168.1.0/24 is directly connected, Loopback0&#xA;CE_2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In next example I will remove route-target import from particular VRF configuration of CUST_A on PE_2 (R4 in topology) router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE_2(config)#ip vrf CUST_A&#xA;PE_2(config-vrf)#no route-target import 10:10&#xA;PE_2(config-vrf)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't see prefix 192.168.0.0/24 in BGP VPNV4 table of PE_2 and in routing table of CE_2 router as well.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE_2#sh bgp vpnv4 unicast all&#xA;BGP table version is 23, local router ID is 10.0.0.4&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;Route Distinguisher: 10:10 (default for vrf CUST_A)&#xA;r&amp;gt; 10.4.6.0/30      10.4.6.2                 0             0 200 ?&#xA;*&amp;gt; 192.168.1.0      10.4.6.2                 0             0 200 ?&#xA;PE_2#&#xA;&#xA;CE_2#sh ip ro | b Gateway&#xA;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/30 is subnetted, 1 subnets&#xA;C       10.4.6.0 is directly connected, FastEthernet0/0&#xA;C    192.168.1.0/24 is directly connected, Loopback0&#xA;CE_2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Even if it's advertised from PE_1 (route R3 in topology) router correctly (with correct RD and RT in NLRI):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE_1#sh bgp vpnv4 unicast all neighbors 10.0.0.4 advertised-routes | b Network&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;Route Distinguisher: 10:10 (default for vrf CUST_A)&#xA;r&amp;gt; 10.3.5.0/30      10.3.5.2                 0             0 100 ?&#xA;*&amp;gt; 192.168.0.0      10.3.5.2                 0             0 100 ?&#xA;&#xA;Total number of prefixes 2&#xA;PE_1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can do more examples, but I hope it's clear enough now.&#xA;Hope it helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Feel free to drop a comment in case of any misunderstanding.&lt;/p&gt;&#xA;" OwnerUserId="10520" LastEditorUserId="10520" LastEditDate="2015-08-17T16:38:56.807" LastActivityDate="2015-08-17T16:38:56.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20681" PostTypeId="1" CreationDate="2015-08-17T15:22:10.097" Score="2" ViewCount="94" Body="&lt;p&gt;If I have two switches that are about 400m apart and I want to connect them through a optical fibre connection, whats the best way to do this? &#xA;I am thinking of using media converters that take a GbE connection on the switch side and convert this to multi-mode optical transmission signals that can be re-converted on the other side. These converters can either perform WDM for full-duplex over a single optical fibre or I could use a two optical fibres for Rx and Tx. Still new to optical data transmission and am just curious to know if there are better ways.&lt;/p&gt;&#xA;" OwnerUserId="17301" LastActivityDate="2015-08-19T15:07:32.667" Title="Optical data transmission" Tags="|optical|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20682" PostTypeId="2" ParentId="20678" CreationDate="2015-08-17T15:36:10.513" Score="12" Body="&lt;p&gt;What happens at the time-out is actually pretty clear from the drawing... The congestion window size drops back to its original value of 1 and slow start is run again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specifics of how a TCP stack will handle congestion events depend on what variant you are using. This drawing looks like an example of the &lt;strong&gt;&lt;em&gt;TCP Reno&lt;/em&gt;&lt;/strong&gt; algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When seeing 3 duplicate ACKs, TCP Reno concludes there is congestion, but the network is still working since some segments were ack-ed. In case of a time-out, the situation is worse: the network seems completely unresponsive. Actually, the fact that duplicate acks are being received before a retransmit timer expires means segments are still being received by the other side, even though some may have been lost (or re-ordered). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in case of the 3 duplicate acks, the congestion window is cut in half and then increased linearly. This is known as &lt;em&gt;fast recovery&lt;/em&gt;, and its goal is actually to avoid waiting for retransmission timeouts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a retransmit time-out does occur, the reaction is more drastic. TCP Reno starts over with slow start from a congestion window of size 1, and a slow start threshold of half of the value of the congestion window when the time-out occurred. When the threshold is reached, increase becomes linear again (additive increase).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;TCP Tahoe&lt;/em&gt;&lt;/strong&gt; did not include fast recovery, and would react the same way in both cases, resetting the congestion window to its initial value and executing slow start. TCP Reno's fast recovery basically skips the slow start, immediately setting the congestion window to the threshold value and starting the linear increase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that many more variants exist and actual implemantations can be more complex. Also observing these algorithms at work is not easy because other TCP mechanisms can interfere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know whether what you had in mind (using fast recovery in both situations) exists as a known and implemented congestion avoidance algorithm. It was probably tested and discarded when Reno was implemented. Feel free to do some digging around in the scientific papers in this area.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-08-17T15:36:10.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20683" PostTypeId="1" CreationDate="2015-08-17T16:04:34.687" Score="1" ViewCount="7021" Body="&lt;p&gt;We have 8-wired ethernet cable in the wall and wall socket for two ethernet cables. I am facing the decision how to connect the wires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know about two basic possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I can use the cable as Gigabit ethernet and use it with only one PC.&#xA;The other connector in the wall wouldn't be usable.&lt;/li&gt;&#xA;&lt;li&gt;I can use first 4 wires as one 100 megabit ethernet connection and use the other 4 wires as second 100 megabit connection.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My question is: Can I somehow achieve the combination of both possibilities?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't want to decide right now what setup I need; I would like to decide each time I plug computers to the wall which setup is better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suggested partial solution:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All eight wires will be one gigabit connection, but 4 of them will be also connected to the second half of socket.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am the only user. And I will remember that in order to connect two computers with 100Mbit connection I need to plug the computers to the wall with only 4 wired cables. This will ensure that one computer won't receive signal from the other computer on unused wires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I would like not to do the same on the other side of cables. Hence I would like to have two 100Mbit connection, each using 4 wires, but the ethernet cable in the router from one connection will have nonsense on the unused wires. Is this going to work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might depend on the order of confusingly connected wires. Can you suggest correct wiring?&lt;/p&gt;&#xA;" OwnerUserId="17303" LastEditorUserId="8499" LastEditDate="2018-03-21T00:28:40.747" LastActivityDate="2018-03-21T00:28:40.747" Title="Ethernet cable used two ways" Tags="|ethernet|layer1|cable|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20687" PostTypeId="2" ParentId="20683" CreationDate="2015-08-17T17:15:49.083" Score="1" Body="&lt;p&gt;The ethernet UTP cabling standard defines that a single UTP cable (for a single connection) use four pairs (8 wires).  If you have an 8-wire cable, you have a single UTP ethernet connection.  Anything else is non-standard.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-08-17T19:32:21.083" LastActivityDate="2015-08-17T19:32:21.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20688" PostTypeId="2" ParentId="13357" CreationDate="2015-08-17T19:21:49.350" Score="0" Body="&lt;p&gt;This is not necessarily a network issue.  If the new facility has other resource starvation (memory, processor availability, etc.) and the NICs are virtual, the packets could be dropped.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can test if it's actually networking issue or processing issue by bringing up echo server and trying to saturate it with nc (under linux) sending random traffic to the port in increasingly large amounts.  See if you get a throughput higher than your client.  Then you might be dealing with a server which can't cope with the processing load. (might!!!)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's still potentially a networking issue even if the saturation test doesn't produce the same packet loss, but, at least, if you'll produce more realistic simulation of networking traffic then just pings.&lt;/p&gt;&#xA;" OwnerUserId="17307" LastActivityDate="2015-08-17T19:21:49.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20689" PostTypeId="2" ParentId="20683" CreationDate="2015-08-17T19:29:44.347" Score="6" Body="&lt;p&gt;My suggestion would be to wire the socket as a single connection and then if you later decide to use it as two cables, just use a splitter (a little piece of cable with one plug and two sockets) at both ends. Just make sure to get a splitter for Ethernet (which connects two pairs to one socket and two to another) and not ISDN (which just connects both sockets in parallel).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connecting the wires to two sockets in parallel may cause signal problems for the gigabit connection and you (or someone else) will forget to use it correctly at least once and plug one end of the cable as a single connection while connecting two computers at the other end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upd.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internal wiring of ethernet splitter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BTQQc.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BTQQc.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Splitter &lt;a href=&quot;http://www.primuscable.com/store/p/1289-Ethernet-Splitter-for-Voice-Over-IP-10/100-BaseT-1P/2J-08.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;kind 1&lt;/a&gt;, &lt;a href=&quot;https://utcc.utoronto.ca/~cks/space/blog/tech/EthernetSplitterPicture&quot; rel=&quot;nofollow noreferrer&quot;&gt;kind 2 useful for patchpanel&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17309" LastEditorUserId="7539" LastEditDate="2016-08-19T00:10:59.457" LastActivityDate="2016-08-19T00:10:59.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20690" PostTypeId="2" ParentId="20683" CreationDate="2015-08-17T19:31:56.417" Score="2" Body="&lt;p&gt;One cable for one connection is the correct way to go. Two 100 Mbps connections on one UTP wire might work under some circumstances, but it might as well cause all kinds of weird problems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the cable run is straight and not too long, you could try to use the existing wire to pull through a pair of cables and use both sockets. Careful, this could also go wrong and you could end up with no working cable at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to connect multiple devices, the best option might be to wire one socket and then set up an ethernet switch to provide multiple ports.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-08-17T19:31:56.417" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20691" PostTypeId="2" ParentId="20681" CreationDate="2015-08-17T21:03:08.720" Score="1" Body="&lt;p&gt;I think the easiest way is going to depend on the capabilities of your switches. If they have &lt;a href=&quot;https://en.wikipedia.org/wiki/Small_form-factor_pluggable_transceiver&quot; rel=&quot;nofollow&quot;&gt;SFP&lt;/a&gt; ports then the easiest way would be to install the correct fiber module and connect the new fiber port in your switch to your existing fiber with a patch cable (pay close attention to connectors). &#xA;If your switches are void of such technology and you don't have the budget to procure new ones then you are relegated to media converters. (Keep in mind, media converters are a stop gap measure.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Single fiber optics I believe are not very prevalent, so sticking with your desire for easy I would not pursue them unless you are low on available fiber and desire to preserve what is left.&lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-08-17T21:03:08.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20692" PostTypeId="1" CreationDate="2015-08-17T23:05:49.397" Score="2" ViewCount="125877" Body="&lt;p&gt;I can not use &lt;code&gt;ping 'target' source 'interface'&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping 192.168.0.2 source lo0&#xA;&#xA;% Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's possible if I use &quot;ping&quot; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#ping&#xA;Protocol [ip]: ip&#xA;Target IP address: 192.168.0.2&#xA;Repeat count [5]: &#xA;Datagram size [100]: &#xA;Timeout in seconds [2]: &#xA;Extended commands [n]: y&#xA;Source address or interface: loopback0&#xA;Type of service [0]: &#xA;Set DF bit in IP header? [no]: &#xA;Validate reply data? [no]: &#xA;Data pattern [0xABCD]: &#xA;Loose, Strict, Record, Timestamp, Verbose[none]: &#xA;Sweep range of sizes [n]: &#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.168.0.2, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.168.1.1&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 2/25/59 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's time consuming! I'd like to use the &quot;shortcut command&quot; but I can't! Any suggestion?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Topology, for curious&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MsyDq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MsyDq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying ping 192.168.0.2 (R2) source 192.168.1.1 (Loopback0)&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="8499" LastEditDate="2018-12-21T05:28:10.320" LastActivityDate="2020-06-09T13:24:32.160" Title="How Can I use &quot;ping command&quot; with source?" Tags="|cisco|ping|icmp|" AnswerCount="6" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="20693" PostTypeId="2" ParentId="20692" CreationDate="2015-08-17T23:36:14.337" Score="0" Body="&lt;p&gt;Source address or interface  is a partial output of the extended ping command. The interface cannot be written as lo0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at this page&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13730-ext-ping-trace.html&quot; rel=&quot;nofollow&quot;&gt;Using the Extended ping and Extended traceroute Commands&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16977" LastActivityDate="2015-08-17T23:36:14.337" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20694" PostTypeId="2" ParentId="20681" CreationDate="2015-08-18T01:25:46.487" Score="1" Body="&lt;p&gt;You may find that a pair of gigabit switches with SFP slots is, in fact, cheaper (or the same price, or nearly) as a pair of media converters. Media converters tend to be overpriced, as the majority of fiber installations don't use any, so they are relatively low-volume as compared to switches with SFP slots and copper ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While the default logic has long been pushing multi-mode for &quot;relatively short links&quot; 400m is a fairly long multi-mode link, especially if you might ever upgrade to 10GbE. It may be long enough that you will find (as I did in 2010) that single-mode fiber is actually cheaper by enough to pay for slightly higher priced SFPs. At that time single-mode cable was about half the cost of OM3/4, and SFPs were about 35% more expensive for single-mode (new - used is different, see below.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, if installing fiber you don't want to get locked into BX/singlefiber SFPs - 12 fiber cable is barely more expensive than 1 fiber cable (at least it is if you are shopping the right vendors) as the cable itself costs a good deal more than the fiber in it. You'll never be sad to have 10 &quot;extra&quot; fibers later on, either. BX (WDM) SFPs are for when you have limited fibers and you want to get more data on the same fiber without installing any more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are willing to shop used items, single-mode SFPs that do gigabit ethernet quite happily but were made to do (now horribly outmoded) 4 Gb fiberchannel are available used for dirt cheap. So are Gigabit SFP switches. If not willing to shop used, prices are a bit stiffer.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-08-18T01:25:46.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20695" PostTypeId="1" AcceptedAnswerId="20700" CreationDate="2015-08-18T02:09:37.467" Score="6" ViewCount="1441" Body="&lt;p&gt;in one of the CCNA courses theres the following image taken from a routing table:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/x0xJF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x0xJF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not very confident with my subnetting skills, so please confirm if I'm wrong: &lt;code&gt;172&lt;/code&gt; is a class B network (&lt;code&gt;/16&lt;/code&gt;). So that means &lt;code&gt;172.16.0.0/24&lt;/code&gt; is already subnetted, since clearly &lt;code&gt;/24&lt;/code&gt; is greater than &lt;code&gt;/16&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now in the image it says &lt;code&gt;172.16.0.0/24&lt;/code&gt; has two subnets: &lt;code&gt;172.16.1.0&lt;/code&gt; and &lt;code&gt;172.16.2.0&lt;/code&gt;. But to me that seems weird, because when you subnet, the subnets have to be a &lt;strong&gt;subnet&lt;/strong&gt;work of the original network, right? But clearly &lt;code&gt;172.16.1.0&lt;/code&gt; and &lt;code&gt;172.16.2.0&lt;/code&gt; isn't in &lt;code&gt;172.16.0.0/24&lt;/code&gt; since the range would be &lt;code&gt;172.16.0.0 - 172.16.0.255&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So did I spot a mistake? Or am I confused about subnetting?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, one thing I don't understand is how the router knows the original network (in this case 172.16.0.0/24) when only the subnets are given. How does it figure this out?&lt;/p&gt;&#xA;" OwnerUserId="13978" LastEditorUserId="13978" LastEditDate="2017-05-21T22:18:13.987" LastActivityDate="2017-05-21T22:18:13.987" Title="subnetting is incorrect in show ip route output" Tags="|subnet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20697" PostTypeId="5" CreationDate="2015-08-18T02:56:53.100" Score="0" Body="" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-08-18T02:56:53.100" LastActivityDate="2015-08-18T02:56:53.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20698" PostTypeId="4" CreationDate="2015-08-18T02:56:53.100" Score="0" Body="One of the three layers of network design. The main characteristics of the network core are that is should be highly redundant and high performance. As such, it is often one of the simpler layers in that it should not implement any services that impact performance. No user/server connections should be made to a pure network core." OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-08-18T02:56:53.100" LastActivityDate="2015-08-18T02:56:53.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20699" PostTypeId="2" ParentId="20692" CreationDate="2015-08-18T03:32:12.833" Score="3" Body="&lt;p&gt;Packet Tracer does not provide access to IOS. It provides access to an IOS-like environment that has a limited subset of IOS features/commands, mainly tailored to learn CCNA level concepts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, it doesn't surprise me that you do not have this option on the command line. &lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-08-19T03:32:46.870" LastActivityDate="2015-08-19T03:32:46.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20700" PostTypeId="2" ParentId="20695" CreationDate="2015-08-18T05:49:47.750" Score="6" Body="&lt;p&gt;Your &quot;question&quot; is actually a series of questions. For future reference, try to avoid this. :-) However, this question is a good one, and I think is an easy enough mistake to make by newcomers to the field, so I'll do my best to answer. Truth be told, your source of confusion has nothing to do with subnetting and everything to do with the &lt;code&gt;show ip route&lt;/code&gt; output itself (and understandably so).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;172 is a class B network (/16). So that means 172.16.0.0/24 is already subnetted, since clearly /24 is greater than /16.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First things first - classful addressing and routing has been dead a long time. I understand that it's still part of networking curriculums though, so do yourself a favor and forget everything classful as soon as you're done with your coursework. IMO, still forcing people to learn about these topics only serves to confuse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, the prefix length (subnet mask) has nothing to do with the class of the address. See &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6491/confusing-a-b-c-network-classes/6502#6502&quot;&gt;this answer&lt;/a&gt; for more information on how classful addressing actually works (and for a hint at the answer to your very last question).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now in the image it says 172.16.0.0/24 has two subnets: 172.16.1.0 and 172.16.2.0. But to me that seems weird, because when you subnet, the subnets have to be a subnetwork of the original network, right? But clearly 172.16.1.0 and 172.16.2.0 isn't in 172.16.0.0/24 since the range would be 172.16.0.0 - 172.16.0.255.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Like I said before, this has nothing to do with subnetting and everything to do with the structure of the output of &lt;code&gt;show ip route&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Way back when, when IOS first came around, there was classful addressing and routing, as you're being taught currently. The structure of the routing table back then was designed with classful routing in mind, and was hierarchical and had (and still has) many levels. When classless addressing and routing came around, the hierarchical structure of the routing table &lt;em&gt;still worked&lt;/em&gt;, so it really hasn't changed much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately the real answer lies in a textbook (one of my favorites) called &lt;em&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0201604736&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IP Routing&lt;/a&gt;&lt;/em&gt; by Alex Zinin. Quote below, emphasis mine:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The subnet mask displayed with the parent network route is not the real subnet mask stored in the route entry but rather is the mask used for all subnets in the network. &lt;strong&gt;&lt;em&gt;The subnet mask is not shown for each subnet only when all child routes have the same mask; that is, VLSM is not used.&lt;/em&gt;&lt;/strong&gt; If more than one subnet mask is used in a major network, each subnet route is augmented with a specific route mask, and the major network is shown with the classful mask.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So in other words, &lt;code&gt;show ip route&lt;/code&gt; output can be somewhat misleading given the right circumstances. Relating back to your output, the &lt;strong&gt;major network boundary&lt;/strong&gt; or &lt;strong&gt;classful boundary&lt;/strong&gt; for the 172.16.1.0/24 subnet is 172.16.0.0. Since all of your subnets of 172.16.0.0 have a /24 length, the &lt;code&gt;show ip route&lt;/code&gt; output is really just telling you that it knows about the 172.16.0.0 classful network, and &lt;strong&gt;all&lt;/strong&gt; of the subnetworks that it knows about for this major network have the &lt;strong&gt;same&lt;/strong&gt; length, and that is /24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try adding a network to the routing table that's part of 172.16.0.0 and which has a &quot;non-classful&quot; length, such as a /27 or /25. What happens?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, one thing I don't understand is how the router knows the original network (in this case 172.16.0.0/24) when only the subnets are given. How does it figure this out?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Again, I'll urge you to read the previous answer which I'd linked, if this isn't already clear at this point. :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: To answer some further questions OP has in comments:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm confused about excercise 1 on 9tut.com/subnetting-tutorial/2. When I subnet I'm used to be given a network address like 4.0.0.0/24 and I would borrow host bits to create subnets. But in excercise 1 they figure out the major network boundary 4.0.0.0/8 and assume that all other class A networks are subnets to that major network boundary. Can you confirm this is correct? It confuses me because you told me that the classful boundary is rarely used these days, so I get the idea that this might be an old/obsolete way to think about subnetting.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It basically &lt;strong&gt;is&lt;/strong&gt; an old way to look at subnetting. Determining the class of address is not needed to determine the number of subnets and hosts per subnet available. The question is worded poorly, and in the real world no one is going to be &quot;assigned&quot; an arbitrary prefix without a length attached to it, ie 4.0.0.0. You could easily find a different answer given the parameters of a /24 prefix length to be used for subnetting if they had given you any prefix length that was shorter than a /24, it doesn't necessarily have to be /8. It's likely that the exercise was worded in such a way to force the reader to remember the classes of addresses in order to answer it correctly.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To make my question a bit clearer, I'm going to give an example. Take a look back at the picture in my original question. The IP routing table says that 172.16.0.0/24 is subnetted and has 2 subnets. It seems the IP routing table also treats 172.16.1.0/24 and 172.16.2.0/24 as subnets because they are in the range of the major classful network 172.16.0.0/16 (i.e. 172.16.0.0 - 172.16.255.255). So this is probably how the routing table looks at subnets, correct?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. Again, the internal structure of the routing table really hasn't changed since the days of classful routing. Anything that's viewed as a subnet of a classful network is going to be viewed as a subnet by the router.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;One last thing: if I subnet a network address, I can always get this network back by supernetting the subnets, correct? This is then the answer to my last question my original post.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, it isn't. Determining your major network or classful network boundary has nothing to do with subnetting or supernetting. It really isn't complicated.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Step One: Determine the class of the address&lt;/li&gt;&#xA;&lt;li&gt;Step Two: Determine the classful network boundary by using the natural mask of the classful address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here's three examples of IP addresses with varying mask lengths:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;115.65.6.18/20&lt;/li&gt;&#xA;&lt;li&gt;200.200.200.200/27&lt;/li&gt;&#xA;&lt;li&gt;188.154.17.8/15&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For #1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address is Class A because the first octet is 115, and this falls within the range of numbers that have a leading bit of &lt;code&gt;0&lt;/code&gt; (0 to 127). The natural mask for Class A networks is 255.0.0.0. So the classful network boundary is 115.0.0.0/8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For #2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address is Class C because the first octet is 200, and this falls within the range of numbers that have leading bits of &lt;code&gt;110&lt;/code&gt; (192 to 223). The natural mask for Class C networks is 255.255.255.0. So the classful network boundary is 200.200.200.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For #3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The address is Class B because the first octet is 188, and this falls within the range of numbers that have leading bits of &lt;code&gt;10&lt;/code&gt; (128 to 191). The natural mask for Class B networks is 255.255.0.0. So the classful network boundary is 188.154.0.0/16.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how the router is able to determine the classful network boundary of any subnet.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-08-19T18:42:21.377" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="20701" PostTypeId="1" AcceptedAnswerId="20703" CreationDate="2015-08-18T07:10:58.930" Score="1" ViewCount="5759" Body="&lt;p&gt;I have a pool of public IP addresses of 203.82.x.x/28 which is running with PAT/Overload with a private IP subnet of 172.22.x.x on a Cisco 2900 series router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The radio modem Ethernet link connects to the router interface with a public IP address, and the LAN connects to another interface of the router with a private IP address; a simple configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I can split the connection from the radio modem, and put it directly into my LAN switch, using the public network with my LAN hosts. It works fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder, how do I bypass the NAT configuration so that I can just change LAN hosts IP addresses to public IP addresses and access the Internet directly, without splitting the connection from the radio modem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please correct me If I am thinking wrong. &lt;/p&gt;&#xA;" OwnerUserId="17316" LastEditorUserId="8499" LastEditDate="2016-03-03T01:59:08.243" LastActivityDate="2016-03-03T01:59:08.243" Title="How to bypass NAT for LAN to use Public IP addressess?" Tags="|cisco|nat|ip|internet|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20702" PostTypeId="1" AcceptedAnswerId="20704" CreationDate="2015-08-18T10:26:11.123" Score="1" ViewCount="579" Body="&lt;p&gt;All my computers (+ NAS, etc) are connected to a gigabit switch and they all have gigabit ethernet controllers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch is connected to a Cisco RV110W router (10/100) which also serves as DHCP server, firewall and gateway to internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I switch to a gigabit Cisco RV130W router will I see an increase in transfer speeds between computers?&lt;/p&gt;&#xA;" OwnerUserId="17321" LastActivityDate="2015-08-18T11:21:09.070" Title="Switch speed and Router speed" Tags="|switch|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20703" PostTypeId="2" ParentId="20701" CreationDate="2015-08-18T10:33:31.213" Score="2" Body="&lt;p&gt;I am not sure if this is recommended but yes you can achieve it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason you needed NAT there as you cant assign same subnet's IP on R2's access facing LAN interface, if you could , then you could use the same subnet , right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.1/24   .2/24&lt;br&gt;&#xA;R1(PE -ISP)  ------&gt; R2 (CE) -----&gt; R3 (access- internal)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you can achieve it by BVI, config is as below, its simple&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bridge irb&#xA;bridge 1 protocol vlan-bridge&#xA;bridge 1 route ip&#xA;&#xA;&#xA;&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; bridge-group 1&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; bridge-group 1&#xA;&#xA;&#xA;interface BVI1&#xA; ip address 192.168.1.2 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you can change the IP address and interface as per your scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if any question/issue or how it goes.&#xA;Sorry, if i misunderstood your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;Lalit&lt;/p&gt;&#xA;" OwnerUserId="17320" LastEditorUserId="2142" LastEditDate="2015-08-18T16:04:58.930" LastActivityDate="2015-08-18T16:04:58.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20704" PostTypeId="2" ParentId="20702" CreationDate="2015-08-18T11:21:09.070" Score="3" Body="&lt;p&gt;No. When you are transferring data between computers on your local LAN that data is only traversing the gig E switch you speak of and doesn't touch the router. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-08-18T11:21:09.070" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20705" PostTypeId="1" CreationDate="2015-08-18T12:27:43.647" Score="0" ViewCount="411" Body="&lt;p&gt;I would like to know which type of antenna can be used with WiMAX devices to have excellent connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess I have very normal one installed manufactured by ZTE.&lt;/p&gt;&#xA;" OwnerUserId="17323" LastActivityDate="2015-08-23T12:33:46.830" Title="Supported antenna for WiMax device" Tags="|wireless|" AnswerCount="1" CommentCount="1" ClosedDate="2015-08-18T12:47:13.793" ContentLicense="CC BY-SA 3.0" />
  <row Id="20706" PostTypeId="2" ParentId="20705" CreationDate="2015-08-18T12:44:57.503" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8cjS2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8cjS2.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WiMAX antennas, just like the antennas for car radio, cell phone, FM radio, or TV, are designed to optimize performance for a given application. The figure above illustrates the three main types of antennas used in WiMAX deployments. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Omni directional antennas&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are used for point-to-multipoint configurations. The main drawback to an omni directional antenna is that its energy is greatly diffused in broadcasting 360 degrees. This limits its range and ultimately signal strength. Omni directional antennas are good for situations where there are a lot of subscribers located very close to the base station. An example of omni directional application is a WiFi hotspot where the range is less than 100 meters and subscribers are concentrated in a small area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Sector Antennas&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sector antenna, by focusing the beam in a more focused area, offers greater range and throughput with less energy. Many operators will use sector  antennas to cover a 360-degree service area rather than use an omni directional antenna due to the superior per-formance of sector antennas over an omni directional antenna.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Panel Antennas&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Panel antennas are usually a flat panel of about one foot square. They can also be a configuration where potentially the WiMAX radio is contained in the square antenna enclosure. Such configurations are powered via the Ethernet cable that connects the ra-dio/antenna combination to the wider network. That power source is known as Power over Ethernet (PoE). This streamlines deployments as there is no need to house the radio in a separate, weatherproof enclosure if outdoors or in a wiring closet if indoors. This configuration can also be very handy for relays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For me I found Panel antenna is the most powerfull one If you know exaclty where is your Wimax bridge&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The distance between My bridge and my Wimax antenna around 8 KM and works perfect with me&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Pv8d6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Pv8d6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.teletopix.org/wimax/which-types-of-antennas-used-in-wimax/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Resources&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15229" LastEditorUserId="15229" LastEditDate="2015-08-23T12:33:46.830" LastActivityDate="2015-08-23T12:33:46.830" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20707" PostTypeId="1" CreationDate="2015-08-18T13:32:45.333" Score="1" ViewCount="1649" Body="&lt;p&gt;I have an interface that is added as a directly connected route in my routing table. (FLAG is only U)&#xA;How can I remove this route from the routing table.&#xA;route del doesn't appear to affect directly connected routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;env is Linux, Ubuntu Server 14.04, The interface is a normal LAN connection.&lt;/p&gt;&#xA;" OwnerUserId="17324" LastActivityDate="2016-11-19T08:07:41.490" Title="Removing directly connected route from routing table in Linux" Tags="|routing|lan|linux|" AnswerCount="2" CommentCount="1" ClosedDate="2017-08-12T04:36:56.443" ContentLicense="CC BY-SA 3.0" />
  <row Id="20708" PostTypeId="2" ParentId="20692" CreationDate="2015-08-18T14:04:18.477" Score="0" Body="&lt;p&gt;Instead of supplying the exit interface, use the source IP address instead.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping 192.168.1.1 source 10.15.2.1 repeat 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This should do what you want.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2015-08-18T14:04:18.477" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20709" PostTypeId="2" ParentId="20707" CreationDate="2015-08-18T14:06:23.620" Score="2" Body="&lt;p&gt;Shut down the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sudo ip link set ethX down&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: If you still wish to receive packets on the interface, then you'll need to remove the IP address configuration of the interface from &lt;code&gt;/etc/network/interfaces&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="9963" LastEditDate="2016-11-19T08:07:41.490" LastActivityDate="2016-11-19T08:07:41.490" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20717" PostTypeId="2" ParentId="20575" CreationDate="2015-08-18T18:00:16.120" Score="1" Body="&lt;p&gt;With two default routes you can achieve redundancy but other routers in your network will just follow the default route to the closest core router so load balancing might not be according to your needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easy solution is to just have full table everywhere but if some routers aren't up for it (limited TCAM or similar) you might need to opt for using a default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure that your core routers have a direct link between each other and exchange the full table over the iBGP session between them. If both core routers inject a default route but one loses its ISP link it needs to see the routes from the other core router so it still have valid paths to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With full tables like this you can also fine-tune the local-preference/MED/whatever of routes you receive from respective ISP to achieve more even load balancing. Do note how your other routers will still follow the default so traffic might go via one core router to the next core router and exit to your ISP. Full table avoids that.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-08-18T18:00:16.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20718" PostTypeId="1" CreationDate="2015-08-18T18:25:56.627" Score="4" ViewCount="1833" Body="&lt;p&gt;I have an 802.3ad port channel comprised of 2 10GigE links from a Force10 E1200 switch to a Linux server with one dual-ported 10G NIC.  This setup works great when Linux speaks LACP and brings up a bonded interface.  However, when the PXE option ROM in the Linux NICs runs, before Linux is in play, it doesn't work.  That is, as I have things configured, the PXE option ROM isn't able to send or receive any packets on the expected native VLAN, when the switch ports are both set to port channel mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'd like is a way for the Force10 switch port to fall back to a normal switchport, when LACP hasn't established a portchannel, so that PXE will still work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this?  Hopefully with just some additional switch config?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware of work-arounds for this like PXE-booting off a different non-portchannel interface, etc.  I'm really constrained by the hardware I have and looking for a solution that involves only the switch I have, along with the two 10G NIC ports.  Further, I'm aware of other Linux bonding types that don't require a port channel on the switch side (e.g., balance-rr, active-backup).  I've tested these, and they do work both in Linux and with PXE, but what I'm really after is the single 20Gb/s link and a port channel on the switch side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Force10 switch is configured like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface TenGigabitEthernet 7/32&#xA; no ip address&#xA;!  &#xA; port-channel-protocol LACP &#xA;  port-channel 99 mode active &#xA; no shutdown&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface TenGigabitEthernet 8/32&#xA; no ip address&#xA;!  &#xA; port-channel-protocol LACP &#xA;  port-channel 99 mode active &#xA; no shutdown&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;#show int switch Po99&#xA;&#xA;Codes:  U - Untagged, T - Tagged&#xA;        x - Dot1x untagged, X - Dot1x tagged&#xA;        G - GVRP tagged, M - Trunk&#xA;&#xA;Name: Port-channel 99&#xA;...&#xA;802.1QTagged: Hybrid&#xA;Vlan membership:&#xA;Q       Vlans&#xA;U       123&#xA;&#xA;Native VlanId:    123.&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Linux server has:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;# cat /etc/sysconfig/network-scripts/ifcfg-bond0 &#xA;DEVICE=bond0&#xA;NAME=bond0&#xA;TYPE=Bond&#xA;BONDING_MASTER=yes&#xA;IPADDR=...&#xA;GATEWAY=...&#xA;PREFIX=...&#xA;ONBOOT=yes&#xA;BOOTPROTO=none&#xA;BONDING_OPTS=&quot;mode=802.3ad miimon=100&quot;&#xA;DNS1=A.B.C.D&#xA;DOMAIN=bar.com foo.bar.com&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;# cat /etc/sysconfig/network-scripts/ifcfg-enp6s0f0 &#xA;TYPE=Ethernet&#xA;BOOTPROTO=none&#xA;DEVICE=enp6s0f0&#xA;NAME=enp6s0f0&#xA;ONBOOT=yes&#xA;MASTER=bond0&#xA;SLAVE=yes&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;# cat /etc/sysconfig/network-scripts/ifcfg-enp6s0f1&#xA;TYPE=Ethernet&#xA;BOOTPROTO=none&#xA;DEVICE=enp6s0f1&#xA;NAME=enp6s0f1&#xA;ONBOOT=yes&#xA;MASTER=bond0&#xA;SLAVE=yes&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="17332" LastActivityDate="2017-11-15T09:39:03.380" Title="Force10 port channel to server that also supports PXE boot" Tags="|linux|ieee-802.1ax|force10|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20719" PostTypeId="2" ParentId="18384" CreationDate="2015-08-18T20:25:55.850" Score="2" Body="&lt;p&gt;Assuming this is an Ethernet link a loopback test would be useless unless you could also send some frames over the link. Unlike POS, frames are only sent when there is traffic to send and you won't see CRC errors if you don't have any frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are devices supporting BERT (bit error rate test) so you can put a loopback fibre and run a test to determine if the optical module and framer is working correctly but it's not common on classic Ethernet switches.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-08-18T20:25:55.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20721" PostTypeId="1" CreationDate="2015-08-19T00:29:53.280" Score="1" ViewCount="99" Body="&lt;h2&gt;Background&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I plan to build a Network Intrusion Detection System, (using a dual-homed desktop pc running Debian and Snort) that will sit between my ISP's router (home LAN) and an additional router (security LAN), for the purpose of learning more about network security)&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;My Question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Are there any special considerations I should make for the network hardware used in the desktop? Will using a desktop without a special NIC introduce lag? Should I opt for a special dual homed NIC or will two standard NIC's work well enough?&lt;/p&gt;&#xA;" OwnerUserId="17337" LastEditorUserId="619" LastEditDate="2015-08-19T02:26:24.170" LastActivityDate="2016-02-15T22:51:09.647" Title="Building an IDS (Special considerations for speed)" Tags="|speed|intrusion-prevention|" AnswerCount="2" CommentCount="3" ClosedDate="2019-03-25T00:24:51.227" ContentLicense="CC BY-SA 3.0" />
  <row Id="20722" PostTypeId="2" ParentId="20721" CreationDate="2015-08-19T02:34:16.253" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Are there any special considerations I should make for the network hardware used in the desktop?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not at the speeds common to &quot;home users&quot;. You may be surprised by the hardware inside many &quot;big iron&quot; routers. (hint: they use the same NIC hardware found in everything.) What makes them &quot;fast&quot; is the routing and switching hardware. And that's present in a small percentage devices.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Should I opt for a special dual homed NIC...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Multi-&lt;em&gt;port&lt;/em&gt; NICs just reduce the number of slots being used. Use what you have, or get what ever your budget allows.  Keep in mind the bus speed of the card(s) if using multi-port cards. (i.e. PCIe x1 is 2.5G)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-08-19T02:34:16.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20723" PostTypeId="1" CreationDate="2015-08-19T04:49:49.920" Score="1" ViewCount="162" Body="&lt;p&gt;i have two gateways for single route &#xA;Ex.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;destination 172.20.100.4  gateways 10.22.0.9 and 10.192.168.18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to add both routes in my route add if one is fail traffic goes automatically from other source. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route add 172.20.100.4 mask 255.255.255.255 10.22.0.9 &#xA;route add 172.20.100.4 mask 255.255.255.255 10.192.168.18 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what metric do I install for both routes and both IP addresses for single Ethernet..&lt;/p&gt;&#xA;" OwnerUserId="17341" LastEditorUserId="17358" LastEditDate="2015-08-19T20:28:07.787" LastActivityDate="2021-01-26T07:37:40.623" Title="i have two gateways for destination for single route" Tags="|routing|ethernet|redundancy|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20724" PostTypeId="1" AcceptedAnswerId="20725" CreationDate="2015-08-19T04:50:17.130" Score="1" ViewCount="445" Body="&lt;p&gt;I am new networking, I want my branch network connect to my HQ.&#xA;I don't want to lease line from ISP because my business just start small.&#xA;My question is can I use VPN or OSPF to connect from branch to HQ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="17342" LastActivityDate="2015-08-19T05:08:25.413" Title="OSPF vs VPN site to site" Tags="|cisco|cisco-asa|vpn|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20725" PostTypeId="2" ParentId="20724" CreationDate="2015-08-19T05:08:25.413" Score="2" Body="&lt;p&gt;Sounds like you need a VPN Site-to-Site tunnel to accomodate your needs. That would let you connect your branch office to your HQ &quot;securely&quot; over the Internet ofcourse depending on which encryption you use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at this white paper from Cisco:&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd8029d629_ps6635_Products_White_Paper.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/technologies/tk583/tk372/technologies_white_paper0900aecd8029d629_ps6635_Products_White_Paper.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding OSPF, that is a routing protocol which won't help you directly to connect the two sites. Although it can be used for routing to connect the two offices through the VPN tunnel like RIP is used in the white paper.&lt;/p&gt;&#xA;" OwnerUserId="14973" LastActivityDate="2015-08-19T05:08:25.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20726" PostTypeId="1" CreationDate="2015-08-19T06:02:15.863" Score="1" ViewCount="280" Body="&lt;p&gt;I configured a Juniper SRX firewall to receive IPv6 prefix from upstream router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        family inet6 {&#xA;            dhcpv6-client {&#xA;                client-type statefull;&#xA;                client-ia-type ia-pd;&#xA;                update-router-advertisement {&#xA;                    interface vlan.20;&#xA;                    interface vlan.30;&#xA;                    interface vlan.40;&#xA;                }&#xA;                client-identifier duid-type duid-ll;&#xA;                req-option dns-server;&#xA;                req-option domain;&#xA;            }&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Received IPv6 prefix is a /56 address pool&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Client IP Prefix:             xxxx:xxxx:xxxx:x000::/56&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For &lt;code&gt;vlan.20&lt;/code&gt;. &lt;code&gt;vlan.30&lt;/code&gt; and &lt;code&gt;vlan.40&lt;/code&gt;, I need to further subnet the received prefix to /64. Is there anyway to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW: In Cisco equipment, the above task can be done with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 address prefix-from-provider 0:0:0:01::/64 eui-64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;at interface configuration.&lt;/p&gt;&#xA;" OwnerUserId="13428" LastActivityDate="2015-08-19T06:02:15.863" Title="Subnet delegated prefix on SRX" Tags="|ipv6|juniper|srx|dhcpv6|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20728" PostTypeId="2" ParentId="20723" CreationDate="2015-08-19T07:08:51.977" Score="2" Body="&lt;p&gt;Firstly, you need some kinda mechanism to track the feasibility status of a route.&#xA;So, you assign higher metric to the backup route, and when the tracking mechanism sense that the route is not active, it will switch to the backup route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cisco IOS, this could be achieved by SLA and Track.&#xA;In JunOS, you have to use IP Monitoring and RPM.&lt;/p&gt;&#xA;" OwnerUserId="17343" LastActivityDate="2015-08-19T07:08:51.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20732" PostTypeId="1" CreationDate="2015-08-19T13:19:10.930" Score="2" ViewCount="3424" Body="&lt;p&gt;I have a SRX 220 cluster running Junos 12.1XD46-D30.2. My ISP provides me with a /27 public IP range. Lets say 80.0.0.64/27&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way this is configured is that they use the first two available IP addresses for a VRRP redundant router setup. These are our default gateway IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured my SRX interface reth0.0 to use the IP address 80.0.0.71/27&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OAMY7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OAMY7.png&quot; alt=&quot;Network overview&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I place a device in a DMZ zone that has the IP address 80.0.0.90?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What have I tried?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Config 1:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;reth0.0 configured as 80.0.0.71/27 in zone untrust&lt;br&gt;&#xA;  reth1.110 configured as 80.0.0.89/30 in zone DMZ&lt;br&gt;&#xA;  SRX has the default gateway of 80.0.0.65&lt;br&gt;&#xA;  server configured as 80.0.0.90/30 with it's gateway as 80.0.0.89&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Tests/Results:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;SRX can ping the server and vice versa&lt;br&gt;&lt;/li&gt;&#xA;  &lt;li&gt;server can't ping the SRX's default gateway 80.0.0.65&lt;br&gt;&lt;/li&gt;&#xA;  &lt;li&gt;When I ping the server (.90) from a remote device I see ARP requests for 80.0.0.90 from our providers gateway 80.0.0.65 but I don't see the SRX sending back any replies&lt;/li&gt;&#xA;  &lt;li&gt;When I ping the SRX reth1.110 (.89) address from a remote device I also see ARP requests from our providers gateway 80.0.0.65. I sdon't see the SRX sending back any replies&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Like this capture of traffic from the reth0.0 interface (via switch port mirror)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;13:03:31.967949 arp who-has 80.0.0.89 tell 80.0.0.65&#xA;13:03:35.612408 arp who-has 80.0.0.90 tell 80.0.0.65&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This shows me clearly that the SRX will not send ARP replies on behalf of it's smaller /30 subnet residing on a different interface (reth1.110) out of it's reth0.0 interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought that this could be a good reason to use the proxy arp settings under security &gt; nat &gt; proxy-arp&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking the routing table shows that my traffic is routed to the correct interface so it isn't that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inet.0: 258 destinations, 267 routes (258 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;80.0.0.88/30     *[Direct/0] 00:44:23&#xA;                  &amp;gt; via reth1.110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Config 2:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;same as config 1 with the following additions&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;set security nat proxy-arp interface reth0.0 address 80.0.0.88/30&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Tests/Results:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;SRX can ping the server and vice versa&lt;br&gt;&lt;/li&gt;&#xA;  &lt;li&gt;server can't ping the SRX's default gateway 80.0.0.65, however I now see ICMP traffic leaving the SRX on the external interface heading for 80.0.0.65. I also see that 80.0.0.65 is just sending ARP requests back which are going unanswered by the SRX.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;13:17:30.182718 IP 80.0.0.90 &amp;gt; 80.0.0.65: ICMP echo request, id 9514, seq 1, length 64&#xA;13:17:30.183316 arp who-has 80.0.0.90 tell 80.0.0.65&#xA;13:17:31.240008 IP 80.0.0.90 &amp;gt; 80.0.0.65: ICMP echo request, id 9514, seq 2, length 64&#xA;13:17:32.240342 IP 80.0.0.90 &amp;gt; 80.0.0.65: ICMP echo request, id 9514, seq 3, length 64&#xA;13:17:32.240990 arp who-has 80.0.0.90 tell 80.0.0.65&#xA;13:17:33.239726 IP 80.0.0.90 &amp;gt; 80.0.0.65: ICMP echo request, id 9514, seq 4, length 64&#xA;13:17:34.239860 IP 80.0.0.90 &amp;gt; 80.0.0.65: ICMP echo request, id 9514, seq 5, length 64&#xA;13:17:34.240758 arp who-has 80.0.0.90 tell 80.0.0.65&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;3&quot;&gt;&#xA;  &lt;li&gt;When I ping the server (.90) from a remote device I see ARP requests for 80.0.0.90 from our providers gateway 80.0.0.65 but I don't see the SRX sending back any replies&lt;/li&gt;&#xA;  &lt;li&gt;When I ping the SRX reth1.110 (.89) address from a remote device I also see ARP requests from our providers gateway 80.0.0.65. I sdon't see the SRX sending back any replies&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It looks like the SRX is still not sending ARP replies on behalf on it's /30 subnet and now my routing table looks a little different which I assume is down to the proxy arp config entry.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inet.0: 258 destinations, 268 routes (258 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;80.0.0.88/30       *[Direct/0] 00:58:45&#xA;                    &amp;gt; via reth1.110&#xA;                    [Static/1] 00:08:33&#xA;                      Receive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Config 3:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this time I changed the proxy arp statement so that it just covered the server IP address&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;set security nat proxy-arp interface reth0.0 address 80.0.0.90/32&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit security nat proxy-arp interface reth0.0 address]&#xA;+      80.0.0.90/32;&#xA;-      80.0.0.88/30;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Tests/Results:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;SRX can &lt;em&gt;NOT&lt;/em&gt; ping the server and vice versa&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# run ping 80.0.0.90&#xA;PING 80.0.0.90 (80.0.0.90): 56 data bytes&#xA;ping: sendto: Can't assign requested address&#xA;ping: sendto: Can't assign requested address&#xA;&#xA;--- 80.0.0.90 ping statistics ---&#xA;2 packets transmitted, 0 packets received, 100% packet loss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;looking at the routing table on the SRX now shows this entry&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inet.0: 259 destinations, 268 routes (259 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;80.0.0.90/32       *[Static/1] 00:00:29&#xA;                      Receive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;3&quot;&gt;&#xA;  &lt;li&gt;When I ping the server (.90) from a remote device I see ARP requests for 80.0.0.90 from our providers gateway 80.0.0.65 and now I see ARP replies&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;13:23:59.327903 arp who-has 80.0.0.90 tell 80.0.0.65&#xA;13:23:59.333994 arp reply 80.0.0.90 is-at 00:00:00:ff:b0:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;4&quot;&gt;&#xA;  &lt;li&gt;When I ping the SRX reth1.110 (.89) address from a remote device I see ARP requests from our providers gateway 80.0.0.65. I don't see the SRX sending back any replies&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now it looks like the SRX is sending ARP replies but can't actually route the traffic to the correct interface due to the proxy arp entry/routing rule.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Interesting if I now revert the convert back to the original because the upstream router has cached our ARP entry for 80.0.0.90 everything works until it times out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will post this now while I wait for the ARP entry to timeout (hopefully not 4 hours!!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Does anyone know what I'm missing?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally this isn't so hard as your ISP gives you a /30 PTP link between them and you and then they just route all traffic down that link leaving you free to do whatever!&lt;/p&gt;&#xA;" OwnerUserId="139" LastActivityDate="2015-08-20T16:41:27.663" Title="SRX - Routed subnet - No NAT" Tags="|juniper-junos|juniper-srx|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20733" PostTypeId="2" ParentId="20718" CreationDate="2015-08-19T13:54:51.490" Score="3" Body="&lt;p&gt;@Matthew you are on the right way. I have faced this exact problem in the past and I have used this command in S4810 devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I suspect this command is not supported in all Force10 Model. I just tested it in S60 and S4810 and it's working. You should check your model/version cli document.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, according to E-Series CLI, this command is not supported. Sorry about that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, a possible workaround would be use a third standadlone interface for PXE provisioning and then use port-channel for normal operations.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2015-08-19T13:54:51.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20734" PostTypeId="1" AcceptedAnswerId="20740" CreationDate="2015-08-19T14:05:09.283" Score="7" ViewCount="2087" Body="&lt;p&gt;&lt;em&gt;Not sure if this is a good stack exchange site to post this on but here goes nothing,&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The problem,&lt;/strong&gt;&#xA;As you can see from my Wireshark screenshot the TCP handshake is not happening. The remote is sending me the SYN message but I'm not responding to SYN/ACK. I can connect just fine with my own socket client and watch the handshake work perfectly, the only difference being I'm not accessing our server through the VPN tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The backstory,&lt;/strong&gt; is we've been tasked with connecting to a remote service &lt;em&gt;(192.168.X.X)&lt;/em&gt; that is essentially a black box to us. Both systems are connected via an IPSec tunnel. Communication is supposed to be done through a TCP socket with our end &lt;em&gt;(172.31.0.5)&lt;/em&gt; implemented in python acting as the server. All we know about their end is that it's running on Windows. Their end is configured with an IP and port, that's it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/0B8Q2EtU9zgjCclRNbjIxUHVYLXM/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wirehsark capture (pcapng)&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/UWKVg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UWKVg.png&quot; alt=&quot;Wireshark output&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Dwzx5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Dwzx5.png&quot; alt=&quot;tcpdump raw capture&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17353" LastEditorUserId="42290" LastEditDate="2017-12-13T11:56:29.970" LastActivityDate="2017-12-13T11:56:29.970" Title="TCP Handshake Not Happening" Tags="|tcp|" AnswerCount="1" CommentCount="7" ClosedDate="2019-01-24T00:13:48.227" ContentLicense="CC BY-SA 3.0" />
  <row Id="20735" PostTypeId="1" CreationDate="2015-08-19T14:42:38.643" Score="7" ViewCount="32697" Body="&lt;p&gt;I have a question regarding TCP timeout. If we look at this picture &lt;a href=&quot;http://www.dcs.bbk.ac.uk/~ptw/teaching/IWT/transport-layer/timeout.gif&quot; rel=&quot;noreferrer&quot;&gt;http://www.dcs.bbk.ac.uk/~ptw/teaching/IWT/transport-layer/timeout.gif&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can see that the timeout starts when the packet loss occur, but how long is the timeout? Is it until the specific packet has been delivered and acknowledged or when?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;To clarify, I'm not asking about any specific time. I'm just asking for what are indicating that a TCP timeout has been finished.&lt;/strong&gt; &lt;/p&gt;&#xA;" OwnerUserId="17134" LastEditorUserId="17134" LastEditDate="2015-08-19T16:36:10.893" LastActivityDate="2020-12-30T11:59:58.770" Title="TCP timeout, how long does it last?" Tags="|tcp|" AnswerCount="5" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20736" PostTypeId="2" ParentId="20589" CreationDate="2015-08-19T14:55:23.950" Score="0" Body="&lt;p&gt;Your original question, for me anyway, doesn't tell me if you are the end user managing a wan or small provider or developing a monitoring product.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;snmp and TR069 are completely unrelated to each other in method, protocols and ports used. Can't compare to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;snmp probe is just that, a node be it a server, or pc on the inside polling all of the desired devices gathering information that it then forwards on to the central collector. In your case that is the cloud server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Snmp can be setup to poll the wan port of the public ip devices but that is up to each device to support. Really only something I would consider if the public ip's are static and I have ACL's protecting what can snmp poll the devices wan ports. Can be done with dynamic dns but but can be problematic if the the device gets handed an updated ip then there is lag until dynamic dns updates. Again the CPE has to support dynamic dns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You asked for links to documentation that more fully explains what your MSO mention. This link includes diagrams and links to the specific RFC's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.snmp.com/protocol/proxyinfo.shtml&quot; rel=&quot;nofollow&quot;&gt;http://www.snmp.com/protocol/proxyinfo.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good Luck.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-08-19T14:55:23.950" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20737" PostTypeId="2" ParentId="20681" CreationDate="2015-08-19T15:07:32.667" Score="2" Body="&lt;p&gt;Second the postings of the other gents. I would avoid media converters for a single run fiber between devices. Another point of failure from the school of hard knocks. Most GigE to fiber converters are generally inexpensive devices that if they go offline on the fiber side can't report the link down unless it supports snmp polling or traps. Of all of the CWDM and DWDM devices I worked with all of the wave lengths for Tx go down one fiber and all of the Rx go down the other. The only time I use single strand fiber is for video transmission gear which is the normal for SDI protocols. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stick with switches that have sfp slots and try and purchase sfp's and switches that support DOM &quot;digital optical monitoring&quot; so you can get power level stats. DOM can be a lifesaver troubleshooting tool. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Media converters are fine if your just going from a copper switch port out to an LED street sign that doesn't get updated often or isn't mission critical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every customer that I have worked with that had media converters eventually pulled them out over troubleshooting lacking information. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fwiw.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-08-19T15:07:32.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20740" PostTypeId="2" ParentId="20734" CreationDate="2015-08-19T15:20:52.493" Score="10" Body="&lt;p&gt;We were able to come to the answer in the &lt;a href=&quot;http://chat.stackexchange.com/rooms/27142/discussion-between-anders-and-ron-trunk&quot;&gt;chat room&lt;/a&gt;.  It appears this is a symptom of StrongSwan itself.  From their &lt;a href=&quot;https://wiki.strongswan.org/projects/strongswan/wiki/FAQ#General-Questions&quot;&gt;FAQ&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Capturing outbound plaintext packets with tcpdump/wireshark&lt;/strong&gt;&lt;BR /&gt;&#xA;  Q: When using tcpdump/wireshark to sniff traffic secured by IPsec, incoming packets show up twice: encrypted i.e. as ESP packets and unencrypted as plaintext packets. However, for outgoing traffic, only ESP packets show up. How can I get incoming and outgoing packets as plaintext?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A: That's a peculiarity of the Linux kernel. Capture the (UDP encapsulated) ESP packets and use wireshark to decrypt them. See &lt;a href=&quot;http://wiki.wireshark.org/ESP_Preferences&quot;&gt;http://wiki.wireshark.org/ESP_Preferences&lt;/a&gt;&#xA;  Run the following command to determine the encryption algorithms and the symmetric keys used by the kernel. Depending on your configuration, strongSwan periodically changes encryption keys. Keep this in mind if you are capturing traffic over an extended period of time.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ip xfrm state&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Its also documented in one of their issues:&lt;BR /&gt;&#xA;&lt;a href=&quot;https://wiki.strongswan.org/issues/470&quot;&gt;https://wiki.strongswan.org/issues/470&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-08-19T15:20:52.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20741" PostTypeId="2" ParentId="20735" CreationDate="2015-08-19T16:03:02.417" Score="3" Body="&lt;p&gt;There is no specific end time for TCP timeout. When it times out the session is dead. It does not &quot;stay dead&quot; for a specific time period.&lt;/p&gt;&#xA;" OwnerUserId="17253" LastActivityDate="2015-08-19T16:03:02.417" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20743" PostTypeId="5" CreationDate="2015-08-19T16:56:58.937" Score="0" Body="&lt;p&gt;Cisco Branch Router product line &lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/branch-routers/&quot; rel=&quot;nofollow&quot;&gt;&quot;Integrated Services Router&quot; (ISR) hardware.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8441" LastEditorUserId="8441" LastEditDate="2015-08-19T20:28:16.300" LastActivityDate="2015-08-19T20:28:16.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20744" PostTypeId="4" CreationDate="2015-08-19T16:56:58.937" Score="0" Body="Questions about Cisco Integrated Services Routers (ISR)." OwnerUserId="8441" LastEditorUserId="8441" LastEditDate="2015-08-19T21:30:40.257" LastActivityDate="2015-08-19T21:30:40.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20745" PostTypeId="5" CreationDate="2015-08-19T17:03:12.587" Score="0" Body="&lt;p&gt;IEEE 802.3x is a standard for &lt;a href=&quot;https://en.wikipedia.org/wiki/Ethernet_flow_control&quot; rel=&quot;nofollow&quot;&gt;Ethernet Flow Control &quot;PAUSE&quot; frames.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8441" LastEditorUserId="8441" LastEditDate="2015-08-19T21:30:22.893" LastActivityDate="2015-08-19T21:30:22.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20746" PostTypeId="4" CreationDate="2015-08-19T17:03:12.587" Score="0" Body="For questions about 802.3x Ethernet Flow Control (PAUSE frames)." OwnerUserId="8441" LastEditorUserId="8499" LastEditDate="2016-11-29T18:07:05.370" LastActivityDate="2016-11-29T18:07:05.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20747" PostTypeId="2" ParentId="20735" CreationDate="2015-08-19T17:14:19.873" Score="4" Body="&lt;p&gt;&lt;strong&gt;Short Answer:&lt;/strong&gt; Basically the timeout is indicated by a retransmission of a packet that is now considered lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Long Answer:&lt;/strong&gt; A TCP stack sending component sends a stream of bytes. The sending window is the range of sequence numbers of bytes that are currently in flight. When sending the first byte (sequence number: x), a timer is started that has a default timeout. When the timeout ends, we retransmit. In case there is an ACK for byte y and y &gt;= x, the timer is reset and we are awaiting an ACK for y+1. The reason for accepting everything above and equal x is due to the fact that ACKs in TCP are cumulative (&quot;ack everything including the mentioned number&quot;) in contrast to selective (&quot;ack only mentioned number&quot;).&lt;/p&gt;&#xA;" OwnerUserId="10219" LastEditorUserId="10219" LastEditDate="2015-08-19T17:20:10.763" LastActivityDate="2015-08-19T17:20:10.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20749" PostTypeId="5" CreationDate="2015-08-19T18:55:55.187" Score="0" Body="&lt;p&gt;This User Datagram  Protocol  (UDP)  is  defined  to  make  available  a&#xA;datagram   mode  of  packet-switched   computer   communication  in  the&#xA;environment  of  an  interconnected  set  of  computer  networks.   This&#xA;protocol  assumes  that the Internet  Protocol  (IP) is used as the&#xA;underlying protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This protocol  provides  a procedure  for application  programs  to send&#xA;messages  to other programs  with a minimum  of protocol mechanism.  The&#xA;protocol  is transaction oriented, and delivery and duplicate protection&#xA;are not guaranteed.  Applications requiring ordered reliable delivery of&#xA;streams of data should use the Transmission Control Protocol (TCP).&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T22:35:31.550" LastActivityDate="2016-11-29T22:35:31.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20750" PostTypeId="4" CreationDate="2015-08-19T18:55:55.187" Score="0" Body="For questions about User Datagram Protocol, a Transport Layer protocol." OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T22:35:31.550" LastActivityDate="2016-11-29T22:35:31.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20752" PostTypeId="1" AcceptedAnswerId="20756" CreationDate="2015-08-19T19:44:29.003" Score="2" ViewCount="16429" Body="&lt;p&gt;I don't have any knowledge about networks, but I noticed that my internet is rather laggy and slow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried performing a &lt;code&gt;tracert&lt;/code&gt; to a particular IP which is used by my Service Provider and after 6 hops it reached the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have an IP Address, which I wish to discover what is it (switch or something like that). Is there a command that will help me discover what it is? I know it is local &lt;code&gt;192.168.x.x&lt;/code&gt; but I cannot find its &quot;name&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope you can understand me, and hope it's in the right forum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="17365" LastActivityDate="2015-08-19T20:43:02.403" Title="Have an unknown IP address, how can I discover what it is?" Tags="|ip|" AnswerCount="2" CommentCount="1" ClosedDate="2015-08-19T20:29:51.930" ContentLicense="CC BY-SA 3.0" />
  <row Id="20754" PostTypeId="2" ParentId="20752" CreationDate="2015-08-19T19:55:27.950" Score="0" Body="&lt;p&gt;If you want to know your PC's IP address, type ipconfig in a command window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know what public IP address you appear to the world as, go to Google and search on &quot;what is my IP&quot;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-08-19T20:43:02.403" LastActivityDate="2015-08-19T20:43:02.403" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20756" PostTypeId="2" ParentId="20752" CreationDate="2015-08-19T20:24:31.337" Score="5" Body="&lt;p&gt;A switch won't show up as a hop in a traceroute. I'll bet it's your home gateway/router that was supplied by your provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some very basic test steps... first, do an &lt;code&gt;ipconfig&lt;/code&gt; and check to see if the IP address is that of your &quot;Default Gateway&quot;. The default gateway is the first router you hop over, and this will be inside your home. If not, try to go to &lt;code&gt;http://192.168.x.x&lt;/code&gt; and &lt;code&gt;https://192.168.x.x&lt;/code&gt;. If both those fail, &lt;code&gt;ping 192.168.x.x&lt;/code&gt;, then &lt;code&gt;arp -a&lt;/code&gt;, find the MAC address associated with the IP, and try to find it on here: &lt;a href=&quot;http://aruljohn.com/mac.pl&quot; rel=&quot;nofollow&quot;&gt;http://aruljohn.com/mac.pl&lt;/a&gt;. That hopefully will at least tell you the vendor of the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all else fails, install &lt;code&gt;nmap&lt;/code&gt; for Windows: &lt;a href=&quot;https://nmap.org/download.html#windows&quot; rel=&quot;nofollow&quot;&gt;https://nmap.org/download.html#windows&lt;/a&gt;, then: &lt;code&gt;nmap -P0 -O 192.168.x.x&lt;/code&gt;, which will possibly tell you the Operating System running on the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're still nowhere, &lt;code&gt;nmap -sS -P0 192.168.x.x&lt;/code&gt; will show you a list of any open ports on the device that you can attempt to connect to.&lt;/p&gt;&#xA;" OwnerUserId="15782" LastEditorUserId="15782" LastEditDate="2015-08-19T20:36:42.477" LastActivityDate="2015-08-19T20:36:42.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20757" PostTypeId="2" ParentId="20646" CreationDate="2015-08-19T20:24:37.793" Score="0" Body="&lt;p&gt;As a first step configure a VTY access list to limit direct access to the router, eg&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 151 permit ip host 192.168.0.10 any&#xA;&#xA;line vty 0 4 &#xA;access-class 151 in&#xA;&#xA;line vty 5 15 &#xA;access-class 151 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will limit telnet/ssh access to the router to 192.168.0.10 (replace the IP with a different host/subnet as necessary).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch off http access if you're not going to use it (don't use it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider adding control-plane policers if the device supports it, see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/web/about/security/intelligence/coppwp_gs.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Andy &lt;/p&gt;&#xA;" OwnerUserId="17367" LastEditorUserId="509" LastEditDate="2015-08-19T20:27:52.897" LastActivityDate="2015-08-19T20:27:52.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20758" PostTypeId="1" AcceptedAnswerId="20906" CreationDate="2015-08-19T22:05:37.797" Score="0" ViewCount="2377" Body="&lt;p&gt;This started after trying to enter password recovery mode and rebooting. It rebooted the one time and started to load the ios but had some sort of TraceBack/Exception on the screen. I reset the power to try it again and it got stuck in this state. The power and fans come on but no output to the console port. I am getting a solid orange sys light and a solid green activity light. After about 5 minutes it then reboots automatically. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am getting no output at all on the console line, is the hardware toast? Is there a way to force a reset on the device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No Cisco support and the warranty is up. :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: I have let it sit for a few days and came back to it. Not it turns on and just dumps this data out. The program exception just repeats itself forever until it powers off and back on again. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System Bootstrap, Version 15.0(1r)M13, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 2011 by cisco Systems, Inc.&#xA;~#~#&#xA;Total memory size = 1024 MB - DIMM0 = 512 MB, DIMM1 = 512 MB&#xA;&#xA;*** Program Exception ***&#xA;PC = 0x230c2b00, Vector = 0x700, SP = 0x413df4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Let it sit for a bit and restarted it and it was able to boot, but get this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Would you like to enter the initial configuration dialog? [yes/no]: n&#xA;&#xA; 17:14:13 UTC Tue Aug 25 2015: Unexpected exception to CPU: vector 700, PC = 0xFF84B840, LR = 0xFF821854&#xA;&#xA;-Traceback= 0xFF84B840z &#xA;&#xA;M8500 CPU Register Context:&#xA;PC   = 0xFF84B840  MSR  = 0x00021200  CR   = 0x44022084  LR    = 0xFF821854&#xA;CTR  = 0x08A0F1A0  XER  = 0x20000000  DEAR = 0x00000000  PVR   = 0x80210030&#xA;DEC  = 0x00009F57  TBU  = 0x00000001  TBL  = 0x935E7AEB&#xA;DBCR0= 0x41000000  DBCR1= 0x00000000  DBCR2= 0x00000000&#xA;IAC1 = 0x00000000  IAC2 = 0x00000000  DAC2 = 0x00000000  DAC2  = 0x00000000&#xA;R0   = 0x00004E1F  R1   = 0x01099080  R2   = 0xEDD6B4FD  R3    = 0x00000001&#xA;R4   = 0x000000AE  R5   = 0x00000000  R6   = 0x01099138  R7    = 0x00000000&#xA;R8   = 0x00000000  R9   = 0x00004E20  R10  = 0x00000000  R11   = 0x01099080&#xA;R12  = 0x44022082  R13  = 0xB0E1D1A8  R14  = 0x05222360  R15   = 0x00000000&#xA;R16  = 0x00000000  R17  = 0x00000000  R18  = 0x00000000  R19   = 0x00000000&#xA;R20  = 0x00000000  R21  = 0x00000000  R22  = 0x00000000  R23   = 0x00000000&#xA;R24  = 0x106C0000  R25  = 0x11460000  R26  = 0x00000000  R27   = 0x11380000&#xA;R28  = 0x11380000  R29  = 0x00000002  R30  = 0x010993D0  R31   = 0x01099080File flash:crashinfo_20150825-171413-UTC Device Error :No such device&#xA;File flash0:crashinfo_20150825-171413-UTC Device Error :No such device&#xA;&#xA;Writing crashinfo to flash1:crashinfo_20150825-171413-UTC&#xA;% Crashinfo may not be recovered at flash:crashinfo&#xA;% This file system device reports an error&#xA;&#xA;&#xA;Press RETURN to get started!&#xA;&#xA;Unable to write file system sector&#xA;&#xA;Jan  2 12:00:00.003: %LICENSE-2-LIC_STORAGE: Storage validation failed,  -Traceback= 0x4046BBCz 0x404768Cz 0x4028814z 0x5221F18z 0x52223CCz 0x4961FB8z 0x4965E1Cz&#xA;Jan  2 12:00:00.975: %LICENSE-2-VLS_ERROR: 'VLSsetInstallLicenseStorage' failed with an error - rc = 144 - 'Error[144]: The specified store is corrupted.',  -Traceback= 0x404752Cz 0x4028814z 0x5221F18z 0x52223CCz 0x4961FB8z 0x4965E1Cz&#xA;Jan  2 12:00:00.975: license_initialize failed with error = 26&#xA;&#xA;Jan  2 12:00:00.979: %IOS_LICENSE_IMAGE_APPLICATION-6-LICENSE_LEVEL: Module name = c3900 Next reboot level = ipbasek9 and License = No valid license found&#xA;Aug 25 17:12:47.583: Following corrupted license storage was un-recoverable : implicit_license:/eval_license -Traceback= 0x4046DD0z 0x4044364z 0x40449ACz 0x4961FB8z 0x4965E1Cz&#xA;Aug 25 17:12:47.587: %LICENSE-2-LIC_STORAGE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Couldn't get anywhere after that so I rebooted it and now I am back to the beginning where it won't even output anything to the console.&lt;/p&gt;&#xA;" OwnerUserId="17370" LastEditorUserId="17370" LastEditDate="2015-08-25T17:28:16.300" LastActivityDate="2015-08-25T18:55:58.183" Title="Cisco 3925 not booting/outputing to console" Tags="|cisco|router|hardware|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20759" PostTypeId="2" ParentId="20707" CreationDate="2015-08-19T23:35:54.373" Score="3" Body="&lt;p&gt;The connected route is generated automatically by the kernel from the prefix length (or netmask) associated with the interface.  In order to avoid the connected route, you need to set a prefix length of /32 (or /128 in IPv6):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ip addr show dev eth0&#xA;...&#xA;    inet 10.0.0.42/24 scope global eth0&#xA;...&#xA;# ip addr del 10.0.0.42/24 dev eth0&#xA;# ip addr add 10.0.0.42/32 dev eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="12089" LastActivityDate="2015-08-19T23:35:54.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20760" PostTypeId="1" AcceptedAnswerId="20765" CreationDate="2015-08-19T23:40:15.033" Score="1" ViewCount="179" Body="&lt;p&gt;My friend's small office uses a network setup of a 48-port switch (Netgear GS748T), a VPN firewall (Netgear fvs336g), a Comcast modem and a Windows Server 2003 machine. We want to take down the SBS2003 server from the network, because it's an old machine using a lot of electricity and nowadays it's only used for sharing the internet access. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This friend was told by a local IT guy who was in the office for a while that the only thing that needs to be done in order to remove the server is to just physically turn it off and disconnect it and the internet access traffic should be re-routed. I unjoined a test PC connected to the network/server from the local domain (just to be sure) and then turned the server off. However, it's not so simple - after doing this, the internet access is down on all connected workstations. It's still routing to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd really appreciate some general tips on why would that happen. I only had a few minutes today to take a look at the network and to check what's going on. As far as I remember, the internet access (modem/DSL) connects to the firewall, and then the firwall connects to NIC1 card of the server, then it goes out from NIC2 card to the switch and then it goes to the clients from the switch. Is that setup even possible? If so, then if I wired the firewall straight to the switch, will we be able to not use the server anymore?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this is our current setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DSL Modem -&gt; Firewall -&gt; first network card of server -&gt; goes out to the second network card -&gt; switch -&gt; clients&lt;/p&gt;&#xA;" OwnerUserId="17371" LastActivityDate="2016-09-13T14:30:23.883" Title="Rerouting network traffic from a SBS" Tags="|routing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20761" PostTypeId="1" CreationDate="2015-08-20T00:05:58.630" Score="0" ViewCount="120" Body="&lt;p&gt;Does 'telecommunications' refer to only some kinds of networks in modern usage? I know that literally it means 'distance (tele-) communication', but does it refer only to TV or cell phones or internet or something else when used among network engineers?(Do network engineers even use that word to describe what they do?) &lt;/p&gt;&#xA;" OwnerUserId="17373" LastActivityDate="2015-12-03T01:02:27.710" Title="Terminology: what is the scope of the meaning of the word 'telecommunications'?" Tags="|terminology|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20762" PostTypeId="1" AcceptedAnswerId="36061" CreationDate="2015-08-20T03:48:39.853" Score="7" ViewCount="2399" Body="&lt;p&gt;People,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've two routers on my ISP's core. First of them is a bit old Cisco gear, which is where I have eBGP sessions with my upstreams, IX and downstreams. The second is a MikroTik CCR, which act as DHCP Server, firewall, etc. for my customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to increasing of our network, the old Cisco router is not being able to deal with all current traffic fluidly, but because of internal reasons we can't change it to another gear for now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm considering redirect all incoming traffic directly to MikroTik gear, in a such way it doesn't need to be routed by Cisco one. But I'm not sure it is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use a /29 range with each of my upstreams, so I can have MikroTik router addressed within same range as my and upstream's border routers. Ex.:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Upstream's 1st router: 198.51.100.1/29&lt;/li&gt;&#xA;&lt;li&gt;Upstream's 2nd router: 198.51.100.2/29&lt;/li&gt;&#xA;&lt;li&gt;My Cisco router: 198.51.100.6/29&lt;/li&gt;&#xA;&lt;li&gt;My MikroTik router: 198.51.100.5/29&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VOGpd.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VOGpd.png&quot; alt=&quot;Network diagram - core&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.0.2.1 is default gateway for MikroTik router (192.0.2.2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be easy to get this solved using as-path prepend if MikroTik gear was running BGP, but it isn't and can't get being for technical and commercial reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought the redirection could be done by changing advertised prefixes' BGP next-hop attribute to MikroTik router's IP address, in the following way (in conformance with above network diagram):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map CHANGE_NEXTHOP permit 10&#xA; set ip next-hop 198.51.100.5&#xA;!&#xA;router bgp XXXXXX&#xA; neighbor 198.51.100.1 route-map CHANGE_NEXTHOP out&#xA; neighbor 198.51.100.2 route-map CHANGE_NEXTHOP out&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That way, upload traffic would flow through direct connection between both routers, whereas download traffic would flow from upstreams directly to MikroTik router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I read somewhere this is only possible when BGP sessions are multihop, not when neighbors are directly connected. Moreover, from what I understood, changing next-hop is an iBGP only feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm far from being a Cisco expert and searched a lot but found no conclusive answer to my doubts, so could somebody tell me if &lt;strong&gt;is it possible to do what I described in above config. snippet&lt;/strong&gt; or suggest any solution to my tricky situation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I currently have no ways to run it on a lab (even using virtual machines) to test if works as intended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be thankful for this and any further information you provide.&lt;/p&gt;&#xA;" OwnerUserId="4575" LastEditorUserId="4575" LastEditDate="2015-08-24T02:17:10.350" LastActivityDate="2017-02-23T17:46:08.047" Title="Redirect inbound traffic to another router not running BGP" Tags="|routing|bgp|" AnswerCount="4" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="20763" PostTypeId="1" AcceptedAnswerId="20771" CreationDate="2015-08-20T06:13:57.407" Score="3" ViewCount="8276" Body="&lt;p&gt;We have internet access in both LAN and WLAN in our offices which is only used to internet access. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do we enable a password based authentication in this infrastructure so that authenticated user will type a user name and password first to gain access to the Internet services? Whenever a user will connect to a SSID the system will prompt for a user name and password. After verifying the user name and password the user will be given internet access. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read many articles on it and came to know RADIUS server can be one solution for this. I look forward how to configure one with Ubuntu Linux (preferably) and store user name and password in a database (if possible) so that the server will authenticate only those users.&lt;/p&gt;&#xA;" OwnerUserId="17316" LastActivityDate="2016-12-20T02:14:54.643" Title="How to secure WiFi with user name and password?" Tags="|security|ieee-802.11|cisco-wireless|network-access|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20764" PostTypeId="1" CreationDate="2015-08-20T07:07:57.650" Score="1" ViewCount="1695" Body="&lt;p&gt;I tried with &lt;code&gt;sudo ethtool --set-ring eth0 rx 1020&lt;/code&gt;, but I'm getting this error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cannot get device ring settings: Operation not supported`&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is there any other way to change network buffer to simulate NIC card errors and Packet drops.&lt;/p&gt;&#xA;" OwnerUserId="17153" LastEditorUserId="3024" LastEditDate="2019-07-25T12:34:48.080" LastActivityDate="2019-07-25T12:34:48.080" Title="How to change network buffer of network interface to get NIC card errors?" Tags="|ethernet|packet-loss|" AnswerCount="1" CommentCount="1" ClosedDate="2019-07-25T12:54:17.823" ContentLicense="CC BY-SA 4.0" />
  <row Id="20765" PostTypeId="2" ParentId="20760" CreationDate="2015-08-20T07:19:13.730" Score="2" Body="&lt;p&gt;The setup you describe is possible and does not even surprise me for a SBS setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can only guess but I would say the SBS server act as DHCP server and Router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can remove it and connect the firewall to the switch but you probably will have to reconfigure the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to consider&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IP address space used&lt;/li&gt;&#xA;&lt;li&gt;need for a DHCP server or not&lt;/li&gt;&#xA;&lt;li&gt;NAT to be performed by the firewall&lt;/li&gt;&#xA;&lt;li&gt;Firewall rules to allow traffic from the client PCs to the Internet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is likely that there's a IP network between the firewall and the SBS server different than the one use between the client computers and the SBS server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you must check that there's no Group Policy applied that would enforce some network settings on the client computers, such a proxy settings and Windows Software Update settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's those kind of GPO you must remove them in a way that they will no more be applied on the computers (there's a Check box in the GPO settings that tell if the settings are still applied when the GPO is removed).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-08-20T07:19:13.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20766" PostTypeId="2" ParentId="20763" CreationDate="2015-08-20T08:29:36.637" Score="0" Body="&lt;p&gt;you need Radius Server and 802.1x Enabled AP , for Radius server you have good option Microsoft Network Policy server and you need to define users on active directory integrated with your NPS &lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2015-08-20T08:29:36.637" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20768" PostTypeId="2" ParentId="20758" CreationDate="2015-08-20T09:02:04.217" Score="0" Body="&lt;p&gt;Ideally you device should come up after you turn off/on the power control switch and your console window should display on going process running. You can reboot the router once again and check the console cable/connection and its setting. Hope it helps. &lt;/p&gt;&#xA;" OwnerUserId="17316" LastActivityDate="2015-08-20T09:02:04.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20771" PostTypeId="2" ParentId="20763" CreationDate="2015-08-20T11:44:41.867" Score="2" Body="&lt;p&gt;Consider looking into PacketFence(.org) + FreeRADIUS.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PacketFence describes itself as : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PacketFence is a fully supported, trusted, Free and Open Source network access control (NAC) solution. Boasting an impressive feature set &lt;strong&gt;including a captive-portal for registration and remediation&lt;/strong&gt;, centralized wired and wireless management, powerful BYOD management options, 802.1X support, layer-2 isolation of problematic devices; PacketFence can be used to effectively secure networks small to very large heterogeneous networks. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(Emphasis mine.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When users first attempt to connect to the network, you can require that they authenticate using a username and password, as shown in this example image from PF's website : &lt;a href=&quot;http://www.packetfence.org/typo3temp/pics/3623b54ba0.png&quot; rel=&quot;nofollow&quot;&gt;http://www.packetfence.org/typo3temp/pics/3623b54ba0.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for (Free)RADIUS, PacketFence's administration guide has this to say : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In some occasions, a RADIUS server is mandatory in order to give access to the network.  For example, the usage of WPA2-Enterprise (Wireless 802.1X), MAC authentication and Wired 802.1X all requires a RADIUS server to authenticate the users and the devices, and then to push the proper VLAN to the network equipment. We strongly recommend that you install FreeRADIUS even if you plan not to use the feature now.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I can't exactly include a whole configuration guide in this answer, but there is good documentation available on the PacketFence site. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best of luck ! &lt;/p&gt;&#xA;" OwnerUserId="4831" LastActivityDate="2015-08-20T11:44:41.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20772" PostTypeId="2" ParentId="20764" CreationDate="2015-08-20T12:00:29.387" Score="1" Body="&lt;p&gt;That's what the &lt;code&gt;netem&lt;/code&gt; queue discipline is for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For outgoing traffic, just set the qdisc of the outgoing interface to netem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;modprobe sch_netem&#xA;tc qdisc add dev eth0 root netem loss 3%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can reset it to normal with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tc qdisc del dev eth0 root&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For incoming traffic, the setup is a little more complicated, please check &lt;a href=&quot;http://www.linuxfoundation.org/collaborate/workgroups/networking/netem#How_can_I_use_netem_on_incoming_traffic.3F&quot; rel=&quot;nofollow&quot;&gt;netem on incoming traffic&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="12089" LastActivityDate="2015-08-20T12:00:29.387" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20773" PostTypeId="2" ParentId="20758" CreationDate="2015-08-20T12:35:08.373" Score="2" Body="&lt;p&gt;I don't know about the device rebooting itself after a few minutes, but ... &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Baud Rate&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you're not getting any console output, try changing the baud rate.&#xA;I've personally made the mistake of changing the default baud rate (line speed) from 9600 to (for example) 19200, saved, then later rebooted and forgot that I had changed it !  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How you change the baud rate differs by what terminal emulator you use.&lt;br&gt;&#xA;Under Windows I usually use TeraTerm or PuTTY.&lt;br&gt;&#xA;For PuTTY, look under Connection -&gt; Serial -&gt; Speed (baud).&lt;br&gt;&#xA;For TeraTerm, Setup -&gt; Serial Port ... -&gt; Baud rate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under Linux I use GNU Screen, where you can specify the speed at the command line : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;screen /dev/ttyS0 115200&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Looking at some documentation for your device, I see these speeds listed : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Baud rates for the USB console port are 1200, 2400, 4800, 9600, 19200, 38400, 57600, and 115200 bps.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You may need to try each. The hardware may support more speeds, too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, the opposite may have occurred - that both your router and terminal emulator were configured for a non-default baud rate (say 19200), but when the router restarted it defaulted to 9600 but your software's still on the old speed. Lot of possibilities. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;USB vs RJ-45 serial console&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;According to this documentation for the 3925 : &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/access/2900/hardware/installation/guide/Hardware_Installation_Guide/Overview.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/routers/access/2900/hardware/installation/guide/Hardware_Installation_Guide/Overview.html&lt;/a&gt;&lt;br&gt;&#xA;There are two serial ports - a USB serial console port and an RJ-45 serial console port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using one, try the other !&lt;br&gt;&#xA;For the RJ-45 port, make sure that you're using the correct &quot;Cisco rollover cable&quot; or that if you pass the connection through a patch panel, that the wires aren't crossed-over (... an odd-number of times). &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Flash&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If you think that the router is passing POST and loading the ROM image fine, but is failing at loading/decompressing the full image from flash, AND if you have another 3925 and a second/spare CompactFlash card, you can try taking the flash card from the working router to see if the problem router can load the full image.&lt;br&gt;&#xA;Bit of a long-shot, but you never know when troubleshooting hardware issues.&lt;br&gt;&#xA;(Technically there's a small chance that using a good card in a bad router could damage the card - assess whether you'll take that risk.)&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Other bad hardware&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As long as your device is down and out for troubleshooting, it doesn't hurt to (safely) remove all accessory interfaces or modules. This is even a longer-shot, since I would expect console output even with failed/failing modules ... but it doesn't cost you more than a few extra minutes (as long as they're easy to remove) to try. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck ! &lt;/p&gt;&#xA;" OwnerUserId="4831" LastEditorUserId="4831" LastEditDate="2015-08-20T12:42:34.473" LastActivityDate="2015-08-20T12:42:34.473" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20774" PostTypeId="1" AcceptedAnswerId="20778" CreationDate="2015-08-20T12:39:34.337" Score="0" ViewCount="1826" Body="&lt;p&gt;I have set up an OpenVPN server on CentOS 6.7&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I copied the configuration from a known working server so I was pretty sure the server was configured correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I'm having is that a VPN client will connect fine, but can't reach anything on the internet. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The clients are using certificates for authentication.&lt;/li&gt;&#xA;&lt;li&gt;I'm pushing Google's public DNS server (8.8.8.8)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've enabled packet forwarding in sysctl.conf &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;net.ipv4.conf.all.forwarding = 1&#xA;net.ipv4.conf.all.mc_forwarding = 0&#xA;net.ipv4.conf.default.forwarding = 1&#xA;net.ipv4.conf.default.mc_forwarding = 0&#xA;net.ipv4.conf.lo.forwarding = 1&#xA;net.ipv4.conf.lo.mc_forwarding = 0&#xA;net.ipv4.conf.eth0.forwarding = 1&#xA;net.ipv4.conf.eth0.mc_forwarding = 0&#xA;net.ipv4.conf.tun0.forwarding = 1&#xA;net.ipv4.conf.tun0.mc_forwarding = 0&#xA;net.ipv4.ip_forward = 1&#xA;net.ipv4.ip_forward_use_pmtu = 0&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've added these iptables rules:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE -m comment --comment &quot;Masquerade OpenVPN traffic&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iptables -A INPUT -i tun0 -j ACCEPT -m comment --comment &quot;Allow all incoming OpenVPN&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iptables -A FORWARD -i tun0 -j ACCEPT&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;tun0 is configured as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;$ ip address show tun0&#xA;6: tun0:  mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 100&#xA;    link/[65534]&#xA;    inet 172.16.1.1 peer 172.16.1.2/32 scope global tun0&lt;br&gt;&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my openvpn.log I can see the client connects ok:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;Thu Aug 20 06:54:59 2015 us=94453 31.108.32.42:55065 [David] Peer Connection Initiated with [AF_INET]31.108.32.42:55065&#xA;Thu Aug 20 06:54:59 2015 us=94789 MULTI: new connection by client 'David' will cause previous active sessions by this client to be dropped.  Remember to use the --duplicate-cn option if you want multiple clients using the same certificate or username to concurrently connect.&#xA;Thu Aug 20 06:54:59 2015 us=94913 MULTI_sva: pool returned IPv4=172.16.1.6, IPv6=(Not enabled)&#xA;Thu Aug 20 06:54:59 2015 us=94991 MULTI: Learn: 172.16.1.6 -&gt; David/31.108.32.42:55065&#xA;Thu Aug 20 06:54:59 2015 us=95013 MULTI: primary virtual IP for David/31.108.32.42:55065: 172.16.1.6&#xA;Thu Aug 20 06:55:00 2015 us=350681 David/31.108.32.42:55065 UDPv4 READ [56] from [AF_INET]31.108.32.42:55065: P_CONTROL_V1 kid=0 [ ] pid=6 DATA len=42&#xA;Thu Aug 20 06:55:00 2015 us=351165 David/31.108.32.42:55065 PUSH: Received control message: 'PUSH_REQUEST'&#xA;Thu Aug 20 06:55:00 2015 us=351212 David/31.108.32.42:55065 send_push_reply(): safe_cap=940&#xA;Thu Aug 20 06:55:00 2015 us=351282 David/31.108.32.42:55065 SENT CONTROL [David]: 'PUSH_REPLY,redirect-gateway def1 bypass-dhcp,dhcp-option DNS 8.8.8.8,route 172.16.1.1,topology net30,ping 10,ping-restart 120,ifconfig 172.16.1.6 172.16.1.5' (status=1)&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I use tshark to watch tun0 I can see DNS queries being performed, but there doesn't appear to be any response:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;1.935018671   172.16.1.6 -&gt; 8.8.8.8      DNS 74 Standard query 0xe4a3  A external-lhr3-1.xx.fbcdn.net&#xA;1.937067717   172.16.1.6 -&gt; 8.8.8.8      DNS 68 Standard query 0xdbc8  A edge-chat.facebook.com&#xA;2.324716221   172.16.1.6 -&gt; 8.8.8.8      DNS 65 Standard query 0xc98b  A clients4.google.com&#xA;2.331865976   172.16.1.6 -&gt; 8.8.8.8      DNS 65 Standard query 0x5acb  AAAA clients4.google.com&#xA;2.335206663   172.16.1.6 -&gt; 8.8.8.8      DNS 65 Standard query 0x6ba8  A clients4.google.com&#xA;2.610867667   172.16.1.6 -&gt; 8.8.8.8      DNS 62 Standard query 0xfb5e  A www.google.co.uk&#xA;2.612555200   172.16.1.6 -&gt; 8.8.8.8      DNS 62 Standard query 0xcaf7  A www.google.co.uk&#xA;2.628983231   172.16.1.6 -&gt; 8.8.8.8      DNS 75 Standard query 0x803d  A fbcdn-photos-a-a.akamaihd.net&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see packets on eth0 too, which has a public internet IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;$ tshark -i eth0 -f &quot;host 172.16.1.6&quot;&#xA;Running as user &quot;root&quot; and group &quot;root&quot;. This could be dangerous.&#xA;Capturing on eth0&#xA;0.000000000   172.16.1.6 -&gt; 8.8.8.8      DNS 79 Standard query 0x7afb  A clients4.google.com&#xA;0.002199239   172.16.1.6 -&gt; 8.8.8.8      DNS 74 Standard query 0x4f3c  A m.facebook.com&#xA;0.003786487   172.16.1.6 -&gt; 8.8.8.8      DNS 74 Standard query 0x7033  A m.facebook.com&#xA;0.005484385   172.16.1.6 -&gt; 8.8.8.8      DNS 70 Standard query 0x86a1  A google.com&#xA;0.008791391   172.16.1.6 -&gt; 8.8.8.8      DNS 74 Standard query 0x031d  AAAA api.amazon.com&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again - nothing the other way&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client can ping the vpn server (172.16.1.1) but nothing outside of it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what else I can check.&lt;/p&gt;&#xA;" OwnerUserId="17383" LastActivityDate="2015-08-20T15:42:23.667" Title="OpenVPN Server on CentOS: Can't get a client to connect to the internet" Tags="|vpn|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20776" PostTypeId="2" ParentId="20774" CreationDate="2015-08-20T14:16:27.437" Score="0" Body="&lt;p&gt;I have a feeling that your traffic isn't being NAT'd properly, so when (or I would really hope long before) it reaches Google's DNS servers, it's dropped as an invalid publicly routable prefix. Connect a sniffer to the Internet side of your VPN server, and see what IP address your VPN server is sending traffic as.&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-08-20T14:16:27.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20777" PostTypeId="2" ParentId="6785" CreationDate="2015-08-20T14:54:45.293" Score="4" Body="&lt;p&gt;OK, so I have revisited this issue several times, and now have working IPv6 with TWC via my SRX.  I wish I could mark several answers and comments as correct as several of you gave me parts of the overall solution.  Thank you all, for that.  I've upvoted the answers that contributed to give as much as I could to contributors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it turns out, the DOCSIS cable modem mini-pim &lt;strong&gt;was&lt;/strong&gt; part of the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that TWC will not send IPv6 RA messages to you if you have an &quot;unsupported&quot; modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the solution to my problem was to go by a TWC supported modem (I got a Motorola SB6141), and connect it to one of the gigabit ports on my SRX.  My interface config now looks like:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;    unit 0 {                        &#xA;        family inet {               &#xA;            dhcp-client;            &#xA;        }                           &#xA;        family inet6 {              &#xA;            dad-disable;            &#xA;            dhcpv6-client {         &#xA;                client-type statefull;&#xA;                client-ia-type ia-pd;&#xA;                client-ia-type ia-na;&#xA;                inactive: update-router-advertisement {&#xA;                    interface ge-0/0/0.0;&#xA;                }                   &#xA;                client-identifier duid-type duid-ll;&#xA;            }                       &#xA;        }                           &#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As one of the answers and comments alluded to, apparently you can't send a IA-PD prefix hint with the SRX, and TWC gives a /64 when it doesn't get a hint.  The SRX then tries to subdivide the /64 65,536 ways and picks the first resultant network to delegate...which means it was trying to put a /80 on ge-0/0/0, which kinda doesn't help much as SLAAC doesn't work.  :/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went with the work around, to see what /64 I get, then manually configured protocol router-advertisement on the inside interface with the block I was delegated (which should be stable as long as they system's DUID remains the same).  Kinda lame, but it's where we are right now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will continue to keep an eye on this entry to see if anyone has other ideas on making this a better setup.  If you have questions on parts of it that I didn't go into enough detail on, please let me know and I'll edit.&lt;/p&gt;&#xA;" OwnerUserId="97" LastActivityDate="2015-08-20T14:54:45.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20778" PostTypeId="2" ParentId="20774" CreationDate="2015-08-20T14:59:05.370" Score="1" Body="&lt;p&gt;Just did a quick test to see whether tcpdump (I̶ ̶a̶s̶s̶u̶m̶e̶ ̶T̶S̶H̶A̶R̶K̶ ̶b̶e̶h̶a̶v̶e̶s̶ ̶t̶h̶e̶ ̶s̶a̶m̶e̶) shows the NAT'd or original source IP address on the egress interface, when NAT is configured using iptables, even without OpenVPN configured. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setup : &#xA;Ubuntu eth1 &amp;lt;-&gt; eth1 CentOS eth0 &amp;lt;-&gt; &quot;Internet&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ubuntu config : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;sudo ip addr add 172.16.1.2/30 dev eth1&lt;br&gt;&#xA;  sudo ip link set dev eth1 up&lt;br&gt;&#xA;  sudo ip route add default via 172.16.1.1  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;CentOS config : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;dhclient -v eth0&lt;br&gt;&#xA;  ip addr add 172.16.1.1/30 dev eth1&lt;br&gt;&#xA;  ip link set dev eth1 up&lt;br&gt;&#xA;  echo 1 &gt; /proc/sys/net/ipv4/ip_forward&lt;br&gt;&#xA;  iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE&lt;br&gt;&#xA;  iptables -F FORWARD&lt;br&gt;&#xA;  iptables -A FORWARD -i eth1 -o eth0 -j ACCEPT&lt;br&gt;&#xA;  iptables -A FORWARD -i eth0 -o eth1 -m state --state RELATED,ESTABLISHED -j ACCEPT  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(Just ask if you need any of the above config explained.)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we ping from Ubuntu (172.16.1.2) to 8.8.8.8 (Google DNS) ...  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internal :  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[root@localhost ~]# tcpdump -ni eth1 'icmp'&lt;br&gt;&#xA;  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode&lt;br&gt;&#xA;  listening on eth1, link-type EN10MB (Ethernet), capture size 65535 bytes&lt;br&gt;&#xA;  11:02:44.251212 IP 172.16.1.2 &gt; 8.8.8.8: ICMP echo request, id 2996, seq 1, length 64&lt;br&gt;&#xA;  11:02:44.269621 IP 8.8.8.8 &gt; 172.16.1.2: ICMP echo reply, id 2996, seq 1, length 64&lt;br&gt;&#xA;  11:02:45.252338 IP 172.16.1.2 &gt; 8.8.8.8: ICMP echo request, id 2996, seq 2, length 64&lt;br&gt;&#xA;  11:02:45.268138 IP 8.8.8.8 &gt; 172.16.1.2: ICMP echo reply, id 2996, seq 2, length 64&lt;br&gt;&#xA;  11:02:46.253904 IP 172.16.1.2 &gt; 8.8.8.8: ICMP echo request, id 2996, seq 3, length 64&lt;br&gt;&#xA;  11:02:46.270498 IP 8.8.8.8 &gt; 172.16.1.2: ICMP echo reply, id 2996, seq 3, length 64  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;External :  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[root@localhost ~]# tcpdump -ni eth0 'icmp'&lt;br&gt;&#xA;  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode&lt;br&gt;&#xA;  listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes&lt;br&gt;&#xA;  11:02:44.251252 IP 10.0.2.15 &gt; 8.8.8.8: ICMP echo request, id 2996, seq 1, length 64&lt;br&gt;&#xA;  11:02:44.269581 IP 8.8.8.8 &gt; 10.0.2.15: ICMP echo reply, id 2996, seq 1, length 64&lt;br&gt;&#xA;  11:02:45.252363 IP 10.0.2.15 &gt; 8.8.8.8: ICMP echo request, id 2996, seq 2, length 64&lt;br&gt;&#xA;  11:02:45.268126 IP 8.8.8.8 &gt; 10.0.2.15: ICMP echo reply, id 2996, seq 2, length 64&lt;br&gt;&#xA;  11:02:46.253942 IP 10.0.2.15 &gt; 8.8.8.8: ICMP echo request, id 2996, seq 3, length 64&lt;br&gt;&#xA;  11:02:46.270469 IP 8.8.8.8 &gt; 10.0.2.15: ICMP echo reply, id 2996, seq 3, length 64  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Success !&lt;/strong&gt;&lt;br&gt;&#xA;More importantly, we see that tcpdump shows the NAT'd address !  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your output, the captured IP is &quot;172.16.1.6&quot; - a clear indication of why no traffic is being returned.&lt;br&gt;&#xA;Your ISP (or some Internet router) is dropping the traffic as soon as it sees a private address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As another comment mentioned, check your NAT configuration - &lt;strong&gt;or try to get NAT working as I did above before you even touch OpenVPN.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT : Just tested with tshark and it does behave the same as tcpdump, in that it shows the source IP address post-NAT : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[root@localhost ~]# tshark -ni eth0 'icmp'&lt;br&gt;&#xA;  Running as user &quot;root&quot; and group &quot;root&quot;. This could be dangerous.&lt;br&gt;&#xA;  Capturing on eth0&lt;br&gt;&#xA;  0.000000000    10.0.2.15 -&gt; 8.8.8.8      ICMP 98 Echo (ping) request  id=0x0bbb, seq=1/256, ttl=63&lt;br&gt;&#xA;  0.015220791      8.8.8.8 -&gt; 10.0.2.15    ICMP 98 Echo (ping) reply    id=0x0bbb, seq=1/256, ttl=54&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Looking at your iptables config more closely ...&lt;/h2&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;iptables -t nat -A POSTROUTING -o tun0 -j MASQUERADE&lt;br&gt;&#xA;  iptables -A INPUT -i tun0 -j ACCEPT&lt;br&gt;&#xA;  iptables -A FORWARD -i tun0 -j ACCEPT&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The first line specifies the &quot;external networking device&quot; on which to perform NAT as tun0.&lt;br&gt;&#xA;The second line isn't really relevant to forwarding, since the INPUT chain concerns traffic destined for the local server itself, not traffic passing through, iinm.&lt;br&gt;&#xA;The third line specifies that tun0 is the &quot;internal / inside&quot; interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems to me that&lt;br&gt;&#xA;1) your NAT'd interface should be eth0, not the tunnel interface, and&lt;br&gt;&#xA;2) that you need to specify the outside interface (eth0) with an option like &quot;-o eth0 -j ACCEPT&quot; on the same line you specify your inside interface (tun0), and&lt;br&gt;&#xA;3) don't forget a separate iptables statement for return traffic, as in my example above !&lt;/p&gt;&#xA;" OwnerUserId="4831" LastEditorUserId="4831" LastEditDate="2015-08-20T15:42:23.667" LastActivityDate="2015-08-20T15:42:23.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20779" PostTypeId="1" AcceptedAnswerId="20786" CreationDate="2015-08-20T15:23:12.110" Score="0" ViewCount="2339" Body="&lt;p&gt;Let's say we have a TCP or UDP message encapsulated in an IP packet. Let's say the length of the UDP/TCP message is too great for IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understood well the initial IP payload should be fragmented in several smaller packets. Hence the first IP packet has the TCP/UDP header and probably the beginning of the UDP/TCP payload. The second one has the next part of the UDP/TCP payload, and so on until the whole UDP/TCP message is sent. The port informations are contained in the UDP/TCP header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence my question: does this mean we can't know the ports (both destination and source) of the fragmented messages ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that yes, we can't know the port. But that is normal because we only need it at the UDP/TCP layer, that is complete once we rebuild it from the several IP packets. But I would like to check the number of packets by port coming through some point on a network. Is the only way to do this to catch the first packet, identify the ports and the IP ID field and to check for every IP ID field of every fragmented packet ?&lt;/p&gt;&#xA;" OwnerUserId="17391" LastEditorUserId="17391" LastEditDate="2015-08-20T19:04:49.130" LastActivityDate="2015-08-20T19:04:49.130" Title="Port of fragmented packets" Tags="|ip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20780" PostTypeId="2" ParentId="6404" CreationDate="2015-08-20T15:31:55.610" Score="1" Body="&lt;p&gt;In the &quot;show snmp&quot; traps are being generated, 13 of them, and you have snmp-server enable traps syslog set.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Few things you can do is add a logging ip address if one doesn't already exist or an additional address and throw up a simple syslog server and do a few things to generate traps like conf t or add a vlan and delete a vlan as you have these set to trap. If you don't to use vlans then add a loopback and shut/no shut it a few times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appears you are dealing with these remotely. I always open two sessions to the box. Session one, I execute &quot;no debug all&quot; then arrow up then switch to the other session and do term mon and then debug snmp packet. The first session is a failsafe so I can turn off debugging with hitting return if for some reason debug is taxing the box. School of remote access hard knocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While debug is running do conf t and exit a few times and/or add delete vlans and you will see the traps being generated and if they are pointing to the desired ip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should see something similar to these below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6506E#term mon&#xA;6506E#debug snmp packet&#xA;SNMP packet debugging is on&#xA;&#xA;6506E#sh run&#xA;Building configuration...&#xA;...&#xA;6506E#&#xA;19:24:18: SNMP: Queuing packet to 10.198.28.80&#xA;19:24:18: SNMP: V3 Trap, reqid 2, errstat 0, erridx 0&#xA;sysUpTime.0 = 6981747&#xA;snmpTrapOID.0 = ciscoConfigManMIB.2.0.1&#xA;ccmHistoryEventEntry.3.100 = 1 &#xA;&#xA;!--- 1 -&amp;gt; commandLine. Executed via CLI.&#xA;&#xA;ccmHistoryEventEntry.4.100 = 3 &#xA;&#xA;!--- 3 -&amp;gt; running&#xA;&#xA;ccmHistoryEventEntry.5.100 = 2 &#xA;&#xA;!--- 2 -&amp;gt; commandSource. Show command was executed.&#xA;&#xA;6506E#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;6506E(config)#exit&#xA;&#xA;22:57:37: SNMP: Queuing packet to 10.198.28.80&#xA;22:57:37: SNMP: V3 Trap, reqid 2, errstat 0, erridx 0&#xA; sysUpTime.0 = 8261709&#xA; snmpTrapOID.0 = ciscoConfigManMIB.2.0.1&#xA; ccmHistoryEventEntry.3.108 = 1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In our shop we only use PI for wireless management controllers and users, not switches. Third party and open source for switches. We have logging for all available traps to dual syslog servers for compliance and redundancy so I understand your frustration when traps aren't working as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also if you aren't are the latest patches in the 2.0 train I would highly recommend it. 2.0 is not the most stable from our experience until the patches are added. fwiw&lt;/p&gt;&#xA;" OwnerUserId="16758" LastEditorUserId="16758" LastEditDate="2015-08-20T15:44:37.120" LastActivityDate="2015-08-20T15:44:37.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20783" PostTypeId="2" ParentId="20732" CreationDate="2015-08-20T16:41:27.663" Score="2" Body="&lt;p&gt;I think with the way you are going about this with routing is always going to run into a problem. Since the subnet with the provider is 80.0.0.64 - 80.0.0.95 and you want to use .90 in another subnet that is behind the SRX you are going to run into either arp issues with the ISP or routing issues. When the ISP routers want to talk with .90 they always assume based on the subnet that is is layer 2 adjacent. As you said you are able to proxy arp, then remove the arp and it works till the ISP router arp table times out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I think you are going to be forced to use a static source nat with a proxy-arp with the way you have it now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want to be able to apply security policies between the server and the internet you can actually just run some of the the SRX interfaces in a layer 2 mode. That way you can put 2 interfaces in the same VLAN/bridge but in different security zones. That way you can write policies between the zones and still have that .90 address directly on that server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos12.1/topics/example/security-zone-layer2-configuring.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/documentation/en_US/junos12.1/topics/example/security-zone-layer2-configuring.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise you will need to work with your ISP to get that block routed to your SRX and have another subnet between the SRX and the ISP router. This is the ideal solution in my opinion.&lt;/p&gt;&#xA;" OwnerUserId="1482" LastActivityDate="2015-08-20T16:41:27.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20784" PostTypeId="1" AcceptedAnswerId="20785" CreationDate="2015-08-20T17:51:24.833" Score="1" ViewCount="312" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jYAoN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jYAoN.png&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each Router is implemented with EIGRP, sharing its routes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Works: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP,R1,R2,R4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3 can't establishment a neighbor relationship with R1 and its route can't be shared. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same processes done with others routers I did with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3 -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#ping 10.0.0.13&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.0.0.13, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/8/22 ms&#xA;&#xA;R3#sh ip protocols    &#xA; Routing Protocol is &quot;eigrp  1 &quot; &#xA;      Outgoing update filter list for all interfaces is not set &#xA;      Incoming update filter list for all interfaces is not set &#xA;      Default networks flagged in outgoing updates  &#xA;      Default networks accepted from incoming updates &#xA;      EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0&#xA;      EIGRP maximum hopcount 100&#xA;      EIGRP maximum metric variance 1&#xA;    Redistributing: eigrp 1&#xA;      Automatic network summarization is not in effect  &#xA;      Maximum path: 4&#xA;      Routing for Networks:  &#xA;         10.0.0.12/30&#xA;      Routing Information Sources:  &#xA;        Gateway         Distance      Last Update &#xA;      Distance: internal 90 external 170    &#xA;&#xA;&#xA;R3#sh ip eigrp neighbors &#xA;    IP-EIGRP neighbors for process 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#ping 10.0.0.14&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.0.0.14, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 19/29/49 ms&#xA;&#xA;R1#sh ip protocols&#xA;&#xA;Routing Protocol is &quot;eigrp  1 &quot; &#xA;  Outgoing update filter list for all interfaces is not set &#xA;  Incoming update filter list for all interfaces is not set &#xA;  Default networks flagged in outgoing updates  &#xA;  Default networks accepted from incoming updates &#xA;  EIGRP metric weight K1=1, K2=0, K3=1, K4=0, K5=0&#xA;  EIGRP maximum hopcount 100&#xA;  EIGRP maximum metric variance 1&#xA;Redistributing: eigrp 1&#xA;  Automatic network summarization is not in effect  &#xA;  Maximum path: 4&#xA;  Routing for Networks:  &#xA;     10.0.0.4/30&#xA;     10.0.0.0/30&#xA;     10.0.0.8/30&#xA;     1.0.0.12/30&#xA;  Routing Information Sources:  &#xA;    Gateway         Distance      Last Update &#xA;    10.0.0.6        90            6397       &#xA;    10.0.0.10       90            8936       &#xA;    10.0.0.2        90            9818       &#xA;  Distance: internal 90 external 170&#xA;&#xA;R1#sh ip eigrp neighbors &#xA;IP-EIGRP neighbors for process 1&#xA;H   Address         Interface      Hold Uptime    SRTT   RTO   Q   Seq&#xA;                                   (sec)          (ms)        Cnt  Num&#xA;0   10.0.0.6        Se0/0/1        10   00:16:28  40     1000  0   5&#xA;1   10.0.0.10       Se0/1/1        10   00:16:26  40     1000  0   5&#xA;2   10.0.0.2        Se0/0/0        12   00:16:25  40     1000  0   5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I disabled &lt;code&gt;auto-summary&lt;/code&gt; thought was it, but it isn't. Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="14008" LastActivityDate="2018-10-08T23:25:14.567" Title="EIGRP - Neighbors Establishment Process" Tags="|cisco|routing|eigrp|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20785" PostTypeId="2" ParentId="20784" CreationDate="2015-08-20T18:04:00.687" Score="2" Body="&lt;p&gt;Would be helpful to see EIGRP config of R1 and R3 which can be displayed with &lt;code&gt;show run | section router eigrp 1&lt;/code&gt; or just &lt;code&gt;show run&lt;/code&gt; and copy the part from &quot;router eigrp 1&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that said I looks like you've entered the wrong network statements.&#xA;On R1 you can see: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Routing for Networks:  &#xA;  10.0.0.4/30&#xA;  10.0.0.0/30&#xA;  10.0.0.8/30&#xA;  1.0.0.12/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Should be 10.0.0.12/30 and not 1.0.0.12/30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On R1 under router eigrp 1, you should enter &lt;code&gt;network 10.0.0.12 0.0.0.3&lt;/code&gt; and remove any other network statements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason to remove any other network statements is because I can't see any other directly connected network than the serial links and you don't mention any loopbacks etc. The &quot;network x.x.x.x y.y.y.y&quot; statement tells EIGRP which interfaces it should enable EIGRP on and to advertise that network. &lt;/p&gt;&#xA;" OwnerUserId="14973" LastEditorUserId="14973" LastEditDate="2015-08-20T18:27:49.990" LastActivityDate="2015-08-20T18:27:49.990" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20786" PostTypeId="2" ParentId="20779" CreationDate="2015-08-20T18:19:53.910" Score="0" Body="&lt;p&gt;That is correct. IP fragments will contain only &lt;em&gt;IP&lt;/em&gt; fields. The TCP/UDP header will be in the first fragment only. So, you'd have to collect the entire frame (from all the fragments) to apply any L4 rules to it, &lt;em&gt;or&lt;/em&gt; track the entire session to apply the same rule to all the fragments. Cisco calls this &lt;em&gt;virtual fragment reassembly&lt;/em&gt;. Some/Many firewalls simply don't bother, and instead block &lt;em&gt;all&lt;/em&gt; fragments. (&quot;it's the only way to be sure&quot; :-))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(FWIW, all my routers/firewalls are explicitly configured to drop fragments. If you cannot do PMTUd correctly, I have no desire to talk to you.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-08-20T18:19:53.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20787" PostTypeId="2" ParentId="10245" CreationDate="2015-08-20T19:28:45.990" Score="2" Body="&lt;p&gt;The &quot;instability&quot; would only exists if both ends of the VPN tunnel are using different values for the subnets on either side (aka, the &quot;Encryption Domain&quot;).  Let me explain...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are &lt;strong&gt;three&lt;/strong&gt; main symptoms of instability you would encounter if the subnets don't match perfectly.  I'll start by describing a &quot;fully working&quot; tunnel, then list out the possible scenarios for a misconfigured tunnel where the subnets are not the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&#xA;&lt;H3&gt;Fully Working Example&lt;/H3&gt;&#xA;For this example, let's assume two sites are connecting to each other via VPN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Site A                                         Site B&#xA;10.1.0.0/24                               10.2.2.0/24&#xA;10.1.1.0/24                               10.2.3.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both sites have two /24 networks.  If SiteA is configured to list out each /24 individually, SiteA would have something like this in its Encryption Domain:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.0.0/24 --&amp;gt; 10.2.2.0/24&#xA;10.1.0.0/24 --&amp;gt; 10.2.2.0/24&#xA;10.1.1.0/24 --&amp;gt; 10.2.3.0/24&#xA;10.1.1.0/24 --&amp;gt; 10.2.3.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each of these pairs of /24 networks would each receive its own set of IPsec tunnels (one for outgoing traffic, one for incoming traffic), identified by a specific SPI (Security Parameter Index -- fancy term, its just a 8-hex digit label for a set of security algorithms and keys -- also known as a Security Association).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for example, SiteA might have something labeled like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SiteA Pairs                      Outbound SPI    Inbound SPI             &#xA;10.1.0.0/24 --&amp;gt; 10.2.2.0/24      0xBBBB1022      0xAAAA1022&#xA;10.1.0.0/24 --&amp;gt; 10.2.3.0/24      0xBBBB1023      0xAAAA1023&#xA;10.1.1.0/24 --&amp;gt; 10.2.2.0/24      0xBBBB1122      0xAAAA1122&#xA;10.1.1.0/24 --&amp;gt; 10.2.3.0/24      0xBBBB1123      0xAAAA1123&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If SiteB wanted to be completely correctly configured, must have the exact mirror configuration for its Encryption Domain&lt;/strong&gt;.  So in a perfect world, it would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SiteB Pairs                      Outbound SPI    Inbound SPI&#xA;10.2.2.0/24 --&amp;gt; 10.1.0.0/24      0xAAAA1022      0xBBBB1022&#xA;10.2.3.0/24 --&amp;gt; 10.1.0.0/24      0xAAAA1023      0xBBBB1023&#xA;10.2.2.0/24 --&amp;gt; 10.1.1.0/24      0xAAAA1122      0xBBBB1122&#xA;10.2.3.0/24 --&amp;gt; 10.1.1.0/24      0xAAAA1123      0xBBBB1123&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice, the SPIs and the networks are perfectly flipped.  The Outbound SPI that SiteA uses for 10.1.0.0/24 to speak to 10.2.2.0/24 is the Inbound SPI that SiteB uses for 10.2.2.0/24 to speak to 10.1.0.0/24.  This is by design.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;Symptom #1&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, &lt;strong&gt;lets assume SiteB is misconfigured, and decides to use 10.1.0.0/23 to summarize SiteA&lt;/strong&gt;.  From a purely subneting perspective, that &lt;em&gt;should&lt;/em&gt; be perfectly acceptable, right?  I mean, two /24's definitely add up to a single /23.  However, because of how IPsec negotiates its tunnels, it will cause some issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If SiteB initiates&lt;/strong&gt; by proposing a &lt;code&gt;10.2.2.0/24 --&amp;gt; 10.1.0.0/23&lt;/code&gt;, SiteA will &lt;em&gt;reject&lt;/em&gt; the request, because SiteB is trying to create a tunnel for something that is &quot;outside&quot; what SiteA intended to protect (remember, SiteA is still using the four, individually listed out /24 pairs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If SiteA initiates&lt;/strong&gt; by proposing a &lt;code&gt;10.1.0.0/24 --&amp;gt; 10.2.2.0/24&lt;/code&gt;, SiteB will &lt;em&gt;accept&lt;/em&gt; the request, because 10.1.0.0/24 is within what SiteB is configured to protect (10.1.0.0/23).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;(1)&lt;/em&gt;&lt;/strong&gt; So initially, the first set of symptoms will look like the tunnels can only build in one direction (if SiteA initiates).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;Symptom #2&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If SiteB is configured with the /23, and SiteA initiates... the tunnel will build.  And when 10.1.0.0/24 and 10.2.2.0/24 try to communicate.... everything will work just fine.  &lt;em&gt;BUT&lt;/em&gt;, remember, SiteB isn't considering 10.1.0.0/24 as a /24, it considers it as a /23.  So if at some point in the future, SiteB tries to send some traffic to 10.1.&lt;strong&gt;1&lt;/strong&gt;.0/24, it will use the pre-existing SPI/tunnel. Which means SiteA will receive something from SiteB with a source of 10.2.2.0/24 (&lt;em&gt;expected&lt;/em&gt;) and a destination of 10.1.1.0/24 (&lt;em&gt;unexpected&lt;/em&gt;).  Which in the Cisco world, will cause a syslog message like this to be generated:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;%PIX|ASA-4-402116: IPSEC: Received an protocol packet (SPI=spi, sequence &#xA;number= seq_num) from remote_IP (username) to local_IP. The decapsulated inner packet &#xA;doesn't match the negotiated policy in the SA. The packet specifies its destination &#xA;as pkt_daddr, its source as pkt_saddr, and its protocol as pkt_prot. The SA specifies &#xA;its local proxy as id_daddr /id_dmask /id_dprot /id_dport and its remote proxy as &#xA;id_saddr /id_smask /id_sprot /id_sport.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4772678&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;Details Here&lt;/em&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;(2)&lt;/em&gt;&lt;/strong&gt; The second set of symptoms would look like certain subnets can not communicate through the VPN, and your syslog is full of messages like the above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;Symptom #3&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same scenario as the last time, except this time SiteA decides it wants to send some traffic from 10.1.&lt;strong&gt;1&lt;/strong&gt;.0/24 to 10.2.2.0/24.  Remember, the already existing SPI from SiteA's perspective is 10.1.0.0/24 to 10.2.2.0/24.  So this new traffic will require a completely new tunnel.  SiteB will receive the request for a new tunnel/SPI and can either reject it, since it considers the original SPI for 10.1.0.0/23 (although, this is rare).  More often, SiteB will accept the request to build a &lt;em&gt;new&lt;/em&gt; tunnel from 10.1.0.0/23 to 10.2.2.0/24, which will cause SiteB to tear down the old tunnel.  And now you have the same set of symtoms in reverse, 10.1.1.0/24 speaking to 10.2.2.0/24 works, but 10.1.0.0/24 speaking to 10.2.2.0/24 doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;(3)&lt;/em&gt;&lt;/strong&gt; The third possible set of symptoms here would look like tunnels rebuilding &quot;randomly&quot;, and certain subnets keep loosing connectivity to the other side.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;NOTE:  A lot of the reactions of how the Firewall/Router will work will different depending on the vendor you are using. Most of the examples above are from my years of working with Cisco ASA and PIX products.  YMMV, but even still, the concepts are still relevant and apply&lt;/sub&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there you have it.  What it &lt;em&gt;should&lt;/em&gt; look like is a perfect mirror reflection of each other.  If you want to summarize the /24's into one /23, that is perfectly fine, as long as BOTH SIDES DO IT THE SAME WAY.  If one side decides to do something the other side isn't, you will run into some of the issues described above.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2015-08-20T20:04:05.933" LastActivityDate="2015-08-20T20:04:05.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20788" PostTypeId="2" ParentId="20763" CreationDate="2015-08-20T22:47:27.680" Score="2" Body="&lt;p&gt;Your Cisco 2500 WLC can authenticate wireless clients in many different ways, one of them being a captive web portal with username and password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Radius server can be used, but this might be overkill if you are only going to set it up for authentication on the wireless network. Users can also be defined directly on the WLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Explaining how to set this up is beyond the scope of this Q&amp;amp;A site, but have a look at the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-6/configuration-guide/b_cg76.html&quot; rel=&quot;nofollow&quot;&gt;Wireless Controller Configuration Guide&lt;/a&gt;, more specifically at the sections &quot;Managing User Accounts&quot; and &quot;Managing Web Authentication&quot;&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2015-08-20T22:47:27.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20789" PostTypeId="2" ParentId="20609" CreationDate="2015-08-20T23:48:27.243" Score="1" Body="&lt;p&gt;I will start by saying that you should not be disabling auto-negotiation with Gigabit connections. This is what the standard has to say (from 802.3-2012 Section Three, which you can reference &lt;a href=&quot;https://standards.ieee.org/about/get/802/802.3.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;37.1.4.4 User Configuration with Auto-Negotiation&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Rather than disabling Auto-Negotiation, the following behavior is suggested in&#xA;  order to improve interoperability with other Auto-Negotiation devices.&#xA;  When a device is configured for one specific mode of operation (e.g.&#xA;  1000BASE-X Full Duplex), it is recommended to continue using&#xA;  Auto-Negotiation but only advertise the specifically selected ability&#xA;  or abilities. This can be done by the Management agent only setting&#xA;  the bits in the advertisement registers that correspond to the&#xA;  selected abilities.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This means you should never use &lt;code&gt;speed 1000&lt;/code&gt; on Gigabit links. You could instead &lt;code&gt;speed auto 1000&lt;/code&gt;, but your expressed need has a better solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real problem is the following command on interface Gigabit0/0/0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  no negotiation auto&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remove the &lt;code&gt;speed 1000&lt;/code&gt;, the &lt;code&gt;duplex full&lt;/code&gt;, and the &lt;code&gt;no negotiation auto&lt;/code&gt; commands from the interface and instead use &lt;code&gt;negotiation forced&lt;/code&gt; so your interface looks like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interface GigabitEthernet0/0/0&#xA;  description WAN Metro Ethernet Circuit&#xA;  ! ...&#xA;  negotiation forced&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From Cisco documentation, the &lt;code&gt;forced&lt;/code&gt; keyword has the following effect (and I believe also adheres to the standard's recommendation):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Disables flow control and configures the Gigabit Ethernet interface in 1000/full-duplex mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This should meet your requirement of 1000/full with no flow control.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In re-reading your question, I realized you noted you did not seem to have the force command available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, I will still recommend removing the &lt;code&gt;no negotiation auto&lt;/code&gt; command and have your interface look like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interface GigabitEthernet0/0/0&#xA;  description WAN Metro Ethernet Circuit&#xA;  ! ...&#xA;  speed auto 1000&#xA;  duplex full&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-08-21T00:30:08.583" LastActivityDate="2015-08-21T00:30:08.583" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20790" PostTypeId="1" CreationDate="2015-08-21T00:31:32.110" Score="4" ViewCount="414" Body="&lt;p&gt;I have to set up our network in our new office. I'm no networking expert (developer), but I need some input and advice here for some things I wonder about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have purchased the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2 x Cisco CS200 smart-switch 24p&lt;/li&gt;&#xA;&lt;li&gt;1 x VoIP PBX (VoIP + 4 access points)&lt;/li&gt;&#xA;&lt;li&gt;1 x dual LAN router&lt;/li&gt;&#xA;&lt;li&gt;4 x 2.4 GHz Wi-Fi access points (Wi-F1 1)&lt;/li&gt;&#xA;&lt;li&gt;2 x 5 GHz access points (Wi-Fi 2)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Connected like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switch 1 (link port) is connected to the router&lt;/li&gt;&#xA;&lt;li&gt;Switch 2 (link port) is connected to Switch 1 (standard port)&lt;/li&gt;&#xA;&lt;li&gt;PBX/access points and Wi-Fi are all connected to the switches&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My questions are about the networking itself:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Am I killing the speed connecting SW1-&gt;SW2 through a regular port? Should I get a SFP cable, or does that not matter for this size of network?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Would it be smarter to connect SW2 directly to the router instead of to SW1?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The other questions I have are about (probably) VLANs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I would like to isolate the PBX/VoIP part, and prioritize traffic from this. The Cisco switches have some options for this, I think, but would this be smart to set a VLAN to those only, or is it overkill? Any directions to how I can do this? The most important thing is that the phone system gets highest priority on the network, and I don't want/need the people to be able to access it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I would like Wi-Fi 1 to be the primary network (a VLAN for this too?). Wi-Fi 2 is thought of as an extra fast network for our developers, with very few limitations, but I would like this network to be able to see the primary network (Wi-Fi 1), but I don't want Wi-Fi 1 to be able to see Wi-Fi 2. Can this be done?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The last question is very basic about VLANs. Am I correct in the understanding that the VLAN has to flow from the router? As the switches are not layer-3, so the router has to control the VLAN, right?&lt;/p&gt;&#xA;" OwnerUserId="16986" LastEditorUserId="8499" LastEditDate="2016-04-04T18:31:53.857" LastActivityDate="2018-11-21T18:01:00.170" Title="VLANs isolating networks (VoIP/Wi-Fi)" Tags="|switch|router|vlan|ethernet|voip|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20791" PostTypeId="1" CreationDate="2015-08-21T01:42:29.090" Score="1" ViewCount="298" Body="&lt;p&gt;Is it possible for the RV042G or similar router to be configured with multiple public IP addresses on the one WAN interface?&lt;/p&gt;&#xA;" OwnerUserId="17400" LastActivityDate="2016-07-20T04:40:13.797" Title="Cisco RV042G Multiple public IP" Tags="|cisco|router|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20792" PostTypeId="2" ParentId="16301" CreationDate="2015-08-21T02:21:27.290" Score="0" Body="&lt;p&gt;I was not able to gather this data through SNMP. Instead, I had to write an 'expect' script which connects to the AP via SSH, runs the command mentioned in the question, then scrapes the returned data.&lt;/p&gt;&#xA;" OwnerUserId="13516" LastActivityDate="2015-08-21T02:21:27.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20793" PostTypeId="1" CreationDate="2015-08-21T03:38:25.373" Score="4" ViewCount="2078" Body="&lt;p&gt;Is it possible to assign a switch port to a VLAN based on the fact that the host IP address is on a certain subnet?  I have found the following references from HP and Netgear, but I have been unable to find any such functionality for Cisco.  Please note that this is only academic at this time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kb.netgear.com/app/answers/detail/a_id/21609/~/what-is-an-ip-subnet-based-vlan-and-how-does-it-work-with-my-managed-swtich%3F&quot; rel=&quot;nofollow&quot;&gt;Netgear Link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In an IP subnet–based VLAN, all the end workstations in an IP subnet&#xA;  are assigned to the same VLAN. In this VLAN, users can move their&#xA;  workstations without reconfiguring their network addresses. IP subnet&#xA;  VLANs are based on Layer 3 information from packet headers. The switch&#xA;  makes use of the network-layer address (for example, the subnet&#xA;  address for TCP/IP networks) in determining VLAN membership. If a&#xA;  packet is untagged or priority tagged, the switch associates the&#xA;  packet with any matching IP subnet classification.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www8.hp.com/h20195/v2/GetPDF.aspx/4AA5-6424ENW.pdf&quot; rel=&quot;nofollow&quot;&gt;HP Link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In this method, packets are assigned to VLANs based on their source IP&#xA;  addresses and subnet masks. A port configured with IP Subnet-based&#xA;  VLANs assigns a received untagged packet to a VLAN based on the source&#xA;  address of the packet. Use this feature when packets from an IP Subnet&#xA;  or IP address must be transmitted in a VLAN. This feature is available&#xA;  only on hybrid ports, and it processes only untagged packets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17402" LastEditorUserId="8499" LastEditDate="2015-10-23T14:34:44.897" LastActivityDate="2016-10-18T04:57:22.697" Title="Subnet-based VLAN assignment on Cisco" Tags="|cisco|vlan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20796" PostTypeId="1" AcceptedAnswerId="21057" CreationDate="2015-08-21T05:14:26.100" Score="4" ViewCount="1048" Body="&lt;p&gt;So we just went through a big server move for a client - a couple of EX4200 switches we had installed from before-hand are now freaking out - all lights blinking always. Using WireShark I found that none of the arp requests are being answered. The central router is an SRX 550 which I am positive is online, but completely unpingable (I know this because i'm using traffic sent through it to type this right now). Any thoughts on why this could happen? It doesn't appear to be a broadcast storm, though every so often WireShark highlihgts a DHCP packet in red sent as a broadcast from 0.0.0.0 to 255.255.255.255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;I've attached a rough drawing of what my network looks like. The NS25 up top is really just a router-nothing exciting happens there. The SRX is used as a gateway/NAT/internal router, it looks like it isn't responding to &quot;who has&quot; arps, an any VLAN. I'll also add that there's another &quot;management&quot; network in front of the SRX but behind the NS25 which is working well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/MfIl3.jpg&quot; alt=&quot;networkTopology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit2:&lt;/strong&gt;&#xA;I am able to hit the public side of my SRX, but not the private side, not even the devices I have a 1-to-1 NAT set with. What's going on here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit3:&lt;/strong&gt;&#xA;I finally got into my SRX' management console - it says that the aggregated link I have to my access switches is down, even though there are activity lights on both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit4:&lt;/strong&gt;(boy, these are fun)&#xA;Using Juniper's knowledge base #&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB19798&quot; rel=&quot;nofollow noreferrer&quot;&gt;19798&lt;/a&gt;, I found that my SRX is not receiving the MAC addresses of the EX4200 (cli show interfaces ae0 shows 'Actor MAC and in Active LACP mode, with Partners all in Passive with MACS of 00:00:00 etc.). This is officially &lt;/p&gt;&#xA;" OwnerUserId="17405" LastEditorUserId="17405" LastEditDate="2015-08-21T06:33:14.813" LastActivityDate="2015-08-31T21:44:36.793" Title="arp Requests not Being Answered After Server Move" Tags="|juniper|arp|switching|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20800" PostTypeId="1" CreationDate="2015-08-21T09:15:15.713" Score="2" ViewCount="1163" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FwEI9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FwEI9.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in this scenario R4 redistribute 8.0.0.0/8 network from an external source into EIGRP domain, R2 and R3 are doing mutual redistribution from OSPF into EIGRP and vice versa, so we have mutual redistribution on multiple devices, when R2 and R3 learn 8.0.0.0/8 network, they put it in their Routing table as EIGRP external route, the question is regarding mutual redistribution on both R2 and R3 they both must advertise that to R1 as OSPF external route, so R1 should have 2 routes toward 8.0.0.0/8 network in its Routing table, and also based on this event, R2 must learn 8.0.0.0/8 as E2 and also R3 must have that route as E2 too,which will result in having a loop but this is not happening, so what's the reason could be possibly? &lt;/p&gt;&#xA;" OwnerUserId="17410" LastActivityDate="2016-02-17T16:58:16.533" Title="Redistribution from OSPF into EIGRP and vice-versa issues" Tags="|ospf|eigrp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20801" PostTypeId="1" AcceptedAnswerId="20802" CreationDate="2015-08-21T10:44:54.353" Score="1" ViewCount="11845" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Z40jQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z40jQ.png&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This's problem&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SW_R2(config)#int vlan 2&#xA;SW_R2(config-if)#ip addr 172.16.0.129 255.255.255.240&#xA;SW_R2(config-if)#int vlan 3&#xA;SW_R2(config-if)#ip addr 172.16.0.145 255.255.255.224&#xA;% 172.16.0.128 overlaps with Vlan2&#xA;SW_R2(config-if)#&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using a Switch Layer 3, setting up Ip address in three Vlans. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.16.0.128/29 and 172.16.0.144/27 are in differents subnets, I tested that address in a Router, setting in a FastEthernet Interface, and works!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan2&#xA; ip address 172.16.0.129 255.255.255.240&#xA;!&#xA;interface Vlan3&#xA; no ip address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't SEE where is my error, Please any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="8499" LastEditDate="2018-12-22T03:01:17.740" LastActivityDate="2018-12-22T03:01:17.740" Title="Overlaps with VLANS" Tags="|cisco|vlan|ip|subnet|packet-tracer|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20802" PostTypeId="2" ParentId="20801" CreationDate="2015-08-21T10:51:22.140" Score="2" Body="&lt;p&gt;The error lies in your subnets&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.16.0.145 with subnet mask 255.255.255.224 give you a network 172.16.0.128/27&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network you set on VLAN 2 is a subnet of the one you try to set on VLAN3 , so the overlap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT in response to the comment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network 172.16.0.128/27 can be subnetted in 2 networks &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;172.16.0.128/28&lt;/li&gt;&#xA;&lt;li&gt;172.16.0.144/28&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So you can use those two subnets on VLAN2 and VLAN3 but not the original network and one of its subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Change your subnet mask to 255.255.255.240 and you will have no overlap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need a bigger subnet (for more than 14 hosts) then you need to use the next-available /27 network which is 172.16.0.160/27 (I.E. 172.16.0.160 with subnet mask 255.255.255.224)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2 in response to other comment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to subnet the /26 to a /27 plus two /28 you can use&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;172.16.0.128/28&lt;/li&gt;&#xA;&lt;li&gt;172.16.0.144/28&lt;/li&gt;&#xA;&lt;li&gt;172.16.0.160/27&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;172.16.0.128/27&lt;/li&gt;&#xA;&lt;li&gt;172.16.0.160/28&lt;/li&gt;&#xA;&lt;li&gt;172.16.0.176/28&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that due to the network address and the broadcast address a /28 allows 14 hosts (including the one that will be used as gateway) and a /27 allows 30.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2015-08-21T14:02:00.943" LastActivityDate="2015-08-21T14:02:00.943" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="20803" PostTypeId="2" ParentId="20801" CreationDate="2015-08-21T10:51:22.423" Score="1" Body="&lt;p&gt;Your int vlan 3 IP address falls in a subnetwork of 172.16.0.128/27 with possible host range of 172.16.0.129-172.16.0.159.&#xA;It definetely overlapps with int vlan 2 IP address you've assigned&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2015-08-21T10:51:22.423" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20804" PostTypeId="2" ParentId="20800" CreationDate="2015-08-21T10:53:49.033" Score="2" Body="&lt;p&gt;Since you don't provide any configuration I can't give you any specific answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general when you perform two-way redisitrbution between two network protocols at multiple points you tag the routes so that when it reaches another redistribution point it will be filtered and hence not redistributed back into the original routing domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 should have two routes for 8.0.0.0/8 and possibly both in the routing table if it's the same cost. R2 and R3 will only have one route each with next hop of R4 in their routing tables since EIGRP has Administrative Distance of 90 which is more believable than 110 of OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;Two-way redistribution at multiple points is always a bit tricky to understad but I'm gonna try to explain what I think is happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3 retrieves route with ad 170 from R4, redistributes into OSPF with ad 110. R1 receives a route to 8.0.0.0/8 with ad 110 and passes it to R2. R2 has now got 2 routes: ad 110 via ospf and ad 170 via eigrp, the ospf route will be inserted into routing table and then passed along to R4 vid ad 170 since it's external. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;R4 retrieves the ad 170 advertisement from R2 but since it's has got a shorter path to 8.0.0.0/8 it will continue to advertise it's own path instead of the one coming from R2.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2 retrieves route with ad 170 from R4 and route with ad 110 from R1 for network 8.0.0.0/8 and hence will insert route from R1 into routing table instead of the one from R4 and will not redistribute the eigrp route since it has already got a &quot;better&quot; route coming from R1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ofcourse it could be the other way around depending on who is first.&lt;/p&gt;&#xA;" OwnerUserId="14973" LastEditorUserId="14973" LastEditDate="2015-08-21T12:41:31.270" LastActivityDate="2015-08-21T12:41:31.270" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="20805" PostTypeId="2" ParentId="20800" CreationDate="2015-08-21T13:09:47.593" Score="0" Body="&lt;p&gt;I found the answer to my question here &lt;a href=&quot;https://learningnetwork.cisco.com/thread/72466&quot; rel=&quot;nofollow&quot;&gt;Cisco Learning Network&lt;/a&gt; but do not know how to copy or use that stuff here in this forum!&lt;/p&gt;&#xA;" OwnerUserId="17410" LastActivityDate="2015-08-21T13:09:47.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20806" PostTypeId="2" ParentId="20801" CreationDate="2015-08-21T14:13:00.563" Score="1" Body="&lt;p&gt;The other answers are correct.  To find a subnet address of any IP address, mask the given address with the mask.  This means that any subnet with a /27 (32-bit address - 27-bit mask = 5 addreess bits, 2^5=32) must start at a multiple of 32.  The 144 address is not a multiple of 32.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any such question, it helps to do it in binary.  Just AND the address with the mask to get the subnet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-08-21T14:13:00.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20808" PostTypeId="1" CreationDate="2015-08-21T19:05:27.780" Score="3" ViewCount="1298" Body="&lt;p&gt;When NAT router is used for global address translation, two networks may have same private IP address. Am I right or wrong?&lt;/p&gt;&#xA;" OwnerDisplayName="user17357" LastEditorUserId="8499" LastEditDate="2018-03-19T18:10:07.683" LastActivityDate="2018-03-19T18:10:07.683" Title="Are private IP addresses unique?" Tags="|ipv4|ip|nat|ip-address|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20809" PostTypeId="2" ParentId="20808" CreationDate="2015-08-21T19:10:52.120" Score="2" Body="&lt;p&gt;My internal private IP addressing and another person's internal IP addressing may be the same or similar, yes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a NAT router or Firewall, you have an inside interface and an outside interface. Using an ACL, or depending on your manufacturer's OS, you determine what internal traffic source is NAT'd to an external address when it crosses the Firewall or NAT router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Out on the internet your public addresses are bought and assigned; there are no overlaps in Public address space. Overlaps in Public address space would cause serious problems. &lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-08-21T19:10:52.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20810" PostTypeId="2" ParentId="20808" CreationDate="2015-08-21T19:11:06.453" Score="3" Body="&lt;p&gt;As long as whatever routable address space either network is using on the &quot;External&quot; side is unique, yes, the &quot;Internal&quot; address space may overlap.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2015-08-21T19:11:06.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20811" PostTypeId="1" CreationDate="2015-08-21T19:42:29.817" Score="1" ViewCount="257" Body="&lt;p&gt;Last week we had a power outage. When power came back, our HP switches came back online but with a problem. A few VLANs in our HP 5406 switches did not get an IP address from DHCP server, the other VLAN on the same switch can get the IP address  from DHCP server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our HP switches are connected to Cisco 3750 Layer 3 switch which is connected to ASA and to Internet. I did everything to check whether the problem could be in DHCP server. I also checked the switches configurations with spanning tree configs as well but nothing changed the situation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After spending a lot of time on troubleshooting I created new VLANs on that trouble maker switches and assigned the ports on that VLANs as an untagged and it started working again. Still I don't understand what was the problem. I am wondering that if we again face the power outage issue than this problem might be repeat again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody help me identify the root cause of the issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Firmware we are using on that switches are:&#xA;K.15.13.0005&lt;/p&gt;&#xA;" OwnerUserId="17420" LastEditorDisplayName="user10222" LastEditDate="2015-08-25T05:07:48.883" LastActivityDate="2015-08-25T09:40:40.843" Title="VLAN issue in HP 5406 switch after a power outage" Tags="|switch|vlan|hp|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20813" PostTypeId="1" CreationDate="2015-08-22T01:25:39.463" Score="4" ViewCount="18758" Body="&lt;p&gt;I want to know what is first after STP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are just three devices, switch and two hosts.&#xA;A switch is not configurated and two hosts have each IP by static.&#xA;Of course, two hosts are connected to the switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From here, &#xA;A host is going to ping to B host.&#xA;At the time, what is first between ARP and ICMP?&#xA;Will A host ping after ARP or omit ARP?.....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&#xA;Terry&lt;/p&gt;&#xA;" OwnerUserId="17426" LastActivityDate="2015-08-22T03:34:13.797" Title="What is first? ARP vs ICMP" Tags="|arp|ping|icmp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20815" PostTypeId="2" ParentId="20813" CreationDate="2015-08-22T03:34:13.797" Score="9" Body="&lt;p&gt;&lt;strong&gt;Short Answer&lt;/strong&gt;: The answer is that it depends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Longer Explanation&lt;/strong&gt;: Naturally, when a device is sending out unicast IP traffic, it needs to add the layer 2 headers (including destination MAC address) to the frame before sending it on the wire. This IP-to-MAC mapping is exactly what the ARP process is there to provide to the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on this statement, one might think that this naturally means that ARP traffic will automatically be sent before any ICMP traffic. However, once a host learns this IP-to-MAC mapping, it inserts it into an ARP table for some period of time. So a host will check this ARP table for such a mapping first and only send out ARP if there is no entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in your example, let's say that &lt;em&gt;Host A&lt;/em&gt; has no entry for &lt;em&gt;Host B&lt;/em&gt;'s IP address in the ARP table. When &lt;em&gt;Host A&lt;/em&gt; pings &lt;em&gt;Host B&lt;/em&gt; the traffic exchange is like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Host A              Host B&#xA; ARP_Request  ---&amp;gt; &#xA;              &amp;lt;---   ARP_Reply&#xA; ICMP_Echo    ---&amp;gt; &#xA;              &amp;lt;---   ICMP_Echo_Reply&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now let's say that &lt;em&gt;Host A&lt;/em&gt; does have an entry for &lt;em&gt;Host B&lt;/em&gt;'s IP address in the ARP table. When &lt;em&gt;Host A&lt;/em&gt; pings &lt;em&gt;Host B&lt;/em&gt; the traffic exchange is instead like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Host A              Host B&#xA; ICMP_Echo    ---&amp;gt; &#xA;              &amp;lt;---   ICMP_Echo_Reply&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So to answer your specific question.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Will A host ping after ARP or omit ARP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Host A&lt;/em&gt; will either send the ICMP after ARP or omit ARP depending on the status of the entry for &lt;em&gt;Host B&lt;/em&gt; in it's ARP table.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-08-22T03:34:13.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20819" PostTypeId="1" AcceptedAnswerId="20845" CreationDate="2015-08-22T16:41:12.430" Score="2" ViewCount="6706" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/R1mLi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/R1mLi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm reformulating the question, once the previous provoked a little confusion. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I didn't find a way to subnet &lt;code&gt;172.16.1.0/26&lt;/code&gt; between two interfaces. MY thought was to set device's gateway to the next device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3 - 172.16.1.1 255.255.255.192&#xA;Server Fa0/0 - 172.16.1.2 255.255.255.192 ; 172.16.1.1&#xA;Server Fa0/1 - 172.16.1.3 255.255.255.192 ; 172.16.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Triggered it : &lt;strong&gt;PT uses 1st port as the default port to forward traffic to the outside network. The 2nd port is only for forwarding traffic within the subnet. Configuring default gateway on 2nd port is insignificant.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to subnet my network for what all traffic can pass and be filtered?&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="14008" LastEditDate="2015-08-23T17:17:12.823" LastActivityDate="2017-11-21T12:40:39.437" Title="How to Configure a Server with two NIC" Tags="|cisco|packet-tracer|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20820" PostTypeId="1" AcceptedAnswerId="20872" CreationDate="2015-08-22T18:19:40.907" Score="1" ViewCount="73" Body="&lt;p&gt;This is a total newbie question. When phones, radios, computers, satellites, and the like transmit signals, how often are they &quot;aimed&quot; at the receiver (a satellite, radio tower, etc), as opposed to transmitting information in every direction?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not read any books about this, but a fairly thorough Google search oddly did not result in any articles that were particularly relevant. I don't know of any aiming device on phones and radios, so making them aim seems unlikely. However, phones and GPS can receive signals from very far away, which seems hard for unarmed signals to achieve.&lt;/p&gt;&#xA;" OwnerUserId="17437" LastActivityDate="2015-08-24T23:40:31.763" Title="How often are signals aimed at receivers?" Tags="|wireless|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20822" PostTypeId="1" CreationDate="2015-08-22T20:02:46.080" Score="0" ViewCount="1453" Body="&lt;p&gt;In my college, private IP is used in the range of 10.x.x.x. Every department uses their own routers for their students. The router has IPs in the range of 10.x.x.x.. But, it gives dynamic IPs to the connected devices. My work is find out all the devices connected to the college LAN having an application installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what I am trying is broadcasting of UDP packets.&#xA;I will get broadcast address of the current device and send a datagram packet at a particular port. The device will receive the packet from other devices too and from that packet I will know the IP address. But, the issue is in finding a device connected to another router. I don't think it's going to work. How can I find other devices and send data to them?&lt;/p&gt;&#xA;" OwnerUserId="17439" LastActivityDate="2015-08-28T08:10:12.333" Title="Finding a device in a LAN having multiple routers" Tags="|routing|lan|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="20823" PostTypeId="1" AcceptedAnswerId="20825" CreationDate="2015-08-22T21:15:50.657" Score="0" ViewCount="130" Body="&lt;p&gt;This is a home networking question. I have a linksys G router that I would like to use as wireless repeater and wired hub.  I can connect it to my wired cat5 connection in my house. The primary wireless signal is weak in the area but I figured that because it was connected to the wired signal it could become an access point that repeats the wired signal. &#xA;How can I set this router up to best eliminate the wireless dead zone in the room? (I figured repeating the weak primary signal would not help but the wired connection is fast.)&lt;/p&gt;&#xA;" OwnerUserId="17441" LastActivityDate="2015-08-22T22:06:32.907" Title="can I use a cat5 connected router to repeat a wireless signal?" Tags="|wireless|" AnswerCount="1" CommentCount="1" ClosedDate="2015-08-23T20:46:59.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="20825" PostTypeId="2" ParentId="20823" CreationDate="2015-08-22T21:55:08.117" Score="0" Body="&lt;p&gt;Yes! using Ethernet is much better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeater can work fast as Ethernet too only if the repeater have something called &quot;full bridging&quot;, &amp;amp; good signal to repeat, anyway cat5! speed around 10Mbps and 100Mbps, if you need something higher than that use CAT5e&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want your wireless cover big areas make sure you have choose the right channel and band, try to put it in higher place and in the middle of the room or house.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;B transfer rate 11mbps 150 feet 2.4GHz  &lt;/li&gt;&#xA;&lt;li&gt;G transfer rate 54mbps 150    feet 2.4GHz&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15229" LastEditorUserId="15229" LastEditDate="2015-08-22T22:06:32.907" LastActivityDate="2015-08-22T22:06:32.907" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20826" PostTypeId="2" ParentId="20820" CreationDate="2015-08-23T01:52:49.893" Score="2" Body="&lt;p&gt;Phones and computers use omnidirectional (or more-or-less omnidirectional) antennas. Access points and especially cellular sites my use directional antennas, though most access points are omnidirectional as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Satellites (at least modern ones, as compared to Sputnik, or good old &lt;a href=&quot;http://www.nasa.gov/missions/science/f-satellites.html&quot; rel=&quot;nofollow&quot;&gt;Echo-1&lt;/a&gt; which was just a radio-reflecting balloon in orbit) will, if covering the whole earth, use an antenna that covers the earth, not all of space. And they may use an array of multiple antennas covering smaller portions of the earth, depending what services they are offering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point to point wireless links are nearly always directional antennas, since the direction to the other antenna is known and fixed.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-08-23T01:52:49.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20827" PostTypeId="1" CreationDate="2015-08-23T06:13:45.103" Score="2" ViewCount="28387" Body="&lt;p&gt;I am trying to write a simple program that displays the front panel of cisco devices remotely (in this case a 3560 switch). So I need to read the status of each port via snmp and turn on the LED on my GUI accordingly.&#xA;After some search I came to use the &quot;ifOperStatus&quot; with OID 1.3.6.1.2.1.2.2.1.8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the problem is that this OID returns &quot;1:up&quot; as soon as a cable is plugged into the port and does not reflect the different status the port might have including:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Blinking green: Link has activity &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solid amber: Port is faulty&lt;/p&gt;&#xA;&#xA;&lt;p&gt;etc,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any clue or hint on which OIDs I should use?&lt;/p&gt;&#xA;" OwnerUserId="17447" LastActivityDate="2015-08-26T15:03:55.460" Title="how to get port/interface status of cisco switch via snmp" Tags="|cisco|snmp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20830" PostTypeId="2" ParentId="20822" CreationDate="2015-08-23T11:30:01.007" Score="1" Body="&lt;p&gt;Ok try &lt;a href=&quot;http://narzan.weebly.com/uploads/3/7/9/8/37988127/mini_sniffer.rar&quot; rel=&quot;nofollow noreferrer&quot;&gt;this program&lt;/a&gt;, I have build small program that will let you sniffing your network. wireshark it's hard to use.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Simply have a router and don't connect it to anything.&lt;/li&gt;&#xA;&lt;li&gt;connect a mobile have that app you want to detect.&lt;/li&gt;&#xA;&lt;li&gt;Connect PC to that router.&lt;/li&gt;&#xA;&lt;li&gt;Open my Mini Sniffer&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How to use Mini sniffer&#xA;&lt;a href=&quot;https://i.stack.imgur.com/HWTnE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HWTnE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;put the IP of your phone &quot;or the IP of your router to detect everything on the network&quot;&lt;/li&gt;&#xA;&lt;li&gt;choose the card network you are using. &quot;if your card is wrong the&#xA;text will be red&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now Mini sniffer will work automatically just wait a cobble of second&#xA;try to open anything from your mobile &quot;youtube or anything on the web&quot;&#xA;sniffer now will show you the port and the data your mobile use.&#xA;there is a lot of garbage data just ignore it.&#xA;Try to open the specific app you want to detect and see witch data this app usually use&#xA;Build your android app or what ever you want, that's it&lt;/p&gt;&#xA;" OwnerUserId="15229" LastActivityDate="2015-08-23T11:30:01.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20831" PostTypeId="2" ParentId="20762" CreationDate="2015-08-23T11:34:28.593" Score="0" Body="&lt;p&gt;I assume that you want to affect INBOUND internet traffic, and you know how to handle your OUTBOUND traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then the easiest way to accomplish this would be to do &quot;&lt;strong&gt;as-path prepending&lt;/strong&gt;&quot; on your Cisco router when it's advertising to its upstream. Then, your INBOUND internet traffic would definitely take the shortest as-path towards you, which will be through the MikroTik router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see an example, see &lt;a href=&quot;http://blog.ipspace.net/2008/02/bgp-essentials-as-path-prepending.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="17343" LastActivityDate="2015-08-23T11:34:28.593" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20832" PostTypeId="2" ParentId="20793" CreationDate="2015-08-23T12:01:24.420" Score="-2" Body="&lt;p&gt;Short answer: &lt;strong&gt;Impossible&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pasting the answer from &lt;a href=&quot;https://supportforums.cisco.com/discussion/9675401/subnet-based-vlan-catalyst-switch&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;First of all it is not possible without assigning the ports to vlans.&#xA;  Any computer connected to any switch port need to be in some vlan.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Now it depends on you that you want to configure static vlan on ports&#xA;  or dynamic vlans which is called VMPS.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;What you want is possible that any pc connected to any port will&#xA;  request from the VMPS server to automatically get binded to vlan and&#xA;  port and you will have to create interface vlan 100 and interface vlan&#xA;  200 on any layer 3 switch with different subnets.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Also to conf VMPS server you have to have high end switch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17343" LastActivityDate="2015-08-23T12:01:24.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20833" PostTypeId="2" ParentId="20575" CreationDate="2015-08-23T12:42:02.870" Score="1" Body="&lt;p&gt;In case you can't setup a full-mesh iBGP and passing tables to SVC routers, I would suggest to setup an IGP between Core and SVC Routers and let it load-balance the default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you can have iBGP to SVC routers and publish the default route. So, if you get multipath enabled and the metrics to both Core Routers match, then you will also have two default routes on SVC routers. Keep in mind that you need to have it full-mesh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding HA in core layer, definitely iBGP between Core Routers would be the best strategy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One point I forgot to add is, in case you are using Cisco routers, you might also need BGP relaxed best-path selection, which allows load-sharing between two similar routes from different ASs. You can read more &lt;a href=&quot;http://1cisco.com/index.php/bgp-multipath-load-sharing-in-cisco/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="17343" LastEditorUserId="17343" LastEditDate="2015-08-23T16:13:16.883" LastActivityDate="2015-08-23T16:13:16.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20835" PostTypeId="1" AcceptedAnswerId="20837" CreationDate="2015-08-23T13:25:24.713" Score="-1" ViewCount="2883" Body="&lt;p&gt;I don't understand what is the need of IP address when each machine has it's own unique MAC  address. Can't it be used to identify a node on a network uniquely without the need of IP address ?&lt;/p&gt;&#xA;" OwnerUserId="17451" LastEditorUserId="33" LastEditDate="2015-08-23T14:10:58.410" LastActivityDate="2015-08-23T14:10:58.410" Title="Why do we need IP address when we have a MAC address?" Tags="|ipv4|mac-address|" AnswerCount="1" CommentCount="0" ClosedDate="2015-08-23T13:53:06.213" ContentLicense="CC BY-SA 3.0" />
  <row Id="20836" PostTypeId="1" CreationDate="2015-08-23T13:34:35.313" Score="2" ViewCount="882" Body="&lt;p&gt;I have always used eBGP (with private AS numbers) to route between branches and headquarter sites. However, after reading the Cisco CCNP ROUTE Foundation Learning Guide, it states that best practice is to run an IGP between WAN sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using OSPF as an example, I would imagine area 0 would be the headquarters location and each branch office would have its own area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion, this is not optimal due to &lt;em&gt;the nature of the business unit&lt;/em&gt;. For example, Site A and Site B are both single-homed to HQ via an MPLS connection. Everything is fine. However, a new BW-heavy application is being deployed at both of these sites. The business unit decides to create a private connection between site A and site B. Since they are both in non-zero OSPF areas, no type 3 LSAs will be advertised. Thus you will have to make a virtual link which introduces new design considerations and makes the design less scalable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With eBGP, you would simply create another eBGP peering relationship and easily manipulate route preference over that link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do you experienced engineers out there think about this? IGP to branch offices or EGP? Also, would the connection type matter to you? For example MPLS vs VPN over Internet?&lt;/p&gt;&#xA;" OwnerUserId="889" LastEditorUserId="8499" LastEditDate="2017-08-06T17:50:09.127" LastActivityDate="2017-08-06T17:50:09.127" Title="Routing between branches" Tags="|routing|bgp|ospf|wan|igp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20837" PostTypeId="2" ParentId="20835" CreationDate="2015-08-23T13:38:53.123" Score="0" Body="&lt;p&gt;IP addresses are explicitly not designed to be bound by hardware where as MAC addresses are. MAC addresses can be changed temporarily most of the time but each device is supposed to have a globally unique factory assigned MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, MAC is specific to Ethernet, and while it is now the defacto Layer 2 encapsulation method, it wasn't always the case and you never know if something better will come along in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quite simply, it is a lot easier and very little overhead to do the same thing for people inside your network segment as outside your network segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some other possible reasons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You may want to use IP's to help remember what something is (the router ends with .1 kind of stuff)&lt;/li&gt;&#xA;&lt;li&gt;You may want to run two networks on one segment that do not talk to each other (you can do that with IP via Subnets)&lt;/li&gt;&#xA;&lt;li&gt;MAC addresses are not easy to remember.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;MAC addresses are used to send Ethernet frames between two stations in the same local area network. Each station has a unique MAC address that is used to identify who is the sender (source address) and who is the receiver (destination address). But Ethernet frames can't travel between networks. One computer in a local network never sees the MAC of a computer which is on another network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addresses are used to send IP packets to another station over the Internet, which is a collection of networks (hence the name &quot;inter networks&quot;, from where Internet is derived). Contrary to MAC addresses, IP frames aren't limited to the local network. While travelling around the world, IP packets pass through many smaller networks, many of them using Ethernet (like inside your home or office LAN). When it is the case, the network stack puts the IP packet inside an Ethernet frame, using the MAC address to send to the next stop (what we call 'next hop'). The gateway strips the Ethernet header, rocering the original IP packet, and forwards it over the next network, until it reaches the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;References:&#xA;&lt;a href=&quot;https://superuser.com/questions/544155/why-do-we-need-ip-addresses-to-communicate-within-the-local-network-segment&quot;&gt;https://superuser.com/questions/544155/why-do-we-need-ip-addresses-to-communicate-within-the-local-network-segment&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.quora.com/What-is-the-difference-between-IP-address-and-MAC-address-and-how-they-are-used&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.quora.com/What-is-the-difference-between-IP-address-and-MAC-address-and-how-they-are-used&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17343" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2015-08-23T13:38:53.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20838" PostTypeId="1" AcceptedAnswerId="20840" CreationDate="2015-08-23T14:12:04.610" Score="0" ViewCount="99" Body="&lt;p&gt;I am reading about computer networks. I saw some simple HTTP socket programs(In c gcc). I saw a strange thins on those programs they are using URL directly without any DNS lookup. How this thing works? are dns lookup's implemented by builtin library functions?or else the application programmer need not to worry about DNS someone else may be the isp do it for the programmer?&lt;/p&gt;&#xA;" OwnerUserId="17453" LastEditorUserId="17453" LastEditDate="2015-08-25T13:59:36.993" LastActivityDate="2015-08-25T13:59:36.993" Title="Who will do DNS lookup?" Tags="|dns|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20840" PostTypeId="2" ParentId="20838" CreationDate="2015-08-23T14:44:49.520" Score="0" Body="&lt;p&gt;Yes. Most libraries for network requests do an implicit &lt;code&gt;get_host_by_name&lt;/code&gt; (which is the libc function) or similar function for retrieving the IP address. This means that you ask your operating system for the IP. It will then use the internal DNS software to retrieve the address.&lt;/p&gt;&#xA;" OwnerUserId="10219" LastActivityDate="2015-08-23T14:44:49.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20841" PostTypeId="2" ParentId="20836" CreationDate="2015-08-23T16:19:52.900" Score="2" Body="&lt;p&gt;I have had also similar situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It depends on different factors. I assume that your topology won't scale that much, so I would suggest keep going with BGP as you mentioned good pros for that.&#xA;Also, you can implement BFD to have faster convergence and dead peer detection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the connection type, VPN over Internet would by last option, because different drawbacks such as fragmentation, delay, complex management, etc.&lt;/p&gt;&#xA;" OwnerUserId="17343" LastActivityDate="2015-08-23T16:19:52.900" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20842" PostTypeId="2" ParentId="20836" CreationDate="2015-08-23T17:26:13.483" Score="1" Body="&lt;p&gt;While I'm not a fan of IGP over WAN circuits (mostly due to the low circuit speeds which could cause convergence problems if there are many branch sites), I &lt;em&gt;have&lt;/em&gt; seen this work well.  There is no single answer of eBGP, iBGP, or IGP for a WAN since there are a lot of factors to consider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traditionally, the WAN topology would be a hub-and-spoke with the headquarters serving as the hub (forcing site-to-site traffic to hairpin and creating a single point of failure).  More modern WAN topologies leverage the telco MPLS VPN offerings which can save money by eliminating the expensive point-to-point circuits in favor of less expensive MPLS cloud connections.  Besides money, an advantage of this is to give you any-to-any site-to-site connections and guarantees for things like QoS that you just can't find on a traditional Internet VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think where you are getting off track with OSPF is that you are envisioning the headquarters site as Area 0, but you are forgetting that OSPF works on router interfaces. If you set up the WAN interfaces of each site's WAN router in Area 0, and the LAN interfaces of each site, including the headquarters site, into a local stub area, this makes the WAN itself Area 0.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-08-23T17:26:13.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20845" PostTypeId="2" ParentId="20819" CreationDate="2015-08-23T21:34:52.773" Score="2" Body="&lt;p&gt;Change the server Fa0 to 172.16.1.66 255.255.255.192  The default gateway is 172.16.1.65.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fa1 has the original address 172.16.1.3 255.255.255.192. No default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Change the router interface fa0/0 to 172.16.1.65 255.255.255.192&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also need a static route on the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 172.16.1.0 255.255.255.192 172.16.1.66&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-08-26T01:28:47.237" LastActivityDate="2015-08-26T01:28:47.237" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="20846" PostTypeId="2" ParentId="20827" CreationDate="2015-08-23T21:44:12.513" Score="0" Body="&lt;p&gt;IF-MIB and CISCO-IF-EXTENSION-MIB (and OLD-CISCO-INTERFACE-MIB) will contain 99.999% of everything you can get via SNMP. In short, there's no OID to give you the LED state of the switch. However, you can retrieve numerous OIDs to figure it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Fetch &lt;code&gt;dashboard.shtml&lt;/code&gt; from one of your switches if you want to see how Cisco's Device Manager does it. You will not be impressed.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-08-23T21:44:12.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20847" PostTypeId="1" AcceptedAnswerId="20853" CreationDate="2015-08-23T21:47:08.007" Score="1" ViewCount="302" Body="&lt;p&gt;I have a question regarding fast retransmit. For example if packet#9 is lost. We send 3 ACK/NACK#9 after each other. But my question is, are we sending 3 &lt;strong&gt;acks or nacks&lt;/strong&gt; in a row with fast retransmit? Because teachers and &quot;experts&quot; always tell me diffrently. &lt;/p&gt;&#xA;" OwnerUserId="17134" LastActivityDate="2015-08-24T06:10:02.393" Title="Fast retransmit: NACK OR ACK?" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20849" PostTypeId="1" AcceptedAnswerId="20850" CreationDate="2015-08-24T00:47:52.993" Score="0" ViewCount="553" Body="&lt;p&gt;Dear all experts out there,&#xA;Is there any tool or API to infer AS-path between any 2 arbitrary Autonomous System?&lt;/p&gt;&#xA;" OwnerUserId="14512" LastActivityDate="2015-09-23T04:43:04.483" Title="Is there any tool or API to infer AS-path between any 2 arbitrary Autonomous System?" Tags="|routing|asymmetric-routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20850" PostTypeId="2" ParentId="20849" CreationDate="2015-08-24T02:42:48.060" Score="2" Body="&lt;p&gt;Decent &lt;code&gt;traceroute&lt;/code&gt; implementations (eg: Linux, OSX) will provide the &lt;code&gt;-a&lt;/code&gt; flag to enable AS Path Resolution eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bendale@lojack&amp;gt; traceroute -a 8.8.8.8&#xA;traceroute to 8.8.8.8 (8.8.8.8), 64 hops max, 52 byte packets&#xA;1   [AS1] 10.0.0.254 (10.0.0.254)  5.374 ms  2.632 ms  4.363 ms&#xA;2   [AS0] 10.0.254.10 (10.0.254.10)  1.159 ms  1.106 ms  1.040 ms&#xA;3   [AS0] 10.192.2.209 (10.192.2.209)  1.846 ms  1.732 ms  1.586 ms&#xA;4   [AS0] 10.192.2.221 (10.192.2.221)  1.815 ms  1.808 ms  1.680 ms&#xA;5   [AS0] 10.1.254.6 (10.1.254.6)  2.349 ms  2.237 ms  2.086 ms&#xA;6   [AS0] 10.1.254.1 (10.1.254.1)  1.803 ms  2.305 ms  1.690 ms&#xA;7   [AS9268] *.*.*.* (*.*.*.*)  3.658 ms  2.630 ms  2.403 ms&#xA;8   [AS9268] *.*.*.* (*.*.*.*)  2.649 ms  17.428 ms  2.789 ms&#xA;9   [AS9268] te3-0-0.pe1.400har.syd.core.overthewire.net.au (180.214.88.45)  14.679 ms  14.429 ms  14.608 ms&#xA;10  [AS56220] as15169.nsw.ix.asn.au (218.100.52.3)  14.700 ms  15.524 ms  14.633 ms&#xA;11  [AS15169] 216.239.40.223 (216.239.40.223)  14.669 ms&#xA;    [AS15169] 216.239.41.77 (216.239.41.77)  15.065 ms&#xA;    [AS15169] 216.239.40.233 (216.239.40.233)  15.303 ms&#xA;12  [AS15169] 209.85.251.53 (209.85.251.53)  16.045 ms&#xA;    [AS15169] 72.14.237.7 (72.14.237.7)  15.305 ms&#xA;    [AS15169] 216.239.41.17 (216.239.41.17)  15.773 ms&#xA;13  [AS15169] google-public-dns-a.google.com (8.8.8.8)  15.932 ms  18.645 ms  15.831 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;however, this will only give you an answer in one direction (from your local AS to the remote AS).  The return path could be (and often is) completely different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good network service providers will often offer Looking Glasses that you can use to examine their routing tables and/or run traceroute from for troubleshooting purposes, but unfortunately not all do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following resources may help:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.bgp4.as/looking-glasses&quot; rel=&quot;nofollow&quot;&gt;http://www.bgp4.as/looking-glasses&lt;/a&gt; - fairly comprehensive list of Looking Glasses around the world.  If you can't find one on the network you are troubleshooting, try to find one on an adjacent network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://www.traceroute.org&quot; rel=&quot;nofollow&quot;&gt;http://www.traceroute.org&lt;/a&gt; - online traceroute tool plenty of global coverage &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://www.robtex.com/as&quot; rel=&quot;nofollow&quot;&gt;https://www.robtex.com/as&lt;/a&gt; - Search for an AS in the search box eg: &quot;AS7474&quot; and then click the first link that comes up.  Shows routing-policy, Peers, Customers, and a graph showing upstream connectivity &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-08-24T02:42:48.060" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20851" PostTypeId="1" CreationDate="2015-08-24T03:06:11.940" Score="2" ViewCount="2330" Body="&lt;p&gt;I have currently configured a PIX501's ethernet0 to DHCP so it gets an IP from my ISP via a Cable Modem.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP --- --&amp;gt; [ethernet0/dhcp] | PIX501 | [ethernet1/192.168.1.2] --&amp;gt; [Layer 3 ethernet1/1 192.168.1.3] | PA-200 | --&amp;gt; Internal network&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to pass ALL traffic (no filtering) through from the Internet via &lt;code&gt;Ethernet0&lt;/code&gt; to &lt;code&gt;Ethernet1&lt;/code&gt; on the PIX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PIX &lt;code&gt;Ethernet1&lt;/code&gt; will then be connected to a Palo Alto firewall (ethernet1/1) which will perform NAT/filtering etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think there will be some double-NAT involved here.  My understanding is that double-NAT will cause issues if I need to access an internal server.&lt;/p&gt;&#xA;" OwnerUserId="17466" LastEditorUserId="8499" LastEditDate="2016-03-22T22:03:10.560" LastActivityDate="2016-03-22T22:03:10.560" Title="Traffic through two firewalls and double-NAT" Tags="|nat|palo-alto|pix|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20853" PostTypeId="2" ParentId="20847" CreationDate="2015-08-24T06:10:02.393" Score="0" Body="&lt;p&gt;Depends on your protocol. I guess you talk about TCP. In this case it is ACK, because there are only ACKs in TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fast retransmit, as well as as ACK/NACK as details of your specific network protocol. Therefore you could in principle combine them as you wish. Nevertheless some combinations make more sense than others and some parts are required if you use others (e.g. having more than one packet in flight between sender and receiver will force you to use something like sequence numbers).&lt;/p&gt;&#xA;" OwnerUserId="10219" LastActivityDate="2015-08-24T06:10:02.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20854" PostTypeId="1" CreationDate="2015-08-24T06:18:26.030" Score="0" ViewCount="423" Body="&lt;p&gt;I'm trying to establish, from a security and networking perspective, if it is advisable to run a internet VRF on a PE router(Cisco 7609 PE) or to use a dedicated router instead(such as a mikrotek CCR1072-1G-8S+). Please assist if you can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="17469" LastActivityDate="2015-10-24T14:39:15.157" Title="Internet to ISP WAN Router or VRF?" Tags="|routing|router|wan|vrf|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20858" PostTypeId="2" ParentId="20854" CreationDate="2015-08-24T10:09:40.450" Score="2" Body="&lt;p&gt;it is depend &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;you must verify the current CPU usage before any routing edit , if it is in suitable rang (not exceed 10%-15% ) then you can start to create VRF routes&lt;/li&gt;&#xA;&lt;li&gt;if you create all your routes in one router you will get one benefit and one drawback. benefit is that you can point to this router by only one route from your core layer , drawback is that you will have single point of fail  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="509" LastEditDate="2015-08-24T12:46:04.127" LastActivityDate="2015-08-24T12:46:04.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20859" PostTypeId="2" ParentId="20851" CreationDate="2015-08-24T10:49:47.330" Score="2" Body="&lt;p&gt;i think you have pool of real IP with GW and DNS so &#xA;no you don't need any NAT on the PIX . you just need to confirm the next with ISP&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the interface of the PIX which faced the modem has private IP (some thing like  192.168.X.X ) and sure the modem will be your GW in same range&lt;/li&gt;&#xA;&lt;li&gt;use one of the real IP which you get from the ISP to bring internet to you and assign it  to the interface connected to the palo alto &lt;/li&gt;&#xA;&lt;li&gt;in the palo alto configure the interface which is connected to the PIX with other Real IP , configure default root to PIX and sure perform NATing for what ever Subnet you need to publish&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;i just wonder why you configure DHCP on the PIX , in such case PIX acting as next hub for your FW and may any L3 device even the FW acting as your DHCP server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HqJ9A.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HqJ9A.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i such case my dear PIX act as a router , just route out subnets get from palo alto to outside and vice versa . in such senario NAT occured only on palo alto which already has real IP as i mentained before&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="33" LastEditDate="2015-11-23T19:34:05.770" LastActivityDate="2015-11-23T19:34:05.770" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20860" PostTypeId="2" ParentId="20793" CreationDate="2015-08-24T11:15:53.530" Score="2" Body="&lt;p&gt;i think you mean dynamic vlan membership , you can find detailed information about it on this link &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/vmps.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/vmps.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-08-24T11:15:53.530" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20861" PostTypeId="2" ParentId="20142" CreationDate="2015-08-24T11:33:52.150" Score="2" Body="&lt;p&gt;very depend on the AP  , for example in Cisco AP you configure the port connecting the AP as a trunk and the MGM Vlan (10.0.0.0/24) will be configured as a Native Vlan on this port and just allow the data Vlan (192.168.1.0/24).   &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-08-24T11:33:52.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20863" PostTypeId="2" ParentId="20827" CreationDate="2015-08-24T13:40:18.837" Score="2" Body="&lt;p&gt;Have you looked at this OID ? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Specific Object Information &#xA;Object  clsPortLedStatus&#xA;OID 1.3.6.1.4.1.9.5.11.1.7.1.1.3&#xA;Type    INTEGER&#xA;Permission  read-only&#xA;Status  current&#xA;Values  1 : unknown&#xA;2 : on&#xA;3 : off&#xA;MIB CISCO-RHINO-MIB &#xA;Description &quot;Indicates the status of the LED.&#xA;Unknown(1) indicates either the LED status is &#xA;not supported or the status is none of the&#xA;defined.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the related :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Specific Object Information &#xA;Object  clsPortLedType&#xA;OID 1.3.6.1.4.1.9.5.11.1.7.1.1.2&#xA;Type    INTEGER&#xA;Permission  read-only&#xA;Status  current&#xA;Values  1 : ledTx&#xA;2 : ledRx&#xA;3 : ledLink&#xA;4 : led100Mbps&#xA;5 : ledRxLoss&#xA;6 : ledRxFullOut&#xA;7 : ledRxSync&#xA;8 : ledFullDuplex&#xA;9 : ledOptDetect&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately the supported images/platforms are very limited : &lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/AdvancedSearch?MibSel=4682&quot; rel=&quot;nofollow&quot;&gt;http://tools.cisco.com/ITDIT/MIBS/AdvancedSearch?MibSel=4682&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say fake it, for link activity. &#xA;Poll interface stats (bytes or frames or packets in or out) and make the light in your application blink as long as either is increasing.&lt;br&gt;&#xA;(Though I suppose technically some control traffic might or might not cause the physical LED to blink - for example, do BPDUs alone count towards link activity ? I do not know - I can check later, if you'd like.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched and browsed the SNMP Object Navigator (&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&quot; rel=&quot;nofollow&quot;&gt;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&lt;/a&gt;) last night for you, but found nothing suitable (not to say it doesn't exist), and any potentially interesting ones were marked as inaccessible (&quot;Permission not-accessible&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're feeling especially crafty, and want the utmost accuracy, you could probably setup an ambient light sensor / &quot;light to frequency converter&quot; in front of each crucial port LED, and code to have that info passed to your application.&lt;br&gt;&#xA;But that's not scalable, so it's probably easier to fake it. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;EDIT, ROUND 2 !&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;How about : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://goo.gl/ugTgQg&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;&quot;This object is used to indicate the current color of a LED.&quot;&lt;/em&gt;&lt;/a&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Object  c2900PortVisualIndicator&#xA;OID 1.3.6.1.4.1.9.9.87.1.4.1.1.24&#xA;Type    INTEGER&#xA;Permission  read-only&#xA;Status  current&#xA;Values  1 : notused&#xA;2 : black&#xA;3 : amber&#xA;4 : green&#xA;MIB CISCO-C2900-MIB&#xA;Description &quot;This object is used to indicate the current color of&#xA;a LED. If a LED is flashing, the value of this object will&#xA;represent the color of the LED at that instant in time.&#xA;The following conventions indicate port status:&#xA;Link healthy returns green(4)&#xA;Link activity usually green(4), but may return black(2).&#xA;Link faulty alternating green(4)/amber(3)&#xA;Port disabled returns amber(3)&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://goo.gl/XyO1sY&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;&quot;The color of the LED.&quot;&lt;/em&gt;&lt;/a&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Object  ceExtEntityLEDColor&#xA;OID 1.3.6.1.4.1.9.9.195.1.3.1.2&#xA;Type    INTEGER&#xA;Permission  read-only&#xA;Status  mandatory&#xA;Values  1 : off&#xA;2 : green&#xA;3 : amber&#xA;4 : red&#xA;MIB CISCO-ENTITY-EXT-MIB-V1SMI&#xA;Description The color of the LED.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://goo.gl/93YrnT&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;&quot;An integer value that describes the color of the&#xA;display&quot;&lt;/em&gt;&lt;/a&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Type    CDisplayColor&#xA;Status  current&#xA;Values  1 : unknown&#xA;2 : white&#xA;3 : red&#xA;4 : green&#xA;5 : yellow&#xA;6 : amber&#xA;7 : blue&#xA;8 : greenAndAmber&#xA;MIB CISCO-ENTITY-DISPLAY-MIB&#xA;Description &quot;An integer value that describes the color of the display.&#xA;&#xA;'greenAndAmber' - Indicates that the display color toggles between green and amber.&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As well as,&lt;br&gt;&#xA;&lt;em&gt;mrStackUnitBasePortVisualIndicatorGreenMap,&lt;br&gt;&#xA;mrStackUnitBasePortVisualIndicatorAmberMap,&lt;br&gt;&#xA;mrStackUnitExpansionPortVisualIndicatorGreenMap,&lt;br&gt;&#xA;mrStackUnitExpansionPortVisualIndicatorAmberMap, and&lt;br&gt;&#xA;mrStackUnitActivityVisualIndicator&lt;/em&gt;&lt;br&gt;&#xA;all under &lt;a href=&quot;http://goo.gl/EzA3Nm&quot; rel=&quot;nofollow&quot;&gt;mrStackUnitEntry&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For ATM :&lt;br&gt;&#xA;&lt;a href=&quot;http://goo.gl/hE8b0X&quot; rel=&quot;nofollow&quot;&gt;ciscoAtmIfXmitLed&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://goo.gl/AbqURQ&quot; rel=&quot;nofollow&quot;&gt;ciscoAtmIfRecvLed&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://goo.gl/w07GP7&quot; rel=&quot;nofollow&quot;&gt;ciscoAtmIfCdLed&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, this nugget, from &quot;CISCO-WIRELESS-EXP-MIB&quot; :&lt;br&gt;&#xA;&quot;When the CISCO-LED-MIB.my becomes available and supports the functionality the LED group needs, the LED group will be migrated into that.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently mention of a MIB that never came to be. &lt;/p&gt;&#xA;" OwnerUserId="4831" LastEditorUserId="4831" LastEditDate="2015-08-25T21:22:37.617" LastActivityDate="2015-08-25T21:22:37.617" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20865" PostTypeId="2" ParentId="20808" CreationDate="2015-08-24T15:54:02.650" Score="2" Body="&lt;p&gt;Yes, you are correct. This is why it is critically important in business to consider this in network architecture planning. It's awful after a merger to create VPN links between offices when they all use 10.0.0.0/8 for instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep your prefixes as small as you require (with space for predicted growth), and if you are setting up multiple offices, even if you think they'll never be connected, use different prefixes. Also, use an IPAM software or at minimum a spreadsheet to keep track of what prefixes are where.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't want to have to do multi-layer NAT and other trickery to connect overlapping subnets, unless absolutely necessary. Guaranteed you'll get &quot;we can't change our IPs&quot;, so what you're left with is a hard-to-document setup that resembles spaghetti.&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-08-24T15:54:02.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20866" PostTypeId="2" ParentId="20791" CreationDate="2015-08-24T16:25:17.477" Score="1" Body="&lt;p&gt;Doubtful.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some proper Cisco routers allow for an &quot;ip address ... secondary&quot; command (&lt;a href=&quot;http://goo.gl/Bqd1VK&quot; rel=&quot;nofollow&quot;&gt;http://goo.gl/Bqd1VK&lt;/a&gt;), but that's not quite the same, and I'm not seeing any mention of it in the RV042G's documentation.  &lt;/p&gt;&#xA;" OwnerUserId="4831" LastActivityDate="2015-08-24T16:25:17.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20868" PostTypeId="1" CreationDate="2015-08-24T19:19:10.103" Score="3" ViewCount="1911" Body="&lt;p&gt;At our ISP's we use Huawei s5300 switches, and we want to upgrade our setup to accomplish the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Place a number of different customers/users under same VLAN. &lt;/li&gt;&#xA;&lt;li&gt;Assign one static-public IP address per client/customer and prevent them&#xA;use another IP address from the same subnet.&lt;/li&gt;&#xA;&lt;li&gt;Isolate each client/interface in the same VLAN, effectively having them as if&#xA;they are part of different VLAN. The goal is to prevent&#xA;broadcast-based network auto-discovery protocols that can locate all&#xA;hosts under the same broadcast domain.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The idea is to: a) save on IP addresses since if we put each client in a separate VLAN we &quot;lose&quot; at least 3 IPs, and b) avoid using MUX VLAN (Private VLAN in Cisco terms) due to configuration complexity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are stuck at point 3. If customers terminate the public IP on a server, then for instance Customer A can see the server of Customer B,C,D in Windows network folder. Here is a sample configuration for clients connected to interface 0/0/3 and 0/0/4. As we learned from the net the command &quot;port-isolate enable group 1&quot; may do the trick but for us it had no effect - we need isolation to work across multiple switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;[Huawei Router]&#xA;interface Vlanif2 (The subnet is based on public IP addresses)&#xA;ip address X.X.X.X 255.255.255.0&#xA;........&#xA;[Huawei Switch 1]&#xA;user-bind static ip-address X.X.X.19 interface GigabitEthernet0/0/3&#xA;interface GigabitEthernet0/0/3&#xA;  port link-type access&#xA;  port default vlan 2&#xA;  port-isolate enable group 1&#xA;  arp anti-attack check user-  bind enable&#xA;[Huawei Switch 2]&#xA;user-bind static ip-address X.X.X.20 interface GigabitEthernet0/0/4&#xA;interface GigabitEthernet0/0/4&#xA;  port link-type access&#xA;  port default vlan 2&#xA;  port-isolate enable group 1&#xA;  arp anti-attack check user-bind enable&#xA;&amp;lt;/code&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDIT] 1. Code snippet changed - commands segmented into more devices. 2. Added information that port isolation should work across multiple switches.&lt;/p&gt;&#xA;" OwnerUserId="17483" LastEditorUserId="17709" LastEditDate="2016-05-18T04:06:50.700" LastActivityDate="2019-05-04T14:02:55.713" Title="Prevent network auto-discovery between members of VLAN" Tags="|vlan|broadcast|" AnswerCount="4" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="20869" PostTypeId="2" ParentId="20868" CreationDate="2015-08-24T20:29:30.343" Score="1" Body="&lt;p&gt;&quot;port-isolate enable group 1&quot; command drops communication between the member ports and only communicate with non member ports.  Configuration done by you is correct but you can implement this in your network if you have only one switch or else it not going to be useful for you. Normally this should drop the communication between A and B. If you are using only one switch in your network try to ping A to B and B to A if you are able to ping each other even after implementing port isolate then contact TAC it could be a bug in IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IF you have mutliple switches then it will work differently, please look at below for better idea.&#xA;Scenario:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A, B are in switch1 on vlan 10 and port isolated&lt;/li&gt;&#xA;&lt;li&gt;C, D are in swtich2 on vlan 10 and port isolated&lt;/li&gt;&#xA;&lt;li&gt;A IP x.x.x.10&lt;/li&gt;&#xA;&lt;li&gt;B IP x.x.x.11&lt;/li&gt;&#xA;&lt;li&gt;C IP x.x.x.12&lt;/li&gt;&#xA;&lt;li&gt;D IP x.x.x.13&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here A can communicate with C and D but not B. C can communicate with A and B but not D.&lt;/p&gt;&#xA;" OwnerUserId="17484" LastActivityDate="2015-08-24T20:29:30.343" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20870" PostTypeId="2" ParentId="20808" CreationDate="2015-08-24T20:43:14.827" Score="0" Body="&lt;p&gt;You can't use same private IP pool under one NAT device for two networks. If you have multiple NAT devices then you can use same private IP pool under each NAT device.&lt;/p&gt;&#xA;" OwnerUserId="17484" LastActivityDate="2015-08-24T20:43:14.827" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20871" PostTypeId="1" CreationDate="2015-08-24T23:08:20.990" Score="1" ViewCount="489" Body="&lt;p&gt;I want to wake up and see the devices connected on my local network, using NMAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I execute this command :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo nmap -sn -PU[7] -PE 10.11.204.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(extract from the man page :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;sn: Ping Scan - disable port scan&lt;/li&gt;&#xA;&lt;li&gt;PS/PA/PU/PY[portlist]: TCP SYN/ACK, UDP or SCTP discovery to given ports&lt;/li&gt;&#xA;&lt;li&gt;PE/PP/PM: ICMP echo, timestamp, and netmask request discovery probes)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, NMAP finds perfectly devices. But lets say device A is found, if I disconnect A from the network (airplane mode), and execute the exact same NMAP command : NMAP will continue to find A.&#xA;If I keep executing the command, A will be found as online (&quot;Host is up (0.0047s latency).&quot;) during some time, and after 2/3 minutes it will not be found anymore by NMAP.&#xA;And what is really strange is that I have information about latency overtime even when I have manually disconnected A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that there is somewhere a timeout, maybe the arp-timeout ?&#xA;And one thing I dont understand, even if there is a timeout why does NMAP gives me a latency when A is physically disconnected ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="16335" LastActivityDate="2022-10-05T09:57:00.783" Title="Why does NMAp find disconnected devices?" Tags="|ethernet|arp|ip-link-local|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20872" PostTypeId="2" ParentId="20820" CreationDate="2015-08-24T23:40:31.763" Score="2" Body="&lt;p&gt;First, I want to clarify that no antenna transmits in &quot;every direction&quot; as you put it. Such an antenna is called an &lt;a href=&quot;https://en.wikipedia.org/wiki/Isotropic_radiator&quot; rel=&quot;nofollow&quot;&gt;isotropic antenna&lt;/a&gt; and is purely a hypothetical construct used to provide a comparison in measuring/comparing radio transmit power. Actual physical antennas will always have directions/areas where they provide little to no signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are most likely referencing is the class of antenna that are known as &lt;a href=&quot;https://en.wikipedia.org/wiki/Omnidirectional_antenna&quot; rel=&quot;nofollow&quot;&gt;omnidirectional antennas&lt;/a&gt;. These will typically provide 360 degrees of coverage on the horizontal plane (or azimuth) and significantly less on the vertical plane (or elevation). If interested, you can learn more about understanding antenna patterns from this &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/wireless/aironet-antennas-accessories/prod_white_paper0900aecd806a1a3e.html&quot; rel=&quot;nofollow&quot;&gt;Cisco document&lt;/a&gt; or &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/wireless/aironet-antennas-accessories/product_data_sheet09186a008008883b.html&quot; rel=&quot;nofollow&quot;&gt;Cisco's Aironet Antenna Guide&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, when you &quot;aim&quot; a radio signal, it isn't like aiming something like a laser. RF never follows a straight line from point A to point B. Even the most directional antennas will radiate signal out covering a pattern that will be measured in degrees and will have &quot;lobes&quot; that provide weaker signals to the sides or rear of the main lobe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third, I want to highlight that many wireless devices use bidirectional communication and are both a transmitter and a receiver (i.e. transceiver). So your examples of receivers (satellite, radio tower, etc) are also typically transmitters as well. This carries over to making your cell phone and any 802.11 wireless devices both transmitters and receivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, back to the heart of your question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;how often are they &quot;aimed&quot; at the receiver&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In some sense, fairly often. Most cellular towers consist of a number of separate transceiver (transmitter/receiver) arrays designed to provide a combined 360 degrees of coverage. 802.11 wireless access points are often positioned or utilize antennas to provide coverage primarily in certain directions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you seem to be looking more for even more &quot;targetted&quot; transmissions such as point-to-point installations. These are considerably rarer when compared to other types of installations for two reasons. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Primarily because when using highly directional antennas, there is little room for either end point to change location, so both typically have to be in fixed locations (even some directional wireless with end points on skyscrapers can have degraded performance on windy days).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondarily, because they are in fixed locations and transmitting in a fixed direction, they can only do so to sites in that specific direction. Any site that is not in that direction will receive little to no coverage making a point-to-multipoint installations of this type even rarer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast, point-to-multipoint installations with omnidirectional antennas (or an array of transceivers covering 360 degrees) allows coverage to devices that are mobile and in any general direction around the installation point.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-08-24T23:40:31.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20873" PostTypeId="5" CreationDate="2015-08-25T00:47:32.310" Score="0" Body="&lt;p&gt;IOS XR is the operating system run on a number of Cisco's large, service-provider focused platforms.  It was originally developed to solve (or at least mitigate) many of the problems inherent in these systems, such as very high interface and routing scale, large numbers of distributed linecards and forwarding ASICs, and very large configurations.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Platforms:  The CRS {1,3,X}, the NCS 6000, and the ASR 9000 all run exclusively IOS XR.  The Cisco 12000 series also runs IOS XR as well as some (very old) classic IOS code.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions using this tag should be specific to the IOS XR operating system.  Many of the commands, syntax, and management interfaces for IOS XR are quite different than the other major IOS versions/trains.&lt;/p&gt;&#xA;" OwnerUserId="13955" LastEditorUserId="13955" LastEditDate="2015-08-25T06:19:32.193" LastActivityDate="2015-08-25T06:19:32.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20874" PostTypeId="4" CreationDate="2015-08-25T00:47:32.310" Score="0" Body="IOS XR is the operating system run on a number of Cisco's large, service-provider focused platforms.    Questions using this tag should be specific to the IOS XR operating system.  Many of the commands, syntax, and management interfaces for IOS XR are quite different than the other major IOS versions/trains." OwnerUserId="13955" LastEditorUserId="13955" LastEditDate="2015-08-25T05:07:58.583" LastActivityDate="2015-08-25T05:07:58.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20879" PostTypeId="2" ParentId="16655" CreationDate="2015-08-25T06:47:29.507" Score="0" Body="&lt;p&gt;Mikrotik has a feature called Bandwidth control.&lt;br&gt;&#xA;On &lt;a href=&quot;http://www.mikrotik.com/testdocs/ros/3.0/qos/queue.php&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; page you will find examples you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look for: Equal bandwidth sharing among users&lt;/p&gt;&#xA;" OwnerUserId="2693" LastActivityDate="2015-08-25T06:47:29.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20882" PostTypeId="1" AcceptedAnswerId="20883" CreationDate="2015-08-25T09:06:20.690" Score="0" ViewCount="1257" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How to configure a local password security for the switch, can it be accessible with a default password?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can the web browser interface password be deleted?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17496" LastActivityDate="2015-09-24T10:14:58.583" Title="HP ProCurve switch 2848 J4904A" Tags="|hp-procurve|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20883" PostTypeId="2" ParentId="20882" CreationDate="2015-08-25T09:27:14.003" Score="1" Body="&lt;p&gt;You can create two levels of access, &lt;strong&gt;Manager&lt;/strong&gt; and &lt;strong&gt;Operator&lt;/strong&gt;.&#xA;You can do this first via the web interface.&#xA;Also you can disable web access by &lt;strong&gt;no web-management&lt;/strong&gt; in CLI or by setting Web Agent Enabled parameter to No via we-management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please take a look at this file:&#xA;&lt;a href=&quot;http://ftp.hp.com/pub/networking/software/59906023-1004-Management-Guide.pdf&quot; rel=&quot;nofollow&quot;&gt;http://ftp.hp.com/pub/networking/software/59906023-1004-Management-Guide.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17343" LastActivityDate="2015-08-25T09:27:14.003" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20884" PostTypeId="1" CreationDate="2015-08-25T09:32:43.480" Score="0" ViewCount="94" Body="&lt;p&gt;We are using an application running on a local server, which is linked to a domain-name via a DMZ in a router. Of course, the link between the ISP IP address and the domain name is established as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since yesterday (Monday) morning, we came to realize that the Web application was not available for the different agencies. We thought something went wrong with the router, but swapping the latter didn't solve the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, we didn't really understand why pinging on the domain-name wouldn't yield any response.&#xA;When using a command-line prompt, my computer (and other computers) don't receive any response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using tools online to obtain the IP address from the domain name returns correct results. Are those results real time ? or could they be cached on a regular basis?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the afore-mentioned, what do you think the problem could be?&lt;/p&gt;&#xA;" OwnerUserId="17497" LastActivityDate="2015-08-25T20:19:22.867" Title="Host Can't be Resolved Anymore" Tags="|router|ip|dns|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20885" PostTypeId="2" ParentId="20142" CreationDate="2015-08-25T09:37:24.653" Score="0" Body="&lt;p&gt;You have to configure AP's to work in managment vlan and on switch set 2 Vlan's on AP's port: tagged managment vlan, and 1 (lan) vlan untagged for users.&lt;/p&gt;&#xA;" OwnerUserId="17499" LastActivityDate="2015-08-25T09:37:24.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20887" PostTypeId="1" CreationDate="2015-08-25T09:58:53.587" Score="6" ViewCount="3275" Body="&lt;p&gt;I monitor about 150 routers with MPLS links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To check if connection is established, I'm pinging loopbacks visible only from WAN. If a loopback is not responding, I can see which link is not working properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are better possibilities? Pinging public address is not possible, as I noticed, and, sometimes, I still have router-edge router connection, but BGP is not established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are other monitoring options?&lt;/p&gt;&#xA;" OwnerUserId="17499" LastEditorUserId="8499" LastEditDate="2016-03-23T04:34:55.037" LastActivityDate="2017-10-16T18:22:23.257" Title="How to check MPLS connections?" Tags="|bgp|mpls|monitoring|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20889" PostTypeId="2" ParentId="20868" CreationDate="2015-08-25T10:24:22.023" Score="-2" Body="&lt;p&gt;Have you tried a L2 access list ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Allow all traffic to and from default-gateway mac.&#xA;Block all other traffic.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Put this on each customer port.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-08-25T10:24:22.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20890" PostTypeId="1" AcceptedAnswerId="29708" CreationDate="2015-08-25T10:44:40.210" Score="4" ViewCount="5347" Body="&lt;p&gt;Hello network engineers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an IPSEC VPN tunnel between two offices, the HQ is a fortigate 200B(os:v5.0,build0292 (GA Patch 9)) and the branch is fortigate 30D(os:5.2.3). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both are now on static IPs. The branch side has an PPPoE though. &lt;code&gt;auto-reconnect is also enabled on the branch side&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue we're facing since day 1 is the tunnel works fine for the day but the next morning is down and does not come up on its own at all, until some minor change is made to the phase1 configuration on the branch side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a case locked with the fortigate TAC since then, it's over 2 months of submitting logs to them and no solution has been provided at all. Submitting logs to them is now a daily thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running debugging during the time of the issue on the branch 30D the initial out put is &lt;code&gt;2015-08-24 21:44:34 ike 0:mandhana: could not locate phase1 configuration&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could find only this &lt;a href=&quot;https://forum.fortinet.com/tm.aspx?m=117799&quot; rel=&quot;nofollow&quot;&gt;one similar case&lt;/a&gt; on their forums, my branch side is already on 5.2.3 so the solution of updating to 5.2 which worked there won't work for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Really appreciate any help towards what could be causing this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;UPDATE 4th NOV 2015:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The wan interface has an static IP address but its through PPPoE, so i guess there's some sort of ip address renewal still happening even though the ip address which the wan interface gets is still the same and is static.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the ip is renewed the tunnel goes down and doesn't come up on its own for some reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TAC has now declared this as a bug and tells me to wait till FortiOS 5.4.0 is released.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am of the opinion though that this is something to do with hardware itself. If this was a bug we would have more of such cases here and elsewhere but i couldn't find any.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the fortinet TAC's logging info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Hi,&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;`&#xA;    -Here is what the issue started occurring today morning.&#xA;    2015-09-08 18:29:41 is PST time(your device has PST time zone), not IST time zone. So actually issue started exactly at 7:30AM today IST time.&#xA;    ---/---&#xA;    2015-09-08 18:29:41 ike 0: IP 59.x.x.x (59) is down ----&amp;lt;&amp;lt;&amp;lt;&amp;lt; probably the pppoe interface went down as the 'IP is down' in the debug logs.&#xA;    2015-09-08 18:29:41 ike 0:mandhana: deleting&#xA;    2015-09-08 18:29:41 ike 0:mandhana: flushing&#xA;    2015-09-08 18:29:41 ike 0:mandhana:79: send IPsec SA delete, spi c21221f8 ---&amp;lt;&amp;lt;&amp;lt;&amp;lt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-The below debug logs confirms that default route was no longer available in FGT as per 'len=92: error 101:Network is unreachable'&#xA;-So it's highly possible that default route was removed from FGT routing table.&#xA;---/---&#xA;2015-09-08 18:29:41 ike 0:mandhana:79: could not send IKE Packet(ISAKMP SA DELETE-NOTIFY):59.x.y.z:500-&amp;gt;14.x.z.c:500, len=92: error 101:Network is unreachable&#xA;---/---&#xA;&#xA;Above continues till next 1 min.&#xA;&#xA;-Next min, we see the following error&#xA;&#xA;2015-09-08 18:30:16 ike 0:mandhana: could not locate phase1 configuration.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;`&#xA;    I suspect, there is an issue with pppoe related -(routes, ip address, policy) when this issue occurs. I will login to fortigate tomorrow at 9:00 am, and figure it out that. Please don't make any changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other option(i think its best) I advised you earlier is that configure the modem in L3 mode, do the nat port forwarding to Fortigate using the public IP. doing this way, avoids the pppoe config in fortigate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have port forward (https, http, VPN traffic) from modem to FGT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15569" LastEditorUserId="15569" LastEditDate="2015-11-04T05:17:05.150" LastActivityDate="2018-06-08T18:42:34.050" Title="Fortigate 30D IPSEC VPN could not locate phase1 configuration" Tags="|vpn|ipsec|fortigate|" AnswerCount="1" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="20891" PostTypeId="2" ParentId="20854" CreationDate="2015-08-25T10:46:35.040" Score="1" Body="&lt;pre&gt;&lt;code&gt;&amp;gt; from a security and networking perspective&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think is totally acceptable, most providers of mpls infrastructure, provide internet access to clients using VRF/MPLS to separate production and internet traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just verify that the management IP of the router is only accessible through the VRF you require it to be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IOS devices will accept all VTY connections by default. However, if an access-class is used, the assumption is that connections should only arrive from the global IP instance.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2015-08-25T13:55:31.713" LastActivityDate="2015-08-25T13:55:31.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20892" PostTypeId="1" CreationDate="2015-08-25T13:29:47.877" Score="8" ViewCount="7041" Body="&lt;p&gt;We have a two-location business with our head quarters in Arlington, and a remote office in Dallas. Currently, both of our offices are running a sonicwall NSA 2600 and hold a VPN tunnel between each other (using the sonicwalls). We recently purchased a point-to-point connection from our ISP between the two locations. Essentially each modem has a port that is a direct link to the other with a dedicated 100mb pipe. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wanting to replace the VPN tunnel with what I assume would be an additional LAN interface on each sonicwall pointing towards the other networks subnet. &#xA;Arlington: 10.74.1.1/24&#xA;Dallas: 10.74.2.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;               +-----------+ X0 ---- LAN 10.74.1.1/24&#xA;               |           |&#xA;WAN_IP ---- X1 | SonicWall |&#xA;               | Arlington |&#xA;               +-----------+ X2 -------- X2  +-----------+ X0 ---- 10.74.2.1/24&#xA;                                    ^        |           |&#xA;                                    |        | Sonicwall | X1 ---- WAN_IP&#xA;                                    |        |  Dallas   |&#xA;                                    |        +-----------+&#xA;                                    |&#xA;                           This X2 would traverse&#xA;                           the point-to-point connection&#xA;                           between each of my ISP's modems &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question would be, how do I configure each X2 interface? My thought would be for example: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring the X2 interface on the Arlington sonicwall as: LAN, Address of 10.74.2.1, mask of 255.255.255.0. And configuring the X2 interface on the Dallas sonicwall as: LAN, address of 10.74.1.1, mask of 255.255.255.0. Also, can I test the LAN interfaces configured like this WHILE the VPN tunnel is still alive? Or would that cause some issues with routing between the two networks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We need these networks to communicate the same way as they do over the VPN tunnel right now. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice would be appreciated! &lt;/p&gt;&#xA;" OwnerUserId="17501" LastActivityDate="2017-03-28T16:01:24.390" Title="Point to point LAN using two sonicwalls at seperate locations" Tags="|sonicwall|point-to-point|network-access|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20893" PostTypeId="1" AcceptedAnswerId="20894" CreationDate="2015-08-25T13:32:32.967" Score="15" ViewCount="28295" Body="&lt;p&gt;I am just wondering how a switch does know how to route packets to destinations &quot;hidden&quot; behind another switch.&#xA;In my understanding a switch has a table that maps each of its hardware ports to exactly one MAC-address. So far so good, when a packet/frame (?) arrives it now can determine the port at which the packet should be routed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what happens when there is another switch connected to one of these ports and this second switch has more than one devices connected?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering how a switch is able to resolve this (on OSI-Layer 2, without a router), as I think this does indeed work in reality (?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sorry if this question already exists (I think so, it should not be that uncommon), but I could not manage to put my thought into a suitable search query.&lt;/p&gt;&#xA;" OwnerUserId="17502" LastActivityDate="2016-04-20T12:57:14.207" Title="How does a switch know where to route packet, when there is another switch in front of the destination?" Tags="|routing|switch|ethernet|mac-address|osi|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20894" PostTypeId="2" ParentId="20893" CreationDate="2015-08-25T13:56:26.780" Score="20" Body="&lt;p&gt;A Layer 2 switch learns most of its information about the location of other endpoints via &quot;listening&quot; to ingressing frames, and when it is not aware of the location, it uses &lt;code&gt;flooding&lt;/code&gt;and will learn from the answer. Lets say the topology is:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Host A) &amp;lt;--&gt; (Switch A) &amp;lt;--&gt; (Switch B) &amp;lt;--&gt;(Host B).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also important to note, a L2 Switch forwards, it does not route. By that I mean, when it receives an encapsulated frame, it forwards it out interfaces.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Host A wants to get to Host B. Host A knows Host B's MAC address. So Host A sends a frame out to Switch A.  &lt;/li&gt;&#xA;&lt;li&gt;Switch A does not have Host B in its MAC address Table. Switch A then flood out the frame on all of its ports, except for the one Host A is located. Among all those ports there is the ports that Switch B is plugged into, so Switch B receives the frame.&lt;/li&gt;&#xA;&lt;li&gt;Switch B then flood that frame out all of its ports (considering Switch B does not have Host B in its MAC address Table).&lt;/li&gt;&#xA;&lt;li&gt;Host B will respond to the frame, Switch B will then record Host B MAC address and send the response to Switch A. Switch A then records the MAC address of Host B in its table and send the response to Host A&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here's a related question: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13012/how-does-a-switch-learn-a-switch-table&quot;&gt;How does a switch learn a switch table?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-04-20T12:57:14.207" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20895" PostTypeId="2" ParentId="20893" CreationDate="2015-08-25T13:57:00.453" Score="5" Body="&lt;p&gt;The switch can map multiple mac-addresses to a port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus all the device mac's on the second switch is seen by the first switch as belonging to one port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It updates it's table when it receives any packet, as they all contain a source mac.  If it had the mac on a different port before it changes it's mac address table (mac to port map).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the position of a mac changes between ports often, it is reported as a mac flap.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-08-25T13:57:00.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20896" PostTypeId="1" AcceptedAnswerId="23605" CreationDate="2015-08-25T14:01:21.390" Score="0" ViewCount="384" Body="&lt;p&gt;LTE data rate is calculated here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://lteuniversity.com/get_trained/expert_opinion1/b/hongyanlei/archive/2010/02/18/how-to-calculate-peak-data-rate-in-lte.aspx&quot; rel=&quot;nofollow&quot;&gt;http://lteuniversity.com/get_trained/expert_opinion1/b/hongyanlei/archive/2010/02/18/how-to-calculate-peak-data-rate-in-lte.aspx&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we say the peak is 300 Mbps( under some specific configuration such as 4 * 4 MIMO), are we referring to a user who will experience 300Mbps or is it an aggregate data rate of all users in the cell? because, in the calculation, all the resource blocks have been used up. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="8739" LastActivityDate="2015-12-25T07:02:39.057" Title="Peak data rate is to whom in LTE?" Tags="|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20897" PostTypeId="1" CreationDate="2015-08-25T14:17:10.193" Score="-1" ViewCount="7139" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xt3wF.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xt3wF.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hello all , I am not able to understand what kind of error is wireshark showing me please refer picture &#xA;need help.&lt;/p&gt;&#xA;" OwnerUserId="17396" LastActivityDate="2015-08-29T17:02:23.777" Title="header checksum error in wireshark" Tags="|cisco|wireshark|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20898" PostTypeId="2" ParentId="20892" CreationDate="2015-08-25T14:50:09.170" Score="1" Body="&lt;p&gt;That won't work, because both 10.74.1.0/24 and 10.74.2.0/24 are both in use. Not only that, a PtP connection requires a mutual prefix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use a different IP range, and a smaller one. Put 10.75.0.1/30 (255.255.255.252) on Arlington X2, and 10.75.0.2/30 (255.255.255.252) on the Dallas X2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then on Arlington, add a route: 10.74.2.0/24 -&gt; 10.75.0.2 and on Dallas: 10.74.1.0/24 -&gt; 10.75.0.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've never used a SonicWall before, so I don't know if the VPN will take precedence over the newly installed routes or not. How I would test this is take a single IP from each side's LAN, and route those over the new PtP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, on a laptop set as 10.74.2.10 on one side, and 10.74.1.10 on the other, on Arlington, route 10.74.2.10/32 -&gt; 10.75.0.2 and in Dallas, route 10.74.1.10 -&gt; 10.75.0.1. Again, I don't know if the Sonicwalls will bypass the crypto to route these over the ptp, but it might be worth a try. You could also set up a new temporary prefix at each side, and route that before going live.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, after EOB, set up the routes, see what happens, disable the VPN, and see what happens. If it works, you're done. If not, you've got a documented ordered list of what was done. Backtrack until you get original status-quo working again, and go from there.&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-08-25T14:50:09.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20900" PostTypeId="2" ParentId="20892" CreationDate="2015-08-25T15:17:34.790" Score="1" Body="&lt;p&gt;If you don't manage your routing appliances directly, you need to sort this thing with your ISP and configure additional routing and interfaces not only on your Sonicwalls but also in routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Define two more networks: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.16.100.0/30 Dallas-to-Arlington &#xA;172.16.101.0/30 Arlington-to-Dallas&#xA;Assign:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dallas X2: 172.16.100.1/30&#xA;Dallas Router Fe(0/1) : 172.16.100.2/30&#xA;Arlington X2: 172.16.101.1/30&#xA;Arlington Router Fe(0/1) : 172.16.101.2/30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On your Dallas Router:&#xA;route 10.74.2.0/24 gateway 172.16.100.1   (traffic from A. to D. routed to Sonicwall)&#xA;route 10.74.1.0/24 gateway your MPLS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Arlington &#xA;route 10.74.1.0/24 gateway 172.16.101.1   (traffic from D. to A. routed to Sonicwall)&#xA;route 10.74.2.0/24 gateway your MPLS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On sonicwall you also need to disable destination NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As always, backup, backup, backup! :)&lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2015-08-25T15:17:34.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20903" PostTypeId="1" CreationDate="2015-08-25T16:13:46.370" Score="2" ViewCount="1523" Body="&lt;p&gt;I'm planning an event annually where we're expecting &lt;strong&gt;over 6,000 attendees&lt;/strong&gt; in the same big room (it's about 60,000 ft&lt;sup&gt;2&lt;/sup&gt;). There is no wireless network installed, and last year, the cellular network got heavily saturated, so 3G/LTE connectivity was mostly unusable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd really like to &lt;strong&gt;provide a more reliable Internet access to everyone&lt;/strong&gt;, but I have no idea where to start. Could wireless routers be powerful enough to support so many clients, if installed strategically? Or do you know any equipment that could &lt;em&gt;boost&lt;/em&gt; the cellular network in the room, just for that evening?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm normally familiar with wireless networks, but with this kind of scale I really have no clue... Thanks in advance for your help!&lt;/p&gt;&#xA;" OwnerUserId="17508" LastActivityDate="2015-11-19T07:55:12.517" Title="Provide Internet access to thousands of people at the same time and place?" Tags="|wireless|ieee-802.11|internet|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20905" PostTypeId="2" ParentId="20903" CreationDate="2015-08-25T18:27:22.017" Score="0" Body="&lt;p&gt;&lt;strong&gt;It would actually be easier to network the entire room with ethernet and switches and run everyone through a data cap per line with the requirement that anyone who needs access has to register beforehand and bring a device capable of wired access.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Disclaimer: While I have worked with wireless a lot and have read and attempted to research large installs I do not have any first hand experience with anything over 100 users per room, this is just some of what I have learned from years of puzzling over possibilities and reading varied sources.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience it's very difficult to get good performance out of wireless APs that are installed in any area with less than 50ft of clearance (just in general terms) + you would have the added difficulty of actually providing enough internet to service the backbone for the wireless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Sadly the cellular option probably isn't possible due to the same wireless limitations that are common with APs, regardless these are some things you will want to look into to check the overall usefulness of that option.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;So I would try improve the cellular reception instead.  However you&#xA;will have to keep in mind that cellular reception is wireless just&#xA;like wireless internet just on a better standard so you will run into&#xA;some of the same limitations. You will also be limited by the amount&#xA;of nearby towers and the bandwidth going to those towers so I would&#xA;strongly encourage giving the local cellular providers a call and&#xA;seeing what kind of limitations are common for a given area/number of&#xA;towers.  Even if you improve the signal it won't be any good if the&#xA;local towers can't keep up with it.&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Things to keep in mind if you try to go the wireless AP route.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do have to service all the visitors with just wireless access points then I would encourage you to give up on seamless coverage and instead try to layer 2.4 and 5 ghz radios using each radio as a way to increase the distance between radios on the same frequency and band.  Just make sure to mark the areas that only have 2.4 and only have 5ghz coverage so everyone won't be caught off guard (I know it's not a good solution but it's the easiest and cheapest way to do it).  Keep in mind that if you are assuming that there will be at least 6000 devices at moderate usage levels so it's possible that you will need as many as 240 APs (25 devices per AP, although you can reduce the number of AP by relying on a per radio count I'm not sure if that would be helpful).  The radio strength of each AP will need to be set to the lowest strength allowed and it would be best if they were centrally managed to allow automatic dropping of clients that go more than a set distance from the AP (based on the client wireless strength).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do attempt to provide internet, make sure to provide enough for everyone attending and actively ban the use of any wireless hotspots since they will only increase the number of wireless conflicts.  I would encourage the registration of any visitors devices in advance so you can sort them into 5ghz, 2.4 ghz and low/high bandwidth groups and plan accordingly.  Remember to count phones in addition to mobile computing devices and try to see if the visitors will be uploading content to the internet while present.  &lt;strong&gt;In all honesty I see this as an almost impossible task but it should be doable with enough funds, make sure to bring someone onsite that has experienced it firsthand to minimize issues.&lt;/strong&gt;  &lt;/p&gt;&#xA;" OwnerUserId="17513" LastEditorUserId="17513" LastEditDate="2015-08-25T18:53:10.803" LastActivityDate="2015-08-25T18:53:10.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20906" PostTypeId="2" ParentId="20758" CreationDate="2015-08-25T18:55:58.183" Score="3" Body="&lt;p&gt;Appears there is no physical compactflash module in slot 0, appears to have on in slot 1 with at a minimum a corrupted file system and at a max bad physical flash as you are getting file system sector error and the storage areas are corrupted. Can't write the crashdump file and that is why you get the repeated reboots after 5 minutes. If control break is enabled then after the first few seconds after power on you can hit control break and dump out to the rommon prompt: May have to type flash_init to activate the file system, type set to see where it is pointing to for the ios file then type dir flash1: and see if it can read the file system. If you have access to the ios from either a backup or from another 3925 copy it to a usb stick and put in the usb flash slots if your model has them. I believe it does. I try and use 1gb sticks and smaller. Not all Cisco routers will accept the larger sticks. From the rommon prompt: type usbflash0 or 1 depending on which slot you put it in and see if the router can see the stick and the files. If so you can boot off of the usb stick. prompt: boot usbflash0:file name and hit return. If the rest of the router hardware is good then it will boot up without a config. May get a few errors go by because the rommon set is pointing to the bad flash for the config and license file but will come up if hardware is good. Best you can hope for at that point. You may be able to reformat the flash file system. If you have licensed any features when the router was purchased you will need the license file to turn on more than the base default license. Definitely either corrupted file system or bad flash.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-08-25T18:55:58.183" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20908" PostTypeId="2" ParentId="20884" CreationDate="2015-08-25T20:19:22.867" Score="1" Body="&lt;p&gt;More info would help like a simple diagram of where the pc's mention live and what online tool you are using. The online tool, is it just looking up the assign dns ip address or actually pinging from the tool website? If just entering the domain name and the site is spitting out the ip address then it is just doing a lookup which good. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you ping from the command line are you ping the dns name or the ip assigned to the NAT? Are you just getting timeouts from the pc and if so is is showing the correct ip to dns mapping?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all of those are correct it's possible an ACL has been added/changed to prevent ping responses in the firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have access to the logs from the DMZ firewall?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you tried traceroute to the address what hop is if failing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If possible what does an nslookup from the pc/workstation show?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also load NMap and run a sweep on the host in question and see if ports are found regardless if they are open or closed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Post some screen captures or logs so others can chime in as well.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-08-25T20:19:22.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20909" PostTypeId="1" CreationDate="2015-08-25T20:23:57.820" Score="1" ViewCount="886" Body="&lt;p&gt;I believe I'm on the right track, but have stumble across something with advertising BGP prefixes to neighbors. I am wonder how if I have a single ASN with multiple prefixes (99.1.1.0/24 and 111.1.1.0/24) with multiple upstream ISPs. How do I send BGP attributes to these upstreams to influence how ingress traffic would go to which router. See picture.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/JlfOg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JlfOg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see this is a GNS3 lab I put together. I have an ASN#99 with 2(two) prefixes (99.1.1.0/24 and 111.1.1.0/24). I also have two ISP neighboring routers. Tier3-1 and Tier3-2. I am trying to get from Tier1's perspective, the best path for 99.1.1.0/24 prefix is through Tier3-1 and the best paht for prefix 111.1.1.0/24 prefix is through Tier3-2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind, I cannot touch Tier3-1 or Tier3-2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is probably something simple I am missing. Appreciate everyones help.&lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2024-01-27T08:08:14.057" Title="BGP transitive attributes for single ASN multiple prefixes multiple neighbors" Tags="|routing|bgp|internet|packet-path|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20911" PostTypeId="1" AcceptedAnswerId="20934" CreationDate="2015-08-25T22:14:40.783" Score="3" ViewCount="279" Body="&lt;p&gt;I'd like to know, What the Application Layer Protocols have in common? client-server model could be one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to know if the protocol belongs to application layer just observing their features?&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="14008" LastEditDate="2016-06-19T22:50:17.170" LastActivityDate="2016-06-19T22:50:17.170" Title="Application Layer Protocols" Tags="|osi|" AnswerCount="1" CommentCount="2" ClosedDate="2016-06-20T07:20:25.327" ContentLicense="CC BY-SA 3.0" />
  <row Id="20912" PostTypeId="1" CreationDate="2015-08-26T00:26:10.493" Score="0" ViewCount="383" Body="&lt;p&gt;We have a cabinet of dedicated servers with a Brocade FESX648-PREM switch at the top. We own all the hardware and all the MAC addresses are known to us. We also fully manage the servers so we retain administrative access, but our customers have administrative access as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently we use VLANs and subnets to isolate the servers, prevent IP hijacking, etc. However, we want to make more efficient use of our IPv4 allocations. We lose a lot of usable IPs for gateway purposes and  we have an abundance of subnets too small for many customer needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've considered progressively migrating the servers to a single VLAN and use static ARP to prevent IP hijacking. We'd lose layer 2 isolation, but I'm not sure what sort of abuse that would open us up to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the dangers of placing all of our servers on a single VLAN with only static ARP bindings to prevent IP hijacking? In other words, what forms of abuse would be possible with a single VLAN config &lt;em&gt;that would not be possible&lt;/em&gt; with every server on its own VLAN? Are there any precautions we can take to prevent the abuse while achieving our goals of more efficient IPv4 usage?&lt;/p&gt;&#xA;" OwnerUserId="8209" LastEditorUserId="8209" LastEditDate="2015-08-26T21:28:58.197" LastActivityDate="2015-08-26T21:28:58.197" Title="What are the dangers of placing multiple servers on a single VLAN with static ARP bindings?" Tags="|vlan|arp|layer2|brocade|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20915" PostTypeId="2" ParentId="20887" CreationDate="2015-08-26T00:54:13.683" Score="1" Body="&lt;p&gt;You can use TCL inside Cisco to ping, or if the links are reachable from your PC, then you can use Python or scapy framework to ping and capture IP addresses which didn't respond.&lt;/p&gt;&#xA;" OwnerUserId="17521" LastEditorUserId="8499" LastEditDate="2016-03-23T04:35:55.323" LastActivityDate="2016-03-23T04:35:55.323" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20916" PostTypeId="1" CreationDate="2015-08-26T03:15:56.687" Score="1" ViewCount="2652" Body="&lt;p&gt;Consider a typical basic-ish Ethernet network, not using VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a bunch of wires and transceivers connecting some devices - the physical layer. At this layer we can only send groups of bytes between directly-connected devices - not terribly useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we have an Ethernet network built out of those wires and transceivers - the data-link layer. At this layer, we can send a packet to any device on the network, using its MAC address. This layer also adds a checksum to each packet, and a tag identifying the next-layer protocol. &quot;Ethernet routers&quot; (i.e. switches) route packets at this level, and have some restrictions (e.g. no loops).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we have an IP network built out of one or more Ethernet networks. At this layer, we can send a packet to any device on the network, using its IP address. This layer also adds a checksum to each packet, and a tag identifying the next-layer protocol. &lt;em&gt;Wait a minute, that sounds familiar.&lt;/em&gt; It also supports fragmentation, and more advanced routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On top of that we run TCP, UDP, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hang on, the IP layer can do everything the Ethernet data-link layer can do! So why do we need the Ethernet data-link layer? Why not run TCP over IP directly over the Ethernet physical layer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, why not expand the Ethernet data-link layer to do the things IP can do, then run TCP over the Ethernet data-link layer, without IP?&lt;/p&gt;&#xA;" OwnerUserId="12046" LastActivityDate="2015-08-26T11:14:35.177" Title="Why do we need the data link layer in Ethernet?" Tags="|ethernet|ip|layer2|osi|" AnswerCount="2" CommentCount="2" ClosedDate="2015-08-26T13:06:15.583" ContentLicense="CC BY-SA 3.0" />
  <row Id="20918" PostTypeId="1" AcceptedAnswerId="20922" CreationDate="2015-08-26T04:58:53.550" Score="2" ViewCount="6975" Body="&lt;p&gt;My friend recent bought a house.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the rooms are wired for CAT5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the garage theirs a networking panel that has some sort of punch panel and then all the CAT5 cable routed to the rooms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem we are having is that the RJ-45 connectors that are currently on ends in the panel to connect to a router/modem etc. for some reason dont fit. They are very hard to connect/disconnect. We actually broke 1 because it got stuck in the Cisco router we were using. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any info on abnormal RJ-45 connectors?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the CAT5 cable that is routed through the house is using some non-standard wire color. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/A5GHP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/A5GHP.jpg&quot; alt=&quot;Normal CAT5&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of these colors, the wires we have are as follows: Wire 1 is a light green, 2 is Dark Green, 3 is yellow, 4 is Dark Blue, 5 is light blue, 6 is orange, 7 is tan and 8 is brown. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I havent been able to find any information on this type of color scheme for CAT5 wiring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We want to cut the current RJ-45 ends and put new RJ-45 connectors on the cables to fit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any information on wiring order or know anything about this color scheme or weird fitting RJ-45 connectors?&lt;/p&gt;&#xA;" OwnerUserId="17524" LastActivityDate="2015-08-26T05:56:24.680" Title="Wierd Ethernet Color Wiring / Rj-45 Connectors" Tags="|ethernet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20919" PostTypeId="2" ParentId="3482" CreationDate="2015-08-26T05:06:39.107" Score="-1" Body="&lt;p&gt;4 bytes for tagging .. 3 bits of which are PRL . remaining 13 bits would be 4096 : 0 to 4095 . the 0 and 4095 reserved and from 1001 to 1005 are not used nowadays . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note : if using VTP , can't use more than 1001 VLANS .&lt;/p&gt;&#xA;" OwnerUserId="17525" LastActivityDate="2015-08-26T05:06:39.107" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20920" PostTypeId="2" ParentId="20918" CreationDate="2015-08-26T05:15:09.460" Score="-2" Body="&lt;p&gt;just get yourself new RJs and repalce every RJ you have . non-standard connections will drive you nuts . &lt;/p&gt;&#xA;" OwnerUserId="17525" LastActivityDate="2015-08-26T05:15:09.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20922" PostTypeId="2" ParentId="20918" CreationDate="2015-08-26T05:56:24.680" Score="3" Body="&lt;p&gt;As far as the RJ45 modular connectors go I have seen cheap ones not fit well. I like Leviton stuff myself.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen colors messed up like this. The way wiring code works White/Green  Green/White with first color being the dominate one, so this would be your translation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Light Green =  White / Green&#xA;Dark Green =  Green /White&#xA;Yellow = White / Orange&#xA;Dark Blue = Blue / White&#xA;Light Blue = White / Blue&#xA;Orange = Orange /White&#xA;Tan = White / Brown&#xA;Brown = Brown /White&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 2 color codes 568A w/g g/w w/o bl/w w/bl o/w w/br br/w and there is 568B that the orange and green pair are swapped and it goes  w/o o/w w/g bl/w w/bl g/w w/br br/w. You need to look where the cable is punched to the patch panel It was say 568A or B. Unless your router needs a crossover (most don't any more) you wire the RJ45 modulator end the same as it is punched on the panel. Hold the end you hand with the clip away from you and the left side is pin 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps&lt;/p&gt;&#xA;" OwnerUserId="17527" LastActivityDate="2015-08-26T05:56:24.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20924" PostTypeId="2" ParentId="20916" CreationDate="2015-08-26T06:39:15.757" Score="0" Body="&lt;p&gt;First what comes to my mind is situation when we have a lot number of users and they standby or communicate. L2 still update their MAC's and broadcast that they are there. A lot of traffic. And services like NAT: using NAT we have 1 public adress for multiple users inside our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you suggesting using only L2 ?:)&lt;/p&gt;&#xA;" OwnerUserId="17499" LastActivityDate="2015-08-26T06:39:15.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20927" PostTypeId="2" ParentId="20912" CreationDate="2015-08-26T06:48:23.020" Score="-1" Body="&lt;p&gt;One Vlan with static IP sound ok but aren't 2 are better option? &#xA;1 untagged vlan for traffic and 1 vlan with static IP for managment.&lt;/p&gt;&#xA;" OwnerUserId="17499" LastActivityDate="2015-08-26T06:48:23.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20929" PostTypeId="2" ParentId="20916" CreationDate="2015-08-26T07:07:47.347" Score="0" Body="&lt;p&gt;Ethernet defines a common format that is used on all different sorts of physical channels. It is therefore responsible for Medium Access, so getting onto a wire or on a satellite link. L1 provides you with a way to send a single bit. May it be over radio, satellite, cable or whatever. This does not add reliability, as e.g. L2 protocols for wireless communication do. It sometimes also defines certain rules to ensure proper collision-free communication. IP does nothing like that... no reliability and no collision detection nor avoidance. This is also why TCP again adds a layer of reliability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, with mostly star topologies, where a wire only connects two nodes, the Ethernet addresses are really not that important if you know how to differentiate between data you sent and the data your peer sent. But as Ethernet comes from a time, where bus topologies where present, it is really important that you have addressing. Otherwise, participants listening on the bus cannot tell whether a packet is for them or for someone else. This is also true for hubs which, in contrast to switches, don't do &quot;store-and-forward&quot;, but instead forward a single bit they receive on an incoming port to all other ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The checksum point is important as even with L1 service of transmitting a bit, nobody ensures that the bit is received correctly. Ethernet can detect errors by the checksum. You said correctly that checksums are done in L3 with IP, but if you take a closer look at IPv6, you see that they dropped the checksum. The motivation behind this is that Ethernet does checksums anyway (L2) and TCP also ensures reliable data transfer through ACKs and sequence numbers (L3).&lt;/p&gt;&#xA;" OwnerUserId="10219" LastEditorUserId="10219" LastEditDate="2015-08-26T11:14:35.177" LastActivityDate="2015-08-26T11:14:35.177" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="20932" PostTypeId="1" CreationDate="2015-08-26T10:17:46.960" Score="1" ViewCount="72" Body="&lt;p&gt;I have one branch which is (branch-1) with two groups of ip phones, one group is connecting to CUCM-1 in HQ and the other group is connecting to CUCM-2 in the branch (branch-1) and the connectivity between HQ and branch-1 is through IPsec and the link between CUCMs is SIP trunk with default configuration and they are working fine, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I have branch-2 which also have two groups of ip phones connecting to CUCM-1 in HQ and CUCM-2 in Branch-1 but when i call from a phone connecting to CUCM-1 to CUCM-2 it can ring and when I answer i can't hear any thing.&#xA;++++++++++++++++++++++++++++++++++++++++++++++++++++&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HQ connecting to branch-1 through IPsec&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HQ connecting to branch-2 through IPsec&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Branch-1 is connecting to branch-2 through IPsec.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;CUCM-1 located in HQ&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CUCM-2 Located in Branch-1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SIP trunk configured in between&#xA;++++++++++++++++++++++++++++++++++++++++++++++++++++&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Who can advise what's the problem ??&lt;/p&gt;&#xA;" OwnerUserId="17531" LastActivityDate="2015-08-26T13:56:46.017" Title="Issue with voice performance between two ip phones at the same site connecting to two different CUCM?" Tags="|cisco|ipsec|voip|sip|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20934" PostTypeId="2" ParentId="20911" CreationDate="2015-08-26T10:56:59.953" Score="1" Body="&lt;p&gt;There is not a single rule to identify an Application Layer Protocol. If you compare the &lt;em&gt;OSI model&lt;/em&gt; and the &lt;em&gt;Internet Protocol Suite&lt;/em&gt; the single common feature is that it &lt;strong&gt;controls the communication among processes&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the &lt;em&gt;Internet Protocol Suite&lt;/em&gt;  the Application Layer is on top of TCP / UDP. It includes protocols as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Routing protocols (peer to peer) (RIP, OSPF, BGP, etc.) &lt;/li&gt;&#xA;&lt;li&gt;Data downloading protocols (server -&gt; client) (FTP, HTTP, TFTP)&lt;/li&gt;&#xA;&lt;li&gt;Human interaction protocols (peer to peer &amp;amp; server -&gt; client)  (XMPP, H323, SIP, RTP)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-08-26T10:56:59.953" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20935" PostTypeId="2" ParentId="20912" CreationDate="2015-08-26T12:50:24.350" Score="1" Body="&lt;p&gt;Are the addresses used in your network public?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If no - wasting up private address space is not an issue, but using VLANs to split customer logically gives a lot of benefits: if limiting broadcasts and such a traffic flow related aspects is not a problem, then, from a point of security, mixing everything together will end up badly. And using static ARP bindings - I would not call it as a real security solution, just like a MAC filtering at wireless.&lt;br&gt;&#xA;Using VLANs will allow you to manage this better by using logically correct ACL`s or firewall rules to keep the customers isolated and that will scale good enough and will not become &quot;who the hell had this IP?&quot; in 10.10.0.0/16 subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If IPs are public - wasting them is an issue. Strict firewall rules on the servers could help, but in fact network diagram would be useful to have an idea where some security measures could be applied as there's still the issue with mixing everyone up in one bucket.&lt;/p&gt;&#xA;" OwnerUserId="868" LastActivityDate="2015-08-26T12:50:24.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20936" PostTypeId="1" CreationDate="2015-08-26T12:57:35.363" Score="2" ViewCount="202" Body="&lt;p&gt;I have a little problem with two SonicWALLs connected between each other with a dedicated link in layer 2 from our ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's call them SonicWALLs A and B. From SonicWALL A, the connection is done with a VLAN in the port X4:110, with the IP address 10.20.0.254 (encap dot1q). From SonicWALL B, the connection is from a physical port without dot1q. Is this the reason SonicWALL B is not able to ping the IP address from SonicWALL A?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a possible cause, because I have knowledge from Cisco, but my point of view, this is not able to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another question: I created two static routes from both SonicWALLs &#xA;with LANs connected to them, and traffic from SonicWALL A's LAN is able to ping. On the other hand, traffic from SonicWALL B's LAN is not able to ping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe this is because of the encapsulation. Can someone confirm if this is the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the statistics from both rules in SonicWALL B:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN A TO LAN B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, the rule in reverse flow shows Rx statistics flowing well.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#14 LAN &amp;gt; LAN 14 Change priority... 130.0.10.0 X0 Subnet Any Allow All None Enabled Enabled&#xA;Access Rule #14 - Traffic Statistics&#xA;Rx Bytes: 1000285&#xA;Rx Packets: 3744&#xA;Tx Bytes: 298962&#xA;Tx Packets: 3377&#xA;Usage: 451&#xA;LAN B TO LAN A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These are the statistics, but it didn't work, the Rx bytes are still in 0.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#LAN &amp;gt; LAN 13 Change priority... X0 Subnet 130.0.10.0 Any Allow All&#xA;Access Rule #13 - Traffic Statistics&#xA;Rx Bytes: 0&#xA;Rx Packets: 0&#xA;Tx Bytes: 41760&#xA;Tx Packets: 696&#xA;Usage: 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17537" LastEditorUserId="8499" LastEditDate="2016-03-29T00:18:17.997" LastActivityDate="2016-12-24T06:29:07.397" Title="SonicWALL dedicated link between" Tags="|vlan|sonicwall|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20938" PostTypeId="1" AcceptedAnswerId="20939" CreationDate="2015-08-26T14:06:45.087" Score="2" ViewCount="21152" Body="&lt;p&gt;we have some issues that am not sure if it port need to be allow on my mikrotik or just a issues from the FTP server the are using TLS encryption to have access but we can't connect is there any port beside of 21 need to be open ?&lt;/p&gt;&#xA;" OwnerUserId="17538" LastActivityDate="2015-08-26T14:33:42.023" Title="when it come to TLS on FTP which port need to be allow?" Tags="|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20939" PostTypeId="2" ParentId="20938" CreationDate="2015-08-26T14:33:42.023" Score="3" Body="&lt;p&gt;Normal FTP uses port 21(TCP/UDP) for control and port 20(TCP/UDP) for data.&#xA;FTP over TLS (FTPS) uses port 990(TCP/UDP) for control and port 989(TCP/UDP) for data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to open both as FTPS prevents the router from detecting which port was negotiated for the data transfer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="7508" LastActivityDate="2015-08-26T14:33:42.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20940" PostTypeId="2" ParentId="20827" CreationDate="2015-08-26T15:03:55.460" Score="1" Body="&lt;p&gt;This is an older Cisco page that I wished was kept current. Has many of the Cisco products but not always the latest and greatest. &lt;a href=&quot;http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/public/sw-center/netmgmt/cmtk/mibs.shtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to keep in mind that I haven't seen mention is you can go through the entire Cisco mib universe but if the mib you are wanting to use isn't installed in the IOS that the switch running you will only be spinning your wheels. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example you mention the 3560 model. If you had 12.2.50 train of code this is the supported mibs. &lt;a href=&quot;ftp://ftp.cisco.com/pub/mibs/supportlists/cat3560/cat3560-supportlist.htm&quot; rel=&quot;nofollow&quot;&gt;ftp://ftp.cisco.com/pub/mibs/supportlists/cat3560/cat3560-supportlist.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had 15.x code train then the mibs will be a different mix. You have to look up the release notes/data sheets for each code build if you are going to deep dive into off beat mibs. The standards based and Cisco generic mibs are generally always in the vast majority of the code trains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Been there, done that with scripts trying to extract specific OID's to only later discover that the mib isn't in the switch. Really problematic for DHCP stats and environmental stats. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also are you wanting the GUI to show blinking lights? snmp queries are snapshots in time depending on the OID queried. If your wanting to keep up with the constant state of the lights then you will be polling non stop which will drive the cpu to 100% and stay there. Not that hard to drive a 3560 cpu into the ground from personal experiences with snmp polling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just some things to keep in mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-08-26T15:03:55.460" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20941" PostTypeId="1" AcceptedAnswerId="20942" CreationDate="2015-08-26T16:34:56.657" Score="0" ViewCount="655" Body="&lt;p&gt;What is the PoE standard supported on Cisco WS-C3524-PWR-XL switch? Only the ILP? &lt;code&gt;show power&lt;/code&gt; does not provide any useful information in that regard and under interfaces configuration it allows one to configure &lt;code&gt;inline power&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3524(config-if)#power inline ?&#xA;  auto   Automatically detect and power inline devices&#xA;  never  Never apply inline power&#xA;&#xA;C3524(config-if)#power inline &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Last but not least, am I correct that &lt;em&gt;IEEE 802.3af&lt;/em&gt; capable devices do not work with ILP equipment?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-08-26T17:06:20.180" Title="PoE standard supported on Cisco WS-C3524-PWR-XL switch" Tags="|power-over-ethernet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20942" PostTypeId="2" ParentId="20941" CreationDate="2015-08-26T16:51:32.183" Score="2" Body="&lt;p&gt;The &lt;a href=&quot;https://supportforums.cisco.com/discussion/10478581/ws-c3524-pwr-xl-support-8023af&quot; rel=&quot;nofollow&quot;&gt;Cisco support forum&lt;/a&gt; seems to indicate that this switch is pre-standard and therefore doesn't support AF or AT. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-08-26T16:51:32.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20943" PostTypeId="1" CreationDate="2015-08-26T16:53:11.580" Score="2" ViewCount="24168" Body="&lt;p&gt;I have connected to the switch from my Win7 computer with the following equipment. (the blue cable isnt the exact one, but nearly the same)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ln8AY.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ln8AY.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i restart the switch while connected with &lt;a href=&quot;http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Putty&lt;/a&gt; or &lt;a href=&quot;https://www.hilgraeve.com/hyperterminal/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HyperTerminal&lt;/a&gt;, i get the following text:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;INFO: RAM test beginning.&#xA;PASS: RAM test, 131072k bytes found.&#xA;INFO: BBR tests beginning.&#xA;PASS: BBR test, 512k bytes found.&#xA;INFO: Self tests complete.&#xA;INFO: Downloading switch software.&#xA;Force EPROM download (Y) ?&#xA;INFO: Initial download successful.&#xA;&#xA;INFO: Initialising Flash File System.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It stalls for 2-3 seconds on &quot;Force EPROM download (Y) ?&quot;, and if i don't do anything, it just continues and doesn't give me a terminal to write in or enter credentials.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.alliedtelesis.com/media/fount/hardware_reference/8800hr.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;manual&lt;/a&gt; states that i should get a terminal where i can enter commands looking something like this(screenshot from the &lt;a href=&quot;http://www.alliedtelesis.com/media/fount/hardware_reference/8800hr.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;manual&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hltAZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hltAZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see what i get when entering each of the answers from the manual shown below:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KlsAW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KlsAW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mYIMs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mYIMs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried to find a reset button, and managed to find one behind a sticker to the left of the ASYN0 / console port, as shown below.&#xA;There was no button there, so i opened the switch and connected a wire between the connectors to reset, and tested this several times(10 sec also).&#xA;&lt;a href=&quot;https://i.stack.imgur.com/tHzkA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tHzkA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The manual can be found &lt;a href=&quot;http://www.alliedtelesis.com/media/fount/hardware_reference/8800hr.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="17542" LastActivityDate="2019-10-18T01:49:25.257" Title="How do i factory reset a Allied Telesyn AT-9924t?" Tags="|switch|management|authentication|interface|hardware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20944" PostTypeId="2" ParentId="20941" CreationDate="2015-08-26T17:06:20.180" Score="1" Body="&lt;p&gt;This switch went end of sales in Aug 2003 and the af spec wasn't fully ratified until 2003. So it's most likely pre af standard which Cisco supported based on af drafts. I've never had a problem with the pre AF Cisco devices not working. Will work fine with most inline power products with Caveats.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Show power doesn't have anything to do with show power inline, two different areas of the switch. If you are wanting the most trouble free setting then enter power inline auto. Will auto negotiate the power level to a max of 15.4w per port up to a max 325w on a 24 port model. From experience if you are doing this specifically for VoIP phones you can run into problems depending on the IOS. Newer ip phones will want LLDP-MED TLV extension protocol support which won't be in a switch this old. At best the switch will have CDP TLV but possibly not the TLV needed. On some models you can manually build the CDP-TLV list and save. That's before you end get to weak QoS support in switch for phones. If you are just doing dumb devices like PoE IP security cameras then the switch will work just fine. Will end up around 6.8w per camera.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-08-26T17:06:20.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20945" PostTypeId="2" ParentId="20217" CreationDate="2015-08-26T18:06:49.870" Score="0" Body="&lt;p&gt;I will suggest if you are comfortable that there is no firewall running on the server or it has the ports allowed and no ACL's on switches in between the server and client that deny these ports is to run NMap on the client side against the server. Default is first thousand ports plus well known ports, add -p 1-45003 and verify that the desired ports don't show (closed). Will take a little longer to scan the additional port range. Hopefully the port will show what app NMap thinks is running on 8833 and 45002 and that they are open. RST is usually the results of a broken conservation and one side says I don't like it and sends a reset to tear-down the conservation.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-08-26T18:06:49.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20946" PostTypeId="1" AcceptedAnswerId="23604" CreationDate="2015-08-26T18:22:54.010" Score="0" ViewCount="83" Body="&lt;p&gt;I'm taking Lab on &lt;code&gt;Modeling and Simulation&lt;/code&gt; this Semester. My instructor is teaching us &lt;code&gt;NS2&lt;/code&gt;. I searched online and found there is already new version of NS2 called NS3. If I learn NS2 then would it help me in learning NS3 or NS3 is totally a different package. I've read online that it is build from scratch and doesn't support backward compatibility with NS2.&lt;/p&gt;&#xA;" OwnerUserId="17541" LastActivityDate="2015-10-22T13:43:05.437" Title="Is NS2 coding will be helpful in NS3" Tags="|network-core|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20947" PostTypeId="1" CreationDate="2015-08-26T18:30:13.987" Score="0" ViewCount="903" Body="&lt;p&gt;I don't believe this is possible iwth the Cisco ASA series, but figured I would as the community.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have an Cisco ASA, can I use the sla feature to track a NAT statement? for example. objReal1=10.1.1.1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sla monitor 1&#xA;type echo protocol ipIcmpEcho 10.1.1.1 interface inside&#xA;num-packets 3&#xA;timeout 1000&#xA;frequency 10&#xA;&#xA;track 1 rtr 1 reachability&#xA;&#xA;nat (inside,outside) source static objSrc objSrc destination static objNAT objReal1 track 1&#xA;nat (inside,outside) source static objSrc objSrc destination static objNAT objReal2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reasoning is we have some Servers that are local, but if they fail the SLA ping, I want to translate to something else that isn't local.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks everyone!&lt;/p&gt;&#xA;" OwnerUserId="3528" LastEditorUserId="3528" LastEditDate="2015-08-26T18:47:34.170" LastActivityDate="2015-08-26T23:47:06.457" Title="Cisco ASA Static NAT with SLA tracking" Tags="|cisco|cisco-asa|nat|dnat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20951" PostTypeId="2" ParentId="14672" CreationDate="2015-08-26T19:40:53.043" Score="0" Body="&lt;p&gt;If you have routers on your interfaces, you can configure static routes on the SonicWALL. Static routing means configuring the SonicWALL to route network traffic to a specific, predefined destination. Static routes must be defines if the LAN, WAN, or other defined interface is segmented into subnets, either for size or practical considerations. For example, a subnet can be created to isolate a section of a company network, such as finance, from network traffic on the rest of the LAN, WAN, or DMZ.&#xA;Static Routes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static Routes are configured when network traffic is directed to subnets located behind routers on your network. For example, you have a router on your network with the IP address of 192.168.168.254, and there is another subnet on your network with an IP address range of 10.0.5.0 - 10.0.5.254 with a subnet mask of 255.255.255.0. To configure a static route to the 10.0.5.0 subnet, follow these instructions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Click Add in the Static Routes section. The Add Static Route window is displayed.&#xA;&#xA;Type 10.0.5.0 in the Destination Network field.&#xA;&#xA;Type 255.255.255.0 in the Subnet Mask field.&#xA;&#xA;Type 192.168.168.254 in the Default Gateway field. This is the IP address of the router.&#xA;&#xA;Select LAN from the Interface menu.&#xA;Click OK.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note! You can configure up to 512 routes on the SonicWALL.&#xA;Static Route Configuration Example&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static Route configurations allow multiple subnets separated by an internal (LAN) router to be supported behind the SonicWALL LAN. This option is only to be used when the secondary subnet is accessed through an internal (LAN) router that is between it and the SonicWALL LAN port. Once static routes are configured, network traffic can be directed to these subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following are key terms used for this static route example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Destination Network - the network IP address of the remote subnet. The address usually ends in 0, such as 10.0.5.0.&#xA;Subnet Mask - the subnet mask of the remote network, such as 255.255.255.0.&#xA;Gateway - the IP address of the internal (LAN) router that is local to the SonicWALL.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example Addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SonicWALL LAN IP Address: 192.168.168.1&#xA;Subnet Mask: 255.255.255.0&#xA;Router IP Address: 192.168.168.254&#xA;Secondary Subnet: 10.0.5.0&#xA;Subnet Mask: 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the internal (LAN) router on your network using the IP address of 192.168.168.254, and there is another subnet on your network using the IP address range of 10.0.5.0 - 10.0.5.254 with a subnet mask of 255.255.255.0, follow these instructions to configure a static router to the 10.0.5.0 subnet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;In the Network&amp;gt;Routing page, click Add in the Static Routes section.&#xA;&#xA;Type 10.0.5.0 in the Destination Network field.&#xA;&#xA;Type 255.255.255.0 in the Subnet Mask field.&#xA;&#xA;Type 192.168.168.254 in the Default Gateway field. This is the IP address of the internal (LAN) router that is local to the SonicWALL.&#xA;&#xA;Select LAN from the Interface menu.&#xA;&#xA;Click OK.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note! Make sure the internal (LAN) router is configured as follows: If the SonicWALL has a NAT Policy on the WAN, the internal (LAN) router needs to have a route of last resort (Gateway Address) that is the SonicWALL LAN IP address.&#xA;Route Advertisement&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SonicWALL uses RIPv1 or RIPv2 (Routing Information Protocol) to advertise its static and dynamic routes to other routers on the network. Changes in the status of VPN tunnels between the SonicWALL and remote VPN gateways are also reflected in the RIPv2 advertisements. Choose between RIPv1 or RIPv2 based on your router's capabilities or configuration. RIPv1 is an earlier version of the protocol that has fewer features, and it also sends packets via broadcast instead of multicast. RIPv2 packets are backwards-compatible and can be accepted by some RIPv1 implementations that provide an option of listening for multicast packets. The RIPv2 Enabled (broadcast) selection broadcasts packets instead of multicasting packets is for heterogeneous networks with a mixture of RIPv1 and RIPv2 routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can configure route advertisements for each Interface/zone by clicking on the Notepad icon in the Configure column of Route Advertisement table, which displays the Route Advertisement Configuration window.&#xA;Routing Table&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Routing Table displays a list of destinations that the IP software maintains on each host and router. The Destination Network IP address, Subnet Mask, Gateway Address, and the corresponding Destination Link are displayed. Most of the entries are the result of configuring LAN and WAN network settings. The SonicWALL LAN and WAN IP addresses are displayed as permanently published at all times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://help.mysonicwall.com/sw/eng/305/ui2/22010/Network/Routing.htm&quot; rel=&quot;nofollow&quot;&gt;http://help.mysonicwall.com/sw/eng/305/ui2/22010/Network/Routing.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17545" LastActivityDate="2015-08-26T19:40:53.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20956" PostTypeId="2" ParentId="20947" CreationDate="2015-08-26T23:47:06.457" Score="3" Body="&lt;p&gt;Unfortunately, the &lt;strong&gt;sla monitoring&lt;/strong&gt; feature only applies to static routes, not NAT.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-08-26T23:47:06.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20958" PostTypeId="2" ParentId="20903" CreationDate="2015-08-27T02:58:35.297" Score="5" Body="&lt;p&gt;I agree with the previous answer. It is a daunting task to provide reliable wireless Internet access for 6000+ users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the past 5 years, I have worked for a company that is specialized in WiFi coverage for schools (some of them with over 1000 users). Big headache. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firs of all you will need to define what type of service you would like to provide. For example browsing the web is not as demanding as watching Youtube.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's asume you want to give a good quality of service for each user while &lt;strong&gt;browsing webpages&lt;/strong&gt;. This will set you at a data rate of &lt;strong&gt;500Kbps per user&lt;/strong&gt;. This number comes from &lt;a href=&quot;http://www.itu.int/rec/T-REC-G.1010-200111-I&quot; rel=&quot;noreferrer&quot;&gt;ITU-T's recommendation&lt;/a&gt; for maximum time of non-realtime content load for a good MOS score (10 seconds). For example for a 480p youtube video this means = 1.5Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you need to consider the &lt;strong&gt;simultaneity coefficient&lt;/strong&gt; of concurrent clients trying to access webpages. In a study me and my team conducted on over 10 facilities this proved to be close to &lt;strong&gt;40%&lt;/strong&gt;. This means that you could consider the simultaneous bandwidth you would need would be 0.4*500Kbps*6000 = &lt;strong&gt;1.2Gbps&lt;/strong&gt;. That is a big pipe!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can afford to get such bandwidth from your ISP then your next concern is what type of WiFi will my users have (802.11n, b, g or, if you are lucky, 802.11ac). Let's assume you will have mostly new cellphones (802.11n dual-band and above), then you will have a total throughput per cell (per 802.11 5GHz radio, do not even try to turn 2.4GHz on) of 120Mbps (for 30 clients). Due to moderate interference this capacity will drop about 40%. These numbers come from a guide of &lt;a href=&quot;http://www.cisco.com/web/strategy/docs/education/cisco_wlan_design_guide.pdf&quot; rel=&quot;noreferrer&quot;&gt;high density WLAN network design by Cisco&lt;/a&gt; and from empirical data me and my team collected on real world cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that leaves you, due to your capacity need of 1.2Gbps, with a need for 17 Access points, that need to be configured properly in order to get the least interference from adjacent cells (for an open environment this means almost every AP in sight). This config should:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Be centrally administered&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Tx power auto-adjust for minimum cell size.&lt;/li&gt;&#xA;&lt;li&gt;Force station roaming, no sticky clients please!!&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Forbid slow clients (minimum PHY data-rate of 24Mbps).&lt;/li&gt;&#xA;&lt;li&gt;Configure MIMO technology for maximum cell isolation.&lt;/li&gt;&#xA;&lt;li&gt;etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You also need to buy the correct AP for this type of scenario. Brands that have WiFi stadium coverage should suffice. Such brands are, among others:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ruckus Wireless&lt;/li&gt;&#xA;&lt;li&gt;Cisco&lt;/li&gt;&#xA;&lt;li&gt;Meraki&lt;/li&gt;&#xA;&lt;li&gt;Extreme Networks&lt;/li&gt;&#xA;&lt;li&gt;Meru&lt;/li&gt;&#xA;&lt;li&gt;Xirrus&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To sum up, these brands cover stadiums with over 20000 people watching videos at half-time, so it is possible to cover 6000 on an open space. You just need to have the proper configuration and RF planning in order to squeeze the last drop of spectrum from 802.11.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!!&lt;/p&gt;&#xA;" OwnerUserId="17553" LastActivityDate="2015-08-27T02:58:35.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20963" PostTypeId="1" AcceptedAnswerId="20969" CreationDate="2015-08-27T14:19:48.777" Score="0" ViewCount="4752" Body="&lt;p&gt;I have 2 distinct network segments (192.168.10.0/24 &amp;amp; 192.168.1.0/24) in my company, and we need them bridged. The thing is the only equipment I have available is a CISCO 878 router that, unfortunately, is a bit peculiar. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 878 is a beefed-up cousin of the consumer-grade routers ISP distribute for free. It supports routing between the (predetermined) WAN port and the 4 LAN ports, which essentially are switch ports and not router ports. It does support VLANs and configuration of the switch ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my 'running-config' I have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface FastEthernet0&#xA;  switchport mode trunk&#xA;  switchport trunk encapsulation dot1q&#xA;  switchport trunk allowed all&#xA;!&#xA;interface Vlan1&#xA;  ip address 192.168.10.80 255.255.255.0&#xA;  no shutdown&#xA;!&#xA;interface Vlan2&#xA;  ip address 192.168.1.69 255.255.255.0&#xA;  no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, in my switch I have configured a port as trunk. What I want is to connect the trunk port on my switch to one of the LAN ports on the 878 and be able to route between the 2 segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I proceed from here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand my problem comes from the fact that the 878 has inside both a router and a switch, and the ports connecting the two are &quot;hidden&quot;. If I had two separate devices I would simply configure subinterfaces on a a router port and proceed with router-on-a-stick configuration.&lt;/p&gt;&#xA;" OwnerUserId="17104" LastEditorUserId="17104" LastEditDate="2015-08-27T14:26:02.187" LastActivityDate="2015-08-27T18:38:45.877" Title="Router-on-a-stick / Inter-VLAN routing with a CISCO 800 Series (878) router" Tags="|cisco|routing|vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20965" PostTypeId="1" CreationDate="2015-08-27T15:12:45.423" Score="-1" ViewCount="50" Body="&lt;p&gt;We need to set up an application that requires the client PC to have a static IP address. It was having trouble retaining the assigned IP address between reboots until we disabled Gratuitous ARP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have set this application up on numerous networks and never encountered this problem.  Is there a setting i.e. on the router or DNS that might be reassigning the IP address?&lt;/p&gt;&#xA;" OwnerUserId="17567" LastActivityDate="2015-08-29T21:09:09.070" Title="Are there router or other network settings that can prevent the setting of a static IP addresson a client PC" Tags="|arp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20967" PostTypeId="1" CreationDate="2015-08-27T18:06:08.073" Score="0" ViewCount="85" Body="&lt;p&gt;The subnet is 192.168.53.0 how is this divided into 3 sub-nets? I am unsure as to how this should be done, i would really appreciate the help. Thanks&lt;/p&gt;&#xA;" OwnerUserId="17569" LastEditorUserId="15982" LastEditDate="2015-08-28T19:37:10.820" LastActivityDate="2015-08-28T19:37:10.820" Title="hi i have a question on separating a network into 3 subnets" Tags="|routing|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20968" PostTypeId="2" ParentId="20963" CreationDate="2015-08-27T18:24:42.050" Score="1" Body="&lt;p&gt;SVIs you created should do the job, as they are L3 interfaces and will do the routing. And using trunk with these VLANs allowed in it should enough to allow them traverse to the switch.&lt;br&gt;&#xA;If this is not working, please check if the L2 VLANs are created by checking VLAN database &lt;code&gt;#show vlan-switch&lt;/code&gt;, and you can create the VLANs in global config mode &lt;code&gt;#vlan ID&lt;/code&gt;. The story behind this is simple - creating L3 interface will not create L2 VLAN, so you have to do it manually in order for the trunk to forward these VLANs properly.&lt;/p&gt;&#xA;" OwnerUserId="868" LastEditorUserId="868" LastEditDate="2015-08-27T18:38:45.877" LastActivityDate="2015-08-27T18:38:45.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20969" PostTypeId="2" ParentId="20963" CreationDate="2015-08-27T18:37:42.757" Score="2" Body="&lt;p&gt;Just connect the trunk port on your switch to FastEthernet0 on your router which you have configured as a trunk port. Also make sure that whatever equipment you have on those two networks have configured 192.168.10.80 and 192.168.1.69 respectively as default gateways. You should also have &lt;code&gt;ip routing&lt;/code&gt; enabled which it should be by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's very much like the typical &quot;router on a stick&quot; except for using vlan interfaces instead of subinterfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it doesn't work, verify the trunk link with &lt;code&gt;show interface status&lt;/code&gt; and &lt;code&gt;show interfaces trunk&lt;/code&gt;. You can also verify the vlan interfaces with &lt;code&gt;show ip int brief&lt;/code&gt; and make sure they are up. If they are down it's probably because you haven't created the layer 2 vlans or because they are not allowed on the trunk.&lt;/p&gt;&#xA;" OwnerUserId="14973" LastActivityDate="2015-08-27T18:37:42.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20970" PostTypeId="2" ParentId="20967" CreationDate="2015-08-27T19:09:04.987" Score="1" Body="&lt;p&gt;You can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any subnetting operation will always be based on a factor of two, because the binary number system is base 2. Therefore splitting up any network into specifically three equal sized parts won't ever be possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You &lt;em&gt;can&lt;/em&gt; however split up 192.168.53.0 into &lt;strong&gt;four&lt;/strong&gt; equal-sized subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.53.0/26    to  192.168.53.63/26&#xA;192.168.53.64/26   to  192.168.53.127/26&#xA;192.168.53.128/26  to  192.168.53.191/26&#xA;192.168.53.192/26  to  192.168.53.255/26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="762" LastActivityDate="2015-08-27T19:09:04.987" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20971" PostTypeId="1" AcceptedAnswerId="20972" CreationDate="2015-08-27T19:35:50.817" Score="2" ViewCount="1868" Body="&lt;p&gt;Trying to monitor some TrippLite switched/metered vertical PDUs with PRTG using SNMP. I can't seem to find any MIB that would provide me with the output current. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have experiencing monitoring these TrippLite PDUs with SNMP? I've download both the TRIPPLITE-MIB and UPS-MIB from their website, but neither of these files contains an entry to current in amps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;MIBS downloaded from &lt;a href=&quot;http://www.tripplite.com/support/model/mid/PDUMV20NET&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Running the following snmpwalk command &lt;code&gt;snmpwalk -v2c -c tripplite 192.168.15.25 1.3.6.1.4.1.850.100.1.4&lt;/code&gt; which is responding with &lt;code&gt;SNMPv2-SMI::enterprises.850.100.1.4 = No Such Object available on this agent at this OID&lt;/code&gt; &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13689" LastEditorUserId="13689" LastEditDate="2015-08-27T19:56:06.240" LastActivityDate="2015-08-27T20:07:37.617" Title="TrippLite PDUVM5NET SNMP MIB for Current" Tags="|snmp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="20972" PostTypeId="2" ParentId="20971" CreationDate="2015-08-27T19:43:23.933" Score="2" Body="&lt;p&gt;Assuming &lt;a href=&quot;http://www.tripplite.com/shared/software/Firmware/Tripp-Lite-MIB-Definitions.txt&quot; rel=&quot;nofollow&quot;&gt;this is the MIB&lt;/a&gt; that you're referring to, I see the following table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tlUpsOutputCircuitTable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With each row in the table being:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tlUpsOutputCircuitIndex     PositiveInteger,&#xA;tlUpsOutputCircuitStatus    INTEGER,&#xA;tlUpsOutputCircuitLoadCurrent   NonNegativeInteger&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Presumably &lt;code&gt;tlUpsOutputCircuitLoadCurrent&lt;/code&gt; would be what you want, and represents the amps in tenths?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Try telling Net-SNMP where to load the MIBs from when you run &lt;code&gt;snmpwalk&lt;/code&gt;. Assuming you've saved those MIB files to &lt;code&gt;/home/ethan/.snmp/mibs&lt;/code&gt; you would do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpwalk -M +/home/ethan/.snmp/mibs -m +TRIPPLITE-MIB -v2c -c 'tripplite' 192.168.15.25 tlUpsOutputCircuitTable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If that still returns an error, the next step would be to just run a bulkwalk on the unit to see what OIDs &lt;strong&gt;are&lt;/strong&gt; available, as the SNMP agent on the device may not export everything that's available in TRIPPLITE-MIB.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpbulkwalk -M +/home/ethan/.snmp/mibs -m +TRIPPLITE-MIB -v2c -c 'tripplite' 192.168.15.25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2015-08-27T20:07:37.617" LastActivityDate="2015-08-27T20:07:37.617" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="20973" PostTypeId="1" CreationDate="2015-08-27T20:59:30.590" Score="0" ViewCount="81" Body="&lt;p&gt;I work for a large organization where the network team is in some disarray (key people left/fired, etc.). My team is responsible for the performance of various client/server applications which of course utilize the network. We often receive performance complaints from application customers (&quot;xxx app is slow&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we receive these complaints, we check our servers for issues. Sometimes we'll restart them and so forth. If we can't find any issues there, our focus turns to the network (since these are client/server apps). We used to have competent network engineers who could inspect/measure traffic between the clients/servers, but don't have that luxury anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some simple performance monitoring approaches we could take to give us a quick--historically contextual--answer around whether the network is misbehaving right now? For example: I can imagine a script or tool which might copy a 1MB file from point A to point B every 30 minutes and record the transfer time. Perhaps it would present the most recent transfer time vs. the last 5 days vs. the last 30 days vs. the last year.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind my team does not have access to the network infrastructure itself (no SNMP, netflow, perfmon, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17574" LastActivityDate="2015-08-27T21:12:52.087" Title="Simple way to monitor network performance w/o access to network infrastructure?" Tags="|troubleshooting|performance|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20974" PostTypeId="2" ParentId="20973" CreationDate="2015-08-27T21:12:52.087" Score="2" Body="&lt;p&gt;Iperf is a great tool for measuring actual TCP or UDP throughput. It is a client server tool so you need access to a machine at both ends of the link to be tested. There is a nice graphical java (jperf) front end that allows you to graph the results. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out &lt;a href=&quot;https://code.google.com/p/xjperf/&quot; rel=&quot;nofollow&quot;&gt;link.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-08-27T21:12:52.087" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20976" PostTypeId="1" CreationDate="2015-08-28T00:02:16.593" Score="1" ViewCount="81" Body="&lt;p&gt;I want to make an IP scan using NMAP, but the operating time varies for some reason. The command can be executed in 2 seconds, and if I launch it again just after, it can take 30 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the command I use :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nmap -n -sn -T5 --max-rtt-timeout 1s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;-n&lt;/code&gt; : no DNS resolution&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;-sn&lt;/code&gt; : disable port scan&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;-T5&lt;/code&gt; fast mode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;--max-rtt-timeout&lt;/code&gt; round trip timeout for the probes 1s&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if my optimisation is good. How do I make it better ?&lt;/p&gt;&#xA;" OwnerUserId="16335" LastEditorUserId="28361" LastEditDate="2016-08-30T16:41:31.897" LastActivityDate="2016-08-30T16:41:31.897" Title="How to make NMAP command steady and the fastest possible?" Tags="|security|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="20978" PostTypeId="2" ParentId="20366" CreationDate="2015-08-28T01:01:26.780" Score="4" Body="&lt;p&gt;&lt;em&gt;I opted to use the Cisco support methods of swapping out my ASA.  You might also consider &lt;a href=&quot;https://networkengineering.stackexchange.com/a/20375/2662&quot;&gt;Ricky Beam's suggestion to swap CF cards&lt;/a&gt; which is &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/20366/checklist-for-replacing-failed-asa-hardware#comment30902_20375&quot;&gt;unsupported by Cisco&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I just finished the swap and definitely have much more clarity about what needs to happen to gracefully swap an ASA5505.  There will be, of course, site-specific considerations, but I have tried to mention anything that probably applies in general.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Setup and Pre-Configuration&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;These tasks can all be done before taking the old ASA out of service.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Find a Second ASA Power Supply&lt;/strong&gt; - AFAICT Cisco doesn't send you a second power supply to help you to replace failing hardware.  If your ASA needs an external power supply and you only have one, you're going to have to take down the old ASA while you configure the new one.  This creates a lot more downtime than is necessary.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Document Cable Connections&lt;/strong&gt; - You are going to be ripping and replacing-with-same. There is also the the possibility of reverting back to the original ASA if the replacement is DOA.  There is also a likelihood that you'll need to perform partial connections as you get the replacement ASA up and running so you need a pretty clear way of matching cables to ports on both the old and new ASA.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Diff &lt;code&gt;show activation-key detail&lt;/code&gt;&lt;/strong&gt; - Connect to the console of the new ASA and dump &lt;code&gt;show activation-key detail&lt;/code&gt; to a file.  Do the same on the old ASA.  Diff the two files and see what stands out.  The replacement ASA I received was activated to the wrong license and there was a wait to get new activation keys.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Download Binaries from Cisco.com and old ASA&lt;/strong&gt; - Download same-version binaries for the firmware and ASDM from both cisco.com and the old ASA.  Compare checksums of the old and new binaries of each.  If the cause of the problems was file corruption, the checksums won't match which might provide a clue.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Save Output of Various Commands from old ASA&lt;/strong&gt; - There are a number of items that are necessary or might come in handy that can only be obtained from the old ASA.  I recommend running and saving the output of the following commands:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;show version&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;show activation-key detail&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;show asdm image&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;show running-config&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Confirm Workstation/ASA Connectivity&lt;/strong&gt; - You're almost certainly going to need both console and SSH access to set up the new ASA.  You might as well ensure that those connections are working with the old ASA prior to replacing it with the new ASA.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Set up a workstation with an independent network connection&lt;/strong&gt; - There's a good chance you'll need to be connected via SSH to the new unconfigured ASA at the same time you need google.  Accordingly, you need a connection to the internet that doesn't depend on troubled ASA.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Load the new ASA with the right Binaries&lt;/strong&gt; - I think there are a few ways of accomplishing this.  I used the console of the new ASA to alter its running configuration just enough to enable TFTP of the appropriate firmware and ASDM binaries to the new ASA's flash.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Change the new ASA's Firmware Version&lt;/strong&gt; - Use the console to issue &lt;code&gt;boot system&lt;/code&gt;, &lt;code&gt;wr mem&lt;/code&gt;, and &lt;code&gt;reload&lt;/code&gt; commands to switch the firmware version to the same as the old ASA&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Change the new ASA's ASDM Image&lt;/strong&gt; - Use the console to issue &lt;code&gt;asdm image&lt;/code&gt; and &lt;code&gt;wr mem&lt;/code&gt; commands to change the asdm image to the same as the old ASA.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Apply and Iterate on Running Config&lt;/strong&gt; - I determined that it took some iteration to get the new ASA to accept all aspects of the old ASA's running-config.  Here are the steps to that iteration:&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Paste the old ASA's running configuration into the console of the new ASA.&lt;/li&gt;&#xA;&lt;li&gt;Save the output of &lt;code&gt;show running-config&lt;/code&gt; to a file.&lt;/li&gt;&#xA;&lt;li&gt;Diff that file with the configuration of the old ASA so you can see what is different.&lt;/li&gt;&#xA;&lt;li&gt;Issue corrective commands to try to correct the differences.  Go back to step 2 and repeat until the old and new running configurations are the same.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Generate New Crypto Keys&lt;/strong&gt; - Use the console to issue a &lt;code&gt;crypto key generate rsa&lt;/code&gt; command.  Without issuing that command, you cannot connect to the ASA over SSH.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Rip and Replace&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Once &lt;em&gt;all&lt;/em&gt; the setup and configuration tasks are done, it should just be a matter of swapping hardware.  This should take only minutes.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;remove the old ASA&lt;/li&gt;&#xA;&lt;li&gt;transfer any brackets and modules to the new ASA&lt;/li&gt;&#xA;&lt;li&gt;mount the new ASA&lt;/li&gt;&#xA;&lt;li&gt;connect all cables except power to the new ASA (you should connect the console port to a terminal so you can watch the boot)&lt;/li&gt;&#xA;&lt;li&gt;connect power to the new ASA&lt;/li&gt;&#xA;&lt;li&gt;monitor the boot sequence for success&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Post-Replacement Tests&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;At this point, at least basic connectivity should be working on the ASA.  To prove the different aspects of workingness, do at least the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;from the console, ping the following:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;8.8.8.8&lt;/li&gt;&#xA;&lt;li&gt;the management workstation that will be connecting over SSH&lt;/li&gt;&#xA;&lt;li&gt;any other node that will help you test that the new hardware is working as desired&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;connect over SSH to the new ASA&lt;/li&gt;&#xA;&lt;li&gt;connect using ASDM to the new ASA&lt;/li&gt;&#xA;&lt;li&gt;test any VPN connections&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2662" LastActivityDate="2015-08-28T01:01:26.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20979" PostTypeId="1" AcceptedAnswerId="20980" CreationDate="2015-08-28T01:44:13.987" Score="3" ViewCount="5583" Body="&lt;pre&gt;&lt;code&gt;PC1-VLAN1======Switch : Successful pings from the switch&#xA;PC1-VLAN2======Switch : *Unsuccessful* pings from the switch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've got a single switch with a static IP directly connected to PC1 with a static IP, both on the same 192.168.1.0/24 network. The switch has no VLAN's on it except the default VLAN1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this setup, the switch can successfully ping PC1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I Create a VLAN2 and assign PC1's port to VLAN2, the switch can no longer ping PC1. I would understand if another PC on a different VLAN couldn't ping PC1, but I would think that the switch could ping either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17576" LastEditorUserId="8499" LastEditDate="2020-02-09T21:10:18.243" LastActivityDate="2020-02-09T21:10:18.243" Title="Cisco Switch Can't Ping Attached Device" Tags="|cisco|switch|vlan|switching|ping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20980" PostTypeId="2" ParentId="20979" CreationDate="2015-08-28T01:49:24.353" Score="2" Body="&lt;p&gt;That's the whole point of VLANs.  VLANs create a layer-2 separation. You can't get from one layer-2 domain to another without a layer-3 device (router) connecting them.  The switch is just another host on a different VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VLANs are like yards separated by fences.  You need a gate (router) to get from one to the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you add a VLAN 2 SVI on the switch with an address in the same subnet as the PC, you could ping the PC.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-08-28T01:49:24.353" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20982" PostTypeId="1" AcceptedAnswerId="20983" CreationDate="2015-08-28T03:07:49.667" Score="2" ViewCount="169" Body="&lt;p&gt;Suppose I have a network of 40 to 50 computers in a LAN. Now suppose a system A open the website google. To open the website, the user of system A types the url in the browser. Now the request will first go the the switch, then the router of the whole network then to the google server via different other routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now when the google gets the request, it will immediately sends the response with a web page. Now, when our network router gets the response, it will transfer it to the switch. Now the question comes here, how does the switch knows which system sends the request to google of 40-50 systems in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does the switch decide where to send the response ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="17563" LastActivityDate="2015-08-28T03:42:35.413" Title="How switch routes the data to the system" Tags="|switch|router|internet|lan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20983" PostTypeId="2" ParentId="20982" CreationDate="2015-08-28T03:15:25.777" Score="2" Body="&lt;p&gt;IP packets have source and destination addresses.  Outbound the souce address will be the PC and the destination will be the web server; inbound will be just the opposite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the router wants to send the packet to the PC, it encapsulates it into a layer-2 frame.  The layer-2 frame has source and destination MAC addresses.  Assuming the PC's IP address is not in the router's ARP cache, it will send an ARP request to find the PCs MAC address, then encapsulate the IP packet in the layer-2 frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch remembers which ports have which MAC addresses, but, if it has forgotten, it will flood the frame to all ports.  The switch just switches the frames.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-08-28T03:42:35.413" LastActivityDate="2015-08-28T03:42:35.413" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20985" PostTypeId="1" AcceptedAnswerId="20987" CreationDate="2015-08-28T05:24:28.353" Score="4" ViewCount="9609" Body="&lt;p&gt;I've noticed that when customizing a server for Dell you have the option to select between &quot;Network Daughter Cards&quot; and &quot;Network Interface Cards&quot;, as well as a number of others. I've looked up the term 'daughter card', but it seems like the two previous terms (NDC and NIC) both fall under that definition. I've also looked for comparisons or differentiators between the two but can't find anything that would justify there being two different terms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know the difference between the two?&lt;/p&gt;&#xA;" OwnerUserId="17583" LastActivityDate="2018-07-04T13:02:27.667" Title="Network Daughter Card vs Network Interface Card" Tags="|interface|terminology|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20987" PostTypeId="2" ParentId="20985" CreationDate="2015-08-28T07:04:44.500" Score="3" Body="&lt;p&gt;A daughter card is typically something used in a blade chassis. But it can also apply to proprietary or internal interfaces within a system -- most commonly for RAID hardware.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-08-28T07:04:44.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20988" PostTypeId="2" ParentId="20822" CreationDate="2015-08-28T08:10:12.333" Score="0" Body="&lt;p&gt;By using &quot;&lt;a href=&quot;https://nmap.org/download.html&quot; rel=&quot;nofollow&quot;&gt;Nmap&lt;/a&gt;&quot; tool, you can do lot of stuff like pining all the devices and port scanning etc. You should try this tool and google the command or refer the &lt;a href=&quot;https://nmap.org/book/man.html&quot; rel=&quot;nofollow&quot;&gt;doc&lt;/a&gt; to built command depending upon your requirements to scan devices.&#xA;There is an android &lt;a href=&quot;https://play.google.com/store/apps/details?id=com.overlook.android.fing&amp;amp;hl=en&quot; rel=&quot;nofollow&quot;&gt;app&lt;/a&gt; to scan the devices which are connected to a hotstop. &lt;/p&gt;&#xA;" OwnerUserId="17153" LastActivityDate="2015-08-28T08:10:12.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20989" PostTypeId="1" AcceptedAnswerId="20997" CreationDate="2015-08-28T09:19:25.650" Score="1" ViewCount="709" Body="&lt;p&gt;We engineer embedded systems (electronics &amp;amp; software), running our own OS with LWIP (a network stack). The device is configured to be IPv6 only (means: no IPv4 is available). These embedded systems run a webserver. A browser must be able to open web pages served by them. Unfortunately, Chrome, Firefox and others do NOT support link local IPv6 addresses as URLs (see e.g. &lt;a href=&quot;https://bugzilla.mozilla.org/show_bug.cgi?id=700999&quot; rel=&quot;nofollow&quot;&gt;Mozilla&lt;/a&gt; and &lt;a href=&quot;https://www.w3.org/Bugs/Public/show_bug.cgi?id=27234&quot; rel=&quot;nofollow&quot;&gt;W3C&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our embedded systems will be connected to the existing network infrastructure (Ethernet). Today, most of our customers networks do not have proper IPv6 setup. Namely, no IPv6 router is available and therefore, our embedded systems and the customers computers (Windows, Linux, etc.) will only have a &quot;link local address&quot; (LLA). As stated above, using LLA is not possible with most browsers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To workaround this, the best solution we can think of is to 'advertise' a prefix to let all computers and our embedded systems generate &quot;unique local addresses&quot; (ULA). The problem is that for some (most?) customers, it won't be easy to convince their IT to reconfigure their network for IPv6 and setup their router to advertise such a prefix in the near future. Therefore, we came up with the following idea: Let our embedded system send out router advertisements (RAs) propagating a prefix like FDxx:xxxx:xxxx::xxxx/64. With that solution, all hosts in the same network will automatically create ULAs and thus every computers browser will be able to connect to our embedded systems. (Note: The idea is that all our embedded systems propagate exactly the same prefix)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Waht do you think about that idea? Specifically:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It's a common use case that several of our embedded systems will be added to the same network. Therefore, multiple systems will send out RAs with the same prefix. So far, Googling and reading RFCs, I coulnd't find any statement whether it's allowed to have more than one &quot;router&quot; sending out RAs with the same prefix. Is it allowed? Is it considered to be &quot;ok&quot; doing that?&lt;/li&gt;&#xA;&lt;li&gt;Our embedded systems are not really &quot;router devices&quot;. In fact, these are &quot;automation devices&quot; which control motors, actors and sensors. Is it &quot;ok&quot; that non-router devices send out RAs?&lt;/li&gt;&#xA;&lt;li&gt;Also: We's send out RAs ONLY to cause all hosts in the network to generate a ULA. We effectively do NOT want any host to use our embedded systems as router/gateway. Is that ok?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17584" LastActivityDate="2015-08-29T12:09:09.590" Title="Is it ok if multiple non-router devices send IPv6 RAs with same prefix in the same network?" Tags="|router|ipv6|icmpv6|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20990" PostTypeId="1" AcceptedAnswerId="20991" CreationDate="2015-08-27T20:16:34.133" Score="1" ViewCount="129" Body="&lt;p&gt;I want to build an application for Raspberry Pi (C++, Boost, OpenSSL) that handles file download/upload requests (and other custom actions). The RPi has an external HDD connected to it (through USB). Let's call it simply &lt;em&gt;Storage&lt;/em&gt; (RPi + HDD).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a public server that I can configure for any need. The problem is that the &lt;em&gt;Storage&lt;/em&gt; is behind a router that I don't have access to configure (port forwarding is excluded), so, the public server cannot connect to &lt;em&gt;Stroage&lt;/em&gt; directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Programmatically, what is the optimal way to communicate between a client (web browser / mobile application) and &lt;em&gt;Storage&lt;/em&gt; through the public server? A simple use case is this: I want to download a file from &lt;em&gt;Storage&lt;/em&gt; to my phone over the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can think of two possible solutions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Maintain a tunnel open between public server and &lt;em&gt;Storage&lt;/em&gt;. Is this scalable for multiple &lt;em&gt;Storages&lt;/em&gt; (assuming that the public server will serve many of them in the future)?&lt;/li&gt;&#xA;&lt;li&gt;The &lt;em&gt;Storage&lt;/em&gt; pings every let's say 3 seconds the public server (more like announces server that it is online) and if the public server has a request from a client, then a full connection will be established (client &amp;lt;-&gt; public server &amp;lt;-&gt; &lt;em&gt;Storage&lt;/em&gt;) and the file download/upload request will be handled normally.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How can I implement this (third party tools like Weaved is excluded) and what other possibilities are there? Also, are the two alternative I described above even viable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The overall sistem architecture looks like the one below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that this is a more general question, but I don't know how to approach my particular case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IKlID.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IKlID.png&quot; alt=&quot;Remote Raspberry Pi requests&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17586" OwnerDisplayName="AlexandruIrimiea" LastActivityDate="2015-08-28T10:52:36.990" Title="Connection between client and remote Raspberry Pi that's behind a router" Tags="|internet|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="20991" PostTypeId="2" ParentId="20990" CreationDate="2015-08-28T10:15:05.550" Score="2" Body="&lt;p&gt;I'll assume your app works on port X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Install ssh server on PS (public server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connect via ssh to PS, and create a reverse port forward, from PS:127.0.0.1:Y (port Y on PS) to S:x&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create a daemon on PS, to listen on port Z. When someone connects to port Z on PS and authenticates (or whatever you need to do) stream data between that new connection and PS:127.0.0.1:Y.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This removes the need of port forwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to take a step further, you can use a hole-punching library to try to do a direct connection (but this is much harder than the above solution).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to ensure the ssh server on ps allows no commands except authentication and reverse port forward, to disallow S clients to do things on the server (if this is desired).&lt;/p&gt;&#xA;" OwnerUserId="1829" OwnerDisplayName="vlad b." LastActivityDate="2015-08-28T10:15:05.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="20992" PostTypeId="2" ParentId="20989" CreationDate="2015-08-28T11:06:55.030" Score="3" Body="&lt;p&gt;I think that this is a very bad idea. Only routers are supposed to send out RAs. Announcing Prefixes without routing them will break things. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2015-08-28T11:06:55.030" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="20996" PostTypeId="2" ParentId="20989" CreationDate="2015-08-28T13:47:43.067" Score="3" Body="&lt;p&gt;This is absolutely not the way to accomplish your goals.  Only real routers should send out RAs and the switches should be set to block RAs from other sources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The end-devices should get their global addressing information through a real router or be statically configured, although they will generate their own link-local addresses using ND, and, if they aren't allowed to use a router, that could be all they need since it will allow IPv6 network on the local link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Non-routers should not generate RAs because other devices &lt;em&gt;will&lt;/em&gt; try to use them as routers.  Non-routers sending RAs is considered a form of DoS.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-08-28T13:47:43.067" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20997" PostTypeId="2" ParentId="20989" CreationDate="2015-08-28T15:50:52.033" Score="1" Body="&lt;p&gt;A non-router shouldn't send RAs, but they can. If you say the lifetime to zero devices won't use it as a default gateway. The problem is advertising a single prefix by all your devices on all networks. Don't assume that users will only have one subnet and that users won't want to connect to your devices across different subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best solution is to use multicast name resolution like mDNS and LLMNR. Take a look at &lt;a href=&quot;https://serverfault.com/questions/352632/name-resolution-in-an-ipv6-network-without-a-dns-server&quot;&gt;https://serverfault.com/questions/352632/name-resolution-in-an-ipv6-network-without-a-dns-server&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to provide a simple IPv6 &quot;dummy router&quot; to your customers that advertises a prefix, where each router advertises a different ULA prefix that is printed on the outside. It can advertise a default gateway lifetime of 0 so it doesn't become a default gateway. Customers that have IPv6 already can use their own prefix, and customers without IPv6 can use/buy/etc your dummy router and use its unique ULA prefix.&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-08-29T12:09:09.590" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="20998" PostTypeId="1" AcceptedAnswerId="21006" CreationDate="2015-08-28T18:56:43.137" Score="1" ViewCount="2328" Body="&lt;p&gt;I asked this question a few weeks ago: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/20346/moving-to-vlans-from-a-basic-network&quot;&gt;Moving to vlans from a basic network&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the advice the answerer gave was right but I think I want to move forward with segregating my network and trying to make it more efficent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I basically have 2 routers. One on the outer network is a &quot;Public Lan&quot; that we allow wifi connections to. I also have an internal &quot;Private Lan&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have 2 internet connections and 2 seperate routers that load balance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to move to a vlan to simplify my network and hopefully speed it up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The outer Peplink router is gigabit and handles my 150mb connection without an issue and the inner router is also a peplink but only does 100mb and a fiber connection we use for voip. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct in thinking that I can use one vlan aware switch out of my router and use that to send my vlans to the dumb switches in each area?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about this diagram? Is it representative of a setup like this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want engineering stuff to be seperate from the office staff stuff but I want the phones for each to reach the voip server as do I want the printer available to everyone. Except some ap users.&lt;a href=&quot;https://i.stack.imgur.com/9mmql.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9mmql.jpg&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or am I over thinking this? I really think I want to go to one router and just make sure AP users can not reach the private network. That way I can take full advantage of my 150MB connection while still keeping everything simple. I would like to have my phones, my office computers, my engineering gear and my ap users all on seperate subnets just for organization sake.&lt;/p&gt;&#xA;" OwnerUserId="10008" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-12-27T19:29:53.057" Title="Moving to VLANs from 2 LANS" Tags="|routing|vlan|network-core|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="20999" PostTypeId="1" AcceptedAnswerId="21002" CreationDate="2015-08-28T18:59:56.733" Score="0" ViewCount="714" Body="&lt;p&gt;By looking at &lt;a href=&quot;https://www.ietf.org/rfc/rfc3768.txt%20RFC3768&quot; rel=&quot;nofollow&quot;&gt;RFC 3768&lt;/a&gt;, section 5.3.9 seems to indicate that indeed you should be able to configure more than one virtual IP in a single instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5.3.9.  IP Address(es)&#xA;&#xA;   One or more IP addresses that are associated with the virtual router.&#xA;   The number of addresses included is specified in the &quot;Count IP Addrs&quot;&#xA;   field.  These fields are used for troubleshooting misconfigured&#xA;   routers.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What would you call a manufacturer that allows you to define secondary IPs on an interface/VLAN, but not in a VRRP instance on that interface? Instead, they say you should just create another instance. While that would work, interoperability with other gear may be at stake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're talking about Fortinet, and all I ever hear from them is &quot;our gear just works that way&quot;.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="8499" LastEditDate="2018-12-26T04:15:38.120" LastActivityDate="2018-12-26T04:15:38.120" Title="Is Fortigate implementation of VRRP RFC compliant?" Tags="|protocol-theory|rfc|vrrp|fhrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21001" PostTypeId="1" AcceptedAnswerId="21004" CreationDate="2015-08-28T20:43:17.360" Score="0" ViewCount="1022" Body="&lt;p&gt;I'm using Huawei&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Device type: HG8245A&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Description: EchoLife HG8245A GPON Terminal (CLASS B+/PRODUCT ID:21500821523GE3017523)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to learn telnet on Windows and then I'm curious about the command line on my router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I typed help/?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WAP&amp;gt;?&#xA;amp clear&#xA;amp debug lswtable all&#xA;amp display efc&#xA;amp display l2act&#xA;amp display l2mac&#xA;amp display sfc&#xA;amp display userflow&#xA;amp show&#xA;backup cfg&#xA;clear poncnt dnstatistic&#xA;clear poncnt gemport upstatistic&#xA;clear poncnt upstatistic&#xA;clear port statistics&#xA;debug bbsp&#xA;debug ddns&#xA;debug ifm&#xA;debug qoscfg&#xA;display access mode&#xA;display apmChipStatus&#xA;display apmpolicy&#xA;display batteryStatus&#xA;display boardItem&#xA;display boot&#xA;display cwmp debug&#xA;display deviceInfo&#xA;display dhcp_em result&#xA;display epon ont info&#xA;display eponkey&#xA;display equip test mode&#xA;display equipId&#xA;display equiptest status&#xA;display ethoam ma info&#xA;display ethoam md info&#xA;display ethoam mep info&#xA;display ethoam mep perf&#xA;display flow&#xA;display inner version&#xA;display lanmac&#xA;display machineItem&#xA;display msg-queue&#xA;display ont config-restore info&#xA;display onu info&#xA;display optic&#xA;display optmode&#xA;display poncnt dnstatistic&#xA;display poncnt gemport upstatistic&#xA;display poncnt upstatistic&#xA;display portstatistics&#xA;display pppoe_em result&#xA;display productId&#xA;display productmac&#xA;display sn&#xA;display swm bootstate&#xA;display swm state&#xA;display sysinfo&#xA;display syslog&#xA;display telnet access&#xA;display timeout&#xA;display timer&#xA;display usb devList&#xA;display userinfo&#xA;display vendorId&#xA;display version&#xA;display wanmac&#xA;display wlanmac&#xA;equip test mode off&#xA;get battery alarm status&#xA;get countbosa&#xA;get mac agingtime&#xA;get ont oamfrequency&#xA;get opm switch&#xA;get optic txmode&#xA;get poncnt upgemport&#xA;get port config&#xA;get port isolate&#xA;get port mac numlimit&#xA;get port statistics&#xA;get port vlan&#xA;get rogue status&#xA;get testself&#xA;get vlan auth&#xA;get wlan advance&#xA;get wlan associated&#xA;get wlan basic&#xA;get wlan enable&#xA;get wlan psk&#xA;get wlan stats&#xA;get wlan wep key&#xA;get wlan wps&#xA;history&#xA;igmp clear statistics&#xA;igmp get debug switch&#xA;igmp get flow info&#xA;igmp get global cfg&#xA;igmp get iptv&#xA;igmp get multilmac&#xA;igmp get port multicast config&#xA;igmp get statistics&#xA;igmp set debug switch&#xA;igmp set iptv&#xA;load pack&#xA;logout&#xA;mtest&#xA;napt cli&#xA;qoscfg get&#xA;quit&#xA;reset&#xA;route get default&#xA;save data&#xA;save log&#xA;set bosa&#xA;set cwmp debug&#xA;set ethportmirror&#xA;set oamdebug&#xA;set ringchk&#xA;set timeout&#xA;set userpasswd&#xA;set voicedebug&#xA;set voicedsploop&#xA;set voicelinetest&#xA;set voiceportloop&#xA;set voicesignalingprint&#xA;set wlan enable&#xA;shell&#xA;sntp get&#xA;su&#xA;system rollback&#xA;vspa debug&#xA;vspa display confrence info&#xA;vspa display dsp running info&#xA;vspa display dsp state&#xA;vspa display mg if state&#xA;vspa display mg info&#xA;vspa display online user info&#xA;vspa display port status&#xA;vspa display signal scene info&#xA;vspa display signal scene list&#xA;vspa display user call state&#xA;vspa display user status&#xA;vspa mgc switch&#xA;vspa remote capture server set&#xA;vspa remote capture set&#xA;vspa reset&#xA;vspa set ptcflag&#xA;vspa shutdown mg&#xA;vspa voiptest&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so, where I could learn about those command lines to setting my router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and I found this article &lt;a href=&quot;https://en.wikipedia.org/wiki/Hayes_command_set&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Hayes_command_set&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;could I say that all of router command lines are hayes command?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="17595" LastActivityDate="2015-08-28T21:08:07.267" Title="Where I could learn about router command line?" Tags="|router|wireless|lan|" AnswerCount="1" CommentCount="1" ClosedDate="2015-08-29T01:01:04.793" ContentLicense="CC BY-SA 3.0" />
  <row Id="21002" PostTypeId="2" ParentId="20999" CreationDate="2015-08-28T20:58:11.223" Score="2" Body="&lt;p&gt;It's hard to say exactly what the question is.&lt;/p&gt;&#xA;&lt;p&gt;Maybe you should rephrase it, with something like :&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;Is fortinet implementation of VRRP RFC-Compliant?&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;The fact is the RFC3768 is obsoleted by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5798#section-3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC5798&lt;/a&gt;, where it is stated in section 3 :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;VRRP specifies an election protocol to provide the virtual router&#xA;function described earlier.  All protocol messaging is performed&#xA;using either IPv4 or IPv6 multicast datagrams; thus, the protocol can&#xA;operate over a variety of multiaccess LAN technologies supporting&#xA;IPvX multicast.  Each link of a VRRP virtual router has a single&#xA;well-known MAC address allocated to it.  This document currently only&#xA;details the mapping to networks using the IEEE 802 48-bit MAC&#xA;address.  The virtual router MAC address is used as the source in all&#xA;periodic VRRP messages sent by the Master router to enable bridge&#xA;learning in an extended LAN.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;A virtual router is defined by its virtual router identifier (VRID)&#xA;and a set of either IPv4 or IPv6 address(es).  A VRRP router may&#xA;associate a virtual router with its real address on an interface.&#xA;The scope of each virtual router is restricted to a single LAN.  A&#xA;VRRP router may be configured with additional virtual router mappings&#xA;and priority for virtual routers it is willing to back up.  The&#xA;mapping between the VRID and its IPvX address(es) must be coordinated&#xA;among all VRRP routers on a LAN.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;There is no restriction against reusing a VRID with a different&#xA;address mapping on different LANs, nor is there a restriction against&#xA;using the same VRID number for a set of IPv4 addresses and a set of&#xA;IPv6 addresses; however, these are two different virtual routers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Following your comment I goes trough the entire RFC and you're right in the fact it always mention &amp;quot;a set of IP address&amp;quot;. It even speak about the &amp;quot;primary address&amp;quot; in a set.&lt;/p&gt;&#xA;&lt;p&gt;So it's quite clear that the author itended the protocol to support multiple IPs per VRID.&lt;/p&gt;&#xA;&lt;p&gt;However, nowhere in the RFC is mentioned something like &amp;quot;the router MUST support a set of X IP address for a given VRID&amp;quot;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;5.2.5.  Count IPvX Addr&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This is the number of either IPv4 addresses or IPv6 addresses&#xA;contained in this VRRP advertisement.  The minimum value is 1.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So I would say, despite the fact the RFC clearly spoke about a &amp;quot;set&amp;quot; of IP address, unfortunately it lacks a &amp;quot;MUST&amp;quot; statement to force vendors to implement it.&lt;/p&gt;&#xA;&lt;p&gt;I guess we have to conclude that, regarding this specific point, Fortinet implementation is RFC-compliant (but I would say, really border-line).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-08-29T20:57:19.193" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21003" PostTypeId="2" ParentId="20999" CreationDate="2015-08-28T20:58:37.117" Score="0" Body="&lt;p&gt;It appears to me that the only real questions that you ask is for comments about Fortinet. &#xA;You probably aren't going to like this but I can see what might have been some motivation for their decision. (Please keep reading I promise I have a point to make.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the true shortcomings (my opinion of course) of VRRP has to do with the amount of idle hardware that it employs. That is, if you want redundancy for LAN-A you must install and configure 2 routers - one as a primary router and the other as backup. The backup does very little all day long but monitor the primary router and if the primary never fails the backup might never route a single packet. If you have a need for secondary addresses then you can possibly split the workload (maybe even load balance) across those very two routers. Allow me to attempt to demonstrate:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say you have 2 IP subnets (172.22.1.0/24 and 172.22.2.0/24) in use hanging from the same router interface and desrie to employ VRRP for redundancy. You could (add a second router obviously) service the first subnet (172.22.1.0/24) with VRRP instance 1 utilizing router-A as primary and router-B as backup. You could then service the second subnet (172.22.2.0/24) with VRRP instance 2 utilizing router-B as primary and router-A as backup. Thus tasking both routers with full time duties (possibly load balancing) at the same time you are providing redundancy for both subnets. Now you no longer have idle hardware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said all of that you are correct that interoperability might be difficult with other manufacturers if/when one of them doesn't employ an entire standard. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I desperately hope you find this helpful in some small way. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-08-28T20:58:37.117" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21004" PostTypeId="2" ParentId="21001" CreationDate="2015-08-28T21:08:07.267" Score="0" Body="&lt;p&gt;No, Hayes commands only apply to dial-up modems that are far less common nowadays than 20 years ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each manufacturer has is own software embedded in its products and so its own command line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some choose to implement command line the behave like other well known manufacturers (like Cisco) so you may find very similar command lines on equipment from different vendors, but this is less common on home office grade equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You  have to rely mainly on the vendor documentation - which is often poor- and the embedded help.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-08-28T21:08:07.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21005" PostTypeId="2" ParentId="19503" CreationDate="2015-08-29T00:11:49.490" Score="0" Body="&lt;p&gt;Check the group policy associated with your AnyConnect profile, and make sure that the ACL used for it allows traffic to pass to the needed subnet.&lt;/p&gt;&#xA;" OwnerUserId="17597" LastEditorUserId="8499" LastEditDate="2016-03-26T15:42:18.353" LastActivityDate="2016-03-26T15:42:18.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21006" PostTypeId="2" ParentId="20998" CreationDate="2015-08-29T01:28:43.433" Score="2" Body="&lt;p&gt;First all first you should define the policy of your segmentation, starting by defining broadcast domains (ie. VLANs and related subnets) you want to have.&#xA;In corporate networks, the most diffused reference is the PCI DSS: &lt;a href=&quot;https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf#page11&quot; rel=&quot;nofollow&quot;&gt;https://www.pcisecuritystandards.org/documents/PCI_DSS_v3.pdf#page11&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, you probably don't need a such formal and strict approach, but still need to define what networks you want to have and how they can communicate between each others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm reading your question correctly, you want:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;public&lt;/li&gt;&#xA;&lt;li&gt;engineering&lt;/li&gt;&#xA;&lt;li&gt;office&lt;/li&gt;&#xA;&lt;li&gt;voip&lt;/li&gt;&#xA;&lt;li&gt;server (only for the printer actually)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I can't say if you're over engineering or not without knowledge of your environment, anyway I think it can be pretty complex for most small networks.&#xA;For instance, a specific network used for printers only, might be an over engineering, but let's say it will scale easily in case of a new DB/file/web/whatever server. On a side note, restricting specific users to access the printer is something I'd manage through authentication rather than with network security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, by looking at your schema, the 802.1Q switch connected to your Peplink seems the only point where these networks meet, with the only exclusion of the phone (voip). If so, (excluding phones) you don't need VLANs that spread into multiple switches making stuff like STP less efficient, you just need a router/firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs are useful when you want an engineer connected to one of the ports of the switch on the left (public), and someone from the office in one of the 2 switches at the bottom (that seems assigned to engineering in the schema), for instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, if I'm understanding your requirements properly, why don't you put a firewall with 5 interfaces where you drew the 802.1q switch , putting the VoIP server and the printers in the server LAN?&#xA;On the firewall you can define the communication policies between these networks than.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Worth to note that VoIP traffic is usually NOT encrypted, if you're concerned about sniffing of calls from office and engineering this solution might not be the best choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, in order to balance the WAN traffic many technologies exists to drive Public network out of a specific link; I don't know Peplink honestly, but with Cisco you can use source/policy routing for instance.&lt;/p&gt;&#xA;" OwnerUserId="17572" LastEditorUserId="17572" LastEditDate="2015-08-29T16:59:07.660" LastActivityDate="2015-08-29T16:59:07.660" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="21011" PostTypeId="1" AcceptedAnswerId="21014" CreationDate="2015-08-29T15:22:24.710" Score="0" ViewCount="160" Body="&lt;p&gt;Had a conversation with a co-worker that left me scratching my head.  Searching the Intrawebz was fruitless in finding an answer.  Anyway my coworker was having some speed issues and was working with a level 2 tech over the phone on the fix.  He uses cable Internet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While helping the tech, the tech mention that he could see the internal &#xA;MAC addresses of my coworkers network externally.  As the tech read them out, my coworker was able to verify that it was his and his roommates equipment.  How is this possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's my understand that MAC's are only visible if you are connected to the same subnet.  Once a packet leaves the network the packet will obtain the MAC of the routers WAN port.&lt;/p&gt;&#xA;" OwnerUserId="17608" LastActivityDate="2015-08-29T16:40:17.517" Title="Internal MAC addresses visible" Tags="|ipv4|mac-address|cable|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21014" PostTypeId="2" ParentId="21011" CreationDate="2015-08-29T16:40:17.517" Score="3" Body="&lt;p&gt;Ever play the game &quot;telephone&quot; as a kid? My guess is that there is a bit of misinformation mixed in with the real information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two most likely solutions I see that could answer this question are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Cable modem/router gateway device is provided by the ISP and has remote management capabilities the tech was using to view the devices on the network.&lt;/li&gt;&#xA;&lt;li&gt;Cable modem is actually functioning as a bridge and not a router. Without installing a gateway/router device, the devices are indeed showing up external to the end user network.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-08-29T16:40:17.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21015" PostTypeId="2" ParentId="20897" CreationDate="2015-08-29T17:02:23.777" Score="1" Body="&lt;p&gt;In an IP packet header, there is a checksum value that is calculated to validate the integrity of the header. If this checksum value doesn't match, the packet is typically discarded. You can read more about &lt;a href=&quot;https://en.wikipedia.org/wiki/IPv4_header_checksum&quot; rel=&quot;nofollow&quot;&gt;IPv4 header checksums&lt;/a&gt; many places online including Wikipedia.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what this error is indicating is that the IP packet header checksum isn't matching the IP packet headers. There was a day an age when this was always a bad thing, however technology is always moving forward. Today, many network cards can provide the ability to calculate and insert this checksum value in the headers itself (either specialized hardware or it's own CPU) so that the computer's CPU doesn't have to do it. This reduces the load on the main computer's CPU giving it more processing cycles to dedicate to other tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now when you are capturing traffic on a system, you are getting copies of the outgoing frames before the hit the network card (or after the network card has processed incoming frames). In cases where the computer is offloading the checksum calculation to the network card, it does nothing with this field leaving it blank (0x0000).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark does highlight these as potential problems, as normally a checksum mismatch is cause for the packet to be dropped. However it also does give the note &lt;code&gt;may be caused by &quot;IP checksum offload&quot;&lt;/code&gt; indicating it may not actually be a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some people recommend disabling the checksum validation in Wireshark's preferences, however I personally disagree. If you do choose to turn it off, only do so while working on that particular capture and then turn it back off. Just because offloading is the most common cause of this behavior, doesn't make it the only one and if it is some other reason, you will want to see these highlighted so you can find out why.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-08-29T17:02:23.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21017" PostTypeId="2" ParentId="20965" CreationDate="2015-08-29T21:09:09.070" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a setting i.e. on the router or DNS that might be reassigning the IP address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;DNS doesn't assign IP address. Neither do routers unless they are providing a DHCP service (assuming IPv4). DHCP is the service on the network that provides IP addresses, whether that is on a server, a router or some other device.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are there router or other network settings that can prevent the setting of a static IP address on a client PC?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As for features that can create problems like this, there are a number of them including dynamic ARP incpection (DAI), IP source guard, or any other feature that requires the use of DHCP for hosts to operate on the network properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, just disabling gratuitous ARP won't typically cause a difference in how those features work. So maybe something like an ARP rate limit may be in play.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, your simple question of are there such features, we can answer. Telling you which and why they are working as you describe would take much more information (vendor/models of devices, diagrams, configurations, packet captures, etc).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-08-29T21:09:09.070" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="21018" PostTypeId="1" AcceptedAnswerId="21019" CreationDate="2015-08-29T22:57:23.023" Score="4" ViewCount="1109" Body="&lt;p&gt;I noticed the following odd behavior with AAAA records when querying existing A records. By base domains I mean domain names without subdomains. So when an A record exist and an AAAA record does not exist on specific records, I get a DNS response with &quot;No errors&quot; instead of getting the expected &quot;Name error&quot; flag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are examples:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Querying a domain with IPv6 support:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nslookup -type=aaaa cisco.com&#xA;Server:  google-public-dns-a.google.com&#xA;Address:  8.8.8.8&#xA;&#xA;Non-authoritative answer:&#xA;Name:    cisco.com&#xA;Address:  2001:420:1101:1::a&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Querying a domain without IPv6 support:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nslookup -type=aaaa microsoft.com&#xA;Server: google-public-dns-a.google.com&#xA;Address:  8.8.8.8&#xA;&#xA;Name:    microsoft.com&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would have expected:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nslookup -type=aaaa microsoft.com&#xA;Server: google-public-dns-a.google.com&#xA;Address:  8.8.8.8&#xA;&#xA;*** google-public-dns-a.google.com can't find microsoft.com: Non-existent domain&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yet if I try a subdomain (example support.microsoft.com), the result will work for an A query, and the AAAA will return an empty result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nslookup -type=a support.microsoft.com&#xA;Server:  google-public-dns-a.google.com&#xA;Address:  8.8.8.8&#xA;&#xA;Non-authoritative answer:&#xA;Name:    e10315.g.akamaiedge.net&#xA;Address:  96.6.190.192&#xA;Aliases:  support.microsoft.com&#xA;          wildcard.support.microsoft.com.edgekey.net&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;AAAA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nslookup -type=aaaa support.microsoft.com&#xA;Server:  google-public-dns-a.google.com&#xA;Address:  8.8.8.8&#xA;&#xA;Non-authoritative answer:&#xA;Non-authoritative answer:&#xA;Name:    support.microsoft.com&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would have expected:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nslookup -type=aaaa support.microsoft.com&#xA;Server:  google-public-dns-a.google.com&#xA;Address:  8.8.8.8&#xA;&#xA;*** google-public-dns-a.google.com can't find support.microsoft.com: Non-existent domain&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yet, when I query non-existing A &amp;amp; AAAA records, I get a proper answer on my AAAA queries... Is this by design or a DNS server bug? I wasn't able to find a reason for this behavior:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nslookup -type=aaaa dontexist.microsoft.com&#xA;Server:  google-public-dns-a.google.com&#xA;Address:  8.8.8.8&#xA;&#xA;*** google-public-dns-a.google.com can't find dontexist.microsoft.com: Non-existent domain&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17614" LastEditorUserId="3232" LastEditDate="2015-09-02T10:51:28.633" LastActivityDate="2015-09-02T10:51:28.633" Title="Why do some AAAA records behave strangely on existing A records?" Tags="|ipv6|dns|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21019" PostTypeId="2" ParentId="21018" CreationDate="2015-08-30T00:21:53.070" Score="6" Body="&lt;p&gt;I actually found what I was looking for in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4074&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4074&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Suppose that an authoritative server has an A RR but has no AAAA RR&#xA;for a host name.  Then, the server should return a response to a query&#xA;for an AAAA RR of the name with the response code (RCODE) being  0&#xA;(indicating no error) and with an empty answer section (see&lt;br /&gt;&#xA;Sections 4.3.2 and 6.2.4 of &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4074&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;). Such a response indicates that there&#xA;is at least one RR of a different type than AAAA for the    queried&#xA;name, and the stub resolver can then look for A RRs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This explain exactly why we do not see &amp;quot;Record not found&amp;quot; for AAAA who have existing A records.&lt;/p&gt;&#xA;" OwnerUserId="17614" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-08-30T00:21:53.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21021" PostTypeId="1" AcceptedAnswerId="21024" CreationDate="2015-08-30T05:53:58.887" Score="0" ViewCount="109" Body="&lt;p&gt;I have  a file server in my local network with publicly accessible web url e.g. example.test-server.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Local IP for the server is 192.168.1.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The local iP of my pc is 192.168.1.11&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, we have NAT hairpin enabled on the router so that we can access the server with the web url from inside the office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, example.test-server.com is accessible from both inside and outside the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is if i've  accessed the server using the public IP or the web url and downloaded a file, whether it costs my bandwidth ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How the request traverses ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether my request goest out of my network up to the internet or it stays inside the local network ?&lt;/p&gt;&#xA;" OwnerUserId="17619" LastActivityDate="2015-08-30T10:26:19.840" Title="Bandwidth usage in accessing Local file server with external URL" Tags="|nat|bandwidth|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21022" PostTypeId="2" ParentId="21021" CreationDate="2015-08-30T07:05:01.900" Score="1" Body="&lt;p&gt;The request goes from your computer to the router that perform the hairpin NAT then to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it doesn't go up to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(In some case the router can be hosted by an ISP on a remote site, so the request may cross a line in both sense, but this is not so common).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-08-30T07:05:01.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21023" PostTypeId="1" CreationDate="2015-08-30T07:37:55.927" Score="0" ViewCount="584" Body="&lt;p&gt;I have a PC connected to the internet with IP#1. I remotely access it to connect to websites from my other PC IP#2 via teamviewer. obviously sites can see IP#1 but is it possible for them to track the original IP I am using to control the PC remotely IP#2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would using VPN/Proxy before remotely connecting to the PC which is doing the browsing do anything to mask my original IP (IP#2)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="17620" LastActivityDate="2015-09-29T14:59:36.617" Title="browsing via remote access to my PC with TeamViewer. Can sites track my original IP?" Tags="|vpn|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21024" PostTypeId="2" ParentId="21021" CreationDate="2015-08-30T09:21:31.370" Score="1" Body="&lt;p&gt;As said by JFL, if you request the public IP mapped to your service, your packets will reach the router where the hairpin NAT is configured (most probably the Router between your LAN and the ISP), and then your internal server.&#xA;The difference between a request to the public IP and a request to the private one is that the packet flow will cross the router where the hairpin NAT is performed, rather than reaching the server through the best layer2 path, for instance (assuming you have 1 switch where your hosts and servers are connected):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Public IP: end host-&gt;switch-&gt;router-&gt;switch-&gt;server (and back)&lt;/li&gt;&#xA;&lt;li&gt;Private IP: end host-&gt;switch-&gt;server (and back)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The main concern you could have is if the link between router and switch may become a bottleneck or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About DNS, it depends by the DNS server/s configured on your hosts. If your hosts have a public DNS (eg. 8.8.8.8), then your first request will cross the WAN link till the public DNS, then it will be cached for the time specified by the TTL field of 'example.test-server.com' record.&#xA;If your hosts use an internal DNS, like your internal router (if it does support DNS Relay/ Proxy DNS), all the requests will cross the LAN, and the router will resolve the first request externally, caching the entry till the TTL expires (in other words, the cache of a local DNS server/router will be used by all the hosts in the LAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, the DNS bandwidth usage isn't something I'd be very concerned of.&lt;/p&gt;&#xA;" OwnerUserId="17572" LastEditorUserId="17572" LastEditDate="2015-08-30T10:26:19.840" LastActivityDate="2015-08-30T10:26:19.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21028" PostTypeId="2" ParentId="20322" CreationDate="2015-08-30T11:02:20.590" Score="3" Body="&lt;p&gt;In Catalyst switches, VLAN ID must match the SVI number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, my guess is that you're confusing SVI (used by the switches) with sub-interfaces (used in routers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is the case, your configuration may look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GiX/Y.20&#xA; encapsulation dot1Q 10&#xA; ip address 192.168.200.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With sub-interfaces, the sub-interface number doesn't need to match the VLAN ID (even if it's a best practice).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, many other possible answers exist, for instance:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Native VLAN is set to 20 in the 2960 while native VLAN of the 6509 is set to 10.&lt;/li&gt;&#xA;&lt;li&gt;2960 has no knowledge of VLANs/802.1Q field at all as the port is configured in &quot;access&quot; (but from your question it seems not the case).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;About the mentioned &quot;Proxy ARP&quot;, I don't think it is the case, because the packets from one VLAN are not allowed to jump in another VLAN; &quot;Proxy ARP&quot; might work in the case of a matching VLAN ID with a mismatching IP addressing, but this is not the case (even if no 802.1Q support, &quot;Proxy ARP&quot; is not needed as the gateway IP and the host IP match).&lt;/p&gt;&#xA;" OwnerUserId="17572" LastEditorUserId="17572" LastEditDate="2015-08-31T13:30:38.717" LastActivityDate="2015-08-31T13:30:38.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21030" PostTypeId="1" AcceptedAnswerId="21034" CreationDate="2015-08-30T13:48:04.653" Score="5" ViewCount="375" Body="&lt;p&gt;Recently I wish to split the network by VLANs. &#xA;Mainly for two reasons&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Exclude management interfaces from the commonly accessible lan&lt;/li&gt;&#xA;&lt;li&gt;Separate WiFi traffic (security and broadcasts)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The current idea is to enable vlans and Layer 3 features of 2960s cisco switch. We have a Mikrotik router and it increases the lag in the network, even while forwarding packets between vlans. That is why I want to dedicate this work to cisco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the schema:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/X7fMC.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/X7fMC.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Switch(config)#ip route 0.0.0.0 0.0.0.0 1.1.1.193&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In Vlan 1 I have servers, printers and other things.&lt;/li&gt;&#xA;&lt;li&gt;In Vlan 2 I have PCs&lt;/li&gt;&#xA;&lt;li&gt;In Vlan 3 I have WiFi&lt;/li&gt;&#xA;&lt;li&gt;And one more Vlan, not shown on the figure.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Client PCs in Vlan 2 and 3 do receive IPs from DHCP (in Vlan 1).&#xA;It is configured on the switch using &lt;code&gt;ip helper-address 1.1.1.10&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately the schema works perfect. But I have tested it only with few devices and do not know if there could be any problems in future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe any of you have any idea about this implementation. How reliable is it?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For example, I am not sure how good is cisco 2960 working as DHCP relay.&lt;/li&gt;&#xA;&lt;li&gt;Or how does Mikrotik know the destination MAC of the host. (It is clear that now the switch replies to every request and in ARP table of Mikrotik everything is assigned to the Mac of Cisco, but let's assume we initialize the connection from another network and Mikrotik does not know the destination mac, it will send the arp to cisco, but how cisco will reply, if his arp is also empty?)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17628" LastActivityDate="2015-08-30T15:16:46.210" Title="Optimizing Network Topology" Tags="|routing|switching|layer3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21031" PostTypeId="1" AcceptedAnswerId="22307" CreationDate="2015-08-30T13:50:25.183" Score="0" ViewCount="204" Body="&lt;p&gt;I'm having problems at my company's colocation routing between two routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have two IP blocks: a &quot;standard&quot; .56/29 and a routed .128/28.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We were having issues with our PBX, so we resurrected an EdgeMarc 4550 (apparently good with VoIP) and put the PBX behind that and left the rest of our equipment behind our Netgear ProSafe FVS318G. The Netgear is at .57 and the Edgemarc is at .58. It looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                 &quot;The Internet&quot;&#xA;                       |&#xA;1.1.1.57 ------ HP ProCurve 1700 ------- 1.1.1.58&#xA;(NetGear)    (used as simple switch)    (EdgeMarc)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can NAT all kinds of IPs from the /28 block into machines on the Netgear LAN, but when I try to do the same thing on the EdgeMarc, the IPs get routed to .57 (as seen from tracert). I believe that I must be doing something wrong on the EdgeMarc as it is more powerful than what I'm used to dealing with; here's the the configuration I have set up on the EdgeMarc (EM):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;NAT -&gt; Port Forwarding: set up for my .136 address into the EM LAN&lt;/li&gt;&#xA;&lt;li&gt;Static Route: 1.1.1.136, 255.255.255.255, 1.1.1.58 &lt;/li&gt;&#xA;&lt;li&gt;Security -&gt; Pass-through rules: DMZ set up for internal addresses&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;One more thing of note, I can set up the same static route on the NetGear and computers on the NetGear LAN can reach 1.1.1.136 without a problem, it's just traffic coming in from &quot;The Internet&quot; don't get routed properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts? I am a one-man show when it comes to IT, but I can usually figure things out with a good bit of research and trial/error, but this one has me stumped!&lt;/p&gt;&#xA;" OwnerUserId="17627" LastActivityDate="2015-09-08T19:51:47.420" Title="Problem routing packets between two routers (EdgeMarc 4550)" Tags="|routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21033" PostTypeId="2" ParentId="21023" CreationDate="2015-08-30T14:28:33.570" Score="1" Body="&lt;p&gt;Using TeamViewer should obscure IP#2 as long as nobody is watching the traffic in and out of IP#1. Any website that is browsed should only see traffic originating from IP#1.&lt;/p&gt;&#xA;" OwnerUserId="17627" LastActivityDate="2015-08-30T14:28:33.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21034" PostTypeId="2" ParentId="21030" CreationDate="2015-08-30T15:16:46.210" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;For example, I am not sure how good is cisco 2960 working as DHCP&#xA;  relay. &lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The 2960 will work just fine as a DHCP relay.  I assume you have created a DHCP scope for each VLAN.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;How does Mikrotik know the destination MAC of the host.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because the 2960 is a layer 3 device, it will rewrite the MAC addresses when forwarding packets to the Mikrotik.  So every packet the Mikrotik receives will have the source MAC of the 2960.  Only the 2960 needs to know the MAC address of the host.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-08-30T15:16:46.210" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21038" PostTypeId="1" CreationDate="2015-08-30T16:50:05.770" Score="2" ViewCount="839" Body="&lt;p&gt;Is there a way to ENCAPSULATE traffic into an ERSPAN tunnel without using a cisco device? What if I wanted to source ERSPAN traffic from a Linux host instead of a switch?&lt;/p&gt;&#xA;" OwnerUserId="17629" LastActivityDate="2015-08-30T16:53:13.940" Title="Encapsulation of ERSPAN in a linux host (Not cisco switch)" Tags="|cisco|linux|mirror|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="21039" PostTypeId="2" ParentId="21038" CreationDate="2015-08-30T16:53:13.940" Score="1" Body="&lt;p&gt;As far as I know, ERSPAN is a Cisco proprietary protocol. That's not to say that someone, somewhere hasn't created something similar or hasn't reverse engineered it. You could ask on the Linux forum.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-08-30T16:53:13.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21043" PostTypeId="1" CreationDate="2015-08-30T23:09:35.170" Score="1" ViewCount="1213" Body="&lt;p&gt;How to set the correct MTU on OpenVPN server client connection ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The highest payload that can be successfully sent from here is 1402 from a Win7 PC.&#xA;    ping host -l 1402 -f&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark shows that the total frame size of the above ICMP packet is 1444 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am uncertain of which options would I need to add to the OpenVPN configuration, &lt;em&gt;link-mtu&lt;/em&gt;, &lt;em&gt;tun-mtu&lt;/em&gt; or &lt;em&gt;mssfix&lt;/em&gt; and their respective values to get my connection up.&lt;/p&gt;&#xA;" OwnerUserId="17639" LastEditorUserId="8499" LastEditDate="2018-02-16T04:25:03.287" LastActivityDate="2018-02-16T04:25:03.287" Title="How to set correct MTU for a particular OpenVPN link" Tags="|vpn|mtu|sslvpn|" AnswerCount="0" CommentCount="1" ClosedDate="2015-08-31T04:56:38.533" ContentLicense="CC BY-SA 3.0" />
  <row Id="21044" PostTypeId="1" CreationDate="2015-08-31T05:53:48.760" Score="4" ViewCount="1939" Body="&lt;p&gt;I'm working at several new network concepts for our company and the challenge is to stack at least two Catalyst 3850 over a distance of 200-300 meters. I know there are other possibilities like VSS or vPC (with other components), but I wanted to know if it's possible to stack them over distance and how this could be done.&#xA;Thank you in advance for your answers!&lt;/p&gt;&#xA;" OwnerUserId="17645" LastActivityDate="2018-03-21T23:38:24.790" Title="Stacking Cisco Catalyst 3850 via Fibre?" Tags="|cisco|cisco-catalyst|stacking|vss|vpc|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21045" PostTypeId="2" ParentId="21044" CreationDate="2015-08-31T07:50:18.243" Score="4" Body="&lt;p&gt;Stack Wise is not possible without the use of stack ports and stack cables and the maximum stack cable length i deal with was CAB-SPWR-150CM which was 1.5 m . so you can't stack over this distance . and also you can make use of this discussion&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2331/can-you-stack-cisco-3750-using-ethernet-cables&quot;&gt;enter link description here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-08-31T07:50:18.243" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="21050" PostTypeId="1" AcceptedAnswerId="21052" CreationDate="2015-08-31T15:33:57.187" Score="0" ViewCount="41" Body="&lt;p&gt;My testbed needs a DDoS detection script or program/software. After detection I will use my solution to do measurements after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to count the number of packets per second and use a threshold mechanism for detection? Or should I have to think about extraction of some specific parameter which would point to a DDoS attack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen in the market where machine learning algorithms are used for anomaly detection. In my scenarion I will be generating UDP, TCP, HTTP-GET floods. For the what is the right way to do the detection? Remember I am interested in detection and not the prevention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a fun time Cheers k&lt;/p&gt;&#xA;" OwnerUserId="17655" LastEditorUserId="17655" LastEditDate="2015-08-31T15:48:29.727" LastActivityDate="2015-08-31T19:30:11.080" Title="Which workflow I would have to follow to create a DDoS detection script?" Tags="|internet|" AnswerCount="1" CommentCount="0" ClosedDate="2015-09-08T20:33:31.560" ContentLicense="CC BY-SA 3.0" />
  <row Id="21052" PostTypeId="2" ParentId="21050" CreationDate="2015-08-31T19:30:11.080" Score="0" Body="&lt;p&gt;If you just want to detect floods, you can simply define a rate limit and when this is exceeded raise an alarm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more machine-learning like way would be: Train an anomaly detection algorithm with legitimate traffic. So you have to chose your features (e.g. packets per second, burst lengths, etc.) and then train you system. Finally you can then just measure the features while operating you network and feed it into the anomaly detector.&lt;/p&gt;&#xA;" OwnerUserId="10219" LastActivityDate="2015-08-31T19:30:11.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21055" PostTypeId="2" ParentId="20892" CreationDate="2015-08-31T20:48:45.840" Score="2" Body="&lt;p&gt;As others have said you can't use IPs that are already in use. You should use a separate subnet that you can route through (to the other network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest using something larger than a /30 block (in case you ever add additional locations) -- a /29 would allow you to expand to 6 locations for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would use something separate from your existing networks (so it stands out) but not adjacent (in case you expand). I would suggest something like &lt;em&gt;10.99.9.0/29&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to be able to test then you should convert your existing VPN to Tunnel based VPNs first:&#xA;&lt;a href=&quot;https://support.software.dell.com/kb/sw7902&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw7902&lt;/a&gt;&#xA;OR:&#xA;&lt;a href=&quot;https://support.software.dell.com/kb/sw11606&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw11606&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has the advantage that you can then more easily make routes to test than Policy based IPsec VPNs. Do this during a period of downtime as the VPN will be down while you switch to a Tunnel interface in the VPN and then create the routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then configure X2 on each router with 1 IP from your Point-to-Point range:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Arlington X2 = 10.99.9.1 /29&#xA;Dallas X2 = 10.99.9.2 /29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both in the LAN zone, both in Static IP mode.&#xA;Connect X2 to the PtP interfaces of your ISP's device (eg. the MPLS). This assumes the link is just a Layer 2 link, no routing is being done by the ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should then be able to use the Diagnostic Ping (or CLI ping) commands from each router to ping the &lt;strong&gt;other&lt;/strong&gt; router's X2 interface (eg. Arlington should be able to ping 10.99.9.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If things are working then you can create a Routing policy to test:&#xA;So on the Arlington router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source: Some 10.74.1.x test IP in Arlington&#xA;Destination: Some 10.74.2.x test IP in Dallas&#xA;Service: Any&#xA;Gateway: 10.99.9.2 (Dallas' X2 IP -- the other side)&#xA;Interface: X2 (the interface Arlington needs to use)&#xA;Metric: make lower than whatever you used for your Tunnel VPN metric.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Make a similar route on Dallas router (but swap all the IPs, so from a Dallas IP to the Arlington IP, the Gateway will be 10.99.9.1 this time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest using something like LAN Speed Test (even the free version):&#xA;&lt;a href=&quot;http://www.totusoft.com/lanspeed.html&quot; rel=&quot;nofollow&quot;&gt;http://www.totusoft.com/lanspeed.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To test the speed to/from your test machines over the VPN &lt;em&gt;first&lt;/em&gt; and then again &lt;em&gt;after&lt;/em&gt; putting the routes in. You should see a speed difference as the traffic goes over the MPLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that works then change the routes so the:&#xA;Source is: Any&#xA;And the Destination is: The network on the other side (instead of just an IP) -- so from Arlington the Destination would be: 10.74.2.0/24.&#xA;Metric: still lower than the VPN Tunnel route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the traffic will go over the MPLS for everybody. This can be done lunch time as the interruption is very minimal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as the Zones for X2 are the same as your X0 networks then no Firewall rules should be needed if you have Interface Trust enabled for the LAN Zone. I don't believe you will need to make any changes to NAT as everything will be routed (with respect to the internal networks). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could then disable the VPN, or leave it and configure Probes on the routes, so that the MPLS' routes are disabled if the probe fails (allowing it to fall back to the VPN. Less useful if it's the same ISP in both cases...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And yes: backup your configs FIRST, and again after :)&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-08-31T20:48:45.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21056" PostTypeId="2" ParentId="20936" CreationDate="2015-08-31T21:02:46.220" Score="1" Body="&lt;p&gt;The problem is likely that you have VLAN tagging mismatch between the two SonicWALLs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How are they connected? With a switch? Or some other device? (an ISP's MPLS device of some kind?)&#xA;&lt;strong&gt;Note:&lt;/strong&gt; &lt;em&gt;I am going to assume on SonicWALL B that the interface is X3, since you don't state it -- just so things are clear. Your packet counts are for X0.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;em&gt;SonicWALL A&lt;/em&gt; has:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;X4:110 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then that is a VLAN subinterface, it will be sending TAGGED VLAN packets out tagged on VLAN 110. Whatever interface/IP you have on &lt;strong&gt;X4&lt;/strong&gt; will be UNTAGGED.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;em&gt;SonicWALL B&lt;/em&gt; has:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;X3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then that is a regular interface, it is expecting only UNTAGGED packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they are connected by a switch then configure the port for SonicWALL A's X4 interface as TAGGED on VLAN 110, and the port for SonicWALL B's X3 interface as UNTAGGED on VLAN 110. OR create a VLAN subinterface on SonicWALL B with the same VLAN ID (eg. X3:110).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Likely you making SonicWALL B's X3 speak to SonicWALL A's X4, not SonicWALL A's X4:110.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;You need both sides to agree&lt;/em&gt;: tagged or untagged packets. A switch can add/remove tags based on the Port VLAN IDs and VLAN membership settings; or the SonicWALL ports need to be set the same.&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-08-31T21:02:46.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21057" PostTypeId="2" ParentId="20796" CreationDate="2015-08-31T21:44:36.793" Score="2" Body="&lt;p&gt;So, for anyone desperate and frantically googling, it turns out that one of my core switches (a Juniper EX4200) lost its configuration (yes, all of them, even the rescue config), when it was powered down. I rebuilt the switch at around 5:30 that morning. The network was up by 8:30, it was a terrible night. &lt;/p&gt;&#xA;" OwnerUserId="17405" LastActivityDate="2015-08-31T21:44:36.793" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21058" PostTypeId="1" CreationDate="2015-08-31T21:55:04.217" Score="0" ViewCount="663" Body="&lt;p&gt;I have to set up a connection from a BIDI SFP to a unidirectional SFP. Any idea how this i even possible? is there an intermediary device that can aggregate the Tx and Rx of one fibre and output only into one line?&lt;/p&gt;&#xA;" OwnerUserId="13422" LastActivityDate="2015-09-01T00:42:54.227" Title="Connection from a BIDI to a uni SFP" Tags="|fiber|sfp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21059" PostTypeId="1" AcceptedAnswerId="21069" CreationDate="2015-08-31T22:18:24.873" Score="2" ViewCount="156" Body="&lt;p&gt;I can write expect scripts to automate logins and backups on regular SSH prompts, but the SRW208 switch has a weird console GUI that makes it difficult to automate logging in. See picture: &lt;a href=&quot;https://i.stack.imgur.com/2XWIr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/2XWIr.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any scripts out there that deal with this? If I can get past this screen and make it to the lcli prompt, I can get a backup, but I'm having trouble even logging in to these devices.&lt;/p&gt;&#xA;" OwnerUserId="15983" LastActivityDate="2016-04-28T14:02:00.060" Title="How to get RANCID to back up a Linksys SRW208?" Tags="|rancid|" AnswerCount="1" CommentCount="1" ClosedDate="2018-03-04T00:52:54.273" ContentLicense="CC BY-SA 3.0" />
  <row Id="21060" PostTypeId="2" ParentId="21058" CreationDate="2015-09-01T00:38:22.787" Score="3" Body="&lt;p&gt;Short answer: NO&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bidirectional (single wire) SFPs come in pairs because they use different frequencies in each direction. Even if you did split the fiber, the TX and RX wavelengths would (a) be different, and (b) not likely to conform to any standard SR/LR optics.  You'll need some form of &quot;media converter&quot; (aka: two port switch) that can take the matching SFP and convert it to whatever standard you want.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-09-01T00:38:22.787" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="21061" PostTypeId="2" ParentId="21058" CreationDate="2015-09-01T00:42:54.227" Score="-2" Body="&lt;p&gt;fiber is half duplex connection so one fiber core must be used as TX and other must used as a RX , SFP module must include both of them at the same time and there is no way to use unidirectional SFP for TX or RX. &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-01T00:42:54.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21063" PostTypeId="1" CreationDate="2015-09-01T05:11:32.593" Score="4" ViewCount="2448" Body="&lt;p&gt;I have IOS Version 15.2(4)S4 on my router, and &quot;show control-plane host open-ports&quot; does not work, is there any other command to generate such output? the &quot;show tcp brief&quot; and &quot;show ip sockets&quot; are not that good!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;IOS Version: 7200 Software (C7200-ADVIPSERVICESK9-M), Version 15.2(4)S4, RELEASE SOFTWARE (fc2)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="17410" LastActivityDate="2017-05-09T07:44:06.130" Title="The Netstat command equivalent on IOS 15" Tags="|cisco-ios-15|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="21064" PostTypeId="1" AcceptedAnswerId="21067" CreationDate="2015-09-01T06:14:24.190" Score="2" ViewCount="3109" Body="&lt;p&gt;Is there any alternative to Cisco's VSS or vPC? I mean not with other vendors, just Cisco? Because I'm planning a new network design here in our company and I'm not really sure, if there's an alternative to the two.&lt;/p&gt;&#xA;" OwnerUserId="17646" LastActivityDate="2022-09-19T06:38:04.923" Title="Alternatives to VSS and vPC?" Tags="|vss|vpc|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21065" PostTypeId="2" ParentId="21063" CreationDate="2015-09-01T06:31:36.380" Score="0" Body="&lt;p&gt;I don't know which router you use, but on IOS 15, I only know the &quot;show control-plane host open-ports&quot; command, so there is no equivalent to that, as far as I know.&lt;/p&gt;&#xA;" OwnerUserId="17646" LastActivityDate="2015-09-01T06:31:36.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21067" PostTypeId="2" ParentId="21064" CreationDate="2015-09-01T07:46:57.780" Score="6" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;First&lt;/em&gt;&lt;/strong&gt; of all there is a big difference between VSS and VPC where Nexus vPC is introduced with Nexus 2,5 and 7K. The vPC is actually eliminate the need of STP on the member vPC ports and allow for efficient load sharing capabilities .The VSS on the other hand is a feature introduced with Cisco 6500 catalyst, its basically combines the Back plane throughput of the two systems which allows for high forwarding rate between ports, &lt;strong&gt;it also simplifies the management by making two physical switch operate as one logical Switch(like stack wise in 2960,3750 series)&lt;/strong&gt;.&#xA;&lt;a href=&quot;http://mycciedatacenter.blogspot.co.il/2013/06/vss-vs-vpc-difference-between-vss-and.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;enter link description here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Second&lt;/em&gt;&lt;/strong&gt; there is a difference between VSS and other redundancy protocoles like HSRP and VRRP , where VSS operate so far like Stack wise in 2960 and 3750 series single IP will manage all the chassis but in HSRP and VRRP you had to assign each chassis one IP and then gave them the Virtual IP but one drawback that VSS can't be supported in all chassis&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EsjLH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EsjLH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Finally&lt;/em&gt;&lt;/strong&gt; if you just want to obtain redundancy between chassis for fail over purposes you can run VSS,HSRP,VRRP for cisco IOS and VPC for Nexus. if you aim to also obtain single management IP you need to run VSS only but it is depend on the chassis   &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-02T07:50:45.430" LastActivityDate="2015-09-02T07:50:45.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21069" PostTypeId="2" ParentId="21059" CreationDate="2015-09-01T09:55:06.917" Score="1" Body="&lt;p&gt;You can also send control characters via expect as far as i know , i used this method in pexpect , if after the initial telnet you can't send the user/pass.&#xA;You can send tab to get to the position , expect any character, and then send the user/pass.&lt;/p&gt;&#xA;" OwnerUserId="6412" LastActivityDate="2015-09-01T09:55:06.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21070" PostTypeId="1" CreationDate="2015-09-01T09:56:00.147" Score="0" ViewCount="303" Body="&lt;p&gt;I am using a LTE Router with a Cellular interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a private LAN (/24 mask), so I'm using NAT to translate my private subnet in order to use the external public IP that my provider assigns to my cellular interface. This IP is dynamic, so here is what I am using :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended NAT&#xA;permit ip 192.168.0.0 0.0.0.255 any &#xA;&#xA;ip nat inside source list NAT interface Cellular0 overload&#xA;ip route 0.0.0.0 0.0.0.0 Cellular0 100&#xA;&#xA;interface Cellular0&#xA; ip nat outside&#xA;&#xA;interface vlan10&#xA; ip nat inside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This setup is working fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have a wired WAN interface, that I want to use when possible, therefore bypassing the Cellular interface.&#xA;Seeing as I have a default route moving all packets to my cellular interface, here is what I have done to achieve using my Wired Gi0 interface when possible :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;track 1 interface gigabitEthernet 0 line-protocol&#xA;&#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0 50 track 1&#xA;ip route 0.0.0.0 0.0.0.0 Cellular0 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But to be perfectly automatic, I would need to change my NAT command-line to this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list NAT interface **Gig0** overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so that my private LAN traffic can be translated and use Gig0's public ip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do this ?&#xA;Cell0 and gig0 public IPs are not the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2015-09-01T14:55:59.947" Title="Dynamically use a different NAT destination interface" Tags="|cisco|nat|acl|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21071" PostTypeId="2" ParentId="7801" CreationDate="2015-09-01T10:07:52.673" Score="0" Body="&lt;p&gt;I've made a short memo on how SIP and NAT interacts, where I've tried to define problens with SIP over NAT and possibe solutions such as TURN and STUN.&#xA;&lt;a href=&quot;https://profcollab.wordpress.com/2015/08/27/nat-and-firewall-traversal-for-sip-and-h-323/&quot; rel=&quot;nofollow&quot;&gt;https://profcollab.wordpress.com/2015/08/27/nat-and-firewall-traversal-for-sip-and-h-323/&lt;/a&gt; &#xA;Also you can refer to a book Voice and Video Conferencing Fundamentals (&lt;a href=&quot;http://www.ciscopress.com/store/voice-and-video-conferencing-fundamentals-9781587052682&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscopress.com/store/voice-and-video-conferencing-fundamentals-9781587052682&lt;/a&gt;) which provides a thorough explanation of this question&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2015-09-01T10:07:52.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21072" PostTypeId="2" ParentId="20298" CreationDate="2015-09-01T12:23:27.233" Score="0" Body="&lt;p&gt;This issue was resolved by installing a VAM2+ crypto accelerator card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DH is now handled by the hardware crypto instead of software crypto&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;custvpn1#sh crypto engine connections dh &#xA;Number of DH's pregenerated = 2&#xA;DH lifetime = 86400 seconds&#xA;&#xA;Software Crypto Engine:&#xA; Conn          Status      Group       Time left &#xA;VAM2+:1:&#xA; Conn          Status      Group       Time left &#xA; 1339            Used    Group 5            6281 &#xA; 1751            Used    Group 1           60250 &#xA; 2207          Pregen    Group 5              -- &#xA; 2443          Pregen    Group 1              -- &#xA; 2980            Used    Group 2             163 &#xA; 3018            Used    Group 2           28501 &#xA; 3055          Pregen    Group 2              --&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the hardware crypto tells me it has a DH index limit which software crypto does not report (we may well have been hitting the software crypto limits)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;custvpn1#sh crypto engine brief &#xA;    crypto engine name:  Virtual Private Network (VPN) Module&#xA;    crypto engine type:  hardware&#xA;                 State:  Enabled&#xA;              Location:  slot 1&#xA;    VPN Module in slot:  1&#xA;          Product Name:  VAM2+&#xA;     Software Serial #:  55AA&#xA;             Device ID:  001F - revision 0000&#xA;             Vendor ID:  0000&#xA;           Revision No:  0x001F0000&#xA;          VSK revision:  0&#xA;          Boot version:  902&#xA;           DPU version:  0&#xA;           HSP version:  3.4(4) (PRODUCTION)&#xA;          Time running:  2w0d&#xA;           Compression:  Yes&#xA;                   DES:  Yes&#xA;                 3 DES:  Yes&#xA;               AES CBC:  Yes (128,192,256)&#xA;              AES CNTR:  No&#xA; Maximum buffer length:  4096&#xA;      Maximum DH index:  5120&#xA;      Maximum SA index:  5120&#xA;    Maximum Flow index:  10230&#xA;  Maximum RSA key size:  2048&#xA;&#xA;&#xA;    crypto engine name:  Cisco VPN Software Implementation&#xA;    crypto engine type:  software&#xA;         serial number:  0198F273&#xA;   crypto engine state:  installed&#xA; crypto engine in slot:  N/A&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16945" LastActivityDate="2015-09-01T12:23:27.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21074" PostTypeId="1" CreationDate="2015-09-01T12:32:02.550" Score="1" ViewCount="3036" Body="&lt;p&gt;At this moment, I have a SG300-28P switch, but it's running out of ports. I want to order another SG300-28p, but I have no idea what modules and cables I need to stack those switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know this?&lt;/p&gt;&#xA;" OwnerUserId="17671" LastEditorUserId="8499" LastEditDate="2016-10-27T23:54:58.703" LastActivityDate="2016-10-27T23:54:58.703" Title="How can I expand my office network with a SG300-28P switch?" Tags="|switch|switching|stacking|cisco-sg300|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21075" PostTypeId="2" ParentId="21070" CreationDate="2015-09-01T12:54:09.633" Score="2" Body="&lt;p&gt;Source address translation only takes place when a packet goes from an &lt;strong&gt;inside&lt;/strong&gt; nat interface to an &lt;strong&gt;outside&lt;/strong&gt; nat interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can just add the line&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list NAT interface GigabitEthernet0 overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in addition to the line for the Cellular0 interface.  Make sure the GigabitEthernet0 interface is also designated as an &lt;strong&gt;outside&lt;/strong&gt; nat interface and the routing will take care of the rest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When packets leave the GigabitEthernet0 interface the source address will be translated to the GigabitEthernet0 address, when they leave the Cellular0 interface they will be translated to the Cellular0 address.&lt;/p&gt;&#xA;" OwnerUserId="16945" LastActivityDate="2015-09-01T12:54:09.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="21076" PostTypeId="2" ParentId="21074" CreationDate="2015-09-01T14:00:06.603" Score="2" Body="&lt;p&gt;No much information in your question how you currently have the switch configured L2/L3 or both, but a quick answer is you aren't really stacking this model as it's not a stackable model. (stackables have only one IP address to manage the stack) You can daisy chain them together using one of the four ports on the front right side and configure as a trunk port on the existing and new switch. Can be technically done with any port but suggest one of the four. Or you can use one of the open SFP slots and buy two fiber modules. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part number# MGBSX1 &quot;1000BASE-SX SFP transceiver, for multimode fiber, 850 nm wavelength&quot; and a 50 micron fiber patch cord between switches. Assuming in the same rack located together a 1-3 meter cable will do. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On most Cisco models if you use one of the SFP ports the the associated copper port is not usable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the ports on the down stream switch are sharing the one uplink to the up stream switch. If this is a small office with mostly internet and low bandwidth traffic then this isn't a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again the ports are either configured as defaults and the two connecting ports between the switches will auto negotiate a link. But if an engineer has made changes to the default config then the link might not come up and spanning tree will shutdown the port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best to find a local network engineer that works with Cisco products and consult with them for the greatest success.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-09-01T14:00:06.603" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="21077" PostTypeId="1" CreationDate="2015-09-01T14:20:52.620" Score="5" ViewCount="2117" Body="&lt;p&gt;I have external hardware that continuously sends UDP data segments over a specified port. I would like to continuously store the last few received packets in a file (could also be time-based).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I use &lt;code&gt;tcpdump&lt;/code&gt; with &lt;code&gt;-G&lt;/code&gt; or &lt;code&gt;-C&lt;/code&gt;, then either a new file is created, or the old one overwritten after the limit is reached. However, this is not what I need. I would like to have a single file that rotates continuously: as a new packet comes in, the oldest packet should be removed to make space for the new one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way I know I will always (after the buffer fills, of course) have a large enough sample (and not of a random size between 0 and N packets/bytes/seconds).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some web searching, I've found that there used to be a tool called &lt;a href=&quot;ftp://ftp.ee.lbl.gov/old/pcapture-0.2.1.tar.Z&quot; rel=&quot;noreferrer&quot;&gt;pcapture&lt;/a&gt; that used a circular buffer to achieve something similar, but it was short-lived and not even supported under Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the best approach with modern tools to achieve such circularity?&lt;/p&gt;&#xA;" OwnerUserId="17675" LastEditorUserId="8499" LastEditDate="2015-10-31T18:09:26.027" LastActivityDate="2016-06-28T06:16:00.117" Title="Circular tcpdump output" Tags="|tcpdump|pcap|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21078" PostTypeId="1" CreationDate="2015-09-01T14:26:50.947" Score="2" ViewCount="392" Body="&lt;p&gt;Does CISCO Nexus 3548P-10G L3 Switch Supports IVP6? What are some other alternative L3 Switches with same or slightly higher hardware configuration as CISCO Nexus 3548P-10G and IPV6 support&lt;/p&gt;&#xA;" OwnerUserId="17676" LastActivityDate="2016-10-03T18:21:56.953" Title="IPV6 Support For Cisco Nexus Switches" Tags="|cisco|juniper|brocade|hp-procurve|netgear-prosafe|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="21079" PostTypeId="2" ParentId="21070" CreationDate="2015-09-01T14:55:59.947" Score="1" Body="&lt;p&gt;I found a way to correctly automate the failover between Gig0 and Cell0, including the NAT operation :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Match the private traffic based on the destination interface&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map Cell0 permit 10&#xA; match interface Cellular0&#xA;!&#xA;route-map gi0 permit 10&#xA; match interface GigabitEthernet0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Create 2 NAT rules to translate the traffic towards the correct interface :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source route-map Cell0 interface Cellular0 overload&#xA;ip nat inside source route-map gi0 interface GigabitEthernet0 overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this piece of configuration, the failover is automatic - although when trying to ping a remote server, the ping fails and never comes back unless I clear the NAT translations, but the transition for the applications (Lync, Exchange) is seamless.&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2015-09-01T14:55:59.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21080" PostTypeId="2" ParentId="21077" CreationDate="2015-09-01T15:09:04.150" Score="0" Body="&lt;p&gt;wireshark for supports circular logging and circular buffering. If you wanting one line of trace for a port to generate a new file then you are going to make the file size setting super small. Not sure what the minimum support file size is. Would have to set the wireshark to filter down to only capturing the desired port. That part is not hard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would imagine it can be done with some experimenting. Too board a subject for this post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;www.wireshark.org. Most linux repositories have wireshark available for download. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's a headless server then it will be more work to get the start config tweaked with the right parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-09-01T15:09:04.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="21082" PostTypeId="2" ParentId="9620" CreationDate="2015-09-01T16:34:36.983" Score="2" Body="&lt;p&gt;As powerkor stated, this was an intentional bug. It is also now fixed in &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/release/notes/asarn95.html#pgfId-148548&quot; rel=&quot;nofollow&quot;&gt;9.5.1&lt;/a&gt;, listed under &lt;strong&gt;Monitoring Features&lt;/strong&gt;. Once you update to 9.5.1 you can disable hiding the username with this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no logging hide username&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They have also added this in other firmware trains:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;9.2(4)&lt;/li&gt;&#xA;&lt;li&gt;9.3(3)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17637" LastActivityDate="2015-09-01T16:34:36.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21086" PostTypeId="1" CreationDate="2015-09-01T17:54:35.143" Score="3" ViewCount="972" Body="&lt;p&gt;I'm planning a deployment of a pair of Cisco ASA 5508-X firewalls in my co-location facility. I purchased the first unit with SMARTnet since it's a newer product and I wanted to get used to the configuration and feature set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm closer to project deployment time and need to obtain the second unit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the SMARTnet cover both units in an Active/Standby scenario? If not, should I buy coverage for the second firewall? &lt;/p&gt;&#xA;" OwnerUserId="548" LastActivityDate="2015-10-09T03:31:47.503" Title="Deploying Active/Standby ASA 5508-X pair - Need SMARTnet on both?" Tags="|cisco|cisco-asa|firewall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="21088" PostTypeId="1" AcceptedAnswerId="21093" CreationDate="2015-09-01T19:01:24.437" Score="0" ViewCount="2559" Body="&lt;p&gt;I searched on google and it only gave me limited information on the differences. I need to know what are also the components on the two encapsulations. Not much information on IP packets except just packets.&lt;/p&gt;&#xA;" OwnerUserId="17684" LastActivityDate="2015-09-02T00:30:11.577" Title="What is the diffrence between a NIC frame and an IP packet?" Tags="|osi|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21090" PostTypeId="2" ParentId="21086" CreationDate="2015-09-01T19:34:40.187" Score="2" Body="&lt;p&gt;You'll need SMARTnet on both units if you want support as it is tied to the hardware serial number of the unit it covers. I highly recommend buying the coverage for both, especially if you've never setup failover.&lt;/p&gt;&#xA;" OwnerUserId="17637" LastActivityDate="2015-09-01T19:34:40.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21093" PostTypeId="2" ParentId="21088" CreationDate="2015-09-02T00:30:11.577" Score="3" Body="&lt;p&gt;Dear you must know that there is no thing called NIC frames because NIC is OSI layer 1 device such like hubs and cables so it simple generate bits (0s and 1s) , each OSI layer generate different type of Data  called protocol data unit &lt;strong&gt;&lt;em&gt;PDU&lt;/em&gt;&lt;/strong&gt; and special device can understand it as next &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;L1&gt;&gt;Bits (Cables,NIC,HUB)&lt;/li&gt;&#xA;&lt;li&gt;L2&gt;&gt;Frames (L2 Switches)&lt;/li&gt;&#xA;&lt;li&gt;L3&gt;&gt;Packets (L3 switches and Routers)&lt;/li&gt;&#xA;&lt;li&gt;L4&gt;&gt;&lt;strong&gt;Segment&lt;/strong&gt; (Fire walls)&lt;/li&gt;&#xA;&lt;li&gt;L5:L7&gt;&gt;&lt;strong&gt;Data&lt;/strong&gt; (PC and Servers)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Where each layer adds its header  on the previous PDU and generates its own PDU in the encapsulation process and vise versa in the decapsulation process&lt;br&gt;&#xA;For example during the encapsulation process L5 (Data) encapsulated in L4 header and generate new PDU called Segment and during the decapsulation process L4 segment header will be striped off to get Data from it as the next&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aAbdO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aAbdO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;now we can answer your question&lt;/em&gt;&lt;/strong&gt; , each Layer add functional header to the previous layer for example L3 will add header indicate source and distination L3 address (IPs) or some times called logical address and other informations provide end to end delivery insurance and so on as next &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XtzQW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XtzQW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-02T00:30:11.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21096" PostTypeId="1" AcceptedAnswerId="21132" CreationDate="2015-09-02T04:17:49.913" Score="0" ViewCount="201" Body="&lt;p&gt;I am not sure whether my question is suit for this place. I am a newbie in computer networks. And I choose Andrew S. Tanenbaum's Computer Networks for my textbook. In the second chapter:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Given a bit rate of b bits/sec, the time required to send the 8 bits in our example&#xA;  1 bit at a time is 8/b sec, so the frequency of the first harmonic of this signal&#xA;  is b /8 Hz. An ordinary telephone line, often called a voice-grade line, has an&#xA;  artificially introduced cutoff frequency just above 3000 Hz. The presence of this&#xA;  restriction means that the number of the highest harmonic passed through is&#xA;  roughly 3000/(b/8), or 24,000/b (the cutoff is not sharp).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here I can't see why the number of the highest harmonic passed through is roughly 3000/(b/8). I think b/8 is the number of harmonics transmit in one second. so if the cutoff frequency is 3000 Hz. then we must transmit about 3000 harmonics to rebuilt the signal. so I think 3000 / (b/8) is the time of transmit a signal. Please help me... thanks very much.&lt;/p&gt;&#xA;" OwnerUserId="17691" LastActivityDate="2015-09-03T03:57:14.710" Title="what's the meaning of this formula &quot;cutoff frequency / (b/8)&quot;" Tags="|hardware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="21098" PostTypeId="1" CreationDate="2015-09-02T11:24:30.053" Score="0" ViewCount="5748" Body="&lt;p&gt;I was able to connect to a remote machine using Remote Desktop application via its IP address under Windows 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I can't ping the remote machine through command line, knowing that I turned off the firewall and every other third-party application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do?&lt;/p&gt;&#xA;" OwnerUserId="17497" LastEditorUserId="17497" LastEditDate="2015-09-02T16:32:02.200" LastActivityDate="2015-09-02T21:17:40.603" Title="I Can't Ping Remote Machine with its Public IP Address" Tags="|ipv4|firewall|ip|ping|" AnswerCount="3" CommentCount="2" ClosedDate="2015-09-04T06:07:06.313" ContentLicense="CC BY-SA 3.0" />
  <row Id="21099" PostTypeId="2" ParentId="21098" CreationDate="2015-09-02T11:34:50.043" Score="3" Body="&lt;p&gt;Are you sure that default GW for this machine is not discarding icmp packets? Can you still access Remote desktop? Make sure your firewall settings permit this kind of traffic on every device that stands in front of this machine.&lt;/p&gt;&#xA;" OwnerUserId="16890" LastActivityDate="2015-09-02T11:34:50.043" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="21100" PostTypeId="1" CreationDate="2015-09-02T12:34:16.027" Score="4" ViewCount="719" Body="&lt;p&gt;I have a OSPF network partitioned onto 2 areas as shown in the Figure below.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dwbxC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dwbxC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Area 4 is configured as a NSSA with no-summary which receives only default route. Routers R3, R4, R5 are redistributing the same IP address 100.0.0.1 (locally configured Loopback interface). My problem is that R2 installs 3 routes (OSPF NSSA external type 2) to the destinations and R1 installs only one (OSPF external type 2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2 routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ip route &#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     1.0.0.0/32 is subnetted, 1 subnets&#xA;O       1.1.1.1 [110/2] via 10.0.12.1, 00:10:38, FastEthernet0/1&#xA;     2.0.0.0/32 is subnetted, 1 subnets&#xA;C       2.2.2.2 is directly connected, Loopback0&#xA;     100.0.0.0/32 is subnetted, 1 subnets&#xA;O N2    100.0.0.1 [110/20] via 10.0.99.5, 00:03:45, FastEthernet0/0&#xA;                  [110/20] via 10.0.99.4, 00:04:14, FastEthernet0/0&#xA;                  [110/20] via 10.0.99.3, 00:04:33, FastEthernet0/0&#xA;     3.0.0.0/32 is subnetted, 1 subnets&#xA;O       3.3.3.3 [110/2] via 10.0.99.3, 00:11:17, FastEthernet0/0&#xA;     4.0.0.0/32 is subnetted, 1 subnets&#xA;O       4.4.4.4 [110/2] via 10.0.99.4, 00:11:17, FastEthernet0/0&#xA;     5.0.0.0/32 is subnetted, 1 subnets&#xA;O       5.5.5.5 [110/2] via 10.0.99.5, 00:11:18, FastEthernet0/0&#xA;     10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks&#xA;C       10.0.12.0/30 is directly connected, FastEthernet0/1&#xA;C       10.0.27.0/30 is directly connected, FastEthernet1/0&#xA;O       10.0.16.0/30 [110/2] via 10.0.12.1, 00:10:40, FastEthernet0/1&#xA;O       10.0.67.0/30 [110/2] via 10.0.27.2, 00:11:28, FastEthernet1/0&#xA;C       10.0.99.0/24 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip route &#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     1.0.0.0/32 is subnetted, 1 subnets&#xA;C       1.1.1.1 is directly connected, Loopback0&#xA;     2.0.0.0/32 is subnetted, 1 subnets&#xA;O       2.2.2.2 [110/2] via 10.0.12.2, 00:12:06, FastEthernet0/1&#xA;     100.0.0.0/32 is subnetted, 1 subnets&#xA;O E2    100.0.0.1 [110/20] via 10.0.99.5, 00:05:02, FastEthernet0/0&#xA;     3.0.0.0/32 is subnetted, 1 subnets&#xA;O       3.3.3.3 [110/2] via 10.0.99.3, 00:12:06, FastEthernet0/0&#xA;     4.0.0.0/32 is subnetted, 1 subnets&#xA;O       4.4.4.4 [110/2] via 10.0.99.4, 00:12:06, FastEthernet0/0&#xA;     5.0.0.0/32 is subnetted, 1 subnets&#xA;O       5.5.5.5 [110/2] via 10.0.99.5, 00:12:07, FastEthernet0/0&#xA;     10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks&#xA;C       10.0.12.0/30 is directly connected, FastEthernet0/1&#xA;O       10.0.27.0/30 [110/2] via 10.0.12.2, 00:12:07, FastEthernet0/1&#xA;C       10.0.16.0/30 is directly connected, FastEthernet1/0&#xA;O       10.0.67.0/30 [110/2] via 10.0.16.2, 00:12:07, FastEthernet1/0&#xA;C       10.0.99.0/24 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand that one of the routers performs Type7/5 translation (in that case R2 as it has higher router-id) therefore it installs 3 all the routes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, is it possible to load balance the traffic so that all the 3 routes are installed on R1 as well? If not, would it be possible to remove the route to 100.0.0.1 from R1 so that the traffic goes via R2 only (PBR is not an option in my case). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router configurations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*********         R1        *************&#xA;!&#xA;interface Loopback0&#xA; ip address 1.1.1.1 255.255.255.255&#xA; ip ospf 1 area 0&#xA;!         &#xA;interface FastEthernet0/0&#xA; ip address 10.0.99.1 255.255.255.0&#xA; ip ospf 1 area 4&#xA;!         &#xA;interface FastEthernet0/1&#xA; ip address 10.0.12.1 255.255.255.252&#xA; ip ospf 1 area 0&#xA;!         &#xA;interface FastEthernet1/0&#xA; ip address 10.0.16.1 255.255.255.252&#xA; ip ospf 1 area 0     &#xA;!         &#xA;router ospf 1&#xA; router-id 1.1.1.1&#xA; log-adjacency-changes&#xA; area 4 nssa no-summary&#xA;!&#xA;*********         R2        *************&#xA;!&#xA;interface Loopback0&#xA; ip address 2.2.2.2 255.255.255.255&#xA; ip ospf 1 area 0&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.0.99.2 255.255.255.0&#xA; ip ospf 1 area 4&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 10.0.12.2 255.255.255.252&#xA; ip ospf 1 area 0&#xA;!         &#xA;interface FastEthernet1/0&#xA; ip address 10.0.27.1 255.255.255.252&#xA; ip ospf 1 area 0&#xA;!&#xA;!&#xA;router ospf 1&#xA; router-id 2.2.2.2&#xA; log-adjacency-changes&#xA; area 4 nssa no-summary&#xA;!&#xA;*********         R3        *************&#xA;!&#xA;interface Loopback0&#xA; ip address 3.3.3.3 255.255.255.255&#xA; ip ospf 1 area 4&#xA;!&#xA;interface Loopback1&#xA; ip address 100.0.0.1 255.255.255.255&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.0.99.3 255.255.255.0&#xA; ip ospf 1 area 4&#xA;!&#xA;router ospf 1&#xA; router-id 3.3.3.3&#xA; log-adjacency-changes&#xA; area 4 nssa no-summary&#xA; redistribute connected subnets&#xA;!&#xA;*********         R4        *************&#xA;!&#xA;interface Loopback0&#xA; ip address 4.4.4.4 255.255.255.255&#xA; ip ospf 1 area 4&#xA;!&#xA;interface Loopback1&#xA; ip address 100.0.0.1 255.255.255.255&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.0.99.4 255.255.255.0&#xA; ip ospf 1 area 4&#xA;!&#xA;router ospf 1&#xA; router-id 4.4.4.4&#xA; log-adjacency-changes&#xA; area 4 nssa no-summary&#xA; redistribute connected subnets&#xA;!&#xA;*********         R5        *************&#xA;!&#xA;interface Loopback0&#xA; ip address 5.5.5.5 255.255.255.255&#xA; ip ospf 1 area 4&#xA;!&#xA;interface Loopback1&#xA; ip address 100.0.0.1 255.255.255.255&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.0.99.5 255.255.255.0&#xA; ip ospf 1 area 4&#xA;!&#xA;router ospf 1&#xA; router-id 5.5.5.5&#xA; log-adjacency-changes&#xA; area 4 nssa no-summary&#xA; redistribute connected subnets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;show ip ospf database:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1# show ip ospf database &#xA;&#xA;            OSPF Router with ID (1.1.1.1) (Process ID 1)&#xA;&#xA;        Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;1.1.1.1         1.1.1.1         35          0x80000003 0x00A5F4 3&#xA;2.2.2.2         2.2.2.2         34          0x80000003 0x00E88E 3&#xA;10.0.67.1       10.0.67.1       39          0x80000003 0x00FAB3 2&#xA;10.0.67.2       10.0.67.2       40          0x80000003 0x00F79D 2&#xA;&#xA;        Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;10.0.12.2       2.2.2.2         37          0x80000001 0x00AC64&#xA;10.0.16.2       10.0.67.1       41          0x80000001 0x00EE91&#xA;10.0.27.2       10.0.67.2       40          0x80000001 0x00ABC3&#xA;10.0.67.2       10.0.67.2       44          0x80000001 0x00748C&#xA;&#xA;        Summary Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;3.3.3.3         1.1.1.1         25          0x80000001 0x00F436&#xA;3.3.3.3         2.2.2.2         35          0x80000001 0x00D650&#xA;4.4.4.4         1.1.1.1         39          0x80000001 0x00C660&#xA;4.4.4.4         2.2.2.2         39          0x80000001 0x00A87A&#xA;5.5.5.5         1.1.1.1         39          0x80000001 0x00988A&#xA;5.5.5.5         2.2.2.2         39          0x80000001 0x007AA4&#xA;10.0.99.0       1.1.1.1         80          0x80000001 0x00AD1D&#xA;10.0.99.0       2.2.2.2         83          0x80000001 0x008F37&#xA;&#xA;        Router Link States (Area 4)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;1.1.1.1         1.1.1.1         42          0x80000002 0x00CB74 1&#xA;2.2.2.2         2.2.2.2         43          0x80000002 0x008DA9 1&#xA;3.3.3.3         3.3.3.3         43          0x80000002 0x00D041 2&#xA;4.4.4.4         4.4.4.4         52          0x80000002 0x00E420 2&#xA;5.5.5.5         5.5.5.5         51          0x80000002 0x00F8FE 2&#xA;&#xA;        Net Link States (Area 4)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;10.0.99.5       5.5.5.5         43          0x80000002 0x00ACB7&#xA;&#xA;        Summary Net Link States (Area 4)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;0.0.0.0         1.1.1.1         86          0x80000001 0x001B17&#xA;0.0.0.0         2.2.2.2         89          0x80000001 0x00FC31&#xA;&#xA;        Type-7 AS External Link States (Area 4)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;100.0.0.1       3.3.3.3         86          0x80000001 0x006CAC 0&#xA;100.0.0.1       4.4.4.4         97          0x80000001 0x008090 0&#xA;100.0.0.1       5.5.5.5         94          0x80000001 0x009474 0&#xA;&#xA;        Type-5 AS External Link States&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;100.0.0.1       2.2.2.2         29          0x80000001 0x0051D1 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ip ospf database &#xA;&#xA;            OSPF Router with ID (2.2.2.2) (Process ID 1)&#xA;&#xA;        Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;1.1.1.1         1.1.1.1         72          0x80000003 0x00A5F4 3&#xA;2.2.2.2         2.2.2.2         69          0x80000003 0x00E88E 3&#xA;10.0.67.1       10.0.67.1       76          0x80000003 0x00FAB3 2&#xA;10.0.67.2       10.0.67.2       75          0x80000003 0x00F79D 2&#xA;&#xA;        Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;10.0.12.2       2.2.2.2         72          0x80000001 0x00AC64&#xA;10.0.16.2       10.0.67.1       77          0x80000001 0x00EE91&#xA;10.0.27.2       10.0.67.2       75          0x80000001 0x00ABC3&#xA;10.0.67.2       10.0.67.2       80          0x80000001 0x00748C&#xA;&#xA;        Summary Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;3.3.3.3         1.1.1.1         62          0x80000001 0x00F436&#xA;3.3.3.3         2.2.2.2         70          0x80000001 0x00D650&#xA;4.4.4.4         1.1.1.1         75          0x80000001 0x00C660&#xA;4.4.4.4         2.2.2.2         73          0x80000001 0x00A87A&#xA;5.5.5.5         1.1.1.1         75          0x80000001 0x00988A&#xA;5.5.5.5         2.2.2.2         73          0x80000001 0x007AA4&#xA;10.0.99.0       1.1.1.1         117         0x80000001 0x00AD1D&#xA;10.0.99.0       2.2.2.2         115         0x80000001 0x008F37&#xA;&#xA;        Router Link States (Area 4)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;1.1.1.1         1.1.1.1         79          0x80000002 0x00CB74 1&#xA;2.2.2.2         2.2.2.2         76          0x80000002 0x008DA9 1&#xA;3.3.3.3         3.3.3.3         78          0x80000002 0x00D041 2&#xA;4.4.4.4         4.4.4.4         87          0x80000002 0x00E420 2&#xA;5.5.5.5         5.5.5.5         87          0x80000002 0x00F8FE 2&#xA;&#xA;        Net Link States (Area 4)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;10.0.99.5       5.5.5.5         77          0x80000002 0x00ACB7&#xA;&#xA;        Summary Net Link States (Area 4)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;0.0.0.0         1.1.1.1         122         0x80000001 0x001B17&#xA;0.0.0.0         2.2.2.2         121         0x80000001 0x00FC31&#xA;&#xA;        Type-7 AS External Link States (Area 4)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;100.0.0.1       3.3.3.3         120         0x80000001 0x006CAC 0&#xA;100.0.0.1       4.4.4.4         131         0x80000001 0x008090 0&#xA;100.0.0.1       5.5.5.5         128         0x80000001 0x009474 0&#xA;&#xA;        Type-5 AS External Link States&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;100.0.0.1       2.2.2.2         63          0x80000001 0x0051D1 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UPDATE&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I found partial solution to the problem. In case the load sharing is not possible I wanted to route the traffic through one of the routers (R1 or R2) only. This is possible if we suppress forwarding address on R2. This forces other routers in Area 0 to use R2 as a gateway to the 100.0.0.1 IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following command has to be added on R2. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA; area 4 nssa translate type7 suppress-fa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17651" LastEditorUserId="17651" LastEditDate="2015-09-02T16:36:06.127" LastActivityDate="2015-10-30T19:45:41.637" Title="OSPF NSSA load balancing" Tags="|cisco|routing|ospf|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21103" PostTypeId="2" ParentId="21100" CreationDate="2015-09-02T14:09:09.647" Score="2" Body="&lt;p&gt;I've noticed one problem in your configuration. Your ASBRs (R3-5) and ABRs (R1-2) are configured with &lt;code&gt;area 4 nssa no-summary&lt;/code&gt;&#xA;According to configuration guide of NSSA area &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/6208-nssa.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/6208-nssa.html&lt;/a&gt; you shoud issue no-summary only on ABRs.&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2015-09-02T14:09:09.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21104" PostTypeId="1" AcceptedAnswerId="21105" CreationDate="2015-09-02T15:54:07.643" Score="2" ViewCount="976" Body="&lt;p&gt;I am trying to setup IP SLA for my WAN interface and want the NAT to be setup to when the link goes down the NAT will switch over. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 15.5&#xA;track 1 ip sla 10 reachability&#xA;interface GigabitEthernet0/0&#xA; ip address 10.1.10.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 74.92.x.x 255.255.255.252&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/2&#xA; ip address 66.219.x.x 255.255.255.252&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip forward-protocol nd&#xA;ip nat inside source list 7 interface GigabitEthernet0/2 overload&#xA;ip route 0.0.0.0 0.0.0.0 66.219.x.x track 1&#xA;ip route 0.0.0.0 0.0.0.0 74.92.x.x 10&#xA;ip sla 10&#xA; icmp-echo 8.8.8.8 source-interface GigabitEthernet0/2&#xA; frequency 10&#xA;ip sla schedule 10 life forever start-time now&#xA;access-list 7 permit any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried multiple different configurations with the NAT, but cannot seem to get both in there and working once the link fails over.&lt;/p&gt;&#xA;" OwnerUserId="17370" LastEditorDisplayName="user36472" LastEditDate="2018-02-18T08:30:21.730" LastActivityDate="2018-02-18T08:30:21.730" Title="Multiple Wan Nat with IP SLA" Tags="|nat|wan|failover|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="21105" PostTypeId="2" ParentId="21104" CreationDate="2015-09-02T16:27:28.310" Score="3" Body="&lt;p&gt;You're correct, I overlooked that you're using an access-list for the nat statement. You'll want to change it to a route map. Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source route-map wan1 interface GigabitEthernet0/1 overload&#xA;ip nat inside source route-map wan2 interface GigabitEthernet0/2 overload&#xA;route-map wan1 permit 10&#xA; match interface GigabitEthernet0/1&#xA;!        &#xA;route-map wan2 permit 10&#xA; match interface GigabitEthernet0/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I labbed your config to do a full test and there are a few extra bits you'll want to add.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want to add a route to the ip you're pinging so it always goes out the correct interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 8.8.8.8 255.255.255.255 66.219.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Full example config (tested in VIRL), I made up the last 2 octets of your public IPs and gateways:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;track 1 ip sla 1 reachability&#xA;&#xA;interface GigabitEthernet0/0&#xA; ip address 10.1.10.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;    !&#xA;interface GigabitEthernet0/1&#xA; ip address 74.92.1.2 255.255.255.252&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/2&#xA; ip address 66.219.1.2 255.255.255.252&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 10.1.10.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;&#xA;ip nat inside source route-map wan1 interface GigabitEthernet0/1 overload&#xA;ip nat inside source route-map wan2 interface GigabitEthernet0/2 overload&#xA;ip route 0.0.0.0 0.0.0.0 66.219.1.1 track 1&#xA;ip route 0.0.0.0 0.0.0.0 74.92.1.1 10&#xA;ip route 8.8.8.8 255.255.255.255 66.219.1.1&#xA;!&#xA;ip sla 1&#xA; icmp-echo 8.8.8.8 source-interface GigabitEthernet0/2&#xA; frequency 10&#xA;ip sla schedule 1 life forever start-time now&#xA;!&#xA;route-map wan1 permit 10&#xA; match interface GigabitEthernet0/1&#xA;!        &#xA;route-map wan2 permit 10&#xA; match interface GigabitEthernet0/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17637" LastEditorUserId="17637" LastEditDate="2015-09-03T00:11:29.397" LastActivityDate="2015-09-03T00:11:29.397" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21106" PostTypeId="1" AcceptedAnswerId="21124" CreationDate="2015-09-02T16:41:16.307" Score="1" ViewCount="606" Body="&lt;p&gt;I'm going through the great CBT nuggets series for the CCNA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the video on WAN protocols Jeremy sets up a PPP connection between two routers using CHAP authentication.&#xA;On each router he adds a local user with the name of the adjacent router's hostname, runs ppp authentication chap on each router's interface and it just works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the significance of creating a local user with the hostname of the connected router? Does something special happen when you create a local user with the hostname of a router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&#xA;I have R1 and R2 connected with a serial link using PPP encapsulation.&#xA;I enable ppp chap authentication on R1's connected interface.&#xA;I add a local user on R1 named R2 and give it a password.&#xA;I then add a local user on R2 name R1 and give it the same password.&#xA;Now one way authentication is in effect and it starts working, but I don't understand how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm creating 2 different user accounts with the same passwords. During ppp authentication I guess the routers just authentication with each other's hostnames? I tried creating a local user on each router with the name &quot;joe&quot; and gave it the same password, but authentication did not work.&lt;/p&gt;&#xA;" OwnerUserId="13362" LastActivityDate="2015-09-02T22:29:07.610" Title="What is happening during CHAP PPP authentication between Cisco routers?" Tags="|cisco|wan|authentication|ppp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21108" PostTypeId="1" AcceptedAnswerId="21109" CreationDate="2015-09-02T18:13:48.253" Score="4" ViewCount="1098" Body="&lt;p&gt;I'm a complete beginner at networking, but if I've understood this correctly, the gist of ARP is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We want to use high level adresses to the highest degree possible but ultimately, we actually need the sinks MAC adress to transmit to it.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;We route a packet to the host with ip adress &lt;code&gt;I&lt;/code&gt;. But we do not know which MAC adress to send it to. &lt;/li&gt;&#xA;&lt;li&gt;Now we broadcast a message in the style of &quot;hey, who does this IP adress belong to?&quot; &lt;/li&gt;&#xA;&lt;li&gt;The sink recognizes its IP and responds by sending its MAC adress.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, we are doing ARP because we do not want to broadcast the entire packet? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follow-up #1: I recall reading that at least for Ethernet networks, broadcasting is basically as cheap as single transmissions. But at the time of sending the packet, we do not know if the sink is on Ethernet so we can not assume broadcasting is cheap?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follow-up #2: At what point do we broadcast? Say the sink is at &lt;code&gt;23.235.37.67&lt;/code&gt;. Do we actually broadcast to &lt;code&gt;23.235.37.67&lt;/code&gt;? If so, what makes it a broadcast, rather than a single user transmission? Why not broadcast the entire packet if there is only a single computer on this IP?&lt;/p&gt;&#xA;" OwnerUserId="20064" LastEditorUserId="8499" LastEditDate="2020-07-17T01:26:28.383" LastActivityDate="2020-07-19T17:43:03.663" Title="What is the point of ARP?" Tags="|ip|ipv4|mac-address|ip-address|arp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21109" PostTypeId="2" ParentId="21108" CreationDate="2015-09-02T18:31:11.333" Score="4" Body="&lt;p&gt;Broadcasts interrupt every host on the broadcast domain, which is not a good thing.  ARP must broadcast in order to find the MAC address, but, after that, the MAC address gets cached in an ARP table (it eventually times out).  Caching the MAC address prevents excessive broadcasts from ARP - only the first packet needs to ARP (broadcast), and the rest of the stream can use the ARP cache.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-02T18:31:11.333" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="21110" PostTypeId="1" AcceptedAnswerId="21131" CreationDate="2015-09-02T18:43:49.830" Score="1" ViewCount="287" Body="&lt;p&gt;Auto-negotiation uses fastlink pulses to help a device determine the speed, duplex mode and other details of the link partner. However it is not clear from the ieee802.3 autoneg section what happens if 2 devices send fast link pulses at the same time over what will be a future half duplex connection. Is collision possible between them? If yes how are they corrected?&lt;/p&gt;&#xA;" OwnerUserId="17704" LastActivityDate="2015-09-03T02:08:27.570" Title="Is collisions between fastlink pulses possible during auto-negotiation?" Tags="|ethernet|autonegotiation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21111" PostTypeId="2" ParentId="21110" CreationDate="2015-09-02T19:17:01.770" Score="2" Body="&lt;p&gt;Short answer is no. Link speed and duplex negotiation is between a NIC and a port on a network (usually a switch port) not with the network itself. Collisions can only occur once you have established your connection to the network and are attempting to transmit a frame.&lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-09-02T19:17:01.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21113" PostTypeId="1" AcceptedAnswerId="21116" CreationDate="2015-09-02T19:30:48.863" Score="4" ViewCount="58131" Body="&lt;p&gt;I am working on Windows Server 2008/12.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two interfaces: a PPTP tunnel and the LAN card and I want to ping an IP via both of them to compare their results. As per the documentation, that should be possible via &lt;code&gt;ping -S default_gateway_for_interface&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now this works when I pass the gateway for the default interface but I get &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PING: transmit failed. General failure.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when I pass the PPTP tunnel's gateway. Any clues? &lt;/p&gt;&#xA;" OwnerUserId="17707" LastEditorUserId="17707" LastEditDate="2015-09-02T19:42:47.320" LastActivityDate="2015-09-02T20:59:03.467" Title="Windows - ping an ip via different interfaces" Tags="|ping|tunnel|split-tunneling|" AnswerCount="2" CommentCount="10" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21114" PostTypeId="2" ParentId="21098" CreationDate="2015-09-02T20:11:18.870" Score="2" Body="&lt;p&gt;It is a good security choice to block ICMP packets on firewalls or routers, cause, this is the most simplest way to discover an entire network. You should be sure that nothing is blocking you on the way&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-02T20:11:18.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21115" PostTypeId="2" ParentId="21113" CreationDate="2015-09-02T20:32:51.023" Score="1" Body="&lt;p&gt;You can add in the command line:&#xA;route ADD xxxx MASK xxx GatewayXXXX&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the place of GatewayXXXX, you put one gateway at time, next, delete the route and put the next one, accross the anothe link, changing the GatewayXXXX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think in that form, you can compare te results &lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-02T20:32:51.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21116" PostTypeId="2" ParentId="21113" CreationDate="2015-09-02T20:33:00.397" Score="5" Body="&lt;p&gt;You are confusing me with the &quot;default gateway&quot; thing. The source address is the address on the device from which you are pinging, not the gateway for that subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I have two addresses, 10.11.12.13 and 172.16.17.18 on my computer. I want to ping on the respective interfaces (logical or physical). I ping from the source (-S) with each of the addresses on my computer, not the gateways for those addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, I have a VPN tunnel and a physical interface on one of my computers, each with IP addresses.  The VPN doesn't allow me to ping outside the network on the other end of the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume they are addressed like this: Tunnel=&lt;code&gt;172.16.17.18&lt;/code&gt;, Ethernet=&lt;code&gt;10.11.12.13&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; C:\&amp;gt;ping -S 10.11.12.13 time1.google.com&#xA;&#xA; pinging time1.google.com [216.239.32.15] from 10.11.12.13 with 32 bytes of data: &#xA; Reply from 216.239.32.15 bytes=32 time=21 ms TTL=43&#xA; Reply from 216.239.32.15 bytes=32 time=22 ms TTL=43&#xA; Reply from 216.239.32.15 bytes=32 time=23 ms TTL=43&#xA; Reply from 216.239.32.15 bytes=32 time=22 ms TTL=43&#xA;&#xA; Ping statistics for 216.239.32.15:&#xA;     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:&#xA;     Minimum = 21ms, Maximum = 23ms, Average = 22ms&#xA;&#xA; C:\&amp;gt;ping -S 172.16.17.18 time1.google.com&#xA;&#xA; pinging time1.google.com [216.239.32.15] from 172.16.17.18 with 32 bytes of data:&#xA; Request timed out.&#xA; Request timed out.&#xA; Request timed out.&#xA; Request timed out.&#xA;&#xA; Ping statistics for 216.239.32.15:&#xA;     Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),&#xA;&#xA;C:\&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-02T20:33:00.397" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21118" PostTypeId="2" ParentId="21098" CreationDate="2015-09-02T21:17:40.603" Score="0" Body="&lt;p&gt;I solved this by specifying the local IP address to the DMZ host (Router's firewall).&lt;/p&gt;&#xA;" OwnerUserId="17497" LastActivityDate="2015-09-02T21:17:40.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21119" PostTypeId="1" AcceptedAnswerId="21120" CreationDate="2015-09-02T21:34:19.047" Score="2" ViewCount="249" Body="&lt;p&gt;My understanding is that a tcp socket is uniquely identified by the tuple src ip:port and dst ip:port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine I have a simple client/server application where the client can send some data request message and the server responds uniquely to that request over one single tcp socket.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say the client asynchronously fires off a bunch of requests in a row before the server can respond to any of them. The client then receives a bunch of responses back some time later; one for each request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some kind of mechanism in the tcp/ip stack that lets you relate one packet with another, aka the request and the response? Is the identification task the responsibility of the protocol in the data payload itself? Or is this just not how TCP works at all?&lt;/p&gt;&#xA;" OwnerUserId="17353" LastActivityDate="2015-09-02T22:34:26.777" Title="TCP Socket Response Identification" Tags="|tcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21120" PostTypeId="2" ParentId="21119" CreationDate="2015-09-02T21:40:15.087" Score="1" Body="&lt;p&gt;TCP/IP will reassemble a TCP segment that was broken into IP packets.  Reassembling other datagrams from the individual TCP segments is left to the upper layer protocols.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-02T21:40:15.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21124" PostTypeId="2" ParentId="21106" CreationDate="2015-09-02T22:29:07.610" Score="2" Body="&lt;p&gt;Note: By default, the router uses its hostname to identify itself to the peer. However, this CHAP username can be changed through the ppp chap hostname command. Refer to PPP Authentication Using the ppp chap hostname and ppp authentication chap callin Commands for more information&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The information above was taken from &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wan/point-to-point-protocol-ppp/25647-understanding-ppp-chap.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/wan/point-to-point-protocol-ppp/25647-understanding-ppp-chap.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3858" LastActivityDate="2015-09-02T22:29:07.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21125" PostTypeId="2" ParentId="21119" CreationDate="2015-09-02T22:34:26.777" Score="1" Body="&lt;p&gt;TCP will not just blindly send a bunch of requests to a server; besides the initial three way hand shake, there are some flow control mechanisms in place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given a scenario where a connection is established and the client sends data to the server, the servers response will include sequence numbers so that the client can put the data back together before handing to the application.&lt;/p&gt;&#xA;" OwnerUserId="3858" LastActivityDate="2015-09-02T22:34:26.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21126" PostTypeId="1" AcceptedAnswerId="42750" CreationDate="2015-09-02T22:55:32.480" Score="1" ViewCount="447" Body="&lt;p&gt;Baby network person just playing around with wireshark to see real life traffic here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went to a website on a web browser and saw DNS query/answers and then TCP handshake but SYN being sent to port 443 instead of 80. Is this normal behaviour?&#xA;I cant think of a reason how firefox just knew to send directly to 443 instead of 80 on a website it's going for the first time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know DNS had nothing to do with HTTPS since it only deals with domain names. And I dont see any other packets before this handshake to explain this. 80 first and redirection to 443 would make more sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help :0&lt;/p&gt;&#xA;" OwnerUserId="17100" LastEditorUserId="8499" LastEditDate="2018-02-16T04:05:49.443" LastActivityDate="2018-02-16T04:05:49.443" Title="How did firefox know to send TCP SYN to port 443?" Tags="|tcp|" AnswerCount="2" CommentCount="2" ClosedDate="2018-02-16T04:05:56.363" ContentLicense="CC BY-SA 3.0" />
  <row Id="21127" PostTypeId="2" ParentId="21126" CreationDate="2015-09-02T22:58:49.963" Score="0" Body="&lt;p&gt;Most recent versions of browsers now default to trying HTTPS, first.  There is a big push on to make sure everything is encrypted; it was all over the news a while back.  If HTTPS fails, it will fall back to HTTP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-02T22:58:49.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21131" PostTypeId="2" ParentId="21110" CreationDate="2015-09-03T02:08:27.570" Score="2" Body="&lt;p&gt;A network connection has dedicated TX and RX pairs, and so the signals do not &quot;collide&quot; during this process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Collisions occur when the two devices operate in a half-duplex CSMA/CD environment. When one device is transmitting on TX, if it receives any sort of signal on the RX it will register this as a collision, stop transmitting, back off and start the transmission process over again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for this is that typically a CSMA/CD environment operates with the use of hubs rather than switches/bridges. A hub is a OSI L1 device that simply receives a signal on one port and repeats the signal out all other ports (other then the receiving port). If a hub were to receive a signal on two different ports at the same time, the signal it repeats would be a &quot;combination&quot; of the two signals and unusable.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-09-03T02:08:27.570" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21132" PostTypeId="2" ParentId="21096" CreationDate="2015-09-03T03:57:14.710" Score="2" Body="&lt;p&gt;This seems pretty straightforward to me, and I am not sure where your confusion is coming from at this point. Perhaps it's the math and if we made the example a bit more concrete you might pick up on this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's set &lt;strong&gt;&lt;em&gt;b&lt;/em&gt;&lt;/strong&gt; to 80, or 80 bit/sec. This means that the time it takes to send 8 bits one bit at a time is 1/10 second (8/&lt;strong&gt;&lt;em&gt;b&lt;/em&gt;&lt;/strong&gt; sec). Or to put this into terms of frequency, this harmonic requires 10 Hz (&lt;strong&gt;&lt;em&gt;b&lt;/em&gt;&lt;/strong&gt;/8 Hz).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we introduce this harmonic onto our medium with a restriction of 3000 Hz (ordinary telephone line) and we want to find the highest number of this harmonic we can pass on this medium. We have already found that the first harmonic for this example requires 10 Hz, so the highest number of harmonics we can pass on this medium is 300 (3000 Hz/10 Hz). Or to follow the math as it is laid out in the book, 3000/(80/8) or 24,000/80, which both give us the same result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To change it up, let's now change &lt;strong&gt;&lt;em&gt;b&lt;/em&gt;&lt;/strong&gt; to 10 bps. This gives us a first harmonic of 1.25 Hz, and the highest harmonic on the medium of 2400.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does that help?&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-09-03T03:57:14.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21133" PostTypeId="2" ParentId="7175" CreationDate="2015-09-03T05:25:50.683" Score="-1" Body="&lt;p&gt;run this command in your router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;line vty 0 4&#xA;transport input all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17719" LastEditorUserId="33" LastEditDate="2015-09-04T05:51:14.340" LastActivityDate="2015-09-04T05:51:14.340" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21135" PostTypeId="2" ParentId="21108" CreationDate="2015-09-03T06:46:53.107" Score="3" Body="&lt;p&gt;The key to answer your questions is that for PC1 to communicate with PC2 &lt;strong&gt;&lt;em&gt;what  PC1 has&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;what PC1 want&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;how PC1 get what it want&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;First of all here in network we don't have any thing called high level address or low level address but we have physical address (MAC address) which is  L2 address and have logical address (IP address) which is L3 address. And by using ARP we map both to gather to get something called &lt;strong&gt;&lt;em&gt;ARP table&lt;/em&gt;&lt;/strong&gt;. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/KpILR.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KpILR.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;br&gt;&#xA;This tables contains the hosts which  PC can communicate with them (like phone book, you will call the persons you have there numbers only, and for person you don't have his number you will ask)&lt;br&gt;&#xA;First part of the key &lt;strong&gt;&lt;em&gt;what  PC1 has&lt;/em&gt;&lt;/strong&gt;???&lt;br&gt;&#xA;In case of ARP, PC1 has the L3 address (IP) of PC2  which it need to communicate with.&#xA;Second part of the Key &lt;strong&gt;&lt;em&gt;what PC1 want&lt;/em&gt;&lt;/strong&gt;???&#xA;it want L2 address (MAC address) of PC2 to establish communication with him&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;Note that&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;PC to communicate with other PC will send him something like that&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                      |SRC MAC | SRC IP | payload |DST IP|DSP MAC | &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So simply in our case we know 4 things from 5, we know SRC MAC, SRC IP , payload ,DST IP but we don't know DSP MAC. So the PC1 will send this packet as it is and for the part which it don't know it will send the Broadcast address of it (FF:FF:FF:FF:FF:FF) and only the PC which has this &lt;strong&gt;&lt;em&gt;DST IP&lt;/em&gt;&lt;/strong&gt; will replay this broadcast by its own MAC address which exactly what the PC1 need .&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mO1JM.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mO1JM.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sending packet with Broudcast MAC address is &lt;strong&gt;&lt;em&gt;ARP Request&lt;/em&gt;&lt;/strong&gt; and sure the PC2 replay by some thing called &lt;strong&gt;&lt;em&gt;ARP replay&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and also you can find a very good Example for ARP in this link &lt;a href=&quot;https://networklessons.com/cisco/arp-address-resolution-protocol-explained/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARP EXAMPLE&lt;/a&gt;  &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-03T06:46:53.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21136" PostTypeId="1" CreationDate="2015-09-03T06:52:29.617" Score="1" ViewCount="1137" Body="&lt;p&gt;having an ASA 5510 (8.3(2)).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 Interfaces: 1. NGCC, SecurityLevel 20, one Host with IP 1.2.3.4 Microsoft ESMTP MAIL Service, Version: 8.5.9600.16384 on Port 25 2. DMZ, Security Level 20, one Host with IP 5.6.7.8 Postfix 2.6.6 on Port 25&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ESMTP Inspection is enabled (global_policy/inspection_default)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to connect from a Network with Security Level 50 using telnet 5.6.7.8 25 shows me the SMTP Banner and i can use e.g. EHLO/HELO without problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;telnet 1.2.3.4 25 gives me the 220 **** Banner and only 500 5.3.3 Replies regardless of the command i send. Until i disable ESMTP Inspection, then telnet 1.2.3.4 25 works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Network i'm connecting from does not have any ACLs or NAT Rules between the one or the other destination network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am i missing ? Why is this working on one Interface but not on the other ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="17722" LastActivityDate="2015-09-04T11:36:48.287" Title="Cisco ASA 5510 ESMTP Inspection" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21137" PostTypeId="1" AcceptedAnswerId="21146" CreationDate="2015-09-03T08:01:50.537" Score="1" ViewCount="169" Body="&lt;p&gt;I noticed that 'host google.com' returns a lot of IP addresses. But 'host facebook.com' returns only one. I would have figured both to either use one, or both to use several since they're both incredibly popular.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the reason for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Maybe it was a poorly worded question. I was operating under the assumption that services had numerous IP:s for performance reasons. I realize now that multiple IP:s can be because they support multiple protocols, socket types etc.&lt;/p&gt;&#xA;" OwnerUserId="20064" LastEditorUserId="20064" LastEditDate="2015-09-03T09:15:23.047" LastActivityDate="2015-09-03T12:48:09.190" Title="Why does 'host facebook.com' only return one IP when 'host google.com' returns several?" Tags="|ip|" AnswerCount="1" CommentCount="1" ClosedDate="2015-09-08T20:32:14.930" ContentLicense="CC BY-SA 3.0" />
  <row Id="21138" PostTypeId="1" AcceptedAnswerId="22167" CreationDate="2015-09-03T08:05:09.637" Score="0" ViewCount="1888" Body="&lt;p&gt;I don't know if I'm posting in the right forum. But well correct me if I am wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am developing a service that counts the PPPoE users per MikroTik Device in the whole network every X minutes. I'm using the API build in Python3 (Although I think the problem is not language-dependent, but I tell you in order for you to know).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect to a MKT, I can execute the command &lt;code&gt;ppp active print count-only&lt;/code&gt;. In the API the language changes a bit. I can't execute that command. It tells me &lt;code&gt;=message=no such command prefix&lt;/code&gt;. I've tried with &lt;code&gt;/ppp/active/print/count-only&lt;/code&gt; but only works when I execute &lt;code&gt;/ppp/active/print&lt;/code&gt; but that is not the result I want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="15455" LastEditorUserId="8499" LastEditDate="2018-02-14T16:40:16.113" LastActivityDate="2018-02-14T16:40:16.113" Title="Mikrotik API &quot;no such command&quot; when trying to get count-only of PPP connections" Tags="|pppoe|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-09T23:49:30.683" ContentLicense="CC BY-SA 3.0" />
  <row Id="21139" PostTypeId="1" AcceptedAnswerId="21143" CreationDate="2015-09-03T08:48:05.647" Score="0" ViewCount="444" Body="&lt;p&gt;I would like to learn/discover a new topology. I usually use these commands. Do you know any other good tools for this? (the network have routers, switches, firewalls, multiple vrfs, vlans and all kind of stuff :) )&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;show arp&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;sho cdp (sometimes enabled)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ping and traceroute&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;sho ip route ..&lt;/li&gt;&#xA;&lt;li&gt;sho ip eigrp/ospf/bgp/rip ...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16778" LastActivityDate="2015-09-03T10:01:15.100" Title="IOS tools to discover a network" Tags="|cisco|cisco-ios|network-discovery|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21140" PostTypeId="1" CreationDate="2015-09-03T09:06:44.883" Score="0" ViewCount="568" Body="&lt;p&gt;Check the image on my routers firewall log i can see traffic from strange ip address to my public address. what are these? i just setup this router few hours ago, am i been hacked or part of DoS attack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JWl8z.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JWl8z.jpg&quot; alt=&quot;log&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17723" LastActivityDate="2015-09-03T21:26:06.207" Title="Strange ip's on firewall log" Tags="|router|firewall|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21141" PostTypeId="2" ParentId="21140" CreationDate="2015-09-03T09:22:09.603" Score="3" Body="&lt;p&gt;Those are normal IPs. My guess: Some infected hosts scanning for other hosts to infect and some (D)DOS traffic. Absolutely normal. If you also copied the destination Port we would be able to tell more. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2015-09-03T09:22:09.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21142" PostTypeId="1" AcceptedAnswerId="22211" CreationDate="2015-09-03T09:50:35.107" Score="2" ViewCount="1856" Body="&lt;p&gt;I have two Linux machines that I'm trying to connect via wired ethernet. I've tried both a straight-through cable and the same cable through a crossover adapter. When connected this way, both computers appear dead to each other. The lights are out on the ethernet ports, and both computers report that the link is not ready. However, when I connect both machines to a switch, everything works: lights come on, dmesg reports ready links, machines can ping each other. This leads me to believe that they are at least set up correctly (/etc/network/interfaces, routing tables etc), and that I may be facing some other type of problem. What may be causing this? It's as if both machines are waiting for the other side to come alive. Do I need to put the ethernet interfaces in some sort of 'recognizable mode' or perform some other magic for this to happen? Googling the issue gives a bunch of answers, all pretty much amounting to &quot;make sure both machines are in the same IP range and check your cable&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: the &quot;computers&quot; are 2x Toradex Apalis iMX6Q mounted on Ixora carrier boards.&#xA;&lt;a href=&quot;http://developer.toradex.com/product-selector/apalis-imx6&quot; rel=&quot;nofollow&quot;&gt;http://developer.toradex.com/product-selector/apalis-imx6&lt;/a&gt;&#xA;&lt;a href=&quot;http://developer.toradex.com/product-selector/ixora-carrier-board&quot; rel=&quot;nofollow&quot;&gt;http://developer.toradex.com/product-selector/ixora-carrier-board&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since posting, I've learned that Toradex themselves face the same issue when duplicating my setup, so right now I'm awaiting a possible solution from their side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2: it works now, the problem was in the physical layer and was fixed by a change to the Linux kernel.&lt;/p&gt;&#xA;" OwnerUserId="17724" LastEditorUserId="17724" LastEditDate="2015-09-04T14:29:09.810" LastActivityDate="2015-09-05T06:25:13.560" Title="Connecting two computers via switch works, but not directly" Tags="|switch|ethernet|lan|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="21143" PostTypeId="2" ParentId="21139" CreationDate="2015-09-03T10:01:15.100" Score="3" Body="&lt;p&gt;a very very useful GUI tool from Cisco called Cisco Network Assistance can help you to discover the entire network with all details you need to know about it.where you can discover your network community by the Rang (start and end IPs)&#xA;Or by supnet defined with mask and once you start to discover it will discover all the network and will draw the topology layout and rack layout of your devices.even Cisco IP phones and access point&#xA;&lt;a href=&quot;https://i.stack.imgur.com/prh6M.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/prh6M.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/femew.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/femew.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also it can generate health report for all devices include the CPU usage and temperature and FAN speed &#xA;&lt;a href=&quot;https://i.stack.imgur.com/g4ISZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/g4ISZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it can also be used to trubleshoot connectivity problems (cascadded devices or loops) and it can also be used for simple configurations like add vlans or configur port for access vlans or trunk . what i very like in it it also can draw stacked switched to gether in both topology layout and rack layout&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v4sMQ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v4sMQ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-03T10:01:15.100" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21144" PostTypeId="2" ParentId="21136" CreationDate="2015-09-03T11:53:07.753" Score="1" Body="&lt;p&gt;Everything being done by the ESMTP inspection is related to the information being exchanged between hosts. It is not related to NAT, ACLs, IPs or interfaces the client and server reside on with one exception: One of the interfaces the traffic is traversing has the inspection rule turned on or it is globally turned on for all interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The information being sent between hosts will be modified if it doesn't match the criteria the ASA expects or if it sends information the ASA wants to mask between parties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/inspect_basic.html#wp1224614&quot; rel=&quot;nofollow noreferrer&quot;&gt;More info can be found in the config guide&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Reason for 220 Banner Modification&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Another security feature used by these devices is SMTP banner modification. In order to hide the type and version of the protected mail server, some devices will obscure all but the 220 portion of the banner that is required for communication.&#xA;  The banner will often appear similar to:&#xA;  220*************&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Part of the information being hidden is the ESMTP advertisement in the banner. When this advertisement is removed, a sending server will not be aware that ESMTP commands are accepted.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/email-security-appliance/118584-qa-esa-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also disable just the banner modification.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map type inspect esmtp new_estmp_inspect_map&#xA;  parameters&#xA;    no mask-banner&#xA;&#xA;policy-map global-policy&#xA;  class class-default&#xA;    inspect esmtp new_esmtp_inspect_map&#xA;service-policy global-policy global&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://serverfault.com/a/225103&quot;&gt;Source&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Reason for Replies&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA only supports 15 SMTP commands, any others will return the errors you are seeing. The second SMTP server (1.2.3.4) is using commands the ASA doesn't support or they are improperly formatted.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ESMTP application inspection adds support for extended SMTP commands, including AUTH, EHLO, ETRN, HELP, SAML, SEND, SOML, STARTTLS, and VRFY. Along with the support for seven RFC 821 commands (DATA, HELO, MAIL, NOOP, QUIT, RCPT, and RSET), the ASA supports a total of 15 SMTP commands. Other extended SMTP commands, such as ATRN, ONEX, VERB, and CHUNKING, and private extensions are not supported. Unsupported commands are translated into Xs, which are rejected by the internal server. This results in a message such as &quot;500 Command unknown: 'XXX'.&quot; Incomplete commands are discarded.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/web/about/security/intelligence/asa_esmtp_starttls.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To verify, I recommend using a packet sniffer between the ASA and 1.2.3.4 to see which commands are being returned.&lt;/p&gt;&#xA;" OwnerUserId="17637" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-09-04T11:36:48.287" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="21146" PostTypeId="2" ParentId="21137" CreationDate="2015-09-03T12:48:09.190" Score="1" Body="&lt;p&gt;Facebook might have only one IP, but it can 'represent' different physical servers. For example, in North America it would get you to datacenter in North America if it's up and running. In Europe it would get you to DCin Europe, i.e closest to you. This is anycasting and is governed by BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google might have multiple A records in DNS for one domain. And this is a DNS round-robin, which is another redundancy mechanism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might be a bird view on very complex problem of creating a redundant service. You can start with wiki &lt;a href=&quot;https://en.wikipedia.org/wiki/Anycast&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Anycast&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Round-robin_DNS&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Round-robin_DNS&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2015-09-03T12:48:09.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21147" PostTypeId="2" ParentId="21142" CreationDate="2015-09-03T12:48:14.497" Score="1" Body="&lt;p&gt;I don´t know how old your computers are, but, seems to be a MIDx problem. Switches can do that, they detect de link and then do the cross over or not, if they have de MIDx function in auto mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Crossover cable is used to link 2 equipment with the same type, and straight-through cable, 2 different equipment&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-03T12:48:14.497" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21148" PostTypeId="2" ParentId="21140" CreationDate="2015-09-03T12:50:20.713" Score="1" Body="&lt;p&gt;That looks like you are victim of an scanning proccess, if you can see, all the traces are UDP, that is an port open discovery proccess.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-03T12:50:20.713" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21151" PostTypeId="1" CreationDate="2015-09-03T15:47:46.310" Score="2" ViewCount="45" Body="&lt;p&gt;I am currently reviewing this course&#xA;&lt;a href=&quot;https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=769&quot; rel=&quot;nofollow&quot;&gt;https://learningportal.juniper.net/juniper/user_activity_info.aspx?id=769&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And it states you can set Frame Control Settings on Wireless networks such as: RTS threshold, Retry Counters, and Fragmentation threshold.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this set as a parameter to filter traffic on the client or the access device, or both?&lt;/p&gt;&#xA;" OwnerUserId="17733" LastActivityDate="2016-08-30T16:04:31.053" Title="802.11 Are the Frame Control Settings Set On the Access Point or the Client Device" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="21152" PostTypeId="2" ParentId="21140" CreationDate="2015-09-03T17:23:36.317" Score="2" Body="&lt;p&gt;dear i'm suffering same problem as you &lt;strong&gt;&lt;em&gt;exactly&lt;/em&gt;&lt;/strong&gt; with my firewall so after a lot of researches i found a very good article speak about that in the next link &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Brian Krebs explains -- &lt;a href=&quot;http://krebsonsecurity.com/2015/05/whos-scanning-your-network-a-everyone/&quot; rel=&quot;nofollow&quot;&gt;Who's Scanning Your Network (A: Everyone)&lt;/a&gt;, this is simply the fact of life of &lt;em&gt;anything&lt;/em&gt; connected to the internet.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="619" LastEditDate="2015-09-03T21:26:06.207" LastActivityDate="2015-09-03T21:26:06.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="21154" PostTypeId="1" CreationDate="2015-09-03T20:11:59.900" Score="1" ViewCount="280" Body="&lt;p&gt;With IPv4, ISP's rarely, if ever, assigned a static IP to a consumer except for maybe AT&amp;amp;T and a few local carriers unless you registered as a business account with them. I understand with the limited address space why this was done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, with IPv6, it's estimated every person can theoretically own over a million IP's each. For those in the ISP business, will residential users be able to request a block of IP's once IPv6 becomes more mainstream? I'm not sure what the equivalent subnet of a /24 on IPv4 is with IPv6 but I would think it would be reasonable to assign that many if requested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reason I ask is, IPv6 no longer supports NAT like IPv4. With the amount of IoT devices, mobile devices, etc, I have easily consumed 83 IPv4 addresses on my private network. If the ISP continues to only assign one IP, how will that affect the future of Internet connectivity for homes? &lt;/p&gt;&#xA;" OwnerUserId="17736" LastActivityDate="2015-09-03T20:56:27.577" Title="How will ISP's handle the future of IPv6 to pro-sumers" Tags="|ipv4|nat|ipv6|internet|" AnswerCount="2" CommentCount="3" ClosedDate="2015-09-04T05:47:15.883" ContentLicense="CC BY-SA 3.0" />
  <row Id="21156" PostTypeId="2" ParentId="21154" CreationDate="2015-09-03T20:23:09.700" Score="0" Body="&lt;p&gt;The IANA recommendation is to assign everyone a /48 (65,536 networks of 18 quintiliion addresses in each /64 subnet) network. Most ISPs are only assigning /56 networks (256 /64 subnets).  You can always get a free tunnel (/64 or /48) to the IPv6 Internet from a company like Hurricane Electric.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would be surprised, but all the big ISPs are already assigning IPv6 to most of their customers (most customers don't have IPv6-capable routers, or they don't realize it).  Google receives a large amount of consumer IPv6 traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As of right now, ARIN only has 92 /24 (none larger) IPv4 blocks left to assign to ISPs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-03T20:23:09.700" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="21158" PostTypeId="2" ParentId="21154" CreationDate="2015-09-03T20:56:27.577" Score="0" Body="&lt;p&gt;Many residential ISPs offer &quot;static address&quot; as an (expensive) up-sell. It may be hard to find, but it's usually there. In the era of DSL and cablemodems, the always-on nature of the technology makes address scarcity a moot point -- the customer will always require an address. Providing a static, unchanging address is a means to extract more money.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With IPv6, it is unlikely any residential ISP will go to the bother of providing static prefixes. It makes for a routing mess, and takes a lot more effort in account management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And IPv6 does, today, support NAT. (as bad an idea as that might be, there's an RFC for it.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-09-03T20:56:27.577" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="21161" PostTypeId="1" AcceptedAnswerId="22238" CreationDate="2015-09-03T22:28:32.233" Score="2" ViewCount="130" Body="&lt;p&gt;I want to route some calls to my VoIP number a call center overseas. The call center is telling me that I need to do a &quot;gateway to gateway link&quot; in order to make this happen. I'm not exactly sure what that is and can't seem to find anything on the net about it. I'm new to VoIP and want to be able to have an intelligent conversation with the call center provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is a &quot;gateway to gateway link?&quot; And will I suffer any degradation of voice quality by doing this?&lt;/p&gt;&#xA;" OwnerUserId="17739" LastActivityDate="2015-09-09T11:41:14.653" Title="&quot;gateway to gateway link&quot; in VoIP?" Tags="|voip|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="21162" PostTypeId="1" AcceptedAnswerId="22164" CreationDate="2015-09-04T00:50:18.187" Score="14" ViewCount="69819" Body="&lt;p&gt;What's the difference here? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are stateful IPv6 entries retained in the DHCPv6 server?&lt;/p&gt;&#xA;" OwnerUserId="15501" LastActivityDate="2019-06-17T19:45:25.203" Title="Stateful vs Stateless IPv6?" Tags="|cisco|dhcp|ipv6|dhcpv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22164" PostTypeId="2" ParentId="21162" CreationDate="2015-09-04T06:03:33.360" Score="17" Body="&lt;p&gt;Stateful autoconfiguration of IPv6 is the equivalent to the use of DHCP in IPv4. It requires a DHCPv6 service to provide the IPv6 address to the client device and that both client device and server maintain the &amp;quot;state&amp;quot; of that address (i.e. lease time, etc).&lt;/p&gt;&#xA;&lt;p&gt;Stateless autoconfiguration of IPv6 allows the client device to self-configure its IPv6 address and routing based on the router advertisements.&lt;/p&gt;&#xA;&lt;p&gt;A network can use both stateful and stateless autoconfiguration at the same time, they are not mutually exclusive.&lt;/p&gt;&#xA;&lt;p&gt;If you are interested in more detailed information, I would highly recommend you read &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4862&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4862&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2019-06-17T12:54:39.363" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="22165" PostTypeId="1" CreationDate="2015-09-04T06:37:37.023" Score="1" ViewCount="217" Body="&lt;p&gt;I would want to buy a ethernet switch. But I have a question (maybe a noob's question...) that I can't find any answer on the forums... And I hope you will be able to answer. &#xA;So if I buy an ethernet switch, connect it to network and connect 3pc to it (for instance), how many Mac adresses will be shown in output? &#xA;For example, if the switch is connected to a router, how many Mac adresses will the router see? Just one, the switch 's Mac? Or each Mac adresses of any pc connected to the switch? &lt;/p&gt;&#xA;" OwnerUserId="18744" LastActivityDate="2015-11-03T13:43:47.077" Title="How many Mac adresses have a switch in output?" Tags="|switch|mac|network-access|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="22166" PostTypeId="1" AcceptedAnswerId="22174" CreationDate="2015-09-04T07:11:22.447" Score="0" ViewCount="7986" Body="&lt;p&gt;I can't find any infromation about which OS is used on the SG300-Switches by cisco, maybe you can help me with that.&lt;/p&gt;&#xA;" OwnerUserId="17646" LastEditorUserId="17646" LastEditDate="2015-09-14T07:52:16.227" LastActivityDate="2021-02-09T23:54:50.863" Title="Which OS is used with CISCO SG300-XXX" Tags="|cisco|switch|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22167" PostTypeId="2" ParentId="21138" CreationDate="2015-09-04T08:05:14.077" Score="1" Body="&lt;p&gt;I needed a 2-line block of code&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ppp/active/print&#xA;=count-only=&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="15455" LastActivityDate="2015-09-04T08:05:14.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22168" PostTypeId="1" AcceptedAnswerId="22169" CreationDate="2015-09-04T08:21:22.343" Score="1" ViewCount="333" Body="&lt;p&gt;If I subnet the IP prefix &lt;code&gt;172.16. 64.0/18&lt;/code&gt;, shouldn't I be able to get 4 subnets? I was only able to get the following subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Network ID - Range - Broadcast ID:&#xA;172.16.64.0    -     172.16.127.255&#xA;172.16.128.0   -     172.16.191.255&#xA;172.16.192.0   -     172.16.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which subnet, if any, am I missing?&lt;/p&gt;&#xA;" OwnerUserId="17715" LastEditorUserId="21337" LastEditDate="2015-12-26T23:27:21.857" LastActivityDate="2015-12-26T23:27:21.857" Title="Am I subnetting correctly?" Tags="|subnet|" AnswerCount="4" CommentCount="0" ClosedDate="2015-12-29T09:52:02.543" ContentLicense="CC BY-SA 3.0" />
  <row Id="22169" PostTypeId="2" ParentId="22168" CreationDate="2015-09-04T08:44:54.810" Score="2" Body="&lt;p&gt;By splitting the 172.16.64.0/18 network in 4 subnets you obtain:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;172.16.64.0/20&lt;/p&gt;&#xA;&lt;p&gt;172.16.80.0/20&lt;/p&gt;&#xA;&lt;p&gt;172.16.96.0/20&lt;/p&gt;&#xA;&lt;p&gt;172.16.112.0/20&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-09-04T08:44:54.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22170" PostTypeId="1" AcceptedAnswerId="22171" CreationDate="2015-09-04T08:49:47.293" Score="0" ViewCount="384" Body="&lt;p&gt;According to &lt;a href=&quot;ftp://ftp.ripe.net/rfc/rfc3330.txt&quot; rel=&quot;nofollow&quot;&gt;rfc3330&lt;/a&gt; the loopback block is 127.0.0.0/8:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   127.0.0.0/8 - This block is assigned for use as the Internet host&#xA;   loopback address.  A datagram sent by a higher level protocol to an&#xA;   address anywhere within this block should loop back inside the host.&#xA;   This is ordinarily implemented using only 127.0.0.1/32 for loopback,&#xA;   but no addresses within this block should ever appear on any network&#xA;   anywhere [RFC1700, page 5].&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a reason why this block is so huge? Are there occasions where any other addresses from 127.0.0.0/8 besides 127.0.0.1/8 are configured?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-09-04T08:59:33.247" Title="size of IPv4 loopback address block" Tags="|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22171" PostTypeId="2" ParentId="22170" CreationDate="2015-09-04T08:59:33.247" Score="2" Body="&lt;p&gt;It comes from the times of clasful IP and 127.0.0.0 is an class-A network and therefore a /8 mask is assigned. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer the second part: Yes I've seen setups where more than 127.0.0.1 was used, e.g. for running multiple SMTP content filters on one host or multiple instances of a database server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that for IPv6 you only have one loopback address ::1&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2015-09-04T08:59:33.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22173" PostTypeId="1" AcceptedAnswerId="22192" CreationDate="2015-09-04T09:54:55.817" Score="5" ViewCount="11470" Body="&lt;p&gt;Firstly what I understand,&#xA;Default Gateway--&gt; When we set the default gateway in PC the network layer check the destination IP address and if it is not on same broadcast domain as the source IP address it set destination MAC address to be of the router which further make routing decision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Proxy ARP --&gt;{{It is used when host do not have default gateway set}} When the destination IP address's MAC address is not in the table of PC it sent an ARP request to know its MAC address. THE switch broadcast the request and it also goes to router and the router knows the destination IP address as it is directly connected to it so it gives its MAC address as proxy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is that&#xA;MY network is like this--&gt;&gt;  Host A---Switch1----Router----Switch2---Host B&#xA;and Host A has IP address of 192.168.1.1 (no default gateway set) and same for host B with IP address 192.168.2.1(no default gateway set) so why can't Host A ping Host B using Proxy ARP.Router has interfaces as 192.168.1.254 and 192.168.2.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IS proxy ARP not enabled by default but it is given in cisco.com it is enabled by default so why can not then&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AND Also &lt;/p&gt;&#xA;&#xA;&lt;p&gt;which is given preference default gateway method or proxy ARP is default gateway is set and router knows path to destination&lt;/p&gt;&#xA;" OwnerUserId="15438" LastEditorUserId="15438" LastEditDate="2015-09-04T19:01:41.747" LastActivityDate="2015-09-04T19:01:41.747" Title="Difference between proxy arp and default gateway" Tags="|cisco|arp|proxy-arp|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22174" PostTypeId="2" ParentId="22166" CreationDate="2015-09-04T09:57:51.270" Score="6" Body="&lt;p&gt;Cisco SG series doesn't use a full Cisco Internetwork Operating System Software IOS but a similiar one.&#xA;Being quite similiar they differ on a lot of stuff (VLAN management for one) &#xA;SG series is aimed to small business, if you need a switch for cert study this is not a valid solution.&lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2015-09-04T09:57:51.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22175" PostTypeId="1" AcceptedAnswerId="22193" CreationDate="2015-09-04T10:14:51.223" Score="3" ViewCount="2465" Body="&lt;p&gt;the network above shown has PC1(10.10.10.1) AND PC2(10.10.10.2) IN VLAN 10  10.10.10.0/24&#xA;AND PC3(20.20.20.3) and PC4(20.20.20.4) in VLAN 20   20.20.20.0/24&#xA;&lt;a href=&quot;https://i.stack.imgur.com/qZ7qw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qZ7qw.png&quot; alt=&quot;Network diagram&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured all the configuration of inter-VLAN routing. Sub-interfaces on router for VLAN10 and VLAN 20,&#xA;switch-port to router as trunk and switch-port to to PC's as access but the only thing I have not set is the Default gateway of PC1 and PC 2 &#xA;as router sub-interface 10.10.10.254 and for PC3 and PC4 as sub-interface 20.20.20.254 and I except that that PC1 should&#xA;ping PC3 AND PC4 using Proxy ARP which is not working . WHY ?&#xA;Since router knows both network(VLAN's)10.10.10.0/24 and 20.20.20.0/24 so it must give it's MAC address to PC1&#xA;to ping PC3 and PC4&lt;/p&gt;&#xA;" OwnerUserId="15438" LastEditorUserId="33" LastEditDate="2015-09-04T14:36:16.580" LastActivityDate="2015-09-04T15:09:50.183" Title="Inter-VLAN Routing and Proxy Arp" Tags="|cisco|vlan|ethernet|arp|proxy-arp|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22177" PostTypeId="2" ParentId="22175" CreationDate="2015-09-04T11:16:21.317" Score="0" Body="&lt;p&gt;Until you set a route in your PCs they don't know what to do with the packets. Type &quot;route print&quot; in a command prompt of your windows PC. You will see a route to your local network but no route to anywhere else. Once you set the default route then the machine knows where to send packets. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-09-04T11:16:21.317" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22179" PostTypeId="1" CreationDate="2015-09-04T11:42:03.927" Score="1" ViewCount="1592" Body="&lt;p&gt;Does anyone have experience with creating HP and Cisco devices?  I created a simple OSPF config, but I can't see any neighbours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my basic config.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&#xA;#HP 5500-48G-PoE+-4SFP HI Switch&#xA;#&#xA;router id 30.0.0.1&#xA;#&#xA;ospf 2&#xA; area 0.0.0.0&#xA;  network 0.0.0.0 255.255.255.255&#xA;#&#xA;interface GigabitEthernet1/0/1&#xA; port link-mode route&#xA; ip address 30.0.0.1 255.0.0.0&#xA;#&#xA;&#xA;#&#xA;#Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 15.0(1)M7, RELEASE SOFTWARE (fc2)&#xA;#&#xA;interface FastEthernet0/0&#xA; ip address 20.0.0.1 255.0.0.0&#xA; duplex auto&#xA; speed auto&#xA; !&#xA;#&#xA;router ospf 2&#xA; router-id 20.0.0.1&#xA; log-adjacency-changes&#xA; network 0.0.0.0 255.255.255.255 area 0&#xA;#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1592" LastActivityDate="2015-09-04T12:51:56.967" Title="OSPF between Cisco and HP devices" Tags="|cisco|ospf|hp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22180" PostTypeId="2" ParentId="22165" CreationDate="2015-09-04T11:58:55.127" Score="2" Body="&lt;p&gt;A switch learns the MAC addresses connected to each one of its ports. For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Port 1 - Connected to PC  -Learns 1 MAC on this port.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Port 2 - Connected to router - Learns 1 MAC on this port.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Port 3 -  Connected to hub - learns as many MACs  as PCs are connected to the hub.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Switching table of the switch will be something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     MAC              PORT&#xA;0f-aa-34-56            1&#xA;0a-17-40-12            2&#xA;09-11-11-11            3&#xA;05-65-23-59            3&#xA;0f-0a-71-62            3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The router on Port 2 will be able to communicate with any other PC (the PC on port 1 or any other one on Port 3) and works &lt;strong&gt;transparently&lt;/strong&gt;. A switch can't modify mask or modify a MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch isolates &lt;em&gt;ethernet collisions&lt;/em&gt;, so if a collsion happens on the hub , the router and the PC on Port 1 won't notice it.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2015-09-04T12:03:34.317" LastActivityDate="2015-09-04T12:03:34.317" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22181" PostTypeId="2" ParentId="22179" CreationDate="2015-09-04T12:04:10.300" Score="1" Body="&lt;p&gt;I see that you have different subnets on both devices. OSPF does subnet check while forming adjacency (exception are p2p links). Make sure both devices are on the same subnet.&lt;/p&gt;&#xA;&lt;p&gt;You can always turn on debugs to check out what is going on:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;debug ip ospf hello&lt;/p&gt;&#xA;&lt;p&gt;debug ip ospf events&lt;/p&gt;&#xA;&lt;p&gt;debug ip ospf packet&lt;/p&gt;&#xA;&lt;p&gt;debug ip ospf adj&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="970" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-09-04T12:04:10.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22182" PostTypeId="2" ParentId="22175" CreationDate="2015-09-04T12:43:21.610" Score="1" Body="&lt;p&gt;ARP should work if you want to ping an PC in the same VLAN, but, if you want to communicate with PC in other networks, you should set a default route to a gateway of that network, in this case, the subinterface that you have configured. Only in that way, you will be able to do what you want.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-04T12:43:21.610" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22183" PostTypeId="2" ParentId="22173" CreationDate="2015-09-04T12:46:49.030" Score="-2" Body="&lt;p&gt;Proxy ARP must be set on the router. &lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-04T12:46:49.030" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="22184" PostTypeId="2" ParentId="22179" CreationDate="2015-09-04T12:51:56.967" Score="2" Body="&lt;p&gt;Bot devices must me on the same subnet if you want to communicate between then, if you have post here the configuration on the interfaces that are connected directly, i think, they cannot form adyacency.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-04T12:51:56.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22185" PostTypeId="2" ParentId="22165" CreationDate="2015-09-04T13:00:39.763" Score="1" Body="&lt;p&gt;In your question. If a router is connected directly with a switch, must know all the addresses that for some point, communicate with him. In th other hand, the switch always must show you 2 mac address per port, the port MAC, and the MAC of the NIC connected to him. This one, will be stored, by default, 300 seconds.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-04T13:00:39.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22188" PostTypeId="1" AcceptedAnswerId="22204" CreationDate="2015-09-04T13:34:58.500" Score="1" ViewCount="1510" Body="&lt;p&gt;We have a straight forward internet connection which has a small /29 IP range. The connection is Ethernet and our default gateway is the first IP in the /29 range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our ISP has just given us a secondary IP range, a /28. They have told us that we need to use the first IP of that range as our default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the device it's connected to is a Juniper SRX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Initially I thought this wouldn't be an issue but it turns out it's more tricky than I thought.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I can't just use any of the new IP addresses on the existing untrust interface because traffic isn't routed back to the correct gateway.&lt;/li&gt;&#xA;&lt;li&gt;I can use a virtual router as the networks both come in over the same Ethernet cable and are plugged into a single interface&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I was thinking that maybe I need to use source or policy based routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any ideas? Should I go back to them and ask for them to just route the new /28 subnet to IP address of the SRX in the original /29? Is PBR/SBR the way to go?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I know about their config is that the device is a Cisco and has the following config snippet&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet1/0/2&#xA;description *** Link into customer LAN ***&#xA;no switchport&#xA;ip address 1.0.0.145 255.255.255.240 secondary&#xA;ip address 1.0.0.121 255.255.255.248&#xA;&#xA;#ping 8.8.8.8 source 1.0.0.145&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:&#xA;Packet sent with a source address of 1.0.0.145 &#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 16/20/26 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="139" LastActivityDate="2015-09-05T01:29:07.987" Title="Two IP ranges, one ISP, one connection, one firewall/router" Tags="|routing|juniper|srx|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22191" PostTypeId="1" AcceptedAnswerId="22194" CreationDate="2015-09-04T14:11:35.020" Score="0" ViewCount="2430" Body="&lt;p&gt;I have telnetted into a Cisco 2851 Router with 7 set users with passwords for a PPTP VPN that show in the following format when I &quot;show running-config&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;username user1 privilege 0 password 7 84HF7CJ384NF83JF2T&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I go about keeping this user but simply changing the user's password?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is greatly appreciated, thanks!&lt;/p&gt;&#xA;" OwnerUserId="18757" LastActivityDate="2015-09-04T14:39:46.753" Title="Change Cisco VPN User Password Question" Tags="|cisco|vpn|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22192" PostTypeId="2" ParentId="22173" CreationDate="2015-09-04T14:23:59.677" Score="3" Body="&lt;p&gt;Let me start by saying proxy ARP is at best a sloppy solution. They only time I found it useful as a feature is when I was dealing with devices on the network that could not utilize classless netmasks or couldn't set a default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, it can &quot;cover&quot; many client configuration or bad design problems, but it doesn't fix those problems. It also doesn't &quot;cover&quot; all of them and it can make troubleshooting issues more difficult. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting back to your question, the most likely reason this isn't working is that your client's aren't ARPing. My guess is that you have given them what is often considered a &quot;standard&quot; network mask of /24. So the solution would be to switch the network masks on the clients to /16.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why? A client uses it's IP address and network mask to determine if a destination is on the local network or not. If it is on the local network, the client checks it's ARP table for any entries for the destination and if one doesn't exist, will send out an ARP request to get this information. This is where the router with proxy ARP enabled can respond, but if there is no ARP request then the router cannot provide a proxy ARP response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination is not on the local network, then the client will check it's routing table to see where to forward the traffic. This is typically your default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, with the IP addresses you used, if you used a /24 network mask, when the client checked the destination against it's IP/mask, it would find the destination is not on the local network. Going to the routing table, it won't have a specific entry for the destination network (clients won't by default) and no default route/gateway. It will then fail with a &quot;no route to host&quot; type of message.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-09-04T14:29:07.417" LastActivityDate="2015-09-04T14:29:07.417" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="22193" PostTypeId="2" ParentId="22175" CreationDate="2015-09-04T14:33:23.903" Score="2" Body="&lt;p&gt;Let me start by saying proxy ARP is at best a sloppy solution. They only time I found it useful as a feature is when I was dealing with devices on the network that could not utilize classless netmasks or couldn't set a default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, it can &quot;cover&quot; many client configuration or bad design problems, but it doesn't fix those problems. It also doesn't &quot;cover&quot; all of them and it can make troubleshooting issues more difficult. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting back to your question, the most likely reason this isn't working is that your client's aren't ARPing. My guess is that you have given them what is often considered a &quot;standard&quot; network mask of /24. In your example, there is likely no solution to get proxy ARP to work as clients should not accept a network mask less than /8 so your client will never think the destination is on the local network and send out an ARP request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why? A client uses it's IP address and network mask to determine if a destination is on the local network or not. If it is on the local network, the client checks it's ARP table for any entries for the destination and if one doesn't exist, will send out an ARP request to get this information. This is where the router with proxy ARP enabled can respond, but if there is no ARP request then the router cannot provide a proxy ARP response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination is not on the local network, then the client will check it's routing table to see where to forward the traffic. This is typically your default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, with the IP addresses you used, when the client checked the destination against it's IP/mask, it would find the destination is not on the local network. Going to the routing table, it won't have a specific entry for the destination network (clients won't by default) and no default route/gateway. It will then fail with a &quot;no route to host&quot; type of message.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-09-04T14:33:23.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22194" PostTypeId="2" ParentId="22191" CreationDate="2015-09-04T14:35:27.940" Score="3" Body="&lt;p&gt;Run this command in config mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username user1 privilege 0 password NewPasswordForUser&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That will change their password to &lt;code&gt;NewPasswordForUser&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I should mention that it is recommended to use &lt;code&gt;secret&lt;/code&gt; instead of &lt;code&gt;password&lt;/code&gt; for increased security on the device. i.e.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username user1 privilege 0 secret NewPasswordForUser&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Though you can't switch from password to secret without removing the user or you'll get this error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ERROR: Can not have both a user password and a user secret.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To make the change you'll want to remove the user:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no username user1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then readd with a &lt;code&gt;secret&lt;/code&gt; instead:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username user1 privilege 0 secret NewPasswordForUser&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17637" LastEditorUserId="17637" LastEditDate="2015-09-04T14:39:46.753" LastActivityDate="2015-09-04T14:39:46.753" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22195" PostTypeId="2" ParentId="22168" CreationDate="2015-09-04T15:00:04.333" Score="1" Body="&lt;p&gt;You are subnneting in a wrong way. This one if what you should do.&#xA;Will take 172.16.64.0/18 into binary(.64.)&#xA;172.16.0100 0000.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you need 4 subnets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0100 0000 /base&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0100 0000&#xA;0101 0000&#xA;0110 0000&#xA;0111 0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of this subnets are /20. We take 2 bits of host parts in 172.16.64.0/18, that has been used in network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.16.64.0/20, 172.16.80.0/20, 172.16.96.0/20, 172.16.112.0/20 &lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-04T15:00:04.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22197" PostTypeId="2" ParentId="22175" CreationDate="2015-09-04T15:09:50.183" Score="2" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;after a lot of search&lt;/em&gt;&lt;/strong&gt; i can figure out that , you can  only make use of proxy arp if PC1 in your example can think that PC 3,4 are directly connected to it to start send ARP request to obtain there MAC address .&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;for example&lt;/em&gt;&lt;/strong&gt; in your topology PC1 which is (10.10.10.1/24) can't think that PC 3,4 are directly connected to it because there ips are (20.20.20.3,4/24) but if you want pc 1 use proxy arp to send packets to pc 3,4 you must make PC1 ip 10.10.x.x/16 and make PC 3,4 something like 10.10.20.X/24 and make router sub interfaces in same IP range of each segment in this case pc1 can think pc3,4 are directly connected to it and start to send proxy ARP .&#xA;&lt;a href=&quot;https://i.stack.imgur.com/h03Bx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/h03Bx.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or avoid all this headache may you use Default GW&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-04T15:09:50.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22199" PostTypeId="2" ParentId="22166" CreationDate="2015-09-04T15:23:08.737" Score="2" Body="&lt;p&gt;Your question title says SG300 and the posted question says SG3000. If you google &quot;cisco sg300 firmware&quot; it takes you directly to the download pages. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can download the code for your model from here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://software.cisco.com/download/navigator.html?mdfid=283009439&amp;amp;flowid=49583&quot; rel=&quot;nofollow&quot;&gt;https://software.cisco.com/download/navigator.html?mdfid=283009439&amp;amp;flowid=49583&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-09-04T15:23:08.737" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22200" PostTypeId="1" CreationDate="2015-09-04T15:59:32.843" Score="2" ViewCount="273" Body="&lt;p&gt;I'm looking for insight/help with a problem I'm having. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a camera that specifically needs a 1000baseT connection in order to communicate over gigabit. The access points we use with the cameras are limited to 10/100 (Ubiquiti Picostation M2). The camera cannot use anything other than its stated spec. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a chip or converter that currently exists that could do this? Where would I need to begin looking if it doesn't?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(there is no need to have the data moving this fast wirelessly.  The 1000baseT is required by the NIC on the camera just to have a successful handshake.  Small four port switches are out of the equation primarily due to size.  We're looking for a small chipset/ready made board or adapter that might help with this)&lt;/p&gt;&#xA;" OwnerUserId="18758" LastActivityDate="2015-12-03T00:32:18.147" Title="1000baseT to 10/100 adapter needs" Tags="|ethernet|" AnswerCount="2" CommentCount="5" ClosedDate="2017-08-06T18:03:29.573" ContentLicense="CC BY-SA 3.0" />
  <row Id="22201" PostTypeId="2" ParentId="22200" CreationDate="2015-09-04T16:06:44.653" Score="3" Body="&lt;p&gt;There is a reason that the camera requires that bandwidth, and you may (probably will) have problems if you restrict the speed on the path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't directly convert 1000BASE-T to 100BASE-TX. You could try a small gigabit ethernet switch between the camera and the rest of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specific product recommendations are off-topic on this forum.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-04T16:06:44.653" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22204" PostTypeId="2" ParentId="22188" CreationDate="2015-09-04T20:35:14.377" Score="1" Body="&lt;p&gt;As @stevieb said, a link subnet and two routes is the &lt;em&gt;correct&lt;/em&gt; path, but few ISPs do that these days. (esp. in a co-lo, which is what this looks like)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the gateway for both networks is the same interface on the same device, there should be no issue with sending traffic from either subnet to either gateway. I've had the exact same setup in many data centers, and it was never an issue. If they have something odd set up (ACLs, etc.), then VRF or PBR would be logical solutions. The SRX should have plenty of CPU to do either; personally, I'd do PBR as it's less headache.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-09-04T20:35:14.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22205" PostTypeId="2" ParentId="22168" CreationDate="2015-09-04T20:36:11.400" Score="1" Body="&lt;p&gt;ip address X.X.X.X consisted of two main parts [Network part] , [host part]&#xA;Network part can be consisted of two parts , fixed part called [network summary address] and tunnable part called [Subnet ID] , will reserved by host IPs .&#xA;in your example you provide us with the network summary address &lt;strong&gt;172.16. 64.0/18&lt;/strong&gt; and you want to subnet this address into 4 subnets (sub 0 ,1 ,2 ,3 ).&#xA;let us present your summary address in other way &#xA;&lt;a href=&quot;https://i.stack.imgur.com/1OVaf.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1OVaf.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as you know in binary if you want to represent up to 3 things you need at lest 2 binary digits (00 ,01,10,11) , simply to represent those 4 subnets we will get the two binary digits we need from the host portion as next  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CYPbZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CYPbZ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so that the network portion of the IP became 20 digits instead of 18 &#xA;and the subnets will be as shown &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/loVJC.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/loVJC.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-04T21:03:12.030" LastActivityDate="2015-09-04T21:03:12.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22206" PostTypeId="1" AcceptedAnswerId="22207" CreationDate="2015-09-04T22:06:32.993" Score="1" ViewCount="63" Body="&lt;p&gt;I am reading about Network Socket. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Network Socket is a one endpoint in a communication flow between two programs running over a network.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like a better definition about &lt;code&gt;endpoint&lt;/code&gt; I searched but that is not being obvious for me.&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="14008" LastEditDate="2015-09-04T22:15:05.363" LastActivityDate="2015-09-04T22:17:22.447" Title="What means endpoint?" Tags="|protocol-theory|internet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22207" PostTypeId="2" ParentId="22206" CreationDate="2015-09-04T22:17:22.447" Score="4" Body="&lt;p&gt;An endpoint is the beginning or end of something.  For example, if you call your friend on the telephone, the phones are the endpoints of the call path.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-04T22:17:22.447" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22209" PostTypeId="2" ParentId="22188" CreationDate="2015-09-05T01:29:07.987" Score="0" Body="&lt;p&gt;I'm not quite following the question. What did you mean when you wrote&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I can't just use any of the new IP addresses on the existing &#xA;  untrust interface because traffic isn't routed back to the correct gateway.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Traffic from the inet? It's not routed back to what gateway? Maybe an ascii drawing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also don't know what to think about &quot;VRF or PBR.&quot; (assuming by PBR we mean filter-based forwarding rather than an execrable brand of beer). If I understand your configuration, you can't use either b/c the ISP's two subnets appear on the same SRX unit interface. You can't put a unit interface in two routing-instances and expect the box to commit the config. (To put it another way, you place interfaces in routing-instances, not addresses.) That also means you can't provision FBF because FBF routes traffic out different routing-instances depending on your filter. Wow, it's probably been 5 years since I did FBF ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am SO confused!&lt;/p&gt;&#xA;" OwnerUserId="18769" LastActivityDate="2015-09-05T01:29:07.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22211" PostTypeId="2" ParentId="21142" CreationDate="2015-09-05T06:25:13.560" Score="1" Body="&lt;p&gt;The problem has been resolved. It turned out to be due to a glitch in the Linux kernel PHY, where it would sometimes not be returned to the proper state. I am unsure as to whether this applies to Toradex Apalis modules only, but leaving the question and this answer in case it may help someone else in the future. Here's a commit fixing the problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://git.toradex.com/cgit/linux-toradex.git/commit/?h=toradex_imx_3.10.17_1.0.0_ga-next&amp;amp;id=eedcb125cd8bcaba5872c3a6f0f4f0705d10758b&quot; rel=&quot;nofollow&quot;&gt;http://git.toradex.com/cgit/linux-toradex.git/commit/?h=toradex_imx_3.10.17_1.0.0_ga-next&amp;amp;id=eedcb125cd8bcaba5872c3a6f0f4f0705d10758b&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17724" LastActivityDate="2015-09-05T06:25:13.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22212" PostTypeId="1" CreationDate="2015-09-05T06:53:42.027" Score="2" ViewCount="3275" Body="&lt;p&gt;Problem: I want to be able to ping a domain name, sourcing from a particular interface on a Cisco router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario: I have Router-A, an it has a management address of 1.1.1.1. I can only connect to this router using that address from a certain location, which is how security is set up, and it cannot be changed. I would like to be able to connect to Router-A and then setup DNS with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip domain-lookup&#xA;ip name-server 44.44.44.44&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, from the command line, I would want to do something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping www.google.com source interface FastEthernet0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, why cant i do this? Well, because when you introduce the domain name into the ping statement, you are not giving the option to source it anymore. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, just use an extended ping? Although it seems like you would have that option, after you enter the domain name in, you don't get the option to source it anymore. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are you trying to source it from Fas0? Because that subnet is allowed to query the DNS, no other address on the device is allowed, by the DNS server, to make queries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, just send the request from an end device connected to the router? I cant, and this is not answering the problem, it has to be done from the command line on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had the idea of &lt;code&gt;tclsh&lt;/code&gt; with something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tclsh&#xA;foreach var {&#xA;http://www.domainname1.com&#xA;http://www.domainname2.com&#xA;http://www.domainname3.com&#xA;http://www.domainname4.com&#xA;http://www.domainname5.com&#xA;} {ping $var repeat 5 source Fas0}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But that does not work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="8109" LastEditorUserId="8499" LastEditDate="2016-04-02T18:49:19.223" LastActivityDate="2017-01-24T15:45:35.783" Title="Ping domain name using sourced interface" Tags="|cisco|dns|icmp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="22213" PostTypeId="2" ParentId="22168" CreationDate="2015-09-05T07:26:53.500" Score="0" Body="&lt;p&gt;There are 4 available subnets here &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network ID - Range - Broadcast ID:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.16.0.0     -     172.16.63.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.16.64.0    -     172.16.127.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.16.128.0   -     172.16.191.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.16.192.0   -     172.16.255.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But your question states :: If I subnet the IP prefix 172.16.64.0/18&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So we have to start @ 172.16.64.0&lt;/p&gt;&#xA;" OwnerUserId="8109" LastActivityDate="2015-09-05T07:26:53.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22214" PostTypeId="1" CreationDate="2015-09-05T11:27:30.100" Score="4" ViewCount="7239" Body="&lt;p&gt;I have a very strange issue with Cisco ASA 5505 started about week ago: ASA like a router with outside port to ISP, next port to DMZ and another one to inside network (contains about 50 hosts thru several Cisco SMB switches).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many, but not all hosts (SIP phones, laptops, desktops) from inside network suddenly stop accessing internet and even ping to ASA doesn't pass thru. Some other hosts, like servers connected thru the same switches always works. DMZ hosts are also works without issues. It could work for 8 hours or happens every 15 mins with no visible understanding. Once the connectivtity for a hosts lost it is possible to restore it with ASA reboot or just wait for 15-20-30 minutes (randomly) before it will self-restore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today I have just started digging and found what &quot;clear arp&quot; immediately resolves the issue, but with my knowledge I can't identify the root and how to fix it. Configuration work almost for an year and nothing were changed recently. ISP checked from their side and reported the issue at our side so coundn't help somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upgraded ASA's software - no changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be appreciated, depersonalized running config is below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Result of the command: &quot;sh ru&quot;&#xA;&#xA;: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz&#xA;:&#xA;ASA Version 9.2(4) &#xA;!&#xA;hostname ciscoasa&#xA;domain-name XXXX&#xA;enable password XXXX encrypted&#xA;names&#xA;ip local pool vpn-pool 192.168.3.2-192.168.3.254 mask 255.255.255.0&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA; switchport access vlan 12&#xA;!&#xA;interface Ethernet0/7&#xA; switchport access vlan 12&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.0.1 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address ISP_PROVIDED_IP 255.255.255.192 &#xA;!&#xA;interface Vlan12&#xA; no forward interface Vlan1&#xA; nameif DMZ&#xA; security-level 50&#xA; ip address 172.16.0.1 255.255.255.0 &#xA;!&#xA;boot system disk0:/asa924-k8.bin&#xA;ftp mode passive&#xA;clock timezone MSK/MSD 3&#xA;clock summer-time MSK/MDD recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;dns domain-lookup inside&#xA;dns domain-lookup outside&#xA;dns server-group DefaultDNS&#xA; name-server DNS1-ISP&#xA; name-server DNS2-ISP&#xA; name-server DNS3-INTERNAL_HOSTS&#xA; name-server 8.8.8.8&#xA; domain-name XXXXX&#xA;same-security-traffic permit intra-interface&#xA;object network obj_any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network NETWORK_OBJ_192.168.2.0_24&#xA; subnet 192.168.2.0 255.255.255.0&#xA;object network 192.168.3.0&#xA; subnet 192.168.3.0 255.255.255.0&#xA;object network 192.168.0.1&#xA; subnet 192.168.0.0 255.255.255.0&#xA;object network ins&#xA; subnet 192.168.1.0 255.255.255.0&#xA;object network 192.168.1.1&#xA; host 192.168.1.1&#xA;object network asdc&#xA; host 192.168.0.50&#xA; description asdc&#xA;object network TGP500-01&#xA; host 192.168.0.32&#xA;object network TGP500-02&#xA; host 192.168.0.25&#xA;object network TGP500-03&#xA; host 192.168.0.30&#xA;object network TGP500-04&#xA; host 192.168.0.10&#xA;object network TGP500-05&#xA; host 192.168.0.11&#xA;object network DMZ_outside&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network DMZ&#xA; subnet 172.16.0.0 255.255.255.0&#xA;object-group network SIP_PROVIDER&#xA; description SIP_PROVIDER&#xA; network-object SIP_ISP_NETW 255.255.255.0&#xA; network-object host SIP_ISP_HOST&#xA; network-object host SIP_ISP_HOST&#xA; network-object host SIP_ISP_HOST&#xA;object-group service SIP-stun tcp-udp&#xA; description SIP-stun&#xA; port-object range 3478 3479&#xA;object-group service SIP60000 udp&#xA; description SIP60000&#xA; port-object eq 60000&#xA;object-group service sip-SIP udp&#xA; description sip-SIP&#xA; port-object range 1024 65535&#xA;object-group service DM_INLINE_UDP_1 udp&#xA; group-object SIP-stun&#xA; group-object SIP60000&#xA; group-object sip-SIP&#xA;object-group protocol TCPUDP&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group network SIPphones&#xA; description SIP phones&#xA; network-object object TGP500-01&#xA; network-object object TGP500-02&#xA; network-object object TGP500-03&#xA; network-object object TGP500-04&#xA; network-object object TGP500-05&#xA;object-group service DM_INLINE_UDP_2 udp&#xA; group-object SIP60000&#xA; group-object sip-SIP&#xA;object-group service DM_INLINE_TCP_1 tcp&#xA; port-object eq 3389&#xA; port-object eq 7766&#xA;access-list main standard permit 192.168.1.0 255.255.255.0 &#xA;access-list main standard permit 192.168.2.0 255.255.255.0 &#xA;access-list main standard permit 192.168.3.0 255.255.255.0 &#xA;access-list main standard permit 192.168.0.0 255.255.255.0&#xA;access-list inside_access_in extended permit icmp any any &#xA;access-list inside_access_in extended permit ip 192.168.0.0 255.255.255.0 192.168.0.0 255.255.255.0 &#xA;access-list inside_access_in extended permit ip any any &#xA;access-list global_access extended permit icmp any any &#xA;access-list outside_access_in remark SIPNAME SIP 5060&#xA;access-list outside_access_in extended permit object-group TCPUDP object-group SIPName object-group SIPphones eq sip &#xA;access-list outside_access_in remark SIPNAME SIP&#xA;access-list outside_access_in extended permit udp object-group SIP object-group SIPphones object-group DM_INLINE_UDP_1 &#xA;access-list outside_access_in extended deny object-group TCPUDP any object-group SIPphones eq sip &#xA;access-list outside_access_in extended deny udp any object-group SIPphones object-group DM_INLINE_UDP_2 &#xA;access-list outside_access_in extended permit tcp any object asdc object-group DM_INLINE_TCP_1 &#xA;access-list outside_access_in extended deny ip any object asdc inactive &#xA;access-list outside_access_in extended permit ip any any &#xA;access-list outside_access_in extended permit ip any object DMZ &#xA;access-list AnyConnect_Client_Local_Print extended deny ip any4 any4 &#xA;access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq lpd &#xA;access-list AnyConnect_Client_Local_Print remark IPP: Internet Printing Protocol&#xA;access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 631 &#xA;access-list AnyConnect_Client_Local_Print remark Windows' printing port&#xA;access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 9100 &#xA;access-list AnyConnect_Client_Local_Print remark mDNS: multicast DNS protocol&#xA;access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.251 eq 5353 &#xA;access-list AnyConnect_Client_Local_Print remark LLMNR: Link Local Multicast Name Resolution protocol&#xA;access-list AnyConnect_Client_Local_Print extended permit udp any4 host 224.0.0.252 eq 5355 &#xA;access-list AnyConnect_Client_Local_Print remark TCP/NetBIOS protocol&#xA;access-list AnyConnect_Client_Local_Print extended permit tcp any4 any4 eq 137 &#xA;access-list AnyConnect_Client_Local_Print extended permit udp any4 any4 eq netbios-ns &#xA;access-list DMZ_access_in extended permit ip any any &#xA;access-list DMZ_mpc extended permit ip any 172.16.0.0 255.255.255.0 &#xA;access-list outside_mpc extended permit ip object-group SIPphones object-group SIP &#xA;access-list outside_mpc_1 extended permit ip any 172.16.0.0 255.255.255.0 &#xA;pager lines 24&#xA;logging enable&#xA;logging asdm debugging&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;mtu DMZ 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-751.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;!&#xA;object network asdc&#xA; nat (inside,outside) static interface no-proxy-arp service tcp 3389 7766 &#xA;!&#xA;nat (inside,outside) after-auto source dynamic any interface&#xA;nat (outside,inside) after-auto source static any any no-proxy-arp&#xA;nat (DMZ,outside) after-auto source dynamic any interface&#xA;access-group inside_access_in in interface inside&#xA;access-group outside_access_in in interface outside&#xA;access-group DMZ_access_in in interface DMZ&#xA;access-group global_access global&#xA;route outside 0.0.0.0 0.0.0.0 ISP_GW_ADDR 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 0:15:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;no user-identity enable&#xA;user-identity default-domain LOCAL&#xA;aaa authentication enable console LOCAL &#xA;aaa authentication ssh console LOCAL &#xA;http server enable&#xA;http 0.0.0.0 0.0.0.0 outside&#xA;http 192.168.2.0 255.255.255.0 inside&#xA;http 192.168.0.0 255.255.255.0 inside&#xA;http 192.168.3.0 255.255.255.0 outside&#xA;http 192.168.1.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec ikev2 ipsec-proposal DES&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES192&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES&#xA;crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map inside_map interface inside&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map outside_map interface outside&#xA;crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0&#xA; enrollment self&#xA; subject-name CN=192.168.1.2,CN=ciscoasa&#xA; crl configure&#xA;crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_1&#xA; enrollment self&#xA; subject-name CN=192.168.1.2,CN=ciscoasa&#xA; crl configure&#xA;crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_2&#xA; enrollment self&#xA; subject-name CN=192.168.1.1,CN=ciscoasa&#xA; crl configure&#xA;crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_3&#xA; enrollment self&#xA; subject-name CN=192.168.2.1,CN=ciscoasa&#xA; crl configure&#xA;crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_4&#xA; enrollment self&#xA; subject-name CN=192.168.1.1,CN=ciscoasa&#xA; crl configure&#xA;crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_5&#xA; enrollment self&#xA; subject-name CN=192.168.0.1,CN=ciscoasa&#xA; crl configure&#xA;crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_6&#xA; enrollment self&#xA; subject-name CN=192.168.0.1,CN=ciscoasa&#xA; crl configure&#xA;crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_7&#xA; enrollment self&#xA; subject-name CN=192.168.0.1,CN=ciscoasa&#xA; crl configure&#xA;crypto ca trustpool policy&#xA;crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0&#xA; certificate 747d9154&#xA; XXX&#xA;  quit&#xA;crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_1&#xA; certificate 465e9554&#xA;   XXX&#xA;  quit&#xA;crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_2&#xA; certificate 475e9554&#xA;    XXX&#xA;  quit&#xA;crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_3&#xA; certificate 485e9554&#xA;   XXX&#xA;  quit&#xA;crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_4&#xA; certificate 495e9554&#xA;   XXX&#xA;  quit&#xA;crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_5&#xA; certificate 4a5e9554&#xA;    XXX&#xA;  quit&#xA;crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_6&#xA; certificate 4b5e9554&#xA;    XXX&#xA;  quit&#xA;crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_7&#xA; certificate 9a7b9554&#xA;    XXX&#xA;  quit&#xA;crypto ikev2 policy 1&#xA; encryption aes-256&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 10&#xA; encryption aes-192&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 20&#xA; encryption aes&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 30&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 40&#xA; encryption des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 enable inside client-services port 443&#xA;crypto ikev2 enable outside&#xA;crypto ikev2 remote-access trustpoint ASDM_Launcher_Access_TrustPoint_0&#xA;telnet timeout 5&#xA;ssh stricthostkeycheck&#xA;ssh 192.168.0.0 255.255.255.0 inside&#xA;ssh timeout 5&#xA;ssh version 2&#xA;ssh key-exchange group dh-group14-sha1&#xA;console timeout 0&#xA;&#xA;dhcpd dns 192.168.0.1 interface inside&#xA;!&#xA;dhcpd address 172.16.0.5-172.16.0.50 DMZ&#xA;dhcpd dns 8.8.8.8 interface DMZ&#xA;dhcpd lease 604800 interface DMZ&#xA;dhcpd enable DMZ&#xA;!&#xA;priority-queue outside&#xA;threat-detection basic-threat&#xA;threat-detection statistics&#xA;threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200&#xA;ntp server 129.6.15.29 source outside&#xA;ssl trust-point ASDM_Launcher_Access_TrustPoint_2 outside&#xA;ssl trust-point ASDM_Launcher_Access_TrustPoint_7 inside vpnlb-ip&#xA;ssl trust-point ASDM_Launcher_Access_TrustPoint_7 inside&#xA;ssl trust-point ASDM_Launcher_Access_TrustPoint_2 outside vpnlb-ip&#xA;webvpn&#xA; enable inside&#xA; enable outside&#xA; anyconnect-essentials&#xA; anyconnect image disk0:/anyconnect-win-4.0.00048-k9.pkg 1&#xA; anyconnect enable&#xA; tunnel-group-list enable&#xA;group-policy DfltGrpPolicy attributes&#xA; dns-server value 192.168.0.1&#xA; split-tunnel-network-list value main&#xA; webvpn&#xA;  anyconnect ssl compression deflate&#xA;group-policy GroupPolicy_main internal&#xA;group-policy GroupPolicy_main attributes&#xA; wins-server none&#xA; dns-server value 192.168.0.1&#xA; vpn-tunnel-protocol ikev2 ssl-client &#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value main&#xA; default-domain value XXX&#xA; webvpn&#xA;  anyconnect profiles value main_client_profile type user&#xA;tunnel-group main type remote-access&#xA;tunnel-group main general-attributes&#xA; address-pool vpn-pool&#xA; authentication-server-group (inside) LOCAL&#xA; authentication-server-group (outside) LOCAL&#xA; authorization-server-group LOCAL&#xA; default-group-policy GroupPolicy_main&#xA;tunnel-group main webvpn-attributes&#xA; group-alias main enable&#xA;!&#xA;class-map outside-class1&#xA; match access-list outside_mpc_1&#xA;class-map DMZ-class&#xA; match access-list DMZ_mpc&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;class-map outside-class&#xA; match access-list outside_mpc&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA; class class-default&#xA;  user-statistics accounting&#xA;policy-map outside-policy&#xA; class outside-class&#xA;  priority&#xA; class outside-class1&#xA;  police input 2000000 1500&#xA;policy-map DMZ-policy&#xA; class DMZ-class&#xA;  police output 2000000 1500&#xA;!&#xA;service-policy global_policy global&#xA;service-policy outside-policy interface outside&#xA;service-policy DMZ-policy interface DMZ&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;hpm topN enable&#xA;Cryptochecksum:XX&#xA;: end&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sh ver&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Result of the command: &quot;sh ver&quot;&#xA;&#xA;Cisco Adaptive Security Appliance Software Version 9.2(4) &#xA;Device Manager Version 7.5(1)&#xA;&#xA;Compiled on Tue 14-Jul-15 22:19 by builders&#xA;System image file is &quot;disk0:/asa924-k8.bin&quot;&#xA;Config file at boot was &quot;startup-config&quot;&#xA;&#xA;ciscoasa up 5 hours 38 mins&#xA;&#xA;Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz,&#xA;Internal ATA Compact Flash, 128MB&#xA;BIOS Flash M50FW016 @ 0xfff00000, 2048KB&#xA;&#xA;Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)&#xA;                             Boot microcode        : CN1000-MC-BOOT-2.00 &#xA;                             SSL/IKE microcode     : CNLite-MC-SSLm-PLUS-2.06&#xA;                             IPSec microcode       : CNlite-MC-IPSECm-MAIN-2.09&#xA;                             Number of accelerators: 1&#xA;&#xA; 0: Int: Internal-Data0/0    : address is 442b.034a.96fa, irq 11&#xA; 1: Ext: Ethernet0/0         : address is 442b.034a.96f2, irq 255&#xA; 2: Ext: Ethernet0/1         : address is 442b.034a.96f3, irq 255&#xA; 3: Ext: Ethernet0/2         : address is 442b.034a.96f4, irq 255&#xA; 4: Ext: Ethernet0/3         : address is 442b.034a.96f5, irq 255&#xA; 5: Ext: Ethernet0/4         : address is 442b.034a.96f6, irq 255&#xA; 6: Ext: Ethernet0/5         : address is 442b.034a.96f7, irq 255&#xA; 7: Ext: Ethernet0/6         : address is 442b.034a.96f8, irq 255&#xA; 8: Ext: Ethernet0/7         : address is 442b.034a.96f9, irq 255&#xA; 9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255&#xA;10: Int: Not used            : irq 255&#xA;11: Int: Not used            : irq 255&#xA;&#xA;Licensed features for this platform:&#xA;Maximum Physical Interfaces       : 8              perpetual&#xA;VLANs                             : 20             DMZ Unrestricted&#xA;Dual ISPs                         : Enabled        perpetual&#xA;VLAN Trunk Ports                  : 8              perpetual&#xA;Inside Hosts                      : Unlimited      perpetual&#xA;Failover                          : Active/Standby perpetual&#xA;Encryption-DES                    : Enabled        perpetual&#xA;Encryption-3DES-AES               : Enabled        perpetual&#xA;AnyConnect Premium Peers          : 25             perpetual&#xA;AnyConnect Essentials             : 25             perpetual&#xA;Other VPN Peers                   : 25             perpetual&#xA;Total VPN Peers                   : 25             perpetual&#xA;Shared License                    : Disabled       perpetual&#xA;AnyConnect for Mobile             : Enabled        perpetual&#xA;AnyConnect for Cisco VPN Phone    : Enabled        perpetual&#xA;Advanced Endpoint Assessment      : Enabled        perpetual&#xA;UC Phone Proxy Sessions           : 2              perpetual&#xA;Total UC Proxy Sessions           : 2              perpetual&#xA;Botnet Traffic Filter             : Disabled       perpetual&#xA;Intercompany Media Engine         : Disabled       perpetual&#xA;Cluster                           : Disabled       perpetual&#xA;&#xA;This platform has an ASA 5505 Security Plus license.&#xA;&#xA;Configuration register is 0x1&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Added:&#xA;show logging once user's reported internet absense&#xA;&lt;a href=&quot;http://pastebin.com/3CqXGtuk&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/3CqXGtuk&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18774" LastEditorUserId="18774" LastEditDate="2015-09-05T12:33:24.863" LastActivityDate="2015-09-06T07:41:18.663" Title="Cisco ASA 5505 stop passing traffic randomly" Tags="|cisco|cisco-asa|arp|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="22217" PostTypeId="2" ParentId="22212" CreationDate="2015-09-05T12:33:34.433" Score="2" Body="&lt;p&gt;Basically, you need to check the connectivity between this router and the DNS server through FastEthernet0.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Try to ping it globally with no source interface&lt;/li&gt;&#xA;&lt;li&gt;Try to ping the DNS server &lt;strong&gt;&lt;em&gt;IP address&lt;/em&gt;&lt;/strong&gt; using this source interface or the IP address assigned to it&lt;/li&gt;&#xA;&lt;li&gt;Try to ping anything local in your domain first (e.g. your PC's fully qualified domain name), then try to ping a global site, since it may be an Internet access problem (1.1.1.1 IP address range)&lt;/li&gt;&#xA;&lt;li&gt;Try Cisco troubleshooting list, this case its may be of help &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/domain-name-system-dns/24182-reversedns.html#subtopic1a&quot; rel=&quot;nofollow noreferrer&quot;&gt;CISCO DNS TS&lt;/a&gt;  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NOTE&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;I just tried the 'ip name-server X.X.X.X' command on my core switch (X.X.X.X is my DNS server IP address) and everything worked perfect internally and externally (I used ping and traceroute to &lt;code&gt;idjsrv.beyti.local&lt;/code&gt;) as shown:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Py02j.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Py02j.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I used ping and traceroute to &lt;code&gt;www.google.com&lt;/code&gt;) as shown:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DU6jB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DU6jB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2016-04-02T18:56:09.197" LastActivityDate="2016-04-02T18:56:09.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22218" PostTypeId="1" CreationDate="2015-09-05T12:46:43.060" Score="1" ViewCount="2253" Body="&lt;p&gt;We need to monitor the download/upload bandwidth on interfaces on Huawei S5300 switches, and we need to do it with a specific monitoring system. This system can get information from a switch using SNMP OID and can draw historic graphs based on collected data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is that there is no standard OID for bandwidth. For instance, the well known IF-MIB and its ifTable (1.3.6.1.2.1.2.2.) can return values for the number of bytes going in/out of the interface (.16-ifOutOctets and .10-ifInOctets) but they aren't useful since they need to be processed in a formula to get the actual bandwidth. The monitoring system we use has not built in option to calculate bandwidth using the information from IF-MIB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a solution, we're looking for Huawei custom MIB that can give us data about the current bandwidth usage of an interface. Is there a way to get the &quot;Last 300 seconds input rate&quot; and &quot;Last 300 seconds ourput rate&quot; in bits/sec for Ethernet and GigabitEthernet interface on S5300 switches using SNMP? Practically, we need the MIB and SNMP OID that relates to the input/output rate that is shown using the command: &quot;display interface GigabitEthernet 0/0/X&quot;, as shown at the image below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NVOpW.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NVOpW.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your attention to this matter.&lt;/p&gt;&#xA;" OwnerUserId="17483" LastActivityDate="2015-09-05T12:46:43.060" Title="Get interface input/output rate statistics over SNMP from Huawei switch" Tags="|snmp|bandwidth|monitoring|interface|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22219" PostTypeId="1" CreationDate="2015-09-05T13:31:55.053" Score="2" ViewCount="159" Body="&lt;p&gt;Apologies for the fairly basic question. We are a fast growing business (12 employees and roughly planning to double in next two years)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part of our work involves direct connection to our customer networks. Typically we do this via VPNs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A new and larger than usual customer is asking for a lot of info regarding our firewall and configuration and it seems wants to set up a site-to-site VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have been running well for some time on a leased line with a good quality router. We open certain ports (such as web, VPN) and forward them to the appropriate IP addresses internally. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are also moving to a new office and trying to set things up well/better there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As well as the above should we have a hardware firewall? What is the advantage over a router that only opens certain ports? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A basic firewall such as SonicWall SOHO seems to be the way to go. If we bought this, it would sit in between the router and the rest of the network? And we would just leave everything open on the router to allow the firewall to manage the connections? And it would still allow us to route the right ports through to where they need to go?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We may need to engage some experts, but we have considerable network experience in house but not with this aspect. So hoping we can handle it ourselves with a bit of a steer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate any help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;James&lt;/p&gt;&#xA;" OwnerUserId="18776" LastActivityDate="2018-10-27T17:48:12.060" Title="Firewall / Router for small growing business" Tags="|router|firewall|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22222" PostTypeId="2" ParentId="22219" CreationDate="2015-09-05T14:24:49.043" Score="4" Body="&lt;p&gt;While product recommendations are off-topic for this forum,  you are correct that the firewall should be placed between the router and the rest of the network.  The big change is that now the default gateway of all your PCs will point to the firewall instead of the router.  Similarly, the router now points to the firewall instead of the internal network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For those devices that are accessible from the outside, good practice says to put them on a separate network (called a DMZ) and a separate interface on the firewall.  You should only allow the necessary ports into the DMZ from the outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To implement a site-to-site VPN, a hardware router makes things much easier.  You also want to limit inbound traffic from the VPN tunnel.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-09-05T14:24:49.043" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22224" PostTypeId="1" AcceptedAnswerId="22229" CreationDate="2015-09-05T17:08:01.540" Score="3" ViewCount="3798" Body="&lt;p&gt;Here i have this topology in my company &#xA;&lt;a href=&quot;https://i.stack.imgur.com/hrXE7.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hrXE7.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cores configure with &lt;strong&gt;&lt;em&gt;VSS&lt;/em&gt;&lt;/strong&gt;, As we can see single link connecting each router to each core which make this link single point of fail, so I need to add link between each router and the other core acting as something like ether channel between two switches to avoid this failure probability from my network , like the next topology&#xA;&lt;a href=&quot;https://i.stack.imgur.com/BOKdm.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BOKdm.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i'm asking about if there is any link aggregation method on the router side (some thing like L3 port aggregation on switches ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NOTE&lt;/em&gt;&lt;/strong&gt; my routers plateform is 2921 and run Version 15.2(4)M6a&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-05T19:21:29.377" LastActivityDate="2016-03-03T21:44:42.830" Title="link aggregation between switch and router" Tags="|cisco|switch|router|" AnswerCount="3" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="22228" PostTypeId="2" ParentId="13357" CreationDate="2015-09-05T20:08:07.557" Score="0" Body="&lt;p&gt;Not necessarily a congestion in the network, because errors in the packet may also cuse retransmission since TCP is used&lt;/p&gt;&#xA;" OwnerDisplayName="user17357" LastActivityDate="2015-09-05T20:08:07.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22229" PostTypeId="2" ParentId="22224" CreationDate="2015-09-05T20:57:33.907" Score="3" Body="&lt;p&gt;Based on your comments, you can achieve link redundancy by installing a link from each physical core switch chassis to each router.  Each link would be a point-to-point (usually /30 or /31) routed link.  The core and the routers would need to run an IGP routing protocol.  Your devices support OSPF, and it is easy to set up and include every layer-3 interface.  When a link is disabled, OSPF will route around the broken link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a simple, conventional network topology that is easy to support on most business-class networks, and it seems to provide what you are looking for.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-05T21:03:30.663" LastActivityDate="2015-09-05T21:03:30.663" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22233" PostTypeId="1" CreationDate="2015-09-06T00:54:00.960" Score="1" ViewCount="332" Body="&lt;p&gt;the on mode still negotiable (send/receive DTP) until  i set it no negotiate so what is the Difference between on and Desirable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please give an example :))  &lt;/p&gt;&#xA;" OwnerUserId="18785" LastEditorUserId="8499" LastEditDate="2018-12-22T03:16:38.983" LastActivityDate="2018-12-22T03:16:38.983" Title="DTP mode desirable and on" Tags="|cisco|switch|switching|layer2|trunk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22234" PostTypeId="2" ParentId="22233" CreationDate="2015-09-06T03:01:05.247" Score="1" Body="&lt;p&gt;I think you are confusing DTP with PAgP. DTP doesn't have a &lt;code&gt;switchport mode on&lt;/code&gt;, while PAgP has &lt;code&gt;channel-group &amp;lt;num&amp;gt; mode on&lt;/code&gt;.  DTP is always on for a switch port unless you turn it off with &lt;code&gt;switchport nonegotiate&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DTP commands are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;switchport mode trunk&lt;/code&gt; - initiates DTP (always trunk)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;switchport mode access&lt;/code&gt; - initiates DTP (never trunk)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;switchport mode dynamic desirable&lt;/code&gt; - initiates and listens for DTP (negotiate trunk)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;switchport mode dynamic auto&lt;/code&gt; - listens for DTP (negotiate trunk)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;switchport nonegotiate&lt;/code&gt; - disables DTP&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;switchport trunk encapsulation &amp;lt;encap&amp;gt;&lt;/code&gt; - disables DTP trunk encapsulation negotiation&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-06T03:06:56.323" LastActivityDate="2015-09-06T03:06:56.323" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22235" PostTypeId="1" CreationDate="2015-09-06T06:03:17.217" Score="2" ViewCount="1321" Body="&lt;p&gt;I am using G.655 standard fiber for a project. We are using short haul SFP &amp;amp; long Haul SFP. Long haul (1550 nm) works fine with G.655 fiber, But Short haul SFP (1310 nm) is having some issue as link is not getting up. I am not sure whether the issue is coming because use of short haul at 1310nm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether 1310nm wavelenght is support in G.655 fiber with cable cut off wavelenght?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for help in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;Vinay&lt;/p&gt;&#xA;" OwnerUserId="18786" LastActivityDate="2015-11-06T09:11:50.283" Title="Does G.655 fiber supports 1310 nm wavelenght?" Tags="|fiber|sfp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22237" PostTypeId="2" ParentId="22214" CreationDate="2015-09-06T07:41:18.663" Score="3" Body="&lt;p&gt;The issue has been resolved! I have tried to analyze non-working hosts ARP tables and found ASA's MAC address change. Decreased ASA's log verbosity to Warning level, rebooted it and got a message during boot &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IP address collision detected between host 192.168.0.1 at f80f.4197.a18d and interface inside&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So found host with the MAC noted. Despite it has different IP address and it is separate point to investigate, host's disconnection immediately resolves the issue.&lt;/p&gt;&#xA;" OwnerUserId="18774" LastActivityDate="2015-09-06T07:41:18.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22238" PostTypeId="2" ParentId="21161" CreationDate="2015-09-06T07:59:53.250" Score="2" Body="&lt;p&gt;dear you need to know that voice GW &lt;strong&gt;&lt;em&gt;(VG)&lt;/em&gt;&lt;/strong&gt; can't communicate other VG without Call agent involved in this communication and this call agent could be centralized and both VG have connectivity to it through WAN connection for example .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;if your business is small growing&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;you can use  some sort of of small business call agent (i.e. Cisco call manager express CME) in both sides which can handle Voip calls over WAN and local,mobile and international calls through PSTN  and if you want to obtain small call center it has call center express as well but it is licensed feature. &lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;you also can use open source call agent like Asterisk and register those GW on it &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if you don't want to bay any equipment other that your IP phones you can join ISP which can run telephone service on it , which is called &lt;strong&gt;&lt;em&gt;ITSP&lt;/em&gt;&lt;/strong&gt;, ITSP will handle all VOIP feature you need (i.e. dial peers , route patterns , conferences , auto attendance and so on) please check this link &lt;a href=&quot;http://www.voip-info.org/wiki/view/Sip+Trunking+Providers&quot; rel=&quot;nofollow&quot;&gt;VOIP INFO&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;degradation may you found for solution 1 and 2 is the WAN connection quality and this issue is solved by using QOS cross the WAN connection.  &lt;/li&gt;&#xA;&lt;li&gt;degradation may you found for solution 3 is the cost where you will bay for each call you make  &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NOTE&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the VG register on the call agent by certain registration protocols some of them is open source any one can make use of like H323 and other are proprietary like Cisco MGCP.&lt;/li&gt;&#xA;&lt;li&gt;i don't aim to mention any product by its name it just for example.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-09T11:41:14.653" LastActivityDate="2015-09-09T11:41:14.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22239" PostTypeId="2" ParentId="22224" CreationDate="2015-09-06T08:01:13.180" Score="1" Body="&lt;p&gt;I'm not sure if link aggregation is possible on a router, but if all you need is redundancy, link aggregation is NOT the way to go. Link aggregation is for increasing the bandwidth of a logical connection, not for redundancy. &lt;/p&gt;&#xA;" OwnerUserId="15698" LastActivityDate="2015-09-06T08:01:13.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22240" PostTypeId="2" ParentId="22224" CreationDate="2015-09-06T08:58:49.977" Score="2" Body="&lt;p&gt;here i found very good solution for this case is to use &lt;strong&gt;&lt;em&gt;IRB (Integrated Routing and Bridging)&lt;/em&gt;&lt;/strong&gt; , refer to this very long discussion &lt;a href=&quot;https://serverfault.com/questions/254347/what-is-a-cisco-bvi-interface-what-is-it-used-for&quot;&gt;IRB why and how?&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A BVI (Bridge Group Virtual Interface) is a routed interface that represents a set of interfaces that gets bridged. so we need to configure IRB from the router side and the core side and it will provide the redundancy needed &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i found some examples for such configuration in the next link &lt;a href=&quot;http://blog.xuite.net/flytw1/ccie/98038572-Cisco+Bridge-Group+Virtual+Interface(BVI)+Configuration+for+High+Availability&quot; rel=&quot;nofollow noreferrer&quot;&gt;EXAMPLE&lt;/a&gt;&#xA;and i try it on GNS3 and it is working properly &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-09-06T08:58:49.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22241" PostTypeId="2" ParentId="16698" CreationDate="2015-09-06T10:42:24.573" Score="2" Body="&lt;p&gt;i believe that the problem is in the VRF configuration itself , so please check the next&lt;br&gt;&#xA; 1. configure  'ip vrf forwarding Customer1-portforwarding' under interfaces involved in NAT (nat inside,nat outside interfaces)&lt;br&gt;&#xA; 2. if your access list will use the VRF routing table so you need to add &#xA;'set vrf Customer1-portforwarding' command under route-map configuration to make use of theVRF routing table&lt;br&gt;&#xA; 3. make your route-map more specific by set next hop&lt;br&gt;&#xA; 4. verify NATing by use 'sh ip nat translation' command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;make use of those URLs&lt;br&gt;&#xA; &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/xe-3s/asr1000/nat-xe-3s-asr1k-book/iadnat-match-vrf.html&quot; rel=&quot;nofollow&quot;&gt;NAT over VRF&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2s/feature/guide/fs_pbrsv.html&quot; rel=&quot;nofollow&quot;&gt;Route-map over VRF&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-06T10:42:24.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22244" PostTypeId="1" CreationDate="2015-09-06T12:38:22.637" Score="3" ViewCount="6804" Body="&lt;p&gt;I am trying to implement simple scenario of RIP using Packet Tracer, first of all here is the scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/f9otl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f9otl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and I have used the following commands to configure &lt;code&gt;RIPv2&lt;/code&gt; in each router,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA;version 2&#xA;network 172.30.10.0&#xA;network 10.1.1.0&#xA;no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA;version 2&#xA;network 10.1.1.0&#xA;network 10.2.2.0&#xA;no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA;version 2&#xA;network 172.30.30.0&#xA;network 10.2.2.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if i see the output of &lt;code&gt;show ip route&lt;/code&gt; command on &lt;code&gt;R1&lt;/code&gt;, it doesn't show any route to &lt;code&gt;172.30.0.0&lt;/code&gt; subnet of &lt;code&gt;R3&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     10.0.0.0/30 is subnetted, 1 subnets&#xA;C       10.1.1.0 is directly connected, Serial0/1/0&#xA;     172.30.0.0/24 is subnetted, 1 subnets&#xA;C       172.30.10.0 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similarly, here are the outputs of &lt;code&gt;R2&lt;/code&gt; and &lt;code&gt;R3&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R2&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     10.0.0.0/30 is subnetted, 2 subnets&#xA;C       10.1.1.0 is directly connected, Serial0/1/0&#xA;C       10.2.2.0 is directly connected, Serial0/1/1&#xA;     172.30.0.0/24 is subnetted, 1 subnets&#xA;R       172.30.10.0 [120/1] via 10.1.1.1, 00:00:19, Serial0/1/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R2&lt;/code&gt; only learned the path to &lt;code&gt;172.30.10.0&lt;/code&gt; network on &lt;code&gt;R1&lt;/code&gt; but not the path of the subnetworks in &lt;code&gt;R3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     10.0.0.0/24 is subnetted, 1 subnets&#xA;C       10.2.2.0 is directly connected, Serial0/1/1&#xA;     172.30.0.0/24 is subnetted, 1 subnets&#xA;C       172.30.30.0 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know what am I missing.&#xA;I read on other post that I was supposed to disable &lt;code&gt;auto-summary&lt;/code&gt; in each router which I have already did, and I have also clear the routing table after that but it is not working either.&lt;/p&gt;&#xA;" OwnerUserId="14885" LastActivityDate="2016-06-03T15:25:50.187" Title="Routers are not learning routes when using RIP" Tags="|routing|rip|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22245" PostTypeId="2" ParentId="22244" CreationDate="2015-09-06T12:58:04.077" Score="2" Body="&lt;p&gt;You are missing &lt;strong&gt;no auto-summary&lt;/strong&gt; in R3.  If that does not solve the problem maybe you need to issue the &lt;strong&gt;'IP routing'&lt;/strong&gt; command in each router. &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="13479" LastEditDate="2016-06-03T15:25:50.187" LastActivityDate="2016-06-03T15:25:50.187" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22246" PostTypeId="2" ParentId="22235" CreationDate="2015-09-06T13:01:59.867" Score="1" Body="&lt;p&gt;If your using Cisco switches/line modules/SFP's that support DOM from the cli do &lt;code&gt;show interface transceiver detail&lt;/code&gt; command and it will show all of the power levels. If your hardware doesn't support DOM you will get an error message. Cisco 1310 -LH SFP don't support DOM. If out of spec it will put either a + or ++ if too hot or - if too low. Definitely have to have the correct SFP reach part or things will be unstable. On 1310 short runs on good fiber loss is very minimal. Very easy to blind the receive side of the optics.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastEditorUserId="619" LastEditDate="2015-09-06T21:53:56.963" LastActivityDate="2015-09-06T21:53:56.963" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="22247" PostTypeId="1" CreationDate="2015-09-06T14:36:26.863" Score="34" ViewCount="10371" Body="&lt;p&gt;Is MAC address filtering the most suitable option to prevent someone connecting their own device to the network by plugging into Ethernet wall sockets? What if they unplug a device and clone its MAC?&lt;/p&gt;&#xA;" OwnerUserId="15575" LastEditorUserId="33" LastEditDate="2017-09-07T03:56:56.010" LastActivityDate="2017-09-07T03:56:56.010" Title="How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?" Tags="|mac-address|security|port-security|ieee-802.1x|rogue|" AnswerCount="8" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22249" PostTypeId="2" ParentId="22247" CreationDate="2015-09-06T17:29:33.340" Score="34" Body="&lt;p&gt;MAC address filtering itself does not provide much protection.  As you pointed out, a MAC address can be cloned.  That doesn't mean it can't be part of the overall defense strategy, but it can be a lot of work for very little return.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need a comprehensive security policy which can include such things as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Physical access limitations&lt;/li&gt;&#xA;&lt;li&gt;802.1X as @robut mentioned, albeit this can be complex and require supporting hardware/software infrastructure, while frustrating legitimate users&lt;/li&gt;&#xA;&lt;li&gt;Port security on switches can be set up to only allow a single (or limited number of) MAC address at any given time, or in any given time period, to prevent connection of hubs, switches, APs, etc., including a port disable for a given time period if violations are detected (care needs to be taken for things like VoIP phones where PCs are connected to the phone since the phone itself will have one or more MAC addresses)&lt;/li&gt;&#xA;&lt;li&gt;You could also implement a policy that requires any switch ports that&#xA;are not currently used to be disabled (including, perhaps, making&#xA;sure that unused network cables are not cross-connected in the data&#xA;closet)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As a locksmith friend of mine once told me, &quot;Locks only keep honest people honest.&quot;  The bad guys will always find a way; your job is to make it not worth their efforts.  If you provide enough layers of protection, only the most determined bad guys will spend the time and effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to weigh the risks with the resources (primarily time and money, but lost productivity, too) that you are willing to put into securing your network.  It may not make much sense to spend thousands of dollars and many man hours to protect that garage-sale bicycle you bought for $10.  You need to come up with a plan and decide how much risk you can tolerate.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-12T15:06:46.360" LastActivityDate="2016-04-12T15:06:46.360" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22251" PostTypeId="1" CreationDate="2015-09-06T23:54:27.373" Score="3" ViewCount="1446" Body="&lt;p&gt;I already have installed CCP. but when I run it, it gives this message:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Cisco configuration professional requires adobe flash player 10 or above&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have Adobe Flash Player 18, and I reset the browser after installing Flash. I installed another version of CCP, and I still have the same problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I fix this problem (I'm running Windows 7)?&lt;/p&gt;&#xA;" OwnerUserId="18785" LastEditorUserId="8499" LastEditDate="2015-11-06T01:44:12.903" LastActivityDate="2016-10-31T08:08:23.013" Title="CCP Running issue" Tags="|cisco|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22252" PostTypeId="2" ParentId="22251" CreationDate="2015-09-07T00:13:02.913" Score="2" Body="&lt;p&gt;CCP has a lot of issue could happen to resolve the issue may you try &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Changing permission for the Cisco system folder , &#xA;Then running it in admin mode&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Open IE 10 , enable menu bar (right click of address bar),&#xA;go to Tools (Ger. Extra),choose Compatibility View thenadd the 127.0.0.1 in the list&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;check if you have installed the flash player for &lt;strong&gt;&lt;em&gt;IE&lt;/em&gt;&lt;/strong&gt;. You could un-install the flash player and download the one for Internet Explorer,&#xA;if you still have the problem try to run tool in this link &lt;a href=&quot;http://download.macromedia.com/pub/flashplayer/updaters/10/flashplayer_10_ax_debug.exe&quot; rel=&quot;nofollow&quot;&gt;flash debug tool&lt;/a&gt; it should solve the problem&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;also you can make use of this discussion &lt;a href=&quot;https://supportforums.cisco.com/discussion/11184816/configuration-professional-cp-windows-7-64bits-and-internet-explorer-ie-9?tstart=0&amp;amp;viewcondensed=#ji&quot; rel=&quot;nofollow&quot;&gt;CCP problems&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-07T00:13:02.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22253" PostTypeId="2" ParentId="22247" CreationDate="2015-09-07T00:17:24.373" Score="7" Body="&lt;p&gt;Use a VPN internally and treat the section of the network outside secure areas the same way you would treat the internet.&lt;/p&gt;&#xA;" OwnerUserId="18799" LastActivityDate="2015-09-07T00:17:24.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22254" PostTypeId="1" AcceptedAnswerId="22255" CreationDate="2015-09-07T00:42:48.580" Score="1" ViewCount="607" Body="&lt;p&gt;here i used the recommendations of making the DHCP server an external server and just use the command &lt;strong&gt;IP helper X.X.X.X&lt;/strong&gt; in &lt;strong&gt;&lt;em&gt;cisco 4500X&lt;/em&gt;&lt;/strong&gt; under each interface vlan to relay DHCP to hosts in this vlan , so that i can get IP on the host machine but when i try to ping machine in other vlan which also obtain its ip from this DHCP server , ping is time out .  when i disable &lt;strong&gt;ip helper&lt;/strong&gt; command and make my core switch as DHCP server for each vlan ,inter-vlan routing work probably and i could ping remote host in other vlans .&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;note&lt;/em&gt;&lt;/strong&gt; i did same configuration on the DR site on cisco 4506 core switch and it's work probably.  &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-07T07:28:09.097" LastActivityDate="2017-08-07T09:55:17.090" Title="problem with inter vlan routing with ip helper" Tags="|cisco|vlan|interface|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22255" PostTypeId="2" ParentId="22254" CreationDate="2015-09-07T04:32:14.003" Score="2" Body="&lt;p&gt;IP helper should not make any routing difference , so you need to check the provided IP settings by DHCP if it is right or not , you need to check two things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Default Gateway for each DHCP Scope&lt;/li&gt;&#xA;&lt;li&gt;subnet mask for each scope &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="1906" LastEditDate="2017-08-07T09:34:36.920" LastActivityDate="2017-08-07T09:34:36.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22256" PostTypeId="1" CreationDate="2015-09-07T08:01:18.773" Score="1" ViewCount="343" Body="&lt;p&gt;I'm sure one of you have done this before. So our company has decided to have a separate physical network for Guest WiFi. This means putting up a new Cisco Wireless Controller and Access Points.  We will also put it on the edge of our LAN, making sure that it's touching only the router of our 2nd ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question will be the (possible?) interference these additional Guest APs will bring. Currently we have 4 APs we are using for our Corporate users. Our office has two floors with about 100+ users. I'm thinking of putting up 2-3 Guest APs. Where do you suggest to put them? Should I place it as far as possible from the Corporate APs? Or can they be close, assuming that it's 5 GHz and they are using different channels. Any best practice or suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks as always.&lt;/p&gt;&#xA;" OwnerUserId="18808" LastActivityDate="2016-09-12T07:26:56.643" Title="Possible issues on having separate Guest Access Points?" Tags="|cisco|wireless|access-point|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22257" PostTypeId="2" ParentId="22235" CreationDate="2015-09-07T08:02:39.997" Score="1" Body="&lt;p&gt;G.655 fiber like Corning LEAF has a cutoff frequency of 1450nm. Thus if you launch a 1310nm signal it behaves as multimode fiber. It's diffucult to predict how these modes would be transmitted in this situation, but most likely the light won't reach the end if your transmitter isn't powerfull enough.&#xA;There are some evidencies like this one &lt;a href=&quot;http://www.gossamer-threads.com/lists/nanog/users/153261&quot; rel=&quot;nofollow&quot;&gt;http://www.gossamer-threads.com/lists/nanog/users/153261&lt;/a&gt; where people make 1310nm sfp with optical budget for 40km to pass g.655 fiber of 10km.&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2015-09-07T08:02:39.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22258" PostTypeId="2" ParentId="22256" CreationDate="2015-09-07T08:33:05.250" Score="3" Body="&lt;p&gt;There you can configure your Access points at different channels, so they wouldn't overlapse and interfere with each other. Also, configure the power of your AP's. There are some apps for android to monitor wifi frequency usage, that would help you to plan the infrastucture. The pictures below are the example of wifi channel planning and 2.4 GHz wifi channel overlay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/e46V3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e46V3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;a href=&quot;https://i.stack.imgur.com/Nhzhr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nhzhr.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18806" LastActivityDate="2015-09-07T08:33:05.250" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22261" PostTypeId="1" AcceptedAnswerId="22268" CreationDate="2015-09-07T14:03:48.293" Score="1" ViewCount="73" Body="&lt;p&gt;The datapacket headers for any given packet follows the struture:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ethernet|ip|tcp|ftp|data&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I am to use ftp connection. Is the reason ethernet comes first historical? Since globally the ethernet adress of my router and PC is not of first concern. I would logically assume that the IP header would come first, it is the main info needed to route my request correctly, not the ethernet, it only becomes relevant when routing a packet from my local LAN to my PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am confused..&lt;/p&gt;&#xA;" OwnerUserId="18820" LastActivityDate="2015-09-07T16:50:25.003" Title="Datapacket header structure" Tags="|ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22262" PostTypeId="2" ParentId="22256" CreationDate="2015-09-07T14:20:19.110" Score="2" Body="&lt;p&gt;make use the next design approach &#xA; 1. Avoid interference on same channel, this should be handled by your controller &#xA;as shown in the next figure for &lt;strong&gt;&lt;em&gt;2.4 range of frequency&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/f3xz5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f3xz5.png&quot; alt=&quot;2.4 range&quot;&gt;&lt;/a&gt; &#xA;and for &lt;strong&gt;&lt;em&gt;5 G range of frequency&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nkuu3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nkuu3.png&quot; alt=&quot;5G range&quot;&gt;&lt;/a&gt; &#xA;and as you can figure out controller manage channels and AP power , so you will have no problem in setup access point any where with no fear of interference  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for interference with other access point or any other 802.11 radio device , cisco provide great feature called &lt;strong&gt;&lt;em&gt;cleanair&lt;/em&gt;&lt;/strong&gt; ,which is acting as Proactive Radio Frequency Interference (RFI) Protection&#xA;&lt;a href=&quot;https://i.stack.imgur.com/6YJcw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6YJcw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;   &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-08T07:47:00.160" LastActivityDate="2015-09-08T07:47:00.160" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22264" PostTypeId="1" AcceptedAnswerId="22267" CreationDate="2015-09-07T14:54:47.327" Score="1" ViewCount="793" Body="&lt;p&gt;First of all thank you in advance trying to solve my issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to Team 4 NICs on HyperV and QNAP server to my switch Cisco 2960X in order to get 4Gbps data transfer rate to backup data faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have implemented some configurations found on the internet but none of them give me 4Gbps, they just show that interface's speed is 1Gbps.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh int port-channel 3 status&#xA;&#xA;Port      Name               Status       Vlan       Duplex  Speed Type&#xA;Po3       QNAP EtherChannel  connected    1          a-full a-1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is my config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel3&#xA; description QNAP EtherChannel&#xA; switchport mode access&#xA;&#xA;interface range GigabitEthernet1/0/9-12&#xA; description QNAP EtherChannel&#xA; switchport mode access&#xA; speed 1000&#xA; duplex full&#xA; channel-protocol lacp&#xA; channel-group 3 mode active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have experience with this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18822" LastActivityDate="2015-09-07T21:41:26.957" Title="Port Group Cisco 2960X + HyperV or any server" Tags="|cisco|switch|ieee-802.1ax|etherchannel|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22266" PostTypeId="2" ParentId="22264" CreationDate="2015-09-07T15:14:46.620" Score="4" Body="&lt;p&gt;Link aggregation / port-channel / lacp will not allow you to have a single stream to use several interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Four different streams can use different physical interfaces, and each one could use 1Gbs (reaching 4Gbs total) but none of them will be able to achieve more than 1Gbs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those protocols works with an algorithm that will choose a specific interface for a specific stream (usually based on source / destination mac addresses; IP addresses etc...), so a stream is &quot;bound&quot; to a physical interface.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-09-07T15:14:46.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22267" PostTypeId="2" ParentId="22264" CreationDate="2015-09-07T15:27:10.547" Score="4" Body="&lt;p&gt;first of all you need to know that using port channel mean you will maximum obtain one physical link speed (1G) per &lt;strong&gt;&lt;em&gt;flow&lt;/em&gt;&lt;/strong&gt; where flow means same source port and same destination port, so if you generate 2 traffic flow  you will obtain speed of two physical link and so on .  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Versification&lt;/em&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;there are two verification methods&lt;br&gt;&#xA; 1. from cisco side &lt;strong&gt;&lt;em&gt;&quot;show port-channel summary&quot;&lt;/em&gt;&lt;/strong&gt; if port-channel working probably you should see  GigabitEthernet1/0/9 (p) GigabitEthernet1/0/10 (p) GigabitEthernet1/0/11 (p) GigabitEthernet1/0/12(p) , if it work probably go to next step&lt;br&gt;&#xA; 2. use the very helpful tool called &lt;strong&gt;&lt;em&gt;Jperf&lt;/em&gt;&lt;/strong&gt; which is setup as server as a client and can generat 1 flow or multiple flow , if you could setup it probably generate 1 flow and monitor the traffic digrame and then generate 2 or more flows and monitor , you should realize that your BW is more than 1G &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Er8Gw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Er8Gw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you still facing same problem , may you make use of the this linke&lt;a href=&quot;http://blogs.technet.com/b/keithmayer/archive/2012/10/16/nic-teaming-in-windows-server-2012-do-i-need-to-configure-my-switch.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;NIC Teaming in Windows Server 2012&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;note&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;don't make any configuration on the members of the port group , just do it under the port channel it self so simply configure&lt;br&gt;&#xA; - switchport mode access&lt;br&gt;&#xA; - speed 1000&lt;br&gt;&#xA; - duplex full&lt;br&gt;&#xA;under the port channel not under the interfaces&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-07T21:41:26.957" LastActivityDate="2015-09-07T21:41:26.957" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22268" PostTypeId="2" ParentId="22261" CreationDate="2015-09-07T15:53:19.077" Score="3" Body="&lt;p&gt;You're assuming the Ethernet header stays with the data from source to destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ethernet header only exists on Ethernet links, and each different Ethernet link will have a different header.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At every router hop, the layer 2 header (Ethernet) is removed, then the IP header is examined, the routing decision is made, and a new layer 2 header is added.  If the layer 2 connection is Ethernet, then an Ethernet header is added.  If it's Wi-fi, then an 802.11 header.  Sonet, HDLC, &lt;em&gt;etc.&lt;/em&gt; all have their own layer 2 headers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ethernet header you receive was added to the packet by the router closest to you.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-09-07T16:50:25.003" LastActivityDate="2015-09-07T16:50:25.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22272" PostTypeId="2" ParentId="22247" CreationDate="2015-09-07T20:52:13.027" Score="4" Body="&lt;p&gt;Answer to your question = No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont think there is one complete answer. The closest would be to have defence in depth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start as Ron Maupin suggested as having Physical access restricted. Then have 802.1x using EAP-TLS to have authentication to the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that you can still have a firewall on the access/ditribution layer. If you are talking more about internal web systems then make sure everyone is authenticated through a proxy also.&lt;/p&gt;&#xA;" OwnerUserId="9981" LastActivityDate="2015-09-07T20:52:13.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22274" PostTypeId="1" AcceptedAnswerId="22280" CreationDate="2015-09-07T22:11:08.817" Score="2" ViewCount="1891" Body="&lt;p&gt;This &lt;a href=&quot;http://www.networkcomputing.com/networking/how-to-set-up-cisco-nexus-fabric-extender/d/d-id/1234057&quot; rel=&quot;nofollow&quot;&gt;design guide&lt;/a&gt; on networkcomputing.com states the following: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When uplinking to Nexus 5Ks, one topology option is to dual-home the physical Fabric Extender. Dual-homing a FEX provides path redundancy, but cuts in half the total number of Fabric Extenders you can deploy&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In the following &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration_limits/limits_503/nexus_5000_config_limits_503_n1_1b.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Data Sheet&lt;/a&gt; it states that &quot;Maximum Fabric Extenders dual-homed to a vPC Cisco Nexus 5000 Series or Nexus 5500 Series switch pair&quot; for a Nexus 5000 series switch is 12. It also states &quot;Maximum Fabric Extenders per Cisco Nexus 5000 Series or Nexus 5500 Series switch&quot; is the same, 12. This doesn't make sense according to the networkcomputing.com guide. Dual homed FEXs connected to Nexus 5000 vPC should be half the supported amount of a single-homed FEX design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I have two Nexus 5000 series switches. They support a total of 24 FEXs if each FEX is dual homed. If I configure vPC on my 5000 series switches and dual home my FEX up to each switch, will I now only be able to connect 12 FEXs instead of 24 using these two switches?&lt;/p&gt;&#xA;" OwnerUserId="889" LastEditorUserId="8499" LastEditDate="2018-12-17T02:56:29.703" LastActivityDate="2018-12-17T02:56:29.703" Title="Nexus 5500 FEX Support" Tags="|cisco|cisco-nexus|vpc|data|fex|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22275" PostTypeId="2" ParentId="22274" CreationDate="2015-09-07T22:25:23.877" Score="2" Body="&lt;p&gt;You need to read the fine print in the Cisco documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Maximum Limits—Indicates the maximum scale capability tested for the&#xA;  corresponding feature individually. This number is the absolute&#xA;  maximum currently supported by Cisco NX-OS Release 5.0(3)N1(1b)&#xA;  software for the corresponding feature. If the hardware is capable of&#xA;  a higher scale, future software releases may increase this maximum&#xA;  limit.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Just because you have the hardware capability to connect a lot of devices doesn't mean that the software will support it.  Based on the note above, the number that the software supports may vary per code release, and it may be lower than the number of physical connections you can make.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems pretty clear from the table that the number of FEX on a 5000 or a 5000 vPC pair is the same number:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7yLCY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7yLCY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-07T22:45:13.087" LastActivityDate="2015-09-07T22:45:13.087" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22277" PostTypeId="1" AcceptedAnswerId="22278" CreationDate="2015-09-07T23:02:27.077" Score="3" ViewCount="290" Body="&lt;p&gt;I have Cisco equipement with &quot;XENPAK-10GB-LRM&quot; and Optical Fiber Type OM3 wavelength 850 nm. As the LRM interface works at 1310 nm, will it work with this type of Fiber.&lt;/p&gt;&#xA;" OwnerUserId="18832" LastEditorUserId="36720" LastEditDate="2018-12-16T08:22:38.053" LastActivityDate="2018-12-16T08:22:38.053" Title="OM3 optical fiber 850 nm compatibility with 10GBASE-LRM" Tags="|cisco|layer1|cable|fiber|interface|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22278" PostTypeId="2" ParentId="22277" CreationDate="2015-09-07T23:06:20.710" Score="4" Body="&lt;p&gt;It only took a few seconds to find this: &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/catalyst-6500-series-supervisor-engine-720/product_data_sheet09186a008007cd00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/catalyst-6500-series-supervisor-engine-720/product_data_sheet09186a008007cd00.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cisco XENPAK-10GB-LRM: Supports link lengths 220m on standard&#xA;  FDDI-grade multimode fiber (MMF). To ensure that specifications are&#xA;  met over FDDI-grade, OM1 and OM2 fibers, the transmitter should be&#xA;  coupled through a mode conditioning patch cord. No mode conditioning&#xA;  patch cord is required for applications over OM3. For additional&#xA;  information on mode conditioning patch cord requirements please see:&#xA;  &lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/modules/ps5455/product_bulletin_c25-530836.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/prod/collateral/modules/ps5455/product_bulletin_c25-530836.html&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-07T23:06:20.710" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22280" PostTypeId="2" ParentId="22274" CreationDate="2015-09-08T00:13:44.647" Score="2" Body="&lt;p&gt;From the Cisco &lt;strong&gt;&lt;em&gt;NX-OS 5.1(3)N1(1)&lt;/em&gt;&lt;/strong&gt; release and later releases, each Cisco Nexus 5500 Series device can manage and support up to 24 FEXs without Layer 3. With Layer 3, the number of FEXs supported per Cisco Nexus 5500 Series device is 8. With Enhanced vPC and a dual-homed FEX topology each FEX is managed by both Cisco Nexus 5000 Series devices. As a result, one pair of Cisco Nexus 5500 Series devices can support up to 24 FEXs and 16 FEXs for Layer 2 and Layer 3.&lt;br&gt;&#xA;There are differences in scalability between the &lt;strong&gt;&lt;em&gt;straight-through topology&lt;/em&gt;&lt;/strong&gt;, the &lt;strong&gt;&lt;em&gt;dual-homed FEX topology&lt;/em&gt;&lt;/strong&gt;, and the &lt;strong&gt;&lt;em&gt;Enhanced vPC topology&lt;/em&gt;&lt;/strong&gt;. In the &lt;strong&gt;&lt;em&gt;straight through topology&lt;/em&gt;&lt;/strong&gt;, only one Cisco Nexus 5000 Series device manages each FEX and a pair of Cisco Nexus 5500 Series devices manage up to 48 FEXs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XxpUm.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XxpUm.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the total number of FEXs that are supported by a pair of Cisco Nexus 5000 Series devices is different between these two topologies, the FEX straight-through design with more than 24 FEXs per one pair of Cisco Nexus 5000 Series devices cannot migrate to Enhanced vPC topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configurations are as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•Total number of host vPC — With Enhanced vPC, each FEX port can be part of a host vPC. The host vPC does not consume port channel resources on the parent Cisco Nexus 5000 Series device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•Total number of ports per host vPC — The total number of ports that can be assigned to each host vPC differs with each FEX model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please may you check this link &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/nexus5000/sw/mkt_ops_guides/513_n1_1/n5k_enhanced_vpc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Using Enhanced vPC&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-08T00:13:44.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22282" PostTypeId="1" AcceptedAnswerId="22283" CreationDate="2015-09-08T07:56:08.617" Score="1" ViewCount="684" Body="&lt;p&gt;How exactly does a TURN relay work on TCP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say User A with a server reflexive address a1:a2 sends an allocate request to the TURN Server which then allocates t1:t2 and opens a connection between t1:t2 and a1:a2, how can User B connect to t1:t2 to relay data to user A?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I might have misunderstood how TURN works - any clarification would be helpful!&lt;/p&gt;&#xA;" OwnerUserId="18837" LastActivityDate="2015-09-08T08:41:21.270" Title="TURN relay with TCP" Tags="|tcp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22283" PostTypeId="2" ParentId="22282" CreationDate="2015-09-08T08:41:21.270" Score="0" Body="&lt;p&gt;In your example t1:t2 would be globally accessible (t1 IP address is a public one). So UserB would know where to send packets from the network layer. Also UserA can make a fixup for SIP signalling if it's capable to fetch bindings (a1:a2 -&gt; t1:t2 from TURN server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client may also set one of the external address/port destinations to be the active destination.&#xA;After the active destination has been set:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The TURN server forwards packets originating from the active address/port directly to the&#xA;client, without TURN packet encapsulation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the TURN server receives nonencapsulated packets from the client, the TURN server&#xA;forwards those messages to the active destination. ((C) Video and Voice conferencing fundamentals by Scott Firestone)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You may take a look here &lt;a href=&quot;http://blogs.technet.com/b/mspfe/archive/2012/04/17/understanding_2d00_nat_2d00_when_2d00_setting_2d00_up_2d00_lync_2d00_part_2d00_2_2d00_stun_2d00_and_2d00_turn_2d00_explained.aspx&quot; rel=&quot;nofollow&quot;&gt;http://blogs.technet.com/b/mspfe/archive/2012/04/17/understanding_2d00_nat_2d00_when_2d00_setting_2d00_up_2d00_lync_2d00_part_2d00_2_2d00_stun_2d00_and_2d00_turn_2d00_explained.aspx&lt;/a&gt; or here &lt;a href=&quot;https://profcollab.wordpress.com/2015/08/27/nat-and-firewall-traversal-for-sip-and-h-323/&quot; rel=&quot;nofollow&quot;&gt;https://profcollab.wordpress.com/2015/08/27/nat-and-firewall-traversal-for-sip-and-h-323/&lt;/a&gt; for some explanation.&#xA;Essentially TRURN server works as an address restricted NAT.&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2015-09-08T08:41:21.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22285" PostTypeId="1" CreationDate="2015-09-08T11:57:51.580" Score="1" ViewCount="51" Body="&lt;p&gt;I have the following scenario:&#xA;PC-A would like to send data to PC-B.&#xA;PC-A is contending for the wireless resource and so is PC-C. &#xA;At present, the medium is idle, hence, PC-A gets to use the air first, since it has a shorter back-off timer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:&#xA;Once PC-A finishes sending its data to PC-B, who will be able to use the wireless medium next? Is it PC-C or will it be PC-B with the ack frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If PC-C is to use the medium next, then, will PC-A re-transmit its data, since its initial frame was not acknowledged by PC-B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lyX9F.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lyX9F.jpg&quot; alt=&quot;DIAGRAM&quot;&gt;&lt;/a&gt;?&lt;/p&gt;&#xA;" OwnerUserId="6188" LastActivityDate="2015-10-08T16:48:05.643" Title="question on acknowledgements in wireless systems" Tags="|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22288" PostTypeId="1" CreationDate="2015-09-08T14:00:52.497" Score="2" ViewCount="2911" Body="&lt;p&gt;To have the RTP media range (10000-20000) flow to the server behind nat I needed to add the following route-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ip nat inside source static &amp;lt;pri&amp;gt; &amp;lt;pub&amp;gt; route-map voip-rtp extendable&#xA; route-map voip-rtp permit 1&#xA; match ip address 130&#xA; exit&#xA; access-list 130 permit udp &amp;lt;pub&amp;gt; &amp;lt;pri&amp;gt; any range 10000 65535&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This got the media packets flowing correctly however, once in a while the green box starts sending port forwarding request to other services (ie, 25, 80, 587...) to the wrong servers. Erasing and reconfiguring everything from scratch and it works fine again....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are my other port forwarding rules:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; do clear ip nat trans *&#xA; !&#xA; ip nat inside source list 1 interface Dialer0 overload&#xA; access-list 1 permit 192.168.2.0 0.0.0.255&#xA; !&#xA; no ip nat service sip udp port 5060&#xA; no ip nat service sip udp port 5080&#xA; !&#xA; ip nat inside source static tcp 192.168.2.5 53 interface Dialer0 53&#xA; ip nat inside source static udp 192.168.2.5 53 interface Dialer0 53&#xA; ip nat inside source static tcp 192.168.2.15 80 interface Dialer0 80&#xA; ip nat inside source static tcp 192.168.2.15 443 interface Dialer0 443&#xA; ip nat inside source static tcp 192.168.2.10 25 interface Dialer0 25&#xA; ip nat inside source static tcp 192.168.2.10 587 interface Dialer0 465&#xA; ip nat inside source static tcp 192.168.2.10 993 interface Dialer0 993&#xA; ip nat inside source static tcp 192.168.2.10 995 interface Dialer0 995&#xA; ip nat inside source static udp 192.168.2.5 5060 interface Dialer0 5060&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Without the route map, I never have any issues with the other static port forwarding rules. When I need to restart the router or network for maintenance, the router start sending SMTP and HTTP requests to the wrong server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question. Is there a better way to do this? Is there anything wrong with my script? Finally, will adding the static port forwarding rules to the same access-list 130 fix my issue? If so, how do I do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Cisco IOS 15.2 advententerprise, and thus the working port range route map. As unstable as it is. I am hoping something can be added or removed from the configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;write erase&#xA;reload&#xA;!&#xA;enable&#xA;!&#xA;conf t&#xA;!&#xA;ntp server 192.168.2.15&#xA;!&#xA;hostname voiper&#xA;ip domain-name test.com&#xA;service password-encryption&#xA;enable secret 0 &amp;lt;password&amp;gt;&#xA;line vty 0 4&#xA;transport input ssh&#xA;exit&#xA;line con 0&#xA;password &amp;lt;password&amp;gt;&#xA;exit&#xA;line aux 0&#xA;password &amp;lt;password&amp;gt;&#xA;exit&#xA;!&#xA;access-list 10 permit 192.168.2.100 log&#xA;line vty 0 4&#xA;access-class 10 in&#xA;exit&#xA;!&#xA;interface Dialer0&#xA;ip address negotiated&#xA;ip nat outside&#xA;ip mtu 1492&#xA;ip tcp adjust-mss 1452&#xA;ip flow ingress&#xA;ip route-cache policy&#xA;encapsulation ppp&#xA;ppp authentication pap callin&#xA;ppp pap sent-username &amp;lt;username&amp;gt; password 0 &amp;lt;password&amp;gt;&#xA;ppp ipcp dns request accept&#xA;ppp ipcp route default&#xA;ppp ipcp address accept&#xA;dialer pool 1&#xA;no cdp enable&#xA;no shut&#xA;exit&#xA;!&#xA;interface GigabitEthernet0/0&#xA;no ip address&#xA;pppoe enable&#xA;pppoe-client dial-pool-number 1&#xA;no cdp enable&#xA;no shut&#xA;no ip redirects&#xA;exit&#xA;!         &#xA;interface GigabitEthernet0/1&#xA;ip address 192.168.2.1 255.255.255.0&#xA;ip nat inside&#xA;no cdp enable&#xA;no ip redirects&#xA;no shut&#xA;exit&#xA;!&#xA;do clear ip nat trans *&#xA;!&#xA;!ip route 0.0.0.0 0.0.0.0 Dialer0&#xA;ip nat inside source list 1 interface Dialer0 overload&#xA;access-list 1 permit 192.168.2.0 0.0.0.255&#xA;!&#xA;no ip nat service sip udp port 5060&#xA;!&#xA;ip nat inside source static tcp 192.168.2.5 53 interface Dialer0 53&#xA;ip nat inside source static udp 192.168.2.5 53 interface Dialer0 53&#xA;ip nat inside source static tcp 192.168.2.15 80 interface Dialer0 80&#xA;ip nat inside source static tcp 192.168.2.15 443 interface Dialer0 443&#xA;ip nat inside source static tcp 192.168.2.10 25 interface Dialer0 25&#xA;ip nat inside source static tcp 192.168.2.10 465 interface Dialer0 465&#xA;ip nat inside source static tcp 192.168.2.10 993 interface Dialer0 993&#xA;ip nat inside source static tcp 192.168.2.10 995 interface Dialer0 995&#xA;ip nat inside source static udp 192.168.2.5 5060 interface Dialer0 5060&#xA;!&#xA;! access-list 130 permit udp any any range 8000 65535&#xA;! route-map voip-rtp permit 1&#xA;! match ip address 130&#xA;! exit&#xA;! ip nat inside source static 192.168.2.5 77.77.77.77 route-map voip-rtp&#xA;ip nat inside source static 192.168.2.5 77.77.77.77 route-map voip-rtp extendable&#xA;route-map voip-rtp permit 1&#xA;match ip address 130&#xA;exit&#xA;!access-list 130 permit udp any any range 8000 65535&#xA;! access-list 130 permit udp 77.77.77.77 192.168.2.5 any range 8000 65535&#xA;access-list 130 permit udp 77.77.77.77 192.168.2.5 any range 8000 65535&#xA;!&#xA;!&#xA;! QOS&#xA;class-map voice&#xA;match protocol rtp audio&#xA;exit&#xA;!&#xA;policy-map wan-qos&#xA;class voice&#xA;bandwidth percent 60&#xA;exit&#xA;exit&#xA;!&#xA;policy-map parent&#xA;class class-default&#xA;shape average 10000000&#xA;service-policy wan-qos&#xA;exit&#xA;exit&#xA;!&#xA;interface GigabitEthernet0/0&#xA;bandwidth 10000&#xA;service-policy output wan-qos&#xA;exit&#xA;!&#xA;!&#xA;! Securing Cisco&#xA;no service dhcp&#xA;no ip bootp server&#xA;no service finger&#xA;no ip http server&#xA;no ip http secure-server&#xA;no snmp-server&#xA;no service config&#xA;no ip gratuitous-arps &#xA;no ip source-route&#xA;ip options drop&#xA;!&#xA;service tcp-keepalives-in&#xA;service tcp-keepalives-out&#xA;service timestamps debug datetime msec show-timezone localtime&#xA;service timestamps log datetime msec show-timezone localtime &#xA;!         &#xA;! Block WAN ICMP Pings&#xA;access-list 101 deny icmp any any echo log&#xA;access-list 101 deny icmp any any redirect log&#xA;access-list 101 deny icmp any any timestamp-request log&#xA;access-list 101 deny icmp any any information-request log&#xA;access-list 101 deny icmp any any mask-request log&#xA;access-list 101 permit ip any any&#xA;&#xA;&#xA;int Dialer0&#xA;IP ACCESS-GROUP 101 IN&#xA;exit&#xA;&#xA;!DoS&#xA;&#xA;access-list 101 deny icmp any any echo log&#xA;access-list 101 deny icmp any any redirect log&#xA;access-list 101 deny icmp any any timestamp-request log&#xA;access-list 101 deny icmp any any information-request log&#xA;access-list 101 deny icmp any any mask-request log&#xA;access-list 101 permit ip any any&#xA;&#xA;do write mem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As mentioned. The config works! Then, if I have to restart the router or server, the router starts sending smtp, and http requests to 192.168.2.5, which if you look above is the suppose to go to 192.168.2.10 (smtp 25) and 192.168.2.15 (http 80) respectfully&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything I can do to stabalize the configuration? Anything in there that I don't need?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Critical Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I am defining static port forwarding, and as was mentioned the need to remove &lt;code&gt;ip nat inside source list 1 interface Dialer0 overload&lt;/code&gt;. Is it possible to define static default routes for traffic originating from inside the network to outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried removing&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ip route 0.0.0.0 0.0.0.0 Dialer0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And replacing with static default routes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ip route 0.0.0.0 0.0.0.0 Dialer0&#xA; access-list 1 permit 192.168.2.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The router can ping the outside world however no internet access from within the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in Advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nick.&lt;/p&gt;&#xA;" OwnerUserId="3706" LastEditorUserId="3706" LastEditDate="2015-09-09T21:10:45.273" LastActivityDate="2015-09-09T21:10:45.273" Title="Port Forwarding and Route Map Cisco" Tags="|cisco|nat|" AnswerCount="0" CommentCount="8" ClosedDate="2019-04-03T01:43:41.877" ContentLicense="CC BY-SA 3.0" />
  <row Id="22289" PostTypeId="1" CreationDate="2015-09-08T14:10:15.320" Score="2" ViewCount="1893" Body="&lt;p&gt;I am trying to create a load test with JMeter, and what I want to do is to limit the bandwidth to 200mbit/second. I have two options, which are &quot;Network Bandwidth Downlink&quot; and &quot;Network Bandwidth Uplink&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the difference between these, and which one is more suitable to change? &lt;/p&gt;&#xA;" OwnerUserId="18844" LastEditorUserId="8499" LastEditDate="2016-03-28T22:32:24.973" LastActivityDate="2016-10-27T03:34:07.883" Title="What is the difference between uplink and downlink (JMeter)?" Tags="|testing|load-balancer|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22290" PostTypeId="2" ParentId="22289" CreationDate="2015-09-08T14:18:50.037" Score="2" Body="&lt;p&gt;in terms of server and client communications .&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;based on stream or traffic&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;traffic going from the server to the clients called  downstream , and from clients to server called upstream .&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;based on device connections&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;client is up linked to server and server is down linked to clients   &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-08T14:18:50.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22292" PostTypeId="2" ParentId="22285" CreationDate="2015-09-08T14:38:33.903" Score="1" Body="&lt;p&gt;I hope this link can help you:&#xA;&lt;a href=&quot;https://www.tlm.unavarra.es/~daniel/docencia/arss/arss09_10/slides/31y32-CSMA-CA.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.tlm.unavarra.es/~daniel/docencia/arss/arss09_10/slides/31y32-CSMA-CA.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-08T14:38:33.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22293" PostTypeId="2" ParentId="22289" CreationDate="2015-09-08T15:19:22.280" Score="1" Body="&lt;p&gt;From your side:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upplink is the traffic that you send to your ISP, request, and all the another stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Downlink, by th other side, is traffic that you download, traffic from your ISP to you.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-08T15:19:22.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22300" PostTypeId="1" AcceptedAnswerId="22319" CreationDate="2015-09-08T17:34:05.550" Score="2" ViewCount="1838" Body="&lt;p&gt;Good Afternoon,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran into an issue this morning where static routes on a certain device weren't being redistributed into an EIGRP process configured on the same device. I'd originally thought this was because the &quot;default-metric&quot; command (or it's route-map subcommand equivalent) wasn't in place. The issue ended up being due to licensure level on the device. It was a 4500X licensed for IPBase, and therefore auto-configured &quot;eigrp stub connected summary&quot; when we turned up the EIGRP process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I fired up a GNS3 lab to check if redistribution from a static routing table into EIGRP needed the &quot;default-metric&quot; command, and routes redistributed just fine without it. From looking at different documents, they all say the default metric needs to be specified for redistribution from all routing processes spare another EIGRP or IGRP instance. Can anyone tell me why the routes are redistributed from static without a default-metric command, and what metrics are being used/why those metrics?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in Advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phillip&lt;/p&gt;&#xA;" OwnerUserId="18856" LastEditorUserId="18856" LastEditDate="2015-09-08T17:43:02.173" LastActivityDate="2015-09-09T06:45:45.980" Title="Why do static routes not need a &quot;default-metric&quot; set when redistributing into EIGRP?" Tags="|cisco|routing|eigrp|redistribution|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22302" PostTypeId="2" ParentId="22300" CreationDate="2015-09-08T18:24:59.293" Score="0" Body="&lt;p&gt;A static route does not have a metric unless is redistributed into s dynamic routing protocol in that case the assignement of a metric is dependent on the particular routing protocol.&lt;/p&gt;&#xA;" OwnerUserId="13605" LastActivityDate="2015-09-08T18:24:59.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22304" PostTypeId="1" AcceptedAnswerId="22309" CreationDate="2015-09-08T18:57:32.963" Score="3" ViewCount="6021" Body="&lt;p&gt;I have a server with three NICs running PfSense. The first NIC connects to my ISP, the second NIC connects to local computers in my office (LAN-1). For the third NIC(LAN-2), i have connected it to a computer and i want it to be able to connect to the second NIC(LAN-1) as well as the first(WAN).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;NIC 1 = gateway  = WAN&#xA;NIC 2 = LAN-1   = 172.30.0.3/16&#xA;NIC 3 = LAN-2   = 172.40.0.3/16&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Problem is that is that i can ping LAN-2(172.40.0.3)  from LAN-1(172.30.0.0/16)  but i cannot ping or trace anything from LAN-2 to LAN-1, or even to the internet. When i ping from LAN-2, there is no reply, not even a timeout.. it stays blank till i disconnect and it give an destination host unreachable message.&lt;/p&gt;&#xA;&lt;p&gt;The pfsense version is 2.2.3-RELEASE (amd64)&lt;/p&gt;&#xA;&lt;p&gt;Kindly help me out.&lt;/p&gt;&#xA;" OwnerDisplayName="user18859" LastEditorUserId="8499" LastEditDate="2021-05-01T00:31:42.063" LastActivityDate="2021-05-01T00:31:42.063" Title="Pfsense with WAN (NIC 1) and routing between two networks(NIC 2 and 3)" Tags="|router|ethernet|internet|pfsense|pfsense-2|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22306" PostTypeId="1" AcceptedAnswerId="22308" CreationDate="2015-09-08T19:49:01.637" Score="3" ViewCount="578" Body="&lt;p&gt;We have 2 buildings which are interconnected by 2 wireless P2P links. One is used as main connection, the second one is for redundancy and backup. So far, we have these 2 buildings in flat L2 network and each building A and B has 1 &amp;quot;core&amp;quot; switch where wireless APs are connected. These 2 APs are different vendor and different speed ( Mikrotik and Alcoma ). Simple diagram should explain it a bit better:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Key0g.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Key0g.png&quot; alt=&quot;diagram&quot; /&gt;&lt;/a&gt;&lt;br /&gt;&#xA;&lt;sub&gt;(source: &lt;a href=&quot;https://www.lucidchart.com/publicSegments/view/ed63e48d-a52d-4c59-bffd-643fee1a871a/image.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;lucidchart.com&lt;/a&gt;)&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;p&gt;We bundled those 2 links in PAgP because those wireless links are transparent for the switches and link between Catalyst 3560 and Catalyst 2960S is shown as 1000Mbit full duplex. &lt;a href=&quot;https://mikrotik.com/product/RBSXTG-5HPacD&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mikrotik&lt;/a&gt; is using 802.11ac, finding more info for Alcoma is somehow difficult, because it's old model and I couldn't find any info from manufacturer. All I know is that it works in 24GHz band.&lt;/p&gt;&#xA;&lt;p&gt;The question here is, should this even work? From what I know, PAgP and Etherchannel works over Ethernet links and those links must have the same speed and duplex settings. What are the outcomes of this little &amp;quot;cheat&amp;quot; using transparent bridges? We noticed, that from time to time bundle is broken on Mikrotik port ( Gi0/39 ) but after issuing shutdown/no shutdown, bundle is successfully created again. I am suspecting that some timers in PAgP are not met or the link is not as stable?&lt;/p&gt;&#xA;&lt;p&gt;Could this work without PAgP and manually setting up Etherchannel?&lt;/p&gt;&#xA;&lt;p&gt;Thanks for insight!&lt;/p&gt;&#xA;" OwnerUserId="16890" LastEditorUserId="31801" LastEditDate="2020-12-26T23:32:09.463" LastActivityDate="2020-12-26T23:32:09.463" Title="PAgP over transparent wireless point-to-point links" Tags="|cisco|wireless|bridge|etherchannel|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22307" PostTypeId="2" ParentId="21031" CreationDate="2015-09-08T19:51:47.420" Score="0" Body="&lt;p&gt;I found the answer through further discussion with my Colocation center. Apparently all traffic was routed to the Netgear router (.57), including the IPs in the /28 block.&lt;/p&gt;&#xA;" OwnerUserId="17627" LastActivityDate="2015-09-08T19:51:47.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22308" PostTypeId="2" ParentId="22306" CreationDate="2015-09-08T20:01:42.227" Score="3" Body="&lt;p&gt;Yes, this should work since the channel is switch-to-switch ethernet from the perspective of the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't actually need to negotiate the channel, why use a channel negotiation protocol?  That's just one more unnecessary complication.  With Cisco switches on each side of the channel, why not just use the &lt;code&gt;channel-group &amp;lt;num&amp;gt; mode on&lt;/code&gt; command.  You don't seem to need channel negotiation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the positive side, failover with channels is faster than even rapid spanning-tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the negative side, some of your traffic is traveling on the backup link, which may be sub-optimal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note: I'm not really a fan of trying to have a layer-2 domain across something like this.  There are very few things that require sharing a layer-2 domain; most things today can be layer-3 connected.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-08T20:01:42.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22309" PostTypeId="2" ParentId="22304" CreationDate="2015-09-08T20:10:09.280" Score="0" Body="&lt;p&gt;The firewall seems to consider your LAN-1 as Inside, and LAN-2 as Outside.  You need to fix the firewall rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While you are at it, double-check that the WAN connection is an Outside connection.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-08T20:10:09.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22310" PostTypeId="2" ParentId="22306" CreationDate="2015-09-08T20:44:24.143" Score="3" Body="&lt;p&gt;The big problem with this is out-of-order packets and statistically half your traffic flowing across a slower, more loss-prone link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can do L3 (ip) across both links, I would suggest &quot;CEF per-packet&quot; load balancing. But again, half the traffic would be crossing a slower link. (I'm not sure CEF uses link bandwidth.)  What you have is an &lt;em&gt;unequal cost&lt;/em&gt; multipath network.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-09-08T20:44:24.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22313" PostTypeId="1" CreationDate="2015-09-08T22:49:24.180" Score="0" ViewCount="597" Body="&lt;p&gt;I'm curious,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a small datacenter in which I'm deploying a very flat structure (like arista's network). I have two nexus 9k's and two fex's attached. If we are to grow larger I'd like to move into more of a Leaf-spine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using traditional vlan and VRF's to segment my &quot;production&quot; network from my &quot;dev&quot; network. I do not have a need as of yet for VXlan or NSX or an overlay. I'm having issues with clos network designs that don't jump right into overlay's. I'm assuming it's because the lack of layer 2? &lt;/p&gt;&#xA;" OwnerUserId="18867" LastEditorUserId="17452" LastEditDate="2015-09-10T19:27:51.123" LastActivityDate="2015-11-09T22:29:16.790" Title="Does clos (Leaf-spine) always mean overlay?" Tags="|cisco|design|switching|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22314" PostTypeId="1" AcceptedAnswerId="22316" CreationDate="2015-09-09T02:48:56.533" Score="2" ViewCount="736" Body="&lt;p&gt;I'm not a network guru. I have had this scenario a few times at a hackathon or small event for technical people. There are usually a group of 50-200 but with an average of anywhere up to 4 devices per person making it necessary to support anywhere up to 1000 devices over wifi. I usually have a few physical ports in the wall of an event space and a few home routers to play with. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The challenge is that there might only be a limited number of allocated ip addresses on the existing LAN usually in some sort of centralized set up, but usually not enough IP addresses for the number of devices being requested. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So finally my question: if the original network is on 192.168.1.0 can I set up a new network broadcast domain such as 172.16.0.0 etc using one of the routers and allocate enough ip numbers for devices. Essentially taking 1 IP allocated by the DHCP on the existing network and multiplying it into effectively 1000's of IP addresses in a new secondary private network space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gmhDV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gmhDV.png&quot; alt=&quot;Setting up a DHCP for a new broadcast domain on top of the existing domain&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Will this work?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Its possible that this scenario may work in certain circumstances but not others, or that it may work but with limited functionality, so for bonus points and to help understanding try breaking your answer down into these parts...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is it ever possible to create a second private IP address space on top of an existing private IP address space (the new broadcast domain is separated from the public internet by another private network)?&lt;/li&gt;&#xA;&lt;li&gt;Will devices on the second private network be able to access the public internet via the first existing network.&lt;/li&gt;&#xA;&lt;li&gt;If this does work in practice, are there any scenarios where this does not work (i.e. 2 daisy chained private networks work but not 3)?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17733" LastActivityDate="2019-01-25T05:55:09.830" Title="Add a router with dhcp to existing lan and create a secondary private network" Tags="|routing|router|dhcp|ip|lan|" AnswerCount="1" CommentCount="1" ClosedDate="2019-01-25T06:00:28.063" ContentLicense="CC BY-SA 3.0" />
  <row Id="22316" PostTypeId="2" ParentId="22314" CreationDate="2015-09-09T05:11:32.747" Score="1" Body="&lt;p&gt;Short answer: Yes it'll work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can daisy chain multiple networks together as long as the routers are aware of each others Routing tables. Sort of. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful though. Most of the routers you'll be working with have firewalls,nat, and so on. &#xA;I suggest that you turn all that off in the second router and let the first router do all the security and such.&lt;/p&gt;&#xA;" OwnerUserId="10329" LastActivityDate="2015-09-09T05:11:32.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22319" PostTypeId="2" ParentId="22300" CreationDate="2015-09-09T06:45:45.980" Score="1" Body="&lt;p&gt;When one routing protocol is being redistributed into another, the router doesn't have a way to translate the routing metric from one routing protocol into another. Statics also fall in this category.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a couple of ways to redistribute statics:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) &lt;code&gt;network&lt;/code&gt; command&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/16406-eigrp-toc.html#statictointerface&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/16406-eigrp-toc.html#statictointerface&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) &lt;code&gt;redistribulte static&lt;/code&gt; where you'd need a rule to calculate a metric &lt;code&gt;default-metric&lt;/code&gt; which sets the default metric for redistributing other protocols into EIGRP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be that in your GNS3 lab you used 1st method.&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2015-09-09T06:45:45.980" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22320" PostTypeId="2" ParentId="16558" CreationDate="2015-09-09T07:47:26.687" Score="2" Body="&lt;p&gt;i experienced same problem in site with 40 AP are installed and controlled by wireless controller . they take photos in any place in the site and upload it on FTP server automatically ,some places are working good and other upload in big time . i used very useful android application called &lt;strong&gt;&lt;em&gt;WiFi Speed Test&lt;/em&gt;&lt;/strong&gt; which is simulating upload and download files between your phone and other remote PC and show you the upload and download speed of this file Transfer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sjnFi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sjnFi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;regarding the problem of those APs it was the AP output power , which need to be adjusted on the controller it self&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you want to plot the shape of packet loss percentage you can use the great application &lt;strong&gt;&lt;em&gt;ping plotter&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OaFHg.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OaFHg.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-09T08:47:16.327" LastActivityDate="2015-09-09T08:47:16.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22321" PostTypeId="1" CreationDate="2015-09-09T08:02:22.250" Score="0" ViewCount="498" Body="&lt;p&gt;We have a small office network with 50 workstations/laptops with 10 Mbits/sec Leased line. My Network goes down intermittently until I unplug the Firewall or Switch cable. However I am able to ping the firewall and switch ports from outside. What could be the reason for this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have observed a trend. At a particular time(around 9 PM) when a group of 7 to 8 users download movies or stream videos (you tube) concurrently through the wireless router the network goes for a toss and never comes back until we unplug the Firewall or Switch cable. Is this related to data anyway?   &lt;/p&gt;&#xA;" OwnerUserId="18874" LastEditorUserId="18874" LastEditDate="2015-09-10T07:05:46.303" LastActivityDate="2016-09-12T08:14:37.820" Title="Network goes down intermittently until I unplug the Firewall or Switch cable" Tags="|switch|router|firewall|network-access|" AnswerCount="4" CommentCount="3" ClosedDate="2019-02-25T00:15:56.733" ContentLicense="CC BY-SA 3.0" />
  <row Id="22322" PostTypeId="2" ParentId="22321" CreationDate="2015-09-09T08:22:21.663" Score="2" Body="&lt;p&gt;50% of network performance drop as i experienced is due to &lt;strong&gt;&lt;em&gt;LOOP&lt;/em&gt;&lt;/strong&gt; , check for a physical loop or if you use Cisco switches check spanning-tree . &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-09T09:04:06.170" LastActivityDate="2015-09-09T09:04:06.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22325" PostTypeId="1" CreationDate="2015-09-09T09:27:13.820" Score="7" ViewCount="3201" Body="&lt;p&gt;I want to create ssh tunnels between 2 clients and 1 server. Can I use the same port numbers for both but binding one of them to 127.0.0.1:N and the other to 127.0.0.2:N ? Are these ports same or can I use them separately ? &lt;/p&gt;&#xA;" OwnerUserId="18816" LastActivityDate="2016-02-07T21:25:45.220" Title="Is the Nth ports on 127.0.0.1 and 127.0.0.2 same ?" Tags="|linux|ssh|tunnel|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22326" PostTypeId="1" AcceptedAnswerId="22774" CreationDate="2015-09-09T09:28:17.000" Score="2" ViewCount="2838" Body="&lt;p&gt;First at all:&lt;br&gt; I am new to BGP and the Bird internet routing daemon. &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Situation: &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP1 - R1 - SW1 - R3&#xA;             |&#xA;ISP2 - R2 - SW2 - R4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have an eBGP instance for R1 and ISP1 and the same between R2 and ISP2.&#xA;And also I have an iBGP Instance for R1 and R2 on both Routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Heres my sample config from R1 for iBGP:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;protocol bgp bgp1 {&#xA;        local as 200000;                &#xA;        neighbor 10.0.0.2 as 200000; &#xA;        multihop 1;                     &#xA;        keepalive time 5;                            &#xA;        source address 10.0.0.1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And heres my sample config from R2 for iBGP: &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;protocol bgp bgp1 {&#xA;        local as 200000;                &#xA;        neighbor 10.0.0.1 as 200000; &#xA;        multihop 1;                     &#xA;        keepalive time 5;                            &#xA;        source address 10.0.0.2;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Furthermore I have a keepalived cluster between R1 and R2 wich is the &lt;br&gt;default-gateway for R3 and R4. &lt;br&gt;&#xA;Now, what if the link from R1 to ISP1 goes down? The Cluster wont change and  &lt;br&gt; I don't have any connection to the internet.&lt;br&gt; &lt;br&gt;&#xA;I want to let the traffic flow even if this happens.My idea was to let &lt;br&gt;&#xA;R1 send the whole traffic to R2 so that R2 sends it to the Internet. &lt;br&gt;&#xA;My questions now are: &lt;br&gt;&#xA;1) What is the best way to do this with Bird and iBGP?&lt;br&gt;&#xA;2) Are there other and even better mechanisms? &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="14081" LastActivityDate="2018-04-17T12:08:41.357" Title="bird internet routing daemon iBGP" Tags="|routing|bgp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22327" PostTypeId="2" ParentId="356" CreationDate="2015-09-09T09:46:07.263" Score="0" Body="&lt;p&gt;if you want to do a &quot;deep&quot; filtering you can have a look at the team cymru templates and bogons project:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.team-cymru.org/ipv6-router-reference.html&quot; rel=&quot;nofollow&quot;&gt;http://www.team-cymru.org/ipv6-router-reference.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1969" LastActivityDate="2015-09-09T09:46:07.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22328" PostTypeId="2" ParentId="22326" CreationDate="2015-09-09T09:55:58.600" Score="0" Body="&lt;p&gt;You can try to propagate the default route via OSPF - or - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you send via iBGP to the second router all the routes advertised by the ISP, the packets will use the other router to route internet traffic in case the link on the primary router fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 routing table, with ISP1 up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;0.0.0.0/0 via ISP1 metric 100&#xA;0.0.0.0/0 via R2 metric 200&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2 routing table, with ISP2 up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;0.0.0.0/0 via ISP2 metric 100&#xA;0.0.0.0/0 via R1 metric 200&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in case of ISP1 failure, R1 routing table will be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;0.0.0.0/0 via R2 metric 200&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so the packets will be routed to R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;remember to establish iBGP peering on a loopback address and set next-hop-self.&lt;/p&gt;&#xA;" OwnerUserId="1969" LastActivityDate="2015-09-09T09:55:58.600" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22329" PostTypeId="2" ParentId="22325" CreationDate="2015-09-09T10:06:09.833" Score="0" Body="&lt;p&gt;if you bind to port+ip you can use them separately.&lt;/p&gt;&#xA;" OwnerUserId="1969" LastActivityDate="2015-09-09T10:06:09.833" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22330" PostTypeId="2" ParentId="22313" CreationDate="2015-09-09T11:02:51.833" Score="2" Body="&lt;p&gt;CLOS networks simply describe the underlying L1 topology - mainly with regards to interface over-subscription and leaf interconnection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you run on top of it (VLAN/VXLAN/IP Fabric) is really up to the implementation and the problem you are trying to solve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the network you are describing (number of switches), it sounds like a simple Fat-Tree topology would suit better&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-09-09T11:02:51.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22331" PostTypeId="2" ParentId="22321" CreationDate="2015-09-09T12:00:36.050" Score="1" Body="&lt;p&gt;Your question is VERY broad, nearly unanswerable. You need to begin by getting some metrics so you can figure out what's going on. Start by buying a solid, commercial grade switch so you can see metrics/usage/errors, etc information. You could have a loop (as suggested in the other answer), a broadcast storm, bad cables, wonky router, nearly anything...&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2015-09-09T12:00:36.050" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22333" PostTypeId="2" ParentId="22304" CreationDate="2015-09-09T12:12:20.467" Score="1" Body="&lt;p&gt;By default pfSense doesn't add any rules for the Interfaces other than WAN and LAN, so LAN-2 which is probably (at least originally) OPT1 in pfsense doesn't have any rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go to Rules and select the interface and add an appropriate rule (ICMP to allow ping to work and and other rules that are necessary for the PC on that interface.&lt;/p&gt;&#xA;" OwnerUserId="1404" LastActivityDate="2015-09-09T12:12:20.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22335" PostTypeId="1" AcceptedAnswerId="22336" CreationDate="2015-09-09T13:10:47.790" Score="0" ViewCount="2165" Body="&lt;p&gt;The &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791&lt;/a&gt; says :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The internet protocol does not provide a reliable communication&#xA;facility.  There are no acknowledgments either end-to-end or&#xA;hop-by-hop.  There is no error control for data, only a header&#xA;checksum.  There are no retransmissions.  There is no flow control.&#xA;Errors detected may be reported via the Internet Control Message&#xA;Protocol (ICMP) [3] which is implemented in the internet protocol&#xA;module.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;My questions :&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;give an example when the header checksum is set to 1&lt;/li&gt;&#xA;&lt;li&gt;'Errors &lt;strong&gt;may be&lt;/strong&gt; reported' what does that mean ? How it decides which errors it should report and which not ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Thank you in advance! Note that I am not a college student so if you throw some weird words please explain what they mean.&lt;/p&gt;&#xA;" OwnerUserId="18863" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2018-12-27T01:01:13.000" Title="Internet Protocol error checking" Tags="|ip|protocol-theory|rfc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22336" PostTypeId="2" ParentId="22335" CreationDate="2015-09-09T14:31:36.977" Score="2" Body="&lt;p&gt;AS for point 1. well, maybe you could craft a IP header which check sum result would be 1, looking at the algorithm used (which is described in the RFC you linked), but if you expect somebody to do it for you, good luck...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding point 2. you have to look at &lt;a href=&quot;https://www.ietf.org/rfc/rfc2119.txt&quot; rel=&quot;nofollow&quot;&gt;RFC2119&lt;/a&gt; where it is said :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;5&quot;&gt;&#xA;  &lt;li&gt;MAY   This word, or the adjective &quot;OPTIONAL&quot;, mean that an item is&#xA;  truly optional.  One vendor may choose to include the item because a&#xA;  particular marketplace requires it or because the vendor feels that&#xA;  it enhances the product while another vendor may omit the same item.&#xA;  An implementation which does not include a particular option MUST be&#xA;  prepared to interoperate with another implementation which does&#xA;  include the option, though perhaps with reduced functionality. In the&#xA;  same vein an implementation which does include a particular option&#xA;  MUST be prepared to interoperate with another implementation which&#xA;  does not include the option (except, of course, for the feature the&#xA;  option provides.)&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it is up to the person that implement its version of an IP stack to decide which errors are reported or not. I have no idea if someone ever wrote an IPv4 stack with checksum error reporting trough ICMP but I doubt it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is that if a checksum is bad, the packet should be dropped, and that's all. Re-transmission will be managed by upper layer if needed (generally by TCP).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-09-09T14:31:36.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22338" PostTypeId="1" CreationDate="2015-09-09T14:48:27.760" Score="1" ViewCount="12002" Body="&lt;p&gt;I'm having trouble with what should be a simple config setting up a 10GigE SFP on an ASR-1000-x. A fiber patch is connected to the SFP sitting in the TE0 port of the device. The interface reports being up, and lower level probing of the subsystems show that the photons are flowing (i think):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router-asr1001-r0101-a#sh hw-module subslot 0/0 transceiver 0 status &#xA;The Transceiver in slot 0 subslot 0 port 0 is enabled.&#xA;  Module temperature                        = +37.039 C&#xA;  Transceiver Tx supply voltage            = 3261.4 mVolts&#xA;  Transceiver Tx bias current              = 36000 uAmps&#xA;  Transceiver Tx power                      = -4.7 dBm&#xA;  Transceiver Rx optical power              = -3.9 dBm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this is the SFP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router-asr1001-r0101-a#sh hw-module subslot 0/0 transceiver 0 idprom &#xA;IDPROM for transceiver TenGigabitEthernet0/0/0:&#xA;  Description                              =  optics (type 130)&#xA;  Transceiver Type:                        = SFP+ 10GBASE-LR (274)&#xA;  Product Identifier (PID)                  = SFP-10G-LR          &#xA;  Vendor Revision                          = B &#xA;  Serial Number (SN)                        = FNS17031564    &#xA;  Vendor Name                              = CISCO-FINISAR  &#xA;  Vendor OUI (IEEE company ID)              = 00.0B.40 (2880)&#xA;  CLEI code                                = COUIA75CAA&#xA;  Cisco part number                        = 10-2457-03&#xA;  Device State                              = Enabled.&#xA;  Date code (yy/mm/dd)                      = 15/08/11&#xA;  Connector type                            = .&#xA;  Nominal bitrate                          =  (0 Mbits/s)&#xA;  Minimum bit rate as % of nominal bit rate = not specified&#xA;  Maximum bit rate as % of nominal bit rate = not specified&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally the interface at the upper level reports:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router-asr1001-r0101-a#show int tengig 0/0/0&#xA;TenGigabitEthernet0/0/0 is up, line protocol is up &#xA;  Hardware is BUILT-IN-2T+6X1GE, address is 188b.9d1f.f400 (bia 188b.9d1f.f400)&#xA;  Description: Link to XO&#xA;  Internet address is 200.1.95.02/30&#xA;  MTU 1500 bytes, BW 10000000 Kbit/sec, DLY 10 usec, &#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not supported &#xA;  Full Duplex, 10000Mbps, link type is force-up, media type is SFP-LR&#xA;  output flow-control is on, input flow-control is on&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output 00:06:11, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 4d01h&#xA;  Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;     Received 0 broadcasts (0 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles &#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 packets output, 0 bytes, 0 underruns&#xA;     156 output errors, 0 collisions, 3 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The handoff has been confirmed to be 10GigE by the carrier. And they confirm that they are up and see us go down when we disconnect the fiber patch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to ping the remote end (200.1.95.1) does not work. I suspect two things here - the output errors, and the link-type being &quot;forced up&quot;. I also suspect this is something simple that I've overlooked in the basic setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody have any experiencing troubleshooting this kind of setup?&lt;/p&gt;&#xA;" OwnerUserId="18883" LastActivityDate="2019-02-14T15:12:13.880" Title="Setting up Cisco TenGig ethernet SFP on ASR 1001-x" Tags="|sfp|10gbase|cisco-asr|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="22342" PostTypeId="2" ParentId="22338" CreationDate="2015-09-09T17:22:10.393" Score="1" Body="&lt;p&gt;Transceiver Rx optical power = -3.9 dBm, looks to be within acceptable parameters. &quot;show int te0/0/0 transceiver detail&quot; will confirm if DOM is supported on the chassis. Transceiver is a SFP+ so it supports DOM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you doing a long haul back to XO's location or did XO bring in something a Cisco ONS 15454 on premise to drop off a local 10g interface to you? If so then they probably used an SR on their side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Need to confirm if XO is using an LR model on their end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see the link type forced-up and also see that flowcontrol for both in &amp;amp; out are on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you hard coding everything on the port config or allowing to auto neg with the XO end? Need to find out if XO is hardcoding their end. If hard coded on your end and not theirs I would set duplex, speed to auto and turn off flow control and see if the link starts passing traffic. I doubt XO has changed default flowcontrols, speed, duplex settings on their end from the install techs I know at XO. Never know though, anything is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also as Ron mentioned. Transceivers and fiber all need to match and be correct first and foremost.&lt;/p&gt;&#xA;" OwnerUserId="16758" LastActivityDate="2015-09-09T17:22:10.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22343" PostTypeId="1" CreationDate="2015-09-09T17:42:28.113" Score="0" ViewCount="1051" Body="&lt;p&gt;I am trying to find out how browsec works. In my college, youtube is banned. When I type youtube.com in my url, the packets carrying the url travels to the proxy server. The proxy server here blocks the packet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;system -----------&amp;gt; proxy server ------------&amp;gt; youtube&#xA;                       ||&#xA;             the packet is dropped here&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now I want to use browsec. So, again I try to connect youtube.com. When I type url the packet should again travel to the proxy server and should be dropped there.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;system -----------&amp;gt; proxy server ----------&amp;gt; browsec ------------&amp;gt; youtube&#xA;                       ||&#xA;             the packet should be dropped here, but doesn't happen. Why?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what I think that packets are dropped at proxy server of my college in both cases. So, how does it work? Is there any type of encryption / decryption?&lt;/p&gt;&#xA;" OwnerUserId="17439" LastEditorUserId="17439" LastEditDate="2015-09-09T18:31:43.070" LastActivityDate="2015-09-09T21:24:46.070" Title="How browsec works?" Tags="|vpn|proxy|" AnswerCount="1" CommentCount="6" ClosedDate="2015-09-09T22:32:08.893" ContentLicense="CC BY-SA 3.0" />
  <row Id="22345" PostTypeId="1" AcceptedAnswerId="22350" CreationDate="2015-09-09T17:47:20.673" Score="0" ViewCount="1772" Body="&lt;p&gt;We have several issues with disconnects, freezing, web session resets, and other goofy things with applications that access resources over the internet. My biggest problem has been outlook using RCP over HTTPS (MS Outlook). I expect this because our internet connection is over loaded. Here is the kicker, the problem with Outlook happens even when bandwidth usage is low.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was helping with troubleshooting another issue and happened to notice Flow-Control is disabled on the Ethernet ports for the switch (I know it is default, I just never really thought about it). Well most computers have it enabled by default. Just because I hadn't tried it before, I disabled Ethernet Flow-Control on my computer and now Outlook and my other internet accessible apps are working appropriately (no disconnects, resets, or session loss).  I don’t want to test this change in other areas without having a little more information, so I have a couple of questions. Is this a fluke, if not why would this happen and does it mean that I need to increase my buffers? Anything else I may be missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have ran perfmon in Windows 7 looking at the NIC and Packet Outbound and receive errors are generally pretty low if at all. &lt;/p&gt;&#xA;" OwnerUserId="14227" LastActivityDate="2015-09-09T21:21:29.353" Title="Disabling Ethernet Flow-Control at the Endpoint" Tags="|ethernet|tcp|protocol-theory|transport-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22346" PostTypeId="1" CreationDate="2015-09-09T19:29:46.797" Score="1" ViewCount="264" Body="&lt;p&gt;I have a laptop (pc1) that is connected to a network governed by 802.11x. I want to route traffic from my other pc (pc2) through pc1 so the network will think that the traffic is from pc1 even though it is from pc2.&#xA;Both pcs run windows 7 and I have a tp link router at my disposal.&lt;/p&gt;&#xA;" OwnerUserId="18892" LastActivityDate="2015-09-09T20:05:33.663" Title="Is it possible to route all traffic from multiple devices through one computer that is attached to a network governed by 802.11x?" Tags="|routing|ieee-802.11|" AnswerCount="1" CommentCount="2" ClosedDate="2015-09-09T20:08:22.147" ContentLicense="CC BY-SA 3.0" />
  <row Id="22347" PostTypeId="2" ParentId="16558" CreationDate="2015-09-09T19:35:39.083" Score="1" Body="&lt;p&gt;Since you want to measure packet loss from a client, I suggest to run &lt;code&gt;ping IP_address -i 0.001 -M do -n -s 1472&lt;/code&gt; and try to stress the link as much as possible.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;code&gt;-i&lt;/code&gt; option drastically shortens the interval.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;-M do&lt;/code&gt; option sets the Don't Fragment bit which is a must for testing the MTU.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;-n&lt;/code&gt; option disables DNS resolution which is unnecessary for testing packet loss.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;-s&lt;/code&gt; option sets the packet size.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If a message containing &lt;code&gt;Frag needed and DF set&lt;/code&gt; is printed, then either the MTU is less than 1500 bytes or there actually is packet loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because &lt;code&gt;ping -i 0.001&lt;/code&gt; prints many lines, it comes in handy to use the &lt;code&gt;-q&lt;/code&gt; option as well. So you'll get a summary when ping is stopped. Alternatively, you can use the &lt;code&gt;-c&lt;/code&gt; option to limit the number of packets sent by ping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By stressing the link, I mean that you should try to creates as much throughput as possible by using other tools than ping. This increases the round-trip time and allows you to test the network as if everyone in the office is working. Even the fastest ping test does not show performance issues. There could be a switch or a router which cannot handle a certain load and consequenly could cause an inacceptable latency or even packet loss.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2015-09-09T19:35:39.083" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22348" PostTypeId="2" ParentId="22346" CreationDate="2015-09-09T20:05:33.663" Score="1" Body="&lt;p&gt;two solution could be resolve this problem  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;if your PCs have wireless NIC connection may you create add hock connection in pc1 and make pc2 join it   so that pc2 can talk to network through pc1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;if you have in pc1 NIC with 2 ports or may you install other NIC if not, may you use one of them to establish communication between two PCs and the other to be connected to network  so that pc2 can talk to network through pc1 &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-09T20:05:33.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22349" PostTypeId="1" AcceptedAnswerId="22352" CreationDate="2015-09-09T20:52:11.547" Score="1" ViewCount="2073" Body="&lt;p&gt;Switch 2 needs to route it's NTP requests through a specific vlan that is setup on a routing-instance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current NTP setup on switch 2 is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set system ntp server 10.0.0.21&#xA;set system ntp source-address 10.0.6.15 routing-instance MGMT-6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Routing-instance is setup as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-instances MGMT-6 description &quot;Policy for MGMT network routing&quot;&#xA;set routing-instances MGMT-6 instance-type virtual-router&#xA;set routing-instances MGMT-6 interface vlan.6&#xA;set routing-instances MGMT-6 routing-options static route 10.0.0.0/23 next-hop 10.0.6.1&#xA;set routing-instances MGMT-6 routing-options static route 10.0.6.0/24 next-hop 10.0.6.1&#xA;set routing-instances MGMT-6 routing-options static route 10.100.4.0/23 next-hop 10.0.6.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XSbb5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XSbb5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen different suggestions, including &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set forwarding-options helpers port 123 server 127.0.0.1&#xA;set forwarding-options helpers port 123 server routing-instance MGMT-6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it has no effect. Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="8713" LastEditorUserId="8713" LastEditDate="2015-09-10T13:15:52.843" LastActivityDate="2015-09-10T13:35:58.683" Title="Route NTP traffic through Routing-Instance" Tags="|routing|juniper-ex|ntp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22350" PostTypeId="2" ParentId="22345" CreationDate="2015-09-09T21:21:29.353" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is this a fluke?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Probably.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;does it mean that I need to increase my buffers?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You disabled flow-control, so this would've made the problem &lt;em&gt;worse&lt;/em&gt; if it were a buffer overflow issue. Error counters should tell you if there were any issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flow Control is a negotiated function. If the switch has it &quot;off&quot; (send &lt;em&gt;and&lt;/em&gt; receive), then the connected devices should disable it as well. Of course, this assumes your nics, drivers, and switches are braindamaged.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-09-09T21:21:29.353" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22351" PostTypeId="2" ParentId="22343" CreationDate="2015-09-09T21:24:46.070" Score="1" Body="&lt;p&gt;It works because you aren't asking to &lt;em&gt;youtube&lt;/em&gt; from the proxy; you're requesting some other site, that then sends you to youtube. (aka a &quot;VPN&quot;, or &quot;tunnel&quot;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-09-09T21:24:46.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22352" PostTypeId="2" ParentId="22349" CreationDate="2015-09-09T22:35:44.567" Score="2" Body="&lt;p&gt;If I am not mistaken, you have a misconfiguration in one of your static routes with the next-hop clause. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where you configuration shows this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-instances MGMT-6 routing-options static route 10.0.0.0/23 next-hop 10.0.6.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It should instead read this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-instances MGMT-6 routing-options static route 10.0.0.0/23 next-hop 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; been a while since I worked on a Juniper device, so now having doubts. We may need to see more of the configuration to know exactly which changes are required to allow this.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-09-09T23:01:01.673" LastActivityDate="2015-09-09T23:01:01.673" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22353" PostTypeId="1" CreationDate="2015-09-09T22:51:31.457" Score="3" ViewCount="4336" Body="&lt;p&gt;this &lt;code&gt;tcpdump&lt;/code&gt; output is the result of sending a single ping package from host 1 to host 2 through a simple hub connection:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@mininet-vm:~# tcpdump -XX -n -i h2-eth0 &#xA;tcpdump: verbose output suppressed, use -v or -vv for full protocol decode&#xA;listening on h2-eth0, link-type EN10MB (Ethernet), capture size 65535 bytes&#xA;00:19:06.466207 ARP, Request who-has 10.0.0.2 tell 10.0.0.1, length 28&#xA;        0x0000:  ffff ffff ffff 0000 0000 0001 0806 0001  ................&#xA;        0x0010:  0800 0604 0001 0000 0000 0001 0a00 0001  ................&#xA;        0x0020:  0000 0000 0000 0a00 0002                 ..........&#xA;00:19:06.466285 ARP, Reply 10.0.0.2 is-at 00:00:00:00:00:02, length 28&#xA;        0x0000:  0000 0000 0001 0000 0000 0002 0806 0001  ................&#xA;        0x0010:  0800 0604 0002 0000 0000 0002 0a00 0002  ................&#xA;        0x0020:  0000 0000 0001 0a00 0001                 ..........&#xA;00:19:06.468925 IP 10.0.0.1 &amp;gt; 10.0.0.2: ICMP echo request, id 4587, seq 1, length 64&#xA;        0x0000:  0000 0000 0002 0000 0000 0001 0800 4500  ..............E.&#xA;        0x0010:  0054 ac58 4000 4001 7a4e 0a00 0001 0a00  .T.X@.@.zN......&#xA;        0x0020:  0002 0800 7d50 11eb 0001 ea2e f155 0000  ....}P.......U..&#xA;        0x0030:  0000 c86b 0600 0000 0000 1011 1213 1415  ...k............&#xA;        0x0040:  1617 1819 1a1b 1c1d 1e1f 2021 2223 2425  ...........!&quot;#$%&#xA;        0x0050:  2627 2829 2a2b 2c2d 2e2f 3031 3233 3435  &amp;amp;'()*+,-./012345&#xA;        0x0060:  3637                                     67&#xA;00:19:06.468961 IP 10.0.0.2 &amp;gt; 10.0.0.1: ICMP echo reply, id 4587, seq 1, length 64&#xA;        0x0000:  0000 0000 0001 0000 0000 0002 0800 4500  ..............E.&#xA;        0x0010:  0054 d17f 0000 4001 9527 0a00 0002 0a00  .T....@..'......&#xA;        0x0020:  0001 0000 8550 11eb 0001 ea2e f155 0000  .....P.......U..&#xA;        0x0030:  0000 c86b 0600 0000 0000 1011 1213 1415  ...k............&#xA;        0x0040:  1617 1819 1a1b 1c1d 1e1f 2021 2223 2425  ...........!&quot;#$%&#xA;        0x0050:  2627 2829 2a2b 2c2d 2e2f 3031 3233 3435  &amp;amp;'()*+,-./012345&#xA;        0x0060:  3637                                     67&#xA;00:19:11.471904 ARP, Request who-has 10.0.0.1 tell 10.0.0.2, length 28&#xA;        0x0000:  0000 0000 0001 0000 0000 0002 0806 0001  ................&#xA;        0x0010:  0800 0604 0001 0000 0000 0002 0a00 0002  ................&#xA;        0x0020:  0000 0000 0000 0a00 0001                 ..........&#xA;00:19:11.509755 ARP, Reply 10.0.0.1 is-at 00:00:00:00:00:01, length 28&#xA;        0x0000:  0000 0000 0002 0000 0000 0001 0806 0001  ................&#xA;        0x0010:  0800 0604 0002 0000 0000 0001 0a00 0001  ................&#xA;        0x0020:  0000 0000 0002 0a00 0002                 ..........&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am a little puzzled about the order of the output.&lt;br&gt;&#xA;I would have assumed the order&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ARP-request host 1 to host 2&#xA;ARP-reply host 2 to host 1&#xA;ICMP echo request host 1 to host 2&#xA;ARP-request host 2 to host 1&#xA;ARP-reply host 1 to host 2&#xA;ICMP echo reply host 2 to host 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but &lt;code&gt;tcpdump&lt;/code&gt; shows the order&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ARP-request host 1 to host 2&#xA;ARP-reply host 2 to host 1&#xA;ICMP echo request host 1 to host 2&#xA;ICMP echo reply host 2 to host 1&#xA;ARP-request host 2 to host 1&#xA;ARP-reply host 1 to host 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which I don't understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My assumption here is, that before echo-replying through ICMP, host 2 has to request host 1's MAC address by using ARP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I getting wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is &lt;code&gt;tcpdump&lt;/code&gt; simply changing the order in its ouput format, so that ICMP-request and reply are not far apart in &lt;code&gt;tcpdump&lt;/code&gt;'s output? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA;All hosts and the network hub are running Ubuntu 14.04 with kernel 3.13.0-24-generic ( to be more precise: I am running a VM inside which I am running mininet with a hub-star-topology).&lt;/p&gt;&#xA;" OwnerUserId="17712" LastEditorUserId="17712" LastEditDate="2015-09-10T06:58:00.697" LastActivityDate="2015-09-10T06:58:00.697" Title="How to interpret this `tcpdump` output" Tags="|arp|tcpdump|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22354" PostTypeId="1" AcceptedAnswerId="22356" CreationDate="2015-09-09T23:30:51.683" Score="4" ViewCount="2242" Body="&lt;p&gt;I have a strong background in OSPF and am now learning EIGRP so everything I read gets compared to my existing knowledge of OSPF. Because of this, I don't see the purpose of EIGRP stubs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In OSPF, you make an area stub so that it does not receive type 5 or 4 LSAs thus reducing the size of the LSDB and saving memory resources. You can make it a stub no-summary so that it doesn't receive type 3, 4 or 5 LSAs further reducing memory resources. This is a logical configuration because stub areas have only one entry point to the backbone network therefore it makes no sense for a stub candidate to learn hundreds of routes all to the same next hop of the ABR when you could simply make it a stub so that it only learns a default route and its intra-area routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP is different from this. In EIGRP, stubs aren't about limiting what routes you &lt;em&gt;learn&lt;/em&gt; but rather what routes you &lt;em&gt;advertise&lt;/em&gt;. I don't see the correlation between having a single entry point to the rest of the network (AKA a stub router) and limiting outbound route advertisements. Stub routers still need to advertise their routes out to the rest of the network - how does having a single entry point into the backbone EIGRP network make them eligible to not advertise their routes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What benefit does EIGRP stub routing provide if any?&lt;/p&gt;&#xA;" OwnerUserId="889" LastEditorUserId="509" LastEditDate="2015-12-06T11:13:47.143" LastActivityDate="2015-12-06T11:13:47.143" Title="What is the purpose of EIGRP stubs?" Tags="|routing|subnet|ospf|eigrp|stub|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22355" PostTypeId="1" AcceptedAnswerId="22358" CreationDate="2015-09-09T23:37:17.510" Score="0" ViewCount="94" Body="&lt;p&gt;I've been playing around with Packet Tracer setting up DHCP on a router, in which I have no issues. But being curious has me stump now. I have a LAN consisting of two clients a server and a switch. Can I configure DHCP using the server without any router present in my network topology? Can I use a default gateway other than 0.0.0.0 if I'm not using a router? Is there any scenario where a router is need if DHCP is being ran off a server in the topology discussed above. &lt;/p&gt;&#xA;" OwnerUserId="17715" LastActivityDate="2015-09-10T01:45:16.127" Title="Setting up DHCP" Tags="|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22356" PostTypeId="2" ParentId="22354" CreationDate="2015-09-10T01:22:33.520" Score="5" Body="&lt;p&gt;There are philosophical differences in the design of OSPF and EIGRP and they are reflected in the protocol operation.  For example, OSPF relies on a strict hierarchy/star topology to prevent loops. EIGRP uses the concept of successors for loop prevention, and this allows for more flexible  topologies (not always a good thing).   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF and EIGRP stubs solve somewhat different problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of OSPF areas is to save resources by limiting the flooding of route updates to just inside the area. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF stubs save resources in the stub area by blocking external routes inside the area (except, of course, NSSA).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP stubs are confined to individual routers, not areas.  They save resources by limiting the size of the DUAL route query, and therefore speeds up convergence. An EIGRP stub advertises its own routes, but doesn't advertise routes it learns from other parts of the network.  An EIGRP stub router tells its neighbor that it doesn't know about the rest of the network, so there's no point querying it about other routes. That speeds up convergence by limiting the number of queries a router has to process.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-09-12T18:58:31.167" LastActivityDate="2015-09-12T18:58:31.167" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22357" PostTypeId="2" ParentId="22353" CreationDate="2015-09-10T01:31:55.897" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My assumption here is, that before echo-replying through ICMP, host 2 has to request host 1's MAC address by using ARP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;ARP-based IP-address-to-MAC-address mappings are cached for some amount of time, so that there isn't an ARP request for every single IP packet transmitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before echo-replying through ICMP, host 2 has to know host 1's MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it &lt;em&gt;already&lt;/em&gt; knows it, for example by having sent out an ARP request some time &lt;em&gt;before&lt;/em&gt; that because of something &lt;em&gt;else&lt;/em&gt; it wanted to send, so that it's in the ARP cache, it wouldn't have to request that address with ARP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps the cached ARP mapping expired and was removed from the cache some time after it sent the echo reply, and, for some reason, it decided it needed that address and ARPed for it again.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Or is &lt;code&gt;tcpdump&lt;/code&gt; simply changing the order in its ouput format&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No.  Tcpdump prints packets in the order in which it receives them from libpcap, which hands them to the application in the order in which they arrive from the OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, note that the time stamp on the second ARP request is greater than the time stamp on the ICMP Echo Reply, so the second ARP request was sent after the ICMP Echo Reply - by almost 5 seconds.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2015-09-10T01:31:55.897" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22358" PostTypeId="2" ParentId="22355" CreationDate="2015-09-10T01:45:16.127" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I configure DHCP using the server without any router present in my&#xA;  network topology?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You don't need a router to run DHCP.  In fact, it is much more common to run DHCP on a server than a router.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I use a default gateway other than 0.0.0.0 if I'm not using a&#xA;  router?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you have no routers in your network, then you don't need a default gateway -- there's nowhere to route to.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any scenario where a router is need if DHCP is being ran off&#xA;  a server in the topology discussed above.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You need a router if you have to route between networks.  That is completely independent of the use of DHCP.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-09-10T01:45:16.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22359" PostTypeId="2" ParentId="22353" CreationDate="2015-09-10T03:55:46.393" Score="3" Body="&lt;p&gt;Your assumptions are flawed.&lt;/p&gt;&#xA;&lt;p&gt;When host 2 receives the ARP request from host 1, in addition to sending the ARP reply it should also update/add the entry for host 1 in it's own ARP table.&lt;/p&gt;&#xA;&lt;p&gt;So your order should be extended to look more like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ARP-request host 1 to host 2&#xA;Host 2 updates or adds entry for host 1 in ARP table&#xA;ARP-reply host 2 to host 1&#xA;Host 1 adds entry for host 2 in ARP table&#xA;ICMP echo request host 1 to host 2&#xA;ICMP echo reply host 2 to host 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;As to why host 2 sends out an ARP request so soon after, I would guess that the OS you are using either keeps a short timer for entries added this way and sends an ARP request to minimize the impact of any potential ARP poisoning attacks. However this is only a guess and it would take looking into what the OS is actually doing to make sure.&lt;/p&gt;&#xA;&lt;p&gt;For more detail on the ARP process, you can check out &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 826&lt;/a&gt;. Here is the processing flow from the RFC:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Packet Reception:&#xA;-----------------&#xA;&#xA;When an address resolution packet is received, the receiving&#xA;Ethernet module gives the packet to the Address Resolution module&#xA;which goes through an algorithm similar to the following.&#xA;Negative conditionals indicate an end of processing and a&#xA;discarding of the packet.&#xA;&#xA;?Do I have the hardware type in ar$hrd?&#xA;Yes: (almost definitely)&#xA;  [optionally check the hardware length ar$hln]&#xA;  ?Do I speak the protocol in ar$pro?&#xA;  Yes:&#xA;    [optionally check the protocol length ar$pln]&#xA;    Merge_flag := false&#xA;    If the pair &amp;lt;protocol type, sender protocol address&amp;gt; is&#xA;        already in my translation table, update the sender&#xA;        hardware address field of the entry with the new&#xA;        information in the packet and set Merge_flag to true.&#xA;    ?Am I the target protocol address?&#xA;    Yes:&#xA;      If Merge_flag is false, add the triplet &amp;lt;protocol type,&#xA;          sender protocol address, sender hardware address&amp;gt; to&#xA;          the translation table.&#xA;      ?Is the opcode ares_op$REQUEST?  (NOW look at the opcode!!)&#xA;      Yes:&#xA;        Swap hardware and protocol fields, putting the local&#xA;            hardware and protocol addresses in the sender fields.&#xA;        Set the ar$op field to ares_op$REPLY&#xA;        Send the packet to the (new) target hardware address on&#xA;            the same hardware on which the request was received.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-09-10T03:55:46.393" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22360" PostTypeId="1" CreationDate="2015-09-10T06:25:40.263" Score="2" ViewCount="372" Body="&lt;p&gt;We have a site that currently has a satellite connection used by users, and a 3G connection used for a specific application. Connections are from different providers. Every connection has it's own router, switch and connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way, to move all users and servers to one switch and connect the two routers on that same switch to provide redundancy in case of one of them fails? E.g. if Satellite connectivity fails then everything will go via 3G and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="18901" LastActivityDate="2016-11-04T15:48:07.940" Title="Satellite/3G redundancy" Tags="|routing|switch|router|redundancy|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22361" PostTypeId="1" AcceptedAnswerId="22364" CreationDate="2015-09-10T07:51:01.583" Score="0" ViewCount="58" Body="&lt;p&gt;The IPv6 payload may like the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 Header -&gt; ExtHeader -&gt; ... -&gt; UpperLayer Header&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use Scapy to make a packet such that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 -&gt; Hop-by-Hop-Option -&gt; Neighbor Solicitation [1]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However from Sniffer, I don't see the Neighbor Advertisement response.&#xA;So I try with this kind of packet:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 -&gt; Neighbor Solicitation [2]. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then It's work!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just wondering, the packet format I make in [1] is invalid? So the opposite station doesn't honor it??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18903" LastActivityDate="2015-09-10T08:30:41.467" Title="Can there be any extension header before Neighbor Solicitation Payload" Tags="|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22364" PostTypeId="2" ParentId="22361" CreationDate="2015-09-10T08:30:41.467" Score="1" Body="&lt;p&gt;The other station might not understand your extension headers, in which case it can not reply to them. But in general extension headers are allowed in all packets, even Neighbour Discovery.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-09-10T08:30:41.467" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22365" PostTypeId="1" CreationDate="2015-09-10T08:51:45.867" Score="0" ViewCount="4168" Body="&lt;p&gt;Is there a way to ban adult websites?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A country blocks access to adult websites based on the IP address. The person still access those adult websites by using a proxy like &quot;tor browser&quot;, &quot;Psiphon&quot; browser plugins &quot;browsec&quot;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a solution to ban access to adult websites even if the person uses a proxy?&lt;/p&gt;&#xA;" OwnerUserId="18904" LastEditorUserId="18905" LastEditDate="2015-09-10T14:24:49.257" LastActivityDate="2016-11-03T16:12:24.297" Title="How to block website so that it doesn't run via proxy" Tags="|vpn|firewall|ip|" AnswerCount="5" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="22366" PostTypeId="2" ParentId="22365" CreationDate="2015-09-10T10:04:43.117" Score="0" Body="&lt;p&gt;As alternative to Gadeliow's answer, take a look at Sophos Web Filtering, maybe this is the one you were looking for.&lt;/p&gt;&#xA;" OwnerUserId="17646" LastActivityDate="2015-09-10T10:04:43.117" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22367" PostTypeId="2" ParentId="22360" CreationDate="2015-09-10T11:19:29.330" Score="2" Body="&lt;p&gt;there are two solution first one will be the automatic and profissional solution and need to be done from the side of your routers and the other one i consider it as a way out &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;first one&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if both USERS and Application servers and router interfaces from the lan side run same IP range so simple you just need to configure &lt;strong&gt;&lt;em&gt;FHRP&lt;/em&gt;&lt;/strong&gt; on both router and map all your devices to single GW .&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;if you are using Cisco routers you can configure &lt;strong&gt;&lt;em&gt;HSRP&lt;/em&gt;&lt;/strong&gt; on both of them and make your devices GW the virtual IP of this HSRP&lt;/li&gt;&#xA;&lt;li&gt;if you are using non cisco routers you can configure &lt;strong&gt;&lt;em&gt;VRRP&lt;/em&gt;&lt;/strong&gt; on both of your routers and also make your devices GW VRRP virtual IP  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;second one&lt;/em&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if your devices and router interfaces from the lan side run same IP range , may you login to each device and configure primary and seconry GW  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;from start login to CMD as administrator then type &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;route add X.X.X.X mask Y.Y.Y.Y Z1.Z1.Z1.Z1 metric 10&lt;br&gt;&#xA;route add X.X.X.X mask Y.Y.Y.Y Z2.Z2.Z2.Z2 metric 20&lt;br&gt;&#xA; wher Xs are your lan ip range and Ys are the mask and Z1s are the primary GW and Z2s are the secondry one  &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;from the interface card login to the advanced setting then configure other GW with metric 20&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-10T11:19:29.330" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22368" PostTypeId="2" ParentId="22365" CreationDate="2015-09-10T11:39:00.770" Score="0" Body="&lt;p&gt;use an anti porn program which will block any porn websites and the program can not be uninstalled without a password that you will set when you setup the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;link of the program:  &lt;a href=&quot;http://www.tueagles.com/anti-porn/&quot; rel=&quot;nofollow&quot;&gt;http://www.tueagles.com/anti-porn/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18907" LastActivityDate="2015-09-10T11:39:00.770" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22369" PostTypeId="2" ParentId="22365" CreationDate="2015-09-10T12:30:34.403" Score="0" Body="&lt;p&gt;If you have control over network you can use firewall rule allow some block all port that not used this way you can block proxy port based. If using web proxy do not know how to block it except block one by one web proxy or using some service that block web proxy.&lt;/p&gt;&#xA;" OwnerUserId="8154" LastActivityDate="2015-09-10T12:30:34.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22370" PostTypeId="2" ParentId="22321" CreationDate="2015-09-10T12:40:59.330" Score="0" Body="&lt;p&gt;Based on my experience it might be cause by network loop that cause high latency that cause lag on network. Try ping some host and see if there are time out and high latency on it. If so please find the root cause. Also if you you network teaming/bond in windows with broadcom nic please make sure the configuration using anycast not multicast because it can cause multicast storm.&lt;/p&gt;&#xA;" OwnerUserId="8154" LastActivityDate="2015-09-10T12:40:59.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22371" PostTypeId="2" ParentId="22321" CreationDate="2015-09-10T13:16:43.167" Score="1" Body="&lt;p&gt;Seems to be a network loop my friend, you must check the logs on the switch, and see was wrong, looking mac address flaping or something like that&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-10T13:16:43.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22372" PostTypeId="2" ParentId="22349" CreationDate="2015-09-10T13:35:58.683" Score="1" Body="&lt;p&gt;I think the before comment is rigth. You have two vlans, with two vlan interfaces, to do routing in your swicht, you should send the next hope to your vlan interfaces in the network that you have the destination&lt;/p&gt;&#xA;&#xA;&lt;p&gt;set routing-instances MGMT-6 routing-options static route 10.0.0.0/23 next-hop 10.0.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because 10.0.0.1, seems to be the ip address of your vlan interfaces of your VLAN DATA&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-10T13:35:58.683" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22375" PostTypeId="2" ParentId="16611" CreationDate="2015-09-10T16:15:07.100" Score="1" Body="&lt;p&gt;You need to set a gateway to all the PC!!!!!&#xA;When you configure the addressing of all pc, you must set, IP address, Mask and Gateway. Gateway is the only way that your network can communicate with other network, in this case, the address that you set on the router interface connected on the same switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, E0(router) should be configured with an IP of your network, and that IP must me configured as gateway in all your PCs.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-10T16:15:07.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22376" PostTypeId="1" AcceptedAnswerId="33729" CreationDate="2015-09-10T17:08:01.877" Score="2" ViewCount="359" Body="&lt;p&gt;Ok so my understanding of TCP is basically like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this data broken up into packets like &lt;code&gt;[#1,#2,#3,...]&lt;/code&gt; that I want to send to Bob. These packets have been wrapped so that the message number is actually included in the packet. So I send out &lt;code&gt;#1,#2,#3,...&lt;/code&gt; which are one by one acknowledged by Bob with some delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At some point, I've sent packets &lt;code&gt;#n&lt;/code&gt; to &lt;code&gt;#n+m&lt;/code&gt;, but Bob detects an error with packet &lt;code&gt;#n&lt;/code&gt;. He now sends me a message: &quot;back it up and retransmit from &lt;code&gt;n&lt;/code&gt; and forward&quot;. Upon receiving this, say I've transmitted an additional &lt;code&gt;p&lt;/code&gt; packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens to these &lt;code&gt;m+p&lt;/code&gt; packets that are now in the ether? As I understand it, Bob discards them? Why doesn't he just leave a buffer slot open for &lt;code&gt;n&lt;/code&gt; and keep receiving the others?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same question for the sender - what is the reason for retransmitting ALL &lt;code&gt;m+p+1&lt;/code&gt; packets instead of just the &lt;code&gt;#n&lt;/code&gt; packet?&lt;/p&gt;&#xA;" OwnerUserId="20064" LastActivityDate="2016-08-03T16:37:29.460" Title="When TCP packet is faulty,why retransmit the whole buffer?" Tags="|tcp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22377" PostTypeId="2" ParentId="22338" CreationDate="2015-09-10T18:34:11.420" Score="3" Body="&lt;p&gt;Problem solved: Somewhere along the troubleshooting path the SFP was removed and reinserted without rebooting the router. We tried a reboot today and the interface came up successfully. I don't know if this is a documented behavior or not, but it makes sense - try a reboot if all else fails.&lt;/p&gt;&#xA;" OwnerUserId="18883" LastActivityDate="2015-09-10T18:34:11.420" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22381" PostTypeId="1" AcceptedAnswerId="22986" CreationDate="2015-09-10T19:28:56.423" Score="4" ViewCount="831" Body="&lt;p&gt;I am seeing the following messages in my ASA Log files:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2015-09-10T14:22:07.860487-05:00 natbox %ASA-2-106006: Deny inbound UDP from 172.17.136.168/16403 to 172.17.136.168/16403 on interface Outside_128.255.2.116/30&#xA;2015-09-10T14:22:07.860487-05:00 natbox %ASA-2-106006: Deny inbound UDP from 172.17.136.168/16403 to 172.17.136.168/16403 on interface Outside_128.255.2.116/30&#xA;2015-09-10T14:22:07.860491-05:00 natbox %ASA-2-106006: Deny inbound UDP from 172.17.136.168/16403 to 172.17.136.168/16403 on interface Outside_128.255.2.116/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 172.17.128.0/17 network should be internal (on the inside interface of the NAT box) and not appear on the Outside Interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the NAT statements from the config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network WLAN_USR_GLOBAL_POOL_129_255_228_0&#xA; range 129.255.228.10 129.255.231.254&#xA;&#xA;object network ARUBA_LOCAL_172_17_128_0&#xA;  subnet 172.17.128.0 255.255.128.0&#xA;&#xA;object network ARUBA_LOCAL_172_17_128_0&#xA;  nat (any,any) dynamic pat-pool WLAN_USR_GLOBAL_POOL_129_255_228_0 round-robin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt; I executed a small packet capture on the outgoing interface of the ASA and I'm not seeing any traffic from 172.17.128.0/17. So I suspect something else. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt; Simplified Diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bxR15.gif&quot; alt=&quot;Diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic to the Internet follows the wireless routers default route to the ASA to be NAT'd.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic to internal networks is routed by more specific routes directly to the core router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 2015-09-15&lt;/strong&gt; The Cisco TAC recommended that I specify the source and destination interfaces rather than (any,any), so I did that. It did not make a difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="18922" LastEditorUserId="18922" LastEditDate="2015-09-15T13:38:26.440" LastActivityDate="2015-10-31T20:20:48.870" Title="Why am I seeing internal traffic on the external interface of my ASA?" Tags="|cisco-asa|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22384" PostTypeId="1" AcceptedAnswerId="22402" CreationDate="2015-09-10T21:57:40.573" Score="4" ViewCount="1190" Body="&lt;p&gt;Here at Stack Exchange, we recently added an MPLS link between data centers to supplement the VPN tunnels that we had been using up until now.  The network looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   +-----------+                                                                  &#xA;   |    NY     |                                                                  &#xA;   |10.7.0.0/16|                                                                  &#xA;   ++----+----++                                                                  &#xA;    |    |    |                                                                   &#xA;  VPN 1  |    |                                                                   &#xA;OSPF P2P |  MPLS Peer--+                                                          &#xA;    |    |             |                                                          &#xA;    |    |             |                                                          &#xA;    |  VPN 2   MPLS Provider Net                                                  &#xA;    |OSPF P2P          |                                                          &#xA;    |    |             |                                                          &#xA;    |    |  MPLS Peer--+                                                          &#xA;    |    |    |                                                                   &#xA;    |    |    |                                                                   &#xA;   ++----+----++                                                                  &#xA;   |    CO     |                                                                  &#xA;   |10.8.0.0/16|                                                                  &#xA;   +-----------+    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The two sites are connected directly using VPN links (OSPF is running on these in point to point mode) and via the MPLS (we're OSPF peering with the MPLS provider's routers on each end). Everything is in area 0; nothing other than these two devices and the MPLS provider's routers are participating in this OSPF network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea was to be able to adjust OSPF costs to have traffic flow over the (faster) MPLS connection - but what's happening instead, is that when only the MPLS is up the traffic takes the MPLS, but when the VPNs come up, the MPLS is no longer considered a valid route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With just the MPLS up, there are type 5 LSAs for the remote site's /16 present in the database (with the advertising-router set to the MPLS provider's router); when the VPNs are brought up and the &quot;original&quot; type 5 LSA (with the advertising router set to the site router) populates across, the MPLS provider's routers stop sending their LSAs for the routes, so there's no way to use the MPLS route when the VPN is up.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Is this strange withdrawl of the MPLS provider's type 5 LSA being caused by having the MPLS network set as area 0, since it's a disjointed area 0 which then gets joined together via the VPN when that's lit up?  Since joining them together gives the MPLS neighbors knowledge of the 'direct' type 5 LSA that flooded via the VPN, would that be why they stopped advertising their own LSAs for those networks? (Could this be fixed by putting the MPLS peers in a different (NSSA?) area instead of area 0?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Because the MPLS network isn't using end-to-end OSPF, and instead distributes the routes to their endpoint routers in some other way then re-advertises new type 5 LSAs, will we be able to get to our desired end state of 'select route based on OSPF cost between VPN and MPLS', or will the fact that the LSAs that are being chosen between have differing advertising routers make that plan impossible?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="221" LastEditorUserId="221" LastEditDate="2015-09-10T22:04:52.243" LastActivityDate="2015-09-16T12:07:09.487" Title="Connecting two OSPF sites both directly and via MPLS" Tags="|routing|ospf|mpls|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22385" PostTypeId="1" AcceptedAnswerId="22386" CreationDate="2015-09-10T23:22:23.093" Score="0" ViewCount="971" Body="&lt;p&gt;I want to establish a wifi connection for a farm. So there is the main house which has internet access. A Barn(300ft) and an other hall(500ft) should have their own networks. It is in an open area. No trees should block the view. My planned setup is a router in the main house with an &lt;a href=&quot;http://www.tp-link.com/resources/document/CPE210_V1_Datasheet.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.tp-link.com/resources/document/CPE210_V1_Datasheet.pdf&lt;/a&gt; TP-LINK CPE210 mounted at the outside. The barn and the hall each get one too and then their own access points. So my question is if that make sense and could work. I have experinece in setting up networks, but not so much in &quot;long&quot; distance networking. I also took a look at &quot;Ubiquiti NanoStation locoM2&quot;. Are my thoughts going in the right direction?&lt;/p&gt;&#xA;" OwnerUserId="18928" LastActivityDate="2015-09-11T03:28:09.220" Title="tp-link CPE210 Network - relatively long range - access points" Tags="|routing|access-point|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22386" PostTypeId="2" ParentId="22385" CreationDate="2015-09-11T03:28:09.220" Score="0" Body="&lt;p&gt;Yes it should be working, you just need do assign subnet on each network example house 192.168.0.1/24 barn 192.168.1.0/24 hall 192.168.2.0/24 and do not forget to do static routing on each wireless router so it can connected each other.&lt;/p&gt;&#xA;" OwnerUserId="8154" LastActivityDate="2015-09-11T03:28:09.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22389" PostTypeId="1" AcceptedAnswerId="22390" CreationDate="2015-09-11T07:41:56.607" Score="0" ViewCount="115" Body="&lt;p&gt;When you subnet for example the ip 154.2.13.5/20 what if there is someone that owns the ip address 154.2.8.6 ? My confusion comes from the fact that I dont know how IANA, RIPE and the others give IPs. Do they only give class C addresses or if they give class B how are they making sure that there isn't someone else that might be using an IP address in the range that they gave away ?&lt;/p&gt;&#xA;" OwnerUserId="18863" LastActivityDate="2015-09-11T08:24:29.733" Title="Subnetting and IP's of other people" Tags="|ipv4|ip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22390" PostTypeId="2" ParentId="22389" CreationDate="2015-09-11T08:06:50.370" Score="2" Body="&lt;p&gt;Once more: &lt;strong&gt;Clasful networking is dead&lt;/strong&gt; Please don't use Class-A, B, C, D, E outside the correct historical context. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP address distribution works like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IANA -&amp;gt; RIR (e.g. RIPE) -&amp;gt; LIR (Provider) -&amp;gt; Customer &#xA;IANA -&amp;gt; RIR (e.g. RIPE) -&amp;gt; Customer (PI) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;RIR: Regional Internet Registry (ARIN, ARIN, APNIC, LANIC, AfriNIC)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LIR: Local Internet Registry &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PI: Provider Independent &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently RIPE only hands out /22 networks to new members or existing members (if they ask for one). This will work as long as they have free networks left.You can't get IPv4 PI from RIPE anymore. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you provider gives you a network he has to take care that there are no overlaps and collisions with other customer (or internal) networks. So if you provider is doing is job you can subnet your networks as you like, there will be no overlaps with other customers.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="509" LastEditDate="2015-09-11T08:24:29.733" LastActivityDate="2015-09-11T08:24:29.733" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22393" PostTypeId="1" CreationDate="2015-09-11T10:31:22.223" Score="2" ViewCount="229" Body="&lt;p&gt;I'm trying to fully understand the Link State Routing protocol since I want to code a program which creates a routing table for every node of a network, represented with a weighted graph.&#xA;I know that to use Dijkstra's algorithm I have to know the full topology of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in the beginning I have nodes that only know their neighbours and I want to build the LSP database – which represents the full network topology – which every node should know.&#xA;Every node sends its neighbours the information about the link cost of links pointing to its neighbours and receives from its neighbours the information about the link cost of their conections to adjacent nodes, but how can a node get information about nodes connected to non-adjacent nodes, if the Link State Packet only brings information about adjacent connections and is only communicated to adjacent neighbours?&#xA;Should the nodes forward the LSPs of other nodes, other than their own LSPs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll try to make an example:&#xA;If I have node A connected to node B, node B connected to node C and node C connected to node D, how could A ever know about the existence of node D if the only information it gets is the Link State Packet from B, which tells “I'm connected to A and C”?&#xA;Even after B knows that C is connected to D, B will keep telling A only its adjacent connections, so A will never know of any other nodes other than B (directly connected) and C (connected through B)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there's something I'm missing, any help will be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="18934" LastEditorUserId="18934" LastEditDate="2015-09-11T12:56:13.137" LastActivityDate="2016-03-20T16:02:47.703" Title="Need help understanding Link State Routing" Tags="|routing|protocol-theory|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22394" PostTypeId="1" CreationDate="2015-09-11T11:21:40.160" Score="0" ViewCount="51" Body="&lt;p&gt;I went for an interview recently and I was asked if a server was experiencing slow file transfer what would you do troubleshoot the issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The could only think of checking speed/duplex. What else can be checked? &lt;/p&gt;&#xA;" OwnerUserId="18936" LastActivityDate="2015-09-11T12:08:24.283" Title="Troubleshooting server connectivity" Tags="|troubleshooting|" AnswerCount="1" CommentCount="2" ClosedDate="2015-09-13T21:08:39.353" ContentLicense="CC BY-SA 3.0" />
  <row Id="22395" PostTypeId="2" ParentId="22394" CreationDate="2015-09-11T12:08:24.283" Score="2" Body="&lt;p&gt;Note that this is more a question about performance than connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's many thing to check to troubleshoot such issues&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could check :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the machines involved :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;server health : cpu usage, memory usage, disk subsystem load (I/O counters), network usage&lt;/li&gt;&#xA;&lt;li&gt;server logs&lt;/li&gt;&#xA;&lt;li&gt;client health&lt;/li&gt;&#xA;&lt;li&gt;client logs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You may perform the test from a different client, and event a different operating system to determine if the issue is client side or server side...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the network between the client and the server:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;topology : are all connection appropriate speeds (for example if you expect a Gbs transfer rate, and there's a 100Mbs switch somewhere...)&lt;/li&gt;&#xA;&lt;li&gt;the switches health and configuration&lt;/li&gt;&#xA;&lt;li&gt;if there's a router in the middle that could be the bottleneck&lt;/li&gt;&#xA;&lt;li&gt;the cabling can easily cause performance issues&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You may connect the client on another port / another switch, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually the idea is to look at each element of the chain and eliminate them one by one.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-09-11T12:08:24.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22396" PostTypeId="1" AcceptedAnswerId="22398" CreationDate="2015-09-11T13:43:35.117" Score="2" ViewCount="5027" Body="&lt;p&gt;In the &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/21030/optimizing-network-topology&quot;&gt;previous question&lt;/a&gt; I have been trying to optimize switching topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I would like to implement redundancy. And here are the problems I faced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the following topology &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RiatP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RiatP.png&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As routers we use Mikrotik. Switches are cisco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Redundancy between two routers will be achieved through VRRP.&#xA;Unfortunately I can't understand how I can establish NAT after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have /28 public address range. It is obvious that both Mikrotiks have to have the IPs from our public range to use the CPE as gateway. VRRP will be inside the network (private). This part is easy and clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then, how to make NAT. While on both Mikrotiks I have to mirror the configuration, thus both will have the same IP addresses in the public range (I had to configure all the list of IPs in order to implement dst-nat).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And from here I can't imagine how should I implement this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking about making VRRP inside our public range. But can't yet make a proper picture of the implementation. Or do I need to create two VRRPs, inside and outside the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does usually configuration of a such network topology looks?&lt;/p&gt;&#xA;" OwnerUserId="17628" LastEditorUserId="8499" LastEditDate="2018-12-22T02:09:16.437" LastActivityDate="2019-01-14T21:55:17.770" Title="Optimizing Router Topology (Redundancy)" Tags="|routing|nat|redundancy|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22397" PostTypeId="2" ParentId="22393" CreationDate="2015-09-11T15:32:40.740" Score="0" Body="&lt;p&gt;I think you mean LSA, not LSP. What you're missing is unique RIDs (Router IDs). If you look at a type 1 LSA in an OSPF LSDB (Link State Database) you will see that an LSA contains within it an RID and all adjacent nodes for that RID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in your example, node D advertises an LSA with all its adjacent neighbors and OSPF-enabled interfaces to C. C then advertises its own LSA plus node D's LSA to B etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So RIDs allow routers to uniquely identify other link-state routers in the same domain even if they're not directly adjacent&lt;/p&gt;&#xA;" OwnerUserId="889" LastEditorUserId="889" LastEditDate="2015-09-11T15:38:42.267" LastActivityDate="2015-09-11T15:38:42.267" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22398" PostTypeId="2" ParentId="22396" CreationDate="2015-09-11T16:17:56.840" Score="1" Body="&lt;p&gt;NAT is a problem with dual routers because the tables in NAT don't get shared between the routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That topology will break NAT if the traffic is asymmetric. Asymmetric traffic will come from the WAN to the wrong router and get passed to the correct router on an inside interface instead of the outside interface, so it will never translate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is your drawing modified for what I mean.  The link between the routers must be the best path from one router to the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oQNdQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oQNdQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-12T23:29:35.433" LastActivityDate="2015-09-12T23:29:35.433" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22400" PostTypeId="1" AcceptedAnswerId="23499" CreationDate="2015-09-11T17:41:59.830" Score="2" ViewCount="407" Body="&lt;p&gt;We're working with a metro ethernet provider to bring up a new multi-point connection between our sites. Currently we're just trying to get it working with two sites. As a simple test I've plugged in an HP switch at either end using an untagged, layer 3 addressed VLAN port. &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Observations&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I can't ping between the devices on the new link&lt;/li&gt;&#xA;&lt;li&gt;I can ping between the devices using a known-good point-to-point ethernet link&lt;/li&gt;&#xA;&lt;li&gt;The provider claims that using testing equipment, the metro ethernet circuit passed all layer 2 connectivity tests. &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is an ethernet product from the provider so I assume that means the tests were layer 2 ethernet tests. I also asked questions about ethernet frame sizes, etc so I think it's a safe assumption.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Wireshark traces show a provider-owned device firing off several 802.1ag &quot;CFM&quot; protocol, &quot;continuity check messages&quot;. The provider confirmed this is their hand-off device (that my switch is plugged into) by MAC address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h1&gt;Questions&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Assuming my metro ethernet circuit is implemented with VPLS, should I be seeing these messages (described in #4 above) from the provider equipment on my circuit or should these be &quot;out-of-band&quot; (therefore a configuration problem)?&lt;/li&gt;&#xA;&lt;li&gt;Assuming our metro ethernet circuit is implemented by VPLS, what would block layer 3 traffic but allow layer 2 connectivity?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4532" LastEditorUserId="8499" LastEditDate="2018-03-21T00:07:55.443" LastActivityDate="2018-03-21T00:07:55.443" Title="Metro Ethernet no layer 3 connectivity" Tags="|ethernet|mpls|layer3|vpls|metro-ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22402" PostTypeId="2" ParentId="22384" CreationDate="2015-09-11T18:29:00.797" Score="2" Body="&lt;p&gt;I think this is the exact situation addressed by the OSPF &quot;Sham Link&quot; feature. It's hard to know if that's the exact issue, without knowing what your MPLS provider is doing with the routes you exchange with them. It's possible that even though the MPLS link is up, it's considered a Inter-area link, while your &quot;backdoor&quot; VPN tunnels are Intra-area, and thus, always preferred over Inter-area links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know what routing platform you use, but Juniper's docs contain a good explanation of the issue: &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.3/topics/topic-map/ospfv2-sham-links.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/en_US/junos12.3/topics/topic-map/ospfv2-sham-links.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="996" LastActivityDate="2015-09-11T18:29:00.797" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22403" PostTypeId="1" AcceptedAnswerId="22422" CreationDate="2015-09-11T18:56:25.423" Score="2" ViewCount="130" Body="&lt;p&gt;I am studying an online course that has just covered the basic standards for WAN data transmission. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It covered the European Frame formats over Copper wires: E1 set as 32 x DS0 channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It then describes the SDH STM-1 Framing unit as being able to carry 1 x E4 unit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the specifications for the E4 framing unit?&#xA;(in particular what is its maximum data rate and when is it used)&lt;/p&gt;&#xA;" OwnerUserId="17733" LastActivityDate="2016-09-06T18:55:37.727" Title="SDH STM-n measured in multiples of E4" Tags="|wan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22404" PostTypeId="1" CreationDate="2015-09-11T18:56:58.733" Score="3" ViewCount="3387" Body="&lt;p&gt;Coming from a Networking (IP/TCP/etc) background, I understand that a typical network packet looks something like the following:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nkyS5.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nkyS5.gif&quot; alt=&quot;TCP Packet&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I further understand that VoIP packets typically do use the same format and encapsulate all of the calling data to route it to the machine itself before handing it up the OSI model until the call is picked up by the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm trying to understand, is how a telephone or mobile phone packet is physically laid out. Simple PSTN lines are an analog signal transmitted over copper wires that lay out a few rules and essentially only provide status updates. What I'm trying to understand is how a mobile phone call packet/datagram is constructed and what information is actually provided to the handset.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my simplified understanding of how a cell phone tower works, I think of it like a WiFi router with all of the subscribed cell phones attempting to speak with it and following a lot of the same rules. As well, my phone needs to be able to know when it's being directly communicated with instead of picking up packets aimed at another subscriber. How is this addressed? (IMEI?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a phone call is made, what packet information is transmitted to my phone? Will my phone know the destination IMEI/whatever address of the calling phone or will it only know it's next hop? Caller ID (to me) seems to something of a higher layer and less dependent on actual routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we're specifically speaking about GSM Networks (Older/Common), I have looked through the ETSI standards from a &lt;a href=&quot;http://www.etsi.org/technologies-clusters/technologies/mobile/gsm&quot; rel=&quot;nofollow noreferrer&quot;&gt;high level here&lt;/a&gt; but I still can't quite wrap my mind around it.&lt;/p&gt;&#xA;" OwnerUserId="18950" LastActivityDate="2018-11-22T05:20:58.473" Title="What is the internal structure of a mobile phone call packet/datagram?" Tags="|routing|protocol-theory|telephony|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22407" PostTypeId="1" CreationDate="2015-09-11T19:06:51.087" Score="1" ViewCount="41" Body="&lt;p&gt;I am doing an online course and just want to check my understanding with terminology. Do the WAN framing units such as SDH STM-n and SONET STS-n have anything to do with the layer 2 (datalink) datagram called a frame?&lt;/p&gt;&#xA;" OwnerUserId="17733" LastActivityDate="2016-02-14T04:35:22.160" Title="WAN DS framing unit different to the layer 2 frame datagram" Tags="|wan|layer2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22408" PostTypeId="1" AcceptedAnswerId="22469" CreationDate="2015-09-11T20:07:45.057" Score="4" ViewCount="4596" Body="&lt;p&gt;i86bi-linux-l2-adventerprisek9-15.1a.bin on Cisco IOU via GNS3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set up the following topology in GNS3:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YmcCX.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YmcCX.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I did was power on the devices, connect them and do a 'no shut'-command on their connected interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought spanning tree was enabled by default but when I do a show spanning-tree on any of the switches it says &quot;No spanning tree instances exist&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FastEthernet1/0 ports of ESW2 and ESW3 both show a status of UP/Down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to enable the port as trunks before spanning-tree gets enabled? Why is the fa1/0 of those two switches UP/Down? It looks almost like it might be blocking?&lt;/p&gt;&#xA;" OwnerUserId="13362" LastEditorUserId="17646" LastEditDate="2015-09-14T12:30:25.710" LastActivityDate="2015-09-14T15:18:47.433" Title="Why am I not seeing a spanning tree instance?" Tags="|cisco|spanning-tree|vtp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22409" PostTypeId="1" AcceptedAnswerId="22511" CreationDate="2015-09-11T21:40:28.623" Score="2" ViewCount="187" Body="&lt;p&gt;In the next topology I face a problem in CPU usage and data transfer from site to HQ &#xA;&lt;a href=&quot;https://i.stack.imgur.com/f4amh.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f4amh.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;During the handheld data transfer from one site to server in HQ ,CPU usage in all site switches (SW1,SW2,SW3) increased and after while handhelds couldn't be discovered by its agent in HQ and its data stopped  to be transferred.here a copy of output of command &lt;strong&gt;*sh proce cpu sorted&lt;/strong&gt; &#xA;&lt;a href=&quot;https://i.stack.imgur.com/qME8u.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qME8u.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;after alot of &lt;strong&gt;&lt;em&gt;clear arp&lt;/em&gt;&lt;/strong&gt; , &lt;strong&gt;&lt;em&gt;clear mac address-table dynamic&lt;/em&gt;&lt;/strong&gt; no thing could happen .also handhelds still not working till I reload all switches .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NOTES&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I run RSTP on all switches &lt;/li&gt;&#xA;&lt;li&gt;I run router on stick method for the data and voice vlan so the router is the GW for both &lt;/li&gt;&#xA;&lt;li&gt;Router is 2901 , switches are 2960 &lt;/li&gt;&#xA;&lt;li&gt;handhelds are assigned DATA VLAN IPs and GW&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-12T17:32:51.800" LastActivityDate="2015-09-15T13:34:02.447" Title="high CPU usage and drop in data transfer from site to HQ" Tags="|cisco|vlan|ipv4|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22411" PostTypeId="2" ParentId="16732" CreationDate="2015-09-12T00:42:23.550" Score="2" Body="&lt;p&gt;I know this is an older post, but in case someone else stumbles upon it like I did, I wanted to provide some input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, the only way to do this that I know of is with Mikrotik's PCQ (per-connection queuing) algorithm. It's not too hard to set up and there's a ton of guides out there to show you how. But it basically makes a packet queue for each device on your network and as the link hits your specified bandwidth limit (typically you set it to your ISP's limit) it begins dropping packets from the highest speed queues until all queues reach the same speed. Then it drops packets equally from each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an option to set a fixed limit per queue, but if you don't set a limit it works the way I described.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is particularly useful in hospitality environments, like hotels, since it basically dynamically adjusts your bandwidth limits per device as your occupancy changes.&lt;/p&gt;&#xA;" OwnerUserId="18955" LastActivityDate="2015-09-12T00:42:23.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22412" PostTypeId="1" AcceptedAnswerId="22413" CreationDate="2015-09-12T02:28:58.620" Score="1" ViewCount="80" Body="&lt;p&gt;Recently I study RFC 4291, and the solicitation node address is defined in that spec. I know what and the function of this solicitation node address. But just wondering why does the address design as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF02::1:FFXX:XXXX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I mean why choose the 104 bits as fix prefix, and just use 24 bits of the unicast IP address as variation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also know that &quot;all nodes on the link&quot; defined as :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF02::1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far as I know the FF02 means multicast on the local link, but beyond that are there any correlation between them ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any tips or references are appreciate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="18903" LastEditorUserId="8499" LastEditDate="2018-03-19T16:17:02.993" LastActivityDate="2018-03-19T16:17:02.993" Title="Design thinking of Solicitation node address in IPv6" Tags="|ip|ipv6|protocol-theory|multicast|rfc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22413" PostTypeId="2" ParentId="22412" CreationDate="2015-09-12T02:48:51.500" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I mean why choose the 104 bits as fix prefix, and just use 24 bits of&#xA;  the unicast IP address as variation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The RFC clearly explains this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IPv6 addresses that differ only in the high-order bits (e.g., due to&#xA;  multiple high-order prefixes associated with different aggregations)&#xA;  will map to the same Solicited-Node address, thereby reducing the&#xA;  number of multicast addresses a node must join.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IPv6 allows, and even requires, multiple addresses per interface. Every IPv6 unicast and anycast address that an interface has must have a corresponding solicited node address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-12T02:48:51.500" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="22414" PostTypeId="1" CreationDate="2015-09-12T04:04:29.983" Score="1" ViewCount="356" Body="&lt;p&gt;I just joined a new company and I am trying to correctly configure our guest wifi, get it secured and outside of our DMZ. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point in time, I am unsure of how to best configure our Sonicwall. &#xA;Currently, under the network interfaces settings, I have the OPT interface set with a zone type of DMZ. &#xA;The IP Address is set on a different subnet from our LAN and WAN interfac and the IP is set as Static.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect the Meraki to the OPT port, the signal lights cycle, indicating that it is unable to find an IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our network flow is as follows...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ATT Modem (Bridged) &gt; Sonicwall (NAT) &gt; Switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if I need to set a static IP on the Meraki and have it double NAT, or what. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!!&lt;/p&gt;&#xA;" OwnerUserId="18953" LastActivityDate="2016-01-16T19:20:17.073" Title="Sonicwall TZ 190 Enhance w/ Meraki MR12 - Configure OPT port for Guest Wifi" Tags="|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22416" PostTypeId="1" AcceptedAnswerId="26611" CreationDate="2015-09-12T07:40:56.790" Score="8" ViewCount="3485" Body="&lt;p&gt;I did an experiment to check if Linux will send the gratuitous ARP or ARP probe before using the target IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The experiment scenario is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two Linux computers, both connected to the same AP. I connected the one first and used &lt;code&gt;ifconfig wlan0 192.168.1.30&lt;/code&gt; (which is another Linux computer's default IP address) to set the IP address statically.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I use WPA_supplicant to connect the other one, and use &lt;code&gt;dhclient wlan0&lt;/code&gt; to get the IP address. From sniffer, I didn't observe any gratuitous ARP or ARP probe sent from the second computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just wondering under what condition, will linux computer send these two ARP request? Since under the same condition, I observe that my windows computer will send the ARP Probe to solicit the IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks  &lt;/p&gt;&#xA;" OwnerUserId="18903" LastEditorUserId="8499" LastEditDate="2016-02-07T17:24:31.347" LastActivityDate="2016-07-13T02:28:20.507" Title="Will Linux send the ARP gratuitous or ARP probe (defined in RFC 5227)" Tags="|dhcp|ip|arp|ieee-802.11|linux|" AnswerCount="3" CommentCount="0" ClosedDate="2020-10-27T01:57:20.127" ContentLicense="CC BY-SA 3.0" />
  <row Id="22417" PostTypeId="2" ParentId="12497" CreationDate="2015-09-12T09:32:20.740" Score="2" Body="&lt;p&gt;dear i faced same problem but with 3rd party AP not aruba .taking into consideration our handheld can be connected wired and wireless, after alot of analysis we found that those handhelds generate huge multicast (icmp , TCP and UDP) traffic cause even  switch CPU%  increase to unusual percentage. the only work around solving this case , &lt;em&gt;isolate handheld devices in separate vlan with separate DHCP scope with separate SSID ,may you configure your controller to be its DHCP server for this vlan .&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-12T09:32:20.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22418" PostTypeId="1" AcceptedAnswerId="22424" CreationDate="2015-09-12T12:05:22.230" Score="3" ViewCount="2263" Body="&lt;p&gt;I am trying to limit access to our SIP servers to only &lt;code&gt;209.85.2.10&lt;/code&gt; however,&#xA;I am getting a little confused by the &lt;code&gt;permit ip any any log&lt;/code&gt;. Will it not allow everything in? Without it, I loose all the rest of the needed traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question, how do I limit access to &lt;code&gt;5060&lt;/code&gt; to only &lt;code&gt;permit ip any any log&lt;/code&gt; and retain the rest of the traffic (ie, http, smtp..).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;permit ip any any log&lt;/code&gt; seems to contradict the constraint by allowing other servers to connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internal Network&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interface GigabitEthernet0/1&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip nat inside&#xA; ip access-group 104 out&#xA; exit&#xA;&#xA; ip access-list extended 104&#xA; permit udp host 209.85.2.10 host 192.168.2.5 eq 5060 log&#xA; permit ip any any log&#xA; deny ip any any log&#xA; deny tcp any any log&#xA; deny udp any any log&#xA; exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I need to change the above to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ip access-list extended 104&#xA; permit udp host 209.85.2.10 host 192.168.2.5 eq 5060 log&#xA; deny ip any host 192.168.2.5 log&#xA; permit ip any any log&#xA; exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then this will work as expected?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i) Accept &lt;code&gt;5060&lt;/code&gt; access to &lt;code&gt;192.168.2.5&lt;/code&gt; only from &lt;code&gt;209.85.2.10&lt;/code&gt;, and deny the rest of the attempts on the &lt;code&gt;5060&lt;/code&gt; port&#xA;ii) Let other traffic in from anywhere to anywhere within the network but &lt;code&gt;5060&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update Final Product&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For those who will find this post in the future. Here is the config that works for me thanks to the help of the two gentlemen in this thread.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended 104&#xA;permit tcp any host 192.168.2.5 eq 53&#xA;permit udp any host 192.168.2.5 eq 53&#xA;permit tcp any host 192.168.2.10 eq 25&#xA;permit tcp any host 192.168.2.10 eq 587&#xA;permit tcp any host 192.168.2.10 eq 993&#xA;permit tcp any host 192.168.2.10 eq 995&#xA;permit tcp any host 192.168.2.15 eq 80&#xA;permit tcp any host 192.168.2.15 eq 443&#xA;permit udp host 205.205.22.186 host 192.168.2.5 eq 5060&#xA;permit udp host 205.205.74.186 host 192.168.2.5 eq 5060&#xA;permit udp host 70.83.45.11 host 192.168.2.5 eq 5060&#xA;permit udp any host 192.168.2.20 eq 5080&#xA;permit udp any host 192.168.2.5 range 8000 65535&#xA;permit tcp any eq 25 host 192.168.2.10 range 1024 65535 established&#xA;permit tcp any eq 53 host 192.168.2.5 range 1024 65535 established&#xA;permit tcp any eq 53 host 192.168.2.10 range 1024 65535 established&#xA;permit tcp any eq 53 host 192.168.2.15 range 1024 65535 established&#xA;permit tcp any eq 53 host 192.168.2.20 range 1024 65535 established&#xA;permit udp any eq 53 host 192.168.2.5 range 1024 65535&#xA;permit udp any eq 53 host 192.168.2.10 range 1024 65535&#xA;permit udp any eq 53 host 192.168.2.15 range 1024 65535&#xA;permit udp any eq 53 host 192.168.2.20 range 1024 65535&#xA;permit tcp any eq 80 host 192.168.2.5 range 1024 65535 established&#xA;permit tcp any eq 80 host 192.168.2.10 range 1024 65535 established&#xA;permit tcp any eq 80 host 192.168.2.15 range 1024 65535 established&#xA;permit tcp any eq 80 host 192.168.2.20 range 1024 65535 established&#xA;deny ip any host 192.168.2.5 log&#xA;deny ip any host 192.168.2.10 log&#xA;deny ip any host 192.168.2.15 log&#xA;deny ip any host 192.168.2.20 log&#xA;permit ip any any&#xA;exit&#xA;&#xA;ip nat inside source static 192.168.2.5 77.77.77.77 route-map voip-rtp extendable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in Advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nick.&lt;/p&gt;&#xA;" OwnerUserId="3706" LastEditorUserId="3706" LastEditDate="2015-09-14T21:09:48.427" LastActivityDate="2015-09-14T21:09:48.427" Title="Understanding Cisco Extended ACL" Tags="|cisco|acl|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22420" PostTypeId="1" CreationDate="2015-09-12T12:19:59.620" Score="4" ViewCount="758" Body="&lt;p&gt;We have the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interface Dialer0&#xA; ip nat outside&#xA; ip access-group 101 in&#xA; exit&#xA;&#xA; interface GigabitEthernet0/1&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip nat inside&#xA; ip access-group 104 out&#xA; exit&#xA;&#xA; ip nat inside source static tcp 192.168.2.15 80 interface Dialer0 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;192.168.2.15 is a www server and our customers can access it from outside. The problem is, there is no internet from inside the network going out.&#xA;Requests are coming in, and the router can ping the outside world. Just no internet from within the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to give access to the internet for a specific number of machines ie:&#xA;      ip nat outside source static tcp 192.168.2.5 interface Dialer0 80&#xA;      ip nat outside source static tcp 192.168.2.10 interface Dialer0 80&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bellow is the complete config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;write erase&#xA;reload&#xA;!&#xA;enable&#xA;!&#xA;conf t&#xA;!&#xA;ntp server 192.168.2.15&#xA;ip name-server 192.168.2.5&#xA;ip name-server 8.8.8.8&#xA;!&#xA;hostname rymax&#xA;ip domain-name example.com&#xA;no ip domain lookup&#xA;! no logging console&#xA;!         &#xA;! crypto key generate rsa&#xA;! username root priv 15 secret &amp;lt;password&amp;gt;&#xA;! aaa new-model&#xA;service password-encryption&#xA;enable secret 0 &amp;lt;password&amp;gt;&#xA;line vty 0 4&#xA;transport input ssh&#xA;exit&#xA;line con 0&#xA;password &amp;lt;password&amp;gt;&#xA;exit&#xA;line aux 0&#xA;password &amp;lt;password&amp;gt;&#xA;exit&#xA;!&#xA;access-list 10 permit 192.168.2.100 log&#xA;line vty 0 4&#xA;access-class 10 in&#xA;exit&#xA;!&#xA;interface Dialer0&#xA;ip address negotiated&#xA;ip mtu 1492&#xA;ip tcp adjust-mss 1452&#xA;ip flow ingress&#xA;ip route-cache policy&#xA;encapsulation ppp&#xA;ppp authentication pap callin&#xA;ppp pap sent-username &amp;lt;username&amp;gt; password 0 &amp;lt;password&amp;gt;&#xA;ppp ipcp dns request accept&#xA;ppp ipcp route default&#xA;ppp ipcp address accept&#xA;ip nat outside&#xA;ip access-group 101 in&#xA;!ip access-group 102 out&#xA;dialer pool 1&#xA;dialer-group 1&#xA;no cdp enable&#xA;no shut&#xA;exit&#xA;!&#xA;interface GigabitEthernet0/0&#xA;no ip address&#xA;pppoe enable&#xA;pppoe-client dial-pool-number 1&#xA;no cdp enable&#xA;no shut&#xA;no ip redirects&#xA;exit&#xA;!         &#xA;interface GigabitEthernet0/1&#xA;ip address 192.168.2.1 255.255.255.0&#xA;ip nat inside&#xA;! ip access-group 103 in&#xA;ip access-group 104 out&#xA;no cdp enable&#xA;no ip redirects&#xA;no shut&#xA;exit&#xA;!&#xA;do clear ip nat trans *&#xA;!&#xA;ip nat inside source list 1 interface Dialer0 overload&#xA;ip route 0.0.0.0 0.0.0.0 Dialer0&#xA;!&#xA;no ip nat service sip udp port 5060&#xA;no ip nat service sip udp port 5080&#xA;!&#xA;ip nat inside source static tcp 192.168.2.5 53 interface Dialer0 53&#xA;ip nat inside source static udp 192.168.2.5 53 interface Dialer0 53&#xA;ip nat inside source static tcp 192.168.2.15 80 interface Dialer0 80&#xA;ip nat inside source static tcp 192.168.2.15 443 interface Dialer0 443&#xA;ip nat inside source static tcp 192.168.2.10 25 interface Dialer0 25&#xA;ip nat inside source static tcp 192.168.2.10 587 interface Dialer0 587&#xA;ip nat inside source static tcp 192.168.2.10 993 interface Dialer0 993&#xA;ip nat inside source static tcp 192.168.2.10 995 interface Dialer0 995&#xA;ip nat inside source static udp 192.168.2.5 5060 interface Dialer0 5060&#xA;ip nat inside source static udp 192.168.2.20 5080 interface Dialer0 5080&#xA;!&#xA;access-list 1 permit 192.168.2.0 0.0.0.255&#xA;!&#xA;ip access-list extended 101&#xA;deny icmp any any echo&#xA;deny icmp any any redirect&#xA;deny icmp any any timestamp-request&#xA;deny icmp any any information-request&#xA;deny icmp any any mask-request&#xA;permit ip any any&#xA;exit&#xA;!&#xA;ip access-list extended 102&#xA;permit ip any any&#xA;exit&#xA;!&#xA;ip access-list extended 103&#xA;permit ip any any&#xA;exit&#xA;!&#xA;&#xA;ip access-list extended 104&#xA;permit tcp any host 192.168.2.5 eq 53&#xA;permit udp any host 192.168.2.5 eq 53&#xA;permit tcp any host 192.168.2.10 eq 25&#xA;permit tcp any host 192.168.2.10 eq 587&#xA;permit tcp any host 192.168.2.10 eq 993&#xA;permit tcp any host 192.168.2.10 eq 995&#xA;permit tcp any host 192.168.2.15 eq 80&#xA;permit tcp any host 192.168.2.15 eq 443&#xA;permit udp host 205.205.22.186 host 192.168.2.5 eq 5060&#xA;permit udp host 205.205.74.186 host 192.168.2.5 eq 5060&#xA;permit udp host 70.83.45.11 host 192.168.2.5 eq 5060&#xA;permit udp any host 192.168.2.20 eq 5080&#xA;permit udp any host 192.168.2.5 range 8000 65535&#xA;permit tcp any eq 25 host 192.168.2.10 range 1024 65535 established&#xA;permit tcp any eq 53 host 192.168.2.5 range 1024 65535 established&#xA;permit tcp any eq 53 host 192.168.2.10 range 1024 65535 established&#xA;permit tcp any eq 53 host 192.168.2.15 range 1024 65535 established&#xA;permit tcp any eq 53 host 192.168.2.20 range 1024 65535 established&#xA;permit udp any eq 53 host 192.168.2.5 range 1024 65535&#xA;permit udp any eq 53 host 192.168.2.10 range 1024 65535&#xA;permit udp any eq 53 host 192.168.2.15 range 1024 65535&#xA;permit udp any eq 53 host 192.168.2.20 range 1024 65535&#xA;permit tcp any eq 80 host 192.168.2.5 range 1024 65535 established&#xA;permit tcp any eq 80 host 192.168.2.10 range 1024 65535 established&#xA;permit tcp any eq 80 host 192.168.2.15 range 1024 65535 established&#xA;permit tcp any eq 80 host 192.168.2.20 range 1024 65535 established&#xA;deny ip any host 192.168.2.5 log&#xA;deny ip any host 192.168.2.10 log&#xA;deny ip any host 192.168.2.15 log&#xA;deny ip any host 192.168.2.20 log&#xA;permit ip any any&#xA;exit&#xA;! Stops pinging but needed for RTP relay&#xA;ip nat inside source static 192.168.2.5 77.77.77.77 route-map voip-rtp extendable&#xA;!&#xA;! dialer-list 1 protocol ip permit&#xA;! route-map voip-rtp permit 1&#xA;! match ip address 104&#xA;! exit&#xA;!&#xA;!&#xA;! QOS&#xA;class-map voice&#xA;match protocol rtp audio&#xA;exit&#xA;!&#xA;policy-map wan-qos&#xA;class voice&#xA;bandwidth percent 60&#xA;exit&#xA;exit&#xA;!&#xA;policy-map parent&#xA;class class-default&#xA;shape average 10000000&#xA;service-policy wan-qos&#xA;exit&#xA;exit&#xA;!&#xA;interface GigabitEthernet0/0&#xA;bandwidth 10000&#xA;service-policy output wan-qos&#xA;exit&#xA;!&#xA;!&#xA;! Securing Cisco&#xA;ip tcp synwait-time 30&#xA;ip inspect name InspectRule icmp&#xA;ip inspect name InspectRule tcp&#xA;ip inspect name InspectRule udp&#xA;&#xA;&#xA;no service dhcp&#xA;no ip bootp server&#xA;no service finger&#xA;no ip http server&#xA;no ip http secure-server&#xA;no snmp-server&#xA;no service config&#xA;no ip gratuitous-arps &#xA;no ip source-route&#xA;ip options drop&#xA;!&#xA;service tcp-keepalives-in&#xA;service tcp-keepalives-out&#xA;service timestamps debug datetime msec show-timezone localtime&#xA;service timestamps log datetime msec show-timezone localtime &#xA;!         &#xA;&#xA;do write mem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The config works as expected (ie, allows and blocks). There are parts however &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Those two lines do not really do anything. Do I really need them?&#xA; ip route 0.0.0.0 0.0.0.0 Dialer0&#xA; ip nat inside source static 192.168.2.5 77.77.77.77 route-map voip-rtp extendable&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;ii) More importantly, I am trying to remove the dynamic route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ip nat inside source list 1 interface Dialer0 overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I suspect the dynamic route as the cause for crashing of the router however, if I remove this line, the servers still serve up services (ie, SMTP HTTP, SIP) bidirectional however, other computers in the network have no internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried many things to exclude the dynamic route map by everything has failed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nick.&lt;/p&gt;&#xA;" OwnerUserId="3706" LastEditorUserId="3706" LastEditDate="2015-09-15T01:36:51.770" LastActivityDate="2015-12-19T16:24:50.463" Title="Understanding CISCO Outbound NAT" Tags="|cisco|nat|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22421" PostTypeId="2" ParentId="22420" CreationDate="2015-09-12T12:25:06.317" Score="1" Body="&lt;p&gt;The majority of websites now try HTTPS first so may you need to forward port 443 as well as port 8080.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2015-09-12T20:10:29.140" LastActivityDate="2015-09-12T20:10:29.140" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22422" PostTypeId="2" ParentId="22403" CreationDate="2015-09-12T12:32:19.753" Score="2" Body="&lt;p&gt;According this wikipedia article:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/E-carrier#E4:_multiplexing_level_4:_140.C2.A0Mbit.2Fs&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/E-carrier#E4:_multiplexing_level_4:_140.C2.A0Mbit.2Fs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;States that E4 has a Data rate of 139.26 Mbps and 2048 channels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of use it just seems to be another PDH multiplexed framing unit of data, capable of being used in a larger trunk fibre framing such as STM-n.&lt;/p&gt;&#xA;" OwnerUserId="17733" LastActivityDate="2015-09-12T12:32:19.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22423" PostTypeId="2" ParentId="22407" CreationDate="2015-09-12T12:46:40.580" Score="2" Body="&lt;p&gt;Yes there is a difference. The STM and STS framing units are both Time Division Multiplexing protocols operating at layer 1 in the OSI networking stack. They help to arrange the data into time divided channels on the optical fibre. Exactly 24 time slots at the level 0 channel rate of DS0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The use of the word frame in this layer 1 context appears to be an unfortunate ambiguity as it is not connected to the layer 2 'frame' datagram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer 2 datalink layer in the OSI stack may use a number of protocols such as PPP over a WAN to wrap layer 3 data with headers and footers into a 'frame' datagram for transmission by lower layer 1 technology.&lt;/p&gt;&#xA;" OwnerUserId="17733" LastActivityDate="2015-09-12T12:46:40.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22424" PostTypeId="2" ParentId="22418" CreationDate="2015-09-12T13:39:21.857" Score="2" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;first&lt;/em&gt;&lt;/strong&gt; of all&lt;br&gt;&#xA;there is no host called 209.85.2.0 this is sort of network , you must configure it as a network not as a host &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;permit udp 209.85.2.0 0.0.0.255 host 192.168.2.5 eq 5060 log&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;second&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;you don't need&lt;br&gt;&#xA;&lt;em&gt;deny ip any any log&lt;/em&gt;&lt;br&gt;&#xA;&lt;em&gt;deny tcp any any log&lt;/em&gt;&lt;br&gt;&#xA;&lt;em&gt;deny udp any any log&lt;/em&gt;&lt;br&gt;&#xA;cause the access list has its own explicate deny so in your case you just need to permit the type of access you want &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;third&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA; you need to know that access list working by the concept of the first match &#xA;where for example as you configured your access list that is mean ,When any one in 209.85.2.0 need to access host 192.168.2.5 ,this access list will allow only UDP access on port 5060 by its first line.     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you have other 3 cases that won't match this line and will go to next ACL lines&lt;br&gt;&#xA; 1. Any network other than  209.85.2.0 need to access 192.168.2.5&lt;br&gt;&#xA; 2. Any one in network  209.85.2.0 need to access anything other than 192.168.2.5&lt;br&gt;&#xA; 3. Any one need to access any other network   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;your ACL second line means you will permit any one to access anything &lt;em&gt;even  192.168.2.5 on port 5060&lt;/em&gt;.&lt;strong&gt;which is wrong&lt;/strong&gt; . if you need to prevent any other network from access this host you just need to insert those 3 lines after your first line &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;deny ip any host  192.168.2.5 log&lt;/em&gt;&lt;/strong&gt;     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and then insert&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;permit ip any any log&lt;/em&gt;&lt;/strong&gt; which will allow access to other servers from any where&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-13T08:35:48.247" LastActivityDate="2015-09-13T08:35:48.247" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22425" PostTypeId="1" AcceptedAnswerId="22426" CreationDate="2015-09-12T13:55:25.990" Score="4" ViewCount="4022" Body="&lt;p&gt;How does the &lt;code&gt;traceroute -A&lt;/code&gt; command work? How does the program look up the ASN? On which protocols or databases does the query depend? Can I recreate the &lt;code&gt;-A&lt;/code&gt; option?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using this version: &lt;code&gt;Modern traceroute for Linux, version 2.0.18, Jun 30 2012&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2017-03-27T12:25:25.663" Title="traceroute -A - how does the lookup work?" Tags="|traceroute|peering|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22426" PostTypeId="2" ParentId="22425" CreationDate="2015-09-12T14:33:46.280" Score="2" Body="&lt;p&gt;A whois query is made for every IP returend.&lt;/p&gt;&#xA;&lt;p&gt;Here is a manual example. Get one of the IPs of networkengineering.stackexchange.com&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; host networkengineering.stackexchange.com&#xA;networkengineering.stackexchange.com has address 104.16.12.128&#xA;networkengineering.stackexchange.com has address 104.16.14.128&#xA;networkengineering.stackexchange.com has address 104.16.15.128&#xA;networkengineering.stackexchange.com has address 104.16.13.128&#xA;networkengineering.stackexchange.com has address 104.16.16.128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And check which AS the IP belongs to:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; &amp;gt; whois 104.16.12.128  | grep -i origin&#xA; OriginAS:       AS13335&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Whois outpus way more information. The protocol ist specified in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3912&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC3912&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Note that whois output of the regional registries differ and not all will provide the origin as. So traceroute -A will not provide AS informations for all addresses.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="-1" LastEditorDisplayName="user2084" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2017-03-25T11:15:36.090" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="22427" PostTypeId="2" ParentId="19469" CreationDate="2015-09-12T15:37:52.847" Score="-1" Body="&lt;p&gt;Try this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list DMZ_nat0_outbound extended permit ip any 192.168.10.0 255.255.255.0 &#xA;&#xA;nat (DMZ) 0 access-list DMZ_nat0_outbound&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18963" LastActivityDate="2015-09-12T15:37:52.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22428" PostTypeId="1" AcceptedAnswerId="22429" CreationDate="2015-09-12T17:26:17.283" Score="0" ViewCount="109" Body="&lt;p&gt;When ISPs connect with each other via peering or through transit who among the two owns the ip address between them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To explain my question further, When ISPs peer, the links between them must be allocated ip addresses. I think they would be global addresses. How would ISPs decide on this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also what would be the general architecture at ISPs interconnection?&lt;/p&gt;&#xA;" OwnerUserId="7651" LastActivityDate="2015-09-12T17:39:37.440" Title="Who owns address betwen ISP links?" Tags="|ip|isp|peering|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22429" PostTypeId="2" ParentId="22428" CreationDate="2015-09-12T17:39:37.440" Score="1" Body="&lt;p&gt;When ISPs peer on e.g. an internet exchange then the internet exchange provides the addresses for the peering LANs. When ISPs set up a private interconnection then one of them provides the addresses. It doesn't matter which one.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-09-12T17:39:37.440" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="22433" PostTypeId="1" CreationDate="2015-09-12T19:52:59.310" Score="5" ViewCount="670" Body="&lt;p&gt;In our factory, we have lighting trunking running above the factory floor, which contains electrical cables and has fluorescent lights hung off the underside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It goes everywhere and could potentially provide a particularly accessible and easy to get to with Cat 6 cable place to mount wifi access points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been warned off doing this in the past - I'm well aware that there's plenty of advice out there that says don't run Cat 6 along with power in the same direction.  But is there any way around that... Do people do it anyway and it doesn't cause issues?  Do the access points themselves suffer from interference due to proximity to electrical cabling or fluorescent lighting?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My other option is to mount access points to a 10 metre high roof using a scissor lift, but getting access and securing cabling along the route to the roof isn't nearly as easy as the lighting trunking.&lt;/p&gt;&#xA;" OwnerUserId="16081" LastEditorUserId="8499" LastEditDate="2018-03-08T04:52:34.193" LastActivityDate="2018-03-08T04:52:34.193" Title="Is it acceptable to run Cat 6 along the top of lighting trunking?" Tags="|ethernet|layer1|cabling|cable|access-point|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22434" PostTypeId="2" ParentId="22433" CreationDate="2015-09-12T20:05:25.550" Score="3" Body="&lt;p&gt;You need proper structured cable pathways. There are standards for this, and your cable installer should be familiar with the &lt;code&gt;ANSI/TIA/EIA-569 Commercial Building Standards for Telecommunications Pathways and Spaces&lt;/code&gt; and follow them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't ever use power pathways to run low-voltage cabling. This can cause problems, and it is violation of the building codes in most most jurisdictions which can result in fines and/or having the building red-tagged, preventing occupation, until the problem is corrected.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-15T03:24:05.343" LastActivityDate="2015-09-15T03:24:05.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22436" PostTypeId="2" ParentId="22396" CreationDate="2015-09-12T22:01:05.300" Score="1" Body="&lt;p&gt;In order to achieve requirements with minimum costs (working with existing cisco 2960s, two Mikrotik routers and one CPE from ISP, where this CPE is covered with SLA) and avoid using single Mikrotik (I trust a bit more to cisco switch than to Mikrotik) I made following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Changed the teamplate of cisco switch to lanbase-routing&lt;/li&gt;&#xA;&lt;li&gt;Created vlan and placed it in the public IP-address range&lt;/li&gt;&#xA;&lt;li&gt;Created VRRP on both Mikrotiks (they are also using public IP addresses)&lt;/li&gt;&#xA;&lt;li&gt;Routed all traffic from Mikrotiks to CPE, but through VRRP interface&lt;/li&gt;&#xA;&lt;li&gt;Created all needed IP addresses on the VRRP interface&lt;/li&gt;&#xA;&lt;li&gt;Now, routing from the network is made by cisco, nat by mikrotiks&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is the simple schema, I've created to illustrate everything (R1, R2 and VR are in VRRP). R1 has 254 priority and R2 is 1, plus preemption-mode enabled (to always use R1 as Master if it is available, I like it more)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TdsJr.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TdsJr.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately it works, now the second part left, start using two switches. How should I implement this I do not know yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All additional IP addresses, that I had to assign to the VRRP work perfectly. Master router puts them up, backup does nothing, for it the VRRP is sort of down.&lt;/p&gt;&#xA;" OwnerUserId="17628" LastActivityDate="2015-09-12T22:01:05.300" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22438" PostTypeId="1" CreationDate="2015-09-13T01:00:51.160" Score="0" ViewCount="138" Body="&lt;p&gt;I want to be able to check the speeds / throughput on my LAN, check for signal strength, interference, dead spots etc. How do I do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having some issues with my wireless, particularly with an Iphone / Ipad and I want to find out why.&#xA;I have Windows &amp;amp; Linux machines available. &lt;/p&gt;&#xA;" OwnerUserId="18969" LastEditorUserId="18969" LastEditDate="2015-09-13T01:40:01.900" LastActivityDate="2015-09-13T08:28:01.453" Title="Wireless network testing software" Tags="|wireless|testing|" AnswerCount="2" CommentCount="9" ClosedDate="2015-09-14T11:19:40.343" ContentLicense="CC BY-SA 3.0" />
  <row Id="22439" PostTypeId="2" ParentId="22438" CreationDate="2015-09-13T01:42:09.043" Score="1" Body="&lt;p&gt;You can buy a wireless tester or get some software for your computer(s) or smartphone to check for signal strength, interference, dead spots etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAN throughput can be checked from PC to PC with the proper software. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Product recommendations are specifically off-topic for this forum.  See the help site.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Off-topic: Product or Resource Recommendations&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Requests for product recommendations, resource recommendations, or&#xA;  polls are off-topic.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;However, polls and recommendations are welcome in the Network&#xA;  Engineering Recommendations Chat Room.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-13T01:42:09.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22440" PostTypeId="2" ParentId="22438" CreationDate="2015-09-13T08:28:01.453" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;useful tool can help you to make good wireless survey is wifi analyzer on the android phones. its can work on both ranges 2.4 and 5 GHZ &#xA;&lt;a href=&quot;https://i.stack.imgur.com/qHaHe.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qHaHe.jpg&quot; alt=&quot;wifi analyzer&quot;&gt;&lt;/a&gt; &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;you can use it to figure out channel utility and it DPI and it can help in find the places of the APs as well &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;on PC insider could be one of the best wireless survey tools &#xA;&lt;a href=&quot;https://i.stack.imgur.com/s0p8O.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/s0p8O.png&quot; alt=&quot;insider&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-13T08:28:01.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22441" PostTypeId="2" ParentId="17582" CreationDate="2015-09-13T10:43:18.813" Score="4" Body="&lt;p&gt;If you want to know which AP your computer is connected to.  You have two options.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Use inSSIDer to investigate your wireless network.  The network that you are connected will be indicated by the green wireless icon.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/uiay1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uiay1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 . Use built-in netsh command in Windows 7 or Windows 8&#xA;To do so, go to your Command Prompt that you can find in Accessories or click on the Windows button (Windows 7) or press Windows button on keyboard (Windows 8), and then type cmd&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Command Prompt will be listed in front of you.  Click on it and type the following command line&lt;/p&gt;&#xA;&#xA;&lt;p&gt;netsh wlan show interfaces&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TMPwW.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TMPwW.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to focus on is BSSID value.  This is the MAC address of the AP that you are being connected.  Now you can go check the MAC address on the APs’ information label to find out which one you are connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please check thise link &lt;a href=&quot;http://ephams.com/2013/06/09/howto-access-point-connected-to/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Which Access Point am I connected to?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-13T10:43:18.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22442" PostTypeId="1" AcceptedAnswerId="22443" CreationDate="2015-09-13T10:56:06.810" Score="2" ViewCount="371" Body="&lt;p&gt;I have a small LAN with three hosts A,B,C connected through a switch. &#xA;If A pings B, then the arp tables of A and B get populated, as expected.&#xA;But C's arp table remains empty, even though it receives the arp broadcast. &#xA;Is this expected behaviour?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought an arp broadcast always caused each host to update their arp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose that host C would want to ping host A. Because C doesn't know A's mac adress, it must send an arp broadcast. This seems a bit unnecessary. If it had learned A's mac-adress the first time, it wouldn't need to broadcast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone please explain? (and I'd be even more happy if you could point to an official document that verifies this)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks :-)&lt;/p&gt;&#xA;" OwnerUserId="34262" LastActivityDate="2015-09-13T14:03:49.063" Title="third-party arp table empty after ping" Tags="|arp|lan|ping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22443" PostTypeId="2" ParentId="22442" CreationDate="2015-09-13T13:56:49.890" Score="3" Body="&lt;p&gt;If it is following the process laid out in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 826&lt;/a&gt;, then this is expected behavior.  Host C should only update an existing entry if present. It should only add an entry if it is the target of the ARP request.&lt;/p&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 826&lt;/a&gt;, here is the processing flow:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Packet Reception:&#xA;-----------------&#xA;&#xA;When an address resolution packet is received, the receiving&#xA;Ethernet module gives the packet to the Address Resolution module&#xA;*which goes through an algorithm similar to the following.&#xA;Negative conditionals indicate an end of processing and a&#xA;discarding of the packet.&#xA;&#xA;?Do I have the hardware type in ar$hrd?&#xA;Yes: (almost definitely)&#xA;  [optionally check the hardware length ar$hln]&#xA;  ?Do I speak the protocol in ar$pro?&#xA;  Yes:&#xA;    [optionally check the protocol length ar$pln]&#xA;    Merge_flag := false&#xA;    If the pair &amp;lt;protocol type, sender protocol address&amp;gt; is&#xA;        already in my translation table, update the sender&#xA;        hardware address field of the entry with the new&#xA;        information in the packet and set Merge_flag to true.&#xA;    ?Am I the target protocol address?&#xA;    Yes:&#xA;      If Merge_flag is false, add the triplet &amp;lt;protocol type,&#xA;          sender protocol address, sender hardware address&amp;gt; to&#xA;          the translation table.&#xA;      ?Is the opcode ares_op$REQUEST?  (NOW look at the opcode!!)&#xA;      Yes:&#xA;        Swap hardware and protocol fields, putting the local&#xA;            hardware and protocol addresses in the sender fields.&#xA;        Set the ar$op field to ares_op$REPLY&#xA;        Send the packet to the (new) target hardware address on&#xA;            the same hardware on which the request was received.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-09-13T13:56:49.890" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22445" PostTypeId="1" AcceptedAnswerId="22446" CreationDate="2015-09-13T18:36:57.110" Score="1" ViewCount="6559" Body="&lt;p&gt;I have a TCP packet as displayed by Wireshark:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/R07JJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/R07JJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MSS is reported at &lt;em&gt;1430&lt;/em&gt; bytes, and the Window scale suggests that this should be multiplied by &lt;em&gt;128&lt;/em&gt;, giving &lt;em&gt;183040&lt;/em&gt; bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt; is this the correct way to calculate the MSS?&lt;/p&gt;&#xA;" OwnerUserId="8038" LastEditorUserId="8038" LastEditDate="2015-09-13T19:08:13.640" LastActivityDate="2015-10-29T23:54:29.287" Title="how to calculate the MSS in wireshark when the window scaling option is set?" Tags="|tcp|wireshark|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22446" PostTypeId="2" ParentId="22445" CreationDate="2015-09-13T22:19:49.407" Score="6" Body="&lt;p&gt;No, the correct way to calculate the MSS is to look at the value in the MSS option.  As per &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1323#section-2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1323&lt;/a&gt;, the Window Scale option scales the TCP window size, not the maximum segment size.  The maximum segment size should be set appropriately for the network path between the two endpoints, so that no segment has to be fragmented; there's no requirement that the MSS be big enough that a single segment can always fill the entire receive window, so there'd only be a need for scaling the MSS if you have a network path with an MTU bigger than 65535.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2015-09-13T22:19:49.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22449" PostTypeId="1" AcceptedAnswerId="22450" CreationDate="2015-09-14T03:23:49.110" Score="1" ViewCount="74" Body="&lt;p&gt;Are there any routers than can failover twice? like having 3 WAN ports or 2 WAN ports + a built-in 3G modem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say like primary WAN is 100 mbps ethernet from ISP, secondary is a Cable Modem and tertiary is a 3G modem (either plugged into a 3rd WAN port or built into the router)&lt;/p&gt;&#xA;" OwnerUserId="18989" LastActivityDate="2015-09-14T03:31:14.850" Title="Is there such a thing as dual failover routers?" Tags="|router|wireless|failover|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22450" PostTypeId="2" ParentId="22449" CreationDate="2015-09-14T03:31:14.850" Score="2" Body="&lt;p&gt;Yes, you just need some way to &quot;rate&quot; your preference for the WAN ports such as administrative distance.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-14T03:31:14.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22451" PostTypeId="1" CreationDate="2015-09-14T04:16:43.007" Score="1" ViewCount="466" Body="&lt;p&gt;My hostel is in the process of implementing AAA using 802.1x, PEAP + MSCHAPv2 on Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a DLINK 850L router, is it possible to configure it to connect to 802.1x? DD-WRT is not available for this (Realtek chipset).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not looking for exact instructions, rather the general direction I need to look at.&lt;/p&gt;&#xA;" OwnerUserId="18990" LastActivityDate="2015-09-14T04:16:43.007" Title="Configure a DLINK AP to connect to 802.1x LAN" Tags="|router|ethernet|ieee-802.1x|" AnswerCount="0" CommentCount="3" ClosedDate="2015-09-14T11:21:23.903" ContentLicense="CC BY-SA 3.0" />
  <row Id="22452" PostTypeId="1" CreationDate="2015-09-14T04:37:46.130" Score="1" ViewCount="36" Body="&lt;p&gt;I have a situation where my outhouse is bit far from the home.And both have two electricity connections.Will it be possible to use a powerline adapter between the main transmission lines to share the Internet ?&#xA;What will be the loss if I do so?&#xA;I am from India where the voltage is 240 V and frequency is 50hz. &lt;/p&gt;&#xA;" OwnerUserId="18991" LastActivityDate="2015-09-14T04:37:46.130" Title="powerline network adapters between main transmission line" Tags="|routing|ieee-802.11|" AnswerCount="0" CommentCount="3" ClosedDate="2015-09-14T11:20:03.363" ContentLicense="CC BY-SA 3.0" />
  <row Id="22453" PostTypeId="1" CreationDate="2015-09-14T04:39:42.393" Score="1" ViewCount="139" Body="&lt;p&gt;Myself testing my internal firewall from external network,What were the effective ways of testing my firewall and ensuring that it secure&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The methods which i tried were launching a stealth scan with sending ack packets to the firewall and checked whether my firewall filtering all my ports,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;using nmap i tested using following commands :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nmap -v -sA -n mydomain -OA firewallaudit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;other than that i tried to repeatedly ping the firewall and tested whether it rejects and blocks the floods of attacks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its an internal firewall and myself testing for internal and external attacks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the above said were the normal tests which i carried out to test my internal firewall,other than above anyother options to ensure that firewall is safe?how can i test my firewall that its efficiently configured or not?&lt;/p&gt;&#xA;" OwnerUserId="2759" LastEditorUserId="2759" LastEditDate="2015-09-14T05:31:41.370" LastActivityDate="2015-09-14T05:31:41.370" Title="What were the effective ways to test my firewall" Tags="|firewall|fortigate|" AnswerCount="0" CommentCount="7" ClosedDate="2015-09-16T20:12:52.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="22454" PostTypeId="1" CreationDate="2015-09-14T06:35:12.400" Score="1" ViewCount="73" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;It may out of scope but I have to research on Network security. I have&#xA;  worked on Signal Processing in Time-Frequency down during Post&#xA;  Graduation research and have few publication. Now my interest has been&#xA;  changed to networking. I was qualify CCNA certification and complete&#xA;  study of CCNP route. Now I wanna to apply PhD in Network Security.&#xA;  Please suggest me some possible online/Offline resource and how to&#xA;  prepare for PhD?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8007" LastEditorUserId="17646" LastEditDate="2015-09-14T07:01:54.147" LastActivityDate="2015-09-14T07:01:54.147" Title="How to proceed for research on Network security?" Tags="|ipv4|security|network-core|network-discovery|" AnswerCount="0" CommentCount="2" ClosedDate="2015-09-14T17:24:14.827" ContentLicense="CC BY-SA 3.0" />
  <row Id="22455" PostTypeId="1" AcceptedAnswerId="22497" CreationDate="2015-09-14T08:20:00.823" Score="2" ViewCount="730" Body="&lt;p&gt;This started as a question, with my connection failing to come up, but after a bit of trial and error, the configuration is working, so I've edited it into a solution. Access lists and address translation is not 100% in the config below yet, but it covers the connection setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup: I have a Cisco router with 2 ethernet ports and another ADSL router with the ATM interface. My service provider offers a static IP for ADSL via an L2TP tunnel (l2tp service ip, shared secret provided, adsl username / password for auth). I want to configure the connection and the tunnel on the Cisco - 1 ethernet port internal (fa0/1), with the L2TP tunnel interface being the external / public IP on the other ethernet port (fa0/0) - but also still maintain a private network between the Cisco and other DSL router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internal network: 192.168.0.0/24&#xA;Private network between Cisco and other router: 10.0.0.0/24 (or could be /30).&#xA;Other router is configured in PPPoE bridge mode / pass through.&#xA;L2TP service: 1.2.3.4&#xA;Shared secret: 54321&#xA;ADSL username / pass: myuser@myisp / mypass&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;aaa authentication ppp default local&#xA;&#xA;l2tp-class l2tp_secret&#xA;  hidden&#xA;  authentication&#xA;  hello 10&#xA;  password 54321&#xA;&#xA;pseudowire-class l2tp_config&#xA;  encapsulation l2tpv2&#xA;  protocol l2tpv2 l2tp_secret&#xA;  ip local interface Dialer1&#xA;&#xA;interface FastEthernet0/0&#xA; description WAN / PPPoE Interface&#xA; ip address 10.0.0.10 255.255.255.0&#xA; ip virtual-reassembly&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 10&#xA;&#xA;interface FastEthernet0/1&#xA; description LAN&#xA; ip address 192.168.0.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; ip tcp adjust-mss 1412&#xA; no ip mroute-cache&#xA;&#xA;interface Virtual-PPP1&#xA; description L2TP Tunnel for static IP&#xA; ip address negotiated&#xA; ip mtu 1452&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; ip tcp adjust-mss 1412&#xA; shutdown&#xA; no cdp enable&#xA; ppp authentication pap callin&#xA; ppp pap sent-username myuser@myisp password 0 mypass&#xA; pseudowire 1.2.3.4 1 pw-class l2tp_config&#xA;&#xA;interface Dialer1&#xA; ip address negotiated&#xA; encapsulation ppp&#xA; shutdown&#xA; dialer pool 10&#xA; ppp authentication pap callin&#xA; ppp pap sent-username myuser@myisp password 0 mypass&#xA; ppp ipcp route default&#xA;&#xA;ip route 0.0.0.0 0.0.0.0 Virtual-PPP1&#xA;ip route 1.2.3.4 255.255.255.255 Dialer1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18938" LastEditorUserId="509" LastEditDate="2015-09-15T08:01:26.353" LastActivityDate="2015-09-15T08:01:44.193" Title="Cisco PPPoE over FA with L2TP client only (no IPSec)" Tags="|cisco|pppoe|l2tp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22456" PostTypeId="1" AcceptedAnswerId="22498" CreationDate="2015-09-14T08:20:52.003" Score="2" ViewCount="91" Body="&lt;p&gt;Still trying to understand the &lt;strong&gt;IP slash notation&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am configuring my OSX laptop to connect to the Internet behind the corporate proxy.&#xA;For the loopback address to work on my local machine after setting the proxy IP and port, I set up &lt;code&gt;127.255/8&lt;/code&gt; as an exception (that is, I suppose: addresses my computer will contact directly without using the proxy). What I want to do is to exclude the entire range from &lt;code&gt;127.0.0.1&lt;/code&gt; to &lt;code&gt;127.255.255.255&lt;/code&gt; from being looked up through the proxy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to put &lt;code&gt;127/8&lt;/code&gt; but this notation does not work, I guess because there could be ambiguity in a text field where I can put unresolved addresses (google.com) as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is: has that &quot;255&quot; some relevance? Could I put anything between 0 to 255 after the dot? Or should I put a dummy address (&lt;code&gt;127.255.255.255/8&lt;/code&gt;) just to fill in the groups?&lt;/p&gt;&#xA;" OwnerUserId="13736" LastEditorUserId="13736" LastEditDate="2015-09-16T09:12:50.917" LastActivityDate="2015-09-16T09:12:50.917" Title="Do bits outside netmask count when defining a range of IP's?" Tags="|lan|proxy|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22457" PostTypeId="1" CreationDate="2015-09-14T09:21:43.073" Score="2" ViewCount="13310" Body="&lt;p&gt;We have two links for a site , both the links are running OSPF , if one of the link keeps flapping the network at site becomes unstable. &#xA;How do it make the flapping link down automatically  &lt;/p&gt;&#xA;" OwnerUserId="8828" LastActivityDate="2016-04-27T19:57:10.637" Title="OSPF is flapping and how to overcome it?" Tags="|ospf|" AnswerCount="4" CommentCount="0" ClosedDate="2017-08-10T19:02:11.577" ContentLicense="CC BY-SA 3.0" />
  <row Id="22458" PostTypeId="2" ParentId="22457" CreationDate="2015-09-14T10:29:57.393" Score="1" Body="&lt;p&gt;If the link flaps OSPF will run the SPF algorithm afresh to re-calculate the shortest path to all available destinations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can change the throttle numbers to make the network more stable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default timers are below&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Initial SPF schedule delay 5000 msecs&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Minimum hold time between two consecutive SPFs 10000 msecs&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Maximum wait time between two consecutive SPFs 10000 msecs&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;SPF calculations occur at the interval set by the timers throttle spf command. The wait interval indicates the amount of time to wait until the next SPF calculation occurs. just tune those timers to force OSPF recalculate &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look at this link on how to change it.&#xA;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2s/feature/guide/fs_spftrl.html&quot; rel=&quot;nofollow&quot;&gt;OSPF throttle tune&lt;/a&gt;&lt;br&gt;&#xA;and for very useful TS command &lt;a href=&quot;https://simplifymycisco.wordpress.com/2012/03/30/51/&quot; rel=&quot;nofollow&quot;&gt;OSPF TS&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-14T11:20:26.667" LastActivityDate="2015-09-14T11:20:26.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22459" PostTypeId="1" AcceptedAnswerId="22468" CreationDate="2015-09-14T11:57:37.057" Score="2" ViewCount="117" Body="&lt;p&gt;I am connecting to internet via a 3g dongle(that is via a local ISP). When I connect to the internet, my computer is assigned a dynamic IP. I can find this by going to &lt;a href=&quot;https://www.whatismyip.com/&quot; rel=&quot;nofollow&quot;&gt;whatismyip&lt;/a&gt;. I tried to ping my computer for that dynamic IP from another computer which is connected to internet via the same ISP. But when I pinged it I got request time out response. That means I can't exchange data between those two machines. If I have a computer with static IP which I can use to exchange data between two machines which I mentioned previously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, Is it possible to ping (in other words to exchange data) a computer which is connected to internet with dynamic IP?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Background for the question is I thought to develop a software like teamviewer. I initially thought there was no involvement in third party computer with static IP when I do a screen share with teamviewer. But with the above mentioned observation, I feel there should be a middle machine with static IP is involved (Correct me if I am wrong) at least to initiate the conversation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is not possible, what is the theoretical explanation for that? &lt;/p&gt;&#xA;" OwnerUserId="19002" LastEditorUserId="17646" LastEditDate="2015-09-14T12:46:44.953" LastActivityDate="2015-09-15T04:35:08.690" Title="is it necessary to involve computer with static ip to exchange data in internet?" Tags="|ip|internet|ping|" AnswerCount="2" CommentCount="1" ClosedDate="2015-09-15T13:21:25.463" ContentLicense="CC BY-SA 3.0" />
  <row Id="22460" PostTypeId="2" ParentId="22459" CreationDate="2015-09-14T12:19:56.530" Score="1" Body="&lt;p&gt;i think the one of the best possible ways is to establish VPN connection between the two PC . make use of this video &lt;a href=&quot;https://www.youtube.com/watch?v=8ZeerKipr3g&quot; rel=&quot;nofollow&quot;&gt;vpn setup&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-14T12:19:56.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22461" PostTypeId="2" ParentId="22457" CreationDate="2015-09-14T12:41:25.500" Score="1" Body="&lt;p&gt;Tuning OSPF timers is a good idea, but there are methods for shutting down a flapping interface on lower levels.&#xA;For example, Cisco switches have a feature which puts a port into err-disabled state thus effectively stopping transmission over this interface is it flaps more that 5 times in 10 seconds (&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/69980-errdisable-recovery.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/69980-errdisable-recovery.html&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover you can you can tune the defaults of this feature using info from this post &lt;a href=&quot;https://supportforums.cisco.com/document/25101/how-configure-errdisable-flap-setting-values-cisco-catalyst-switches-running-cisco&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/document/25101/how-configure-errdisable-flap-setting-values-cisco-catalyst-switches-running-cisco&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17411" LastEditorUserId="17411" LastEditDate="2015-09-14T13:15:34.503" LastActivityDate="2015-09-14T13:15:34.503" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22462" PostTypeId="1" CreationDate="2015-09-14T12:47:51.033" Score="1" ViewCount="60" Body="&lt;p&gt;I'm currently studying for an upcomming exam and I came across the following question, the IP-Addresses are to be filled in by me and this is my try at solving it, but I'm not sure if the IP-Address, especially for the tunnels(tun), are correct.&lt;br&gt;&#xA;I'm also unsure as to what IPv6 address the client E should get, as I don't have any network address to base my IPv6-Address on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HeNm2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HeNm2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Where C is a router that can only work with IPv4 addresses and E is a client that can only handle IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for your help!&lt;/p&gt;&#xA;" OwnerUserId="19005" LastActivityDate="2015-09-14T12:47:51.033" Title="IPv6 network addresses with 6to4 router and tunnel" Tags="|ipv4|ipv6|" AnswerCount="0" CommentCount="2" ClosedDate="2015-09-14T17:28:13.167" ContentLicense="CC BY-SA 3.0" />
  <row Id="22463" PostTypeId="1" CreationDate="2015-09-14T13:02:43.943" Score="2" ViewCount="1751" Body="&lt;p&gt;I'm running IPSEC-VPN (AES256/SHA256/DH14) tunnel between a PaloAlto PA-500 and a Fortigate 110C via Internet (10MBit up/down guaranteed both sides - latency between 40 and 50ms).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;90% connections are ICA/HDX connections (TCP 1494 and 2598) for XenDesktop connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The connection is working not very well. The ICA-sessions are quite stable most of the time but some hangs and freezes from time to time and very low file transfer speeds of physical clients. So I captured data at a tunnel end and saw that I have a huge amount of retransmissions/duplicates ACKs/reassembly errors/...). There are about 15 to 40% of all packets through my tunnel are Dups ands Retrans packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody help me where to start my debugging/solving? I think this are the causes of my problems - right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. ICA-Traffic&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EQFTU.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EQFTU.jpg&quot; alt=&quot;e.g. ICA-Traffic&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g. RDP-Traffic&#xA;&lt;a href=&quot;https://i.stack.imgur.com/xJjeP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xJjeP.jpg&quot; alt=&quot;e.g. RDP-Traffic&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot for any help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stony&lt;/p&gt;&#xA;" OwnerUserId="18996" LastActivityDate="2016-12-14T15:35:52.747" Title="High count of packet retransmissions/Dups over IPSEC/VPN" Tags="|vpn|ipsec|wireshark|mtu|" AnswerCount="0" CommentCount="2" ClosedDate="2019-12-20T00:17:48.993" ContentLicense="CC BY-SA 3.0" />
  <row Id="22464" PostTypeId="1" CreationDate="2015-09-14T13:21:22.480" Score="7" ViewCount="190" Body="&lt;p&gt;We have a router with NAT enabled on our edge. The NAT inside is 10.0.0.0/24. Now, we're running out IP blocks and we wish to change this to 10.0.0.0/22. We can do this quickly on the NAT router.  But for the host devices, do we need to replace their subnet mask as well and use /22? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a mix of DHCP and Static IP address users here. My initial thought is we can skip them from changing the Subnet Mask and still use /24 since the default gateway is still 10.0.0.1. Is this a correct assumption? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="18808" LastEditorUserId="8499" LastEditDate="2018-03-19T19:07:58.917" LastActivityDate="2018-08-15T21:32:20.117" Title="Is IP address Subnet Renumbering needed here?" Tags="|ipv4|ip|nat|subnet|ip-address|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22465" PostTypeId="1" CreationDate="2015-09-14T13:21:45.573" Score="3" ViewCount="349" Body="&lt;p&gt;We have the situation where we need to network an isolated room in a building to a network on the other side of the building but with an 3rd party company owning all the rooms between them (they lease us our rooms). The building is 300 years old and has thick stone walls not conducive to new cabling or Wi-Fi. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At some point, a CAT5 network was installed in the part of the building we need to span, and this network happens to reach nearly all the way across the building.  We want to join our &quot;room A&quot; and &quot;room E&quot; networks together, without giving the company that owns the rooms the middle (B,C &amp;amp; D) any visibility of our network (or vice-versa). Clearly the best solution would be to run a new cable through the other company's office, but in practice this will be very disruptive in our 300 year old building, so I'm wondering if there's a way to utilize their cabling in a secure way (for both parties).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any devices which would allow us to create a private VPN which runs over the other company's network, without ever exposing either network to the other?  Essentially what we're trying to do is a bit like the idea of using HomePlug adapters, but using someone else's CAT 5 network instead of mains cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing which help: We have a Fortigate firewall which could potentially act as a VPN host is in a room which adjoins their network. &lt;/p&gt;&#xA;" OwnerUserId="19006" LastEditorUserId="8499" LastEditDate="2015-10-14T23:01:22.530" LastActivityDate="2016-01-13T06:21:54.653" Title="Easiest way to create VPN over a LAN (with good reason!)" Tags="|vpn|lan|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22466" PostTypeId="2" ParentId="22464" CreationDate="2015-09-14T14:05:50.787" Score="6" Body="&lt;p&gt;Yes, you should change the netmask to /22 on all the devices.   While some things may work, there is a lot of potential for problems, especially when internal devices talk to each other.  It may seem like a PITA, but changing the netmask will save you lots of late night troubleshooting later on.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-09-14T14:05:50.787" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22467" PostTypeId="2" ParentId="22465" CreationDate="2015-09-14T14:12:16.663" Score="3" Body="&lt;p&gt;A VPN tunnel is a reasonable solution to this problem.  I'm assuming just a few users in the isolated room, so any router or firewall with VPN capabilities would probably be fine.  There would be one device in room A and one in room E.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-09-14T14:12:16.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22468" PostTypeId="2" ParentId="22459" CreationDate="2015-09-14T14:44:28.000" Score="3" Body="&lt;p&gt;The answer to your question.&quot;&lt;em&gt;Is it possible to ping (in other words to exchange data) a computer which is connected to internet with dynamic IP?&lt;/em&gt;&quot; is yes, but with caveats:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You need to know the currently assigned IP address of the host that you are trying to ping. The dynamic IP address probably doesn't change for an extended period of time or until the host restarts.&lt;/li&gt;&#xA;&lt;li&gt;Are the hosts themselves configured to respond to pings?&lt;/li&gt;&#xA;&lt;li&gt;Is there some sort of firewall in between the to hosts? This could&#xA;either be a physical box, or it could be something like the Windows&#xA;built-in firewall. The firewall(s) could block you from pinging.&lt;/li&gt;&#xA;&lt;li&gt;Is one side or the other (or both) using NAT? NAT can prevent pings from reaching the host to which you are trying to connect.&lt;/li&gt;&#xA;&lt;li&gt;Since you say the hosts are both on the same ISP, does the ISP block or allow one customer to ping another customer? Some ISPs block this.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If both hosts are directly connected to the Internet with no NAT or firewall (hardware of software) in between, and you know the dynamic address of the the other host, you should be able to ping the other host. This assumes your ISP is not blocking such things. For instance, the cable ISP I use is blocking the ability to ping from one customer to another within its network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Not having a firewall protecting your company's network is a very foolish thing to do. My guess it that your company has a firewall that prevents pings from one host to another over the Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-15T04:35:08.690" LastActivityDate="2015-09-15T04:35:08.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22469" PostTypeId="2" ParentId="22408" CreationDate="2015-09-14T15:18:47.433" Score="4" Body="&lt;p&gt;I looked again and found I was using the wrong ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches were configured with a GT96100-FE (2 ports) and a NM-16ESW module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was using the GT9600 ports (fa0/0 -fa0/1) which don't even support switchport mode commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I plugged everything into the NM module and it worked as expected. Sorry my bad!&lt;/p&gt;&#xA;" OwnerUserId="13362" LastActivityDate="2015-09-14T15:18:47.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22470" PostTypeId="2" ParentId="22465" CreationDate="2015-09-14T15:26:19.140" Score="0" Body="&lt;p&gt;You could simply configure a small router on your ends of the network with a site-to-site VPN and treat their network as &quot;untrusted&quot; as if it were any other public/Internet connection. Your Fortigate can most certainly terminate one end if you have cable between it and your other location. Just add a small router/firewall with compatible site-to-site VPN capabilities.&lt;/p&gt;&#xA;" OwnerUserId="19009" LastActivityDate="2015-09-14T15:26:19.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22471" PostTypeId="1" CreationDate="2015-09-14T16:06:06.160" Score="1" ViewCount="127" Body="&lt;p&gt;I ran into a little bit of an odd issue this morning. I have a site-to-site VPN tunnel that is up and correctly passing traffic between two sites. Interesting traffic is specified as a /24 at the remote site, and /16 at the headend, and the IPSEC SA is coming up correctly based off of the ACL that specifies that traffic. The head end has multiple subnets, a core router...etc. The remote end is a single subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tunnel is up, and traffic is passing over the tunnel (not traffic to the static devices, traffic to DHCP devices)... for whatever reason though, I was unable to ping devices statically assigned at the remote end from the head end. As soon as I logged into the ASA5505 at the remote end and initiated a ping directly to the static devices, pings from the head end started working. I've never seen this type of behavior from an ASA before, and I've installed dozens of them in similar fashion. Anyone know why this is happening? Maybe an arp setting, or something of the sort?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA at the remote end is on 9.1(6)6. The head-end firewall is a provider-hosted context on a Palo Alto firewall.&lt;/p&gt;&#xA;" OwnerUserId="18856" LastEditorDisplayName="user36472" LastEditDate="2018-02-14T16:38:39.313" LastActivityDate="2018-02-15T14:45:23.850" Title="VPN needs ping directly to a device from the remote ends ASA in order to allow traffic" Tags="|cisco|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22472" PostTypeId="2" ParentId="22456" CreationDate="2015-09-14T16:56:33.130" Score="0" Body="&lt;p&gt;An IP address and its mask are 32 bits each. To get the subnet, you &lt;code&gt;AND&lt;/code&gt;, bitwise, the IP address with the mask. In your example (I assume you mean &lt;code&gt;127.255.0.0/8&lt;/code&gt; as the IP address), only the first 8 bits of the IP address comprise the subnet since &lt;code&gt;127.255.0.0 AND 255.0.0.0&lt;/code&gt; equals &lt;code&gt;127.0.0.0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also subnet further. For instance, &lt;code&gt;127.255.0.0/16&lt;/code&gt; is a subnet of the network &lt;code&gt;127.0.0.0/8&lt;/code&gt; which is an aggregate of all the subnets and addresses with &lt;code&gt;127&lt;/code&gt; in the first octet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @RonTrunk points out, the IP address range of 127.0.0.0/8 is reserved as the host loopback address, so this is not a range you should not use beyond the host on which it is configured. Typically, you would use 127.0.0.1 as the loopback address to refer to the host itself, and each host will use this address to refer to itself so it has a different meanings outside the host on which you use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Putting this on a proxy means that the proxy will use the proxy itself in the exception rule, not the host you intend to be the exception. You must use the LAN IP address of the host in the proxy exception rule, and if you mean only that host, use must use a /32 on the address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really don't think that you should be changing proxy rules if you have such a small understanding of IP addressing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-14T16:56:33.130" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22474" PostTypeId="1" CreationDate="2015-09-14T18:49:00.233" Score="4" ViewCount="140" Body="&lt;p&gt;I have 2 linux servers, Server A with IP 1.1.1.1 and Server B with IP 2.2.2.2 in 2 different geographical locations. I want all the data arriving on a specific TCP port (5678) on Server B to be forwarded to Server A. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried using rinetd for forwarding the data from Server B to Server A. It works fine, however the Source IP received at Server A is changing to the IP address of Server B. I want Server B to act as a simple transparent relay and the Source IP to be the same as the originating client IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to accomplish this task?&lt;/p&gt;&#xA;" OwnerUserId="19012" LastActivityDate="2015-12-14T01:15:43.240" Title="Forwarding data on a port to another external server retaining source IP" Tags="|linux|" AnswerCount="1" CommentCount="4" ClosedDate="2015-12-14T19:10:52.747" ContentLicense="CC BY-SA 3.0" />
  <row Id="22475" PostTypeId="1" CreationDate="2015-09-14T18:59:45.577" Score="5" ViewCount="686" Body="&lt;p&gt;Our IT guy is on vacation for a week, and after an hour on the phone with Dell trying to resolve the issue with no improvement, they gave up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a SonicWALL TZ215 and a 3Com 16 port dual speed switch to run our simple office network. With nothing in the system changing in the last while, the Internet download speeds are 20% of what they should be as of last week.  Speeds directly at the modem are fine, likewise speeds directly at the SonicWALL are fine, and if you bypass the SonicWALL, speeds through the switch are fine.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modem is plugged into x1 and the switch into x0 on the sonic wall.&lt;/p&gt;&#xA;" OwnerUserId="19014" LastEditorUserId="8499" LastEditDate="2016-03-14T17:48:21.923" LastActivityDate="2018-11-27T17:03:20.657" Title="SonicWALL TZ215 and switch issues" Tags="|sonicwall|" AnswerCount="1" CommentCount="9" ClosedDate="2018-12-08T16:50:15.723" ContentLicense="CC BY-SA 3.0" />
  <row Id="22477" PostTypeId="1" AcceptedAnswerId="22478" CreationDate="2015-09-14T19:40:51.923" Score="4" ViewCount="3095" Body="&lt;p&gt;I'm wondering if there is a heuristic plug-in, software or other process for determining protocol when a non-standard TCP port is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark will decode packets based on the well-known port number. For example, TCP 80 will be decoded as HTTP.  There is some level of flexibility, such as the ability to define TCP 8080 traffic as HTTP and to be decoded accordingly.  My question surrounds decoding non-standard port numbers.  You can use the &quot;Decode As...&quot; functionality to do this, provided that the protocol is known.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a session with the server listening on TCP 4443 which is officially &lt;em&gt;Individual Zone Solutions P/L Remote Mail Checking Protocol&lt;/em&gt;, for which there is no decode and I was pretty sure is not what it is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ynT5B.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ynT5B.png&quot; alt=&quot;TCP decode&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took a wild guess, based on the similarity of 443 and 4443 and did a &quot;Decode As...&quot; SSL and was rewarded with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Hr4oy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Hr4oy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This worked, however it could be lots of guessing/trial and error.  Since I can analyze the payload and most likely find clues as to the protocol, is there an automated method to do the same within Wireshark or another tool?&lt;/p&gt;&#xA;" OwnerUserId="5153" LastEditorUserId="5153" LastEditDate="2015-09-14T20:15:56.927" LastActivityDate="2017-01-06T00:47:00.973" Title="Determine protocol decode for non-standard ports in Wireshark" Tags="|tcp|wireshark|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22478" PostTypeId="2" ParentId="22477" CreationDate="2015-09-14T19:45:25.103" Score="2" Body="&lt;p&gt;You need software that does DPI (Deep Packet Inspection). Some companies have made standard rules for some protocols, where in a TCP or UDP packet or some sequence, it can identify the protocol or application that is running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This kind of application realizes an analysis of Layer 7 of a packet, matching the packet content with a huge rules database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like @ojs said, you can try with &lt;a href=&quot;https://github.com/ntop/nDPI&quot; rel=&quot;nofollow noreferrer&quot;&gt;nDPI&lt;/a&gt; from &lt;a href=&quot;http://www.ntop.org/products/deep-packet-inspection/ndpi/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ntop&lt;/a&gt;, test it and see the results. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco also has its own database that can be used with the OPNManager, but requires a license.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="5153" LastEditDate="2017-01-06T00:47:00.973" LastActivityDate="2017-01-06T00:47:00.973" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22480" PostTypeId="1" AcceptedAnswerId="22482" CreationDate="2015-09-14T20:44:37.707" Score="2" ViewCount="175" Body="&lt;p&gt;Is VLAN Trunking Protocol enabled or disabled by default on all switches ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have VTP Domain name showing nothing in command &quot;&quot; show VTP status &quot;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;therfore does this mean VTP is disabled by default on all switches.&lt;/p&gt;&#xA;" OwnerUserId="15438" LastEditorUserId="8499" LastEditDate="2018-12-22T03:24:33.547" LastActivityDate="2018-12-22T03:24:33.547" Title="VLAN Trunking Protocol" Tags="|cisco|switch|vlan|switching|vtp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22482" PostTypeId="2" ParentId="22480" CreationDate="2015-09-14T20:53:40.597" Score="2" Body="&lt;p&gt;Set &lt;code&gt;vtp mode transparent&lt;/code&gt; to disable VTP on a switch.  If VTP version 2 is used, a transparent switch will still forward VTP advertisements, but, in any VTP version, the transparent switch will itself ignore VTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VTP domain name and password must match between switches for VTP to work, and blank (null) VTP domain names and passwords are valid, so any switches set this way will exchange and use VTP advertisements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VTP only travels on trunks.  You can connect switches with access ports but VTP will not propagate across these ports.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-14T20:53:40.597" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22483" PostTypeId="2" ParentId="22474" CreationDate="2015-09-14T21:08:57.550" Score="1" Body="&lt;p&gt;Iptables, which is a utility for configuration of netfilter firewall would do.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/sh&#xA;&#xA;echo 1 &amp;gt; /proc/sys/net/ipv4/ip_forward&#xA;&#xA;iptables -F&#xA;iptables -t nat -F&#xA;iptables -X&#xA;&#xA;iptables -t nat -A PREROUTING -p tcp --dport 5678 -j DNAT --to-destination 2.2.2.2:5678&#xA;iptables -t nat -A POSTROUTING -p tcp -d 2.2.2.2 --dport 5678 -j SNAT --to-source 1.1.1.1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Iptables is very powerful tool so getting accustomed with it is a must (&lt;a href=&quot;http://linux.die.net/man/8/iptables&quot; rel=&quot;nofollow&quot;&gt;http://linux.die.net/man/8/iptables&lt;/a&gt; or just google some tutorials) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you a proxying HTTP protocol - using nginx (&lt;a href=&quot;http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass&quot; rel=&quot;nofollow&quot;&gt;http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_pass&lt;/a&gt;) will be much easier&lt;/p&gt;&#xA;" OwnerUserId="17411" LastEditorUserId="17411" LastEditDate="2015-09-14T21:14:36.853" LastActivityDate="2015-09-14T21:14:36.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22484" PostTypeId="2" ParentId="5910" CreationDate="2015-09-14T21:20:18.940" Score="-1" Body="&lt;p&gt;&lt;a href=&quot;http://www.petenetlive.com/KB/Article/0001108.htm&quot; rel=&quot;nofollow&quot;&gt;Cisco ASA (acl-drop) Flow is denied by configured rule&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pete&lt;/p&gt;&#xA;" OwnerUserId="19016" LastActivityDate="2015-09-14T21:20:18.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22488" PostTypeId="1" AcceptedAnswerId="22489" CreationDate="2015-09-15T01:13:08.443" Score="2" ViewCount="240" Body="&lt;p&gt;I just configured a scenario of point to point frame relay. As shown in the figure, I mapped DLCI as shown below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10:102  20:201&#xA;10:103  30:301&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but I don't able to figure out how my ping from serial3/0.102 are reaching to serial3/0.301 when supposed to reach serial3/0.201 as because the mapping is from 102 to 201?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping from serial 3/0.102:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#ping 192.168.2.2 source serial 3/0.102&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.168.2.2, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.168.1.1&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 104/172/228 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router configurations for Router 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 10.1.1.1 255.255.255.0&#xA; duplex half&#xA;!&#xA;interface Serial3/0&#xA; no ip address&#xA; encapsulation frame-relay&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/0.102 point-to-point&#xA; ip address 192.168.1.1 255.255.255.0&#xA; snmp trap link-status&#xA; frame-relay interface-dlci 102&#xA;!&#xA;interface Serial3/0.103 point-to-point&#xA; ip address 192.168.2.1 255.255.255.0&#xA; snmp trap link-status&#xA; frame-relay interface-dlci 103&#xA;!&#xA;router eigrp 1&#xA; network 10.0.0.0&#xA; network 192.168.1.0&#xA; network 192.168.2.0&#xA; auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router configurations for Router 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 10.2.2.1 255.255.255.0&#xA; duplex half &#xA;!&#xA;interface Serial3/0&#xA; no ip address&#xA; encapsulation frame-relay&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/0.201 point-to-point&#xA; ip address 192.168.1.2 255.255.255.0&#xA; snmp trap link-status&#xA; frame-relay interface-dlci 201&#xA;!&#xA;router eigrp 1&#xA; network 10.0.0.0&#xA; network 192.168.1.0&#xA; no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router configurations for Router 3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 10.3.3.1 255.255.255.0&#xA; duplex half&#xA;!&#xA;interface Serial3/0.301 point-to-point&#xA; ip address 192.168.2.2 255.255.255.0&#xA; snmp trap link-status&#xA; frame-relay interface-dlci 301&#xA;!&#xA;router eigrp 1&#xA; network 10.0.0.0&#xA; network 192.168.2.0&#xA; no auto-summary&#xA;!&#xA;interface Serial3/0&#xA; no ip address&#xA; encapsulation frame-relay&#xA; serial restart-delay 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Scenario:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/sgdh7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sgdh7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17520" LastEditorUserId="8499" LastEditDate="2018-03-22T21:38:28.673" LastActivityDate="2018-03-22T21:38:28.673" Title="How a ping from DLCI 102 going to DLCI 301 instead of 201?" Tags="|cisco|routing|router|ping|frame-relay|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22489" PostTypeId="2" ParentId="22488" CreationDate="2015-09-15T01:29:34.443" Score="2" Body="&lt;p&gt;Why would the ping travel to R2 S3/0.201 from R1 S3/0.102? The source of the ping is just the source; it doesn't tell the ping which way to go or force the traffic out that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't matter which interface you source from in R1 because the R1 routing table will direct it out the correct interface to get to the IP address.  Sourcing the ping from the interface toward R2 doesn't matter since R1 knows it has to go out the interface to R3.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-15T01:29:34.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22493" PostTypeId="1" CreationDate="2015-09-15T02:51:58.757" Score="5" ViewCount="882" Body="&lt;p&gt;My company has 2 separated networking systems: wired and wireless. The R&amp;amp;D department is now developing an application that runs on a PC to scan the devices on the wireless network (smartphones and tablets) with a specific port open. The thing is the PCs can connect to both networks at the same time. So if the application scans the port using built-in functions of Windows/Linux (2 main OS of my company's PCs) will it affect the networks' stability since I have heard that it will scan for ports on all connected networks and there can be more than 1 PC to run this app at the same time.&lt;/p&gt;&#xA;" OwnerUserId="19021" LastEditorUserId="16741" LastEditDate="2016-09-30T21:01:08.180" LastActivityDate="2017-10-15T19:13:01.720" Title="Will port scanning affect my networks stability?" Tags="|ieee-802.11|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22494" PostTypeId="1" AcceptedAnswerId="22495" CreationDate="2015-09-15T04:33:46.117" Score="3" ViewCount="845" Body="&lt;p&gt;I am attempting to configure a &lt;em&gt;temporary&lt;/em&gt; network for a client. I'm having some problems with getting the devices to communicate. Here are the details of the current configuration. *Note: I cannot change the IP scheme of the current configuration, forcing me to resort to some crafty routing pattern (if possible)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gateway to WAN (G1) - 192.168.254.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RV130 VPN Gateway/Router in Router mode (R1) - WAN: 192.168.254.200/24,LAN: 10.55.142.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Managed Switch (SW1) - 172.16.6.1/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Control Logix PLC (PLC1) - 172.16.6.2/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Control PC (PC1) - 172.16.100.10/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I need to do is create a PPTP vpn connection on the RV130 (R1) accessible from the outside that can access both (PLC1) and (PC1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the RV130 (R1) can only support a network with a cidr value of 24 or greater.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How I have them connected is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(G1:LAN) &amp;lt;-&gt; (R1:WAN)-(R1:LAN1) &amp;lt;-&gt; (SW1:Port4)-(SW1:Port1) &amp;lt;-&gt; (PLC1:eth0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(R1:LAN2) &amp;lt;-&gt; (PC1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing to note is that both (SW1) and (R1) are capable of VLAN. (PC1) supports VLAN tagging and (PLC1) does not support VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've played around with static routes between the networks to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) Is this even possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) Is this way outside the normal?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.) If this is possible, how do I go about it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone has any information to point me in the right direction, please share.&lt;/p&gt;&#xA;" OwnerUserId="19022" LastActivityDate="2015-09-15T05:20:47.753" Title="Subnet routing problem" Tags="|routing|vlan|subnet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22495" PostTypeId="2" ParentId="22494" CreationDate="2015-09-15T05:08:04.777" Score="0" Body="&lt;p&gt;Well, right off the bat, you can't normally route from one subnet (172.16.0.0/16) to the same subnet (172.16.0.0/16); this is a layer-2 (switch), not a layer-3 (router), thing. A router receiving a packet destined for the subnet on which the packet originated will just drop the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some Cisco routers can do IRB, but I don't know about the RV130, and this would put them on the same layer-2 domain, not a layer-3 tunnel between them.  Also, I have seen proxy ARP do strange things where printers assigned IP addresses on the wrong subnet can be reached by both the correct and other subnets, and, again, this, also, would not be conducive to a layer-3 tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To create a PPTP VPN, I think you are going to need different subnets for the devices.  If one of the devices can do VLANs, you could try assigning a trunk to it with both its 172.16.0.0/16 address and a different subnet on another VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you want to do with what you have is just not how networks work.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-15T05:20:47.753" LastActivityDate="2015-09-15T05:20:47.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22496" PostTypeId="2" ParentId="22455" CreationDate="2015-09-15T07:35:46.813" Score="1" Body="&lt;p&gt;I'm not very familiar with Cisco, but is it possible that you need to use &quot;secret&quot; instead of password @l2tp-class?&lt;/p&gt;&#xA;" OwnerUserId="17646" LastActivityDate="2015-09-15T07:35:46.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22497" PostTypeId="2" ParentId="22455" CreationDate="2015-09-15T08:01:44.193" Score="0" Body="&lt;p&gt;There was a fair amount of trial and error. The first question to various approaches can be found in the revisions: &lt;a href=&quot;https://networkengineering.stackexchange.com/posts/22455/revisions&quot;&gt;https://networkengineering.stackexchange.com/posts/22455/revisions&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original post is now a solution, not a question. &lt;/p&gt;&#xA;" OwnerUserId="18938" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-09-15T08:01:44.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22498" PostTypeId="2" ParentId="22456" CreationDate="2015-09-15T08:23:16.733" Score="0" Body="&lt;p&gt;&lt;em&gt;I try to answer to my question based on what I've found googling around. Please help me if I'm wrong.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The so-called &lt;em&gt;slash notation&lt;/em&gt; is a way to assign a block of IPs to a given subnet, granting the ability to divide the IP addresses in blocks of 32 different lengths. In other words, it lets you define a given &lt;em&gt;prefix&lt;/em&gt; from 1 to 32 bits in length. This is needed when you need to define IP blocks with more grain than what you can get with the triplet-based segmentation (4 blocks, giving four &quot;classes&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example from &lt;a href=&quot;https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;code&gt;92.168.100.14/24&lt;/code&gt;&lt;/strong&gt; represents the IPv4 address &lt;code&gt;192.168.100.14&lt;/code&gt; and its associated routing prefix &lt;code&gt;192.168.100.0&lt;/code&gt;, or equivalently, its subnet mask &lt;code&gt;255.255.255.0&lt;/code&gt;, which has 24 leading 1-bits.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That leads me to think that in order to define a specific IP range (or a specific &lt;em&gt;prefix&lt;/em&gt;), the conventional notation is to set the triplets to zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To refer to the IPv4 loopback range, you should then write &lt;code&gt;127.0.0.0/8&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13736" LastActivityDate="2015-09-15T08:23:16.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22499" PostTypeId="1" AcceptedAnswerId="22501" CreationDate="2015-09-15T08:49:33.190" Score="5" ViewCount="224" Body="&lt;p&gt;Assuming there are three switches interconnected(Switch1--Switch2---switch3---switch1) to each other and STP has convergence has taken place and there is no change in the topology for a while. Now my question is that to converge STP BPDU's were flowing generated by all switches in the network, But after the convergence are BPDU also flowing (after convergence and before any change in topology) ? And if they are flowing all three switches are generating them or some particular Switch?&lt;/p&gt;&#xA;" OwnerUserId="15438" LastEditorUserId="2142" LastEditDate="2016-03-06T13:12:57.487" LastActivityDate="2016-03-06T13:12:57.487" Title="Spanning Tree protocol question" Tags="|cisco|switch|spanning-tree|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22500" PostTypeId="1" AcceptedAnswerId="22510" CreationDate="2015-09-15T09:38:38.540" Score="2" ViewCount="6673" Body="&lt;p&gt;I had been working in a mid-large company, and had limited administrator privilege both server and network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We had network that had two subnet on single shared network consist of 192.168.1.0/24 and 192.168.4.0/24. The full flagged administrator had been setup DHCP server with 2 pool 192.168.1.0/24 and 192.168.4.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had been noticed that pool 192.168.4.0/24 not working even when 192.168.1.0/24 already full assigned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following picture of how our DHCP server look like.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/shpij.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/shpij.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there way to solve this, so we can also use 192.168.4.0/24 when other exhausted ?&lt;/p&gt;&#xA;" OwnerUserId="8154" LastEditorUserId="8154" LastEditDate="2015-09-16T06:20:04.970" LastActivityDate="2017-09-22T01:12:09.577" Title="DHCP Server On Two Subnet On Single Shared Network" Tags="|dhcp|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="22501" PostTypeId="2" ParentId="22499" CreationDate="2015-09-15T09:59:27.883" Score="4" Body="&lt;p&gt;The &lt;em&gt;root bridge&lt;/em&gt; sends BPDU's to know if the network has changed and to inform  other bridges in case of change. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The frequency of those BPDU's is determined by a setting called &lt;strong&gt;hello time&lt;/strong&gt; that can be set on the switch. Usually is two seconds, a value low enough to guarantee a good convergence time and also high enough to not overflow the network.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2015-09-15T12:57:01.507" LastActivityDate="2015-09-15T12:57:01.507" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22502" PostTypeId="1" CreationDate="2015-09-15T10:24:04.380" Score="4" ViewCount="466" Body="&lt;p&gt;What does the 'FPS' in WS-C2960S-48FPS-L mean? I have tried to run a search online and have not fount concrete answers so i came here&lt;/p&gt;&#xA;" OwnerUserId="19028" LastActivityDate="2015-09-15T12:21:06.823" Title="Nomenclature of the Acronyms" Tags="|cisco-catalyst|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22503" PostTypeId="1" AcceptedAnswerId="22778" CreationDate="2015-09-15T10:45:04.280" Score="1" ViewCount="587" Body="&lt;p&gt;Is it correct to say that packet forwarding engines for MX960 series are DPC, DPCE, MPC, etc? And all those DPC, DPCE, etc cards actually include one or more packet forwarding engines? So in similar fashion CFEB is the packet forwarding engine for M10i and it contains actually one or more FPCs?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-09-24T17:46:08.617" Title="understand the terminology for packet forwarding engine in Juniper routers" Tags="|juniper|juniper-mx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22505" PostTypeId="1" AcceptedAnswerId="22618" CreationDate="2015-09-15T11:25:06.057" Score="3" ViewCount="5384" Body="&lt;p&gt;Am I correct that &quot;show pfe route ip&quot; extracts information from PFE and &quot;show route forwarding-table&quot; extracts information from routing-engine copy of forwarding table? So this means that in latter case there is no RE&amp;lt;-&gt;PFE communication?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2015-09-18T14:59:50.817" Title="Difference between &quot;show route forwarding-table&quot; and &quot;show pfe route ip&quot; in JUNOS?" Tags="|juniper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22506" PostTypeId="2" ParentId="22502" CreationDate="2015-09-15T12:21:06.823" Score="3" Body="&lt;p&gt;The first two letters, &lt;strong&gt;FP&lt;/strong&gt;, indicate 740 Watts of available PoE power, as opposed to &lt;strong&gt;LP&lt;/strong&gt; which indicates 370 Watts of PoE power. Note that the F versus L letter only applies to 48-port PoE switches, since 370 Watts is full power for a 24 port PoE switch, and there are no 740 Watt nor 185 Watt 24 port models. Models without PoE are indicated with a &lt;strong&gt;T&lt;/strong&gt; after the number of ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third letter, &lt;strong&gt;S&lt;/strong&gt;, indicates 4 one gigabit SFP ports, as opposed to &lt;strong&gt;D&lt;/strong&gt; which indicates 2 ten gigabit SFP+ ports or 2 one gigabit SFP ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-2960-series-switches/product_data_sheet0900aecd80322c0c.html&quot; rel=&quot;nofollow&quot;&gt;Here's Cisco's list of part numbers for the 2960 line.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2015-09-15T12:21:06.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22509" PostTypeId="1" AcceptedAnswerId="22524" CreationDate="2015-09-15T13:29:03.180" Score="5" ViewCount="5826" Body="&lt;p&gt;I do not have a cisco contract or license, but I did order the Cisco CP-8851 IP Phone from Amazon, and was hoping that I could configure it to work with my VoIP SIP PBX.  But I can't seem to log into the Web GUI to configure anything, it seems pretty locked down.  When I go to try to download anything from Cisco, it seems that the Cisco site will not let me because I don't have an active contract.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How else could I configure my device to run on my VoIP PBX?  I have the Cisco 525G2a and was able to configure it from the Web GUI just fine, but I wanted a nicer phone.&lt;/p&gt;&#xA;" OwnerUserId="16248" LastActivityDate="2016-02-02T23:58:08.517" Title="Can't configure the Cisco CP-8851 IP Phone" Tags="|cisco|voip|sip|cisco-voip|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22510" PostTypeId="2" ParentId="22500" CreationDate="2015-09-15T13:31:21.970" Score="1" Body="&lt;p&gt;There is quite a bit of detail missing from your description, but you do have a fairly simple question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I implement dhcp relay on the router for two subnet in same broadcast domain?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You could, but there really is no point. DHCP relay features are only there to proxy specific broadcast traffic (by default only DHCP traffic) from one broadcast domain to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since your client and your DHCP server are in the same broadcast domain, there is no need to proxy DHCP broadcasts. The server and client will be able to communicate with broadcasts just fine without any help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit more commentary on other parts of your description, although we are still lacking details:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I as I know it would not be successful for subnet address that not used as IP address in router in this case 192.168.4.0/24 should not work.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no reason the router interface/SVI for the VLAN cannot have two addresses, one from each subnet. As such, it could work just fine. Even if this weren't the case, there are other reasons one may do something like this.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But since it not sunetted properly I had no idea what that full flagged administrator tried to achive &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is nothing wrong with the subnetting. There are two perfectly good subnets that do not overlap in your description. Although there may be other problems in the setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What he was trying to achieve we could only guess without knowing more detail and/or asking the party in question.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-09-15T13:31:21.970" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22511" PostTypeId="2" ParentId="22409" CreationDate="2015-09-15T13:34:02.447" Score="2" Body="&lt;p&gt;practically problem regard the high CPU usage still bending , but for the drop of the handheld traffic i found one useful work a round that to isolate the handhelds traffic in separate VLAN . &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-15T13:34:02.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22514" PostTypeId="1" CreationDate="2015-09-15T15:54:48.027" Score="3" ViewCount="110" Body="&lt;p&gt;We all know that all consumer based internet connections are shared and that ISPs protect themselves with &quot;best effort&quot; contracts, also we know that a client's 50 Mbps (for example) connection speed is being used by someone else when they are not using it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what I am curious about and I believe others are as well, is &lt;strong&gt;how many people actually share that 1 Mbps of an ISP's backbone&lt;/strong&gt; or their total throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure that different ISP's have different &quot;ratios&quot;, but there must be a general rule or something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;This seems to be the most relevant site to ask this kind of question, If I'm mistaken mods, I am sorry.&lt;/em&gt; &lt;/p&gt;&#xA;" OwnerUserId="19033" LastActivityDate="2015-09-15T15:54:48.027" Title="How many people share 1 Mbps of an ISP backbone?" Tags="|internet|isp|speed|" AnswerCount="0" CommentCount="5" ClosedDate="2015-09-15T17:48:52.430" ContentLicense="CC BY-SA 3.0" />
  <row Id="22515" PostTypeId="1" AcceptedAnswerId="22516" CreationDate="2015-09-15T16:04:10.900" Score="8" ViewCount="146" Body="&lt;p&gt;In a network with a dual-redundant link between two switches, will any data be lost during the switchover from an active link to the blocked link when the active link fails?&lt;/p&gt;&#xA;" OwnerUserId="19034" LastEditorUserId="8499" LastEditDate="2018-12-22T03:26:14.437" LastActivityDate="2018-12-22T03:26:14.437" Title="Will STP lose data whilst switching from a failed link?" Tags="|switch|switching|spanning-tree|redundancy|failover|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22516" PostTypeId="2" ParentId="22515" CreationDate="2015-09-15T16:21:07.507" Score="6" Body="&lt;p&gt;It is possible, even likely, that at least one (probably more) frames will be lost on any failover.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The speed of the failover is highly dependent on what type of redundancy you are using.  Spanning Tree is the slowest, routing is an order of magnitude faster, and etherchannels are yet and order of magnitude faster than that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When frames are lost, there is nothing in layer-2 to request that they be resent.  If the data in the frames is TCP, the upper layer will request that the packet containing the TCP segment be resent.  UDP does not do that, so it would be up to the application to request a resend if it is built that way.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-03-18T20:10:22.710" LastActivityDate="2018-03-18T20:10:22.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22517" PostTypeId="2" ParentId="6923" CreationDate="2015-09-15T17:31:58.747" Score="1" Body="&lt;p&gt;From my experience ,channelfly proves to be a great feature in environment where  the RF presence and interference level is potentially unpredictable and requires constant scanning for better channels.The ISP for which I used to work deployed RUCKUS APs and the channel fly proved to be a boon for us in areas where assigning channels manually proved to be cumbersome.We are now looking forward to also use the feature of beamflex as we have not yet employed 5 GHz band.Looking forward for the results....&lt;/p&gt;&#xA;" OwnerUserId="14759" LastActivityDate="2015-09-15T17:31:58.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22518" PostTypeId="1" CreationDate="2015-09-15T17:47:58.200" Score="1" ViewCount="107" Body="&lt;p&gt;I am preparing for my final paper but i got stock in the initially in OSI model question. &#xA;So, any help will be greatly appreciated. &lt;/p&gt;&#xA;" OwnerUserId="19040" LastActivityDate="2015-09-15T17:47:58.200" Title="Can we implement OSI model in any type of communication?" Tags="|osi|" AnswerCount="0" CommentCount="1" ClosedDate="2015-09-15T18:24:39.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="22519" PostTypeId="1" AcceptedAnswerId="22670" CreationDate="2015-09-15T18:37:20.923" Score="2" ViewCount="140" Body="&lt;p&gt;Do they have to give different IPv4 addresses?&lt;/p&gt;&#xA;" OwnerUserId="19043" LastEditorUserId="8499" LastEditDate="2018-03-12T03:08:34.027" LastActivityDate="2018-03-12T03:08:34.027" Title="How common is it for mobile network operators to give the same IPv4 address to different 3G devices?" Tags="|ipv4|ip|nat|ip-address|mobile|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22520" PostTypeId="2" ParentId="22519" CreationDate="2015-09-15T18:44:42.473" Score="2" Body="&lt;p&gt;If the carrier uses NAT, the carrier can reuse addresses in different locations.  This is how home networks can all reuse the same subnet and addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT masks the assigned address behind a globally unique address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-15T18:44:42.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22521" PostTypeId="2" ParentId="5587" CreationDate="2015-09-15T18:58:37.513" Score="2" Body="&lt;p&gt;Actually breaking up of PDUs takes place only at two layers:1)At transport layer called SEGMENTATION.&#xA;2)At network layer called FRAGMENTATION.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The need for fragmentation as mentioned in earlier answers are as per the restrictions upon on L-2 interfaces(E.g:for Ethernet it is 1500 bytes).This value is called MTU (Maximum Transmission Value).If Ethernet interfaces receive frames larger than this default MTU value they will drop those frames.Hence it has to be decided at L-3 level whether or not to fragment the IP datagram as per L-2 requirement.All the process of fragmentation and re-segmentation are done using multiple fields in IP HEADER.&#xA;And to answer your question there is no fragmentation done at L-2 level for L-1 layer requirement.&lt;/p&gt;&#xA;" OwnerUserId="14759" LastActivityDate="2015-09-15T18:58:37.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22522" PostTypeId="1" AcceptedAnswerId="22523" CreationDate="2015-09-15T20:11:58.743" Score="14" ViewCount="20574" Body="&lt;p&gt;I want to make sure I'm understanding how this works. Specifically the term &quot;Sending Port ID&quot; has me very confused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider this diagram, I want to make sure I have root port selection figured out:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lIZZI.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lIZZI.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch on top is the root and all settings are at the defaults.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of SW2's ports connected to SW3 are designed because it has the lowest path cost to the root (its the only path to the root).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I'm unsure of: SW3's 0/4 is the Root Port because the Sending Port ID of 0/1 wins over 0/2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this correct? The Port IDs of SW3 have no bearing in the selection it is only the Sending Port ID's of SW2 that matter right?&lt;/p&gt;&#xA;" OwnerUserId="13362" LastActivityDate="2019-05-16T17:03:54.710" Title="STP blocking port selection" Tags="|cisco|switch|spanning-tree|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22523" PostTypeId="2" ParentId="22522" CreationDate="2015-09-15T21:20:23.453" Score="9" Body="&lt;p&gt;you need to understand the next &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spanning-Tree Port Roles&lt;br&gt;&#xA; - Root Port (RP) - It is a port on a non-root switch, which is the shortest (the best) path towards the root bridge. (i.e. port 0/4 0/3 in SW3)&lt;br&gt;&#xA; - Designated Port (DP) - It is a port that is in the forwarding state. (i.e. port 0/1 0/2 SW2)&lt;br&gt;&#xA; - Non-Designated Port (NDP) - It is a port that is in a blocking state in the STP topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so your question is about which port in SW3 will be selected as &lt;strong&gt;&lt;em&gt;Root Port&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As soon as the root has been elected, all non-root switches begin to calculate which port is the best &lt;strong&gt;&lt;em&gt;(the least cost)&lt;/em&gt;&lt;/strong&gt; towards the root bridge. This port will be called the root port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;What if the Root Cost Path is identical?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Prefer the lowest Root Path Cost.&lt;/li&gt;&#xA;&lt;li&gt;In case of the same Root Path Cost, prefer the lowest Bridge ID of the designated switch (the neighbor that sends BPDUs).&lt;/li&gt;&#xA;&lt;li&gt;In case of receiving BPDUs on multiple ports from the same designated switch (BPDU sender), &lt;strong&gt;&lt;em&gt;prefer the lowest Port ID (known also as port priority) of the sender&lt;/em&gt;&lt;/strong&gt;. That parameter has a default value 128 and is configurable.&lt;/li&gt;&#xA;&lt;li&gt;In case of all above are did not resolve the problem, prefer the lowest Port ID of the BPDU sender.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;so answer of your question (SW3's 0/4 is the Root Port because the Sending Port ID of 0/1 wins over 0/2)is &lt;strong&gt;&lt;em&gt;YES&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please make use of this very usful linke &lt;a href=&quot;http://ciscoiseasy.blogspot.com.eg/2010/10/lesson-20-spanning-tree-protocol.html&quot;&gt;STP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-15T21:20:23.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22524" PostTypeId="2" ParentId="22509" CreationDate="2015-09-15T21:42:34.887" Score="2" Body="&lt;p&gt;here i can gave you the basic steps you need and i'll guide you to how accomplishing this proccess &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default most Cisco VoIP phones come configured for Call Manager, which uses the 'Skinny' protocol - SCCP.&#xA;most of other PBX has 2 implementations for this channel &lt;/p&gt;&#xA;&#xA;&lt;p&gt;•   Skinny implements a very basic set of telephone functions and ships with asterisk.&lt;br&gt;&#xA;•   SCCP has implemented more of the SCCP protocol, so some class 5 features (hold, transfer, forward, etc) should work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, cisco phones can be reconfigured to use SIP (recommended for use with other PBX than CUCM):&lt;br&gt;&#xA;make sure you have the next &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DHCP - By far the easiest way to configure the phones IP address is via DHCP, make sure you have a fully working DHCP server before continuing.&lt;/li&gt;&#xA;&lt;li&gt;TFTP Server - The phone picks its firmware and configuration up from a tftp server and you'll therefore need to have one on your LAN for this to work.&lt;/li&gt;&#xA;&lt;li&gt;Download Firmware , i know it is impossible for the normal users but may you can get from any integrator you know or from internet file sharing sites&lt;/li&gt;&#xA;&lt;li&gt;Create The Config Files . please check this link &lt;a href=&quot;http://wiki.siftah.com/Cisco_7960G_IP_Phone_on_Asterisk&quot; rel=&quot;nofollow&quot;&gt;Asterisk&lt;/a&gt;&#xA;it is taking Asterisk as  an example for free PBX&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-15T21:42:34.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22527" PostTypeId="2" ParentId="22509" CreationDate="2015-09-16T02:15:59.117" Score="1" Body="&lt;p&gt;I think that I may have figured this out, here are some links:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/11292241/cisco-cp-6901-dialplan-configure-3rd-party-pbx-how-change-interdigit-timeout&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/11292241/cisco-cp-6901-dialplan-configure-3rd-party-pbx-how-change-interdigit-timeout&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.voip-info.org/wiki/view/Asterisk+phone+cisco+79xx&quot; rel=&quot;nofollow&quot;&gt;http://www.voip-info.org/wiki/view/Asterisk+phone+cisco+79xx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the link that shows examples of how to do it.  I will check it out and let you all know.&#xA;&lt;a href=&quot;http://www.minded.ca/2009-12-16/configure-cisco-ip-phones-with-asterisk/&quot; rel=&quot;nofollow&quot;&gt;http://www.minded.ca/2009-12-16/configure-cisco-ip-phones-with-asterisk/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16248" LastActivityDate="2015-09-16T02:15:59.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22528" PostTypeId="2" ParentId="22500" CreationDate="2015-09-16T02:47:19.413" Score="0" Body="&lt;p&gt;Thank you very much for your answer sir @Ylearn, the answer for my question can be solved by DHCP Superscope.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following the picture what I really want try to achive.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/PGZhd.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PGZhd.gif&quot; alt=&quot;DHCP Superscope&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope can be useful for other who had same problem :).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://technet.microsoft.com/en-us/library/dd759168.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;DHCP Superscope Explanation&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8154" LastActivityDate="2015-09-16T02:47:19.413" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22529" PostTypeId="1" CreationDate="2015-09-16T05:54:24.307" Score="3" ViewCount="230" Body="&lt;p&gt;I was reading about this functionality on this wiki (&lt;a href=&quot;https://en.wikipedia.org/wiki/Port_triggering&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Port_triggering&lt;/a&gt;), and I am unsure what this sentence means in the &quot;disadvantages&quot; section: &quot;On some routers it is possible to have more than one client use port triggering and port forwarding, but not simultaneously.&quot; Could someone please make clear why this is? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the general concept of port triggering but not this nuance. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19051" LastActivityDate="2016-02-25T20:15:27.813" Title="Question about Port Triggering" Tags="|routing|firewall|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22531" PostTypeId="2" ParentId="22529" CreationDate="2015-09-16T06:02:00.050" Score="0" Body="&lt;p&gt;This isn't that difficult, it just means that only one client at a time can use port triggering and port forwarding, but not 2 or more at the same time.&lt;/p&gt;&#xA;" OwnerUserId="17646" LastActivityDate="2015-09-16T06:02:00.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22532" PostTypeId="1" AcceptedAnswerId="22542" CreationDate="2015-09-16T07:34:39.527" Score="2" ViewCount="91" Body="&lt;p&gt;I would like to know if I can configure a routing protocol, for instance OSPF, EIGRP, or Ripv2 with out a physical address configured to the any interfaces. But then again by not configuring a IP address to the physical interfaces connected to each network using Either routing protocol, then they won't be able to communicate? Is this correct? I'm not actually in front of a network to test this. &lt;/p&gt;&#xA;" OwnerUserId="17715" LastActivityDate="2015-09-16T15:58:15.493" Title="Configuring routing protocols" Tags="|routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22533" PostTypeId="1" AcceptedAnswerId="22534" CreationDate="2015-09-16T07:45:55.393" Score="3" ViewCount="6706" Body="&lt;p&gt;Good day, I connected two computers together with an Ethernet straight-through cable. I did not configure any ip address, and after a while they both got APIPA addresses. Now they can ping each other and share files. I am a bit confused because firstly, it's a straight-through cable, so there should be no communication and secondly, when I type in &quot;ipconfig /all&quot; in cmd on both computers, there is no subnet mask. How is communication even possible? I am so confused.&lt;/p&gt;&#xA;" OwnerUserId="19053" LastEditorUserId="8499" LastEditDate="2018-12-21T04:11:14.183" LastActivityDate="2018-12-21T04:11:14.183" Title="Two computers connected by straight through Ethernet cable, communicating with APIPA addresses" Tags="|ethernet|layer1|cable|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22534" PostTypeId="2" ParentId="22533" CreationDate="2015-09-16T08:08:23.820" Score="8" Body="&lt;p&gt;Nowodays, many ethernet interfaces are 'auto MDI/MDIX'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They detect the type of device connected and if needed reverse internally Transmit and Receive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This allow connection of 2 devices of the same layer with straight-through cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;APIPA is specifically made to provide IP addresses and allow IP communication in a network where there's no DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a subnet mask associated with APIPA-assigned IP addresses, it is 255.255.0.0 (I.E. /16). &#xA;On a windows 7 machine this subnet mask is shown by &quot;ipconfig /all&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe windows 8 or 10 hide it because it's implicit with APIPA, but I cannot check it right now.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-09-16T08:08:23.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22535" PostTypeId="1" AcceptedAnswerId="22561" CreationDate="2015-09-16T09:49:18.257" Score="1" ViewCount="112" Body="&lt;p&gt;I have 6 APs connected to a desktop switch &#xA;&lt;a href=&quot;http://www.tp-link.com/lk/products/details/cat-4763_TL-SF1005D.html&quot; rel=&quot;nofollow&quot;&gt;http://www.tp-link.com/lk/products/details/cat-4763_TL-SF1005D.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MY APs are TPLINK TL-901WD&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The desktop switch is connected to my main router Asus RTN66U running off Asus RWT Merlin Firmware(latest build)&#xA;&lt;a href=&quot;https://www.asus.com/Networking/RTN66U/&quot; rel=&quot;nofollow&quot;&gt;https://www.asus.com/Networking/RTN66U/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have been facing this issue, sometimes, I'm using one of the APs, the latency became really high, and disconnection happens. I restarted the router and AP then the problem goes away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how to identify the problem, is it because of one of these?&lt;br&gt;&#xA;1. DHCP lease time (i set to 7200)&lt;br&gt;&#xA;2. Spanning Tree Protocol (disabled)&lt;br&gt;&#xA;3. NAT Acceleration (disabled)&amp;lt;-Not sure why i cant seem to set it to Auto&lt;br&gt; &#xA;4. Weak Desktop Switch &lt;br&gt;&#xA;5. I have turned on Per-IP monitoring and the database uses RAM(Asus RWT Merlin)&lt;br&gt;&#xA;6. 10Mbps fibre line. (Even if theres not much usage, the problem still occurs)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network have at least 50 concurrent users at peak hours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope someone here can shed some light on my problem&lt;/p&gt;&#xA;" OwnerUserId="19055" LastActivityDate="2015-09-17T07:07:16.557" Title="AP High latency, sometimes disconnection from network" Tags="|switch|dhcp|spanning-tree|" AnswerCount="1" CommentCount="1" ClosedDate="2018-03-20T23:43:16.840" ContentLicense="CC BY-SA 3.0" />
  <row Id="22536" PostTypeId="1" AcceptedAnswerId="49633" CreationDate="2015-09-16T11:30:34.623" Score="4" ViewCount="949" Body="&lt;p&gt;Is it possible to have a dynamic and static VPN between the same IOS router and ASA, sharing same interesting traffic/crypto ACL on the ASA end? The two devices in question:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ASA 9.1 - hub/termination point for VPNs &lt;/li&gt;&#xA;&lt;li&gt;897 15.4 - spoke/branch office&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The 897 IOS router has two links for internet connectivity:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Primary link: static IP 2.2.2.2, ATM0 tied to Dialer2 (default route injected via 'ppp&#xA;ipcp route default', static AD 1) &lt;/li&gt;&#xA;&lt;li&gt;Backup link: dynamic IP, Cell0 tied to Dialer1 (floating static default route with AD 200 for when ATM0/Dialer2 interfaces go down)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There is a single network - 10.1.30.0/24 at the branch office. A static L2L VPN (2.2.2.2 for examples sake) is configured over ATM0 link to the ASA and is working successfully. In the event this link/tunnel goes down I want the branch office to maintain reachability back to our corporate networks via the dynamic VPN tunnel over the Cellular 4G backup link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently both the static and dynamic VPN's have identical local and remote networks in their crypto ACL's. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant ASA configuration: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto dynamic-map BACKUPCELL 16 match address CRYPTOACL_CELL&#xA;crypto dynamic-map BACKUPCELL 16 set pfs group5&#xA;crypto dynamic-map BACKUPCELL 16 set ikev1 transform-set ESP-AES-256-SHA&#xA;crypto dynamic-map BACKUPCELL 16 set reverse-route&#xA;&quot;&#xA;crypto map outside_map 11 match address CRYPTOACL_ATM&#xA;crypto map outside_map 11 set pfs group5&#xA;crypto map outside_map 11 set peer 2.2.2.2&#xA;crypto map outside_map 11 set ikev1 transform-set ESP-AES-256-SHA&#xA;crypto map outside_map 11 set reverse-route&#xA;&quot;&#xA;crypto map outside_map 16 ipsec-isakmp dynamic BACKUPCELL&#xA;&#xA;access-list CRYPTOACL_ATM extended permit ip any4 object 10.1.30.0_24 &#xA;access-list CRYPTOACL_CELL extended permit ip any4 object 10.1.30.0_24 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The issue I am facing when attempting to test a failover scenario by dropping the ATM0 link on the 897, 'show crypto ipsec sa' on the ASA shows decrypts but no encrypts (packet-tracer shows a DROP on ENCRYPT phase). It appears even with the static peer down, when evaluating the ASA's crypto map sequence it is stopping at the CRYPTOACL_ATM match for the static peer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I modify the ASA's CRYPTOACL_ATM to be something else specific, causing the CRYPTOACL_CELL to be matched it works successfully. It's not feasible as the branch office will need to access all networks over it's Cell0 link if ATM0 goes down. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a possible solution with this topology and policy based VPN's on ASAs? (That doesn't involve a second ASA head end, or replacing it with something that supports route based VPNs.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="478" LastActivityDate="2019-07-17T15:18:32.270" Title="IOS to ASA dynamic and static VPNs - sharing same crypto ACL?" Tags="|cisco|cisco-asa|vpn|cisco-ios|ipsec|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22537" PostTypeId="2" ParentId="22384" CreationDate="2015-09-16T12:07:09.487" Score="1" Body="&lt;p&gt;FWIW, another solution is to just run a different routing protocol on your backup links. You could do RIP, EIGRP, or even just floating statics. Then just alter the AD of that protocol (if necessary) to ensure the MPLS routing protocol is preferred to the backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMO, Sham-link are a bit of a hack to get around a design problem and are unnecessarily complex.&lt;/p&gt;&#xA;" OwnerUserId="349" LastActivityDate="2015-09-16T12:07:09.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22539" PostTypeId="2" ParentId="22457" CreationDate="2015-09-16T13:40:07.780" Score="1" Body="&lt;p&gt;i would think that something like &quot;ip event dampening&quot; might be a better fit.  when tuned correctly, it should hold a flapping interface down and when it's stable again allow it to come up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this has long been available on Cisco IOS and more recently on JunOS.&lt;/p&gt;&#xA;" OwnerUserId="4095" LastActivityDate="2015-09-16T13:40:07.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22540" PostTypeId="1" CreationDate="2015-09-16T13:40:58.180" Score="1" ViewCount="5192" Body="&lt;p&gt;I'm currently working on Cisco Prime Infrastructure 2.2 and I'm having trouble making my own template.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm actually trying to access the interfaces &quot;Description&quot; data from the Cisco Prime database but even after a while looking at the official Cisco documentation and forum topics, I can't find the info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to set my own DB variable in the CLITemplateDbVariablesQuery.properties file but before I need to &quot;explore&quot; the existing tables in order to find the field I need. Is there a way to get the &lt;strong&gt;database schema&lt;/strong&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19060" LastActivityDate="2016-03-07T04:35:03.183" Title="Cisco Prime Infrastructure : How to access the database?" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22541" PostTypeId="2" ParentId="22475" CreationDate="2015-09-16T14:20:10.603" Score="0" Body="&lt;p&gt;Have you considered that something on the local LAN may be downloading/consuming a lot of traffic? How many computers do you have connected to your switch? (including any wireless clients from an AP)&#xA;What kind of ISP/internet/modem do you have? (xDSL, Cable, etc)&#xA;What are your normal expected speeds? What are you seeing now?&#xA;How are you testing? (eg. &lt;a href=&quot;http://www.speedtest.net&quot; rel=&quot;nofollow&quot;&gt;http://www.speedtest.net&lt;/a&gt;)&#xA;If nothing else has changed I suspect it is not that the SonicWALL is overloaded. (on the System, Status page what are the Connections and Connection Usage values? and the CPUs percentage?)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you have confirmed plugging directly into the modem = full download speeds (make sure to enable a software firewall!) then, you know the modem/ISP/internet is OK.&lt;/li&gt;&#xA;&lt;li&gt;If you connect just the SonicWALL to the modem (X1) and then connect directly to the SonicWALL (X0) with no switch = full speed, then you know the SonicWALL is likely OK.&lt;/li&gt;&#xA;&lt;li&gt;If you now connect the switch to the SonicWALL (X0) and still ONLY connect your test computer to the switch = full speed, then you know the switch is likely OK.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note: when you say &quot;if you bypass the sonic wall speeds through the switch are fine&quot; do you mean that you have configured each computer with a public static IP (because bypassing the SonicWALL means no DHCP and no NAT from the router and many ISPs only provide 1 or 2 public addresses via DHCP).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Try hooking up the SonicWALL to the modem and the switch and then only connecting ONE additional computer at a time, testing and waiting between each one. If one computer is infected or perhaps has a BitTorrent client running on it I would suspect a few minutes after being connected it may start pushing a lot of traffic.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hopefully you will find one computer (or maybe several) that cause the the traffic to spike and decrease your download speeds.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Try enabling basic &lt;strong&gt;Reporting&lt;/strong&gt; (under Log, Reports): press Start Data Collection. With the computers all connected you can select Bandwidth Usage by IP Address to see which IP is using all the bandwidth.&lt;/li&gt;&#xA;&lt;li&gt;You can also use the &lt;strong&gt;Connection Monitor&lt;/strong&gt; (which is under Dashboard latest firmware) to view live connections. You can filter based on Source IP (such as the top IP from Reports) and then see what connections that machine has open right now.&lt;/li&gt;&#xA;&lt;li&gt;You can also sort columns using Tx Bytes and Rx Bytes to see which IPs (source or destination) are sending or receiving the most data at this moment.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you have tested each component individually and they all test OK (meaning don't cause an 80% drop in speed) the devices are probably not the problem, it's probably one of the computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use something like LAN Speed Test (&lt;a href=&quot;http://www.totusoft.com/lanspeed.html&quot; rel=&quot;nofollow&quot;&gt;http://www.totusoft.com/lanspeed.html&lt;/a&gt;) to test speeds across your switch -- it's possible your switch (or a few ports) is dying under high load.&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-09-16T14:20:10.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22542" PostTypeId="2" ParentId="22532" CreationDate="2015-09-16T14:30:57.280" Score="2" Body="&lt;p&gt;Cisco has the &lt;code&gt;ip unnumbered&lt;/code&gt; command that allows an interface to assume the address of another interface for distance-vector routing protocols.  If the requirement is no IP address assignment on a physical interface, you could assign a loopback with an IP address and use the &lt;code&gt;ip unnumbered Loopback&amp;lt;num&amp;gt;&lt;/code&gt; on the physical interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The physical interfaces could also use DHCP to get an IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interfaces need some sort of IP address, specifically assigned, or not.  Routing can't work without knowing IP addressing.  Routing without IP addressing is like the post office needing to deliver mail without knowing a street address, city, or state.  It's just not going to happen.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-16T15:58:15.493" LastActivityDate="2015-09-16T15:58:15.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22543" PostTypeId="1" CreationDate="2015-09-16T16:13:14.647" Score="1" ViewCount="2206" Body="&lt;p&gt;Can any one please help in configuring a TACACS+ server, along with configuration in Juniper devices?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ubuntu Server 14.04&lt;/li&gt;&#xA;&lt;li&gt;Juniper QFX5100 switch&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Below are my configurations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the TACACS+ server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#Encryption key&#xA;key = &quot;test&quot;&#xA;&#xA;#Accounting Records&#xA;&#xA;default authentication = file /etc/passwd&#xA;&#xA;accounting syslog;&#xA;&#xA;accounting file = var/log/tac_plus/tac_plus.acct&#xA;&#xA;group = SU {&#xA;   default service = permit&#xA;   service = junos-exec {&#xA;     local-user-name = SU&#xA;   }&#xA; }&#xA;&#xA;user = admin_user {&#xA; member =  SU&#xA; login = file /etc/passwd&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the Juniper devices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set system authentication-order tacplus&#xA;set system authentication-order password&#xA;set system root-authentication encrypted-password &quot;$1$reAOW7RO$wRFyLe1K.3FZFq7XWVw1&quot;&#xA;set system tacplus-server 172.16.x.x secret &quot;$9$.mz6pu1hyKBI&quot;&#xA;set system tacplus-server 172.16.x.x source-address 172.16.x.x&#xA;set system accounting events login&#xA;set system accounting events change-log&#xA;set system accounting events interactive-commands&#xA;set system accounting destination tacplus server 172.16.1.229 secret &quot;$9$Pf390SlMIE&quot;&#xA;set system login class admin idle-timeout 30&#xA;set system login class admin permissions all&#xA;set system login user SU full-name local-user-name&#xA;set system login user SU uid 2002&#xA;set system login user SU class admin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please help me, as I am stuck for the last 3 months. I have no clue which mistakes I am making. I am able to get the logs, but I am unable to authenticate users, which is very much important for me.&lt;/p&gt;&#xA;" OwnerUserId="15690" LastEditorUserId="8499" LastEditDate="2016-04-04T16:43:04.760" LastActivityDate="2019-06-28T18:00:18.437" Title="TACACS with Juniper Devices" Tags="|juniper|juniper-junos|juniper-srx|aaa|tacacs|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22547" PostTypeId="1" CreationDate="2015-09-16T17:30:19.740" Score="2" ViewCount="239" Body="&lt;p&gt;I want to prioritize applications which use the internet but in the QoS I find the applications are IGMP SIP H.323 MGCP SNMP DNS DHCP RIP RSTP RTCP RTP, I don't understand which of them is responsible for videos? or which is for firefox?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't understand what is Destination MAC? IP? Mask? Port Range? .. please give me a tutorial how to configure those things.&lt;/p&gt;&#xA;" OwnerUserId="19068" LastActivityDate="2015-09-16T17:30:19.740" Title="How to configure QoS on router?" Tags="|router|qos|" AnswerCount="0" CommentCount="3" ClosedDate="2015-09-16T20:14:34.380" ContentLicense="CC BY-SA 3.0" />
  <row Id="22550" PostTypeId="1" AcceptedAnswerId="22551" CreationDate="2015-09-16T18:36:14.673" Score="4" ViewCount="7745" Body="&lt;p&gt;I'm preparing for the CCNA and I have a little trouble understanding the outputs for STP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default a CISCO switch use PVST (Per VLAN Spanning Tree) but if we use the command  show spanning-tree with the default configuration the output is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show spanning-tree&#xA;&#xA;VLAN0001&#xA;&#xA;Spanning tree enabled protocol IEEE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[output omitted]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand why it said IEEE, as far i know the PVST is a CISCO proprietary protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm not wrong the PVST is a modification from the IEEE 802.1D Common Spanning tree protocol(CSTP) then why in the output said &quot;enabled protocol IEEE&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help!&lt;/p&gt;&#xA;" OwnerUserId="15438" LastEditorUserId="509" LastEditDate="2015-09-17T05:32:49.050" LastActivityDate="2015-09-17T05:32:49.050" Title="Why showing IEEE Spanning Tree protocol" Tags="|cisco|switch|spanning-tree|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22551" PostTypeId="2" ParentId="22550" CreationDate="2015-09-16T20:26:47.113" Score="5" Body="&lt;p&gt;one needs to look at it from a historic perspective.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) The original STP was designed by Radia Perlman working for DECnet. Then IBM &amp;amp; other vendors implemented their own versions of STP.&lt;br&gt;&#xA;2) Then IEEE created their standard (IEEE 802.1D) for STP.&lt;br&gt;&#xA;3) STP, as defined in 8012.1D standard was implemented as 802.1Q CST (Common Spanning Tree) for all VLANs by IEEE &amp;amp; as PVST by Cisco on a per-VLAN basis. Later, PVST+ was created to interoperate with 802.1Q trunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But all these implementations, whether they're Cisco's PVST(+) or IEEE's CST, implemented the same mechanism (BPDU Structure/ STP timers/ Topology changes) as defined in the standard 802.1D. I guess that's why Cisco prefers to call their version (PVST+) as &quot;IEEE&quot;, although RSTP is also IEEE (802.1w). Maybe, they don't want to change their code now to avoid creating any confuson, so they just prefer to write IEEE for PVST+ (Using old timers etc.) &amp;amp; RSTP for 802.1w (Using new tmers &amp;amp; synchronizations etc.).&#xA;That's how I've understood it so far. Would love to hear some expert opinion though....maybe people who were around when the standards were created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;make use of this discussion &lt;a href=&quot;https://learningnetwork.cisco.com/thread/35585&quot; rel=&quot;noreferrer&quot;&gt;Cisco Learning Network&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-16T20:26:47.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22552" PostTypeId="1" CreationDate="2015-09-16T20:49:48.383" Score="1" ViewCount="302" Body="&lt;p&gt;I have a commercial setup where everything is on the the same xxx.xxx.xx.1-255 network.  I have a D-link router (DIR-615) that is on this network in another building with the router IP as xxx.xxx.xx.abc and in the router the IP is also set as 10.10.0.1 in the setup admin.  (When viewing the device information the WAN is specified as the xxx.xxx.xx.abc IP and LAN is 10.10.0.1)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Behind my D-link router is a number of machines that have http pages I'd like to get access to that are on local 10.10.0.x IPs.  When I remote desktop to a machine in the other building I have web access to the router on 10.10.0.1, a machine on 10.10.0.x:80 and another on 10.10.0.y:5050 ports and am able to log in fine.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue.  When I try to access these ports without remote desktop from my building over the xxx.xxx.xx.abc:5050 port it doesn't work at all, but weirdly enough &lt;strong&gt;when I try to access the port xxx.xxx.xx.abc:80 the log-in page opens, but does not let me log in.&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My troubleshooting:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are your ports forwarded properly?  Yes.  Local IP 10.10... then port number specified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the 5050 machine listening on 5050? Yes. Over its http port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a inbound filter?  Yes.  The range is specified for everything allowed over the xxx.xxx.xx.1-xxx.xxx.xx.255 range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router Firewall settings?  Disabled except for PPTP, IPSec, RTSP, SIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Windows Firewall settings?  Disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What else can I look at?&lt;/p&gt;&#xA;" OwnerUserId="19071" LastActivityDate="2015-09-16T20:49:48.383" Title="Port forwarding works locally over LAN IP but not over the router IP WAN from another building" Tags="|ip|lan|wan|" AnswerCount="0" CommentCount="4" ClosedDate="2015-09-16T21:34:08.730" ContentLicense="CC BY-SA 3.0" />
  <row Id="22553" PostTypeId="2" ParentId="13098" CreationDate="2015-09-16T20:53:02.677" Score="1" Body="&lt;p&gt;The answer to this was the firmware needed updating, i found there to be quite a few issues with the firmware that was installed.&lt;/p&gt;&#xA;" OwnerUserId="4880" LastActivityDate="2015-09-16T20:53:02.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22554" PostTypeId="1" AcceptedAnswerId="22565" CreationDate="2015-09-16T20:57:59.723" Score="3" ViewCount="2307" Body="&lt;p&gt;Is it possible to reset a password for the admin account on a Sonicwall via SSH?&lt;/p&gt;&#xA;" OwnerUserId="19074" LastActivityDate="2016-01-12T15:59:58.270" Title="Sonicwall - SSH to change admin password" Tags="|sonicwall|ssh|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22556" PostTypeId="1" AcceptedAnswerId="22557" CreationDate="2015-09-16T23:08:48.060" Score="0" ViewCount="1804" Body="&lt;p&gt;I am trying to capture packets with GNS3 using wireshark but wireshark is giving error message every time I run wireshark in GNS3. Path for Wireshark is &quot;D:\Wireshark\Wireshark.exe&quot;. Same Path I mentioned in Packet capture analysis command. Screen shot od error message is attacked below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/60aEr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/60aEr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17520" LastActivityDate="2017-08-06T20:46:10.130" Title="Wireshark is giving error message while capturing packets from GNS3?" Tags="|wireshark|gns3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22557" PostTypeId="2" ParentId="22556" CreationDate="2015-09-16T23:22:37.317" Score="2" Body="&lt;p&gt;Check the location of your Wireshark install , make sure it is like&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;tail.exe -f -c +0b %c | &quot;D:\Wireshark\Wireshark.exe&quot; -k -i -&lt;/em&gt;&lt;/strong&gt; ,for your case.&#xA;may you need also to shut down your windows firewall &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-16T23:22:37.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22558" PostTypeId="1" CreationDate="2015-09-17T01:12:33.420" Score="6" ViewCount="6162" Body="&lt;p&gt;I have two Cisco 3560's in a branch office. One acts as an access switch configured with two vlans:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan10&#xA; ip address 192.168.0.254 255.255.255.0&#xA;&#xA;interface Vlan20&#xA; ip address 172.16.0.254 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is connected to the same model switch in a Comms room that will be routing back to the Core network. The Core for this exercise is also a 3560 layer 3 switch connected as a point to point link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have added the VLANs to all switches, but with different SVIs (i.e x.x.x.253/24 and  x.x.x.252/24)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also enabled IP Routing on each switch. I would like to use OSPF to route the traffic over the network and have configured this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also configured the interconnecting interfaces with 'no switchport' and assigned an IP address. These networks have been added to the OSPF routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/McAup.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/McAup.png&quot; alt=&quot;Here is a diagram with the configuration details&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interfaces on the Access switch have been configured with VLANs and the PCs are assigned static IP Addresses&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Access_Switch#&#xA;interface GigabitEthernet0/1&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;end&#xA;&#xA;interface GigabitEthernet0/2&#xA; switchport access vlan 20&#xA; switchport mode access&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this information should I be able to ping a host connected to the core (or even telnet the Core switch) from a host connected to the Access switch in the branch office?  Thanks in advance :)&lt;/p&gt;&#xA;" OwnerUserId="19081" LastActivityDate="2015-09-17T01:20:27.487" Title="Assistance with routing between layer 3 switches with ospf" Tags="|cisco|routing|ospf|layer3|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22559" PostTypeId="2" ParentId="22558" CreationDate="2015-09-17T01:20:27.487" Score="2" Body="&lt;p&gt;If all your interfaces are passive in OSPF, OSPF will never create neighbors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you really don't want the same network on two device separated by a layer-3 link since devices on Access VLANs 10 and 20 will never be able to communicate with Comms VlANs 10 and 20, and neither will be able to communicate with Core VLANs 10 and 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really need to rethink this design.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-17T01:20:27.487" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="22561" PostTypeId="2" ParentId="22535" CreationDate="2015-09-17T07:07:16.557" Score="0" Body="&lt;p&gt;As like @Ron Maupin said, the wireless issue much likely cause by miss configured wireless AP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you sure your AP channel not configured properly (using auto mode), try to manage channel properly and see if the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.slideshare.net/PeterSam67/advanced-location-based-services&quot; rel=&quot;nofollow&quot;&gt;He some material that may help you deploying more efficient wireless network.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8154" LastActivityDate="2015-09-17T07:07:16.557" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="22563" PostTypeId="1" AcceptedAnswerId="22599" CreationDate="2015-09-17T10:06:46.830" Score="3" ViewCount="155" Body="&lt;p&gt;I have a full mesh core network running OSPF. I use OSPF down to the &quot;L3 Agg switches&quot;. Now I want to restrict traffic between some of the networks at our site, but how is this done when there is multiple routes to every network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Behind every &quot;L3 Agg switch&quot; there is a cluster that in some cases need to be isolated from the rest of the network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MkoSF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MkoSF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16331" LastActivityDate="2015-09-18T02:02:26.693" Title="How to manage ACL in a routed network" Tags="|routing|ospf|security|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22565" PostTypeId="2" ParentId="22554" CreationDate="2015-09-17T10:51:55.430" Score="2" Body="&lt;p&gt;If you have a valid configuration backup you can boot sonicwall in safe mode and change admin password, which is &lt;strong&gt;not&lt;/strong&gt; stored in exported backup file. &#xA;You have to phisically access the appliace, however...&#xA;See &lt;a href=&quot;https://support.software.dell.com/kb/sw8010&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw8010&lt;/a&gt;&#xA;So: &#xA;-find configuration backup&#xA;-start safe mode in your sonicwall as per kb article&#xA;-change password&#xA;-reboot appliance in normal mode&#xA;-restore configuration&lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2015-09-17T10:51:55.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22566" PostTypeId="1" AcceptedAnswerId="22568" CreationDate="2015-09-17T11:07:31.997" Score="0" ViewCount="166" Body="&lt;p&gt;I've read a lot of definitions of DCE and DTE and I'd want to know if data transmission if exclusive responsibility of a DCE.&lt;/p&gt;&#xA;" OwnerUserId="19092" LastActivityDate="2015-09-17T11:53:25.367" Title="Exclusive responsibility of a DCE" Tags="|terminology|data|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22568" PostTypeId="2" ParentId="22566" CreationDate="2015-09-17T11:53:25.367" Score="2" Body="&lt;p&gt;What is the actual function of the DCE ? , that is to provide &lt;strong&gt;&lt;em&gt;clock rate&lt;/em&gt;&lt;/strong&gt; to the DTE on the &lt;strong&gt;&lt;em&gt;SERIAL link&lt;/em&gt;&lt;/strong&gt; . This type of communications between two routers called (back to back routers connection) and could be between router on your site (your ownership) and other in ISP ownership,&#xA;So answer of your questions is YES, DCE is responsible on the data transferee but only on the &lt;strong&gt;&lt;em&gt;serial interface&lt;/em&gt;&lt;/strong&gt;, on any other tybe of connection (ethernet) DCE has no control on the data transferee.   &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-17T11:53:25.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22569" PostTypeId="1" CreationDate="2015-09-17T12:27:08.563" Score="0" ViewCount="1478" Body="&lt;p&gt;I have a core switch which is a HP Procurve switch with Vlans 1, 10, 20.  I'm trying to setup an edge Dell switch.  On the HP I have untagged vlan 1 and tagged vlans 10, 20 on port 1.  On the Dell switch I changed port 16 to 'switchport general', with 10, 20 tagged (I think I had vlan 1 as the PVID).  I then set port 2 as Switchport Access vlan 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect a computer to port 2 on the Dell switch, it gets an IP from the vlan 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't edited any encapsulation settings, so I assume they're both 802.1q, and I can't see any reference to encapsulation in the running config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have successful linked to HP Procurves before, I just haven't used a Dell switch before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions on what might be wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also a little confused about, when to use 'general' and when to use 'trunk' on the Dell switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19097" LastActivityDate="2015-10-11T15:09:10.523" Title="Passing Vlans between HP Procurve and Dell Powerconnect switches" Tags="|vlan|hp-procurve|dell|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22571" PostTypeId="1" AcceptedAnswerId="22572" CreationDate="2015-09-17T15:52:11.813" Score="0" ViewCount="64" Body="&lt;p&gt;I'm searching a switch where I can route all ethernet packages over one input/output port. It should be impossible to communicate directly between two ports, but with that single on.&#xA;How is such a feature, where I can decide which ports are allowed to communicate directly with eachother, called?&lt;/p&gt;&#xA;" OwnerUserId="19100" LastActivityDate="2015-09-20T21:31:41.330" Title="network-switch where I can allow which ports can communicate with each other" Tags="|switch|" AnswerCount="1" CommentCount="1" ClosedDate="2015-09-23T11:25:14.267" ContentLicense="CC BY-SA 3.0" />
  <row Id="22572" PostTypeId="2" ParentId="22571" CreationDate="2015-09-17T16:02:18.593" Score="0" Body="&lt;p&gt;There are several ways to do this depending on the switch vendor.&#xA;Here is a list of features that can accomplish what you want to do:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&lt;li&gt;Private VLANs&#xA;&lt;/li&gt;&lt;li&gt;EVC: Ethernet Virtual Connection&#xA;&lt;/li&gt;&lt;li&gt;VPC: Virtual Private Connection&#xA;&lt;/li&gt;&lt;li&gt;Bridge ports&#xA;&lt;/li&gt;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The list goes on, but that should be a good starting point to compare switches with.&lt;/p&gt;&#xA;" OwnerUserId="635" LastEditorUserId="635" LastEditDate="2015-09-20T21:31:41.330" LastActivityDate="2015-09-20T21:31:41.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22574" PostTypeId="1" CreationDate="2015-09-17T16:46:50.240" Score="1" ViewCount="148" Body="&lt;p&gt;My professor differentiates between Datagram network and Packet network. But I don't get the difference between the two. I believe that Datagram network is just a sub-term under Packet network as a connectionless-oriented which differentiates it from a virtual-circuit network(also a sub-term under packet network). As part of an exercise, I was asked under which condition is the performance of a Datagram network the same as a Packet network. I don't know how to even begin answering this question. Could someone please explain the difference to me?&lt;/p&gt;&#xA;" OwnerUserId="19101" LastActivityDate="2015-09-17T16:46:50.240" Title="The difference between Packet network and Datagram network" Tags="|switching|" AnswerCount="0" CommentCount="1" ClosedDate="2015-09-18T16:07:03.043" ContentLicense="CC BY-SA 3.0" />
  <row Id="22575" PostTypeId="1" AcceptedAnswerId="22584" CreationDate="2015-09-17T17:35:59.590" Score="1" ViewCount="2413" Body="&lt;p&gt;I have a laptop and a wireless router at home. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is this LAN ?&lt;/li&gt;&#xA;&lt;li&gt;Is this private network ?&lt;/li&gt;&#xA;&lt;li&gt;Is every LAN a private network?&lt;/li&gt;&#xA;&lt;li&gt;If true for question 1, where is my proxy and firewall ? Built inside router ? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4339" LastActivityDate="2017-02-08T09:59:46.380" Title="Is my home network a LAN?" Tags="|lan|" AnswerCount="3" CommentCount="2" ClosedDate="2015-09-18T16:07:12.867" ContentLicense="CC BY-SA 3.0" />
  <row Id="22576" PostTypeId="2" ParentId="22575" CreationDate="2015-09-17T18:02:21.090" Score="1" Body="&lt;p&gt;Yes, that is a LAN and it is private network(It uses Private Network range IPs:&lt;a href=&quot;https://en.wikipedia.org/wiki/Private_network&quot; rel=&quot;nofollow noreferrer&quot;&gt;Private Network&lt;/a&gt;). Depending upon your router, the router may have simple firewall(E.g. &lt;a href=&quot;http://www.dd-wrt.com/wiki/index.php/What_is_%22DD-WRT%22%3F&quot; rel=&quot;nofollow noreferrer&quot;&gt;DD-WRT&lt;/a&gt; firmware for routers has simple firewall) and other functionalities inbuilt. I guess, proxy is not required in your home LAN. Generally it would be in Offices, Collegs to reach other networks (&lt;a href=&quot;https://en.wikipedia.org/wiki/Proxy_server&quot; rel=&quot;nofollow noreferrer&quot;&gt;Check Here for Proxy&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="17153" LastEditorUserId="17153" LastEditDate="2017-02-08T09:59:46.380" LastActivityDate="2017-02-08T09:59:46.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22577" PostTypeId="2" ParentId="22575" CreationDate="2015-09-17T18:22:49.550" Score="2" Body="&lt;p&gt;Yes, you have a LAN, cause you are in an área network, but locally. If you add more equipment to your network, conneting to the wireless router, all the equipment will still be in the same network, the only difference is that, you are in a Wireless LAN. Your router have an DHCP service running, is the proccess that make possible give one IP address to all equipment in your home.&#xA;And, by the other hand, your are in a private network, cause im 99 % totally sure you are using an IP address in the range of:&#xA;192.168.x.x/24&#xA;10.10.x.x/24&#xA;172.16.x.x/24&#xA;or something like that.&#xA;Your can surf the web and find information about this IP ranges, calleds, Private Ranges, cause is for using into a LAN, behind a firewall, or a Proxy.&#xA;Your firewall or proxy, must be located in your ISP equipment, that is on charge of communicate to you with the internet, with real IP&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-17T18:22:49.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22578" PostTypeId="1" CreationDate="2015-09-17T19:07:54.867" Score="1" ViewCount="490" Body="&lt;p&gt;I'm guessing the answer to this questions is yes, but I just wanted to check before buying the kit :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to overlay VPN access onto an existing network (standard DSL/Wifi).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked at dd-wrt and Tomato, which allow both selective and policy-based routing, but the configuration scripts seem a pain to maintain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking a simple solution might be to buy a second wifi router (with OpenVPN) and configure it as an access point with the first router as its default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would then have two wifi networks: one straight out and the other always over the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no requirement for the various connected devices to communicate with each other, so them being on potentially different subnets is not an issue here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question essentially boils down to: can I open a VPN tunnel on a router which is not directly touching the WAN?&lt;/p&gt;&#xA;" OwnerUserId="19106" LastEditorUserId="19106" LastEditDate="2015-09-25T18:23:38.140" LastActivityDate="2015-09-25T18:23:38.140" Title="Two WIFI routers, one dedicated to VPN" Tags="|router|vpn|ieee-802.11|" AnswerCount="0" CommentCount="6" ClosedDate="2015-09-18T16:06:20.973" ContentLicense="CC BY-SA 3.0" />
  <row Id="22579" PostTypeId="2" ParentId="17843" CreationDate="2015-09-17T19:21:23.313" Score="3" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;for the first part of your question&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Cisco device There are &lt;strong&gt;&lt;em&gt;16 privilege levels&lt;/em&gt;&lt;/strong&gt; 3 of them are default and the other are configurable . the default as you said &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Privilege level 0 — includes the disable, enable, exit, help, and logout commands.&lt;br&gt;&#xA;Privilege level 1 — Normal level on Telnet; includes all user-level commands at the router&gt; prompt.&lt;br&gt;&#xA;Privilege level 15 — includes all enable-level commands at the router# prompt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;*Commands available at a particular level in a particular router can be found by typing a ? at the router prompt. *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router&gt;show privilege&lt;br&gt;&#xA;Current privilege level is 1&lt;br&gt;&#xA;Router&gt;enable 5&lt;br&gt;&#xA;Password: level-5-password&lt;br&gt;&#xA;Router#show privilege&lt;br&gt;&#xA;Current privilege level is 5&lt;br&gt;&#xA;Router#   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can configure whatever privilege you need with whatever commands you allow &#xA;by using the privilege command as illustrated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;privilege mode {level level command | reset} command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the highest privilege level can execute commands that associated to it plus the the command associated to the lower privilege &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;example&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;username user_9  privilege 9 password pass_1&lt;br&gt;&#xA;username user_6  privilege 6 password pass_6&lt;br&gt;&#xA;username user_15  privilege 15 password pass_15    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;privilege configure level 8 snmp-server community&lt;br&gt;&#xA;privilege exec level 6 show running&lt;br&gt;&#xA;privilege exec level 8 configure terminal    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;User user_6 is able to Telnet in and execute the show run command, but the resulting configuration is virtually blank because this user cannot configure anything (configure terminal is at level 8, not at level 6). The user is not permitted to see usernames and passwords of the other users, or to see Simple Network Management Protocol (SNMP) information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;User user_9 is able to Telnet in and execute the show run command, but only sees commands that he can configure (the snmp-server community part of the router configuration, since this user is our network management administrator). He can configure snmp-server community because configure terminal is at level 8 (at or below level 9), and snmp-server community is a level 8 command. The user is not permitted to see usernames and passwords of the other users, but he is trusted with the SNMP configuration.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-17T19:33:40.333" LastActivityDate="2015-09-17T19:33:40.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22580" PostTypeId="1" AcceptedAnswerId="22582" CreationDate="2015-09-17T20:03:45.633" Score="2" ViewCount="314" Body="&lt;p&gt;There are algorithms that do compression technique on the TCP/IP headers to increase transmision efficiency such as &lt;code&gt;Van Jacobson TCP/IP Header Compression&lt;/code&gt;. In case a router receives a compressed header, how does the router extract the IP header? What if there are multiple routers on the path to the destination?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2017-04-03T20:10:08.777" Title="How do routers deal with compressed TCP/IP headers?" Tags="|cisco|routing|switch|tcp|ip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22581" PostTypeId="2" ParentId="22477" CreationDate="2015-09-17T20:15:51.887" Score="2" Body="&lt;p&gt;ther is many ways to do so &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;to use &lt;strong&gt;&lt;em&gt;netstat and is extensions&lt;/em&gt;&lt;/strong&gt; in the CMD . it will give you all you want . &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;examples in images &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/URqtR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/URqtR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2gxru.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2gxru.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a good tutorial for netstate commands &lt;a href=&quot;http://pcsupport.about.com/od/commandlinereference/p/netstat-command.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;NETSTATE COM&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i know it is a very hard way to do so but it is free of charge &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;SolarWinds Response Time Viewer for Wireshark&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;it is the revers engineering of you question . it will list the applications used in you session and all related details &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rZ6Le.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rZ6Le.jpg&quot; alt=&quot;SW&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jpsj1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jpsj1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;other wise you will need to bay for monitoring tool include DPI features (i.e. solarwinds , manageenginee )&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-17T20:15:51.887" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22582" PostTypeId="2" ParentId="22580" CreationDate="2015-09-17T20:22:11.910" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.ietf.org/rfc/rfc1144.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 1144&lt;/a&gt; explains how both compression and decompression work.  This was designed for low-speed serial links.  Most links today are fast enough that this just isn't needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This RFC is has been around for a very long time, and just about every router vendor supports it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-17T20:22:11.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22583" PostTypeId="1" AcceptedAnswerId="22598" CreationDate="2015-09-17T20:23:31.213" Score="4" ViewCount="229" Body="&lt;p&gt;From the way I understand it, Source based RTBH (&lt;a href=&quot;http://packetlife.net/blog/2010/aug/23/source-based-rtbh/&quot; rel=&quot;nofollow&quot;&gt;http://packetlife.net/blog/2010/aug/23/source-based-rtbh/&lt;/a&gt;) works on the principle that only if the routing entry for the IP address is present, it will allow the packet through. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is that if I initiate the connection to 123.123.123.123 (which is on the internet) then the response will be allowed to enter as the FIB will see that the request was actually initiated from my end (hopefully this is a correct understanding).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is that at any given time.. someone will always be on Google, or Wikipedia. So how can one prevent an attack from someone who is spoofing their IP and using the IP of a large organisation such as Google or Wikipedia.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If my understanding is correct, If I initiate the connection to Google, then the response will be allowed in (as the FIB will see that I sourced it), but how would it know that it was someone impersonating Google that is re-entering.&lt;/p&gt;&#xA;" OwnerUserId="13422" LastActivityDate="2015-09-18T01:42:55.710" Title="Source based RTBH with spoofed IP addresses" Tags="|routing|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22584" PostTypeId="2" ParentId="22575" CreationDate="2015-09-17T20:26:30.647" Score="1" Body="&lt;p&gt;Based on your question I think you are kind of new to these subjects like I am new to the forum. Local Area Network refers to a network that is geographically or location wise at the same place/locality and doesn't span large areas as the name suggests. IS your home a network? Yes it is. Why? Because you have at least 2 devices within the same IP subnet which is communicating. Any device that you will connect to your router will have an IP address from the same range and they will be part of your network. You could connect a printer and start printing once you tell your PC/laptop where to go for printing because they can communicate. So you are a little community at home. This is a LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Private Network doesn't necessarily refer to privacy in the classical sense. Private Networks are the IP ranges that are designated for home/company local area networks. Private IP subnets are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.0.0.0 / 8&#xA;172.16.0.0/12&#xA;192.168.0.0 /16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means you can use these subnets at home. You and your neighbour's LANs can have the same IP subnets, they can be used by other people as long as their networks are not in contact/adjacent. These are called private because these IP subnets can not travel to internet, tehy won't be routed. That's a rule, it is given. Why? Because they are not unique. Internet is one big network and IP adresses there cannot be duplicates. This is why, at the edge of your network, there will be a device like a router or firewall whose partial job is to translate your private IPs to a/some Public IP(s). If you check your PC's IP address and tthen go to whatismyip and check your IP you will see different IP addresses. Whatismyip will show you what public IP address your ISP assigned you at the time. These addresses are called public because hey are really public. Maybe you can find similarities between this and telephony world. You may have extensions in a building which can't be called from public world, but there will be either one or more public phone numbers at the edge of your building where people can reach and wich will show up as your number when you call somewhere outside your building. This is exactly how private and public IPs work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also asked about proxy. There isn't necessarily a proxy at homes. A proxy is who asks for websites outside your network on behalf of you. You can install one at home, tell your other PCs to use this proxy and they will start forwarding web requests to proxy first and it will call them. What is the point? If you are on a company network, applying policies like URL filtering and firewall policies will be easier because you will be able o collect all web traffic at one place and then apply what you want. Traffic may come to proxy which will itself check your request against your URL filtering policies either hosted on itself or some other server/computer and it will allow or block. There are otther uses for a proxy server where for example you are in the UK but want to forward all your web requests to France as if you were based in France.French server would request the pages for you and bring the results to your PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is every LAN a private network? Sort of but not necessarily. You could in theory use public IP addresses at home behind a firewall and this would still be a LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="19108" LastEditorUserId="19108" LastEditDate="2015-09-18T05:12:50.200" LastActivityDate="2015-09-18T05:12:50.200" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22586" PostTypeId="1" AcceptedAnswerId="22588" CreationDate="2015-09-17T20:49:34.377" Score="2" ViewCount="749" Body="&lt;p&gt;We have an Arista 7050S configured with a few PVLANs. All hosts on these PVLAN share the same /24 network (major flaw?). They can communicate between themselves within each PVLAN and with the gateway (to be able to reach the Internet). They currently cannot communicate with each other, if the hosts are on different PVLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a need to allow some servers from PVLAN 1 to access a service on a different host on PVLAN 2. Because they are on the same /24 network, that creates some issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We could fix the netmask but it would require some IP reassignments that we'd like to avoid. Are there are features on the eOS that we might be overlooking and would allow us to pierce some holes and permit inter-PVLAN communication with a /24 ?&lt;/p&gt;&#xA;" OwnerUserId="10004" LastEditorUserId="8499" LastEditDate="2018-12-12T03:18:15.367" LastActivityDate="2018-12-12T03:18:15.367" Title="Inter-PVLAN communication on Arista 7050S" Tags="|vlan|ip|subnet|ip-address|arista|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22588" PostTypeId="2" ParentId="22586" CreationDate="2015-09-17T21:35:10.033" Score="2" Body="&lt;p&gt;This is all very basic networking that you must understand before you start designing networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a host is trying to send to another host on the same network, it will not send to the router.  An IP address is the address for a layer-3 packet that gets encapsulated into a layer-2 frame before going out the layer-1 interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A layer-2 frame has source and destination addresses (MAC addresses), too.  The source host needs to know the destination layer-2 address so it looks in its ARP cache.  If it isn't in the ARP cache, it will ARP for it (a layer-2 broadcast).  Layer-2 broadcasts will not cross a layer-3 boundary (router) to get to another VLAN, so the sending host will never get the layer-2 address and can't send to the destination host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means that two hosts on separate VLANs, but in the same network, can't communicate at layer-2, so they can't communicate at layer-3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the two hosts are on different networks, the sending host uses the gateway's (router) layer-2 address to encapsulate the layer-3 packet.  The router will strip off the layer-2 frame and routes the layer-3 packet to another interface where it encapsulates the layer-3 packet into a new layer-2 frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you really need is to use different networks for your different VLANs if you want them to communicate through the router. &lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-17T21:35:10.033" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22590" PostTypeId="1" CreationDate="2015-09-17T22:11:18.640" Score="2" ViewCount="1011" Body="&lt;p&gt;Ok,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basic question is this.&lt;br&gt;&#xA; &lt;strong&gt;show ip igmp snooping groups&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is not returning the multicast groups I am creating&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More in-depth explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to test multicast.  I am on a flat network, and I just want to be able to multicast between clients on the same vlan, and even the same switch.  I can use a multicast tool to mimic both a sending and receiving host.  This tool works as expected on network A(where I know multicast works), while on network B I get a couple different results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If multicasting between 2 hosts on the same Vlan and the same switch:&#xA;Then I can transmit and receive, however, &lt;strong&gt;show ip igmp snooping groups&lt;/strong&gt; is does not populate with the multicast group I am using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I am not routing between vlans, and I am on the same switch /vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the IGMP vlan config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip igmp snooping vlan 888&#xA;Global IGMP Snooping configuration:&#xA;-------------------------------------------&#xA;IGMP snooping              : Enabled&#xA;IGMPv3 snooping (minimal)  : Enabled&#xA;Report suppression         : Enabled&#xA;TCN solicit query          : Disabled&#xA;TCN flood query count      : 2&#xA;Robustness variable          : 2&#xA;Last member query count      : 2&#xA;Last member query interval : 1000&#xA;&#xA;Vlan 888:&#xA;--------&#xA;IGMP snooping                       : Enabled&#xA;CAPWAP enabled                      : Disabled&#xA;IGMPv2 immediate leave              : Disabled&#xA;Multicast router learning mode      : pim-dvmrp&#xA;CGMP interoperability mode          : IGMP_ONLY&#xA;Robustness variable                 : 2&#xA;Last member query count             : 2&#xA;Last member query interval          : 1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My test multicast does seem to be transmitting/receiving correctly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sending&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Singlewire Software Packet 254  239.0.1.2:20480  TTL: 16&#xA;Singlewire Software Packet 255  239.0.1.2:20480  TTL: 16&#xA;Singlewire Software Packet 256  239.0.1.2:20480  TTL: 16&#xA;Singlewire Software Packet 257  239.0.1.2:20480  TTL: 16&#xA;Singlewire Software Packet 258  239.0.1.2:20480  TTL: 16&#xA;Singlewire Software Packet 259  239.0.1.2:20480  TTL: 16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Receiving&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Receive Singlewire Software Packet 254 : 239.0.1.2:20480 : Receive Total 26&#xA;Receive Singlewire Software Packet 255 : 239.0.1.2:20480 : Receive Total 27&#xA;Receive Singlewire Software Packet 256 : 239.0.1.2:20480 : Receive Total 28&#xA;Receive Singlewire Software Packet 257 : 239.0.1.2:20480 : Receive Total 29&#xA;Receive Singlewire Software Packet 258 : 239.0.1.2:20480 : Receive Total 30&#xA;Receive Singlewire Software Packet 259 : 239.0.1.2:20480 : Receive Total 31&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show ip igmp snooping groups&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seems to return these two unrelated multicast groups which are on a different vlan.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show ip igmp snooping groups&#xA;Vlan      Group                    Type        Version     Port List&#xA;-----------------------------------------------------------------------&#xA;889       224.0.5.128              igmp        v2          Fa0/33, Gi0/2&#xA;889       239.255.255.250          igmp        v2          Fa0/13, Gi0/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do I have to setup PIM/RP/etc on a layer 3 switch/router?  How do you get a ip igmp snooping groups to populate on a layer 2 switch?&lt;/p&gt;&#xA;" OwnerUserId="19110" LastEditorUserId="8499" LastEditDate="2018-03-19T20:46:57.370" LastActivityDate="2018-03-19T20:46:57.370" Title="Multicasting questions" Tags="|cisco|multicast|igmp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22591" PostTypeId="2" ParentId="22590" CreationDate="2015-09-17T22:20:51.160" Score="0" Body="&lt;p&gt;If you want multicast to cross between different networks, all the routers in between the two networks must be multicast enabled. This is why you don't multicast on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IGMP snooping will populate on a capable switch that has one or more hosts join IGMP on the router.  IGMP snooping snoops on the IGMP conversation between the host and the router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-17T22:20:51.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22592" PostTypeId="2" ParentId="17801" CreationDate="2015-09-17T22:43:53.487" Score="1" Body="&lt;p&gt;&lt;strong&gt;QoS takes action when there is a congestion&lt;/strong&gt;. So, yes, your team mates might be right when saying that a link used at 50 to 70 percent doesn't need QoS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, let's think to a theoretical link of 1 bit per second with a clock rate of 1 second (meaning that there would be 1 wire that transmit either 1 or 0 for 1 second, because destination wouldn't be able to catch the value if the signal is shorter): until the traffic that we need to send is of 1 bit per second, we just put that bit into the wire. No QoS is needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if we receive 2 bits per second from a faster link (a LAN for instance), these 2 bits need to be forwarded to the 1bit/s link, and so we need to either queue or drop 1 of the 2 packets we received, while forwarding the other 1 bit. Here QoS should be used to decide what bit must be forwarded first, and what should we do with the other one (basically, drop or queue).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, &lt;strong&gt;in a real world situation, we have links that have a fixed bandwidth and that can transmit only at that bandwidth&lt;/strong&gt;; for instance, an Ethernet 100M full duplex can send and receive data at 100Mbps only. If we're connected to an ISP with a 100M Ethernet link but we pay for 50Mbps, our link must send frames/packets at 100Mbps. To achieve the 50Mbps we need to do something like transmitting at 100Mbps for an half second, and than wait another half second without transmitting anything, obtaining the average of 50Mbps in the time of 1 second. In this example, a burst may allow to transmit at 100Mbps for 1 full second if we didn't transmit anything in the previous 1 second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With these concepts in mind, we can understand that the link used at 50%, that hasn't any burst above the link capacity, will never be congested and QoS won't be used. On the other side, in a real world, it's rare to spend a lot of money for a WAN link that is never fully utilised (but it might be not in a LAN); also, &lt;strong&gt;peaks of traffic happen in a usually unforeseeable manner&lt;/strong&gt;. Consequently, moments of congestion should be taken in account in a good plan, in order to permit the flow of the critical traffic while sacrificing the non critical one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;QoS is quite complex anyway, if you're interested &lt;strong&gt;I wrote this column: &lt;a href=&quot;https://www.matteo.site/blog/post/quality-of-service/&quot; rel=&quot;nofollow&quot;&gt;https://www.matteo.site/blog/post/quality-of-service/&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="17572" LastEditorUserId="17572" LastEditDate="2016-08-28T08:35:48.220" LastActivityDate="2016-08-28T08:35:48.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22593" PostTypeId="1" CreationDate="2015-09-17T22:56:55.960" Score="1" ViewCount="872" Body="&lt;p&gt;I'm having issues with connectivity on my home &lt;strong&gt;lab&lt;/strong&gt; network after trying a different setup. Can't connect to the pfsense box from LAN, though pfsense can reach all the way to the LAN network.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/VVIZc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VVIZc.png&quot; alt=&quot;homenet&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;From the viewpoint of my laptop&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping 192.168.1.1 From laptop to fa 1/0/1 interface&#xA;PING 192.168.1.1 (192.168.1.1): 56 data bytes&#xA;64 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=1.290 ms&#xA;64 bytes from 192.168.1.1: icmp_seq=1 ttl=255 time=1.281 ms&#xA;64 bytes from 192.168.1.1: icmp_seq=2 ttl=255 time=1.865 ms&#xA;64 bytes from 192.168.1.1: icmp_seq=3 ttl=255 time=3.229 ms&#xA;&#xA;ping 192.168.1.43 From laptop to fa 1/0/2 interface&#xA;PING 192.168.1.43 (192.168.1.43): 56 data bytes&#xA;64 bytes from 192.168.1.43: icmp_seq=0 ttl=255 time=1.256 ms&#xA;64 bytes from 192.168.1.43: icmp_seq=1 ttl=255 time=1.606 ms&#xA;64 bytes from 192.168.1.43: icmp_seq=2 ttl=255 time=1.299 ms&#xA;64 bytes from 192.168.1.43: icmp_seq=3 ttl=255 time=1.877 ms&#xA;&#xA;ping 192.168.1.41 From laptop to Pfsense&#xA;PING 192.168.1.41 (192.168.1.41): 56 data bytes&#xA;Request timeout for icmp_seq 0&#xA;Request timeout for icmp_seq 1&#xA;Request timeout for icmp_seq 2&#xA;Request timeout for icmp_seq 3&#xA;Request timeout for icmp_seq 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Laptop has connectivity to L3 switch but not pfsense box&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;From the viewpoint of the L3 switch:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping 192.168.1.1 - From SW to host in LAN&#xA;&#xA;    Type escape sequence to abort.&#xA;    Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:&#xA;    !!!!!&#xA;    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/7/17 ms&#xA;&#xA; ping 192.168.1.41 - From SW to Pfsense em1 interface&#xA;&#xA;    Type escape sequence to abort.&#xA;    Sending 5, 100-byte ICMP Echos to 192.168.1.41, timeout is 2 seconds:&#xA;    !!!!!&#xA;    Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/8 ms&#xA;&#xA; ping 8.8.8.8 - L3 SW to internet&#xA;&#xA; Type escape sequence to abort.&#xA; Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:&#xA; .....&#xA; Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Routing table&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip route&#xA;Gateway of last resort is 0.0.0.0 to network 0.0.0.0&#xA;&#xA;     192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C       192.168.1.40/29 is directly connected, FastEthernet1/0/2&#xA;C       192.168.1.0/28 is directly connected, FastEthernet1/0/1&#xA;S*   0.0.0.0/0 is directly connected, FastEthernet1/0/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;running config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router-L3(config)#do show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 3239 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname Router-L3&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret &#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;switch 1 provision ws-c3750-48ts&#xA;system mtu routing 1500&#xA;ip routing&#xA;ip name-server 50.116.40.226&#xA;ip name-server 104.245.39.112&#xA;ip name-server 74.207.232.103&#xA;ip name-server 107.170.95.180&#xA;ip name-server 8.8.8.8&#xA;ip dhcp excluded-address 192.168.1.1 192.168.1.2&#xA;!&#xA;ip dhcp pool LAN&#xA;   network 192.168.1.0 255.255.255.240&#xA;   dns-server 50.116.40.226 104.245.39.112&#xA;   default-router 192.168.1.1&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet1/0/1&#xA; description LAN&#xA; no switchport&#xA; ip address 192.168.1.1 255.255.255.240&#xA;!&#xA;interface FastEthernet1/0/2&#xA; description TO FW&#xA; no switchport&#xA; ip address 192.168.1.43 255.255.255.248&#xA;!&#xA;interface FastEthernet1/0/3&#xA;!&#xA;[...]&#xA;interface FastEthernet1/0/48&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip default-gateway 192.168.1.41&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 FastEthernet1/0/2&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 5 15&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;L3 SW has connectivity to LAN and pfsense box, but not the internet&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Viewpoint from PFsense&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PING 192.168.1.43 (192.168.1.43): 56 data bytes  - PFsense to L3 fa 1/0/2&#xA;64 bytes from 192.168.1.43: icmp_seq=0 ttl=255 time=2.502 ms&#xA;64 bytes from 192.168.1.43: icmp_seq=1 ttl=255 time=2.281 ms&#xA;64 bytes from 192.168.1.43: icmp_seq=2 ttl=255 time=2.405 ms&#xA;64 bytes from 192.168.1.43: icmp_seq=3 ttl=255 time=1.730 ms&#xA;&#xA;--- 192.168.1.43 ping statistics ---&#xA;4 packets transmitted, 4 packets received, 0.0% packet loss&#xA;round-trip min/avg/max/stddev = 1.730/2.229/2.502/0.299 ms&#xA;&#xA;PING 192.168.1.1 (192.168.1.1): 56 data bytes - PFsense to L3 fa 1/0/1&#xA;64 bytes from 192.168.1.1: icmp_seq=0 ttl=255 time=0.571 ms&#xA;64 bytes from 192.168.1.1: icmp_seq=1 ttl=255 time=0.537 ms&#xA;64 bytes from 192.168.1.1: icmp_seq=2 ttl=255 time=0.548 ms&#xA;64 bytes from 192.168.1.1: icmp_seq=3 ttl=255 time=0.519 ms&#xA;&#xA;--- 192.168.1.1 ping statistics ---&#xA;4 packets transmitted, 4 packets received, 0.0% packet loss&#xA;round-trip min/avg/max/stddev = 0.519/0.544/0.571/0.019 ms&#xA;&#xA;PING 192.168.1.13 (192.168.1.13): 56 data bytes - From PFSense to a host in Lan&#xA;64 bytes from 192.168.1.13: icmp_seq=0 ttl=63 time=53.374 ms&#xA;64 bytes from 192.168.1.13: icmp_seq=1 ttl=63 time=69.013 ms&#xA;64 bytes from 192.168.1.13: icmp_seq=2 ttl=63 time=79.912 ms&#xA;64 bytes from 192.168.1.13: icmp_seq=3 ttl=63 time=114.207 ms&#xA;&#xA;--- 192.168.1.13 ping statistics ---&#xA;4 packets transmitted, 4 packets received, 0.0% packet loss&#xA;round-trip min/avg/max/stddev = 53.374/79.126/114.207/22.342 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Firewall config&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/WpGTw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WpGTw.png&quot; alt=&quot;Firewall config&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Routing table&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/um1Wl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/um1Wl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pf sense has connectivity to internet, and all the way to LAN&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I believe it's an issue with the L3 switch, but there's something obvious I'm missing but I can't see it at the moment. Any help would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="4603" LastEditorUserId="4603" LastEditDate="2015-09-17T23:08:25.230" LastActivityDate="2015-12-19T17:24:50.997" Title="Connectivity issues/L3 switch" Tags="|cisco|routing|pfsense|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22594" PostTypeId="2" ParentId="22593" CreationDate="2015-09-17T23:10:34.117" Score="0" Body="&lt;p&gt;It looks like you have misconfigured the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is most likely with the pfsense box since the laptop can ping the other network through the layer-3 switch. Do you allow the pfsense box to receive ICMP from a different network on that interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can the layer-3 switch ping the local public address on the pfsense box?  It can't ping Google.  Something in the pfsense box is blocking you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, looking at your firewall rules, it looks like you only allow HTTP and HTTPS from anything other than the attached network.  The pfsense box rjects any other traffic from the network the laptop is on.  Try adding a rule just like the 2nd one, but using &lt;code&gt;192.168.1.0/28&lt;/code&gt; as the source.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-17T23:34:02.073" LastActivityDate="2015-09-17T23:34:02.073" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22595" PostTypeId="1" CreationDate="2015-09-17T23:36:38.273" Score="1" ViewCount="236" Body="&lt;p&gt;I am new to computer networking. One very simple question that comes to my  mind is how two AS - geographically apart are connected with each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, If I see the &lt;a href=&quot;http://lg.bt.net/&quot; rel=&quot;nofollow&quot;&gt;http://lg.bt.net/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BT Global Services: Looking Glass&#xA;&#xA;&#xA;Query:  Traceroute&#xA;Router:     Australia Sydney AS3300 - t1a1.au-syt&#xA;Address:    www.tune2wizard.com (66.96.147.82)&#xA;&#xA;Tracing the route to 82.147.96.66.static.eigbox.net (66.96.147.82)&#xA;VRF info: (vrf in name/id, vrf out name/id)&#xA;  1 i-0-11-0-0.sydp01.bi.telstraglobal.net (202.84.220.210) [AS 4637] 4 msec&#xA;    i-0-4-0-0.sydp01.bi.telstraglobal.net (202.84.223.10) [AS 4637] 9 msec&#xA;    i-0-11-0-0.sydp01.bi.telstraglobal.net (202.84.220.210) [AS 4637] 5 msec&#xA;  2 i-0-1-0-7.sydp-core03.bi.telstraglobal.net (202.84.223.9) [AS 4637] 3 msec 1 msec 2 msec&#xA;  3 i-0-4-0-6.1wlt-core01.bx.telstraglobal.net (202.84.141.41) [AS 4637] 149 msec&#xA;    i-0-6-0-1.1wlt-core01.bx.telstraglobal.net (202.84.249.61) [AS 4637] 152 msec&#xA;    i-0-6-0-0.1wlt-core01.bx.telstraglobal.net (202.84.144.221) [AS 4637] 152 msec&#xA;  4 i-0-5-0-1.tlot02.bi.telstraglobal.net (202.84.253.38) [AS 4637] 148 msec&#xA;    i-0-5-0-0.tlot02.bi.telstraglobal.net (202.84.253.34) [AS 4637] 148 msec&#xA;    i-0-0-0-5.tlot02.bi.telstraglobal.net (202.40.149.154) [AS 4637] 149 msec&#xA;  5 8-3-2.edge1.LosAngels.Level3.net (4.68.70.69) [AS 3356] 148 msec 164 msec&#xA;    l3-peer.tlot02.pr.telstraglobal.net (134.159.61.18) [AS 4637] 147 msec&#xA;  6 ae-0-11.bar2.Boston1.Level3.net (4.69.140.90) [AS 3356] 254 msec&#xA;    ge-6-12.car2.Cleveland1.Level3.net (4.69.140.178) [AS 3356] 257 msec&#xA;    ae-0-11.bar2.Boston1.Level3.net (4.69.140.90) [AS 3356] 254 msec&#xA;  7 ENDURANCE-I.bar2.Boston1.Level3.net (4.53.56.190) [AS 3356] 256 msec 255 msec 255 msec&#xA;  8  *  *  * &#xA;  9 82.147.96.66.static.eigbox.net (66.96.147.82) [AS 29873] 257 msec 265 msec 257 msec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This obviously tells that telestra - Australia is getting connected with edge1 - America. They are far from each other. How do they connect with each other physically? I don't think so there can be any wireless communication. Is somebody has laid these lines? How they are connected via wire? Somebody was saying that all the wires are going under the sea bed. I don't think so. So, please help me in understanding my very basic question.&lt;/p&gt;&#xA;" OwnerUserId="19113" LastActivityDate="2017-08-20T23:24:58.757" Title="how to AS geographically apart are connected physically?" Tags="|network-core|telephony|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22596" PostTypeId="2" ParentId="22595" CreationDate="2015-09-17T23:39:42.557" Score="0" Body="&lt;p&gt;They don't actually need a direct physical connection between them, but the AS in not tied to geography.  An AS can span the world.  Who's to say that the Australian AS doesn't have a presence in the U.S., or vice versa?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are actually fiber-optic cables running on the seafloor all over the world.  This has been true for many years, and the number of cables is growing.  See: &lt;a href=&quot;http://www.submarinecablemap.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.submarinecablemap.com/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-17T23:39:42.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22597" PostTypeId="2" ParentId="17030" CreationDate="2015-09-18T01:35:41.483" Score="0" Body="&lt;p&gt;i Think both definitions are very confusing. the author needs to define them again. i find it useful that enconding is choosing the method of coding the bits with volt, RF, or light. whereas signaling is defining what a zero and one represent. For example, the manchester code is a good example of picking a volt graph to represent a group of one and zeroes whereas the low to high voltage and high to low voltage representing  the zero and the one is an example of signaling. if im wrong correct me. this comes from the cisco book.&lt;/p&gt;&#xA;" OwnerUserId="19117" LastEditorUserId="19117" LastEditDate="2015-09-18T01:42:52.437" LastActivityDate="2015-09-18T01:42:52.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22598" PostTypeId="2" ParentId="22583" CreationDate="2015-09-18T01:42:55.710" Score="4" Body="&lt;p&gt;I think you are both misunderstanding how RTBH works and what it is designed to do.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My understanding is that if I initiate the connection to&#xA;  123.123.123.123 (which is on the internet) then the response will be allowed to enter as the FIB will see that the request was actually&#xA;  initiated from my end (hopefully this is a correct understanding).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm afraid that's not how S/RTBH works. The router doesn't know who initiated a connection; routers generally do not maintain connection state (firewalls do that).  Routers treat each packet individually, so the routing decision for an individual packet is made without regard to what happened before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;S/RTBH works because you are, in effect, spoofing the route:  you tell your border router that the attacker's IP is inside your network, not on the Internet.  When the router receives the bad packet from the outside interface, the RPF check fails and the packet is dropped because the router thinks the IP is on the inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;S/RTBH can't protect against spoofed packets.  It can only protect from known bad source IPs.  In that sense, it works like an access list, but more efficiently.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-09-18T01:42:55.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22599" PostTypeId="2" ParentId="22563" CreationDate="2015-09-18T02:02:26.693" Score="1" Body="&lt;p&gt;A good practice is to place access lists as close to the source as possible.  So for example, to block access to a specific host or subnet, you would place an ACL on the inbound interfaces of each agg switch (the interfaces that connect to your access layer).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-09-18T02:02:26.693" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22600" PostTypeId="1" CreationDate="2015-09-18T04:15:21.807" Score="1" ViewCount="202" Body="&lt;p&gt;I have been tasked to create a simple local SIP system. We have two Snom 710 phones and we just want one to call the other. We have tried Freeswitch and 3CX. It seems that we are missing something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of hardware and software, what else do we need other than 2 Snom phones and a Windows 7 laptop or Windows 2k8 Server (no AD or anything, just the OS)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if the setup is in just local test environment, do I need an SIP Provider?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19120" LastEditorUserId="19120" LastEditDate="2015-09-18T09:01:20.673" LastActivityDate="2015-09-18T15:19:13.147" Title="Basic SIP system" Tags="|sip|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-12T18:00:47.710" ContentLicense="CC BY-SA 3.0" />
  <row Id="22601" PostTypeId="1" CreationDate="2015-09-18T06:39:33.673" Score="1" ViewCount="298" Body="&lt;p&gt;We took on a client with a really old 2811, with a mess of a config file. We brought up a new IPsec tunnel to us. The tunnel works great, however, now only three computers can ping to 8.8.8.8, the rest get reports: &lt;code&gt;destination host unreachable&lt;/code&gt;. I tried writing an ACL allowing one of the effected computers to 8.8.8.8, but I still got nothing, and nothing showed up on on debug.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building configuration...&#xA;&#xA;Current configuration : 10307 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime localtime show-timezone&#xA;service timestamps log datetime localtime show-timezone&#xA;service password-encryption&#xA;!&#xA;hostname xxxxxx&#xA;!&#xA;boot-start-marker&#xA;boot system flash xxxxxxx&#xA;boot-end-marker&#xA;!&#xA;logging buffered 16384 informational&#xA;!&#xA;no aaa new-model&#xA;!&#xA;resource policy&#xA;!&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring 2 Sun Mar 2:00 1 Sun Nov 2:00&#xA;!&#xA;!&#xA;ip cef&#xA;ip inspect max-incomplete high 2000&#xA;ip inspect max-incomplete low 1200&#xA;ip inspect one-minute high 2000&#xA;ip inspect one-minute low 1200&#xA;ip inspect name MLPPP_1 tcp&#xA;ip inspect name MLPPP_1 udp&#xA;ip inspect name MLPPP_1 cuseeme&#xA;ip inspect name MLPPP_1 ftp&#xA;ip inspect name MLPPP_1 h323&#xA;ip inspect name MLPPP_1 rcmd&#xA;ip inspect name MLPPP_1 realaudio&#xA;ip inspect name MLPPP_1 streamworks&#xA;ip inspect name MLPPP_1 vdolive&#xA;ip inspect name MLPPP_1 sqlnet&#xA;ip inspect name MLPPP_1 tftp&#xA;ip inspect name MLPPP_1 esmtp max-data 102400000&#xA;ip inspect name MLPPP_1 dns&#xA;ip inspect name MLPPP_1 ddns-v3&#xA;ip inspect name MLPPP_1 fragment maximum 256 timeout 1&#xA;ip inspect name MLPPP_1 https&#xA;ip inspect name MLPPP_1 imap&#xA;ip inspect name MLPPP_1 imap3&#xA;ip inspect name MLPPP_1 isakmp&#xA;ip inspect name MLPPP_1 l2tp&#xA;ip inspect name MLPPP_1 ldap&#xA;ip inspect name MLPPP_1 ldap-admin&#xA;ip inspect name MLPPP_1 pop3&#xA;ip inspect name MLPPP_1 pptp&#xA;ip inspect name MLPPP_1 ssh&#xA;ip inspect name MLPPP_1 syslog&#xA;ip inspect name MLPPP_1 telnet&#xA;ip inspect name MLPPP_1 time&#xA;ip inspect name MLPPP_1 timed&#xA;ip inspect name MLPPP_1 ms-sql&#xA;ip inspect name MLPPP_1 ms-sql-m&#xA;ip inspect name MLPPP_1 msexch-routing alert on&#xA;ip inspect name MLPPP_1 rpc program-number 100003&#xA;ip inspect name MLPPP_1 rpc program-number 100005&#xA;ip inspect name MLPPP_1 rpc program-number 100021&#xA;ip inspect name MLPPP_1 rpc program-number 100024&#xA;!&#xA;!&#xA;ip domain name xxxxxxx&#xA;!&#xA;!&#xA;!&#xA;crypto pki trustpoint TP-self-signed-2276015229&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-2276015229&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-2276015229&#xA;!&#xA;!&#xA;login  stuff xxxxxxxxxx&#xA;!&#xA;!&#xA;class-map match-any BUSINESS-WRED&#xA; match access-group name WRED_LIST&#xA;class-map match-all VPN&#xA; match access-group name QOS_VPN&#xA;class-map match-all FLASH&#xA; match access-group name QOS_FLASH&#xA; match protocol syslog&#xA; match protocol ntp&#xA; match protocol telnet&#xA; match protocol ssh&#xA;class-map match-any SCAVENGER&#xA; match protocol napster&#xA; match protocol fasttrack&#xA; match protocol gnutella&#xA; match protocol kazaa2&#xA;class-map match-any BUSINESS-WFQ&#xA; match access-group name WFQ_LIST&#xA;!&#xA;!&#xA;policy-map NESTED-VPN&#xA; class BUSINESS-WFQ&#xA;  shape average 196000&#xA; class BUSINESS-WRED&#xA;  bandwidth percent 56&#xA;  random-detect dscp-based&#xA;  shape average 392000&#xA; class class-default&#xA;  fair-queue&#xA;policy-map QUEUE-EGRESS&#xA; class FLASH&#xA;  priority percent 28&#xA; class VPN&#xA;  shape average percent 56&#xA;  service-policy NESTED-VPN&#xA; class SCAVENGER&#xA;  shape average percent 1&#xA;  police cir percent 5&#xA;    conform-action transmit &#xA;    exceed-action drop &#xA; class class-default&#xA;  bandwidth percent 16&#xA;  random-detect dscp-based&#xA;!&#xA;! &#xA;!&#xA;crypto isakmp policy 1&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key xxxxx address xxxxx &quot;sitebresponder&quot;&#xA;crypto isakmp invalid-spi-recovery&#xA;crypto isakmp keepalive 10 4&#xA;!&#xA;!&#xA;crypto ipsec transform-set test esp-aes esp-sha-hmac &#xA;!&#xA;crypto map SDM_CMAP_1 1 ipsec-isakmp &#xA; description Tunnel toxxxxxx&#xA; set peer xxxxxxx &quot;sitebresponder&quot;&#xA; set transform-set test &#xA; match address 100&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; description Nail down NAT&#xA; ip address &quot;weirdwanaddress&quot; 255.255.255.248&#xA;!&#xA;interface Multilink1&#xA; description ACC Business 3Mb DIA 2xT1&#xA; ip address &quot;wan address&quot; 255.255.255.252&#xA; ip access-group INGRESS in&#xA; ip inspect MLPPP_1 out&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; ip tcp adjust-mss 1320&#xA; load-interval 30&#xA; ppp multilink&#xA; ppp multilink group 1&#xA;!&#xA;interface FastEthernet0/0&#xA; description Markline PA LAN&#xA; ip address 172.16.16.1 255.255.255.0 secondary&#xA; ip address 192.168.56.1 255.255.248.0&#xA; ip helper-address 192.168.48.14 &quot;these arent even needed&quot;&#xA; ip helper-address 192.168.48.9  &quot;old stuff SMH&quot;&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; ip route-cache flow&#xA; ip tcp adjust-mss 1200&#xA; load-interval 30&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; description DMZ With ISA Server&#xA; ip address &quot;another weird wan&quot; 255.255.255.248&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; ip route-cache flow&#xA; ip tcp adjust-mss 1200&#xA; load-interval 30&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0/0&#xA; description xxxxx&#xA; no ip address&#xA; ip virtual-reassembly&#xA; encapsulation ppp&#xA; load-interval 30&#xA; service-module t1 timeslots 1-24&#xA; ppp multilink&#xA; ppp multilink group 1&#xA;!&#xA;interface Serial0/1/0&#xA; description xxxxx&#xA; no ip address&#xA; ip virtual-reassembly&#xA; encapsulation ppp&#xA; load-interval 30&#xA; service-module t1 timeslots 1-24&#xA; ppp multilink&#xA; ppp multilink group 1&#xA;!&#xA;router ospf 100&#xA; log-adjacency-changes&#xA; redistribute connected&#xA; redistribute static subnets&#xA; passive-interface default&#xA; no passive-interface Tunnel101&#xA; network 192.168.0.0 0.0.255.255 area 0&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 &quot;wan interface&quot;&#xA;ip flow-top-talkers&#xA; top 20&#xA; sort-by bytes&#xA;!&#xA;ip http server&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 600 life 86400 requests 10000&#xA;ip nat pool MLPA-POOL1 &quot;more werid wan&quot; &quot;another weird wan&quot; netmask 255.255.255.248&#xA;ip nat inside source list TOINTERNET pool MLPA-POOL1 overload&#xA;!&#xA;ip access-list extended INGRESS&#xA; permit ip &quot;wan&quot; 0.0.31.255 any&#xA; permit gre &quot;wan&quot; 0.0.31.255 any&#xA; permit esp &quot;wan&quot; 0.0.31.255 any&#xA; permit ip 192.168.48.0 &quot;siteb&quot; 0.0.7.255 192.168.56.0 &quot;site a&quot; 0.0.7.255&#xA; permit udp host &quot;sitebwan&quot; host &quot;siteawan&quot; eq non500-isakmp&#xA; permit udp host &quot;sitebwan&quot; host &quot;siteawan&quot; eq isakmp&#xA; permit esp host &quot;sitebwan&quot; host &quot;siteawan&quot;&#xA; permit ahp host &quot;sitebwan&quot; host &quot;siteawan&quot;&#xA; permit tcp any any eq 22&#xA; permit icmp any any echo&#xA; permit icmp any any echo-reply&#xA; permit icmp any any unreachable&#xA; permit icmp any any time-exceeded&#xA; permit icmp any any packet-too-big&#xA; permit icmp any any administratively-prohibited&#xA; permit icmp any any source-quench&#xA; permit udp any host &quot;siteawan&quot; eq isakmp&#xA; permit gre any host &quot;siteawan&quot;&#xA; permit esp any host &quot;siteawan&quot;&#xA; permit udp any host &quot;siteawan&quot; eq non500-isakmp&#xA; permit udp any eq isakmp host &quot;siteawan&quot;&#xA; permit ip 192.168.24.0 0.0.0.255 192.168.0.0 0.0.255.255&#xA;ip access-list extended QOS_FLASH&#xA; remark -- SNMP,Telnet, SSH and Net Mgmt&#xA; permit icmp any any echo&#xA; permit icmp any any echo-reply&#xA; permit udp any any eq echo&#xA; permit udp any eq echo any&#xA; permit udp any any eq snmp&#xA; permit udp any eq snmp any&#xA; remark -- Ntop Box&#xA; permit ip any host 192.168.48.20&#xA;ip access-list extended QOS_VPN&#xA; remark -- DMVPN Traffic&#xA; deny   ip any host 192.168.48.20&#xA; permit ip 192.168.56.0 0.0.7.255 192.168.48.0 0.0.7.255&#xA;ip access-list extended TOINTERNET&#xA; deny   ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255&#xA; permit ip 192.168.56.0 0.0.7.255 any&#xA;ip access-list extended WFQ_LIST&#xA; remark -- Terminal Service,share point, AD and SQl&#xA; permit ip any host 192.168.48.8&#xA; permit ip any host 192.168.48.9&#xA;ip access-list extended WRED_LIST&#xA; remark -- CAD Printing&#xA; permit ip any host 192.168.48.11&#xA; permit ip any host 192.168.48.14&#xA; remark -- Anti Virus,file and print server&#xA; permit ip any host 192.168.48.21&#xA; remark -- WSUS&#xA; permit ip any host 192.168.48.9&#xA; remark -- POP3 and SMTP&#xA; permit tcp any any eq smtp&#xA; permit tcp any eq smtp any&#xA; permit tcp any any eq pop3&#xA; permit tcp any eq pop3 any&#xA;ip access-list extended remote-manage&#xA; permit tcp any host  eq 2222&#xA; permit tcp any host  eq 2222&#xA; permit tcp any host  eq 22&#xA; permit tcp any host  eq 22&#xA; permit tcp any host &quot;bunch of weird wans&quot; eq 22&#xA;!&#xA;logging trap debugging&#xA;logging facility local2&#xA;logging 192.168.48.20&#xA;access-list 108 permit ip host 192.168.56.11 192.168.64.0 0.0.0.255&#xA;access-list 108 permit ip any 192.168.64.0 0.0.0.255&#xA;access-list 100 remark SDM_ACL Category=4&#xA;access-list 100 remark IPSec Rule&#xA;access-list 100 permit ip 192.168.56.0 0.0.7.255 192.168.48.0 0.0.7.255&#xA;access-list 108 permit ip host 192.168.56.11 192.168.64.0 0.0.0.255&#xA;access-list 108 permit ip any 192.168.64.0 0.0.0.255&#xA;snmp-server community xxxxxxx RO&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;banner login ^C&#xA;Authorized Users Only !!!&#xA;^C&#xA;!&#xA;line con 0&#xA; login local&#xA;line aux 0&#xA;line vty 0 4&#xA; privilege level 15&#xA; login local&#xA; transport input telnet ssh&#xA;line vty 5 15&#xA; privilege level 15&#xA; login local&#xA; transport input telnet ssh&#xA;!&#xA;scheduler allocate 20000 1000&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;192.168.56.0 is site a initiator. It's also the site where only three PCs can ping 8.8.8.8. They all have same gateway, and they can ping the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.48.0 is the site B responder. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look for &lt;code&gt;&quot; &quot;&lt;/code&gt; and &lt;code&gt;xxxx&lt;/code&gt; where I cleaned the config. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ACL or NAT issue?&lt;/p&gt;&#xA;" OwnerUserId="19121" LastEditorUserId="8499" LastEditDate="2016-04-04T14:26:47.647" LastActivityDate="2016-04-04T14:26:47.647" Title="After VPN, only three PCs can ping 8.8.8.8" Tags="|vpn|internet|acl|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22603" PostTypeId="2" ParentId="22590" CreationDate="2015-09-18T07:40:39.027" Score="2" Body="&lt;p&gt;for the vlan you need to enable the multicast on it , it must configured to be interface vlan and under this interface configure &lt;strong&gt;* ip pim sparse-dense-mode*&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;something like&lt;br&gt;&#xA;interface Vlan1&lt;br&gt;&#xA; ip address 1.1.1.1 255.255.255.0&lt;br&gt;&#xA; ip pim sparse-dense-mode&lt;br&gt;&#xA;end&lt;/em&gt;    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i found a very useful documentation that is talking about your problem exactly in this link &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/68131-cat-multicast-prob.html&quot; rel=&quot;nofollow&quot;&gt;Multicast Does Not Work in the Same VLAN in Catalyst Switches&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-18T07:40:39.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22604" PostTypeId="1" CreationDate="2015-09-18T08:12:29.653" Score="1" ViewCount="131" Body="&lt;p&gt;I am currently studying my Certificate IV in Networking (The first course I have ever done on networking). The current task at hand is to create a small network for a business at three sites, including 7 printers, 35 computers and 2 file servers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This part is simple. I am current creating a report and have come to the section regarding routers and switch configuration. I'd like to cover DNS zones/forwarders and routing. I have no manuals or assistance for this; it is all study yourself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I believe routing and route tables are Layer 3 (Network) devices on the OSI Model. At this level we deal with IPv4 and IPv6. My current belief is the following statement:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In a home network the routing is controlled via the ISP using their HPE (Host Provided Equipment).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Without Layer 3 devices (such as switches and routers) on site, there is no facility to create your own routing tables for data and traffic.The reliance is on the routing on the ISP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My belief is the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In an enterprise solution, it would be beneficial to create a DNS zone&#xA;  for www.domain.org to point to the required destination. It would then be&#xA;  beneficial to NAT all traffic from one &quot;site&quot; so that effective&#xA;  persistent routes can be created.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So in order to have this configured correctly, is the following statement effective: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default gateway for the site is: 10.128.1.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly we setup a zone forwarder for www.domain1.org to point to the required host to the required router. On this device we have a NAT for all 10.128.1.0/24 to come off as 10.X.X.X&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based upon this address, we can configure a static route for all traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most newer routers have a GUI where you can add a persistent route (but I will delve into CLI at one point). So from here if I add the persistent route, all clients requesting www.domain1.org will abide by this route. &lt;/p&gt;&#xA;" OwnerUserId="16176" LastEditorUserId="16176" LastEditDate="2015-09-18T10:03:20.253" LastActivityDate="2015-09-18T10:03:20.253" Title="Static Routes per IP Address" Tags="|routing|router|" AnswerCount="1" CommentCount="2" ClosedDate="2015-09-18T16:33:51.373" ContentLicense="CC BY-SA 3.0" />
  <row Id="22605" PostTypeId="2" ParentId="20456" CreationDate="2015-09-18T08:17:31.063" Score="1" Body="&lt;p&gt;Athan, As other guys suggested, you would need to provide more information but you need to bear in mind that pinging and browsing are different.Also we don't know where you are pinging. Browsing first of all requires connectivity to the target node, do you have it? If yes, then drill down on other mechanisms. Does your DNS work? Can you resolve addresses? Did you try doing nslookup? You say some nodes can access while others can't. Is there a difference in their DNS configuration? Have you checked your devices' logs for any event that may give you a clue? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I ended up asking more questions then you unfortunately.&lt;/p&gt;&#xA;" OwnerUserId="19108" LastActivityDate="2015-09-18T08:17:31.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22607" PostTypeId="2" ParentId="13064" CreationDate="2015-09-18T08:26:57.323" Score="0" Body="&lt;p&gt;When it comes to ISP redundancy, if your circumstantes allow it i.e. you own a Public IP address or subnet; you could use BGP protocol which would connect you to internet with more than one ISP. They would both point your network from internet ad you could assign priority. That's a method. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly you could have a load balancer like a Peplink device.You have multiple WAN ports on load balancers and can establish clever and flexible algorithms on it. You don't have to use such a device to use 1 active connection. In theory you could have 3 ISPs at the same time and divide your traffic on the way to the internet based on your source addresses, destination addresses and protocols for example. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thirdly, you could use things like IP SLA commands to costantly check if one ISP available, as soon as it goes down the traffic could be diverted to second ISP. In order to do this you should have L3 devices that can support these capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="19108" LastActivityDate="2015-09-18T08:26:57.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22609" PostTypeId="1" AcceptedAnswerId="22615" CreationDate="2015-09-18T08:33:51.143" Score="3" ViewCount="8629" Body="&lt;p&gt;I am new to networking, and currently studying about how router learn different routes.&#xA;One of my lecture slides shows the following,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, please have a look at this network,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4AH7z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4AH7z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that &lt;code&gt;link local&lt;/code&gt; is created in the routing table when interface is configured, and &lt;code&gt;connected&lt;/code&gt; is created when an interface is active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I tried the same scenario in Packet Tracer and here is what I got when i type &lt;code&gt;show ip route&lt;/code&gt; command,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show ip route &#xA;Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area&#xA;       * - candidate default, U - per-user static route, o - ODR&#xA;       P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;C    192.168.10.0/24 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the interface is active why there is still two entries (&lt;code&gt;C&lt;/code&gt; and &lt;code&gt;L&lt;/code&gt;) in routing&#xA;table (in the photo), and just single &lt;code&gt;C&lt;/code&gt; entry in my network ?&lt;/li&gt;&#xA;&lt;li&gt;How come the diagram shows the ip address for link local&#xA;with subnet mask of &lt;code&gt;32&lt;/code&gt; because when I tried assigning ip address with &lt;code&gt;/32&lt;/code&gt; subnet mask to this interfacce, I got bad mask error  ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="14885" LastEditorUserId="8499" LastEditDate="2018-12-22T03:29:59.917" LastActivityDate="2018-12-22T03:29:59.917" Title="show ip route shows interface with /32 subnet mask" Tags="|cisco|routing|router|packet-tracer|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22610" PostTypeId="2" ParentId="22604" CreationDate="2015-09-18T08:49:23.870" Score="2" Body="&lt;p&gt;Michael, there are many problems with your post. Your topology is not here so we don't know if there any routes at all to route. To be able to route the traffic to another node, you have to have it first. With one ISP, can you really create a routing difference unles you are talking about a more complicated internal network where you have multiple routers etc? Your ISP meets you at your doorstep and takes your traffic away. You don't have a say then how this traffic will be routed. You can check it by issuing a tracert command. Plus if you are writing a route for one specific public IP address, you should give 255.255.255.255 subnet mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to change the route for all nodes in your network, it would be enough to write the route to the Layer3 device only i.e. router. You don't have to add static routes to all PCs. If everybody has the same default gateway and the gateway is located just before meeting routing alternatives then you can add the route to this device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But Michael,It is not clear to me what you are trying to achieve and what sort of setup do you have.. So I might have just talked rubbish :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards..&lt;/p&gt;&#xA;" OwnerUserId="19108" LastEditorUserId="19108" LastEditDate="2015-09-18T09:24:08.297" LastActivityDate="2015-09-18T09:24:08.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22611" PostTypeId="1" CreationDate="2015-09-18T09:06:36.933" Score="3" ViewCount="1679" Body="&lt;p&gt;VJX 0,1,3 are setup to be RR’s for this simple test , i want to know why link p5 is always preferred even though the physical next-hop changes , and the IGP path to the next-hop is is not via p5 ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xBmcz.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xBmcz.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Below baseline exhibits where VJX4 has 3 equal iBGP paths to 77/22  where 172.65.65.11 – VJX1 is the current preferred path &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@VJX4&amp;gt; show route 77/22 &#xA;&#xA;inet.0: 17 destinations, 19 routes (17 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;77.0.0.0/22        *[BGP/170] 04:43:01, MED 999, localpref 100, from 172.16.65.10&#xA;                      AS path: I, validation-state: unverified&#xA;                      to 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                      to 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                    &amp;gt; to 10.0.0.12 via ge-0/0/3.0 (P5) &#xA;                    [BGP/170] 23:35:18, MED 999, localpref 100, from 172.16.65.11&#xA;                      AS path: I, validation-state: unverified&#xA;                      to 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                      to 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                    &amp;gt; to 10.0.0.12 via ge-0/0/3.0 (p5) &#xA;                    [BGP/170] 04:43:06, MED 999, localpref 100, from 172.16.65.13&#xA;                      AS path: I, validation-state: unverified&#xA;                      to 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                      to 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                    &amp;gt; to 10.0.0.12 via ge-0/0/3.0 (p5)&#xA;&#xA;root@VJX4&amp;gt; show route 77/22 extensive &#xA;&#xA;inet.0: 17 destinations, 19 routes (17 active, 0 holddown, 0 hidden)&#xA;77.0.0.0/22 (3 entries, 1 announced)&#xA;TSI:&#xA;KRT in-kernel 77.0.0.0/22 -&amp;gt; {indirect(262143)}&#xA;        *BGP    Preference: 170/-101&#xA;                Next hop type: Indirect&#xA;                Address: 0x92a8698&#xA;                Next-hop reference count: 5&#xA;                Source: 172.16.65.10&#xA;                Next hop type: Router, Next hop index: 262144&#xA;                Next hop: 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                Session Id: 0x1&#xA;                Next hop: 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                Session Id: 0x3&#xA;                Next hop: 10.0.0.12 via ge-0/0/3.0, selected (P5)&#xA;                Session Id: 0x5&#xA;                Protocol next hop: 172.16.65.12&#xA;                Indirect next hop: 94ec000 262143 INH Session ID: 0x4&#xA;                State: &amp;lt;Active Int Ext&amp;gt;&#xA;                Local AS:  1234 Peer AS:  1234&#xA;                Age: 4:43:14    Metric: 999     Metric2: 20 &#xA;                Validation State: unverified &#xA;                Task: BGP_1234.172.16.65.10+56241&#xA;                Announcement bits (2): 0-KRT 4-Resolve tree 4 &#xA;                AS path: I (Originator)&#xA;                Cluster list:  0.0.0.0&#xA;                Originator ID: 172.16.65.12&#xA;                Accepted&#xA;                Localpref: 100&#xA;                Router ID: 172.16.65.10&#xA;                Indirect next hops: 1&#xA;                        Protocol next hop: 172.16.65.12 Metric: 20&#xA;                        Indirect next hop: 94ec000 262143 INH Session ID: 0x4&#xA;                        Indirect path forwarding next hops: 3&#xA;                                Next hop type: Router&#xA;                                Next hop: 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                                Session Id: 0x1&#xA;                                Next hop: 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                                Session Id: 0x3&#xA;                                Next hop: 10.0.0.12 via ge-0/0/3.0 (P5)&#xA;                                Session Id: 0x5&#xA;                        172.16.65.12/32 Originating RIB: inet.0&#xA;                          Metric: 20                      Node path count: 1&#xA;                          Forwarding nexthops: 3&#xA;                                Nexthop: 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;         BGP    Preference: 170/-101&#xA;                Next hop type: Indirect&#xA;                Address: 0x92a8698&#xA;                Next-hop reference count: 5&#xA;                Source: 172.16.65.11&#xA;                Next hop type: Router, Next hop index: 262144&#xA;                Next hop: 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                Session Id: 0x1&#xA;                Next hop: 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                Session Id: 0x3&#xA;                Next hop: 10.0.0.12 via ge-0/0/3.0, selected ( P5 ) &#xA;                Session Id: 0x5&#xA;                Protocol next hop: 172.16.65.12&#xA;                Indirect next hop: 94ec000 262143 INH Session ID: 0x4&#xA;                State: &amp;lt;NotBest Int Ext&amp;gt;&#xA;                Inactive reason: Not Best in its group - Update source&#xA;                Local AS:  1234 Peer AS:  1234&#xA;                Age: 23:35:31   Metric: 999     Metric2: 20 &#xA;                Validation State: unverified &#xA;                Task: BGP_1234.172.16.65.11+60823&#xA;                AS path: I (Originator)&#xA;                Cluster list:  1.1.1.1&#xA;                Originator ID: 172.16.65.12&#xA;                Accepted&#xA;                Localpref: 100&#xA;                Router ID: 172.16.65.11&#xA;                Indirect next hops: 1&#xA;                        Protocol next hop: 172.16.65.12 Metric: 20&#xA;                        Indirect next hop: 94ec000 262143 INH Session ID: 0x4&#xA;                        Indirect path forwarding next hops: 3&#xA;                                Next hop type: Router&#xA;                                Next hop: 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                                Session Id: 0x1&#xA;                                Next hop: 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                                Session Id: 0x3&#xA;                                Next hop: 10.0.0.12 via ge-0/0/3.0 (P5)&#xA;                                Session Id: 0x5&#xA;                        172.16.65.12/32 Originating RIB: inet.0&#xA;                          Metric: 20                      Node path count: 1&#xA;                          Forwarding nexthops: 3&#xA;                                Nexthop: 10.0.0.10 via ge-0/0/1.0&#xA;         BGP    Preference: 170/-101&#xA;                Next hop type: Indirect&#xA;                Address: 0x92a8698&#xA;                Next-hop reference count: 5&#xA;                Source: 172.16.65.13&#xA;                Next hop type: Router, Next hop index: 262144&#xA;                Next hop: 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                Session Id: 0x1&#xA;                Next hop: 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                Session Id: 0x3&#xA;                Next hop: 10.0.0.12 via ge-0/0/3.0, selected (P5)&#xA;                Session Id: 0x5&#xA;                Protocol next hop: 172.16.65.12&#xA;                Indirect next hop: 94ec000 262143 INH Session ID: 0x4&#xA;                State: &amp;lt;NotBest Int Ext&amp;gt;&#xA;                Inactive reason: Not Best in its group - Update source&#xA;                Local AS:  1234 Peer AS:  1234&#xA;                Age: 4:43:19    Metric: 999     Metric2: 20 &#xA;                Validation State: unverified &#xA;                Task: BGP_1234.172.16.65.13+52655&#xA;                AS path: I (Originator)&#xA;                Cluster list:  3.3.3.3&#xA;                Originator ID: 172.16.65.12&#xA;                Accepted&#xA;                Localpref: 100&#xA;                Router ID: 172.16.65.13&#xA;                Indirect next hops: 1&#xA;                        Protocol next hop: 172.16.65.12 Metric: 20&#xA;                        Indirect next hop: 94ec000 262143 INH Session ID: 0x4&#xA;                        Indirect path forwarding next hops: 3&#xA;                                Next hop type: Router&#xA;                                Next hop: 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                                Session Id: 0x1&#xA;                                Next hop: 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                                Session Id: 0x3&#xA;                                Next hop: 10.0.0.12 via ge-0/0/3.0 (P5)&#xA;                                Session Id: 0x5&#xA;                        172.16.65.12/32 Originating RIB: inet.0&#xA;                          Metric: 20                      Node path count: 1&#xA;                          Forwarding nexthops: 3&#xA;                                Nexthop: 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;&#xA;root@VJX4&amp;gt; show route 172.16.65.10 &#xA;&#xA;inet.0: 17 destinations, 19 routes (17 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;172.16.65.10/32    *[IS-IS/18] 04:45:50, metric 10&#xA;                    &amp;gt; to 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;&#xA;root@VJX4&amp;gt; show route 172.16.65.12    &#xA;&#xA;inet.0: 17 destinations, 19 routes (17 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;172.16.65.12/32    *[IS-IS/18] 04:45:59, metric 20&#xA;                    &amp;gt; to 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                      to 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                      to 10.0.0.12 via ge-0/0/3.0 (P5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1092" LastActivityDate="2016-05-19T15:41:02.347" Title="Junos BGP physical Next-hop" Tags="|bgp|juniper|juniper-junos|next-hop|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22612" PostTypeId="1" AcceptedAnswerId="22632" CreationDate="2015-09-18T09:53:15.520" Score="2" ViewCount="824" Body="&lt;p&gt;I am inspecting the Bluetooth HCI snoop logs as part of debugging an application. For dissecting the logs/Bluetooth LE packets I'm using Wireshark. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that there is a recurring unknown command in my Bluetooth LE logs, right before setting scan parameters and after generating advertisement reports. The command is being sent from the host to the controller. The host is a Samsung Galaxy S5, and the controller chip is a Broadcom BCM4354 MIMO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The unknown code is &quot;0xfd57&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The controller answers with a command complete packet.&#xA;I have tried to look for events that induce this command but I've yet to find any; I cannot manually trigger it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are screenshots depicting the unknown code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dissection of the command packet&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/FTC9U.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FTC9U.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Command appearing before advertising parameters:&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/oBN86.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oBN86.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know any approaches to finding out more about this command? Or has anyone encountered such a command before?&lt;/p&gt;&#xA;" OwnerUserId="19127" LastActivityDate="2015-09-18T17:51:18.690" Title="Structural unknown HCI Command in Bluetooth LE logs" Tags="|protocol-theory|wireshark|packet-analysis|mobile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22613" PostTypeId="2" ParentId="22609" CreationDate="2015-09-18T10:15:11.860" Score="3" Body="&lt;p&gt;May can answer your question.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the interface is active why there is still two entries (C and L) in routing table (in the photo), and just single C entry in my network ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=2180210&amp;amp;seqNum=12&quot; rel=&quot;nofollow&quot;&gt;Prior to IOS release 15, local routing did not appear in routing tables&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How come the diagram shows the ip address for link local with subnet mask of 32 because when I tried assigning ip address with /32 subnet mask to this interfacce, I got bad mask error ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think you can not assign directly /32 to cisco router interface.&lt;/p&gt;&#xA;" OwnerUserId="8154" LastActivityDate="2015-09-18T10:15:11.860" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22614" PostTypeId="2" ParentId="22600" CreationDate="2015-09-18T10:37:07.020" Score="1" Body="&lt;p&gt;The Snom phones are &lt;em&gt;SIP clients&lt;/em&gt; and Freeswitch or 3CX are &lt;em&gt;SIP Servers&lt;/em&gt;. That's all you need for a local test environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't used Freeswitch or 3CX, because I work installing Asterisk that is Linux based. However I can give you general guidelines to achieve a working scenario:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Install the server (&lt;em&gt;Freeswitch&lt;/em&gt; or &lt;em&gt;3CX&lt;/em&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check in the configuration of the server that SIP is enabled and which port is using (usually 5060).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Verify that the Windows firewall isn't blocking the SIP port.&lt;/li&gt;&#xA;&lt;li&gt;Create on the server two extensions (one for each client) and if the server requires a dialplan (a list of routes that let the server route the calls to the destination), you need to create it. &lt;/li&gt;&#xA;&lt;li&gt;The basic parameters of a extension are username (in some cases it could be the same as the extension number) and password, but there are more parameters. My recommendatio is to use the default parameters provided by the server.&lt;/li&gt;&#xA;&lt;li&gt;On each Snom phone configure the username and password, the IP of the server and the SIP port.&lt;/li&gt;&#xA;&lt;li&gt;Connect the phones to the network and check on the server logs that the login process was correct, sometimes the user needs to be in the form:&lt;em&gt;user@server&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;When the clients have succesfully logged in, try to make a call. Calls use RTP, and depending of the configuration of the server, the RTP connection can go directly from phone to phone or through the server. In the latter case you have to check that the Windows firewall isn't blocking the RTP packets.&lt;/li&gt;&#xA;&lt;li&gt;If the call can't be established, verify the &lt;em&gt;dialplan&lt;/em&gt; of the server to be sure that there are routes to get to every client.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-09-18T10:37:07.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22615" PostTypeId="2" ParentId="22609" CreationDate="2015-09-18T12:59:16.497" Score="2" Body="&lt;p&gt;Assigning a /32 to an interface that connects to something else doesn't make any sense.  You can assign the /32 to a loopback interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 192.168.1.1 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to assign the &lt;code&gt;192.168.10.1&lt;/code&gt; address to the GigabitEthernet0/0 interface which uses &lt;code&gt;192.168.10.0/24&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; ip address 192.168.10.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This results in the network &lt;code&gt;192.168.10.0/24&lt;/code&gt; entry in the routing table as a connected route (&lt;code&gt;C&lt;/code&gt;).  I suppose it depends on the IOS version, but you can also get a local (not link local which is something else, entirely) route to the specific (&lt;code&gt;/32&lt;/code&gt;) address assigned to an interface in your router.  My IOS does this.  The version you have doesn't show the &lt;code&gt;L&lt;/code&gt; in the codes, whereas mine does as the first entry:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;`&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-18T13:24:37.397" LastActivityDate="2015-09-18T13:24:37.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22616" PostTypeId="1" CreationDate="2015-09-18T14:00:58.520" Score="1" ViewCount="2693" Body="&lt;p&gt;I've checked large amount of given below error messages on ASA.&#xA;i know that some people tunes error messages like 106015 not logging for performance on device and cisco also no recommend about this but i'm not sure it's alright or not. cause it generates nearly 8,000,000 counts per day and it's almost takes up 95% on total messages&lt;/p&gt;&#xA;&#xA;&lt;p&gt;anyone who can solve this problem..&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;*most packets are 80(http)port w fin,ack flag.&#xA;*device model is ASA-5585X and version is 9.1.&#xA;*network diagram is as below(all L4 run FLB)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[network]  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GW1       GW2  &#xA; |         |         &#xA;L4 -------L4  &#xA; |         |  &#xA;ASA         ASA  &#xA; |         |  &#xA;L4 -------L4  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[error messages]   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Sep  2 00:27:45  %ASA-4-106015: Deny TCP (no connection) from  flags FIN ACK  on interface outside&#xA;Sep  2 00:27:45  %ASA-4-106015: Deny TCP (no connection) from  flags FIN PSH ACK  on interface outside&#xA;Sep  2 00:27:48  %ASA-4-106015: Deny TCP (no connection) from  flags FIN PSH ACK  on interface outside&#xA;Sep  2 00:27:52  %ASA-4-106015: Deny TCP (no connection) from  flags FIN PSH ACK  on interface outside&#xA;Sep  2 00:27:59  %ASA-4-106015: Deny TCP (no connection) from  flags FIN PSH ACK  on interface outside&#xA;Sep  2 00:28:14  %ASA-4-106015: Deny TCP (no connection) from  flags FIN PSH ACK  on interface outside&#xA;Sep  2 00:28:44  %ASA-4-106015: Deny TCP (no connection) from  flags FIN PSH ACK  on interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14884" LastEditorUserId="8499" LastEditDate="2018-12-22T03:35:07.060" LastActivityDate="2018-12-22T03:35:07.060" Title="ASA-6-106015, too many error messages on ASA" Tags="|cisco|cisco-asa|firewall|logging|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22617" PostTypeId="2" ParentId="22616" CreationDate="2015-09-18T14:27:52.877" Score="1" Body="&lt;p&gt;Those are not errors.  You are logging access attempts that are being denied, per the device configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Log them if you need to know about unauthorized access attempts.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-18T14:27:52.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22618" PostTypeId="2" ParentId="22505" CreationDate="2015-09-18T14:59:50.817" Score="2" Body="&lt;p&gt;Correct, a little review.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Routing Engine(s) are the control plane, they build the routing table based on all of the information given to it by whatever protocols are configured, and it also builds the forwarding table.  The routing engine will then copy it's version of the forwarding table to the appropriate PFE'(s) (forwarding plane).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, the RE has a copy of the routing table and the forwarding table, and all of the PFE's have their respective forwarding entries to be used to actually forward traffic.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;show route&lt;/code&gt; - will display the routing table.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;show route forwarding-table&lt;/code&gt; - will show the routing engine's version&#xA;of the forwarding table&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;show pfe route ip&lt;/code&gt; - will show the forwarding table/entries that are&#xA;actually installed in each PFE.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So this means that in latter case there is no RE&amp;lt;-&gt;PFE communication?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, but lets be clear.  In the case of &lt;code&gt;show pfe route ip&lt;/code&gt;, the RE still has to communicate with the PFE to query their version of the forwarding table, but it will not query its own copy of the forwarding table.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll be happy to update my answer if necessary.&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-09-18T14:59:50.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22619" PostTypeId="2" ParentId="22414" CreationDate="2015-09-18T15:10:01.057" Score="2" Body="&lt;p&gt;You likely don't have a DHCP scope configured for the OPT interface (in the DMZ Zone). I don't have a TZ 190 or a device with that older SonicOS 4.x firmware but you can do one of two things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configure a DHCP scope so the Meraki AP can obtain an IP and access the internet: go to &lt;strong&gt;Network, DHCP Server&lt;/strong&gt; and see if you can add a Dynamic DHCP scope for the OPT interface.&lt;/li&gt;&#xA;&lt;li&gt;Configure a &lt;strong&gt;Static IP&lt;/strong&gt; on the Meraki AP so it can access the internet. You may need to connect it to your LAN port first, allow it to obtain (via DHCP) an IP address, then configure the Static IP (on the OPT subnet) in the Meraki cloud config (or, I think depending on the firmware, log into that AP directly using the IP it has on the LAN and assign it an IP in the OPT subnet)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Meraki APs need IPs with internet access as they connect to the cloud-based controller network. Without a Static IP or DHCP on the OPT subnet it has no IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether you configure the NAT on the Meraki (for the Guest Network) won't change, you can &lt;em&gt;either&lt;/em&gt; leave the Meraki clients on the OPT network and manage them with the SonicWALL, &lt;em&gt;OR&lt;/em&gt; configure the Meraki Guest network (which enabled a mini-router on the Meraki AP which does NAT and creates a 10.x.x.x Guest network) and manage the guests on the Meraki (this would be Double NAT). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you manage the Guests on the Meraki you might as well leave the Meraki on the LAN subnet since it will keep them isolated from the local management network. But if you wanted to have, say, your internal Wireless users on the OPT/DMZ subnet BUT ALSO have Guests on a separate subnet then putting the Meraki on OPT and configure Meraki controlled Guests is the right idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you can configure VLAN subinterfaces if you have a managed switch and run several subnets that way, all managed from your SonicWALL.&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-09-18T15:10:01.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22620" PostTypeId="2" ParentId="22600" CreationDate="2015-09-18T15:19:13.147" Score="1" Body="&lt;p&gt;Snom phones are very feature-rich devices. They are capable of calling each other by IP address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try to enter IP address of one of them with the dialpad of the other one using * (asterisk sign) as a replacement for dot (like 192*168*0*1 for 192.168.0.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've used that method for building a much bigger system. I've just uploaded a directory containing each phone's IP as well as its corresponded make via CVS-file import pn each phone and it worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I remember (it was quite some time ago) you have to set a port of 5060 (which is standart SIP port) in some menu on the phone's web interface.&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2015-09-18T15:19:13.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22621" PostTypeId="1" AcceptedAnswerId="22622" CreationDate="2015-09-18T15:25:40.570" Score="3" ViewCount="297" Body="&lt;p&gt;A datacenter can contains thousands of machines. At very high level is it just a LAN and private network with thousands of machines on them.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is datacenter a LAN ? or is it WAN ?&lt;/li&gt;&#xA;&lt;li&gt;Is datacenter a private network ? Do all machines on datacenter fall in private subnets?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4339" LastEditorUserId="8499" LastEditDate="2018-03-09T01:33:29.797" LastActivityDate="2018-03-09T01:33:29.797" Title="Is datacenter a lan?" Tags="|lan|terminology|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22622" PostTypeId="2" ParentId="22621" CreationDate="2015-09-18T15:34:59.610" Score="5" Body="&lt;p&gt;The term LAN is rather amorphous.  It can mean a single broadcast domain, a network on a single cable plant, a network in a building or small group of close buildings, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as the broadcast domain definition, a data center could have multiple LANs, separated by routers.  It really depends on the definition of LAN which you are using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A data center could use private addressing, it could be using public addressing, or it could be using a mixture of public and private addressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you will find many definitions for data center, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You won't find single answers to your questions without more detail and context.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-18T15:34:59.610" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22623" PostTypeId="1" CreationDate="2015-09-18T15:40:46.593" Score="1" ViewCount="70" Body="&lt;p&gt;We have a dws-4026 and 22 access points attached to it, with 9 vlans on every access point. Once in week we have terrible wifi connection in our building, sometimes the rebooting of  the controller switch helps, but there is no strict correlation with anything.&#xA;We have about 500 imac spread throughout the building with a wire to each, actually we do not use wifi to connect imacs, and I do not know how to start the troubleshooting, maybe there is a software that can be installed on imacs and report the connection strength and delays to gateways for example?&#xA;DWS can export sflow, but I can not find a reason to prove that it shout be exported somewhere to help this situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&#xA;Probably our neighbors from the upper floor forceing their aironets to transmit at maximal power or something like that.&lt;/p&gt;&#xA;" OwnerUserId="19133" LastEditorUserId="19133" LastEditDate="2015-09-19T05:46:26.333" LastActivityDate="2015-09-19T05:46:26.333" Title="How to monitor the D-Link DWS-4026 based wifi network" Tags="|ieee-802.11|packet-loss|" AnswerCount="0" CommentCount="5" ClosedDate="2015-09-19T16:12:32.237" ContentLicense="CC BY-SA 3.0" />
  <row Id="22624" PostTypeId="1" AcceptedAnswerId="22625" CreationDate="2015-09-18T16:13:36.750" Score="1" ViewCount="91" Body="&lt;p&gt;I have 2 WAN IP (from 2 ISP) and I want to use them for a server behind the router.&#xA;Is this possible with NAT/PAT? When I open a session on one of the one IPs can the server respond normally on the same way back?&#xA;Or do you know some other method? &lt;/p&gt;&#xA;" OwnerUserId="16778" LastActivityDate="2015-09-18T16:19:35.330" Title="Is it possible to use PAT with 2 WAN IP?" Tags="|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22625" PostTypeId="2" ParentId="22624" CreationDate="2015-09-18T16:19:35.330" Score="0" Body="&lt;p&gt;On a single router with two WAN connections, NAT can work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bigger problem is using both WAN connections.  You need to define exactly how you want it to happen.  Do you want a simple load-balancing of traffic streams, or something more complex like traffic to/from particular address(es) travel through a specific WAN port?&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-18T16:19:35.330" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22626" PostTypeId="1" AcceptedAnswerId="22738" CreationDate="2015-09-18T16:53:28.920" Score="1" ViewCount="1220" Body="&lt;p&gt;I'm new to HP ProCurve and I am a problem getting host in a vlan connected to the internet.  I am not certain if the ACL is blocking internet traffic or if there is someother configuration issue.  I would like to temporarily disable the ACL without removing all of the rules.  Is there a command in this model to disble the ACL. I tried the &quot;ip dont-use-acl&quot; command and received and &quot;Invalid input: dont-use-acl&quot; error.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Core Switch config:&amp;lt;br/&amp;gt;&#xA;hostname &quot;Prod-Core&quot;&amp;lt;br/&amp;gt;&#xA;module 1 type j8702a&amp;lt;br/&amp;gt;&#xA;module 2 type j8702a&amp;lt;br/&amp;gt;&#xA;module 3 type j8702a&amp;lt;br/&amp;gt;&#xA;module 4 type j8702a&amp;lt;br/&amp;gt;&#xA;module 5 type j9309a&amp;lt;br/&amp;gt;&#xA;module 6 type j8702a&amp;lt;br/&amp;gt;&#xA;mirror 1 port A24&amp;lt;br/&amp;gt;&#xA;fault-finder broadcast-storm sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder bad-driver sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder bad-transceiver sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder bad-cable sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder too-long-cable sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder over-bandwidth sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder loss-of-link sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder duplex-mismatch-hdx sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder duplex-mismatch-fdx sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder link-flap sensitivity high&amp;lt;br/&amp;gt;&#xA;power-over-ethernet pre-std-detect ports F1-F24&amp;lt;br/&amp;gt;&#xA;timesync sntp&amp;lt;br/&amp;gt;&#xA;sntp unicast&amp;lt;br/&amp;gt;&#xA;sntp 60&amp;lt;br/&amp;gt;&#xA;sntp server priority 1 10.100.12.33&amp;lt;br/&amp;gt;&#xA;sntp server priority 2 10.100.12.32&amp;lt;br/&amp;gt;&#xA;time daylight-time-rule continental-us-and-canada&amp;lt;br/&amp;gt;&#xA;time timezone -360&amp;lt;br/&amp;gt;&#xA;web-management idle-timeout 900&amp;lt;br/&amp;gt;&#xA;ip access-list extended &quot;vlan68-DEVEL_ACL&quot;&amp;lt;br/&amp;gt;&#xA;     10 remark &quot;ACL Applied to the vlan 68 interface (in)&quot;&amp;lt;br/&amp;gt;&#xA;     11 remark &quot;-----------------------------------------&quot;&amp;lt;br/&amp;gt;&#xA;     12 remark &quot;Allow traffic to flow within the DEVEL vlan&quot;&amp;lt;br/&amp;gt;&#xA;     13 permit ip 10.100.68.0 0.0.3.255 10.100.68.0 0.0.3.255&amp;lt;br/&amp;gt;&#xA;     22 remark &quot;Allow 80, 443 for Exchange and KBOX&quot;&amp;lt;br/&amp;gt;&#xA;     23 remark &quot;-----------------------------------------&quot;&amp;lt;br/&amp;gt;&#xA;     24 permit tcp 10.100.68.0 0.0.3.255 10.100.15.40 0.0.0.0 eq 80&amp;lt;br/&amp;gt;&#xA;     25 permit tcp 10.100.68.0 0.0.3.255 10.100.15.40 0.0.0.0 eq 443&amp;lt;br/&amp;gt;&#xA;     26 permit tcp 10.100.68.0 0.0.3.255 10.100.15.91 0.0.0.0 eq 80&amp;lt;br/&amp;gt;&#xA;     27 permit tcp 10.100.68.0 0.0.3.255 10.100.15.91 0.0.0.0 eq 443&amp;lt;br/&amp;gt;&#xA;     28 permit tcp 10.100.68.0 0.0.3.255 10.100.15.98 0.0.0.0 eq 80&amp;lt;br/&amp;gt;&#xA;     29 permit tcp 10.100.68.0 0.0.3.255 10.100.15.98 0.0.0.0 eq 443&amp;lt;br/&amp;gt;&#xA;     30 remark &quot;Block 80, 443&quot;&amp;lt;br/&amp;gt;&#xA;     31 remark &quot;-----------------------------------------&quot;&amp;lt;br/&amp;gt;&#xA;     32 deny tcp 10.100.68.0 0.0.3.255 10.100.12.0 0.0.3.255 eq 80&amp;lt;br/&amp;gt;&#xA;     33 deny tcp 10.100.68.0 0.0.3.255 10.100.12.0 0.0.3.255 eq 443&amp;lt;br/&amp;gt;&#xA;     80 remark &quot;Allow Other Dev to Prod traffic&quot;&amp;lt;br/&amp;gt;&#xA;     81 remark &quot;-------------------------------&quot;&amp;lt;br/&amp;gt;&#xA;     82 permit ip 10.100.68.0 0.0.3.255 10.100.12.0 0.0.3.255&amp;lt;br/&amp;gt;&#xA;     90 remark &quot;Allow Everything else (Internet)&quot;&amp;lt;br/&amp;gt;&#xA;     91 remark &quot;--------------------------------&quot;&amp;lt;br/&amp;gt;&#xA;     92 permit ip 10.100.68.0 0.0.3.255 0.0.0.0 255.255.255.255&amp;lt;br/&amp;gt;&#xA;     100 remark &quot;Allow return Internet traffic&quot;&amp;lt;br/&amp;gt;&#xA;     101 remark &quot;--------------------------------&quot;&#xA;     102 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;ip authorized-managers 10.100.12.0 255.255.252.0 access manager&amp;lt;br/&amp;gt;&#xA;ip default-gateway 10.100.12.1&amp;lt;br/&amp;gt;&#xA;ip route 0.0.0.0 0.0.0.0 10.100.12.1&amp;lt;br/&amp;gt;&#xA;ip routing&amp;lt;br/&amp;gt;&#xA;..........&amp;lt;br/&amp;gt;&#xA;..........&amp;lt;br/&amp;gt;&#xA;..........&amp;lt;br/&amp;gt;&#xA;snmp-server community &quot;public&quot; unrestricted&amp;lt;br/&amp;gt;&#xA;snmp-server host 10.100.13.130 community &quot;public&quot; trap-level critical&amp;lt;br/&amp;gt;&#xA;snmp-server contact &quot;Dave Guyton - 2463&quot; location &quot;HQ&quot;&amp;lt;br/&amp;gt;&#xA;vlan 1&amp;lt;br/&amp;gt;&#xA;   name &quot;DEFAULT_VLAN&quot;&amp;lt;br/&amp;gt;&#xA;   no untagged D1-D3,D7,D9,D11,D14,D16,E1-E4,F1-F24&amp;lt;br/&amp;gt;&#xA;   untagged A1-A24,B1-B24,C1-C24,D4-D6,D8,D10,D12-D13,D15,D17-D24&amp;lt;br/&amp;gt;&#xA;   ip address 10.100.12.10 255.255.252.0&amp;lt;br/&amp;gt;&#xA;   ip local-proxy-arp&amp;lt;br/&amp;gt;&#xA;   forbid D14,D16&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;vlan 5&amp;lt;br/&amp;gt;&#xA;   name &quot;CharterInternetHA&quot;&amp;lt;br/&amp;gt;&#xA;   untagged D1-D3&amp;lt;br/&amp;gt;&#xA;   no ip address&amp;lt;br/&amp;gt;&#xA;   forbid A1-A24,B3-B24,C1-C24,D5-D24&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;vlan 6&amp;lt;br/&amp;gt;&#xA;   name &quot;AT&amp;amp;TInternetHA&quot;&amp;lt;br/&amp;gt;&#xA;   untagged D7,D9,D11&amp;lt;br/&amp;gt;&#xA;   no ip address&amp;lt;br/&amp;gt;&#xA;   forbid A1-A24,B3-B24,C1-C24,D1-D6,D8,D10,D12-D24&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;vlan 7&amp;lt;br/&amp;gt;&#xA;   name &quot;iSCSI VLAN&quot;&amp;lt;br/&amp;gt;&#xA;   untagged E1-E4,F1-F24&amp;lt;br/&amp;gt;&#xA;   no ip address&amp;lt;br/&amp;gt;&#xA;   forbid A1-A24,B1-B24,C1-C24,D1-D24&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;vlan 10&amp;lt;br/&amp;gt;&#xA;   name &quot;DMZ-Guest-WLAN&quot;&amp;lt;br/&amp;gt;&#xA;   tagged D14,D16,D20&amp;lt;br/&amp;gt;&#xA;   no ip address&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;vlan 68&amp;lt;br/&amp;gt;&#xA;   name &quot;DEVEL-68&quot;&amp;lt;br/&amp;gt;&#xA;   tagged A19,D23-D24&amp;lt;br/&amp;gt;&#xA;   ip access-group &quot;vlan68-DEVEL_ACL&quot; in&amp;lt;br/&amp;gt;&#xA;   ip address 10.100.68.1 255.255.252.0&amp;lt;br/&amp;gt;&#xA;   ip local-proxy-arp&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;vlan 72&amp;lt;br/&amp;gt;&#xA;   name &quot;VOICE&quot;&amp;lt;br/&amp;gt;&#xA;   tagged D23-D24&amp;lt;br/&amp;gt;&#xA;   ip address 10.100.72.1 255.255.255.0&amp;lt;br/&amp;gt;&#xA;   ip local-proxy-arp&amp;lt;br/&amp;gt;&#xA;   dhcp-server&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;no spanning-tree bpdu-throttle&amp;lt;br/&amp;gt;&#xA;no autorun&amp;lt;br/&amp;gt;&#xA;no dhcp config-file-update&amp;lt;br/&amp;gt;&#xA;no dhcp image-file-update&amp;lt;br/&amp;gt;&#xA;dhcp-server pool &quot;vlan72-Voice&quot;&amp;lt;br/&amp;gt;&#xA;   authoritative&amp;lt;br/&amp;gt;&#xA;   default-router &quot;10.100.72.1&quot;&amp;lt;br/&amp;gt;&#xA;   dns-server &quot;10.100.12.33,10.100.12.32&quot;&amp;lt;br/&amp;gt;&#xA;   domain-name &quot;memco.local&quot;&amp;lt;br/&amp;gt;&#xA;   lease 08:00:00&amp;lt;br/&amp;gt;&#xA;   network 10.100.72.0 255.255.255.0&amp;lt;br/&amp;gt;&#xA;   option 4 ip &quot;10.100.12.33,10.100.12.32&quot;&amp;lt;br/&amp;gt;&#xA;   option 42 ip &quot;10.100.12.33,10.100.12.32&quot;&amp;lt;br/&amp;gt;&#xA;   option 156 ascii &quot;ftpservers=10.100.13.16, layer2tagging=1, vlanid=72&quot;&amp;lt;br/&amp;gt;&#xA;   range 10.100.72.75 10.100.72.253&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;dhcp-server enable&amp;lt;br/&amp;gt;&amp;lt;br/&amp;gt;&#xA;&#xA; IP Route Entries&amp;lt;br/&amp;gt;&amp;lt;br/&amp;gt;&#xA;&#xA;  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.&amp;lt;br/&amp;gt;&#xA;  ------------------ --------------- ---- --------- ---------- ---------- -----&amp;lt;br/&amp;gt;&#xA;  0.0.0.0/0          10.100.12.1     1    static               1          1&amp;lt;br/&amp;gt;&#xA;  10.100.12.0/22     DEFAULT_VLAN    1    connected            1          0&amp;lt;br/&amp;gt;&#xA;  10.100.68.0/22     DEVEL-68        68   connected            1          0&amp;lt;br/&amp;gt;&#xA;  10.100.72.0/24     VOICE           72   connected            1          0&amp;lt;br/&amp;gt;&#xA;  127.0.0.0/8        reject               static               0          0&amp;lt;br/&amp;gt;&#xA;  127.0.0.1/32       lo0                  connected            1          0&amp;lt;br/&amp;gt;&amp;lt;br/&amp;gt;&amp;lt;br/&amp;gt;&#xA;Dev Switch Config:&amp;lt;br/&amp;gt;&#xA;hostname &quot;DEV-4th floor&quot;&amp;lt;br/&amp;gt;&#xA;module 1 type j8702a&amp;lt;br/&amp;gt;&#xA;module 2 type j8702a&amp;lt;br/&amp;gt;&#xA;module 3 type j8702a&amp;lt;br/&amp;gt;&#xA;module 4 type j8702a&amp;lt;br/&amp;gt;&#xA;module 5 type j8702a&amp;lt;br/&amp;gt;&#xA;module 6 type j8702a&amp;lt;br/&amp;gt;&#xA;module 7 type j8702a&amp;lt;br/&amp;gt;&#xA;module 8 type j8702a&amp;lt;br/&amp;gt;&#xA;mirror 1 port A24&amp;lt;br/&amp;gt;&#xA;mirror 3 port A8&amp;lt;br/&amp;gt;&#xA;fault-finder broadcast-storm sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder bad-driver sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder bad-transceiver sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder bad-cable sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder too-long-cable sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder over-bandwidth sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder loss-of-link sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder duplex-mismatch-hdx sensitivity high&amp;lt;br/&amp;gt;&#xA;fault-finder duplex-mismatch-fdx sensitivity high&amp;lt;br/&amp;gt;&#xA;power-over-ethernet pre-std-detect ports B13,B23,C19,F20,F22,F24,H1-H24&amp;lt;br/&amp;gt;&#xA;qos device-priority 10.100.13.116/0 priority 7&amp;lt;br/&amp;gt;&#xA;timesync sntp&amp;lt;br/&amp;gt;&#xA;sntp unicast&amp;lt;br/&amp;gt;&#xA;sntp 60&amp;lt;br/&amp;gt;&#xA;sntp server priority 1 10.100.12.33&amp;lt;br/&amp;gt;&#xA;sntp server priority 2 10.100.12.32&amp;lt;br/&amp;gt;&#xA;time daylight-time-rule continental-us-and-canada&amp;lt;br/&amp;gt;&#xA;time timezone -360&amp;lt;br/&amp;gt;&#xA;ip authorized-managers 10.100.12.0 255.255.252.0 access manager&amp;lt;br/&amp;gt;&#xA;ip default-gateway 10.100.12.1&amp;lt;br/&amp;gt;&#xA;ip timep manual 10.100.12.32&amp;lt;br/&amp;gt;&#xA;..........&amp;lt;br/&amp;gt;&#xA;..........&amp;lt;br/&amp;gt;&#xA;..........&amp;lt;br/&amp;gt;&#xA;snmp-server community &quot;public&quot; unrestricted&amp;lt;br/&amp;gt;&#xA;snmp-server host 10.100.12.45 community &quot;public&quot; trap-level not-info&amp;lt;br/&amp;gt;&#xA;no snmp-server enable traps link-change A4&amp;lt;br/&amp;gt;&#xA;snmp-server contact &quot;Dave Guyton - 2463&quot; location &quot;HQ&quot;&amp;lt;br/&amp;gt;&#xA;vlan 1&amp;lt;br/&amp;gt;&#xA;   name &quot;DEFAULT_VLAN&quot;&amp;lt;br/&amp;gt;&#xA;   no untagged G19,G21,G23,H1-H24&amp;lt;br/&amp;gt;&#xA;   untagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E24,F1-F24,G1-G18,G20,G22,G24&amp;lt;br/&amp;gt;&#xA;   ip address 10.100.12.9 255.255.252.0&amp;lt;br/&amp;gt;&#xA;   forbid G19,G21,G23&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;vlan 10&amp;lt;br/&amp;gt;&#xA;   name &quot;GuestVLAN&quot;&amp;lt;br/&amp;gt;&#xA;   tagged G19,G21,G23&amp;lt;br/&amp;gt;&#xA;   no ip address&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;vlan 68&amp;lt;br/&amp;gt;&#xA;   name &quot;DEVEL-68&quot;&amp;lt;br/&amp;gt;&#xA;   untagged H1-H24&amp;lt;br/&amp;gt;&#xA;   tagged B19&amp;lt;br/&amp;gt;&#xA;   ip address 10.100.68.9 255.255.252.0&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;vlan 72&amp;lt;br/&amp;gt;&#xA;   name &quot;VOICE&quot;&amp;lt;br/&amp;gt;&#xA;   tagged A1-A24,B1-B24,C1-C24,D1-D24,E1-E24,F1-F19,F21,F23,G1-G6,G8-G24,H1-H24&amp;lt;br/&amp;gt;&#xA;   ip address 10.100.72.9 255.255.255.0&amp;lt;br/&amp;gt;&#xA;   forbid F20,F22,F24,G7&amp;lt;br/&amp;gt;&#xA;   exit&amp;lt;br/&amp;gt;&#xA;no spanning-tree bpdu-throttle&amp;lt;br/&amp;gt;&#xA;no autorun&amp;lt;br/&amp;gt;&#xA;no dhcp config-file-update&amp;lt;br/&amp;gt;&#xA;no dhcp image-file-update&amp;lt;br/&amp;gt;&amp;lt;br/&amp;gt;&#xA;&#xA; IP Route Entries&amp;lt;br/&amp;gt;&amp;lt;br/&amp;gt;&#xA;&#xA;  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.&amp;lt;br/&amp;gt;&#xA;  ------------------ --------------- ---- --------- ---------- ---------- -----&amp;lt;br/&amp;gt;&#xA;  0.0.0.0/0          10.100.12.1     1    static               250        1&amp;lt;br/&amp;gt;&#xA;  10.100.12.0/22     DEFAULT_VLAN    1    connected            1          0&amp;lt;br/&amp;gt;&#xA;  10.100.68.0/22     DEVEL-68        68   connected            1          0&amp;lt;br/&amp;gt;&#xA;  10.100.72.0/24     VOICE           72   connected            1          0&amp;lt;br/&amp;gt;&#xA;  127.0.0.0/8        reject               static               0          0&amp;lt;br/&amp;gt;&#xA;  127.0.0.1/32       lo0                  connected            1          0&amp;lt;br/&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19136" LastEditorUserId="19136" LastEditDate="2015-09-22T15:42:16.417" LastActivityDate="2015-09-23T18:47:43.160" Title="HP procurve 5412zl ACL" Tags="|switch|hp-procurve|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22627" PostTypeId="1" AcceptedAnswerId="22629" CreationDate="2015-09-18T16:58:55.523" Score="11" ViewCount="6662" Body="&lt;p&gt;I have read a lot on how switches forward within LAN, but little about how switch talks to router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When does a switch send packet to router ? Is it when it does not find recipient on the same LAN ?&lt;/p&gt;&#xA;" OwnerUserId="4339" LastActivityDate="2019-01-16T16:12:29.613" Title="When does switch talk to router" Tags="|switch|router|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22628" PostTypeId="2" ParentId="22627" CreationDate="2015-09-18T17:03:40.060" Score="9" Body="&lt;p&gt;Switches don't send packets, they send frames.  A switch only forwards layer-2 frames from interface to interface.  To the switch, a router is just another host.  The switch talks to the router when it has a frame addressed to the router's MAC address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-18T17:03:40.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22629" PostTypeId="2" ParentId="22627" CreationDate="2015-09-18T17:13:20.293" Score="10" Body="&lt;p&gt;It kind of depends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normal primary operation for a switch is to forward frames from one host on the L2 domain to another host based on the destination MAC address. So in this sense, a switch will only forward frames to the router if the frame it received has the router's MAC address as the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if it is a managed switch, then it is also acting as a host on the network as well as a L2 device. So management traffic that needs to be routed (i.e. to hosts on a different subnet/network) will be sent by the switch to the router (assuming correct routing/default gateway are in place).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-09-18T17:13:20.293" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22632" PostTypeId="2" ParentId="22612" CreationDate="2015-09-18T17:51:18.690" Score="2" Body="&lt;p&gt;I found this in some obscure documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Raw Report Mode&lt;/strong&gt;&#xA;  The start byte 0xFD indicates a raw HID report. In the Bluetooth module, the start byte is stripped and the following&#xA;  bytes are sent without interpretation. The Raw HID report consists of&#xA;  a start byte, length, descriptor type (which defines the type of HID&#xA;  device), and data specified in scan codes or encoded values. The&#xA;  format of the data depends on the descriptor type. HID reports are&#xA;  sent one report at a time.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-18T17:51:18.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22633" PostTypeId="1" AcceptedAnswerId="22646" CreationDate="2015-09-18T18:27:49.637" Score="3" ViewCount="255" Body="&lt;p&gt;Is there a way in Junos 12.3R4.6 to filter Cron jobs out of the syslog that is being sent to a host running Kiwi. &lt;a href=&quot;https://i.stack.imgur.com/anxBN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/anxBN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19139" LastActivityDate="2016-05-06T09:13:47.407" Title="Junos syslog filter Cron facility" Tags="|juniper-junos|syslog|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22634" PostTypeId="1" AcceptedAnswerId="24164" CreationDate="2015-09-18T18:34:02.930" Score="1" ViewCount="675" Body="&lt;p&gt;I am studying about DNS servers, but have not clear idea about some parts of DNS message which are pointed in following figure:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1Oaqj.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1Oaqj.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the things I am not clear about is &lt;code&gt;Questions&lt;/code&gt;. Can there be multiple entries in this section (of DNS message)? Means can there be number of questions &lt;code&gt;more than one&lt;/code&gt; (in one DNS query)?  If yes, then how? or in which situations? Because, what I have understood, in normal DNS query only ONE question should be there. Then how can there be multiple questions there (in Questions section of DNS message of ONE query)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And other thing is what information is contained in &lt;code&gt;Authority&lt;/code&gt; and &lt;code&gt;Additional information&lt;/code&gt; sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please explain in detail and in an easy-to-understand language from a layman's perspective.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDITs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can there be multiple entries in this section? ==&gt; Can there be&#xA;multiple entries in this section (of DNS message)? &lt;/li&gt;&#xA;&lt;li&gt;can there be number of questions more than one? ==&gt; can there be number of&#xA;questions &lt;code&gt;more than one&lt;/code&gt; (in one DNS query)? &lt;/li&gt;&#xA;&lt;li&gt;in normal query only question should be there ==&gt; in normal DNS query only ONE question should be there &lt;/li&gt;&#xA;&lt;li&gt;Then how can there be multiple questions there? ==&gt;&#xA;Then how can there be multiple questions there (in Questions section&#xA;of DNS message of ONE query)?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19138" LastEditorUserId="19138" LastEditDate="2015-09-19T18:06:43.573" LastActivityDate="2015-11-06T23:30:28.683" Title="Explanation of different parts in DNS message format" Tags="|dns|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22635" PostTypeId="2" ParentId="22627" CreationDate="2015-09-18T18:55:57.473" Score="5" Body="&lt;p&gt;Switches come in different flavours JavaDeveloper. Why do you need a switch? Because you want more than 2 hosts to share a common communication medium. If you have 2 PCs and they are not far away from each other you could connect an ethernet cable between them, assign IP addresses and start communicating. What if you have 15 PCs? Then you want to have a shared medium, a meeting ground where all are available. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's carry on with the same analogy. You plugged in your switch, did the cabling, employed an IP distribution mechanism and assigned each a 192.168.1.x/24 address. You will see that they can reach other. You can create a shared folder on one and send/receive files from others, you are connected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now imagine you wanted you and your neighbours' PCs to communicate, he uses a different subnet plus you don't have enough ethernet ports. You now need another mechanism that will route the traffic between you two. You found a router with two interfaces and connected a cable from your switch to one interface and another cable from your neighbours's switch to the oher interface. Why did you plug this cable to switches but not a printer? Because everybody is there and available. If you see the world from the router's point of view, I have 2 networks on each side, one speaks German, other one speaks French. In order to be able to let you 2 communicate it has to speak both languages. That's why on each router interface, you assign an IP address from each subnet to the correct side (yours will be 192.168.1.x/24). He is your virtual gate to your neighbour's house. If your network needs to communicate your neighbours, you have to knock on the virtual door. The address you just assigned at the router interface is your network's gateway to the other network which makes sense right? If you have a PC that only communicates with your printer, you don't need to assign him a gateway address why should you? He always stays at home. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When does a switch talk to router? When it needs to contact other adjacent or reachable networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(as other people wrote down, there are layer 3 switches thatt can be assigned IP addresses from other networks enabling you to meet everybody there but I won't talk about that. I wrote long, please don't get me wrong, there are other people who can make use of this thread)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="19108" LastActivityDate="2015-09-18T18:55:57.473" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22636" PostTypeId="2" ParentId="22626" CreationDate="2015-09-18T19:01:55.183" Score="0" Body="&lt;p&gt;If I understand you correctly, you could remove the application of ACL from the interface first, edit or rewrite (copy-paste) your ACL and re-apply to the interface. This is if I got you right.&lt;/p&gt;&#xA;" OwnerUserId="19108" LastActivityDate="2015-09-18T19:01:55.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22637" PostTypeId="2" ParentId="22627" CreationDate="2015-09-18T19:08:49.797" Score="6" Body="&lt;p&gt;Based on the way you phrased your question, I think the important point to know is that the decision of whether the packet should go to the router or not is made by the switch, but by the sending host on that LAN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The host (PC or router) determines that the destination is not on the local network, and that it needs to be forwarded to the router.  If so, the host sets the destination MAC address to that of the router.  The switch then forwards packets based on the MAC address.  It doesn't know whether it's a router or something else.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-09-18T19:08:49.797" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22638" PostTypeId="1" AcceptedAnswerId="22639" CreationDate="2015-09-18T19:24:29.323" Score="2" ViewCount="919" Body="&lt;p&gt;My business is moving to a new location and this calls for new internet service. I am comparing quotes for both fiber optic and coax services from local internet service providers. While researching, I am finding conflicting opinions in regards to speed comparisons. A sales rep has told me that 10mbps DL over fibre is equivalent to 100 mbps DL over cable. That sounds odd to me though. Isn't bandwidth bandwidth regardless of delivery media. I am fine with the QOS on cable and don't doubt fiber wins in that regard. I simply want to compare the speed. Other than mbps, should I be considering other factors? Thank you, stackexchange community!&lt;/p&gt;&#xA;" OwnerUserId="19142" LastEditorUserId="8499" LastEditDate="2018-03-21T00:32:34.630" LastActivityDate="2018-03-21T00:32:34.630" Title="Fiber Optic vs. Cable from ISP - how to compare speed?" Tags="|layer1|fiber|cable|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22639" PostTypeId="2" ParentId="22638" CreationDate="2015-09-18T19:41:23.937" Score="2" Body="&lt;p&gt;The sales guy might have meant the latency advantage. Although the capacity (diameter of a tap/pipe for example) is the same, fiber may be able to carry traffic quicker and therefore perform better (water speed in the pipe). &lt;/p&gt;&#xA;" OwnerUserId="19108" LastEditorUserId="19108" LastEditDate="2015-09-18T19:46:55.963" LastActivityDate="2015-09-18T19:46:55.963" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22640" PostTypeId="1" CreationDate="2015-09-18T20:34:26.413" Score="1" ViewCount="217" Body="&lt;p&gt;Does anyone make a single fiber cwdm 10g sfp or xfp that will do 10g over a single fiber using a single 1510nm wavelength?&lt;/p&gt;&#xA;" OwnerUserId="19145" LastEditorUserId="2301" LastEditDate="2015-09-19T00:31:53.343" LastActivityDate="2016-09-14T01:12:47.307" Title="Optics for long haul fiber" Tags="|design|fiber|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22641" PostTypeId="1" CreationDate="2015-09-18T23:21:51.520" Score="1" ViewCount="69" Body="&lt;p&gt;I'm with an enterprise networking team and we're trying to collect some metrics on our dhcp and how long it takes devices at various locations around our campus to receive an IP address after renewing a dhcp lease. Is there a method on OSX/Linux to time this?&lt;/p&gt;&#xA;" OwnerUserId="19149" LastActivityDate="2015-09-18T23:42:08.280" Title="Is there a method to time how long it takes to receive a DHCP lease?" Tags="|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22642" PostTypeId="2" ParentId="22641" CreationDate="2015-09-18T23:42:08.280" Score="3" Body="&lt;p&gt;Okay so after some more searching I have decided to just use Wireshark and see the time difference between DHCP request and ACK packets.&lt;/p&gt;&#xA;" OwnerUserId="19149" LastActivityDate="2015-09-18T23:42:08.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22644" PostTypeId="2" ParentId="22640" CreationDate="2015-09-18T23:55:43.070" Score="6" Body="&lt;p&gt;Single fiber &lt;strong&gt;and&lt;/strong&gt; single wavelength are &lt;strong&gt;fundamentally incompatible.&lt;/strong&gt; You either need two fibers (send at each end connected to receive at the other end) and one wavelength is fine, or you need two different wavelengths so that data can travel both ways over the same fiber without conflict. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;10Gb does not include a half-duplex option, which would be the only other way to get one fiber and one wavelength (and half the speed, or less than half the speed.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;CWDM&quot; means &lt;strong&gt;C&lt;/strong&gt;oarse &lt;strong&gt;W&lt;/strong&gt;avelength &lt;strong&gt;D&lt;/strong&gt;ivision &lt;strong&gt;M&lt;/strong&gt;ultiplexing&quot; and is another way of saying &quot;not one wavelength&quot; and the &quot;coarse&quot; part also says &quot;wavelengths that are not terribly close to each other&quot; such as 1490/1510, 1310/1490, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dense WDM (DWDM) implies wavelengths that are much closer to each other.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2015-09-19T00:02:48.493" LastActivityDate="2015-09-19T00:02:48.493" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22645" PostTypeId="1" CreationDate="2015-09-19T07:37:38.210" Score="2" ViewCount="688" Body="&lt;p&gt;I am using GNS3 to configure the basic RIPv2 in my simple network.&#xA;First of, here is my network,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/m2PlE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m2PlE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and here is the configuration for each router,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1,&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA; version 2&#xA; passive-interface FastEthernet0/0&#xA; network 10.0.0.0&#xA; network 192.168.2.0&#xA; no auto-summary&#xA;&#xA;&#xA;R1#show ip int br&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;FastEthernet0/0            192.168.1.1     YES manual up                    up  &#xA;Serial0/0                  10.1.1.6        YES manual up                    up  &#xA;FastEthernet0/1            unassigned      YES unset  administratively down down&#xA;Serial0/1                  unassigned      YES unset  administratively down down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;for R2&lt;/strong&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA; passive-interface FastEthernet0/0&#xA; network 192.168.1.0&#xA; network 192.168.2.0&#xA; no auto-summary&#xA;&#xA;&#xA;R2#show ip int br&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;FastEthernet0/0            192.168.2.1     YES manual up                    up&#xA;Serial0/0                  10.1.1.5        YES manual up                    up&#xA;FastEthernet0/1            unassigned      YES unset  administratively down down&#xA;Serial0/1                  10.1.1.2        YES manual up                    up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R3,&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA; version 2&#xA; passive-interface FastEthernet0/0&#xA; network 10.0.0.0&#xA; network 192.168.1.0&#xA; network 192.168.2.0&#xA; no auto-summary&#xA;&#xA;&#xA;R3#show ip int br&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;FastEthernet0/0            192.168.2.129   YES manual up                    up  &#xA;Serial0/0                  unassigned      YES unset  administratively down down&#xA;FastEthernet0/1            unassigned      YES unset  administratively down down&#xA;Serial0/1                  10.1.1.1        YES manual up                    up &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Even though, I have configured &lt;code&gt;RIPv2&lt;/code&gt; in each router, my routers still wouldn't learn any routes outside its own network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the outputs of &lt;code&gt;show ip route&lt;/code&gt; command for each router,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/30 is subnetted, 1 subnets&#xA;C       10.1.1.4 is directly connected, Serial0/0&#xA;C    192.168.1.0/24 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/30 is subnetted, 2 subnets&#xA;C       10.1.1.0 is directly connected, Serial0/1&#xA;C       10.1.1.4 is directly connected, Serial0/0&#xA;     192.168.2.0/25 is subnetted, 1 subnets&#xA;C       192.168.2.0 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R3,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/30 is subnetted, 1 subnets&#xA;C       10.1.1.0 is directly connected, Serial0/1&#xA;     192.168.2.0/25 is subnetted, 1 subnets&#xA;C       192.168.2.128 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I used &lt;code&gt;debug ip rip&lt;/code&gt; command, I see the following output,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1,&#xA;&#xA;R1#&#xA;*Mar  1 00:31:48.595: RIP: sending v2 update to 224.0.0.9 via Serial0/0 (10.1.1.6)&#xA;*Mar  1 00:31:48.595: RIP: build update entries - suppressing null update&#xA;R1#&#xA;*Mar  1 00:32:15.975: RIP: sending v2 update to 224.0.0.9 via Serial0/0 (10.1.1.6)&#xA;*Mar  1 00:32:15.975: RIP: build update entries - suppressing null update&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R3,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#&#xA;*Mar  1 00:32:15.559: RIP: sending v2 update to 224.0.0.9 via Serial0/1 (10.1.1.1)&#xA;*Mar  1 00:32:15.559: RIP: build update entries&#xA;*Mar  1 00:32:15.563:   192.168.2.128/25 via 0.0.0.0, metric 1, tag 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As can be seen in the above output, both &lt;code&gt;R1&lt;/code&gt; and &lt;code&gt;R3&lt;/code&gt; are sending updates to &lt;code&gt;224.0.0.9&lt;/code&gt;, but I don't have any network with this ip address. Beside that, &lt;code&gt;R2&lt;/code&gt; is not showing any updates at all when i enabled debugging on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the output of &lt;code&gt;show ip protocols&lt;/code&gt; command on &lt;code&gt;R2&lt;/code&gt;,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ip protocols&#xA;Routing Protocol is &quot;rip&quot;&#xA;  Sending updates every 30 seconds, next due in 16 seconds&#xA;  Invalid after 180 seconds, hold down 180, flushed after 240&#xA;  Outgoing update filter list for all interfaces is not set&#xA;  Incoming update filter list for all interfaces is not set&#xA;  Redistributing: rip&#xA;  Default version control: send version 1, receive any version&#xA;  Automatic network summarization is not in effect&#xA;  Maximum path: 4&#xA;  Routing for Networks:&#xA;    192.168.1.0&#xA;    192.168.2.0&#xA;  Passive Interface(s):&#xA;    FastEthernet0/0&#xA;  Routing Information Sources:&#xA;    Gateway         Distance      Last Update&#xA;  Distance: (default is 120)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone please tell me why my routers are not learning the correct routes to neighbouring networks, and sending updates to wrong addresses ?. I have no &lt;code&gt;access list&lt;/code&gt; or anything else configured in any of the routers, just simple &lt;code&gt;RIPv2&lt;/code&gt; is configured.&lt;/p&gt;&#xA;" OwnerUserId="14885" LastActivityDate="2017-01-03T15:10:26.817" Title="RIPv2 sending updates to unkown network" Tags="|routing|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22646" PostTypeId="2" ParentId="22633" CreationDate="2015-09-19T08:59:06.017" Score="2" Body="&lt;p&gt;Typically, log filtering is done on syslog servers, not on routers, but if you really want to do this on your router, it's possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A very simple way to achieve it is to set your log level higher than &lt;code&gt;informational&lt;/code&gt;, but that filters out more than just cron messages, so that probably isn't such a good idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there's a nice KB article on how to filter syslog output: &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB9382&quot; rel=&quot;nofollow&quot;&gt;KB9382&lt;/a&gt;, so probably something like this should work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit system syslog]&#xA;host 192.0.2.1 {&#xA;  any any;&#xA;  match &quot;!(.*cron.*)&quot;;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2016-05-06T09:13:47.407" LastActivityDate="2016-05-06T09:13:47.407" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22647" PostTypeId="2" ParentId="22593" CreationDate="2015-09-19T09:43:23.113" Score="1" Body="&lt;p&gt;Beside the Problem, your default route is set in the wrong manner:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;ip routing&#xA;ip classless&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is on on your switch, ok.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip default-gateway 192.168.1.41&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;has no meaning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 FastEthernet1/0/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is not good, it should read&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.1.41&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And (my opinion) the switch should not wait for DNS resolution,&#xA;so i almost allways configure &quot;&lt;code&gt;no ip domain-lookup&lt;/code&gt;&quot;&#xA;(some IOS versions dont like the  &quot;-&quot; )&#xA;Ok, so you must know the IP-adresses, but logging etc. of events on the device does not depend on external service &quot;DNS&quot; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, hat NAT been enabled on your PFSense box ?&lt;/p&gt;&#xA;" OwnerUserId="19154" LastEditorUserId="19154" LastEditDate="2015-09-20T15:36:28.683" LastActivityDate="2015-09-20T15:36:28.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22648" PostTypeId="2" ParentId="22645" CreationDate="2015-09-19T10:50:40.973" Score="1" Body="&lt;p&gt;on R2,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network 10.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is missing on your router rip&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since your FastEthernet Interfaces are passive,&#xA;you do not need the &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network 192.168.1.0&#xA;network 192.168.2.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;statements in router rip on any of your Routers.&#xA;Those (still classfull) ip-nets must include the adresses on your links &#xA;over RIP shall be spoken, &lt;code&gt;no passive interface Serial0/0&lt;/code&gt; does not suffit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is also save to connect s0/1 to an s0/0 Interface of an other Router.&#xA;Just names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, do not spend too much time with RIP. &#xA;Better learn OSPF and BGP.&lt;/p&gt;&#xA;" OwnerUserId="19154" LastActivityDate="2015-09-19T10:50:40.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22650" PostTypeId="1" AcceptedAnswerId="34304" CreationDate="2015-09-19T11:18:14.290" Score="3" ViewCount="5400" Body="&lt;p&gt;The OSI model describes them as layers. But where do these layers actually operate in the operating system? For example, where and what actually does TCP? All these layers are described as using protocols or &quot;rules&quot;, but how is the rule implemented? Does it all happen at the NIC? Is there a specific service running in the background that handles each protocol? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see that DHCP and DNS are run by services in the background of the windows operating system when I open up task manager. That's nice and easy to understand. Does TCP have its own background service or is it actually implemented in the code of an application using a network library? The same goes with ARP, IP and Ethernet. Does the NIC have a program running that handles ARP, IP, and Ethernet and where exactly?&lt;/p&gt;&#xA;" OwnerUserId="14714" LastActivityDate="2021-06-18T16:24:25.640" Title="Where do the layers of the OSI Model operate in the operating system?" Tags="|ipv4|tcp|arp|osi|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22653" PostTypeId="1" AcceptedAnswerId="22657" CreationDate="2015-09-19T15:04:24.137" Score="5" ViewCount="357" Body="&lt;p&gt;I've begun looking into network bridging, must most of it is witchcraft for me so far. I currently have the following setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JdHyq.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JdHyq.jpg&quot; alt=&quot;Basic overview of current network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use PC 1 as my development station and PC 2 as a deployment/test station. I'd like to be able to create socket connections from PC 1 to the secondary network of devices represented by the lower LAN (where the switch is) and interfaced through NIC 2. However, I do not want these devices (robots, controllers, etc) to be exposed to the full office network and especially the active internet connection. Both PCs run a mixture of Windows and Ubuntu VMs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions? &lt;/p&gt;&#xA;" OwnerUserId="19146" LastActivityDate="2015-09-19T17:07:37.250" Title="Bridging LAN networks privately in office environment" Tags="|routing|switch|ethernet|lan|bridge|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22655" PostTypeId="2" ParentId="22653" CreationDate="2015-09-19T16:32:42.733" Score="0" Body="&lt;p&gt;I think you could either bridge your connections (NICs) at PC2 or write a static route on command line to get 2 networks talk to each oher. If your switch is manageable you could also write an ACL not to allow outbound connections towards PC1 network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just thinking also, if you removed the default gateway from the nodes on your lower network tthey can stay isolates, am I wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards...&lt;/p&gt;&#xA;" OwnerUserId="19108" LastActivityDate="2015-09-19T16:32:42.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22657" PostTypeId="2" ParentId="22653" CreationDate="2015-09-19T17:07:37.250" Score="1" Body="&lt;p&gt;Bridging means that you are placing the bridged devices onto the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common method for what you are trying to achieve is to use a firewall and place the things you don't want to get to your office network on the outside interface of the firewall. Your office network can then get to the devices, but the devices cannot get to the office network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-19T17:07:37.250" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22658" PostTypeId="2" ParentId="22650" CreationDate="2015-09-19T17:26:09.733" Score="2" Body="&lt;p&gt;The OSI model is a theoretical representation or guideline. The real world is often very different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are not going to get an answer that doesn't change depending on the circumstances.  A lot depends on the OS itself since different OSes do things differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is easy to relate some of the layers to different parts of a computer (e.g. the physical layer as the NIC, but even that doesn't encompass the entirety of layer-1). Layer-7 looks easy as the actual application application, but it is often more complicated than that; sometimes the OS itself or some add-on is the ultimate layer-7 source/destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many times, the lines between the OSI layers are blurred, or multiple layers are encompassed in one.  Sometimes things have a foot in one layer while operating in a different layer.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-19T17:26:09.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22661" PostTypeId="1" AcceptedAnswerId="22663" CreationDate="2015-09-19T18:42:13.753" Score="1" ViewCount="85" Body="&lt;p&gt;I have a Raspberry Pi connected to my Macbook Pro via ethernet, so I'm basically sharing my Macbook Pro's internet connection with my Raspberry Pi. I am connecting to my Raspberry Pi via SSH. The ethernet interface of my Macbook Pro has an IP address of &lt;code&gt;169.254.66.72&lt;/code&gt;, and even if I use a static IP address for this interface, my Raspberry Pi always have an ip address of &lt;code&gt;192.168.2.5&lt;/code&gt;. Why does my Raspberry Pi's IP address isn't &lt;code&gt;169.254.66.72&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help!&lt;/p&gt;&#xA;" OwnerDisplayName="user19165" LastActivityDate="2015-09-19T18:54:21.017" Title="Headless Raspberry Pi has different IP address than the interface it is connected to?" Tags="|ip|ssh|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22662" PostTypeId="2" ParentId="7451" CreationDate="2015-09-19T18:50:55.857" Score="2" Body="&lt;p&gt;To me the following analogy works:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think about you and your friend communicate each other by sending letters.&#xA;You and your friend send/receive in full duplex manner but let's say the post office works in half duplex manner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You and your friend act like TCP(Full duplex) but the delivery of letters(post office) works in half duplex.&lt;/p&gt;&#xA;" OwnerUserId="19166" LastActivityDate="2015-09-19T18:50:55.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22663" PostTypeId="2" ParentId="22661" CreationDate="2015-09-19T18:54:21.017" Score="0" Body="&lt;p&gt;Your PI will not have the same IP address as your MacBook, that wouldn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't have a diagram, so I have to assume the PI is connected to the MacBook via the ethernet, the MacBook is connecting to the LAN via Wi-Fi, and the MacBook is bridging the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason the MacBook has its address is that it doesn't have a DHCP server on the ethernet segment so it gets the IP address in the link-local address range (169.254.0.0/16).  The PI would then be getting its IP address from the DHCP server on the bridged LAN, the same place the MacBook gets its Wi-Fi IP address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-19T18:54:21.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22665" PostTypeId="2" ParentId="22611" CreationDate="2015-09-19T18:57:16.547" Score="-2" Body="&lt;p&gt;Buddy, by the conf that you has put here, this one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;77.0.0.0/22        *[BGP/170] 04:43:01, MED 999, localpref 100, from 172.16.65.10&#xA;                      AS path: I, validation-state: unverified&#xA;                      to 10.0.0.10 via ge-0/0/1.0 (P3)&#xA;                      to 10.0.0.8 via ge-0/0/2.0 (P4)&#xA;                    &amp;gt; to 10.0.0.12 via ge-0/0/3.0 (P5) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The best path is accross VJX0, over the p4 link, and not accross VJX1 like you said. By the other hand, the bgp set this one like the BEST ROUTE, ´cause, all the parameters are de same to all the routers, weigth, local-preference, .... But, on the end of the bgp decision algotihm, it takes the LOWER router ID of the BGP neighbors, with preference the loopbacks address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.16.65.10, is the lowest loopback address of all your routers. This path (p4) is set to best route then.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="509" LastEditDate="2015-09-19T19:28:26.947" LastActivityDate="2015-09-19T19:28:26.947" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22667" PostTypeId="2" ParentId="20658" CreationDate="2015-09-19T21:39:56.200" Score="1" Body="&lt;p&gt;Without assuming anything, if you want a VIP in the External network (VLAN 20) and be able to access nodes in the Internal network (VLAN 10) via that VIP then you should add both VLANs with Self IPs in each network on the F5.&lt;/p&gt;&#xA;" OwnerUserId="14589" LastActivityDate="2015-09-19T21:39:56.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22668" PostTypeId="1" CreationDate="2015-09-19T21:47:18.283" Score="2" ViewCount="188" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LXNDs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LXNDs.png&quot; alt=&quot;Setup of Connection&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am looking to use my provider Ethernet Connection between our HQ and Branch to do Layer 2 and Layer 3. The Ip addresses I hope to use for the remote are those being advertised to the ISP using BGP. This will help with Internet access. On the other hand, I want the Trust SVR1 and the HQ SVR1 etc to be able to talk to each other. My major problem is &quot;Do I use private IPs, OSPF and VLAN to connect the remote to the HQ over the SP Ethernet (Q-in-Q is allowed)and then route from there. I see this to be a problem since I have to still setup Zoning on the Branch FW. Zones here would include Internet, trust, DMZ. I will also do NAT for the remote and DMZ servers. I am looking for guidance, i can get the commands to implement any suggestions.&lt;/p&gt;&#xA;" OwnerUserId="19170" LastEditorUserId="8499" LastEditDate="2018-03-21T00:53:18.370" LastActivityDate="2018-03-21T00:53:18.370" Title="How do I use my SP Ethernet connection between HQ and Branch for Layer 2 and Layer 3" Tags="|juniper|layer2|layer3|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22669" PostTypeId="2" ParentId="10790" CreationDate="2015-09-19T22:29:18.847" Score="1" Body="&lt;p&gt;I´m agree with the explanation of Alex, but if you do that, the you must set a modification because if for some reason, one of the two links fails, the pbr mus continue matching traffic, and may occurs that, the traffic flow searching the next-hop of the link down, in other words, a blackhole inside your network.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-19T22:29:18.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22670" PostTypeId="2" ParentId="22519" CreationDate="2015-09-19T22:30:18.933" Score="2" Body="&lt;p&gt;This is very possible. This type of NAT is called Carrier grade NAT (CG-NAT) and is supported by most vendor (Juniper, Cisco Alcatel) equipment.&lt;/p&gt;&#xA;" OwnerUserId="19170" LastActivityDate="2015-09-19T22:30:18.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22671" PostTypeId="2" ParentId="20658" CreationDate="2015-09-19T22:57:01.333" Score="4" Body="&lt;p&gt;SelfIP is for sure needed on External as that's where it will arp out for the VIP address. The one on VLAN 10 should be used so it can locally contact the box, otherwise it will refer to the route table on how to reach the node in the pool. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you have generally three options from there: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If you're not going to create a local IP to the servers, you will HAVE to use SNAT, otherwise the servers will try to directly respond to the reqeuster and the firewall will have no idea why that server is replying to a connection that was originally destined for the F5 and therefore drop it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you create the local IP address on VLAN 10 you will need to either configure SNAT so the source traffic is destined back to the F5 and other traffic that isn't web (i.e. SSH/RDP for mgmt) is sent back to the original default gateway. If do this you are going to want to configure a new HTTP profile with the 'forward X-headers' option enabled so you can tell what the original source was, otherwise all your web server logs will tell you is that the F5 float/selfip is accessing the server for every request.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The other option with local selfip is to set the default gateway of the servers to the F5 and create an L3 VFS server to pass other connections that aren't for a specific VIP to the server, this way the F5 will still NAT it back out to the VIP ip to forward to the firewall and also permit traffic destined directly to the servers, if you choose this make sure your network devices have their next hop set to the F5 for that network on a local IP address otherwise you will get problems from asymmetric routing (I.e. local pcs forward traffic to firewall to there, then the server response goes to the F5, F5 forwards the response to an interface other than the original it was forwarded out of and the traffic gets dropped)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;TL;DR You have to have a self IP in the external VLAN in order to proxy-arp for the VIP. Easiest option is going to be create a self-ip in both vlans then enable SNAT for the server VLAN. &lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2015-09-19T22:57:01.333" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22673" PostTypeId="1" AcceptedAnswerId="22688" CreationDate="2015-09-20T04:58:24.243" Score="2" ViewCount="4834" Body="&lt;p&gt;I am documenting equipment which requires me to state installed Physical Layer Interface Module (PLIM)/slot and transceivers/interfaces. What confused me is the different information shown between &lt;code&gt;#show inventory&lt;/code&gt; and &lt;code&gt;#show interface description&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The information from &lt;code&gt;#show interface description&lt;/code&gt; doesn't list all interfaces under a slot shown from &lt;code&gt;#show inventory&lt;/code&gt;. The slot has status ready from &lt;code&gt;#show platform&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The information from &lt;code&gt;#show inventory&lt;/code&gt; doesn't list all interfaces which are listed from &lt;code&gt;#show int description&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any reasons for these situations? Any suggestions so that I can documenting without any contradictions? Router is Cisco ASR 12000 series.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-09-20T15:14:34.687" Title="Cisco - #show inventory vs #show interface" Tags="|cisco|cisco-ios|cisco-commands|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22674" PostTypeId="1" AcceptedAnswerId="22681" CreationDate="2015-09-20T05:03:32.737" Score="2" ViewCount="285" Body="&lt;p&gt;Baby network person here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to set up a small network such as the one in attached picture.&#xA;3 routers, 3 switches, 3 endpoints. Color boxes denote subnets.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/fNxhR.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fNxhR.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I want to have only 1 DHCP server, which router would be the best/how would it be set up?&#xA;I believe I should be able to set any one router to work as DHCP and hand out IPs from different pools for any endpoints(except for routers which have static IPs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, questions:&#xA;1. If R1 becomes DHCP server, how does it determine which pool to use for PC2 &amp;amp; PC3? Even with DHCP relay setup, they'd be coming from the same interface(same line). Or does R2 &amp;amp; R3 replace the source address when relaying the DHCP broadcast packets so R1 can look at that and use it to determine which pool?&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Extension of Q1, how does DHCP server decide between multiple pools? If R2 was DHCP server, does it look at which interface it came from(which would cause problem for multiple VLANs coming via multiple hops to same interface) or does it look at source router IP address that started DHCP relay?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Kinda confused here, any help would be awesome!&lt;/p&gt;&#xA;" OwnerUserId="17100" LastActivityDate="2024-01-15T19:08:35.400" Title="DHCP relay question in small network" Tags="|routing|dhcp|design|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22676" PostTypeId="1" CreationDate="2015-09-20T07:42:06.867" Score="8" ViewCount="34726" Body="&lt;p&gt;Is fiber optic Digital or analog? optical signal is digital or analog?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what kind of signal Fiber generate? I mean traditional phone system is analog, but Ethernet is digital, but what about Fiber Optic? please keep it simple.&lt;/p&gt;&#xA;" OwnerUserId="17410" LastActivityDate="2019-04-01T13:21:21.037" Title="Is fiber optic Digital or analog? optical signal is digital or analog?" Tags="|fiber|" AnswerCount="9" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22678" PostTypeId="2" ParentId="22676" CreationDate="2015-09-20T09:29:14.067" Score="6" Body="&lt;p&gt;All signals are analog, wether if it's electricity (copper), light (fiber) or radio (wifi), signals/waves can have any arbitrary value. However, in the computer world they carry digital information (either 1 or 0) and they are processed digitally, transforming the analog information into digital information. How this transformation done depends on the encoding. Check the Wikipedia article about the Manchester code for more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.m.wikipedia.org/wiki/Manchester_code&quot; rel=&quot;noreferrer&quot;&gt;https://en.m.wikipedia.org/wiki/Manchester_code&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2079" LastActivityDate="2015-09-20T09:29:14.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22680" PostTypeId="1" AcceptedAnswerId="22696" CreationDate="2015-09-20T12:45:07.127" Score="0" ViewCount="60" Body="&lt;p&gt;If a switch is running in the live network and a port of it was in use before now.so I wants to shut it down. what are the parameter / things I need to check ? &lt;/p&gt;&#xA;" OwnerUserId="19180" LastActivityDate="2015-09-21T05:44:47.227" Title="what are the parameter need to check out before shutting down the switch port?" Tags="|lan|switching|layer2|port-security|" AnswerCount="2" CommentCount="1" ClosedDate="2015-09-21T11:20:52.953" ContentLicense="CC BY-SA 3.0" />
  <row Id="22681" PostTypeId="2" ParentId="22674" CreationDate="2015-09-20T12:57:30.057" Score="2" Body="&lt;p&gt;It's based on the sending interface where you have configured the ip-helper option(or dhcp relay in juniper).&#xA;Look up giaddr.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/15-sy/dhcp-15-sy-book/dhcp-relay-svr-option-82.html#GUID-EAF7E927-F3BA-4B06-B4F0-1EE436ED452D&quot; rel=&quot;nofollow noreferrer&quot;&gt;DHCP Configuration Guide, Cisco IOS Release 15SY: IP Addressing § &lt;strong&gt;Information About DHCP Relay Server ID Override and Link Selection Option 82 Suboptions&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If you have 2 ip adresses on the svi/interface it will send from the primary then the secondary.&lt;/p&gt;&#xA;" OwnerUserId="6412" LastEditorUserId="42041" LastEditDate="2024-01-15T19:08:35.400" LastActivityDate="2024-01-15T19:08:35.400" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22684" PostTypeId="2" ParentId="22676" CreationDate="2015-09-20T14:43:49.270" Score="9" Body="&lt;p&gt;Due to the way that fiber lasers work, common digital encoding on fiber is &amp;lt;20% is a 0 and &gt;80% is a 1 so the beam is never &quot;off&quot; it just varies between low and high power. Turning the laser OFF is much more of an event than varying its power level, so this method is faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The transmitted data is put through various encodings before going on the fiber which ensure things like an equal number of 1's and 0's and never having a very long string of 1s or 0s in a row - the received data is decoded from that format before being passed on, and for Ethernet anyway the actual &quot;raw&quot; data speed in the line is greater than the &quot;nominal&quot; speed to permit carrying decoded data at the nominal speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At 10 GB, the encoding schemes have been altered to make them less of a burden - rather than using &lt;a href=&quot;https://en.wikipedia.org/wiki/8b/10b_encoding&quot; rel=&quot;noreferrer&quot;&gt;10 raw bits to carry 8 data bits&lt;/a&gt; as is done at 1 gigabit, &lt;a href=&quot;https://en.wikipedia.org/wiki/64b/66b_encoding&quot; rel=&quot;noreferrer&quot;&gt;66 raw bits carry 64 data bits.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-09-20T14:43:49.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22686" PostTypeId="2" ParentId="22420" CreationDate="2015-09-20T14:55:12.867" Score="0" Body="&lt;p&gt;i think your problem is in next, you have this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-group 104 out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but you must this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-group 104 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;because your trafic not have access when you use out &lt;/p&gt;&#xA;" OwnerUserId="19183" LastActivityDate="2015-09-20T14:55:12.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22688" PostTypeId="2" ParentId="22673" CreationDate="2015-09-20T15:14:34.687" Score="4" Body="&lt;p&gt;&lt;code&gt;show inventory&lt;/code&gt; shows you the device components, part-no. and erial-no.&#xA;so you may also see controller´s, Crypto-Modules, SFP's, Power-supplies, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show interface&lt;/code&gt; shows all interfaces (which may have a protocal attached, for example, IPv4) . This includes interfaces without hardware, like&#xA;loopback, tunnel, Ethernet.subinterfaces ( gig 0/1.234 ) ,&#xA;and dynamically created (virtual-access, ...) or the stamp of them (virtual-template).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use &quot;show inventory&quot; &quot;show license&quot; &quot;show hardware&quot; &quot;show diag&quot; &quot;show platform&quot;&#xA;to collect the physical infrastructure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get &quot;show running&quot; for the Configuration and the allways-be-there interfaces,&#xA;including non-physical or interface-templates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dont forget to save the IOS Version and Variety which is running.&lt;/p&gt;&#xA;" OwnerUserId="19154" LastActivityDate="2015-09-20T15:14:34.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22689" PostTypeId="2" ParentId="22676" CreationDate="2015-09-20T15:17:28.700" Score="2" Body="&lt;p&gt;There are many differences between analog and digital, but one of the primary distinctions that will easily answer your question is that analog signals make use of sine waves while digital signals make use of square waves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since fiber optic data transmissions in networking use square waves, it is a digital signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you can also transmit a analog signal over fiber optic, such as a video. It is not the medium that determines the type of signal, but the devices on each end.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-09-20T15:17:28.700" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="22690" PostTypeId="1" AcceptedAnswerId="22691" CreationDate="2015-09-20T15:18:53.777" Score="3" ViewCount="606" Body="&lt;p&gt;When capturing a dump using wireshark during download of a file and then exploring the total bytes downloaded in pcap is always greater than the actual file downloaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example&lt;/p&gt;&#xA;&#xA;&lt;p&gt;700000 bytes shows in pcap&lt;/p&gt;&#xA;&#xA;&lt;p&gt;680000 bytes shows in original file size &lt;/p&gt;&#xA;" OwnerUserId="1878" LastActivityDate="2015-09-20T16:17:04.480" Title="Why the pcap file always shows more bytes downloaded than the actual file size downloaded when using wireshark?" Tags="|wireshark|pcap|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22691" PostTypeId="2" ParentId="22690" CreationDate="2015-09-20T16:17:04.480" Score="1" Body="&lt;p&gt;It's just protocol overhead. YOur file is cut into  smaler bites,&#xA;gets tcp header, gets ip header, gets ethernet header ...&lt;/p&gt;&#xA;" OwnerUserId="19154" LastActivityDate="2015-09-20T16:17:04.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22692" PostTypeId="2" ParentId="22650" CreationDate="2015-09-20T16:57:41.863" Score="2" Body="&lt;p&gt;The &quot;NIC&quot; Hardware just sends ethernet-frames onto the wire and recieves them.&#xA;The operation-system has a &quot;driver&quot; to programm the NIC since that is a hardware-specific task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there is software in the Operation-system (modules in the kernel) which handles common &quot;ethernet&quot; tasks. It sends ethernet-frames of know type to &quot;customers&quot; which have an abonnement for it.&#xA;The helper-protocol ARP is one of them,&#xA;IP is the popular used one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP and UDP Modules are customers of IP. &#xA;ICMP is also customer of IP (but IP also uses it as a &quot;client&quot; of icmp,&#xA;that is a little bit confusing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of them have programming-interfaces from the kernal to the user-application-level ( often the &quot;socket-library&quot; ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Programms like a &quot;webserver&quot; runs as an background-application&#xA;and connectes to the tcp-module asking for every ip-paket with Destination TCP-Port 80.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Programm like an Internet-Browser usese the tcp-module to connect to remote servers with TCP-Port 80, local Port does not matter here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When TCP/IP was created, the OSI-Model was non-existing, &#xA;so the relations beetween the OSI-layers are not so clear &#xA;as in newer Networkprotocols (appletalk, for example :-)&lt;/p&gt;&#xA;" OwnerUserId="19154" LastActivityDate="2015-09-20T16:57:41.863" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22693" PostTypeId="1" CreationDate="2015-09-20T18:35:38.200" Score="1" ViewCount="90" Body="&lt;p&gt;I'm running a Raspberry Pi 2 as a Print-Server for a MFC-Printer with saned for scanning over network support. I have the Pi powered via a TP-Link &lt;a href=&quot;http://www.tp-link.com/en/products/details/cat-4794_TL-POE10R.html&quot; rel=&quot;nofollow&quot;&gt;PoE-Splitter&lt;/a&gt; with 5V output. The PoE switch is a D-Link &lt;a href=&quot;http://support.dlink.com/ProductInfo.aspx?m=DGS-1210-10P&quot; rel=&quot;nofollow&quot;&gt;DGS-1210-10P&lt;/a&gt; (HW Rev C).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Pi which works perfectly when powered from a wall-outlet is rebooting over and over again, and as far as I understand, this is due to the fact, that the Switch delivers only about 0.8W / 22mA through the port the Pi is connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Interface of the Switch only allows to &lt;em&gt;limit&lt;/em&gt; but not to specifically set the Wattage that is sent through a specific port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some kind of trick or hack (e.g. by soldering a resistor in between or such) to force the Switch to deliver more Wattage? Or any other ideas / suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="19186" LastActivityDate="2015-09-20T19:57:52.580" Title="Actively take Influence on PoE Wattage delivered by Switch?" Tags="|power-over-ethernet|" AnswerCount="2" CommentCount="2" ClosedDate="2019-02-12T03:52:03.710" ContentLicense="CC BY-SA 3.0" />
  <row Id="22694" PostTypeId="2" ParentId="22693" CreationDate="2015-09-20T18:44:21.133" Score="0" Body="&lt;p&gt;There are several PoE standards, and each has a maximum amount of power it can deliver. Apparently your switch can't deliver enough power, and there is nothing to be done about that except to replace the switch or use an external, in-line PoE adapter that delivers enough power.  You can't change the existing switch to use a newer PoE standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see this problem all the time with the new 802.11ac WAPs.  They require PoE+, but people try to use them on PoE, and it just doesn't work.  With one or two devices, it makes sense to buy external PoE adapters, but for a lot of devices, you just need to replace the switch with one that supports the newer standards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data sheet for your switch shows a maximum of 78 Watts PoE for the entire switch.  Are you using PoE in other ports?  You could be exceeding the power budget for the switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-20T18:58:23.580" LastActivityDate="2015-09-20T18:58:23.580" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22695" PostTypeId="2" ParentId="22693" CreationDate="2015-09-20T19:57:52.580" Score="2" Body="&lt;p&gt;if you want to provide power over Ethernet and your switch couldn't deliver enough power ,may you use power injector , a lot of brands may show a lot of power injectors with variety of o/p power . power injector is something work as in the next shape &#xA;&lt;a href=&quot;https://i.stack.imgur.com/j3Wfv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/j3Wfv.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-20T19:57:52.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22696" PostTypeId="2" ParentId="22680" CreationDate="2015-09-20T20:07:01.593" Score="1" Body="&lt;p&gt;if you want to shutdown this port just for security purpose may you need to check the next.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;if any user plugged in   &lt;/li&gt;&#xA;&lt;li&gt;if any switch plugged in  &lt;/li&gt;&#xA;&lt;li&gt;if it is working as a plan B for any physical failure    &lt;/li&gt;&#xA;&lt;li&gt;check the running configuration if it is part of any policy , NAT (if you run on cisco appliance may you issue #sh run | inc )   &lt;/li&gt;&#xA;&lt;li&gt;if it is attached to any VLAN may you need to know what is the use of this vlan   &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;that is not all but it will keep you in safe side .&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-20T20:07:01.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22697" PostTypeId="1" AcceptedAnswerId="22701" CreationDate="2015-09-20T21:32:50.317" Score="1" ViewCount="1430" Body="&lt;p&gt;Trying to learn how to subnet but having hard time understanding. Trying to subnet 10.20.0.0/16. So I understand the subnet mask is default for class A 255.0.0.0 but it has been subnetted to 255.255.0.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to add 300 hosts but They don't fit as 10.20.0.1-300.. So does that mean I fit as many hosts into 10.20.0.255 and then the rest into 10.20.1.45?&lt;/p&gt;&#xA;" OwnerUserId="19187" LastActivityDate="2015-09-20T23:29:16.957" Title="Subnetting a Class A IP" Tags="|ipv4|subnet|" AnswerCount="2" CommentCount="0" ClosedDate="2015-09-23T16:53:11.287" ContentLicense="CC BY-SA 3.0" />
  <row Id="22699" PostTypeId="2" ParentId="22676" CreationDate="2015-09-20T22:02:32.393" Score="5" Body="&lt;p&gt;the answer of this question is depend of how we under stand data transmission across fiber optic ??&lt;br&gt;&#xA; lets say we have a group of 0's and 1's represent the data need to be transferred from end to end . simply across the fiber optic ,transmitting   such data is by turning laser light on for interval to represent 1 and turn it off for interval to represent 0 , this behave of sending data is &lt;strong&gt;&lt;em&gt;DIGITAL&lt;/em&gt;&lt;/strong&gt;  the next figure show basic transmit and receive based on this concept&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Ax3wu.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ax3wu.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;   &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-20T22:02:32.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22700" PostTypeId="2" ParentId="22697" CreationDate="2015-09-20T22:59:57.507" Score="1" Body="&lt;p&gt;Classful addressing was deprecated more than 20 years ago. Subnetting is done in prefixes these days. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The prefix length is the number of bits at the start of the address that stay the same. Subnet mask 255.255.255.0 in binary is 11111111.11111111.11111111.00000000 correspond to prefix length 24 (count the 1s), 255.255.0.0 corresponds to 16 etc. For 300 hosts you need a network with prefix length 23Blues (or shorter): 23 bits fixed leaves 9 bits for numbering hosts, which gives you 512 addresses. The first and the last address are reserved, the rest you can use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we take 10.20.0.0/23 as example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network address and mask are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001010.00010100.00000000.00000000&#xA;11111111.11111111.11111110.00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We don't change the bits marked as fixed by the prefix. That gives us this range of addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001010.00010100.00000000.00000000&#xA;00001010.00010100.00000001.11111111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which is 10.20.0.0 to 10.20.1.255. The first and last address are reserved for network and broadcast address, the rest (including 10.20.0.255 and 10.20.1.0) are normal addresses available to be used.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-09-20T22:59:57.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22701" PostTypeId="2" ParentId="22697" CreationDate="2015-09-20T23:00:53.773" Score="1" Body="&lt;p&gt;as you said  &lt;em&gt;class A 255.0.0.0 but it has been subnetted to 255.255.0.0&lt;/em&gt; so what you post is not class A it is simply classless network . usual subneting method in classless network is as following .&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                              NETWORK | SUBNET | HOST &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;for the network part (which is the part won't change ever) -&gt; 10.20.X.X  &lt;/li&gt;&#xA;&lt;li&gt;for the part of SUBNET it can take any number -&gt; here we need to ask a question . &#xA;it is mandatory to but all of the 300 users in single network or it can be divided into two subnets or more ???  &lt;/li&gt;&#xA;&lt;li&gt;for the part of host (the most important)  -&gt;   we need to ask very impotent question . in  how many bits we can represent 300 host ???&lt;br&gt;&#xA;in 7 bits maximum we can represent 126 host&#xA;in 8 bits maximum we can represent 254 host .&#xA;in 9 bits we can represent 510 host .&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;so you may use one subnet with 9 bit representing the host in form of 10.20.0.0/23 , so you will obtain (510-300=210 extra IP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or may you use 3 subnets with 7 bits represent the users in form of&lt;br&gt;&#xA;10.20.0.0/25 -&gt;126 host&lt;br&gt;&#xA;10.20.0.1/25 -&gt;126 host&lt;br&gt;&#xA;10.20.1.0/25 -&gt;126 host&lt;br&gt;&#xA;and here you will get (3*126-300=78 extra IP)&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-09-20T23:29:16.957" LastActivityDate="2015-09-20T23:29:16.957" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22702" PostTypeId="1" AcceptedAnswerId="22703" CreationDate="2015-09-21T00:50:37.410" Score="2" ViewCount="506" Body="&lt;p&gt;I am in review of an IOT(Internet of Things) Project . Earlier my wifi devices were connected to a central hub which ran the webserver from an ip obtained from customer home router and on a dedicated port number . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are thinking of removing the central box and planning to get web-servers running on each device . I would like to know since more than one device will be connected to the same router , they both will obtain ip from the same router and hence the IP addresses will be a subnet . Can both of these devices run on the same port number ?&lt;/p&gt;&#xA;" OwnerUserId="19189" LastActivityDate="2015-09-21T02:21:35.853" Title="Same port number on subnet" Tags="|ipv4|subnet|route-server|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22703" PostTypeId="2" ParentId="22702" CreationDate="2015-09-21T00:55:12.817" Score="2" Body="&lt;p&gt;The port number is per IP address, not subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The port number is in layer-4, while the IP address is in layer-3.  What a different device will connect to first is layer-3, then layer-4.  Layer-4 creates an end-to-end connection by basically combining layer-3 and layer-4 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's like the layer-3 address is the street address of the building (host), and the layer-4 address is the room number in that building.  Multiple buildings (hosts) on the same street (subnet) can have the same room (port) number, and they are all different rooms.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-21T02:21:35.853" LastActivityDate="2015-09-21T02:21:35.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22704" PostTypeId="2" ParentId="22702" CreationDate="2015-09-21T00:56:12.783" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;they both will obtain ip from the same router and hence the IP addresses will be a subnet &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is not correct.  They will each obtain a unique IP address.  Both IP addreses will be in the same subnet.  Since each device in individually addressable, the servers can use the same port number.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-09-21T00:56:12.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22706" PostTypeId="1" AcceptedAnswerId="22707" CreationDate="2015-09-21T03:34:39.247" Score="1" ViewCount="455" Body="&lt;p&gt;I want to be able to remotely access an Ethernet switch-port protected by 802.1x.  The switch I want to access is at a distant site, but I have a T1 circuit that goes from that site to my office.  I tried using a set up like the picture shows, where I used two Ethernet to T1 bridges, but the problem I'm having is that the EAPOL frames seem to be addressed to 01:80:c2:00:00:03, which is filtered by the bridges and not passed to the host/laptop.  These bridges are non configurable, and I can't change the config on the switch so I have to find another workaround.  What I basically need is a solution makes the T1 bridge &quot;look like a cable&quot; to the host and switch.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yv9JR.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yv9JR.jpg&quot; alt=&quot;first solution, that didn&amp;#39;t work.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading around, I've read mention of a transparent bridge, whereby one may use two cisco routers with T1 interfaces as a bridge, and the Ethernet ports can be made to ignore LLDP, which would make it pass the frames addressed for 01:80:c2:00:00:03.  Would a solution like the one described in the picture work for my purposes?  Also can anyone tell me how I would need to configure the routers to pass all frames addressed to 01:80:xx:xx:xx:xx?&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/AIMiw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AIMiw.jpg&quot; alt=&quot;proposed soultion.&quot;&gt;&lt;/a&gt;&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="19190" LastActivityDate="2018-03-05T19:22:22.010" Title="How can I access switch port protected by 802.1X thats in a seperate collision domain seperated by a T1 bridge" Tags="|security|lan|bridge|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22707" PostTypeId="2" ParentId="22706" CreationDate="2015-09-21T03:54:13.380" Score="0" Body="&lt;p&gt;Cisco routers and switches can certainly ignore LLDP, but neither will they pass LLDP frames on.  LLDP is a link protocol, meaning is won't go beyond the link on which it was originated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many such link-only protocols that are never passed beyond the link on which they originate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to make something like this work is with devices that are simply layer-1 devices like media converters or hubs, not layer-2 (or above) devices like bridges or switches.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-21T03:54:13.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22708" PostTypeId="2" ParentId="22680" CreationDate="2015-09-21T05:44:47.227" Score="0" Body="&lt;p&gt;Copy or backup existing interface configuration. &lt;/p&gt;&#xA;" OwnerUserId="12082" LastActivityDate="2015-09-21T05:44:47.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22709" PostTypeId="2" ParentId="22668" CreationDate="2015-09-21T06:25:13.543" Score="1" Body="&lt;p&gt;You've tagged this post Juniper, so I'm assuming those two Firewalls are SRXs of some variety, in which case - just create Zones for each interface as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HQFW:&#xA;Internet Zone&#xA;HQ Server Zone&#xA;WAN&#xA;&#xA;BranchFW:&#xA;Trust/Branch Server Zone&#xA;DMZ Zone&#xA;WAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then just write explicit policies (meaning reference Server IPs) to allow traffic between zones.  You do &lt;strong&gt;not&lt;/strong&gt; want to extend/tunnel L2 across your Wide-Area Network except in &lt;strong&gt;very&lt;/strong&gt; specific use cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said all that, the SRX is quite capable of supporting tunnelled L2 as either point-to-point (via L2Circuit-over-MPLS-over-GRE), or multipoint (via VPLS-over-MPLS-over-GRE).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper VPLS example below (uses IPSEC, but this will work fine with GRE once you sort MTU issues):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos15.1x49/topics/example/vpls-over-gre-ipsec.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/en_US/junos15.1x49/topics/example/vpls-over-gre-ipsec.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-09-21T06:25:13.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22711" PostTypeId="2" ParentId="22640" CreationDate="2015-09-21T07:26:22.090" Score="1" Body="&lt;p&gt;As Ecnerwal states, you can't transmit signal with the same wavelength in both directions.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure you know how one-eyed SFPs work, but here (&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/transceiver-modules/data_sheet_c78-455693.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/transceiver-modules/data_sheet_c78-455693.pdf&lt;/a&gt;) you can find a diagram explaining it on page 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are planing yo use single fiber SFPs/XFPs, your CWDM muxes should support them. ( like this one &lt;a href=&quot;http://www.pandacomdirekt.com/en/products/wdm/passive-multiplexer/cwdm-multiplexer/48-channel-single-fiber.html&quot; rel=&quot;nofollow&quot;&gt;http://www.pandacomdirekt.com/en/products/wdm/passive-multiplexer/cwdm-multiplexer/48-channel-single-fiber.html&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2015-09-21T07:26:22.090" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22712" PostTypeId="2" ParentId="22706" CreationDate="2015-09-21T07:42:22.663" Score="1" Body="&lt;p&gt;If your T1-Link and devices are just bridges,&#xA;either they must authenticate to the local switch-port&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or bridge &lt;strong&gt;all&lt;/strong&gt; traffic so that both switches &#xA;are dot.x client to each other .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having ethernet-frames with odd first-byte 01:, 03: , ...&#xA;the are all multicast or broadcast. &#xA;They may get lost due to the fact that &quot;intelligent&quot; Bridges also want to reduce all the broadcast traffic.&#xA;Also, Traffic with special desination MAC Adresses are &quot;link-local&quot;&#xA;and should never be bridged further but go to the local switch'S CPU to be processed.&#xA;There may be an configuration option to forward everything,&#xA;this depends on your device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also use a pair of (for just T1 ancient) Cisco-Devices (1841 &#xA;with appropiatio T1 module);&#xA;configure a private ip subnet on the T1 link,&#xA;and configure a l2tpv3 xconnect between physical port&lt;/p&gt;&#xA;&#xA;&lt;p&gt;( and if that does not work,&#xA;  that cisco device may dot1x authentificate to the switch,&#xA;  at least with username/password )&lt;/p&gt;&#xA;" OwnerUserId="19154" LastActivityDate="2015-09-21T07:42:22.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22713" PostTypeId="1" AcceptedAnswerId="22720" CreationDate="2015-09-21T08:10:20.227" Score="2" ViewCount="126" Body="&lt;p&gt;Let's say I have a /27 allocation from my ISP, and let's call it: 90.10.200.32/27&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP have their router set up as my gateway on address 90.10.200.33. The range 90.10.200.34-62 are free for me to allocate. I need to add a routed subnet behind this network, that is reachable from the internet. Can I do this by dividing my prefix? Something like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I connect a router to the ISP network and give it the address 90.10.200.34/28, and set it's gateway to 90.10.200.33&lt;/li&gt;&#xA;&lt;li&gt;I configure another interface of the route for the address 90.10.200.49/28, and connect devices to this interface, assigning them addresses in the 90.10.200.50-62 range.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I do not have control over routing tables on the ISP router (90.10.200.33). Is it possible to do this, or something like it without BGP? As far as I can tell, outbound routing would work fine, but I am confused as to whether to ISP router, which obviously only knows about the /27 will be able to direct packets to 90.10.200.34 for the 90.10.200.48/28 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there another way to do this that does not involve BGP or having the ISP alter the configuration of their router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Just to make it clear, the question is whether this is possible &lt;strong&gt;without&lt;/strong&gt; the ISP changing the routing table on their equipment. As such, what I really want to know is whether this form of subnetting can be done &quot;transparently&quot;, so to speak, without altering the configuration of the next upstream device. &lt;/p&gt;&#xA;" OwnerUserId="16936" LastEditorUserId="16936" LastEditDate="2015-09-21T20:27:56.253" LastActivityDate="2017-06-18T12:36:42.027" Title="Can I add a hop by dividing my prefix?" Tags="|routing|subnet|prefix|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22714" PostTypeId="1" AcceptedAnswerId="22717" CreationDate="2015-09-21T08:23:35.957" Score="3" ViewCount="100" Body="&lt;p&gt;I got an port here from somewhere, and I'm guessing its an isdn30 line but I'm not sure. How can I check if its indeed an isdn30 line? I can plug my laptop in with an utp-cable but is there a program which can detect which line it is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="19194" LastEditorUserId="27143" LastEditDate="2016-06-14T00:37:03.003" LastActivityDate="2016-06-14T00:37:03.003" Title="How can I see if this line is an isdn30 line?" Tags="|voip|cisco-voip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22715" PostTypeId="2" ParentId="20061" CreationDate="2015-09-21T08:46:16.847" Score="1" Body="&lt;p&gt;If the IOS is too old, bug CSCsq59183 incorrectly shows those messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may also help us to help you if you provide the DMVPN configuration (at least, the Tunnel interface config) of HUB and at least one SPOKE. &lt;/p&gt;&#xA;" OwnerUserId="19154" LastEditorUserId="8499" LastEditDate="2016-03-28T22:25:25.110" LastActivityDate="2016-03-28T22:25:25.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22716" PostTypeId="2" ParentId="22713" CreationDate="2015-09-21T09:05:33.820" Score="1" Body="&lt;p&gt;You must ask your ISP to adjust the netmask (say: /29),&#xA;so the network between ISP-Router and Your-Router is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;90.10.200.32 /29 255.255.255.248 0.0.0.7 net-to-isp&#xA;90.10.200.33 default-gw for you, ISP-Router&#xA;90.10.200.34 (free for future)&#xA;90.10.200.35 (free for future)&#xA;90.10.200.36 (free for future)&#xA;90.10.200.37 (free for future)&#xA;90.10.200.38 Your-Router&#xA;90.10.200.39 broadcast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let your ISP route the other adresses route to Your-Router,&#xA;that ist&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 90.10.200.40 255.255.255.248 90.10.200.38&#xA;ip route 90.10.200.48 255.255.255.240 90.10.200.38&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, change netmask on the ethernet interface to /29.&#xA;Your default-route will be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 90.10.200.33&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The remaining /29 and /28 may be used in the following way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first may be used as the interface to Your Firewall(s),&#xA;You will route the second onto the firewall (to give it a&#xA;DMZ with real-not-natted ip-adresses).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ALso, you have some ip-adress-space for more devices or hardware-redundany, say two routers, firewall-cluster, ...&lt;/p&gt;&#xA;" OwnerUserId="19154" LastActivityDate="2015-09-21T09:05:33.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22717" PostTypeId="2" ParentId="22714" CreationDate="2015-09-21T11:36:58.967" Score="2" Body="&lt;p&gt;the port you are specking about called controller and for 30 it will be E1 . its format will be something like E1 0/0/0 .&lt;br&gt;&#xA;so by issue &lt;strong&gt;&lt;em&gt;sh controllers E1&lt;/em&gt;&lt;/strong&gt;  you will get some thing like  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;E1 0/0/0 is up.&lt;br&gt;&#xA;  [Omitted]&lt;br&gt;&#xA;E1 0/0/1 is down.&lt;br&gt;&#xA;  [Omitted]&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the UP one is the CONNECTED one&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to check the status of the ISDN ,issue the command &lt;strong&gt;&lt;em&gt;sh isdn status&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Global ISDN Switchtype = primary-net5&lt;br&gt;&#xA;ISDN Serial0/0/0:15 interface&lt;br&gt;&#xA;        dsl 0, interface ISDN Switchtype = primary-net5&lt;br&gt;&#xA;    Layer 1 Status:&lt;br&gt;&#xA;        ACTIVE&lt;br&gt;&#xA;    Layer 2 Status:&lt;br&gt;&#xA;        TEI = 0, Ces = 1, SAPI = 0, State = MULTIPLE_FRAME_ESTABLISHED&lt;br&gt;&#xA;    Layer 3 Status:&lt;br&gt;&#xA;        0 Active Layer 3 Call(s)&lt;br&gt;&#xA;    Active dsl 0 CCBs = 0&lt;br&gt;&#xA;    The Free Channel Mask:  0xFFFF7FFF&lt;br&gt;&#xA;    Number of L2 Discards = 0, L2 Session ID = 6&lt;br&gt;&#xA;    Total Allocated ISDN CCBs = 0&lt;/em&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the most importunate here ,the status of layer 1 which &lt;strong&gt;&lt;em&gt;active&lt;/em&gt;&lt;/strong&gt;   indicating that connection is establish and every thing going well&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-21T11:36:58.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22719" PostTypeId="1" CreationDate="2015-09-21T13:53:18.310" Score="2" ViewCount="5323" Body="&lt;p&gt;I am configuring a new 3560 switch. Running IOS  Version 15.0(2)SE6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I want to configure enable secret I can choose the following : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#enable secret ?&#xA;  0      Specifies an UNENCRYPTED password will follow&#xA;  5      Specifies a MD5 HASHED secret will follow&#xA;  8      Specifies a PBKDF2 HASHED secret will follow&#xA;  9      Specifies a SCRYPT HASHED secret will follow&#xA;  LINE   The UNENCRYPTED (cleartext) 'enable' secret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that MD5 HASHED is weak, but I was wondering which one is more secure between PBKDF2  and SCRYPT  ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards,&lt;/p&gt;&#xA;" OwnerUserId="3406" LastEditorUserId="3406" LastEditDate="2015-12-23T09:51:42.273" LastActivityDate="2015-12-23T10:04:42.330" Title="PBKDF2 vs SCRYPT" Tags="|cisco-ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22720" PostTypeId="2" ParentId="22713" CreationDate="2015-09-21T14:04:06.917" Score="2" Body="&lt;p&gt;You can subnet the /27 into /30 for the WAN link.  That will leave you with another /30, a /29, and a /28 for you to assign on your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;90.10.200.32/30&lt;/code&gt; for the WAN, use &lt;code&gt;90.10.200.33&lt;/code&gt; for the ISP and&#xA;&lt;code&gt;90.10.200.34&lt;/code&gt; for your WAN interface&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;90.10.200.36/30&lt;/code&gt; for a subnet with 2 hosts&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;90.10.200.40/29&lt;/code&gt; for a subnet with 6 hosts&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;90.10.200.48/28&lt;/code&gt; for a subnet with 14 hosts&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-21T14:04:06.917" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22722" PostTypeId="2" ParentId="22713" CreationDate="2015-09-21T15:40:39.217" Score="2" Body="&lt;p&gt;What does stop you from bridging these two interfaces? Simple transparent bridge. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case you save 1 IP address. For all internal devices the GW is the IP of the router. For external devices, everything behind the router is visible, but you may adjust it with some filtering policy.&lt;/p&gt;&#xA;" OwnerUserId="17628" LastActivityDate="2015-09-21T15:40:39.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22723" PostTypeId="1" CreationDate="2015-09-21T17:16:30.543" Score="1" ViewCount="111" Body="&lt;p&gt;I have new equipment arriving (and more to come) that is PLC controlled and uses Ethernet I/O. It may utilize up to 50 IP addresses that are not compatible with our LAN. I need to access only the PLC and HMI via our LAN. I have an HP 1910-8 switch. Can I configure this switch to accept communications compatible with our LAN and convert/route them to the PLC and HMI and in turn route PLC and HMI communications back to our LAN? In other words, could I configure the switch to route communications between a device with 10.39.122.22 IP address and a PLC whose address is 120.30.16.20? Possible or am I just being silly?&lt;/p&gt;&#xA;" OwnerUserId="19208" LastActivityDate="2016-10-16T09:29:54.817" Title="Control Communications between dissimilar IP addresses" Tags="|routing|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22727" PostTypeId="2" ParentId="22723" CreationDate="2015-09-21T17:35:37.150" Score="1" Body="&lt;p&gt;You could configure a VLAN, VLAN interface. and and static routing on this platform based on this document &lt;a href=&quot;http://vmfocus.com/2012/09/26/how-to-configure-layer-3-static-routes-vlans-on-hp-v1910-24g/&quot; rel=&quot;nofollow&quot;&gt;How To Configure Layer 3 Static Routes &amp;amp; VLANs On HP v1910 24G&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devices, which have the same abilities, could perform inter-VLAN routing, which you need; just try from its GUI :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;create 2 VLANs&lt;/li&gt;&#xA;&lt;li&gt;create interface IP addresses for each &lt;/li&gt;&#xA;&lt;li&gt;assign ports in each VLAN&lt;/li&gt;&#xA;&lt;li&gt;try to ping from one to the other &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2016-03-20T05:34:03.130" LastActivityDate="2016-03-20T05:34:03.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22730" PostTypeId="1" CreationDate="2015-09-22T09:28:55.987" Score="1" ViewCount="2505" Body="&lt;p&gt;Why DHCP has 16 Bytes reserved for chaddr in the BOOTP header ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per my knowledge DHCP is IPoE, so 48 Bits/ 6 BYtes should be enough ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the answer is same, means &quot;for future purpose&quot; ? Because i don't see now it's helpful in case of InfiniBand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anywhere it's documented with valid reason ?&lt;/p&gt;&#xA;" OwnerUserId="19218" LastActivityDate="2015-09-22T13:24:00.500" Title="What is the use of 16 Bytes chaddr in DHCP packet header?" Tags="|dhcp|mac-address|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="22732" PostTypeId="1" AcceptedAnswerId="43087" CreationDate="2015-09-22T09:32:04.233" Score="1" ViewCount="2550" Body="&lt;p&gt;I bought a Nanostation Loco M2 which does not have an UFL to SMA(f) RP port for me to add an external antenna.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I bought these UFL to SMA(f) RP cables and an external antenna but I am not sure where or how to attach them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://arg-wireless.com.ar/index.php?topic=920.0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Having seen this post&lt;/a&gt; which needs Google translate by the way, I am not sure whether I just attached the cable to the J5/J6 port, or solder the wire on to the J9 port. Has anyone had any experience with this? Here is a picture of the circuit board:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jzRRF.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jzRRF.jpg&quot; alt=&quot;Nanostation Loco M2 board&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15536" LastEditorUserId="8499" LastEditDate="2016-04-04T14:15:43.860" LastActivityDate="2017-08-08T09:05:31.090" Title="Adding external omni directional antenna to Nanostation Loco M2" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22733" PostTypeId="2" ParentId="22730" CreationDate="2015-09-22T13:24:00.500" Score="1" Body="&lt;p&gt;RFC2131 p. 7:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   From the client's point of view, DHCP is an extension of the BOOTP&#xA;   mechanism.  This behavior allows existing BOOTP clients to&#xA;   interoperate with DHCP servers without requiring any change to the&#xA;   clients' initialization software. &#xA;&#xA;   FIELD      OCTETS       DESCRIPTION&#xA;   -----      ------       -----------&#xA;   chaddr       16  Client hardware address.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ietf.org/rfc/rfc2131.txt&quot; rel=&quot;nofollow&quot;&gt;https://www.ietf.org/rfc/rfc2131.txt&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2015-09-22T13:24:00.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22734" PostTypeId="1" CreationDate="2015-09-22T13:26:54.213" Score="0" ViewCount="40" Body="&lt;p&gt;For clustered environments both Controllers must operate on the same firmware version. Now my situation on backup controller is &lt;a href=&quot;https://i.stack.imgur.com/zUgfV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zUgfV.png&quot; alt=&quot;show boot output&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how can I force using version 5.5 on next boot?&lt;/p&gt;&#xA;" OwnerUserId="19220" LastActivityDate="2015-09-22T20:38:38.637" Title="MOTOROLA RF7000 Series Switch between image" Tags="|wireless|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22735" PostTypeId="2" ParentId="17673" CreationDate="2015-09-22T15:29:55.033" Score="1" Body="&lt;p&gt;You say:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I gave the port, where the L2 switch was connected, the IP Address&#xA;  192.168.9.254. On the L2-Switch I added this IP Address as Gateway.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The L2 switch needs gateway only for mgmt afaik. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The L3 switch should have 2 logical VLAN interfaces, and both should be up. These VLAN interfaces then should be the default gateways for your clients. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All VLANs on an L3 switch, by default, communicate back and forth. The ports on which both the L2 switches connect to the L3, and vice versa, should be trunks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issue the equivalent of the &lt;code&gt;ip routing&lt;/code&gt; command on the L3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41860-howto-L3-intervlanrouting.html#steps&quot; rel=&quot;nofollow&quot;&gt;Cisco's inter-vlan routing guide.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15569" LastEditorUserId="8499" LastEditDate="2016-03-20T23:24:34.717" LastActivityDate="2016-03-20T23:24:34.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22738" PostTypeId="2" ParentId="22626" CreationDate="2015-09-22T18:32:54.417" Score="1" Body="&lt;p&gt;Thanks, config makes it easier :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you look at the config file, each item (excluding &quot;module&quot;) is a configuration command you can give on the CLI. And every command is negated with a preceding &quot;no&quot;. So if you want to disable the ACL for a duration, just &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip access-group &quot;vlan68-DEVEL_ACL&quot; in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will remove it from the interface, but won't touch the rules. When you're done with testing, give command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-group &quot;vlan68-DEVEL_ACL&quot; in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it's re-applied. Of course since this is applied to a VLAN, you need to be in the VLAN configuration context, so this is what it looks like in practice (with the prompt):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure &#xA;vlan 68&#xA;no ip access-group &quot;vlan68-DEVEL_ACL&quot; in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will change the running config. If you need the configuration w/o ACL to survive a reboot, you need to give command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;write memory&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;last to save to startup config. Even after this you re-apply the ACL the same way, just don't forget to &quot;write memory&quot; ;-)&lt;/p&gt;&#xA;" OwnerUserId="10799" LastActivityDate="2015-09-22T18:32:54.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22739" PostTypeId="2" ParentId="5400" CreationDate="2015-09-22T18:37:55.077" Score="1" Body="&lt;p&gt;Let us say that SWA has the config you want to copy and SWB is the new switch. Follow these steps to replicate the configs&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;user@SWA&amp;gt;show configuration|display set&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;copy the set commands from this display&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;user@SWB#load set terminal&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Press Enter&lt;/li&gt;&#xA;&lt;li&gt;Right Click to paste the copied set commands&lt;/li&gt;&#xA;&lt;li&gt;Press ctrl-D&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Commit check&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Commit&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19170" LastEditorUserId="509" LastEditDate="2015-09-22T19:58:10.707" LastActivityDate="2015-09-22T19:58:10.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22740" PostTypeId="2" ParentId="22734" CreationDate="2015-09-22T20:38:38.637" Score="1" Body="&lt;pre&gt;&lt;code&gt;boot system [primary|secondary] {on &amp;lt;DEVICE-NAME&amp;gt;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://portal.motorolasolutions.com/Support/US-EN/Wireless+Networks/Wireless+LAN/Unified+Access+Platforms/RFS7000_US-EN&quot; rel=&quot;nofollow&quot;&gt;WiNG CLI Reference Manual&lt;/a&gt; (any reference manual)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-09-22T20:38:38.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22742" PostTypeId="1" AcceptedAnswerId="22743" CreationDate="2015-09-23T02:33:14.037" Score="4" ViewCount="1609" Body="&lt;p&gt;I would like to understand what is the difference between twisted pair and single ended USB with the other hand having an ethernet port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My colleague mentioned that both ends have to be ethernet for the cable to be a twisted pair. Is this true? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pardon my question as i am very new to such networking stuff. &lt;/p&gt;&#xA;" OwnerUserId="19229" LastEditorUserId="8499" LastEditDate="2017-08-06T20:26:07.367" LastActivityDate="2017-08-06T20:26:07.367" Title="twisted pair vs single ended usb" Tags="|ethernet|cable|layer1|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22743" PostTypeId="2" ParentId="22742" CreationDate="2015-09-23T03:02:37.083" Score="3" Body="&lt;p&gt;Unshielded twisted pair (UTP) cabling is the most common type of cabling.  It is used for everything from standard phone lines to ethernet cabling.  UTP is graded by category.  The twisted pairs reduce problems from external noise and crosstalk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;USB cables may or may not have twisted pairs, depending on the manufacturer and quality of the cabling.  There is an adapter in the USB cable/connector to allow ethernet to connect via USB.  The ethernet side will need UTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cable from the ethernet port on your adapter will need to be UTP to the next ethernet device.  Ethernet, at modern network speeds, is quite sensitive to how far the pairs can be untwisted at the ends of the cable, so there will be almost no untwisting beyond the tiny bit needed to fit the individual wires into the connector.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-23T03:14:56.963" LastActivityDate="2015-09-23T03:14:56.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22746" PostTypeId="2" ParentId="16000" CreationDate="2015-09-23T08:43:42.983" Score="2" Body="&lt;p&gt;You should check FIB on your switch if you find there two records it means that the switch will load-balance. The command is:&#xA;    display fib x.x.x.x 32 verbose &#xA;In the output you'll also see whether switch will use mpls switching for this FEC and what LSP will it pick. Fields LspFwdFlag and LspToken indicate this.&lt;/p&gt;&#xA;" OwnerUserId="16345" LastActivityDate="2015-09-23T08:43:42.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22747" PostTypeId="1" CreationDate="2015-09-23T11:52:37.003" Score="3" ViewCount="3161" Body="&lt;p&gt;The router is connected to ISP which is 3500 series. There is a core switch connected to the router to the inside network. I can ping the internet from the router. but I cannot ping the internet from core switch and accesses switch. Any help please? Here is the configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1 Router&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OWWDSEROUTER#sh run&#xA;Building configuration...&#xA;Current configuration : 1552 bytes&#xA;!&#xA;version 15.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname OWWDSEROUTER&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;enable secret 5 xxxx&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;cts logging verbose&#xA;!&#xA;!&#xA;license udi pid C3900-SPE150/K9 sn FOC19102APP&#xA;!&#xA;!&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 10.151.49.234 255.255.240.0&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.10.1 255.255.255.252&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/2&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router rip&#xA; version 2&#xA; network 192.168.10.0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip nat inside source list NATADDRESSES interface GigabitEthernet0/0 overload&#xA;ip route 0.0.0.0 0.0.0.0 10.151.48.1&#xA;!&#xA;ip access-list standard NATADDRESSES&#xA; permit 10.0.0.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; password pa55w0rd&#xA; logging synchronous&#xA;line aux 0&#xA;line 2&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport output pad telnet rlogin lapb-ta mop udptn v120 ssh&#xA; stopbits 1&#xA;line vty 0 4&#xA; password Pa55w0rd&#xA; login&#xA; transport input all&#xA;line vty 5 15&#xA; login&#xA; transport input none&#xA;!&#xA;scheduler allocate 20000 1000&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2 core switch configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OWWDSECS#sh run&#xA;Building configuration...&#xA;Current configuration : 5423 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname OWWDSECS&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 xxx&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;ip routing&#xA;ip dhcp excluded-address 10.1.10.1 10.1.10.20&#xA;ip dhcp excluded-address 10.1.20.1 10.1.20.20&#xA;!&#xA;ip dhcp pool vlan20&#xA;   network 10.1.20.0 255.255.255.0&#xA;   domain-name owwdse.gov.et&#xA;   dns-server 213.55.96.166&#xA;   default-router 10.1.20.1&#xA;!&#xA;ip dhcp pool vlan10&#xA;   network 10.1.10.0 255.255.255.0&#xA;   default-router 10.1.10.1&#xA;   domain-name OWWDSE.GOV.ET&#xA;   dns-server 213.55.96.148 4.2.2.2&#xA;!&#xA;!&#xA;no ip domain-lookup&#xA;!&#xA;password encryption aes&#xA;!&#xA;crypto pki trustpoint TP-self-signed-3930400128&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-3930400128&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-3930400128&#xA;!&#xA;!&#xA;crypto pki certificate chain TP-self-signed-3930400128&#xA; certificate self-signed 01&#xA;  30820241 308201AA A0030201 02020101 300D0609 2A864886 F70D0101 04050030&#xA;  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274&#xA;  69666963 6174652D 33393330 34303031 3238301E 170D3933 30333031 30303031&#xA;  31365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649&#xA;  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 39333034&#xA;  30303132 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281&#xA;  8100BA3F C1ED6F08 0A7015C1 38713F23 AD545F99 5ED37090 822C5E83 D2A1FD1E&#xA;  35EF4E41 1F56637B C7364828 BF407113 48F4283E 3FA354F4 3415BFB4 E3B0B99B&#xA;  7B4DDA78 6FCD06FF CED2D5E9 DE22D914 7CC3C5FA D07B1AC0 F810A046 E1110294&#xA;  435D8C8E D98D1776 267F4A19 AE69DC19 82C18255 BA3BA6FD DBBA7795 3DC1622C&#xA;  45770203 010001A3 69306730 0F060355 1D130101 FF040530 030101FF 30140603&#xA;  551D1104 0D300B82 094F5757 44534543 532E301F 0603551D 23041830 1680145D&#xA;  75FE33FC 207F4677 776D4C37 D9739CA3 7501F730 1D060355 1D0E0416 04145D75&#xA;  FE33FC20 7F467777 6D4C37D9 739CA375 01F7300D 06092A86 4886F70D 01010405&#xA;  00038181 00B08206 69843C74 87C271CB 3A214EFB D5DD8FB3 D6D152D9 7741A520&#xA;  BEC7A10D 2B6690B7 F29DA32E 283E0E45 5EE1138A 8DC702B5 735599C9 71E1F2B5&#xA;  868012A6 0E803AEF D2DB7E10 6683F1A2 9F98A370 8CA7F3D0 F26E618D C748B0FC&#xA;  F5C447C2 A41C7333 AB621F84 E9251AD2 02EB4C25 0763F885 F5C884D2 CE3B4142&#xA;  0684AD2F BF&#xA;  quit&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;!&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;ip ssh time-out 5&#xA;ip ssh authentication-retries 5&#xA;ip ssh version 2&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA; no ip route-cache cef&#xA; no ip route-cache&#xA; no ip mroute-cache&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA; no switchport&#xA; ip address 192.168.10.2 255.255.255.252&#xA;!&#xA;interface GigabitEthernet0/3&#xA;!&#xA;interface GigabitEthernet0/4&#xA;!&#xA;interface GigabitEthernet0/5&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/6&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/7&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/8&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/9&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/10&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/11&#xA; switchport access vlan 20&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/12&#xA; switchport access vlan 20&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/13&#xA; switchport access vlan 20&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/14&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/15&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/16&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/17&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/18&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/19&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/20&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/21&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/22&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/23&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/24&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/1&#xA;!&#xA;interface GigabitEthernet1/2&#xA;!&#xA;interface GigabitEthernet1/3&#xA;!&#xA;interface GigabitEthernet1/4&#xA;!&#xA;interface TenGigabitEthernet1/1&#xA;!&#xA;interface TenGigabitEthernet1/2&#xA;!&#xA;interface Vlan1&#xA; description MANAGEMENT&#xA; ip address 10.1.1.2 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan10&#xA; description DATA&#xA; ip address 10.1.10.1 255.255.255.0&#xA;!&#xA;interface Vlan20&#xA; description INTERNET&#xA; ip address 10.1.20.1 255.255.255.0&#xA;!&#xA;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; network 192.168.10.0&#xA; no auto-summary&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 192.168.10.1&#xA;!&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; password pa55w0rd&#xA; logging synchronous&#xA; login&#xA;line vty 0 4&#xA; password pa55w0rd&#xA; login&#xA; transport input all&#xA;line vty 5 15&#xA; login&#xA; transport input none&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19240" LastEditorUserId="509" LastEditDate="2015-09-23T12:04:00.827" LastActivityDate="2022-03-13T02:12:41.917" Title="ping from router to the internet is ok but I can't access internet from swich" Tags="|cisco|routing|internet|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22749" PostTypeId="1" AcceptedAnswerId="22848" CreationDate="2015-09-23T12:59:49.693" Score="1" ViewCount="568" Body="&lt;p&gt;I have a Cisco router with a tunnel configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# sh ip int brief&#xA;FastEthernet0/1 192.168.1.1&#xA;Dialer1         1.2.3.4&#xA;Tunnel1         169.254.1.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Dialer1&lt;/code&gt; is a pppoe internet connection and &lt;code&gt;Tunnel1&lt;/code&gt; a VPN connection to another network - 172.16.1.0/24. Routes are configured for 192.168.1 and 172.16.1. Network is working as expected between these 2 networks, and between 192.168 and the internet (&lt;code&gt;ip nat outside&lt;/code&gt; on dialer1, inside on fa0/1, and &lt;code&gt;ip nat inside source list 192-168-1-0  dialer1 overload&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am unable to connect to 172.16.1 network from the router itself - the source address comes from the tunnel interface IP of 169.254.x.y. I could add a route for 169.254 on the remote network, but would rather want packets originating from the router to have the source address translated to 192.168.1.1. Is it possible to do this? &lt;/p&gt;&#xA;" OwnerUserId="18938" LastActivityDate="2015-09-28T10:04:04.533" Title="Translating to different addresses on a Cisco router based on destination" Tags="|cisco|nat|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22750" PostTypeId="1" CreationDate="2015-09-23T13:48:27.463" Score="1" ViewCount="332" Body="&lt;p&gt;In our environment, we have a Cisco 1841 which, among other things, performs DHCP services for a small manufacturing facility. We have 100 available DHCP addresses in the pool. That device connects to a Dell 2824, which serves our static devices across the location. Also connected to the Dell switch are several Cisco WAP4410N access points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our issue is that we can connect to our system wirelessly, but only if we put a static address into the adapter. Using DHCP, we can connect over Ethernet ONLY, but not over the WLAN. We do get a connection to the AP, but we get an APIPA address. 'show ip dhcp bindings' shows that I have only used about 40 of our 100 addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea why our devices cannot use DHCP over the WLAN? I'm stumped here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:I have since found out that DHCP is NOT working via Ethernet either, at least not consistently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2: Config posted below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;;WAP4410N Configuration File - Version: 2.0.4.2&#xA;;MAC address: 44:2B:03:7F:00:A6&#xA;;WPS PIN: 30978577&#xA;;The checksum: 855329  &#xA;&#xA;&#xA;[BASIC]&#xA;&#xA;Host_Name=HOSTNAME&#xA;&#xA;Device_Name=WAP4410N&#xA;&#xA;Language=en&#xA;&#xA;IP_settings=0 ;0:static; 1:automatic&#xA;&#xA;Ipv4_address=192.168.2.244&#xA;&#xA;Ipv4_subnet_mask=255.255.255.0&#xA;&#xA;IPv4_default_gateway=192.168.2.254&#xA;&#xA;IPv4_Primary_DNS=192.168.0.2&#xA;&#xA;IPv4_Secondary_DNS=0.0.0.0&#xA;&#xA;IPv6=0 ;0:disabled; 1:enabled&#xA;&#xA;Ipv6_address=&#xA;&#xA;Ipv6_prefix_length=0&#xA;&#xA;IPv6_default_gateway=&#xA;&#xA;IPv6_Primary_DNS=&#xA;&#xA;IPv6_Secondary_DNS=&#xA;&#xA;&#xA;&#xA;[Time]&#xA;&#xA;Time_setting=1 ;0: manually, 1:automatically&#xA;&#xA;Date=2015/09/23 ;yyyy/mm/dd&#xA;&#xA;Time=08:27:24 ;hh:mm:ss&#xA;&#xA;Time_zone=010-06:00 &#xA;&#xA;daylight_saving=0 ;0:disabled, 1:enabled&#xA;&#xA;User_Defined_NTP=0 ;0:disabled, 1:enabled&#xA;&#xA;User_NTP=&#xA;&#xA;&#xA;&#xA;[Setup_advanced]&#xA;&#xA;Force_Fast_Ethernet=0 ;0:disabled, 1:enabled&#xA;&#xA;Ethernet_Auto_Negotiation=1 ;0:disabled, 1:enabled&#xA;&#xA;Administrative_Port_Speed=0 ;0:10M, 1:100M, 2:1000M&#xA;&#xA;Administrative_Duplex_Mode=1 ;0:Half Duplex, 1:Full Duplex&#xA;&#xA;Bonjour=1 ;0:disabled, 1:enabled&#xA;&#xA;HTTP_Redirect=0 ;0:disabled, 1:enabled&#xA;&#xA;HTTP_Redirect_URL=&#xA;&#xA;802.1x_supplicant=0 ;0:disabled, 1:enabled&#xA;&#xA;Via_mac_authentication=0 ;0:disabled, 1:enabled&#xA;&#xA;Username=&#xA;&#xA;Password=&#xA;&#xA;&#xA;&#xA;[Wireless_Basic]&#xA;&#xA;Network_mode=7 ;0:Disable; 1: b only; 2: g only; 3: n only; 4: B/G mixed; 7:B/G/N mixed&#xA;&#xA;Channel=6 ; 0..14; 0: auto channel&#xA;&#xA;SSID1=HOSTNAME&#xA;&#xA;SSID1_broadcast=1 ;0:disabled, 1:enabled&#xA;&#xA;SSID2=&#xA;&#xA;SSID2_broadcast=0 ;0:disabled, 1:enabled&#xA;&#xA;SSID3=&#xA;&#xA;SSID3_broadcast=0 ;0:disabled, 1:enabled&#xA;&#xA;SSID4=&#xA;&#xA;SSID4_broadcast=0 ;0:disabled, 1:enabled&#xA;&#xA;&#xA;&#xA;[Radius_Server]&#xA;&#xA;Primary_radius_server=&#xA;&#xA;Primary_port_no=1812&#xA;&#xA;Primary_shared_secret=&#xA;&#xA;Secondary_radius_server=&#xA;&#xA;Secondary_port_no=1812&#xA;&#xA;Secondary_shared_secret=&#xA;&#xA;&#xA;&#xA;[Wireless_security_1]&#xA;&#xA;;for SSID1&#xA;&#xA;ssid=HOSTNAME&#xA;&#xA;isolation_between_SSID=1 ;0:disabled, 1:enabled&#xA;&#xA;security_mode=1 ;1: WEP, 2: WPA-Personal, 3: WPA2-Personal, 4: WPA2-Personal Mixed, 5: WPA-Enterprise,&#xA;&#xA;    6: WPA2-Enterprise, 7: WPA2-Enterprise Mixed, 8:RADIUS, 0: Disabled&#xA;&#xA;isolation_within_SSID=0 ;0:disabled, 1:enabled&#xA;&#xA;authentication_type=1 ;0:open system; 1:shared key&#xA;&#xA;encryption=64 ;64: 64 bit WEP, 128:128 bit WEP, 1: TKP, 2: AES, 3: AES+TKIP&#xA;&#xA;Default_Tx_key=1 ; 1..4&#xA;&#xA;key1=********** ;in Hex&#xA;&#xA;key2= ;in Hex&#xA;&#xA;key3= ;in Hex&#xA;&#xA;key4= ;in Hex&#xA;&#xA;PSK_key= ;in ASCII; The length of the key is from 8 to 64&#xA;&#xA;Key_renew=3600 ;in seconds&#xA;&#xA;&#xA;&#xA;[Wireless_security_2]&#xA;&#xA;;for SSID2&#xA;&#xA;ssid=&#xA;&#xA;isolation_between_SSID=1 ;0:disabled, 1:enabled&#xA;&#xA;security_mode=0 ;1: WEP, 2: WPA-Personal, 3: WPA2-Personal, 4: WPA2-Personal Mixed, 5: WPA-Enterprise,&#xA;&#xA;    6: WPA2-Enterprise, 7: WPA2-Enterprise Mixed, 8:RADIUS, 0: Disabled&#xA;&#xA;isolation_within_SSID=0 ;0:disabled, 1:enabled&#xA;&#xA;authentication_type=0 ;0:open system; 1:shared key&#xA;&#xA;encryption=0 ;64: 64 bit WEP, 128:128 bit WEP, 1: TKP, 2: AES, 3: AES+TKIP&#xA;&#xA;Default_Tx_key=0 ; 1..4&#xA;&#xA;key1= ;in Hex&#xA;&#xA;key2= ;in Hex&#xA;&#xA;key3= ;in Hex&#xA;&#xA;key4= ;in Hex&#xA;&#xA;PSK_key= ;in ASCII; The length of the key is from 8 to 63&#xA;&#xA;Key_renew=0 ;in seconds&#xA;&#xA;&#xA;&#xA;[Wireless_security_3]&#xA;&#xA;;for SSID3&#xA;&#xA;ssid=&#xA;&#xA;isolation_between_SSID=1 ;0:disabled, 1:enabled&#xA;&#xA;security_mode=0 ;1: WEP, 2: WPA-Personal, 3: WPA2-Personal, 4: WPA2-Personal Mixed, 5: WPA-Enterprise,&#xA;&#xA;    6: WPA2-Enterprise, 7: WPA2-Enterprise Mixed, 8:RADIUS, 0: Disabled&#xA;&#xA;isolation_within_SSID=0 ;0:disabled, 1:enabled&#xA;&#xA;authentication_type=0 ;0:open system; 1:shared key&#xA;&#xA;encryption=0 ;64: 64 bit WEP, 128:128 bit WEP, 1: TKP, 2: AES, 3: AES+TKIP&#xA;&#xA;Default_Tx_key=0 ; 1..4&#xA;&#xA;key1= ;in Hex&#xA;&#xA;key2= ;in Hex&#xA;&#xA;key3= ;in Hex&#xA;&#xA;key4= ;in Hex&#xA;&#xA;PSK_key= ;in ASCII; The length of the key is from 8 to 63&#xA;&#xA;Key_renew=0 ;in seconds&#xA;&#xA;&#xA;&#xA;[Wireless_security_4]&#xA;&#xA;;for SSID4&#xA;&#xA;ssid=&#xA;&#xA;isolation_between_SSID=1 ;0:disabled, 1:enabled&#xA;&#xA;security_mode=0 ;1: WEP, 2: WPA-Personal, 3: WPA2-Personal, 4: WPA2-Personal Mixed, 5: WPA-Enterprise,&#xA;&#xA;    6: WPA2-Enterprise, 7: WPA2-Enterprise Mixed, 8:RADIUS, 0: Disabled&#xA;&#xA;isolation_within_SSID=0 ;0:disabled, 1:enabled&#xA;&#xA;authentication_type=0 ;0:open system; 1:shared key&#xA;&#xA;encryption=0 ;64: 64 bit WEP, 128:128 bit WEP, 1: TKP, 2: AES, 3: AES+TKIP&#xA;&#xA;Default_Tx_key=0 ; 1..4&#xA;&#xA;key1= ;in Hex&#xA;&#xA;key2= ;in Hex&#xA;&#xA;key3= ;in Hex&#xA;&#xA;key4= ;in Hex&#xA;&#xA;PSK_key= ;in ASCII; The length of the key is from 8 to 63&#xA;&#xA;Key_renew=0 ;in seconds&#xA;&#xA;&#xA;&#xA;[Wireless_Connection_Control_1]&#xA;&#xA;;for SSID1&#xA;&#xA;Connection_Control=0 ;0: disabled, 1:local, 2: Radius&#xA;&#xA;Control_type=1 ;0: allowed the following local mac, 1: prevent the following local mac&#xA;&#xA;Mac_01=&#xA;&#xA;Mac_02=&#xA;&#xA;Mac_03=&#xA;&#xA;Mac_04=&#xA;&#xA;Mac_05=&#xA;&#xA;Mac_06=&#xA;&#xA;Mac_07=&#xA;&#xA;Mac_08=&#xA;&#xA;Mac_09=&#xA;&#xA;Mac_10=&#xA;&#xA;Mac_11=&#xA;&#xA;Mac_12=&#xA;&#xA;Mac_13=&#xA;&#xA;Mac_14=&#xA;&#xA;Mac_15=&#xA;&#xA;Mac_16=&#xA;&#xA;Mac_17=&#xA;&#xA;Mac_18=&#xA;&#xA;Mac_19=&#xA;&#xA;Mac_20=&#xA;&#xA;&#xA;&#xA;[Wireless_Connection_Control_2]&#xA;&#xA;;for SSID2&#xA;&#xA;Connection_Control=0 ;0: disabled, 1:local, 2: Radius&#xA;&#xA;Control_type=0 ;0: allowed the following local mac, 1: prevent the following local mac&#xA;&#xA;Mac_01=&#xA;&#xA;Mac_02=&#xA;&#xA;Mac_03=&#xA;&#xA;Mac_04=&#xA;&#xA;Mac_05=&#xA;&#xA;Mac_06=&#xA;&#xA;Mac_07=&#xA;&#xA;Mac_08=&#xA;&#xA;Mac_09=&#xA;&#xA;Mac_10=&#xA;&#xA;Mac_11=&#xA;&#xA;Mac_12=&#xA;&#xA;Mac_13=&#xA;&#xA;Mac_14=&#xA;&#xA;Mac_15=&#xA;&#xA;Mac_16=&#xA;&#xA;Mac_17=&#xA;&#xA;Mac_18=&#xA;&#xA;Mac_19=&#xA;&#xA;Mac_20=&#xA;&#xA;&#xA;&#xA;[Wireless_Connection_Control_3]&#xA;&#xA;;for SSID3&#xA;&#xA;Connection_Control=0 ;0: disabled, 1:local, 2: Radius&#xA;&#xA;Control_type=0 ;0: allowed the following local mac, 1: prevent the following local mac&#xA;&#xA;Mac_01=&#xA;&#xA;Mac_02=&#xA;&#xA;Mac_03=&#xA;&#xA;Mac_04=&#xA;&#xA;Mac_05=&#xA;&#xA;Mac_06=&#xA;&#xA;Mac_07=&#xA;&#xA;Mac_08=&#xA;&#xA;Mac_09=&#xA;&#xA;Mac_10=&#xA;&#xA;Mac_11=&#xA;&#xA;Mac_12=&#xA;&#xA;Mac_13=&#xA;&#xA;Mac_14=&#xA;&#xA;Mac_15=&#xA;&#xA;Mac_16=&#xA;&#xA;Mac_17=&#xA;&#xA;Mac_18=&#xA;&#xA;Mac_19=&#xA;&#xA;Mac_20=&#xA;&#xA;&#xA;&#xA;[Wireless_Connection_Control_4]&#xA;&#xA;;for SSID4&#xA;&#xA;Connection_Control=0 ;0: disabled, 1:local, 2: Radius&#xA;&#xA;Control_type=0 ;0: allowed the following local mac, 1: prevent the following local mac&#xA;&#xA;Mac_01=&#xA;&#xA;Mac_02=&#xA;&#xA;Mac_03=&#xA;&#xA;Mac_04=&#xA;&#xA;Mac_05=&#xA;&#xA;Mac_06=&#xA;&#xA;Mac_07=&#xA;&#xA;Mac_08=&#xA;&#xA;Mac_09=&#xA;&#xA;Mac_10=&#xA;&#xA;Mac_11=&#xA;&#xA;Mac_12=&#xA;&#xA;Mac_13=&#xA;&#xA;Mac_14=&#xA;&#xA;Mac_15=&#xA;&#xA;Mac_16=&#xA;&#xA;Mac_17=&#xA;&#xA;Mac_18=&#xA;&#xA;Mac_19=&#xA;&#xA;Mac_20=&#xA;&#xA;&#xA;&#xA;[VLAN_QoS]&#xA;&#xA;VLAN=0 ;0: disabled, 1:enabled&#xA;&#xA;Default_VLAN_ID=0 ;1..4094&#xA;&#xA;VLAN_Tag=0 ;0:untagged, 1: tagged&#xA;&#xA;AP_Management_VLAN=0 ;1..4094&#xA;&#xA;VLAN_tag_over_WDS=0 ;0: disabled, 1:enabled&#xA;&#xA;WDS_VLAN_List= ;a,b,...,&quot;a&quot; is a VLAN ID. Different IDs divided by &quot;,&quot;. 4 VLAN IDs should be set at most&#xA;&#xA;VLAN_ID_4_SSID1=0 ;1..4094&#xA;&#xA;Priority_4_SSID1=0 ;0..7&#xA;&#xA;WMM_4_SSID1=1 ;0: disabled, 1:enabled&#xA;&#xA;VLAN_ID_4_SSID2=0 ;1..4094&#xA;&#xA;Priority_4_SSID2=0 ;0..7&#xA;&#xA;WMM_4_SSID2=0 ;0: disabled, 1:enabled&#xA;&#xA;VLAN_ID_4_SSID3=0 ;1..4094&#xA;&#xA;Priority_4_SSID3=0 ;0..7&#xA;&#xA;WMM_4_SSID3=0 ;0: disabled, 1:enabled&#xA;&#xA;VLAN_ID_4_SSID4=0 ;1..4094&#xA;&#xA;Priority_4_SSID4=0 ;0..7&#xA;&#xA;WMM_4_SSID4=0 ;0: disabled, 1:enabled&#xA;&#xA;&#xA;&#xA;[Wireless_Advanced]&#xA;&#xA;802.11d=0 ;0: disabled, 1:enabled&#xA;&#xA;Country_Region=840 ;840: United States. It°Øs read only&#xA;&#xA;Channel_bandwidth=1 ;0: auto, 1: 20MHz, 2: 40MHz&#xA;&#xA;Guard_Interval=0 ;0: auto, 1: 400ns, 2: 800ns&#xA;&#xA;CTS_Protection_Mode=0 ;0: disable, 1: auto&#xA;&#xA;beacon_interval=100 ;20..1000&#xA;&#xA;DTIM_interval=1 ;1..255&#xA;&#xA;rts_threshold=2347 ;1..2347&#xA;&#xA;fragmentation_threshold=2346 ;256..2346&#xA;&#xA;Load_balance=0 ;0: disabled, 1:enabled&#xA;&#xA;Load_threshold_4_SSD1=&#xA;&#xA;Load_threshold_4_SSD2=&#xA;&#xA;Load_threshold_4_SSD3=&#xA;&#xA;Load_threshold_4_SSD4=&#xA;&#xA;&#xA;&#xA;[AP_Mode]&#xA;&#xA;AP_mode=0 ;0: Access Point, 1: WDS repeater, 2: WDS bridge, 3: Universal bridge, 4: Monitor&#xA;&#xA;MAC1=&#xA;&#xA;MAC2=&#xA;&#xA;MAC3=&#xA;&#xA;MAC4=&#xA;&#xA;Allow_WDS_repeater=0 ;0:disabled, 1: enabled&#xA;&#xA;Universal_repeater=0 ;0:disabled, 1: enabled&#xA;&#xA;Preferred_SSID= ;for universal bridge&#xA;&#xA;No_Security=0 ;1: view it as a rogue AP. 0: don°Øt&#xA;&#xA;No_in_Legal_AP_List=0 ;1: view it as a rogue AP. 0: don°Øt&#xA;&#xA;Legal_AP_List_entry_no=0 ;0..255&#xA;&#xA;Legal_AP=&#xA;&#xA;&#xA;&#xA;[Management]&#xA;&#xA;secret_shown=0 ;0: show clear text, 1: just show ********&#xA;&#xA;username=*&#xA;&#xA;AP_password=*&#xA;&#xA;HTTPS_Access=0 ;0:disabled, 1: enabled&#xA;&#xA;Wireless_Web_Access=0 ;0:disabled, 1: enabled&#xA;&#xA;Secure_Shell=0 ;0:disabled, 1: enabled&#xA;&#xA;SNMP=0 ;0:disabled, 1: enabled&#xA;&#xA;Contact=&#xA;&#xA;Device_Name=&#xA;&#xA;Location=&#xA;&#xA;Get_Community=&#xA;&#xA;Set_Community=&#xA;&#xA;Trap_Community=&#xA;&#xA;SNMP_Trusted_Any_Host=0 ;0:disabled, 1: enabled&#xA;&#xA;SNMP_Trusted_Host_start_IP=&#xA;&#xA;SNMP_Trusted_Host_range=0 ;0..255&#xA;&#xA;Trap_Destination=&#xA;&#xA;&#xA;&#xA;[Log]&#xA;&#xA;E-mail_alert=0 ;0:disabled, 1: enabled&#xA;&#xA;SMTP_server=&#xA;&#xA;Email_address_for_logs=&#xA;&#xA;Log_queue_length=0&#xA;&#xA;Log_time_threshold=0&#xA;&#xA;Syslog=0 ;0:disabled, 1: enabled&#xA;&#xA;Syslog_server_IP=&#xA;&#xA;Unathorized_login_attempt=0 ;0:no log, 1: log&#xA;&#xA;Authorized_Login=0 ;0:no log, 1: log&#xA;&#xA;System_error_message=0 ;0:no log, 1: log&#xA;&#xA;Configuration_changes=0 ;0:no log, 1: log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19242" LastEditorUserId="19242" LastEditDate="2015-09-23T14:33:23.013" LastActivityDate="2015-09-23T14:33:23.013" Title="Cisco 1841/WAP4410N Wireless Access Issue" Tags="|dhcp|ip|cisco-wireless|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22751" PostTypeId="2" ParentId="22749" CreationDate="2015-09-23T13:51:37.707" Score="2" Body="&lt;p&gt;NAT translates addresses from an inside interface to an outside interface. So packets coming from the router won't be translated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the other network already has an interface on 169.254.x.y, I don't think adding a route will help.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-09-23T13:51:37.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22752" PostTypeId="2" ParentId="22747" CreationDate="2015-09-23T13:56:14.210" Score="1" Body="&lt;p&gt;Here are your vlans interfaces configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan10&#xA; description DATA&#xA; ip address 10.1.10.1 255.255.255.0&#xA;&#xA;interface Vlan20&#xA;description INTERNET&#xA;ip address 10.1.20.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With ip address 10.1.20.1 and 10.1.10.1, then, i guess: &#xA;10.1.10.0/24 and 10.1.20.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in your access list, on the nat section, you only match one network, 10.0.0.0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list standard NATADDRESSES&#xA;permit 10.0.0.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thats it, 10.0.0.0/24 from 10.0.0.1 to 10.0.0.254, and not 10.1.10.0 and 10.1.20.0. I guess you need to change NATADDRESSES like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list standard NATADDRESSES&#xA; permit 10.1.10.0 0.0.0.255&#xA; permit 10.1.20.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2015-09-23T20:31:03.390" LastActivityDate="2015-09-23T20:31:03.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22753" PostTypeId="2" ParentId="22749" CreationDate="2015-09-23T14:20:11.720" Score="1" Body="&lt;p&gt;As @RonTrunk pointed out, NAT translates from an inside interface to an outside interface. The router can source lots of thing from interfaces with the correct commands.  You could create an access list of the addresses to translate, add a loopback as a inside interface in the access list, and try to source what you want translated from that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, some source commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip tftp source-interface Loopback0&#xA;ip ftp source-interface Loopback0&#xA;ip ssh source-interface Loopback0&#xA;ip tacacs source-interface Loopback0&#xA;ip domain lookup source-interface Loopback0&#xA;logging source-interface Loopback0&#xA;snmp-server trap-source Loopback0&#xA;ntp source Loopback0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-23T14:20:11.720" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22755" PostTypeId="1" AcceptedAnswerId="22757" CreationDate="2015-09-23T14:35:35.950" Score="3" ViewCount="2003" Body="&lt;p&gt;So our newly configured servers have uncovered some switch configuration issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In /etc/sysctl.conf we have the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;net.ipv4.conf.all.send_redirects = 0                    # CIS 4.1.2&#xA;net.ipv4.conf.default.send_redirects = 0                # CIS 4.1.2&#xA;net.ipv4.conf.all.accept_source_route = 0               # CIS 4.2.1&#xA;net.ipv4.conf.default.accept_source_route = 0           # CIS 4.2.1&#xA;net.ipv4.conf.all.accept_redirects = 0                  # CIS 4.2.2&#xA;net.ipv4.conf.default.accept_redirects = 0              # CIS 4.2.2&#xA;net.ipv4.conf.all.secure_redirects = 0                  # CIS 4.2.3&#xA;net.ipv4.conf.default.secure_redirects = 0              # CIS 4.2.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is good because it turns off ICMP redirect and uncovered an incorrectly configured switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant switch config is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure&#xA;vlan database&#xA;vlan 10,99,102&#xA;vlan routing 102 1&#xA;vlan routing 99 2&#xA;vlan routing 10 3&#xA;exit&#xA;hostname &quot;CloudSwitch3&quot;&#xA;stack&#xA;member 1 1&#xA;member 2 1&#xA;exit&#xA;ip address 10.10.10.12 255.255.255.0&#xA;ip routing&#xA;ip route 0.0.0.0 0.0.0.0 10.168.102.2&#xA;interface vlan 10&#xA;routing&#xA;ip address 10.10.102.1 255.255.255.0&#xA;exit&#xA;interface vlan 99&#xA;routing&#xA;ip address 10.168.99.1 255.255.255.0&#xA;exit&#xA;interface vlan 102&#xA;routing&#xA;ip address 10.168.102.1 255.255.255.0&#xA;ip rip&#xA;ip rip receive version both&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My route table is showing as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Network Address Subnet Mask Protocol    Next Hop Interface  Next Hop IP Address&#xA;0.0.0.0         0.0.0.0         Default vlan102 10.168.102.2&#xA;10.10.102.0     255.255.255.0   Local   vlan10  10.10.102.1&#xA;10.168.99.0     255.255.255.0   Local   vlan99  10.168.99.1&#xA;10.168.102.0    255.255.255.0   Local   vlan102 10.168.102.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now for the issue: My GW is setup to be 10.168.102.1 but the ICMP redirect from the router keeps staying to redirect it to 10.168.102.2 next time. This configuration works for the servers that are configured to accept the redirects, but doesn't for the ones that don't. ( we are experiencing slowness on those )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are the 10.168.102.xxx addresses getting told to route through the 10.168.101.2 server when (Local) VLAN 102 says to use 10.168.101.1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.168.101.2 is the failover switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way to address the issue?&lt;/p&gt;&#xA;" OwnerUserId="19244" LastActivityDate="2015-09-23T16:20:34.570" Title="ICMP Redirects uncovers routing issues" Tags="|cisco|routing|router|icmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22757" PostTypeId="2" ParentId="22755" CreationDate="2015-09-23T16:20:34.570" Score="2" Body="&lt;p&gt;This got pretty long so I'm just going to put the answer at the top instead of the bottom, read the whole thing if you want more background and to read a rant. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Fix and summary of the issue&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially the problem is that your pointing your default gateway to another device that is still local to the clients as it's default gateway which is causing asymmetric routing and making connection inconsistencies that the applications/hosts probably don't like much. You can turn on redirects on the router interface or the switch but that's still not going to change that you're sending your packets to one device and receiving them from another. To remidiate this you have a couple options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Segment off those two devices. You generally do not need two separate routing devices in an end network. Keep your transit upstream and keep your LANs clean as this will also help clear chatter that your servers don't need to hear (as much as they love receiving RIP updates)&lt;/li&gt;&#xA;&lt;li&gt;An exception to this would be to configure the switch and the router to have some sort of first hop redundancy protocol (VRRP,GLBP,HSRP,etc.) the caveat with this is that you would need an identical next hop (or equal cost way to reach the destination) and be sure to specify the master and why it's priority would decrement to ensure traffic paths.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The just of it is that you need to create boundaries in order to segment traffic and control where the decisions to send traffic is being made. How it is now with two possible routing devices, it's leading straight down the road to a lack of security controls and irregular traffic patterns. I would really suggest setting a layer 3 transit up behind the scene to reach between eachother (possibly just take the IP addresses off your switch if the router handle it). That way devices have one exit, and that one exit leads to how everything is going to reach everything else, giving you central control and simplifying troubleshooting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ANALYSIS AND RCA OF ISSUE FROM GIVEN OUTPUTS&lt;/strong&gt;&#xA;Since both the Gateway and the Gateway's next hop are both on the same LAN as your end devices, the redirect is there to let them know they no longer need to forward traffic to them since there is a more direct route available for them to use (even if you don't want them to be using it, a network device will still see it as a better option as it's one less hop the end device would have to take)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This essentially creates local asymmetric routing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Path out w/o ICMP-REDIR:(SER-&gt;RTR-&gt;SW-&gt;NEWNET)&lt;br&gt;&#xA;Return Path:(NEWNET-&gt;RTR-&gt;SER)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the path that is taken every time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where as the ones that do accept the redirects get a temporary route statement in their table, once that times out they forward to the default gateway again, who proceeds to give them another redirect. How everything is taking an expected path so it is happy:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st Attempt out: (SER-&gt;RTR|| Use this route instead)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Path out ICMP-REDIR: (SER-&gt;SW-&gt;NEWNET) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Return Path:(NEWNET-&gt;RTR-&gt;SER)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you are dealing with things that have connection tables/states, applications that are expecting certain consistencies and possibly even source based routing on your hosts and you locally have asymmetric routing, thing will either kinda of limp along somehow or they will completely break. Neither one is what you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good analogy would be if you invited your SO over and told her to pick up some love tubes on the way, you to the door and make sure the mood is right in the lovepad you open the door with eyes closed, lips puckered and you're handed your condoms, it's not your girlfriend handing them to you though, it's some weird stranger who just happened to get them for you after hearing that you wanted them, you'd probably be a bit weirded out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The redirect would be the equivalent of you SO telling you that they wouldn't be able to make it there tonight but they have a friend in the area to help us out and get what we need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SECURITY CONSIDERATIONS OF REDIRECTS AND MULTIPLE L3 DEVICES IN ACCESS LAN&lt;/strong&gt;&#xA;If you decide you're going to put an access list on the switch because you don't want it to access XYZ server, well that's cool, I can just change my gateway to the other device that routes making that a completely null point (assuming they both know how to get there). The reason I'm bringing this up is because generally when I run across this happening it's because someone decided they were going to put their firewall on the network as the exit point, but then they put in a layer 3 switch with an IP in every network and that's the default gateway. It completely voids the fact that you have a firewall, because the switch is local to everything, I don't need to have my access to internal resources inspected and passed, I just go through the switch. This may not be the case for what your doing but it gets the &quot;you should have rigid boundaries&quot; point across. And you NEED to turn off redirects everywhere unless you have some reason that I have yet to hear. If you need to get to a specific host/subnet, add a static route on your host instead of dynamically learning it from an unsecured protocol, you're opening yourself up to DOS from route poisoning and MITM attacks. Anyone can spoof an ICMP redirect, and like when those redirects are sent it's just that device guessing what it should be based on what's in it's table, which might be completely wrong if it was from a reconfigured router advertisement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have three user LANs put that on one switch have the default gateway for that switch be your firewall/router in a separate transit network defined as a separate zone. Do the same for each border you have and make sure they all go through one place that controls access to resources between them. &lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2015-09-23T16:20:34.570" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="22758" PostTypeId="1" AcceptedAnswerId="22759" CreationDate="2015-09-23T16:47:19.980" Score="7" ViewCount="6990" Body="&lt;p&gt;We've received a /48 allocation from ARIN, and want to advertise smaller blocks from different sites in our organization.  I tried advertising a /56 from each site, but ISP is telling me they won't advertise anything smaller than a /48.  So each site would have to have its own /48.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone else run into a similar issue with their ISP?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="8499" LastEditDate="2019-01-05T03:33:04.613" LastActivityDate="2019-01-05T03:33:04.613" Title="Smallest IPv6 block advertised?" Tags="|routing|ip|bgp|ipv6|internet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22759" PostTypeId="2" ParentId="22758" CreationDate="2015-09-23T16:49:47.557" Score="10" Body="&lt;p&gt;Yes. Nobody will advertise any network smaller than a /48.  The same thing is in IPv4; no ISP will advertise any network smaller than a /24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is the sheer number of routes that would generate on the Internet by advertising networks smaller than a /48.  Even at /48 with the current global address range of 2000::/3, that translates to 35,184,372,088,832 possible routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, IANA had a rule that nobody (even individuals) should get networks smaller than /48.  The ISPs eventually overruled that for individuals, giving them /56.  Each site is supposed to have at least a /56, and a company gets at least a /48 which the company can advertise.  If you wish to advertise individual sites, they each need a /48 (or a /56 out of separate /48s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can go to the RIR and get a smaller mask.  For instance, we got a /32 from each RIR.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-23T17:03:47.913" LastActivityDate="2015-09-23T17:03:47.913" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22760" PostTypeId="1" AcceptedAnswerId="22761" CreationDate="2015-09-23T17:26:04.280" Score="1" ViewCount="827" Body="&lt;p&gt;I have a windows server that's on the domain which has been put in a DMZ. All traffic from the internal network is allowed into the DMZ, but everything initiated from the DMZ heading in is blocked. I've recent installed a backup agent on the DMZ server that needs to regularly check in. I know how to open the appropriate ports for that check in to happen. The problem being that the DMZ server cannot resolve the address of the internal backup server, in order to check in. What is the best practice here? Should I open up my internal dns server to my dmz?&lt;/p&gt;&#xA;" OwnerUserId="19248" LastActivityDate="2015-09-23T17:29:52.393" Title="internal dns for dmz server?" Tags="|firewall|dns|" AnswerCount="1" CommentCount="5" ClosedDate="2015-09-24T04:24:00.620" ContentLicense="CC BY-SA 3.0" />
  <row Id="22761" PostTypeId="2" ParentId="22760" CreationDate="2015-09-23T17:29:52.393" Score="0" Body="&lt;p&gt;That's one way.  Another would be to place the IP address of the backup server in the server's host file so that it doesn't need to do a DNS lookup.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-23T17:29:52.393" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22765" PostTypeId="2" ParentId="22626" CreationDate="2015-09-23T18:47:43.160" Score="0" Body="&lt;p&gt;This issue was resolved by adding a return route on the firewall to the 10.100.68.0 network. Not certain that this was the best solution. But, the vlan no has an Internet connection.&lt;/p&gt;&#xA;" OwnerUserId="19136" LastActivityDate="2015-09-23T18:47:43.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22766" PostTypeId="1" AcceptedAnswerId="22767" CreationDate="2015-09-23T20:05:33.893" Score="2" ViewCount="4578" Body="&lt;p&gt;I had a question about a vlan I accidentally added a port to. I have a cisco 2960x 48 port switch. I entered the incorrect port and added it to our wireless vlan. The port is a trunked port to my router in the MDF. I entered the following command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw1(config-if)#switchport access vlan 12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now I get the following from &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw1#show run inter gi1/0/49&#xA;&#xA;interface GigabitEthernet1/0/49&#xA; description -&amp;gt;MDF-RT01&#xA; switchport access vlan 12&#xA; switchport mode trunk&#xA; logging event spanning-tree&#xA; srr-queue bandwidth share 1 50 30 20&#xA; srr-queue bandwidth shape 5 0 0 0&#xA; priority-queue out &#xA; mls qos trust dscp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to remove the vlan 12 from the config without disallowing it across the trunk. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;my only idea is to use the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw1(config-if)#no switchport access vlan 12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any advice?&lt;/p&gt;&#xA;" OwnerUserId="19249" LastEditorUserId="8499" LastEditDate="2019-01-04T06:03:53.790" LastActivityDate="2019-01-04T06:03:53.790" Title="How do I remove a vlan from a trunked port" Tags="|cisco|switch|vlan|cisco-commands|trunk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22767" PostTypeId="2" ParentId="22766" CreationDate="2015-09-23T20:10:12.287" Score="5" Body="&lt;p&gt;In Cisco devices you can do the command with &lt;code&gt;no&lt;/code&gt; in front of it: &lt;code&gt;no switchport access vlan 12&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Putting the access VLAN on a trunk port does nothing unless the trunk goes down and the port reverts to an access port.  You have it nailed up as a trunk port.  The access VLAN statement is doing nothing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-23T20:10:12.287" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22768" PostTypeId="1" AcceptedAnswerId="22819" CreationDate="2015-09-23T20:17:20.600" Score="2" ViewCount="88" Body="&lt;p&gt;I've looked all over and can not find a for sure answer to this. Can you insert stacking modules into a Netgear GSM7252PS while the switch is still powered on? This switch is located in a production environment so downtime is hard to come by. &lt;/p&gt;&#xA;" OwnerUserId="19139" LastActivityDate="2015-09-26T11:08:01.547" Title="Add stacking modules to powered on GSM7252PS" Tags="|stacking|netgear-prosafe|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22769" PostTypeId="2" ParentId="22766" CreationDate="2015-09-24T02:20:27.780" Score="-1" Body="&lt;p&gt;Not exactly an answer, but on IOS you define a vlan as &quot;native&quot; if you want it to go out a trunkport not dot1q tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the above comments have stated, removing the access statement should be harmless and is good housekeeping.&lt;/p&gt;&#xA;" OwnerUserId="19252" LastActivityDate="2015-09-24T02:20:27.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22770" PostTypeId="1" AcceptedAnswerId="43206" CreationDate="2015-09-24T03:50:22.377" Score="1" ViewCount="4268" Body="&lt;p&gt;I would like to give brief background, Please go through the below details:-&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Palo Alto firewalls have bug for Software version 5.0.12 (Confirmed by PA TAC team)&lt;/li&gt;&#xA;&lt;li&gt;This bug will not hamper the user traffic but potentially may cause outage resulting in isolation&lt;/li&gt;&#xA;&lt;li&gt;As per PA, The firewalls those have uptime of more than 365 days will loose their configuration due to this bug&lt;/li&gt;&#xA;&lt;li&gt;Hence PA team have suggested firewall reboot as a work around and later to upgrade the firewall to latest version&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hence as per PA TAC teams recommendation, We have rebooted one of the firewall but have lost the management for the same. If someone have faced/facing this issue then would really appreciate response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot and have a great day ahead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rgds // Rounak&lt;/p&gt;&#xA;" OwnerUserId="17487" LastEditorUserId="17487" LastEditDate="2016-02-17T18:24:00.547" LastActivityDate="2017-08-13T11:46:42.033" Title="Unable to login palo alto firewall post rebooting the device!" Tags="|firewall|palo-alto|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="22772" PostTypeId="2" ParentId="22768" CreationDate="2015-09-24T10:00:30.647" Score="1" Body="&lt;p&gt;I did it several time in the past, without trouble, running image 8.0.3.34.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course there's always a risk that something goes wrong, so you have to assess the impact of a (unlikely) failure versus the impact of a planned downtime.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-09-24T10:00:30.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22774" PostTypeId="2" ParentId="22326" CreationDate="2015-09-24T14:05:36.437" Score="2" Body="&lt;p&gt;I found the answer by myself: &lt;br&gt;&#xA;If you want to create a failover between two Routers with the &lt;br&gt;&#xA;bird internet routing daemon you need to follow the next steps: &lt;br&gt;&lt;br&gt;&#xA;1. Every router must be connected to an ISP: means 1 Router to 1 ISP &lt;br&gt;&#xA;2. Form peers (BGP neighbor, eBGP) between your AS and the ISPs' AS&lt;br&gt;&#xA;3. Form a peer (iBGP) between both of your Routers&lt;br&gt;&#xA;4. Add a preference (highest preference wins)&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example config: &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# example ID, change at R2, e.g. 144.233.0.2&#xA;router id 144.233.0.1; &#xA;debug protocols all;&#xA;&#xA;# filtering routes&#xA;function avoid_martians() &#xA;prefix set martians; &#xA;{   &#xA;martians = [ 169.254.0.0/16+, 172.16.0.0/12+, 192.168.0.0/16+, 10.0.0.0/8+, 0.0.0.0/0 ];&#xA;&#xA;  # Avoid RFC1918 and similar networks   &#xA;  if net ~ martians then return false;&#xA;&#xA;  return true; &#xA;  }&#xA;&#xA;filter bgp_in {&#xA;        if ! (avoid_martians())&#xA;                then reject;&#xA;        accept; &#xA;       }&#xA;&#xA;# tell BGP about your routes to your systems&#xA;# change to 144.233.0.3 at R2&#xA;protocol static {&#xA;        route 144.233.0.0/22 via 144.233.0.2; &#xA;        }&#xA;&#xA;protocol kernel {&#xA;        learn;&#xA;        scan time 20;&#xA;        import filter bgp_in;&#xA;        export all; &#xA;       }&#xA;&#xA;protocol device {&#xA;        scan time 10; &#xA;        }&#xA;&#xA;&#xA;protocol bgp iBGP_INSTANCE {&#xA;        local as 500000;                # local AS&#xA;        neighbor 144.233.0.3 as 500000; # iBGP peering to R2, change to 144.233.0.2 at R2 &#xA;        keepalive time 5;               # keepalive timer&#xA;        graceful restart;                    &#xA;        import filter bgp_in;&#xA;        export all;&#xA;        preference 150;                 # highest preference &quot;wins&quot;, 100 at R2&#xA;        direct;&#xA;        gateway direct; &#xA;        }&#xA;&#xA;protocol bgp eBGP_INSTANCE {&#xA;        local as 500000;                &#xA;        neighbor 155.0.0.3 as 102;      # eBGP peering to ISP1, change at R2&#xA;        direct;                         &#xA;        keepalive time 5;               &#xA;        graceful restart;               &#xA;        import filter bgp_in;&#xA;        export all;&#xA;        hold time 10;&#xA;        preference 150;                # highest preference &quot;wins&quot;, 100 at R2&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;The config above creates two BGP instances. &lt;br&gt;&#xA;One for the internal BGP (same AS as the other Router) and one external BGP (an other AS as the other Router). &lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I commented in the config, the Router with the highest preference will be the &quot;Master Router&quot;. The traffic now flows through R1 to ISP1. &lt;br&gt;&#xA;But what if R1 doesn't get any update and/or keepalive message from the ISP? &lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer is simple: &lt;br&gt;&#xA;R1 doesn't get any update from ISP1. Means, there is no route to the destination. &lt;br&gt;&#xA;Now that R1 and R2 has formed a peer (iBGP), R1 gets updates from R2. &lt;br&gt;&#xA;This means now that R1 has to send every traffic from below to R2 who sends it to the ISP2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;//edit: corrected typos&lt;/p&gt;&#xA;" OwnerUserId="14081" LastEditorUserId="14081" LastEditDate="2018-04-17T12:08:41.357" LastActivityDate="2018-04-17T12:08:41.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22775" PostTypeId="1" AcceptedAnswerId="22776" CreationDate="2015-09-24T14:10:46.857" Score="3" ViewCount="3150" Body="&lt;p&gt;I do traceroute in my router and I found result like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    traceroute to 114.0.36.130, 30 hops max, 40 byte packets&#xA;  1  114.0.17.30 (114.0.17.30)    3.49 ms  14.2 ms  2.65 ms &#xA;  2  114.0.27.1 (114.0.27.1)    4.30 ms  3.84 ms  6.63 ms &#xA;  3  114.0.1.213 (114.0.1.213)    9.38 ms  8.63 ms  10.2 ms &#xA;  4  114.0.12.110 (114.0.12.110)    5.19 ms &#xA;  4  114.0.2.38 (114.0.2.38)    4.49 ms &#xA;  4  114.0.12.110 (114.0.12.110)    4.68 ms&#xA;  5  114.0.34.33 (114.0.34.33)    4.58 ms  4.77 ms&#xA;  5  114.0.33.194 (114.0.33.194)    6.41 ms &#xA;  6  114.0.32.130 (114.0.32.130)    4.82 ms &#xA;  6  114.0.34.14 (114.0.34.14)    4.83 ms &#xA;  6  114.0.33.198 (114.0.33.198)    6.56 ms &#xA;  7  114.0.36.130 (114.0.36.130)    6.74 ms  17.0 ms  6.09 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the result, I found there is some hop is same but destination ip is different. Could you help me to know about this issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="14483" LastActivityDate="2015-09-25T02:54:44.607" Title="trace route result same hop but different destination ip" Tags="|traceroute|network-discovery|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22776" PostTypeId="2" ParentId="22775" CreationDate="2015-09-24T14:38:03.997" Score="3" Body="&lt;p&gt;The reason for that result on a trace is that, some ISP, does load balance in his Autonomus System, thats it: same destination across diferent ways. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the reason that you looks, in the same hop, ex: 4, 5 and 6, that one packet goes hrough every one of the links that can reach the destination.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-24T14:38:03.997" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22777" PostTypeId="1" AcceptedAnswerId="22779" CreationDate="2015-09-24T17:40:34.587" Score="2" ViewCount="119" Body="&lt;p&gt;Currently I have experienced collisions and packet loss on an outer routing switch (1-2% from the States and above 6% when tested from Europe). In a basic way infrastructure looks like &#xA;&lt;a href=&quot;https://i.stack.imgur.com/iM0fu.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iM0fu.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where outer switch is Netgear DS524 (previously some Linksys). NSA TS and NSA HA are Sonciwall 2400 family. Internet test gateway and WiFi are network devices before a firewall (a PC and a wireless guest AP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tested if there are packet loss on VLANs behind a firewall but all work as should. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can cause those packet loss on that outer switch? Any good suggestions for a hardware replacement (up to 8 ports, rack mountable)?&lt;/p&gt;&#xA;" OwnerUserId="19263" LastActivityDate="2015-09-24T17:50:02.953" Title="Outer routing switch - collisions and packet loss" Tags="|routing|switch|packet-loss|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22778" PostTypeId="2" ParentId="22503" CreationDate="2015-09-24T17:46:08.617" Score="3" Body="&lt;p&gt;It is correct to say that each of that card, DPC,DPCe and MPC provides packet forwarding engines. Everyone of this card uses this mechanism to forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Several types of DPCs are available. Each DPC includes either two or four Packet Forwarding Engines. Each Packet Forwarding Engine enables a throughput of 10 Gbps.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(http://www.juniper.net/techpubs/en_US/release-independent/junos/topics/concept/mx960-description.html)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-24T17:46:08.617" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22779" PostTypeId="2" ParentId="22777" CreationDate="2015-09-24T17:48:06.747" Score="2" Body="&lt;p&gt;The Netgear DS524 is a hub, not a switch.  Collisions are part of life with hubs.  Switches separate collision domains per port, while hubs do not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hubs are layer-1 devices that constitute a single connection for all ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches are layer-2 devices that have separate connections for each port.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-24T17:50:02.953" LastActivityDate="2015-09-24T17:50:02.953" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="22783" PostTypeId="2" ParentId="19484" CreationDate="2015-09-24T20:39:24.613" Score="1" Body="&lt;p&gt;1: Port gi0/3 seems to be shut. You don´t be able to transmit traffic across him.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2: Do you have configured the two vlans with the two IPs in your Server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3: You don´t be able to ping the vlanif 98 unless you assign an access port to that vlan and connect one pc with an IP on that network, or had configured on the right way the 2 vlan interfaces on your server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way you said that vlanif 98 connect sometimes, look that switch seems a flapping port assigned to that vlan. The only way vlanif will up, is that at least, one port must belong to that vlan&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NEEDED:&#xA;Can you put the configuration of your server??&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-24T20:39:24.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22785" PostTypeId="1" CreationDate="2015-09-25T00:51:15.590" Score="4" ViewCount="1137" Body="&lt;p&gt;This is my first question on forums at all. I work as a network support engineer and I have a little issue at work and I would really appreciate advice from you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cannot access the url www.reach2.org from customer side (from every other net site is available).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping to the site succeeded with the source of the LAN interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;zare@cet-edgware&amp;gt; ping 95.142.154.194 source 185.20.63.197                     &#xA;PING 95.142.154.194 (95.142.154.194): 56 data bytes&#xA;64 bytes from 95.142.154.194: icmp_seq=0 ttl=57 time=3.176 ms&#xA;64 bytes from 95.142.154.194: icmp_seq=1 ttl=57 time=3.363 ms&#xA;64 bytes from 95.142.154.194: icmp_seq=2 ttl=57 time=3.304 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Traceroute to the site from source of the LAN of the CPE (juniper) fails.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;zare@cet-edgware&amp;gt; traceroute 95.142.154.194 source 185.20.63.197&#xA;traceroute to 95.142.154.194 (95.142.154.194) from 185.20.63.197, 30 hops max, 40 byte packets&#xA; 1  172.21.2.238 (172.21.2.238)  2.699 ms  3.284 ms  3.734 ms&#xA; 2  195.66.224.109 (195.66.224.109)  4.163 ms  3.451 ms  3.734 ms&#xA; 3  195.66.225.228 (195.66.225.228)  3.932 ms  3.841 ms  3.564 ms&#xA; 4  185.52.26.134 (185.52.26.134)  3.991 ms  3.853 ms  3.913 ms&#xA; 5  185.52.26.185 (185.52.26.185)  5.343 ms  11.915 ms  5.004 ms&#xA; 6  185.52.26.180 (185.52.26.180)  7.053 ms  5.392 ms  12.536 ms&#xA; 7  * * *&#xA; 8  * * *&#xA; 9  * * *&#xA;10  * * *&#xA;^C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Traceroute to every other site failes (except to google).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only IP address that a traceroute can be obtained is from Google. No other site has been successful.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;darkoj@cet-edgware&amp;gt; traceroute 8.8.8.8 source 185.20.63.197 no-resolve&#xA;traceroute to 8.8.8.8 (8.8.8.8) from 185.20.63.197, 30 hops max, 40 byte packets&#xA; 1  172.21.2.238  3.081 ms  8.896 ms  3.341 ms&#xA; 2  149.6.2.198  3.179 ms  3.354 ms  2.833 ms&#xA; 3  149.6.2.197  3.777 ms  3.601 ms  3.365 ms&#xA; 4  130.117.51.210  9.562 ms  3.674 ms  3.747 ms&#xA; 5  149.14.8.150  3.756 ms  3.372 ms  3.161 ms&#xA; 6  216.239.47.23  47.197 ms 64.233.174.213  4.311 ms 64.233.174.219  10.453 ms&#xA; 7  216.239.47.101  4.202 ms 72.14.234.81  3.755 ms 209.85.245.199  5.016 ms&#xA; 8  8.8.8.8  4.376 ms  3.618 ms  3.766 m&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I advised them to change the DNS to google's but no help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I advised them to lower the MTU MSS on the device that sends the request, they advised that they lowered MTU on the server down to 1300 and same again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that it is MTU/MSS issue.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you advise why ping succeeds and traceroute fails?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need any additional info please ask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice will be helpful and appreciated.&lt;/p&gt;&#xA;" OwnerUserId="19270" LastEditorUserId="8499" LastEditDate="2015-09-25T01:05:16.673" LastActivityDate="2015-09-25T05:01:51.680" Title="Cannot access certain web page. Ping succeded traceroute didn't" Tags="|ethernet|juniper|ping|dns|traceroute|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22786" PostTypeId="2" ParentId="22785" CreationDate="2015-09-25T01:13:28.670" Score="2" Body="&lt;p&gt;Ping uses ICMP, but traceroute doesn't necessarily use ICMP so different results are not necessarily unexpected.  Some OSes use ICMP and some use something else like UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The traceroute seems to stop in the 185.52.26.xxx network on its way to the next network.  Who owns that network, the ISP?  It would be beneficial to have the owner of that network see what is happening since that is where the traceroute is failing.  The network to which you are trying to trace could be blocking the traceroute, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both ping and traceroute use small packets, so the odds of an MTU problem are fairly small.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice that the trace to Google goes a completely different route.  There is some sort of routing problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what it's worth, I &lt;em&gt;can't&lt;/em&gt; ping or trace to the website, but I &lt;em&gt;can&lt;/em&gt; load it in my browser.  That has everything to do with my router configuration.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-25T01:41:08.997" LastActivityDate="2015-09-25T01:41:08.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22788" PostTypeId="2" ParentId="22775" CreationDate="2015-09-25T02:54:44.607" Score="0" Body="&lt;p&gt;I don't quite understand what you mean by &quot;some hop is same but destination ip is different&quot;? The destination IP in your case is &lt;code&gt;114.0.36.130&lt;/code&gt;, and this is the last hop. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On different runs of traceroute to a destination, you can certainly see different paths to that destination. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, the following behavior is common - multiple routers replying to the same probe TTL packet. This usually is the case when the routers belong to the same ISP. Why they do it? My guess is that the ISP does this for load balancing etc, as Orlando pointed out, or perhaps sometimes due to a poorly configured network! &lt;/p&gt;&#xA;" OwnerUserId="4094" LastActivityDate="2015-09-25T02:54:44.607" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22789" PostTypeId="2" ParentId="22785" CreationDate="2015-09-25T03:23:26.557" Score="2" Body="&lt;p&gt;I was able to ping and traceroute to your destination (&lt;code&gt;95.142.154.194&lt;/code&gt;). I  tried the default UDP traceroute, and it failed. Some routers along the path are perhaps filtering ICMP/UDP messages. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ICMP traceroute works:  &lt;code&gt;traceroute -I 95.142.154.194&lt;/code&gt;. I suspect that either &lt;code&gt;185.52.26.180&lt;/code&gt; network or &lt;code&gt;95.142.154.194&lt;/code&gt; network is configured to filter ICMP/UDP packets, and that's the reason traceroute was initially failing. (FYI - the immediate next hop after &lt;code&gt;185.52.26.180&lt;/code&gt; is &lt;code&gt;95.142.154.194&lt;/code&gt; - this tells me there is some configuration problem in either of those networks)&lt;/p&gt;&#xA;" OwnerUserId="4094" LastActivityDate="2015-09-25T03:23:26.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22790" PostTypeId="2" ParentId="22785" CreationDate="2015-09-25T05:01:51.680" Score="2" Body="&lt;p&gt;A ping/traceroute is a good test to run, but may not provide uselful results (as with your case here).  I do see that the last IP address before the trace drops (&lt;code&gt;185.52.26.180&lt;/code&gt;) and the IP of the web server (&lt;code&gt;95.142.154.194&lt;/code&gt;) belong to the same organization (Paragon Internet Group), But your successful pings prove that there isn't a routing issue anywhere in transit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try a higher level test as ping/traceroutes don't equate to trying to pull up a web page. Run &lt;code&gt;telnet 95.142.154.194 80&lt;/code&gt; or &lt;code&gt;telnet 95.142.154.194 443&lt;/code&gt; to see if traffic can reach your destination IP &lt;em&gt;and&lt;/em&gt; port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that other users are able to reach this site, and your other networks are able to reach this site, I would look closer on the CPE side for anything that may be blocking web traffic to this address.&lt;/p&gt;&#xA;" OwnerUserId="19273" LastActivityDate="2015-09-25T05:01:51.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22791" PostTypeId="2" ParentId="19248" CreationDate="2015-09-25T05:17:54.630" Score="1" Body="&lt;p&gt;You need to create a static NAT rule that translates your internal hosts &lt;em&gt;to&lt;/em&gt; their external equivalents.&#xA;Use the following commands (add in your public IP):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static (inside,outside) TCP *ExternalIP* 5902 10.0.1.81 5902 netmask 255.255.255.255&#xA;static (inside,outside) TCP *ExternalIP* 5903 10.0.1.82 5903 netmask 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then create the appropriate ACL rules to allow this traffic.&lt;/p&gt;&#xA;" OwnerUserId="19273" LastActivityDate="2015-09-25T05:17:54.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22794" PostTypeId="1" CreationDate="2015-09-25T09:08:38.463" Score="1" ViewCount="537" Body="&lt;p&gt;I have a set of broadcasting devices that are using multicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the configuration :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L3 SWITCH#&#xA;igmp-snooping&#xA;interface Vlan-interface280&#xA; description BroadcastDevice&#xA; ip address x.x.x.x 255.255.255.0&#xA; pim sm&#xA; igmp enable&#xA; igmp version 3&#xA;&#xA;interface Vlan-interface206&#xA; description Subscribers&#xA; ip address x.x.x.x 255.255.254.0&#xA; igmp enable&#xA; igmp version 3&#xA;interface Vlan-interface226&#xA; description Not-Subscribers&#xA; ip address x.x.x.x 255.255.254.0&#xA; igmp enable&#xA; igmp version 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am running IGMP Snooping to make sure multicast traffic is not forwarded to every port in my network.&#xA;Here is a sample from my Access Switch for the relevant vlans :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L2 ACCESS SWITCH#&#xA;igmp-snooping&#xA;vlan 206&#xA; name Subscribers&#xA; igmp-snooping enable&#xA; igmp-snooping version 3&#xA;vlan 226&#xA; name Not-Subscribers&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This works well. VLAN 206 users are subscribing to the source flows from VLAN 241 and VLAN 226 are not receiving anything multicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wish to filter multicast on my WIFI vlans the same way I did with the VLAN 206.&#xA;Here is how I tried to do it :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L3 SWITCH#&#xA;interface Vlan-interface250&#xA; description WIFI-ADMIN&#xA; ip address x&#xA; igmp enable&#xA; igmp version 3&#xA;interface Vlan-interface252&#xA; description WIFI-SSID-CORP&#xA; ip address x&#xA; igmp enable&#xA; igmp version 3&#xA;vlan 250&#xA; igmp-snooping enable&#xA; igmp-snooping version 3&#xA;vlan 252&#xA; igmp-snooping enable&#xA; igmp-snooping version 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VLAN 250 is the vlan in which my clients are located when they authenticate on the controller.&#xA;VLAN 252 is the controller VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this configuration, my WIFI clients are still able to subscribe to multicast flows, which then brings my WiFi network down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone has any tips on what I am missing here ? Should I look in the controller configuration directly? It's a HP MSM 760.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="3484" LastEditorUserId="3484" LastEditDate="2015-09-25T09:20:48.763" LastActivityDate="2015-09-25T20:31:50.983" Title="Filter multicast traffic to WiFi SSID" Tags="|ieee-802.11|multicast|hp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22795" PostTypeId="2" ParentId="22794" CreationDate="2015-09-25T10:00:48.757" Score="2" Body="&lt;p&gt;There is an option on the controllers to enable IGMP snooping helpers that should help. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the issue is generally that Multicast is sent at the lowest packet rate available. Unlike an Aruba system, you can't get the controller to manage multicasts as far as I am aware.&lt;/p&gt;&#xA;" OwnerUserId="865" LastActivityDate="2015-09-25T10:00:48.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22802" PostTypeId="1" CreationDate="2015-09-25T12:39:06.930" Score="3" ViewCount="683" Body="&lt;p&gt;Here is network schema:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.2.200 - Switch layer 2 ---|                     |--X0 LAN 192.168.2.254&#xA;                                  |---Switch layer 3 ---|&#xA;10.50.40.40 --- Swtich layer 2 ---|                     |--X6 LAN 10.50.60.1&#xA;                                                        |-- WAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The layer-3 switch has multiple IP addresses: 10.50.40.1, 10.50.60.6, and 192.168.2.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default route for the layer-3 switch is 0.0.0.0 for gateway 192.168.2.254.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three VLANs on the the layer-3 switch, and routing is enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN1 (192.168.2) is the default VLAN. There were 3 switches. I changed those switches to make VLANs, change network addressing, and delete all 192.168.2 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other VLANs, but for clarity I show only one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I've got these issues:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When machine 192.168.2.200 has 192.168.2.254 for its gateway, it can get&#xA;to the Internet and ping 10.50.60, but it can't ping 10.50.40.*.&lt;/li&gt;&#xA;&lt;li&gt;Machines in 10.50.40.* have the gateway 10.50.40.1, can't get to the&#xA;Internet, can't ping 192.168.2.254, can ping all other 192.168.2,&#xA;but they can't make MSTSC or access network shares or nslookup the DNS (all services can't go).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So, I've made these changes:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;On the SonicWALL, I've added a route to access 10.50.40 with gateway&#xA;10.50.60.6.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now, from 192.168.2.200, I can ping 10.50.40 and 10.50.60, but from&#xA;192.168.2 and from 10.50.40, I can't MSTSC or network share or whatever.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Another change:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;On machine 192.168.1.200, I set the gateway to 192.168.2.1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now, all over network services are reachable for all networks. I can&#xA;MSTSC and network share etc., but now from 192.168.2.200, I can't&#xA;ping 10.50.60.1 (X6 interface)!&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From machine 10.50.40, I still can't ping 192.168.2.254, and I can't&#xA;get to the Internet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Summary:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If I'm on VLAN1 (default vlan 192.168.2), I can't ping the X6&#xA;interface.&lt;/li&gt;&#xA;&lt;li&gt;If I'm on VLAN4 (10.50.40), I can't ping the X0 interface, and VLAN4&#xA;can't get to the Internet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I don't know what's happening. Please help if you have any ideas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;News:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've changed the default route on the layer-3 switch to the gateway 10.50.60.1, and now 10.50.40 can get to the Internet, but 192.168.2 can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to be a SonicWALL issue.&lt;/p&gt;&#xA;" OwnerUserId="19282" LastEditorUserId="8499" LastEditDate="2018-12-21T05:03:40.773" LastActivityDate="2019-05-25T04:06:40.643" Title="SonicWALL TZ215 : 2 LAN interfaces and 1 WAN" Tags="|switch|router|vlan|layer3|sonicwall|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="22804" PostTypeId="2" ParentId="22802" CreationDate="2015-09-25T14:00:32.187" Score="1" Body="&lt;p&gt;If the &quot;&lt;em&gt;Switch layer 3&lt;/em&gt;&quot; truly is configured for layer-3, you should not have the same subnet on each side of the switch.  A host won't use layer-3 to talk to another device in the same subnet, that is a layer-2 function, and separating a layer-2 domain with layer-3 will cause you no end of problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your diagram and comments, you have some serious design and configuration problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hosts on the VLANs should use the VLAN IP address configured on the layer-3 switch as the gateway for the host.  This will allow them to connect to other hosts on different VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hosts addressed in the subnet of a VLAN need to be connected to a port that is in that VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-3 switch, as the site router, should have its default route point to the IP address of the device which is directly connected to the Internet if you wan the hosts on the VLANs to access the Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-25T14:51:51.093" LastActivityDate="2015-09-25T14:51:51.093" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22808" PostTypeId="2" ParentId="22802" CreationDate="2015-09-25T14:51:30.680" Score="1" Body="&lt;p&gt;It works now. I have deleted the configuration from this post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have unassigned X6 on sonicwall and simply made a route to join my VLANs.&#xA;Now all machine can go to Internet and do everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network design was not correct. I thought it could work like my diagram but it doesn't. So now, it works without X6. &lt;/p&gt;&#xA;" OwnerUserId="19282" LastEditorDisplayName="user10222" LastEditDate="2016-06-21T05:18:28.587" LastActivityDate="2016-06-21T05:18:28.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22811" PostTypeId="2" ParentId="22794" CreationDate="2015-09-25T19:59:28.967" Score="2" Body="&lt;p&gt;Multicast is &quot;broadcast&quot; traffic. It gets sent at the AP's &quot;basic rate&quot;, which is the rate &lt;em&gt;every&lt;/em&gt; associated client can process. This is usually less than 5.5Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your available solutions are to block all multicast either at the switch or on the AP itself.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-09-25T19:59:28.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22813" PostTypeId="2" ParentId="22794" CreationDate="2015-09-25T20:31:50.983" Score="2" Body="&lt;p&gt;If you want to shut down multicasts on an interface completely, use&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;storm-control multicast level 0&lt;/h1&gt;&#xA;&#xA;&lt;h1&gt;switchport block multicast&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The first command prevents inbound multicasts from entering the switchport. The second stops outbound multicasts from getting out.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-25T20:31:50.983" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22814" PostTypeId="1" AcceptedAnswerId="22817" CreationDate="2015-09-25T21:06:57.230" Score="1" ViewCount="496" Body="&lt;p&gt;I'm trying to connect to my router by using the FastEthernet0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;int f0&#xA;ip addr 10.0.0.1 255.255.255.0&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And i got the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap#sh ip interface brief&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;BVI1                       unassigned      YES DHCP   up                    up&#xA;Dot11Radio0                unassigned      YES unset  administratively down down&#xA;Dot11Radio1                unassigned      YES unset  administratively down down&#xA;FastEthernet0              10.0.0.1        YES manual up                    up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also created a manual lan connection on Windows with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 10.0.0.10&#xA;Mask: 255.255.255.0&#xA;Gateway: 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But i can't connect to my router :\&lt;/p&gt;&#xA;" OwnerUserId="19295" LastActivityDate="2015-09-26T02:26:04.453" Title="Problems with Cisco Aironet 1200 FastEthernet connection" Tags="|cisco|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="22815" PostTypeId="2" ParentId="12764" CreationDate="2015-09-25T21:11:00.773" Score="1" Body="&lt;p&gt;IPv6 actually does have classful addressing, although not by that name, and there is only one class instead of the three classes A, B and C that we have in IPv4 (there also is an equivalent to class D in IPv6. Not sure about class E).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; @RonMaupin points out that IPv6 is technically classless. What I mean here is that the restriction on /64 subnets has the same practical effect as classes did in IPv4, in that it imposes a very ridgid subnetting structure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 is actually more restrictive than the IPv4 classes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IPv4, the classes are basically just conventions (and, as others have pointed out, classes have been deprecated for a very long time); except for RIP version 1, I know of nothing that has assumptions about classes hard-coded. If you use a class A prefix wih a /29 subnet mask, pretty much nothing breaks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IPv6, on the other hand, you simply cannot subnet to anything less than a /64 without breaking a lot, such as SLAAC and Neighbor Discovery.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't simply create a /68 or a /120 subnet and expect things to work. You can use a /127 for point-to-point networks, but only because a point-to-point network generally doesn't need anything beyond bare static IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="17317" LastEditorUserId="17317" LastEditDate="2015-09-27T20:36:11.520" LastActivityDate="2015-09-27T20:36:11.520" CommentCount="16" ContentLicense="CC BY-SA 3.0" />
  <row Id="22816" PostTypeId="1" CreationDate="2015-09-25T21:41:38.013" Score="0" ViewCount="755" Body="&lt;p&gt;I'm not sure if this belongs here or to Server Fault... but gotta start somewhere...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running a Win2008R2 server on VirtualBox. This server has an SNMP application. I'm trying to make this application manage physical devices which reside in a remote test lab, to which I connect through our office VPN. The setup is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+--------------------+&#xA;| Win7 PC            |&#xA;| +----------------+ |&#xA;| | VirtualBox     | |&#xA;| | Win2K8 R2      | |  +-----------------------+           &#xA;| | 172.16.0.2/24  | |  | DSL Router            |           &#xA;| | DGW 172.16.0.1 | |--| LAN IP 192.168.1.1/24 |&#xA;| +----------------+ |  | WAN IP 1.2.3.4/31     |           &#xA;| LAN IP             |  +-----------------------+           &#xA;| 192.168.1.10/24    |          |&#xA;| DGW 192.168.1.1    |      +-----------+&#xA;| VPN IP 10.10.10.10 |      | Unknown   |&#xA;+--------------------+      | VPN       |&#xA;                            +-----------+&#xA;                                |&#xA;                            +------------+&#xA;                            | Some       |&#xA;                            | routers in |&#xA;                            | 10.0.0.0/8 |&#xA;                            +------------+&#xA;                                |&#xA;+-----------------------+   +---------------+&#xA;| Switch 10.100.0.50/2  |   | Lab Router    |&#xA;|                       |---| 10.100.0.2/24 |&#xA;+-----------------------+   +---------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I add the switch to the SNMP application, the application registers on the switch as a trap receiver with IP address 172.16.0.2. When I ping the switch from the W2K8, the source address is the VPN IP of my PC, 10.10.10.10. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping the VPN IP of my PC from the switch. However I can't ping the IP of the W2K8. The obvious reason is that there's no route to 172.16.0.0/24. And when I check the switch status regarding the SNMP application, I only see &quot;Connecting&quot;. I've tried to configure the switch for mgmt. app IP 172.16.0.2 as well as the VPN IP 10.10.10.10 with no luck. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring the Virtual Server IP to different modes produces these ping results:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping from the switch to my PC VPN IP is always successful. I can never ping the W2K8 from host OS - ipconfig doesn't show IP 172.16.0.1. The DSL Router WAN port won't respond to ping from the Internet side. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT or NAT Network:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;With no proxy configured W2K8 has full Internet access, whatismyip.com shows the WAN IP of the DSL router&lt;/li&gt;&#xA;&lt;li&gt;With office proxy configured W2K8 has full Internet access, whatismyip.com shows the office proxy IP&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can ping its DGW&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can ping the physical IP of my PC&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can ping the VPN IP of my PC&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can ping the DSL Router LAN IP&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can ping the DSL Router WAN IP&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can ping the Lab Router&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can ping the switch&lt;/li&gt;&#xA;&lt;li&gt;Switch can ping everything else but the W2K8 IP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Bridged Adapter:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;W2K8 gets IP address on my own network with DSL router as DGW, and can ping it&lt;/li&gt;&#xA;&lt;li&gt;W2K8 has full access to the Internet&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can't ping the physical IP of my PC&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can't ping the VPN IP of my PC&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can ping the DSL Router LAN IP&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can ping the DSL Router WAN IP&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can't ping the Lab Router&lt;/li&gt;&#xA;&lt;li&gt;W2K8 can't ping the switch&lt;/li&gt;&#xA;&lt;li&gt;Switch can ping everything else but the W2K8 IP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Internal network:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;W2K8 has no IP address so no ping&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Host only: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;W2K8 has &quot;Media disconnected&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some additional info:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have a Debian system in the 10.100.0.0, which has a perpetual SSH connection to a RasPi in my own 192.168.1.0&lt;/li&gt;&#xA;&lt;li&gt;I have full control over everything in 10.100.0.0 except for router .0.2 so I can for example configure both Linux boxes to route traffic&lt;/li&gt;&#xA;&lt;li&gt;I have full control over everything in 192.168.1.0&lt;/li&gt;&#xA;&lt;li&gt;I have no control whatsoever over anything else in 10.0.0.0 &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So: is there any way to make the W2K8 reachable for devices in 10.100.0.0?&lt;/p&gt;&#xA;" OwnerUserId="10799" LastEditorUserId="10799" LastEditDate="2015-09-26T11:22:58.623" LastActivityDate="2015-09-26T18:24:11.203" Title="Routing to a virtual machine through a VPN" Tags="|virtual|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-12T18:09:41.893" ContentLicense="CC BY-SA 3.0" />
  <row Id="22817" PostTypeId="2" ParentId="22814" CreationDate="2015-09-26T02:26:04.453" Score="2" Body="&lt;p&gt;The address goes on BVI1, not fa0. It's a bridge, not router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know why Cisco even allows you to enter such a configuration. You cannot unbridge the interfaces either; you can enter the commands, it just won't work.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-09-26T02:26:04.453" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22819" PostTypeId="2" ParentId="22768" CreationDate="2015-09-26T11:08:01.547" Score="2" Body="&lt;p&gt;Netgear's official answer is to power off the device before adding HSM cards.  From &lt;a href=&quot;http://kb.netgear.com/app/answers/detail/a_id/14140&quot; rel=&quot;nofollow noreferrer&quot;&gt;GSM7228PS/GSM7252PS Product Information | Answer | NETGEAR Support&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;What are the two I/O modules for?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;There are three modules that are available for these module slots:&#xA;AX741, AX742, AX743 and AX744. AX741 is for 10G XFP. Netgear offers&#xA;both multi-mode and single mode XFP, AXM751 and AXM752 respectively.&#xA;AX742 is the stacking adaptor that comes with short Infiniband cable&#xA;to provide up to 12 Gigabit of bandwidth in one direction. And AX743&#xA;is for the newer 10 Gigabit SFP+ module. Netgear also offers AXM761&#xA;and AXM762 SFP+ for multi-mode and single mode fiber. And AX744&#xA;provides CX4 10-GbE interface.  The I/O modules are not hot pluggable.&#xA;You need to power off the switch, insert or move the modules, then&#xA;power on the switch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="13537" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-09-26T11:08:01.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22822" PostTypeId="1" AcceptedAnswerId="22826" CreationDate="2015-09-26T16:41:53.743" Score="1" ViewCount="5331" Body="&lt;p&gt;Analyzed 2 different internet connection. Details are as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Net-1:&#xA;&#xA;Download Speed: 2699 kbps (337.4 KB/sec transfer rate)&#xA;Upload Speed: 4737 kbps (592.1 KB/sec transfer rate)&#xA;Latency: 172 ms&#xA;Jitter: 50 ms&#xA;&#xA;Net-2:&#xA;&#xA;Download Speed: 1711 kbps (337.4 KB/sec transfer rate)&#xA;Upload Speed: 505 kbps (592.1 KB/sec transfer rate)&#xA;Latency: 40 ms&#xA;Jitter: 19 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I know about &quot;Latency&quot; is that it's good if less and same goes for &quot;Jitter&quot;. So, why come in this case an internet connection, with higher bandwidth, have higher &quot;Latency and Jitter&quot; then a connection less bandwidth?&lt;/p&gt;&#xA;" OwnerUserId="19308" LastEditorUserId="19308" LastEditDate="2015-09-26T20:47:09.220" LastActivityDate="2015-09-26T20:47:09.220" Title="Understanding Latency and Jitter" Tags="|latency|" AnswerCount="1" CommentCount="6" ClosedDate="2015-09-27T10:01:52.910" ContentLicense="CC BY-SA 3.0" />
  <row Id="22823" PostTypeId="2" ParentId="22816" CreationDate="2015-09-26T18:24:11.203" Score="1" Body="&lt;p&gt;The problem is the switch doesn't know how to get to the 172.16.0.0 network.  And since you don't have control over the intervening devices, you can't add routes.   If you had control over the router you could do some sort of tunneling.  Otherwise, there's not much you can do.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-09-26T18:24:11.203" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22824" PostTypeId="1" CreationDate="2015-09-26T18:41:33.883" Score="7" ViewCount="3101" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ow1Nz.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ow1Nz.png&quot; alt=&quot;network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HQ network is using PAT to gain access to the internet, the internal webserver needs to be accessed from the internet using static NAT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;S_HQ&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 10&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 20&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 30&#xA;!&#xA;interface GigabitEthernet0/1&#xA; switchport mode trunk&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R_HQ&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/0.10&#xA; encapsulation dot1Q 10&#xA; ip address 192.168.10.1 255.255.255.0&#xA; ip nat inside&#xA;!&#xA;interface GigabitEthernet0/0.20&#xA; encapsulation dot1Q 20&#xA; ip address 192.168.20.1 255.255.255.0&#xA; ip nat inside&#xA;!&#xA;interface GigabitEthernet0/0.30&#xA; encapsulation dot1Q 30&#xA; ip address 192.168.30.1 255.255.255.0&#xA; ip nat inside&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 145.89.181.192 255.255.255.0&#xA; ip nat outside&#xA; clock rate 2000000&#xA;!&#xA;ip nat pool PAT 145.89.181.192 145.89.181.192 netmask 255.255.255.0&#xA;ip nat inside source list PAT pool PAT overload&#xA;ip nat inside source static tcp 192.168.30.10 80 145.89.181.192 80&#xA;ip route 0.0.0.0 0.0.0.0 Serial0/0/0 &#xA;!&#xA;ip access-list standard PAT&#xA; permit 192.168.0.0 0.0.255.255&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R_ISP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet0/0&#xA; ip address 172.16.1.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 145.89.181.193 255.255.255.0&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 Serial0/0/0 &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All PC's are configured correctly, yet pinging from any VLAN inside the HQ network to the customer leads to a timeout, no translations are being made stating the &lt;code&gt;show ip nat translations&lt;/code&gt; command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, static NAT seems to be working fine visiting 145.89.181.192 in the browser on the customer PC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By removing and reapplying static NAT the problem seems to be gone, but after reopening Packet Tracer the problem is back again, it makes no sense to me...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I overseeing something or could this be a bug in Packet Tracer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much appreciated!&lt;/p&gt;&#xA;" OwnerUserId="19310" LastActivityDate="2024-01-11T21:00:35.043" Title="PAT and Static NAT not working together?" Tags="|cisco|nat|packet-tracer|snat|" AnswerCount="5" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="22826" PostTypeId="2" ParentId="22822" CreationDate="2015-09-26T20:37:06.090" Score="2" Body="&lt;p&gt;First, you are equating &quot;good&quot; with &quot;perceived speed.&quot; Latency and jitter, &lt;em&gt;in general&lt;/em&gt;, have little to do with bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Latency is a measure of the rather fixed limits of physics. Distance, routing and switching delays all contribute to the latency between any two nodes. Higher or lower latency doesn't make a link good or bad. Lower latency is &lt;em&gt;better&lt;/em&gt;, but there's usually very little that can be done about it. (speed of light being what it is and all.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jitter is the variability in latency. Jitter is &quot;bad&quot;. It's a function of queuing, buffers, processing loads, and generally the fact that there's other traffic competing for the link. Lower speed links will tend to have higher jitter due to the delay one packet will cause for any other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Protocols can easily deal with latency -- i.e. by transmitting more data without any acknowledgement. But jitter is problematic because of it's randomness and very nature -- sending more traffic could overflow a buffer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So... why is net-1 &quot;worse&quot;? It's a longer link, passing through more hops, and thus meeting with more congestion? (you've given &lt;em&gt;nothing&lt;/em&gt; on which to base an actual factual answer)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-09-26T20:37:06.090" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22827" PostTypeId="1" AcceptedAnswerId="22829" CreationDate="2015-09-26T22:10:08.307" Score="3" ViewCount="7867" Body="&lt;p&gt;I am a novice so please bear with me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At work we have a Cisco SG200-50P (which is connected to our router and server)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just bought a Engenius EGS2110P that I want to add to our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I do this please? Do I just get a CAT5e and connect it to a empty port on each switch and then it will work? Or do I have to use the Link/Act ports, or something else?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers, Roger&lt;/p&gt;&#xA;" OwnerUserId="19315" LastActivityDate="2015-09-27T02:04:09.653" Title="How to connect two switches together" Tags="|switch|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22828" PostTypeId="2" ParentId="22827" CreationDate="2015-09-26T22:16:20.217" Score="2" Body="&lt;p&gt;Certainly, the ports need to be enabled before the link will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should enable trunking on the ports connecting the two switches. How many VLANs do you have configured on the Cisco, and do you want all of them to be available on the Engenius? You can limit which VLANs cross the trunk.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-26T22:16:20.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22829" PostTypeId="2" ParentId="22827" CreationDate="2015-09-27T02:04:09.653" Score="4" Body="&lt;p&gt;you need to bring cat 5 (cat 6 preferred as it is 1G BW) and connect the two switches to each other and then log to each one (using the GUI)and configure the ports involved in this connection as a trunk , &lt;strong&gt;&lt;em&gt;change the management IP of the two switches&lt;/em&gt;&lt;/strong&gt; to be in the same range to be able to manage them from any where .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NOTE:&lt;/em&gt;&lt;/strong&gt; if you connected the two switches to each other directly without trunk configuration , it will work but under the consideration of you run single vlan which is called   &lt;strong&gt;&lt;em&gt;spread network&lt;/em&gt;&lt;/strong&gt; but this solution is not standered and not recommended as well&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-27T02:04:09.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22830" PostTypeId="1" AcceptedAnswerId="25837" CreationDate="2015-09-27T05:00:53.987" Score="3" ViewCount="2076" Body="&lt;p&gt;This is how I did it  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bit rate of &lt;strong&gt;E1&lt;/strong&gt; is &lt;strong&gt;2.048 Mbps&lt;/strong&gt; and bit rate of &lt;strong&gt;STM-4&lt;/strong&gt; is &lt;strong&gt;622.08 Mbs&lt;/strong&gt;&lt;br&gt;&#xA;I divided the bit rate of &lt;strong&gt;STM-4&lt;/strong&gt; by the bit rate of &lt;strong&gt;E1&lt;/strong&gt; and got the answer as &lt;strong&gt;303&lt;/strong&gt;.&lt;br&gt;&#xA;Is this correct? Or do I have to consider about the payload of STM-4?&lt;/p&gt;&#xA;" OwnerUserId="19319" LastActivityDate="2016-01-11T11:34:10.897" Title="How many E1 tributaries can be carried in one STM-4?" Tags="|fiber|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22831" PostTypeId="1" AcceptedAnswerId="22833" CreationDate="2015-09-27T12:24:17.733" Score="5" ViewCount="348" Body="&lt;p&gt;I know the basics of NAT technique and public/private IP addressing but I still have one conflict.&#xA;Let's say that my private address is &lt;code&gt;192.168.1.2&lt;/code&gt; and my public one is &lt;code&gt;180.180.1.2&lt;/code&gt;.&#xA;If I ping &lt;code&gt;180.180.1.2&lt;/code&gt; from my machine what I'm really pinging ?,&#xA;If it the isp router interface does it means that when I ping a random website, I'm not pinging the server itself but the router before  him from the ISP perspective ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please advice &lt;/p&gt;&#xA;" OwnerUserId="14476" LastEditorUserId="14476" LastEditDate="2015-09-27T17:14:27.530" LastActivityDate="2015-09-30T02:08:14.427" Title="IPv4 public address" Tags="|ipv4|nat|ip|isp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22832" PostTypeId="2" ParentId="22831" CreationDate="2015-09-27T15:06:05.093" Score="1" Body="&lt;p&gt;Like the answer to so many things in networking, it depends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you ping your public address, with residential or small business, it is probably a router at your home or office that sits between your network and the ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you ping a server at a large Internet site, in theory, you are pinging the server directly, but, in reality, you are probably pinging an address used by a load balancer sitting in front of a bunch of servers since one server couldn't keep up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference is that a residential or small business probably doesn't have more than the one public IP address assigned by the ISP.  A larger enterprise can afford to have a much larger public IP address range.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-27T15:12:44.103" LastActivityDate="2015-09-27T15:12:44.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22833" PostTypeId="2" ParentId="22831" CreationDate="2015-09-27T16:50:40.190" Score="3" Body="&lt;p&gt;good question&lt;br&gt;&#xA;you need to take care of the next ,&lt;br&gt;&#xA; 1- ISP will give you range of real IPs may this range is 2 IPs only , based on you example , ISP may assign you range of public IPs with 2 IPs (you 180.180.1.2/30 and GW 180.180.1.1/30) , &lt;strong&gt;&lt;em&gt;so the IP may you need to NAT to  is 180.180.1.2&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA; 2- you don't need &lt;strong&gt;&lt;em&gt;NAT&lt;/em&gt;&lt;/strong&gt; to ping any website , just routing &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hSCVh.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hSCVh.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to ping www.website_1.com you just need default route on R1 to 180.180.1.1,but if you need to access www.website_1.com (HTTP,HTTPS....etc) you sure will need to &lt;strong&gt;&lt;em&gt;NAT&lt;/em&gt;&lt;/strong&gt; on R1&lt;br&gt;&#xA; 3- as i told you before ISP can give you range of public IPs you can assign one of them to the website server by doing static NATing which is called publishing ,so when you ping this server from any PC in the global this real ip will reply your ping &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;try to ping any website from your PC ,the real IP of this website will reply you. to check the real ips assigned to any website use nslookup under the CMD&lt;/em&gt; &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-27T16:50:40.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22837" PostTypeId="1" AcceptedAnswerId="23099" CreationDate="2015-09-27T20:15:29.097" Score="2" ViewCount="684" Body="&lt;p&gt;I have a question concerning an example of OpenFlow utilization for a campus network made in the paper: &lt;em&gt;Open Flow: Enabling Innovation in Campus Networks&lt;/em&gt;. I will first quote the paper to provide some &lt;em&gt;context&lt;/em&gt; about the example I am struggling with. After which, I quote the specific passage that I do not understand.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;3&quot;&gt;&#xA;  &lt;li&gt;USING OPENFLOW &lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;As a simple example of how an OpenFlow Switch might be used imagine that Amy (a researcher) invented Amy-OSPF as a new&#xA;  routing protocol to replace OSPF. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;She wants to try her protocol in a&#xA;  network of OpenFlow Switches, without changing any end-host software.&#xA;  &lt;strong&gt;Amy-OSPF will run in a controller; each time a new application flow&#xA;  starts AmyOSPF picks a route through a series of OpenFlow Switches,&#xA;  and adds a flow- entry in each switch along the path.&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In her experiment, Amy decides to use Amy-OSPF for the traffic entering the&#xA;  OpenFlow network from her own desktop PC— so she doesn’t disrupt the&#xA;  network for others. To do this, &lt;strong&gt;she defines one flow to be all the&#xA;  traffic entering the OpenFlow switch through the switch port her PC is&#xA;  connected to&lt;/strong&gt;, and adds a flow-entry with the action “Encapsulate and&#xA;  forward all packets to a controller”.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Following is the excerpt that I struggle to understand:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;When her packets reach a controller, her new protocol chooses a route and adds a new flow-entry&lt;/strong&gt;&#xA;  (for the application flow) &lt;strong&gt;to every switch along the chosen path.&lt;/strong&gt; When&#xA;  subsequent packets arrive at a switch, they are processed quickly (and&#xA;  at line-rate) by the Flow Table&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, if my understanding is correct:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Amy defines one flow to be all the traffic coming from port N on router R.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Add a flow-entry with action &quot;encapsulate+forward to controller&quot;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Packets are routed using Path P_0, to controller C_1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Packets are reaching C_1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Amy-OSPF will compute the best route/path (which may be different from P_0), we call it P_1, from port N on router R to C1.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It multicast the flow-entry to the chosen routers on path P_1, saying that if a packet is labeled to be from port N on router R forward to the next router on P_1.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Each router on path P_1 has a &lt;em&gt;local view&lt;/em&gt; of the best path (next hop), whereas C_1 has the &lt;em&gt;global view&lt;/em&gt; (all the hops from start to finish).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Further processing will be very fast because the router will just execute the flow-entry communicated by the controller C_1.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Am I missing something? Also, to which router/switch is Amy adding the rules for 0 and 1 (defining a flow, adding a flow-entry &quot;encapsulate + forward to controller&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you,&lt;/p&gt;&#xA;" OwnerUserId="19330" LastActivityDate="2015-10-06T05:29:23.680" Title="OpenFlow Example: Is my understanding correct?" Tags="|routing|openflow|sdn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22838" PostTypeId="2" ParentId="22529" CreationDate="2015-09-27T22:56:22.113" Score="0" Body="&lt;p&gt;The way I understand that statement is that you can have multiple clients using port forwarding or port triggering, but you cannot have a single client use port triggering AND port forwarding.  Doing so is redundant as the dynamic rule(triggering) created may be identical to the static(forwarding) rule and the resulting behavior may vary from device to device (duplicate traffic, error creating the trigger rule, etc).&lt;/p&gt;&#xA;" OwnerUserId="19273" LastActivityDate="2015-09-27T22:56:22.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22840" PostTypeId="2" ParentId="22493" CreationDate="2015-09-27T23:23:57.123" Score="1" Body="&lt;p&gt;A full subnet scan of all ports will impact your network performance, especially on a wireless network as those are basically a hub network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can minimize the amount of noise by limiting your port scans to 1 IP and 1 port at a time (as clients connect, take their IP and specifically scan them for only the ports you are looking for).&lt;/p&gt;&#xA;" OwnerUserId="19273" LastActivityDate="2015-09-27T23:23:57.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22841" PostTypeId="1" AcceptedAnswerId="22844" CreationDate="2015-09-28T01:35:45.153" Score="2" ViewCount="708" Body="&lt;p&gt;When Device A sends an IP datagram toward Device B, the IP Layer of Device A computes if it must or not fragment the IP datagram to fit the link MTU. Sent to the next hop, the process will be repeated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, must every intermediary device on network wait for all the IP datagram fragments to arrive and reassemble them in the correct order and re-fragment if necessary?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oh7kT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oh7kT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="8499" LastEditDate="2019-01-12T20:34:00.793" LastActivityDate="2019-01-12T20:34:00.793" Title="IP Fragmentation" Tags="|ip|ipv4|protocol-theory|layer3|fragmentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22844" PostTypeId="2" ParentId="22841" CreationDate="2015-09-28T02:03:52.457" Score="4" Body="&lt;p&gt;As the diagram shows, fragmentation happens along the path, as needed.  It is up to the end-device to reassemble any fragments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice in the drawing how the colored boxes (representing IP packets) are fragmented by the first hop router, and they remain fragmented upon leaving the second hop router.  Device B is responsible to reassemble the fragment into the IP packets before passing the reassembled packets to the upper-layer protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is only for IPv4.  IPv6 requires the sending host to pre-fragment any IPv6 packets before sending them since the intermediate devices will not fragment the IPv6 packets.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-28T02:03:52.457" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22847" PostTypeId="2" ParentId="22824" CreationDate="2015-09-28T09:24:12.837" Score="0" Body="&lt;p&gt;Is there a specific configuration to have your Pool Nat with a mask of /24 and not /32 if your public address is always the same: 145.89.181.192&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you tried to modify your PAT Pool by this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat pool PAT 145.89.181.192 145.89.181.192 netmask 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19274" LastActivityDate="2015-09-28T09:24:12.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22848" PostTypeId="2" ParentId="22749" CreationDate="2015-09-28T10:04:04.533" Score="2" Body="&lt;p&gt;Finally got it to work, after much playing around. The high level steps to complete were as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create a general NAT access list for inside traffic to internet and remote network (with permit and deny rules)&lt;/li&gt;&#xA;&lt;li&gt;Create a specific NAT access list to match router-originated traffic&lt;/li&gt;&#xA;&lt;li&gt;Add outside matcher to tunnel interface&lt;/li&gt;&#xA;&lt;li&gt;Create 2 nat rules, 1 for each access list in #1 and #2 above.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here's the config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended INSIDE_TO_OUTSIDE_GENERAL&#xA; deny ip 192.168.1.0 0.0.0.255 172.16.1.0 0.0.0.255 ! Match local private to remote private traffic - deny translation&#xA; permit ip 192.168.1.0 0.0.0.255 any ! translate all other local traffic&#xA;ip access-list extended FROM_ROUTER_DOWN_TUNNEL&#xA; permit ip host 169.254.1.10 172.16.1.0 0.0.0.255 ! allow traffic with source address matching tunnel interface and a destination of remote private&#xA;&#xA;ip nat inside source list INSIDE_TO_OUTSIDE_GENERAL interface Dialer1 overload ! attach inside to outside traffic - excludes pvt to pvt&#xA;ip nat inside source list FROM_ROUTER_DOWN_TUNNEL interface FastEthernet0/1 overload ! traffic from local tunnel interface to remote private gets translated to FA0/1 (i.e. inside private) IP.&#xA;int Tunnel1&#xA;  ip nat outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The adjustment to the first access-list (the addition of the &lt;code&gt;deny&lt;/code&gt;) allows me to add the &lt;code&gt;ip nat outside&lt;/code&gt; to the tunnel and not translate 192.168 traffic headed to 172.16. The 2nd access-list allows me to identify router-originated traffic headed to remote private network, and the 2nd &lt;code&gt;ip nat inside&lt;/code&gt; rule ensures translation from tunnel IP to private inside IP (.1.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Working like a charm.&lt;/p&gt;&#xA;" OwnerUserId="18938" LastActivityDate="2015-09-28T10:04:04.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22849" PostTypeId="1" CreationDate="2015-09-28T11:23:03.443" Score="0" ViewCount="148" Body="&lt;p&gt;I want to build a server/client application, where a smartphone streams real-time data from the device to a stationary computer. They are connected directly via WiFi. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The streamed data shall include&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;audio data (at least 44.1 kHz, 16 Bit)&lt;/li&gt;&#xA;&lt;li&gt;video data (no high quality is required, e.g. 640 x 320 pixels or similar), and &lt;/li&gt;&#xA;&lt;li&gt;from different sensors (e.g. accelerometer, GPS, gyroscope, etc.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you may notice, all data source are very different in sampling rate (44.1 kHz for audio vs. 100 Hz for accelerometer vs. variable for GPS (event-based)) and amount of data (video with lots of data vs. GPS with only some bytes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it better (in terms of real-time performance and delay) to tunnel the data through one TCP connection, or to use for each data type an own TCP connection? Is it worth to got with UDP?&lt;/p&gt;&#xA;" OwnerUserId="19340" LastActivityDate="2015-09-28T12:34:03.797" Title="Streaming data with different sampling rates and data types" Tags="|tcp|udp|streaming|" AnswerCount="1" CommentCount="1" ClosedDate="2015-09-28T15:44:03.837" ContentLicense="CC BY-SA 3.0" />
  <row Id="22851" PostTypeId="2" ParentId="22849" CreationDate="2015-09-28T12:34:03.797" Score="1" Body="&lt;p&gt;first of all, for real time applications (audio , video ..etc) you &lt;strong&gt;&lt;em&gt;must&lt;/em&gt;&lt;/strong&gt; use &lt;strong&gt;&lt;em&gt;UDP&lt;/em&gt;&lt;/strong&gt; not TCP (where TCP is connection oriented ) .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;second,the only thing you should care about if you run such applications is the &lt;strong&gt;&lt;em&gt;throughput&lt;/em&gt;&lt;/strong&gt; and if WIFI connection could handle this through put or not ??? , your audio and video rates as you listed will never exceed the throughput of the WIFI where b/g stander are 54 MBPS and a stander is 150 MBPS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;third, regarding run single connection or multi connection , i guess you should run each type of application on single connection , network wise it is better from the side of apply quality of service and traffic control. &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-28T12:34:03.797" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="22854" PostTypeId="1" AcceptedAnswerId="22855" CreationDate="2015-09-28T15:26:44.927" Score="2" ViewCount="108" Body="&lt;p&gt;Could some one explain to me what &quot;The same autonomous system&quot; means with regards to the neighbor full relationship requirement rules in OSPF. Does it need to be the same across all areas of my OSPF routed network?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Same Autonomous System  &lt;/li&gt;&#xA;&lt;li&gt;Same Subnet Mask&lt;/li&gt;&#xA;&lt;li&gt;Same Hello and Dead&lt;/li&gt;&#xA;&lt;li&gt;Same Authentication&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19249" LastEditorUserId="8499" LastEditDate="2017-08-27T17:27:14.293" LastActivityDate="2017-08-27T17:27:14.293" Title="Neighbor Full Relationship Requirements in OSPF" Tags="|routing|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22855" PostTypeId="2" ParentId="22854" CreationDate="2015-09-28T15:38:38.603" Score="2" Body="&lt;p&gt;From the OSPF perspective, an autonomous system is the collection of OSPF areas that connect to a single Area 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To connect as full neighbors on a link, the prospective neighbors need to be in the same OSPF area, have a common subnet with the same mask, the same timers, and the same authentication.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-28T15:38:38.603" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22856" PostTypeId="2" ParentId="519" CreationDate="2015-09-28T16:50:40.880" Score="0" Body="&lt;p&gt;The question is now two years old, but the issue still exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My answer assumes that you are on the server side, although similar reasoning also applies on the client side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would do well to get ready for IPv6. Make sure your you have IPv6 allocations. Test all your systems. Get to the point where you can simply flip the switch by adding AAAA records to your DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then stop there and consult with management. The main problem is that the number of support calls will go up dramatically. You will have to deal with two main problems: people whose IPv6 is simply misconfigured, and ISPs whose IPv6 is flaky. As long as most users use IPv4, problems on the IPv6 side may go unreported and undetected for hours.&lt;/p&gt;&#xA;" OwnerUserId="17317" LastActivityDate="2015-09-28T16:50:40.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22857" PostTypeId="1" AcceptedAnswerId="22900" CreationDate="2015-09-28T20:35:15.680" Score="2" ViewCount="251" Body="&lt;p&gt;Would it be possible from a central server, communicating with two clients {A, B}, to determine if A and B are physically located on the same local network? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1) Local/Home Networks&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd say sure. The user's NAT/router would indicate an identical IP address of A and B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2) Larger networks with multiple gateways&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My concern comes in on larger, wireless networks (e.g. an airport). If I have two IPs for A and B who connected to a wireless network through different routers, can I make any assumptions about the airport's network based on the IP addresses of A and B? I could probably get to some top-level information via reverse-IP lookup, but that might not be good enough for a very large network (like a university wireless network). The answer here is probably &quot;no...&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, what if A and B could &lt;em&gt;provide information TO the central server&lt;/em&gt;? This is where my networking knowledge gets hazy. If both A and B have the same gateway and a &quot;similar-enough&quot; public IP, I should be able to assume they are on the same local area network, correct? What are the flaws in this assumption?&lt;/p&gt;&#xA;" OwnerUserId="4184" LastEditorUserId="8499" LastEditDate="2018-11-04T19:00:50.603" LastActivityDate="2018-11-04T19:00:50.603" Title="Detecting same local area network" Tags="|routing|wireless|nat|ieee-802.11|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22858" PostTypeId="2" ParentId="22857" CreationDate="2015-09-28T20:51:19.940" Score="1" Body="&lt;p&gt;There is really no way for a remote server to know if two clients are on the same local network.  Even with the same public address, you can't know that they are not across the country from each other since they may belong to a company with multiple sites that uses a central proxy or firewall using NAT.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-28T20:58:09.993" LastActivityDate="2015-09-28T20:58:09.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22859" PostTypeId="1" CreationDate="2015-09-28T21:14:37.383" Score="8" ViewCount="7387" Body="&lt;p&gt;Here is the question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When and Why do we decrease MSS instead of MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the router that we can configure can configure both of them separately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I have kept MSS as 1260.I have not made any changes to the MTU. Now if the TCP and the IP header do not have any options then they will be using 40 bytes( 20 TCP + 20 IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So does this mean that the MTU in this case is 1300. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the second scenario. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I decreased the MTU to 1300. I did not make any change to the MSS. Again there are no options in the TCP and IP options. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So does this mean that the MSS in this case is 1260. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If both the scenarios have same outcome then please help me understand the following. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In which case should we decrease the MTU and leave MSS untouched ?&lt;/li&gt;&#xA;&lt;li&gt;In which case should we decrease the MSS and leave MTU untouched ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank You &lt;/p&gt;&#xA;" OwnerUserId="19353" LastActivityDate="2015-09-29T17:57:47.597" Title="MTU vs MSS? When to change MTU and when to change MSS?" Tags="|ethernet|network-core|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22860" PostTypeId="1" AcceptedAnswerId="22862" CreationDate="2015-09-28T21:21:56.317" Score="1" ViewCount="2223" Body="&lt;p&gt;I am trying to figure out how to summarize the subnet for ip route. I am following this information here... &lt;a href=&quot;http://www.pearsonitcertification.com/articles/article.aspx?p=2169746&amp;amp;seqNum=7&quot; rel=&quot;nofollow&quot;&gt;http://www.pearsonitcertification.com/articles/article.aspx?p=2169746&amp;amp;seqNum=7&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It basically is having me change the &quot;interesting octet&quot; into binary, and then find the common barrier between the 1 and 0. However I am unsure since one of them is 0's. The IP's are..&lt;br&gt;&#xA;    10.10.0.1&lt;br&gt;&#xA;    10.10.2.1&lt;br&gt;&#xA;    10.10.4.1&lt;br&gt;&#xA;    10.10.6.1&lt;br&gt;&#xA;When I convert them into binary I get&lt;br&gt;&#xA;0 = 0000 0000&lt;br&gt;&#xA;2 = 0000 0010&lt;br&gt;&#xA;4 = 0000 0100&lt;br&gt;&#xA;6 = 0000 0110&lt;br&gt;&#xA;Would it end up being 10.10.0.0/21?&lt;/p&gt;&#xA;" OwnerUserId="19187" LastEditorUserId="8499" LastEditDate="2018-12-22T03:52:17.810" LastActivityDate="2018-12-22T03:52:17.810" Title="Summarize subnet from 4 ip addresses" Tags="|router|ip|ipv4|subnet|route-summarization|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22862" PostTypeId="2" ParentId="22860" CreationDate="2015-09-28T21:32:43.810" Score="1" Body="&lt;p&gt;Yes.  The number of bits in common is the number you are looking for.  You left off the first 16 bits (they are in common). plus the 5 bits in common you show here is 21 bits in common.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-28T21:32:43.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22863" PostTypeId="2" ParentId="22860" CreationDate="2015-09-28T21:39:48.803" Score="1" Body="&lt;p&gt;10.10.0000 0&lt;strong&gt;000.0000 0000&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.10.0000 0 are the common bits, the network bits&lt;/p&gt;&#xA;&#xA;&lt;p&gt;000.0000 0000 are the bit that are dedicated to host on your network 10.10.0.0/21&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-28T21:39:48.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22864" PostTypeId="2" ParentId="22859" CreationDate="2015-09-28T21:47:55.520" Score="2" Body="&lt;p&gt;You may want to decrease MSS without decreasing MTU since you may want to put a limit on the size of the TCP segment.  You have to remember that not everything transmitted is TCP.  You may, and probably do, have other layer-4 protocols used with IP, and you may not want to decrease their sizes.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-28T21:47:55.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22865" PostTypeId="1" CreationDate="2015-09-28T22:23:11.843" Score="1" ViewCount="38" Body="&lt;p&gt;in your experience what's better to recommed for a friend?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its to interconnect access level switches from two buildings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possible to interconnect to a ring topology on a near future.&lt;/p&gt;&#xA;" OwnerUserId="19355" LastActivityDate="2015-09-29T00:26:04.137" Title="FO on what mode: Multimode or monomode for 290mts" Tags="|fiber|" AnswerCount="1" CommentCount="5" ClosedDate="2015-09-29T05:10:56.723" ContentLicense="CC BY-SA 3.0" />
  <row Id="22866" PostTypeId="1" CreationDate="2015-09-28T23:17:23.873" Score="3" ViewCount="4307" Body="&lt;p&gt;Reading about IP Routing, I found a brief explanation: &lt;code&gt;&quot;routing daemon, which is normally a user process. The most common daemons used on Unix systems are the programs routed and gated.&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an Unix system these programs are activated if an host to act as router. So, routing daemon is not applied in Cisco IOS? If I am right, those two little square &lt;code&gt;&quot;Routing Daemon&quot; &quot;Netstat Command&quot;&lt;/code&gt; are replaced by one routing protocol? Sure which will not exists &lt;code&gt;TCP Module&lt;/code&gt; too&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qzCVH.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qzCVH.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14008" LastActivityDate="2017-01-24T18:54:54.160" Title="What is Routing Daemon?" Tags="|routing|ip|layer3|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22867" PostTypeId="2" ParentId="22866" CreationDate="2015-09-28T23:24:47.457" Score="1" Body="&lt;p&gt;You can't compare a monolithic, closed, proprietary OS like IOS to any other OS since you have no architectural or other reference points with which to compare.  There may be similarities, but the people who know aren't talking due to legal issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing works at layer-3, mostly with IP in today's world, but not exclusively.  TCP, UDP, etc. are at layer-4.  Routing uses the layer-3 addresses to populate a routing table which it uses to switch layer-3 packets from one interface to another. &lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-09-28T23:35:36.763" LastActivityDate="2015-09-28T23:35:36.763" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22868" PostTypeId="2" ParentId="22859" CreationDate="2015-09-29T00:07:21.663" Score="6" Body="&lt;p&gt;&lt;strong&gt;MTU&lt;/strong&gt; is typically a reference to the physical medium of the &lt;strong&gt;directly connected interface&lt;/strong&gt;.  As a general rule, you want to leave this as the maximum the medium can handle.  There are occasional cases where you need to enable &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1377&quot;&gt;jumbo frames&lt;/a&gt; or adjust MTU due to overlay networks or fancy encapsulation schemes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MSS&lt;/strong&gt; is mostly a reference to the &lt;strong&gt;end-to-end path&lt;/strong&gt;.  This isn't commonly manually set, and is instead left to functions such as &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13417/&quot;&gt;Path MTU&lt;/a&gt; discovery to dynamically set on a connection by connection basis.  The most common case is TCP, which can better 'tune' a connection for optimal end-to-end bandwidth usage if it has full control over the segments being sent, as opposed to having the segments being fragmented unknowingly along the path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way of looking at it...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MTU&lt;/strong&gt; should be set solely based upon the physical medium and/or fringe encapsulation or jumbo frame needs.  MTU affects every frame sent out an interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MSS&lt;/strong&gt; is dynamically set based upon the collective path MTU, typically on a connection by connection basis.  &lt;em&gt;Dynamic&lt;/em&gt; adjustment of the MSS is tuned for each connection, but doesn't affect other connections, or other 'non-connection-oriented' communications.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-09-29T00:07:21.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22869" PostTypeId="2" ParentId="22865" CreationDate="2015-09-29T00:26:04.137" Score="1" Body="&lt;p&gt;For 290 meters, you can go either way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my personal experience I have found singlemode to be cheaper overall (despite potentially more expensive SFPs and connectors, the cable is MUCH cheaper than OM3 &amp;amp; OM4 multimode, and the connectors and SFPs can be cheaper as well under the right shopping conditions.) Singlemode is also not limited to 10 GB - the future capacity is virtually unlimited if and when faster optics become available, while OM3 can only do 10GB for 300 meters, which might not even work depending on the length of patchcords, etc at either end of a 290 meter (if that's accurate) link. OM4 will buy you some more distance, but neither has the future potential that singlemode does. Even if it's only getting lit at 1 GB &lt;strong&gt;now&lt;/strong&gt;, experience says that upgrades will be wanted in the next 10 years, and not having to replace the cable makes those upgrades easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But lots of people would choose OM3/4 based merely on distance and a somewhat inaccurate in detail (or outdated) belief that &quot;multimode is always cheaper.&quot;&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-09-29T00:26:04.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22870" PostTypeId="1" CreationDate="2015-09-29T01:47:17.287" Score="0" ViewCount="1096" Body="&lt;p&gt;I have install F5 VM edition to do &lt;code&gt;SNAT&lt;/code&gt; testing but fail to produce scenario. I have enable &lt;code&gt;autonat&lt;/code&gt; on VIP (10.10.10.201) and trying to ping google.com from A, B, C machines but ping doesn't work also any machine not able to surf internet. what i am doing wrong? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping 172.16.20.1 IP which is default GW for all internal machine.   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   Internet&#xA;       |&#xA;      [sw]---------[Database]&#xA;       |&#xA; 10.10.10.201&#xA;   [BIGIP]&#xA; 172.16.20.1&#xA;     |&#xA;-----+------&#xA;|    |     |&#xA;A    B     C&#xA;&#xA;A=172.16.20.2&#xA;B=172.16.20.3&#xA;C=172.16.20.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;  I have added &lt;code&gt;database&lt;/code&gt; machine and A, B, C accessing them. someone my A, B and C not able to access those database machine. Even i configure &lt;code&gt;F5&lt;/code&gt; for ALL Traffic allowed, do you thing that is SNAT issue?&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2015-09-29T14:05:44.607" LastActivityDate="2015-09-29T14:05:44.607" Title="F5 auto SNAT not working" Tags="|routing|load-balancer|f5|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22871" PostTypeId="1" AcceptedAnswerId="25528" CreationDate="2015-09-29T02:33:39.290" Score="4" ViewCount="324" Body="&lt;p&gt;I want to feed a Juniper router a set of routes via BGP and measure how long it takes the router to process them, including time spent on prefix filters and RPKI origin validation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco IOS XR routers keep timers that measure the amount of time they spend processing routes, so it's fairly easy to do.&#xA;&lt;br/&gt;I can do it like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show bgp neighbor performance-statistics&#xA;... output omitted ...&#xA;Processed 101900 inbound update messages (time spent: 3.646 secs)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way to do this on a Juniper router?&#xA;The Juniper router model is mx240 and it's running Junos 14.2R1.9.&lt;/p&gt;&#xA;" OwnerDisplayName="user19357" LastActivityDate="2015-12-31T03:18:35.720" Title="Measuring route processing time" Tags="|router|juniper|juniper-mx|performance|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22872" PostTypeId="2" ParentId="22870" CreationDate="2015-09-29T04:56:17.843" Score="3" Body="&lt;p&gt;SNAT automap applied to a VIP will only affect traffic that has arrived inbound to the VIP.  It won't affect traffic initiated from your real servers heading outbound.  For that, you will need to create a SNAT Pool.  More information &lt;a href=&quot;https://support.f5.com/kb/en-us/products/big-ip_ltm/manuals/product/ltm_configuration_guide_10_0_0/ltm_snat.html#1210773&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-09-29T04:56:17.843" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22873" PostTypeId="2" ParentId="22860" CreationDate="2015-09-29T05:40:27.070" Score="1" Body="&lt;p&gt;Without the binary&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where is the change happening ? - in the third octet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How big a block size do i need ? - Well its 0 - 6 in the 3rd octet, so a block &#xA;size of 6 would be great but there is no such thing, so 8 will do.&#xA;(block-sizes 2,4,8,16,32,64,128,256 etc etc )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right i now know that i need a block size of 8, how many bits do i need to borrow to accomplish this? 2,4,8 - so the answer is 3 - i borrowed 3bits, 3^2 = 8&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now for some basic maths :: 24 - 3 = 21 !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why did i subtract from 24? Because an ip address is made up of 4 * 8bits, i am working in the 3rd octet, if i was working in the 4th it would be &lt;/p&gt;&#xA;&#xA;&lt;p&gt;32 - 3 = 29 !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, 24 - 3 = 21 ! So i now know my mask is /21&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My networks are ::&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.10.0.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.10.8.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.10.16.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.10.24.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.10.32.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;etc&#xA;etc&#xA;.&lt;/p&gt;&#xA;" OwnerUserId="8109" LastActivityDate="2015-09-29T05:40:27.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22877" PostTypeId="2" ParentId="22857" CreationDate="2015-09-29T08:59:04.537" Score="0" Body="&lt;p&gt;There are some tricks that let you know the local IP address of a client that is connecting to the server through a proxy / NAT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of them is making the client run a java applet that checks and send the local IP to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some VPN clients let out the local IP address and also some browsers let it be known to the server when there is a WebRTC request. (This is not a feature, it's a bug so probably it wil be corrected soon).&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-09-29T08:59:04.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22880" PostTypeId="1" CreationDate="2015-09-29T09:16:07.407" Score="0" ViewCount="54" Body="&lt;p&gt;I had a network which is accessible through LAN and Wi-Fi but the problem is while using Wi-Fi we can't ping to any PC, and that's why we can't remotely connect to any PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Wi-Fi and LAN are on the same network it should ping and remotely connect, but it doesn't work. So please tell me why this is happening, and how we can resolve the problem.&lt;/p&gt;&#xA;" OwnerUserId="19361" LastEditorUserId="8499" LastEditDate="2015-10-29T14:04:46.217" LastActivityDate="2015-10-29T14:04:46.217" Title="Remote Desktop is not geting through Wi-Fi" Tags="|network-core|" AnswerCount="1" CommentCount="3" ClosedDate="2017-08-12T18:35:19.037" ContentLicense="CC BY-SA 3.0" />
  <row Id="22881" PostTypeId="1" CreationDate="2015-09-29T09:49:24.887" Score="5" ViewCount="21904" Body="&lt;p&gt;I have a Sonicwall firewall. I want to block the Psiphon mobile and PC applications.&lt;br /&gt;&#xA;I denied access on these ports: 51,5242,4244,5243,9785,1701,47,443,500,4500,1080&lt;br /&gt;&#xA;Most VPNs are closed but the Psiphon app still works; how I can block it?&lt;/p&gt;&#xA;" OwnerUserId="19362" LastEditorUserId="31801" LastEditDate="2020-10-24T19:33:13.073" LastActivityDate="2021-10-23T17:44:10.437" Title="How I can block Psiphon?" Tags="|vpn|firewall|sonicwall|" AnswerCount="7" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="22882" PostTypeId="1" AcceptedAnswerId="22883" CreationDate="2015-09-29T10:54:26.380" Score="2" ViewCount="134" Body="&lt;p&gt;In order to have a second &quot;backup&quot; gateway for my company network, I tried to implement this topology:&lt;a href=&quot;https://i.stack.imgur.com/xCi8u.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xCi8u.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is pretty straightforward, with the network between the modem and the router being the 192.168.1.0/24 and the network between the router and the stations being the 192.168.10.0/24. The actual IP addresses are the ones on the sketch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The status of the interfaces on the router is like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco1#show ip interface brief&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;FastEthernet0/0            192.168.1.69    YES NVRAM  up                    up&#xA;FastEthernet0/1            192.168.10.69   YES NVRAM  up                    up&#xA;Serial0/0/0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routing table is like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco1#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       + - replicated route, % - next hop override&#xA;&#xA;Gateway of last resort is 192.168.1.1 to network 0.0.0.0&#xA;&#xA;S*    0.0.0.0/0 [1/0] via 192.168.1.1&#xA;      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C        192.168.1.0/24 is directly connected, FastEthernet0/0&#xA;L        192.168.1.69/32 is directly connected, FastEthernet0/0&#xA;      192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C        192.168.10.0/24 is directly connected, FastEthernet0/1&#xA;L        192.168.10.69/32 is directly connected, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see I have configured the modem's IP address as the gateway of last resort, so that the packets take that way towards the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also configured my test PC with an IP of 192.168.10.13, mask of 255.255.255.0 and default gateway of 192.168.10.69.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now this is where it gets weird: From the router's CLI I can successfully ping 192.168.1.1, 192.168.1.69, 192.168.10.69 and 192.168.10.13. From the test PC I can successfully ping only 192.168.1.69 and 192.168.10.69. When trying to ping 192.168.1.1 from the test PC it fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course I have no Internet connectivity from the test PC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, is there something I am overlooking? Why is it that I cannot connect to the internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some more inspection, my routing table looks really fishy. Why have the directly connected networks been broken up like that? I have never before seen The interface IP addresses mentioned in the routing table as separate &quot;/32&quot; directly connected subnets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any idea why this is happening? I have a strong feeling this may be related to my connectivity issue.&lt;/p&gt;&#xA;" OwnerUserId="17104" LastActivityDate="2015-09-29T11:49:01.390" Title="Routing/gateway problems in a simple topology" Tags="|cisco|routing|lan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22883" PostTypeId="2" ParentId="22882" CreationDate="2015-09-29T11:35:54.627" Score="4" Body="&lt;p&gt;If you want to ping your modem (192.168.1.1) from your test PC (192.168.10.13), you must to add a route in your modem for the network 192.168.10.0/24 via 192.168.1.69 (your router). By default, your modem doesn't know where is the address of your test PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your ICMP Echo arrives on your modem but it can't send the reply because it has no route for this network: 192.168.10.0/24 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You ping from your router all IP's addresses beacuse they are all connected to him. The router knows, by default, all the networks it have been directly connected to him.&lt;/p&gt;&#xA;" OwnerUserId="19274" LastActivityDate="2015-09-29T11:35:54.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22884" PostTypeId="2" ParentId="22882" CreationDate="2015-09-29T11:49:01.390" Score="3" Body="&lt;p&gt;Your router have 2 networks connected directly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.0/24&#xA;192.168.10.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It can reach the two networks, but, your modem router, only knows that it wil connect to internet across the serial link or something like this, i´m talking about the link connected with the cloud.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, the same happens when the modem receive a packet from an equipment located in the network 192.168.10.0/24. The modem knows this network cause it has connected DIRECLTY.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;YOU MUST ADD some route on your modem router with destination 192.168.1.0/24 across gateway 192.168.1.69/24. This is the way that packets from 192.168.1.0 will be reply to that destination. The problem is this, the REQUEST arrive without problem, but the modem UNKNOWN the location of the network 192.168.1.0/24. &lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-29T11:49:01.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22885" PostTypeId="2" ParentId="22880" CreationDate="2015-09-29T11:53:50.403" Score="2" Body="&lt;p&gt;You must do a review of your wifi conf, cause, sometimes, it has enable a configuration that does user isolation, with the finally of a security measure to isolate users. On this cases, is thinking that you gonna put your wifi network in other network, dedicated for that.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-29T11:53:50.403" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22889" PostTypeId="1" CreationDate="2015-09-29T12:56:52.293" Score="2" ViewCount="16994" Body="&lt;p&gt;I'am trying to install an FL-4320-PERF-K9 (Performance) License on an ISR4321 to increase throughput from 85 mbit to 100 mbit but it tells me that there is a better license installed already.. Does anyone know what that is and how i can see that? Log messages clearly describes that it is using the maximum bandwith of 85 mbit for this license platform...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%CERM_DP-4-DP_TX_BW_LIMIT: Maximum Tx Bandwidth limit of 85000 Kbps reached for Crypto functionality with securityk9 technology package license.&#xA;&#xA;Router#license install flash:&amp;lt;hidden.lic&amp;gt;&#xA;Installing licenses from &quot;flash:&amp;lt;hidden.lic&amp;gt;&quot; &#xA;Installing...Feature:throughput...Failed:&#xA;% Error: Better license exists &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is an output of show license:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cKc0h.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cKc0h.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19366" LastEditorUserId="33" LastEditDate="2015-12-05T06:39:38.030" LastActivityDate="2017-04-07T17:48:14.700" Title="Performance License for 4321" Tags="|cisco|cisco-isr|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22891" PostTypeId="2" ParentId="22857" CreationDate="2015-09-29T14:28:57.287" Score="2" Body="&lt;p&gt;short answer is no way to know the local IP address (the private IP) of remote host . except you show the ARP address table or any sort of administrative show on L3 device connected to the remote site it self &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-09-29T14:28:57.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22892" PostTypeId="2" ParentId="22881" CreationDate="2015-09-29T14:38:08.397" Score="4" Body="&lt;p&gt;I'm quoting what is posted on the Psiphon page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You can only establish connections via Psiphon by using the following ports:&#xA;  53, 80, 443, 554, 1935, 7070, 8000, 8001,&#xA;  6971-6999.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If you block these ports, you will also be blocking a lot of services in your network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You need to do Deep Packet Inspection if you want your really block Psiphon.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://psiphon.ca/es/faq.html&quot; rel=&quot;nofollow&quot;&gt;https://psiphon.ca/es/faq.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="623" LastEditDate="2015-10-29T21:56:21.100" LastActivityDate="2015-10-29T21:56:21.100" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22893" PostTypeId="2" ParentId="22881" CreationDate="2015-09-29T14:41:11.233" Score="2" Body="&lt;p&gt;If you want to block this application, you must block all VPNs which are not yours.&lt;/p&gt;&#xA;&lt;p&gt;Psiphon can mount proxy HTTP/SOCKS via tunnels. All the traffic of this application will bypass the port TCP 80 by default. So you must to have a firewall capable to inspect your packets to see which packets are real HTTP packets and HTTP proxy packets.&lt;/p&gt;&#xA;&lt;p&gt;You can't block this application only with port numbers.&lt;/p&gt;&#xA;" OwnerUserId="19274" LastEditorUserId="31801" LastEditDate="2020-10-24T19:33:07.013" LastActivityDate="2020-10-24T19:33:07.013" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22894" PostTypeId="1" AcceptedAnswerId="22896" CreationDate="2015-09-29T15:22:22.747" Score="11" ViewCount="33077" Body="&lt;p&gt;So I've got this task where I have to setup a virtual network with an OSPF routing protocol. I firstly ignored this loopback interface I had to configure on the routers since it didn't do any difference in this virtualization software called Cisco Packet Tracer (I thought). Then I've built the network in real life with some Cisco routers and it didn't do anything either. With or without this loopback the network worked (pinging from one host to another).  Now my question is: Why is this loopback interface needed or what function does it do? In the picture below is the network I had to build (if it is any help).&lt;a href=&quot;https://i.stack.imgur.com/TLEFV.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TLEFV.png&quot; alt=&quot;Network configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16256" LastEditorUserId="8499" LastEditDate="2018-12-22T03:53:50.697" LastActivityDate="2019-01-25T19:43:06.893" Title="Whats's the function of a loopback interface in routing protocols?" Tags="|cisco|routing|ospf|packet-tracer|loopback|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22895" PostTypeId="2" ParentId="22894" CreationDate="2015-09-29T15:38:08.280" Score="4" Body="&lt;p&gt;First, loopbacks interfaces are mainly used when we want to establish adjacencies between 2 equipments (i.e. routers) and to be sure that when one link fails, the adjacency will not go down because, loopbacks interfaces are logical interfaces, and you can reach them by different ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another use for this is to announce some networks. Networks can only be anounnced even if the existed in the routing table. I guess, in the above example, when you comment all the loopbacks interfaces, one use that can be done for this, is to announce some networks and see how OSPF can work, but, even if you use or not loopbacks interfaces, your configuration must work fine. &lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="53804" LastEditDate="2019-01-25T19:39:44.613" LastActivityDate="2019-01-25T19:39:44.613" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="22896" PostTypeId="2" ParentId="22894" CreationDate="2015-09-29T15:38:16.040" Score="6" Body="&lt;p&gt;The loopback interface is useful because it is an interface with an IP address which never goes down.  OSPF, without a specifically defined Router ID, will pick a Router ID on its own.  It chooses the Router ID from the IP addresses of the configured and enabled interfaces.  A loopback is a good choice since the loopback interface is always up unless someone specifically shuts it down.  Other interfaces may go down if there is a problem on the link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-29T15:38:16.040" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22897" PostTypeId="2" ParentId="22522" CreationDate="2015-09-29T15:56:58.777" Score="7" Body="&lt;p&gt;Some corrections to the above answer. Port-id and port-priority are different. One is configurable. The other is internally set. I'll make an attempt to answer your question below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There has to be just 1 root port per switch. By definition , this is the port with the lowest &lt;strong&gt;path-cost&lt;/strong&gt; to root. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A path-cost is the sum of all port-costs along a given path. And&#xA;port-cost is set by the speed of the link connected to a given&#xA;port.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now lets look at your diagram. SW3 has 2 paths to the root, and both go through SW2. Assuming that both the links out of SW3 are the same speed, the port-cost is identical. So the path cost is the same out of both its ports. Now we need a tie-breaker, cuz we can have only 1 root port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default, STP uses the bridge-id of neighboring switch to break the tie. But since the neighboring switch is the same switch here (SW2), STP next uses &lt;strong&gt;port-priority of the neighboring switch&lt;/strong&gt; to break the tie. This is something that can be manually configured. But lets say that in your case, its at default, and therefore at the same setting on both switches. So STP falls to something that &lt;strong&gt;has&lt;/strong&gt; to be unique. And this final fallback is &lt;strong&gt;the internal port-id&lt;/strong&gt;. This is not the same as the interface number (0/1,0/2..) but is an integer that is mapped to the interface number internally. And usually lower interface numbers, are mapped to lower ordered port-ids.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-09-29T15:56:58.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22898" PostTypeId="2" ParentId="22499" CreationDate="2015-09-29T17:43:06.443" Score="4" Body="&lt;p&gt;Yes. In short , during convergence and election, all switches will originate BPDUs. Once converged, and root has been elected, only the root will originate it. Remaining switches will continue forwarding it though.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-09-29T17:43:06.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22899" PostTypeId="2" ParentId="22859" CreationDate="2015-09-29T17:57:47.597" Score="5" Body="&lt;p&gt;To add to the previous comment, there are two MTU settings in the network itself that needs to be set. There is the Ethernet MTU , which you set on the switches. Again, set this to the maximum permissive value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there is the IP MTU you set on routers. Typically, if there are no options set (like the DF bit), then this just means the router will fragment when a packet exceeds this size. If you have the DF bit (do not fragment) set , then the router will drop a packet that is above its permitted IP MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Coming to your question - the IP MTU is not of concern, since you arent using any option bits, it will just fragment at the set size. But the Ethernet MTU has to be greater than your MSS. Another way of saying this is that the MSS should be smaller than the ethernet MTU size. Generally, you wont set this MSS manually, but rather use path-mtu discovery, which finds the least MTU between two end points, and adjusts the MSS to be lower than that value.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-09-29T17:57:47.597" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22900" PostTypeId="2" ParentId="22857" CreationDate="2015-09-29T18:04:23.840" Score="2" Body="&lt;p&gt;To add a different perspective to the already provided answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When an application wants to do transfers between clients on the same network without proxying through some sort of remote server, the application typically makes use of Broadcasts to allow the clients to &quot;detect each other&quot; on the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how Windows NFS works, in fact.  Windows machines broadcast to each other over the local network to determine what other machines are on the workgroup, and or what resources are available for sharing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dropbox does the same thing.  If my phone and my laptop are connected to the same Dropbox account and connected to the same WiFi.  What I share on my phone gets synced to my PC with a local LAN communication.  (My phone will still upload to DropBox on the Internet, but it would spare my PC from having to download the new file from the Internet, since it is available at a higher speed locally)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR /&gt;&#xA;To tie it back in to your question.  There isn't a way for a remote server to learn whether two clients might be on the same network.  BUT, there is absolutely a way for the two clients to discover for themselves whether they are on the same network, and then report their 'finding of each other' back to the remote server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ron said, the Remote server can't assume the two clients are on the same LAN if they share an IP address.  Neither should the two clients assume they are on the same LAN just because they share the same Gateway (or even Gateway MAC address, &lt;a href=&quot;https://supportforums.cisco.com/discussion/11824496/hsrp-relevance-group-best-practice&quot; rel=&quot;nofollow&quot;&gt;HSRP mac address collisions are not as rare as you think&lt;/a&gt;), or each have an address in the same IP Network.  Their surefire way of detecting whether they are on the same network is via some sort of discovery mechanism.  &lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-09-29T18:04:23.840" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22901" PostTypeId="2" ParentId="17911" CreationDate="2015-09-29T18:05:47.213" Score="3" Body="&lt;p&gt;Have you considered setting the link debounce timer to a higher value than its default (which I think is 100ms)? This basically delays the notification that the link has flapped, and can affect reconvergence.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-09-29T18:05:47.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22902" PostTypeId="2" ParentId="13003" CreationDate="2015-09-29T18:09:33.823" Score="4" Body="&lt;p&gt;Ah, been there, done that!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which vrf are you pinging from. By default the IP is on the MGMT vrf. So you do a ping sourcing it from the mgmt vrf. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also that mgmt network has to be routable to where the IPs of these servers you are pinging are sitting. Otherwise, it wont ping , even if it is on the same switch.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-09-29T18:09:33.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22904" PostTypeId="1" CreationDate="2015-09-29T18:33:47.057" Score="4" ViewCount="248" Body="&lt;p&gt;I have an upcoming project in which I need to create and divide our company production , database, web, etc. servers into different vlan and how certain users (regular user, admins) with rights is able to have access to certain servers. Currently all the servers are on the same subnet /20 and users are on a different subnet /24. What would be the best way to approach this considering we have 100 servers and 200 users?  Please state the pros and cons of each approach. Any suggestion is appreciated. Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="19376" LastActivityDate="2015-09-29T20:24:59.433" Title="VLAN Segmentation Project" Tags="|cisco|routing|switch|router|vlan|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22905" PostTypeId="2" ParentId="22515" CreationDate="2015-09-29T18:42:01.330" Score="7" Body="&lt;p&gt;If i remember, default spanning tree (802.1d) takes about &lt;em&gt;50 secs to reconverge&lt;/em&gt;. That is the duration for which you will be losing frames.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A link is detected down by the loss of 10 hello pkts. These are usually 2 secs apart. So total=20 secs. This is called the &lt;strong&gt;max-age timer&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Next it has to transition another blocked port through listening and learning states into a forwarding state. This transitioning takes 15 secs for listening state, and 15 for learning. So total=30 secs. These are called the &lt;strong&gt;forward-delay timers&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Sure, you can modify these timers to make is quicker. Or use RSTP(Rapid Spanning tree), which is more like the defacto now. RSTP is much quicker, as takes just a few secs to reconverge. &lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-09-29T18:42:01.330" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22906" PostTypeId="2" ParentId="22904" CreationDate="2015-09-29T18:55:01.453" Score="0" Body="&lt;p&gt;I would create VLANs (w/ SVIs) for each group that needs to be separated.  That is the easy part.  As far as permissions, you can do it the easy way via AD or the hard way would be access lists based on users IP addresses that are assigned to them. You can use reservations in DHCP, but at the scale you are talking this would never work efficiently. There are some good security tools (Cisco ISE) that can look into the type of traffic and allow or block based on users/systems, etc.&lt;/p&gt;&#xA;" OwnerUserId="19377" LastActivityDate="2015-09-29T18:55:01.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22907" PostTypeId="2" ParentId="22904" CreationDate="2015-09-29T18:58:29.323" Score="5" Body="&lt;p&gt;100 servers and 200 users - there are a lot of ways to segregate that. But since you have clearly said that you want to divide by function (prod, db, web, etc) I'd suggest the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SERVERS:&lt;/strong&gt; Take the 100 servers that are currently on the /20. Divide them up by function. For each function, add in 'room-for-growth'. This is probably the hard part. But better to plan at this stage. Then start subnetting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your requirement, it may or may not make sense to have a consistent mask throughout. Say one subnet needs only 4 ips, and another needs 200, it doesnt make sense to keep a /24 throughout. But if the numbers are more or less the same, then use the same mask. Consistency will pay off when you are trying to automate things later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;USERS:&lt;/strong&gt; Then take the user network, and segment it similar to what you did for the servers. These are both independent of each other, I assume. You will have IP ACLs on a higher protocol layer , to control access.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastEditorUserId="19373" LastEditDate="2015-09-29T20:24:59.433" LastActivityDate="2015-09-29T20:24:59.433" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="22909" PostTypeId="2" ParentId="22904" CreationDate="2015-09-29T19:01:16.273" Score="2" Body="&lt;p&gt;You can create access-list, that can be applied on the interfaces in outgoing direction, matching some traffic with the IP that you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you can work with iptables on your server,. but, on the other hand, why you want to use vlans??&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-09-29T19:01:16.273" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22910" PostTypeId="2" ParentId="22881" CreationDate="2015-09-29T19:26:25.583" Score="2" Body="&lt;p&gt;I work with a High School and some of the students are using &lt;a href=&quot;https://psiphon3.com/en/index.html&quot; rel=&quot;nofollow&quot;&gt;Psiphon&lt;/a&gt; to get around our web filter. So I believe we were having a similar issue. We found that A third party managed firewall and web filter filled our needs better than closing so many ports that have important services running on them. We used &lt;a href=&quot;http://www.iboss.com/&quot; rel=&quot;nofollow&quot;&gt;iboss&lt;/a&gt; for our web filter and firewall and we were able to curtail the problem with Psiphon.&lt;/p&gt;&#xA;" OwnerUserId="19249" LastActivityDate="2015-09-29T19:26:25.583" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22913" PostTypeId="1" AcceptedAnswerId="22915" CreationDate="2015-09-30T00:15:38.040" Score="4" ViewCount="22657" Body="&lt;p&gt;I am preparing for CCNA and i came across both VTP and DTP. It seems confusing. Are they both trunking protocols to trunk interfaces? But the modes are different for each. Can someone explain how they differ or same?&lt;/p&gt;&#xA;" OwnerUserId="19381" LastEditorUserId="19381" LastEditDate="2015-09-30T00:47:50.940" LastActivityDate="2018-03-21T18:34:39.217" Title="Whats the difference between VTP and DTP" Tags="|cisco|routing|switch|router|ethernet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22914" PostTypeId="2" ParentId="22913" CreationDate="2015-09-30T00:21:00.230" Score="3" Body="&lt;p&gt;DTP allows two switches to dynamically negotiate establishing a trunk link between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VTP allows two switches to share VLAN information (or the VLAN database) across a trunk link.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-09-30T00:21:00.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22915" PostTypeId="2" ParentId="22913" CreationDate="2015-09-30T00:21:26.743" Score="9" Body="&lt;p&gt;VTP and DTP are two different things.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In summary, &lt;em&gt;VTP is a protocol used to share VLAN information&lt;/em&gt; within a domain among connected switches. On the other hand, &lt;em&gt;DTP is a protocol used to negotiate trunking between switch ports on either ends of a link&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h1&gt;DTP&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Think of it this way - if you want to automatically setup trunk interfaces on one switch, when the other side is requesting a trunk, you turn to DTP (Dynamic Trunking Protocol). Using the right settings, you’d be able to automatically set an interface to trunk mode, if it is connected to another switch.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;VTP&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Now lets say you have multiple VLANs that you need to create in your network. But you don’t want to bother going to every single switch and creating these VLANs. So you turn to VTP. You configure the right settings, and you just create the VLANs on one switch. VTP also propagates these VLANs to other switches that are set to client-mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, they are independent of each other, except for very little overlap. Like for instance, if you have VTP domains configured on 2 switches, and the domains mismatch, then this affects DTPs ability to negotiate trunking between them. But for the purpose of your CCNA, this level of detail is not required.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-09-30T00:21:26.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22916" PostTypeId="1" AcceptedAnswerId="22917" CreationDate="2015-09-30T01:14:35.340" Score="5" ViewCount="335" Body="&lt;p&gt;I read about CDP - which says its a cisco protocol. It lists devices that are connected to each other. But if i don't have all cisco vender, how can I see what connects where?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have cisco router R1 connected to another vender router R2, and from there to another cisco R3. CDP can only show R1 connecting to R3? How can I see R2?&lt;/p&gt;&#xA;" OwnerUserId="19381" LastActivityDate="2015-09-30T17:59:42.120" Title="Finding what devices are interconnected" Tags="|cisco|routing|switch|cisco-ios|cisco-catalyst|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22917" PostTypeId="2" ParentId="22916" CreationDate="2015-09-30T01:16:57.423" Score="3" Body="&lt;p&gt;Actually even with CDP you cannot see R3 as being neighbors with R1. &#xA;CDP, is &lt;strong&gt;link-local&lt;/strong&gt;. Which basically means that CDP can only show devices directly connected as neighbors 1 hop away. In your example, R3 is two hops away. Unless it has another directly connected link to R1, it won't become a CDP neighbor.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What you are looking for is LLDP. Its can run on CISCO as well as most other vendor gear. And it functions similar to CDP - shows the immediate neighbor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-09-30T01:16:57.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22918" PostTypeId="2" ParentId="22916" CreationDate="2015-09-30T01:20:38.813" Score="1" Body="&lt;p&gt;As @ajaysdesk writes, CDP and LLDP are only valid on the link on which they are originated. These protocols use special layer-2 frames which are not switched or routed beyond the device on the other end of the link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-30T01:20:38.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22919" PostTypeId="1" CreationDate="2015-09-30T01:26:32.940" Score="2" ViewCount="271" Body="&lt;p&gt;I was wondering if its possible that in a p2p network; for example, Gnutella, that one node could establish a static routing with another node. I know that in a p2p network each node acts like a client and a server, so that figure would be possible&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, I would like to know if in this type of networks ,a node would be able to sent a message by passing through some other specific node,  by using static routing, before reaching its destination.&lt;/p&gt;&#xA;" OwnerUserId="19383" LastEditorUserId="17452" LastEditDate="2015-09-30T15:16:22.927" LastActivityDate="2015-09-30T15:16:22.927" Title="is it possible to do static routing in a peer to peer network?" Tags="|routing|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-12T18:33:10.857" ContentLicense="CC BY-SA 3.0" />
  <row Id="22920" PostTypeId="2" ParentId="22919" CreationDate="2015-09-30T01:42:50.717" Score="3" Body="&lt;p&gt;Routing is a layer-3 function.  An application, like Gnutella, happens at a higher layer which uses layer-4 for the end-to-end connection.  Routing is independent of the application.  Certainly, there is probably static routing between such applications, but the application is unaware of the routes used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, new technologies (e.g. SDN) will allow the application to have more say in how routing happens.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-30T01:42:50.717" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22921" PostTypeId="2" ParentId="22831" CreationDate="2015-09-30T02:08:14.427" Score="2" Body="&lt;p&gt;When you 180.180.1.2, you are actually pinging the outside interface of your router, which connects to your ISP. The inside interface is sitting on the 192.168.1.0/24 network, and in this case it probably is the .1 ip!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now when you ping a random website, you are actually pinging the web server itself that hosts your site. &lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-09-30T02:08:14.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22922" PostTypeId="1" CreationDate="2015-09-30T02:15:59.843" Score="1" ViewCount="1096" Body="&lt;p&gt;It is not uncommon for large routers to have unpredictable, random port allocation (which cripples UDP hole punching by making port prediction impossible) and for firewalls (not the software firewall built into your device, but something more upstream) to block all outgoing UDP and TCP traffic except for TCP on ports 80 and 443. This doesn't stop Skype from working - I have used Skype behind such routers and Skype will just relay all the data over a server listening on port 80 or 443. Computer viruses could do the same thing - just relay traffic over a server and make it look like an HTTP get request or something like that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how does random port allocation (symmetric NAT) improve security? What about blocking all outgoing UDP? Blocking all outgoing TCP other than port 80 and 443? It seems to me that these measures mostly just make my Skype slow and inconvenience people.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;* Update *&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm asking why is it that large (symmetric, carrier grade, large scale, etc.) routers often choose random (between 1024 and 65535) ports rather than predictable (3000, 3001, 3002, etc.) ports that are easy to guess and why local businesses drop all outgoing UDP packets and send in RST packets to kill any TCP connections that aren't directed at port 80 or port 443.&lt;/p&gt;&#xA;" OwnerUserId="15975" LastEditorUserId="8499" LastEditDate="2019-01-02T22:03:59.490" LastActivityDate="2019-01-02T22:03:59.490" Title="Why do routers (and router firewalls) go through so much effort to make peer-to-peer difficult?" Tags="|router|tcp|firewall|nat|udp|" AnswerCount="2" CommentCount="4" ClosedDate="2017-08-06T21:04:35.157" ContentLicense="CC BY-SA 3.0" />
  <row Id="22923" PostTypeId="2" ParentId="22922" CreationDate="2015-09-30T02:28:39.413" Score="6" Body="&lt;p&gt;You are confusing a couple of things: firewalls, and NAT. While it's true that you can have NAT on many firewalls, they are not even close to the same technologies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP hole punching is used on NAT, which may or may not be configured on a firewall or plain old router. NAT is designed for IPv4 address conservation, not security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A firewall will typically block traffic originated from an outside source. If the conversation is started from inside the firewall, the destination host outside the firewall is allowed to continue the conversation through the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many home router/NAT/firewall combinations tend to confuse people. You can usually turn off NAT if you have enough public IP addresses, but leave the firewall enabled, or vice versa.  Many even allow the router and NAT to be disabled while preserving the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to separate these disparate technologies and rethink your question.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-30T02:28:39.413" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="22924" PostTypeId="1" AcceptedAnswerId="22925" CreationDate="2015-09-30T03:31:08.990" Score="1" ViewCount="652" Body="&lt;p&gt;I live in a dorm where our wing has about 15 rooms, each with a physical LAN port from a wing switch, which is our link to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To mess with the subnet, I spoofed my MAC to my friend's MAC address. I've done this before, and it just leads to loss of packets at worst, but this time it lead to serious consequences.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My friend's LAN port is not responding at all. It is powered up, but all packets sent up are dropped. Even DHCP requests are not acked. Put a static IP and Broadcast ARPs are dropped too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can the switch do this, ban a physical port? Or there is some other problem I am unaware of? How to fix this?&lt;/p&gt;&#xA;" OwnerUserId="19386" LastActivityDate="2015-09-30T04:04:35.310" Title="Can a switch block a physical port?" Tags="|switch|mac-address|" AnswerCount="1" CommentCount="1" ClosedDate="2015-09-30T10:35:37.530" ContentLicense="CC BY-SA 3.0" />
  <row Id="22925" PostTypeId="2" ParentId="22924" CreationDate="2015-09-30T03:59:35.073" Score="2" Body="&lt;p&gt;If you &lt;em&gt;didn't physically connect&lt;/em&gt; another machine to the port where your friend is connected, but just spoofed his Mac, then it's possible that somewhere along the route a switch saw what it calls a &lt;strong&gt;'mac-flap'&lt;/strong&gt; . &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Basically, it learnt a Mac through one port, and now it sees the same Mac on another port. The switch can be set to do several things as a result of this, from err-disabling to suspending l2 learning for a brief period&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As the previous commenter stated, find the model of switch, and then its capabilities.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastEditorUserId="19373" LastEditDate="2015-09-30T04:04:35.310" LastActivityDate="2015-09-30T04:04:35.310" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22928" PostTypeId="2" ParentId="22922" CreationDate="2015-09-30T09:15:57.763" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I honestly think that you don't understand the question&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't understand your question either, and it's probably because I believe you're operating under incorrect assumptions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me be clear - your provider doesn't care about you trying to NAT traverse to make your Skype calls better. They care about making money, minimizing outages, and lowering their transit costs if they're not tier 1. That's basically it. The &quot;large scale&quot; or &quot;carrier grade&quot; routers you're referring to have very little to nothing to do with NAT or &quot;picking ports&quot;. Even routers that are directly upstream of the router in your home (or the the Winn Dixie), don't care about NAT. The whole point of NAT is that your end device &lt;em&gt;doesn't know it's being NATed&lt;/em&gt;, and the carrier's edge router doesn't care - they see a destination IP address and a source IP address which they have allocated to you, and they want to get those packets off of their network as quickly as possible. As Ron has said, NAT was designed for address preservation/conservation and &quot;mobility&quot; in mind, so that customers at the edge of the carrier's network could make the most use out of their allocated address space. Most routers at the &quot;large&quot; scales you're referring to are not deployed in production networks with design considerations that involve doing any kind of NAT, they're implemented for their FIB/RIB capacity, port density, type of interfaces available, TCAM size, backplane speed, etc. etc. The finger pointing regarding the port selection need not be at the carrier and their equipment, it needs to be squarely at the client initiating the connection and its upstream first-hop L3 device that's performing the NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if your question is, &quot;why don't the clients pick easy to guess ports?&quot; (or say sequential ports), the answer is many implementations had done just this when choosing an ephemeral port: &quot;take the last currently in-use port, add one, get new ephemeral port&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you need to understand that choosing an ephemeral port isn't only something that the client has to care about - a &quot;collision&quot; would occur in the following scenario (somewhat simplified and contrived):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CLIENT_IP:EPH_PORT     &amp;lt;----FIN----       WEBSERVER:80&#xA;CLIENT_IP:EPH_PORT     --FIN/ACK--&amp;gt;       WEBSERVER:80&#xA;CLIENT_IP:EPH_PORT     &amp;lt;----ACK----       WEBSERVER:80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So now the client's state of the connection is gone, and the webserver's TCP session is in &lt;code&gt;FIN_WAIT&lt;/code&gt;. If the client used the &quot;next available + 1&quot; ephemeral port criteria, and used the same ephemeral port that it used previously to connect to the same webserver while the previous session was still in &lt;code&gt;FIN_WAIT&lt;/code&gt; on the webserver, there would be a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the blocking of everything outbound but 80 and 443, that's again up to the person that manages the equipment at the edge, not the carrier. Carriers simply just don't do this. If I'm feeling like an extremely cautious or paranoid admin and I was managing the network infrastructure/WiFi in a highly public place, I would likely do the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT is not a means of security. The ephemeral ports chosen for NAT can be and sometimes are obfuscated for security measures however, as you've noticed; an attacker can in fact do nefarious things if they have a means of easily guessing the next ephemeral port used in a transport-layer flow.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2015-09-30T09:28:44.800" LastActivityDate="2015-09-30T09:28:44.800" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="22931" PostTypeId="1" CreationDate="2015-09-30T11:03:39.990" Score="1" ViewCount="100" Body="&lt;p&gt;recently i have a problem with &lt;em&gt;Juniper SSG-140&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's timing out on pings and also to requests to websites on its LAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of one of the erraticisms: identical trace routes to similar IPs, one works exactly as expected the other one fails:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER-&amp;gt; trace 8.8.4.4 &#xA;Type escape sequence to escape &#xA;&#xA;Send ICMP echos to 8.8.4.4, timeout is 2 seconds, maximum hops are 32, &#xA;1 1ms 1ms 2ms xx.xxx.208.3 &#xA;2 1ms 1ms 0ms xx.xxx.54.53 &#xA;3 2ms 1ms 1ms xx.xxx.55.253 &#xA;4 1ms 2ms 1ms xx.xxx.55.221 &#xA;5 1ms 1ms 1ms xx.xxx.50.121 &#xA;6 1ms 1ms 1ms xx.xxx.51.2 &#xA;7 1ms 1ms 1ms xx.xx.211.178 &#xA;8 3ms 3ms 3ms 216.239.47.223 &#xA;9 2ms 2ms 2ms 209.85.255.143 &#xA;10 2ms 2ms 3ms 8.8.4.4 &#xA;Trace complete &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The other:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER-&amp;gt; trace 8.8.8.8 &#xA;Type escape sequence to escape &#xA;&#xA;Send ICMP echos to 8.8.8.8, timeout is 2 seconds, maximum hops are 32, &#xA;1 2ms 18ms 19ms xx.xxx.208.3 &#xA;2 * 58ms 2ms xx.xxx.54.53 &#xA;3 9ms * * &#xA;4 * 6ms 17ms xx.xxx.55.221 &#xA;5 10ms * 18ms xx.xxx.50.121 &#xA;6 * * 9ms xx.xxx.51.2 &#xA;7 4ms 5ms * &#xA;8 * 8ms 13ms 216.239.47.223 &#xA;9 13ms 14ms 13ms 216.239.46.85 &#xA;10 5ms 9ms 14ms 8.8.8.8 &#xA;Trace complete &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The hops along the way are identical until hop 9.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been working with network engineers on the upstream network and they can't see any problems their end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why might the results from the two trace routes be so different, when the routes are so similar? Could it be a sign the router's on its way out?&lt;/p&gt;&#xA;" OwnerUserId="19395" LastEditorUserId="17452" LastEditDate="2015-09-30T14:06:21.193" LastActivityDate="2015-11-29T15:22:00.863" Title="Troubleshooting ageing router? Two almost identical trace routes, one fine the other not" Tags="|routing|" AnswerCount="1" CommentCount="5" ClosedDate="2019-04-03T00:28:15.957" ContentLicense="CC BY-SA 3.0" />
  <row Id="22932" PostTypeId="2" ParentId="22931" CreationDate="2015-09-30T11:47:07.997" Score="2" Body="&lt;p&gt;If you want to measure the difference between the two traces, you can ping directly 8.8.8.8 and 8.8.4.4 and see the time response to know if there is a big difference in the delay. You can use the options (for Wndows) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-n for increasing the number of ping and having a best average&#xA;-w for increasing the delay of the response&#xA;ping -w 5000 -n 50 8.8.8.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Concerning the difference in the results of yours traces, maybe yours packets (or the packets of response) doesn't take the sames routes during their transits. This may be due to dynamic routing in your network.&lt;/p&gt;&#xA;" OwnerUserId="19274" LastActivityDate="2015-09-30T11:47:07.997" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="22933" PostTypeId="1" AcceptedAnswerId="22934" CreationDate="2015-09-30T12:16:52.523" Score="5" ViewCount="5245" Body="&lt;p&gt;Referring  &lt;a href=&quot;http://www.faqs.org/rfcs/rfc1071.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.faqs.org/rfcs/rfc1071.html&lt;/a&gt;, I try to deduce the c code for calculating the checksum for ICMPv6. But check with the checksum parse by wireshark, I find that the answer got from my code is wrong... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the checksum parsed by wireshark is 0x8e73.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the following is my code, that is exactly same as mentioned in RFC.&#xA;NOTE : the array data is the raw data got from the ICMPv6&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned short checksum(unsigned short *addr, unsigned short count)&#xA;{&#xA;    unsigned long sum;&#xA;&#xA;    sum = 0;&#xA;    while (count &amp;gt; 1) {&#xA;            sum += *(unsigned short*)addr++;&#xA;            count -= 2;&#xA;            printf(&quot;sum is %x\n&quot;, sum);&#xA;    }&#xA;&#xA;    /*  Add left-over byte, if any */&#xA;    if (count){&#xA;            sum += *(unsigned char *)addr;&#xA;            printf(&quot;in side left-over byte\n&quot;);&#xA;    }&#xA;    /*  Fold 32-bit sum to 16 bits */&#xA;    while (sum &amp;gt;&amp;gt; 16) {&#xA;            sum  = (sum &amp;amp; 0xffff) + (sum &amp;gt;&amp;gt; 16);&#xA;            printf(&quot;IN while:sum is %x\n&quot;, sum);&#xA;    }&#xA;    printf(&quot;sum is %x\n&quot;, sum);&#xA;    return (unsigned short)(~sum);&#xA;}&#xA;&#xA;int main() {&#xA;    unsigned short count = 32;&#xA;    //data is the raw data for ICMPv6 got from wireshark, and I put the checksum field as 0x0000&#xA;    unsigned short data[] = {0x8800, 0x0000, 0x6000, 0x0000, 0xfe80, 0x0000, 0x0000, 0x0000, 0xb96b, 0x982f, 0x447a, 0x6a80, 0x0201, 0x6057, 0x187d, 0x7fad};&#xA;&#xA;&#xA;    printf(&quot;check sum is %x\n&quot;, checksum(data, 32));&#xA;    return 0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18903" LastEditorUserId="8499" LastEditDate="2018-12-26T04:32:35.910" LastActivityDate="2018-12-26T04:32:35.910" Title="Calculating checksum for ICMPv6" Tags="|protocol-theory|icmp|rfc|checksum|icmpv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22934" PostTypeId="2" ParentId="22933" CreationDate="2015-09-30T12:29:43.390" Score="5" Body="&lt;p&gt;ICMP and ICMPv6 are two different protocols. For ICMPv6 checksum callulation see &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2463&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC2463&lt;/a&gt; section 2.3 and the documents reffered there.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-09-30T12:29:43.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22936" PostTypeId="2" ParentId="22933" CreationDate="2015-09-30T13:29:48.583" Score="3" Body="&lt;p&gt;Thanks for Jens's help. After having look for RFC2463. I pre-append the following data for the pseudo header. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;unsigned short src_ip[8] = {0} //fill the source IP&#xA;unsigned short dst_ip[8] = {0} //fill the destination IP&#xA;//0x0020 is the packet length of ICMPv6&#xA;//fill 3bytes of zero and 0x3a is the type of ICMPv6, so we have&#xA;//0x00, 0x003a&#xA;unsigned short remain[] = {0x0020, 0x0000, 0x003a} &#xA;unsigned short data[] = {} //as before&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So concatenate all this data, send it to the check_sum algorithm[this part is same as icmp], we can derive the correct checksum!&lt;/p&gt;&#xA;" OwnerUserId="18903" LastActivityDate="2015-09-30T13:29:48.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22940" PostTypeId="1" AcceptedAnswerId="33556" CreationDate="2015-09-30T18:14:56.990" Score="4" ViewCount="213" Body="&lt;p&gt;What happens to data being sent into a circuit-switched network when the incoming data rate exceeds the bandwidth of the network? &lt;/p&gt;&#xA;" OwnerUserId="19402" LastActivityDate="2016-07-28T01:21:26.347" Title="Circuit-Switched Network" Tags="|network-core|data|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22942" PostTypeId="2" ParentId="22940" CreationDate="2015-09-30T21:38:37.830" Score="2" Body="&lt;p&gt;Such problem couldn't happen with circuit switching because, in circuit switching, a route and bandwidth is reserved from source to destination. Sometimes circuit switching can be relatively inefficient because capacity is &lt;strong&gt;&lt;em&gt;guaranteed&lt;/em&gt;&lt;/strong&gt; on connections which are set up but are not in continuous use, but rather momentarily. However, the connection is immediately available while established.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;examples of circuit switching are PSTN , ISDN , Optical mesh network such types of network where the media designed to carry fixed number of calls for example in case of PSTN . &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Please make use of this link &lt;a href=&quot;https://en.wikipedia.org/wiki/Circuit_switching&quot; rel=&quot;nofollow&quot;&gt;Circuit switching&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2016-03-29T15:39:23.807" LastActivityDate="2016-03-29T15:39:23.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22943" PostTypeId="1" AcceptedAnswerId="22946" CreationDate="2015-09-30T22:57:07.993" Score="2" ViewCount="437" Body="&lt;p&gt;Ok so I am taking over a network and I'm trying to figure out the best topology for it and looking for some advice on what you experts think.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, the ISP demarc goes to an unmanaged switch (Switch 1). Switch 1 then has a link to the WAN port on Router 1 (Sonicwall 220), and 2 ports to the same  Windows server (handling AD and DNS). DHCP is handled by the router currently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 1 then has a link from it's WAN port to port 49 of Switch 2 (Netgear FS750T2). Then the rest of the managed devices are as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port 50 Switch 2 -&gt; Port 49 Switch 3&#xA;Port 50 Switch 3 -&gt; Port 49 Switch 4&#xA;Port 50 Switch 4 -&gt; Port 49 Switch 5&#xA;Port 50 Switch 5 -&gt; Port 49 Switch 6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One if not two of those switches will be taken out, as only a few ports on each are really being used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a couple questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Is going from the ISP -&gt; unmanaged switch -&gt; router OK? Or should the ISP go directly to the router and leave the unmanaged switch out? The Router will be changed to a Sonicwall 2600, giving me more ports on the router.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Should the switches be trunked on those ports at all? Is just a direct link OK? &#xA;Or should each switch go to a port on the router? These are not VLAN'd at all.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I'm thinking the server should have 1 nic to different devices for redundancy. Right now both NICs are just set to .10 and .11 on the same network. However, where does that fit in if I skip the unmanaged switch (Switch 1) and going directly to the router?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated. It's for a call center and I have a few weeks before things start getting crazy. So if I'm going to start taking things down and rearranging devices now is the time. Thank you for all your help ahead of time.&lt;/p&gt;&#xA;" OwnerUserId="19406" LastActivityDate="2015-10-01T00:24:34.057" Title="Need some help with taking over a network" Tags="|routing|switch|design|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22944" PostTypeId="2" ParentId="22943" CreationDate="2015-09-30T23:16:32.737" Score="0" Body="&lt;p&gt;The SonicWALL is a firewall. It is best to have everything behind the firewall that you possibly can.  You need to discover the reason that the server is not behind the firewall.  It may be a legitimate reason, and you may be able to get around that reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch-to-switch links should be trunks.  Call centers are usually sensitive to single-points-of-failure, and this network design has a bunch of them.  Having the switches daisy-chained, especially such a large chain, leaves you vulnerable to having the loss of a single switch disabling most or all of the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the current switch configuration, having the server connect to two different devices doesn't mean much.  If the first switch in the chain quits working (for whatever reason), all the switches quit being able to get to the firewall.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-09-30T23:16:32.737" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22945" PostTypeId="1" CreationDate="2015-09-30T23:43:15.893" Score="0" ViewCount="350" Body="&lt;p&gt;I have an upcoming project in which I need to create and divide our company production , database,and dev servers into different vlan and how certain users (regular user, admins) with rights is able to have access to certain servers. I have create a simple diagram below to propose how i am going to do this. My question is should i put separate the dev and dev db server or should I combine them together as one vlan? Please let me know the pros and cons for each route. Any suggestion will help! Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current:&lt;a href=&quot;https://i.stack.imgur.com/7ZIgU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7ZIgU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Proposal: &lt;a href=&quot;https://i.stack.imgur.com/6WBXP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6WBXP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19376" LastActivityDate="2015-11-02T00:01:08.023" Title="VLAN segmentation per Server functionality" Tags="|routing|vlan|switching|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22946" PostTypeId="2" ParentId="22943" CreationDate="2015-09-30T23:49:43.433" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uFMOT.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uFMOT.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it seams like you have network like shown&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;first&lt;/em&gt;&lt;/strong&gt; of all it is not proper network design , where cascading switch connection means single point of failure and traffic bottleneck.so you should run star topology.&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;second&lt;/em&gt;&lt;/strong&gt; wan port refer to external connection ,so your router not connected to SW2 via wan port it just Ethernet port and in your case is internal &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;regarding your first question&lt;/em&gt;&lt;/strong&gt; : no problem of have switch here for two purposes&lt;br&gt;&#xA;a) may be in the future you get more services from this ISP (WAN , VPN ..etc) so each one may need single port&lt;br&gt;&#xA;b) port in a switch is  cheaper than port in router &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;regarding your second question&lt;/em&gt;&lt;/strong&gt; : for any switch connect any other switch , ports involved in this connection should be configured as a trunk&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;regarding your third question&lt;/em&gt;&lt;/strong&gt; : keep both link from your server to the switch and make use of great feature &lt;strong&gt;&lt;em&gt;port aggregation&lt;/em&gt;&lt;/strong&gt; or &lt;strong&gt;&lt;em&gt;NIC teamming&lt;/em&gt;&lt;/strong&gt; from the side of server  , which will increase the Bandwidth and add redundancy to your server &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;sure for all unused ports on any switch you should shut it down or remove those switches cause it is consider one of security issue &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-10-01T00:24:34.057" LastActivityDate="2015-10-01T00:24:34.057" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22947" PostTypeId="2" ParentId="22945" CreationDate="2015-10-01T00:17:42.087" Score="2" Body="&lt;p&gt;there is no such problem in follow the normal network hierarchy &lt;strong&gt;&lt;em&gt;(routing traffic is 80% of the allover traffic and the switching traffic is 20%)&lt;/em&gt;&lt;/strong&gt;, so you will create separate VLAN for all servers which will be your server farm , and depend on the specification divide each user group (access same resources , share same functionality ) in separate VLANs &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-10-02T22:40:48.100" LastActivityDate="2015-10-02T22:40:48.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22949" PostTypeId="1" AcceptedAnswerId="22956" CreationDate="2015-10-01T02:16:35.623" Score="0" ViewCount="2207" Body="&lt;p&gt;Since there aren't many resources out there regarding virtual rendezvous protocol, my basic understanding of it seems very similar to BGP. Which basically had me questioning why the protocol even exists. Can anyone please explain VRP, and how it differs from BGP?&lt;/p&gt;&#xA;" OwnerUserId="13422" LastActivityDate="2015-10-01T09:38:14.233" Title="VRP vs BGP protocols" Tags="|bgp|protocol-theory|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22950" PostTypeId="1" AcceptedAnswerId="22951" CreationDate="2015-10-01T03:22:07.680" Score="2" ViewCount="77" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Fiber_optic_splitter&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt; says we need &lt;strong&gt;31&lt;/strong&gt; couplers. Can't we do it with 8 couplers?&lt;/p&gt;&#xA;" OwnerUserId="19319" LastEditorUserId="8499" LastEditDate="2019-01-03T03:16:40.587" LastActivityDate="2019-01-03T03:16:40.587" Title="How many 3 dB couplers are needed to construct a 16 way fiber optic splitter?" Tags="|layer1|cable|fiber|cabling|optics|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22951" PostTypeId="2" ParentId="22950" CreationDate="2015-10-01T04:08:33.603" Score="3" Body="&lt;p&gt;Follow the math in the wiki article: (2^4)-1=15.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-01T04:08:33.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22954" PostTypeId="1" AcceptedAnswerId="22957" CreationDate="2015-10-01T07:42:39.310" Score="2" ViewCount="133" Body="&lt;p&gt;RFC2460 defines some extension headers, like hop-by-hop, Routing Options...etc. All these headers seem to have the next header type and header extension length in the beginning of the header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However there is one extension header called &quot;Encapsulating Security Payload&quot; defined in RFC4303 seems don't have this property. The next header and pad length are followed by a variable data, so how can I parse that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks  &lt;/p&gt;&#xA;" OwnerUserId="18903" LastActivityDate="2015-10-01T08:48:07.363" Title="Parse the Encapsulating Security Payload" Tags="|ipv6|rfc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22956" PostTypeId="2" ParentId="22949" CreationDate="2015-10-01T08:10:35.137" Score="3" Body="&lt;p&gt;actually there is no relation between them , BGP is a routing protocol which in general will be used to exchange routing information (routing table for example) between multi hopped routers , but VRP is sort of communication establish mechanism (between two peers)  SIP and so on . so simply BGP work mainly in layer 3 and VRP work in layer 7 &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-10-01T09:38:14.233" LastActivityDate="2015-10-01T09:38:14.233" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22957" PostTypeId="2" ParentId="22954" CreationDate="2015-10-01T08:48:07.363" Score="2" Body="&lt;p&gt;That is the IPsec ESP header, which encrypts its content. You can parse that if you have the decryption keys. Not being able to parse that content without having the right keys is the whole purpose of that header.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-10-01T08:48:07.363" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="22958" PostTypeId="1" CreationDate="2015-10-01T09:12:52.763" Score="3" ViewCount="365" Body="&lt;p&gt;I have been asked to add a guest Wi-Fi network to our existing Wi-Fi network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have an HP switch (Comware) v1910 and Brocade/Motorola AP 7131.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have created an untrusted interface on the firewall to allow guest users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firewall will provide DHCP in the range 192.168.100.0/24 for users on the guest Wi-Fi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know if this can be implemented and if so how one would go about doing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure how one would implement a VLAN and get this working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help or advice will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="17536" LastEditorUserId="8499" LastEditDate="2015-10-01T14:07:35.533" LastActivityDate="2018-05-19T16:23:44.353" Title="Guest WI-FI implementation - HP switch (comware) and Brocade/Motorola AP 7131" Tags="|switch|wireless|vlan|ieee-802.11|hp-procurve|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22962" PostTypeId="1" AcceptedAnswerId="22991" CreationDate="2015-10-01T12:54:45.190" Score="3" ViewCount="291" Body="&lt;p&gt;I'm trying to understand what it means for users... Does it mean that some content will not load on websites, increasingly so in the upcoming year or so? Does it mean that certain CDNs or hostings will simply not connect? I already have experienced that with some websites on a system with no IPv4 support, where I could connect through Tor, but not through any normal browser, so I'm just wondering.&lt;/p&gt;&#xA;" OwnerUserId="19417" LastActivityDate="2015-10-04T02:10:03.630" Title="Since we ran out of IPv4 now, what does it mean for consumers?" Tags="|ipv4|ethernet|ipv6|internet|ipv6-transition|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22963" PostTypeId="2" ParentId="22962" CreationDate="2015-10-01T13:08:11.850" Score="2" Body="&lt;p&gt;For most people, this means nothing. Telcos still have alot of addresses (used, some even unused).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens, depends on the country and telco. Most probably outcome is, that the cheapest internet packages (for end users) will be behing carrier-grade NAT, and power-users will be able to pay a few $/€/... more to get a public IP. Since alot of users have no idea what a public IP is, they wont pay for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Service providers (CDN, etc.) will continue buying/renting IPs, like they've done until now... until the price gets too high. &lt;/p&gt;&#xA;" OwnerUserId="1220" LastActivityDate="2015-10-01T13:08:11.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22964" PostTypeId="2" ParentId="22962" CreationDate="2015-10-01T13:08:14.077" Score="1" Body="&lt;p&gt;That means that ISP will be on dificulty to expand services to users who needs communicate with its own IP, i guess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex: You want to get a dedicated line with its own IP range and be on charge of that, on this way, and if we look that we ran out of IPv4, the expansion will be dificult. More, one users maybe want to connect also some devices, and not only one, and equipments configured with NAT, only could accepted a fixed number of devices peer IP pool configured, if you want to provide a acceptable QoS in your service.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-01T13:08:14.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22965" PostTypeId="2" ParentId="22962" CreationDate="2015-10-01T13:56:26.613" Score="4" Body="&lt;p&gt;ARIN ran out of IPv4 addresses to supply to the carriers. There is a market for blocks of IPv4 addresses, but it is supply and demand driven.  Since the supply is dwindling, and demand is unabated, the price will be going up.&lt;/p&gt;&#xA;&lt;p&gt;Many carriers have a good supply of addresses, for now.  Other began to use Carrier-Grade NAT (CGN) a while back, and most carriers will implement this in the future.  Unfortunately, CGN can break some things for users of the Internet.&lt;/p&gt;&#xA;&lt;p&gt;Most of the carriers are providing IPv6, too, and the ones that have not yet implemented it are busy doing so now.  The complete Internet transition to IPv6 is many years away, but, even today, about half of the tabs in my browser are connected via IPv6.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7021&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7021, Assessing the Impact of Carrier-Grade NAT on Network Applications&lt;/a&gt;, discusses the implications of CGN on home networks, including several case studies of different scenarios.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-10-04T02:10:03.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22966" PostTypeId="2" ParentId="22958" CreationDate="2015-10-01T14:18:20.427" Score="1" Body="&lt;p&gt;Yes, you can:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration must be on this way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;User-------AP-------------Switch---------------Firewall(DHCP)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;           VLAN_guest      VLAN_guest&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The port of the switch connected to the firewall and the AP must be located on the same VLAN like &quot;Access Ports&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must configure your AP on the way that be a bridge between your LAN and wifi users, on the way to provide the IP address gives by your Firewall and not by your AP.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-01T14:18:20.427" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22967" PostTypeId="1" AcceptedAnswerId="23775" CreationDate="2015-10-01T14:32:45.250" Score="2" ViewCount="720" Body="&lt;p&gt;I've been trying to upgrade the Junos version on some switches and most have gone fine using;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;root@host&gt; request system software add /var/tmp/jinstall-ex-3200-12.3R6.6-domestic-signed.tgz&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However some of them show this instead of the normal &quot;reboot immediately..&quot;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Done with validate on all virtual chassis members&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Before returning to prompt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried rebooting the switches and looking through messages log, however I'm not sure what I'm looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone else experienced this or knows of a fix?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Model: EX4200-24T&lt;/p&gt;&#xA;" OwnerUserId="19420" LastActivityDate="2015-10-27T13:09:51.963" Title="Junos upgrade from 11.4R5.7 to 12.4R6.6" Tags="|switch|juniper-junos|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22968" PostTypeId="2" ParentId="21074" CreationDate="2015-10-01T14:54:07.737" Score="1" Body="&lt;p&gt;If you have some doubt about your bandwidth, you can configure between the 2 switchs an etherchannel, on the way to take a link with more capacity between A and B. If you dont know what it is an etherchannel, it´s a configuration that permit bound a few interfaces to make on logical interface. If you bound 2 Gigabit interfaces on the 2 swithces, you can create a link of 2 Gigabit between then, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Etherchannel will provides you more bandwidth, load-balance and redundancy.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-01T14:54:07.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22970" PostTypeId="2" ParentId="22967" CreationDate="2015-10-01T15:17:43.050" Score="0" Body="&lt;p&gt;The message itself, just means that it validated the software for all members of the VC. How many members does 'Show virtual-ch' display?&#xA;Remember, members running different versions, cannot form a virtual chassis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you try the same install using the 'no-validate' suffix?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw, it  is possible to do NSSU on EX-series. Again, capabilities and version &lt;strong&gt;must&lt;/strong&gt; match.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-10-01T15:17:43.050" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22971" PostTypeId="1" CreationDate="2015-10-01T15:19:36.050" Score="3" ViewCount="1733" Body="&lt;p&gt;I know that coaxial cable can use CSMA/CD but can UTP used it also? and can you guys explain it how is it done or work? thank you so much for your answer&lt;/p&gt;&#xA;" OwnerUserId="19422" LastEditorUserId="8499" LastEditDate="2018-03-21T00:31:24.433" LastActivityDate="2018-03-21T00:31:24.433" Title="Can a UTP cable use CSMA/CD?" Tags="|ethernet|layer1|cable|utp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22972" PostTypeId="1" AcceptedAnswerId="22975" CreationDate="2015-10-01T15:23:08.730" Score="2" ViewCount="100" Body="&lt;p&gt;From RFC2460 :&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2460#section-4.5&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2460#section-4.5&lt;/a&gt;, the length of the fragment header seems to be fixed 8 bytes.&lt;/p&gt;&#xA;&lt;p&gt;But when I test with Scapy with the default fragment header, from sniffer I can see the fragment header is for one byte? That is the data generated by Scapy seems not consistent with the specification?&lt;/p&gt;&#xA;&lt;p&gt;I'm not sure in the real world, what will this header will be designed?&lt;/p&gt;&#xA;" OwnerUserId="18903" LastEditorUserId="8499" LastEditDate="2022-11-20T01:43:53.920" LastActivityDate="2022-11-20T01:43:53.920" Title="The length of Fragment header in IPv6" Tags="|ipv6|layer3|rfc|fragmentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22974" PostTypeId="2" ParentId="22971" CreationDate="2015-10-01T15:25:51.903" Score="0" Body="&lt;p&gt;Yes, UTP permit it. In fact, this is the access mode with Ethernet works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A collision occurs when two or more devices on a network attempt to transmit over a single data channel (e.g., a twisted pair copper wire cable or an optical fiber cable) simultaneously. It is detected by all participating devices, and, after a brief, random, and different interval of time (called a backoff delay) has elapsed for each device, the devices attempt to transmit again. If another collision occurs, the time intervals from which the random waiting times are selected are increased step-by-step in a process referred to as exponential back off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CSMA/CD is a modification of pure CSMA. Carrier sense refers to the fact that a transmitting device listens for a carrier wave (i.e., a waveform that carries signals) before attempting to transmit. That is, it first tries to detect the presence of an encoded signal from another device. If a carrier is sensed, the device waits for the transmission in progress to finish before starting its own transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multiple access describes the fact that multiple devices send and receive on the medium. Transmissions by one node are generally received by all other nodes using the medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Collision detection is used to improve CSMA performance by terminating transmission as soon as a collision is detected, and reducing the probability of a second collision on the next try. The techniques used for detecting collisions depend on the type of media: in the case of electrical wires, for example, collisions are detected by comparing the transmitted data with the received data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CSMA/CD operates at the physical layer is the bottom level in the OSI (open systems interconnection) seven layer model, which is used to standardize and simplify definitions with regard to computer networks. This layer defines all physical and electrical specifications for devices used to interface to the network, and it deals with data only in terms of raw bits (i.e., it does not recognize MAC addresses, IP addresses and packets).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A major feature of CSMA/CD is that it is simple to implement. This has helped make it an international standard and an important part of the ethernet, which is the most widely deployed architecture for LANs (local area networks).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  http://www.linfo.org/csma_cd.html&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-01T15:25:51.903" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22975" PostTypeId="2" ParentId="22972" CreationDate="2015-10-01T15:33:32.480" Score="2" Body="&lt;p&gt;You question is confusing.  The fragmentation header is 8 bytes.  You say the observed payload is 1 byte.  The payload is not the header, and the size of the header has nothing to do with the size of the payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit based on your comment and correction of the the question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fragmentation header is 8 bytes.  You may be reading the results incorrectly, or it is possible that the application you are using doesn't correctly understand what it is seeing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-01T15:48:51.293" LastActivityDate="2015-10-01T15:48:51.293" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="22976" PostTypeId="1" CreationDate="2015-10-01T16:13:49.433" Score="2" ViewCount="504" Body="&lt;p&gt;Network setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router: Netgear FVS318N&#xA;Switch: Netgear GS752TP&#xA;There are two wireless APs connected to the switch, as well as about 15 wired devices, and about 10 wireless devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking for a way to determine which wireless client is using up bandwidth.  &lt;/p&gt;&#xA;" OwnerUserId="19424" LastEditorUserId="1908" LastEditDate="2015-10-01T17:54:53.570" LastActivityDate="2015-10-02T06:39:40.827" Title="How to determine which machine is eating bandwidth" Tags="|monitoring|netgear-prosafe|" AnswerCount="2" CommentCount="2" ClosedDate="2019-02-12T03:56:15.127" ContentLicense="CC BY-SA 3.0" />
  <row Id="22977" PostTypeId="2" ParentId="22976" CreationDate="2015-10-01T16:38:43.873" Score="0" Body="&lt;p&gt;Since you don't give any details, I will have to make some assumptions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I assume you mean that the wireless clients are having difficulties, and you assume that it is a particular client using a lot of bandwidth.  Your assumption may be incorrect.  You may be experiencing wireless interference.  Always start troubleshooting at layer-1, which, in this case, is the airwaves.  You need to get a hardware/software combination that can sniff the airwaves to see what is actually happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, you can use the router/firewall's logging facility to look at the traffic to and from the Internet.  If your problem is inbound, you can look to see if you are experiencing a DoS, or look at the destination addresses to see if one of the devices is streaming some sort of video or something.  If the problem is outbound, you can look at the source addresses to see which device is sending an inordinate amount of traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-01T16:38:43.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22978" PostTypeId="2" ParentId="22404" CreationDate="2015-10-01T16:42:53.263" Score="1" Body="&lt;p&gt;I think one of the issues is the assumption that it looks exactly like a standard IP Packet. Most phones at this time (using standard GSM or CDMA technology) don't use an IP network but older phone technology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The phone itself will not know anything about the end device. It will send some basic information to the carriers voice switch. That switch will handle all of the routing using a combination of SIP for calls to other phones on its network, or SS7 for calls that go to the PSTN (Public Switching Telephone Network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Verizon Wireless, when HD calling is enabled, does do VoIP (SIP) from end to end. When these HD calling phones try to go to a non HD calling phone, they have a device that will transcode the call and do signaling for the PSTN to connect the call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SS7 does not use IPs, it uses point codes for routing (in the format xxx-xxx-xxx). While it doesn't use IPs, it is still data and not analog. It is transferring bits across the signaling path about how the call is going to be setup. Most devices in this path will only know the next hop.&lt;/p&gt;&#xA;" OwnerUserId="19426" LastActivityDate="2015-10-01T16:42:53.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22980" PostTypeId="1" CreationDate="2015-10-01T18:00:46.560" Score="3" ViewCount="20479" Body="&lt;p&gt;Will a device's arp table be updated only upon receiving a reply from a previously sent out arp request, or will it be updated if the device receives a frame/packet ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.&#xA;A send a arp request to B&lt;br&gt;&#xA;B send a arp reply to A&lt;br&gt;&#xA;A's arp table is updated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C sends a packet to A (assuming C already has A's IP/MAC in its arp table)&lt;br&gt;&#xA;A's arp table did not have C's entry for some reason&lt;br&gt;&#xA;A updates its arp table immediately with C's IP/MAC&lt;/p&gt;&#xA;" OwnerUserId="16635" LastEditorUserId="38943" LastEditDate="2017-08-09T20:55:45.577" LastActivityDate="2017-08-09T20:55:45.577" Title="when will an arp table be updated" Tags="|arp|mac|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22981" PostTypeId="2" ParentId="22980" CreationDate="2015-10-01T18:25:17.490" Score="4" Body="&lt;p&gt;The RFC doesn't address your second scenario.  The reason for this is that Host C sending to Host A may not be on the same network as Host A.  Host A having an ARP cache entry in that case doesn't make sense since Host A will never look for Host C in its ARP cache.  Host A will always know Host C is not on its network, so it will always look for its own gateway's entry in its ARP cache when it wants to send to Host C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be implementations that do what you what you describe, but it is not addressed by the standard, and it would seem to waste ARP cache memory.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-01T18:25:17.490" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22982" PostTypeId="2" ParentId="22980" CreationDate="2015-10-01T18:32:08.237" Score="-2" Body="&lt;p&gt;I think you have some issues:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A send a Arp Broadcast request with destination address FF:FF:FF:FF:FF:FF, askin who has some &quot;IP address&quot;. This request arrive to &quot;IP address&quot;, this pc update it arp table and send a reply with it own MAC.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2015-10-02T14:54:33.830" LastActivityDate="2015-10-02T14:54:33.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22983" PostTypeId="2" ParentId="22980" CreationDate="2015-10-01T18:37:08.287" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'll try to answer each of your questions, one after the other. But the premise is that an arp entry will get generated on a host, only when it sees an ARP response. Hosts dont typically do mac-learning from all frames. Switches do that function.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A send a arp request to B B send a arp reply to A A arp table updated.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The right thing to say is A does &lt;strong&gt;not&lt;/strong&gt; send an arp request to B specifically. It sends out an arp request (period). This is addressed to a broadcast MAC. So everyone on the subnet (broadcast domain), including B gets it. Now B sends an arp reply. This is a very specific packet format (see RFC). And once A gets this, it will update its ARP table.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C send a packet to A (assuming C already has A's IP/MAC in its arp table) A arp table did not have C's entry due to some reason A updated its arp table immediately of C's IP/MAC&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;No. In this case, if A doesnt have C's MAC , and needs to send a response to C,  it will first send out an ARP request for the IP-MAC mapping. (a.k.a a WHOIS). And this will go out to the bcast MAC. C, who sees this will respond, and this will cause A to update its mapping&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All of this assumes they are on the same subnet. Otherwise, the gateway comes into picture. See Ron's answer for that.&lt;/p&gt;&#xA;" OwnerUserId="19373" LastActivityDate="2015-10-01T18:37:08.287" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="22985" PostTypeId="1" AcceptedAnswerId="22988" CreationDate="2015-10-01T19:27:10.960" Score="3" ViewCount="1284" Body="&lt;p&gt;I am currently looking to upgrade internet connections in our major offices. Given that our reliance on cloud services has grown, some users are complaining of sluggishly behavior. After testing, as far as I can tell, it is primarily web traffic that is saturating our connection split relatively evenly across all hosts. As such, I have looked at the price of bringing fiber into the building, as well as T1 and OC3 options. But, I have noticed that a 100/100 fiber connection costs only slightly more than T1, with OC3 being ridiculously more expensive. Why is this? Are OC3 and T1 technologies not old and out-dated? Put another way, why would anyone use T1 over fiber in a location where both are available?&lt;/p&gt;&#xA;" OwnerUserId="19429" LastEditorUserId="8499" LastEditDate="2019-01-03T02:40:48.963" LastActivityDate="2019-01-03T02:40:48.963" Title="Why use T1, T3, OC3 in 2015? Why not just pull fiber?" Tags="|layer1|internet|fiber|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22986" PostTypeId="2" ParentId="22381" CreationDate="2015-10-01T19:39:48.803" Score="1" Body="&lt;p&gt;It turns out that for some reason inside hosts where trying to talk to other inside hosts using their public IP. We suspect some sort of service where the public IP is registered. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To prevent the traffic from reaching the ASA we put a routing statement to black-hole traffic coming from the inside to outside addresses.&lt;/p&gt;&#xA;" OwnerUserId="18922" LastActivityDate="2015-10-01T19:39:48.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22987" PostTypeId="2" ParentId="22985" CreationDate="2015-10-01T19:42:46.467" Score="3" Body="&lt;p&gt;You're right. You would just get a MetroE connection ( usually runs EoMPLS at the carrier). &#xA;Prices are cheap. It gives symmetric speeds just like T1 does. And when you need to add more bandwidth, you just let the carrier know. They can add bandwidth in most cases without having to change your link or hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Here are some additional things to consider:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For Metro ethernet (fiber), you'd simply use a fiber patch to connect your equipment to carrier demarc. For OC3, you need specialized modules.&lt;/li&gt;&#xA;&lt;li&gt;If your network and everything is running ethernet already, why choose to convert to sonet, and back again?&lt;/li&gt;&#xA;&lt;li&gt;Ethernet is scalable by design and this can save you money in the long run. A 100 meg ethernet fiber connection on a 1G eth port, can be scaled up or down later by the carrier without requiring additional hardware.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19373" LastEditorUserId="19373" LastEditDate="2015-10-01T19:50:10.730" LastActivityDate="2015-10-01T19:50:10.730" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22988" PostTypeId="2" ParentId="22985" CreationDate="2015-10-01T19:46:19.487" Score="4" Body="&lt;p&gt;Yes, TDM technologies are old, but they are ubiquitous.  The telcos would love to move everyone to IP, and they are working toward that goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are telco customers who are comfortable with the old way of doing things, but as the cost disparity increases, even those customers will likely decide to come into the new world.  That requires a capital layout for both the telcos and the customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real problem is that TDM circuits are available everywhere, and it takes time and money to get IP-based circuits installed everywhere.  Many times, the IP-based circuits that, you as the consumer see as fiber, are actually delivered by the telco as OCx circuits to a conversion box.  You, the customer, only see then end result of the IP-based circuit.  This is a temporary situation while the telcos work toward their goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;FYI Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One big problem we have discovered with ethernet delivered from the carriers is that when the link is actually down, the port still shows up because it is from the carrier equipment to our equipment.  This hasn't really been a problem with leased or owned fiber, only with what we use to connect to to a carrier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of Metro Ethernet, we can mitigate the problem by using devices on each end of the link that support BFD which will drop the link, from the the routing protocol's perspective, far sooner than the routing protocol will determine the neighbor is down.  It is still an irritant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case where the actual circuit is delivered via TDM to a conversion box, we have declined to use the ethernet option becasue, so far, every time the TDM circuit is down, the ethernet shows up.  All the carriers have promised to fix this problem with newer, different equipmet, but there is no real resolution, so far.  BFD is not really an option to mitigate this case since the other end of the link is the PE, and the carriers don't play BFD with us.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-02T02:26:23.407" LastActivityDate="2015-10-02T02:26:23.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22989" PostTypeId="1" AcceptedAnswerId="22993" CreationDate="2015-10-01T20:10:22.977" Score="5" ViewCount="230" Body="&lt;p&gt;My needs will be met by two patch panels with dedicated copper running between them for each port.  &lt;strong&gt;But&lt;/strong&gt; I'm looking at a few hundred ports and I'd rather not have to run a few hundred cables.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Unfortunately, VLANs are not an option (at least not in any configuration I'm aware of)&lt;/strong&gt; so I am looking for some other means of trunking things together onto a single cable while ensuring they remain separate on either end.  Maybe there is something similar to VLANs or maybe there is some way of wrapping one VLAN tag inside another?  I'm hoping there's some sort of switch that will help me accomplish this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Anyways, I'm looking for suggestions!  I've attached my needs and constraints in both text and glorious MS Paint, below.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nfQSU.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nfQSU.jpg&quot; alt=&quot;network doodle&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Vehicles and Computers are physically separated.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Vehicle A must have connectivity to Computer A.  Vehicle B to Computer B, etc.&lt;/li&gt;&#xA;&lt;li&gt;There must be zero connectivity between different Vehicles. (There will be collisions and routing problems)&lt;/li&gt;&#xA;&lt;li&gt;There must be zero connectivity between different Computers. (Bad things will happen)&lt;/li&gt;&#xA;&lt;li&gt;Subnets and masks CANNOT be changed (artifact of vehicle equipment).&lt;/li&gt;&#xA;&lt;li&gt;The traffic between vehicles and computers will already have -multiple- VLAN taggings, and these VLANs will often (but not always) be the same between vehicles.  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; There will be multicast traffic between vehicles and computers.  This traffic must not be shared with other vehicles/computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit2:&lt;/strong&gt; The traffic between vehicles and computers is actually a mixture of VLAN-tagged and untagged traffic.  i.e. a given link may contain packets for VLANs 1, 2, and 3, as well as untagged traffic.&lt;/p&gt;&#xA;" OwnerUserId="19431" LastEditorUserId="8499" LastEditDate="2019-01-03T02:12:34.853" LastActivityDate="2019-01-03T02:12:34.853" Title="I need the functionality of a pair of patch panels but I don't want to run one cable per port" Tags="|switch|ethernet|layer1|cable|patch-panel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22990" PostTypeId="2" ParentId="22989" CreationDate="2015-10-01T20:47:47.693" Score="1" Body="&lt;p&gt;Have you investigated patch panels with RJ-21X connectors on the back.  This allows 25-pair cables to connect to the patch panel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to determine what category of cabling you wish to use.  I believe you can get 25-pair Category-5E, but not Category-6 or above, as a 25-pair cable.  Also, realize that with so many pairs in a single sheath, you could be subject to more crosstalk, so practical distances may be reduced.  Termination tolerances will be tight, too, so be sure to get the cable installer to give you the test reports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Private VLANs are a way to prevent ports in a VLAN from communicating with each other.  If you have switches set up this way, you could prevent anything on one switch from communicating with anything else on the switch.  Setting up a pair of switches connected together may be something to look at, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-01T20:47:47.693" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="22991" PostTypeId="2" ParentId="22962" CreationDate="2015-10-01T22:41:04.143" Score="1" Body="&lt;p&gt;I suspect youre talking about IPv4 and IPv6 ok.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, there is no way to directly connect IPv4 network to IPv6 network unless there is someone (switch, routers,etc) who speaks both 'languages'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All internet is based over IPv4, immediate change to IPv6 is impossible due to its hugeness. So IPv6 adoption must be done gradually. So, there is gonna be a period of transition and coexistence between 6 and 4. We already on this period of time and we should expect more IPv6 networks in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, we need someone who translates our communication between our IPv4 only network and the IPv6-only destination website network. The translation can be done by your ISP, the destination's ISP or whoelse in between both of you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So answering your questions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does it mean that some content will not load on websites?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IF your ISP, or destination ISP, or whoever in between does not deliver you any kind of translation than yes. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;increasingly so in the upcoming year or so?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In general I'd say yes, for the same reason as last answer and because we expect greater use in IPv6 in the future.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does it mean that certain CDNs or hostings will simply not connect?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, no translation no deal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the experience you told, it seems like a Tor node did the job of translation IPv6 to IPv4 for your IPv6 only network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its worth noting that as IPv4 ran out, some ISPs still do not make good use of IPv6 and keep using bad IPv4 solutions such as Carrier Grade NAT (CGN) to aggregate more costumers on a single IPv4 address. It creates a lot of issues, the main one is for making it difficult for costumers to, for example, play certain kind of games or services that rely on port forwarding.&lt;/p&gt;&#xA;" OwnerUserId="19428" LastActivityDate="2015-10-01T22:41:04.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22992" PostTypeId="2" ParentId="22962" CreationDate="2015-10-01T23:28:35.977" Score="2" Body="&lt;p&gt;As stated in the other answers many providers will implement some for of Carrier Grade NAT (CGN). So you share an IP address with several other users,. If these providers take care and don't overload their NATs you'll notice not much if you only use HTTP(S), SMTP, ... If he dose overload his CGN you can find an example how google maps looks like in this &lt;a href=&quot;http://meetings.apnic.net/__data/assets/file/0011/38297/Miyakawa-APNIC-KEYNOTE-IPv6-2011-8.pptx.pdf&quot; rel=&quot;nofollow&quot;&gt;presentation.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we have to possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Your provider only uses CGN&lt;/li&gt;&#xA;&lt;li&gt;Your provider uses a combination of CGN for IPv4 and also offers IPv6&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you are using some external service like VoIP, VPNs  or computer games which only offer IPv4 you may / will have some significant performance degradation or no service at all (somewhere between &quot;works&quot;, &quot;works sometimes&quot;, &quot;does not work&quot;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your provider supports IPv6 and you are using external service which use IPv6 and your provider also supports IPv6 everything should work as usual.  There was a BLOG post by a big German VoIP provider complaining that many of the access provider where using this new IPv6 stuff and NAT'ing IPv4 so their VoIP product would fail. The solution was simple: Implement v6. But complaining seemed to be easier. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your running some kind of service (NAS, SSH, ..) at home you'll most probably have ho IPv4 access when your provider uses CGN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the content side you'll have to be aware that not implementing IPv6 will hurt your customers as CGN and other transition mechanisms will increase IPv4 latency. See this &lt;a href=&quot;https://www.youtube.com/watch?v=_7rcAIbvzVY&quot; rel=&quot;nofollow&quot;&gt;talk on youtube&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2015-10-01T23:28:35.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22993" PostTypeId="2" ParentId="22989" CreationDate="2015-10-02T02:48:55.100" Score="3" Body="&lt;p&gt;If I understand your needs correctly, you should look into &quot;QinQ&quot; or &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1ad&quot; rel=&quot;nofollow&quot;&gt;802.1ad&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically &quot;double-layer VLANs&quot; or &quot;VLAN Encapsulation&quot; - the switches wrap incoming packets in an additional layer of VLAN going in, and unwrap them going out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'd need switches that support it, but they are commonly available. And you need to keep your head on straight when setting it up....&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-10-02T02:48:55.100" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22994" PostTypeId="1" CreationDate="2015-10-02T04:04:30.707" Score="2" ViewCount="2810" Body="&lt;p&gt;I am trying to clear up concept here. This is regarding shaper using Token bucket algorithm. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let’s assume that the bucket depth is 1500 bytes. And assume that the data rate is 2Bps (very slow one). This means that unless the bucket doesn't have tokens unlike leaky bucket, the data will not be transmitted.&#xA;This implies that there will be a delay/drop in the packet transmission. If so, then don’t you think that this will add congestion in the traffic? Imagine, a synchronous communication, where the receiver will time out and ask for re-transmission.&#xA;Thus, there will be a lot of packets in the network. So, don’t you think that leaky bucket is better than token bucket?  At least you don’t have a possibility of duplicate packets in leaky bucket. Only disadvantage of leaky bucket is that it will transmit the data always with a constant bit rate. &#xA;So, it will throttle the bit rate to a lower value even when the source is sending at a higher bit rate. &lt;/p&gt;&#xA;" OwnerUserId="13278" LastActivityDate="2015-10-02T04:04:30.707" Title="why token bucket algorithm is better than leak bucket algorithm?" Tags="|congestion|policing|" AnswerCount="0" CommentCount="2" ClosedDate="2019-12-20T00:17:24.593" ContentLicense="CC BY-SA 3.0" />
  <row Id="22995" PostTypeId="2" ParentId="22980" CreationDate="2015-10-02T06:25:00.220" Score="0" Body="&lt;p&gt;A diagram that explains the arp request:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly,in this example, Poste1 want to send a packet to poste4, but it has not the @MAC of poste 4, so it sends a &lt;strong&gt;broadcast&lt;/strong&gt; ARP. In this request, poste 1 will ask &quot;what is the MAC address with 192.168.0.44 IP address ?&quot;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GZWG4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GZWG4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The poste B will answer &lt;strong&gt;only&lt;/strong&gt; to Poste 1, &quot;I am 192.168.0.44, mys @MAC is 9c-d2-1e-31-19-44&quot;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/6FSkP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6FSkP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, Poste1 updates his MAC table with the new values of poste 4. This entry will stay in this table during a period determinated by the Operating System.&lt;/p&gt;&#xA;" OwnerUserId="19274" LastActivityDate="2015-10-02T06:25:00.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22996" PostTypeId="1" CreationDate="2015-10-02T06:27:03.813" Score="0" ViewCount="933" Body="&lt;p&gt;Efficiency for Ethernet (CSMA-CD) is: 1/(1+6.44a), &#xA;where a is ratio of Propagation Delay and Transmission delay&lt;br&gt;&#xA;   (from &lt;strong&gt;Data Communication and Networking&lt;/strong&gt;  by Forouzan)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to connect my understanding of above formula with &lt;strong&gt;1-Persistent&lt;/strong&gt;, &lt;strong&gt;P-Persistent&lt;/strong&gt; and &lt;strong&gt;Non-Persistent&lt;/strong&gt; CSMA CD.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I think:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Since in the derivation of above formula (&lt;a href=&quot;http://www.eecs.yorku.ca/course_archive/2010-11/F/3213/CSE3213_13_RandomAccess_2_F2010.pdf&quot; rel=&quot;nofollow&quot;&gt;a lesson from N. Vlajic&lt;/a&gt;), we use maximized 'p' value to calculate final throughput, &lt;strong&gt;we are able to control&lt;/strong&gt; 'p' value and set it in transmitting devices. Thus, it makes sense to call it &lt;strong&gt;P-persistent&lt;/strong&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Since maximised 'p' value still gives P(success) = 1/N, we may consider it as &lt;strong&gt;Natural Uniform Probability&lt;/strong&gt; even if transmission devices do not have capability of controlling p value. Thus, we may also call it 1-Persistent.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have no idea about Non-Persistent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two deductions (points 1 and 2 above) are rough ideas, what I could reckon. But I am looking for exact and concrete answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I've seen 1/(1+5a) formula as well (&lt;strong&gt;Computer Networking&lt;/strong&gt; by Kurose and Ross ). Why is this different from above one?&lt;/p&gt;&#xA;" OwnerUserId="16962" LastEditorUserId="16962" LastEditDate="2015-12-24T05:53:57.057" LastActivityDate="2015-12-24T05:53:57.057" Title="CDMA CD throughput formula connection with Persistence methods" Tags="|ethernet|lan|" AnswerCount="1" CommentCount="3" ClosedDate="2015-12-24T11:57:33.157" ContentLicense="CC BY-SA 3.0" />
  <row Id="22997" PostTypeId="2" ParentId="22976" CreationDate="2015-10-02T06:39:40.827" Score="1" Body="&lt;p&gt;If all of your devices (and the AP) are connected on the switch Netgear GS752TP and this connected to the router Netgear FVS318N, you could do a mirroring-port on the port between the switch and the router to a free port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After, you could capture all the traffic of your devices with what you want (tcpdump, wireshark) and see which device eats your bandwith. You could save your traffic in pcap format and analyse later. With wireshark, for example, you could list all your devices with their bandwith. &lt;/p&gt;&#xA;" OwnerUserId="19274" LastActivityDate="2015-10-02T06:39:40.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="22998" PostTypeId="1" AcceptedAnswerId="22999" CreationDate="2015-10-02T06:41:54.147" Score="13" ViewCount="45017" Body="&lt;p&gt;I have an old Linksys switch (EZXS55W) and it has worked fine for many years now, but I tried to hook something up today to the last open port and noticed the device didn't work when I did this. When I looked about my switch, it says that it disables that port when using the Uplink port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm still a bit fuzzy on what the Uplink port does for me, I had always assumed that this Uplink port was for me to plug into from my router which is elsewhere in the house and hooked up to the modem so it could allow the switch to work for my other devices. I guess I need more than 5 ports now, but I see newer switches do not have this Uplink port generally anymore. Can I safely buy a new 8 port switch that does not have an Uplink port and maintain the exact same functionality? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand what I'm reading correctly, newer switches did away with the need for a dedicated Uplink port so now the switches intelligently do whatever the Uplink did? I don't want to get further off from the accurate answer to this, so I just want to understand the technicality behind this so I'm not uninformed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The one thing I guess I'm seeing from this though, if a switch is say an 8 port switch that means 1 port will be used to feed from the actual internet connection (whichever cable is providing it to the switch) and then the other 7 can be devices that need access to that shared network connection and by that virtue, the internet. It does not however, work like 5 port means it has 6 physical ports with one being the &quot;internet&quot; connection, and the other 5 being devices that need to be hooked up, correct? The latter is how I always thought it worked, but thinking this is incorrect now.&lt;/p&gt;&#xA;" OwnerUserId="19438" LastActivityDate="2021-10-06T13:14:13.453" Title="What purpose is the Uplink port in layman's terms and do I need it?" Tags="|switch|ethernet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="22999" PostTypeId="2" ParentId="22998" CreationDate="2015-10-02T06:52:39.250" Score="15" Body="&lt;p&gt;An uplink port is a port on which Transmit and Receive are reversed.&lt;/p&gt;&#xA;&lt;p&gt;They are used to connect together 2 switches with a standard straight-trough cable.&#xA;(otherwise it would require a cross cable where the transmit and receive are crossed in the cable rather than on the switch port)&lt;/p&gt;&#xA;&lt;p&gt;Some switches came with 2 physical ports that were actually the same logical port , the first one being wired normally and the second wired &amp;quot;crossed&amp;quot;. So you were able to use only one of the physical port a a time, depending if you connect a PC (or a router) or a switch.&lt;/p&gt;&#xA;&lt;p&gt;Nowadays this generally doesn't matter anymore since most interfaces are &amp;quot;auto-mdix&amp;quot;, meaning that the interface detect the type of device connected and cross transmit and receive internally if needed.&lt;/p&gt;&#xA;&lt;p&gt;(and if the switch itself is not auto-mdix but the device you connect on it is , it also works).&lt;/p&gt;&#xA;&lt;p&gt;Note: this apply mostly to 10Base-T / 100Base-TX ports, since Auto MDI-X is nearly ubiquitous on gigabit Ethernet, and doesn't apply to 10GB Ethernet and above where there's no more dedicated transmit / receive wires.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2021-10-06T13:14:13.453" LastActivityDate="2021-10-06T13:14:13.453" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23000" PostTypeId="2" ParentId="22998" CreationDate="2015-10-02T07:00:59.377" Score="9" Body="&lt;p&gt;This has to do with how (UTP) Ethernet cabling works. In the old days, end point devices (like your PC) would use wires 1 and 2 to transmit data, and wires 3 and 6 to listen (&lt;a href=&quot;https://en.wikipedia.org/wiki/File:Ethernet_MDI_crossover.svg&quot; rel=&quot;noreferrer&quot;&gt;https://en.wikipedia.org/wiki/File:Ethernet_MDI_crossover.svg&lt;/a&gt;) (*). The switch on the other side of the cable would listen on wires 1 and 2, and transmit on 3 and 6. Now if you would connect two siwtches, this would not work with a regular cable, because both switches would use the same wires in the cable to transmit. On solution for this is to use a special crossover cable, within which the cabling is crossed. Another solution is to have a specific &quot;Uplink&quot;  port on the switch, which is wired as an end-point and uses the same wires to listen/transmit as a regular PC for instance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With modern devices this is all a moot point, since practically every device uses &quot;Auto-MDI-X&quot; (&lt;a href=&quot;https://en.wikipedia.org/wiki/Medium-dependent_interface#Auto_MDI-X&quot; rel=&quot;noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Medium-dependent_interface#Auto_MDI-X&lt;/a&gt;) to sense which wire to listen and to transmit on. This standard was introduced in 1998, so it's very rare to find use for your old crossover cables today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your Linksys switch: you can use the Uplink port to connect an end-point if you would use a crossover cable. However, in the internal wiring in the switch the Uplink port is the same port as port number 5 (&lt;a href=&quot;http://www.linksys.com/id/support-article?articleNum=132646&quot; rel=&quot;noreferrer&quot;&gt;http://www.linksys.com/id/support-article?articleNum=132646&lt;/a&gt;), so you can only use one of them (either the Uplink port, or port 5, not both simultaneously).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) This is true for 10BASE-T (10 Mbit/s) and 100BASE-TX (100 Mbit/s) Ethernet. Gigabit Ethernet uses all 8 wires in the cable.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2015-10-02T07:00:59.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23001" PostTypeId="2" ParentId="12849" CreationDate="2015-10-02T07:45:45.560" Score="1" Body="&lt;p&gt;When performing RSPAN another tag (the RSPAN VLAN tag) is added to the packet. Please note that this is not an actual encapsulation. You just add a second tag to the packet. The RSPAN Vlan has learning disabled, therefore the packets are flooded inside RSPAN VLAN. At the destination, the RSPAN tag is removed and you have the packet sent by the source unmodified. This is what you want when you mirror a packet. If you would not use a VLAN then your packet would be discarded. &lt;/p&gt;&#xA;" OwnerUserId="19439" LastActivityDate="2015-10-02T07:45:45.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23002" PostTypeId="1" CreationDate="2015-10-02T10:53:41.600" Score="5" ViewCount="2593" Body="&lt;h1&gt;Current Network&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I have the following network situation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Internet&#xA;    |  &#xA;81.x.x.x (WAN)&#xA;Modem / DSL Router 1  &#xA;192.168.1.1 (LAN)  &#xA;    |  &#xA;    +-----------------------------+&#xA;    |                             |&#xA;192.168.1.2 (WAN)           192.168.1.100&#xA;Router 2                    PC 1&#xA;192.168.2.1 (LAN)&#xA;    |&#xA;    +-----------------------------+&#xA;    |                             |&#xA;192.168.2.100               192.168.2.101&#xA;PC 2                        Printer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My problem is, that computers in subnet 192.168.&lt;strong&gt;1&lt;/strong&gt;.0/24 (PC 1) can't reach destinations behind Router 2 (so in the subnet 192.168.&lt;strong&gt;2&lt;/strong&gt;.0/24), in my case eg the printer. The other direction works without problems:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Pinging from PC 2 to PC 1  works&lt;/li&gt;&#xA;&lt;li&gt;Pinging from PC 1 to PC 2  fails&lt;/li&gt;&#xA;&lt;li&gt;Pinging from PC 1 to 192.168.1.2  (Router 2 WAN)  works&lt;/li&gt;&#xA;&lt;li&gt;Pinging from PC 1 to 192.168.2.1  (Router 2 LAN)  fails&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h1&gt;Routing problem&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;So I thought this might be a routing problem. Trying tracert from PC 1 (192.168.1.100) to Router 2 (192.168.2.1) resulted in the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\Alexander&amp;gt;tracert 192.168.2.1&#xA;Routenverfolgung zu 192.168.2.1 über maximal 30 Hops&#xA;&#xA;  1     1 ms     1 ms     1 ms  192.168.1.1&#xA;  2     8 ms     8 ms     8 ms  d91-130-241-1.cust.tele2.at [91.130.241.1]&#xA;  3     *        *        *     Zeitüberschreitung der Anforderung.&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means the DSL Router routes the request to the internet, which is not what I want. So I entered the following static route on the DSL router (192.168.1.1)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Destination   Subnet Mask     Gateway       Interface&#xA;192.168.2.0   255.255.255.0   192.168.1.2   br0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I had the following interfaces to choose from. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Data_0_0_35_1/ppp_0_0_35_1&lt;/li&gt;&#xA;&lt;li&gt;VoIP_0_0_40_1/ppp_0_0_40_1&lt;/li&gt;&#xA;&lt;li&gt;EFM_0_0_32.31/nas_0_0_32.31&lt;/li&gt;&#xA;&lt;li&gt;EFM_0_0_32.32/nas_0_0_32.32&lt;/li&gt;&#xA;&lt;li&gt;EFM_0_0_32.33/nas_0_0_32.33&lt;/li&gt;&#xA;&lt;li&gt;EFM_0_0_32.34/nas_0_0_32.34&lt;/li&gt;&#xA;&lt;li&gt;LAN/br0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The arp table in the device info of the DSL router showed the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP address      Flags       HW Address          Device&#xA;192.168.1.100   Complete    2C:41:38:8F:C7:3B   br0&#xA;192.168.1.101   Complete    BC:F5:AC:FF:7A:92   br0&#xA;192.168.1.102   Complete    C8:F7:33:E9:0B:C9   br0&#xA;192.168.1.2     Complete    F4:EC:38:9D:72:BD   br0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I think interface br0 (bridge0) is correct. However the help text for the routing table said &quot;&lt;em&gt;Enter the destination network address, subnet mask, gateway AND/OR available WAN interface then click &quot;Save/Apply&quot; to add the entry to the routing table.&lt;/em&gt;&quot; As this should be not WAN interface in my point of view I tried both, but that had no differences in the result:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again trying tracert from PC 1 (192.168.1.100) to Router 2 (192.168.2.1) resulted in the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\Alexander&amp;gt;tracert 192.168.2.1&#xA;Routenverfolgung zu 192.168.2.1 über maximal 30 Hops&#xA;&#xA;  1     1 ms     1 ms     1 ms  192.168.1.1&#xA;  2     *        *        *     Zeitüberschreitung der Anforderung.&#xA;  ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;And now&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;something changed but I don't know how to proceed. Additionally I disabled the SPI Firewall (Stateful Packet Inspection) an Router 2, but that did not change anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has somebody a clue what I might forgot?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Adding route on PC client&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I added the route to the client PC, but that did not change anything. (Ping from PC 1 to 192.168.1.2 works, to 192.168.2.1 fails)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ipconfig&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\WINDOWS\system32&amp;gt; ipconfig&#xA;Windows-IP-Konfiguration&#xA;Drahtlos-LAN-Adapter WiFi:&#xA;&#xA;   Verbindungsspezifisches DNS-Suffix: Home&#xA;   Verbindungslokale IPv6-Adresse  . : fe80::d0d5:82f1:5058:9099%7&#xA;   IPv4-Adresse  . . . . . . . . . . : 192.168.1.101&#xA;   Subnetzmaske  . . . . . . . . . . : 255.255.255.0&#xA;   Standardgateway . . . . . . . . . : 192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;route print&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\WINDOWS\system32&amp;gt; route print&#xA;===========================================================================&#xA;Schnittstellenliste&#xA;  6...18 67 b0 2b 07 48 ......Realtek PCIe GBE Family Controller&#xA;  9...c8 f7 33 e9 0b ca ......Microsoft Wi-Fi Direct Virtual Adapter&#xA; 11...ca f7 33 e9 0b c9 ......Microsoft Hosted Network Virtual Adapter&#xA;  7...c8 f7 33 e9 0b c9 ......Intel(R) Centrino(R) Advanced-N 6235&#xA; 10...c8 f7 33 e9 0b cd ......Bluetooth Device (Personal Area Network)&#xA;  1...........................Software Loopback Interface 1&#xA;  4...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter&#xA;  5...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface&#xA;===========================================================================&#xA;&#xA;IPv4-Routentabelle&#xA;===========================================================================&#xA;Aktive Routen:&#xA;     Netzwerkziel    Netzwerkmaske          Gateway    Schnittstelle Metrik&#xA;          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.101     25&#xA;        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    306&#xA;        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    306&#xA;  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306&#xA;      192.168.1.0    255.255.255.0   Auf Verbindung     192.168.1.101    281&#xA;    192.168.1.101  255.255.255.255   Auf Verbindung     192.168.1.101    281&#xA;    192.168.1.255  255.255.255.255   Auf Verbindung     192.168.1.101    281&#xA;        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    306&#xA;        224.0.0.0        240.0.0.0   Auf Verbindung     192.168.1.101    281&#xA;  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306&#xA;  255.255.255.255  255.255.255.255   Auf Verbindung     192.168.1.101    281&#xA;===========================================================================&#xA;Ständige Routen:&#xA;  Keine&#xA;&#xA;IPv6-Routentabelle&#xA;===========================================================================&#xA;Aktive Routen:&#xA; If Metrik Netzwerkziel             Gateway&#xA;  5    306 ::/0                     Auf Verbindung&#xA;  1    306 ::1/128                  Auf Verbindung&#xA;  5    306 2001::/32                Auf Verbindung&#xA;  5    306 2001:0:5ef5:79fd:471:3998:ae42:9bf1/128&#xA;                                    Auf Verbindung&#xA;  7    281 fe80::/64                Auf Verbindung&#xA;  5    306 fe80::/64                Auf Verbindung&#xA;  5    306 fe80::471:3998:ae42:9bf1/128&#xA;                                    Auf Verbindung&#xA;  7    281 fe80::d0d5:82f1:5058:9099/128&#xA;                                    Auf Verbindung&#xA;  1    306 ff00::/8                 Auf Verbindung&#xA;  5    306 ff00::/8                 Auf Verbindung&#xA;  7    281 ff00::/8                 Auf Verbindung&#xA;===========================================================================&#xA;Ständige Routen:&#xA;  Keine&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;route add&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\WINDOWS\system32&amp;gt; route -p add 192.168.2.0 mask 255.255.255.0 192.168.1.2&#xA; OK!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;route print&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\WINDOWS\system32&amp;gt; route print&#xA;===========================================================================&#xA;Schnittstellenliste&#xA;  6...18 67 b0 2b 07 48 ......Realtek PCIe GBE Family Controller&#xA;  9...c8 f7 33 e9 0b ca ......Microsoft Wi-Fi Direct Virtual Adapter&#xA; 11...ca f7 33 e9 0b c9 ......Microsoft Hosted Network Virtual Adapter&#xA;  7...c8 f7 33 e9 0b c9 ......Intel(R) Centrino(R) Advanced-N 6235&#xA; 10...c8 f7 33 e9 0b cd ......Bluetooth Device (Personal Area Network)&#xA;  1...........................Software Loopback Interface 1&#xA;  4...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter&#xA;  5...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface&#xA;===========================================================================&#xA;&#xA;IPv4-Routentabelle&#xA;===========================================================================&#xA;Aktive Routen:&#xA;     Netzwerkziel    Netzwerkmaske          Gateway    Schnittstelle Metrik&#xA;          0.0.0.0          0.0.0.0      192.168.1.1    192.168.1.101     25&#xA;        127.0.0.0        255.0.0.0   Auf Verbindung         127.0.0.1    306&#xA;        127.0.0.1  255.255.255.255   Auf Verbindung         127.0.0.1    306&#xA;  127.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306&#xA;      192.168.1.0    255.255.255.0   Auf Verbindung     192.168.1.101    281&#xA;    192.168.1.101  255.255.255.255   Auf Verbindung     192.168.1.101    281&#xA;    192.168.1.255  255.255.255.255   Auf Verbindung     192.168.1.101    281&#xA;      192.168.2.0    255.255.255.0      192.168.1.2    192.168.1.101     26&#xA;        224.0.0.0        240.0.0.0   Auf Verbindung         127.0.0.1    306&#xA;        224.0.0.0        240.0.0.0   Auf Verbindung     192.168.1.101    281&#xA;  255.255.255.255  255.255.255.255   Auf Verbindung         127.0.0.1    306&#xA;  255.255.255.255  255.255.255.255   Auf Verbindung     192.168.1.101    281&#xA;===========================================================================&#xA;Ständige Routen:&#xA;  Netzwerkadresse          Netzmaske  Gatewayadresse  Metrik&#xA;      192.168.2.0    255.255.255.0      192.168.1.2       1&#xA;===========================================================================&#xA;&#xA;IPv6-Routentabelle&#xA;===========================================================================&#xA;Aktive Routen:&#xA; If Metrik Netzwerkziel             Gateway&#xA;  5    306 ::/0                     Auf Verbindung&#xA;  1    306 ::1/128                  Auf Verbindung&#xA;  5    306 2001::/32                Auf Verbindung&#xA;  5    306 2001:0:5ef5:79fd:471:3998:ae42:9bf1/128&#xA;                                    Auf Verbindung&#xA;  7    281 fe80::/64                Auf Verbindung&#xA;  5    306 fe80::/64                Auf Verbindung&#xA;  5    306 fe80::471:3998:ae42:9bf1/128&#xA;                                    Auf Verbindung&#xA;  7    281 fe80::d0d5:82f1:5058:9099/128&#xA;                                    Auf Verbindung&#xA;  1    306 ff00::/8                 Auf Verbindung&#xA;  5    306 ff00::/8                 Auf Verbindung&#xA;  7    281 ff00::/8                 Auf Verbindung&#xA;===========================================================================&#xA;Ständige Routen:&#xA;  Keine&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ping 192.168.1.2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\WINDOWS\system32&amp;gt; ping 192.168.1.2&#xA;&#xA;Ping wird ausgeführt für 192.168.1.2 mit 32 Bytes Daten:&#xA;Antwort von 192.168.1.2: Bytes=32 Zeit=1ms TTL=64&#xA;Antwort von 192.168.1.2: Bytes=32 Zeit=7ms TTL=64&#xA;Antwort von 192.168.1.2: Bytes=32 Zeit=2ms TTL=64&#xA;Antwort von 192.168.1.2: Bytes=32 Zeit=2ms TTL=64&#xA;&#xA;Ping-Statistik für 192.168.1.2:&#xA;    Pakete: Gesendet = 4, Empfangen = 4, Verloren = 0&#xA;    (0% Verlust),&#xA;Ca. Zeitangaben in Millisek.:&#xA;    Minimum = 1ms, Maximum = 7ms, Mittelwert = 3ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ping 192.168.2.1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\WINDOWS\system32&amp;gt; ping 192.168.2.1&#xA;&#xA;Ping wird ausgeführt für 192.168.2.1 mit 32 Bytes Daten:&#xA;Zeitüberschreitung der Anforderung.&#xA;Zeitüberschreitung der Anforderung.&#xA;Zeitüberschreitung der Anforderung.&#xA;Zeitüberschreitung der Anforderung.&#xA;&#xA;Ping-Statistik für 192.168.2.1:&#xA;    Pakete: Gesendet = 4, Empfangen = 0, Verloren = 4&#xA;    (100% Verlust),&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Route on 192.168.2.1&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I was not able to add a route on 192.168.2.1. I tried to add 192.168.1.0 with 255.255.255.0 and Gateway 192.168.1.1 with the following error code&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Error code: 4011&lt;br&gt;&#xA;  Destination Network address cannot be inside the subnet of WAN IP&lt;br&gt;&#xA;  address, please enter again.  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However the device lists the following routes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ID  Destination   Network         Subnet Mask   Gateway Interface&#xA;1   192.168.2.0   255.255.255.0   0.0.0.0       LAN &amp;amp; WLAN&#xA;2   192.168.1.0   255.255.255.0   0.0.0.0       WAN&#xA;3   239.0.0.0     255.0.0.0       0.0.0.0       LAN &amp;amp; WLAN&#xA;4   0.0.0.0       0.0.0.0         192.168.1.1   WAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19443" LastEditorUserId="19443" LastEditDate="2015-11-25T17:36:43.587" LastActivityDate="2015-11-25T17:36:43.587" Title="Route does not work / LAN port not reachable" Tags="|routing|traceroute|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="23004" PostTypeId="1" CreationDate="2015-10-02T11:00:14.940" Score="6" ViewCount="1568" Body="&lt;p&gt;Trying to setup a VPN for our small business (more secure and useful than the WebDAV we currently use) - but I'm having trouble getting it to work. I've not had to setup any VPN before, so have read all the docs and guides I could find - but no luck :-/&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After using the simple setup these are screenshots of what I have - blurred areas to hide specific details and show that there are correct values in there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wanting to simply have the router act as a VPN server for clients (ie, us at home etc) to connect in and get access to everything in the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When trying to connect from Windows7, OSX Mavericks and iOS9 it just times out and/or says the server isn't responding - port scan shows the relevant ports appear open.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pretty sure this is me just missing something, but can't find any relevant results when searching, and trying several (dozen now?) variations of everything am asking for help from anyone who's managed this before :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firmware is 1.0.4.14 (latest release)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eKe1B.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eKe1B.png&quot; alt=&quot;IKE Policy&quot;&gt;&lt;/a&gt;&lt;a href=&quot;https://i.stack.imgur.com/9TdLM.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9TdLM.png&quot; alt=&quot;VPN Policy&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19283" LastActivityDate="2019-04-19T20:03:10.667" Title="Having trouble setting up VPN on a Cisco RV180W" Tags="|cisco|vpn|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="23005" PostTypeId="2" ParentId="22996" CreationDate="2015-10-02T11:08:52.370" Score="1" Body="&lt;p&gt;I believe the formula would apply to all three of the CSMA access modes 1-persistent, P-persistent, and Non-persistent. 1-persistent has low efficiency and low delay. P-persistent has efficiency and delay can be balanced. Non-persistent has high efficiency and high delay. However, all of them use the same formula. &lt;a href=&quot;http://www.eecs.yorku.ca/course_archive/2010-11/F/3213/CSE3213_13_RandomAccess_2_F2010.pdf&quot; rel=&quot;nofollow&quot;&gt;I am referencing a lesson from  N. Vlajic&lt;/a&gt; his lecture handout is very helpful I would suggest reading it because he goes into great detail explaining it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I can tell the Kuros and Ross text is using an aproximation to derive its formula.&#xA;&lt;a href=&quot;http://A%20derivation%20of%20the%20efficiency%20of%20Ethernet%20is%20beyond%20the%20scope%20of%20this%20book%20(see[Lam%201980]and[Bertsekas%201992]).%20Here%20we%20simply%20state%20the%20following%20approximation&quot;&gt;A derivation of the efficiency of Ethernet is beyond the scope of this book (see[Lam 1980]and[Bertsekas 1992]). Here we simply state the following approximation&lt;/a&gt;  the Data Communications and Networking text would seam to have a more accurate formula  (1/1+6.44a). &lt;/p&gt;&#xA;" OwnerUserId="19249" LastActivityDate="2015-10-02T11:08:52.370" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23012" PostTypeId="1" AcceptedAnswerId="23015" CreationDate="2015-10-02T14:47:01.940" Score="1" ViewCount="543" Body="&lt;p&gt;Hello and good afternoon&lt;/p&gt;&#xA;&#xA;&lt;p&gt;well i we have to router sending hello to the multicast 224.0.0.10 &#xA;cisco 800 series in both sides, can i form an adjacency between them even if a sonicwall is between the, like sending their hello to the multicast address&#xA;i recall in linux you can set the ip forwarding bit in -&gt; /car/proc/sys/net/ipv4/ip.forwarding&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe with firewall rule?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the drawing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-+++++++++-                                              -+++++++++-&#xA; Cisco 800---&amp;gt;Dedicated link&amp;lt;----&amp;gt;Sonicwall &amp;lt;-----&amp;gt; LAN  Cisco 2900&#xA;-+++++++++-    X4 no Subinterface    X0 no Subinterface  -+++++++++- &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17537" LastEditorUserId="8499" LastEditDate="2018-12-27T02:46:32.203" LastActivityDate="2018-12-27T02:46:32.203" Title="Routing eigrp between socniwall" Tags="|routing|firewall|multicast|sonicwall|eigrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23014" PostTypeId="2" ParentId="23012" CreationDate="2015-10-02T15:03:49.677" Score="2" Body="&lt;p&gt;Sonicwall  won't understand EIGRP cause EIGRP is Cisco proprietary may you try other routing protocol or tunnel the Sonicwall  to forward the traffic without involving in any routing  &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-02T15:03:49.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23015" PostTypeId="2" ParentId="23012" CreationDate="2015-10-02T15:26:48.333" Score="1" Body="&lt;p&gt;Stop to think what sort of multicast this is: a local multicast that cannot be sent outside the subnet on which it originates.  You would need to account for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also use static neighbors in EIGRP to disable using multicast.  You would then need to open the correct port on the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, you need the interfaces between two EIGRP neighbors on a common subnet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-02T16:20:58.020" LastActivityDate="2015-10-02T16:20:58.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23018" PostTypeId="2" ParentId="23002" CreationDate="2015-10-02T22:35:21.737" Score="2" Body="&lt;p&gt;first of all your topology seams to be as following&#xA;&lt;a href=&quot;https://i.stack.imgur.com/o4UmT.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/o4UmT.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;following your description&#xA;&lt;a href=&quot;https://i.stack.imgur.com/TW0mx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TW0mx.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;pc2 could reach PC1 cause the pc2 GW (which is R2) can reach PC1 (cause it is directly connected to the both network).&lt;/p&gt;&#xA;&lt;p&gt;so same way let us ask a very importent question . &lt;em&gt;&lt;strong&gt;what is the PC1 GW and do PC1 GW know about subnet 192.168.2.X or not ?????????&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;if PC1 GW is the modem so you must add static route on the modem tell it if you want to reach 192.168.2.X you should go to 192.168.1.2 . otherwise you need to set the GW of PC1 to be 192.168.1.2&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-10-02T22:35:21.737" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23019" PostTypeId="2" ParentId="22945" CreationDate="2015-10-02T23:01:47.947" Score="1" Body="&lt;p&gt;The point here of segregating devices into VLANs is so that you can apply your security rules to each VLAN.  So the answer to your question is create as many VLANs as you have different policies.  For example, if dev apps and dev db are always accessed by the same group of people, there's not much point in having them in separate VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful that your rules make sense and follow your business practices.  Otherwise you end up with every device in its own VLAN, and you'll spend all your time managing access lists. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-02T23:01:47.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23020" PostTypeId="1" AcceptedAnswerId="23021" CreationDate="2015-10-02T23:05:20.063" Score="2" ViewCount="988" Body="&lt;p&gt;I need to simply configure switch ports which are similar:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode access&#xA;switchport access vlan XX&#xA;switchport voice vlan YY&#xA;spanning-tree mode portfast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm asking about using &lt;strong&gt;&lt;em&gt;Smartports&lt;/em&gt;&lt;/strong&gt; Macro port configurations which act as a port profile or template, are there any problems with this?&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2020-02-09T04:53:16.317" LastActivityDate="2020-02-09T04:53:16.317" Title="Switch Port Configuration" Tags="|cisco|switch|switching|switchport|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23021" PostTypeId="2" ParentId="23020" CreationDate="2015-10-02T23:10:13.230" Score="3" Body="&lt;p&gt;The Cisco &lt;code&gt;interface range&lt;/code&gt; command is really a macro that allows you to configure the same commands on a range of interfaces, and they don't necessarily need to be contiguous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree portfast default&#xA;spanning-tree portfast bpduguard default&#xA;!&#xA;interface range GigabitEthernet1/0/1 - 24 , 35 , 48&#xA; description ACCESS PORT&#xA; switchport access vlan 10&#xA; switchport voice vlan 20&#xA; switchport mode access&#xA; storm-control broadcast level 5.00&#xA; ip dhcp snooping limit rate 50&#xA; queue-set 1&#xA; srr-queue bandwidth share 1 30 35 30&#xA; priority-queue out&#xA; mls qos vlan-based&#xA; load-interval 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit, excerpt from the Cisco Press &lt;em&gt;CCNP Practical Studies: Switching&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cisco has recognized the administrative overhead of this common task&#xA;  on Cisco IOS-based switches and has introduced a new global&#xA;  configuration command &lt;strong&gt;interface range&lt;/strong&gt; that allows you to apply&#xA;  commands to a range or list of interfaces at the same time. This&#xA;  command is actually a &lt;em&gt;macro&lt;/em&gt;, which means that when used, the macro&#xA;  actually invokes a series of commands. This process is transparent to&#xA;  the administrator. The configuration file contains no reference to the&#xA;  interface range macro; instead it displays each of the configuration&#xA;  commands invoked by the macro.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit based on you comment about Auto Smartport Macros:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Auto Smartport Macros can be useful if you often connect/disconnect various types of devices in a large network. You want to make sure it's worth your while since you may be supporting multiple configuration types, some of which may never get connected to a particular switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many companies consider this a security risk because they want unused ports disabled, not available every time someone wants to just plug in a random device. Static macros are more secure in that regard, not automatically reconfiguring a port to accommodate a switch or router that an end-user bought at a local store and just plugs in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that if you use this for connecting network infrastructure devices like switches or routers, whoever is making the connections may accidentally connect to the wrong port, and everything seems to come up and work correctly, but it doesn't match your documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may find that creating and maintaining these macros is is worth the effort, or you may find it is a lot of work for little gain.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-03T16:40:43.097" LastActivityDate="2015-10-03T16:40:43.097" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="23023" PostTypeId="1" CreationDate="2015-10-03T00:11:40.000" Score="3" ViewCount="244" Body="&lt;p&gt;As I understand it, FDM uses separate frequency for each channel, thus A will transmit data, for instance, every two seconds and B every three seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, what will be delivered on the wire in the overlapping times, after 6, 12, 18 seconds in my example?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the multiplexer sends data from both channels? If so, how could someone distinguish between the senders? And if they are marked, what's the point of the frequency here?&lt;/p&gt;&#xA;" OwnerUserId="3131" LastEditorUserId="36720" LastEditDate="2018-05-27T17:16:15.927" LastActivityDate="2018-07-27T11:06:23.480" Title="How does frequency-division multiplexing deal with overlaps?" Tags="|broadcast|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="23024" PostTypeId="1" AcceptedAnswerId="23025" CreationDate="2015-10-03T03:32:31.527" Score="0" ViewCount="46" Body="&lt;p&gt;I'm working on a network design proposal for a class that deals with a hypothetical school building that needs to establish a new LAN for students and faculty with internet access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, this is the part I'm confused about - The school needs a primary connection of at least 40 Mbps, but it cannot be through cable, DSL, or FIOS. It also needs a backup line of at least 20 Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, other than cable, DSL, and fiber optic, what other options would there even be? We've been made aware of some WAN options (T3, etc.), but as far as I can tell those wouldn't be applicable here. Any help is appreciated.  &lt;/p&gt;&#xA;" OwnerUserId="19457" LastActivityDate="2015-10-03T06:59:21.457" Title="Network Project Question" Tags="|lan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23025" PostTypeId="2" ParentId="23024" CreationDate="2015-10-03T06:59:21.457" Score="1" Body="&lt;p&gt;In other words, residential broadband is off-limits.  &lt;strong&gt;Business or enterprise grade Direct Internet Access (DIA)&lt;/strong&gt; is the direction you need to seek out.  Consider carrier ethernet services delivered over twisted-pair (*Base-T), coax (T3), or fiber (1000Base-X) that provide symmetrical bandwidth and better service level agreements (SLAs).&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-10-03T06:59:21.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23027" PostTypeId="1" AcceptedAnswerId="23038" CreationDate="2015-10-03T08:23:21.267" Score="2" ViewCount="503" Body="&lt;p&gt;I have a small engineering network with a Linux router, LAN nodes on the one side of the router, and a WAN link attached to the router. The WAN link is a 16mbit/s wireless channel, while the LAN nodes have 100mbit/s fast ethernet connections. The LAN nodes generate traffic, including commands and data. Commands are small packets (hundreds bytes) with 10-15 pps rate with a real-time need. Data is the other type with a few Mbps rate.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm trying to do is to share the WAN link in a best way: high priority packets (commands) should occupy the WAN first, then everything else for other data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So after I have read a lot of docs across the Internet I realized to organize kind of traffic management on the Linux router using &lt;code&gt;tc&lt;/code&gt; and &lt;code&gt;HFSC Scheduling&lt;/code&gt; in particular.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I think about next simple config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# eth0 is the WAN link&#xA;tc qdisc add dev eth0 root handle 1:0 hfsc default 20&#xA;&#xA;# Define overall bandwidth&#xA;tc class add dev eth0 parent 1:0 classid 1:1  hfsc sc rate 16mbit ul rate 16mbit&#xA;&#xA;# This class is for commands&#xA;tc class add dev eth0 parent 1:1 classid 1:10 hfsc rt m2 16mbit&#xA;&#xA;# And this one is for everything else&#xA;tc class add dev eth0 parent 1:1 classid 1:20 hfsc ls m2 16mbit ul m2 16mbit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And a filtering part:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# This is for commands&#xA;tc filter add dev eth0 parent 1: protocol ip prio 1 u32 match ip dst 224.0.0.0/4 flowid 1:20&#xA;# This is for everything else&#xA;tc filter add dev eth0 parent 1: protocol ip prio 2 u32 match ip dst 0.0.0.0/0 flowid 1:10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And some tuning with &lt;code&gt;SFQ&lt;/code&gt; as queue inside each class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# tc qdisc add dev eth0 parent 1:10 handle 10: sfq perturb 10&#xA;# tc qdisc add dev eth0 parent 1:20 handle 20: sfq perturb 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So using this config I expect that packets with commands should be processed as fast as possible with minimum delay. Is this config fine and complete or totally wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I can't test this config on a production network before I'm sure that it will work.&lt;/p&gt;&#xA;" OwnerUserId="19460" LastEditorUserId="19460" LastEditDate="2015-10-06T05:00:01.453" LastActivityDate="2015-10-06T05:00:01.453" Title="QoS in a small network" Tags="|qos|bandwidth|linux|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23028" PostTypeId="1" AcceptedAnswerId="23054" CreationDate="2015-10-03T09:42:30.040" Score="1" ViewCount="1556" Body="&lt;p&gt;I have two routers connected to a single switch and both have internet connections. I have configured HSRP and VRRP as follows, This is a test bench I'm using so that's why I'm using both. The HSRP is working as normal on the GigabitEthernet 0/1 interface, but on the vlans they are both active. Here are the configs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco Router 1&#xA;interface GigabitEthernet0/0&#xA;ip address 10.21.6.10 255.255.255.0&#xA;ip nat outside&#xA;exit&#xA;&#xA;interface GigabitEthernet0/1&#xA;    ip address 192.168.1.2 255.255.255.0&#xA;    standby 0 ip 192.168.1.1&#xA;    standby 0 priority 95&#xA;    standby 0 preempt&#xA;    ip nat inside&#xA;&#xA;interface GigabitEthernet0/1.101&#xA;    encapsulation dot1Q 101&#xA;    ip address 192.168.101.2 255.255.255.240&#xA;    vrrp 1 ip 192.168.101.1&#xA;    vrrp 1 priority 95&#xA;    ip nat inside&#xA;&#xA;interface GigabitEthernet0/1.102&#xA;    encapsulation dot1Q 102&#xA;    ip address 192.168.102.2 255.255.255.0&#xA;    standby 2 ip 192.168.102.1&#xA;    standby 2 preempt&#xA;    ip nat inside&#xA;&#xA;interface GigabitEthernet0/1.103&#xA;    encapsulation dot1Q 103&#xA;    ip address 192.168.103.2 255.255.255.0&#xA;    vrrp 3 ip 192.168.103.1&#xA;    vrrp 3 priority 140&#xA;    ip nat inside&#xA;&#xA;interface GigabitEthernet0/1.104&#xA;    encapsulation dot1Q 104&#xA;    ip address 192.168.104.2 255.255.255.0&#xA;    standby 4 ip 192.168.104.1&#xA;    standby 4 priority 95&#xA;    standby 4 preempt&#xA;    ip nat inside&#xA;&#xA;interface GigabitEthernet0/1.105&#xA;    encapsulation dot1Q 105&#xA;    ip address 192.168.105.2 255.255.255.0&#xA;    vrrp 5 ip 192.168.105.1&#xA;    vrrp 5 priority 95&#xA;    ip nat inside&#xA;&#xA;interface GigabitEthernet0/1.106&#xA;    encapsulation dot1Q 106&#xA;    ip address 192.168.106.2 255.255.255.0&#xA;    standby 6 ip 192.168.106.1&#xA;    standby 6 preempt&#xA;    ip nat inside&#xA;&#xA;interface GigabitEthernet0/1.107&#xA;    encapsulation dot1Q 107&#xA;    ip address 192.168.107.2 255.255.255.192&#xA;    vrrp 7 ip 192.168.107.1&#xA;    vrrp 7 priority 140&#xA;    ip nat inside &#xA;&#xA;interface GigabitEthernet0/1.108&#xA;    encapsulation dot1Q 108&#xA;    ip address 192.168.108.2 255.255.255.192&#xA;    standby 8 ip 192.168.108.1&#xA;    standby 8 priority 95&#xA;    standby 8 preempt&#xA;    ip nat inside&#xA;&#xA;interface GigabitEthernet0/1.109&#xA;    encapsulation dot1Q 109&#xA;    ip address 192.168.109.2 255.255.255.0&#xA;    vrrp 9 ip 192.168.109.1&#xA;    vrrp 9 priority 95&#xA;    ip nat inside&#xA;&#xA;&#xA;Router 2&#xA; int g0/0&#xA;    ip address 10.21.6.11 255.255.255.0&#xA;    ip nat outside&#xA;    no shutdown&#xA;    exit&#xA; int g0/1&#xA;    ip address 192.168.1.3 255.255.255.0&#xA;    standby 0 ip 192.168.1.1&#xA;    standby 0 preempt         &#xA;    ip nat inside&#xA;    no shutdown&#xA;    exit&#xA; int g0/1.101&#xA;    encapsulation dot1Q 101&#xA;    ip address 192.168.101.3 255.255.255.240&#xA;    vrrp 1 ip 192.168.101.1&#xA;    vrrp 1 priority 140&#xA;    ip nat inside&#xA;    exit&#xA; int g0/1.102&#xA;    encapsulation dot1Q 102&#xA;    ip address 192.168.102.3 255.255.255.0&#xA;    standby 2 ip 192.168.102.1&#xA;    standby 2 priority 95&#xA;    standby 2 preempt&#xA;    ip nat inside&#xA;    exit&#xA; int g0/1.103&#xA;    encapsulation dot1Q 103&#xA;    ip address 192.168.103.3 255.255.255.0&#xA;    vrrp 3 ip 192.168.103.1&#xA;    vrrp 3 priority 95&#xA;    ip nat inside&#xA;    exit&#xA; int g0/1.104&#xA;    encapsulation dot1Q 104&#xA;    ip address 192.168.104.3 255.255.255.0&#xA;    standby 4 ip 192.168.104.1&#xA;    standby 4 preempt&#xA;    ip nat inside&#xA;    exit&#xA; int g0/1.105&#xA;    encapsulation dot1Q 105&#xA;    ip address 192.168.105.3 255.255.255.0&#xA;    vrrp 5 ip 192.168.105.1&#xA;    vrrp 5 priority 140&#xA;    ip nat inside&#xA;    exit&#xA; int g0/1.106&#xA;    encapsulation dot1Q 106&#xA;    ip address 192.168.106.3 255.255.255.0&#xA;    standby 6 ip 192.168.106.1&#xA;    standby 6 priority 95&#xA;    standby 6 preempt&#xA;    ip nat inside&#xA;    exit&#xA; int g0/1.107&#xA;    encapsulation dot1Q 107&#xA;    ip address 192.168.107.3 255.255.255.192&#xA;    vrrp 7 ip 192.168.107.1&#xA;    vrrp 7 priority 95&#xA;    ip nat inside&#xA;    exit&#xA; int g0/1.108&#xA;    encapsulation dot1Q 108&#xA;    ip address 192.168.108.3 255.255.255.192&#xA;    standby 8 ip 192.168.108.1&#xA;    standby 8 preempt&#xA;    ip nat inside&#xA;    exit&#xA; int g0/1.109&#xA;    encapsulation dot1Q 109&#xA;    ip address 192.168.109.3 255.255.255.0&#xA;    vrrp 9 ip 192.168.109.1&#xA;    vrrp 9 priority 140&#xA;    ip nat inside&#xA;    exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any idea on why it would be doing this. &lt;/p&gt;&#xA;" OwnerUserId="19463" LastEditorUserId="17452" LastEditDate="2015-10-04T17:11:39.550" LastActivityDate="2016-08-29T22:36:31.930" Title="HSRP and VRRP both routers active" Tags="|cisco|hsrp|vrrp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23032" PostTypeId="1" AcceptedAnswerId="23035" CreationDate="2015-10-03T13:43:31.177" Score="0" ViewCount="697" Body="&lt;p&gt;We've inherited an existing network that is a mixture of a cat5e, cat6, with switches and rj45  couplers that tie everything together. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to test a local network speed from one side of the network say by the modem to the other side of the network at its furthest point ?&lt;/p&gt;&#xA;" OwnerUserId="19472" LastActivityDate="2015-10-03T15:10:13.340" Title="Testing local network speed" Tags="|testing|speed|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23033" PostTypeId="2" ParentId="23032" CreationDate="2015-10-03T14:00:41.460" Score="1" Body="&lt;p&gt;If you use linux or windows, you can test with Iperf, and server-client application that easily can do what you want. You can get information here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; http://openmaniak.com/es/iperf.php&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example:&#xA;Client: iperf -c ip_Server&#xA;Server: iperf -s&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you can change the parameters to do a more strong test&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2015-10-03T14:20:04.017" LastActivityDate="2015-10-03T14:20:04.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23034" PostTypeId="1" AcceptedAnswerId="23040" CreationDate="2015-10-03T14:41:23.150" Score="3" ViewCount="1315" Body="&lt;p&gt;We need to build a routing table, based on routes from neighbors.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Route A receives three routes from different Routing Process: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EIGRP - 192.168.100.0/26&#xA;OSPF - 192.168.100.0/19&#xA;RIP - 192.168.100.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We have multiple paths to the same destination, How will we decide which will be installed on routing table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider three elements: &lt;code&gt;Administrative Distance, Metrics and Prefix Lenght&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Question 1: Sorted by priority, which element will use first?&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think &lt;code&gt;winner based on Administrative Distance&lt;/code&gt;, but I've multiple paths, I can't discart them, so these routes shows different prefix lenght. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Question 2: Are they considered different destinations, therefore will all be installed?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Question 3: Who are the Tie-Break? I mean, if I have two paths to the same destination, same AD value I'll consider Metric value and if they have equal values the load balancing is actived?&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Question 4: Prefix Lenght is used only for Forwarding Decision?&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pgVa0.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pgVa0.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="14008" LastEditDate="2015-10-03T19:41:12.183" LastActivityDate="2015-10-03T19:41:12.183" Title="Routing and Forwarding Decisions" Tags="|routing|router|ip-forwarding-table|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23035" PostTypeId="2" ParentId="23032" CreationDate="2015-10-03T15:04:03.923" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://iperf.fr&quot; rel=&quot;nofollow&quot;&gt;iPerf&lt;/a&gt; or &lt;a href=&quot;http://www.tamos.com/products/throughput-test/&quot; rel=&quot;nofollow&quot;&gt;Tamosoft throughput test&lt;/a&gt;. As a primarily Mac shop I currently find TTT more convenient, as iPerf builds for Mac are somewhat limited to specific OS versions or &quot;build it yourself&quot;. TTT is a straightforward (and cross-platform) download and run. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;...but iPerf is by far the more commonly/widely accepted method among network professionals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have used both, not affiliated with either. The old &quot;copy a large file from a computer here to a computer there&quot; method is also informative and straightforward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To the horror of cable salespeople, you will probably not find any noticeable difference between Cat5e and Cat6 segments, unless a segment of either type is kinked or otherwise defective...Or plugged into a non-gigabit switch...&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2015-10-03T15:10:13.340" LastActivityDate="2015-10-03T15:10:13.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23037" PostTypeId="1" AcceptedAnswerId="23039" CreationDate="2015-10-03T16:44:01.857" Score="2" ViewCount="326" Body="&lt;p&gt;Given a collection of switches all communicating together, will the local time on the switching equipment configuration have any bearing on performance, or just a common reference point when troubleshooting log files and diagnostics?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it stands default configurations default to a 199x time on boot, and they are all in different time frames in relation to when last booted. Logically I will fix this, but will it change anything other than logging data?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Id est, if I configure all switches to a common NTP server, will it affect performance and or reliability in any form?&lt;/p&gt;&#xA;" OwnerUserId="19475" LastActivityDate="2015-10-04T03:38:06.530" Title="Effects of local switch time on network performance" Tags="|troubleshooting|switching|performance|ntp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23038" PostTypeId="2" ParentId="23027" CreationDate="2015-10-03T18:13:06.270" Score="1" Body="&lt;p&gt;I don't know the specifics of QoS configuration for your router or switch(es), but this is how QoS should work for the requirements you have described.  You may be able to use this to come up with a configuration for your needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;QoS is really several separate things working together, and your need is fairly common.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you should use shaping on the WAN port if the port's native line rate is higher than your CIR.  For instance, if your WAN port is a 1 Gb ethernet port connecting to a device providing a 16 Mb path, shaping is in order.  On the other hand, if the native line rate of the port really is 16 Mb, you don't need to shape.  Shaping can be a little more complex than it first seems.  Your CIR is 16 Mb.  You should account for some protocol overhead, and if there are many small packets, you will need to account for more protocol overhead since smaller packets have a smaller payload-to-overhead ratio than larger packets.  You should set a shape rate at some percentage of the CIR.  You can narrow this down by traffic observation, and fine tune it later.  This percentage may be as low as 80% or so, or it may approach 97% or 98%.  It all depends on the protocol overhead of your traffic mix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, you should identify and mark the various classes of traffic as close to the source of the traffic as possible.  For instance, as traffic comes into the router, or, better yet, on the switch if it supports QoS marking.  Mark traffic like the commands with a higher priority and ordinary traffic as best effort or various marking(s) that fit your needs.  You can have multiple classes of traffic, each marked differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you get to queuing.  You should create a priority queue for the priority traffic.  This queue can have a guaranteed minimum bandwidth, or percentage of the bandwidth, and it can be served before any other queues.  You assign the the traffic marked for priority to this queue.  Create queue(s) for the other class(es) of traffic that you have identified and marked and assign to the respective queue(s).  Other, multiple queues can have various bandwidths, or bandwidth percentages, assigned, but they may not necessarily be priority queues with guarantees.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-03T18:13:06.270" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23039" PostTypeId="2" ParentId="23037" CreationDate="2015-10-03T18:23:04.380" Score="1" Body="&lt;p&gt;The time on the real-time clock of a network device has no bearing on its functionality, except for certain instances like using ACLs that only take effect during specific time periods.  Standard switching is not affected by the time set on a switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-03T19:20:33.160" LastActivityDate="2015-10-03T19:20:33.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23040" PostTypeId="2" ParentId="23034" CreationDate="2015-10-03T19:17:10.910" Score="2" Body="&lt;p&gt;Routes with different prefix lengths are really different routes so they end up in the routing table.  The route with the longest prefix will be used for the routing decision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Metrics are used by a routing protocol to determine the best route to be offered as a candidate to the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Administrative distance will be used by the routing table as the tie-breaker for candidate routes offered by the routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The various routing protocols keep or discard routes for the routing protocol's table (not the same as the routing table) based on the rules for the particular routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Different routing protocols handle ties and load balancing differently.  As I recall, EIGRP will, by Default, load balance across up to four routes, but that can be modified.  Other routing protocols have different rules for load balancing, or not.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-03T19:17:10.910" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23041" PostTypeId="1" AcceptedAnswerId="23043" CreationDate="2015-10-03T22:29:56.957" Score="2" ViewCount="1704" Body="&lt;p&gt;My question is regarding Cisco SmartNet. Do I really need this support from Cisco?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a network technician, but I'm in charge of purchasing the network equipment for an upcoming project. I have spec out two WS-C3650-24TS-S Layer 3 switches. The sales rep wants to include this additional charge, but I'm not really sure whether we really need this   Cisco SMARTnet extended service agreement.&lt;/p&gt;&#xA;" OwnerUserId="19478" LastEditorUserId="8499" LastEditDate="2015-10-03T22:51:06.223" LastActivityDate="2015-10-03T22:51:06.223" Title="Is SmartNet really worth it? What is it?" Tags="|cisco|switch|vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23043" PostTypeId="2" ParentId="23041" CreationDate="2015-10-03T22:47:33.263" Score="1" Body="&lt;p&gt;This is only something you can decide for yourself.  Answers are likely to be opinion-based, so this question may be closed as off-topic for this forum.  I will try to give you the facts without the opinion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main reasons you &lt;em&gt;would&lt;/em&gt; get SmartNet are for service, support, and software updates.  If there are bugs in your code version that get updated in later releases, or new features are added to new releases, SmarNet allows you to easily download the new code from CCO.  You can also call CCO for help with the devices covered by the contract.  Cisco will also cover failed devices and replace them for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only real reason you wouldn't get it is cost.  There are several levels of support, from Next Business Day to 2-hour turnaround, and pricing is based on the support level.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-03T22:47:33.263" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23044" PostTypeId="1" AcceptedAnswerId="23045" CreationDate="2015-10-03T23:09:01.700" Score="4" ViewCount="4347" Body="&lt;p&gt;I have a lab setup with 3 routers and 3 switches, but for simplicity for this issue, I turned on only 1 router and 1 switch and ran this test with the same results so I'm pretty sure it has nothing to do with my ip route statements.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC &amp;gt;&amp;gt; Cisco Router &amp;gt;&amp;gt; Cisco switch &amp;gt;&amp;gt; Home Router&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Router&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;FE0/0 192.168.1.15 /24&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;FE0/1 192.168.10.1 /24&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ip route 0.0.0.0 0.0.0.0 192.168.1.1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Switch (default vlan1 only)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;192.168.1.20 /24&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ip default-gateway 192.168.1.1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The default-gateway is my live/home router that I access the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is: The router (192.168.1.15) can ping outside addresses, but even if I plug my PC directly into the routers FE0/1 port (192.168.10.1), the router will not forward anything to the outside world from my PC. If the router can get out, why can't my PC? The PC has no problem pinging the FE0/0 interface.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PC&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;IP 192.168.10.51 /24&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Gateway 192.168.10.1&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;DNS 192.168.1.1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Router - show ip route...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Gateway of last resort is 192.168.1.1 to network 0.0.0.0&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;S*    0.0.0.0/0 [1/0] via 192.168.1.1&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;C        192.168.1.0/24 is directly connected, FastEthernet0/0&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;L        192.168.1.15/32 is directly connected, FastEthernet0/0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated,&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17576" LastActivityDate="2015-10-03T23:43:26.077" Title="Router can ping external IP, PC going thru same router can't" Tags="|cisco|routing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23045" PostTypeId="2" ParentId="23044" CreationDate="2015-10-03T23:43:26.077" Score="2" Body="&lt;p&gt;Your home router needs a route to the &lt;code&gt;192.168.10.0/24&lt;/code&gt; route. It needs a route to know where to send traffic destined for that route, else it will send it out the default route (WAN).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-03T23:43:26.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23047" PostTypeId="1" AcceptedAnswerId="23065" CreationDate="2015-10-04T02:19:08.827" Score="0" ViewCount="597" Body="&lt;p&gt;I need some help setting up a Sonicwall NSA 2600. Hoping somebody can help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have multiple public IP's assigned to us. The Wan IP is (example) set to 3.3.3.3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a server setup with a public IP and no private IP. I'm sure who set it up, but it's an OpenSuse server running asterisk if that helps at all. It's setup with 3.3.3.4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't figure out how to get network access to that server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried this link: &lt;a href=&quot;https://support.software.dell.com/kb/sw8612&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw8612&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19406" LastActivityDate="2015-10-04T20:54:49.663" Title="Help with Sonicwall 2600" Tags="|ip|sonicwall|wan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23048" PostTypeId="2" ParentId="23037" CreationDate="2015-10-04T03:38:06.530" Score="3" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;Regarding your first question&lt;/em&gt;&lt;/strong&gt; local time on certain switch or switching equipment won't affect any switching Performance. You may face this problem and in the devices which are multi homed to multiple controllers such as access points assigned to multi wireless controller so all of   wireless controller must have same clock for access points management issues and so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Regarding to your second question&lt;/em&gt;&lt;/strong&gt;, if you didn't configure any time based configurations (time-based ACL , QOS , Routing , port shutdown) , changing time shouldn't affect any thing  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Regarding to your third question&lt;/em&gt;&lt;/strong&gt; , Use NTP server as a clock provider to you network (switches and routers and servers  ...etc.) is the best practice to grantee unified network time and date ,&lt;code&gt;some platforms have its time reset each time it is rebooting&lt;/code&gt; .&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-04T03:38:06.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23050" PostTypeId="1" CreationDate="2015-10-04T05:26:51.913" Score="3" ViewCount="518" Body="&lt;p&gt;Classless Interdomain Routing (CIDR) takes, in addition to a 32-bit IPv4 IP address,&#xA;a prefix to tell the cut-off of the network ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP header has room only 32-bit address fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, an IP address can match two classless addresses: Eg. the IP address 222.10.5.11 would match both 222.10.0.0/21 and 222.10.5.0/23.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Q is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a router R1 receives a packet addressed to host 222.10.5.11 of network 222.10.0.0/21, how does R1 know that this is a classless address and the network prefix is 21? Where is this network prefix written in the IP header?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;//-----------------------------------------&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the routing protocols, like OSPF can pass the subnet mask and thus this prefix. &#xA;But, for forwarding, when an IPv4 packet addressed to 222.10.5.11 comes in, how does IP know &#xA;that this packet is for the host in 222.10.5.0/23?&lt;/p&gt;&#xA;" OwnerUserId="19482" LastEditorUserId="19482" LastEditDate="2015-10-04T05:40:58.137" LastActivityDate="2015-10-04T11:55:50.570" Title="CIDR -- Network prefix in IPv4 header" Tags="|routing|ipv4|subnet|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23051" PostTypeId="2" ParentId="23050" CreationDate="2015-10-04T05:37:31.407" Score="1" Body="&lt;p&gt;Routers use their route table to know where to send stuff. Your IP packet &lt;em&gt;cannot&lt;/em&gt; tell my router how to deal with it. (there are options for &quot;source routing&quot; but every sane admin disables it.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing flows to the most specific (longest prefix) match. If I have a route for 222/8 and a route for 222.10/16. The latter would apply -- 16 is greater than 8. In your example, the /23 would be the one used because it's the more specific route.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-04T05:37:31.407" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23052" PostTypeId="1" AcceptedAnswerId="23055" CreationDate="2015-10-04T07:20:06.787" Score="3" ViewCount="375" Body="&lt;p&gt;ODAS (Outdoor Distributed Antenna System) and Wireless APs - From what I know ODAS connects to Cellular towers while APs go through the Wireless Technology? Please add some more information.&lt;/p&gt;&#xA;" OwnerUserId="19225" LastEditorUserId="8499" LastEditDate="2015-10-04T13:24:21.713" LastActivityDate="2015-10-04T13:24:21.713" Title="Difference between ODAS and Wireless APs" Tags="|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23053" PostTypeId="1" CreationDate="2015-10-04T07:49:40.710" Score="0" ViewCount="1963" Body="&lt;p&gt;How does WISP work and where does it connect it to? Will it connect to a Satellite or do you need Fibers to establish connection? In short what Gateway or headend device does it connect to?&lt;/p&gt;&#xA;" OwnerUserId="19225" LastEditorUserId="19225" LastEditDate="2015-10-04T11:00:56.207" LastActivityDate="2015-10-04T12:57:49.447" Title="Difference - WISP from ISP" Tags="|wireless|" AnswerCount="2" CommentCount="3" ClosedDate="2015-10-05T11:40:25.160" ContentLicense="CC BY-SA 3.0" />
  <row Id="23054" PostTypeId="2" ParentId="23028" CreationDate="2015-10-04T08:22:28.687" Score="2" Body="&lt;p&gt;I found the problem, my team member had set that port to receive monitor traffic and therefor it was not trunking any vlan traffic to the router. Once this was fixed everything started working.  thanks @RonTrunk&lt;/p&gt;&#xA;" OwnerUserId="19463" LastActivityDate="2015-10-04T08:22:28.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23055" PostTypeId="2" ParentId="23052" CreationDate="2015-10-04T09:41:06.203" Score="1" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;A DAS&lt;/em&gt;&lt;/strong&gt; is a system of managed hubs and remote antennas that distribute a wireless signal to a series of connected indoor or &lt;strong&gt;&lt;em&gt;outdoor&lt;/em&gt;&lt;/strong&gt; multi-band, multi-technology radio heads as shown:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TMknr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TMknr.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the head-end of the DAS, service providers typically locate base stations to provide the cellular signal. A main hub takes that signal, digitizes it, and distributes it to other hubs and radio heads via a high-bandwidth fiber optic network. At the antenna, the radio converts the signals from digital to RF and RF to digital. You can find more about DAS in this link &lt;a href=&quot;http://electronicdesign.com/communications/understanding-distributed-antenna-systems-dass&quot; rel=&quot;nofollow noreferrer&quot;&gt;DAS tech&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;The answer to your question:&lt;/em&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;This style of wireless implementation is suitable for Wi-Fi, but&#xA;only 5% of commercial Wi-Fi implementations use a distributed antenna system. It is more common for mobile network indoor and outdoor implementations. On the other side, APs are used for Wi-Fi in most implementation scenarios (e.g. mesh connections).&lt;/li&gt;&#xA;&lt;li&gt;DAS acts as one big controller with multiple antennas (one huge AP),&#xA;but AP Wi-Fi implementations distribute and control the APs&#xA;themselves.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2015-10-04T13:23:10.730" LastActivityDate="2015-10-04T13:23:10.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23056" PostTypeId="2" ParentId="23053" CreationDate="2015-10-04T11:40:25.520" Score="2" Body="&lt;p&gt;WISP Setup Provider (Wireless Internet Service Provider) with networks built around wireless networking. Technology may include commonplace Wi-Fi wireless mesh networking, or proprietary equipment designed to operate over &lt;strong&gt;&lt;em&gt;open band&lt;/em&gt;&lt;/strong&gt; 900 MHz, 2.4 GHz, 4.9, 5.2, 5.4, 5.7, and 5.8 GHz bandsor &lt;strong&gt;&lt;em&gt;licensed frequencies&lt;/em&gt;&lt;/strong&gt; in the UHF band (including the MMDS frequency band) and LMDS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qfGhE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qfGhE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WISP Setup Provider (Wireless Internet Service Provider) are predominantly in rural environments where cable and digital subscriber lines are not available. WiMax is expected to become mainstream in the near future,the current called prewimax, bringing with it dramatic changes to the marketplace by increasing the number of inter operable equipment on the market and making mobile data transmission feasible, increasing the utility of such networks in rural environments. However, high-bandwidth wireless backhauls are already common in major cities, providing levels of bandwidth previously only available through expensive fiber optic connections. this linke is good reference for &lt;a href=&quot;http://trueinet.com/wisp%20setup%20provider.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;WISP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-04T11:40:25.520" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23057" PostTypeId="2" ParentId="23050" CreationDate="2015-10-04T11:55:50.570" Score="0" Body="&lt;p&gt;Packets just contain a destination address. Networks all have none-overlapping prefixes so it's always clear which network an address belongs in. A router's routing table contains the routes to prefixes and aggregates of prefixes so it knows where to send a packet. The final router is directly connected to the network and knows the exact (unaggregated) prefix. &lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-10-04T11:55:50.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23058" PostTypeId="2" ParentId="23053" CreationDate="2015-10-04T12:57:49.447" Score="0" Body="&lt;p&gt;I currently work for a WISP; we have 3 fiber connections that reside at the edge of our network, and we use point-to-point and point-to-multipoint wireless links to interconnect a backbone network that pulls in traffic from our subscriber access layer. We could use satellite at the edge connections if we needed to, but fiber is available, so that's what we use. A network is a network, so just like your network at home it doesn't make a difference if it's satellite, fiber, coax, DSL; a default route is a default route. Whatever technology is available with the right mix of price and performance.&lt;/p&gt;&#xA;" OwnerUserId="16940" LastActivityDate="2015-10-04T12:57:49.447" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23059" PostTypeId="1" CreationDate="2015-10-04T13:41:40.200" Score="3" ViewCount="573" Body="&lt;p&gt;Recently, I was asked to implement &lt;strong&gt;&lt;em&gt;vPC&lt;/em&gt;&lt;/strong&gt; connections over &lt;strong&gt;&lt;em&gt;Dark Fiber&lt;/em&gt;&lt;/strong&gt; between two data centers. Is this possible, and, if it is possible, does it have any drawbacks or limitations? I'm asked to encrypt the data involved in the &lt;strong&gt;&lt;em&gt;vPC&lt;/em&gt;&lt;/strong&gt; using &lt;strong&gt;&lt;em&gt;MACsec&lt;/em&gt;&lt;/strong&gt;. I know it is a very hard task, but any help would be useful.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2015-10-04T13:59:29.557" LastActivityDate="2015-10-04T22:10:46.247" Title="vPC over Dark Fiber" Tags="|vpc|cisco-nexus|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23060" PostTypeId="1" CreationDate="2015-10-04T02:36:12.147" Score="4" ViewCount="2087" Body="&lt;p&gt;In Tanenbaum's Computer Networks:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What happens if more than one of the stations or ports wants to send a&#xA;  frame at the same time? Again, switches differ from hubs. In a hub,&#xA;  all stations are in the same collision domain. They must use the&#xA;  CSMA/CD algorithm to schedule their transmissions. In a switch, each&#xA;  port is its own independent collision domain. In the common case that&#xA;  the cable is full duplex, both the station and the port can send a&#xA;  frame on the cable at the same time, without worrying about other&#xA;  ports and stations. Collisions are now impossible and CSMA/CD is not&#xA;  needed. However, if the cable is half duplex, the station and the port&#xA;  must contend for transmission with CSMA/CD in the usual way.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can't find the definition of collision domain in the book, or by searching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it a definition that is not just for the context in the quote, but also for a more general case?&lt;/p&gt;&#xA;" OwnerUserId="7894" OwnerDisplayName="Tim" LastEditorUserId="21048" LastEditDate="2015-12-02T14:08:57.080" LastActivityDate="2015-12-02T17:28:51.917" Title="What is &quot;collision domain&quot;" Tags="|switch|errors|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23061" PostTypeId="2" ParentId="23060" CreationDate="2015-10-04T04:33:00.627" Score="6" Body="&lt;p&gt;This will be a bit of a layman's answer, rather than quoting spec, but it should be accurate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The collision domain is the sum total of the network segment (hosts, hubs) affected by the collision, and forced to deal with it by a random backoff delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anytime a collision is detected on an Ethernet line, any and all interfaces on that line are required to stop transmitting.  They each then come up with a random amount of time to wait before transmitting again, in an attempt to avoid another collision.  In a crowded network, this delay will start to add up very quickly, and the collision domain is essentially the sum total of equipment that delay affects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As in your quote, it comes up a lot less these days.  The original Ethernet gear that filled the role of the switch was a hub, which simply repeated any frame sent to it out all of the other ports.  Once a network got even lightly congested, this made collisions a common symptom.  Modern switch technology virtually eliminates that problem, since any frame received by the switch is only sent to the host it's intended for.  The only possible collision is between a host and the switch, making it a very small collision domain, affecting only that host.  &lt;/p&gt;&#xA;" OwnerUserId="19491" OwnerDisplayName="Radhil" LastActivityDate="2015-10-04T04:33:00.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23062" PostTypeId="2" ParentId="23060" CreationDate="2015-10-04T13:03:51.920" Score="3" Body="&lt;p&gt;A collision domain is all devices connected by &lt;strong&gt;shared medium&lt;/strong&gt;.  Originally a collision domain was a physical cable, then repeaters and hubs were added. The shared medium ended at a router port and was temporally bounded (512 bit times).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the advent of switches the concept of collision domain shrank to the port on the switch, and as was noted collisions do not occur on full duplex ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Collision domains are still pertinent in WIFI networks.  WIFI uses CSMA/CA.&lt;/p&gt;&#xA;" OwnerUserId="2159" OwnerDisplayName="dbasnett" LastActivityDate="2015-10-04T13:03:51.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23065" PostTypeId="2" ParentId="23047" CreationDate="2015-10-04T20:54:49.663" Score="2" Body="&lt;p&gt;If you have a WAN subnet of, for example, 3.3.3.3/29 then you have a range of WAN IPs from, say, 3.3.3.2 - 3.3.3.6 (let's assume 3.3.3.1 is your default gateway/ISP router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your SonicWALL X1 interface is configured to use 3.3.3.3 then you can use the other available IPs to provide &lt;em&gt;NAT&lt;/em&gt; to internal IPs (on your X0 interface, or another interface) OR you can provide &lt;em&gt;Transparent IPs&lt;/em&gt; to another interface where devices on that Transparent interface will have PUBLIC IPs (like 3.3.3.4). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SonicWALL KB you linked to is part of the first case: providing external access using (say 3.3.3.3) to some internal IP (say 10.100.0.3) on a LAN (or DMZ) interface. This is OK for services that are NAT friendly, like HTTP. BUt less so for VoIP protocols that are not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you want to do is configure an interface in &lt;strong&gt;Transparent mode&lt;/strong&gt; (which is called Splice L3 Subnet in newer SonicOS releases). Have a look at this KB: &lt;a href=&quot;https://support.software.dell.com/kb/sw5979&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw5979&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transparent mode is like the device having a Public IP and &quot;sharing&quot; the WAN subnet BUT is still fully protected by the firewall and security services (IPS/Gateway AV, etc) with no NAT to get in the way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What to do:&lt;/strong&gt;&#xA;If you have a server on 3.3.3.4/29 which means it has a Public WAN IP and you want to put it behind the Firewall then you want to configure an interface (say X2) in Transparent / L3 Splice mode and connect it there.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configure your &lt;em&gt;interface&lt;/em&gt; (X2) to be in the &lt;em&gt;DMZ zone&lt;/em&gt; (or create a new Zone if you are using DMZ on another subnet)&lt;/li&gt;&#xA;&lt;li&gt;Set the IP Assignment to &lt;em&gt;Transparent&lt;/em&gt; / Splice L3 mode&lt;/li&gt;&#xA;&lt;li&gt;For the &lt;em&gt;Transparent Range&lt;/em&gt; select (or create) an Address Object that contains the IP (3.3.3.4 /29 or whatever your subnet is). You can have a single IP in the range, a range of IPs, or a group of IPs. But they must all be from the WAN (probably X1) subnet.&lt;/li&gt;&#xA;&lt;li&gt;Give it a useful comment, enable Ping so you can ping the WAN IP, and HTTPS if you desire.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now you can connect your Linux server to that port (X2, or to a switch connected to that port -- you could have several machines in your range, so long as they all have unique IPs within the WAN subnet, like 3.3.3.5 and 3.3.3.6 in our example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;Default Gateway&lt;/strong&gt; of the devices in the Transparent Range (X2 in our example) can be EITHER the WAN IP of the SonicWALL (3.3.3.3) OR the Default Gateway of the subnet (what the SonicWALL has as its Default Gateway, 3.3.3.1 in our example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DNS&lt;/strong&gt; should be the ISP's DNS servers or some public ones, like Google's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will now need to some &lt;strong&gt;Firewall rules&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Outbound&lt;/em&gt; rules (DMZ &gt; WAN) will probably already allow Any/Any/Any which is probably what you want -- unless you want to block some outbound access.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you want to be able to Ping or HTTPS manage your SonicWALL from this Transparent IP you will need to allow the correct rules here.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;Inbound&lt;/em&gt; rules (WAN &gt; DMZ) will need to be created. You will need to create any rules to allow the outside world to access your server, so you might want to create a rule allowing SIP from ANY to your Server (3.3.3.4). Or SSH from &quot;Your External Management IP&quot; to your Server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You will also want some &lt;em&gt;internal rules&lt;/em&gt; as well, you probably have full access from LAN &gt; DMZ to allow connecting from your LAN to your Server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;But you will likely need some DMZ &gt; LAN rules to allow your Server to connect to your LAN. Such as allowing SMTP from Your Server to your internal mail server (which is maybe 10.100.0.66 on the LAN/X0 interface).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In my experience it can take a few minutes for the Transparent interface to &quot;work&quot; -- so once you configure it and add the rules, try connecting out from the Server to the internet and give the SonicWALL a few mins to update the ARP tables to allow it to work. If it doesn't try changing the gateway on the Server to the SonicWALL's IP. Or test the scenario with a laptop to get a working setup before connecting in your Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Note: L2 Bridge mode is different, that's also Transparent but placing the SonicWALL &quot;inline&quot; more like a switch not a router, if you see that option]&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-10-04T20:54:49.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23066" PostTypeId="1" CreationDate="2015-10-04T21:04:04.550" Score="2" ViewCount="76" Body="&lt;p&gt;I am trying to establish communication between 2 devices within different vlan. But I require a router for that. Can I send packets within different VLAN without having a router or a Layer 3 device.&lt;/p&gt;&#xA;" OwnerUserId="17138" LastEditorUserId="8499" LastEditDate="2018-03-21T01:13:35.437" LastActivityDate="2018-03-21T01:13:35.437" Title="Inter Vlan Packet Transfer" Tags="|routing|vlan|layer2|layer3|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23067" PostTypeId="2" ParentId="23066" CreationDate="2015-10-04T21:48:18.270" Score="6" Body="&lt;p&gt;No you can't.  If you forward packets at layer 2 between the two VLANs, you have effectively made them into one VLAN.  If you forward packets based on layer 3 information,well, that is the definition of  router.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-04T21:48:18.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23068" PostTypeId="2" ParentId="23059" CreationDate="2015-10-04T22:10:46.247" Score="3" Body="&lt;p&gt;Three words:  Don't do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many reasons why, but the most important is that instead of making  resilient links, you have made both data centers vulnerable to the same problem.  If the VPC link goes down, both data centers will think they're active.  That almost certainly means that nothing will work until you restore the link.  Not exactly a robust system is it?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-04T22:10:46.247" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="23071" PostTypeId="1" CreationDate="2015-10-05T02:24:35.613" Score="2" ViewCount="1497" Body="&lt;p&gt;Speaking of Software-Defined Networking, when it is said SDN switches or SDN routers, does it imply the &quot;physical&quot; routers and switches? If not, does it then imply that SDN controller &lt;strong&gt;emulates&lt;/strong&gt; the routers inside its operating system including the routing tables too?&lt;/p&gt;&#xA;" OwnerUserId="19174" LastActivityDate="2016-01-04T12:25:00.033" Title="how do we view Switches and Routers in SDN networking" Tags="|cisco|routing|switch|router|sdn|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23073" PostTypeId="1" AcceptedAnswerId="23074" CreationDate="2015-10-05T04:25:41.793" Score="4" ViewCount="7508" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;From Tanenbaum's Computer Networks:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Point-to-point links&lt;/strong&gt; connect individual pairs of machines. To go from the source to the destination on a network made up of&#xA;  point-to-point links, short messages, called packets in certain&#xA;  contexts, may have to first visit one or more intermediate machines.&#xA;  Often multiple routes, of different lengths, are possible, so finding&#xA;  good ones is important in point-to-point networks. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Point-to-point transmission&lt;/strong&gt; with exactly one sender and exactly one receiver is sometimes called&#xA;  &lt;strong&gt;unicasting&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What is the difference between point-to-point and unicasting?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What&#xA;does the last sentence mean? &#xA;Doesn't a point-to-point transmission&#xA;always have exactly one sender and exactly one receiver?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From Tanenbaum's book&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In the literature, &lt;strong&gt;broadcast channels&lt;/strong&gt; are sometimes referred to as&#xA;  &lt;strong&gt;multiaccess channels&lt;/strong&gt; or random access channels. The protocols used to determine who goes next on a multiaccess channel be- long to&#xA;  a&#xA;  sublayer of the data link layer called the MAC (Medium Access Con-&#xA;  trol) sublayer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/Media_access_control&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Media_access_control&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;The MAC layer&lt;/strong&gt; emulates a full-duplex logical communication channel in a multi-point network. This channel may provide&#xA;  &lt;strong&gt;unicast,&#xA;  multicast or broadcast&lt;/strong&gt; communication service. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Tanenbaum seems to suggest that multiaccess and broadcast are the&#xA;same, while Wikipedia says multiaccess can be unicast, multicast or&#xA;broadcast.  What is the difference between multiaccess and&#xA;broadcast?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastActivityDate="2015-10-05T04:42:57.997" Title="Point-to-point vs unicast, and multiaccess vs multicast/broadcast?" Tags="|multicast|broadcast|point-to-point|mac|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23074" PostTypeId="2" ParentId="23073" CreationDate="2015-10-05T04:42:57.997" Score="2" Body="&lt;p&gt;When you discuss a point-to-point link, you are usually referring to a physical link that exists only between two devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A point-to-point transmission is a transmission from one device to a single other device.  This may or may not cross point-to-point links, but that is not a requirement.  A unicast is essentially the same idea in that it means the packet is addressed to a single recipient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Contrast a broadcast or mutiaccess medium with the idea of a point-to-point link.  A broadcast medium allows multiple devices on a single link.  Each device looks at the destination address of a packet sent on the medium to see if it belongs to him.  This doesn't directly relate to the 'cast designations since those are about how a packet is addressed rather than the medium on which it is sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 'cast references refer to how the packet is addressed, not the medium on which the packet travels.  A unicast is addressed to a single recipient, while a broadcast is addressed to every recipient.  A multicast is addressed to every recipient which has subscribed to the multicast group (the destination address of the packet).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-05T04:42:57.997" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23079" PostTypeId="2" ParentId="23004" CreationDate="2015-10-05T15:55:59.607" Score="1" Body="&lt;p&gt;I haven't worked with the Cisco RV180w, but I want to try to throw out a few suggestions based upon other VPN experience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;(1)&lt;/em&gt;&lt;/strong&gt;&lt;BR /&gt;&#xA;For starters, in your first screenshot, I'm seeing you are requesting the &quot;Remote&quot; side identify themselves with a FQDN, which you have filled out as &quot;remote.com&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually this would be some sort of &quot;Group Username&quot; or &quot;Group Identifier&quot;.  I don't know what other options exist in that drop down, but look for something along those lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the client side, the configuration would use the same &quot;Group Username&quot; as above in &lt;em&gt;their&lt;/em&gt; username configuration.  And then they would use what you have in the &quot;pre-shared key&quot; box as their password.  Note, that multiple users will share the same username and password here.  (see below on how to amend that)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;(2)&lt;/em&gt;&lt;/strong&gt;&lt;BR /&gt;&#xA;You have the same setting to change in your 2nd screenshot.  THe remote end point will probably identify themselves with some sort of Group Username or Password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;(3)&lt;/em&gt;&lt;/strong&gt;&lt;BR /&gt;&#xA;The &quot;Local Traffic Selection&quot; should be an identification of the subnet(s) that exist behind your Cisco router.  If you're only network is 192.168.12.0/24, then you're fine.  But if you have other subnets, you should update this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;(4)&lt;/em&gt;&lt;/strong&gt;&lt;BR /&gt;&#xA;The Remote Traffic Selection should identify the IP address that is given to the users who connect through the VPN.  On Cisco Firewalls, typically an IP pool is created (it doesn't much matter what IPs you pick, just pick something that probably won't' be used at either the client end or your end).  Then you configure the &quot;remote traffic selection&quot; as that subnet.  I'm not sure the implications of leaving that set to Any.  I feel that might cause potential routing issues, so I would avoid it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;(5)&lt;/em&gt;&lt;/strong&gt;&lt;BR /&gt;&#xA;Back on your first screenshot, you have XAUTH set to None.  This is fine while you are testing, but in production this is a pretty big security vulnerability.  For two main reasons:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5.1:  All of users will now share only one Group Username and Pre-Shared Key for password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5.2:  Due to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13468/in-ipsec-vpn-how-is-the-pre-shared-key-encrypted/13473#13473&quot;&gt;how Aggressive Mode negotiates&lt;/a&gt;, the packet which contains the hash of the Pre-Shared Key is sent in clear text.  Which leaves you vulnerable to someone eavesdropping that packet, and running offline brute force attacks on a hash (which can be performed at relatively high speed).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Better to not leave yourself open to this.  XAUTH creates a second layer of username/password challenge, but these are all transferred securely through the VPN tunnel.   So I would suggest turning that on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last thing I would suggest, is running a packet capture on your Cisco box's outside interface, when you have a client trying to connect.  The result of that would be very useful in determining why the VPN connections are not working.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-10-05T15:55:59.607" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23081" PostTypeId="1" AcceptedAnswerId="23094" CreationDate="2015-10-05T18:45:33.867" Score="1" ViewCount="606" Body="&lt;p&gt;Please advise on the following question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With 2 Cisco 2960G switches connected as in the diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Y1cgw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y1cgw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP is not used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could the switches be configured in such a way that all the traffic &lt;code&gt;HOST&amp;lt;-&amp;gt;SERVER&lt;/code&gt; will go like &lt;code&gt;HOST-&amp;gt;SW1-&amp;gt;SW2-&amp;gt;SW1-&amp;gt;SERVER&lt;/code&gt; as in the picture, but not &lt;code&gt;HOST-&amp;gt;SW1-&amp;gt;SERVER&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to block &quot;internal&quot; ports on SW1?&lt;/p&gt;&#xA;" OwnerUserId="19524" LastEditorUserId="8499" LastEditDate="2015-10-05T20:43:44.493" LastActivityDate="2015-10-06T01:51:32.800" Title="Avoiding switch loop?" Tags="|switch|spanning-tree|loop|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23082" PostTypeId="2" ParentId="23081" CreationDate="2015-10-05T19:05:40.690" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vHCTy.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vHCTy.jpg&quot; alt=&quot;Traffic direction with only one way&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is your configuration. You need to configure the host and one port of the switch that connect to the host one the same vlan(23). Then, on the other switch, the 2 ports need to be on another same vlan(24). Finally, do the same with the other port and the server port(vlan25).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All port must be configured like ACCESS-PORTS. Remember that&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2015-10-05T21:27:24.690" LastActivityDate="2015-10-05T21:27:24.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23083" PostTypeId="1" AcceptedAnswerId="24073" CreationDate="2015-10-05T20:34:26.633" Score="10" ViewCount="3457" Body="&lt;p&gt;In a standard Static PAT configuration, where one IP:Port combination is always mapped to another IP:Port combination, there are three possible combinations of inside/outside/source/destination that can be configured. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, this is a configuration example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static tcp 10.0.20.13 8080 2.2.2.33 80&#xA;       ^^^^^^^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In layman's terms, this configuration allows any Outside host to initiate a TCP connection to the IP 2.2.2.33 over port 80.  When this packet hits the router, the &lt;em&gt;destination IP Address and Port&lt;/em&gt; (&lt;code&gt;2.2.2.33:80&lt;/code&gt;) gets translated to &lt;code&gt;10.0.20.13:8080&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reverse would also happen, if the inside host 10.0.20.13 sends a TCP packet with a source port of 8080, as this packet crosses the router, the &lt;em&gt;source IP and Port&lt;/em&gt; (&lt;code&gt;10.0.20.13:8080&lt;/code&gt;) gets translated to &lt;code&gt;2.2.2.33:80&lt;/code&gt;.  (this would typically be a &lt;em&gt;response packet&lt;/em&gt;, rather than one initiated from the Inside host)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here are all the three configuration options for the marked portion above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)#ip nat inside ?&#xA;  destination  Destination address translation&#xA;  source       Source address translation&#xA;&#xA;Router(config)#ip nat outside ?&#xA;  source  Source address translation&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In effect, you could configure:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ip nat &lt;strong&gt;inside source&lt;/strong&gt; static tcp {IP} {Port} {IP} {Port}&lt;/li&gt;&#xA;&lt;li&gt;ip nat &lt;strong&gt;inside destination&lt;/strong&gt; static tcp {IP} {Port} {IP} {Port}&lt;/li&gt;&#xA;&lt;li&gt;ip nat &lt;strong&gt;outside source&lt;/strong&gt; static tcp {IP} {Port} {IP} {Port}&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How are these options different and when would one use each of the three options?  Please use layman's terms like I did above to describe how each would manipulate packets that were coming through the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, can anyone tell me why there is no &lt;strong&gt;outside destination&lt;/strong&gt; option?&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="8499" LastEditDate="2018-12-16T04:40:27.487" LastActivityDate="2018-12-16T04:40:27.487" Title="What do these three options in a Cisco Router NAT configuration mean?" Tags="|cisco|router|nat|cisco-ios|cisco-commands|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23085" PostTypeId="1" CreationDate="2015-10-05T20:47:33.550" Score="2" ViewCount="1357" Body="&lt;p&gt;I am trying to hook up a VPN between us and a customer. Customer has a Checkpoint FW (not sure which version), I have a 2811.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Symptom:&#xA;The tunnel (session) comes up, I can ping through, other side cannot communicate with me, I cannot even see a package coming in, but tons of errors when I debug on the crypto&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISAKMP (0:16559): received packet from 2.1.64.189 dport 500 sport 500 Global (R) QM_IDLE&#xA;ISAKMP: set new node -1881551979 to QM_IDLE&#xA;crypto_engine: Decrypt IKE packet&#xA;crypto_engine: Generate IKE hash&#xA;ISAKMP:(16559): processing HASH payload. message ID = -1881551979&#xA;ISAKMP:(16559): processing SA payload. message ID = -1881551979&#xA;ISAKMP:(16559):Checking IPSec proposal 1&#xA;ISAKMP: transform 1, ESP_3DES&#xA;ISAKMP:   attributes in transform:&#xA;ISAKMP:      group is 2&#xA;ISAKMP:      SA life type in seconds&#xA;ISAKMP:      SA life duration (VPI) of  0x0 0x0 0xE 0x10&#xA;ISAKMP:      authenticator is HMAC-MD5&#xA;ISAKMP:      encaps is 1 (Tunnel)&#xA;ISAKMP:(16559):atts are acceptable.&#xA;IPSEC(ipsec_process_proposal): peer address 2.1.64.189 not found&#xA;ISAKMP:(16559): IPSec policy invalidated proposal with error 64&#xA;ISAKMP:(16559): phase 2 SA policy not acceptable! (local 1.2.226.74 remote 2.1.64.189)&#xA;ISAKMP: set new node -1932908402 to QM_IDLE&#xA;crypto_engine: Generate IKE hash&#xA;ISAKMP:(16559):Sending NOTIFY PROPOSAL_NOT_CHOSEN protocol 3&#xA;    spi 120039592, message ID = -1932908402&#xA;crypto_engine: Encrypt IKE packet&#xA;ISAKMP:(16559): sending packet to 2.1.64.189 my_port 500 peer_port 500 (R) QM_IDLE&#xA;ISAKMP:(16559):Sending an IKE IPv4 Packet.&#xA;ISAKMP:(16559):purging node -1932908402&#xA;ISAKMP:(16559):deleting node -1881551979 error TRUE reason &quot;QM rejected&quot;&#xA;ISAKMP:(16559):Node -1881551979, Input = IKE_MESG_FROM_PEER, IKE_QM_EXCH&#xA;ISAKMP:(16559):Old State = IKE_QM_READY  New State = IKE_QM_READY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We have tried different encodings and hashing on phase2 as well as PFS/no PFS, other DH groups too, but got the same error&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant part of my config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto isakmp policy 4&#xA;encr aes 256&#xA;authentication pre-share&#xA;group 2&#xA;crypto isakmp key ........... address 2.1.64.189&#xA;crypto ipsec transform-set C1 esp-3des esp-md5-hmac&#xA;crypto map grvpn 4 ipsec-isakmp&#xA;set peer 2.1.64.189&#xA;set transform-set C1&#xA;set pfs group2&#xA;match address C1&#xA;ip access-list extended C1&#xA;permit ip 172.30.130.0 0.0.0.255 192.168.33.160 0.0.0.7&#xA;permit ip 192.168.33.160 0.0.0.7 172.30.130.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19526" LastActivityDate="2015-10-05T20:47:33.550" Title="IPSEC VPN between Cisco IOS and Checkpoint SA failure, one way works" Tags="|cisco|ipsec|acl|checkpoint|" AnswerCount="0" CommentCount="2" ClosedDate="2019-12-20T00:15:25.257" ContentLicense="CC BY-SA 3.0" />
  <row Id="23086" PostTypeId="1" AcceptedAnswerId="23088" CreationDate="2015-10-05T20:50:30.440" Score="1" ViewCount="138" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/q8VKe.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/q8VKe.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it practical to connect the printer directly to the main cable (aka trunk) instead of the server as in the photo. If not why? &lt;/p&gt;&#xA;" OwnerUserId="17715" LastEditorUserId="8499" LastEditDate="2015-10-05T22:58:33.070" LastActivityDate="2015-10-05T22:58:33.070" Title="Network Topology" Tags="|lan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23087" PostTypeId="2" ParentId="23086" CreationDate="2015-10-05T21:14:52.777" Score="1" Body="&lt;p&gt;It depends on whether or not the printer has a NIC and built-in print server.  Many new printers will work this way with built-in ethernet and/or Wi-Fi adapters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The diagram shows something that once was very common: a printer connected to a file/print server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what it's worth, the word &quot;trunk&quot; has a connotation as a switch link which carries multiple VLANs.  The diagram is just showing a network, typically a single VLAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-05T21:14:52.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23088" PostTypeId="2" ParentId="23086" CreationDate="2015-10-05T21:26:29.087" Score="1" Body="&lt;p&gt;The books shows the typical case of a printer connected with an serial-paralel-usb cable to a host. Then the host will share &quot;his printer&quot;, and the equipment on network will be able to print once it will connected to the host, and search for &quot;Devices shared&quot; on the target host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Newer printers with hign performance can bring a NIC built-in. In this cases, you can configure an IP address and convert it into a terminal device. Then, all the equipments that can conmunicate with him, and will be able to print without problem.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-05T21:26:29.087" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23094" PostTypeId="2" ParentId="23081" CreationDate="2015-10-06T01:51:32.800" Score="2" Body="&lt;p&gt;To meet this requirement, you can configure switch ports as protected ports (also referred to as private VLAN edge ports). Protected ports do not forward any traffic to protected ports &lt;strong&gt;&lt;em&gt;on the same switch&lt;/em&gt;&lt;/strong&gt;&lt;code&gt;so configure port attached to host and server as protected port&lt;/code&gt; . This means that all traffic passing between protected ports be forwarded through a Layer 3 device. so that just &lt;code&gt;configure vlan 24 as a interface vlan on SW2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NOTE&lt;/em&gt;&lt;/strong&gt; Protected ports can forward any type of traffic to nonprotected ports, and they forward as usual to all ports on other switches. Dynamically learnt addresses are not retained if the switch is reloaded.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-06T01:51:32.800" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23095" PostTypeId="1" AcceptedAnswerId="23096" CreationDate="2015-10-06T01:53:25.830" Score="1" ViewCount="160" Body="&lt;p&gt;Let router A connects two LANs L1 and L2 into an internetwork, and router B connects two LANs L3 and L4 into an internetwork.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can the two internetworks be connected into an internetwork?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it done by connecting router A and B? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, is the connection between A and B treated the same as an connection between A and LAN L1? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me clarify my last question. I assume routers A and B are just gateways between networks for internetworking, without having non-gateway features that are commonly added to personal routers. I am not familiar with gateway only routers, except reading a little on Tanenbaum's Computer Network book.&#xA;But my last question comes from a comparison to personal routers. In my apartment, my personal router has a WAN port and several LAN ports. Back to the case here, do routers A and B (as gateways only) have different ports similarly? What ports of routers A and B are used to connect between A (or B) and the LANs and to connect between A and B? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastEditorUserId="7894" LastEditDate="2015-10-06T01:59:58.980" LastActivityDate="2015-10-06T02:19:02.313" Title="How to connect two internetworks into one?" Tags="|router|internet|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23096" PostTypeId="2" ParentId="23095" CreationDate="2015-10-06T02:13:42.207" Score="1" Body="&lt;p&gt;Routers switch layer-3 packets. It doesn't matter what interface.  When a packet comes into an interface, if the router has a route for the packet, it switches out the interface toward the destination (assuming something like an ACL isn't blocking it).  This could be toward an LAN, another router, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a problem with comparing to consumer-grade equipment since that type of router typically has only a single physical router interface. Interfaces labeled LAN are usually switch interfaces that are connected to a single logical router interface rather than a physical router interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logical interfaces count as router interfaces to/from which routers switch layer-3 packets.  The problems with switch interfaces is that they only switch layer-2 frames, not layer-3 packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers A and B would need a link between them, but they would gladly exchange layer-3 packets.  Somehow, Router A would need to know to switch packets to router B, either through a statically defined route, or through exchanging routes with Router B, and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A home router has a built-in default route toward the WAN port, whereas a business-grade router needs to be explicitly told how to route anything not directly connected, even if it is a configured default route.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-06T02:19:02.313" LastActivityDate="2015-10-06T02:19:02.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23097" PostTypeId="2" ParentId="23095" CreationDate="2015-10-06T02:13:56.113" Score="2" Body="&lt;p&gt;i guess you speak about topology like this &#xA;&lt;a href=&quot;https://i.stack.imgur.com/AKrxD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AKrxD.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;regarding to your first question&lt;/em&gt;&lt;/strong&gt; , answer is sure&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;regarding to your second question&lt;/em&gt;&lt;/strong&gt; L1,L2 can connect L3,L4 by routing configuration on both routers not just connect Router A to router B&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;regarding to your third question&lt;/em&gt;&lt;/strong&gt; it is not clear enough but router A will use its own port P3 to reach the networks behind Router B and so router B will do it will use P4 to know about networks behind router A   &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-06T02:13:56.113" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="23099" PostTypeId="2" ParentId="22837" CreationDate="2015-10-06T05:29:23.680" Score="1" Body="&lt;p&gt;I think you've mostly got it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few points I would make though. &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;The path &lt;code&gt;P_0&lt;/code&gt;, from &lt;code&gt;R&lt;/code&gt; to &lt;code&gt;C_1&lt;/code&gt;, is often (but not always) implemented 'out-of-band', as a separate network. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Only one, or a handful, of packets for each network flow should reach &lt;code&gt;C_1&lt;/code&gt;. As soon as the flows are inserted by the AmyOSPF controller, they are simply forwarded according to that routing logic. This is what the second quote says. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;No.&lt;/strong&gt; AmyOSPF computes the best path &lt;code&gt;P_1&lt;/code&gt; from &lt;code&gt;R&lt;/code&gt; to the destination of the packets, wherever that may be. It can do this without talking to the switches.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The flow entries that make up the path &lt;code&gt;P_1&lt;/code&gt; is then sent to the routers on &lt;code&gt;P_1&lt;/code&gt;, so that all traffic coming from Amy's machine &lt;em&gt;to a particular destination&lt;/em&gt; are sent along that path, without having to go to the controller. In the case of &lt;code&gt;R&lt;/code&gt;, this new flow entry must have higher priority than the one that says to send all traffic from that port to the controller. &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;6&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;It's not really a multicast, the controller has a separate connection to each switch/router. The flow entries may be slightly different for each router too. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The point is that it doesn't matter what 'view' the router has, as all of the routing is done in the controller. But &lt;code&gt;C_0&lt;/code&gt; does have a global view.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This will have to be repeated for each new network flow originating from Amy's machine. It wouldn't make sense to create a path from &lt;code&gt;R&lt;/code&gt; to &lt;code&gt;X&lt;/code&gt; and then send packets destined for &lt;code&gt;Y&lt;/code&gt; along it. Having said that, flow entries can be aggregated.&lt;/p&gt;&#xA;" OwnerUserId="16691" LastActivityDate="2015-10-06T05:29:23.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23100" PostTypeId="1" AcceptedAnswerId="23101" CreationDate="2015-10-05T15:12:11.157" Score="2" ViewCount="364" Body="&lt;p&gt;As I understand, TCP packets in a TCP session can take any path in the world to their destination, the path each takes depends on the routing tables of the routers it passes through, resulting in some packets taking different paths to others (other OSI layers/network factors are involved of course). My network admin professor stated that SSL establishes a &quot;static&quot; (or whatever you want to call it) data pipe, so that all packets take the same route as the initial. I can't find anything to support this, is it correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, does any other protocol suite (or whatever) create similar session &quot;pipes&quot; through routers? And can they work for UDP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all leads to a concept for UDP static data pipes for more consistent WAN performance, due to my widely varied experience with online games and latency/packet loss inconsistency. Is it being done now? How might I achieve this for my own software?&lt;/p&gt;&#xA;" OwnerUserId="19541" OwnerDisplayName="Amateur NetMan" LastActivityDate="2015-10-06T07:18:45.103" Title="Multi-part: TCP, UDP, SSL and Data Pipes" Tags="|routing|tcp|udp|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23101" PostTypeId="2" ParentId="23100" CreationDate="2015-10-05T15:20:59.037" Score="2" Body="&lt;p&gt;SSL can be routed in different ways for each different packet in the same way as any other non-ssl traffic. The routing takes place at a different layer of the stack than the encryption and still relies on the same mechanism for deciding routes for individual packets in a stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By definition the Internet's WAN is packet switched for all protocols - only at a point to point level, or for non-IP networks, can you define protocols that don't switch at the packet level.&lt;/p&gt;&#xA;" OwnerDisplayName="David Scholefield" LastActivityDate="2015-10-05T15:20:59.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23102" PostTypeId="2" ParentId="23100" CreationDate="2015-10-05T15:24:22.000" Score="1" Body="&lt;p&gt;I'm going to assume you misunderstood what your professor said.  Routers forward packets at layer 3, so they don't &quot;know&quot; whether the data is TCP, UDP, or anything else.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They also don't maintain any information about previous packets, so every forwarding decision is made independently.  So packets to the same destination can take different paths. &lt;/p&gt;&#xA;" OwnerUserId="2142" OwnerDisplayName="Ron Trunk" LastActivityDate="2015-10-05T15:24:22.000" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23103" PostTypeId="2" ParentId="23100" CreationDate="2015-10-05T16:01:41.330" Score="0" Body="&lt;p&gt;UDP itself is used when the information does not need to be consistently received on the receiver's end. The reason most gamers feel udp is a far better protocol is primarily down to the game's handling of out of sequence information and/or the use of programming techniques that hides udp ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Short udp joke there ....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words if you can tolerate inconsistent data, and this is primarily the case with a large networked set of players where the player with the largest network issues has the commands conveniently ignored while the rest of the game world proceeds, then udp might be it for you.&lt;/p&gt;&#xA;" OwnerDisplayName="munchkin" LastActivityDate="2015-10-05T16:01:41.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23105" PostTypeId="2" ParentId="23100" CreationDate="2015-10-06T07:18:45.103" Score="0" Body="&lt;p&gt;The short answer is, there's no way of knowing where your packets are routed to. On the one hand you're pretty sure peering agreements of the isp means you can be certain of where the next hop destination will be, but after that, the next-next is not guaranteed. This was the only way you could get guaranteed connectivity on what is essentially a mix of networks without a direct connection to the destination server. You can also contrast it to uucp and smtp where you could specify the intermediate hosts through which your mail could be transmitted between. Since those are not l3 based, it fulfills the conditions of strictly routing through known hosts, but at the same time allowing unfettered packet travel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is also of interest to note every other technology that comes layered above L2/L3 routing considerations is meant to solve characteristics caused by this dichotomy.&lt;/p&gt;&#xA;" OwnerUserId="19539" LastActivityDate="2015-10-06T07:18:45.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23106" PostTypeId="1" AcceptedAnswerId="23108" CreationDate="2015-10-06T07:20:48.690" Score="3" ViewCount="1295" Body="&lt;p&gt;I'm trying to get a first-order evaluation of how network latency / Round Trip Time (RTT) &lt;strong&gt;&lt;em&gt;T&lt;/em&gt;&lt;/strong&gt;, as characterized by ping time, will affect the duration of consecutive sequential POST requests over an https connection (assumed established, reused across requests, and using TLS v1.1 or better). &lt;strong&gt;I'm assuming large&lt;/strong&gt; &lt;strong&gt;&lt;em&gt;T&lt;/em&gt;&lt;/strong&gt; (think 200 ms), and I'm primarily asking if &lt;strong&gt;&lt;em&gt;T&lt;/em&gt;&lt;/strong&gt; influences the POST duration with a multiplication factor of 1, or some higher integer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client waits for answer from a server before sending the next request. Requests and answers are small, and we can at first assume the MTU is not reached even with the encryption/MAC overhead. I'm willing to neglect processing delays by client and server, packet loss, and variations of routing delays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I reason that for large &lt;strong&gt;&lt;em&gt;T&lt;/em&gt;&lt;/strong&gt;, the average POST time is about &lt;strong&gt;&lt;em&gt;N * T&lt;/em&gt;&lt;/strong&gt; for some small positive integer &lt;strong&gt;&lt;em&gt;N&lt;/em&gt;&lt;/strong&gt;; and hope that &lt;strong&gt;&lt;em&gt;N = 1&lt;/em&gt;&lt;/strong&gt; ; is that positively certain (under the above assumptions)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does request and answer size increase that? What parameters mater, like TLS or TCP/IP.. options?&lt;/p&gt;&#xA;" OwnerUserId="19538" LastEditorUserId="8499" LastEditDate="2018-02-16T04:04:49.570" LastActivityDate="2018-02-16T04:04:49.570" Title="POST duration over https vs ping time?" Tags="|tcp|ping|latency|" AnswerCount="2" CommentCount="2" ClosedDate="2019-02-12T03:57:35.003" ContentLicense="CC BY-SA 3.0" />
  <row Id="23107" PostTypeId="2" ParentId="23071" CreationDate="2015-10-06T07:49:14.830" Score="0" Body="&lt;p&gt;you can't say it is emulated because emulating network element is running same physical device operating system and config over emulated hardware , it is totally software defined switch or router or firewall , for example Cisco nexus 1000V it is software defined switch , and it has many features like any physical switches and also has some specific properties like not running any type of Spanning tree protocol &lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2015-10-06T07:49:14.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23108" PostTypeId="2" ParentId="23106" CreationDate="2015-10-06T08:27:15.793" Score="1" Body="&lt;p&gt;&lt;code&gt;N&lt;/code&gt; will &lt;em&gt;always&lt;/em&gt; be more than 1.  It is impossible to accurately judge exactly how much more than 1, but here are some factors that will contribute to increasing the time between a Post request and an HTTP response:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm going to do this from the perspective of a single Post and a single HTTP response compared to a single Echo Request and a single Echo Reply.  The time increase between 1 ICMP Exchange and HTTP Exchange verses 3 ICMP/HTTP Exchanges would be linear.  Each exchange would be affected by each of factor belows.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;1. There are more packets sent/received in the HTTP Post/Response&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;A ping 'sequence' is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01 Client --&amp;gt; Server ICMP Request&#xA;02 Client &amp;lt;-- Server ICMP Response.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where as a HTTP Post/Response sequence would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;01 Client --&amp;gt; Server HTTP Post&#xA;02 Client &amp;lt;-- Server TCP ACK&#xA;03 Client &amp;lt;-- Server HTTP Response&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Server doesn't need wait for the ACK (packet #2) to get to the client before sending the HTTP Response (packet #3).  Both of those packets are sent directly one after the other. But either way, it is still a second packet that must be sent, so an increase to your value &lt;code&gt;N&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;2. Additional Crypto processing causes additional overhead&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Even if the TCP Ack (packet #2 above) didn't need to be sent, the simple fact that the packets are secured with HTTPS is going to require both parties to validate the packet and decrypt the content before it gets passed to the HTTP interpreter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is something the ICMP packet would not require.  Hence, additional time added to &lt;code&gt;N&lt;/code&gt; for the HTTP Request/Response.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;3. HTTP packets might call for additional inspection by transient devices.&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If this communication happens through a Firewall, it is likely the Firewall (or some sort of WAF/IPS) is performing additional processing/inspection/validation on the HTTP packets.  In particular, since this a Post request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is less likely if it is HTTPS.  But many transient firewalls can now decrypt HTTPS, inspect the underlying HTTP, and then re-encrypt the HTTPS before sending it on its way.  Again, less likely, but not something we can dutifully rule out entirely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such inspection would not be necessary for simple ICMP packets.  And not just because the packets themselves would more than likely be smaller.  There is just less malicious intent that can exist with the far simpler ICMP protocol, as such more 'attention' is put in to deeper inspection of the HTTP/HTTPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;4. An HTTP Post requires more processing by the server&lt;/H3&gt;&#xA;Responding to an ICMP Response is (relatively) easy.  At best, there is a little bit of data in the ICMP echo Payload to copy to the ICMP Response.  Depending the content of the HTTP Post, there is more to consider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there data entry validation?  Does the content that is posted need to be processed and somehow included in the HTTP Response?  Does it have to be processed 'as is', or does it require some analyzing before a useful HTTP Response can be produced?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are literally endless possibilities for what sort of analyzing and/or data is presented in the Post.  And this additional processing would also account for an increase to your &lt;code&gt;N&lt;/code&gt; value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure there are others, but those are the ones I could come up with thus far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit:  added #4&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2015-10-06T14:30:48.387" LastActivityDate="2015-10-06T14:30:48.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23110" PostTypeId="1" AcceptedAnswerId="23129" CreationDate="2015-10-06T09:52:11.220" Score="3" ViewCount="162" Body="&lt;p&gt;Please HELP &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hi I am trying to configure the DHCP server in the network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NETMAP of my network layout is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;150:0/0 250:0/0&#xA;250:0/1 450:0/0&#xA;250:1/0 350:0/0&#xA;250:1/1 550:0/0`&#xA;Say here 150,250,350,450 and 550 represents the router and each interface is connected in the above fashion example the 0/0 interface of router 150 is connected to interface 0/0 of the router 250 and so on.&#xA;&#xA;I am trying to make the router 450 as the DHCP server the config for that is&#xA;&#xA;`!&#xA;! Last configuration change at 14:37:39 IST Tue Oct 6 2015&#xA;!&#xA;version 15.5&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;clock timezone IST 5 30&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;&#xA;&#xA;&#xA;&#xA;ip dhcp excluded-address 10.0.0.1 10.0.0.30&#xA;ip dhcp excluded-address 30.0.0.1 30.0.0.20&#xA;ip dhcp excluded-address 40.0.0.1 40.0.0.10&#xA;!&#xA;ip dhcp pool DHCP150&#xA;network 10.0.0.0 255.255.255.0&#xA;default-router 10.0.0.1 255.255.255.0&#xA;!&#xA;ip dhcp pool DHCP350&#xA;network 30.0.0.0 255.255.255.0&#xA;default-router 30.0.0.1 255.255.255.0&#xA;!&#xA;ip dhcp pool DHCP550&#xA;network 40.0.0.0 255.255.255.0&#xA;default-router 40.0.0.1 255.255.255.0&#xA;!&#xA;!&#xA;!&#xA;&#xA;&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Ethernet0/0&#xA;ip address 20.0.0.2 255.0.0.0&#xA;!&#xA;interface Ethernet0/1&#xA;no ip address&#xA;!&#xA;interface Ethernet0/2&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Ethernet0/3&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Ethernet1/0&#xA;no ip address&#xA;!&#xA;interface Ethernet1/1&#xA;no ip address&#xA;!&#xA;interface Ethernet1/2&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Ethernet1/3&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Serial2/0&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial2/1&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial2/2&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial2/3&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/0&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;logging synchronous&#xA;line aux 0&#xA;line vty 0 4&#xA;login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can you guys please tell me what should i do on the client side ?&#xA;I guess first  I should provide the default routes on the client so that they know how to reach the DHCP server but even if i am trying to configure the ip routes on the client .&#xA;I am getting the message as gateway of the last resort is not set whenever i do sh ip route&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the configs on the 250 router where all the other router connects is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;! Last configuration change at 14:44:09 IST Tue Oct 6 2015&#xA;!&#xA;version 15.5&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;clock timezone IST 5 30&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;&#xA;&#xA;&#xA;&#xA;ip dhcp excluded-address 10.0.0.1 10.0.0.30&#xA;!&#xA;ip dhcp pool DHCP1&#xA;network 10.0.0.0 255.0.0.0&#xA;default-router 10.0.0.1&#xA;dns-server 10.0.0.1&#xA;domain-name cisco.local&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;&#xA;&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Ethernet0/0&#xA;ip address 10.0.0.1 255.0.0.0&#xA;!&#xA;interface Ethernet0/1&#xA;ip address 20.0.0.1 255.0.0.0&#xA;!&#xA;interface Ethernet0/2&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Ethernet0/3&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Ethernet1/0&#xA;ip address 30.0.0.1 255.0.0.0&#xA;!&#xA;interface Ethernet1/1&#xA;ip address 40.0.0.1 255.0.0.0&#xA;!&#xA;interface Ethernet1/2&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Ethernet1/3&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Serial2/0&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial2/1&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial2/2&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial2/3&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/0&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;logging synchronous&#xA;line aux 0&#xA;line vty 0 4&#xA;login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&#xA;&#xA;&#xA;!&#xA;! Last configuration change at 15:07:25 IST Tue Oct 6 2015&#xA;!&#xA;version 15.5&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;clock timezone IST 5 30&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;&#xA;&#xA;&#xA;&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;&#xA;&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Ethernet0/0&#xA;ip address 10.0.0.1 255.255.255.0&#xA;!&#xA;interface Ethernet0/1&#xA;ip address 20.0.0.1 255.255.255.0&#xA;!&#xA;interface Ethernet0/2&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Ethernet0/3&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Ethernet1/0&#xA;ip address 30.0.0.1 255.255.255.0&#xA;!&#xA;interface Ethernet1/1&#xA;ip address 40.0.0.1 255.255.255.0&#xA;!&#xA;interface Ethernet1/2&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Ethernet1/3&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Serial2/0&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial2/1&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial2/2&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial2/3&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/0&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA;no ip address&#xA;shutdown&#xA;serial restart-delay 0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;logging synchronous&#xA;line aux 0&#xA;line vty 0 4&#xA;login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to configure the defualt routes on the client but is saying that gateway of the last resort is not set.&lt;/p&gt;&#xA;" OwnerUserId="14661" LastActivityDate="2015-10-06T22:13:15.517" Title="DHCP Configurauion on Cisco router" Tags="|cisco|router|ipv4|dhcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23111" PostTypeId="2" ParentId="23110" CreationDate="2015-10-06T10:45:04.587" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I guess first I should provide the default routes on the client so&#xA;  that they know how to reach the DHCP server but even if i am trying to&#xA;  configure the ip routes on the client&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Nope, clients discover DHCP server/s by sending a broadcast packet (DHCPDISCOVER, UDP packet from port 68 - bootpc - to 67 - bootps), consequently your DHCP server must be in the same broadcast domain of the clients to serve. As an kind of exception, a DHCP Relay Agent placed on the broadcast domain may be enough; basically, it forwards the DHCP messages from the clients in the network it connects to a remote DHCP server (command &quot;ip helper x.x.x.x&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for instance, if interface Ethernet1/0 of Router 250 owns 30.0.0.1/8 (broadcast domain), either the config &quot;ip dhcp pool DHCP350&quot; on router 450 should be moved to the 250, or the 250 should be configured as DHCP Relay Agent towards the 450.&lt;/p&gt;&#xA;" OwnerUserId="17572" LastActivityDate="2015-10-06T10:45:04.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23112" PostTypeId="1" CreationDate="2015-10-06T11:23:40.840" Score="2" ViewCount="663" Body="&lt;p&gt;i am trying to use a netsh command to help setup an FTP &quot;Tunnel&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;netsh interface portproxy add v4tov4 listenport=21 listenaddress=0.0.0.0 connectport=21 connectaddress=ftpserver&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If i setup the tunnel on machine A this seems to work grand.  If i go to machine B and ftp to machine A i do get the login for the ftpserver.  However when i try to issue any commands i get errors like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;425-Can't build data connection for x.x.x.x,64009&#xA;425 connect to network object rejected&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem i think is the returning connection is getting stuck at machine A , as it only forwards port 21 and not port 64009.  i have setup machine A to forward port 64009 back to machine B, which does get further down the line but times out after &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;150 Opening data connection for HOST:[FOLDERA]*.*;* (x.x.x.x,64009)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am i doing this all the wrong way? or can someone offer advice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically i am trying to access an ftp server from machine B which is on a different network, nut machine A is on both networks ( two network cards) &lt;/p&gt;&#xA;" OwnerUserId="19545" LastEditorUserId="509" LastEditDate="2015-12-06T11:06:41.450" LastActivityDate="2015-12-06T11:06:41.450" Title="How could i &quot;tunnel&quot; through a PC to access ftp server" Tags="|tunnel|" AnswerCount="2" CommentCount="1" ClosedDate="2019-02-12T03:56:54.650" ContentLicense="CC BY-SA 3.0" />
  <row Id="23114" PostTypeId="1" CreationDate="2015-10-06T12:58:57.857" Score="4" ViewCount="477" Body="&lt;p&gt;I need help with a NAT configuration on a Cisco router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the diagram:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4xSsl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4xSsl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Explanation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer1 from network 10.197.56.0 connects to Client1, and it's default GW is Router1, but it needs to connect to host 10.100.2.1 of Client2 so it has a static route to Cisco1 (10.197.56.5) which does a NAT.  Also Cisco1 has a static route 10.100.0.0/16 to 172.19.0.4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And here are the configurations for NAT:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0.1   &#xA; encapsulation dot1Q 1 native    &#xA; ip address 10.197.56.5 255.255.255.0    &#xA; ip nat inside     &#xA; ip virtual-reassembly in    &#xA;!   &#xA;interface FastEthernet0/1    &#xA; ip address 172.19.0.5 255.255.255.0    &#xA; ip nat outside    &#xA; ip virtual-reassembly in    &#xA; duplex auto    &#xA; speed auto     &#xA;!    &#xA;ip route 10.100.0.0 255.255.0.0 172.19.0.4   &#xA;ip route 172.24.0.0 255.255.0.0 10.197.56.5    &#xA;access-list 1 permit 10.197.56.0 0.0.0.255     &#xA;ip nat inside source list 1 interface FastEthernet0/1 overload      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Up to this point it's OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problems comes with the second need:&#xA;Computer3 has a default GW 172.30.56.1 to connect to Client3 to reach production networks, but it also needs to connect to a host 172.24.2.6 (mail server) from Client1. I need to NAT in Cisco1 the from 172.30.56.10 to 10.197.56.5 at the same time that Cisco1 NATs computers from Network1 to Client2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How may I accomplish this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I finally did it with NVI:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here the config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA;no ip address&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet0/0.1&#xA;encapsulation dot1Q 1 native&#xA;ip address 10.197.56.5 255.255.255.0&#xA;ip nat enable&#xA;!&#xA;interface FastEthernet0/0.39&#xA;encapsulation dot1Q 39&#xA;ip address 172.30.56.5 255.255.255.0&#xA;ip nat enable&#xA;!&#xA;interface FastEthernet0/1&#xA;ip address 172.19.0.5 255.255.255.0&#xA;ip nat enable&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;&#xA;ip nat pool NAT_client2 172.19.0.7 172.19.0.7 netmask 255.255.255.0 add-route&#xA;ip nat pool NAT_client1-3 10.197.56.215 10.197.56.215 netmask 255.255.255.0 add-route&#xA;ip nat source list client2_NAT pool NAT_client2 overload&#xA;ip nat source list NAT_client1-3 pool NAT_client1-3 overload&#xA;ip route 0.0.0.0 0.0.0.0 10.197.56.1&#xA;ip route 10.100.0.0 255.255.0.0 172.19.0.4&#xA;ip route 172.24.0.0 255.255.0.0 10.197.56.1&#xA;&#xA;!&#xA;ip access-list extended client2_NAT&#xA; permit ip 10.197.56.0 0.0.0.255 any&#xA;ip access-list extended NAT_client1-3&#xA; permit ip 172.30.56.0 0.0.0.255 172.24.0.0 0.0.255.255&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;thanks anyway.&lt;/p&gt;&#xA;" OwnerUserId="19546" LastEditorUserId="19546" LastEditDate="2015-10-13T09:38:07.263" LastActivityDate="2016-02-10T11:23:20.457" Title="Multiple direction NAT" Tags="|cisco|nat|" AnswerCount="1" CommentCount="8" ClosedDate="2019-03-26T02:27:22.763" ContentLicense="CC BY-SA 3.0" />
  <row Id="23115" PostTypeId="2" ParentId="23112" CreationDate="2015-10-06T13:56:26.303" Score="1" Body="&lt;p&gt;Port 21 is used only for FTP control.  You also have to &quot;tunnel&quot; port 20, which is used for the actual data transfer.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-06T13:56:26.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23116" PostTypeId="2" ParentId="23112" CreationDate="2015-10-06T13:56:37.443" Score="0" Body="&lt;p&gt;The originating host will pick a random port from which to initiate a conversation, in this case, it was port 64009.  The destination host will reply to the originating host on that port.  Machine A sends from port 64009 to Machine B port 21.  Machine B will replay to Machine A port 64009.  The next time Machine A tries to start a conversation, it will use another randomly chosen port, probably not the same one, and Machine B will need to respond to that port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FTP uses two ports: port 21 is the FTP Control port and port 20 is the FTP Data port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the two networks use the same addressing, Windows has a bridge mode to bridge two network segments.  If they are different networks altogether, that is what routers are for.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-06T13:56:37.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23118" PostTypeId="2" ParentId="23106" CreationDate="2015-10-06T14:47:23.967" Score="0" Body="&lt;p&gt;You can't compare times between packets (like ICMP) that only get as high as layer-3 to datagrams (like HTTP) that must endure processing all the way up to layer 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference is going to depend on the hosts on each end.  The host processing is going to add a large, unpredictable overhead.  You have no way of knowing the capabilities of the hosts, the applications that the hosts are using, and the host load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such a comparison is not valid since it will vary greatly based on the endpoints themselves which has nothing at all to do with the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Certainly, network latency plays a part, and a change in latency affects the total time, but what you get from a PING can't really be used in the calculation.  The TCP nature of HTTP/HTTPS will vary the amount of data that can be transferred in a window.  TCP, with its reliability algorithms, will  multiply the latency, but it is not a constant multiple, varying during a transfer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The nature of the layers higher than layer-3 will multiply the latency in ways that you can't completely predict, but you may be able to average them over a period of time if the data transferred is identically sized every time.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-06T15:35:49.873" LastActivityDate="2015-10-06T15:35:49.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23120" PostTypeId="1" CreationDate="2015-10-06T15:55:53.313" Score="1" ViewCount="55" Body="&lt;p&gt;For some time I noticed that my ultrabook Lenovo Thinkpad experiences a faster decrease in speed, in terms of distance from the router, as other devices. I tested (with speedtest.net) and these are the results (the following values are the approximated averages of download and upload speeds (download ~= upload anyways); also I didn't repeat the tests many times and they might not be accurate, but the problem is persistent!). &lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt; Device           |      2 meters      | 4 meters + 1 wall  | 8 meters + 2 walls &#xA;---------------------------------------------------------------------------------&#xA; Lenovo Thinkpad  |      50 Mbps       |      30 Mbps       |      &lt;strong&gt;1.5 Mbps&lt;/strong&gt;&#xA;---------------------------------------------------------------------------------&#xA; Sony Xperia phone|      35 Mbps       |      30 Mbps       |       25 Mbps&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that on a mid-range HP laptop the speed tends to vary in the phone's fashion (I can't make the tests on it right now; that is based purely on observation). When i download something being 8 meters away on the troubling device, it seems like every centimeter counts! Let's say I download something with 200kb/s, if I move 20 centimeters closer in the router's direction, the speed might go up to 300kb/s or even more! What might be the problem? Is the problem on the router's side (a mid-range TP-LINK) or is it on the laptop's side (hardware or software)? Can I fix it? (it bothers me when I try to watch videos) If not, I am quite curious what causes the problem anyways, because as far as I know, this is really, really strange!&lt;/p&gt;&#xA;" OwnerUserId="19554" LastActivityDate="2015-10-06T17:32:39.993" Title="Strange wireless speed variation in terms of distance!" Tags="|router|wireless|" AnswerCount="1" CommentCount="1" ClosedDate="2015-10-06T17:52:52.503" ContentLicense="CC BY-SA 3.0" />
  <row Id="23123" PostTypeId="1" AcceptedAnswerId="23124" CreationDate="2015-10-06T16:48:11.413" Score="2" ViewCount="136" Body="&lt;p&gt;I have enabled top-talkers ingress/egress &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip flow-top-talkers&#xA; top 10&#xA; sort-by bytes&#xA; cache-timeout 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to confirm a couple things with the output below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) When I see a (K), I assume its Kilobytes, NOT Kilobits?&#xA;2.) I see two different flows for the same source. Could an example of this be when someone is downloading a file and uploading or streaming music simultaneously?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ip flow top-talkers&#xA;&#xA;SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP Bytes&#xA;Fa0/0         192.168.1.1     Local         192.168.1.2     01 0000 0800  2257K&#xA;Fa0/0         192.168.1.1     Local         192.168.1.2     01 0000 0000   165K&#xA;2 of 10 top talkers shown. 2 flows processed.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19559" LastEditorUserId="2142" LastEditDate="2015-10-06T16:56:22.170" LastActivityDate="2015-10-06T17:02:46.100" Title="Cisco top-talker data" Tags="|cisco|router|netflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23124" PostTypeId="2" ParentId="23123" CreationDate="2015-10-06T17:02:46.100" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;If you read the heading over the K quantities, it says, &quot;Bytes.&quot;&lt;/li&gt;&#xA;&lt;li&gt;A host can have many different simultaneous flows.  Just about everything today multitasks. You can download multiple things and upload multiple things all while using VoIP.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-06T17:02:46.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23125" PostTypeId="2" ParentId="23120" CreationDate="2015-10-06T17:32:39.993" Score="1" Body="&lt;p&gt;This is likely a difference in the Wifi technology in the client devices. In most cases devices using the 5GHz frequency range (802.11a, n and ac) have a much better throughput (transfer speed) but a much shorter range, than devices operating in the 2.4GHz range (802.11b, g and n).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I have 2 smartphones. One is newer and uses 5GHz(with 802.11n) and downloads faster, but drops out once I move more than 2 rooms away. The older phone uses 2.4GHz(with 802.11g) and can still get WiFi in the street.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The frequency set and 802.11 standard used depends on the device's WiFi hardware, the WiFi router's capabilities, and what settings have been applied in both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.11&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for more info about Wifi.&lt;/p&gt;&#xA;" OwnerUserId="19541" LastActivityDate="2015-10-06T17:32:39.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23126" PostTypeId="2" ParentId="23114" CreationDate="2015-10-06T19:02:06.093" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/i2oaN.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/i2oaN.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;i just redraw your network in more clear way to define the problem ,&#xA;first of all you have 6 network and i mark each one with different color and your CISCO router know about 4 of them only so you need to define the remaining two in blue and dark red colors.the blue one by define the router interface and the dark red one by static route then perform what ever NATing you want on CISCO router&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;from my side NAT is not the best practice , but ACL with route mab&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;a- CISCO router know about 3 networks by default and by static nating will know about the other 3&lt;br /&gt;&#xA;b- on the GW of the computer configure extended access list and define the source host and destination host&lt;br /&gt;&#xA;c- on the GW router configure route map that match this access list and set its next hop as CISCO router&lt;/p&gt;&#xA;&lt;p&gt;and that will make you achieve your gool easy and  secure way&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-10-06T19:02:06.093" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23127" PostTypeId="1" AcceptedAnswerId="23233" CreationDate="2015-10-06T19:40:44.787" Score="0" ViewCount="1148" Body="&lt;p&gt;Pinging from one SRC to a few DST's I can see some drops happening on my captures for some attempts and none for others.  Wondering how I can see what's really happening to  ALL of the arriving icmp packets outlined in my tests below.  Thank you!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wEfgb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wEfgb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA config - ready to paste into GNS3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!-- Test lab script&#xA;En&#xA;&#xA;Conf t&#xA;Hostname US&#xA;&#xA;Int gi0&#xA;Ip address 172.30.1.1 255.255.255.0&#xA;Nameif backend&#xA;Security-level 50&#xA;No shut&#xA;&#xA;Int gi1&#xA;Ip address 10.15.99.129 255.255.255.0&#xA;Nameif data_admin&#xA;Security-level 50&#xA;No shut&#xA;&#xA;Same-security-traffic permit inter-interface&#xA;&#xA;Object network host_10.15.99.129&#xA;  host 10.15.99.129&#xA;&#xA;Object network host_10.59.2.137&#xA;  host 10.59.2.137&#xA;&#xA;Access-list backend line 1 extended permit ip any any&#xA;Access-list backend line 1 extended permit icmp any any echo&#xA;Access-list data_admin line 1 extended permit ip any any&#xA;Access-list data_admin line 1 extended permit icmp any any echo&#xA;&#xA;Access-group backend in int backend&#xA;Access-group data_admin in int data_admin&#xA;&#xA;route backend 10.80.55.0 255.255.255.0 172.30.1.2&#xA;&#xA;Nat (data_admin,backend) source static host_10.15.99.129 host_10.59.2.137&#xA;&#xA;Class-map icmp-class&#xA;  match any&#xA;Exit&#xA;&#xA;Policy-map icmp_policy&#xA;  class icmp-class&#xA;    inspect icmp&#xA;Exit&#xA;&#xA;Service-policy icmp_policy interface backend&#xA;Service-policy icmp_policy interface data_admin&#xA;&#xA;Capture capin int backend match icmp any any&#xA;Capture capout int data_admin match icmp any any&#xA;Capture aspdrop type asp-drop all match ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Packet captures:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!-- From PC to NAT IP of data_admin interface (FW)&#xA;9 packets captured&#xA;&#xA;   2: 04:27:33.064129 10.80.55.50 &amp;gt; 10.59.2.137: icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;   5: 04:27:35.046445 10.80.55.50 &amp;gt; 10.59.2.137: icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;   7: 04:27:37.105936 10.80.55.50 &amp;gt; 10.59.2.137: icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;   8: 04:27:39.090586 10.80.55.50 &amp;gt; 10.59.2.137: icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;   9: 04:27:41.117944 10.80.55.50 &amp;gt; 10.59.2.137: icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;&#xA;!-- From PC to interface IP of data_admin interface (FW)&#xA;Nothing&#xA;&#xA;!-- From PC to data_admin router interface &#xA;12 packets captured&#xA;&#xA;   5: 19:24:07.343045 10.80.55.50 &amp;gt; 10.15.99.130: icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;   6: 19:24:09.287643 10.80.55.50 &amp;gt; 10.15.99.130: icmp: echo request&#xA;   7: 19:24:11.370510 10.80.55.50 &amp;gt; 10.15.99.130: icmp: echo request&#xA;  10: 19:24:13.166022 10.80.55.50 &amp;gt; 10.15.99.130: icmp: echo request&#xA;  11: 19:24:15.201863 10.80.55.50 &amp;gt; 10.15.99.130: icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;  12: 19:24:17.262223 10.80.55.50 &amp;gt; 10.15.99.130: icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once we answer the question of why I can't see some of these drops. I would like to know why these are getting dropped in the first place.  I've already tried things like setting the service-policy to global, setting the inspection policy in the default class, or setting inspection globally, all with the same results.  Ultimately though should inspection of icmp and allowance by ACL not account for everything?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2015-10-09T22:05:05.277" Title="ASA and ICMP - can't see drops via aspdrop - why are drops happening?" Tags="|cisco|cisco-asa|icmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23128" PostTypeId="1" CreationDate="2015-10-06T20:37:48.273" Score="1" ViewCount="1429" Body="&lt;p&gt;We've enabled IGMP snooping on one of our VLANs.  The configuration used is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bridge multicast filtering&#xA;ip igmp snooping&#xA;ip igmp snooping vlan 1&#xA;ip igmp snooping vlan 1 querier&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We're now seeing the message &quot;%BRG_IGMP_QRR-W-DUPLICATE_IP: Duplicate IGMP Querier IP address 192.168.142.1 detected on VLAN 1. Remote MAC address is 34:a8:4e:0d:34:55.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IP address and MAC address belong to this switch... so I'm puzzled as to why the switch is identifying itself as a duplicate IGMP Querier IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I totally misunderstanding what this message means?  It looks like it's logged every time a multicast packet is sent from one of our stock system applications, which uses the multicast address 239.255.0.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're using Cisco SG300-28P switches, running v1.4.1.3 firmware.  This particular switch is in layer 3 mode and has multiple VLAN interfaces.&lt;/p&gt;&#xA;" OwnerUserId="16081" LastActivityDate="2015-10-06T20:37:48.273" Title="Cisco SG300 switch identifies itself as duplicate IP address" Tags="|cisco|multicast|igmp|cisco-small-business|" AnswerCount="0" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23129" PostTypeId="2" ParentId="23110" CreationDate="2015-10-06T22:13:15.517" Score="2" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;first of all&lt;/em&gt;&lt;/strong&gt; it seams to be IOU lap&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bZ3AG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bZ3AG.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;strong&gt;&lt;em&gt;here you fail in many of the problems&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA; 1- you configured DHCP pool contain same range in router 450 and router 250 (10.0.0.0/24 and 10.0.0.0/8) which will result in iP conflict&lt;br&gt;&#xA; 2- essentially &lt;strong&gt;&lt;em&gt;&lt;code&gt;why you need to configure this DHCP server ??&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt; , the networks which you configured as a DHCP pools already used as inter connect between routers , DHCP regularly used for a client or hosts behind the router (which will be sure in networks other than the networks used in conecting routers to each other)&lt;br&gt;&#xA; 3- just for the information if you aim to use router 450 as a DHCP server for clients behind other routers just use the &lt;strong&gt;&lt;em&gt;&lt;code&gt;IP helper command&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt; under the interface used as a GW for your client network&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-06T22:13:15.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23131" PostTypeId="2" ParentId="17775" CreationDate="2015-10-07T07:54:35.850" Score="0" Body="&lt;p&gt;I Went ahead with the firmware upgrade and it did wipe the configuration as it is an entirely different OS.&lt;/p&gt;&#xA;" OwnerUserId="13529" LastActivityDate="2015-10-07T07:54:35.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23132" PostTypeId="1" AcceptedAnswerId="23173" CreationDate="2015-10-07T08:22:52.830" Score="1" ViewCount="1238" Body="&lt;p&gt;The logs from CISCO ASA fierwall is currently in the following format.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;%ASA-message_class-severity-messageID&lt;/p&gt;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   &amp;quot;%ASA-session-6-.....&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I want to remove messsage class from logs&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;%ASA-severity-messageID&lt;/p&gt;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   &amp;quot;%ASA-6-.....&amp;quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I checked in internet and cicso configue help guide, then tried the commands&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;   no logging class session&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;But still coming the logs with message class. Please help me&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;   no logging emblem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Is this work?&lt;/p&gt;&#xA;&lt;p&gt;Which is the actual command for that?&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="16027" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-10-08T16:34:32.503" Title="Configure Log format Cisco ASA firewall" Tags="|cisco|cisco-asa|cisco-ios|cisco-commands|logging|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23135" PostTypeId="1" CreationDate="2015-10-07T12:16:12.773" Score="1" ViewCount="3465" Body="&lt;p&gt;I'm not asking for answers but rather guidance on whether am i doing it right. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the transfer of a data file of 10^6 bits from a source to a destination for the following switching network:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The data rate of the line is 1 Mbps.&lt;/li&gt;&#xA;&lt;li&gt;The file is divided into fixed packet size, each of which has a size&#xA;of 4000 bits (including data and header), before transmitting. There&#xA;is 250 bits in the header. If there is not enough data to fill a&#xA;packet, it is filled with zeros before transmission. All frames sent&#xA;have the same size.&lt;/li&gt;&#xA;&lt;li&gt;The propagation delay per transmission is 0.002 sec.&lt;/li&gt;&#xA;&lt;li&gt;Each packet must be transmitted 7 times before reaching destination.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(i) Determine the number of packets needed to transmit the data file using packet switching. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(ii) Determine the time it takes each host along the path to transmit the entire data file.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(iii) Compute the end to end delay using datagram packet switching. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For part (i), I have calculated the number of packets needed would be 267 packets, however I am having problems with part (ii) and (iii)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For (ii) my calculations are these:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Propagation time tp = 0.002 sec&#xA;Data rate = 1 x 10^6 bps (1 Mbps)&#xA;Packet length = 10^6 bits / 267 + 250 = 3995.318 bits&#xA;Packet transmission time td = 3995.318 bits / 1 x 10^6 = 0.003995 sec&#xA;Total time = tp + (267 x td) + tp + td = 0.002 sec + (267 x 0.003995 sec) + 0.002 sec + 0.003995 sec = 1.07466 ≈ 1.075 sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have calculated that it takes 1.075 sec to transmit the entire data file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I did a bit of googling and got a different way of calculation for total transmit time. &#xA;Here is the link, &lt;a href=&quot;http://www.academia.edu/6835957/Homework_1_Solution_Total_50_Points_Extra_Credit_10_Points_Problem_1_Time_Division_Multiplexing_Points_4&quot; rel=&quot;nofollow&quot;&gt;http://www.academia.edu/6835957/Homework_1_Solution_Total_50_Points_Extra_Credit_10_Points_Problem_1_Time_Division_Multiplexing_Points_4&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm confused whether am I'm doing it right.  Should I follow the website for part (iii), too? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seriously, I need some guidance here  since I'm, new to this module.&lt;/p&gt;&#xA;" OwnerUserId="19573" LastEditorUserId="8499" LastEditDate="2015-10-07T14:31:21.200" LastActivityDate="2015-10-07T14:31:21.200" Title="Calculating total time and end to end delay for datagram packet switching" Tags="|lan|throughput|" AnswerCount="0" CommentCount="3" ClosedDate="2015-10-08T02:05:38.713" ContentLicense="CC BY-SA 3.0" />
  <row Id="23136" PostTypeId="1" CreationDate="2015-10-07T16:55:09.193" Score="1" ViewCount="725" Body="&lt;p&gt;The AS-path policy for this eBGP neighbor is receive/send routes with maximum 3 AS paths away from/to us/customer. The issue is we found out from traffic analysis that this neighbor also route traffic beyond the 2 AS paths away from us. In other words, we have become transit without any intention to be that and without our permission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only possible solution that I can think of is my eBGP router that peering to that eBGP neighbor should have only BGP routes that have maximum 2 AS paths and no default route in IP routing table. So, traffic with destination beyond IGP and 2 AS paths away will be dropped by my router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other solution? It seems impossible with access list.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-10-08T22:53:37.123" Title="How to filter traffic to routes that I do not advertise to eBGP neighbors?" Tags="|bgp|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="23137" PostTypeId="1" AcceptedAnswerId="23140" CreationDate="2015-10-07T16:58:05.257" Score="0" ViewCount="75" Body="&lt;p&gt;Developer here, not a sysadmin. After reading over my firewall logs and seeing (assuming bot inititied) DROP entries, I'd like to script something to auto-update my firewall settings to deny their originating IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a sensible strategy? Should I simply let the firewall continue to deny these hits by itself and hope they don't return or progress into something more?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or perhaps I should simply be asking for documentation or tutorials on router configurations?&lt;/p&gt;&#xA;" OwnerUserId="19578" LastEditorUserId="509" LastEditDate="2015-10-09T05:40:13.123" LastActivityDate="2015-10-09T05:40:13.123" Title="Is it possible to auto update router firewall filter?" Tags="|router|firewall|security|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23140" PostTypeId="2" ParentId="23137" CreationDate="2015-10-07T17:48:10.650" Score="0" Body="&lt;p&gt;If your firewall is denying the traffic, what would you hope to accomplish by changing the firewall? A deny is a deny; the firewall is doing its job, and you want to change that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could do that, but, if this firewall is connected to the Internet, you will end up with far too many specific deny statements. Typically, the firewall will deny any traffic initiated from outside unless you have specifically added exceptions. I don't see much to gain from all the work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Holes are automatically created for outside traffic when a traffic flow is originated from the inside.  The hole is created for a specific flow from the a specific address and port to a specific address and port.  Even with those restrictions, the hole only lasts so long before being closed.  You could open a specific hole with a firewall exception to allow any outside traffic to a specific address/port in your network to allow things like a web server to be accessed from outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a very broad subject that cannot properly be discussed in this forum, and product or resource recommendations are specifically off-topic for this forum.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-07T17:50:54.953" LastActivityDate="2015-10-07T17:50:54.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23141" PostTypeId="2" ParentId="23136" CreationDate="2015-10-07T18:00:32.283" Score="1" Body="&lt;p&gt;You can avoid become a transit AS using the next configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create an as-path access list match YOUR OWNS NETWORKS and only advertise that.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)#ip as-path access-list X permit ^$&#xA;&#xA;Router(config-router)#neighbor x.x.x.x filter-list X out&#xA;Router(config-router)#neighbor y.y.y.y filter-list X out&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On that form, you can be sure that all your providers only will go to you, to reach YOUR NETWORKS&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-07T18:00:32.283" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23144" PostTypeId="1" CreationDate="2015-10-07T22:58:54.173" Score="2" ViewCount="492" Body="&lt;p&gt;We have a Cisco 3825 router with an IPSec Remote Access VPN configured to authenticate against a radius server. We're retiring the old server and moving to a new one (Windows Server 2012). We changed the radius-server host line in our config accordingly and the router is able to communicate with the new radius server. The server is denying access however, because the Cisco is configured to use PAP authentication which I've configured our radius to not accept because it is insecure. I'd like to change this to PEAP-MSCHAPv2 on the router but can't manage to figure out if this is possible. I find a lot of information about this related to the ASA, but not the IOS platform. Any advice on how to configure this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running C3825-ADVIPSERVICESK9-M Version 12.4(24)T8&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cleansed config pasted below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto isakmp policy 10&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key &amp;lt;remove&amp;gt; address &amp;lt;remove&amp;gt; no-xauth&#xA;crypto isakmp keepalive 20 3&#xA;&#xA;&#xA;crypto isakmp client configuration group ABC&#xA; key &amp;lt;remove&amp;gt;&#xA; dns &amp;lt;remove&amp;gt;&#xA; domain &amp;lt;remove&amp;gt;&#xA; pool ABCpool&#xA; acl 150&#xA; max-logins 10&#xA; netmask 255.255.255.0&#xA;&#xA;&#xA;crypto ipsec transform-set ABCtransform esp-aes esp-sha-hmac &#xA;crypto ipsec df-bit clear&#xA;&#xA;&#xA;crypto dynamic-map dynmap 10&#xA; set transform-set ABCtransform &#xA; reverse-route&#xA;&#xA;&#xA;crypto map ABCmap client authentication list ABCvpn&#xA;crypto map ABCmap isakmp authorization list ABCgroups&#xA;crypto map ABCmap client configuration address respond&#xA;crypto map ABCmap 10 ipsec-isakmp &#xA; set peer &amp;lt;remove&amp;gt;&#xA; set transform-set ABCtransform &#xA; match address vpn_tunnel&#xA;crypto map ABCmap 1000 ipsec-isakmp dynamic dynmap &#xA;&#xA;&#xA;interface GigabitEthernet0/1&#xA;crypto map ABCmap&#xA;&#xA;&#xA;radius-server host &amp;lt;serverA&amp;gt; auth-port 1812 acct-port 1813 key 7 &amp;lt;remove&amp;gt;&#xA;radius-server host &amp;lt;serverB&amp;gt; auth-port 1812 acct-port 1813 key 7 &amp;lt;remove&amp;gt;&#xA;radius-server key 7 &amp;lt;remove&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19584" LastActivityDate="2023-12-21T05:04:50.570" Title="Change RADIUS auth method for remote access ipsec vpn" Tags="|cisco|vpn|ipsec|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23145" PostTypeId="1" AcceptedAnswerId="23355" CreationDate="2015-10-07T23:41:29.973" Score="0" ViewCount="1068" Body="&lt;p&gt;I am troubleshooting a bizarre case of packet loss. We have a cabinet of servers with a top of cabinet switch (Brocade FESX648-PREM). That switch runs BGP sessions with our transit providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have one server (referred to below as the &quot;bad server&quot;) that's experiencing 50% packet loss. The server is running Windows Server 2012 R2 and it's been running for months without issue until this morning. At this point, I suspect something might be wrong with the switch itself, so I'm turning to this community for help with additional troubleshooting rather than ServerFault or SuperUser for server-related troubleshooting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I've checked so far to rule out the cause of the packet loss on the bad server:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;No other servers in the cabinet are experiencing packet loss.&lt;/li&gt;&#xA;&lt;li&gt;The gateway switch and bad server can ping each other without issue.&lt;/li&gt;&#xA;&lt;li&gt;If I log into another server in the cabinet and attempt to ping the bad server, then I do get the packet loss.&lt;/li&gt;&#xA;&lt;li&gt;The routing table on the bad server is fine -- the default route points to the proper gateway, no other entries exist (except for&#xA;local IPv4 assignments).&lt;/li&gt;&#xA;&lt;li&gt;Firewalls have been disabled.&lt;/li&gt;&#xA;&lt;li&gt;No VPN setup is in effect (i.e., routing table on the bad server just has the default route).&lt;/li&gt;&#xA;&lt;li&gt;CPU load and network traffic are both very low.&lt;/li&gt;&#xA;&lt;li&gt;Server has been power cycled.&lt;/li&gt;&#xA;&lt;li&gt;Speed and duplex settings are set to auto-neg and are the same on both the switch and server.&lt;/li&gt;&#xA;&lt;li&gt;Forced 100mbit full on both ends, still had the packet loss.&lt;/li&gt;&#xA;&lt;li&gt;There are no port errors (no drops, collisions, FCS etc) recorded on the switch.&lt;/li&gt;&#xA;&lt;li&gt;CPU utilization on the switch is low (&lt;a href=&quot;http://pastebin.com/q24QSqEz&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/q24QSqEz&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Anyone have any ideas where I should look next? The results of #2, #3, and #11 in particular are really throwing me for a loop...&lt;/p&gt;&#xA;" OwnerUserId="8209" LastEditorUserId="8209" LastEditDate="2015-10-08T01:21:47.927" LastActivityDate="2015-10-14T06:23:49.197" Title="Packet loss within private network (server to server). No packet loss between gateway and server" Tags="|packet-loss|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23146" PostTypeId="1" CreationDate="2015-10-07T23:44:44.603" Score="3" ViewCount="191" Body="&lt;p&gt;We have a Juniper EX4200 which is connected via ge-0/0/0 trunk port to the providers router. We got our own vlan(id 250) and there are two public subnets routed on this vlan. &#xA;Currently all our serves are in the same vlan (the providers vlan), now we want to to route one of these subnets we got from our provider in a new vlan(300) for an extra server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is how can I route one subnet from vlan 250 into the new vlan 300 without loosing ip addresses ?&#xA;A small example config would be nice or at least a possible way to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So just in case a small summary:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Provider --&gt; Vlan250 --&gt; Juniper EX4200 (ge-0/0/0, trunk)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;two public subnets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;xx.xx.xx.xx/25&#xA;yy.yy.yy.yy/27&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper EX4200:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan250: (providers vlan)&#xA;xx.xx.xx.xx/25&#xA;yy.yy.yy.yy/27&#xA;ge-0/0/0 - ge-0/0/10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan300: (our own vlan)&#xA;ge-0/0/11 - ge-0/0/20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now we want to route the /27 from providers vlan to our new vlan 300&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much !&lt;/p&gt;&#xA;" OwnerUserId="10428" LastActivityDate="2023-12-21T08:01:05.117" Title="Juniper EX4200 Public Subnet Vlan Routing" Tags="|routing|vlan|subnet|juniper|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23148" PostTypeId="1" AcceptedAnswerId="23149" CreationDate="2015-10-08T00:56:59.867" Score="1" ViewCount="67" Body="&lt;p&gt;I have recently been hired on as an IT specialist at a company, and have been given the task of upgrading several old switches with brand new beautiful devices.  The only issue is the existing rack's depth cannot accommodate the new gear (power cable protrudes) by about two inches.  It has been suggested to me that what I require is a &quot;standoff extender bracket&quot;.  Ref. &lt;br&gt; &lt;a href=&quot;http://www.rackmountsolutions.net/standoff_rack_extender.asp&quot; rel=&quot;nofollow&quot;&gt;http://www.rackmountsolutions.net/standoff_rack_extender.asp&lt;/a&gt; &lt;br&gt;&#xA;For the life of me as I look at this device I cannot figure out how it is supposed to securely mount to the existing rack.  The screw holes must be facing outwards to accept the mounting screws for the switch, but then all that is left attach the extender to the rack are a set of notches.  In the one photo I have been able to find of one already attached it appears that I would take apart the rack, and slide this in between.  Ref. &lt;br&gt; &lt;a href=&quot;http://www.rackmountsolutions.net/images/Standoff-Brackets-A.jpg&quot; rel=&quot;nofollow&quot;&gt;http://www.rackmountsolutions.net/images/Standoff-Brackets-A.jpg&lt;/a&gt; &lt;br&gt; But that seems a bit ridiculous.  I feel like I'm missing something very simple here.  Can anyone point me in the right direction?&lt;/p&gt;&#xA;" OwnerUserId="19589" LastActivityDate="2015-10-08T01:09:44.703" Title="Rack Hardware Mounting Issue" Tags="|switch|rack-layout|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23149" PostTypeId="2" ParentId="23148" CreationDate="2015-10-08T01:09:44.703" Score="1" Body="&lt;p&gt;What you call notches are screw holes that allow you to adjust the left-right position.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rack and mounted equipment needs to have a minimum 1 meter clearance behind it.  You should relocate the rack itself.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-08T01:09:44.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23150" PostTypeId="1" AcceptedAnswerId="23155" CreationDate="2015-10-08T02:12:00.643" Score="3" ViewCount="170" Body="&lt;p&gt;Let says I have two VLANs, &lt;code&gt;10.0.1.x&lt;/code&gt; and &lt;code&gt;192.168.1.x&lt;/code&gt;. These 2 VLANs have inter VLAN routing enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer &lt;strong&gt;A&lt;/strong&gt;: connected to &lt;code&gt;192.168.1.x&lt;/code&gt; with IP &lt;code&gt;192.168.1.2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer &lt;strong&gt;B&lt;/strong&gt;: connected to both. &lt;code&gt;10.0.1.3&lt;/code&gt; and &lt;code&gt;192.168.1.3&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I ping &lt;code&gt;192.168.1.3&lt;/code&gt; from &lt;strong&gt;A&lt;/strong&gt;, it is okay. But if I ping &lt;code&gt;10.0.1.3&lt;/code&gt;, it fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I turn off the &lt;code&gt;192.168.1.3&lt;/code&gt; interface on computer &lt;strong&gt;B&lt;/strong&gt;, then I can reach &lt;code&gt;10.0.1.3&lt;/code&gt; from &lt;strong&gt;A&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is that so? What can I do to solve the situation? Any routing table issue involved?&lt;/p&gt;&#xA;" OwnerUserId="19591" LastEditorUserId="1395" LastEditDate="2015-10-08T15:02:23.337" LastActivityDate="2015-10-08T16:49:24.440" Title="One computer connects to multiple VLANs with inter-VLAN routing" Tags="|vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23154" PostTypeId="1" CreationDate="2015-10-08T07:05:34.660" Score="1" ViewCount="655" Body="&lt;p&gt;There is an example in 'Computer Network : A top down approach' : how to calculate IP address of the network from the parent network using subnet numbers: Parent Network(Parent ISP)'s IP Address 200.23.16.0/20 There are 8 child organizations below 'Parent Network(Parent ISP)'&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Org1's one : 200.23.16.0/23&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Org2's one : 200.23.18.0/23&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Org3's one : 200.23.20.0/23&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Org4's one : 200.23.22.0/23&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Org5's one : 200.23.24.0/23&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Org6's one : 200.23.26.0/23&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Org7's one : 200.23.28.0/23&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Org8's one : 200.23.30.0/23&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I understand this example easy to understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But How about this situation that Org2's subnet number is 24 so that Org2 has more larger network addresses but fewer host addresses(2^8).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Org2's one may be this : 200.23.18.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there are two cases for next one, Org3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we set Org3's one as same as above (200.23.20.0/23), we lost 2^9 - 2^8 IP addresses which is 200.23.19.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when we consider the lost addresses(=200.23.19.0/24) and recalculate economical Org3, Org3's one is this :(200.23.19.0/24 + 200.23.20.0/24)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I don't know how to mark 'economical' Org3 as dotted decimal IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the solution for this situations having different subnet number at the same level of network depth?&lt;/p&gt;&#xA;" OwnerUserId="19596" LastEditorUserId="8499" LastEditDate="2018-03-19T18:44:06.620" LastActivityDate="2018-03-19T18:44:06.620" Title="How can calculate IP address when subnet number is different?" Tags="|subnet|ip-address|isp|" AnswerCount="3" CommentCount="1" ClosedDate="2019-01-13T00:17:11.290" ContentLicense="CC BY-SA 3.0" />
  <row Id="23155" PostTypeId="2" ParentId="23150" CreationDate="2015-10-08T07:05:39.817" Score="3" Body="&lt;p&gt;That's perfectly normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you ping &lt;code&gt;10.0.1.3&lt;/code&gt; you emit a ICMP &lt;em&gt;echo request&lt;/em&gt; packet with source address &lt;code&gt;192.168.1.2&lt;/code&gt; and destination address of &lt;code&gt;10.0.1.3&lt;/code&gt;, and expect a response with source address &lt;code&gt;10.0.1.3&lt;/code&gt; / destination address &lt;code&gt;192.168.1.2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the computer &lt;strong&gt;B&lt;/strong&gt; responds, it sends a response to &lt;code&gt;192.168.1.2&lt;/code&gt;. &#xA;Since it has an interface in the same network, with it's IP &lt;code&gt;192.168.1.3&lt;/code&gt;, it sends the response trough this interface, so the ICMP &lt;em&gt;echo reply&lt;/em&gt; message is sent with source address &lt;code&gt;192.168.1.3&lt;/code&gt; / destination address &lt;code&gt;192.168.1.2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer &lt;strong&gt;A&lt;/strong&gt; does receive the response but it's not the expected source address, so it does not associate it with the initial echo request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if you turn off the interface &lt;code&gt;192.168.1.3&lt;/code&gt;, the response is sent trough the other interface with the correct IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Concerning how to solve the situation, it all depends on why you do have computer &lt;strong&gt;B&lt;/strong&gt; multi-homed (I.E. connected to several networks). It's better in most case to avoid this kind of setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to do it would be to NAT the &lt;code&gt;10.0.1.X&lt;/code&gt; address to &lt;code&gt;192.168.1.x&lt;/code&gt; address for example.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="1395" LastEditDate="2015-10-08T16:49:24.440" LastActivityDate="2015-10-08T16:49:24.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23156" PostTypeId="1" CreationDate="2015-10-08T07:08:01.757" Score="3" ViewCount="491" Body="&lt;p&gt;As per my knowledge, each exporter(Netflow packets from server1, Netflow packets from server2...) have a destination collector port(single nfcap daemon). So, is there any way to configure multiple exporters can point to single collector?. If yes, how can we differentiate the records. For eg. If server1-&gt;nfcap(PORT:6003), server2-&gt;nfcap(PORT:6003), server3-&gt;nfcap(PORT:6003) scenario is like this, how can I identify the netflow data(Data from server1-&gt;save the file as nfcap.server.data). Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17153" LastEditorUserId="8499" LastEditDate="2016-07-04T22:45:24.417" LastActivityDate="2017-06-30T02:25:21.363" Title="Can multiple netflow exporters use same collector port name?" Tags="|netflow|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23158" PostTypeId="2" ParentId="23154" CreationDate="2015-10-08T07:22:58.837" Score="2" Body="&lt;p&gt;I'm not sure I understand you question but the fact is you cannot aggregate in a single prefix 2 subnets from 2 different networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If org2 need only a /24 network and org3 need a /23 (I.E. 510 hosts in a single network) the simpliest thing is to use 200.23.20.0/23 for org 3 and use the free 200.23.19.024/24 for another customer who also need a only a /24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise you can allocate two different /24 to org 3 but once again you cannot aggregate them.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2015-10-08T07:22:58.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23159" PostTypeId="1" AcceptedAnswerId="23162" CreationDate="2015-10-08T07:44:47.860" Score="2" ViewCount="120" Body="&lt;p&gt;I use Windows 7 on my desktop.&#xA;I tried to connect my Android to my PC via Wi-Fi connection.&#xA;SSH port 22 is open on my desktop.&#xA;I use Connectbot to connect to my pc .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result of ipconfig:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Windows\system32&amp;gt;­ipconfigWindows IP ConfigurationEthernet adapter Local Area Connection 3:&#xA;Connection-specific DNS Suffix . : domain.name&#xA;Link-local IPv6 Address . . . . . : fe80::286c:2b76:ae18­:18f5%14&#xA;IPv4 Address. . . . . . . . . . . : 192.168.0.2&#xA;Subnet Mask . . . . . . . . . . . : 255.255.255.0&#xA;Default Gateway . . . . . . . . . : fe80::6e72:20ff:fe7d­:1063%14192.168.0.1&#xA;Ethernet adapter Local Area Connection 3:&#xA;Media State . . . . . . . . . . . : Media disconnectedConnection-specific &#xA;DNS Suffix . :Ethernet adapter Local Area Connection:Connection-specific &#xA;DNS Suffix . :Link-local IPv6 Address . . . . . : fe80::79f7:d7d6:8a1f­:4c13%11&#xA;IPv4 Address. . . . . . . . . . . : 192.168.42.25&#xA;Subnet Mask . . . . . . . . . . . : 255.255.255.0&#xA;Default Gateway . . . . . . . . . : 192.168.42.129&#xA;C:\Windows\system32&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From connectbot via ssh:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Connecting to 192.168.0.2:&#xA;The authenticity of host 'lished.&#xA;Host EC key fingerprint is:6c:de:6c:f6:c0:78:2a&#xA;Key exchange was not finis&#xA;The server hostkey was not allback&#xA;&#xA;Connection Lost&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ping result from android:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;app_30@android:/ $ ping 192.168.0.2&#xA;PING 192.168.0.2 (192.168.0.2) 56(84) bytes of data.&#xA;64 bytes from 192.168.0.2: icmp_seq=1 ttl=128 time=2.13 ms&#xA;64 bytes from 192.168.0.2: icmp_seq=2 ttl=128 time=1.46 ms&#xA;64 bytes from 192.168.0.2: icmp_seq=3 ttl=128 time=1.44 ms&#xA;64 bytes from 192.168.0.2: icmp_seq=4 ttl=128 time=1.45 ms&#xA;64 bytes from 192.168.0.2: icmp_seq=5 ttl=128 time=1.44 ms&#xA;64 bytes from 192.168.0.2: icmp_seq=6 ttl=128 time=1.49 ms&#xA;64 bytes from 192.168.0.2: icmp_seq=7 ttl=128 time=1.44 ms&#xA;64 bytes from 192.168.0.2: icmp_seq=8 ttl=128 time=1.43 ms&#xA;64 bytes from 192.168.0.2: icmp_seq=9 ttl=128 time=1.40 ms&#xA;64 bytes from 192.168.0.2: icmp_seq=10 ttl=128 time=1.37 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19600" LastEditorUserId="8499" LastEditDate="2015-10-08T14:58:01.520" LastActivityDate="2015-10-08T14:58:01.520" Title="Cant connect to PC via SSH" Tags="|wireless|lan|ssh|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23160" PostTypeId="2" ParentId="23154" CreationDate="2015-10-08T07:52:27.913" Score="1" Body="&lt;p&gt;if you do not want to mix your subnets, you can organize them in the following manner:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The sybnets with a mask in / 23 will start from 200.23.16.0/23, and you will increase of 2 for the next subnet: the following will 200.23.18.0/23, etc ...&lt;/li&gt;&#xA;&lt;li&gt;The subnets with a mask on /24 will start from 200.23.31.0/24 24, and you will decrease of 1 for the next subnet: 200.23.30.0/24, etc ....&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In this way, you do not mix your networks with different masks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Technically, it does not change, you just have your networks sorted according to their masks.&lt;/p&gt;&#xA;" OwnerUserId="19274" LastActivityDate="2015-10-08T07:52:27.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23161" PostTypeId="2" ParentId="23154" CreationDate="2015-10-08T08:06:01.977" Score="0" Body="&lt;p&gt;Time for IPv4 subnetting. For economical use of addresses, you don't order by organisation. &#xA;You order by the number of addresses needed. Since Org2 needs less, you move it down the list like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Org1's one : 200.23.16.0/23&#xA;&#xA;Org3's one : 200.23.18.0/23&#xA;&#xA;Org4's one : 200.23.20.0/23&#xA;&#xA;Org5's one : 200.23.22.0/23&#xA;&#xA;Org6's one : 200.23.24.0/23&#xA;&#xA;Org7's one : 200.23.26.0/23&#xA;&#xA;Org8's one : 200.23.28.0/23&#xA;&#xA;Org2's one : 200.23.30.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And when new Organisations come along you can add something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Org9's one : 200.23.31.0/24&#xA;Org10's one : 200.23.32.0/25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case Org10's range will start at 200.23.32.0 and end with 200.23.32.127. But this is normally within a business/corp or whatever. An ISP won't want to move their structure around whenever a new customer asks for IP's, because it could affect the other organisations, so JFL and Sorcha's solutions could work. Or whatever. They're an ISP.   :D&lt;/p&gt;&#xA;" OwnerUserId="19541" LastActivityDate="2015-10-08T08:06:01.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23162" PostTypeId="2" ParentId="23159" CreationDate="2015-10-08T08:09:07.903" Score="1" Body="&lt;p&gt;It looks like the Windows machine's host key may have changed since the last time you tried to connect using ConnectBot. If you remove and then re-add the windows machine to the ConnectBot hosts list you might be able to connect.&lt;/p&gt;&#xA;" OwnerUserId="11948" LastActivityDate="2015-10-08T08:09:07.903" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="23164" PostTypeId="1" CreationDate="2015-10-08T11:40:45.270" Score="1" ViewCount="247" Body="&lt;p&gt;I have a generic ADSL router that supports dual bridge and pppoe mode. I have an ADSL account configured on the ADSL router, and have the same ADSL account configured as a pppoe connection on a cisco via 1 of the ethernet ports - so I can change the default route of hosts on the network to compare connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using the connection via the generic router, I have stable transfers. However, internet usage on the Cisco is inconsistent and jitterish. For example, if I try upload a 2mb file via HTTP to a service (e.g. AWS S3), it seems to upload in bursts, and will sometimes fail. Is there anything obvious in my config below that may be slowing down the connection?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp database nvram:dhcp.txt&#xA;ip dhcp pool localPool&#xA;  ! dhcp pool specifics configured.&#xA;ip inspect name FWOUT tcp&#xA;ip inspect name FWOUT udp&#xA;ip inspect name FWOUT https&#xA;ip inspect name FWOUT time&#xA;ip inspect name FWOUT ntp&#xA;ip inspect name FWOUT dns&#xA;ip inspect name FWOUT icmp&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;interface FastEthernet0/0&#xA; description ETH-WAN and phys pppoe interface&#xA; ip address 10.0.0.10 255.255.255.0&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 10&#xA;!&#xA;interface FastEthernet0/1&#xA; description ETH-LAN&#xA; ip address 192.168.1.1 255.255.255.0&#xA; ip flow ingress&#xA; ip flow egress&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; ip tcp adjust-mss 1452&#xA; no ip mroute-cache&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Dialer1&#xA; mtu 1492&#xA; ip address negotiated&#xA; ip nat outside&#xA; ip inspect FWOUT out&#xA; ip virtual-reassembly&#xA; encapsulation ppp&#xA; ip tcp adjust-mss 1452&#xA; dialer pool 10&#xA; ppp authentication pap callin&#xA; ppp pap sent-username myaccount@myisp password 0 mypass&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 Dialer1&#xA;ip nat inside source list NAT_RULES interface Dialer1 overload&#xA;&#xA;ip access-list extended NAT_RULES&#xA; permit ip 192.168.1.0 0.0.0.255 any&#xA;ip access-list logging interval 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is not my full config - I have tunnel interfaces with crypto configs, lots more routes and a handful more access lists, but just wondering if there's anything in that config that might be causing the inconsistency.&lt;/p&gt;&#xA;" OwnerUserId="18938" LastActivityDate="2015-10-08T11:40:45.270" Title="What could be causing slow bandwidth on a Cisco 2801 ADSL connection" Tags="|cisco|bandwidth|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23168" PostTypeId="2" ParentId="23150" CreationDate="2015-10-08T14:12:40.603" Score="0" Body="&lt;p&gt;You may be hit by Reverse Path Filtering. Basically Computer &lt;strong&gt;B&lt;/strong&gt; is dropping the incoming ICMP-packets since it wasn't expecting IP packets from &lt;code&gt;192.168.1.2&lt;/code&gt; on the &lt;code&gt;10.0.1.3&lt;/code&gt; interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is expecting traffic from the &lt;code&gt;192.168.1.0/24&lt;/code&gt; subnet from the &lt;code&gt;192.168.1.3&lt;/code&gt; interface.&lt;/p&gt;&#xA;" OwnerUserId="13967" LastEditorUserId="1395" LastEditDate="2015-10-08T15:17:21.517" LastActivityDate="2015-10-08T15:17:21.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23169" PostTypeId="2" ParentId="23156" CreationDate="2015-10-08T14:16:28.247" Score="1" Body="&lt;p&gt;A NetFlow collector can be the collector for many devices. The collector knows where each record comes from by the source address of the sender.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does a web server know which host to reply to when thousands or millions of hosts send it requests on the same port? It's the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How the collected records are presented is up to the application you are using to view them.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-08T14:16:28.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23170" PostTypeId="2" ParentId="23132" CreationDate="2015-10-08T14:40:54.080" Score="0" Body="&lt;p&gt;You can enable or disable classes or specific messages, but you can't change the message format.  You will have to do that with an external program.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-08T14:40:54.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23173" PostTypeId="2" ParentId="23132" CreationDate="2015-10-08T16:34:32.503" Score="1" Body="&lt;p&gt;Thanks for the comments and answers.&#xA;I got the correct answer today.&#xA;the first message is of &lt;strong&gt;emblem format&lt;/strong&gt;&#xA;and second one is &lt;strong&gt;default format&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can go back to default format by using the following command&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;no logging emblem &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For more details &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/l2.html#wpmkr1771268&quot; rel=&quot;nofollow&quot;&gt;look &lt;strong&gt;here&lt;/strong&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16027" LastActivityDate="2015-10-08T16:34:32.503" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23174" PostTypeId="2" ParentId="22285" CreationDate="2015-10-08T16:48:05.643" Score="1" Body="&lt;p&gt;&lt;strong&gt;Short answer:&lt;/strong&gt; No device gets automatic priority.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it &lt;a href=&quot;https://en.wikipedia.org/wiki/Wireless_ad_hoc_network&quot; rel=&quot;nofollow&quot;&gt;Ad Hoc&lt;/a&gt; (device-to-device), or is a Wifi AP (switch/router) involved?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In Wifi AP:&lt;/strong&gt; Wifi Access Points use &lt;a href=&quot;https://en.wikipedia.org/wiki/Carrier_sense_multiple_access_with_collision_avoidance&quot; rel=&quot;nofollow&quot;&gt;CSMA/CA&lt;/a&gt; with &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.11_RTS/CTS&quot; rel=&quot;nofollow&quot;&gt;RTS/CTS&lt;/a&gt;&lt;br&gt;&#xA;The first image in the CSMA/CA Wiki link should be easy to understand.&lt;br&gt;&#xA;Since WifiAP wants to forward the received packet to PCb, PCc wants to talk, and the others have nothing to say; either WifiAP or PCc will go first depending on their random backoff timers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In Ad Hoc:&lt;/strong&gt; I believe the same protocols are used (someone please correct me if I'm wrong). But the middle man WifiAP is removed, which would match your diagram. In this case either PCb or PCc will go next, but again it depends on the &lt;em&gt;random&lt;/em&gt; backoff timers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Multiple_Access_with_Collision_Avoidance_for_Wireless&quot; rel=&quot;nofollow&quot;&gt;This link&lt;/a&gt; might help you understand RTC/CTS more completely.&lt;/p&gt;&#xA;" OwnerUserId="19541" LastActivityDate="2015-10-08T16:48:05.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23175" PostTypeId="2" ParentId="1048" CreationDate="2015-10-08T17:05:01.163" Score="0" Body="&lt;p&gt;Depending on how old the switches are you may need to configure the &quot;switchport trunk native vlan xxx&quot; on the Port Channel interface on both sides. &lt;/p&gt;&#xA;" OwnerUserId="19614" LastActivityDate="2015-10-08T17:05:01.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23176" PostTypeId="1" AcceptedAnswerId="23181" CreationDate="2015-10-08T17:13:32.620" Score="0" ViewCount="7984" Body="&lt;p&gt;I configured a windows 2012 server inside virtual machine in Ubuntu 14.04.&#xA;I installed DHCP, DNS, AD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to setup client's to use my DHCP server instead of Routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Now how can I assign my server's Ip address to WIndows 7, which is in another VM in the same Ubuntu host? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to setup DNS server's address in client PC. &#xA; But How do we do it for DHCP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Is it possible to access my DHCP server which is in VM by Other machines on the same network ? How?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; windows 2012 VM IP: 192.168.247.201&#xA;&#xA; Linux Host ip     : 192.168.0.102   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19612" LastActivityDate="2015-10-10T03:57:50.233" Title="How to set the DHCP server IP address to windows 7 client" Tags="|dhcp|" AnswerCount="2" CommentCount="0" ClosedDate="2015-10-09T20:19:00.637" ContentLicense="CC BY-SA 3.0" />
  <row Id="23177" PostTypeId="2" ParentId="23176" CreationDate="2015-10-08T17:17:26.247" Score="1" Body="&lt;p&gt;&lt;strong&gt;About DHCP:&lt;/strong&gt;&#xA;Any machine without a static IP will send out a Broadcast packet requesting an IP from any DHCP servers on the network. The client doesn't need the server IP. If DHCP is setup correctly (and your VM's are networked properly) it will work automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scroll down to &lt;em&gt;Operation&lt;/em&gt; on &lt;a href=&quot;https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt; to see the request process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;About IP's:&lt;/strong&gt;&#xA;A DHCP server should have a static IP in the range it is handing out. If server IP is 192.168.247.201, then it should hand out 192.168.247.X addresses, or change the netmask to allow variation in the 3rd octet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;About VM's&lt;/strong&gt;&#xA;If you follow those steps, then a good method of testing is isolating the VM's from the physical network. While they are Host-only they can only talk to each other (and the host machine). Like being on a switched network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use NAT, then your NIC acts like a router, allowing talk between subnets. Bridged mode allows your VM's to act like machines that are on the network directly, like another PC in the home/office.&lt;/p&gt;&#xA;" OwnerUserId="19541" LastEditorUserId="19541" LastEditDate="2015-10-10T03:57:50.233" LastActivityDate="2015-10-10T03:57:50.233" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="23178" PostTypeId="1" AcceptedAnswerId="23179" CreationDate="2015-10-08T17:22:44.853" Score="3" ViewCount="341" Body="&lt;p&gt;We are given an IPv4 datagram with the following characteristics.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The source IP address is 132.71.4.333 and destination is 132.71.4.54&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Its data content is an unfragmented TCP message of 64 bytes (TCP header + data)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It has Type of Service value of 25, Identification of value 264, Time to Live of 254 (all decimal values)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It is disallowed from being fragmented in transmission and contains no options&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We are going to calculate the value of the checksum field, step by step. Each answer is a 16-bit binary value, e.g. 1100111101010011. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a first step, what is the value of the first 16 bits of the IP header?&#xA;&lt;strong&gt;The thing that I am confused about from this question is that how do we use the internet header length field to show that the data is 64 bytes long or 16 words(32 bit words) as the internet header length field is only 4 bits so it can only show up to 15 32 bit words?&lt;/strong&gt;&#xA;&lt;br&gt;&#xA;Thanks in advance for any help&#xA;&lt;/p&gt;&#xA;" OwnerUserId="19613" LastEditorUserId="42290" LastEditDate="2017-12-13T10:58:03.697" LastActivityDate="2017-12-13T10:58:03.697" Title="IP Header value" Tags="|ipv4|ip|checksum|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23179" PostTypeId="2" ParentId="23178" CreationDate="2015-10-08T17:31:36.233" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791, Internet Protocol&lt;/a&gt;, Section 3, shows the header format. The length field is 2 &lt;em&gt;bytes&lt;/em&gt; (16 bits), not 4 &lt;em&gt;bits&lt;/em&gt;. It explains that this allows for 65,535 octets.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-10-08T17:31:36.233" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23180" PostTypeId="1" CreationDate="2015-10-08T17:43:39.340" Score="2" ViewCount="782" Body="&lt;p&gt;From Tanebaum's Computer Network:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When an application (e.g., a user) process wishes to set up a connection to a&#xA;  remote application process, it must specify which one to connect to. (Con-&#xA;  nectionless transport has the same problem: to whom should each message be&#xA;  sent?) The method normally used is to define transport addresses to which processes can listen for connection requests. In the Internet, these endpoints are called&#xA;  ports. We will use the generic term TSAP (Transport Service Access Point) to&#xA;  mean a specific endpoint in the transport layer. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The analogous endpoints in the&#xA;  network layer (i.e., network layer addresses) are not-surprisingly called NSAPs&#xA;  (Network Service Access Points). IP addresses are examples of NSAPs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What are endpoints in other layers (the data link layer, physical layer and application layer) called respectively?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastActivityDate="2015-10-08T19:18:49.743" Title="What are endpoints in the data link layer, physical layer and application layer called?" Tags="|terminology|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23181" PostTypeId="2" ParentId="23176" CreationDate="2015-10-08T18:04:45.290" Score="2" Body="&lt;p&gt;Short Answer... the DHCP server who replies first to the DHCPDISCOVER wins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long Answer...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DHCP utilizes &lt;strong&gt;broadcast&lt;/strong&gt; for communication between client and server.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Client initiates the process by sending a &lt;strong&gt;DHCPDISCOVER&lt;/strong&gt; frame.&lt;/li&gt;&#xA;&lt;li&gt;Server receives the frame and sends back a &lt;strong&gt;DHCPOFFER&lt;/strong&gt; (=network configuration settings for client)&lt;/li&gt;&#xA;&lt;li&gt;Client sends a &lt;strong&gt;DHCPREQUEST&lt;/strong&gt; frame to the server to request the address slot it got via the DHCPOFFER frame&lt;/li&gt;&#xA;&lt;li&gt;Server sends a  &lt;strong&gt;DHCPACK&lt;/strong&gt; to acknowledge the request&lt;/li&gt;&#xA;&lt;li&gt;Client assigns the ip address settings&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In case there are multiple dhcp servers the one who responds first wins. If a client already received a DHCPOFFER it will still send back a DHCPREQUEST to decline the offer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To workaround your issue I would recommend using a Host-Only or NAT network adapter to isolate your lab environment from your network.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-08T18:04:45.290" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="23182" PostTypeId="2" ParentId="23180" CreationDate="2015-10-08T18:11:18.957" Score="1" Body="&lt;p&gt;Explaination about the Data link layer is frequently related with a software as a driver for a network interface card (NIC). The data link and physical layers are so closely one to the other, because many types of hardware are also associated with the data link layer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex: NICs typically implement a specific data link layer technology, so they are often called Ethernet cards, Token Ring cards, etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then Enpoints on physical and data link layer, is to hard to differetiate, cause the pyshical layer is the medium, electrical or optical signal that travel on some form, to reach some device(where most often, is decoded the signal(link-layer) and the information is passed up to the upper layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An application endpoint is the commom application that perform the action, the data request or transmit, ex: an Explorer, FTP_client and so on&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-08T18:11:18.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23183" PostTypeId="2" ParentId="22289" CreationDate="2015-10-08T18:12:29.103" Score="0" Body="&lt;p&gt;From different perspectives I would say that Orlando's answer is good in relation to the general idea of the internet. Gadeliow's answer well describes the terms in reference to a server-client relationship.&#xA;(not giving my opinion on answers, giving credit where it's due.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But some software tracks up/downlink in reference to the interface. So download would be incoming, and upload would be outgoing. I have a switch/router that tracks like that. such a headache. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For choosing up/downlink to test, you need to determine what your server is being used for. What kind of load do you want it to endure?&#xA;In every case I can think of though, the downlink &lt;strong&gt;from&lt;/strong&gt; the server &lt;strong&gt;to&lt;/strong&gt; the clients will be under more strain. Even a file server will be used to download hosted files more frequently than they are uploaded.&lt;/p&gt;&#xA;" OwnerUserId="19541" LastActivityDate="2015-10-08T18:12:29.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23185" PostTypeId="1" AcceptedAnswerId="23188" CreationDate="2015-10-08T19:16:02.100" Score="3" ViewCount="5550" Body="&lt;p&gt;We have a SonicWALL NSA 2400. We have numerous (100+) personnel in different offices in different physical locations that establish VPN sessions successfully every day. Some of these client computers are behind routers. One of these offices is reporting that, with four office computers, they sometimes cannot get some or all of their four VPN sessions to connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I check our SonicWALL logs, I see that our NSA 2400 is receiving packets from their office router. Our NSA then tries to acknowledge these packets, but this results in a time-out message for the ack. (Unfortunately, I don't have the specific error messages.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked our settings and our UDP timeout value for this connection (LAN-&gt;VPN) is 30 seconds. This seems low and I would like to increase this in an attempt to remedy the problem with the timeout ack messages, but I don't know what effect this will have on the rest of the connecting VPN sessions. Our TCP timeout value is 900 minutes, by the way, for reference. I suspect some previous administrator changed the TCP settings but forgot/ignored the UDP settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NSA logs also have messages about UDP packets being dropped, as well, both incoming and outgoing. The messages are for various port numbers and services (DNS, IKE (Transversal), etc.), so changing the UDP settings might help in removing these messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My fear is that changing these settings will affect the existing VPN connections. However, the NSA has 512 MB of RAM and our peak connection usage has been around 6200 connections out of 32000 max. We run about 1500 connections on average.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have researched this on the web, but have only found general troubleshooting recommendations to &quot;increase the UDP timeout and see if that fixes it&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So will increasing the UDP timeout to 300 seconds negatively affect the other existing VPN connections? It doesn't look like we are close to our connection limit.&lt;/p&gt;&#xA;" OwnerUserId="5016" LastActivityDate="2015-10-08T21:03:16.333" Title="Should I increase the timeout value for UDP on our VPN router-device?" Tags="|router|vpn|udp|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="23186" PostTypeId="2" ParentId="23180" CreationDate="2015-10-08T19:18:49.743" Score="2" Body="&lt;p&gt;A partial answer:  at the data-link layer, it's called a Link Service Access Point (LSAP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get the others, you'd have to read the OSI specification, which is 1) expensive to purchase, and 2) irrelevant.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-08T19:18:49.743" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="23187" PostTypeId="2" ParentId="23185" CreationDate="2015-10-08T20:26:06.757" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;know exactly why he should replace the router&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because his router is interfering with vpn client operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPSec VPN's use udp/500 for key exchange (ISAKMP, aka IKE) and, typically, udp/4500 for NAT traversal. Once keys and settings are negotiated, the actual tunnel transport is either ESP (IP protocol 50) or AH (IP protocol 51), but AH is not compatible with NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as your firewall is not behind some other NAT, changing the firewall's connection timers will do absolutely &lt;em&gt;nothing&lt;/em&gt;; those setting are for sessions &lt;em&gt;through&lt;/em&gt; the firewall, not connections to/from the firewall. The most likely cause of the problem is the remote office's router.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-08T20:26:06.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23188" PostTypeId="2" ParentId="23185" CreationDate="2015-10-08T21:03:16.333" Score="3" Body="&lt;p&gt;NAT Traversal is the standard solution for what you are describing.  Specifically, you need to verify the NAT Traversal keep alive setting.  Let me explain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More than likely, you are using IPsec in ESP mode.  In a non-NAT traversal scenario, your data packets will look like this (after negotiation):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;[Outer IP header][ESP Header][Encrypted/Authenticated Data][ESP Trailer]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The outer IP header will include the the Source/Destination IP of your VPN gateway device (your NSA 2400) and whatever WAN IP the remote office is using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, you have multiple clients sharing a single source IP -- which is a very common PAT configuration.  As such, the Remote router needs to re-write the source IP of each of your clients, as well as the source port.  If that router were to have encountered a packet like the one above (with no L4 header between the L3 header and the data), it would drop it claiming it is a malformed packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT Traversal inserts an additional L4 header in the packet.  So it would look like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;[Outer IP header][NAT-T UDP 4500 header][ESP Header][Encrypted/Authenticated Data][ESP Trailer]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This header starts with UDP source and destination port 4500 (by default, this is configurable).  The destination port typically does not change (on route TO your VPN head end device).  The source port typically &lt;em&gt;does&lt;/em&gt; get changed by the transient NAT device (in this case, the remote office router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now.  MOST Stateful Firewalls or Routers have a very low UDP connection time out.  UDP is, by nature, connection-less, so it is very common for UDP connection timeouts to be less than a minute.  Cisco ASA's are 30 seconds, if I recall (don't quote me, its from memory).  By comparison, TCP timeouts are inherently high, because usually the stateful device is looking for the RST or FINs to purge an entry from its connection table.  A TCP timeout is just a stop gap in case both ends of the communication exploded simultaneously and weren't able to send out a RST/FIN.  So a higher TCP timeout than UDP timeout is normal, and even suggested behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that said, we can describe what is probably going on with your issue...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the first time a remote office client connects, and their NAT-T header's source port gets re-written to 2222, the VPN Head end device is going to expect all future communication for that particular VPN connection to arrive with a source port of 2222.  It will also encapsulate and send all return traffic back to the remote router's IP, with a destination port of 2222.  This will work just fine, so long as this particular NAT translation stays active in the remote router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But &lt;em&gt;IF&lt;/em&gt; the Remote Router purges its NAT translation table, the next packet sent from Client to Server will get a new UDP source, say 3333.  When that gets to the VPN Head end device, it will consider it a new &quot;connection&quot;, and expect a full re-negotiation of IPsec (which from a security standpoint, is the right thing to do).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, &lt;em&gt;if&lt;/em&gt; the Remote Router purges its NAT translation table, and the next packet sent is from Server to Client (aka, destined to port 2222), the Remote Router won't have any record of an outbound translation for that source port, so the packet will simply be dropped.  Remember, PAT is uni-directional.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All that said.  Since its common and perfectly normal for VPN connections to go silent.  There is a function built into NAT Traversal called the &quot;NAT Traversal Keepalive&quot;.  It is simply an empty packet that is sent every 10-15 seconds (differs by implementation) from Client to Server, and the sole purpose of this packet is to keep the NAT translation alive in transient NAT devices, like the remote Router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it sounds to me like you have your NAT Traversal Keepalive set to too high.  I would start by decreasing that one.  Because its a software change you can make on your Head End device, and should affect all your clients, without forcing you to replace hardware on the other end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, to re-iterate what Ricky mentioned.  If any time out needs to be adjusted, it will be on the Remote router, not on the VPN Head end device.  &lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-10-08T21:03:16.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23189" PostTypeId="1" AcceptedAnswerId="23191" CreationDate="2015-10-08T21:15:09.520" Score="1" ViewCount="292" Body="&lt;p&gt;The concepts of connection-oriented and connectionless  and the concept of multiplexing come to me in different chapters in Tanebaum's Computer Networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But after some thoughts, I feel that connection-oriented means reserving a path for a communication exclusively, and connectionless means allowing multiple communications do multiplexing in the form of time-division (specifically, divide a message into datagrams, and allow datagrams of different messages to travel a shared link in different times). So am I right that connectionless and multiplexing mean the same, and connection-oriented and non-multiplexing mean the same?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastEditorUserId="7894" LastEditDate="2015-10-08T21:35:14.920" LastActivityDate="2015-10-09T05:51:45.113" Title="Does connectionless mean the same as multiplexing?" Tags="|terminology|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23190" PostTypeId="2" ParentId="23136" CreationDate="2015-10-08T22:53:37.123" Score="1" Body="&lt;p&gt;Three options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;apply an access-list to deny traffic to destinations not advertised to the neighbor.  You don't have to make this perfect.  Only include destinations that will never be advertised, and enough of them that will make them rethink their routing.  Give warning though in case they are litigious.  &quot;We noticed you are sending traffic to destinations you have not contracted for/we see your theft of service.  We will filter this traffic starting on xxx.&quot;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;move the connection to a router that only has the routes you advertise.  This way any traffic to destinations besides what's advertised won't have anywhere to go and will get dropped.  Basically, add the filtering one hop up.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;move the connection into a VRF and only import routes into the VRF that are what you want to advertise.  Same effect as the above option, but logically not physically. One way is to use an export-map and only match the routes of interest to a special route-target then import that rt into the neighbor's VRF.  Export the neighbor's routes and import that into the VRF you use for all other traffic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8079" LastActivityDate="2015-10-08T22:53:37.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23191" PostTypeId="2" ParentId="23189" CreationDate="2015-10-08T22:56:14.283" Score="1" Body="&lt;p&gt;No. These are two completely different, unrelated concepts. Multiplexing means that you are transferring multiple signals, and there are different ways of multiplexing.  For instance many telephone systems use Time Division Multiplexing (TDM) but the telephone calls carried are connection-oriented.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-08T22:56:14.283" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="23193" PostTypeId="2" ParentId="16184" CreationDate="2015-10-09T03:19:36.963" Score="3" Body="&lt;p&gt;The question is specifically about SSD, not compact flash. The 5505/5510/etc series doesn't support SSD. On the newer -X series ASA, the SSD is used for IPS software. The SSD is not user-addressable for storage from the ASA CLI, so it won't appear the same way disk0 does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA version 9.1(1) was the first to support CX, which is the prior (obsolete) generation of IPS product.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA Version 9.2(2.4) and up support FirePower AMP, IPS, AVC, and URL filtering, which is the current product line that uses the SSD.  &quot;show module sfr&quot; or &quot;show inventory&quot; will tell you if your SSD is installed properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;References: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/hw/maintenance/5500xguide/5500xhw/asa_procs.html#63882&quot; rel=&quot;nofollow&quot;&gt;SSD Hardware Installation&lt;/a&gt; in ASA 5512/5515/5525/5545/5555-X&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#pgfId-132069&quot; rel=&quot;nofollow&quot;&gt;ASA Compatibility Matrix&lt;/a&gt; (search the page for &quot;SSD&quot;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19619" LastActivityDate="2015-10-09T03:19:36.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23194" PostTypeId="2" ParentId="21086" CreationDate="2015-10-09T03:31:47.503" Score="1" Body="&lt;p&gt;You need SmartNet on each individual unit (as the others have said, it's based on the unit's serial number) but if you want to save money, consider 8x5xNBD instead of the 24x7 option - since you now have a HA pair!  If you're desperate to save dollars, you can even ask your vendor for &quot;RFR&quot; = Return For Repair ... but ask about the difference in turnaround speed in repairs before committing to that.&lt;/p&gt;&#xA;" OwnerUserId="19619" LastActivityDate="2015-10-09T03:31:47.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23195" PostTypeId="2" ParentId="23189" CreationDate="2015-10-09T05:00:03.813" Score="1" Body="&lt;p&gt;By Tanebaum's definition, the internet is &quot;connectionless&quot;. No dedicated, reserved path is created between any two nodes. A stream of packets are free (and often &lt;em&gt;do&lt;/em&gt;) follow independent paths, per packet, and may be asymmetric -- flowing a different path in each direction.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-09T05:00:03.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23196" PostTypeId="2" ParentId="23189" CreationDate="2015-10-09T05:51:45.113" Score="2" Body="&lt;p&gt;it sound like , connection-oriented or connection less are the &lt;strong&gt;&lt;em&gt;conditions&lt;/em&gt;&lt;/strong&gt; need to be meted before any signal transfer but multiplexing (TDM , FDM , CDM ...etc) are the &lt;strong&gt;&lt;em&gt;way of transfer&lt;/em&gt;&lt;/strong&gt; the signal after the link establishment.&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;connection-oriented&lt;/em&gt;&lt;/strong&gt; means that the connection need to be granted from end to end before any data or signal transfer  (TCP is connection orignted , source will never send the next session until the first one is granted to be delivered )&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;connectionless&lt;/em&gt;&lt;/strong&gt; means no dedicated path or BW or end to end grantee is needed (UDP is connectionless protocol where all the session will be delivered regardless what session is doped)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4GBRf.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4GBRf.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;multiplexing&lt;/em&gt;&lt;/strong&gt; is the way of send multiple signal on certain time interval or frequency range based on the type of this multiplexing&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/fGwXH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fGwXH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;     &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-09T05:51:45.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23197" PostTypeId="1" CreationDate="2015-10-09T06:47:28.477" Score="1" ViewCount="66" Body="&lt;p&gt;I wanna design an hardware device (ARM Microcontroller based) to find the availability of internet connection in an ethernet cable. The scenario is, a system connected to a network through an unmanaged network switch, from the switch i want to tap the connection and have to found the internet connection availability (by any LED indications, or..) Note that, the connected system is not accessible to me and the switch must be unmanaged switch that means the network connection is also not accessible and not configurable to the switch. But have to find the internet Link UP/ DOWN connectivity. Is it possible ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pl Reply&lt;/p&gt;&#xA;" OwnerUserId="19621" LastActivityDate="2015-10-09T22:39:20.617" Title="Is Unmanaged Network Switch available with Link Up/Down?" Tags="|network-access|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23198" PostTypeId="1" CreationDate="2015-10-09T07:17:19.847" Score="1" ViewCount="111" Body="&lt;p&gt;I want to write an automation code for getting the inventory in the DCNM tool with a code. I am trying to do so with Java using JDBC. I am able to connect to the database but when I executing a query to fetch the data, it says 'no rows selected'. I want to know the table name in the database where I can get the whole inventory by running SQL queries.&lt;/p&gt;&#xA;" OwnerUserId="19624" LastActivityDate="2018-11-30T17:04:03.587" Title="Table name for devices in DCNM inventory" Tags="|cisco|nms|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23199" PostTypeId="1" CreationDate="2015-10-09T07:24:43.893" Score="1" ViewCount="225" Body="&lt;p&gt;I have a cisco firewall with a /30 internet connection. There is an outside interface and an inside interface connecting to a switch where clients sit in..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All clients coming from the internal network are patted to the outside interface in order to reach the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now have a server on the internal network that i need to access form the internet. Is it true that i cannot make a static nat statement and pat into this server on port 443 using the ip-adress of the outside interface? Do i really need a /29 and more ip-adresses in order to accomplish this? If no how would i go about natting to my server? Everytime i attempt to nat asdm tells me that my nat statement would overlap with the outside interface.&lt;/p&gt;&#xA;" OwnerUserId="19366" LastActivityDate="2015-11-08T14:59:20.467" Title="NAT/PAT Question" Tags="|nat|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23200" PostTypeId="2" ParentId="23197" CreationDate="2015-10-09T07:44:40.817" Score="1" Body="&lt;p&gt;There's no special way to see if you're connected to &quot;The Internet&quot; since it is just a collection of inter-networks. (as far as I'm aware)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most methods just ping a server that is known to be on the internet, such as Google or an ISP server. The server you pick should be reliable, since connections (such as those between countries) go down from time to time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I personally try to pick a server that isn't likely to be filtered or redirected by a network, as that could trick the result. For example the network might redirect any packets meant for Google or Facebook to an internal &quot;You are not allowed&quot; page. This will still give a positive ping result though.&lt;/p&gt;&#xA;" OwnerUserId="19541" LastActivityDate="2015-10-09T07:44:40.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23201" PostTypeId="2" ParentId="23199" CreationDate="2015-10-09T07:57:58.763" Score="0" Body="&lt;p&gt;You shouldn't need extra IP's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not used ASDM, but in my experience setting up a static NAT/PAT is no problem at all. Some router software can be a pain with weird or over-simplified setups for this. But I'm assuming ASDM is better than that.&lt;/p&gt;&#xA;" OwnerUserId="19541" LastActivityDate="2015-10-09T07:57:58.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23203" PostTypeId="1" AcceptedAnswerId="24128" CreationDate="2015-10-09T08:25:39.757" Score="2" ViewCount="2326" Body="&lt;p&gt;I know this might be stupid question, but I had troubles finding the answer on Google. I would like to extend my Wi-Fi, but I read that repeater is not really good idea due to sharing the same Wi-Fi device to both receive and extend signal. I found out that I could set two routers connected via lan cable. One of them would be receiving and the second creating Wi-Fi  network to extend the range. Is it possible though, to use one router as a receiver and AP at the same time? It would save me some space and maybe even money.&#xA;Thanks in advance &lt;/p&gt;&#xA;" OwnerUserId="19629" LastActivityDate="2015-11-06T19:01:11.987" Title="One router as WiFi receiver and AP at the same time" Tags="|router|ieee-802.11|network-access|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23204" PostTypeId="1" CreationDate="2015-10-09T08:47:53.837" Score="1" ViewCount="56" Body="&lt;p&gt;In my office there is a internet connection and access by others computer through wifi router( D-link router). &#xA;My home from office is about 2 km. It is possible to connect office wifi from my home with any wifi adapter to access internet.  &lt;/p&gt;&#xA;" OwnerUserId="19628" LastEditorUserId="19628" LastEditDate="2015-10-09T08:57:21.643" LastActivityDate="2015-10-09T09:42:57.533" Title="Connect internet through WIFI" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-12T19:20:01.673" ContentLicense="CC BY-SA 3.0" />
  <row Id="23205" PostTypeId="2" ParentId="23204" CreationDate="2015-10-09T09:16:00.567" Score="1" Body="&lt;p&gt;No. Some wireless technology has that range, but since the router is a D-link consumer grade device, it doesn't have that kind of reach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason is even if you have a &lt;strong&gt;very&lt;/strong&gt; strong receiver/transmitter for your adapter, which is not normal, the router would need a receiver/transmitter that's just as strong. It will need to receive your signal the same way you receive it's signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: this doesn't seem like it would be ok to do in the first place. Unless you own this company or have their explicit permission, I highly discourage doing this.&lt;/p&gt;&#xA;" OwnerUserId="19541" LastActivityDate="2015-10-09T09:16:00.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23206" PostTypeId="2" ParentId="23203" CreationDate="2015-10-09T09:38:00.300" Score="1" Body="&lt;p&gt;&lt;strong&gt;Short Answer:&lt;/strong&gt; Yes you can use one device to do both, it is cheaper, but the hardware will be a switch, not a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In regards to the &quot;two routers&quot;; I understand you're talking about a WiFi client and Access Point pair. The client for connecting to existing WiFi, and the Access Point to be the new, secondary Wifi. The two connected by RJ45.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you said, using the same hardware lowers performance, in theory. The reason being that it will be Access Point on the same channel (frequency) it is client. Whereas with a client on one channel (1 for example) and the new Access Point on another channel (lets say 3), you get an extended WiFi coverage with less chance of &lt;a href=&quot;https://en.wikipedia.org/wiki/Exposed_node_problem&quot; rel=&quot;nofollow&quot;&gt;Exposed node problem&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in practice there is often no need for two devices. You may not even notice a difference in performance after spending money and time on the more complicated setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact finding a device that works only as a Wifi client has been very difficult for me. By default they re-transmit anyway and I can't seem to turn it off on any device.&lt;/p&gt;&#xA;" OwnerUserId="19541" LastEditorUserId="19541" LastEditDate="2015-10-09T16:03:56.760" LastActivityDate="2015-10-09T16:03:56.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23207" PostTypeId="1" AcceptedAnswerId="23211" CreationDate="2015-10-09T09:42:49.353" Score="3" ViewCount="227" Body="&lt;p&gt;My book says that because most ISPs support asymmetrical bandwidth usage and so support greater downstream traffic than upstream, that P2Ps somehow put stress on the ISP due to this? I don't understand how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is quoted from the book &quot;Computer Networking: A Top-down Approach&quot;:&#xA;&quot;P2P video-streaming and file distribution applications put stress on ISPs by shifting upstream traffic from servers to residential ISPs.&quot;&lt;/p&gt;&#xA;" OwnerUserId="19402" LastActivityDate="2016-01-12T09:14:28.533" Title="P2P Applications and ISPs" Tags="|isp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23208" PostTypeId="2" ParentId="23204" CreationDate="2015-10-09T09:42:57.533" Score="0" Body="&lt;p&gt;It's is not feasible, the typical office router signal is strong enough to get around 200m when there are &lt;em&gt;no obstacles&lt;/em&gt; as walls, roof, etc. &#xA;Just think the big amount of obstacles the signal will have to pass through between your home and the office. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dense material as brick walls absorb part of the power of the signal and metal superficies reflex the signal, weakening it enough to being undetectable after a few meters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your office and yourself would need to install &lt;em&gt;high poles&lt;/em&gt; on the roof to put there antennas on a &lt;em&gt;line of sight&lt;/em&gt; without meaningful obstacles. Besides of that your device and the office device will need to be &lt;em&gt;high power&lt;/em&gt; devices, not the tipical home/office devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even with that, your signal will travel above other people's houses who use also wi-fi besides cordless phones and baby monitors that could interfere your signal causing some kind of &lt;em&gt;quality degradation&lt;/em&gt;. &lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-10-09T09:42:57.533" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23211" PostTypeId="2" ParentId="23207" CreationDate="2015-10-09T11:05:28.350" Score="4" Body="&lt;p&gt;Suppose the typical client-server connection, for example watching a &lt;em&gt;YouTube&lt;/em&gt; video or browsing the web. When you watch a video or do web browsing the downstream is highly used, but the &lt;em&gt;upstream&lt;/em&gt; is almost not used, mainly to send &lt;em&gt;periodical short bursts of data&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have a &lt;em&gt;P2P&lt;/em&gt; application open 24 hours you are downloading and also continually &lt;em&gt;uploading&lt;/em&gt; files, probably using all your upload bandwith. ISPs doesn't expect that behavior and have designed their systems keeping in mind that the typical upstream will be short bursts of data and long silences.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ADSL is the typical assymetrical home solution, it uses POTS cable to transport data, and all the ADSL connections on a zone are gathered on a DSLAM at the ISP zone premises.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The power of the upstream signal is weaker on the DSLAM as there are more distance from the home to the DSLAM, meanwhile the power of the downstream signal on the DSLAM is very high for everybody. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine all the cables coming from the houses and getting on the DSLAM, as they are together for some length, then happens &lt;em&gt;crosstalk&lt;/em&gt; (interference from one cable to the other), the high power signals will interfere the low power signals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per design, the ISP supposes that the user will use the upstream to send short burts of data then crosstalk seems to be not important, but as more users use upstream to upload files causing a constant stream of data, then crosstalk increases causing loss of data and retransmisions. The DSLAM becomes a bottleneck for the upstream traffic and finally the user gets the impression that the network is slower.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-01-12T09:14:28.533" LastActivityDate="2016-01-12T09:14:28.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23212" PostTypeId="1" AcceptedAnswerId="23216" CreationDate="2015-10-09T13:57:41.297" Score="1" ViewCount="711" Body="&lt;p&gt;If I am correct (correct me if I am wrong):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;MAC sublayer is all about how to use a multiaccess medium.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A multiaccess medium is a medium with multiple communication entities attached to its end(s), which has conflict issue between senders and addressing issue between receivers. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But I am not very clear about it yet, especially related it to duplex and multiplexing:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Relation between multiaccess and full-duplex&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a full-duplex medium, with only one communication entity&#xA;at each end, &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;will it cause conflict when the two entities try to communicate with each other at the same time? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is this medium a multiaccess medium? Does a multiaccess medium require multiple entities attach to at least one of its ends? When&#xA;people talking about a multiaccess medium in general, do they assume&#xA;the medium to be unidirectional instead of full-duplex?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Relation between multiaccess and multiplexing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a  multiaccess medium, &#xA;when there are multiple entities attaching to one end of the medium&#xA;and they want to send out signals/messages at the same time, is&#xA;multiplexing a solution to solve the conflict problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Multiplexing#Multiple_access_method&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt; says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A multiplexing technique may be further extended into a multiple access method or channel access method, for example, TDM into time division multiple access (TDMA) and statistical multiplexing into carrier sense multiple access (CSMA). A multiple access method makes it possible for several transmitters connected to the same physical medium to share its capacity.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Multiplexing is provided by the Physical Layer of the OSI model, while multiple access also involves a media access control protocol, which is part of the Data Link Layer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What does it mean by saying &quot;A multiplexing technique may be further extended into a multiple access method&quot;?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Relation between duplex and multiplex,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it correct that although the two words end with the same suffix &quot;-plex&quot;, multiplex isn't an extension of duplex, in that duplex means bi-directional with only one communication entity at each end, while multiplex is uni-directional with multiple communication sending entities at one end?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastEditorUserId="7894" LastEditDate="2015-10-09T14:09:13.290" LastActivityDate="2015-10-09T14:23:24.327" Title="Multiaccess with duplex and multiplexing" Tags="|mac|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23213" PostTypeId="2" ParentId="23199" CreationDate="2015-10-09T13:58:12.967" Score="1" Body="&lt;p&gt;I assume that your ASA is running with pre 8.3 IOS version...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is similar to configuring global nat using IP in ASA where we cannot use single IP to configure multiple global nat statements and we cannot use single IP to configure multiple combinations of NAT statement..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same applies for interface NAT also.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you need one more IP to use for inbound connection to internal server's &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try this for better utilization of IP's:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Since it is /30 and you are configuring in your firewall outside interface directly, I assume that you are not using any dynamic protocols for subnet advertisement or receival.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;So you can ask service provider to configure private IP's for LAN connectivity and utilize the full /30 only to do NAT (since it is assigned to interface now, you cannot use its broadcast &amp;amp; unicast IP. So if you release those public IP from interface assignment, you can utilize complete /30 - 4 IP's to do NAT.. In Juniper firewall broadcast and unicast IP's can be used to do NAT by enabling point to point option though you assign /30 to interface)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19631" LastEditorUserId="19631" LastEditDate="2015-10-09T14:37:42.330" LastActivityDate="2015-10-09T14:37:42.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23214" PostTypeId="1" CreationDate="2015-10-09T14:09:01.627" Score="1" ViewCount="921" Body="&lt;p&gt;Can I split Cisco ASA outside interface, that has public IP address, for site-to-site VPN, aceess to Internet...from that site-to-site tunnel, and client-ASA VPN connection?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastEditorUserId="3481" LastEditDate="2015-10-23T15:11:20.837" LastActivityDate="2015-10-23T15:11:20.837" Title="Splitting Cisco ASA interface for traffic" Tags="|cisco-asa|vpn|split-tunneling|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23215" PostTypeId="2" ParentId="23203" CreationDate="2015-10-09T14:12:24.053" Score="1" Body="&lt;p&gt;Wi-Fi APs and clients both must send and receive. It is the nature of Wi-Fi that it is only half-duplex, and it must do collision avoidance. Having a Wi-Fi device only receive won't do anything for you except be able to sniff the airwaves; you can't use it to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could have your original AP connected to the wired network and use a repeater, or you could extend the wired network and install another AP father away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AP placement and channel choice are important, and you really need to do a wireless survey before deciding on placement. You may find that you need more APs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-09T14:12:24.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23216" PostTypeId="2" ParentId="23212" CreationDate="2015-10-09T14:23:24.327" Score="1" Body="&lt;p&gt;Remember that you're talking about abstract concepts, so exact definitions can be a bit squishy.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Full duplex means that an endpoint can send and receive at the same time.  A telephone is a good example of that.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;1a.  No, depending on how you define &quot;the medium,&quot; there will not be a conflict.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1b.  Maybe.  It doesn't have to be.  &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;When actually implementing a &quot;multiaccess medium&quot; in real life, multiplexing is one strategy to make it work.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Again, I think you're trying to pin down an abstract term.  Multiplex could mean everyone can talk and hear at the same time, but then again, maybe not.  Multiplex could be either half or full duplex.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-09T14:23:24.327" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="23217" PostTypeId="2" ParentId="23214" CreationDate="2015-10-09T14:56:16.363" Score="0" Body="&lt;p&gt;Yes.  Think of the VPN tunnels (S2S and remote access) as additional logical interfaces.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-09T14:56:16.363" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23218" PostTypeId="1" AcceptedAnswerId="23219" CreationDate="2015-10-09T15:14:58.080" Score="4" ViewCount="5037" Body="&lt;p&gt;I was wondering about the IPv4 problem and thought about one of the solutions where endpoints do not have their own public ip address, but rather an address only used within the VPN and a mapping by the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These local addresses fall in the range of 192.168.x.x, and in my experience mostly 192.168.0.x. But what happens to the public ip addresses in this range? Who owns them, and what are they used for? Can they even be practically used, and if they can, how does the endpoint know whether to connect to a local address or to the public one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to ping random addresses from the range, but none of them returned a response (except of course endpoints on my local network). So I would suspect the range is not used publicly. But isn't that a wast of the addresses?&lt;/p&gt;&#xA;" OwnerUserId="19633" LastEditorUserId="8499" LastEditDate="2019-01-13T00:13:16.373" LastActivityDate="2020-09-08T18:21:02.403" Title="Are there public servers with a 192.168.X.X IP address?" Tags="|ip|ipv4|subnet|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23219" PostTypeId="2" ParentId="23218" CreationDate="2015-10-09T15:28:10.803" Score="6" Body="&lt;p&gt;The three private address ranges, and many other address ranges, are not allowed to be routed on the Internet.  IANA owns the private address ranges and has allowed anyone to use them as they wish, as long as they are not routed on the Internet.  They are simply network addresses used the same way as public addresses, except that any Internet provider will drop any packets with a private address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your pings to private addresses on the Internet never made it to the Internet since your provider dropped them at the PE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These private addresses actually save addresses since everyone can reuse the same addresses internally rather than needing unique public addresses.  IPv4 would have been exhausted many years ago if we didn't have private addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-09T15:28:10.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23221" PostTypeId="2" ParentId="23214" CreationDate="2015-10-09T17:24:27.133" Score="1" Body="&lt;p&gt;With your comment to Ron Trunk, I am assuming that you are using two ASA firewalls and one (ASA1) is connected to Internet through outside interface and the other ASA2 is having Site to Site connectivity to ASA1 (both are in differnt location and not connected through direct L2 connectivity). You want the user's behind ASA2 inside interface to use the Internet connectivity of ASA1..&lt;/p&gt;&#xA;&lt;p&gt;If my assumption is correct, we can make it simple as below,&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Place default route i.e., 0.0.0.0 towards Internet at ASA1 via its outside interface, so that all unknown public IP's will be routed towards Internet.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Place default route to next hop of ASA2 via outside interface.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Built the tunnel between ASA1 outside interface to ASA2 outside interface. So you have to bind crypto map at outside interface of both firewalls.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Allow ASA2 inside interface subnet (user's subnet) as local proxy and &amp;quot;any&amp;quot; as remote proxy in encryption domain of ASA2&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the encryption domain of ASA1, allow source (local proxy) as &amp;quot;any&amp;quot; and destination(remote proxy) as ASA2 inside interface.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you want to block ASA1 inside talking to ASA2 inside, place deny statement in encryption domain between ASA1 inside and ASA2 inside *optional&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;With this, if a user sitting behind ASA2 inside try accessing internet, it will reach ASA2 inside, match the encryption domain, getting encrypted and send to ASA2 through tunnel. At ASA2, it will get decrypt and look for route for its public destination. Since we have default route towards outside interface, it will try to push the traffic through outside interface.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Here, the traffic entered into ASA1 through outside interface (Security level 0 - example) and trying to exit through the same outside interface (Security level 0) but by default, ASA won't allow traffic between the interfaces having same security level. So to make it work we have to permit the traffic between same security level interfaces. Below are those commands.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&amp;quot;same-security-traffic permit intra-interface&amp;quot; - this will allow the traffic entering and exiting through the same interface.&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;same-security-traffic permit inter-interface&amp;quot; - this will allow the traffic entering and exiting through different interfaces having same security level.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;ol start=&quot;9&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;So if you configure this, the traffic from ASA2 inside interface will take the default route of ASA1 and reaches Internet.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Return communication will happen vice versa.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Cisco link explaining security level - &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa70/configuration/guide/config/intparam.html#wp1039276&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa70/configuration/guide/config/intparam.html#wp1039276&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;You can built, remote access VPN bind to outside interface of ASA1 for home user connectivity and they can take the same site to site to reach ASA2 inside if required.&lt;/p&gt;&#xA;&lt;p&gt;If you want further explanation with configurations, I could provide.&lt;/p&gt;&#xA;" OwnerUserId="19631" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-10-09T17:24:27.133" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="23222" PostTypeId="1" CreationDate="2015-10-09T17:45:30.487" Score="0" ViewCount="175" Body="&lt;p&gt;how we will be able to tansfer the data from fpga to pc&#xA;whether we have to ping it aur there is any other solution&lt;/p&gt;&#xA;" OwnerUserId="19635" LastEditorUserId="19635" LastEditDate="2015-10-16T18:11:52.813" LastActivityDate="2015-10-16T18:11:52.813" Title="communicating fpga &lt;-&gt; pc over ethernet" Tags="|ethernet|" AnswerCount="1" CommentCount="0" ClosedDate="2015-10-10T15:53:17.263" ContentLicense="CC BY-SA 3.0" />
  <row Id="23223" PostTypeId="2" ParentId="23222" CreationDate="2015-10-09T18:02:35.347" Score="1" Body="&lt;p&gt;The IEEE maintains all the ethernet standards in 802.3.  If you are programming hardware to communicate via ethernet, you need to follow those.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP is not directly related to ethernet since it is at a higher layer and can use protocols other than ethernet on various layer-1 media.  Conversely, ethernet can transport higher layer protocols other than IP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-09T18:02:35.347" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="23226" PostTypeId="2" ParentId="16891" CreationDate="2015-10-09T19:05:41.200" Score="1" Body="&lt;p&gt;192.168.0.0/16 is directly connected at US &amp;amp; 172.16.0.0/16 is directly connected at UK. As per the running-config, the site to site tunnels are allowed to pass traffic between 192.168.0.0/16 &amp;amp; 172.16.0.0/16. Also traffic between same security level is permitted. Also you are having manual identity NAT configuration at both firewall. Web-vpn is configured with tunnel-specified split-tunneling and the alternative addresses are permitted. Routing configurations are also correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it should work perfectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you check below,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;route print at the vpn client machine to see whether alternate location destinations are routed through tunnel only.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Connection logs at the firewalls while user trying to connect.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Debug logs to see encryption, decryption happening while trying to connect from vpn client machine.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Since it is 9.X, can you try ping tcp by spoofing the VPN Client IP address as source from one firewall to other firewall destination?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Example&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From UK Firewall try this,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ping tcp 192.168.49.3 22 source 172.16.200.152 23423&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="19631" LastActivityDate="2015-10-09T19:05:41.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23229" PostTypeId="1" AcceptedAnswerId="23242" CreationDate="2015-10-09T19:36:32.927" Score="4" ViewCount="649" Body="&lt;pre&gt;&lt;code&gt; [Internet]&#xA;     |&#xA;     |&#xA;     |---------[ Public Server ]&#xA;     |&#xA;     |&#xA;[ Firewall ]&#xA;     |&#xA;     |&#xA;[Private LAN]    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In above Design we have a few public servers. We moved them outside the firewall because they are very high intensity servers, firewall degrading performance and filling connection tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:&#xA;Currently if any &lt;code&gt;Private LAN&lt;/code&gt; (10.x.x.x) using NATing (one to many) if it wants to talk to &lt;code&gt;Public Server&lt;/code&gt; in DMZ. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it OK to do NAT on firewall for Public Server or we should configure Routing? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can add &lt;code&gt;10.x.x.x&lt;/code&gt; route in all Public server to hand off packet to Firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the best design in this case?&lt;/p&gt;&#xA;" OwnerUserId="17285" OwnerDisplayName="Satish" LastEditorUserId="8499" LastEditDate="2019-01-02T22:08:52.990" LastActivityDate="2019-01-02T22:08:52.990" Title="Network design question" Tags="|firewall|nat|design|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23230" PostTypeId="1" AcceptedAnswerId="23232" CreationDate="2015-10-09T21:03:34.633" Score="2" ViewCount="2550" Body="&lt;p&gt;I am trying to understand the relation and difference between multiplexing and multiple access. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since &lt;a href=&quot;https://www.quora.com/What-is-the-difference-between-multiple-access-and-multiplexing-like-in-FDMA-and-FDM&quot; rel=&quot;nofollow&quot;&gt;multiplexing appears in physical layer, and multiple access in data link layer (or MAC sublayer)&lt;/a&gt;, what is the difference between physical layer and data link layer, which can help to explain the difference between multiplexing and multiple access? &#xA;I don't completely understand the Quora replies there, and I am not sure if they are correct 100%. But they may point out the right direction to understand it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.techexams.net/forums/off-topic/74579-difference-between-multiplexing-multiple-access-methods.html&quot; rel=&quot;nofollow&quot;&gt;Another link&lt;/a&gt; also says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Two types of combining signals are:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Multiplexing - combining signals from the same sources&lt;/li&gt;&#xA;  &lt;li&gt;Multiple-access - combining signals from multiple sources&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Do the signals in multiplexing come from the same source, or can the signals also come from multiple sources?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastEditorUserId="7894" LastEditDate="2015-10-09T21:25:19.303" LastActivityDate="2015-10-11T16:33:22.140" Title="Difference between physical layer and data link layer, so as to understand difference between multiplexing and multiple access?" Tags="|layer2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23231" PostTypeId="2" ParentId="23229" CreationDate="2015-10-09T21:05:22.777" Score="4" Body="&lt;p&gt;You need to get a beefier firewall that can handle the traffic. You really don't want your servers unprotected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do go down the path of your drawing, you would need to get a larger public address allocation from your provider (good luck with that!) since you don't have a device to NAT your servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need NAT, whatever device you get to NAT may end up with the same problem as your firewall. You should just get a firewall capable of handling your traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-09T21:05:22.777" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23232" PostTypeId="2" ParentId="23230" CreationDate="2015-10-09T21:38:14.897" Score="4" Body="&lt;p&gt;Neither definition is quite correct in all cases. As I've said before, these terms are abstract, so depending on your point of reference, they could be right or wrong.  But it is not true that one is layer 1 and the other is layer 2.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multiplexing is a technique for combining signals, while multi-access is a characteristic of a medium.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-09T21:38:14.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23233" PostTypeId="2" ParentId="23127" CreationDate="2015-10-09T22:05:05.277" Score="2" Body="&lt;p&gt;I have just tested your setup in GNS3 (v1.3.8) with ASA image asa842.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your questions...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;!-- From PC to NAT IP of data_admin interface (FW)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason your ICMP packets are dropped is due to RPF (anti-spoofing). The ASA checks your routing table against the ingress DST (=host_10.59.2.137) which cannot be found because there is no entry within the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To verify the cause enable logging and ping the NAT ip address again.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;US(config)#logging enable&#xA;US(config)#logging console 7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/100830-asa-pix-netattacks.html#topic2&quot; rel=&quot;nofollow&quot;&gt;Cisco Documentation - RPF&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;!-- From PC to interface IP of data_admin interface (FW)&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot ping a distant interface on ASA by design. For example you cannot ping the outside interface from the inside network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;!-- From PC to data_admin router interface&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you pinged multiple times? Populating mapping tables in GNS3 takes more time than with real equipment. I had no issues with that one.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-09T22:05:05.277" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23235" PostTypeId="2" ParentId="23229" CreationDate="2015-10-09T22:27:58.000" Score="4" Body="&lt;p&gt;Place your public servers into a network segment that is being routed on the firewall for security and management reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you cannot do that due to performance reasons you should &lt;strong&gt;consider Host-Based firewall&lt;/strong&gt; on you public server(s) to have atleast stateful inspection capabilities (iptables, firewalld in case of *NIX).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having your public servers directly in your public transit network is a poor design choice if you want to access the servers from the clients without NAT. You would have to have routes on the servers to route traffic destined to your internal networks to the firewall otherwise the default route to your ISP gateway would match and ISP will drop the traffic because its RFC1918 address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you only have one server and do not have to scale you may go with the host based firewall and routes on the server option.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-09T22:27:58.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23236" PostTypeId="2" ParentId="23197" CreationDate="2015-10-09T22:39:20.617" Score="0" Body="&lt;p&gt;As far as I understood your question you want to develop a device which is being placed between an internet uplink and an unmanaged switch and want to determine if the internet connectivity is being given or not.&#xA;h.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want to determine if a link is UP or DOWN. The problem is that you connect from the switch to your ISP that in return connects to other ISPs. You would only determine the state of the direct connection from the switch to the first active networking device within the ISPs network but not the end-to-end connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As  NetMan pointed out it would be more reasonable to check the connectivity end-to-end because a low level check like interface UP/DOWN does not indicate if the connectivity is really given.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example one could setup a script to ping a well known ip address that should be reachable at any given time.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-09T22:39:20.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23237" PostTypeId="1" CreationDate="2015-10-09T23:11:00.207" Score="2" ViewCount="78" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Duplex_(telecommunications)&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Duplex_(telecommunications)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In a &lt;strong&gt;half-duplex&lt;/strong&gt; system, there are still &lt;strong&gt;two clearly defined&#xA;  paths/channels&lt;/strong&gt;, and each party can communicate with the other but not&#xA;  simultaneously&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Are the &quot;two clearly defined paths/channels&quot;  physical channels?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Multiplexing&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Multiplexing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;strong&gt;multiplexed&lt;/strong&gt; signal is transmitted over &lt;strong&gt;a communication channel&lt;/strong&gt;,&#xA;  such as a cable. The multiplexing divides the capacity of the&#xA;  communication channel into &lt;strong&gt;several logical channels&lt;/strong&gt;, one for each&#xA;  message signal or data stream to be transferred.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is &quot;a communication channel&quot; a physical channel?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it correct that &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a physical channel can only allow at most one transmission at a time?&lt;/li&gt;&#xA;&lt;li&gt;a medium can have multiple physical channels? E.g. a duplex medium has two channels for opposite directional transmissions (see the quote in part 1)?&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastActivityDate="2015-10-10T00:04:51.437" Title="Are the channels mentioned here physical or logical in duplex and multiplex?" Tags="|terminology|duplex|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23238" PostTypeId="2" ParentId="23237" CreationDate="2015-10-10T00:04:51.437" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;No, they do not have to be physical.  They can be a logical, virtual, etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Same as answer 1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;3a.  No.  A physical channel can be half or full duplex. It can also support multiple simultaneous transmissions. Actually, it depends more upon the capabilities of the endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3b. Again, they don't have to be physical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the &quot;aether&quot; (space-time) as a medium.  You can transmit radio energy through it, and you can do it half duplex or full duplex.  You can divide it up into &quot;channels&quot;.  Many transmitters can operate simultaneously. You can (but you don't have to) multiplex.   Depending on how you want to define it, it can fit any of your definitions.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-10T00:04:51.437" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23239" PostTypeId="1" CreationDate="2015-10-10T00:45:31.117" Score="2" ViewCount="2171" Body="&lt;p&gt;I came across some flat ethernet cables (&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B00R77LOFO&quot; rel=&quot;nofollow&quot;&gt;like this&lt;/a&gt;) and was thinking of picking some up, but I have no idea if their performance would be degraded compared to regular cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know anything about them?&lt;/p&gt;&#xA;" OwnerUserId="19641" LastEditorUserId="8499" LastEditDate="2018-12-21T04:10:41.297" LastActivityDate="2018-12-21T04:10:41.297" Title="Do flat ethernet cables perform as well as regular cables?" Tags="|ethernet|layer1|cable|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23241" PostTypeId="2" ParentId="23239" CreationDate="2015-10-10T01:19:08.767" Score="2" Body="&lt;p&gt;First off, the manufacturer may claim Category-6, but the UTP standard says that patch cords cannot exceed 5 meters, and this claims 100'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is highly unlikely that this cable can actually pass the Category-6 suite for patch cords in all the other tests in the suite (it &lt;em&gt;will&lt;/em&gt; fail for length).  If you happen to get one, get it tested on a high-end tester that can test the Category-6 suite. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At speeds up to 1 Gb, Category-5E and Category-6 will both either work at the full 1 Gb, or they are not properly installed.  A cable system only gets the rating of the lowest rated component (horizontal cable, terminations, patch panels, patch cords, etc.) in the system.  Buying Category-6 anything to add to a lower rated system is a waste of money.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-10T01:19:08.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23242" PostTypeId="2" ParentId="23229" CreationDate="2015-10-10T03:55:43.627" Score="5" Body="&lt;p&gt;First of all, as they mentioned above it is a poor design. No security engineer would consider exposing their servers directly to public without having any defenses (IPS, Firewall DMZ or host based firewalls)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still to answer your questions technically,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no need to do NAT at the firewall for your public server since you may already have default route towards outside to facilitate the public Internet traffic so this public server IP also would be reachable (or adding a route for this public server will work).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is fine, if you could add route in the public server for the complete private subnet towards firewall outside to reach internal network (because, it make no sense to route private subnet towards Internet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With NAT exempt in the firewall, it will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, can you share more details on your firewall model, memory &amp;amp; CPU utilization, Interface types, max used connection when you had your public servers traffic through this firewall? &lt;/p&gt;&#xA;" OwnerUserId="19631" LastActivityDate="2015-10-10T03:55:43.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23243" PostTypeId="1" CreationDate="2015-10-10T04:09:25.770" Score="1" ViewCount="1108" Body="&lt;p&gt;How ever I'm using packet tracer for confidential Purposes. In the image below The PC's are 192.168.1.0 network and the server is 192.168.2.2, the pc's are requesting data in the server HTTPS every Point one seconds .1 in 1000mb size file. so the question is how can I still give service without congesting the network,In this image we can see the latency become higher and also a packet loss. what I want is no packet loss and low latency, literally avoiding JITTER NETWORK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: in the picture all links are now GIGABIT two switch was unnecessary but the switch only have 12 ports but i need more than one so I add one more,  the system no longer suffer packet loss however the jitter or  high latency still occur, ping is around 50-200ms, were getting close people.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1a8fa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1a8fa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pAR7p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pAR7p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19643" LastEditorUserId="8499" LastEditDate="2018-12-22T04:05:42.070" LastActivityDate="2018-12-22T04:05:42.070" Title="How to fix real time congested network. (JITTER)" Tags="|cisco|routing|switch|router|packet-tracer|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23245" PostTypeId="2" ParentId="23243" CreationDate="2015-10-10T05:10:54.700" Score="1" Body="&lt;p&gt;You have multiple things that could cause this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Daisy-chaining PCs will be a problem since they are not optimized for&#xA;switching.  The PCs closest to the switch will need to handle their&#xA;own traffic as well as all the traffic from the PCs behind them.&lt;/li&gt;&#xA;&lt;li&gt;You can cause congestion if the uplink from the switch is the&lt;br&gt;&#xA;same speed as each of the links from the PCs feeding it.  Multiple,&lt;br&gt;&#xA;saturated access links simply cannot be served at line-speed by a single&lt;br&gt;&#xA;uplink at the same speed as the access links without congestion. The switch uplink needs to be at least as fast as the aggregated access links' speeds.&lt;/li&gt;&#xA;&lt;li&gt;You should check the load on your router since it may have gigabit&#xA;ethernet ports, but that doesn't mean it can packet switch at&#xA;line-speed, especially with multiple services running on it.&lt;/li&gt;&#xA;&lt;li&gt;The link to the server needs to be at least as fast as the aggregated access links' speeds.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You need to figure out what is causing the congestion and remediate it, and there may be multiple problems that need to be resolved. That may involve redesigning your network, replacing underpowered equipment, upgrading link speeds, etc.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-10T05:10:54.700" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23246" PostTypeId="1" CreationDate="2015-10-10T06:13:18.780" Score="1" ViewCount="847" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;In en.wikipedia.org/wiki/Channel_access_method, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A channel-access scheme is based on a multiplexing method, that allows several data streams or signals to share the same&#xA;  communication channel or physical medium. Multiplexing is in this&#xA;  context provided by the physical layer.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;multiplexing also may be used in &lt;strong&gt;full-duplex point-to-point&#xA;  communication between nodes in a switched network&lt;/strong&gt;, which should&#xA;  not be considered as &lt;strong&gt;multiple access&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Why &quot;multiplexing also may be used in full-duplex point-to-point&#xA;communication between nodes in a switched network, &lt;strong&gt;which should&#xA;not be considered as multiple access&lt;/strong&gt;&quot;?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In en.wikipedia.org/wiki/Media_access_control, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Examples of &lt;strong&gt;shared physical media&lt;/strong&gt; are ..., and h&lt;strong&gt;alf-duplex point-to-point links&lt;/strong&gt;. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Are &quot;shared physical media&quot;  the same as &quot;multiple access media&quot;?&#xA;Why are &quot;half-duplex point-to-point links&quot;  &quot;shared physical media&quot;?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastActivityDate="2015-10-10T19:04:30.637" Title="Multiple access and full/half duplex point-to-point links" Tags="|duplex|access-control|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23247" PostTypeId="2" ParentId="23246" CreationDate="2015-10-10T07:59:49.117" Score="2" Body="&lt;p&gt;&lt;strong&gt;Shared physical media:&lt;/strong&gt; only one device on the shared media can access it at any given time, the rest has to wait.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Halfduplex point to point links, uses &lt;strong&gt;the same physical media&lt;/strong&gt; in both directions.  It is the same frequency and point to point electromagnetic wave/channel.&#xA;It is halfduplex as a radio can only transmit or receive at a given point in time. The two sides of the point to point link can not transmit at the same time they &lt;strong&gt;share the physical media&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Multiplexing:&lt;/strong&gt; is the interleaving of multiple data streams, the resulting multiplexed stream can then be sent over a full or half duplex link.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2015-10-10T18:16:27.760" LastActivityDate="2015-10-10T18:16:27.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23248" PostTypeId="1" AcceptedAnswerId="23254" CreationDate="2015-10-10T08:36:22.963" Score="2" ViewCount="2495" Body="&lt;p&gt;I've changed our Watchguard XTM firewall for Cisco ASA 5508-x, all seems to be working but do have one problem though... The nat / pat connections from the outside stop working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a single external IP address, and so use effectively port forwarding to open firewall to the servers. The connections are fine from inside, but not from the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I do a &quot;clear arp&quot; on the firewall, the connections start working again for a while...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I disabled the secondary firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On some servers, there were two nic's connected without any teaming software, so I've removed the second cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've rebooted the servers but still get the issue...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example of the nat config for a connection to a servers port 80 using port 90 on the outside&lt;/p&gt;&#xA;&#xA;&lt;p&gt;object network Server1_90&#xA; host 192.168.1.66&lt;/p&gt;&#xA;&#xA;&lt;p&gt;access-list OUTSIDE extended permit tcp any object Server1_90 eq www&lt;/p&gt;&#xA;&#xA;&lt;p&gt;object network Server1_90&#xA; nat (inside,EXT_PUB_INT) static interface service tcp www 90&lt;/p&gt;&#xA;" OwnerUserId="19645" LastActivityDate="2015-10-12T03:47:37.610" Title="Cisco ASA Possible arp issue?" Tags="|cisco|arp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23249" PostTypeId="2" ParentId="23243" CreationDate="2015-10-10T08:45:53.510" Score="0" Body="&lt;p&gt;You may want to implement Quality of Service to limit the usage of bandwith.&#xA;By using traffic shaping you would be able to limit the bandwith usage.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-10T08:45:53.510" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23251" PostTypeId="1" CreationDate="2015-10-10T09:00:47.753" Score="2" ViewCount="3615" Body="&lt;p&gt;I want to back up the configuration of an Enterasys switch via TFTP. When I connect a machine to the switch and give it the command, it returns the error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;please remove back up file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How I can back it up?&lt;/p&gt;&#xA;" OwnerUserId="19646" LastEditorUserId="8499" LastEditDate="2015-10-10T17:20:38.250" LastActivityDate="2017-02-02T09:45:44.263" Title="How to back up the configuration of an Enterasys C2G 124-24 switch via TFTP" Tags="|tftp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23252" PostTypeId="1" AcceptedAnswerId="23324" CreationDate="2015-10-10T09:04:15.010" Score="2" ViewCount="507" Body="&lt;p&gt;What could be the possible causes of wireless interference for outdoor implementation using the latest technology 802.11ac. Are trees considered as interference?.&lt;/p&gt;&#xA;" OwnerUserId="19225" LastEditorUserId="19225" LastEditDate="2015-10-10T09:27:54.147" LastActivityDate="2015-10-12T22:24:19.180" Title="Wireless Interference (Outdoor)" Tags="|wireless|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23253" PostTypeId="2" ParentId="23248" CreationDate="2015-10-10T09:20:37.790" Score="0" Body="&lt;p&gt;Since you are using interface MNAT, it may be proxy arp issue..&#xA;Can you share the output of command below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show running-config sysopt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19631" LastEditorUserId="8499" LastEditDate="2015-10-10T16:29:15.557" LastActivityDate="2015-10-10T16:29:15.557" CommentCount="18" ContentLicense="CC BY-SA 3.0" />
  <row Id="23254" PostTypeId="2" ParentId="23248" CreationDate="2015-10-10T10:04:15.437" Score="0" Body="&lt;p&gt;Looks like a duplicate IP issue to me. Is outbound traffic working fine when your servers are not reachable from the Internet?&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-10T10:04:15.437" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23255" PostTypeId="1" CreationDate="2015-10-10T10:59:17.540" Score="2" ViewCount="859" Body="&lt;p&gt;Below is definition of Implicit Withdrawal by Wang et al. in the &quot;Observation and Analysis of BGP Behavior under Stress&quot; paper. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am not getting is how do I count implicit withdrawals? If for example, I have 4 BGP messages shown below that have same IP address and different AS-PATH attribute, how many implicit withdrawals do I have? Is it 3? Or 6? Do I look only consecutive messages when computing implicit withdrawal or I look at first message in respect to the rest, than second message in respect to the rest , and third message in respect to fourth?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I look at consecutive messages the result would be 3, if I use second approach result is 6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help,&#xA;Jannine &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TIME: 2001-9-16 00:00:06&#xA;TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IP&#xA;FROM: 192.65.185.144&#xA;TO: 192.65.185.40&#xA;BGP PACKET TYPE: UPDATE&#xA;ORIGIN: IGP&#xA;AS_PATH: 6893 8938 1 297&#xA;NEXT_HOP: 192.65.185.144&#xA;ANNOUNCED: 192.152.102.0/24&#xA;&#xA;TIME: 2001-9-16 00:00:18&#xA;TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IP&#xA;FROM: 192.65.184.3&#xA;TO: 192.65.185.40&#xA;BGP PACKET TYPE: UPDATE&#xA;ORIGIN: IGP&#xA;AS_PATH: 513 10764 6509 297&#xA;NEXT_HOP: 192.65.185.9&#xA;ANNOUNCED: 192.152.102.0/24&#xA;&#xA;TIME: 2001-9-16 00:00:36&#xA;TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IP&#xA;FROM: 192.65.185.144&#xA;TO: 192.65.185.40&#xA;BGP PACKET TYPE: UPDATE&#xA;ORIGIN: IGP&#xA;AS_PATH: 6893 3561 209 297&#xA;NEXT_HOP: 192.65.185.144&#xA;ANNOUNCED: 192.152.102.0/24&#xA;&#xA;TIME: 2001-9-16 00:00:44&#xA;TYPE: BGP4MP/BGP4MP_MESSAGE AFI_IP&#xA;FROM: 192.65.185.130&#xA;TO: 192.65.185.40&#xA;BGP PACKET TYPE: UPDATE&#xA;ORIGIN: IGP&#xA;AS_PATH: 559 8933 6509 297&#xA;NEXT_HOP: 192.65.185.130&#xA;ANNOUNCED: 192.152.102.0/24&#xA;&#xA;&#xA;Implicit Withdrawal Definition:If the sender announces a route&#xA;to a previously unreachable address, this is a new&#xA;announcement. If the sender announces a route to&#xA;a currently reachable address and the new route is&#xA;identical to the current route, this is a duplicate&#xA;announcement. Otherwise, the sender is replacing&#xA;the current route with a new route and this is an&#xA;implicit withdrawal.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8668" LastEditorUserId="8668" LastEditDate="2015-10-10T11:14:46.820" LastActivityDate="2016-04-19T16:06:48.230" Title="BGP Implicit Withdrawal" Tags="|routing|bgp|internet|bgp-ipv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23256" PostTypeId="2" ParentId="23243" CreationDate="2015-10-10T11:35:24.273" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HOz4l.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HOz4l.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;The answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-All links and ports must be gigabit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-The switch to the router link must be trunk all else must be access&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Switch connected to PC's must be Full duplex and Speed or bandwidth is set auto.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Tx ring limit must be 5 (higher ring = higher latency)&lt;/p&gt;&#xA;" OwnerUserId="19643" LastActivityDate="2015-10-10T11:35:24.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23257" PostTypeId="2" ParentId="23252" CreationDate="2015-10-10T13:29:43.850" Score="1" Body="&lt;p&gt;This is a very broad question, so I'll give you a very broad answer: anything in the propagation path will reduce the signal.  So yes, trees buildings, people, etc will interfere.  Other objects will reflect signals and cause mutlipath interference.  Other radios operating on the same or nearby channels will also interfere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At higher data rates, a higher SNR is needed and tolerances are tighter, generally speaking.  So in that sense 802.11ac is more susceptible to interference.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-10T13:29:43.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23258" PostTypeId="1" CreationDate="2015-10-10T13:49:36.360" Score="3" ViewCount="603" Body="&lt;p&gt;I am planning to procure a UTM/Firewall device for our office network of 50 Nodes (can be increased upto 75). I want a comprehensive solution for optimum ISP bandwidth utilization, corporate content protection, Traffice security. Breaking up the requirement in features we can consider ISP failover, Bandwidth shaping, Bandwidth optimization, Browsing control, Intrusion Prevention, Data Leakage Prevention etc. Moreover there will be 10-20 VPN users and one site-to-site VPN.&#xA;But my main focus is on local network security and browsing control and performance. Over VPN, the work criticallity won't be much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In search of a suitable device, I am evaluating tech specs of some Fortigate models. But I bit confused comparing the features of different models. IF some of my question can be clarified here then I can proceed further in my evaluation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A) Difference in performance of SoC based models and CPU base models considering primary requirement as Browsing control, Traffic security etc and secondary purpose as VPN Gateway?&#xA;What I understood 60D/70D/90D are all SoC based models and 80D/92D/100D are all CPU based models.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B) Is there any significant necessity of Internal storage other than log storing capacity?&#xA;As I found, 60D, 70D do not have any Internal storage, but 90D, 92D, 100D have internal storage. 70D and 90D have same feature except availability of internal storage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C) Is it a practical thought to make this UTM/Firewall device works as VLAN router as well? &lt;/p&gt;&#xA;" OwnerUserId="19647" LastActivityDate="2017-08-31T09:11:50.287" Title="Need help to identify UTM/Firewall for SME network" Tags="|firewall|fortigate|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23259" PostTypeId="2" ParentId="23258" CreationDate="2015-10-10T14:27:45.167" Score="1" Body="&lt;p&gt;A) SoC based models are able to offload processing to the silicon, cpu based models are not as optimized and may implement certain functions in software and not hardware&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information &lt;a href=&quot;http://www.fortinet.com/sites/default/files/solutionbrief/Inside_FGT_FS1-SOC.pdf&quot; rel=&quot;nofollow&quot;&gt;click&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B) Depending on the model internal storage may be used for logging, wan optimization and caching purposes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C) It depends... If you need segmentation between your VLANs it might be a consideration but keep in mind that a firewall has certain throughput limitations that you should think of. Your setup is rather small so I think you got about 3 segments (DMZ, Clients, Server).... If that is the case and you are using fileservers etc. you may not want to route Client and Server VLAN on the firewall but only DMZ for seperation between your trusted and untrusted zone...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need any more information let me know.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-10T14:27:45.167" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="23261" PostTypeId="2" ParentId="23252" CreationDate="2015-10-10T18:20:00.390" Score="0" Body="&lt;p&gt;Another, often overlooked, problem with outdoor Wi-Fi implementations is distance. Wi-Fi performance degrades with distance, even at distances within the specifications, and especially at higher frequencies. Wi-Fi was designed to operate up to 100 meters, just like UTP, but it will not deliver full performance for the full 100 meters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen it work at much longer distances, but the users complained that they were not getting advertised data rates at several hundred yards. They didn't realize that they had far exceeded the specifications and asked how to boost the power so that it works better. They wanted advertised data rates regardless of the distance from the single AP they had installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not just the radio(s) in the AP(s); the radios in the clients need to be able to reach the AP(s), too.  Boosting the AP radio power doesn't doesn't change the capabilities of the radios in the clients.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-10T18:20:00.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23262" PostTypeId="2" ParentId="20530" CreationDate="2015-10-10T18:41:24.460" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Create an ACL with VPN IP address pool as source address and destination as any or specific IP address which you want to access.&lt;/li&gt;&#xA;&lt;li&gt;Bind that ACL to a client configuration group. It will work.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 108 permit ip X.X.X.X 0.0.0.255 Y.Y.Y.Y 0.0.0.255&#xA;crypto isakmp client configuration group &amp;lt;group&amp;gt;&#xA;acl 108&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19631" LastEditorUserId="8499" LastEditDate="2016-04-07T21:59:21.717" LastActivityDate="2016-04-07T21:59:21.717" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23263" PostTypeId="2" ParentId="23246" CreationDate="2015-10-10T19:04:30.637" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Why &quot;multiplexing also may be used in full-duplex point-to-point communication between nodes in a switched network, which should not be considered as multiple access&quot;?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Because you want to send traffic from more than one host over the link, e.g. a trunk.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The actual link (e.g. Fiber) is not multiple access,only one device on each side with nothing else that has access to the link.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Are &quot;shared physical media&quot; the same as &quot;multiple access media&quot;? Why are &quot;half-duplex point-to-point links&quot; &quot;shared physical media&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because they share the physical channel with other devices.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;e.g Wifi - links operating on the same frequency in the same area interfere with each other and reduces capacity.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;e.g. Ethernet-hub , host have to check if media is available before sending.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-10-10T19:04:30.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23264" PostTypeId="2" ParentId="22365" CreationDate="2015-10-10T19:08:16.573" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Block full Internet access to all the use machine IP's in all ports thus it will block direct connectivity to TOR (make sure you blocked tcp port 9001 &amp;amp; 9090 which TOR exit nodes will respond first)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Install Bluecoat (I would prefer) or Websense or any other effective proxy server in your network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There will be seperate categorization for we proxies in the name like Proxy Avoidance Category. Block it so that no user could use web proxies&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In bluecoat if you purchase SSL license, you can intercept https traffic thus ssh to other proxy servers over https can be intercepted and blocked..&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19631" LastActivityDate="2015-10-10T19:08:16.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23266" PostTypeId="2" ParentId="22313" CreationDate="2015-10-10T21:33:59.530" Score="0" Body="&lt;p&gt;CLOS network architecture is a viable option for a scalable datacenter network. It is a good option for connecting multiple pods to each other and is ideal for optimal east-west traffic flow within your fabric&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for L2 vs L3 fabric. Layer 3 scales better and is a good option for keeping failure domains small but technologies like TRILL (e.g. Cisco FabricPath, Brocade VCS Fabric, etc.) may be used to build a non blocking L2 fabric which are easier to manage and are suitable for small size datacenter networks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you would go for a Layer 3 CLOS architecture you would need to use overlay networking for virtual machine mobility between your leafes / pods which might complicate your design.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-10T21:33:59.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23268" PostTypeId="2" ParentId="23251" CreationDate="2015-10-10T22:30:02.723" Score="2" Body="&lt;p&gt;Did you try deleting the backup file? I haven't used an Enterasys before but a quick search of your problem yielded a manual explaining what you're trying to do and how to fix it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.manualslib.com/manual/441038/Enterasys-C5g124-24.html?page=92&quot; rel=&quot;nofollow&quot;&gt;http://www.manualslib.com/manual/441038/Enterasys-C5g124-24.html?page=92&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2073" LastActivityDate="2015-10-10T22:30:02.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23269" PostTypeId="2" ParentId="23251" CreationDate="2015-10-10T22:59:29.860" Score="1" Body="&lt;pre&gt;&lt;code&gt;A4(su)-&amp;gt;show config outfile configs/config-bak.cfg&#xA;A4(su)-&amp;gt;copy configs/config-bak.cfg tftp://&amp;lt;IP_ADDRESS&amp;gt;/config-bak.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please post the commands you used to back up the configuration. If it is not a command issue you might want to check your tftp server. Is it reachable? Can you upload files from other sources? (if not - check windows firewall &amp;amp; reachability between switch an TFTP server)&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-10T22:59:29.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23270" PostTypeId="5" CreationDate="2015-10-10T23:05:00.097" Score="0" Body="&lt;p&gt;This is a special tag that is designed to be used only by the system for questions that have had all of their other tags removed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All questions in the system must have at least one tag. Normally, it is not possible to submit new or edited questions that do not have tags; the system will reject the submission until a valid tag is applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few unusual situations that can cause this tag to be applied. When a tag has existed for six months and only been used on one question, and no tag wiki has been created for the tag, the system deletes the tag. When the community decides that a given tag can never be appropriate &amp;#8212; for example, because it is misspelled or is off-topic &amp;#8212; moderators may remove the tag from the site &lt;em&gt;en masse&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When one of these deletions removes the last tag from a question, the system adds the &lt;a href=&quot;/questions/tagged/untagged&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;untagged&amp;#39;&quot; rel=&quot;tag&quot;&gt;untagged&lt;/a&gt; tag to that question so that the &quot;all questions must have at least one tag&quot; rule is not broken.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can help clean up some of these questions! If they're good questions, edit them to remove the &lt;a href=&quot;/questions/tagged/untagged&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;untagged&amp;#39;&quot; rel=&quot;tag&quot;&gt;untagged&lt;/a&gt; tag and add more descriptive tags. If they're not so good, use the usual tools: downvoting, flagging and voting to close/delete.&lt;/p&gt;&#xA;" OwnerUserId="21048" LastEditorUserId="21048" LastEditDate="2015-12-18T02:25:44.077" LastActivityDate="2015-12-18T02:25:44.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23271" PostTypeId="4" CreationDate="2015-10-10T23:05:00.097" Score="0" Body="This is a special tag that is designed to be used only by the system for questions that have had all of their other tags removed. Do not add this tag to existing questions, it is reserved for use by the system to identify posts with no valid tags." OwnerUserId="19610" LastEditorUserId="21048" LastEditDate="2015-12-18T02:26:53.700" LastActivityDate="2015-12-18T02:26:53.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23274" PostTypeId="1" CreationDate="2015-10-11T07:19:32.870" Score="1" ViewCount="56" Body="&lt;p&gt;Upon applying for a leased line from ISP, and subcription to monthly Bandwidth, how would the bandwidth be distributed per Access Point? Say you have a 40mbps bandwidth from the ISP, how would that be distributed for each user?&lt;/p&gt;&#xA;" OwnerUserId="19225" LastActivityDate="2015-10-11T12:42:25.507" Title="Outdoor Wi-Fi implementation (Bandwidth Distribution)" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23276" PostTypeId="1" CreationDate="2015-10-11T11:46:37.253" Score="1" ViewCount="50" Body="&lt;p&gt;Let's say I'm migrating my network to new infrastructure. So, the new site and the old site are connected using private ASs. I wonder if there is any benefit for the new site to advertise /24 along with &gt;=/25 to the old site. The old site only advertises &gt;=/25 to the new site.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-10-11T11:46:37.253" Title="Any benefit if advertise /24 between my ASs that connect through eBGP using private ASs?" Tags="|bgp|" AnswerCount="0" CommentCount="4" ClosedDate="2022-11-19T00:46:41.547" ContentLicense="CC BY-SA 3.0" />
  <row Id="23277" PostTypeId="2" ParentId="23274" CreationDate="2015-10-11T12:42:25.507" Score="1" Body="&lt;p&gt;Wi-Fi uses &lt;a href=&quot;http://ilovewifi.blogspot.com/2012/08/how-80211-csmaca-works.html&quot; rel=&quot;nofollow&quot;&gt;CSMA/CA&lt;/a&gt;, so all users share the bandwidth.  If there is only one user, she gets all of it.  If there are many, they share it.  Everyone gets (statistically) a time slot in which they can send data.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-11T12:42:25.507" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23278" PostTypeId="2" ParentId="22365" CreationDate="2015-10-11T13:35:19.213" Score="2" Body="&lt;p&gt;You cannot block all possible workarounds to access a certain webserver but you may use a layered approach to make it very hard for the average end user to access said blocked content&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Allow/Block traffic based on destination port(e.g. only allow tcp/80, tcp/443, udp/53)&lt;/li&gt;&#xA;&lt;li&gt;Allow/Block traffic based on destination URL (e.g. block category PORN, Web-Proxy)&lt;/li&gt;&#xA;&lt;li&gt;Allow/Block traffic based on application (e.g. only permit http,https,dns)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A policy as stated above may be implemented by using a modern firewall that is capable of L7 firewalling (e.g. Cisco FirePower, Palo Alto Networks, Checkpoint, Sophos, etc. etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have only listed a few vendors for reference. There are many solutions for your problem and a firewall capable of deep packet inspection may be the best fit to solve your issue.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-11T13:35:19.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23279" PostTypeId="2" ParentId="19438" CreationDate="2015-10-11T14:04:54.997" Score="1" Body="&lt;p&gt;The way you connected the Controller is technically correct. By using DOT1Q VLAN tags you allow traffic within VLAN 1,2,3,4 to be sent from and to your Controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that it might not be necessary to allow all VLANs on the port to the controller (e.g. UserLAN, DevLAN) because you might only need Guest and UserWIFI for WLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only allowing certain VLANs on a Trunk is called VLAN pruning which can enhance network security and stability.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-11T14:04:54.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23280" PostTypeId="2" ParentId="23248" CreationDate="2015-10-11T14:14:19.770" Score="0" Body="&lt;p&gt;Found the issue... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone had put a wireless access point somewhere with the same IP address as the inside of the firewall&lt;/p&gt;&#xA;" OwnerUserId="19645" LastActivityDate="2015-10-11T14:14:19.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23281" PostTypeId="2" ParentId="22457" CreationDate="2015-10-11T14:42:14.013" Score="0" Body="&lt;p&gt;You may use IP Event Dampening to solve your issue.&#xA;For each flap a so-called penalty is incremented and when the penalty reaches the suppress threshold the interface is being dampened to ensure network stability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP Event Dampening is an automatic process that uses timers to make sure an interface is stable before enabling it again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get more information on IP Event Dumpening click &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/s_ipevdp.html#wp1048359&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-11T14:42:14.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23282" PostTypeId="2" ParentId="22569" CreationDate="2015-10-11T15:09:10.523" Score="2" Body="&lt;p&gt;Mode general and trunk are both used for VLAN trunking&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mode general&#xA;You may choose multiple tagged and untagged vlans, default is tagged&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mode trunk &#xA;You may define one native vlan, all others are tagged&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mode access&#xA;You may define a single untagged VLAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you post your configuration for further troubleshooting? If you set the interface to mode access and specified the VLAN there should be no issue.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-11T15:09:10.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23283" PostTypeId="2" ParentId="23230" CreationDate="2015-10-11T16:33:22.140" Score="6" Body="&lt;p&gt;Multiplexing means combining analog signals or digital data streams into a single composite signal. The output is just ONE signal. This signal has the content of all its constituents. This signal can travel through a shared medium or a non-shared medium. The receiver of this signal can extract all its constituents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multiple access means that different devices are able to access the same medium in some shared manner. They may use time slots or have a particular schedule for using the medium. In most cases, only one of the devices is using the medium in any given time instant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, multiplexing COMBINES the signals into one signal while multiple access governs WHEN this signal will be transmitted through the medium.&lt;/p&gt;&#xA;" OwnerUserId="17721" LastActivityDate="2015-10-11T16:33:22.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23284" PostTypeId="1" CreationDate="2015-10-11T18:11:21.187" Score="1" ViewCount="7461" Body="&lt;p&gt;There are some holes in my comprehension when it comes to figuring out values related to the TCP mechanics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MSS = 1 (the maximum segment size, max. size by TCP segment for the receiver)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link flow (throughput) = 2Mb/s&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RTT = 100 msec&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Knowing that, you have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2Mb/s = cwnd / RTT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The congestion window is then 200ko.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also know that the sender is limited to min(cwnd, rwnd).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I find the rwnd? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I find the threshold?&lt;/p&gt;&#xA;" OwnerUserId="19659" LastEditorUserId="19659" LastEditDate="2015-10-11T18:25:27.440" LastActivityDate="2015-11-12T17:22:45.753" Title="Relation between MSS, cwnd, rwnd, threshold and RTT" Tags="|tcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23285" PostTypeId="1" CreationDate="2015-10-11T20:10:57.320" Score="1" ViewCount="985" Body="&lt;p&gt;I am new to this so apologies if this is the wrong place for such a question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm testing out a simple &quot;hello world&quot; website hosted at home.  As we have not been assigned a static IP address by our ISP I've set up a subdomain with a dynamic DNS provider to point at the home router - let's call this subdomain &lt;em&gt;mysubdomain.ddnsprovider.net&lt;/em&gt;.  I also have a domain which I own (and which was set up with a different provider than that to the dynamic DNS subdomain) - let's call that &lt;em&gt;mymaindomain.com&lt;/em&gt;.  A DNS CNAME record for &lt;em&gt;mymaindomain.com&lt;/em&gt; is set up to point at &lt;em&gt;mysubdomain.ddnsprovider.net&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can successfully browse to &lt;em&gt;mymaindomain.com&lt;/em&gt; and see my &quot;hello world&quot; page from anywhere outside of my home LAN - but if I browse to &lt;em&gt;mymaindomain.com&lt;/em&gt; from any machine at home (i.e. within the LAN) I get &quot;Server not found&quot;/&quot;web page not available&quot; etc errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand from various searches that this looks like a NAT loopback issue and as such is likely best solved by getting a new router that supports NAT loopback.  However, I &lt;em&gt;can&lt;/em&gt; see my &quot;hello world&quot; site if I browse to &lt;em&gt;mysubdomain.ddnsprovider.net&lt;/em&gt; from anywhere at all - including from within my LAN. From what (little) I understand about NAT loopback, I shouldn't be able to connect to a site hosted within my LAN via an external address (i.e. &lt;em&gt;mysubdomain.ddnsprovider.net&lt;/em&gt;) at all if lack of support for NAT loopback by my router is the cause of the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, before I go out and buy a new router, my question is: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this definitely a NAT loopback issue (how can I confirm that)?  And if so, what's the reason I can see my website from within the LAN via &lt;em&gt;mysubdomain.ddnsprovider.net&lt;/em&gt;?  If it isn't NAT loopback what is it likely to be and what's the best solution? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;FWIW - I'm in the UK and am using a BT home hub 3 wireless router connected to a BT Openreach modem (Infinity fibre).  Does anyone know whether the lack of NAT loopback support is inherent in the router, or modem, or both? - i.e. is replacing just the router likely to solve the problem or is it likely to persist unless I replace both of them (if that's possible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any light that anyone can shed on this and any advice would be very gratefully received.&lt;/p&gt;&#xA;" OwnerUserId="19662" LastActivityDate="2015-10-11T20:33:47.487" Title="Is NAT loopback the only reason I can't view my own website from within my LAN?" Tags="|router|nat|troubleshooting|dns|loopback|" AnswerCount="1" CommentCount="3" ClosedDate="2015-10-12T10:55:10.853" ContentLicense="CC BY-SA 3.0" />
  <row Id="23286" PostTypeId="2" ParentId="23285" CreationDate="2015-10-11T20:33:47.487" Score="2" Body="&lt;p&gt;You have diagnosed the problem correctly. The problem is that you try to access your webserver which is located within your local network by its public ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your router will not NAT your DST ip address back to your private ip address since traffic is originating from within your network. To work around this issue you would need NAT hairpining also called NAT loopback as you stated above already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To verifiy why you can access your webserver with the URL &lt;strong&gt;mysubdomain.ddnsprovider.net&lt;/strong&gt; could you please do a nslookup via Windows Powershell/CMD and post the result. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If both your domain and ddnsprovider.net ip address matches the problem might not be related to NAT hairpining.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-11T20:33:47.487" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23287" PostTypeId="1" AcceptedAnswerId="23289" CreationDate="2015-10-11T20:41:34.080" Score="0" ViewCount="387" Body="&lt;p&gt;I have a question about ALOHA protocol acknowledgement messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If host A sends a message to host E, and E sends an acknowledgement back to host A, but then it collides with a message being sent from another host, say, host C, then both messages end up being garbled. Does that mean host A will have to send his original message again, even though host E has already received it?&lt;/p&gt;&#xA;" OwnerUserId="19663" LastActivityDate="2015-10-11T20:52:39.680" Title="Pure ALOHA acknowledgement messages on a busy channel" Tags="|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23288" PostTypeId="1" AcceptedAnswerId="23290" CreationDate="2015-10-11T20:48:45.303" Score="1" ViewCount="173" Body="&lt;p&gt;There seem to be two separate cases of when to re-transmit messages in the pure ALOHA.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A message is received while a host is trying to transmit a message.&lt;/li&gt;&#xA;&lt;li&gt;After the timer runs down, when a message is sent and no acknowledgement for it has been received yet.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is it true that according to the pure ALOHA protocol, re-transmissions happen in both these two cases? None of the references I've found make mention of re-transmissions happening in both these cases - it's always just one or the other.&lt;/p&gt;&#xA;" OwnerUserId="19663" LastActivityDate="2015-10-11T20:59:50.487" Title="Pure ALOHA protocol: When to retransmit" Tags="|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23289" PostTypeId="2" ParentId="23287" CreationDate="2015-10-11T20:52:39.680" Score="0" Body="&lt;p&gt;Host A, not receiving an ACK within a reasonable amount of time must assume that the original message was lost due to a collision. So, yes, it will re-transmit the original message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=6&amp;amp;ved=0CEMQFjAFahUKEwir7rHRpLvIAhXDlYAKHWK-B_o&amp;amp;url=https%3A%2F%2Fwww.seas.upenn.edu%2F~kassam%2Ftcom370%2Fn99_12.pdf&amp;amp;usg=AFQjCNFlxDiFQZfEIAKX5mtY2LwzeknbRA&amp;amp;sig2=L4OrRe32bhnFvvnaqhRs-A&amp;amp;cad=rja&quot; rel=&quot;nofollow&quot;&gt;PDF&lt;/a&gt; that explains how this works in Section 3:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If a sending node does not see on the downlink within a reasonable&#xA;  time an ACK for a frame it sent up, it assumes that a collision&#xA;  occurred and re-transmits the frame after some random delay. Thus&#xA;  ALOHA depends on the ability of a node to detect or learn that a&#xA;  collision has occurred.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-11T20:52:39.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23290" PostTypeId="2" ParentId="23288" CreationDate="2015-10-11T20:59:50.487" Score="1" Body="&lt;p&gt;An ALOHA sender needs to re-transmit if determines that a collision has occurred.  Either of those situations would indicate to the sender that a collision has occurred so the sender will re-transmit.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-11T20:59:50.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23291" PostTypeId="2" ParentId="23252" CreationDate="2015-10-12T00:56:49.420" Score="0" Body="&lt;p&gt;Just remember, when you want density (sustainable service to lots of people) bring your channels down to 20MHz.&#xA;When you want performance (Less people, higher speeds) you may span your channels to 40MHz-80MHz to take full advantage of AC's capacity.&#xA;As you move down to a short frequency (2.4-&gt;5Ghz) you will lose penetrating power in materials; this is general as many materials will interact and obscure differently compared to the frequency range you choose.&#xA;Trees have lots of water and 2.4 Ghz loves to absorb into polar molecules; working like your microwave.&lt;/p&gt;&#xA;" OwnerUserId="19144" LastActivityDate="2015-10-12T00:56:49.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23292" PostTypeId="1" AcceptedAnswerId="43323" CreationDate="2015-10-12T02:44:12.707" Score="-1" ViewCount="83" Body="&lt;p&gt;There is a strange issue in my office building.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to Google DNS &lt;code&gt;8.8.8.8&lt;/code&gt;, StackExchange.com and StackOverflow.com IP address is &lt;code&gt;198.252.206.16&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Outside of the building's&lt;/strong&gt; internet connection, no problems, &lt;strong&gt;but inside of the building&lt;/strong&gt;, the site cannot be reached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now here is the weird part&lt;/strong&gt;. Whois info (&lt;a href=&quot;http://whois.domaintools.com/stackexchange.com&quot; rel=&quot;nofollow&quot;&gt;http://whois.domaintools.com/stackexchange.com&lt;/a&gt;) shows the IP address of the server as &lt;code&gt;104.16.12.128&lt;/code&gt; (different from Google DNS) and when I manually edit my host file and point those domains there, &lt;strong&gt;it works!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something is seriously strange. My first guess is that my building's IP has been blocked and pointing to the IP in the Whois info circumvents this block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain why this is happening?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;My building IP is 115.89.231.130&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="7669" LastEditorUserId="7669" LastEditDate="2015-10-12T03:19:41.843" LastActivityDate="2017-08-16T23:56:44.650" Title="StackExchange.com IP from Google DNS doesn't work, BUT IP from Whois Database works" Tags="|ip|dns|" AnswerCount="2" CommentCount="0" ClosedDate="2019-12-02T17:42:32.893" ContentLicense="CC BY-SA 3.0" />
  <row Id="23293" PostTypeId="2" ParentId="16625" CreationDate="2015-10-12T03:43:49.867" Score="-1" Body="&lt;p&gt;it is a speed and / or duplex mismatch&lt;/p&gt;&#xA;" OwnerUserId="19666" LastActivityDate="2015-10-12T03:43:49.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23295" PostTypeId="2" ParentId="23292" CreationDate="2015-10-12T06:04:41.887" Score="1" Body="&lt;p&gt;The ip address 104.16.12.128 is owned by CloudFlare. StackExchange use(s/d) CloudFlare as DDoS mitigation service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;198.252.206.16 is the correct ip address for stackexchange as tested with stackexchange dns server (cf-dns01.stackexchange.com)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could there be a firewall policy in place with certain blocked ip ranges (e.g. CloudFlare - which would explain your issue)?&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-12T06:04:41.887" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23297" PostTypeId="1" CreationDate="2015-10-12T07:18:29.147" Score="2" ViewCount="1607" Body="&lt;p&gt;My computer appears to be assigned a subnet ip address from my isp's router and I do not actually have my own ip address. Is this possible through network address translation or NAT? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have wanted to host a website for a little while now, but I do not think I can using what ever ip address my packets appear to come from (which I think would be my router or gateway) because  either the ISP does not want to be a server, or it simply doesn't know to whom on the subnet; to route the packets. Just to be painfully clear, say my ip address (or gateway's ip address) was 233.234.92.3 (I just made that up). If I linked my domain name to that ip address, the gateway I am on would have no way to know where to route the packet on the subnet it is connected to.&lt;/p&gt;&#xA;" OwnerUserId="19668" LastActivityDate="2015-10-13T06:08:22.077" Title="Is there a way to access a computer on a subnet from the internet?" Tags="|subnet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23298" PostTypeId="1" CreationDate="2015-10-12T07:31:00.750" Score="4" ViewCount="222" Body="&lt;p&gt;I am trying to understand the &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_protocol_suite&quot; rel=&quot;nofollow&quot;&gt;Internet Protocol Suite&lt;/a&gt; as described by Wikipedia. What is confusing me is the Internet Layer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to see if I understood it, this layer is simply the IP header and data. TCP or UDP or TCMP, or even ARP would be an inner layer the transport layer. So this layer is the IP protocol or IPv4/6. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Granted I understand correctly, would it be possible to have two nested Internet layers? Like an outer layer that has one ip address then another with a different layer like subnet address?&lt;/p&gt;&#xA;" OwnerUserId="19668" LastEditorUserId="17678" LastEditDate="2015-10-12T17:41:30.917" LastActivityDate="2016-01-11T15:42:29.430" Title="Understanding Internet Protocol Suite; The Internet Layer" Tags="|internet|osi|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23299" PostTypeId="1" AcceptedAnswerId="23300" CreationDate="2015-10-12T07:49:32.163" Score="1" ViewCount="240" Body="&lt;p&gt;I have a small confusion. I have watched an example on youtube on subnetting. It takes the Network IP 168.173.70.134 /29.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I know, if we look at the 168, it is the rage 128 - 191, hence falls in Class B. But if we consider /29 it falls in the Class C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please someone enlighten me on this confusion :/ &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks &amp;amp; Regards.&lt;/p&gt;&#xA;" OwnerUserId="19669" LastActivityDate="2015-10-12T08:15:12.050" Title="TCP/IP Subnet Masking" Tags="|subnet|" AnswerCount="1" CommentCount="3" ClosedDate="2015-10-12T10:54:09.757" ContentLicense="CC BY-SA 3.0" />
  <row Id="23300" PostTypeId="2" ParentId="23299" CreationDate="2015-10-12T08:15:12.050" Score="0" Body="&lt;p&gt;Original address 168.173.70.134/29 is in &lt;a href=&quot;https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing&quot; rel=&quot;nofollow&quot;&gt;CIDR notation&lt;/a&gt;, hence I'd assume classless routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most practical cases Classes can be considered obsolete. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some edge cases, like RIPv1, for example, doesn't have support for variable length subnet masks. That said, I'd not expect to run into RIPv1 in any production network.&lt;/p&gt;&#xA;" OwnerUserId="5385" LastActivityDate="2015-10-12T08:15:12.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23305" PostTypeId="1" AcceptedAnswerId="23307" CreationDate="2015-10-12T12:58:04.150" Score="0" ViewCount="96" Body="&lt;p&gt;Is there a way I can set a DHCP on the 3.0 network without using a server like the other two networks or configuring a DHCP on the router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I use the IP helper-address command to use the server on my 200.0 network for DHCP? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QnHb7.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QnHb7.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17715" LastEditorUserId="17678" LastEditDate="2015-10-12T16:20:30.587" LastActivityDate="2015-10-12T17:57:44.400" Title="Configuring DHCP" Tags="|dhcp|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23306" PostTypeId="2" ParentId="23298" CreationDate="2015-10-12T13:22:18.820" Score="2" Body="&lt;p&gt;The nice thing about protocol models is that you can invent your own.  So I suppose you could create the Craft model that has an extra layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it's hard to see how that layer would function.  IP already has a hierarchical mechanism for determining network boundaries.  That's what the subnet mask is for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend that you don't get too hung up on layers.  To quote the Wikipedia article you mention, &quot;The lack of emphasis on layering is a major difference between the IETF and OSI approaches.&quot;  In other words, it's important that you understand the encapsulation and abstraction function of layers.  How many and what they're called is not as important.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-12T13:22:18.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23307" PostTypeId="2" ParentId="23305" CreationDate="2015-10-12T13:24:11.237" Score="2" Body="&lt;p&gt;Yes, you can.  That is exactly the scenario it was made for.  On the far right router (the 3.0) network, use the help command on the LAN interface.  For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface Fa0/1&#xA;ip address x.x.x.x m.m.m.m&#xA;ip helper-address y.y.y.y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;y.y.y.y is the IP address of your DHCP server.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-10-12T13:29:21.927" LastActivityDate="2015-10-12T13:29:21.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23308" PostTypeId="2" ParentId="23297" CreationDate="2015-10-12T13:47:36.273" Score="2" Body="&lt;p&gt;There seems to be a lot of confusion in your question.  Let me see if I can untangle some of it.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The IP address you made up is actually in the multicast address range.  Currently those are not routed over the Internet.  Ignoring that for the moment:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You could, in theory set up a web server on your network.  Your ISP may have policies to prevent that, but from a networking perspective, it will work fine.  Your gateway already knows how to route packets to your host.  Otherwise how could you browse the web?  (i.e., How would all those funny cat videos get to you?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can ignore this for the moment, but it's highly probable that your host is behind a router that is performing Network Address Translation, or NAT.  You can read more about that, but briefly the router translates your IP address from a private one to one assigned by the ISP.   This is usually done dynamically.  You will need to set up a static translation.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It appears that you're hung up on the idea of &quot;subnets.&quot;  Subnets are just networks.  From a routing perspective, &quot;networks&quot; and &quot;subnetworks&quot; are the same thing.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-12T13:47:36.273" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23309" PostTypeId="2" ParentId="9506" CreationDate="2015-10-12T15:46:23.533" Score="-1" Body="&lt;p&gt;The fact that the question said both computers are in different VLAN, which mean it is talking about two different subnet, since VLAN = SUBNET, BROADCAST DOMAIN, NETWORK, then it is not possible for those computers to comunicate, without the presence of a layer three device(router).&lt;/p&gt;&#xA;" OwnerUserId="19680" LastActivityDate="2015-10-12T15:46:23.533" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23310" PostTypeId="2" ParentId="23305" CreationDate="2015-10-12T16:01:51.963" Score="0" Body="&lt;p&gt;DHCP uses Broadcast to find a DHCP server. ip-helper may be used on your router to forward those broadcast frames to your DHCP server located within another broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router receives the broadcast frame and uses unicast to forward it to the specified dhcp server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ron has already posted the correct configuration required to set up DHCP helper where the interface can be a physical interface a sub-interface or an SVI.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-12T16:01:51.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23311" PostTypeId="1" CreationDate="2015-10-12T16:06:24.830" Score="2" ViewCount="894" Body="&lt;p&gt;I'm looking for some help on how to manage devices which are connected via a 2nd router that is used as a Wi-Fi AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;TPLink TD-W8968 Wi-Fi router (as AP) is connected to our switch&lt;/li&gt;&#xA;&lt;li&gt;Various (authorised) devices connected to the switch&lt;/li&gt;&#xA;&lt;li&gt;Switch connected to our Vigor2925 Router&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Wi-Fi AP has been mapped to an IP address on the router (&lt;code&gt;.100&lt;/code&gt;) and has a public (passworded) Wi-Fi connection to which users can connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Users connecting to Wi-Fi show up on the Vigor as other IP addresses, e.g ., &lt;code&gt;192.168.1.16&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I manage (QoS, bandwidth/session limits) any device which has connected via the Wi-Fi AP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set a bandwidth limit for &lt;code&gt;.100&lt;/code&gt;, but since other devices are given their own IP addresses on the Vigor router, I'm guessing it may not be affecting them as it should?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to maybe use settings on the Wi-Fi AP to manage the devices that connect through it, or can it be done with the Vigor?&lt;/p&gt;&#xA;" OwnerUserId="19681" LastEditorUserId="19681" LastEditDate="2016-03-12T17:54:38.677" LastActivityDate="2016-05-11T18:54:51.627" Title="Vigor2925 - How to manage devices connected via secondary Wi-Fi router" Tags="|ipv4|ieee-802.11|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-06T23:14:04.480" ContentLicense="CC BY-SA 3.0" />
  <row Id="23312" PostTypeId="2" ParentId="23311" CreationDate="2015-10-12T16:23:28.037" Score="1" Body="&lt;p&gt;Two options immediately spring to mind:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set the Wi-Fi router into bridge mode and manage on the main router.  You should have a separate VLAN for your Wi-Fi if you want to treat that traffic separately.&lt;/li&gt;&#xA;&lt;li&gt;Manage on the Wi-Fi router.  The Wi-Fi router may not be capable of this if it is a consumer-grade device, in which case it would be off-topic for this forum.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-12T16:23:28.037" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23313" PostTypeId="1" CreationDate="2015-10-12T16:50:22.270" Score="5" ViewCount="265" Body="&lt;p&gt;We have 2 satellite locations which are linked to our main network with &quot;Wireless AP/Outdoor CPE/Network Bridge/Repeater/WIFI Signal Booster &amp;amp; Amplifier&quot; devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can access the internet from each location but we cannot seem to ping/remote to any of the devices connected to each of the locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first device in the chain connects to our network via cable and is assigned an IP address on what it calls it's WAN side. It's LAN side then has a different IP address so I think that each wireless device is creating it's own subnet (they seem to be in 'gateway' mode).&#xA;I think it the solution must be something to do with routing but I'm afraid that is where my knowledge is lacking and I'm coming a bit unstuck with it all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should we be creating separate subnets at each location or should we extend the original network IP range to each site?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have DVR's at each location that need to be accessed directly from the main network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each device has plenty of modes and options (gateway, bridge, repeater, etc.) but we cannot seem to get them all working the way we would like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks,&#xA;Alan&lt;/p&gt;&#xA;" OwnerUserId="19682" LastActivityDate="2016-03-10T20:19:13.823" Title="Multiple subnets or extended network?" Tags="|routing|wireless|" AnswerCount="2" CommentCount="0" ClosedDate="2019-02-12T04:21:24.157" ContentLicense="CC BY-SA 3.0" />
  <row Id="23314" PostTypeId="2" ParentId="23313" CreationDate="2015-10-12T16:58:29.507" Score="0" Body="&lt;p&gt;It sounds like your remote sites are doing NAT which would present the symptoms that you describe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many options to fix this.  A simple solutions would be to set the devices comprising the links into bridge mode, and have a separate VLAN for each link at your main site. The main site would then perform DHCP for the remote sites, and you would have routes to the remote sites.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-12T16:58:29.507" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23315" PostTypeId="2" ParentId="23313" CreationDate="2015-10-12T17:33:05.113" Score="2" Body="&lt;p&gt;Just turn NAT off and the firewall (or open needed ports) on the remote APs, add routes to the remote subnets pointing to the outside interface address of the Router/AP at the remote locations.&#xA;Bridging will work but will come with a lot more configuration and opens up more problems from in operation. DHCP over WAN will cause local resources at the remote locations to become unavailable if the main site or the connection goes down. Also DHCP over a wireless WAN link can lead to problems if that link is ever saturated or if it get's affected by weather conditions. Also you'll have to think about where your gateway is going to be. Also those links will now have all layer 2 traffic on it when it wouldn't need to be. I don't know the bandwidth of them or current utilization but this could issues that are easily avoided. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH, Let me know if this makes sense or you need clarification.&lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2015-10-12T17:33:05.113" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23316" PostTypeId="2" ParentId="23305" CreationDate="2015-10-12T17:57:44.400" Score="0" Body="&lt;p&gt;It can be done but it's not really recommended. You just have to make sure your server has a scope for that network so it knows which pool to use when it reads the relay stamp and configure the helper on the local router (don't configure multiple devices with helpers, it's a really common mistake to see).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best practices rant:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When possible you should do DHCP as close to the originating network as possible, if a WAN link goes down they're not going to be able to access any of the information locally. If the .200s site link goes down any sites relying on that server have lost access to every thing until you go around and statically configure addresses on devices that need it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically you'd use helper if you have multiple subnets at the same site (or layer 3 boundaries? I can't tell exactly what's going on in your screenshot, it's small and my eyes are strained currently) &lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2015-10-12T17:57:44.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23317" PostTypeId="1" CreationDate="2015-10-12T18:22:52.180" Score="4" ViewCount="40323" Body="&lt;p&gt;I am new to networking and figuring out that how to calculate sample RTT which will be used later to calculate estimated RTT,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my assigned problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose that TCP's current estimated values for the round trip time&#xA;(estimatedRTT) and deviation in the RTT (DevRTT) are &lt;code&gt;250 msec&lt;/code&gt; and &lt;code&gt;17 msec&lt;/code&gt;, respectively (see textbook for definition of variables). Suppose that&#xA;the next three measured values of the RTT are &lt;code&gt;330&lt;/code&gt;, &lt;code&gt;400&lt;/code&gt;, and &lt;code&gt;320&lt;/code&gt;&#xA;respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compute TCP's new value of estimatedRTT, DevRTT, and the TCP timeout&#xA;value after each of these three measured RTT values is obtained.Use the&#xA;values of &lt;code&gt;α = 0.125&lt;/code&gt; and &lt;code&gt;β = 0.25&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as estimated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RTT=(1-Alpha)*Estimated RTT+Alpha*SampleRTT&#xA;DEV RTT=(1-BETA)*DEVRTT+BETA*|SAMPLERTT-ESTIMATEDRTT|&#xA;timout=EstimatedRTT-4*DEVRTT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i have some questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How do I calculate Sample RTT?&lt;/li&gt;&#xA;&lt;li&gt;Is the estimated RTT in above formula the previously estimated RTT?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19684" LastEditorUserId="8499" LastEditDate="2015-10-13T01:43:42.777" LastActivityDate="2018-12-10T23:05:58.230" Title="How to calculate sample RTT?" Tags="|network-core|network-discovery|" AnswerCount="2" CommentCount="2" ClosedDate="2016-12-25T05:27:14.757" ContentLicense="CC BY-SA 3.0" />
  <row Id="23318" PostTypeId="1" CreationDate="2015-10-12T18:57:40.637" Score="4" ViewCount="10236" Body="&lt;p&gt;Can somebody please explain whats going on here?  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;localuser@localhost:~$ host 127.0.0.1  &#xA;1.0.0.127.in-addr.arpa domain name pointer localhost.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's up with the IP address being resolved backwards? : &lt;strong&gt;&lt;em&gt;(127.0.0.1 == 1.0.0.127) ?&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;Also; what is the significance of this new appendage, accompanying it? : &lt;strong&gt;&lt;em&gt;(.in-addr.arpa) ?&lt;/em&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance, guys.&lt;/p&gt;&#xA;" OwnerUserId="17196" LastActivityDate="2015-10-15T20:29:05.817" Title="DNS Resolution:&lt;Backwards IP Address&gt;.in-addr.arpa" Tags="|routing|dns|packet-analysis|udp|cli|" AnswerCount="3" CommentCount="1" ClosedDate="2017-08-12T19:11:30.423" ContentLicense="CC BY-SA 3.0" />
  <row Id="23319" PostTypeId="2" ParentId="23318" CreationDate="2015-10-12T19:31:42.027" Score="2" Body="&lt;p&gt;What you are seeing is the local forward and reverse entry for the ip address 127.0.0.1 (localhost loopback)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in.addr.arpa is a reserved top-level domain for infrastructure purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason you see the ip address in reverse format is due to the way DNS works. The notation is used to pass the Forward Confirmed reverse DNS process that is used for verification purposes (e.g. does a mail from the ipaddress 1.1.1.1 really belongs to the domain example.com).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short... in.addr.arpa is a reserved top-level domain for reverse lookups and the inverted format is used because it was specified back in the days. Reverse DNS is used for verifying that a certain ip address really belongs do a domain.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastEditorUserId="19610" LastEditDate="2015-10-15T15:41:53.500" LastActivityDate="2015-10-15T15:41:53.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23320" PostTypeId="2" ParentId="23318" CreationDate="2015-10-12T20:32:15.543" Score="1" Body="&lt;p&gt;The reverse order of the IP address on the query is because when you do some research for some IP, the order matters. You need to find a specific machine in some network, and not matching the network part and the host part. You need to go to &lt;code&gt;from the host&lt;/code&gt; to &lt;code&gt;the network&lt;/code&gt; on a recursive lookup, like it's said on &lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc730980.aspx&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This reversed ordering of the domains for each octet value is&#xA;  necessary because, unlike DNS names, when IP addresses are read from&#xA;  left to right, they are interpreted in the opposite manner. When an IP&#xA;  address is read from left to right, it is viewed from its most&#xA;  generalized information (an IP network address) in the first part of&#xA;  the address to the more specific information (an IP host address) that&#xA;  is contained in the last octets. For this reason, the order of IP&#xA;  address octets must be reversed when the in-addr.arpa domain tree is&#xA;  built. The IP addresses of the DNS in-addr.arpa tree can be delegated&#xA;  to organizations as they are assigned a specific or limited set of IP&#xA;  addresses within the Internet-defined address classes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17678" LastEditDate="2015-10-14T16:41:57.937" LastActivityDate="2015-10-14T16:41:57.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23321" PostTypeId="1" AcceptedAnswerId="23329" CreationDate="2015-10-12T21:32:02.733" Score="5" ViewCount="3381" Body="&lt;p&gt;During my years working with Cisco equipment I realised that switches have more VTY lines (16) as compared to routers which have 5 VTY lines considering that the equipment that we work with (c2960 switches and 1941 routers) the routers have more memory than the switch. What is the logical explanation for this?&lt;/p&gt;&#xA;" OwnerUserId="15536" LastEditorUserId="8499" LastEditDate="2020-01-10T09:14:42.353" LastActivityDate="2020-01-10T09:14:42.353" Title="Why does a switch have more VTY lines than a router?" Tags="|cisco|switch|router|cisco-catalyst|virtual|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23322" PostTypeId="1" CreationDate="2015-10-12T21:52:23.500" Score="3" ViewCount="66" Body="&lt;p&gt;I connect to a organization's non-secure Wi-Fi provided to guests.&#xA;it is said that my data transmissions are not private and could be intercepted by others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do to secure my data transmission, for example, for web browsing, email, on Ubuntu 14.04 (my laptop) and Android 4.4.2 (my phone)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastActivityDate="2015-10-12T22:40:12.147" Title="How to secure data transmission over a non-secure Wi-Fi" Tags="|security|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23324" PostTypeId="2" ParentId="23252" CreationDate="2015-10-12T22:24:19.180" Score="1" Body="&lt;p&gt;Trees (also books or anything made out of cellulose) are a nightmare, they block most of the signal even from 2.4Ghz frequencies. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you call interference both losses from propagation and real interference. But, theres a difference, because you can lose signal power to a level that the SINR becomes too low and the channel noise becomes a significant problem. Also situations where multipath signal reflection generates collisions at the receiver or situations where other microwave sources uses the same channel of your AP, for example. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11ac is restricted to 5Ghz frequencies. Higher the frequency, lower the possibility to go through walls, for example. 5Ghz signals might even be &quot;trapped&quot; inside the room where the access point is located.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a too generic question.. but the pack of usual problems, same as earlier 802.11s:&#xA;Refraction,&#xA;Defraction,&#xA;Reflection,&#xA;Propagation losses (related to distance),&#xA;Channel interference (rarer in 5Ghz),&#xA;Collisions,&#xA;Low signal power from client -&gt; AP compared to AP -&gt; client &lt;/p&gt;&#xA;" OwnerUserId="19428" LastActivityDate="2015-10-12T22:24:19.180" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23325" PostTypeId="2" ParentId="23322" CreationDate="2015-10-12T22:40:12.147" Score="1" Body="&lt;p&gt;You can make use of a secure tunnel relying on encription at least to somewhere outside the WIFI zone. You can use ssh port forwarding or VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use Debian in my notebook and I use the tool openvpn to set a VPN tunnel to encrypt my notebook's entire traffic until it reaches the VPN server. With VPN you can choose if you route all or individual ports to the VPN server and you can use ssh forwading to a remote server on specific ports too, such as 80 and 443. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sry, dont know about VPN apps on android yet.&lt;/p&gt;&#xA;" OwnerUserId="19428" LastActivityDate="2015-10-12T22:40:12.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23326" PostTypeId="1" AcceptedAnswerId="23327" CreationDate="2015-10-12T23:03:41.723" Score="5" ViewCount="6244" Body="&lt;p&gt;I'm going to be running some Cat5E cables to have a more organized wired computer network at home. I'm going to be terminating the premise wiring at the jacks and patch panels based on the T568A standard. I chose T568A because:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It's specified for residential installations according to ANSI/TIA-570-C for residential structired wiring.&lt;/li&gt;&#xA;&lt;li&gt;I'm also running new phone Cat5e for some phone lines and using&#xA;T568A there, and I want to be consistent during the installation for&#xA;simplicity and to be able to repurpose cables if I chose to later.&lt;/li&gt;&#xA;&lt;li&gt;T568A matches line 1 &amp;amp; 2 pinouts for phones.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A lot of the patch cords I currently have are T568B, and I'd like to reuse some. Would that cause any problems?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example a run might be.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Computer&amp;lt;-&amp;gt;Patch cord (T568B)&amp;lt;-&amp;gt;Wall jack (T568A)&amp;lt;-&amp;gt;Patch Panel Port (T568A)&amp;lt;-&amp;gt;Patch Cord (T568A)&amp;lt;-&amp;gt;Switch Port&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't imagine that it would be a problem, but I just wanted to be sure.&lt;/p&gt;&#xA;" OwnerUserId="4452" LastEditorUserId="8499" LastEditDate="2019-01-03T01:51:29.413" LastActivityDate="2022-09-12T18:04:33.547" Title="Any problems mixing T568B Patch cords with T568A Premise wiring?" Tags="|layer1|cable|cabling|utp|standardisation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23327" PostTypeId="2" ParentId="23326" CreationDate="2015-10-13T00:04:46.030" Score="3" Body="&lt;p&gt;No, it is not a problem. You only need to be concerned that both ends of a physical cable (patch cord, horizontal cable, vertical cable, etc.) are terminated to the same standard.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-13T00:04:46.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23328" PostTypeId="2" ParentId="23321" CreationDate="2015-10-13T00:21:54.113" Score="4" Body="&lt;p&gt;The no. of VTY lines  depends on IOS version installed. Starting IOS 12.2, 16 VTY lines are allowed.&lt;/p&gt;&#xA;" OwnerUserId="19695" LastActivityDate="2015-10-13T00:21:54.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23329" PostTypeId="2" ParentId="23321" CreationDate="2015-10-13T00:22:02.160" Score="2" Body="&lt;p&gt;Your premise is not necessarily true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some Cisco routers do have VTY lines 0 to 15, and some older Cisco switches only have VTY lines 0 to 4.  As far as I know, you can configure &lt;code&gt;line vty 0 15&lt;/code&gt; on a Cisco 1941 router.  It won't show lines 5 to 15 unless you actually configure them.  I don't have direct experience with the 1941, but every ISR G2 router that I have touched, including the 1921, can configure VTY lines 0 to 15.  If you can't on your 1941, it may be a software version thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers generally have more memory because they need it.  Routing processes, routing protocol tables, routing tables, access lists, route maps, NAT tables, ARP cache, routing buffers, QoS policies, etc. tend to eat up a lot of RAM, while switches primarily need it for the MAC address table.  On the other hand, there are large Cisco switches which can have a lot of memory, but they tend to be layer-3 switches which perform routing functions, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-13T00:22:02.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23331" PostTypeId="2" ParentId="1832" CreationDate="2015-10-13T04:03:52.427" Score="1" Body="&lt;p&gt;There is no requirement that you place your dhcp server on the nat device, and in your case having it not on the nat device allows you to preserve state across nat device swaps.&lt;/p&gt;&#xA;" OwnerUserId="13774" LastActivityDate="2015-10-13T04:03:52.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23333" PostTypeId="2" ParentId="23297" CreationDate="2015-10-13T06:08:22.077" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If I linked my domain name to that ip address, the gateway I am on would have no way to know where to route the packet on the subnet it is connected to.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Let's recap what you've described: the gateway here has a public-Internet-facing IP address (the one you see when you visit WhatIsMyIP?). It also has a private-subnet-facing IP address. The gateway does network address translation (NAT): it translates the (public, shared) destination IP address in incoming packets to the private IP address of a host on the subnet, and it translates the private source address of outgoing packets from hosts on the subnet to the public IP address of the gateway, which is shared by all hosts on the subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/z1O5q.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z1O5q.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;(Image source: &lt;a href=&quot;https://wiki.filezilla-project.org/Network_Configuration&quot; rel=&quot;noreferrer&quot;&gt;FileZilla Wiki&lt;/a&gt;, licensed under &lt;a href=&quot;http://www.gnu.org/copyleft/fdl.html&quot; rel=&quot;noreferrer&quot;&gt;GNU Free Documentation License 1.2&lt;/a&gt;)&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You've correctly noted that in most cases, a NAT can forward outgoing traffic, and receive incoming traffic for &lt;em&gt;established sessions&lt;/em&gt; (that's how you can receive data back once you contact a website, for example), but it doesn't know how to forward incoming traffic for &lt;em&gt;new&lt;/em&gt; sessions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution to this particular problem is &lt;a href=&quot;https://en.wikipedia.org/wiki/Port_forwarding&quot; rel=&quot;noreferrer&quot;&gt;NAT &quot;port forwarding&quot;&lt;/a&gt; or &quot;port mapping.&quot; To use this, you would define port forwarding rules on your NAT device (e.g. router) that say, for example, &quot;Packets received on TCP port 80 should be forwarded to 192.168.0.44.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(You may face other problems that are not solved by port forwarding, however. For example, if you haven't paid for a static IP address, your ISP may change the public IP address assigned to your gateway whenever it feels like it, which will break your setup.)&lt;/p&gt;&#xA;" OwnerUserId="19700" LastActivityDate="2015-10-13T06:08:22.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23334" PostTypeId="1" CreationDate="2015-10-13T06:45:57.163" Score="4" ViewCount="2235" Body="&lt;p&gt;My current single uplink from 2-stacked switches to ASA is not enough to cater the link utilization (upload traffic from the 2-stacked switches to ASA). So, I have thought of using 2 uplinks. If I use Etherchannel for the 2-uplinks, then only one link will run in case that one link down instead of failover to standby ASA using 2 standby-uplinks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please advise if there is better way of using the 2 uplinks to each ASA and failover to standby ASA in case that one uplink is down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please refer the current and new planned diagrams below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rbwDH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rbwDH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2020-07-31T18:32:20.213" Title="2-stacked switches with 2 uplinks to each ASA" Tags="|cisco|switch|cisco-asa|failover|stacking|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23335" PostTypeId="2" ParentId="23334" CreationDate="2015-10-13T07:23:40.930" Score="3" Body="&lt;p&gt;Using a 2nd Uplink and using link aggregation (etherchannel) is the right way to go. Keep in mind that your throughput problems might be due to the ASAs limitations (which model do you use?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing to keep in mind is the load balancing algorithm you use for etherchannel (src-mac, src-dst-mac, src-dst-ip, src-dst-mac-ip). Based on your traffic patterns the default algorithm src-mac might not be the right choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if you need any configuration examples.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;ASA&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gi0/0&#xA;channel-group 1 mode passive&#xA;&#xA;interface gi0/1&#xA;channgel-group 1 mode passive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Switch&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gi1/0/1&#xA;channel-group 1 mode active&#xA;&#xA;interface gi2/0/1&#xA;channgel-group 1 mode active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To verify the status of the link aggregation use the following commands&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;ASA&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show port-channel summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Switch&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show etherchannel summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;both devices should display your configured ports with status &lt;strong&gt;P&lt;/strong&gt; (bundled)&lt;/p&gt;&#xA;" OwnerUserId="19610" LastEditorUserId="19610" LastEditDate="2015-10-14T18:19:03.763" LastActivityDate="2015-10-14T18:19:03.763" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23336" PostTypeId="1" CreationDate="2015-10-13T07:31:20.293" Score="1" ViewCount="249" Body="&lt;p&gt;On every vlan I have two ip ranges (for historical reasons). To PXE boot machines on these vlans I use ip helper/dhcp relay to relay requests onto the vlan where the dhcp server sits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the dhcp server only handles DHCP requests for one of the ip ranges (the one used as source address in the relayed dhcp message). How could I tell my dhcp server så accept dhcp requests for multiple subnets from one specific IP?&lt;/p&gt;&#xA;" OwnerUserId="16331" LastActivityDate="2015-10-14T06:06:18.790" Title="ip-helper outside the helped network range" Tags="|dhcp|" AnswerCount="2" CommentCount="1" ClosedDate="2015-10-16T05:14:27.130" ContentLicense="CC BY-SA 3.0" />
  <row Id="23338" PostTypeId="2" ParentId="23336" CreationDate="2015-10-13T07:59:35.760" Score="1" Body="&lt;p&gt;just try to gave your interface vlan two IPs &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;#vlan 10&lt;br&gt;&#xA;   # int vlan 10&lt;br&gt;&#xA;   # ip add X.X.X.X M.M.M.M&lt;br&gt;&#xA;   # ip add Y.Y.Y.Y M.M.M.M secondary&lt;br&gt;&#xA;   # ip helper address &lt;em&gt;your DHCP server address&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;so that DHCP sever will be able to give IP to hosts in rang of X.X.X.X M.M.M.M and in range of Y.Y.Y.Y M.M.M.M , but i'm not sure which host get which IP  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;but it is better to configure two interface vlans instead of one with two ranges&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;also make use of this link about &lt;a href=&quot;https://supportforums.cisco.com/discussion/11152746/using-ip-helper-address-vlan-three-subnets&quot; rel=&quot;nofollow&quot;&gt;multiple range in same vlan&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also i'm not understand how you put two ranges in one vlan &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-10-13T08:44:49.133" LastActivityDate="2015-10-13T08:44:49.133" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23339" PostTypeId="1" CreationDate="2015-10-13T08:17:57.093" Score="2" ViewCount="7624" Body="&lt;p&gt;I need to rename an existing Fortigate 100D VDOM. I cannot find the command unless it's really counter-intuitive. Furthermore, if this is not possible, can I copy the existing VDOM to a new one with the correct name?&lt;/p&gt;&#xA;" OwnerUserId="1985" LastActivityDate="2018-11-13T20:00:50.130" Title="How to rename an existing FortiGate VDOM" Tags="|fortigate|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23341" PostTypeId="1" AcceptedAnswerId="23342" CreationDate="2015-10-13T08:51:43.750" Score="2" ViewCount="423" Body="&lt;p&gt;Lets say I own (LIR-status) the prefix 80.200.72.0/21 and that prefix is routed via AS e.g. &lt;strong&gt;AS12345&lt;/strong&gt; at this very moment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to split this prefix into two AS, so the last portion (80.200.79.0/24) of the prefix mentioned before is routed via a new AS e.g. &lt;strong&gt;AS54321&lt;/strong&gt; and the rest is routed via the existing AS &lt;strong&gt;AS12345&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="3200" LastActivityDate="2015-10-13T09:02:02.183" Title="Split prefix into several autonomous systems - BGP" Tags="|routing|bgp|prefix|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23342" PostTypeId="2" ParentId="23341" CreationDate="2015-10-13T09:02:02.183" Score="1" Body="&lt;p&gt;Yes, no problem at all, that's what BGP is for. You can do this by announcing the /24 from AS54321 and announcing the remaining /22, /23 and /24 from AS12345, or announce the /24 from AS54321 and the /21 from AS12345. The last option will work since more specific routes are preferred.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want your prefixes to be globally visible, don't use anything smaller than a /24. Also, you may need to fix proper routing object in routing registries like the RIPE database and announce to your upstreams that you'll be advertising the prefixes, so they can update their filters and will accept the announcement.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-10-13T09:02:02.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23343" PostTypeId="1" AcceptedAnswerId="23363" CreationDate="2015-10-13T09:54:24.963" Score="3" ViewCount="214" Body="&lt;p&gt;Today someone told me that when a device has connected to an AP, other APs in the room normally cannot see its packets, because:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Adjacent APs commonly work at different frequencies to prevent&#xA;interference&lt;/li&gt;&#xA;&lt;li&gt;The wireless network interface controller will not pass the packet&#xA;that isn't addressed to it&lt;/li&gt;&#xA;&lt;li&gt;Sometimes the device does send probe packets, but it only happens&#xA;when the device decides to roam&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is what he said correct?&lt;/li&gt;&#xA;&lt;li&gt;If so, how can a WiFi positioning system, be it fingerprinting-based&#xA;or triangulation-based, be able to detect the locations of connected&#xA;devices using just a single AP, or do the APs have to work in&#xA;promiscuous mode for WiFI positioning?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19705" LastEditorUserId="8499" LastEditDate="2015-10-14T02:59:53.370" LastActivityDate="2015-10-14T05:43:12.837" Title="How does Wi-Fi localization work for connected devices?" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23345" PostTypeId="2" ParentId="23298" CreationDate="2015-10-13T14:20:06.187" Score="1" Body="&lt;p&gt;I think it's better understood using an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet Layer manages the &lt;em&gt;addressing&lt;/em&gt;. And addressing means to know its &lt;em&gt;own address&lt;/em&gt; and the &lt;em&gt;subnet&lt;/em&gt; where the system belongs. To be aware of that information it is neccesary to know the subnet mask. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the internet protocol they go together, because it let the system decides easily if a packet goes to its own subnet or to another one through the default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to separate it in two different layers is possible but not useful. &lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-10-13T14:20:06.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23347" PostTypeId="1" CreationDate="2015-10-13T16:44:49.123" Score="1" ViewCount="266" Body="&lt;p&gt;I want to build a HTPC (&lt;em&gt;Home Theater PC&lt;/em&gt;) connected to a NAS (&lt;em&gt;Network Access Storage&lt;/em&gt;) server where all the media will be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My HTPC and NAS server will be connected to a Gigabit Ethernet switch, and this switch will be connected to a Fast Ethernet router which provides internet from the ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: &lt;strong&gt;will the connection between the HTPC and the NAS have a Gigabit (1000Mb) or Fast (100Mb) bandwidth?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm not wrong, when the HTPC will try to access the NAS server, it will do it directly through the switch, and therefore with Gigabit Ethernet connection (1000Mb of bandwidth). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when the HTPC will try to access the internet (or other device connected to the router), it will do it through the switch and then the router, and therefore with Fast Ethernet connection (100Mb of bandwidth). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When someone will try to access the NAS from, lets say, the Wifi provided by the router, it will do it through router then switch, and therefore at a bandwidth of 100Mb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is all this correct?&lt;/p&gt;&#xA;" OwnerUserId="19721" LastEditorUserId="19721" LastEditDate="2015-10-13T16:53:57.083" LastActivityDate="2015-10-13T17:03:01.290" Title="Bandwidth of combined switch and router" Tags="|switch|router|lan|" AnswerCount="1" CommentCount="2" ClosedDate="2015-10-13T17:58:58.297" ContentLicense="CC BY-SA 3.0" />
  <row Id="23349" PostTypeId="2" ParentId="23347" CreationDate="2015-10-13T17:03:01.290" Score="1" Body="&lt;p&gt;Shortly someone will tell you that questions about home networks are off topic and will give a link to the rules for this forum. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, an Ethernet's link speed is always predicated upon the device it is plugged into at the physical and MAC layers. The IP (network) connection to some other device has no impact on your link speed. So, if your switch is Gigabit and the machines plugged into it have Gigabit interfaces then they should negotiate a Gigabit link speed. As you mentioned your router being FastE will negotiate a FastEthernet connection with the switch. Your wireless devices with always negotiate some link speed within the capabilities of whatever 802.xx protocol you are utilizing. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-10-13T17:03:01.290" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23350" PostTypeId="2" ParentId="23284" CreationDate="2015-10-13T17:13:30.303" Score="1" Body="&lt;p&gt;There are different flow and rate control mechanics, and to an extent they work separately from each other.&lt;/p&gt;&#xA;&lt;p&gt;The Receivers window has to do with how much room in the buffer the device has to dedicate to that connection.  As it takes the data from the buffer and sends it off to the waiting program, it will clear space on the buffer and constantly update the sender on its available buffer. So I don't think it is possible to find using the RTT or cwnd.&lt;/p&gt;&#xA;&lt;p&gt;By threshold I assume you mean SSthresh.  Over a sufficiently long period of time it should pretty closely match the speed of the bottleneck of the connection.  IE. it should be 2Mbps in your example.&lt;/p&gt;&#xA;&lt;p&gt;In traditional Slow Start it doubles every time the sender receives an ACK for one of it's segments, until it passes the bottleneck speed and slows down.  So you can kind of plot where it should be by how many RTTs (and therefor how many ACKs should return), as long as you assume the initial value.&lt;/p&gt;&#xA;&lt;p&gt;I would recommend reading TCP_IP Protocol Suite 4th ed. – B. Forouzan for a more complete explanation of this.&lt;/p&gt;&#xA;&lt;p&gt;Note that a lot of this is out the window with the widely used implementation of TCP called Cubic TCP.  It changes how Slow Start and Congestion Avoidance works significantly.&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/CUBIC_TCP&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/CUBIC_TCP&lt;/a&gt;&#xA;&lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-rhee-tcp-cubic-00&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://datatracker.ietf.org/doc/html/draft-rhee-tcp-cubic-00&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19720" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2015-10-13T17:13:30.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23351" PostTypeId="1" AcceptedAnswerId="23352" CreationDate="2015-10-13T17:16:22.213" Score="9" ViewCount="7755" Body="&lt;p&gt;I have to teach my sixth form about MAC Addresses and IP Addresses in a few weeks time and there are some areas I am unclear on which I am hoping some of you will be able to clarify for me. I have enough to get them through the syllabus, but I like to have more knowledge than the spec so that I can explain how things work in more meaningful way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So as I understand it the following happens when a device on a LAN sends a packet/frame to a device on another separate LAN via the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A packet is created at the sending end with the destination and sending IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First question: Is the destination IP actually the IP of the gateway for the receiving device’s LAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is then turned into a frame which will go to the gateway for the LAN - this happens at the data link layer and the frame has a MAC sending and destination address added&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;First question: The destination MAC address - is this the final&#xA;  destination or the destination of the gateway?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The packet/frame is then sent onto the internet and routed (using the IP address) to the next hop towards the final destination&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Second question: At each hop, does the data link layer change the&#xA;  destination MAC address in the frame to the MAC address of the next&#xA;  hop?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The packet/frame is routed to the destination address (which is the gateway )&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Third question: Once the frame/packet reaches the gateway of the&#xA;  receiving LAN is the destination MAC address in the frame used by a&#xA;  switch to ensure it ends up at the correct device? This obviously&#xA;  assumes that the destination MAC address is not amended by the routers&#xA;  as the frame/packet traverses the internet - if it is amended then&#xA;  once the receiving gateway receives the frame/packet, how does it know&#xA;  where to send it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="19719" LastEditorUserId="8499" LastEditDate="2015-10-13T21:19:05.130" LastActivityDate="2019-03-31T21:52:22.423" Title="How are MAC/IP addresses used in routing" Tags="|routing|router|ipv4|mac-address|osi|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23352" PostTypeId="2" ParentId="23351" CreationDate="2015-10-13T17:22:50.583" Score="6" Body="&lt;p&gt;MAC addresses are layer-2 addresses in the frame header. The layer-2 frame encapsulates the layer-3 IP packet.  The layer-2 frame is stripped off at a layer-2/3 boundary (e.g. a router).  If the layer-3 packet needs to be forwarded through another layer-2 domain, a new layer-2 frame is created using MAC addresses in the new layer-2 domain to encapsulate the layer-3 packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conceptually:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To the router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;lt;L2 frame&amp;gt;&amp;lt;L3 packet&amp;gt;&amp;lt;L4 segment&amp;gt;PAYLOAD DATA&amp;lt;/L4 segment&amp;gt;&amp;lt;/L3 packet&amp;gt;&amp;lt;/L2 frame&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;lt;L3 packet&amp;gt;&amp;lt;L4 segment&amp;gt;PAYLOAD DATA&amp;lt;/L4 segment&amp;gt;&amp;lt;/L3 packet&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;lt;New L2 frame&amp;gt;&amp;lt;L3 packet&amp;gt;&amp;lt;L4 segment&amp;gt;PAYLOAD DATA&amp;lt;/L4 segment&amp;gt;&amp;lt;/L3 packet&amp;gt;&amp;lt;/New L2 frame&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original layer-2 frame will contain the source MAC address of the sender, and the destination MAC address of the router's interface in that layer-2 domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The new layer-2 frame will contain the source MAC address of the router's interface in the new layer-2 domain, and the destination MAC address of the next hop in the new layer-2 domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-3 packet will contain the layer-3 source IP address of the originator of the packet, and the layer-3 destination address of the final layer-3 destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 MAC addresses are removed at each layer2/3 boundary along the routes to be replaced with the MAC addresses of the new source and destination, but the layer-3 IP addresses stay the same along the path (with certain exceptions like NAT).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-13T17:35:32.203" LastActivityDate="2015-10-13T17:35:32.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23353" PostTypeId="1" CreationDate="2015-10-13T18:32:33.303" Score="2" ViewCount="286" Body="&lt;p&gt;Good afternoon guys.  I have a Dell precision 4800 Laptop which is most of the time hooked up to the LAN at the users desk.  Out on our production floor we have 4 Access Points, each on their own VLAN except for 1 which shares the 192.168.0.* network with the rest of the main domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the user takes his laptop out to the Access Point and connects the computer says it is connected to an unidentified network and it gets an IP from the DHCP server successfully but it cannot see any other devices on the network.  The IP that it gets is the IP that he gets when connected to the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When he connects to another AP he gets his DHCP address for that VLAN (192.168.4.*) and is able to connect to the network and email and internet just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I take another computer out there to the floor and connect to the wifi it gets the same IP as if connected to the LAN and it works just fine.  Able to surf the web, connect to network drives, everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried netsh int ip reset and everything I can think of but this one PC, on this 1 network, will not connect properly and I am confused as hell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the AP's are up to date with the latest firmware and they are all the same model, Pakedge W7&lt;/p&gt;&#xA;" OwnerUserId="13578" LastActivityDate="2015-10-13T18:32:33.303" Title="Windows 7 PC getting unidentified network and no network access on 1 wifi" Tags="|wireless|dell|access-point|network-discovery|" AnswerCount="0" CommentCount="1" ClosedDate="2015-10-13T18:36:08.347" ContentLicense="CC BY-SA 3.0" />
  <row Id="23354" PostTypeId="1" AcceptedAnswerId="43096" CreationDate="2015-10-13T18:37:23.440" Score="4" ViewCount="561" Body="&lt;p&gt;&lt;strong&gt;Summary&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a network (Cisco 2960E) with many Apple products, when I connect a computer via hard ethernet it cannot see Airplay devices (Airport Express) that it can see when connected via WiFi (WiFi devices are RUCKUS not Airport). In the hard line state, Bonjour Browser shows Apple and non-Apple services, but not the Airport Expresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Details&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Cisco Router (1941-sec) and Switch and Ruckus WiFi APs (7372) and Controller. The Switch has PoE for the APs and a handful of security cameras. These devices provide the backbone for my LAN.  I'm not running VLAN, yet; every device is currently on the same subnet (10.10.10.XXX).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AirPort Express devices (4) are present solely as Airplay points for music. Their phone jacks are piped into a multizone amplifier and to be used to send music from various Airplay music sources.  Importantly, their WiFi is off and they are hardwired into the switch, picking up their IP addresses via DHCP (server runs on the Router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When my computer is on WiFi and attached to the Ruckus APs, it can see the Airport Expresses. However, when my computer starts out hardwired (to the switch) only, it cannot see the AEs. If I temporarily turn on the WiFi and then turn it off, the computer sees the AEs and remembers them until sleep or reboot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My assumption is that the Bonjour requests aren't making it from the computer to the AEs through the Switch, although I don't know why. Presumably, there's something the Ruckus APs are doing which puts their ports in a different state and encourages the packets to flow between the AEs and the APs. Something that my computer is not doing.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there a way I can track, log or debug this?&lt;/li&gt;&#xA;&lt;li&gt;What can I do to test&#xA;the Ruckus ports and compare them to the AE and Computer ports?&lt;/li&gt;&#xA;&lt;li&gt;Can I&#xA;modify the AE or computer ports to improve this situation?&lt;/li&gt;&#xA;&lt;li&gt;Is there&#xA;some global state for the Switch (or the Router) that I've missed?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm happy to provide more details (configuration files, etc.) if this would help. Also, I'm definitely new to all of this. I've got a reasonable understanding of how all of this stuff works, but I'm really just crawling along. I'm aware that Bonjour has problems across networks and there are bridges available, etc., that solve those problems. Please note, we are not in that situation as there is only one Class C network that everything sits on.&lt;/p&gt;&#xA;" OwnerUserId="5618" LastActivityDate="2017-08-08T14:26:06.067" Title="Odd Wired/Wireless Behavior Difference with Cisco Switch and Airplay (Bonjour) Device" Tags="|cisco|switch|wireless|ethernet|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23355" PostTypeId="2" ParentId="23145" CreationDate="2015-10-13T18:38:32.837" Score="1" Body="&lt;p&gt;This ended up being a failing switch. A couple days later we started having issues on ports 37-48. The FESX648-PREM is powered by port ASICs which control port regions. Those regions are: 1-12, 13-24, 25-36 and 37-48.  One of the&#xA;failure modes on this box is that a port ASIC can die and cause forwarding&#xA;problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;bad server&quot; above, was the only server we had in use on the 37-48 region. So when we switched the port and re-tested, we had the same result because the failing ASIC affected multiple ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We replaced the entire switch and that resolved the issue.&lt;/p&gt;&#xA;" OwnerUserId="8209" LastEditorUserId="8209" LastEditDate="2015-10-14T06:23:49.197" LastActivityDate="2015-10-14T06:23:49.197" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23357" PostTypeId="2" ParentId="23351" CreationDate="2015-10-13T21:15:03.377" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;First question: The destination MAC address - is this the final destination or the destination of the gateway?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The MAC addresses are used in the layer 2 of the frame, and the layer 2 define the local network. So, the destination MAC address is the address of your gateway if the final target is not on the same LAN.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Second question: At each hop, does the data link layer change the destination MAC address in the frame to the MAC address of the next hop?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, or the MAC address of the final target if it is on the same LAN.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Third question: Once the frame/packet reaches the gateway of the receiving LAN is the destination MAC address in the frame used by a switch to ensure it ends up at the correct device? This obviously assumes that the destination MAC address is not amended by the routers as the frame/packet traverses the internet - if it is amended then once the receiving gateway receives the frame/packet, how does it know where to send it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With the IP address of the final target and his routes (LAN address and masks), the router can deduct if the target of the packet is on the same LAN or not. If the IP address is in the range of the LAN IP address and the mask, it knows the final target is in a LAN the router is connected.&lt;/p&gt;&#xA;" OwnerUserId="19274" LastEditorUserId="55708" LastEditDate="2019-03-31T20:49:25.470" LastActivityDate="2019-03-31T20:49:25.470" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23358" PostTypeId="1" AcceptedAnswerId="23359" CreationDate="2015-10-13T22:54:18.607" Score="3" ViewCount="22367" Body="&lt;p&gt;let's say I have 200.35.1.0/24 network block. I need to address 20 hosts on each subnet. How do I specify the minimum number of host bits that are required?&lt;/p&gt;&#xA;" OwnerUserId="19729" LastActivityDate="2015-12-04T17:11:19.613" Title="how to find a minimum number of host bits needed?" Tags="|subnet|" AnswerCount="3" CommentCount="0" ClosedDate="2019-04-02T01:13:22.427" ContentLicense="CC BY-SA 3.0" />
  <row Id="23359" PostTypeId="2" ParentId="23358" CreationDate="2015-10-13T23:07:17.100" Score="2" Body="&lt;p&gt;First, you have to add 2 addresses to the number of hosts you want. These are for network and broadcast addreses (therefore, for 20 hosts you get 20+2=22)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, convert this number to the binary (22d = 10110b)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, count how many bits you used and that's your answer (in this case, it will be 5 bits, so 32-5=27 bits for network)&#xA;Your subnets will be then 200.35.1.0/27, 200.35.1.32/27, 200.35.1.64/27, and so on..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can use some network subnet calculator, most of them allow you to choose or enter number of hosts per subnet (always choose closest bigger number by at least 2 hosts, as I said in 1st step). Example of such calculator is &lt;a href=&quot;http://www.subnet-calculator.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.subnet-calculator.com/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19676" LastActivityDate="2015-10-13T23:07:17.100" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23360" PostTypeId="1" AcceptedAnswerId="23365" CreationDate="2015-10-14T03:37:53.843" Score="4" ViewCount="687" Body="&lt;p&gt;I am a fresh network engineer and tasked with building a test bed to provide remote internet connectivity for users in remote areas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no problems pinging the terminals located on both ends of the network but the remote terminal simply cannot connect to the Internet. Below is the diagram that I was following.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remote PC ------Remote Router A ====== Remote Router B ----- Gateway (with Internet access)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;---- is LAN and === wireless transmission&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The leftmost network (remote) is &lt;code&gt;192.168.201.x/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network between router is &lt;code&gt;172.x.x.x/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rightmost network (Internet) is &lt;code&gt;192.168.200.x/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be worth noting that the remote routers are more like modems with router capabilities. They only have one Ethernet port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A PC connected to the gateway (it's a Linksys) via LAN can ping the remote PC. It can also ping any of the remote routers along the route. The same can be done from the remote PC's end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I try to ping a URL, for example google.com, using the remote PC, I will get the message that the name cannot be resolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if anyone could give me some pointers on what is going wrong?&#xA;I've been at it for weeks, and I'm running out of options to try.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional info:&#xA;&lt;s&gt;i tried pinging the ip address of google and it didn't work either. router is a satellite modem. remote PC is set to a static ip of 192.168.201.2/24. remote router A is 192.168.201.1/24. remote PC was configured with a DNS address (not 8.8.8.8 though) &lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SFP79.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SFP79.png&quot; alt=&quot;setup diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some elaboration regarding the image. Currently the setup is still being tested so the Tx and Rx ports of both Modem A and B are connected via cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Linksys Gateway (Linksys 10/100 8 port VPN Router RV082) connects to the Internet through its WAN/Internet port. a total of 8 PCs can be connected to it to use the internet in this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, I can ping from Remote PC to Modem A, Modem B, Linksys, Another PC. It fails when I ping to any IP on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remote PC has been configured with the same DNS settings as Another PC.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Routing Table of Modem A&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0.0.0.0/0 routed via BNC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Routing Table of Modem B&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.201.0/24 routed via BNC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0.0.0.0/0 routed via ETH to 192.168.200.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Routing Table of Linksys&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.201.0/24 to use 192.168.200.200 as gateway&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Linksys configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Device IP: 192.168.200.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Device's connection to Internet is via static IP 147.25.x.x/24 with the gateway indicated as 147.25.100.1/24&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I need to specify a next hop address for ETH on the Modem routes but not if the are using BNC because it is a point-to-point setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;unfortunately, i can't share much about the linksys router as i have no access to the Internet facing side. i am only aware of the DNS server, default GW and the dynamic ip range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this is clearer.&lt;/p&gt;&#xA;" OwnerUserId="19735" LastEditorUserId="19735" LastEditDate="2015-10-15T02:34:54.820" LastActivityDate="2016-04-30T09:20:53.643" Title="configuring for remote internet connection" Tags="|internet|" AnswerCount="4" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="23361" PostTypeId="2" ParentId="23360" CreationDate="2015-10-14T04:11:52.733" Score="0" Body="&lt;p&gt;Based on the little information you have provided (no router models and no configurations, especially PC DNS configuration), it appears you have a DNS problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can ping an Internet IP address (e.g. 8.8.8.8), but not ping by URL, you have a DNS problem; the PC cannot resolve the name because it doesn't have a DNS server with Internet DNS names.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-02T05:19:51.690" LastActivityDate="2015-11-02T05:19:51.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23363" PostTypeId="2" ParentId="23343" CreationDate="2015-10-14T05:43:12.837" Score="0" Body="&lt;p&gt;Wifi clients will continue to perform Active Probing of the entire Wifi channel space even when already associated to an AP  - primarily so they are aware of other APs in the same SSID (on different channels) to roam to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can prove this every time you associate to a network, open your wireless settings and see a real-time list of other networks you could associate with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you talk about &quot;packets&quot; I assume you mean IP, which in this case is true - while the client probes will be sent out on all channels, IP traffic will only be sent to the AP the client is associated to.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-10-14T05:43:12.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23364" PostTypeId="2" ParentId="23336" CreationDate="2015-10-14T06:06:18.790" Score="0" Body="&lt;p&gt;If you're on Cisco you could use static mac mapping and &lt;code&gt;ip dhcp smart-relay&lt;/code&gt;.  This will send 3 requests from the primary interface address, and if the DHCP server doesn't respond (i.e. the MAC isn't in the pool for than subnet on the server), then it will switch the giaddr in the relay request to the secondary address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not on Cisco, well, this is how DHCP relay is supposed to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You &lt;strong&gt;could&lt;/strong&gt; create a large supernet on the DHCP server that encompasses both ranges and then use static MAC mappings for the hosts you want on the second range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally though, rather than perpetuating bad designs with filthy hacks I would concentrate on removing legacy crap from your network ; )&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-10-14T06:06:18.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23365" PostTypeId="2" ParentId="23360" CreationDate="2015-10-14T08:55:29.463" Score="1" Body="&lt;p&gt;From the remote PC, you ping all your routers but not an external IP, for example 8.8.8.8 (DNS google). Maybe you have forgotten a default route on one of your routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try to traceroute the IP 8.8.8.8 from the remote PC and see where your packet stops. If it stops, you can add a default route like 0.0.0.0 to the next router or gateway. If your packet stops on the gateway, your satellite connection maybe is not up or you have a problem with your satellite provider.&lt;/p&gt;&#xA;" OwnerUserId="19274" LastEditorUserId="17678" LastEditDate="2015-10-14T18:19:57.633" LastActivityDate="2015-10-14T18:19:57.633" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23369" PostTypeId="1" AcceptedAnswerId="38496" CreationDate="2015-10-14T13:02:35.093" Score="6" ViewCount="14954" Body="&lt;p&gt;I want to capture packets using tcpdump and get as precise timestamps as possible. The latest version of tcpdump has the &lt;code&gt;-j adapter&lt;/code&gt; command-line option, which can be used for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested the option inside a virtual machine (which definitely has no hardware timestamps ;-)), but there was no error message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Online research did not yield any keyword or phrase that can be used to check whether some card supports it or not. Typical NIC data sheets don't have anything in them which indicates timestamp precision or general support for such a thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I check whether my actual NIC supports hardware timestamps?&lt;/p&gt;&#xA;" OwnerUserId="10219" LastActivityDate="2020-04-26T13:35:20.833" Title="How to check if a NIC supports hardware timestamps" Tags="|hardware|tcpdump|" AnswerCount="2" CommentCount="1" ClosedDate="2018-04-06T13:45:05.937" ContentLicense="CC BY-SA 3.0" />
  <row Id="23370" PostTypeId="1" AcceptedAnswerId="23371" CreationDate="2015-10-14T13:21:09.570" Score="3" ViewCount="952" Body="&lt;p&gt;Active ASA and standby ASA communicates through failover link. If active ASA detects its interface to switch is down, then it tells the standby ASA and the standby ASA becomes active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does the switch connected to both ASAs know to divert traffic to standby ASA which becomes active after the interface to the original active ASA is down? Any required configuration on the switch?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="8499" LastEditDate="2018-12-22T04:13:39.890" LastActivityDate="2018-12-22T04:13:39.890" Title="How switch divert traffic to standby ASA when link to active ASA is down?" Tags="|cisco|cisco-asa|firewall|cisco-catalyst|failover|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23371" PostTypeId="2" ParentId="23370" CreationDate="2015-10-14T13:59:26.237" Score="3" Body="&lt;p&gt;Switches only forward frames based MAC address.  The secondary ASA takes over the MAC address of the failed ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has an &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/ha_active_standby.html#wp1079435&quot; rel=&quot;nofollow&quot;&gt;explanation of the process&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-14T13:59:26.237" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23372" PostTypeId="1" CreationDate="2015-10-14T15:22:54.413" Score="1" ViewCount="1415" Body="&lt;p&gt;I manage a Cisco ASA Firewall, and I'm receiving since some hours ago a flood of messages about built in/teardown local-host connections from the INTERNET interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if this is a DDoS attack. This happen twices a week and usually the source IPs are everything (Last day it started from 31.0.0.0 until 217.0.0.0). As the log does not show where the traffic goes I think they're flooding the public IP of the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe the question is too abroad but how can I filter this behaviour preventing a possible DDoS attack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aixhS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aixhS.png&quot; alt=&quot;log&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6193" LastEditorUserId="17678" LastEditDate="2015-10-14T18:19:44.883" LastActivityDate="2015-10-14T18:19:44.883" Title="Possibly DDoS? Thousand of Built local-host and Teardown local-host" Tags="|cisco|firewall|" AnswerCount="0" CommentCount="2" ClosedDate="2020-12-16T22:27:33.267" ContentLicense="CC BY-SA 3.0" />
  <row Id="23373" PostTypeId="1" AcceptedAnswerId="23382" CreationDate="2015-10-14T16:00:48.923" Score="5" ViewCount="1637" Body="&lt;p&gt;I have a client that provides an online API service that requires 100% uptime but has been facing connectivity challenges from ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They started out with one ISP (ISP-A), who of course when there was a fiber cut or the ISP had issues, business went down and my Client's APIs were not available. In frustration they got rid of ISP-A and got another ISP (ISP-B) who offered 2 last mile connections i.e. 2 fiber connections from different ISPs. This worked until ISP-B started having problems of their own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I write this, ISP-B is down and we had to get yet another ISP (ISP-C) to provide us with a fixed connection and Static IP addresses and then we had to update the DNS records to reflect the new IPs. We've done this about three times this month and not only are we tired, but the API clients aren't happy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've made some research and it seems that there are two ways to solve this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Retain ISP-B and ISP-C as our two ISPs and subscribe to managed Dynamic DNS service companies who will check for us when ISP-B is down and update our DNS records to point to ISP-C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second option is to get an AS-Number and have it advertised with two or more ISPs. I gather we have to get an AS-Number from Afrinic (business is located in Africa) who run the service on behalf of ARIN and there is an annual subscription fee? I gather we also might be required to buy specialized equipment to support the BGP stuff?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best option to take in this scenario considering complexity, cost and the fact that its a small business without the capacity to hire experienced network architects. When I talk to the ISPs they aren't really providing me with the best solution and seems they have vested sales interests. For example do ISPs charge to carry my AS-Number on their networks or do I only have to pay for bandwidth services. For Dynamic DNS I don't know which package to get as most websites are overly complicated and I am not sure which service I need really.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only requirement is to ensure that the APIs are accessible 24/7 with no downtime attributed to connectivity issues. &lt;/p&gt;&#xA;" OwnerUserId="4111" LastEditorUserId="4111" LastEditDate="2015-10-14T16:13:32.800" LastActivityDate="2015-10-14T20:16:34.267" Title="Choosing between BGP (AS Number) and Dynamic DNS" Tags="|bgp|dns|failover|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23376" PostTypeId="1" CreationDate="2015-10-14T17:41:52.103" Score="1" ViewCount="196" Body="&lt;p&gt;All ONTs on a single GPON eventually share the same fiber core.  It's light, so I anything entering the core travels both ways through PLCs, down to the ONTs and up to the OLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If one would continoulsy send rubbish on either 1310nm or 1490nm, would it mean the whole segment collapses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do understand any system can be broken as long as there is bad intention, but what if one individual - more innocently and common perhaps - accidentally connects a 1310nm media convertor?&lt;/p&gt;&#xA;" OwnerUserId="17455" LastActivityDate="2015-10-14T19:58:11.007" Title="GPON intentional sabotage" Tags="|fiber|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23377" PostTypeId="2" ParentId="23360" CreationDate="2015-10-14T18:06:52.727" Score="2" Body="&lt;p&gt;based on your descriptions i guess you run some thing like that &#xA;&lt;a href=&quot;https://i.stack.imgur.com/A0dZE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/A0dZE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;first of all i you must under stand that Router B has two type of connections , one of them between it and  router A through satellite terminal with range of 172.x.x.x/24 and the another one between it and linksys which provide the internet. the way that make PC in site B access internet is NAT 192.168.200.x/24 range in the linksys router to its 147.25.x.x/24 IP.so you need to NAT 192.168.201.x/24 to this IP as well.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;guiding notes&lt;/em&gt;&lt;/strong&gt;    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- try to ping the 192.168.200.1 from PC in site A&lt;br&gt;&#xA; 2- check the configuration done for 192.168.200.x/24 to access internet through linksys and do it same for 192.168.201.x/24      &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-10-15T07:51:15.547" LastActivityDate="2015-10-15T07:51:15.547" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23380" PostTypeId="2" ParentId="23373" CreationDate="2015-10-14T19:54:08.383" Score="2" Body="&lt;p&gt;when you speak about &lt;code&gt;Dynamic DNS&lt;/code&gt; you actually speak about fail over on the level of services you need to be accessed in your site via internet &lt;code&gt;(published mail server , web server or any other application )&lt;/code&gt;.&lt;br&gt;&#xA;and when you speak about BGP you actually speak about fail over on the level of WAN connectivity &lt;code&gt;(between main site and branches)&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;any way you must get that&lt;/em&gt;&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dynamic DNS is perfect choice for residential customers and small businesses, but the draw back is that , all the time you must have internet access to the company that host your DNS which something like google or amazon. so RUN DDNS will requre using internet from certain ISP B ,C or even A (NO WAY).so you will bay twice , first for DDNS host company and second for ISP to get internet. &lt;/li&gt;&#xA;&lt;li&gt;also run BGP as a dynamic routing protocol between your ISPs is perfect to optimize your WAN connection and make use of the best available connection ,but the draw back as you said you don't have equipment that support BGP so you need to bay such devices.&lt;/li&gt;&#xA;&lt;li&gt;you need also consider that which is best ,access your resources via internet or via WAN based on connection quality and security &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;so for me running dynamic routing protocol over two ISPs is better than use DDNS , because the only thing you will bay is  equipment able to run BGP but it will be once and for all instead of monthly fees for internet and DDNS hosting.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and also &lt;code&gt;WAN&lt;/code&gt; connection is more secured and link speed and quality will be better than &lt;code&gt;internet&lt;/code&gt; &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-14T19:54:08.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23381" PostTypeId="2" ParentId="23376" CreationDate="2015-10-14T19:58:11.007" Score="1" Body="&lt;p&gt;The fiber is split in the downstream (OLT to ONT) and combined in the upstream. Only the OLT will see what any end transmits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could, in theory, jam the upstream since that's the only signal you generate. High enough power could damage equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind, the operator can rather trivially tell who does this. And it would be highly illegal almost everywhere.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-14T19:58:11.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23382" PostTypeId="2" ParentId="23373" CreationDate="2015-10-14T20:16:34.267" Score="5" Body="&lt;p&gt;&lt;strong&gt;DynDNS&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using DynDNS is not a viable solution for your usecase since its primary use case is mapping a dynamic ip address to a dns record. If you have two Upstreams with different ip subnets you would need to edit ip address or nat confiuration on failure which could be scripted but is prone to error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;GSLB&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way of using DNS would be GSLB, which utilizes DNS to load balance and use a keep alive method to check for availability. Since DNS is bound to TTL you will always encounter a certain downtime since clients will cache the ip address to fqdn mapping and it will need to time out so it might be the wrong solution for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BGP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using BGP to solve the problem would be the optimal solution. You would have an AS and your own ip address range which you advertise to both providers. If you encounter issues with one provider the peering between your local router and your isp would time out and traffic will automagically be routed to your other provider (I will not get to technical, there is still more to it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering Complexity... BGP is not complex to set-up in this scenario. You would still need an experienced network engineer to ensure best-practice configuration but your scenario does not require much BGP knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering Cost... Annual costs for AFRINIC &amp;amp; additional costs of ISP peering with you. You would need router(s) to be BGP capable but nowadays there are even small HP/Cisco/YouNameIt routers that are capable of BGP...heck even Sophos UTM is BGP capable. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope I could help... I tried to be generic and not go too much into the details, drop me a note if you need to know more.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-14T20:16:34.267" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="23383" PostTypeId="2" ParentId="22465" CreationDate="2015-10-14T20:34:11.293" Score="0" Body="&lt;p&gt;@NickG - The solutions can be varied but as Ron Trunk and Bobstro mentionned, a secured vpn will work.&#xA;See this cisco centric link below for setting up a vpn.&#xA;Note:- You could do it with harware from many other providers, even build your linux router to perform the same level of security/encryption :-)&#xA;&lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/867-cisco-router-site-to-site-ipsec-vpn.html&quot; rel=&quot;nofollow&quot;&gt;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/867-cisco-router-site-to-site-ipsec-vpn.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2015-10-14T20:34:11.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23385" PostTypeId="1" CreationDate="2015-10-14T21:05:56.737" Score="1" ViewCount="382" Body="&lt;p&gt;Convergence is not a unique process from one determinate protocol, a common characteristic is that process occur as result of change in topology. Once time  I found a better definition but I lost it :\ &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, Can I say that Convergence is the time it takes to run the algorithm for accomplishing a task? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: accomplishing a task .. when occur a change in topology&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="14008" LastEditDate="2015-10-14T21:18:11.120" LastActivityDate="2015-10-14T21:27:45.750" Title="Convergence Time" Tags="|internet|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23386" PostTypeId="2" ParentId="23385" CreationDate="2015-10-14T21:22:25.853" Score="2" Body="&lt;p&gt;Your definition might be somewhat too generic in the networking space. &quot;Accomplishing a task&quot; would have to be adapted based on the scenario&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Linux Information Project provides a clear definition for convergence.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Convergence occurs as a result of a change in network topology, i.e.,&#xA;  a link becoming available or unavailable. When this occurs, each&#xA;  router independently runs a routing algorithm to recalculate metrics&#xA;  and build a new routing table based on this information. Once all the&#xA;  routing tables have been updated, convergence is complete.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-14T21:22:25.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23387" PostTypeId="2" ParentId="23385" CreationDate="2015-10-14T21:22:39.363" Score="1" Body="&lt;p&gt;In routing, convergence is the act of the routers updating their routing tables to reflect a topology change, and it is done when all the routing tables have been updated.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-14T21:22:39.363" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23388" PostTypeId="2" ParentId="23385" CreationDate="2015-10-14T21:27:45.750" Score="2" Body="&lt;p&gt;most of the time convergence is describe &lt;code&gt;turning from certain state to another state  through multiple states&lt;/code&gt; like routing or even like spanning tree .&#xA;if we have 4 states like spanning tree &lt;code&gt;blocking&lt;/code&gt;-&gt;&lt;code&gt;lessening&lt;/code&gt;-&gt;&lt;code&gt;learning&lt;/code&gt;-&gt;&lt;code&gt;forwarding&lt;/code&gt;  so turning from blocking to forwarding that what is called full convergence but if the process interrupted in any certain state that can't be called convergence and the whole of the process will rebuild after certain time  &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-14T21:27:45.750" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23390" PostTypeId="1" AcceptedAnswerId="23394" CreationDate="2015-10-14T22:30:26.023" Score="1" ViewCount="7357" Body="&lt;p&gt;I'm using a Fortinet 311B firewall and having an issue understanding why this traffic is being blocked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an access rule and matching NAT statement for an external IP address pointing to an internal web server.  External users (via the Internet) can access this website with no problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internal users are using internal DNS, which resolves the same hostname to a private IP address, providing direct access to the website, and this works normally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireless users, connected via FortiAP and coming into the Fortinet on a separate &quot;wireless&quot; interface, have a completely separate subnet and are not allowed any LAN access; Internet only.  When they attempt to connect to the website host address, it fails.  Since they are Internet only, they are using external DNS and resolving the outside IP address.  This outside IP address of the web server is a virtual IP on the Fortinet attached to the External interface, with a 1-to-1 NAT to the internal web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried creating ACL entries to allow traffic from the wireless interface to the External interface, and even a &quot;NAT 0&quot; rule for this traffic, but I'm wondering if there is some other security feature at work here, as I know firewalls don't necessarily like this sort of &quot;hairpin&quot; traffic.  I've checked the logs and I'm not seeing any of my interesting traffic show up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any ideas?&lt;/p&gt;&#xA;" OwnerUserId="17551" LastActivityDate="2015-10-15T02:30:17.087" Title="Firewall preventing access to internal resource using external NAT address when traffic comes in from a third interface" Tags="|nat|firewall|acl|fortinet|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="23391" PostTypeId="2" ParentId="17604" CreationDate="2015-10-15T02:05:24.790" Score="2" Body="&lt;p&gt;Junos can't have multiple loopback interfaces in the same routing-instance, so you'll need to enable snmp in routing-instances first:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set snmp routing-instance-access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously you'll also need a route inside your routing-instance that will get return traffic back to your SNMP poller.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-10-15T02:05:24.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23393" PostTypeId="1" CreationDate="2015-10-15T02:24:36.737" Score="1" ViewCount="874" Body="&lt;p&gt;I have been playing with network stuff so I installed &lt;code&gt;GNS3&lt;/code&gt; network simulator. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have deployed &lt;code&gt;ASA 8.4&lt;/code&gt; image and it has loaded fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I connected it with basic &lt;code&gt;Switch&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;switch&lt;/code&gt;-----&lt;code&gt;ASA&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured IP address on an interface and executed &lt;code&gt;no shut&lt;/code&gt;. I then tried to ping itself but ping did not work :(  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have restart GNS3 also but didn't work :( &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0&#xA; no nameif&#xA; no security-level&#xA; ip address 192.168.56.2 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Trying to ping itself&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fw01# ping 192.168.56.2&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.168.56.2, timeout is 2 seconds:&#xA;No route to host 192.168.56.2&#xA;&#xA;Success rate is 0 percent (0/1)&#xA;fw01#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19759" LastEditorUserId="509" LastEditDate="2015-12-14T21:03:50.990" LastActivityDate="2015-12-29T18:48:36.360" Title="GNS3 ASA not pinging itself" Tags="|cisco|cisco-asa|gns3|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23394" PostTypeId="2" ParentId="23390" CreationDate="2015-10-15T02:30:17.087" Score="1" Body="&lt;p&gt;This is a pretty common problem on a lot of stateful firewalls (SRXs and ScreenOS will do this as well).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is that traffic from your wireless interface/zone will be routed out the Internet Zone/Interface, but not &lt;em&gt;to&lt;/em&gt; the NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the SRX at least, you need to configure the NAT so that it is available on the wireless interface (as if it was another Internet-facing interface) and then the inbound traffic from your wireless interface will be destination NATted before the routing decision is made and then routed to the &quot;LAN&quot; interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would be very surprised if Fortinet didn't require something similar.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-10-15T02:30:17.087" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23398" PostTypeId="1" CreationDate="2015-10-15T06:29:28.173" Score="2" ViewCount="2410" Body="&lt;p&gt;Sometimes I receive some odd, or inconsistent port scan results. Consider the two following excerpts, copied from my command shell:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@host:~$ nmap 10.1.1.0/24&#xA;&#xA;Starting Nmap 6.47 ( http://nmap.org ) at 2015-10-15 13:47 AWST&#xA;Nmap scan report for (10.1.1.1)&#xA;Host is up (0.0073s latency).&#xA;Not shown: 979 closed ports&#xA;PORT      STATE    SERVICE&#xA;21/tcp    open     ftp&#xA;22/tcp    open     ssh&#xA;23/tcp    open     telnet&#xA;80/tcp    open     http&#xA;139/tcp   open     netbios-ssn&#xA;445/tcp   open     microsoft-ds&#xA;500/tcp   filtered isakmp&#xA;720/tcp   filtered unknown&#xA;1097/tcp  filtered sunclustermgr&#xA;1218/tcp  filtered aeroflight-ads&#xA;2191/tcp  filtered tvbus&#xA;3000/tcp  filtered ppp&#xA;3013/tcp  filtered gilatskysurfer&#xA;3283/tcp  filtered netassistant&#xA;5001/tcp  filtered commplex-link&#xA;5431/tcp  open     park-agent&#xA;7741/tcp  filtered scriptview&#xA;8000/tcp  open     http-alt&#xA;8008/tcp  filtered http&#xA;49176/tcp filtered unknown&#xA;55555/tcp filtered unknown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Less than ten minutes after the first scan started:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@host:~$ nmap 10.1.1.0/24&#xA;&#xA;Starting Nmap 6.47 ( http://nmap.org ) at 2015-10-15 13:56 AWST&#xA;Nmap scan report for (10.1.1.1)&#xA;Host is up (0.0081s latency).&#xA;Not shown: 992 closed ports&#xA;PORT     STATE SERVICE&#xA;21/tcp   open  ftp&#xA;22/tcp   open  ssh&#xA;23/tcp   open  telnet&#xA;80/tcp   open  http&#xA;139/tcp  open  netbios-ssn&#xA;445/tcp  open  microsoft-ds&#xA;5431/tcp open  park-agent&#xA;8000/tcp open  http-alt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I haven't done anything in between scans and don't understand what would cause the results to differ. Most of these extra services are unknown to me, so I can only speculate that these results are being shown in error; raising more questions. This is a frequent occurrence. What is likely to be the cause of this?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="17196" LastEditorUserId="509" LastEditDate="2015-12-06T11:09:54.363" LastActivityDate="2016-02-12T17:16:05.393" Title="Strange Nmap Scan Results" Tags="|router|security|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23399" PostTypeId="2" ParentId="23398" CreationDate="2015-10-15T06:59:05.643" Score="0" Body="&lt;p&gt;Any TCP/IP connection you make uses two ports. You use the &quot;well-known&quot; port number to initiate the connection with the server and a fairly randomly selected port for the return path. Any port could legitimately be used occasionally for that purpose. You can run netstat with the -p parameter to discover what program is listening on a given port.&#xA;The command:&#xA;netstat -p -a | grep 55555&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where 55555 is the port in question.&#xA;This will give you an idea if the port is being used properly or by a trojan etc.&lt;/p&gt;&#xA;" OwnerUserId="19764" LastActivityDate="2015-10-15T06:59:05.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23400" PostTypeId="2" ParentId="23398" CreationDate="2015-10-15T07:12:29.573" Score="4" Body="&lt;p&gt;The main difference between the two scans is the absence of the &lt;em&gt;filtered&lt;/em&gt; ports in the second scan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;filtered&lt;/em&gt; in nmap terms means something like &quot;i don't know for sure&quot; so the second scan might be a bit more accurate, as nmap claims the ports in question are closed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possible reasons for the different results are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;timing - you might try to slow down nmap (timing --scan-delay=2s or -T3) and see if that makes the results more stable&lt;/li&gt;&#xA;&lt;li&gt;Firewall with rate-limits - maybe there is a firewall / packtefilter in the path that changes block behaviour after some packets (DROP instead of sending icmp-port-unreachables or tcp-fin) so that the result of the portscan differs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But don't spend too much time on that topic unless you want to educate yourself on that. For day to day use you can assume that the filtered ports are closed and think of the two results as equal.&lt;/p&gt;&#xA;" OwnerUserId="19765" LastActivityDate="2015-10-15T07:12:29.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23401" PostTypeId="2" ParentId="23369" CreationDate="2015-10-15T07:40:16.417" Score="1" Body="&lt;p&gt;I found this simple C program that can be used to capture using different timestamping options for Linux sockets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.kernel.org/doc/Documentation/networking/timestamping/timestamping.c&quot; rel=&quot;nofollow&quot;&gt;https://www.kernel.org/doc/Documentation/networking/timestamping/timestamping.c&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Invoking it with &lt;code&gt;interface SOF_TIMESTAMPING_RX_HARDWARE&lt;/code&gt; gives a output like &lt;code&gt;SIOCSHWTSTAMP: Operation not supported&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I apparently don't have hardware available that is capable of hardware timestamps so I don't know for sure whether the test also succeeds for NICs that are hardstamp-capable.&lt;/p&gt;&#xA;" OwnerUserId="10219" LastActivityDate="2015-10-15T07:40:16.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23402" PostTypeId="1" AcceptedAnswerId="23589" CreationDate="2015-10-15T08:09:34.653" Score="5" ViewCount="19041" Body="&lt;p&gt;I am currently diving into topics like PTP (IEEE 1588) and precise timestamping for capturing network traffic. Many resources on the Internet name &lt;strong&gt;hardstamps&lt;/strong&gt; as a feature of network cards, allowing them to add a timestamp to a packet before putting it into a (typically non-deterministic) queue towards the application layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are these timestamps like? Are they measured relative to a start signal sent by the OS or absolute timestamps? Are the absolute stamps synchronized to the OS clock or to a clock managed by the NIC?&lt;/p&gt;&#xA;" OwnerUserId="10219" LastActivityDate="2015-10-22T09:39:11.117" Title="How do hardware timestamps (hardstamps) work" Tags="|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23403" PostTypeId="1" CreationDate="2015-10-15T08:13:43.597" Score="3" ViewCount="2343" Body="&lt;p&gt;In regular request/response between client and server, first a client initiates a request to server, then server responses.&#xA;Assume that the server always knows the IP address of its clients (note that clients have dynamic IP address). Is it possible for server to initiate the request first? By &quot;initiate the request first&quot; I mean server must be able to send data to clients whenever wants.&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="19768" LastActivityDate="2017-03-10T11:02:40.467" Title="Send data to client without request" Tags="|ip|" AnswerCount="3" CommentCount="3" ClosedDate="2017-08-12T19:58:28.327" ContentLicense="CC BY-SA 3.0" />
  <row Id="23404" PostTypeId="2" ParentId="23403" CreationDate="2015-10-15T09:55:19.743" Score="0" Body="&lt;p&gt;As Gerben mentioned in comment, in IP protocol there is no server or client. If you know IP and port of the client, then you can send data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the client has to listen on some port, because otherwise the system doesn't know to which application are the data meant and it will just discard them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the answer to your question whether it is possible for server to initiate data transmission is yes and no. Yes it is possible, but your client has to listen on some port first, so you need the client running before you send data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: this is assuming your clients have public IPs or are on the same network as server. If they use NAT, then it would be more complicated.&lt;/p&gt;&#xA;" OwnerUserId="19676" LastEditorUserId="19676" LastEditDate="2015-10-15T10:00:27.133" LastActivityDate="2015-10-15T10:00:27.133" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23406" PostTypeId="2" ParentId="16454" CreationDate="2015-10-15T13:16:03.930" Score="28" Body="&lt;p&gt;The answer by YLearn is correct but it is important to know more details.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;*&lt;/code&gt; means that your machine received no response.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;!H&lt;/code&gt; means that your machine received ICMP message &quot;destination host unreachable&quot; from the host indicated in the &lt;code&gt;traceroute&lt;/code&gt; output. &lt;/li&gt;&#xA;&lt;li&gt;Rarely &lt;code&gt;traceroute&lt;/code&gt; can indicate also other unreachable messages like &lt;code&gt;!N&lt;/code&gt; or &lt;code&gt;!P&lt;/code&gt; (network or protocol) etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A machine normally sends &quot;destination host unreachable&quot; when it cannot send the IP packet to the network. This could happen when:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is no route to the destination.&lt;/li&gt;&#xA;&lt;li&gt;The next hop IP address or the final IP address cannot be resolved to an L2 address (there is no ARP reply for the IP address).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As YLearn wrote, routers can be configured to not to send the ICMP message but you can also get &lt;code&gt;*&lt;/code&gt; instead of &lt;code&gt;!H&lt;/code&gt; when your request was silently dropped by an ACL or firewall policy. In security policies silent drop is a normal practice. The drop caused by a security policy depends on the type of the message sent by &lt;code&gt;traceroute&lt;/code&gt;. Traditional Unix &lt;code&gt;traceroute&lt;/code&gt; by default sends UDP packets to &quot;unusual&quot; ports like 33434 but it can use other methods too. Windows &lt;code&gt;tracert&lt;/code&gt; sends ICMP echo request.&lt;/p&gt;&#xA;" OwnerUserId="2162" LastActivityDate="2015-10-15T13:16:03.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23409" PostTypeId="1" CreationDate="2015-10-15T14:24:59.583" Score="2" ViewCount="453" Body="&lt;p&gt;My question is, if I have a Cisco switch with a particular port kept in default VLAN 1 and the native VLAN of the trunk port is changed to 2. When a frame arrives at the trunk port from that port it will be an untagged frame, right? If yes, then the trunk port will tag this untagged frame with its own native VLAN (VLAN 2) before sending it over to other end of trunk, right?&lt;/p&gt;&#xA;" OwnerUserId="14759" LastEditorUserId="8499" LastEditDate="2018-12-22T04:14:28.990" LastActivityDate="2018-12-22T04:14:28.990" Title="Confusion over VLAN tagging" Tags="|cisco|switch|vlan|trunk|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23410" PostTypeId="2" ParentId="23409" CreationDate="2015-10-15T14:38:16.483" Score="1" Body="&lt;p&gt;VLAN tags are placed on frames leaving a trunk port except for frames in the native VLAN for that port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access ports, despite being a port for a particular VLAN, do not tag frames, and, depending on the switch, a received tagged frame may be dropped on an access port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A frame coming into an access port will not have a tag.  It will be tagged as it leaves the switch on a trunk port (assuming it is not in the native VLAN for that port), but it will not be tagged if it leaves the switch on another access port.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-15T14:38:16.483" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23411" PostTypeId="1" CreationDate="2015-10-15T15:03:25.203" Score="0" ViewCount="975" Body="&lt;p&gt;I am trying to do some automated browsing but with identity-hiding/proxy servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One can find some public lists with http proxy servers up and running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to instantiate a selenium web driver instance via a http proxy server. I have been unsuccessful so far, so I want to make sure these proxy servers I am getting from public lists (such as &lt;a href=&quot;http://proxylist.hidemyass.com/search-1311573#listable&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;) are indeed working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I do that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ping them and do not get a response (get timeouts).&#xA;However, for some of them initiating a request in my browser for its ip it returns something (for instance, a Windows Server IIS page). &#xA;Others return connection_reset error/time out.&lt;/p&gt;&#xA;" OwnerUserId="19774" LastEditorUserId="8499" LastEditDate="2018-02-16T04:10:43.683" LastActivityDate="2018-02-16T04:10:43.683" Title="How do I validate Http Proxy Servers from public proxy lists?" Tags="|network|" AnswerCount="2" CommentCount="0" ClosedDate="2015-10-16T21:08:41.570" ContentLicense="CC BY-SA 3.0" />
  <row Id="23412" PostTypeId="2" ParentId="23411" CreationDate="2015-10-15T15:09:27.023" Score="2" Body="&lt;p&gt;Ping uses ICMP which many sites block. Browsing uses HTTP/HTTPS running on TCP.  Using one protocol to see if another protocol is running doesn't work.  Many things respond to an ICMP ping, but they are not running web servers so you can't browse to them.  The reverse is also true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to determine if HTTP/HTTPS is running on a host, you need to test with HTTP/HTTPS.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-15T15:09:27.023" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23413" PostTypeId="2" ParentId="23411" CreationDate="2015-10-15T15:48:06.820" Score="2" Body="&lt;p&gt;As Ron already pointed out you would need to verify the proxy server via http(s) and not ICMP. Going beyond just a simple port probe (is server XY listening on tcp port 8080?) would be the best solution. You should use a script to check if the server can be used as proxy and the response times are fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example (normally used for monitoring purposes):&#xA;&lt;a href=&quot;https://exchange.nagios.org/directory/Plugins/Network-Protocols/HTTP/check_http_proxy/details&quot; rel=&quot;nofollow&quot;&gt;https://exchange.nagios.org/directory/Plugins/Network-Protocols/HTTP/check_http_proxy/details&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-15T15:48:06.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23414" PostTypeId="2" ParentId="23393" CreationDate="2015-10-15T16:11:24.523" Score="2" Body="&lt;p&gt;You need to set the interface name otherwise the interface will remain unreachable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gi0&#xA; nameif inside&#xA; ip address 10.0.0.1 255.255.255.0&#xA; no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To verify your interface status&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show int ip brief&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-10-15T16:11:24.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23421" PostTypeId="1" AcceptedAnswerId="23450" CreationDate="2015-10-15T17:48:22.410" Score="2" ViewCount="6099" Body="&lt;p&gt;I'm faced with with an odd issues I can not explain. After having setup the Squid Reverse Proxy in pfSense, 1 of the 2 mappings I've setup keeps alternating between destinations, while the other mapping consistently goes to the correct destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8neA7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8neA7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both mappings are identical (as far as I can tell)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kJWQt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kJWQt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/a2zeg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/a2zeg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot explain why &lt;a href=&quot;http://skami.steuff.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://skami.steuff.net&lt;/a&gt; keeps alternating between the two different webservers. There is no load balancing involved. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the bonus confusion whenever I do a cache refresh the page it seems to stay on the same webserver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://test.steuff.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://test.steuff.net/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://skami.steuff.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://skami.steuff.net/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19781" LastEditorDisplayName="user36472" LastEditDate="2018-02-16T16:56:58.677" LastActivityDate="2018-02-16T16:56:58.677" Title="Squid Reverse Proxy alternating between destinations" Tags="|pfsense|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23425" PostTypeId="2" ParentId="23318" CreationDate="2015-10-15T20:29:05.817" Score="0" Body="&lt;p&gt;here's a little suitable example for setting up a local reverse zone, is simple in the file &quot;&lt;strong&gt;&lt;em&gt;db.127&lt;/em&gt;&lt;/strong&gt;&quot; we have the definition of reverse zone, and then in the following section we have the setting for the zone 127 for the file &quot;named. conf &quot;along with other areas.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;&lt;strong&gt;db.127&lt;/strong&gt;  - File Reverse Addres&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;;&#xA;; BIND reverse data file for local loopback interface&#xA;;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$TTL    604800&#xA;&#xA;@           IN      SOA     localhost. root.localhost. (&#xA;            1    ; Serial&#xA;       604800    ; Refresh&#xA;        86400    ; Retry&#xA;      2419200    ; Expire&#xA;       604800 )  ; Negative Cache TTL&#xA;&#xA;@           IN  NS      localhost.&#xA;1.0.0       IN  PTR     localhost.&#xA;1           IN  PTR     localhost.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;=========================================================================&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;- The defination of the reverse address on the &lt;strong&gt;named.conf&lt;/strong&gt; file.&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&#xA;zone        &quot;127.in-addr.arpa&quot;&#xA;{&#xA;                  type master;&#xA;                file &quot;db.127&quot;;&#xA;};&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So simple that way ...&lt;/p&gt;&#xA;" OwnerUserId="19786" LastActivityDate="2015-10-15T20:29:05.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23426" PostTypeId="1" AcceptedAnswerId="23427" CreationDate="2015-10-15T21:35:48.043" Score="5" ViewCount="2264" Body="&lt;p&gt;Some reason I'm drawing a blank on this. Let's say I have two EX switches connected together with 2 links to each other (xe-0/1/0 and xe-0/1/1 on both switches).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can easily setup a trunk on one of those links using a simple configuration like the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test@SW1# show interfaces xe-0/1/0                                 &#xA;unit 0 {&#xA;description &quot;Trunk to SW2 to port xe-0/1/0&quot;;&#xA;family ethernet-switching {&#xA;    port-mode trunk;&#xA;    vlan {&#xA;        members [ vlan-10 vlan-20 ];&#xA;    }&#xA;    native-vlan-id 1;&#xA;}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now my question is how would I make the second link be a backup for this trunk? Would I configure port xe-0/1/1 the same as above and let STP block it? What's the proper procedure for this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I can tell there are 3 options (redundant trunk group, link aggregation, two links using STP) I'm just having an issue telling if I need to configure both ports identically or if there is something else I should do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="4186" LastEditorUserId="8499" LastEditDate="2018-03-18T20:09:14.053" LastActivityDate="2018-03-18T20:09:14.053" Title="Juniper trunking with two links (not using LAG)" Tags="|juniper|spanning-tree|trunk|ieee-802.1ax|juniper-ex|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23427" PostTypeId="2" ParentId="23426" CreationDate="2015-10-15T21:46:44.167" Score="3" Body="&lt;p&gt;One thing to keep in mind with trunk redundancy is that STP fails over slowly, even with Rapid STP.  If you set up the two links as an aggregated channel, the link failover is much faster.  STP failover is the slowest, routing protocol failover is an order of magnitude faster, and the aggregation channel failover is another order of magnitude faster still.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-15T21:46:44.167" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23432" PostTypeId="2" ParentId="22627" CreationDate="2015-10-16T09:26:28.153" Score="2" Body="&lt;p&gt;A normal (layer 2) switch sends frames from one port (in) to another port (out) based on the destination MAC address in the frame. It wil search its MAC table &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if the destination MAC address is in there and when found, it will&#xA;use the documented port for this MAC. &lt;/li&gt;&#xA;&lt;li&gt;If it isn't found, it will flood all ports with this frame instead.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="623" LastActivityDate="2015-10-16T09:26:28.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23435" PostTypeId="1" CreationDate="2015-10-16T12:27:35.030" Score="1" ViewCount="92" Body="&lt;p&gt;How to connect remotely from home to office? &#xA;What other option do we have instead of using VPN?&#xA;please give me some hints.&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="19804" LastActivityDate="2015-10-16T13:59:37.537" Title="REMOTE ACCESS FROM HOME TO OFFICE" Tags="|vpn|" AnswerCount="1" CommentCount="3" ClosedDate="2015-10-22T08:04:07.280" ContentLicense="CC BY-SA 3.0" />
  <row Id="23436" PostTypeId="1" CreationDate="2015-10-16T12:40:00.243" Score="4" ViewCount="209" Body="&lt;p&gt;I have a Cisco PIX-515, version 6.3(4). I need to add a rule allowing the delivery of email from a series of IP addresses (e.g. XX.XXX.XXX.0/20). Is there a way to put such a rule into the PIX without individually entering each IP address?&lt;/p&gt;&#xA;" OwnerUserId="16819" LastEditorUserId="8499" LastEditDate="2015-10-16T14:34:11.147" LastActivityDate="2018-12-01T02:02:20.467" Title="Adding CIDR rules to PIX" Tags="|pix|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23437" PostTypeId="2" ParentId="23409" CreationDate="2015-10-16T13:28:40.770" Score="1" Body="&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The native VLAN on a trunk means that:&lt;br&gt;&#xA;A) Any untagged frame arriving on the trunk will be treated as being in the native VLAN (regardless of what VLAN it was in on the sending switch).&lt;br&gt;&#xA;B) Frames on the native VLAN will cross the trunk untagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example a frame arriving on the default VLAN (VLAN 1) will be forwarded out the trunk port on VLAN 1. Since VLAN 2 is the native VLAN that means the frame on VLAN 1 will be tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way a layer-2 switch will ever move a frame from one VLAN to another is if something is misconfigured. You could misconfigure it intentionally but in my opinion it would still be wrong.&lt;/p&gt;&#xA;" OwnerUserId="165" LastActivityDate="2015-10-16T13:28:40.770" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23438" PostTypeId="1" AcceptedAnswerId="23443" CreationDate="2015-10-16T13:39:21.553" Score="1" ViewCount="40" Body="&lt;p&gt;I made a simple multi client chat application in Java (with the help of a book named HEAD FIRST JAVA). The application is working fine on localhost i.e when both client and server are run on same host and also working fine when I run server on one host and clients on other hosts in the same network. But the problem is I am not able to communicate with a friend of mine who is in some other network by using this application. Can anyone explain why ?&lt;/p&gt;&#xA;" OwnerUserId="17451" LastActivityDate="2015-10-16T21:06:40.607" Title="Query regarding chat application" Tags="|internet|lan|wan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23439" PostTypeId="2" ParentId="23435" CreationDate="2015-10-16T13:59:37.537" Score="1" Body="&lt;p&gt;If you want plain transparent network integration, VPN is indeed the way to go.  If you're happy with just taking over the screen of your office computer, there are other options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If you have access to your office's router and are allowed to do some portforwarding, you can look at installing a VNC server to your work desktop.  VNC servers are available for any flavour of OS.  Some implementations are commercial (&lt;a href=&quot;http://www.tightvnc.com/&quot; rel=&quot;nofollow&quot;&gt;RealVNC&lt;/a&gt;) but there are also Open Source and therefore version free to use (&lt;a href=&quot;http://www.tightvnc.com/&quot; rel=&quot;nofollow&quot;&gt;TightVNC&lt;/a&gt;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If your computer happens to be a Mac, there's &lt;a href=&quot;http://www.apple.com/remotedesktop/&quot; rel=&quot;nofollow&quot;&gt;Apple Remote Desktop&lt;/a&gt; which uses similar VNC technology, but more secure.  The server version is not free though - about $80.  Needs portforwarding also.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Another option that doesn't require router portforwarding is &lt;a href=&quot;http://www.teamviewer.com&quot; rel=&quot;nofollow&quot;&gt;Teamviewer&lt;/a&gt;, available for PC, mac and some linux flavours.  You can use the free version as long as you don't make money out of it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you're using Chrome as your desktop browser, there is CRD - &lt;a href=&quot;https://chrome.google.com/webstore/detail/chrome-remote-desktop/gbchcmhmhahfdphkhkmpfmihenigjmpp?hl=en&quot; rel=&quot;nofollow&quot;&gt;Chrome Remote Desktop&lt;/a&gt;.  Free and no need for portforwarding.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17455" LastActivityDate="2015-10-16T13:59:37.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23440" PostTypeId="2" ParentId="23426" CreationDate="2015-10-16T14:09:28.327" Score="3" Body="&lt;p&gt;RSTP - configure both links the same. Ensure that RSTP is enabled on both sides of the link via 'set protocols rstp interface xe-blah' or just ensure 'set protocol rstp interface all' is configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RTG - Must explicitly disable RSTP. RTG and RSTP are mutually exclusive. Once RSTP is disabled configure both links the same but also provide the RTG group configuration under ethernet-switching options - (&lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos13.2/topics/example/cfm-ex-series-redundant-trunk-groups.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/documentation/en_US/junos13.2/topics/example/cfm-ex-series-redundant-trunk-groups.html&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link aggregation - Create aggregated ethernet interface, the trunk configuration goes under the aggregated ethernet interface while the physical members will just be configured to be members of the AgEth bundle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set chassis aggregated-device ethernet device-count 1&#xA;!&#xA;test@SW1# show interfaces ae0                               &#xA;unit 0 {&#xA;description &quot;Trunk to SW2:ae0&quot;;&#xA;aggregated-ether-options {&#xA;lacp {&#xA;active;&#xA;}&#xA;}&#xA;family ethernet-switching {&#xA;    port-mode trunk;&#xA;    vlan {&#xA;        members [ vlan-10 vlan-20 ];&#xA;    }&#xA;    native-vlan-id 1;&#xA;}&#xA;}&#xA;&#xA;set interfaces xe-0/1/0 gigether-options 802.3ad ae0&#xA;set interfaces xe-0/1/1 gigether-options 802.3ad ae0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Link aggregation would be preferred as RSTP and RTG are an active/standby configuration by default. Whereas with link aggregation you could make use of both paths and have automatic failover with no STP like delay should a link fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2015-10-16T14:09:28.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23441" PostTypeId="2" ParentId="23198" CreationDate="2015-10-16T14:10:30.913" Score="1" Body="&lt;p&gt;You need to get this information from Cisco.  Cisco maintains programming guides for this tool at:  &lt;a href=&quot;http://www.cisco.com/c/en/us/support/cloud-systems-management/prime-data-center-network-manager/products-programming-reference-guides-list.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/cloud-systems-management/prime-data-center-network-manager/products-programming-reference-guides-list.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-16T14:10:30.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23442" PostTypeId="2" ParentId="23409" CreationDate="2015-10-16T14:12:00.727" Score="1" Body="&lt;p&gt;The switch receives it and since there is no tagging will threat it as if it was on VLAN 2 (in your example). So if it receives a broadcast on this port, it will forward it out of all ports configured with VLAN 2 (still untagged doh).&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2015-10-16T14:12:00.727" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23443" PostTypeId="2" ParentId="23438" CreationDate="2015-10-16T14:46:26.723" Score="0" Body="&lt;p&gt;You already mentioned the problem: your friend is not in the same network as you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess your application asks for the server's IP address on startup and then tries to connect to it. This is a valid approach and generally a good idea, as long as everything stays in the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm guessing your friend is using a server IP address you provided him, that you looked up using some service like &lt;a href=&quot;https://www.whatismyip.com/&quot; rel=&quot;nofollow&quot;&gt;whatismyip.com&lt;/a&gt;. And that's the main problem here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming both of you are using a &quot;normal&quot; Internet connection for personal use, that IP you gave him is the one of your router. The router, however, does not know what to do with the chat client's request to connect to the server coming from your friend's computer. So it just drops the request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The magic keyword in this case is &quot;port forwarding&quot; depending on the device, there should be a setting similar to this in your router's configuration screen. It allows you to forward all traffic arriving at a certain port to some host of your choice (which is, in your case, the server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Be careful with these settings, as they allow access from the Internet to your local network!&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, you will have to make the chat client try to connect on the port you configured your router to listen on. If it doesn't have an option for that yet, you will have to implement it and send your friend the updated application.&lt;/p&gt;&#xA;" OwnerUserId="19544" LastEditorUserId="17452" LastEditDate="2015-10-16T21:06:40.607" LastActivityDate="2015-10-16T21:06:40.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23447" PostTypeId="1" AcceptedAnswerId="23451" CreationDate="2015-10-16T15:58:49.447" Score="3" ViewCount="1031" Body="&lt;p&gt;I use a &lt;strong&gt;Netgear 48-port switch GS748T&lt;/strong&gt;. I'm trying since yesterday to configure VLANs. So I added different vlans associated with their ID knowing the VLANs type is &lt;strong&gt;port-based&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EFV6p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EFV6p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After associating ports such as VLANs and saved my configuration, when I go to the page that allows me to view the MAC address table, I notice that all ports are always associated to the &lt;code&gt;VLAN 1&lt;/code&gt; (default), as you can see in the picture below, while some should be associated with vlan 2, in this example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gOL0C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gOL0C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to solve this problem and allow these ports to be associated to the VLAN n°2?&lt;/p&gt;&#xA;" OwnerUserId="19787" LastActivityDate="2016-10-14T19:16:41.470" Title="Netgear GS748Tv3 associate ports to vlans" Tags="|switch|vlan|netgear-prosafe|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="23450" PostTypeId="2" ParentId="23421" CreationDate="2015-10-16T17:00:54.003" Score="1" Body="&lt;p&gt;There seems to be several bugs when using squid with pfsense 2.2. I believe the answer is somewhere around the topic in this thread. I have the same problem after ugrading pfsense to 2.2 from 2.1.1. &lt;a href=&quot;https://forum.pfsense.org/index.php?topic=87280.15&quot; rel=&quot;nofollow&quot;&gt;https://forum.pfsense.org/index.php?topic=87280.15&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 7 servers behind my pfsense and it's working with three of them activated, but when i activate the 4th, i get the same error as you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately i have not been able to work this out so i'll be happy for a solution. (I am thinking about downgrading my pfsense to 2.1.1)&lt;/p&gt;&#xA;" OwnerUserId="19813" LastActivityDate="2015-10-16T17:00:54.003" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23451" PostTypeId="2" ParentId="23447" CreationDate="2015-10-16T18:08:47.843" Score="2" Body="&lt;p&gt;First, you might be experiencing a bug which doesn't show the proper VLANs port membership, so check this out and see if a different browser helps: &lt;a href=&quot;http://kb.netgear.com/app/answers/detail/a_id/23841/~/the-vlan-and-lag-configuration-screens-do-not-display-correctly-on-my-switch&quot; rel=&quot;nofollow&quot;&gt;http://kb.netgear.com/app/answers/detail/a_id/23841/~/the-vlan-and-lag-configuration-screens-do-not-display-correctly-on-my-switch&lt;/a&gt;.&lt;BR&gt;&lt;BR&gt;Second, make sure you are adding the VLANs correctly by verifying with the user guide that you have done the required steps properly.  You can find the user guide on the &lt;A HREF=&quot;http://downloadcenter.netgear.com/en/product/GS748TS#searchResults&quot; rel=&quot;nofollow&quot;&gt;GS748T Downloads Page&lt;/A&gt;.&lt;BR&gt;&lt;BR&gt;If this still isn't working, I would suggest trying 801.q VLANs.  The important thing to know when using 802.1q VLANs, is to set each port to &quot;untagged&quot; mode, assign a VLAN, and set the PVID per-port to the same VLAN ID.  This should allow you to create separate VLANs on your Netgear switch.  Make sure you keep at least one port on VLAN 1 so that you can still connect to the management interface.  Of course make sure you have a router that can route between these separate networks, and either connect a port from each VLAN into this router, or create a &quot;tagged&quot; port carrying multiple VLANs to this device.&lt;/p&gt;&#xA;" OwnerUserId="17551" LastActivityDate="2015-10-16T18:08:47.843" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23455" PostTypeId="1" AcceptedAnswerId="23456" CreationDate="2015-10-16T19:57:24.870" Score="3" ViewCount="1275" Body="&lt;p&gt;I have an understanding about RIP options that to some extent contradicts with the text books.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that the hold-time is used to give the network enough time to converge so to avoid false updates that may cause loops. Hold-time is one of the reasons for which RIP is considered as a slow protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is fine up to now. However, the split-horizon option can take care of loops problem, then why do we need the hold-time which causes latency. The answer can be that the hold-time is required in case of circular topology where the false update about a down route may still reach the router from the other side even if split-horizon is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Okay, that is fine. However, as far as hold-down time is used along with the split horizon, this means that the hold-down is preventing loops not the split-horizon as even if there is no split horizon, hold-down time will be good enough to stop the loops alone. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, split-horizon is good enough to avoid loops in non-circular topologies while hold-down can stop loops in both cases (circular and non-circular). That means there is no advantage in stopping the loops by applying both methods. Split-horizon alone will be good enough for non-circular topologies (so RIP can work faster without the hold-time here). While hold-time is good enough to stop the loops in circular topologies (so no more advantage in stopping loops by having split-horizon also applied in this scenario).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then why we get both of them usually applied? The only thing I can find here is that split-horizon saves the bandwidth but does not help in stopping the loops if the hold-down timer is used. Am I right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, according to my understanding, I am advising to use split-horizon alone for non-circular topology by making the hold-timer = 0. Is it possible?&#xA;And in case of circular topologies, we need to apply both, hold-timer to prevent loops and split-horizon to save the bandwidth NOT to stop the loops. Am I right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other issue is about poison-reverse. I do not understand how it can help by breaking the split-horizon rule and advertising infinite routes to the same interface from where it got the update. I hope you can help me in that.&lt;/p&gt;&#xA;" OwnerUserId="19816" LastEditorUserId="8499" LastEditDate="2019-01-05T01:31:23.463" LastActivityDate="2019-01-05T01:31:23.463" Title="Issues in Understanding RIP Hold-time, Split-Horizon and poison-reverse" Tags="|routing|rip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23456" PostTypeId="2" ParentId="23455" CreationDate="2015-10-17T01:57:30.673" Score="1" Body="&lt;p&gt;The holddown timer prevents a router from updating its routing table with an unreachable route while the network may be in an unstable state by waiting three times the update period. Networks, especially large networks, can have flapping links or congestion which causes missed routing updates (you appear to want to drop a route immediately on a single missed update). This is useful for routes that are several hops away (indirectly reported routes) which can take time to propagate through the network (advertised every 30 seconds, and a missed update will need to wait another 30 seconds to see if it, too, is missed), and it can prevent problems which split horizon wouldn't necessarily catch (especially if split horizon is disabled due to use of a non-broadcast medium). This addresses a problem that split horizon, even if enabled, does not.&lt;/p&gt;&#xA;&lt;p&gt;Split horizon is used on broadcast media like ethernet. It prevents routing loops so that the routers don't keep sending updates for the same route back and forth to each other. Split horizon may need to be disabled on non-broadcast media where you need to maintain a specific list of neighbors to which you must advertise routes. Since the neighbors don't broadcast to each other, you may need to specifically tell one neighbor on an interface about a route you learned from another neighbor on that same interface, and not having split horizon doesn't present a problem since the advertisement will not go to the originating neighbor (non-broadcast). Split horizon keeps routing deterministic. The holddown timer has nothing to do with this.&lt;/p&gt;&#xA;&lt;p&gt;In the event of a routing loop without route poisoning, you would need to wait for timers to expire, but a poisoned route is immediately unusable, breaking the loop right away. Using split horizon with route poisoning is considered safer than split horizon alone.&lt;/p&gt;&#xA;&lt;p&gt;All these subject are covered in the RFCs, in particular &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1058&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1058, Routing Information Protocol&lt;/a&gt; which has been subsequently updated with several RFCs (RFCs &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=2&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0CCgQFjABahUKEwinz9jHscjIAhWBrIAKHcWlArc&amp;amp;url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc1723&amp;amp;usg=AFQjCNE4XDvtLMfBJ3bbjoNxXFEKMBKsmw&amp;amp;sig2=nRmaxi2xRMfoj3edailzUA&quot; rel=&quot;nofollow noreferrer&quot;&gt;1723&lt;/a&gt; and &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0CB4QFjAAahUKEwinz9jHscjIAhWBrIAKHcWlArc&amp;amp;url=https%3A%2F%2Ftools.ietf.org%2Fhtml%2Frfc2453&amp;amp;usg=AFQjCNGvygjYIADrdafIJni9Dftt36QIrg&amp;amp;sig2=SAmAAP1pJq3E4Pwtb85haA&quot; rel=&quot;nofollow noreferrer&quot;&gt;2453&lt;/a&gt;) pertaining to RIP version 2, and have been studied and vetted over many years. There are legitimate reason for changing update timers (hence the holddown timer) or split horizon, but careful thought has gone into them, and any change should not be taken lightly. You should read and understand the reasons for the decisions which went into the choices made in the RFCs, and a good place to start is the RFCs themselves.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-10-17T02:12:08.443" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="23458" PostTypeId="1" AcceptedAnswerId="23459" CreationDate="2015-10-17T05:56:43.800" Score="4" ViewCount="42524" Body="&lt;p&gt;Suppose my friend and I are connected to the Internet via some local ISP (not necessarily same), which means we are on different networks, hence our computers have different private IP addresses. Is there any way I can send a message to him if I know his private, as well as public, IP address (which is the IP address of his gateway router)? If so, then how will the packets will reach him?&lt;/p&gt;&#xA;" OwnerUserId="17451" LastEditorUserId="8499" LastEditDate="2018-12-22T01:56:30.983" LastActivityDate="2019-04-14T22:37:28.710" Title="How can 2 computers in different network communicate?" Tags="|routing|ip|nat|lan|wan|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23459" PostTypeId="2" ParentId="23458" CreationDate="2015-10-17T06:51:49.487" Score="3" Body="&lt;p&gt;First, just because your two computers are connected via the Internet at two separate locations doesn't necessarily mean that you are using private addresses.  That is certainly the most likely scenarios with IPv4, given the IPv4 address shortage, but it is still not necessarily true.  If you are running IPv6, you are probably using public IPv6 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume you are using private IPv4 addressing behind a router using NAT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Knowing the other private address does nothing for you at all, so just take that out of the equation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under normal, non-hacker circumstances, the NAT routers at each end would need to have port forwarding enabled for each PC's private address, or the routers would need to be using one-to-one NAT, to enable the two PCs to communicate via the public addresses. You could also use a VPN between the two PCs to get around the NAT problem.  This all assumes that there are no firewalls in place to block traffic from the Internet into the private networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In one-to-one NAT, each network would have multiple public addresses which uniquely translate to a single private address, so using a public address will get you to the corresponding private address. This is also an unlikely scenario given the shortage of IPv4 addresses, but it is done in some places.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port forwarding configures NAT to forward incoming traffic sent to a router's public address on a given port number to be sent to a particular inside private address at a given port number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VPN is a tunnel. Usually, traffic from one inside network is encapsulated within packets addressed to the public address of the other network and sent to the other network where it is de-encapsulated to the other inside network. This can be configured in such a way as to make the foreign network appear local to the tunnel interface of the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A firewall on either end, or anywhere along the path, may be configured to block any or all of these methods.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-17T06:51:49.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23460" PostTypeId="1" AcceptedAnswerId="23494" CreationDate="2015-10-17T07:03:47.877" Score="2" ViewCount="316" Body="&lt;p&gt;I need to setup a VPN with a remote location which has no wired Internet access. At the most we can get a GSM Wi-Fi hotspot for Internet access. I am hoping to install a SonicWall TZ105W and put W0 in the WAN zone to use the Wi-Fi hotspot as the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible?&lt;/p&gt;&#xA;" OwnerUserId="11931" LastEditorUserId="17678" LastEditDate="2015-10-18T07:45:01.677" LastActivityDate="2015-10-19T14:30:07.430" Title="Can Sonicwall TZ105W W0 port be configured as WAN?" Tags="|sonicwall|wan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23462" PostTypeId="1" AcceptedAnswerId="23463" CreationDate="2015-10-17T09:19:21.223" Score="0" ViewCount="193" Body="&lt;p&gt;How many headers are attached to voice data  when we use VoIP services?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I understand is, the maximum number of headers that can be attached to voice data is 4. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, Layer-2 would add a Frame-header. At layer 3, Frame-header would be removed and then IP-header, UDP-header and VoIP-protocol-headers would be attached sequentially. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct?&lt;/p&gt;&#xA;" OwnerDisplayName="user15062" LastEditorDisplayName="user15062" LastEditDate="2015-10-17T18:15:28.840" LastActivityDate="2015-10-17T18:15:28.840" Title="How many headers are attached to voice data when we use VoIP services?" Tags="|voip|" AnswerCount="1" CommentCount="1" ClosedDate="2015-10-19T05:01:16.437" ContentLicense="CC BY-SA 3.0" />
  <row Id="23463" PostTypeId="2" ParentId="23462" CreationDate="2015-10-17T15:50:14.857" Score="0" Body="&lt;p&gt;Since you asked about a packet, which is a layer-3 construct, it will not contain any layer-1 or layer-2 information, but it will be contained in layer-2 frame(s) in transit across the layer-1 medium/media.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will be a protocol header for the packet itself, and there may, or may not, be a layer-4 segment with a protocol header. Those one or two protocol headers are the extent of the network protocol headers in the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, it is completely up to whichever application originates the payload data to determine if there are any other headers, which ones, and what they may be.  Application-specific headers have nothing to do with network transport, and their use (or very existence) varies from application to application. This subject is normally beyond the scope of what is discussed on this site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A study of the OSI model may be useful, but just remember that it is a model that doesn't necessarily reflect the real world, especially when it comes to the layers above layer-4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number of headers in packets containing VoIP data is dependent on the VoIP application being used. In the context of a single VoIP application, the answer to you last question is probably, &quot;Yes,&quot; but different applications may, or may not, have a different number of application headers. To the network, VoIP is just another payload (application).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-17T15:50:14.857" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23465" PostTypeId="1" AcceptedAnswerId="23565" CreationDate="2015-10-17T19:29:30.280" Score="2" ViewCount="82" Body="&lt;p&gt;For voice data, session layer use SIP, H.323, MGCP, H.248, etc protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do these protocols add any header to the voice data payload?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When voice data is transmitted over the Internet, does session layer add any header to the packet?&lt;/p&gt;&#xA;" OwnerDisplayName="user15062" LastActivityDate="2015-10-21T09:20:00.623" Title="When voice data is transmitted over the Internet, does session layer add any header to the packet?" Tags="|voip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23466" PostTypeId="1" AcceptedAnswerId="23472" CreationDate="2015-10-17T19:35:47.483" Score="4" ViewCount="91" Body="&lt;p&gt;What is the current mode Spanning Tree running on Switches, since 802.1W was incorporated into 802.1D-2004? Even being 802.1D or 802.1W still not support VLANs, just Native VLAN has one SPT instance? &lt;/p&gt;&#xA;" OwnerUserId="14008" LastActivityDate="2015-10-18T04:11:14.260" Title="Current Mode Spanning Tree" Tags="|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23467" PostTypeId="1" AcceptedAnswerId="23468" CreationDate="2015-10-17T22:24:05.943" Score="3" ViewCount="985" Body="&lt;p&gt;Real-time Transfer Protocol (RTP) belongs to which layer of OSI?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Various people said various things from transport-layer to application-layer.&lt;/p&gt;&#xA;" OwnerDisplayName="user15062" LastActivityDate="2015-10-18T01:29:03.470" Title="Realtime Transfer Protocol (RTP) belongs to which layer of OSI?" Tags="|voip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23468" PostTypeId="2" ParentId="23467" CreationDate="2015-10-18T01:29:03.470" Score="1" Body="&lt;p&gt;RTP is an Application Layer protocol, because at the Transport Layer, RTP implementations use either UDP or TCP (most commonly UDP).&lt;/p&gt;&#xA;" OwnerUserId="3187" LastActivityDate="2015-10-18T01:29:03.470" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23469" PostTypeId="2" ParentId="23458" CreationDate="2015-10-18T02:03:29.037" Score="1" Body="&lt;p&gt;First of all, all computers in the whole world are physically connected to each other via ISPs. The ISP runs cables all over which brings them together to multiple routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways. To answer your question. You dont need his private IP. Only his public ip. To connect to his computer within his own private network, his router uitilizes something called NAT. &#xA;When you connect to his public IP lets say you want to control his computer.. The router/firewall on his end has to open the specified port for that service. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So an example would be something like:  lets say you want to turn off his computer from your computer (assuming such service exists), and that service uses port 10. You would send that special shutdown packet to port 10 to his Public IP address. The router/firewall on his end would then need to be configured to forward requests on port 10 to go to his computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope i helped. &lt;/p&gt;&#xA;" OwnerUserId="10329" LastActivityDate="2015-10-18T02:03:29.037" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23470" PostTypeId="1" AcceptedAnswerId="23475" CreationDate="2015-10-18T03:25:32.097" Score="2" ViewCount="1670" Body="&lt;p&gt;Gentleman,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know if is scenario on picture possible. I don't know how to configure layer 3 switch over routed ports with trunk link which is connected to layer 2 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EBtqL.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EBtqL.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19828" LastEditorUserId="8499" LastEditDate="2018-12-22T04:18:23.883" LastActivityDate="2021-01-29T10:59:50.130" Title="Inter VLAN routing on layer 3 switch over routed ports with trunk link" Tags="|cisco|routing|switch|vlan|packet-tracer|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23471" PostTypeId="2" ParentId="23470" CreationDate="2015-10-18T03:43:12.950" Score="2" Body="&lt;p&gt;A trunk link is a switched link, not a routed link. The port would not be a routed port, just an ordinary switch trunk link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to do is to create a layer-3 virtual port for each VLAN coming in on the switched trunk port. Cisco calls these virtual interfaces, SVIs. The SVIs are the routed ports, not the physical ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your diagram, you seem to want to create a router-on-a-stick. You can do this. The port on the layer-3 switch will be configured as a normal switch trunk port. Inside the layer-3 switch, you create an SVI for each VLAN on the trunk, and you configure it as you would a routed port (IP address, etc.).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-18T03:43:12.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23472" PostTypeId="2" ParentId="23466" CreationDate="2015-10-18T04:11:14.260" Score="7" Body="&lt;p&gt;That will depend on the switch vendor, switch model, and software version which the switch is running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a new standard emerges, it can take some vendors a while to update their code to support the new standard. If there are switch model which the vendor no longer supports, they may never be able to support the new standard.  The default STP version for a switch is also dependent on the above criteria. Most of the switches that I see actually default to the oldest standard and only use the newest standard when specifically configured to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if a vendor updates the code for a switch model, many switches of that model, already released into the wild, may never get updated with the code necessary to support the new standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the time, switches which are connected will drop to the newest STP standard that all the connected switches support.  This isn't guaranteed, especially with heterogeneous implementations, but I have seen it &lt;em&gt;almost&lt;/em&gt; always work that way.  For instance, if I configure 9 out of 10 interconnected switches to Rapid STP, but the 10th switch doesn't support Rapid STP, the 9 switches configured for Rapid STP will have that configuration, but will actually not use it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-18T04:11:14.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23473" PostTypeId="1" AcceptedAnswerId="23480" CreationDate="2015-10-18T05:22:35.593" Score="4" ViewCount="901" Body="&lt;p&gt;I am studying a Wireless subject and I have a random question where we have two floors each floor has a size of &lt;code&gt;70x140 meters&lt;/code&gt; and WIFI specs are as follows,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# of Antennas, 3&#xA;RF Pwr (EIRP) in dBm 17&#xA;Antenna Gain in dBi 2&#xA;UPnP able/cert able&#xA;Frequency: 2.4GHz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to find if I need two Wireless router or one to cover the entire two &#xA;floors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have calculated &lt;code&gt;Power Budget&lt;/code&gt; as &lt;code&gt;19&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But How can I calculate how much area would one Wireless router will cover ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't the answer i just need the guidance so I can calculate it myself and draw the graph.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone please help me ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="14885" LastActivityDate="2015-10-18T21:05:48.647" Title="How do know if Wireless router will cover the entire area" Tags="|wireless|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23474" PostTypeId="1" AcceptedAnswerId="24487" CreationDate="2015-10-18T06:31:36.387" Score="2" ViewCount="163" Body="&lt;p&gt;The IOS I have is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version 12.4(25d), RELEASE SOFTWARE (fc1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a card installed with four serial ports.  Whenever I have any serial interface that has been &lt;code&gt;no shut&lt;/code&gt; and has the clock rate set (and the dte side has also been &lt;code&gt;no shut&lt;/code&gt;), I get a SegV exception like below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main(config-if)#clock rate 64000&#xA;main(config-if)#&#xA;&#xA;00:14:55 UTC Fri Mar 1 2002: Unexpected exception to CPUvector 100, PC = 0x80519C70, LR = 0x80246E34&#xA;&#xA;-Traceback= 0x80519C70 0x80246E34 0x80247378 0x8024FB90&#xA;&#xA;CPU Register Context:&#xA;MSR = 0x00009032  CR  = 0x33000033  CTR = 0x8228635C  XER   = 0xA000E77F&#xA;R0  = 0x00000000  R1  = 0x84C5EB78  R2  = 0x84680000  R3    = 0x00000001&#xA;R4  = 0x00000038  R5  = 0x84BE96F8  R6  = 0x84680000  R7    = 0x68010000&#xA;R8  = 0x00000000  R9  = 0x00000000  R10 = 0x84420000  R11   = 0x84A4176C&#xA;R12 = 0x0003D738  R13 = 0xFFF4B634  R14 = 0x804F2CE0  R15   = 0x00000000&#xA;R16 = 0x00000000  R17 = 0x848743C4  R18 = 0x00000000  R19   = 0x00000000&#xA;R20 = 0x0000000F  R21 = 0x84680000  R22 = 0x84870000  R23   = 0x00000000&#xA;R24 = 0x800A8FE0  R25 = 0x9EA0612C  R26 = 0x0467D2D8  R27   = 0x848743C4&#xA;R28 = 0x84870000  R29 = 0x000F4240  R30 = 0x00000000  R31   = 0x00000000&#xA;&#xA;Writing crashinfo to flash:crashinfo_20020301-001455&#xA;&#xA;=== Flushing messages (00:14:55 UTC Fri Mar 1 2002) ===&#xA;&#xA;Queued messages:&#xA;*** System received a SegV exception ***&#xA;signal= 0xb, code= 0x100, context= 0x84874190&#xA;PC = 0x80519c70, Vector = 0x100, SP = 0x84c5eb78&#xA;*** Unexpected Console tx-ready interrupt ***&#xA;PC = 0xfff03fc4, Vector = 0x500, SP = 0x84875334&#xA;&#xA;System Bootstrap, Version 12.2(8r) [cmong 8r], RELEASE SOFTWARE (fc1)&#xA;Copyright (c) 2003 by cisco Systems, Inc.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Crash info file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#more flash:/crashinfo_20020301-001455&#xA;*Mar  1 00:00:07.572: %LINEPROTO-5-UPDOWN: Line protocol on Interface VoIP-Null0, changed state to up&#xA;This product contains cryptographic features and is subject to United&#xA;States and local country laws governing import, export, transfer and&#xA;use. Delivery of Cisco cryptographic products does not imply&#xA;third-party authority to import, export, distribute or use encryption.&#xA;Importers, exporters, distributors and users are responsible for&#xA;compliance with U.S. and local country laws. By using this product you&#xA;agree to comply with applicable laws and regulations. If you are unable&#xA;to comply with U.S. and local laws, return this product immediately.&#xA;&#xA;A summary of U.S. laws governing Cisco cryptographic products may be found at:&#xA;ww.cisco.com/wwl/export/crypto/tool/stqrg.html&#xA;&#xA;If you require further assistance please contact us by sending email to&#xA;export---cisco.com.&#xA;&#xA;Cisco 2611XM (MPC860P) processor (revision 3.1) with 127205K/3867K bytes of memory.&#xA;Processor board ID FOC08290ENT&#xA;M860 processor: part number 5, mask 2&#xA;2 FastEthernet interfaces&#xA;4 Low-speed serial(sync/async) interfaces&#xA;32K bytes of NVRAM.&#xA;49152K bytes of processor board System flash (Read/Write)&#xA;&#xA;&#xA;&#xA;     --- System Configuration Dialog ---&#xA;&#xA;Would you like to enter the initial configuration dialog? [yes/no]:&#xA;*Mar  1 00:00:33.238: %LINK-3-UPDOWN: Interface FastEthernet0/0, changed state to up&#xA;*Mar  1 00:00:33.238: %LINK-3-UPDOWN: Interface FastEthernet0/1, changed state to up&#xA;*Mar  1 00:00:33.238: %LINK-3-UPDOWN: Interface Serial1/0, changed state to down&#xA;*Mar  1 00:00:33.238: %LINK-3-UPDOWN: Interface Serial1/1, changed state to up&#xA;*Mar  1 00:00:33.242: %LINK-3-UPDOWN: Interface Serial1/2, changed state to up&#xA;*Mar  1 00:00:33.242: %LINK-3-UPDOWN: Interface Serial1/3, changed state to up&#xA;*Mar  1 00:00:34.240: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to down&#xA;*Mar  1 00:00:34.240: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/1, changed state to down&#xA;*Mar  1 00:00:34.240: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/0, changed state to down&#xA;*Mar  1 00:00:34.240: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to up&#xA;*Mar  1 00:00:34.244: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/2, changed state to up&#xA;*Mar  1 00:00:34.244: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/3, changed state to up&#xA;*Mar  1 00:00:54.252: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to down&#xA;*Mar  1 00:00:54.252: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/2, changed state to down&#xA;*Mar  1 00:00:54.256: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/3, changed state to down&#xA;*Mar  1 00:01:00.911: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to upno&#xA;CMD: 'access-list 199 permit icmp host 10.10.10.10 host 20.20.20.20' 00:12:01 UTC Fri Mar 1 2002&#xA;CMD: 'crypto map NiStTeSt1 10 ipsec-manual' 00:12:01 UTC Fri Mar 1 2002&#xA;CMD: 'match address 199&#xA;' 00:12:01 UTC Fri Mar 1 2002&#xA;CMD: 'set peer 20.20.20.20&#xA;' 00:12:01 UTC Fri Mar 1 2002&#xA;CMD: 'exit' 00:12:01 UTC Fri Mar 1 2002&#xA;CMD: 'no access-list 199' 00:12:01 UTC Fri Mar 1 2002&#xA;CMD: 'no crypto map NiStTeSt1' 00:12:02 UTC Fri Mar 1 2002&#xA;&#xA;*Mar  1 00:12:03.091: %LINK-5-CHANGED: Interface FastEthernet0/0, changed state to administratively down&#xA;*Mar  1 00:12:03.091: %LINK-5-CHANGED: Interface FastEthernet0/1, changed state to administratively down&#xA;*Mar  1 00:12:03.095: %LINK-5-CHANGED: Interface Serial1/0, changed state to administratively down&#xA;*Mar  1 00:12:03.095: %LINK-5-CHANGED: Interface Serial1/1, changed state to administratively down&#xA;*Mar  1 00:12:03.095: %LINK-5-CHANGED: Interface Serial1/2, changed state to administratively down&#xA;*Mar  1 00:12:03.095: %LINK-5-CHANGED: Interface Serial1/3, changed state to administratively down&#xA;*Mar  1 00:12:03.796: %SYS-5-RESTART: System restarted --&#xA;Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version 12.4(25d), RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2010 by Cisco Systems, Inc.&#xA;Compiled Wed 18-Aug-10 04:49 by prod_rel_team&#xA;*Mar  1 00:12:03.796: %SNMP-5-COLDSTART: SNMP agent on host Router is undergoing a cold start&#xA;*Mar  1 00:12:04.093: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/0, changed state to downCMD: 'en' 00:12:37 UTC Fri Mar 1 2002&#xA;CMD: 'conf t' 00:12:40 UTC Fri Mar 1 2002&#xA;CMD: 'hostname main' 00:12:43 UTC Fri Mar 1 2002&#xA;CMD: 'do write mem' 00:12:49 UTC Fri Mar 1 2002&#xA;CMD: 'write mem' 00:12:49 UTC Fri Mar 1 2002&#xA;CMD: 'config-' 00:13:48 UTC Fri Mar 1 2002&#xA;CMD: 'config-register 0x2102' 00:13:51 UTC Fri Mar 1 2002&#xA;CMD: 'int s1/1' 00:13:59 UTC Fri Mar 1 2002&#xA;CMD: 'clock rate 64000' 00:14:04 UTC Fri Mar 1 2002&#xA;CMD: 'no clock rate' 00:14:08 UTC Fri Mar 1 2002&#xA;CMD: 'ip address 10.0.0.1 255.255.255.252' 00:14:19 UTC Fri Mar 1 2002&#xA;CMD: 'no shut' 00:14:21 UTC Fri Mar 1 2002&#xA;&#xA;*Mar  1 00:14:23.068: %LINK-3-UPDOWN: Interface Serial1/1, changed state to up&#xA;*Mar  1 00:14:24.070: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to upCMD: 'ping 10.0.0.2' 00:14:32 UTC Fri Mar 1 2002&#xA;CMD: 'do ping 10.0.0.2' 00:14:36 UTC Fri Mar 1 2002&#xA;CMD: 'ping 10.0.0.2' 00:14:36 UTC Fri Mar 1 2002&#xA;&#xA;*Mar  1 00:14:46.823: %LINEPROTO-5-UPDOWN: Line protocol on Interface Serial1/1, changed state to down&#xA;&#xA;00:14:55 UTC Fri Mar 1 2002: Unexpected exception to CPUvector 100, PC = 0x80519C70, LR = 0x80246E34&#xA;&#xA;-Traceback= 0x80519C70 0x80246E34 0x80247378 0x8024FB90&#xA;&#xA;CPU Register Context:&#xA;MSR = 0x00009032  CR  = 0x33000033  CTR = 0x8228635C  XER   = 0xA000E77F&#xA;R0  = 0x00000000  R1  = 0x84C5EB78  R2  = 0x84680000  R3    = 0x00000001&#xA;R4  = 0x00000038  R5  = 0x84BE96F8  R6  = 0x84680000  R7    = 0x68010000&#xA;R8  = 0x00000000  R9  = 0x00000000  R10 = 0x84420000  R11   = 0x84A4176C&#xA;R12 = 0x0003D738  R13 = 0xFFF4B634  R14 = 0x804F2CE0  R15   = 0x00000000&#xA;R16 = 0x00000000  R17 = 0x848743C4  R18 = 0x00000000  R19   = 0x00000000&#xA;R20 = 0x0000000F  R21 = 0x84680000  R22 = 0x84870000  R23   = 0x00000000&#xA;R24 = 0x800A8FE0  R25 = 0x9EA0612C  R26 = 0x0467D2D8  R27   = 0x848743C4&#xA;R28 = 0x84870000  R29 = 0x000F4240  R30 = 0x00000000  R31   = 0x00000000&#xA;&#xA;&#xA;=== Start of Crashinfo Collection (00:14:55 UTC Fri Mar 1 2002) ===&#xA;&#xA;For image:&#xA;Cisco IOS Software, C2600 Software (C2600-ADVENTERPRISEK9-M), Version 12.4(25d), RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2010 by Cisco Systems, Inc. &#xA;Compiled Wed 18-Aug-10 04:49 by prod_rel_team&#xA;&#xA;FF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF&#xA;8525D9DC: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF&#xA;8525D9FC: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF&#xA;8525DA1C: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF&#xA;8525DA3C: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF&#xA;8525DA5C: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF&#xA;8525DA7C: FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF FFFFFFFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It just keeps having SegV exceptions and restarting if I don't put it into rommon mode and start over without that config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also about 1400 more lines of memory addresses (that goes at the end of what I pasted), etc, in the crash info file, but I decided to not paste them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know what could be wrong or how to troubleshoot this?&lt;/p&gt;&#xA;" OwnerUserId="16873" LastEditorUserId="16873" LastEditDate="2015-10-18T22:37:47.070" LastActivityDate="2015-11-17T09:42:12.327" Title="SegV exception when clock rate is configured on a serial connection on a Cisco 2611 XM router" Tags="|cisco|router|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23475" PostTypeId="2" ParentId="23470" CreationDate="2015-10-18T09:21:47.317" Score="2" Body="&lt;p&gt;In your sheme you need 3 trunk links (if there is only one physical connection between these switches):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;switch 1 to switch 0&lt;/li&gt;&#xA;&lt;li&gt;switch 0 to switch 2&lt;/li&gt;&#xA;&lt;li&gt;switch 2 to L3SW&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The routing between these subnets will be handled by the L3 switch.&#xA;so if pc 0 wants to ping to pc 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC0 &gt; (gets it on his vlan 1 port) switch 1 (trunk) &gt; switch 0 (trunk) &gt; switch 2 (trunk) &gt; L3SW (vlan1 &gt; vlan2) (sends it out of its trunk port) &gt; switch 2 (trunk) &gt; switch 0 (trunk) &gt; switch 1 (vlan2) &gt; pc1&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2015-10-18T09:21:47.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23476" PostTypeId="1" CreationDate="2015-10-18T09:47:10.140" Score="3" ViewCount="114" Body="&lt;p&gt;According to this link, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/WAN_and_MAN/V3PN_SRND/V3PN_SRND/v3p_plan.html#wp1035916&quot; rel=&quot;nofollow&quot;&gt;Planning and Design&lt;/a&gt;, an encrypted IPsec voice data packet contains: IPsec header, ESP header, GRE IP header, IP header, UDP header, RTP header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which header is added in Layer-2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How many headers are added to the voice data payload in total when we use an IPsec VPN, e.g. is the information in this link correct?&lt;/p&gt;&#xA;" OwnerDisplayName="user15062" LastEditorUserId="8499" LastEditDate="2016-04-12T15:49:38.203" LastActivityDate="2016-08-10T17:39:07.537" Title="Which header is added to the voice data payload in Layer-2 when we use an IPsec VPN?" Tags="|voip|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23477" PostTypeId="2" ParentId="23473" CreationDate="2015-10-18T13:49:26.867" Score="2" Body="&lt;p&gt;You need to know the &lt;a href=&quot;https://www.pasternack.com/t-calculator-fspl.aspx&quot; rel=&quot;nofollow&quot;&gt;free space path loss&lt;/a&gt; -- that is, the loss between the transmitting antenna and the receiving antenna.  With that you can figure out the radius of the area.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-18T13:49:26.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23479" PostTypeId="2" ParentId="23473" CreationDate="2015-10-18T15:24:50.610" Score="2" Body="&lt;p&gt;As stated above by Ron Trunk, you can calculate the radius of the wireless signal using free space path loss. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But its worth noting that this calculation doesnt account for obstacles (walls, metal plates, bookshelf, etc), for example at the same floor or the floor,ceiling of the below/above floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another propagation model is Log distance path loss, which is an extension to free space path loss, and it tries to take account of common obstacles in the calculations.&#xA;&lt;a href=&quot;http://www.gaussianwaves.com/2013/09/log-distance-path-loss-or-log-normal-shadowing-model/&quot; rel=&quot;nofollow&quot;&gt;http://www.gaussianwaves.com/2013/09/log-distance-path-loss-or-log-normal-shadowing-model/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19428" LastActivityDate="2015-10-18T15:24:50.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23480" PostTypeId="2" ParentId="23473" CreationDate="2015-10-18T15:25:27.810" Score="4" Body="&lt;p&gt;Well, you have the &quot;test/book answer&quot; and you have real life.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In real life, you try it if you want to know the real answer, since modeling the actual effect of walls, floors, etc is still somewhat substandard (or would require more effort to get an accurate model than going and checking in real life takes.) This is a &quot;wireless site survey&quot; and without one you are flying blind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Free space path&quot; only applies if the path is in free space, which is &lt;strong&gt;exceedingly rare&lt;/strong&gt; except for outdoor WiFi serving playing fields or the like. It does not account for the floor/ceiling you must have if the question is about 2 floors. Most commercial building floor structures (such as concrete over steel sheets) are exceedingly hostile to WiFi propagation. If there are any walls on the those floors, (ie, it's not just a warehouse like space) the answer changes again.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2015-10-18T21:05:48.647" LastActivityDate="2015-10-18T21:05:48.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23484" PostTypeId="1" CreationDate="2015-10-19T01:07:18.057" Score="3" ViewCount="2355" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bMJzt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does message switching fit in this comparison table here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are these 4 switching work at different layers in the OSI model?&lt;/p&gt;&#xA;" OwnerDisplayName="user15062" LastActivityDate="2015-10-19T20:27:24.050" Title="How does message switching compare with other switching techniques?" Tags="|switching-modes|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23485" PostTypeId="2" ParentId="23484" CreationDate="2015-10-19T01:22:25.777" Score="1" Body="&lt;p&gt;A message could be circuit switched or packet switched.  You would probably classify message switching as an application layer construct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet switching can break a large message into smaller packets to be sent, but a message may be small enough to fit into a single packet, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A circuit could carry a message over a circuit switched network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's kind of like comparing peer-to-peer routing with IP routing. They are not equivalent since one is application layer routing, and the other is layer-3 routing on which the application layer routing may happen.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-19T01:22:25.777" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="23487" PostTypeId="1" CreationDate="2015-10-19T05:30:02.043" Score="2" ViewCount="612" Body="&lt;p&gt;I'm trying to figure out a way to have our Fortigate 60C redirect certain subdomains but not block complete access to the domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.G. I want to block update.microsoft.com but I don't want microsoft.com or office.microsoft.com to be blocked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current settings are blocking the complete domain. I do find this strange though as I specified a hostname.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config system dns-database &#xA;&#xA;edit &quot;test&quot; &#xA;&#xA;config dns-entry &#xA;&#xA;edit 2 &#xA;&#xA;set hostname &quot;update&quot; &#xA;&#xA;set ip 1.1.1.1 &#xA;&#xA;next&#xA;&#xA;end&#xA;&#xA;set domain &quot;microsoft.com&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My goals is to prevent certain software from accessing certain urls to prevent devices from downloading updates or phoning home.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.1.1.1 is set as a loopback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Blocking access on devices itself is not an option.&lt;/p&gt;&#xA;" OwnerUserId="19842" LastEditorUserId="509" LastEditDate="2015-10-19T06:52:41.417" LastActivityDate="2019-02-01T23:00:35.093" Title="Fortigate - Redirecting subdomains only?" Tags="|dns|fortigate|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23492" PostTypeId="2" ParentId="20646" CreationDate="2015-10-19T13:53:08.367" Score="1" Body="&lt;p&gt;There is a lot to say on this field. I would like to add at Andy answer the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html&quot; rel=&quot;nofollow&quot;&gt;following guidelines&lt;/a&gt; provided by Cisco. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the configuration itself, well you can improve ACL on line, service password-encryption, disable not used service like http and so on.  &lt;/p&gt;&#xA;" OwnerUserId="206" LastActivityDate="2015-10-19T13:53:08.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23493" PostTypeId="1" AcceptedAnswerId="23495" CreationDate="2015-10-19T14:19:34.250" Score="1" ViewCount="1338" Body="&lt;p&gt;I know how arp poisoning works in the LAN environment and I know that routers also contains mac-address tables with the neighbouring router's mac-addresses, that means routers exchange arp frames. So is there any possibility to send the arp poisoning attack to ISP level? Till now is there any attacking techniques exists regarding arp poisoning in WAN. If not how the attackers are doing man-in-the-middle attacks &amp;amp; what is the security mechanism the routers use to stop these attacks? &lt;/p&gt;&#xA;" OwnerUserId="6195" LastActivityDate="2015-10-20T08:29:38.053" Title="Will arp poison attack work in the WAN" Tags="|ipv4|ethernet|protocol-theory|arp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23494" PostTypeId="2" ParentId="23460" CreationDate="2015-10-19T14:30:07.430" Score="2" Body="&lt;p&gt;If your GSM Wifi Hotspot has an Ethernet port you could connect &lt;strong&gt;X1 (WAN)&lt;/strong&gt; there and it should work; that would be simplest.&#xA;If NOT then you will need to put &lt;strong&gt;W0 (Wireless)&lt;/strong&gt; into &lt;em&gt;Wireless Bridge Mode&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://support.software.dell.com/kb/sw11099&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw11099&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in both cases, you will need to ensure the correct ports within GSM Wifi hotspot router are open for VPNs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IPSec uses:&#xA;IP protocol 50 for ESP&#xA;IP protocol 51 for AH&#xA;UDP port 500 for IKE Phase 1 and Phase 2 negotiations&#xA;UDP port 4500 is used as well if NAT-T is enabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's to allow the remote site to initiate the connection, you would need to publish/NAT inbound those ports to the W0 interface if you wanted to initiate from the central office to the remote site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest testing this before sending any equipment out as the little routers inside those hotspots are often troublesome. If it works please post back with the make and model.&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-10-19T14:30:07.430" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23495" PostTypeId="2" ParentId="23493" CreationDate="2015-10-19T14:44:54.627" Score="1" Body="&lt;p&gt;Based on your question, I don't think you understand ARP poisoning as well as you think you do.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most cases, WAN links are point to point, so there's nowhere to redirect traffic to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not within the layer 2 broadcast domain, you won't be able to send or receive ARP messages, legitimate or otherwise.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-19T14:44:54.627" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="23497" PostTypeId="1" CreationDate="2015-10-19T15:55:53.040" Score="0" ViewCount="34" Body="&lt;p&gt;This problem might be a lot simpler than you guys are used to, with an equally simple solution but I'm just not seeing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So we have a redirect site called:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;delphonbenefits.com&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;which redirects to a site called:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;pcms.plansource.com&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On everybody else's network this redirect works. However, on my network it does not. Is there anything that would prevent my network from allowing this redirect? Let me know if you guys can help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some DNS reports that may or may not be relevant:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jbsXr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jbsXr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0Mmrw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0Mmrw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19859" LastEditorUserId="8499" LastEditDate="2018-02-16T04:04:08.690" LastActivityDate="2018-02-16T04:04:08.690" Title="Website Forwarder not Forwarding-- but is?" Tags="|tcp|udp|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-12T19:48:44.600" ContentLicense="CC BY-SA 3.0" />
  <row Id="23498" PostTypeId="1" AcceptedAnswerId="25247" CreationDate="2015-10-19T15:58:33.313" Score="2" ViewCount="696" Body="&lt;p&gt;Background:  I am setting up a network for a local church I attend.  The setup will be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently ATT DSL --&gt; Motorola 3801HGV set in transparent (bridging) mode --&gt;outside interface of ASA5506 (configured for DHCP from DSL modem) --&gt;Inside interface of 5506 (172.16.0.2 IP) --&gt; routed interface on Cisco 3750 (Gi1/0/3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 3750 has 3 private networks.  All networks can talk to each other without issue.  All networks can ping the 172.16.0.2 IP (inside interface of ASA5506).  Those three private networks are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.1.0/24&#xA;10.1.2.0/24&#xA;10.1.3.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: I have single area OSPF running on the 3750 that performs my routing.  I have default information originate configured there as well.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I currently have NAT configured on my ASA so that when traffic leaves the outside interface, it is PAT-ed to the external ISP IP (108.x.x.x).  I ran packet-tracer to confirm - and packet tracer says it is allowed out - and shows it PAT-ed to the 108.x.x.x IP.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The problem&lt;/strong&gt;:  None of my 10.x.x.x networks can get out to the Internet. If i plug directly into the ATT 5031NV with a statically assigned 192.168.1.x IP (that's the DHCP Pool range the 5031nv gives out) - I can get out to the Internet with no issues.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that I can also not ping my default (ISP) gateway from my Cisco ASA.  See below with updated (11/5/2015) config.  I made several changes based on comments from this thread.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Relevant config on Cisco 3750:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SRPC-CORE-OFFICE#sho run | s router ospf&#xA; router ospf 1&#xA;   passive-interface default&#xA;   no passive-interface GigabitEthernet1/0/3&#xA;   network 10.1.1.0 0.0.0.255 area 1&#xA;   network 10.1.2.0 0.0.0.255 area 1&#xA;   network 10.1.3.0 0.0.0.255 area 1&#xA;&#xA;SRPC-CORE-OFFICE#sho ip route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;      10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks&#xA;C        10.1.1.0/24 is directly connected, Vlan100&#xA;L        10.1.1.1/32 is directly connected, Vlan100&#xA;C        10.1.2.0/24 is directly connected, Vlan120&#xA;L        10.1.2.1/32 is directly connected, Vlan120&#xA;C        10.1.3.0/24 is directly connected, Vlan130&#xA;L        10.1.3.1/32 is directly connected, Vlan130&#xA;      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks&#xA;C        172.16.0.0/24 is directly connected, GigabitEthernet1/0/3&#xA;L        172.16.0.1/32 is directly connected, GigabitEthernet1/0/3&#xA;S     192.168.0.0/16 is directly connected, GigabitEthernet1/0/3&#xA;S     192.168.5.0/24 is directly connected, GigabitEthernet1/0/3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;!&#xA;!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SRPC-CORE-OFFICE#sho ip int br | ex un&#xA;    Interface              IP-Address      OK? Method Status            Protocol&#xA;    Vlan100                10.1.1.1        YES NVRAM  up                    up      &#xA;    Vlan120                10.1.2.1        YES NVRAM  up                    up      &#xA;    Vlan130                10.1.3.1        YES NVRAM  up                    up    &#xA;    GigabitEthernet1/0/3   172.16.0.1      YES NVRAM  up                    up &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;!&#xA;!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SRPC-CORE-OFFICE#sho vlan br | i active&#xA;    100  MANAGEMENT                       active &#xA;    120  SRPC_WIFI                        active &#xA;    130  SRPC_DATA                        active &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cisco ASA5506 relevant config:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SRPC-FW-01# sho run nat&#xA;        !&#xA;        object network obj_any&#xA;         nat (dmzTest,outside) dynamic interface&#xA;&#xA;router ospf 1&#xA; network 7.0.1.0 255.255.255.0 area 1&#xA; network 10.1.1.10 255.255.255.255 area 1&#xA; network 192.168.1.0 255.255.255.0 area 1&#xA; log-adj-changes&#xA; default-information originate&#xA;&#xA;!&#xA;route dmzTest 10.1.0.0 255.255.224.0 172.16.0.1 1&#xA;!&#xA;!&#xA;SRPC-FW-01# sh int ip br &#xA;Interface                  IP-Address      OK? Method Status            Protocol&#xA;GigabitEthernet1/1         108.225.177.202 YES DHCP   up                    up  &#xA;GigabitEthernet1/2         172.16.0.2      YES CONFIG up                    up  &#xA;&#xA;!&#xA;!&#xA;SRPC-FW-01# sho nameif&#xA;       Interface                Name                     Security&#xA;       GigabitEthernet1/1       outside                    0&#xA;       GigabitEthernet1/2       dmzTest                  100&#xA;        !&#xA;&#xA;access-list dmzTest-in extended permit tcp any any &#xA;access-list dmzTest-in extended permit icmp any any &#xA;access-list dmzTest-out extended permit tcp any any &#xA;access-list management-in extended permit ip any any &#xA;access-list management-out extended permit ip any any &#xA;access-list OutsideATT-in extended permit ip any any &#xA;access-list OutsideATT-out extended permit ip any any &#xA;access-list dmztest-out extended permit icmp any any &#xA;access-list outside_inbound_to_SRPC extended deny ip any any &#xA;access-list outside_inbound_to_SRPC extended permit ip host 108.225.176.1 any &#xA;access-list outside_outbound_to_INET extended permit ip 108.225.176.0 255.255.252.0 any &#xA;access-list outside_outbound_to_INET extended permit ip any any &#xA;!&#xA;!&#xA;!   &#xA;access-group outside_inbound_to_SRPC in interface outside&#xA;access-group outside_outbound_to_INET out interface outside&#xA;access-group dmzTest-in in interface dmzTest&#xA;access-group dmzTest-out out interface dmzTest&#xA;access-group OutsideATT-in in interface OutsideATT&#xA;access-group OutsideATT-out out interface OutsideATT&#xA;access-group management-in in interface management&#xA;access-group management-out out interface management&#xA;!&#xA;&#xA;SRPC-FW-01# sho route&#xA;    Gateway of last resort is 108.225.176.1 to network 0.0.0.0&#xA;&#xA;    S*    0.0.0.0 0.0.0.0 [1/0] via 108.225.176.1, outside&#xA;    S        10.1.0.0 255.255.224.0 [1/0] via 172.16.0.1, dmzTest&#xA;    C        108.225.176.0 255.255.252.0 is directly connected, outside&#xA;    L        108.225.177.202 255.255.255.255 is directly connected, outside&#xA;    C        172.16.0.0 255.255.255.0 is directly connected, dmzTest&#xA;    L        172.16.0.2 255.255.255.255 is directly connected, dmzTest&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13939" LastEditorUserId="13939" LastEditDate="2015-11-06T01:34:54.840" LastActivityDate="2015-12-15T20:24:12.130" Title="ASA5506 Likely NAT issue with ISP" Tags="|cisco|nat|isp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23499" PostTypeId="2" ParentId="22400" CreationDate="2015-10-19T16:07:19.687" Score="2" Body="&lt;p&gt;This turned out to be an issue with the provider-side equipment. They swapped our physical hand-off port at one end to another and things started working. They said it was due to a damaged physical interface, even though layer 2 tests seemed fine(?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it seems like with these VPLS connections, it is possible to have layer 2 connectivity without layer 3 connectivity.&lt;/p&gt;&#xA;" OwnerUserId="4532" LastActivityDate="2015-10-19T16:07:19.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23500" PostTypeId="1" CreationDate="2015-10-19T16:36:42.073" Score="3" ViewCount="1075" Body="&lt;p&gt;I'm a bit confused between Software-Defined Networks and OpenFlow. As far as I know, OpenFlow is just a protocol that manages the communication between the controlling plan and forwarding plan but I don't know where SDN takes place here. Is it the controller itself? How do I distinguish between them and when to say OpenFlow or SDN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you. &lt;/p&gt;&#xA;" OwnerUserId="19174" LastActivityDate="2015-10-31T19:24:20.780" Title="SDN vs OpenFlow" Tags="|cisco|routing|sdn|openflow|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23501" PostTypeId="2" ParentId="23500" CreationDate="2015-10-19T16:39:30.280" Score="4" Body="&lt;p&gt;Openflow is to SDN &lt;/p&gt;&#xA;&#xA;&lt;p&gt;as&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF is to Routing&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-19T16:39:30.280" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23503" PostTypeId="1" CreationDate="2015-10-19T16:59:04.420" Score="0" ViewCount="271" Body="&lt;p&gt;&lt;strong&gt;Alright, so I have a question as listed below:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose you are designing a sliding window protocol for a 10 Mbps point-to-point link to the moon, which has a one-way latency of 2.0 seconds.  Assuming that each frame carries 5KB of data, what is the minimum number of bits you need for the sequence number if RWS = SWS? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I have worked out so far is:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SWS = RTT x Bandwidth / Framesize&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10,000,000 bps * 4 seconds = 40,000,000 bits  is the through put&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5000 Bytes = 40,000 bits per frame is the size of each frame&lt;/p&gt;&#xA;&#xA;&lt;p&gt;40,000,000 bits/ 40,000 bits = 1000 bits&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SWS = 1000 bits&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;According to the instructor there are two more steps past this to get the answer, and they are:&lt;/strong&gt; &quot;First, compute MaxSeqNum based on SWS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, compute the number of bits you need for the sequence number.  For example, if MaxSeqNum is 1000, you will need at least 10 bits for all possible sequence number, 2^10 =1024 &gt; 1000.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I can't figure out how to calc MaxSeqNum based of SWS&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;And i'm not sure how in the second part you get 10 bits because 2^10... that part doesn't make any sense either. Why is it only 10 bits when the SWS equals 1000 bits?? Where does 1024 come into play?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i'm looking for is the formula needed to calculate this, or a similar example solved that I can derive a formula or method of solving this from.&lt;/p&gt;&#xA;" OwnerUserId="19863" LastEditorUserId="19863" LastEditDate="2015-10-19T17:06:56.633" LastActivityDate="2015-10-20T01:45:44.060" Title="Theoretical calculations of of the number of bits needed in receive window size" Tags="|ethernet|" AnswerCount="1" CommentCount="1" ClosedDate="2015-10-20T09:49:21.330" ContentLicense="CC BY-SA 3.0" />
  <row Id="23504" PostTypeId="1" CreationDate="2015-10-19T17:40:54.243" Score="2" ViewCount="508" Body="&lt;p&gt;Wi-Fi direct (ad-hoc) can transfer data without using an AP.  Is it possible to use my wireless USB adapter to capture frames?&lt;/p&gt;&#xA;" OwnerUserId="19865" LastEditorUserId="8499" LastEditDate="2015-10-19T17:44:39.253" LastActivityDate="2015-10-20T23:44:03.110" Title="Is it possible to capture W-Fi direct frames?" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-06T23:36:03.537" ContentLicense="CC BY-SA 3.0" />
  <row Id="23505" PostTypeId="2" ParentId="23504" CreationDate="2015-10-19T17:50:31.277" Score="1" Body="&lt;p&gt;If your USB adapter supports monitor mode, you can capture the Wi-Fi frames that it sees, but those frames may (probably) be encrypted.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-19T17:50:31.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23508" PostTypeId="1" CreationDate="2015-10-19T20:28:14.610" Score="2" ViewCount="841" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC793&lt;/a&gt; states that, at the receiver, the incoming segment is accepted upon the following check:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;The first part of this test checks to see if the beginning of the segment &#xA;falls in the window, the second part of the test checks to see if the end of&#xA;the segment falls in the window; if the segment passes either part of the &#xA;test it contains data in the window. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;However, there may be a case that the the beginning of the segment falls in the window, but the end of the segment doesn't. This is he case when there still is room in the window, but the segment size is longer than the remaining space in the buffer. What if this is the case-- what happens?&lt;/p&gt;&#xA;&lt;p&gt;Does TCP drop this segment? or Does it arrange the buffer based on Maximum Segment Size so that it can take these partial segments?&lt;/p&gt;&#xA;&lt;p&gt;TIA.&lt;/p&gt;&#xA;" OwnerUserId="19482" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-06-03T03:23:02.293" Title="TCP -- partial segments in receiver's sliding window" Tags="|tcp|transport-protocol|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23509" PostTypeId="2" ParentId="23498" CreationDate="2015-10-19T20:35:32.993" Score="3" Body="&lt;p&gt;First, OSPF is not necessary (or recommended) for such a tiny network. I run much larger networks and still don't bother with dynamic routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, never, &lt;strong&gt;&lt;em&gt;ever&lt;/em&gt;&lt;/strong&gt;, route to a broadcast interface (ie. &lt;code&gt;ip route 0.0.0.0 0.0.0.0 GigabitEthernet1/0/3&lt;/code&gt;) BTW, that's &lt;em&gt;proxy-arp&lt;/em&gt;; I'm 1000% certain that &lt;em&gt;is not what you want&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third, AT&amp;amp;T's 3801 does not have a &quot;bridge mode&quot;. And those modems have a particularly nasty bit of brain damage where the IP:MAC table is one-to-one -- a MAC can have only one IP and v.v., which means with a static block each IP must go to a different device.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-19T20:35:32.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23510" PostTypeId="2" ParentId="23493" CreationDate="2015-10-19T20:44:02.063" Score="2" Body="&lt;p&gt;If the WAN is a shared ethernet, &lt;em&gt;maybe&lt;/em&gt;. That tends to only happen in cheap/lazy data centers. Common (residential) WAN protocols like DSL and DOCSIS are point-to-point; while they may be ethernet and &lt;em&gt;appear&lt;/em&gt; to be a shared medium, all traffic flows through the ISP headend (DSLAM/CMTS), CPE's cannot directly communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond that, ISP technology intended to be used in such a manor has various security mechanisms to prevent this sort of thing.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-19T20:44:02.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23512" PostTypeId="1" AcceptedAnswerId="23514" CreationDate="2015-10-19T21:40:53.147" Score="1" ViewCount="299" Body="&lt;p&gt;How do i get &lt;code&gt;counter64&lt;/code&gt; to monitor hight bandwidth using &lt;code&gt;snmp&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Counter32 works! &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spatel@MBP:~$ snmpget -v1 -c public switch.cisco.com ifOutOctets.50&#xA;IF-MIB::ifOutOctets.50 = Counter32: 2038072800  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;counter64 not working :( &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; spatel@MBP:~$ snmpget -v1 -c public switch.cisco.com ifHCOutOctets.50&#xA; Error in packet&#xA; Reason: (noSuchName) There is no such variable name in this MIB.&#xA; Failed object: IF-MIB::ifHCOutOctets.50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My binary also 64 bit&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spatel@MBP:~$ file /usr/bin/snmpget&#xA;/usr/bin/snmpget: Mach-O 64-bit executable x86_64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2015-10-20T06:09:43.913" Title="ifHCOutOctets doesn't working with snmpget" Tags="|cisco|snmp|bandwidth|linux|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23513" PostTypeId="1" CreationDate="2015-10-19T22:56:07.613" Score="1" ViewCount="1515" Body="&lt;p&gt;The interface is connected to a switch and has the &lt;code&gt;no shutdown&lt;/code&gt; command applied. The interface at the switch is already up/up, but ASA's interface is still down/down. Another ASA also has the same behavior. What is the reason for this?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="8499" LastEditDate="2015-10-20T22:57:26.803" LastActivityDate="2015-11-20T00:45:43.977" Title="Interface on ASA 5525 cannot turn up/up" Tags="|cisco-asa|interface|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23514" PostTypeId="2" ParentId="23512" CreationDate="2015-10-19T23:31:15.003" Score="1" Body="&lt;p&gt;Try with SNMPv2 (-v2c).  Are you sure the switch even supports ifXTable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Search &lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/AdvancedSearch?MibSel=4548&quot; rel=&quot;nofollow&quot;&gt;[here]&lt;/a&gt;]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-19T23:31:15.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23515" PostTypeId="1" AcceptedAnswerId="23516" CreationDate="2015-10-20T00:50:10.883" Score="2" ViewCount="202" Body="&lt;p&gt;Our company website is developed in WordPress, but the services that we offer to customers are developed in .Net. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering if I can host our company website CompanyName.com onto a linux based hosting like BlueHost, and host our service Portal.CompanyName.com on a windows hosting like Microsoft Azure.&lt;/p&gt;&#xA;" OwnerUserId="14120" LastActivityDate="2015-10-20T01:00:15.200" Title="Can sub-domain be on a different hosting?" Tags="|routing|" AnswerCount="2" CommentCount="1" ClosedDate="2015-10-20T06:51:00.350" ContentLicense="CC BY-SA 3.0" />
  <row Id="23516" PostTypeId="2" ParentId="23515" CreationDate="2015-10-20T00:58:35.953" Score="6" Body="&lt;p&gt;Yes.  You can.  You are simply describing different A records.  You can have as many A records as you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can even host the domain and the subdomain on different DNS hosts.  This is referred to as DNS Delegation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, DNS is off topic on this Stack Exchange.  You'll get a much more thorough answer on &lt;a href=&quot;https://serverfault.com/&quot;&gt;ServerFault&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-10-20T00:58:35.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23517" PostTypeId="2" ParentId="23515" CreationDate="2015-10-20T01:00:15.200" Score="3" Body="&lt;p&gt;Yes, of course. That's part of DNS.&#xA;&lt;br /&gt;You can set different records for each sub-domain, including A, MX, etc..&#xA;&lt;br /&gt;&#xA;You would do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sub1.domain.com A xxx.xxx.xxx.xxx&#xA;sub2.domain.com A yyy.yyy.yyy.yyy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19873" LastActivityDate="2015-10-20T01:00:15.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23518" PostTypeId="2" ParentId="23503" CreationDate="2015-10-20T01:45:44.060" Score="1" Body="&lt;p&gt;You were doing fine until you got here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;40,000,000 bits/ 40,000 bits = 1000 bits &#xA;SWS = 1000 bits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The unit of measure of SWS is not bits, but frames.  So the question becomes, how big a binary number do you need to represent 1000 (frames)?  The answer, as you've stated, is 10 bits.  That's because it takes at least 10 bits to represent 1000 (2^10).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-20T01:45:44.060" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23519" PostTypeId="1" AcceptedAnswerId="23542" CreationDate="2015-10-20T03:52:56.143" Score="0" ViewCount="1128" Body="&lt;p&gt;I'm trying to configure an ASA 5506 to allow ICMP and RDP through on GbE 1/3 and 1/4.  These interfaces are internal only, as their own networks (20.10.10.0/24 and 30.10.10.0/24 -- non-internet destined or originating traffic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having trouble getting any machine on either network to ping each other, or pass RDP (20.10.10.5 -&gt; 30.10.10.5 doesn't work, for example).  I think I have messed something silly up, and am hoping someone could point me in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 9.5(1) &#xA;!&#xA;interface GigabitEthernet1/1&#xA; nameif outside&#xA; security-level 0&#xA; ip address dhcp setroute &#xA;!&#xA;interface GigabitEthernet1/2&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet1/3&#xA; nameif L2&#xA; security-level 0&#xA; ip address 20.10.10.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet1/4&#xA; nameif L3&#xA; security-level 0&#xA; ip address 30.10.10.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet1/5&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/6&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/7&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/8&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management1/1&#xA; management-only&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;ftp mode passive&#xA;object network obj_any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object service RDP&#xA; service tcp destination eq 3389 &#xA;access-list global_access extended permit object RDP any any &#xA;access-list global_access extended permit icmp any any &#xA;access-list global_access extended permit ip any any &#xA;access-list L2_access_in extended permit ip 20.10.10.0 255.255.255.0 30.10.10.0 255.255.255.0 &#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;mtu L3 1500&#xA;mtu L2 1500&#xA;no failover&#xA;no monitor-interface service-module &#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;icmp permit any L3&#xA;icmp permit any L2&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;!&#xA;object network obj_any&#xA; nat (any,outside) dynamic interface&#xA;access-group L2_access_in in interface L2&#xA;access-group global_access global&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;user-identity default-domain LOCAL&#xA;http server enable&#xA;http 192.168.1.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;service sw-reset-button&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpool policy&#xA;telnet timeout 5&#xA;no ssh stricthostkeycheck&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;&#xA;dhcpd auto_config outside&#xA;!&#xA;dhcpd address 192.168.1.5-192.168.1.254 inside&#xA;dhcpd enable inside&#xA;!&#xA;dhcpd address 30.10.10.5-30.10.10.254 L3&#xA;dhcpd enable L3&#xA;!&#xA;dhcpd address 20.10.10.5-20.10.10.254 L2&#xA;dhcpd enable L2&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect icmp &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19875" LastEditorUserId="8499" LastEditDate="2015-10-20T03:58:26.400" LastActivityDate="2015-10-20T15:03:48.737" Title="ASA unable to pass ICMP and RDP through internal interfaces" Tags="|cisco|routing|cisco-asa|firewall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23521" PostTypeId="2" ParentId="23512" CreationDate="2015-10-20T06:09:43.913" Score="0" Body="&lt;p&gt;SNMPv1 doesn't support the 64-bit counters, you must use SNMPv2c or SNMPv3 for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/26007-faq-snmpcounter.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/26007-faq-snmpcounter.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19274" LastActivityDate="2015-10-20T06:09:43.913" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23522" PostTypeId="1" AcceptedAnswerId="23526" CreationDate="2015-10-20T06:31:28.253" Score="2" ViewCount="758" Body="&lt;p&gt;I simulated a Denial-of-Service attack by connecting two virtual machines, i.e. attack and victim machine. The attack machine sends lots of traffic (http) against the victim machine running an application (web server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I run tshark at the victim. At the end of a monitoring session, I see a tshark message indicating that some packets were dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I know who dropped the packet: tshark, the application (web server), or the machine (in this case Ubuntu), or any other resource I haven't thought of? What sort of tests can I perform to verify that?&lt;/p&gt;&#xA;" OwnerUserId="19879" LastActivityDate="2015-10-22T09:09:33.597" Title="How to test which process that drops packets?" Tags="|wireshark|monitoring|packet-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23525" PostTypeId="1" AcceptedAnswerId="26046" CreationDate="2015-10-20T08:40:39.770" Score="2" ViewCount="952" Body="&lt;p&gt;I have a server hardware with installed windows server and DHCP server running on it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network is 192.168.0.0/24. A small issue we just faced is the client machines could not get an IP address from the dhcp server. I then checked that the server nic with the IP 192.168.0.250 which runs the dhcp server also had one more IP address in the 190/8 range. This was probably assigned for some testing purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once I removed the 190 IP the problem seemed to have been resolved. &lt;a href=&quot;https://support.microsoft.com/en-us/kb/197197&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft's dhcp troubleshooting document&lt;/a&gt; mentions this in the first scenario but says nothing about multiple IPs on the same NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just needed to confirm if that was the issue or something else is happening under the hood. I have this query also because on this same network I had some issues like random machines not pinging their default gateway but could very well ping and access the rest of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am no expert at wireshark but during a wireshark packet capture test i could see some STP packets and later learned that STP is disabled. The network layout to my best knowledge is as below.&lt;a href=&quot;https://i.stack.imgur.com/CGkU8.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CGkU8.jpg&quot; alt=&quot;network diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more doubt i have is that will those multiple links going to the storage in anyway cause network loops. I don't have the idea about their configuration as of now.&lt;/p&gt;&#xA;" OwnerUserId="15569" LastActivityDate="2016-01-19T07:10:04.610" Title="Some clients not getting an dhcp address and some don't ping the default gateway" Tags="|dhcp|wireshark|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23526" PostTypeId="2" ParentId="23522" CreationDate="2015-10-20T09:51:18.417" Score="0" Body="&lt;p&gt;&lt;code&gt;tsharck&lt;/code&gt; won't tell you about packet dropped by the web server or any other application or daemon. It won't tell about packet dropped at the source. It will tell only about packet received on the wire that could not be processed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets can be dropped at any of the following steps, if that's too much for that step to handle:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;packet receive by the network card driver&lt;/li&gt;&#xA;&lt;li&gt;kernel receiving and duplicating packet to send to tshark&lt;/li&gt;&#xA;&lt;li&gt;tshark reading packets (and filtering or decoding if either was requested)&lt;/li&gt;&#xA;&lt;li&gt;tshark output for processed packets, either to display or to disk.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To prevent packet drop, try to alleviate these steps, starting by the later ones. For example, try to&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;reduce packet processing by just dumping raw packets to disk, and to a fast enough disk (SSD speed or similar is recommended)&lt;/li&gt;&#xA;&lt;li&gt;when capturing to disk, to see if packet dropping is due to file writing not keeping up, check if capturing to &lt;code&gt;/dev/null&lt;/code&gt; reduce packet dropping. If it does, try again capturing to file, but with increased capture buffer using &lt;code&gt;-B &amp;lt;size in MiB&amp;gt;&lt;/code&gt; option, for example &lt;code&gt;-B 100&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;look for bottlenecks on your system (network card or driver overload, CPU or IRQ overload, etc.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="18916" LastEditorUserId="18916" LastEditDate="2015-10-22T09:09:33.597" LastActivityDate="2015-10-22T09:09:33.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23527" PostTypeId="1" AcceptedAnswerId="23539" CreationDate="2015-10-20T10:08:35.090" Score="3" ViewCount="10669" Body="&lt;p&gt;I am very new to networking and I am currently trying to get my head around the order things happen in relation to the OSI stack. I know that the Transport layer takes the data stream and converts it into segments before handing it to the Network layer where a header is added relating to the IP address creating a packet before passing this packet to the Data Link layer where a header and footer are added including the MAC addresses  creating a frame before finally being passed to the Physical layer in order to be converted into bits and sent along the network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The part I am struggling with is where in the process certain protocols are involved. For example, TCP performs the three way handshake, supposedly at layer 4 (Transport), does this mean that the SYN is sent to the destination machine at this layer before waiting for the ACK so that the data can be sent later on from the Physical layer? Does the SYN have to go down the stack to be sent by the Physical layer and in turn the ACK back up the stack of the host before the actual data is sent again by the Physical layer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example is ARP, when an ARP request is sent out by the Data Link layer in order to find the MAC address of the destination machine, is this sent out before the frame is created at layer 2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am unsure as to whether the only communication on the network is done at the Physical layer or if each layer interacts with the network relating to different protocols, as the data moves down the stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not been able to find a good video or diagram of the actual real world order that things happen so does anyone have a suggestion?&lt;/p&gt;&#xA;" OwnerUserId="19885" LastEditorUserId="17452" LastEditDate="2015-10-20T13:04:52.470" LastActivityDate="2015-10-20T14:37:54.657" Title="When does the three way handshake take place in relation to data flowing down the OSI stack?" Tags="|tcp|arp|osi|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23528" PostTypeId="1" CreationDate="2015-10-20T11:26:29.850" Score="3" ViewCount="16488" Body="&lt;p&gt;From what I understand, there are protocols like VTP and CDP that no matter what will use VLAN 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CDP and VTP are layer 2 meanwhile interface VLAN is layer 3. So, I wonder why I cannot delete interface VLAN 1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to use different VLAN from VLAN 1 for managing my switch but it is impossible because only interface VLAN 1 can turn up in layer-2 switch.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="8499" LastEditDate="2020-01-10T09:12:16.553" LastActivityDate="2020-01-10T09:12:16.553" Title="Remove interface VLAN 1 in cisco 2960 switch" Tags="|cisco|switch|vlan|cisco-catalyst|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23529" PostTypeId="2" ParentId="23528" CreationDate="2015-10-20T11:42:39.610" Score="1" Body="&lt;p&gt;Remember, by default, VLAN 1 is associated with all the physical interfaces, Default VLAN (for access ports) and Native VLAN (for IEEE 802.1Q&#xA;trunks) on the switch. The thing that people does is to unassociated with the required interface(in this case, VLAN 1 ):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switchport trunk allowed vlan remove &quot;VLAN_TO_REMOVE&quot;(to remove a vlan from a trunk port)&#xA; no switchport access vlan 1(to remove a vlan from access port)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only way that one Vlan interfaces came UP is to associated with some interface of that switch, this is the only way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess, this is the problem that you have. Here you can find the datasheet for your 2690 switch: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_25_fx/configuration/guide/2960scg.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_25_fx/configuration/guide/2960scg.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are supported up to 4096 Vlan ID on that switch, on the way that you can do what you are asking, i guess, first you need to clear the capabilities of your equipment, and next, configure what you want.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2015-10-20T11:57:13.580" LastActivityDate="2015-10-20T11:57:13.580" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="23530" PostTypeId="1" AcceptedAnswerId="23534" CreationDate="2015-10-20T11:59:13.203" Score="1" ViewCount="162" Body="&lt;p&gt;We are using a router to connect multiple devices. We have a server connected to the Internet that will continually ping a website to check if there is still an Internet connection. If there is no Internet connection, we will cut the connection of those devices connected to the server as a precaution since our system requires an Internet connection to work. The computers connected to the server will constantly ping it, and if the connection is cut will run a program to stop anything from happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our first idea was to release the IP address in the server on the LAN interface if there is no internet connection, and then renew it when the connection returns. This will terminate the connection between the server and other computers, but our server's LAN IP address is statically assigned for added security measures, and it cannot be released and renewed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option for us is to disable the LAN interface on the server so that the other computers cannot ping it, but we are looking for a better solution, or is this the best solution for our problem?&lt;/p&gt;&#xA;" OwnerUserId="19747" LastEditorUserId="8499" LastEditDate="2015-10-20T23:51:08.920" LastActivityDate="2015-10-20T23:55:16.217" Title="How do I disable a connection in a server when the Internet connection is lost" Tags="|router|lan|ping|network-access|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="23532" PostTypeId="2" ParentId="23527" CreationDate="2015-10-20T12:18:42.920" Score="1" Body="&lt;p&gt;First, you really need to find some good books to clear your concepts, i recommend you Computers Networks, by Tanenbaum, the best of best for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, the OSI model look some like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Equipment1       Equipment2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Application ---  Application &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presentacion --  Presentacion&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Session   -----  Session&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transport -----  Transport&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network   -----  Network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data Link -----  Data Link&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Physical ******  Physical&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The principle is that the upper layers send the data to the lower layers, until de physical layer, that is on charge to transmit the info in form of ligth, or electromagnetic waves. But, all the upper layer only spoke with it same on the other equipment. To transmit data, by eg: from the lower middle of equipment 1, segments of data are created on the transport layer, and passes to the network layer, when are added some things and the IP header, and then pakets area created with that info. Then it passes to de Data Link layer where occurred some proccess and frames is the result, that are passed to the Physical Layer where all of that are transmitted like BITS, &quot;zeros and ones&quot;. On the other side, the invert proccess is carried out, and everyone of the Layer proccess his info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SYN that you are asking is send to the other machine and until is not proccesed, that machine not send it SYN,ACK to the origin machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, you can read this in one easily form on the Tanenbaum book&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-20T12:18:42.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23533" PostTypeId="2" ParentId="23527" CreationDate="2015-10-20T12:41:08.200" Score="1" Body="&lt;p&gt;it seams like confusing in network layers functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;first of all&lt;/em&gt;&lt;/strong&gt; you must know that layer 3 add information regards to both source and destination IP not destination only and Layer 2 add information regards to both source and destination mac-address not destination only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Second&lt;/em&gt;&lt;/strong&gt; when you speak about layer get some headers and footers added to be transformed to other layer you actually speaking about &lt;strong&gt;&lt;em&gt;encapsulation&lt;/em&gt;&lt;/strong&gt; , but 3 hand check which is occurred in layer 4 is actually layer to layer communication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vPDbB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vPDbB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;third&lt;/em&gt;&lt;/strong&gt; regarding your question about layer 4 TCP communication establishment which is as i told you before (layer to layer communication) . this communication contains two parts , one regarding the communication establishment (SYC,SYNACK,ACK) and other is the segment of data which need to be transferred itself  and both walk the same way (encapsulating in layer 3 header and footer then layer 2 then layer 1 header and footer)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IL8gK.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IL8gK.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;last there are three things you must know (encapsulation ,decapsulation and layer to layer communication ) . each layer has a lot of protocols can create and understand ( ex. ARP request is layer 3 function use both layer 3 protocol &lt;strong&gt;IP&lt;/strong&gt; and layer 2 protocol &lt;strong&gt;&lt;em&gt;MAC-ADDRESS&lt;/em&gt;&lt;/strong&gt;) &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-20T12:41:08.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23534" PostTypeId="2" ParentId="23530" CreationDate="2015-10-20T13:39:46.693" Score="2" Body="&lt;p&gt;i guess you refer to topology like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/f37he.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f37he.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to disable user access to the server when the Internet is down, you may create patch file to change the IP address of the network card with the &lt;strong&gt;&lt;em&gt;NETSH&lt;/em&gt;&lt;/strong&gt; command. &lt;em&gt;Make use of this link &lt;a href=&quot;https://technet.microsoft.com/en-us/library/bb490943.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;NETSH&lt;/a&gt;&lt;/em&gt;, and create aother patch to restore the original IP address when the Internet connection is restored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using some routers, it may accomplished using IP SLA which is not supported by your router model.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2015-10-20T23:55:16.217" LastActivityDate="2015-10-20T23:55:16.217" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23535" PostTypeId="2" ParentId="23528" CreationDate="2015-10-20T13:41:03.430" Score="1" Body="&lt;p&gt;Link-local protocols, such as CDP, don't actually use a VLAN, which is really an end-to-end layer-2 construct.  The frames that CDP uses are untagged so some people consider them in the native VLAN, but they can never go beyond the next hop because they are confined to the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a frame is untagged, and can't be propagated beyond the next hop, it is really in a VLAN? No, because if it was in the native VLAN it could be propagated to the other ports in that same VLAN, and that is not the case for the link-local protocols. The fact is that you could have no native VLAN set for a trunk and remove VLAN 1 from the list of allowed VLANs on the trunk, and CDP,etc. will still cross to the next hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We do what you want to do all the time. You can't actually remove the layer-2 VLAN 1, but not allowing VLAN 1 across the trunk essentially disables it. You can restrict the trunk from using VLAN 1, and don't define a native VLAN for the trunk. You can remove the layer-3 SVI for VLAN 1, and add an SVI for whichever VLAN you wish to use to manage the switch. The SVI can have the IP address of the switch that can be used for switch management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 1, as the default VLAN, is now considered a security risk, as are any native VLANS. After removing VLAN 1, and any native VLAN, from the trunk, you have crippled the ability of an attacker from using a default that is present in most networks. Untagged traffic will not be propagated beyond the link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-20T23:37:40.353" LastActivityDate="2015-10-20T23:37:40.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23536" PostTypeId="2" ParentId="19768" CreationDate="2015-10-20T13:48:05.337" Score="2" Body="&lt;p&gt;Download The clear house modems specs before they close the website.&#xA;These modems are made by a company in tiawan, I think the name is GENECOM,&#xA;They sell these modems worldwide to different WIMAX operators.&#xA;They are reprogrammed by a simple download. You may be able to sell your&#xA;modem on ebay to a foreign customer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I reused the clear telephone adapter with several clients by reprogramming,&#xA;they were made by linksys. Clear sold them for $10 each, Linksys sold them&#xA;for $40.&#xA;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="19893" LastEditorUserId="17452" LastEditDate="2015-10-20T15:03:26.427" LastActivityDate="2015-10-20T15:03:26.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23538" PostTypeId="2" ParentId="23504" CreationDate="2015-10-20T13:56:10.223" Score="1" Body="&lt;p&gt;You can use Wireshark to capture network traffic on an interface, but some adapters will not show you frames other than your own, and without the physical layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're running &lt;strong&gt;&lt;em&gt;Linux&lt;/em&gt;&lt;/strong&gt;, you may want to look at cards with Atheros chipsets, which have a good reputation. If you run &lt;strong&gt;&lt;em&gt;Windows&lt;/em&gt;&lt;/strong&gt;, AirPCAP adapters will be good as well.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2015-10-20T23:44:03.110" LastActivityDate="2015-10-20T23:44:03.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23539" PostTypeId="2" ParentId="23527" CreationDate="2015-10-20T14:12:33.543" Score="5" Body="&lt;p&gt;Sometimes, I wish they'd stop teaching the OSI model.  It seems to confuse more than it helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we say that layers communicate with each other, we mean the data created by a particular layer (say, transport) on host A is processed by the same layer on host B.  This is a &lt;strong&gt;logical&lt;/strong&gt; connection.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual data (in this case, the segment containing the SYN flag) is encapsulated in the Network PDU (IP packet), then encapsulated in the data-link PDU (Ethernet), then finally transmitted on the Ethernet cable (Physical layer).  Host B reverses this process, unencapsulating the PDU at each layer until it reaches the transport layer. The transport layer processes the SYN flag and creates a new PDU containing the SYN, ACK flags.  Then it sends it to A using the same encapsulation process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way data is actually sent from one host to another is via the physical wire.  Layer to layer communication is just a mental construct. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-20T14:12:33.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23541" PostTypeId="2" ParentId="23525" CreationDate="2015-10-20T14:40:41.780" Score="2" Body="&lt;p&gt;Loops may be the root cause. A high percentage of the network issues is caused by a loop, so you must make sure you network is loop free. You can use a free tool which can scan and draw connectivity diagram (e.g. Spiceworks, NMAP, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eeFNf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eeFNf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2015-10-20T23:19:50.283" LastActivityDate="2015-10-20T23:19:50.283" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23542" PostTypeId="2" ParentId="23519" CreationDate="2015-10-20T15:03:48.737" Score="2" Body="&lt;p&gt;By default, a Cisco ASA does not permit traffic between two interfaces of the same security-level (L2 is 0 and L3 is 0).  To enable traffic between the same security-levels, (SEE WARNING BELOW FIRST) use the &quot;&lt;em&gt;same-security-traffic permit inter-interface&lt;/em&gt;&quot; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;WARNING:&lt;/strong&gt;  With your current config, traffic from the outside interface will now be allowed into the L2 and L3 interfaces after running the command above because the Outside, L2 and L3 interfaces are at security-level 0.  First, change the L2 and L3 interfaces to a higher security level so that traffic from the outside interface cannot get to L2 and L3 unless an Access-List permits it - especially since you've stated there are no destinations on L2 and L3 for the outside world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of the security level as a hill where 0 is the bottom of the hill and 100 is the top of the hill.  Now if you were a stream of water, you could not flow up the hill, but you could flow down it.  Security levels act this way so that the ASA automatically prevents the traffic from the outside interface (security level 0) from getting to your inside interface (security level 100) unless allowed explicitly by an access-list.  However, traffic can automatically flow down the hill.  In other words traffic from security level 100 to security level 0 is automatically permitted unless otherwise stated in an access-list.  So an interface with a security level of 50 could not automatically send traffic to an interface with a security level of 100 but could to an interface with a security-level of 0. &lt;/p&gt;&#xA;" OwnerUserId="18849" LastActivityDate="2015-10-20T15:03:48.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23544" PostTypeId="2" ParentId="20095" CreationDate="2015-10-20T15:35:32.770" Score="0" Body="&lt;p&gt;If it's a /24, it means all of the first three octets are used up with 1s, 255.255.255.0 is the subnet mask that matches /24 because all 8 bit in the first three octets are used, 8 x 3 = 24. With the first octet in this network being 192 this is clearly class C. Therefore, there can be no manipulation of the third octet within any particular network. What he might be doing is setting up more than one class C network, each one separate and distinct, needing a router in order to communicate between networks. It seems to me he is just choosing .10 increments to make room for growth.&#xA;Access my subnetting videos on youtube and learn subnetting the easy way.&lt;/p&gt;&#xA;" OwnerUserId="19896" LastEditorUserId="33" LastEditDate="2015-10-20T16:13:50.870" LastActivityDate="2015-10-20T16:13:50.870" CommentCount="20" ContentLicense="CC BY-SA 3.0" />
  <row Id="23545" PostTypeId="1" CreationDate="2015-10-20T16:12:47.300" Score="1" ViewCount="525" Body="&lt;p&gt;Have any of you had any experience using PFSense and Auto Scaling in AWS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does PFSense have support for a user-data field? [1] &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way of running start-up custom scripts inside PFSense?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html&quot; rel=&quot;nofollow&quot;&gt;http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19898" LastEditorUserId="775" LastEditDate="2021-05-04T23:33:11.713" LastActivityDate="2023-04-05T19:47:46.340" Title="PFSense on AWS with ASG" Tags="|pfsense|aws|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23546" PostTypeId="2" ParentId="23513" CreationDate="2015-10-20T17:51:59.857" Score="1" Body="&lt;p&gt;You need to assign name for the interface, like below example :&#xA;Configure t&#xA;Interface gigaethernet 0/0&#xA; Name inside &#xA; Security-level 100&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2015-10-20T17:51:59.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23547" PostTypeId="2" ParentId="23513" CreationDate="2015-10-20T18:16:58.890" Score="1" Body="&lt;p&gt;Configure below commands in the Interface that you want to bring up&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;nameif inside&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="19631" LastActivityDate="2015-10-20T18:16:58.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23548" PostTypeId="1" CreationDate="2015-10-20T18:53:08.167" Score="1" ViewCount="324" Body="&lt;p&gt;I am having issue with setting up my Radius server to authenticate before going to the router. I am able to do a test from the router successfully but once I exit the router and log in with my Windows Active Directory group login (same one used during the test inside the router), it says that the password is incorrect. Below are few screen shots of what I have configure. Is there something I am missing? Please advise. Any help is appreciated! Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/re9IO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/re9IO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OA3eN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OA3eN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NToEz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NToEz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19376" LastActivityDate="2016-09-12T08:06:53.530" Title="Able to test AAA to Radius Server from router but unable to log into Router with A.D" Tags="|cisco-ios|cisco-commands|aaa|radius|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23550" PostTypeId="1" CreationDate="2015-10-20T20:32:33.097" Score="2" ViewCount="4244" Body="&lt;p&gt;I am trying to capture HTTPS traffic between a client (windows machine) and a server. I would like to do this before the traffic is encrypted as I would like to analyse its contents. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there easy way to do this on the local machine? . For example, could I set up a local HTTP proxy to achieve this? &lt;/p&gt;&#xA;" OwnerUserId="16717" LastEditorUserId="8499" LastEditDate="2018-02-16T04:03:56.993" LastActivityDate="2018-05-17T05:12:08.663" Title="Capturing un-encrypted HTTPS traffic using wireshark" Tags="|wireshark|" AnswerCount="2" CommentCount="8" ClosedDate="2018-05-17T05:15:03.803" ContentLicense="CC BY-SA 3.0" />
  <row Id="23551" PostTypeId="1" AcceptedAnswerId="23552" CreationDate="2015-10-20T20:56:51.870" Score="0" ViewCount="210" Body="&lt;p&gt;I'm so used to using &lt;code&gt;conf t&lt;/code&gt; to get into configuration mode, but it doesn't work in &quot;Cisco IOS Software, C3700 Software (AP3G2-RCVK9W8-M), Version 15.3(3)JA3, RELEASE SOFTWARE (fc1)&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the equivalent command to get into the configuration mode?&lt;/p&gt;&#xA;" OwnerUserId="15721" LastEditorUserId="8499" LastEditDate="2015-10-20T22:45:27.190" LastActivityDate="2015-10-20T22:45:27.190" Title="IOS Configure Terminal equiv in C3700 Software" Tags="|cisco|cisco-ios|access-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23552" PostTypeId="2" ParentId="23551" CreationDate="2015-10-20T21:02:14.227" Score="2" Body="&lt;p&gt;Lightweight Wireless Access Points (LWAP) such as the C3700 are configured by the controller, but if you want to access the configuration mode on the LWAP you must first type &lt;strong&gt;&lt;em&gt;debug capwap console cli&lt;/em&gt;&lt;/strong&gt;. Without this, an LWAP will not accept the &lt;code&gt;conf t&lt;/code&gt; command. If you want to convert it to autonomous, follow this link &lt;a href=&quot;http://mrncciew.com/2012/10/20/lightweight-to-autonomous-conversion/&quot; rel=&quot;nofollow&quot;&gt;lightweight-to-autonomous-conversion&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2015-10-20T21:44:37.107" LastActivityDate="2015-10-20T21:44:37.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23554" PostTypeId="2" ParentId="23550" CreationDate="2015-10-20T22:41:25.807" Score="0" Body="&lt;p&gt;If this traffic is not encrypted before it gets to an external firewall, it is possible to capture network traffic either as it leaves the PC or just after it leaves the PC before the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the traffic is encrypted by your application, there are proxies that can decrypt/encrypt HTTPS traffic in order to change the source address of the traffic. Whether or not a particular proxy lets you capture the decrypted traffic before it re-encrypts is something you would need to research. Large companies often use these sorts of proxies, and some allow the company to do this in order to snoop on employee web use. These are typically high-end, dedicated proxies that require lots of CPU horsepower.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to do your own research to see if there is a product that fits your needs. Product/resource recommendations are specifically off-topic for this forum.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-20T22:41:25.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23555" PostTypeId="1" CreationDate="2015-10-21T02:38:03.270" Score="2" ViewCount="1136" Body="&lt;p&gt;I have an EIGRP issue hopefully someone can help me with. I have a 2821 router with three static routes to VLANs that exist on a switch it's connected to. I want to share these routes with the rest of my network. I thought a &quot;redistribute static&quot; command would do this, but it does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can run a &quot;show ip eigrp topology  &quot; on the router and other equipment in the eigrp network and the network information comes up, but I can't ping any of the VLANs from anything but the router. My EIGRP statement also includes &quot;no auto-summary&quot; but that does not help either. Below is the results of the &quot;show ip eigrp topology&quot; command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#sh ip eigrp XXX top 10.X.47.0 255.255.255.0&#xA;IP-EIGRP (AS XXX): Topology entry for 10.X.47.0/24&#xA;State is Passive, Query origin flag is 1, 1 Successor(s), FD is 28160&#xA;Routing Descriptor Blocks:&#xA;10.X.0.15, from Rstatic, Send flag is 0x0&#xA;Composite metric is (28160/0), Route is External&#xA;  Vector metric:&#xA;    Minimum bandwidth is 100000 Kbit&#xA;    Total delay is 100 microseconds&#xA;    Reliability is 255/255&#xA;    Load is 1/255&#xA;    Minimum MTU is 1500&#xA;    Hop count is 0&#xA;  External data:&#xA;    Originating router is 10.X.X.3 (this system)&#xA;    AS number of route is 0&#xA;    External protocol is Static, external metric is 0&#xA;    Administrator tag is 0 (0x00000000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19266" LastActivityDate="2015-10-22T20:29:48.757" Title="EIGRP redistribute static issue" Tags="|cisco|eigrp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23556" PostTypeId="2" ParentId="23555" CreationDate="2015-10-21T03:21:17.803" Score="2" Body="&lt;p&gt;It sounds like you redistributed static without setting a metric.  By default, routes redistributed into EIGRP have a metric of &quot;unreachable&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You either need to specify a metric for the static routes in your &quot;redistribute static&quot; command, or you need to specify a default metric using the &quot;default-metric&quot; command.&lt;/p&gt;&#xA;" OwnerUserId="155" LastEditorUserId="155" LastEditDate="2015-10-21T14:55:54.353" LastActivityDate="2015-10-21T14:55:54.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23557" PostTypeId="1" AcceptedAnswerId="23559" CreationDate="2015-10-21T04:35:38.170" Score="1" ViewCount="136" Body="&lt;p&gt;I'm noticing large spikes of packet loss when using maximum of my 30/1 HFC cable connection. Is that normal, or should I talk to my ISP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. when downloading something at close to 30mbps or uploading at 1mbps all machines show sporadic packet loss and pings increase from 30/40ms to 90/120.&lt;/p&gt;&#xA;" OwnerUserId="7940" LastActivityDate="2015-10-21T06:46:17.383" Title="Should using full bandwidth cause packet loss and latency (domestic cable service)?" Tags="|packet-loss|cable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23558" PostTypeId="1" CreationDate="2015-10-21T05:52:42.347" Score="3" ViewCount="247" Body="&lt;p&gt;I have a Nokia and a Cisco switch, connected with one RJ cable. I've configured the switch in trunk mode, and the port on the Nokia with some VLAN number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have a ping between them, I don't think there should be a trunk configuration on the Nokia, since I couldn't find any info on that issue on the Internet or the official CP documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I right in not configuring anything that is &quot;trunk&quot; on the Nokia, or is there something that I'm missing?&lt;/p&gt;&#xA;" OwnerUserId="13770" LastEditorUserId="8499" LastEditDate="2016-03-19T17:32:19.743" LastActivityDate="2018-01-09T08:01:26.587" Title="No ping between Nokia (IPSO) and Cisco switch through trunk link" Tags="|switch|vlan|firewall|ping|trunk|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23559" PostTypeId="2" ParentId="23557" CreationDate="2015-10-21T06:46:17.383" Score="3" Body="&lt;p&gt;Packets get dropped by interfaces when their queues are full but the packets keep coming in.  This is likely to happen when a device has packets arriving on a faster link than the one they are leaving on.&lt;/p&gt;&#xA;&lt;p&gt;TCP congestion control algorithms use packet loss as an indicator that the link is overloaded.  The hosts communicating across your HFC link don't necessarily know that it's 30/1. They continue to send more and more data at a time until something goes wrong, and that's how they know to back off a bit.&lt;/p&gt;&#xA;&lt;p&gt;You can read more in &lt;a href=&quot;https://en.wikipedia.org/wiki/TCP_congestion-avoidance_algorithm&quot; rel=&quot;nofollow noreferrer&quot;&gt;This Wikipedia article on the topic&lt;/a&gt; and also in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5681&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC5681&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As for your increased RTT during heavy load, I'd expect that's due to additional queuing delay on the interfaces connected to the congested link.&lt;/p&gt;&#xA;&lt;p&gt;I'd say that looks like normal behaviour for an at-capacity link.&lt;/p&gt;&#xA;&lt;p&gt;If the packet loss and latency is causing issues, I'd suggest setting up QoS. This essentially lets important packets skip the queue.&lt;/p&gt;&#xA;" OwnerUserId="11948" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-10-21T06:46:17.383" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23563" PostTypeId="2" ParentId="23558" CreationDate="2015-10-21T08:25:47.857" Score="2" Body="&lt;p&gt;My problem was that I forgot the command: &lt;code&gt;switchport mode trunk&lt;/code&gt; on the Cisco switch.&lt;/p&gt;&#xA;" OwnerUserId="13770" LastEditorUserId="8499" LastEditDate="2016-03-19T17:32:38.337" LastActivityDate="2016-03-19T17:32:38.337" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23564" PostTypeId="2" ParentId="23508" CreationDate="2015-10-21T09:06:16.437" Score="2" Body="&lt;p&gt;A segment longer that the receiving window &lt;strong&gt;must&lt;/strong&gt; be discarded, otherwise the receiver could get in a buffer overflow, and that could be exploited to hack the receiver's system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The receiver is constantly letting know its &lt;em&gt;receiving window&lt;/em&gt; value to the sender, so during normal operation the sender obeys that restriction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Receiving a larger segment is a violation of the flow control rules and that's why it should be ignored.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-10-21T09:06:16.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23565" PostTypeId="2" ParentId="23465" CreationDate="2015-10-21T09:20:00.623" Score="2" Body="&lt;p&gt;The mentioned protocols are &lt;em&gt;signalling and control protocols&lt;/em&gt;, the voice data isn't transported using them. Its main feature is manage the connection and hangup of multimedia sessions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of VoIP using SIP, most of the systems rely on RTP to transport voice data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;RTP is the appropiate transport for real-time data such as audio or video. RTP does not control resource reservation and can't guarantee quality-of-service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RTP adds up to 128 bits to the data, where the most important fields added are a &lt;em&gt;sequence number&lt;/em&gt; and a &lt;em&gt;timestamp&lt;/em&gt;. Using both of them the receiver knows if the package is getting in order, later, etc.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-10-21T09:20:00.623" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23566" PostTypeId="1" AcceptedAnswerId="30864" CreationDate="2015-10-21T09:45:21.453" Score="12" ViewCount="24509" Body="&lt;p&gt;What are EUI-48 and EUI-64 addresses formed and used? Give me examples.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are MA-L, MA-S and MA-M assignments?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read &lt;a href=&quot;https://standards.ieee.org/develop/regauth/tut/eui48.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://standards.ieee.org/develop/regauth/tut/eui48.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://standards.ieee.org/develop/regauth/tut/eui64.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://standards.ieee.org/develop/regauth/tut/eui64.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, understood nothing.&lt;/p&gt;&#xA;" OwnerDisplayName="user15062" LastEditorUserId="89165" LastEditDate="2023-04-03T21:16:39.410" LastActivityDate="2023-04-03T21:16:39.410" Title="What are EUI-48 and EUI-64?" Tags="|ethernet|mac-address|standardisation|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23568" PostTypeId="1" CreationDate="2015-10-21T10:51:21.527" Score="3" ViewCount="363" Body="&lt;p&gt;I configured a Cisco H323 Gateway between 2 CUCMs connected via Intercluster trunk(non-gatekeeper controlled) Dial peer configuration is :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dial-peer voice 10001 voip  &#xA;destination-pattern 3971...   &#xA;session target ipv4:10.10.10.1    &#xA;session transport tcp    &#xA;incoming called-number .    &#xA;dtmf-relay h245-alphanumeric    &#xA;codec g711ulaw    &#xA;!   &#xA;dial-peer voice 10002 voip   &#xA;destination-pattern 2971...    &#xA;session target ipv4:10.10.10.2    &#xA;session transport tcp    &#xA;incoming called-number .    &#xA;dtmf-relay h245-alphanumeric    &#xA;codec g711ulaw   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Call entered the gateway and not routed to the destination.     &lt;/p&gt;&#xA;" OwnerUserId="19916" LastEditorUserId="17452" LastEditDate="2015-10-21T14:55:46.073" LastActivityDate="2015-12-20T15:43:36.233" Title="H323 Gateway configuration" Tags="|cisco|network-core|cisco-voip|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23571" PostTypeId="1" CreationDate="2015-10-21T13:01:36.257" Score="7" ViewCount="2711" Body="&lt;p&gt;I have two questions which I will separate to avoid confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I intend to build a network based on redundancy.  There will be two pieces of every device, sometimes more than 2 such as NIC cards.  I drew up this picture for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LsRmB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LsRmB.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see I have &lt;strong&gt;two switches&lt;/strong&gt;,&lt;strong&gt;one router&lt;/strong&gt; and &lt;strong&gt;two servers&lt;/strong&gt;.  Each server will run Windows 2012 R2 Teaming,(Teams of 2),Each Team will be on its own VLAN (Please note this may change as the question 2 talks about it).  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;My first question is, what type of logic does the NICs have for load balancing? , Do I have to Stack the switches together for it to work? , Can I just connect two ports of the router to each of the switches and NOT stack them (the switches)? , Will this then send traffic from &lt;strong&gt;switch A&lt;/strong&gt; to &lt;strong&gt;router&lt;/strong&gt; to &lt;strong&gt;switch B&lt;/strong&gt;? ,I would prefer them to be completely independent, so if a switch fails or a NIC fails won't be a problem.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;My second question is about VLAN'ing. We have multiple independent processes running on the network (about 8). Where we would prefer that server A doesn't talk to server B if its not needed. This is making me create 8 different VLANs, and have each machine or VM have an IP address specifically on the VLAN. One or two computers need all 8. (There is a lot more than 2 servers, but for the picture sake, I only drew two for the example).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is there a better way to do this?  We are going to have the team VPN into the network, and I want them to be able to get to every switch/pc/vm, so I guess I would need another Administrator VLAN, adding another IP and another VNIC to each machine. There has to be a better way to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all,&lt;/p&gt;&#xA;" OwnerUserId="19755" LastEditorUserId="21926" LastEditDate="2016-01-16T16:46:17.920" LastActivityDate="2016-02-11T22:37:40.130" Title="Load Balance NIC, Switch and Router (Redundancy)" Tags="|routing|vlan|ethernet|ipv4|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23572" PostTypeId="2" ParentId="23568" CreationDate="2015-10-21T13:36:11.677" Score="1" Body="&lt;p&gt;if the call can inter the VG from the two sides but can't out you may need to add the next lines to your configurations :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# voice service voip &#xA;Router(config-voi-serv)# allow-connections h323 to h323&#xA;Router(config-voi-serv)# allow-connections sip to sip&#xA;Router(config-voi-serv)# allow-connections h323 to sip&#xA;Router(config-voi-serv)# allow-connections &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-21T13:36:11.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23577" PostTypeId="2" ParentId="23508" CreationDate="2015-10-21T17:21:26.327" Score="0" Body="&lt;p&gt;Segment size(Size of a segment) is different from window size(Size of unacknowledged data).. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Segment size will be based on MSS(Maximum Segment Size of a sender/receiver) and path MTU where as window size might be larger than that and it don't have dependency on Segment size.. In that case if window size is larger, the data will be sent as multiple segments to accomplish the window.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Default Path MTU size is 1500 bytes if you take Ethernet (including all headers and payloads; MSS - 1460 bytes, Header and footer - 40bytes ) thus a packet size wont exceed this size..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ietf.org/rfc/rfc813.txt&quot; rel=&quot;nofollow&quot;&gt;RFC813&lt;/a&gt;  describes the stratagies of TCP windows&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me explain with values. The numbers here are in bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MSS= 1460 bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tcp Window = 56K = 56000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the sender/reciever accepts the TCP negotiation session with these values and if there is a requirement for a large  data transfer, the sender will do like this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each packet size will be 1500 bytes - Ethernet path MTU ( 1460 -MSS + 20 Byts IP header + 20 bytes TCP header)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At a time it will send 37 packets of 1500 bytes + 1 packet of 500bytes ( 1500bytes X 37 packets + 500bytes X 1packet = 56000) to complete the window of the size 56K.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it will wait for the acknowledment from receiver. Once it receives ACK, it can send again 56k Bytes as explained above&lt;/p&gt;&#xA;" OwnerUserId="19631" LastActivityDate="2015-10-21T17:21:26.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23578" PostTypeId="1" CreationDate="2015-10-21T18:04:51.467" Score="1" ViewCount="786" Body="&lt;p&gt;Looking for best practices and feedback on whether to use fiber or radio (&quot;air fiber&quot;) in a certain situation ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;=== BACKGROUND ===&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--- Project involves providing Internet access to several hundred endpoints in a residential/campus type of setting (approx 50 acres)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--- Endpoints will have a WiFi hot spot, VOIP phone, and TV&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--- Typical bandwidth requirement at each endpoint is 5-10 Mbps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--- For TV, amenable to a pure OTT video solution (e.g., video over TCP/IP HLS) versus multicast﻿&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--- Have proposals from several providers to use a Gigabit Ethernet solution with a star topology connected via single mode fiber (runs up to 1/4 mile or more)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--- But have also seen solutions using point-to-point radio instead of fiber at a fraction of the price of fiber proposal (e.g., Ubiquiti airFiber)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;﻿=== QUESTION ===&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When/is point-to-point radio a viable alternative to fiber distribution in a case like this?  What are the considerations and trade offs in terms of performance, quality of service, robustness, and long term value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any feedback!﻿﻿&lt;/p&gt;&#xA;" OwnerUserId="19924" LastActivityDate="2015-10-22T19:02:20.207" Title="Fiber vs. Point-to-point radio for campus network" Tags="|wireless|ethernet|design|fiber|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23579" PostTypeId="2" ParentId="23578" CreationDate="2015-10-21T18:47:45.357" Score="0" Body="&lt;p&gt;Your clients suffer from bandwidth limitations should wireless (half-duplex or full-duplex) be used.&#xA;That is considered a bad solution as the wireless will be subject to many sorts of interference including weather and idiots who think it is fun to disrupt or piggy back on your wireless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whereas with single-mode fibre you can easily upgrade from 1G to 10G or more when there is need for it.&#xA;It is way more secure than wireless, scalable and you only have to worry about backhoes digging where they shouldn't. Which is rare but does happen.&#xA;Go with fibre, it is the proper solution.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="4565" LastEditDate="2015-10-22T19:02:20.207" LastActivityDate="2015-10-22T19:02:20.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23580" PostTypeId="2" ParentId="23578" CreationDate="2015-10-21T20:35:31.630" Score="4" Body="&lt;p&gt;In general, point-to-point wireless is a &quot;last resort&quot; solution -- either due to cost or lack of access to infrastructure (eg. right of way.) Over longer distances, it can be harder to setup (eg. aim.) And it will suffer from environmental factors (heat, rain, snow, birds, squirrels, etc.) The equipment will be rather expensive, but installation costs will be low. (nailing a dish to the side of a building isn't labor intensive)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiber (single-mode) is a much more robust, and future-proof, solution. Bandwidth is only limited by what you attach to it. Fiber is fairly cheap, and plentiful these days. The main expense is in installation -- conduits, trenching, etc. But once done, fiber will last decades, and you'll have conduits to quickly add more when needed.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-21T20:35:31.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23583" PostTypeId="2" ParentId="23571" CreationDate="2015-10-21T22:36:55.847" Score="2" Body="&lt;p&gt;it seams like we talk about some thing like that &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3g4uD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3g4uD.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;My first question is, what type of logic does the NICs have for load balancing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Logic design of load balancing is like the diagram ,each VM should has at lest two VNIC's &lt;em&gt;(you may map each VNIC to physical NIC on th e server)&lt;/em&gt; which will be teamed as per your design and each VNIC will connected to different switch ,and port aggregation on the level of switches should be configured (which is call etherchanel or port-group).the etherchanel created on switches is connecting individual VM and assigned to VLAN as well.for example you could configure teaming between VNICs to use LACP as port aggregation and use mac-address hashing for example as a load balance mechanism and from the switch side you can configure ports connected to this VNICs as port-group and configure it as a LACP port aggregation and assign this port-group a VLAN. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Do I have to Stack the switches together for it to work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes sure stack cause the two switches came as one switch which will allow you to configure etherchanel on the two switches.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I just connect two ports of the router to each of the switch and NOT stack the switches?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;NO connecting the two switches to the router wont solve this issue you must stack both of them like the next diagram &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ucsNF.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ucsNF.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Will this then send traffic from Switch A to Router to Switch B?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In this case you have full redundancy on the level of servers and the level of switches so there is no fear from any switch to came down or any NIC came down the only thing you may fear of that the server it self came down.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a better way to do this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The best way to accomplish this task is to configure the 8 vlan as a layer 2 on your switches and as layer 3 on the router and apply access list configuration on the router which will control the access of each host from vlan to another &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="33" LastEditDate="2015-11-21T18:43:56.730" LastActivityDate="2015-11-21T18:43:56.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23584" PostTypeId="1" AcceptedAnswerId="23585" CreationDate="2015-10-21T23:50:04.827" Score="5" ViewCount="18825" Body="&lt;p&gt;I've configured a Cisco ASA 5506-X for a customer of mine and I'm having trouble successfully passing traffic round-trip to the remote network.  The VPN tunnel connects successfully according to 'show crypto ipsec sa'.  Below is a copy of the scrubbed configuration I'm using currently:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: &#xA;: Serial Number: XXXXXXXXXXX&#xA;: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)&#xA;:&#xA;ASA Version 9.4(1) &#xA;!&#xA;hostname ciscoasa01&#xA;enable password XXXXXXXXXXXXXXX encrypted&#xA;names&#xA;!&#xA;interface GigabitEthernet1/1&#xA; nameif outside&#xA; security-level 0&#xA; ip address 172.16.10.163 255.255.255.248 &#xA;!&#xA;interface GigabitEthernet1/2&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.2.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet1/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/4&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/5&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/6&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/7&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/8&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management1/1&#xA; management-only&#xA; nameif management&#xA; security-level 100&#xA; no ip address&#xA;!&#xA;ftp mode passive&#xA;clock timezone CST -6&#xA;clock summer-time CDT recurring&#xA;dns domain-lookup outside&#xA;dns domain-lookup inside&#xA;dns server-group DefaultDNS&#xA; name-server 8.8.8.8&#xA; name-server 4.2.2.2&#xA;same-security-traffic permit inter-interface&#xA;object network obj_any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network Datacenter&#xA; subnet 10.10.185.0 255.255.255.0&#xA;object network Internal&#xA; subnet 192.168.2.0 255.255.255.0&#xA;access-list outside_cryptomap extended permit ip object Internal object Datacenter &#xA;access-list outside_cryptomap extended permit icmp object Internal object Datacenter&#xA;access-list internet_access extended permit ip object Internal any &#xA;access-list outside_access_in extended permit ip any any&#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;mtu management 1500&#xA;no failover&#xA;no monitor-interface service-module &#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;icmp permit any outside&#xA;icmp permit any inside&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (inside,outside) source static Internal Internal destination static Datacenter Datacenter no-proxy-arp route-lookup&#xA;nat (outside,outside) source static Internal Internal destination static Datacenter Datacenter no-proxy-arp route-lookup&#xA;!&#xA;object network obj_any&#xA; nat (any,outside) dynamic interface&#xA;!&#xA;nat (inside,outside) after-auto source dynamic any interface&#xA;access-group outside_access_in in interface outside&#xA;route outside 0.0.0.0 0.0.0.0 172.16.10.161 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL &#xA;http server enable&#xA;http 192.168.2.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;service sw-reset-button&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto map outside_map 1 match address outside_cryptomap&#xA;crypto map outside_map 1 set peer 20.30.40.185 &#xA;crypto map outside_map 1 set ikev1 transform-set ESP-3DES-SHA ESP-3DES-SHA-TRANS ESP-AES-256-SHA ESP-AES-256-SHA-TRANS&#xA;crypto map outside_map 1 set security-association lifetime seconds 3600&#xA;crypto map outside_map interface outside&#xA;crypto ca trustpool policy&#xA;crypto ikev2 policy 1&#xA; encryption aes-256&#xA; integrity sha&#xA; group 2&#xA; prf sha&#xA; lifetime seconds 3600&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 policy 120&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 3600&#xA;telnet timeout 5&#xA;no ssh stricthostkeycheck&#xA;ssh 192.168.2.0 255.255.255.0 inside&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;management-access management&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;ntp server 24.56.178.140 source outside prefer&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-tunnel-protocol ikev2 l2tp-ipsec &#xA;group-policy GroupPolicy_20.30.40.185 internal&#xA;group-policy GroupPolicy_20.30.40.185 attributes&#xA; vpn-tunnel-protocol ikev1 &#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;username admin password XXXXXXXXXXXXXX encrypted privilege 15&#xA;tunnel-group 20.30.40.185 type ipsec-l2l&#xA;tunnel-group 20.30.40.185 general-attributes&#xA; default-group-policy GroupPolicy_20.30.40.185&#xA;tunnel-group 20.30.40.185 ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; peer-id-validate nocheck&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;!&#xA;class-map filtered-class&#xA; match any&#xA;class-map global-class&#xA; match default-inspection-traffic&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; description Filtered Traffic&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA; class filtered-class&#xA;  sfr fail-open&#xA;policy-map global-policy&#xA; class global-class&#xA;  inspect icmp &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;Cryptochecksum:3ed383cb9ad07574a579a99ea71c2946&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I perform a packet trace from this Cisco ASA to the remote network, it works just fine however when I perform a packet trace from the remote network back to the LAN behind this ASA I get the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# packet-tracer input outside tcp 10.10.185.2 3389 192.168.2.5 3389 detailed&#xA;&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: Resolve Egress Interface&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;found next-hop 192.168.2.5 using egress ifc  inside&#xA;&#xA;Phase: 2&#xA;Type: ACCESS-LIST&#xA;Subtype: log&#xA;Result: ALLOW&#xA;Config:&#xA;access-group outside_access_in in interface outside&#xA;access-list outside_access_in extended permit ip any any &#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x7fffde35d0a0, priority=13, domain=permit, deny=false&#xA;    hits=24, user_data=0x7fffcfffed00, cs_id=0x0, use_real_addr, flags=0x0, protocol=0&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0&#xA;    input_ifc=outside, output_ifc=any&#xA;&#xA;Phase: 3&#xA;Type: NAT     &#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x7fffdd3fd8a0, priority=0, domain=nat-per-session, deny=false&#xA;    hits=470, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0&#xA;    input_ifc=any, output_ifc=any&#xA;&#xA;Phase: 4&#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x7fffddb1e950, priority=0, domain=inspect-ip-options, deny=true&#xA;    hits=2051, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0&#xA;    input_ifc=outside, output_ifc=any&#xA;&#xA;Phase: 5&#xA;Type: SFR&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;class-map filtered-class&#xA; match any&#xA;policy-map global_policy&#xA; description Filtered Traffic&#xA; class filtered-class&#xA;  sfr fail-open&#xA;service-policy global_policy global&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x7fffde1e96f0, priority=71, domain=sfr, deny=false&#xA;    hits=25, user_data=0x7fffde1e90a0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0&#xA;    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any&#xA;    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0&#xA;    input_ifc=outside, output_ifc=any&#xA;&#xA;Phase: 6&#xA;Type: VPN&#xA;Subtype: ipsec-tunnel-flow&#xA;Result: DROP  &#xA;Config:&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x7fffde312c90, priority=70, domain=ipsec-tunnel-flow, deny=false&#xA;    hits=1, user_data=0x197c4, cs_id=0x7fffddbdbc70, reverse, flags=0x0, protocol=0&#xA;    src ip/id=10.10.185.0, mask=255.255.255.0, port=0, tag=any&#xA;    dst ip/id=192.168.2.0, mask=255.255.255.0, port=0, tag=any, dscp=0x0&#xA;    input_ifc=outside, output_ifc=any&#xA;&#xA;Result:&#xA;input-interface: outside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: inside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: drop&#xA;Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't seem to locate what's holding up traffic from returning properly.  I also cannot seem to get traffic sourced from the LAN behind the Cisco ASA to the Internet and back even though I have NAT rules that should take care of that but I'll look to resolve one thing at a time starting with the VPN tunnel traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;EDIT&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding some info per dareuja's request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show run nat output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# sho run nat&#xA;nat (outside,any) source static any any destination static interface Win_Svr service RDP RDP no-proxy-arp&#xA;nat (inside,outside) source dynamic obj_any interface&#xA;nat (inside,outside) source static Internal Internal destination static Datacenter Datacenter no-proxy-arp route-lookup&#xA;!&#xA;object network obj_any&#xA; nat (any,outside) dynamic interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Packet tracer output sourcing from inside IP of 192.168.2.5 to outside at 8.8.8.8&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# packet-tracer input inside tcp 192.168.2.5 53 8.8.8.8 53&#xA;&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: Resolve Egress Interface&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;found next-hop 172.16.10.161 using egress ifc  outside&#xA;&#xA;Phase: 2&#xA;Type: NAT&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside,outside) source dynamic obj_any interface&#xA;Additional Information:&#xA;Dynamic translate 192.168.2.5/53 to 172.16.10.163/53&#xA;&#xA;Phase: 3&#xA;Type: NAT&#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 4      &#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 5&#xA;Type: SFR&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;class-map filtered-class&#xA; match any&#xA;policy-map global_policy&#xA; description Filtered Traffic&#xA; class filtered-class&#xA;  sfr fail-open&#xA;service-policy global_policy global&#xA;Additional Information:&#xA;&#xA;Phase: 6&#xA;Type: NAT&#xA;Subtype: rpf-check&#xA;Result: ALLOW &#xA;Config:&#xA;nat (inside,outside) source dynamic obj_any interface&#xA;Additional Information:&#xA;&#xA;Phase: 7&#xA;Type: NAT&#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 8&#xA;Type: IP-OPTIONS&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 9&#xA;Type: FLOW-CREATION&#xA;Subtype: &#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;New flow created with id 13956, packet dispatched to next module&#xA;&#xA;Result:&#xA;input-interface: inside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: outside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: allow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output of 'show crypto ipsec sa peer 20.30.40.185'&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# sh crypto ipsec sa peer 20.30.40.185 detail   &#xA;peer address: 20.30.40.185&#xA;    Crypto map tag: outside_map, seq num: 1, local addr: 172.16.10.163&#xA;&#xA;      access-list outside_cryptomap extended permit ip 192.168.2.0 255.255.255.0 10.10.185.0 255.255.255.0 &#xA;      local ident (addr/mask/prot/port): (192.168.2.0/255.255.255.0/0/0)&#xA;      remote ident (addr/mask/prot/port): (10.10.185.0/255.255.255.0/0/0)&#xA;      current_peer: 20.30.40.185&#xA;&#xA;&#xA;      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0&#xA;      #pkts decaps: 11043, #pkts decrypt: 11043, #pkts verify: 11043&#xA;      #pkts compressed: 0, #pkts decompressed: 0&#xA;      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0&#xA;      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0&#xA;      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0&#xA;      #TFC rcvd: 0, #TFC sent: 0&#xA;      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0&#xA;      #pkts no sa (send): 0, #pkts invalid sa (rcv): 0&#xA;      #pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0&#xA;      #pkts invalid prot (rcv): 0, #pkts verify failed: 0&#xA;      #pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0&#xA;      #pkts invalid pad (rcv): 0,&#xA;      #pkts invalid ip version (rcv): 0,&#xA;      #pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0&#xA;      #pkts replay failed (rcv): 0&#xA;      #pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0&#xA;      #pkts internal err (send): 0, #pkts internal err (rcv): 0&#xA;&#xA;      local crypto endpt.: 172.16.10.163/4500, remote crypto endpt.: 20.30.40.185/4500&#xA;      path mtu 1500, ipsec overhead 82(52), media mtu 1500&#xA;      PMTU time remaining (sec): 0, DF policy: copy-df&#xA;      ICMP error validation: disabled, TFC packets: disabled&#xA;      current outbound spi: CDCAAA61&#xA;      current inbound spi : 337E6914&#xA;&#xA;    inbound esp sas:&#xA;      spi: 0x337E6914 (863922452)&#xA;         transform: esp-aes-256 esp-sha-hmac no compression &#xA;         in use settings ={L2L, Tunnel,  NAT-T-Encaps, IKEv1, }&#xA;         slot: 0, conn_id: 12288, crypto-map: outside_map&#xA;         sa timing: remaining key lifetime (kB/sec): (4373985/2388)&#xA;         IV size: 16 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap: &#xA;          0xFFFFFFFF 0xFFFFFFFF&#xA;    outbound esp sas:&#xA;      spi: 0xCDCAAA61 (3452611169)&#xA;         transform: esp-aes-256 esp-sha-hmac no compression &#xA;         in use settings ={L2L, Tunnel,  NAT-T-Encaps, IKEv1, }&#xA;         slot: 0, conn_id: 12288, crypto-map: outside_map&#xA;         sa timing: remaining key lifetime (kB/sec): (4374000/2386)&#xA;         IV size: 16 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap: &#xA;          0x00000000 0x00000001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19932" LastEditorUserId="19932" LastEditDate="2015-10-23T13:36:28.713" LastActivityDate="2016-02-06T03:23:49.703" Title="Cisco ASA 5506-X - Site-to-Site VPN Tunnel - Return traffic dropped" Tags="|cisco|cisco-asa|vpn|nat|ipsec|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23585" PostTypeId="2" ParentId="23584" CreationDate="2015-10-22T00:11:41.593" Score="2" Body="&lt;p&gt;You won't be able to test a VPN using packet-tracer from remote to local, a drop is expected if you do so.  I believe it's due to the expectation that the traffic would be encrypted, receiving an unencrypted packet (even through simulation) is dropped per security. (if I can get it set up on my lab, I'll test this out as well.) &lt;em&gt;EDIT&lt;/em&gt; tested in lab as well, sourcing from remote will drop when testing VPN.  If anyone else has had a different experience, please let me know.&lt;/p&gt;&#xA;" OwnerUserId="14230" LastEditorUserId="14230" LastEditDate="2015-10-22T00:48:31.883" LastActivityDate="2015-10-22T00:48:31.883" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="23589" PostTypeId="2" ParentId="23402" CreationDate="2015-10-22T09:39:11.117" Score="6" Body="&lt;p&gt;The timestamping happens in hardware based on a clock in the NIC. Depending on your NIC there's either a NIC register where your timestamp will be written or some card (Intel 82580) can prepend the information to the packet buffer. For cards that write the timestamp to a register you have to read the register before it can timestamp the next packet, effectively limiting your throughput, while the 82580 can timestamp all packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Linux, you will receive the timestamp in a data structure outside of the packet itself. Here's a bit from the &lt;a href=&quot;https://www.kernel.org/doc/Documentation/networking/timestamping.txt&quot; rel=&quot;noreferrer&quot;&gt;kernel docs&lt;/a&gt; on it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;These timestamps are returned in a control message with cmsg_level&#xA;SOL_SOCKET, cmsg_type SCM_TIMESTAMPING, and payload of type&#xA;&#xA;struct scm_timestamping {&#xA;    struct timespec ts[3];&#xA;};&#xA;&#xA;The structure can return up to three timestamps. This is a legacy&#xA;feature. Only one field is non-zero at any time. Most timestamps&#xA;are passed in ts[0]. Hardware timestamps are passed in ts[2].&#xA;&#xA;ts[1] used to hold hardware timestamps converted to system time.&#xA;Instead, expose the hardware clock device on the NIC directly as&#xA;a HW PTP clock source, to allow time conversion in userspace and&#xA;optionally synchronize system time with a userspace PTP stack such&#xA;as linuxptp. For the PTP clock API, see Documentation/ptp/ptp.txt.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Timestamp is based on NIC time. I believe you can modify the NIC clock but the more common way is to let the NIC clock be free running (guaranteeing monotonic time) and do any adjustment in user space. Adjustments could include working out the offset with system time and adjusting all received timestamps to system time. The kernel can/could (was a long time since I checked) do this for you but I believe recommended way is to do it yourself in your user space. In other applications you simply don't care about absolute time as the relative time between packets is the only important factor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two colleagues of mine wrote a SLA measurement application relying on this. You'll find the source at on &lt;a href=&quot;https://github.com/SLANG-foundation/SLANG/&quot; rel=&quot;noreferrer&quot;&gt;GitHub&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also &lt;a href=&quot;https://github.com/emmericp/MoonGen&quot; rel=&quot;noreferrer&quot;&gt;MoonGen&lt;/a&gt; which is a DPDK based framework with Lua scripting abilities for packet processing. They have an &lt;a href=&quot;http://www.net.in.tum.de/fileadmin/bibtex/publications/papers/MoonGen_IMC2015.pdf&quot; rel=&quot;noreferrer&quot;&gt;excellent paper&lt;/a&gt; including information on timestamping.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-22T09:39:11.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23590" PostTypeId="1" CreationDate="2015-10-22T09:50:33.803" Score="2" ViewCount="1177" Body="&lt;p&gt;I was going through a Networking course online and they instructed me to try &lt;code&gt;ping&lt;/code&gt; and &lt;code&gt;traceroute&lt;/code&gt; commands on Linux for network checking. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have Fedora OS v22 and am using WLAN Dlink Router for Internet connection. My private IP address is 192.168.0.103 and that of my router is 192.168.0.1.&#xA;If I ping any website (e.g. google.com, stackoverflow.com, etc.), I am getting 100% packet loss. I asked a friend to share his public IP address, and, when I ping that IP, I still get 100% packet loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither is traceroute working. There is only 1 hop showing, which is that of my gateway 192.168.0.1 and the rest &lt;code&gt;* * *&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the problem here? Have all the servers disabled their ICMP echo request? Are there some sites on which ping still works?&lt;/p&gt;&#xA;" OwnerUserId="19939" LastEditorUserId="8499" LastEditDate="2015-10-22T13:38:42.413" LastActivityDate="2016-09-05T08:45:24.150" Title="ping, traceroute not working" Tags="|ping|linux|traceroute|" AnswerCount="2" CommentCount="1" ClosedDate="2019-02-26T23:00:07.580" ContentLicense="CC BY-SA 3.0" />
  <row Id="23591" PostTypeId="2" ParentId="23255" CreationDate="2015-10-22T09:52:01.007" Score="2" Body="&lt;p&gt;It would be 3 for the given messages. The first message contains an update and provided that you don't currently have a route for that prefix this would then be the first route that we installed. The subsequent messages contains information for the same prefix and therefore are implicit withdrawals.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-22T09:52:01.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23592" PostTypeId="1" AcceptedAnswerId="23594" CreationDate="2015-10-22T09:58:25.500" Score="2" ViewCount="253" Body="&lt;p&gt;My question may be too basic and factual for this site, but I was reading about subnetting from our textbook which gives following example:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/V56fs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V56fs.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As it shows, the router itself occupies an address on each subnet. However, in the textual explanation, nowhere this fact is specified in words; it's just that in the diagram where I noticed this.&lt;/p&gt;&#xA;&lt;p&gt;Is it always the case that the router uses an address in each of the subnets to which it is connected?&lt;/p&gt;&#xA;" OwnerUserId="19940" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-10-22T19:19:52.310" Title="Does a router occupy an address on subnet" Tags="|router|subnet|ip|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23594" PostTypeId="2" ParentId="23592" CreationDate="2015-10-22T10:33:53.840" Score="2" Body="&lt;p&gt;A router must get, on its interfaces which face each subnet, an IP address in the address range of this subnet. This interface IP is called the &lt;strong&gt;&lt;em&gt;gateway&lt;/em&gt;&lt;/strong&gt; from the perspective of the devices on the subnet, so you will actually find this expression is more popular .  &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2015-10-22T17:56:25.723" LastActivityDate="2015-10-22T17:56:25.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23597" PostTypeId="2" ParentId="23592" CreationDate="2015-10-22T11:06:33.167" Score="1" Body="&lt;p&gt;A router is just another element in the subnet, so it needs to have an address belonging to the subnet, otherwise, how could devices in the network be aware of its presence?&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-10-22T11:06:33.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23598" PostTypeId="1" AcceptedAnswerId="23627" CreationDate="2015-10-22T11:28:52.503" Score="0" ViewCount="173" Body="&lt;p&gt;My client is thinking about implementing a cloud-hosted video streaming solution for their company. Ideally they want to be able to have 3k+ users watch a video at the same time and have it be reasonable quality. I did some quick math and found that for 3k users to watch even just a &lt;em&gt;240p&lt;/em&gt; video at the same time, it would require a minimum of 1200Mb of bandwidth (based on &lt;a href=&quot;https://support.google.com/youtube/answer/2853702?hl=en&quot; rel=&quot;nofollow noreferrer&quot;&gt;Google's suggestions for YouTube content&lt;/a&gt;). Considering they have a 300Mb pipe now, that doesn't seem doable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two main questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is my math even close to correct? I used the bare minimum value, added in 128Kb audio (audio added based on &lt;a href=&quot;https://superuser.com/questions/487797/how-can-i-determine-the-minimum-theoretical-internet-speed-needed-for-smooth-str&quot;&gt;this post&lt;/a&gt;), and multiplied it by 3000 to get that number.&lt;/li&gt;&#xA;&lt;li&gt;How do large companies generally go about implementing these kinds of solutions? Do they simply have larger pipes or is there some sort of network optimization that's possible (like Riverbed appliances) to serve this kind of content more effectively?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19943" LastEditorUserId="-1" LastEditDate="2017-03-20T10:04:42.970" LastActivityDate="2015-10-22T21:14:15.853" Title="Network Requirements for Video Streaming" Tags="|bandwidth|streaming|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23599" PostTypeId="1" CreationDate="2015-10-22T11:29:11.693" Score="1" ViewCount="713" Body="&lt;p&gt;Is there a quick way how to optimize Wi-Fi AP/router settings for better VoIP performance? I use SIP protocol. Can I tweak RTS or fragmentation threshold values for better voice performance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am asking because if I use SIP on my desktop (Linphone) over Ethernet, it seems to have better voice quality then when using CIP on Android over WiFi. My current AP has pretty much the default values set for wireless:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RTS: 2346 (=max)&lt;/li&gt;&#xA;&lt;li&gt;Fragmentation threshold: 2346 (=max)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The AP has only these &quot;advanced&quot; wireless settings but I can buy a better new one in case it would help for voice.&lt;/p&gt;&#xA;" OwnerUserId="2797" LastActivityDate="2015-10-22T14:23:29.770" Title="Optimize WiFi router settings for VoIP" Tags="|wireless|ieee-802.11|voip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23600" PostTypeId="2" ParentId="22611" CreationDate="2015-10-22T11:56:43.390" Score="2" Body="&lt;p&gt;See the &lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junos11.4/topics/reference/general/routing-ptotocols-address-representation.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;JUNOS route selection process&lt;/a&gt; and you'll find that you end up at rule 9:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;For BGP, prefer the path whose next hop is resolved through the IGP&#xA;route with the lowest metric.&lt;/p&gt;&#xA;&lt;p&gt;Note: A path is considered a BGP&#xA;equal-cost path (and will be used for forwarding) if a tie-break is&#xA;performed after the previous step. All paths with the same neighboring&#xA;AS, learned by a multipath-enabled BGP neighbor, are considered. BGP&#xA;multipath does not apply to paths that share the same MED-plus-IGP&#xA;cost yet differ in IGP cost. Multipath path selection is based on the&#xA;IGP cost metric, even if two paths have the same MED-plus-IGP cost.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The default load-balancing of JUNOS is to set the next-hop for a BGP route over one of the IGP paths, i.e. &lt;em&gt;not&lt;/em&gt; to install &lt;em&gt;multiple&lt;/em&gt; IGP next-hops for a given BGP route. If you add a second prefix in addition to your 77/22 you will see how it picks another next-hop for it so to achieve load balancing of your traffic on a per-prefix level. This works well when you have a lot of prefixes and your traffic is spread over all or many of these prefixes. If you are only looking at one prefix though, you will not achieve any load balancing of traffic.&lt;/p&gt;&#xA;&lt;p&gt;This behaviour can be changed. If you want to install all IGP next-hops you can set load-balancing to per-packet (which really isn't true on most platforms, it's hash-bashed). See &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos13.2/topics/usage-guidelines/policy-configuring-per-packet-load-balancing.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this document&lt;/a&gt; for further explanation on load-balancing in JUNOS.&lt;/p&gt;&#xA;&lt;p&gt;Exactly how to calculate which IGP next-hop is picked for a given BGP route is trickier. I don't know the internal workings of it but I assume it is based on a hash of the prefix.&lt;/p&gt;&#xA;" OwnerUserId="672" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-10-22T11:56:43.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23601" PostTypeId="2" ParentId="22393" CreationDate="2015-10-22T12:09:07.280" Score="1" Body="&lt;p&gt;LSAs/LSPs (OSPF vs IS-IS speak) are flooded through the network. You are indeed correct that a LSP (I prefer ISIS) only contains information for adjacent nodes + certain IP reachability info from the node that sourced the LSP but flooding solves this and allows you to gain a full picture of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can look at the LSP DB in a router. Here's some output from a virtual environment I'm working with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tsroot@R2-4&amp;gt; show isis database&#xA;IS-IS level 1 link-state database:&#xA;LSP ID                      Sequence Checksum Lifetime Attributes&#xA;R1-1.00-00                      0x1e   0x6880    52429 L1&#xA;R1-2.00-00                     0x122   0x17c4    62130 L1&#xA;R1-3.00-00                     0x320   0xca73      542 L1&#xA;R1-4.00-00                     0x3b8   0x9e67      761 L1&#xA;R2-1.00-00                     0x26a   0x90cd    62131 L1 L2&#xA;R2-2.00-00                     0x398   0x9ea4    62130 L1 L2&#xA;R2-4.00-00                     0x3ce   0x8ecb      793 L1 L2 Attached&#xA;R2-5.00-00                     0x2b4   0xa3b0    62137 L1 L2&#xA;R2-6.00-00                     0x26b   0x78d3    62028 L1 L2&#xA;R1-5.00-00                     0x1a4   0x285f    62131 L1&#xA;R1-6.00-00                     0x1cc   0x6069    61984 L1&#xA;  11 LSPs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see that we have received LSPs from all other routers in this topology and obviously we also have our local information (R2-4).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible to look in more detail of the LSP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tsroot@R2-4&amp;gt; show isis database R1-1 extensive&#xA;IS-IS level 1 link-state database:&#xA;&#xA;R1-1.00-00 Sequence: 0x1e, Checksum: 0x6880, Lifetime: 52351 secs&#xA;   IPV6 Unicast IS neighbor: R2-1.00          Metric:       30&#xA;     Two-way fragment: R2-1.00-00, Two-way first fragment: R2-1.00-00&#xA;   IPV6 Unicast IS neighbor: R2-2.00          Metric:       30&#xA;     Two-way fragment: R2-2.00-00, Two-way first fragment: R2-2.00-00&#xA;   V6 IPV6 Unicast prefix: 2001:db8::13/128   Metric:        0 Internal Up&#xA;   V6 IPV6 Unicast prefix: 2001:db8:1:13:11::/112 Metric:       30 Internal Up&#xA;   V6 IPV6 Unicast prefix: 2001:db8:1:13:12::/112 Metric:       30 Internal Up&#xA;&#xA;  Header: LSP ID: R1-1.00-00, Length: 156 bytes&#xA;    Allocated length: 284 bytes, Router ID: 0.0.0.0&#xA;    Remaining lifetime: 52351 secs, Level: 1, Interface: 330&#xA;    Estimated free bytes: 257, Actual free bytes: 128&#xA;    Aging timer expires in: 52351 secs&#xA;    Protocols: IPv6&#xA;&#xA;  Packet: LSP ID: R1-1.00-00, Length: 156 bytes, Lifetime : 65531 secs&#xA;    Checksum: 0x6880, Sequence: 0x1e, Attributes: 0x1 &amp;lt;L1&amp;gt;&#xA;    NLPID: 0x83, Fixed length: 27 bytes, Version: 1, Sysid length: 0 bytes&#xA;    Packet type: 18, Packet version: 1, Max area: 0&#xA;&#xA;  TLVs:&#xA;    Area address: 49.0276 (3)&#xA;    Speaks: IPV6&#xA;    Topology: ipv6 unicast&#xA;    Hostname: R1-1&#xA;    IPv6 address: 2001:db8::13&#xA;    IPV6 UnicastIS neighbor: R2-2.00, Metric: default 30&#xA;    IPV6 UnicastIS neighbor: R2-1.00, Metric: default 30&#xA;    IPV6 UnicastIPv6 prefix: 2001:db8::13/128 Metric 0 Up&#xA;    IPV6 UnicastIPv6 prefix: 2001:db8:1:13:11::/112 Metric 30 Up&#xA;    IPV6 UnicastIPv6 prefix: 2001:db8:1:13:12::/112 Metric 30 Up&#xA;  No queued transmissions&#xA;&#xA;IS-IS level 2 link-state database:&#xA;&#xA;tsroot@R2-4&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And we can see that includes adjacency information with metric to reach those neighbours:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   IPV6 Unicast IS neighbor: R2-1.00          Metric:       30&#xA;   IPV6 Unicast IS neighbor: R2-2.00          Metric:       30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's info about the directly connected IP prefixes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   V6 IPV6 Unicast prefix: 2001:db8::13/128   Metric:        0 Internal Up&#xA;   V6 IPV6 Unicast prefix: 2001:db8:1:13:11::/112 Metric:       30 Internal Up&#xA;   V6 IPV6 Unicast prefix: 2001:db8:1:13:12::/112 Metric:       30 Internal Up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From this information we can then compute the shortest path by starting the tree at our own node (R2-4). It's also possible to deduce loop free backup paths by rooting the tree at an adjacent node. This is called LFA (Loop Free Alternatives) and is a way of achieving IP FRR (Fast Re-Route).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The flooding of LSPs happens verbatim. Ie the LSP is not even interpreted before being flooded. It is therefore important that the size of an LSP is equal or smaller in size to the link in the network with the lowest MTU.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-22T12:09:07.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23602" PostTypeId="2" ParentId="23599" CreationDate="2015-10-22T13:00:55.953" Score="4" Body="&lt;p&gt;When you design a wireless solution for VoIP, several things must be taken into consideration:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Jitter&lt;/em&gt;&lt;/strong&gt;: Variations in delay of packet delivery , Jitter buffers (used to compensate for varying delay) further add to the end-to-end delay, and are usually only effective on delay variations &lt;strong&gt;&lt;em&gt;&lt;code&gt;less than 100 ms&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt;. Jitter must therefore be minimized.    &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Latency&lt;/em&gt;&lt;/strong&gt; : Delay for packet delivery Callers usually notice round trip voice delays of &lt;em&gt;250ms&lt;/em&gt; or more. ITU-T G.114 &lt;strong&gt;&lt;em&gt;&lt;code&gt;recommends a maximum of a 150 ms one-way latency&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt;. Since this includes the entire voice path, part of which may be on the public Internet, your own network should have transit latencies of considerably less than 150 ms.    &lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Packet Loss&lt;/em&gt;&lt;/strong&gt; :VOIP is not tolerant of packet loss. Even &lt;em&gt;1% packet loss&lt;/em&gt; can &quot;significantly degrade&quot; a VOIP call using a G.711 codec and other more compressing codecs can tolerate even less packet loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco says:The default G.729 codec requires packet loss far less than 1%&lt;br&gt;&#xA;to avoid audible errors. Ideally, there should be no packet loss for VoIP&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;- Poor Internet Connection&lt;br&gt;&#xA;- Inadequate Router&lt;br&gt;&#xA;- Internal Network Improperly Configured&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;em&gt;Summary&lt;/em&gt;&lt;/strong&gt; : you must make sure that your wireless connection will never exceed &lt;strong&gt;&lt;em&gt;100 ms jittering&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;150 ms one-way latency&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;1% packet loss&lt;/em&gt;&lt;/strong&gt; and sure good internet connection and proper network setup&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The question here is how we can make sure of that? There are tools &lt;a href=&quot;http://www.voip-info.org/wiki/view/QoS&quot; rel=&quot;nofollow&quot;&gt;in this link&lt;/a&gt; which may help in such survey.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2015-10-22T14:23:29.770" LastActivityDate="2015-10-22T14:23:29.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23603" PostTypeId="1" AcceptedAnswerId="23609" CreationDate="2015-10-22T13:12:09.143" Score="3" ViewCount="1906" Body="&lt;p&gt;I was reading Data Communication book by Forouzan in which there is a one restriction put on CIDR subnetting by Internet authorities:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;First IP address in the block should be evenly divisible by the number of addresses. For example, below, the first address, when converted to a decimal number, is 3440387360, which when divided by 16 (block size) results in 215024210.&#xA;  &lt;a href=&quot;https://i.stack.imgur.com/0aOQB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0aOQB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since this did not clear the practical significance behind this restriction I went on exploring and came across the video where it is explained as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Whenever we divide any number by &lt;em&gt;k&lt;/em&gt;th power of 2 (another restriction being that the block size should be 2^k), the reminder is least significant k bits. So evenly divisible by 2^k means that least significant k bits should all be 0. This way the first address of the allocated address block can be used as a block ID since it has all 0s in the host ID part. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now that seems more logical despite the fact that I dont understand how &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;evenly divisible&lt;/strong&gt; by the number of addresses 2^k&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;translates to &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;least significant k bits &lt;strong&gt;should all be 0&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can't it be just that the decimal equivalent of least significant k bits should be divisible by 2. I mean if least significant 4 bits (for a block of 2^4 addresses) is binary 1010, then it translates to decinal 10 which is divisible by 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in short why is &lt;strong&gt;&lt;em&gt;evenly divisible&lt;/em&gt;&lt;/strong&gt; translates to &lt;strong&gt;&lt;em&gt;all 0 LSBs&lt;/em&gt;&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="19940" LastEditorUserId="8499" LastEditDate="2018-12-22T04:21:32.260" LastActivityDate="2022-07-30T03:58:29.130" Title="What this subnetting restriction means" Tags="|ip|ipv4|subnet|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23604" PostTypeId="2" ParentId="20946" CreationDate="2015-10-22T13:43:05.437" Score="1" Body="&lt;p&gt;Indeed, they are quite different. Don't expect code compatibility between the two. Any experience you pick up on network simulations working with NS2 will be applicable to any network simulator so it's not all in vain though ;)&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-22T13:43:05.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23605" PostTypeId="2" ParentId="20896" CreationDate="2015-10-22T13:49:07.403" Score="1" Body="&lt;p&gt;It's the total throughput of the cell. A single user could use up all that or it could be divided over many users. Do note that when you have multiple users you are likely to have more overhead in various reasons so total throughput will go down.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-22T13:49:07.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23606" PostTypeId="2" ParentId="23590" CreationDate="2015-10-22T13:58:56.330" Score="1" Body="&lt;p&gt;Many sites, including your friend's router, drop ICMP as a security feature. Pinging an entire domain such as &lt;code&gt;google.com&lt;/code&gt; won't work unless there is a host responding on behalf of the domain. You can try to ping one of Google's DNS servers (e.g. 8.8.8.8). If that doesn't work, it may be that your router is blocking ICMP echo replies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traceroute can be a very different story. Some versions of traceroute use ICMP, but, originally, it was thought that a host should not respond to ICMP messages with an ICMP error message. The result is that many vendors implemented traceroute using UDP instead of ICMP. This can cause sites which block unsolicited UDP traffic to not respond to any version of traceroute using UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There can be other problems, too. Any of the devices (routers, firewall, etc.) in the path from the source to the target may block your attempts. Some ISPs are implementing Carrier-Grade NAT (due to the IPv4 shortage), and the way some of them implement it seems to interfere with these tools.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-22T13:58:56.330" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23608" PostTypeId="2" ParentId="23603" CreationDate="2015-10-22T14:40:55.263" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I mean if least significant 4 bits (for a block of 2^4 addresses) is&#xA;  binary 1010, then it translates to decinal 10 which is divisible by 2.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Actually, &lt;code&gt;2^4&lt;/code&gt; is decimal &lt;code&gt;16&lt;/code&gt;, hexadecimal &lt;code&gt;10&lt;/code&gt;, binary &lt;code&gt;10000&lt;/code&gt;, so the least significant four bits (the exponent in &lt;code&gt;2^4&lt;/code&gt;) are all &lt;code&gt;0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that an IP address is 32 bits, so a block of &lt;code&gt;2^4&lt;/code&gt; host addresses is from a 32 bit number. This is how it would lay out, where &lt;code&gt;N&lt;/code&gt; is a binary bit in the network portion of the address, and &lt;code&gt;H&lt;/code&gt; is a binary bit in the host portion of the address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NNNNNNN.NNNNNNNNN.NNNNNNNN.NNNNHHHH&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What the book and video are trying to tell you is that increasing the number of host bits increases the number of hosts in that address block by a power of two. For every host bit in the address block, you double the number of hosts which you can have. The entire address block (call it the network or subnet) can then be referred to using only the network bits with the host bits all set to &lt;code&gt;0&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-22T14:40:55.263" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23609" PostTypeId="2" ParentId="23603" CreationDate="2015-10-22T14:44:18.683" Score="4" Body="&lt;p&gt;This restriction on CIDR was created to forbid that an arbitrary block could be created, let's see an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose that we have the full block 192.168.1.0/24 and we want to subnet it with &lt;em&gt;/27&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;/27&lt;/em&gt; means that from the 32 bits of the address, &lt;em&gt;27&lt;/em&gt; are network, and &lt;em&gt;5&lt;/em&gt; are host, then we have 2^5 addresses per subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The subnets are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;First Address    Last Octet  Last Octet &#xA;                             in decimal /32&#xA;&#xA;192.168.1.0      000 00000       0&#xA;192.168.1.32     001 00000       1&#xA;192.168.1.64     010 00000       2&#xA;192.168.1.96     011 00000       3&#xA;192.168.1.128    100 00000       4&#xA;192.168.1.160    101 00000       5&#xA;192.168.1.192    110 00000       6&#xA;192.168.1.224    111 00000       7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first address divided by the number of addresses per subnet is always an integer without decimals, and that is possible because the last &lt;em&gt;k&lt;/em&gt; bits are 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It makes impossible to have a block starting on &lt;em&gt;192.168.1.133&lt;/em&gt;, for example, because 133/32 = 4.15625&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="62196" LastEditDate="2019-09-23T13:14:51.820" LastActivityDate="2019-09-23T13:14:51.820" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23610" PostTypeId="1" CreationDate="2015-10-22T16:54:12.707" Score="2" ViewCount="104" Body="&lt;p&gt;I've been spending a lot of time trying to learn different &lt;strong&gt;&lt;em&gt;Network File Systems&lt;/em&gt;&lt;/strong&gt; &lt;em&gt;&amp;amp;&lt;/em&gt; &lt;strong&gt;&lt;em&gt;File Transfer Protocols&lt;/em&gt;&lt;/strong&gt; &lt;em&gt;etc.&lt;/em&gt; in order to integrate three different devices with three different &lt;em&gt;Operating Systems:&lt;/em&gt;  &lt;strong&gt;&lt;em&gt;Linux, Windows, Mac OS X.&lt;/em&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, I have ben looking into the following:&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;SMB/CIFS, AFP/Appletalk, FTP/SFTP, NFS, WebDAV&lt;/em&gt;&lt;/strong&gt; &lt;em&gt;(also&lt;/em&gt; &lt;strong&gt;&lt;em&gt;Bonjour/Avahi, NetBIOS&lt;/strong&gt;) etc.&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all seems kind of superfluous and not knowing exactly what I should or shouldn't implement has been stressing me out. Suddenly it occurs to me; Can't we do all this already with &lt;strong&gt;&lt;em&gt;SSH?&lt;/em&gt;&lt;/strong&gt; &lt;em&gt;(&lt;strong&gt;SSHFS, SCP)?&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;" OwnerUserId="17196" LastEditorUserId="17196" LastEditDate="2015-11-02T10:06:41.973" LastActivityDate="2015-11-02T10:06:41.973" Title="Why are there so many different Network File Systems &amp; File Transfer Protocols?" Tags="|ssh|network-discovery|autonegotiation|peering|" AnswerCount="1" CommentCount="3" ClosedDate="2015-11-02T20:23:40.490" ContentLicense="CC BY-SA 3.0" />
  <row Id="23611" PostTypeId="2" ParentId="23610" CreationDate="2015-10-22T17:10:25.847" Score="1" Body="&lt;p&gt;There are so may different file systems because there are so many different OS vendors, each thinking it has the best solution, and some file systems are designed for specific purposes, such as being optimized for databases, which may not be a good fit for other things, such as video streaming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The various file transfer protocols come from changing needs. For instance, FTP adequately served its purpose for a long time, but the need to encrypt the data being transferred spurred the creation of SCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Old file systems and transfer protocols don't vanish overnight, and they may need to be supported for many years. Most vendors try to support older protocols because they don't want to alienate possible customers which may have a need to support older systems.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-22T17:10:25.847" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23612" PostTypeId="1" CreationDate="2015-10-22T17:14:51.753" Score="1" ViewCount="792" Body="&lt;p&gt;What is the basic difference between &lt;strong&gt;spray and wait&lt;/strong&gt; routing protocol and other routing protocols? And what is the main benefit of using the spray and wait protocol?&lt;/p&gt;&#xA;" OwnerUserId="19948" LastActivityDate="2015-10-22T17:30:32.027" Title="Spray and wait routing protocol" Tags="|routing|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23613" PostTypeId="2" ParentId="23612" CreationDate="2015-10-22T17:30:32.027" Score="1" Body="&lt;p&gt;Most network routing protocols are designed for use in fairly stable networks where paths can be known, but they have the ability to change dynamically as the network changes. These protocols are deterministic, and they are optimized for the accurate, speedy delivery of network traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Spray and Wait algorithm is designed to work where paths may be unknown and may frequently change. These networks are tolerant of delay in delivery of traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The abstract for Spray and Wait describes it pretty well:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Intermittently connected mobile networks are sparse wireless networks&#xA;  where most of the time there does not exist a complete path from the&#xA;  source to the destination. These networks fall into the general&#xA;  category of Delay Tolerant Networks. There are many real networks that&#xA;  follow this paradigm, for example, wildlife tracking sensor networks,&#xA;  military networks, inter-planetary networks, etc. In this context,&#xA;  conventional routing schemes would fail.To deal with such networks&#xA;  researchers have suggested to use flooding-based routing schemes.&#xA;  While flooding-based schemes have a high probability of delivery, they&#xA;  waste a lot of energy and suffer from severe contention, which can&#xA;  significantly degrade their performance. Furthermore, proposed efforts&#xA;  to significantly reduce the overhead of flooding-based schemes have&#xA;  often be plagued by large delays. With this in mind, we introduce a&#xA;  new routing scheme, called Spray and Wait, that &quot;sprays&quot; a number of&#xA;  copies into the network, and then &quot;waits&quot; till one of these nodes&#xA;  meets the destination.Using theory and simulations we show that Spray&#xA;  and Wait outperforms all existing schemes with respect to both average&#xA;  message delivery delay and number of transmissions per message&#xA;  delivered; its overall performance is close to the optimal scheme.&#xA;  Furthermore, it is highly scalable retaining good performance under a&#xA;  large range of scenarios, unlike other schemes. Finally, it is simple&#xA;  to implement and to optimize in order to achieve given performance&#xA;  goals in practice.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://dl.acm.org/citation.cfm?id=1080143&quot; rel=&quot;nofollow&quot;&gt;http://dl.acm.org/citation.cfm?id=1080143&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-22T17:30:32.027" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="23614" PostTypeId="1" AcceptedAnswerId="23616" CreationDate="2015-10-22T17:36:46.557" Score="4" ViewCount="894" Body="&lt;p&gt;I have two layer 3 switches (Main And back up) and a palo alto firewall&lt;/p&gt;&#xA;&#xA;&lt;p&gt;main switch connects to the firewall with a routed link port(gi1/1 ip add 10.1.70.2)- firewall (10.1.70.1). All connectivity is good at this point (ping successful) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back up switch is connected to the main switch with a routed link (gi 1/1 ip 10.1.70.5) main switch(gi /24 ip add 10.1.70.6) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PROBLEM:&#xA;Both switches are running EIGRP(Network 10.1.70.0) and I can ping successfully from the back up switch to the main switch IP address 10.1.70.2. the problen is I cannot ping the firewall from the backup switch(10.1.70.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the vlans created on the backup switch if i connect a pc to a port assigned with that vlan it pings the firewall and routes to the internet with no problems! I just cant ping the firewall from the CLI of my back up switch. Im going bananas..lol&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you in advance&lt;/p&gt;&#xA;" OwnerUserId="19478" LastActivityDate="2015-12-21T19:56:10.527" Title="Why I cant Ping An Address across my a routed link" Tags="|routing|switch|vlan|ping|eigrp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23615" PostTypeId="2" ParentId="23614" CreationDate="2015-10-22T17:46:04.983" Score="1" Body="&lt;p&gt;Assuming this is your setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Backup-swi_Gi1/1 -- _Gi1/24_Main-swi_Gi1/1 -- Firewall&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have both interfaces in routing mode on main swi, you should make sure the subnets do not overlap. This is not apparent from your question. Could you please share a bit more of the config, like the interface and routing table output on all devices?&lt;/p&gt;&#xA;" OwnerUserId="15877" LastActivityDate="2015-10-22T17:46:04.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23616" PostTypeId="2" ParentId="23614" CreationDate="2015-10-22T17:47:46.883" Score="1" Body="&lt;p&gt;A router (layer-3 switch, included) doesn't route from one network to the same network. If you had two different networks, one on each side, of the first switch, the layer-3 switch could route from one network to the other, and the ping should succeed.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-22T17:47:46.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23617" PostTypeId="2" ParentId="23592" CreationDate="2015-10-22T17:55:50.977" Score="1" Body="&lt;p&gt;Yes. All devices on an IP network need an IP address, including routers. In your example, the router has actually 3 visible IP addresses and one more at the bottom of the diagram (x.y.z.t/n).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router IP address in this example serves as the default gateway for each of the subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Subnet 1: Default GW = 17.12.14.2, subnet mask is 255.255.255.224 (/27)&#xA;Subnet 2: Default GW = 17.12.14.34, subnet mask is 255.255.255.240 (/28)&#xA;Subnet 3: Default GW = 17.12.14.50, subnet mask is 255.255.255.240 (/28)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Despite I said all devices on an IP network need an IP address, the devices which need an IP are all L3 capable devices (see OSI model). L2 devices, such as switches, do not necessarily need an IP address. For management purposes they usually do have an IP address, though.&lt;/p&gt;&#xA;" OwnerUserId="15877" LastActivityDate="2015-10-22T17:55:50.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23618" PostTypeId="2" ParentId="18893" CreationDate="2015-10-22T18:04:49.580" Score="11" Body="&lt;p&gt;Disclaimer: I work at Cumulus Networks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To address a few of the high level points/concerns raised:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1.) Is ONIE getting traction?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ONIE is the de facto method for getting software onto whitebox switches. It's been embraced by Dell, HP, Supermicro, Penguin, Facebook and a few others.  It's run out of the Open Compute Project (&lt;a href=&quot;http://www.opencompute.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.opencompute.org/&lt;/a&gt;) an independent organization working to make datacenter equipment more open, more affordable and more interoperable. When this post was first written HP was mentioned; they didn't have open networking switches. Today HP has open networking switches with ONIE that run Cumulus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2.) Is it stable? Can I trust it?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sure. Cumulus is running some of the biggest clouds on the planet, as well as hospitals, police departments, school districts, financial services firms and everything in between. I'm sorry that you had a crash, but with every Cumulus License comes 24x7x365 support based in North Carolina, USA and Sydney, Australia. If you run Cumulus and run into problems they are happy to help! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3.) Coming from a Cisco/Arista background, I don't know what to think of this Linux stuff.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's different and that can be a challenge for sure. Using FRR to configure BGP or OSPF on Cumulus will look very familiar to those with a Cisco background. To configure IP addresses, bonds (etherchannels), mLAG (vPC) or other L1/L2 features we have a lot of documentation to help you out&#xA;&lt;a href=&quot;http://docs.cumulusnetworks.com/display/DOCS/Cumulus+Linux+2.5.4+User+Guide&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://docs.cumulusnetworks.com/display/DOCS/Cumulus+Linux+2.5.4+User+Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and again, if you get stuck you can try to search &quot;how to configure an IP on Linux&quot; and it's the same configuration for Cumulus, or call support!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;4.) The staff doesn't have the skills they need&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's probably why they called in reinforcements for help on the networking side of the house. Personally, I come from a Cisco background and I think that network engineers and architects have a very important skill. We build networks that are scalable and fault tolerant. That's a skill a lot of server people do not have. But do we need CCIEs to configure VLANs or modify an ACL on day to day operations? I don't think so. Let's have network engineers build networks and systems/ops people operate systems (+ networks). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's still a gap or concern we offer full day bootcamps to help get you comfortable, or you can use our virtual edition, Cumulus-Vx (www.cumulusnetworks.com/cumulus-vx) and get a feel for how the software behaves. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're interested in hearing more, we'd love to win you back! The things you can do with Cumulus from an automation, configuration, choice and price standpoint make us a great product. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pete Lumbis - CCIE #28677, CCDE 2012::3&#xA;plumbis@cumulusnetworks.com &lt;/p&gt;&#xA;" OwnerUserId="19949" LastEditorUserId="50821" LastEditDate="2020-03-25T09:40:46.063" LastActivityDate="2020-03-25T09:40:46.063" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="23619" PostTypeId="1" CreationDate="2015-10-22T18:49:03.043" Score="1" ViewCount="178" Body="&lt;p&gt;I am trying to separate the traffic of a wireless controller using VLANs. I have a Cisco 4400 wireless LAN controller configured to connect to the guest VLAN on an HP ProCurve 5412zl switch. The controller has been configured to use web policy and authentication. The interface name is &lt;code&gt;guest-vlan&lt;/code&gt;, the VLAN identifier is &lt;code&gt;10&lt;/code&gt;, and the IP address is &lt;code&gt;192.168.101.2&lt;/code&gt;. The firewall has the &lt;code&gt;192.168.101.1&lt;/code&gt; IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch configurations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Core Switch config:&#xA;hostname &quot;Prod-Core&quot;&#xA;module 1 type j8702a&#xA;module 2 type j8702a&#xA;module 3 type j8702a&#xA;module 4 type j8702a&#xA;module 5 type j9309a&#xA;module 6 type j8702a&#xA;mirror 1 port A24&#xA;fault-finder broadcast-storm sensitivity high&#xA;fault-finder bad-driver sensitivity high&#xA;fault-finder bad-transceiver sensitivity high&#xA;fault-finder bad-cable sensitivity high&#xA;fault-finder too-long-cable sensitivity high&#xA;fault-finder over-bandwidth sensitivity high&#xA;fault-finder loss-of-link sensitivity high&#xA;fault-finder duplex-mismatch-hdx sensitivity high&#xA;fault-finder duplex-mismatch-fdx sensitivity high&#xA;fault-finder link-flap sensitivity high&#xA;power-over-ethernet pre-std-detect ports F1-F24&#xA;timesync sntp&#xA;sntp unicast&#xA;sntp 60&#xA;sntp server priority 1 10.100.12.33&#xA;sntp server priority 2 10.100.12.32&#xA;time daylight-time-rule continental-us-and-canada&#xA;time timezone -360&#xA;web-management idle-timeout 900&#xA;ip access-list extended &quot;vlan68-DEVEL_ACL&quot;&#xA;     10 remark &quot;ACL Applied to the vlan 68 interface (in)&quot;&#xA;     11 remark &quot;-----------------------------------------&quot;&#xA;     12 remark &quot;Allow traffic to flow within the DEVEL vlan&quot;&#xA;     13 permit ip 10.100.68.0 0.0.3.255 10.100.68.0 0.0.3.255&#xA;     22 remark &quot;Allow 80, 443 for Exchange and KBOX&quot;&#xA;     23 remark &quot;-----------------------------------------&quot;&#xA;     24 permit tcp 10.100.68.0 0.0.3.255 10.100.15.40 0.0.0.0 eq 80&#xA;     25 permit tcp 10.100.68.0 0.0.3.255 10.100.15.40 0.0.0.0 eq 443&#xA;     26 permit tcp 10.100.68.0 0.0.3.255 10.100.15.91 0.0.0.0 eq 80&#xA;     27 permit tcp 10.100.68.0 0.0.3.255 10.100.15.91 0.0.0.0 eq 443&#xA;     28 permit tcp 10.100.68.0 0.0.3.255 10.100.15.98 0.0.0.0 eq 80&#xA;     29 permit tcp 10.100.68.0 0.0.3.255 10.100.15.98 0.0.0.0 eq 443&#xA;     30 remark &quot;Block 80, 443&quot;&#xA;     31 remark &quot;-----------------------------------------&quot;&#xA;     32 deny tcp 10.100.68.0 0.0.3.255 10.100.12.0 0.0.3.255 eq 80&#xA;     33 deny tcp 10.100.68.0 0.0.3.255 10.100.12.0 0.0.3.255 eq 443&#xA;     80 remark &quot;Allow Other Dev to Prod traffic&quot;&#xA;     81 remark &quot;-------------------------------&quot;&#xA;     82 permit ip 10.100.68.0 0.0.3.255 10.100.12.0 0.0.3.255&#xA;     90 remark &quot;Allow Everything else (Internet)&quot;&#xA;     91 remark &quot;--------------------------------&quot;&#xA;     92 permit ip 10.100.68.0 0.0.3.255 0.0.0.0 255.255.255.255&#xA;     100 remark &quot;Allow return Internet traffic&quot;&#xA;     101 remark &quot;--------------------------------&quot;&#xA;     102 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255&#xA;   exit&#xA;ip authorized-managers 10.100.12.0 255.255.252.0 access manager&#xA;ip default-gateway 10.100.12.1&#xA;ip route 0.0.0.0 0.0.0.0 10.100.12.1&#xA;ip routing&#xA;..........&#xA;..........&#xA;..........&#xA;snmp-server community &quot;public&quot; unrestricted&#xA;snmp-server host 10.100.13.130 community &quot;public&quot; trap-level critical&#xA;snmp-server contact &quot;Dave Guyton - 2463&quot; location &quot;HQ&quot;&#xA;vlan 1&#xA;   name &quot;DEFAULT_VLAN&quot;&#xA;   no untagged D1-D3,D7,D9,D11,D14,D16,E1-E4,F1-F24&#xA;   untagged A1-A24,B1-B24,C1-C24,D4-D6,D8,D10,D12-D13,D15,D17-D24&#xA;   ip address 10.100.12.10 255.255.252.0&#xA;   ip local-proxy-arp&#xA;   forbid D14,D16&#xA;   exit&#xA;vlan 5&#xA;   name &quot;CharterInternetHA&quot;&#xA;   untagged D1-D3&#xA;   no ip address&#xA;   forbid A1-A24,B3-B24,C1-C24,D5-D24&#xA;   exit&#xA;vlan 6&#xA;   name &quot;AT&amp;amp;TInternetHA&quot;&#xA;   untagged D7,D9,D11&#xA;   no ip address&#xA;   forbid A1-A24,B3-B24,C1-C24,D1-D6,D8,D10,D12-D24&#xA;   exit&#xA;vlan 7&#xA;   name &quot;iSCSI VLAN&quot;&#xA;   untagged E1-E4,F1-F24&#xA;   no ip address&#xA;   forbid A1-A24,B1-B24,C1-C24,D1-D24&#xA;   exit&#xA;vlan 10&#xA;   name &quot;DMZ-Guest-WLAN&quot;&#xA;   tagged D14,D16,D20&#xA;   no ip address&#xA;   exit&#xA;vlan 68&#xA;   name &quot;DEVEL-68&quot;&#xA;   tagged A19,D23-D24&#xA;   ip access-group &quot;vlan68-DEVEL_ACL&quot; in&#xA;   ip address 10.100.68.1 255.255.252.0&#xA;   ip local-proxy-arp&#xA;   exit&#xA;vlan 72&#xA;   name &quot;VOICE&quot;&#xA;   tagged D23-D24&#xA;   ip address 10.100.72.1 255.255.255.0&#xA;   ip local-proxy-arp&#xA;   dhcp-server&#xA;   exit&#xA;no spanning-tree bpdu-throttle&#xA;no autorun&#xA;no dhcp config-file-update&#xA;no dhcp image-file-update&#xA;dhcp-server pool &quot;vlan72-Voice&quot;&#xA;   authoritative&#xA;   default-router &quot;10.100.72.1&quot;&#xA;   dns-server &quot;10.100.12.33,10.100.12.32&quot;&#xA;   domain-name &quot;memco.local&quot;&#xA;   lease 08:00:00&#xA;   network 10.100.72.0 255.255.255.0&#xA;   option 4 ip &quot;10.100.12.33,10.100.12.32&quot;&#xA;   option 42 ip &quot;10.100.12.33,10.100.12.32&quot;&#xA;   option 156 ascii &quot;ftpservers=10.100.13.16, layer2tagging=1, vlanid=72&quot;&#xA;   range 10.100.72.75 10.100.72.253&#xA;   exit&#xA;dhcp-server enable&amp;lt;br/&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IP Route Entries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Destination        Gateway         VLAN Type      Sub-Type   Metric     Dist.&#xA;  ------------------ --------------- ---- --------- ---------- ---------- -----&#xA;  0.0.0.0/0          10.100.12.1     1    static               1          1&#xA;  10.100.12.0/22     DEFAULT_VLAN    1    connected            1          0&#xA;  10.100.68.0/22     DEVEL-68        68   connected            1          0&#xA;  10.100.72.0/24     VOICE           72   connected            1          0&#xA;  127.0.0.0/8        reject               static               0          0&#xA;  127.0.0.1/32       lo0                  connected            1          0&amp;lt;br/&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19136" LastEditorUserId="19136" LastEditDate="2015-10-23T19:56:54.947" LastActivityDate="2015-10-23T19:56:54.947" Title="Wireless guest vlan issue" Tags="|switch|wireless|hp-procurve|" AnswerCount="0" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="23622" PostTypeId="2" ParentId="23614" CreationDate="2015-10-22T19:16:01.970" Score="4" Body="&lt;p&gt;If you are talking about L3 interfaces and EIGRP, we must assume this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Network1: Switch1 - Firewall&#xA;&#xA;Network2: Switch2 - Switch1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First. You need to set-up on your firewall EIGRP(on the way to LEARN all the routes, i thinking It don´t knows how to reach youre second switch), but, STOP, you HAVE a Palo Alto firewall, i know that EIGRP is a Cisco Propietary Routing Protocol, then, you need to set-up a DEFAULT route to Switch1(10.1.70.2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be a possible solution to your issue.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-22T19:16:01.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23623" PostTypeId="2" ParentId="23592" CreationDate="2015-10-22T19:19:52.310" Score="2" Body="&lt;p&gt;A simple router always will use an address on the networks that it is connected, cause it will work like a GATEWAY fot the equipments of that subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On modular routers, big routers that you can encounter on ISP or Tier1 or Tier2 places, port can be configured like router or switchports, and then, with your configuration in mind, you can decide to put or not and address. Remember, an address is the diference to work on Layer 2 or Layer 3.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-22T19:19:52.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23624" PostTypeId="2" ParentId="19441" CreationDate="2015-10-22T19:25:14.970" Score="1" Body="&lt;p&gt;Firt of all. You need to review your policies on the way to permit the traffic from inside to outside, and on the contrary way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that is OK, then you can check if your firewall know your LAN networks. I think&#xA;your firewall do not know how to reach your networks, you need to check if it is also running RIPv2, the same that routers.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-22T19:25:14.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23626" PostTypeId="2" ParentId="23555" CreationDate="2015-10-22T20:29:48.757" Score="0" Body="&lt;p&gt;After examining my switch closer I've discovered I can run full EIGRP on it so I won't need to statically redistribute routes from the router.&lt;/p&gt;&#xA;" OwnerUserId="19266" LastActivityDate="2015-10-22T20:29:48.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23627" PostTypeId="2" ParentId="23598" CreationDate="2015-10-22T21:14:15.853" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How do large companies generally go about implementing these kinds of solutions?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Various &quot;trade secret&quot; methods :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most common method is &quot;go distributed&quot;. Feed connections from many distributed -- &quot;network-local&quot; -- sites. The total bandwidth is still huge, but it's not crossing one monstrous link. (that also means a single failure, anywhere, will not kill you.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the viewers are all within a single network (&quot;autonomous system&quot;, &quot;enterprise lan&quot;, &quot;campus&quot;), distributed caching systems would be ideal. (eg. build your own mini-cdn) If they're all watching the same thing at the same time (ala broadcast TV), then multicast distribution is &lt;em&gt;the answer&lt;/em&gt;. (that's how AT&amp;amp;T Uverse does it, btw.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-22T21:14:15.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23628" PostTypeId="1" AcceptedAnswerId="23630" CreationDate="2015-10-22T22:21:19.720" Score="0" ViewCount="38" Body="&lt;p&gt;I've got a gameserver based in US/Los Angeles, and I've got people from Europe asking for a EU gameserver for better network latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been thinking about tunneling traffic from an EU machine in Frankfurt Germany to my machine in LA/US. Would there be a significant improvement in latency by having my users connect through a tunnel from EU to the gameserver in LA? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the answer is no, is there any way I can create a sort of &quot;gateway&quot; from other countries to a centralized server to improve latency?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also to consider:&#xA;If someone connects from the U.K. to Frankfurt, then to LA through the tunnel, would this negatively impact the connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network both US and EU machines would be on is the InterNAP network, if it matters, dedicated bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="19958" LastActivityDate="2015-10-22T23:23:22.520" Title="intercontinental networking for a single gameserver" Tags="|tcp|tunnel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23629" PostTypeId="2" ParentId="23458" CreationDate="2015-10-22T23:13:38.980" Score="1" Body="&lt;p&gt;1 Step: as above - Port forwarding on the Router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be specific about your 'message' query then you might like to look at:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spark IM client...&lt;/p&gt;&#xA;" OwnerUserId="19960" LastActivityDate="2015-10-22T23:13:38.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23630" PostTypeId="2" ParentId="23628" CreationDate="2015-10-22T23:23:22.520" Score="2" Body="&lt;p&gt;Tunneling won't help you, those packets still need to travel from Europe to the US and back. The longer the distance, the higher latency gets (roughly +1ms for every 100km), so routing traffic from the UK to Frankfurt to LA would even make it worse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to reduce latency, place those servers closer to your customers, host clusters in several continents and let your customers connect to the server closest to them.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-10-22T23:23:22.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23631" PostTypeId="1" CreationDate="2015-10-23T05:35:42.917" Score="2" ViewCount="155" Body="&lt;p&gt;Is there any common factor (similarity) between circuit switching or packet switching theory with the working principle of &lt;strong&gt;Spray and Wait&lt;/strong&gt; routing  protocol? If not, then what is the main difference?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean &quot;most network routing protocols are designed for use in fairly stable networks where paths can be known&quot;- does it refer to circuit switching theory where a complete path needs to be established before sending message?&lt;/p&gt;&#xA;" OwnerUserId="19948" LastEditorUserId="8499" LastEditDate="2016-03-21T17:10:30.857" LastActivityDate="2016-03-21T17:10:30.857" Title="Circuit switching and packet switching technique in routing protocols" Tags="|routing|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23632" PostTypeId="2" ParentId="23631" CreationDate="2015-10-23T05:43:20.010" Score="1" Body="&lt;p&gt;You are back to comparing apples and oranges.  You just can't compare two dissimilar things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing protocols are used to determine the direction traffic should be sent. How it is sent (switched) in that direction has nothing to do with the routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use a map to determine the direction to go to get to a particular location (routing), but how you get to the destination (switching) can be by walking, car, bus, plane, train, etc. One really doesn't necessarily depend on the other.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-23T05:43:20.010" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23633" PostTypeId="1" CreationDate="2015-10-23T06:42:50.240" Score="2" ViewCount="734" Body="&lt;p&gt;I've a client to which I want to deny access so that he cannot access my network host. There is this specified port that he scanned on my network host which I want to block (Port 137).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using NMAP, the client is able to find my open port on my network host(137). So I implemented an ACL on my router using the command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 111 deny udp (insert client ip) any eq 137&#xA;access-list 111 permit udp any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I wanted to do is to make sure that the moment the client uses NMAP to scan my network host for the port, port 137 will be filtered instead of open because of the ACL configured, however, the client is unable to even ping my network host now &lt;em&gt;unless&lt;/em&gt; I add another command, &lt;code&gt;permit ICMP any any&lt;/code&gt;,  in the ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this so? Can any experts shed light about this?&lt;/p&gt;&#xA;" OwnerUserId="19962" LastEditorUserId="8499" LastEditDate="2015-10-23T14:51:34.687" LastActivityDate="2015-10-23T14:51:34.687" Title="Cisco ACL not working as expected" Tags="|cisco|router|acl|access-control|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23635" PostTypeId="1" AcceptedAnswerId="23645" CreationDate="2015-10-23T07:22:38.387" Score="2" ViewCount="101" Body="&lt;p&gt;I have been reading mobile IPv6 for a while and in that the two terms:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mobile Node's Home address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mobile Node's Home agent address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;are used frequently, and they seem similar to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is do they mean the same thing, or are they two different addresses? If they are different then how can we tell which will be used when?&lt;/p&gt;&#xA;" OwnerUserId="19964" LastEditorUserId="8499" LastEditDate="2015-10-23T14:28:24.497" LastActivityDate="2015-10-23T14:28:24.497" Title="Mobile Node home address and Mobile Node Home Agent Address" Tags="|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23636" PostTypeId="1" AcceptedAnswerId="23638" CreationDate="2015-10-23T07:39:20.873" Score="2" ViewCount="1235" Body="&lt;p&gt;We have two managed switches (Draytek VigorSwitch P2261) in our (small) office. They are connected to each other with two ports (LACP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have four access points which provide plenty of coverage in our office, two of which are plugged into the first switch and two in the other. For redundancy, I'd like our network to continue operating if one of the switches dies (or is taking down for maintenance) but that would require both the switches to be connected to our router (Fortigate 60D). The little I know about networking tells me it's unlikely that just plugging both the switches into the router will work. (This lack of knowledge also made it hard for me to know what to search for, so my apologies if this is already answered somewhere)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically, my question is how can I achieve this? Or is it even possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Schematically, this is what I want to try to achieve:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          /---------- Switch 1&#xA;         /              |   |&#xA;Router  &amp;lt;               |   |&#xA;         \              |   |&#xA;          \---------- Switch 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;* edit *&lt;/strong&gt;&lt;br&gt;&#xA;Trying to make the question clearer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router/firewall in this case is just an example device, another device could be a NAS with at least two network ports for example. Ideally I would like to plug any LACP device with two ports into both switch 1 and 2 instead of both in the same switch. I've not been able to find out whether something like that is possible or not or if there is some other mechanism/protocol that allows you to do so.&lt;/p&gt;&#xA;" OwnerUserId="19963" LastEditorUserId="19963" LastEditDate="2015-10-23T08:59:23.483" LastActivityDate="2015-10-23T09:06:38.147" Title="Link aggregation / redundancy" Tags="|redundancy|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23637" PostTypeId="2" ParentId="23633" CreationDate="2015-10-23T07:42:57.230" Score="4" Body="&lt;p&gt;There is an implicit &quot;deny&quot; at the end of every access-list. So your current access-list actually says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 111 deny udp (insert client ip) any eq 137&#xA;access-list 111 permit udp any any&#xA;access-list 111 deny ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This means any UDP traffic (except from the client to port 137) is allowed, but all other traffic on that interface (including TCP and ICMP) is dropped. What you're looking for is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 111 deny udp (insert client ip) any eq 137&#xA;access-list 111 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2015-10-23T07:42:57.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23638" PostTypeId="2" ParentId="23636" CreationDate="2015-10-23T08:23:00.607" Score="2" Body="&lt;p&gt;There are many solutions to achieve redundancy on the first hop (Router). Normally one would use two routers which make use of a FHRP (First Hop Redundancy Protocol) like HSRP (Cisco-Propretary) or VRRP (open standard). A virtual ip address would be assigned to one of two routers and in case of failure a failover would occur and the standby router would take over the VIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since in your case you have a firewall and not a router your solutions will differ. You only have one firewall in your disposal and want to connect it redundant to both your switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many firewall vendors offer a &quot;redundant&quot; interface option. A secondary link may be connected to another switch and in case of the primary link going down a failover to the backup link would occur.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to check your software version, FortiGate supports this feature&#xA;&lt;a href=&quot;http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/interfaces.100.12.html&quot; rel=&quot;nofollow&quot;&gt;http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/interfaces.100.12.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19610" LastEditorUserId="19610" LastEditDate="2015-10-23T09:06:38.147" LastActivityDate="2015-10-23T09:06:38.147" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23640" PostTypeId="1" CreationDate="2015-10-23T10:14:13.663" Score="3" ViewCount="3114" Body="&lt;p&gt;I have an ongoing VLAN issue in my NX55 VPC. I'm new to the Nexus environment, so I need advice on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've created 3 VLANs in a Nexus 5548 VPC (where all the gateways are in my Core 6500VSS) . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not have a L3 daughter card inside my NX55, but I have LAN_BASE_SERVICE_PKG license to activate the &lt;code&gt;interface-vlan&lt;/code&gt; feature. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been advised that since I don't have a L3 daughter card, I will not be able to bring up L3 in my NX55, so I keep it as L2 while the routing will be handled by my Core 6500VSS with an Etherchannel VPC between them. Someone told me that having LAN_BASE license without L3 daughter card can cause issue on an SVI, so I already removed it, but the issue is still persists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The strange thing is that only 2 of 3 VLANs are UP, though they are all set in the same configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vlan716 is up, line protocol is up&#xA;  Hardware is EtherSVI, address is  002a.6a3f.3681&#xA;  Description: VLAN-SVR716&#xA;  Internet Address is 172.27.16.2/24&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec&#xA;SZANDCSF01# sh int vlan 717&#xA;Vlan717 is up, line protocol is up&#xA;  Hardware is EtherSVI, address is  002a.6a3f.3681&#xA;  Description: VLAN-SVR717&#xA;  Internet Address is 172.27.17.2/24&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec&#xA;SZANDCSF01# sh int vlan 718&#xA;Vlan718 is down, line protocol is down&#xA;  Hardware is EtherSVI, address is  002a.6a3f.3681&#xA;  Description: VLAN-SVR718&#xA;  Internet Address is 172.27.18.2/23&#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec&#xA;SZANDCSF01# ping 172.27.16.1 source 172.27.16.2&#xA;PING 172.27.16.1 (172.27.16.1) from 172.27.16.2: 56 data bytes&#xA;64 bytes from 172.27.16.1: icmp_seq=0 ttl=254 time=2.986 ms&#xA;64 bytes from 172.27.16.1: icmp_seq=1 ttl=254 time=2.409 ms&#xA;64 bytes from 172.27.16.1: icmp_seq=2 ttl=254 time=2.483 ms&#xA;64 bytes from 172.27.16.1: icmp_seq=3 ttl=254 time=2.474 ms&#xA;64 bytes from 172.27.16.1: icmp_seq=4 ttl=254 time=2.481 ms&#xA;--- 172.27.16.1 ping statistics ---&#xA;5 packets transmitted, 5 packets received, 0.00% packet loss&#xA;round-trip min/avg/max = 2.409/2.566/2.986 ms&#xA;SZANDCSF01# ping 172.27.17.1 source 172.27.17.2&#xA;PING 172.27.17.1 (172.27.17.1) from 172.27.17.2: 56 data bytes&#xA;64 bytes from 172.27.17.1: icmp_seq=0 ttl=254 time=2.979 ms&#xA;64 bytes from 172.27.17.1: icmp_seq=1 ttl=254 time=2.413 ms&#xA;64 bytes from 172.27.17.1: icmp_seq=2 ttl=254 time=2.481 ms&#xA;64 bytes from 172.27.17.1: icmp_seq=3 ttl=254 time=2.485 ms&#xA;64 bytes from 172.27.17.1: icmp_seq=4 ttl=254 time=2.477 ms&#xA;--- 172.27.17.1 ping statistics ---&#xA;5 packets transmitted, 5 packets received, 0.00% packet loss&#xA;round-trip min/avg/max = 2.413/2.567/2.979 ms&#xA;SZANDCSF01# ping 172.27.18.1 source 172.27.18.2&#xA;PING 172.27.18.1 (172.27.18.1) from 172.27.18.2: 56 data bytes&#xA;Request 0 timed out&#xA;Request 1 timed out&#xA;Request 2 timed out&#xA;Request 3 timed out&#xA;Request 4 timed out&#xA;--- 172.27.18.1 ping statistics ---&#xA;5 packets transmitted, 0 packets received, 100.00% packet loss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the &lt;code&gt;#sh vpc consistency-parameters global&lt;/code&gt;, it says that my VLAN 718 is suspended.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1# sh vpc consistency-parameters global&#xA;    Legend:&#xA;&#xA;Type 1 : vPC will be suspended in case of mismatch&#xA;&#xA; Name                        Type  Local Value            Peer Value&#xA; -------------               ----  ---------------------- -----------------------&#xA; QoS                         2     ([], [3], [], [], [],  ([], [3], [], [], [],&#xA;                              [])                    [])&#xA; Network QoS (MTU)           2     (1538, 2196, 0, 0, 0,  (1538, 2196, 0, 0, 0,&#xA;                              0)                     0)&#xA; Network Qos (Pause)         2     (F, T, F, F, F, F)     (F, T, F, F, F, F)&#xA; Input Queuing (Bandwidth)   2     (50, 50, 0, 0, 0, 0)   (50, 50, 0, 0, 0, 0)&#xA; Input Queuing (Absolute     2     (F, F, F, F, F, F)     (F, F, F, F, F, F)&#xA; Priority)&#xA; Output Queuing (Bandwidth)  2     (50, 50, 0, 0, 0, 0)   (50, 50, 0, 0, 0, 0)&#xA; Output Queuing (Absolute    2     (F, F, F, F, F, F)     (F, F, F, F, F, F)&#xA; Priority)&#xA; STP Mode                    1     Rapid-PVST             Rapid-PVST&#xA; STP Disabled                1     None                   None&#xA; STP MST Region Name         1     &quot;&quot;                     &quot;&quot;&#xA; STP MST Region Revision     1     0                      0&#xA; STP MST Region Instance to  1&#xA;  VLAN Mapping&#xA; STP Loopguard               1     Disabled               Disabled&#xA; STP Bridge Assurance        1     Enabled                Enabled&#xA; STP Port Type, Edge         1     Normal, Disabled,      Normal, Disabled,&#xA; BPDUFilter, Edge BPDUGuard        Disabled               Disabled&#xA; STP MST Simulate PVST       1     Enabled                Enabled&#xA; VTP domain                  2&#xA; VTP version                 2     1                      1&#xA; VTP mode                    2     Server                 Server&#xA; VTP password                2&#xA; VTP pruning status          2     Disabled               Disabled&#xA; IGMP Snooping Group-Limit   2     4000                   4000&#xA; Interface-vlan admin up     2     716-717                716-717&#xA; Interface-vlan routing      2     1,716-717              1,716-717&#xA; capability&#xA; Allowed VLANs               -     1,716-717              1,716-718&#xA; Local suspended VLANs       -     718                    -&#xA;&#xA;     SZANDCSF01# sh int trunk vlan 718&#xA;     --------------------------------------------------------------------------------&#xA;     Port          Native  Status        Port&#xA;              Vlan                  Channel&#xA;     --------------------------------------------------------------------------------&#xA;     --------------------------------------------------------------------------------&#xA;     Port          Vlans Allowed on Trunk&#xA;     --------------------------------------------------------------------------------&#xA;     --------------------------------------------------------------------------------&#xA;     Port          Vlans Err-disabled on Trunk&#xA;     --------------------------------------------------------------------------------&#xA;     Eth1/9        none&#xA;     Eth1/10       none&#xA;     Eth1/17       718&#xA;     Eth1/18       718&#xA;     Po1           718&#xA;     Po20          none&#xA;     --------------------------------------------------------------------------------&#xA;     Port          STP Forwarding&#xA;     --------------------------------------------------------------------------------&#xA;     Eth1/9        none&#xA;     Eth1/10       none&#xA;     Eth1/17       none&#xA;     Eth1/18       none&#xA;     Po1           1,716-717&#xA;     Po20          1,716-718&#xA;     --------------------------------------------------------------------------------&#xA;     Port          Vlans in spanning tree forwarding state and not pruned&#xA;     --------------------------------------------------------------------------------&#xA;     --------------------------------------------------------------------------------&#xA;     Port          Vlans Forwarding on FabricPath&#xA;     --------------------------------------------------------------------------------&#xA;SZANDCSF01# sh run int vlan 716&#xA;&#xA;interface Vlan716&#xA;  no shutdown&#xA;  description VLAN-SVR716&#xA;  no ip redirects&#xA;  ip address 172.27.16.2/24&#xA;&#xA;interface Vlan717&#xA;  no shutdown&#xA;  description VLAN-SVR717&#xA;  no ip redirects&#xA;  ip address 172.27.17.2/24&#xA;&#xA;interface Vlan718&#xA;  no shutdown&#xA;  description VLAN-SVR718&#xA;  ip address 172.27.18.2/23&#xA;&#xA;SZANDCSF02# sh run int vlan 716&#xA;&#xA;interface Vlan716&#xA;  no shutdown&#xA;  description VLAN-SVR716&#xA;  no ip redirects&#xA;  ip address 172.27.16.3/24&#xA;&#xA;interface Vlan717&#xA;  no shutdown&#xA;  description VLAN-SVR717&#xA;  no ip redirects&#xA;  ip address 172.27.17.3/24&#xA;&#xA;interface Vlan718&#xA;  no shutdown&#xA;  description VLAN-SVR718&#xA;  ip address 172.27.18.3/23&#xA;&#xA;SZANDCSF01# sh run int po 1&#xA;&#xA;interface port-channel1&#xA;  description ** PEER-LINK TO SZANDCSF02 **&#xA;  switchport mode trunk&#xA;  spanning-tree port type network&#xA;  speed 10000&#xA;  vpc peer-link&#xA;&#xA;SZANDCSF01# sh run int po20&#xA;&#xA;interface port-channel20&#xA;  description **L2-ETHERCHANNEL TO SZANDCRL01** (Portchannel to Core 6500VSS)&#xA;  shutdown&#xA;  switchport mode trunk&#xA;  switchport trunk allowed vlan 1,716-718&#xA;  spanning-tree link-type point-to-point&#xA;  vpc 20&#xA;&#xA;SZANDCSF02# sh run int po 1&#xA;&#xA;interface port-channel1&#xA;  description ** PEER-LINK TO SZANDCSF01 **&#xA;  switchport mode trunk&#xA;  spanning-tree port type network&#xA;  speed 10000&#xA;  vpc peer-link&#xA;&#xA;SZANDCSF02# sh run int po 20&#xA;&#xA;interface port-channel20&#xA;  description **L2-ETHERCHANNEL TO SZANDCRL01**&#xA;  switchport mode trunk&#xA;  switchport trunk allowed vlan 1,716-718&#xA;  spanning-tree link-type point-to-point&#xA;  vpc 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know if I made mistakes in the configuration, but I hope you can help me on this.&lt;/p&gt;&#xA;" OwnerUserId="19967" LastEditorUserId="8499" LastEditDate="2015-10-23T15:17:07.383" LastActivityDate="2018-07-30T17:07:46.873" Title="SVI (VLAN issue) in Nexus 5548 VPC" Tags="|vlan|" AnswerCount="0" CommentCount="7" ClosedDate="2018-08-12T17:49:41.610" ContentLicense="CC BY-SA 3.0" />
  <row Id="23642" PostTypeId="1" AcceptedAnswerId="23643" CreationDate="2015-10-23T12:47:07.327" Score="1" ViewCount="1443" Body="&lt;p&gt;I want to connect two networks using a wireless bridge. My networks are in different subnets and each have their own router (and DHCP server, and independent internet connection).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried a basic layer 2 bridge, but I can't connect to devices on the other network. I can ping both wireless devices (Ubiquiti Nanostation) from network 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network 1:&#xA;Router IP: 192.168.0.1 (and DHCP server), Mask: 255.255.255.0&#xA;Nanostation IP: 192.168.0.3 (as Access Point), Mask: 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network 2:&#xA;Router IP: 192.168.1.1 (and DHCP server), Mask: 255.255.255.0&#xA;Nanostation IP: 192.168.0.4 (as Station), Mask: 255.255.255.0&lt;/p&gt;&#xA;" OwnerUserId="19968" LastActivityDate="2015-10-23T13:42:45.417" Title="How to bridge two networks with Ubiquiti hardware?" Tags="|wireless|bridge|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23643" PostTypeId="2" ParentId="23642" CreationDate="2015-10-23T13:42:45.417" Score="3" Body="&lt;p&gt;You need to provide a route, otherwise you have two networks with no reason to talk across the link, as they are different subnets, with different default gateways, and the nanostation &lt;strong&gt;at&lt;/strong&gt; network 2 is &lt;strong&gt;on&lt;/strong&gt; network 1. If you plug a single computer into the LAN port on that nanostation, does it connect to network 1? it should, if the link is working. But without a route, no traffic will flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you need a router at each end that is capable of managing a connection to WAN and a connection to the other network. Not difficult, but not consumer-grade stuff.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-10-23T13:42:45.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23644" PostTypeId="2" ParentId="17087" CreationDate="2015-10-23T13:51:14.763" Score="1" Body="&lt;p&gt;In our network with more than 10000 devices (many of them user-administrated Windows devices) we experience this problem since the rise of Windows Vista and Windows 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is mostly caused by Windows &lt;a href=&quot;https://en.wikipedia.org/wiki/Link_Layer_Topology_Discovery&quot; rel=&quot;nofollow&quot;&gt;Link Layer Topology Discovery (LLTD)&lt;/a&gt;, which enables the search of windows file and printer shares in the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is important to know, that Link Layer Topology Discovery only causes problems in big LANs or VLANs with many LLTD-enabled devices. There, you can usually reliably trigger error-disabled state via connecting your LLTD-enabled device and starting Windows printer search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution is&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;to raise the arp inspection limit to the count of tolerated LLTD&#xA;devices and/or&lt;/li&gt;&#xA;&lt;li&gt;to consequently disable Link Layer Topology&#xA;Discovery on most devices.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Link Layer Topology Discovery can be disabled via one of the following steps:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Choose Start → Control Panel → Network and Sharing Center → Manage Network Connections → right-click on your Ethernet Connection → Properties  → deactivate both Link Layer Topology Discovery Mapper and Responder service.&lt;/li&gt;&#xA;&lt;li&gt;Uninstall mapper and responder drivers via &quot;netcfg.exe -u ms_lltdio&quot; and netcfg.exe -u ms_rspndr&quot;. This removes the drivers for all network devices.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc755075(v=ws.10).aspx&quot; rel=&quot;nofollow&quot;&gt;Group Policy for LLTD Mapper&lt;/a&gt; and LLTD Responder.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19971" LastActivityDate="2015-10-23T13:51:14.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23645" PostTypeId="2" ParentId="23635" CreationDate="2015-10-23T13:59:15.620" Score="1" Body="&lt;p&gt;A Mobile Node is the host which is roaming; a Mobile Node Home Agent is a router of the Mobile Node's home network which keeps track of the Mobile Node's current location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When traffic is sent to the Mobile Nodes Home Address, the Mobile Home Agent forwards that traffic, via a tunnel, to the Mobile Node at it's current location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could be compared to you going to visit a relative and forwarding your home phone to Grandma's home phone. Someone who calls your home number will reach you at Grandma's house, but the caller has no idea that you aren't at home.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-23T13:59:15.620" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23647" PostTypeId="1" AcceptedAnswerId="23667" CreationDate="2015-10-23T14:40:29.887" Score="2" ViewCount="3141" Body="&lt;p&gt;I have a sonicwall NSA 2400 firewall which has a LAN on X0, WAN on X3 (Failover WAN on X1). The X0 lan is running subnet 192.168.50.x (interface IP of 192.168.50.253) and everything is working fine on this subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today I have added another LAN to the network through a new switch operating on 192.168.250.x subnet. I have plugged the switch into the X4 interface on the firewall and configured the X4 interface to have static IP of 192.168.250.253. The new switch has a gateway of 192.168.250.253. I can now see the firewall using this IP through any device on the new subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My new subnet is working fine and traffic is segregated from the main subnet which is what I desire, but how can I enable internet access for the new subnet?&lt;/p&gt;&#xA;" OwnerUserId="19974" LastEditorUserId="19974" LastEditDate="2015-10-23T14:51:34.333" LastActivityDate="2015-10-24T05:04:17.437" Title="Multiple Subnets on Sonicwall Firewall" Tags="|sonicwall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23649" PostTypeId="1" AcceptedAnswerId="23674" CreationDate="2015-10-23T17:20:01.247" Score="0" ViewCount="505" Body="&lt;p&gt;I'm on my workstation at home. I've connected to the VPN for my company. I ran a dig on &quot;server01.test.int&quot; and it gives me the address 10.0.1.15. I ran a dig on &quot;server02.test.int&quot; and it gives me the address 172.16.20.30. From my workstation, I can telnet to both of those servers on port 22 and get the response from ssh. I don't have ssh creds for either server. I would like to confirm I can connect to 172.16.20.30:22 from 10.0.1.15, and vice-versa. I know these are different private networks, but there might be routes in place to allow these servers to reach each other. Is this doable if I can't log in to either server and try opening a connection directly? Can it be done indirectly from my workstation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Related question: how am I able to reach both subnets from my VPN?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="3957" LastEditorUserId="33" LastEditDate="2015-10-27T00:53:01.733" LastActivityDate="2015-10-27T00:53:01.733" Title="Determine if one server can reach another without logging into either" Tags="|routing|vpn|" AnswerCount="2" CommentCount="6" ClosedDate="2015-10-25T10:22:57.807" ContentLicense="CC BY-SA 3.0" />
  <row Id="23651" PostTypeId="1" AcceptedAnswerId="23928" CreationDate="2015-10-23T18:05:14.967" Score="1" ViewCount="1077" Body="&lt;p&gt;I am doing some physical changes to a dev network. The physical hardware is a Cisco ASR9006 to a traffic generator with duplex MM fiber. I am changing from a 10G traffic generator to a 1G. I am stumped and have not been able to get it to work (down/down from &quot;show int tengig &quot;, rx error on the traffic generator).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have done in chronological order:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Changed the C9k SFP from 10G to 1G. The 1G SFPs are NOT Cisco branded.&lt;/li&gt;&#xA;&lt;li&gt;Changed the bandwidth in the running config from 10G to 1G. Committed the changes.&lt;/li&gt;&#xA;&lt;li&gt;Verified 1G SFPs are in the traffic generator&lt;/li&gt;&#xA;&lt;li&gt;Did a loopback test on the used interfaces of the traffic generator. It worked fine.&lt;/li&gt;&#xA;&lt;li&gt;Lunch&lt;/li&gt;&#xA;&lt;li&gt;Go back to 10G SFPs on the C9k and put a pair in the traffic generator. Left the speed at 1G in the C9k running config. No dice.&lt;/li&gt;&#xA;&lt;li&gt;Went back to the original 10G setup. Worked just fine.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am lost. Is there anything that I missed here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Avago 850nm SFP (C9k and traffic generator)&#xA;Multimode fiber (OM3 50/125), 50micron &lt;/p&gt;&#xA;" OwnerUserId="19365" LastEditorUserId="19365" LastEditDate="2015-10-23T18:42:36.073" LastActivityDate="2015-10-31T02:53:58.220" Title="Troubleshooting Fiber: Changing from 10G to 1G connection" Tags="|cisco|fiber|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23652" PostTypeId="2" ParentId="23651" CreationDate="2015-10-23T18:13:28.583" Score="1" Body="&lt;p&gt;I have a doubt?. When you config on your 10 Gb SFP, from 10 to 1, did work?, because i just tried to down the speed from 10 to 1 and did not work. I thing for this way you can resolve your problem. You must check that your SPF permit downgrade the speed from 10 to 1.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-23T18:13:28.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23653" PostTypeId="1" AcceptedAnswerId="23654" CreationDate="2015-10-23T18:55:09.850" Score="1" ViewCount="209" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/Port_forwarding&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Port_forwarding&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computer networking, &lt;strong&gt;port forwarding&lt;/strong&gt; or port mapping is &lt;strong&gt;an&#xA;  application of network address translation (NAT)&lt;/strong&gt; that redirects a&#xA;  communication request from one address and port number combination to&#xA;  another while the packets are traversing a network gateway, such as a&#xA;  router or firewall.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think that network address translation (what a NAT device does)&#xA;isn't   necessarily involved in port forwarding (e.g SSH port&#xA;forwarding), by their definitions.   So   why does wikipedia say&#xA;port forwarding is an application of NAT? Can you explain from their&#xA;definitions?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it correct that what is said for &quot;port forwarding&quot; in a&#xA;commercial router (commercial in the sense of including NAT) so that a computer outside a LAN can access a&#xA;service inside the LAN isn't actually &quot;port forwarding&quot;, but NAT?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="7894" LastEditorUserId="7894" LastEditDate="2015-10-23T19:03:08.837" LastActivityDate="2016-05-16T12:03:34.000" Title="Why does wikipedia say port forwarding is an application of NAT" Tags="|nat|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23654" PostTypeId="2" ParentId="23653" CreationDate="2015-10-23T19:01:52.613" Score="3" Body="&lt;p&gt;Without NAT, port forwarding doesn't exist. Port forwarding is a function of NAT that allows traffic addressed to the outside interface, on a particular port, to be forwarded to a host on the inside network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, if I have a web server on an inside network with private addressing, and I would like to let people on the public Internet use the web server, I would need to set up port forwarding on the NAT router to let the public use the public, outside address to get to the private, inside address of the web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT translates an inside address to an outside address. Traffic destined for an inside private address cannot be routed on the internet. The public, outside address belongs to the NAT router. In the example above, traffic sent to the outside, public address of the router on port 80 (HTTP) would be dropped by the NAT router since it is not running a web server. When you configure port forwarding on the NAT router, then it knows to forward that traffic to a particular private, inside address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-23T19:14:10.637" LastActivityDate="2015-10-23T19:14:10.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23655" PostTypeId="1" AcceptedAnswerId="23656" CreationDate="2015-10-23T19:42:14.217" Score="1" ViewCount="2616" Body="&lt;p&gt;If I am correct, a network interface is the interface between a network interface controller and a network.&#xA;If I am not correct, please let me know. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;How many network interface can  a network interface controller have? (My guess: one)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How many network or MAC address can a network interface have? (My guess: one)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My question is from the fact that a computer or a router can have multiple IP or MAC addresses. Does that mean the computer or router &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;have multiple network interfaces, each of which has an address, or &lt;/li&gt;&#xA;&lt;li&gt;have multiple network interface controllers, each of which has a network interface assigned with an address,&lt;/li&gt;&#xA;&lt;li&gt;or both?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastActivityDate="2015-10-23T20:06:00.437" Title="How many network interface can a network interface controller have?" Tags="|ip|mac-address|interface|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23656" PostTypeId="2" ParentId="23655" CreationDate="2015-10-23T20:06:00.437" Score="1" Body="&lt;p&gt;When most people refer to a Network Interface Controller, they mean a single port. Some people use the acronym, NIC, to refer to this, or to Network Interface Card which may actually have multiple interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are corner cases which blur the hard lines you may want to draw. For instance:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, each controller (not card) would control a single interface, but there are things like switches which may use ASICs controlling multiple ports. In such a case, you must consider the &quot;controller&quot; broken into is individual parts, with a PHY on each physical port. Each physical port may still have its own MAC address, but the overall controller could be considered to have multiple MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you refer to a computer, I assume you mean a PC or end-user workstation. Most PCs have individual controllers for individual physical interfaces, but there are some specialty cards which can be used, in conjunction with software, to turn a PC into a router or switch. Each physical port would still have a MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IEEE 802 documents explain all the pieces and parts of the software and physical parts and requirements for controllers and interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-23T20:06:00.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23657" PostTypeId="1" AcceptedAnswerId="23658" CreationDate="2015-10-23T20:30:52.330" Score="2" ViewCount="668" Body="&lt;p&gt;Is there a way to check the current interface output/input rate on Cisco devices? the interface statistics only give the average over 5 minutes, and monitoring the interface seems to have a very long lag (as it also only shows the updated value over 5 minutes). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I do a show interface on a Juniper device, it gives the current input/output rate.. is there a way to do this on a Cisco device?&lt;/p&gt;&#xA;" OwnerUserId="13422" LastEditorUserId="13422" LastEditDate="2015-10-23T20:38:07.420" LastActivityDate="2015-10-23T20:41:09.613" Title="Showing the current intput/output rate on a cisco device" Tags="|cisco|juniper|interface|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23658" PostTypeId="2" ParentId="23657" CreationDate="2015-10-23T20:41:09.613" Score="2" Body="&lt;p&gt;An I/O rate must be over some time period since it is a number of bits per time period, just like your speed in a car is an average of the number of miles per hour. The Cisco device can change the time period for the average of a particular interface with the interface command, &lt;code&gt;load-interval&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your Juniper has to have a time period over which it averages the number of bits. It may be a one second time period, but you can't get bits per second unless you count the over a one second (or longer) time period.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, you do want an I/O rate averaged over a time period longer than 1 second since it smooths out bursts and gives you a more accurate picture of throughput on an interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-23T20:41:09.613" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="23659" PostTypeId="1" AcceptedAnswerId="23660" CreationDate="2015-10-23T20:44:30.160" Score="2" ViewCount="1706" Body="&lt;p&gt;I was reading a wiki page about Spanning Tree and the following quote intrigued me: &lt;code&gt;&quot;Both PVST and PVST+ protocols are Cisco proprietary protocols, and few switches from other vendors support them. &quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know, Cisco is proprietary about Spanning-Tree features: &lt;code&gt;Port Fast, BPDU Guard . . .&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's my question, I have no sure about it, I would like to confirm my statement. &lt;/p&gt;&#xA;" OwnerUserId="14008" LastActivityDate="2015-10-23T21:00:11.793" Title="Cisco proprietary protocol - Spanning Tree" Tags="|cisco|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23660" PostTypeId="2" ParentId="23659" CreationDate="2015-10-23T20:55:05.280" Score="4" Body="&lt;p&gt;Many Cisco protocols are proprietary simply because Cisco created a protocol to facilitate something where there wasn't an industry standard. For instance, Cisco created HSRP, and, eventually, submitted it for RFC approval. The industry feared extending the influence that Cisco has over networking, and it created a competing protocol, VRRP, which really does the same thing that HSRP does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco didn't change the Spanning Tree Protocol, but they extended it so that each VLAN can have a separate Spanning Tree instance (PVST: per-VLAN spanning tree). The industry created Multiple-instance Spanning Tree, but MSTP doesn't go as far as Cisco's PVST does. As rapid spanning tree became a standard, Cisco extended PVST to use Rapid Spanning Tree on a per VLAN basis (Rapid PVST).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-23T21:00:11.793" LastActivityDate="2015-10-23T21:00:11.793" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="23661" PostTypeId="2" ParentId="23649" CreationDate="2015-10-23T22:57:03.910" Score="3" Body="&lt;p&gt;I'll answer the second question first:  When you use a VPN, you can get to all the networks your administrator has granted you access to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have no information on the topology or policies of your network, then you don't have enough information to determine if the servers can talk to each other or not.  If you want to know, you would naturally ask your network administrator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can't get the information you need, it's probably because the administrator doesn't think you need to know it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-23T22:57:03.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23662" PostTypeId="1" CreationDate="2015-10-24T00:18:31.390" Score="1" ViewCount="506" Body="&lt;p&gt;This is an EIGRP Topology with frame relay. I'm not able to figure out why R1's topology table doesn't show feasible successor for 192.168.2.0/24?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;P 192.168.1.0/24, 1 successors, FD is 2730496&#xA;        via 172.16.124.2 (2730496/2218496), Serial3/0&#xA;        via 172.16.124.3 (3193856/2681856), Serial3/0&#xA;P 192.168.2.0/24, 1 successors, FD is 2681856&#xA;        via 172.16.124.3 (2681856/2169856), Serial3/0&#xA;P 192.168.3.0/24, 1 successors, FD is 3193856&#xA;        via 172.16.124.3 (3193856/2681856), Serial3/0&#xA;        via 172.16.124.2 (3242496/2730496), Serial3/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Topology looks like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/WYe1O.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WYe1O.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And why I'm receiving these messages on R5?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Oct 24 05:28:10.455: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.124.1 (Serial3/3) is up: new adjacency&#xA;R5(config-if)#&#xA;*Oct 24 05:28:23.559: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.124.1 (Serial3/3) is down: Interface G                                                          oodbye received&#xA;R5(config-if)#&#xA;*Oct 24 05:29:05.299: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.124.1 (Serial3/3) is up: new adjacency&#xA;R5(config-if)#&#xA;*Oct 24 05:32:09.819: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.124.1 (Serial3/3) is down: retry limit                                                           exceeded&#xA;*Oct 24 05:32:10.107: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.124.1 (Serial3/3) is down: Peer goodby                                                          e received&#xA;R5(config-if)#&#xA;*Oct 24 05:33:03.867: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.124.1 (Serial3/3) is up: new adjacency&#xA;R5(config-if)#&#xA;*Oct 24 05:33:55.747: %SYS-5-CONFIG_I: Configured from console by console&#xA;R5#&#xA;*Oct 24 05:36:08.363: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.124.1 (Serial3/3) is down: Peer goodbye received&#xA;R5#&#xA;*Oct 24 05:36:47.611: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.124.1 (Serial3/3) is up: new adjacency&#xA;R5#&#xA;*Oct 24 05:39:52.047: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.124.1 (Serial3/3) is down: Peer goodbye received&#xA;R5#&#xA;*Oct 24 05:40:30.191: %DUAL-5-NBRCHANGE: IP-EIGRP(0) 1: Neighbor 172.16.124.1 (Serial3/3) is up: new adjacency&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1) R1's neighbor table:&#xA;&#xA;    R1#show ip eigrp neighbors&#xA;    IP-EIGRP neighbors for process 1&#xA;    H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq&#xA;                                                (sec)         (ms)       Cnt Num&#xA;    1   172.16.124.4            Se3/0            178 00:00:10    1  5000  1  74&#xA;    2   172.16.124.2            Se3/0            120 00:15:34  987  5000  0  72&#xA;    0   172.16.124.3            Se3/0            147 00:15:34  138   828  0  77&#xA;&#xA;2) R1's topology Table:&#xA;&#xA;&#xA;&#xA;    R1#show ip eigrp topology&#xA;        IP-EIGRP Topology Table for AS(1)/ID(10.1.3.1)&#xA;&#xA;        Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,&#xA;               r - reply Status, s - sia Status&#xA;&#xA;        P 10.2.0.0/22, 1 successors, FD is 2297856&#xA;                via 172.16.124.2 (2297856/128256), Serial3/0&#xA;        P 10.3.1.0/24, 1 successors, FD is 3370496&#xA;                via 172.16.124.2 (3370496/2858496), Serial3/0&#xA;        P 10.1.3.0/24, 1 successors, FD is 128256&#xA;                via Connected, Loopback3&#xA;        P 10.3.0.0/22, 1 successors, FD is 2297856&#xA;                via 172.16.124.3 (2297856/128256), Serial3/0&#xA;        P 10.2.1.0/24, 1 successors, FD is 3321856&#xA;                via 172.16.124.3 (3321856/2809856), Serial3/0&#xA;        P 10.1.2.0/24, 1 successors, FD is 128256&#xA;                via Connected, Loopback2&#xA;        P 10.3.3.0/24, 1 successors, FD is 3370496&#xA;                via 172.16.124.2 (3370496/2858496), Serial3/0&#xA;        P 10.2.2.0/24, 1 successors, FD is 3321856&#xA;                via 172.16.124.3 (3321856/2809856), Serial3/0&#xA;        P 10.1.1.0/24, 1 successors, FD is 128256&#xA;                via Connected, Loopback1&#xA;        P 10.3.2.0/24, 1 successors, FD is 3370496&#xA;                via 172.16.124.2 (3370496/2858496), Serial3/0&#xA;        P 10.2.3.0/24, 1 successors, FD is 3321856&#xA;                via 172.16.124.3 (3321856/2809856), Serial3/0&#xA;        P 192.168.1.0/24, 1 successors, FD is 2730496&#xA;                via 172.16.124.2 (2730496/2218496), Serial3/0&#xA;                via 172.16.124.3 (3193856/2681856), Serial3/0&#xA;        P 192.168.2.0/24, 1 successors, FD is 2681856&#xA;                via 172.16.124.3 (2681856/2169856), Serial3/0&#xA;        P 192.168.3.0/24, 1 successors, FD is 3193856&#xA;                via 172.16.124.3 (3193856/2681856), Serial3/0&#xA;                via 172.16.124.2 (3242496/2730496), Serial3/0&#xA;        P 172.16.124.0/29, 1 successors, FD is 2169856&#xA;                via Connected, Serial3/0&#xA;        P 172.16.120.0/21, 1 successors, FD is 3705856&#xA;                via 172.16.124.3 (3705856/3193856), Serial3/0&#xA;                via 172.16.124.2 (3754496/3242496), Serial3/0&#xA;&#xA;        3) R1's routing table:&#xA;&#xA;        R1#show ip route&#xA;        Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;               D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;               N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;               E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;               i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;               ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;               o - ODR, P - periodic downloaded static route&#xA;&#xA;        Gateway of last resort is not set&#xA;&#xA;             172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks&#xA;        C       172.16.124.0/29 is directly connected, Serial3/0&#xA;        D       172.16.120.0/21 [90/3705856] via 172.16.124.3, 00:09:57, Serial3/0&#xA;             10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks&#xA;        D       10.3.1.0/24 [90/3370496] via 172.16.124.2, 00:09:57, Serial3/0&#xA;        D       10.2.0.0/22 [90/2297856] via 172.16.124.2, 00:09:57, Serial3/0&#xA;        C       10.1.3.0/24 is directly connected, Loopback3&#xA;        D       10.3.0.0/22 [90/2297856] via 172.16.124.3, 00:09:58, Serial3/0&#xA;        D       10.2.1.0/24 [90/3321856] via 172.16.124.3, 00:09:58, Serial3/0&#xA;        C       10.1.2.0/24 is directly connected, Loopback2&#xA;        D       10.3.3.0/24 [90/3370496] via 172.16.124.2, 00:09:57, Serial3/0&#xA;        D       10.2.2.0/24 [90/3321856] via 172.16.124.3, 00:09:58, Serial3/0&#xA;        C       10.1.1.0/24 is directly connected, Loopback1&#xA;        D       10.3.2.0/24 [90/3370496] via 172.16.124.2, 00:09:59, Serial3/0&#xA;        D       10.2.3.0/24 [90/3321856] via 172.16.124.3, 00:09:59, Serial3/0&#xA;        D    192.168.1.0/24 [90/2730496] via 172.16.124.2, 00:09:59, Serial3/0&#xA;        D    192.168.2.0/24 [90/2681856] via 172.16.124.3, 00:09:59, Serial3/0&#xA;        D    192.168.3.0/24 [90/3193856] via 172.16.124.3, 00:09:59, Serial3/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router's Running configs:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) R1's running configs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 2166 bytes&#xA;!&#xA;upgrade fpd auto&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$tImO$nXOKvyq7gRSwqCiLPJQJO.&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;key chain EIGRP_KEYS&#xA; key 1&#xA;   key-string cisco1&#xA;   accept-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA;   send-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA; key 2&#xA;   key-string cisco2&#xA;   accept-lifetime 00:00:00 Jan 28 2015 infinite&#xA;   send-lifetime 00:00:00 Jan 28 2015 infinite&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback1&#xA; ip address 10.1.1.1 255.255.255.0&#xA;!&#xA;interface Loopback2&#xA; ip address 10.1.2.1 255.255.255.0&#xA;!&#xA;interface Loopback3&#xA; ip address 10.1.3.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 172.30.8.1 255.255.255.0&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Serial3/0&#xA; ip address 172.16.124.1 255.255.255.248&#xA; encapsulation frame-relay&#xA; no ip split-horizon eigrp 1&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 10.0.0.0&#xA; network 172.16.0.0&#xA; network 172.30.0.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;logging alarm informational&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;banner motd ^C&#xA;*****************************&#xA;This is a CISCO ROUTER&#xA;*****************************^C&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; password cisco&#xA; logging synchronous&#xA; login&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;1) R2's running configs &amp;amp; routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 2121 bytes&#xA;!&#xA;upgrade fpd auto&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$UbxQ$Vsto.IK7WKlg8MkuYywEs1&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;key chain EIGRP_KEYS&#xA; key 1&#xA;   key-string cisco1&#xA;   accept-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA;   send-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback1&#xA; ip address 10.2.1.1 255.255.255.0&#xA;!&#xA;interface Loopback2&#xA; ip address 10.2.2.1 255.255.255.0&#xA;!&#xA;interface Loopback3&#xA; ip address 10.2.3.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Serial3/0&#xA; ip address 172.16.124.2 255.255.255.248&#xA; encapsulation frame-relay&#xA; ip summary-address eigrp 1 10.2.0.0 255.255.252.0 5&#xA; serial restart-delay 0&#xA; frame-relay map ip 172.16.124.3 201&#xA;!&#xA;interface Serial3/1&#xA; bandwidth 1500&#xA; ip address 192.168.1.1 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 10.0.0.0&#xA; network 172.16.0.0&#xA; network 192.168.1.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;logging alarm informational&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;banner motd ^C&#xA;*****************************&#xA;This is a CISCO ROUTER&#xA;*****************************^C&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; password cisco&#xA; logging synchronous&#xA; login&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;- R2's routing table;&#xA;&#xA;R2#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks&#xA;C       172.16.124.0/29 is directly connected, Serial3/0&#xA;D       172.16.120.0/21 [90/3242496] via 192.168.1.2, 00:10:48, Serial3/1&#xA;     10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks&#xA;D       10.3.1.0/24 [90/2858496] via 192.168.1.2, 00:10:46, Serial3/1&#xA;D       10.2.0.0/22 is a summary, 00:10:45, Null0&#xA;D       10.1.3.0/24 [90/2297856] via 172.16.124.1, 00:10:45, Serial3/0&#xA;D       10.3.0.0/22 [90/2809856] via 172.16.124.1, 00:10:48, Serial3/0&#xA;C       10.2.1.0/24 is directly connected, Loopback1&#xA;D       10.1.2.0/24 [90/2297856] via 172.16.124.1, 00:10:45, Serial3/0&#xA;D       10.3.3.0/24 [90/2858496] via 192.168.1.2, 00:10:46, Serial3/1&#xA;C       10.2.2.0/24 is directly connected, Loopback2&#xA;D       10.1.1.0/24 [90/2297856] via 172.16.124.1, 00:10:45, Serial3/0&#xA;D       10.3.2.0/24 [90/2858496] via 192.168.1.2, 00:10:46, Serial3/1&#xA;C       10.2.3.0/24 is directly connected, Loopback3&#xA;C    192.168.1.0/24 is directly connected, Serial3/1&#xA;D    192.168.2.0/24 [90/2730496] via 192.168.1.2, 00:10:49, Serial3/1&#xA;D    192.168.3.0/24 [90/2730496] via 192.168.1.2, 00:10:49, Serial3/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) R3's Running configs and routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#show run&#xA;R3#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 2273 bytes&#xA;!&#xA;upgrade fpd auto&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R3&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$fhTy$oS62/3CBdLhdKH89ogXQE0&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;key chain EIGRP_KEYS&#xA; key 1&#xA;   key-string cisco1&#xA;   accept-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA;   send-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA; key 2&#xA;   key-string cisco2&#xA;   accept-lifetime 00:00:00 Jan 28 2015 infinite&#xA;   send-lifetime 00:00:00 Jan 28 2015 infinite&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback1&#xA; ip address 10.3.1.1 255.255.255.0&#xA;!&#xA;interface Loopback2&#xA; ip address 10.3.2.1 255.255.255.0&#xA;!&#xA;interface Loopback3&#xA; ip address 10.3.3.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Serial3/0&#xA; ip address 172.16.124.3 255.255.255.248&#xA; encapsulation frame-relay&#xA; ip summary-address eigrp 1 10.3.0.0 255.255.252.0 5&#xA; serial restart-delay 0&#xA; frame-relay map ip 172.16.124.2 301 broadcast&#xA;!&#xA;interface Serial3/1&#xA; ip address 192.168.3.1 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; ip address 192.168.2.2 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 10.0.0.0&#xA; network 172.16.0.0&#xA; network 192.168.2.0&#xA; network 192.168.3.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;logging alarm informational&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;banner motd ^C&#xA;*****************************&#xA;This is a CISCO ROUTER&#xA;*****************************^C&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; password cisco&#xA; logging synchronous&#xA; login&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;- R3's routing table:&#xA;&#xA;R3#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks&#xA;C       172.16.124.0/29 is directly connected, Serial3/0&#xA;D       172.16.120.0/21 [90/3193856] via 192.168.2.1, 00:11:18, Serial3/2&#xA;     10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks&#xA;C       10.3.1.0/24 is directly connected, Loopback1&#xA;D       10.2.0.0/22 [90/2809856] via 172.16.124.1, 00:11:16, Serial3/0&#xA;D       10.1.3.0/24 [90/2297856] via 172.16.124.1, 00:11:19, Serial3/0&#xA;D       10.3.0.0/22 is a summary, 00:11:18, Null0&#xA;D       10.2.1.0/24 [90/2809856] via 192.168.2.1, 00:11:18, Serial3/2&#xA;D       10.1.2.0/24 [90/2297856] via 172.16.124.1, 00:11:19, Serial3/0&#xA;C       10.3.3.0/24 is directly connected, Loopback3&#xA;D       10.2.2.0/24 [90/2809856] via 192.168.2.1, 00:11:18, Serial3/2&#xA;D       10.1.1.0/24 [90/2297856] via 172.16.124.1, 00:11:19, Serial3/0&#xA;C       10.3.2.0/24 is directly connected, Loopback2&#xA;D       10.2.3.0/24 [90/2809856] via 192.168.2.1, 00:11:19, Serial3/2&#xA;D    192.168.1.0/24 [90/2681856] via 192.168.2.1, 00:11:17, Serial3/2&#xA;C    192.168.2.0/24 is directly connected, Serial3/2&#xA;D    192.168.3.0/24 [90/2681856] via 192.168.2.1, 00:11:19, Serial3/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4) R4's running configs and routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 1443 bytes&#xA;!&#xA;upgrade fpd auto&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R4&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Serial3/0&#xA; ip address 192.168.3.2 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA; ip address 192.168.1.2 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; ip address 192.168.2.1 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 192.168.1.0&#xA; network 192.168.2.0&#xA; network 192.168.3.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;logging alarm informational&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;- R4's routing table:&#xA;&#xA;R4#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks&#xA;D       172.16.124.0/29 [90/2681856] via 192.168.2.2, 00:12:30, Serial3/2&#xA;                        [90/2681856] via 192.168.1.1, 00:12:30, Serial3/1&#xA;D       172.16.120.0/21 [90/2681856] via 192.168.3.1, 00:12:28, Serial3/0&#xA;     10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks&#xA;D       10.3.1.0/24 [90/2297856] via 192.168.2.2, 00:13:27, Serial3/2&#xA;D       10.2.0.0/22 [90/3321856] via 192.168.2.2, 00:11:34, Serial3/2&#xA;D       10.1.3.0/24 [90/2809856] via 192.168.2.2, 00:11:34, Serial3/2&#xA;                    [90/2809856] via 192.168.1.1, 00:11:34, Serial3/1&#xA;D       10.3.0.0/22 [90/3321856] via 192.168.1.1, 00:11:36, Serial3/1&#xA;D       10.2.1.0/24 [90/2297856] via 192.168.1.1, 00:13:29, Serial3/1&#xA;D       10.1.2.0/24 [90/2809856] via 192.168.2.2, 00:11:34, Serial3/2&#xA;                    [90/2809856] via 192.168.1.1, 00:11:34, Serial3/1&#xA;D       10.3.3.0/24 [90/2297856] via 192.168.2.2, 00:13:28, Serial3/2&#xA;D       10.2.2.0/24 [90/2297856] via 192.168.1.1, 00:13:29, Serial3/1&#xA;D       10.1.1.0/24 [90/2809856] via 192.168.2.2, 00:11:34, Serial3/2&#xA;                    [90/2809856] via 192.168.1.1, 00:11:34, Serial3/1&#xA;D       10.3.2.0/24 [90/2297856] via 192.168.2.2, 00:13:28, Serial3/2&#xA;D       10.2.3.0/24 [90/2297856] via 192.168.1.1, 00:13:29, Serial3/1&#xA;C    192.168.1.0/24 is directly connected, Serial3/1&#xA;C    192.168.2.0/24 is directly connected, Serial3/2&#xA;C    192.168.3.0/24 is directly connected, Serial3/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;5) R5's running configs and routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    R5#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 1675 bytes&#xA;!&#xA;upgrade fpd auto&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R5&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$bO2q$Yzyc3mFfHaiVGiOOlz27l0&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Serial3/0&#xA; bandwidth 1500&#xA; ip address 192.168.3.1 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; ip address 172.16.124.4 255.255.255.248&#xA; encapsulation frame-relay&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 172.16.0.0&#xA; network 192.168.3.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;logging alarm informational&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;banner motd ^C&#xA;*****************************&#xA;This is a CISCO ROUTER&#xA;*****************************^C&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; password cisco&#xA; logging synchronous&#xA; login&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1's topology table still doesn't show feasible successor for 192.168.2.0/24&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip eigrp topology&#xA;IP-EIGRP Topology Table for AS(1)/ID(10.1.3.1)&#xA;&#xA;Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,&#xA;       r - reply Status, s - sia Status&#xA;&#xA;P 10.2.0.0/22, 1 successors, FD is 2297856&#xA;        via 172.16.124.2 (2297856/128256), Serial3/0&#xA;P 10.3.1.0/24, 2 successors, FD is 3370496&#xA;        via 172.16.124.2 (3370496/2858496), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 10.1.3.0/24, 1 successors, FD is 128256&#xA;        via Connected, Loopback3&#xA;P 10.3.0.0/22, 1 successors, FD is 2297856&#xA;        via 172.16.124.3 (2297856/128256), Serial3/0&#xA;P 10.2.1.0/24, 1 successors, FD is 3321856&#xA;        via 172.16.124.3 (3321856/2809856), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 10.1.2.0/24, 1 successors, FD is 128256&#xA;        via Connected, Loopback2&#xA;P 10.2.2.0/24, 1 successors, FD is 3321856&#xA;        via 172.16.124.3 (3321856/2809856), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 10.3.3.0/24, 2 successors, FD is 3370496&#xA;        via 172.16.124.2 (3370496/2858496), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 10.1.1.0/24, 1 successors, FD is 128256&#xA;        via Connected, Loopback1&#xA;P 10.2.3.0/24, 1 successors, FD is 3321856&#xA;        via 172.16.124.3 (3321856/2809856), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 10.3.2.0/24, 2 successors, FD is 3370496&#xA;        via 172.16.124.2 (3370496/2858496), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 192.168.1.0/24, 1 successors, FD is 2730496&#xA;        via 172.16.124.2 (2730496/2218496), Serial3/0&#xA;        via 172.16.124.3 (3193856/2681856), Serial3/0&#xA;P 192.168.2.0/24, 1 successors, FD is 2681856&#xA;        via 172.16.124.3 (2681856/2169856), Serial3/0&#xA;P 192.168.3.0/24, 1 successors, FD is 2730496&#xA;        via 172.16.124.4 (2730496/2218496), Serial3/0&#xA;        via 172.16.124.3 (3193856/2681856), Serial3/0&#xA;P 172.16.124.0/29, 1 successors, FD is 2169856&#xA;        via Connected, Serial3/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17520" LastEditorUserId="17520" LastEditDate="2015-10-24T02:41:09.723" LastActivityDate="2015-10-24T02:41:09.723" Title="Why R1's topology table doesn't show feasible successor for 192.168.2.0/24?" Tags="|eigrp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23663" PostTypeId="1" CreationDate="2015-10-24T00:58:03.713" Score="1" ViewCount="73" Body="&lt;p&gt;What makes a client outside an intranet can't access a service inside? Is it a NAT device, a firewall, or a router (in its academic definition sense i.e. gateway sense, not as a commercial router sense), or something else? (My guess is: a NAT  or a firewall)&lt;/p&gt;&#xA;" OwnerUserId="7894" LastActivityDate="2015-10-25T22:46:28.923" Title="What makes a client outside an intranet can't access a service inside?" Tags="|router|nat|firewall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23664" PostTypeId="2" ParentId="23663" CreationDate="2015-10-24T01:06:38.807" Score="1" Body="&lt;p&gt;It could be NAT. It could be a firewall. It could be that the gateway which the client uses doesn't have a route to the intranet.  It could be that the client's gateway has an ACL blocking access from the client IP address or the client source port, or access to the destination IP address or destination port. It could be that the router for the intranet has an ACL blocking access from the client IP address or the client source port, or access to the destination IP address or destination port.  It could be anything else in the path from the client to the intranet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could be any combination of the above.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-24T01:06:38.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23665" PostTypeId="2" ParentId="23662" CreationDate="2015-10-24T01:35:58.690" Score="2" Body="&lt;p&gt;On R5, Ser 3/3 has an incorrect mask.  You have 255.255.248.0.  It should be 255.255.255.248.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-24T01:35:58.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23667" PostTypeId="2" ParentId="23647" CreationDate="2015-10-24T05:04:17.437" Score="2" Body="&lt;p&gt;First double check the devices on that X4 subnet: Can they reach the router (192.168.250.253)? Is that is their default gateway? Correct subnet mask? Are you statically assigning IPs or using DHCP? Assuming all is well and they can reach the router but not beyond:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can't connect between your X0 LAN and X4 other subnet then I assume they are in separate Zones (unless you created one I will assume DMZ for X4) -- or you disabled Interface Trust for the LAN Zone. By default the DMZ Zone will have internet access, but you can check several places to ensure it has access:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What &lt;strong&gt;Network | Zone&lt;/strong&gt; is X4 in? If the same Zone as X0 then is &lt;em&gt;Interface Trust&lt;/em&gt; enabled on that Zone? Likely not if you can't connect between them.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check the &lt;strong&gt;Firewall | Access Rules&lt;/strong&gt;. Look at DMZ (or your Zone) &gt; WAN:&#xA;You should have an &lt;em&gt;Any / Any / Any Allow rule&lt;/em&gt;, if not you can create one or perhaps you have added a Deny rule with a higher precedence.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Look at the LAN &gt; WAN rules to see what it should look like. Usually it is last and usually the only rule [unless you are blocking some outbound traffic]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they are in the same Zone and Interface Trust is off then you may have changed the default rule from Any to X0 Subnet.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Check the &lt;strong&gt;Network | NAT Policies&lt;/strong&gt;. An Auto-Added Policy is usually added automatically. You may be missing one from &lt;em&gt;Inbound Interface = X4, Outbound Interface = X3&lt;/em&gt;. You will probably see one for X0 (in) -&gt; X3 (out). Near the bottom. Source IP is Any, Translated IP is X3 IP Address or WAN Primary IP or something. [Destination IP and Services are all Any / Original]&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can create one if one doesn't exist. But I would look under the X4 Interface' properties (Network | Interfaces) -- on the Advanced tab. Make sure Use Routed Mode is NOT checked off. If it is that disabled NAT, which you need if you are using an RFC 1918 non-routable/non-Public subnet on X4.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Finally check &lt;strong&gt;Network | Routing&lt;/strong&gt;. There should have been a rule added automatically for Source = Any, Destination = X4 Subnet, Service = Any, Gateway = 0.0.0.0, Interface = X4 so that &lt;em&gt;the inbound traffic can come BACK to the correct subnet&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You'll see one for your X0 subnet. I suspect this isn't the problem but you can look. Chances are you have either managed to disable NAT or have a Firewall rule blocking the traffic.&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-10-24T05:04:17.437" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23668" PostTypeId="1" CreationDate="2015-10-24T06:08:44.780" Score="1" ViewCount="993" Body="&lt;p&gt;I'm having problem with a site-to-site. I think I have the basic setup working and I want to confirm that the tunnel is up and working. Here is what I have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyos@&amp;lt;vpnxy&amp;gt;:~$ show vpn ipsec sa&#xA;Peer ID / IP                            Local ID / IP&#xA;------------                            -------------&#xA;&amp;lt;other endpoint&amp;gt;                        172.31.16.102&#xA;&#xA;    Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto&#xA;    ------  -----  -------------  -------  ----    -----  ------  ------  -----&#xA;    1       up     0.0/0.0        3des     sha1    yes    1289    3600    all&#xA;&#xA;&#xA;vyos@&amp;lt;vpnxy&amp;gt;:~$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This seems to indicate to me that the tunnel is up, only no traffic is flowing through it which I guess means that we aren't looking for a problem in VPN setup but rather in routing or natting somewhere?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a safe conclusion or can there still be VPN problems that causes the lack of traffic and if so how can  Ieffectively troubleshoot them?&lt;/p&gt;&#xA;" OwnerUserId="3632" LastActivityDate="2016-02-07T01:14:13.150" Title="Connection problem, site-to-site, VYOS" Tags="|vpn|ipsec|vyos|" AnswerCount="0" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23671" PostTypeId="2" ParentId="20851" CreationDate="2015-10-24T15:35:22.797" Score="1" Body="&lt;p&gt;The other answers have spoken to the topology and are absolutely correct.  I will speak a bit to the PIX config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are running PIX code versions 6.x, then you are going to be forced to consider NAT.  As you probably know, in PIX code 6.x, any packets that are crossing two security levels (aka, interfaces) must be NATed or they will be dropped.  This &quot;security feature&quot; is called &lt;em&gt;nat-control&lt;/em&gt;.  It is called this because in code versions 7.x and above, you are given the option to disable this behavior using the command &lt;code&gt;no nat-control&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, your options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you are running code 7.x+&lt;/strong&gt;, disable nat-control, and let the PIX route the packets from one interface to the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you are running code 6.x&lt;/strong&gt;, you will have to NAT everything crossing your interfaces.  The simplest way is to configure an Identity NAT for every IP.  The configuration will look something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;static  (inside,outside)  0.0.0.0  0.0.0.0  netmask  0.0.0.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If you are running code 6.x&lt;/strong&gt;, you can also try setting both interfaces (inside and outside) to the same security level, which might preclude the requirement for you to NAT everything as it crosses through.  I'll be honest though, I haven't tested this, and only just now thought of it as an option.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-10-24T15:35:22.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23672" PostTypeId="1" AcceptedAnswerId="23673" CreationDate="2015-10-24T16:41:47.590" Score="1" ViewCount="570" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Per-VLAN Spanning Tree+ (PVST+) is an extension of the PVST standard.&#xA;  Per-VLAN Spanning Tree+ (PVST+) allows interoperability between CST&#xA;  and PVST in Cisco switches.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What does &lt;code&gt;interoperability between CST and PVST&lt;/code&gt; mean?&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="8499" LastEditDate="2015-10-24T19:20:42.387" LastActivityDate="2015-10-24T19:25:13.533" Title="Interoperability CST and PVST" Tags="|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23673" PostTypeId="2" ParentId="23672" CreationDate="2015-10-24T16:49:48.787" Score="2" Body="&lt;p&gt;Interoperability here means backward compatibility between PVST+ and Common STP. It Uses Bridge Protocol Data Unit (BPDU) version 2 which is backward compatible with the 802.1D STP, which uses BPDU version 0. You can find information about it &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/72836-rapidpvst-mig-config.html&quot; rel=&quot;nofollow&quot;&gt;in this link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="8499" LastEditDate="2015-10-24T19:25:13.533" LastActivityDate="2015-10-24T19:25:13.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23674" PostTypeId="2" ParentId="23649" CreationDate="2015-10-24T18:34:18.663" Score="1" Body="&lt;p&gt;You would like to confirm If you can connect to 172.16.20.30:22 from 10.0.1.15, and vice-versa? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ANS: We can use IP spoofing technique to identify that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this doable if I can't log in to either server and try opening a connection directly? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ANS: Yes this is doable if you have ASA firewall in between these two servers but if meets below condition&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;ASA should be running with IOS 9.X&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Packets between these severs should only go through this firewall and servers should not communicate directly.If above conditions are met, we can use ping tcp command to confirm this, the actual command would be,&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ping tcp 172.16.20.30 22 source 10.0.1.15 5678&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ping tcp 10.0.1.15 22 source 172.16.20.30 7885&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You will get &quot;!&quot; If port 22 is open between these two IP's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can it be done indirectly from my workstation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, there is one old logic of IP spoofing to identify this but not sure about its success percentage.. This technique is doable only if there shouldn't be any traffic to these servers from any other IP's apart from your workstation..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This could be identified by obseving IP Identification field in IP header.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Identification(16 bits): This field is used for uniquely identifying the IP datagrams. This value is incremented every-time an IP datagram is sent from source to the destination. This field comes in handy while reassembly of fragmented IP data grams.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You have to send TCP SYN packet to 172.16.20.30(host A) in port 22 with spoofed source IP as 10.0.1.15(host B) from your workstation. Of course as you know, the reply from B will be to A but not to your workstation. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IPID is the the unique identification number of IP packet and that will get increment to each packet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The reply from A to your SYN packet would be as below,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A reply SYN/ACK to SYN if tcp 22 port is open, reply RST/ACK if tcp 22 port is closed. This packet will reach B if routes are present as you mentioned&lt;/li&gt;&#xA;&lt;li&gt;You can know the number of packets that hosts are sending using IP ID in header field.&lt;/li&gt;&#xA;&lt;li&gt;B reply RST to SYN|ACK, reply nothing to RST/ACK.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Flow will be as below&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You send SYN packet to Host B in port 22 with your original workstation IP as source. You will get SYN/ACK from B with IP ID as 1(for example)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You send SYN packet to host A with spoofed Host B IP as source  in port 22 from your workstation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If port 22 is open at Host A for Host B, A replies with SYN/ACK to B.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then B replies to A with RST and IP ID as 2, since B didn't sent TCP SYN originally to have TCP session (originally you sent it from your workstation which both parties dont know about it).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;After few sec you send one more SYN to B then you will get SYN/ACK from B with IP ID as 3. (So there is one more addional increment comparing the previous reply from B)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This confirm that you can connect to A from B in port 22. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If port 22 is closed at A for B, then the flow will be as below&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You send SYN packet to Host B in port 22 with your original workstation IP as source. You will get SYN/ACK from B with IP ID as 1(for example)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You send SYN packet to host A with spoofed Host B IP as source  in port 22 from your workstation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If port 22 is closed at Host A for Host B, A replies with RST/ACK to B.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then B discards the RST from A, wont send any reply to A.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;After few sec you send one more SYN to B then you will get SYN/ACK from B with IP ID as 2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This confirms that you cannot connect to Host A from Host B in port 22.&lt;/p&gt;&#xA;" OwnerUserId="19631" LastActivityDate="2015-10-24T18:34:18.663" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23679" PostTypeId="1" AcceptedAnswerId="23680" CreationDate="2015-10-24T21:33:10.220" Score="8" ViewCount="1658" Body="&lt;p&gt;I have run into an interesting issue setting the native VLAN between one of my Cisco Catalyst 2960 and my Layer 3 switch (third party). Here is the setup, the layer three switch is set up to run on native vlan 171 and allows vlans 1,2,151,170-175,1000-1001 over the trunk. The Cisco switch in question is configured to trunk native vlan 1 and allow 1,2,151,170-175,1000-1001. The layer 3 supports RSTP and its bridge ID was set lower than the Cisco switches downstream so it would always be root. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So from what I have describe I obviously have a native vlan mismatch over this trunk. Downstream of this specific Cisco switch has 4 other switches connected to it which trunk native vlan 1001 and allow vlans 1,2,151,170-175,1000-1001.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So everytime I attempt to correct the native vlan mismatch between the Layer 3 switch and the one Cisco Switch the trunk will not pass any traffic over that trunk. The Layer 3 switch sees there is something plugged in and sends ARPS but no replies come back. The changes being attempted are as to set the native vlan to 1001 on both ends of the trunk. The only way i can have the same native vlan is if i set it to vlan 1 on both ends. Support for the third party Layer 3 switch say's there are no error's or issues on that end. Does anyone have any ideas? do I have an spann tree issue? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer 3 switch is not becoming the root for all the VLANs, just for VLAN 1, another access switch is the root for the rest of the VLANs. I have not been able to duplicate this in a Lab which makes it more confusing.&lt;/p&gt;&#xA;" OwnerUserId="14372" LastEditorUserId="8499" LastEditDate="2020-01-10T09:38:42.923" LastActivityDate="2020-01-10T09:38:42.923" Title="Native Vlan Cisco Catalyst and Layer 3 switch" Tags="|cisco|switch|vlan|cisco-catalyst|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23680" PostTypeId="2" ParentId="23679" CreationDate="2015-10-24T21:47:00.137" Score="4" Body="&lt;p&gt;The non-Cisco switch will be running MST if it is using Rapid STP. You need to make sure your Cisco switches are also running MST, not the default PVST+ or Rapid PVST+. You need to run the same STP version on all the connected switches for STP to work correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you fix all that, make sure that the native VLANs on each end of a link are the same. Cisco switches will use CDP to verify this, but your non-Cisco switch probably doesn't have CDP, so it may ignorant of the mismatch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT per the comment:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Different versions of STP use different BPDUs to establish the root switch and root ports. Cisco PVST+ (including Rapid PVST+) uses a separate STP instance for each VLAN, while MST uses one instance of STP for each user-defined group of VLANs, and, unless you take pains to do this, the two STP versions probably won't match in this regard. When mixing the two, it is normally best to use MST, and correctly match the VLANs to the STP groups. This works well, but it is certainly more work than using the Cisco STP version everywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to interoperate the two versions, but it can be difficult to get it right so that the root and root ports are correctly identified on each switch in the layer-2 domain. &lt;em&gt;Having inconsistent root switches and root ports can cause STP loops resulting in broadcast storms which can bring down the entire layer-2 domain.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is much easier to use a single STP version across all your switches, and, unfortunately for added complexity, that would probably be be MST when mixing Cisco and non-Cisco switches.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-12-17T01:49:18.790" LastActivityDate="2018-12-17T01:49:18.790" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="23682" PostTypeId="1" AcceptedAnswerId="23685" CreationDate="2015-10-25T06:54:03.550" Score="2" ViewCount="173" Body="&lt;pre&gt;&lt;code&gt;P 192.168.1.0/24, 1 successors, FD is 2730496&#xA;        via 172.16.124.2 (2730496/2218496), Serial3/0&#xA;        via 172.16.124.3 (3193856/2681856), Serial3/0&#xA;P 192.168.2.0/24, 1 successors, FD is 2681856&#xA;        via 172.16.124.3 (2681856/2169856), Serial3/0&#xA;P 192.168.3.0/24, 1 successors, FD is 2730496&#xA;        via 172.16.124.4 (2730496/2218496), Serial3/0&#xA;        via 172.16.124.3 (3193856/2681856), Serial3/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/23662/why-r1s-topology-table-doesnt-show-feasible-successor-for-192-168-2-0-24&quot;&gt;Previous question&lt;/a&gt; was not answered properly, that's why I'm posting it again by making some corrections.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology looks like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GZSCV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GZSCV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) R1's Neighbor table, Topology Table and Routing table looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip eigrp neighbors&#xA;IP-EIGRP neighbors for process 1&#xA;H   Address                 Interface       Hold Uptime   SRTT   RTO  Q  Seq&#xA;                                            (sec)         (ms)       Cnt Num&#xA;2   172.16.124.2            Se3/0            128 00:04:29 1179  5000  0  18&#xA;1   172.16.124.3            Se3/0            132 00:04:29  984  5000  0  17&#xA;0   172.16.124.4            Se3/0            136 00:04:29  982  5000  0  15&#xA;&#xA;R1#show ip eigrp topology&#xA;IP-EIGRP Topology Table for AS(1)/ID(10.1.3.1)&#xA;&#xA;Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,&#xA;       r - reply Status, s - sia Status&#xA;&#xA;P 10.2.0.0/22, 1 successors, FD is 2297856&#xA;        via 172.16.124.2 (2297856/128256), Serial3/0&#xA;P 10.3.1.0/24, 2 successors, FD is 3370496&#xA;        via 172.16.124.2 (3370496/2858496), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 10.1.3.0/24, 1 successors, FD is 128256&#xA;        via Connected, Loopback3&#xA;P 10.3.0.0/22, 1 successors, FD is 2297856&#xA;        via 172.16.124.3 (2297856/128256), Serial3/0&#xA;P 10.2.1.0/24, 1 successors, FD is 3321856&#xA;        via 172.16.124.3 (3321856/2809856), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 10.1.2.0/24, 1 successors, FD is 128256&#xA;        via Connected, Loopback2&#xA;P 10.2.2.0/24, 1 successors, FD is 3321856&#xA;        via 172.16.124.3 (3321856/2809856), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 10.3.3.0/24, 2 successors, FD is 3370496&#xA;        via 172.16.124.2 (3370496/2858496), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 10.1.1.0/24, 1 successors, FD is 128256&#xA;        via Connected, Loopback1&#xA;P 10.2.3.0/24, 1 successors, FD is 3321856&#xA;        via 172.16.124.3 (3321856/2809856), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 10.3.2.0/24, 2 successors, FD is 3370496&#xA;        via 172.16.124.2 (3370496/2858496), Serial3/0&#xA;        via 172.16.124.4 (3370496/2858496), Serial3/0&#xA;P 192.168.1.0/24, 1 successors, FD is 2730496&#xA;        via 172.16.124.2 (2730496/2218496), Serial3/0&#xA;        via 172.16.124.3 (3193856/2681856), Serial3/0&#xA;P 192.168.2.0/24, 1 successors, FD is 2681856&#xA;        via 172.16.124.3 (2681856/2169856), Serial3/0&#xA;P 192.168.3.0/24, 1 successors, FD is 2730496&#xA;        via 172.16.124.4 (2730496/2218496), Serial3/0&#xA;        via 172.16.124.3 (3193856/2681856), Serial3/0&#xA;P 172.16.124.0/29, 1 successors, FD is 2169856&#xA;        via Connected, Serial3/0&#xA;&#xA;R1#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     172.16.0.0/29 is subnetted, 1 subnets&#xA;C       172.16.124.0 is directly connected, Serial3/0&#xA;     10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks&#xA;D       10.3.1.0/24 [90/3370496] via 172.16.124.4, 00:04:39, Serial3/0&#xA;                    [90/3370496] via 172.16.124.2, 00:04:39, Serial3/0&#xA;D       10.2.0.0/22 [90/2297856] via 172.16.124.2, 00:04:39, Serial3/0&#xA;C       10.1.3.0/24 is directly connected, Loopback3&#xA;D       10.3.0.0/22 [90/2297856] via 172.16.124.3, 00:04:40, Serial3/0&#xA;D       10.2.1.0/24 [90/3321856] via 172.16.124.3, 00:04:40, Serial3/0&#xA;C       10.1.2.0/24 is directly connected, Loopback2&#xA;D       10.3.3.0/24 [90/3370496] via 172.16.124.4, 00:04:40, Serial3/0&#xA;                    [90/3370496] via 172.16.124.2, 00:04:40, Serial3/0&#xA;D       10.2.2.0/24 [90/3321856] via 172.16.124.3, 00:04:40, Serial3/0&#xA;C       10.1.1.0/24 is directly connected, Loopback1&#xA;D       10.3.2.0/24 [90/3370496] via 172.16.124.4, 00:04:41, Serial3/0&#xA;                    [90/3370496] via 172.16.124.2, 00:04:41, Serial3/0&#xA;D       10.2.3.0/24 [90/3321856] via 172.16.124.3, 00:04:41, Serial3/0&#xA;D    192.168.1.0/24 [90/2730496] via 172.16.124.2, 00:04:41, Serial3/0&#xA;D    192.168.2.0/24 [90/2681856] via 172.16.124.3, 00:04:41, Serial3/0&#xA;D    192.168.3.0/24 [90/2730496] via 172.16.124.4, 00:04:41, Serial3/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) R1 running configs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1's running configs:&#xA;&#xA;R1#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 2166 bytes&#xA;!&#xA;upgrade fpd auto&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$tImO$nXOKvyq7gRSwqCiLPJQJO.&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;key chain EIGRP_KEYS&#xA; key 1&#xA;   key-string cisco1&#xA;   accept-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA;   send-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA; key 2&#xA;   key-string cisco2&#xA;   accept-lifetime 00:00:00 Jan 28 2015 infinite&#xA;   send-lifetime 00:00:00 Jan 28 2015 infinite&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback1&#xA; ip address 10.1.1.1 255.255.255.0&#xA;!&#xA;interface Loopback2&#xA; ip address 10.1.2.1 255.255.255.0&#xA;!&#xA;interface Loopback3&#xA; ip address 10.1.3.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 172.30.8.1 255.255.255.0&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Serial3/0&#xA; ip address 172.16.124.1 255.255.255.248&#xA; encapsulation frame-relay&#xA; no ip split-horizon eigrp 1&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 10.0.0.0&#xA; network 172.16.0.0&#xA; network 172.30.0.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;logging alarm informational&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;banner motd ^C&#xA;*****************************&#xA;This is a CISCO ROUTER&#xA;*****************************^C&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; password cisco&#xA; logging synchronous&#xA; login&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) R2 running configs and routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 2121 bytes&#xA;!&#xA;upgrade fpd auto&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$UbxQ$Vsto.IK7WKlg8MkuYywEs1&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;key chain EIGRP_KEYS&#xA; key 1&#xA;   key-string cisco1&#xA;   accept-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA;   send-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback1&#xA; ip address 10.2.1.1 255.255.255.0&#xA;!&#xA;interface Loopback2&#xA; ip address 10.2.2.1 255.255.255.0&#xA;!&#xA;interface Loopback3&#xA; ip address 10.2.3.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Serial3/0&#xA; ip address 172.16.124.2 255.255.255.248&#xA; encapsulation frame-relay&#xA; ip summary-address eigrp 1 10.2.0.0 255.255.252.0 5&#xA; serial restart-delay 0&#xA; frame-relay map ip 172.16.124.3 201&#xA;!&#xA;interface Serial3/1&#xA; bandwidth 1500&#xA; ip address 192.168.1.1 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 10.0.0.0&#xA; network 172.16.0.0&#xA; network 192.168.1.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;logging alarm informational&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;banner motd ^C&#xA;*****************************&#xA;This is a CISCO ROUTER&#xA;*****************************^C&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; password cisco&#xA; logging synchronous&#xA; login&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;R2#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     172.16.0.0/29 is subnetted, 1 subnets&#xA;C       172.16.124.0 is directly connected, Serial3/0&#xA;     10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks&#xA;D       10.3.1.0/24 [90/2858496] via 192.168.1.2, 00:17:06, Serial3/1&#xA;D       10.2.0.0/22 is a summary, 00:17:05, Null0&#xA;D       10.1.3.0/24 [90/2297856] via 172.16.124.1, 00:17:06, Serial3/0&#xA;D       10.3.0.0/22 [90/2809856] via 172.16.124.1, 00:17:05, Serial3/0&#xA;C       10.2.1.0/24 is directly connected, Loopback1&#xA;D       10.1.2.0/24 [90/2297856] via 172.16.124.1, 00:17:06, Serial3/0&#xA;D       10.3.3.0/24 [90/2858496] via 192.168.1.2, 00:17:06, Serial3/1&#xA;C       10.2.2.0/24 is directly connected, Loopback2&#xA;D       10.1.1.0/24 [90/2297856] via 172.16.124.1, 00:17:06, Serial3/0&#xA;D       10.3.2.0/24 [90/2858496] via 192.168.1.2, 00:17:06, Serial3/1&#xA;C       10.2.3.0/24 is directly connected, Loopback3&#xA;C    192.168.1.0/24 is directly connected, Serial3/1&#xA;D    192.168.2.0/24 [90/2730496] via 192.168.1.2, 00:17:07, Serial3/1&#xA;D    192.168.3.0/24 [90/2730496] via 192.168.1.2, 00:17:07, Serial3/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4) R3's running configs and routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 2273 bytes&#xA;!&#xA;upgrade fpd auto&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R3&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$fhTy$oS62/3CBdLhdKH89ogXQE0&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;key chain EIGRP_KEYS&#xA; key 1&#xA;   key-string cisco1&#xA;   accept-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA;   send-lifetime 00:00:00 Jan 1 2015 00:00:00 Feb 1 2015&#xA; key 2&#xA;   key-string cisco2&#xA;   accept-lifetime 00:00:00 Jan 28 2015 infinite&#xA;   send-lifetime 00:00:00 Jan 28 2015 infinite&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback1&#xA; ip address 10.3.1.1 255.255.255.0&#xA;!&#xA;interface Loopback2&#xA; ip address 10.3.2.1 255.255.255.0&#xA;!&#xA;interface Loopback3&#xA; ip address 10.3.3.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Serial3/0&#xA; ip address 172.16.124.3 255.255.255.248&#xA; encapsulation frame-relay&#xA; ip summary-address eigrp 1 10.3.0.0 255.255.252.0 5&#xA; serial restart-delay 0&#xA; frame-relay map ip 172.16.124.2 301 broadcast&#xA;!&#xA;interface Serial3/1&#xA; ip address 192.168.3.1 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; ip address 192.168.2.2 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 10.0.0.0&#xA; network 172.16.0.0&#xA; network 192.168.2.0&#xA; network 192.168.3.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;logging alarm informational&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;banner motd ^C&#xA;*****************************&#xA;This is a CISCO ROUTER&#xA;*****************************^C&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; password cisco&#xA; logging synchronous&#xA; login&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;R3#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     172.16.0.0/29 is subnetted, 1 subnets&#xA;C       172.16.124.0 is directly connected, Serial3/0&#xA;     10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks&#xA;C       10.3.1.0/24 is directly connected, Loopback1&#xA;D       10.2.0.0/22 [90/2809856] via 172.16.124.1, 00:18:55, Serial3/0&#xA;D       10.1.3.0/24 [90/2297856] via 172.16.124.1, 00:18:56, Serial3/0&#xA;D       10.3.0.0/22 is a summary, 00:18:55, Null0&#xA;D       10.2.1.0/24 [90/2809856] via 192.168.2.1, 00:18:55, Serial3/2&#xA;D       10.1.2.0/24 [90/2297856] via 172.16.124.1, 00:18:56, Serial3/0&#xA;C       10.3.3.0/24 is directly connected, Loopback3&#xA;D       10.2.2.0/24 [90/2809856] via 192.168.2.1, 00:18:55, Serial3/2&#xA;D       10.1.1.0/24 [90/2297856] via 172.16.124.1, 00:18:56, Serial3/0&#xA;C       10.3.2.0/24 is directly connected, Loopback2&#xA;D       10.2.3.0/24 [90/2809856] via 192.168.2.1, 00:18:56, Serial3/2&#xA;D    192.168.1.0/24 [90/2681856] via 192.168.2.1, 00:18:56, Serial3/2&#xA;C    192.168.2.0/24 is directly connected, Serial3/2&#xA;D    192.168.3.0/24 [90/2681856] via 192.168.2.1, 00:18:56, Serial3/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;5) R4's running configs and routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 1443 bytes&#xA;!&#xA;upgrade fpd auto&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R4&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Serial3/0&#xA; ip address 192.168.3.2 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA; ip address 192.168.1.2 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; ip address 192.168.2.1 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 192.168.1.0&#xA; network 192.168.2.0&#xA; network 192.168.3.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;logging alarm informational&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;R4#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     172.16.0.0/29 is subnetted, 1 subnets&#xA;D       172.16.124.0 [90/2681856] via 192.168.3.1, 00:21:09, Serial3/0&#xA;                     [90/2681856] via 192.168.2.2, 00:21:09, Serial3/2&#xA;                     [90/2681856] via 192.168.1.1, 00:21:09, Serial3/1&#xA;     10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks&#xA;D       10.3.1.0/24 [90/2297856] via 192.168.2.2, 00:22:10, Serial3/2&#xA;D       10.2.0.0/22 [90/3321856] via 192.168.3.1, 00:20:14, Serial3/0&#xA;                    [90/3321856] via 192.168.2.2, 00:20:14, Serial3/2&#xA;D       10.1.3.0/24 [90/2809856] via 192.168.3.1, 00:20:15, Serial3/0&#xA;                    [90/2809856] via 192.168.2.2, 00:20:15, Serial3/2&#xA;                    [90/2809856] via 192.168.1.1, 00:20:15, Serial3/1&#xA;D       10.3.0.0/22 [90/3321856] via 192.168.3.1, 00:20:14, Serial3/0&#xA;                    [90/3321856] via 192.168.1.1, 00:20:14, Serial3/1&#xA;D       10.2.1.0/24 [90/2297856] via 192.168.1.1, 00:22:06, Serial3/1&#xA;D       10.1.2.0/24 [90/2809856] via 192.168.3.1, 00:20:16, Serial3/0&#xA;                    [90/2809856] via 192.168.2.2, 00:20:16, Serial3/2&#xA;                    [90/2809856] via 192.168.1.1, 00:20:16, Serial3/1&#xA;D       10.3.3.0/24 [90/2297856] via 192.168.2.2, 00:22:10, Serial3/2&#xA;D       10.2.2.0/24 [90/2297856] via 192.168.1.1, 00:22:06, Serial3/1&#xA;D       10.1.1.0/24 [90/2809856] via 192.168.3.1, 00:20:16, Serial3/0&#xA;                    [90/2809856] via 192.168.2.2, 00:20:16, Serial3/2&#xA;                    [90/2809856] via 192.168.1.1, 00:20:16, Serial3/1&#xA;D       10.3.2.0/24 [90/2297856] via 192.168.2.2, 00:22:10, Serial3/2&#xA;D       10.2.3.0/24 [90/2297856] via 192.168.1.1, 00:22:06, Serial3/1&#xA;C    192.168.1.0/24 is directly connected, Serial3/1&#xA;C    192.168.2.0/24 is directly connected, Serial3/2&#xA;C    192.168.3.0/24 is directly connected, Serial3/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;6) R5's running configs and routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R5#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 1675 bytes&#xA;!&#xA;upgrade fpd auto&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R5&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$bO2q$Yzyc3mFfHaiVGiOOlz27l0&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Serial3/0&#xA; bandwidth 1500&#xA; ip address 192.168.3.1 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; ip address 172.16.124.4 255.255.255.248&#xA; encapsulation frame-relay&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 172.16.0.0&#xA; network 192.168.3.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;logging alarm informational&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;banner motd ^C&#xA;*****************************&#xA;This is a CISCO ROUTER&#xA;*****************************^C&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; password cisco&#xA; logging synchronous&#xA; login&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;R5#show ip rou&#xA;R5#show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     172.16.0.0/29 is subnetted, 1 subnets&#xA;C       172.16.124.0 is directly connected, Serial3/3&#xA;     10.0.0.0/8 is variably subnetted, 11 subnets, 2 masks&#xA;D       10.3.1.0/24 [90/2858496] via 192.168.3.2, 00:21:30, Serial3/0&#xA;D       10.2.0.0/22 [90/2809856] via 172.16.124.1, 00:21:29, Serial3/3&#xA;D       10.1.3.0/24 [90/2297856] via 172.16.124.1, 00:21:30, Serial3/3&#xA;D       10.3.0.0/22 [90/2809856] via 172.16.124.1, 00:21:29, Serial3/3&#xA;D       10.2.1.0/24 [90/2858496] via 192.168.3.2, 00:21:29, Serial3/0&#xA;D       10.1.2.0/24 [90/2297856] via 172.16.124.1, 00:21:30, Serial3/3&#xA;D       10.3.3.0/24 [90/2858496] via 192.168.3.2, 00:21:30, Serial3/0&#xA;D       10.2.2.0/24 [90/2858496] via 192.168.3.2, 00:21:29, Serial3/0&#xA;D       10.1.1.0/24 [90/2297856] via 172.16.124.1, 00:21:30, Serial3/3&#xA;D       10.3.2.0/24 [90/2858496] via 192.168.3.2, 00:21:30, Serial3/0&#xA;D       10.2.3.0/24 [90/2858496] via 192.168.3.2, 00:21:30, Serial3/0&#xA;D    192.168.1.0/24 [90/2730496] via 192.168.3.2, 00:21:30, Serial3/0&#xA;D    192.168.2.0/24 [90/2730496] via 192.168.3.2, 00:21:30, Serial3/0&#xA;C    192.168.3.0/24 is directly connected, Serial3/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17520" LastEditorUserId="8499" LastEditDate="2019-01-04T21:55:07.737" LastActivityDate="2019-01-04T21:55:07.737" Title="This is an EIGRP Topology with frame relay. I'm not able to figure out why R1's topology table doesn't a show feasible successor for 192.168.2.0/24" Tags="|cisco|routing|router|packet-tracer|eigrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23684" PostTypeId="1" AcceptedAnswerId="23686" CreationDate="2015-10-25T11:22:45.873" Score="1" ViewCount="371" Body="&lt;p&gt;I have the TL-R470T+ and i have two different internet connections from two different ISPs. One 39 Mbps and the other 5 mbps and i want to get 44 mbps. When i installed the router on the speedtest showed 44 mbps etc. But with bittorrent or steam i get only 1.0 - 1.5 mb/s. Then i changed Policy Routing and it gets from 1.0 mb/s to 4.0 mb/s but its not stable. Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My modems configured with the router:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/xz6Xf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xz6Xf.png&quot; alt=&quot;TL-R470T+ Main Page&quot;&gt;&lt;/a&gt;&#xA;My Policy Routing settings:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/f2GuH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f2GuH.png&quot; alt=&quot;My policy routing settings&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20001" LastEditorUserId="8499" LastEditDate="2018-12-22T04:28:30.100" LastActivityDate="2018-12-22T04:28:30.100" Title="Load Balance with TL-R470T+" Tags="|router|bandwidth|load-balancing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23685" PostTypeId="2" ParentId="23682" CreationDate="2015-10-25T14:49:05.000" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm not able to figure out why R1's topology table doesn't show&#xA;  feasible successor for &lt;code&gt;192.168.2.0/24&lt;/code&gt;?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Remember the feasible successor rule: A feasible successor is a path whose reported distance is less than the feasible distance. If you look at the three routers which could tell R1 about &lt;code&gt;192.168.2.0/24&lt;/code&gt;, what are the reported distances? Compare those against the feasible distance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The feasible distance R1 shows in its topology table for &lt;code&gt;192.168.2.0/24&lt;/code&gt; is &lt;code&gt;2681856&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reported distance for:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R2 is &lt;code&gt;2730496&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;R3 is &lt;code&gt;2169856&lt;/code&gt; as the successor&lt;/li&gt;&#xA;&lt;li&gt;R5 is &lt;code&gt;2730496&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Clearly, no reported distance, other than R3, is less than the feasible distance, so there is no feasible successor.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-25T14:49:05.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23686" PostTypeId="2" ParentId="23684" CreationDate="2015-10-25T15:05:29.587" Score="0" Body="&lt;p&gt;With only one WAN link (39 Mbps) connected, are you saying the stream is 1.0 to 1.5 Mbps? That would be a problem with the sender of the stream, or somewhere along the path throttling the stream (ISPs sometimes do that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you try to bind two different WAN links, normally, a single traffic flow will only use one of the links. The aggregate bandwidth will be achieved using multiple traffic flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do set it up so that a single traffic flow uses both WAN links, especially with such different speeds, you can end up slowing a flow down, not speeding it up. This is because you increase the out of order packets, among other problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to think carefully about what you want to achieve vs. what you can achieve based on how things really work. You also need to understand that if you have a high bandwidth, but the sender does not, you are not going to get traffic any faster than the sender can send it. Also, be aware that one or more networks in the path from sender to receiver could throttle the traffic flow, and there really isn't anything you can do about that.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-25T15:05:29.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23687" PostTypeId="1" AcceptedAnswerId="23688" CreationDate="2015-10-25T16:23:42.647" Score="2" ViewCount="115" Body="&lt;p&gt;I have a Mikrotik RB532 router with three Ethernet ports. One of the ports supports PoE and the other two don't. The main point is that LAN2 and LAN3 interfaces are broken. Can the device still be used, for example, to connect a few PCs to the Internet? In my case, I intend to use the router as a Hotspot server.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Software:&#xA;&#xA;RouterOS 6.32.2&#xA;RouterBoard Firmware 2.18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/P5YiT.png&quot; alt=&quot;Mikrotik RB532 Board&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="20007" LastEditorUserId="8499" LastEditDate="2018-02-14T16:39:50.293" LastActivityDate="2018-02-14T16:39:50.293" Title="Can I use a router which has just one working interface?" Tags="|ethernet|interface|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-07T00:25:06.963" ContentLicense="CC BY-SA 3.0" />
  <row Id="23688" PostTypeId="2" ParentId="23687" CreationDate="2015-10-25T16:33:11.317" Score="2" Body="&lt;p&gt;If the device supports VLANs, it could be used as a router-on-a-stick to route between the VLANs. You would need a switch which also supports VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The connection from the switch to the router would be a trunk carrying all the VLANs supported by the switch. Place the WAN connection on a switch port which is set to the VLAN used for the WAN, and any other ports would be in another VLAN for the LAN. In fact, you could have multiple LAN VLANs for different LAN segments.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-25T16:33:11.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23689" PostTypeId="1" CreationDate="2015-10-25T18:13:16.890" Score="0" ViewCount="6848" Body="&lt;p&gt;On an HTTP request message, there is a field for the host ip address and the url of the server : GET &lt;strong&gt;/cs453/index.html&lt;/strong&gt; ~ Host: &lt;strong&gt;gaia.cs.umass.edu&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But How about the IP address of host (requester, where the browser that is sending this request message is running)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think a server needs to know the client's host from HTTP request message, but there is no field for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does it work?&lt;/p&gt;&#xA;" OwnerUserId="19596" LastEditorUserId="8499" LastEditDate="2018-02-16T04:03:42.270" LastActivityDate="2018-02-16T04:03:42.270" Title="Is getting host IP address (requester) from HTTP request message possible?" Tags="|network|" AnswerCount="2" CommentCount="1" ClosedDate="2018-02-16T03:45:35.040" ContentLicense="CC BY-SA 3.0" />
  <row Id="23691" PostTypeId="2" ParentId="23689" CreationDate="2015-10-25T18:55:33.443" Score="2" Body="&lt;p&gt;You need to understand the concept of the different layers in networking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTTP is an application layer protocol. When an HTTP message gets sent, it uses TCP as the transport layer protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP chops the HTTP message into segments and adds a TCP header to each segment. The TCP header includes the source and destination port numbers (TCP addresses). TCP then uses IP to deliver the TCP segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP takes the TCP segments and encapsulates them into IP packets. The IP packets have IP headers which contain the source and destination IP addresses. IP uses a layer-2 protocol, such as ethernet to deliver the IP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet encapsulates the IP packets into ethernet frames. Each ethernet frame has an ethernet header which contains the source and destination MAC addresses. Ethernet then sends the ethernet frames, which contain the IP packets, which contain the TCP segments, which contain the pieces of the HTTP message, to the hardware which sends the bits out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the application message travels down the stack, the data get encapsulated at each of the various layers, and each layer has it own address scheme which is used in the header of the datagram for that layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the server receives the bits, it reverses the process until the HTTP request is delivered to the HTTP server. When the HTTP server replies, it uses the same process to encapsulate and send the reply back to the PC.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-25T18:55:33.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23692" PostTypeId="1" AcceptedAnswerId="76596" CreationDate="2015-10-25T19:20:59.587" Score="6" ViewCount="22062" Body="&lt;p&gt;In broadcast routing, packets are sent to all nodes even if they do not want it.  What is a real life example of &quot;broadcast&quot;? Almost everything I can think of, like GMail and YouTube, appears to be unicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Along similar lines whats a real life use case for &quot;multicast&quot;?&lt;/p&gt;&#xA;" OwnerUserId="4339" LastEditorUserId="8499" LastEditDate="2015-10-25T19:39:13.480" LastActivityDate="2021-10-07T13:33:31.760" Title="What are real life examples of broadcast and multicast?" Tags="|multicast|broadcast|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23693" PostTypeId="2" ParentId="23692" CreationDate="2015-10-25T19:34:35.420" Score="9" Body="&lt;p&gt;Broadcasts are stopped at a layer-3 boundary (router). An example of a broadcast is an ARP request where a host is looking for the MAC address of the owner of an IP address. The host sends a broadcast asking, &quot;Who owns this IP address?&quot; Broadcasts are received and processed by every host in the layer-2 domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A multicast is received and processed by hosts which subscribe to the multicast group of the multicast. It is an elective &quot;broadcast&quot;. Many things use multicast, including some routing protocols. An example of multicasting is an IPTV application which some companies use. Multicasts are normally stopped at a layer-3 boundary (router) unless the router is configured for multicast routing, which is a large topic which cannot be adequately addressed here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since broadcasts are stopped at a layer-3 boundary, and multicasts only traverse layer-3 when all the routers in the path are configured to do multicast routing, broadcasts and multicasts cannot traverse the Internet,  which is why all your internet traffic will be unicasts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, IPv6 has eliminated broadcasts; there is no such concept in IPv6. IPv6 makes heavy use of multicasts. You may also see the term anycast used a lot in IPv6, but IPv4 can use anycasting, too. Anycasts are really unicasts, so the unicast rules and concepts apply to anycasts.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-25T19:43:08.930" LastActivityDate="2015-10-25T19:43:08.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23695" PostTypeId="1" CreationDate="2015-10-25T21:07:21.737" Score="3" ViewCount="847" Body="&lt;p&gt;What will happen if I desolder the 25 MHz clock of an ethernet module (like &lt;a href=&quot;http://www.siliconray.com/boards-modules/network/enc28j60-ethernet-module.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; one; &lt;a href=&quot;http://ww1.microchip.com/downloads/en/devicedoc/39662a.pdf&quot; rel=&quot;nofollow&quot;&gt;datasheet of the chip&lt;/a&gt;) and add a faster clock (say 100 MHz)? &#xA;The related product is a 10BASE-T ethernet module. But is the 10 Mbps limit related to the chip or the clock?* In case the limit is not related to the chip, will I get a higher speed, data corruption, ...?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to Wikipedia 100BASE-TX ethernet uses a 25 MHz clock and 10BASE-T a 2.5 MHz clock so I am actually confused why they use the faster clock for their low speed ethernet controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the speed is also related to the encoding. But for my application I actually need the Manchester encoding of 10BASE-T, yet with a higher speed.&lt;/p&gt;&#xA;" OwnerUserId="20013" LastEditorUserId="8499" LastEditDate="2019-01-03T01:47:13.657" LastActivityDate="2019-01-03T01:47:13.657" Title="&quot;Overclocking&quot; a 10BASE-T ethernet controller" Tags="|ethernet|layer1|transceiver|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23696" PostTypeId="2" ParentId="23695" CreationDate="2015-10-25T21:23:31.327" Score="2" Body="&lt;p&gt;If you aren't at all concerned with interoperability with other devices, you could try to do what you want, but increasing the clock also means that the other end needs to be identically configured, and the cabling in between, which is rated, depending on category, for certain signal speeds, would need to be compatible (e.g. crosstalk), too. Also, any firmware and software for driving the module would need to be checked for compatibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is doubtful that changing the clock will actually work for anything. It could be an interesting experiment, but you would need to do it on two devices to test it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-25T21:23:31.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23697" PostTypeId="1" AcceptedAnswerId="23698" CreationDate="2015-10-25T21:45:21.353" Score="4" ViewCount="304" Body="&lt;h2&gt;Two Networks&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I have an embedded device using Xilinx ARM processor, with eth0 and eth1.  I also have wlan0 and I am running Linux 3.17.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC0 &amp;lt;---left---&amp;gt;[eth0  ARM   eth1]&amp;lt;---right:some devices---&amp;gt;PC1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Left&lt;/strong&gt;: point to point, only PC0 is connected to eth0.  This is a local area network. We use this side to do ftp.  We also configures the IP address of eth1 from our PC software.  We plan to specify eth0 to be 192.168.1.100, and PC0 to be 192.168.1.99.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Right&lt;/strong&gt;: some devices are connected to be a local area network.  Our customers configure their right side, and don't&#xA;us to participate on this side.  Our customer can use our same PC software to read data or ftp from eth1 side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Between Left and Right&lt;/strong&gt;: nothing should be forwarded, no bridging, completely isolated.  &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The following configurations have potential problem from my opinion and I would like to have peer opinions: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If customer already configured their networks to be 192.168.1.x, and configures eth1 to be 1.100 which == eth0, this device will have two NIC with same IP on different network.  Should we avoid this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC0(99) &amp;lt;---left---&gt;[eth0(100)  ARM   eth1(100)]&amp;lt;---right:some devices---&gt;PC1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If customer configured their networks to be 192.168.1.x, and configures eth1 to be 1.99 == PC0, now will this confuses the Linux on ARM device? Now the stack knows that both PC0 and eth1 are same IP.  Should we avoid this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC0(99) &amp;lt;---left---&gt;[eth0(100)  ARM   eth1(99)]&amp;lt;---right:some devices---&gt;PC1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If customer configured their networks to be 192.168.1.x, and configure eth1 to be 1.98, and PC1 to be 100, will there be a problem? Should we avoid this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC0(99) &amp;lt;---left---&gt;[eth0(100)  ARM   eth1(98)]&amp;lt;---right:some devices---&gt;PC1(100)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If customer configured their networks to be 192.168.1.x, and configure eth1 to be 1.98, and PC1 to be 99, will there be a problem? Should we avoid this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC0(99) &amp;lt;---left---&gt;[eth0(100)  ARM   eth1(98)]&amp;lt;---right:some devices---&gt;PC1(99)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If customer configured their networks to be 192.168.1.x, and configure eth1 to be 1.98, and PC1 to be 101, and other devices on the right have IP different from 98, or 100.  I hope there is a way to configure the routing table so requests to eth0 are replied through eth0, and requests to eth1 are replied through eth1.  But will there be a problem? Is it recommended to avoid this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC0(99) &amp;lt;---left---&gt;[eth0(100)  ARM   eth1(98)]&amp;lt;---right:some devices---&gt;PC1(101)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Should we tells customer what is our subnet on the left side and not to use this same subnet for the right side at all?  Imagine if we run two OS on this ARM device and each controls one NIC then there is no problem.  &lt;/p&gt;&#xA;" OwnerUserId="20014" LastEditorUserId="8499" LastEditDate="2020-12-11T23:36:47.527" LastActivityDate="2020-12-11T23:36:47.527" Title="Can computer device with multiple NIC be configured with same subnets for isolated networks?" Tags="|subnet|" AnswerCount="1" CommentCount="0" ClosedDate="2020-12-12T00:03:48.240" ContentLicense="CC BY-SA 3.0" />
  <row Id="23698" PostTypeId="2" ParentId="23697" CreationDate="2015-10-25T22:26:51.100" Score="1" Body="&lt;p&gt;The host in the middle of two networks, both using &lt;code&gt;192.168.1.0/24&lt;/code&gt;, would have no way of knowing that &lt;code&gt;192.168.1.99&lt;/code&gt; is on one of the networks by itself unless you have a specific route for that. You should also make sure that no hosts on the other side have that same address, or the address of &lt;code&gt;192.168.1.100&lt;/code&gt;. The isolated host (&lt;code&gt;192.168.1.99&lt;/code&gt;) would not be able to send or receive anything except to &lt;code&gt;192.168.1.100&lt;/code&gt;, and nothing on the other side would be able to communicate with the isolated PC.&lt;/p&gt;&#xA;&lt;p&gt;The obvious solution would be to select addressing for the left side which doesn't exist anywhere else on the right side. You could use a point-to-point link with a &lt;code&gt;/31&lt;/code&gt; mask length since it will be only need two addresses. There are a lot of address blocks which probably won't be used, such as TEST-NET-1, TEST-NET-2, TEST-NET-3, etc. Look at &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5735#section-4&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5735, Special Use IPv4 Addresses, Section 4, Summary Table&lt;/a&gt;, for candidate address blocks. In fact, addresses from the Link-local bock (&lt;code&gt;169.254.0.0/16&lt;/code&gt;) may be ideal for this since those addresses are forbidden from being routed. You also aren't supposed to change the mask size from &lt;code&gt;/16&lt;/code&gt;, but that doesn't really matter for your application.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-10-25T22:42:56.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23699" PostTypeId="2" ParentId="23692" CreationDate="2015-10-25T22:42:41.843" Score="4" Body="&lt;p&gt;Also IGMP snooping is used for multicast on layer2.  This allows the switches to prune that ports get the multicast traffic.  Without IGMP snooping the multicast would flood all of the layer2 ports.  &lt;/p&gt;&#xA;" OwnerUserId="20015" LastActivityDate="2015-10-25T22:42:41.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23700" PostTypeId="2" ParentId="23663" CreationDate="2015-10-25T22:46:28.923" Score="1" Body="&lt;p&gt;If the intranet site is on private IP space then the traffic cannot even route to it from outside the network too.&lt;/p&gt;&#xA;" OwnerUserId="20015" LastActivityDate="2015-10-25T22:46:28.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23701" PostTypeId="1" AcceptedAnswerId="23702" CreationDate="2015-10-25T23:09:27.217" Score="0" ViewCount="5419" Body="&lt;p&gt;When I open my GMail and download an attachment, from my understanding, I use HTTP. What are real life examples of using SMTP (for emails) and FTP (downloading files)?&lt;/p&gt;&#xA;" OwnerUserId="4339" LastEditorUserId="8499" LastEditDate="2015-10-25T23:16:34.693" LastActivityDate="2015-10-26T02:16:58.620" Title="What are real life examples of SMTP and FTP?" Tags="|tftp|" AnswerCount="2" CommentCount="1" ClosedDate="2015-10-27T17:00:41.280" ContentLicense="CC BY-SA 3.0" />
  <row Id="23702" PostTypeId="2" ParentId="23701" CreationDate="2015-10-25T23:25:17.263" Score="2" Body="&lt;p&gt;If you use a web browser to use GMail, you do use HTTP. You could have an e-mail application as a client to GMail, and it could use SMTP to send, receive, and synchronize with GMail. A lot of people do this so that they automatically have local copies of their e-mail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before the advent of the World Wide Web, FTP was a main tool used for file transfers. It is still often used today where you don't run an HTTP server, or you have a host that doesn't run an HTTP browser. For instance, many large companies with large networks use an FTP server to hold different software versions for their network infrastructure devices. These devices can use FTP to download code updates, configurations, etc., but they don't typically run HTTP browser software.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-26T02:16:58.620" LastActivityDate="2015-10-26T02:16:58.620" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23703" PostTypeId="2" ParentId="23701" CreationDate="2015-10-26T00:22:38.197" Score="2" Body="&lt;p&gt;In addition to what Ron said, you would be aware of their secure counterparts.  HTTPS is an SSL encrypted version of HTTP.  For example, whenever you enter a credit card anywhere on a site it should be via an HTTPs:// url.  Gmail and Google both try to default to HTTPS now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SMTP is simple mail transfer protocol.  It is the protocol used to send email (not receive).  To keep it straight in your head you can use a trick of the acronym by saying Send-Mail-To-People.  When I write code to send automated emails, I send them through an SMTP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to what Ron said on FTP.  There is also FTPS and SFTP protocols to do so securely.  FTPS uses SSL encryption.  SFTP uses SSH.  Basically a more secure way to transfer files between devices.   I often used SFTP to transfer logs and other.  SFTP is more of a sub protocol of SSH than it is FTP.&lt;/p&gt;&#xA;" OwnerUserId="20015" LastActivityDate="2015-10-26T00:22:38.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23705" PostTypeId="1" CreationDate="2015-10-26T03:02:20.713" Score="3" ViewCount="139" Body="&lt;p&gt;Not sure if this is the right place to ask this question&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently i have this set up &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC 1 and PC 2 are connected by a switch on the same subnet which is connected to a router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to connect to internet via this route &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC 1 - &gt; PC 2  -&gt; router &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, i tried configuring my default gateway and DNS address as the ip address of PC2 but it does not work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using windows 7 and have disabled firewall on PC 2&lt;/p&gt;&#xA;" OwnerUserId="19229" LastActivityDate="2015-10-26T07:19:06.233" Title="Setting up a computer as a gateway" Tags="|firewall|internet|" AnswerCount="1" CommentCount="3" ClosedDate="2015-10-26T14:11:05.573" ContentLicense="CC BY-SA 3.0" />
  <row Id="23706" PostTypeId="1" AcceptedAnswerId="23708" CreationDate="2015-10-26T03:44:08.573" Score="2" ViewCount="1360" Body="&lt;p&gt;As the question implies, why use two NICs, one external facing and the other internal facing when one would suffice for both functions using NAT.&lt;/p&gt;&#xA;" OwnerUserId="20018" LastActivityDate="2015-10-27T01:48:47.270" Title="Why use two NICs, one external facing and the other internal facing?" Tags="|ethernet|nat|interface|" AnswerCount="2" CommentCount="2" ClosedDate="2015-10-27T17:00:04.130" ContentLicense="CC BY-SA 3.0" />
  <row Id="23707" PostTypeId="2" ParentId="23689" CreationDate="2015-10-26T04:02:23.207" Score="0" Body="&lt;p&gt;&lt;strong&gt;tl;dr: the true client's source IP address is usually known via the IP packet delivered to the web server.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the case of source NAT (sNAT) or HTTP proxies between client and server, the true client IP will not be in the packet the server sees.  The x-forwarded-for (XFF) header should contain the client's real IP when HTTP intermediaries are involved as the IP seen by the web server is the proxy's IP.  With sNAT, true client IP is lost unless the device doing the sNAT creates/rewrites a HTTP header like XFF discussed earlier or another custom header to contain it.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-10-26T04:02:23.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23708" PostTypeId="2" ParentId="23706" CreationDate="2015-10-26T04:11:46.960" Score="2" Body="&lt;p&gt;The main thing to think about is traffic competing for the bandwidth resources of a single Interface. This may be less important for a end-user PC, but it could be very important for a server, firewall, or router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is less likely, but not unheard of, for an end-user PC to saturate a single network interface. More likely is that servers, firewall, routers, etc., will saturate a single network interface. For instance, it used to be common practice to use a router-on-a-stick to route between subnets, but that limited the bandwidth on each of the VLANs in the trunk. The modern approach is to move the routing down to a layer-3 switch which can have multiple layer-2 inputs, spreading the load to individual VLAN interfaces or multiple trunk ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NICs are relatively inexpensive so it is a cheap solution to use different NICs for different things on PCs and servers, albeit more expensive on fixed devices like firewalls and routers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-26T04:11:46.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23709" PostTypeId="2" ParentId="23497" CreationDate="2015-10-26T04:21:52.587" Score="1" Body="&lt;p&gt;The redirect occurs within HTTP, so if you can reach the web server, it would not be blocked.  You need to determine the source of the redirect as it may come from web server, load balancer, firewall, etc.  You also need to confirm you're getting the same or equivalent functioning IP for the host via DNS.  Outside networks are most likely not hitting same devices as when you access the web server.  For example, you may be landing directly on server while your load balancer or other device is sending redirects for external users.  The redirect might even be occurring for you, but the site you're redirecting to is blocked for your path.  &lt;em&gt;More details from you still help troubleshoot this.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-10-26T04:21:52.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23711" PostTypeId="1" CreationDate="2015-10-26T07:02:39.657" Score="1" ViewCount="127" Body="&lt;p&gt;The Cisco ISR 4321 router is not giving Internet connections to the LAN PCs when the WAN interface has a &lt;code&gt;/30&lt;/code&gt; mask length (mask of &lt;code&gt;255.255.255.252&lt;/code&gt;), which is the actual IP address range I got from the ISP for my leased line. It has no problem using a &lt;code&gt;/24&lt;/code&gt; mask length (mask of &lt;code&gt;255.255.255.0&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this happening?&lt;/p&gt;&#xA;" OwnerUserId="20024" LastEditorUserId="8499" LastEditDate="2015-10-26T15:10:26.860" LastActivityDate="2015-10-26T15:10:26.860" Title="Why is the router is not giving an Internet connection to the PCs?" Tags="|routing|subnet|ip|wan|isp|" AnswerCount="1" CommentCount="2" ClosedDate="2015-10-27T02:01:27.633" ContentLicense="CC BY-SA 3.0" />
  <row Id="23712" PostTypeId="1" CreationDate="2015-10-26T07:11:23.787" Score="1" ViewCount="204" Body="&lt;p&gt;Found this problem in the web interface on Cisco WS-C2960G-24TC-L: the &quot;Smartports&quot; descriptions of the ports do not corresponds to the actual configuration received from memory with the command &lt;code&gt;show running-config&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in CLI a port appears as a trunk port, but in the web interface it can be seen as &lt;code&gt;vlan 1&lt;/code&gt;. I noticed this on two switches. Firmware: &lt;code&gt;12.2(55)SE9&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To what could the problem be related?&lt;/p&gt;&#xA;" OwnerUserId="20023" LastEditorUserId="8499" LastEditDate="2015-10-26T16:26:20.013" LastActivityDate="2016-03-25T14:01:18.223" Title="Cisco Catalyst 2960: incorrect data in the Web interface" Tags="|cisco|cisco-2960|" AnswerCount="1" CommentCount="1" ClosedDate="2019-03-18T00:53:18.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="23713" PostTypeId="2" ParentId="23705" CreationDate="2015-10-26T07:19:06.233" Score="2" Body="&lt;p&gt;You can either choose to turn on ICS or do the following:&#xA;Go to Start and search on cmd or command. Right click on either cmd or command then select Run as administrator. At the command prompt type regedit. Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\Tcpip\Parameters\IPEnableRouter setting, right click and select Modify&lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2015-10-26T07:19:06.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23714" PostTypeId="2" ParentId="23711" CreationDate="2015-10-26T07:22:57.380" Score="1" Body="&lt;p&gt;It sounds like even though that's your block assigned to use the ISP hasn't segmented it out so the ARP broadcasts are working improperly to resolve, this is usually done by smaller ISP in order to conserve IP space. If they were to give an actual /30 to every customer they would be losing 3/4 of the IP addresses they have to allocate (their router's IP, network address, broadcast address). I would confirm that with them, but I've seen it before. Otherwise if that's not the case you can sterilize your configuration and post it so unique problems can be dissected.&lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2015-10-26T07:22:57.380" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23715" PostTypeId="1" AcceptedAnswerId="24077" CreationDate="2015-10-26T07:25:50.187" Score="5" ViewCount="601" Body="&lt;p&gt;Does the NAT UDP port depend only on src ip/port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I have a two networks connected via a NAT/router using Source NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC A (192.168.0.2) in Network A (with router 192.168.0.1) sends a UDP packet to PC B (10.0.0.2) in Network B (with router 10.0.0.1). In Network A the packet has src ip/port 192.168.0.2:2000 and dst 10.0.0.2:5000. In Network B it becomes src ip/port 10.0.0.1:6000 (because 6000 is free for whatever reason, just for the example's sake) and dst 10.0.0.2:5000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then PC A sends another UDP packet from src ip/port 192.168.0.2:2000 to a different PC in Network B. The source port in Network A is the same, but will it also be the same in network B (6000 in this example)? I assume yes, but I am not sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it depend on the dst ip/port as well? If not, does it mean one PC, even one src port in Network A, can use up all the NAT hash table entries in Network B? (I hope it takes at least 65536 Network A src ports to fill up the NAT hash table entries in Network B.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW: This question was moved from Stack Overflow, as I think it fits here better.&lt;/p&gt;&#xA;" OwnerUserId="20025" LastEditorUserId="8499" LastEditDate="2015-10-26T15:27:27.177" LastActivityDate="2016-08-14T01:27:21.390" Title="Does the NAT source UDP port depend only on src ip/port?" Tags="|router|nat|udp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23718" PostTypeId="1" CreationDate="2015-10-26T13:24:49.390" Score="3" ViewCount="155" Body="&lt;ol&gt;&#xA;&lt;li&gt;I came up with this idea of using more than LAN cable for&#xA;transmitting data. Suppose we have 6 wires running between two&#xA;clients,  we can divide the each packet into 4 equal parts (2 for&#xA;error detection and correction), and transmit it simultaneously. On&#xA;receiving the packet, the receiver combines all the fragments to get&#xA;back the packet.&lt;/li&gt;&#xA;&lt;li&gt;Also, if 6 cables seem to much, we can use 2 cables, both for only&#xA;one way transmission. This way, the receiver doesn't have to send&#xA;acknowledgement via the same channel, and can help de-stress the&#xA;connection.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How are the ideas?&lt;/p&gt;&#xA;" OwnerUserId="20027" LastEditorUserId="8499" LastEditDate="2015-10-26T14:21:12.343" LastActivityDate="2017-03-31T15:54:39.280" Title="Why don't we send fragmented packets over multiple cables simultaneously?" Tags="|ethernet|lan|network-core|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="23719" PostTypeId="1" CreationDate="2015-10-26T13:46:08.380" Score="2" ViewCount="716" Body="&lt;p&gt;We're replacing aged Nortel core/distro with Cisco. Just put in a pair of stacked 3750X 24 port SFP switches. From there, we try and run 2 pair of fiber out to access switches. Some are Nortel/Avaya 5520s, and also working with some Nortel/Avaya 8300 chassis switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've had to disable 1 link of most of our port-channels, due to loss of connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've tried a couple setups with no luck. Most recently, I've got two gig interfaces on the Ciscos in channel-group 5 mode passive. I've tried mode 'on' as well, with no luck. On 'passive' the Cisco thinks the protocol is LACP, which may or may not be fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Nortel, it's configured as MLT 1; we've disabled NTSTG, and even disabled spanning-tree on the interfaces themselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever we lose connectivity, on the Cisco we see things like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Oct 26 13:36:45.069: %SW_MATM-4-MACFLAP_NOTIF: Host b8ac.6fcc.0f0f in vlan 2007 is flapping between port Gi1/0/5 and port Gi2/0/5&#xA;Oct 26 13:36:45.270: %SW_MATM-4-MACFLAP_NOTIF: Host d067.e530.95ba in vlan 10 is flapping between port Gi1/0/5 and port Gi2/0/5&#xA;Oct 26 13:36:45.279: %SW_MATM-4-MACFLAP_NOTIF: Host b8ac.6f2f.e391 in vlan 10 is flapping between port Gi2/0/5 and port Gi1/0/5&#xA;Oct 26 13:36:45.497: %SW_MATM-4-MACFLAP_NOTIF: Host 0026.b9cc.751c in vlan 10 is flapping between port Gi1/0/5 and port Gi2/0/5&#xA;Oct 26 13:36:45.723: %SW_MATM-4-MACFLAP_NOTIF: Host b8ac.6f85.763a in vlan 10 is flapping between port Gi2/0/5 and port Gi1/0/5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that Gi1/0/5, and Gi2/0/5 are members of Po5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the 8300, I don't even see options for using LACP. We'd like to get this working with multiple links, but have a loop-free topology until we get on all Cisco...&lt;/p&gt;&#xA;" OwnerUserId="20028" LastEditorUserId="8499" LastEditDate="2015-10-26T14:24:01.920" LastActivityDate="2015-10-26T21:08:15.027" Title="Cannot get etherchannel/port-channel to work with Nortel MLT" Tags="|cisco|etherchannel|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23720" PostTypeId="1" CreationDate="2015-10-26T14:14:27.507" Score="2" ViewCount="311" Body="&lt;p&gt;Hi I currently working in school where  we don't have LAN connection only one pc is connected to WiFi.&#xA;Now I want to make a LAN Connection of 6 pc.&#xA;Plz give me some guidance and which architecture is best for 6 pc's @ school level.&#xA;Thanx in advance.&lt;/p&gt;&#xA;" OwnerUserId="20030" LastActivityDate="2015-11-12T19:38:03.730" Title="LAN connection in school" Tags="|network-access|" AnswerCount="3" CommentCount="1" ClosedDate="2017-08-12T20:20:01.550" ContentLicense="CC BY-SA 3.0" />
  <row Id="23722" PostTypeId="1" AcceptedAnswerId="23723" CreationDate="2015-10-26T15:50:26.807" Score="1" ViewCount="1259" Body="&lt;p&gt;Assume we have an infinitely powerful CPU, and super fast IO communication with RAM and harddisk. On this powerful host, I have a server program which does two things - accepts files from the user and stores it on disk, and returns the files to the user when requested. Assume the even the network is infinitely fast. But Network interface card speed is 1 Gbit/s.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Will NIC be bottleneck with reading file from user and returning it back when requested ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How often does NIC become bottleneck in real world ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4339" LastActivityDate="2015-10-26T15:56:42.207" Title="Can NIC be a bottleneck?" Tags="|network-core|" AnswerCount="2" CommentCount="2" ClosedDate="2015-10-27T16:59:06.320" ContentLicense="CC BY-SA 3.0" />
  <row Id="23723" PostTypeId="2" ParentId="23722" CreationDate="2015-10-26T15:53:50.690" Score="9" Body="&lt;p&gt;Of course the NIC can be a bottleneck, if you have a NIC that can only handle a link of 100mbps, you can only transfer data at a max of 100mbps through that NIC - regardless of the other hardware specs of any hardware on the network. Same for if you have a 1Gbps NIC, the max throughput through that single NIC can only be 1Gbps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your network is only as fast as the interfaces the network needs to communicate via.&lt;/p&gt;&#xA;" OwnerUserId="20035" LastActivityDate="2015-10-26T15:53:50.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23724" PostTypeId="2" ParentId="23722" CreationDate="2015-10-26T15:56:42.207" Score="4" Body="&lt;p&gt;Anything network traffic flows through can be a bottleneck. Large, popular websites usually use multiple servers behind load balancers to, among other things, keep the NIC(s) on one server from becoming a bottleneck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to look at every point in a network to see where the bottlenecks are. For instance, many people will install a 48-port switch with 1 Gb ports, but have only a 1 Gb uplink to serve all the 1 Gb access ports. Cisco did some studies, and has recommended that the Access to Distribution ratio be no larger than 20:1.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-26T15:56:42.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23729" PostTypeId="1" CreationDate="2015-10-26T17:35:07.107" Score="2" ViewCount="173" Body="&lt;p&gt;I'm helping my friend punch down all of the Cat5-e cable in his office. Some of it went to existing patch panel and some went directly into a switch.  There are two patch panels, each was about half full.  We punched down about 12 cables into the first patch panel, following the same pinout as the rest - T-568A.  We moved on to the next patch panel and followed the pinout labeled on it, which was T-568-B.  After finishing it, we tested all cables and they worked fine.  Then we realized we probably built some cables that have pinout A on one end and B on the other.  From what I have read, on a 10/100 network (which they are on), having one end be A and one end B doesn't matter.  We obviously have to fix this but I have two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;On the 10/100 network, will they have any issues using a cable that has one end with pinout A and one end with pinout B?&lt;/li&gt;&#xA;&lt;li&gt;If we have cables with pinout A going from the wall to the patch panel and then we use a Cat6 cable with pinout B from the patch panel to the switch, is that going to cause any problems?  I'm guessing not but just want to confirm.  We are planning on upgrading the switches to 1 Gbps.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="20037" LastEditorUserId="8499" LastEditDate="2019-02-01T20:40:02.010" LastActivityDate="2019-02-01T20:40:02.010" Title="T-568A/B on the same cable" Tags="|layer1|cable|cabling|patch-panel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23730" PostTypeId="2" ParentId="23729" CreationDate="2015-10-26T17:41:47.563" Score="1" Body="&lt;p&gt;You have a cable which has the transmit and receive pairs reversed on one end, basically, a crossover cable for 10/100 Mbps. Also, 1 Gbps uses all four pairs. A lot of things today have Auto MDIX, and they should be able to adjust, but not everything does have this, and those things won't work unless you use a crossover patch cable on one end (not both ends) of the horizontal cable.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;By the way, why go to the expense of Category-6 patch cables if the horizontal cable is Category-5e? This is completely useless, and could lead someone to believe that the horizontal cable is Category-6 when it is not. A cable plant should use the same rating throughout because the rating of the cable plant is the rating of the lowest rated link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2019-02-01T20:39:50.813" LastActivityDate="2019-02-01T20:39:50.813" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23731" PostTypeId="1" AcceptedAnswerId="23737" CreationDate="2015-10-26T17:50:47.470" Score="1" ViewCount="141" Body="&lt;p&gt;Is there any advantage point of having a Gigabit Ethernet if the PCI bus connecting NIC to Memory is a lot slower than that say just 80 MBps?&#xA;In other words, I am trying to conclude that it makes sense to use high speed network only if the bus connecting the NIC to RAM is fast enough, else its of no use. Correct me if I am wrong.&lt;/p&gt;&#xA;" OwnerUserId="4339" LastEditorUserId="509" LastEditDate="2015-12-14T21:06:12.177" LastActivityDate="2015-12-14T21:06:12.177" Title="NIC speed and PCI bus speed to be synchronized?" Tags="|bandwidth|performance|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23732" PostTypeId="2" ParentId="23720" CreationDate="2015-10-26T17:57:20.257" Score="0" Body="&lt;p&gt;Connect all 6 of the pc's to the wifi ap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going the wifi route is the most cost effective and quickest to deploy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look for a AP that has 2.4GHz and 5GHz radios so you have more bandwidth, and connect the Server/Internet to the Ethernet ports on the AP, to reduce the wifi hop for most traffic to one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have to place some pc's more that 20 meters from the AP or there is a lot of walls reducing the signal think about adding more AP's connected with ethernet Cat5/Cat6 cabling to central AP, avoid wifi bridge links between AP's as it halves the bandwidth.  use the same ssid en wpa2 key, selecting not overlapping channels for each AP.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2015-11-12T19:38:03.730" LastActivityDate="2015-11-12T19:38:03.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23733" PostTypeId="2" ParentId="23720" CreationDate="2015-10-26T18:23:46.393" Score="1" Body="&lt;p&gt;Get a Switch and share the internet connection of the PC connected to the WIFI to all the other PCs accross the switch. This can be done on a simple way. Post if you can get a switch and here we can help you.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-26T18:23:46.393" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23734" PostTypeId="2" ParentId="23720" CreationDate="2015-10-26T18:45:27.543" Score="1" Body="&lt;p&gt;Is this is a school that doesn't have an infrastructure, you really want to start building the infrastructure properly as there will be a future demand for more connections/bandwidth/file servers/wireless/etc. I have walked in many a school where parents and other unqualified helpers created standardless spaghetti networks so as to cut down costs but later cost more $$$ to fix. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Search the web for structured cabling (blackbox.com had a good pdf), physical/logical infrastructure and post more of your questions for this community to assist you after you've researched your solutions. It's not that often nowadays that someone has the opportunity to start a school in the right way towards IT :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hint: Lookup a star topology, it's the easiest to troubleshoot and scale up from.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2015-10-26T18:45:27.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23736" PostTypeId="1" CreationDate="2015-10-26T19:08:50.490" Score="3" ViewCount="149" Body="&lt;p&gt;How to filter traffic for the address of type: &lt;code&gt;p309-pmr.ii.ucla.edu.uk&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What kinds of servers are generally these types of names given to : &lt;code&gt;p309-pmr.ii.ucla.edu.uk&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a DNS server or IP server?&lt;/p&gt;&#xA;" OwnerDisplayName="user15062" LastEditorUserId="8499" LastEditDate="2015-10-26T19:27:21.047" LastActivityDate="2015-10-26T19:27:21.047" Title="How to filter traffic for the address of a name like this?" Tags="|wireshark|" AnswerCount="2" CommentCount="1" ClosedDate="2017-08-12T19:51:36.057" ContentLicense="CC BY-SA 3.0" />
  <row Id="23737" PostTypeId="2" ParentId="23731" CreationDate="2015-10-26T19:10:09.527" Score="4" Body="&lt;p&gt;This was a problem when 1 Gb NICs first came out. Servers could only get about 400 Mb of throughput on a 1 Gb network because the server bus wasn't fast enough to get 1 Gb. It was still four times better than 100 Mb, even if it couldn't use the full bandwidth of the NIC. The bus used in PCs and servers has caught up with 1 Gb NICs, and there are newer bus speeds popping up every few years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be wrong to say it is of no use if the bus is too slow to take full advantage of the NIC speed since it can still be faster than a slower NIC.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-26T19:10:09.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23738" PostTypeId="2" ParentId="23736" CreationDate="2015-10-26T19:15:04.197" Score="1" Body="&lt;p&gt;Those are DNS names for hosts, and you can't know by the name if it is an end-user PC, phone, server, or anything else by the DNS name. DNS is an application layer protocol that isn't used by the network; the DNS name must be translated to an IP address before the network can use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It really depends on what you are using to filter traffic, but many devices which filter traffic can only do it by IP address, not DNS name.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-26T19:15:04.197" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="23739" PostTypeId="2" ParentId="23736" CreationDate="2015-10-26T19:19:20.373" Score="1" Body="&lt;p&gt;This is a domain name an could be anything, from a phone, server, workstation,.. an so on. I think first you need to know the IP behind this domain name, i hope you only find an IP address, on this way you are lucky, if not, an you encounter some hostnames behind this domain name, then, you need to study the traffic, and wich kind of traffic do you need to filter.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-26T19:19:20.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23741" PostTypeId="1" CreationDate="2015-10-26T19:59:43.717" Score="3" ViewCount="27182" Body="&lt;p&gt;I am trying to set up communication across a network, and I have run into a bit of a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the diagram below, why is it that I cannot ping host 2 from host 1? Router 1 has interfaces on both networks net1 and net2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What rule do I have to add to the routing table to tell router 1 that it can access net 2 on its 2.250 interface? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip route add 192.168.2.0/24 via 192.168.2.250 but I get the error RTNETLINK : no such process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OxXtx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OxXtx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20043" LastActivityDate="2019-03-13T06:04:47.390" Title="Cant ping across router?" Tags="|routing|ping|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23742" PostTypeId="2" ParentId="23741" CreationDate="2015-10-26T20:19:54.053" Score="2" Body="&lt;p&gt;The only thing i guess, you need to do is to add a route on host1 and 2: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Host1: ip route add 192.168.2.0/24 via 192.168.1.11&#xA;Host2: ip route add 192.168.1.0/24 via 192.168.2.250&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router already knows hoe to reach the two networks, ´cause it have directly connected.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-26T20:19:54.053" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="23743" PostTypeId="1" AcceptedAnswerId="23745" CreationDate="2015-10-26T20:28:00.613" Score="5" ViewCount="13050" Body="&lt;p&gt;What are the disadvantages of VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whereas advantages are : &lt;code&gt;Broadcast Control, Security and Fexibility&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14008" LastActivityDate="2015-10-26T21:16:11.043" Title="What are the disadvantages of VLANs" Tags="|vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23744" PostTypeId="2" ParentId="23741" CreationDate="2015-10-26T20:31:50.490" Score="2" Body="&lt;p&gt;You need to have routing set up on the routers so that every router which is on the networks of the two hosts knows how to reach the other network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would work if each host's gateway was Router1, but that may not always be the case. The whole point of routing is that the routers know how to reach the other networks, even if they aren't attached to the networks. You can do this dynamically with a routing protocol, or statically with static routes configured in the routers. Static routing doesn't scale, and it can't automatically respond to changes in the network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-26T20:31:50.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23745" PostTypeId="2" ParentId="23743" CreationDate="2015-10-26T20:45:54.093" Score="3" Body="&lt;p&gt;I think, managment is a little more complex, nothing out of this world, but, you need to make sure wich ports do you configured like access, and vlans permitted on trunk ports. This one is only done on the firs time, the you only need to permits vlans and configure the access for machines who needs to communicate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other thing is when you need to add a new vlan, you need to configured on all the switches on your networks, or configure VTP, a little more complex too.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-26T20:45:54.093" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23746" PostTypeId="2" ParentId="23719" CreationDate="2015-10-26T21:08:15.027" Score="1" Body="&lt;p&gt;Nortel:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! *** MLT (Phase 1) ***&#xA;!! (cisco 2960s)&#xA;mlt 2 name &quot;R2-1 [VMWare C]&quot; enable member 1/41-44 &#xA;mlt 2 loadbalance advance&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/45&#xA; description [uplink] nortel-5510-1 [1/41]&#xA; channel-group 1 mode on&#xA;!&#xA;interface GigabitEthernet1/0/46&#xA; description [uplink] nortel-5510-1 [1/42]&#xA; channel-group 1 mode on&#xA;!&#xA;interface GigabitEthernet1/0/47&#xA; description [uplink] nortel-5510-1 [1/43]&#xA; channel-group 1 mode on&#xA;!&#xA;interface GigabitEthernet1/0/48&#xA; description [uplink] nortel-5510-1 [1/44]&#xA; channel-group 1 mode on&#xA;!&#xA;interface Port-channel1&#xA; switchport trunk allowed vlan ...&#xA; switchport mode trunk&#xA; load-interval 30&#xA; flowcontrol receive desired&#xA; ip dhcp snooping trust&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I recall (setup is many years old), the key is &lt;code&gt;mode on&lt;/code&gt;. You can use LACP, but I don't want the overhead or the issues with links not joining the bundle (which is what you're seeing.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-26T21:08:15.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23747" PostTypeId="2" ParentId="23743" CreationDate="2015-10-26T21:16:11.043" Score="4" Body="&lt;p&gt;They are a tool. like any other, and can be misapplied, like any other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not infrequently the case that someone (possibly in management) will get all excited about VLANs and proceed to break (or order broken) a network by deploying VLANs willy-nilly, ignoring the need of various devices on the network to actually communicate over the network. With proper planning these needs can be met via inter-VLAN-routing, but proper planning is often engaged in only after the network suddenly stops working...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common enough example is VLAN-ing a guest wireless network. A common enough result (entirely avoidable with planning) is that the guest wireless network ends up without a DHCP server or a route to the internet, because it's successfully &quot;isolated&quot; but the fact that this now means it's an entirely separate network that needs every service any network needs to function is neglected. Blame is then applied with a broad brush to the wireless AP vendor, who has nothing to do with the actual problem, but makes a handy target since the issue is with a wireless network not working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As with many things, poor documentation can make a VLAN setup that actually worked fine when set up fall apart when details are forgotten, employees move on or forget details that are not documented, and some seemingly irrelevant change balkanizes a VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Implemented properly, these things don't happen. They happen commonly enough to suggest that proper implementation is not as common as it should be.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-10-26T21:16:11.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23748" PostTypeId="2" ParentId="23718" CreationDate="2015-10-26T21:22:19.227" Score="2" Body="&lt;p&gt;This is not done in the general case because of error handling and reassembly issues due to differing transmission delays. Plus, the full frame would have to be received to divide it up for parallel transmission -- store-and-forward switching is generally avoided due to the latency it introduces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some switches (eg. Cabletron) can do this via proprietary mechanisms. In the cabletron case, it requires the parallel links be equidistant to within a &lt;em&gt;few feet&lt;/em&gt;; if a fragment is damaged in transit, the reassembled frame will contain that damage. (i.e. they didn't bother with error detection/correction)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-26T21:22:19.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23749" PostTypeId="2" ParentId="20217" CreationDate="2015-10-26T21:25:42.287" Score="1" Body="&lt;p&gt;Try using the following &lt;strong&gt;&lt;em&gt;&lt;code&gt;wireshark&lt;/code&gt;/&lt;code&gt;tshark&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt; &lt;strong&gt;&lt;em&gt;display-filter:&lt;/em&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tcp.flags.reset&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Alternatively, Try using the following &lt;strong&gt;&lt;em&gt;&lt;code&gt;tcpdump&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt; &lt;strong&gt;&lt;em&gt;capture-filter:&lt;/em&gt;&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tcp-rst&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Both are compatible with the following &lt;strong&gt;&lt;em&gt;logic-modifiers:&lt;/em&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;amp;&amp;amp;&lt;/code&gt; or &lt;code&gt;and&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;||&lt;/code&gt; or &lt;code&gt;or&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;!&lt;/code&gt; or &lt;code&gt;not&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="17196" LastEditorUserId="17196" LastEditDate="2016-07-27T16:00:03.827" LastActivityDate="2016-07-27T16:00:03.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23751" PostTypeId="1" AcceptedAnswerId="23758" CreationDate="2015-10-26T23:29:04.703" Score="9" ViewCount="23793" Body="&lt;p&gt;Can one IP address be assigned to more then one device or interface? In which situations may this happen? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can one device or interface posses more than one IP address?&lt;/p&gt;&#xA;" OwnerDisplayName="user15062" LastEditorUserId="8499" LastEditDate="2019-01-12T23:28:45.653" LastActivityDate="2021-06-27T05:57:43.370" Title="How many IP addresses can a device or an interface possess?" Tags="|ip|ip-address|interface|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23752" PostTypeId="2" ParentId="23751" CreationDate="2015-10-26T23:41:56.613" Score="3" Body="&lt;p&gt;As long as an IP address is isolated from a network containing the same IP address, there is no problem, and no conflict. One of the benefits of the Private IP Address ranges is that they can be assigned many times. They are used by just about every home and company on the Internet. They cannot be routed on the Internet for the reason that they are the same addresses used in many places. This does pose problems when two companies using the same private IP address ranges merge. NAT can be used as a temporary solution while one side or another is re-addressed. (I have been through this many times, and it is never fun.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another use for using the same address in multiple places is the concept of anycast. In anycast, multiple hosts have the same IP address, and the routing protocol will route traffic to the nearest one. For instance, servers like DNS, NTP, etc. could be set up in a company with a wide geographic area and many sites. These servers could be dispersed around the country in central locations, and all have the same IP address per function. When a host needs the services of one of the servers, the routing protocol will make sure it reaches the closest server. That way, only one IP address for each function needs to be configured across the entire company. When the route to the nearest server goes down, the routing protocol will send the traffic to the next nearest server with the same IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One interface can certainly have multiple IP addresses, and this is mandatory with IPv6, but is a bit more difficult in IPv4, although software has become more accepting of this for IPv4.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-26T23:41:56.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23753" PostTypeId="2" ParentId="23751" CreationDate="2015-10-26T23:42:45.427" Score="2" Body="&lt;p&gt;Depends on the device really. Most end user devices' NICs can handle at least one IPv4 and IPv6  (and have been able to for years). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers (and other network &quot;infrastructure&quot; devices can be assigned a lot more, mainly with the idea of subinterfaces. Basically, these are virtual interfaces that use the physical interface as a transmission medium. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will say that your question is a little ambiguous without a reference or more detail. But I hope I gave you some sort of answer before it gets flagged.&lt;/p&gt;&#xA;" OwnerUserId="19985" LastActivityDate="2015-10-26T23:42:45.427" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23757" PostTypeId="2" ParentId="23706" CreationDate="2015-10-27T01:48:47.270" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;why use two NICs, one external facing and the other internal facing when one would suffice for both functions using NAT&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Let me start by saying that this is thinking backwards a bit. Why would you use NAT when a better solution is available? NAT is a band aid. An ugly &quot;temporary&quot; solution to a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT is generally to be avoided whenever possible. It does little good, takes resources, increases latency, and often creates problems.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why use two NICs, one external facing and the other internal facing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For this, there are many specific reasons, but they can be summed up as segregation/isolation for security and/or performance reasons.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;A few examples:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Dedicated NICs for normal and management traffic - separate NICs make this easy to configure and firewall, both on the server and on the network. Further, if the server is under a DoS type of attack on the normal NIC, you may still have access on the management NIC.&lt;/li&gt;&#xA;&lt;li&gt;Dedicated NIC for network based backups/snapshots - this allows the backups to utilize the full capability of the NIC performance without affecting any normal traffic to/from the server.&lt;/li&gt;&#xA;&lt;li&gt;Dedicated NIC for access to an isolated network - imagine you have a network of &quot;insecure&quot; devices (e.g. SCADA devices) and you want them isolated from any access (no gateway or access to any other network resource). The management server can be configured with a NIC to communicate with this isolated network (pull data, push configs, etc) and another NIC for access to the server which may provide reporting, alerting or other services.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-10-27T01:48:47.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23758" PostTypeId="2" ParentId="23751" CreationDate="2015-10-27T03:30:30.193" Score="12" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can one IP address be assigned to more then one device or interface? In which situations may this happen?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you actually stopped to think this through, clearly this can happen. All you need to consider is all the consumer/CPE devices that default their management interfaces to an IP address something like 192.168.1.1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, in a single local network (i.e. flat network or VLAN) a single IP address can only be assigned to one interface/device at any given time. The reason why is that other devices need to learn a correlation between a MAC address and an IP address. This is what the ARP process provides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However like many general rules, there are exceptions and in this case these are normally mechanisms used to provide some sort of load balancing and/or redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say you have two devices that both want to provide the same service on the local network. They could be programmed in a fashion where one responds to ARP for queries where the source MAC address is odd, and the other for even (or hashes or some other mechanism to group sources). This will allow the load to be distributed between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your two devices can then also maintain some sort of &quot;heartbeat&quot; and have the ability to &quot;take over&quot; the other device's MAC address in case of a failure, then you now also have a means of providing redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The presences of these capabilities and exactly how they work would be dependent on the features available in the device.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can one device or interface posses more than one IP address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, however this capability will depend on the device/operating system in question. Some may provide this capability by allowing you to create multiple &quot;virtual&quot; interfaces of some sort tied to the interface or device. Others may allow multiple IP addresses on one interface. Or they may be able to do both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are examples of virtual interfaces (Linux pulled as example off web after quick search):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root@here]# ifconfig&#xA;eth0      Link encap:Ethernet  HWaddr 00:0C:29:28:11:22&#xA;          inet addr:172.16.16.125  Bcast:172.16.16.100  Mask:255.255.255.224&#xA;          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1&#xA;          RX packets:237 errors:0 dropped:0 overruns:0 frame:0&#xA;          TX packets:198 errors:0 dropped:0 overruns:0 carrier:0&#xA;          collisions:0 txqueuelen:1000&#xA;          RX bytes:25429 (24.8 KiB)  TX bytes:26910 (26.2 KiB)&#xA;          Interrupt:18 Base address:0x2000&#xA;&#xA;eth0:0    Link encap:Ethernet  HWaddr 00:0C:29:28:11:22&#xA;          inet addr:172.16.16.126  Bcast:172.16.16.100  Mask:255.255.255.224&#xA;          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1&#xA;          Interrupt:18 Base address:0x2000&#xA;&#xA;eth0:1    Link encap:Ethernet  HWaddr 00:0C:29:28:11:22&#xA;          inet addr:172.16.16.127  Bcast:172.16.16.100  Mask:255.255.255.224&#xA;          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1&#xA;          Interrupt:18 Base address:0x2000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is an example of multiple IP address on an interface (BSD based load balancer IIRC):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan100: flags=8843&amp;lt;UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST&amp;gt; mtu 1500&#xA;    inet 192.168.1.30 netmask 0xffffffff broadcast 48.0.5.12&#xA;    inet 192.168.1.40 netmask 0xffffffff broadcast 48.0.5.12&#xA;    inet 192.168.1.50 netmask 0xffffffff broadcast 48.0.5.12&#xA;    inet 1.2.3.35 netmask 0xffffffff broadcast 48.0.5.12&#xA;    inet 1.2.3.36 netmask 0xffffffff broadcast 48.0.5.12&#xA;    inet 1.2.3.37 netmask 0xffffffff broadcast 48.0.5.12&#xA;    inet 1.2.3.55 netmask 0xffffffff broadcast 48.0.5.12&#xA;    inet 1.2.3.233 netmask 0xffffffff broadcast 48.0.5.12&#xA;    inet 1.2.3.250 netmask 0xffffffff broadcast 48.0.5.12&#xA;    inet 1.2.3.252 netmask 0xffffffff broadcast 48.0.5.12&#xA;    inet 1.2.3.253 netmask 0xffffffff broadcast 60.0.5.12&#xA;    inet 192.168.1.10 netmask 0xffffff00 broadcast 192.168.1.255&#xA;    ether 00:11:22:33:44:55&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How many IP addresses can a device or an interface possess?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This will be entirely dependent on what limitations are present in the device/operating system. Without knowing a specific device/operating system (and version), this is not a question that can be answered.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-10-27T03:30:30.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23759" PostTypeId="1" CreationDate="2015-10-27T03:44:01.210" Score="2" ViewCount="650" Body="&lt;p&gt;I have seen &quot;port forwarding&quot; associated with &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;netcat&lt;/code&gt;/&lt;code&gt;socat&lt;/code&gt;, &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ssh&lt;/code&gt;, and &lt;/li&gt;&#xA;&lt;li&gt;configuring server inside the local LAN behind a NAT device.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Does it have different meanings in the cases?&#xA;For example does &quot;port forwarding&quot; in the first two cases mean the same as packet/datagram forwarding?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What layer in the OSI model does each case's &quot;port forwarding&quot; belong to?&#xA;For example, does the first case belong to the transport layer, the second to the application layer, and the last to the transport layer?&lt;/p&gt;&#xA;" OwnerUserId="7894" LastEditorUserId="8499" LastEditDate="2019-01-02T22:37:02.117" LastActivityDate="2019-01-02T22:37:02.117" Title="&quot;port forwarding&quot; in netcat/socat, ssh, and commerical router" Tags="|router|nat|osi|layer4|ssh|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23760" PostTypeId="2" ParentId="23759" CreationDate="2015-10-27T03:55:29.717" Score="2" Body="&lt;p&gt;In the first two, the term &quot;port forwarding&quot; really refers to tunneling. Tunneling encapsulates a layer-3 packet inside a new layer-3 packet so that the original can pass as the the encapsulating packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original use for the term &quot;port forwarding&quot; came from NAT. NAT can use a port address on the outside IP address of a NAT router to forward traffic to a host on the inside network. This isn't tunneling since it directly translates the destination address to a different address without encapsulating it inside another packet. There is also layer-2 tunneling where layer-2 frames can be encapsulated in other layer-2 frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both tunneling and NAT port forwarding happen at layer-3, but NAT port forwarding involves layer-4 because it depends on the transport protocol and the port address for that protocol. Tunneling can involve layer-4, too, but that depends on the tunneling implementation and how it is configured.&#xA;The OSI layers are theoretical, and real life isn't so neat. Many things blur the lines between layers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-27T04:06:09.530" LastActivityDate="2015-10-27T04:06:09.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23761" PostTypeId="1" CreationDate="2015-10-27T08:23:49.717" Score="2" ViewCount="2737" Body="&lt;p&gt;I am programming for an embedded device and I want it to display the local time. I know I can get the UTC time by NTP or SNTP. However how can I convert it to the local time if I do not want the user to input the timezone manually? Obviously I need a method that I can get my timezone from the network. Is there any network protocol that can do this? If this method exist, is it reliable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am programming for an embedded device in which there is no OS. Therefore I need the &quot;low level&quot; method, for example a protocol rather than a Windows function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much.&lt;/p&gt;&#xA;" OwnerUserId="9858" LastActivityDate="2016-08-26T18:02:23.180" Title="How to get local time from internet" Tags="|internet|ntp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23762" PostTypeId="2" ParentId="23761" CreationDate="2015-10-27T09:23:59.087" Score="5" Body="&lt;p&gt;There is no protocol as such but you could do a GeoIP lookup to get your approximate location and map the location to a timezone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MaxMind offers a GeoIP database that is accessible via various methods, see &lt;a href=&quot;http://dev.maxmind.com&quot; rel=&quot;noreferrer&quot;&gt;http://dev.maxmind.com&lt;/a&gt;. You can even get the data in a CSV file and store locally but given that you are on an embedded device I suspect you are low on storage and might prefer to just do an online lookup. They have a convenient API that can do a lookup on the requestors IP address, so you don't need to use any other method to find your external address. In addition the returned data includes timezone information so it appears you can get all you need with a single HTTP call. See &lt;a href=&quot;https://www.maxmind.com/en/locate-my-ip-address&quot; rel=&quot;noreferrer&quot;&gt;https://www.maxmind.com/en/locate-my-ip-address&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I put together a few lines of Python to show how this could work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/env python&#xA;&#xA;import urllib, json&#xA;url = &quot;https://js.maxmind.com/geoip/v2.1/city/me?referrer=https%3A%2F%2Fwww.maxmind.com&quot;&#xA;response = urllib.urlopen(url)&#xA;data = json.loads(response.read())&#xA;print data['location']['time_zone']&#xA;# to pretty print all returned data&#xA;#print json.dumps(data, sort_keys=True, indent=4, separators=(',', ': '))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And when run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;kll $ python ip2tz.py&#xA;Europe/Stockholm&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It would probably be wise to cache the result so that you can get your timezone even if your Internet connection is down.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-27T09:23:59.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23765" PostTypeId="1" CreationDate="2015-10-27T11:34:36.660" Score="1" ViewCount="221" Body="&lt;p&gt;I am new to VoIP so apologize if this is a dump question&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to accept a traditional telephone call (FXO) channel and based on the callers extension selection I want to switch the call to set of GSM mobile phones and some extensions inside the office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hypothetical scenario will be like this,&#xA;- Person A dials our landline number&#xA;- Voice interface advice user to dial 111 to contact John and 222 to contact Mary.&#xA;- If caller dials 111, call will be connected to John's mobile phone through GSM gateway&#xA;- If user dials 222 it should dial the office phone that belongs to Mary&#xA;- In case John or Mary are unreachable, call should go to voicemail box&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody give me some instructions to get this done?. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am currently thinking is to use D-link DVX-2005F to accept the FXO and switch to GSM using D-link DVG-6008G GSM gateway. Will it be possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="20058" LastEditorUserId="27721" LastEditDate="2017-06-26T02:03:31.473" LastActivityDate="2017-06-26T02:03:31.473" Title="FXO to GSM routing" Tags="|voip|telephony|cisco-voip|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23766" PostTypeId="2" ParentId="23741" CreationDate="2015-10-27T11:40:22.153" Score="0" Body="&lt;p&gt;Check the basics on host 1 and host 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does host 1 have a default route via router 1, or a specific route to host 2's network via router 1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does host 2 have a default route via router 1, or a specific route to host 1's network via router 1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you've provided no useful debug, it's difficult to guess what's going on, especially as your diagram mentions many devices, but we're only interested in three of them - two hosts and a router - simplify the problem for yourself, and you may find it easier to work out the solution.&lt;/p&gt;&#xA;" OwnerUserId="14482" LastActivityDate="2015-10-27T11:40:22.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23767" PostTypeId="1" AcceptedAnswerId="23768" CreationDate="2015-10-27T11:52:15.007" Score="1" ViewCount="333" Body="&lt;p&gt;I have a doubt about MMF and SMF cables. If MMF can handle more than one signal light at the same time and both MMF and SMF support full-duplex, why isn't MMF faster than SMF cable?&lt;/p&gt;&#xA;" OwnerUserId="20059" LastActivityDate="2015-11-01T02:58:25.383" Title="Doubt about MMF and SMF speed" Tags="|cable|optics|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23768" PostTypeId="2" ParentId="23767" CreationDate="2015-10-27T12:05:09.280" Score="3" Body="&lt;p&gt;As the name implies a multi mode fibre can carry multiple modes of light. This is not the same thing as multiple signals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The multiple modes of the same signal only leads to modal dispersion which stretches out the signal in the time domain, due to the different propagation speed of the modes, making it more difficult to detect at the receiver end. This leads to a lower speed both in theory and practice than a single mode fibre which doesn't suffer from modal dispersion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both MMF and SMF fibre &lt;em&gt;can&lt;/em&gt; carry multiple signals through the use of wavelength division multiplexing (WDM), although this is much more common with SMF as its characteristics allow it to be used over longer distances where it generally becomes more economical to use WDM equipment.&lt;/p&gt;&#xA;" OwnerUserId="672" LastEditorUserId="672" LastEditDate="2015-11-01T02:58:25.383" LastActivityDate="2015-11-01T02:58:25.383" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23769" PostTypeId="1" AcceptedAnswerId="23786" CreationDate="2015-10-27T12:05:46.627" Score="5" ViewCount="554" Body="&lt;p&gt;Let's suppose I have 3 computers A, B and C connected to the same switch with only the native VLAN active. A and B belong to the same network, let's say that their IP addresses are 192.168.1.1/24 for A and 192.168.1.2/24 for B. C belongs to another network like 192.168.2.1/24. Since a switch works on the second layer of the OSI model, it won't know which computers are in the same network or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What prevents computer C from answering an ARP request coming from the computer A?&lt;/p&gt;&#xA;" OwnerUserId="20059" LastEditorUserId="8499" LastEditDate="2019-12-11T22:20:43.967" LastActivityDate="2019-12-11T22:20:43.967" Title="What blocks a computer from another network in the same switch from answering an ARP request?" Tags="|switch|protocol-theory|arp|layer2|layer3|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23770" PostTypeId="2" ParentId="23769" CreationDate="2015-10-27T12:23:10.150" Score="5" Body="&lt;p&gt;You are correct that on a layer 2 level all computers will receive broadcast packets, including ARP requests for IP addresses of networks other than their own. The IP stack of those computers will however discard those packets as they recognise it is outside of their own local network.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-27T12:23:10.150" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23771" PostTypeId="1" CreationDate="2015-10-27T12:42:09.327" Score="1" ViewCount="48" Body="&lt;p&gt;While writing a Java program, I noticed that a SINGLE TCP PORT (ServerSocket) can connect to MANY Connections (Sockets). Does this mean that a Single TCP PORT can THEORETICALLY handle infinite connections?&lt;/p&gt;&#xA;" OwnerUserId="16698" LastActivityDate="2015-10-27T13:22:05.813" Title="Regarding single TCP Port" Tags="|tcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23772" PostTypeId="1" AcceptedAnswerId="23781" CreationDate="2015-10-27T12:54:52.567" Score="1" ViewCount="2307" Body="&lt;p&gt;I need help for a little test I am doing with virtual machines (KVM Virt-manager).&lt;/p&gt;&#xA;&lt;p&gt;I have created 4 VM running Ubuntu Server with static configuration (see schema) linking one VM to the next.&lt;/p&gt;&#xA;&lt;p&gt;I can ping the closest machines to the VM who's pinging but I cant ping the one who's not directly linked to the VM.&#xA;I added the route to rochefort using orval as gateway but still din't work.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;route add -net 172.16.2.0 netmask 255.255.255.0 gw 172.16.1.2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;From chimay:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ping 172.16.1.2 # (orval) works!&lt;/p&gt;&#xA;&lt;p&gt;ping 172.16.4.4 # (westmalle) works !&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;ping 172.16.2.3&lt;/strong&gt; # (rochefort) Doesn't work !!!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Example: &lt;strong&gt;chimay&lt;/strong&gt; can ping &lt;strong&gt;orval&lt;/strong&gt; and &lt;strong&gt;westmalle&lt;/strong&gt; but not &lt;strong&gt;rochefort&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/r6IXi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/r6IXi.png&quot; alt=&quot;Schema&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I have already done the same thing with physical machines and it works so trying to get why it doesn't work with Virtual Maniches.&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance for your help !&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;All route:Chimay - Orval - Rochefort - Westmalle&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5D5tj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5D5tj.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20060" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-10-28T11:05:20.320" Title="Ping through a virtual machine" Tags="|routing|linux|" AnswerCount="3" CommentCount="3" ClosedDate="2018-05-22T15:17:00.740" ContentLicense="CC BY-SA 3.0" />
  <row Id="23773" PostTypeId="2" ParentId="23712" CreationDate="2015-10-27T12:59:12.553" Score="1" Body="&lt;p&gt;Without a screenshot we can only make an assumption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing I will point out is that vlan 1 is the native vlan by default on a trunk port. The native vlan is used to send untagged traffic via a trunk. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps this is what the CLI is displaying.&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2015-10-27T12:59:12.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23774" PostTypeId="2" ParentId="23772" CreationDate="2015-10-27T13:04:26.680" Score="1" Body="&lt;p&gt;Ubuntu(Linux) doesn't perform gateway functions aka forward IP packets by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must explicitly tell the system to do so &gt;&gt; /proc/sys/net/ipv4/ip_forward&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This guide should help you:&#xA;&lt;a href=&quot;http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/&quot; rel=&quot;nofollow&quot;&gt;http://www.ducea.com/2006/08/01/how-to-enable-ip-forwarding-in-linux/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My hunch is that on your physical topology you already made that change.&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2015-10-27T13:04:26.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23775" PostTypeId="2" ParentId="22967" CreationDate="2015-10-27T13:09:51.963" Score="0" Body="&lt;p&gt;The software was for the wrong model of switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The package was jinstall-ex-3200-12.3R6.6-domestic-signed.tgz&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e. for a EX-3200 model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;using &lt;/p&gt;&#xA;&#xA;&lt;p&gt;root@lsw22g&gt; show chassis hardware | match Chassis &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chassis                                BM0212070665      EX4200-24T&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can see that the firmware does not match up.&lt;/p&gt;&#xA;" OwnerUserId="19420" LastActivityDate="2015-10-27T13:09:51.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23776" PostTypeId="2" ParentId="23771" CreationDate="2015-10-27T13:12:06.180" Score="1" Body="&lt;p&gt;There only exist 65536 ports (from 0 to 65535), one of then located by the IANA into well known ports(lower to 1024), registered ports(from 1024 to 49151, that can be used by any application) and private or dynamic ports (from 49152 to 65535 assigned dynamically to a cliento who iniciates the connection). If you, THEORETICALLY, will be a lot of CPU and RAM on your equipment, from one port, you only will be able to entablish 65536 sockets.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-27T13:12:06.180" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23777" PostTypeId="2" ParentId="23771" CreationDate="2015-10-27T13:22:05.813" Score="3" Body="&lt;p&gt;The TCP tuple is composed of:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;source IP&lt;/li&gt;&#xA;&lt;li&gt;source port&lt;/li&gt;&#xA;&lt;li&gt;destination IP&lt;/li&gt;&#xA;&lt;li&gt;destination port&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since your sever socket is listening to one port and I presume one IP address (although it could be more) the remaining factors are the IP address and port on the remote end, i.e. the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPv4 there are 2^32 addresses, out of which roughly 3.5 billion are usable. There are 2^16 ports, most of which won't be used by clients as most TCP stacks use only a high range but let's say we are dealing with a client that could use any port, so that gives you a potential number of connections around 3.5*65000 = 229*10^12. That's more than you could ever hope to realistically handle on a single server.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-27T13:22:05.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23779" PostTypeId="2" ParentId="2283" CreationDate="2015-10-27T13:43:30.793" Score="3" Body="&lt;p&gt;There are a number of ranges that are reserved for various use cases. IANA has the authoritative and &lt;a href=&quot;http://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml&quot; rel=&quot;nofollow&quot;&gt;comprehensive list&lt;/a&gt;. It includes RFC1918, RFC6761 as well as more recent reservations like the 100.64/10 CGN block. If you find any addresses in there they are likely somehow used in a private network and should be discarded in favour of the others in search of the first public address.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-27T13:43:30.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23780" PostTypeId="1" AcceptedAnswerId="23784" CreationDate="2015-10-27T13:45:35.857" Score="2" ViewCount="678" Body="&lt;p&gt;When doing neighbor discovery in IPv6, the last 24 bits of the hosts MAC address is glued on to some link local multicast prefix. I'm wondering why 24 bits? Why not 48, or 32, or 16? What happens if two MACs on the same network shares the last 24 bits of their MAC addresses?&lt;/p&gt;&#xA;" OwnerUserId="20064" LastActivityDate="2015-10-27T23:24:18.407" Title="Why is only 24 bits of the MAC address used for multicasting?" Tags="|ipv6|multicast|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23781" PostTypeId="2" ParentId="23772" CreationDate="2015-10-27T13:48:40.703" Score="1" Body="&lt;p&gt;You need to clear your conf, and see between your gateways and static routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firts: chimay can ping orval and westmalle because it is directly connected, but, once the request arrives from HOST to chimay, then it is sended to orval and westmalle(you can see it on a sniffer), but the thing is that orval and westmalle do not know where is located HOST(IP 192.168.122.1). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you need to add an static route on orval like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(route add -net 192.168.122.0 netmask 255.255.255.0 gw 172.16.1.1) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and on westmalle&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(route add -net 192.168.122.0 netmask 255.255.255.0 gw 172.16.4.1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same i think happens from chimay to reach rochefort:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;You need to set 2 gateways on chimay, and one of then like DEFAULT route, 172.16.1.2 and 172.16.4.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, the only thing you need to do is to declare is the gateways and a DEFAULT route on rocheford to reach chimay and HOST and so on, eg: 172.16.2.2 or 172.16.3.4&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-27T13:48:40.703" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23782" PostTypeId="2" ParentId="23761" CreationDate="2015-10-27T14:08:59.323" Score="3" Body="&lt;p&gt;The answer @kll gave is probably the best you can do, although geo-location is getting worse all the time with the IPv4 address shortage because some users are using addresses assigned to RIRs in other continents. I know of at least one company that will only use ARIN (North America) addresses for its addressing, regardless of the site location anywhere in the world, because of the problems with sites being blocked, based on geo-location, from certain regions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most reliable method would be to use GPS, but that can be problematic indoors, and it would require extra hardware in your device. On the positive side, it would give you the most accurate time, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-27T14:08:59.323" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23783" PostTypeId="2" ParentId="23772" CreationDate="2015-10-27T14:21:06.943" Score="0" Body="&lt;p&gt;Your problem is that the host(rochfort) you are pinging (from chimay) does not know how to return packets.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I added the route to rochefort using orval as gateway but still din't work.&#xA;  route add -net 172.16.2.0 netmask 255.255.255.0 gw 172.16.1.2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;On &lt;strong&gt;rochefort&lt;/strong&gt; add the route&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route add default via 172.16.2.2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route add 172.16.1.0/24 via 172.16.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On &lt;strong&gt;chimey&lt;/strong&gt; add the route&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route ad 172.16.2.0/24 via 172.16.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-10-27T14:21:06.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23784" PostTypeId="2" ParentId="23780" CreationDate="2015-10-27T14:23:01.200" Score="3" Body="&lt;p&gt;The reason for the 24 bits (really 23 bits) is the OUI which is assigned by IEEE. They guys who created multicasting went to the IEEE and registered the OUI for multicasting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The story I heard was that it cost $1000 (a lot of money at the time) to register an OUI with IEEE, but they didn't have all of it, so they went in with someone else. They then divided the OUI into two parts (the reason it is only 23 bits). Multicasting can only use half the OUI addresses because of this. (Apparently, the other guy didn't use his half for anything of note.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember the destination MAC address for multicast has nothing to do with any interface MAC address. A MAC address has 24 bits for the OUI, and 24 bits to identify the individual interface, per OUI. Multicast uses the multicast OUI and the last 23 bits are for the layer-2 multicast group number. It's true that 23 bits are not enough to represent all the layer-3 multicast groups, so that you have multiple layer-3 multicast groups represented by a single layer-2 multicast group. That is a whole discussion all by itself.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-27T23:24:18.407" LastActivityDate="2015-10-27T23:24:18.407" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23785" PostTypeId="2" ParentId="23769" CreationDate="2015-10-27T14:24:08.393" Score="1" Body="&lt;p&gt;The syntax of an ARP request is something like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Who has x.x.x.y?  Tell x.x.x.y2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But switch see is x.x.x.y and x.x.x.y2 are on the same network(It has his ARP table who match MAC with IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you does a capture, you can see that on the same switch, that if from one network to another, you tried to make a ping request, this one &quot;Who has x.x.x.y?  Tell y.y.y.y2&quot; never happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch only conmunicates equipments on the same network&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-27T14:24:08.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23786" PostTypeId="2" ParentId="23769" CreationDate="2015-10-27T14:39:31.327" Score="4" Body="&lt;p&gt;ARP is a broadcast, but it is looking for a specific address, and Computer C would not have that address, so it won't answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A host doesn't ARP for an IP address it knows is not on its network. Instead, it will send the traffic destined for the other network to its configured gateway, and it may need to ARP for the gateway's layer-2 address, but it won't even try for a host which is not in its own network based on its configured IP address and mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computers A and B will never ARP for computer C's address since, based on their IP addresses and masks, they know that Computer C's address is not on their network. When Computers A and B want to send something to Computer C, they realize it is on another network, so they will send it to the gateway each has configured.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-27T14:39:31.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23787" PostTypeId="2" ParentId="23769" CreationDate="2015-10-27T15:16:18.253" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Since switch works on the second layer of the OSI model, it won't know which computers are in the same network or not.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To be accurate, based on your description, all three of your hosts are on the same network from a L2 perspective and the switch knows this to be the case. The switch doesn't care about what IP addresses are as it is only using the L2 addressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L2 broadcasts and unicast floods will be received by all three computers in your example. For example, if A ARPs for B, C will also see this broadcast.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What forbiddens computer C to answer an ARP request coming from the computer A?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Nothing on the switch prevents C from answering a request from A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in this example, A will never send a request to C. If A has traffic for C, A will use it's own IP address and mask to determine if C is on the local network or not. In this case it is not, so A will then look to it's routing table to determine where to forward this traffic (on most computers this will typically be the default route or gateway).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's extend this example a bit and say that B is misconfigured with a /22 mask (smallest network to include both 192.168.1.0/24 and 192.168.2.0/24) instead of the /24 it should have. If B had traffic for C, it would determine that C is on the local network and B would ARP for C. When C receives this ARP request, it should not respond as it would determine that B is not on the local network.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-10-27T15:16:18.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23789" PostTypeId="1" AcceptedAnswerId="26289" CreationDate="2015-10-27T17:41:30.490" Score="3" ViewCount="2430" Body="&lt;p&gt;Long ago, I read (I don't recall where now) that one may test a link's throughput by copying a file from a remote source to a local Cisco router's null: file system.  I thought it was a great suggestion but never really had the chance to use it.  REcently, I've been troubleshooting a link where the customer has been complaining of slow connectivity.  I dusted off this nugget stored in my brain and tried it out.  I'm slightly concerned about the results, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Truly, the connection was slow, but it was FAR slower than I expected it to be, slower even than the customer's report of a similarly-sized file.  The command I used was something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy scp://joe@10.11.12.13://home/joe/randomfile.100m null:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, is this a valid test?  I am making assumptions that the TCP/IP stack and SSH/SCP processes are optimized well enough to handle the reception of data at or close to the line speed of the link in the direction of the remote host.  Since the router is throwing the data away, I think I should be able to ignore write speed to the FS (as one may not be able to do when writing to flash, for example).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;extra info:&#xA;The link in question is a 1Gig interface towards the provider with a 50Mbps CIR.  Traffic shaping is configured outbound, but this data direction is inbound.  ISR4331, running 15.4-3 (isr4300-universalk9.03.13.02.S.154-3.S2-ext.SPA.bin).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this IS a valid test, I could ask the provider to check the link to ensure shaping/policing outbound is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for you thoughts.&lt;/p&gt;&#xA;" OwnerUserId="194" LastActivityDate="2016-01-26T13:26:40.393" Title="Cisco throughput testing with null:" Tags="|cisco|throughput|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23790" PostTypeId="1" AcceptedAnswerId="23793" CreationDate="2015-10-27T18:48:05.447" Score="2" ViewCount="179" Body="&lt;p&gt;We have several BRIs to provide a specialized service, which requires a specific type of hardware per BRI. We're struggling with offering incoming calls, as each of these lines has its own telephone number and we were told by the Telco that this is how it works, and each line can only have one &quot;SPID&quot;. We did however ask for numbers, not SPIDs, but their answer suggests that the two are linked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible and common in Europe to assign a single phone number to multiple lines, ISDN or not, on a first answerer gets the call basis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is a North American ISDN line indeed bound to its SPIDs in a way that it is limited exclusively to receiving calls from a single telephone number per B-Channel, and if so, must that number indeed be unique? Or is it possible to configure a number for ringing on multiple BRIs?&lt;/p&gt;&#xA;" OwnerUserId="20067" LastEditorUserId="20067" LastEditDate="2015-10-27T18:54:28.433" LastActivityDate="2015-10-27T20:10:35.577" Title="Can several ISDN BRIs be mapped to a common phone number in north america?" Tags="|telephony|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23791" PostTypeId="2" ParentId="23790" CreationDate="2015-10-27T19:16:12.923" Score="1" Body="&lt;p&gt;In Europe, ISDN became popular, but in the U.S. it never really took off the same way. The problem in the U.S. is that each carrier does it differently, and, even worse, it is handled differently in different states.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, in most U.S. locations, ISDN was billed by per minute of usage, not flat-rate as is common for regular phone lines. In my state the state government wanted ISDN, and it really force the main carrier in the state to offer it at a flat rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the U.S., you are, unfortunately, at the mercy of the incumbent carrier at the location, and the same carrier may have different rules for different states. The only long distance carrier that could even transport ISDN calls was AT&amp;amp;T, which is no longer even a stand-alone entity/LD carrier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A SPID is the circuit ID, and it does directly relate to the phone number. Usually, a SPID starts with the 10-digit phone number with something like &lt;code&gt;0101&lt;/code&gt; tacked on the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back when I got an ISDN BRI for personal use (before the current DSL and cable internet connections), I used it for both data and phone service. Calling one of the two phone numbers assigned to the BRI would ring that line, but if that line was in use, it would ring the other line. To get that to work across multiple BRI lines would involve the carrier to get that enabled. Unfortunately for you, there is no way to force a carrier to do that, and, in many states, they can't offer such a service without getting a tariff granted by the state to offer the service. At this point, ISDN BRI never really took off, and it isn't cost effective for the carriers to jump through the necessary hoops to add such services. The carriers are more concerned about getting all their services on IP, and off TDM (like ISDN), rather than enhancing and adding TDM services.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-27T19:49:58.110" LastActivityDate="2015-10-27T19:49:58.110" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23792" PostTypeId="1" CreationDate="2015-10-27T20:05:25.627" Score="-1" ViewCount="123" Body="&lt;p&gt;I want to begin to learn about the basics of networking.  Is there any networker's 'bible' or high regarded very entry level reading material I can begin to read?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="20073" LastActivityDate="2015-10-27T20:20:54.487" Title="Beginner Learning Material" Tags="|network-discovery|" AnswerCount="1" CommentCount="3" ClosedDate="2015-10-27T21:36:07.000" ContentLicense="CC BY-SA 3.0" />
  <row Id="23793" PostTypeId="2" ParentId="23790" CreationDate="2015-10-27T20:10:35.577" Score="5" Body="&lt;p&gt;Each B-channel has a SPID (circuit ID). It doesn't have to have anything at all to do with the PSTN phone number. Many LECs in the US assign the two together, but nothing in the switch requires this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Individual lines can be mapped to a &quot;hunt group&quot; with a single pilot number, and/or each line can be programmed to roll forward to the next (&quot;rotary&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Good luck finding anyone at the telco who knows how any of this stuff works. When you do find them, get their &lt;em&gt;direct&lt;/em&gt; phone number!)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-27T20:10:35.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23794" PostTypeId="2" ParentId="23792" CreationDate="2015-10-27T20:20:54.487" Score="2" Body="&lt;p&gt;Cisco CCNA Exploration 4.0 is the best that you can find, where are explained on a easily way, all the basics topics of networking&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-27T20:20:54.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23798" PostTypeId="1" AcceptedAnswerId="23801" CreationDate="2015-10-28T07:07:39.853" Score="3" ViewCount="1014" Body="&lt;p&gt;Is LAN QoS required for VoIP applications?&#xA;We have basic network infrastructure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC (Softphone) -GigEth-&amp;gt; [Switch] -GigEth-&amp;gt; [Router/Firewall] -&amp;gt; Internet (100 Mbps) -&amp;gt; [ITSP]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Voice traffic flows via switch and firewall towards my IP Telephony Service Provider. We have around 50 users which may place simultaneous calls. (Bandwidth per call is around 80 Kbps - Kilobits per second) and Softphone doesn't mark traffic with DSCP, use BE (0). We have received some complaints about voice quality. I believe 1 GB ethernet is more than enough per PC.&lt;/p&gt;&#xA;" OwnerUserId="20079" LastEditorUserId="8499" LastEditDate="2015-10-28T14:38:20.743" LastActivityDate="2015-11-06T01:48:00.583" Title="LAN QoS for VoIP" Tags="|lan|qos|voip|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23799" PostTypeId="2" ParentId="22529" CreationDate="2015-10-28T07:14:14.117" Score="1" Body="&lt;p&gt;A port can only be forwarded to one particular host. A port triggering is nothing more than a triggered port forwarding, when connection is established on port range n to n then port x to x is forwarded to machine 192.168.178.2. The ports are usually forwarded to the same ports on the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port forwarding is used to forward traffic when only one public IP is available. So only connections or communication that was established from a host inside the network can be assigned to the host by the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, a port forwarding is a static and permanent port forwarding, it gets active when connections or communications are established from the outside which not had been requested / established from the internal network (or all of the time and the router prevents to use those ports for other connections). When a router supports a port forwarding and triggering rule for the same outbound ports then the triggering rule is preferred as it is temporary. There are also routers where you can create an exposed host, so basically all ports are forwarding to this host. But when you add a port forwarding then all ports but not the ports that you just forwarded another host are forwarded to the exposed host.&lt;/p&gt;&#xA;" OwnerUserId="20081" LastEditorUserId="20081" LastEditDate="2015-10-28T15:37:36.657" LastActivityDate="2015-10-28T15:37:36.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23800" PostTypeId="1" CreationDate="2015-10-28T07:29:04.340" Score="2" ViewCount="1360" Body="&lt;p&gt;I'm new to this forum and HP's 1920 switching technology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'd like to do is getting a 1920 configured with 2 VLANs (intranet and adminnet), but with WebLoging enabled in only one (adminnet) of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I configured the 1920 with two port based VLANs and assigned one static adddress to each.&#xA;I'm performing the routing between these two VLANs by a seperate firewall which works fine for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem this in the Web GUI's wizzard in the &quot;Management IP Interface Configure&quot; I can configure one IP address for each VLAN. But, when I changethe  &quot;Admin Status&quot; from &quot;Up&quot; to &quot;Down it works for both interfaces instead of just one and I kicked out myself from the WebGUI. How can I get this configuration running using just one of these Management IP Interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to revoke/change my selection via serial console, &quot;_cmdline-mode on&quot; and &quot;SYS&quot;. There are a lot of CLI commands available, but sadly not documentation available on the web. Searched 4 hours now using Google and gave up. Just old ProCurve CLI documentations are available, using &quot;enable&quot; and &quot;config&quot; mode (I know form former times ... and from CISCO routers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, back to my inital question: How can I configure the 1920 for 2 port based VLANs using only interface in one VLAN for WebLogin?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas, hints, etc.?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance and greetinx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;priesemut&lt;/p&gt;&#xA;" OwnerUserId="20082" LastActivityDate="2016-05-24T12:52:20.217" Title="HP 1920-48 - WebLogin addresses/interfaces" Tags="|switch|vlan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23801" PostTypeId="2" ParentId="23798" CreationDate="2015-10-28T08:44:42.683" Score="3" Body="&lt;p&gt;internet speed seams to be very good (&lt;em&gt;80k/user&lt;/em&gt; X &lt;em&gt;50 user&lt;/em&gt; = &lt;em&gt;4000K&lt;/em&gt; = &lt;em&gt;4M&lt;/em&gt;) &#xA;sure &lt;strong&gt;&lt;em&gt;QOS&lt;/em&gt;&lt;/strong&gt; is great thing to think about but first you need to make sure of the next.&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;you must think about&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA; 1- Uplinks between switches and each other (specially when it seams you run spread network). lets say  you attached the users to 3 &lt;strong&gt;24 port switchs&lt;/strong&gt; for example and connect switches to each other by 1G uplink so you fail into bottle neck, so how you connect your switches to each other very affect the performance of any traffic switching.&lt;br&gt;&#xA; 2- uplink between switches and your router , port speed of each also can be bottle neck.&lt;br&gt;&#xA; 3- you must think about storm control and broad cast control , if you run over cisco switches may you adapt storm control and broad cast level.&lt;br&gt;&#xA; 4- Firewall traffic inspection may delay the voice traffic specially you run soft phones which may use the same range of IPs as normal Data . (you may configure your firewall with roles and polices which allow SIP traffic with no inspection based on port number or protocol type)&lt;br&gt;&#xA; 5- may you can make sure of your internet speed per each user to make sure it is equal or greater 80 KBPS.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-28T08:44:42.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23802" PostTypeId="2" ParentId="20627" CreationDate="2015-10-28T09:17:05.990" Score="1" Body="&lt;p&gt;In most cases for charging it does not matter if you are using 2G, 3G or 4G network. Charging is usually defined per service and it is not related to the radio access technology (2G, 3G or 4G). And it is not dependent on the transmission technology between the basestation and the core network - it can be SDH/PDH, Ethernet (over copper or fiber), Frame Relay, point to point radio link, or any combination of these and other technologies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Voice services are charged per call minutes or seconds depending on operator policies. And data services are charged per data volume (usually kilobytes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 4G, voice can be carried by packets if the technology used is VoLTE (Voice over LTE), even in this case the charging system counts the duration of the call not the transmitted kilobytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally most operators use 2G mainly for voice, 3G for voice and data and 4G for data. Some operators also have &lt;a href=&quot;https://en.wikipedia.org/wiki/VoLTE#Deployment&quot; rel=&quot;nofollow&quot;&gt;deployed VoLTE&lt;/a&gt; and use 4G for voice too. &lt;/p&gt;&#xA;" OwnerUserId="5576" LastActivityDate="2015-10-28T09:17:05.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23803" PostTypeId="1" AcceptedAnswerId="23818" CreationDate="2015-10-28T10:21:12.537" Score="3" ViewCount="229" Body="&lt;p&gt;Is it possible to set up routing rules without connecting additional cables to the Cisco routers? The problem is that we have old Ciscos, and two ethernet ports are used already. We use Cisco 1841 routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: I am on a PC with IP address 192.168.1.19, and I need to access 192.168.2.25, which is in a branch office. My office PC firewall (pfSense) has two network cards with IP addressess set up on them 192.168.1.28 and 10.0.0.1. The branch office has a similar firewall. They are connected through a VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would look something like this, I guess:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.19 (client) -&amp;gt; 192.168.1.1 (Cisco router) -&amp;gt; 192.168.1.28 (pfSense) -&amp;gt; 10.0.0.1 -&amp;gt; 10.0.0.2 -&amp;gt; 192.168.2.28 (pfSense) -&amp;gt; 192.168.2.1 (Cisco router) -&amp;gt; 192.168.2.25 (client)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know this probably looks so bad, so you are welcome to criticize. I am just trying to learn networking while being sysadmin and have some constraints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically here I want to set up VPN between two offices using different internet source and spare computers with pfSense installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;I have created a detailed diagram if that helps to understand the reason behind this. I want to create a new VPN for a new &quot;test&quot; network in the branch office while not breaking old VPN connection. If this works, then I can replace the old VPN link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qaZDI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qaZDI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two ethernet ports on the Ciscos used for 1 - our main network, 2 - VoIP system. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the diagram, I guess if our internet traffic is routed through the firewall, the same way should be possible to route traffic between the subnets, correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit2:&lt;/strong&gt; corrected picture IP addresses &lt;/p&gt;&#xA;" OwnerUserId="19921" LastEditorUserId="8499" LastEditDate="2015-10-29T00:40:46.583" LastActivityDate="2015-10-29T00:40:46.583" Title="Subnet routing rules without connecting additional cables" Tags="|cisco|vpn|firewall|pfsense|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23805" PostTypeId="2" ParentId="23789" CreationDate="2015-10-28T10:37:37.300" Score="2" Body="&lt;p&gt;copy process you did not involved in link speed only but Buffer size and Que Rate of the &lt;strong&gt;&lt;em&gt;file system memory&lt;/em&gt;&lt;/strong&gt; as well which will provide slower result than you expected . so may you have two valid speed test.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- Using Test TCP (TTCP) to Test Throughput as described in &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/dial-access/asynchronous-connections/10340-ttcp.html&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- use jperf server client speed test as described in &lt;a href=&quot;http://www.techrepublic.com/blog/linux-and-open-source/using-jperf-to-check-network-performance/&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-28T10:37:37.300" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23806" PostTypeId="2" ParentId="23803" CreationDate="2015-10-28T11:33:36.767" Score="1" Body="&lt;p&gt;if your network looks like the next&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1aB0D.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1aB0D.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;so router it self won't handle any routing regard the VPN or additional VPN connections because &lt;em&gt;&lt;strong&gt;pfsense&lt;/strong&gt;&lt;/em&gt; will handle it . router will just has a default route to the firewall to access any network in the other side . so router won't involve in creating new VPN over new ISP , &lt;em&gt;&lt;strong&gt;pfsense&lt;/strong&gt;&lt;/em&gt; will&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-10-28T11:33:36.767" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23809" PostTypeId="2" ParentId="22404" CreationDate="2015-10-28T12:43:56.880" Score="2" Body="&lt;p&gt;In mobile networks, the voice call data is Channel Switched and there is no packets.In Packet Switched data networks information is transferred in packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there are different protocols and technologies in the different interfaces in the mobile network. Interfaces like the ones between the user equipment and the basestation, and other protocols an technologies between the basestation and the core network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are asking about the GSM Networks, the radio interface each frequency is divided to time-slots and each of them can contain several types of logical channels for signaling or voice traffic. This is TDMA (Time Division Multiple Access). Each subscriber is using the radio channel within specific time interval is a cycle. Basically all the subscribers in the cell are using the channel in a cyclic order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The channel carrying speech is called traffic channel (TCH). It carries digital speech data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The process of forming this data is roughly the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Speech &lt;/li&gt;&#xA;&lt;li&gt;Analog to digital conversion  &lt;/li&gt;&#xA;&lt;li&gt;Grouping the digital audio signals into 20 msec speech frames &lt;/li&gt;&#xA;&lt;li&gt;Using codec to compress the voice data&lt;/li&gt;&#xA;&lt;li&gt;Adding protection bits (checksum) and some service information&lt;/li&gt;&#xA;&lt;li&gt;The formed block is transmitted within one timeslot of the TCH&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The whole process is more complex and it is difficult to be described in a short answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2G is using TDMA and 3G is using CDMA methond for accessing the radio resource.&lt;/p&gt;&#xA;" OwnerUserId="5576" LastActivityDate="2015-10-28T12:43:56.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23810" PostTypeId="1" CreationDate="2015-10-28T13:07:19.843" Score="2" ViewCount="3625" Body="&lt;p&gt;In a mobile network the UE establishes a PDP Context in order to transmit an receive data. In which cases the PDP contexts is terminated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example - is it terminated when:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the UE is switched off&lt;/li&gt;&#xA;&lt;li&gt;the UE is out of coverage for certain time&lt;/li&gt;&#xA;&lt;li&gt;the subscriber deactivated mobile data by pushing the mobile data icon on his smarphone&lt;/li&gt;&#xA;&lt;li&gt;the UE moves from the serving area of one SGSN to the serving area of another SGSN&lt;/li&gt;&#xA;&lt;li&gt;after being active too much time&lt;/li&gt;&#xA;&lt;li&gt;Any other cases?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="5576" LastActivityDate="2015-10-28T14:32:39.700" Title="In which cases is the PDP context terminated" Tags="|mobile|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23812" PostTypeId="2" ParentId="23798" CreationDate="2015-10-28T14:22:16.707" Score="1" Body="&lt;p&gt;QoS is something you should set up when you have a bunch of users and VoIP. You really want the VoIP to run in its own VLAN separate from the rest of the network traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should do QoS marking as close to the source as possible (at the switch port, if possible). Even better, the phones may already mark the VoIP traffic as EF, but that depends on the phone. The rest of your traffic can be marked as BE, or you can get into multiple classes if you have a need for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the traffic is marked, you need to set up proper queues in the router for the various traffic types based on the markings. VoIP should probably have a priority queue which you need to size carefully. There are various other techniques such as shaping, RED policing, etc. QoS is a topic far too broad to properly be discussed here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that, unless you pay for it, your ISP won't honor QoS markings, and any other ASes through which your traffic travels to your VoIP provider will not honor any QoS markings either. The goal for QoS in your network is to make sure that VoIP gets first priority exiting your network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-28T17:51:01.197" LastActivityDate="2015-10-28T17:51:01.197" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23813" PostTypeId="2" ParentId="23810" CreationDate="2015-10-28T14:32:39.700" Score="2" Body="&lt;p&gt;The PDP context can be actively torn down, i.e. the UE sends a PDP deactivation request or there can be an inactive timeout in the GGSN. The timeout typically starts counting from the last transferred data on the PDP so for a PDP with continuous traffic the timer will be reset all the time.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;UE is switched off&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Either the UE sends a PDP deactivation request before it is switched off or, if for example you pull the battery on the phone, it won't be able to and then you will instead hit the inactive timeout in the GGSN.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the UE is out of coverage for certain time&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;PDP will be deactivated from GGSN if UE is out of coverage for at least the timeout period.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the subscriber deactivated mobile data by pushing the mobile data icon on his smartphone&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Would definitely send PDP deactivation request from UE to tear down PDP.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the UE moves from the serving area of one SGSN to the serving area of another SGSN&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I will admit I'm not sure if the UE, provided it is still within radio coverage of both serving areas, would signal PDP deactivation in the &quot;old&quot; serving area before moving into the new area. If nothing else, you will hit the timeout in GGSN.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;after being active too much time&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is rather rare in modern networks as mobile carriers want their customers to use as much data (they are getting paid for it after all) so you don't want to tear down connections. In addition, the UE will very likely send PDP create request so you will only increase signalling load by trying to tear down the PDP of an active UE.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Any other cases?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Yes, simply not sending any data on the PDP for at least one timeout. In practice this is rare as the timeout is often set for hours or even days and modern devices tend to send various keepalives at regular intervals (minutes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another case is when the mobile carrier is performing planned maintenance on their GGSN and wishes to move sessions over to another GGSN by deactivating the current PDP contexts.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-28T14:32:39.700" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23814" PostTypeId="1" CreationDate="2015-10-28T14:39:36.737" Score="5" ViewCount="1712" Body="&lt;p&gt;I have a star topology consisting of 12 switches.  Recently, we began running low on available IP addresses (192.168.100.0/24) and I was asked to open up a new scope (192.168.50.0/24) on the DHCP server.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The scope has been created, I tied it to the same VLAN 50 on all switches, tagged and untagged the appropriate ports and everything seemed to be fine.  The clients correctly grab their IP address from the newly designated scope, and they have full network access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem we are seeing is that when a host tries to communicate with a host on the other VLAN, there is anywhere between 0-10% packet loss.  If I run a constant ping across the VLANs and it isn't dropping any packets, I will get 3-4ms per attempt and then a 30-40ms packet every 15-20.  Any host that communicates with its own VLAN is flawless.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches are mostly HP Procurve 1920-24G, with a couple of 1910-24G models that haven't been replaced yet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have checked on multiple occasions to make sure that there isn't a loop in the network, because the switch logs all seem to show ports intermittently changing their status to DOWN and back to UP right away over a period of a few seconds.  Sometimes this will happen every 90 minutes or so, and the port is not always the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It just seems quite strange that there are only issues when the communication crosses over to the other VLAN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can upload any configs or output, if needed.&lt;/p&gt;&#xA;" OwnerUserId="2670" LastEditorUserId="8499" LastEditDate="2019-01-04T21:47:07.267" LastActivityDate="2019-01-04T21:47:07.267" Title="Dropping packets routed between VLANs" Tags="|routing|vlan|hp-procurve|packet-loss|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23815" PostTypeId="2" ParentId="23814" CreationDate="2015-10-28T14:48:07.747" Score="3" Body="&lt;p&gt;If the problem only happens between VLANs, you need to look at the router which is used to route between the VLANs. It may be overloaded on its CPU or buffers, but that is the common point between VLANs, and that is the place to start your investigation.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-28T14:48:07.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23816" PostTypeId="1" AcceptedAnswerId="23817" CreationDate="2015-10-28T16:34:00.777" Score="3" ViewCount="11687" Body="&lt;p&gt;I'm installing the network in an office building that will be used as co-working space by multiple smaller companies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I was hoping to isolate traffic from the different companies I purchased hardware which (supposedly) has VLAN support:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://uk.tp-link.com/products/details/cat-4910_TL-ER5120.html#overview&quot; rel=&quot;nofollow&quot;&gt;TP-Link ER-5120 broadband router&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;TP-Link TL-SG3424 L2 switch&lt;/li&gt;&#xA;&lt;li&gt;Linksys LAPAC 1750 802.11AC access points&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The creation of company SSIDs on the Linksys and assigning them to VLAN IDs created on the L2 switch works fine. However, clients in this VLAN don't get an IP address from the router. The router doesn't know how to handle the VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ER-5120 apparently has port-based VLAN support but does that mean it can't trunk the VLANs over a single cable? I only have 4 LAN ports on the router which is not enough for the number of VLANs that I need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According &lt;a href=&quot;http://uk.tp-link.com/faq-887.html&quot; rel=&quot;nofollow&quot;&gt;to this&lt;/a&gt; doc on the TP-Link website I need to include a managed L3 switch, which (from TP-Link) costs more than all the equipment I already purchased :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is whether I'm overlooking something. And if I &lt;em&gt;really&lt;/em&gt; need an L3 switch for this configuration, could I also use a much cheaper model like HP's 1920 8-port L3 switch, or the Edgeswitch Lite from Ubiquity?&lt;/p&gt;&#xA;" OwnerUserId="20091" LastActivityDate="2017-07-20T11:16:50.623" Title="How to configure VLANs on a TP-Link ER-5120 router" Tags="|vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23817" PostTypeId="2" ParentId="23816" CreationDate="2015-10-28T17:01:49.777" Score="0" Body="&lt;p&gt;That router, apparently, only does port based VLANs, not 802.1Q trunks. You either need a different router which can do 802.1Q trunks, or you need to get a layer-3 switch which can connect to this router via a point-to-point routed link. You are trying to use the equipment you have in a way it wasn't designed to be used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't really give all the specifications for what you are trying to do. A layer-3 switch could work; you could get a router that supports trunking; you could get a router with enough ports, etc. You need to decide how you want to design the network, first, then buy equipment which supports your design. It seems you did that backwards (using the wrong tools for the job; don't use a screwdriver to drive nails).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT based on your comment:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A layer-3 switch as a distribution switch is certainly a viable solution. You can set it up to trunk the correct VLANs to the various access switches. The VLANs defined in the Layer-3 switch will have the gateway addresses for the VLANs, and, probably, a static route to the WAN router. You should set up a point-to-point routed link between the layer-3 switch and the WAN router. If the WAN router is the DHCP server, you will need to set up a relay for that on the layer-3 switch for each of the VLANs using DHCP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-28T21:45:16.857" LastActivityDate="2015-10-28T21:45:16.857" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23818" PostTypeId="2" ParentId="23803" CreationDate="2015-10-28T17:29:29.043" Score="0" Body="&lt;p&gt;Based on your updated diagram and edits, you have one obvious problem: multiple routes to the same remote network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to prioritize the routes to use the test network when you want to test. In your Ciscos, you should be able to do this, but it depends on how you have the routes set up in the device. One of the easiest ways is to use administrative distance to do this. Set AD lower on the route you wish to prefer and higher on the backup route. AD works with both statically defined routes or routes received through routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You didn't include the Cisco configurations, so I don't know how the Ciscos get the routes to the other site.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-28T17:29:29.043" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23821" PostTypeId="1" CreationDate="2015-10-28T17:50:13.150" Score="4" ViewCount="536" Body="&lt;p&gt;I'm trying to achieve this: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13762-40.html#conf3&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13762-40.html#conf3&lt;/a&gt;. The only difference here is that I am being sent the full BGP routing table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have following questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If the upstream is sending full BGP table instead of a default&#xA;route, will the setup and logic described on that page work?&lt;/li&gt;&#xA;&lt;li&gt;Should I ask just for a default route?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20096" LastEditorUserId="8499" LastEditDate="2019-01-05T00:04:35.997" LastActivityDate="2019-01-05T00:04:35.997" Title="BGP loadbalancing: full bgp table vs default route only" Tags="|routing|bgp|load-balancing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23822" PostTypeId="1" CreationDate="2015-10-28T17:55:46.050" Score="2" ViewCount="481" Body="&lt;p&gt;I am using Quagga and FreeBSD 10.2 to achieve BGP loadbalancing. Before putting this into the production, I am trying out all fail cases I can come up with. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried doing &quot;pkill -9 bgpd&quot; to simulate daemon crash. This removed all BGP entries  from the routing table. Is it possible to configure Quagga to keep BGP entries in the routing table? Any hints appreciated.&lt;/p&gt;&#xA;" OwnerUserId="20097" LastActivityDate="2016-01-09T17:48:13.347" Title="Quagga route persistence" Tags="|quagga|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23823" PostTypeId="2" ParentId="23821" CreationDate="2015-10-28T18:01:28.637" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes it will work in the same way.  BGP prefers external to internal routes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Probably.   It you are only connected to a single provider, there's no advantage to full routes.  Full routes make sense when you can choose among several providers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-28T18:01:28.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23824" PostTypeId="2" ParentId="23821" CreationDate="2015-10-28T18:01:35.833" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;A default route is just a single route. If you receive the full BGP&#xA;routing table, you just have many routes instead of one. The same&#xA;logic applies to each individual route as it would for a single,&#xA;default route.&lt;/li&gt;&#xA;&lt;li&gt;You could just ask for a default route if you really have no need&#xA;for the full BGP routes. You could also set your routers up to&#xA;ignore the incoming BGP routes and supply your own default route.&#xA;You need to decide that based on whether or not one router really&#xA;does have a better route to specific networks, and you want to take&#xA;advantage of that.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-28T18:01:35.833" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23826" PostTypeId="2" ParentId="23822" CreationDate="2015-10-28T19:10:48.197" Score="1" Body="&lt;p&gt;Dynamic Routing Protocols works on that form, any neighbor or peer changes, will cause change on the routing tables, then, think if that neighbor or peer disapear??, automatically the routing table will be changed, only maintaining the statical routes, and those who are put by some active routing protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quagga emulates in a good way a router, i think, what you need to do is to check the Quagga daemons, eg: quagga, zebra, bgpd and so on, on the way to maintain those working, i´m thinking a daemon like Supervisor, and configured to up every daemon with the conf that you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find supervisor info here: &lt;a href=&quot;http://supervisord.org/introduction.html&quot; rel=&quot;nofollow&quot;&gt;http://supervisord.org/introduction.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2015-10-28T19:16:14.640" LastActivityDate="2015-10-28T19:16:14.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23827" PostTypeId="2" ParentId="23500" CreationDate="2015-10-28T20:34:16.650" Score="1" Body="&lt;p&gt;SDN is a concept of a network that virtualizes it control plane and allows it to be programmable (Therefore it has the name &quot;Software-Defined&quot;).&#xA;Whether you look inside of SDN, you'll see a set of protocols and tools for enabling software defined. One of this protocols is the OpenFlow, however you have another protocols that does almost the same stuff (NFV - Network Function Virtualization) and also other tools that are considered as SDN, such as OpenStack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Practical examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You can use both SDN or OpenFlow, since you're using the OpenFlow protocol in your research (as an example).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You cannot use OpenFlow whether you're dealing with another protocol (e. g. NFV). Nevertheless, you can still use SDN in this case.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20101" LastActivityDate="2015-10-28T20:34:16.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23828" PostTypeId="1" AcceptedAnswerId="23834" CreationDate="2015-10-28T21:17:13.850" Score="5" ViewCount="3004" Body="&lt;p&gt;I am working in an inherited environment where I have basically been thrown in feet first. I'm also brand new to VLANs, and only set it up via documentation from other techs in my company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After struggling for a &lt;em&gt;long&lt;/em&gt; time trying to get VoIP phones working both inside and outside of our LAN, another colleague and I finally got a VLAN setup on one of the switches, and the phones started working properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, I have 3 network closets, all connected by dual CAT6 cables back to the main closet. All the switches are 802.1Q compatible. One switch has the VLAN to the phone system, as required. What I want to do is get the other switches on a tagged VLAN, but I was wondering why I should or should not make every switch part of that VLAN as well, for future proofing? Is it a good idea to set every port either untagged to one network, or tagged to all VLANs available?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main problem that I actually care about most, however, is should I only include the Uplink ports on the other switches to be part of the phone's VLAN, Tagged, plus the ports off those individual switches that needs to be part of that VLAN? Or am I making this too complicated for myself?&lt;/p&gt;&#xA;" OwnerUserId="4371" LastEditorUserId="8499" LastEditDate="2018-12-22T04:40:55.523" LastActivityDate="2018-12-22T04:40:55.523" Title="Extending VLANs to other switches" Tags="|switch|vlan|switching|trunk|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23829" PostTypeId="2" ParentId="23828" CreationDate="2015-10-28T21:35:24.640" Score="1" Body="&lt;p&gt;You didn't include a drawing, so I will assume that the switches are connected in a star rather than chained in some other fashion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, you would connect switches together with trunks (tagged links). You can allow or restrict which VLANs cross the trunks between the switches. If you do this, it becomes a simple matter to add a VLAN used on other switches to a switch which didn't previously have that VLAN. This assumes that the switches aren't daisy-chained, which would be a bad idea, anyway.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-28T21:35:24.640" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23830" PostTypeId="2" ParentId="23828" CreationDate="2015-10-28T21:40:19.960" Score="1" Body="&lt;p&gt;First, are you talking about VoIP phones?? Everyone on the network must be able to access the VoIP infraestructure, eg: will everyone use de VoIP system??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing that you can do is separate the DATA and VoIP into two different networks, all represented on all the switches. One thing that you need to take on mind is the number of users that you have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg: We suppose you have a 24 port switch per closet, i guess, you have aprox. 20 ports per switch available to connect something, and 10 per user(i suppose you will get 2 ports per user, one for DATA, and another por VoIP phone). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On that way, you need to configure like access ports(untagged links), the switchports connected to end-user, computer and phones, everyone on his vlan, remember, 2 VLANS, and create Trunks(tagged links) to transport the vlans, and permitted on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On that conf. i guess, yor project work.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2015-10-29T12:08:54.733" LastActivityDate="2015-10-29T12:08:54.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23831" PostTypeId="1" AcceptedAnswerId="23832" CreationDate="2015-10-28T09:23:22.140" Score="5" ViewCount="3673" Body="&lt;p&gt;I have a wireshark capture of implementations of DTLS protocol. I have the PSK and I have converted it to corresponding hex.DTLS uses &lt;code&gt;TLS_PSK_WITH_AES_128_CCM_8&lt;/code&gt; cipher suite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I decrypt the data in wieshark(1.12.7)?&lt;/p&gt;&#xA;" OwnerUserId="20111" OwnerDisplayName="Kalu" LastEditorUserId="21048" LastEditDate="2015-12-01T16:10:30.200" LastActivityDate="2015-12-01T16:10:30.200" Title="Decode with known PSK in DTLS" Tags="|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23832" PostTypeId="2" ParentId="23831" CreationDate="2015-10-28T09:40:09.417" Score="7" Body="&lt;p&gt;Open the capture on Wireshark, and:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Rigth-click on a DTLS packet&lt;/li&gt;&#xA;&lt;li&gt;Then select &quot;Protocol Preferences&quot; --&gt; &quot;Datagram Transport Layer Preferences&quot;&lt;/li&gt;&#xA;&lt;li&gt;There you can put your PSK in HEX format.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Finally, when you select a DTLS packet, on the details section you have a second tab with the decrypted DTLS data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/e5JuD.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e5JuD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20113" OwnerDisplayName="renzoe" LastActivityDate="2015-10-28T09:40:09.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23833" PostTypeId="1" AcceptedAnswerId="23835" CreationDate="2015-10-28T21:53:49.953" Score="3" ViewCount="729" Body="&lt;p&gt;I have a Cisco 1921 and I want to allow one WAN IP number (lets call it 1.2.3.4) to access a server on the LAN. My WAN interface is GigabitEthernet0/0 and my LAN interface is GigabitEthernet0/1. I have now one access list that is applied both to inbound GigabitEthernet0/0 and outbound GigabitEthernet0/1 it is this one here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10 permit udp host 8.8.8.8 eq domain any&#xA;20 permit udp host NTPIP eq ntp host ciscoIP eq ntp&#xA;25 permit tcp host 1.2.3.4 eq 3389 host 192.168.31.9 eq 3389&#xA;26 permit udp host 1.2.3.4 eq 3389 host 192.168.31.9 eq 3389&#xA;28 deny udp any any eq 3389&#xA;29 deny tcp any any eq 3389&#xA;30 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this access list I can not get my RDP connection to work, but if I replace that access list with one that has only one line &lt;code&gt;10 permit ip any any&lt;/code&gt; on the inbound interface GigabitEthernet0/0 then RDP works fine, which means I must have set up NAT port forwarding correctly right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I can tell then lines 25 and 26 should allow 1.2.3.4 to access port 3389 and lines 28 and 29 should ban all other IP's. So where am I going wrong here?&lt;/p&gt;&#xA;" OwnerUserId="14419" LastEditorUserId="14419" LastEditDate="2015-10-28T22:05:34.217" LastActivityDate="2015-10-28T22:11:25.920" Title="Open up port for one IP" Tags="|cisco|access-control|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23834" PostTypeId="2" ParentId="23828" CreationDate="2015-10-28T21:57:08.223" Score="3" Body="&lt;p&gt;Two different philosophies are commonly applied (IME), leading to two different approaches (well, 3 if we include the not-very-philosophical &quot;random mess&quot;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The higher-paranoia approach is to restrict all VLANs only to the places they are needed, and to place all unused ports into a VLAN that goes nowhere. If you later add VoIP phones to a particular switch that does not have them now, you will add the VoIP VLAN to that trunk link at the time, not before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lower paranoia approach would be to put all VLANs on all trunks, and only apply them to device ports as needed. This is often (but need not be) combined with leaving open ports on some useful network rather than a &quot;dead&quot; VLAN so that plugging things in does not require a management change every time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is appropriate depends on the use of the network(s), the exposure of switches to unauthorized persons, and to some extent which philosophy is dominant in your local/company culture.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-10-28T21:57:08.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23835" PostTypeId="2" ParentId="23833" CreationDate="2015-10-28T22:11:25.920" Score="2" Body="&lt;p&gt;If you have port forwarding set up correctly, you don't want to restrict this on the WAN port since the incoming packet will not have the private address as the destination address in the incoming packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port forwarding will allow publicly addressed packets toward a particular private address. The ACL could then include only the source address and RDP port in to restrict the source device, but the port forwarding will take care of only forwarding it to the configured private IP address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-28T22:11:25.920" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23836" PostTypeId="1" AcceptedAnswerId="23841" CreationDate="2015-10-28T22:58:12.893" Score="2" ViewCount="2001" Body="&lt;p&gt;My question is not a duplicate &quot;The slash after an IP Address - CIDR Notation&quot; because the answers to this question say that CIDR is our SUBNET MASK. And My question is &lt;strong&gt;&quot;If CIDR is our subnet mask - why am I provided with second subnet mask?&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am given bunch of IP/CIDR and subnet masks and I am asked to calculate  # of subnets and hosts per subnet.&#xA;For example&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP address ---- Subnet mask ----- Number of subnets ----- Number of  hosts per subnet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;128/8 ---------255.255.255.128 ------------------ ? -------------------------------- ? ---------------&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am confused about is what does it mean to give subnet mask if we are given CIDR. I though CIDR is exactly subnet mask but represented with different notation.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;From wiki: 192.168.100.14/24 represents the IPv4 address 192.168.100.14 and its associated routing prefix 192.168.100.0, or equivalently, its subnet mask 255.255.255.0, which has 24 leading 1-bits.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I though if I have 128/8 then I have 255.0.0.0 as a subnet mask. But then I am given another subnet mask. How should I treat this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="19793" LastEditorUserId="19793" LastEditDate="2015-10-28T23:37:11.797" LastActivityDate="2015-10-29T01:26:01.733" Title="Given IP/CIDR and subnet mask - calculate # of subnets and # of hosts per subnet" Tags="|ipv4|" AnswerCount="1" CommentCount="4" ClosedDate="2015-10-29T06:57:22.890" ContentLicense="CC BY-SA 3.0" />
  <row Id="23839" PostTypeId="1" AcceptedAnswerId="23840" CreationDate="2015-10-29T00:39:54.443" Score="3" ViewCount="223" Body="&lt;p&gt;Assume the Internet speed is 10 MBps, NIC is GigabitEthernet, PCI bus connecting to RAM is 133 MBps, disk IO is 70 MBps, and this server simply accepts files and stores them to disk and then returns when requested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct to understand that a 1000 MB file will take 100 seconds to upload and download from the server since the slowest piece is the 10 MBps internet link?&lt;/p&gt;&#xA;" OwnerUserId="4339" LastEditorUserId="8499" LastEditDate="2018-03-09T01:20:28.687" LastActivityDate="2018-03-09T01:20:28.687" Title="Bandwidth is mimimum of the path?" Tags="|bandwidth|throughput|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23840" PostTypeId="2" ParentId="23839" CreationDate="2015-10-29T00:51:49.620" Score="4" Body="&lt;p&gt;The slowest link in a path will dictate the transfer speed, but a raw bitrate is only one part of it. You also need to consider the packet size and protocol overhead. The smaller the packets, the more packets are transferred, the more protocol overhead eats up bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-29T00:51:49.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23841" PostTypeId="2" ParentId="23836" CreationDate="2015-10-29T01:26:01.733" Score="2" Body="&lt;p&gt;The question is asking you to take the large network (with the slash notation) and divide it up into smaller subnets, each one using the given subnet mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you have a network 128/8 (or more correctly, 128.0.0.0/8), and you want to subdivide it into smaller subnets using the mask 255.255.255.128, how many subnets can you make?  And how many hosts are in each of those subnets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this problem could be asked using all slash notation, or all dotted decimal.  The problem uses both just to make sure you are proficient with both.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-29T01:26:01.733" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="23843" PostTypeId="2" ParentId="11364" CreationDate="2015-10-29T02:37:41.510" Score="1" Body="&lt;p&gt;It's possible to recover the security, admin and app passwords on a CUCM (or other UCOS host) as opposed to resetting them.  If running on VMWare, take a snapshot just in case.  Boot the UCOS host using a Linux rescue CD and extract this file...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/usr/local/platform/conf/platformConfig.xml &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and copy to your server. An alternative that doesn't involve downtime is to issue the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;utils create report platform&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then follow the instructions to upload to an SFTP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then use the UCOS Password Decrypter app to open the file.  It will show you the decrypted passwords.  You can download it here...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.adhdtech.com/uctools.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.adhdtech.com/uctools.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way you don't go through the headache of resetting the cluster security password on your pub &amp;amp; subs.  To perform the actual copy of the XML file to a Windows host, I boot the UCOS host with a CentOS Live ISO, configure a temp static IP then start the SSHD service.  From there I use WinSCP on my Windows box to connect to the CentOS live session and extract the file.&lt;/p&gt;&#xA;" OwnerUserId="20108" LastEditorUserId="-1" LastEditDate="2017-11-03T09:09:58.547" LastActivityDate="2017-11-03T09:09:58.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23845" PostTypeId="2" ParentId="23839" CreationDate="2015-10-29T03:12:04.993" Score="2" Body="&lt;p&gt;In addition to Ron mentioned, it also depends on upstream/downstream bandwidth of the Server where you are trying dowload from or upload to..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Common BW notation would be Mbps.&lt;/p&gt;&#xA;" OwnerUserId="19631" LastEditorUserId="19631" LastEditDate="2015-10-29T03:22:25.607" LastActivityDate="2015-10-29T03:22:25.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23846" PostTypeId="1" AcceptedAnswerId="23848" CreationDate="2015-10-29T03:45:39.120" Score="2" ViewCount="883" Body="&lt;p&gt;I'm trying to recreate a theoretical situation in packet tracer with 3 areas with the protocol OSPF for some reason there's no communication between the devices, even when the ospf hop can see the other devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 192.168.0.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 10.0.0.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 1&#xA; router-id 1.1.1.1&#xA; log-adjacency-changes&#xA; network 192.168.0.0 0.0.0.255 area 1&#xA; network 10.0.0.0 0.0.0.3 area 1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 11.0.0.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 10.0.0.2 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 1&#xA; router-id 2.2.2.2&#xA; log-adjacency-changes&#xA; area 2 virtual-link 3.3.3.3&#xA; network 10.0.0.0 0.0.0.3 area 1&#xA; network 11.0.0.0 0.0.0.3 area 2&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 11.0.0.2 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 12.0.0.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 1&#xA; router-id 3.3.3.3&#xA; log-adjacency-changes&#xA; area 2 virtual-link 2.2.2.2&#xA; network 11.0.0.0 0.0.0.255 area 2&#xA; network 12.0.0.0 0.0.0.3 area 3&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R4&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 192.168.1.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 12.0.0.2 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 1&#xA; router-id 4.4.4.4&#xA; log-adjacency-changes&#xA; network 12.0.0.0 0.0.0.3 area 3&#xA; network 192.168.1.0 0.0.0.255 area 3&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/N9EAo.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/N9EAo.jpg&quot; alt=&quot;Network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20109" LastEditorUserId="8499" LastEditDate="2018-12-22T04:46:36.177" LastActivityDate="2018-12-22T04:46:36.177" Title="OSPF with multi-areas" Tags="|cisco|routing|router|ospf|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23847" PostTypeId="1" AcceptedAnswerId="23849" CreationDate="2015-10-29T03:51:10.290" Score="3" ViewCount="228" Body="&lt;p&gt;I work for a global company in the client support department. Another department manages the network. My team is frequently asked to throttle client traffic from our on-premises Apple software update servers (Apache) and Casper distribution points (IIS) because it's not possible to do so from network management. We run into a problem where one client can completely saturate a remote network link while downloading a patch or software package. This disrupts critical services like VoIP and intranet access. I know we have Cisco and Juniper hardware, and the link in question is around 30 Mbps. I'm sorry for not having specifics, but getting details is difficult to get from our networking team... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get the feeling the network team is trying to pass the buck to my team... However, my team's network skills are marginal since our focus is client support. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it really the case network traffic can't be regulated from the router/switch level?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice will help.&lt;/p&gt;&#xA;" OwnerUserId="170" LastEditorUserId="8499" LastEditDate="2018-12-20T21:24:49.883" LastActivityDate="2018-12-20T21:24:49.883" Title="Throttle traffic over a link?" Tags="|cisco|juniper|qos|bandwidth|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23848" PostTypeId="2" ParentId="23846" CreationDate="2015-10-29T03:51:51.207" Score="2" Body="&lt;p&gt;Areas 1 and 3 can't directly communicate with Area 2. OSPF areas can only connect to to Area 0. If you change Area 2 to Area 0, things should work much better. Also, you can't have discontiguous Area 0s.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-29T03:51:51.207" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="23849" PostTypeId="2" ParentId="23847" CreationDate="2015-10-29T03:58:25.173" Score="3" Body="&lt;p&gt;This is a case for QoS. Traffic like VoIP should have priority queues, and bulk traffic like you describe should be marked down to give other traffic priority. QoS is all about fairness (as you define it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can set the various queues to allow the bulk traffic to use all the bandwidth when noting else is using it, but, when higher priority traffic comes in, the higher priority traffic will take the bandwidth it needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both Cisco and Juniper have robust QoS capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;QoS is a very large topic that can't be properly discussed here, so you need to do some research.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, you can't control incoming traffic, so someone sending from the outside can saturate the incoming link. This is called a Denial of Service (DoS) attack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, questions from end-users of corporate networks are specifically off-topic because you need to deal with your network administration to make anything happen.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-29T03:58:25.173" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23850" PostTypeId="1" CreationDate="2015-10-29T05:09:33.643" Score="1" ViewCount="988" Body="&lt;p&gt;I have two interfaces on my linux machine, lets say eth0 and eth1. eth0 is a public IP that has IPv6 address and eth1 has a private IPv4 address. If I try to nat the packets that received on eth1 interface onto IPv6 address, NAT module in the linux kernel needs to take care of converting IPv4 packet to IPv6 packet before sending out. Once a response is received from other end, it will convert the IPv6 packet back to IPv4 before giving to eth1 interface. I want to understand this conversion mechanism. &#xA;example: You have a mobile with LTE mobile data connection and you want to share internet to others by creating a hotspot in mobile.  Now a days, most of LTE providers are giving IPv6 address. Mobiles connected to hotspot will get IPv4 address. But, Mobiles connected hotspot are able to browse internet. All the requests from clients of mobile hotspot are IPv4 packets and the responses received by LTE from internet are IPv6 packets. That means, there is some conversion happening from ipv4 to ipv6 and vice versa in mobile linux stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If somebody can point me to linux code or explain the transitions required for this, it would be great. Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="20110" LastEditorUserId="20110" LastEditDate="2015-10-29T09:49:13.107" LastActivityDate="2015-10-29T09:49:13.107" Title="NAT translation of a packet on interface with IPv4 address to interface with IPv6 address and vice versa" Tags="|ipv4|nat|ipv6|linux|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23852" PostTypeId="2" ParentId="23850" CreationDate="2015-10-29T05:34:00.490" Score="-3" Body="&lt;p&gt;IPv4 and IPv6 &lt;strong&gt;&lt;em&gt;are not the same thing&lt;/em&gt;&lt;/strong&gt;. You cannot &lt;em&gt;NAT&lt;/em&gt; between them. There is no amount of &quot;address rewriting&quot; that can convert between them. Can you rewrite the address of an IPX packet to make it Appletalk? NO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are extensive products to &lt;em&gt;PROXY&lt;/em&gt; between the two systems, but they are almost exclusively protocol dependent. (because protocols have a nasty habit of carrying address information within them.) v4 talks to v4; v6 talks to v6. THAT'S IT.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-29T05:34:00.490" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23853" PostTypeId="2" ParentId="23850" CreationDate="2015-10-29T07:41:28.260" Score="2" Body="&lt;p&gt;Doing NAT from IPv6 to IPv4 is possible because you can embed the IPv4 address inside the IPv6 address. This is usually done with DNS64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing NAT from IPv4 to IPv6 is much harder because you can't embed an IPv6 address inside an IPv4 address. That doesn't fit. Matt is still possible, but you'd have to statically configure mappings between IPv4 and IPv6 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know if the Linux kernel can do that, but it's a bad idea anyway. Because of the different header lengths you'll run into issues with fragmentation and MTU sizes. Using a proxy would be a much better idea.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-10-29T07:41:28.260" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="23854" PostTypeId="1" AcceptedAnswerId="23859" CreationDate="2015-10-29T10:57:47.383" Score="5" ViewCount="2176" Body="&lt;p&gt;I was reading the &lt;a href=&quot;http://computer.howstuffworks.com/ethernet12.htm&quot; rel=&quot;noreferrer&quot;&gt;HowStuffWorks article&lt;/a&gt; on ethernet. From the article, I understand that bridges are just like repeaters, but with the added benefit of not cluttering up other collision domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I understand that we can use a bridge wherever we can use a repeater. My questions is, if that's the case, why do repeaters still exist?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it have to do with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Bridges cost more than repeaters?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Bridges introduce a higher overhead?&lt;/p&gt;&#xA;" OwnerUserId="19156" LastActivityDate="2016-03-30T04:41:36.270" Title="Why do we need repeaters since there are bridges (or switches)?" Tags="|ethernet|bridge|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23855" PostTypeId="1" CreationDate="2015-10-29T11:18:38.187" Score="2" ViewCount="163" Body="&lt;p&gt;I have set up VPN server (PPTP) on Windows Server 2012, I connect as a client from a Windows 7 PC and after roughly 23 minutes the connection drops, redials and connects fine.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There are no connection limits on the server side.&lt;/li&gt;&#xA;&lt;li&gt;I have tried with dynamic dns and directly with the public IP, the result is the same.&lt;/li&gt;&#xA;&lt;li&gt;I login to the VPN with local account.&lt;/li&gt;&#xA;&lt;li&gt;Windows firewall is disabled on client side, Kaspersky Internet Security is installed&lt;/li&gt;&#xA;&lt;li&gt;Connection also drops from other PC's in the same network, though I have not tested connecting from another place that uses different router (maybe its the router)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20034" LastActivityDate="2015-11-28T14:03:14.393" Title="VPN connection drops after ~23 minutes" Tags="|vpn|" AnswerCount="1" CommentCount="1" ClosedDate="2015-11-29T16:21:59.807" ContentLicense="CC BY-SA 3.0" />
  <row Id="23857" PostTypeId="2" ParentId="23854" CreationDate="2015-10-29T12:42:58.590" Score="2" Body="&lt;p&gt;Repeaters works on Layer 1 of OSI model and Bridges works on Layer 2. The main thing that repeaters does is to REPEAT the signal from one side to other, it no taken on mind destination or something else, it just repeat the signal to the other ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, bridges conmunicate 2 networks from different topologies. This one also works matching the destination MAC address, to send or not, the transmition to that network segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bridges are more like a switch, a small switch, a 2 port switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I´m not have any price, but i think bridges DO NOT cost more that repeaters, the contrary, because, with the repeaters you can connect a lot of equipments, it have about 8, 16 ports, and bridges only have 2 interfaces, on the way to EXTEND and separate a collision domain into 2.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-29T12:42:58.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23858" PostTypeId="2" ParentId="23855" CreationDate="2015-10-29T12:45:00.460" Score="0" Body="&lt;p&gt;Seems a SA Lifetime issue, look in your events for Event 542 , Event 543  as per &lt;a href=&quot;https://technet.microsoft.com/it-it/library/cc302672.aspx&quot; rel=&quot;nofollow&quot;&gt;https://technet.microsoft.com/it-it/library/cc302672.aspx&lt;/a&gt;  &lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2015-10-29T12:45:00.460" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23859" PostTypeId="2" ParentId="23854" CreationDate="2015-10-29T12:55:50.153" Score="8" Body="&lt;p&gt;I would argue that repeaters hardly do exist today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A repeater amplifies the electric signal but is a completely analogue device and does not in any way interpret the signal. A repeater is the same thing as a 2-port hub although I've seen some companies starting to use the term repeater for equipment that resembles a switch more than a hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Contrast this with a switch that receives a frame, interprets it and extracts the destination MAC address which it then acts upon to forward the frame to it's correct destination. A bridge is the same thing as a 2-port switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to the low cost of switches and their support for higher speeds, the market for hubs/repeaters is slim to none.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-29T12:55:50.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23861" PostTypeId="1" AcceptedAnswerId="23898" CreationDate="2015-10-29T13:12:53.013" Score="2" ViewCount="361" Body="&lt;p&gt;Scenario:&#xA;I am passing traffic across multiple VLANs between a Cisco and a Juniper device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Cisco device, when I do a &lt;code&gt;sh int ge-x/x/x.xx&lt;/code&gt;, it gives the input/output rate on this VLAN (and gives rates on other VLANs, too). When I do the same on a Juniper device, the VLAN does not show the rate, only the parent interface shows the overall rate passing through the physical interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: On a Juniper device, how do I see the I/O rate per VLAN ?&lt;/p&gt;&#xA;" OwnerUserId="13422" LastEditorUserId="8499" LastEditDate="2015-10-29T14:08:07.950" LastActivityDate="2015-10-30T05:45:07.140" Title="Input/Output rate for VLANs on Juniper devices" Tags="|cisco|juniper|juniper-junos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23862" PostTypeId="2" ParentId="23854" CreationDate="2015-10-29T13:50:35.243" Score="1" Body="&lt;p&gt;to be aware of the whole image &lt;strong&gt;&lt;em&gt;this topic is technical speaking about logical items accomplish certain tasks&lt;/em&gt;&lt;/strong&gt; not existed devices  , where bridge is the device which has two ports , those two ports will share the same &lt;strong&gt;&lt;em&gt;collision domain&lt;/em&gt;&lt;/strong&gt; and the repeaters are the devices which detect certain signal &lt;strong&gt;&lt;em&gt;(which suffered from some degradation)&lt;/em&gt;&lt;/strong&gt; and amplify it and send it again . now a days the existing device are the &lt;strong&gt;&lt;em&gt;switches&lt;/em&gt;&lt;/strong&gt; which is multi port bridge &lt;strong&gt;&lt;em&gt;(share the same broadcast domain on the base of VLANs)&lt;/em&gt;&lt;/strong&gt; and when you read any configuration guide of any product some time you can see its describe the switch as abridge .repeaters are existing only on the wireless setup &lt;strong&gt;&lt;em&gt;(actually it is Access point configured as repeater)&lt;/em&gt;&lt;/strong&gt; where it can spread the coverage on a far location than which the access point is setup.   &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-10-29T13:50:35.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23864" PostTypeId="2" ParentId="23854" CreationDate="2015-10-29T14:12:25.773" Score="4" Body="&lt;p&gt;In general, repeaters are no longer needed or used in modern networking. This section of the article dedicated to repeaters is largely there to provide historical background, and a big hint that this is the case is that it also mentions thicknet (a long defunct network technology).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeaters operate on L1 of the OSI model and simply &quot;regenerate&quot; the signal allowing it to cover a longer distance than it would otherwise. Being a relatively simple device, they were considerably cheaper at the time than bridges. They were quite common at one point and as such there were even rules for their deployment (reference the &lt;a href=&quot;https://en.wikipedia.org/wiki/5-4-3_rule&quot; rel=&quot;nofollow&quot;&gt;5-4-3 Rule&lt;/a&gt; if interested).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today repeaters are limited to a couple of roles. First, carriers/ISPs will sometimes use repeaters when they are covering very long distances or using a technology that will benefit from strong signal strengths (for example xDSL).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, and more commonly known to general users, are repeaters that are sold to extend the coverage of consumer 802.11 wireless. Some of these truly are repeaters, while some are more advanced than simple signal repeaters.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-10-29T14:12:25.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23865" PostTypeId="2" ParentId="23822" CreationDate="2015-10-29T14:29:40.203" Score="3" Body="&lt;p&gt;I think you are looking for the --retain argument, which allows you to retain routes in the kernel across restarts of the daemons.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-10-29T14:29:40.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23866" PostTypeId="1" CreationDate="2015-10-29T14:32:53.513" Score="3" ViewCount="5523" Body="&lt;p&gt;I have a Cisco C3750V2 switch in which a particular interface is continuously flapping almost i could find 15,000 events from the device logs in last 24 hours. Is there a way to find the end device connected to this particular interface??&lt;/p&gt;&#xA;" OwnerUserId="20120" LastActivityDate="2016-04-05T18:40:03.390" Title="How to find the End device connected to a particular interface?" Tags="|cisco|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23868" PostTypeId="1" AcceptedAnswerId="23883" CreationDate="2015-10-29T15:18:00.727" Score="4" ViewCount="2810" Body="&lt;p&gt;I have to do the following configuration on an cisco Sg-300 small business L3 switch as in the figure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FVVhm.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FVVhm.jpg&quot; alt=&quot;network dig&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since i don’t have access to this switche for practice before doing this live in production i need to clear some doubts in my head. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is my plan, i would really appreciate if you could check it to see if im headed right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.Configure vlan 2 and 3 interface with .1 ips as per the subnet, assign ports and configure the clients to use them as the gateway.&#xA;question: Does tagged port simply mean an access port on just a single vlan and a port tagged on many different vlans means a trunk port? what does an untagged port mean then?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.Add a static route on the switch as 0.0.0.0/0 with 192.168.1.1 0.0.0.255 as next hop which is the firewall.  Does the L3 switch allow its interfaces to be assigned an ip address? On packet tracert I had to do &quot;no switchport&quot; before i could assign an ip to an interface on the L3 switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.Add reverse routes on the firewall for both the vlan subnets with 192.168.1.2 as the next hop for the internet to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.Configure firewall policies to allow traffic from 192.168.2.0 and 3.0 subnets to the internet. &lt;strong&gt;Does the switch to firewall /30 link need trunk ports?&lt;/strong&gt; as that is going to on vlan1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this stage the internet should get started on both vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My next phase of config is to block the entire vlan 3 from accessing one particular host on vlan2. And then allow only certain hosts on vlan2(printers) to be accessible from vlan3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is proving to be confusing, i could really use some help here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the plan is to use static IPs for now, but if we decide to go with dhcp I would be configuring the switch itself as the dhcp server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware of creating the dhcp pools, how do i assign them to the vlans though? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do we use the ip helper cmd in this case?&#xA;eg:&#xA;pools:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool vlan2&#xA;network 192.168.2.0 255.255.255.0&#xA;default-router 192.168.2.1&#xA;dns-server 4.2.2.2&#xA;&#xA;ip dhcp pool vlan3&#xA;network 192.168.3.0 255.255.255.0&#xA;default-router 192.168.3.1&#xA;dns-server 8.8.8.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then for the binding to vlan2 : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan2&#xA;ip address 192.168.2.1 255.255.255.0&#xA;ip helper-address 192.168.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also if i am to add a access point in either of the vlans, the AP would to the vlan port on the switch and does it need to have vlan tagging enabled as well? &lt;/p&gt;&#xA;" OwnerUserId="15569" LastEditorUserId="8499" LastEditDate="2018-03-21T00:59:18.467" LastActivityDate="2018-03-21T00:59:18.467" Title="Help with VLANs, ACLs, DHCP on SG-300 Layer 3 switch" Tags="|switch|vlan|acl|layer3|cisco-small-business|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23869" PostTypeId="1" CreationDate="2015-10-29T15:19:34.183" Score="1" ViewCount="10722" Body="&lt;p&gt;Wireshark shows that an IP address belongs to two different MAC addresses:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;wireshark&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I spoofed ARP, and I use VMware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I fix this? How is it possible that one IP address can belong to two different MAC addresses? Is it related to my use of VMware? Is something wrong in my ARP spoofing? How is that possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it normal when I open arp -a on the victim machine and it says that one IP address has two different MAC addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did arp spoofing on my router and another computer. My other computer is the victim. When I open cmd on the victim computer, and I run arp -a it says: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ll2mY.png&quot; alt=&quot;Screenshot of arp -a result&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is this possible? It happened after the ARP spoof.&lt;/p&gt;&#xA;" OwnerUserId="20123" LastEditorUserId="8499" LastEditDate="2018-03-19T17:48:23.123" LastActivityDate="2018-03-19T17:48:23.123" Title="Wireshark shows duplicate IP address detected" Tags="|mac-address|arp|ip-address|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="23870" PostTypeId="1" CreationDate="2015-10-29T15:55:00.013" Score="1" ViewCount="37" Body="&lt;p&gt;I'm not confident that this is the correct place to post this type of question but I haven't gotten many answers looking elsewhere, so apologies in advance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been tasked with setting up the security cameras (approx. 14) at a facility my employer owns. The cameras are all IP cameras that deliver RTMP streams. The desired functionality is to have a single computer for the security cameras that will both record videos and host a website accessible from our virtual network, which would have streams of all our security cameras. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would be a relatively straightforward task, except that the bandwidth of the plant is known to be limited. We simply couldn't have 14 streams outgoing. I doubt we could sustain more than 2 or 3 without serious hiccups. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current plan is to set up an NGINX server, have it take in all the streams, multiplex them into a single stream, and then host that on the website. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a better way to go about this? I'm really struggling with this and was hoping there would be an alternative possibility. &lt;/p&gt;&#xA;" OwnerUserId="20122" LastEditorUserId="8499" LastEditDate="2015-10-29T15:59:33.537" LastActivityDate="2015-10-29T16:09:18.527" Title="Streaming Website" Tags="|streaming|" AnswerCount="1" CommentCount="1" ClosedDate="2015-10-30T04:45:22.383" ContentLicense="CC BY-SA 3.0" />
  <row Id="23871" PostTypeId="2" ParentId="23869" CreationDate="2015-10-29T15:56:18.170" Score="2" Body="&lt;p&gt;This is the sort of thing that happens when you break a network by hacking it, and it is perfectly normal behavior. You can also get this result if you assign the same IP address to two different hosts, which is basically what you did when you spoofed ARP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an attack on the network; bad guys do this sort of thing to disrupt a network. Doing this sort of thing on a network belonging to someone else can get you in a lot of trouble. It's OK to do this on your own network if you want to see what happens, and you saw the results (not good).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-29T15:56:18.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23872" PostTypeId="2" ParentId="23870" CreationDate="2015-10-29T16:09:18.527" Score="1" Body="&lt;p&gt;A single multiplexed stream of 14 streams would still require the same bandwidth as the 14 separate streams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be possible to reduce the frame rate and/or other parameters of the camera. Panasonic had a good presentation showing a school hallway full of people, and demonstrated how a frame rate as low as 7.5 fps is still useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real solution is to size the bandwidth to meet the needs of the network. &lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-29T16:09:18.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23873" PostTypeId="1" CreationDate="2015-10-29T16:35:56.520" Score="1" ViewCount="323" Body="&lt;p&gt;I'm using VPLS to extend vlan x from site1 (Cisco C6500) to two remotes sites (Cisco C6500) site2 and site3 over MPLS. &#xA;The issue I'm facing is that a vlan with the same number already exists in the remote site3, so I'm using a different vlan number (say y) in the remote site3. How do I configure vlan mapping between site1 and site3 to map vlan y to x and vice versa?&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="20125" LastActivityDate="2024-01-05T09:06:55.877" Title="How to configure vlan mapping with VPLS on Cisco 6500 routers?" Tags="|vlan|cisco-catalyst|vpls|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23874" PostTypeId="2" ParentId="23866" CreationDate="2015-10-29T16:37:52.363" Score="1" Body="&lt;p&gt;First you need to check which is the interface that isn presenting the flapping event.&#xA;Then you can write:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sho mac address-table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To see de mac address table and find the mac address learned by the flapping interface in particular.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, you can visit here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;www.macvendorlookup.com/ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or something else, to make a lookup for the vendor of that specific mac address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you will find de device, i hope so&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-10-29T16:37:52.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23876" PostTypeId="1" AcceptedAnswerId="23878" CreationDate="2015-10-29T17:19:09.387" Score="2" ViewCount="2625" Body="&lt;p&gt;ok so i have this port configure as an access port for vlan 10. I connected a cisco wireless access WAP321 configure to send untagged traffic to expand this vlan for wireless access. I have two of these in the same /24 network with different SSID. however when I plug it into the switch it triggers BPDU guard and shuts the port down. this only happens with one access point the other didnt give me this issue.below the configuration for both interfaces. should the access point send bpdu??&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gigabitethernet1/38&#xA; spanning-tree portfast&#xA; spanning-tree bpduguard enable&#xA; switchport mode access&#xA; switchport access vlan 10&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19478" LastEditorUserId="8499" LastEditDate="2018-03-09T00:34:29.793" LastActivityDate="2018-03-09T00:34:29.793" Title="Access point triggering BPDU guard on sg500" Tags="|cisco|switch|wireless|network-access|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23877" PostTypeId="1" AcceptedAnswerId="23903" CreationDate="2015-10-29T17:30:02.793" Score="1" ViewCount="2181" Body="&lt;p&gt;I tried many times to make my router work in the configuration I want, but no matter what I do, it won't work.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP router: IP address 192.168.99.1 all ports forwarded to 192.168.99.2 &#xA;connected to a Cisco Small Business RV 325 configured with the 192.168.99.2 IP address on WAN port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set some VLANs on the RV 325 :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 1 =&gt; default, gateway 192.168.99.254 No DHCP&lt;/li&gt;&#xA;&lt;li&gt;VLAN 10 =&gt; for workstations IP 192.168.1.1/24 GW 192.168.1.1 DHCP Enabled&lt;/li&gt;&#xA;&lt;li&gt;VLAN 20 =&gt; for VOIP IP 192.168.2.1/24 GW 192.168.2.1 No DHCP&lt;/li&gt;&#xA;&lt;li&gt;VLAN 30 =&gt; for IP cameras IP 192.168.3.1/24 GW 192.168.3.1 No DHCP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;By default the VLAN option is not enabled. I can access to the internet, but I don't have the benefit of the VLANs.&#xA;When I enable it, I can't get access to the internet anymore...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the time, I get an error referring to DNS error so I suspected a missing firewall rule. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I've tried multiple firewall rules (even ANY to ANY), but I never succeeded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do to make this router work with VLANs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/assets/sol/sb/RV325_Emulators/RV325_Emulator_v1-1-0-09/default.htm&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; is the interface I have to setup for the router&lt;/p&gt;&#xA;" OwnerUserId="20126" LastEditorUserId="20126" LastEditDate="2015-10-29T18:34:38.193" LastActivityDate="2015-10-30T12:17:27.463" Title="Cisco Small Business RV 325 - Loose internet when VLAN enabled" Tags="|cisco|routing|vlan|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="23878" PostTypeId="2" ParentId="23876" CreationDate="2015-10-29T17:35:11.320" Score="0" Body="&lt;p&gt;It has to do the the WAP configuration. I was just discussing something similar here at work. A Cisco WAP can actually convert an access port into a trunk without changing the visible switch configuration; apparently, it negotiates this via CDP. You have something in, or missing from, the WAP configuration which causes it to send BPDUs, but you didn't include the WAP configuration in your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Side note:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rather than placing &lt;code&gt;portfast&lt;/code&gt; and &lt;code&gt;bpduguard&lt;/code&gt; on the individual switch ports, you can globally enable them as port defaults. When you do this, it only affects access ports unless you also add the &lt;code&gt;trunk&lt;/code&gt; option to the command. We do this to save configuration steps.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-29T17:35:11.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23879" PostTypeId="2" ParentId="23876" CreationDate="2015-10-29T17:55:21.363" Score="1" Body="&lt;p&gt;Somehow STP got enabled on those two, which is strange because it's disabled by default... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To resolve, whether you configured this or not do one of these: Disable spanning-tree on the bridge group ( bridge-group # spanning-disable), turn off BPDUGuard on these ports, also since technically an AP is a switch or make sure the 'bridge protocol ieee' isn't on the bridge group of the 2 as well. &lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2015-10-29T17:55:21.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23881" PostTypeId="1" AcceptedAnswerId="23910" CreationDate="2015-10-29T19:56:14.397" Score="1" ViewCount="979" Body="&lt;p&gt;I am a beginner,&lt;/p&gt;&#xA;&lt;p&gt;I want to Block a Specific Website in cyberoam&#xA;I have followed this tutorial : &lt;a href=&quot;http://kb.cyberoam.com/default.asp?id=2395&quot; rel=&quot;nofollow noreferrer&quot;&gt;Block a Specific Website&lt;/a&gt;&#xA;to block a Specific Website in cyberoam.&#xA;the first URL has been blocked successfully, but when I tried to block another website with the same method did not work.&#xA;I don't know where is my mistake&#xA;Thanks by advance&lt;/p&gt;&#xA;" OwnerUserId="20129" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-10-30T14:31:42.877" Title="Cyberoam : Issue Web Filter Policy" Tags="|security|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23882" PostTypeId="2" ParentId="23866" CreationDate="2015-10-29T20:04:02.653" Score="0" Body="&lt;p&gt;Remotely? That's hard to say. As Orlando suggests, the MAC could point you in that direction (nic manufacturer.) If the device and switch are setup for LLDP, that may give you a better picture. Setting up a SPAN to watch any traffic on that port may be enlightening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, you go to the end of the cable connected to that port and &lt;em&gt;see what's there&lt;/em&gt;. However, that requires you to be on-site and the device causing the problems being there when you arrive.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-29T20:04:02.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23883" PostTypeId="2" ParentId="23868" CreationDate="2015-10-29T20:05:07.217" Score="3" Body="&lt;p&gt;You do not need the ip helper-address statement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand your requirement, you only want to allow printers on vl 2 to be accessed from vl 3.  Nothing else on vl 2 can be accessed from vl 3.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended vlan3-in&#xA; remark allow printers.  Repeat this line for each printer&#xA; permit ip any host &amp;lt;printer address&amp;gt;&#xA; remark alternatively, you can only allow the printer port on the VLAN, for ex.&#xA; permit tcp any 192.168.2.0 0.0.0.255 eq 9100&#xA; remark block the rest of vlan 2&#xA; deny ip any 192.168.2.0 0.0.0.255&#xA; remark permit Internet&#xA; permit ip any any&#xA;&#xA;interface vlan 3&#xA;service-acl input vlan3-in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If your AP can offer multiple SSIDs, then you can have one SSID for each VLAN.  You tag the VLANs and set the switchport to trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your AP can't offer multiple SSIDs, then make the switch port an access port and don't tag the vlan.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-10-30T11:44:44.943" LastActivityDate="2015-10-30T11:44:44.943" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="23886" PostTypeId="2" ParentId="23869" CreationDate="2015-10-29T22:01:39.240" Score="3" Body="&lt;p&gt;ARP spoofing is just the thing that is doing the multiple MAC's for one IP. :)&#xA;So if you want to avoid duplicate adresses... stop ARP spoofing (poisoning) your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to understand this, read the following page:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.arppoisoning.com/how-does-arp-poisoning-work/&quot; rel=&quot;nofollow&quot;&gt;http://www.arppoisoning.com/how-does-arp-poisoning-work/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2015-10-29T22:01:39.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23887" PostTypeId="1" AcceptedAnswerId="23888" CreationDate="2015-10-29T22:05:02.453" Score="2" ViewCount="974" Body="&lt;p&gt;I'm thinking of using &lt;code&gt;169.254.0.0/16&lt;/code&gt; (link-local) addresses on OSPF transit links for increased security together with prefix-supression. This way the links are not reachable from any other non directly connected subnet. Do you see any problems with this? &lt;/p&gt;&#xA;" OwnerDisplayName="user20131" LastEditorUserId="8499" LastEditDate="2018-03-11T01:59:50.443" LastActivityDate="2018-03-11T01:59:50.443" Title="Using 169.254.0.0/16 addresses on transit links?" Tags="|ipv4|ip|ospf|ip-address|ip-link-local|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23888" PostTypeId="2" ParentId="23887" CreationDate="2015-10-29T22:40:11.127" Score="1" Body="&lt;p&gt;This network is designed for local links. You will need to take steps to make sure that OSPF doesn't include these addresses in what it advertises to other routers.&lt;/p&gt;&#xA;&lt;p&gt;Also, &amp;quot;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3927#section-2.8&quot; rel=&quot;nofollow noreferrer&quot;&gt;The 169.254/16 address prefix MUST NOT be subnetted&lt;/a&gt;&amp;quot;. This means that only one interface in this range per router since the router will complain that this network is already in use when you try to add it to another interface.&lt;/p&gt;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3927#section-2.7&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3927, Dynamic Configuration of IPv4 Link-Local Addresses&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-10-29T22:40:11.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23889" PostTypeId="2" ParentId="22445" CreationDate="2015-10-29T23:54:29.287" Score="3" Body="&lt;p&gt;Guy's answer is spot on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just an FYI, if you're interested in reading more about MSS and MTU, I've written a couple of blog posts on the subject - &lt;a href=&quot;http://www.oznetnerd.com/2012/02/17/mtu-vs-mss-part-one/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.oznetnerd.com/2012/02/17/mtu-vs-mss-part-one/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back onto the subject of the Window size - the calculation is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Window Size * Window Size Scaling Factor = Real Window Size aka Calculated Window Size&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using the formula above in conjunction with the screenshot below, we've got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3650 * 8 = 29,200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/f07yZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f07yZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-10-29T23:54:29.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23890" PostTypeId="1" CreationDate="2015-10-30T00:03:15.707" Score="1" ViewCount="506" Body="&lt;p&gt;I have a task on which I have spent a lot of time. I am not fluent in Linux, but I can manage basic things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The task is to gather different types of ICMP packets. I can harvest them by &lt;code&gt;tcpdump&lt;/code&gt; (which I prefer) or Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able get the ICMP types of &lt;code&gt;echo reply&lt;/code&gt; and &lt;code&gt;echo request&lt;/code&gt; using &lt;code&gt;ping&lt;/code&gt;, and &lt;code&gt;time exceeded&lt;/code&gt; using &lt;code&gt;tracepath&lt;/code&gt; or &lt;code&gt;traceroute&lt;/code&gt;. Now, what I am trying to get is &lt;code&gt;unreachable&lt;/code&gt; or &lt;code&gt;timestamp&lt;/code&gt; or something else. I need two more types, however I don't know a way to produce.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried pinging a nonexistent host or wrong port, and using &lt;code&gt;tracepath&lt;/code&gt; the same way, but I am not getting anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone advise me or tell me what commands I can use, and in which way, to obtain two more types of ICMP packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit (answer to comment):&#xA;I guess there are no matter which ones. I must to catch some types and describe them. May be from the same category as reply, request and time exceeded, but should be different ones.&lt;/p&gt;&#xA;" OwnerUserId="20134" LastEditorUserId="20135" LastEditDate="2015-11-02T20:54:17.940" LastActivityDate="2015-11-02T20:54:17.940" Title="Different types of ICMP" Tags="|wireshark|packet-analysis|icmp|tcpdump|" AnswerCount="1" CommentCount="3" ClosedDate="2015-10-30T02:08:04.473" ContentLicense="CC BY-SA 3.0" />
  <row Id="23891" PostTypeId="2" ParentId="23890" CreationDate="2015-10-30T00:53:28.377" Score="1" Body="&lt;p&gt;I suppose the point of this task was for you to figure out how to generate and capture different types of ICMP messages. Without directly giving you the answers, I will point you in the direction of how to figure it out.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc792&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 792&lt;/a&gt; describes ICMP messages. There are different possible sources for ICMP messages:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Code&lt;/p&gt;&#xA;&lt;p&gt;0 = net unreachable;&lt;/p&gt;&#xA;&lt;p&gt;1 = host unreachable;&lt;/p&gt;&#xA;&lt;p&gt;2 = protocol unreachable;&lt;/p&gt;&#xA;&lt;p&gt;3 = port unreachable;&lt;/p&gt;&#xA;&lt;p&gt;4 = fragmentation needed and DF set;&lt;/p&gt;&#xA;&lt;p&gt;5 = source route failed.&lt;/p&gt;&#xA;&lt;p&gt;Codes 0, 1, 4, and 5 may be received from a gateway.  Codes 2 and&#xA;3 may be received from a host.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You say want &lt;code&gt;unreachable&lt;/code&gt; messages. Code 0 seems to be a good target, and it comes from a gateway (router), How do you suppose you can get a router to generate one of those codes? Remember that this is something that a router must be able to know.&lt;/p&gt;&#xA;&lt;p&gt;This is the sort of thing which you should be looking for when figuring out how to generate and capture the messages.&lt;/p&gt;&#xA;&lt;p&gt;The RFCs are good sources to understand the protocol, and once you understand the protocol (apparently the point of this exercise), it becomes easier to figure out how to use it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-10-30T00:53:28.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23893" PostTypeId="1" CreationDate="2015-10-30T03:12:40.240" Score="1" ViewCount="252" Body="&lt;p&gt;I want to setup a configuration for a Juniper SRX-1100. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an office where I need 3 site to site VPNs to two Cisco ASAa and one to a Juniper SSG 5.  I also have work at home users who need to access the office servers via VPN.  I also need the work at home users to access the remote servers across the site to site VPN's.  The remote site to site networks are not under my control, they belong to our customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I do this?&lt;/p&gt;&#xA;" OwnerUserId="20137" LastEditorUserId="8499" LastEditDate="2015-10-30T03:55:47.123" LastActivityDate="2015-10-30T05:33:25.227" Title="Juniper SRX-1100 VPN configuration" Tags="|cisco-asa|firewall|juniper|srx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23894" PostTypeId="1" CreationDate="2015-10-30T03:46:52.557" Score="3" ViewCount="1289" Body="&lt;p&gt;I have a few Juniper EX3300 switches in my core. I'm seeing something strange where packets destined for device with the MAC address &lt;code&gt;00:90:0b:30:2d:f2&lt;/code&gt; are being flooded out all interfaces. However, an entry for this MAC address exists in the ethernet-switching table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas what could be causing this? According to the ethernet-switching table, the switch should know to forward these frames out &lt;code&gt;ge-0/0/33&lt;/code&gt; just fine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN: default, Tag: 1, MAC: 00:90:0b:30:2d:f2, Interface: ge-0/0/33.0&#xA;Type: Learn, Age: 0, Learned: 3w6d 22:04:44&#xA;Action: Forward&#xA;Nexthop index: 1326&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This began yesterday afternoon, and we have not recently made any changes to the network. I found this when checking out PRTG. I noticed that a bunch of devices which should not be passing any traffic were suddenly being flooded with ~100 Mbps of traffic.&lt;/p&gt;&#xA;" OwnerUserId="13689" LastEditorUserId="8499" LastEditDate="2016-03-28T15:49:49.103" LastActivityDate="2016-03-28T15:50:49.843" Title="Juniper EX Unicast Flooding" Tags="|juniper|mac-address|switching|layer2|" AnswerCount="0" CommentCount="6" ClosedDate="2019-12-19T09:04:29.353" ContentLicense="CC BY-SA 3.0" />
  <row Id="23895" PostTypeId="1" AcceptedAnswerId="23896" CreationDate="2015-10-30T05:08:38.647" Score="5" ViewCount="2836" Body="&lt;p&gt;I have some question regarding DNS root server.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Where is it located ? In USA ? In europe ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Which company spends money to maintain dns root server ? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What about fail-safety ? If root dns fails where is the backup server? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Approximately how many requests does it serve per second ? How does it not get overloaded with requests ? is it loadbalanced? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4339" LastActivityDate="2015-10-30T05:24:11.100" Title="Where is dns root server located?" Tags="|dns|" AnswerCount="1" CommentCount="1" ClosedDate="2015-10-30T17:41:59.277" ContentLicense="CC BY-SA 3.0" />
  <row Id="23896" PostTypeId="2" ParentId="23895" CreationDate="2015-10-30T05:24:11.100" Score="5" Body="&lt;p&gt;Most of the information can be found here:&#xA;&lt;a href=&quot;http://www.root-servers.org/&quot; rel=&quot;noreferrer&quot;&gt;http://www.root-servers.org/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There are several in different regions of the world, see link above for map&lt;/li&gt;&#xA;&lt;li&gt;There are 12 companies that operate them, they are funded by whatever their primary business is&lt;/li&gt;&#xA;&lt;li&gt;There are 13 root DNS servers, there is therefore redundancy&lt;/li&gt;&#xA;&lt;li&gt;The root servers aren't the ones that generally handle requests, they are primarily used for spreading DNS information so if I register XYZ.com and point is to my IP address, my provider will send it to the root server for it to be propagated. The root servers are surely load-balanced for the sheer volume of queries, I'm not sure on that exact number (approximate volume can be found here: &lt;a href=&quot;https://www.isoc.org/briefings/020/&quot; rel=&quot;noreferrer&quot;&gt;https://www.isoc.org/briefings/020/&lt;/a&gt;), that being said DNS is extremely light weight and connection-less (UDP), a high volume application provider like twitter or facebook has much more powerful systems behind it. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2015-10-30T05:24:11.100" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23897" PostTypeId="2" ParentId="23893" CreationDate="2015-10-30T05:33:25.227" Score="1" Body="&lt;p&gt;You'll configure and allow hairpin NAT on your SRX (&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB24639&amp;amp;actp=search&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB24639&amp;amp;actp=search&lt;/a&gt;), make sure to allow the traffic from the VPN zone to the other VPN zones for services that are needed. Depending on your setup you'll either add the customer network list to the protected networks for split tunneling on the clients, if it's not split you'll don't have to add anything client side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the site to site VPNs you and your customers will have to add your VPN subnet to their cryptomaps so the client VPN traffic will be encrypted and forwarded to the remote sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using a pulse appliance for the VPN the configuration could be more simple if you just NAT it out of the pulse box to an already trusted network, that way the traffic appears to the SRX as already coming from the inside and the client sites will already know of the network that it's coming from so no further configuration on their end would be needed.&lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2015-10-30T05:33:25.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23898" PostTypeId="2" ParentId="23861" CreationDate="2015-10-30T05:45:07.140" Score="2" Body="&lt;p&gt;Are you talking about layer 3 traffic for vlan interfaces that can be seen with 'show interfaces vlan.### extensive', if your trying to find it per vlan in total including layer 2 traffic that's not a capability of the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only ways to find the layer 2 traffic rates would be to write a script gathering the interfaces that are in a specific vlan, parse the output for rates and then add them together or in a monitoring application create a view that has the all the interfaces in a vlan and show you the throughput of them, or with SFLOW you could have the device send you the stats and again parse the data somehow to add them together, but this again would mainly layer 3 data (it'll show you inter-vlan communication rates as well though at least).&lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2015-10-30T05:45:07.140" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23900" PostTypeId="2" ParentId="23866" CreationDate="2015-10-30T10:07:05.097" Score="0" Body="&lt;p&gt;Finding the switchport a device is connected to is very easy. You can do it using the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute&#xA;show ip arp &amp;lt;ip_address&amp;gt;&#xA;show mac add &amp;lt;mac_address&amp;gt; | show mac-add add &amp;lt;mac_address&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The last command depends on what version of IOS you're using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need additional information I have just published a blog post describing how to achieve what you're asking - &lt;a href=&quot;http://www.oznetnerd.com/2015/10/30/finding-a-hosts-switchport/&quot; rel=&quot;nofollow&quot;&gt;http://www.oznetnerd.com/2015/10/30/finding-a-hosts-switchport/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, what exactly does the event/log say? It should really give you all the information you need. e.g if it were a MAC flap, it should tell you the ports its flapping between. If it is a physical port flap, it should tell you the exact port number.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-10-30T10:07:05.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23901" PostTypeId="2" ParentId="23839" CreationDate="2015-10-30T10:34:28.707" Score="2" Body="&lt;p&gt;This might be classed as slightly off topic, but you might be interested in reading about &lt;a href=&quot;https://en.wikipedia.org/wiki/Bandwidth-delay_product&quot; rel=&quot;nofollow&quot;&gt;Long Fat Networks (LFNs)&lt;/a&gt;. The reason why I say this is because a big internet pipe does not always mean it will be fast, nor will it be fully utilised unless it is set tuned correctly.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-10-30T10:34:28.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23903" PostTypeId="2" ParentId="23877" CreationDate="2015-10-30T12:17:27.463" Score="0" Body="&lt;p&gt;first of all, thank you for your questions and answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution was provided by &lt;a href=&quot;https://networkengineering.stackexchange.com/users/33/ylearn&quot;&gt;YLearn&lt;/a&gt; : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I believe the VLANs are only for the internal LAN ports and don't apply to the WAN ports on this device. Your VLAN 1 IP address overlaps with the WAN interface IP address putting the same subnet on both sides of the RV325. This should only work if the WAN port is configured as a &quot;Transparent Bridge&quot; as per documentation. For normal operation these two subnets should be different.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I changed the VLAN1 to another IP range and enabled VLAN. It worked like a charm.&lt;/p&gt;&#xA;" OwnerUserId="20126" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-10-30T12:17:27.463" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23904" PostTypeId="1" AcceptedAnswerId="23922" CreationDate="2015-10-30T12:58:27.227" Score="3" ViewCount="1171" Body="&lt;p&gt;So here's the issue I am having.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a bunch of HP Procurve 2920s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inter vlan routing is being done by a single firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan 10 - 10.10.10.0/25&#xA;Vlan 20 - 10.10.20.0/25&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gateway for each 10.1 and 20.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan 10 interface on switch = 10.5&#xA;PC1 on Vlan 10 = 10.100&#xA;PC2 on Vlan 20 = 20.100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface from switch to firewall is Tagged for vlan 10 and 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So first test for intervlan routing works.&#xA;PC1 on vlan 10 can communicate with PC2 on vlan 20. (10.100 &amp;lt;--&gt; 20.100) &#xA;PC1 switch interface is untagged vlan 10&#xA;PC2 switch interface is untagged vlan 20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So again intervlan routing via the L3 firewall is working. However where it breaks down is PC's on vlan 20 cannot talk to the actual switch IPs. (20.100 &amp;lt;-!-&gt; 10.5) does not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume this has to do something the way the HP is handling these incoming packets on the tagged interfaces. I'm hoping there is a procurve expert around here that can help. I need other vlans to be able to access the switches in the mgmt vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried both setting vlan 10 as &quot;primary-vlan&quot; and turned off &quot;primary-vlan&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry took so long to post code, I had to get some internet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NLRC127A-DS1# sho run&#xA;&#xA;Running configuration:&#xA;&#xA;; J9727A Configuration Editor; Created on release #WB.15.12.0015&#xA;; Ver #05:18.41.ff.35.0d:9b&#xA;&#xA;hostname &quot;NLRC127A-DS1&quot;&#xA;module 1 type j9727a&#xA;trunk 19-20 trk1 lacp&#xA;no telnet-server&#xA;ip default-gateway 10.10.10.1&#xA;ip routing&#xA;interface 1&#xA;   name &quot;External from Firewall:Eth0&quot;&#xA;   exit&#xA;interface 2&#xA;   name &quot;WAN port to Juniper:0/0&quot;&#xA;   exit&#xA;interface 3&#xA;   name &quot;RSV for Switch Trunks&quot;&#xA;   exit&#xA;interface 4&#xA;   name &quot;RSV for Switch Trunks&quot;&#xA;   exit&#xA;interface 5&#xA;   name &quot;RSV for Switch Trunks&quot;&#xA;   exit&#xA;interface 6&#xA;   name &quot;RSV for Switch Trunks&quot;&#xA;   exit&#xA;interface 7&#xA;   name &quot;RSV for Switch Trunks&quot;&#xA;   exit&#xA;interface 8&#xA;   name &quot;RSV for Switch Trunks&quot;&#xA;   exit&#xA;interface 9&#xA;   name &quot;RSV for Switch Trunks&quot;&#xA;   exit&#xA;interface 10&#xA;   name &quot;RSV for Switch Trunks&quot;&#xA;   exit&#xA;interface 11&#xA;   name &quot;RSV for Switch Trunks&quot;&#xA;   exit&#xA;interface 12&#xA;   name &quot;RSV for Switch Trunks&quot;&#xA;   exit&#xA;interface 23&#xA;   name &quot;Trunk_to_NLRC127A-FW1&quot;&#xA;   exit&#xA;interface 24&#xA;   name &quot;Trunk_to_NLRC127A-FW2&quot;&#xA;   exit&#xA;&#xA;oobm&#xA;   ip address dhcp-bootp&#xA;   exit&#xA;vlan 1&#xA;   name &quot;DEFAULT_VLAN&quot;&#xA;   no untagged 1-18,21-24,Trk1&#xA;   untagged A1-A2,B1-B2&#xA;   no ip address&#xA;   forbid 1-18,21-24,Trk1&#xA;   exit&#xA;vlan 3&#xA;   name &quot;Empty Vlan - DO NOT ROUTE&quot;&#xA;   no ip address&#xA;   exit&#xA;vlan 5&#xA;   name &quot;WAN_to_Juniper&quot;&#xA;   tagged 1-2&#xA;   no ip address&#xA;   exit&#xA;vlan 10&#xA;   name &quot;IT Mgmt-32.0/25&quot;&#xA;   untagged 13-18&#xA;   tagged 1-12,21-24,Trk1&#xA;   ip address 10.10.10.4 255.255.255.128&#xA;   exit&#xA;vlan 15&#xA;   name &quot;Bldg Infra-32.128/26&quot;&#xA;   tagged 21-24,Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 20&#xA;   name &quot;NLSC-33.0/25&quot;&#xA;   tagged 1,10,21-24,Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 25&#xA;   name &quot;NLSC-WHSE-33.128/25&quot;&#xA;   tagged 21-24,Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 30&#xA;   name &quot;NRC-34.0/24&quot;&#xA;   tagged 10,21-24,Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 35&#xA;   name &quot;NRC Testbed-32.192/26&quot;&#xA;   tagged 21-24,Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 40&#xA;   name &quot;Shared-35.0/26&quot;&#xA;   tagged 21-24,Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 50&#xA;   name &quot;NatAD-35.64/26&quot;&#xA;   tagged 21-24,Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 60&#xA;   name &quot;Wireless-36.0/24&quot;&#xA;   tagged 21-24,Trk1&#xA;   no ip address&#xA;   exit&#xA;vlan 70&#xA;   name &quot;DMZ&quot;&#xA;   tagged 21-24,Trk1&#xA;   no ip address&#xA;   exit&#xA;primary-vlan 3&#xA;spanning-tree&#xA;spanning-tree Trk1 priority 4&#xA;spanning-tree mode rapid-pvst&#xA;spanning-tree vlan 5 root primary&#xA;spanning-tree vlan 10 root primary&#xA;spanning-tree vlan 20 root primary&#xA;spanning-tree vlan 30 root primary&#xA;&#xA;NLRC127A-DS1#           &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17253" LastEditorUserId="17253" LastEditDate="2015-10-30T20:36:05.693" LastActivityDate="2015-10-30T20:36:05.693" Title="Cannot connect to HP Procurve 2920 from different vlan" Tags="|hp-procurve|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23905" PostTypeId="1" AcceptedAnswerId="23907" CreationDate="2015-10-30T13:12:31.453" Score="2" ViewCount="211" Body="&lt;p&gt;see my network diagram. I can't access internet from LAN network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C8qmP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C8qmP.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did the following configurations in cisco 1800 router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.configured ip address for interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.configure ip routing&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 10.0.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3.set defualt gateway&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip default-gateway 10.0.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can able to ping and traceroute from the router to google.com. But the users not able to.&lt;/p&gt;&#xA;" OwnerUserId="16394" LastEditorUserId="8499" LastEditDate="2018-12-22T04:51:57.120" LastActivityDate="2018-12-22T04:51:57.120" Title="cisco 1800 router blocks internet traffic" Tags="|cisco|routing|router|nat|packet-tracer|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23906" PostTypeId="2" ParentId="23905" CreationDate="2015-10-30T13:15:53.377" Score="2" Body="&lt;p&gt;Do you had set the gateway on your computers?? I guess: 192.168.10.50&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One question: It is a real scenario?, or is just some simulation for testing purpose. The thing is that from internet, it must not know the existence of network 192.168.10.0/24. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From internet cloud, must exist a route to 192.168.10.0/24 destination, across 10.0.1.50/16. With that conf, your scenario must work.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2015-10-30T13:38:13.120" LastActivityDate="2015-10-30T13:38:13.120" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="23907" PostTypeId="2" ParentId="23905" CreationDate="2015-10-30T13:49:00.487" Score="1" Body="&lt;p&gt;You shouldn't set a default gateway in your router since you are routing. The static default route is good enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you have private addressing for your network. You will need to configure NAT to translate your private addresses to the public address of the WAN interface. Google, and other Internet sites, cannot send return traffic to private addresses since the private addresses cannot be routed on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you really, really, really, need a firewall. Every time I set up something connected to the Internet, within 5 minutes, I can log a dozen attempts to break into what I just set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit based on the comment that there is a router between the Cisco router and the Internet:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your Internet router doesn't know about the network behind your Cisco router. Somehow, either using a static route or dynamic routing between the two routers, it need to know that traffic for the &lt;code&gt;192.168.10.0/24&lt;/code&gt; network should go to &lt;code&gt;10.0.1.50&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also NAT on the Cisco to accomplish this, but that in not an ideal solution.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-30T14:02:28.893" LastActivityDate="2015-10-30T14:02:28.893" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="23908" PostTypeId="1" CreationDate="2015-10-30T14:00:07.030" Score="7" ViewCount="143" Body="&lt;p&gt;I've inherited a network with approximately 200 computers and no VLANs configured.  We are currently adding a system that uses multicasting to communicate with each other and will be adding VoIP in 2 years.  I'd like to set up VLANs, with which I had some experience 10 years ago, but I'm a bit rusty, and I need my memory cells re-awakened.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network address is &lt;code&gt;10.110.32.0 255.255.252.0&lt;/code&gt;.  I was thinking to set up a VLAN and subnet for the multicasting (6 devices) and use &lt;code&gt;10.110.34.224 255.255.255.224&lt;/code&gt;, but is the subnetting necessary or is the VLAN sufficient?  In the past I did both subnetting and VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My second question is: does the router need to be configured with VLANs to support any of this?  It's of course set up for the &lt;code&gt;10.110.32.0&lt;/code&gt; network but management of the router is contracted out and I can't make any changes myself.  Requests for changes take months so I'm hoping that I don't need to request a change or I'll need to request plans for future configurations as well.  I'd rather not have to deal with them.  QoS is already configured so that's covered for the VoIP at least.&lt;/p&gt;&#xA;" OwnerUserId="20145" LastEditorUserId="8499" LastEditDate="2019-01-12T22:57:27.203" LastActivityDate="2019-01-12T22:57:27.203" Title="VLAN clarification" Tags="|vlan|ip|ipv4|subnet|multicast|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23909" PostTypeId="2" ParentId="23908" CreationDate="2015-10-30T14:24:29.183" Score="2" Body="&lt;p&gt;First, the proposed subnet, &lt;code&gt;10.110.34.224 255.255.255.224&lt;/code&gt; is within the existing subnet, &lt;code&gt;10.110.32.0 255.255.252.0&lt;/code&gt;. You will need to pick a subnet outside the range of the existing subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure why you would actually need a separate subnet for the multicasting, but a separate VLAN and subnet for VoIP is probably the way to go since you don't really want all the broadcast traffic for the users impeding your VoIP traffic. Separating the traffic at layer-2 with a separate VLAN is probably the way to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will definitely need router changes. The router needs to know about any new subnets, and the QoS will need to be modified for any new VLANs and subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm almost tempted to call this question off-topic since you don't really have the control of the network necessary to make the network changes required to accomplish your plan.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-30T14:24:29.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23910" PostTypeId="2" ParentId="23881" CreationDate="2015-10-30T14:31:42.877" Score="0" Body="&lt;p&gt;Are the sites using https? You should take a look at blocking https enabled and follow that guide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also some google sites now use their new QUIC protocol and even enabling https will not block it so you need to block that as well and then block the sites using the normal https blocking method.&lt;/p&gt;&#xA;" OwnerUserId="15569" LastActivityDate="2015-10-30T14:31:42.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23913" PostTypeId="2" ParentId="23908" CreationDate="2015-10-30T15:35:10.793" Score="4" Body="&lt;p&gt;One of primary reasons for segregating devices into separate VLANs is so that you can treat traffic from the VLANs differently, for example by applying a security policy, or a QoS policy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't mention how your 200 users are connected (one big switch or several small ones?), but for VoIP, you might want to to put your phones in a separate VLAN so that you can apply a QoS policy on your switches.  OTOH, depending on the kind(s) of switches, you may be able to do that with just DSCP or CoS markings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You say QoS is already configured, but I'd like to know exactly how before making any additional recommendations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I agree with @RonMaupin and @JohnJensen that there probably isn't any justification for putting your multicast devices in a separate VLAN, unless you intend to treat that traffic differently.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-30T15:35:10.793" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23914" PostTypeId="1" CreationDate="2015-10-30T16:01:53.633" Score="5" ViewCount="325" Body="&lt;p&gt;I would like some help in identifying a missing Packet in a TCP Stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an Application Layer Firewall where I can filter specific Web sites and Applications. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I access a simple Website from a Client with the IP 172.16.11.3/16 my Firewall will correctly identify the website I accessed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I change the IP address from this Client to 172.16.10.3/16 my Firewall will not identify the website anymore. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that everything stays the same, the only difference is one octet in the IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to find the problem I did a packet capture on the Firewall and I can see that there is indeed a difference. From the non-working IP, I am missing one single TCP Packet in my sequence indifference to the working IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following is a Screenshot of the problematic Packet being blue:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0RZQj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0RZQj.png&quot; alt=&quot;Wiresharp Capture&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My assumption is that the Firewall is missing a Packet in the TCP Stream and can therefore not correctly identify the Application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Question: Can anyone tell me if my assumption is feasible and could anyone guess what could cause the TCP Stream to look different? My money is on a buggy Core Switch between Client and Firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edited to add:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I captured the traffic on the internal interface of the firewall before the firewall process even gets the traffic. Configuration or type of Firewall should not be relevant. On top of that, I can replicate this behavior on a different firewall which is connected to a mirror port.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Networktopo is pretty easy: Client 10.3 or 11.3 &amp;lt;- Client Network 172.16.0.0/16 -&gt; L3 Core &amp;lt;- Transportnetwork 172.20.5.0/24 -&gt; Firewall&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Capture where logging is not working as intended and my Packet is missing: &lt;a href=&quot;https://www.cloudshark.org/captures/8d271219db64&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cloudshark.org/captures/8d271219db64&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Capture where the traffic gets logged as intended: &lt;a href=&quot;https://www.cloudshark.org/captures/960191af2a44&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cloudshark.org/captures/960191af2a44&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1558" LastEditorUserId="8499" LastEditDate="2018-02-16T04:03:21.893" LastActivityDate="2018-02-16T04:03:21.893" Title="Identifying missing TCP Packet" Tags="|firewall|tcp|checkpoint|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="23916" PostTypeId="1" AcceptedAnswerId="23917" CreationDate="2015-10-30T16:15:43.210" Score="3" ViewCount="1716" Body="&lt;p&gt;I've been having some strange issues with some site-to-site IPsec tunnels using ESP and pre-shared keys that I've been working on for the past two weeks with no success. The tunnel has no problem coming up, but certain traffic just doesn't want to pass over the link and I cannot for the life of me figure out why. We have 12 tunnels to remote locations, all configured identically and just about all with identical hardware (all Cisco 867VAE or 861 routers except for two of the sites), but these problems are only affecting 4 of the tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a mountain of details and a list of all the different types of things that do and don't work over the tunnel, but to keep it simple let's just stick with this particular one: I'm unable to send pings from the main office (where our Cisco ASA 5512-X is) to the remote location (where the router is; two of these locations are Cisco 867VAE routers, one is an old Cisco 2811 router, and one is a TP-Link TD-W8960N) over the VPN tunnel. However, pings from the remote location to the main office over the VPN tunnel work just fine. Any idea what might cause this behavior?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference there are four different ISPs involved, so I'm assuming it's not an issue with one particular ISP, but just in case it's relevant: We have three bonded T1's at our main office through Time Warner, while at the remote locations we have two with T1's (one through AT&amp;amp;T and one through Level 3) and two with DSL through CenturyLink. In case it matters none of our tunnels are very heavily used at all (usually just supporting two or three computers and a couple IP phones), so it definitely shouldn't be network congestion causing this somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've already triple-checked my configuration, rebooted everything, wiped out the configuration and re-added it, tried a different model Cisco router at the location with the 2811, and just for the heck of it I played with a variety of MTU and MSS values on both the ASA and remote router, but no difference. I can provide additional details on traffic that works and doesn't work as well as specific configuration details or show command output if needed.&lt;/p&gt;&#xA;" OwnerUserId="20150" LastActivityDate="2015-10-30T16:30:50.303" Title="Site-to-Site IPsec VPN Tunnel - Certain Traffic Doesn't Work" Tags="|cisco|vpn|ipsec|tunnel|" AnswerCount="1" CommentCount="2" ClosedDate="2015-10-30T16:54:29.920" ContentLicense="CC BY-SA 3.0" />
  <row Id="23917" PostTypeId="2" ParentId="23916" CreationDate="2015-10-30T16:30:50.303" Score="0" Body="&lt;p&gt;Ok, it was my fault, I didn't realize that the order of the NAT statements in the ASA actually made any difference, I had a bunch of static NAT entries for servers (and my own computer) and I just needed to make sure that the double NAT statement that keeps traffic intended to be tunneled from being NAT'ed appears above all my static NAT entries so that it occurs first.&lt;/p&gt;&#xA;" OwnerUserId="20150" LastActivityDate="2015-10-30T16:30:50.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23918" PostTypeId="2" ParentId="21100" CreationDate="2015-10-30T16:35:47.547" Score="2" Body="&lt;p&gt;I did lab this topology up and I'm getting the 3 routes installed on both R1 and R2 as you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the output of &lt;code&gt;show ip ospf | i NSSA&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip ospf | i NSSA&#xA; Supports NSSA (compatible with RFC 3101)&#xA;        It is a NSSA area&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the output says RFC 1587 you have to disable it under the OSPF process&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1  &#xA; no compatible rfc1587&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user20131" LastEditorDisplayName="user20131" LastEditDate="2015-10-30T19:45:41.637" LastActivityDate="2015-10-30T19:45:41.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23919" PostTypeId="1" AcceptedAnswerId="23967" CreationDate="2015-10-30T17:50:49.577" Score="2" ViewCount="370" Body="&lt;p&gt;I'm configuring my proxy server to serve 2 Internet connections to one end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, some websites load and some don't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My cache.log file return me this when I attempt to load a website:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2015/10/30 15:15:03| comm_udp_sendto: FD 8, (family=2) 208.67.222.222:53: (101) Network is unreachable&#xA;2015/10/30 15:15:03| idnsSendQuery: FD 8: sendto: (101) Network is unreachable&#xA;2015/10/30 15:15:03| comm_udp_sendto: FD 8, (family=2) 208.67.220.220:53: (101) Network is unreachable&#xA;2015/10/30 15:15:03| idnsSendQuery: FD 8: sendto: (101) Network is unreachable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My firewall script can be seen here: &#xA;&lt;a href=&quot;http://pastebin.com/9dbiSmeU&quot; rel=&quot;nofollow&quot;&gt;http://pastebin.com/9dbiSmeU&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20153" LastEditorUserId="8499" LastEditDate="2015-11-01T23:16:51.403" LastActivityDate="2015-11-01T23:16:51.403" Title="IPTABLES port 53 closed" Tags="|firewall|proxy|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-12T20:26:54.967" ContentLicense="CC BY-SA 3.0" />
  <row Id="23921" PostTypeId="1" CreationDate="2015-10-30T18:45:08.587" Score="3" ViewCount="129" Body="&lt;p&gt;Can I do this with a Juniper SRX-100?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a combination of corporate office users and remote work from home users.  A total of around 30 users with 10 remote work from home.  The remote users run a mixture of Windows, Mac OSX and Linux (Ubuntu and Centos).  It would be nice if the built-in/native VPN clients can be used to connect.  It would also be nice if the VPN client for the Apple iPhone/iPad would work, but it's not a show stopper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have three sites that the corporate office and remote work from home users need to access.  Two of the sites use Cisco ASA devices, and one uses a Juniper SSG5.  These three sites are not under my control, they are our customers.  We may have more customers in the future with site to site VPN requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking a hub and spoke VPN config with site to site VPNs would work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I setup the remote work from home dialup VPN to have access to the three site to site VPNs?&lt;/p&gt;&#xA;" OwnerUserId="20152" LastEditorUserId="8499" LastEditDate="2015-10-30T20:07:36.470" LastActivityDate="2015-10-30T20:07:36.470" Title="I want to combine a hub and spoke VPN with a dialup VPN" Tags="|cisco|cisco-asa|vpn|juniper|srx|" AnswerCount="0" CommentCount="1" ClosedDate="2019-12-19T09:03:19.723" ContentLicense="CC BY-SA 3.0" />
  <row Id="23922" PostTypeId="2" ParentId="23904" CreationDate="2015-10-30T19:34:18.210" Score="1" Body="&lt;p&gt;You say that inter-VLAN routing is done by the firewall, but you have IP routing enabled on the switch.  Turn it off.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip routing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-10-30T19:34:18.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23923" PostTypeId="2" ParentId="23904" CreationDate="2015-10-30T19:34:37.267" Score="0" Body="&lt;p&gt;You wrote:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Vlan 10 interface on switch = 10.5&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So again intervlan routing via the L3 firewall is working. However&#xA;  where it breaks down is PC's on vlan 20 cannot talk to the actual&#xA;  switch IPs. (20.100 &amp;lt;-!-&gt; 10.5) does not work.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;yet the actual switch configuration shows &lt;code&gt;10.10.10.4&lt;/code&gt;, not &lt;code&gt;10.10.10.5&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 10&#xA;   name &quot;IT Mgmt-32.0/25&quot;&#xA;   untagged 13-18&#xA;   tagged 1-12,21-24,Trk1&#xA;   ip address 10.10.10.4 255.255.255.128&#xA;   exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like you are trying to get to the wrong address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-30T19:34:37.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23925" PostTypeId="2" ParentId="23914" CreationDate="2015-10-30T21:24:59.290" Score="0" Body="&lt;p&gt;To answer your question (not the reason for the failure)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet count difference between the two captures doesn't mean something is wrong. Packet 10 in the first capture (103_chak..) is an ACK that's piggy-backed in another data packet. Packet 7 in the second capture (113_chak..) is just an empty ACK for previous received data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for the piggy-back in the first capture is that the HTTP GET (packet 10) is sent 20 ms after the received packet. In the second capture there is no piggy-backing because the HTTP GET is sent almost 2 seconds (very long time) after the received packet so an empty ACK is needed before that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at the last segments SEQ/ACK numbers in both captures, they are the same. Which means both sessions in the end of the day sent the same amount of data, just one session had an extra packet.&lt;/p&gt;&#xA;" OwnerDisplayName="user20131" LastActivityDate="2015-10-30T21:24:59.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23926" PostTypeId="2" ParentId="23914" CreationDate="2015-10-30T21:28:46.913" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Configuration or type of Firewall should not be relevant&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Without having more information such as the hardware involved and their configs, my guess is that the fault &lt;strong&gt;is&lt;/strong&gt; configuration related. Perhaps the two addresses are covered by two different rules. One which does a DNS lookup and one which doesn't. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As they say, the simplest answer is usually the right one. &lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-10-30T21:28:46.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23927" PostTypeId="2" ParentId="23083" CreationDate="2015-10-31T02:07:26.200" Score="7" Body="&lt;p&gt;Think about this very carefully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside source means that you want to translate the source address from traffic originating inside your network. This is the typical &quot;home networking&quot; arrangement which allows you to use private addresses on the public Internet. Of course, this is not the only use for this version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside destination means that you want traffic originating from an outside address to a particular destination transport protocol and port to go to a particular inside address. This is what home users do to allow something like a web server with a private address to be accessed from the public Internet. Of course, this is not the only use for this version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Outside source translates traffic originating from outside to look like it originated from an inside address. It can useful in cases where companies with overlapping IP address ranges merge and need to start connecting the networks. You can translate the source addresses of traffic originating from the outside, which would normally have outside source addresses which conflict with inside addresses, to source addresses addresses in an available inside address range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Outside destination doesn't really make a lot of sense since it is the inverse of port forwarding. This would limit any traffic originating from the inside, destined to a particular outside transport protocol and port, to a single outside address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-31T03:30:24.470" LastActivityDate="2015-10-31T03:30:24.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23928" PostTypeId="2" ParentId="23651" CreationDate="2015-10-31T02:53:58.220" Score="2" Body="&lt;p&gt;I got this issue resolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did a lot of reading. Yes, it appears sometimes Cisco devices don't play nice with 3rd party SFPs. My environment and timeframe did not allow to get Cisco branded SFPs in. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked at what I had and found a 20x1G line card laying around and decided to throw that in a blank slot. I had been working off of a 10G line card in all of the steps in my original post. Once I had everything physically connected and moved my config over to the needed card/ports, line and protocol status went up/up and beautiful green link lights came alive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that you cannot simply drop the speed on a 10G line card down to match lower bandwidths. I will update with a better explanation if/when I find one.&lt;/p&gt;&#xA;" OwnerUserId="19365" LastActivityDate="2015-10-31T02:53:58.220" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23929" PostTypeId="1" AcceptedAnswerId="23930" CreationDate="2015-10-31T06:10:32.677" Score="3" ViewCount="123" Body="&lt;p&gt;Apologies in advance if this question is a bit simplistic. I'm normally a software dev, however I'm the only 'IT guy' in my company so I have to deal with all sorts. Bear with me..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My company is planning on setting up equipment overseas on the premises of a third party. When we get there we will be piggy-backing onto the network of the third-party. We need control of the network which our devices are connected to in order to ensure things like static IP address allocation etc. The hard part is we don't really know anything about the network we'll be connecting to. Ideally we have everything set up so we can plug-and-play on arrival.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I &lt;em&gt;think&lt;/em&gt; this means I need to create a subnet like I've shown in the picture, with our router acting as a DHCP server for the subnet. However, that's about as far as I got.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is this the correct way to achieve such an outcome?&lt;/li&gt;&#xA;&lt;li&gt;What sort of device do I need to achieve this? Router? Switch?&lt;/li&gt;&#xA;&lt;li&gt;How can I best set up the router/switch so that we can get as close to plug &amp;amp; play on arrival and avoid conflicts with the existing network?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MB2Pd.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MB2Pd.jpg&quot; alt=&quot;my idea of a network diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20159" LastActivityDate="2015-10-31T06:35:59.467" Title="Setting up a private subnet in an unknown host environment" Tags="|subnet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23930" PostTypeId="2" ParentId="23929" CreationDate="2015-10-31T06:35:59.467" Score="2" Body="&lt;p&gt;Since you are simply using the foreign network to get access to the public Internet, you can get an IP address and subnet for your router from the foreign network, but you need to know beforehand what the address and subnet are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can run NAT on your router to assign your inside subnets as any private address subnets which do not belong to the foreign network's subnet to which your NAT router is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I &lt;strong&gt;strongly&lt;/strong&gt; urge you to also run a firewall, either on your router, or as a separate box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will allow you to send a turnkey network, but only if you can be assigned your outside NAT address and subnet prior to shipping the equipment. If you happen to use a subnet which falls in the subnet to which your NAT router is attached, you will have problems. That's why you want to know this up front.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-10-31T06:35:59.467" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23932" PostTypeId="1" AcceptedAnswerId="23949" CreationDate="2015-10-31T11:19:23.080" Score="2" ViewCount="1238" Body="&lt;p&gt;My goal is to gain access to a sambashare on my schools network (using a vpn), while not routing all other traffic trough the vpn. The school has disabled split tunneling. Is this possible? I'm using cisco vpn client.&lt;/p&gt;&#xA;" OwnerUserId="20164" LastActivityDate="2015-10-31T23:47:45.940" Title="Route specific trafic trough vpn without split tunneling" Tags="|vpn|split-tunneling|" AnswerCount="2" CommentCount="7" ClosedDate="2015-10-31T23:51:33.583" ContentLicense="CC BY-SA 3.0" />
  <row Id="23933" PostTypeId="1" AcceptedAnswerId="23935" CreationDate="2015-10-31T12:32:03.790" Score="1" ViewCount="445" Body="&lt;p&gt;I need to port forward my Netgear router 'JNR1010v2 genie' to my system. My ISP has assigned to my router a static IP of 172.17.1.x which I think is not my public IP. On googling my public IP is shown to be of the type 43.247.y.x. I made an entry on my router to forward port to 8080.&lt;a href=&quot;https://i.stack.imgur.com/L0GZV.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L0GZV.jpg&quot; alt=&quot;port forward page&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have disabled all firewalls on my system and as far as possible on the router. I have a local server running on my system which I can access locally and on the local network. I ran a traceroute to my public IP from an external network and it did not complete. I am not able to ping this public IP. Is that normal? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I am attaching my WAN configuration page here &lt;a href=&quot;https://i.stack.imgur.com/Ttoxo.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ttoxo.jpg&quot; alt=&quot;WAN page&quot;&gt;&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="20165" LastEditorUserId="509" LastEditDate="2015-12-06T11:10:21.000" LastActivityDate="2015-12-06T11:10:21.000" Title="Port forwarding won't work on Netgear JNR1010v2 router" Tags="|router|" AnswerCount="1" CommentCount="2" ClosedDate="2015-10-31T23:52:29.323" ContentLicense="CC BY-SA 3.0" />
  <row Id="23935" PostTypeId="2" ParentId="23933" CreationDate="2015-10-31T13:28:30.937" Score="1" Body="&lt;p&gt;If there is a 172.17(private) network in between you and the ISP then it won't work because they have to do some port-forwarding as well from the external IP to the one assigned to your router (I doubt they will). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic port forwarding config is ok as long as the internal IP and port number is correct.&lt;/p&gt;&#xA;" OwnerDisplayName="user20131" LastActivityDate="2015-10-31T13:28:30.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23936" PostTypeId="2" ParentId="23932" CreationDate="2015-10-31T13:58:23.250" Score="-1" Body="&lt;p&gt;You could do that by modifing your PC routing table, if split tunnel disabled VPN server will push default route to your PC &#xA;So you need to do this:&#xA;1-add default route through you network with lower metric&#xA;2-add specific route to your school NFS server through the tunnel&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2015-10-31T13:58:23.250" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23940" PostTypeId="1" AcceptedAnswerId="23952" CreationDate="2015-10-31T16:02:06.493" Score="1" ViewCount="154" Body="&lt;p&gt;I have a router and switch in my institute. The switch is connected 15 PCs in a lab. With little effort, how can i block social sites, video buffering and &lt;code&gt;torrentz.eu&lt;/code&gt; downloading? Please suggest a sound method.&lt;/p&gt;&#xA;" OwnerUserId="8007" LastEditorUserId="8499" LastEditDate="2015-10-31T17:59:53.673" LastActivityDate="2015-11-09T07:14:42.423" Title="Small network security Issue" Tags="|routing|nat|firewall|security|internet|" AnswerCount="4" CommentCount="1" ClosedDate="2019-11-16T17:27:22.983" ContentLicense="CC BY-SA 3.0" />
  <row Id="23942" PostTypeId="1" CreationDate="2015-10-31T16:24:07.113" Score="1" ViewCount="339" Body="&lt;p&gt;I have a problem with GNS3 router DHCP . I'm using a Cisco 1700, VMware, and Windows 7 which are connected by a cloud.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured DHCP on the router, and the DHCP binding works; I can see the DORA process in Wireshark, but the host gets an APIPA address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any idea what may be wrong?&lt;/p&gt;&#xA;" OwnerUserId="20123" LastEditorUserId="8499" LastEditDate="2015-10-31T18:07:39.940" LastActivityDate="2016-09-24T13:55:36.507" Title="DHCP request with no answer" Tags="|cisco|" AnswerCount="1" CommentCount="5" ClosedDate="2019-02-23T22:16:48.163" ContentLicense="CC BY-SA 3.0" />
  <row Id="23943" PostTypeId="2" ParentId="23940" CreationDate="2015-10-31T16:30:01.303" Score="0" Body="&lt;p&gt;Most routers these days support web filtering. If your router supports that you can setup rules to filter certain websites. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also &lt;a href=&quot;http://www.opendns.com/&quot; rel=&quot;nofollow&quot; title=&quot;Open DNS&quot;&gt;Open DNS&lt;/a&gt; which can filter sites based on content categories and you don't have to manually add the list of websites that you want to block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several other methods like modifying the hosts file on the machines (can be easily bypassed), but Open DNS would be a better solution.&lt;/p&gt;&#xA;" OwnerUserId="20158" LastActivityDate="2015-10-31T16:30:01.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23946" PostTypeId="2" ParentId="23500" CreationDate="2015-10-31T19:24:20.780" Score="2" Body="&lt;p&gt;Openflow is just the protocol used for communicatuin between the controller and a switch.  This is considered the southbound communication.   SDN is too vague and over used.  There is no direct comparison.   However openflow would fall under the SDN umbrella.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to compare openflow,  then compare it to a proprietary protocol doing the same function.&lt;/p&gt;&#xA;" OwnerUserId="20015" LastActivityDate="2015-10-31T19:24:20.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23947" PostTypeId="1" AcceptedAnswerId="23948" CreationDate="2015-10-31T22:48:00.010" Score="2" ViewCount="2255" Body="&lt;p&gt;In encoding 4B5B, the rule  is no more than one leading zero and no more than two trailing zeros. For example, to convert &lt;code&gt;1110&lt;/code&gt;, the result is  &lt;code&gt;11100&lt;/code&gt;; just add zero to end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To convert &lt;code&gt;0101&lt;/code&gt;, I thought the result should be &lt;code&gt;01010&lt;/code&gt; because only one leading zero and no more than two trailing zeros.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the correct result is &lt;code&gt;01011&lt;/code&gt;. Why is that?&lt;/p&gt;&#xA;" OwnerUserId="20176" LastEditorUserId="8499" LastEditDate="2016-11-29T03:25:10.773" LastActivityDate="2016-11-29T03:25:10.773" Title="How to encode 4B/5B" Tags="|protocol-theory|layer1|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23948" PostTypeId="2" ParentId="23947" CreationDate="2015-10-31T23:05:25.427" Score="1" Body="&lt;p&gt;The nibble &lt;code&gt;0101&lt;/code&gt; can't be converted to &lt;code&gt;01010&lt;/code&gt; because that's what &lt;code&gt;0100&lt;/code&gt; converts to. Before you ask why &lt;code&gt;0100&lt;/code&gt; doesn't convert to &lt;code&gt;01001&lt;/code&gt;, it's because &lt;code&gt;0001&lt;/code&gt; converts to &lt;code&gt;01001&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The nibbles are converted from a dictionary, and the dictionary specifies that &lt;code&gt;0101&lt;/code&gt; converts to &lt;code&gt;01011&lt;/code&gt;. Encoding and decoding by a dictionary is fast and easy, which is appealing when designing communications systems.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-10-31T23:12:52.673" LastActivityDate="2015-10-31T23:12:52.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23949" PostTypeId="2" ParentId="23932" CreationDate="2015-10-31T23:47:45.940" Score="0" Body="&lt;p&gt;The Cisco VPN Client will not allow you to alter/override tunnel policies. Should you manage to get around that, the tunnel will not carry traffic that doesn't match the tunnel policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You network admins have it setup the way they intend. If you require something different, you'll have to talk to them.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-10-31T23:47:45.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23950" PostTypeId="2" ParentId="18073" CreationDate="2015-11-01T03:49:22.643" Score="3" Body="&lt;p&gt;Based on &lt;a href=&quot;https://www.iol.unh.edu/sites/default/files/knowledgebase/ge/pcs.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this presentation&lt;/a&gt; some of those PAM5 codes (2 byte &quot;SSD&quot; and respectively 4 byte combo &quot;csreset&quot; and &quot;ESD&quot;) mark the start and respectively end of frame, similar to how J/K and T/R do the same for 100BASE-TX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vLjcT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vLjcT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 802.3-2005 standard explains how these are coded relative to normal data:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;During data encoding, PCS Transmit utilizes a three-state convolutional encoder. The transition from idle or carrier extension to data is signalled by inserting a SSD, and the end of transmission of data is signalled by an ESD. [...] During idle and carrier extension encoding, special code-groups with symbol values restricted to the set {2, 0, –2} are used. These&#xA;  code-groups are also generated using the transmit side-stream scrambler. However, the encoding rules for the idle, SSD, and carrier extend code-groups are different from the encoding rules for data, CSReset, CSExtend,&#xA;  and ESD code-groups. During idle, SSD, and carrier extension, the PCS Transmit function reverses the sign of the transmitted symbols. This allows, at the receiver, sequences of code-groups that represent data, CSReset, CSExtend, and ESD to be easily distinguished from sequences of code-groups that represent SSD,&#xA;  carrier extension, and idle.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;CSReset means &quot;Convolutional State Reset&quot; and SSD/ESD mean Start-of-Stream/End-of-Stream Delimiter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual codes are publicly available [for free] as ASCII &lt;a href=&quot;http://www.ieee802.org/3/publication/ab/table40_1.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;table 40-1&lt;/a&gt; and &lt;a href=&quot;http://www.ieee802.org/3/publication/ab/table40_2.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;table 40-2&lt;/a&gt;. The codes are given per byte there, e.g. to send SSD, you send SSD1 and SSD2 in this order.&lt;/p&gt;&#xA;" OwnerUserId="17626" LastEditorUserId="17626" LastEditDate="2015-11-01T04:32:49.787" LastActivityDate="2015-11-01T04:32:49.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23952" PostTypeId="2" ParentId="23940" CreationDate="2015-11-01T08:07:31.277" Score="4" Body="&lt;p&gt;the most simple way to do that is &lt;strong&gt;&lt;em&gt;proxy server&lt;/em&gt;&lt;/strong&gt; with black list include all sits you try to block , but to be onest with you in such environment any small solution could be hacked by the users. may you need to invest little bit in some sort of small business firewall. regardless product recognition i just try fortigate 60C in such environment and it is working properly.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-11-01T08:07:31.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23954" PostTypeId="1" AcceptedAnswerId="23956" CreationDate="2015-11-01T09:32:08.857" Score="4" ViewCount="522" Body="&lt;p&gt;Since inception, the resilience of the Internet has been based upon multiple paths from source to destination. At the granularity of the AS, this is generally implemented by linking to more than one AS's. Without resolving this further into whether each link carries advertisements of all or only a subset of routes, this is the basis of resilience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With particular reference to routers in Tier 1 networks, I am curious about whether the router at the end of each link is implemented as part of a set of redundant routers. I am familiar with VRRP and HSRP for the operation of such a set of redundant routers but I only know of their use in stub ASes, like those owned by end users who need to ensure the resilience of their connection to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, how common is the use of device redundancy as a means complementary to multiple links in order to strengthen the resilience of the Internet? I would guess that in cases where links between geographical regions are relatively few (such as links based on submarine cables), device redundancy is an important factor in the resilience of the Internet. This guess is based on the assumption that the portion of inter-region traffic carried by each such link is high, increasing the importance of redundancy at the end point - the router.&lt;/p&gt;&#xA;" OwnerUserId="20180" LastEditorUserId="42290" LastEditDate="2017-12-13T12:15:57.153" LastActivityDate="2017-12-13T12:15:57.153" Title="Redundancy in Internet core and edge networks - redundant devices and redundant links" Tags="|redundancy|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23955" PostTypeId="2" ParentId="23954" CreationDate="2015-11-01T12:14:18.727" Score="1" Body="&lt;p&gt;when you think in internet service stability and resilience (as you describe) you need to think in different ISP , not multiple AS , and may you run each ISP on different Router and then run any internal redundancy protocol like HSRP or VRRP&#xA;between those routers to provide single internet GW to the users.if you run multiple AS on the same ISP it won't make seance cause if this ISP connection is drooped so the all AS related to it will drooped as well.    &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-11-01T12:14:18.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23956" PostTypeId="2" ParentId="23954" CreationDate="2015-11-01T13:45:30.470" Score="3" Body="&lt;p&gt;This would be entirely up to the Tier 1 and their strategy/business model and each one may handle this differently. Redundancy is about preventing loss of service first and preventing degradation of service second (and often a distant second). This means that the focus needs to be on avoiding anything that provides a &quot;single point of failure.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets look at your example of the submarine cable. Yes, they could have redundant devices, but it might be more common that they have a single device with redundancy built in (multiple SUP/RP, redundant power) connected to multiple fiber pairs in that cable (probably tied to different line cards/modules in the device). This provides you with most of the redundancy of multiple hardware platforms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However since the cable itself is a possible point of failure, instead of a second piece of redundant hardware on both ends tied to the same point of failure, it would be better to spend that money putting hardware on a second alternative path (i.e. another submarine cable following a different route). Or to plan for and depend on peering partners that have an alternative path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While this path may be longer/less efficient/lower bandwidth or less desirable for a number of reasons, it provides an entirely different alternate path should something happen to the cable itself.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-11-01T13:45:30.470" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23957" PostTypeId="2" ParentId="23954" CreationDate="2015-11-01T14:19:58.203" Score="0" Body="&lt;p&gt;Physical device and link separation is key to a redundancy plan.  Not only is it beneficial to unexpected failures, it can be critical to uptime when doing planned software upgrades or hardware replacement. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could have redundant paths to the same IP or leverage BGP multi homing to use different ISPs.&lt;/p&gt;&#xA;" OwnerUserId="20015" LastActivityDate="2015-11-01T14:19:58.203" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23958" PostTypeId="1" AcceptedAnswerId="23962" CreationDate="2015-11-01T15:42:28.900" Score="5" ViewCount="6095" Body="&lt;p&gt;I understand that Extended Unique Identifier (EUI-64) allows a host to automatically assign itself a 64-bit interface identifier IID for an IPv6 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: What is the purpose of using EUI-64, and what is the relationship between EUI-64bit and IPv6-128bit?&lt;/p&gt;&#xA;" OwnerUserId="20185" LastEditorUserId="8499" LastEditDate="2018-12-22T04:58:24.097" LastActivityDate="2023-02-13T14:25:38.793" Title="Understanding the difference between EUI-64 and IPv6" Tags="|routing|ip|ipv6|protocol-theory|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23959" PostTypeId="1" AcceptedAnswerId="23976" CreationDate="2015-11-01T16:09:59.433" Score="32" ViewCount="24023" Body="&lt;p&gt;My employer requires me to first log on to a VPN, and only then I can SSH into the servers. But, given the security of SSH, is a VPN overkill?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the use of a VPN in terms of security if I am &lt;strong&gt;already using SSH&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="4339" LastEditorUserId="4196" LastEditDate="2015-11-02T20:54:09.920" LastActivityDate="2018-09-11T18:17:52.960" Title="Why use SSH and VPN in combination?" Tags="|vpn|ssh|" AnswerCount="9" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="23960" PostTypeId="1" AcceptedAnswerId="24425" CreationDate="2015-11-01T16:12:33.023" Score="1" ViewCount="20766" Body="&lt;p&gt;I have a router and a MikroTik connected by a (long) ethernet cable that I'm trying to setup with switch-like functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is that the correct way to do this is to create a bridge on the MikroTik that incorporates the port that it's plugged into (a normal LAN port) and the WLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I attempt this however, there are couple of problems I seem to face:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;WLAN devices cannot communicate with devices which are connected to the router (or in fact, the router itself). I assume this is some kind of routing issue in that it doesn't know where to try and send the requests, but my understanding of bridging would imply that would be a non-issue. Attempting to ping the router sends back the following response:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;92 bytes from router (192.168.88.1): Redirect Host(New addr: 192.168.0.1)&#xA;Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst&#xA; 4  5  00 0054 db8d   0 0000  3f  01 c5cb 192.168.88.254  192.168.0.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the MikroTik itself acts as a DHCP server rather than the main router. This is still the case after setting the DHCP client to attach to the bridge-local interface. Do I want to setup a DHCP relay? Setup a separate DHCP server? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If I connect the ethernet to the ether1-gateway port, I can successfully route through it (access the router etc) but then I'm not actually connecting the network together (which kind of defeats the point).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers as to where I'm going wrong would be gratefully received, this isn't something I normally do so stupid errors are not unlikely.&lt;/p&gt;&#xA;" OwnerUserId="20186" LastEditorUserId="8499" LastEditDate="2018-02-14T16:39:32.180" LastActivityDate="2018-02-14T16:39:32.180" Title="Transparent bridging using Mikrotik RouterBoard" Tags="|routing|" AnswerCount="3" CommentCount="1" ClosedDate="2017-07-28T15:25:55.197" ContentLicense="CC BY-SA 3.0" />
  <row Id="23961" PostTypeId="1" CreationDate="2015-11-01T16:28:05.023" Score="1" ViewCount="1411" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uEK3k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uEK3k.png&quot; alt=&quot;Network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my network. The forwarding tables I provide them bellow. I am able to establish the connection between Office1 and R1 but I am not able to connect with R2, as for a reason I do not know, all the traffic from R1 goes to Office1, ignoring the forwarding table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Office 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/sbin/ip route add 10.0.6.205/24 via 10.0.6.181&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/sbin/ip route add 10.0.6.1/25 via 10.0.6.177&#xA;/sbin/ip route add 10.0.6.185/24 via 10.0.6.181&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/sbin/ip route add 10.0.6.1/30 via 10.0.6.177&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone know where am I failing when configuring this basic routing exercise using CORE emulator?&lt;/p&gt;&#xA;" OwnerUserId="20188" LastEditorUserId="20189" LastEditDate="2015-11-02T20:54:41.733" LastActivityDate="2015-11-02T20:54:41.733" Title="Basic example of forwarding tables" Tags="|routing|ipv4|ip-forwarding-table|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23962" PostTypeId="2" ParentId="23958" CreationDate="2015-11-01T16:31:58.673" Score="5" Body="&lt;p&gt;One of the methods for assigning IPv6 addresses is called Stateless Address Autoconfiguration (SLAAC), which uses a modified EUI-64 for the Interface ID portion of the IPv6 address.  Using the modified EUI-64 is a way the help ensure any self-generated address on a link is unique. Other methods for that have been used, too, since SLAAC was described in the RFC.&lt;/p&gt;&#xA;&lt;p&gt;An IPv6 address consists of the Global Routing Prefix assigned by the ISP or RIR, the Subnet ID assigned by the network administration, and the Interface ID. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#section-2.5.4&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291, IP Version 6 Addressing Architecture, Section 2.5.4, Global Unicast Addresses&lt;/a&gt;, describes this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   The general format for IPv6 Global Unicast addresses is as follows:&#xA;&#xA;   |         n bits         |   m bits  |       128-n-m bits         |&#xA;   +------------------------+-----------+----------------------------+&#xA;   | global routing prefix  | subnet ID |       interface ID         |&#xA;   +------------------------+-----------+----------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;SLAAC uses the 48-bit (EUI-48) MAC address of an interface to generate the 64-bit modified EUI-64 for the Interface ID of an IPv6 address. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#appendix-A&quot; rel=&quot;nofollow noreferrer&quot;&gt;Appendix A of RFC 4291&lt;/a&gt; describes how to create an Interface ID using the MAC address.  Basically, you split the MAC address into two 24-bit parts, insert 16 bits (&lt;code&gt;FFFE&lt;/code&gt;) in between the two parts, and invert the Universal/Local bit.&lt;/p&gt;&#xA;&lt;p&gt;Using SLAAC, IPv6 hosts can create thier own IPv6 addresses. Some people are concerned that a host address can uniquely identify a host using SLAAC, regardless of the network. This led to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4941&quot; rel=&quot;nofollow noreferrer&quot;&gt;Privacy Extensions&lt;/a&gt;, and some OSes like Windows and some Linux distributions to generate and use random Interface IDs by default.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2015-11-01T16:31:58.673" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23963" PostTypeId="1" CreationDate="2015-11-01T16:36:21.753" Score="1" ViewCount="1905" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Routing Information Protocol (RIP) is a standards-based, distance-vector, interior gateway protocol (IGP) used by routers to exchange routing information.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What does it mean by standards-based protocol?&lt;/p&gt;&#xA;" OwnerDisplayName="user15062" LastEditorUserId="8499" LastEditDate="2015-11-01T18:14:43.410" LastActivityDate="2016-03-23T08:25:58.093" Title="What is a standards-based protocol?" Tags="|rip|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23964" PostTypeId="2" ParentId="23959" CreationDate="2015-11-01T16:42:51.973" Score="4" Body="&lt;p&gt;SSH is an encryption protocol used for several things. Encrypting traffic in a VPN tunnel is one of them. Your traffic is encrypted using SSH, but it then needs to be wrapped in valid IP packets (tunnel) to traverse a network like the Internet. This tunnel is the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, your employer blocks outside network traffic, for security, unless that traffic comes through a VPN which the employer controls. A VPN may or may not encrypt the contents of the tunnel. Using SSH will encrypt the traffic carried in the VPN tunnel.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-01T16:42:51.973" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23965" PostTypeId="2" ParentId="23963" CreationDate="2015-11-01T16:55:52.427" Score="3" Body="&lt;p&gt;It's an open standard and not vendor proprietary.  EIGRP is an example of a Cisco proprietary routing protocol, and OSPF is an example of a standards-based routing protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using standards-based protocols makes transitions between hardware vendors easier, although proprietary protocols sometimes have benefits you may want to use. &lt;/p&gt;&#xA;" OwnerUserId="20015" LastEditorUserId="8499" LastEditDate="2015-11-01T23:15:16.773" LastActivityDate="2015-11-01T23:15:16.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23966" PostTypeId="2" ParentId="23961" CreationDate="2015-11-01T17:12:54.120" Score="3" Body="&lt;p&gt;Office1 and R1 aren't on the same network -- even the network mask is different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 and R2 aren't on the same network neither: R1 is on the 10.0.6.180/30 where R2 is on 10.0.6.184/30, so that point-to-point link is never going to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, once you set up correct IP addresses for all interfaces, we'd need to know the routing tables from all devices to be able to troubleshoot the problem. &lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2015-11-01T17:12:54.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23967" PostTypeId="2" ParentId="23919" CreationDate="2015-11-01T17:40:58.023" Score="1" Body="&lt;p&gt;The errors in the logs concern a DNS connection (port 53) towards OpenDNS servers (208.67.222.222 and 208.67.220.220).  It appears that these servers are not reachable from your proxy machine.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issues with websites not loading aren't due to the websites themselves, but to the fact that your proxy is unable to resolve the domain name of the URL to an IP address.  Probably some websites work because their IP mapping is still stored in the DNS cache, which makes me think that the connection to the OpenDNS servers works sometimes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try a &lt;code&gt;traceroute 208.67.222.222&lt;/code&gt; to see where the connection fails.&lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2015-11-01T17:40:58.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23968" PostTypeId="2" ParentId="23959" CreationDate="2015-11-01T18:04:03.513" Score="7" Body="&lt;p&gt;The VPN allows you to connect to your employer's private network and acquire an IP address of that private network.  Once you're connected to the VPN, it's like you are using one of the computers inside the company -- even if you are physically located on the other side of the world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most probably, your employer requires you to connect via VPN first because the servers are not accessible from the Internet (i.e. they haven't a public IP address), which is a good idea.  The VPN adds another layer of security, as if the servers were publicly accessible via SSH they would be vulnerable to a range of attacks. &lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2015-11-01T18:04:03.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23969" PostTypeId="2" ParentId="23960" CreationDate="2015-11-01T18:09:51.533" Score="1" Body="&lt;p&gt;If the router is used for all the VLANs, you have a few  options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The router needs to use 802.1Q trunking on its LAN port. It will need to be the gateway for each&#xA;subnet (have a gateway address for each subnet in the address range&#xA;of the subnet for which it is serving as the gateway). The link&#xA;between the MikroTik and the router needs to trunk all the VLANs.&lt;/li&gt;&#xA;&lt;li&gt;You could configure the MikroTik as a layer-3 switch. This&#xA;essentially makes the MikroTik the router for the VLANs, and it will&#xA;need a gateway address for each subnet in the address for the subnet.&#xA;The link between the MikroTik and the router should be a routed&#xA;point-to-point link. The router will need to have routes to each&#xA;subnet which point to the MikroTik as the next hop.&lt;/li&gt;&#xA;&lt;li&gt;You could configure the MikroTik as a typical WAN router running NAT&#xA;with the WAN port connecting to the router's LAN port. This&#xA;introduces double-NAT which may cause some problems.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-01T18:09:51.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23971" PostTypeId="1" AcceptedAnswerId="23973" CreationDate="2015-11-01T18:37:44.453" Score="2" ViewCount="203" Body="&lt;p&gt;I was trying to research how RSVP is utilized, and if it succeeded. I have the following question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I notice Cisco routers do support RSVP, but is it really utilized, or is it just for few high-end, sophisticated apps?&lt;/p&gt;&#xA;" OwnerUserId="20192" LastEditorUserId="8499" LastEditDate="2015-11-01T19:22:26.103" LastActivityDate="2015-11-01T19:22:26.103" Title="Resource Reservation Protocol (RSVP) utilization in Cisco" Tags="|cisco|rsvp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="23972" PostTypeId="1" CreationDate="2015-11-01T18:54:25.480" Score="1" ViewCount="64" Body="&lt;p&gt;I started a Named ACL Lab today and my configuration is not quite working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LAB: &lt;a href=&quot;http://gns3vault.com/security/named-access-list/&quot; rel=&quot;nofollow&quot;&gt;http://gns3vault.com/security/named-access-list/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first task is creating an ACL which blocks users from NSA's L1 to reach HTTPS on CIA's L2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The addressing is fine and I can ping all interfaces.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;My Configuration is placed on NSA, different from author's config which places the config on CIA's router. I later configured it the same way as the lab author configured, and it worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;NSA#sh access-lists&#xA;&lt;/code&gt;&#xA;&lt;code&gt;Extended IP access list NSA_L1_TO_CIA_L2&#xA;    10 deny tcp 33.33.33.0 0.0.0.255 111.111.111.96 0.0.0.31 eq 443&#xA;    20 permit ip any any (444 matches)&#xA;&lt;/code&gt;&#xA;&lt;code&gt;sh ip int e0/0&#xA;Ethernet0/0 is up, line protocol is up&#xA;  Internet address is 192.168.13.3/24&#xA;  Broadcast address is 255.255.255.255&#xA;  Address determined by setup command&#xA;  MTU is 1500 bytes&#xA;  Helper address is not set&#xA;  Directed broadcast forwarding is disabled&#xA;  Multicast reserved groups joined: 224.0.0.5 224.0.0.6&#xA;  Outgoing access list is NSA_L1_TO_CIA_L2&#xA;  Inbound  access list is NSA_L1_TO_CIA_L2 (This shouldn't be here, I just put for test purposes)&#xA;  ... (Continues...)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Can someone explain why?&lt;/p&gt;&#xA;" OwnerUserId="19118" LastEditorUserId="8499" LastEditDate="2018-12-22T05:00:53.983" LastActivityDate="2018-12-22T05:00:53.983" Title="Named ACL Configuration" Tags="|cisco|acl|gns3|lab|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23973" PostTypeId="2" ParentId="23971" CreationDate="2015-11-01T19:05:06.323" Score="1" Body="&lt;p&gt;Cisco routers can be configured to support RSVP. RSVP would need to be configured on all the routers in a path from one endpoint to the other endpoint. This Cisco document may be useful to you: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfrsvp.html&quot; rel=&quot;nofollow&quot;&gt;Configuring RSVP&lt;/a&gt;, or you can search the Internet for &quot;Cisco RSVP&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once RSVP is properly configured on the routers, it is completely up to the applications and OSes on the endpoints as to whether or not it is used. This is beyond the scope of this site.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-01T19:05:06.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23975" PostTypeId="2" ParentId="23972" CreationDate="2015-11-01T19:17:12.337" Score="1" Body="&lt;p&gt;ACL placement is important, and the ACL design is dependent on whether it is inbound or outbound.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general rule for ACL placement is that extended ACLs should be placed as close to the traffic source as possible, and standard ACLs should be placed as close to the traffic destination as possible. If you think about the contents of the ACLs and how they work, this makes sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changing the location or direction of the ACL is something that you normally don't want to do without changing the ACL itself.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-01T19:17:12.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23976" PostTypeId="2" ParentId="23959" CreationDate="2015-11-01T19:23:15.593" Score="38" Body="&lt;p&gt;The reasoning behind your current setup is probably some combination of the following three reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VPN is a security solution for outside your company's network &lt;strong&gt;&lt;em&gt;(See #1 below)&lt;/em&gt;&lt;/strong&gt;. SSH however, might be a second layer of security outside of your company's network... but its main purpose is to secure the traffic within your company's network &lt;strong&gt;&lt;em&gt;(See #2 Below)&lt;/em&gt;&lt;/strong&gt;.  VPN is also necessary if the device you are trying to SSH into is using a private address on your companies network &lt;strong&gt;&lt;em&gt;(See #3 below)&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;VPN creates the tunnel to your company network that you push data through.  Thus no one seeing the traffic between you and your company's network can actually see what you're sending.  All they see is the tunnel.  This prevents people that are outside the company network from intercepting your traffic in a way that is useful.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;SSH is an encrypted way of connecting to devices on your network (as opposed to Telnet, which is clear text).  Companies often require SSH connections even on a company network for security sake.  If I have installed malware on a network device and you &lt;strong&gt;telnet&lt;/strong&gt; into that device (even if you're coming through a VPN tunnel - as the VPN tunnel usually terminates at the perimeter of a company's network), I can see your username and password.  If it's SSH you're using, then I cannot.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If your company is using private addressing for the internal network, then the device you are connecting to may not be rout-able over the internet.  Connecting via a VPN tunnel would be like you are directly connected in the office, therefore you would use the internal routing of the company network that would not be reachable outside of the company network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="18849" LastActivityDate="2015-11-01T19:23:15.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23979" PostTypeId="2" ParentId="23959" CreationDate="2015-11-01T20:31:59.447" Score="4" Body="&lt;p&gt;You need the VPN to get into the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't then &lt;em&gt;need&lt;/em&gt; to secure your connection to individual servers, as it'll already be encrypted by the VPN link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, how else would you connect to them? SSH is the &lt;em&gt;de facto&lt;/em&gt; console access protocol for remote servers; installing and configuring an unsecure one would be an additional management overhead, and decrease security &lt;em&gt;within&lt;/em&gt; the local network (which may or may not be a problem).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't forget, not everybody even within the company will have total access to every server, and the ability to use key-based encryption even within the local network allows your network administrator to easily and securely ensure that only people who ostensibly know what they are doing, even within the company, are allowed to touch the server.&lt;/p&gt;&#xA;" OwnerUserId="13256" LastActivityDate="2015-11-01T20:31:59.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23980" PostTypeId="2" ParentId="23959" CreationDate="2015-11-01T20:35:37.910" Score="24" Body="&lt;p&gt;SSH is an extremely popular target for brute-forcing attempts. If you have an SSH server directly on the Internet, within minutes, you will see login attempts with all kinds of user names (and passwords) - often thousands per day even on small insignificant servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now it is possible to harden SSH servers (the main three mechanisms are requiring an SSH key, denying root access to SSH, and if possible restricting the IP addresses that are even allowed to connect). Still, the best way of hardening an SSH server is to not even have it available on the Internet at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does it matter? After all, SSH is fundamentally secure, right? Well, yes, but it is only as secure as users make it - and your employer may well be concerned about weak passwords, and SSH keys being stolen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding a VPN adds an extra layer of defense that is controlled at the corporate level, instead of at the individual-server level as SSH is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, I would commend your employer on implementing some good security practices here. At the expense of convenience, of course (security usually comes at the expense of convenience).&lt;/p&gt;&#xA;" OwnerUserId="17317" LastActivityDate="2015-11-01T20:35:37.910" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="23981" PostTypeId="2" ParentId="23959" CreationDate="2015-11-01T21:49:19.703" Score="4" Body="&lt;p&gt;You can drive additional layers of security through the VPN as well.  Such as device criteria checks, 2 factor authentication,  etc.  &lt;/p&gt;&#xA;" OwnerUserId="20015" LastActivityDate="2015-11-01T21:49:19.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23983" PostTypeId="1" AcceptedAnswerId="23984" CreationDate="2015-11-01T23:38:37.357" Score="3" ViewCount="747" Body="&lt;p&gt;I'm trying to understand the contents of an ARP packet and the request/reply exchange from a Data Communications textbook and one example just doesn't make sense to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an example that states that an ARP packet request will look like this (assuming both devices are on the same network):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Jwfqs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Jwfqs.png&quot; alt=&quot;ARP Request&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes perfect sense based on the information in the book. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The example then goes on to state that the reply would look like this (same assumptions):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9hQPR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9hQPR.png&quot; alt=&quot;ARP Reply&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would the destination protocol address be the same as the source protocol address in the reply packet? I feel like the destination address should be &lt;strong&gt;IP 1&lt;/strong&gt; but my book says otherwise in the example. My book unfortunately does not explain why it thinks the destination address is &lt;strong&gt;IP 2&lt;/strong&gt; in the reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is my book correct? If so, why?&lt;/p&gt;&#xA;" OwnerUserId="20202" LastEditorUserId="8499" LastEditDate="2018-12-22T05:02:06.670" LastActivityDate="2018-12-23T15:31:23.153" Title="Should the source and destination protocol addresses be the same in an ARP reply packet?" Tags="|protocol-theory|arp|rfc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23984" PostTypeId="2" ParentId="23983" CreationDate="2015-11-01T23:59:18.733" Score="1" Body="&lt;p&gt;When in doubt, the RFC which creates the protocol usually has the answer. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 826, An Ethernet Address Resolution Protocol&lt;/a&gt; has a description of what happens when a host receives an ARP request, including the rationale for why it is done the way it is. It says that you, &amp;quot;&lt;em&gt;Swap hardware and protocol fields, putting the local hardware and protocol addresses in the sender fields.&lt;/em&gt;&amp;quot; Some may interpret this to mean that you only change the sender fields, while other may think that swap means swap. This is how you get conflicting information and implementation of these protocols. Often a succeeding RFC will come out to explain which direction is the correct one. In this case, ARP is really a layer-2 communication, so the destination IP address isn't really the issue in a reply because the reply is back to the requesting layer MAC address, and it is not passed back up the stack to layer-3.&lt;/p&gt;&#xA;&lt;p&gt;By the way, it doesn't matter if both devices are in the same subnet since a PC should never ARP for an IP address not in its subnet; it will send an ARP for the configured gateway IP address, instead of a destination IP address not in its subnet.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;h2&gt;Packet Reception:&lt;/h2&gt;&#xA;&lt;p&gt;When an address resolution packet is received, the receiving Ethernet&#xA;module gives the packet to the Address Resolution module which goes&#xA;through an algorithm similar to the following. Negative conditionals&#xA;indicate an end of processing and a discarding of the packet.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;?Do I have the hardware type in ar$hrd? Yes: (almost definitely)  &#xA;[optionally check the hardware length ar$hln]   ?Do I speak the&#xA;protocol in ar$pro?   Yes:&#xA;    [optionally check the protocol length ar$pln]&#xA;    Merge_flag := false&#xA;    If the pair &amp;lt;protocol type, sender protocol address&amp;gt; is&#xA;        already in my translation table, update the sender&#xA;        hardware address field of the entry with the new&#xA;        information in the packet and set Merge_flag to true.&#xA;    ?Am I the target protocol address?&#xA;    Yes:&#xA;      If Merge_flag is false, add the triplet &amp;lt;protocol type,&#xA;          sender protocol address, sender hardware address&amp;gt; to&#xA;          the translation table.&#xA;      ?Is the opcode ares_op$REQUEST?  (NOW look at the opcode!!)&#xA;      Yes:&#xA;        Swap hardware and protocol fields, putting the local&#xA;            hardware and protocol addresses in the sender fields.&#xA;        Set the ar$op field to ares_op$REPLY&#xA;        Send the packet to the (new) target hardware address on&#xA;            the same hardware on which the request was received.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Notice that the &amp;lt;protocol type, sender protocol address, sender&#xA;hardware address&amp;gt; triplet is merged into the table before the opcode&#xA;is looked at.  This is on the assumption that communcation is&#xA;bidirectional; if A has some reason to talk to B, then B will probably&#xA;have some reason to talk to A.  Notice also that if an entry already&#xA;exists for the &amp;lt;protocol type, sender protocol address&amp;gt; pair, then the&#xA;new hardware address supersedes the old one.  Related Issues gives&#xA;some motivation for this.&lt;/p&gt;&#xA;&lt;p&gt;Generalization:  The ar$hrd and ar$hln fields allow this protocol and&#xA;packet format to be used for non-10Mbit Ethernets.  For the 10Mbit&#xA;Ethernet &amp;lt;ar$hrd, ar$hln&amp;gt; takes on the value &amp;lt;1, 6&amp;gt;.  For other&#xA;hardware networks, the ar$pro field may no longer correspond to the&#xA;Ethernet type field, but it should be associated with the protocol&#xA;whose address resolution is being sought.&lt;/p&gt;&#xA;&lt;h2&gt;Why is it done this way??&lt;/h2&gt;&#xA;&lt;p&gt;Periodic broadcasting is definitely not desired.  Imagine 100&#xA;workstations on a single Ethernet, each broadcasting address&#xA;resolution information once per 10 minutes (as one possible set of&#xA;parameters).  This is one packet every 6 seconds.  This is almost&#xA;reasonable, but what use is it?  The workstations aren't generally&#xA;going to be talking to each other (and therefore have 100 useless&#xA;entries in a table); they will be mainly talking to a mainframe, file&#xA;server or bridge, but only to a small number of other workstations&#xA;(for interactive conversations, for example). The protocol described&#xA;in this paper distributes information as it is needed, and only once&#xA;(probably) per boot of a machine.&lt;/p&gt;&#xA;&lt;p&gt;This format does not allow for more than one resolution to be done in&#xA;the same packet.  This is for simplicity.  If things were multiplexed&#xA;the packet format would be considerably harder to digest, and much of&#xA;the information could be gratuitous.  Think of a bridge that talks&#xA;four protocols telling a workstation all four protocol addresses,&#xA;three of which the workstation will probably never use.&lt;/p&gt;&#xA;&lt;p&gt;This format allows the packet buffer to be reused if a reply is&#xA;generated; a reply has the same length as a request, and several of&#xA;the fields are the same.&lt;/p&gt;&#xA;&lt;p&gt;The value of the hardware field (ar$hrd) is taken from a list for this&#xA;purpose.  Currently the only defined value is for the 10Mbit Ethernet&#xA;(ares_hrd$Ethernet = 1).  There has been talk of using this protocol&#xA;for Packet Radio Networks as well, and this will require another value&#xA;as will other future hardware mediums that wish to use this protocol.&lt;/p&gt;&#xA;&lt;p&gt;For the 10Mbit Ethernet, the value in the protocol field (ar$pro) is&#xA;taken from the set ether_type$.  This is a natural reuse of the&#xA;assigned protocol types.  Combining this with the opcode (ar$op) would&#xA;effectively halve the number of protocols that can be resolved under&#xA;this protocol and would make a monitor/debugger more complex (see&#xA;Network Monitoring and Debugging below).  It is hoped that we will&#xA;never see 32768 protocols, but Murphy made some laws which don't allow&#xA;us to make this assumption.&lt;/p&gt;&#xA;&lt;p&gt;In theory, the length fields (ar$hln and ar$pln) are redundant, since&#xA;the length of a protocol address should be determined by the hardware&#xA;type (found in ar$hrd) and the protocol type (found in ar$pro).  It is&#xA;included for optional consistency checking, and for network monitoring&#xA;and debugging (see below).&lt;/p&gt;&#xA;&lt;p&gt;The opcode is to determine if this is a request (which may cause a&#xA;reply) or a reply to a previous request.  16 bits for this is&#xA;overkill, but a flag (field) is needed.&lt;/p&gt;&#xA;&lt;p&gt;The sender hardware address and sender protocol address are absolutely&#xA;necessary.  It is these fields that get put in a translation table.&lt;/p&gt;&#xA;&lt;p&gt;The target protocol address is necessary in the request form of the&#xA;packet so that a machine can determine whether or not to enter the&#xA;sender information in a table or to send a reply.  It is not&#xA;necessarily needed in the reply form if one assumes a reply is only&#xA;provoked by a request.  It is included for completeness, network&#xA;monitoring, and to simplify the suggested processing algorithm&#xA;described above (which does not look at the opcode until AFTER putting&#xA;the sender information in a table).&lt;/p&gt;&#xA;&lt;p&gt;The target hardware address is included for completeness and network&#xA;monitoring.  It has no meaning in the request form, since it is this&#xA;number that the machine is requesting.  Its meaning in the reply form&#xA;is the address of the machine making the request. In some&#xA;implementations (which do not get to look at the 14.byte ethernet&#xA;header, for example) this may save some register shuffling or stack&#xA;space by sending this field to the hardware driver as the hardware&#xA;destination address of the packet.&lt;/p&gt;&#xA;&lt;p&gt;There are no padding bytes between addresses.  The packet data should&#xA;be viewed as a byte stream in which only 3 byte pairs are defined to&#xA;be words (ar$hrd, ar$pro and ar$op) which are sent most significant&#xA;byte first (Ethernet/PDP-10 byte style).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-11-02T00:24:32.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23985" PostTypeId="1" CreationDate="2015-11-02T00:46:54.920" Score="6" ViewCount="2741" Body="&lt;p&gt;In MPLS VPN network, which one is the first thing to do? I mean label tagging is first or VPN encapsulation is first? If you can, please explain about this case.&lt;/p&gt;&#xA;" OwnerUserId="20207" LastActivityDate="2019-02-08T17:22:47.137" Title="In MPLS VPN, Which one become first? MPLS Label tag or VPN encapsulation?" Tags="|vpn|mpls|network-core|mpls-vpn|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="23987" PostTypeId="1" AcceptedAnswerId="23989" CreationDate="2015-11-02T01:02:44.753" Score="4" ViewCount="11126" Body="&lt;p&gt;What does this picture describe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/E8Fra.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fa0/0 == Fast Ethernet port 0/0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fa0/1 == Fast Ethernet port 0/1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0/24 == IP Address of the PC of the bottom left.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.2.0/24 == IP Address of the PC of the bottom right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.0.0/24 == Why is there only one IP Address between the routers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.1,  .2 == What are these values? Are they fractions or what?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;S 0/0/0 == What does it mean? 0/0 port of Slot 0? Then why does 0/0 port of Slot 1 is written as 0/1/0?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DTE == Terminal?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DCE == Modem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are 'Terminal' and 'Modem' information necessary?&lt;/p&gt;&#xA;" OwnerDisplayName="user15062" LastEditorUserId="8499" LastEditDate="2015-11-02T01:49:49.883" LastActivityDate="2021-06-24T15:53:37.387" Title="What does this picture describe?" Tags="|router|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23989" PostTypeId="2" ParentId="23987" CreationDate="2015-11-02T01:17:41.443" Score="4" Body="&lt;p&gt;&lt;code&gt;Fa0/0&lt;/code&gt; is the FastEthernet interface on slot 0, port 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Fa0/1&lt;/code&gt; is the FastEthernet interface on slot 0, port 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The addresses &lt;code&gt;192.168.1.0/24&lt;/code&gt;, &lt;code&gt;192.168.0.0/24&lt;/code&gt;, and &lt;code&gt;162.168.2.0/24&lt;/code&gt; are address prefixes representing the subnets used on the respective link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;.1&lt;/code&gt; and &lt;code&gt;.2&lt;/code&gt; mean the specific addresses on that subnet (e.g. the &lt;code&gt;.1&lt;/code&gt; on the &lt;code&gt;192.168.1.0/24&lt;/code&gt; subnet means the &lt;code&gt;192.168.1.1&lt;/code&gt; address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;S0/0/0&lt;/code&gt; means the serial interface on slot 0, card 0, port 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;DTE&lt;/code&gt; means Data Terminal Equipment and &lt;code&gt;DCE&lt;/code&gt; means Data Communications Equipment. Basically, serving the same purpose as male and female connectors; male connects to female, not another male. The DTE/DCE information is necessary for the configuration of the interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-02T01:17:41.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23990" PostTypeId="1" CreationDate="2015-11-02T01:39:51.967" Score="2" ViewCount="648" Body="&lt;p&gt;I see some mobile operators mentioned LTE and some are mentioning LTE with band 4. What is the difference between those two ?&lt;/p&gt;&#xA;" OwnerUserId="20208" LastActivityDate="2015-11-03T09:32:50.860" Title="what is the difference between LTE and LTE Band 4?" Tags="|mobile|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23991" PostTypeId="2" ParentId="22971" CreationDate="2015-11-02T02:25:39.510" Score="2" Body="&lt;p&gt;First a quick note on terminology. The Ethernet standards don't use the terms &quot;hub&quot; and &quot;switch&quot;. What the market calls a hub is a multi-port repeater according to the standards and what the market calls a switch is a multi-port bridge according to the standards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10BASE5 and 10BASE2 coaxial Ethernet used CSMA/CD to manage collisions on the coaxial cable segment. Repeaters could be used to join multiple segments. Repeaters were dumb low level devices, they had no packet buffers and were designed to ensure that if a collision happened on any connected segment it would be seen on every connected segment. This meant detecting collisions and when a collision was detected (either with the repeater or otherwise) on one port a &quot;JAM signal&quot; would be output to the other ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bridges on the other hand operate at a higher level. They work with complete frames and have no need to repeat collisions between ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10BASE-T and 100BASE-TX have separate pairs for transmit and receive. With 1000BASE-T things get more complicated but fundamentally there is still a separate data channel in each direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These standards can operate in two modes known as &quot;half duplex&quot; and &quot;full duplex&quot;. In half duplex mode the twisted pair cable essentially acts as a virtual coaxial cable. If transmission and reception happen at the same time then it is treated a collision even though no signals collided on the wire. The Ethernet controllers use CSMA/CD just as they would on a coaxial cable. Repeaters (hubs) forward collisions to other segments just as they did with coaxial Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In full duplex mode transmission is allowed to happen in both directions at the same time and CSMA/CD is not used. Repeaters (hubs) cannot be used on links running in full duplex mode because they would have no way of handling conflicting transmissions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is important that both ends of a link are in the same duplex mode. If one end is set to full duplex while the other end is set to half duplex there will be massive packet loss and essentially unusable network performance. Nowadays this is normally handled through auto-negotiation but the system isn't perfect. In particular there are likely to be problems if one end is set to forced full duplex and the other end is set to autonegotiate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a modern network the vast majority of links should be running in full duplex mode. CSMA/CD should normally only be used on links to legacy equipment.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2015-12-02T07:17:22.503" LastActivityDate="2015-12-02T07:17:22.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23992" PostTypeId="2" ParentId="7809" CreationDate="2015-11-02T04:16:21.067" Score="1" Body="&lt;p&gt;Given your comment that it's that it's stranded then i'd suggest going with two plugs and a coupler. If you want to run high speeds then getting a coupler that is actually cat5e rated rather than a generic RJ45 coupler with no internal impedance control is probablly a good idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Punch down connections are only suitable for solid cable. Soldering and heatshrinking is possible but will create an impedance bump which may cause issues at higher speeds. The jelly connectors that telephone companies use will likely create an even bigger impedance bump than carefully applied solder/heatshrink and are also unisuitable for stranded cable.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-11-02T04:16:21.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23993" PostTypeId="1" AcceptedAnswerId="24015" CreationDate="2015-11-02T04:38:40.400" Score="3" ViewCount="190" Body="&lt;p&gt;Can HTTP be used with SSH ? If yes, why has it not been as popular as HTTP over SSL ?&lt;/p&gt;&#xA;" OwnerUserId="4339" LastEditorUserId="8499" LastEditDate="2018-02-16T04:03:05.717" LastActivityDate="2018-02-16T04:03:05.717" Title="Why http + ssh is not popular?" Tags="|ssh|" AnswerCount="2" CommentCount="4" ClosedDate="2015-11-02T20:24:41.227" ContentLicense="CC BY-SA 3.0" />
  <row Id="23994" PostTypeId="2" ParentId="6740" CreationDate="2015-11-02T05:21:47.290" Score="4" Body="&lt;p&gt;1500 bytes is the standard MTU for Ethernet. Lots of Ethernet hardware now supports larger limits but unfortunately there is no standard for handling segments with mixed MTUs on a single vlan. So increasing the MTU from the default of 1500 bytes means that you have to make sure every device on the vlan is both capable and configured to support the larger size. That is a massive PITA.&lt;/p&gt;&#xA;&lt;p&gt;For the most part the gain of running jumbo frames doesn't outweigh the pain. Some exceptions are networks that are used to carry tunneled traffic and HPC/SAN networks but those kinds of specialist high performance networks don't tend to cross organization boundaries.&lt;/p&gt;&#xA;&lt;p&gt;There is no reason two autonomous systems can't make an arrangement to exchange packets larger than 1500 bytes but few do because it's normally not worth the cost/hassle to allow exchange of larger packets with a small number of networks (there is something of a chicken and egg situation here too).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2020-12-18T09:37:10.817" LastActivityDate="2020-12-18T09:37:10.817" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="23996" PostTypeId="1" CreationDate="2015-11-02T07:22:16.997" Score="1" ViewCount="23438" Body="&lt;p&gt;I am new to IT, and I want to login to a Fortigate 60D firewall, but I don't know the password. How do I reset the firewall password without resetting the firewall.&lt;/p&gt;&#xA;" OwnerUserId="20218" LastEditorUserId="8499" LastEditDate="2015-11-02T14:20:20.637" LastActivityDate="2017-03-06T07:19:47.437" Title="How do I reset a Fortigate firewall password without resetting the firewall" Tags="|firewall|fortigate|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-12T20:44:06.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="23997" PostTypeId="2" ParentId="23996" CreationDate="2015-11-02T07:34:43.297" Score="6" Body="&lt;p&gt;Hey you could have just googled that and the first link is your answer. &lt;a href=&quot;http://docs.fortinet.com/uploaded/files/1708/Resetting_a_lost_admin_password.pdf&quot;&gt;Here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do some research before asking please.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the steps in short:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;connect to the fgt with a com cable, if not com port then use USB cable with fortiexplorer. Start the console.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;reboot the device and wait for it to ask for the username&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Type in the username: &lt;code&gt;maintainer&lt;/code&gt; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The password is bcpb+ the serial number of  the firewall (letters of the serial number are in UPPERCASE format) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Example:bcpbFGT60C3G10016011&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note:&#xA;On some devices, after the device boots, you have only 14 seconds or less to type in the username and password. It might, therefore, be necessary to have the credentials ready in a text editor, and then copy and paste them into the login screen. There is no indicator of when your time runs out so it is possible that it might take more than one attempt to succeed.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Once logged reset your admin password using:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;config system admin&#xA;edit admin&#xA;set password &amp;lt;psswrd&amp;gt;&#xA;end&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="15569" LastEditorUserId="15569" LastEditDate="2015-11-02T09:29:15.743" LastActivityDate="2015-11-02T09:29:15.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="23998" PostTypeId="2" ParentId="23940" CreationDate="2015-11-02T07:39:28.000" Score="0" Body="&lt;p&gt;You can go for small business firewalls as mentioned above or even do some RND and install a open source firewall OS and create yourself a firewall box. You can use pfsense or any other open source thing, just google for it. Also do confirm whatever you choose can block https websites as well.&lt;/p&gt;&#xA;" OwnerUserId="15569" LastActivityDate="2015-11-02T07:39:28.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="23999" PostTypeId="2" ParentId="23993" CreationDate="2015-11-02T08:24:22.130" Score="2" Body="&lt;p&gt;The purpose of TLS/SSL is to provide security (via key exchange, encryption, and digital signature) between two applications.  As such, it is quite agnostic concerning the protocol used by these two applications to communicate.  It is intended as a security layer to support pre-existing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, SSH was conceived as a complete protocol to connect securely to a shell on a remote server and replace insecure protocols such as telnet, rlogin, rsh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although there are protocols (such as SCP) that run over SSH, TLS/SSL is more flexible, complete, and lightweight to be used as a security layer than SSH.  It is also worth noting that HTTPS (i.e. HTTP over TLS/SSL) was invented in 1994, well one year before SSH.&lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2015-11-02T08:24:22.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24000" PostTypeId="5" CreationDate="2015-11-02T08:44:42.810" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2015-11-02T08:44:42.810" LastActivityDate="2015-11-02T08:44:42.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24001" PostTypeId="4" CreationDate="2015-11-02T08:44:42.810" Score="0" Body="SSL (more precisely TLS/SSL) is a suite of cryptographic protocols designed to provide security over network communications." OwnerUserId="19543" LastEditorUserId="19543" LastEditDate="2015-11-02T21:52:38.620" LastActivityDate="2015-11-02T21:52:38.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24002" PostTypeId="2" ParentId="23990" CreationDate="2015-11-02T09:14:39.527" Score="5" Body="&lt;p&gt;LTE is a standard for building a mobile network. It lists the available bands on which to operate on and Band 4 is one of those bands. See &lt;a href=&quot;https://en.wikipedia.org/wiki/E-UTRA#Frequency_bands_and_channel_bandwidths&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/E-UTRA#Frequency_bands_and_channel_bandwidths&lt;/a&gt; for a full list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone mentions only &quot;LTE&quot; than the band is not specified but you can look up which bands are in used by a specific operator in a given country on &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_LTE_networks&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/List_of_LTE_networks&lt;/a&gt;. For example, where I live (Sweden), that would be band 3, 7, 8 and 20 for my operator but no-one ever refers to it as &quot;LTE with band 3,7,8 and 20&quot;, it's just called &quot;4G&quot; or &quot;LTE&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There could be a few different reasons for specifically mentioning the support of a band. If it is from a representative of the mobile operator it is likely they perceive it as a selling point. Lower frequencies have lower attenuation and therefore propagate further enabling better coverage. Higher frequencies are usually handed out in larger blocks so to enable higher throughput. Note how 20MHz of 900MHz spectra will enable the same speed as a 20MHz block in the 2600MHz band.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another reason, however a bit unlikely to be pitched by a operator representative, is that certain bands are less commonly supported on handsets, so you might want to check that the device you intend to use support the bands that the operator is using.&lt;/p&gt;&#xA;" OwnerUserId="672" LastEditorUserId="672" LastEditDate="2015-11-03T09:32:50.860" LastActivityDate="2015-11-03T09:32:50.860" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24003" PostTypeId="1" CreationDate="2015-11-02T09:25:05.873" Score="-1" ViewCount="60" Body="&lt;p&gt;I've been stress testing my application now and I've identified a high average network connection time. This is odd because I haven't gone over the max bandwith at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can this be caused by? Have I gone over the &quot;max thread limit&quot; on the router/network if there is such a thing? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not good at networking at all so all help is greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="20220" LastActivityDate="2015-11-02T17:22:55.467" Title="Do routers and networks have have a &quot;max threads&quot; configuration?" Tags="|cisco|router|testing|" AnswerCount="2" CommentCount="1" ClosedDate="2015-11-02T20:25:21.093" ContentLicense="CC BY-SA 3.0" />
  <row Id="24004" PostTypeId="2" ParentId="20631" CreationDate="2015-11-02T09:38:09.933" Score="0" Body="&lt;p&gt;Finally I found the issue, which was quite a stupid moment... The problem was the MTU of the link combined with many 1514byte packets in the PCAP with the DF bit set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PCAP file was recorded at a normal Ethernet connection. In this particular time frame, there were several large packets with 1514 bytes each and the Do Not Fragment (DF) bit set. During the troubleshooting process, I replaced the MX80 with a Cisco ASR10002-f router, and used &lt;code&gt;show ip cef switching statistics&lt;/code&gt; which in turn shows a high counter for &lt;code&gt;RP LES Fragmentation failed, DF&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After knowing this I modified the PCAP and truncated the packet in sizes below 1500, and the problem was gone.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2015-11-02T09:38:09.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24008" PostTypeId="1" AcceptedAnswerId="24011" CreationDate="2015-11-02T13:39:43.987" Score="4" ViewCount="24499" Body="&lt;p&gt;I have seen the use of both terms. Are they the same thing or are there any differences between them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen the use of &quot;server name&quot; on this &lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_hosting&quot; rel=&quot;nofollow&quot;&gt;Wikipedia page&lt;/a&gt; and on this &lt;a href=&quot;https://answers.yahoo.com/question/index?qid=20071201064530AAjdnGe&quot; rel=&quot;nofollow&quot;&gt;Yahoo Answers page&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="19156" LastEditorUserId="19156" LastEditDate="2015-11-02T13:51:26.567" LastActivityDate="2015-11-03T03:07:35.403" Title="Is host name and server name the same thing?" Tags="|terminology|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24009" PostTypeId="2" ParentId="23959" CreationDate="2015-11-02T14:00:50.847" Score="2" Body="&lt;p&gt;Typical reasoning is that you want to reduce the exposure and possible attack vectors as far as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you begin from the premise that both SSH and VPN are required (for their own purposes), then have both externally facing means that attackers have two potential routes into your environment. If you make SSH local-only it adds an additional layer to the security of the server. Consider the following scenarios:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;SSH + VPN externally. Attacker needs only compromise SSH to compromise the server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;SSH external. Functionally the same as the previous scenario.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;VPN external (SSH internal). Doubles up on security. Attacker must break through both before they can do anything to the server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Consider that alongside the fact that VPN would be nessecary for other functions, and may be better configured for external access and it's a no-brainer.&lt;/p&gt;&#xA;" OwnerUserId="20228" LastActivityDate="2015-11-02T14:00:50.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24010" PostTypeId="1" AcceptedAnswerId="24013" CreationDate="2015-11-02T14:14:55.107" Score="3" ViewCount="344" Body="&lt;p&gt;&lt;a href=&quot;http://www.cidr-report.org/cgi-bin/as-report?as=AS50999&amp;amp;v=4&amp;amp;view=2.0&quot; rel=&quot;nofollow&quot;&gt;http://www.cidr-report.org/cgi-bin/as-report?as=AS50999&amp;amp;v=4&amp;amp;view=2.0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the announced prefixes section, you can see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Prefix               AS Path                              Aggregation Suggestion&#xA; 109.171.128.0/17     6939 6762 48237 35819 50999  &#xA; 109.171.128.0/18     4777 2497 3356 50999   &#xA; 109.171.128.0/21     6939 1299 3356 50999 + Announce - aggregate of 109.171.128.0/22 (6939 1299 3356 50999) and 109.171.132.0/22 (6939 1299 3356 50999)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So every row is a group of IP addresses from this AS (autonomous system).&#xA;If someone from outside wants to communicate with an IP from that group, it needs to go enter that AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, so far I thought every AS consists of BGP routers. If they want to communicate with a different AS, they look in the routing table and check the AS PATH attribute of the specified subnet. This way, they know which AS to talk to to reach the destination AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this in mind, what's the meaning of AS Path attribute from the quote above? It looks like the AS stores information about how others can reach it, and 'broadcasts' that information to others, using BGP protocol. Is that right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, some of the addresses on that site are marked green or red. Any idea what does that mean?&lt;/p&gt;&#xA;" OwnerUserId="20229" LastActivityDate="2015-11-02T19:05:56.033" Title="What information does AS PATH contain in this case?" Tags="|routing|bgp|protocol-theory|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24011" PostTypeId="2" ParentId="24008" CreationDate="2015-11-02T14:43:01.343" Score="3" Body="&lt;p&gt;&lt;strong&gt;hostname&lt;/strong&gt; is the correct term when referring to the name of a machine, as opposed to its IP address.  From Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In computer networking, a hostname (archaically nodename) is a&#xA;  label that is assigned to a device connected to a computer network and&#xA;  that is used to identify the device in various forms of electronic&#xA;  communication such as the World Wide Web, e-mail or Usenet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With &quot;server name&quot; or &quot;machine name&quot; it is intended, well, the name (hostname) of the server or the machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the hostname (e.g. &lt;code&gt;jupiter&lt;/code&gt;) usually doesn't include the domain name (e.g. &lt;code&gt;example.org&lt;/code&gt;). Together, they form a FQDN (Fully Qualified Domain Name): &lt;code&gt;jupiter.example.org&lt;/code&gt;. This is the most precise usage. &lt;br&gt;However, for instance when talking about the World Wide Web as in the Wikipedia page you linked, &lt;code&gt;jupiter.example.org&lt;/code&gt; is often called (somehow incorrectly) an hostname.&lt;br&gt;&#xA;In the Yahoo question you linked, they're synonyms.&lt;/p&gt;&#xA;" OwnerUserId="19543" LastEditorUserId="19543" LastEditDate="2015-11-02T15:01:25.723" LastActivityDate="2015-11-02T15:01:25.723" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24012" PostTypeId="2" ParentId="24010" CreationDate="2015-11-02T14:55:58.330" Score="1" Body="&lt;p&gt;The AS_Path attribute shows the hops (ASes through which the traffic must travel) to reach the the prefix. This attribute is one of several which BGP may use to determine the best path to reach that prefix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The prefixes in red indicate that the prefix was withdrawn, and the ones in green indicate a new prefix announcement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP doesn't broadcast anything, it uses TCP to connect to specifically configured neighbors.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-02T15:00:40.487" LastActivityDate="2015-11-02T15:00:40.487" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24013" PostTypeId="2" ParentId="24010" CreationDate="2015-11-02T14:58:46.970" Score="1" Body="&lt;p&gt;You seem to have some misconceptions about BGP operation.  Routing works the same regardless of the protocol -- the router looks up the destination address, finds the best (longest) match, and then forwards that packet to the next hop router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AS PATH is one of BGP's metrics for choosing a particular path over other matching ones.   The AS PATH you see is the list of ASes to get to the destination network, from the point of view of the website you linked to (Univ of Delaware).  The AS PATH will be different from the point of view of other ASes.  You can look at others from &lt;a href=&quot;http://www.bgp4.as/looking-glasses&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the website explains, the green routes have been added and the red ones withdrawn since the last report.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-11-02T19:05:56.033" LastActivityDate="2015-11-02T19:05:56.033" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24014" PostTypeId="2" ParentId="24008" CreationDate="2015-11-02T15:05:55.950" Score="4" Body="&lt;p&gt;&quot;Hostname&quot; is used specifically in the context of the TCP/IP suite.  Other protocols or operating systems (MS Windows) often use the term &quot;server name.&quot;  So for example, a device could be referred to by its Server Name in Windows, but by its Hostname using DNS.  The names can be different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often the two terms are used interchangeably.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-02T15:05:55.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24015" PostTypeId="2" ParentId="23993" CreationDate="2015-11-02T15:08:10.923" Score="4" Body="&lt;p&gt;If we ignore all the cryptography involved in the Confidentiality and Integrity services that both of these services provide, the only main remaining difference between SSH and SSL are how they engage the concept of Authenticity.  &lt;strong&gt;Authenticity is the process of confirming the other party of the communication is indeed who they say they are&lt;/strong&gt;.  Both protocols approach this differently.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;SSL/TLS&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;SSL/TLS is primarily concerned with &lt;strong&gt;Server Authentication&lt;/strong&gt;. The client in a SSL/TLS communication is rarely authenticated (&lt;em&gt;at the SSL/TLS layer&lt;/em&gt;). For example, when you connect to your bank website over HTTPS, your browser receives a certificate from the bank which proves the bank's identity. BUT, you or your browser are never forced to provide a certificate to identify who the client is. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your bank website will probably ask you for a username and password, but understand this is happening at the HTTP layer, and after the SSL/TLS negotiation has already completed. At the SSL/TLS layer, your Bank website has &lt;em&gt;no idea&lt;/em&gt; who you are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, in the traditional mode of operation for SSL/TLS is the concept of Chain of Trust. Namely, when you receive a certificate from a Server, you only trust it because &lt;em&gt;some other entity&lt;/em&gt; vouches for the validity of said certificate. This &quot;other entity&quot; is known as a Certificate Authority (CA). If not for the CA, the Client has no way to really know whether the other party in the communication is who they say they are.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;SSH&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;SSH, on the other hand, is more concerned about &lt;strong&gt;Client Authentication&lt;/strong&gt;, but provides some measure of &lt;strong&gt;Server Authentication&lt;/strong&gt; as well, but not the same way that SSL/TLS does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you connect to a server using SSH, the server &lt;em&gt;requires&lt;/em&gt; the Client to provide a username and password (or an SSH Key) to identify whether the client has access to the particular server. This process is built into SSH itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once connected, the Server gives you an RSA identity signature, which your client can store locally as a sort of fingerprint for said server, so that in the future when the Client is connecting to the Server, he can validate the signature to ensure he is definitely connecting &lt;em&gt;to the same Server he originally connected to&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice the difference, however.  In SSH, you can connect to a server, and then ensure future connections are connected to the same server.  But the real identity of that server is never truly proved. No third party entity vouched for the Server's identity. In fact, you only know you are connected to the right Server because of your own prior knowledge of what should be on the Server. Which is to say, when you SSH to a server, you know before hand that you should expect to see a certain set of files or software on the server.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In comparison, both of these models are best suited for the purposes that each provide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SSL/TLS is best suited for a world where the Client can be anyone, but the Server's identity must be validated. In the World Wide Web, this is ideal, because you want &lt;em&gt;anyone&lt;/em&gt; to be able to access your Web Server, and you want that &quot;anyone&quot; to feel safe in knowing that they are indeed connecting to the Server they mean to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SSH is best suited for a world where the Server is known a priori, and the Client must be validated before providing access to the resource. From then on, all that matters to the Client is that they are always connecting to the same server they initially connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;&lt;em&gt;This article is written from the perspective of the typical deployments of SSH and SSL/TLS.  There are extensions to either protocol which allow for additional features, but &lt;strong&gt;they are rarely implemented&lt;/strong&gt;.  Namely, there is a method of SSL/TLS that also requires Client Authentication, known as &lt;a href=&quot;https://en.wikipedia.org/wiki/Mutual_authentication&quot; rel=&quot;nofollow&quot;&gt;Mutual Authentication&lt;/a&gt;. There is also a method of SSH that provides &lt;a href=&quot;https://www.digitalocean.com/community/tutorials/how-to-create-an-ssh-ca-to-validate-hosts-and-clients-with-ubuntu&quot; rel=&quot;nofollow&quot;&gt;Certificate Authority validation&lt;/a&gt;.&lt;/em&gt;&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-11-02T15:08:10.923" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24016" PostTypeId="2" ParentId="24010" CreationDate="2015-11-02T16:10:28.510" Score="1" Body="&lt;p&gt;The meaning of AS Path attribute on the BGP protocol is a way to the router to know how far is some network located. If you are studying BGP, i guess you are familiar with RIP, OSPF, ISIS and so on. RIP works by hops, router know how to reach network by hops, OSPF works with bandwith, with someting called cost, on the reference of the link bandwiths that the networks are connected, well, BGP works with the AS-PATH, bigger or shorter AS-PATH, is something like the way to reach some networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If some networks are marked with red and another with green, i think this is to show you what is the best i guess, here i dont see thats colors, on routers only see wich is the best, which are valid routes and that kind of stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you can fin how BGP makes a selection of the best route to work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On your reading, you will see where it looks the &quot;AS PATH&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, on reference to &quot;broadcast to his neighbors&quot;,.. remember, broadcast is the mechanins to send the same info to all equipments in SOME NETWORK. BGP neighbors are mainly on different network, but if you want to say that the router send learned networks to other BGP neighbors, the you are rigth.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-11-02T16:10:28.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24017" PostTypeId="1" CreationDate="2015-11-02T16:36:40.360" Score="5" ViewCount="6719" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ouPJS.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ouPJS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;APP 1 sends data to APP 2 over a TCP connection through an IP network. The one-way delay is 10ms. The TCP connection bandwidth is 100 Mbps. The system starts up with a WINDOW set at 4,000 bytes.Thereafter, APP 2 will advertise to the sender APP 1 a WINDOW of 4,000 bytes on top of an acknowledge. APP 2 maintains a buffer of 16,000 bytes, and it can consume the received data at a rate of 200,000 bytes/sec. How do I calculate its throughput?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;RCV buffer size / RTT = Max TCP throughput&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RTT = 2 * 10ms = 20 * 10^-3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The WINDOW size can be increased to 16,000 bytes. So 16,000 bytes is the RCV buffer size?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, throughput = (16,000 * 8)/(20 * 10^-3) / 8 = 800,000 bytes/sec.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this result is larger than the consumption rate of APP 2. It seems so odd. If 16,000 is replaced by 4,000, the answer is 200,000. Does this seem normal?&lt;/p&gt;&#xA;" OwnerUserId="20231" LastEditorUserId="20231" LastEditDate="2015-11-02T17:00:37.490" LastActivityDate="2021-08-18T15:41:34.410" Title="How to determine the throughput of the TCP connection?" Tags="|tcp|throughput|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24018" PostTypeId="2" ParentId="24003" CreationDate="2015-11-02T17:06:05.000" Score="0" Body="&lt;p&gt;It's impossible to say to give you a definitive answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router is like a computer. If you throw a big workload at a cheap, home grade one you're likely to hit its limits. However, if you use a suitably sized one it will have no issues doing what you need. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words although your router doesn't seem to be able to handle your applications load it does not mean that everyone else's router would struggle too.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-11-02T17:06:05.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24019" PostTypeId="2" ParentId="24003" CreationDate="2015-11-02T17:22:55.467" Score="2" Body="&lt;p&gt;You may be confused about something. You application may create threads for execution on your PC, but routers switch packets one at a time, regardless of what came before, and routers have no expectation that anything is coming in the future. Each packet is handled as an individual packet to be switched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router may not be able to handle the throughput at wire speed, but it doesn't spawn threads to handle your individual traffic flows. It has to deal with serialization, buffers, routing table lookups, etc. which can overwhelm it when it starts receiving more traffic than it can handle.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-02T17:22:55.467" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24020" PostTypeId="1" AcceptedAnswerId="24021" CreationDate="2015-11-02T17:52:15.240" Score="3" ViewCount="1279" Body="&lt;p&gt;We have two offices with separate routers and Internet connections. Is it possible to connect them with a LAN cable so they can share files?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first router is at gateway 192.168.100.1 the second is at 192.168.101.1.&#xA;From what I read I will need to assign static routes in the routers. Is that all I need to do?&lt;/p&gt;&#xA;" OwnerUserId="20034" LastEditorUserId="8499" LastEditDate="2015-11-02T18:24:18.860" LastActivityDate="2015-11-03T04:54:29.387" Title="Connect two networks to share resources" Tags="|lan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24021" PostTypeId="2" ParentId="24020" CreationDate="2015-11-02T18:02:06.843" Score="2" Body="&lt;p&gt;From the perspective of the network, you need the physical connection between the two routers on a common subnet, but you also need the routers to share routes, either through a common routing protocol, or by configuring static routes. You need to make sure there are no overlapping routes, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the perspective of the computers connected to the networks, you may have a problem with DHCP. You will need to make sure that the routers only connect to each other on their own link, not the LAN of the other router. When a host requests DHCP, it will use the first DHCP response, which may end up being the wrong DHCP server if the two separate networks are connected via layer-2, not layer-3.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-02T18:02:06.843" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24027" PostTypeId="2" ParentId="20594" CreationDate="2015-11-02T23:50:07.607" Score="0" Body="&lt;p&gt;It was BPDUGuard as suggested in the comments.&lt;/p&gt;&#xA;" OwnerUserId="17208" LastActivityDate="2015-11-02T23:50:07.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24030" PostTypeId="2" ParentId="24008" CreationDate="2015-11-03T03:07:35.403" Score="-3" Body="&lt;p&gt;Switches and Routers = Hostnames = &#xA;Device name&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Systems = Server Names&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DNS = FQDN&lt;/p&gt;&#xA;" OwnerUserId="20210" LastActivityDate="2015-11-03T03:07:35.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24033" PostTypeId="1" AcceptedAnswerId="24039" CreationDate="2015-11-03T05:11:09.933" Score="3" ViewCount="717" Body="&lt;p&gt;For the last couple of months i am delving into SDN and trying to implement the application aware routing through SDN .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Application aware routing:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;SDN controller will route each application data based on the application preferences, for instance FTP traffic will forwarded through the path having higher bandwidth, while the SSH traffic which perform better in low latency will be forwarded through the path having low latency, in summary each application have their own best path from source to destination based on the nature of the traffic generated per application.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To implement this, I am using the tool called &lt;a href=&quot;http://mininet.org&quot; rel=&quot;nofollow&quot;&gt;mininet&lt;/a&gt; for the network simulation, but I am stuck on programming the controller. Up to now, based on my experience working with the mininet tool, mininet doesn't support the controller programming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to ask about using the SDN &lt;a href=&quot;http://opendaylight.org&quot; rel=&quot;nofollow&quot;&gt;Opendaylight&lt;/a&gt; Project controller for the implementation of application based routing. Has anyone implemented the application aware routing in SDN, and what was your experience on it? I would like to know which SDN tools I can use to implement the SDN based application aware routing per application preferences. &lt;/p&gt;&#xA;" OwnerUserId="10225" LastEditorUserId="8499" LastEditDate="2015-11-03T05:26:08.100" LastActivityDate="2015-11-03T10:10:57.213" Title="Application aware routing in software defined network" Tags="|routing|sdn|openflow|mininet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24034" PostTypeId="1" CreationDate="2015-11-03T05:31:17.087" Score="1" ViewCount="167" Body="&lt;p&gt;I keep reading about this impregnable illegal website network on the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for a this instance we assume that the co-operation and willingness of legal authority is not a hurdle and everything is in terms of technical designs alone.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;website servers can't be located due to use of proxies: but proxies are just a relay point which should have a record of the actual user ip that was using the proxy and even if there was a chain of proxy each proxy server should know the address of the last which will track down to the server in the end. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There are millions of server running billions of websites: still each website needs a public ip which is unique and dependent  on geological location of the server's isp and the information regarding location of the server can be procured from the isp.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;websites like pirates bay use virtual machine running on servers: that doesn't explain how it hides the actual location since virtual machine is bound to have a actual hardware for networking which even though having different ip that virtual machine is still a public ip alloted by a isp&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20250" LastActivityDate="2015-11-03T05:31:17.087" Title="Why isn't it possible to track down illegal websites?" Tags="|routing|ip|internet|" AnswerCount="0" CommentCount="3" ClosedDate="2015-11-03T06:11:47.867" ContentLicense="CC BY-SA 3.0" />
  <row Id="24038" PostTypeId="2" ParentId="9339" CreationDate="2015-11-03T10:02:41.283" Score="1" Body="&lt;p&gt;The definition of &quot;isochronous&quot; is that of something that happens at a regular interval. Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In telecommunication, an isochronous signal is a signal in which the&#xA;  time interval separating any two significant instants is equal to the&#xA;  unit interval or a multiple of the unit interval. Variations in the&#xA;  time intervals are constrained within specified limits.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A voice call is isochronous as it is transferring bits of your voice at regular intervals. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second part of the sentence&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;with a clock distribution tree radiating from a single, protected cesium reference clock.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;seems to indicate that the transport network carrying voice calls relies on a centralised clock. SDH would be an example of a technology that does rely on synchronised clocks and using caesium clocks as a source of that clock is fairly common. A Caesium clock will only give you a frequency, which is what is required for operating an SDH network. GPS could be an alternative source that would also provide absolute time, i.e. date, time of date and so forth. It's not uncommon to use both, with GPS as primary and Caesium as a backup. Using multiple clocks also allows you to detect drift (someone could attempt tampering with GPS). Without accurate clocks you will get frame slips in your SDH network effectively dropping bits in your payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, as put by Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;Isochronous&quot; is a characteristic of one signal, while &quot;synchronous&quot;&#xA;  indicates a relationship between two or more signals.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From a technical perspective perhaps the &quot;telephony network&quot; should refer to the transport network that is carrying those calls, in which case it might not be isochronous (SDH definitely isn't) but when just looking at the calls themselves they are isochronous. Regardless of underlying carrier you will have bits coming in at regular intervals, representing the audio stream, thus making the voice calls isochronous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I agree that the sentence is a bit weird but depending on your interpretation it isn't necessarily incorrect.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2015-11-03T10:02:41.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24039" PostTypeId="2" ParentId="24033" CreationDate="2015-11-03T10:10:57.213" Score="2" Body="&lt;p&gt;This is a nice idea. &lt;a href=&quot;https://www.on.uni-saarland.de/start&quot; rel=&quot;nofollow&quot;&gt;We&lt;/a&gt; are using &lt;a href=&quot;http://www.projectfloodlight.org/&quot; rel=&quot;nofollow&quot;&gt;Floodlight&lt;/a&gt; for our SDN experiments. At the point in time we started, it was much more mature than the OpenDaylight software. As this has been more than a year ago, it might not be true anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SDN offers you the following features that should be helpful to your use case:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Link parameter measurements to find such paths:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Delay&lt;/em&gt; by using customly crafted probe packets and correlate timestamps&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Loss&lt;/em&gt; can be done by sampling the port statistics&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Bandwidth&lt;/em&gt; is still something we are working on&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;As you are implementing reactive routing, you are most likely going to react on the &lt;code&gt;packet_in&lt;/code&gt; event. In this case, you have two options:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Simple&lt;/em&gt;: use the transport protocol and port to deduce the app&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Difficult&lt;/em&gt;: do some kind of deep-packet inspection to deduce the traffic type &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10219" LastActivityDate="2015-11-03T10:10:57.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24041" PostTypeId="2" ParentId="23002" CreationDate="2015-11-03T12:05:00.910" Score="1" Body="&lt;p&gt;Agree with the Sorcha's comment: if &lt;strong&gt;Router 2&lt;/strong&gt; does NAT, this will prevent pinging from &lt;strong&gt;PC 1&lt;/strong&gt; to 192.168.2.x, because NAT works as a firewall as a side effect. Your statement &lt;em&gt;&quot;Pinging from &lt;strong&gt;PC 2&lt;/strong&gt; to &lt;strong&gt;PC 1&lt;/strong&gt; works&quot;&lt;/em&gt; confirms that this is the case (that is, NAT) because after &lt;strong&gt;Router 2&lt;/strong&gt; translates ICMP message's source IP 192.168.2.100 to 192.168.1.2, &lt;strong&gt;PC 1&lt;/strong&gt; replies to 192.168.1.2, which then gets translated back to 192.168.2.100, so ping works.&#xA;Next, 192.168.1.x hosts should know a route to the 192.168.2.0 segment. This can be accomplished in several ways. If &lt;strong&gt;Router 1&lt;/strong&gt; supports static routes, configure it there and leave &lt;strong&gt;PC 1&lt;/strong&gt; and others configured with &lt;strong&gt;Router 1&lt;/strong&gt; as their default gateway. When &lt;strong&gt;Router 1&lt;/strong&gt; receives a packet from &lt;strong&gt;PC 1&lt;/strong&gt; destined to &lt;strong&gt;PC 2&lt;/strong&gt; it send the packet back through the same interface on which it has received it and possibly sends an ICMP redirect message to &lt;strong&gt;PC 1&lt;/strong&gt;. Windows hosts are able to understand this (&lt;a href=&quot;https://support.microsoft.com/en-us/kb/195686&quot; rel=&quot;nofollow&quot;&gt;https://support.microsoft.com/en-us/kb/195686&lt;/a&gt;) and start sending traffic directly through &lt;strong&gt;Router 2&lt;/strong&gt;. Another way to configure the route to the 192.168.2.0 segment is to do this manually on each of the 192.168.1.x hosts by using the following Windows command: &lt;strong&gt;route -p add 192.168.2.0 mask 255.255.255.0 192.168.1.2&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there are, probaly, two issues: NAT on &lt;strong&gt;Router 2&lt;/strong&gt; and no route to the 192.168.2.0 segment.&lt;/p&gt;&#xA;" OwnerUserId="20261" LastEditorUserId="20261" LastEditDate="2015-11-04T18:28:28.603" LastActivityDate="2015-11-04T18:28:28.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24042" PostTypeId="1" CreationDate="2015-11-03T13:15:03.197" Score="0" ViewCount="552" Body="&lt;p&gt;How do I set the password for the console port on a Juniper SRX650 router?&lt;/p&gt;&#xA;" OwnerUserId="20265" LastEditorUserId="8499" LastEditDate="2015-11-03T14:06:47.163" LastActivityDate="2015-11-03T14:06:47.163" Title="Console password for SRX 650 juniper router" Tags="|juniper-srx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24043" PostTypeId="2" ParentId="23887" CreationDate="2015-11-03T13:15:21.947" Score="0" Body="&lt;p&gt;Technical side was already discussed, let's observe the question from a conceptual perspective: what you propose seems to be &quot;security by obscurity&quot; and thus can not be recommended. Generally in the IT, but especially in the security area, the so-called 'best practices' play super important role; personally I, for example, haven't heard of using APIPA addresses as a (well-known and widely accepted) security measure. So explore the best practices for your particular task (they definitely exist) and adhere to them. As you haven't given the details of your task, it's difficult to provide concrete recommendations; for example, it's possible to employ IPsec to encrypt OSPF communications.&lt;/p&gt;&#xA;" OwnerUserId="20261" LastActivityDate="2015-11-03T13:15:21.947" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24044" PostTypeId="2" ParentId="24042" CreationDate="2015-11-03T13:39:50.243" Score="1" Body="&lt;p&gt;By default the only username configured is root. Thus setting password is a matter of using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;`set system root-authentication plain-text-password`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is auto-encrypted once entered in.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It is best practice not to be logging in as root however unless special circumstances requires it... even then you would log in as a normal user and 'su root' to gain elevated privileges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I would do is setup a user profile under 'set system login':&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user testuser {&#xA;       full-name &quot;Your USER FULLNAME&quot;;&#xA;       uid 2004;&#xA;       class super-user;&#xA;       authentication {&#xA;            encrypted-password &quot;password&quot;;&#xA;      }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once committed this will allow you to use the configured user as a local login.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The authentication order will need to be changed if you want to use 'radius/tacacs + local password authentication as backup'&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2015-11-03T13:39:50.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24045" PostTypeId="2" ParentId="17405" CreationDate="2015-11-03T13:52:39.947" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;I have very little to no access to the Access Points to modify any settings&lt;/li&gt;&#xA;  &lt;li&gt;I have very little to no access to the devices used by clients to connect to Access Points&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think you need to step back and ask yourself a couple of questions.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Are you solving a real problem here or is this just change for the sake of change? Is there a compelling security reason for the machines on different subnets to be more isolated or are all the subnets routed to each other with no firewall in-between anyway? is the broadcast traffic actually significant enough to cause a noticable performance hit?&lt;/li&gt;&#xA;&lt;li&gt;Do you have the needed buy-in from the rest of your organisation to implement this change?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are ways to put different clients of the same access point on different VLANS but they &lt;em&gt;will&lt;/em&gt; require significant reconfiguration or even possiblly replacement of the access points. They will also require minor reconfiguration of the clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore to make this a success requires buy-in from the people who do have the authority to make such changes. That is probablly going to mean demonstrating a real problem.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2015-11-03T14:21:28.127" LastActivityDate="2015-11-03T14:21:28.127" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24046" PostTypeId="2" ParentId="13123" CreationDate="2015-11-03T14:07:20.447" Score="0" Body="&lt;p&gt;A switch only knows which port a MAC address is behind. Not whether there are other switches between it and the host with that MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could filter the port/mac data you gather to ports with MAC addresses counts below a threshold. The downside of that approach is that some MACs may not appear in your data at all (e.g. unmanaged switch on someones desk, VM setups that result in one host having multiple MACs) or may appear more than once (if the total devices behind a switch is less than your threshold).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more subtle approach would be to gather the MAC/port data from all your switches to produce a list of MAC addresses behind every switchport. Then look for the shortest list that contains each MAC address. This will represent the switchport closest to the device (occasionally you may get duplicates if a switch has only one port in use but it shouldn't be too hard to resolve these manually). If you find a lot of MACs with the same closest switchport you probablly need to gets someone to investigate what is on the end of it.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2015-11-03T14:13:34.303" LastActivityDate="2015-11-03T14:13:34.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24049" PostTypeId="2" ParentId="23959" CreationDate="2015-11-03T15:31:26.957" Score="0" Body="&lt;p&gt;I would hazard that the answer is simply that NAT is involved and (as many others have stated) exposing the ultimate target server to the world invites another attack point. Unless you are doing heavy bulk data transfers with large keys, SSH doesn't generally get in the way. The bottleneck will almost always be the network. (Almost != Always).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are 'lucky' enough to have IPv6 this is not likely to be as much of an issue, but with IPv4 and the limited address space available NAT is (IMO) ultimately what I think is behind this 'policy' more than any other 'accidental' or 'purposeful' security.&lt;/p&gt;&#xA;" OwnerUserId="20272" LastActivityDate="2015-11-03T15:31:26.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24050" PostTypeId="1" CreationDate="2015-11-03T16:36:53.363" Score="4" ViewCount="431" Body="&lt;p&gt;I have the following abridged configuration for a Ubiquiti switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    ethernet eth1 {&#xA;        address 192.168.4.1/24&#xA;        vif 101 {&#xA;            address 10.10.254.1/24&#xA;        }&#xA;        vif 103 {&#xA;            address 10.1.1.1/24&#xA;        }&#xA;    }&#xA;}&#xA;protocols {&#xA;    static {&#xA;        route 10.1.1.0/24 {&#xA;            next-hop 192.168.4.254 {&#xA;            }&#xA;        }&#xA;        route 10.10.254.0/24 {&#xA;            next-hop 192.168.4.254 {&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where 192.168.4.254 is the Gateway and the vifs share the exact same firewall configuration with eth1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices on eth1's network can see devices on vif101 when they are configured to talk to the gateway for the vifs subnets through the following route entries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.1/24          192.168.4.254      UGSc            1        2     en5&#xA;10.10.254/24       192.168.4.254      UGSc            0        0     en5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, the switch cannot reach devices on either vif and devices on the vifs cannot reach the Internet despite being able to reach the gateway and devices on eth1 even with the static routing. Devices on eth1 are able to communicate with the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routing table on the switch is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S&amp;gt;* 0.0.0.0/0 [1/0] via --redacted--, eth0&#xA;S   10.1.1.0/24 [1/0] via 192.168.4.254&#xA;C&amp;gt;* 10.1.1.0/24 is directly connected, eth1.103&#xA;S   10.10.254.0/24 [1/0] via 192.168.4.254&#xA;C&amp;gt;* 10.10.254.0/24 is directly connected, eth1.101&#xA;C&amp;gt;* --redacted-- is directly connected, eth0&#xA;C&amp;gt;* 127.0.0.0/8 is directly connected, lo&#xA;C&amp;gt;* 192.168.4.0/24 is directly connected, eth1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routing table on one of the devices on vif101 is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Destination           Gateway           Flags  Ref     Use     Interface &#xA;-------------------- -------------------- ----- ----- ---------- --------- &#xA;default              10.1.1.1             UG        4       1954 net0      &#xA;10.0.1.0             10.0.1.38            U         4        958 net1      &#xA;10.1.1.0             10.1.1.7             U         3          1 net0      &#xA;127.0.0.1            127.0.0.1            UH        2          0 lo0    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't have networking knowledge so I'm not sure if there's something obvious I'm missing. How do I get the vifs to communicate with the Internet?&lt;/p&gt;&#xA;" OwnerUserId="20276" LastEditorUserId="33" LastEditDate="2015-11-05T03:46:21.283" LastActivityDate="2017-10-23T16:11:57.537" Title="How do I fix my vlans connection to the Internet?" Tags="|vlan|troubleshooting|ubiquiti|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24052" PostTypeId="2" ParentId="24050" CreationDate="2015-11-03T17:31:51.233" Score="0" Body="&lt;p&gt;I am not able to understand any of the config, which commands are these? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can tell you about vlans and routing them to the internet. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create vlans. &lt;/li&gt;&#xA;&lt;li&gt;Terminate the vlans. This can be a L3 switch where the vlan gateway is an virtual vlan interface on the switch itself or subinterfaces on a router.&lt;/li&gt;&#xA;&lt;li&gt;The router between your vlans and the internet should have a static route back to each of your vlans. Because the router can't see of your vlans and doesn't know those networks and hence can't send back the reply packets to them.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Use &lt;a href=&quot;https://supportforums.cisco.com/discussion/11520346/cisco-sg300-10-how-set-inter-vlan-routing&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; and &lt;a href=&quot;https://community.spiceworks.com/how_to/72048-enable-inter-vlan-routing-with-cisco-sg-series-smb-layer-3-switches&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; for better understanding.&lt;/p&gt;&#xA;" OwnerUserId="15569" LastActivityDate="2015-11-03T17:31:51.233" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24053" PostTypeId="1" CreationDate="2015-11-03T18:57:46.137" Score="2" ViewCount="642" Body="&lt;p&gt;I'm attempting to uplink an older D-Link DGS-1224 switch to an HP Procurve 2810 using a 50 meter MM OM3 fiber cable on the bench before running the cable in the plenum for production.  Cable is high quality and brand new.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both transceivers seem to initialize fine in their respective switches but when I connect the LCs on both ends no activity or link is shown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found by accident that when I press in the LC connector just a bit further than it normally &quot;clicks&quot; into place on the D-Link the link is up and traffic appears to be moving.  As soon as I let go to allow the LC connector to return to its normal resting position the link lights go dark again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried using an older orange OM1 or OM2 (don't know) cable which is only 8 meters long and got the same result, including link lights when I press it in a bit further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone else ever seen something like this before?  Is the light not &quot;bright&quot; or powerful enough to be received unless it's closer to the sensor?  Should connecting two transceivers and switches made by different vendors be a problem as a general rule?  Thanks!&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2015-11-03T19:22:53.330" Title="Layer 1 problem - fiber ethernet won't connect unless held in" Tags="|switch|fiber|hp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24054" PostTypeId="2" ParentId="24053" CreationDate="2015-11-03T19:22:53.330" Score="5" Body="&lt;p&gt;This sounds like an optical problem in the transceiver module - for whatever reason the optics are not lining up correctly when the connector is clicked into place, but are managing to focus when the connector is pushed in further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do kinda wonder if everything is clean - filth at a very small scale is the bane of fiber optics in general. If you can't scope every connection before making it it's difficult to know, because (for instance) &quot;I just took off the dust cap, so it must be clean&quot; is not actually true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, there should be no trouble connecting between different makers so long as mode/type/etc. match.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-11-03T19:22:53.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24055" PostTypeId="1" CreationDate="2015-11-03T20:18:04.837" Score="1" ViewCount="38" Body="&lt;p&gt;I'm a remote developer working on a web application.  I'd like to share my work-in-progress to other users on the LAN (I'm on a VPN).  Other users should be able to find my web application using a browser at this URL:&#xA;&lt;a href=&quot;http://x.x.x.x/myapp:8080&quot; rel=&quot;nofollow&quot;&gt;http://x.x.x.x/myapp:8080&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I open port 8080 on my laptop's firewall, the port will also be exposed when I'm off the VPN.  My employer doesn't want the port open to the public when I'm off the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to dynamically allow 8080 while I&quot;m on the VPN, and to automatically block 8080 when I'm not VPN (either logoff or connection broken)?  It would have to enable and disable the port depending on the VPN connection status.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, is there some other creative solution to grant network users access while blocking the public?  E.g. Allow IP clients with a certain subnet? Apache configuration?&lt;/p&gt;&#xA;" OwnerUserId="20284" LastActivityDate="2015-11-03T20:18:04.837" Title="brainstorm: dynamically block ports when not on VPN" Tags="|vpn|firewall|" AnswerCount="0" CommentCount="3" ClosedDate="2015-11-03T22:03:55.383" ContentLicense="CC BY-SA 3.0" />
  <row Id="24056" PostTypeId="1" CreationDate="2015-11-03T22:45:51.500" Score="1" ViewCount="86" Body="&lt;p&gt;Let's say that we have a room with a router and 30 PC's plugged in. Every PC has it's own 'subnet'. If we check for available hosts via ettercap/wireshark (on any PC), it only discoveres two hosts: our own and the router. I couldn't find any switches in the room, but they are probably hidden somewhere. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My teacher gave me a task, to sniff his wordpress password. As you probably know, login is easy, cause it can be easily enumerated, for ex. with wpsniff. In my own network, in home I work on w-shark, cause I have one mask, one router and it's simple - every packet is visible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the class, my IP address is like '10.169.100.181' and the 'main host' is on '100.1'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to configure ettercap to work with VLSM subnets, or any other way to retrieve any packet that is in a different subnet, but on the same router? He said on the first lesson, that there is a plugin for Firefox, that may work with a thing like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know, that this question is stupid and you'll say that I should go learn somewhere, but I don't know where. If there is someone who can point a way (just the way), I would be grateful :)&lt;/p&gt;&#xA;" OwnerUserId="20287" LastActivityDate="2015-11-03T22:45:51.500" Title="ARP poison on divided network (every PC in it's own subnet)" Tags="|subnet|arp|" AnswerCount="0" CommentCount="4" ClosedDate="2015-11-03T22:57:25.497" ContentLicense="CC BY-SA 3.0" />
  <row Id="24057" PostTypeId="1" AcceptedAnswerId="24060" CreationDate="2015-11-04T01:00:38.880" Score="4" ViewCount="298" Body="&lt;p&gt;I am very new to linux networking and am trying to setup the following topology setup for some VMs on a testbed. &#xA;(Please note, I have to have the VMs setup exactly this way for my testing purposes. I can't cheat and put them on switches. They all need to be on separate nets).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Node1     Node2     Node3     Node4&#xA;eth[x]&amp;lt;--&amp;gt;eth[x]    eth[x]&amp;lt;--&amp;gt;eth[x]&#xA;          eth[y]&amp;lt;--&amp;gt;eth[y]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm currently trying to get Node4 to talk to Node2 via Node3, but failing miserably. Can someone tell me were I'm going wrong and how to correct it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Node1's IP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eth2 - 10.1.3.2/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Node2's IPs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eth3 - 10.1.1.2/24&#xA;eth4 - 10.1.3.3/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Node3's IPs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eth1 - 10.1.2.2/24&#xA;eth3 - 10.1.1.3/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Node4's IP&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eth4 - 10.1.2.3/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Routes, from &quot;ip route&quot;)&#xA;The route for Node1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.3.0/24 dev eth2  proto kernel  scope link  src 10.1.3.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The route for Node2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.1.0/24 dev eth3  proto kernel  scope link  src 10.1.1.2 &#xA;10.1.3.0/24 dev eth4  proto kernel  scope link  src 10.1.3.3 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The route for Node3, after adding a via:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.1.0/24 dev eth3  scope link  src 10.1.1.3 &#xA;10.1.2.0/24 dev eth1  scope link  src 10.1.2.2 &#xA;10.1.3.0/24 via 10.1.1.2 dev eth3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The route for Node4:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.2.0/24 dev eth4  proto kernel  scope link  src 10.1.2.3 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this setup, Node3 can ping Node2's address at 10.1.3.3, but Node4 cannot ping this address. What do I need to do to enable Node4 to be able to ping 10.1.3.3? Also, how can I get Node4 to be able to communicate all the way to Node1?&lt;/p&gt;&#xA;" OwnerUserId="20291" LastActivityDate="2015-11-04T01:17:45.847" Title="How can I get these static IPv4 routes to work?" Tags="|routing|ipv4|linux|" AnswerCount="2" CommentCount="0" ClosedDate="2019-02-12T04:23:05.510" ContentLicense="CC BY-SA 3.0" />
  <row Id="24059" PostTypeId="2" ParentId="24057" CreationDate="2015-11-04T01:14:38.013" Score="0" Body="&lt;p&gt;Node4 doesn't have routes to the prefixes other than its own. How does Node4 know where to send traffic for Node2's &lt;code&gt;10.1.3.3&lt;/code&gt; address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing protocols will let routers tell each the routes about which they know, so that each router knows to send traffic for a prefix in a specific direction. You can do this with static routes, but it is not scalable or dynamic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What the end nodes should have is a default route &lt;code&gt;0.0.0.0/0&lt;/code&gt; pointing to their single interface.  This falls apart if they have more than one interface. The two middle nodes will need routes to the prefixes to which they don't have direct contact, and this shouldn't be done with default routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine a network with many routers where you are trying to keep up with this sort of thing. You can see why routing protocols were created. Static routing has its uses, but trying to completely run a network using is is a recipe for going insane.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-04T01:14:38.013" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24060" PostTypeId="2" ParentId="24057" CreationDate="2015-11-04T01:17:45.847" Score="5" Body="&lt;p&gt;Step one, enable &lt;em&gt;IP Forwarding&lt;/em&gt; on node2 and node3 (or the nodes will be &quot;hosts&quot; not &quot;routers&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the nodes need to know what isn't &lt;em&gt;directly attached&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Node1&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route add 10.1.1.0/24 via 10.1.3.3&#xA;ip route add 10.1.2.0/24 via 10.1.3.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Node2&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route add 10.1.2.0/24 via 10.1.1.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Node3&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route add 10.1.3.0/24 via 10.1.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Node4&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route add 10.1.3.0/24 via 10.1.2.2&#xA;ip route add 10.1.1.0/24 via 10.1.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(This would be A LOT easier to see if it were all in one picture.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-11-04T01:17:45.847" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24065" PostTypeId="1" AcceptedAnswerId="24071" CreationDate="2015-11-04T12:17:31.763" Score="2" ViewCount="1019" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3JqEb.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3JqEb.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a tech startup environment where I'm replacing consumer-grade routers with enterprise-grade.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, they are asking if we can have dual ISPs to minimize downtime and any disruption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 70: 10.70.0.0/16 with 10.70.0.1 default gw&lt;/li&gt;&#xA;&lt;li&gt;VLAN 5: 10.2.10.0/24 with 10.2.10.1 default gw&lt;/li&gt;&#xA;&lt;li&gt;Mgmt VLAN is 70 where router has 10.70.0.2, layer 3 switch has&#xA;10.70.0.3, and so forth.&lt;/li&gt;&#xA;&lt;li&gt;Virtual-IP GW of 10.70.0.1 or iBGP?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Usually, I use GLBP with two Cisco routers for CEF load-balancing, but we are not sticking with Cisco this time. Shall I use VRRP between vendors or use BGP with our ISP gateway being iBGP neighbors with each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Requirements:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Later on, we want hybrid cloud with AWS and it uses BGP that I'm&#xA;eventually going to set a default route in OSPF for.&lt;/li&gt;&#xA;&lt;li&gt;Minimize CPU on routers&lt;/li&gt;&#xA;&lt;li&gt;We are very ARP Layer 2 loop prone due to multiple adapters on&#xA;servers acting unexpectedly.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the long run, which would provide simple yet effective HA and load balancing?&lt;/p&gt;&#xA;" OwnerDisplayName="user10221" LastEditorUserId="8499" LastEditDate="2019-01-05T00:01:35.850" LastActivityDate="2019-01-05T00:01:35.850" Title="ISP HA using GLBP vs BGP" Tags="|bgp|vrrp|fhrp|cef|glbp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24067" PostTypeId="1" AcceptedAnswerId="24070" CreationDate="2015-11-04T12:28:21.050" Score="3" ViewCount="4604" Body="&lt;p&gt;I have a SOHO environment for which I'm using Cisco 891-K9 as the ISP GW.&#xA;But the nature of Cisco 891 is that it's both a router and a switch with 10 ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will switch ports (both access and trunk ports) be properly forwarding broadcast packets/DHCP requests for VLAN or VLANs or would only trunk ports propagate?&#xA;Is is the case for 891 where, broadcast packets do not flood within one device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st option I have is router on stick:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface FastEthernet8&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet8.2&#xA; encapsulation dot1Q 10&#xA; ip address 10.2.10.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; no cdp enable&#xA;!&#xA;interface FastEthernet8.70&#xA; encapsulation dot1Q 70&#xA; ip address 10.70.0.1 255.255.252.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; no cdp enable&#xA;!&#xA;!&#xA;ip dhcp pool VLAN70&#xA; network 10.70.0.0 255.255.252.0&#xA; dns-server 8.8.8.8 8.8.4.4 &#xA; default-router 10.70.0.1 &#xA;!&#xA;ip dhcp pool VLAN2&#xA; network 10.2.10.0 255.255.255.0&#xA; dns-server 8.8.8.8 8.8.4.4 &#xA; default-router 10.2.10.1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2nd option via SVI:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface FastEthernet0&#xA; switchport mode trunk&#xA; no ip address&#xA;!&#xA;interface Vlan2&#xA; ip address 10.2.10.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface Vlan70&#xA; ip address 10.70.0.1 255.255.252.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;&#xA;!&#xA;ip dhcp pool VLAN70&#xA; network 10.70.0.0 255.255.252.0&#xA; dns-server 8.8.8.8 8.8.4.4 &#xA; default-router 10.70.0.1 &#xA;!&#xA;ip dhcp pool VLAN2&#xA; network 10.2.10.0 255.255.255.0&#xA; dns-server 8.8.8.8 8.8.4.4 &#xA; default-router 10.2.10.1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Most routers, as far as I've encountered, can only do sub-interface, but seems 891 is a unique case.&lt;/p&gt;&#xA;" OwnerDisplayName="user10221" LastEditorDisplayName="user10221" LastEditDate="2015-11-04T12:54:42.310" LastActivityDate="2015-11-04T15:07:41.917" Title="Cisco 891: sub-interface VS SVI approach" Tags="|vlan|dot1q|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24068" PostTypeId="1" AcceptedAnswerId="24072" CreationDate="2015-11-04T14:36:05.997" Score="185" ViewCount="114161" Body="&lt;p&gt;The TCP 3-way handshake works like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Client ------SYN-----&amp;gt; Server&#xA;Client &amp;lt;---ACK/SYN---- Server&#xA;Client ------ACK-----&amp;gt; Server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why not just this?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Client ------SYN-----&amp;gt; Server&#xA;Client &amp;lt;-----ACK------ Server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13856" LastEditorUserId="8499" LastEditDate="2018-10-26T19:10:04.740" LastActivityDate="2020-02-09T06:54:17.337" Title="Why do we need a 3-way handshake? Why not just 2-way?" Tags="|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="9" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="24069" PostTypeId="2" ParentId="24068" CreationDate="2015-11-04T15:05:30.213" Score="28" Body="&lt;p&gt;The three-way handshake is necessary because both parties need to &lt;strong&gt;syn&lt;/strong&gt;chronize their segment sequence numbers used during their transmission.  For this, each of them sends (in turn) a SYN segment with a sequence number set to a random value &lt;em&gt;n&lt;/em&gt;,  which then is &lt;strong&gt;ack&lt;/strong&gt;nowledged by the other party via a ACK segment with a sequence number set to &lt;em&gt;n+1&lt;/em&gt;.      &lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2015-11-04T15:05:30.213" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24070" PostTypeId="2" ParentId="24067" CreationDate="2015-11-04T15:07:41.917" Score="1" Body="&lt;p&gt;You have a traditional 2-port router trunking to an 8-port switch. The 891 has two router ports which can be used like traditional router ports. These two ports are usually used for WAN connections, but one or both can be set up with subinterfaces, etc. as traditional router ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other eight ports are switch ports and act like a switch, and cannot be used as router ports. Many of the ISR routers can use a switch module; this router just has it built in. To use the switch ports, you can use SVIs and assign VLANs to the switch ports. You can even set them up as trunk ports, but you can't use them as router ports.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-04T15:07:41.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24071" PostTypeId="2" ParentId="24065" CreationDate="2015-11-04T15:54:20.413" Score="1" Body="&lt;p&gt;If you have a single layer-3 switch to which the LAN connects, you don't need an FHRP for the LAN. The question then becomes how to load balance from the layer-3 switch to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need the layer-3 switch to know about the specific routes advertised from each ISP in order to make intelligent decisions about which direction to route particular packets, then BGP would certainly be the right choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any FHRP will need to have a layer-2 connection between the routers. That would make the uplinks from the layer-3 switch be layer-2 links, but that doesn't seem to be how the layer-3 switch should be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really don't see the need for two separate routers on each ISP link. That could be handled by a single router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to go is to have the links from the layer-3 switches toward the Internet be routed links, and just use the default route on each one. The default routes could be equal cost, and, depending on your layer-3 switch, could naturally load balance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should think carefully about load balancing. You can end up with asymmetric traffic flows which may cause problems. You can also slow down because of the out of order packet delivery problem. There is no guarantee that to and from a particular place on the Internet is equidistant from your site on each of the ISPs, or even that to a place and from a place will use the same ISP (asymmetric).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-04T15:54:20.413" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24072" PostTypeId="2" ParentId="24068" CreationDate="2015-11-04T16:56:45.837" Score="238" Body="&lt;p&gt;Break down the handshake into what it is really doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In TCP, the two parties keep track of what they have sent by using a Sequence number. Effectively it ends up being a running byte count of everything that was sent. The receiving party can use the opposite speaker's sequence number to acknowledge what it has received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the sequence number doesn't start at 0. It starts at the ISN (Initial Sequence Number), which is a randomly chosen value. And since TCP is a bi-directional communication, both parties can &quot;speak&quot;, and therefore both must randomly generate an ISN as their starting Sequence Number. Which in turn means, both parties need to notify the other party of their starting ISN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you end up with this sequence of events for a start of a TCP conversation between Alice and Bob:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Alice ---&amp;gt; Bob    SYNchronize with my Initial Sequence Number of X&#xA;Alice &amp;lt;--- Bob    I received your syn, I ACKnowledge that I am ready for [X+1]&#xA;Alice &amp;lt;--- Bob    SYNchronize with my Initial Sequence Number of Y&#xA;Alice ---&amp;gt; Bob    I received your syn, I ACKnowledge that I am ready for [Y+1]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice, four events are occurring:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Alice picks an ISN and &lt;strong&gt;SYNchronizes&lt;/strong&gt; it with Bob. &lt;/li&gt;&#xA;&lt;li&gt;Bob &lt;strong&gt;ACKnowledges&lt;/strong&gt; the ISN. &lt;/li&gt;&#xA;&lt;li&gt;Bob picks an ISN and &lt;strong&gt;SYNchronizes&lt;/strong&gt; it with Alice. &lt;/li&gt;&#xA;&lt;li&gt;Alice &lt;strong&gt;ACKnowledges&lt;/strong&gt; the ISN.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In actuality though, the middle two events (#2 and #3) happen in the same packet. What makes a packet a &lt;code&gt;SYN&lt;/code&gt; or &lt;code&gt;ACK&lt;/code&gt; is simply a binary flag turned on or off inside each &lt;a href=&quot;http://www.freesoft.org/CIE/Course/Section4/8.htm&quot;&gt;TCP header&lt;/a&gt;, so there is nothing preventing both of these flags from being enabled on the same packet. So the three-way handshake ends up being:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bob &amp;lt;--- Alice         SYN&#xA;Bob ---&amp;gt; Alice     SYN ACK &#xA;Bob &amp;lt;--- Alice     ACK     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice the two instances of &quot;SYN&quot; and &quot;ACK&quot;, one of each, in both directions.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So to come back to your question, why not just use a two-way handshake? The short answer is because a two way handshake would only allow one party to establish an ISN, and the other party to acknowledge it. Which means only one party can send data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But TCP is a bi-directional communication protocol, which means either end ought to be able to send data reliably. Both parties need to establish an ISN, and both parties need to acknowledge the other's ISN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in effect, what you have is exactly your description of the two-way handshake, but &lt;em&gt;in each direction&lt;/em&gt;. Hence, four events occurring. And again, the middle two flags happen in the same packet.  As such three packets are involved in a full TCP connection initiation process.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="30285" LastEditDate="2016-09-06T14:03:42.043" LastActivityDate="2016-09-06T14:03:42.043" CommentCount="27" ContentLicense="CC BY-SA 3.0" />
  <row Id="24073" PostTypeId="2" ParentId="23083" CreationDate="2015-11-04T17:38:41.797" Score="4" Body="&lt;p&gt;We must start from the basics, so let's revise NAT terminology. NAT translates IP addresses in IP packets, right? What does that mean? That it, basically, creates mirages - yes, optical illusions, you know. For example, in a typical NAT configuration when private-addressed LAN hosts access Internet by using external router interface's public IP address those hosts appear for Internet servers as having this public IP (or IPs from a pool of public IPs). NAT does not create new physical hosts, of course - but it create kind of new virtual entities - in this example, the LAN hosts see themselves as, let's say 192.168.1.x but Internet servers see them as 203.0.113.x - one set of physical hosts but two sets of IP addresses. Two distinct sets of (logical) hosts. Optical illusion. And the terminology is this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;inside local&lt;/strong&gt; - &quot;real&quot; IP addresses of the internal hosts as assigned to their interfaces and as they see each other&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;inside global&lt;/strong&gt; - &quot;mirage&quot; IP addresses as seen by the outside world&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;outside global&lt;/strong&gt; - &quot;real&quot; IP addresses of the external hosts as they seen by themselves and by (almost) entire Internet&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;outside local&lt;/strong&gt; - &quot;mirage&quot; IP addresses as we see external hosts (if we asked NAT to translate correspondingly)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And as you can see, we are obliged to make a distinction between our network and the Internet or another external network. We do this by marking our router's IP interfaces as either &lt;strong&gt;ip nat inside&lt;/strong&gt; or &lt;strong&gt;ip nat outside&lt;/strong&gt;, agree?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's remember how NAT is usually implemented: it maintains special tables that contain entries about translations. And the important point is that these entries can be created either &lt;em&gt;statically&lt;/em&gt; or &lt;em&gt;dynamically&lt;/em&gt;. For dynamically created entries, the direction of traffic is important - is the traffic initiated from inside to outside or vice versa? For static entries, this is not so - they are &lt;em&gt;symmetrical&lt;/em&gt;. NAT configuration statements that contain the &lt;strong&gt;static&lt;/strong&gt; keyword create static entries immediately after putting them into the running config; those with the &lt;strong&gt;dynamic&lt;/strong&gt; keyword watch for the interesting traffic and dynamically create translation entries, which will then eventually time out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can already speculate about your last question: why there is no &lt;strong&gt;outside destination&lt;/strong&gt; option? &lt;strong&gt;ip nat inside source static&lt;/strong&gt; creates static NAT entry that translates exactly as you described, but this includes not only the traffic initiated from one particular side - static NAT entries are symmetrical. So, &lt;strong&gt;ip nat outside destination static&lt;/strong&gt; would create a static entry for translating &lt;em&gt;destination&lt;/em&gt; IP addresses of traffic entering into your network from the &lt;em&gt;outside&lt;/em&gt; AND &lt;em&gt;source&lt;/em&gt; IP addresses for traffic going from &lt;em&gt;inside&lt;/em&gt; - but this is exactly what &lt;strong&gt;ip nat inside source static&lt;/strong&gt; command does! So, it's simply redundant to have this command. The only difference is that you would interchange the source with the destination ip when using one or another form of basically the same command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In regard to your first statement, &quot;there are three possible combinations of inside/outside/source/destination that can be configured&quot; - this is not quite so. The point is that, generally speaking, NAT configuration statements are not &quot;math formulas&quot; and should be considered wholly, and not as builded logically from independed keywords. So, each &quot;combination&quot; presents a solution for a particular task, for example, &lt;strong&gt;ip nat inside destination list&lt;/strong&gt; is used for configuring server TCP load balancing that uses specific algorithm and does not work with UDP. Also, (in modern IOSes) there is no &lt;strong&gt;ip nat inside destination static&lt;/strong&gt; command - have you actually tried it with the &lt;strong&gt;static&lt;/strong&gt; option?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see some particular scenarios of using NAT including configuration examples in this Cisco paper: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/12-2sx/nat-12-2sx-book/iadnat-addr-consv.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/12-2sx/nat-12-2sx-book/iadnat-addr-consv.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, I would like to mention that sometimes NAT is not what you want, for example, look at my answer for this &quot;canonical question&quot;: &lt;a href=&quot;https://serverfault.com/questions/55611/loopback-to-forwarded-public-ip-address-from-local-network-hairpin-nat/733532#733532&quot;&gt;https://serverfault.com/questions/55611/loopback-to-forwarded-public-ip-address-from-local-network-hairpin-nat/733532#733532&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;PS Should I go into more details?&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="20261" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-11-04T17:46:39.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24076" PostTypeId="1" CreationDate="2015-11-04T21:30:01.127" Score="1" ViewCount="416" Body="&lt;p&gt;I am trying to configure an A/S firewall cluster, and I have the interface configured as a PPPoE client. When I try to configure the clustering on ASDM, I get a message saying that high availability is not possible with a named interface configured as a PPPoE or DHCP client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why they does it say named? I know naming an interface is not optional in a Cisco ASA. If anyone has advice related to clustering with this way, please share it. &lt;/p&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="8499" LastEditDate="2015-11-04T22:27:24.670" LastActivityDate="2023-08-06T22:06:59.340" Title="ASA cluster with named interface running PPPoE" Tags="|cisco|cisco-asa|failover|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24077" PostTypeId="2" ParentId="23715" CreationDate="2015-11-04T22:07:03.490" Score="1" Body="&lt;p&gt;In your case, it's &lt;strong&gt;&quot;NAT overload&quot; (or PAT, NAPT)&lt;/strong&gt;.&lt;br&gt;&#xA;It's all about ensuring the &lt;em&gt;uniqueness of the translation entries&lt;/em&gt;(local-src ip:port ==&gt; global-src ip:port)&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to answer your questions:&lt;br&gt;&#xA;1- If the translation table already contains the following entry:&lt;br&gt;&#xA;&lt;em&gt;192.168.0.2:2000  ==&gt; 10.0.0.1:6000&lt;/em&gt;  (just for the example's sake),&#xA;all outgoing connections from 192.168.0.2:2000 will be translated to 10.0.0.1:6000. So your assumption is correct.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- It depends on the local src-ip and src-port.&lt;br&gt;&#xA;So yes, with a &lt;strong&gt;theoretical maximum of 65536 PAT entries&lt;/strong&gt;, 1 device with 65536 outgoing connections from different src-ports, or one src-port from 65536 devices, could fill up the translation table.&lt;br&gt;&#xA;&lt;strong&gt;In practice&lt;/strong&gt;, that limit might be reduced by:&lt;br&gt; &#xA;- Memory, CPU, available ports(static-PAT/PAR), ... &lt;br&gt; &lt;/p&gt;&#xA;" OwnerUserId="20317" LastActivityDate="2015-11-04T22:07:03.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24079" PostTypeId="1" AcceptedAnswerId="24083" CreationDate="2015-11-04T22:33:16.427" Score="1" ViewCount="575" Body="&lt;p&gt;I'm on a network where I don't own the router and I don't want to modify the network existing network by running a firewall over the entire network however I want to have a firewall protecting my server. How would I go about segmenting my network? I want to use a hardware firewall, probably in a pfSense box, I've been reading about subnets and VLANs, is there a way I could use these to split up my network into a separate many network that just my computer and server would be on?&lt;/p&gt;&#xA;" OwnerUserId="20325" LastActivityDate="2015-11-04T23:14:41.380" Title="How do I segment my network?" Tags="|vlan|firewall|subnet|pfsense|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24080" PostTypeId="1" CreationDate="2015-11-04T22:35:38.133" Score="4" ViewCount="5132" Body="&lt;p&gt;I have two captures: a sender side capture file and a receiver side capture file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I applied the tcp.analysis.lost_segment filter at sender side, I didn't see any frame popping up. When I applied the same at receiver end and saw the black highlighted columns matching the description as &quot;Expert Info (Warn/Sequence): Previous segment not captured (common at capture start)&quot;.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Who knows first (sender or receiver) that the packet is lost?&lt;/li&gt;&#xA;&lt;li&gt;Scrolling at the sender side. I do see frames highlighted in black&#xA;with info as, &quot;This is a TCP duplicate ACK.&quot; Is this a lost packet?&#xA;But this frame is different from the one at the receiver saying, &quot;prev&#xA;seg not captured.&quot;&lt;/li&gt;&#xA;&lt;li&gt;Which capture file should be used to identity the lost packet?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20326" LastEditorUserId="8499" LastEditDate="2015-11-04T22:57:05.610" LastActivityDate="2016-01-05T08:24:45.060" Title="Finding the lost packet" Tags="|packet-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24081" PostTypeId="5" CreationDate="2015-11-04T23:14:11.503" Score="0" Body="&lt;p&gt;AAA is a framework for of three network security functions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Authentication:&lt;/strong&gt; Method used for identifying users prior to granting users access through Authorization to the network, services, and/or devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Authorization:&lt;/strong&gt; Method used to grant access to the network, services, and/or devices, including various access levels of these, for the users identified by the Authentication method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Accounting:&lt;/strong&gt; Method used for collecting information for the previous Authentication and Accounting methods so that the data may be used for things like reporting and auditing. These data may include things such as the user identity, which networks, services, and or devices were used, when the services were used and for how long, etc.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-05T06:23:52.577" LastActivityDate="2015-11-05T06:23:52.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24082" PostTypeId="4" CreationDate="2015-11-04T23:14:11.503" Score="0" Body="For questions about network Authentication, Authorization, and Accounting. These are methods which comprise a security framework for access control on the network, services, and/or devices." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-05T06:23:46.990" LastActivityDate="2015-11-05T06:23:46.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24083" PostTypeId="2" ParentId="24079" CreationDate="2015-11-04T23:14:41.380" Score="0" Body="&lt;p&gt;pfsense will bridge. Seems to me the easiest route would be to isolate the two machines behind your pfsense box and bridge the outside interface with the inside. No reconfig of IP yet you have the separation you desire. You could even do some port forwarding if you wanted access to your server from the outside LAN. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastActivityDate="2015-11-04T23:14:41.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24084" PostTypeId="2" ParentId="24068" CreationDate="2015-11-05T01:02:48.267" Score="8" Body="&lt;p&gt;Actually, a 3-way handshake isn't the only means of establishing a TCP connection.  Simultaneous SYN exchange is also allowed: &lt;a href=&quot;http://www.tcpipguide.com/free/t_TCPConnectionEstablishmentProcessTheThreeWayHandsh-4.htm&quot; rel=&quot;noreferrer&quot;&gt;http://www.tcpipguide.com/free/t_TCPConnectionEstablishmentProcessTheThreeWayHandsh-4.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That could be seen as a sort of double 2-way handshake.&lt;/p&gt;&#xA;" OwnerUserId="20332" LastActivityDate="2015-11-05T01:02:48.267" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24085" PostTypeId="5" CreationDate="2015-11-05T03:48:16.437" Score="0" Body="" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-11-05T03:48:16.437" LastActivityDate="2015-11-05T03:48:16.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24086" PostTypeId="4" CreationDate="2015-11-05T03:48:16.437" Score="0" Body="Ubiquiti Networks  is a provider of networking equipment." OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-11-05T03:48:16.437" LastActivityDate="2015-11-05T03:48:16.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24087" PostTypeId="1" AcceptedAnswerId="24088" CreationDate="2015-11-05T07:39:04.863" Score="3" ViewCount="583" Body="&lt;p&gt;I am trying to understand the DNS. Say I have a domain named &lt;code&gt;mydomain.com&lt;/code&gt;. And let's say that we have the following FQDNs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub0.mydomain.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub00.sub0.mydomain.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub01.sub0.mydomain.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub000.sub00.sub0.mydomain.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub010.sub01.sub0.mydomain.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub1.mydomain.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub10.sub1.mydomain.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub11.sub1.mydomain.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub100.sub10.sub1.mydomain.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sub110.sub10.sub1.mydomain.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is, what can I infer given this information?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, can I infer that &lt;code&gt;sub00.sub0.mydomain.com&lt;/code&gt; &lt;code&gt;sub01.sub0.mydomain.com&lt;/code&gt; are geographically located in similar locations? (Because they are under the same subdomain: &lt;code&gt;sub0.mydomain.com&lt;/code&gt;). Or is it completely possible that one of them is located in say, US and the other in China?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, what can I infer given this list of FQDNs? In other words, what is the purpose of the subdomain system?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if &lt;code&gt;sub00.sub0.mydomain.com&lt;/code&gt; points to a computer, is it possible that &lt;code&gt;sub0.mydomain.com&lt;/code&gt; points to a computer as well?&lt;/p&gt;&#xA;" OwnerUserId="19156" LastActivityDate="2015-11-13T05:27:43.960" Title="What exactly is a domain in context of DNS?" Tags="|dns|" AnswerCount="3" CommentCount="0" ClosedDate="2018-03-02T00:29:37.313" ContentLicense="CC BY-SA 3.0" />
  <row Id="24088" PostTypeId="2" ParentId="24087" CreationDate="2015-11-05T07:57:57.197" Score="2" Body="&lt;p&gt;Basically, DNS is only a name system. So you have FQDN and they translate into something else. This could be for example an IP address (A record), a mailserver (MX record) or another thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often times, it is used in a way that subdomains provide hierarchy. So &lt;code&gt;sub.domain.com&lt;/code&gt; is something belonging to &lt;code&gt;domain.com&lt;/code&gt;. But if you want, you can do this mapping in any way you want. There is especially no geographic information in domain names. Nevertheless, it makes sense to use the hierarchy and distribute your name servers in a geographically senseful manner. But you are not forced to do so and many organizations don't do so. Take for example content-delivery networks (CDNs), where they are resolving domains based on your location, so that you get the content from a geographically nearby location to reduce latency and load on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual DNS lookup is also done hierarchically:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You want to resolve &lt;code&gt;sub.example.com&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Your local resolver asks the root servers for the address of .com TLD server&lt;/li&gt;&#xA;&lt;li&gt;Your local resolver asks the TLD server for the address of example.com&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Up to this point, the domain hierarchy and the name servers are usually mapped 1:1, so one part of the domain relates to one name server. Starting from the domain, it can then have an arbitrary structure and is due to the organizations needs. So one server could be responsible for &lt;code&gt;sub.sub.sub.domain.com&lt;/code&gt; or there can be 3 servers responsible for this.&lt;/p&gt;&#xA;" OwnerUserId="10219" LastEditorUserId="10219" LastEditDate="2015-11-05T08:00:28.983" LastActivityDate="2015-11-05T08:00:28.983" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24089" PostTypeId="2" ParentId="24080" CreationDate="2015-11-05T08:10:22.253" Score="2" Body="&lt;p&gt;Actually, in networking you never know if a packet got lost or not if you are only watching the end-points. This is due to the fact that you cannot distinguish between a lost packet (dropped by router or even corrupted on the link layer) and a extremely delayed transmission (packet is still on the wire or in a queue but is not processed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A TCP duplicate ACK indicates: You received an acknowledgement from the server but it gives the same sequence number that the last ACK had. This means that an intermediate packet is lost (as the receiver ACKed the number twice) or extremely delay. But as you have received another ACK (the duplicate ACK) this means that the network path is not completely congested. Consequently, if you get multiple ACKs in a row, you can assume that the ACKed packet is lost as the other packets come through. Many TCP implementations then do what is called a Fast Retransmit, so that they don't wait for the retransmit timeout but instead resend the first unacked packet. This also has some implications regarding the congestion window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The message &quot;Expert Info (Warn/Sequence): Previous segment not captured (common at capture start)&quot; means the following: On the receiver side you capture an outgoing ACK packet for a sequence number where you haven't seen the respective segment. This is common, as it might be possible that a segment arrived, you started the capture and afterwards your TCP stack replied with an ACK. So there was no way to see the incoming packet. This does not necessarily indicate a loss.&lt;/p&gt;&#xA;" OwnerUserId="10219" LastEditorUserId="10219" LastEditDate="2015-11-06T06:49:42.067" LastActivityDate="2015-11-06T06:49:42.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24090" PostTypeId="2" ParentId="24068" CreationDate="2015-11-05T08:15:32.957" Score="8" Body="&lt;p&gt;TCP connection is bidirectional. What this means is that it actually is a pair of one-way connections. The initiator sends SYN, the responder sends ACK: one simplex connection begins. &quot;Then&quot; the responder sends SYN, the initiator sends ACK: another simplex connection begins. Two simplex connections form one duplex TCP session, agree? So logically there are four steps involved; but because SYN and ACK flags are different &quot;fields&quot; of TCP header, they can be set simultaneously - the second and the third steps (of the four) are combined, so technically there are three packet exchanges. Each simplex (half-)connection uses 2-way exchange, as you proposed.&lt;/p&gt;&#xA;" OwnerUserId="20261" LastEditorUserId="20261" LastEditDate="2015-11-05T08:41:32.473" LastActivityDate="2015-11-05T08:41:32.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24091" PostTypeId="1" CreationDate="2015-11-05T08:34:28.207" Score="1" ViewCount="67" Body="&lt;p&gt;I have a security problem on my network, sometimes some computers are disconecting from internet, when i visualised log files of my cyberoam , i found in top domains some adresses not recognised  like :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;bfm-vh.akamaihd.net&lt;/li&gt;&#xA;&lt;li&gt;akmedia.shahid.net  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;is that can be considered as an attack ?&#xA;if yes what are the solutions of that ? &#xA;Thanks by advance&lt;/p&gt;&#xA;" OwnerUserId="20129" LastActivityDate="2015-11-05T08:34:28.207" Title="Cyberoam Internet Issue" Tags="|security|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24092" PostTypeId="2" ParentId="23985" CreationDate="2015-11-05T10:24:36.213" Score="6" Body="&lt;p&gt;I think your question is not truly correct.&#xA;First of all, as explain &lt;a href=&quot;http://searchenterprisewan.techtarget.com/guides/MPLS-VPN-fundamentals&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;&lt;em&gt;an MPLS VPN is a VPN that is built on top of an MPLS network, usually from a service provider, to deliver connectivity between enterprise office locations.&lt;/em&gt; &quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;MPLS&lt;/strong&gt; is the mechanism that directs data from one network node to the next, based on &lt;em&gt;short path labels&lt;/em&gt; instead network addresses. This avoid the routing table complexity.&#xA;MPLS works in conjunction with IP and its routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on this, &lt;strong&gt;MPLS VPN&lt;/strong&gt; is a method to harm the power of MPLS to create virtual private networks.&#xA;There are three different type of MPLS VPN:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Layer 3 MPLS VPNs&lt;/li&gt;&#xA;&lt;li&gt;Layer 2 MPLS VPNs&lt;/li&gt;&#xA;&lt;li&gt;Point-to-point (pseudowire)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, the &lt;strong&gt;protocol&lt;/strong&gt; on the base of all this environment is the &lt;em&gt;Label Distribution Protocol&lt;/em&gt; (LDP), which routers, capable of MPLS, exchange label mapping information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Label tagging is developped to works MPLS network also &lt;em&gt;without&lt;/em&gt; VPN.&#xA;Then, MPLS VPNs born to combine the power of MPLS and the Border Gateway Protocol (BGP) routing protocol: MPLS is used to forward packets over the provider’s network backbone, and BGP is used for distributing routes over the backbone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The common thing (if you analyze a packet captured in a MPLS network) is the MPLS header that is (in a L3 MPLS) always putted between datalink layer and IP layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qkxp8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qkxp8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a L3 MPLS VPNs, for example, the situation is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wKeYy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wKeYy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In details, the MPLS header frame format is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KOX1A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KOX1A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20302" LastEditorUserId="20302" LastEditDate="2019-02-08T17:22:47.137" LastActivityDate="2019-02-08T17:22:47.137" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24093" PostTypeId="1" CreationDate="2015-11-05T10:25:04.813" Score="1" ViewCount="73" Body="&lt;p&gt;I'm working on a project of indoor localization based on wifi.&#xA;I believe we can get the RSSI and the MAC address from the frame header, however i would like to know if there is a way to get this infos from the root node in a mesh network.&#xA;So if a device is performing a probe request with a remote node, is the root node aware of it ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To better understand, i know that cisco CMX can do that with a cisco MSE as a root node. Does anyone know how they do that ? Is there a way do to that in a open source way ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks ! &lt;/p&gt;&#xA;" OwnerUserId="20345" LastActivityDate="2015-11-05T10:25:04.813" Title="Get RSSI and Mac origin on a mesh network for probe request" Tags="|cisco|mac-address|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24094" PostTypeId="1" AcceptedAnswerId="24195" CreationDate="2015-11-05T11:15:20.290" Score="2" ViewCount="7083" Body="&lt;p&gt;I am trying to create a VPN connection between 2 sonicwall TZ 200 and I follow most popular tutorial on the net without success; as sonicwall - whatever I did - shows &quot;No Active VPN Tunnels&quot;. The VPN should got linked between:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Main Office [sonicwall router with local IP 192.168.2.1]&lt;/li&gt;&#xA;&lt;li&gt;Branch office [sonicwall router with local IP 192.168.3.1]&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In both offices we have static WAN IP address from ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to make basic Site to Site connection between those offices so they can access each other subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I need in order to make this work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the configuration I used is as following:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/5NWLl.jpg&quot; alt=&quot;General&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/IM3Hw.jpg&quot; alt=&quot;Network&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/YG8Wj.jpg&quot; alt=&quot;Branch office&quot;&gt; &lt;img src=&quot;https://i.stack.imgur.com/nFsgO.jpg&quot; alt=&quot;Main office&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/8YPNv.jpg&quot; alt=&quot;Proposals&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/DuAg2.jpg&quot; alt=&quot;Advance&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then the it was activated like this from the other side but with changing the peer and local &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/mLcoF.jpg&quot; alt=&quot;After activate&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aggressive mode:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1   11/08/2015 09:11:35.912 Info    VPN IKE IKE negotiation aborted due to timeout  192.168.1.15, 500   xx.xx.xx.xxx, 500   VPN Policy: Tubli Office&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2   11/08/2015 09:11:01.912 Info    VPN IKE IKE Initiator: Remote party timeout - Retransmitting IKE request.   192.168.1.15, 500   xx.xx.xx.xxx, 500   VPN Policy: Tubli Office&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3   11/08/2015 09:10:42.912 Info    VPN IKE IKE Initiator: Remote party timeout - Retransmitting IKE request.   192.168.1.15, 500   xx.xx.xx.xxx, 500   VPN Policy: Tubli Office&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4       11/08/2015 09:10:33.912 Info    VPN IKE IKE Initiator: Remote party timeout - Retransmitting IKE request.   192.168.1.15, 500   xx.xx.xx.xxx, 500   VPN Policy: Tubli Office&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5       11/08/2015 09:10:26.400 Info    VPN IKE IKE Initiator: Start Aggressive Mode negotiation (Phase 1)  192.168.1.15, 500   xx.xx.xx.xxx, 500   VPN Policy: Tubli Office&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Main mode:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1       11/08/2015 08:59:28.352 Info    VPN IKE IKE Initiator: Remote party timeout - Retransmitting IKE request.   192.168.1.20, 500   xx.xx.xx.xxx, 500   VPN Policy: Main Office &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2       11/08/2015 08:59:09.352 Info    VPN IKE IKE Initiator: Remote party timeout - Retransmitting IKE request.   192.168.1.20, 500   xx.xx.xx.xxx, 500   VPN Policy: Main Office &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3       11/08/2015 08:58:57.352 Info    VPN IKE IKE Initiator: Remote party timeout - Retransmitting IKE request.   192.168.1.20, 500   xx.xx.xx.xxx, 500   VPN Policy: Main Office &lt;/p&gt;&#xA;&#xA;&lt;p&gt;4       11/08/2015 08:58:50.352 Info    VPN IKE IKE Initiator: Start Main Mode negotiation (Phase 1)    192.168.1.20, 500   xx.xx.xx.xxx, 500   VPN Policy: Main Office&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure settings are same from both sides. xx.xx.xx.xxx to hide the IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure if Advance settings is needed here as well but it is same in both sides&lt;/p&gt;&#xA;" OwnerUserId="20337" LastEditorUserId="20337" LastEditDate="2015-11-08T06:15:46.020" LastActivityDate="2015-11-08T08:12:36.137" Title="VPN connection between 2 sonicwall devices" Tags="|vpn|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24096" PostTypeId="1" AcceptedAnswerId="24098" CreationDate="2015-11-05T13:01:19.293" Score="2" ViewCount="109" Body="&lt;p&gt;My topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 &amp;lt;-&gt; R2 &amp;lt;-&gt; R3 &amp;lt;-&gt; R4 &amp;lt;-&gt; R5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every router is in a different AS. R4 is based on IOS. All the other routers are based on CentOS7 (Bird internet routing dameon).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have formed peers between all routers and wanted to distribute routes from R1 and R5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2, R3 and R4 got the routes from R1 and R2. R1 and R5 don't even receive them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to ping R1 and R5 from R2, R3, R4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know where my mistakes are and I am quite confused. Is there a limitation of route distribution in BGP between several ASes? Where is my mistake?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router config R1 (bird)&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP interface 1: 10.0.0.2/30   (to R2)&#xA;IP interface 2: 9.9.9.1/24  &#xA;&#xA;Bird config:&#xA;router id 10.0.0.2;&#xA;debug protcols all;&#xA;protocol kernel {&#xA;learn;&#xA;scan time 20;&#xA;import all;&#xA;export all;&#xA;}&#xA;protocol static {&#xA;     route 9.9.9.0/24 via 9.9.9.1;&#xA;}&#xA;protocol bgp AS_to_R2 {&#xA;local as 100;&#xA;neighbor 10.0.0.1 as 200;&#xA;keepalive time 5;&#xA;import all;&#xA;export all;&#xA;direct;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router config R2 (bird)&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP interface 1: 10.0.0.1/30   (to R1)&#xA;IP interface 2: 22.22.22.1/30 (to R3)&#xA;&#xA;Bird config:&#xA;router id 22.22.22.1;&#xA;debug protcols all;&#xA;protocol kernel {&#xA;learn;&#xA;scan time 20;&#xA;import all;&#xA;export all;&#xA;}&#xA;protocol bgp AS_to_R3 {&#xA;local as 200;&#xA;neighbor 22.22.22.2 as 300;&#xA;keepalive time 5;&#xA;import all;&#xA;export all;&#xA;direct;&#xA;}&#xA;protocol bgp AS_to_R1 {&#xA;local as 200;&#xA;neighbor 10.0.0.2 as 100;&#xA;keepalive time 5;&#xA;import all;&#xA;export all;&#xA;direct;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router config R3 (bird)&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP interface 1: 22.22.22.2/30 (to R2)&#xA;IP interface 2: 90.0.143.1/30 (to R4)&#xA;&#xA;Bird config:&#xA;router id 90.0.143.1;&#xA;debug protcols all;&#xA;protocol kernel {&#xA;learn;&#xA;scan time 20;&#xA;import all;&#xA;export all;&#xA;}&#xA;protocol bgp AS_to_R2 {&#xA;local as 300;&#xA;neighbor 22.22.22.1 as 200;&#xA;keepalive time 5;&#xA;import all;&#xA;export all;&#xA;direct;&#xA;}&#xA;protocol bgp AS_to_R3 {&#xA;local as 300;&#xA;neighbor 90.0.143.2 as 400;&#xA;keepalive time 5;&#xA;import all;&#xA;export all;&#xA;direct;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco Router Config (which is R4, simple route forwarding):&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface f0/0&#xA;ip address 90.0.143.2 255.255.255.248 (to R3)&#xA;no shut&#xA;&#xA;interface f0/1&#xA;ip address 40.235.60.21 255.255.255.252 (to R5)&#xA;no shut&#xA;&#xA;router bgp 400&#xA;bgp router-id 90.0.143.20&#xA;neighbor 90.0.143.2 remote-as 300       #(session to R3)&#xA;neighbor 40.235.60.22 remote-as 500     #(session to R5)&#xA;neighbor 90.0.143.2 activate&#xA;neighbor 40.235.60.20 activate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router config R5 (bird)&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP interface 1(to R4): 40.235.60.22/30&#xA;IP interface 2: 4.4.4.1/30&#xA;&#xA;Bird config:&#xA;router id 40.235.60.22;&#xA;debug protcols all;&#xA;protocol static {&#xA;     route 4.4.4.0/30 via 4.4.4.1;&#xA;}&#xA;protocol kernel {&#xA;learn;&#xA;scan time 20;&#xA;import all;&#xA;export all;&#xA;}&#xA;protocol bgp AS_to_R4 {&#xA;local as 500;&#xA;neighbor 40.235.60.21 as 400;&#xA;keepalive time 5;&#xA;import all;&#xA;export all;&#xA;direct;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14081" LastEditorUserId="8499" LastEditDate="2015-11-05T16:45:19.733" LastActivityDate="2015-11-05T16:45:19.733" Title="Route distribution BGP failed" Tags="|bgp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24098" PostTypeId="2" ParentId="24096" CreationDate="2015-11-05T14:04:03.313" Score="1" Body="&lt;p&gt;You have a typo on R4:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;neighbor 40.235.60.22 remote-as 500     #(session to R5)&#xA;neighbor 40.235.60.20 activate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-05T14:04:03.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24099" PostTypeId="2" ParentId="24068" CreationDate="2015-11-05T14:44:54.630" Score="26" Body="&lt;p&gt;In order for the connection to work, each side needs to verify that it can send packets to the other side. &lt;strong&gt;The only way to be sure that you got a packet to the other side is by getting a packet from them that, by definition, would not have been sent unless the packet you sent got through&lt;/strong&gt;. TCP &lt;em&gt;essentially&lt;/em&gt; uses two kinds of messages for this: SYN (to request proof that this packet got through) and ACK (which only gets sent after a SYN gets through, to prove that the SYN got through). There's actually a third kind of message, but we'll get to that in a moment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before the connection starts, neither side really knows anything about the other. &lt;strong&gt;The client sends a SYN packet to the server, to request proof that its messages can get through&lt;/strong&gt;. That doesn't tell either person anything, but it's the first step of the handshake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the SYN gets through, then the server knows that the client can send packets to it, because, well, it just happened. &lt;strong&gt;But that doesn't prove that the server can send packets back: clients can send SYNs for lots of reasons&lt;/strong&gt;. So the server needs to send two messages back to the client: an ACK (to prove that the SYN got through) and a SYN (to request an ACK of its own). TCP combines these two messages into one -a SYN-ACK message, if you will- to reduce network traffic. This is the second step of the handshake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Because a SYN-ACK is an ACK, the client now knows for sure that it can send packets to the server. And because a SYN-ACK is a SYN, it also knows that the server wants proof that this message got through.&lt;/strong&gt; So it sends back an ACK: just a plain ACK this time, because it doesn't need proof anymore that its packets can get through. This is the final step of the handshake: the client now knows that packets can go both ways, and that the server is &lt;em&gt;just about&lt;/em&gt; to figure this out (because it knows the ACK will go through).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Once that ACK gets through, now the server knows that it can send packets to the client&lt;/strong&gt;. It also knows that the client knows this, so it can start sending data right away. The handshake is complete. We have a good channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Well, strictly speaking, we can't be &lt;em&gt;certain&lt;/em&gt; we have a good channel&lt;/strong&gt;. Just because this sequence of packets got through does not &lt;em&gt;strictly&lt;/em&gt; guarantee that others will. We can't prove that without sending an infinite number of SYNs and ACKs, and then nothing else would ever get done, so that's not really a practical option. &lt;strong&gt;But in practice, three steps turns out to be good enough for most purposes&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="20267" LastEditorUserId="20267" LastEditDate="2016-10-31T15:52:34.073" LastActivityDate="2016-10-31T15:52:34.073" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24101" PostTypeId="1" AcceptedAnswerId="24102" CreationDate="2015-11-05T15:04:00.723" Score="3" ViewCount="12833" Body="&lt;p&gt;I have a question about connecting two LANs (logically same LAN) over a VPN.&#xA;In picture below you can see overall representation of our implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Description:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On each side, we have distinct sites with AAA servers (both servers share same base). We have 2 VLANs. For normal users (who can pass authentication) and guests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Guests can only get to the Internet. Normal users can get to the Internet, and, if needed connect to co-workers at the other site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, an IPsec + NAT configuration should work well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main problem is outgoing IPsec packets from one router will be &quot;stripped&quot; on the site side of another router. How, in this situation, do we put this packet in VLAN 10 (for normal users) if we lose the VLAN tag information?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope I was clear in description of problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short: How do we put packets, coming from IPsec, in VLAN 10 (for normal users), or is there any way to propagate a VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BxaqS.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BxaqS.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="18847" LastEditorUserId="8499" LastEditDate="2015-11-06T00:52:59.823" LastActivityDate="2023-03-03T12:32:51.927" Title="Propagate VLAN through VPN (IPsec)?" Tags="|cisco|vlan|vpn|ipsec|ieee-802.1x|" AnswerCount="5" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24102" PostTypeId="2" ParentId="24101" CreationDate="2015-11-05T15:19:12.480" Score="1" Body="&lt;p&gt;VLANs are layer-2 domains, and they end at a layer-3 boundary (router). A layer-2 frame is stripped from the layer-3 packet at the first router it encounters. When the layer-3 packet reaches the second router, a new layer-2 frame will encapsulate the packet for the VLAN of the destination subnet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-05T15:19:12.480" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24103" PostTypeId="2" ParentId="24101" CreationDate="2015-11-05T15:22:16.210" Score="1" Body="&lt;p&gt;If the packet's destination address belongs to the IP subnet on VLAN 10, then the router will forward the packet onto that VLAN.  I am assuming that the IP subnet for VLAN 10 is different at each site.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-05T15:22:16.210" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24104" PostTypeId="1" AcceptedAnswerId="24105" CreationDate="2015-11-05T15:31:01.643" Score="6" ViewCount="2541" Body="&lt;p&gt;Token rings have an optional priority feature, for which the 8 access control bits in the token ring non-token frame are used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose we are working with the delayed token reinsertion scheme. How does the priority scheduling for the token work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what is the difference in meaning and use between the 3 priority bits and the 3 reservation bits?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose here, the non-destination stations in the ring will have to copy the frame too, since they have to change the priority/reservation bits and recalculate the CRC. Am I correct?&lt;/p&gt;&#xA;" OwnerUserId="20357" LastEditorUserId="8499" LastEditDate="2018-12-22T05:08:41.793" LastActivityDate="2018-12-22T05:08:41.793" Title="How does priority work in token ring?" Tags="|protocol-theory|lan|layer2|layer1|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24105" PostTypeId="2" ParentId="24104" CreationDate="2015-11-05T15:52:03.613" Score="5" Body="&lt;p&gt;Cisco has a pretty good &lt;a href=&quot;http://docwiki.cisco.com/wiki/Token_Ring/IEEE_802.5&quot;&gt;explanation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Priority System&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Token Ring networks use a sophisticated priority system that permits&#xA;  certain user-designated, high-priority stations to use the network&#xA;  more frequently. Token Ring frames have two fields that control&#xA;  priority: the priority field and the reservation field.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Only stations with a priority equal to or higher than the priority&#xA;  value contained in a token can seize that token. After the token is&#xA;  seized and changed to an information frame, only stations with a&#xA;  priority value higher than that of the transmitting station can&#xA;  reserve the token for the next pass around the network. When the next&#xA;  token is generated, it includes the higher priority of the reserving&#xA;  station. Stations that raise a token's priority level must reinstate&#xA;  the previous priority after their transmission is complete.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If a non-destination station wants to reserve the token for the next pass, it must have a higher priority, and it uses that to reserve the token by putting its priority into the reservation bits. The Frame Delimiter and Access Control are not included in the Frame Check Sequence, so changing the reservation bits doesn't require a new CRC.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-05T15:52:03.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24106" PostTypeId="1" AcceptedAnswerId="24108" CreationDate="2015-11-05T09:35:50.377" Score="6" ViewCount="4957" Body="&lt;p&gt;At work, we have a network with 2 routers connected to ISPs, and other routers in our internal network like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP                        ISP&#xA;|(BGP)                      |(BGP)&#xA;R1                         R2&#xA;|----(my_network/cloud)-----|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The default route for my routers in &quot;my_network&quot; is currently R1, and we switch it to R2 manually if there's a problem between R1 and the ISP. We'd like it to be automatic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 and R2 run Cisco IOS and get their default routes to ISP with BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/47868-ospfdb9.html&quot; rel=&quot;noreferrer&quot;&gt;there&lt;/a&gt; that OSPF could propagate a default route with &lt;code&gt;default-information originate&lt;/code&gt;, but I'm not sure how it works and I have no labs to test it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I configure both R1 and  R2 like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1 (config)&amp;gt; router ospf&#xA;R1 (router-ospf)&amp;gt; network my_network my_network_mask area 1&#xA;R1 (router-ospf)&amp;gt; default-information originate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will it do what I want?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the R2 default routes announcement have a lower metric than the one from R1 in the case R1 can't reach ISP? &lt;/p&gt;&#xA;" OwnerUserId="20412" OwnerDisplayName="david_loup" LastEditorUserId="8499" LastEditDate="2015-11-05T17:03:31.660" LastActivityDate="2018-08-11T02:44:45.057" Title="OSPF default route, 2 routers connecting to ISP" Tags="|routing|cisco-ios|ospf|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24107" PostTypeId="1" CreationDate="2015-11-05T16:53:32.427" Score="1" ViewCount="1430" Body="&lt;p&gt;I'm trying to figure out where is the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The router&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Cisco small business RV 325.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have set two Easy VPNs with different pre-shared keys. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first one, &quot;ManagementVPN&quot; should lead to a 192.168.98.1/24 LAN with DHCP Enabled (I created a VLAN and a DHCP server) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other one should lead to a 192.168.42.1/24 (DHCP Enabled).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both links can be connected but both give me an IP in 42 range. Both links are set with the &quot;Split tunnel&quot; option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created two users, both are with an unassigned group membership. The first is destined to reach the first VPN and the second the other VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Client to Gateway config (2nd VPN)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bIP4K.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bIP4K.png&quot; alt=&quot;Configuration for 2nd VLAN&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first VLAN has the same config, but the IP Address is set to 192.168.98.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Issue summary&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's as if the tunnel was established with the wrong shared key, or the second was used anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used Windows 7 connectivity tool to connect to the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any clue?&lt;/p&gt;&#xA;" OwnerUserId="20126" LastEditorUserId="20126" LastEditDate="2015-11-05T18:30:47.180" LastActivityDate="2016-08-24T09:21:18.133" Title="Multiple Easy VPN on Cisco Small Business RV325" Tags="|cisco|vpn|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24108" PostTypeId="2" ParentId="24106" CreationDate="2015-11-05T17:00:28.257" Score="3" Body="&lt;p&gt;You can inject a default route into OSPF with the &lt;code&gt;default-information originate&lt;/code&gt; command which will advertise a default route from a router, as long as there is a default route in the routing table of that router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can configure a static default route on each router, but have the defaults routes with different administrative distances. The default route with the lowest AD will be preferred, but when that link is down, the other default route will take over.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-05T17:39:07.060" LastActivityDate="2015-11-05T17:39:07.060" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24111" PostTypeId="1" CreationDate="2015-11-05T18:45:31.303" Score="2" ViewCount="3081" Body="&lt;p&gt;I'm running new IOS 15.4.3(M2) on 2911 and 15.4.3(S3) on ISR4331s.  I have the following QoS policy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map WAN-EGRESS-POLICY&#xA; class CLASSIFY-AF41&#xA;    bandwidth remaining percent 25&#xA; class CLASSIFY-AF31&#xA;    bandwidth remaining percent 30&#xA; class CLASSIFY-AF21&#xA;    bandwidth remaining percent 15&#xA; class class-default&#xA;     random-detect dscp-based&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In prior IOS versions, Cisco would allocate 25% to the default class, which leaves you to allocate 75% of the remaining bandwidth (or changeable with the max reserved bandwidth command).  Now, Cisco allows you to configure up to 100%, however, I'm not clear on what &quot;percentage&quot; that leaves the default class.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I have 70% assigned to classes above.  My questions is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming full 100% allocation by default, what is allocated to the default class if it's not specified?&lt;/p&gt;&#xA;" OwnerUserId="20363" LastEditorUserId="8499" LastEditDate="2015-11-06T00:57:57.313" LastActivityDate="2015-11-06T00:57:57.313" Title="Cisco QoS - Default Class Allocation" Tags="|cisco|qos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24112" PostTypeId="2" ParentId="24111" CreationDate="2015-11-05T19:01:06.147" Score="2" Body="&lt;p&gt;You are not assigning 70% of the bandwidth because you are using the &lt;code&gt;remaining&lt;/code&gt; keyword.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are not reserving or dedicating the bandwidth you assign. If a class is not using all its bandwidth, other classes can use it, too. The default class gets to use any unreserved bandwidth that is not used. It could use up to 100% of the bandwidth, as can any of the classes, if it is not reserved. The &lt;code&gt;bandwidth percent&lt;/code&gt; command doesn't exclusively reserve bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-packet-marking/10100-priorityvsbw.html&quot; rel=&quot;nofollow&quot;&gt;paper&lt;/a&gt; describing how this works:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;How Is Unused Bandwidth Allocated?&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This section explains how the queueing system distributes any&#xA;  remaining bandwidth. Here is how the Class-Based Weighted Fair&#xA;  Queueing Feature Overview describes the allocation mechanism: &quot;If&#xA;  excess bandwidth is available, the excess bandwidth is divided amongst&#xA;  the traffic classes in proportion to their configured bandwidths. If&#xA;  not all of the bandwidth is allocated, the remaining bandwidth is&#xA;  proportionally allocated among the classes, based on their configured&#xA;  bandwidth.&quot; Let's look at two examples.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In the first example, policy-map foo guarantees 30 percent of the&#xA;  bandwidth to class bar and 60 percent of the bandwidth to class baz.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map foo &#xA;  class bar &#xA;    bandwidth percent 30 &#xA; class baz &#xA;  bandwidth percent 60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;If you apply this policy to a 1 Mbps link, it means that 300 kbps is&#xA;  guaranteed to class bar, and 600 kbps is guaranteed to class baz.&#xA;  Importantly, 100 kbps is leftover for class-default. If class-default&#xA;  does not need it, the unused 100 kbps is available for use by class&#xA;  bar and class baz. If both classes need the bandwidth, they share it&#xA;  in proportion to the configured rates. In this configuration, the&#xA;  sharing ratio is 30:60 or 1:2.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-05T21:49:46.450" LastActivityDate="2015-11-05T21:49:46.450" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24115" PostTypeId="1" AcceptedAnswerId="24129" CreationDate="2015-11-05T21:27:22.603" Score="0" ViewCount="134" Body="&lt;p&gt;I came across this question and I have no clue how to prove. Any help would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q) Prove that a shortest path across a graph is loop free&lt;/p&gt;&#xA;" OwnerUserId="20369" LastActivityDate="2015-11-06T07:25:08.397" Title="Network Routing and what makes network loop free" Tags="|routing|network-core|" AnswerCount="1" CommentCount="3" ClosedDate="2015-11-07T08:53:04.357" ContentLicense="CC BY-SA 3.0" />
  <row Id="24117" PostTypeId="2" ParentId="24101" CreationDate="2015-11-05T22:13:04.593" Score="2" Body="&lt;p&gt;&quot;VPN&quot; is the wrong term here. That implies a layer-3 (IP) transport between sites. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your diagram, 10.0/16 is the subnet on both sites. For that to work, one would need a &lt;em&gt;bridge&lt;/em&gt; between sites. An IOS &lt;code&gt;tunnel&lt;/code&gt; interface could achieve this. (as could several other methods) Bridge &quot;VLAN 10&quot; (whatever interface that may be) and the tunnel interface, and it should work [tunnel and vlan remain layer-2 interfaces; the BVI handles layer-3.] Some tweaking would be required to keep the DHCP domains isolated -- since this creates one broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better solution would be to segment each site into it's own subnet. And place each guest lan into an isolated, local-only VLAN. Then let routing and VPN(s) (tunnel or not) handle everything. VRF and/or ACLs can isolate and restrict guest access.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-11-05T22:13:04.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24119" PostTypeId="5" CreationDate="2015-11-05T22:41:15.613" Score="0" Body="&lt;p&gt;A Media Access Control (MAC) address is used by many OSI layer-2 protocols as the OSI layer-2 address used in the frame encapsulation. There are two types of MAC address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EUI-48:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A 48-bit MAC address comprised of two parts: a 24-bit Organizationally Unique Identifier (OUI), and a 24-bit number unique within the OUI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;48-bit MAC addresses are the most commonly used type of MAC address, and they are used for protocols such as ethernet, token ring, FDDI, 802.11 Wi-FI, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EUI-64:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A 64-bit MAC address can have one of three different formats:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;MA-L assignment: a 24-bit Organizationally Unique Identifier (OUI),&#xA;and a 40-bit number unique within the OUI.&lt;/li&gt;&#xA;&lt;li&gt;MA-M: a 28-bit Organizationally Unique Identifier (OUI), and a 36-bit&#xA;number unique within the OUI.&lt;/li&gt;&#xA;&lt;li&gt;MA-S: a 36-bit Organizationally Unique Identifier (OUI), and a 28-bit&#xA;number unique within the OUI.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;64-bit MAC addresses are used primarily by wireless personal area network (WPAN) protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 SLAAC uses a modified EUI-64 address to create an OSI layer-3 address from either a 48-bit or 64-bit MAC address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-06T07:51:16.040" LastActivityDate="2015-11-06T07:51:16.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24120" PostTypeId="4" CreationDate="2015-11-05T22:41:15.613" Score="0" Body="For questions about Media Access Control (MAC) address which is used as the OSI layer-2 address for many OSI layer-2 protocols." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-06T07:51:07.560" LastActivityDate="2015-11-06T07:51:07.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24121" PostTypeId="1" CreationDate="2015-11-06T01:17:15.053" Score="4" ViewCount="213" Body="&lt;p&gt;In OLSR we have the MPR - Multi Point Relays and MS - Multi Point Relay Selector. During the topology control messages flood, each MPR floods its MS set. Based on the MS set info of each node, every node builds the routing table. Is it possible to route if the MPR sets were flooded instead of the MS set?&lt;/p&gt;&#xA;" OwnerUserId="20379" LastEditorUserId="19543" LastEditDate="2015-11-08T17:16:29.397" LastActivityDate="2018-11-23T21:00:40.140" Title="OLSR mobile routing protocol" Tags="|routing|mobile|ad-hoc-wireless|olsr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24123" PostTypeId="1" AcceptedAnswerId="24126" CreationDate="2015-11-06T01:44:31.887" Score="0" ViewCount="131" Body="&lt;p&gt;I'm a bit confused as to how static IP's work. People talk about setting it up directly on the router, but you can also it up right on the computer. Do you need to do both? Or just one? If you were to just set the static IP on your computer, how would the router know which IP address to give that computer? I want to have my router give my server a static IP but continue to give the other computers IPs with DHCP .&lt;/p&gt;&#xA;" OwnerUserId="20325" LastActivityDate="2015-11-06T01:52:55.230" Title="Static IP set on router or on computer" Tags="|router|ip|" AnswerCount="1" CommentCount="5" ClosedDate="2015-11-06T01:55:48.373" ContentLicense="CC BY-SA 3.0" />
  <row Id="24124" PostTypeId="2" ParentId="23798" CreationDate="2015-11-06T01:48:00.583" Score="2" Body="&lt;p&gt;You said IT telephony provider so I'm assuming  Hosted VoIP service. If this is the case you should be most concerned with your upload internet bandwidth, 50 simultaneous users using the G711 codec will consume 4.25 Mbps so you should budget enough for your normal data needs and the VoIP usage. Some things you could do to make use of limited bandwidth are implement bandwidth prioritization for traffic going to the VoIP service, cap other non essential tasks going out to the internet, and use a smaller codec if supported by your provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other things you can check to resolve VoIP Quality Issues:&#xA;- Ensure no problems with cabling&#xA;- Reaching throughput or other limits on switches, more common with lower end switches&#xA;- Do standard network tests to different components on the network to see where the latency if any is being introduced.&#xA;- Implement network monitoring to provide more insight into bandwidth utilization, and other device metrics. I would recommend PRTG, and depending on your needs 100 sensors are free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best of luck with your issues, if you continue to experience issues I would contact your VoIP provider as they may be able to troubleshoot with you.&lt;/p&gt;&#xA;" OwnerUserId="14613" LastActivityDate="2015-11-06T01:48:00.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24126" PostTypeId="2" ParentId="24123" CreationDate="2015-11-06T01:52:55.230" Score="0" Body="&lt;p&gt;If the router will give the ip to the server it is not a pure Static IP...&#xA;To have a pure Static IP you must define it in the Server/NIC... and then point the gateway to the router addres...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think what you want is a feature that are present in some routers called &quot;IP Reservation&quot;, where you associate a IP with a MAC Address from a NIC so the router always gave the same IP to that computer.&lt;/p&gt;&#xA;" OwnerUserId="20380" LastActivityDate="2015-11-06T01:52:55.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24128" PostTypeId="2" ParentId="23203" CreationDate="2015-11-06T06:45:03.290" Score="1" Body="&lt;p&gt;A WiFi repeater or extender is used to extend the coverage area of a WiFi network. It works by receiving your existing WiFi signal, amplifying it and then transmitting the boosted signal. With a WiFi repeater you can effectively increase the coverage area of your WiFi network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WiFi boosters, repeaters, and extenders are mostly the same thing - devices to extend WiFi coverage. There isn’t a clearly defined difference between devices that manufacturers describe as “repeaters” and devices described as “extenders”. However, not all WiFi extenders work in the exact same way. There are several different kinds of devices available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a couple of solutions to try before opting for a WiFi extender. The simplest is to try moving the location of your WiFi router to the most central location possible. If that doesn’t help (or if changing location just isn’t practical) check if your router needs to be upgraded. If you’ve had an older model for many years, it could be time for an upgrade to a more powerful model. For upgrade, go for some dual band routers with ultrafast processors and gigabit ethernet ports for use with Smart TVs or game consoles. There are routers with unique Beamforming technology which allows the routers to concentrate the WiFi signal towards your WiFi devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If everything is fine, that means you have a big place to cover and a WiFi extender could be the solution for you. There are a couple of different options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the most straightforward is a powerline ethernet kit. The kit allows you to send your internet signal over the electrical circuit in your home or office. Firstly, it’s fast to set up. You plug and go.Secondly, it’s fast in bandwidth terms. An extender that uses WiFi will usually see some speed loss. But the distance between power outlets can have an impact on performance, and so can the kind of wiring you have in your place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The alternate solution is a WiFi repeater. Dual band repeaters get around the speed loss that you mentioned by connecting to the router on one band and outputting a WiFi signal on the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One final feature that helps reduce speed loss is dual radios. If the device has dual radios, it can speak to the main router on lower channels, and then rebroadcast on higher channels. There are routers which can be installed outdoors too.&lt;/p&gt;&#xA;" OwnerUserId="20387" LastEditorUserId="20387" LastEditDate="2015-11-06T19:01:11.987" LastActivityDate="2015-11-06T19:01:11.987" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24129" PostTypeId="2" ParentId="24115" CreationDate="2015-11-06T07:25:08.397" Score="4" Body="&lt;p&gt;By contradiction: Suppose &lt;em&gt;p&lt;/em&gt; is the shortest path across the graph and &lt;em&gt;p&lt;/em&gt; has a loop. Remove the loop. The new loop-less path across the graph is shorter than &lt;em&gt;p&lt;/em&gt;. We have achieved a contradiction, so our initial supposition must be false.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(This applies only if &quot;shortest&quot; means &quot;smallest sum of edge weights&quot; and there are no negative edge weights.)&lt;/p&gt;&#xA;" OwnerUserId="19700" LastActivityDate="2015-11-06T07:25:08.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24130" PostTypeId="1" CreationDate="2015-11-06T11:05:22.090" Score="5" ViewCount="296" Body="&lt;p&gt;I'm trying to connect a Zyxel Speedlink router to a Cisco 886VA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the FE ports on the Cisco 886VA are switchports and I can't assign the ports an IP address directly. Therefore, I have to create a SVI and add the FE interface to the VLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if I assign the switchport interface FE0 on the 886VA to VLAN 1(native) and give the SVI an IP address of 192.168.1.1/24, I can't ping the Zyxel IP address 192.168.1.2/24. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe this is because the Zyxel isn't compatible with Cisco VLANs, but I'm not sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone please let me know if it's possible for the Zyxel Speedlink to talk to Cisco 886VA?&lt;/p&gt;&#xA;" OwnerUserId="20399" LastEditorUserId="453" LastEditDate="2018-08-25T13:30:50.053" LastActivityDate="2019-04-22T21:03:05.600" Title="Need Zyxel Speedlink router to communicate with Cisco 886VA router" Tags="|cisco-commands|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="24132" PostTypeId="1" AcceptedAnswerId="24141" CreationDate="2015-11-06T12:27:06.270" Score="47" ViewCount="9062" Body="&lt;p&gt;This will be a kind of newbie question but I am not quite sure why we really need IPv6. AFAIK, the story is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the olden days, when computers were not plentiful, 32 bit IP addresses were enough for everybody. At these times, the subnet mask was implicit. Then the number of computers have increased and 32 bits started to become insufficient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the subnet mask started to become explicit. Essentially the size of an IP address has increased.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, what is the downside of continuing the addressing with the subnet masks? For example when they become insufficient as well, can't we continue with using &quot;subnet-subnet masks&quot; etc.?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that it consumes more space than the original IPv4 (and maybe not much different than using IPv6) but aren't explicit subnet masks a sufficient solution? If not, why are they an insufficient solution?&lt;/p&gt;&#xA;" OwnerUserId="19156" LastEditorUserId="8499" LastEditDate="2017-09-11T18:13:35.677" LastActivityDate="2017-09-11T18:13:35.677" Title="Why do we need IPv6?" Tags="|ipv4|ip|ipv6|ip-address|" AnswerCount="5" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="24133" PostTypeId="2" ParentId="24132" CreationDate="2015-11-06T12:56:47.613" Score="4" Body="&lt;p&gt;First of all the variable subnet mask technique did become insufficient. That is why people invented the Network address translation technique where you can use public IP to mask multiple private IP's. Even with this technique, we are almost out of IP's to allocate. Also NAT breaks one of the founding principles of the Internet: the end to end principle. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the main reason for using IPv6 is that everyone will have available as many public IP's as they need and all the complexity of using NAT will disappear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 also provides other functionality that I will not go into detail:mandatory security at the IP level, enables Stateless address auto configuration, no more broadcasting only multicasting and provides a more efficient processing by routers by simplifying the header. Also in this age of mobile devices it has explicit support for mobility in the form of mobile IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your proposal of using subnet/subnet masks:it does not sound feasible since its implementation would break all existing applications and it is not really elegant. If you have to change things  why not go for something new and well thought.&lt;/p&gt;&#xA;" OwnerUserId="4584" LastActivityDate="2015-11-06T12:56:47.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24134" PostTypeId="2" ParentId="24132" CreationDate="2015-11-06T13:50:40.003" Score="7" Body="&lt;p&gt;Simply put, there are no more IPv4 address available.  All (or nearly all) the available IPv4 addresses have been allocated.  The explosion of IP devices, laptops, phones, tablets, cameras, security devices, etc, etc, have used up all the address space.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-06T13:50:40.003" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24136" PostTypeId="1" AcceptedAnswerId="24137" CreationDate="2015-11-06T14:38:46.343" Score="3" ViewCount="104" Body="&lt;p&gt;With my simple understanding of the Internets nature, it is basically a network full of networks along with servers and hard-drives that hold data. Which comes to my question on how are these servers connected to each other to form this massive network we call the Internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do the Internet Service Providers just send out cables across the continents to eachother on a mutual deal or something? &lt;/p&gt;&#xA;" OwnerUserId="20407" LastActivityDate="2015-12-16T04:04:56.980" Title="How are collective networks connected to eachother for the creation of the Internet?" Tags="|internet|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24137" PostTypeId="2" ParentId="24136" CreationDate="2015-11-06T14:47:52.067" Score="0" Body="&lt;p&gt;The Internet is better described as a hierarchy of networks, with small carriers connected to mid-size carriers, who in turn are connected to worldwide providers.  &lt;a href=&quot;http://computer.howstuffworks.com/internet/basics/internet-infrastructure1.htm&quot; rel=&quot;nofollow&quot;&gt;This article&lt;/a&gt; will give you a nice overview.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-06T14:47:52.067" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24139" PostTypeId="2" ParentId="24132" CreationDate="2015-11-06T15:03:23.460" Score="16" Body="&lt;p&gt;The Internet Protocol (IP) was designed to provide end-to-end connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 32 bits of an IPv4 address only allow for about 4.3 billion unique addresses. Then you must subtract a bunch of addresses for things like multicast, and there is a lot of math showing that you can never use the full capacity of a subnet, so there are a lot of wasted addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are about twice as many humans as there are usable IPv4 addresses, and many of those humans consume multiple IP addresses. This doesn't even touch on the business needs for IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using NAT to satisfy the IP address hunger breaks the IP end-to-end connection paradigm. It becomes difficult to expose enough public IP addresses. Think for a minute what you, as a home user with only one public IP address, would do if you want to allow multiple devices using the same transport protocol and port, say two web servers, which by convention use TCP port 80, to be accessed from the public Internet. You can port forward TCP port 80 on your public IP address to one private IP address, but what about the other web server? This scenario will require you to jump through some hoops which a typical home user isn't equipped to handle. Now, think about the &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_of_Things&quot;&gt;Internet of Things&lt;/a&gt; (IoT) where you may have hundreds, or thousands, of devices (light bulbs, thermostats, thermometers, rain gauges and sprinkler systems, alarm sensors, appliances, garage door openers, entertainment systems, pet collars, and who knows what all else), some, or all, of which want to use the same specific transport protocols and ports. Now, think about businesses with IP address needs to provide their customers, vendors, and partners with connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP was designed for end-to-end connectivity so, no matter how many different hosts use the same transport protocol and port, they are uniquely identified by their IP address. NAT breaks this, and it limits IP in ways it was never intended to be limited. NAT was simply created as a way to extend the life of IPv4 until the next IP version (IPv6) could be adopted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 provides enough public addresses to restore the original IP paradigm. IPv6 currently has 1/8 of the IPv6 addresses in the entire IPv6 address block set aside for globally routable IPv6 addresses. Assuming there are 17 billion people on earth in the year 2100 (not unrealistic), the current global IPv6 address range (1/8 of the IPv6 address block) provides over 2000 /48 networks for each and every one of those 17 billion people. Each /48 network is 65,536 /64 subnets with 18,446,744,073,709,551,616 addresses per subnet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-06T17:33:14.200" LastActivityDate="2015-11-06T17:33:14.200" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24140" PostTypeId="2" ParentId="24136" CreationDate="2015-11-06T15:05:51.900" Score="1" Body="&lt;p&gt;Like you said, the internet is something like multiple networks along the planet connected each other. On your example, there are some networks, small networks, eg: your company network, taht is connected to your ISP, and that ISP is connected to a bigger ISP, and so on, until arrive to BIGGER points of interconnection, called IPX, forming the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, a picture of Wikipedia, from this link. &lt;a href=&quot;https://es.wikipedia.org/wiki/Tier_1&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://es.wikipedia.org/wiki/Tier_1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the networks are separated by some characteristics, as size,...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/T48Mv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/T48Mv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the image, you are located on the lower side, like an internet user.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-11-06T15:05:51.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24141" PostTypeId="2" ParentId="24132" CreationDate="2015-11-06T15:17:28.983" Score="83" Body="&lt;p&gt;Two things are getting confused here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;classful addressing vs CIDR&lt;/li&gt;&#xA;&lt;li&gt;Masquerading / NAT&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Going from classful addressing to Classless Inter Domain Routing (CIDR) was an improvement that made the address distribution to ISPs and organisations more efficient, thereby also increasing the lifetime of IPv4. In classful addressing an organisation would get one of these:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a class A network (a /8 in CIDR terms, with netmask 255.0.0.0)&lt;/li&gt;&#xA;&lt;li&gt;a class B network (a /16 in CIDR terms, with netmask 255.255.0.0)&lt;/li&gt;&#xA;&lt;li&gt;a class C network (a /24 in CIDR terms, with netmask 255.255.255.0)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All of these classes were allocated from fixed ranges. Class A contained all addresses where the first digit was between 1 and 126, class B was from 128 to 191 and class C from 192 to 223. Routing between organisations had all of this hard-coded into the protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the classful days when an organisation would need e.g. 4000 addresses there were two options: give them 16 class C blocks (16 x 256 = 4096 addresses) or give them one class B block (65536 addresses). Because of the sizes being hard-coded the 16 separate class C blocks would all have to be routed separately. So many got a class B block, containing many more addresses than they actually needed. Many large organisations would get a class A block (16,777,216 addresses) even when only a few hundred thousand were needed. This wasted a lot of addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CIDR removed these limitations. Classes A, B and C don't exist anymore (since ±1993) and routing between organisations can happen on any prefix length (although something smaller than a /24 is usually not accepted to prevent lots of tiny blocks increasing the size of routing tables). So since then it was possible to route blocks of different sizes, and allocate them from any of the previously-classes-A-B-C parts of the address space. An organisation needing 4000 addresses could get a /20, which is 4096 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnetting means dividing your allocated address block into smaller blocks. Smaller blocks can then be configured on physical networks etc. It doesn't magically create more addresses. It only means that you divide your allocation according to how you want to use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What did create more addresses was Masquerading, better known as NAT (Network Address Translation). With NAT one device with a single public address provides connectivity for a whole network with private (internal) addresses behind it. Every device on the local network thinks it is connected to the internet, even when it isn't really. The NAT router will look at outbound traffic and replace the private address of the local device with its own public address, pretending to be the source of the packet (which is why it was also known as masquerading). It remembers which translations it has made so that for any replies coming back it can put back the original private address of the local device. This is generally considered a hack, but it worked and it allowed many devices to send traffic to the internet while using less public addresses. This extended the lifetime of IPv4 immensely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to have multiple NAT devices behind each other. This is done for example by ISPs that don't have enough public IPv4 addresses. The ISP has some huge NAT routers that have a handful of public IPv4 addresses. The customers are then connected using a special range of IPv4 addresses (&lt;code&gt;100.64.0.0/10&lt;/code&gt;, although sometimes they also use normal private addresses) as their external address. The customers then again have  NAT router that uses that single address they get on the external side and performs NAT to connect a whole internal network which uses normal private addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few downsides to having NAT routers though:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;incoming connections: devices behind a NAT router can only make outbound connections as they don't have their own 'real' address to accept incoming connections on&lt;/li&gt;&#xA;&lt;li&gt;port forwarding: this is usually made less of a problem by port forwarding, where the NAT routed dedicates some UDP and/or TCP ports on its public address to an internal device. The NAT router can then forward incoming traffic on those ports to that internal device. This needs the user to configure those forwardings on the NAT router&lt;/li&gt;&#xA;&lt;li&gt;carrier grade NAT: is where the ISP performs NAT. Yyou won't be able to configure any port forwarding, so accepting any incoming connections becomes (bit torrent, having your own VPN/web/mail/etc server) impossible&lt;/li&gt;&#xA;&lt;li&gt;fate sharing: the outside world only sees a single device: that NAT router. Therefore all devices behind the NAT router share its fate. If one device behind the NAT router misbehaves it's the address of the NAT router that ends up on a blacklist, thereby blocking every other internal device as well&lt;/li&gt;&#xA;&lt;li&gt;redundancy: a NAT router must remember which internal devices are communicating through it so that it can send the replies to the right device. Therefore all traffic of a set of users must go through a single NAT router. Normal routers don't have to remember anything, and so it's easy to build redundant routes. With NAT it's not.&lt;/li&gt;&#xA;&lt;li&gt;single point of failure: when a NAT router fails it forgets all existing communications, so all existing connections through it will be broken&lt;/li&gt;&#xA;&lt;li&gt;big central NAT routers are expensive&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you can see both CIDR and NAT have extended the lifetime of IPv4 for many many years. But CIDR can't create more addresses, only allocate the existing ones more efficiently. And NAT does work, but only for outbound traffic and with higher performance and stability risks, and less functionality compared to having public addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is why IPv6 was invented: Lots of addresses and public addresses for every device. So your device (or the firewall in front of it) can decide for itself which inbound connections it wants to accept. If you want to run your own mail server that is possible, and if you don't want anybody from the outside connecting to you: that's possible too :)  IPv6 gives you the options back that you used to have before NAT was introduced, and you are free to use them if you want to.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-11-06T15:17:28.983" CommentCount="18" ContentLicense="CC BY-SA 3.0" />
  <row Id="24142" PostTypeId="1" CreationDate="2015-11-06T15:29:04.897" Score="1" ViewCount="1082" Body="&lt;p&gt;Can an AP broadcast on more than one channel?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 TP Link routers that can only broadcast on a single channel at any given time. You can choose the channel to be fixed, or select the 'auto' feature, which brings me to my other question &gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you select the 'auto' channel option, is the selection random, or the AP has an scheme that can detect what are the surrounding channels and choose a channel accordingly; more over, once an 'auto' channel is selected, does it change if there was too much interference on that channel, ie, is the channel selection adaptive and automagical?&lt;/p&gt;&#xA;" OwnerUserId="20410" LastActivityDate="2015-11-06T15:55:59.733" Title="Can a router broadcast on more than one channel?" Tags="|router|ieee-802.11|access-point|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24143" PostTypeId="2" ParentId="24130" CreationDate="2015-11-06T15:34:08.190" Score="1" Body="&lt;p&gt;The Zyxel will probably not respond to ping because it has its firewall enabled, and it purposely ignores any attempt to connect from the WAN side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to connect the Zyxel to a switch port on the Cisco router. You have a couple of options there. You can use DHCP on the Cisco to assign the IP address to the Zyxel, or you can statically assign an IP address to the Zyxel. In either case, you want to connect the Zyxel WAN port to the Cisco switch port. Statically configuring the Zyxel means manually configuring everything that it would expect to get from an ISP (e.g. DNS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to set the Zyxel to bridge mode and allow the Cisco to be the router, and the Zyxel to be only a Wi-Fi AP. The Cisco would need to handle the DHCP functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Zyxel is a consumer-grade device, and questions about configuring those are specifically off-topic. You can ask those questions on Super User.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-06T15:34:08.190" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24144" PostTypeId="2" ParentId="24136" CreationDate="2015-11-06T15:52:48.970" Score="0" Body="&lt;p&gt;Suppose you want to start an ISP (Internet service Provider). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need a group of servers, for example for DNS, e-mail, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to put a router to connect your servers and users to the rest of the world, so the best place is an Internet exchange point (&lt;em&gt;IX&lt;/em&gt;). The primary purpose of an IX is to allow networks to interconnect directly (as they are inside the same building), eliminating the cost of installing costly cables from your ISP to high-tier ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You put your equipments on the IX premises, get agreements with other ISPs on the same IX and now your ISP is public and working. You pay a rent for using the space and electrical power of the IX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The more connections you have, the better service you give. So, there comes a time when your ISP needs to connect to other ISP not available through the IX, let's call it ABC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can rent the use of a limited bandwith on a link to ABC belonging to a third-party provider, let's call it XYZ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your ISP is growing and then there is a moment that you can consider stop paying a rent for the limited bandwith to XYZ and then you deploy your own connection with more bandwith directly to ABC eliminating the monthly fee.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP keeps growing, so you are considering to connect directly to ISPs on other continents, then you have to pay a monthly fee for bandwith on a submarine cable, unless your business has grown so much that you can deploy your own one.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-11-06T15:52:48.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24145" PostTypeId="2" ParentId="24142" CreationDate="2015-11-06T15:55:59.733" Score="1" Body="&lt;p&gt;Let's use a more correct term &quot;transmit&quot; instead of &quot;broadcast,&quot; which has other meanings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A radio can only transmit on one channel at a time.  Some radios can change frequency very rapidly to give the appearance they operate on more than one channel, but that technique is too complicated and expensive for something like WiFi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your second question, it depends on the AP manufacturer.  Most have some sort of algorithm to pick an unused channel, but how they do that is a proprietary secret.  Generally, changing channels in the middle is a bad idea, since there will be an interruption in service until the user can &quot;find&quot; the new channel.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-06T15:55:59.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24147" PostTypeId="1" CreationDate="2015-11-06T15:59:20.407" Score="1" ViewCount="166" Body="&lt;p&gt;I was attempting to use a VACL to block intra-VLAN traffic. The VACL was matching a MACL that specified an EtherType to block. I applied the VACL to a VLAN, and then plugged two PCs into the switch in the same VLAN to test the VACL. For some reason, the VACL did not block any of the specified traffic. I was wondering if anyone else could test this and see if they get similar results. I was able to block traffic with the VACL based on other criteria, such as a RACL blocking ICMP. This was tested on a 3750V2 with 12.2(55)SE5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the configuration I was using below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mac access-list extended IPv6_MACL&#xA;permit any any 0x86DD 0&#xA;&#xA;vlan access-map Control_Intra_VLAN 10&#xA;match mac address IPv6_MACL&#xA;action drop&#xA;&#xA;vlan access-map Control_Intra_VLAN 20&#xA;action forward&#xA;&#xA;vlan filter Control_Intra_VLAN vlan-list 23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20419" LastActivityDate="2015-11-06T15:59:20.407" Title="VACL Matching on EtherType" Tags="|switching|acl|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24148" PostTypeId="2" ParentId="24132" CreationDate="2015-11-06T16:29:37.553" Score="2" Body="&lt;p&gt;The major organization that distributes IP's to the regional orgs is completely exhausted. ARIN - the regional org in the US has been exhausted for the past few months. The only regional org that still has some IP's left is AfriNIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a lot of companies/orgs, like Ford, MIT, etc that have full Class A IP ranges. Back when they acquired them, no one thought we would run out so quick. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this time, to buy IP's, you either wait for a company to go out of business and buy it on the gray market, or you try to buy unused IPs from another company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP's designed for a region, cannot be used in another region. Well they can, but it is highly discouraged (geo-IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this time, a lot of companies are getting ready for IPv6. The switch isn't easy as its very expensive to buy new equipment that supports full IPv6 for those who have 10s of thousands of servers.&lt;/p&gt;&#xA;" OwnerUserId="20424" LastActivityDate="2015-11-06T16:29:37.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24149" PostTypeId="1" CreationDate="2015-11-06T16:31:27.557" Score="1" ViewCount="1977" Body="&lt;p&gt;I am noticing that our Dell N4000 series switch connected to a stack of Cisco devices is constantly attempting to change spanning tree topology. The Cisco switch is our Internet connection and a fiber loop that connects to our other offices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My logs are:&lt;br&gt;&#xA;&lt;code&gt;&amp;lt;189&gt; Nov  6 09:34:36 SW105-1 TRAPMGR[dot1s_task]: traputil.c(777) 7355 %% Spanning Tree Topology Change Received: MSTID: 0 Te1/0/1&#xA;&amp;lt;189&gt; Nov  6 09:34:35 SW105-1 TRAPMGR[dot1s_task]: traputil.c(777) 7354 %% Spanning Tree Topology Change: 0, Unit: 1&#xA;&amp;lt;189&gt; Nov  6 09:34:35 SW105-1 TRAPMGR[dot1s_task]: traputil.c(777) 7353 %% Spanning Tree Topology Change Received: MSTID: 0 Te1/0/1&#xA;&amp;lt;189&gt; Nov  6 09:28:26 SW105-1 TRAPMGR[dot1s_task]: traputil.c(777) 7352 %% Spanning Tree Topology Change Received: MSTID: 0 Te1/0/1&#xA;&amp;lt;189&gt; Nov  6 09:28:25 SW105-1 TRAPMGR[dot1s_task]: traputil.c(777) 7351 %% Spanning Tree Topology Change: 0, Unit: 1&#xA;&amp;lt;189&gt; Nov  6 09:28:25 SW105-1 TRAPMGR[dot1s_task]: traputil.c(777) 7350 %% Spanning Tree Topology Change Received: MSTID: 0 Te1/0/1&#xA;&amp;lt;189&gt; Nov  6 08:38:20 SW105-1 TRAPMGR[dot1s_task]: traputil.c(777) 7347 %% Spanning Tree Topology Change Received: MSTID: 0 Te1/0/1&#xA;&amp;lt;189&gt; Nov  6 08:38:19 SW105-1 TRAPMGR[dot1s_task]: traputil.c(777) 7346 %% Spanning Tree Topology Change: 0, Unit: 1&#xA;&amp;lt;189&gt; Nov  6 08:38:19 SW105-1 TRAPMGR[dot1s_task]: traputil.c(777) 7345 %% Spanning Tree Topology Change Received: MSTID: 0 Te1/0/1&#xA;&amp;lt;189&gt; Nov  6 08:29:16 SW105-1 TRAPMGR[dot1s_task]: traputil.c(777) 7344 %% Spanning Tree Topology Change Received: MSTID: 0 Te1/0/1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only config on the port is:&lt;br&gt;&#xA;&lt;code&gt;switchport mode general&#xA;switchport general pvid 10&#xA;switchport general allowed vlan add 10&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it be best to enable tcn guard and bpdu filter on this port?&lt;/p&gt;&#xA;" OwnerUserId="3449" LastActivityDate="2015-11-06T16:31:27.557" Title="Block MSTP on port Dell N series networking" Tags="|spanning-tree|dell|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24151" PostTypeId="1" CreationDate="2015-11-06T18:11:07.783" Score="3" ViewCount="282" Body="&lt;p&gt;In  the TC  message of  OLSR    that    is  created by  each    node    x,  x   includes    its MS  set,&lt;br&gt;&#xA;i.e.,   a   list    of  nodes   that    have    selected    it  as  an  MPR.    Assume  instead that    TC  messages&lt;br&gt;&#xA;created by  each    node    x,  let x   include its MPR set (rather than    its MS  set).   Will    the &#xA;routing still   work    properly?&lt;/p&gt;&#xA;" OwnerUserId="20432" LastEditorUserId="19543" LastEditDate="2015-11-08T17:16:16.027" LastActivityDate="2018-11-23T11:01:20.217" Title="In OLSR instead of MS if MPR selector are used, will it work?" Tags="|routing|protocol-theory|mobile|ad-hoc-wireless|olsr|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24152" PostTypeId="1" AcceptedAnswerId="24159" CreationDate="2015-11-06T18:11:27.787" Score="3" ViewCount="1015" Body="&lt;p&gt;I am trying to create named extended access-lists on Cisco IOS on an 800 series router, but it changes the destination network to 0.0.0.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended ACL-TEST&#xA;    permit tcp host 192.168.1.44 192.168.2.0 255.255.255.0 eq 44818&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is accepted with no errors, but then when I run &quot;show access-lists&quot; the output is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Extended IP access list ACL-TEST&#xA;    10 permit tcp host 192.168.1.44 0.0.0.0 255.255.255.0 eq 44818&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?  Thanks.&lt;/p&gt;&#xA;" OwnerUserId="20431" LastActivityDate="2015-11-06T20:20:57.647" Title="Cisco IOS Extended Access List changes destination network to 0.0.0.0" Tags="|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24153" PostTypeId="1" AcceptedAnswerId="24154" CreationDate="2015-11-06T19:02:22.417" Score="9" ViewCount="1671" Body="&lt;p&gt;Let's consider a host A in an autonomous system AS100. Suppose it wants to communicate with host B in another AS, say, AS200. In AS100 there are several routers. Within one AS, the rotuing protocols used are Internal gateway protocols such as OSPF or RIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AS100 needs to know the path through other AS-es to AS200, so the edge routers in AS100 are BGP routers, BGP is an external gateway protocol used for routing between autonomous systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If AS100 is connected to, say, two ASes (it has two eBGP routers), how does host A inside AS100 know which BGP router to talk to, in order to communicate with host B in AS200?&lt;/strong&gt; Host A tells its router that it wants to communicate with host B. Now, that router would need to know the path to host B. But host B is outside AS100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Do eBGP routers send their routing tables to all routers (both BGP and IGP) in one AS&lt;/strong&gt;? I mean, 'normal' routers inside AS have to know a lot, they have to choose the appropriate border router so that host A can calk to host B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all routers know the same thing, then why would anyone need iBGP? Generally BGP routing tables are big, so it's probably a false statement, but I'm not sure how could host A know the right path if its neighbour routers didn't know all the routes the border routers have.&lt;/p&gt;&#xA;" OwnerUserId="20229" LastEditorUserId="20229" LastEditDate="2015-11-07T11:20:05.597" LastActivityDate="2022-03-31T02:42:48.637" Title="BGP - how does IGP know the right route?" Tags="|routing|bgp|ospf|igp|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24154" PostTypeId="2" ParentId="24153" CreationDate="2015-11-06T19:19:46.163" Score="4" Body="&lt;p&gt;There are multiple ways to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other ASes could be sending a default route, or the router in AS100 could just have a default route configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other ASes could just advertise their own routes through BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other ASes could advertise full BGP routes to AS100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP has many factors which could play into the decision of which way to switch traffic destined to another AS. This is the subject of entire books, and it is beyond the scope of this site. It is far more complicated than IGP routing protocols, and it may involve many steps to determine the best path. Often is just boils down to how many AS hops away it is to get to the other AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be confused about the role of iBGP. The distinction of iBGP and eBGP is whether or not the neighbor is in the same AS. An AS will almost always have more routers than just the routers connecting to other ASes. The routers internal to the AS would have the same AS number as their neighbors, so they would use iBGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would also be a huge discussion about how design within an AS. Again, you could have default routes, full or partial routing tables, a combination, etc., or a mix of IGP and iBGP (which is involved because you could use a full-mesh, route reflectors, confederations, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What BGP neighbors send each other can be controlled. It could be full routing tables, or it could be whatever the AS owner decides is appropriate. there is no one answer to this question.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-06T19:19:46.163" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24155" PostTypeId="2" ParentId="24153" CreationDate="2015-11-06T19:23:56.337" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Do eBGP routers send their routing tables to all routers (both BGP and&#xA;  IGP) in one AS?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, that's the whole point of running a separate protocol.  BGP speakers redistribute a very small number of routes into the IGP.  If you only have one link outside your AS, then the BGP router just needs to redistribute a default route.  If you have more than one exit point, you may redistribute a few summary routes to steer traffic in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often, only a default route is advertised into the IGP by the BGP speakers, and the BGP speakers will route the traffic outside the AS based on their routing information.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, A doesn't need to know everything, it only needs to know how to get to the border routers, who can then route traffic correctly.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-06T19:23:56.337" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24156" PostTypeId="2" ParentId="24153" CreationDate="2015-11-06T19:25:42.123" Score="3" Body="&lt;p&gt;BGP protocol is the routing protocol of the INTERNET. IT´s the way that all the autonomus systems are interconnected. The BGP is conformed by 2 types of peers, internal and external peers(from the AS point of view). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, you, like a network administrator, need to know the networks that you want to announce to the world(once that you have been approved by some HIGHER organization like ARIN, RIPE, and so on). Well, you need to know the networks that you are propietary and you want to &quot;announce&quot;. That´s what AS100 and AS200 does, announcing the networks that host A and B are connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have adoubt about how the known of that networks travels accross 2 other autonomous system. That is the way that BGP works: One autonomus system is on charge to announce its own network and resend(it is permitted or needed) the networks that learned from it eBGP peers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On that way, is something like a HUGE mesh of BGP peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, host A can communicate to host B, on different autonomus system, cause,eg: the AS200 knows to reach network_of_host_A located on AS100, and it´s reached across some_number_of_AS(known as AS_PATH).&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-11-06T19:25:42.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24157" PostTypeId="2" ParentId="24087" CreationDate="2015-11-06T19:32:13.837" Score="0" Body="&lt;p&gt;The main answer to you question is that the domain and subdomain system helps to scale the administration of computer names that map to a certain IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DNS only maps a domain name to an IP. If you want to communicate with mydomain.com then your computer needs the IP of the server where that domain is hosted, since computers communicate and are identified based on IP addresses (and MAC on layer 2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When trying to establish a connection to mydomain.com, your computer will make a query to the DNS system to send him the IP of the machine associated with that domain. Note that multiple domains can be mapped to the same IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same happens when you communicate with a subdomain like sub10.sub1.mydomain.com. What you can infer from domains with a common suffix is that it may be possible that they are under the same administration and the hosts associated with them are also under the same administration.&lt;/p&gt;&#xA;" OwnerUserId="4584" LastEditorUserId="4584" LastEditDate="2015-11-06T19:58:02.283" LastActivityDate="2015-11-06T19:58:02.283" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24158" PostTypeId="1" CreationDate="2015-11-06T20:03:25.070" Score="1" ViewCount="66" Body="&lt;p&gt;I have a timecapsule connecting to my ISP router in bridge mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: If i'm connected to the timecapsule, and exchanging data with the router, will the traffic go to the router to come back to the time capsule, or is the timecapsule simply forwarding?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is it:&#xA;a- device 1 -&gt; time capsule -&gt; router -&gt; time capsule -&gt; device 2&#xA;b- device 1 -&gt; time capsule -&gt; device 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, I'm asking because the bandwidth differ!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your answers.&lt;/p&gt;&#xA;" OwnerUserId="20443" LastActivityDate="2015-11-06T20:03:25.070" Title="Bridge mode: will traffic go to the router or not?" Tags="|bridge|" AnswerCount="0" CommentCount="1" ClosedDate="2015-11-07T08:52:23.543" ContentLicense="CC BY-SA 3.0" />
  <row Id="24159" PostTypeId="2" ParentId="24152" CreationDate="2015-11-06T20:20:57.647" Score="6" Body="&lt;p&gt;Access lists do not use an ordinary subnet mask. They use a &quot;wildcard &quot; mask. A wildcard mask is the ones complement of the subnet mask. So 255.255.255.0 becomes 0.0.0.255&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-06T20:20:57.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24160" PostTypeId="1" CreationDate="2015-11-06T21:18:53.647" Score="1" ViewCount="771" Body="&lt;p&gt;I have a Netgear Prosafe as per the title and as of yesterday when I relocated my office to a different room in the house it continually drops internet connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My ISP is Virgin Media and I am on the SuperHub 2 (which is not that super). I am using it in modem mode and using the prosafe as my firewall and switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I can get a connection the best I have had a connection for is 42 minutes.  I then have to disconnect the WAN cable, reboot the switch, wait for it to come up fully then connect the WAN cable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a few seconds this then connects to the internet and I am able to browse, download and do anything a normal person would want \ need to do and then as I have mentioned it goes down again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I previously saw a fix for this on Virgin Media forums but cannot find it again but was wondering if there are any specific things that I could do or check to ensure my rig is as it should be and to stop this from happening again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device specs are&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Netgear Prosafe FVS318G-V2&#xA;Firmware 4.3.1-9&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have run a packet trace to see whats going on and it says that two of my machines are unreachable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have since removed these and had the same thing with my NAS too. I have also fixed IP addresses, no change. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be very much appreciated. Also, bear with me if I take a while in replying as I may have lost my connection. &lt;/p&gt;&#xA;" OwnerUserId="20445" LastEditorUserId="8499" LastEditDate="2015-11-06T22:39:26.997" LastActivityDate="2015-11-06T22:39:26.997" Title="Netgear ProSafe FVS318G V2 keeps losing connection" Tags="|switch|internet|netgear-prosafe|" AnswerCount="0" CommentCount="0" ClosedDate="2015-11-11T14:37:56.670" ContentLicense="CC BY-SA 3.0" />
  <row Id="24161" PostTypeId="1" AcceptedAnswerId="24224" CreationDate="2015-11-06T21:43:44.400" Score="4" ViewCount="1436" Body="&lt;p&gt;In an SDN controller, when a new packet arrived to an OpenFlow-based router or switch and does not find a match flow entry in the OpenFlow flow tables, what does the SDN controller do? Does it just forward that packet to the destination and install its corresponding flow entry in the flow table? If so, why not just drop it for security reasons?&lt;/p&gt;&#xA;" OwnerUserId="19174" LastEditorUserId="8499" LastEditDate="2015-11-09T03:04:20.940" LastActivityDate="2018-05-29T14:29:18.103" Title="How do SDN controllers handle unknown packets?" Tags="|cisco|routing|router|sdn|openflow|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24162" PostTypeId="1" AcceptedAnswerId="24163" CreationDate="2015-11-06T21:49:10.783" Score="2" ViewCount="3620" Body="&lt;p&gt;Cisco ISR is reporting &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%FW-4-TCP_OoO_SEG: Dropping TCP Segment: seq:1979009128 1500 bytes is out-of-order; expected seq:1978984512. Reason: TCP reassembly queue overflow - session&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have adjusted config up to these limits to no avail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip inspect tcp reassembly memory limit 4096 &#xA;ip inspect tcp reassembly queue length 1024&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is occurring on traffic originating from the Internet or from a GRE tunnel, resulting in application timeout and rather slow download speeds. &lt;/p&gt;&#xA;" OwnerUserId="15982" LastEditorUserId="8499" LastEditDate="2015-11-07T01:00:53.397" LastActivityDate="2015-11-07T01:00:53.397" Title="Cisco ISR - Dropping TCP Segment: - Reason: TCP reassembly queue overflow" Tags="|cisco|firewall|tcp|cisco-isr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24163" PostTypeId="2" ParentId="24162" CreationDate="2015-11-06T22:15:07.933" Score="1" Body="&lt;p&gt;There are a few things you can adjust for this. I had to do this on a router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip inspect tcp reassembly queue length &amp;lt;length&amp;gt;&#xA;ip inspect tcp reassembly timeout &amp;lt;timeout&amp;gt;&#xA;ip inspect tcp reassembly memory limit &amp;lt;limit&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You don't seem to have adjusted the timeout. &lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-06T22:15:07.933" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24164" PostTypeId="2" ParentId="22634" CreationDate="2015-11-06T23:30:28.683" Score="2" Body="&lt;p&gt;Whilst the DNS packet format technically supports multiple questions, in practise there can only be one, and the vast majority of servers will return &lt;code&gt;FORMERR&lt;/code&gt; if more than one is seen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In part this is because there are no defined semantics for what RCODE to return if the multiple questions were to result in different responses (e.g. &lt;code&gt;NOERROR&lt;/code&gt; vs &lt;code&gt;NXDOMAIN&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="20449" LastActivityDate="2015-11-06T23:30:28.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24167" PostTypeId="1" AcceptedAnswerId="24176" CreationDate="2015-11-07T05:08:28.957" Score="2" ViewCount="1075" Body="&lt;p&gt;At one point, we had a system which performed best when is 100/MB half duplex mode. (purely anecdotal evidence). It was plugged into a switch with other systems running at 100 Mbs full. Seemed ok and NW guys did not report any issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how can you have systems on the same switch running different duplexes like that? Won't the 100Mbs half systems basically try to use CSMA/CD and 'disrupt' the other attached systems? I did not get a very good answer from the NW person at them time. &lt;/p&gt;&#xA;" OwnerUserId="20459" LastActivityDate="2015-11-07T22:25:49.887" Title="Full and half duplex 100 Mbs on the same switch" Tags="|ethernet|switching-modes|half-duplex|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24168" PostTypeId="2" ParentId="24167" CreationDate="2015-11-07T07:35:02.577" Score="2" Body="&lt;p&gt;The mode/speed is configured on the &lt;strong&gt;switch port&lt;/strong&gt;! &lt;br&gt;So you could have 12 ports in half-duplex(for devices that don't support full-duplex) and 12 ports in full-duplex. On the assumption that you're on a physical &quot;star topology&quot;, those in &quot;half&quot; won't disrupt the others.&lt;/p&gt;&#xA;" OwnerUserId="20317" LastEditorUserId="20317" LastEditDate="2015-11-07T14:35:27.843" LastActivityDate="2015-11-07T14:35:27.843" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24171" PostTypeId="1" CreationDate="2015-11-07T11:27:59.907" Score="5" ViewCount="1567" Body="&lt;p&gt;Let's say AS100 is a multihomed AS, connected to AS200 and AS300. It has two eBGP border routers - B1 is connected to AS200, B2 to AS300. The IGP inside AS100 is OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If B1 knows about AS200, and B2 knows about AS300, and AS100 has IGP protocol running in it, why would anyone need internal BGP (iBGP)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought that's the point of OSPF - it tells every router inside AS about the reachable networks and the right paths, so two hosts from any pair of networks can communicate. So if B1 knows about AS200, I thought that IGP just steps in and tell everyone else in AS100, including B2, about networks from AS100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But for some reason, iBGP is still needed between B1 and B2 to make thigs fully work. Is it because B2 needs to know exactly the same thing as B1 and vice versa and IGP isn't telling B2 all that B1 knows (not sure why)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd be grateful if you could explain it in the most straighforward way.&lt;/p&gt;&#xA;" OwnerUserId="20229" LastActivityDate="2015-11-07T14:22:56.183" Title="iBGP and IGP relationship" Tags="|routing|bgp|ospf|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24173" PostTypeId="1" CreationDate="2015-11-07T12:50:48.897" Score="4" ViewCount="214" Body="&lt;p&gt;Should it be possible for someone to export the binary payload (say from a UDP packet) captured from Wireshark and later send this stream as a &quot;valid&quot; UDP packet? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Longer story:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've captured a DNS query packet with Wireshark. I used the &quot;export&quot; feature of Wireshark to export the UDP payload to a binary file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using libnet to basically rebuild this packet and send it again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I resend my &quot;custom&quot; packet, I use Wireshark to sniff the output. The new stream is malformed only in the payload (DNS) section. I've verified that my binary output from Wireshark matches what Wireshark is showing. Cross-referencing the binary file, it matches with what I expect from the DNS specification. Am I overlooking some sort of assumption about Wireshark? Maybe I have an endian-related problem...&lt;/p&gt;&#xA;" OwnerUserId="4184" LastActivityDate="2016-03-23T02:59:04.740" Title="Copying bytes from Wireshark" Tags="|wireshark|dns|udp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24174" PostTypeId="2" ParentId="24171" CreationDate="2015-11-07T13:33:09.443" Score="2" Body="&lt;p&gt;It's not true that you always need iBGP.  Many networks with eBGP run fine without it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two scenarios where iBGP is important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are a transit provider.  That means you allow traffic to pass through your AS.  In your example, you allow AS 200 to reach AS 300 by going through you.  In this case, B1 needs to know B2's routes so it can advertise them to AS 200, and vice versa.   Your internal routers running OSPF don't need to know all these routes.  So B1 talks to B2 using iBGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have multiple border routers and they need to determine the best path out.  You many have a default route drawing traffic to your edge, but then you may have several carriers from which to chose.  B1 needs to know B2's routes so it can forward traffic to B2 if that's a better path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3909/why-use-ibgp-inside-an-autonomous-system-if-igp-protocols-fulfill-the-need-for?rq=1&quot;&gt;earlier SE question&lt;/a&gt; might help you too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several good books on BGP design, and you would be served well by reading them.  Look for books by Halabi, Stewart or Zhang.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-11-07T13:33:09.443" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24176" PostTypeId="2" ParentId="24167" CreationDate="2015-11-07T14:00:27.183" Score="2" Body="&lt;p&gt;In a hub, all the ports are electrically connected, and only one device at a time can talk on the wire. If more then one device talks at the same time, it creates a collision, so hub ports are all half-duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a switch, each port is isolated, and traffic from one port is selectively sent to other ports, so there are no collisions in the switch. Unlike a hub, where all the ports together are in one collision domain, each switch port is a separate collision domain. That means that each switch port can be set to full-duplex (when connected to a single device supporting full-duplex) or half-duplex (when connected to a hub or other device requiring half-duplex).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-07T22:25:49.887" LastActivityDate="2015-11-07T22:25:49.887" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24177" PostTypeId="2" ParentId="24171" CreationDate="2015-11-07T14:22:56.183" Score="2" Body="&lt;p&gt;Besides what Ron explained, you should also understand that each routing protocol maintains its own table which is separate from the routing table used by the router to forward traffic. It may be useful for routers running eBGP to share their BGP tables, and if they are in the same AS, they would need iBGP to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router running BGP and OSPF doesn't share routes between the routing protocols unless you specifically redistribute those routes from one routing protocol to another. This presents problems because the metrics, attributes, and administrative distances of each routing protocol are different. BGP maintains a lot of information which OSPF doesn't. If you get eBGP routes on Router 1, redistribute the routes into OSPF, and send them to Router 2 (also running BGP), then redistribute them back into BGP, you have lost all the BGP attributes which Router 1 had received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to maintain the BGP attributes from one BGP router to another BGP router is to let them communicate with BGP, and in the same AS that is iBGP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-07T14:22:56.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24178" PostTypeId="2" ParentId="23866" CreationDate="2015-11-07T17:09:47.953" Score="2" Body="&lt;p&gt;Use CDP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Show cdp neighbors&lt;/code&gt; will show you the name of the device on the interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course thats only if CDP is turned on on both devices.&lt;/p&gt;&#xA;" OwnerUserId="10329" LastEditorUserId="10329" LastEditDate="2016-04-05T18:40:03.390" LastActivityDate="2016-04-05T18:40:03.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24180" PostTypeId="1" AcceptedAnswerId="24244" CreationDate="2015-11-07T19:02:02.033" Score="2" ViewCount="2668" Body="&lt;p&gt;I have two Dell X1052 switches and a SonicWall TZ400 firewall.  The SonicWall has a WAN port and then 6 available LAN ports.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it best practice to connect a network cable from the LAN port of the SonicWall to my first X1052 switch and then connect a network cable from the first X1052 switch to the second X1052 switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it better to connect one network cable from the LAN port of the SonicWall to my first X1052 switch and then connect a second network cable from another LAN port on the SonicWall to my second X1052 switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help!&lt;/p&gt;&#xA;" OwnerUserId="20041" LastActivityDate="2015-11-09T15:08:36.917" Title="Dual Network Switch Setup to Firewall - Best Practices" Tags="|switch|sonicwall|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24181" PostTypeId="1" CreationDate="2015-11-07T19:57:01.457" Score="2" ViewCount="105" Body="&lt;p&gt;The company has a Wi-Fi network, and the company area is quite large. There is a dead zone in which the Internet is not available by client devices (about 30% of the total area). There were attempts to use the router as a repeater, but they were not crowned with success, as it was impossible to trace the users connected to the repeater (all users show up as a repeater). As far as I know, the repeater also does not nave a very good effect on network bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any ways to enhance the Wi-Fi signal without using repeaters? Using a cable is not considered as an option. It is also necessary that the network need to has &lt;em&gt;seamless roaming&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="20483" LastEditorUserId="8499" LastEditDate="2019-01-03T02:06:08.753" LastActivityDate="2019-01-03T02:06:08.753" Title="Strengthening Wi-Fi signal" Tags="|wireless|ieee-802.11|layer1|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24182" PostTypeId="2" ParentId="24181" CreationDate="2015-11-07T20:13:06.953" Score="1" Body="&lt;p&gt;It sounds like the Wi-Fi wasn't set up properly in the first place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably want to do it correctly, or you will continually run into problems. This involves performing a wireless site survey to identify proper WAP placement. After you get the survey, you need to install the WAPs, probably with a wireless controller to get seamless roaming. This will involve cabling for the WAPs (wireless is &lt;em&gt;not&lt;/em&gt; completely wireless). After implementation, you should perform another wireless site survey in order to be able to tweak the WAP placements and radio strengths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how companies do successful Wi-Fi design and implementation. Also, you don't own the airwaves and cannot control other wireless implementations which may happen close by and cause interference. The use of monitoring WAPs can help identify sources of interference which didn't exist before, and you may need to modify the AP placements and radio power over time to adjust for changing wireless conditions.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-07T20:13:06.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24183" PostTypeId="2" ParentId="24180" CreationDate="2015-11-07T21:05:07.263" Score="1" Body="&lt;p&gt;I think your firewall have 6 LAN network intrefaces to divide your networks, on the way to have varios networks  and apply security policies. The best practice is to connect one switch to a LAN port and this gonna be your intranet zone were will be located all your private lan and network infraestructure. Second, you can connect the other switch to a second LAN port ans this gonna be your DMZ zone, where will be located servers and services that are needed to be accesed from the outside, eg, a web server. This DMZ will be a place where you need to plan carefully your security and access from the outside. This one is the better practice.&#xA;If you dont need to have a DMZ zone, you can connect the 2 switch like you explain on your first case, one next to the other.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-11-07T21:05:07.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24184" PostTypeId="1" AcceptedAnswerId="24337" CreationDate="2015-11-07T21:29:49.790" Score="1" ViewCount="2061" Body="&lt;p&gt;I have a Dell X1052 network switch and I am trying to setup SNTP.  I don't have a time server on my network and my SonicWall TZ400 doesn't seem to work as an NTP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I get SNTP working to an external IP?  I have changed the Clock Source to &quot;SNTP&quot;, I've enabled the four options under SNTP Global Settings (Receive Broadcast Servers Updates, Receive Anycast Servers Updates, Receive Unicast Servers Updates, and Poll Unicast Requests).  I've added a bunch of IPs including ones from time.apple.com, &lt;a href=&quot;http://www.pool.ntp.org&quot; rel=&quot;nofollow&quot;&gt;http://www.pool.ntp.org&lt;/a&gt;, and several others from the web but after I add them, the Status just says &quot;Down&quot; and I never get the date and time to update.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="20041" LastActivityDate="2015-11-12T03:37:14.393" Title="Dell X1052 External NTP" Tags="|switch|ntp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24186" PostTypeId="1" AcceptedAnswerId="24187" CreationDate="2015-11-07T22:37:47.263" Score="3" ViewCount="1369" Body="&lt;p&gt;When my PC sends a request to a server, the transmitted IP address is the one of my private network. When the server responds to the request, how does the router know to which PC in the network to send the response?&lt;/p&gt;&#xA;" OwnerUserId="20489" LastEditorUserId="8499" LastEditDate="2018-03-08T04:59:50.040" LastActivityDate="2018-03-08T04:59:50.040" Title="How does a router know to which PC in a network to send a response from a server?" Tags="|router|ipv4|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24187" PostTypeId="2" ParentId="24186" CreationDate="2015-11-07T22:42:24.200" Score="4" Body="&lt;p&gt;The NAT process maintains the translations tables. When the client sends to the server, NAT creates a table entry which saves the fact that the client IP address and port sent something to the server IP address address and port. When something comes back from the server address and port to the public address and NAT selected port, NAT looks it up and sees that it should go to the client address and port.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-07T22:42:24.200" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="24191" PostTypeId="2" ParentId="6369" CreationDate="2015-11-08T04:47:42.603" Score="7" Body="&lt;p&gt;There are two parts to the answer.&lt;/p&gt;&#xA;&lt;p&gt;First, to answer your question directly: the official recommendation on this topic has changed. In the past, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3627&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3627&lt;/a&gt; is titled &amp;quot;Use of /127 Prefix Length Between Routers Considered Harmful&amp;quot; The current recommendation is different, though: &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6164&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6164&lt;/a&gt; recommends using a /127 (not a /126!) on point-to-point links. Both RFCs outline the reasons for the respective recommendations.&lt;/p&gt;&#xA;&lt;p&gt;The second part of the answer is that generally, outside point-to-point links, IPv6 &lt;em&gt;will&lt;/em&gt; break with any prefix longer than /64. It is actually not IPv6 itself, but many of the protocols it uses, such as SLAAC, Neighbor Discovery, etc. Since a point-to-point link does not involve any form of discovery, that consideration is not relevant, and a /127 will work.&lt;/p&gt;&#xA;" OwnerUserId="17317" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-11-08T04:47:42.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24192" PostTypeId="2" ParentId="1" CreationDate="2015-11-08T04:49:59.103" Score="2" Body="&lt;p&gt;Please check whether this helps, I know that I am late :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, this is from the Wikipedia article, &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Security_Association_and_Key_Management_Protocol&quot; rel=&quot;nofollow&quot;&gt;&lt;em&gt;Internet Security Association and Key Management Protocol&lt;/em&gt;&lt;/a&gt;, but I didn't see any references so far to Wiki/RFC here in discussion.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ISAKMP defines the procedures for authenticating a communicating peer,&#xA;  creation and management of Security Associations, key generation&#xA;  techniques and threat mitigation (e.g. denial of service and replay&#xA;  attacks). As a framework, ISAKMP is typically utilized by IKE for key&#xA;  exchange, although other methods have been implemented such as&#xA;  Kerberized Internet Negotiation of Keys. A Preliminary SA is formed&#xA;  using this protocol; later a fresh keying is done.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ISAKMP defines procedures and packet formats to establish, negotiate,&#xA;  modify and delete Security Associations. SAs contain all the&#xA;  information required for execution of various network security&#xA;  services, such as the IP layer services (such as header authentication&#xA;  and payload encapsulation), transport or application layer services or&#xA;  self-protection of negotiation traffic. ISAKMP defines payloads for&#xA;  exchanging key generation and authentication data. These formats&#xA;  provide a consistent framework for transferring key and authentication&#xA;  data which is independent of the key generation technique, encryption&#xA;  algorithm and authentication mechanism.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ISAKMP is distinct from key exchange protocols in order to cleanly&#xA;  separate the details of security association management (and key&#xA;  management) from the details of key exchange. There may be many&#xA;  different key exchange protocols, each with different security&#xA;  properties. However, a common framework is required for agreeing to&#xA;  the format of SA attributes and for negotiating, modifying and&#xA;  deleting SAs. ISAKMP serves as this common framework.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ISAKMP can be implemented over any transport protocol. All&#xA;  implementations must include send and receive capability for ISAKMP&#xA;  using UDP on port 500.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="20496" LastEditorUserId="8499" LastEditDate="2015-11-08T07:05:28.287" LastActivityDate="2015-11-08T07:05:28.287" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24193" PostTypeId="2" ParentId="119" CreationDate="2015-11-08T05:21:49.817" Score="4" Body="&lt;p&gt;The biggest concern is likely to identify &lt;em&gt;where&lt;/em&gt; your bottlenecks are going to be, in terms of route aggregation. The basic parameters are likely going to be: each subnet must be a /64 (dictated by IPv6), and you have a /60, /56, or /48 to play with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As others have said, a /48 gives you 64k subnets, but it's still easy to paint yourself into a corner if you just assign them randomly. Let's say you have 1000 store locations, and give each one a /64 sequentially from the start. Then you find out that the 43rd store needs a second subnet - that means, either renumbering that network, or giving the store two separate subnets that can't be aggregated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Incidentally, in the IPv4 world, you also get 64k subnets if you use the 10.x.x.x network and subnet it to /24s. Some of the practices you use in that scenario may translate nicely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One company I work for uses 10.x.x.x internally for about 150 branch offices (with some 100-500 computers at each location). The second byte is the branch number, and they use /22 instead of /24 for their subnets. So each branch office can have up to 64 subnets, which works nicely for them.&lt;/p&gt;&#xA;" OwnerUserId="17317" LastEditorUserId="17317" LastEditDate="2015-11-08T05:26:55.217" LastActivityDate="2015-11-08T05:26:55.217" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24194" PostTypeId="2" ParentId="130" CreationDate="2015-11-08T05:44:32.913" Score="5" Body="&lt;p&gt;The design philosophy behind IPv6 is that having a reasonably-structured address space is more important than conserving addresses. Incidentally, IPv4 was conceived with the same idea (which is why each device has 16 million loopback addresses, but only ever uses the 127.0.0.1 address, and most of the class D and E addresses are unused).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link-local addresses theoretically do waste gazillions of IP addresses, but it's not considered a problem. Similarly, giving each customer a full /56 or even /48 is technically very wasteful, but not a real problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a dark side to this approach: the claim that IPv6 can give an IP address to each grain of sand in the world (or some such) is nonsense, just as the claim that IPv4 can support 4 billion devices. In reality, by the time you add up all the waste in IPv6, you'll find that the limits are much narrower (still bigger than IPv4).&lt;/p&gt;&#xA;" OwnerUserId="17317" LastActivityDate="2015-11-08T05:44:32.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24195" PostTypeId="2" ParentId="24094" CreationDate="2015-11-08T08:12:36.137" Score="1" Body="&lt;p&gt;According your last log, not even Phase 1 is established because both sides of tunnel got a timeout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest to make a packet capture to find where the packet is stopping. You should filter in each device with public ip as filter. I suggest three scenarios:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The (returning) traffic is dropped at the firewall. You will see a red line with a drop code.&lt;/li&gt;&#xA;&lt;li&gt;There are no returning traffic. Some device is dropping IKE packets in the middle.&lt;/li&gt;&#xA;&lt;li&gt;You see normal returning traffic. There are another problem in your tunnel config.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2015-11-08T08:12:36.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24196" PostTypeId="2" ParentId="24151" CreationDate="2015-11-08T12:16:05.700" Score="1" Body="&lt;p&gt;It's impossible to answer your question because there are some assumptions wrong in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, in OLSR not all nodes generate TC messages.  Only nodes that have been selected as a MPR generate and relay TCs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, the node generating the TC message includes in it the list of all its symmetric neighbors, not just those that have selected it as a MPR (i.e. its MS set).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's &lt;a href=&quot;http://www.crans.org/~raffo/papers/phdthesis/thesisch1.html#x5-210001.4.4&quot; rel=&quot;nofollow&quot;&gt;a short explanation of the OLSR protocol&lt;/a&gt; and the &lt;a href=&quot;https://www.ietf.org/rfc/rfc3626.txt&quot; rel=&quot;nofollow&quot;&gt;RFC (3626) that details it&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2015-11-08T12:16:05.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24197" PostTypeId="2" ParentId="24121" CreationDate="2015-11-08T12:39:49.893" Score="1" Body="&lt;p&gt;A TC (Topology Control) message sent by a node &lt;em&gt;x&lt;/em&gt; contains a list of all symmetric neighbors of the node &lt;em&gt;x&lt;/em&gt;, not just the nodes that have selected &lt;em&gt;x&lt;/em&gt; as a MPR.  So your question contains a wrong assumption.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Including only MPRs or MSs in a TC message wouldn't allow all nodes in the network to get full topology information about the whole network.&lt;/p&gt;&#xA;" OwnerUserId="19543" LastEditorUserId="19543" LastEditDate="2015-11-08T18:23:41.310" LastActivityDate="2015-11-08T18:23:41.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24200" PostTypeId="1" CreationDate="2015-11-08T15:04:25.763" Score="1" ViewCount="810" Body="&lt;p&gt;I am seeing a lot of entries like this in my &lt;code&gt;Netgear DGN 1000&lt;/code&gt; log for the last few weeks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Wed, 2015-11-04 20:36:56 - TCP Packet - Source:192.168.0.2,63272 Destination:68.232.44.114,80 - [BLOCK]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.whois.com/whois/68.232.44.114&quot; rel=&quot;nofollow&quot;&gt;http://www.whois.com/whois/68.232.44.114&lt;/a&gt; I have learned that the server is owned by &lt;code&gt;EdgeCast Networks, Inc.&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this happening?&lt;/p&gt;&#xA;" OwnerUserId="20506" LastEditorUserId="20506" LastEditDate="2015-11-08T15:10:02.037" LastActivityDate="2015-11-08T15:10:02.037" Title="Why are TCP Packets going from my pc to server owned by EdgeCast Networks, Inc.?" Tags="|tcp|packet-analysis|" AnswerCount="0" CommentCount="8" ClosedDate="2015-11-08T15:10:40.973" ContentLicense="CC BY-SA 3.0" />
  <row Id="24201" PostTypeId="1" AcceptedAnswerId="24206" CreationDate="2015-11-08T15:42:24.073" Score="4" ViewCount="216" Body="&lt;p&gt;Initially, I thought that the reason token ring uses a physical star topology is to make up for the shortcomings of a physical ring. That is: In a ring, when a failure occurs at any point, the system goes down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I have read the following about daisy chains in &lt;a href=&quot;https://en.wikipedia.org/wiki/Network_topology#Daisy_chain&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt; (emphasis by me):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;By connecting the computers at each end, a ring topology can be&#xA;  formed. An advantage of the ring is that the number of transmitters&#xA;  and receivers can be cut in half, since a message will eventually loop&#xA;  all of the way around. When a node sends a message, the message is&#xA;  processed by each computer in the ring. &lt;strong&gt;If the ring breaks at a&#xA;  particular link then the transmission can be sent via the reverse path&#xA;  thereby ensuring that all nodes are always connected in the case of a&#xA;  single failure.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it says that a message can be transmitted in both directions, which ensures the system not to go down in case of a failure at a point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, if such thing is possible, why this isn't used in token ring as well? If it was used in token ring, then token ring wouldn't need a physical star topology. It could be a physical ring as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is there an error in this Wikipedia article or am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="19156" LastEditorUserId="33" LastEditDate="2015-11-10T19:32:36.037" LastActivityDate="2015-11-10T19:32:36.037" Title="Why token ring uses a physical star?" Tags="|cabling|layer2|layer1|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24202" PostTypeId="1" AcceptedAnswerId="24205" CreationDate="2015-11-08T16:13:53.710" Score="2" ViewCount="6260" Body="&lt;p&gt;I own a MAC address and I want to know from it, the IP address.&lt;/p&gt;&#xA;" OwnerUserId="20508" LastEditorUserId="8499" LastEditDate="2018-03-18T22:03:33.857" LastActivityDate="2022-05-12T19:49:33.853" Title="What is the relationship between the IP address and MAC address?" Tags="|ip|mac-address|layer2|ip-address|layer3|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24203" PostTypeId="2" ParentId="24202" CreationDate="2015-11-08T16:25:37.877" Score="5" Body="&lt;p&gt;There is no relationship. A MAC Address is a layer-2 address, and an IP address is a layer-3 address. The network layers are independent of each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A MAC address can have different layer-3 protocols with different layer-3 addresses. There were even implementations of networks which used only layer-2.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-08T16:25:37.877" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24205" PostTypeId="2" ParentId="24202" CreationDate="2015-11-08T16:37:16.403" Score="4" Body="&lt;p&gt;The &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_Resolution_Protocol&quot; rel=&quot;noreferrer&quot;&gt;ARP&lt;/a&gt; cache is the the link between them. The &lt;em&gt;Address Resolution Protocol&lt;/em&gt; is responsible for converting an IP-address to a MAC-address.&lt;/p&gt;&#xA;" OwnerUserId="20317" LastEditorUserId="20317" LastEditDate="2015-11-08T16:42:57.363" LastActivityDate="2015-11-08T16:42:57.363" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24206" PostTypeId="2" ParentId="24201" CreationDate="2015-11-08T16:59:03.293" Score="3" Body="&lt;p&gt;Token ring may appear to be a physical star, but it really is a ring from the perspective of the cabling. A physical token ring cable has an outbound cable, and an inbound cable inside it. Breaking one of those internal cables will break the ring, and the MAU will bypass the cable, thus preserving the ring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The token ring star can be thought of as a circle (ring) with various points pushed tightly toward the center of the circle. It is still a physical ring, just distorted:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mZLrH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mZLrH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The token travels around the ring, out to a workstation on the internal outbound cable leg, and back in on the inbound cable leg. If the workstation or one of the cable legs fails, the MAU heals the break, and the faulty link is isolated from the ring, preserving the ring.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-08T17:21:33.687" LastActivityDate="2015-11-08T17:21:33.687" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="24207" PostTypeId="2" ParentId="24181" CreationDate="2015-11-08T17:25:07.767" Score="2" Body="&lt;p&gt;You may be able to add an additional AP with a directional antenna to improve reception in the dead zone.  As @RonMaupin says, you will need a site survey to determine if this is possible. Repeaters are usually a bad idea.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-08T17:25:07.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24208" PostTypeId="5" CreationDate="2015-11-08T18:54:18.757" Score="0" Body="&lt;p&gt;An internet (lower-case &quot;i&quot;) is a network of networks (interconnected networks). What is know as the Internet (upper-case &quot;I&quot;) is the largest internet (network of networks). The networks comprising the Internet connect to each other by agreement of the network owners using BGP as the routing protocol. BGP uses TCP as the transport protocol and IP as the network protocol.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-08T22:07:51.650" LastActivityDate="2015-11-08T22:07:51.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24209" PostTypeId="4" CreationDate="2015-11-08T18:54:18.757" Score="0" Body="For questions about interconnected networks." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-08T22:07:43.503" LastActivityDate="2015-11-08T22:07:43.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24211" PostTypeId="1" CreationDate="2015-11-08T20:14:01.683" Score="3" ViewCount="405" Body="&lt;p&gt;I need some help to better understand how networks work, ports, and communication.&#xA;Suppose we have this situation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VlUEz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VlUEz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have on the left a corporate network (let's call it &quot;A&quot;) which has a DMZ with a server exposed to the public Internet (public IP), and on the right another corporate network (let's call it &quot;B&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Commonly corporate networks has Symmetric NAT (isn't that correct?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to create a video conference application to let a host in A communicate a host in B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Talking about VoIP, is it enough to install a VoIP proxy server (e.g. Asterisk) in 10.10.0.0 to let hosts communicate? I would open the required ports for 10.10.0.0 for inbound and outbound traffic. Do I need TURN or STUN?&#xA;I hope I've been enough clear, but the situation it's not clear to me, so in case help me to better explain.&lt;/p&gt;&#xA;" OwnerUserId="20514" LastEditorUserId="8499" LastEditDate="2015-11-08T20:33:12.443" LastActivityDate="2017-08-31T08:11:43.900" Title="Understanding of NAT and VoIP" Tags="|nat|voip|" AnswerCount="3" CommentCount="2" ClosedDate="2019-02-12T04:25:18.763" ContentLicense="CC BY-SA 3.0" />
  <row Id="24212" PostTypeId="5" CreationDate="2015-11-08T20:17:46.197" Score="0" Body="&lt;p&gt;Address Resolution Protocol (ARP) resolves OSI layer-3 addresses to OSI layer-2 addresses. This is necessary because the OSI layers are independent of each other. In order for an OSI layer-3 packet (e.g. IP packet) to be forwarded on an OSI layer-2 protocol (e.g. ethernet), the OSI layer-2 address (e.g. MAC address) must be discovered in order to encapsulate the OSI layer-3 packet into an OSI layer-2 frame which contains both the source and destination OSI layer-2 addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-08T22:07:58.190" LastActivityDate="2015-11-08T22:07:58.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24213" PostTypeId="4" CreationDate="2015-11-08T20:17:46.197" Score="0" Body="For questions about Address Resolution Protocol (ARP). ARP resolves OSI layer-3 addresses to OSI layer-2 addresses." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-08T22:07:34.707" LastActivityDate="2015-11-08T22:07:34.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24215" PostTypeId="2" ParentId="24211" CreationDate="2015-11-08T20:30:09.173" Score="0" Body="&lt;p&gt;First lets clear up a few misconceptions. Corporate networks do not necessarily use NAT. If they do use NAT, it is not necessarily symmetric NAT. There are many different corporate network designs. Many corporations own large blocks of public addresses which are used for services facing the public Internet. Some corporations use things like MPLS VPNs to connect sites within the corporation or to other, partner businesses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VoIP application and server type you use needs to work with the network designs, and there are many network designs. This is too large a subject to be discussed here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may, or may not, need TURN or STUN. That depends on the VoIP application used and the network design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example drawing, a very likely scenario is that A and B would establish a VPN across the public Internet to allow things like VoIP to communicate seamlessly. This is especially true for sites within the same corporation. If these are two separate companies, it is more likely that each has VoIP connecting to the public telephone system through SIP trunks, and will connect calls to the other company that way. Some companies need closer ties, and they will use a VPN to provide connection across the public Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-08T20:37:18.803" LastActivityDate="2015-11-08T20:37:18.803" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24216" PostTypeId="1" CreationDate="2015-11-08T20:35:35.910" Score="3" ViewCount="3701" Body="&lt;p&gt;Let's say I have a network with 17 devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The minimum mask I could use to accommodate these 17 devices is 255.255.255.224 (i.e. /27), which itself can contain 30 useful addresses (excluding the broadcast and network address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means if I have only 17 devices, &lt;strong&gt;13 useful addresses are wasted&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: &lt;em&gt;why not just use IP address ranges&lt;/em&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do the number of addresses in a network need to be a power of two?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, why not just say: &lt;code&gt;Network A: 192.168.1.1 - 192.168.1.17 (inclusive)&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the disadvantages of this, apart from having to store 8 octets (the start address and the end address) instead of 4 octets (the subnet mask)?&lt;/p&gt;&#xA;" OwnerUserId="20517" LastEditorUserId="8499" LastEditDate="2019-01-12T20:02:21.873" LastActivityDate="2019-01-12T20:02:21.873" Title="Subnet masks vs. IP address ranges" Tags="|ip|ipv4|subnet|protocol-theory|ip-address|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24218" PostTypeId="2" ParentId="24180" CreationDate="2015-11-08T22:39:50.287" Score="0" Body="&lt;p&gt;TZ400 ports are user defineable, you can configure zones and apply them accordingly to your needs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You aren't telling what do you want from your configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a simple, &lt;strike&gt;plan&lt;/strike&gt; flat network, you could go as per your first case&lt;/p&gt;&#xA;" OwnerUserId="2542" LastEditorUserId="2542" LastEditDate="2015-11-09T14:34:31.513" LastActivityDate="2015-11-09T14:34:31.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24220" PostTypeId="2" ParentId="24216" CreationDate="2015-11-08T22:58:40.467" Score="2" Body="&lt;p&gt;When IP was designed performance was a much bigger deal than conserving address space. Checking if something is in an arbitary range is more complex than checking it against a single number and a bitmask. This is somewhat true in software and even more true in hardware. Changing that once the IP address shortage became so acute it was worthwhile would have been a massive task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that if you are desperate there are a few ways to workaround the issue. They all come at a cost though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One option is to run multiple subnets on the same link. The downside is that you waste more network/broadcast/gateway addresses and more traffic bounces via a router. Still it can save some addresses (for example in your case you could use a /28 and a /29.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using linux then it supports /32 addresses as secondary addresses ( &lt;a href=&quot;https://www.zmonkey.org/blog/content/using-32-netmask-linux&quot; rel=&quot;nofollow&quot;&gt;https://www.zmonkey.org/blog/content/using-32-netmask-linux&lt;/a&gt; ) . So if you are running linux and get desperate for IP space you can use private space as your primary address and then manually route your handful of public addresses to individual boxes. This allows you to achieve near-perfect public IP utilisation but obviously the price you pay is larger routing tables on your routers and in some cases local traffic bouncing via a router rather than going direct. &lt;a href=&quot;https://www.zmonkey.org/blog/content/using-32-netmask-linux&quot; rel=&quot;nofollow&quot;&gt;https://www.zmonkey.org/blog/content/using-32-netmask-linux&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to use private IPs (or IPv6) internally and then put NATs or load balancers at your network border.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet another option is to set your netmask wide open and then use arp proxying to pick up traffic that clients think is local to their subnet but actually isn't. Again making this work is going to be more work for the routers but it's possible (at least with linux routers).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-11-08T22:58:40.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24221" PostTypeId="1" CreationDate="2015-11-08T23:48:02.917" Score="3" ViewCount="5415" Body="&lt;p&gt;The ethernet IEEE 802.3 standard defines the minimum Ethernet frame size as 64 bytes, and the maximum frame size as 1518 bytes. Why is There a Minimum and Maximum Ethernet Frame size?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An ethernet frame has a minimum size because anything that is shorter than the 64 byte minimum is interpreted by receiving stations as a collision and is automatically discarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why maximum as 1518? &lt;/p&gt;&#xA;" OwnerUserId="20523" LastEditorUserId="619" LastEditDate="2015-11-09T05:42:45.033" LastActivityDate="2015-11-09T05:42:45.033" Title="Why does IEEE 802.3 have both minimum and maximum frame sizes?" Tags="|ethernet|ieee-802.3x|" AnswerCount="1" CommentCount="0" ClosedDate="2015-11-09T06:10:39.697" ContentLicense="CC BY-SA 3.0" />
  <row Id="24222" PostTypeId="2" ParentId="24221" CreationDate="2015-11-08T23:55:58.337" Score="0" Body="&lt;p&gt;Different frame sizes accommodate different traffic needs. For instance, VoIP traffic is best served by many small datagrams, and a server backup is better served by fewer but larger datagrams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had one fixed frame size, you could end up wasting a lot of network bandwidth by padding for VoIP with larger frame sizes, or you could end up wasting a lot of bandwidth with protocol overhead for server backups with smaller frame sizes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One size does &lt;em&gt;not&lt;/em&gt; fit all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit to answer your changed question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sizes go back to the original ethernet medium. The minimum of 64 bytes was the minimum to make sure that a frame completely filled the medium from end-to-end so that the other hosts could detect that the medium is in use. The minimum is too small for some applications, so a maximum needed to be determined..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your question of why the choice for the maximum size is actually answered in another question: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2962/how-was-the-mtu-size-for-ethernet-frames-calculated-as-1500-bytes&quot;&gt;How was the MTU size for ethernet frames calculated as 1500 bytes?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-11-09T00:22:28.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24224" PostTypeId="2" ParentId="24161" CreationDate="2015-11-09T00:33:02.040" Score="4" Body="&lt;p&gt;When a packet is received at an SDN switch that doesn't have a rule associated with it, it gets forwarded to the controller. Now, the controller may choose to drop it, or do something special (like log it and then forward). This behavior is key to implementing many Openflow features, like learning switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/mininet/openflow-tutorial/wiki/Create-a-Learning-Switch&quot; rel=&quot;nofollow&quot;&gt;https://github.com/mininet/openflow-tutorial/wiki/Create-a-Learning-Switch&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20524" LastActivityDate="2015-11-09T00:33:02.040" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24225" PostTypeId="5" CreationDate="2015-11-09T00:52:54.277" Score="0" Body="&lt;p&gt;The Open Systems Interconnect (OSI) model is one of several theoretical or conceptual models/frameworks for network communications. The OSI model defines seven layers through which a communication message passes. Each layer defines a distinct and separate function which is independent of the other layers. This allows different methods or protocols in one layer to be changed without affecting the other layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be stressed that the OSI model is an idealized concept which rarely aligns with the real world. This disparity has led to the development of other models which parallel the OSI model, but strive to more closely match network communications in the real world.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-09T05:05:47.980" LastActivityDate="2015-11-09T05:05:47.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24226" PostTypeId="4" CreationDate="2015-11-09T00:52:54.277" Score="0" Body="For questions about the Open Systems Interconnect (OSI) model defined by the International Organization for Standardization (ISO)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-09T05:05:52.937" LastActivityDate="2015-11-09T05:05:52.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24228" PostTypeId="5" CreationDate="2015-11-09T01:10:50.237" Score="0" Body="&lt;p&gt;Hypertext Transport Protocol (HTTP) is an application-layer protocol which is designed for stateless communications between applications. HTTP is defined in &lt;a href=&quot;https://tools.ietf.org/html/rfc7230&quot; rel=&quot;nofollow&quot;&gt;RFC 7230, Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the RFC:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Hypertext Transfer Protocol (HTTP) is a stateless&#xA;  application-level request/response protocol that uses extensible&#xA;  semantics and self-descriptive message payloads for flexible&#xA;  interaction with network-based hypertext information systems.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-09T05:05:42.420" LastActivityDate="2015-11-09T05:05:42.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24229" PostTypeId="4" CreationDate="2015-11-09T01:10:50.237" Score="0" Body="For questions about the application-layer Hypertext Transport Protocol (HTTP)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-09T05:05:57.297" LastActivityDate="2015-11-09T05:05:57.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24231" PostTypeId="2" ParentId="24216" CreationDate="2015-11-09T02:44:29.870" Score="4" Body="&lt;p&gt;Your idea of start and end addresses will slow routing decisions down a lot, and a packet may traverse multiple routers to get to its destination; mask and compare for equality uses far fewer CPU cycles than compare for &lt;code&gt;&amp;gt;= AND &amp;lt;=&lt;/code&gt;. More CPU cycles equals more time and more CPU load. Using a mask is fast and easy to do in either software or special hardware (ASIC). You have to remember that routers switch packets individually, and a router must make the determination which way to switch a packet for each and every packet which passes through it, and each router through which a packet travels will need to do the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can route aggregation work with odd sized subnets? The number of Internet routes is already out of hand, and the ISPs won't advertise any IPv4 prefix longer than /24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your idea adds unacceptable overhead and delay to packet switching. You also need to think about so tightly restricting subnets that there is no room for growth. If you have assigned 192.168.1.1 to 192.168.1.17 for subnet 1, and each subsequent subnet is equally restrictive, what happens when a manager on subnet 1 wants to add a printer, scanner, new PC, etc. Suddenly, you need to move everyone to a new, larger subnet, and you have an unused subnet that may never have a good fit, thereby wasting those 17 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This idea doesn't really solve any problems since even doubling the number of available IPv4 addresses will not even come close to fixing the IPv4 address shortage, and it adds considerably to router overhead and real world implementation support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep thinking about things, but realize that there are many, many extremely intelligent people who live, eat, breathe, and sleep this stuff, and have for many years, with no thought but how to make it work better. Everything about IP is under constant review and can be changed if a consensus decides it should be. The proof is the demise of IP classes in favor of CIDR and VLSM.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-09T03:49:28.717" LastActivityDate="2015-11-09T03:49:28.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24233" PostTypeId="2" ParentId="23940" CreationDate="2015-11-09T07:14:42.423" Score="1" Body="&lt;p&gt;You can sometimes block ports to block various protocols such as port 80 and 443 to block web access, however this won't work if the programs you are trying to block are designed to try other ports. You can also try blocking source address ranges, but this will fail if the target has hundreds to thousands of servers like Google, or uses a general purpose distributed cloud computing service like Amazon Web Services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some programs like BitTorrent will be nearly impossible to block using simple port blocking. Also it is very common for people to use web proxies to get around basic port-based firewalling. The more dedicated geeks will set up their home computer to relay a private data stream to them from inside your network. You have little to no hope of blocking this with simple port or address based rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to be serious about it, you need to do &lt;strong&gt;deep packet inspection&lt;/strong&gt;, which takes a look at the data packets, and tries to figure out what they are for. This is not simply an &lt;strong&gt;HTTP proxy&lt;/strong&gt;, as it can inspect and block any protocol on any port, and it is able to analyze and block encrypted HTTPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many companies now make filtering appliances that can do this, acting either as your primary router or inserted between an existing router and your users operating in what's called &lt;strong&gt;transparent mode&lt;/strong&gt; filtering, where it has no IP address and silently accesses all VLANs passing through it. A third ethernet port is used for device management in transparent mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It snoops every connection attempt, tries to figure out what it is for, and will either silently block unwanted data or send people a warning rather than the content they were trying to access. Logging of each client's activity and category-based content blocking may also be supported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I'm using an iBoss Pro in transparent mode, but there many companies with other similar filtering appliances. Previously we used an M86 / TrustWave R3000 with no issues.&lt;/p&gt;&#xA;" OwnerUserId="20529" LastActivityDate="2015-11-09T07:14:42.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24236" PostTypeId="1" AcceptedAnswerId="24243" CreationDate="2015-11-09T08:46:26.283" Score="4" ViewCount="617" Body="&lt;p&gt;Is it possible to sniff for all packets on an encrypted wifi SSID if you know the password?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the SSID password provide only general isolation for all devices as a group within the SSID, or does it establish completely independent isolation between devices, to prevent general traffic sniffing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case I am thinking mainly about the common WPA2 Personal / TKIP / preshared key, but is the answer different for the various other wifi encryption methods?&lt;/p&gt;&#xA;" OwnerUserId="20529" LastActivityDate="2015-11-09T20:06:31.457" Title="sniff traffic on a private SSID?" Tags="|ieee-802.11|packet-analysis|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24237" PostTypeId="1" CreationDate="2015-11-09T09:16:33.843" Score="1" ViewCount="182" Body="&lt;p&gt;Is there any easy-to-manage way to firewall off individual Ethernet ports from each other on a wired network switch in a large organization, so that devices cannot see each other or anything else on the LAN, unless specifically authorized in a firewall configuration for each port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A typical application would be in a semi-public space where people may be bringing in personal devices which could potentially be plugged into the wired building network, to limit device discovery and nmap address probing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking that it is probably possible to implement manually, but it would require some ridiculously complex configuration, such as assigning each individual Ethernet jack on the switches to a separate VLAN, and then in a router create separate firewall rule groups for each VLAN interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using VLANs for this would only work up to the maximum 4096 VLANs. If an organization has more wired wall ports than that, then apparently the network would require physical cabling isolation and individual router NICs/cabling, to allow reuse of VLAN IDs on each router NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or perhaps use distributed routers in network closets to handle the physically segmented VLAN re-use groups, rather than having a single huge router in the main datacenter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any switch equipment which already provides this sort of individually firewalled ethernet port isolation?&lt;/p&gt;&#xA;" OwnerUserId="20529" LastEditorUserId="8499" LastEditDate="2018-03-09T01:02:07.527" LastActivityDate="2018-03-09T01:02:07.527" Title="Firewalling of individual ethernet ports in an organization" Tags="|vlan|firewall|security|packet-analysis|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24238" PostTypeId="1" CreationDate="2015-11-09T10:05:36.297" Score="0" ViewCount="379" Body="&lt;p&gt;I'm using &lt;a href=&quot;http://mum.mikrotik.com/presentations/ZA13/bisschoff.pdf&quot; rel=&quot;nofollow&quot;&gt;bisschoff load-balancing&lt;/a&gt; .its really good and works fine.but it has a problem. The problem is when a adsl line don't have access to internet , it don't disable automatically and vice versa. For that i statically disable and enable lines. Is there any solution about this ? &#xA;Thanks for your help.&lt;/p&gt;&#xA;" OwnerUserId="3985" LastEditorUserId="8499" LastEditDate="2018-02-14T16:39:20.133" LastActivityDate="2018-02-14T16:39:20.133" Title="MikroTik: bisschoff load balancing problem?" Tags="|router|failover|pppoe|load-balancing|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-09T23:48:47.157" ContentLicense="CC BY-SA 3.0" />
  <row Id="24240" PostTypeId="2" ParentId="17783" CreationDate="2015-11-09T14:29:07.643" Score="1" Body="&lt;p&gt;If you assing a separate, physical switch to each of your network zones VLANs are useless; just assign a zone to your interface and let Zywall take care for routing and firewall rules.&#xA;Obviously you cannot mix different end points on same device (ex, pcs and voip phones on the same switch).&lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2015-11-09T14:29:07.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24241" PostTypeId="2" ParentId="24237" CreationDate="2015-11-09T14:49:41.397" Score="3" Body="&lt;p&gt;Cisco switches have a feature called Private VLANs (other mfrs name it differently). You can configure the port so it can only talk to the gateway port and no others on the same VLAN.  This would accomplish what you're asking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I'm very skeptical that this is what you really need.  I would like to understand your security requirements better.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-09T14:49:41.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24242" PostTypeId="2" ParentId="24237" CreationDate="2015-11-09T14:50:21.540" Score="3" Body="&lt;p&gt;As @Silent-Bob suggested, private or isolated VLANs will keep devices from communicating with each other on the same VLAN. I'm not sure that's exactly what you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most companies set up a VLAN for such a scenarios if guests or BYOD is allowed. The VLAN can be firewalled from the rest of the network. It is not a good idea to allow any device you don't control to be able to access your network, and most companies limit such devices to allow access to and from the Internet only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, see this question: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/22247/how-can-i-stop-an-intruder-plugging-into-an-ethernet-wall-socket-getting-access&quot;&gt;How can I stop an intruder plugging into an Ethernet wall socket getting access to the network?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-11-09T23:37:49.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24243" PostTypeId="2" ParentId="24236" CreationDate="2015-11-09T14:53:12.647" Score="4" Body="&lt;p&gt;First, I want to clarify a few things. Then, to better answer your questions, I will provide a brief explanation of how WPA2 works. Finally, I will directly answer your questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TKIP and AES are the actual encryption methods. TKIP is not secure in any circumstance and actually no longer supported by modern 802.11 (since 802.11n, if you use TKIP, devices are supposed to disable the HT data rates leaving you with a maximum data rate of 54Mbps or 802.11g speeds).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WPA/WPA2 are the methods used to provide the encryption keys for use between the access point and the station. AFAIK WPA/AES is still secure today, but WPA was a &quot;quick fix&quot; to a couple of the major problems with WEP. There is no reason to use WPA instead of WPA2 so one should really only be using WPA2/AES (either Personal/PSK or Enterprise) unless there is a specific reason to do otherwise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for WPA2 to start, both sides need a common starting point (the &quot;Pairwise Master Key&quot; or PMK) on which to build the encryption key (&quot;Pairwise Transient Key&quot; or PTK).  When using WPA2-Personal or WPA2-PSK, the PMK is the (hashed) Pre-Shared Key (PSK).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PTK is created by combining and hashing the following values: the PMK, the authenticator nonce value or ANonce, the supplicant nonce value or SNonce, the MAC address of the AP (BSSID), and finally the MAC address of the station. (&lt;a href=&quot;https://en.wikipedia.org/wiki/Cryptographic_nonce&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia entry for Cryptographic nonce&lt;/a&gt; for further background if desired.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The information for the PTK is exchanged in a four way handshake:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;After the station authenticates, the AP will send the ANonce to the station.&lt;/li&gt;&#xA;&lt;li&gt;The station responds with the SNonce plus a MIC (message integrity code).&lt;/li&gt;&#xA;&lt;li&gt;The AP then responds to the station with the GTK (group temporal key - used for broadcast/multicast) and a MIC.&lt;/li&gt;&#xA;&lt;li&gt;The station sends an acknowledgement to the AP.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Once this is done, both the station and the AP have been able to generate the PTK and know that the other side has been able to do so as well.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to sniff for all packets on an encrypted wifi SSID if you know the password?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The PSK is not a password or used to directly encrypt the data. Rather it is used as the PMK used to generate the PTK. Each session between a station and the access point ends up with a unique encryption key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the answer to this question is that yes it is possible, but to do so the person capturing must know the PSK (which again is the PMK) &lt;strong&gt;AND&lt;/strong&gt; capture the four way handshake where the PTK is generated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is fairly trivial to cause a station to re-initialize this connection so you can capture the handshake. This is often done by spoofing a deauthentication frame from the AP to the stations causing them to reconnect.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does the SSID password provide only general isolation for all devices as a group within the SSID, or does it establish completely independent isolation between devices, to prevent general traffic sniffing?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I detailed above, each PTK is unique not only to the station, but to the connection/session because of the Nonce values. So in general terms, they are isolated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind when using PSK, all stations share/know the same PMK material, so if they really wanted to capture the traffic from other stations this would be possible providing the capture the handshake.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In this case I am thinking mainly about the common WPA2 Personal / TKIP / preshared key, but is the answer different for the various other wifi encryption methods?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is true with any method that uses the same known fixed value for the PMK. So how can one not use a fixed value for the PMK? Through the use of WPA2-Enterprise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WPA2-Enterprise is more secure because each and every authenticated station will have a unique PMK, and the PMK will be unique every time the station connects. The PMK is supplied from the RADIUS authentication server (to both the station and the access point) during the authentication process while the station is first connecting (before the handshake).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;Note: I did &lt;a href=&quot;https://security.stackexchange.com/a/47302/24467&quot;&gt;reuse parts of the answer I posted on a similar question&lt;/a&gt; over at one of our sister sites, &lt;a href=&quot;https://security.stackexchange.com/&quot;&gt;Information Security&lt;/a&gt;.&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.953" LastActivityDate="2015-11-09T15:42:32.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24244" PostTypeId="2" ParentId="24180" CreationDate="2015-11-09T15:08:36.917" Score="4" Body="&lt;p&gt;The answer will depend on where most of your &lt;em&gt;internal LAN traffic&lt;/em&gt; will be going:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If most of your LAN traffic is &lt;strong&gt;INTERNALLY BOUND&lt;/strong&gt; (ie, to a local File Server, Terminal Server, Intranet server, etc) then you definitely want to choose 1 switch as your &quot;main/core&quot; switch and connect the SonicWALL's LAN to it, along with the 2nd switch and any other switches. Plug the server(s) into the main switch, along with the most critical workstations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The reason for this is&lt;/em&gt;: if most traffic is internal then you don't want to waste the SonicWALL's resources switching those frames from Switch #1 to Switch #2 -- in fact it is probably not as fast as the dedicated switches doing that. If you plugged both  switches into the SonicWALL's LAN ports then ALL traffic from Switch #1 to Switch #2 would go through the SonicWALL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If most of your LAN traffic is &lt;strong&gt;EXTERNALLY BOUND&lt;/strong&gt; (ie, to the Internet; eg. you have few internal resources and connect mainly to Cloud Based resources, like Office 365 or various websites) then it may actually make sense to connect both switches separately to the SonicWALL's LAN ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The reason for this is&lt;/em&gt;: if most of your traffic is going out through the SonicWALL then you might as well connect directly to the SonicWALL instead of having one switch pass additional frames from the 2nd switch. Plus if the &quot;main&quot; switch were to fail then the other switch would still be connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;strong&gt;either case&lt;/strong&gt; if you have separate subnets/VLANs then I wouldn't change anything -- your Dell X1052 switches are Layer 2 only so any routing of packets from one network/subnet/VLAN to another will require the SonicWALL router to route those packets. It wouldn't matter if you configured one of your LAN ports to be on a different network/subnet (eg. a DMZ) or if you configured an internal interface and trunked 1 or more VLANs through a single port. In both cases the SonicWALL is doing all the routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Of course if you have a large/complex network with multiple subnets I would recommend a Layer 3 switch to off load from the SonicWALL. The SonicWALL's job is firewall/UTM/packet inspection and it is not going to be as fast as a switch at either plain old layer 2 switching or layer 3 routing.]&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2015-11-09T15:08:36.917" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24246" PostTypeId="1" CreationDate="2015-11-09T12:52:15.863" Score="1" ViewCount="203" Body="&lt;p&gt;I want to set my device to L3 mode (specifically, 3560X-S).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular, I want yo configure multicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because I haven't been configuring as multicast, I'm here to ask you about multicast configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Topology:&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0Ftc9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0Ftc9.jpg&quot; alt=&quot;topology.jpg&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see in the topology diagram, there are three switch models, such as SG300, 3560X, 4500X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 3560Xs are IP base, and IP base has no option but to enable stub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First, situation:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;PC_1, PC_2 ..., whole PCs are using mDNS, so they use multicast.&lt;/li&gt;&#xA;&lt;li&gt;Based on PC_1's traffic which is multicast, it doesn't pass the GW(4500X).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I guess that's because I didn't configure multicast anywhere else. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second, questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;When I configure the 3560X switches, can I use stub mode in multicast&#xA;situation? (criterion on 4500X, these are different domain between left and right side.) If not, can I change from 3560X-S to E (IP base -&gt; IP services)?&lt;/li&gt;&#xA;&lt;li&gt;I know the stub is only used for top of the network? How can I&#xA;say.. That is, stub switch is located in between 2 IP which are different domain.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I wondered whether you can understand because I don't know English well..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't understand my expanation, please don't hesitate tell me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--------------------configuration--------------------------&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(**SG300** Telnet permit)&#xA;conf t&#xA;ip ssh server&#xA;ip telnet server&#xA;&#xA;&#xA;&#xA;Telnet permit (All devices are same)&#xA;&#xA;username cisco secret cisco&#xA;enable secret cisco&#xA;line vty 0 4&#xA; login local&#xA;exit&#xA;!&#xA;line console 0&#xA; password cisco&#xA;!&#xA;&#xA;**&amp;lt;4500X_1&amp;gt;**&#xA;en&#xA;conf t&#xA;hostname 4500X_1&#xA;ip routing&#xA;int te 1/1&#xA; no sw&#xA; ip add 192.168.200.1 255.255.255.252&#xA;!&#xA;int te 1/3&#xA; no sw&#xA; ip add 192.168.200.9 255.255.255.252&#xA;!&#xA;int te 1/5&#xA; no sw&#xA; ip add 192.168.200.17 255.255.255.252&#xA;!&#xA;int te 1/7&#xA; no sw&#xA; ip add 192.168.200.25 255.255.255.252&#xA;!&#xA;int te 1/9&#xA; no sw&#xA; ip add 192.168.200.33 255.255.255.252&#xA;!&#xA;int te 1/11&#xA; no sw&#xA; ip add 192.168.200.41 255.255.255.252&#xA;!&#xA;int te 1/13&#xA; no sw&#xA; ip add 192.168.200.49 255.255.255.252&#xA;!&#xA;int te 1/15&#xA; no sw&#xA; ip add 192.168.200.57 255.255.255.252&#xA;!&#xA;int lo 0&#xA; ip add 192.168.50.1 255.255.255.255&#xA;exit&#xA;!&#xA;router ospf 1&#xA; router-id 1.1.1.1&#xA; network 192.168.200.0 0.0.0.255 area 0&#xA; network 192.168.50.1 0.0.0.0 area 0&#xA;!&#xA;&#xA;**&amp;lt;4500X_2&amp;gt;**&#xA;en&#xA;conf t&#xA;hostname 4500X_2&#xA;ip routing&#xA;int te 1/1&#xA; no sw&#xA; ip add 192.168.200.5 255.255.255.252&#xA;!&#xA;int te 1/3&#xA; no sw&#xA; ip add 192.168.200.13 255.255.255.252&#xA;!&#xA;int te 1/5&#xA; no sw&#xA; ip add 192.168.200.21 255.255.255.252&#xA;!&#xA;int te 1/7&#xA; no sw&#xA; ip add 192.168.200.29 255.255.255.252&#xA;!&#xA;int te 1/9&#xA; no sw&#xA; ip add 192.168.200.37 255.255.255.252&#xA;!&#xA;int te 1/11&#xA; no sw&#xA; ip add 192.168.200.45 255.255.255.252&#xA;!&#xA;int te 1/13&#xA; no sw&#xA; ip add 192.168.200.53 255.255.255.252&#xA;!&#xA;int te 1/15&#xA; no sw&#xA; ip add 192.168.200.61 255.255.255.252&#xA;!&#xA;int lo 0&#xA; ip add 192.168.50.2 255.255.255.255&#xA;exit&#xA;!&#xA;router ospf 1&#xA; router-id 2.2.2.2&#xA; network 192.168.200.0 0.0.0.255 area 0&#xA; network 192.168.50.2 0.0.0.0 area 0&#xA;!&#xA;&#xA;**&amp;lt;3560X_1&amp;gt;**&#xA;conf t&#xA;hostname 3560X_1&#xA;vlan 5&#xA;exit&#xA;ip routing&#xA;int te 1/2&#xA; description ## 4500X_1 ##&#xA; no sw&#xA; ip add 192.168.200.2 255.255.255.252&#xA; no shut&#xA;!&#xA;int gi 0/23&#xA; description ## HSRP ##&#xA; sw mo acc&#xA; sw acc vlan 5&#xA;!&#xA;int lo 0&#xA; ip add 192.168.100.1 255.255.255.255&#xA;exit&#xA;!&#xA;int vlan 1&#xA; ip add 192.168.0.252 255.255.255.0&#xA; standby 0 ip 192.168.0.254&#xA; standby 0 priority 110&#xA; standby 0 preempt delay minimum 30&#xA; standby 0 track te 1/2 50&#xA; no shut&#xA;!&#xA;router ospf 1&#xA; router-id 3.3.3.3&#xA; network 192.168.200.2 0.0.0.0 area 0&#xA; network 192.168.100.1 0.0.0.0 area 0&#xA; network 192.168.0.0 0.0.0.255 area 0&#xA;!&#xA;&#xA;**&amp;lt;3560X_2&amp;gt;**&#xA;conf t&#xA;hostname 3560X_2&#xA;vlan 5&#xA;exit&#xA;ip routing&#xA;int te 1/2&#xA; description ## 4500X_2 ##&#xA; no sw&#xA; ip add 192.168.200.6 255.255.255.252&#xA; no shut&#xA;!&#xA;int gi 0/23&#xA; sw mo acc&#xA; sw acc vlan 5&#xA;!&#xA;int lo 0&#xA; ip add 192.168.100.2 255.255.255.255&#xA;exit&#xA;!&#xA;int vlan 1&#xA; ip add 192.168.0.253 255.255.255.0&#xA; standby 0 ip 192.168.0.254&#xA; standby 0 preempt&#xA; no shut&#xA;!&#xA;router ospf 1&#xA; router-id 4.4.4.4&#xA; network 192.168.200.6 0.0.0.0 area 0&#xA; network 192.168.100.2 0.0.0.0 area 0&#xA; network 192.168.0.0 0.0.0.255 area 0&#xA;!&#xA;&#xA;**&amp;lt;3560X_3&amp;gt;**&#xA;conf t&#xA;hostname 3560X_3&#xA;vlan 5&#xA;exit&#xA;ip routing&#xA;int te 1/2&#xA; description ## 4500X_1 ##&#xA; no sw&#xA; ip add 192.168.200.10 255.255.255.252&#xA; no shut&#xA;!&#xA;int gi 0/23&#xA; description ## HSRP ##&#xA; sw mo acc&#xA; sw acc vlan 5&#xA;!&#xA;int lo 0&#xA; ip add 192.168.100.3 255.255.255.255&#xA;exit&#xA;!&#xA;int vlan 1&#xA; ip add 192.168.1.252 255.255.255.0&#xA; standby 1 ip 192.168.1.254&#xA; standby 1 priority 110&#xA; standby 1 preempt delay minimum 30&#xA; standby 1 track te 1/2 50&#xA; no shut&#xA;!&#xA;router ospf 1&#xA; router-id 5.5.5.5&#xA; network 192.168.200.10 0.0.0.0 area 0&#xA; network 192.168.100.3 0.0.0.0 area 0&#xA; network 192.168.1.0 0.0.0.255 area 0&#xA;!&#xA;&#xA;**&amp;lt;3560X_4&amp;gt;**&#xA;conf t&#xA;hostname 3560X_4&#xA;vlan 5&#xA;exit&#xA;ip routing&#xA;int te 1/2&#xA; description ## 4500X_2 ##&#xA; no sw&#xA; ip add 192.168.200.14 255.255.255.252&#xA; no shut&#xA;!&#xA;int gi 0/23&#xA; sw mo acc&#xA; sw acc vlan 5&#xA;!&#xA;int lo 0&#xA; ip add 192.168.100.4 255.255.255.255&#xA;exit&#xA;!&#xA;int vlan 1&#xA; ip add 192.168.1.253 255.255.255.0&#xA; standby 1 ip 192.168.1.254&#xA; standby 1 preempt&#xA; no shutd&#xA;!&#xA;router ospf 1&#xA; router-id 6.6.6.6&#xA; network 192.168.200.14 0.0.0.0 area 0&#xA; network 192.168.100.4 0.0.0.0 area 0&#xA; network 192.168.1.0 0.0.0.255 area 0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20562" OwnerDisplayName="SK.Kwon" LastEditorUserId="8499" LastEditDate="2015-11-10T03:55:38.123" LastActivityDate="2015-11-10T05:21:38.457" Title="Which one is the best method when it comes to multicast (stub)?" Tags="|cisco|multicast|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24249" PostTypeId="2" ParentId="19869" CreationDate="2015-11-09T17:10:23.683" Score="0" Body="&lt;p&gt;See i made a similar &lt;a href=&quot;https://drive.google.com/file/d/0B85TmH4wS9GSVnMxNEQtZ3hyc0E/view?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;topology&lt;/a&gt; and uploaded to drive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ports connecting from to L3-sw to L2-sw and L2-sw to L3-sw both need to be trunked to carry all the vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the port connecting to pc should be access and assigned to the vlan you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also create both the vlans on L3-sw along with the interfaces for those vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want inter-vlan routing then also enable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t &#xA;ip routing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15569" LastActivityDate="2015-11-09T17:10:23.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24253" PostTypeId="2" ParentId="24236" CreationDate="2015-11-09T20:06:31.457" Score="1" Body="&lt;p&gt;The above answer is spot on - very detailed and insightful. One thing I would like to add is the what environment your performing this capture on? If its in an enterprise environment, you can simply set up a port monitor session closest to the device and have the source be the port going to outbound network traffic and the destination be to your laptop/desktop. Simply have all the traffic mirrored to the port that is headed outbound, if you have a couple SVI/Vlans that segment out the wireless traffic from the local traffic, you'd be able to capture all traffic leaving that interface. We have a Wireless Lan Controller ( 4402 ) going to our 2960-S switch then to our 2900 series router. Whenever i'm doing a monitor, I simply mirror the ports I want to monitor or capture and review the data that way.&lt;/p&gt;&#xA;" OwnerUserId="20550" LastActivityDate="2015-11-09T20:06:31.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24254" PostTypeId="1" CreationDate="2015-11-09T20:42:17.433" Score="1" ViewCount="569" Body="&lt;p&gt;How would one go about extending an optimum wifi connection? I would assume a bridge would be better than a repeater so the network wouldn't suffer from reduced bandwidth, however I have learned I would need to know the MAC address of their router which I do not have access to... what would you suggest?&lt;/p&gt;&#xA;" OwnerUserId="20554" LastActivityDate="2015-11-09T23:13:11.130" Title="Extending Optimum WiFi range" Tags="|wireless|bridge|" AnswerCount="1" CommentCount="2" ClosedDate="2015-11-09T23:21:37.567" ContentLicense="CC BY-SA 3.0" />
  <row Id="24255" PostTypeId="1" AcceptedAnswerId="24256" CreationDate="2015-11-09T21:15:44.140" Score="18" ViewCount="13370" Body="&lt;p&gt;We know that in the OSI or TCP-IP model, the higher layer utilizes the services offered by the lower layer. For example, the data link layer uses services offered by the physical layer, network layer uses services offered by the data link layer and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I find that some protocols uses services provided by the protocols in the layers above them. For example, both BGP and RIP perform routing which is usually considered as network layer functionality. BGP uses TCP while RIP uses UDP. So here protocols at the network layer which are using services from the protocols in the transport layer. That's why some people online argue that BGP &amp;amp; RIP should be associated at least at the transport layer, while some say that these are application layer protocols as they use services of transport layers, and in TCP-IP model above transport layer there is only application layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand both BGP and RIP perform mostly network layer functionality of routing. What's the truth/convention?&lt;/p&gt;&#xA;" OwnerUserId="19940" LastEditorUserId="8499" LastEditDate="2017-08-27T20:53:43.620" LastActivityDate="2017-08-27T20:53:43.620" Title="In which OSI/TCP-IP model layers do BGP, RIP protocols belong?" Tags="|routing|bgp|osi|rip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24256" PostTypeId="2" ParentId="24255" CreationDate="2015-11-09T21:21:52.480" Score="16" Body="&lt;p&gt;You have to remember that models like OSI are just that, models. They are theoretical. The real world doesn't fall neatly into these models. For the most part, routing is a layer-3 function, but, as you pointed out, BGP uses a layer-4 protocol to communicate with other BGP speakers in order to do what is normally considered a layer-3 function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many network protocols fall into a gray area, or are considered in one layer while using another layer. Take ARP for instance. It resolves layer-3 addresses to layer-2 addresses. Which layer should it be considered to be in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understanding the models is useful, but the models are not mandated by any organization, and you are free to create protocols and functions that do not follow any model.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-09T23:41:09.017" LastActivityDate="2015-11-09T23:41:09.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24257" PostTypeId="2" ParentId="24254" CreationDate="2015-11-09T23:13:11.130" Score="1" Body="&lt;p&gt;You run a cable to the network and add an access point; you did say optimum, and optimum is carried on wires (and fibers) until it reaches an AP which is physically near the end user devices.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-11-09T23:13:11.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24258" PostTypeId="2" ParentId="24255" CreationDate="2015-11-09T23:38:20.160" Score="8" Body="&lt;p&gt;BGP is on top of TCP, so it would be Internet layer 4, OSI layer 7. Usually external BGP is done only between 2 directly connected peers, enforced by setting TTL flag on IP header, which is located at layer 3.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-09T23:38:20.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24259" PostTypeId="2" ParentId="11401" CreationDate="2015-11-10T00:01:19.810" Score="4" Body="&lt;p&gt;Under &lt;strong&gt;System-&amp;gt;Advanced-&amp;gt;Firewall&lt;/strong&gt; and NAT there is an option &amp;quot;&lt;em&gt;Automatically create outbound NAT rules which assist inbound NAT rules that direct traffic back out to the same subnet it originated from.&lt;/em&gt;&amp;quot;&lt;/p&gt;&#xA;" OwnerUserId="20559" LastEditorUserId="58873" LastEditDate="2021-05-01T13:02:22.250" LastActivityDate="2021-05-01T13:02:22.250" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24260" PostTypeId="5" CreationDate="2015-11-10T00:07:46.640" Score="0" Body="&lt;p&gt;The OSI layer-1 is the physical layer which is how the actual &quot;bits on the wire&quot; get transferred from one device to another. It includes multiple technologies such as coax, fiber, UTP, radio, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This layer is the bottom-most layer in the OSI model, and any network communication eventually crosses a layer-1 link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-10T09:05:15.880" LastActivityDate="2015-11-10T09:05:15.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24261" PostTypeId="4" CreationDate="2015-11-10T00:07:46.640" Score="0" Body="For questions about the OSI layer-1 (physical layer)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-10T09:05:18.273" LastActivityDate="2015-11-10T09:05:18.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24262" PostTypeId="2" ParentId="7513" CreationDate="2015-11-10T02:32:46.727" Score="1" Body="&lt;p&gt;GRNET (the Greek Research and Education network) have developed a web application for customers to do this with Flowspec. The web portal has a BGP Flowspec backend which injects flowspec into your network. Highly configurable and in use on the 500-1,000 Gbps pan-European GEANT backbone: &lt;a href=&quot;https://www.noc.grnet.gr/en/fod&quot; rel=&quot;nofollow&quot;&gt;https://www.noc.grnet.gr/en/fod&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20561" LastEditorUserId="-1" LastEditDate="2015-11-10T09:05:00.620" LastActivityDate="2015-11-10T09:05:00.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24265" PostTypeId="1" AcceptedAnswerId="24266" CreationDate="2015-11-10T06:43:45.860" Score="1" ViewCount="2261" Body="&lt;p&gt;is there any program that enables me to capture 802.11 frames/packets in my environment (like wireshark when my interface is put in monitor mode), then sends the captured data over TCP/IP to broadcast them on the other side?&lt;/p&gt;&#xA;" OwnerUserId="20568" LastActivityDate="2016-11-17T09:28:06.793" Title="Capturing and sending 802.11 Frames/Packets" Tags="|wireless|" AnswerCount="1" CommentCount="0" ClosedDate="2019-02-18T21:00:35.583" ContentLicense="CC BY-SA 3.0" />
  <row Id="24266" PostTypeId="2" ParentId="24265" CreationDate="2015-11-10T08:21:07.757" Score="0" Body="&lt;p&gt;&lt;code&gt;..then sends the captured data over TCP/IP to broadcast them on the other side?&lt;/code&gt;  May be you need a program to do that for coping/send through &lt;code&gt;eth0&lt;/code&gt;(or you can write your own program). For capturing 802.11 frames/packets you need a software &lt;a href=&quot;https://www.acrylicwifi.com/en/wlan-software/wlan-scanner-acrylic-wifi-free/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Acrylic WiFi&lt;/a&gt; and go through this &lt;a href=&quot;https://www.acrylicwifi.com/en/blog/how-to-capture-wifi-traffic-using-wireshark-on-windows/&quot; rel=&quot;nofollow noreferrer&quot;&gt;LINK&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Wireshark uses libpcap or Winpcap libraries to capture network traffic on Windows. Winpcap libraries are not intended to work with wireless network cards, therefore they do not support WiFi network traffic capturing using Wireshark on Windows. Therefore, Wireshark monitor mode for Windows is not supported by default.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;(EDIT2:)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;To make this integration possible, Acrylic installs an airpcap.dll library in the system. When Wireshark loads the installed airpcap library, it returns a fake list of airpcap network cards installed. One Airpcap device for each integrated WiFi network card or external USB WiFi network card.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Through this method, you can use your preferred network analyzer compatible with Airpcap to monitor WiFi packets under windows&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, by using &lt;code&gt;Acrylic WiFi&lt;/code&gt;'s driver, the wireshark can capture the beacons/frames which are hitted by &lt;code&gt;wlan0&lt;/code&gt;. Save those captures and send it to other interface(Mostly Ethernet interface I guess). And I haven't checked the  packet capturing with &lt;code&gt;Acrylic WiFi&lt;/code&gt;+&lt;code&gt;Wireshark&lt;/code&gt; yet, please let me know :-)&#xA;There are some other tools to view the WLAN networks&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.inssider.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;LinSSID&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.stumbler.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Netstumbler&lt;/a&gt;(Free)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.kismetwireless.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;kismet&lt;/a&gt; (Free)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.vistumbler.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;vistumbler&lt;/a&gt; (Free)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0zXR0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0zXR0.png&quot; alt=&quot;Beacons/Frames that was seen by &amp;lt;code&amp;gt;wlan&amp;lt;/code&amp;gt; adapter(No need to connect any access point)&quot;&gt;&lt;/a&gt;&lt;strong&gt;Beacons/Frames that was seen by &lt;code&gt;wlan&lt;/code&gt; adapter(No need to connect any access point)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/faxwX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/faxwX.png&quot; alt=&quot;View, what are the access point near by you&quot;&gt;&lt;/a&gt;&lt;strong&gt;View, what are the access point near by you&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="17153" LastEditorUserId="17153" LastEditDate="2016-11-17T09:28:06.793" LastActivityDate="2016-11-17T09:28:06.793" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24267" PostTypeId="2" ParentId="24238" CreationDate="2015-11-10T09:03:55.593" Score="2" Body="&lt;p&gt;You can use the routerOS netwatch tool to monitor each ADSL's gateway. When netwatch detects a failure (=no more ping), you can execute a script to disable some rules, and another to re-enable them when the ping gets back.&lt;/p&gt;&#xA;" OwnerUserId="20569" LastActivityDate="2015-11-10T09:03:55.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24268" PostTypeId="1" CreationDate="2015-11-10T10:50:55.837" Score="6" ViewCount="6269" Body="&lt;p&gt;There are different PoE standards like 802.3af, 802.3at (PoE+) and 802.3bt (announced for 2017). In some articles I found the information that &quot;CAT5e&quot; is the minimum requirment for 802.3at. But &quot;CAT5e&quot; has no requirement for the wire diameter itself. So what diameter is needed to support the different PoE standards in which length without getting problems?&lt;/p&gt;&#xA;" OwnerUserId="20570" LastActivityDate="2015-11-10T12:06:55.657" Title="What is the minimum diameter for Power over Ethernet?" Tags="|cabling|cable|power-over-ethernet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24269" PostTypeId="1" AcceptedAnswerId="24272" CreationDate="2015-11-10T12:01:06.520" Score="9" ViewCount="19476" Body="&lt;p&gt;According to big endian byte ordering or network byte order the bits are transmitted in this order: bits 0-7 first, then bits 8-15, then 16-23 and bits 24-31 last. &#xA;Does this means that bits from version, identification, TTL etc go first and then bits from next fields?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CH80Q.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CH80Q.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2022-05-11T20:03:37.367" Title="Network Byte Order" Tags="|ethernet|ipv4|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24270" PostTypeId="2" ParentId="24268" CreationDate="2015-11-10T12:06:55.657" Score="6" Body="&lt;p&gt;As I know the main problem of transporting power over ethernet cables is temperature rise and resistance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;802.3af&lt;/em&gt; defines the max power as 12.95 W and max current as 350 mA over 2 pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;802.3at&lt;/em&gt; defines the max power as 25 W and max current as 600 mA over 2 pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For both of them the typical wire (&lt;strong&gt;24 AWG&lt;/strong&gt;) supports the temperature rise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lower diameters as 26 AWG and 28 AWG increases the resistance, so they are not recommended beside that the temperature rise increases also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;802.3bt&lt;/em&gt; will define the max power as 96 W and max current as 1000 mA over 4 pairs. For the moment there are not official documents stating the max temperature rise allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check this &lt;a href=&quot;http://www.nexans.no/eservice/Norway-no_NO/fileLibrary/Download_540223405/UK/files/PoE+_2013_1.pdf&quot; rel=&quot;noreferrer&quot;&gt;document&lt;/a&gt; that goes deeper than my explanation.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-11-10T12:06:55.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24271" PostTypeId="1" AcceptedAnswerId="24280" CreationDate="2015-11-10T12:34:24.150" Score="0" ViewCount="1661" Body="&lt;p&gt;I'm using an Edgemax router (EdgeOs), and even after having read posts and checked internet pages, I'm still very confused about which of my ethernet interfaces are communicating with what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My LAN is on eth2 and my WAN on eth1. Can someone tell me if I'm wrong about what's next (because I saw a lot of opposite answers on network tutorials):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;eth2/in is the part of my interface that receive packets from the LAN,&lt;/li&gt;&#xA;&lt;li&gt;eth2/out deals with packets from LAN that will go to the WAN and&lt;/li&gt;&#xA;&lt;li&gt;eth2/local are packets from LAN that &quot;travel&quot; through the LAN. Is that right? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17044" LastEditorUserId="8499" LastEditDate="2015-11-10T15:08:29.477" LastActivityDate="2020-10-12T14:14:24.793" Title="I'm confused about ethernet interfaces (eth/in, eth/out, eth/local)" Tags="|router|lan|interface|packet-path|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24272" PostTypeId="2" ParentId="24269" CreationDate="2015-11-10T13:01:21.830" Score="6" Body="&lt;p&gt;There is a confusion here. The network byte order does not specify how bits are transmitted over the network. It specifies how values are stored in multi byte fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;Total Length&lt;/em&gt; field is composed of two bytes. It specifies in bytes the size of the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say we have the value 500 for that field. Using the Network Byte Order it will be seen over the wire like this, being transmitted transmission from left to right:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000001 11110100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If we would use the little endian format then it would have been seen over the wire like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11110100 00000001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After the whole packet is constructed the bits will be sent starting with the lowest addressed bit of the header (bit 0), so the transmission will start with the &lt;em&gt;Version&lt;/em&gt; field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A final point to make here is that the Network byte order is, as you mentioned, the Big Endian Order. This was chosen arbitrarily to have a common format for all network protocols and implementations. &lt;/p&gt;&#xA;" OwnerUserId="4584" LastActivityDate="2015-11-10T13:01:21.830" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24273" PostTypeId="1" AcceptedAnswerId="24984" CreationDate="2015-11-10T13:11:13.300" Score="0" ViewCount="602" Body="&lt;p&gt;I have a Brocade ICX-6610 switch.  I was exploring FIPS mode, and admittedly, did not do enough research on it.  I enabled it.  Rebooted the switch, and now it is stuck in a boot loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When booting, it states that it is unable to open the check file primary.sig.  Of course it can't - I never loaded it on the switch.  I am able to interrupt booting and go into boot monitor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Booting to secondary flash doesn't help - same issue.  So, I tried to use TFTP to copy the signature file over...  TFTP does not function in FIPS mode (need to use SCP).  SCP is not supported in the boot monitor phase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm at a loss on how to boot this switch.  I need to somehow disable the FIPS flag so I can boot using regular firmware and stuff.  Or - enable TFTP from the boot monitor, so I can put the correct files on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="20573" LastActivityDate="2015-12-04T18:14:33.343" Title="Brocade - Recover from FIPS mode" Tags="|brocade|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24274" PostTypeId="2" ParentId="13447" CreationDate="2015-11-10T13:51:40.937" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But why in both standards there is one pair that is not adjacent (pin 3 always pairs with pin 6)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Phone standards traditionally put the first pair on the middle, then the second pair straddling it, then the third pair straddling that and so-on. RJ series connectors were designed so that you could plug a smaller plug into a larger socket and it would end up in the center and this wiring arrangement meant that plugging a smaller plug into a larger socket would result in a sensible connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This worked fine at the low frequencies of voice and old low speed data systems but was poor for crosstalk. noise susceptibility, reflections etc at higher frequencies. The greater the number of pairs in this arrangement the worse the high frequency performance gets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A wiring standard with each pair of wires on a pair of adjacent contacts would be best from a high frequency performance point of view but would be lack any backwards compatibility with the existing telco standards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The standard used for ethernet is a compromise. The two central pairs are arranged in the same way they would be in a traditional phone wiring giving compatibility with phone applications that only use the first two pairs. The two outer pairs are arranged in a way that optimises their high speed performance.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Once I have got a wrong long cable that was working intermittently. It was made with all rings adjacent to their corresponding tips. After correcting it worked fine.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When doing differential signaling on twisted pairs it is important that a pair of signal connections are actually on a twisted pair of wires. If the two lines from a signal pair are split between two different twisted pairs then this is known as a &quot;split pair&quot; and will have far worse crosstalk and EMC performance than it should have. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore your cable must match the pair arrangement your devices are expecting. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But I am sure that I have already seen a short cable that worked fine too. Hence there must be an effect that this configuration avoids which I have googled and not found.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Signal integrity problems become worse with increasing cable length. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-11-10T13:51:40.937" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24275" PostTypeId="1" AcceptedAnswerId="24276" CreationDate="2015-11-10T14:07:41.400" Score="1" ViewCount="135" Body="&lt;p&gt;I've a typical situation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;server1 - switch1 - link-bridge (AP1) &amp;lt;----&amp;gt; link-bridge (AP2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;AP1 and AP2 are 2 dlink-dap1360 (wireless N) with wpa2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so, if I connect my laptop to AP2 via cable I can &quot;surf&quot; about 8/10Mb/s (megabyte). Instead if I connect my laptop via wifi I &quot;surf&quot; up to 1Mb/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using bridge mode I've half speed?&lt;/p&gt;&#xA;" OwnerUserId="20575" LastActivityDate="2015-11-10T14:14:53.763" Title="wifi bridge mode" Tags="|wireless|bridge|" AnswerCount="1" CommentCount="1" ClosedDate="2015-11-10T15:47:29.073" ContentLicense="CC BY-SA 3.0" />
  <row Id="24276" PostTypeId="2" ParentId="24275" CreationDate="2015-11-10T14:14:53.763" Score="1" Body="&lt;p&gt;There are many factors involved here.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The APs will adjust the data rate based on the received signal strength.  The weaker the signal, the lower the data rate.  Check the bridges and see what you're running at.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Interference.  If there is a lot of interference (other WiFi, for example), this will cause retransmissions and lower your throughput.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;WiFi is half duplex.  Even under ideal conditions, you're throughput will be approximately half of the data rate.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-10T14:14:53.763" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24277" PostTypeId="2" ParentId="19918" CreationDate="2015-11-10T14:28:04.120" Score="1" Body="&lt;p&gt;First edition of TCP/IP Illustrated is also very helpful. You can know about protocols and their behavior also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An Example -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1023873914.125606 fulton.ssh &gt; spider.1145: P 3066603742:3066603806(64) ack 1646168&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4510 0068 7e87 4000 4006 3862 c0a8 011e&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;c0a8 0128&lt;/em&gt;&lt;/strong&gt; 0016 0479 b6c8 a8de 621e 87db &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1023873914.125606&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;is the time the packet came across our network card (not part of the packet) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;fulton.ssh &gt; spider.1145&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;is the source &amp;amp; source port and destination &amp;amp; destination port of the communication taking place&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;is TCP flag&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3066603742:3066603806&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;is the byte sequence/ range&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A typical IP header is 20 bytes in length and TCP is another 20 bytes. And 2 digits in hex is equivalent to one byte. So that means that the headers lie within the first 20 chunks of hex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;c0&lt;/em&gt;&lt;/strong&gt; = (12 x 16) + (0 x 1) = 192&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;a8&lt;/em&gt;&lt;/strong&gt; = (10 x 16) + (8 x 1) = 168&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;01&lt;/em&gt;&lt;/strong&gt; = ( 0 x 16) + (1 x 1) = 1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;28&lt;/em&gt;&lt;/strong&gt; = ( 2 x 16) + (8 x 1) = 40 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more details please check this link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://neerci.ist.utl.pt/neerci_shelf/LEIC/3%20Ano/1%20Semestre/Redes%20de%20Computadores/Laboratorios/2009%20-%202010/understanding_tcpdump.pdf&quot; rel=&quot;nofollow&quot;&gt;http://neerci.ist.utl.pt/neerci_shelf/LEIC/3%20Ano/1%20Semestre/Redes%20de%20Computadores/Laboratorios/2009%20-%202010/understanding_tcpdump.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20572" LastEditorUserId="20572" LastEditDate="2015-11-10T15:57:21.820" LastActivityDate="2015-11-10T15:57:21.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24280" PostTypeId="2" ParentId="24271" CreationDate="2015-11-10T15:50:49.170" Score="1" Body="&lt;p&gt;Ethernet interfaces are named eth0, eth1, eth2, etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;eth&lt;em&gt;n&lt;/em&gt;/in and eth&lt;em&gt;n&lt;/em&gt;/out, in firewall rules, identify respectively the ingress and egress point for a packet that travels through physical interface eth&lt;em&gt;n&lt;/em&gt;.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your LAN is on eth2 and your WAN on eth1, eth2/in receives packets from the LAN and eth2/out deals with packets destined to the LAN. &lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2015-11-10T15:50:49.170" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24281" PostTypeId="1" CreationDate="2015-11-10T15:58:09.700" Score="2" ViewCount="1485" Body="&lt;p&gt;In Juniper routers running the Junos operating system, one can set the BGP peer group type either to &lt;code&gt;external&lt;/code&gt; or &lt;code&gt;internal&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit]&#xA;root@M10i# set groups customer protocols bgp group customer-BGP-group type ?           &#xA;Possible completions:&#xA;  external             EBGP group&#xA;  internal             IBGP group&#xA;[edit]&#xA;root@M10i# set groups customer protocols bgp group customer-BGP-group type    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Default should be &lt;code&gt;external&lt;/code&gt;. I know that if the type is set to &lt;code&gt;external&lt;/code&gt;, then the peer AS can not be the same as the local AS, and if the type is set to &lt;code&gt;internal&lt;/code&gt;, then the peer AS must be the same as the local AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this change anything else?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="8499" LastEditDate="2019-01-04T23:24:32.690" LastActivityDate="2019-01-04T23:24:32.690" Title="BGP peer group type in Junos" Tags="|routing|bgp|juniper|juniper-junos|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24282" PostTypeId="2" ParentId="24281" CreationDate="2015-11-10T16:39:21.760" Score="2" Body="&lt;p&gt;Because the AS-PATH attribute is not updated in iBGP,  in order to prevent routing loops, an iBGP router will not advertise routes learned from an iBGP peer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP speakers within a single AS (iBGP) must be connected in a full mesh or use a mitigation to prevent traffic from being blackholed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some BGP attributes cannot be sent from one AS to a different AS, and some BGP attributes only have meaning between different ASes.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-10T17:58:33.720" LastActivityDate="2015-11-10T17:58:33.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24283" PostTypeId="5" CreationDate="2015-11-10T16:41:56.703" Score="0" Body="&lt;p&gt;There are several definitions for a Local Area Network (LAN). The specific definition often depends on context, but LAN usually refers to a relatively small network within a limited area. A LAN is usually controlled by a single person or organization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The term LAN may have various meanings, such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;An OSI layer-2 broadcast domain.&lt;/li&gt;&#xA;&lt;li&gt;A network in a single office.&lt;/li&gt;&#xA;&lt;li&gt;A network in a single building.&lt;/li&gt;&#xA;&lt;li&gt;A network in a small group of adjacent buildings.&lt;/li&gt;&#xA;&lt;li&gt;A network on a single cable plant.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-10T20:07:29.190" LastActivityDate="2015-11-10T20:07:29.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24284" PostTypeId="4" CreationDate="2015-11-10T16:41:56.703" Score="0" Body="For questions about Local Area Networks (LANs)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-10T20:07:24.097" LastActivityDate="2015-11-10T20:07:24.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24286" PostTypeId="2" ParentId="24281" CreationDate="2015-11-10T18:05:18.573" Score="2" Body="&lt;p&gt;@Ron_Maupin is 100% correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as the Juniper specific portion goes, this is nothing but a construct to make configuration easier, as well as more explicit/obvious.  JunOS was built to be very specific in nature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following example would work for both &lt;strong&gt;iBGP or EBGP&lt;/strong&gt; peers, as long as the router on the other end had its AS set correctly, setting a group type is not mandatory.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jhead@VPN-EP1# show | compare&#xA;[edit protocols]&#xA;+   bgp {&#xA;+       group TRANSIT {&#xA;+           neighbor 1.2.3.4 {&#xA;+               peer-as 65555;&#xA;+           }&#xA;+       }&#xA;+   }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, you don't have to specify &lt;code&gt;external&lt;/code&gt; or &lt;code&gt;internal&lt;/code&gt;.  But looking at that configuration you wouldn't be able to tell whether it was EBGP or iBGP, without looking at neighbor information or already having knowledge of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a more practical reason to set a &lt;code&gt;type&lt;/code&gt; at the group level, would be enforcement of that type of peering in that group.  If you have a group built for peers in an IX exchange, those peers probably inherit the same policies and other attributes.  If someone comes along and puts an iBGP peer in that group without having the type set, that peer might come up.  There are a ton of reasons that this could be bad, but would vary per deployment, setting the type at the group level helps mitigate any of the potential issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a lot cleaner to do something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jhead@VPN-EP1# show protocols bgp&#xA;group TRANSIT {&#xA;    type external;&#xA;    neighbor 172.16.67.3 {&#xA;        peer-as 20000;&#xA;    }&#xA;}&#xA;&#xA;[edit]&#xA;jhead@VPN-EP1# show routing-options&#xA;autonomous-system 10000;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2015-11-10T18:05:18.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24287" PostTypeId="1" CreationDate="2015-11-10T18:18:58.150" Score="0" ViewCount="91" Body="&lt;p&gt;Is it possible to implement NDIS filter driver to catch and analyse raw 802.11 packets?&#xA;If not, then how I can catch baecon, auth and death packets in windows?&lt;/p&gt;&#xA;" OwnerUserId="20577" LastActivityDate="2015-11-10T19:57:54.333" Title="802.11 sniffering with NDIS" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="3" ClosedDate="2015-11-11T14:39:08.377" ContentLicense="CC BY-SA 3.0" />
  <row Id="24289" PostTypeId="1" AcceptedAnswerId="24291" CreationDate="2015-11-10T19:08:44.763" Score="4" ViewCount="1597" Body="&lt;p&gt;I'm stuck with NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The inside server is at 192.168.1.1 running HTTP on port 80. The Cisco IOS router at 192.168.1.254 using 1.1.1.1 as external address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT overload works correctly for Internet access, as well as local access to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router is port forwarding  using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static tcp 192.168.1.1 80 interface Dialer0 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the external host at 2.2.2.2 can see the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I swap the server - all settings being left the same, ARP caches cleared - for a device which only accepts clients from it's own subnet (the 192.168.1.0/24 network), the port forwarding quite correctly fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's because, although the inbound packet has its destination changed, the source of the request remains as 2.2.2.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What NAT do I need to use to ensure inbound requests, which can be on a different port if needed, appear to hit the server/device from 192.168.1.254 - the router's internal IP?&lt;/p&gt;&#xA;" OwnerUserId="106" LastEditorUserId="8499" LastEditDate="2015-11-10T21:49:26.463" LastActivityDate="2015-11-10T21:49:26.463" Title="Inbound NAT - masquerade as router?" Tags="|cisco|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24291" PostTypeId="2" ParentId="24289" CreationDate="2015-11-10T19:15:28.890" Score="5" Body="&lt;p&gt;You can use &lt;code&gt;outside source&lt;/code&gt; to translate the outside address to appear as if it comes from inside. Companies often use this when they merge and have overlapping address ranges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/23083/what-do-these-three-options-in-a-cisco-router-nat-configuration-mean&quot;&gt;this question&lt;/a&gt; for an explanation of different NAT options.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-11-10T19:15:28.890" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24292" PostTypeId="5" CreationDate="2015-11-10T19:35:02.647" Score="0" Body="&lt;p&gt;The OSI layer-1 is the physical layer which is how the actual &quot;bits on the wire&quot; get transferred from one device to another. It includes multiple technologies such as coax, fiber, UTP, radio, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This layer is the bottom-most layer in the OSI model, and any network communication eventually crosses a layer-1 link.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-11-10T19:35:02.647" LastActivityDate="2015-11-10T19:35:02.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24293" PostTypeId="4" CreationDate="2015-11-10T19:35:02.647" Score="0" Body="For questions about the OSI layer-1 (physical layer)." OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-11-10T19:35:02.647" LastActivityDate="2015-11-10T19:35:02.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24294" PostTypeId="2" ParentId="24287" CreationDate="2015-11-10T19:57:54.333" Score="2" Body="&lt;p&gt;In general, no you cannot do so in Windows with any normal drivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are products that provide their own custom drivers that will allow you to capture 802.11 traffic, but product recommendations are specifically off topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind when looking at products that you find a solution that best meets your needs. For instance, if you are running an 802.11ac four spatial stream network, you wouldn't want a capture solution for 802.11n two spatial stream. While it may be better than no solution, there will be traffic it won't be able to capture...but sometimes the capabilities of the network outpace the capabilities of the tools you can use.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-11-10T19:57:54.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24295" PostTypeId="2" ParentId="18440" CreationDate="2015-11-10T21:21:36.753" Score="1" Body="&lt;p&gt;You are designing a network with 8 switches. In my opinion, it's a network big enough to invest a bit more in a core switch with more 10GB links. Make a pure star topology with a core (switch 3) connected to each switch trought an etherchannel/port-channel (2x10GBx7 switches = 14x10GB).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can't afford a core with 14x10GB, try to get a core with at least 7x10GB. Make a star topology with only one link per switch and get redudancy connecting each switch with another one (should be blocked by STP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are stuck to this Cisco model, you can't do much better. Just try to connect switch 1 to switch 3 directly and switch 5 to switch 7. As a best practice, try to not chain switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an opinion, at least, get a decent switch core ;).&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2015-11-10T21:21:36.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24296" PostTypeId="5" CreationDate="2015-11-10T22:44:05.633" Score="0" Body="&lt;p&gt;For questions about Voice over Internet Protocol (VoIP) which encompasses various technologies (methods, functions, and encapsulations) for encoding and delivering audio on a network using IP. VoIP technologies may be proprietary or open, but the VoIP datagrams are delivered using IP as the OSI layer-3 network protocol.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-10T23:04:33.860" LastActivityDate="2015-11-10T23:04:33.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24297" PostTypeId="4" CreationDate="2015-11-10T22:44:05.633" Score="0" Body="For questions about Voice over Internet Protocol (VoIP) which encompasses various technologies (methods, functions, and encapsulations) for encoding and delivering audio on a network using IP." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-10T23:04:27.320" LastActivityDate="2015-11-10T23:04:27.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24298" PostTypeId="2" ParentId="16732" CreationDate="2015-11-11T02:31:11.430" Score="0" Body="&lt;p&gt;This can also be done with the limiter in pfSense's traffic shaper (and probably many other systems have some way to get there) - m0n0wall did in the simplest way possible (one button to &quot;share bandwidth equally&quot;, which folks on pfSense have asked for and not gotten), but I guess m0n0wall's &lt;a href=&quot;http://m0n0.ch/wall/index.php&quot; rel=&quot;nofollow&quot;&gt;moved into being abandonedware.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per @RonTrunk's question, with the pfSense Limiter (being the one I use, as I assume @Andrew uses Microtik's) it does appear that the 2 active devices each get half the bandwidth, or if one is only looking for 20% the other gets 80%. However, in practice it's really a somewhat smaller figure since the &quot;root&quot; limiter that gets split up among the child queues needs to be a bit smaller than the actual maximum bandwidth for the limiter to work correctly (it needs to be shaping the traffic, not an upstream device.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Details on how I do it are here: &lt;a href=&quot;https://forum.pfsense.org/index.php?topic=99529.msg555886#msg555886&quot; rel=&quot;nofollow&quot;&gt;https://forum.pfsense.org/index.php?topic=99529.msg555886#msg555886&lt;/a&gt; and additional detail is provided here (it links to the message above, but fills in some additional details) &lt;a href=&quot;https://forum.pfsense.org/index.php?topic=101774.msg569030#msg569030&quot; rel=&quot;nofollow&quot;&gt;https://forum.pfsense.org/index.php?topic=101774.msg569030#msg569030&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I make no claim that it's the be-all end-all, but it works (for @RossC's desired version of work) better than anything else I've tried so far with some truly painful loading on it (I'm in desperate need of a bigger pipe, but it's endlessly delayed in getting here.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used to do hard per-user limits. This works much better.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-11-11T02:31:11.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24299" PostTypeId="1" AcceptedAnswerId="24301" CreationDate="2015-11-11T04:18:38.767" Score="2" ViewCount="6315" Body="&lt;p&gt;I am building an image server. If a client uploads an image, is it possible for image to be corrupted when it reaches the server from its journey from client to server? If yes, is there some TCP mechanism to fix this issue (e.g. parity)? &lt;/p&gt;&#xA;" OwnerUserId="4339" LastEditorUserId="8499" LastEditDate="2018-10-19T06:12:03.143" LastActivityDate="2018-10-19T06:12:03.143" Title="Data corruption over wire" Tags="|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24300" PostTypeId="2" ParentId="24299" CreationDate="2015-11-11T04:40:45.693" Score="3" Body="&lt;p&gt;There is a CRC in an ethernet frame header which will drop a frame if it detects corruption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv4 has a header checksum to detect corruption in the IP header (IPv6 doesn't have this).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP has a checksum for the entire TCP segment to detect data corruption, and TCP guarantees delivery and out-of-order reassembly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP has a checksum, but it is a fire-and-forget, best-effort protocol with no expectation of delivery or reception, so you would need to build that into the application layer if you use UDP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-11T04:40:45.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24301" PostTypeId="2" ParentId="24299" CreationDate="2015-11-11T05:27:34.903" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am building an image server. If a client uploads an image, its it possible for image to be corrupted when it reaches the server from its journey from client to server ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Possible? Certainly, but before you get worried, lets get into this a bit more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet contains a CRC value to help prevent corruption. IPv4, TCP, and UDP all use checksum values to help prevent corruption (note: IPv6 does not). CRC and checksum are two different methods to calculate the data is unchanged. So a single IPv4 packet will have a CRC and two different checksum operations performed on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any single bit error introduced in the data will be detected by both methods. The issue comes when you have multiple bit errors in the data. It is possible to have multiple bit errors that will provide a valid CRC. It is also possible to have multiple bit errors that will provide a valid checksum. However, it is very unlikely (but yes, possible) to have multiple bit errors that provide both a valid CRC and checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In all cases, when corruption is detected it causes the data to be dropped. TCP contains a mechanism for retransmission of dropped segments, no normally you experience no data loss when it is in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if UDP is used instead of TCP, if there is corruption detected any any of the three levels (Ethernet, IPv4 or UDP), then the data is dropped and it is up to a higher level process (i.e. the application, file format, etc) to detect and remedy the lost data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of this so far is based purely on the network, but applications transferring data often have some means of checking data integrity as well. Further some file formats may have some means of validating integrity as well, especially if they are compressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So again, yes it is possible, but unlikely. You are probably just as likely to introduce data corruption when your computer or server is reading/writing data to disk or memory. I will also note that data corruption in image files will generally either cause a serious problem or be unnoticeable.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If yes, is there some tcp mechanism to fix this issue like parity etc ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I detailed, TCP (as well as UDP, IPv4, and Ethernet) all have ways to detect errors in the data. Only TCP has a mechanism for retransmission, so if TCP is not used, the data is dropped. The good news is that most file transfers do use TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond that, it would be dependent on the application to fix errors. For instance, most compressed data has some sort of error detection/correction. So compressed file formats often have some measure of this built into the file. Also if the data sent across the network is compressed (for example a browser and server with HTTP compression enabled), there will be a measure of this involved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And that doesn't include any measures built into the application itself, which should be concerning itself with data integrity even when handling data with the the same computer/server.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-11-11T05:27:34.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24302" PostTypeId="1" AcceptedAnswerId="24303" CreationDate="2015-11-11T08:13:21.367" Score="0" ViewCount="642" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SWpk1.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SWpk1.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hello all,&#xA;I have a Alteon 4408 switch.&#xA;&lt;strong&gt;Even though I configured the switch as baud rate(9600), stop bit(1), it does not working properly.&#xA;It happened like upper picture.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I changed the baud rate except for 9600. but failed.&#xA;and I also changed my console cable. but failed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past, I had dealt with 4408,&#xA;At this time, it worked well.. as I used same console cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know this issue, please contact me.&#xA;Regards,&lt;/p&gt;&#xA;" OwnerUserId="20562" LastActivityDate="2015-11-11T08:43:25.273" Title="Alteon 4408, console connection" Tags="|switch|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24303" PostTypeId="2" ParentId="24302" CreationDate="2015-11-11T08:25:33.963" Score="1" Body="&lt;p&gt;it may some thing relate to converter which connect your console cable to the USB port in your computer . may you try to used desktop computer with normal serial port and use putty terminal with the next settings&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2TYXr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2TYXr.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and it should work .&lt;br&gt;&#xA;otherwise you may check the flow control options in the serial part as next &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Y7Efj.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y7Efj.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and try the 4 options . one of them should work&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-11-11T08:43:25.273" LastActivityDate="2015-11-11T08:43:25.273" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24309" PostTypeId="1" AcceptedAnswerId="24310" CreationDate="2015-11-11T14:37:34.987" Score="6" ViewCount="31673" Body="&lt;p&gt;I came across this command at a Layer 2 Switch, and I don't know what it does. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no switchport&#xA;Ip Addr 10.2.3.4 255.255.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="5725" LastEditDate="2015-11-11T19:57:12.663" LastActivityDate="2017-07-27T21:58:00.210" Title="What does this &quot;no switchport&quot; command do?" Tags="|layer2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24310" PostTypeId="2" ParentId="24309" CreationDate="2015-11-11T14:51:08.137" Score="10" Body="&lt;p&gt;This would have to be commands provided from an interface on a L3 capable switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;no switchport&lt;/code&gt; command puts the interface in L3 mode (known as &quot;routed port&quot;) and makes it operate more like a router interface rather than a switch port. The &lt;code&gt;ip address&lt;/code&gt; command assigns an IP address and network mask to the interface. Routed ports can be configured with a Layer 3 routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/configuration/guide/scg3750/swint.html#16355&quot; rel=&quot;nofollow noreferrer&quot;&gt;restrictions apply&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It does not support VLAN subinterfaces.&lt;/li&gt;&#xA;&lt;li&gt;It does not support Layer 2 protocols, such as DTP and STP.&lt;/li&gt;&#xA;&lt;li&gt;It is supported only on switches running the IP base or IP services image.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33" LastEditorUserId="6080" LastEditDate="2017-07-27T21:58:00.210" LastActivityDate="2017-07-27T21:58:00.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24312" PostTypeId="1" AcceptedAnswerId="24313" CreationDate="2015-11-11T15:59:09.527" Score="12" ViewCount="42634" Body="&lt;p&gt;Well I know that might sound a stupid question and I believe that the most proper answer will be like I will be able to tell as my experience builds up and I learn more and more about the protocols. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I am a student and I am not having much hands on experience in the field. Though I can google for any given protocol, I want to know if there is any rule of thumb. I still feel asking for &quot;rule of thumb&quot; is stupid, but still I am looking for one. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I encountered &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers&quot; rel=&quot;noreferrer&quot;&gt;this list on wikipedia&lt;/a&gt; which lists the protocols and whether they use TCP or UDP in the tabular format. However I am not able to understand that what it means when the row for a particular protocol contains both TCP and UDP with single port number. For example, in Telnet row, it has &lt;code&gt;23-TCP-UDP&lt;/code&gt;. What does this mean? Telnet can operate on both TCP port 23 and UDP port 23?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also I found that in my textbook, it says TFTP uses UDP, but if we look in the above table, TFTP line is &lt;code&gt;69-TCP-UDP&lt;/code&gt;. So just guessing whats going on in the above table.&lt;/p&gt;&#xA;" OwnerUserId="19940" LastEditorUserId="8499" LastEditDate="2018-10-27T02:36:29.383" LastActivityDate="2023-12-04T14:31:43.600" Title="How to know whether a protocol uses TCP or UDP" Tags="|tcp|udp|layer4|transport-protocol|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24313" PostTypeId="2" ParentId="24312" CreationDate="2015-11-11T16:36:07.427" Score="13" Body="&lt;p&gt;You asked a good question. Don't let anyone tell you otherwise.&lt;/p&gt;&#xA;&lt;p&gt;Regrettably, there is no rule of thumb for the types of protocols that use TCP versus the types of protocols that use UDP.&lt;/p&gt;&#xA;&lt;p&gt;The decision whether a protocol uses one or the other comes down to whomever wrote/created the protocol to begin with.&lt;/p&gt;&#xA;&lt;p&gt;If they didn't want to bother with writing their own &amp;quot;reliable delivery&amp;quot; system, then they can simply use TCP which provides all the reliability innately.&lt;/p&gt;&#xA;&lt;p&gt;If they thought (knowing their own protocol innately) that they could write a better or more appropriate &amp;quot;reliable delivery&amp;quot; system, then they can build that into the protocol itself and simply use UDP as their transport.&lt;/p&gt;&#xA;&lt;p&gt;As an example, take a look at a UDP &lt;a href=&quot;https://wiki.wireshark.org/TFTP&quot; rel=&quot;nofollow noreferrer&quot;&gt;TFTP sample capture&lt;/a&gt;, you'll notice that there are built in acknowledgement systems within TFTP itself -- having both those and the additional acknowledgement systems within TCP would simply be redundant.&lt;/p&gt;&#xA;&lt;p&gt;Whereas FTP, which runs over TCP, does not have a built-in acknowledgement system. A user simply request a file, and the sender sends it. There is a &amp;quot;file transfer complete&amp;quot; notification, but nothing that guarantees having received each bit of the file.  FTP is relying on TCP's reliability to ensure the file gets all the way across.&lt;/p&gt;&#xA;&lt;p&gt;That said, I looked through the list of ports on the wiki page you linked, and saw a surprising amount of protocols that supposedly use TCP &lt;em&gt;and&lt;/em&gt; UDP. This was foreign to me, and I only know of very few that use both (namely, DNS). But it may be that there is a TFTP implementation that uses TCP, and if so, I'm afraid I have no exposure to it.&lt;/p&gt;&#xA;&lt;p&gt;Domain Name System (DNS) is traditionally the protocol referred to when discussing protocols that use both TCP and UDP. It doesn't use these at the same time, mind you. But different functions within DNS might call for TCP vs UDP.&lt;/p&gt;&#xA;&lt;p&gt;For example, when making a simple A-record resolution request, the &amp;quot;request&amp;quot; and &amp;quot;response&amp;quot; are very lightweight, both requiring a single packet.  As such, this is typically done over UDP.&lt;/p&gt;&#xA;&lt;p&gt;But if a request or response requires a larger transfer (above a certain amount of bytes), then DNS chooses to use TCP to ensure &amp;quot;all the bits&amp;quot; get there. This is common with full Zone Transfer requests.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="71994" LastEditDate="2023-12-04T14:31:43.600" LastActivityDate="2023-12-04T14:31:43.600" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="24314" PostTypeId="2" ParentId="24312" CreationDate="2015-11-11T16:53:21.723" Score="6" Body="&lt;p&gt;The Wikipedia page is not the best. IANA maintains the registry for port numbers (be warned, it is currently 138 pages): &lt;a href=&quot;http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml&quot; rel=&quot;noreferrer&quot;&gt;Service Name and Transport Protocol Port Number Registry&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An application layer protocol is free to use any transport layer protocol and port number. By convention, most use specific port numbers in the registry, but that doesn't mean they can't use others, too. For instance, a web server will default to TCP port 80, but it can be set to use any other port number, and a web browser can still use it if given the port number on the URI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many applications which can be set to use either TCP or UDP, and the port numbers can be changed. This offers some flexibility when dealing with conflicts and strange implementations.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-11T16:53:21.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24315" PostTypeId="1" CreationDate="2015-11-11T17:21:08.633" Score="3" ViewCount="5120" Body="&lt;p&gt;Looking to see where my MX router is failing to peer with a neighbor.  I can do a &lt;code&gt;show bgp neighbor&lt;/code&gt;, but that only shows me the current state.  Is there a way to see all the steps it took during the peering process, and where it failed?&lt;/p&gt;&#xA;" OwnerUserId="11938" LastEditorUserId="8499" LastEditDate="2015-11-11T17:29:52.270" LastActivityDate="2015-11-11T23:04:52.453" Title="How to observe logs/steps MX has taken to peer BGP" Tags="|bgp|juniper|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24316" PostTypeId="1" CreationDate="2015-11-11T17:38:16.380" Score="1" ViewCount="262" Body="&lt;p&gt;I'm new to all the network field of knowldege, so I hope my question makes sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a scenario of transition from IPv4 to IPv6, let's suppose ALG is implemented. How would an ALG convert the IHL in the header between the two versions? For exemple: if a IPv6 packet is sent to a IPv4-only host, would a ALG replace the IHL with something like the padding found in the option part of an IPv4 or would a ALG simply &quot;discard&quot; the IHL?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for enlightening me! &lt;/p&gt;&#xA;" OwnerUserId="20605" LastEditorUserId="8499" LastEditDate="2022-10-08T00:40:55.077" LastActivityDate="2022-10-08T00:40:55.077" Title="Transition from IPv4 to IPv6: how would IHL be managed using ALG?" Tags="|routing|ipv6|ipv6-transition|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24318" PostTypeId="2" ParentId="24316" CreationDate="2015-11-11T18:04:31.873" Score="2" Body="&lt;p&gt;IPv6-only and IPv4-only hosts can't directly communicate. The IPv6 packet would never be delivered to an IPv4-only host since the IPv4-only host doesn't have an IPv6 address. Application layer protocols can't do anything about this. You would need something like NAT64, but that has its problems, too, since these are two completely separate protocols. Any bridging between the two is really a hack. Most people will run dual-stack so that they can send/receive either protocol.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="619" LastEditDate="2015-11-11T20:48:57.970" LastActivityDate="2015-11-11T20:48:57.970" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24319" PostTypeId="2" ParentId="24315" CreationDate="2015-11-11T18:11:26.553" Score="6" Body="&lt;p&gt;I think you're looking for traceoptions for BGP. From the documentation on &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/topic-map/bgp-troubleshooting.html&quot; rel=&quot;nofollow&quot;&gt;Juniper's site&lt;/a&gt;: &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Configuring Traceoptions&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit protocols bgp traceoptions]&#xA;user@router# set file bgp.log size 10m files 10 world-readable&#xA;&#xA;[edit protocols bgp traceoptions]&#xA;user@router# set flag ?&#xA;Possible completions:&#xA;4byte-as             Trace 4 byte AS events&#xA;add-path             Trace add-path events&#xA;all                  Trace everything&#xA;bfd                  Trace BFD events&#xA;damping              Trace BGP damping information&#xA;general              Trace general events&#xA;graceful-restart     Trace Graceful Restart events&#xA;keepalive            Trace BGP keepalive packets&#xA;normal               Trace normal events&#xA;nsr-synchronization  Trace NSR synchronization events&#xA;open                 Trace BGP open packets&#xA;packets              Trace all BGP protocol packets&#xA;policy               Trace policy processing&#xA;refresh              Trace BGP refresh packets&#xA;route                Trace routing information&#xA;state                Trace state transitions&#xA;task                 Trace routing protocol task processing&#xA;timer                Trace routing protocol timer processing&#xA;update               Trace BGP update packets&#xA;&#xA;[edit protocols bgp traceoptions]&#xA;user@router# commit and-quit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Viewing Your Traceoptions&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@router&amp;gt; show log bgp.log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the above will turn on traceoptions for all BGP peers which could be quite chatty. You have the ability to only turn on traceoptions for a specific group or even a specific neighbor by navigating to that hierarchy and running the same commands.&lt;/p&gt;&#xA;" OwnerUserId="10323" LastEditorUserId="10323" LastEditDate="2015-11-11T23:04:52.453" LastActivityDate="2015-11-11T23:04:52.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24320" PostTypeId="2" ParentId="24315" CreationDate="2015-11-11T18:41:58.197" Score="0" Body="&lt;p&gt;You need to communicate with your provider, on the way to see if it's presenting some troubles on his side, checking from the physical link, eg, fiber troubles, some equipment, or something else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the way to debug your BGP session, you need to change what do you want to see, like is explained here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos13.2/topics/topic-map/bgp-troubleshooting.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/documentation/en_US/junos13.2/topics/topic-map/bgp-troubleshooting.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;your@host# set traceoptions file bgp-log&#xA;your@host# set traceoptions file size 10k&#xA;your@host# set traceoptions file files 2&#xA;your@host# set traceoptions flag update detail&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And sure, made a &quot;commit&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;your@host# commit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, you can see you debugging here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;your@host&amp;gt; file show /var/logical-systems/A/log/bgp-log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-11-11T18:41:58.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24321" PostTypeId="1" CreationDate="2015-11-11T20:10:12.780" Score="3" ViewCount="5866" Body="&lt;p&gt;Perhaps the question I want to ask is not directly related to discussion subjects over here, but I couldn't find better place to ask. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanna know how does internet connection speed depend on distance while connecting with different cables. For example, if a connection made with optical fiber cable and the distance it follows is 1(one) mile, would it get a down speed for some reason? And what if the distance is 10 or a 100 etc? &#xA;Same goes for a DSL connection type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, If there is some down speed because of the distance, how does it actually happens and why? Is it because as the distance higher - then weaker the signal is?&lt;/p&gt;&#xA;" OwnerUserId="20610" LastEditorUserId="8499" LastEditDate="2018-03-09T01:00:47.977" LastActivityDate="2018-03-09T01:00:47.977" Title="Does Internet speed over cable depend on distance?" Tags="|internet|layer1|cable|speed|adsl|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24323" PostTypeId="2" ParentId="24321" CreationDate="2015-11-11T20:47:26.317" Score="3" Body="&lt;p&gt;The answer to your question depends completely on the technology used. The complete answer to your question is far too broad, covering many different technologies, to answer here. Any distance will add to latency which can affect perceived speed, depending on the upper layer protocol used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiber (there are multiple standards with various fiber types and bandwidths) will either work at the bandwidths for the standard used, or it won't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some copper based technologies will either work (up to the distance limitation), or they will not work. Some (DSL comes to mind) will degrade to lower bandwidth because some of the frequency channels will not work over a certain distance while others still do.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-11T20:47:26.317" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24324" PostTypeId="2" ParentId="24312" CreationDate="2015-11-11T21:54:59.147" Score="5" Body="&lt;p&gt;In real life, you will find it is very easy to tell which transport protocol is used.  Also, if you are looking for a &quot;rule of thumb&quot;, then think of this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UDP&lt;/strong&gt; is a 'connectionless' / unreliable protocol, it does not recover lost packets like TCP does, and has much less overhead than TCP, so it is used as transport for applications that are sensitive to delay (like streaming audio / video).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TCP&lt;/strong&gt; is a 'connection oriented' / reliable protocol, it recovers packets when they are lost, and has higher overhead, but is used where packet loss would cause issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a number of methods you can use to determine in real life what transport layer protocol an application is using:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Run &lt;code&gt;netstat -an&lt;/code&gt; from a Windows command prompt. &lt;/li&gt;&#xA;&lt;li&gt;Download and run TCPView (which also lists UDP) for a GUI view.&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wireshark&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Run &lt;a href=&quot;https://nmap.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;nmap&lt;/code&gt;&lt;/a&gt; against the server with port in question (by default only scans TCP ports)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20613" LastEditorUserId="41711" LastEditDate="2017-11-26T14:02:59.843" LastActivityDate="2017-11-26T14:02:59.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24326" PostTypeId="1" AcceptedAnswerId="24343" CreationDate="2015-11-11T23:18:43.733" Score="3" ViewCount="73" Body="&lt;p&gt;I need some clarification when using Cisco unified connections as a basis for my VoIP network. If I have a PC connecting through an IP phone, how can I put the PC into a separate subnet? If the IP phone and PC are separate subnets, how would they be able to communicate? &lt;/p&gt;&#xA;" OwnerUserId="20574" LastEditorUserId="8499" LastEditDate="2018-12-12T23:44:00.450" LastActivityDate="2018-12-12T23:44:00.450" Title="Cisco unified connections subnetting" Tags="|cisco|vlan|subnet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24327" PostTypeId="2" ParentId="24326" CreationDate="2015-11-11T23:22:47.693" Score="2" Body="&lt;p&gt;The switch will use either CDP or LLDP to negotiate a trunk with the phone. The VoIP phone acts as a switch. As with any VLANs, you need a router to let a device on one VLAN talk to a device on another VLAN. The PC and phone probably have no need to communicate with each other. It is normally a good idea to keep VoIP and data VLANs separate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a Cisco switch, you put this on an access port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport access vlan &amp;lt;DATA VLAN&amp;gt;&#xA;switchport voice vlan &amp;lt;VOIP VLAN&amp;gt;&#xA;switchport mode access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-11T23:53:19.843" LastActivityDate="2015-11-11T23:53:19.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24328" PostTypeId="1" AcceptedAnswerId="24330" CreationDate="2015-11-11T23:27:49.317" Score="2" ViewCount="91" Body="&lt;p&gt;I'm a bit confused by the logic behind this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I find the IP address given just the subnet mask and network address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that given the IP address and subnet mask, I can obtain the network address by converting to decimal dot notation of both addresses to binary and using the &lt;code&gt;AND&lt;/code&gt; bitwise operation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I must just not be seeing something so obvious. &lt;/p&gt;&#xA;" OwnerUserId="20615" LastEditorUserId="8499" LastEditDate="2015-11-11T23:37:21.197" LastActivityDate="2015-11-11T23:54:15.657" Title="What can I obtain from this information (given subnet mask and network address)?" Tags="|subnet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24330" PostTypeId="2" ParentId="24328" CreationDate="2015-11-11T23:35:35.170" Score="2" Body="&lt;p&gt;There is no way to determine a single host's IP address from the network address and mask. The network address and mask will give you the range of possible host addresses, but not any individual host's IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you wrote, it is possible to derive the network address from the host address and mask, but it is not possible to do the reverse since you can go from specific to range, but a range has nothing in it to give you a specific.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's like trying to know which finger is represented by &quot;fingers&quot;. You can know that &quot;the left index finger&quot; is is in &quot;fingers on the left hand&quot;, but knowing &quot;fingers on the left hand&quot; doesn't give you the specific finger.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-11T23:54:15.657" LastActivityDate="2015-11-11T23:54:15.657" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24331" PostTypeId="1" AcceptedAnswerId="24332" CreationDate="2015-11-11T23:39:10.617" Score="4" ViewCount="1894" Body="&lt;p&gt;Why do we need both source and destination port numbers in transport layer protocols such as TCP or UDP? What is the purpose for having both?&lt;/p&gt;&#xA;" OwnerUserId="20617" LastEditorUserId="8499" LastEditDate="2020-12-19T20:58:06.457" LastActivityDate="2020-12-19T20:58:06.457" Title="port numbers for TCP and UDP" Tags="|tcp|protocol-theory|udp|transport-protocol|layer4|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24332" PostTypeId="2" ParentId="24331" CreationDate="2015-11-11T23:44:30.790" Score="2" Body="&lt;p&gt;Just as MAC addresses are layer-2 addresses, and IP addresses are layer-3 addresses, port numbers are layer-4 addresses. When the transport layer wants to reply to a layer-4 request, it must have the address (port) to which it should reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a PC sends an HTTP (TCP port 80) request to to an HTTP server, the PC uses an ephemeral TCP source port and the HTTP server's TCP port 80 as the destination port. The HTTP server replies back to the PC's ephemeral port, and it gets that port number from the source port of the PC's request.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-07-09T07:46:17.010" LastActivityDate="2017-07-09T07:46:17.010" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24333" PostTypeId="2" ParentId="24326" CreationDate="2015-11-12T00:57:50.917" Score="0" Body="&lt;p&gt;As Mr. Maupin stated, VOIP and data traffic are typically separated. The Phone acting as a Switch (layer 2 device), will just pass the IP traffic from the Phone and PC to the router for Layer 3 (routing) functionality. Therefore, the networks that each device is in (whether it is the same or not) does not matter to the Phone or PC.  &lt;/p&gt;&#xA;" OwnerUserId="20619" LastActivityDate="2015-11-12T00:57:50.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24335" PostTypeId="1" AcceptedAnswerId="24336" CreationDate="2015-11-12T03:07:07.620" Score="2" ViewCount="914" Body="&lt;p&gt;I am confused with what happens to the &lt;code&gt;default router&lt;/code&gt; adddress when we are configuring &lt;code&gt;DHCP&lt;/code&gt; in the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the network with 253 hosts, &lt;code&gt;192.168.1.0/24&lt;/code&gt;, and I have configured &lt;code&gt;DHCP&lt;/code&gt; in my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, while configuring DHCP, I have excluded the first four IP address of the network using &lt;code&gt;ip dhcp exclude-address&lt;/code&gt; command, but I haven't excluded the address that I have used as a &lt;code&gt;default-router&lt;/code&gt; address in DHCP configuration, which is the last address of the network, i.e. &lt;code&gt;192.168.1.254&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I am confused that, since I didn't excluded that last ip address and point it to a &lt;code&gt;default-router&lt;/code&gt; will router try to lease that address ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, is it automatically excluded ? or do I have to exclude it myself to avoid any conflict ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; &lt;code&gt;default-router&lt;/code&gt; is pointing to another router where hosts are connected, and where &lt;code&gt;ip helper-address&lt;/code&gt; is configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using 1841 Router in Packet Tracer.&lt;/p&gt;&#xA;" OwnerUserId="14885" LastEditorUserId="8499" LastEditDate="2018-12-17T03:06:33.797" LastActivityDate="2018-12-17T03:06:33.797" Title="Does Router automatically exclude default-router address from DHCP leasing?" Tags="|cisco|router|cisco-ios|dhcp|cisco-commands|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24336" PostTypeId="2" ParentId="24335" CreationDate="2015-11-12T03:13:56.273" Score="3" Body="&lt;p&gt;A Cisco ISR router like the 1841 excludes the router's address on the subnet for which DHCP is configured if the router is performing DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have two routers and an FHRP on the subnet, you need to be more careful.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-12T03:13:56.273" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24337" PostTypeId="2" ParentId="24184" CreationDate="2015-11-12T03:37:14.393" Score="0" Body="&lt;p&gt;Okay, I spoke with Dell support and the issue was related to routing.  The switch couldn't get to the Internet to hit the external SNTP servers.  We used putty to connect to the switch and then tried to ping the external SNTP server IP which didn't work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back in the web interface, you can do the following to fix it:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Click on &quot;Network Administration&quot;, &quot;Route Settings&quot;, and then &quot;IPv4 Route Settings&quot;&lt;/li&gt;&#xA;&lt;li&gt;Beside &quot;IPv4 Routes Table&quot;, Click &quot;Edit&quot;&lt;/li&gt;&#xA;&lt;li&gt;Click &quot;Add&quot;&lt;/li&gt;&#xA;&lt;li&gt;Enter &quot;0.0.0.0&quot; into the &quot;Destination IPv4 Prefix&quot; textbox&lt;/li&gt;&#xA;&lt;li&gt;Enter &quot;0.0.0.0&quot; into the &quot;Network Mask&quot; textbox&lt;/li&gt;&#xA;&lt;li&gt;Enter the default gateway (Example: 192.168.0.1) into the &quot;Next Hop&quot; textbox&lt;/li&gt;&#xA;&lt;li&gt;Click &quot;OK&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After that, the switch was able to obtain the time correctly.&lt;/p&gt;&#xA;" OwnerUserId="20041" LastActivityDate="2015-11-12T03:37:14.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24341" PostTypeId="1" AcceptedAnswerId="24342" CreationDate="2015-11-12T08:41:56.193" Score="1" ViewCount="1835" Body="&lt;p&gt;I'm evaluating whether to get a SonicWall TZ or a comparable Fortinet  firewall. One thing i can't find but would really like to have is the ability to automate backing up the firewall configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a (preferably simple) way to fetch the running configuration from a SonicWall using scriptable command line-fu, utilising secure transport like ssh or scp? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, can the retrieved file be edited and uploaded to a TZ to reconfigure the firewall?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both tricks seem to be doable on a Fortinet firewall.&lt;/p&gt;&#xA;" OwnerUserId="20627" LastActivityDate="2015-11-12T09:08:12.030" Title="Backup configuration from SonicWall using ssh or scp" Tags="|sonicwall|fortinet|automation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24342" PostTypeId="2" ParentId="24341" CreationDate="2015-11-12T09:08:12.030" Score="2" Body="&lt;p&gt;Sonicwall export files are compiled , thus is not possible to edit them offline and reupload to a different appliace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a way to fetch config files , I never tried, but on stackoverflow there was a discussion on it, with an example script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/14147473/shell-script-to-automate-sonicwall-firewall-ssh-session-not-working&quot;&gt;https://stackoverflow.com/questions/14147473/shell-script-to-automate-sonicwall-firewall-ssh-session-not-working&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no experience on Fortinet , sorry...&lt;/p&gt;&#xA;" OwnerUserId="2542" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2015-11-12T09:08:12.030" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24343" PostTypeId="2" ParentId="24326" CreationDate="2015-11-12T09:16:27.430" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eTbmg.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eTbmg.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;as shown in the figure , the layer 2 switch will be connected to the ip phone with connection called &lt;strong&gt;&lt;em&gt;mini trunk&lt;/em&gt;&lt;/strong&gt; which acting as a trunk carry two Vlan's the data one and the voice one . on the ip phone itself there is mini switch which will untag the voice vlan and use it for voice traffic and untag the data vlan and forward it to the pc port . voice traffic is treated this way mainly for one reason that is QOS ,where voice traffic need to be prioritized than the data traffic &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-11-12T09:16:27.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24346" PostTypeId="1" AcceptedAnswerId="24591" CreationDate="2015-11-12T10:21:18.333" Score="3" ViewCount="1840" Body="&lt;p&gt;I have read some articles describing that one can use the monitor mode on a NIC to do packet injection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really don't understand why I cannot just use the managed mode to forge the packets, and I can use another computer be a sniffer to sniff the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently I tried two experiments:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I tried to use Scapy to send the 802.11 probe response in managed mode.&#xA;However, from the sniffer I cannot see the packets on the air.&lt;/li&gt;&#xA;&lt;li&gt;If instead I send with the 802.11 QoS packet, then the sniffer&#xA;shows the packets.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What's the difference between these two cases? Is this because I don't use in monitor mode so I cannot send the probe response?  &lt;/p&gt;&#xA;" OwnerUserId="18903" LastEditorUserId="8499" LastEditDate="2015-11-12T14:36:47.677" LastActivityDate="2017-09-22T02:46:32.690" Title="Packet injection in a Wi-Fi network" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24349" PostTypeId="1" CreationDate="2015-11-12T12:59:05.667" Score="2" ViewCount="981" Body="&lt;p&gt;what is the best way to migrate from Cisco ASA 5520 &quot;ASA version 8.2(1)&quot; firewall to &lt;strong&gt;5525x&lt;/strong&gt;, iv'e tried to copy the running-config through the CLI and it went horribly &quot; because of the deference in the NAT config and the VPN crypto maps. please advise. regards &lt;/p&gt;&#xA;" OwnerUserId="20631" LastActivityDate="2015-11-12T17:37:05.160" Title="Migrating from ASA 5520 to 5525x" Tags="|cisco-asa|firewall|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24350" PostTypeId="1" AcceptedAnswerId="24413" CreationDate="2015-11-12T13:32:24.267" Score="4" ViewCount="730" Body="&lt;p&gt;if IPv4 is 32 bits and IPv6 is 128 bits wide, why TCAM is configured to be 36, 72, or 144 bits wide? why don't configure it as 32, 64, and 128 bits?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if there is link for reading material would be better. &lt;/p&gt;&#xA;" OwnerUserId="20634" LastActivityDate="2015-12-01T10:33:12.340" Title="TCAM entry width" Tags="|ipv4|ipv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24352" PostTypeId="1" AcceptedAnswerId="36981" CreationDate="2015-11-12T14:07:45.507" Score="3" ViewCount="1088" Body="&lt;p&gt;I'm using an EdgeMAX router. From the GUI, I'm trying to forward the WAN (eth1) port 22 to the LAN (eth2) port 22 to a local IP address (172.16.12.3) to allow SSH from outside my network. When I tried to SSH I get a &lt;code&gt;time out&lt;/code&gt; error. I tried to troubleshoot in all imaginable ways: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I've checked my firewall for rules that might drop that connection&#xA;attempt.&lt;/li&gt;&#xA;&lt;li&gt;I tried to port forward to two others local IP addresses successfully from WAN 2222 to LAN 22, and I managed to connect through SSH on those two machines.&lt;/li&gt;&#xA;&lt;li&gt;I've tried to change the SSH port on the target machine (172.16.12.3).&lt;/li&gt;&#xA;&lt;li&gt;I've disabled the firewall on the local target machine (172.16.12.3).&lt;/li&gt;&#xA;&lt;li&gt;Since the 2222 port worked for the two other machines (item 2), I also tried to port forward from that port to a different port (22,2222) on the target machine (172.16.12.3)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Of course the target machine is reachable from inside the LAN. I don't have any more ideas about what could be wrong! any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="17044" LastEditorUserId="8499" LastEditDate="2015-11-12T14:47:26.227" LastActivityDate="2016-12-01T08:28:28.563" Title="Port forwarding doesn't work" Tags="|router|internet|lan|ssh|network-access|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="24354" PostTypeId="1" AcceptedAnswerId="24356" CreationDate="2015-11-12T16:45:19.043" Score="1" ViewCount="96" Body="&lt;p&gt;I have L3 switch connected to &lt;code&gt;ISP1&lt;/code&gt;, and recently i got new link from &lt;code&gt;ISP2&lt;/code&gt; for few special host going to use that new route. How i am going to tell switch two send traffic for special host to new &lt;code&gt;ISP2&lt;/code&gt; network and rest &lt;code&gt;ISP1&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the best configuration to handle this kind of scenarios?&lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2015-11-12T16:57:14.827" Title="Cisco L3 switch two default routes config" Tags="|cisco|routing|switch|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24356" PostTypeId="2" ParentId="24354" CreationDate="2015-11-12T16:57:14.827" Score="2" Body="&lt;p&gt;Had you read about route policies?? That is a kind of configuration to avoid the routing table, and is applied on the in-interfaces, on the way to match the source address of the packet, and do what you want, in this case, sended to an specific &quot;next-hop&quot;. &lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-11-12T16:57:14.827" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24357" PostTypeId="1" CreationDate="2015-11-12T17:22:23.760" Score="4" ViewCount="2781" Body="&lt;p&gt;A LAG group on the X1018P managed switch is real easy but switch port configuration is not available on the TZ 500.  Is there a way to set it up for 2 ports like x0 and x2 on the firewall and e15 and e16 on the switch?  How would I configure the firewall ports?  Is this a PortShield Group????&lt;/p&gt;&#xA;" OwnerUserId="20640" LastActivityDate="2017-05-29T04:17:12.187" Title="How do I set up a Link Aggregation for 2 ports between a Sonicwall TZ500 and a Dell XP1018P" Tags="|routing|switching|sonicwall|dell|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24358" PostTypeId="2" ParentId="24349" CreationDate="2015-11-12T17:37:05.160" Score="2" Body="&lt;p&gt;Cisco has a guide for migrating your ASA configuration file: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/upgrading/migrating.html&quot; rel=&quot;nofollow&quot;&gt;Cisco ASA 5500 Migration to Version 8.3&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also online migration tools which you can find with a quick Google search. I haven't used any so I have no opinion of thm.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-12T17:37:05.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24359" PostTypeId="1" AcceptedAnswerId="24362" CreationDate="2015-11-12T18:06:25.187" Score="1" ViewCount="181" Body="&lt;p&gt;I am migrating from SNMP community1 to SNMP community2 on a NEXUS switch (plus a bunch of 2960s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to monitor that the old community is not used anymore?&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-12T18:51:46.973" Title="Monitor which SNMP communities are still in use" Tags="|cisco|cisco-ios|snmp|cisco-nexus|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24360" PostTypeId="1" CreationDate="2015-11-12T18:34:12.693" Score="3" ViewCount="1910" Body="&lt;p&gt;I have been reading about the OSI model and understand all the other layers but this layer seems to have many websites describing it differently&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are the sessions to keep track on connections, such as computer connecting to stream 1,stream 2 and stream 3. These would all have different sessions and be identified by their port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or are the sessions for the services being connected to such as session ids for websites.&lt;/p&gt;&#xA;" OwnerUserId="20645" LastActivityDate="2015-11-13T08:25:10.913" Title="what is the OSI session layer (5) used for?" Tags="|osi|" AnswerCount="3" CommentCount="0" ClosedDate="2017-08-12T21:35:34.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="24361" PostTypeId="1" AcceptedAnswerId="24365" CreationDate="2015-11-12T18:34:26.730" Score="2" ViewCount="1626" Body="&lt;p&gt;I have my network configured this way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP router giving internet access (192.168.&lt;strong&gt;1&lt;/strong&gt;.1/24) through wifi (SSID wlan01).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connected to this wifi I have a Nanostation2 (192.168.&lt;strong&gt;0&lt;/strong&gt;.20/24) in bridge mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally I have a neutral router connected to the Nanostation2 in the WAN port.&#xA;The WAN port is configured as DHCP auto (so the ISP router gives the neutral router a 192.168.&lt;strong&gt;1&lt;/strong&gt;.X/24 address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This neutral router has a subnet (192.168.&lt;strong&gt;10&lt;/strong&gt;.0/24), it's configured as a DHCP server (192.168.&lt;strong&gt;10&lt;/strong&gt;.1/24) and provides another wifi connection (SSID wlan02).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to connect with the Nanostation2 (192.168.&lt;strong&gt;0&lt;/strong&gt;.20) while I am connected to the wlan02 SSID, which gives me an 192.168.&lt;strong&gt;10&lt;/strong&gt;.X IP address to my computer's wireless interface...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible through a static routing entry or with another method?&lt;/p&gt;&#xA;" OwnerUserId="20642" LastActivityDate="2015-11-12T18:49:35.157" Title="Reach to LAN device from a different subnet" Tags="|router|subnet|bridge|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24362" PostTypeId="2" ParentId="24359" CreationDate="2015-11-12T18:35:35.397" Score="1" Body="&lt;p&gt;The thing that you need to do is to erase the old community, i know that sound like you haven´t doit before, but if you do that, and only configure the new one, and on your management or monitoring software, place the new one to, you will be sure that only the community2 is in use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are using cisco, i guess you can debug your snmp proccess:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;your_router#debug snmp packet&#xA;your_router#debug snmp request&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With snmp request, i think, you can have the community name what you are looking for. With snmp packet, you will get the source ip.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2015-11-12T18:51:46.973" LastActivityDate="2015-11-12T18:51:46.973" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24364" PostTypeId="2" ParentId="24360" CreationDate="2015-11-12T18:45:58.707" Score="1" Body="&lt;p&gt;First one. TCP is providing a session. It can be considered as a layer 4/5 protocol in the OSI model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The confusion is coming from the fact that in the IP model, there is no direct translation to the OSI model above layer 4.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-12T18:45:58.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24365" PostTypeId="2" ParentId="24361" CreationDate="2015-11-12T18:49:35.157" Score="0" Body="&lt;p&gt;I'm confused about where the &lt;code&gt;192.168.0.0/24&lt;/code&gt; network is defined. If the Nanostation is in bridge mode it should have an IP address on the network &lt;code&gt;192.168.1.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your &quot;neutral router&quot; will have a default route to the ISP, and it will send anything from its LAN port to the default route. It doesn't know where the &lt;code&gt;192.168.0.0/24&lt;/code&gt; network is. Conversely, the Nanostation should have a route to the &lt;code&gt;192.168.10.0/24&lt;/code&gt; network is unless the &quot;neutral router&quot; is running NAT (giving you double-NAT which is probably not a good idea).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do this with static routes, which doesn't scale, or a routing protocol between routers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-12T18:49:35.157" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24369" PostTypeId="2" ParentId="24360" CreationDate="2015-11-12T19:23:34.710" Score="1" Body="&lt;p&gt;You are correct in saying that the Session Layer provides connection management. An example to help explain would be a protocol that resides at the Session layer. NetBIOS is a session layer protocol. NetBIOS provides the framework that allows applications on a computer to use the network stack from a local perspective (LAN). The most common use in Windows is for file and printer sharing. I would highly recommend researching NetBIOS to understand the use of the Session Layer.&lt;/p&gt;&#xA;" OwnerUserId="20619" LastActivityDate="2015-11-12T19:23:34.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24373" PostTypeId="1" AcceptedAnswerId="24374" CreationDate="2015-11-12T21:44:52.913" Score="3" ViewCount="2076" Body="&lt;p&gt;The &lt;code&gt;show interface switchport&lt;/code&gt; command shows a specific row &lt;code&gt;Pruning VLANs Enabled&lt;/code&gt;. The field description is &lt;code&gt;Lists the VLANs that are pruning-eligible&lt;/code&gt; but I cannot understand what that row is meaning.&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="8499" LastEditDate="2018-12-12T03:08:20.877" LastActivityDate="2018-12-12T03:08:20.877" Title="About &quot;show interface switchport&quot; output" Tags="|cisco|switch|vlan|cisco-commands|vtp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24374" PostTypeId="2" ParentId="24373" CreationDate="2015-11-12T21:59:34.753" Score="3" Body="&lt;p&gt;With VTP, you can mark VLANs as eligible to be pruned for a trunk link. When pruning is enabled in VTP, the eligible VLANs will be pruned if there is nothing downstream of the trunk link using those VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/nx-os/layer2/configuration/guide/b_Cisco_Nexus_7000_Series_NX-OS_Layer_2_Switching_Configuration_Guide/b_Cisco_Nexus_7000_Series_NX-OS_Layer_2_Switching_Configuration_Guide_chapter_0101.html#concept_E644838A406843419A14A8FB2791D1E1&quot; rel=&quot;nofollow&quot;&gt;This Cisco document&lt;/a&gt; shows how to configure VTP pruning and how to add VLANs to the pruning eligible list.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config-if)# switchport trunk pruning vlan [add | remove | except | none | all] VLAN-IDs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is a good practice to prune VLANs from links where they are not needed. This will eliminate broadcast traffic for those VLANs being sent to switches which don't have those VLANs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-12T22:17:38.790" LastActivityDate="2015-11-12T22:17:38.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24375" PostTypeId="2" ParentId="24357" CreationDate="2015-11-12T22:19:49.533" Score="4" Body="&lt;p&gt;You can't do it on Sonicwall device. TZ series doesn't support link aggregation. Check this doc &lt;a href=&quot;http://documents.software.dell.com/sonicos/6.2.3.1/release-notes/document-download?ParentProduct=847&quot; rel=&quot;nofollow&quot;&gt;http://documents.software.dell.com/sonicos/6.2.3.1/release-notes/document-download?ParentProduct=847&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2015-11-12T22:19:49.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24376" PostTypeId="1" AcceptedAnswerId="24377" CreationDate="2015-11-13T02:08:22.047" Score="5" ViewCount="372" Body="&lt;p&gt;I read all the posts on this site on IXP's and my question remains. Any clarity that anyone can bring to this topic would be much appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have trying to get a better mental big-picture of how the internet works I stumbled across the Wikipedia article about Tier 1 networks that really helped build my picture. This lead to Wikipedia'ing about interconnect agreements and especially internet exchange points which helped to greatly clarify the mechanisms of the internet. I found www.internetexchangemap.com which helped with a physical picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was then curious which tier 1 networks participate in my local IX, the &lt;a href=&quot;http://www.mkeix.net/participants/&quot;&gt;Milwaukee Internet Exchange&lt;/a&gt;, but to my surprise I did not recognize any of the networks listed - no Verizon, AT&amp;amp;T, Sprint, Time Warner, although Verizon, AT&amp;amp;T, and Sprint are listed as Tier 1 Networks on Wikipedia. I also checked the &lt;a href=&quot;https://chi.ams-ix.net/connected_parties&quot;&gt;Chicago Exchange Point&lt;/a&gt; and found the same. I looked up most of the companies that are listed; some were very small ISP’s. But if it is not these major ISP's (Verizon, AT&amp;amp;T, Sprint, Time Warner) that converge at Internet Exchange Points, then I feel there may still be a little infrastructure involved that I do not understand, like a hand off between these major ISP's and some more obscure major networks that don't deal with consumers. If not at these major IXP’s, then how does an AT&amp;amp;T end user request make it to a web server on a Verizon network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A related question: I'm also wondering what the Milwaukee Internet Exchange means in their FAQ when they discuss how you can go there and &quot;connect&quot; (www.mkeix.net/faq/).&lt;/p&gt;&#xA;" OwnerUserId="20381" LastActivityDate="2016-08-26T00:43:29.763" Title="Missing major ISP's from local major IXP's?" Tags="|routing|internet|isp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24377" PostTypeId="2" ParentId="24376" CreationDate="2015-11-13T02:49:19.443" Score="4" Body="&lt;p&gt;To start, the reference you are using is incomplete. &lt;a href=&quot;http://www.datacentermap.com/ixps.html&quot;&gt;Here&lt;/a&gt; is another one, that is also incomplete (lists none in Milwaukee and only one in the Chicago area). Both are missing one of the &lt;a href=&quot;https://www.peeringdb.com/private/exchange_view.php?id=2&quot;&gt;largest IXPs&lt;/a&gt; in Chicago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But more importantly, these are only the points where one network will peer with another network. This doesn't account for the breadth or scope of a single provider's network. For example, clearly AT&amp;amp;T has a presence in your area, but they may choose not to peer with anyone there. They may peer in Chicago and carry all the traffic across their network to that point (or one somewhere else).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, private organizations are not required to disclose their presence at any location. They may choose not to do so for any number of reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, most lists do not account for networks that may have been absorbed by a larger network but are still listed under an older name. One example you will often still see listed in places is &lt;a href=&quot;https://en.wikipedia.org/wiki/UUNET&quot;&gt;UUNET&lt;/a&gt; although this network is now part of Verizon (which you can also find listed in places as MCI or MCI Worldcom as well).&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-11-13T02:49:19.443" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24378" PostTypeId="1" AcceptedAnswerId="24379" CreationDate="2015-11-13T03:33:11.807" Score="2" ViewCount="1402" Body="&lt;p&gt;I'm new to network engineering. Currently I'm studying a few routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I'm studying RIP. There is a small thing that is bothering me. I wasn't sure if RIP &lt;strong&gt;sends all&lt;/strong&gt; its routing table to its neighbors or just &lt;strong&gt;sends downed route&lt;/strong&gt; with metric of 16. &lt;/p&gt;&#xA;" OwnerUserId="20657" LastEditorUserId="8499" LastEditDate="2015-11-13T03:59:52.507" LastActivityDate="2015-11-13T04:07:17.580" Title="Does RIP send the whole routing table in a Triggered Update?" Tags="|routing|rip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24379" PostTypeId="2" ParentId="24378" CreationDate="2015-11-13T03:58:23.847" Score="2" Body="&lt;p&gt;When in doubt, you should check the RFC (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2453#section-3.10.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2453, RIP Version 2, Section 3.10.1, Triggered Updates&lt;/a&gt;):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;3.10.1 Triggered Updates&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Triggered updates require special handling for two reasons.  First,&#xA;experience shows that triggered updates can cause excessive load on&#xA;networks with limited capacity or networks with many routers on them.&#xA;Therefore, the protocol requires that implementors include provisions&#xA;to limit the frequency of triggered updates.  After a triggered update&#xA;is sent, a timer should be set for a random interval between 1 and 5&#xA;seconds.  If other changes that would trigger updates occur before the&#xA;timer expires, a single update is triggered when the timer expires.&#xA;The timer is then reset to another random value between 1 and 5&#xA;seconds.  A triggered update should be suppressed if a regular update&#xA;is due by the time the triggered update would be sent.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Second, triggered updates do not need to include the entire routing table.&lt;/strong&gt;&lt;/em&gt;  In principle, only those routes which have changed need to&#xA;be included. Therefore, messages generated as part of a triggered&#xA;update must include at least those routes that have their route change&#xA;flag set.  They may include additional routes, at the discretion of&#xA;the implementor; however, &lt;em&gt;&lt;strong&gt;sending complete routing updates is strongly&#xA;discouraged&lt;/strong&gt;&lt;/em&gt;.  When a triggered update is processed, messages should be&#xA;generated for every directly-connected network.  Split Horizon&#xA;processing is done when generating triggered updates as well as normal&#xA;updates (see section 3.9).  If, after Split Horizon processing for a&#xA;given network, a changed route will appear unchanged on that network&#xA;(e.g., it appears with an infinite metric), the route need not be&#xA;sent.  If no routes need be sent on that network, the update may be&#xA;omitted.  Once all of the triggered updates have been generated, the&#xA;route change flags should be cleared.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-11-13T04:07:17.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24381" PostTypeId="2" ParentId="24087" CreationDate="2015-11-13T05:27:43.960" Score="0" Body="&lt;p&gt;OK, so think of DNS as an upside-down tree, a directory structure if you will. &#xA;Working backward, from the end of the FQDN... At the end of every Fully-Qualified Domain Name (FQDN) is an implied (or literal) &quot;dot&quot;.  This ending &quot;dot&quot; is root.&#xA;Next is either a Top-Level Domain (TLD) or a Country Code-Level Domain (CCLD).&#xA;So if we take an example, host.mydomain.com is really &quot;host.mydomain.com**.**&quot; where:&#xA;.= root,&#xA;.com = TLD,&#xA;.mydomain = domain level,&#xA;host = name of host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without going into the details and semantics of DNS queries (like authoritative or non-authoritative, or recursive vs. non-recursive), when your device queries for this host (or subdomain or domain), it first asks &quot;root&quot; where to find &quot;com&quot;, then asks &quot;com&quot; where to find &quot;mydomain&quot;, and then asks &quot;mydomain&quot; where to find &quot;host&quot;.&#xA;Best Practice is to never use &quot;dots&quot; in hostnames.  Some don't follow best practice.  With your list above, if they use dotted hostnames, everything past that 2nd-level domain is thrown out with the bathwater.&#xA;Presuming that they've followed Best Practice and the &quot;dots&quot; truly do indicate a domain hierarchy, then you can infer the following tree (not great art):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/9HZ1v.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9HZ1v.png&quot; alt=&quot;domaincells&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that DNS is a Name Service and has no bearing what-so-ever on the layout of the actual physical network. If I am the NameServer that &quot;owns&quot; (is authoritative for) the &quot;sub00.sub0.mydomain.com&quot; domain, then I will have the authoritative answer for the host called &quot;sub000&quot;.  Ask me, and I will tell you its IP.  That IP (or any name that I am authoritative for) can be in NE, GA, Singapore, or anywhere else in the world. Now while its true that I can be authoritative for a name that is anywhere in the world, I am likely responsible for hostnames/IPs that are near me, either in proximity or by some other relationship (like within the same company or division in a company). &lt;/p&gt;&#xA;" OwnerUserId="20662" LastActivityDate="2015-11-13T05:27:43.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24384" PostTypeId="1" AcceptedAnswerId="24385" CreationDate="2015-11-13T06:43:38.200" Score="-2" ViewCount="438" Body="&lt;p&gt;I have a terrible issue on Alteon 4408.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to recover password (I forgot my password.), I tried to search on the internet.&#xA;However, I didn't find great solution.&#xA;Finally, I entered strange environment like &quot;cmd&quot;.&#xA;At that point, I figured out that it was a solution to recover password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe I should have tried it.. because I &quot;clear nvram&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, Alteon 4408 required me to type the &lt;strong&gt;license key&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm so confused..&#xA;I don't have a license key;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do to deal with it.&#xA;Please help me.&#xA;Thank you for reading.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing that switch required was below one.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Invalid license key&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please enter a license key (e.g. appdirector-GxtlqMwA) for device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MAC address: xxxxxx&#xA;License ID : xxd-xxx-xxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In case of problems please contact Radware's support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;License key:&lt;/p&gt;&#xA;" OwnerUserId="20562" LastActivityDate="2015-11-13T06:52:47.847" Title="Alteon 4408 issue (License Key)" Tags="|switch|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24385" PostTypeId="2" ParentId="24384" CreationDate="2015-11-13T06:52:47.847" Score="0" Body="&lt;p&gt;Do what it says! CONTACT RADWARE SUPPORT. They're the only ones who can (re)generate your license key(s). If you erased it from persistent storage (internal drive, flash, whatever), and don't have it recorded somewhere, it's gone. We've had that problem enough times to keep our keys recorded elsewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(If you're a Radware customer with an active support contract, you should be able to get your keys from the support portal. Or so I'm told.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-11-13T06:52:47.847" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24386" PostTypeId="1" AcceptedAnswerId="24400" CreationDate="2015-11-13T07:29:38.990" Score="1" ViewCount="455" Body="&lt;p&gt;I understand the concept of virtual link, which it will connect to backbone area to form a star topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, there is ABR A connects Area 0.0.0.1 and Area 0.0.0.0, and ABR B connects Area 0.0.0.1 and Area 0.0.0.2. Then there should be a virtual link between ABR A and ABR B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I wonder how it actually works in router. Does ABR B generates summary-LSA of Area 0.0.0.2 and send to ABR A directly? So ABR A will distribute the LSA into Area 0.0.0.0. What if there is a router on virtual link? Will it receive the LSA which ABR B generates or just treat it as a datagram and send to ABR A? And, does ABR B have LSAs from Area 0.0.0.0?&lt;/p&gt;&#xA;" OwnerUserId="20657" LastActivityDate="2015-11-13T15:18:13.897" Title="Virtual Link in OSPF" Tags="|routing|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24388" PostTypeId="1" AcceptedAnswerId="24409" CreationDate="2015-11-13T08:11:40.483" Score="3" ViewCount="1393" Body="&lt;p&gt;I have two network segments connected to a single Cisco router by Cisco switches. I've enabled multicast routing on the router by running following commands:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;ip multicast-routing&lt;/code&gt; in configuration mode&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ip pim dense-mode&lt;/code&gt; on each interface&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And set following route on the hosts for multicast traffic:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;code&gt;route add -net 224.0.0.0 netmask 240.0.0.0 dev eth2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;According to my searches the multicast traffic should cross the networks without setting &lt;code&gt;route&lt;/code&gt; for their network (&lt;code&gt;128.238.61.0&lt;/code&gt; and &lt;code&gt;128.238.62.0&lt;/code&gt; here),  but is not the case. I tried following solutions, but neither worked:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Using &lt;code&gt;sparse-mode&lt;/code&gt; and &lt;code&gt;dense-sparse-mode&lt;/code&gt; for interfaces&lt;/li&gt;&#xA;&lt;li&gt;Enabling and disabling &lt;code&gt;Reverse path filtering&lt;/code&gt; from &lt;code&gt;/proc/sys/net/ipv4/conf/[all,defalut,eth2]/rp_filter&lt;/code&gt; by writing &lt;code&gt;0&lt;/code&gt; and &lt;code&gt;2&lt;/code&gt; in it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I use &lt;code&gt;netspy&lt;/code&gt; to create multicast traffic and groups (&lt;code&gt;224.111.111.111&lt;/code&gt;) and I've verified that the corresponding address is in the multicast groups of router interfaces. Also hosts inside a single network segment can see the multicast traffic properly. As I think the traffic should cross the networks without setting &lt;code&gt;route&lt;/code&gt;, what misconfigurations may cause this problem. Thank you in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is one router with interface IPs: &lt;code&gt;128.238.61.1/24&lt;/code&gt; and &lt;code&gt;128.238.62.1/24&lt;/code&gt;. To each port of the router a switch is connected. To each switch three hosts are connected. I connect to router by telnet and then type &lt;code&gt;config term&lt;/code&gt;. Then I type &lt;code&gt;ip multicast-routing&lt;/code&gt;. I go to interfaces with command &lt;code&gt;int fa 0/0 (0/1)&lt;/code&gt; and type &lt;code&gt;ip pim dense-mode&lt;/code&gt;. Then on the host with ip &lt;code&gt;128.238.61.109/24&lt;/code&gt; I start &lt;code&gt;netspy&lt;/code&gt; by typing &lt;code&gt;netspyd 224.111.111.111 1500 6&lt;/code&gt; (parameters are group ip, port and ttl). Now on all other hosts I type &lt;code&gt;netspy 224.111.111.111 1500&lt;/code&gt;. Now if I &lt;code&gt;telnet&lt;/code&gt; from one of the hosts on the same side as the &lt;code&gt;netspyd&lt;/code&gt; to it (&lt;code&gt;109&lt;/code&gt;) nothing happens. If I set on all hosts route &lt;code&gt;route add -net 224.0.0.0 netmask 240.0.0.0 dev eth2&lt;/code&gt; and then do the &lt;code&gt;telnet&lt;/code&gt; hosts on the same side of as the &lt;code&gt;netspyd&lt;/code&gt; server (network &lt;code&gt;61.0&lt;/code&gt;) get the message about the log on but others don't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best,&lt;/p&gt;&#xA;" OwnerUserId="20666" LastEditorUserId="8499" LastEditDate="2018-03-19T19:44:44.493" LastActivityDate="2018-03-19T19:44:44.493" Title="multicast not working in two segment network" Tags="|routing|multicast|pim|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="24389" PostTypeId="2" ParentId="24360" CreationDate="2015-11-13T08:25:10.913" Score="2" Body="&lt;p&gt;First, let's have a look at the ISO/OSI stack vs the TCP/IP stack:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tphZV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tphZV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISO/OSI layer 5 is not much &quot;used&quot; alone: it is implemented together with layers 6 and 7 to the TCP/IP Application layer, where network applications such as HTTP, NTP, IMAP etc. take place.  In practice, its functions are mixed with the upper layers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The session layer controls the dialogues (connections) between computers. It establishes, manages and terminates the connections between the local and remote application. It provides for full-duplex, half-duplex, or simplex operation, and establishes checkpointing, adjournment, termination, and restart procedures. The OSI model made this layer responsible for graceful close of sessions, which is a property of the Transmission Control Protocol, and also for session checkpointing and recovery, which is not usually used in the Internet Protocol Suite. The session layer is commonly implemented explicitly in application environments that use remote procedure calls.     &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2015-11-13T08:25:10.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24394" PostTypeId="1" CreationDate="2015-11-13T11:53:46.873" Score="2" ViewCount="1252" Body="&lt;p&gt;One of my colleague kept saying 'hopefully we do not encounter firmware issue' in a project when referring to our Cisco 9000 XR series route processor. I did not bother to ask him because he seemed confident when saying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as far as I know, the IOS XR is the operating system in the route processor. Or am I mistaken?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-11-13T15:54:10.633" Title="Cisco IOS XR: Firmware vs operating system" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24397" PostTypeId="5" CreationDate="2015-11-13T13:21:30.197" Score="0" Body="&lt;p&gt;A tag for discussion of &quot;&lt;strong&gt;mobile&lt;/strong&gt;&quot;, topics on how the mobile devices proceed to access mobile services provided by mobile operators, having a mobile network or providing mobile applications.&lt;/p&gt;&#xA;" OwnerUserId="15145" LastEditorUserId="15145" LastEditDate="2015-11-17T14:14:53.143" LastActivityDate="2015-11-17T14:14:53.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24398" PostTypeId="4" CreationDate="2015-11-13T13:21:30.197" Score="0" Body="A tag for discussion of &quot;mobile&quot;, topics on how the mobile devices proceed to access mobile services" OwnerUserId="15145" LastEditorUserId="15145" LastEditDate="2015-12-09T15:07:41.830" LastActivityDate="2015-12-09T15:07:41.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24399" PostTypeId="2" ParentId="22554" CreationDate="2015-11-13T15:11:05.010" Score="0" Body="&lt;p&gt;I found a command reference that mentioned the following, but it didn't work on the TZ appliance I had to test on.  It may be NSA only?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;admin-password old-password &amp;lt;WORD&amp;gt; new-password &amp;lt;WORD&amp;gt; confirm-password &amp;lt;WORD&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="3624" LastActivityDate="2015-11-13T15:11:05.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24400" PostTypeId="2" ParentId="24386" CreationDate="2015-11-13T15:18:13.897" Score="1" Body="&lt;p&gt;You can think of the virtual link as an OSPF tunnel. ABR B acts like it is an Area 0 border router, and the LSAs it sends to ABR A are the same as any Area 0 border sends into Area 0. ABR B will also receive from ABR A any LSAs that any Area 0 router receives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any routers in Area 1 will only pass along IP packets from ABR B to ABR A, they will not directly use the LSAs since those routers are not the destination of the IP packets carrying the LSAs. LSA are carried in IP packets which are like any other IP packets and have source and destination IP addresses. The routers routing IP packets do not look in the IP packets unless the packets' destination IP address is an IP address on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a full explanation of OSPF, including virtual links, in &lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 2328, OSPF Version 2&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-13T15:18:13.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24401" PostTypeId="1" AcceptedAnswerId="24405" CreationDate="2015-11-13T15:38:56.917" Score="4" ViewCount="2305" Body="&lt;p&gt;I know that Autonomous Systems (ASes) used to be identified with a 16 bit number. It wasn't enough, so 32-bit ASNs were introduced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The BGP routing table of BGP border router contains the IP address of the destination network and a series of numbers of ASes the packet will go through, starting from that router, in order to reach destination network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the BGP router R1 doesn't support 32-bit AS numbers, it will be represented as 23456 in the AS Path. Okay, but what if R1 is connected to multiple 32-bit ASes? If both are represented by the same number, 23456, how does it differentiate between them? It can't know where to send the packet because two distinct ASes have the same number in its routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think there's a new attribute, AS4_Path, ignored by 16-bit ASN-compatible BGP routers, that 32-bit routers take into account (&lt;a href=&quot;http://www.menog.org/presentations/menog-2/philip-smith-32bit-asn.pdf&quot; rel=&quot;nofollow&quot;&gt;brief explanation&lt;/a&gt;). But it doesn't explain how 16-bit ASN-compatible routers know the right way.&lt;/p&gt;&#xA;" OwnerUserId="20505" LastEditorUserId="20505" LastEditDate="2015-11-13T16:08:17.187" LastActivityDate="2015-11-13T16:22:01.963" Title="16 and 32-bit ASN compatibility of BGP routers" Tags="|routing|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24402" PostTypeId="2" ParentId="24394" CreationDate="2015-11-13T15:54:10.633" Score="1" Body="&lt;p&gt;By using the term &quot;firmware,&quot; your colleague is probably referring to the OS version. Cisco has multiple OS versions, and some are more problematic than others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firmware originally meant something else, but the term has come to mean the code running an appliance like a router or switch. It's not really correct since it is like referring to Windows as the firmware on a PC (the BIOS on a PC could be called firmware). It certainly shouldn't be used when referring to the configuration of the device.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-13T15:54:10.633" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24404" PostTypeId="1" AcceptedAnswerId="24406" CreationDate="2015-11-13T16:14:02.890" Score="23" ViewCount="85436" Body="&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/a/3483/16906&quot;&gt;This answer&lt;/a&gt; says vlans 0 and 4095 are reserved. &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1Q#Frame_format&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia agrees that vlans 0 and 4095&lt;/a&gt; are reserved. &lt;a href=&quot;http://www.microhowto.info/howto/configure_an_ethernet_interface_as_a_vlan_trunk_on_redhat.html&quot; rel=&quot;noreferrer&quot;&gt;This article&lt;/a&gt; says that Cisco reserves vlan 1 (in addition to vlans 0 and 4095).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But I am having trouble finding good information on what are these vlans reserved for? and/or why they are reserved?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please include good authoritative sources please or references to the spec.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;If I want to transmit/receive, is it a good rule of thumb to just not use vlans 0,1,4095?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="16906" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-05-30T04:00:38.033" Title="vlan 0, 1, and 4095 are reserved: what are they reserved for?" Tags="|vlan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24405" PostTypeId="2" ParentId="24401" CreationDate="2015-11-13T16:22:01.963" Score="3" Body="&lt;p&gt;The number of hops is preserved, even if all the hops in the AS_PATH are all AS23456. Path prepending with the same AS number prepended is used to influence traffic all the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP will still send the traffic toward the neighbor with preferred route based on how it was configured, and, normally, the number of AS hops will determine the direction to send the traffic. It doesn't matter that every hop is the same AS number, what matters is the number of hops.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-13T16:22:01.963" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24406" PostTypeId="2" ParentId="24404" CreationDate="2015-11-13T16:29:38.927" Score="21" Body="&lt;p&gt;The &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1Q#Frame_format&quot;&gt;Wikipedia article you mention&lt;/a&gt; gives a succinct explanation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;VLAN identifier (VID): a 12-bit field specifying the VLAN to which the&#xA;  frame belongs. The hexadecimal values of 0x000 and 0xFFF are reserved.&#xA;  All other values may be used as VLAN identifiers, allowing up to 4,094&#xA;  VLANs. The reserved value 0x000 indicates that the frame does not&#xA;  carry a VLAN ID; in this case, the 802.1Q tag specifies only a&#xA;  priority and is referred to as a priority tag. On bridges, VID 0x001&#xA;  (the default VLAN ID) is often reserved for a management VLAN; this is&#xA;  vendor-specific. The VID value 0xFFF is reserved for implementation&#xA;  use; it must not be configured or transmitted. 0xFFF can be used to&#xA;  indicate a wildcard match in management operations or filtering&#xA;  database entries.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you can see, there isn't really a usable VLAN 0 or 4095.  Cisco uses VLAN 1 as a default VLAN, and management protocols (STP, CDP, DTP, etc) are sent on VLAN 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use VLAN 1 for simple installations where there is no VLAN trunking, but good practice is to not put user data on VLAN 1 in a multi-VLAN environment.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-13T16:29:38.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24407" PostTypeId="1" CreationDate="2015-11-13T16:33:17.830" Score="1" ViewCount="145" Body="&lt;p&gt;I am dealing with a problem with Netscreen VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology is basically&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Server Side ーー＞ (Agg2)Trust/Untrust(Agg1)ーー＞ ーー＞ Remote Office (Yamaha)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;100.66.xx.0/24 ーー＞ Netscreen VPN ーー＞ Internet ーー＞ 100.71.YY.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Proxy id is the same with source and destination range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tunnel is in Untrust zone and unnumbered to aggregate1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPN is connected successfully and I can ping from our server side L3 switches to other side servers (I cannot try data transmission, because servers are not built yet.). But because of the monitoring VPN is giving UP/DOWN alert in every 100 seconds. so I tried to create a loopback with 100.66.xx.253/32 and tried to use it as source for monitoring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;set vpn monitor source-interface loopback.1 destination-ip 100.71.YY.253 optimized rekey&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it is failing. I tried to ping from loopback.1 to other side of the VPN, but I couldn't. There is no routing missmatch. Tunnel and loopback are in both Untrust zone. loopback address is in the same range with proxy-id. Policy is already allowing Proxy-id source range to proxy-id destination range. I couldn't understand the problem at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do we need to do to ping from loopback to VPN destination through tunnel?&lt;/p&gt;&#xA;" OwnerUserId="20675" LastActivityDate="2023-12-21T09:06:25.817" Title="「Netscreen」 VPN UP/DOWN due to loopback address source monitoring" Tags="|vpn|juniper|troubleshooting|monitoring|loopback|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24408" PostTypeId="2" ParentId="24331" CreationDate="2015-11-13T18:33:34.717" Score="3" Body="&lt;p&gt;The destination TCP port tells which &lt;strong&gt;service&lt;/strong&gt; on the host is needed: 80 is usually http, 22 ssh, 25 mail, ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But one &lt;strong&gt;source&lt;/strong&gt; can connect &lt;strong&gt;several times&lt;/strong&gt; to the same service: for instance, I can ssh twice to mybox.example.net. As the destination port would be 22, I need different source ports to distinguish the two connections. Usually source ports are chosen randomly by the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you take the main parameters of a socket in our example: &lt;em&gt;src IP&lt;/em&gt;, &lt;em&gt;dst IP&lt;/em&gt;, &lt;em&gt;protocol&lt;/em&gt;, &lt;em&gt;src Port&lt;/em&gt;, &lt;em&gt;dst Port&lt;/em&gt;, only &lt;em&gt;src Port&lt;/em&gt; change between two ssh connections to the same host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is why we need both a source port number and a destination port number.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-13T18:33:34.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24409" PostTypeId="2" ParentId="24388" CreationDate="2015-11-13T19:33:01.207" Score="1" Body="&lt;p&gt;PIM is a router-to-router protocol. I think what you are missing is IGMP. The clients wanting to receive traffic from a multicast groups will use IGMP to inform the router that they wish to receive the traffic:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mc8RE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mc8RE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your configuration commands, I assume you are using a Cisco router. Cisco has a &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfmulti.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;document&lt;/a&gt; which describes all of this and how to configure multicast routing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-13T19:33:01.207" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24411" PostTypeId="2" ParentId="24331" CreationDate="2015-11-13T21:41:15.433" Score="0" Body="&lt;p&gt;I'll give you an example to explain a little more, if you are using your browser to browse a website, Your PC IP address will be the source IP address and the web server on the other side will be the destination IP, your web browser will put port 80 &quot;http default&quot; as the destination port and will generate a source port number and send it to the web server, the web server will reply to your PC using the same port your pc generated earlier, if source ports weren't exist you wouldn't be able to use multiple applications at the same time.&lt;/p&gt;&#xA;" OwnerUserId="20631" LastActivityDate="2015-11-13T21:41:15.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24412" PostTypeId="2" ParentId="2501" CreationDate="2015-11-13T22:14:05.073" Score="2" Body="&lt;p&gt;For others that come across this, here is my solution. I had the same issue, similar scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$ scp c2900-universalk9-mz.SPA.155-3.M.bin user@10.192.255.22:/&#xA;Password: &#xA;c2900-universalk9-mz.SPA.155-3.M.bin                                                           0%    0     0.0KB/s   --:-- ETA lost connection&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was my fix:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$ scp c2900-universalk9-mz.SPA.155-3.M.bin user@10.192.255.22://c2900-universalk9-mz.SPA.155-3.M.bin&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="20681" LastActivityDate="2015-11-13T22:14:05.073" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24413" PostTypeId="2" ParentId="24350" CreationDate="2015-11-13T22:19:44.607" Score="4" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;TCAM&lt;/em&gt;&lt;/strong&gt; table is designed to make the process of lookup for IPs involved in layer 3 function such &lt;strong&gt;&lt;em&gt;(routing,ACL,QOS,filtering)&lt;/em&gt;&lt;/strong&gt; more easier but return not only 0 in case of match and 1 in case of no match but also X in case of don’t care which mean &lt;strong&gt;&lt;em&gt;(For example, a ternary CAM might have a stored word of &quot;10XX0&quot; which will match any of the four search words &quot;10000&quot;, &quot;10010&quot;, &quot;10100&quot;, or &quot;10110&quot; (XX can be 00,01,10,11).)&lt;/em&gt;&lt;/strong&gt; and also add little bits to the table entry width&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can say a multi layer switch uses sets of TCAMs, each set of TCAMs are used for a certain feature &lt;strong&gt;&lt;em&gt;(Routing, QoS, ACLs ...)&lt;/em&gt;&lt;/strong&gt;, and it does parallel lookups to get all the required results using the VMR combination &lt;strong&gt;&lt;em&gt;(Value, Mask and Result)&lt;/em&gt;&lt;/strong&gt;, these results can be permit and deny in the case of ACLs, values for QoS policies in case of QoS or pointers to a next-hop in the routing table in case of routing &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;NOTE&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;you have conflict when you consider the TCAM entry width is directly related to the length of the IP address cause each entry is consented of 3 parts(Value (134 bit), Mask (134 bit), result (permit,deny)) and those three pars are varying from layer 3 function to another layer 3 function as shown in the next table .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XDJfa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XDJfa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;entry width note depend only on the width of IPs but also on the lookup mechanism used to find specific entry and the compression mechanism used to compress those information in one table entry ,&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;an examble for TCAM entry produced by multi access list entries &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v5L8S.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v5L8S.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also this &lt;a href=&quot;https://supportforums.cisco.com/sites/default/files/legacy/5/5/1/10155-TCAM.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this link&lt;/a&gt; could be useful to understand the TCAM table complete process . and this &lt;a href=&quot;https://books.google.com.eg/books?id=AFeNDyyiNCIC&amp;amp;pg=PA86&amp;amp;lpg=PA86&amp;amp;dq=tcam%20table%20entry%20width&amp;amp;source=bl&amp;amp;ots=USEG91UC3w&amp;amp;sig=1zYsm6AwMoH7XSj_O3msHI1lmtk&amp;amp;hl=en&amp;amp;sa=X&amp;amp;ved=0CDMQ6AEwA2oVChMIqZSZ77yOyQIVy1UaCh3R0A9O#v=onepage&amp;amp;q=tcam%20table%20entry%20width&amp;amp;f=false&quot; rel=&quot;nofollow noreferrer&quot;&gt;google book&lt;/a&gt; speak about the lookup mechanisms used in TCAM table build &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-11-13T22:46:13.640" LastActivityDate="2015-11-13T22:46:13.640" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24414" PostTypeId="1" CreationDate="2015-11-13T23:05:43.220" Score="2" ViewCount="115" Body="&lt;p&gt;I got this from bgpmon.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Detected new prefix:  121.66.128.0/17&#xA;Update time:          2015-11-12 07:18 (UTC)&#xA;Detected by #peers:   16&#xA;Announced by:         AS3786 (LG DACOM Corporation)&#xA;Upstream AS:          AS2914 (NTT America, Inc.)&#xA;ASpath:               18356 38794 45796 23947 38753 45300 7713 2914 3786&#xA;&#xA;Detected new prefix:  121.66.0.0/17&#xA;Update time:          2015-11-12 07:18 (UTC)&#xA;Detected by #peers:   16&#xA;Announced by:         AS3786 (LG DACOM Corporation)&#xA;Upstream AS:          AS2914 (NTT America, Inc.)&#xA;ASpath:               133165 23947 38753 45300 7713 2914 3786&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is the as-path so long here? Several ASNs in the path are just 1-2 hops away from AS3786. And that's what they did in traceroute originated from those ASNs. For example, AS23947 can reach AS3786 via AS3491.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears to me that this is some kind of traffic engineering effort to mitigate attacks (the prefix in question seems to have been null routed at the edge), possibly using BGP community to restrict the announcement to certain (geographical) peers. This particular prefix was never globally visible according to RIPE RIS (121.64.0.0/14 is globally visible).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And how did AS3786 make it happen? imo this is very difficult with BGP if other ASNs aren't cooperating.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="8499" LastEditDate="2019-01-05T00:09:39.967" LastActivityDate="2019-01-05T00:09:39.967" Title="Why is the as-path so long?" Tags="|routing|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24415" PostTypeId="2" ParentId="24414" CreationDate="2015-11-13T23:21:51.927" Score="2" Body="&lt;p&gt;I'm not sure why you would think this is difficult. There are a few ways this could happen. You have no insight into what the administration of another AS is doing. The AS can receive a route from multiple sources (different ASes), and it is up to the administration of that AS which of those routes, if any, to advertise to peer ASes. It can even advertise different routes to different peer ASes. Your AS can only know what other ASes tell it about any routes outside the control of your AS. The other AS could well have a better route which it uses itself when routing traffic, but it doesn't choose to tell your AS about the better route.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-13T23:21:51.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24416" PostTypeId="1" AcceptedAnswerId="24421" CreationDate="2015-11-14T05:03:55.150" Score="2" ViewCount="80" Body="&lt;p&gt;What is the behavior of a port in a private-vlan pimary vlan that isn't set to promiscuous? &lt;/p&gt;&#xA;" OwnerUserId="7534" LastActivityDate="2015-11-15T09:54:44.510" Title="private-vlan pimary vlan port not set to promiscuous?" Tags="|security|private-vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24419" PostTypeId="2" ParentId="24416" CreationDate="2015-11-14T10:42:08.097" Score="1" Body="&lt;p&gt;It is depend on the private vlan type:&lt;br&gt;&#xA;1- if it is community vlan member will be able to communicate with the promiscuous port and other ports in the same community vlan.&lt;br&gt;&#xA;2- if it is isolated vlan member will be able to communicate with promiscuous port only&lt;/p&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="17452" LastEditDate="2015-11-15T09:54:44.510" LastActivityDate="2015-11-15T09:54:44.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24421" PostTypeId="2" ParentId="24416" CreationDate="2015-11-14T14:32:12.167" Score="2" Body="&lt;p&gt;you need to consider the next facts&lt;br&gt;&#xA; 1- A private VLAN domain has &lt;strong&gt;&lt;em&gt;only one primary VLAN&lt;/em&gt;&lt;/strong&gt;. Each port in a private VLAN domain is a &lt;strong&gt;&lt;em&gt;member of the primary VLAN&lt;/em&gt;&lt;/strong&gt;; &lt;strong&gt;&lt;em&gt;the primary VLAN is the entire private VLAN domain&lt;/em&gt;&lt;/strong&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- &lt;strong&gt;&lt;em&gt;Secondary VLANs&lt;/em&gt;&lt;/strong&gt; provide isolation between ports within the same private VLAN domain. The following two types are secondary VLANs within a primary VLAN: &lt;strong&gt;&lt;em&gt;Secondary Isolated VLAN&lt;/em&gt;&lt;/strong&gt; &amp;amp; &lt;strong&gt;&lt;em&gt;Secondary Community VLANs&lt;/em&gt;&lt;/strong&gt; where&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Isolated VLANs&lt;/em&gt;&lt;/strong&gt;—Ports within an isolated VLAN cannot communicate directly with each other at the Layer 2 level.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Community VLANs&lt;/em&gt;&lt;/strong&gt;—Ports within a community VLAN can communicate with each other but cannot communicate with ports in other community VLANs or in any isolated VLANs at the Layer 2 level&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9HseZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9HseZ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3- &lt;strong&gt;&lt;em&gt;A promiscuous port&lt;/em&gt;&lt;/strong&gt; can serve &lt;strong&gt;&lt;em&gt;only one primary VLAN&lt;/em&gt;&lt;/strong&gt;, &lt;strong&gt;&lt;em&gt;one isolated VLAN&lt;/em&gt;&lt;/strong&gt;, and multiple &lt;strong&gt;&lt;em&gt;community VLANs&lt;/em&gt;&lt;/strong&gt;. Layer 3 gateways are typically connected to the switch through a promiscuous port.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;SO other port types (isolated port and community port) are the only available port types if this port is not promiscuous&lt;/em&gt; where &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;An &lt;strong&gt;&lt;em&gt;isolated port&lt;/em&gt;&lt;/strong&gt; is a host port that belongs to an isolated secondary VLAN. This port has complete isolation from other ports within the same private VLAN domain, except that it can communicate with associated promiscuous ports&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Community&lt;/em&gt;&lt;/strong&gt;—A community port is a host port that belongs to a community secondary VLAN.Community ports communicate with other ports in the same community VLAN and with associated promiscuous ports&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-11-14T14:32:12.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24423" PostTypeId="1" AcceptedAnswerId="24597" CreationDate="2015-11-14T15:47:29.860" Score="0" ViewCount="1141" Body="&lt;p&gt;hoping someone can help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am visiting family in Majorca and they have bought some cctv cameras that they would like set up so they can view the cams when back in the UK. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I am running into is trying to route to the router so the cameras are available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Effectively the internet is provided by a wireless provider through a transponder and connected to the router. The WAN ip address given is in the 192.168.1 range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way of getting access to the cameras outside of the 192.168.0 range?&lt;/p&gt;&#xA;" OwnerUserId="20689" LastActivityDate="2015-11-20T12:17:27.823" Title="WAN IP in 192.168 range" Tags="|wan|network-access|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24425" PostTypeId="2" ParentId="23960" CreationDate="2015-11-14T18:05:19.390" Score="1" Body="&lt;p&gt;I'll assume you are using a RB951 series router, which has ether1-5 and wlan1.&#xA;If that's not the case just edit the script to fit the specifications of your router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, do a System &gt; Reset configuration (check No default configuration).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, apply the following config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface bridge&#xA;add name=lan auto-mac=no admin-mac=[/interface get [find where name=ether1] mac-address]&#xA;/interface bridge port&#xA;add bridge=lan interface=ether1&#xA;add bridge=lan interface=ether2&#xA;add bridge=lan interface=ether3&#xA;add bridge=lan interface=ether4&#xA;add bridge=lan interface=ether5&#xA;add bridge=lan interface=wlan1&#xA;/interface wireless&#xA;set wlan1 mode=ap-bridge wireless-protocol=802.11 band=2ghz-b/g/n frequency=auto ssid=&quot;**Your WiFi SSID**&quot; enabled=yes&#xA;/interface wireless security-profiles&#xA;set [find default=yes] authentication-types=wpa-psk,wpa2-psk group-ciphers=tkip,aes-ccm unicast-ciphers=tkip,aes-ccm mode=dynamic-keys wpa-pre-shared-key=&quot;**Your WiFi password**&quot; wpa2-pre-shared-key=&quot;**Your WiFi password**&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To do it, upload it to the router and type &quot;import filename&quot; in a Terminal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will make a bridge between the wireless interface and all the MikroTik ethernet ports, carrying all traffic transparently. Your main router will still act as the gateway and will take care of NAT, firewall and routing.&lt;/p&gt;&#xA;" OwnerUserId="20690" LastActivityDate="2015-11-14T18:05:19.390" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24426" PostTypeId="1" CreationDate="2015-11-14T18:48:46.867" Score="2" ViewCount="1899" Body="&lt;p&gt;Considering TCP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I create a server socket I reserve a TCP port from SO. When a client connects to my server my SO reserves a TCP port different to exchange data. Is there a limit to the number of clients which can connect to my server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering UDP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I start to listen to a port, are all segments which are sent to that port concurrent? Must my application must separate the source package? Is there a limit to the number of clients which can connect to my server?&lt;/p&gt;&#xA;" OwnerUserId="11977" LastEditorUserId="8499" LastEditDate="2015-11-14T18:57:14.163" LastActivityDate="2017-08-16T15:34:49.407" Title="TCP and UDP port reservation difference and limits" Tags="|tcp|udp|" AnswerCount="3" CommentCount="1" ClosedDate="2019-02-12T04:30:01.530" ContentLicense="CC BY-SA 3.0" />
  <row Id="24427" PostTypeId="2" ParentId="24426" CreationDate="2015-11-14T18:53:50.257" Score="0" Body="&lt;p&gt;A server can have as many clients connect to a single port (TCP or UDP) as the server (hardware and software) can handle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A client could have a limit on the number of servers to which it can connect because there are only so many ports available for outbound connections, but it would probably run into hardware/software limitations before it runs into port number limitations.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-14T18:53:50.257" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24429" PostTypeId="1" AcceptedAnswerId="24430" CreationDate="2015-11-14T22:03:50.227" Score="3" ViewCount="2953" Body="&lt;p&gt;Is there any &lt;code&gt;show&lt;/code&gt; command which allows me to determine the number of routers in a specific OSPF area? I can use the &lt;code&gt;show ip ospf database router&lt;/code&gt; command and consider each LSA represent one router, but I need a clear command to do that. Are you aware of any such command?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to find the number of routers inside area 0 from the CLI on any router. The screenshot is showing that, but i want to find that from the router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Owye8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Owye8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any tool that can read a Cisco configuration file? For example, I give the tool the input as the configuration file, and this tool can represent this configuration in more proper way.&lt;/p&gt;&#xA;" OwnerUserId="20695" LastEditorUserId="8499" LastEditDate="2015-11-15T00:49:51.373" LastActivityDate="2019-06-04T13:35:35.530" Title="How do I determine how many routers are in an OSPF area?" Tags="|cisco|cisco-ios|ospf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24430" PostTypeId="2" ParentId="24429" CreationDate="2015-11-14T22:12:10.560" Score="2" Body="&lt;p&gt;The &lt;code&gt;show ip ospf neighbor&lt;/code&gt; command will show you the list of OSPF neighbors. This will give you the list of directly connected neighbors for an OSPF router. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13688-16.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;This document&lt;/a&gt; from Cisco describes the command. LSAs don't really represent routers, so counting them to count routers is not the correct way to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to this Cisco document, &lt;a href=&quot;https://supportforums.cisco.com/document/133976/reading-and-understanding-ospf-database&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reading and Understanding the OSPF Database&lt;/a&gt;, the &lt;code&gt;show ip ospf database&lt;/code&gt; command will first show you each router in the area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as a tool recommendation, such recommendations are specifically off-topic. You can ask this on the SE &lt;a href=&quot;https://softwarerecs.stackexchange.com/&quot;&gt;Software Recommendations&lt;/a&gt; site, but not here. I don't really understand what you mean about representing it in a more proper way.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:50:06.373" LastActivityDate="2015-11-15T00:10:19.780" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24432" PostTypeId="1" CreationDate="2015-11-15T03:49:14.487" Score="11" ViewCount="1611" Body="&lt;p&gt;What is a &quot;Layer 3 Switch&quot;?   I essentially understand the OSI model, well maybe I don't and maybe that is why I don't understand.   Its just that I don't see how/when/if a &quot;managed switch&quot; becomes a &quot;layer 3 switch&quot;.  Or, is a &quot;managed switch&quot; automatically a layer 3 switch?   &lt;/p&gt;&#xA;" OwnerUserId="20700" LastEditorUserId="8499" LastEditDate="2018-03-18T21:10:12.373" LastActivityDate="2018-03-18T21:10:12.373" Title="What is a &quot;Layer 3 Switch&quot;?" Tags="|switch|router|osi|layer3|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24433" PostTypeId="2" ParentId="24432" CreationDate="2015-11-15T03:57:22.013" Score="4" Body="&lt;p&gt;Layer-3 switches can route, too.  Some layer-2 switches are managed so that you can change settings. All layer-3 switches are managed because you need to configure the settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 switches only switch at layer-2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-3 switches can switch at layer-2, but they can also route at layer-3. Layer-3 switches don't necessarily have all the features of a router, but some are quite sophisticated.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-15T04:51:02.873" LastActivityDate="2015-11-15T04:51:02.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24437" PostTypeId="2" ParentId="24432" CreationDate="2015-11-15T10:01:19.923" Score="2" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;layer 3 switch&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;managed switch&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;layer 2 switch&lt;/em&gt;&lt;/strong&gt; are different terminologies have some common features and some differences &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Layer 2 switch&lt;/em&gt;&lt;/strong&gt; : is the device which can operate in the osi layer 2 and make its own switching decisions based on layer 2 address (MAC address) and may perform basic (QOS ,ACL)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Layer 3 switch&lt;/em&gt;&lt;/strong&gt; : is the device which can operate in the osi layer 3 and make its own switching decisions based on layer 2 address (MAC address) and make its own Layer 3 functions (routing,QOS,ACL and so on) based on Layer 3 address (IP address) &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Managed switch&lt;/em&gt;&lt;/strong&gt; : both Layer 2 and Layer 3 must given IP to be managed so it is not necessary for a switch to be layer 3 to be managed , even layer 2 switches can be managed  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;other impotent question may you ask your self , &lt;strong&gt;&lt;em&gt;what is the deference between L3 switch and Router where both operate in the same layer??&lt;/em&gt;&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Layer 3 switch has some thing called ASIC which enhance switching performance but Router not    &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;by default Router can perform Layer 3 functions more than Layer 3 switch (some dynamic routing like BGP not enable by default on L3 switch may need extra license but not default , route-map , object tracking and so on) but it is also depend on the vendor    &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2015-11-15T14:11:54.067" LastActivityDate="2015-11-15T14:11:54.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24441" PostTypeId="1" AcceptedAnswerId="24442" CreationDate="2015-11-15T13:28:13.917" Score="1" ViewCount="1624" Body="&lt;p&gt;I have two APs in standalone mode right now because the controller is broken. I have configured DHCP server in the router (L3 switch) but the clients do not get IP. Laptop connected to the router got IP from the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I think the problem is related to DHCP relay but I am not sure what.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="5014" LastEditDate="2015-11-15T14:41:27.617" LastActivityDate="2015-11-15T14:41:27.617" Title="Cisco Aironet 3702i AP standalone - clients do not get DHCP from router" Tags="|cisco|dhcp|access-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24442" PostTypeId="2" ParentId="24441" CreationDate="2015-11-15T13:41:17.003" Score="1" Body="&lt;p&gt;check &lt;strong&gt;&lt;em&gt;SSID VLAN mapping&lt;/em&gt;&lt;/strong&gt; on the AP configuration GUI . you must map the SSID to the proper VLAN to get IP in its range . make use of the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/interfaces-modules/security-modules-routers-switches/116586-config-ap-00.html&quot; rel=&quot;nofollow&quot;&gt;NEXT LINK&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-11-15T13:41:17.003" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24443" PostTypeId="2" ParentId="24432" CreationDate="2015-11-15T14:21:03.247" Score="12" Body="&lt;p&gt;Managed switches are in simple terms switches that can be &quot;managed.&quot; Managed means that they can provide information/statistics about their operation and usually that they can be configured. While the vast majority of managed switches can be configured for IP (and this includes all the more capable devices with full feature sets), there are some that can be managed strictly over L2 with proprietary management software but this limits them severely in terms of what advantages they have over a non-managed switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A L3 switch is a switch that can perform some or all the functions of a router in addition to being a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This then begs the question, what is the difference between a L3 switch and a router? Technically speaking, a L3 switch is a router. Or put another way, a device which performs L3 functions is a router (this is also why they can call consumer gateway devices &quot;routers&quot;), and a L3 switch performs L3 functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why the distinction? People will point out many things sometimes, but you can always find exceptions to those (whether it is based on features, performance, etc). In my mind it really comes down to one thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L3 switches are designed first and foremost to perform L2 functions. Even if they have a full L3 feature set and high L3 performance, the primary motivation behind their design and engineering is L2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers are first and foremost designed to perform L3 functions. Even if they have L2 modules or functionality, the primary motivation behind their design and engineering is L3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when it comes to pushing new capabilities, features and/or performance, the focus is often on their primary layer of operation first. An example of this was the Cisco 6500 L3 switch and the 7600 router. While they were both basically the same platform and could use much of the same hardware/modules, the focus was different.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-11-15T14:21:03.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24444" PostTypeId="1" AcceptedAnswerId="24447" CreationDate="2015-11-15T14:34:16.183" Score="1" ViewCount="9628" Body="&lt;p&gt;I am trying to identify the size of memory available on the CISCO router. I do not have physical access to the router but I am able to login to the console and fire commands in privilege mode. &lt;strong&gt;I see that Flash and NVRAM memory sizes have been explicitly called out, but I don't see any information for RAM, and ROM&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some snippets from the show version command,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(15)T1, RELEASE SOFTWARE (fc2)&#xA;&#xA;&#xA;cisco 2811 (MPC860) processor (revision 0x200) with 60416K/5120K bytes of memory&#xA;Processor board ID JAD05190MTZ (4292891495)&#xA;M860 processor: part number 0, mask 49&#xA;2 FastEthernet/IEEE 802.3 interface(s)&#xA;2 Low-speed serial(sync/async) network interface(s)&#xA;239K bytes of NVRAM.&#xA;62720K bytes of processor board System flash (Read/Write)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also in the line - &quot;cisco 2811 (MPC860) processor (revision 0x200) with 60416K/5120K bytes of memory&quot; how do I interpret &quot;&lt;strong&gt;60416K/5120K&lt;/strong&gt;&quot;?&lt;/p&gt;&#xA;" OwnerUserId="20706" LastEditorUserId="17452" LastEditDate="2015-11-15T14:59:35.270" LastActivityDate="2015-11-15T16:17:50.553" Title="RAM and ROM size on Cisco Router" Tags="|cisco|router|cisco-ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24445" PostTypeId="1" CreationDate="2015-11-15T14:57:26.133" Score="-1" ViewCount="71" Body="&lt;pre&gt;&lt;code&gt;|---------|          |---------|          |---------|     |---------|  &#xA;|         |          |         |          |         |     |         |&#xA;| PLCnet1 | &amp;lt;-WIFI-&amp;gt; | PLCnet2 | &amp;lt;-WIFI-&amp;gt; | PLCnet3 | ... | PLCnetN |&#xA;|---------|          |---------|          |---------|     |---------|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to link several power line communication (PLC) networks together using wireless comm, forming one large cohesive network sharing the same subnet.  &lt;em&gt;See above text art.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each PLCnet above is a network segment consisting of several nodes. Let's say there are 8 nodes in each segment. Each node is a computer hooked up to a PLC adapter. Each PLCnetwork is independent. I want to create wireless bridges between each independent PLCnetwork so that one large network is formed with all nodes operating on the same subnet; so that the nodes at PLCnetwork1 can communicate with then nodes at PLCnetworkN. Is this possible?  If so, what type of device, in what configuration?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, would it be possible to use a DHCP server at PLCnet1 to assign IP addresses to nodes in PLCnetN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Constraints:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Each PLC network operates on independent electrical wiring.  Each segement is able to communicate using PLC adapters, but cannot use PLC to communicate with other segments.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Physical connection between PLC networks using Cat5 cabling is not ideal and may not be feasable.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20707" LastEditorUserId="20707" LastEditDate="2015-11-15T15:37:34.383" LastActivityDate="2015-11-22T20:48:43.287" Title="link several powerline networks using wireless?" Tags="|routing|wireless|lan|bridge|" AnswerCount="3" CommentCount="2" ClosedDate="2017-08-12T21:23:22.213" ContentLicense="CC BY-SA 3.0" />
  <row Id="24446" PostTypeId="2" ParentId="24444" CreationDate="2015-11-15T15:02:18.700" Score="3" Body="&lt;p&gt;When you see &lt;code&gt;60416K/5120K&lt;/code&gt; in the &lt;code&gt;show version&lt;/code&gt; command, it is telling you that you have &lt;code&gt;60416K&lt;/code&gt; of main memory and &lt;code&gt;5120K&lt;/code&gt; of shared memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;show memory&lt;/code&gt; command will show you about the memory, and it has a bunch of options:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1#show memory ?&#xA;  &amp;lt;0-4294967294&amp;gt;      Dump memory starting at &amp;lt;address&amp;gt;&#xA;  allocating-process  Show allocating process name&#xA;  console             Console memory&#xA;  dead                Memory owned by dead processes&#xA;  debug               Memory debugging commands&#xA;  failures            Memory failures&#xA;  fast                Fast memory stats&#xA;  fragment            Summary of memory fragment information&#xA;  free                Free memory stats&#xA;  io                  IO memory stats&#xA;  lite-chunks         Malloc lite info&#xA;  multibus            Multibus memory stats&#xA;  overflow            memory overflow corrections&#xA;  pci                 PCI memory stats&#xA;  processor           Processor memory stats&#xA;  statistics          Mempool Statistics&#xA;  summary             Summary of memory usage per alloc PC&#xA;  transient           Transient memory stats&#xA;  |                   Output modifiers&#xA;  &amp;lt;cr&amp;gt;&#xA;&#xA;Router1#show memory statistics&#xA;                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)&#xA;Processor    F96C068   289042648   117972352   171070296   137846436   149146964&#xA;      I/O   1DD13140    36622016    17281324    19340692    18933200    18360124&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You're not really specific about what you are looking for. There are a lot of different &lt;code&gt;show&lt;/code&gt; commands that can give you different statistics. It's not really like a Windows PC, if that is the sort of thing you are looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1#show processes memory&#xA;Processor Pool Total:  289042648 Used:  118031228 Free:  171011420&#xA;      I/O Pool Total:   36622016 Used:   17278752 Free:   19343264&#xA;&#xA; PID TTY  Allocated      Freed    Holding    Getbufs    Retbufs Process&#xA;   0   0  182017988   71112816  105430820       2426     311700 *Init*          &#xA;   0   0      13124     238360      13124          0          0 *Sched*         &#xA;   0   0   45943548   44545972    1372356          2          1 *Dead*          &#xA;   0   0          0          0     394968          0          0 *MallocLite*    &#xA;   1   0  114617512  110099076    4525732          0          0 Chunk Manager   &#xA;   2   0        240        240       4296          0          0 Load Meter      &#xA;   3   0     159196     152332      32076          0          0 Exec            &#xA;   4   0      65588          0      90884          0          0 EDDRI_MAIN      &#xA;   5   0          0          0       7296          0          0 RO Notify Timers&#xA;   6   0       3376        240      10432          0          0 Check heaps     &#xA;   7   0 1224604664 1227210180     218940         49          0 Pool Manager    &#xA;   8   0          0          0       7296          0          0 DiscardQ Backgro&#xA;   9   0        240        240       7296          0          0 Timers          &#xA;  10   0          0          0       4296          0          0 WATCH_AFS   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For File systems:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1#show file systems&#xA;File Systems:&#xA;&#xA;       Size(b)       Free(b)      Type  Flags  Prefixes&#xA;             -             -    opaque     rw   archive:&#xA;             -             -    opaque     rw   system:&#xA;             -             -    opaque     rw   tmpsys:&#xA;             -             -    opaque     rw   null:&#xA;             -             -   network     rw   tftp:&#xA;*    256503808      78442496      disk     rw   flash:#&#xA;        262136        248681     nvram     rw   nvram:&#xA;             -             -    opaque     wo   syslog:&#xA;             -             -    opaque     rw   xmodem:&#xA;             -             -    opaque     rw   ymodem:&#xA;             -             -   network     rw   rcp:&#xA;             -             -   network     rw   http:&#xA;             -             -   network     rw   ftp:&#xA;             -             -   network     rw   scp:&#xA;             -             -    opaque     ro   tar:&#xA;             -             -   network     rw   https:&#xA;             -             -    opaque     ro   cns:&#xA;             -             -    opaque     rw   security:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-15T16:17:50.553" LastActivityDate="2015-11-15T16:17:50.553" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="24447" PostTypeId="2" ParentId="24444" CreationDate="2015-11-15T15:23:04.803" Score="2" Body="&lt;p&gt;When you see a line like &lt;code&gt;with 60416K/5120K bytes of memory&lt;/code&gt; in a router, this indicates the amount of DRAM and packet memory installed in the router. For many platforms, part of the DRAM is assigned to packet memory, so you take this in two ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If the first number is a &quot;normal&quot; amount of RAM (binary or multiple of two), use only the first number. For examples from a 4500 switch, the following output would indicated 64M of RAM: &lt;code&gt;65536K/2072K bytes of memory&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Otherwise, you will need to add the two numbers. In the example you provided, you would add the two and also get 64M of RAM.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;While there are many ROM only components in many Cisco devices, usually this is used as a misnomer for persistent storage on the device (i.e. where the bootable images, configuration, and other such files are stored), also often referred to as flash or NVRAM. After all, we don't really care how much ROM is installed as you can't use ROM memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The line &lt;code&gt;62720K bytes of processor board System flash (Read/Write)&lt;/code&gt; clearly indicates how much you have installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now some routers and switches will allow you to use other sources of flash as well, such as compact flash. So this is another source of storage that may not be represented on a show version.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-11-15T15:23:04.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24448" PostTypeId="2" ParentId="24445" CreationDate="2015-11-15T15:24:31.560" Score="1" Body="&lt;p&gt;here you can treat those &lt;strong&gt;&lt;em&gt;PLCs as normal PCs&lt;/em&gt;&lt;/strong&gt; . you may get one &lt;strong&gt;&lt;em&gt;access point&lt;/em&gt;&lt;/strong&gt; (any brand) and make sure its range of coverage can cover all those PLCs . or may you use more than one access point .regarding the &lt;strong&gt;&lt;em&gt;DHCP&lt;/em&gt;&lt;/strong&gt; ,sure you can configure this access point to provide DHCP for those PLCs .all PLC will get iPs from the access point in same range so they can communicate each other. &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-11-15T15:24:31.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24449" PostTypeId="1" AcceptedAnswerId="24453" CreationDate="2015-11-15T15:58:18.023" Score="1" ViewCount="115" Body="&lt;p&gt;RTS and CTS packets in IEEE 802.11 are for dealing with hidden node problem. If I enable this feature on channel 1, would other nodes in other channels(e.g 2) receive and respect RTS/CTS packets?&lt;/p&gt;&#xA;" OwnerUserId="20249" LastActivityDate="2015-11-15T17:48:31.693" Title="are RTS/CTS packets channel dependent?" Tags="|ieee-802.11|network-access|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24450" PostTypeId="2" ParentId="24445" CreationDate="2015-11-15T16:05:28.377" Score="1" Body="&lt;p&gt;This question leads to some rather opinion-based answers, which is off-topic. I will try to keep this as general as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, it is possible to do this. There are several way to accomplish what you are asking. You could use Wi-Fi, you could create pseudo data closets and connect them with standard cabling (copper or fiber). There are also specialty radio or laser devices which could connect the separate segments. Basically, you seem to want point-to-point communications from one segment to another. You can do this, but it may not be the best solution, and I doubt very seriously that you will get anything close to the bandwidth or performance you are expecting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have narrowed down your design, we may be able help with configurations. We can't really design your network for you.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-15T16:05:28.377" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24453" PostTypeId="2" ParentId="24449" CreationDate="2015-11-15T17:48:31.693" Score="1" Body="&lt;p&gt;No. Nodes on other channels are not listening to you. That's one reason why you should always use non-overlapping channels (1,6,11)&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-15T17:48:31.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24455" PostTypeId="1" AcceptedAnswerId="24466" CreationDate="2015-11-15T21:25:11.977" Score="1" ViewCount="79" Body="&lt;p&gt;I work at firm that transfers files some being up to 6Gb and growing to a network server that is dedicated to storing the files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These files are compared after transfer by a comparison software that sits on the source machine. So it must compare the files over the network connection. There can be a few devices writing or reading from the machine not more than 6 simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I will look at what HDDs on the server to see if they are the best. I am guessing that will be the biggest bottle neck, but can I help by putting all my machines on separate VLANs to reduce the size of their broadcast domain or will that give no appreciable increase in performance? The devices are on a Cisco 2970X-TS24, and access the network through through a Cisco ASA 5525-X.&lt;/p&gt;&#xA;" OwnerUserId="10462" LastEditorUserId="8499" LastEditDate="2015-11-15T21:38:47.753" LastActivityDate="2015-11-16T08:11:07.707" Title="File comparison over intranet, improved by use of VLANs?" Tags="|cisco|vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24456" PostTypeId="1" AcceptedAnswerId="24458" CreationDate="2015-11-15T21:55:24.973" Score="1" ViewCount="586" Body="&lt;p&gt;Is the &lt;strong&gt;Static Multicast MAC address&lt;/strong&gt; term the same as &lt;strong&gt;hardware ethernet MAC address&lt;/strong&gt; (wan0)? In devices where two MAC addresses is present, i.e. lan0, wan0.&lt;/p&gt;&#xA;" OwnerUserId="15947" LastActivityDate="2015-11-15T22:22:00.323" Title="Static Multicast MAC address term" Tags="|mac-address|multicast|wan|cable|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24458" PostTypeId="2" ParentId="24456" CreationDate="2015-11-15T22:22:00.323" Score="0" Body="&lt;p&gt;No. A multicast MAC address is a layer-2 address in the multicast range, but it will not be a hardware MAC address. You would configure a static multicast MAC address in the CAM table on a switch to solve a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/68131-cat-multicast-prob.html#solu4&quot; rel=&quot;nofollow&quot;&gt;document&lt;/a&gt; that explains the problem and possible solutions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Understand the Problem and Its Solutions&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;By default, the Catalyst switches have IGMP snooping enabled. With&#xA;  IGMP snooping, the switch snoops (or listens) for IGMP messages on all&#xA;  the ports. The switch builds an IGMP snooping table that basically&#xA;  maps a multicast group to all the switch ports that have requested it.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Assume that, without any prior configuration, Receiver 1 and Receiver&#xA;  2 have signaled their intentions to receive a multicast stream for&#xA;  239.239.239.239 that maps to the L2 multicast MAC address of 01.00.5e.6f.ef.ef. Both Switch 1 and Switch 2 create an entry in their snooping tables for these receivers in response to the IGMP reports&#xA;  that the receivers generate. Switch 1 enters port Gigabit Ethernet&#xA;  2/48 in its table, and Switch 2 enters port Fast Ethernet 1/0/47 in&#xA;  its table.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: At this point, the multicast source has not started its traffic,&#xA;  and none of the switches knows about the switch mrouter port.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When the source on Switch 1 starts to stream multicast traffic, Switch&#xA;  1 has &quot;seen&quot; the IGMP report from Receiver 1. As a result, Switch 1&#xA;  delivers the multicast out port Gigabit Ethernet 2/48. But, since&#xA;  Switch 2 &quot;absorbed&quot; the IGMP report from Receiver 2 as part of the&#xA;  IGMP snooping process, Switch 1 does not see an IGMP report (multicast&#xA;  request) on port Gigabit Ethernet 2/46. As a result, Switch 1 does not&#xA;  send any multicast traffic out to Switch 2. Therefore, Receiver 2&#xA;  never gets any multicast traffic, even though Receiver 2 is in the&#xA;  same VLAN but merely on a different switch than the multicast source.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The reason for this issue is that IGMP snooping is not really&#xA;  supported on any Catalyst platform without an mrouter. The mechanism&#xA;  &quot;breaks down&quot; in the absence of an mrouter port. If you want a fix for&#xA;  this solution, you must have the switches somehow learn or know of an&#xA;  mrouter port. The Solutions section of this document explains the&#xA;  procedure. But how does the presence of an mrouter port on the&#xA;  switches remedy the situation?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Basically, when the switches learn or statically know about an mrouter&#xA;  port, two critical things occur:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The switch &quot;relays&quot; the IGMP reports from the receivers to the    mrouter port, which means that the IGMP reports go toward the&lt;br&gt;&#xA;  multicast router. The switch does not relay all the IGMP reports.&lt;br&gt;&#xA;  Instead, the switch sends only a few of the reports to the mrouter.&lt;br&gt;&#xA;  For the purpose of this discussion, the number of reports is not&lt;br&gt;&#xA;  important. The multicast router only needs to know if there is at&lt;br&gt;&#xA;  least one receiver that is still interested in the multicast&lt;br&gt;&#xA;  downstream. In order to make the determination, the multicast router&lt;br&gt;&#xA;  receives the periodic IGMP reports in response to its IGMP queries.&lt;/li&gt;&#xA;  &lt;li&gt;In a source-only multicast scenario, in which no receivers have yet    &quot;joined&quot; in, the switch only sends the multicast stream out its&lt;br&gt;&#xA;  mrouter port.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;When the switches know their mrouter port, Switch 2 relays out the&#xA;  IGMP report that the switch received from Receiver 2 to its mrouter&#xA;  port. This port is Fast Ethernet 1/0/33. Switch 1 gets this IGMP&#xA;  report on the switch port Gigabit Ethernet 2/46. From the perspective&#xA;  of Switch 1, the switch has received merely another IGMP report. The&#xA;  switch adds that port into its IGMP snooping table and begins to send&#xA;  out the multicast traffic on that port as well. At this point, both&#xA;  the receivers receive the requested multicast traffic, and the&#xA;  application works as expected.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;But how do the switches identify their mrouter port so that IGMP&#xA;  snooping works as it is expected to work in a simple environment like&#xA;  this? The Solutions section provides some answers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-15T22:22:00.323" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24460" PostTypeId="1" AcceptedAnswerId="24461" CreationDate="2015-11-16T01:08:07.250" Score="1" ViewCount="136" Body="&lt;p&gt;We have several old Cisco switches (currently only have VLAN 1 for everything). We are moving to a VOIP setup with Brocade and so I've (hopefully) configured the Brocade switch to handle the traffic correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've configured the Brocade with a default VLAN ID of 1, VLAN 10 for data/LAN traffic, VLAN 20 for our guest WIFI network, and VLAN 30 for VOIP. The phones should tag the packets for VLAN 30, the PC data should be untagged but come in as VLAN 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: How can I get the old Cisco switch to take the VLAN 10 traffic and put it on it's default VLAN so that I don't have to create a VLAN 10 on two dozen Cisco switches that will be replaced soon anyway?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MLMCP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MLMCP.jpg&quot; alt=&quot;New design&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1834" LastActivityDate="2022-04-24T11:07:22.107" Title="Help with network topology" Tags="|cisco|vlan|brocade|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24461" PostTypeId="2" ParentId="24460" CreationDate="2015-11-16T01:43:39.617" Score="3" Body="&lt;p&gt;If you have no need to divide the traffic on all (and it does have to be all) the old hardware, then just make sure the switch connection from the old Cisco equipment connects to a VLAN 10 only port on your Brocade.  Don't configure for trunking, tagging, or any management protocol on either side of that one link - Cisco will only tag if the port is configured for trunk.  The Brocade will consider all the traffic that comes in from the old hardware to be VLAN 10 traffic, and your Ciscos will keep doing what they're doing thinking they are VLAN1 without any config changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not terribly good practice, so as soon anything changes this is a rather bad idea.  If the replacement simply forges ahead as you describe however, it may be a way to tide you over.&lt;/p&gt;&#xA;" OwnerUserId="19491" LastActivityDate="2015-11-16T01:43:39.617" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24462" PostTypeId="1" AcceptedAnswerId="24465" CreationDate="2015-11-16T04:55:37.417" Score="1" ViewCount="673" Body="&lt;p&gt;I noticed there are some switches called &quot;Layer-3 Switch&quot;, which is able to do both switching and routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen some articles that says Layer-3 switch can replace routers. Is it going to replace both routers and managed switches in future? Or are there still some routing functions that Layer-3 switch cannot achieve?&lt;/p&gt;&#xA;" OwnerUserId="20657" LastActivityDate="2015-11-16T05:28:59.923" Title="Is &quot;Layer-3 switch&quot; a combination of router and switch?" Tags="|switch|router|layer3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24464" PostTypeId="1" AcceptedAnswerId="24472" CreationDate="2015-11-16T05:23:53.377" Score="1" ViewCount="1373" Body="&lt;p&gt;First question here. I am &lt;strong&gt;very new&lt;/strong&gt; to Cisco systems - about 3 days worth of knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to migrate our configuration from our old router to our new router. Our new router is a &lt;a href=&quot;http://www.cisco.com/c/en/us/products/routers/2900-series-integrated-services-routers-isr/index.html&quot; rel=&quot;nofollow&quot;&gt;Cisco 2900&lt;/a&gt;, and our old router is a &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/800-series-routers/product_data_sheet0900aecd8028a976.html&quot; rel=&quot;nofollow&quot;&gt;877m&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a clip from our old router's running-config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA; description --- Office bound to fa0&#xA; ip address 10.2.0.254 255.255.192.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My understanding is that these vlans exist on this configuration simply as an alias to the &quot;real&quot; interfaces, to make it easier to swap them around if need be. I have successfully replicated all of the configuration into the new router except the creation of these vlans and the migration of the interface config to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I've been trying to figure out how to create these vlans. I've been told I can create them with the &lt;code&gt;vlan database&lt;/code&gt; command from admin mode. However this gives me a warning about this method being deprecated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;host#vlan database&#xA;% Warning: It is recommended to configure VLAN from config mode,&#xA;  as VLAN database mode is being deprecated. Please consult user&#xA;  documentation for configuring VTP/VLAN in config mode.&#xA;&#xA;host(vlan)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so then I tried to find out what commands to use in &lt;code&gt;conf&lt;/code&gt; mode, and all I could find was posts like these, saying i simply use &lt;code&gt;vlan 1&lt;/code&gt;: &lt;a href=&quot;https://supportforums.cisco.com/discussion/9819021/vlan-database-deprecated&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/9819021/vlan-database-deprecated&lt;/a&gt; But this does not work for me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;host(config)#vlan 1&#xA;                  ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;host(config)#vlan ?&#xA;  accounting  VLAN accounting configuration&#xA;  ifdescr     VLAN subinterface ifDescr&#xA;&#xA;host(config)#vlan&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there some module that I still need to install? Some other setting I need to enable? Or should I continue using &lt;code&gt;vlan database&lt;/code&gt; even though it's deprecated?&lt;/p&gt;&#xA;" OwnerUserId="20715" LastEditorUserId="20715" LastEditDate="2015-11-16T05:47:23.013" LastActivityDate="2015-11-16T15:38:57.017" Title="How to create a vlan" Tags="|cisco|vlan|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24465" PostTypeId="2" ParentId="24462" CreationDate="2015-11-16T05:28:59.923" Score="2" Body="&lt;p&gt;Layer-3 switches can do layer-3 routing along with layer-2 switching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether or not a layer-3 switch can replace a router depends on the switch model and what you need it to do. Some layer-3 switches are very complete router replacements, with a full range of WAN, firewall, VoIP, etc. modules. On the other hand, those switches are expensive, and most layer-3 switches only have ethernet ports. There can be things that dedicated routers do better than most layer-3 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;YLearn has a good explanation in an answer for &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/24432/what-is-a-layer-3-switch&quot;&gt;this question&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-11-16T05:28:59.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24466" PostTypeId="2" ParentId="24455" CreationDate="2015-11-16T08:11:07.707" Score="1" Body="&lt;p&gt;Generally speaking, unless you have a large broadcast domain (hundreds of hosts) with lots of broadcast traffic, simply isolating the traffic to a VLAN won't help you much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not finding specs for a Cisco 2970X, are you sure it isn't a 2970G or 2960X? Either way, it looks like you're working with 1gbps ports&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Things I would look at first:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Are you getting 70-80MB/s transfer rate from your client machines? Yes: Congrats, you've reached optimal transfer rates for your link speed, look into 10gbps or port channels all around for additional throughput. If not, continue:&lt;/li&gt;&#xA;&lt;li&gt;Are you maxing out the server interface? Yes: Your server interface is the bottle neck, if you have an additional interface on the server look into setting up an LACP bond with two NICs to your switch for 2gbps throughput. If not, continue:&lt;/li&gt;&#xA;&lt;li&gt;Check your intermediate uplinks between network devices, if you're maxing these out, I'd suggest putting an extra link in there for additional bandwidth, again look into LACP port channels between your 2970 and your ASA. If not:&lt;/li&gt;&#xA;&lt;li&gt;At this point it doesn't appear to be a congestion issue. Other bottlenecks might be the ASA (if too many rules or filters are applied), or disk IO&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20714" LastActivityDate="2015-11-16T08:11:07.707" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24468" PostTypeId="1" CreationDate="2015-11-16T11:17:55.317" Score="1" ViewCount="344" Body="&lt;p&gt;Is it possible to connect an server with FCOE adapter  on a virtual chassis juniper ex4550 in order to access a fc disk array connected to a Cisco Nexus 5548UP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The juniper and the nexus are connected together with 10G optic cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your answer.&lt;/p&gt;&#xA;" OwnerUserId="250" LastEditorUserId="250" LastEditDate="2015-11-16T20:26:06.183" LastActivityDate="2015-11-16T23:27:57.503" Title="FCOE between virtual chassis Juniper EX and Cisco Nexus" Tags="|cisco|juniper|fcoe|san|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24469" PostTypeId="1" CreationDate="2015-11-16T14:56:37.613" Score="1" ViewCount="2745" Body="&lt;p&gt;The distance between AP and the switch is around 60 meters. The AP is powered up and SSIDs are broadcasted. But the Ethernet interface has line Protocol down. I have changed the RJ45 connectors on both side of the cable but still same behaviour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this related to the cable length?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2015-11-17T05:53:16.970" Title="PoE AP is powered up but line protocol is down" Tags="|cisco|access-point|power-over-ethernet|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24470" PostTypeId="2" ParentId="22338" CreationDate="2015-11-16T15:10:17.660" Score="1" Body="&lt;p&gt;A reboot should not be the right answer, especially with that kind of network equipment. Next time you should try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;    int tengig0/0/0&#xA;        shut&#xA;        do show log&#xA;        no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-16T15:10:17.660" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24471" PostTypeId="1" AcceptedAnswerId="24491" CreationDate="2015-11-16T15:37:42.163" Score="0" ViewCount="136" Body="&lt;p&gt;Network n00b here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 'dumb' monitoring devices attached to a LAN via Ethernet. &#xA;Using a desktop app on a PC within the same LAN, it is very simple to connect and to obtain the monitoring data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I need to network these devices such that they can be accessed from a desktop app on a PC in a different LAN only connected via the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sQiyC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sQiyC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have looked at:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;TCP/IP communication;&lt;/li&gt;&#xA;&lt;li&gt;Monitoring devices connected to a VPN router - connected to the LAN&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;We can't use 1 because it is unsecure and we have no access to the LAN config.&#xA;2 is great because it's secure but the PC with the desktop app would also need to be connected to the VPN so the user would have to install the VPN client software and we can't automate the process. Would there be a way to automate the process? Is there something I've missed?&lt;/p&gt;&#xA;" OwnerUserId="20728" LastActivityDate="2015-11-17T12:11:27.653" Title="How can I get data from networked device on different LAN?" Tags="|vpn|lan|wan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24472" PostTypeId="2" ParentId="24464" CreationDate="2015-11-16T15:38:57.017" Score="2" Body="&lt;p&gt;It seems like there is some confusion going on here. While Cisco typically appears to try to avoid re-using product line numbering, there are exceptions (and possibly more recently). The 2900 ISR router series is one of them. It overlaps with an older switching product line, the Catalyst 2900 series.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To muddy the waters more, your current 800 ISR series router is a router with a switch built in, allowing it to support some switch commands in addition to the normal router commands. Specifically, IIRC (been a while since I configured one of these, maybe I can find one to play with later today) all the &quot;LAN&quot; ports are actually part of this switch and as such cannot be configured like a router interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole ISR series of routers is designed to provide functionality of multiple platforms into one integrated platform. As I understand the 2900 ISR platform, you will only have certain commands/features available if the associated hardware is installed and/or licensed. Specifically, to add VLANs like you are attempting, you would need to have one of the Gigabit EtherSwitch modules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My best guess is that you don't have one of these modules installed in the router and you only really have router interfaces available. These will need to be configured differently than the configuration in your old router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To confirm, you would have to provide more details in your question about the specifics of the hardware installed in your router.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-11-16T15:38:57.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24476" PostTypeId="1" CreationDate="2015-11-16T17:43:53.303" Score="3" ViewCount="5567" Body="&lt;p&gt;I have been monitoring a 1 Gbps OM2 fiber connection to one switch we have with Smokeping...&#xA;There seems to be an avg loss of 3-4% for a few days now..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Started troubleshooting using iperf, having set window size to 65K...Just to cross-check i used pathtest using the same window size...Both report speeds below 10 Mbps (!) which surely are unacceptable, considering a logical transfer rate would be at around 1/4 of the Gpbs connection when PCI NIC's are used and in terms of in-memory transfers...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP tests, on the other hand, from both iperf and smokeping report speeds between 300-400 Mbps and as far as reading and writing using LanSpeed i get a respective 55-65 Mbps and 20 Mbps...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having read that iperf's implementation on Windows is not a reliable one i now think that testing using that tool was wrong in the first place with Windows...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Machines used for testing were Windows XP (client) &gt; Windows XP (server)...all NICs have auto in terms of negotiation and reporting pre-negotiated speed of lan link at 1 Gbps...no mdix errors or up/downs shown on syslog...&#xA;MTU at 1500...&#xA;Quick Rawcap trace and trace analysis with Wireshark shows TCP Zero Window errors which clearly explain the significant drop on TCP throughput...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch is an SG200-50, poor on out-of-band management facilities and cli, so, for now, not much to see except under web interface...already disabled zero-DNS servics like Bonjour.....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions greatly appreciated...&lt;/p&gt;&#xA;" OwnerUserId="20731" LastActivityDate="2015-11-19T17:05:47.387" Title="Very slow TCP speed and throughtput in contast to UDP" Tags="|switch|ethernet|tcp|packet-analysis|udp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24478" PostTypeId="1" AcceptedAnswerId="24479" CreationDate="2015-11-16T20:56:19.030" Score="2" ViewCount="226" Body="&lt;p&gt;I am having some issues creating some redundancy with an L2 network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a main tcom room with my distribution switches, and a switch room with 5 floor switches.&#xA;As it stands, I only have the infrastructure for 2 trunks from the tcom room to the switch room, so I can't create a full mesh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image below shows the current setup, however if for instance I lose switch 3, I also lose 4 and 5. So I am looking for some kind of redundancy should a switch die. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need a full mesh between switches 1-5? (thus using up 4 ports on every switch?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am running HP Procurves using rpvst spanning-tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/6steh.png&quot; alt=&quot;network&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="17253" LastActivityDate="2015-11-18T15:37:40.577" Title="L2 Topology - looping" Tags="|layer2|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24479" PostTypeId="2" ParentId="24478" CreationDate="2015-11-16T21:30:34.823" Score="4" Body="&lt;p&gt;Assuming that the switch room devices are all equally capable, then the simple solution would be to move the connection from &lt;em&gt;DistSw2 --&gt; FloorSw2&lt;/em&gt; to &lt;em&gt;DistSw2 --&gt; FloorSw5&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Uses no more ports and provides full redundancy from any single failure. A better solution that what you currently have in place with a minimum of changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if FloorSw3-5 each had their own connection to both FloorSw1 and FloorSw2, then you may be able to experience multiple failures and still maintain most of your operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Redundancy is great and we love making things as redundant as possible. However redundancy does have it's costs (in money, hardware, ports, power, cooling, etc). How much you spend on building redundancy into a network will depend on your business needs. The less tolerance for downtime, the more redundancy you will have to provide.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-11-16T21:30:34.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24480" PostTypeId="2" ParentId="24468" CreationDate="2015-11-16T23:27:57.503" Score="1" Body="&lt;p&gt;I don't believe this is possible, although Juniper's documentation is very vague.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is my understanding that in order to do FCoE, the EX4550 must be a stand-alone device, not part of a Virtual-Chassis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is vague reference in the EX4600 doco that says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Note: Standalone switches support FCoE. Virtual Chassis (VC) and mixed-    &#xA; mode Virtual Chassis Fabric (VCF) configurations do not support FCoE.    &#xA; Pure QFX5100 switch VCFs (consisting of only QFX5100 switches) support FCoE.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This can be found at the following URL:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.jnpr.net/techpubs/en_US/junos13.2/topics/concept/fibre-channel-fcoe-understanding.html&quot; rel=&quot;nofollow&quot;&gt;http://www.jnpr.net/techpubs/en_US/junos13.2/topics/concept/fibre-channel-fcoe-understanding.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could test on a dummy VLAN on your EX-VC by trying to commit the following and see what happens:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ethernet-switching-options {&#xA;    secure-access-port {&#xA;        interface xe-0/0/0.0 {&#xA;            fcoe-trusted;&#xA;        }&#xA;        vlan my-fcoe-vlan {&#xA;            examine-fip {&#xA;                fc-map 0x0EFC03;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-11-16T23:27:57.503" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24482" PostTypeId="2" ParentId="20591" CreationDate="2015-11-17T03:20:24.407" Score="0" Body="&lt;p&gt;What about like Pieter said and adding eth0 to the bridge, then giving a tagged &quot;internal&quot; interface back to the OS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ovs-vsctl add-port br0 eth0&#xA;# ifconfig eth0 0.0.0.0&#xA;# ovs-vsctl add-port br0 vlan100 tag=100 vlan_mode=access -- set interface vlan100 type=internal&#xA;# ifconfig vlan100 192.168.1.10/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15067" LastEditorUserId="15067" LastEditDate="2015-11-17T04:08:59.160" LastActivityDate="2015-11-17T04:08:59.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24483" PostTypeId="1" CreationDate="2015-11-17T04:09:12.533" Score="1" ViewCount="4252" Body="&lt;p&gt;I have a certain number of packets dropped on my port channel interface with 3gbps bundled speed, on Cisco 6500 with Sup 720. You can see underneath the number of dropped packet within a minute, after I cleared the counters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering why packets don't enter in the queue at all before being dropped. Please help me resolve the problem with queue drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will adding another interface in to the bundle resolve help reduce the drops?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CORESW01#show interfaces port-channel 50                      &#xA;Port-channel50 is up, line protocol is up (connected)&#xA;  Hardware is EtherChannel, address is XXXXXXXXXX (bia XXXXXXXX)&#xA;  Description: [***Etherchannel Connected to DELL-ENCLOSURE-B1 Ports 17,18,19,20***]&#xA;  MTU 1500 bytes, BW 3000000 Kbit, DLY 10 usec, &#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 1000Mb/s&#xA;  input flow-control is off, output flow-control is off&#xA;  Members in this channel: Gi2/33 Gi2/34 Gi2/35 &#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 17:30:41&#xA;  --THIS LINE--&amp;gt; Input queue: 0/2000/73599/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 7422000 bits/sec, 1105 packets/sec&#xA;  5 minute output rate 6306000 bits/sec, 1329 packets/sec&#xA;     77713779 packets input, 87465246992 bytes, 0 no buffer&#xA;     Received 530784 broadcasts (258881 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 5 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     46002614 packets output, 24633769164 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;11-18-2016&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CORESW01#show interfaces gigabitEthernet 2/33  &#xA;GigabitEthernet2/33 is up, line protocol is up (connected)  &#xA;  Hardware is C6k 1000Mb 802.3, address is XX  &#xA;  Description: [***Uplink Connected to DELL-ENCL1-B2***]  &#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,   &#xA;     reliability 255/255, txload 2/255, rxload 1/255  &#xA;  Encapsulation ARPA, loopback not set  &#xA;  Keepalive set (10 sec)  &#xA;  Full-duplex, 1000Mb/s  &#xA;  input flow-control is off, output flow-control is off  &#xA;  Clock mode is auto  &#xA;  ARP type: ARPA, ARP Timeout 04:00:00  &#xA;  Last input never, output 00:00:29, output hang never   &#xA;  Last clearing of &quot;show interface&quot; counters 04:47:46  &#xA;  Input queue: 0/2000/359/0 (size/max/drops/flushes); Total output drops: 0  &#xA;  Queueing strategy: fifo  &#xA;  Output queue: 0/40 (size/max)  &#xA;  5 minute input rate 3744000 bits/sec, 820 packets/sec  &#xA;  5 minute output rate 10958000 bits/sec, 1649 packets/sec  &#xA;     7916371 packets input, 4017248800 bytes, 0 no buffer  &#xA;     Received 32074 broadcasts (24595 multicasts)  &#xA;     0 runts, 0 giants, 0 throttles  &#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored  &#xA;     0 watchdog, 0 multicast, 0 pause input  &#xA;     0 input packets with dribble condition detected  &#xA;     13081762 packets output, 4307087164 bytes, 0 underruns  &#xA;     0 output errors, 0 collisions, 0 interface resets  &#xA;     0 babbles, 0 late collision, 0 deferred  &#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output  &#xA;     0 output buffer failures, 0 output buffers swapped out  &#xA;&#xA;CORESW01#show interfaces gigabitEthernet 2/34  &#xA;GigabitEthernet2/34 is up, line protocol is up (connected)  &#xA;  Hardware is C6k 1000Mb 802.3, address is XX  &#xA;  Description: [***Uplink Connected to DELL-ENCL1-B2***]  &#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,   &#xA;     reliability 255/255, txload 1/255, rxload 1/255  &#xA;  Encapsulation ARPA, loopback not set  &#xA;  Keepalive set (10 sec)  &#xA;  Full-duplex, 1000Mb/s  &#xA;  input flow-control is off, output flow-control is off  &#xA;  Clock mode is auto   &#xA;  ARP type: ARPA, ARP Timeout 04:00:00  &#xA;  Last input never, output 00:00:36, output hang never  &#xA;  Last clearing of &quot;show interface&quot; counters 04:47:49  &#xA;  Input queue: 0/2000/136/0 (size/max/drops/flushes); Total output drops: 0  &#xA;  Queueing strategy: fifo  &#xA;  Output queue: 0/40 (size/max)    &#xA;  5 minute input rate 6338000 bits/sec, 647 packets/sec  &#xA;  5 minute output rate 821000 bits/sec, 298 packets/sec  &#xA;     7605420 packets input, 6914668706 bytes, 0 no buffer  &#xA;     Received 79343 broadcasts (26075 multicasts)  &#xA;     0 runts, 0 giants, 0 throttles  &#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored  &#xA;     0 watchdog, 0 multicast, 0 pause input  &#xA;     0 input packets with dribble condition detected  &#xA;     11489585 packets output, 5625019559 bytes, 0 underruns  &#xA;     0 output errors, 0 collisions, 0 interface resets  &#xA;     0 babbles, 0 late collision, 0 deferred  &#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output  &#xA;     0 output buffer failures, 0 output buffers swapped out  &#xA;&#xA;CORESW01#show interfaces gigabitEthernet 2/35  &#xA;GigabitEthernet2/35 is up, line protocol is up (connected)  &#xA;  Hardware is C6k 1000Mb 802.3, address is XX  &#xA;  Description: [***Uplink Connected to DELL-ENCL1-B2***]  &#xA;  MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec,   &#xA;     reliability 255/255, txload 1/255, rxload 1/255  &#xA;  Encapsulation ARPA, loopback not set  &#xA;  Keepalive set (10 sec)  &#xA;  Full-duplex, 1000Mb/s  &#xA;  input flow-control is off, output flow-control is off  &#xA;  Clock mode is auto  &#xA;  ARP type: ARPA, ARP Timeout 04:00:00  &#xA;  Last input never, output 00:00:44, output hang never  &#xA;  Last clearing of &quot;show interface&quot; counters 04:48:08  &#xA;  Input queue: 0/2000/193/0 (size/max/drops/flushes); Total output drops: 0  &#xA;  Queueing strategy: fifo &#xA;  Output queue: 0/40 (size/max)  &#xA;  5 minute input rate 4163000 bits/sec, 515 packets/sec  &#xA;  5 minute output rate 2445000 bits/sec, 373 packets/sec  &#xA;     25776481 packets input, 32767081104 bytes, 0 no buffer  &#xA;     Received 37253 broadcasts (29829 multicasts) &#xA;     0 runts, 0 giants, 0 throttles  &#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored  &#xA;     0 watchdog, 0 multicast, 0 pause input  &#xA;     0 input packets with dribble condition detected  &#xA;     14263612 packets output, 13067998250 bytes, 0 underruns  &#xA;     0 output errors, 0 collisions, 0 interface resets  &#xA;     0 babbles, 0 late collision, 0 deferred  &#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output  &#xA;     0 output buffer failures, 0 output buffers swapped out  &#xA;&#xA;&#xA;&#xA;CORESW01#show module   &#xA;Mod Ports Card Type                              Model              Serial No.  &#xA;--- ----- -------------------------------------- ------------------ -----------&#xA;  1   24  CEF720 24 port 1000mb SFP              WS-X6724-SFP       XX  &#xA;  2   48  48-port 10/100/1000 RJ45 EtherModule   WS-X6148A-GE-45AF  Xx  &#xA;  5    2  Supervisor Engine 720 (Active)         WS-SUP720-3B       SX  &#xA;&#xA;Mod MAC addresses                       Hw    Fw           Sw           Status  &#xA;--- ---------------------------------- ------ ------------ ------------ -------&#xA;  1  0016.XXXX.7ad6 to 0016.XXXX.7aed   2.3   12.2(14r)S5  12.2(18)SXF3 Ok  &#xA;  2  0016.XXXX.f2e0 to 0016.XXXX.f30f   2.0   8.4(1)       8.5(0.46)RFW Ok  &#xA;  5  0014.XXXX.d988 to 0014.XXXX.d98b   4.5   8.1(3)       12.2(18)SXF3 Ok  &#xA;&#xA;Mod  Sub-Module                  Model              Serial       Hw     Status   &#xA;---- --------------------------- ------------------ ----------- ------- -------&#xA;  1  Centralized Forwarding Card WS-F6700-CFC       XX  2.0    Ok  &#xA;  2  IEEE Voice Daughter Card    WS-F6K-48-AF       XX  2.0    Ok  &#xA;  5  Policy Feature Card 3       WS-F6K-PFC3B       XX  2.2    Ok  &#xA;  5  MSFC3 Daughterboard         WS-SUP720          XX  2.4    Ok  &#xA;&#xA;Mod  Online Diag Status   &#xA;---- -------------------&#xA;  1  Pass  &#xA;  2  Pass  &#xA;  5  Pass  &#xA;CORE-SW01#&#xA;&#xA;&#xA;Group: 50  &#xA;---------- &#xA;                Port-channels in the group:    &#xA;        ----------------------&#xA;&#xA;Port-channel: Po50    (Primary Aggregator)  &#xA;&#xA;------------&#xA;&#xA;Age of the Port-channel   = 389d:22h:28m:24s  &#xA;Logical slot/port   = 14/2          Number of ports = 3  &#xA;Port state          = Port-channel Ag-Inuse   &#xA;Protocol            =   LACP  &#xA;&#xA;Ports in the Port-channel:   &#xA;&#xA;Index   Load   Port     EC state        No of bits &#xA;------+------+------+------------------+----------- &#xA;  0     49     Gi2/33   Active    3  &#xA;  1     92     Gi2/34   Active    3  &#xA;  2     24     Gi2/35   Active    2  &#xA;&#xA;Time since last port bundled:    389d:22h:27m:19s    Gi2/35  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since I am not seeing the queue count jump, I think this could be because of bursts of traffic. &lt;/p&gt;&#xA;" OwnerUserId="20743" LastEditorUserId="8499" LastEditDate="2015-11-18T15:22:24.340" LastActivityDate="2015-11-18T15:53:31.380" Title="Input packet drops on port channel" Tags="|cisco|troubleshooting|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24484" PostTypeId="1" CreationDate="2015-11-17T05:32:48.223" Score="1" ViewCount="475" Body="&lt;p&gt;I have developed an application that partially replicates the functionality of the builtin ping application, essentially sending an ICMP packet, receiving the response, and parsing the header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I want to report any error messages received. The problem I'm running into is trying to ping a host/address in such a way that I get ICMP type 3 with some type of ICMP code (presumably codes 0-7, but I'm not picky).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried pinging a bogus address on a different, nonexistent, thinking my router will send out this message, but it doesn't happen, it just times out. Windows &lt;code&gt;ping&lt;/code&gt; behaves the same way though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from setting up a linux box running a service that responds to all pings with type 3 and random codes, is there a way I can test this functionality? Are these codes arcane, obsolete, or otherwise not used?&lt;/p&gt;&#xA;" OwnerUserId="283" LastEditorUserId="283" LastEditDate="2015-11-19T01:10:31.090" LastActivityDate="2015-11-19T01:10:31.090" Title="How can I test my ping application for proper detection of ICMP return types and codes" Tags="|ping|icmp|testing|errors|" AnswerCount="1" CommentCount="4" ClosedDate="2015-11-18T15:51:59.627" ContentLicense="CC BY-SA 3.0" />
  <row Id="24485" PostTypeId="2" ParentId="24476" CreationDate="2015-11-17T05:37:59.083" Score="2" Body="&lt;p&gt;As Ron said, 3-4% packet loss is incredibly high. ThousandEyes ran some experiments on the effects of packet loss and found anything over ~0.5% is hugely detrimental. see: &lt;a href=&quot;https://blog.thousandeyes.com/a-very-simple-model-for-tcp-throughput/&quot; rel=&quot;nofollow&quot;&gt;https://blog.thousandeyes.com/a-very-simple-model-for-tcp-throughput/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully replacing the fiber patch (make sure to clean it first!) will help. Otherwise start looking into other sources for the loss.&lt;/p&gt;&#xA;" OwnerUserId="20714" LastActivityDate="2015-11-17T05:37:59.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24486" PostTypeId="2" ParentId="24469" CreationDate="2015-11-17T05:53:16.970" Score="1" Body="&lt;p&gt;If the SSID is broadcasting then the AP is clearly powered up and PoE is working. Line Protocol Down indicates that Ethernet is not functioning on the link. This could be caused by&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Speed/Duplex mismatch&lt;/li&gt;&#xA;&lt;li&gt;Faulty cable&lt;/li&gt;&#xA;&lt;li&gt;Bad switchport&lt;/li&gt;&#xA;&lt;li&gt;other configuration issues&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It is unlikely that it has to do with cable length. Good luck!&lt;/p&gt;&#xA;" OwnerUserId="20714" LastActivityDate="2015-11-17T05:53:16.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24487" PostTypeId="2" ParentId="23474" CreationDate="2015-11-17T09:42:12.327" Score="0" Body="&lt;p&gt;It turns out it was just a faulty Serial WIC.&lt;/p&gt;&#xA;" OwnerUserId="16873" LastActivityDate="2015-11-17T09:42:12.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24490" PostTypeId="1" AcceptedAnswerId="24493" CreationDate="2015-11-17T11:45:37.160" Score="1" ViewCount="2173" Body="&lt;p&gt;I have the switch put in production already Dell Power Connect 2848. Now im trying to put some ip address and configurations. The problem is that when i connect it through the serial i have just the following prompt &quot;&gt;&quot;. Can i configure the SNMPv3 via MCLI or should i press the config/Managed mode button. Also becouse this is production switch, what will happen if i activeate the Managed mode ? Do i have to reboot the switch or the switch will reboot itself ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also is there a way to configure SNMPv3 via MCLI &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="20749" LastActivityDate="2015-11-17T16:41:20.657" Title="Dell PowerConnect 2848 MCLI Mode" Tags="|switch|management|dell|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24491" PostTypeId="2" ParentId="24471" CreationDate="2015-11-17T12:11:27.653" Score="1" Body="&lt;p&gt;I can't think of any way to accomplish what you want without making major changes to your design.  Fundamentally, you want to make inbound connections to networks you don't control.  Also, you want to install software on PCs you don't administer with minimal or no user interaction.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are mimicking what hackers and malware do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a few thoughts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you need to change your design so that the devices make outbound connections to you (a server on the Internet, for example).  That eliminates all the problems with firewalls, NAT, etc.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You could write a program that reads the data from your device and then makes outbound connections to your server.  You can use SSH for confidentiality, and the program would be lightweight enough that you can automate installation.  But this may require more programming skills than you have.  You could possibly use free software like Putty to do SSH tunneling -- I'm just thinking off the top of my head ere.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You could modify the dumb device so it makes connections directly.  But again, that requires modifying the devices.  That may not be practical either.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-17T12:11:27.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24493" PostTypeId="2" ParentId="24490" CreationDate="2015-11-17T12:38:00.613" Score="1" Body="&lt;p&gt;Dell PC 28XX series don't support SNMPv3. If you are happy with v1 or v2, you can configure it via CLI (console) or via HTTP web (IP address). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest you CLI mode, it's really straight-forward. Just use config command &quot;snmp-server community whatever&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source &lt;a href=&quot;http://downloads.dell.com/Manuals/all-products/esuprt_ser_stor_net/esuprt_networking/esuprt_net_fxd_prt_swtchs/powerconnect-2848_User%27s%20Guide_en-us.pdf&quot; rel=&quot;nofollow&quot;&gt;http://downloads.dell.com/Manuals/all-products/esuprt_ser_stor_net/esuprt_networking/esuprt_net_fxd_prt_swtchs/powerconnect-2848_User%27s%20Guide_en-us.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As page 42 stated, the switch reboots itself when transitioning from unamanaged to managed.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastEditorUserId="3949" LastEditDate="2015-11-17T16:41:20.657" LastActivityDate="2015-11-17T16:41:20.657" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24494" PostTypeId="1" AcceptedAnswerId="24504" CreationDate="2015-11-17T14:11:45.930" Score="1" ViewCount="595" Body="&lt;p&gt;On embedded Wi-Fi access points relying on hostapd, what is the link between the Tx-power value returned by iwconfig to the actual signal level measured with a spectrum analyzer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is not clear to me is the actual meaning of “Tx-power” value. Is this the peak value of the Wi-Fi signal at the centrum of the channel or is it the total power emitted in the selected Wi-Fi channel?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More concretely, can the value returned by iwconfig be used to check if the total emitted RF power is within the allowed RF regulation limits?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any help&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards&lt;/p&gt;&#xA;" OwnerUserId="20751" LastEditorUserId="20751" LastEditDate="2015-11-18T13:30:11.227" LastActivityDate="2015-11-18T14:47:33.847" Title="iwconfig Tw-power value signification" Tags="|wireless|ieee-802.11|linux|" AnswerCount="1" CommentCount="5" ClosedDate="2015-11-18T12:08:30.927" ContentLicense="CC BY-SA 3.0" />
  <row Id="24495" PostTypeId="1" CreationDate="2015-11-17T14:28:16.637" Score="1" ViewCount="5087" Body="&lt;p&gt;Hi we have DellForce10 switches and we are changing them to Cisco Meraki switches. On the Dell switch we have the following Vlan setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Covington-CustomerCheckout-S25&amp;gt;show vlan&#xA;&#xA;Codes: * - Default VLAN, G - GVRP VLANs, P - Primary, C - Community, I - Isolated&#xA;Q: U - Untagged, T - Tagged&#xA;   x - Dot1x untagged, X - Dot1x tagged&#xA;   G - GVRP tagged, M - Vlan-stack&#xA;&#xA;    NUM    Status    Description                     Q Ports&#xA;&#xA;    1      Active                                    T Po1(Gi 0/21-22)&#xA;&#xA;                                                    U Gi 0/9&#xA;    102    Active    Wireless                        T Po1(Gi 0/21-22)&#xA;                                                     U Gi 0/18,20&#xA;    105    Active    DHCP_Clients                    T Po1(Gi 0/21-22)&#xA;                                                     U Gi 0/1-8,10,12-17,19&#xA;    106    Active    Static_Clients                  T Po1(Gi 0/21-22)&#xA;    109    Active    Production                      T Po1(Gi 0/21-22)&#xA;    110    Active    VOIP                            T Po1(Gi 0/21-22)&#xA;    112    Active    Management                      T Po1(Gi 0/21-22)&#xA;    220    Active    Printers                        T Po1(Gi 0/21-22)&#xA;                                                     U Gi 0/11&#xA;    999    Inactive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, the Meraki switch has Native and allowed VLANS and I am not sure how to set it up.  Below are the options that I have to set it up with. I am also a little confused on what the untagged and tagged traffic means on the the Dell switch and how that would translate onto the configuration of the Meraki Switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FeX78.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FeX78.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;If you could please help me&lt;/p&gt;&#xA;" OwnerUserId="20752" LastEditorUserId="619" LastEditDate="2015-11-19T03:24:39.607" LastActivityDate="2015-11-19T03:24:39.607" Title="Setting up VLAN on new Meraki Switch" Tags="|vlan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24496" PostTypeId="2" ParentId="24495" CreationDate="2015-11-17T14:48:26.030" Score="1" Body="&lt;p&gt;On trunk ports, the native VLAN is untagged, and other VLANs are tagged. You are configuring a trunk port on the Cisco, according to the Type field. The native VLAN will not be tagged on the trunk, but all the other VLANs will.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No VLANs will be tagged on access ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like the Dell has a trunk on Po1, but the other ports are access ports. It also looks like the Dell has no native VLAN set on Po1.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-17T14:48:26.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24498" PostTypeId="1" AcceptedAnswerId="24502" CreationDate="2015-11-17T15:46:13.067" Score="5" ViewCount="814" Body="&lt;p&gt;Must the receiver know the generator polynomial in order to detect the errors in the received data?&lt;br&gt;&#xA;So how does it know what generator polynomial the sender has used? &lt;/p&gt;&#xA;" OwnerUserId="20756" LastEditorUserId="51281" LastEditDate="2018-10-31T03:45:51.190" LastActivityDate="2018-10-31T03:45:51.190" Title="In Cyclic Redundancy Check, how does the receiver knows what the generator polynomial is?" Tags="|layer2|errors|checksum|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24500" PostTypeId="1" AcceptedAnswerId="24501" CreationDate="2015-11-17T15:56:27.740" Score="1" ViewCount="99" Body="&lt;p&gt;I have a practical doubt. Can someone explain to me if i can connect 2 networks equipments using XFP and SFP+, MM the two, accross a SM fiber, ´cause i recently made the escenario and did not work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2 connectors, XFP and SFP+ work on 850 nm, on a distance of 300m, every of that a just checked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The link never came up, but the same link where connected to other slot using 1Gb SFP and instantly came UP.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-11-17T16:00:17.563" Title="About Optic Fiber Connection" Tags="|fiber|sfp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24501" PostTypeId="2" ParentId="24500" CreationDate="2015-11-17T16:00:17.563" Score="2" Body="&lt;p&gt;Multimode SFPs (MM) are incompatible with singlemode (SM) fiber.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-17T16:00:17.563" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24502" PostTypeId="2" ParentId="24498" CreationDate="2015-11-17T16:16:02.380" Score="8" Body="&lt;p&gt;It's true that you have to know it in advance in order to calculate the CRC.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The correct polynomial depends on the application of the CRC.   For Ethernet, for example, the CRC-32 polynomial is part of the IEEE 802.3 standard.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For you trivia buffs, it's &lt;code&gt;0x82608EDB&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="8499" LastEditDate="2015-11-17T16:17:51.690" LastActivityDate="2015-11-17T16:17:51.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24503" PostTypeId="1" AcceptedAnswerId="24505" CreationDate="2015-11-17T16:34:28.907" Score="2" ViewCount="1715" Body="&lt;p&gt;I have a new Cisco Meraki Switch that is replacing a DellForce10 switch that is already in place. I need to configure the Meraki switch to how the Dell switch is setup.  The only thing that is significant with the switch and how they are setup is the use of VLAN's.  On the Dell switch I do not believe there is a Native VLAN setup on it as seen below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NUM    Status    Description                     Q Ports&#xA;1      Active                                    T Po1(Gi 0/21-22)&#xA;                                                 U Gi 0/9&#xA;102    Active    Wireless                        T Po1(Gi 0/21-22)&#xA;                                                 U Gi 0/18,20&#xA;105    Active    DHCP_Clients                    T Po1(Gi 0/21-22)&#xA;                                                 U Gi 0/1-8,10,12-17,19&#xA;106    Active    Static_Clients                  T Po1(Gi 0/21-22)&#xA;109    Active    Production                      T Po1(Gi 0/21-22)&#xA;110    Active    VOIP                            T Po1(Gi 0/21-22)&#xA;112    Active    Management                      T Po1(Gi 0/21-22)&#xA;220    Active    Printers                        T Po1(Gi 0/21-22)&#xA;                                                 U Gi 0/11&#xA;999    Inactive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To my understanding the Native VLAN will be left at 1 on the Meraki switch?  The Meraki switch is a 48 port switch with four fiber ports, and the network connection for the switch will be setup with the connection coming through the fiber port 49.  Would I have Port 49 setup to configure as type would be trunk, Native VLAN 1, and Allowed VLAN all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then would I have all of the ports 1-48 setup as access ports?&#xA;So if we were to go by the Dell VLAN setup from above.  On port 1, would I have it setup as Type: access, VLAN: 105? Below is what I am seeing for the window for the configuration of port 1/1.&#xA;If someone could please help me in trying to figure out if this is the right way to set up the new switch as the old one? Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UPMuM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UPMuM.png&quot; alt=&quot;Meraki Port 1 Setup&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20754" LastEditorUserId="8499" LastEditDate="2018-03-18T20:05:57.400" LastActivityDate="2018-03-18T20:05:57.400" Title="Setting up a new Meraki MS220-48FP Switch to replace a pre-existing DellForce10 Switch" Tags="|vlan|spanning-tree|trunk|dell|meraki|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24504" PostTypeId="2" ParentId="24494" CreationDate="2015-11-17T16:37:07.203" Score="3" Body="&lt;p&gt;The Tx-Power value is represented in dBm. This is a relative measure, specifically dB relative to a milliWatt. Wikipedia has a good &lt;a href=&quot;https://en.wikipedia.org/wiki/DBm&quot; rel=&quot;nofollow&quot;&gt;page on dBm&lt;/a&gt; that covers the formulas to covert this to &lt;a href=&quot;http://www.rapidtables.com/convert/power/mW_to_dBm.htm&quot; rel=&quot;nofollow&quot;&gt;actual power levels&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is my understanding that the Tx-power value provided by iwconfig is a representation of the TX power output of the radio. When it comes to OFDM wireless (most 802.11), the signal strength is relatively uniform across the width of the channel (there isn't really a &quot;peak&quot; at the center frequency).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where things become unclear for me in Linux is how the antenna gain is accounted for in the configuration (I have never researched this thoroughly, so the answer is probably out there). The adapter can't detect the gain of an antenna, so this should be configured or accounted for somewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example if you are legally allowed to transmit at 100mW, iwconfig will typically show a TX power of 20dBm (100mW). However the antenna gain is added to this, so if you have a 3dBi antenna, this would result in a TX power of 23dBm or 200mW. With this 3dBi antenna, the radio TX power should be set to 17dBm to match the allowed 100mW TX power.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If iwconfig assumes a certain type of antenna (possibly based on adapter type?), you may be required to reduce the radio TX power if you use a higher gain antenna.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-11-18T14:47:33.847" LastActivityDate="2015-11-18T14:47:33.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24505" PostTypeId="2" ParentId="24503" CreationDate="2015-11-17T16:50:58.177" Score="2" Body="&lt;p&gt;As far as the VLAN for access port 1, that looks like what you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on how you have STP configured on the network, you should think about using RSTP. Also, STP guard on the access ports may be a good thing to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default native VLAN is 1, but you don't need a native VLAN, or you can set it to any VLAN. This is only relevant for trunk ports.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-17T16:50:58.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24510" PostTypeId="1" AcceptedAnswerId="24571" CreationDate="2015-11-17T19:59:54.320" Score="3" ViewCount="2471" Body="&lt;p&gt;I read on &lt;a href=&quot;https://www.novell.com/documentation/nbm38/?page=/documentation/nbm38/overview/data/ae70q0b.html&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt; that in TCP ACK bit filtering, only packets with the ACK bit set are allowed into a network, so that the firewall knows that those packets were requested by users within that network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Okay, so I know that the ACK bit is set for TCP acknowledgement packets.  But what else is it used for?  What if users on the local intranet are requesting web pages?  Will the ACK bit be set for the HTTP responses that contain the web pages requested by the users of the network?  They would have to, or else the packets would be dropped by the firewall.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But HTTP and TCP work at completely different layers, so it doesn't make sense that TCP would be able to set the ACK flag for HTTP.  I mean, how would it know that the packets are HTTP responses?  But that's the only way I can think of that users on the local network would be able to use web services outside the network, because otherwise, the only thing the firewall would let into the network would be TCP acknowledgement packets, which are basically useless to the end user.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help me understand this?  I'm very confused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; I think my confusion stemmed from a misunderstanding of how TCP works.  I thought that a separate TCP session was maintained for each message sent from one host to another, i.e. one TCP session for the HTTP request and another TCP session for the HTTP response.  If this were the case, the ACK flag would not be set for the HTTP response packets, and they would be dropped.  In fact, basically no useful application layer communication would be allowed into the network if this were the case.  Thanks to &lt;a href=&quot;http://packetlife.net/blog/2010/jun/7/understanding-tcp-sequence-acknowledgment-numbers/&quot; rel=&quot;nofollow&quot;&gt;this article&lt;/a&gt;, I now understand that a single connection is maintained for the entire session, including the request and the response.&lt;/p&gt;&#xA;" OwnerUserId="20762" LastEditorUserId="20762" LastEditDate="2015-11-18T20:45:49.347" LastActivityDate="2015-11-19T16:41:40.000" Title="Is the TCP ACK bit set for things like HTTP responses?" Tags="|firewall|tcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24511" PostTypeId="1" AcceptedAnswerId="24805" CreationDate="2015-11-17T21:06:31.167" Score="1" ViewCount="1087" Body="&lt;p&gt;Is there a way to make libpcap compatible packet captures using Dell Force 10 switches? Or at least a way to show real time packet activity that will display something similar to the console output of tcpdump or snoop?&lt;/p&gt;&#xA;" OwnerUserId="500" LastActivityDate="2015-11-28T17:31:09.700" Title="Force 10 packet capture" Tags="|force10|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24512" PostTypeId="2" ParentId="24510" CreationDate="2015-11-17T22:07:04.370" Score="2" Body="&lt;p&gt;You are right: HTTP and TCP are located at different layers.&#xA;TCP will let a connection be established. When the connection is established streams are bidirectional. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firewall will only work at the TCP layer anyway, so you can forget HTTP, completely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say you want your users to connect to the outside on port 80. You would let every IP datagram, protocol TCP, dst port 80 go to the outside.&#xA;It isn't suffiscient as you must add a rule to let traffic go back from Internet to your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would just let everything in but SYN only (SYN/ACK are ok). &#xA;This documentation suggest letting only ACK packet return, which seems also quite correct to me (but not totally: FIN or RESET packets could be sent by the remote side first, without ACK as far as I know).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that ACK is just a flag: the real data is in the TCP segment, so you would have your application data in it (here http).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stateless filters are still in use for high traffic, low budget firewalls.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-17T22:07:04.370" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24517" PostTypeId="1" CreationDate="2015-11-18T07:39:17.730" Score="1" ViewCount="1673" Body="&lt;p&gt;I am currently planning a voice network and test different ways. Currently a classic IP network with various Cisco Routers is used to bound different media (fiber, copper, MPLS) and route to a classic SBC. The SBC routes the calls to the Asterisk machine, with load balancing and failover.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because I'm looking for a pragmatic solution which is redundant. Therefore, I have considered the SBC's from CISCO, I read that Cisco calls the system CUBE and &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-series-aggregation-services-routers/white_paper_c11-540690.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco say it is a carrier-grade SBC&lt;/a&gt;. I would prefer an ASR 1009x with two routing processing units (with two ESP Module) and the licenses for the CUBE. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have experience with the CUBE as SBC in the ISP Environment? We expect traffic per location of approx 3,000 concurrent calls and about 25 SIP trunks. Does anyone have experience with the daily Tasks a SBC brings in? What are the difference to a classic SBC?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a sketch of the current infrastructure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/W8wIL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/W8wIL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To explain what I want to do I will show a few tasks that our SBC now brings in:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;create new Endpoints (registered and static) &lt;/li&gt;&#xA;&lt;li&gt;SIP and H.323 Support&lt;/li&gt;&#xA;&lt;li&gt;Easy Support Codecs like G.711 G.721 or some exotic Codecs (easy to reload)&lt;/li&gt;&#xA;&lt;li&gt;can I do a header manipulation of SIP packets&lt;/li&gt;&#xA;&lt;li&gt;is it possible to do a normalization (NPI,TON of CDPN or CGPN)&lt;/li&gt;&#xA;&lt;li&gt;How I can trace the Calls? PCAP for each call or any other Concept?&lt;/li&gt;&#xA;&lt;li&gt;User management to delegate tasks to other user with access rules&lt;/li&gt;&#xA;&lt;li&gt;CDR export for billing Issues&lt;/li&gt;&#xA;&lt;li&gt;Loadshare or loadbalancing algorithms like (hunt high, hunt low, percentage ...) &lt;/li&gt;&#xA;&lt;li&gt;Backup and Restore process &lt;/li&gt;&#xA;&lt;li&gt;SQL integration of CDR and configuration&lt;/li&gt;&#xA;&lt;li&gt;SNMP functionality to insert SBC into monitoring environment &lt;/li&gt;&#xA;&lt;li&gt;Is the amount of simultanous Calls limited to 16.000 Calls (this is&#xA;onyl approx 1,5 GBit/s and we have a 40GBit ESP in the ASR Router)&lt;/li&gt;&#xA;&lt;li&gt;CUBE supports RLT and SIP Call transfer, anyone use it to connect two Calls together, for routing Issues to reduce number of needed licenses?&lt;/li&gt;&#xA;&lt;li&gt;It is possible to capture Calls directly on the Router for quality monitoring&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what function is implemented and what function not implemented in a Cisco CUBE?&lt;/p&gt;&#xA;" OwnerUserId="20772" LastEditorUserId="20772" LastEditDate="2015-11-24T15:30:22.957" LastActivityDate="2015-11-25T16:43:44.700" Title="CISCO CUBE is as SBC suitable for ISP" Tags="|cisco|routing|voip|voice|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="24520" PostTypeId="1" AcceptedAnswerId="24534" CreationDate="2015-11-18T12:14:03.610" Score="2" ViewCount="6716" Body="&lt;p&gt;After visiting a simple webpage at my browser, how can I check how many data containing TCP segments carried the HTTP response and the text file, in Wireshark? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I check the Packet List window I find x TCP segments, but if I check the Packet Details window for the &quot;HTTP 200 OK&quot; response it says that there were x+1 Reassembled TCP segments. This extra TCP segment is the &quot;HTTP 200 OK&quot; response. Do we have to count this packet as well?&lt;/p&gt;&#xA;" OwnerUserId="20764" LastActivityDate="2015-11-18T17:46:47.600" Title="Number of TCP segments for HTTP response - Wireshark" Tags="|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24522" PostTypeId="2" ParentId="24517" CreationDate="2015-11-18T14:30:59.843" Score="1" Body="&lt;p&gt;According to this Cisco document, &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-series-aggregation-services-routers/white_paper_c11-540690.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Unified Border Element (SP Edition) on Cisco ASR 1000 Series&lt;/a&gt;, CUBE on the ASR 1000 series is designed for carrier-grade use:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Cisco® Unified Border Element (SP Edition) is a high-scale,&#xA;  &lt;strong&gt;&lt;em&gt;carrier-grade&lt;/em&gt;&lt;/strong&gt; Session Border Controller (SBC), which is integrated&#xA;  into Cisco routing platforms and can use a huge number of router&#xA;  functions to provide a very feature-rich and intelligent SBC&#xA;  application.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The document includes some drawings and explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has many documents which explain all of the features. For instance, &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/unified-communications/unified-border-element/data-sheet-c78-729692.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Unified Border Element Version 10.0.2 Data Sheet&lt;/a&gt; has a table which answers most of your list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CUBE also has a &lt;a href=&quot;https://developer.cisco.com/site/uc-gateway-services/overview/&quot; rel=&quot;nofollow&quot;&gt;programming interface&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information, start with &lt;a href=&quot;http://www.cisco.com/c/en/us/products/unified-communications/unified-border-element/index.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Unified Border Element&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco is more than happy to give you specifics to any question you may have.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-19T08:04:33.097" LastActivityDate="2015-11-19T08:04:33.097" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="24523" PostTypeId="2" ParentId="20646" CreationDate="2015-11-18T14:36:58.650" Score="1" Body="&lt;p&gt;Another thing that you can do is change your ssh configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to change your&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip ssh version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;from 1 to 2, to IMPROVE your security, ssh version 1 is an old configuration&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-11-18T14:36:58.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24525" PostTypeId="2" ParentId="20646" CreationDate="2015-11-18T14:56:26.707" Score="1" Body="&lt;p&gt;Just a few things to get you started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router MGMT Security &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;Service password-encryption&quot; for plain-text encryption of &quot;password&quot;s. &lt;/li&gt;&#xA;&lt;li&gt;&quot;IP SSH version 2&quot;.&lt;/li&gt;&#xA;&lt;li&gt;&quot;No CDP run&quot; command.&lt;/li&gt;&#xA;&lt;li&gt;&quot;transport input ssh&quot; on VTY ports.&lt;/li&gt;&#xA;&lt;li&gt;Access-class commands on VTY ports (with associated ACLs).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Router Networking Security&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;No IP redirects/no ip unreachables/no ip proxy-arp on interface ports. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20619" LastActivityDate="2015-11-18T14:56:26.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24527" PostTypeId="1" AcceptedAnswerId="24531" CreationDate="2015-11-18T15:22:30.763" Score="1" ViewCount="156" Body="&lt;p&gt;How and what IP address should i apply between the connections of the routers in the diagram below? Do I need to make 5 subnets each to one router-router connection? Like &lt;code&gt;192.168.0.1/30&lt;/code&gt; to one router and &lt;code&gt;192.168.0.2/30&lt;/code&gt; to second router etc., or only one subnet for all routers? Could someone explain me that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would a network (in that scheme) be more efficient than a network with only one router, or would DHCP addressing would be too much for one router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JFlFl.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JFlFl.jpg&quot; alt=&quot;The scheme&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20733" LastEditorUserId="8499" LastEditDate="2015-11-19T01:45:12.973" LastActivityDate="2015-11-19T01:45:12.973" Title="How should I address the routers?" Tags="|router|subnet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24528" PostTypeId="2" ParentId="24484" CreationDate="2015-11-18T15:27:28.627" Score="1" Body="&lt;p&gt;Take a look at scapy: &lt;a href=&quot;http://www.secdev.org/projects/scapy/&quot; rel=&quot;nofollow&quot;&gt;http://www.secdev.org/projects/scapy/&lt;/a&gt; and tcpdump/wireshark. With the former you can generate any ICMP packet, with the later you can &lt;em&gt;see&lt;/em&gt; what your generated packets look like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your router has certainly a default route. Remove it and it should generate the ICMP messages you are looking for.&#xA;Alternatively, try this command on a host that doesn't have a DNS service:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dig example.com @[host]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The server will answer with an ICMP type 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These codes are still in use. I would specifically look at &lt;em&gt;time exceeded&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-18T15:27:28.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24529" PostTypeId="2" ParentId="24478" CreationDate="2015-11-18T15:37:40.577" Score="-1" Body="&lt;p&gt;Layer 2 redundancy is slow to converge. Spanning-tree is not a protocol meant to assure redundancy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also be careful that layer2 is not routed: usually one of your red link will be cut by the protocol. That means that for a host plugged on floorSw5 to speak to a host on floorSw1, it will not be routed directly via: distSw2 -&gt; distSw1 -&gt; floorSw1, even if it would take less hops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last but not least, spanning tree is based on timeouts, which means that you are not allowed to cascade more than 7 switches (you already have 6).&#xA;If for some reason you artificially lower the timeouts, this setup may become less stable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can not come with a full layer3 network, I would suggest looking at the next generation datacenter switches with network fabric and trill (which is basically a routing infrastructure for layer2 devices).&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-18T15:37:40.577" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24530" PostTypeId="2" ParentId="24483" CreationDate="2015-11-18T15:53:31.380" Score="2" Body="&lt;p&gt;You get a high number of input drops if your device cannot service the input queue fast enough. There can be many reasons for this. For instance, routing policies or other services which cause process switching will slow your CPU and increase the number of input drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a document, &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/10000-series-routers/6343-queue-drops.html&quot; rel=&quot;nofollow&quot;&gt;Troubleshooting Input Queue Drops and Output Queue Drops&lt;/a&gt;, which discusses the problem:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Input Queue Drops&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When a packet enters the router, the router attempts to forward it at&#xA;  interrupt level. If a match cannot be found in an appropriate cache&#xA;  table, the packet is queued in the input queue of the incoming&#xA;  interface to be processed. Some packets are always processed, but with&#xA;  the appropriate configuration and in stable networks, the rate of&#xA;  processed packets must never congest the input queue. If the input&#xA;  queue is full, the packet is dropped.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Here is a sample output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show interfaces ethernet 0/0 &#xA;...&#xA;Input queue: 30/75/187/0 (size/max/drops/flushes); Total output drops: 0 &#xA;Output queue :0/40 (size/max)...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;In this sample output, there is no way to see exactly which packets&#xA;  have been dropped. In order to troubleshoot input queue drops, you&#xA;  must find out which packets fill the input queue. In this example, 30&#xA;  packets are in the input queue of interface ethernet0/0 when the &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_3/interface/command/reference/int_s3g.html#wp1140060&quot; rel=&quot;nofollow&quot;&gt;show&#xA;  interfaces ethernet 0/0&lt;/a&gt; command is issued. The queue depth is 75&#xA;  packets and there have been 187 drops since the interface counters&#xA;  were last cleared.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The system counts input queue drops if the number of packet buffers&#xA;  allocated to the interface is exhausted or reaches its maximum&#xA;  threshold. You can increase the maximum queue value with the&#xA;  &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_3/interface/command/reference/int_d1g.html#wp1142192&quot; rel=&quot;nofollow&quot;&gt;hold-queue&lt;/a&gt; &lt;em&gt;&lt;/em&gt; command for each interface (the queue length&#xA;  value can be between 0 and 4096. The default value is 75).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Shared-memory routers (1600, 2500, and 4000 series), also use the input queue for fast-switched traffic. If you get input queue&#xA;  drops on those platforms, ensure that all traffic uses the best&#xA;  switching path available (see &lt;a href=&quot;http://www.cisco.com/en/US/products/sw/iosswrel/ps1831/products_tech_note09186a00800a7306.shtml&quot; rel=&quot;nofollow&quot;&gt;Performance Tuning Basics&lt;/a&gt;). Input&#xA;  queue drops generally occur when a packet is process-switched. A&#xA;  process switch means that the router cannot use a preferable&#xA;  route-cache method, such as fast switching or Cisco Express Forwarding&#xA;  (CEF), to handle the forwarding decision. If input drops are still&#xA;  present, it implies that there is simply too much traffic. Consider a&#xA;  hardware upgrade, or try to decrease the traffic load.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;These are the conditions for input queue drop counter. They usually&#xA;  occur when the router receives bursty traffic and cannot handle all&#xA;  packets.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The Rx FIFO which is accessible by the interface PHY and interface    DMA is full and any new frames that arrive in this condition will be&lt;br&gt;&#xA;  dropped (normally called as overflow) and the rx_overflow counter&lt;br&gt;&#xA;  (seen through &lt;strong&gt;show controller&lt;/strong&gt; &lt;em&gt;interface-id&lt;/em&gt;) will be&lt;br&gt;&#xA;  incremented. When rx_overflow counter is incremented by one, it&lt;br&gt;&#xA;  indicates that overflow condition has occurred once and is not&lt;br&gt;&#xA;  indicative of the number of frames dropped.&lt;/li&gt;&#xA;  &lt;li&gt;The Rx ring which is accessible by the interface DMA and interface    driver code is full. Any new frame transfers from the DMA cannot&lt;br&gt;&#xA;  proceed with this condition, since there are no free entries in Rx&lt;br&gt;&#xA;  ring and hence the frames sent are dropped (termed as overrun&lt;br&gt;&#xA;  condition). The rx_int_drop counter (seen through &lt;strong&gt;show controller&lt;/strong&gt; &#xA;  &lt;em&gt;interface-id&lt;/em&gt;) is also incremented by one. Again, if rx_int_drop is incremented by one it indicates that there is one occurrence of an&lt;br&gt;&#xA;  overrun condition, and the number of frames dropped is not known.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;The input hold queue size can be increased from the default 75&#xA;  packets. The hold queue stores packets received from the network that&#xA;  wait to be sent to the client. Cisco recommends that the queue size&#xA;  not exceed ten packets on asynchronous interfaces. For most other&#xA;  interfaces, queue length must not exceed 100. The input hold queue&#xA;  prevents a single interface from flooding the network server with too&#xA;  many input packets. Further input packets are discarded if the&#xA;  interface has too many input packets outstanding in the system.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(conf-if)# hold-queue length in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;For Catalyst Switches, Cisco recommends to make this adjustment on all&#xA;  L3 interfaces on the device, both physical interfaces and VLAN&#xA;  interfaces. L2 ports configured with the &lt;strong&gt;switchport&lt;/strong&gt; command can be&#xA;  left at the default value.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; After you apply this command, you need to clear the interface counters and then monitor the network.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Caution:&lt;/strong&gt; An increase in the hold queue can have detrimental effects on network routing and response times. For protocols that use&#xA;  SEQ/ACK packets to determine round-trip times, do not increase the&#xA;  output queue. Dropping packets instead informs hosts to slow down&#xA;  transmissions to match available bandwidth. This is generally better&#xA;  than duplicate copies of the same packet within the network, which can&#xA;  happen with large hold queues.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-18T15:53:31.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24531" PostTypeId="2" ParentId="24527" CreationDate="2015-11-18T15:53:34.500" Score="1" Body="&lt;p&gt;Your first ponit is rigth, you need to separate each Point to Poin link between routers in one subnet, like you said:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.0.0/30 &#xA;192.168.0.4/30&#xA;192.168.0.8/30&#xA;192.168.0.12/30&#xA;192.168.0.16/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Always taken one IP for the centra router and other for the edges routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with one subnet is WRONG because one subnet if for SWITCHES, not for routers, routers DIVIDE broadcast segments, and one subnet is that, one boradcast segment. Every port of the router must be located on a different subnet, on the way to ROUTE traffic form one to other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think, this one could be a rela scenario, remember that major clients connect to it ISP accross a DSL, a modem-router, and then, the ISP, seeing like your central router, ROUTE the traffic from and to internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are plannig this scenario to some enterprise, or something like that, you can less behind the 5 edge routers on your scheme, and only use the central router. With that, you can save money of that 5 2811 routers, and also your network will work FINE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you can configure a DHCP server, to provide the addressing oon every subnet (every port), saving if you like, the first or the last one IP address of that subnet to your router port.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-11-18T15:53:34.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24534" PostTypeId="2" ParentId="24520" CreationDate="2015-11-18T17:46:47.600" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;When I check the Packet List window I find x TCP segments&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Do you mean &quot;I find x rows that say &quot;[TCP segment of reassembled PDU]&quot;?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;but if I check the Packet Details window for the &quot;HTTP 200 OK&quot; response it says that there were x+1 Reassembled TCP segments. This extra TCP segment is the &quot;HTTP 200 OK&quot; response. Do we have to count this packet as well?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you mean &quot;do I have to count more than the segments whose Info column just says &quot;[TCP segment of reassembled PDU]&quot;, the answer is &quot;yes&quot; - when the last segment is seen, the HTTP request or response is dissected, and information about that request or response is put into the Info column.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't assume the only segments in a request or response are the ones labeled as &quot;[TCP segment of reassembled PDU]&quot;.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2015-11-18T17:46:47.600" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24535" PostTypeId="1" AcceptedAnswerId="24551" CreationDate="2015-11-18T17:50:18.103" Score="1" ViewCount="5705" Body="&lt;p&gt;I currently have a VPN server running and I am attached to it as a client. The current setup is such that &lt;em&gt;only&lt;/em&gt; routes 10.0.0.0/16 are tunnelled through the VPN. Additionally, I push Amazon's internal DNS server (10.0.0.2) to the client so if I hit any of my private hosted zones then Route 53 will take care of the redirection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how can I route a specific URL to tunnel through the VPN? For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;google.com -&amp;gt; local wifi&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;abc.com -&amp;gt; vpn&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;abc.com&lt;/code&gt; is my specified URL that I want to make sure gets tunneled.&lt;/p&gt;&#xA;" OwnerUserId="20786" LastActivityDate="2018-04-27T11:13:41.297" Title="How to force a specific URL to tunnel through VPN (OpenVPN)?" Tags="|vpn|" AnswerCount="1" CommentCount="3" ClosedDate="2018-04-27T11:18:01.137" ContentLicense="CC BY-SA 3.0" />
  <row Id="24536" PostTypeId="1" CreationDate="2015-11-18T17:51:14.050" Score="8" ViewCount="3807" Body="&lt;h1&gt;&lt;strong&gt;Summary&lt;/strong&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;My ultimate goal is to run a VPN through my Cisco Router, which to me means getting the Comcast Gateway out of the way.  To this end, I would like to place my Cisco Router (and/or Switch) &lt;em&gt;logically&lt;/em&gt; closer to the WAN and remove my Comcast Modem as a &lt;em&gt;logical&lt;/em&gt; device. I cannot really remove the modem (it provides the WAN access, after all), however, I do not need its DHCP, NAT or firewall services. I'd like configuration advice.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;&lt;strong&gt;Details&lt;/strong&gt;&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Here's my current network setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Comcast Gateway - Cisco Router - Cisco Switch &amp;lt; LAN &amp;amp; Wifi (Ruckus)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Comcast Modem: TC8305C&lt;/li&gt;&#xA;&lt;li&gt;Cisco Router: 1941-sec/k9 + ehwic-4esg&lt;/li&gt;&#xA;&lt;li&gt;Cisco Switch: 2960S 48TS-L (Multi-layer switch, VLANs, etc.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Modem runs as DHCP Server, NAT and firewall with inside address 10.0.0.1/24. The Router's WAN port is connect to it with a dynamic address (DHCP client). On the Router's LAN side, it is also running NAT (yes, double NAT'ed, for now), DHCP Server, DNS, NTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thoughts on options are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Run Modem in Bridge Mode.&lt;/li&gt;&#xA;&lt;li&gt;Place Router in Modem's DMZ.&lt;/li&gt;&#xA;&lt;li&gt;One variation on 1&amp;amp;2 is to connect Modem to switch.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;Modem In Bridge Mode&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I tried to set the Modem into Bridge mode and had a very unpleasant 90 minute period where my internet access was down and had to endure some very angry users. I'm guessing I failed to configure the Router WAN port correctly. Probably because it was in DHCP mode. I'd like to try to set it to a static address (e.g. 10.0.0.2/24), however I'm a little gun shy about Bridge Mode, right now.  Google generates plenty of hits when searching for &quot;Comcast Bridge Mode&quot;, however I haven't been able to make much use of what I found.  I haven't been able to find a good incantation for Router WAN port configuration with Comcast Bridge mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside, the Comcast bridge isn't entirely transparent, the Modem retains its IP address (10.0.0.1) to which I can connect via http and reconfigure (fortunately) when I attach a laptop directly to it Port 1 on the Modem. So, my laptop understands how to deal with the Modem in bridge mode, even if the Router does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also confused how in Bridge Mode the Router gets dynamic settings from Comcast ISP (for DNS and default Gateway, etc.) like it would with DHCP. Or, if these are not really dynamic and I should just hard code them in the Router configuration file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe this is the best option for the network because the Modem steps out of the way completely and the Router can run security, VPN, DDNS, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I be doing to make this work?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Router in Modem DMZ&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here, I can finese whatever configuration problems I might be having and just drop the Router (with a static IP of, say, 10.0.0.2/24) into the Modem's DMZ and let all internet traffic be forwarded to this. There's not a whole lot different between this configuration and the one above, except that the Modem is still acting like a Layer 3 device (well, even more like a Layer 3 device). I'm fairly certain I can get this working and I see no reason why I couldn't get VPN working through the Router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The one drawback here is that the Modem only provides for dyndns.org for running Dynamic DNS. I have no opinion about this organization as a DDNS provider, however, I'd like a choice of vendors, something the Router would allow. Also,  the engineer in me wants as little unnecessary processing on the WAN path, so bridging the Modem just feels better.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Run Modem through Switch&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;When I chatted with a Network Engineer a while back, he suggested that I could run the Modem directly into the Switch. We didn't go into details regarding the configuration. My assumption is that either of the above scenarios (Bridge or DMZ) could work just as well into the Switch directly with the following provisions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Proper ACL set up on the Switch/Modem Port to prevent external attacks.&lt;/li&gt;&#xA;&lt;li&gt;Separate VLAN for Modem &amp;amp; Router communication to forward incoming DMZ traffic to the Router. Incoming traffic should be limited to VPN traffic. All other traffic (TPC, UDP, ICMP) would be blocked for security purposes. The same ACLs that would be on WAN side of Router.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm guessing he recommeneded this set up because by placing the Modem on the Switch directly, you take advantage of the Switch's ability to short cut IP packets after connection establishment. That is, once an internal device connects through the Modem (presumably, connection establishment started with VLANs on the Router), the Switch recognizes this and routes all relevant IP packets directly between the internal device and the modem, skipping the Router. This cannot occur in the physical configuration under which the Modem and the Switch are on Router ports.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Wrap Up&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What should my Router's WAN Port configuration look like to ensure it works with a Comcast Modem in Bridge mode? Are there any other config options I should look out for (like DNS servers)?&lt;/li&gt;&#xA;&lt;li&gt;Alternatively, should I &lt;em&gt;settle&lt;/em&gt; for placing the Router in the DMZ?&lt;/li&gt;&#xA;&lt;li&gt;Is it worth reconfiguring and moving the Modem to a Switch Port for either #1 or #2?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="5618" LastActivityDate="2022-01-31T19:41:33.397" Title="Advice for network &amp; device configuration using Comcast Modem?" Tags="|cisco|switch|router|vpn|bridge|" AnswerCount="4" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="24537" PostTypeId="2" ParentId="24536" CreationDate="2015-11-18T18:22:32.963" Score="2" Body="&lt;p&gt;When you have the modem in bridge mode, your laptop works because it is using DHCP to get its IP address and other information from Comcast. You will need to set the router to do the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this same setup with a my cable Internet provider with a Cisco ISR G2 router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description WAN&#xA; ip address dhcp&#xA; ip access-group WAN_Firewall in&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip nat outside&#xA; ip inspect WAN_Inspect out&#xA; ip virtual-reassembly in&#xA; ip verify unicast source reachable-via rx allow-default 100&#xA; load-interval 30&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA; service-policy output QoS-WAN-Out&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You need to have your router receive DHCP for its WAN address. You will also need to configure NAT and DHCP (unless you have that on another server) on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The full configurations for your firewall, NAT, DHCP, etc. are too broad to cover.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-18T18:22:32.963" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="24538" PostTypeId="1" AcceptedAnswerId="24539" CreationDate="2015-11-18T18:31:41.410" Score="1" ViewCount="141" Body="&lt;p&gt;Several references of the OSI model states the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A layer serves the layer above it and is served by the layer below it.&lt;/li&gt;&#xA;&lt;li&gt;Each layer provides services to the next-higher layer and shields the upper layer from the details of how the services below it are actually implemented.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Therefore, the Network Layer (#3) should provide services for the Transport Layer (#4) and not the other way around. However, there are some routing protocols (Network Layer) that uses UDP and TCP services (Transport Layer), for example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RIP (Routing Information Protocol) uses UDP&lt;/li&gt;&#xA;&lt;li&gt;BGP (Border Gate Protocol) uses TCP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How do we reconcile that? Am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="20647" LastActivityDate="2015-11-18T18:41:05.543" Title="OSI Model: serving a layer bellow" Tags="|osi|" AnswerCount="1" CommentCount="0" ClosedDate="2015-11-18T18:43:24.000" ContentLicense="CC BY-SA 3.0" />
  <row Id="24539" PostTypeId="2" ParentId="24538" CreationDate="2015-11-18T18:41:05.543" Score="1" Body="&lt;p&gt;This is the same answer (copied and pasted) for this question: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/24255/in-which-osi-tcp-ip-model-layers-do-bgp-rip-protocols-belong&quot;&gt;In which OSI/TCP-IP model layers do BGP, RIP protocols belong?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to remember that models like OSI are just that, models. They are theoretical. The real world doesn't fall neatly into these models. For the most part, routing is a layer-3 function, but, as you pointed out, BGP uses a layer-4 protocol to communicate with other BGP speakers in order to do what is normally considered a layer-3 function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many network protocols fall into a gray area, or are considered in one layer while using another layer. Take ARP for instance. It resolves layer-3 addresses to layer-2 addresses. Which layer should it be considered to be in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understanding the models is useful, but the models are not mandated by any organization, and you are free to create protocols and functions that do not follow any model.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-11-18T18:41:05.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24540" PostTypeId="1" AcceptedAnswerId="24542" CreationDate="2015-11-18T19:20:34.713" Score="3" ViewCount="6034" Body="&lt;p&gt;On a SonicWALL TZ105, I have a LAN with the IP address of 172.16.20.1 &amp;amp; netmask of 255.255.255.0. I defined a VLAN with the IP address of 172.16.21.1 &amp;amp; a netmask of 255.255.255.0. Both are on physical port X0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already have many PCs on the LAN pointing to gateway 172.16.20.1, but when I tried to add a PC to the VLAN pointing to gateway 172.16.21.1, it doesn't work. I can't even ping 172.16.21.1 from the VLAN PC and it can't access anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the PCs are on the same managed switch (D-Link DES-3028) which supports VLANs. I even defined ports that connect to the SonicWALL and the VLAN PC as VLAN trunks, but the VLAN simply doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does one debug VLAN problems? I am simply hitting a brick wall here.&lt;/p&gt;&#xA;" OwnerUserId="11931" LastEditorUserId="8499" LastEditDate="2015-11-19T15:25:27.780" LastActivityDate="2017-09-27T13:06:18.313" Title="I can't get a VLAN to talk to the LAN on a SonicWALL" Tags="|routing|vlan|sonicwall|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24542" PostTypeId="2" ParentId="24540" CreationDate="2015-11-18T20:17:22.943" Score="4" Body="&lt;p&gt;Well, you normally don't make the port that the PC &quot;on the VLAN&quot; connects to a &lt;strong&gt;trunk&lt;/strong&gt;, and that's probably the bulk of your problem. So the PC isn't actually ON the VLAN, regardless of what you set its IP address to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PC conection port should be set to be a member of the VLAN, the VLAN should be that port's PVID, and the VLAN should go untagged out the port, and tag anything coming in untagged from that port. Normally you also want to remove that port from the &quot;default&quot; VLAN, or the VLAN your LAN runs on if you use a non-default VLAN for that purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An untagged, PVID'd port on the VLAN in question is the usual way that VLAN problems are debugged. In your case, that should also solve the problem, assuming the SonicWall and its port are set up right. In more extensive setups, you make sure that the &quot;plain untagged port on the VLAN&quot; works as expected and then you can run down problems with things that used tagged/trunked ports, knowing that if the VLAN gets to the switch you tested the untagged port on, it was working there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, your LAN is on VLAN1, untagged, the SonicWall port from the switch should have VLAN1 as the PVID untagged, but also have/be on VLAN12, tagged. The PC-on-the-VLAN12 port should be removed from VLAN1, have VLAN12 as it's PVID and be untagged and on VLAN12. The PC does not need to know anything about what VLAN it is on.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2015-11-19T12:15:44.517" LastActivityDate="2015-11-19T12:15:44.517" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24544" PostTypeId="2" ParentId="18959" CreationDate="2015-11-18T21:10:40.343" Score="2" Body="&lt;p&gt;If the syntax is for 8.2, you need to use &lt;code&gt;nat 0&lt;/code&gt;, something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside) 0 access-list azure-vpn-acl&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This guy has done a fantastic article relating to a PIX 501, but it should work for a 5500 series pre-8.3. I am trying this on a 5510 with 8.2: &lt;a href=&quot;https://hikmatkanaan.wordpress.com/2013/07/04/create-azure-site-to-site-vpn-solution-using-cisco-pix-501/&quot; rel=&quot;nofollow&quot;&gt;Create Azure Site-to-Site VPN Solution using Cisco Pix 501&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20790" LastEditorUserId="8499" LastEditDate="2016-03-18T00:20:23.013" LastActivityDate="2016-03-18T00:20:23.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24545" PostTypeId="1" AcceptedAnswerId="24559" CreationDate="2015-11-18T22:48:31.707" Score="3" ViewCount="2362" Body="&lt;p&gt;I desperatly need some help. Ok, quick topic. We've a fiber optic link configure through a Cisco 2960 with 2 externals VLAN (one for voip, one for data configure through 4 of the 2960 ports) on which I don't have any control. In one of those 2 VLANs, I've all my local building patch panel and switch configure with 5 internal VLANs (management, phone, computers, wifi public and wifi admin). The computers VLAN (the X3:V73 on the TZ215) gives address over DHCP but in the range of the VLAN on the Cisco 2960 to be able to have direct internet access without using the WAN port on the TZ215. All that is working perfectly fine. But during my test phase, I've used the SonicWall IP as my gateway (X3:V69, X3:V73, X3:V83) and all the concerned VLANs grouped on the same TZ215 interface (X3 in this case), give me the access to all the VLAN configure on that port, which is nice. But now, after changing the gateway (to use the internet gateway of the fiber provider on the Cisco 2960) to put all computers in productions mode, I'm not able to access the other VLAN on the X3 port. I'm pretty sure it has something to do with the static routing, but after an afternoon trying to resolve this issue and a big headache later, I'm here asking for some help. I've tried to configure the SonicWall with 2 gateways, very bad idea with Windows...it slows internet badly and internal request on local computers just doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea or questions about my setup are more than welcome&#xA;Draven&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, sorry...I'll try to be a little more clear.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SonicWall TZ215 Interface X3 (3 Vlans for now...)&#xA;X3:V69 for management&#xA;X3:V73 for computers&#xA;X3:V83 for wireless admin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;X3 Interface enter the first port of a GS724T linked with another GS724T and two FS728TP, all linked together by a trunk port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the GS724T port are configured as an &quot;access&quot; port directly into the Cisco Catalyst 2960 port 19 but this switch is provided pre-configured by our fiber link provider. This port (19) is configured as an &quot;access&quot; port in which every computer or device in the IP range of this specific vlan automatically gain internet access, so, no need to use the WAN interface on the SonicWall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my SonicWall computer vlan (X3:V73) address the computers in the pre-configured &quot;good&quot; range of IP to gain internet access without TZ215 WAN port.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Example (simple scenario) :&#xA;TZ215(X3:V73) ---&amp;gt; GS724T Port 1 (&quot;trunk&quot;)&#xA;Computer 1 ---&amp;gt; GS724T Port 2 DHCP in the good range&#xA;GS724T Port 24 ---&amp;gt; Catalyst 2960 ---&amp;gt; Internet&#xA;TZ215(X3:V69) ---&amp;gt; GS724T Port 1 (&quot;trunk&quot;)&#xA;Manageable switch ---&amp;gt; GS724T Port 3 DHCP in another range (of course, in another vlan)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the switch in the port 3 doesn't gain internet access directly because it's not in the good range of the pre-configured Catalyst 2960 but that's totally fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this scenario, as long as I keep the TZ215 corresponding interface IP as my gateway in my DHCP pool, I can access all 3 vlans configured on the same port even if I can't access internet, and that's exactly what I want. But as soon as I switch to the fiber provider gateway in my DHCP pool (to disable the WAN port on my SonicWall), vlans doesn't seem to see each other. I would like to be able to configure some of the vlans on the TZ215 X3 Interface (with my 3 vlans) to communicate together. Example, the X3:V73 Windows 2012 Server accessible from the X3:V83 Wireless Admin Network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the X3:V73 assign address in the range of 10.146.10.0 and the X3:V83 assign address in the range of 10.83.0.0. As long as I keep the interface IP of the TZ215 as my gateway, everything works fine but the goal of our last month mega-network-redesign was to gain access directly without the TZ215 WAN Port. And to achieve that, I have to switch the gateway to the one provided by our fiber provider and as soon as I did that, I lose access to the other vlan on the X3 Port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, Thank you VERY much to try to help me...If you really need a drawing, I'll try to &quot;mspaint&quot; something tomorrow morning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok, here's the network diagram with old and new network :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AY9it.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AY9it.png&quot; alt=&quot;Network diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If computers or devices connected in the Catalyst get an address in the 10.146.0.0 range, they get internet access. So, in the old network, computers were addressed in the range of 10.0.100.X but the X1 WAN interface was in the 10.146.0.0 so, we used the WAN interface but only one address in our pre-configured pool on the Catalyst. No vlan on the old network. The new network, for now, has 3 vlans on the X3 port (69 (management),73 (computers),83 (wireless admin)). VLAN 73 has a dhcp range in the 10.146.0.0 in order to access internet directly, without the use of the SonicWall WAN port. The pre-configured gateway on the Cisco is 10.146.0.1 and the SonicWall is 10.146.0.2 (IP address on the X3:V73 port). If I put 10.146.0.2 as my gateway address, I am able to ping all other devices in all other vlans on the same port (X3 in this case) but I can't disconnect the WAN cable of the SonicWall. If I put the pre-configured Cisco gateway (10.146.0.1) as the gateway, I can disconnect the WAN cable of the SonicWall but I can't ping other devices on different vlan on the X3 port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, I want to do both. Remove the WAN cable and be able to ping all other devices on my 3 vlans on X3 port of the SonicWall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope it's a little more clear and I would really like to thank everyone for their precious help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Draven&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: Sorry for my bad english...&lt;/p&gt;&#xA;" OwnerUserId="20793" LastEditorUserId="20793" LastEditDate="2015-11-19T14:56:14.840" LastActivityDate="2015-12-19T18:24:51.810" Title="VLAN routing on a SonicWall TZ215" Tags="|routing|vlan|sonicwall|cisco-2960|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24546" PostTypeId="1" AcceptedAnswerId="24549" CreationDate="2015-11-18T23:23:13.753" Score="3" ViewCount="7124" Body="&lt;p&gt;How will VRRP and OSPF interact in the following scenario?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/QwCls.jpg&quot; alt=&quot;https://i.stack.imgur.com/QwCls.jpg&quot;/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where the OSPF area is comprised of the Local and Remote L3 Switches. Remote Network 3.3.3.0 is advertised to Remote Switch 1 and 2 using BGP (by the Remote Routers), both switches redistribute this route via OSPF. Remote switch 2 also advertises the directly connected VLAN 20 2.2.2.0. The Local Switches both only advertise VLAN 10 1.1.1.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is about the inter-operation of VRRP and OSPF. Will the next hop for traffic from the Remote Switches to VLAN 10 simply be 1.1.1.1 - and so is traffic from the Remote Network 3.3.3.0 just as likely to go via either Remote Router (assuming the metrics are the same)? Or have I completely missed the mark?&lt;/p&gt;&#xA;" OwnerUserId="20792" LastEditorUserId="8499" LastEditDate="2018-03-08T05:07:50.587" LastActivityDate="2018-03-08T05:07:50.587" Title="OSPF and VRRP network advertisements" Tags="|routing|bgp|ospf|vrrp|fhrp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24549" PostTypeId="2" ParentId="24546" CreationDate="2015-11-19T01:38:47.457" Score="4" Body="&lt;p&gt;These are two completely independent protocols. VRRP doesn't interact with OSPF, or vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VRRP will create a virtual gateway, and one router (layer-3 switch?) will be the primary and the other router will be the secondary which takes over if the primary router fails. This has nothing to do with the routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real concern with an FHRP is that it match its primary router with the STP root switch for the VLAN. Not matching the FHRP primary router with the root switch can cause sub-optimal traffic paths as the layer-2 traffic is switched to the root switch via STP, then to the other router (layer-3 switch) as the FHRP primary gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF will populate the routing tables of the routers, and whichever router the traffic goes to (based on the FHRP) will route the traffic based on the best route in the routing table.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-19T01:38:47.457" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24550" PostTypeId="2" ParentId="20646" CreationDate="2015-11-19T02:32:09.743" Score="1" Body="&lt;p&gt;I have participated in quite a few certifications for Department of Defense network devices and ALL DoD devices have to adhere to Security Technical Implementation Guides (STIGs).  They are a list usually sorted by device type, then by vendor on standards to follow in order to provide security and Defense in Depth with network appliances.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would download a STIG viewer from the DISA site and pick the correct STIG for your device and start going through them one by one.  This is what my company does for all their devices they implement on DoD networks.  Additionally we have to pull all our configurations and send them to an accreditation body who grants us permission to connect and have them operate on a DoD networks.  Security like this is maybe a bit of an overkill, but it will give you quite a few good guidelines for you implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the link to the network devices STIGS:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://iase.disa.mil/stigs/net_perimeter/network-infrastructure/Pages/index.aspx&quot; rel=&quot;nofollow&quot;&gt;http://iase.disa.mil/stigs/net_perimeter/network-infrastructure/Pages/firewall.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically the one labeled: &quot;&lt;strong&gt;Network Firewall STIG - Version 8, Release 19&lt;/strong&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will be a zip file that contains vendor specific guidelines as well as a generic file with generic guidelines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck.  &lt;/p&gt;&#xA;" OwnerUserId="16456" LastActivityDate="2015-11-19T02:32:09.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24551" PostTypeId="2" ParentId="24535" CreationDate="2015-11-19T03:04:32.933" Score="2" Body="&lt;p&gt;You have to have the IP of abc.com included in the tunnel policy. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-19T03:04:32.933" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24552" PostTypeId="1" AcceptedAnswerId="29454" CreationDate="2015-11-19T03:11:14.807" Score="2" ViewCount="1732" Body="&lt;p&gt;While on wireshark, I tried to connect to some site using http protocol. When I followed the TCP stream I saw that there was just one FIN package. How could this happen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is I didn't save the capture and now each time I try to replicate it I obtain two handshakes I can tell &lt;a href=&quot;http://this&quot; rel=&quot;nofollow&quot;&gt;http://elpais.com/&lt;/a&gt; is the webpage I accessed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking about two possibilities:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1-I closed the capture before receiving all the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2-I followed a special transition on the TCP transition diagram so that only one FIN was necessary to close the connection...(is that possible?)&lt;/p&gt;&#xA;" OwnerUserId="20797" LastEditorUserId="8499" LastEditDate="2018-02-16T04:01:38.263" LastActivityDate="2018-02-16T04:01:38.263" Title="HTTP closing connection with just one FIN package" Tags="|tcp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24553" PostTypeId="1" AcceptedAnswerId="24554" CreationDate="2015-11-19T03:34:55.420" Score="1" ViewCount="160" Body="&lt;p&gt;Can someone explain to me if a wireless phone is a device, just like a computer, that's connected to a huge wireless router called the Verizon network, or another 192.168.x.x device when it picks up a local wireless open network? Does it have an IP address that I can obtain e.g. whatismyip.com online somehow when it's connected to the 4G network on Verizon? I don't know if this is the right place to ask but I'm a long-time Java developer and enterprise architect and I'm studying TCP/IP for messaging and it's reliability. I have more questions now that relate to mobile phones and that's the reason for my understanding of the phone as a network device. MAC address? IP number?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any responses are well appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;David L. Whitehurst, CEO CI Wise Inc.&lt;/p&gt;&#xA;" OwnerUserId="20799" LastActivityDate="2015-12-19T04:14:55.780" Title="Can someone explain what the wireless data phone is on the TCP/IP layer?" Tags="|wireless|tcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24554" PostTypeId="2" ParentId="24553" CreationDate="2015-11-19T03:48:53.390" Score="2" Body="&lt;p&gt;4G mobile phones are end-devices like PCs; you can get a 4G card for a PC. The phones get IP addresses, and, most likely, the 4G phone will get an IPv6 address, and, on some carriers, and IPv4 address. There is usually somewhere in the phone information where you can find the carrier assigned IP address(es), and those addresses will probably (for IPv4) differ from what a web site tells you your IPv4 address is because most of the mobile carriers use CGN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For programming questions (with many network-savvy programmers), you need to ask on &lt;a href=&quot;https://stackoverflow.com/&quot;&gt;Stack Overflow&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2015-11-19T03:48:53.390" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24555" PostTypeId="1" AcceptedAnswerId="24556" CreationDate="2015-11-19T04:10:40.007" Score="1" ViewCount="247" Body="&lt;p&gt;I have three routers connected with the middle router having s0/0 and s0/1 as its ports. Consider them to be R1, R2,R3. R2 being the router in the middle. R1 uses s0/0 and is connected to s0/0 of R2. S0/1 of R2 is connected connect to s0/1 of R3. However when I am configuring interface S0/1 it gives me this error &quot; 201.195.144.0 overlaps with Serial0/0&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2- S0/0-201.195.144.1(DCE)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2-S0/1-201.195.144.5(DCE)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1-S0/0-201.195.144.2(DTE)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3-S0/1-201.195.144.6(DTE)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone suggest as to what needs to be done. I have tried to do it multiple times and it still gives me the same error.&lt;/p&gt;&#xA;" OwnerUserId="20800" LastActivityDate="2015-11-19T04:12:47.917" Title="S0/0 and S0/1 overlapping Error" Tags="|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24556" PostTypeId="2" ParentId="24555" CreationDate="2015-11-19T04:12:47.917" Score="0" Body="&lt;p&gt;Based on your addresses, you need to use masks of &lt;code&gt;255.255.255.252&lt;/code&gt;. If you use subnets any larger, you will overlap the subnets, and you can't do that on the router interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-19T04:12:47.917" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24557" PostTypeId="2" ParentId="20903" CreationDate="2015-11-19T07:40:55.980" Score="5" Body="&lt;p&gt;I have been deploying event WiFi networks for 9 years. 6000 people in one room is a challenge. To deliver a good service will take a significant investment in time and money. Franco's advice on bandwidth and spectrum usage is very good, here are some additional tips from an event wifi 'veteran'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;If you have not previously designed, deployed and managed a high density WiFi network for an event I would &lt;strong&gt;strongly&lt;/strong&gt; suggest working with a consultant or specialist Event WiFi company. I have contacts worldwide if you need recommendations/introductions.&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, some tips....&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How many concurrent users do you need to support?&#xA;You state 6000 users are in the same room at the same time, the profile of these users is critical. Is it a technology focused audience? Will they have more than one device? Do you expect all users to be connected and active (using their device online) at the same time?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Answering these questions will give you some idea of how many concurrently active devices need to be supported at one time. For our purposes here we will say that 3000 concurrently active devices must be supported.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Spectrum planning.&#xA;In a wired network capacity planning is simple for wireless it is exceptionally complex. The shared resource is the bandwidth available in the air, this is a finite resource and has tobe managed very carefully.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Firstly you should expect to use only 20MHz channels for both 802.11a and 802.11gn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, disable all legacy data rates (or set the network to OFDM only depending on the particular vendor's nomenclature). Essentially, you are turning off 802.11b.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third. Coverage. &#xA;Identify areas where you will have very high crowd density and device usage. You must deploy enterprise grade hardware as Franco correctly states. My experience is with Ruckus (my personal favourite), Xirrus and Cisco. I have also used Ubiquiti extensively but this is best suited to small scale deployments and office type networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A note here about physical access point location. In large venues we typically see a very high roof space. That can make life hard for delivering a good signal so my recommendation for your circumstance is to mount Access points approx 1m to 2m max above head height using tripods where necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make your cell sizes, the area of coverage for each access point as compact as possible. This is achieved manually by reducing transmit power. Both Cisco and Ruckus have very good automatic cell adjustment systems within their controllers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Band steering. This forces 5GHz capable clients to connect with 5GHz radios. Different vendors have different names for this function but they all operate in a similar fashion. Why do you want clients on 5GHz? It is like a 16 lane superhighway vs the 3 lane motorway of 2.4GHz.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Bandwidth. 10Mbps per 100 users is our standard rule unless you are expecting a great deal of video traffic (inbound or outbound).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Switching. POE enabled gigabit switches are a must have, core to edge. You should put all guest WiFi in separate vlan to management, organisers, exhibitors etc.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Routing/Firewalls. Your DHCP scope planning is important here. Also consider dynamic vlans to separate broadcast domains and reduce broadcast traffic in the air.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;keep SSIDs/Networks to a minimum. More SSIDs = more broadcast traffic (and it's exponential) and you want to keep as much spectrum available for client traffic as possible.Guest network (open), Organisers network (WPA2/AES), exhibitor/Contractor network (WPA2/AES).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Caffeine sources. Must be of high quality and within arms reach. Coffee is good, Red Bull only in extreme circumstances...such as working straight for 24+ hours. If you pursue a career in this field you &lt;strong&gt;will&lt;/strong&gt; be doing that. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Rate limiting. A topic of much discussion in our world. I belong to the &quot;let it fly&quot; camp. Don't limit client bandwidth, get the traffic on and off the air as fast as possible in order to best utilise available spectrum. Most client traffic is bursty unless it is streaming video.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Apple updates. They can kill a network. Block access or ask users to refrain from upgrading their iOS or 65 apps on your network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Please share &lt;a href=&quot;https://www.linkedin.com/pulse/20140925150527-2116814-the-7-deadly-sins-of-conference-wifi&quot; rel=&quot;noreferrer&quot;&gt;the 7 deadly sins of conference wifi&lt;/a&gt; with your guests.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Good Luck! &lt;/p&gt;&#xA;" OwnerUserId="16288" LastEditorUserId="16288" LastEditDate="2015-11-19T07:55:12.517" LastActivityDate="2015-11-19T07:55:12.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24558" PostTypeId="2" ParentId="24423" CreationDate="2015-11-19T08:12:53.800" Score="0" Body="&lt;p&gt;You need to either set port forwarding on their router in majorca or connect to that router via VPN. if your royter does not support this, and most home grade routers don't, consider upgrading to &lt;a href=&quot;http://www.broadbandbuyer.co.uk/products/11946-d-link-dsr-250n/&quot; rel=&quot;nofollow&quot;&gt;something like this&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also,be aware of the upload bandwidth available. use speedtest.net to confirm this. You will probably be restricted to SD resolution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can ask your ISP to upgrade your WAN IP to a fixed address, otherwise you will need to configure &lt;a href=&quot;http://www.ubergizmo.com/how-to/how-to-set-up-dynamic-dns/&quot; rel=&quot;nofollow&quot;&gt;dynamic dns&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16288" LastActivityDate="2015-11-19T08:12:53.800" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24559" PostTypeId="2" ParentId="24545" CreationDate="2015-11-19T11:24:22.760" Score="1" Body="&lt;p&gt;You need to leave the gateway set to your TZ215 device...how is it supposed to know what route to use if you asks someone else? :)  You are not tied to WAN interface X0, but you need to assign a WAN zone to an interface....and define routing between zones. &#xA;It's not clear what your situation is, a network diagram could be a terrific help, though.&lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2015-11-19T11:24:22.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24560" PostTypeId="1" CreationDate="2015-11-19T11:43:45.487" Score="1" ViewCount="927" Body="&lt;p&gt;I am using quagga and FreeBSD boxes to achieve this: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13762-40.html#conf3&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13762-40.html#conf3&lt;/a&gt;. Only change is that upstream provider is sending full bgp instead of the default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have everything set up and working moreless correctly. However, I am having issues with few things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;when connection between R101 and R103 goes down, R101 doesn't send traffic over R102-R104 link. This is because, R101 doesn't have any routes R102 besides the one I am advertising. How should I can configure quagga to redistribute routes obtained via external peer over internal BGP session?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For advertising my networks, Quagga works until the moment I restart R101. Once, R!01 comes back and internal BGP session is re-established, R102 stops advertising anything to R101, but advertises to R104. Is this normal? After I restart quagga on R102, the advertising to R101 works correctly.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Quagga config from R101:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;!&#xA;hostname Router&#xA;log file /var/log/quagga.log&#xA;log stdout&#xA;hostname bgpd&#xA;bgp config-type cisco&#xA;!&#xA;debug bgp updates in&#xA;!&#xA;password zebra&#xA;enable password zebra&#xA;!&#xA;interface bge0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface bge1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb2&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lagg0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lo0&#xA; no link-detect&#xA;!&#xA;interface lo1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface pfsync0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan4&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan5&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan101&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan106&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan107&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan109&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;router bgp 1&#xA; no synchronization&#xA; bgp router-id 0.0.0.1&#xA; bgp log-neighbor-changes&#xA; network 1.0.0.0&#xA; network 2.0.0.0&#xA; neighbor 4.4.4.1 remote-as 2&#xA; neighbor 4.4.4.1 description &quot;R101 uplink&quot;&#xA; neighbor 4.4.4.1 update-source 4.4.4.2&#xA; neighbor 4.4.4.1 send-community both&#xA; neighbor 4.4.4.1 route-map R1-MAP out&#xA; neighbor 1.1.1.1 remote-as 1&#xA; neighbor 1.1.1.1 description &quot;R101 BGP interconnect&quot;&#xA; neighbor 1.1.1.1 update-source 1.1.1.2&#xA; neighbor 1.1.1.1 next-hop-self&#xA; neighbor 1.1.1.1 send-community both&#xA; neighbor 1.1.1.1 soft-reconfiguration inbound&#xA; maximum-paths 2&#xA; no auto-summary&#xA;!&#xA;ip prefix-list 1 seq 5 permit 2.0.0.0/8&#xA;ip prefix-list 2 seq 5 permit 1.0.0.0/8&#xA;!&#xA;route-map R1-MAP permit 10&#xA; match ip address prefix-list 1&#xA; set as-path prepend 1 1 1&#xA;!&#xA;route-map R1-MAP permit 20&#xA; match ip address prefix-list 2&#xA;!&#xA;ip forwarding&#xA;!&#xA;line vty&#xA;!&#xA;end&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R102 full config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;hostname Router&#xA;hostname bgpd&#xA;log file /var/log/quagga.log&#xA;log stdout&#xA;bgp config-type cisco&#xA;!&#xA;password zebra&#xA;enable password zebra&#xA;!&#xA;interface bge0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface bge1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb2&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lagg0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lo0&#xA; no link-detect&#xA;!&#xA;interface lo1&#xA; no link-detect&#xA;!&#xA;interface pfsync0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan4&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan5&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan101&#xA; ipv6 nd suppress-ra&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan106&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan107&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan109&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;router bgp 1&#xA; no synchronization&#xA; bgp router-id 0.0.0.2&#xA; bgp log-neighbor-changes&#xA; network 1.0.0.0&#xA; network 2.0.0.0&#xA; neighbor 3.3.3.1 remote-as 2&#xA; neighbor 3.3.3.1 description &quot;R102 uplink&quot;&#xA; neighbor 3.3.3.1 update-source 3.3.3.2&#xA; neighbor 3.3.3.1 send-community both&#xA; neighbor 3.3.3.1 route-map R102-MAP out&#xA; neighbor 1.1.1.2 remote-as 1&#xA; neighbor 1.1.1.2 description &quot;R102 BGP interconnect&quot;&#xA; neighbor 1.1.1.2 update-source 1.1.1.1&#xA; neighbor 1.1.1.2 next-hop-self&#xA; neighbor 1.1.1.2 send-community both&#xA; neighbor 1.1.1.2 soft-reconfiguration inbound&#xA; no auto-summary&#xA;!&#xA;ip prefix-list 1 seq 5 permit 1.0.0.0/8&#xA;ip prefix-list 2 seq 5 permit 2.0.0.0/8&#xA;!&#xA;route-map R102-MAP permit 10&#xA; match ip address prefix-list 1&#xA; set as-path prepend 1 1 1&#xA;!&#xA;route-map R102-MAP permit 20&#xA; match ip address prefix-list 2&#xA;!&#xA;ip forwarding&#xA;!&#xA;line vty&#xA;!&#xA;end&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="20805" LastEditorUserId="20805" LastEditDate="2015-11-19T19:38:26.840" LastActivityDate="2015-12-19T20:24:53.373" Title="Quagga bgp advertisment stop after peer restart" Tags="|routing|bgp|" AnswerCount="1" CommentCount="18" ContentLicense="CC BY-SA 3.0" />
  <row Id="24562" PostTypeId="1" AcceptedAnswerId="24579" CreationDate="2015-11-19T13:10:56.027" Score="0" ViewCount="126" Body="&lt;p&gt;&lt;strong&gt;Current problem:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;7 desktops installed at client's business&lt;/li&gt;&#xA;&lt;li&gt;1 dedicated ethernet line for each desktop&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The original idea was that each line would run to their VOIP phones and then take advantage of the LAN connection on the phone to connect their desktops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VOIP phones have a 10/100 interface and our client is complaining about the lag from the network connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My current solutions / thoughts:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Small 3 port switch to ensure the desktop has a direct connection off the phone. (Expencive)&lt;/li&gt;&#xA;&lt;li&gt;Install an extra ethernet card in the desktops and run a line from the PC to the phone. Though this would be ideal, they would not be able to use the phone if the computer is shutdown. Is there any way to provide an always on network threw a computer that is shutdown?&lt;/li&gt;&#xA;&lt;li&gt;Current last resort would be to use a hub, but this would not 100% solve the problem. It would only make it somewhat better.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Please let me know if you can come up with a better solution to this issue. Running extra lines and installing new switches would not be cost effective enough but we do have the spare ethernet cards to install.&lt;/p&gt;&#xA;" OwnerUserId="20807" LastEditorUserId="20807" LastEditDate="2015-11-19T13:19:12.937" LastActivityDate="2015-11-19T20:49:05.500" Title="Not enough ethernet lines; looking for a cheap solution" Tags="|switch|ethernet|design|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24563" PostTypeId="1" CreationDate="2015-11-19T13:23:37.260" Score="0" ViewCount="2038" Body="&lt;p&gt;I have a question about Cisco ACL's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a router has an ACL which denies pings and replies, which is stopping any devices on the LAN from pinging the internet but the router can still ping the internet, why is this the case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this because the router isn't affected by ACL's whereas the PC's are?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="20767" LastActivityDate="2015-11-23T17:28:27.727" Title="Cisco - ACL Clarification" Tags="|cisco|acl|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24566" PostTypeId="1" CreationDate="2015-11-19T14:05:09.613" Score="0" ViewCount="879" Body="&lt;p&gt;I'm trying to understand TCP Congestion Avoidance Phase. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to pages 82-83 of the slide below, cwnd equals CongWin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to pages 84-85, they are different. The writer did not bother to define those terms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea what's going on? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://cs.bilkent.edu.tr/~morhan/cs421/lectures/Chapter3_spring15.pdf&quot; rel=&quot;nofollow&quot;&gt;http://cs.bilkent.edu.tr/~morhan/cs421/lectures/Chapter3_spring15.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20809" LastActivityDate="2015-11-20T02:38:01.373" Title="In TCP Congestion Avoidance Phase, are cwnd and CongWin the same thing?" Tags="|tcp|congestion|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24567" PostTypeId="2" ParentId="24562" CreationDate="2015-11-19T14:26:36.830" Score="1" Body="&lt;p&gt;You should adopt a switch capable of vlan , separate VOIP from data traffic and prioritize voip . no way an hub would solve this type of problems... &lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2015-11-19T14:26:36.830" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24570" PostTypeId="1" AcceptedAnswerId="24572" CreationDate="2015-11-19T16:41:37.703" Score="2" ViewCount="2381" Body="&lt;p&gt;Amateur here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I leave the default gateway blank in TCP/IPv4 configuration the client won't be able to reach other networks right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But can other clients still reach the client with no gateway? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to make the client unable to access the internet and vice versa.&#xA;Is leaving the gateway blank a good way to do that?&#xA;Is there a better way?&lt;/p&gt;&#xA;" OwnerUserId="20814" LastActivityDate="2015-11-19T16:45:27.020" Title="Consequences of leaving Default Gateway blank in TCP/IPv4 Configuration?" Tags="|ipv4|internet|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24571" PostTypeId="2" ParentId="24510" CreationDate="2015-11-19T16:41:40.000" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But the problem is the ACK flag is only set on TCP acknowledgement packets, which do not carry any useful information as far as the end user is concerned, so if you only allow packets that have that flag set, you will drop all useful packets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While ACK packets may not contain any useful data, the packets themselves are extremely useful. The ACK packet tells the other side of the connection &quot;I received the data you sent and I'm ready for more.&quot; If the ACK is not received due to packet loss, a firewall blocking it, or any other reason, the connection sender of the ACK will keep resending that same ACK until the other side sends more data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's take a step back and discuss the Web server scenario you mentioned. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the three way handshake completes the client will sends a request for a page. This would contain &quot;useful&quot; data because it tells the server what page the client wants. The server then sends an ACK to let the client know the request has been received. The server then sends back data packets which contain the requested page. The client then sends an ACK or ACKs to let the server know it has received all of the data which was sent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that all of the above took place on a single TCP connection. In other words, both parties can send and receive data over the one connection, they do not need one each. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, just an FYI, blocking traffic based on a TCP flag for security purposes is almost as weak as blocking on port numbers. The reason being that malicious users can craft packets any which way they like so sending all packets with the ACK bit set is no trouble at all. If you're interested in reading more about this take a look at Scapy. &lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-11-19T16:41:40.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24572" PostTypeId="2" ParentId="24570" CreationDate="2015-11-19T16:45:27.020" Score="3" Body="&lt;p&gt;Without the gateway, the PC can't get to another network, and devices on another network may be able to send something to that PC, but that PC can't reply, and it can't establish something like a TCP session. This is a very bad idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better solution would be to put an ACL in you router or firewall for that PC's IP address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-19T16:45:27.020" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24573" PostTypeId="2" ParentId="22593" CreationDate="2015-11-19T16:56:47.150" Score="1" Body="&lt;p&gt;I didn't get the IP of your laptop, but I am guessing your pfsense box is missing a route to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;traceroute from the pfsense should help you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, it smells like pfsense is dropping icmp echo requests (which makes network debugging harder).&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-19T16:56:47.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24574" PostTypeId="2" ParentId="24476" CreationDate="2015-11-19T17:05:47.387" Score="0" Body="&lt;p&gt;The answer is in your question :) &#xA;TCP Zero Window means that the data flow is going to grind to a halt until the receiving end's buffer is cleared enough to receive more data. In other words you're network connection is working just fine, it's your PC/server that's the problem. &#xA;Have a read of &lt;a href=&quot;https://wiki.wireshark.org/TCP%20ZeroWindow&quot; rel=&quot;nofollow&quot;&gt;this link.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Troubleshooting a Zero Window For one reason or another, the machine alerting the Zero Window will not receive any more data from the host. It could be that the machine is running too many processes at that moment, and its processor is maxed. Or it could be that there is an error in the TCP receiver, like a Windows registry misconfiguration. Try to determine what the client was doing when the TCP Zero Window happened.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The reason why you're not seeing the same problem with UDP is because it is connectionless and therefore it does not know nor care whether the remote end has buffers available, it will continue sending more data anyway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My suggestion is to first ensure that the hosts you're using for testing have sufficient RAM and CPU, and if they do, try testing from a couple of different hosts. The fact is that it's not the network connection which is holding you back, it's that your host(s) are not processing the received data quickly enough which is therefore delaying their ACKs which in turn is slowing your connection down. &lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-11-19T17:05:47.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24577" PostTypeId="2" ParentId="24560" CreationDate="2015-11-19T17:58:56.743" Score="1" Body="&lt;p&gt;By the data that you give us, this one is an interesting part. Unless you had change the neighbors for your safety, and put the conf here, i think you need to explaind why your iBGP neighbor has the same IP address of your UPDATE SOURCE? This one is like if your iBGP share your same host. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;neighbor 1.1.1.1 description &quot;R101 BGP interconnect&quot;&#xA;neighbor 1.1.1.1 update-source 1.1.1.1&#xA;neighbor 1.1.1.1 next-hop-self&#xA;neighbor 1.1.1.1 send-community both&#xA;neighbor 1.1.1.1 soft-reconfiguration inbound&#xA;&#xA;neighbor 1.1.1.2 description &quot;R102 BGP interconnect&quot;&#xA;neighbor 1.1.1.2 update-source 1.1.1.2&#xA;neighbor 1.1.1.2 next-hop-self&#xA;neighbor 1.1.1.2 send-community both&#xA;neighbor 1.1.1.2 soft-reconfiguration inbound&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-11-19T17:58:56.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24579" PostTypeId="2" ParentId="24562" CreationDate="2015-11-19T20:32:20.967" Score="2" Body="&lt;p&gt;So assuming you are reasonably certain that the problem is the two-port  10/100 switch built in phones, using a separate three-port switch may work as long as it's a gigabit switch, and the rest of the network upstream is gigabit.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the phones to make sure they are not connecting at 10MB.  Of course you probably already did that.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using a hub - there's really no good reason to use a hub here.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding a second NIC to the computers will not make the computers act as switches / hubs / repeaters.  You could configure them to act as routers, but it would be quite a chore.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VOIP phones with gigabit switches are available, that would work.  Or, you could buy headsets for the PCs and use softphones.  &lt;/p&gt;&#xA;" OwnerUserId="19640" LastEditorUserId="19640" LastEditDate="2015-11-19T20:49:05.500" LastActivityDate="2015-11-19T20:49:05.500" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24580" PostTypeId="1" AcceptedAnswerId="24581" CreationDate="2015-11-19T23:04:29.590" Score="1" ViewCount="362" Body="&lt;p&gt;The OSPF has a hierarchy system that separates a single Autonomous System into individual areas, while EIGRP has not a hierarchy system, it prefer to handle with an entire Autonomous System, right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are advantages of using a Hierarchy System? What if there, Why EIGRP has not a Hierarchy System?&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="8499" LastEditDate="2015-11-19T23:22:17.623" LastActivityDate="2015-11-20T17:02:18.867" Title="Advantages of hierarchy system on Routing Protocols" Tags="|routing|ospf|protocol-theory|eigrp|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24581" PostTypeId="2" ParentId="24580" CreationDate="2015-11-19T23:16:13.133" Score="1" Body="&lt;p&gt;This has to do with the algorithms used. OSPF and IS-IS use Dijkstra's algorithm which requires a hierarchy. EIGRP uses a proprietary algorithm (DUAL) which does not. The DUAL algorithm is diffusing (the &quot;D&quot; in DUAL) so that it doesn't require a hierarchy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP can be set up in a sort of hierarchy with stub areas, but it doesn't fundamentally need a hierarchy the way OSPF or IS-IS do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With Dijkstra's algorithm, each router has a complete understanding of an area, but DUAL only knows about the next hop for a route.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-19T23:16:13.133" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24582" PostTypeId="1" CreationDate="2015-11-20T00:37:33.053" Score="2" ViewCount="1962" Body="&lt;p&gt;I have a problem when I try to achieve load sharing with bgp. My scenario is &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13762-40.html#conf3&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13762-40.html#conf3&lt;/a&gt;. Only difference to this is that the ISP is sending me the full bgp table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that when I shutdown r101-r103 link (vlan4 in my case), r101 isn't able to route anything because it has only directly connected routes in its routing table. Shouldn't be r102 advertising full bgp over ibgp session?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration file from r101:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;!&#xA;hostname Router&#xA;log file /var/log/quagga.log&#xA;log stdout&#xA;hostname bgpd&#xA;bgp config-type cisco&#xA;!&#xA;debug bgp updates in&#xA;!&#xA;password zebra&#xA;enable password zebra&#xA;!&#xA;interface bge0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface bge1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb2&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lagg0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lo0&#xA; no link-detect&#xA;!&#xA;interface lo1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface pfsync0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan4&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan5&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan101&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan106&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan107&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan109&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;router bgp 1&#xA; no synchronization&#xA; bgp router-id 0.0.0.1&#xA; bgp log-neighbor-changes&#xA; network 1.0.0.0&#xA; network 2.0.0.0&#xA; neighbor 4.4.4.1 remote-as 2&#xA; neighbor 4.4.4.1 description &quot;R101 uplink&quot;&#xA; neighbor 4.4.4.1 update-source 4.4.4.2&#xA; neighbor 4.4.4.1 send-community both&#xA; neighbor 4.4.4.1 route-map R1-MAP out&#xA; neighbor 1.1.1.2 remote-as 1&#xA; neighbor 1.1.1.2 description &quot;R101 BGP interconnect&quot;&#xA; neighbor 1.1.1.2 update-source 1.1.1.1&#xA; neighbor 1.1.1.2 next-hop-self&#xA; neighbor 1.1.1.2 send-community both&#xA; neighbor 1.1.1.2 soft-reconfiguration inbound&#xA; maximum-paths 2&#xA; no auto-summary&#xA;!&#xA;ip prefix-list 1 seq 5 permit 2.0.0.0/8&#xA;ip prefix-list 2 seq 5 permit 1.0.0.0/8&#xA;!&#xA;route-map R1-MAP permit 10&#xA; match ip address prefix-list 1&#xA; set as-path prepend 1 1 1&#xA;!&#xA;route-map R1-MAP permit 20&#xA; match ip address prefix-list 2&#xA;!&#xA;ip forwarding&#xA;!&#xA;line vty&#xA;!&#xA;end&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R102 configuration file:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;hostname Router&#xA;hostname bgpd&#xA;log file /var/log/quagga.log&#xA;log stdout&#xA;bgp config-type cisco&#xA;!&#xA;password zebra&#xA;enable password zebra&#xA;!&#xA;interface bge0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface bge1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb2&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lagg0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lo0&#xA; no link-detect&#xA;!&#xA;interface lo1&#xA; no link-detect&#xA;!&#xA;interface pfsync0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan4&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan5&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan101&#xA; ipv6 nd suppress-ra&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan106&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan107&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan109&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;router bgp 1&#xA; no synchronization&#xA; bgp router-id 0.0.0.2&#xA; bgp log-neighbor-changes&#xA; network 1.0.0.0&#xA; network 2.0.0.0&#xA; neighbor 3.3.3.1 remote-as 2&#xA; neighbor 3.3.3.1 description &quot;R102 uplink&quot;&#xA; neighbor 3.3.3.1 update-source 3.3.3.2&#xA; neighbor 3.3.3.1 send-community both&#xA; neighbor 3.3.3.1 route-map R102-MAP out&#xA; neighbor 1.1.1.1 remote-as 1&#xA; neighbor 1.1.1.1 description &quot;R102 BGP interconnect&quot;&#xA; neighbor 1.1.1.1 update-source 1.1.1.2&#xA; neighbor 1.1.1.1 next-hop-self&#xA; neighbor 1.1.1.1 send-community both&#xA; neighbor 1.1.1.1 soft-reconfiguration inbound&#xA; no auto-summary&#xA;!&#xA;ip prefix-list 1 seq 5 permit 1.0.0.0/8&#xA;ip prefix-list 2 seq 5 permit 2.0.0.0/8&#xA;!&#xA;route-map R102-MAP permit 10&#xA; match ip address prefix-list 1&#xA; set as-path prepend 1 1 1&#xA;!&#xA;route-map R102-MAP permit 20&#xA; match ip address prefix-list 2&#xA;!&#xA;ip forwarding&#xA;!&#xA;line vty&#xA;!&#xA;end&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Network interfaces are on separate vlans over link aggregation interface. vlan4 is the link to the provider, vlan3 is the link between the two routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R101 interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;vlan3: flags=8843 metric 0 mtu 1500&#xA;    options=303&#xA;    ether a0:36:9a:4a:ec:f1&#xA;    inet 1.1.1.1 netmask 0xfffffffc broadcast 1.1.1.3&#xA;    nd6 options=29&#xA;    media: Ethernet autoselect&#xA;    status: active&#xA;    vlan: 3 parent interface: lagg0&#xA;[root@r101 ~]# ifconfig vlan4&#xA;vlan4: flags=8943 metric 0 mtu 1500&#xA;    options=303&#xA;    ether a0:36:9a:4a:ec:f1&#xA;    inet 4.4.4.2 netmask 0xfffffff8 broadcast 4.4.4.7&#xA;    nd6 options=29&#xA;    media: Ethernet autoselect&#xA;    status: active&#xA;    vlan: 4 parent interface: lagg0&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R102 interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;[root@r102 ~]# ifconfig vlan3&#xA;vlan3: flags=8843 metric 0 mtu 1500&#xA;    options=303&#xA;    ether a0:36:9a:4a:ec:f1&#xA;    inet 1.1.1.2 netmask 0xfffffffc broadcast 1.1.1.3&#xA;    nd6 options=29&#xA;    media: Ethernet autoselect&#xA;    status: active&#xA;    vlan: 3 parent interface: lagg0&#xA;[root@r102 ~]# ifconfig vlan4&#xA;vlan4: flags=8943 metric 0 mtu 1500&#xA;    options=303&#xA;    ether a0:36:9a:4a:ec:f1&#xA;    inet 3.3.3.2 netmask 0xfffffff8 broadcast 3.3.3.7&#xA;    nd6 options=29&#xA;    media: Ethernet autoselect&#xA;    status: active&#xA;    vlan: 4 parent interface: lagg0&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="20805" LastEditorUserId="8499" LastEditDate="2019-01-05T00:09:58.147" LastActivityDate="2019-01-05T00:09:58.147" Title="Quagga not announcing external routes over ibgp session" Tags="|routing|bgp|network-core|linux|quagga|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="24583" PostTypeId="2" ParentId="24582" CreationDate="2015-11-20T01:12:25.823" Score="1" Body="&lt;p&gt;The &lt;code&gt;update-source&lt;/code&gt; isn't used for eBGP unless you use eBGP multihop (which you aren't), and it's unnecessary for your iBGP since you are not sourcing from a different interface from the one which you are using to connect the neighbors. You should remove those lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't seem to be using communities, so you can lose the lines with &lt;code&gt;send-community both&lt;/code&gt;. Normally you would have consistent communities on prefixes within your AS, and you would only use that when you need to send your communities to a different AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your iBGP routers should be sharing their BGP routing tables already, so the &lt;code&gt;soft-reconfiguration inbound&lt;/code&gt; shouldn't be used within your AS, but it is often used between ASes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure why you are prepending the same number of ASes to both the external routers. Normally you use prepending to have the external AS to prefer one of your routers over the other; you would prepend on one external link but not the other. The way you are doing doesn't seem like it accomplishes anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you want to advertise aggregate prefixes, use the &lt;code&gt;aggregate-address&lt;/code&gt; command. This will advertise the summary routes, and based on what you commented, I think this is your goal. The aggregate addresses will be advertised as long as there is at least one route within the summary in your routing table. the &lt;code&gt;summary-only&lt;/code&gt; means that it will not advertise the individual routes that are within the aggregate address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think your BGP configurations should look something like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R101:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 1&#xA; no synchronization&#xA; bgp router-id 0.0.0.1&#xA; bgp log-neighbor-changes&#xA;! network 1.0.0.0&#xA;! network 2.0.0.0&#xA; aggregate-address 1.1.1.0 255.255.255.0 summary-only&#xA; aggregate-address 2.2.2.0 255.255.255.0 summary-only&#xA; neighbor 4.4.4.1 remote-as 2&#xA; neighbor 4.4.4.1 description &quot;R101 uplink&quot;&#xA; neighbor 4.4.4.1 update-source 4.4.4.2&#xA; neighbor 4.4.4.1 route-map R1-MAP out&#xA; neighbor 4.4.4.1 soft-reconfiguration inbound&#xA; neighbor 1.1.1.2 remote-as 1&#xA; neighbor 1.1.1.2 description &quot;R101 BGP interconnect&quot;&#xA; neighbor 1.1.1.2 next-hop-self&#xA; maximum-paths 2&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R102:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 1&#xA; no synchronization&#xA; bgp router-id 0.0.0.2&#xA; bgp log-neighbor-changes&#xA;! network 1.0.0.0&#xA;! network 2.0.0.0&#xA; aggregate-address 1.1.1.0 255.255.255.0 summary-only&#xA; aggregate-address 2.2.2.0 255.255.255.0 summary-only&#xA; neighbor 3.3.3.1 remote-as 2&#xA; neighbor 3.3.3.1 description &quot;R102 uplink&quot;&#xA; neighbor 3.3.3.1 update-source 3.3.3.2&#xA; neighbor 3.3.3.1 route-map R102-MAP out&#xA; neighbor 3.3.3.1 soft-reconfiguration inbound&#xA; neighbor 1.1.1.1 remote-as 1&#xA; neighbor 1.1.1.1 description &quot;R102 BGP interconnect&quot;&#xA; neighbor 1.1.1.1 next-hop-self&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-20T17:59:14.210" LastActivityDate="2015-11-20T17:59:14.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24584" PostTypeId="1" CreationDate="2015-11-20T01:15:56.447" Score="4" ViewCount="4353" Body="&lt;p&gt;I'm in the middle of equipment migration and the setup is somewhat similar to Mike's (&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2257/configure-cisco-asa-in-transparent-mode-layer2-dmz-w-vlan-translation&quot;&gt;Configure Cisco ASA in Transparent mode: Layer2 DMZ w/ Vlan translation&lt;/a&gt;) but with a difference that I need the inside and outside VLANs to be different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a &lt;strong&gt;X&lt;/strong&gt; 'outside' VLANS (with IDs from 600-699) and &lt;strong&gt;X&lt;/strong&gt; 'inside' VLANS (with IDs from 700 to 799). I was going with the same idea as in Mike's post: two subinterfaces (one outside, one inside) and one bridge group. Setup looked fine... on the paper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First thing I found out is that you need to have a BVI interface for bridge group to work, so burning one (public in our case) IP for no apparent reason. Second thing, that some of you probably know but I didn't even think i should check, is that ASA allows maximum of 8 BVI interfaces (or 8 per context if in multimode).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;My questions&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I would mostly like to know the why ASA has such requirements.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why is there a need for BVI interface with a valid IP address if we want just to bridge two interfaces? Documentation vaguely states that BVI is used for management and packets sourced from ASA (ARP, etc.) but why is any of that necessary for a transparent L2 firewall? I understand the need when we're talking about IRB on routers but I really don't on a device that basically should just drop or pass frames.&lt;/li&gt;&#xA;&lt;li&gt;What is a reason for a limit of 8 bridge groups? Is there any technical reason or is this just so you would need to buy more context licenses if you want to do something like this.&lt;/li&gt;&#xA;&lt;li&gt;And of course do you have any different solutions for this problem?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I know that their idea is probably to have a different context for each VLAN (or a mix of contexts and bridge groups). My concern is management, for example can you share objects between contexts? We have a lot of network devices and servers on the 'outside' and making object for them for each context would not be manageable.&lt;/p&gt;&#xA;" OwnerUserId="2358" LastEditorUserId="8499" LastEditDate="2018-02-09T02:51:15.743" LastActivityDate="2018-06-02T17:58:50.563" Title="Cisco ASA and BVI interfaces" Tags="|vlan|cisco-asa|firewall|bridge|irb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24585" PostTypeId="2" ParentId="24563" CreationDate="2015-11-20T02:17:31.587" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is this because the router isn't affected by ACL's whereas the PC's&#xA;  are?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, this is correct. The router's ACLs do not affect traffic which is originated by the router itself (e.g the router pinging an internet address). This is true regardless of whether the ACLs are placed inbound, outbound, on an SVI, physical interface, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to filter traffic which is originated by the router, you need to use the &quot;&lt;a href=&quot;http://packetlife.net/blog/2009/nov/30/local-policy-routing/&quot; rel=&quot;nofollow&quot;&gt;ip local policy route-map&lt;/a&gt;&quot; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Adding references as per YLearn's suggestion:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://learningnetwork.cisco.com/thread/73656&quot; rel=&quot;nofollow&quot;&gt;Cisco forum&lt;/a&gt; - Suggestion is to use &quot;ip local policy route-map&quot; to block traffic originating from the router.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfacls.html&quot; rel=&quot;nofollow&quot;&gt;Cisco documentation&lt;/a&gt; - &quot;Access lists that are applied to interfaces do not filter traffic that originates from that router.&quot;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/9767791/acls-never-apply-traffic-generated-router&quot; rel=&quot;nofollow&quot;&gt;Cisco forum&lt;/a&gt; - Information on how the router's ACLs do not apply to traffic originating from the router.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2015-11-20T12:16:09.713" LastActivityDate="2015-11-20T12:16:09.713" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="24586" PostTypeId="2" ParentId="24563" CreationDate="2015-11-20T02:35:44.837" Score="1" Body="&lt;p&gt;It really depends on which side of the ACL from which the ping is originated. If you have an inbound ACL on the LAN ports, pings originating on the LAN won't even enter the router, but the pings from the router are already in the router so they never cross or are evaluated by the ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are standard and extended ACLs, and ACLs are applied to interfaces in one direction (either inbound or outbound). The ACL does nothing unless traffic crosses it in the correct direction, then the traffic is evaluated against the ACL, and the traffic is either permitted or denied based on the ACL rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1(config)#ip access-list extended Test   &#xA;Router1(config-ext-nacl)#deny icmp any host 203.0.113.8&#xA;Router1(config-ext-nacl)#permit ip any any&#xA;Router1(config-ext-nacl)#int vlan100&#xA;Router1(config-if)#ip access-group Test out&#xA;Router1(config-if)#do ping 203.0.113.8&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 203.0.113.8, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms&#xA;Router1(config-if)#do ping 203.0.113.7&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 203.0.113.7, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms&#xA;Router1(config-if)#do ping 203.0.113.8 source loopback 0&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 203.0.113.8, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.0.0.8 &#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;Router1(config-if)#do ping 203.0.113.7 source loopback 0&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 203.0.113.7, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.0.0.8 &#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms&#xA;Router1(config-if)#do ping 203.0.113.8 source vlan 101  &#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 203.0.113.8, timeout is 2 seconds:&#xA;Packet sent with a source address of 203.0.113.129 &#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;Router1(config-if)#do ping 203.0.113.7 source vlan 101&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 203.0.113.7, timeout is 2 seconds:&#xA;Packet sent with a source address of 203.0.113.129 &#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms&#xA;Router1(config-if)#do ping 203.0.113.8 source vlan 102&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 203.0.113.8, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.0.2.253 &#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;Router1(config-if)#do ping 203.0.113.7 source vlan 102&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 203.0.113.7, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.0.2.253 &#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms&#xA;Router1(config-if)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can certainly appreciate all the thorough testing that @YLearn and @Eddie have done. I didn't think to study it in any sort of depth, I was just doing a quick and dirty test to see what happens, and what I have above is the full extent of my testing. I will see if I can do some better tests in a few weeks. I'm willing to concede that there could be something else in the rest of the configurations already in place on the router I tested which affected my test.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-21T03:04:36.070" LastActivityDate="2015-11-21T03:04:36.070" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24587" PostTypeId="2" ParentId="24566" CreationDate="2015-11-20T02:38:01.373" Score="1" Body="&lt;p&gt;Yes, they are the same thing.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The writer did not bother to define those terms.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you feel that way you should try to find the answer yourself. The first result you get when Googling &quot;tcp cwnd&quot; is &lt;a href=&quot;https://en.wikipedia.org/wiki/Slow-start&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; Wikipedia page which states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Slow-start begins initially with a &lt;strong&gt;cong&lt;/strong&gt;estion &lt;strong&gt;wind&lt;/strong&gt;ow Size (&lt;strong&gt;cwnd&lt;/strong&gt;) of 1,&#xA;  2 or 10.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I have highlighted in bold, conwind and cwnd both mean Congestion Window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'd like to learn more about TCP/IP, I can't recommend &lt;a href=&quot;http://www.tcpipguide.com/free/t_toc.htm&quot; rel=&quot;nofollow&quot;&gt;TCP/IP Guide&lt;/a&gt; enough. It is an excellent book, and free too. If you do get good use out of it though I suggest you purchase a copy of it too as a &quot;thank you&quot; to the author.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-11-20T02:38:01.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24589" PostTypeId="1" CreationDate="2015-11-20T10:02:53.597" Score="1" ViewCount="903" Body="&lt;p&gt;We know that a switch can be divided logically into different lans by using VLAN using VLAN tagged mechanism.&#xA;Now is it necessary that in each vlan to tagg a port?&#xA;Also what is the use of tagged port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is different in the sense as the other solution tells what is vlan tagging but it doesnot clearly mention how does the tagged port works or why do we nned to tag a port&lt;/p&gt;&#xA;" OwnerUserId="20111" LastEditorUserId="20111" LastEditDate="2015-11-20T11:18:51.580" LastActivityDate="2015-11-20T18:35:34.923" Title="Why do we use vlan tagged port?" Tags="|vlan|" AnswerCount="4" CommentCount="0" FavoriteCount="0" ClosedDate="2015-11-20T23:40:30.383" ContentLicense="CC BY-SA 3.0" />
  <row Id="24591" PostTypeId="2" ParentId="24346" CreationDate="2015-11-20T10:30:54.853" Score="2" Body="&lt;p&gt;After doing some research on the internet: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found some of the adapters can do TX when they are in monitor mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the reference, and from this reference I bought TP-LINK TL-WN722N.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.wirelesshack.org/top-kali-linux-compatible-usb-adapters-dongles-2015.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.wirelesshack.org/top-kali-linux-compatible-usb-adapters-dongles-2015.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And from the github open source, I found a really interesting project. Here is the link:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://github.com/rpp0/scapy-fakeap&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/rpp0/scapy-fakeap&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a Python project, and it can be simulated as an AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follows the instructions on the git-hub, I successfully launch this fakeAP in the monitor mode. And from sniffer, I can found the beacon frame are sent from this fakeAP. The blue rectangle is the beacon frames, and the red rectangle is the SSID I specified in the program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is the sniffer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/l0S1M.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/l0S1M.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also try with Managed mode, but the program launch fail.&#xA;Hope this post will help anyone who are interested in this field.&lt;/p&gt;&#xA;" OwnerUserId="18903" LastActivityDate="2015-11-20T10:30:54.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24592" PostTypeId="2" ParentId="24589" CreationDate="2015-11-20T11:07:47.950" Score="0" Body="&lt;p&gt;The switch, by configuration knows which port belongs to which VLAN, but when a frame coming from a PC have to go to &lt;em&gt;another&lt;/em&gt; switch it has to use the common link between them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is not other way than &lt;em&gt;&quot;tagging&quot;&lt;/em&gt; the frame before sending it on the common link between switches and stripping the tag before sending it out to the destination PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using 802.1Q a tag containing the VLAN-ID can be put inside the ethernet frame before the frame goes to the common link.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-11-20T11:07:47.950" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24594" PostTypeId="1" AcceptedAnswerId="24595" CreationDate="2015-11-20T11:39:11.490" Score="0" ViewCount="75" Body="&lt;p&gt;we all know &quot;Time-to-Live: 8-bit binary value that indicates the remaining &quot;life&quot; of the packet. &#xA;if becomes zero, the router discards or drops the packet and it is removed from the network data flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my question here is , can the sender  ( OR anyone else beside the sender  ) catch these dropped packets somehow &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and IF these packets where to be accessed after being dropped (assuming we can catch them)  is it possible to get data from them (even if not complete)&lt;/p&gt;&#xA;" OwnerUserId="20833" LastActivityDate="2015-11-20T13:51:06.787" Title="can you catch a discard or dropped packet?" Tags="|packet-tracer|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24595" PostTypeId="2" ParentId="24594" CreationDate="2015-11-20T12:03:08.310" Score="1" Body="&lt;p&gt;The last hop to receive the packet before it hits the TTL limit would see the packet in its normal form. Once this hop (router/switch/firewall/etc) realises that the TTL has been reached, it will drop the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore to view this packet before it is dropped you would need to capture the inbound traffic on the last hop, or SPAN (port mirror) it in order to view what it looked like before it was dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the last hop happens to be a Cisco router you could use the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/epc/command/epc-cr-book/epc-cr-m1.html&quot; rel=&quot;nofollow&quot;&gt;Embedded Packet Capture&lt;/a&gt; to capture the traffic.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-11-20T12:03:08.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24597" PostTypeId="2" ParentId="24423" CreationDate="2015-11-20T12:17:27.823" Score="0" Body="&lt;p&gt;Thanks for your responses guys, apologies that this was in the wrong section.&#xA;The isp gave me a static ip that 'could' change so its setup for now, hopefully it will not change to often :-)&lt;/p&gt;&#xA;" OwnerUserId="20689" LastActivityDate="2015-11-20T12:17:27.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24600" PostTypeId="2" ParentId="24594" CreationDate="2015-11-20T13:51:06.787" Score="0" Body="&lt;p&gt;Once the packet is dropped, it's gone forever. The SPAN idea mentioned above is great for viewing a mirrored version of the packet at the last hop, but technically it isn't dropped. To my knowledge, there isn't a program that stores dropped packets for later viewing. &lt;/p&gt;&#xA;" OwnerUserId="20619" LastActivityDate="2015-11-20T13:51:06.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24601" PostTypeId="2" ParentId="24589" CreationDate="2015-11-20T13:57:19.703" Score="-1" Body="&lt;p&gt;&lt;strong&gt;Is it necessary to tag a port?&lt;/strong&gt; &#xA;No, not at all. A switch works right out of the box with no VLAN tagging necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&quot;What's the purpose of VLAN tagging?&lt;/strong&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Separate broadcast domains within a Layer 2 network. In simple terms, separate the Switch logically into 2 or more separate networks. Benefits of VLANs include, increased security and increased bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="20619" LastActivityDate="2015-11-20T13:57:19.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24604" PostTypeId="1" AcceptedAnswerId="24607" CreationDate="2015-11-20T15:16:30.900" Score="2" ViewCount="16458" Body="&lt;p&gt;I have to go through and find out the configuration set up on the old Dell Force10 switches that we have. I was wanting to make sure that I fully understand what is going on with what I see.  I have the configuration of the VLANs for the ports below:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AdImO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AdImO.png&quot; alt=&quot;VLAN Config IDF3&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I am just trying to fully  understand what this all means.  I know that the U is for untagged and that T is for tagged.&#xA;The question that I have is what the meaning of untagged and tagged has on the ports.  I thought that if the port is in use you would want to tag that port with the VLAN that you want it to be on.  But I know that untagged is what is getting used because I know they are physically plugged.&lt;/p&gt;&#xA;&lt;p&gt;So, I am just a little confused. If someone could please help me understand.&lt;/p&gt;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="20754" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-11-20T15:46:13.617" Title="Understanding VLAN tagging and untagging of ports" Tags="|vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24607" PostTypeId="2" ParentId="24604" CreationDate="2015-11-20T15:37:05.307" Score="8" Body="&lt;p&gt;The meaning of &quot;tagged&quot; and &quot;untagged&quot; is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a VLAN is tagged on a port, it means that data from that VLAN is sent out the port in 802.1q format, which has a VID (a tag) that identifies what VLAN it's associated with.  Also, data received with a VLAN tag is placed in the appropriate VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the VLAN is untagged, it is sent in &quot;standard&quot; 802.3 Ethernet, with no VLAN information.  Data received on the port in &quot;standard&quot; format is placed into this VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that a port can have only one untagged VLAN, but multiple tagged VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VLAN can be untagged on one port, but tagged on another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Cisco world, an untagged VLAN is called the &quot;native VLAN.&quot;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-11-20T15:46:13.617" LastActivityDate="2015-11-20T15:46:13.617" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24609" PostTypeId="1" AcceptedAnswerId="24616" CreationDate="2015-11-20T15:57:14.767" Score="1" ViewCount="826" Body="&lt;p&gt;Problem: We have our Ubiquiti wireless APs hooked up to an SG300-10P. The user's MAC can roam from AP to AP without asking DHCP for an address. We want to have IP Source Guard enabled as a best practice, to prevent someone wreaking havoc on our wireless network with a static IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately we had to disable IP Source Guard because it appears to lock the MAC to a port as well as an IP. Lets say a user connects to an AP on Port 1 and pulls an address via DHCP. They then begin to walk across the office and migrate to another AP on port 2. At that point, IP Source Guard drops all of their traffic until they pull a new DHCP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way around this?&lt;/p&gt;&#xA;" OwnerUserId="20841" LastActivityDate="2016-04-25T13:23:48.657" Title="Cisco Small Business SG300-10P and Ubiquiti Wireless APs, is is possible to enable IP Source Guard?" Tags="|cisco|wireless|ip|security|ubiquiti|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24613" PostTypeId="2" ParentId="24589" CreationDate="2015-11-20T18:02:43.193" Score="2" Body="&lt;p&gt;It is not necessary to have at least one port tagged per vlan. You can let all your ports untagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A tagged port is usually used when you have more than one vlan in it. To determine which vlan a frame is belonging to the switch is setting a tag. The tag is located in the ethernet header: &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1Q&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/IEEE_802.1Q&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically switch uplinks are tagged, because they are configured with several vlans.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-20T18:02:43.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24615" PostTypeId="2" ParentId="24589" CreationDate="2015-11-20T18:18:23.710" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;We know that a switch can be divided logically into different lans by using VLAN using VLAN tagged mechanism. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;VLAN tagging is not required to logically divide a switch into different LANs. VLAN tagging is only necessary when sending data from more than one VLAN on the switch to another switch or device over a single link.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now is it necessary that in each vlan to tagg a port? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, as I said above, it is only necessary when you are sending data from more than one VLAN across a single link.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also what is the use of tagged port?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;By now, you can probably guess where this answer is heading. The use of a tagged port (aka trunk port for some vendors) is to allow you to send the data from more than one VLAN over a single link. The tagging allows the receiving device to understand which traffic belongs to which VLAN allowing it to maintain the logical separation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For normal access ports, there should only be one (untagged) VLAN configured and no addition (tagged) VLANs.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-11-20T18:35:34.923" LastActivityDate="2015-11-20T18:35:34.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24616" PostTypeId="2" ParentId="24609" CreationDate="2015-11-20T18:35:13.053" Score="1" Body="&lt;p&gt;That is what source guard is supposed to do. It protects the network by making sure that each address is only coming from one port on the switch. This prevents someone from spoofing to receive traffic destined for a different port. IP source guard doesn't do this by MAC address, but by IP address, so it isn't locking your MAC to a single port, it is locking the IP address to a single port to prevent spoofing. It uses DHCP snooping to lock the IP address to the port. To use the same device from a different port, you would need to pull an address from DHCP on the new port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You seem to want it to work only for static addresses, but that is not how IP source guard works or what it is designed to do. It require DHCP snooping to allow an IP address on a port, and that is how it blocks statically assigned IP addresses, but there is no feature that only blocks statically assigned addresses; it is sort of a side effect which you can get around by putting a static binding on a port to allow a statically addressed device to work on a port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a document, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/configuration/guide/sy_swcg/ip_source_guard.html&quot; rel=&quot;nofollow&quot;&gt;IP Source Guard&lt;/a&gt;, which explains this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Overview of IP Source Guard&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;IP source guard provides source IP address filtering on a Layer 2 port&#xA;  to prevent a malicious host from impersonating a legitimate host by&#xA;  assuming the legitimate host's IP address. The feature uses dynamic&#xA;  DHCP snooping and static IP source binding to match IP addresses to&#xA;  hosts on untrusted Layer 2 access ports.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Initially, all IP traffic on the protected port is blocked except for&#xA;  DHCP packets. After a client receives an IP address from the DHCP&#xA;  server, or after static IP source binding is configured by the&#xA;  administrator, all traffic with that IP source address is permitted&#xA;  from that client. Traffic from other hosts is denied. This filtering&#xA;  limits a host's ability to attack the network by claiming a neighbor&#xA;  host's IP address. IP source guard is a port-based feature that&#xA;  automatically creates an implicit port access control list (PACL).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-20T18:35:13.053" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24618" PostTypeId="2" ParentId="24563" CreationDate="2015-11-21T02:28:14.247" Score="4" Body="&lt;p&gt;I don't mean for this to be considered an answer, I just wanted to show the output of testing @OzNetNerd's answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured three routers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1 ----- R2 ----- R3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Gave them each an IP and a Loopback interface. Configured an ACL to block ICMP traffic:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ip access-lists&#xA;Extended IP access list DENY-ICMP&#xA;    10 deny icmp any any&#xA;    20 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And applied it direction OUT on the interface facing R3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ip interface | i line|Internet|list&#xA;FastEthernet0/0 is up, line protocol is up&#xA;  Internet address is 10.1.2.2/24&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;FastEthernet0/1 is up, line protocol is up&#xA;  Internet address is 10.2.3.2/24&#xA;  Outgoing access list is DENY-ICMP&#xA;  Inbound  access list is not set&#xA;Loopback0 is up, line protocol is up&#xA;  Internet address is 2.2.2.2/32&#xA;  Outgoing access list is not set&#xA;  Inbound  access list is not set&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I than ran three tests, pinging 3.3.3.3 from R2 natively, then source from interface L0, then sourced from interface fa0/0.  All three were successful:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#ping 3.3.3.3&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 60/69/92 ms&#xA;R2#ping 3.3.3.3 source l0&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:&#xA;Packet sent with a source address of 2.2.2.2&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 52/80/104 ms&#xA;R2#ping 3.3.3.3 source fa0/0&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:&#xA;Packet sent with a source address of 10.1.2.2&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 16/30/52 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All the while the ACL hitcount stayed at 0 (even the permit):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ip access-list&#xA;Extended IP access list DENY-ICMP&#xA;    10 deny icmp any any&#xA;    20 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And all the while R1 was unable to ping R3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#ping 3.3.3.3&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 3.3.3.3, timeout is 2 seconds:&#xA;UUUUU&#xA;Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1's attempt did increase the ACL Hitcount:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ip access-list&#xA;Extended IP access list DENY-ICMP&#xA;    10 deny icmp any any (15 matches)&#xA;    20 permit ip any any&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(although why it did so by 15 when only 5 attempts were sent is curious, anyone have any ideas?)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did the same test sourcing the ping from the IP 2.2.2.2 and 10.1.2.2 (the addresses on R2's L0 interface and the interface facing R1), and the results were the same.  All this was on GNS3 running 12.4:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show ver | i Ver&#xA;Cisco IOS Software, 3700 Software (C3725-ADVENTERPRISEK9-M), Version 12.4(25), RELEASE SOFTWARE (fc2)&#xA;ROM: 3700 Software (C3725-ADVENTERPRISEK9-M), Version 12.4(25), RELEASE SOFTWARE (fc2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My testing confirms, &lt;strong&gt;@OzNetNerd is correct, ACLs do not apply to traffic sourced from the router itself&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did test applying an INbound ACL on R2's f0/1 (interface facing R3). And that did successfully block the return ICMP Responses from R3. But the initial ICMP Echo's did indeed make it out and to R3 (as expected). I confirmed this with debugs on R3.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-11-21T02:28:14.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24619" PostTypeId="2" ParentId="24563" CreationDate="2015-11-21T02:41:31.233" Score="3" Body="&lt;p&gt;According to Cisco documentation that I have found, traffic sourced by a router is not affected by access list on the router's interfaces, only on traffic that transits the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some quotes from Cisco documentation linked to their respective documents:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/xe-3s/sec-data-acl-xe-3s-book/sec-access-list-ov.html&quot; rel=&quot;nofollow&quot;&gt;An access list can control traffic arriving at a device or leaving a device, but not traffic originating at a device.&lt;/a&gt; - IOS XE version 3S  documentation&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfacls.html&quot; rel=&quot;nofollow&quot;&gt;Access lists that are applied to interfaces do not filter traffic that originates from that router.&lt;/a&gt; - IOS version 12.2 documentation&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/15-sy/sec-data-acl-15-sy-book.pdf&quot; rel=&quot;nofollow&quot;&gt;Access lists that are applied to interfaces on a device do not filter traffic that originates from that device.&lt;/a&gt; - IOS version 15SY documentation&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=174313&amp;amp;seqNum=4&quot; rel=&quot;nofollow&quot;&gt;Another special note on Cisco ACLs is that ACLs never apply to traffic generated by the router. So, even if you have an inbound and an outbound ACL on a router denying all traffic, the router will still be able to send any packet it wants; the return packet, however, will be blocked as usual.&lt;/a&gt; - Cisco Press&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, there do appear to be exceptions to these statements. Ron has been able to show that the ACL does have an effect, at least in some cases. I haven't found any documentation to back this up, but perhaps a device with L2 functionality such as the ISR that he used behaves differently? I sometimes can get access to a non-production 7600 so if I get a chance to test with that I will update with my findings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the results I can get consistently across the routers in my lab (1800s, 2500s, 2600/2600XMs, and 3825) across a variety of codes. I will also note that I did cut some lines at points to reduce the length of the output (some of my extra play/testing, interface output not relevant to this test, etc). To start, let's establish some basic information by showing the serial interface on this router, the loopback on this router, the cdp neighbor showing the neighbor router, routing to the loopback on the neighbor router (which includes IP from serial on that side) and a basic ping to set the baseline:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r7#sh ip int brie&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;Serial0/0                  10.78.1.1       YES NVRAM  up                    up    &#xA;Loopback0                  10.7.1.1        YES NVRAM  up                    up    &#xA;r7#sh cdp nei&#xA;Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge&#xA;                  S - Switch, H - Host, I - IGMP, r - Repeater&#xA;&#xA;Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID&#xA;r8               Ser 0/0            134          R        2610      Ser 0/0&#xA;r7#sh ip route 10.8.1.1&#xA;Routing entry for 10.8.1.1/32&#xA;  Last update from 10.78.1.2 on Serial0/0, 6w4d ago&#xA;  Routing Descriptor Blocks:&#xA;  * 10.78.1.2, from 10.78.1.2, 6w4d ago, via Serial0/0&#xA;r7#ping 10.78.1.2&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.78.1.2, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, let's start the fun:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r7#sh ip access-lists&#xA;Extended IP access list TestACL&#xA;    deny icmp any any echo&#xA;    deny icmp any any echo-reply&#xA;    permit ip any any&#xA;r7#config t&#xA;r7(config)#int Ser 0/0&#xA;r7(config-if)#ip access-group TestACL out&#xA;r7(config-if)#end&#xA;r7#ping 10.78.1.2&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.78.1.2, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms&#xA;r7#ping 10.8.1.1 source lo 0&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.8.1.1, timeout is 2 seconds:&#xA;Packet sent with a source address of 10.7.1.1&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms&#xA;r7#ping 10.78.1.2 source lo 0&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.78.1.2, timeout is 2 seconds:&#xA;Packet sent with a source address of 10.7.1.1&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms&#xA;r7#sh ip access-lists&#xA;Extended IP access list TestACL&#xA;    deny icmp any any echo&#xA;    deny icmp any any echo-reply&#xA;    permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I show my access list, apply it to the serial interface, and run the same ping, then ping both remote IP addresses sourced from loopback. All three work just fine and showing the access list again, note there are no hits. But maybe I applied it backwards?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r7(config)#int Ser 0/0&#xA;r7(config-if)#no ip access-group out&#xA;r7(config-if)#ip access-group TestACL in&#xA;r7(config-if)#end&#xA;r7#ping 10.78.1.2&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.78.1.2, timeout is 2 seconds:&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now it looks like it was blocked, but not because I applied it backwards. Let's look at the access list again:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r7#sh ip access-lists&#xA;Extended IP access list TestACL&#xA;    deny icmp any any echo&#xA;    deny icmp any any echo-reply (10 matches)&#xA;    permit ip any any (17 matches)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can see based on the counters that it is the echo-reply from the neighbor router that is being blocked when coming into the interface. This is what we should expect using this ACL inbound. Note that the permit statement now also has matches. These are the routing updates and other traffic from the neighboring router, but note above that the outbound ACL didn't get any permit matches even the local router is also participating in routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Observant readers may point out that my ACL doesn't match Ron's. It is actually based on the original question posted by the OP. But let's run a test similar to Ron's to rule that out as well. I also went ahead and explicitly allowed my second IP just to have the match counter if it applied.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r7#config t&#xA;r7(config)#int ser 0/0&#xA;r7(config-if)#no ip access-group in&#xA;r7(config-if)#exit&#xA;r7(config)#no ip access-list extended TestACL&#xA;r7(config)#ip access-list extended TestACL&#xA;r7(config-ext-nacl)#permit icmp any host 10.8.1.1&#xA;r7(config-ext-nacl)#deny icmp any host 10.78.1.2&#xA;r7(config-ext-nacl)#permit ip any any&#xA;r7(config-ext-nacl)#end&#xA;r7(config)#int ser 0/0&#xA;r7(config-if)#ip access&#xA;r7(config-if)#ip access-group TestACL out&#xA;r7(config-if)#end&#xA;r7#sh ip access-lists TestACL&#xA;Extended IP access list TestACL&#xA;    permit icmp any host 10.8.1.1&#xA;    deny icmp any host 10.78.1.2&#xA;    permit ip any any&#xA;r7#ping 10.8.1.1 sourc lo 0&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.8.1.1, timeout is 2 seconds:&#xA;Packet sent with a source address of 10.7.1.1&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms&#xA;r7#ping 10.78.1.2 source lo 0&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.78.1.2, timeout is 2 seconds:&#xA;Packet sent with a source address of 10.7.1.1&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 4/4/4 ms&#xA;r7#sh ip access-lists&#xA;Extended IP access list TestACL&#xA;    permit icmp any host 10.8.1.1&#xA;    deny icmp any host 10.78.1.2&#xA;    permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2015-11-21T02:53:28.580" LastActivityDate="2015-11-21T02:53:28.580" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24620" PostTypeId="1" AcceptedAnswerId="24621" CreationDate="2015-11-21T09:41:02.577" Score="0" ViewCount="65" Body="&lt;p&gt;I have a managed stack of Netgear GS752TPS switches that are joined together into a single stack using fibre.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have - for example - a terminal server with four NICs using teaming. I also have other servers etc but using this as an example, should I spread the connections between the switches 1, 2, 3, and 4 or is the difference negligible from putting all four into switch 1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The patch panel connections are spread between the four.&lt;/p&gt;&#xA;" OwnerUserId="8146" LastEditorUserId="8146" LastEditDate="2015-11-21T09:56:46.263" LastActivityDate="2015-11-21T10:17:10.633" Title="Should I spread connections into a stack of switches" Tags="|switch|netgear-prosafe|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24621" PostTypeId="2" ParentId="24620" CreationDate="2015-11-21T10:17:10.633" Score="2" Body="&lt;p&gt;Definitely spread hosts across stacks where possible. This eliminates the switch from being a single point of failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As stacked switches have dual rings they avoid being a single point of failure (provided that all hosts are connected to a minimum of two switches in the stack.)&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-11-21T10:17:10.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24623" PostTypeId="2" ParentId="5386" CreationDate="2015-11-21T11:33:26.767" Score="3" Body="&lt;p&gt;Let's consider only the Root Bridge and the switch not participating in RSTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The root bridge (which runs RSTP), puts one of its port connected to the non-RSTP switch, to Backup role (Discarding state) and the other port continues in Designated role (Forwarding state).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reason: Initially both ports of the Root Bridge sends BPDUs. The peer non-xSTP node, floods the BPDU (doesnot forward BPDU since Dest MAC is a multicast), so the BPDU is received by another port of the ROOT Bridge.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Then comparison takes place with the information in BPDU and the information in the receiving port. &lt;/li&gt;&#xA;&lt;li&gt;Here all the parameter matches (Root BridgeID, Root Path Cost,... ) except the PortID parameter. &lt;/li&gt;&#xA;&lt;li&gt;Hence among the port with lower (Better) PortID will be chosen as Designated, and other will be chosen as Backup.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;[In some switches, BPDU dest MAC frames, will be dropped, which might lead to loops]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kindly confirm whether the answer clears your doubt.&lt;/p&gt;&#xA;" OwnerUserId="16107" LastActivityDate="2015-11-21T11:33:26.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24626" PostTypeId="1" AcceptedAnswerId="24627" CreationDate="2015-11-21T12:20:11.563" Score="2" ViewCount="1621" Body="&lt;p&gt;I never keep a managed switch outside the firewall. However, I have a situation where I have to do that. I am connecting two Sonicwall NSA220 in HA configuration. So I have to use a small Ethernet switch in front of the firewall to connect the WAN cable to X1 port of both primary and slave firewall. I have ordered a pair of NETGEAR ProSAFE GS105Ev2 for that purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the management IP of the managed switch has to be in the same subnet, I can only assign a WAN IP as the management IP of this switch. That means anybody can access this switch if I assign the IP, with password being the only defense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way to deal with this? Not set the IP at all? I prefer to manage this switch, but not at the cost of security.&lt;/p&gt;&#xA;" OwnerUserId="11931" LastActivityDate="2015-11-22T01:47:02.223" Title="How to manage the Ethernet switch that is on WAN?" Tags="|switch|management|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24627" PostTypeId="2" ParentId="24626" CreationDate="2015-11-21T12:48:05.560" Score="6" Body="&lt;p&gt;There are a few options with different security risks.  You will have to decide which one(s) meets your needs.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use an out-of-band connection to the console port.  This is probably the safest way, but may require additional hardware to make a serial connection.&lt;/li&gt;&#xA;&lt;li&gt;Create a separate VLAN on the switch and put the management port in that VLAN.Connect that VLAN internally or to a separate logical interface on the firewall.&lt;/li&gt;&#xA;&lt;li&gt;Use unique credentials for the switch, and make them more complex than normal. &lt;/li&gt;&#xA;&lt;li&gt;If the switch supports it, place ACLs on the management interface (this one doesn't).&lt;/li&gt;&#xA;&lt;li&gt;Set the default gateway of the management IP to the firewall.  Most firewalls will not issue redirects by default.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm sure other readers can think of other techniques.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-21T12:48:05.560" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24629" PostTypeId="1" AcceptedAnswerId="24776" CreationDate="2015-11-21T19:32:31.420" Score="2" ViewCount="302" Body="&lt;p&gt;In surveying cellular &quot;coverage&quot; over a geographic area, one could record any of several metrics, RSSI and practical bandwidth/throughput (e.g., Speedtest) among them.  I understand that RSSI is poorly defined, but please assume an apples-to-apples measurement situation.  The question is, all other things being equal, will reported RSSI depend on the total user load on the cellular system at that time and location?  I've been told that -- again, all other things being equal -- reported RSSI will be lower if my mobile device is being allocated less bandwidth by the cellular system due to heavy user load (or for any other reason).  This doesn't make sense to me as I thought RSSI was strictly an RF measure, independent of all logical/data considerations.  Can someone clarify this?&lt;/p&gt;&#xA;" OwnerUserId="20858" LastActivityDate="2016-02-25T14:10:32.367" Title="RSSI versus available bandwidth, cellular context" Tags="|mobile|throughput|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24631" PostTypeId="1" CreationDate="2015-11-21T20:56:18.297" Score="2" ViewCount="413" Body="&lt;p&gt;I have automated my network provisioning with ztp and ansible and it's already rocking.&lt;br&gt;&#xA;When ztp finishes I have a working config but I'm missing 2 things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the xe-0/1/2 and xe-0/1/3 on my ex3300 are still configured as vc-ports&lt;/li&gt;&#xA;&lt;li&gt;my rescue config is not saved&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is there a way to issue requests to the system via ztp?&lt;br&gt;&#xA;My approach would be to configure an &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos14.2/topics/usage-guidelines/automation-configuring-an-event-policy-to-execute-operational-mode-commands.html&quot; rel=&quot;nofollow&quot;&gt;event-policy&lt;/a&gt; to run these commands when ztp is finished, but I fail to find a event after the ztp process has finished.&lt;br&gt;&#xA;Thanks in advance for your help.&lt;/p&gt;&#xA;" OwnerUserId="8825" LastActivityDate="2015-11-30T14:24:17.673" Title="Juniper ztp trigger system requests" Tags="|juniper|juniper-junos|juniper-ex|automation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24635" PostTypeId="2" ParentId="20387" CreationDate="2015-11-21T23:15:58.347" Score="1" Body="&lt;p&gt;This is from the &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:CRS_examples#Port_Level_Isolation&quot; rel=&quot;nofollow&quot;&gt;port isolation part for CRS on Mikrotik wiki&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With default configuration for CRS ether2 is the uplink (gateway) port for local users so you need to add profile for it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface ethernet switch port&#xA;    set ether2 isolation-leakage-profile-override=0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you need to set isolated profile for the users (example here is for ports 3 to 6 only, you need to add more if needed):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface ethernet switch port&#xA;    set ether3 isolation-leakage-profile-override=1&#xA;    set ether4 isolation-leakage-profile-override=1&#xA;    set ether5 isolation-leakage-profile-override=1&#xA;    set ether6 isolation-leakage-profile-override=1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And let only uplink port communicate with them:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface ethernet switch port-isolation&#xA;    add port-profile=1 ports=ether2 type=dst&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way they can reach internet, but not communicate among themselves.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2015-11-21T23:15:58.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24637" PostTypeId="2" ParentId="24626" CreationDate="2015-11-22T01:47:02.223" Score="1" Body="&lt;p&gt;If your firewall supports it, use secondary (private) addresses on the outside interface. NAT internal hosts to this subnet to talk to your &lt;strike&gt;poor choice of&lt;/strike&gt; switch. This is logically creating a DMZ riding on the public network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have the interfaces available, a physical DMZ for managing that switch would be the safest option. (consider the effects of typos, misconfigurations, stray cables, and hackers -- but that's a question for the security SE)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-11-22T01:47:02.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24639" PostTypeId="1" AcceptedAnswerId="24640" CreationDate="2015-11-22T07:11:57.433" Score="1" ViewCount="98" Body="&lt;p&gt;I was reading up on network interface cards and came across this statement:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Avoid mixing network adapters from different vendors on the&#xA;same LAN. Although all may follow a standard, implementation&#xA;differences impacts performance.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this true, and is the performance impact anything significant?&lt;/p&gt;&#xA;" OwnerUserId="20870" LastEditorUserId="8499" LastEditDate="2018-03-09T20:32:48.397" LastActivityDate="2018-03-09T20:32:48.397" Title="Using different NIC vendors on a LAN - does it make a difference?" Tags="|ethernet|interface|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24640" PostTypeId="2" ParentId="24639" CreationDate="2015-11-22T07:18:43.327" Score="4" Body="&lt;p&gt;There is no reason you can't mix network adapters from different vendors on a LAN. They should all be IEEE compliant and tested for interoperability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably can't help but mix hardware vendors since it is unlikely that the switches to which you connect hosts use the same hardware as the hosts.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-22T07:18:43.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24643" PostTypeId="1" CreationDate="2015-11-22T11:05:52.490" Score="0" ViewCount="689" Body="&lt;p&gt;I'm an university student majoring in computer science &amp;amp; engineering as a sophomore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm studying about TCP(transport layer) specifically, sequence number.&#xA;What my materials of Network says sequence number is 'byte stream 'number' of first byte in segment's data'. As I know Operating System decides sequence number randomly but properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I do not understand what 'byte stream number of first byte'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it the value of ID for each byte?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it the record saying 'until me(byte), it's n(bytes) of total bytes''?&lt;/p&gt;&#xA;" OwnerUserId="19596" LastActivityDate="2015-11-22T19:38:01.940" Title="Sequence Number in packet" Tags="|tcp|packet-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24644" PostTypeId="1" CreationDate="2015-11-22T11:47:32.460" Score="0" ViewCount="1844" Body="&lt;p&gt;What is the difference between Best effort traffic and Real time traffic? Is TCP means best effort traffic and UDP means real time traffic? Or anything else?&lt;/p&gt;&#xA;" OwnerUserId="20873" LastEditorUserId="509" LastEditDate="2015-11-22T15:30:41.393" LastActivityDate="2015-11-22T17:21:07.290" Title="Real time traffic explanation" Tags="|tcp|udp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24645" PostTypeId="2" ParentId="24644" CreationDate="2015-11-22T13:06:00.370" Score="1" Body="&lt;p&gt;Typically, real-time traffic (voice, video, etc) does use UDP, but UDP is used for many other things, and most UDP traffic is not real-time traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Classifications like &quot;best effort&quot; and &quot;real time&quot; (you can have additional classifications) are made by the network administrator to specify how the traffic is treated by the network devices--routers and switches.  An administrator decides which traffic is given priority so that network resources (bandwidth, etc) can be matched to the requirements of the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, as the network administrator, it's up to you to classify traffic in ways that suits your requirements.  You decide that VoIP traffic gets priority in your network and is forwarded before other kinds of traffic.  You can also decide that Youtube videos of dancing kittens gets lower priority and limited access to your network resources.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-22T13:06:00.370" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="24647" PostTypeId="2" ParentId="24644" CreationDate="2015-11-22T17:21:07.290" Score="0" Body="&lt;p&gt;Real time or best effort only makes sense when you have a congested network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When your network is congested you can mark some types of traffic as real time and some as best effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a real time packet hits a switch/router it's processed first. After that the switch/router process best effort packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best analogy I can give you is an avenue. The avenue here is your network. All types of cars/trucks (packets) go thorugh it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there are times when a firefighter truck needs to go first. And in your network you could mark firefighters as real time traffic and normal cars as best effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP can be real time and UDP could be best effort and the other way around. The answer here is the good old &quot;it depends&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is that TCP is connection oriented where UDP is not. So it's a matter of taste I guess...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps!&lt;/p&gt;&#xA;" OwnerUserId="20876" LastActivityDate="2015-11-22T17:21:07.290" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24649" PostTypeId="2" ParentId="24643" CreationDate="2015-11-22T19:38:01.940" Score="1" Body="&lt;p&gt;If you consider the TCP session as a stream of bytes, the sequence number is the ordinal number of the first byte in the TCP segment.  So the first byte in the first segment is 1.  If there are 100 bytes in the segment, the first byte of the second segment will be 101.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-22T19:38:01.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24650" PostTypeId="1" CreationDate="2015-11-22T20:35:51.127" Score="2" ViewCount="2969" Body="&lt;p&gt;I have one public ip address that I would like to share among two private networks. To this end I have a first router/firewall and second router/firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, the second firewall terminates the public address on one of its ports and provides nating and filtering to one of the private networks, let's call it the second private network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now would like to 'highjack' the public ip address with the first router without the second router noticing too much (except changing the default gateway ip address on the second router perhaps). That is, I would like to terminate the public ip address on the first router directly and then redirect traffic to the second router without blocking any ports or anything, as if the second router was terminating the public ip address directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I would like to use the first router to also make the internet connection through the public ip address available to another private network, let's call it the first private network, hanging off one of the first router's ethernet ports and implementing a firewall there, however with the possibility to have any port from the public ip address available also on this first private network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, as an example, one scenario that could happen with this setup is that somebody sets up a webserver on the second private network and configures port forwarding of port 80 on the second router/fw to this webserver. At the same time, I configure port forwarding of port 80 on the first router to a webhost on the first network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, there is an ambiguity here: somebody connecting to port 80 on the public address, should s/he be directed to the first or second private network? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could this be resolved somehow? If so, could it be done with the resources described or do I need more network equipment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How, roughly described, would I set this up practically? For any configuration example, I use Vyatta/Vyos/Edgemax routers if you are familiar with those. &lt;/p&gt;&#xA;" OwnerUserId="20877" LastEditorUserId="20877" LastEditDate="2015-11-22T20:41:39.597" LastActivityDate="2022-10-21T16:59:16.393" Title="Connecting one public ip address independently to two private ip networks with full port availabilty on both?" Tags="|routing|nat|design|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24651" PostTypeId="2" ParentId="24650" CreationDate="2015-11-22T20:47:10.460" Score="1" Body="&lt;p&gt;If you have a single public address, you can forward one transport protocol/port to one private address. Routing is deterministic, and you want it to not be. It's like having two hosts with the name IP address on the same network; anycast does this, but it uses the routing protocol to deliver the traffic to the closest (as determined by the routing protocol) host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As your company grows, you need get more public addresses, or you can use a hosting provider.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-22T20:47:10.460" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24652" PostTypeId="2" ParentId="24445" CreationDate="2015-11-22T20:48:43.287" Score="1" Body="&lt;p&gt;Although technically you might be able to bridge all the different PLC networks together into one big layer-2 domain using WiFi (for which you can indeed then run a single DHCP server), such a setup would probably be very unstable and unreliable as all the broadcast and multicast traffic would have to be duplicated across all those networks.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-11-22T20:48:43.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24653" PostTypeId="2" ParentId="24650" CreationDate="2015-11-23T01:26:24.053" Score="2" Body="&lt;p&gt;If you only need to direct http/https connections to different web servers, then you need a &lt;a href=&quot;https://en.wikipedia.org/wiki/Reverse_proxy&quot; rel=&quot;nofollow&quot;&gt;reverse-proxy&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;install and configure your reverse-proxy inside your network&lt;/li&gt;&#xA;&lt;li&gt;make sure your reverse-proxy can contact all your internal networks&lt;/li&gt;&#xA;&lt;li&gt;redirect the public 80 port to the reverse-proxy&lt;/li&gt;&#xA;&lt;li&gt;and voilà, you can reach several different web servers from the outside&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you need to share other ports, then you have to find a way to decide why each packet must go in which network. In most case this is very difficult and require to write your own reverse-proxy.&lt;/p&gt;&#xA;" OwnerUserId="20878" LastActivityDate="2015-11-23T01:26:24.053" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24654" PostTypeId="2" ParentId="14944" CreationDate="2015-11-23T03:08:30.863" Score="0" Body="&lt;p&gt;Your setup seems reasonable to me but I do not have any experience setting up networks in a warehouse environment. Two things that I would caution you to think about when implementing the network though are these: 1) any interference that may come from metal shelving units or products that could interrupt the wireless signal and 2) interference or crosstalk caused by the lights or other electrical lines running along the ceilings where you plan to position the APs. &lt;/p&gt;&#xA;" OwnerUserId="20879" LastActivityDate="2015-11-23T03:08:30.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24656" PostTypeId="1" AcceptedAnswerId="24657" CreationDate="2015-11-23T05:36:44.393" Score="1" ViewCount="102" Body="&lt;p&gt;This question pertains to a situation where we have a server with a single NIC somewhere on a large corporate network. (Not sure how much it matters but in this scenario there are no VPNs involved.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We also have two sets of users, &lt;strong&gt;SET A&lt;/strong&gt; accessing the server from IP addresses within a specific range, and &lt;strong&gt;SET B&lt;/strong&gt; accessing it from IP addresses within another range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to make the server accessible through one IP-address for SET A and another for SET B? What are the requirements (limitations) for this to work?&lt;/p&gt;&#xA;" OwnerDisplayName="user14639" LastActivityDate="2015-11-23T18:25:10.373" Title="Can a server with 1 NIC be configured to be accessible from 2 separate IP addresses to clients based on client IP range?" Tags="|nat|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24657" PostTypeId="2" ParentId="24656" CreationDate="2015-11-23T07:03:26.010" Score="-1" Body="&lt;p&gt;I'm not sure why you would need to do what you are proposing since traffic from each set of users can be routed to the server with a single IP address, regardless of what addressing range it uses. That is really the whole point of IP addressing and routing, and everyone in this large corporate network can use a single IP address to get to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few ways to do this. For instance, many servers can use 802.1Q trunking to use multiple VLANs. You would configure the subnets on your router and the VLANs on your switch, and then trunk the VLANs to the server.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-23T07:03:26.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24658" PostTypeId="1" AcceptedAnswerId="24659" CreationDate="2015-11-23T08:52:13.397" Score="1" ViewCount="1262" Body="&lt;p&gt;What adverse effects could occurred if I set the igmp snooping querier query-interval to 1 second in the switch? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default in switch is 60 seconds&lt;/p&gt;&#xA;" OwnerUserId="20883" LastEditorUserId="8499" LastEditDate="2018-03-19T15:42:03.793" LastActivityDate="2018-03-19T15:42:03.793" Title="IGMP Query Interval" Tags="|multicast|igmp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24659" PostTypeId="2" ParentId="24658" CreationDate="2015-11-23T09:00:19.390" Score="0" Body="&lt;p&gt;Decreasing the query interval could needlessly increase the traffic on your LAN segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IGMP is between a host and a router, not a switch. A switch can snoop on IGMP, but it doesn't do IGMP queries.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-23T09:00:19.390" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="24660" PostTypeId="2" ParentId="24658" CreationDate="2015-11-23T09:02:47.790" Score="1" Body="&lt;p&gt;The default, per spec is 125 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set to 1 (one) second would result in a broadcast storm as every multicast capable device answers the query.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-11-23T09:02:47.790" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24661" PostTypeId="2" ParentId="24563" CreationDate="2015-11-23T09:09:04.653" Score="0" Body="&lt;p&gt;Hope this clarifies any confusion.&#xA;You have your computer connected to internet through a Cisco router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Computer()––––––( R )––––––Internet(I)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the router ( R ) there are two ports involved in forwarding the data to and from internet. Let's say we call the port connected to your LAN as Port1 and the port connected to internet is Port 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;–––1( R )2–––I&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Ip Addresses:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;/strong&gt; - 10.0.0.10/8&lt;br&gt;&#xA;&lt;strong&gt;1&lt;/strong&gt; - 10.0.0.1/8&lt;br&gt;&#xA;&lt;strong&gt;2&lt;/strong&gt; - 20.0.0.1/8&lt;br&gt;&#xA;&lt;strong&gt;I&lt;/strong&gt; - 20.0.0.2/8 (some address on internet)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Router ACL can be enforced on either of these ports in either direction (in or out). Let's see what happens in the following cases:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ping internet ( I ) from your computer (  ).&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;(  ) sends out an Echo request. &lt;code&gt;&amp;gt;–––1( R )2–––I&lt;/code&gt;  &lt;/li&gt;&#xA;&lt;li&gt;The IP packet will have the Source IP Address= 10.0.0.10 and Destination IP Address = 20.0.0.2&lt;/li&gt;&#xA;&lt;li&gt;Router ( R ) receives the packet on interface ( 1 ). &lt;code&gt;–––&amp;gt;1( R )2–––I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;( R ) checks the routing table and based on that decides to forward the packet to interface 2. &lt;code&gt;–––1( R &amp;gt;)2–––I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Interface ( 2 ) of ( R ) will prepare the packet based on the type of WAN link and send it forward to ( I ) (20.0.0.2) &lt;code&gt;–––1( R )2&amp;gt;–––I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;( I ) receives the packet. &lt;code&gt;–––1( R )2–––&amp;gt;I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;( I ) responds to the packet using a Echo Reply. &lt;code&gt;–––1( R )2––&amp;lt;–I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;This packet will have the Source IP Address= 20.0.0.2 and Destination IP Address= 10.0.0.10&lt;/li&gt;&#xA;&lt;li&gt;Eventually ( R ) will receive the packet on its interface ( 2 ). &lt;code&gt;–––1( R )2&amp;lt;–––I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;( R ) will check the route in its routing table and forward the packet to its interface ( 1 ). &lt;code&gt;–––1(&amp;lt; R )2–––I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Interface ( 1 ) of ( R ) will prepare the packet based on the type of LAN link and send it forward to (  ) (10.0.0.10). &lt;code&gt;–––&amp;lt;1( R )2–––I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;(  ) receives the packet. &lt;code&gt;&amp;lt;–––1( R )2–––I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;li&gt;Ping internet ( I ) from your computer ( R ).&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;( R ) prepares an Echo request.&lt;/li&gt;&#xA;&lt;li&gt;( R ) checks its routing table and concludes that the packet needs to be sent out from interface ( 2 ). &lt;code&gt;–––1( R &amp;gt;)2–––I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;As the ( R ) has two interface it can choose to put either of their address as in the Source IP Address field, i.e 10.0.0.1 or 20.0.0.1. &lt;strong&gt;It chooses the exit interface IP address as the source by default&lt;/strong&gt;. This is to simplify the routing process. &lt;em&gt;Extended Ping command can be used to change this behaviour&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;So the IP packet will have the Source IP Address= 20.0.0.1 and Destination IP Address = 20.0.0.2.&lt;/li&gt;&#xA;&lt;li&gt;Interface ( 2 ) of ( R ) will prepare the packet based on the type of WAN link and send it forward to ( I ) (20.0.0.2) &lt;code&gt;–––1( R )2&amp;gt;–––I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;( I ) receives the packet. &lt;code&gt;–––1( R )2–––&amp;gt;I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;( I ) responds to the packet using a Echo Reply. &lt;code&gt;–––1( R )2––&amp;lt;–I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;This packet will have the Source IP Address= 20.0.0.2 and Destination IP Address= 20.0.0.1&lt;/li&gt;&#xA;&lt;li&gt;Eventually ( R ) will receive the packet on its interface ( 2 ). &lt;code&gt;–––1( R )2&amp;lt;–––I&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h3&gt;ACL function&lt;/h3&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;When the ACL is bound on interface ( 1 ) in inbound direction &lt;code&gt;–––&amp;gt;|1( R )2–––I&lt;/code&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The packet &lt;code&gt;–––&amp;gt;1|( R )2–––I&lt;/code&gt; will be checked by ACL.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1|( R &amp;gt;)2–––I&lt;/code&gt; will not be checked by ACL.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1|( R )2&amp;lt;–––I&lt;/code&gt; will not be checked by ACL.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1|(&amp;lt; R )2–––I&lt;/code&gt; will not be checked by ACL.&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;When the ACL is bound on interface ( 1 ) in outbound direction &lt;code&gt;–––1|(&amp;lt; R )2–––I&lt;/code&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The packet &lt;code&gt;–––&amp;gt;1|( R )2–––I&lt;/code&gt; will not be checked by ACL.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1|( R &amp;gt;)2–––I&lt;/code&gt; will not be checked by ACL.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1|( R )2&amp;lt;–––I&lt;/code&gt; will not be checked by ACL.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1|(&amp;lt; R )2–––I&lt;/code&gt; will be checked by ACL.&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;When the ACL is bound on interface ( 2 ) in inbound direction &lt;code&gt;–––1( R )|2&amp;lt;–––I&lt;/code&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The packet &lt;code&gt;–––&amp;gt;1( R )|2–––I&lt;/code&gt; will not be checked by ACL.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1( R &amp;gt;)|2–––I&lt;/code&gt; will not be checked by ACL.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1( R )|2&amp;lt;–––I&lt;/code&gt; &lt;strong&gt;will be checked by ACL&lt;/strong&gt;.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1(&amp;lt; R )|2–––I&lt;/code&gt; will not be checked by ACL&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;li&gt;When the ACL is bound on interface ( 2 ) in outbound direction &lt;code&gt;–––1( R &amp;gt;)|2–––I&lt;/code&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The packet &lt;code&gt;–––&amp;gt;1( R )|2–––I&lt;/code&gt; will not be checked by ACL.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1( R &amp;gt;)|2–––I&lt;/code&gt; &lt;strong&gt;will be checked by ACL unless it was generated by ( R )&lt;/strong&gt;.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1( R )|2&amp;lt;–––I&lt;/code&gt; &lt;strong&gt;will not be checked by ACL&lt;/strong&gt;.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;–––1(&amp;lt; R )|2–––I&lt;/code&gt; will not be checked by ACL.&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h3&gt;Note&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Any packet going out from Router ( R ) to Internet has a chance of Inspection only if the ACL is placed on the path the packet would take ( 2 ) and in the direction the packet would take ( Outbound).&lt;/li&gt;&#xA;&lt;li&gt;Packet being forwarded by Router ( R ) retains the Source IP address of the LAN system unless NATed.&lt;/li&gt;&#xA;&lt;li&gt;Packet generated by Router ( R ) takes the &lt;strong&gt;exit interface IP address&lt;/strong&gt; as source by default (20.0.0.2).&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Extended Ping command can make the Router ( R ) generate a packet with a different interface IP address as the source (10.0.0.1). Still in this case the packet gets generated inside the Router ( R ) although with the IP Address of the interface where the ACL is bound ( 1 ) it would &lt;strong&gt;not&lt;/strong&gt; be inspected by that ACL.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;TLDR&lt;/h3&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Any packet going out from Router to Destination has a chance of Inspection only if the ACL is placed on the path the packet would take ( exit interface ) and in the direction the packet would take ( Outbound). Unless the packet is generated by the router forwarding the packet.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Reference&lt;/h3&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Cisco documentation on &lt;a href=&quot;http://www.cisco.com/c/en/us/tech/ip/access-lists/index.html&quot; rel=&quot;nofollow&quot;&gt;ACL&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4752" LastEditorUserId="4752" LastEditDate="2015-11-23T17:28:27.727" LastActivityDate="2015-11-23T17:28:27.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24663" PostTypeId="1" AcceptedAnswerId="24695" CreationDate="2015-11-23T09:46:55.950" Score="1" ViewCount="1709" Body="&lt;p&gt;I have a Sonicwall with two WAN connections, a primary WAN (X1) and backup WAN (X2). I have defined a DMZ on X3 in transparent mode, to use some of the public IPs from the WAN. I can't use NAT since these are VOIP servers, which are allergic to NAT. I am noticing that I can only specify the IP range from the primary WAN. If the primary WAN is down, I can't use the backup WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Despite having two WANs, I am not able to achieve network redundancy. How can I use public IPs from both WAN ranges in transparent mode? Is it possible at all?&lt;/p&gt;&#xA;" OwnerUserId="11931" LastActivityDate="2016-03-10T18:20:38.543" Title="How to put more than one WAN subnets into transparent mode in sonicwall?" Tags="|sonicwall|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24664" PostTypeId="1" CreationDate="2015-11-23T10:03:50.543" Score="4" ViewCount="471" Body="&lt;p&gt;I have one P2P Circuit from our HQ to a secondary office. the distance between them is approx 2kms. Earlier when the Circuit was delivered at that time we were having an RTT of 3-4ms. It is a 10Mbps Circuit and when there is traffic flowing on it, irrespective to the amount of Traffic, the Latency reaches to 300-400ms. But when I remove all the traffic from the Circuit then it gives a proper RTT of 2-3ms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you suggest what could be the Issue?&lt;/p&gt;&#xA;" OwnerUserId="20886" LastEditorUserId="8499" LastEditDate="2018-03-22T21:41:28.973" LastActivityDate="2018-03-22T21:41:28.973" Title="Latency in P2P Circuit" Tags="|ping|troubleshooting|wan|latency|congestion|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24665" PostTypeId="2" ParentId="24664" CreationDate="2015-11-23T10:13:02.200" Score="3" Body="&lt;p&gt;This is to be expected if your routers are filling the buffers. If you are using ping to test this, understand that ping has the lowest priority.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your traffic mix, you may want to use QoS to define which traffic gets priority. ICMP should be on the bottom of the list, so ping should still not give you a good number when it is under load.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-23T10:13:02.200" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="24668" PostTypeId="1" AcceptedAnswerId="24698" CreationDate="2015-11-23T12:04:17.733" Score="2" ViewCount="9769" Body="&lt;p&gt;I have two networks Network 1 and Network 2 shown in the picture, and one client machine that must access resources on both networks. Due to security reasons the two networks must be isolated from each other. I have only basic understanding of networking and am complete newbie to Mikrotiks. How do I configure the router to support this configuration? I understand that this scenario is like having 2 ISPs, but I cannot figure out how to configure the routes so that each gateway is used only to access it's own resources.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Zcmyv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zcmyv.png&quot; alt=&quot;Network Schema&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;gvhfghj&lt;/p&gt;&#xA;" OwnerUserId="20891" LastEditorUserId="8499" LastEditDate="2018-02-14T16:26:18.977" LastActivityDate="2018-02-14T16:26:18.977" Title="Connecting clients to two networks using Mikrotik router" Tags="|routing|network-core|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-07T15:08:15.113" ContentLicense="CC BY-SA 3.0" />
  <row Id="24675" PostTypeId="1" AcceptedAnswerId="24676" CreationDate="2015-11-23T17:48:14.733" Score="1" ViewCount="1377" Body="&lt;p&gt;So I have a small topology ( 4 AS ), and I tested it on a real environment (College Lab) with Cisco routers (2000 series).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The latency from one point to another was too high when I used GNS3, the latency just spiked (100 ms), while in a real environment was lower (22 ms).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please explain the reason?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand GNS3 emulates routing and switching and depends on my PC especifications. (I have a intel i5 PC with 8GB RAM).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this is the GNS3 topology, I use my own Windows loopback interface for PC1, and Ubuntu VM on PC2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the real environment I use 2 different PCs (and of course, different routers). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm testing BGP route propagation and stuff, but when I test latency (using ping and using average value) it spikes in GNS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mIygj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mIygj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for your help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Daniel&lt;/p&gt;&#xA;" OwnerUserId="20012" LastActivityDate="2015-11-23T17:55:34.627" Title="GNS3 Latency test" Tags="|bgp|latency|gns3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24676" PostTypeId="2" ParentId="24675" CreationDate="2015-11-23T17:55:34.627" Score="2" Body="&lt;p&gt;You answered your own question.  GNS3 emulates routers and switches, so it can't work as fast as dedicated processors.  In this case, you have one processor trying to do the work of eight, and emulate a Linux box.  I'm actually impressed it's working as fast as it is.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-23T17:55:34.627" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24677" PostTypeId="1" CreationDate="2015-11-23T18:18:41.920" Score="1" ViewCount="1317" Body="&lt;p&gt;I'm fairly new to networking in general, but I need to develop a 4 point mesh with redundant paths routing multicast from point A to points B and C. I've already setup the mesh and have network redistribution with OSPF and PIM-SM running and working (99% anyways... I think), however, I'm having a issue where if a source is connected to any router that is not the RP (where the RP is also the gateway for the source) the multicast is not being distributed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand it, the router receiving the multicast should be either notifying the RP that he has the source for that group so the RP can build the SPT or should be unicasting the stream to the RP for it's redistribution, but there's no traffic going from this router towards the RP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my lab, I'm using 4x catalyst 3550 switches with the EMI firmware to enable the multicast routing. I've set it up using the autorp feature (I only intend to have a single RP) in case we later on decide to add more redundancy to the design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything I need to do on the non-rp router to tell him &quot;if you see this multicast IP originating within one of your networks relay it to the RP&quot; or should this be happening on its own?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname PT&#xA;!&#xA;no logging console&#xA;!&#xA;username EDITED privilege 15 secret 5 EDITED&#xA;aaa new-model&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;ip subnet-zero&#xA;ip routing&#xA;no ip domain-lookup&#xA;!&#xA;!&#xA;ip multicast-routing&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode rapid-pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;ip ssh version 2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 172.30.255.0 255.255.255.255&#xA; ip pim sparse-mode&#xA;!&#xA;interface FastEthernet0/1&#xA; description CNMG&#xA; no switchport&#xA; ip address 172.30.2.1 255.255.255.252&#xA; ip pim sparse-mode&#xA; ip ospf cost 100&#xA; load-interval 30&#xA;!&#xA;!&#xA;interface FastEthernet0/3&#xA; description TT&#xA; no switchport&#xA; ip address 172.30.2.17 255.255.255.252&#xA; ip pim sparse-mode&#xA; ip ospf cost 1000&#xA; load-interval 30&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/24&#xA; description WinPC_Server_Source&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; load-interval 30&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/1&#xA; switchport mode dynamic desirable&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport mode dynamic desirable&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.20.254 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; ip address 172.30.100.6 255.255.255.248&#xA; ip pim sparse-mode&#xA;!&#xA;router ospf 100&#xA; log-adjacency-changes&#xA; redistribute connected metric-type 1 subnets&#xA; network 172.30.2.0 0.0.0.3 area 0&#xA; network 172.30.2.16 0.0.0.3 area 0&#xA;!&#xA;ip default-gateway 172.30.0.254&#xA;ip classless&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;ip pim autorp listener&#xA;ip pim send-rp-announce Loopback0 scope 12 group-list 1&#xA;ip pim send-rp-discovery scope 12&#xA;!&#xA;access-list 1 permit 239.10.10.0 0.0.0.255&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; privilege level 15&#xA;line vty 5 15&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Source:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec localtime show-timezone&#xA;no service password-encryption&#xA;!&#xA;hostname Cumberland&#xA;!&#xA;no logging console&#xA;!&#xA;username EDITED secret 5 EDITED&#xA;aaa new-model&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;clock timezone POS -4&#xA;ip subnet-zero&#xA;ip routing&#xA;no ip domain-lookup&#xA;!&#xA;!&#xA;ip multicast-routing&#xA;no ip igmp snooping&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 172.30.255.2 255.255.255.255&#xA;!&#xA;interface FastEthernet0/1&#xA; description TT&#xA; no switchport&#xA; ip address 172.30.2.10 255.255.255.252&#xA; ip pim sparse-mode&#xA; ip ospf cost 200&#xA; load-interval 30&#xA;!&#xA;interface FastEthernet0/2&#xA; description CNMG&#xA; no switchport&#xA; ip address 172.30.2.5 255.255.255.252&#xA; ip pim sparse-mode&#xA; ip ospf cost 100&#xA; load-interval 30&#xA;!&#xA;! int 3-47 not in use&#xA;!&#xA;interface FastEthernet0/48&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; load-interval 30&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/1&#xA; switchport mode dynamic desirable&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport mode dynamic desirable&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.22.254 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; ip address 172.30.100.22 255.255.255.248&#xA; ip pim sparse-mode&#xA;!&#xA;router ospf 100&#xA; log-adjacency-changes&#xA; redistribute connected metric-type 1 subnets&#xA; network 172.30.2.4 0.0.0.3 area 0&#xA; network 172.30.2.8 0.0.0.3 area 0&#xA;!&#xA;ip classless&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;ip pim autorp listener&#xA;ip pim send-rp-discovery scope 12&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; privilege level 15&#xA;line vty 5 15&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt;&#xA;Here's a diagram describing my topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qcJR5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qcJR5.png&quot; alt=&quot;Topology Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE #2:&lt;/strong&gt;&#xA;I'm adding the &lt;strong&gt;show&lt;/strong&gt; data requested by Ron in the comments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cumberland&amp;gt;show ip mroute&#xA;IP Multicast Routing Table&#xA;Flags: D - Dense, S - Sparse, B - Bidir Group, s - SSM Group, C - Connected,&#xA;       L - Local, P - Pruned, R - RP-bit set, F - Register flag,&#xA;       T - SPT-bit set, J - Join SPT, M - MSDP created entry,&#xA;       X - Proxy Join Timer Running, A - Candidate for MSDP Advertisement,&#xA;       U - URD, I - Received Source Specific Host Report,&#xA;       Z - Multicast Tunnel, z - MDT-data group sender,&#xA;       Y - Joined MDT-data group, y - Sending to MDT-data group&#xA;       V - RD &amp;amp; Vector, v - Vector&#xA;Outgoing interface flags: H - Hardware switched, A - Assert winner&#xA; Timers: Uptime/Expires&#xA; Interface state: Interface, Next-Hop or VCD, State/Mode&#xA;&#xA;(*, 239.10.10.1), 2d02h/stopped, RP 172.30.255.0, flags: SJC&#xA;  Incoming interface: FastEthernet0/2, RPF nbr 172.30.2.6&#xA;  Outgoing interface list:&#xA;    Vlan2, Forward/Sparse, 2d02h/00:02:45, H&#xA;&#xA;(172.30.100.5, 239.10.10.1), 2d02h/00:02:59, flags: JT&#xA;  Incoming interface: FastEthernet0/2, RPF nbr 172.30.2.6&#xA;  Outgoing interface list:&#xA;    Vlan2, Forward/Sparse, 2d02h/00:02:45, H&#xA;&#xA;(*, 224.0.1.39), 2d02h/stopped, RP 0.0.0.0, flags: DCL&#xA;  Incoming interface: Null, RPF nbr 0.0.0.0&#xA;  Outgoing interface list:&#xA;    Vlan2, Forward/Sparse, 2d02h/00:00:00&#xA;    FastEthernet0/2, Forward/Sparse, 2d02h/00:00:00&#xA;    FastEthernet0/1, Forward/Sparse, 2d02h/00:00:00&#xA;&#xA;(172.30.255.0, 224.0.1.39), 2d02h/00:02:48, flags: LT&#xA;  Incoming interface: FastEthernet0/2, RPF nbr 172.30.2.6&#xA;  Outgoing interface list:&#xA;    FastEthernet0/1, Prune/Sparse, 00:02:14/00:00:45&#xA;    Vlan2, Forward/Sparse, 2d02h/00:00:00&#xA;&#xA;(*, 224.0.1.40), 2d02h/stopped, RP 0.0.0.0, flags: DCL&#xA;  Incoming interface: Null, RPF nbr 0.0.0.0&#xA;  Outgoing interface list:&#xA;    FastEthernet0/2, Forward/Sparse, 2d02h/00:00:00&#xA;    FastEthernet0/1, Forward/Sparse, 2d02h/00:00:00&#xA;    Vlan2, Forward/Sparse, 2d02h/00:00:00&#xA;&#xA;(172.30.2.10, 224.0.1.40), 00:01:37/00:01:22, flags: L&#xA;  Incoming interface: FastEthernet0/1, RPF nbr 0.0.0.0&#xA;  Outgoing interface list:&#xA;    Vlan2, Forward/Sparse, 00:01:37/00:00:00&#xA;    FastEthernet0/2, Forward/Sparse, 00:01:37/00:00:00&#xA;&#xA;(172.30.2.5, 224.0.1.40), 00:01:37/00:01:22, flags: L&#xA;  Incoming interface: FastEthernet0/2, RPF nbr 0.0.0.0&#xA;  Outgoing interface list:&#xA;    Vlan2, Forward/Sparse, 00:01:37/00:00:00&#xA;    FastEthernet0/1, Forward/Sparse, 00:01:37/00:00:00&#xA;&#xA;(172.30.2.17, 224.0.1.40), 2d02h/00:02:16, flags: LT&#xA;  Incoming interface: FastEthernet0/1, RPF nbr 172.30.2.9&#xA;  Outgoing interface list:&#xA;    Vlan2, Forward/Sparse, 2d02h/00:00:00&#xA;    FastEthernet0/2, Prune/Sparse, 00:01:50/00:01:09&#xA;&#xA;(172.30.2.1, 224.0.1.40), 2d02h/00:02:16, flags: LT&#xA;  Incoming interface: FastEthernet0/2, RPF nbr 172.30.2.6&#xA;  Outgoing interface list:&#xA;    FastEthernet0/1, Forward/Sparse, 2d02h/00:00:00&#xA;    Vlan2, Forward/Sparse, 2d02h/00:00:00&#xA;&#xA;Cumberland&amp;gt;sh ip pim neighbor&#xA;PIM Neighbor Table&#xA;Mode: B - Bidir Capable, DR - Designated Router, N - Default DR Priority,&#xA;      P - Proxy Capable, S - State Refresh Capable&#xA;Neighbor          Interface                Uptime/Expires    Ver   DR&#xA;Address                                                            Prio/Mode&#xA;172.30.2.9        FastEthernet0/1          2d02h/00:01:42    v2    1 / S P&#xA;172.30.2.6        FastEthernet0/2          2d02h/00:01:16    v2    1 / DR S P&#xA;Cumberland&amp;gt;sh ip pim rp map&#xA;PIM Group-to-RP Mappings&#xA;This system is an RP-mapping agent&#xA;&#xA;Group(s) 239.10.10.0/24&#xA;  RP 172.30.255.0 (?), v2v1&#xA;    Info source: 172.30.255.0 (?), elected via Auto-RP&#xA;         Uptime: 2d02h, expires: 00:02:14&#xA;Cumberland&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20897" LastEditorUserId="8499" LastEditDate="2019-01-05T00:42:45.970" LastActivityDate="2019-01-05T00:42:45.970" Title="Does a multicast source have to be connected to the RP for Cisco PIM-SM to work?" Tags="|cisco|routing|multicast|pim|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="24678" PostTypeId="1" AcceptedAnswerId="24685" CreationDate="2015-11-23T18:24:04.397" Score="4" ViewCount="2549" Body="&lt;p&gt;I have a question that is basically clarification of concepts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know IPMI &quot;...provides management and monitoring capabilities...&quot; [copy/paste from wiki]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And SNMP &quot;...exposes management data in the form of variables on the managed systems, which describe the system configuration....&quot; [also copy/paste from wiki]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After studying IPMI for a while, it seems that it can exist in a layer very close to the hardware, making it independent of O.S.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, SNMP runs in a more &quot;higher level&quot;, much closer to the O.S.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My understand is that: Both provide machine information, but IPMI will work independent of anything (like O.S.). While SNMP is just a way for the O.S. to expose machine information where it is sitting on.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the above statement correct? Or am I completely mistaken and I need better understand of both concepts? If that's the case, would you care to clarify?&lt;/p&gt;&#xA;" OwnerUserId="20900" LastActivityDate="2015-11-24T07:51:12.140" Title="IPMI and SNMP - Concept like location and functionality" Tags="|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24679" PostTypeId="2" ParentId="24656" CreationDate="2015-11-23T18:25:10.373" Score="2" Body="&lt;p&gt;&lt;strong&gt;Yes&lt;/strong&gt; it is possible.&lt;br&gt;&#xA;Most of the modern day OS have the ability to work with more than one IP Addresses on single interface.&lt;br&gt;&#xA;I'm sure you can assign IP Address on &lt;a href=&quot;http://www.tecmint.com/create-multiple-ip-addresses-to-one-single-network-interface/&quot; rel=&quot;nofollow&quot;&gt;Windows&lt;/a&gt; and &lt;a href=&quot;http://www.howtogeek.com/51741/how-to-quickly-add-multiple-ip-addresses-to-windows-servers/&quot; rel=&quot;nofollow&quot;&gt;Linux&lt;/a&gt;. But to make multiple LAN information reach your server you need to configure your Routers and Switches appropriately.  &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Switch&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If both these LAN from users of &lt;strong&gt;SetA&lt;/strong&gt; and &lt;strong&gt;SetB&lt;/strong&gt; connect to the same physical Layer 2 domain (Switching network) then you need to make sure that they are configured properly using &lt;strong&gt;VLAN&lt;/strong&gt; (which separates the data using logical Layer2 domains).&lt;/li&gt;&#xA;&lt;li&gt;A switch not supporting Trunking/Tagging (802.1Q) will not work properly in this scenario.  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Router&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It is possible that both the Set of users &lt;strong&gt;SetA&lt;/strong&gt; and &lt;strong&gt;SetB&lt;/strong&gt; may have to communicate between each other or may talk to systems outside your LAN (internet). In which case your Router should be configured with both these LAN's subnet address.&lt;/li&gt;&#xA;&lt;li&gt;If only one router is present in your network and a single link is connected from your Layer2 network (Switched Network) to your Router (Router on a stick) then again Trunk/Tagged link needs to be created.&lt;/li&gt;&#xA;&lt;li&gt;Such Router link has to be configured with Sub-interface with IP address from different subnet of SetA and SetB users.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Server&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If VLAN is configured in switched network, the link connecting to the Server should be configured as Trunk/Tagged (802.1Q enabled) as the Data so traveling from the users in SetA and SetB is lead to the Server using a single link.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h3&gt;Impact&lt;/h3&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Assigning multiple IP addresses to a single Server is common, especially in a web hosting setup but it work the same in just about every other scenario.&lt;/li&gt;&#xA;  &lt;li&gt;In case the NIC does not support 802.1Q then it would fail to differentiate between different traffic while sending out the data from its interface (now a days this is very rare and mostly occurs only with old drivers). &lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="4752" LastActivityDate="2015-11-23T18:25:10.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24680" PostTypeId="1" AcceptedAnswerId="25746" CreationDate="2015-11-23T18:31:04.480" Score="2" ViewCount="12396" Body="&lt;p&gt;Some network services require a group of open ports, and those might not even be next to each other (by port number, I mean). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm doing still is I create a dst-nat rule for each port that should be mapped to the server, then enable/disable the rule as needed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my specific case, that's a bit tedious because sometimes the ports should point to a different computer for a short period of time which means I have to manually change all the entries to the new IP each time I do this. Also, I wish I could just say &quot;disable service x&quot; instead of figuring out which port rules belong together. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a better and more efficient way of doing this? &lt;/p&gt;&#xA;" OwnerUserId="20652" LastEditorUserId="8499" LastEditDate="2018-02-14T16:26:03.930" LastActivityDate="2018-02-14T16:26:03.930" Title="Mikrotik RouterOS - NAT to multiple ports on the same IP" Tags="|router|firewall|dnat|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-09T23:48:08.800" ContentLicense="CC BY-SA 3.0" />
  <row Id="24682" PostTypeId="2" ParentId="24668" CreationDate="2015-11-23T19:58:38.680" Score="0" Body="&lt;p&gt;You should be able to put in ACLs on the interfaces for Network 1 and Network 2 to prevent those two networks from talking to each other. The ACLs should permit everything else, so your Operator can access both networks with no problem. &lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-23T19:58:38.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24683" PostTypeId="1" AcceptedAnswerId="24687" CreationDate="2015-11-23T20:08:54.547" Score="4" ViewCount="315" Body="&lt;p&gt;I would like to learn more about BGP and there are many good books as I see but most of were made around 2000. How much did BGP change since then? I know that BGP and TCP/IP are the fundamentals but 15 years in the IT world seems like a thousand years. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm mostly interested in these books:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;BGP4 Case Studies/Tutorial - Sam Halabi&lt;/li&gt;&#xA;&lt;li&gt;Internet Routing Architectures, 2nd Edition - Sam Halabi&lt;/li&gt;&#xA;&lt;li&gt;Routing TCP/IP, Volume II - Jeff Doyle, Jennifer DeHaven Carroll&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16778" LastEditorUserId="1420" LastEditDate="2015-11-27T06:08:09.060" LastActivityDate="2015-11-27T06:08:09.060" Title="How outdated are BGP books?" Tags="|bgp|tcp|ip|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24685" PostTypeId="2" ParentId="24678" CreationDate="2015-11-23T20:12:00.800" Score="4" Body="&lt;p&gt;If you read your IPMI article carefully, you will see that IPMI is primarily used for PCs and servers, and it is a specification for out-of-band management of a system. IPMI also requires specialized hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, SNMP is a software specification which is used across a wide variety of hardware, usually in the OS, and it is primarily used in-band. SNMP can be set to send traps to an SNMP server, or it can be polled by an SNMP server or application.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-24T07:51:12.140" LastActivityDate="2015-11-24T07:51:12.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24687" PostTypeId="2" ParentId="24683" CreationDate="2015-11-23T21:07:33.213" Score="2" Body="&lt;p&gt;The biggest change will be 32bit ASN's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing thats worth looking at is BGP security, especially RPKI, both RIPE and ARIN have good resources for them.&lt;/p&gt;&#xA;" OwnerUserId="3397" LastActivityDate="2015-11-23T21:07:33.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24689" PostTypeId="1" AcceptedAnswerId="24715" CreationDate="2015-11-23T21:58:28.647" Score="2" ViewCount="1944" Body="&lt;p&gt;I have a site-to-site tunnel up between two locations (non-ASA initiator, ASA responder). The tunnel will come up but not stay up. I'm 95% sure I have an issue in my crypto maps but I'm at a loss. The initiator's configuration is mostly hard coded. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what I've posted below, 2.2.2.2 is a dummy address for the initiator. See &quot;figure&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.54.0/23 - 1.1.1.1  ------------  2.2.2.2 - 10.24.16.0/28&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the more interesting parts of the config. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec security-association replay disable&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto map Internet_map 1 match address Internet_cryptomap_14&#xA;crypto map Internet_map 1 set pfs group5&#xA;crypto map Internet_map 1 set peer 2.2.2.2&#xA;crypto map Internet_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map Internet_map interface Internet&#xA;crypto ca trustpool policy&#xA;crypto ikev1 enable Internet&#xA;crypto ikev1 policy 30&#xA; authentication pre-share&#xA;&#xA;no arp permit-nonconnected&#xA;nat (Internet,Lab) source static DM_INLINE_NETWORK_4 DM_INLINE_NETWORK_4 destination static interface JUMPHOST service RDP-to-JH RDP-real description RDP to Terminal Server&#xA;nat (any,Lab) source static local-network local-network destination static LABTS LABTS service HTTPS HTTPS net-to-net&#xA;nat (Lab,Internet) source dynamic any interface description Lab computers share firewall's Internet address.&#xA;nat (Lab,Internet) source static any any destination static NETWORK_OBJ_192.168.56.0_24 NETWORK_OBJ_192.168.56.0_24&#xA;nat (Lab,Internet) source static local-network local-network destination static remote-network remote-network no-proxy-arp route-lookup&#xA;&#xA;&#xA;access-list Lab_access_in extended permit ip object local-network object remote-network &#xA;access-list Internet_cryptomap extended permit ip any4 object remote-network &#xA;access-list Internet_cryptomap_1 extended permit ip any4 object remote-network &#xA;access-list Internet_cryptomap_2 extended permit ip object local-network object remote-network &#xA;access-list Internet_cryptomap_3 extended permit ip object local-network object remote-network &#xA;access-list Internet_cryptomap_4 extended permit ip object local-network object remote-network &#xA;access-list Internet_cryptomap_5 extended permit ip any4 any4 &#xA;access-list Internet_cryptomap_65535.65535 extended permit ip object IP-for-RDP-PAT any4 &#xA;access-list Internet_cryptomap_6 extended permit ip any4 object remote-network &#xA;access-list Internet_cryptomap_7 extended permit ip object local-network object remote-network &#xA;access-list Internet_cryptomap_65535.65535_1 extended permit ip any4 any4 inactive &#xA;access-list Lab_cryptomap_65535.65535 extended permit ip any4 any4 inactive &#xA;access-list Internet_cryptomap_9 extended permit ip object local-network object remote-network &#xA;access-list Internet_cryptomap_8 extended permit ip object local-network any4 &#xA;access-list Internet_cryptomap_10 extended permit ip any4 object remote-network &#xA;access-list Internet_cryptomap_11 extended permit ip object local-network object remote-network &#xA;access-list Lab_cryptomap_1 extended permit ip object remote-network object local-network &#xA;access-list Internet_cryptomap_12 extended permit ip any any &#xA;access-list Internet_cryptomap_13 extended permit ip object local-network object remote-network &#xA;access-list Internet_cryptomap_14 extended permit ip object local-network object remote-network &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what debug anyone would want to see. Just shout and I'll post it up. Thanks for everyone's help. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;LSC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: Here's the output of &quot;debug crypto isakmp 127&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nov 24 08:41:54 [IKEv1]IP = 2.2.2.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 204&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, processing SA payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, Oakley proposal is acceptable&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, processing VID payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, processing VID payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, Received xauth V6 VID&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, processing VID payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, Received DPD VID&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, processing IKE SA payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, IKE SA Proposal # 1, Transform # 0 acceptable  Matches global IKE entry # 4&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, constructing ISAKMP SA payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, constructing Fragmentation VID + extended capabilities payload&#xA;Nov 24 08:41:54 [IKEv1]IP = 2.2.2.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + SA (1) + VENDOR (13) + NONE (0) total length : 108&#xA;Nov 24 08:41:54 [IKEv1]IP = 2.2.2.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + NONE (0) total length : 244&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, processing ke payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, processing ISA_KE payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, processing nonce payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, constructing ke payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, constructing nonce payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, constructing Cisco Unity VID payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, constructing xauth V6 VID payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, Send IOS VID&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, Constructing ASA spoofing IOS Vendor ID payload (version: 1.0.0, capabilities: 20000001)&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, constructing VID payload&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]IP = 2.2.2.2, Send Altiga/Cisco VPN3000/Cisco ASA GW VID&#xA;Nov 24 08:41:54 [IKEv1]IP = 2.2.2.2, Connection landed on tunnel_group 2.2.2.2&#xA;Nov 24 08:41:54 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Generating keys for Responder...&#xA;Nov 24 08:41:54 [IKEv1]IP = 2.2.2.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + KE (4) + NONCE (10) + VENDOR (13) + VENDOR (13) + VENDOR (13) + VENDOR (13) + NONE (0) total length : 320&#xA;Nov 24 08:41:55 [IKEv1]IP = 2.2.2.2, IKE_DECODE RECEIVED Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + NONE (0) total length : 64&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ID payload&#xA;Nov 24 08:41:55 [IKEv1 DECODE]Group = 2.2.2.2, IP = 2.2.2.2, ID_IPV4_ADDR ID received&#xA;2.2.2.2&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing hash payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Computing hash for ISAKMP&#xA;Nov 24 08:41:55 [IKEv1]IP = 2.2.2.2, Connection landed on tunnel_group 2.2.2.2&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing ID payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing hash payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Computing hash for ISAKMP&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing dpd vid payload&#xA;Nov 24 08:41:55 [IKEv1]IP = 2.2.2.2, IKE_DECODE SENDING Message (msgid=0) with payloads : HDR + ID (5) + HASH (8) + VENDOR (13) + NONE (0) total length : 84&#xA;Nov 24 08:41:55 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, PHASE 1 COMPLETED&#xA;Nov 24 08:41:55 [IKEv1]IP = 2.2.2.2, Keep-alive type for this connection: DPD&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Starting P1 rekey timer: 8100 seconds.&#xA;Nov 24 08:41:55 [IKEv1 DECODE]IP = 2.2.2.2, IKE Responder starting QM: msg id = 91e61bae&#xA;Nov 24 08:41:55 [IKEv1]IP = 2.2.2.2, IKE_DECODE RECEIVED Message (msgid=91e61bae) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NONE (0) total length : 416&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing hash payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing SA payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing nonce payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ke payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ISA_KE for PFS in phase 2&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ID payload&#xA;Nov 24 08:41:55 [IKEv1 DECODE]Group = 2.2.2.2, IP = 2.2.2.2, ID_IPV4_ADDR_SUBNET ID received--10.24.16.0--255.255.255.240&#xA;Nov 24 08:41:55 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Received remote IP Proxy Subnet data in ID Payload:   Address 10.24.16.0, Mask 255.255.255.240, Protocol 0, Port 0&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ID payload&#xA;Nov 24 08:41:55 [IKEv1 DECODE]Group = 2.2.2.2, IP = 2.2.2.2, ID_IPV4_ADDR_SUBNET ID received--192.168.54.0--255.255.254.0&#xA;Nov 24 08:41:55 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Received local IP Proxy Subnet data in ID Payload:   Address 192.168.54.0, Mask 255.255.254.0, Protocol 0, Port 0&#xA;Nov 24 08:41:55 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, QM IsRekeyed old sa not found by addr&#xA;Nov 24 08:41:55 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Static Crypto Map check, checking map = Internet_map, seq = 1...&#xA;Nov 24 08:41:55 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Static Crypto Map check, map Internet_map, seq = 1 is a successful match&#xA;Nov 24 08:41:55 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, IKE Remote Peer configured for crypto map: Internet_map&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing IPSec SA payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, IPSec SA Proposal # 0, Transform # 1 acceptable  Matches global IPSec SA entry # 1&#xA;Nov 24 08:41:55 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, IKE: requesting SPI!&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, IKE got SPI from key engine: SPI = 0x59d8f571&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, oakley constucting quick mode&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing blank hash payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing IPSec SA payload&#xA;Nov 24 08:41:55 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Overriding Initiator's IPSec rekeying duration from 0 to 4608000 Kbs&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing IPSec nonce payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing pfs ke payload&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing proxy ID&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Transmitting Proxy Id:&#xA;  Remote subnet: 10.24.16.0  Mask 255.255.255.240 Protocol 0  Port 0&#xA;  Local subnet:  192.168.54.0  mask 255.255.254.0 Protocol 0  Port 0&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Sending RESPONDER LIFETIME notification to Initiator&#xA;Nov 24 08:41:55 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing qm hash payload&#xA;Nov 24 08:41:55 [IKEv1 DECODE]Group = 2.2.2.2, IP = 2.2.2.2, IKE Responder sending 2nd QM pkt: msg id = 91e61bae&#xA;Nov 24 08:41:55 [IKEv1]IP = 2.2.2.2, IKE_DECODE SENDING Message (msgid=91e61bae) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NOTIFY (11) + NONE (0) total length : 388&#xA;Nov 24 08:41:56 [IKEv1 DECODE]IP = 2.2.2.2, IKE Responder starting QM: msg id = 279cbbd1&#xA;Nov 24 08:41:56 [IKEv1]IP = 2.2.2.2, IKE_DECODE RECEIVED Message (msgid=279cbbd1) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NONE (0) total length : 408&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing hash payload&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing SA payload&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing nonce payload&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ke payload&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ISA_KE for PFS in phase 2&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ID payload&#xA;Nov 24 08:41:56 [IKEv1 DECODE]Group = 2.2.2.2, IP = 2.2.2.2, ID_IPV4_ADDR ID received&#xA;2.2.2.2&#xA;Nov 24 08:41:56 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Received remote Proxy Host data in ID Payload:  Address 2.2.2.2, Protocol 0, Port 0&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ID payload&#xA;Nov 24 08:41:56 [IKEv1 DECODE]Group = 2.2.2.2, IP = 2.2.2.2, ID_IPV4_ADDR ID received&#xA;1.1.1.1&#xA;Nov 24 08:41:56 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Received local Proxy Host data in ID Payload:  Address 1.1.1.1, Protocol 0, Port 0&#xA;Nov 24 08:41:56 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, QM IsRekeyed old sa not found by addr&#xA;Nov 24 08:41:56 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Static Crypto Map check, checking map = Internet_map, seq = 1...&#xA;Nov 24 08:41:56 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Static Crypto Map check, map = Internet_map, seq = 1, ACL does not match proxy IDs src:2.2.2.2 dst:1.1.1.1&#xA;Nov 24 08:41:56 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 2.2.2.2/255.255.255.255/0/0 local proxy 1.1.1.1/255.255.255.255/0/0 on interface Internet&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, sending notify message&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing blank hash payload&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing qm hash payload&#xA;Nov 24 08:41:56 [IKEv1]IP = 2.2.2.2, IKE_DECODE SENDING Message (msgid=61889da) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 464&#xA;Nov 24 08:41:56 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, QM FSM error (P2 struct &amp;amp;0x00007fffa2f8dfe0, mess id 0x279cbbd1)!&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, IKE QM Responder FSM error history (struct &amp;amp;0x00007fffa2f8dfe0)  &amp;lt;state&amp;gt;, &amp;lt;event&amp;gt;:  QM_DONE, EV_ERROR--&amp;gt;QM_BLD_MSG2, EV_NEGO_SA--&amp;gt;QM_BLD_MSG2, EV_IS_REKEY--&amp;gt;QM_BLD_MSG2, EV_CONFIRM_SA--&amp;gt;QM_BLD_MSG2, EV_PROC_MSG--&amp;gt;QM_BLD_MSG2, EV_HASH_OK--&amp;gt;QM_BLD_MSG2, NullEvent--&amp;gt;QM_BLD_MSG2, EV_COMP_HASH&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, sending delete/delete with reason message&#xA;Nov 24 08:41:56 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Removing peer from correlator table failed, no match!&#xA;Nov 24 08:41:56 [IKEv1]IP = 2.2.2.2, IKE_DECODE RECEIVED Message (msgid=91e61bae) with payloads : HDR + HASH (8) + NONE (0) total length : 52&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing hash payload&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, loading all IPSEC SAs&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Generating Quick Mode Key!&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, NP encrypt rule look up for crypto map Internet_map 1 matching ACL Internet_cryptomap_14: returned cs_id=a204c060; encrypt_rule=a2116350; tunnelFlow_rule=a2116a10&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Generating Quick Mode Key!&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, NP encrypt rule look up for crypto map Internet_map 1 matching ACL Internet_cryptomap_14: returned cs_id=a204c060; encrypt_rule=a2116350; tunnelFlow_rule=a2116a10&#xA;Nov 24 08:41:56 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Security negotiation complete for LAN-to-LAN Group (2.2.2.2)  Responder, Inbound SPI = 0x59d8f571, Outbound SPI = 0xcce2fd3a&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, IKE got a KEY_ADD msg for SA: SPI = 0xcce2fd3a&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Pitcher: received KEY_UPDATE, spi 0x59d8f571&#xA;Nov 24 08:41:56 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Starting P2 rekey timer: 3418 seconds.&#xA;Nov 24 08:41:56 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, PHASE 2 COMPLETED (msgid=91e61bae)&#xA;Nov 24 08:42:06 [IKEv1 DECODE]IP = 2.2.2.2, IKE Responder starting QM: msg id = 279cbbd1&#xA;Nov 24 08:42:06 [IKEv1]IP = 2.2.2.2, IKE_DECODE RECEIVED Message (msgid=279cbbd1) with payloads : HDR + HASH (8) + SA (1) + NONCE (10) + KE (4) + ID (5) + ID (5) + NONE (0) total length : 408&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing hash payload&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing SA payload&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing nonce payload&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ke payload&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ISA_KE for PFS in phase 2&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ID payload&#xA;Nov 24 08:42:06 [IKEv1 DECODE]Group = 2.2.2.2, IP = 2.2.2.2, ID_IPV4_ADDR ID received&#xA;2.2.2.2&#xA;Nov 24 08:42:06 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Received remote Proxy Host data in ID Payload:  Address 2.2.2.2, Protocol 0, Port 0&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing ID payload&#xA;Nov 24 08:42:06 [IKEv1 DECODE]Group = 2.2.2.2, IP = 2.2.2.2, ID_IPV4_ADDR ID received&#xA;1.1.1.1&#xA;Nov 24 08:42:06 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Received local Proxy Host data in ID Payload:  Address 1.1.1.1, Protocol 0, Port 0&#xA;Nov 24 08:42:06 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, QM IsRekeyed old sa not found by addr&#xA;Nov 24 08:42:06 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Static Crypto Map check, checking map = Internet_map, seq = 1...&#xA;Nov 24 08:42:06 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Static Crypto Map check, map = Internet_map, seq = 1, ACL does not match proxy IDs src:2.2.2.2 dst:1.1.1.1&#xA;Nov 24 08:42:06 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Rejecting IPSec tunnel: no matching crypto map entry for remote proxy 2.2.2.2/255.255.255.255/0/0 local proxy 1.1.1.1/255.255.255.255/0/0 on interface Internet&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, sending notify message&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing blank hash payload&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing qm hash payload&#xA;Nov 24 08:42:06 [IKEv1]IP = 2.2.2.2, IKE_DECODE SENDING Message (msgid=6516a9f) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 464&#xA;Nov 24 08:42:06 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, QM FSM error (P2 struct &amp;amp;0x00007fffa2f8dfe0, mess id 0x279cbbd1)!&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, IKE QM Responder FSM error history (struct &amp;amp;0x00007fffa2f8dfe0)  &amp;lt;state&amp;gt;, &amp;lt;event&amp;gt;:  QM_DONE, EV_ERROR--&amp;gt;QM_BLD_MSG2, EV_NEGO_SA--&amp;gt;QM_BLD_MSG2, EV_IS_REKEY--&amp;gt;QM_BLD_MSG2, EV_CONFIRM_SA--&amp;gt;QM_BLD_MSG2, EV_PROC_MSG--&amp;gt;QM_BLD_MSG2, EV_HASH_OK--&amp;gt;QM_BLD_MSG2, NullEvent--&amp;gt;QM_BLD_MSG2, EV_COMP_HASH&#xA;Nov 24 08:42:06 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, sending delete/delete with reason message&#xA;Nov 24 08:42:06 [IKEv1]Group = 2.2.2.2, IP = 2.2.2.2, Removing peer from correlator table failed, no match!&#xA;Nov 24 08:42:10 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Sending keep-alive of type DPD R-U-THERE (seq number 0x5439854b)&#xA;Nov 24 08:42:10 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing blank hash payload&#xA;Nov 24 08:42:10 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, constructing qm hash payload&#xA;Nov 24 08:42:10 [IKEv1]IP = 2.2.2.2, IKE_DECODE SENDING Message (msgid=290294a3) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84&#xA;Nov 24 08:42:10 [IKEv1]IP = 2.2.2.2, IKE_DECODE RECEIVED Message (msgid=de876da5) with payloads : HDR + HASH (8) + NOTIFY (11) + NONE (0) total length : 84&#xA;Nov 24 08:42:10 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing hash payload&#xA;Nov 24 08:42:10 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, processing notify payload&#xA;Nov 24 08:42:10 [IKEv1 DEBUG]Group = 2.2.2.2, IP = 2.2.2.2, Received keep-alive of type DPD R-U-THERE-ACK (seq number 0x5439854b)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And for what it's worth, here's my Crypto Map window from ASDM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Object groups:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network local-network &#xA;object network remote-network&#xA;object-group network DM_INLINE_NETWORK_1&#xA;     network-object object ABC-Corp&#xA;     network-object object Lab-Offsite&#xA;    object-group network DM_INLINE_NETWORK_2&#xA;     network-object object ABC-Corp&#xA;     network-object object Lab-Offsite&#xA;    object-group service DM_INLINE_TCP_1 tcp&#xA;     port-object eq 26291&#xA;     port-object eq 3389&#xA;     port-object eq ftp&#xA;    object-group network DM_INLINE_NETWORK_3&#xA;     network-object object ABC-Corp&#xA;     network-object object Lab-Offsite&#xA;    object-group network DM_INLINE_NETWORK_4&#xA;     network-object object ABC-Corp&#xA;     network-object object Lab-Offsite&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/n7OCn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/n7OCn.png&quot; alt=&quot;ASDM crypto map&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20904" LastEditorUserId="20904" LastEditDate="2015-11-24T18:16:18.400" LastActivityDate="2016-11-19T01:55:19.220" Title="ASA to non-ASA Site-to-site VPN - Tunnel not staying up" Tags="|cisco|cisco-asa|ipsec|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="24692" PostTypeId="1" CreationDate="2015-11-24T03:12:55.593" Score="2" ViewCount="85" Body="&lt;p&gt;I have two Cisco 2950 switches connected with a Dell 7810 machine to provide network redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The machine is equipped with one built in (On Mother Board) Ethernet port and with a dual port NIC “Intel X520-T2 Dual Port 10GbE”. Here I have been facing problem in communicating the dual port NIC with the switch. The built in port is working fine in all cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the adapter settings/properties when the “Speed” of NIC is selected to “Auto Negotiate” it didn’t communicate with the switch. For that switch port is additionally configured and adjust the switch port Speed to “Auto”, after both adjustments a healthy communication is established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here can anyone be kind enough to let me know that why the communication didn’t established when only configured from adapter (NIC) settings/properties (Why the switch port configuration need is felt when the adapter is been configured to “Auto”)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more thing, as per my understanding the CISCO has now stopped the support for 2950. So if the access to the switch port configuration is not available through Internet Explorer, what should be the alternate to resolve the problem (keeping in mind the switches and machine are in always running mode)?&lt;/p&gt;&#xA;" OwnerUserId="20916" LastEditorUserId="8499" LastEditDate="2018-12-22T05:31:30.960" LastActivityDate="2018-12-22T05:31:30.960" Title="Why switch (2950) port configuration is needed when NIC adapter is configuired?" Tags="|cisco|switch|cisco-catalyst|interface|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24693" PostTypeId="2" ParentId="24692" CreationDate="2015-11-24T03:19:12.923" Score="1" Body="&lt;p&gt;The way it works is that if one side is set to Auto, the other side needs to be set to Auto for things to work correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If one side is set to fixed speed and duplex, the other side can detect the speed, but will default to the duplex for the speed (10/100 Mb is half, 1 Gb is full, and 10 Gb only has full). The mismatched duplex causes all kinds of problems on the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a document, &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/17053-46.html&quot; rel=&quot;nofollow&quot;&gt;Troubleshooting Cisco Catalyst Switches to NIC Compatibility Issues&lt;/a&gt;, which explains this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2950 has been EoL for a long time. That doesn't change the way which it can be configured, so I'm not sure about your last question. Most of the time, Cisco devices will be configured with something like telnet or SSH using the CLI. The console port can also be used for configuration when someone is on-site with the switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-24T03:29:03.050" LastActivityDate="2015-11-24T03:29:03.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24694" PostTypeId="1" AcceptedAnswerId="24699" CreationDate="2015-11-24T07:45:14.243" Score="1" ViewCount="166" Body="&lt;p&gt;I have connected to a wifi network i have assigned with an ip:192.168.5.125&#xA;subnet:255.255.240.0 . but my gateway is in 192.168.0.1 how could this possible? And i have observed my friend's ip he also connected to the same wifi network. he got 192.168.1.28 and he also have the same gateway 192.168.0.1. And I could able to ping him also. How come this possibe?&lt;/p&gt;&#xA;" OwnerUserId="6195" LastEditorUserId="8499" LastEditDate="2018-03-11T02:01:36.023" LastActivityDate="2018-03-11T02:01:36.023" Title="How come my gateway have different subnet ip" Tags="|vlan|ipv4|ip|subnet|network-discovery|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24695" PostTypeId="2" ParentId="24663" CreationDate="2015-11-24T07:50:32.680" Score="1" Body="&lt;p&gt;Looks like there is no way to do it using single Sonicwall. Therefore, I will use two sonicwalls in parallel.&lt;/p&gt;&#xA;" OwnerUserId="11931" LastActivityDate="2015-11-24T07:50:32.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24696" PostTypeId="2" ParentId="24694" CreationDate="2015-11-24T07:54:27.317" Score="2" Body="&lt;p&gt;That is because you are on the same network, &lt;code&gt;192.168.0.0/20&lt;/code&gt;. That network goes from &lt;code&gt;192.168.0.0&lt;/code&gt; to &lt;code&gt;192.168.15.255&lt;/code&gt;. The network has 4096 addresses, and 4094 of them can be used for hosts.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-24T07:54:27.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24698" PostTypeId="2" ParentId="24668" CreationDate="2015-11-24T08:40:19.200" Score="3" Body="&lt;p&gt;assign the correct IPs to each interface, for example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ip address add interface=ether1 address=10.191.4.192/24&#xA;/ip address add interface=ether2 address=10.100.4.100/24&#xA;/ip address add interface=ether3 address=192.168.10.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(not sure about the /24 masks, you have to adapt to your real network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;by default, mikrotik does automatic routing, so you just have to block traffic between network1 and network2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ip firewall filter chain=prerouting src-address=10.191.4.0/24 dst-address=10.100.4.0/24 action=drop&#xA;/ip firewall filter chain=prerouting src-address=10.100.4.0/24 dst-address=10.191.4.0/24 action=drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so traffic between net1 and net2 is blocked but traffic between net1/net2 and operator is allowed. Of course you will have to add the correct routes on all the devices, for example for operator, if it's a windows system&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route add 10.191.4.0 mask 255.255.255.0 192.168.10.1&#xA;route add 10.100.4.0 mask 255.255.255.0 192.168.10.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20569" LastActivityDate="2015-11-24T08:40:19.200" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24699" PostTypeId="2" ParentId="24694" CreationDate="2015-11-24T09:06:21.897" Score="5" Body="&lt;p&gt;The subnet mask is &lt;code&gt;255.255.240.0&lt;/code&gt; which means 20 bits belong to Network and remaining 12 is for host. The range of IP Address inside the network can be found by running your IP address against Subnet Mask.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address:   192.168.5.125         11000000.10101000.0000 0101.01111101&#xA;Netmask:   255.255.240.0 = 20    11111111.11111111.1111 0000.00000000&#xA;=&amp;gt;&#xA;Network:   192.168.0.0/20        11000000.10101000.0000 0000.00000000 (Class C)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The broadcast IP, First Host and Last host IP addresses are:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Broadcast: 192.168.15.255        11000000.10101000.0000 1111.11111111&#xA;HostMin:   192.168.0.1           11000000.10101000.0000 0000.00000001&#xA;HostMax:   192.168.15.254        11000000.10101000.0000 1111.11111110&#xA;Hosts per Network : 4094         (Private Internet)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So your IP address, your friend's IP address and the Gateway IP address all belong to the same network. They should communicate without any trouble.&lt;/p&gt;&#xA;" OwnerUserId="4752" LastActivityDate="2015-11-24T09:06:21.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24700" PostTypeId="1" AcceptedAnswerId="24721" CreationDate="2015-11-24T09:38:51.207" Score="3" ViewCount="6356" Body="&lt;p&gt;I have a Layer-3 switch with three VLANs and a router, using OSPF routing protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current setting:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A router with router-id 1.1.1.1&lt;/li&gt;&#xA;&lt;li&gt;An interface connect to L3 switch with 192.168.2.1/24&lt;/li&gt;&#xA;&lt;li&gt;A L3 switch with router-id 2.2.2.2&lt;/li&gt;&#xA;&lt;li&gt;VLAN 1 on L3 switch 192.168.1.10/24&lt;/li&gt;&#xA;&lt;li&gt;VLAN 2 on L3 switch 192.168.2.10/24, a port connected to router&lt;/li&gt;&#xA;&lt;li&gt;VLAN 10 on L3 switch 192.168.10.1/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I didn't set VLANs on the router. So maybe that's why it doesn't aware there are VLANs from 192.168.2.1/24. I have looked into InterVLAN routing and set same VLANs on router with &lt;strong&gt;switchport&lt;/strong&gt; command. However, only VLAN 2 is working and I lost LSA of subnet of 192.168.2.0/24. I guess I still don't know how to achieve that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under current setting, I can advertise a LSA of subset 192.168.2.0/24 with a direct link on VLAN 2 to the router, and that makes OSPF network aware subnet of 192.168.2.0/24. However, I want OSPF network know it can connect to subnet of 192.168.1.0/24 and subnet of 192.168.10.0/24 too. How do I do that? Or is it possible?&lt;/p&gt;&#xA;" OwnerUserId="20657" LastEditorUserId="20657" LastEditDate="2015-11-25T02:18:54.763" LastActivityDate="2015-11-25T02:23:49.070" Title="Multiple VLANs to a router with OSPF" Tags="|routing|vlan|ospf|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24701" PostTypeId="2" ParentId="24700" CreationDate="2015-11-24T09:46:25.720" Score="2" Body="&lt;p&gt;You need to create subinterfaces on the router. &lt;br /&gt;&#xA;It's called &quot;inter vlan routing&quot; what you want to use. &lt;br /&gt;&#xA;After that you can tell OSPF to which vlans it should connect. &lt;br /&gt;&lt;/p&gt;&#xA;" OwnerUserId="14081" LastActivityDate="2015-11-24T09:46:25.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24702" PostTypeId="2" ParentId="24700" CreationDate="2015-11-24T10:12:12.113" Score="3" Body="&lt;p&gt;may you create loopback interfaces on the router with ips in these ranges to advertise it on the OSPF.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2015-11-24T10:12:12.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24706" PostTypeId="1" CreationDate="2015-11-24T15:46:31.500" Score="2" ViewCount="371" Body="&lt;p&gt;HP(3Com) V1910 switch with 2 vlans: VLAN1 (native) and VLAN191&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Trunk Port is configured like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/V0yOh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V0yOh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are frames tagged for '191' also being forwarded to VLAN1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="5123" LastEditorUserId="8499" LastEditDate="2019-01-04T06:06:00.807" LastActivityDate="2019-01-04T06:06:00.807" Title="HP V1910 - Why is tagged traffic going to VLAN1?" Tags="|switch|vlan|trunk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="24707" PostTypeId="1" CreationDate="2015-11-24T15:51:31.230" Score="2" ViewCount="2387" Body="&lt;p&gt;We have &lt;code&gt;ws-c3850-48t&lt;/code&gt; two switch in stack. and from Internet Provide &lt;code&gt;ISP&lt;/code&gt; we have two fiber drops coming for redundancy. I want to configure HSRP for failover but i believe stack switch work like single virtual switch. so I am confused whether it is doable or not or if yes then how it will work? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    _________________&#xA;   [_______ISP_______]&#xA;     |             |&#xA;     |             | &#xA; 10G |             | 10G  (links) &#xA;   ___________________&#xA;  [__ 2x stack SW ____]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Q1. Does `HSRP` suggestible on stack switches?&#xA;Q2. Is there any alternation for gateway redundancy? &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; I am getting &lt;code&gt;/30&lt;/code&gt; IP pool for handoff and &lt;code&gt;/23&lt;/code&gt; IP pool for my server firm from my ISP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that way i have to configure IP address on my &lt;code&gt;L3&lt;/code&gt; switch port and configure &lt;code&gt;HSRP&lt;/code&gt; right to failover right??&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2015-11-24T17:56:39.953" LastActivityDate="2015-11-24T21:32:34.573" Title="Stack switch with HSRP for Gateway redundancy" Tags="|cisco|switch|redundancy|stacking|hsrp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24708" PostTypeId="1" AcceptedAnswerId="34940" CreationDate="2015-11-24T16:04:16.677" Score="2" ViewCount="4937" Body="&lt;p&gt;My network diagram is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OZTDV.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OZTDV.jpg&quot; alt=&quot;network diag&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The printer on the 2-network responds to pings from the 3-wifi-network for sometime and then just drops out for some reason i can’t figure out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have policies on the fortigate firewall to traffic from 3.0 to 2.0 and also reverse with all ports open. I have a server on 2.250 which responds to pings perfectly but not this printer. &#xA;The printer is on a static ip of 2.16.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also configured policy routing on the fortigate to force to and from traffic with source and destination addresses 2.0 and 3.0 and vice versa to force the traffic between those two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My policy config and routers as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config firewall policy&#xA;    edit 3&#xA;        set uuid 2e5c19ea-8776-51e5-f4a0-26880cb5c37b&#xA;        set srcintf &quot;internal1&quot;&#xA;        set dstintf &quot;internal2&quot;&#xA;        set srcaddr &quot;all&quot;&#xA;        set dstaddr &quot;all&quot;&#xA;        set action accept&#xA;        set schedule &quot;always&quot;&#xA;        set service &quot;ALL&quot;&#xA;        set logtraffic disable&#xA;    next&#xA;end&#xA;&#xA;config firewall policy&#xA;    edit 4&#xA;        set uuid 2e75fa22-8776-51e5-a324-5bb10126bbdd&#xA;        set srcintf &quot;internal2&quot;&#xA;        set dstintf &quot;internal1&quot;&#xA;        set srcaddr &quot;all&quot;&#xA;        set dstaddr &quot;all&quot;&#xA;        set action accept&#xA;        set schedule &quot;always&quot;&#xA;        set service &quot;ALL&quot;&#xA;        set logtraffic disable&#xA;    next&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And policy routing to force traffic:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config router policy&#xA;    edit 2&#xA;        set input-device &quot;internal2&quot;&#xA;        set src &quot;192.168.3.0/255.255.255.0&quot;&#xA;        set dst &quot;192.168.2.0/255.255.255.0&quot;&#xA;        set output-device &quot;internal1&quot;&#xA;    next&#xA;    edit 1&#xA;        set input-device &quot;internal1&quot;&#xA;        set src &quot;192.168.2.0/255.255.255.0&quot;&#xA;        set dst &quot;192.168.3.0/255.255.255.0&quot;&#xA;        set output-device &quot;internal2&quot;&#xA;    next&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the interfaces : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config system interface&#xA;    edit &quot;internal1&quot;&#xA;        set vdom &quot;root&quot;&#xA;        set ip 192.168.2.1 255.255.255.0&#xA;        set allowaccess ping https ssh&#xA;        set vlanforward enable&#xA;        set type physical&#xA;        set alias &quot;LAN&quot;&#xA;        set snmp-index 4&#xA;    next&#xA;end&#xA;&#xA;config system interface&#xA;    edit &quot;internal2&quot;&#xA;        set vdom &quot;root&quot;&#xA;        set ip 192.168.3.1 255.255.255.0&#xA;        set allowaccess ping https ssh&#xA;        set vlanforward enable&#xA;        set type physical&#xA;        set alias &quot;WIFI&quot;&#xA;        set snmp-index 5&#xA;    next&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help please.&lt;/p&gt;&#xA;" OwnerUserId="15569" LastEditorUserId="15569" LastEditDate="2015-11-25T17:37:55.627" LastActivityDate="2016-09-15T10:27:54.990" Title="Printer on wired LAN not accessible from wifi in a differnet subnet" Tags="|fortigate|network-access|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24709" PostTypeId="2" ParentId="24706" CreationDate="2015-11-24T17:06:58.360" Score="4" Body="&lt;p&gt;That port is set up to be a trunk. A trunk will carry both untagged (native) and tagged frames. You will forward both VLAN 1 (untagged) and VLAN 191 (tagged) frames on that port. If you want only VLAN 1 frames on the port, you need to set it to be an access port with only VLAN 1, or remove VLAN 191 membership from the trunk, instead of a trunk with both VLANs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-24T17:06:58.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24710" PostTypeId="1" AcceptedAnswerId="24722" CreationDate="2015-11-24T17:21:58.073" Score="0" ViewCount="6486" Body="&lt;p&gt;I'm running some performance tests on GNS3 (I know I shouldn't, but it is not until Friday that I will have the college lab available), and I'm trying to compare real BW or &amp;quot;speed&amp;quot; and theoritecal.&lt;/p&gt;&#xA;&lt;p&gt;So if I just put the command : &amp;quot;show interfaces serial1/1&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Do I get the &amp;quot;theoretical&amp;quot; value of the link?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;(MTU 1500 bytes, BW 1544 Kbit, DLY 20000 usec)&lt;/p&gt;&#xA;&lt;p&gt;So when I run iperf from my loopback interface (PC1) (client side) to my Linux VM (server side) I get and average of &lt;strong&gt;BW= 1.1 Mbps.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Is is safe to say that the performance of the link is:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Performance = real BW / theoritecal BW = 71.24 %&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This is the topology I use, and it goes from PC1 to PC2:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yMPRw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yMPRw.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I expect the performance to be higher in a real environment since GNS3 emulates everything and it consumes too much.&lt;/p&gt;&#xA;&lt;p&gt;This is my real PC specs:&#xA;Intel i5 processor&#xA;8 GB of RAM&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance! :)&lt;/p&gt;&#xA;&lt;p&gt;Daniel&lt;/p&gt;&#xA;" OwnerUserId="20012" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-11-25T22:28:41.133" Title="GNS3: performance tests using iperf3?" Tags="|bandwidth|testing|performance|iperf|" AnswerCount="1" CommentCount="0" ClosedDate="2015-11-30T11:56:00.480" ContentLicense="CC BY-SA 3.0" />
  <row Id="24711" PostTypeId="2" ParentId="24707" CreationDate="2015-11-24T17:22:51.153" Score="2" Body="&lt;p&gt;HSRP would be configured on the ISP side, not your side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch will look and be configured like a single switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will use the &lt;code&gt;no switchport&lt;/code&gt; command on the two interfaces to the ISP. Each interface would be configured as a router interface and each would have an IP address. It will look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/0&#xA; no switchport&#xA; ip address 1.1.1.2 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no cdp enable&#xA; no shutdown&#xA;!&#xA;interface GigabitEthernet2/0/0&#xA; no switchport&#xA; ip address 2.2.2.2 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no cdp enable&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since you are now considering using a port channel:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/0&#xA; no switchport&#xA; no ip address&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no cdp enable&#xA; channel-group 1 mode on&#xA; no shutdown&#xA;!&#xA;interface GigabitEthernet2/0/0&#xA; no switchport&#xA; no ip address&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no cdp enable&#xA; channel-group 1 mode on&#xA; no shutdown&#xA;!&#xA;interface PortChannel1&#xA; no switchport&#xA; ip address 1.1.1.2 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no cdp enable&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You &lt;em&gt;really&lt;/em&gt; should have a firewall between the ISP and your switch stack. Also, you can't use NAT on the switch, you would need a router for that.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-24T21:32:34.573" LastActivityDate="2015-11-24T21:32:34.573" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="24712" PostTypeId="1" CreationDate="2015-11-24T17:27:46.850" Score="4" ViewCount="7005" Body="&lt;p&gt;I am currently trying to route traffic from one Linux box (local VM for testing purposes) to my Linux (Debian) server with the intent to use NAT.&#xA;I was told to use IPSec to get my data to said server and decided that I would use Openswan to facilitate this scenario.&#xA;I have successfully installed the required packages but as an amateur I struggle with understanding the different IPs that have to be defined in the &lt;code&gt;ipsec.conf&lt;/code&gt;.&#xA;This is an excerpt from an example found on the Debian wiki (including commented text by me):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;left=10.15.109.36   #Is this the public (internet) IP? &#xA;leftsubnet=192.168.50.0/24   #How do I find this one and whats the &quot;/24&quot;?&#xA;leftsourceip=192.168.50.X   #What is it and can it be deduced from the above?&#xA;leftnexthop=10.15.109.5   #I think this should be my gateway, right?&#xA;leftid=@vpngw1   #I assume this is something I can define myself?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I realize this might be a rather general question but I can assure you I did plenty of digging on this subject and could not find a comprehensive explanation.&lt;/p&gt;&#xA;" OwnerUserId="20926" LastActivityDate="2016-04-22T19:34:26.510" Title="IPSec based VPN using Openswan - IP confusion" Tags="|vpn|ip|ipsec|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-12T22:37:50.167" ContentLicense="CC BY-SA 3.0" />
  <row Id="24713" PostTypeId="2" ParentId="24712" CreationDate="2015-11-24T17:47:10.573" Score="7" Body="&lt;p&gt;Most of your answers can be found here:&#xA;&lt;a href=&quot;http://linux.die.net/man/5/ipsec.conf&quot; rel=&quot;noreferrer&quot;&gt;http://linux.die.net/man/5/ipsec.conf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To speak through them however:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;left&lt;/strong&gt; will specify the IP address of the &lt;em&gt;left&lt;/em&gt; peer, as it is seen from the &lt;em&gt;right&lt;/em&gt; peer. Typically, this public IP address of the &lt;em&gt;left&lt;/em&gt; peer.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;leftsubnet&lt;/strong&gt; will specify the IP subnet for the &lt;em&gt;left&lt;/em&gt; subnet. In the end, the IPsec SA (secure data channel) will encrypt everything from &lt;em&gt;leftsubnet&lt;/em&gt; to &lt;em&gt;rightsubnet&lt;/em&gt;. In your example, since it seems you only intend for your one Linux Box to speak to your other Linux box, you can simply use those Linux boxes' IP addresses directly for left/right subnet, using a /32 mask.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;leftsourceip&lt;/strong&gt; This will be the address that will be used when the VPN device itself is speaking through the tunnel. If the linux box referred to above is the only intended speaker through the VPN, &lt;em&gt;and is also the machine that is doing the VPN processing&lt;/em&gt;, then this will be the IP address of your Linux box, and should match the &lt;em&gt;leftsubnet&lt;/em&gt; above (but won't include a mask).&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;leftnexthop&lt;/strong&gt; This will be the default-gateway of the box on the left that is doing the VPN processing&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;leftid&lt;/strong&gt; This is going to end up being what is used in the negotiation as the ID Method (I go into a tun of details about what that is in this &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13468/in-ipsec-vpn-how-is-the-pre-shared-key-encrypted&quot;&gt;question/answer&lt;/a&gt;). For the most part, it doesn't matter what you put -- you may as well put something that identifies 'left' (Linux VM's hostname, or 'branch' or 'dev box' or anything). If the VPN connection will allow a FQDN/hostname ID, it will use this. If the VPN connection will default to its IP Address as its ID Method, then openswan will accommodate automatically.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Here are quotes from how the manual defines each term:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;left&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(required) the IP address of the left participant's public-network interface, in any form accepted by ipsec_ttoaddr(3). Currently, IPv4 and IPv6 IP addresses are supported. There are several magic values. If it is %defaultroute, and the config setup section's, interfaces specification contains %defaultroute, left will be filled in automatically with the local address of the default-route interface (as determined at IPsec startup time); this also overrides any value supplied for leftnexthop. (Either left or right may be %defaultroute, but not both.) The value %any signifies an address to be filled in (by automatic keying) during negotiation. The value %opportunistic signifies that both left and leftnexthop are to be filled in (by automatic keying) from DNS data for left's client. The value can also contain the interface name, which will then later be used to obtain the IP address from to fill in. For example %ppp0 The values %group and %opportunisticgroup makes this a policy group conn: one that will be instantiated into a regular or opportunistic conn for each CIDR block listed in the policy group file with the same name as the conn.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;leftsubnet&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;private subnet behind the left participant, expressed as network/netmask (actually, any form acceptable to ipsec_ttosubnet(3)); Currentlly, IPv4 and IPv6 ranges are supported. if omitted, essentially assumed to be left/32, signifying that the left end of the connection goes to the left participant only&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;leftsourceip&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the IP address for this host to use when transmitting a packet to the other side of this link. Relevant only locally, the other end need not agree. This option is used to make the gateway itself use its internal IP, which is part of the leftsubnet, to communicate to the rightsubnet or right. Otherwise, it will use its nearest IP address, which is its public IP address. This option is mostly used when defining subnet-subnet connections, so that the gateways can talk to each other and the subnet at the other end, without the need to build additional host-subnet, subnet-host and host-host tunnels. Both IPv4 and IPv6 addresses are supported.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;leftnexthop&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;next-hop gateway IP address for the left participant's connection to the public network; defaults to %direct (meaning right). If the value is to be overridden by the left=%defaultroute method (see above), an explicit value must not be given. If that method is not being used, but leftnexthop is %defaultroute, and interfaces=%defaultroute is used in the config setup section, the next-hop gateway address of the default-route interface will be used. The magic value %direct signifies a value to be filled in (by automatic keying) with the peer's address. Relevant only locally, other end need not agree on it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;leftid&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;how the left participant should be identified for authentication; defaults to left. Can be an IP address (in any ipsec_ttoaddr(3) syntax) or a fully-qualified domain name preceded by @ (which is used as a literal string and not resolved). The magic value %fromcert causes the ID to be set to a DN taken from a certificate that is loaded. Prior to 2.5.16, this was the default if a certificate was specified. The magic value %none sets the ID to no ID. This is included for completeness, as the ID may have been set in the default conn, and one wishes for it to default instead of being explicitly set. The magic value %myid stands for the current setting of myid. This is set in config setup or by ipsec_whack(8)), or, if not set, it is the IP address in %defaultroute (if that is supported by a TXT record in its reverse domain), or otherwise it is the system's hostname (if that is supported by a TXT record in its forward domain), or otherwise it is undefined.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-11-24T17:47:10.573" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24715" PostTypeId="2" ParentId="24689" CreationDate="2015-11-24T21:20:21.210" Score="1" Body="&lt;p&gt;So it appears there were multiple things going on here. For one, the remote device was the VPN initiator and apparently it doesn't like getting responder packets. I switched the ASA profile from &quot;bidirectional&quot; to &quot;answer-only&quot;. That cleared up most of the errors shown above but traffic still wouldn't pass.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turns out my NAT for the tunnel was at the bottom of the list so the traffic was being picked up by another NAT. Here's that &lt;a href=&quot;https://supportforums.cisco.com/discussion/11479076/disable-nat-vpn-site-site&quot; rel=&quot;nofollow&quot;&gt;the link&lt;/a&gt; tipped me off. Simply moved it to the top and all was well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks everyone for the help.&lt;/p&gt;&#xA;" OwnerUserId="20904" LastActivityDate="2015-11-24T21:20:21.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24717" PostTypeId="2" ParentId="23358" CreationDate="2015-11-24T23:51:58.423" Score="1" Body="&lt;p&gt;I think everyone is everywhere of how to get the number of available hosts given a prefix length of a certain size, for example with an /24 IPv4 prefix, you have 32-24 = 8 bits for hosts, giving 2^8 = 256 hosts or 254 &quot;usable&quot; ones. This is usually taught in any networking class or explanation of subnetting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The inverse of 2^x is log(x)/log(2) so to get the number of bits for 22 addresses, you just do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;log(22)/log(2) = 4.459&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously you can't do decimal prefix length so you have to round that up to the closest integer, which is 5. You need 5 bits, or 32-5 = 27, i.e. a /27 network!&lt;/p&gt;&#xA;" OwnerUserId="672" LastEditorUserId="672" LastEditDate="2015-11-26T23:59:35.113" LastActivityDate="2015-11-26T23:59:35.113" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24721" PostTypeId="2" ParentId="24700" CreationDate="2015-11-25T02:23:49.070" Score="2" Body="&lt;p&gt;This is with some assumptions since you didn't include a drawing or configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a router connected to a layer-3 switch, you should probably make the link between the two a point-to-point routed link (use &lt;code&gt;no switchport&lt;/code&gt; on the layer-3 switch port) and give the link a point-to-point address like &lt;code&gt;/30&lt;/code&gt; or &lt;code&gt;/31&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the layer-3 switch, you have SVIs with IP addresses for your VLANs, and you use network statements (or redistribute connected routes) in the OSPF configuration so that OSPF will share the networks with the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably want the router to send a default route to the layer-3 switch, so you use the &lt;code&gt;default-information originate&lt;/code&gt; command on the router, and it will inject the default route into OSPF if it exists in the routing table.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-25T02:23:49.070" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24722" PostTypeId="2" ParentId="24710" CreationDate="2015-11-25T02:52:43.637" Score="5" Body="&lt;p&gt;Don't trust GNS3 for throughput tests. As soon as you use a router in your topology you are likely only to get 5mb/sec tops, regardless of whether you use a serial, ethernet or fast ethernet interface and regardless of how powerful your PC is. (Note that the performance hit won't be seen if you use a GNS3 switch instead of a router, however, the switches are extremely limited in what they can do).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few years ago GNS3's website used to say something along the lines of &lt;em&gt;don't use GNS3 for production workloads as GNS3 routers perform more than 1,000 times slower than the real thing.&lt;/em&gt; I know you're only labbing, but the reason why I mention this is that the devs themselves say its performance is not even close to what you will get from real equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, just an FYI - A little while back I did a few iperf tests through a couple of VMs connected to GNS3 on my i7 with 32GB of RAM (see &lt;a href=&quot;http://www.oznetnerd.com/2012/12/01/new-pc-nexus-1000v-come/&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt; for specs, though at the time of writing I only had 16GB of RAM). If I recall correctly I only got about 3mb/sec. However, when I &lt;a href=&quot;http://www.oznetnerd.com/2015/01/31/guide-building-self-contained-virtual-steelhead-lab-part-1/&quot; rel=&quot;nofollow&quot;&gt;rejigged the lab&lt;/a&gt; to include a couple of Riverbed Steelheads I saw a massive improvements, but that's a whole other story :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum up the above - GNS3 is great for testing protocols, configs, etc but is pretty much useless when testing throughput.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2015-11-25T22:28:41.133" LastActivityDate="2015-11-25T22:28:41.133" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24723" PostTypeId="1" AcceptedAnswerId="24739" CreationDate="2015-11-25T02:54:51.330" Score="3" ViewCount="1224" Body="&lt;p&gt;I am setting up a testbed for some VMs. These routes need to be static as this is an academic project. (I know that doing this manually is generally a bad idea. Trust me, I have a reason for this.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running into an issue where my hosts on the far ends cannot ping each other unless the route to and from go through all of the same hosts. Can someone help and explain why this is? Is there any way that I can set it up so that the return route is separate? For example, in the image below, can I make the ping out from n0 go through n1 -&gt; n2 -&gt; n4 -&gt; n5 and return on n5 -&gt; n4 -&gt; n3 -&gt; n1 -&gt; n0?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my network. Everything is a 10.1.y.x address. The links are shown with the last two octets.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;              n2&#xA;            /     \&#xA;           / 2.x   \6.x&#xA;   5.x    /         \     4.x&#xA;n0 ---- n1           n4 ----- n5&#xA;          \         /&#xA;           \ 3.x   /1.x&#xA;            \     /&#xA;              n3 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are the routing tables for each, if that makes it clearer. All taken from &quot;ip route&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;n0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.4.0/24 via 10.1.5.3 dev eth2 &#xA;10.1.5.0/24 dev eth2  proto kernel  scope link  src 10.1.5.2 &#xA;10.1.6.0/24 via 10.1.5.3 dev eth2 &#xA;10.1.1.0/24 via 10.1.5.3 dev eth2 &#xA;10.1.2.0/24 via 10.1.5.3 dev eth2 &#xA;10.1.3.0/24 via 10.1.5.3 dev eth2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;n1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.4.0/24 via 10.1.3.3 dev eth3 &#xA;10.1.5.0/24 dev eth2  proto kernel  scope link  src 10.1.5.3 &#xA;10.1.6.0/24 via 10.1.2.3 dev eth4 &#xA;10.1.1.0/24 via 10.1.3.3 dev eth3 &#xA;10.1.2.0/24 dev eth4  proto kernel  scope link  src 10.1.2.2 &#xA;10.1.3.0/24 dev eth3  proto kernel  scope link  src 10.1.3.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;n2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.4.0/24 via 10.1.6.3 dev eth2 &#xA;10.1.5.0/24 via 10.1.2.2 dev eth4 &#xA;10.1.6.0/24 dev eth2  proto kernel  scope link  src 10.1.6.2 &#xA;10.1.1.0/24 via 10.1.6.3 dev eth2 &#xA;10.1.2.0/24 dev eth4  proto kernel  scope link  src 10.1.2.3 &#xA;10.1.3.0/24 via 10.1.2.2 dev eth4 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;n3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.4.0/24 via 10.1.1.3 dev eth4 &#xA;10.1.5.0/24 via 10.1.3.2 dev eth3 &#xA;10.1.6.0/24 via 10.1.1.3 dev eth4 &#xA;10.1.1.0/24 dev eth4  proto kernel  scope link  src 10.1.1.2 &#xA;10.1.2.0/24 via 10.1.3.2 dev eth3 &#xA;10.1.3.0/24 dev eth3  proto kernel  scope link  src 10.1.3.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;n4&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.4.0/24 dev eth3  proto kernel  scope link  src 10.1.4.2 &#xA;10.1.5.0/24 via 10.1.6.2 dev eth2 &#xA;10.1.6.0/24 dev eth2  proto kernel  scope link  src 10.1.6.3 &#xA;10.1.1.0/24 dev eth4  proto kernel  scope link  src 10.1.1.3 &#xA;10.1.2.0/24 via 10.1.6.2 dev eth2 &#xA;10.1.3.0/24 via 10.1.1.2 dev eth4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;n5&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.4.0/24 dev eth2  proto kernel  scope link  src 10.1.4.3 &#xA;10.1.5.0/24 via 10.1.4.2 dev eth2 &#xA;10.1.6.0/24 via 10.1.4.2 dev eth2 &#xA;10.1.2.0/24 via 10.1.4.2 dev eth2 &#xA;10.1.3.0/24 via 10.1.4.2 dev eth2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20292" LastActivityDate="2021-01-31T12:44:23.577" Title="Why do these static routes need to be bi-directional?" Tags="|routing|asymmetric-routing|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24725" PostTypeId="2" ParentId="24723" CreationDate="2015-11-25T03:04:26.120" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;can I make the ping out from n0 go through n1 -&gt; n2 -&gt; n4 -&gt; n5 and return on n5 -&gt; n4 -&gt; n3 -&gt; n1 -&gt; n0?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, you can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the information in your post, n0's IP address is 10.1.5.2. Therefore to alter the return path you will need to change the route for 10.1.5.0 on n4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently it looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.5.0/24 via 10.1.6.2 dev eth2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What you will need to do is change it to this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.5.0/24 via 10.1.1.2 dev eth4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason being that your current route (10.1.5.0/24 via 10.1.6.2 dev eth2) points to n2, whereas &quot;10.1.1.2 dev eth4&quot; points to n3 as per your diagram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore my suggested change above says &quot;traffic which hits n4 and has a destination IP address of 10.1.5.0/24 can reach its destination by going through eth4.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, this will result in traffic flowing in the following manner: n5 - n4 - n3 - n1 - n0. In other words, traffic from n5 to n0 will go via n3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order for traffic in the opposite direction to take the other route (n0 - n1 - n2 - n4 - n5, in other words, traffic from n0 to n5 will go via n2) you will need to do the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remove this from n1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.4.0/24 via 10.1.3.3 dev eth3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And add this on n1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.4.0/24 via 10.1.2.3 dev eth4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2015-11-25T05:50:32.663" LastActivityDate="2015-11-25T05:50:32.663" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24727" PostTypeId="1" CreationDate="2015-11-25T09:04:13.477" Score="1" ViewCount="1716" Body="&lt;p&gt;I need to create a read only account on all of my cisco devices..&#xA;I haven't really been able to figure out exactly how as all the tutorials i can find on how to do this modifies the privilege 3 level and allows it to execute show command using an alias.. This is now what i want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I basically want a user account that can login and perform every show command including show run, show ip interface brief, show interface status and so on, but without access to modify the configuration.. I don't care that the person can obtain information in the configuration that will make him or her able to access the router anyway, it is simply because i'am having someone access the equipment who needs to view certain information, but does not have enough knowledge that i trust him or her to make changes to the config..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to do this without using Radius/TACACS?&lt;/p&gt;&#xA;" OwnerUserId="19366" LastActivityDate="2015-11-25T09:22:52.627" Title="Read Only Access to Cisco Device" Tags="|cisco|switch|router|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24728" PostTypeId="2" ParentId="24727" CreationDate="2015-11-25T09:22:52.627" Score="2" Body="&lt;p&gt;Without TACACS, you have to setup a privilege level (&quot;view&quot;) that only allows the commands you want them to run. Allowing access to the full config may expose passwords to accounts that have higher access than they do -- eventually, they'll figure that out and bypass such weak controls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TACACS is really the direction you need to move. However, I do understand not wanting that headache.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-11-25T09:22:52.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24729" PostTypeId="2" ParentId="24683" CreationDate="2015-11-25T11:46:27.983" Score="7" Body="&lt;p&gt;A good way to find the differences is to look at the RFCs.&lt;/p&gt;&#xA;&lt;p&gt;At the time a book published in 2000 was authored, the current version of BGP would have been according to the 1995 version of the standard: RFC1771.  Today the current version of BGP is described by RFC4271 published in 2005.&lt;/p&gt;&#xA;&lt;p&gt;RFC4271 has a handy list of the changes since the previous version in Appendix A:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4271#appendix-A&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc4271#appendix-A&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;(some of these changes were available as extensions before they were folded into the protocol update so the books may cover them or may not).&lt;/p&gt;&#xA;&lt;p&gt;The top of the html version of the RFC also has a handy list of &amp;quot;updated by&amp;quot; references that you can use to find additional changes since 2005.&lt;/p&gt;&#xA;&lt;p&gt;RFCs are written for implementors, so aren't necessarily the best way to learn how to &lt;em&gt;use&lt;/em&gt; BGP; however they are the definitive reference for features so you can use them to identify what you want to learn about, and then use your google-fu to find more accessible documentation on that specific feature.&lt;/p&gt;&#xA;" OwnerUserId="4440" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-11-25T11:46:27.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24730" PostTypeId="1" CreationDate="2015-11-25T12:32:05.820" Score="1" ViewCount="1486" Body="&lt;p&gt;Sender at TCP can not finish transmitting data without receiving ACK packets of transmitted packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the situation I want to  think is that server closes the connection so the state is 'half-open(client) connection' in this case, client can not get ack from server, and then how can client transmit the data? or what does client do?&lt;/p&gt;&#xA;" OwnerUserId="19596" LastActivityDate="2015-11-25T16:27:14.167" Title="TCP with Half-Open Connection, how to transmit data?" Tags="|tcp|half-duplex|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24731" PostTypeId="1" AcceptedAnswerId="24747" CreationDate="2015-11-25T13:39:08.550" Score="2" ViewCount="2766" Body="&lt;p&gt;I have a Cisco WLC and different LWAPPs. What I am looking for is a way to be able to get in the WLC the RSSI of all connected clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the moment, I am able to access through SNMP to the &lt;em&gt;AIRESPACE-WIRELESS-MIB&lt;/em&gt; on the WLC. There, I can access the &lt;em&gt;bsnMobileStationRssiDataTable&lt;/em&gt;, where all the connected clients have an entry, indexed by each LWAPPs. The main problem is that the RSSI update is really slow, like every 3 to 5 minutes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am looking for is for a refresh rate of at least 5 to 10 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way of doing this, or is there another MIB where this information can be retrieve?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am really struggling to get this information through the Cisco forums/websites.&lt;/p&gt;&#xA;" OwnerUserId="20942" LastEditorUserId="8499" LastEditDate="2016-03-25T00:52:30.960" LastActivityDate="2017-07-18T12:03:27.200" Title="Real time RSSI from Clients" Tags="|cisco|wireless|snmp|access-point|wlc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24734" PostTypeId="1" AcceptedAnswerId="25485" CreationDate="2015-11-25T15:42:54.110" Score="3" ViewCount="4456" Body="&lt;p&gt;I'm having a issue with receiving duplicate packets in my network and I'm unsure what's causing it. A simplistic explanation of what's happening is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Server1 sends a ping request to Server2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Server2 receives the ping request from Server1, sends ping reply to Server1&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Server1 receives two ping replies (DUP)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network layout is pretty simple - here is a (poorly) drawn diagram: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5SyDv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5SyDv.png&quot; alt=&quot;http://i.imgur.com/jW0LoTU.png&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some things to note that I think is related:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The SW1.LAX.AGG switches each have RVI's from different subnets. We have a VLAN called &quot;test&quot; with subnets 10.0.0.0/24, 10.0.1.0/24 and 10.0.2.0/24. The VLAN interface has the first IP of each range assigned. The VLAN &quot;test&quot; has a &quot;l3-interface&quot; pointing to the proper VLAN interface.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When you ping an IP from another subnet (say pinging 10.0.1.200 while the primary IP on the machine is 10.0.0.200) it goes over the default gateway of 10.0.0.1 and gets the DUP ping reply. When pinging from a secondary IP on another subnet (10.0.2.200) using the &lt;code&gt;ping -i eth1:0&lt;/code&gt; there is no DUP reply.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When receiving the duplicate reply the TTL is not increasing or decreasing.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This is not a duplicate IP issue.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any suggestion on how I can debug this further / is there something silly I'm missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="4186" LastEditorUserId="4186" LastEditDate="2015-11-25T17:38:48.600" LastActivityDate="2016-02-26T04:24:14.787" Title="Duplicate packet / ping reply in network configuration" Tags="|juniper-ex|loop|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24735" PostTypeId="2" ParentId="24730" CreationDate="2015-11-25T16:03:22.227" Score="1" Body="&lt;p&gt;Client then does what it's instructed to do... normally there are limits in place to deal with so called &amp;quot;embryonic connection&amp;quot; as half open connection state is normally achieved when negotiating connection .&#xA;Without limits and timeouts endpoint is exposed to SYN flood DoS attack.&#xA;You could read on RFC 793 , page 33 , about &amp;quot;  Half-Open Connections and Other Anomalies&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc793&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2542" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-11-25T16:03:22.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24736" PostTypeId="2" ParentId="24730" CreationDate="2015-11-25T16:27:14.167" Score="1" Body="&lt;p&gt;There are basically two ways to close a TCP connection between host A and B:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The proper way: A is sending a &lt;strong&gt;FIN&lt;/strong&gt;, telling that it would not send new TCP segments anymore. It will continue sending &lt;strong&gt;ACKs&lt;/strong&gt; though. The connection is half closed and can stay like this forever. When B has finished sending data, he can close his part of the connection with a &lt;strong&gt;FIN&lt;/strong&gt; too. When he has received the last ACK, the connection will be totally closed.&lt;/li&gt;&#xA;&lt;li&gt;For various reasons A can send a &lt;strong&gt;RST&lt;/strong&gt; packet, telling that this connection is not taken into account. When receiving the RST message, B will stop the connection quite immediately.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;AFAIK, which host is the server or the client does not change the basics.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-25T16:27:14.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24737" PostTypeId="2" ParentId="24734" CreationDate="2015-11-25T16:35:45.730" Score="1" Body="&lt;p&gt;Might be a case of &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6000-series-switches/23563-143.html&quot; rel=&quot;nofollow&quot;&gt;unicast storm flood&lt;/a&gt;&#xA;If pinging from server2 to server1 is fixing the issue, that might be that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, I would check that there is no proxy arp anywhere in your network.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-25T16:35:45.730" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24738" PostTypeId="2" ParentId="24517" CreationDate="2015-11-25T16:43:44.700" Score="0" Body="&lt;p&gt;Cisco have announced End of Life for Cisco Unified Border Element (Service Provider Edition) and seem to have pulled out of the carrier-grade SBC market!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;With this end-of-sale and end-of-life announcement, Cisco will exit the service provider session border controller (SP SBC) product segment at the provider edge. Customers are encouraged to migrate to alternative SP SBC products available in the industry.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are currently in the process of migrating our Customers away from Cisco and onto a Sonus SBC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-series-aggregation-services-routers/eos-eol-notice-c51-732167.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-series-aggregation-services-routers/eos-eol-notice-c51-732167.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20946" LastActivityDate="2015-11-25T16:43:44.700" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24739" PostTypeId="2" ParentId="24723" CreationDate="2015-11-25T16:48:53.397" Score="4" Body="&lt;p&gt;You should remove reverse path filtering on your linux routers (n1 to n4).&#xA;&lt;a href=&quot;https://access.redhat.com/solutions/53031&quot; rel=&quot;nofollow&quot;&gt;https://access.redhat.com/solutions/53031&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-25T16:48:53.397" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24744" PostTypeId="1" AcceptedAnswerId="24746" CreationDate="2015-11-25T20:35:26.923" Score="1" ViewCount="1658" Body="&lt;p&gt;I do not understand how to fragment a IP datagram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say the original datagram has a total size of 302 (20bytes header and 282 bytes payload). My datagram needs to be fragmented since it goes through a network of 128MTU. I have to fragment it and add 20 header for each new fragments. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Fragment 1 124 total length (104 bytes payload)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Fragment 2 124 total length  (104 bytes payload)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Fragment 3 94 total length  (74 bytes payload)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If I addition that it gives me indeed the original payload. I do not understand how to find those numbers...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why couldn't it be&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Fragment 1 114 total length (94 bytes payload)&lt;/li&gt;&#xA;&lt;li&gt;Fragment 2 114 total length  (94 bytes payload)&lt;/li&gt;&#xA;&lt;li&gt;Fragment 3 114 total length  (94 bytes payload)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(282/128(MTU)) &gt; 2 so I need 3 fragments. 3Fragments = 60 bytes header added&#xA;60 +282 = 342 342/3 = 114 total lenght for each fragments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How and why should I get 124 124 and 94?&lt;/p&gt;&#xA;" OwnerUserId="20952" LastEditorUserId="8499" LastEditDate="2018-03-07T22:43:23.703" LastActivityDate="2018-03-07T22:43:23.703" Title="IP Datagram Fragmentation total length and payload calculations" Tags="|routing|ipv4|mtu|data|fragmentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24746" PostTypeId="2" ParentId="24744" CreationDate="2015-11-25T20:44:11.723" Score="3" Body="&lt;p&gt;The IP fragmentation and reassembly is described by the RFCs. You must fragment on 64-bit boundaries. There are RFCs dealing with this, and other sites which will describe the fragmentation and reassembly process in depth; you can do a search to find them&lt;/p&gt;&#xA;&lt;p&gt;Start with &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791, INTERNET PROTOCOL&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;To fragment a long internet datagram, an internet protocol module&lt;br /&gt;&#xA;(for example, in a gateway), creates two new internet datagrams and&lt;br /&gt;&#xA;copies the contents of the internet header fields from the long&lt;br /&gt;&#xA;datagram into both new internet headers.  The data of the long&lt;br /&gt;&#xA;datagram is divided into two portions on a 8 octet (64 bit) boundary&lt;br /&gt;&#xA;(the second portion might not be an integral multiple of 8 octets,&lt;br /&gt;&#xA;but the first must be).  Call the number of 8 octet blocks in the&lt;br /&gt;&#xA;first portion NFB (for Number of Fragment Blocks).  The first&lt;br /&gt;&#xA;portion of the data is placed in the first new internet datagram,&lt;br /&gt;&#xA;and the total length field is set to the length of the first&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-11-25T20:49:51.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24747" PostTypeId="2" ParentId="24731" CreationDate="2015-11-25T22:42:33.423" Score="1" Body="&lt;p&gt;To get the RSSI of connected clients, you will need this OID:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;.1.3.6.1.4.1.9.9.273.1.3.1.1.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In regards to graphing the information every 5 or 10 seconds, you could use monitoring software like Cacti to achieve this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;References:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://forums.cacti.net/about4901.html&quot; rel=&quot;nofollow&quot;&gt;Cacti Forum&lt;/a&gt; - Client Table RSSI value for your clients.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/10196106/snmp-monitoring&quot; rel=&quot;nofollow&quot;&gt;Cisco Forum&lt;/a&gt; - Signal Strength (dBm)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://docs.ipswitch.com/NM/85_WhatsUp%20Gold%20v14.2/03_Help/index.htm?Wireless_active_clients.htm?zoom_highlight=wireless?toc.htm&quot; rel=&quot;nofollow&quot;&gt;ipswitch&lt;/a&gt; - Signal Strength&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&amp;amp;translate=Translate&amp;amp;objectInput=1.3.6.1.4.1.9.9.273.1.3.1.1.3&quot; rel=&quot;nofollow&quot;&gt;Cisco OID Navigator&lt;/a&gt; - RSSI Indicator.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-11-25T22:42:33.423" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24749" PostTypeId="1" AcceptedAnswerId="24750" CreationDate="2015-11-26T01:33:11.247" Score="23" ViewCount="37511" Body="&lt;p&gt;I noticed that IPv4 reserved &lt;code&gt;169.254.0.0/16&lt;/code&gt; and IPv6 reserved &lt;code&gt;fe80::/10&lt;/code&gt; for link-local addressing. While I saw IPv6 uses both &lt;code&gt;fe80::/10&lt;/code&gt; address and my private IPv6 address &lt;code&gt;fd00::12&lt;/code&gt; to communicate with other devices in Wireshark, I never seen &lt;code&gt;169.254/16&lt;/code&gt; working in IPv4. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what is the purpose of link-local addressing?&lt;/p&gt;&#xA;" OwnerUserId="20657" LastEditorUserId="8499" LastEditDate="2018-11-23T16:04:52.887" LastActivityDate="2023-12-13T01:43:59.063" Title="What is Link-local addressing?" Tags="|ip|ipv4|ipv6|ip-address|ip-link-local|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24750" PostTypeId="2" ParentId="24749" CreationDate="2015-11-26T01:40:21.173" Score="22" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I never seen 169.254/16 working in IPv4.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A PC automatically acquires a 169.254.x.x/16 address if it does not receive an IP address from a DHCP server. If you disable the DHCP server on your home or lab network and issue the &quot;ipconfig/release&quot; and &quot;ipconfig/renew&quot; commands, your PC will receive a 169.254.x.x address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per &lt;a href=&quot;http://packetlife.net/blog/2008/sep/24/169-254-0-0-addresses-explained/&quot;&gt;this article&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The purpose of these self-assigned link-local addresses is to&#xA;  facilitate communication with other hosts within the subnet even in&#xA;  the absence of external address configuration (via manual input or&#xA;  DHCP). Unlike in IPv6, implementation of IPv4 link-local addresses is&#xA;  recommended only in the absence of a normal, routable address. Hosts&#xA;  pseudo-randomly generate the last two octets of the address to&#xA;  mitigate address conflicts. Because of the broadcast nature of some&#xA;  local networking protocols (for example, Microsoft's NetBIOS), hosts&#xA;  may be able to detect one another even without any preexisting&#xA;  knowledge of the address scheme.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-11-26T01:40:21.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24751" PostTypeId="1" AcceptedAnswerId="24755" CreationDate="2015-11-26T04:33:17.123" Score="2" ViewCount="1298" Body="&lt;p&gt;If I use the &lt;code&gt;inline power&lt;/code&gt; command in interface configuration mode, it will enable with the default PoE class, which is Class 0 or &quot;UnknownClass&quot;. If I leave the default class can the switch automatically determine the correct class, based on the end-device, when it requests power, or should I be manually specifying the class with the parameter power-by-class?&lt;/p&gt;&#xA;" OwnerUserId="1834" LastEditorUserId="8499" LastEditDate="2016-03-25T14:07:07.010" LastActivityDate="2016-09-05T09:16:10.343" Title="Can I auto-negotiate PoE class (brocade)?" Tags="|brocade|power-over-ethernet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24753" PostTypeId="1" AcceptedAnswerId="24754" CreationDate="2015-11-26T05:23:04.070" Score="1" ViewCount="97" Body="&lt;p&gt;I am studying for CCNA and the book I am using states that&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Once configured, the two routers negotiate as to which will be the&#xA;  AVG. As with HSRP, if both come up at the same time, R1 will win, with&#xA;  a priority set to 110 with the &lt;code&gt;glbp 1 priority 110&lt;/code&gt; command versus R2’s&#xA;  default priority of 100. However, &lt;strong&gt;if either router comes up before the&#xA;  other, that router goes ahead and takes on the AVG role&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is this similar to the case that if an OSPF router's RID is changed, it will only take effect after the OSPF process is restarted?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other GLBP configured routers &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html&quot; rel=&quot;nofollow&quot;&gt;discover the AVG through hello messages&lt;/a&gt; and I assume that the selected AVG's ID will circulate in the Hellos regardless of the GLBP priority of any new routers that just came online.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of the other sources corroborate this theory and only mention the priority but they do not deny it either. &lt;/p&gt;&#xA;" OwnerUserId="9877" LastActivityDate="2015-11-26T05:53:50.177" Title="Is priority the only factor for selecting the AVG when using GLBP?" Tags="|fhrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24754" PostTypeId="2" ParentId="24753" CreationDate="2015-11-26T05:53:50.177" Score="0" Body="&lt;p&gt;The document you link, &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html&quot; rel=&quot;nofollow&quot;&gt;GLBP - Gateway Load Balancing Protocol&lt;/a&gt;, also has this as the last paragraph of &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2t/12_2t15/feature/guide/ft_glbp.html#wp1040147&quot; rel=&quot;nofollow&quot;&gt;GLBP Gateway Priority&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;By default, the GLBP gateway preemptive scheme is disabled. A backup&#xA;  virtual gateway can become the AVG only if the current AVG fails,&#xA;  regardless of the priorities assigned to the virtual gateways. You can&#xA;  enable the GLBP preemptive scheme using the glbp preempt command.&#xA;  Preemption allows a backup virtual gateway to become the AVG, if the&#xA;  backup virtual gateway is assigned a higher priority than the current&#xA;  AVG.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is saying the same thing as what you have quoted above.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-26T05:53:50.177" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24755" PostTypeId="2" ParentId="24751" CreationDate="2015-11-26T06:10:07.243" Score="1" Body="&lt;p&gt;Using &quot;inline power&quot; does enable PoE for Class 0, which covers a large power range from 0.44 to 15.4 watts. This seems to intelligently hand out the correct amount of power.&lt;/p&gt;&#xA;" OwnerUserId="1834" LastEditorUserId="8499" LastEditDate="2016-03-25T14:07:33.730" LastActivityDate="2016-03-25T14:07:33.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24756" PostTypeId="1" AcceptedAnswerId="24757" CreationDate="2015-11-26T08:50:59.740" Score="1" ViewCount="371" Body="&lt;p&gt;Yesterday, I saw some new articles about Li-Fi. With speeds up to 1 Gb/s it seems like a very renovating technology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can current hardware and/or software can actually handle this kind of speed?&#xA;How do they test this kind of speed, and will this require a complete new overhaul on the hardware/software in the future?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It just out of curiosity :)&lt;/p&gt;&#xA;" OwnerUserId="20962" LastEditorUserId="8499" LastEditDate="2015-11-26T12:54:16.000" LastActivityDate="2017-09-10T04:01:55.290" Title="Li-Fi, hardware and software limits" Tags="|speed|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24757" PostTypeId="2" ParentId="24756" CreationDate="2015-11-26T12:40:55.137" Score="0" Body="&lt;p&gt;We have had 1 Gb, 10 Gb ethernet for a while now, and, more recently, 40 Gb and 100 Gb ethernet. Why would you think that current hardware and software can't handle another 1 Gb technology?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Li-Fi will require some new hardware to transmit and receive since it is based on light instead of radio waves, but it is just an evolution of IEEE standards, not something radically different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the current Li-Fi really only goes up to 96 Mb, and that is far short of 1 Gb.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-26T12:57:04.770" LastActivityDate="2015-11-26T12:57:04.770" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24761" PostTypeId="2" ParentId="23741" CreationDate="2015-11-26T17:38:10.740" Score="3" Body="&lt;p&gt;You likely have a routing problem, but it probably isn't on R1 (which should know both subnets because they are directly connected). We wouldn't be able to confirm without knowing the router/host configurations and possibly the router vendor/model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having more than one router, each with distinct networks beyond it and not directly connected to the other routers, on the same subnet as hosts can be less than ideal. While it can work just fine, there are generally not &quot;good&quot; solutions to the problems that arise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you do have to make sure that the each router knows about the networks beyond the other routers. Static routes are problematic as they are more difficult to maintain and prone to error. So this means running a routing protocol. (For the rest of my answer, I will assume that a routing protocol is running between the routers.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running a routing protocol on the routers on the same network where hosts are connected creates security implications. This can provide valuable information to an attacker (internal or external on compromised resource) about the network topography and subnets in use. Additional steps would be required to secure this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, you have the issues associated with the hosts themselves. Typically hosts only have one &quot;default&quot; route or gateway where they will send all traffic destined to non-local subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you have a number of options, none of them what I would consider &quot;good&quot;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Configure static routes for other subnets on each host: again management issues and prone to error.&lt;/li&gt;&#xA;&lt;li&gt;Configure hosts to participate in a routing protocol: again security concerns and you need to make sure that the hosts can't inject routes into the router's routing table.&lt;/li&gt;&#xA;&lt;li&gt;Depend on ICMP redirects: security implications and more security implications. Generally turned off on routers and hosts are often configured to not respond to ICMP redirects. You would need to make sure it was enabled on all devices.&lt;/li&gt;&#xA;&lt;li&gt;Let the routers do the work without ICMP redirects. Probably the best option, but this means that your routers acting as default gateways will be processing more traffic, which means that they may need to be &quot;bigger&quot; (i.e. higher performance, possibly faster interfaces) and there are some security concerns. Why is this the case? Because traffic that is intended for those other routers needs to be received on an interface and then sent back out that same interface to another router.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, what are alternatives? Well, if you go back to my statement early on in this post, there are a few things I could consider better options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Provide direct connections between your router(s) acting as the default gateway and the other routers using physical interfaces. This require more interfaces per router and still may require a &quot;bigger&quot; router, but it provides a number of benefits.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can run your routing protocol on interfaces where hosts are not connected.&lt;/li&gt;&#xA;&lt;li&gt;You avoid any security concerns when you would receive and send the same traffic on the same interface.&lt;/li&gt;&#xA;&lt;li&gt;You avoid &quot;doubling&quot; the outbound traffic by not receiving and sending the same traffic on the same interface.&lt;/li&gt;&#xA;&lt;li&gt;Increased redundancy when using HSRP, VRRP, GLBP or similar to provide gateway redundancy.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Provide direct connections between your router(s) acting as the default gateway and the other routers using &quot;virtual&quot; interfaces, for example through the use of VLANs and trunking/tagged links. Gives the same first two benefits I mentioned in the first option.&lt;/li&gt;&#xA;&lt;li&gt;Add a router (or routers for redundancy) between hosts in Net1 and R1/R2/R3 (as well as other similar locations such as Net2/Net4). Basically provides all the benefits from the first option, but requires extra hardware to a manage.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-11-26T17:38:10.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24762" PostTypeId="1" AcceptedAnswerId="24782" CreationDate="2015-11-26T18:03:45.670" Score="1" ViewCount="3659" Body="&lt;p&gt;We are getting many &lt;code&gt;IP Fragmentation&lt;/code&gt; attack. Our server only dealing with UDP RTP traffic so i wonder can we set &lt;code&gt;don't fragment&lt;/code&gt; configuration so switch or cisco router port drop all packet instead of sending them to Server and server get overload to reassemble them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know IP Fragmentation is very important but in our case we are only handling RTP UDP traffic and packet size is very small.. so i doubt we need IP Fragmentation feature.&lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2017-01-26T13:32:31.010" Title="Disable IP fragmentation on cisco port" Tags="|cisco|switch|router|mtu|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24766" PostTypeId="1" CreationDate="2015-11-26T21:13:25.300" Score="3" ViewCount="2318" Body="&lt;p&gt;I am trying to do this: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13762-40.html#conf3&quot; rel=&quot;nofollow&quot;&gt;Load Sharing When Dual-Homed to One ISP Through Multiple Local Routers&lt;/a&gt;. The only difference from the example is that the ISP is &lt;strong&gt;sending a full BGP table&lt;/strong&gt; instead of &lt;strong&gt;the default gateway&lt;/strong&gt;. I have a problem that R101 won't advertise external routes to R102, which causes problem when R102's upstream peer disconnects, and R102 loses all routes.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;My configuration:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R101 running configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 6001&#xA; no synchronization&#xA; bgp router-id 1.1.2.253&#xA; bgp log-neighbor-changes&#xA; network 1.1.1.0&#xA; network 1.1.2.0&#xA; neighbor 2.1.1.249 remote-as 6000&#xA; neighbor 2.1.1.249 soft-reconfiguration inbound&#xA; neighbor 2.1.1.249 prefix-list 3 in&#xA; neighbor 2.1.1.249 route-map R1-DC-MAP out&#xA; neighbor 1.1.2.254 remote-as 6001&#xA; neighbor 1.1.2.254 next-hop-self&#xA; neighbor 1.1.2.254 soft-reconfiguration inbound&#xA; maximum-paths 2&#xA; no auto-summary&#xA;!&#xA;ip prefix-list 1 seq 5 permit 1.1.1.0/24&#xA;ip prefix-list 2 seq 5 permit 1.1.2.0/24&#xA;ip prefix-list 3 seq 5 deny 1.1.1.0/23&#xA;ip prefix-list 3 seq 10 permit any&#xA;!&#xA;route-map R1-DC-MAP permit 10&#xA; match ip address prefix-list 1&#xA; set as-path prepend 6001 6001 6001&#xA;!&#xA;route-map R1-DC-MAP permit 20&#xA; match ip address prefix-list 2&#xA;!&#xA;route-map R1-DC-MAP deny 200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R102 running configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 6001&#xA; no synchronization&#xA; bgp router-id 1.1.2.254&#xA; bgp log-neighbor-changes&#xA; network 1.1.1.0&#xA; network 1.1.2.0&#xA; neighbor 3.1.1.25 remote-as 6000&#xA; neighbor 3.1.1.25 soft-reconfiguration inbound&#xA; neighbor 3.1.1.25 prefix-list 3 in&#xA; neighbor 3.1.1.25 route-map R2-SIX-MAP out&#xA; neighbor 1.1.2.253 remote-as 6001&#xA; neighbor 1.1.2.253 next-hop-self&#xA; neighbor 1.1.2.253 soft-reconfiguration inbound&#xA; maximum-paths 2&#xA; no auto-summary&#xA;!&#xA;ip prefix-list 1 seq 5 permit 1.1.2.0/24&#xA;ip prefix-list 2 seq 5 permit 1.1.1.0/24&#xA;ip prefix-list 3 seq 5 deny 1.1.1.0/23&#xA;ip prefix-list 3 seq 10 permit any&#xA;!&#xA;route-map R2-SIX-MAP permit 10&#xA; match ip address prefix-list 1&#xA; set as-path prepend 6001 6001 6001&#xA;!&#xA;route-map R2-SIX-MAP permit 20&#xA; match ip address prefix-list 2&#xA;!&#xA;route-map R2-SIX-MAP deny 30&#xA; match ip address 1.1.1.0/23&#xA;!&#xA;route-map R2-SIX-MAP deny 200&#xA;!&#xA;ip forwarding&#xA;!&#xA;line vty&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R101 interface list:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface vlan3 is up, line protocol detection is disabled&#xA;  inet 1.1.1.253/30 broadcast 1.1.1.255&#xA;&#xA;Interface vlan4 is up, line protocol detection is disabled&#xA;  inet 2.1.1.253/29 broadcast 2.1.1.255&#xA;&#xA;Interface vlan101 is up, line protocol detection is disabled&#xA;  inet 1.1.1.61/26 broadcast 1.1.1.63&#xA;  inet 1.1.1.1/32 broadcast 1.1.1.1&#xA;&#xA;Interface vlan106 is up, line protocol detection is disabled&#xA;  inet 1.1.1.125/27 broadcast 1.1.1.127&#xA;  inet 1.1.1.97/32 broadcast 1.1.1.97&#xA;&#xA;Interface vlan107 is up, line protocol detection is disabled&#xA;  inet 1.1.1.141/28 broadcast 1.1.1.143&#xA;  inet 1.1.1.129/28 broadcast 1.1.1.143 secondary&#xA;&#xA;Interface vlan109 is up, line protocol detection is disabled&#xA;  inet 1.1.1.93/27 broadcast 1.1.1.95&#xA;  inet 1.1.1.65/32 broadcast 1.1.1.65&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R102 interface configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface vlan3 is up, line protocol detection is disabled&#xA;  inet 1.1.2.254/30 broadcast 1.1.2.255&#xA;&#xA;Interface vlan4 is up, line protocol detection is disabled&#xA;  inet 3.1.1.29/29 broadcast 3.1.1.31&#xA;&#xA;Interface vlan101 is up, line protocol detection is disabled&#xA;  inet 1.1.2.62/26 broadcast 1.1.2.63&#xA;  inet 1.1.2.1/32 broadcast 1.1.2.1&#xA;&#xA;Interface vlan106 is up, line protocol detection is disabled&#xA;  inet 1.1.2.126/27 broadcast 1.1.2.127&#xA;  inet 1.1.2.97/32 broadcast 1.1.2.97&#xA;&#xA;Interface vlan107 is up, line protocol detection is disabled&#xA;  inet 1.1.2.142/28 broadcast 1.1.2.143&#xA;  inet 1.1.2.129/28 broadcast 1.1.2.143 secondary&#xA;&#xA;Interface vlan109 is up, line protocol detection is disabled&#xA;  inet 1.1.2.94/27 broadcast 1.1.2.95&#xA;  inet 1.1.2.65/32 broadcast 1.1.2.65&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Advertisements are not working at all on R101, but I can see advertisements coming from R102. Communication with the upstream ISP BGP peers works as expected, and I am obtaining full BGP from them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R101 advertisements:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BGP table version is 0, local router ID is 1.1.2.253&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, = multipath,&#xA;              i internal, r RIB-failure, S Stale, R Removed&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R101 received-routes:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BGP table version is 0, local router ID is 1.1.2.253&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, = multipath,&#xA;              i internal, r RIB-failure, S Stale, R Removed&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*&amp;gt; 1.1.1.0     1.1.2.254           0    100      0 i&#xA;*&amp;gt; 1.1.2.0     1.1.2.254           0    100      0 i&#xA;&#xA;Total number of prefixes 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any ideas what may be wrong?&lt;/p&gt;&#xA;" OwnerUserId="20805" LastEditorUserId="8499" LastEditDate="2016-03-26T02:20:10.713" LastActivityDate="2017-04-20T19:54:58.107" Title="Quagga eBGP route advertisments are not propagated into iBGP session" Tags="|routing|bgp|quagga|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24767" PostTypeId="1" AcceptedAnswerId="24797" CreationDate="2015-11-26T22:50:20.693" Score="0" ViewCount="1965" Body="&lt;p&gt;I'm seeing some things in Wireshark I can't explain. My setup is as follows:&#xA;A router with a single global IP doing NAT for the devices behind it. I am also behind it with my computer. I port forward port 53 external port to my computer also on port 53 in the router (as an experiment).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From that point on, no-one in the network can do NS resolves anymore. Not even me. But the weird thing is that I'm seeing everyone their NS lookup queries in Wireshark arriving on &lt;strong&gt;my computer&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain this? I thought that port forwarding was meant to only apply on traffic coming from outside the NAT. It seems like the internal traffic is also being relayed to me. Is this a bug in the router? This seems like a huge security hole.&lt;/p&gt;&#xA;" OwnerUserId="20973" LastActivityDate="2018-11-19T18:49:43.177" Title="Why do I capture all DNS queries from everyone in the network when I port forward port 53 to my computer?" Tags="|router|nat|dns|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24769" PostTypeId="2" ParentId="24766" CreationDate="2015-11-27T00:05:55.337" Score="0" Body="&lt;p&gt;I guess that the problem is with your &lt;strong&gt;supporting routes&lt;/strong&gt; for 1.1.1.0/24 and 1.1.2.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To announce a prefix, you need a supporting route in RIB. So, you should have 1.1.1.0/24 and 1.1.2.0/24 in RIB to be able to announce them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you can't change your SVI's IP addressing, thus maybe you can enter two /24 routes towards the south of your network, or to Null0. Then the BGP network command will take effect.&lt;/p&gt;&#xA;" OwnerUserId="17343" LastEditorUserId="8499" LastEditDate="2016-03-26T02:21:10.750" LastActivityDate="2016-03-26T02:21:10.750" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24770" PostTypeId="2" ParentId="24762" CreationDate="2015-11-27T00:10:49.693" Score="1" Body="&lt;p&gt;You can use an inbound ACL to block fragments. The following link is a good place to start:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/8014-acl-wp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/8014-acl-wp.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17343" LastActivityDate="2015-11-27T00:10:49.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24771" PostTypeId="1" CreationDate="2015-11-27T00:31:21.757" Score="2" ViewCount="869" Body="&lt;p&gt;I am new member of Network Engineering site!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days I am interested in GRE tunneling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that GRE is developed by CISCO and many routers produced by CISCO and Juniper support GRE tunneling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I want to know other routers or firewalls support GRE tunneling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I know whether some routers support GRE if there's no mention in product specification without testing by myself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also wonder that GRE is standard or used generally in network industry or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="20974" LastActivityDate="2018-04-24T00:43:37.470" Title="Support GRE tunneling router or firewall" Tags="|cisco|router|firewall|gre|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="24772" PostTypeId="2" ParentId="24677" CreationDate="2015-11-27T03:24:44.133" Score="1" Body="&lt;p&gt;See the drawing about where PIM is between routers, and IGMP is between the router and the hosts. IGMP snooping is a switch command which is not necessary for the operation of multicast, but it lets the switch snoop on the IGMP messages between the hosts and router. Even without IGMP snooping, you still need IGMP; the multicast listener application sends an IGMP message to the router to tell it to start sending the multicast group out the router interface. All that IGMP snooping does is to let the switch target the specific ports instead of flooding all the ports. The drawing shows the older CGMP instead of IGMP snooping, but the purpose is the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HWD9q.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HWD9q.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As soon as the host application wants to listen to a multicast group, it sends an IGMP join message for a group to the router. The router will then set up the multicast forwarding and send the multicasts to the interface. The router will periodically send IGMP queries out the interface to see if any hosts are still interested in receiving this multicast group. If it gets no replies in the time period, it will stop sending the multicast group to the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't specify what the source type is, nor the destination application. You may have a problem with one of the other. If the source application is sending the multicasts, you may need to check the target application. You can use the &lt;code&gt;ip igmp join-group &amp;lt;group-address&amp;gt;&lt;/code&gt; interface command on your routers aid in your testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Notes:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are setting both the RP and the source as the RP mapping agent (&lt;code&gt;ip pim send-rp-discovery scope 12&lt;/code&gt;). You only need to do this on the RP since the RP can be the mapping agent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should enter your loopback as the interface-id for the RP mapping agent:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip pim send-rp-discovery Loopback0 scope 12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You shouldn't have &lt;code&gt;ip default-gateway 172.30.0.254&lt;/code&gt; in a router. A router should have routes delivered by OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are redistributing connected routes, but you have explicit network statement for two of those routes. You should pick one way or the other. Instead of &lt;code&gt;redistribute connected&lt;/code&gt;, you should probably use a broad network statement so that your routes aren't external routes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 100&#xA; log-adjacency-changes&#xA; passive-interface default&#xA; no passive-interface FastEthernet0/1&#xA; no passive-interface FastEthernet0/3&#xA; network 0.0.0.0 255.255.255.255 area 0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Double-check unicast routing, in particular, make sure that the source router has a route to the loopback of the RP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-28T09:39:11.267" LastActivityDate="2015-11-28T09:39:11.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24773" PostTypeId="1" CreationDate="2015-11-27T09:12:37.917" Score="4" ViewCount="1359" Body="&lt;p&gt;I'm confused about routing table sizes in BGP vs OSPF. My understanding is that in an AS with the routers running OSPF, each router will have the whole picture of the network, and as such will have an entry for each router and the metric for reaching it. If the routers in the AS are running BGP, each router will only be aware of its neighbors; as such, it will have much fewer entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this assumption correct? If it is, could you provide an example showing how this is so, and why this is always true?&lt;/p&gt;&#xA;" OwnerUserId="20977" LastActivityDate="2015-11-28T18:25:20.463" Title="OSPF vs BGP Routing Table Size" Tags="|routing|bgp|ospf|protocol-theory|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24775" PostTypeId="2" ParentId="24773" CreationDate="2015-11-27T09:55:58.480" Score="4" Body="&lt;p&gt;Don't confuse the routing protocol tables with the routing table. Each routing protocol maintains its own set of tables which are not the same thing as the routing table. The routing table will contain the best routes from the routing protocol tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP and OSPF serve different purposes. OSPF will always be within a single AS. BGP is primarily to route between ASes (eBGP). BGP can be used within an AS (iBGP), but there are some limitations and rules for iBGP. For instance, iBGP peers cannot advertise routes learned from another iBGP peer, so iBGP must maintain a full mesh or use some sort of mitigation (route reflectors or confederations). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF maintains a complete picture of the entire OSPF area in which it resides, and only that area, not necessarily an entire AS which may consist of multiple areas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP will have entries for each neighbor, and the prefixes which each neighbor advertises to it, along with BGP attributes, which can take up considerable space.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-27T09:55:58.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24776" PostTypeId="2" ParentId="24629" CreationDate="2015-11-27T11:06:11.277" Score="1" Body="&lt;p&gt;RSSI is the total received power over the whole 5Mhz UMTS carrier (if you are talking about 3G). This power includes the power of the common channels (which can be configured), the dedicated channels which have power control and the HSDPA, and the same powers coming from adjacent cells. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;RSSI depends on cell load, but it also depends on many other factors and practically it can't be used to assess the cell load. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other factors which affect the RSSI value are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;configured CPICH power&lt;/li&gt;&#xA;&lt;li&gt;path loss&lt;/li&gt;&#xA;&lt;li&gt;adjacent cells power&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;RSSI is RF measure which represents the received power. In 3G, power is related to capacity. If we have a cell with max power 20W and pilot channel of 2W then the rest of the power (18W) is for users. Each user takes small part of this power until it is all consumed.&lt;/p&gt;&#xA;" OwnerUserId="5576" LastEditorUserId="5576" LastEditDate="2015-11-27T13:24:18.677" LastActivityDate="2015-11-27T13:24:18.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24778" PostTypeId="1" AcceptedAnswerId="24779" CreationDate="2015-11-27T12:18:46.287" Score="1" ViewCount="106" Body="&lt;p&gt;I know PPP is used for point-to-point connections.  The Wikipedia article for &quot;point-to-point&quot; says that the term is used to refer to a wire that links only two computers or networks, as opposed to, say, a crossbar or bus that links several.  The Wikipedia article for PPP states that the protocol is used to establish a &quot;direct connection&quot; between two nodes on a network.  I am concluding from this that PPP is used only to establish a connection from one node to the next immediate neighbor; it is not concerned with sending traffic down multiple routers.  It establishes communications between two hosts that are adjacent to each other on the network, with no other hosts in between, or with the illusion that there are no other hosts in between (in the case of, e.g. VPN).  Am I right in thinking this?  I'm kind of confused here, because terms phrases &quot;direct connection&quot; and &quot;links only two computers&quot; are kind of vague.  If I am wrong in my interpretation of these phrases, then can you explain what they are supposed to mean?&lt;/p&gt;&#xA;" OwnerUserId="20762" LastActivityDate="2015-11-27T14:42:44.547" Title="Is PPP used to connect immediately adjacent hosts on a network?" Tags="|point-to-point|ppp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24779" PostTypeId="2" ParentId="24778" CreationDate="2015-11-27T12:34:34.677" Score="0" Body="&lt;p&gt;PPP is an extensible encapsulation-protocol which operates over a DTE/DCE connection. This implies two endpoints (one DTE and one DCE). These endpoints are adjacent to each other over the real or virtual circuit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a PPP description document: &lt;a href=&quot;http://docwiki.cisco.com/wiki/Point-to-Point_Protocol&quot; rel=&quot;nofollow&quot;&gt;Point-to-Point Protocol&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-27T12:34:34.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24780" PostTypeId="1" AcceptedAnswerId="24900" CreationDate="2015-11-27T14:18:58.533" Score="2" ViewCount="648" Body="&lt;p&gt;I currently have a ubiquiti edgerouter setup with an ipsec site-to-site vpn and l2tp/ipsec remote access vpn. Both work as intended. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to configure the remote access (l2tp/ipsec) vpn to work when the client is not behind NAT? I'm having trouble finding information about this since NAT is so prevalent and everyone assumes that it will be in use.&lt;/p&gt;&#xA;" OwnerUserId="20964" LastEditorUserId="20964" LastEditDate="2015-11-28T15:11:11.643" LastActivityDate="2016-04-25T14:59:29.667" Title="Vyatta/EdgeOS remote access VPN without NAT?" Tags="|vpn|nat|l2tp|vyatta|ubiquiti|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24781" PostTypeId="2" ParentId="24778" CreationDate="2015-11-27T14:42:44.547" Score="1" Body="&lt;p&gt;PPP is a layer 2 protocol, and like most layer 2 protocols, it is usually dependent on the physical media. The Wikipedia article you quote lists the kinds of media normally used with PPP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, you choose the L2 protocol based on the communications media, not on who you're trying to communicate with.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-27T14:42:44.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24782" PostTypeId="2" ParentId="24762" CreationDate="2015-11-27T19:54:43.873" Score="2" Body="&lt;p&gt;On the external interface of your router, use this ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list extended NO_FRAG&#xA;deny ip any any fragments&#xA;permit ip any any&#xA;end&#xA;&#xA;interface &amp;lt;ext interface&amp;gt;&#xA;ip access-group NO_FRAG in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-11-27T19:54:43.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24784" PostTypeId="1" CreationDate="2015-11-27T23:54:16.950" Score="3" ViewCount="5535" Body="&lt;p&gt;Has anyone configured FTP rules in the Meraki MX family of network devices? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Locally, inside the LAN, I can login to the FTP server (IIS Windows 2012 server) without problems; but, I cannot login from outside (via WAN). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FTP Server uses Passive mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later I'm going to attached links from Meraki and YouTube websites that I have already tried.&lt;/p&gt;&#xA;" OwnerUserId="20972" LastEditorUserId="453" LastEditDate="2018-01-03T04:46:20.287" LastActivityDate="2018-01-03T04:46:20.287" Title="How to configure FTP in Cisco Meraki?" Tags="|cisco|firewall|tftp|" AnswerCount="2" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24787" PostTypeId="1" AcceptedAnswerId="34346" CreationDate="2015-11-28T02:01:37.667" Score="0" ViewCount="731" Body="&lt;p&gt;We have to plug two brand new Juniper SRX firewalls to the core switches, and I'm tasked with the research for what's the best mode of operation for the FW, either transparent mode or routing mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/88QBx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/88QBx.jpg&quot; alt=&quot;Core-Distribution-Firewall.where.to&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose for the firewalls is to protect and perform the IPS to both inbound and outbound traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eager to hear your thoughts.&#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="20981" LastActivityDate="2017-08-20T10:09:09.463" Title="Juniper SRX to core switch and distribution. Transparent (L2) mode vs. routing mode" Tags="|switch|firewall|juniper-junos|juniper-srx|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24789" PostTypeId="1" CreationDate="2015-11-28T05:05:20.667" Score="0" ViewCount="14442" Body="&lt;p&gt;Here's the scenario:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There are 2 Mikrotiks, each are on different floor&lt;/li&gt;&#xA;&lt;li&gt;Each ether 1 port connected to ISP through PPPoE&lt;/li&gt;&#xA;&lt;li&gt;Both Mikrotiks connected to each other on port 3&lt;/li&gt;&#xA;&lt;li&gt;There's a VOIP server on IP address 192.168.121.2 on Mikrotik 1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Mikrotik 1:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ether 1 is out to internet&lt;/li&gt;&#xA;&lt;li&gt;Ether 3 is connected to Mikrotik 2 and has an IP address of 192.168.30.1&lt;/li&gt;&#xA;&lt;li&gt;Ether 4 is a master of Ether 5, and both ports connect to 2 different&#xA;switches which are used for IP phones on VLAN 103 (192.168.114.0/24) and&#xA;the local network on VLAN 102 (192.168.99.0/24)&lt;/li&gt;&#xA;&lt;li&gt;Ether 6 (192.168.60.1) goes to the 6th floor which is only used for the Internet, which is connected to Ether 1&lt;/li&gt;&#xA;&lt;li&gt;Ether 9 is the port to which the VoIP server (192.168.121.2) is connected, and Ether 9 has an IP address of 192.168.121.1/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Mikrotik 2:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ether 1 is out to another ISP for the Internet&lt;/li&gt;&#xA;&lt;li&gt;Ether 3 is connected to Mikrotik 1 (192.168.30.2)&lt;/li&gt;&#xA;&lt;li&gt;Ether 4 (192.168.110.0/24) is connected to a switch for use in this&#xA;floor and has 2 VLANs (103 and 104)&lt;/li&gt;&#xA;&lt;li&gt;VLAN 103 = IP address 192.168.112.0/24 is used for the VoIP network&lt;/li&gt;&#xA;&lt;li&gt;VLAN 104 = IP address 192.168.111.0/24 is used for local network and&#xA;Wi-Fi&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My problems are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;VLAN 103 in Mikrotik 2 can't connect/route to VoIP server&#xA;(192.168.121.2) on Ether 9 in Mikrotik 1.&lt;/li&gt;&#xA;&lt;li&gt;I need Ether 9 (VoIP server 192.168.121.2) in Mikrotik 1 to route to&#xA;VLAN 103 (192.168.112.0) in Mikrotik 2.&lt;/li&gt;&#xA;&lt;li&gt;How do i route traffic from VLAN 102 in Mikrotik 1 to&#xA;Ether 3 (Mikrotik 1) and down to Ether 3 in Mikrotik 2 to the ISP which&#xA;is connected on Ether 1 in Mikrotik 2?&lt;/li&gt;&#xA;&lt;li&gt;From the existing configuration, both Ether 1 on the Mikrotiks&#xA;connect to the ISPs using address acquisition of static instead of PPPoE&#xA;which is the IP address of the modem but both have PPPoE clients configured with&#xA;PPPoE usernames and passwords. Neither router can operate in&#xA;bridge mode, and configurations on both modems don't have PPPoE&#xA;usernames and passwords. How does it work?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20992" LastEditorUserId="8499" LastEditDate="2018-02-14T16:25:51.790" LastActivityDate="2018-02-14T16:25:51.790" Title="Mikrotik route between VLANs on 2 mikrotik" Tags="|vlan|" AnswerCount="2" CommentCount="1" ClosedDate="2017-08-09T23:47:12.577" ContentLicense="CC BY-SA 3.0" />
  <row Id="24790" PostTypeId="1" AcceptedAnswerId="24791" CreationDate="2015-11-28T05:31:44.283" Score="1" ViewCount="5188" Body="&lt;p&gt;I'm working on a Cisco 2800, trying to get it to NAT an internal RFC1918 to a WAN. The WAN (ISP) address is from DHCP. I've never worked with NAT on a Cisco before. Cisco's tech pages are also listing some commands that don't exist in the 2800. Please see &lt;code&gt;sh run&lt;/code&gt; output below. Hopefully, someone sees what I'm leaving out. I can ping from each interface to its' connected network, but cannot cross the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2015.11.27 21:00:50 =~=~=~=~=~=~=~=~=~=~=~=&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco_Edge#sh run  &#xA;Building configuration...  &#xA;&#xA;Current configuration : 2888 bytes &#xA;!&#xA;version 12.4  &#xA;no service pad  &#xA;service timestamps debug datetime msec  &#xA;service timestamps log datetime msec  &#xA;service password-encryption  &#xA;!  &#xA;hostname Cisco_Edge  &#xA;!  &#xA;boot-start-marker  &#xA;boot-end-marker  &#xA;!  &#xA;no aaa new-model  &#xA;!  &#xA;resource policy  &#xA;!  &#xA;mmi polling-interval 60  &#xA;no mmi auto-configure  &#xA;no mmi pvc  &#xA;mmi snmp-timeout 180  &#xA;ip subnet-zero  &#xA;ip cef  &#xA;!  &#xA;ip domain name [redacted]  &#xA;ip ssh version 2  &#xA;!  &#xA;crypto pki certificate chain   &#xA;  [redacted]  &#xA;!  &#xA;interface FastEthernet0/0  &#xA; description WAN - Outside - Untrusted  &#xA; ip dhcp client client-id FastEthernet0/0  &#xA; ip dhcp client class-id Cisco  &#xA; ip dhcp client hostname Cisco-Edge  &#xA; ip dhcp client lease 3 0 0  &#xA; ip address dhcp  &#xA; ip nat outside  &#xA; ip nat enable  &#xA; ip virtual-reassembly  &#xA; duplex auto  &#xA; speed auto  &#xA;!  &#xA;interface FastEthernet0/1  &#xA; description LAN - Inside - Trusted  &#xA; ip address 172.16.16.1 255.255.255.0  &#xA; ip nat inside  &#xA; ip nat enable  &#xA; ip virtual-reassembly  &#xA; speed auto  &#xA; full-duplex  &#xA; no mop enabled  &#xA;!  &#xA;ip classless  &#xA;ip route 0.0.0.0 0.0.0.0 dhcp  &#xA;!  &#xA;!  &#xA;no ip http server  &#xA;no ip http secure-server  &#xA;!  &#xA;control-plane  &#xA;!  &#xA;line con 0  &#xA;line aux 0  &#xA;line vty 0 4  &#xA; login local  &#xA;!  &#xA;end  &#xA;&#xA;Cisco_Edge#  sh ip int bri  &#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;FastEthernet0/0            10.0.1.245      YES DHCP   up                    up        &#xA;FastEthernet0/1            172.16.16.1     YES manual up                    up        &#xA;NVI0                       unassigned      YES unset  up                    up        &#xA;Cisco_Edge#sh ip route  &#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 10.0.1.1 to network 0.0.0.0  &#xA;&#xA;    172.16.0.0/24 is subnetted, 1 subnets  &#xA;C       172.16.16.0 is directly connected, FastEthernet0/1  &#xA;     10.0.0.0/24 is subnetted, 1 subnets  &#xA;C       10.0.1.0 is directly connected, FastEthernet0/0  &#xA;S*   0.0.0.0/0 [1/0] via 10.0.1.1  &#xA;Cisco_Edge#ping 10.0.1.1  &#xA;&#xA;Type escape sequence to abort.  &#xA;Sending 5, 100-byte ICMP Echos to 10.0.1.1, timeout is 2 seconds:  &#xA;!!!!!  &#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/4 ms  &#xA;Cisco_Edge#ping 10.0.1.1 source fa0/1  &#xA;&#xA;Type escape sequence to abort.  &#xA;Sending 5, 100-byte ICMP Echos to 10.0.1.1, timeout is 2 seconds:  &#xA;Packet sent with a source address of 172.16.16.1   &#xA;.....  &#xA;Success rate is 0 percent (0/5)  &#xA;Cisco_Edge#exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1068" LastEditorUserId="8499" LastEditDate="2015-11-28T06:03:47.317" LastActivityDate="2015-11-28T06:27:57.110" Title="Cisco Static NAT with DHCP outside interface" Tags="|dhcp|cisco-ios-12|snat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24791" PostTypeId="2" ParentId="24790" CreationDate="2015-11-28T06:02:45.690" Score="0" Body="&lt;p&gt;First, I &lt;strong&gt;&lt;em&gt;strongly&lt;/em&gt;&lt;/strong&gt; urge you to have a firewall in from of your router, and you could do the NAT on that. You have the interfaces described as &quot;Trusted&quot; and &quot;Untrusted&quot;, but those are firewall terms. Without a firewall, nothing should be considered trusted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are willing to risk your network with no firewall, something like this should work (you don't specify the IOS version, so you may need to make accommodations for differences in commands):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; description WAN - Outside&#xA; ip address dhcp&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA; no shutdown&#xA;!&#xA;interface FastEthernet0/1&#xA; description LAN - Inside&#xA; ip address 172.16.16.1 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; no shutdown&#xA;!  &#xA;ip nat inside source list 10 interface FastEthernet0/0 overload&#xA;!&#xA;access-list 10 permit 172.16.16.1 0.0.0.255&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-28T06:27:57.110" LastActivityDate="2015-11-28T06:27:57.110" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24793" PostTypeId="2" ParentId="24787" CreationDate="2015-11-28T09:45:51.660" Score="0" Body="&lt;p&gt;Hence you mentioned the main purpose is IPS performance, then I would suggest put it in Transparent mode. Thus, as you may know, you won't have to hassle with IP Addressing changes, but you will lose VPN, NAT, and such flow features; which I assume you won't need them in this scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;Mohammad Moghaddas&lt;/p&gt;&#xA;" OwnerUserId="17343" LastActivityDate="2015-11-28T09:45:51.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24794" PostTypeId="2" ParentId="24771" CreationDate="2015-11-28T09:52:23.350" Score="2" Body="&lt;p&gt;Although GRE is developed by Cisco, it doesn't mean that other vendors don't support it. It's became kinda standard in the industry and I have not seen any single vendor who doesn't support it, whether Juniper, Check Point, Fortinet, etc.... And it's also pretty simple to implement on any Linux distribution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd rather getting in contact with the Sales/Technical team of the vendor and ask whether it is supported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As mentioned, it's generally used in Network industry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;Mohammad Moghaddas&lt;/p&gt;&#xA;" OwnerUserId="17343" LastActivityDate="2015-11-28T09:52:23.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24797" PostTypeId="2" ParentId="24767" CreationDate="2015-11-28T10:48:47.777" Score="2" Body="&lt;p&gt;Most likely your router acts as a DNS relay. So it doesn't need to know the external DNS servers when you request a IP, using DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So all clients inside the network think your router is a DNS server, but in fact its just a relay client. So if a client inside the network send s DNS request the ip destination field is the internal address of your router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By allowing external DNS request to be forwarded you would get the following. A packet with the external ip address arrives at the router. It sees a this is my ip i have to forward it to internal PCx.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next a internal client sends a DNS packet to the router. again the same thing happens. Because both packets have the router as destination. The router is to 'dumb' to see the packet is arriving on the internal interface(ip) or the external interface(ip).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This isn't really a bug(the industry would call it a feature :P) it has been in many router firmware's. Is just the problem that consumer grade routers are programmed that they don't really see a difference in traffic, where they are the destination. Even when the packet arrives on a totally different interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope my explanation helps ;)&lt;/p&gt;&#xA;" OwnerUserId="14392" LastActivityDate="2015-11-28T10:48:47.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24800" PostTypeId="2" ParentId="24631" CreationDate="2015-11-28T11:28:10.510" Score="1" Body="&lt;p&gt;As far a i know your not able to do that with ztp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why not let Ansible login and use raw commands ? or create a bash script with the expect command and let Ansible run that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i know both solutions are not ideal but they can get the job done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck! hope my 2 cents helps.&lt;/p&gt;&#xA;" OwnerUserId="14392" LastActivityDate="2015-11-28T11:28:10.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24802" PostTypeId="1" CreationDate="2015-11-28T12:58:22.863" Score="2" ViewCount="52" Body="&lt;p&gt;What's actually difference in settings of VPN when it's used e.g. to connect the company's offices around the world with the headquarters and VPN you just connect to hide what you do on the Internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;question 1) Is it the same, but in those VPNs that are used only for privacy, the &lt;strong&gt;data sharing is disabled&lt;/strong&gt; between the connected computers? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;question 2) Can other people on VPNs like hotspotshield or other free or paid VPNs see me on the network or access my files on the computer somehow or the owner of the VPN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can one set-up a simple VPN? Just point me to a software or something that can manage that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance, i am just a newbie into networking and want to get it sorted out.&lt;/p&gt;&#xA;" OwnerUserId="21002" LastActivityDate="2016-02-26T20:29:04.527" Title="VPN connecting offices vs hiding only VPNs (privacy) and their settings" Tags="|vpn|data|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24803" PostTypeId="1" CreationDate="2015-11-28T13:04:37.163" Score="7" ViewCount="2219" Body="&lt;p&gt;My question is simple, i don't really know if I understand it so I'm asking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do we have both addresses, if we know the ip address of the target and source computer, why do we need some physical address? I've had this question so I have googled that and found that network devices communicate via physical address (MAC address), then why do we have ip addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it work like that I know target ip address, and my network devices finds using ARP the physical (MAC) address of the computer somewhere else in the world and sends that there?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone really &lt;strong&gt;simply illustrate&lt;/strong&gt; &lt;strong&gt;how both addresses work together&lt;/strong&gt;? Because I'm really confused about it.&lt;/p&gt;&#xA;" OwnerUserId="21002" LastEditorUserId="8499" LastEditDate="2018-03-07T22:40:58.433" LastActivityDate="2018-03-07T22:40:58.433" Title="IP Address vs MAC Address, how does that really work together illustration" Tags="|ip|mac-address|arp|ip-address|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24804" PostTypeId="2" ParentId="24803" CreationDate="2015-11-28T16:05:46.013" Score="4" Body="&lt;p&gt;The answer is both technical and historical. IP is the network that interconnect several networks. As ethernet nic have a MAC adress at layer 2, something else is needed at layer 3: IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With IP, 2^128 devices are theorically adressable, whereas MAC address are limited to 48 bit. Keep in mind that ethernet is a flat, commuted, broadcast network: it would not scale worldwide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I agree with you on one point: it is totally plausible to have an IP network without ethernet, or at least without a broadcast layer 2 network.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-28T16:05:46.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24805" PostTypeId="2" ParentId="24511" CreationDate="2015-11-28T17:31:09.700" Score="1" Body="&lt;p&gt;Force10 routers and switches have a top level &lt;code&gt;tcpdump&lt;/code&gt; command that can create libpcap compatible captures.&lt;/p&gt;&#xA;" OwnerUserId="500" LastActivityDate="2015-11-28T17:31:09.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24806" PostTypeId="2" ParentId="24787" CreationDate="2015-11-28T18:05:09.333" Score="0" Body="&lt;p&gt;I would suggest routing, because it will ease debugging. Traceroute will work for instance.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-28T18:05:09.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24807" PostTypeId="2" ParentId="24773" CreationDate="2015-11-28T18:25:20.463" Score="2" Body="&lt;p&gt;OSPF will only exchange routes in your Autonomous System. Basically, OSPF knows about all your vlans and all your router interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP exchange routes from other AS: how to reach networks from google, twitter, colt, level3... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside your AS, you may have several BGP routers, that know about those external networks. But somehow they have to exchange the information. For instance your router A may be directly connected to colt network, whereas router B can reach google more easily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The (very) old way was to redistribute all the external routes inside OSPF. It is not a good practice now because OSPF was designed for faster convergence and won't scale with that many routes.&#xA;OSPF would flood every change, won't be able to apply 'policies' the same way as BGP, and would not support dampening (AFAIK).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current best practice is to have internal BGP sessions between all your routers (iBGP): external routes exchanged between your internal routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helped.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-28T18:25:20.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24808" PostTypeId="2" ParentId="24802" CreationDate="2015-11-28T18:41:50.760" Score="1" Body="&lt;p&gt;A VPN is just a tunnel which encapsulates, and optionally encrypts, your IP packets inside other IP packets. Different VPN creators add different options to their software, but a VPN tunnel operates the the same from a network perspective - encapsulate IP packets inside other IP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions about the actual applications or recommendations for such are off-topic, and you can ask those questions on &lt;a href=&quot;https://superuser.com/&quot;&gt;Super User&lt;/a&gt; or &lt;a href=&quot;https://softwarerecs.stackexchange.com/&quot;&gt;Software Recommendations&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:50:06.373" LastActivityDate="2015-11-28T18:41:50.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24809" PostTypeId="2" ParentId="24803" CreationDate="2015-11-28T19:33:19.330" Score="4" Body="&lt;p&gt;MAC addresses are assigned with a vendor identification (OUI) and an identification which is unique to the vendor. There is no order to this in a particular LAN since you will have devices from multiple vendors, and even devices from the same vendor will not be in order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IEEE assigns OUIs and defines how the LAN works. This only goes as far as the layer-2 boundaries. Layer-2 needs broadcasts to operate, and each and every broadcast must interrupt and be processed by each and every host on the LAN. This can get out of hand very quickly, placing a practical limit on the size of a layer-2 network. Imagine having you PC pounded by broadcasts from every host on the Internet; it couldn't keep up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also multiple types of LANs which are not directly interoperable. For instance, Wi-Fi (IEEE 802.11) can't directly communicate with ethernet (IEEE 802.3). You would need a translation bridge at layer-2 like used to be used between token ring and ethernet, or you move up the stack to layer-3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where layer-3 steps in. Layer-3 is independent of the layer-2 protocol used by the hosts. It has its own addressing which is independent of the layer-2 addressing. Layer-3 addressing is hierarchical, allowing segmentation of layer-2 LANs so that broadcasts and other communications can be isolated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that's not enough addresses for you, layer-4 can have its own addresses, too. For instance, TCP and UDP use addresses which are called ports. Upper layers can have addresses, too, but there is no real standardization for those; the application designer can create any addressing desired for an application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hosts are unaware of the layer-2 address of other hosts. They need some sort of layer-2 protocol to help with that, and many were developed over the years, but the limitations of layer-2 didn't allow layer-2-only networking to scale to the size of today's networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a host wants to talk to another host at layer-3 (I will assume IP as the layer-3 protocol for this, but the concept applies to any layer-3 protocol), it must determine if the other host is on its own LAN. It can do this by masking the destination address with its mask and comparing it to its own network. If the destination host is not on its LAN it will need to send the traffic to its configured gateway which will be on its LAN. At this point, the host needs to discover the MAC address on it LAN, either the destination host or gateway. To do this, it uses ARP. ARP sends a broadcast asking, &quot;To whom does this layer-3 address belong?&quot; The destination host or gateway will respond with its MAC address, and the sending host will use that to create the frame and send the traffic. The sending host will also cache the layer-3 to layer-2 resolution for a period of time so that if there is more traffic destined for that layer-3 address, it already has that information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the layer-2 destination is the gateway, the gateway will get the frame and strip it off, leaving the layer-3 packet. The router will then determine where to send the packet next, and it will create a new layer-2 frame for the new layer-2 segment over which the packet must travel.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-28T19:33:19.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24810" PostTypeId="2" ParentId="24789" CreationDate="2015-11-28T20:24:51.897" Score="1" Body="&lt;p&gt;You might find the section on &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Simple_Static_Routes_Example&quot; rel=&quot;nofollow&quot;&gt;static routes&lt;/a&gt; in the Mikrotik Wiki helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, you need to add a static route on Mikrotik 2 traffic to reach the voip server vlan on Mikrotik 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;/ip route add dst-address=192.168.121.0/24 gateway=192.168.30.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, you need to add a static route on Mikrotik 1 for return traffic to vlan 103 on Mikrotik 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;/ip route add dst-address=192.168.112.0/24 gateway=192.168.30.2&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="21006" LastActivityDate="2015-11-28T20:24:51.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24811" PostTypeId="1" CreationDate="2015-11-28T21:52:57.943" Score="1" ViewCount="107" Body="&lt;p&gt;It is my understanding that technically there is no limitation on using port 0 in a TCP/IP packet, it is normally simply reserved to mean an ephemeral port.  I tested this by writing a simple C-app that binded to port 0 and in fact &lt;code&gt;netstat&lt;/code&gt; revealed that it had binded to an ephemeral port, 50252.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I wrote an application, and explicitly made any (perhaps) necessary modifications to my networking library, operating system, and anything else that is physically under my control not to interpret port 0 (zero) as literally port zero and nothing special, would it be routed over the public internet?  Or even perhaps reliably routed over the public internet?&lt;/p&gt;&#xA;" OwnerUserId="21007" LastEditorUserId="8499" LastEditDate="2018-03-07T22:38:32.690" LastActivityDate="2018-03-07T22:38:32.690" Title="If I wrote an application to use port 0, would it be routed over the public internet?" Tags="|routing|tcp|internet|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24812" PostTypeId="2" ParentId="24811" CreationDate="2015-11-28T21:59:00.273" Score="3" Body="&lt;p&gt;A port is a layer-4 address for some layer-4 protocols (you don't specify which layer-4 protocol). Routing is done with layer-3 addresses. Routing looks at the layer-3 packet, not the layer-4 segment. This is because layer-3 protocols can encapsulate any of a number of layer-4 protocols, some of which don't even use ports.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-28T21:59:00.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24813" PostTypeId="1" CreationDate="2015-11-29T02:02:08.817" Score="2" ViewCount="158" Body="&lt;p&gt;I have a series of modules (similar to a RPi) that run a Linux flavor each having an Ethernet NIC. I have 4 of these and I want to connect them to a switch to be able to send UDP packets to each one individually from a host connected to the same switch. Each one has its own IP address in the 192.168.1.0 subnet. It seems simple enough to get this to work, the problem is all of them have the same MAC Address (except for the host). This of course causes problems with the switch when sending packets to the modules. Packets to the host are received fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not able to change their MAC Addresses, only the IP Addresses, although that won't help much given that the switch works based on MAC entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this setup the only way to make sure the UDP packets actually reach the modules every time would be to broadcast them all over the subnet. The problem with this approach is that they don't handle very well the fact of being constantly flooded with packets that initially aren't for them. The time spent handling the packet causes timeouts in the system which renders this solution unfeasible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another solution would be to isolate each in one VLAN in order to separate broadcast domains and configure the routing paths accordingly. The problem with this is that I don't have spare equipment that I could use to do this and even if I had, my networking knowledge is limited when it comes to VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point I would need an advice about this problem... maybe a scenario that I haven't thought about yet in which I could get this to work with as few extra hardware as possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance! &lt;/p&gt;&#xA;" OwnerUserId="21008" LastActivityDate="2018-03-18T13:27:09.740" Title="Is there a way to build a functional (sub)network with devices that have the same MAC Address?" Tags="|routing|switch|vlan|udp|mac|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24814" PostTypeId="1" AcceptedAnswerId="24815" CreationDate="2015-11-29T03:55:29.493" Score="2" ViewCount="853" Body="&lt;p&gt;I'm aware of the fact that broadcast has been removed from IPv6 and just has multicast instead. However, recently I read&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;This process (ARP) is now achieved via a multicast address called the solicited node address because all hosts join this multicast group upon connecting to the network.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now my question is, if all hosts join this node upon entering the network and then a &quot;multicast&quot; packet is sent out to all hosts on this node, doesn't that become the same as a broadcast in IPv4?&lt;/p&gt;&#xA;" OwnerUserId="20062" LastEditorUserId="8499" LastEditDate="2019-01-13T03:44:25.547" LastActivityDate="2019-01-13T09:07:27.523" Title="Broadcasts in IPv6" Tags="|ip|ipv4|ipv6|multicast|ndp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24815" PostTypeId="2" ParentId="24814" CreationDate="2015-11-29T04:25:10.560" Score="3" Body="&lt;p&gt;You misunderstand how the solicited-node multicast addresses work. Each host could have a different solicited-node multicast address. A solicited-node multicast address is based on the IPv6 unicast or anycast address. From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Solicited-Node multicast address are computed as a function of a&lt;br /&gt;&#xA;node's unicast and anycast addresses.  A Solicited-Node multicast&lt;br /&gt;&#xA;address is formed by taking the low-order 24 bits of an address&lt;br /&gt;&#xA;(unicast or anycast) and appending those bits to the prefix&lt;br /&gt;&#xA;FF02:0:0:0:0:1:FF00::/104...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;A broadcast, like ARP, will interrupt every host on a LAN, and require each and every host on the LAN to process the request to see whether or not the ARP is for the host. Multicasts are selective broadcasts, and only the hosts subscribing to the multicast group will receive the multicast.&lt;/p&gt;&#xA;&lt;p&gt;This method will only affect one or a few hosts on a LAN instead of all the hosts on the LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-11-29T04:25:10.560" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24820" PostTypeId="1" CreationDate="2015-11-29T09:17:17.140" Score="0" ViewCount="60" Body="&lt;p&gt;Sorry if this is a very basic question. I'm trying to learn as much as I can about how packets are sent across the different layers on Protocol Stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One confusion I have is with DNS protocol. When I set my machine's DNS server from default to say 8.8.8.8 . How are the packets, affected? Do they retain DNS server IP in the header? Or my understanding is wrong about packets/DNS? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="21011" LastActivityDate="2015-12-31T16:27:52.120" Title="Packets: How are they affected with DNS configurations?" Tags="|dns|" AnswerCount="2" CommentCount="2" ClosedDate="2017-08-12T23:11:30.797" ContentLicense="CC BY-SA 3.0" />
  <row Id="24826" PostTypeId="2" ParentId="24820" CreationDate="2015-11-29T18:20:03.633" Score="1" Body="&lt;p&gt;IP knows nothing about DNS or names, so packets are not affected by DNS. IP only understands IP addresses, not DNS names. An application will use DNS to resolve a name to an IP address before IP can be used by the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a protocol above OSI Layer 4, questions about DNS are off-topic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-29T18:20:03.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24828" PostTypeId="1" AcceptedAnswerId="24830" CreationDate="2015-11-29T18:56:29.187" Score="2" ViewCount="254" Body="&lt;p&gt;I read that limited broadcast address will be dropped by the router. So, it's not used in the layer-3 (Network layer), where IP addresses are meant to be used. So, where exactly is it used?&lt;/p&gt;&#xA;" OwnerUserId="21020" LastEditorUserId="8499" LastEditDate="2020-07-17T01:19:07.777" LastActivityDate="2020-07-17T01:19:07.777" Title="Where exactly is the limited broadcast address used?" Tags="|router|ip|ip-address|layer3|broadcast|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24830" PostTypeId="2" ParentId="24828" CreationDate="2015-11-29T19:04:35.700" Score="2" Body="&lt;p&gt;Any broadcasts are limited to a layer-2 domain, which is bounded by a layer-3 device (router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An application designer, needing to send broadcasts on any subnet where the application may be run, could use the Limited Broadcast address as a hard-coded address rather than spending the time to figure out the subnet broadcast address for the subnet on which the application finds itself.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-29T19:04:35.700" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24832" PostTypeId="1" AcceptedAnswerId="24833" CreationDate="2015-11-29T19:49:04.570" Score="0" ViewCount="697" Body="&lt;p&gt;Consider, there is router R connected to switches A,B,C. Each switch is connected to 5 systems. If a system in switch A sends a limited broadcast, will it be broadcasted only to the systems under switch A, or to all the systems under switches A,B,C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please explain the flow of packets at each stage. i.e. Does it go from Switch to Router to Switch, or just Switch to Switch, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a router simply drops the packet, then how does it get broadcasted to other switches in that subnet?&lt;/p&gt;&#xA;" OwnerUserId="21020" LastActivityDate="2015-11-29T20:00:55.607" Title="How does a router/switch handle a limited broadcast address (255.255.255.255)?" Tags="|ip|broadcast|" AnswerCount="1" CommentCount="3" ClosedDate="2015-11-30T11:56:59.103" ContentLicense="CC BY-SA 3.0" />
  <row Id="24833" PostTypeId="2" ParentId="24832" CreationDate="2015-11-29T19:54:29.980" Score="2" Body="&lt;p&gt;Broadcasts will not cross a layer-3 boundary (router). If the switches are connected to the router in separate subnets, the broadcast will be limited to a single switch. If the switches are bridged at layer-2, the broadcast will be propagated to any switch in the bridge group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, if traffic from one switch to the other must be routed (different subnets), broadcasts will be limited to a single switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switches only connect to the router at layer-3, broadcasts will be limited to a single switch. If the switches are connected to the router in a bridge group, the router acts like another layer-2 device for any traffic between the switches, and will pass layer-2 traffic (like broadcasts) between the switches. If the switches are connected together, layer-2 traffic will pass from one switch to another switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to define the layer-2/layer-3 boundaries in order to properly answer this question. Once you do that, you can tell where a broadcast will travel since it will not cross such a boundary.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-29T20:00:55.607" LastActivityDate="2015-11-29T20:00:55.607" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24834" PostTypeId="1" AcceptedAnswerId="24868" CreationDate="2015-11-29T20:09:56.443" Score="2" ViewCount="171" Body="&lt;p&gt;I've been wondering how it would be possible to accurately map a network using something like nmap and discover hosts on the network if those hosts have stateful firewalls set up that filter packets based on the source IP address, port, and sequence number of incoming packets.  The source port and IP address you can obtain by monitoring the network with a packet sniffer like Wireshark or TCPdump, but the sequence number is something that constantly changes, and you would have to get it right and with precise timing, meaning you would have to send a discovery packet with a sequence number that is exactly one greater than the sequence number of the last packet that the host received.  Of course you can bruteforce the sequence number (not sure how to do this with nmap), but you also want to do it transparently, and there's the fact that if your discovery packet does successfully reach the host, its firewall will filter out further traffic they were meant to receive, resulting in an error on their end and making your presence at least somewhat visible.  Is there a way to avoid this problem?  Have nmap and other network scanners accounted for stateful firewalls in recent years?&lt;/p&gt;&#xA;" OwnerUserId="20762" LastActivityDate="2017-03-03T09:10:14.330" Title="How would you discover hosts on a network if they have stateful firewalls set up?" Tags="|firewall|monitoring|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24835" PostTypeId="1" AcceptedAnswerId="24837" CreationDate="2015-11-29T20:16:18.623" Score="4" ViewCount="9462" Body="&lt;p&gt;Please explain the flow of traffic in each case.&lt;/p&gt;&#xA;" OwnerUserId="21020" LastEditorUserId="8499" LastEditDate="2018-03-11T02:04:11.710" LastActivityDate="2018-03-11T02:04:11.710" Title="What is the difference between ff-ff-ff-ff-ff-ff (layer 2 broadcast) 255.255.255.255 (layer 3 limited broadcast)?" Tags="|ipv4|ip|layer2|broadcast|layer3|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24836" PostTypeId="2" ParentId="24834" CreationDate="2015-11-29T20:22:09.737" Score="1" Body="&lt;p&gt;One of the benefits of firewalls is that they can render hosts, or whole networks, invisible. The idea behind this is that the owner of the firewall can block or allow whatever traffic is desired. An external tool will not be able to get a host to respond if the host's firewall doesn't allow it. The tool would need to not only find a port in use for a traffic flow, but it would also need to spoof the source IP address and port of the traffic allowed through the port since the firewall opens a port for a specific traffic flow (IP address + port number).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can render things like port scans useless. Depending on where your sniffer is placed on a network, you may be able to sniff network traffic to discover devices on the network, but this may not be possible, either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the network owner does this in order to prevent someone from network discovery, attempting this is trying to bypass network security or policies which is specifically off-topic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-29T20:22:09.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24837" PostTypeId="2" ParentId="24835" CreationDate="2015-11-29T20:30:10.953" Score="6" Body="&lt;p&gt;They are aimed at different network layers. Every layer-2 broadcast must be inspected and processed by every host to see if it should be passed up to layer-3. A layer-3 broadcast received by a host must be inspected and processed to see if it must be passed up to layer-4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose it would be possible to create a layer-2 frame which is a layer-2 unicast frame but contains a layer-3 broadcast address. This would not really be a broadcast since it only goes to a single host based on the layer-2 MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP is an example of a layer-2 broadcast which has a layer-3 unicast address. Each host must inspect the layer-2 ARP broadcast to see if it should be passed up to layer-3, but only the host with the layer-3 unicast address will actually pass the layer-2 broadcast up the stack.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-29T21:22:48.907" LastActivityDate="2015-11-29T21:22:48.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24838" PostTypeId="2" ParentId="16074" CreationDate="2015-11-29T21:28:45.127" Score="0" Body="&lt;p&gt;it will not exit always when you put the command of access-list then the such as &#xA;(access-list extended) then the implicit rule will exit if there is deny until unless not permit interesting traffic every thing will be deny   &lt;/p&gt;&#xA;" OwnerUserId="21023" LastActivityDate="2015-11-29T21:28:45.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24840" PostTypeId="1" AcceptedAnswerId="24841" CreationDate="2015-11-29T22:37:05.347" Score="1" ViewCount="408" Body="&lt;p&gt;Why is the SFD (Start Frame Delimiter) value 171 (10101011 in binary notation)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it just a constant number?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm just curious...&lt;/p&gt;&#xA;" OwnerUserId="17449" LastEditorUserId="8499" LastEditDate="2015-11-30T03:25:49.430" LastActivityDate="2015-11-30T03:25:49.430" Title="Why is the SFD value 171?" Tags="|ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24841" PostTypeId="2" ParentId="24840" CreationDate="2015-11-29T22:47:07.417" Score="0" Body="&lt;p&gt;The ethernet SFD is is a continuation and ending of the preamble. The preamble, from the original ethernet specification, is a series of alternating bits which aided signal synchronization. The SFD continues the synchronization until the last bit, which is a one instead of zero. This one bit marks the end of synchronization.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-11-29T22:47:07.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24842" PostTypeId="1" AcceptedAnswerId="24843" CreationDate="2015-11-29T23:12:21.787" Score="7" ViewCount="2240" Body="&lt;p&gt;As I know the preamble of an Ethernet packet consists of a 56-bit pattern of alternating 1 and 0 bits. But how exactly it helps the other devices to be synced?&lt;/p&gt;&#xA;" OwnerUserId="17449" LastActivityDate="2015-11-29T23:19:37.643" Title="How does the preamble synchronize other devices receiving clocks?" Tags="|ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24843" PostTypeId="2" ParentId="24842" CreationDate="2015-11-29T23:19:37.643" Score="5" Body="&lt;p&gt;The key for this is the IEEE 802.3 documents which define ethernet. There is an &lt;a href=&quot;https://superuser.com/questions/260965/what-is-ieee-802-3-ethernets-communication-type-synchronous-or-asynchronous&quot;&gt;answer&lt;/a&gt; on &lt;a href=&quot;https://superuser.com/&quot;&gt;Super User&lt;/a&gt; which addresses this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From IEEE 802.3:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;802.3-2008_section1.pdf&#xA;  3.2.1 Preamble field The Preamble field is a 7-octet field that is used to allow the PLS circuitry to reach its steady-state&#xA;  synchronization with the received packet’s timing (see 4.2.5).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;4.2.5 Preamble generation In a LAN implementation, most of the Physical Layer components are allowed to provide valid output some&#xA;  number of bit times after being presented valid input signals. Thus it&#xA;  is necessary for a preamble to be sent before the start of data, to&#xA;  allow the PLS circuitry to reach its steady state. Upon request by&#xA;  TransmitLink- Mgmt to transmit the first bit of a new frame,&#xA;  PhysicalSignalEncap shall first transmit the preamble, a bit sequence&#xA;  used for physical medium stabilization and synchronization, followed&#xA;  by the Start Frame Delimiter. If, while transmitting the preamble or&#xA;  Start Frame Delimiter, the collision detect variable becomes true, any&#xA;  remaining preamble and Start Frame Delimiter bits shall be sent. The&#xA;  preamble pattern is: 10101010 10101010 10101010 10101010 10101010&#xA;  10101010 10101010 The bits are transmitted in order, from left to&#xA;  right. The nature of the pattern is such that, for Manchester&#xA;  encoding, it appears as a periodic waveform on the medium that enables&#xA;  bit synchronization. It should be noted that the preamble ends with a&#xA;  “0.”&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2015-11-29T23:19:37.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24844" PostTypeId="2" ParentId="24835" CreationDate="2015-11-30T07:16:39.930" Score="3" Body="&lt;p&gt;The flow of traffic in each case goes like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take Ron's example of an ARP Request. So the layer 2 destination address is ff:ff:ff:ff:ff:ff which is a broadcast. The layer 3 address however may be 192.168.1.2 which is probably the IP address of the host that you're trying to find the MAC address for. Now this ARP packet is sent out on the network and every host on the network receives it. Each host is going to first receive it, run a CRC on it and if pass, will go on to check the layer 2 address. Now since it's a broadcast, it's going to pass through and then it will check the layer 3 address. Those that do not match, discard the packet. The one that does match then forms a response packet with it's MAC address, sets the layer 3 destination as our original source (say 192.168.1.3) and layer 2 destination as the MAC address of our source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like Ron mentioned, the difference is mainly where it's processed. While MAC addresses are processed in layer 2, IP addresses are looked at only at layer 3. Sometimes, the device might not even look at the IP address and directly discard the packet after checking layer 2 information.&lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2015-11-30T07:16:39.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24845" PostTypeId="1" AcceptedAnswerId="24885" CreationDate="2015-11-30T11:32:59.073" Score="1" ViewCount="1577" Body="&lt;p&gt;thanks for reading.&#xA;So I'm a bit of a newbie when it comes to real network engineering. I've started my ICND1 and we've long talked about connecting routers and switches etc etc etc... I understand all the protocols and how they work, but can you connect a decent layer 2 switch like the c2960s to a home router and have that work?&#xA;I googled quite a bit and everyone kept showing examples of &quot;Quick fix&quot; solutions that involved super easy Layer 2 to Layer 3 on simple Linksys home products.&#xA;I'm trying to learn how to interconnect a router to my switch and this is purely for learning purposes with the switch and IOS. I know how to do it already with ALL Cisco hardware, but is it possible with a simple E900 wireless router if someone were to need a simple lab on a budget?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any feed back or advice.&lt;/p&gt;&#xA;" OwnerUserId="21028" LastActivityDate="2015-12-01T16:04:04.013" Title="Connecting C2960s To router" Tags="|cisco|routing|switch|router|cisco-ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24846" PostTypeId="2" ParentId="24845" CreationDate="2015-11-30T12:17:31.153" Score="2" Body="&lt;p&gt;Yes, you should be able to connect a 2960 (I'm assuming a default configuration) to your router.  The IP address of the LAN interface of your router is the default gateway for all devices plugged into the switch.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="8499" LastEditDate="2015-12-01T16:04:04.013" LastActivityDate="2015-12-01T16:04:04.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24847" PostTypeId="1" AcceptedAnswerId="24849" CreationDate="2015-11-30T12:30:34.273" Score="1" ViewCount="288" Body="&lt;p&gt;i have a HP/3Com 5500-ei PoE-Switch, and i can't get a usefull response from the console. I have tried putty and HyperTerminal with following parameters:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Speed 9600&lt;/li&gt;&#xA;&lt;li&gt;Data Bits 8&lt;/li&gt;&#xA;&lt;li&gt;Stop Bits 1&lt;/li&gt;&#xA;&lt;li&gt;Parity None&lt;/li&gt;&#xA;&lt;li&gt;Flow Control None&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The console displays senseless characters only. Have anybody an advice?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="21030" LastActivityDate="2015-11-30T12:55:27.823" Title="Switch console problem" Tags="|switch|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24849" PostTypeId="2" ParentId="24847" CreationDate="2015-11-30T12:55:27.823" Score="1" Body="&lt;p&gt;I remember having a very similar issue due to baud rate when trying to console into some Big-IP devices. While I was using 9600 their default was 19200. I would start there and see if perhaps different speeds could help.&lt;/p&gt;&#xA;" OwnerUserId="21031" LastActivityDate="2015-11-30T12:55:27.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24850" PostTypeId="1" AcceptedAnswerId="24852" CreationDate="2015-11-30T13:26:14.120" Score="1" ViewCount="10601" Body="&lt;p&gt;i am newbie in networking. While working on the network i have seen that switches and wifi access points do contain the ip addresses. One reason for them to have the ip address is that we can manage them from the network but my question is why do these devices have ip address while they do not need it for their working. Secondly let us suppose that there is no dhcp server configured on the network so we gave the access point an ip address that is not in the same network. Now we will not be able to connect to it on network but it will still perform its functioning  that is, it will broadcast packets to the network. Isn't it logically incorrect. That a device being on the different network is routing or broadcasting data of other network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is edit 1:-&#xA;as i myself answered the first question that they need ip address for management but point is, this is wastage of ip address. In a network when it is divided into several subnetworks sometime each network has 5-6 ip addresses then assigning one ip address to switch is wastage of one address.Should it be omitted&lt;/p&gt;&#xA;" OwnerUserId="21032" LastEditorUserId="8499" LastEditDate="2018-03-07T22:34:17.993" LastActivityDate="2021-04-01T07:48:40.253" Title="Why do switches and access points have ip addresses?" Tags="|switch|switching|access-point|ip-address|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24851" PostTypeId="2" ParentId="24850" CreationDate="2015-11-30T13:39:21.103" Score="0" Body="&lt;p&gt;You are answering the first question yourself. IP addresses are there to be able to manage them. Some layer two devices need IP addresses in some networks or vlan to be able to use different services, such as DHCP-relay or mDNS gateways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand your other question, but as said, if you're using a DHCP-server in another network, the DHCP request needs to be sent to another network. And since the DHCP-client doesn't have a valid IP-address yet, the switch needs an IP-address to use as source-address so it can route the DHCP-packets back and forth from server to client.&lt;/p&gt;&#xA;" OwnerUserId="16630" LastActivityDate="2015-11-30T13:39:21.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24852" PostTypeId="2" ParentId="24850" CreationDate="2015-11-30T13:39:29.113" Score="4" Body="&lt;p&gt;Layer-2 devices like switches an WAPs get IP addresses for management. There are unmanaged switches which don't get, and don't have an option for, IP addresses because they don't need them since they are not managed. Some WAPs (LWAPs) don't get configured with IP address as you normally would, but they get an IP address from DHCP and a configuration from a WLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could give these devices IP addresses not on the same network as the network which they serve. This could be a problem since you may not be able to get to the devices to manage them, or it may be that you have set up a management VLAN with which to get to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IP addresses assigned to these devices are &lt;em&gt;not&lt;/em&gt; wasted addresses. The devices need to be managed. As I wrote above, you could have a separate management VLAN. If you have so few addresses per subnet, you are really doing it wrong. Each subnet will have a bunch of unused addresses. These addresses could be considered wasted, but it is how IP addresses get assigned. There has been a lot of research and math to demonstrate how you can't, and really shouldn't, have a very efficient IP address scheme. This is one of the reasons IPv6 was designed the way it is with over 18 quintillion addresses per subnet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-11-30T13:59:49.513" LastActivityDate="2015-11-30T13:59:49.513" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24853" PostTypeId="2" ParentId="24631" CreationDate="2015-11-30T14:24:17.673" Score="3" Body="&lt;p&gt;Not via ZTP, but I've just put together a couple of Ansible modules for you to handle both of these tasks here: &lt;a href=&quot;https://github.com/dfex/dfex-ansible-modules&quot; rel=&quot;nofollow&quot;&gt;https://github.com/dfex/dfex-ansible-modules&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They're pretty self-explanatory - &lt;code&gt;junos_save_rescue&lt;/code&gt; for saving the rescue configuration, and &lt;code&gt;junos_op_cli&lt;/code&gt; for executing arbitrary Operational mode commands in Junos.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a &lt;code&gt;junos-op-cli&lt;/code&gt; example in the README specifically targeting the removal of the EX3300 default vc-ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Feedback and improvement suggestions welcome.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-11-30T14:24:17.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24856" PostTypeId="2" ParentId="24835" CreationDate="2015-11-30T16:35:22.530" Score="5" Body="&lt;p&gt;The layer 2 broadcast address ff:ff:ff:ff:ff:ff is used on ethernet frames and is supposedly broadcasted on all equipments. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;255.255.255.255 is the layer 3 address that is used to adress the exact same hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IP can support all kind of networks, so ethernet won't be always used. &lt;/li&gt;&#xA;&lt;li&gt;Reciprocally ethernet can be used without IP (appletalk, IPX, ...).&lt;/li&gt;&#xA;&lt;li&gt;One layer 2 media can share several IP networks, but it is really bad practice: broadcast limits should be the same at layer 2 and 3 (for instance if 10.0.0.0/24 and 10.0.1.0/24 are located on the same switch and same vlan: bad idea).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-11-30T16:35:22.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24858" PostTypeId="1" CreationDate="2015-11-30T17:56:06.873" Score="1" ViewCount="184" Body="&lt;p&gt;I would like some clarification on the MTU setting on an interface and the size attribute for ICMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two routers connected directly with an MTU of 1500 set on both sides. There is no dot1q, pppoe or other protocol running across the link, this is a bare bones setup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would have thought this should work.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping x.x.x.x size 1500 donotfrag&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although it fails. It appears it only works at 1487.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I increase the MTU to, for example 1514, I can then ping with df at 1500, but 1501 fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying to connect this to a particular header size, for example an IP header, however minimum this would be 20 bytes, so I guess I am a bit confused as to why is it 14 bytes off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume I am missing something straight forward :)&lt;/p&gt;&#xA;" OwnerUserId="21043" LastActivityDate="2015-11-30T17:56:06.873" Title="Basic Interface MTU Setting" Tags="|mtu|interface|" AnswerCount="0" CommentCount="3" ClosedDate="2019-04-02T22:20:59.157" ContentLicense="CC BY-SA 3.0" />
  <row Id="24861" PostTypeId="1" AcceptedAnswerId="24863" CreationDate="2015-11-30T20:00:41.313" Score="1" ViewCount="3625" Body="&lt;p&gt;I'm focusing currently on the &quot;Unknown Unicast Flooding&quot;, and the proposed solutions from Cisco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really need deep information about:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Cisco Blocking Unknown Unicast Flooding (UUFB)&lt;/li&gt;&#xA;&lt;li&gt;Unknown Unicast Flood Rate-limiting (UUFRL)&lt;/li&gt;&#xA;&lt;li&gt;Port Unicast and Multicast Flood Blocking&lt;/li&gt;&#xA;&lt;li&gt;Unknown Unicast Forwarding (from Juniper)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have already the concept they are used to block/limit unicast flooding attacks, however I'm intrested on how they work, the algorithms behind the process, any specific RFC, mechanisms and approaches !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I search about those concept, but what I found is just how configure them without go deep in their algorithms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yours sincerely,&lt;/p&gt;&#xA;" OwnerUserId="3672" LastEditorUserId="8499" LastEditDate="2018-12-17T03:09:20.530" LastActivityDate="2018-12-17T03:09:35.257" Title="Unknown Unicast Flooding" Tags="|cisco|switch|juniper|security|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24862" PostTypeId="2" ParentId="24861" CreationDate="2015-11-30T20:44:59.967" Score="2" Body="&lt;p&gt;You must first understand where unicast flooding is coming from:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when a router wants to forward a packet to a destination, it must know the next hop port, IP address and MAC address. To know that it will use ARP protocol, that will update internal MAC/IP arp table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To forward some traffic, a switch with listen to it's ingress ports and record source MAC addresses and put it in a MAC/port table. To switch a frame correcly, the switch must find the MAC address in the table. (if I have seen incoming traffic from MAC A on port 1, then MAC A is on port 1, I can remember it for some time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most equipments are both switch and routers those days. In certain case, the switch part can 'forget' the MAC/port relation, whereas the router knows the IP/MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case the packet is broadcasted to the whole VLAN, by the switch part (that would behave like a hub, flooding the frame to each ports but the incoming one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UUFB will prevent the flooding and drop the packet in this case.&#xA;UUFRL will flood but the flood will be rate limited.&#xA;In both case you prevent/limit the flood but lose packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The documentation can be found &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/blocking.html&quot; rel=&quot;nofollow&quot;&gt;online&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest having small networks and reduce ARP timers so that unicast flooding won't occur at all&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/hot-standby-router-protocol-hsrp/10583-62.html#t8&quot; rel=&quot;nofollow&quot;&gt;old documentation but the idea is still the same&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20558" LastEditorUserId="20558" LastEditDate="2015-11-30T23:22:22.570" LastActivityDate="2015-11-30T23:22:22.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24863" PostTypeId="2" ParentId="24861" CreationDate="2015-11-30T21:12:10.990" Score="2" Body="&lt;p&gt;There really isn't a lot to this subject, you can block unknown unicasts or you can rate limit them to a particular percentage of the bandwidth. Juniper does have an interesting third option, but I'm not sure how useful it really is. There are no RFCs, each vendor is able to handle (or not) this subject in a different, possibly proprietary, way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco configuration documents are usually pretty good about explaining how things work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For how Cisco Cisco UUFB and UUMB works: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/7600/ios/12-2SXF/configuration/guide/swcg/blocking.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Unknown Unicast Flood Blocking (UUFB)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;By default, unknown unicast and multicast traffic is flooded to all&#xA;  Layer 2 ports in a VLAN. You can prevent this behavior by using the&#xA;  UUFB and UMFB features to prevent or limit this traffic. The UUFB and&#xA;  UMFB features block unknown unicast and multicast traffic flooding at&#xA;  a specific port, only permitting egress traffic with MAC addresses&#xA;  that are known to exist on the port. The UUFB and UMFB features are&#xA;  supported on all ports that are configured with the switchport&#xA;  command, including private VLAN (PVLAN) ports.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For how Cisco UUFRL works: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/7600/ios/12-1E/configuration/guide/storm.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Traffic-Storm Control&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Traffic storm control (also called traffic suppression) monitors&#xA;  incoming traffic levels over a 1-second traffic storm control interval&#xA;  and, during the interval, compares the traffic level with the traffic&#xA;  storm control level that you configure. The traffic storm control&#xA;  level is a percentage of the total available bandwidth of the port.&#xA;  Each port has a single traffic storm control level that is used for&#xA;  all types of traffic (broadcast, multicast, and unicast).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt; •The router supports multicast and unicast traffic storm control&#xA;  only on Gigabit Ethernet LAN ports.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•The router supports broadcast traffic storm control on all LAN ports.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;•Traffic storm control does not suppress spanning tree packets. Except&#xA;  for spanning tree packets, traffic storm control does not&#xA;  differentiate between control traffic and data traffic.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Traffic storm control monitors the level of each traffic type for&#xA;  which you enable traffic storm control in 1-second traffic storm&#xA;  control intervals. Within an interval, when the ingress traffic for&#xA;  which traffic storm control is enabled reaches the traffic storm&#xA;  control level that is configured on the port, traffic storm control&#xA;  drops the traffic until the traffic storm control interval ends.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Juniper has similar UUFB and UUFRL, but it also has a feature which allows a VLAN to forward all unknown unicast frames to a specific port (trunk), and each VLAN can use a different port in order avoid overloading a particular trunk: &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos13.2/topics/concept/rate-limiting-unknown-unicast-forwarding-understanding.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding Unknown Unicast Forwarding&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To prevent a storm, you can disable the flooding of unknown unicast&#xA;  packets to all VLAN interfaces by configuring one VLAN or all VLANs to&#xA;  forward all unknown unicast traffic to a specific interface. This&#xA;  channels the unknown unicast traffic to a single interface.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-12-17T03:09:35.257" LastActivityDate="2018-12-17T03:09:35.257" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="24864" PostTypeId="2" ParentId="24861" CreationDate="2015-11-30T22:54:03.840" Score="2" Body="&lt;p&gt;Simply put, Unicast Flooding is a the layer-2 process where by traffic with a destination to an unknown location is sent to every port (other than the receiving port.) This is due to the switch's mac-address-table not holding a port for the destination MAC -- it hasn't seen traffic from that MAC, the table is full, &lt;em&gt;or the table is OFF&lt;/em&gt;. (few switches support disabling mac-learning.) Disabling unicast flooding is a very bad idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When talking about Multicast, it's a similar process but based on groups/IGMP snooping/etc. to know what traffic is wanted where. When the switch doesn't know to which ports a group belongs, it can flood it to all ports, or drop it entirely. Which is best for a network depends on the specifics of that network.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-11-30T22:54:03.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24865" PostTypeId="2" ParentId="24813" CreationDate="2015-12-01T00:17:21.467" Score="4" Body="&lt;p&gt;Put every device in a different VLAN: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;device 1: vlan 11,&#xA;device 2: vlan 12,&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Put a different IP network for each device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;device 1: 192.168.1.11/24&#xA;device 2: 192.168.2.11/24&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then put your host in a trunk with all the vlans. Having an interface on your PC to each vlan would do the trick: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int eth0.11: ip address 192.168.1.1/24&#xA;int eth0.12: ip address 192.168.2.1/24&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: I used /24 networks but you can totally use /31 (or /127 in IPv6).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your switch can route, then route with it, or you can plug a router too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be a way by configuring the interfaces as point to point interfaces, but I have never done this (and it would be even more awkward).&lt;/p&gt;&#xA;" OwnerUserId="20558" LastEditorUserId="20558" LastEditDate="2015-12-01T00:22:43.377" LastActivityDate="2015-12-01T00:22:43.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24866" PostTypeId="1" CreationDate="2015-12-01T01:53:48.263" Score="0" ViewCount="3353" Body="&lt;p&gt;Please help me I don't know what is wrong in my configuration. OSPF is not working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tXj5T.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tXj5T.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ROUTER 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g0/0&#xA;ip add 210.1.1.1 255.255.255.224&#xA;no shut&#xA;&#xA;int s0/0/1&#xA;ip add 172.20.0.222 255.255.255.252&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ROUTER 0:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int g0/0&#xA;ip add 172.20.0.129 255.255.255.224&#xA;no shut&#xA;&#xA;int s0/0/1&#xA;ip add 172.20.0.221 255.255.255.252&#xA;no shut&#xA;&#xA;int s0/0/0&#xA;ip add 172.20.0.218 255.255.255.252&#xA;no shut&#xA;&#xA;router ospf 1&#xA;router-id 2.2.2.2&#xA;&#xA;network 172.20.0.128 0.0.0.31 area 0&#xA;network 172.20.0.220 0.0.0.3 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21041" LastEditorUserId="8499" LastEditDate="2017-08-29T03:05:40.750" LastActivityDate="2017-08-29T03:05:40.750" Title="OSPF not showing on show ip route" Tags="|cisco|routing|switch|router|ospf|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24867" PostTypeId="2" ParentId="24866" CreationDate="2015-12-01T01:59:46.463" Score="2" Body="&lt;p&gt;You don't have OSPF configured on both routers. The point of a routing protocol is to share routes with other routers. It does no good to run OSPF on only one router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to configure OSPF on Router 1 like you did on Router 0. If you include all the routes connected to Router 1 in the OSPF configuration for Router 1, Router 0 should be able to see them, and Router 1 should be able to see the routes on Router 0.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-01T02:16:02.747" LastActivityDate="2015-12-01T02:16:02.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24868" PostTypeId="2" ParentId="24834" CreationDate="2015-12-01T03:20:02.580" Score="2" Body="&lt;p&gt;If you've got access to devices like routers and switches, or a host on the same subnet as the mystery device you can easily identify it regardless of whether it has a firewall or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the above mentioned devices you could monitor the VLAN's traffic and therefore identify all of the hosts on it &lt;strong&gt;without&lt;/strong&gt; having to probe any of them with tools like nmap. The reason being that the mystery host would eventually send data and would therefore reveal its MAC &amp;amp; IP address in the process so you now know it exists even though it didn't respond to your earlier probes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further to this, during your monitoring you would be able to keep tabs on what the mystery user is doing by viewing the contents of their network traffic (provided that it's not encrypted). This could then assist you in identifying who the user is. For example, if they use telnet you could get their username (and password, though passwords are best left alone). If the traffic was encrypted, you would still be able to view the destination IP address(es) of the sites they're visiting which you could then look up. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you could also see what protocols they're using by viewing the captured traffic as well (provided that the software you're using to view the capture e.g Wireshark, has a decoder for the protocol(s) used). This shouldn't be a problem unless the mystery user has custom written the protocol.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2015-12-01T23:41:28.503" LastActivityDate="2015-12-01T23:41:28.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24870" PostTypeId="1" CreationDate="2015-12-01T03:46:00.720" Score="2" ViewCount="411" Body="&lt;p&gt;Upgrading an ASA5510 to an ASA5525-X, we want to change from transparent to routed mode so Packet Tracer will work. Also want to undo the change easily and without making our provider change routing at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could we add a router like in the weird-looking config below? The routing is all static. To undo we'd move a few patch cords. Once we trust the new firewall, our provider would make a routing change and we'd remove the temporary extra router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in the temp setup, could we safely route from provider to subnet A to subnet B to subnet A to our internal network (a supernet of A and B)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BEFORE&lt;/strong&gt; [* = interface]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Provider Edge router*1.1.1.1 --old fw-- 1.1.1.2*my router to 1.1.0.0/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;AFTER&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PE*1.1.1.1 --- 1.1.1.2*temp rtr*1.1.2.1 --- 1.1.2.2*new fw*1.1.1.1 --- 1.1.1.2*my router to 1.1.0.0/16&lt;/p&gt;&#xA;" OwnerUserId="3198" LastEditorUserId="3198" LastEditDate="2015-12-01T13:24:20.513" LastActivityDate="2016-04-30T22:31:36.310" Title="Replacing transparent with routed ASA firewall - am i crazy?" Tags="|routing|firewall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24871" PostTypeId="1" AcceptedAnswerId="24872" CreationDate="2015-12-01T05:49:09.870" Score="1" ViewCount="10907" Body="&lt;p&gt;We have Cisco catalyst &lt;code&gt;C3850-48T&lt;/code&gt; L3 switch in stack. and it is showing Active/Standby.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: what does standby mean in stack? Does it means if i plug my laptop on standby switch port it won't work? Can anyone explain what is the advantage of having switch in stack? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show switch&#xA;Switch/Stack Mac Address : 6c99.8962.3990 - Local Mac Address&#xA;Mac persistency wait time: Indefinite&#xA;                                             H/W   Current&#xA;Switch#   Role    Mac Address     Priority Version  State&#xA;------------------------------------------------------------&#xA;*1       Active   6c99.8962.3990     15     M0      Ready&#xA; 2       Standby  1c1d.86a9.3500     1      M0      Ready&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2018-12-22T05:35:31.937" LastActivityDate="2018-12-22T05:35:31.937" Title="C3850 switch active/standby question" Tags="|cisco|switch|ethernet|cisco-catalyst|stacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24872" PostTypeId="2" ParentId="24871" CreationDate="2015-12-01T05:55:11.230" Score="3" Body="&lt;p&gt;The Active switch is the one which is the current master of the stack. Priority 15 is the highest priority, and the highest priority will be the master. If the master fails, the next highest priority will be the master.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A stack of switches acts like a single switch, and one switch is the master for the stack, but all the switches have the configuration, so if one switch fails, the stack lives on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the switches are actually working. The switches appear as if they were boards in a single chassis. The ports are referred to as &lt;code&gt;&amp;lt;switch&amp;gt;/&amp;lt;slot&amp;gt;/&amp;lt;port&amp;gt;&lt;/code&gt;, like &lt;code&gt;GigabitEthernet1/0/1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage of a stack is that you can lose a switch in the stack, and the stack still works. It's just like losing a board in a chassis - you lose those ports, but the chassis still works.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-01T06:08:45.573" LastActivityDate="2015-12-01T06:08:45.573" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24873" PostTypeId="2" ParentId="24866" CreationDate="2015-12-01T07:47:59.910" Score="1" Body="&lt;p&gt;You need to &lt;strong&gt;configure Router1 like you did on Router0.&lt;/strong&gt; Also you can capture packets (ie. Wireshark) to check OSPF hello packets, if routers are sending them then OSPF on that router should be up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: (ROUTER 1)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface g0/0&#xA;ip address 210.1.1.1 255.255.255.224&#xA;no shutdown&#xA;&#xA;interface s0/0/1&#xA;ip address 172.20.0.222 255.255.255.252&#xA;no shutdown&#xA;&#xA;router ospf 1&#xA;router-id 1.1.1.1&#xA;&#xA;network 210.1.1.1 0.0.0.31 area 0&#xA;network 172.20.0.222 0.0.0.3 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20657" LastEditorUserId="20657" LastEditDate="2015-12-01T07:54:00.933" LastActivityDate="2015-12-01T07:54:00.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24874" PostTypeId="1" CreationDate="2015-12-01T09:08:12.947" Score="-1" ViewCount="128" Body="&lt;p&gt;Since then, OSPF protocol uses Dijkstra's Algorithm for generating routing tables and the like. Is it possible to apply ACO and how would you do it? Thanks.&#xA;[Edited; added a comment below]&lt;/p&gt;&#xA;" OwnerUserId="21054" LastEditorUserId="21054" LastEditDate="2015-12-02T11:17:27.190" LastActivityDate="2015-12-02T11:17:27.190" Title="Implementing Ant Colony Optimization on OSPF Protocol" Tags="|routing|" AnswerCount="1" CommentCount="2" ClosedDate="2015-12-01T21:13:14.703" ContentLicense="CC BY-SA 3.0" />
  <row Id="24878" PostTypeId="1" CreationDate="2015-12-01T10:39:03.700" Score="1" ViewCount="1779" Body="&lt;p&gt;What configuration do I need to connect ospf configure router to the other one which has a static route?&lt;/p&gt;&#xA;&lt;p&gt;router 1 config:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;hostname ISP&#xA;int g0/0&#xA;  ip add 210.1.1.1 255.255.255.224&#xA;  no shut&#xA;int s0/0/1&#xA;  ip add 172.20.0.222 255.255.255.252&#xA;  no shut&#xA;ip route 172.20.0.128 255.255.255.224 s0/0/1&#xA;ip route 0.0.0.0 0.0.0.0 s0/0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Router 0 config:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;hostname R2&#xA;int g0/0&#xA;  ip add 172.20.0.129 255.255.255.224&#xA;  no shut&#xA;int s0/0/1&#xA;  ip add 172.20.0.221 255.255.255.252&#xA;  no shut&#xA;int s0/0/0&#xA;  ip add 172.20.0.218 255.255.255.252 &#xA;  no shut&#xA;router ospf 1&#xA;router-id 2.2.2.2&#xA;network 172.20.0.128 0.0.0.31 area 0&#xA;network 172.20.0.220 0.0.0.3 area 0&#xA;passive-interface g0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/M5q51.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M5q51.jpg&quot; alt=&quot;Topology&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21041" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-12-22T05:36:41.567" Title="Router OSPF to Static Route" Tags="|cisco|routing|router|ospf|packet-tracer|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24879" PostTypeId="2" ParentId="24878" CreationDate="2015-12-01T10:55:18.743" Score="2" Body="&lt;p&gt;I don't know if you understand why you need OSPF? You need OSPF on both of the routers and you need to advertise the networks connected to the respective routers for OSPF to work. What you want on Router 1 is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA;router-id 1.1.1.1&#xA;network 172.20.0.222 0.0.0.3 area 0&#xA;network 210.1.1.0 0.0.0.31 area 0&#xA;passive interface g0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see that there's some problems with your ip-addresses, you should correct those or ospf wont work.&lt;/p&gt;&#xA;" OwnerUserId="21058" LastEditorUserId="21058" LastEditDate="2015-12-01T11:28:37.447" LastActivityDate="2015-12-01T11:28:37.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24882" PostTypeId="1" CreationDate="2015-12-01T13:00:18.020" Score="2" ViewCount="14926" Body="&lt;p&gt;I am new to networking. I have some confusions regarding CBR and FTP? Are they any protocols like TCP or UDP or something else? When do we use them?&lt;/p&gt;&#xA;" OwnerUserId="20873" LastActivityDate="2019-01-21T07:23:10.810" Title="Difference between CBR and FTP" Tags="|routing|protocol-theory|network-core|transport-protocol|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24885" PostTypeId="2" ParentId="24845" CreationDate="2015-12-01T14:43:37.333" Score="2" Body="&lt;p&gt;To the switch, the router is a regular computer (be it Cisco or whatever brand). The router or the PC might well support 802.1Q trunking, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About the switch port:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If you want to connect all VLANs on the 2960 through an 802.1Q trunk to the router, it will depend on whether the E900 supports that. If it does, you will need to configure it on both sides.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you just want to connect the 2960 with a single VLAN to the E900, just configure the port as an &quot;access&quot; port set to that VLAN.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;About the physical connection:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If your E900 has switch ports and you connect the switch to one, you &lt;em&gt;may&lt;/em&gt; need to use a crossover cable (or you may not, it depends).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If your E900 has only regular ports, you will use a regular cable.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="755" LastActivityDate="2015-12-01T14:43:37.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24886" PostTypeId="2" ParentId="24820" CreationDate="2015-12-01T14:56:08.880" Score="2" Body="&lt;p&gt;Data packets are not affected. Packets are &lt;em&gt;always&lt;/em&gt; sent from one numeric address to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DNS server is queried for the numeric address of a domain name &lt;em&gt;before&lt;/em&gt; sending a packet. (DNS itself uses network packets for the query, though and those &lt;em&gt;will&lt;/em&gt; be affected).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you change your configured DNS server from A to B and then ping www.google.com, your PC (specifically, the OS) will ask B (instead of A) for the numeric address of www.google.com. Once the OS knows the numeric address it will send data packets to whatever address resulted from the query.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Do they retain DNS server IP in the header? Or my understanding is wrong about packets/DNS?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your understanding of DNS seems to be wrong. There is no DNS field in the IP header.&lt;/p&gt;&#xA;" OwnerUserId="755" LastActivityDate="2015-12-01T14:56:08.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24887" PostTypeId="2" ParentId="24870" CreationDate="2015-12-01T15:15:02.313" Score="2" Body="&lt;p&gt;You can't do it that way, as new_fw will have the same route (1.1.1.0) on both sides of it (always preferring the connected one pointing to my_router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming your ISP is routing you a block of IPs (eg: /29), then I'd connect a switch to PE, and connect old_fw to the switch and keep everything status quo. Then, connect new_fw to the same switch, give it a new IP from your block (eg: 1.1.1.3) on the inside of new_fw, connect a workstation to test with. You can even configure it with the IP block that will eventually be between new_fw and my_rtr, so when you make the switchover and connect my_rtr to new_asa, things'll just work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This allows you to test the new setup, without altering your existing setup (less adding a switch between your networks and the PE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you're done testing, you just need to move my_rtr to the new_fw (and if needed, change the new_asa external IP to that of my_rtr).&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2015-12-01T15:15:02.313" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24888" PostTypeId="2" ParentId="24878" CreationDate="2015-12-01T15:50:10.797" Score="3" Body="&lt;p&gt;You either use static routes all around, which doesn't scale and needs manual intervention when routes change, or you use a dynamic routing protocol, like OSPF, which can adapt to changing conditions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A routing protocol like OSPF must be run on all the routers. Running it on only one router doesn't do anything since it is designed to exchange information with other routers running the same routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router don't need a routing protocol to have a routing table, they need a routing protocol to share routes. That doesn't happen unless they are all running the routing protocol.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-01T15:50:10.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24889" PostTypeId="2" ParentId="24882" CreationDate="2015-12-01T15:59:30.593" Score="3" Body="&lt;p&gt;They are unrelated to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FTP is an application (and protocol) used for file transfer.  It uses TCP for transport, but FTP is considered an application protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CBR is a quality of service term usually used in the context of codecs, describing how they convert analog signals to digital (and vice versa).  It's not a term commonly used in the TCP/IP suite.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-01T15:59:30.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24890" PostTypeId="2" ParentId="24882" CreationDate="2015-12-01T16:01:54.350" Score="2" Body="&lt;p&gt;Constant Bit rate is not a protocol, but a description for an ideal situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FTP is a protocol, but it is above OSI layer-4 (transport layer), and it uses the transport layer to do its work. Questions about protocols above layer-4 are specifically off-topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP and UDP are layer-4 protocols. UDP is a best-effort, fire-and-forget transport protocol. TCP guarantees delivery.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-01T16:01:54.350" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24891" PostTypeId="2" ParentId="24874" CreationDate="2015-12-01T16:34:23.167" Score="6" Body="&lt;p&gt;ACO and SPF (Dijkstra) would seem to be mutually exclusive.  You could in theory create a routing protocol based on ACO, but it would be something other than OSPF.  You could call it Protocol for Incremental Calculation of Networked Inter-node Clusters (PICNIC).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-12-01T17:06:18.083" LastActivityDate="2015-12-01T17:06:18.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24894" PostTypeId="1" CreationDate="2015-12-01T18:23:52.617" Score="1" ViewCount="5123" Body="&lt;p&gt;So I have this problem in trunking that the outside hosts cant ping one another. Here is my configuration please help me and what network should I put in my OSPF?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WSZTB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WSZTB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN Number - Port assignment&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10 - Fa0/4&#xA;20 – Fa0/3, Fa0/1   &#xA;30 - FA0/2  &#xA;60 - VLAN 60    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch 0:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 10&#xA;name Servers&#xA;!&#xA;vlan 20&#xA;name PC1, PC4&#xA;!&#xA;vlan 30&#xA;name Native&#xA;!&#xA;vlan 60&#xA;name Management&#xA;!&#xA;int f0/4&#xA; sw mode access&#xA; sw access vlan 10&#xA;!&#xA;int f0/3&#xA; sw mode access&#xA; sw access vlan 20&#xA;!&#xA;int f0/1&#xA; sw mode access&#xA; sw access vlan 20&#xA;!&#xA;int f0/2&#xA; sw mode access&#xA; sw access vlan 30&#xA;!&#xA;int vlan 60&#xA; ip add 172.20.0.209 255.255.255.248&#xA; no shut&#xA;!&#xA;ip default-gateway 172.20.0.1&#xA;!&#xA;int f0/2&#xA; sw mode trunk&#xA; sw trunk allowed vlan 10,20,30,60&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21041" LastEditorUserId="8499" LastEditDate="2015-12-01T18:26:36.770" LastActivityDate="2015-12-03T18:08:51.953" Title="VLAN, Trunk and OSPF" Tags="|cisco|switch|vlan|ospf|trunk|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24895" PostTypeId="1" AcceptedAnswerId="24897" CreationDate="2015-12-01T21:40:07.483" Score="2" ViewCount="146" Body="&lt;p&gt;PC 1 is on VLAN 10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC 2 is on VLAN 20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 1 is on VLAN 30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Between SW and Router2 is trunk which allow vlans 10-30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping between PC1 and PC2, but I can't ping from Router 1 any PC. Should I add additional routing ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simpler version ( still not work )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a topology like this :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4naWU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4naWU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my configuration :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fa0/1&#xA;sw mode access &#xA;sw access vlan 10&#xA;&#xA;int fa0/2&#xA;sw mode access&#xA;sw access vlan 20&#xA;&#xA;int fa0/3&#xA;sw mode trunk&#xA;sw trunk allowed vlan 10-20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router R_1 configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fa0/0.10&#xA;encapsulation dot1q&#xA;ip address 10.0.10.1 255.255.255.0&#xA;&#xA;int fa0/0.20&#xA;encapsulation dot1q&#xA;ip address 10.0.20.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configuration on PC&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip : 10.0.10.100/24  default gateway : 10.0.10.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configuration on Router R_2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fa0/0&#xA;ip address 10.0.20.100 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Route configurations of R_2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/24 is subnetted, 2 subnets&#xA;C       10.0.10.0 is directly connected, FastEthernet0/0.10&#xA;C       10.0.20.0 is directly connected, FastEthernet0/0.20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After show run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 719 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/0.10&#xA; encapsulation dot1Q 10&#xA; ip address 10.0.10.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0.20&#xA; encapsulation dot1Q 20&#xA; ip address 10.0.20.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Route configuration of R_2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is 10.0.20.1 to network 0.0.0.0&#xA;&#xA;     10.0.0.0/24 is subnetted, 1 subnets&#xA;C       10.0.20.0 is directly connected, FastEthernet0/0&#xA;S*   0.0.0.0/0 [1/0] via 10.0.20.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after show run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 596 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.0.20.100 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 10.0.20.1 &#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21069" LastEditorUserId="8499" LastEditDate="2018-12-22T05:38:11.813" LastActivityDate="2018-12-22T05:38:11.813" Title="Router and VLANS" Tags="|cisco|switch|router|vlan|packet-tracer|" AnswerCount="1" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="24896" PostTypeId="1" CreationDate="2015-12-01T23:41:57.260" Score="2" ViewCount="364" Body="&lt;p&gt;As a bit of background, around 2002 there were some &lt;a href=&quot;http://www.cablinginstall.com/articles/print/volume-10/issue-8/contents/standards/the-case-for-category-6-as-a-gigabit-ethernet-infrastructure.html&quot; rel=&quot;nofollow&quot;&gt;articles&lt;/a&gt; predicting the success of then newly announced 1000BASE-T&lt;strong&gt;X&lt;/strong&gt; (TIA‐854), as inevitably enjoying much more commercial success than 1000BASE-T (IEEE 802.3ab). These predictions were &lt;a href=&quot;http://www.ecmag.com/section/category-6-gigabit-ethernet-standard-approved&quot; rel=&quot;nofollow&quot;&gt;partly based&lt;/a&gt; on betting that history was going to repeat itself, since 100BASE-T4 didn't see much adoption relative to the much more successful 100BASE-TX. The former used four Cat3 twisted pairs, whereas the latter used only two pairs of a Cat5 cable, thus reducing the number of transmitter and receivers needed. (The latter also supported full duplex so it had another advantage/bonus.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But today hardly anyone remembers 1000BASE-TX, which still used all four pairs, but only uses a given wire unidirectionally, so theoretically cuts in half the number of transmitters and receivers relative to 1000BASE-T. (Full duplex operation remains the same as far the user is concerned, unlike in the 100BASE-T4 vs 100BASE-TX case.) 1000BASE-TX requires Cat 6 cable though, whereas 1000BASE-T needed Cat5e.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find any evidence of actual products that supported 1000BASE-TX, though. So, did any such commercial products even exist or was this 1000BASE-TX entirely a &quot;paper launch&quot;? According to &lt;a href=&quot;http://www.tlu.ee/~matsak/telecom/cabling/eu_generic_cabling/811_gigabit_ethernet_in_twisted_pair_cabling.html&quot; rel=&quot;nofollow&quot;&gt;this page&lt;/a&gt; some products existed, but no concrete example is given. Which companies backed 1000BASE-TX back then? And what did they release in marketplace?&lt;/p&gt;&#xA;" OwnerUserId="17626" LastEditorUserId="8499" LastEditDate="2018-03-20T23:41:00.113" LastActivityDate="2018-03-20T23:41:00.113" Title="Were any 1000BASE-TX commercial products released?" Tags="|ethernet|layer1|utp|standardisation|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="24897" PostTypeId="2" ParentId="24895" CreationDate="2015-12-02T00:19:07.883" Score="1" Body="&lt;p&gt;I think the part you are missing is that one VLAN cannot talk to another VLAN without having a router between the two VLANs; it's like they are separate cables on separate interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch is a layer-2 device which knows nothing about layer-3 addresses. It can't bridge traffic between VLANs, which is the point of VLANs. The switch will only send traffic from a port on one VLAN to ports or trunks with the same VLAN. It simply cannot take traffic from R_2 on VLAN 20 and send it to the PC on VLAN 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logically, R_2 connects to R_1 on one interface, and the PC connects to R_1 on a different interface. The PC has an implicit default route to its gateway (R_1). R_2 doesn't have an implicit default route so it only knows about the directly connected routes (VLAN 20) and any static routes or routes learned via a routing protocol, but you aren't running a routing protocol. That's why you had to configure a static route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static routes, like what you configured on R_2 simply do not scale and are not flexible or dynamic. The real way to do this is to run a common routing protocol on both routers so that R_2 automatically receives a route to VLAN 10 from R_1.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-02T00:19:07.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24900" PostTypeId="2" ParentId="24780" CreationDate="2015-12-02T07:30:43.160" Score="1" Body="&lt;p&gt;I was in contact with ubiquiti support and got this response:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unfortunately, it isn't possible  to configure the remote access VPN (L2TP/IPSEC) on Edgerouter to work when the client is not behind NAT.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="20964" LastActivityDate="2015-12-02T07:30:43.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24901" PostTypeId="2" ParentId="16741" CreationDate="2015-12-02T07:41:53.847" Score="2" Body="&lt;p&gt;IEEE  802.3af POE has two modes, mode A sends power on the &quot;data pairs&quot; while mode B sends power on the &quot;spare pairs&quot;. However that is not very relevant as it doesn't sound like you are planning to use that. It sounds more like you are planning a &quot;Ghetto POE&quot; type setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wouldn't worry too much about mixing POTs and Ethernet on the same cable, especially if the POTs link is only local. I also wouldn't worry about CAT5 vs CAT5E on a link this short.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bigger problem would be current on the DC power lines. 35W at 12V is nearly 3A. Apparently the safe current limit on the conductors is 350ma so if you used one conductor for power and one for ground you would be running nearly 8 times the acceptable current on each conductor. Even if you used the whole cable for power and ground you would still be running at over double the acceptable current.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-12-02T07:41:53.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24902" PostTypeId="1" AcceptedAnswerId="25011" CreationDate="2015-12-02T08:13:06.953" Score="0" ViewCount="161" Body="&lt;p&gt;I'm trying to apply an auto-attendant on a CUC, where the voice message will be just played for one time and stops, and if the caller didn't dial anything the call would hangup after 10 sec.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that you can hangup it after one time playing directly but I'm interested in setting a time after this voice message plays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to do something like that?&lt;/p&gt;&#xA;" OwnerUserId="21075" LastEditorUserId="8499" LastEditDate="2015-12-02T10:42:11.410" LastActivityDate="2015-12-06T08:15:05.890" Title="Auto-Attendant on Cisco CUC" Tags="|cisco|voip|voice|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24903" PostTypeId="2" ParentId="2078" CreationDate="2015-12-02T08:13:21.647" Score="9" Body="&lt;p&gt;The Wikipedia answer Teun posted is correct but is pretty dense and hard to follow for someone who is not up on EE terminology. Here is my attempt at a less jargon heavy version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Signals are transmitted as a voltage difference between the two wires in a pair while power is transmitted as a voltage difference between two pairs. Ethernet is transformer coupled so the transmit and receive electronics only see (in principle, nothing is perfect) the voltage between the two wires of a pair. The power connections are taken from a center tap on the transformers so they only see the voltage between the two pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The large difference in frequency also helps keep the signal and power from interfering with each other but it's not the primary separation mechanism (unlike with POTS).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-12-02T08:13:21.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24904" PostTypeId="1" CreationDate="2015-12-02T08:34:54.083" Score="1" ViewCount="453" Body="&lt;p&gt;A client: 3 sites with L2 links to our Data Centre. I create L3 links by providing IP's both sides. I want to create a GRE tunnel over each link with seperate IPs in order to route Data over these new links and splitting Voice this way using the overhead. The idea is to have a 30m line with a 27m GRE for the Data component and the Voice will be routed over the normal L3 link, therefore always able to have the additional 3m bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can this work?&lt;/p&gt;&#xA;" OwnerUserId="1985" LastEditorUserId="8499" LastEditDate="2021-07-12T00:04:11.980" LastActivityDate="2021-07-12T00:04:11.980" Title="Splitting Data and Voice by creating GRE tunnel for Data, using overhead for Voice" Tags="|qos|voip|gre|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24905" PostTypeId="2" ParentId="24894" CreationDate="2015-12-02T08:37:14.917" Score="4" Body="&lt;p&gt;you really should start reading a bit more about what you're doing. A VLAN is a broadcast domain, so computers on separate VLANs are unable to communicate without the intervention of a routing device. Any device that supports Layer 3 routing, such as a router or a multilayer switch, can be used to perform the necessary routing functionality. Regardless of the device used, the process of forwarding network traffic from one VLAN to another VLAN using routing is known as inter-VLAN routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will show you an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jDA58.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jDA58.png&quot; alt=&quot;Inter-Vlan Router on a stick&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This called a Router-on-a-Stick, if you ping from PC1 to PC2 it goes through the router. You need to configure the VLANs on the subinterfaces on the router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0.10&#xA; encapsulation dot1Q 10&#xA; ip address 172.20.0.1 255.255.255.128&#xA;!&#xA;interface GigabitEthernet0/0.20&#xA; encapsulation dot1Q 20&#xA; ip address 192.168.0.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is my subinterface configuration on the router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the router-on-a-stick option, appropriate IP addressing and VLAN information must be configured on each logical subinterface and a trunk encapsulation must be configured to match that of the trunking interface of the switch.&lt;/p&gt;&#xA;" OwnerUserId="21058" LastActivityDate="2015-12-02T08:37:14.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24907" PostTypeId="2" ParentId="24896" CreationDate="2015-12-02T09:41:49.337" Score="2" Body="&lt;p&gt;It wasn't a &quot;paper launch&quot;. Some vendors adopted both standards, for example Cabletron (Now Siemens) and Nortel (now dissapeared) offered at that time network cards for their modular switches with 1000 BASE TX interfaces. (&lt;a href=&quot;http://www.productsandservices.bt.com/btbusiness/btbusinessProducts/pdfs/technical_specifications/BS380-24F.pdf&quot; rel=&quot;nofollow&quot;&gt;Nortel Baystack 380&lt;/a&gt; and &lt;a href=&quot;http://www.ebay.com/itm/Cabletron-Enterasys-Router-Control-1000BASE-TX-SSR-GTX32-04-/331612042923&quot; rel=&quot;nofollow&quot;&gt;SSR-GTX32-04&lt;/a&gt; for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main problem for this standard was that was cheaper and easier to change network cards than changing the cabling of a building or campus.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-12-02T09:41:49.337" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24908" PostTypeId="2" ParentId="24803" CreationDate="2015-12-02T10:07:10.497" Score="6" Body="&lt;p&gt;IP is a &lt;strong&gt;layer 3&lt;/strong&gt; protocol. It &lt;em&gt;doesn't know anything about the physical media&lt;/em&gt;, it means that IP can travel through &lt;em&gt;any media&lt;/em&gt; (for example: fiber optic, copper cable, air, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP relies on a layer below (&lt;strong&gt;layer 2&lt;/strong&gt;) that manages the access to the media. In the case of ethernet each device is connected to a common media (copper cable) and then the device has to identify itself to let know the others it is there, and that identification is the MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each device has a MAC address that is used by the layer 2 protocol to access the common copper cable and move &lt;em&gt;frames&lt;/em&gt; from one device to the other. It seems to be enough to have communication, however layer 2 protocols doesn't scale well if you have hundreds of devices. Then it is needed a layer 3 protocol as IP.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2015-12-03T08:55:29.093" LastActivityDate="2015-12-03T08:55:29.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24909" PostTypeId="2" ParentId="16197" CreationDate="2015-12-02T11:03:33.717" Score="2" Body="&lt;p&gt;The reason you struggle to find a straight answer is because it depends on multiple factors including&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The exact type of fiber, &quot;single mode&quot; and &quot;multi mode&quot; are wide categories within which there are many different types of fiber.&lt;/li&gt;&#xA;&lt;li&gt;The data rate you require. For multimode fiber higher data rates mean shorter distances. There is a handy table at &lt;a href=&quot;https://en.wikipedia.org/wiki/Multi-mode_optical_fiber#Comparison&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Multi-mode_optical_fiber#Comparison&lt;/a&gt; though note that the table doesn't cover 10GBASE-LRM or 10Gbaase-Lx4.&lt;/li&gt;&#xA;&lt;li&gt;What transceivers you use, by spending more on the transceivers and/or using matched pairs from a single manufacturer you can often get more distance on the same fiber.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Assuming you want to run gigabit or 10 gigabit speeds, multimode tends to reach it's limit at a few hundred meters. Exactly what &quot;few&quot; means depends on the precise type of fiber you have and whether you want to run gigabit or 10 gigabit. Getting those distances at 10 gigabit over old fiber will require more expensive LX4 or LRM transcivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Singlemode can go much further. As I understand it 100km is about the limit for a single segment without intermediate amplifiaction.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2015-12-03T19:53:58.643" LastActivityDate="2015-12-03T19:53:58.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24910" PostTypeId="2" ParentId="24904" CreationDate="2015-12-02T11:04:56.963" Score="2" Body="&lt;p&gt;First, if the three sites connect to the data center over WAN circuits with any appreciable latency, layer-2 connections are not a very good idea. Layer-2 must send all the broadcasts across the layer-2 links, and this can degrade performance and eat up expensive WAN bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sending the VoIP over the layer-2 link will force it to compete with the broadcast and link-local traffic inherent in a layer-2 connection, so you may not always have 3 Mb for VoIP as you envision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The proper way to separate classes of traffic and guarantee bandwidth is with QoS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are going to need a router on each end of the link if you use GRE. In that case, you should use layer-3 links. Doing this will allow you to use QoS to mark priority traffic and guarantee bandwidth for VoIP. You could also have a lower-priority class of traffic for things like backups and replication which would normally hog bandwidth, starving more immediate, normal user traffic. When the higher-priority classes are not using their bandwidth, the lower-priority class(es) can use that bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-02T11:04:56.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24912" PostTypeId="1" CreationDate="2015-12-02T15:38:10.857" Score="2" ViewCount="557" Body="&lt;p&gt;In my company there are 3 switches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x.x.x.8&#xA;x.x.x.9&#xA;x.x.x.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I monitor them on Netsight, sometimes with nmap, and of course pinging.&#xA;They are visible on Netsight and reachable by ping. I can log onto them by nmap. Nmap is showing only the last of them(10). Config is exactly the same and they are in stack so physically they are connected like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8--&amp;gt;9--&amp;gt;10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And 8 is connected to the router. I'm pinging from the remote server connected to the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could go wrong and why? &lt;code&gt;nmap -sP x.x.x.*&lt;/code&gt; is showing only the last host?&lt;/p&gt;&#xA;" OwnerUserId="17499" LastEditorUserId="8499" LastEditDate="2016-03-01T19:17:43.773" LastActivityDate="2018-11-17T12:01:35.277" Title="Nmap doesn't see every reachable host" Tags="|monitoring|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24913" PostTypeId="2" ParentId="24912" CreationDate="2015-12-02T16:43:31.823" Score="1" Body="&lt;p&gt;You may have one file called &lt;em&gt;x.x.x.10&lt;/em&gt; on your current directory. Then bash will interpret the command as: &lt;strong&gt;nmap -sP x.x.x.10&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest you scan this way: &lt;strong&gt;nmap -sP x.x.x.0/24&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-12-02T16:43:31.823" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24914" PostTypeId="2" ParentId="23060" CreationDate="2015-12-02T17:28:51.917" Score="3" Body="&lt;p&gt;Well, I see your question as &quot;What is a collision domain&quot;. In simple terms, a collision domain, like the name suggests, is an area where collision can occur. Think of it as a narrow tunnel where space for only one car to pass through exists. If two cars pass through, they collide. Hence, the tunnel is known as a collision domain. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, let's take this to networks. Like the other answers here, before, these devices called hubs were used to connect various hosts. The hub was also a dumb device, in the sense that whatever data it received from one port, it would simply copy to all the other ports. Anyway, the problem with hubs was that it had only 1 collision domain. What do I mean by that? It meant that if I connected 5 hosts to the hub, it would only allow space (like our tunnel example) for just one system to transfer data at a time. If one host is transmitting data, and another host tried to transmit data, a collision would occur, or the two cars would collide and go boom! So when you talk about a collision domain, we think of a shared medium wherein collisions can occur. Of course, lot of prevention mechanisms came out like switches and CSMA/CD, etc. etc, you can read about those in the other replies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jMctN.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jMctN.jpg&quot; alt=&quot;Collision Domains - Hub&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image above shows that two hosts on either side of the hub tries to send data at the same time and since there is only one collision domain, only one is allowed to send. Two = boom (as shown in the image).&lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2015-12-02T17:28:51.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24915" PostTypeId="1" CreationDate="2015-12-02T18:47:17.450" Score="1" ViewCount="26" Body="&lt;p&gt;I have 4 VWIC2-2MFT-T1/E1 installed on a C2921 router running Version 15.3(3)M2, everytime I enter the framing esf and linecode b8zs, the router accepts the commands but the controller remains with the following configs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;controller T1 0/0/0&#xA; cablelength long 0db&#xA; channel-group 1 timeslots 1-24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2015-12-02T18:55:05.430" Title="Can't Configure ESF or linecode on C2921/k9" Tags="|cisco|router|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24916" PostTypeId="1" AcceptedAnswerId="24920" CreationDate="2015-12-02T18:52:22.227" Score="2" ViewCount="206" Body="&lt;p&gt;Reading this quote,&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The 802.1Q standard defines one unique Spanning Tree instance to be used by all VLANs in the network.&lt;/p&gt;&#xA;&lt;p&gt;STP runs on the Native VLAN so that it can communicate with both 802.1Q and non-802.1Q compatible switches.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This questions is based on 802.1D standard, How would be the behavior between two switches with ISL encapsulation, once which ISL doesn't support Native VLAN?&lt;/p&gt;&#xA;&lt;p&gt;Beside, using ISL instead of 802.1Q, that won't disrespect the first statement?&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-12-12T05:02:31.403" Title="Behavior about 802.1D with ISL" Tags="|cisco|switch|vlan|spanning-tree|trunk|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24917" PostTypeId="2" ParentId="24915" CreationDate="2015-12-02T18:52:50.180" Score="1" Body="&lt;p&gt;That is because those are the default values. You will find that when doing &lt;code&gt;show run&lt;/code&gt; on Cisco devices, the default values will not show up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example of this is to set the time zone to UTC 0. That is the default time zone, and it will not show in the  &lt;code&gt;show run&lt;/code&gt; configuration. If you set the time zone to anything else it will be in the configuration that you see.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-02T18:55:05.430" LastActivityDate="2015-12-02T18:55:05.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24920" PostTypeId="2" ParentId="24916" CreationDate="2015-12-02T20:55:18.783" Score="2" Body="&lt;p&gt;The first statement deals with 802.1Q, not ISL which is a different protocol, so the first statement has no relationship to ISL. Two switches connected with ISL will not have a Native VLAN because they don't use 802.1Q.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.1Q has the concept of a native (untagged VLAN) because it inserts a VLAN tag inside the layer-2 frame for tagged VLANs, but just leaves the layer-2 frame alone for untagged (native) VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISL encapsulates a layer-2 frame inside an ISL frame for all VLANs, so there is not an untagged (native) VLAN. Each VLAN uses ISL frame encapsulation and runs a separate STP (802.1d) instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe you are confusing 802.1Q (tagging) with 802.1d (STP)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://cciethebeginning.wordpress.com/2008/10/15/differences-between-pvst-and-pvst/&quot; rel=&quot;nofollow&quot;&gt;This link&lt;/a&gt; has a chart comparing 802.1Q, PVST, and PVST+ which may help clarify this for you.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-02T21:03:40.937" LastActivityDate="2015-12-02T21:03:40.937" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="24921" PostTypeId="2" ParentId="16741" CreationDate="2015-12-02T23:32:33.647" Score="2" Body="&lt;p&gt;I just wanted to add a quick note to answer one of your last remaining questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Standard Fast Ethernet (100BASE-TX) calls to use Pair 2 and 3, which correlate to pins 1&amp;amp;2 and pins 3&amp;amp;6, respectively (the yellow and green wires, + their white stripped counterparts). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pair 1 and 4 are unused (the blue and brown wires, + their white counter part).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pair 1 was specifically skipped in the Ethernet world because the RJ11 (standard phone cable) used it for the phone line.  &lt;a href=&quot;https://serverfault.com/a/449430/275179&quot;&gt;More details here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-12-02T23:32:33.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24922" PostTypeId="2" ParentId="22200" CreationDate="2015-12-03T00:32:18.147" Score="0" Body="&lt;p&gt;To interface between different speeds requires a device that can accept complete frames into a buffer and retransmit them at the changed speed. That pretty much means a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Custom designing a switch in the form factor you want will not be a cheap option. EEs at the skill level to successfully build a reliable gigabit Ethernet implementation don't come cheap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think your best option is probably to change to a different wireless access point. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-12-03T00:32:18.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24924" PostTypeId="2" ParentId="20761" CreationDate="2015-12-03T01:02:27.710" Score="1" Body="&lt;p&gt;As I understand it the term &quot;telecom&quot; (a shortened version of &quot;telecommunications&quot;) is usually used to refer to the phone network, the companies that ran it and the technologies that grew out of it. Building computer networks was/is a separate specialism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is interesting is in recent years there has been an inversion. It used to be that computer networks were built on top of services provided by the phone network. Nowadays phones are being run over systems designed for computer networking.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-12-03T01:02:27.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24925" PostTypeId="1" AcceptedAnswerId="24926" CreationDate="2015-12-03T01:05:39.317" Score="2" ViewCount="6870" Body="&lt;p&gt;Trying to access a network via a static route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My PC is on Windows 10 and I am connecting to a remote network via VPN.&#xA;My local network is 192.168.178.1/24. &#xA;My PC's VPN client address is 10.35.0.144.&#xA;The VPN gateway is 10.35.0.129.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Via the VPN I have access to a 10.1.0.0/24 network, where a router, IP: 10.1.1.175, enables access to another 10.124.193.0/24 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to be able to manage devices on this 10.124.193.0/24 network. I added a static route: &quot;route add 10.124.194.0 mask 255.255.255.0 10.1.1.175&quot;, which I thought might do the trick. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I do a tracert to 10.124.193.x, I see that traffic is not going through the VPN as expected, but hits my local gateway (192.168.178.1) and stops there. I expected a couple of hops like: 10.35.0.129, then 10.1.1.175, then 10.124.193.x. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output of the route table below is partly in German, I hope that is ok, and still comprehensible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C:\WINDOWS\system32&gt;tracert 10.124.193.6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;tracing route to 10.124.193.6 over a maximum of 30 Hops&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1     2 ms     1 ms     1 ms  fritz.box [192.168.178.1]&lt;br&gt;&#xA;  2  fritz.box [192.168.178.1]  reports: destination host unreachable&#xA;&lt;a href=&quot;https://i.stack.imgur.com/eLg8N.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eLg8N.png&quot; alt=&quot;route print&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21092" LastEditorUserId="21092" LastEditDate="2015-12-03T12:57:42.233" LastActivityDate="2018-02-10T18:55:46.573" Title="Static Route to Subnet via VPN" Tags="|routing|vpn|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24926" PostTypeId="2" ParentId="24925" CreationDate="2015-12-03T01:16:03.223" Score="1" Body="&lt;p&gt;When you set a route, you need to give it the next hop. In your case, the next hop is &lt;code&gt;10.35.0.129&lt;/code&gt;, but your configured next hop is not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, you are trusting that the next hop has a route to then next hop in the path toward your destination. If not, you need to modify that router to have a route toward your destination. If you don't have access to that router, this question is off-topic since you need to have control over the network about which you are asking questions.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-03T01:16:03.223" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24928" PostTypeId="2" ParentId="24904" CreationDate="2015-12-03T09:50:11.453" Score="3" Body="&lt;p&gt;Do not create GRE tunnels - this will appear to your L3 network as two distinct paths to the same site, meaning you'll end up with extra routing complexity you don't need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GRE will also add overhead to your payload, and reduce your link MTU which you do not want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On top of all this, GRE does nothing to solve the guaranteed bandwidth issue, for which you will need to use QoS anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep it simple&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-12-03T09:50:11.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24929" PostTypeId="1" CreationDate="2015-12-03T11:44:20.903" Score="1" ViewCount="49" Body="&lt;p&gt;I have recently found the broadcasting in a network which is running on static IP's. If I enable DHCP will the broadcasting stops?&#xA;Which is the best way to prevent broadcasting?&lt;/p&gt;&#xA;" OwnerUserId="21104" LastActivityDate="2015-12-04T10:43:54.393" Title="Does enabling dhcp stops broadcasting within the network (currently on static)?" Tags="|routing|dhcp|multicast|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24930" PostTypeId="1" CreationDate="2015-12-03T12:26:40.867" Score="1" ViewCount="499" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TdjHV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TdjHV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following network which splits a site into a Corp/DMz style network as best I can with the limitations of the ASA in packer tracer. Both routers have static routes to the 10.100.0.0 and 172.16.0.0 networks pointing at the corresponding ASA interfaces and a classless route out the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both ASAs have two static routes. One for the inside network it covers and a classless route to its respective router (ASA1 to R1 and ASA2 to R2). From a machine inside the 10.100.0.0 network I can ping the inside R1 interface at 10.50.6.241. From R1 I can ping the router interface at 200.195.100.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I try and ping 200.195.100.2 from a machine inside the 10.100.0.0 network (or ASA1) the packet hits ASA1 and is bounced between the inside 10.50.6.249/30 interface on ASA1 and the outside 10.50.6.244/29 interface on ASA2 inside of ASA1 sending it to R1 as defined by its default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configured ASA1 routes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route inside 10.100.0.0 255.255.0.0 10.50.6.250 1  &#xA;route outside 0.0.0.0 0.0.0.0 10.50.6.241 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ARP output from ASA1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UK-Corp-EP-ASA1#show arp&#xA;        outside 10.50.6.241 000A.4146.0501&#xA;        outside 10.50.6.242 0030.F2A0.5101&#xA;        outside 10.50.6.243 0003.E4BC.38D8&#xA;        inside 10.50.6.249 0003.E4BC.38D8&#xA;        inside 10.50.6.250 00D0.BA60.B218&#xA;        inside 10.100.10.2 00D0.BA60.B218&#xA;        inside 10.100.10.3 00D0.BA60.B218&#xA;        outside 172.16.30.4 0002.1612.88E8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Could anyone suggest why this might occur?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an interesting note. After reopening the file and running and tracert from the PC I get the following result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC&amp;gt;tracert 200.195.100.2&#xA;&#xA;Tracing route to 200.195.100.2 over a maximum of 30 hops: &#xA;&#xA;  1   0 ms      0 ms      0 ms      10.100.10.1&#xA;  2   0 ms      0 ms      0 ms      10.50.6.249&#xA;  3   *         0 ms      1 ms      10.50.6.242&#xA;  4   37 ms     1 ms      1 ms      200.195.100.6&#xA;  5   *         *         *         Request timed out.&#xA;  6   *         *         *         Request timed out.&#xA;  7   *         *         *         Request timed out.&#xA;  8   *         *         *         Request timed out.&#xA;  9   *         *         *         Request timed out.&#xA;  10  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As requested:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 interfaces (others are shutdown and not in use)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 10.50.6.241 255.255.255.248&#xA; ip nat inside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 200.195.100.1 255.255.255.252&#xA; ip nat outside&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2 Interfaces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 10.50.6.242 255.255.255.248&#xA; ip nat inside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 200.195.100.5 255.255.255.252&#xA; ip nat outside&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch Config:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 - fa0/24&lt;br&gt;&#xA;R2 - fa0/23&lt;br&gt;&#xA;ASA1 - fa0/1&lt;br&gt;&#xA;ASA2 - fa0/2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;UK-EP-Distro-SW1#show int trunk&#xA;Port        Mode         Encapsulation  Status        Native vlan&#xA;Fa0/1       on           802.1q         trunking      80&#xA;Fa0/2       on           802.1q         trunking      80&#xA;Fa0/23      on           802.1q         trunking      80&#xA;Fa0/24      on           802.1q         trunking      80&#xA;&#xA;Port        Vlans allowed on trunk&#xA;Fa0/1       6,10,20,30,80,150&#xA;Fa0/2       6,10,20,30,80,150&#xA;Fa0/23      6,10,20,30,80,150&#xA;Fa0/24      6,10,20,30,80,150&#xA;&#xA;Port        Vlans allowed and active in management domain&#xA;Fa0/1       6,10,20,30,80,150&#xA;Fa0/2       6,10,20,30,80,150&#xA;Fa0/23      6,10,20,30,80,150&#xA;Fa0/24      6,10,20,30,80,150&#xA;&#xA;Port        Vlans in spanning tree forwarding state and not pruned&#xA;Fa0/1       6,10,20,30,80,150&#xA;Fa0/2       6,10,20,30,80,150&#xA;Fa0/23      6,10,20,30,80,150&#xA;Fa0/24      6,10,20,30,80,150&#xA;&#xA;UK-EP-Distro-SW1# show vlan brief&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                          active    &#xA;5    Default                          active    Fa0/3, Fa0/4, Fa0/5, Fa0/6&#xA;                                                Fa0/7, Fa0/8, Fa0/9, Fa0/10&#xA;                                                Fa0/11, Fa0/12, Fa0/13, Fa0/14&#xA;                                                Fa0/15, Fa0/16, Fa0/17, Fa0/18&#xA;                                                Fa0/19, Fa0/20, Fa0/21, Fa0/22&#xA;                                                Gig0/1, Gig0/2&#xA;6    Routing                          active    &#xA;10   UK-Corp-PC                       active    &#xA;20   UK-Corp-Server                   active    &#xA;30   UK-DMz-Server                    active    &#xA;80   Native                           active    &#xA;150  VoIP                             active    &#xA;1002 fddi-default                     active    &#xA;1003 token-ring-default               active    &#xA;1004 fddinet-default                  active    &#xA;1005 trnet-default                    active   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I ping 200.195.100.6 from 10.100.0.0 it will get a reply as ASA1 will send the packet out of R2 (again, not it's default route).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have considered the possibility of it being a bug in PT. Not a lot I can do about that :( &lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is 200.195.100.2 to network 0.0.0.0&#xA;&#xA;     10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;C       10.50.6.240/29 is directly connected, FastEthernet0/0&#xA;S       10.100.0.0/16 [1/0] via 10.50.6.243&#xA;S    172.16.0.0/16 [1/0] via 10.50.6.244&#xA;     200.195.100.0/30 is subnetted, 1 subnets&#xA;C       200.195.100.0 is directly connected, Serial0/0/0&#xA;S*   0.0.0.0/0 [1/0] via 200.195.100.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ping from PC 10.100.10.2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC&amp;gt;tracert 200.195.100.2&#xA;&#xA;Tracing route to 200.195.100.2 over a maximum of 30 hops: &#xA;&#xA;  1   1 ms      1 ms      1 ms      10.100.10.1&#xA;  2   *         0 ms      0 ms      10.50.6.249&#xA;  3   *         *         0 ms      10.50.6.244&#xA;  4   *         11 ms     11 ms     10.50.6.249&#xA;  5   11 ms     10 ms     10 ms     10.50.6.244&#xA;  6   1 ms      12 ms     12 ms     10.50.6.249&#xA;  7   25 ms     11 ms     26 ms     10.50.6.244&#xA;  8   13 ms     12 ms     12 ms     10.50.6.249&#xA;  9   23 ms     22 ms     24 ms     10.50.6.244&#xA;  10   19 ms     21 ms     26 ms     10.50.6.249&#xA;  11   24 ms     13 ms     12 ms     10.50.6.244&#xA;  12   24 ms     24 ms     21 ms     10.50.6.249&#xA;  13   34 ms     10 ms     23 ms     10.50.6.244&#xA;  14   22 ms     33 ms     43 ms     10.50.6.249&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Dropbox link for the file. As an update since this discussion I have changed the interfaces on the switch from trunks to sit on routing vlan 6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/sh/kt5x03j1kckf9bw/AABdlTWqvyUNQer-O-t_AAv7a?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.dropbox.com/sh/kt5x03j1kckf9bw/AABdlTWqvyUNQer-O-t_AAv7a?dl=0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8397" LastEditorUserId="8397" LastEditDate="2015-12-07T08:58:49.190" LastActivityDate="2015-12-07T08:58:49.190" Title="ASA not following default route" Tags="|routing|cisco-asa|packet-tracer|" AnswerCount="0" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="24931" PostTypeId="1" AcceptedAnswerId="24932" CreationDate="2015-12-03T13:43:39.140" Score="1" ViewCount="125" Body="&lt;p&gt;Is it true that continuously using a different IP make your browser tend to think that your Proxy IP is your main IP. They change your location to the country according to the vpn. So after a period of time although you are not not using VPN .... your network is now virtual?&lt;/p&gt;&#xA;" OwnerUserId="21106" LastActivityDate="2017-03-05T13:25:43.827" Title="Does using vpn for a long time change your location?" Tags="|vpn|ip|internet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24932" PostTypeId="2" ParentId="24931" CreationDate="2015-12-03T14:06:18.313" Score="1" Body="&lt;p&gt;No.&#xA;But as I need to respond with at least 30 characters I will review my answer so:&#xA;No. &lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2015-12-03T14:06:18.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24933" PostTypeId="2" ParentId="24929" CreationDate="2015-12-03T14:48:27.230" Score="2" Body="&lt;p&gt;DHCP will add more broadcast on your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;see: &lt;a href=&quot;https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-12-03T14:48:27.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24934" PostTypeId="2" ParentId="24929" CreationDate="2015-12-03T15:18:42.907" Score="0" Body="&lt;p&gt;A layer-2 network depends on broadcasts in order to function. The way one host discovers the layer-2 address of another host (including the gateway) on the same network is by using ARP to resolve the layer-3 address to the layer-2 address. ARP sends a broadcast since it doesn't know the layer-2 address (what it is looking for).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Broadcasts are an essential part of networking, and preventing broadcasts will kill your network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-03T15:18:42.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24935" PostTypeId="2" ParentId="1252" CreationDate="2015-12-03T16:02:35.987" Score="0" Body="&lt;p&gt;configure ip-helper address on the subinterfaces too with the same helper ip.. no smart-relay.. i tried it and it worked in GNS3..not tested in live ..!&lt;/p&gt;&#xA;" OwnerUserId="21109" LastActivityDate="2015-12-03T16:02:35.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24936" PostTypeId="1" CreationDate="2015-12-03T16:36:05.033" Score="3" ViewCount="3830" Body="&lt;p&gt;I have a pair of Cisco ASA 5585 firewalls in my network. I need to make some network changes on my network however we can have very little to no impact/downtime. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to be able to make changes on the standby and then failover to that standby so the network will use those changes. However once that standby becomes the Active, I want to prevent it from syncing the config to the new standby(The previous active) In order to be able to fail right back over to the old config if the new does not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to configure the failover to not sync changes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="17253" LastActivityDate="2018-06-02T19:58:50.540" Title="Active/Standby Cisco ASA failover without Sync" Tags="|cisco-asa|failover|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24938" PostTypeId="1" CreationDate="2015-12-03T16:56:55.553" Score="1" ViewCount="7943" Body="&lt;p&gt;Using following command on my cisco WAN interface is good or bad?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip redirects&#xA;no ip unreachables&#xA;no ip proxy-arp&#xA;no cdp enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;are there any advantage?&lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2015-12-03T19:18:41.823" Title="no ip unreachables good or bad" Tags="|cisco|switch|ethernet|isp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24939" PostTypeId="2" ParentId="24931" CreationDate="2015-12-03T16:57:46.193" Score="1" Body="&lt;p&gt;I guess you are trying to understand too many things - VPN, public - private IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally if you are in private network then you will be assigned a private IP address, and to the world you will be identified using a public IP address and that public IP address would be of your private network (company or college etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPNs basically hook you inside somebody else's private network. Now once you are in VPN then typically your own IP address (private or public) will be masked and all requests to the destination server will be sent using VPN provider's IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a public IP address, lets say you are connected to internet using some ISP, then you have a public IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, whether you are in private n/w and have private IP, or public IP or in VPN: as long as you do not disconnect and re-connect back you will have same IP address. &lt;strong&gt;So, just by using VPN your location will not change or your own network will not become virtual&lt;/strong&gt;; you are already in a virtual network using VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But good think to note that if you are connected to internet using a ISP then as per &lt;a href=&quot;https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#DHCP_offer&quot; rel=&quot;nofollow noreferrer&quot;&gt;DHCP protocol&lt;/a&gt; you will be assigned the IP address for some time, and after that time is elapsed your connection will be broken and you will need to re-connect in which case you will get a new IP address.&lt;/p&gt;&#xA;" OwnerUserId="17198" LastEditorUserId="17198" LastEditDate="2017-03-05T13:25:43.827" LastActivityDate="2017-03-05T13:25:43.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24940" PostTypeId="1" AcceptedAnswerId="24943" CreationDate="2015-12-03T17:36:56.780" Score="1" ViewCount="5772" Body="&lt;p&gt;Here is the Diagram. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/CxEwL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CxEwL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ip address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[VIP]- 10.107.25.5&#xA;[R1] - 10.107.25.6&#xA;[R2] - 10.107.25.7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Me:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[VIP] - 10.107.25.10&#xA;[SW1] - 10.107.25.11&#xA;[SW2] - 10.107.25.12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configuration on port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1&#xA;&#xA;&#xA;    interface GigabitEthernet1/0/1&#xA;    description #Primary Link WTBB 1#&#xA;    no switchport&#xA;    ip address 10.107.25.11 255.255.255.248&#xA;    standby 30 ip 10.107.25.10&#xA;    standby 30 priority 110&#xA;    standby 30 preempt&#xA;&#xA;SW2&#xA;&#xA;&#xA;    interface GigabitEthernet1/0/1&#xA;    description # Secondary Link WTBB 2#&#xA;    no switchport&#xA;    ip address 10.107.25.12 255.255.255.248&#xA;    standby 30 ip 10.107.25.10&#xA;    no standby 30 preempt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notes: Interesting thing i can't ping from &lt;code&gt;10.107.25.11&lt;/code&gt; to &lt;code&gt;10.107.25.12&lt;/code&gt; I am not sure what is other side of ISP, As per document .11 should ping .12 so they can say hello to each other using &lt;code&gt;L2&lt;/code&gt; layer right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what i did but i think its wrong way to configure HSRP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[SW1]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan3&#xA;ip address 10.107.25.11 255.255.255.248&#xA;standby 30 ip 10.107.25.10&#xA;standby 30 priority 110&#xA;standby 30 preempt &#xA;&#xA;interface GigabitEthernet1/0/1&#xA;switchport access allow vlan 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;[SW2]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan3&#xA;ip address 10.107.25.12 255.255.255.248&#xA;standby 30 ip 10.107.25.10&#xA;standby 30 priority 110&#xA;standby 30 preempt &#xA;&#xA;interface GigabitEthernet1/0/1&#xA;switchport access allow vlan 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Trunk interface i allowed &lt;code&gt;Vlan3&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now i can ping from .11 to .12 ip address using vlan3 (L2) network. and HSRP is happy (active/standby). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if i unplug cable on port &lt;code&gt;G1/0/1&lt;/code&gt; trying to mimic cable is cut and my VIP will failover. but problem is .11 and .12 is on &lt;code&gt;vlan3&lt;/code&gt; interface and they are &lt;code&gt;UP&lt;/code&gt; no matter you cut the cable or not.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do i solve this issue in above scenario?  &lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2018-12-22T20:37:11.827" LastActivityDate="2018-12-22T20:37:11.827" Title="HSRP issue both device active stats" Tags="|cisco|switch|router|hsrp|fhrp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24941" PostTypeId="2" ParentId="24894" CreationDate="2015-12-03T18:08:51.953" Score="0" Body="&lt;p&gt;In case you're using Layer 3 device, you should start by enabling the routing on L3 device, than configure for each VLAN a SVI (Switch Virtual Interface):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;interface Vlan 10&#xA; ip address 172.20.0.1 255.255.255.128&#xA;!&#xA;interface Vlan 20&#xA; ip address 192.168.0.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3672" LastActivityDate="2015-12-03T18:08:51.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24943" PostTypeId="2" ParentId="24940" CreationDate="2015-12-03T19:04:55.803" Score="2" Body="&lt;p&gt;&lt;strong&gt;Edited to reflect new information in the question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your multiple edits which &lt;em&gt;finally&lt;/em&gt; give the whole picture (I hope), you can try something like this, but using the switch stacking capability in the alternative configuration will give you a better solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your connection to the ISP will need to be on the same subnet as the ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;track 3 interface GigabitEthernet1/0/1 line-protocol&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description #Primary Link WTBB 1#&#xA; switchport&#xA; switchport access vlan 3&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; description #Link to switch 2#&#xA; switchport&#xA; switchport access vlan 3&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface Vlan3&#xA; ip address 10.107.25.11 255.255.255.240&#xA; standby 30 ip 10.107.25.10&#xA; standby 30 priority 105&#xA; standby 30 preempt&#xA; standby 30 track 3 decrement 10&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SW2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;track 3 interface GigabitEthernet1/0/1 line-protocol&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description #Primary Link WTBB 2#&#xA; switchport&#xA; switchport access vlan 3&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; description #Link to switch 1#&#xA; switchport&#xA; switchport access vlan 3&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface Vlan3&#xA; ip address 10.107.25.12 255.255.255.240&#xA; standby 30 ip 10.107.25.10&#xA; standby 30 priority 100&#xA; standby 30 preempt&#xA; standby 30 track 3 decrement 10&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This allows the ISP HSRP to work since the ISP routers need to be able to talk to each other on the same VLAN so that the ISP HSRP works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Alternate (stacked) Configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW1/2 stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/1&#xA; description #Primary Link WTBB 1#&#xA; switchport&#xA; switchport access vlan 3&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigabitEthernet2/0/1&#xA; description #Primary Link WTBB 2#&#xA; switchport&#xA; switchport access vlan 3&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface Vlan3&#xA; ip address 10.107.25.10 255.255.255.240&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This configuration gives you all the benefits of the two separate switches but solves your problem of having two separate switches with separate IP addresses. The stack is configured as a single switch and is managed as a single device. Besides the data sharing, the 3850s can also do power sharing so that if one of them loses power, the other can keep both switches running. You will also save precious public IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-04T13:35:48.340" LastActivityDate="2015-12-04T13:35:48.340" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="24945" PostTypeId="2" ParentId="24938" CreationDate="2015-12-03T19:18:41.823" Score="3" Body="&lt;p&gt;I personally enable cdp/lldp at least internally (some exchange points usually forbid them though).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;no ip unreachable&lt;/strong&gt; is not a good idea: it breaks PMTU discovery for instance. &lt;a href=&quot;http://packetlife.net/blog/2008/oct/9/disabling-unreachables-breaks-pmtud/&quot; rel=&quot;nofollow&quot;&gt;http://packetlife.net/blog/2008/oct/9/disabling-unreachables-breaks-pmtud/&lt;/a&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ICMP unreachables can be rate limited though.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-12-03T19:18:41.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24946" PostTypeId="1" CreationDate="2015-12-03T20:13:43.470" Score="3" ViewCount="628" Body="&lt;p&gt;I have the following prefix-list configured on our router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list adsvr seq 5 permit 172.30.5.241/32&#xA;ip prefix-list adsvr seq 10 permit 134.239.130.143/32&#xA;ip prefix-list adsvr seq 15 permit 192.168.151.135/32&#xA;ip prefix-list adsvr seq 20 permit 192.168.181.182/32&#xA;&#xA;ip prefix-list networks permit 10.15.0.0/16&#xA;ip prefix-list networks permit 10.18.3.0/24&#xA;ip prefix-list networks permit 10.18.10.0/24&#xA;ip prefix-list networks permit 10.18.48.0/20&#xA;ip prefix-list networks permit 10.16.7.0/24&#xA;ip prefix-list networks permit 10.16.77.0/24&#xA;ip prefix-list networks permit 10.19.0.0/22&#xA;ip prefix-list networks permit 10.16.3.0/24&#xA;ip prefix-list networks permit 10.16.8.128/25&#xA;ip prefix-list networks permit 10.16.1.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have configured a route-map as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map allowed_Alfa_networks permit 10&#xA;match ip address prefix-list adsvr networks&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have applied the route-map to our bgp configuration as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 65230&#xA; bgp log-neighbor-changes&#xA; network 10.9.252.90 mask 255.255.255.255&#xA; network 10.16.76.0 mask 255.255.255.0&#xA; network 10.112.224.0 mask 255.255.254.0&#xA; network 10.112.226.0 mask 255.255.254.0&#xA; network 10.112.228.0 mask 255.255.254.0&#xA; network 10.112.230.0 mask 255.255.254.0&#xA; network 10.112.232.0 mask 255.255.255.0&#xA; network 10.112.233.0 mask 255.255.255.0&#xA; network 192.168.58.0&#xA; redistribute static&#xA; neighbor 10.1.243.17 remote-as 2856&#xA; neighbor 10.1.243.17 ebgp-multihop 3&#xA; neighbor 10.1.243.17 soft-reconfiguration inbound&#xA; neighbor 10.1.242.17 route-map allowed_Alfa_networks in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when I do a show ip bgp I only see the prefixes from 'networks' - I don't see prefixes from 'adsvr', see below;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     Network          Next Hop            Metric LocPrf Weight Path&#xA; *&amp;gt;  10.0.0.0         0.0.0.0                  0         32768 ?&#xA; *&amp;gt;  10.9.252.90/32   0.0.0.0                  0         32768 i&#xA; *&amp;gt;  10.16.1.0/24     10.1.243.17                            0 2856 65201 i&#xA; *&amp;gt;  10.16.3.0/24     10.1.243.17                            0 2856 64521 ?&#xA; *&amp;gt;  10.16.7.0/24     10.1.243.17                            0 2856 64521 ?&#xA; *&amp;gt;  10.16.45.0/25    10.1.243.17                            0 2856 65248 i&#xA; *&amp;gt;  10.16.45.128/25  10.1.243.17                            0 2856 65248 i&#xA; *&amp;gt;  10.16.76.0/24    0.0.0.0                  0         32768 i&#xA; *&amp;gt;  10.16.77.0/24    10.1.243.17                            0 2856 64521 ?&#xA; *&amp;gt;  10.19.0.0/22     10.1.243.17                            0 2856 65286 ?&#xA; *&amp;gt;  10.19.8.0/22     10.1.243.17                            0 2856 12641 65289 ?&#xA; *&amp;gt;  10.19.9.0/27     10.1.243.17                            0 2856 12641 65289 i&#xA; *&amp;gt;  10.112.224.0/23  0.0.0.0                  0         32768 i&#xA; *&amp;gt;  10.112.226.0/23  0.0.0.0                  0         32768 i&#xA; *&amp;gt;  10.112.228.0/23  0.0.0.0                  0         32768 i&#xA; *&amp;gt;  10.112.230.0/23  0.0.0.0                  0         32768 i&#xA; *&amp;gt;  10.112.232.0/24  0.0.0.0                  0         32768 i&#xA; *&amp;gt;  10.112.233.0/24  0.0.0.0                  0         32768 i&#xA; *&amp;gt;  134.239.128.0/21 0.0.0.0                  0         32768 ?&#xA; *&amp;gt;  141.247.238.0/24 0.0.0.0                  0         32768 ?&#xA; *&amp;gt;  172.16.0.0/12    0.0.0.0                  0         32768 ?&#xA; *&amp;gt;  172.23.204.0/22  10.1.243.17                            0 2856 65287 ?&#xA; *&amp;gt;  172.50.0.0       0.0.0.0                  0         32768 ?&#xA; *&amp;gt;  192.168.0.0/16   0.0.0.0                  0         32768 ?&#xA; *&amp;gt;  192.168.58.0     0.0.0.0                  0         32768 i&#xA;jmeu-heysham01-mpls# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can some please tell me why I can't see&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172.30.5.241/32&#xA;134.239.130.143/32&#xA;192.168.151.135/32&#xA;192.168.181.182/32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Its driving me crazy&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="20399" LastEditorUserId="8499" LastEditDate="2018-12-22T20:38:58.137" LastActivityDate="2018-12-22T20:38:58.137" Title="Cisco Prefix List Won't Appear in Route Table" Tags="|cisco|routing|cisco-ios|bgp|route-filter|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="24948" PostTypeId="2" ParentId="3355" CreationDate="2015-12-03T20:48:32.480" Score="0" Body="&lt;p&gt;It's somewhat true, somewhat BS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most current FTTH deployments are using gigabit level techology. Many of them are also using PON and are often capped at a lower rate so that no one user can hog the channel and/or to protect revenues from more expensive buisness fiber products. There are products on the horizon (others have linked some) that can potentially achive those kind of datarates over copper phone wiring and/or cable TV wiring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those techologies have short range. The higher the datarate the shorter the range. Therefore to use them the fiber to copper transition point needs to be moved ever closer to the customer. That means lots of active hardware spread across meany locations in the field. Worse to significantly increase datarates requires replacing that active hardware with another load even closer to the customer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Meanwhile a dedicated run of single mode fiber can easilly support 10 gigabit and with the right hardware (which is currently prohibitively expensive) can support far more. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the PON side there is a standard for 10 gigabit PON in development. It would also be possible to re-splice high bandwidth customers from PON to a dedicated fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for wireless systems the headline bandwidth figures can be high but real world performance is usually much worse.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-12-03T20:48:32.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24949" PostTypeId="2" ParentId="24946" CreationDate="2015-12-03T20:49:34.253" Score="2" Body="&lt;p&gt;It looks like you don't want to get the full route prefix, only the host route prefix, which you want to create out of the full route prefix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you are confused. BGP will only get prefixes which are advertised to it. It appears that you are getting the the &lt;code&gt;192.168.151.0/24&lt;/code&gt; prefix, but you wan to extract individual host prefixes from it, like &lt;code&gt;192.168.151.135.32&lt;/code&gt;. That's not how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can filter any prefixes which you receive, but your are not receiving any host prefixes, so you can't filter on them. You neighbor would need to send you the host prefixes before you can filter on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your neighbor is sending you both &lt;code&gt;192.168.151.0/24&lt;/code&gt; and &lt;code&gt;192.168.151.135/32&lt;/code&gt;, you can filter out one or the other, but if you only receive one of the prefixes, you can't create the other from the one you receive (except for aggregates).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-03T23:13:37.923" LastActivityDate="2015-12-03T23:13:37.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24952" PostTypeId="1" CreationDate="2015-12-03T21:10:20.360" Score="1" ViewCount="109" Body="&lt;p&gt;I've got a satellite modem with an 8 port switch behind it.  The modem has an IP of 192.168.128.100 and only allows traffic from 192.168.128.200.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I connected the modem to my WAN port, set up my switch IP as 192.168.128.200 and the gateway as 192.168.128.100.  Devices on the switch use DHCP with the IP address set per MAC address, in the 192.168.128.201-209 range. &lt;strong&gt;Unfortunately none of those devices are able to ping outside past the modem. Does the modem see all traffic as 192.168.128.200 or does it see it as the addresses behind the switch?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, the hardware is a Hughes 9502 BGAN Satellite modem, the switch is a DLink DSR-150.&lt;/p&gt;&#xA;" OwnerUserId="21111" LastActivityDate="2015-12-03T21:14:50.713" Title="Modem only allows outgoing traffic from specific IP, how should I configure the switch behind it?" Tags="|switch|router|dhcp|" AnswerCount="1" CommentCount="1" ClosedDate="2015-12-03T21:22:57.623" ContentLicense="CC BY-SA 3.0" />
  <row Id="24953" PostTypeId="2" ParentId="24952" CreationDate="2015-12-03T21:14:50.713" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The modem has an IP of 192.168.128.100 and only allows traffic from&#xA;  192.168.128.200&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If this is an absolute requirement which cannot be changed because of limitations on the ISP's side, your only option would be to install a router between the modem and a switch. Once you have done that, you can configure the router to NAT all user traffic which is destined for non-local networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, your internal network would receive IP addresses from one range (e.g 192.168.0.0/24), but once they send their traffic through the router, their source IP addresses will be changed to 192.168.128.200. This results in the modem allowing the traffic through. When the return traffic comes in the modem will pass the traffic to the router and the router will &quot;un-NAT&quot; it and pass it to the host who originally requested the traffic.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-12-03T21:14:50.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24954" PostTypeId="1" AcceptedAnswerId="24955" CreationDate="2015-12-03T21:37:27.787" Score="1" ViewCount="2484" Body="&lt;p&gt;I currently have setup my SonicWALL TZ215 with SSLVPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am connecting from my 2015 MacBook using the SonicWALL Mobile Connection application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The application correctly connects, but when I run &lt;code&gt;ifconfig&lt;/code&gt;, I can see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;utun0: flags=8051&amp;lt;UP,POINTOPOINT,RUNNING,MULTICAST&amp;gt; mtu 1500&#xA;inet 192.168.16.191 --&amp;gt; 192.168.16.191 netmask 0xffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My network is on &lt;code&gt;192.168.16.0&lt;/code&gt;, so I correctly receive an address from the range (provided by the SonicWALL) but I am getting given a &lt;code&gt;0xffffffff&lt;/code&gt; (hexadecimal converts to 255.255.255.255) subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SonicWALL is running firmware 5.8. Do you nave any ideas how I can provide a different subnet on the SSLVPN connection as I can't see anywhere that I apply the subnet mask?&lt;/p&gt;&#xA;" OwnerUserId="21113" LastEditorUserId="8499" LastEditDate="2016-03-03T02:16:21.307" LastActivityDate="2016-07-31T04:21:15.477" Title="Dell SonicWALL SSL VPN applying a /32 (255.255.255.255) subnet mask" Tags="|vpn|sonicwall|sslvpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24955" PostTypeId="2" ParentId="24954" CreationDate="2015-12-03T22:09:40.783" Score="0" Body="&lt;p&gt;Resolved, I needed to apply allowed networks underneath the user. I applied the &lt;code&gt;network&lt;/code&gt; object here.&lt;/p&gt;&#xA;" OwnerUserId="21113" LastActivityDate="2015-12-03T22:09:40.783" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24963" PostTypeId="2" ParentId="24929" CreationDate="2015-12-04T10:11:38.727" Score="0" Body="&lt;p&gt;With DHCP you can set flags for Windows hosts to never use brodcasts to find each other. This way you could potentially have less broadcasts, but...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you need to check with network analyzer like tcpdump or &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow&quot;&gt;Wireshark&lt;/a&gt; to see which machines are broadcasting what. Then you can turn off protocols and/or applications which are causing this and are not needed. Also if you have smart switch you could enable protocol vlans to limit protocol broadcasts only to proper hosts, etc.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2015-12-04T10:11:38.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24965" PostTypeId="1" AcceptedAnswerId="28163" CreationDate="2015-12-04T11:09:31.197" Score="2" ViewCount="143" Body="&lt;p&gt;Source nat can be done using a pool of ip addresses. Suppose, I have a pool of 64 public ip addresses and I configure my nat enabled router so that whenever packets are sent outside, source nat all connections using this pool of addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, my question is that, what am I doing with these addresses actually? Are they all configured in my router interfaces? Or they are for just source nat purpose(I advertise reachability of those addresses by some protocol)?&lt;/p&gt;&#xA;" OwnerUserId="4213" LastEditorUserId="4213" LastEditDate="2016-05-24T06:30:50.217" LastActivityDate="2021-01-29T06:30:22.353" Title="Use of pool of addresses in source NAT" Tags="|routing|router|nat|snat|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24968" PostTypeId="1" CreationDate="2015-12-04T13:37:05.067" Score="3" ViewCount="506" Body="&lt;p&gt;Most 100 Base TX ethernet devices today support auto mdix. However I need a device (ethernet nic, router, usb ethernet adapter, ...) where it is either possible to permanently (via software/drivers is not enough) disable auto mdix (by desoldering a pin maybe?) or where auto mdix is not even implemented. But I'm not sure if such a thing even exists. Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="21127" LastActivityDate="2016-02-03T05:55:59.813" Title="Wanted: 100 BaseTX devices without Auto Mdix" Tags="|ethernet|" AnswerCount="3" CommentCount="8" ClosedDate="2017-08-12T22:50:38.307" ContentLicense="CC BY-SA 3.0" />
  <row Id="24969" PostTypeId="2" ParentId="24968" CreationDate="2015-12-04T14:46:36.507" Score="1" Body="&lt;p&gt;Go buy some junk at a garage sale or on sleaze-bay. Plenty of hubs (and a few switches, perhaps) were made this way ~20 years ago.&lt;a href=&quot;https://i.stack.imgur.com/L967R.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L967R.jpg&quot; alt=&quot;DS108&quot;&gt;&lt;/a&gt; Look for a switch to make one port &quot;uplink&quot; (as seen on the right of this picture) and you're probably looking at the junque you want....&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2015-12-04T14:46:36.507" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24973" PostTypeId="2" ParentId="24968" CreationDate="2015-12-04T15:57:02.813" Score="0" Body="&lt;p&gt;You do not need to satisfy the requirement on the hardware level. There are platforms which support disabling Auto MDI-X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: Cisco IOS offers the &lt;code&gt;no mdix auto&lt;/code&gt; command. Junos offers the &lt;code&gt;no-auto-mdix&lt;/code&gt; command. Still, I recommend to look up the specifiation because you may get a device which does not run the original image anymore. Look for a feature navigator on the vendor's homepage.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2015-12-04T15:57:02.813" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="24974" PostTypeId="2" ParentId="13191" CreationDate="2015-12-04T16:07:13.187" Score="1" Body="&lt;p&gt;We are getting much closer to the physical limits of twisted pair media nowadays. I doubt you will see the massive increases on the same cable we saw in the transition from dialup to DSL and the transition from 100BASE-TX to 1000BASE-T. We might see some more incremental improvements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is talk about new standards for speeds of 2.5 and 5 gigabit per second over twisted pair (google for 2.5 gigabit ethernet to find lots of articles about it) . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ethernetalliance.org/wp-content/uploads/2013/04/Ethernet-Alliance-Technology-Roadmap-FINAL.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.ethernetalliance.org/wp-content/uploads/2013/04/Ethernet-Alliance-Technology-Roadmap-FINAL.pdf&lt;/a&gt; indicates that there is an intention to support 2.5 gigabit and maybe 5 gigabit on 100 meters of cat5e.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-12-04T16:07:13.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24975" PostTypeId="1" AcceptedAnswerId="24978" CreationDate="2015-12-04T16:11:00.717" Score="2" ViewCount="645" Body="&lt;p&gt;How do RIPv2/RIPng select between equal routes? Randomly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, 2 broadcast domains, 5 routers, all running RIPv2 and RIPng. The &lt;code&gt;|&lt;/code&gt; pipes represent a switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; R01  &#xA;     | R02&#xA;     | R03 | &#xA;     | R04 |    &#xA;           | R05&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How does R01 decide between R02/R03/R03?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Commentary: There are no static routes. Timers are the same on each router. There are only two IPv4 and two IPv6 networks.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="8499" LastEditDate="2018-12-22T20:40:15.520" LastActivityDate="2018-12-22T20:40:15.520" Title="Route selection in RIPv2 and RIPng (equal hop count)" Tags="|routing|router|rip|redundant-routes|next-hop|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24976" PostTypeId="1" AcceptedAnswerId="24977" CreationDate="2015-12-04T16:13:29.930" Score="2" ViewCount="13497" Body="&lt;p&gt;I am doing some practice on &lt;code&gt;GNS3&lt;/code&gt; related switch and want to allow SSH from specific &lt;code&gt;VLAN&lt;/code&gt; Ex: vlan1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In GNS3 i used router with 16NM ethernet module to emulate switch, so i am using following command to tell allow SSH from only vlan1, it seems not working. Do i need &lt;code&gt;ACL&lt;/code&gt; ? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip ssh source-interface vlan 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;EDIT&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I have following cisco config. but its not working &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; line con 0&#xA;  stopbits 1&#xA; line aux 0&#xA; line vty 5 15&#xA;  access-class ALLOW-SSH in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2015-12-04T16:54:29.640" LastActivityDate="2015-12-04T16:54:29.640" Title="ip ssh source-interface vlan - allow ssh from specific vlan not working" Tags="|cisco|vlan|access-control|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24977" PostTypeId="2" ParentId="24976" CreationDate="2015-12-04T16:30:37.403" Score="3" Body="&lt;p&gt;You are using the wrong command.&#xA;&lt;code&gt;ip ssh source-interface&lt;/code&gt; command defines the source IP when starting an SSH session from the router.  It has no effect on other traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To control who can SSH into your router, you use an ACL and access-class.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list standard ALLOW-SSH&#xA;permit 192.168.100.0 0.0.0.255&#xA;&#xA;line vty 0 15&#xA;transport ssh&#xA;access-class ALLOW-SSH in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-04T16:30:37.403" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24978" PostTypeId="2" ParentId="24975" CreationDate="2015-12-04T16:49:57.630" Score="1" Body="&lt;p&gt;Cisco routers can load balance across equal-cost routes, but you don't give a router make/model. The RFC for RIPv2, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2453&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2453, RIP Version 2&lt;/a&gt;, actually discusses equal-cost routes:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If the new metric is the same as the old one, it is simplest to do&#xA;nothing further (beyond re-initializing the timeout, as specified&#xA;above); but, there is a heuristic which could be applied.  Normally,&#xA;it is senseless to replace a route if the new route has the same&#xA;metric as the existing route; this would cause the route to bounce&#xA;back and forth, which would generate an intolerable number of&#xA;triggered updates.  However, if the existing route is showing signs of&#xA;timing out, it may be better to switch to an equally-good alternative&#xA;route immediately, rather than waiting for the timeout to happen.&#xA;Therefore, if the new metric is the same as the old one, examine the&#xA;timeout for the existing route.  If it is at least halfway to the&#xA;expiration point, switch to the new route.  This heuristic is&#xA;optional, but highly recommended.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-12-04T16:49:57.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24980" PostTypeId="2" ParentId="23358" CreationDate="2015-12-04T17:11:19.613" Score="0" Body="&lt;p&gt;With a class C to get hosts, I count from 128 backwards cutting it in half each step. So 128, 64, 32. It has to be 32 hosts because half of 32 is 16, not enough for 20. That's 3 bits borrowed. That is from a standard /24 to a /27. The networks are added by starting with 2 and doubling them, so 2, 4, 8 which gives you 8 nets for 3 bits borrowed. I made a video for my class that shows you how to make an easy to remember cheat sheet, that helps you understand the basic concept of subnetting a class C network. &lt;a href=&quot;https://www.youtube.com/watch?v=zqH0COM81Qc&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=zqH0COM81Qc&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19896" LastActivityDate="2015-12-04T17:11:19.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24981" PostTypeId="1" AcceptedAnswerId="24983" CreationDate="2015-12-04T17:31:10.700" Score="2" ViewCount="2653" Body="&lt;p&gt;tl;dr Which is looked at first, longest match or the BGP decision process&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm taking a course on BGP right now and trying to figure out how these two routing processes work together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that a more specific route is preferred in the router over a less specific one (192.0.0.0/25 will always be chosen over 192.0.0.0/24)&#xA;I also know how the BGP decision process works (Local pref is looked at before AS_Path, ect)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, if an AS has 2 neighbors, and it advertises a more specific network to one of them than the other, then some other AS down the line gets both of those advertisements, will longest match take affect automatically and the more specific one will automatically be chosen? Or does the BGP decision process happen first, therefore only one of the routes is put into the route table and longest match has no impact on it at all?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope I explained that in a way that makes sense. Thanks for the help&lt;/p&gt;&#xA;" OwnerUserId="21133" LastEditorUserId="498" LastEditDate="2016-01-05T04:03:16.837" LastActivityDate="2016-01-05T04:03:16.837" Title="BGP Decision process priority vs Longest match" Tags="|routing|bgp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24982" PostTypeId="2" ParentId="24981" CreationDate="2015-12-04T17:39:40.867" Score="1" Body="&lt;p&gt;Longest Match will always be looked at first. A /25 RIP route will be preferred over a /24 EIGRP/OSPF/BGP/anything route.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2015-12-04T17:39:40.867" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="24983" PostTypeId="2" ParentId="24981" CreationDate="2015-12-04T17:39:59.683" Score="1" Body="&lt;p&gt;Don't confuse the BGP process and tables with the routing table used by the router to switch packets. The BGP table can contain both the longer and shorter prefixes, and BGP can advertise both to other neighbors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The route selection in a router will install the longest match in its routing table, assuming it is presented with both matches, but that doesn't remove the shorter prefix from the BGP table. BGP can be set to prefer the shortest match, and that may be the one presented to the routing table.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-04T17:39:59.683" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="24984" PostTypeId="2" ParentId="24273" CreationDate="2015-12-04T18:14:33.343" Score="0" Body="&lt;p&gt;I solved my issue.  A Brocade TAC engineer can fix this issue (On ICX 6610 at least) without an RMA.  Some cases require an RMA.&lt;/p&gt;&#xA;" OwnerUserId="20573" LastActivityDate="2015-12-04T18:14:33.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="24986" PostTypeId="2" ParentId="22889" CreationDate="2015-12-04T22:13:10.580" Score="-1" Body="&lt;p&gt;You may need to enter the command &quot;platform hardware throughput level xxxxxx&quot; in order to enable the license.&lt;/p&gt;&#xA;" OwnerUserId="21137" LastActivityDate="2015-12-04T22:13:10.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24987" PostTypeId="1" AcceptedAnswerId="24988" CreationDate="2015-12-04T22:29:03.207" Score="3" ViewCount="633" Body="&lt;p&gt;I'm not sure if I get the idea of &lt;a href=&quot;https://en.wikipedia.org/wiki/6to4&quot; rel=&quot;nofollow&quot;&gt;6to4 mechanism&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I see it: if we have two IP v6 hosts that would like to communicate and all of the internet was IP v6, there would be no problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if there's an IPv4 network on the path from IPv6 host A to IPv6 host B, then apparently it's a problem 6to4 tries to solve. But what is this problem exactly? If I send a packet from IPv6 host A to IPv6 host B, then the only issue I can think of is that routers in IPv4 network don't udnerstand IPv6 addresses = no way to route the packet to host B properly. Anything else? I think 6to4 is &lt;strong&gt;not&lt;/strong&gt; about allowing IPv6 hosts to 'talk' with IPv4 ones, which is what the article emphasised.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the above is true, then we would like to somehow convert IPv6 address of host B to an IPv4 address the IPv4 routers can understand - then IPv4 routers will be able to route the packet to host B. But, for some reason, the wikipedia article I linked to says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For example, the global IPv4 address 192.0.2.4 has the corresponding&#xA;  6to4 prefix 2002:c000:0204::/48. This gives a prefix length of 48&#xA;  bits, which leaves room for a 16-bit subnet field and 64 bit host&#xA;  addresses within the subnets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I just don't get it. We want to convert IPv6 address to IPv4 one, but the quote says the opposite!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok, but even if we need that, the IPv6 address has 128 bits. The first 48 bits in the conversion above will be 2002:c000:0204::/48, and the rest is for &lt;em&gt;subnet field and 64 bit host addresses within the subnets&lt;/em&gt; - &lt;strong&gt;what&lt;/strong&gt; subnet field and &lt;strong&gt;what&lt;/strong&gt; host addresses within what subnets? Could anyone explain what are the remaining 80 bits used for?&lt;/p&gt;&#xA;" OwnerUserId="20229" LastActivityDate="2015-12-05T15:07:56.833" Title="IPv6 6to4 mechanism" Tags="|ipv4|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24988" PostTypeId="2" ParentId="24987" CreationDate="2015-12-04T23:08:49.593" Score="6" Body="&lt;p&gt;You are correct that 6to4 is for allowing IPv6 hosts (actually whole networks of IPv6 hosts) to talk to other IPv6 hosts. It does that by doing automatic tunnelling: putting the IPv6 packet into an IPv4 packet. This is done by a router that has both IPv4 and IPv6. That IPv4 packet can then be transmitted over the IPv4 internet (which doesn't know how to handle IPv6 at all) to another router that has both IPv4 and IPv6. The IPv4 wrapper is taken off, and the IPv6 packet can travel to its destination.&lt;/p&gt;&#xA;&lt;p&gt;This is just basic tunnelling. What makes 6to4 so special? It is that the IPv4 address of the router is communicated inside the IPv6 prefix. For example: the address between &lt;code&gt;2002:c000:0204:0000:0000:0000:0000:0000&lt;/code&gt; and &lt;code&gt;2002:c000:0204:ffff:ffff:ffff:ffff:ffff&lt;/code&gt; can be reached by wrapping (encapsulating) the IPv6 packet inside an IPv4 packet and sending that packet to IPv4 address &lt;code&gt;192.0.2.4&lt;/code&gt; (&lt;code&gt;c0&lt;/code&gt;=192, &lt;code&gt;00&lt;/code&gt;=0, &lt;code&gt;02&lt;/code&gt;=2, &lt;code&gt;04&lt;/code&gt;=4). That makes it possible for people whose provider doesn't give them IPv6 but does give them a public IPv4 address to get their own IPv6 addresses. With a &lt;code&gt;/48&lt;/code&gt; you can create 65536 subnets (which are a &lt;code&gt;/64&lt;/code&gt; each).&lt;/p&gt;&#xA;&lt;p&gt;The problem occurs when communicating with systems that have 'normal' IPv6 addresses. Such addresses don't have an IPv4 address encoded in the IPv6 address and therefore the 6to4 router doesn't know which IPv4 address to send the packets to. So it has to send them to a 3rd-party relay that is connected to the normal IPv6 internet. The quality of such relays is very unpredictable, and therefore the connectivity to the normal IPv6 internet is often bad. Therefore such deployment of 6to4 is deprecated (see &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7526&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC7526&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;If you want IPv6 access then first complain to your ISP. If they don't want to provide IPv6 then find a decent ISP that does. If you can't get IPv6 from an ISP then you should look at i.e. &lt;a href=&quot;http://tunnelbroker.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;tunnelbroker.net&lt;/a&gt;. They provide free IPv6 tunnels with proper connectivity. It's not optimal, but it's much much better than unreliable 6to4.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Based on the chat discussion some extra information:&lt;/p&gt;&#xA;&lt;p&gt;6to4 is an obsolete technology. It was meant to give IPv6 addresses and routeability to people whose ISP didn't provide proper IPv6. A quick overview:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you need a device with a public IPv4 address&lt;/li&gt;&#xA;&lt;li&gt;From that IPv6 address you derive a /48 prefix to use with 6to4&lt;/li&gt;&#xA;&lt;li&gt;so my address (37.77.56.75) would become 2002:254d:384b::/48&lt;/li&gt;&#xA;&lt;li&gt;that prefix can then be used to provision my whole house/business/etc with IPv6&lt;/li&gt;&#xA;&lt;li&gt;that is where you need subnetting&lt;/li&gt;&#xA;&lt;li&gt;the device with the public IPv4 address is the gateway between my internal IPv6 network and the rest of the IPv6 world&lt;/li&gt;&#xA;&lt;li&gt;and your LANs are numbered out of that 2002:....:....::/48 prefix&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;And that's it basically :)&lt;/p&gt;&#xA;&lt;p&gt;The problem with 6to4 is that it needs 3rd-party relays on the internet to relay between the IPv4 internet (to which your 6to4 gateway is connected) and the real IPv6 internet. And you usually have no control over which relays are used for your outbound traffic, and you certainly never have control over which relays are used for your inbound traffic. This causes many many problems with reliability. Connectivity to some IPv6 sites may work, to others it may not, or performance is really unpredictable etc etc etc.&lt;/p&gt;&#xA;&lt;p&gt;So it is therefore better use i.e. &lt;a href=&quot;http://tunnelbroker.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;tunnelbroker.net&lt;/a&gt;. They provide proper tunnels straight to the real IPv6 internet :)&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-12-05T15:07:56.833" CommentCount="18" ContentLicense="CC BY-SA 3.0" />
  <row Id="24989" PostTypeId="1" AcceptedAnswerId="25007" CreationDate="2015-12-05T01:34:22.863" Score="2" ViewCount="6375" Body="&lt;p&gt;The goal is to forward two different ports 1195 and 1196 from the outside address of the ASA to two different hosts on the inside but on the same port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the addresses used in this example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ASA.Internet   192.168.1.99/24&lt;/li&gt;&#xA;&lt;li&gt;ASA.DMZ        172.16.0.1/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Here is the relevant part of the config for one inside host:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network VPN2&#xA; host 172.16.0.66 &#xA; nat (DMZ,Internet) static interface service udp 1194 1195&#xA;&#xA;object service VPN&#xA; service udp destination eq 1194&#xA;&#xA;access-list Internet_access_in_1 extended permit object VPN any object VPN2&#xA;access-list Internet_access_in_1 extended deny ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;What is the correct way to use packet tracer in this case?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;What is the correct destination port to use in the ACL in this case?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Experiments: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;packet-tracer input internet udp 8.8.8.8 1234 172.16.0.66 1194&lt;/code&gt; (inside IP/port) I get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Phase: 7&#xA;Type: NAT&#xA;Subtype: rpf-check&#xA;Result: DROP&#xA;Config:&#xA;object network VPN2&#xA; nat (DMZ,Internet) static interface service udp 1194 1195&#xA;Additional Information:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;packet-tracer input internet udp 8.8.8.8 1234 192.168.1.99 1195&lt;/code&gt; (outside IP/port) I obviously get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Phase: 4&#xA;Type: ACCESS-LIST&#xA;Subtype:&#xA;Result: DROP&#xA;Config:&#xA;Implicit Rule&#xA;Additional Information:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In any case, packets are currently hitting the firewall on the Internet(outside) interface on udp port 1195 but they aren't seen inside. &lt;code&gt;show nat detail&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  (DMZ) to (Internet) source static VPN2 interface   service udp 1194 1195&#xA;     translate_hits = 0, untranslate_hits = 0&#xA;     Source - Origin: 172.16.0.66/32, Translated: 192.168.1.99/24&#xA;     Service - Protocol: udp Real: 1194 Mapped: 1195&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now what is making me crazy in addition&lt;/strong&gt;, if I add port 1195 to the access list, the following invocation of packet tracer accepts the traffic:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;packet-tracer input internet tcp 8.8.8.8 1234 172.16.0.66 1195&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's the inside IP but the outside port? WT...? &lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="509" LastEditDate="2015-12-06T11:05:49.883" LastActivityDate="2016-12-29T11:28:40.647" Title="ASA 9.1 static PAT (&quot;port forwarding&quot;) not working" Tags="|cisco-asa|nat|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24991" PostTypeId="2" ParentId="24968" CreationDate="2015-12-05T03:53:00.377" Score="1" Body="&lt;p&gt;The easy way to test is to get two identical devices, plug a straight cable between them and see if they link up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect you are looking for older hardware. I'm pretty sure the secondary card in my office desktop (which came out of a collegues junk box) doesn't do auto MDI-X but I don't have the model number handy right now.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-12-05T03:53:00.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24992" PostTypeId="1" AcceptedAnswerId="24998" CreationDate="2015-12-05T05:45:04.777" Score="2" ViewCount="754" Body="&lt;p&gt;My question is simply whether or not BGP speakers can form peer relationships with other routers on the same broadcast domain in the following scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two L3 switches running BGP, let's call them R1 and R2. They both host two of the same networks on (let's say) VLAN 10 and 20 using VRRP. I want to connect a new router each to R1 and R2. R3 connects physically to R1 on VLAN 10, and R4 to R2 on VLAN 20. In this scenario can R4 ever peer with R1, and similarly R3 with R2? Note they are all in the same AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, and I configure both R1 and R2 as route reflectors - is the appropriate configuration to have R1 serve as RR for R2 and R3, while also having R2 as RR for R1 and R4?&lt;/p&gt;&#xA;" OwnerUserId="20792" LastEditorUserId="20792" LastEditDate="2015-12-05T05:55:53.973" LastActivityDate="2015-12-05T14:37:44.793" Title="Must BGP peers be directly connected?" Tags="|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="24998" PostTypeId="2" ParentId="24992" CreationDate="2015-12-05T14:37:44.793" Score="4" Body="&lt;p&gt;Yes, they can.  Since they are all in the same AS, iBGP will peer across multiple hops.  And as you are probably aware, you need all the BGP speakers in a full mesh.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-05T14:37:44.793" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="24999" PostTypeId="1" AcceptedAnswerId="25013" CreationDate="2015-12-05T15:30:15.403" Score="1" ViewCount="132" Body="&lt;p&gt;As I understand it your phone (Android) sends out beacons to ask local access points if they are one of its preferred networks.&#xA;Access points also send out beacons announcing they are there.&#xA;What are the specific names given to these two types of beacons?&lt;/p&gt;&#xA;" OwnerUserId="10132" LastActivityDate="2016-07-03T12:24:11.830" Title="What are the names of the 2 types of beacon a phone and an AP send" Tags="|router|access-point|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25000" PostTypeId="1" AcceptedAnswerId="25004" CreationDate="2015-12-05T15:36:38.823" Score="3" ViewCount="949" Body="&lt;p&gt;This is the topology&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MtUIb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MtUIb.png&quot; alt=&quot;My Network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see routers and switches are all named out, so I will use those names to explain the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all this network consists of VLANs, WANs running on EIGRP and DHCP configured routers, with that out of the way let me explain the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Right Router's network, specifically the one directly connected to the switch, works just fine! Those 2 different VLANs can communicate without any issue whatsoever, keep in mind there are 2 different VLANs on each network except for the Middle one... However, the moment one of the PCs on the Right network (not VLAN but network as a whole) try to communicate (ICMP/Ping) a PC on any of the other networks connected through a WAN connection, it simply fails. Keep in mind the other 2 Networks (Middle and Left) do not suffer from this issue whatsoever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After using the simulation mode the issue was extremely, extremely weird... I first tried to ping from Right Router to Middle Router, and it worked no problems there... Then I tried to ping from a PC on the Right network to the Middle Router... Surprisingly enough, there is no destination IPv4 address in the packet!! What makes this even more weird is that when I try to ping the other way around, namely from the Middle Router to a PC on the Right network, the packet gets dropped &lt;strong&gt;immediately&lt;/strong&gt; at the Middle Router, why? It doesn't know it's &lt;strong&gt;own&lt;/strong&gt; IP address (and yes I did assign it an IP address on the serial port). Here are pictures in detail from Simulation mode:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QN5lS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QN5lS.png&quot; alt=&quot;From PC (Right Network) to Middle Router&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/srOSU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/srOSU.png&quot; alt=&quot;From Middle Router to PC (Right Network)&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Link for Middle Router Configuration&lt;/strong&gt;&#xA;&lt;a href=&quot;http://pastebin.com/MAj8SaAm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pastebin.com/MAj8SaAm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname MRouter&#xA;!&#xA;!&#xA;!&#xA;enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 10.0.0.2 255.255.255.252&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 10.1.1.1 255.255.255.252&#xA; clock rate 128000&#xA;!&#xA;interface Serial0/1/0&#xA; ip address 172.16.10.1 255.255.255.252&#xA; clock rate 128000&#xA;!&#xA;interface Serial0/1/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router eigrp 5&#xA; network 10.0.0.0&#xA; network 172.16.0.0&#xA; auto-summary&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;banner motd ^C&#xA;This is the Middle Router&#xA;^C&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; password cisco&#xA; login&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Link for Right Router Configuration&lt;/strong&gt;&#xA;&lt;a href=&quot;http://pastebin.com/Wk8hCv9Z&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://pastebin.com/Wk8hCv9Z&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname RRouter&#xA;!&#xA;!&#xA;!&#xA;enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0&#xA;!&#xA;!&#xA;!&#xA;ip dhcp pool Right&#xA; network 172.16.1.0 255.255.255.240&#xA; default-router 172.16.1.14&#xA;ip dhcp pool Left&#xA; network 172.16.2.0 255.255.255.240&#xA; default-router 172.16.2.14&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/0.20&#xA; encapsulation dot1Q 20&#xA; ip address 172.16.1.14 255.255.255.240&#xA;!&#xA;interface FastEthernet0/0.25&#xA; encapsulation dot1Q 25&#xA; ip address 172.16.2.14 255.255.255.240&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/0/0&#xA; no ip address&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 10.1.1.2 255.255.255.252&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router eigrp 5&#xA; network 172.16.0.0&#xA; network 10.0.0.0&#xA; auto-summary&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;banner motd ^C&#xA;This is the Right Router&#xA;^C&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; password 7 0822455D0A16&#xA; login&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; password 7 0822455D0A16&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21153" LastEditorUserId="8499" LastEditDate="2018-12-20T03:48:51.100" LastActivityDate="2018-12-20T03:48:51.100" Title="Why can't I ping in this situation?" Tags="|cisco|routing|router|packet-tracer|eigrp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25001" PostTypeId="1" AcceptedAnswerId="25003" CreationDate="2015-12-05T15:41:54.920" Score="0" ViewCount="434" Body="&lt;p&gt;Why don't we use more powerful routers that have better signal reception instead of adding access points to the network?&lt;/p&gt;&#xA;" OwnerUserId="20489" LastEditorUserId="20489" LastEditDate="2016-01-15T16:57:36.560" LastActivityDate="2016-01-15T16:57:36.560" Title="Powerful router or access points" Tags="|router|wireless|ieee-802.11|access-point|" AnswerCount="2" CommentCount="1" ClosedDate="2015-12-29T14:03:33.650" ContentLicense="CC BY-SA 3.0" />
  <row Id="25002" PostTypeId="2" ParentId="24999" CreationDate="2015-12-05T15:50:26.780" Score="0" Body="&lt;p&gt;An end-station would send beacons for an Ad-Hoc network, but not to a WAP. You should really get the scoop directly from the &lt;a href=&quot;http://standards.ieee.org/about/get/802/802.11.html&quot; rel=&quot;nofollow&quot;&gt;IEEE 802.11 Wireless LAN Standards&lt;/a&gt;, but Wikipedia has a description of the &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.11#Management_frames&quot; rel=&quot;nofollow&quot;&gt;management frames&lt;/a&gt; which IEEE 802.11 uses:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Management frames allow for the maintenance of communication. Some&#xA;  common 802.11 subtypes include:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Authentication frame: 802.11 authentication begins with the Wireless    network interface card (WNIC) sending an authentication&#xA;  frame to the    access point containing its identity. With an open&#xA;  system    authentication, the WNIC sends only a single authentication&#xA;  frame,    and the access point responds with an authentication frame&#xA;  of its own    indicating acceptance or rejection. With shared key&#xA;  authentication,    after the WNIC sends its initial authentication&#xA;  request it will    receive an authentication frame from the access&#xA;  point containing    challenge text. The WNIC sends an authentication&#xA;  frame containing the    encrypted version of the challenge text to the&#xA;  access point. The    access point ensures the text was encrypted with&#xA;  the correct key by    decrypting it with its own key. The result of&#xA;  this process determines    the WNIC's authentication status.&lt;/li&gt;&#xA;  &lt;li&gt;Association request frame: Sent from a station it enables the access    point to allocate resources and synchronize. The frame&#xA;  carries    information about the WNIC, including supported data rates&#xA;  and the    SSID of the network the station wishes to associate with.&#xA;  If the    request is accepted, the access point reserves memory and&#xA;  establishes    an association ID for the WNIC.&lt;/li&gt;&#xA;  &lt;li&gt;Association response frame: Sent from an access point to a station    containing the acceptance or rejection to an association request. If&lt;br&gt;&#xA;  it is an acceptance, the frame will contain information such an&lt;br&gt;&#xA;  association ID and supported data rates.&lt;/li&gt;&#xA;  &lt;li&gt;Beacon frame: Sent periodically from an access point to announce its    presence and provide the SSID, and other parameters for WNICs&#xA;  within    range.&lt;/li&gt;&#xA;  &lt;li&gt;Deauthentication frame: Sent from a station wishing to terminate    connection from another station.&lt;/li&gt;&#xA;  &lt;li&gt;Disassociation frame: Sent from a station wishing to terminate    connection. It's an elegant way to allow the access point to&lt;br&gt;&#xA;  relinquish memory allocation and remove the WNIC from the association &#xA;  table.&lt;/li&gt;&#xA;  &lt;li&gt;Probe request frame: Sent from a station when it requires information    from another station.&lt;/li&gt;&#xA;  &lt;li&gt;Probe response frame: Sent from an access point containing capability    information, supported data rates, etc., after receiving&#xA;  a probe    request frame.&lt;/li&gt;&#xA;  &lt;li&gt;Reassociation request frame: A WNIC sends a reassociation request    when it drops from range of the currently associated access point and &#xA;  finds another access point with a stronger signal. The new access&lt;br&gt;&#xA;  point coordinates the forwarding of any information that may still be &#xA;  contained in the buffer of the previous access point.&lt;/li&gt;&#xA;  &lt;li&gt;Reassociation response frame: Sent from an access point containing    the acceptance or rejection to a WNIC reassociation request frame.&lt;br&gt;&#xA;  The frame includes information required for association such as the&lt;br&gt;&#xA;  association ID and supported data rates.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-05T15:50:26.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25003" PostTypeId="2" ParentId="25001" CreationDate="2015-12-05T15:59:45.123" Score="1" Body="&lt;p&gt;I'm not sure I really understand the question, but I think you are confused. Why would routers have better signal reception that WAPs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router with Wi-Fi capability merely has a WAP added to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAPs may be placed where you wouldn't place a router (e.g., in the ceiling in the middles of a room), moving the WAP closer to the clients. Multiple WAPs can all be on the same LAN, allowing roaming without reauthentication.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-05T15:59:45.123" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25004" PostTypeId="2" ParentId="25000" CreationDate="2015-12-05T16:33:15.943" Score="6" Body="&lt;p&gt;You have the &lt;code&gt;10.0.0.0/8&lt;/code&gt; and &lt;code&gt;172.16.0.0/16&lt;/code&gt; networks defined on both the middle and right routers. Using &lt;code&gt;auto-summary&lt;/code&gt; on both makes each think they own those whole summarized networks, so they will not send any traffic in those networks toward the other router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;no auto-summary&lt;/code&gt; will allow each router to understand the more specific routes of each router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-05T16:33:15.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25006" PostTypeId="2" ParentId="11202" CreationDate="2015-12-06T00:13:54.673" Score="2" Body="&lt;p&gt;I think it reallly comes down to how you define &quot;modulation&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One definition (taking from the first paragraph of the wikipedia &quot;modulation&quot; article):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In electronics and telecommunications, modulation is the process of varying one or more properties of a periodic waveform, called the carrier signal, with a modulating signal that typically contains information to be transmitted.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;By that definition the line coding schemes used by modern network cards would not qualify as &quot;modulation&quot; (you could argue that the Manchester Encoding used by 10 megabit ethernet does count as modulating a carrier). On the other hand the schemes used by modern dialup modems wouldn't either&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand if we take a broader view of the term modulation as covering any scheme designed to take a signal and encode it as a waveform whose voltage and frequency characteristics suitable for a given channel then the coding schemes used by ethernet would count.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice the term &quot;modem&quot; is typically used for devices used over channels that were not specifically built to carry data. That doesn't imply much at a technical level though.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-12-06T00:13:54.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25007" PostTypeId="2" ParentId="24989" CreationDate="2015-12-06T02:06:07.027" Score="1" Body="&lt;p&gt;There was a manual Dynamic PAT (Hide) to any in NAT section 1. I moved it to after-auto (section 3) and all is good...&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2015-12-06T02:06:07.027" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25008" PostTypeId="1" AcceptedAnswerId="25009" CreationDate="2015-12-06T03:55:55.707" Score="2" ViewCount="2934" Body="&lt;p&gt;I'm trying to understand if two ports on the same switch, are in portfast mode, will a loop be created when the two ports are connected to each other.  i.e. if FastEthernet 0/2 and 0/3 are both set to portfast and are then connected via an ethernet cable directly to each other, or via a hub, will one of the ports go into 'blocking'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tested this behavior using Cisco's Packet Tracer and FastEthernet 0/3 ends up being blocked.  Below is an excerpt from the running config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;spanning-tree mode rapid-pvst&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/2&#xA; spanning-tree portfast&#xA;!&#xA;interface FastEthernet0/3&#xA; spanning-tree portfast&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following is the show spanning-tree output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show spanning-tree &#xA;VLAN0001&#xA;  Spanning tree enabled protocol rstp&#xA;  Root ID    Priority    32769&#xA;             Address     0060.3EB7.B631&#xA;             Cost        19&#xA;             Port        1(FastEthernet0/1)&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)&#xA;             Address     00D0.D315.4BD5&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  20&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Fa0/3            Altn BLK 19        128.3    Shr&#xA;Fa0/2            Desg FWD 19        128.2    Shr&#xA;Fa0/1            Root FWD 19        128.1    P2p&#xA;&#xA;Switch#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the behavior described above, is expected when using portfast, what advantage is there to using bpduguard?  As it would appear a lot sources recommend using portfast and bpduguard together.&lt;/p&gt;&#xA;" OwnerUserId="21159" LastEditorUserId="8499" LastEditDate="2018-03-18T19:53:07.747" LastActivityDate="2018-03-18T19:53:07.747" Title="Will STP portfast prevent a loop?" Tags="|cisco|switch|switching|spanning-tree|packet-tracer|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25009" PostTypeId="2" ParentId="25008" CreationDate="2015-12-06T04:23:57.067" Score="4" Body="&lt;p&gt;Port fast bypasses the usual STP phases and goes straight into forwarding. This is useful for ports connected to end-devices which use DHCP. It does not stop BPDUs, and there are those who advocate using it on all ports, although Cisco has a &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10553-12.html&quot; rel=&quot;nofollow&quot;&gt;different take&lt;/a&gt; on it:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Caution:&lt;/strong&gt;  Never use the PortFast feature on switch ports that connect to other switches, hubs, or routers. These connections can&#xA;  cause physical loops, and spanning tree must go through the full&#xA;  initialization procedure in these situations. A spanning tree loop can&#xA;  bring your network down. If you turn on PortFast for a port that is&#xA;  part of a physical loop, there can be a window of time when packets&#xA;  are continuously forwarded (and can even multiply) in such a way that&#xA;  the network cannot recover.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;BPDU guard will disable (errdisable) a port which receives BPDUs. The helps to prevent rogue switches and STP loops. Cisco has a &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10586-65.html&quot; rel=&quot;nofollow&quot;&gt;document&lt;/a&gt; which explains BPDU guard:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Feature Description&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;STP configures meshed topology into a loop-free, tree-like topology.&#xA;  When the link on a bridge port goes up, STP calculation occurs on that&#xA;  port. The result of the calculation is the transition of the port into&#xA;  forwarding or blocking state. The result depends on the position of&#xA;  the port in the network and the STP parameters. This calculation and&#xA;  transition period usually takes about 30 to 50 seconds. At that time,&#xA;  no user data pass via the port. Some user applications can time out&#xA;  during the period.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In order to allow immediate transition of the port into forwarding&#xA;  state, enable the STP PortFast feature. PortFast immediately&#xA;  transitions the port into STP forwarding mode upon linkup. The port&#xA;  still participates in STP. So if the port is to be a part of the loop,&#xA;  the port eventually transitions into STP blocking mode.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;As long as the port participates in STP, some device can assume the&#xA;  root bridge function and affect active STP topology. To assume the&#xA;  root bridge function, the device would be attached to the port and&#xA;  would run STP with a lower bridge priority than that of the current&#xA;  root bridge. If another device assumes the root bridge function in&#xA;  this way, it renders the network suboptimal. This is a simple form of&#xA;  a denial of service (DoS) attack on the network. The temporary&#xA;  introduction and subsequent removal of STP devices with low (0) bridge&#xA;  priority cause a permanent STP recalculation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The STP PortFast BPDU guard enhancement allows network designers to&#xA;  enforce the STP domain borders and keep the active topology&#xA;  predictable. The devices behind the ports that have STP PortFast&#xA;  enabled are not able to influence the STP topology. At the reception&#xA;  of BPDUs, the BPDU guard operation disables the port that has PortFast&#xA;  configured. The BPDU guard transitions the port into errdisable state,&#xA;  and a message appears on the console.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-06T04:23:57.067" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="25011" PostTypeId="2" ParentId="24902" CreationDate="2015-12-06T08:15:05.890" Score="0" Body="&lt;p&gt;I just solved this problem using the Unity Connection Audio Text Manger , it worked fine now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its also much better than using the Media Master if you want to upload a new audio file to the for your greeting message.&lt;/p&gt;&#xA;" OwnerUserId="21075" LastActivityDate="2015-12-06T08:15:05.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25013" PostTypeId="2" ParentId="24999" CreationDate="2015-12-06T09:00:17.793" Score="2" Body="&lt;p&gt;According to this &lt;a href=&quot;http://edwardkeeble.com/2014/02/passive-wifi-tracking/&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt;, the signals your phone sends out are called Probe Requests and the signals the Router/AP sends out are called Beacon Frames.&lt;/p&gt;&#xA;" OwnerUserId="10132" LastActivityDate="2015-12-06T09:00:17.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25015" PostTypeId="1" CreationDate="2015-12-06T12:05:17.557" Score="4" ViewCount="695" Body="&lt;p&gt;&lt;a href=&quot;http://packetlife.net/blog/2010/jan/7/understanding-nat-address-types/&quot; rel=&quot;nofollow&quot;&gt;http://packetlife.net/blog/2010/jan/7/understanding-nat-address-types/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I have a bunch of hosts connected to a typical router (which is in fact a switch + router) that has a public global IP assigned by my ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hosts use private IPs that are non-routable addresses, and need to be translated using NAT to the public one so that it can talk with the rest of Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, &lt;strong&gt;my router&lt;/strong&gt; is connected to a network of my ISP. It has some IP address in that network, but that address is different than what my public IP address is, right? - it follows from the article linked above:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;by this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static 192.168.0.10 192.0.2.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which assigned a public IP (in other words, inside global IP) &lt;code&gt;192.0.2.10&lt;/code&gt; to the host &lt;code&gt;192.168.0.10&lt;/code&gt;. That's quite weird, because you usually give a public IP to all devices in your network, not to just one host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the inside global IP address is indeed my public IP address, can't I just change my public IP? I guess it has to be configured in the NAT of my home router. If it's not possible, is it just because the router firmware doesn't provide a way to change that IP?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Basically I've seen two ways of doing NAT:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Translating private IP of my host to the public IP of my router with a special port number (that allows the inverse translation back to my private IP to happen when the other host sends a reply).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Translating private IP of my host to a public IP that's &lt;strong&gt;different&lt;/strong&gt; from the public IP of my router. The problem is - how does my NAT router know that his public address used for translation isn't already used by some other host on the Internet?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Do these two methods have different names?&lt;/p&gt;&#xA;" OwnerUserId="20229" LastEditorUserId="20229" LastEditDate="2015-12-06T12:55:00.527" LastActivityDate="2019-06-06T06:45:40.490" Title="NAT - inside global address" Tags="|nat|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25016" PostTypeId="2" ParentId="25015" CreationDate="2015-12-06T13:42:11.460" Score="3" Body="&lt;p&gt;The two kinds of NAT your question is referring to can be categorized as destination NAT, and source NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Destination NAT will typically change a connection to your router from the ISP direction to a destination target that's inside your network.  It's also commonly referred to as port forwarding.  This lets you expose a service that would normally be inaccessible inside your private network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source NAT will change a connection through your router from your local network to a source target that is the router itself, allowing multiple hosts to use a single public address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT can perform other translations, but few others are useful except in niche cases.  Despite the phrasing in your question, a source NAT that you describe is not helpful.  Using a global address that is not functional on the router will have no good effect.  No other device or protocol would keep track of that, so all replies will be forwarded to the device that should have that IP, which would know nothing about your setup and promptly drop them.  If you want to use a different IP, get it set up and functional on the router first.&lt;/p&gt;&#xA;" OwnerUserId="19491" LastActivityDate="2015-12-06T13:42:11.460" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25022" PostTypeId="2" ParentId="25015" CreationDate="2015-12-06T19:24:04.900" Score="3" Body="&lt;p&gt;We aren't going to discuss home routers because home networking and consumer-grade equipment are specifically off-topic, as are question from ISP end-users.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now, my router is connected to a network of my ISP. It has some IP&#xA;  address in that network, but that address is different than what my&#xA;  public IP address is, right?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your router will have an IP address assigned by the ISP which is normally a (your) public IP address unless the ISP is using CGN.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;That's quite weird, because you usually give a public IP to all&#xA;  devices in your network, not to just one host.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You may want to expose one device like a web server (or load-balancer for a group of servers).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the inside global IP address is indeed my public IP address, can't&#xA;  I just change my public IP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You should never use a public address which doesn't belong to you; you will find yourself cut off from the Internet. You may be assigned a block of public IP addresses, and you can use those in any way you want, but using public IP addresses not assigned to you can cause all sorts of problems, and you won't like the results.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If it's not possible, is it just because the router firmware doesn't&#xA;  provide a way to change that IP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can set any valid IP address (public or private) on any router interface, as long as the networks on router interfaces don't overlap or conflict.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Basically I've seen two ways of doing NAT:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Then you haven't really seen much of NAT. See this question, &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/23083/what-do-these-three-options-in-a-cisco-router-nat-configuration-mean&quot;&gt;What do these three options in a Cisco Router NAT configuration mean?&lt;/a&gt;, for more explanation about NAT.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Translating private IP of my host to the public IP of my router with&#xA;  a special port number (that allows the inverse translation back to&#xA;  my private IP to happen when the other host sends a reply).&lt;/li&gt;&#xA;  &lt;li&gt;Translating private IP of my host to a public IP that's different&#xA;  from the public IP of my router. The problem is - how does my NAT&#xA;  router know that his public address used for translation isn't&#xA;  already used by some other host on the Internet?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;Do these two methods have different names?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your number 1 could be Inside Source or Inside Destination. You aren't very clear on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your number 2 could be Inside Source using a pool of public IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-12-06T19:34:54.480" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25024" PostTypeId="1" CreationDate="2015-12-06T20:21:50.057" Score="0" ViewCount="540" Body="&lt;p&gt;I am doing a little research about comparison between 2g and 3g wireless communication technologies in terms of physical OSI layer. I want to focus especially coding differences. However, I couldn't be sure which coding methods are subjects for physical layer. Source coding, channel coding and line coding are coding techniques that I can find by now. Recently, I figured out that channel coding is in link layer (2. layer). My question is which topics I have to focus on.&lt;/p&gt;&#xA;" OwnerUserId="21174" LastActivityDate="2015-12-27T12:21:50.580" Title="Comparison between 2g and 3g in terms of PHYSICAL layer" Tags="|wireless|mobile|telephony|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25025" PostTypeId="2" ParentId="24811" CreationDate="2015-12-07T00:11:48.513" Score="-1" Body="&lt;p&gt;Comcast blocks port 0 and we do deep packet inspection to an extent.&lt;/p&gt;&#xA;" OwnerUserId="21176" LastActivityDate="2015-12-07T00:11:48.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25026" PostTypeId="2" ParentId="25015" CreationDate="2015-12-07T05:55:54.590" Score="2" Body="&lt;p&gt;I am going to answer this from iptables nat table point of view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First method is called MASQUERADING, in which you translate all your private IP addresses with the public IP of outgoing interface (with different source port numbers for reverse translation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second method is what you call source nat or SNAT. You have a pool of public addresses and your private IP addresses are translated using these pool of addresses. PAT can also occur in this case, when the number of connections translated is greater than the pool size.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;how does my NAT router know that his public address used for translation isn't already used by some other host on the Internet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You &lt;strong&gt;DON'T USE&lt;/strong&gt; any public address for NAT translation that isn't assigned to you (Otherwise, reply packets for that connection won't reach you).&lt;/p&gt;&#xA;" OwnerUserId="4213" LastEditorUserId="4213" LastEditDate="2019-06-06T06:45:40.490" LastActivityDate="2019-06-06T06:45:40.490" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25028" PostTypeId="1" AcceptedAnswerId="25039" CreationDate="2015-12-07T08:54:08.900" Score="2" ViewCount="7318" Body="&lt;p&gt;I have an issue with a pair of 2960s switches. I can see a lot of outdiscards on some of the interfaces and the end users are noticing network issues. I also have some access points that can't download the configuration from the controller because of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interfaces are trunks which are connected to other switches in the other end via multimode fiber 100Mbit. They are configured like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet2/0/7&#xA; switchport mode trunk&#xA; speed 100&#xA; duplex full&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The command show interfaces counters errors:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Port        Align-Err     FCS-Err    Xmit-Err     Rcv-Err  UnderSize  OutDiscards &#xA;Gi2/0/17            0         899           0         903          0     42443970&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have searched around via different forums and noticed that some says that this issue is because of the incoming traffic is higher than 100Mbit and forces the switch to discards some packets because it can't send them out on the slow interface. Incoming interface is with Gigabit speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to increase the buffer on the switch for the outgoing traffic or is the only solution to install gigabit traffic on these as well?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it the 2960s that is slow or is it not possible to have different speeds in a LAN environment?&lt;/p&gt;&#xA;" OwnerUserId="21178" LastEditorUserId="8499" LastEditDate="2018-12-22T20:43:25.113" LastActivityDate="2018-12-22T20:43:25.113" Title="2960s and outdiscards" Tags="|cisco|switch|cisco-catalyst|network-core|cisco-2960|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25029" PostTypeId="1" AcceptedAnswerId="25470" CreationDate="2015-12-07T09:28:06.043" Score="2" ViewCount="131" Body="&lt;p&gt;I would like to get advice about client identification connected over gprs network. Is it possible to solve identity in simple TCP packet or exist some higher protocol to obtain IMEI? There is many solutions, but I need to know if exist any standard solution or recommended use cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any advice.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Martin Petřík&lt;/p&gt;&#xA;" OwnerUserId="16879" LastActivityDate="2015-12-27T12:40:39.363" Title="GPRS client identification" Tags="|mobile|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25030" PostTypeId="1" AcceptedAnswerId="25105" CreationDate="2015-12-07T09:50:36.730" Score="4" ViewCount="856" Body="&lt;p&gt;&lt;a href=&quot;http://packetlife.net/blog/2010/mar/15/6to4-ipv6-tunneling/&quot; rel=&quot;nofollow&quot;&gt;http://packetlife.net/blog/2010/mar/15/6to4-ipv6-tunneling/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to configure a 6to4 tunnel on R2 router, you execute the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)# interface tunnel0&#xA;R2(config-if)# tunnel mode ipv6ip 6to4&#xA;R2(config-if)# tunnel source 10.0.2.1&#xA;R2(config-if)# ipv6 address 2002:a00:201::/128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone know why on earth should I specify the Ipv6 address of the tunnel (last command)? The fact that I've written:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config-if)# ipv6 address 2002:a00:201::/128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is not used by R2 at any point, I believe - R2 doesn't need that information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When an IPv6 host behind R1 sends a packet to an IPv6 host &lt;code&gt;2001:db8:0:2::/64&lt;/code&gt; behind R2, the first thing that happens is R1 checks its routing table. We configured R1 in the following way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ipv6 route 2002::/16 tunnel0&#xA;ipv6 route 2001:db8:0:2::/64 2002:a00:201::&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It then puts the IPv6 packet inside an IPv4 packet and sets the &lt;strong&gt;IPv4 destination address&lt;/strong&gt; to 10.0.2.1 - it extracts the destination address from the second address in this line, which created an entry in the routing table: &lt;code&gt;ipv6 route 2001:db8:0:2::/64 2002:a00:201::&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if we didn't set the IPv6 tunnel address on R2 (&lt;code&gt;R2(config-if)# ipv6 address 2002:a00:201::/128&lt;/code&gt;), I guess it wouldn't change anything, because the packet would arrive to R2 anyway. Then why should we do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, 10.0.2.1 is a private IP address, so it shouldn't be used in a 6to4 address (only public IPs are allowed) - I think the article is wrong in this aspect.&lt;/p&gt;&#xA;" OwnerUserId="20229" LastEditorUserId="8499" LastEditDate="2018-03-12T00:23:40.260" LastActivityDate="2018-03-12T00:23:40.260" Title="6to4 - IPv6 tunnel address" Tags="|cisco|ipv4|ip|ipv6|ip-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25032" PostTypeId="1" AcceptedAnswerId="29208" CreationDate="2015-12-07T10:18:47.290" Score="1" ViewCount="244" Body="&lt;p&gt;I am working for a company that is installing a video conferencing e-learning web application that is using a red5 media server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client is complaining that the performance is choppy/slow, and my boss is complaining that their network is probably at fault.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We gace decided that they should run some tests on their network and give us back some numbers related to bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could I have suggestions about which commands/tools to use to get good measurements from 1 computer to the red5 streaming server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Update&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I am now using iperf to get bandwidth for TCP and UDP using the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Tools\iperf-3.0.11-win64&amp;gt;iperf3.exe -c IP_ADDRESS -p 5201&#xA;Connecting to host localhost, port 5201&#xA;[  4] local ::1 port 56453 connected to ::1 port 5201&#xA;[ ID] Interval           Transfer     Bandwidth&#xA;[  4]   0.00-1.00   sec  1.38 MBytes  11.5 Mbits/sec&#xA;[  4]   1.00-2.00   sec  1.12 MBytes  9.44 Mbits/sec&#xA;[  4]   2.00-3.00   sec   640 KBytes  5.24 Mbits/sec&#xA;[  4]   3.00-4.00   sec   768 KBytes  6.29 Mbits/sec&#xA;[  4]   4.00-5.00   sec   768 KBytes  6.29 Mbits/sec&#xA;[  4]   5.00-6.00   sec   768 KBytes  6.29 Mbits/sec&#xA;[  4]   6.00-7.00   sec  1.12 MBytes  9.44 Mbits/sec&#xA;[  4]   7.00-8.00   sec   896 KBytes  7.34 Mbits/sec&#xA;[  4]   8.00-9.00   sec  1.00 MBytes  8.39 Mbits/sec&#xA;[  4]   9.00-10.00  sec   768 KBytes  6.30 Mbits/sec&#xA;- - - - - - - - - - - - - - - - - - - - - - - - -&#xA;[ ID] Interval           Transfer     Bandwidth&#xA;[  4]   0.00-10.00  sec  9.12 MBytes  7.65 Mbits/sec                  sender&#xA;[  4]   0.00-10.00  sec  8.96 MBytes  7.52 Mbits/sec                  receiver&#xA;&#xA;iperf Done.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1762" LastEditorUserId="1762" LastEditDate="2015-12-07T13:35:29.327" LastActivityDate="2016-04-01T11:17:04.363" Title="Testing Bandwidth in preparation of tele conferencing" Tags="|qos|streaming|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25033" PostTypeId="1" AcceptedAnswerId="25034" CreationDate="2015-12-07T11:00:03.483" Score="2" ViewCount="10915" Body="&lt;p&gt;I have a simple confusion about these two kinds of interfaces:&#xA;As far as Fast Ethernet is faster, then why it is not used over WAN connections. Typically, network traffic nowadays between any workstation and the internet is more than that between two workstations on the same network. This is not true always but it is more common.&#xA;Moreover, the serial interface of a router generally hold the traffic of all internal PCs towards the internet. So it has to be faster than internal Ethernet as far as using switches makes any communication between two PCs a one to one communication.&#xA;Can any body clarify this point to me?&lt;/p&gt;&#xA;" OwnerUserId="19816" LastActivityDate="2015-12-08T01:42:30.693" Title="fast ethernet vs serial interface" Tags="|ethernet|wan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25034" PostTypeId="2" ParentId="25033" CreationDate="2015-12-07T12:45:42.843" Score="3" Body="&lt;p&gt;Fast Ethernet over cooper is limited to a max distance of 100 meters over Cat5 or higher category cabling. It makes it impossible to be used over typical WAN lines. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However you can provide a long distance fast ethernet using fiber optics: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;100 BASE-FX can give up to 2 kms for full-duplex over multi-mode optical fiber.&lt;/li&gt;&#xA;&lt;li&gt;100 BASE-SX (&lt;em&gt;not an 802.3 standard&lt;/em&gt;) goes 550m on multi-mode fiber.&lt;/li&gt;&#xA;&lt;li&gt;100 BASE-LX10 can reach 10km using single-mode fiber.&lt;br/&gt;&#xA;[&lt;a href=&quot;https://en.wikipedia.org/wiki/Fast_Ethernet&quot; rel=&quot;nofollow&quot;&gt;Wikipedia Fast_Ethernet&lt;/a&gt;]&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Besides fiber optics, the other predominant WAN media is &lt;em&gt;air&lt;/em&gt;. Typically you use RF, microwaves, wiMAX,etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main problem is that on &lt;em&gt;air&lt;/em&gt; dedicated bandwith is expensive. Having 100 Mbps dedicated could be costly in equipments and licenses. So most systems use a shared spectrum where you can have good speed, but it's a system prone to interferences. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Serial interfaces as RS-232 or V.35 were designed having in mind speeds below 2 Mbps. They aren't useful for today speeds.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="619" LastEditDate="2015-12-08T01:42:30.693" LastActivityDate="2015-12-08T01:42:30.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25035" PostTypeId="1" AcceptedAnswerId="25159" CreationDate="2015-12-07T14:29:49.400" Score="1" ViewCount="1922" Body="&lt;p&gt;I have two ASA 5525-X in cluster. Between them, for Cluster Control Link, I have Switch. When this switch fails, both CCL fail and both ASAs shut down cluster mode. (data interfaces are shut down). ASA in cluster doesnt support connecting to switch stack. What are my options, to achive switch redundancy?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastEditorUserId="8499" LastEditDate="2018-12-22T20:49:05.607" LastActivityDate="2018-12-22T20:49:05.607" Title="How to achive switch redundancy between ASA Cluster Control Link" Tags="|cisco|cisco-asa|firewall|failover|etherchannel|" AnswerCount="1" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="25036" PostTypeId="1" CreationDate="2015-12-07T14:57:56.637" Score="4" ViewCount="1175" Body="&lt;p&gt;I was just wondering why Packet Tracer allows 2 end devices to ping each other even though they're specced with 2 different subnet masks? am i missing something here? i.e.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC1: 192.168.1.10/24&#xA;PC2: 192.168.1.20/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be much appreciated! Cheers&lt;/p&gt;&#xA;" OwnerUserId="21185" LastEditorUserId="8499" LastEditDate="2018-12-20T21:33:49.913" LastActivityDate="2021-08-06T20:53:35.863" Title="Connection between 2 end devices with different subnet masks (Packet Tracer)" Tags="|ip|ipv4|subnet|ping|packet-tracer|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25037" PostTypeId="2" ParentId="25036" CreationDate="2015-12-07T15:28:32.567" Score="1" Body="&lt;p&gt;Those two devices are in the same subnet. When you mask the addreses with the longest mask, they have the same subnet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.10 AND 255.255.255.0 = 192.168.1.0&#xA;192.168.1.20 AND 255.255.255.0 = 192.168.1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If, for instance, the second IP address was 192.168.2.20, it would not work since you would be on two different networks from the perspective of the first one, and it would try to send to its configured gateway instead of the other host:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.10 AND 255.255.255.0 = 192.168.1.0&#xA;192.168.2.20 AND 255.255.255.0 = 192.168.2.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-07T16:08:23.437" LastActivityDate="2015-12-07T16:08:23.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25038" PostTypeId="1" AcceptedAnswerId="25053" CreationDate="2015-12-07T15:31:37.323" Score="2" ViewCount="2568" Body="&lt;p&gt;I'm a student taking the cisco beginners course, but I'm running into some problems with subnetting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have this network setup below, what are the valid number of hosts, and how does one calculate that. If I just take the host bits (n = 11) and apply 2^n then I get 121 as outcome. Which ofcourse is wrong. Could anyone tell me what I'm doing wrong here?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Network address: 10.0.0.0&#xA;Subnet mask: 255.255.248.0&#xA;Network address in binary: 00001010.00000000.00000000.00000000&#xA;Subnet mask in binary:     11111111.11111111.11111000.00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="21186" LastActivityDate="2016-01-07T06:29:38.160" Title="Calculating valid hosts" Tags="|cisco|ipv4|subnet|" AnswerCount="2" CommentCount="1" ClosedDate="2017-08-12T23:25:34.383" ContentLicense="CC BY-SA 3.0" />
  <row Id="25039" PostTypeId="2" ParentId="25028" CreationDate="2015-12-07T15:38:08.473" Score="0" Body="&lt;p&gt;What is probably happening is that your access bandwidth is too big for your uplink bandwidth. The only real solution is to increase the uplink bandwidth. For instance, with 48 100 Mb access ports and only a 100 Mb uplink, one host could monopolize the uplink, forcing the situation you describe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a recommendation for access to distribution bandwidth of 20:1. That is for every 20 access ports of 100 Mb, you need 100 Mb in the uplink. This is for normal everyday use, but if you are streaming something at 1 Gb, you may need something less than 20:1.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-07T16:35:41.210" LastActivityDate="2015-12-07T16:35:41.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25040" PostTypeId="2" ParentId="25029" CreationDate="2015-12-07T15:43:38.113" Score="0" Body="&lt;p&gt;The IMEI is below layer-3 (IP) or layer-4 (TCP) so it will not be transmitted beyond the carrier network to the public Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-07T15:43:38.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25041" PostTypeId="2" ParentId="25036" CreationDate="2015-12-07T16:02:15.890" Score="1" Body="&lt;p&gt;The two host acan ping each other because they are on the same subnet, /16 can contains host located on /24, that is the reason.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2015-12-07T16:02:15.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25043" PostTypeId="1" CreationDate="2015-12-07T17:11:54.203" Score="2" ViewCount="375" Body="&lt;p&gt;The setup is this:&lt;br&gt;&#xA;The linux system (debian 7 as a VBox guest) has the following interfaces:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ip addr&#xA;    1: lo: &amp;lt;LOOPBACK,UP,LOWER_UP&amp;gt; mtu 16436 qdisc noqueue state UNKNOWN &#xA;        link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00&#xA;        inet 127.0.0.1/8 scope host lo&#xA;    2: eth0: &amp;lt;BROADCAST,MULTICAST,UP,LOWER_UP&amp;gt; mtu 1500 qdisc pfifo_fast state UP qlen 1000&#xA;        link/ether 08:00:27:de:a3:54 brd ff:ff:ff:ff:ff:ff&#xA;        inet 201.1.1.1/24 brd 201.1.1.255 scope global eth0&#xA;    3: tap0: &amp;lt;BROADCAST,MULTICAST,UP,LOWER_UP&amp;gt; mtu 1500 qdisc pfifo_fast state UNKNOWN qlen 500&#xA;        link/ether 9e:7a:83:ec:5e:47 brd ff:ff:ff:ff:ff:ff&#xA;        inet 10.0.0.1/24 brd 10.0.0.255 scope global tap0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routing table is populated by a quagga ripv2 daemon and look as follows:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ip route&#xA;10.0.0.0/24 dev tap0  proto kernel  scope link  src 10.0.0.1 &#xA;201.1.1.0/24 dev eth0  proto kernel  scope link  src 201.1.1.1 &#xA;202.1.1.0/24 via 10.0.0.2 dev tap0  proto zebra  metric 2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UDP packets are received from another subnet through interface tap0. Their destination is always 201.1.1.1:30000.&lt;br&gt;&#xA;However, depending on their source address, some of them will be seen or not by a netcat listener.&lt;br&gt;&#xA;This is the tcpdump output:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo /usr/sbin/tcpdump -i tap0 port 30000&#xA;tcpdump: verbose output suppressed, use -v or -vv for full protocol decode&#xA;listening on tap0, link-type EN10MB (Ethernet), capture size 65535 bytes&#xA;17:25:36.060532 IP 10.0.0.2.38353 &amp;gt; 201.1.1.1.30000: UDP, length 6&#xA;17:25:52.073758 IP 202.1.1.1.30000 &amp;gt; 201.1.1.1.30000: UDP, length 457&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And netcat output:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ netcat -vnulp 30000&#xA;listening on [any] 30000 ...&#xA;connect to [10.0.0.1] from (UNKNOWN) [10.0.0.2] 38353&#xA;hello&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 1st packet (len 6, sent with netcat) is correctly received. The 2nd packet (len 457, sent with a datagram socket bound to 202.1.1.1) is not received.&lt;br&gt;&#xA;What should I do to have both packets be correctly received by netcat?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;notes: iptables are empty ; /proc/sys/net/ipv4/ip_forward=1&lt;/p&gt;&#xA;" OwnerUserId="17351" LastEditorUserId="17351" LastEditDate="2015-12-09T07:14:13.467" LastActivityDate="2015-12-09T07:14:13.467" Title="Linux routing: routing between 2 local interfaces depends on source address?" Tags="|routing|ipv4|linux|udp|interface|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-12T23:23:47.570" ContentLicense="CC BY-SA 3.0" />
  <row Id="25047" PostTypeId="2" ParentId="25043" CreationDate="2015-12-07T22:08:18.150" Score="1" Body="&lt;p&gt;The second packet is sourced from an adjacent subnet which appears to have been learned via Quagga (this information would be relevant in your OQ). The &lt;code&gt;tap&lt;/code&gt; interface has obviously received the packet, which &lt;code&gt;tcpdump&lt;/code&gt; is showing you, but it hasn't been handed up the stack to your application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;length&lt;/code&gt; of each packet also gives some clues. Why is the second packet so much larger than the first? Does it contain additional information that your application is not parsing correctly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the fact that the &lt;code&gt;tap0&lt;/code&gt; interface is in state &lt;code&gt;UNKNOWN&lt;/code&gt; is also problematic - it should be in the &lt;code&gt;UP&lt;/code&gt; state. You could try to bridge &lt;code&gt;tap0&lt;/code&gt; and &lt;code&gt;eth0&lt;/code&gt; together (which is how &lt;code&gt;tap&lt;/code&gt; interfaces are traditionally utilized), and then move 201.1.1.1/24 to the newly created &lt;code&gt;br0&lt;/code&gt; interface.&lt;/p&gt;&#xA;" OwnerUserId="762" LastActivityDate="2015-12-07T22:08:18.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25048" PostTypeId="1" AcceptedAnswerId="25062" CreationDate="2015-12-08T00:04:03.383" Score="2" ViewCount="3203" Body="&lt;p&gt;From the book &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/0131411551&quot; rel=&quot;nofollow&quot;&gt;Unix Network Programming&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The frame is received by the datalink on the right based on what we&#xA;  call imperfect filtering, which is done by the interface using the&#xA;  Ethernet destination address. We say this is imperfect because it is&#xA;  normally the case that when the interface is told to receive frames&#xA;  destined to one specific Ethernet multicast address, it can receive&#xA;  frames destined to other Ethernet multicast addresses, too.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The book further goes on to explain why is this filtering imperfect -&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...many current Ethernet interface cards apply a hash function to the&#xA;  address, calculating a value between 0 and 511...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My question is- Ethernet address is 6 bytes, out of which top 3 bytes are constant for any multicast ethernet address. All that is remaining is 3 bytes. Why not compare them, byte by byte instead of all the hash logic. The filtering would be perfect( at least at the ethernet level I mean, at the IP layer we may as well end up detect this frame does not belong to our multicast group) and logic is much more simpler.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What performance benefits does hashing have when contrasted with a simple compare?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: I think there is some confusion here. Its not about 32 IP addresses mapping into a single ethernet address. Cos if such was the case, perfect filtering at the ethernet layer would have been impossible. But the book goes on to give examples of cards that are capable of perfect filtering&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Another interface card does perfect filtering for 80 multicast&#xA;  addresses, but then has to enter multicast promiscuous mode. &lt;strong&gt;Even if&#xA;  the interface performs perfect filtering, perfect software filtering&#xA;  at the IP layer is still required because the mapping from the IP&#xA;  multicast address to the hardware address is not one-to-one&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The bolded line clearly states that the 32-1 mapping problem exists at the IP layer and not the ethernet layer.&lt;/p&gt;&#xA;" OwnerUserId="21194" LastEditorUserId="21194" LastEditDate="2015-12-08T00:28:01.547" LastActivityDate="2015-12-08T19:36:01.760" Title="Why is a hash used instead of a simple compare for filtering multicast frames?" Tags="|ethernet|ipv4|multicast|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25049" PostTypeId="2" ParentId="25048" CreationDate="2015-12-08T00:14:53.540" Score="0" Body="&lt;p&gt;What the book is describing is that a layer-3 multicast IP address is 32-bits, but the multicast group part of a layer-2 multicast MAC address is only 23 bits because the first 25 bits of the layer-2 multicast MAC address are fixed. It is an imperfect match, and a layer-2 multicast MAC address maps to multiple layer-3 multicast IP addresses. Each layer-2 multicast address maps to 32 layer-3 multicast addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose you want to subscribe to one layer-3 multicast group, but you want to filter a different layer-3 multicast group, and those two different layer-3 multicast groups map to the same layer-2 multicast address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-08T00:14:53.540" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25051" PostTypeId="2" ParentId="25048" CreationDate="2015-12-08T01:23:56.967" Score="1" Body="&lt;p&gt;Multicast (IPv4) is 224/4. So it's a 28-bit layer-3 address space. That has to be put into a 23-bit layer-2 (ethernet) address space. As such, there's some overlap. But that isn't what the book is talking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast is fundamentally broadcast, so a nic will &quot;see&quot; all multicast traffic. A NIC that understands multicast -- and there &lt;em&gt;are&lt;/em&gt; NICs that don't -- implements an internal &quot;multicast filter&quot; to determine what to send up to the OS. For a number of reasons (mainly speed and simplicity), it was popular to use a hash function (bunch of xor's) based on a very limited number of entries in a filter table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Several (exact numbers I've never bothered to count) linux drivers &quot;gave up&quot;. If multicast is enabled on the interface, it sets the chip to &quot;all_multi&quot; mode (multicast promiscuous mode) and does filtering in the driver.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-12-08T01:23:56.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25052" PostTypeId="2" ParentId="25038" CreationDate="2015-12-08T01:48:40.563" Score="0" Body="&lt;p&gt;I made a video for my class to explain a simple way to understand the concept. If you need help understanding Class A subnetting, you should watch &lt;a href=&quot;https://www.youtube.com/watch?v=tzyRGqLqiao&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=tzyRGqLqiao&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="19896" LastActivityDate="2015-12-08T01:48:40.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25053" PostTypeId="2" ParentId="25038" CreationDate="2015-12-08T06:00:23.910" Score="2" Body="&lt;p&gt;How is 2^11 = 121? Firstly, 2^11 = 2048. The formula for finding the number of valid hosts are (2^n)-2 which is 2046. The 2 being the broadcast address and network address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example you've given, 10.0.0.0 is given as the network ID. Since the mask is a 255.255.248.0 one, it means that the hosts jump in terms of 8 hosts, and will have 32 subnets. The broadcast ID of the first network will be 10.0.7.255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the network ID of the next subnet will be 10.0.8.0, while it's broadcast ID will be 10.0.15.255 and so on. You're not clear with your logic of subnetting. Please watch a few videos on how to subnet. I suggest &lt;a href=&quot;https://www.youtube.com/watch?v=TMjo-Iphjyo&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; one and the rest of their series.&lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2015-12-08T06:00:23.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25055" PostTypeId="2" ParentId="8224" CreationDate="2015-12-08T10:27:07.227" Score="0" Body="&lt;p&gt;I'm a GNS3 developer, and It's strange nobody has reported this issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seem to be a problem with your computer or the terminal you are using. I recommend to test with a different terminal application.&lt;/p&gt;&#xA;" OwnerUserId="21202" LastEditorUserId="8499" LastEditDate="2015-12-08T15:26:36.033" LastActivityDate="2015-12-08T15:26:36.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25056" PostTypeId="1" AcceptedAnswerId="25126" CreationDate="2015-12-08T11:34:45.727" Score="3" ViewCount="9338" Body="&lt;p&gt;I'm trying to setup an iBGP session between two nodes running BIRD 1.4.5 in my lab network but I can't establish a working session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My config looks like this on both hosts except the different neighbor ip and router id:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };&#xA;router id 10.142.0.6;&#xA;debug protocols all;&#xA;&#xA;protocol kernel {&#xA;import none;&#xA;export filter {&#xA;    if source = RTS_STATIC then reject;&#xA;    accept;&#xA;  };&#xA;&#xA;}&#xA;&#xA;protocol static {&#xA;    route 10.142.120.0/22 reject;&#xA;}&#xA;&#xA;protocol bgp {&#xA;    local as 76118;&#xA;    neighbor 10.142.12.2 as 76118;&#xA;    export where source=RTS_STATIC;&#xA;    import all;&#xA;    direct;&#xA;    next hop self;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The two hosts are connected via a tinc vpn and are both in the 10.142.12.0/24 subnet. The interfaces are configured properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this setup there is no error in my log files but the BGP session is only in idle state. I've checked my config with some other people running almost the same config and it works for them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I remove the &quot;direct&quot; and &quot;next hop self&quot; config options it results in this routes in the master routing table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.142.112.0/22    unreachable [bgp1 16:38:55 from 10.142.12.2] * (100/-) [i]&#xA;10.142.120.0/22    unreachable [static1 16:25:50] * (200)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21205" LastEditorUserId="21205" LastEditDate="2015-12-08T13:20:14.133" LastActivityDate="2015-12-10T21:41:02.257" Title="Establish an iBGP connection using BIRD" Tags="|routing|bgp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25058" PostTypeId="1" CreationDate="2015-12-08T12:45:27.180" Score="2" ViewCount="6407" Body="&lt;p&gt;I have configured a network in Packet Tracer with 5 switches and connected them all together. Then, I configured a priority of 0 and wanted to see how the election of the root bridge takes effect.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)#spanning-tree vlan 1 priority 0&#xA;Switch#show spanning-tree vlan 1&#xA;VLAN0001&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    1&#xA;             Address     0060.47A2.34E8&#xA;             This bridge is the root&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    1  (priority 0 sys-id-ext 1)&#xA;             Address     0060.47A2.34E8&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  20&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Fa0/1            Desg LRN 19        128.1    P2p&#xA;Fa0/3            Desg FWD 19        128.3    P2p&#xA;Fa0/4            Desg FWD 19        128.4    P2p&#xA;Fa0/2            Desg FWD 19        128.2    P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why do I have a priority 1 and not 0?&lt;/p&gt;&#xA;" OwnerUserId="21208" LastActivityDate="2015-12-08T15:29:49.207" Title="Set priority of bridge to 0 but root bridge shows now priority 1 in STP" Tags="|cisco|switch|spanning-tree|packet-tracer|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25059" PostTypeId="2" ParentId="25058" CreationDate="2015-12-08T13:56:06.513" Score="3" Body="&lt;p&gt;Your clue is in the listing you posted:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Bridge ID  Priority    1  (priority 0 sys-id-ext 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The priority is made up of two parameters: the priority value you set (0) and the extended ID (sys-ext-id) The sys-ext-id identifies the specific instance of STP on the switch (Cisco by default runs a separate instance for each VLAN).  In this case you're using VLAN 1, so that is the sys-ext-id.  Combining the two (0 and 1) gives you 1 as the bridge priority.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-08T13:56:06.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25060" PostTypeId="2" ParentId="25058" CreationDate="2015-12-08T15:23:38.890" Score="1" Body="&lt;p&gt;As Ron Trunk pointed out, the switch priority is a 16-bit value made up of two parts: the bridge priority is the high-order four bits, and the VLAN number is the low-order 12 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/configuration/guide/2960scg/swstp.html#wp1236904&quot; rel=&quot;nofollow&quot;&gt;Cisco document&lt;/a&gt; has a diagram demonstrating this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Bridge ID, Switch Priority, and Extended System ID&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The IEEE 802.1D standard requires that each switch has an unique&#xA;  bridge identifier (bridge ID), which controls the selection of the&#xA;  root switch. Because each VLAN is considered as a different logical&#xA;  bridge with PVST+ and rapid PVST+, the same switch must have a&#xA;  different bridge IDs for each configured VLAN. Each VLAN on the switch&#xA;  has a unique 8-byte bridge ID. The 2 most-significant bytes are used&#xA;  for the switch priority, and the remaining 6 bytes are derived from&#xA;  the switch MAC address.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The switch supports the IEEE 802.1t spanning-tree extensions, and some&#xA;  of the bits previously used for the switch priority are now used as&#xA;  the VLAN identifier. The result is that fewer MAC addresses are&#xA;  reserved for the switch, and a larger range of VLAN IDs can be&#xA;  supported, all while maintaining the uniqueness of the bridge ID. As&#xA;  shown in Table 17-1, the 2 bytes previously used for the switch&#xA;  priority are reallocated into a 4-bit priority value and a 12-bit&#xA;  extended system ID value equal to the VLAN ID.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-08T15:29:49.207" LastActivityDate="2015-12-08T15:29:49.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25062" PostTypeId="2" ParentId="25048" CreationDate="2015-12-08T19:36:01.760" Score="4" Body="&lt;p&gt;The main benefit of hashing rather than a simple compare is that you can do one lookup for any number of enabled multicast addresses. The system that has an exact match for 80 addresses will either have to build logic to fetch 80 addresses into a comparator in turn, or have 80 comparators in parallel. That's a lot of gates, even if it is simple in concept. And that's all extra cost and power.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast, a hash lookup can be easily implemented with a shift register and a few XOR gates. The computation and shifts can be done as the bits arrive on the wire. &lt;em&gt;Even better, the NIC is doing this already, in order to calculate the checksum.&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note also, that Stevens was writing 20-25 years ago; whilst it is still more or less the definitive work on TCP/IP, hardware has come along since then. The cost of adding a few thousand more gates won't make so much difference.&#xA;Flicking through a few NIC datasheets, most opt for a hybrid approach: e.g. 16 exact addresses and a 4096 bit hashtable. &lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2015-12-08T19:36:01.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25065" PostTypeId="1" CreationDate="2015-12-08T20:45:10.510" Score="2" ViewCount="476" Body="&lt;p&gt;We have two ASA 5505s.  One accepts remote connections from clients coming into our office, the other has a tunnel from our office into AWS.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the attached diagram, the red lines denote ping paths.  I'm able to ping from a VPN client all the way to the AWS-VPN ASA.  I'm also able to ping from an AWS instance all the way to the remote access VPN ASA.  But I can't seem to ping past these firewalls into the VPN tunnel/clients they support.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've attached the routing tables of each ASA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/22vay.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/22vay.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA-01&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is x.58.107.57 to network 0.0.0.0&#xA;&#xA;S*    0.0.0.0 0.0.0.0 [1/0] via x.58.107.57, OUTSIDE&#xA;C        x.58.107.56 255.255.255.252 is directly connected, OUTSIDE&#xA;L        x.58.107.58 255.255.255.255 is directly connected, OUTSIDE&#xA;C        172.16.0.0 255.255.252.0 is directly connected, COMPUTE&#xA;L        172.16.0.1 255.255.255.255 is directly connected, COMPUTE&#xA;C        172.16.8.0 255.255.254.0 is directly connected, GUEST&#xA;L        172.16.8.1 255.255.255.255 is directly connected, GUEST&#xA;C        172.16.10.0 255.255.254.0 is directly connected, TRUSTED&#xA;L        172.16.10.1 255.255.255.255 is directly connected, TRUSTED&#xA;C        172.16.12.0 255.255.254.0 is directly connected, DMZ&#xA;L        172.16.12.1 255.255.255.255 is directly connected, DMZ&#xA;S     172.30.0.0 255.255.0.0 [1/0] via 172.16.0.2, COMPUTE&#xA;C        192.168.255.0 255.255.255.0 is directly connected, INFERNO&#xA;L        192.168.255.1 255.255.255.255 is directly connected, INFERNO&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASA-02&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is x.142.10.213 to network 0.0.0.0&#xA;&#xA;S*    0.0.0.0 0.0.0.0 [1/0] via x.142.10.213, OUTSIDE-PHONES&#xA;C        x.142.10.212 255.255.255.252 is directly connected, OUTSIDE-PHONES&#xA;L        x.142.10.214 255.255.255.255 is directly connected, OUTSIDE-PHONES&#xA;C        172.16.0.0 255.255.252.0 is directly connected, COMPUTE&#xA;L        172.16.0.2 255.255.255.255 is directly connected, COMPUTE&#xA;S        172.16.4.0 255.255.255.0 [1/0] via 172.16.0.1, COMPUTE&#xA;C        172.16.60.0 255.255.254.0 is directly connected, PHONES&#xA;L        172.16.60.1 255.255.255.255 is directly connected, PHONES&#xA;S     172.30.0.0 255.255.0.0 [1/0] via x.142.10.213, OUTSIDE-PHONES&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3702" LastActivityDate="2015-12-09T14:01:58.230" Title="Remote Access VPN traffic is not properly routing through to Site-To-Site VPN tunnel (Cisco ASA)" Tags="|cisco|vpn|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25066" PostTypeId="1" AcceptedAnswerId="25069" CreationDate="2015-12-08T21:02:21.660" Score="1" ViewCount="1351" Body="&lt;pre&gt;&lt;code&gt;Device  Interface   Number of Hosts Subnet  Subnet Mask&#xA;&#xA;London&#xA;        Fa0/0         30           193.10.156.0     255.255.255.224&#xA;        Fa0/1         20           193.10.156.32    255.255.255.224&#xA;        S0/0/1        2            193.10.156.64    255.255.255.252&#xA;        S0/0/0        2            193.10.156.68    255.255.255.252&#xA;&#xA;Edinburgh   &#xA;        Fa0/0         10           193.10.156.72    255.255.255.240&#xA;        Fa0/1         15           193.10.156.88    255.255.255.224&#xA;        S0/0/1        2            193.10.156.64    255.255.255.252&#xA;Cardiff &#xA;        Fa0/0         14           193.10.156.120   255.255.255.224&#xA;        Fa0/1         8            193.10.156.136   255.255.255.240&#xA;        S0/0/0        2            193.10.156.68    255.255.255.252&#xA;&#xA;&#xA;Device  Interface   IP Address  Subnet Mask Default Gateway&#xA;&#xA;London  &#xA;    Fa0/0   193.10.156.1    255.255.255.224 N/A&#xA;    Fa0/1   193.10.156.33   255.255.255.224 N/A&#xA;    S0/0/1  193.10.156.65   255.255.255.252 N/A&#xA;    S0/0/0  193.10.156.69   255.255.255.252 N/A&#xA;    Lo0     183.32.43.254   255.255.255.252 N/A&#xA;Edinburgh&#xA;    Fa0/0   193.10.156.73   255.255.255.240 N/A&#xA;    Fa0/1   193.10.156.89   255.255.255.224 N/A&#xA;    S0/0/1  193.10.156.66   255.255.255.252 N/A&#xA;&#xA;Cardiff&#xA;    Fa0/0   193.10.156.121  255.255.255.224 N/A&#xA;    Fa0/1   193.10.156.137  255.255.255.240 N/A&#xA;    S0/0/0  193.10.156.70   255.255.255.252 N/A&#xA;    PC1     193.10.156.30   255.255.255.224 193.10.156.1&#xA;    PC2     193.10.156.62   255.255.255.224 193.10.156.33&#xA;    PC3     193.10.156.86   255.255.255.240 193.10.156.73&#xA;    PC4     193.10.156.118  255.255.255.224 193.10.156.89&#xA;    PC5     193.10.156.134  255.255.255.240 193.10.156.137&#xA;    PC6     193.10.156.150  255.255.255.224 193.10.156.121&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Dsoy7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Dsoy7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FA interface will get the first usable IP address and the PCs will get the last one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get an error when i do the addressing the overlap error. Did i do something wrong on the addressing?&lt;/p&gt;&#xA;" OwnerUserId="21218" LastEditorUserId="8499" LastEditDate="2015-12-08T22:11:47.260" LastActivityDate="2015-12-08T22:11:47.260" Title="Overlap Error (possible subnetting mistake)" Tags="|cisco|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25069" PostTypeId="2" ParentId="25066" CreationDate="2015-12-08T21:56:57.467" Score="0" Body="&lt;p&gt;You have overlapping networks for London and Edinburgh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;London:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    S0/0/1        2            193.10.156.64    255.255.255.252&#xA;    S0/0/0        2            193.10.156.68    255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Overlaps with Edinburgh:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Fa0/0         10           193.10.156.72    255.255.255.240&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you mask the Edinburgh &lt;code&gt;193.10.156.72&lt;/code&gt; with &lt;code&gt;255.255.2555.240&lt;/code&gt; you get a subnet address of &lt;code&gt;193.10.156.64&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;193.10.156.72   = 11000001.00001010.10011100.01001000&#xA;255.255.255.240 = 11111111.11111111.11111111.11110000&#xA;                  ===================================&#xA;                  11000001.00001010.10011100.01000000 = 193.10.156.64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can't just make up a subnet address and mask like &lt;code&gt;193.10.156.72 255.255.255.240&lt;/code&gt;, you actually should mask the address to see if you got the subnet. In this case, you didn't.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-08T22:03:42.473" LastActivityDate="2015-12-08T22:03:42.473" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25070" PostTypeId="1" CreationDate="2015-12-08T22:01:42.900" Score="0" ViewCount="41" Body="&lt;p&gt;right now this is our current BGP config. we have two class C's and two ISP's. we would like both networks to prefer the Verizon path 157.130.124.197 for inbound over ATT while we do maintenance on the ATT circuit and would like some advice on the best way of doing this. thank you&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 1123&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; network 12.80.93.0 mask 255.255.255.0&#xA; network 208.220.256.0&#xA; neighbor 12.88.105.13 remote-as 7020&#xA; neighbor 12.88.105.13 version 4&#xA; neighbor 12.88.105.13 send-community&#xA; neighbor 157.131.125.121 remote-as 704&#xA; neighbor 157.131.125.121 version 4&#xA; neighbor 157.131.125.121 send-community&#xA; no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21222" LastEditorUserId="509" LastEditDate="2015-12-09T08:06:55.600" LastActivityDate="2015-12-09T08:06:55.600" Title="BGP routing multi-homes router" Tags="|bgp|cisco-ios|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25071" PostTypeId="2" ParentId="25070" CreationDate="2015-12-08T22:08:10.930" Score="4" Body="&lt;p&gt;Shut down your BGP session with ATT and wait a few minutes for BGP to converge globally, that should do the trick.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2015-12-08T22:08:10.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25073" PostTypeId="1" CreationDate="2015-12-09T04:24:14.997" Score="1" ViewCount="5897" Body="&lt;p&gt;I see that the calculated window size is set to 5888 with the three handshake, however it jumps to 7808 with the first ACK.&#xA;Can someone explain me why and what algorithm Linux (Linux OS and Wireshark) used to calculate this window?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand window scaling concept and I don't have any congestion or slow start at this point of time. 5888 was SYN. 2000 in flight after two seg push. So you have 3888 available now. At this point you send ACK 1001, so the receiver shoots out ACK with updated window size (3888+1000=4888). But I see 7808! How? I observe such increase for every ack, unable to quantitatively reason this out.&lt;/p&gt;&#xA;" OwnerUserId="20326" LastEditorUserId="8499" LastEditDate="2015-12-09T15:04:05.350" LastActivityDate="2015-12-09T23:43:26.860" Title="Calculated window size in Wireshark" Tags="|wireshark|linux|packet-analysis|packet-tracer|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25074" PostTypeId="1" AcceptedAnswerId="25300" CreationDate="2015-12-09T06:10:00.480" Score="3" ViewCount="1793" Body="&lt;p&gt;I'm trying to configure an IPSec tunnel between a Cisco router (ISR) and AWS (Customer Gateway). The connection to the ISP here is a PPPoE connection with a static private IP (e.g. 10.100.1.1) which is mapped to from a public IP,  (e.g. 160.1.1.1 ). There is no filtering on the public IP, all traffic is translated to the private.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am now trying to configure the IPSec tunnel, but am not able to get it up. The recommended configuration provided to configure a tunnel if I had a public IP is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto keyring preshared-key-public&#xA;  local-address 160.1.1.1&#xA;  pre-shared-key address 54.1.1.1 key XXX ! AWS IP&#xA;&#xA;crypto isakmp profile isakmp-vpn-public&#xA;  keyring preshared-key-public&#xA;  match identity address 54.1.1.1 255.255.255.255&#xA;  local-address 160.1.1.1&#xA;&#xA;interface Tunnel1&#xA;  ip address 169.1.1.1 255.255.255.252&#xA;  tunnel source 160.1.1.1&#xA;  tunnel destination 54.1.1.1&#xA;  tunnel mode ipsec ipv4&#xA;  tunnel protection ipsec profile pfs-group2-sometransform&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the config I am using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto keyring preshared-key-private&#xA;  local-address 10.100.1.1&#xA;  pre-shared-key address 54.1.1.1 key XXX&#xA;&#xA;crypto isakmp profile isakmp-vpn-private&#xA;  keyring preshared-key-private&#xA;  match identity address 54.1.1.1 255.255.255.255&#xA;  local-address 10.100.1.1&#xA;&#xA;interface Tunnel1&#xA;  tunnel source 10.100.1.1&#xA;  ! everything else is the same&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I have modified the 3 occurrences of public IPs with the private IP (based on &lt;a href=&quot;http://blog.brianbeach.com/2015/05/configuring-aws-customer-gateway-behind.html&quot; rel=&quot;nofollow&quot;&gt;http://blog.brianbeach.com/2015/05/configuring-aws-customer-gateway-behind.html&lt;/a&gt;), but the tunnel does not come up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Dec  8 : ISAKMP: Error: payload length of VENDOR 0 &amp;lt; 4&#xA;*Dec  8 : %CRYPTO-4-IKMP_BAD_MESSAGE: IKE message from 54.1.1.1    failed its sanity check or is malformed&#xA;*Dec  8 : ISAKMP (0:0): incrementing error counter on sa, attempt 1 of 5: PAYLOAD_MALFORMED&#xA;*Dec  8 : ISAKMP:(0:0:N/A:0): sending packet to 54.1.1.1 my_port 500 peer_port 500 (I) MM_NO_STATE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I initially thought that the &lt;code&gt;0 &amp;lt; 4&lt;/code&gt; error might be related to this bug: &lt;a href=&quot;https://tools.cisco.com/quickview/bug/CSCee74283&quot; rel=&quot;nofollow&quot;&gt;https://tools.cisco.com/quickview/bug/CSCee74283&lt;/a&gt; but firmware is a fixed version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco IOS Software, 2801 Software, Version 12.4(25c), RELEASE SOFTWARE (fc2)&#xA;ROM: System Bootstrap, Version 12.4(13r)T, RELEASE SOFTWARE (fc1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can confirm that the preshared secret is configured correctly, I downloaded the configuration from AWS and copied it into the Cisco config. Is the setup correct? Any ideas as to what might be wrong? I am not sure if I am meant to be using the private IP in all 3 locations (&lt;code&gt;keyring&lt;/code&gt;, &lt;code&gt;isakmp profile&lt;/code&gt; and &lt;code&gt;interface&lt;/code&gt;), or should 1 of them reference the public IP (I've tried using it in &lt;code&gt;keyring&lt;/code&gt; and &lt;code&gt;isakmp profile&lt;/code&gt; but it didn't work either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before providing a public / NAT / private setup, the ISP used to provide an L2TP tunnel where the public static IP was on the router, and that worked fine. However the L2TP tunnel is no longer available (but this router / software worked with AWS in that environment)&lt;/p&gt;&#xA;" OwnerUserId="18938" LastEditorUserId="775" LastEditDate="2021-05-04T23:35:52.587" LastActivityDate="2021-05-04T23:35:52.587" Title="Cisco ipsec tunnel with nat to aws customer gateway" Tags="|cisco-ios|ipsec|aws|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25076" PostTypeId="1" CreationDate="2015-12-09T08:42:28.157" Score="1" ViewCount="76" Body="&lt;p&gt;I am newbie to network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been learned What hub is in &lt;a href=&quot;https://mva.microsoft.com/ko/training-courses/--8249?l=Q69GuP0QB_1200115888&quot; rel=&quot;nofollow&quot;&gt;Microsoft MVN Network course&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I say Hub is device which sends data to all connected nodes whenever it received data from a notice?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I asked this question is that I don't know definitely what node is..&lt;/p&gt;&#xA;" OwnerUserId="21225" LastActivityDate="2015-12-09T15:36:10.377" Title="Can I say Hub is device which sends data to all connected nodes whenever it received data from a notice?" Tags="|lan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25077" PostTypeId="1" AcceptedAnswerId="25129" CreationDate="2015-12-09T08:50:59.353" Score="1" ViewCount="924" Body="&lt;p&gt;We are going to provide Wi-Fi (802.11b/g/n) to a small building with a dozen APs, one AP per room.  The rooms are adjacent to each other.  Each AP will independently have its own SSID protected by WPA2 shared key, and will be used concurrently by 20 clients (consumer-grade tablets). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've been asked if we could increase the transmission signal power from the APs - provided that the firmware allows it - for &quot;a better reception&quot; (as APs can increase bandwidth by reducing transmission range, and transmission power is directly proportional to range).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have some doubts about it, considering that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Increasing transmission power will enhance its range, making it more likely to interfere with the other signals from the other APs;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Concerning the point above, many network devices in fact implement Transmit Power Control (TPC) to &lt;em&gt;lower&lt;/em&gt; signal power in order to reduce interference with other wireless networks;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Trying to increase signal range makes sense to try to reach far clients. Here, it is important that the AP signal is heard only from clients in the same room;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;We can increase APs Tx power but - most likely - not clients', therefore the increase in range would be just mono-directional. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I know that the correct answer to this kind of questions is &quot;it depends&quot;; however, I'd like to know if there's something I am missing, or it is indeed not worthy to try to boost Tx signal given this specific configuration.&lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2017-07-18T17:51:21.357" Title="Is it a viable solution to increase Tx power of AP if network is crowded?" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25078" PostTypeId="1" AcceptedAnswerId="25079" CreationDate="2015-12-09T09:32:24.897" Score="2" ViewCount="3310" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1gMkS.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1gMkS.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/868-cisco-router-gre-ipsec.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/868-cisco-router-gre-ipsec.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example above, R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)# interface Tunnel0&#xA;R1(config-if)# ip address 172.16.0.1 255.255.255.0&#xA;R1(config-if)# tunnel source 1.1.1.10&#xA;R1(config-if)# tunnel destination 2.2.2.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)# interface Tunnel0&#xA;R2(config-if)# ip address 172.16.0.2 255.255.255.0&#xA;R2(config-if)# tunnel source 2.2.2.10&#xA;R2(config-if)# tunnel destination 1.1.1.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When a packet with dst IP &lt;code&gt;172.16.0.2&lt;/code&gt; address arrives to R1, how does R1 know where to send it? It checks its routing table and knows that &lt;code&gt;172.16.0.2&lt;/code&gt; is directly connected? Anyway, it adds new IP header (dst IP set to &lt;code&gt;2.2.2.10&lt;/code&gt; -tunnel destination) and GRE header to that packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When R2 receives the packet, it knows the packet was addressed to its &lt;code&gt;2.2.2.10 FE0/1&lt;/code&gt; interface and it matches the tunnel source IP address that was set up on R2. So it removes the outer IP and GRE header, leaving the packet with dst IP &lt;code&gt;172.16.0.2&lt;/code&gt; and routes it forward (not in this case of course, but it would if the dst IP was different).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose there was another router - R3. Is it possible to set up a tunnel between R1 and R3 using the same network - &lt;code&gt;172.16.0.0/24&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When R1 pings the tunnel interface of R2 - &lt;code&gt;172.16.0.2&lt;/code&gt;, how does it know how to send it there? It probably checks his own Tunnel0 configuration: oh, I should send it to &lt;code&gt;172.16.0.2&lt;/code&gt;, which is in the same subnet as my Tunnel0 interface &lt;code&gt;172.16.0.1&lt;/code&gt;. Then it checks &lt;code&gt;tunnel destination&lt;/code&gt; address to learn it's &lt;code&gt;2.2.2.10&lt;/code&gt;. In other words, it can't directly ARP &lt;code&gt;172.16.0.2&lt;/code&gt; because it's not a physical connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I add R3 with Tunnel1 interface &lt;code&gt;172.16.0.4/24&lt;/code&gt; whose public IP is &lt;code&gt;3.3.3.10&lt;/code&gt;. Next I configure Tunnel1 on R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)# interface Tunnel1&#xA;R1(config-if)# ip address 172.16.0.3 255.255.255.0&#xA;R1(config-if)# tunnel source 1.1.1.10&#xA;R1(config-if)# tunnel destination 3.3.3.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pinging 172.16.0.2 from R1 probably wouldn't work, because now I have two tunnels on R1 using the same subnet (R1-R2 and R1-R3). R1 has no idea which tunnel I mean here and therefore it doesn't know the tunnel destination.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TLDR&lt;/strong&gt; Does it mean we need a different subnet for each tunnel? If so, shouldn't all tunnel subnets be /30? We only need two IPs for a tunnel - source and destination.&lt;/p&gt;&#xA;" OwnerUserId="20229" LastActivityDate="2017-05-30T11:24:20.050" Title="Two GRE tunnels in one subnet" Tags="|tunnel|gre|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25079" PostTypeId="2" ParentId="25078" CreationDate="2015-12-09T10:47:31.427" Score="2" Body="&lt;p&gt;A 'normal' GRE tunnel is a used as a point-to-point connection. A /30 (or even /31) would be a better use of your subnet space. There also exist multipoint GRE tunnels, such as DMVPN. Here you can have multiple tunnel endpoints connected to one tunnel interface. In that case, you will want a bigger subnet.&lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2015-12-09T10:47:31.427" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25080" PostTypeId="2" ParentId="16910" CreationDate="2015-12-09T11:36:30.227" Score="5" Body="&lt;p&gt;Although there's no direct equivalent to the Cisco IOS &quot;!&quot; to add comment lines to an HP ProCurve switch config file, you can achieve a similar result by using multiple &quot;alias&quot; commands within the config file, with a final &quot;no alias&quot; command at the end of the script to tidy things up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;alias COMMENT &quot;Some procurve configuration comment line here&quot;&#xA;...&#xA;alias COMMENT &quot;Second line of comment&quot;&#xA;...&#xA;no alias COMMENT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21229" LastActivityDate="2015-12-09T11:36:30.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25081" PostTypeId="1" AcceptedAnswerId="25088" CreationDate="2015-12-09T12:13:22.403" Score="1" ViewCount="1034" Body="&lt;p&gt;So I have an ethernet cable but I can see only one end of it. From the colors this end is &lt;strong&gt;Straight&lt;/strong&gt;. The other end is connected to a router or switch (I don't know where it's connected because it goes inside a wall).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to know if it's Crossover or not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem is, &lt;strong&gt;it works&lt;/strong&gt; on a laptop with Windows 10. &lt;strong&gt;Doesn't work&lt;/strong&gt; on the same laptop with Ubuntu (Linux 3.2), &lt;strong&gt;doesn't work&lt;/strong&gt; on a mac and &lt;strong&gt;doesn't work&lt;/strong&gt; on a router (a Linksys). By doesn't work I mean it's not even recognised as plugged. I need to make it work on a router I have (the router's ports are all working, I tested with another cable).&lt;/p&gt;&#xA;" OwnerUserId="21231" LastEditorUserId="8499" LastEditDate="2018-12-21T04:37:10.663" LastActivityDate="2018-12-21T04:37:10.663" Title="How to tell if a Cable is Crossover or Straight from one end" Tags="|ethernet|layer1|cable|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25082" PostTypeId="2" ParentId="25076" CreationDate="2015-12-09T12:15:03.413" Score="1" Body="&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before hubs using 10-BASET or 100-BASET there were 10-BASE5 and 10-BASE2. They were a &lt;em&gt;single cable&lt;/em&gt; connecting all the nodes (PCs, printers, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine a single cable going through an office, if someone step on the cable or pull violently the cable, he could break it and turn down the whole network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine moving a PC to another site in the office. If there wasn't a connector in the cable in that place they had to cut open the cable and put a new connector, it means having the network down during that time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To overcome these and other problems the industry moved from the &lt;em&gt;linear design&lt;/em&gt; to a &lt;em&gt;star design&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the star desingn each node uses a cable (UTP) that connect to a single point (the hub). The hub has the mission to act as a repeater on all its ports to &lt;em&gt;emulate&lt;/em&gt; the single cable functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For each frame received on a port, all the others will repeat the frame so everybody is able to see the same data as if they were connected to a single cable.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2015-12-09T12:15:03.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25083" PostTypeId="2" ParentId="25065" CreationDate="2015-12-09T14:01:58.230" Score="-1" Body="&lt;p&gt;I had erroneously configured a local route on my testing laptop...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whoops.  &lt;/p&gt;&#xA;" OwnerUserId="3702" LastActivityDate="2015-12-09T14:01:58.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25086" PostTypeId="1" CreationDate="2015-12-09T15:03:18.223" Score="2" ViewCount="509" Body="&lt;p&gt;I am trying to build resilient core networking by using BGP. I have two routers, R1 and R2, which are connected to the single ISP. ISP has two routers (let's call them R3 and R4). My have successfully configured BGP peering with R3 from R1 and R4 from R2. The ISP is announcing the default gateway via both links. However, I am having difficulties with BGP not reannouncing the default gateway over iBGP session between R1 and R2.&#xA;My topology looks like &lt;a href=&quot;http://www.cisco.com/c/dam/en/us/support/docs/ip/border-gateway-protocol-bgp/13762-40c.gif&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am attaching config files (relevant information is replaced):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;hostname Router&#xA;log file /var/log/quagga.log&#xA;log stdout&#xA;log timestamp precision 6&#xA;hostname bgpd&#xA;bgp config-type cisco&#xA;!&#xA;debug bgp as4&#xA;debug bgp events&#xA;debug bgp keepalives&#xA;debug bgp updates&#xA;debug bgp fsm&#xA;debug bgp filters&#xA;debug bgp zebra&#xA;!&#xA;password zebra&#xA;enable password zebra&#xA;!&#xA;interface bge0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface bge1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb2&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lagg0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lo0&#xA; no link-detect&#xA;!&#xA;interface lo1&#xA; no link-detect&#xA;!&#xA;interface pfsync0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan4&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan5&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan101&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan106&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan107&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan109&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;router bgp 6001&#xA; no synchronization&#xA; bgp router-id 1.1.2.253&#xA; bgp log-neighbor-changes&#xA; network 1.1.1.0&#xA; network 1.1.2.0&#xA; neighbor 2.1.1.249 remote-as 6000&#xA; neighbor 2.1.1.249 soft-reconfiguration inbound&#xA; neighbor 2.1.1.249 prefix-list 3 in&#xA; neighbor 2.1.1.249 route-map R1-DC-MAP out&#xA; neighbor 1.1.2.254 remote-as 6001&#xA; neighbor 1.1.2.254 next-hop-self&#xA; neighbor 1.1.2.254 soft-reconfiguration inbound&#xA; maximum-paths 2&#xA; no auto-summary&#xA;!&#xA;ip route 1.1.1.0/24 Null0&#xA;ip route 1.1.2.0/24 Null0&#xA;!&#xA;ip prefix-list 1 seq 5 permit 1.1.1.0/24&#xA;ip prefix-list 2 seq 5 permit 1.1.2.0/24&#xA;ip prefix-list 3 seq 5 deny 1.1.1.0/23&#xA;ip prefix-list 3 seq 10 permit any&#xA;!&#xA;route-map R1-DC-MAP permit 10&#xA; match ip address prefix-list 1&#xA; set as-path prepend 6001 6001 6001&#xA;!&#xA;route-map R1-DC-MAP permit 20&#xA; match ip address prefix-list 2&#xA;!&#xA;ip forwarding&#xA;!&#xA;line vty&#xA;!&#xA;end&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2 config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;hostname Router&#xA;log timestamp precision 6&#xA;hostname bgpd&#xA;log file /var/log/quagga.log&#xA;log stdout&#xA;bgp config-type cisco&#xA;!&#xA;debug zebra events&#xA;debug zebra packet&#xA;debug zebra rib&#xA;debug bgp as4&#xA;debug bgp events&#xA;debug bgp updates&#xA;!&#xA;password zebra&#xA;enable password zebra&#xA;!&#xA;interface bge0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface bge1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb2&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface igb3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lagg0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface lo0&#xA; no link-detect&#xA;!&#xA;interface lo1&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface pfsync0&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan3&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan4&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan5&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan101&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan106&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan107&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;interface vlan109&#xA; ipv6 nd suppress-ra&#xA; no link-detect&#xA;!&#xA;router bgp 6001&#xA; no synchronization&#xA; bgp router-id 1.1.2.254&#xA; bgp log-neighbor-changes&#xA; network 1.1.1.0&#xA; network 1.1.2.0&#xA; neighbor 3.1.1.25 remote-as 6000&#xA; neighbor 3.1.1.25 soft-reconfiguration inbound&#xA; neighbor 3.1.1.25 prefix-list 3 in&#xA; neighbor 3.1.1.25 route-map R2-SIX-MAP out&#xA; neighbor 1.1.2.253 remote-as 6001&#xA; neighbor 1.1.2.253 next-hop-self&#xA; neighbor 1.1.2.253 soft-reconfiguration inbound&#xA; no auto-summary&#xA;!&#xA;ip route 1.1.1.0/24 Null0&#xA;ip route 1.1.2.0/24 Null0&#xA;!&#xA;ip prefix-list 1 seq 5 permit 1.1.2.0/24&#xA;ip prefix-list 2 seq 5 permit 1.1.1.0/24&#xA;ip prefix-list 3 seq 5 deny 1.1.1.0/23&#xA;ip prefix-list 3 seq 10 permit any&#xA;!&#xA;route-map R2-SIX-MAP permit 10&#xA; match ip address prefix-list 1&#xA; set as-path prepend 6001 6001 6001&#xA;!&#xA;route-map R2-SIX-MAP permit 20&#xA; match ip address prefix-list 2&#xA;!&#xA;ip forwarding&#xA;!&#xA;line vty&#xA;!&#xA;end&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am using Quagga with latest FreeBSD (10.2).&lt;/p&gt;&#xA;" OwnerUserId="20965" LastActivityDate="2019-04-04T15:08:58.800" Title="BGP loadsharing not working" Tags="|bgp|load-balancing|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25087" PostTypeId="2" ParentId="25076" CreationDate="2015-12-09T15:14:54.463" Score="1" Body="&lt;p&gt;A &quot;hub&quot; is an OSI layer 1 device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means whatever the network protocol is (for example, Ethernet), any packet received on any port, it duplicated and sent to all ports. This is usually called &quot;bridging&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &quot;switch&quot; is an OSI layer 2 device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although they can do many other things, their primary different from a &quot;hub&quot; is that the switch keeps track of what device addresses are on which of its ports. When a packet arrives on one port, if the switch knows where the receiver address is located, the switch forwards it to only that one port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More about switches can be found &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/24432/what-is-a-layer-3-switch&quot;&gt;in this question&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="49" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2015-12-09T15:36:10.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25088" PostTypeId="2" ParentId="25081" CreationDate="2015-12-09T15:35:17.613" Score="2" Body="&lt;p&gt;There is no way to tell if a cable is a crossover cable or a straight through cable without access to both ends. I doubt your problem has to do with cross over since it does work with Windows on a laptop, but not Linux on the same laptop because you are using the same interface for both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not a very good idea to connect to a cable when you don't know where it is connected on the other end, especially when you want to connect a network infrastructure device like a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do you not know where it is connected on the other end? It is, after all, your network, and the National Electric Code requires cables to be terminated and labeled on both end and ready for use, or they are considered abandoned and must be removed.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-09T15:35:17.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25089" PostTypeId="1" AcceptedAnswerId="25090" CreationDate="2015-12-09T15:36:09.657" Score="3" ViewCount="2091" Body="&lt;p&gt;I have the following topology:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/UTRsN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UTRsN.png&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&#xA;SW1 and SW2 have ip routing enabled.&#xA;Both are able to ping the Loopback addresses: 2.2.2.2 and 2.2.2.3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output for show ip route is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1&amp;gt;show ip route&#xA;Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area&#xA;       * - candidate default, U - per-user static route, o - ODR&#xA;       P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     2.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;S       2.2.2.3/32 [1/0] via 192.168.100.2&#xA;S       2.2.2.0/24 [1/0] via 192.168.100.20&#xA;C    192.168.200.0/24 is directly connected, Vlan200&#xA;C    192.168.100.0/24 is directly connected, Vlan1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW2&amp;gt;show ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     2.0.0.0/32 is subnetted, 2 subnets&#xA;S       2.2.2.3 [1/0] via 192.168.100.30&#xA;S       2.2.2.0 [1/0] via 192.168.100.1&#xA;S    192.168.200.0/24 [1/0] via 192.168.100.1&#xA;C    192.168.100.0/24 is directly connected, Vlan1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Routers have their direct connected switches as &lt;strong&gt;default-gateway&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output for show run is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 865 bytes&#xA;!&#xA;version 12.3&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname R2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$maRc$UwddG0WVyNyDcklve0f5v1&#xA;enable password 7 110A1016141D5A&#xA;!&#xA;no aaa new-model&#xA;ip subnet-zero&#xA;no ip routing&#xA;!&#xA;!&#xA;!&#xA;no ip cef&#xA;!         &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback1&#xA; ip address 2.2.2.2 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.100.20 255.255.255.0&#xA; no ip route-cache&#xA; speed auto&#xA; full-duplex&#xA; no mop enabled&#xA;!&#xA;interface BRI0/0&#xA; no ip address&#xA; encapsulation hdlc&#xA; no ip route-cache&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip default-gateway 192.168.100.1&#xA;ip http server&#xA;ip classless&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!         &#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA; password 7 070C285F4D06&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 727 bytes&#xA;!&#xA;version 12.2&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;service password-encryption&#xA;!&#xA;hostname R3&#xA;!&#xA;enable secret 5 $1$xOJl$oNJ4x6DoBuCeLk8T8Jr5q/&#xA;enable password 7 110A1016141D5A&#xA;!&#xA;ip subnet-zero&#xA;no ip routing&#xA;!&#xA;!&#xA;!&#xA;call rsvp-sync&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!         &#xA;!&#xA;!&#xA;!&#xA;interface Loopback1&#xA; ip address 2.2.2.3 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.100.30 255.255.255.0&#xA; no ip route-cache&#xA; no ip mroute-cache&#xA; speed auto&#xA; full-duplex&#xA;!&#xA;interface Serial0/0&#xA; no ip address&#xA; no ip route-cache&#xA; no ip mroute-cache&#xA; shutdown&#xA; no fair-queue&#xA;!&#xA;ip default-gateway 192.168.100.2&#xA;ip classless&#xA;ip http server&#xA;!&#xA;!&#xA;dial-peer cor custom&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA; password 7 1511021F0725&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why I'm not able to ping 2.2.2.3 from R2, neither 2.2.2.2 from R3?&#xA;Thanks a lot for your help!&lt;/p&gt;&#xA;" OwnerUserId="21236" LastEditorUserId="8499" LastEditDate="2018-12-22T20:45:18.467" LastActivityDate="2018-12-22T20:45:18.467" Title="CCNA Static Routing - Routers not able to ping each other" Tags="|cisco|routing|lab|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25090" PostTypeId="2" ParentId="25089" CreationDate="2015-12-09T15:44:40.413" Score="1" Body="&lt;p&gt;You don't have routes (either static or with a routing protocol) in the routers to reach the other router's loopback address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers should not have a default gateway (this is a rookie mistake), and the switches can't be gateways, anyway, since they are layer-2 devices. You can put in static default routes, static specific routes, or run a routing protocol between the routers in order to share routes.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-09T15:44:40.413" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="25095" PostTypeId="2" ParentId="25056" CreationDate="2015-12-09T19:23:59.320" Score="0" Body="&lt;p&gt;You want to null route, so add a static route everywhere to do that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.0.2.1 -&gt; null0 (the IP is reserved for that usecase).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then announce every network you want to rTBH through 192.0.2.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That would do the trick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://packetlife.net/blog/2009/jul/6/remotely-triggered-black-hole-rtbh-routing/&quot; rel=&quot;nofollow&quot;&gt;http://packetlife.net/blog/2009/jul/6/remotely-triggered-black-hole-rtbh-routing/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2015-12-09T19:23:59.320" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25096" PostTypeId="1" AcceptedAnswerId="25098" CreationDate="2015-12-09T19:38:12.793" Score="2" ViewCount="101" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1gMkS.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1gMkS.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/868-cisco-router-gre-ipsec.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/868-cisco-router-gre-ipsec.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me use the same example as in my previous question.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)# interface Tunnel0&#xA;R1(config-if)# ip address 172.16.0.1 255.255.255.0&#xA;R1(config-if)# tunnel source 1.1.1.10&#xA;R1(config-if)# tunnel destination 2.2.2.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is it necessary to configure tunnel &lt;strong&gt;source&lt;/strong&gt; IP? Isn't it something R1 can figure out on its own? When pinging 172.16.0.2, it adds IP and GRE headers, and sets dst IP to &lt;code&gt;2.2.2.10&lt;/code&gt; - it knows it based based on the configuration above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can't R1 simply figure the source IP on its own? R1 just checks its routing table to find out the next hop for &lt;code&gt;2.2.2.10&lt;/code&gt; and chooses the interface with the longest prefix match. There's no ambiguity regarding which interface it should send that packet from.&lt;/p&gt;&#xA;" OwnerUserId="20229" LastEditorUserId="8499" LastEditDate="2019-01-04T23:30:36.217" LastActivityDate="2019-01-04T23:30:36.217" Title="Why specify the source tunnel address?" Tags="|routing|ip|tunnel|gre|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25098" PostTypeId="2" ParentId="25096" CreationDate="2015-12-09T19:57:15.723" Score="2" Body="&lt;p&gt;Often, you may want to use a loopback, since it will never go down, as the source because you may have a backup path to the other end. It is not always the right thing to do to use the exit interface since it could go down, but there is another interface which could also get you to the other router. Putting it on a loopback will allow the tunnel to continue to function, no matter if the best interface to the other end is up or not.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-09T19:57:15.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25100" PostTypeId="1" AcceptedAnswerId="25102" CreationDate="2015-12-09T19:56:13.563" Score="14" ViewCount="14911" Body="&lt;p&gt;I am new to wireless LAN. I see that it has four addresses in the frame header. In case of a Wired Ethernet, there are only two MAC addresses, the source and the destination (which is essentially the address of the next hop).&lt;/p&gt;&#xA;&lt;p&gt;But in case of wireless LAN, why do we always need the end point's address? Isn't this task essentially for the IP layer?&lt;/p&gt;&#xA;&lt;p&gt;What is the need of the extra source and destination addresses, apart from the transmitter and receiver addresses?&lt;/p&gt;&#xA;" OwnerUserId="21250" OwnerDisplayName="Ankur Bhatia" LastEditorUserId="43734" LastEditDate="2022-11-23T23:54:13.133" LastActivityDate="2022-11-23T23:56:33.730" Title="Four layer-2 addresses in 802.11 frame header" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25102" PostTypeId="2" ParentId="25100" CreationDate="2015-12-09T21:51:00.760" Score="20" Body="&lt;p&gt;The distinction to understand is that while an 802.11 device is transmitting to a receiving device, either one (or both) of these devices may not be the actual source or destination of the L2 traffic. So this can create situations where you need four different addresses:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Transmitter Address (TA)&lt;/li&gt;&#xA;&lt;li&gt;Receiver Address (RA)&lt;/li&gt;&#xA;&lt;li&gt;Source Address (SA)&lt;/li&gt;&#xA;&lt;li&gt;Destination Address (DA)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The &lt;a href=&quot;https://en.wikipedia.org/wiki/Service_set_(802.11_network)#Basic_service_set_types&quot; rel=&quot;noreferrer&quot;&gt;BSSID&lt;/a&gt; of the wireless network may be the TA or RA, but it can also be an identifier to associate traffic to a BSS. Unless the access point (AP) uses the same MAC address for the management interface and the BSSID, you generally won't have any traffic where the BSSID is either the SA or DA.&lt;/p&gt;&#xA;&lt;p&gt;The use the address fields in an 802.11 header is tied to the To/From DS (distribution system) flags. Depending on how the To/From DS flags are set, this determines which of the four fields are required and what information each provides.&lt;/p&gt;&#xA;&lt;p&gt;Here are a couple quick summary tables that I took from an &lt;a href=&quot;https://www.ieee802.org/1/files/public/802_architecture_group/802-11/4-address-format.doc&quot; rel=&quot;noreferrer&quot;&gt;IEEE document&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iOipv.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iOipv.png&quot; alt=&quot;IEEE table of distribution system flags with meaning explained&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7lV31.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7lV31.png&quot; alt=&quot;IEEE table of distribution system flags with different addresses&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Let me add a couple of images to provide examples taken from &lt;a href=&quot;https://www.oreilly.com/library/view/80211-wireless-networks/0596100523/&quot; rel=&quot;noreferrer&quot;&gt;802.11 Wireless Networks: The Definitive Guide&lt;/a&gt; by O'Reilly Press:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tKBIj.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tKBIj.png&quot; alt=&quot;illustration 1 of client, access point, and server with their source, transmitter, receiver, and destination addresses&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BrKbS.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BrKbS.png&quot; alt=&quot;illustration 2 of client, access points, and server with their source, transmitter, receiver, and destination addresses&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="43734" LastEditDate="2022-11-23T23:56:33.730" LastActivityDate="2022-11-23T23:56:33.730" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25103" PostTypeId="1" CreationDate="2015-12-09T22:33:21.957" Score="1" ViewCount="1420" Body="&lt;p&gt;I have cisco ASA &lt;code&gt;5500&lt;/code&gt; firewall and curious can i disable connection tracking for specific rules or protocol.&lt;/p&gt;&#xA;&lt;p&gt;In short i want to disable connection tracking for &lt;code&gt;UDP&lt;/code&gt; traffic. because UDP is connection less, it doesn't have any state like &lt;code&gt;NEW, ESTABLISHED&lt;/code&gt; etc.. what is the purpose of tracking them. I want to exclude them from my ASA rules.&lt;/p&gt;&#xA;&lt;h1&gt;UPDATE&lt;/h1&gt;&#xA;&lt;p&gt;I have quick check in ASA and following traffic we are inspecting. if there is no UDP/SIP there then who is filling connection table?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc&#xA;  inspect xdmcp&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect icmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here is the connection table output, I can see UDP traffic and my SIP port 6050. How can i tell don't track UDP connection?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;fw1/act# show conn&#xA;366629 in use, 650039 most used&#xA;UDP outside 188.16.1.180:48145 inside 63.91.252.112:6065, idle 0:00:00, bytes 784, flags -&#xA;UDP outside 93.170.181.204:11862 inside 63.91.252.112:6065, idle 0:00:00, bytes 796, flags -&#xA;UDP outside 194.44.127.194:49526 inside 63.91.252.112:6065, idle 0:00:00, bytes 1226, flags -&#xA;UDP outside 5.166.44.120:46668 inside 63.91.252.112:6065, idle 0:00:00, bytes 814, flags -&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-12-10T20:08:31.143" Title="Cisco ASA 5500 disable connection tracking" Tags="|cisco|cisco-asa|firewall|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25105" PostTypeId="2" ParentId="25030" CreationDate="2015-12-09T23:03:33.340" Score="2" Body="&lt;p&gt;The IPv6 address is the network address assigned to the interface of the tunnel. I don't know where you came up with the &lt;code&gt;/128&lt;/code&gt; because that is used for something like a loopback.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Specifies the IPv6 network assigned to the interface and enables IPv6&#xA;  processing on the interface.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Something like this from the Cisco &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/interface/configuration/xe-3s/ir-xe-3s-book/ip6-6to4-tunls-xe.html&quot; rel=&quot;nofollow&quot;&gt;documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Example: Configuring 6to4 Tunnels&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following example configures a 6to4 tunnel on a border router in&#xA;  an isolated IPv6 network. The IPv4 address is 192.168.99.1, which&#xA;  translates to the IPv6 prefix of 2002:c0a8:6301::/48. The IPv6 prefix&#xA;  is subnetted into 2002:c0a8:6301::/64 for the tunnel interface:&#xA;  2002:c0a8:6301:1::/64 for the first IPv6 network, and&#xA;  2002:c0a8:6301:2::/64 for the second IPv6 network. The static route&#xA;  ensures that any other traffic for the IPv6 prefix 2002::/16 is&#xA;  directed to tunnel interface 0 for automatic tunneling.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0/0&#xA; description IPv4 uplink&#xA; ip address 192.168.99.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet1/0/0&#xA; description IPv6 local network 1&#xA; ipv6 address 2002:c0a8:6301:1::1/64 &#xA;!&#xA;interface GigabitEthernet2/0/0&#xA; description IPv6 local network 2&#xA; ipv6 address 2002:c0a8:6301:2::1/64 &#xA;!&#xA;interface Tunnel0&#xA; description IPv6 uplink&#xA; no ip address&#xA; ipv6 address 2002:c0a8:6301::1/64 &#xA; tunnel source GigabitEthernet0/0/0&#xA; tunnel mode ipv6ip 6to4&#xA;!&#xA;ipv6 route 2002::/16 tunnel 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-09T23:16:31.197" LastActivityDate="2015-12-09T23:16:31.197" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25106" PostTypeId="2" ParentId="25073" CreationDate="2015-12-09T23:43:26.860" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://ask.wireshark.org/questions/36789/drastic-tcp-window-size-change-without-scaling&quot; rel=&quot;nofollow&quot;&gt;This post&lt;/a&gt; has a good explanation for what you're seeing.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What you see is normal behavior. Both sides send a small window size&#xA;  and neither announce that they are able to use window scaling. So in&#xA;  the next step they both pull up their TCP window to 64k to allow the&#xA;  other node to send more than just a few packets in case that there is&#xA;  a lot of data to be transferred.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It's quite normal to see that kind of session behavior - as soon as&#xA;  both know that the connection is established and what the parameters&#xA;  are they simply adjust their window.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It is to conserve memory for connection that are not guaranteed to be&#xA;  established yet. The OS/TCP stack needs to reserve as much memory for&#xA;  incoming bytes as promised in the window size (which is essentially&#xA;  just a buffer), so if you waste too much memory on connections from&#xA;  the start you might run out of memory.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="129" LastActivityDate="2015-12-09T23:43:26.860" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25109" PostTypeId="1" CreationDate="2015-12-10T06:10:41.820" Score="2" ViewCount="2395" Body="&lt;p&gt;What is the basic difference between a sip proxy and a sip outbound proxy. Can sip proxy and outbound proxy be the same?&lt;/p&gt;&#xA;" OwnerUserId="21249" LastActivityDate="2015-12-28T16:50:27.983" Title="Difference between sip proxy and sip outbound proxy?" Tags="|voip|sip|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-12T23:19:20.863" ContentLicense="CC BY-SA 3.0" />
  <row Id="25111" PostTypeId="2" ParentId="25029" CreationDate="2015-12-10T08:26:31.077" Score="2" Body="&lt;p&gt;Yes, the IMEI can be obtained over the GPRS network but it has to be done &lt;strong&gt;at the Network Operator level, not by the User at Service level&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This process is called &quot;Automatic Device Detection&quot; and it is applicable to a GSM, GPRS or UMTS network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can refer to 4.1.2.1 in 3rd Generation Partnership Project (3GPP) TS 23.012 version 9.1.0 Release 9 to have more details about this standard solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In few words, if this function is activated at the network operator level, the IMEI is exchanged by the user equipment to the network operator equipment (MSC/VLR/HLR) through some signalling message. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HLR finally sends the IMEI in XML format (SOAP) to a third-party server called ADD SERVER, the protocol used between them is HTTP or HTTPS.&lt;/p&gt;&#xA;" OwnerUserId="15145" LastEditorUserId="15145" LastEditDate="2015-12-10T08:32:57.263" LastActivityDate="2015-12-10T08:32:57.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25120" PostTypeId="2" ParentId="25103" CreationDate="2015-12-10T19:31:12.060" Score="2" Body="&lt;p&gt;By default, the ASA inspects SIP and many other protocols as you can see listed below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip &#xA;  inspect netbios &#xA;  inspect tftp &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To remove unwanted inspection, go into the policy-map and remove the inspect command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map global_policy&#xA; class inspection_default&#xA;  no inspect sip &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please be aware that this will kill the existing connections so this should be done off hours or during a maintenance window.&lt;/p&gt;&#xA;" OwnerUserId="2231" LastActivityDate="2015-12-10T19:31:12.060" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="25121" PostTypeId="1" CreationDate="2015-12-10T19:33:35.950" Score="2" ViewCount="1041" Body="&lt;p&gt;I have a Cisco Nexus 3548 switch and a bunch of machine that I want to connect to it via 10GbE RJ45 connectivity. &#xA;I am a bit overwhelmed with all the acronyms and sheer volume of technical info on this. &#xA;I know what I want looks like this: &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B00U77IJ2M&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/10Gtek%C2%AE-Compatible-Gigabit-Transceiver-Mini-GBIC/dp/B00U77IJ2M/ref=sr_1_1?ie=UTF8&amp;amp;qid=1449775858&amp;amp;sr=8-1-spons&amp;amp;keywords=cisco+sfp%2B+rj45&amp;amp;psc=1&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this is only 1GbE.&#xA;Is there such a thing for 10GbE?&lt;/p&gt;&#xA;" OwnerUserId="21267" LastActivityDate="2016-10-07T16:08:18.393" Title="10GbE copper module for Cisco Nexus 3548 switch" Tags="|cisco|switch|transceiver|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25122" PostTypeId="2" ParentId="25077" CreationDate="2015-12-10T19:40:14.913" Score="1" Body="&lt;p&gt;Depending on your vendor solution, you may want to implement a wireless management solution that will provide the services you want to deliver to the clients. That includes power management, RF management, SSID management, etc... &lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="8499" LastEditDate="2017-07-18T17:51:21.357" LastActivityDate="2017-07-18T17:51:21.357" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25123" PostTypeId="1" AcceptedAnswerId="25124" CreationDate="2015-12-10T19:55:28.507" Score="2" ViewCount="180" Body="&lt;p&gt;How will PVST behave in a situation in which there are two switches connected to each other via access switchports which have different VLANs assigned to them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ex:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Switch 1] Port with &quot;Access Vlan 100&quot; &amp;lt;----&gt; Port with &quot;Access Vlan 200&quot; [Switch2]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic from switch 1, on VLAN 100 will arrive to switch 2 untagged and become part of switch 2's VLAN 200, and vice versa. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how will PVST behave in this situation, considering the VLANs do not match on the link between the 2 switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not intending to create this situation on purpose, just curious about how PVST will behave in this situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerDisplayName="user16942" LastEditorUserId="8499" LastEditDate="2018-12-22T20:47:26.417" LastActivityDate="2018-12-22T20:47:26.417" Title="PVST with VLANs not matching on switches" Tags="|cisco|switch|vlan|switching|spanning-tree|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25124" PostTypeId="2" ParentId="25123" CreationDate="2015-12-10T20:15:23.163" Score="1" Body="&lt;p&gt;You will get Native VLAN Mismatch errors. The two VLANs will now be one layer-2 domain instead of two, and this may be a problem, or not, depending on how the rest of the network is configured and connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the ports have DTP enabled, and at least one side is Desirable, a trunk will form.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have BPDU guard enabled on either port, it will be errdisabled.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-10T20:15:23.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25126" PostTypeId="2" ParentId="25056" CreationDate="2015-12-10T21:41:02.257" Score="4" Body="&lt;p&gt;So I've got the problem fixed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first problem was the missing device protocol. This protocol is needed to get the interfaces of the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second problem is connected with the first. BIRD has to know the route to the interface where my vpn network is connected to. To get this routes I've to add a static route at the static protocol block or I've to get theme dynamically with a direct protocol definition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a last modification I have to delete the direct option. I don't exactly know why but with the direct; option defined the two BIRD instances can't connect and there ins't traffic on the interface between them. So I have to run this iBGP BIRD Session in multihop mode. It would be great if someone can explane this last little problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My working config looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;log syslog { debug, trace, info, remote, warning, error, auth, fatal, bug };&#xA;router id 10.142.0.2;&#xA;protocol device {&#xA;    scan time 10;&#xA;};&#xA;debug protocols all;&#xA;protocol kernel {&#xA;export filter {    &#xA;    if source = RTS_STATIC then reject;&#xA;    accept;&#xA;  };&#xA;&#xA;}&#xA;protocol direct {&#xA;        interface &quot;*&quot;;&#xA;}&#xA;&#xA;protocol static {&#xA;    route 10.142.112.0/22 reject;&#xA;#   route 10.142.12.0/24 via &quot;mapbone&quot;;&#xA;}&#xA;&#xA;protocol bgp {&#xA;    local as 76118;&#xA;    neighbor 10.142.12.6 as 76118;&#xA;    export where source=RTS_STATIC;&#xA;    import all;&#xA;    next hop self;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21205" LastActivityDate="2015-12-10T21:41:02.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25129" PostTypeId="2" ParentId="25077" CreationDate="2015-12-11T03:30:05.243" Score="4" Body="&lt;p&gt;Generally speaking, if you have a wireless network dedicated to each room then increasing the transmit power will have more of a negative effect than any positive effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only case where you may need to consider this is if you are in an environment where the noise floor is extremely high for the 802.11 frequencies. In this case you may need the extra power to have a sufficient SNR for a good connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you point out in the question, increasing the transmit power will increase the visibility with other access points, meaning that the airtime will be divided between all the access points on the same channel. This can have a significant performance impact which worsens the user experience. Decreasing the transmit power so that fewer &quot;neighbor&quot; APs are seen can improve performance and the user experience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the best approach it to do an actual survey of the area (including spectrum analysis) and monitor performance statistics from the wireless environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me also add that you said, &lt;em&gt;&quot;We've been asked if we could increase the transmission signal power from the APs....&quot;&lt;/em&gt; However, you do not mention why this suggestion was given to you. Is there actually some sort of problem that users are experiencing? Usually if someone makes a suggestion like this, then there is a reason and maybe you need to look into the reason behind the suggestion.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-12-11T03:30:05.243" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25131" PostTypeId="1" AcceptedAnswerId="25135" CreationDate="2015-12-11T05:37:11.527" Score="1" ViewCount="2051" Body="&lt;p&gt;I have a tunneling setup working in the lab using a pair of Cisco routers directly connected via Ethernet crossover on their WAN ports to simulate the internet.  The problem is this is not realistic enough because the WANs have to be on the same subnet with this very simplified setup (afaik).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To add context, the customer wants to add a VPN in addition to an existing T1 without disturbing what is already there and there is no interest in giving internet access to the remote site, just another way to connect to the main office, via VPN in addition to T1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So again, I have everything tested and working but the problem is I am quite sure it will not work &quot;IRL&quot; because of the default gateways below and the fact that in real life the WAN IPs of course are not on the same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the question really has two parts: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For future reference what is the easiest and cheapest thing to put &quot;in the middle&quot; so that I could use completely different IP addresses on the two WAN connections and have a much better lab, and &lt;/li&gt;&#xA;&lt;li&gt;Do you believe the third commented routes shown in each set below, or rather something similar, will be sufficient to make it work once on the customer site with the real IPs and the real ISP gateway IPs?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Essential details of both configs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!-- MAIN OFFICE&#xA;!-- - WAN meant for VPN only&#xA;interface FastEthernet0/1&#xA; ip address 212.212.212.212 255.255.255.248&#xA; speed auto&#xA; crypto map MY_MAP&#xA;!-- - LAN&#xA;interface FastEthernet0/0&#xA; ip address 192.168.1.1 255.255.255.0&#xA; speed auto&#xA;!-- - VPN - not shown for brevity&#xA;!-- - Routes - .8 is a completely different gateway device.&#xA;ip route 0.0.0.0 0.0.0.0 192.168.1.8&#xA;ip route 192.168.2.0 255.255.255.0 192.168.2.1&#xA;!-- - If remote were 222.222.222.213 and main &#xA;!--   office ISP gw were 212.212.212.214,&#xA;!--   will this be sufficient?&#xA;!ip route 222.222.222.213 255.255.255.248 212.212.212.214&#xA;&#xA;!-------------------------------------&#xA;&#xA;!-- REMOTE OFFICE&#xA;!-- - WAN meant for VPN only&#xA;interface FastEthernet0/1&#xA; ip address 212.212.212.213 255.255.255.248&#xA; speed auto&#xA; crypto map MY_MAP&#xA;!-- - VPN - not shown for brevity&#xA;!-- - LAN&#xA;interface FastEthernet0/0&#xA; ip address 192.168.2.1 255.255.255.0&#xA; speed auto&#xA;!-- - Routes&#xA;ip route 0.0.0.0 0.0.0.0 192.168.1.1&#xA;ip route 192.168.1.0 255.255.255.0 192.168.1.1&#xA;!-- - If 222.222.222.214 were ISP gw address at remote, will this be sufficient?&#xA;!ip route 212.212.212.212 255.255.255.255 222.222.222.214&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20801" LastEditorUserId="20801" LastEditDate="2015-12-11T05:44:07.720" LastActivityDate="2015-12-11T14:01:14.373" Title="How to simulate internet connectivity with two Cisco routers only" Tags="|cisco|vpn|tunnel|lab|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25133" PostTypeId="1" CreationDate="2015-12-11T13:05:10.680" Score="5" ViewCount="587" Body="&lt;p&gt;I am working on implementing a &quot;standard&quot; Remote Access IKEv1 IPSec VPN to a Cisco ASA 5505 (OS 8.4 - base license) and I keep getting the error message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%ASA-4-713239: IP_Address: Tunnel Rejected: The maximum tunnel count allowed has been reached&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;even if there are no site-to-site or any additional VPN sessions (remote access VPN, Easy VPN, etc.) currently running or established on the unit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to clear the &lt;code&gt;vpn-sessiondb&lt;/code&gt; summary and statistics, as well as all ISAKMP / IKE SAs - no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before the statistics reset, the cumulative count of VPN sessions (remote access + S2S, SSL as well as IKEv1 and IKEv2) was set to &gt; 60.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is currently set to 0; however, it looks to me as if the OS is still somehow &quot;retaining&quot; the cumulative count of VPN sessions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(the unit has now been running over almost 14 months...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks to me as if something as OS level is stuck .... does anyone know a workaround for resetting the responsible SW modules without needing to reboot the platform ?&lt;/p&gt;&#xA;" OwnerUserId="16189" LastEditorUserId="8499" LastEditDate="2015-12-11T14:04:11.660" LastActivityDate="2015-12-11T14:04:11.660" Title="Cisco ASA 5505 Remote Access IPSec - Tunnel Rejected - The maximum tunnel count allowed has been reached" Tags="|cisco|cisco-asa|vpn|ipsec|ike|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25134" PostTypeId="2" ParentId="20282" CreationDate="2015-12-11T13:05:52.923" Score="1" Body="&lt;p&gt;You could configure an interface , say X4, to be part of a DMZ zone and in Transparent Mode, as per this KB article from Dell:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://support.software.dell.com/kb/sw5979&quot; rel=&quot;nofollow&quot;&gt;Configuring an Interface (LAN, DMZ, etc.) in Transparent Mode in SonicOS Enhanced (SW5979)&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2542" LastEditorUserId="8499" LastEditDate="2016-03-11T02:07:22.053" LastActivityDate="2016-03-11T02:07:22.053" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25135" PostTypeId="2" ParentId="25131" CreationDate="2015-12-11T14:01:14.373" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;For your simulation, you could just put another router in between&#xA;the two  site routers to act as the Internet.&lt;/li&gt;&#xA;&lt;li&gt;The commented routes will allow you to get the the Internet&#xA;interface of the other side. I'm puzzled by the different masks used&#xA;in the routes. You have &lt;code&gt;255.255.255.248&lt;/code&gt; assigned to the&#xA;interfaces, and you use that on the router at the Main site, but at&#xA;the Remote site you use &lt;code&gt;255.255.255.255&lt;/code&gt; as the route to the Main&#xA;router. Neither one will allow general Internet access since you have your default route pointing to your LAN at the Main site. You may want to adjust the default route at the Remote site to point to the next hop (T1) and add another default route with a higher AD to point to the VPN to give you a backup default route for when the T1 fails.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-11T14:01:14.373" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25136" PostTypeId="1" AcceptedAnswerId="25140" CreationDate="2015-12-11T19:10:38.743" Score="2" ViewCount="191" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2784&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2784&lt;/a&gt; mentions:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Care should be taken when forwarding such a packet, since if the destination address of the payload packet is the encapsulator of the packet (i.e., the other end of the tunnel), looping can occur. In this case, the packet MUST be discarded.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It would seem that the original tunnel endpoint sending would have to have a messed up route to not recognize itself as the destination and forward the packet over the tunnel.&lt;/p&gt;&#xA;&lt;p&gt;Does this imply that an &lt;strong&gt;infinite&lt;/strong&gt; loop is possible or just that the packet will get possibly sent back one time?&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/64565-gre-tunnel-keepalive.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's documentation&lt;/a&gt; seems to demostrate that they use this exact behavior to make a keepalive work.   Wouldn't this violate the RFC though since &amp;quot;the packet MUST be discarded?&amp;quot;&lt;/p&gt;&#xA;" OwnerUserId="21279" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2018-12-26T04:17:22.757" Title="How would &quot;looping&quot; in GRE occur according to RFC 2784" Tags="|protocol-theory|tunnel|gre|rfc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25137" PostTypeId="1" AcceptedAnswerId="25189" CreationDate="2015-12-11T19:18:34.747" Score="4" ViewCount="6879" Body="&lt;p&gt;We have all of our network devices attached to console servers for out-of-band access. Occasionally, someone will log in as the local root user and forget to log out. Whoever happens to log into that device next via the console server will be greeted by an open console session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware that you can &lt;a href=&quot;http://forums.juniper.net/t5/SRX-Services-Gateway/Console-vty-login-session-inactivity-timeout/td-p/145386&quot; rel=&quot;nofollow&quot;&gt;configure idle timeouts under login classes&lt;/a&gt;, but that doesn't seem to be an option for the built-in super-user class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# set system login class super-user idle-timeout 10 &#xA;warning: 'super-user' is a predefined class name; changing to 'super-user-local'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nor can we assign the root user to a custom class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# set system login user root class root&#xA;# commit &#xA;error: cannot create user account: root&#xA;error: user name is used by a system account&#xA;error: commit failed: daemon file propagation failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any clever tricks around this? We could certainly use a separate user account instead of root, but that still leaves open the possibility that someone will log in as root during a maintenance action and forget to log out.&lt;/p&gt;&#xA;" OwnerUserId="5" LastActivityDate="2021-06-08T18:03:20.680" Title="Is it possible to set idle-timeout for the Junos root user?" Tags="|juniper|juniper-junos|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25138" PostTypeId="1" AcceptedAnswerId="25139" CreationDate="2015-12-11T19:33:05.097" Score="1" ViewCount="1584" Body="&lt;p&gt;Newbie networking question here...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do ISPs generally use the same link layer protocols (Ethernet, ARP to relate to network layer 3, etc.) that are used on LANs? In school I learned in some detail about Ethernet, how hosts ARP for the MAC address of another host, wrap the IP packets in Ethernet frames that travel through switches to the correct host, and so on. But once the IP packets leave a LAN I'm not too sure what happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I googled around, and came across things like PPP and PPPoE, but am not too sure I understand their significance. Are these like &quot;Ethernet&quot; (layer 2 protocol) for networks beyond LANs. On ISPs' networks, do they have a bunch of routers connected to a switch that all use ARP-like protocols do find each others MAC and send the packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess I'm looking for a clearer picture of what happens to my packets as they become encapsulated at the link layer, from the time it leaves my router to the time they end up at the destination network. I'm not asking about routing protocols/algorithms and stuff like that, but rather the link layer stuff. Any resources for further reading would be much appreciated also.&lt;/p&gt;&#xA;" OwnerUserId="16349" LastActivityDate="2016-12-05T03:54:39.817" Title="Link layer protocols used by ISP?" Tags="|ethernet|layer2|isp|pppoe|ppp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25139" PostTypeId="2" ParentId="25138" CreationDate="2015-12-11T19:41:27.717" Score="1" Body="&lt;p&gt;Some layer-2 protocols use MAC addresses, and some don't. For example, PPP uses something different. Your router will encapsulate in the layer-2 protocol which is used on the link to the ISP, and that link may or may not use MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you work for the ISP you can't know what a particular ISP does internally because there are many different ways that ISPs do things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resource recommendations are off-topic, so we can't help with reading resources.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-11T19:41:27.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25140" PostTypeId="2" ParentId="25136" CreationDate="2015-12-11T20:02:55.813" Score="0" Body="&lt;p&gt;If the de-encapsulating router has a route for the un-encapsulated destination address going back to the encapsulating router, you will get a loop that only expires when the TTL expires. This is an entirely plausible scenario if the rule is not followed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is nothing to say that the two routers are running a routing protocol between them, so they could have entirely different ideas of which way to send a packet. One or more could be using static routes or PBR. There is nothing to say that the two routing tables are in sync.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-11T20:02:55.813" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25141" PostTypeId="2" ParentId="25137" CreationDate="2015-12-11T20:16:48.933" Score="-2" Body="&lt;p&gt;If you are accessing it via console server, I would suggest following:&#xA;Change root password, so no admin has knowledge of it or inform them that they should not use it any more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create new super-user class and set cli time-out to XX minutest&#xA;Create new user that would be member of new super-user class and use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more info on link:&#xA;&lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos15.1/topics/task/configuration/login-idle-timeout-configuring.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/documentation/en_US/junos15.1/topics/task/configuration/login-idle-timeout-configuring.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21282" LastActivityDate="2015-12-11T20:16:48.933" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25142" PostTypeId="1" AcceptedAnswerId="25146" CreationDate="2015-12-12T00:22:11.780" Score="1" ViewCount="101" Body="&lt;p&gt;I'm an undergraduate looking for ways to experiment with network security techniques on my residential local area network, so much of this is going to be very new to me. Forgive me in advance for asking a question that might be obvious to others. My intention is to run two devices -- a RPi running Kali Linux and another device running Metasploitable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a separate box running Kali because I want to be able to run tools from a network I control rather than running them from the university's network, which understandably frowns on the use of penetration testing tools. I ssh into this box from the university and use it to interact with wargaming servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to set up my own Metasploitable server to attack because I have peers that I work with (we're all learning these things together) and I would like us all to practice running these tools together (and give them a legitimate target to operate against) and it gives me a chance to learn network hardening techniques against live opponents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue, naturally, is with putting an intentionally unsecure box on the network. The logs in the Kali RPi are filled with brute force attacks, and putting a metasploitable box on the network seems like an invitation to disaster if I can't partition the server away from things like my NAS (which is mostly filled with a terabyte of family photos).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This device:&#xA;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B00AHSNQNS&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/Cisco-Systems-Wireless-Security-RV215WAK9NA/dp/B00AHSNQNS&lt;/a&gt;&#xA;appears ready to set up a VLAN. I don't know a whole lot about VLAN (as I've said, I'm a student), but it seems to me that a VLAN is just the sort of thing I need. Is my instinct here correct, or would there be an unacceptable level of danger (should the intentionally-vulnerable server get compromised by someone other than my colleagues) of exposure to other adjacent virtual networks?&lt;/p&gt;&#xA;" OwnerUserId="21286" LastEditorUserId="21286" LastEditDate="2015-12-12T00:31:23.283" LastActivityDate="2015-12-12T03:09:37.413" Title="Partitioning servers from the rest of the network" Tags="|vlan|security|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25144" PostTypeId="2" ParentId="25142" CreationDate="2015-12-12T01:45:43.483" Score="1" Body="&lt;p&gt;VLANs give you layer-2 (broadcast) separation, but not layer-3 (IP) separation, and it sounds like you need layer-3 separation. To prevent access from one VLAN to another where both terminate on the same router, you will need to put in an ACL to prevent access between the VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An intentionally insecure box is still just as insecure on any VLAN where you place it, and if the router is the same router for the VLANs, you aren't really adding any security between VLANs unless you put an ACL on the router to prevent access from one VLAN to the other, and this will disallow traffic between VLANs, so you would need to be outside your network to access the insecure VLAN, and your tools server would also need to be outside your network if it needs to access the insecure VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your boxes are both on your network behind a firewall, you could set up a VPN to cross your firewall, and you can restrict access to the VPN to a specific group of people. That way, you have a vulnerable box that is not publicly exposed, but you and your friends can attack it as you please through the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure VLANs actually gain anything for you, but a security router with built-in firewall and VPN could be what you are looking for.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-12T01:45:43.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25146" PostTypeId="2" ParentId="25142" CreationDate="2015-12-12T03:09:37.413" Score="1" Body="&lt;p&gt;Remember, that while you may intend for it to be used by you and your friends, it will be on the Internet and open for anyone to exploit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, if exposing an intentionally vulnerable device on the Internet is the goal, then the more separation the better. I would recommend getting an entirely separate Internet connection (with it's own hardware) to dedicate to the vulnerable host. Treat anything that is connected to that network as compromised after the exploitable device is exposed, including any network devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make it easier on yourself, make everything as easy to restore as possible. Before exposing anything get everything configured and secure. Archive backups of configurations and systems (do not store on the same network where it will be exposed). Use software that &lt;a href=&quot;https://en.wikipedia.org/wiki/Deep_Freeze_(software)&quot; rel=&quot;nofollow&quot;&gt;Deep Freezes&lt;/a&gt; systems or makes them easy to restore. That way, when it comes time to make sure everything is secure again, it takes as little work as possible (possibly just reboots or factory defaulting with configuration restores).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use unique passwords for each device in that environment that you haven't ever used elsewhere. Change these passwords every time you expose the vulnerable network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possibly most important, only expose the vulnerable system when you are actually using it. Primarily because exploited systems can be used in attacks on other entities. Preventing having your systems participate in attacks elsewhere is first an foremost being a good &quot;netizen&quot; but if that isn't enough imagine that your exploitable system came back to bite you personally (i.e. used in an attack that exposed your financials, etc). Also depending on laws where you live, you may be liable for damages done from an intentionally exploitable system. Finally, this will also help prevent it becoming a widely known soft target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I mean by my last statement is that &quot;soft targets&quot; get put on lists and sometimes shared by those online looking to exploit systems. You mention that &quot;logs in the Kali RPi are filled with brute force attacks.&quot; If your RPi isn't taking action on these brute force attacks (i.e. dropping traffic from source IPs after X failed attampts, etc) the number of these attacks will only increase over time. If the RPi takes action, it will see fewer attempts over time (they will never completely go away). &lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-12-12T03:09:37.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25149" PostTypeId="2" ParentId="17869" CreationDate="2015-12-12T09:05:52.777" Score="-2" Body="&lt;p&gt;IF this is NOT a nexus switch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;set your port channel to mode on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port-channel5 mode on&lt;/p&gt;&#xA;" OwnerUserId="21290" LastActivityDate="2015-12-12T09:05:52.777" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25152" PostTypeId="1" CreationDate="2015-12-12T11:27:58.167" Score="1" ViewCount="967" Body="&lt;p&gt;i have network in my office which i roughly described in images.&#xA;pc1(Ethernet) and laptop(via wifi) is connected directly to router, and pc2 and pc3 is connected via switch in both in Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when i transfer data between laptop and pc1 it works fine, but when i trying to transfer between pc2 or pc3 to pc1 process becomes too much slow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is using switch making this lan slow or is there any extra configuration is to make to work this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lCURE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lCURE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3334" LastActivityDate="2016-01-11T17:49:50.210" Title="can switch make lan slow" Tags="|switch|router|troubleshooting|" AnswerCount="2" CommentCount="2" ClosedDate="2017-08-12T23:14:34.227" ContentLicense="CC BY-SA 3.0" />
  <row Id="25153" PostTypeId="2" ParentId="25152" CreationDate="2015-12-12T12:32:07.260" Score="1" Body="&lt;p&gt;Using a switch does not make a network slow. In fact, in most cases, it makes it faster since switches provide separate bandwidth per interface and many collision domains. Only when it comes to broadcasts do switches prove inferior (assuming without vlan, etc) since it has only one broadcast domain. Routers are only used in the case of linking two different networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your problem, I would suggest checking the cabling you're using with the switch. You should be using a straight through cable for switch to host connections (length of the cable also matters). Usually, slowness with a switch is attributed to duplex or speed mismatches between two devices. However, to zero into your problem, we'll need some interface information of your switch (maybe a show interfaces f0/0?)&lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2015-12-12T12:32:07.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25155" PostTypeId="1" CreationDate="2015-12-12T13:54:01.897" Score="1" ViewCount="449" Body="&lt;p&gt;Why PPP have protocol field? Isn't whole purpose of partitioning communication system to have simple isolated subsystems?&lt;/p&gt;&#xA;" OwnerUserId="21294" LastEditorUserId="8499" LastEditDate="2018-03-18T21:22:20.700" LastActivityDate="2018-03-18T21:22:20.700" Title="Why PPP cares about network layer?" Tags="|layer2|osi|layer3|ppp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25156" PostTypeId="1" CreationDate="2015-12-12T14:52:46.790" Score="1" ViewCount="132" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sCABE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sCABE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above image explains how to communicate between IPv4 and IPv6 by tunneling..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that concept by wrapping IPv6 datagram into iPv4 datagram..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I do not understand what the 'Flow X' in the IPv6 datagram means?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know that and can explain me?&lt;/p&gt;&#xA;" OwnerUserId="21296" LastActivityDate="2015-12-12T16:14:17.887" Title="What does the Flow mean?" Tags="|ipv4|ipv6|ipv6-transition|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25157" PostTypeId="2" ParentId="25156" CreationDate="2015-12-12T16:14:17.887" Score="1" Body="&lt;p&gt;A flow is usually a sequence of packets belonging together in some way. In IPv6 each packet has a flow label field that the sender can set to signal which packets belong together.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-12-12T16:14:17.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25159" PostTypeId="2" ParentId="25035" CreationDate="2015-12-12T17:03:50.870" Score="1" Body="&lt;p&gt;The section in the documentation to which you refer says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ASA does not support connecting an EtherChannel to a switch stack.&#xA;  If the ASA EtherChannel is connected cross stack, and if the master&#xA;  switch is powered down, then the EtherChannel connected to the&#xA;  remaining switch will not come up.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are a couple of diagrams which follow. The next diagram shows an EtherChannel among the ASA, and I think this text may apply to it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/M4rpP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M4rpP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next diagram shows each ASA having a separate channel on the switch. This should work on a switch stack. With a stack of two switches, and one switch failing, the EtherChannel of each ASA will fail, but the connections to the switch which stays up should maintain connections between the ASAs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6rOjL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6rOjL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you are really just looking to maintain the connections between the ASA in the event of a switch failure, and I'm pretty sure that the second diagram will work with a stack, but you should test it to be sure. I just don't see how an ASA could tell it is connected to a stack of switches as opposed to a switch chassis with separate boards.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-12T17:03:50.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25160" PostTypeId="2" ParentId="25155" CreationDate="2015-12-12T17:39:37.950" Score="1" Body="&lt;p&gt;PPP is an encapsulating protocol for transporting various network-layer protocols. The design of PPP puts it in both OSI layer-2 and layer-3. The OSI model is theoretical (what happens in the real world can be very different), and some protocols operate in multiple layers. Because of its design, PPP needs to know something about the network-layer protocol which it is transporting:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PPP also established a standard for assigning and managing IP&#xA;  addresses, asynchronous and bit-oriented synchronous encapsulation,&#xA;  network protocol multiplexing, link configuration, link quality&#xA;  testing, error detection, and option negotiation for added networking&#xA;  capabilities.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;One of the three parts to PPP is the Network Control Protocol. PPP allows different NCPs to be used, depending on which network-layer protocol needs to be encapsulated and transported.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a document which explains more about PPP: &lt;a href=&quot;http://docwiki.cisco.com/wiki/Point-to-Point_Protocol&quot; rel=&quot;nofollow&quot;&gt;Point-to-Point Protocol&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-12T17:39:37.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25163" PostTypeId="1" AcceptedAnswerId="25166" CreationDate="2015-12-12T21:01:07.123" Score="2" ViewCount="2010" Body="&lt;p&gt;In a GRE tunnel, when R1 (public IP &lt;code&gt;172.16.0.1&lt;/code&gt;, tunnel address &lt;code&gt;10.0.0.1&lt;/code&gt;) sends a packet to R3 (public IP &lt;code&gt;172.16.0.6&lt;/code&gt;, tunnel address &lt;code&gt;10.0.0.2&lt;/code&gt;) and R3 receives it, the following happens:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;A packet is received on R3's physical interface.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A routing decision determines that the destination address belongs to R3.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The router recognizes the destination IP address (&lt;code&gt;172.16.0.6&lt;/code&gt;)and GRE header as belonging to the tunnel interface. The tunnel interface removes the outer IP and GRE headers, and the original IP packet is sent back &quot;in&quot; to the router.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A second routing decision is performed based on the original destination IP address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The IP TTL is decremented by one and the packet is transmitted out the appropriate interface.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://packetlife.net/blog/2008/jul/11/visualizing-tunnels/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; for the example I'm gonna discuss now and for more details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering about point 3. If the packet's destination in the outer IP header set by the tunnel on R1 is &lt;code&gt;172.16.0.6&lt;/code&gt;, why doesn't R3 immediately get rid of the extra IP and GRE headers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, R3 checks its configured tunnels to find one with source tunnel address &lt;code&gt;172.16.0.6&lt;/code&gt; and passes the packet there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It means that the destination tunnel address on R1 needs to match the source address on R3, and vice versa (&lt;a href=&quot;https://learningnetwork.cisco.com/thread/62310&quot; rel=&quot;nofollow&quot;&gt;proof by example&lt;/a&gt;). If they don't, R1 won't be able ping &lt;code&gt;10.0.0.2&lt;/code&gt;. What is a logical explanation for this requirement?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe I'd like the packets to take different physical paths over the tunnel, depending on the direction they are travelling (R1 to R3 or R3 to R1)?&lt;/p&gt;&#xA;" OwnerUserId="20229" LastActivityDate="2019-11-14T22:49:45.747" Title="Why source and destination addresses should match in GRE tunnel?" Tags="|ipv4|tunnel|gre|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25165" PostTypeId="1" AcceptedAnswerId="25186" CreationDate="2015-12-12T21:50:42.407" Score="0" ViewCount="534" Body="&lt;p&gt;Well, the question is not only for Google, but for other big Internet companies like Amazon or Yahoo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the question can be a bit weird, but I'll try to explain it a bit. Internet is a network made of multiple networks. So first we have networks from Tier 1 Level like Level3, NTT or Telia-Sonera. Then we have ISP that works at Tier 2 level, who pays for connect end users with the entire Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But some large companies have datacenters across the world. How are these connected? &lt;/p&gt;&#xA;" OwnerUserId="21306" LastActivityDate="2015-12-17T16:57:14.827" Title="How google is connected across internet" Tags="|routing|internet|isp|" AnswerCount="2" CommentCount="3" ClosedDate="2015-12-14T19:05:48.423" ContentLicense="CC BY-SA 3.0" />
  <row Id="25166" PostTypeId="2" ParentId="25163" CreationDate="2015-12-12T22:11:49.353" Score="3" Body="&lt;p&gt;One simple explanation is that R3 needs to determine which tunnel the packet came from.  It's often that there may be more than one tunnel terminating on the same interface on R3.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;More importantly, if you allow the tunnel configuration on R3 to specify a different endpoint, there's no guarantee that that address is actually on R1-- it could be anywhere. That would mean the interface for the other end of the tunnel, 10.0.0.1, could exist in two different places. That will cause, as we say, a bad routing day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another explanation is that it allows keepalives so R1 and R3 know that the other end other end of the tunnel is up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can certainly have asymmetric paths if you want.  That depends on the route information on R3.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2015-12-13T17:51:40.913" LastActivityDate="2015-12-13T17:51:40.913" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="25167" PostTypeId="2" ParentId="25165" CreationDate="2015-12-12T22:34:39.343" Score="0" Body="&lt;p&gt;Interesting networking question that you probably partly answered yourself; huge datacentres are globally located in key areas where very  high speed internet is available to the peering hosting companies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your research investigate companies such as Akamai and Cloudfront comes to mind. And the new kid on the block Venturebeat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Technologies used to load balance between the global sites are many (mostly based on Linux I think).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Akamai_Technologies&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Akamai_Technologies&lt;/a&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Amazon_CloudFront&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Amazon_CloudFront&lt;/a&gt;&#xA;&lt;a href=&quot;http://venturebeat.com/2015/12/09/google-cloud-cdn/&quot; rel=&quot;nofollow&quot;&gt;http://venturebeat.com/2015/12/09/google-cloud-cdn/&lt;/a&gt;&#xA;www.sanog.org/resources/sanog24/Peering_Update.pdf&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Load_balancing_(computing)&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Load_balancing_(computing)&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2015-12-12T22:34:39.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25168" PostTypeId="1" AcceptedAnswerId="25169" CreationDate="2015-12-12T22:46:42.933" Score="2" ViewCount="18037" Body="&lt;p&gt;As I understand Cisco IOS takes subnet mask from interface to which is network connected and put it in RIPv2 updates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you advice please if it possible to somehow manualy set subnet mask of RIPv2 updates (in Cisco IOS)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance assuming that I have following topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tHqM4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tHqM4.jpg&quot; alt=&quot;topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should be configured R1 in way to advertise only network A.B.C.D/28 but not entire network A.B.C.D/24?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's strange that configuring of subnet mask for RIPv2 is not supported by wide range of vendors (actually I don't know the one who supports it:))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know if there are any RIPv2 standart limitation for it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19524" LastActivityDate="2015-12-12T23:12:10.283" Title="RIPv2 manual subnet mask configuration?" Tags="|cisco|routing|rip|igp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25169" PostTypeId="2" ParentId="25168" CreationDate="2015-12-12T23:12:10.283" Score="4" Body="&lt;p&gt;RIPv2 with the &lt;code&gt;no auto-summary&lt;/code&gt; option will advertise the specific routes, not the aggregated prefix, unless you you use the &lt;code&gt;ip summary-address rip&lt;/code&gt; interface command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network statements in RIP are not specifically telling RIP what prefix(es) to advertise, they tell RIP which interfaces should participate in RIP, and RIP will get the specific prefix(es) from the interface(s) which fall into the network statement. This is true for most routing protocols on Cisco routers, and it is a source of confusion for many people. For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 10.1.1.1 255.255.255.0&#xA;&#xA;interface FastEthernet0/1&#xA; ip address 10.2.2.1 255.255.255.0&#xA;&#xA;interface FastEthernet1/0&#xA; ip address 172.16.1.1 255.255.255.0&#xA;&#xA;router rip&#xA; version 2&#xA; no auto-summary&#xA; network 10.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above configuration will run RIP on &lt;code&gt;F0/0&lt;/code&gt; and &lt;code&gt;F0/1&lt;/code&gt;, but not &lt;code&gt;F1/0&lt;/code&gt;. RIP will advertise two routes: &lt;code&gt;10.1.1.0/24&lt;/code&gt; and &lt;code&gt;10.2.2.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are Cisco documents, such as &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfrip.html#wp1001118&quot; rel=&quot;nofollow&quot;&gt;Configuring Routing Information Protocol&lt;/a&gt; which explain RIP route summarization:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Restrictions to RIP Route Summarization&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Supernet advertisement (advertising any network prefix less than its&#xA;  classful major network) is not allowed in RIP route summarization,&#xA;  other than advertising a supernet learned in the routing tables.&#xA;  Supernets learned on any interface that is subject to configuration&#xA;  are still learned. For example, the following summarization is&#xA;  invalid:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface E1&#xA;.&#xA;.&#xA;.&#xA;ip summary-address rip 10.0.0.0 252.0.0.0 (invalid supernet summarization)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Each route summarization on an interface must have a unique major net,&#xA;  even if the subnet mask is unique. For example, the following is not&#xA;  permitted:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet1&#xA;.&#xA;.&#xA;.&#xA;ip summary-address rip 10.1.0.0 255.255.0.0&#xA;ip summary-address rip 10.2.0.0 255.255.0.0 (or different mask)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-12T23:12:10.283" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="25171" PostTypeId="1" CreationDate="2015-12-13T05:33:24.997" Score="3" ViewCount="2430" Body="&lt;p&gt;This set of question stems from a part of &lt;a href=&quot;https://networkengineering.stackexchange.com/a/795/3675&quot;&gt;the answer&lt;/a&gt; to this question: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/792&quot;&gt;What are the differences between VRRP and HSRP?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;With HSRP, each interface must have an IP address that is separate from the HSRP group address. VRRP lets you share the Master's interface IP address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm trying to understand this point in more detail. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How are the individual routers sharing the master router's interface IP address? (AKA, how does it work at the ARP/Switch layers)&lt;/li&gt;&#xA;&lt;li&gt;Are the individual (non-master) routers simply not accessible via this IP address until the master fails (and a new master is elected)? &lt;/li&gt;&#xA;&lt;li&gt;Is there a benefit to this configuration other than simply conserving a few more IP addresses?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(so its clear, I'm not referring to the virtual address created by VRRP that becomes the end hosts's default-gateway. I'm talking about the physical router's physical interface address)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="8499" LastEditDate="2018-12-22T20:52:30.800" LastActivityDate="2018-12-22T20:52:30.800" Title="VRRP Sharing Master Router's IP" Tags="|cisco|hsrp|vrrp|fhrp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25172" PostTypeId="2" ParentId="25137" CreationDate="2015-12-13T06:59:16.757" Score="1" Body="&lt;p&gt;could always make sure you set the system to disconnect on logout&lt;/p&gt;&#xA;&#xA;&lt;p&gt;set system ports console logout-on-disconnect&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and just have the console server timeout after X minutes.&lt;/p&gt;&#xA;" OwnerUserId="21308" LastActivityDate="2015-12-13T06:59:16.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25174" PostTypeId="1" AcceptedAnswerId="25176" CreationDate="2015-12-13T07:46:13.950" Score="4" ViewCount="241" Body="&lt;p&gt;I had the &lt;code&gt;&amp;lt;sarcasm&amp;gt;privilege&amp;lt;/sarcasm&amp;gt;&lt;/code&gt; for the second time in 10 years to have one of our smaller prefixes hijacked.  I have a branch office with a /27 assigned from ISP-A PA space configured with static routing.  Recently, ISP-B, a well-known tier 2 cable company, allowed a customer to start advertising a /24 over BGP that overlapped with my /27, effectively siphoning off my traffic and causing an outage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, ISP-B should be filtering what advertisements it receives from its customers to prevent this.  Since my prefix is a /27, it's likely that even if I had my more specific route advertised, it would've been dropped by many routers that filter out anything &gt; /24. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there anything more ISP-A could have done to reduce this likelihood of this event occurring?&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Would it be better for me to speak BGP to ISP-A and advertise that /27 in the hope it at least reaches more of that carrier's network to minimize the chance that on-net traffic would see trouble?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2015-12-15T03:29:48.510" Title="Prefix hijacked by another ISP" Tags="|routing|bgp|isp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25176" PostTypeId="2" ParentId="25174" CreationDate="2015-12-13T08:56:18.687" Score="7" Body="&lt;p&gt;At this moment, there's not that much that ISP's can do to prevent these kind of hijacks except, as you said, doing proper filtering of received and announced prefixes. Unfortunately many ISP's still don't do that. &lt;a href=&quot;https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure&quot; rel=&quot;nofollow&quot;&gt;RPKI&lt;/a&gt; may help as well but has some other drawbacks and isn't widely implemented either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wouldn't expect on-net traffic for ISP-A to be affected though. Any sane ISP wouldn't accept their own prefixes (or more specifics of those) from any BGP peer. If they really accepted the /24 containing your prefix from another ISP, that's something you should complain about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds as if ISP-A only had an aggregate route containing a larger block than your /27 in its IBGP, else they should always have had a more specific route winning it from the hijacked /24. If it makes any difference if they configure that /27 statically on an interface or receive it via BGP is something only ISP-A can answer. Maybe it does help and the /27 will be installed in their IBGP, maybe not. &lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="630" LastEditDate="2015-12-15T03:29:48.510" LastActivityDate="2015-12-15T03:29:48.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25177" PostTypeId="2" ParentId="25171" CreationDate="2015-12-13T08:57:06.887" Score="3" Body="&lt;p&gt;The individual routers' physical interfaces do not share the master router's IP address. Each router must have different addresses configured on the physical interface. What that statement means is that the virtual interface may be assigned to the IP address of one of the physical interfaces. The physical interface which shares its address with the virtual interface becomes the master. IOS will assign the interface with same address as the virtual interface to a priority of &lt;code&gt;255&lt;/code&gt; to always make it the master because the maximum priority which can be configured is &lt;code&gt;254&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no problem with pinging or reaching each router since each router, except the master, actually has a different assigned address which is different than the virtual address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This feature really only conserves IP addresses, and only one per subnet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-13T08:57:06.887" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25178" PostTypeId="1" CreationDate="2015-12-13T10:14:44.417" Score="3" ViewCount="319" Body="&lt;p&gt;I was reading about &lt;a href=&quot;https://en.wikipedia.org/wiki/Smurf_attack&quot; rel=&quot;nofollow&quot;&gt;Smurf Attacks&lt;/a&gt; and how &lt;a href=&quot;https://en.wikipedia.org/wiki/Smurf_Amplifier_Registry&quot; rel=&quot;nofollow&quot;&gt;Smurf Amplifier Registry&lt;/a&gt; keeps track of servers used for amplifying the attack, then I wondered, can a request coming from anywhere broadcast it to all parts on a network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, do routers come by default so that if they receive a message from the internet they actually will broadcast it to all nodes on the internal network? Wouldn't this mean it's very simple to ping the entire internet all at once?&lt;/p&gt;&#xA;" OwnerUserId="8025" LastEditorUserId="8499" LastEditDate="2019-01-05T03:26:56.523" LastActivityDate="2019-01-05T03:26:56.523" Title="Must a broadcast request come from the same network?" Tags="|routing|router|subnet|security|broadcast|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25179" PostTypeId="2" ParentId="25178" CreationDate="2015-12-13T10:21:00.980" Score="6" Body="&lt;p&gt;Broadcasts do not normally cross layer-3 (routers). Some routers can be configured to forward subnet broadcasts, but the limited broadcast (255.255.255.255) will not cross layer-3. The Cisco version is &lt;code&gt;ip directed-broadcast&lt;/code&gt;, and it must be configured on each subnet for which you want it. This is considered dangerous, and it is highly discouraged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Broadcasts are layer-2, which is why it is bounded by layer-3. Since broadcasts force an interruption of every host on a layer-2 domain, they are bounded by layer-3 by default. The Internet would be completely unusable if broadcasts went everywhere.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-13T10:21:00.980" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25181" PostTypeId="1" AcceptedAnswerId="25183" CreationDate="2015-12-13T12:26:44.513" Score="3" ViewCount="57" Body="&lt;p&gt;Is it possible to somehow program or configure Ethernet router to direct all traffic from specific port to some other port bidirectionally (as if connecting devices are directly connected via Ethernet cable), while all other ports are routed normally? If yes, can you give me some key terms to google because all English wording I come up with are a dead end. Also, if yes, how &quot;physical&quot; is this connection? In a sense, if I put some arbitrary DC voltage on unused wires of 10/100A will the other device see it? &lt;/p&gt;&#xA;" OwnerUserId="21297" LastActivityDate="2015-12-13T13:34:55.123" Title="Is it generally possible to manually program network routers on how to direct traffic?" Tags="|routing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25182" PostTypeId="2" ParentId="25181" CreationDate="2015-12-13T13:02:38.797" Score="2" Body="&lt;p&gt;A lot depends on the type of router you have.  Cisco calls it &quot;policy based routing,&quot; but other manufacturers use other names.   And it is a logical connection, not a physical one.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-13T13:02:38.797" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25183" PostTypeId="2" ParentId="25181" CreationDate="2015-12-13T13:34:55.123" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In a sense, if I put some arbitrary DC voltage on unused wires of 10/100A will the other device see it? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Probably you will fry the router's circuitry and nothing more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The behavior that you are describing is that of a hub (stupid repeater), and even then....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should get some basic understanding of the different layers:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Layer 1: physical connection: connection between machines, or between machines and some network gear like&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a repeater/hub (layer 1 device),&lt;/li&gt;&#xA;&lt;li&gt;a bridge/switch (layer 2 device), or&lt;/li&gt;&#xA;&lt;li&gt;a router (layer 3 device)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Layer 2 and up: The signal on the wire is inspected by the circuitry of the device in order to decide which ports to forward it to.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I don't know what you are planning to do exactly, but in any case with classical network gear it is not possible.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2015-12-13T13:34:55.123" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25185" PostTypeId="1" AcceptedAnswerId="25187" CreationDate="2015-12-13T14:54:14.460" Score="2" ViewCount="7308" Body="&lt;p&gt;how can I read the STP port status of each interface (in my software/program)?&#xA;There is a MIB called BRIDGE-MIB with OID &quot;dot1dStpPortState=1.3.6.1.2.1.17.2.15.1.3&quot; that returns the FORWARDING OR BLOCKING state.&#xA;BUT my problem is that i can not associate the returned value with the port/interface.&#xA;It seems the index of the OID is the &quot;nbr&quot; that is shown in the output of the &quot;show spanning-tree&quot; command, yet again I dont know how this relates to the interface number (it seems there is a fix offset added to the interface number, but how is that calculated?) the output for a typical show spanning-tree cmd is shown:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch2#show spanning-tree&#xA;VLAN0001&#xA;Spanning tree enabled protocol ieee&#xA; Root ID    Priority    32769&#xA;         Address     0006.d6ab.a040&#xA;         Cost        19&#xA;         Port        11 (FastEthernet0/11)&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)&#xA;         Address     0006.d6ac.46c0&#xA;         Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;         Aging Time 15&#xA;Interface        Role Sts Cost      Prio.**Nbr** Type&#xA;---------------- ---- --- --------- --------        -------------------------------&#xA;Fa0/2            Desg FWD 19        128.4    P2p&#xA;Fa0/11           Root FWD 19        128.13   P2p&#xA;Fa0/12           Altn BLK 19        128.14   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the last three rows show that status of each interface/port and the relating priority.Nbr (Does anyone know how nbr for each interface is calculated?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any OID that would simply show the STP status of each port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the help in advance.&lt;/p&gt;&#xA;" OwnerUserId="17447" LastActivityDate="2015-12-13T15:10:56.627" Title="how to read the STP status (FORWARD/BLOCKING) of each interface/port via SNMP" Tags="|cisco|snmp|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25186" PostTypeId="2" ParentId="25165" CreationDate="2015-12-13T15:10:37.847" Score="1" Body="&lt;p&gt;There are basically two approaches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One is to make each datacenter (or cluster of datacenters) a separate &quot;network&quot; with it's own IP space (which may be either allocated by a provider or provider independent) and it's own routing and it's own deals (transit and possibly peering) with networks who have a presence in the datacenter's locality. Traffic between the datacenters in different parts of the world would then go via one or more IP transit providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other approach is to rent circuits (which may be dedicated fiber, WDM wavelengths, MPLS links or whatever) between your datacenters and build a network which appears to the rest of the internet as one network. Traffic between your own hosts in different datacenters never leaves your network. Traffic to hosts elsewhere on the internet will obviously flow in and out of your network but possibly not at the same location where it is generated/consumed. This gives you more flexibility on how traffic is routed and makes it easier to move IPs around to different geographical locations but it can work out more expensive, especially if you are small.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure google takes the second approach.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Someone mentioned anycast in a comment on the question. Anycast is possible with both approaches but you have more flexibility with the &quot;one network&quot; approach since the smallest route you can advertise on the internet is generally a /24 while within your own network you can route individual IPs or even route based on information other than the destination IP.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2015-12-17T16:57:14.827" LastActivityDate="2015-12-17T16:57:14.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25187" PostTypeId="2" ParentId="25185" CreationDate="2015-12-13T15:10:56.627" Score="1" Body="&lt;p&gt;What you're getting at the OID you mentioned is a table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BRIDGE-MIB::dot1dStpPortState.1025 = INTEGER: blocking(2)&#xA;BRIDGE-MIB::dot1dStpPortState.1026 = INTEGER: blocking(2)&#xA;BRIDGE-MIB::dot1dStpPortState.1027 = INTEGER: blocking(2)&#xA;BRIDGE-MIB::dot1dStpPortState.1028 = INTEGER: forwarding(5)&#xA;BRIDGE-MIB::dot1dStpPortState.1029 = INTEGER: blocking(2)&#xA;BRIDGE-MIB::dot1dStpPortState.1030 = INTEGER: blocking(2)&#xA;BRIDGE-MIB::dot1dStpPortState.1031 = INTEGER: forwarding(5)&#xA;BRIDGE-MIB::dot1dStpPortState.1032 = INTEGER: blocking(2)&#xA;BRIDGE-MIB::dot1dStpPortState.1033 = INTEGER: blocking(2)&#xA;BRIDGE-MIB::dot1dStpPortState.1034 = INTEGER: blocking(2)&#xA;BRIDGE-MIB::dot1dStpPortState.1035 = INTEGER: blocking(2)&#xA;BRIDGE-MIB::dot1dStpPortState.1036 = INTEGER: blocking(2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then match the bridge port to the interface index by querying .1.3.6.1.2.1.17.1.4.1.2.1033&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BRIDGE-MIB::dot1dBasePortIfIndex.1033 = INTEGER: 62009&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then look it up in the interface table &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IF-MIB::ifName.62009 = STRING: ge.6.9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2015-12-13T15:10:56.627" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25188" PostTypeId="2" ParentId="24376" CreationDate="2015-12-13T15:34:42.760" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I have trying to get a better mental big-picture of how the internet works I stumbled across the Wikipedia article about Tier 1 networks that really helped build my picture. This lead to Wikipedia'ing about interconnect agreements and especially internet exchange points which helped to greatly clarify the mechanisms of the internet. I found www.internetexchangemap.com which helped with a physical picture.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Exchange points are not the be-all and end all of peering. They are a mechanism to allow the costs of a physical connection to be shared among multiple peering relationships, the downside being that you have to pay for the exchange points switching infrastructure and organisational overhead. So low traffic peering relationships tend to go via exchange points while high traffic ones tend to go via dedicated private links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a provider buys &quot;transit&quot; (that is the service of providing connectivty to anywhere on the internet) then again that connection is almost certain to go over a private link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There seems to be a big difference in attitude here between the US and Europe. The big access providers in the US tend to be very monopolistic and have the attitude that peering with &quot;little guys&quot; is giving away for free something that they could be charging for. In many cases those big access providers are also teir 1 transit providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand in Europe there is more competition among ISPs and the individual access providers are generally smaller and have to buy transit to reach large parts of the internet. The result is that there is more incentive for the access providers to peer directly with the content providers and internet exchanges flourish.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;how does an AT&amp;amp;T end user request make it to a web server on a Verizon network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Given that AT&amp;amp;T and Verizon are both teir 1 ISPs it will almost certainly pass over a private peering link between them. That link may well not be especially local though (you can often get hints as to the geographic route from the hostnames in traceroute). &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A related question: I'm also wondering what the Milwaukee Internet Exchange means in their FAQ when they discuss how you can go there and &quot;connect&quot; (www.mkeix.net/faq/).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They don't explicitly list minimum requirements on that page but in practice they would almost certainly expect you to have your own IP space and AS number before allowing you to connect. I expect they would also at the very least consider it strange if you applied to connect to the exchange without first acquiring transit connectivity to the Internet in general&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that connecting to an exchange doesn't necessarily let you interconnect with everyone on that exchange. The actual peering relationships are still at the discretion of the individual member.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lack of requirements and fees listed on that page suggests they are a fairly minor internet exchange. Most of the big ones will have a lot more formalities and reccuring fees.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2015-12-16T03:30:42.260" LastActivityDate="2015-12-16T03:30:42.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25189" PostTypeId="2" ParentId="25137" CreationDate="2015-12-13T17:29:25.977" Score="8" Body="&lt;p&gt;UPDATE: As of 16.1 this is possible with the following configuration:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;set system login idle-timeout n&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Where &lt;code&gt;n&lt;/code&gt; is the number of minutes.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/ref/statement/idle-timeout--edit-system-login.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.juniper.net/documentation/us/en/software/junos/network-mgmt/topics/ref/statement/idle-timeout--edit-system-login.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;For versions of code prior to 16.1, the following answer still works.&lt;/p&gt;&#xA;&lt;p&gt;Setting idle-timeout for root directly from the CLI is not possible, unfortunately.&lt;/p&gt;&#xA;&lt;p&gt;I wrote an event script that does what you need.&lt;/p&gt;&#xA;&lt;p&gt;Basically, every 5 minutes it checks:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If root is logged in via console (verified by a &amp;quot;-&amp;quot; in the FROM&#xA;section of &amp;quot;show system users&amp;quot;)&lt;/li&gt;&#xA;&lt;li&gt;If root is logged in, has it been&#xA;idle for 15 minutes or more (checked in seconds, so 900 seconds).&lt;/li&gt;&#xA;&lt;li&gt;If&#xA;all of those requirements are met, issue &amp;quot;request system logout&#xA;terminal $TERM&amp;quot; (uses whatever terminal is present in the information&#xA;the script pulled).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;strong&gt;Non-XML version of what is pulled:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;jhead@VPN-EP1&amp;gt; show system users&#xA; 4:02PM  up 2:56, 2 users, load averages: 0.07, 0.02, 0.00&#xA;USER     TTY      FROM                              LOGIN@  IDLE WHAT&#xA;root     v0       -                                3:55PM      6 cli&#xA;jhead    p0       172.16.67.1                      1:09PM      - -cli (cli)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can see a closer representation of what information the script parses by issuing:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;show system users | display xml&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;The Script Itself: (filename: &lt;code&gt;terminate-idle-root.slax&lt;/code&gt;)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA; * Author        : Jordan Head&#xA; * Company       : Juniper Networks&#xA; * Version       : 1.0&#xA; * Last Modified : December 13, 2015&#xA; * Platform      : all&#xA; *&#xA; * Description   : This event script periodically checks for root user sessions logged in&#xA; * via out-of-band console that have been idle for 15 minutes or more, and terminates the session.&#xA; *&#xA; */&#xA;&#xA;version 1.0;&#xA;&#xA;ns junos = &amp;quot;http://xml.juniper.net/junos/*/junos&amp;quot;;&#xA;ns xnm = &amp;quot;http://xml.juniper.net/xnm/1.1/xnm&amp;quot;;&#xA;ns jcs = &amp;quot;http://xml.juniper.net/junos/commit-scripts/1.0&amp;quot;;&#xA;&#xA;import &amp;quot;../import/junos.xsl&amp;quot;;&#xA;&#xA;var $event-definition = {&#xA;  &amp;lt;event-options&amp;gt; {&#xA;    &amp;lt;generate-event&amp;gt; {&#xA;      &amp;lt;name&amp;gt; &amp;quot;5-minute-delay&amp;quot;;&#xA;      &amp;lt;time-interval&amp;gt; &amp;quot;300&amp;quot;;&#xA;    }&#xA;    &amp;lt;policy&amp;gt; {&#xA;      &amp;lt;name&amp;gt; &amp;quot;terminate-idle-root&amp;quot;;&#xA;      &amp;lt;events&amp;gt; &amp;quot;5-minute-delay&amp;quot;;&#xA;      &amp;lt;then&amp;gt; {&#xA;        &amp;lt;event-script&amp;gt; {&#xA;          &amp;lt;name&amp;gt; &amp;quot;terminate-idle-root.slax&amp;quot;;&#xA;        }&#xA;      }&#xA;    }&#xA;  }&#xA;}&#xA;&#xA;match / {&#xA;    &amp;lt;op-script-results&amp;gt; {&#xA;&#xA;      var $root_user = &amp;quot;root&amp;quot;;&#xA;      var $idle_time = &amp;quot;900&amp;quot;;&#xA;      var $from = &amp;quot;-&amp;quot;;&#xA;&#xA;      var $show-system-users-output = &amp;lt;get-system-users-information&amp;gt;;&#xA;      var $show-system-users = jcs:invoke($show-system-users-output);&#xA;&#xA;      for-each ($show-system-users/uptime-information/user-table/user-entry) {&#xA;          var $user_check = ./user;&#xA;          var $idle_time_check = ./idle-time/@junos:seconds;&#xA;          var $from_check = ./from;&#xA;          var $tty = ./tty;&#xA;              if ($user_check == $root_user &amp;amp;&amp;amp; $idle_time_check &amp;gt;= $idle_time &amp;amp;&amp;amp; $from_check == $from) {&#xA;                  var $terminate_root_console = &amp;lt;command&amp;gt; &amp;quot;request system logout terminal &amp;quot; _ $tty;&#xA;                  expr jcs:invoke($terminate_root_console);&#xA;              }&#xA;      }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Applying the Script:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;If the commit is successful, it means that the script's syntax is valid.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;jhead@VPN-EP1&amp;gt; configure exclusive&#xA;warning: uncommitted changes will be discarded on exit&#xA;Entering configuration mode&#xA;&#xA;[edit]&#xA;jhead@VPN-EP1# set event-options event-script file terminate-idle-root.slax&#xA;&#xA;[edit]&#xA;jhead@VPN-EP1# commit and-quit&#xA;commit complete&#xA;Exiting configuration mode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Hope this helps, feel free to comment if anything is unclear and I'll be happy to update my answer.&lt;/p&gt;&#xA;&lt;p&gt;Just a final note: @bob is right, that should work.  I've just seen console appliances that maintain a connection, but allow access to the box itself so it wouldn't terminate.  If you're doing a typical setup, his solution will work - but I've seen implementations where it wouldn't.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Adjusting Timeout for root Shells:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Just wanted to add one more quick thing someone brought to my attention.&lt;/p&gt;&#xA;&lt;p&gt;If you're concerned with idle timeout on root user shell sessions (not CLI), you can jump into a shell and set:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;set autologout=X  ## Where X is the number of minutes of idle time before session is terminated.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You add/edit the file /etc/csh.login&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2021-06-08T18:03:20.680" LastActivityDate="2021-06-08T18:03:20.680" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25193" PostTypeId="1" AcceptedAnswerId="25194" CreationDate="2015-12-14T02:07:45.823" Score="2" ViewCount="90" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2460&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC2460&lt;/a&gt; doesn't describe any types other than Type 0. And in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5095&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC5095&lt;/a&gt;, it deprecated Type 0 Routing Header. Does that mean Routing Header is useless?&lt;/p&gt;&#xA;" OwnerUserId="20657" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-12-14T02:29:44.827" Title="Is IPv6 Routing Header useless?" Tags="|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25194" PostTypeId="2" ParentId="25193" CreationDate="2015-12-14T02:29:44.827" Score="2" Body="&lt;p&gt;Basically, at this point in time, yes. The door is still open for future types, but I think the whole idea of the routing header was flawed to begin with. Add the fact that some variants of SDN want to do something similar, and I think the idea is dead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have never thought it a good idea to let end-devices try to dictate the path packets take through the network. Similarly, if you look at QoS, most successful QoS implementations usually overwrite the end-device supplied DSCP value in order to create a comprehensive, consistent QoS solution; everybody wants their traffic marked &lt;code&gt;EF&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-14T02:29:44.827" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25199" PostTypeId="2" ParentId="17810" CreationDate="2015-12-14T07:11:48.687" Score="1" Body="&lt;p&gt;I think you're correct. The key point is ABR (R1 and R4), since they decide the flooding between areas and exchange area information in backbone area. However, the idea can be easier to understand. In RFC2328:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;3.1. The backbone of the Autonomous System&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The OSPF backbone is the special OSPF Area 0 (often written as&#xA;  Area 0.0.0.0, since OSPF Area ID’s are typically formatted as IP&#xA;  addresses). The OSPF backbone always contains all area border&#xA;  routers. &lt;strong&gt;The backbone is responsible for distributing routing&#xA;  information between non-backbone areas.&lt;/strong&gt; The backbone must be&#xA;  contiguous. However, it need not be physically contiguous;&#xA;  backbone connectivity can be established/maintained through the&#xA;  configuration of virtual links.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3.7. Partitions of areas&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;However, in order to maintain full routing after the partition,&#xA;  an address range must not be split across multiple components of&#xA;  the area partition. Also, &lt;strong&gt;the backbone itself must not&#xA;  partition. If it does, parts of the Autonomous System will&#xA;  become unreachable.&lt;/strong&gt; Backbone partitions can be repaired by&#xA;  configuring virtual links (see Section 15).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So we know an OSPF autonomous system can only have a backbone area.&#xA;Based on the scenario you presented, after backbone area is splited, it's no longer a single OSPF autonomous system, but two OSPF autonomous systems [Area 0(a), Area 1] and [Area 0(b), Area 1]. So both autonomous systems have routing information of Area 1, which is the behavior you desired.&lt;/p&gt;&#xA;" OwnerUserId="20657" LastActivityDate="2015-12-14T07:11:48.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25200" PostTypeId="1" CreationDate="2015-12-14T07:46:21.010" Score="1" ViewCount="203" Body="&lt;p&gt;How do i telnet back?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have done stacking using 2 dummy HP Pro Curve 2610.&#xA;Gateway for Commander is 192.168.1.1 , while member has 192.168.1.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was in Commander Switch, then i telnet to the Member Switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue was that, when i am in Member Switch, i could not telnet back to Commander Switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize that when i use &quot;Sh Stack All&quot; , my Commander Switch does not have Commander IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do i rectify all these and telnet back to Commander?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Commander is 1-0&#xA;Member is 1-1&lt;/p&gt;&#xA;" OwnerUserId="14178" LastActivityDate="2016-02-09T09:01:23.543" Title="HP ProCurve Stacking" Tags="|hp-procurve|stacking|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25201" PostTypeId="1" AcceptedAnswerId="25205" CreationDate="2015-12-14T10:19:28.910" Score="1" ViewCount="6896" Body="&lt;p&gt;I have some Netgear GS728TP smart switches with some CCTV camera that run over them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Occasionally these camera's freeze and require the network plug pulling on them to reset (They are PoE)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of these switches are in some awkward to get to places so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way in the Netgear admin panel to disable / enable switch ports so I can kill the power and essentially reboot the camera without having to climb ladders etc?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've hunted through the manuals but no joy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="5980" LastEditorUserId="8499" LastEditDate="2015-12-14T15:50:42.577" LastActivityDate="2015-12-14T15:50:42.577" Title="Disable port Netgear GS728TP" Tags="|switch|management|power-over-ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25202" PostTypeId="1" CreationDate="2015-12-14T11:04:15.823" Score="0" ViewCount="286" Body="&lt;p&gt;I am new to subnet masking. I have a question. If network address is 10.10.10.0/23, what will be the first and last usable IP address of this network?&lt;/p&gt;&#xA;" OwnerUserId="21315" LastEditorUserId="509" LastEditDate="2015-12-14T21:04:40.520" LastActivityDate="2015-12-14T21:04:40.520" Title="subnet masking related confusion" Tags="|ipv4|subnet|" AnswerCount="2" CommentCount="0" ClosedDate="2015-12-14T19:05:57.750" ContentLicense="CC BY-SA 3.0" />
  <row Id="25203" PostTypeId="2" ParentId="25202" CreationDate="2015-12-14T11:23:51.857" Score="0" Body="&lt;p&gt;The range of usable hosts will be 10.10.10.1 - 10.10.11.254 with a subnet of 255.255.254.0. The 10.10.10.255 and 10.10.11.0 address will be usable in this situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can run these questions through a subnet calcualtor. I use &lt;a href=&quot;http://wintelguy.com/subnetcalc.pl&quot; rel=&quot;nofollow&quot;&gt;Wintelguy&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8397" LastActivityDate="2015-12-14T11:23:51.857" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25204" PostTypeId="2" ParentId="25202" CreationDate="2015-12-14T13:28:11.720" Score="2" Body="&lt;p&gt;I don't believe that 10.10.10.10/23 is a network address, it would be a host address on a network;  the network address would be 10.10.10.0, the subnet mask would be 255.255.254.0. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the calculations:  I always convert to binary - 10.10.10.10 is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001010 00001010 00001010 00001010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With a 23 bit subnet mask, that's &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111 11111111 11111110 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using it as a mask&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111 11111111 11111110 00000000&#xA;00001010 00001010 00001010 00001010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the network address is the part below the 1's, followed by zeros:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001010 00001010 00001010 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is 10.10.10.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hosts are determined by the rest of the bits.  Since the mask is 23 bits, there are 9 bits for the host portion of the addresses.  (32-23=9)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so they range from  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 00000000 00000000 00000001 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 00000000 00000001 11111111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Adding those values to the network address - the low value:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 00001010 00001010 00001010 00000000&#xA;+00000000 00000000 00000000 00000001&#xA;____________________________________&#xA; 00001010 00001010 00001010 00000001 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is 10.10.10.1  - the high value:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 00001010 00001010 00001010 00000000&#xA;+00000000 00000000 00000001 11111111&#xA;____________________________________&#xA; 00001010 00001010 00001011 11111111 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is 10.10.11.255 - the broadcast address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the network address is 10.10.10.0 &#xA;and the broadcast address is 10.10.11.255 &#xA;and the usable addresses are 10.10.10.1 through 10.10.11.254 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;its easy in binary.  &lt;/p&gt;&#xA;" OwnerUserId="19640" LastActivityDate="2015-12-14T13:28:11.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25205" PostTypeId="2" ParentId="25201" CreationDate="2015-12-14T14:36:07.307" Score="1" Body="&lt;p&gt;In the &lt;a href=&quot;http://www.downloads.netgear.com/files/GDC/GS728TP/GS752TP_GS728TP_GS728TPP_SWA_3Dec2013.pdf&quot; rel=&quot;nofollow&quot;&gt;GS752TP, GS728TP, and GS728TPP Gigabit Smart Switches Software Administration Manual&lt;/a&gt;, on page 47:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Admin Mode. Select whether to enable or disable the ability of the&#xA;  port to deliver power.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It would seem that you can shut off power on the port, wait a few minutes, then re-enable it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from that, it is not a very good idea to have the switches in awkward places. Network infrastructure devices, like switches and routers, should be racked in data closets, and the cabling should extend back to the data closet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-14T14:36:07.307" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="25212" PostTypeId="1" CreationDate="2015-12-14T22:02:52.683" Score="2" ViewCount="140" Body="&lt;p&gt;I have a Catalyst 3750 series switch-stack with 3 switches in the stack. All of my clients are connected to the 10/100 ports of the switch-stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 10 servers connected to 10/100/1000 SFP plugs (4 in each switch)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our gateway (firewall) for all the clients and servers is plugged into one of the SFP 10/100/1000 ports of the switch-stack, and the firewall itself is a 10/100/1000 port...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does all the traffic have to flow through the gateway (firewall), limiting throughput to the firewall's 10/100/1000 port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I apologize if this is a silly question, but I really need help...&lt;/p&gt;&#xA;" OwnerUserId="21345" LastActivityDate="2015-12-15T01:02:55.277" Title="Calculating Throughput... Please help!" Tags="|firewall|switching|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25213" PostTypeId="2" ParentId="25212" CreationDate="2015-12-14T22:49:21.340" Score="1" Body="&lt;p&gt;Only traffic destined for a VLAN (subnet) which is different from the one on which it originated needs to travel through the router. Intra-VLAN traffic will not use a router, but inter-VLAN traffic will.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-14T22:49:21.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25214" PostTypeId="1" AcceptedAnswerId="25215" CreationDate="2015-12-14T23:44:03.090" Score="1" ViewCount="3096" Body="&lt;p&gt;Last time i had many mistakes this time the problem is on in the cardif but i dont get it i do the math and the resuls are right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AmDw8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AmDw8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21218" LastEditorUserId="8499" LastEditDate="2018-12-22T20:55:06.190" LastActivityDate="2018-12-22T20:55:06.190" Title="Cisco Packet Tracer (overlap error)" Tags="|cisco|ip|ipv4|subnet|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25215" PostTypeId="2" ParentId="25214" CreationDate="2015-12-14T23:51:15.843" Score="0" Body="&lt;p&gt;If you compare the two tables, the subnet masks don't match for Cardiff F0/0. The subnet mask on the second table is too small (host subnet too large), and it overlaps the next subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC5 has an invalid host IP address. The last valid host address must be an even number. The IP address assigned to PC5 is the broadcast address for the subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me give you the benefit of my experience. You probably should have used a single table. In my experience, duplicate information will &lt;em&gt;always&lt;/em&gt; get out of sync. That appears to have been the problem here. The subnet mask in the first table appears to be correct, but it does not match the subnet mask in the second table. Had you just made another column in the first table for the interface IP address, you probably would not have made the overlap mistake.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-15T00:06:56.263" LastActivityDate="2015-12-15T00:06:56.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25220" PostTypeId="1" CreationDate="2015-12-15T03:35:28.187" Score="1" ViewCount="76" Body="&lt;p&gt;Two different paths to the same network are present in the routing table: one entered statically: and the other learned through dynamic routing protocol. When forwarding a packet to that network, which route will the router choose, the static route or the dynamic route? I have one more confusion. if the router doesn't find a path to the destination in the routing table, will it forward the packet through all the interfaces?&lt;/p&gt;&#xA;" OwnerUserId="21315" LastEditorUserId="21315" LastEditDate="2015-12-15T04:12:47.523" LastActivityDate="2015-12-15T04:12:47.523" Title="Static and dynamic routing related query" Tags="|routing|network-core|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25221" PostTypeId="2" ParentId="25220" CreationDate="2015-12-15T03:39:47.550" Score="2" Body="&lt;p&gt;Assuming both prefixes are equally long, it will choose the one with the lowest administrative distance. That would, by default, be the static route, but either one could have had the AD changed. For example, when you configure a static route, you can configure it with am AD higher than the learned prefix so that it is a floating static route.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-15T03:39:47.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25222" PostTypeId="1" CreationDate="2015-12-15T05:17:15.680" Score="1" ViewCount="345" Body="&lt;p&gt;I have a confusion. if the router doesn't find a path to the destination in the routing table, will it forward the packet through all the interfaces?&lt;/p&gt;&#xA;" OwnerUserId="21315" LastActivityDate="2015-12-16T21:19:23.367" Title="packet forwarding decision taken by router" Tags="|routing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25223" PostTypeId="2" ParentId="25222" CreationDate="2015-12-15T05:39:47.353" Score="5" Body="&lt;p&gt;Routing tables usually have a default path. Packets that don't meet the longest match for any entry in the routing table are then forwarded through the default route. There also exists Proxy ARP which can help find destinations that aren't in it's local routing table. But definitely the router doesn't forward packets out all interfaces in case it can't find the destination, it just drops the packets, in which case you'd get a destination unreachable or timed out or some error depending on the situation.&lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2015-12-15T05:39:47.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25224" PostTypeId="1" CreationDate="2015-12-15T06:51:41.390" Score="1" ViewCount="1982" Body="&lt;p&gt;suppose I have three ip addresses&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; A:172.16.1.1&#xA; B:172.16.2.1&#xA; C:172.16.3.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, If I want to put B and C in the same network and A in a different network, which subnet mask will i have to use? how will I calculate it?&lt;/p&gt;&#xA;" OwnerUserId="21315" LastActivityDate="2015-12-15T14:42:14.990" Title="calculating subnet mask from ip addresses" Tags="|routing|ipv4|subnet|" AnswerCount="1" CommentCount="1" ClosedDate="2015-12-15T11:30:52.810" ContentLicense="CC BY-SA 3.0" />
  <row Id="25225" PostTypeId="2" ParentId="25224" CreationDate="2015-12-15T06:58:26.333" Score="0" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;172.16.1.0/24&lt;/code&gt; for A&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;172.16.2.0/23&lt;/code&gt; for B and C&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3697/the-slash-after-an-ip-address-cidr-notation&quot;&gt;This question will tell you how to calculate it.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP Address &lt;code&gt;10.10.15.10/16&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 1) Translate the IP address 4 octets into binary:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;00001010.00001010.00001111.00001010&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 2) Translate the Subnet mask 4 octets into binary, which is easy using CIDR:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;11111111.11111111.00000000.00000000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 3) Perform the &lt;code&gt;AND&lt;/code&gt; operation on the two addresses. This will give you the Network Address for the subnet. &lt;code&gt;AND&lt;/code&gt; rules are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;1 AND 1 = 1&lt;/code&gt;, &lt;code&gt;O AND 1 = 0&lt;/code&gt;, &lt;code&gt;0 AND 0 = 0&lt;/code&gt;, &lt;code&gt;1 AND 0 = 0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001010.00001010.00001111.00001010&#xA;11111111.11111111.00000000.00000000&#xA;===================================&#xA;00001010.00001010.00000000.00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Step 4) Convert it back to decimal:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;10.10.0.0&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="20657" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2015-12-15T14:42:14.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25226" PostTypeId="1" CreationDate="2015-12-12T10:15:12.570" Score="1" ViewCount="120" Body="&lt;p&gt;I found a multicasting example at &lt;a href=&quot;http://ntrg.cs.tcd.ie/undergrad/4ba2/multicast/antony/example.html&quot; rel=&quot;nofollow&quot;&gt;http://ntrg.cs.tcd.ie/undergrad/4ba2/multicast/antony/example.html&lt;/a&gt;. After correcting some errors, this program seems to work fine within our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now need to multicast to a different subnet. Here is my setup:&#xA;my machine ==&gt; cisco router ==&gt; Internet ==&gt; cisco hub ==&gt; client machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My local IP address is 10.10.15.20. The client machine's IP address is 192.168.15.101.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our network provider has configured a GRE tunnel between the cisco router and the cisco hub. If I ssh or ping from my machine to 192.168.15.101, it works just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now need to run my multicast server program on my machine and the client  program on the client machine. However, it appears the message from my server never reaches the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network service provider demonstrated a program that seemed to multicast just fine. Unfortunately, they don't have the source code for the application. All they said is that they used 239.255.255.255 as the group id and 6000 as the port. I changed our application to use these parameters but still couldn't get the client and server to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am thinking the multicast datagram probably reaches the router but the router does not know if the datagram must be send on the GRE tunnel or to the Internet. This is because the server code does not specifically mention anything about 192.168.15.xx network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel I need to somehow pass in a hint to the router that the multicast packet must really be forwarded to the internal network. Given that the destination client ids are 192.168.15.xx, I tried to set the groupid of the server to 224.192.168.15 (from the net, it appeared that the first four bits for multicast must be 1110. I am using 0b11100000). However, even this did not seem to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am at a loss. Can you please guide me on how to hint the router that the  multicasting is meant of 192.168.15.x network? Regards. &lt;/p&gt;&#xA;" OwnerDisplayName="Peter" LastActivityDate="2016-01-14T09:20:17.577" Title="Multicasting - How to send a hint to the router?" Tags="|multicast|igmp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25227" PostTypeId="2" ParentId="25226" CreationDate="2015-12-12T12:02:51.623" Score="1" Body="&lt;p&gt;You probably need to use &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Group_Management_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;IGMP&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IGMP is the protocol end hosts use to let their routers know which multicast groups they're interested in listening to. End hosts inform their routers, and the routers in turn join the relevant groups over the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an overview of the process, shamelessly stolen from wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/d463A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/d463A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client uses IGMP over the LAN to let his local router know that he's interested in a certain multicast group. The router then uses a multicast protocol (&lt;a href=&quot;https://en.wikipedia.org/wiki/Protocol_Independent_Multicast&quot; rel=&quot;nofollow noreferrer&quot;&gt;PIM&lt;/a&gt; in this case) to join the group (which consists of Router 1 in this case)&lt;/p&gt;&#xA;" OwnerUserId="3905" OwnerDisplayName="Malt" LastActivityDate="2015-12-12T12:10:13.037" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25228" PostTypeId="2" ParentId="25226" CreationDate="2015-12-13T20:17:40.427" Score="1" Body="&lt;p&gt;Thank you all for your help. I finally made it work. I am posting my solution here in hopes that it will save you days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cisco router, multicasting setup rule requires you to specify the group id and the port you intend to use. It appears there is yet another parameter that I had missed initially in my server code and that is the TTL value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default, it appears Cisco router drops the datagram if the TTL value is 1 or less. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your server code, if you don't specifically set the TTL value, by default it is assumed to be 1. You can set it by calling &lt;code&gt;setsocketopt&lt;/code&gt;with &lt;code&gt;IP_MULTICAST_TTL&lt;/code&gt;parameter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once I used the proper group id, port and TTL value, my client-server communication started to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: In the Cisco router, apparently you can use &lt;code&gt;ip multicast ttl-threshold&lt;/code&gt;command to change this but I haven't tried it.&lt;/p&gt;&#xA;" OwnerDisplayName="Peter" LastActivityDate="2015-12-13T20:17:40.427" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25233" PostTypeId="1" CreationDate="2015-12-15T12:22:26.753" Score="1" ViewCount="199" Body="&lt;p&gt;I am new to networking. I have a small confusion. Can two pc be connected directly using straight through cable without any router or switch?&lt;/p&gt;&#xA;" OwnerUserId="21315" LastActivityDate="2015-12-15T15:08:52.877" Title="connection between two pc without switch" Tags="|router|network-core|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25234" PostTypeId="2" ParentId="25233" CreationDate="2015-12-15T13:13:27.830" Score="1" Body="&lt;p&gt;Yes. But with a crossover cable. That's easy to figure out yourself. You may have questions about the firewalls and configs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Ethernet_crossover_cable&quot; rel=&quot;nofollow&quot;&gt;wikipedia wants to help you :-)&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user21352" LastActivityDate="2015-12-15T13:13:27.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25235" PostTypeId="1" CreationDate="2015-12-15T14:54:19.360" Score="2" ViewCount="6292" Body="&lt;p&gt;I'm fairly new to Fortinet devices, so please let me know if I'm making a rookie mistake. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a FortiGate 90D (v5.2.5,build701) which has an IPSec site-to-site VPN connection to another firewall and I can access nodes across the VPN.  I have a static Route to forward traffic for the subnet on the other side of the VPN through the VPN.  I can do a traceroute and see that the traffic goes to the FortiGate and then over the VPN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the VPN goes down, the FortiGate starts routing traffic through it's public IP and out to the Internet where it gets stopped (as expected).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, once the VPN comes back up, any host that had recently tried to send traffic across the VPN will have their traffic continue to go out to the Internet while other hosts (on the same subnet) will have their traffic routed over the VPN.  It's as if the FortiGate remembers that some hosts were previously routed over the Internet, while any new traffic is correctly routed over the VPN.  This persists until I reboot the host that is having its traffic routed over the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone tell me what's going on?&lt;/p&gt;&#xA;" OwnerUserId="21358" LastActivityDate="2016-02-19T10:27:11.440" Title="Fortigate &quot;remembers&quot; bad routes" Tags="|vpn|ipsec|fortigate|fortinet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25236" PostTypeId="2" ParentId="25233" CreationDate="2015-12-15T15:08:52.877" Score="1" Body="&lt;p&gt;The answer is, &quot;It depends.&quot; If the ethernet ports on one or both of the PCs support Auto MDI/MDIX, then the answer is, &quot;Yes,&quot; otherwise, the answer is, &quot;No.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most modern PCs have ethernet ports which support  Auto MDI/MDIX, so the answer is probably, &quot;Yes,&quot; but you need to double check your equipment.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-15T15:08:52.877" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25237" PostTypeId="1" AcceptedAnswerId="25241" CreationDate="2015-12-15T16:00:58.770" Score="2" ViewCount="2300" Body="&lt;p&gt;I am very new to network engineering, I have read through the netgear user manual and find nothing about Global Flow Control (IEEE 802.3x) Mode. Is it different than the storm controls that I have the ability to change all or per interface? &lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2015-12-18T12:05:47.330" Title="Flow Control vs. Storm Control" Tags="|switch|layer2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25238" PostTypeId="1" CreationDate="2015-12-15T16:01:08.863" Score="1" ViewCount="1500" Body="&lt;p&gt;I have a FortiGate 90D (v5.2.5) that I have an IPSec VPN configured for FortiClient access via the VPN Wizard.  My LAN and FortiClients are using different subnets.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can access my LAN from my FortiClient computer, but I can't access my FortiClient computer from my LAN.  If I traceroute from a LAN computer to the FortiGate-assigned IP address of my FortiClient computer, the packets are routed out to the Internet.  I can ping the FortiClient computers from the CLI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try to set up a static route to the subnet assigned to the FortiClients, I can not select the FortiClient VPN as the &quot;device&quot; (although I have options for SSL VPN, point-to-point IPSec VPNs, and physical interfaces).  If I try to set up a Policy Route, I can see my FortiClient VPN as an interface, but I have no idea what to use as a gateway (and 0.0.0.0 doesn't work).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's plenty of documentation on getting FortiClients to access the LAN, but none for accessing the FortiClients from the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a trick I'm missing?&lt;/p&gt;&#xA;" OwnerUserId="21358" LastActivityDate="2018-03-03T02:18:27.903" Title="Access FortiClients from LAN" Tags="|vpn|lan|fortigate|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25239" PostTypeId="1" AcceptedAnswerId="25250" CreationDate="2015-12-15T16:23:40.280" Score="1" ViewCount="61" Body="&lt;p&gt;Is there a way to set up logging on a Cisco router to keep a log of all the host IP's and the ports successfully accessed the network and the last time port was accessed, and automatically garbage collects records from the log after a max time threshold is hit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have such a log that I can access from a TCL program that can check what ports a host have been granted access to a host and whether they are still actively using that port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This log would enable me to write a dynamic port granting api like port knocking or a similar scheme and reduce the number of brute force attacks that happen these days on edge routers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is imperative that the solution be light weight so it can run on its own directly on a smaller scale SMB router like an 800 series.&lt;/p&gt;&#xA;" OwnerUserId="21361" LastActivityDate="2015-12-15T21:20:04.333" Title="Actively host ip and port accessed in Cisco IOS" Tags="|cisco-ios|monitoring|logging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25241" PostTypeId="2" ParentId="25237" CreationDate="2015-12-15T16:29:00.840" Score="1" Body="&lt;p&gt;Ethernet Flow Control is different than Storm Control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet Flow Control was developed because traffic on a link may be generated faster than the receiver can handle it. The IEEE has several efforts for this in 802.1 and 802.3. Unfortunately, this really doesn't help with STP loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Storm Control is something which some switch vendors have implemented, and it is typically used to limit broadcast and multicast traffic to acceptable levels in order to mitigate STP loops. Cisco does have an implementation for unicast traffic, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-15T16:29:00.840" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25242" PostTypeId="1" CreationDate="2015-12-15T16:46:07.030" Score="2" ViewCount="549" Body="&lt;p&gt;Can anyone please explain me what will be the compatibility/communication issues of using media converter at one end and fiber switch at the other end.?&#xA;if no, then will different brand of fiber switch and media converter will have any impact.??&lt;/p&gt;&#xA;" OwnerUserId="21363" LastActivityDate="2015-12-15T20:32:02.527" Title="What will be the compatibility/communication issues of using media converter at one end and fiber switch at the other end.?" Tags="|fiber|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25243" PostTypeId="1" AcceptedAnswerId="25246" CreationDate="2015-12-15T17:15:59.090" Score="4" ViewCount="2502" Body="&lt;p&gt;I need help regarding the following spanning-tree issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a network core of 2 HP5412 (procurve) connected together using VRRP over a L2 tagged link.&#xA;I have a Cisco 3560 connected to each of the 5412 with L2 links. For loop avoidance, there is spanning-tree running on all switches involved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HP5412_F is Root Primary Bridge (priority 4096) running forced RSTP&#xA;HP5412_A is Root Secondary Bridge (priority 8192) running forced RSTP&#xA;Marbot_batF4 is an access switch which is running PVST.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when I look at the 3560 logs, I can see something wrong :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Marbot_batF4_1#sh spanning-tree root&#xA;&#xA;                                        Root    Hello Max Fwd&#xA;Vlan                   Root ID          Cost    Time  Age Dly  Root Port&#xA;---------------- -------------------- --------- ----- --- ---          ------------&#xA;VLAN0001          4096 001b.3fbd.6100     20000    2   20  15  Gi0/50&#xA;VLAN0002          4098 0017.597d.d600     20000    2   20  15  Gi0/50&#xA;VLAN0003          4099 0017.597d.d600     20000    2   20  15  Gi0/50&#xA;VLAN0004          4100 0017.597d.d600     20000    2   20  15  Gi0/50&#xA;VLAN0005          4101 0017.597d.d600     20000    2   20  15  Gi0/50&#xA;VLAN0010          4106 0017.597d.d600     20000    2   20  15  Gi0/50&#xA;VLAN0011          4107 0017.597d.d600     20000    2   20  15  Gi0/50&#xA;VLAN0012          4108 0017.597d.d600     20000    2   20  15  Gi0/50&#xA;VLAN0013          4109 0017.597d.d600     20000    2   20  15  Gi0/50&#xA;VLAN0014          4110 0017.597d.d600     20000    2   20  15  Gi0/50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Root ID for vlan 1 is not the same as for all other vlans!&#xA;The Root Bridge MAC Address matches the Root ID for VLAN 1, but the other Root ID pictured above is not known on my network.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HP5412_BatF_1# sh spanning-tree&#xA;&#xA; Multiple Spanning Tree (MST) Information&#xA;&#xA;  STP Enabled   : Yes&#xA;  Force Version : RSTP-operation&#xA;  IST Mapped VLANs : 1-4094&#xA;  Switch MAC Address : 001b3f-bd6100&#xA;  Switch Priority    : 4096&#xA;  Max Age  : 20&#xA;  Max Hops : 20&#xA;  Forward Delay : 15&#xA;&#xA;  Topology Change Count  : 3971&#xA;  Time Since Last Change : 6 days&#xA;&#xA;  CST Root MAC Address : 001b3f-bd6100&#xA;  CST Root Priority    : 4096&#xA;  CST Root Path Cost   : 0&#xA;  CST Root Port        : This switch is root&#xA;&#xA;  IST Regional Root MAC Address : 001b3f-bd6100&#xA;  IST Regional Root Priority    : 4096&#xA;  IST Regional Root Path Cost   : 0&#xA;  IST Remaining Hops            : 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm guessing that the Root ID of 0017.597d.d600 also belongs to HP5412_F, but I can't prove it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to relate this unknown Root ID to my Root Bridge ?&#xA;Also, the switch says that I am running MST (Multiple Spanning-Tree) but I don't have any instance configured, as I am forcing RSTP operation (just the one instance for all vlans) - is this maybe the source of the behavior seen above ? Mixing RSTP on ProCurves with PVST on Cisco ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your inputs.&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2015-12-15T21:07:02.747" Title="Spanning-Tree Interoperability between ProCurve core &amp; Cisco access layer" Tags="|cisco|spanning-tree|hp-procurve|ieee-802.1s|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25246" PostTypeId="2" ParentId="25243" CreationDate="2015-12-15T19:59:21.540" Score="6" Body="&lt;p&gt;Cisco PVST uses a non-standard destination MAC for BPDUs on all VLANs, so HP will not understand it.  To the Cisco switch, it is the only switch on VLANs 2-14, which is why it thinks it is the root.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco sends BPDUs with the standard MAC (01:80:C2:00:00:00) untagged on VLAN 1, even if VLAN 1 is not allowed on the trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So HP will only see BPDUs for VLAN 1.  It will ignore all other VLAN BPDUs from Cisco.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-15T19:59:21.540" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25247" PostTypeId="2" ParentId="23498" CreationDate="2015-12-15T20:24:12.130" Score="0" Body="&lt;p&gt;As an update:  I had a coworker come work on this - and she was able to change the 'Public-Private NAT Mappings and Device IP Allocation' options on the ATT Cable modem so that instead of my 'outside' interface getting the public 108.x.x.x IP - it pulled a 192.168.x.x IP from the ATT modem.  The options were:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Settings &gt; LAN &gt; LAN IP Address Allocation&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Device:  [My firewall] &lt;/li&gt;&#xA;&lt;li&gt;Device Status:  DHCP RENEW 3&lt;/li&gt;&#xA;&lt;li&gt;FIREWALL:  DISABLED&lt;/li&gt;&#xA;&lt;li&gt;Address Assignment:   Public (select WAN IP Mapping) &lt;/li&gt;&#xA;&lt;li&gt;WAN IP Mapping:    Router WAN IP Address (default) &lt;/li&gt;&#xA;&lt;li&gt;Cascaded Router:  No&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Right when that option changed, I shut/no shut my ASA outside interface and was able to get out.  If anyone wants further logs/configs etc. I can post.&lt;/p&gt;&#xA;" OwnerUserId="13939" LastActivityDate="2015-12-15T20:24:12.130" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25248" PostTypeId="2" ParentId="25242" CreationDate="2015-12-15T20:32:02.527" Score="4" Body="&lt;p&gt;As long as the two devices utilize the same network connection type and follow the standards, there should be no compatibility/communication issues. They should be able to work without problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However as Ron points out, there are other potential negatives to such a configuration. He mentions another point of failure, and I will also add that it can make troubleshooting a bit more difficult.  For instance, most media converters are not managed (again as Ron pointed out). This means that you will only be able to pull statistics from one side of each of the copper and fiber links. So you may not see errors on traffic flowing in one direction on the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, link state is not always mirrored on media converters, so one side of the link (from the switches' perspectives) may look up while the other side shows down. You may see the link as up from the side you are troubleshooting and see outgoing traffic but no incoming traffic. This may initially lead you to false assumptions about what is actually taking place.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-12-15T20:32:02.527" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25249" PostTypeId="2" ParentId="25243" CreationDate="2015-12-15T21:07:02.747" Score="4" Body="&lt;p&gt;The only standards compliant STP method common to all switches is MST. You don't have to go nuts with it, 'tho -- running everything from the CIST is fine. (I do just that between half a dozen vendors.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;End your headache and switch them all to MST. Yes, there will be a small disruption while things are in transition, but &lt;em&gt;It Has To Be Done.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-12-15T21:07:02.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25250" PostTypeId="2" ParentId="25239" CreationDate="2015-12-15T21:20:04.333" Score="1" Body="&lt;p&gt;This sounds like a job for NBAR and netflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NBAR collects protocol statistics:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rtr3745#show ip nbar protocol-discovery protocol http&#xA;&#xA; FastEthernet0/1 &#xA;                            Input                    Output                  &#xA;                            -----                    ------                  &#xA;   Protocol                 Packet Count             Packet Count            &#xA;                            Byte Count               Byte Count              &#xA;                            30sec Bit Rate (bps)     30sec Bit Rate (bps)    &#xA;                            30sec Max Bit Rate (bps) 30sec Max Bit Rate (bps)&#xA;   ------------------------ ------------------------ ------------------------&#xA;   http                     910077                   478364                  &#xA;                            1355496116               35911309                &#xA;                            0                        0                       &#xA;                            45313000                 1184000                 &#xA;   unknown                  2521171                  130821                  &#xA;                            2612681510               21335665                &#xA;                            1000                     0                       &#xA;                            18759000                 105000                  &#xA;   Total                    4661716                  1686610                 &#xA;                            4321983406               182285406               &#xA;                            2000                     4000                    &#xA;                            75164000                 1544000                 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Netflow can collect (and export) statistics on all traffic:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rtr3745#show ip cache flow &#xA;...&#xA;IP Flow Switching Cache, 278544 bytes&#xA;  223 active, 3873 inactive, 301379 added&#xA;  182598876 ager polls, 0 flow alloc failures&#xA;  Active flows timeout in 60 minutes&#xA;  Inactive flows timeout in 600 seconds&#xA;...&#xA;Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)&#xA;--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow&#xA;TCP-Telnet         551      0.0         1    59      0.0       0.6     599.4&#xA;TCP-FTP             11      0.0         1    41      0.0       0.0     491.6&#xA;TCP-WWW          17048      0.0       149   972      4.2      52.1      52.5&#xA;TCP-SMTP            14      0.0         1    48      0.0       0.4     600.5&#xA;TCP-X              322      0.0         1    40      0.0       0.4     594.8&#xA;TCP-other        82581      0.1        27   404      3.8     216.4     118.1&#xA;UDP-DNS          88256      0.1         1    66      0.1       2.5     600.5&#xA;UDP-NTP           7639      0.0        10    75      0.1    1302.2     448.2&#xA;UDP-TFTP             6      0.0         1    56      0.0       0.0     600.3&#xA;UDP-other       100432      0.1         6   170      1.0     146.7     581.3&#xA;ICMP              1623      0.0         6    57      0.0     748.2     496.3&#xA;IPv6INIP           168      0.0      6964  1092      1.9    3557.4      22.1&#xA; -IP-other           612      0.0       127   384      0.1    2912.6     170.9&#xA;Total:          299263      0.4        23   699     11.4     157.9     424.0&#xA;&#xA;SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts&#xA;Fa0/0         24.225.xxx.xxx  Fa0/1*        38.114.132.204  06 C261 006E    26 &#xA;Fa0/0         192.168.1.2     Fa0/1         173.194.205.104 06 8B3C 01BB    10 &#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-12-15T21:20:04.333" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25251" PostTypeId="1" AcceptedAnswerId="47602" CreationDate="2015-12-15T22:45:42.357" Score="4" ViewCount="12978" Body="&lt;p&gt;I am getting this error for many clients. I don't think they get disconnected but it's just filling-up my logs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xtrcca204wm40: *Dot1x_NW_MsgTask_3: Dec 15 17:22:36.045: #DOT1X-3-INVALID_WPA_KEY_MSG_STATE: 1x_eapkey.c:957 Received invalid EAPOL-key M2 msg in START  state - invalid secure bit; KeyLen 40, Key type 1, client cc:3d:82:5d:f5:43&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've read many Cisco posts in regards with this and they recommend changing the EAPOL-Key Timeout to 5000 ms. I'll probably try to play around with the values this Friday, but is increasing (or decreasing) the value will really help? We are using the default of 1000 ms. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="18808" LastEditorUserId="8499" LastEditDate="2015-12-15T22:53:35.603" LastActivityDate="2018-02-04T10:47:23.173" Title="What should be the EAPOL-key timeout setting on the WLC?" Tags="|cisco|wlc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25252" PostTypeId="1" AcceptedAnswerId="25260" CreationDate="2015-12-15T23:37:15.597" Score="1" ViewCount="767" Body="&lt;p&gt;I've been trying to learn about SNMP Protocol (as a beginner)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When studying network performance, we look at three main points:&#xA;- Bandwidth&#xA;- Response Time&#xA;- Devices Availability&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But which of these info can we get using SNMP?&#xA;I know of Response time, but not sure of the others&lt;/p&gt;&#xA;" OwnerUserId="14937" LastActivityDate="2015-12-16T12:05:51.947" Title="SNMP bandwidth and response time" Tags="|snmp|bandwidth|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25253" PostTypeId="2" ParentId="24136" CreationDate="2015-12-16T04:04:56.980" Score="0" Body="&lt;p&gt;Networks interconnect in two main ways. (and various variants in between the two) in a &quot;transit&quot; relationship there is a provider-customer relationship. The provider provides the customer with the service of carrying their data to and from the internet in general. A peering relationship is a more mutual thing, it allows network A (and their customers) to communicate with network B and their customers but it's not transitive. If A peers with B and B peers with C thendata will not be allowed to flow from A to C via B. Peering is usually settlement free (neither side pays the other though someone has to pay for the actual link) and may go via a private connection or via an internet exchange point depending on traffic volumes and local customs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are exceptions but usually the long distance links will either be within a given providers network (and obviously paid for by that provider) or from a provider to their customer (and paid for by the customer). Peering links are usually relatively local.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Larger providers will often refuse to peer with smaller ones because they see it as losing a potential customer and/or as an unbalanced relationship where the large provider does most of the work of moving data around and the small provider gets most of the benefit. This is more of an issue in the US than in Europe as the access providers are larger, more monopolistic and are often vertically integrated with tier 1 providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the top of the pile are the &quot;tier 1&quot; providers. These do not buy transit from anybody and all peer with each other. Becoming a new tier 1 is extremely difficult. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand it all of the tier 1 providers have a major presence in the USA (though many are now owned by foreign firms) and peer with each other there. Most of them also have a substantial presence in western Europe and peer with each other there too. That is a large part of the reason why internet transit is much cheaper in the US and western Europe than elsewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes a provider may establish a point of presence (a router in a rented rack, connected back to their main network) in cities or countries where they don't otherwise operate in order to participate in peering there. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2015-12-16T04:04:56.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25254" PostTypeId="1" AcceptedAnswerId="25579" CreationDate="2015-12-16T04:16:09.433" Score="2" ViewCount="1177" Body="&lt;p&gt;EDIT 2: This may be a bug in the kernel or module. Reported here &lt;a href=&quot;https://bugzilla.kernel.org/show_bug.cgi?id=109471&quot; rel=&quot;nofollow&quot;&gt;https://bugzilla.kernel.org/show_bug.cgi?id=109471&lt;/a&gt; Can anybody confirm that this phenomenon is definitely out of spec?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm tracking down a network phenomenon in my lab where a Wi-Fi device (possibly multiple) can connect to one of my access points (AP) with no problem, but when communicating through another AP, network flow is disrupted. The bad AP sends  &quot;oversize&quot; ethernet frames of length 1522 (see below rx_length_errors counter). The AP where the problem does NOT exist never sends frames larger than 1514 and they are all accepted and forwarded by the gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the Wi-Fi client device is using an MTU of 1500 on both APs because the TCP payloads in both cases are always at/below 1500 bytes. This rules out the client being a factor. When the ethernet frame is added, one AP adds 14 bytes (resulting in  1514-byte frames), and the other AP adds 22 bytes (resulting in 1522-byte frames). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample oversized packet (MAC and IP modified for anonymity). &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;03:51:25.978066 1b:22:fe:cd:f3:77 &amp;gt; a8:27:db:fe:9e:51, ethertype IPv4 (0x0800), length 1522: (tos 0x0, ttl 64, id 55530, offset 0, flags [DF], proto TCP (6), length 1500)&#xA;    192.168.1.149.41744 &amp;gt; 54.239.17.6.443: Flags [.], cksum 0x5b39 (correct), seq 1724444568:1724446028, ack 3109213756, win 377, length 1460&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;`&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I connect to another of my APs, the maximum frame size ends up being 1514, and those have no problem getting through the gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A comparison of the 1514 byte frame vs the 1522 byte frame reveals an incorrect four-byte frame check sequence (normal checksum offloading?) as well as four trailer bytes. Together that's 8 bytes altogether, which may account for the 8 byte difference between the working and nonworking, however I'm not 100% sure frame check sequence is absent on the working, even though wireshark doesn't show it in the packet dissector, so that may only account for 4 of the extra 8 bytes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Why would Linux pad an ethernet frame with a trailer when the enclosed IP packet is already 1500 bytes long?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the gateway, frame and length errors increase in lock-step with the 1522 byte frames coming from the AP. So this is how I reached the conclusion that the frame size is a significant factor. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/sys/class/net/eth0/statistics/rx_frame_errors:36059&#xA;/sys/class/net/eth0  /statistics/rx_length_errors:36059&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Good AP is running kernel&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Linux goodAP 3.18.11+ #781 PREEMPT Tue Apr 21 18:02:18 BST 2015 armv6l GNU/Linux&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Bad AP is running kernel&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Linux notsogoodAP 3.18.11-v7+ #781 SMP PREEMPT Tue Apr 21 18:07:59 BST 2015 armv7l GNU/Linux&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the question is, why is a Linux server (Access Point) generating overly large (1522-byte) ethernet frames with seemingly invalid frame check sequence? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Adding full packet dump as exported from wireshark:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;No.     Time            Source                Destination           Protocol Length Info&#xA;     35 21:55:21.644314 192.168.1.149        54.239.25.200         TCP      1522   [TCP Retransmission] 44053→443 [ACK] Seq=350 Ack=155 Win=88832 Len=1460 [ETHERNET FRAME CHECK SEQUENCE INCORRECT]&#xA;&#xA;Frame 35: 1522 bytes on wire (12176 bits), 1522 bytes captured (12176 bits)&#xA;    Encapsulation type: Ethernet (1)&#xA;    Arrival Time: Dec 15, 2015 21:55:21.644314000 EST&#xA;    [Time shift for this packet: 0.000000000 seconds]&#xA;    Epoch Time: 1450234521.644314000 seconds&#xA;    [Time delta from previous captured frame: 0.150820000 seconds]&#xA;    [Time delta from previous displayed frame: 3.683211000 seconds]&#xA;    [Time since reference or first frame: 9.568260000 seconds]&#xA;    Frame Number: 35&#xA;    Frame Length: 1522 bytes (12176 bits)&#xA;    Capture Length: 1522 bytes (12176 bits)&#xA;    [Frame is marked: False]&#xA;    [Frame is ignored: False]&#xA;    [Protocols in frame: eth:ethertype:ip:tcp]&#xA;    [Coloring Rule Name: Bad TCP]&#xA;    [Coloring Rule String: tcp.analysis.flags &amp;amp;&amp;amp; !tcp.analysis.window_update]&#xA;Ethernet II, Src: xx:xx:xx:xx:xx:xx (xx:xx:xx:xx:xx:xx), Dst: Raspberr_xx:xx:xx (xx:xx:xx:xx:xx:xx)&#xA;    Destination: Raspberr_xx:xx:xx (xx:xx:xx:xx:xx:xx)&#xA;        Address: Raspberr_xx:xx:xx (xx:xx:xx:xx:xx:xx)&#xA;        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)&#xA;        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)&#xA;    Source: xx:xx:xx:xx:xx:xx (xx:xx:xx:xx:xx:xx)&#xA;        Address: xx:xx:xx:xx:xx:xx (xx:xx:xx:xx:xx:xx)&#xA;        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)&#xA;        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)&#xA;    Type: IP (0x0800)&#xA;    Trailer: 2f8e4de5&#xA;    Frame check sequence: 0x29f37f68 [incorrect, should be 0x3b863a28]&#xA;        [FCS Good: False]&#xA;        [FCS Bad: True]&#xA;            [Expert Info (Error/Checksum): Bad checksum]&#xA;                [Bad checksum]&#xA;                [Severity level: Error]&#xA;                [Group: Checksum]&#xA;Internet Protocol Version 4, Src: 192.168.1.149 (192.168.1.149), Dst: 54.239.25.200 (54.239.25.200)&#xA;    Version: 4&#xA;    Header Length: 20 bytes&#xA;    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))&#xA;        0000 00.. = Differentiated Services Codepoint: Default (0x00)&#xA;        .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)&#xA;    Total Length: 1500&#xA;    Identification: 0xaaf3 (43763)&#xA;    Flags: 0x02 (Don't Fragment)&#xA;        0... .... = Reserved bit: Not set&#xA;        .1.. .... = Don't fragment: Set&#xA;        ..0. .... = More fragments: Not set&#xA;    Fragment offset: 0&#xA;    Time to live: 64&#xA;    Protocol: TCP (6)&#xA;    Header checksum: 0x3234 [validation disabled]&#xA;        [Good: False]&#xA;        [Bad: False]&#xA;    Source: 192.168.1.149 (192.168.1.149)&#xA;    Destination: 54.239.25.200 (54.239.25.200)&#xA;    [Source GeoIP: Unknown]&#xA;    [Destination GeoIP: Unknown]&#xA;Transmission Control Protocol, Src Port: 44053 (44053), Dst Port: 443 (443), Seq: 350, Ack: 155, Len: 1460&#xA;    Source Port: 44053 (44053)&#xA;    Destination Port: 443 (443)&#xA;    [Stream index: 1]&#xA;    [TCP Segment Len: 1460]&#xA;    Sequence number: 350    (relative sequence number)&#xA;    [Next sequence number: 1810    (relative sequence number)]&#xA;    Acknowledgment number: 155    (relative ack number)&#xA;    Header Length: 20 bytes&#xA;    .... 0000 0001 0000 = Flags: 0x010 (ACK)&#xA;        000. .... .... = Reserved: Not set&#xA;        ...0 .... .... = Nonce: Not set&#xA;        .... 0... .... = Congestion Window Reduced (CWR): Not set&#xA;        .... .0.. .... = ECN-Echo: Not set&#xA;        .... ..0. .... = Urgent: Not set&#xA;        .... ...1 .... = Acknowledgment: Set&#xA;        .... .... 0... = Push: Not set&#xA;        .... .... .0.. = Reset: Not set&#xA;        .... .... ..0. = Syn: Not set&#xA;        .... .... ...0 = Fin: Not set&#xA;    Window size value: 347&#xA;    [Calculated window size: 88832]&#xA;    [Window size scaling factor: 256]&#xA;    Checksum: 0x1c58 [validation disabled]&#xA;        [Good Checksum: False]&#xA;        [Bad Checksum: False]&#xA;    Urgent pointer: 0&#xA;    [SEQ/ACK analysis]&#xA;        [iRTT: 0.028704000 seconds]&#xA;        [Bytes in flight: 2077]&#xA;        [TCP Analysis Flags]&#xA;            [Expert Info (Note/Sequence): This frame is a (suspected) retransmission]&#xA;                [This frame is a (suspected) retransmission]&#xA;                [Severity level: Note]&#xA;                [Group: Sequence]&#xA;            [The RTO for this segment was: 7.247571000 seconds]&#xA;            [RTO based on delta from frame: 12]&#xA;    Retransmitted TCP segment data (1460 bytes)&#xA;&#xA;&#xA;&#xA;0000  b8 27 eb fe 9e 71 1c 56 fe cd f3 75 08 00 45 00   .'...q.V...u..E.&#xA;0010  05 dc aa f4 40 00 40 06 32 33 c0 a8 46 95 36 ef   ....@.@.23..F.6.&#xA;0020  19 c8 ac 15 01 bb 71 be a7 a7 cb 7c 15 6f 50 10   ......q....|.oP.&#xA;0030  01 5b 1c 58 00 00 17 03 03 08 18 00 00 00 00 00   .[.X............&#xA;0040  00 00 02 cd 63 94 47 c0 31 81 4d ea b2 13 b6 46   ....c.G.1.M....F&#xA;0050  cb 5d 4d 64 71 21 b1 c1 3c 6d d6 1c 5e 0a 89 4b   .]Mdq!..&amp;lt;m..^..K&#xA;0060  a3 f8 58 f3 a9 2e 95 81 2c 08 be cc 64 a2 11 c3   ..X.....,...d...&#xA;0070  8c 7e 10 7f 51 e5 87 e7 c0 49 08 19 65 0a 7a 5b   .~..Q....I..e.z[&#xA;0080  ee 22 2e 93 31 cf 22 5d 7e 36 5f ee 3b 2e 43 f0   .&quot;..1.&quot;]~6_.;.C.&#xA;0090  83 23 9f 69 7f ae 82 22 04 f4 02 42 fb 28 43 f3   .#.i...&quot;...B.(C.&#xA;00a0  8f 05 80 6c fd 7f ef 47 7b 07 d2 b7 d9 e8 ab 78   ...l...G{......x&#xA;00b0  54 67 af 61 bf 55 89 33 f3 85 5d 7b a4 53 34 73   Tg.a.U.3..]{.S4s&#xA;00c0  17 75 b0 da 6a 31 d5 0a 86 7a 11 66 7f 9f 81 5a   .u..j1...z.f...Z&#xA;00d0  96 bc 64 72 0d da 32 01 8d 88 70 d3 f5 e7 70 29   ..dr..2...p...p)&#xA;00e0  94 be 35 37 10 10 41 79 fc d3 4f f1 1d a2 c3 ef   ..57..Ay..O.....&#xA;00f0  32 81 50 e2 2a ca 6e bf 95 b8 77 1b ee 76 ba fb   2.P.*.n...w..v..&#xA;0100  8d 85 25 a2 47 7a 96 fd af c3 39 98 8b bd ff 31   ..%.Gz....9....1&#xA;0110  ae ca 15 60 e1 2f 00 4f 43 c4 20 11 92 47 91 10   ...`./.OC. ..G..&#xA;0120  f6 0c a7 ea 5d 54 f1 01 eb d4 9e 7a bb ae 08 5f   ....]T.....z..._&#xA;0130  9b 31 85 af 4e b4 0b 03 ad 6b 51 11 51 e5 f8 d8   .1..N....kQ.Q...&#xA;0140  af ff 78 46 3e 24 6c 2e 40 3e aa 27 b7 87 10 c7   ..xF&amp;gt;$l.@&amp;gt;.'....&#xA;0150  5a aa d3 33 fa b6 bc 4d e9 2f 18 34 81 98 28 34   Z..3...M./.4..(4&#xA;0160  18 de e8 32 ae c0 21 6a 52 20 3b 5f 12 6c f4 df   ...2..!jR ;_.l..&#xA;0170  71 c6 e0 cc b2 d1 75 94 f2 e3 63 e5 4d a5 7c ba   q.....u...c.M.|.&#xA;0180  1c 46 e1 83 e1 ca e3 c7 dc c3 08 d7 0a 3e e2 3b   .F...........&amp;gt;.;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21373" LastEditorUserId="21373" LastEditDate="2015-12-16T19:22:57.833" LastActivityDate="2016-01-02T02:21:27.323" Title="1522-byte frames from access point being dropped by gateway" Tags="|ethernet|linux|mtu|packet-loss|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25255" PostTypeId="2" ParentId="25254" CreationDate="2015-12-16T05:19:31.330" Score="1" Body="&lt;p&gt;An ethernet frame with a payload of 1500 bytes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Without an 802.1Q tag is 1518 bytes&lt;/li&gt;&#xA;&lt;li&gt;With an 802.1Q tag is 1522 bytes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The WAP showing you 1514 bytes is due to the fact that the frame does not have an 802.1Q tag, and the interface or driver is not giving Wireshark the FCS. From the &lt;a href=&quot;https://wiki.wireshark.org/Ethernet&quot; rel=&quot;nofollow&quot;&gt;Wireshark Wiki&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Most Ethernet interfaces also&#xA;  either don't supply the FCS to Wireshark or other applications, or&#xA;  aren't configured by their driver to do so; therefore, Wireshark will&#xA;  typically only be given the green fields, &lt;em&gt;although on some platforms,&#xA;  with some interfaces, the FCS will be supplied on incoming packets.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The WAP showing you the 1522 byte frame size is apparently showing you the FCS (four bytes), so the interface or driver is giving it to Wireshark. The other four bytes are due to an 802.1Q tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your router is not expecting 802.1Q tagged frames, so it is giving you errors. You need to disable 802.1Q on the WAP. WAPs can use 802.1Q on the wired side to separate traffic among multiple SSIDs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-17T01:42:38.767" LastActivityDate="2015-12-17T01:42:38.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25257" PostTypeId="1" AcceptedAnswerId="25258" CreationDate="2015-12-16T09:48:16.197" Score="1" ViewCount="98" Body="&lt;p&gt;I have a setup for a workstation consisting of a PC, monitor and a networked laser printer. The PC uses DHCP to get an IP, but the network printer must be assigned a static IP due to a requirement with the software from which it is accessed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question now is, is there a way that if the network printer had to be switched with a new network printer, that the new network printer would be able to get the same static IP as the previous network printer without the person who is switching having to do anything more than plug in the power and ethernet cable? This could be either through network settings or programmatically.&lt;/p&gt;&#xA;" OwnerUserId="16782" LastActivityDate="2015-12-16T15:41:51.227" Title="Change device - Reassign static IP" Tags="|ip|network-discovery|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25258" PostTypeId="2" ParentId="25257" CreationDate="2015-12-16T11:05:05.227" Score="3" Body="&lt;p&gt;You'd need to know the MAC address of the newly plugged in printer beforehand. Then you could reserve a specific IP address for that MAC address through DHCP Reservation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that that's not the same as a &lt;strong&gt;static IP&lt;/strong&gt; (thanks @Ricky Beam for pointing that out). The device would always receive the &lt;strong&gt;same IP&lt;/strong&gt; though.&lt;/p&gt;&#xA;" OwnerUserId="15706" LastEditorUserId="8499" LastEditDate="2015-12-16T15:41:51.227" LastActivityDate="2015-12-16T15:41:51.227" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25260" PostTypeId="2" ParentId="25252" CreationDate="2015-12-16T12:05:51.947" Score="1" Body="&lt;p&gt;Yes, you can get all those data via SNMP. By using below OID, you can retrieve the data&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; OID                           Object Nanme&#xA;&amp;gt; 1.3.6.1.2.1.34.9.1.1.1.2      tn3270eRtCollCtlType(Respose Time/Not sure!)&#xA;&amp;gt; 1.3.6.1.2.1.2.2.1.8           ifOperStatus (Interface Status)&#xA;&amp;gt; 1.3.6.1.2.1.2.2.1.5           ifSpeed (Bandwidth)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you have OID, &lt;a href=&quot;http://cric.grenoble.cnrs.fr/Administrateurs/Outils/MIBS/&quot; rel=&quot;nofollow&quot;&gt;HERE&lt;/a&gt; You can check details of that OID. Google the OID for Device status/Availability.(I couldn't get, but definitely there will! )&lt;/p&gt;&#xA;" OwnerUserId="17153" LastActivityDate="2015-12-16T12:05:51.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25261" PostTypeId="1" CreationDate="2015-12-16T15:14:04.933" Score="0" ViewCount="75" Body="&lt;p&gt;I need  some recommendation about Hotspots wifi business. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm planning to start Internet Hotspot wifi business  sealing internet cards. But before I make my first step I want  to know the right equipment and software to run this business because I want to be the best in the market I tried to use one of the wifi hotspots in my area but it's to slow. I did a scan to find out how users are using this hotspot . There was 50 users.  I found out that the hotspot owner did not put a rule to split bandwidth between users. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know is there an access point that can cover 10 kilometres. And is the best system that can control users bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please share your ideas. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="21388" LastActivityDate="2015-12-18T11:44:50.813" Title="I need some recommendation about Hotspots wifi business" Tags="|wireless|network-access|" AnswerCount="2" CommentCount="1" ClosedDate="2017-08-07T16:33:25.417" ContentLicense="CC BY-SA 3.0" />
  <row Id="25262" PostTypeId="1" AcceptedAnswerId="32552" CreationDate="2015-12-16T15:26:31.203" Score="1" ViewCount="6541" Body="&lt;p&gt;I tried to configure a DMVPN between two routers (hub and spoke) on Cisco Packet Tracer 6.0.1, but it does not accept the commands, i.e., when I type &lt;code&gt;tunnel mode gre multipoint&lt;/code&gt;, I get an error on &lt;code&gt;multipoint&lt;/code&gt; as it does not exist as an option. Does the program support DMVPNs or should I try GNS3?&#xA;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="21387" LastActivityDate="2016-06-25T09:40:07.283" Title="Can I configure DMVPN on Cisco Packet Tracer 6.0.1?" Tags="|cisco|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25264" PostTypeId="2" ParentId="25261" CreationDate="2015-12-16T15:35:32.123" Score="2" Body="&lt;p&gt;Wi-Fi is two-way, so if you had a WAP that could cover 10 km, the clients could still only use it within 100 meters (the IEEE 802.11 maximum distance) because the client radios will only work that far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the airwaves are a shared medium using CSMA-CA, you can't evenly divide the bandwidth among Wi-Fi clients for a first come, first served medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you need to do some research about IEEE 802.11, how it works, and the laws surrounding the use of unlicensed radio, before you do anything else. This is a subject far too broad to be discussed here, and product or resource recommendations are specifically off-topic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-16T15:35:32.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25265" PostTypeId="1" AcceptedAnswerId="25267" CreationDate="2015-12-16T16:07:14.613" Score="1" ViewCount="440" Body="&lt;p&gt;At a small business with under 10 PCs they have 3 general purpose wifi routers with internet from different ISPs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They want to have a single network so that if they have to switch the gateway the shared folders and printers would be accessible the same way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As they use the wifi they have enabled the DHCP for all three routers but one of them gets to be the primary so those who do not set their addresses statically will get to be on that network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They want to switch between networks manually and not to have alternative gateways to be set automatically if one ISP is failing or similar router or client side solutions. Sometimes they are having conferences on the best ISP's line and for that time everybody who is not in the conference has to use another IP's line. Any good idea how to get rid of this networking mess and still meet the requirements?&lt;/p&gt;&#xA;" OwnerUserId="21391" LastEditorUserId="21391" LastEditDate="2015-12-17T19:38:56.047" LastActivityDate="2015-12-17T19:38:56.047" Title="Small business multiple gateways with different internet providers" Tags="|router|architecture|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="25267" PostTypeId="2" ParentId="25265" CreationDate="2015-12-16T18:01:41.767" Score="2" Body="&lt;p&gt;You can certainly create a single network with wireless that will satisfy your needs.  A single network switch, a few commercial grade access points (depending on how far apart the users are), and a router to connect to one or more providers is what you need.  There should be no need to &quot;switch gateways.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on where you live, you should be able to find someone to design and install this for you.  You should expect to pay more than the price for home networking gear.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-16T18:01:41.767" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25268" PostTypeId="2" ParentId="25265" CreationDate="2015-12-16T20:32:42.650" Score="0" Body="&lt;p&gt;This might be the point where you will need to invest in more robust network equipment. In general, two routers running a First Hop Routing Protocol (FHRP) like VRRP can connect to two ISPs while keeping everyone on the same network on the LAN or WLAN. VRRP will place one router/ISP on standby and the other active. When the active fails, the standby takes over. For better cost advantage, you can use Cisco's GLRP which will load balance between ISPs. Other router and switch makers might also have similar load balancing FHRP as well. &lt;/p&gt;&#xA;" OwnerUserId="21392" LastActivityDate="2015-12-16T20:32:42.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25269" PostTypeId="2" ParentId="25222" CreationDate="2015-12-16T21:19:23.367" Score="1" Body="&lt;p&gt;No, the router does not flood the packet on all the other interfaces. Because not finding a path means that the router does not even have a default route. In that case, the packet is dropped. Depending on configuration, an ICMP &lt;em&gt;Destination Unreachable&lt;/em&gt; with the apppropriate code is sent to the IP source address to inform about the unreachable destination. Here are the codes: &lt;a href=&quot;https://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml#icmp-parameters-codes-3&quot; rel=&quot;nofollow&quot;&gt;ICMPv4&lt;/a&gt;, &lt;a href=&quot;https://www.iana.org/assignments/icmpv6-parameters/icmpv6-parameters.xhtml#icmpv6-parameters-codes-2&quot; rel=&quot;nofollow&quot;&gt;ICMPv6&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2015-12-16T21:19:23.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25270" PostTypeId="1" CreationDate="2015-12-16T22:36:13.567" Score="2" ViewCount="136" Body="&lt;p&gt;We have a 5555-x with multiple interfaces. Our Outside interface and DMZ interfaces have routable IP addresses and DMZ subnet is routed via IP address of the outside interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stripped for readability.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 123.123.6.243 255.255.255.248&#xA;&#xA;interface GigabitEthernet0/1&#xA; nameif inside&#xA; security-level 50&#xA; ip address 192.168.50.4 255.255.255.0&#xA;&#xA;interface GigabitEthernet0/2&#xA; nameif dmz&#xA; security-level 50&#xA; ip address 123.123.27.129 255.255.255.224&#xA;&#xA;object-group network newprod-hosts&#xA; network-object host 123.123.27.134&#xA;&#xA;route inside 192.168.60.0 255.255.255.0 192.168.50.1 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to PAT &lt;code&gt;123.123.27.134&lt;/code&gt; port 22 to &lt;code&gt;192.168.60.20&lt;/code&gt; port 22&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network inside-ssh-host&#xA; host 192.168.60.20&#xA;&#xA;nat (inside,dmz) static 123.123.27.134 service tcp ssh ssh&#xA;&#xA;access-list OUTSIDE extended permit tcp any host 123.123.27.134 eq ssh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when I do that, and try to telnet to port 22 on &lt;code&gt;123.123.27.134&lt;/code&gt;  I end up on a server that does not even belong to us and SSH version that I do not expect.  Funny thing is, If i remove the ACL listed above, I can no longer access that port, so it is obvious that our ASA is doing something strange..... &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% telnet 123.123.27.134 22&#xA; Trying 123.123.27.134...&#xA; Connected to www.&amp;lt;DOMAIN THAT DOES NOT BELONG TO US&amp;gt;.com.&#xA; Escape character is '^]'.&#xA; SSH-2.0-OpenSSH_4.3&#xA; ^]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I doing something wrong here, or do we need to contact our upstream provider to figure out what is happening there?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: We have recently acquired this DMZ subnet from the upstream provider, but ACL based routing of web traffic to our F5 sitting behind this ASA is working fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2&lt;/strong&gt;: When I do &lt;code&gt;whois&lt;/code&gt; on this subnet (&lt;code&gt;123.123.27.128/27&lt;/code&gt;), it returns the information of the previous assignee, who had a larger &lt;code&gt;123.123.27.128/26&lt;/code&gt; subnet&lt;/p&gt;&#xA;" OwnerUserId="21393" LastEditorUserId="21393" LastEditDate="2015-12-16T22:45:56.300" LastActivityDate="2024-01-11T02:03:05.417" Title="NAT takes me to a wrong place" Tags="|cisco-asa|nat|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25271" PostTypeId="1" CreationDate="2015-12-16T23:41:07.290" Score="2" ViewCount="375" Body="&lt;p&gt;May I know is it possible to only send email of logging message interface up/down instead of based on severity level?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2017-02-16T23:53:37.430" Title="Cisco ASA 5500 Series: Send email of logging message monitored interface up/down" Tags="|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25272" PostTypeId="1" CreationDate="2015-12-17T00:31:06.047" Score="1" ViewCount="1143" Body="&lt;p&gt;I used telnet all the time to confirm ports are open and troubleshoot firewall issues, but how does it work? I thought that there is typically 1 service listening on 1 port (e.g., http listening on port 80, but it does not respond on any other port). How is it that the telnet service is listening on every port?&lt;/p&gt;&#xA;" OwnerUserId="15270" LastActivityDate="2015-12-17T00:55:50.483" Title="How does telnet work?" Tags="|network-access|" AnswerCount="1" CommentCount="3" ClosedDate="2015-12-17T01:15:35.063" ContentLicense="CC BY-SA 3.0" />
  <row Id="25273" PostTypeId="2" ParentId="25272" CreationDate="2015-12-17T00:55:50.483" Score="2" Body="&lt;p&gt;As Ron Trunk pointed out, this is a subject which is too large to properly discuss here. The best place to start would be &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc854&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 854, TELNET PROTOCOL SPECIFICATION&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The TELNET Protocol is built upon three main ideas:  first, the&lt;br /&gt;&#xA;concept of a &amp;quot;Network Virtual Terminal&amp;quot;; second, the principle of&lt;br /&gt;&#xA;negotiated options; and third, a symmetric view of terminals and&lt;br /&gt;&#xA;processes.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;When a TELNET connection is first established, each end is    assumed to originate and terminate at a &amp;quot;Network Virtual Terminal&amp;quot;,&lt;br /&gt;&#xA;or NVT.  An NVT is an imaginary device which provides a standard,&lt;br /&gt;&#xA;network-wide, intermediate representation of a canonical terminal.&lt;br /&gt;&#xA;This eliminates the need for &amp;quot;server&amp;quot; and &amp;quot;user&amp;quot; hosts to keep&lt;br /&gt;&#xA;information about the characteristics of each other's terminals and&lt;br /&gt;&#xA;terminal handling conventions.  All hosts, both user and server, map&lt;br /&gt;&#xA;their local device characteristics and conventions so as to appear to&#xA;be dealing with an NVT over the network, and each can assume a&lt;br /&gt;&#xA;similar mapping by the other party.  The NVT is intended to strike a&lt;br /&gt;&#xA;balance between being overly restricted (not providing hosts a rich&lt;br /&gt;&#xA;enough vocabulary for mapping into their local character sets), and&lt;br /&gt;&#xA;being overly inclusive (penalizing users with modest terminals).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;  NOTE:  The &amp;quot;user&amp;quot; host is the host to which the physical terminal&#xA;  is normally attached, and the &amp;quot;server&amp;quot; host is the host which is&#xA;  normally providing some service.  As an alternate point of view,&#xA;  applicable even in terminal-to-terminal or process-to-process&#xA;  communications, the &amp;quot;user&amp;quot; host is the host which initiated the&#xA;  communication.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;The principle of negotiated options takes cognizance of the fact    that many hosts will wish to provide additional services over&#xA;and    above those available within an NVT, and many users will have&lt;br /&gt;&#xA;sophisticated terminals and would like to have elegant, rather than&lt;br /&gt;&#xA;minimal, services.  Independent of, but structured within the TELNET&lt;br /&gt;&#xA;Protocol are various &amp;quot;options&amp;quot; that will be sanctioned and may be&lt;br /&gt;&#xA;used with the &amp;quot;DO, DON'T, WILL, WON'T&amp;quot; structure (discussed below) to&#xA;allow a user and server to agree to use a more elaborate (or perhaps&lt;br /&gt;&#xA;just different) set of conventions for their TELNET connection.  Such&#xA;options could include changing the character set, the echo mode, etc.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The basic strategy for setting up the use of options is to have&lt;br /&gt;&#xA;either party (or both) initiate a request that some option take&lt;br /&gt;&#xA;effect.  The other party may then either accept or reject the&lt;br /&gt;&#xA;request.  If the request is accepted the option immediately takes&lt;br /&gt;&#xA;effect; if it is rejected the associated aspect of the connection&lt;br /&gt;&#xA;remains as specified for an NVT.  Clearly, a party may always refuse&lt;br /&gt;&#xA;a request to enable, and must never refuse a request to disable some&lt;br /&gt;&#xA;option since all parties must be prepared to support the NVT.&lt;/p&gt;&#xA;&lt;p&gt;The syntax of option negotiation has been set up so that if both&lt;br /&gt;&#xA;parties request an option simultaneously, each will see the other's&lt;br /&gt;&#xA;request as the positive acknowledgment of its own.&lt;/p&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;The symmetry of the negotiation syntax can potentially lead to    nonterminating acknowledgment loops -- each party seeing the incoming&#xA;commands not as acknowledgments but as new requests which must be&lt;br /&gt;&#xA;acknowledged.  To prevent such loops, the following rules prevail:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;pre&gt;&lt;code&gt;  a. Parties may only request a change in option status; i.e., a&#xA;  party may not send out a &amp;quot;request&amp;quot; merely to announce what mode it&#xA;  is in.&#xA;&#xA;  b. If a party receives what appears to be a request to enter some&#xA;  mode it is already in, the request should not be acknowledged.&#xA;  This non-response is essential to prevent endless loops in the&#xA;  negotiation.  It is required that a response be sent to requests&#xA;  for a change of mode -- even if the mode is not changed.&#xA;&#xA;  c. Whenever one party sends an option command to a second party,&#xA;  whether as a request or an acknowledgment, and use of the option&#xA;  will have any effect on the processing of the data being sent from&#xA;  the first party to the second, then the command must be inserted&#xA;  in the data stream at the point where it is desired that it take&#xA;  effect.  (It should be noted that some time will elapse between&#xA;  the transmission of a request and the receipt of an&#xA;  acknowledgment, which may be negative.  Thus, a host may wish to&#xA;  buffer data, after requesting an option, until it learns whether&#xA;  the request is accepted or rejected, in order to hide the&#xA;  &amp;quot;uncertainty period&amp;quot; from the user.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2015-12-17T00:55:50.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25274" PostTypeId="1" AcceptedAnswerId="25275" CreationDate="2015-12-17T04:58:58.867" Score="4" ViewCount="2133" Body="&lt;p&gt;I have a scenario like this topology&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Customer End device --&gt; Customer Switch --&gt; My Cisco Router --&gt; My network --&gt; My Cisco Router --&gt; Customer Switch --&gt; Customer End device&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only part of the network where I can view the config is on &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Cisco Router &amp;amp;&amp;amp; My network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The customer's end device needs to get a DHCP address assigned to them, and their DHCP server lives at a Data Center, across my network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The customer states that they are sending DHCP requests but they are not being received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am making the 'assumption' that the switch is using a DHCP helper address, I say 'assumption', because nobody will tell me YES or NO. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same customer has other working scenarios on my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I want to prove/disprove what is happening with the DHCP requests that are being sent from the customer end device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to enable debugging on My Cisco Router, but what debugging do I enable?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;debug ip dhcp server packet - don't get any hits&lt;/li&gt;&#xA;&lt;li&gt;debug ip udp port 67 - don't get any hits&lt;/li&gt;&#xA;&lt;li&gt;debug ip udp port 68 - don't get any hits &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So if the customer has IP helper, I think this will send a replicated unicast to My Cisco Router, I think this is TCP rather than UDP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think I can debug a particular port, because I think when My Cisco Router receives the packet, it will only look up the OSI model until Layer 3, and then realize this is not for me, and send it on its way.&lt;/p&gt;&#xA;" OwnerUserId="8109" LastEditorDisplayName="user10222" LastEditDate="2016-06-03T08:22:05.417" LastActivityDate="2016-06-03T08:22:05.417" Title="DHCP IP debugging" Tags="|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25275" PostTypeId="2" ParentId="25274" CreationDate="2015-12-17T05:35:22.790" Score="1" Body="&lt;p&gt;DHCP is a link-local protocol. (broadcast) For it to span networks (broadcast domains, the internet, etc.) there has to be a relay-agent. (or more than one) That agent listens for requests (unicast and broadcast) and transmits them on to some other server. In theory that server can be anywhere, but some (many?) DHCP servers aren't happy getting requests from non-local agents. (like the DHCP server in windows 2000) Also note, there is a maximum size for DHCP requests; each relay adds to the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend &lt;em&gt;packet captures&lt;/em&gt;. (debug ip packet, with an ACL defined to catch dhcp) As your router(s) aren't a DHCP server or relay-agent, debug ip dhcp isn't going to get anywhere.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-12-17T05:35:22.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25277" PostTypeId="1" CreationDate="2015-12-17T08:18:24.517" Score="3" ViewCount="22840" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/V7B0k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V7B0k.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made this topology and some of the links are red, I enabled all the interfaces though&lt;/p&gt;&#xA;" OwnerUserId="21401" LastActivityDate="2015-12-17T11:31:02.037" Title="Why this topology's links are red?" Tags="|cisco|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25280" PostTypeId="2" ParentId="25277" CreationDate="2015-12-17T09:37:07.940" Score="4" Body="&lt;p&gt;Your problem is that you are using a crossover cable instead of a straight-through cable. Remedy this by changing the cable type or using a router/switch that supports auto-mdix. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When automatic medium-dependent interface crossover (auto-MDIX) is enabled on an interface, the interface automatically detects the required cable connection type (straight through or crossover) and configures the connection appropriately. When connecting switches without the auto-MDIX feature, you must use straight-through cables to connect to devices such as servers, workstations, or routers and crossover cables to connect to other switches or repeaters. With auto-MDIX enabled, you can use either type of cable to connect to other devices, and the interface automatically corrects for any incorrect cabling. For more information about cabling requirements, see the hardware installation guide. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/int_hw_components/configuration_guide/b_int_152ex_2960-x_cg/b_int_152ex_2960-x_cg_chapter_011.html&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="20964" LastEditorUserId="20964" LastEditDate="2015-12-17T09:45:27.713" LastActivityDate="2015-12-17T09:45:27.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25282" PostTypeId="2" ParentId="25277" CreationDate="2015-12-17T11:31:02.037" Score="7" Body="&lt;p&gt;Simple, you need to use &quot;Straight Cable&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Straight Cable:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Usually use straight cable to connect different type of devices. This&#xA;  type of cable will be used most of the time and can be used to:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;1) Connect a computer to a switch/hub's normal port.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2) Connect a computer to a cable/DSL modem's LAN port.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3) Connect a router's WAN port to a cable/DSL modem's LAN port.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;4) Connect a router's LAN port to a switch/hub's uplink port.&#xA;  (Normally used for expanding network)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;5) Connect two switches/hubs with one of the switch/hub using an&#xA;  uplink port and the other one using normal port.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If you need to check how straight cable looks like, it's easy. Both&#xA;  sides (side A and side B) of cable have wire arrangement with same&#xA;  color.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Crossover Cable:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Sometimes you will use crossover cable, it's usually used to connect&#xA;  same type of devices. A crossover cable can be used to:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;1) Connect two computers directly.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2) Connect a router's LAN port to a switch/hub's normal port.&#xA;  (Normally used for expanding network)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3) Connect two switches/hubs by using normal port in both&#xA;  switches/hubs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Source:&lt;a href=&quot;https://sites.google.com/site/mullais/network/what-is-the-defference-between-cross-cable-and-straight-cable&quot; rel=&quot;noreferrer&quot;&gt;Check This Link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HK3ct.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HK3ct.jpg&quot; alt=&quot;crossover cable vs straight through&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Here is thing, you need to do!&lt;/em&gt;&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RHgqL.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RHgqL.png&quot; alt=&quot;Packet Tracer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17153" LastActivityDate="2015-12-17T11:31:02.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25283" PostTypeId="2" ParentId="12621" CreationDate="2015-12-17T12:47:41.463" Score="2" Body="&lt;p&gt;What's the reason you want to drop all traffic of a VLAN into a queue? It's not common. You can use DSCP and prioritize on IP packet level. You can be much more specific in what you want to prioritize. If it's VoIP, your hardphone's probably send out DSCP 46. On Comware do a 'qos trust dscp' command on the interfaces, and that's all. VoIP will be thrown in 'ef', queue 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason traffic is coming into queue's 0, 2 and 7 is because of background chatting of switches and routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 = default queue on Comware&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7 = VRRP, OSPF, etc.&lt;/p&gt;&#xA;" OwnerUserId="21407" LastEditorUserId="8499" LastEditDate="2016-03-16T15:17:54.560" LastActivityDate="2016-03-16T15:17:54.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25284" PostTypeId="1" AcceptedAnswerId="25288" CreationDate="2015-12-17T13:27:30.077" Score="9" ViewCount="2418" Body="&lt;p&gt;Why do summary routes get a lower AD than other routing protocols? For example: The AD of EIGRP is 90, whereas the AD of a summary route is 5.&lt;/p&gt;&#xA;" OwnerUserId="21408" LastEditorUserId="8499" LastEditDate="2017-08-29T03:08:39.330" LastActivityDate="2017-08-29T03:08:39.330" Title="Why do summary routes get a low Administrative Distance?" Tags="|routing|eigrp|route-summarization|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25287" PostTypeId="2" ParentId="25284" CreationDate="2015-12-17T15:02:39.993" Score="6" Body="&lt;p&gt;The AD of the EIGRP summary route is 5 only on the router that has the summary route configured.  When the summary is advertised to other routers it has an AD of 90.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for the low AD is to insure that the summary route (to nul0) is preferred to prevent routing loops.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-17T15:02:39.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25288" PostTypeId="2" ParentId="25284" CreationDate="2015-12-17T15:03:38.307" Score="9" Body="&lt;p&gt;Since the summarized route means that a router advertising it has knowledge of the individual routes within the summarized prefix, it is more trustworthy than the same (summarized) prefix being advertised as an individual route without the knowledge of the individual routes which make up the summary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This doesn't mean that the summarized route is more preferred than one of the routes in the summary since the longest match will be more preferred than the summary. It simply means that the same route, if advertised as both a summary and a non-summary, the summary route is more trustworthy.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-17T15:03:38.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25291" PostTypeId="1" AcceptedAnswerId="25292" CreationDate="2015-12-17T19:14:56.900" Score="13" ViewCount="4358" Body="&lt;p&gt;Recently I was puzzled by the following articles about Raw-Ethernet frames:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://aschauf.landshut.org/&quot;&gt;RAW ethernet vs. UDP&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://antrix.net/static/pages/about/dsarda_btech.pdf&quot;&gt;Message Passing Using Raw Ethernet Frames&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Briefly, both of them discusses that it is possible to establish a point-to-point communication using only the Ethernet layer. In that case, the overhead of the IP and TCP layers would be avoided and the throughput would increase (roughtly 50% according to some benchmarks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to do a similar test but in a wireless environment. However, I have some issues:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1st Issue&lt;/strong&gt;&lt;br&gt;&#xA;Is there any hardware constraint (ie: the Wi-Fi card) that might undermine such effort?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2nd Issue&lt;/strong&gt;&lt;br&gt;&#xA;Both articles chose the following frame format:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Preamble | Delimiter | Mac Headers | Payload | Pad | CRC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know, preamble, delimiter, pad and CRC are added by the Ethernet device to every frame and can not be changed via software. I guess with Wi-Fi devices is similar.&#xA;Therefore, is there any hardware constraint (ie: the Wi-Fi card) that would undermine removing the Mac Headers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ps: consider that the communication will be on a point-to-point basis, ie., there will be no routers, switches, bridges, ... no internet connectivity.&lt;/p&gt;&#xA;" OwnerUserId="20647" LastEditorUserId="8499" LastEditDate="2018-10-26T19:05:57.397" LastActivityDate="2018-10-26T19:05:57.397" Title="Raw-Ethernet Frames" Tags="|ethernet|wireless|ieee-802.11|mac-address|ad-hoc-wireless|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25292" PostTypeId="2" ParentId="25291" CreationDate="2015-12-17T19:28:00.667" Score="9" Body="&lt;p&gt;First, Wi-Fi (IEEE 802.11) is not ethernet (IEEE 802.3) any more than token ring (IEEE 802.5) or any of the other IEEE LAN standards other than 802.3 are ethernet. The frame headers are different for Wi-Fi and ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wi-Fi, ethernet, token ring, FDDI, etc. are all LAN standards for OSI layer-1 and layer2 which encapsulate datagrams for upper layer protocols. Each can transport layer-3 protocols, of which IP is merely one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are free to create your own or use one of the existing layer-3 protocols for one of the IEEE LAN protocols, but you will need to have the frame for the LAN protocol which you choose. Don't expect to be able to interoperate with any device which is not running your protocol stack, nor can you expect it to run over any routers which don't have your protocol stack (this means no Internet which uses IP). Bridges like ethernet switches or WAPs will transport your upper layer protocols since they work at layer-2, so you could create a LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to have the frame header for the type of LAN you are on. For one thing, how does one host actually send to another host without the layer-2 address in the frame. I think you are basically going back to serial communication like RS-232 which has no frame or header, but it relies on extra wires for data control.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-17T20:15:36.750" LastActivityDate="2015-12-17T20:15:36.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25294" PostTypeId="2" ParentId="22719" CreationDate="2015-12-17T19:49:44.513" Score="5" Body="&lt;p&gt;The short answer is that SCRYPT has additional protections against brute forcing AND uses PBKDF2. However, which is best ultimately depends on which implementation is most secure for the longest time and only time will tell.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This answer on the &lt;a href=&quot;https://supportforums.cisco.com/discussion/12057411/secret-8-and-9-vs-secret-4&quot; rel=&quot;nofollow&quot;&gt;Cisco Support Forums&lt;/a&gt; provides a comprehensive answer:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Type-8 passwords are what type-4 were meant to be: PBKDF2 &#xA;  (Password-Based Key Derivation Function 2) with 20000 iterations of&#xA;  SHA-256. While good, this is still vulnerable to brute-forcing since&#xA;  SHA-256 is easy to implement VERY fast in ASICS or graphics cards.&#xA;  That is not to say its easy, and in fact if you choose good passwords&#xA;  it is close to impossible, but it is doable&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Type 9: Type 9 passwords use the scrypt algorithm from the&#xA;  crypto-currency guys. Its whole goal is to ensure that it is expensive&#xA;  to run the algorithm. It does this first by being hard to run in&#xA;  parallel and by requiring a tradeoff: Either use lots of memory and be&#xA;  fast or a little memory and be slow. The trick there is that ASICS and&#xA;  graphics cards don't have enough memory (memory BW) to run fast so in&#xA;  practice it is VERY SLOW to run this algorithm. The other interesting&#xA;  thing is that inside the algorithm is....Lots of PBKDF2 so in Scrypt&#xA;  you combine the best of both.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Bottom line: Either one of these is WAY more secure then type 5's and&#xA;  almost infinity more secure then the horrible broken type 4's.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="403" LastEditorUserId="8499" LastEditDate="2015-12-23T10:04:42.330" LastActivityDate="2015-12-23T10:04:42.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25296" PostTypeId="2" ParentId="25291" CreationDate="2015-12-17T21:42:29.580" Score="0" Body="&lt;p&gt;Yes. &lt;em&gt;In theory&lt;/em&gt;, you can run point-to-point ethernet like that. Both endpoints would have to be in promiscuous mode to remove the 802.3 Ethernet MAC headers (otherwise the frames don't belong to either NIC and would be ignored.) Of course, doing this means you aren't running &quot;ethernet&quot;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-12-17T21:42:29.580" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25298" PostTypeId="2" ParentId="25291" CreationDate="2015-12-18T01:45:19.620" Score="7" Body="&lt;p&gt;Based on your questions and comments, I think you are missing the point of the two articles you are referencing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When they are talking about &quot;Raw Ethernet,&quot; they are talking about data frames that do not contain any IP (L3) or TCP/UDP (L4) headers. They are not talking about using L2 frames without L2 headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without the L2 headers, a frame would be neither an 802.3 (Ethernet) nor an 802.11 frame. It would be something else entirely. A separate L2 protocol.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any hardware constraint (ie: the Wi-Fi card) that might undermine such effort?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Of not including L2 headers? Absolutely. You would have to specify a specific adapter to get a specific answer, but I doubt you could even write drivers that would work with most 802.3 or 802.11 adapters that did not include the L2 headers. My guess is that most adapters would reject/drop the frame as malformed either before sending or upon receiving it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of sending just an 802.3 or 802.11 frame that doesn't include IP or TCP/UDP headers? No. This happens all the time as part of normal network operations and has for decades (at least for 802.3; 802.11 hasn't been around as long but at least a decade).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Therefore, is there any hardware constraint (ie: the Wi-Fi card) that would undermine removing the Mac Headers?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See above.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2015-12-18T01:45:19.620" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25299" PostTypeId="1" AcceptedAnswerId="25342" CreationDate="2015-12-18T06:48:33.843" Score="2" ViewCount="131" Body="&lt;p&gt;Can I run a single Corning 12-strand armored fiber cable to a series of security cameras?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know the details of fiber installation, so I'm wondering if strands can be split off along the way (can't see in my mind how this would work). I want to avoid daisy chaining, but I also wouldn't want a separate armored fiber cable for each camera.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example of armored fiber:&#xA;&lt;a href=&quot;http://catalog.corning.com/opcomm/en-US/catalog/ProductDetails.aspx?cid=tight_buffered_indoor_outdoor_cables_web&amp;amp;pid=9231&amp;amp;vid=10363&quot; rel=&quot;nofollow&quot;&gt;http://catalog.corning.com/opcomm/en-US/catalog/ProductDetails.aspx?cid=tight_buffered_indoor_outdoor_cables_web&amp;amp;pid=9231&amp;amp;vid=10363&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While I'm at it: anyone have experience on what brand of ethernet-to-fiber media converters are respected in the industry?&lt;/p&gt;&#xA;" OwnerDisplayName="user21430" LastActivityDate="2015-12-20T16:48:30.343" Title="Armored Fiber Installation" Tags="|switch|fiber|media-conversion|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25300" PostTypeId="2" ParentId="25074" CreationDate="2015-12-18T07:28:30.157" Score="3" Body="&lt;p&gt;It turns out that having nat traversal enabled was causing the issue.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no cry ips nat-trans udp-encaps&#xA;int tun1&#xA;shut&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the tunnel was up.&lt;/p&gt;&#xA;" OwnerUserId="18938" LastActivityDate="2015-12-18T07:28:30.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25303" PostTypeId="2" ParentId="25299" CreationDate="2015-12-18T10:22:14.803" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I don't know the details of fiber installation, so I'm wondering if strands can be split off along the way (can't see in my mind how this would work). I want to avoid daisy chaining, but I also wouldn't want a separate armored fiber cable for each camera.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I understand it to make a tee you pretty much have to cut the whole cable so you can put both ends plus your branch cables into a splice case and terminate them properly. Inside that splice case you can then fusion splice the individual fibres together in whatever combination you want.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2015-12-20T16:48:30.343" LastActivityDate="2015-12-20T16:48:30.343" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25304" PostTypeId="2" ParentId="25261" CreationDate="2015-12-18T11:44:50.813" Score="0" Body="&lt;p&gt;Wi-Fi hot spots are cheap to set up, but the billing systems can easily cost 10 times as much as a basic hot spot.   Also add in the cost of selling the cards etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence in the UK, companies that have tried to charge for access to hotspots have not done well, as providing a free hotspot and just letting everyone within range use it, gives a good return on investment for cafes etc, just due to selling more cups of coffee.&lt;/p&gt;&#xA;" OwnerUserId="21436" LastActivityDate="2015-12-18T11:44:50.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25306" PostTypeId="2" ParentId="25237" CreationDate="2015-12-18T12:05:47.330" Score="0" Body="&lt;p&gt;If I understand this correctly,  &quot;Ethernet Flow control&quot; is used when one computer on a single Ethernet network segment can not cope with the rate that pockets are being sent to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Ethernet Flow control&quot; is blocked by switches (bridges), so does not effect what happens on any other Ethernet network that is connected to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days, it is uncommon to find a &quot;Ethernet network segment&quot; that consists of more then one computer and one switch port.   In the &quot;old days&quot; there used to be lots of computers on each network segment, sharing the same wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Storm Control is well explained by Ron.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In real life, most flow control is done by the TCP protocol and network buffers are large enough that &quot;low level&quot; flow control is not really needed to the extent it was when I was a child and Ethernet run on yellow cables the thickness of my finger.&lt;/p&gt;&#xA;" OwnerUserId="21436" LastActivityDate="2015-12-18T12:05:47.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25307" PostTypeId="1" CreationDate="2015-12-18T12:06:46.460" Score="1" ViewCount="2373" Body="&lt;p&gt;As there is no option for preempt in ASA active/standby configuration, does anyone have a suggestion for a workaround to confirm that primary ASA will always be active when it is up?&lt;/p&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="8499" LastEditDate="2018-12-22T21:00:02.423" LastActivityDate="2018-12-22T21:00:02.423" Title="Preempt in ASA a/s fail over" Tags="|cisco|cisco-asa|firewall|failover|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="25309" PostTypeId="1" AcceptedAnswerId="25311" CreationDate="2015-12-18T14:28:35.643" Score="2" ViewCount="2822" Body="&lt;p&gt;We used to have one site with one Cisco switch to which a RANCID server was connected to take configuration backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A new site was opened, and we have another switch on this new site. The sites have the same IP network addressing, and we cannot change it, seriously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/thYtO.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/thYtO.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a task to connect a second switch to the RANCID server, and this gives us a bit of a headache as the IP network addresses of the switches are the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RANCID server connects to the switches via telnet (security is not important).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the question is - how to connect the RANCID server to both switches without making any changes on switches (minor changes can be done on switches only as last resort)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seemed to me that one of the solutions is to install a router between switches and RANCID Server and perform NAT port forwarding:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/30KO8.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/30KO8.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But we cannot do it as ports connected to the switches should be in the same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about using PBR, but in any case both interfaces cannot be in the same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From one point of view it seems pointless to have on both interfaces the same subnet because &quot;how will the router know to which interface to send packets&quot;, from another point I don't want the router to know where to send packets because I can manually specify what to do with packets that, for example, fall under PBR access-list &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you please advise if there is solution of this problem of connecting RANCID to switches with the same IP?&lt;/p&gt;&#xA;" OwnerUserId="19524" LastEditorUserId="8499" LastEditDate="2019-01-12T23:29:17.340" LastActivityDate="2019-01-12T23:29:17.340" Title="Connect to switches with the same IP" Tags="|cisco|switch|ip|ipv4|nat|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25310" PostTypeId="2" ParentId="22645" CreationDate="2015-12-18T14:28:51.600" Score="0" Body="&lt;p&gt;You forgot to configure RIP version 2 for R2. You've specified it on R1 and R3, but not R2. Without this, subnet information will not be advertised and hence you cannot use disconnected networks. That's also why R2 is not showing anything on debug mode.&lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2015-12-18T14:28:51.600" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25311" PostTypeId="2" ParentId="25309" CreationDate="2015-12-18T14:37:05.490" Score="2" Body="&lt;p&gt;When companies merge, they often have this problem with overlapping addresses. Cisco has NAT Outside Source which helps to solve the problem. You can do an Internet search for &quot;cisco ip nat outside source&quot; to find information such as &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13770-1.html&quot; rel=&quot;nofollow&quot;&gt;Sample Configuration Using the ip nat outside source list Command&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Introduction&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This document provides a sample configuration with the &lt;strong&gt;ip nat&#xA;  outside source list&lt;/strong&gt; command, and includes a brief description of&#xA;  what happens to the IP packet during the NAT process. You can use this&#xA;  command to translate the source address of the IP packets that travel&#xA;  from outside of the network to inside the network. This action&#xA;  translates the destination address of the IP packets that travel in&#xA;  the opposite direction—from inside to outside of the network. &lt;strong&gt;&lt;em&gt;This&#xA;  command is useful in situations such as overlapping networks, where&#xA;  the inside network addresses overlap addresses that are outside the&#xA;  network.&lt;/em&gt;&lt;/strong&gt; Let us consider the network diagram as an example.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Note: this should really only be a temporary situation, and you should strive to resolve the conflict. This is not something you want to maintain as a long term solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possible solution is to create VLANs on the switches just for the RANCID server connections, and you can set up different IP addresses for the switches on the server VLANs. This will not affect the switches and the existing LAN addressing, it just adds new addressing specifically for the server connections.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-18T16:29:13.170" LastActivityDate="2015-12-18T16:29:13.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25312" PostTypeId="1" CreationDate="2015-12-18T16:42:31.497" Score="0" ViewCount="44" Body="&lt;p&gt;During an interview I was asked to provide a basic outline of a project managment for a network position. The &lt;strong&gt;objective&lt;/strong&gt; was to provide wireless access to 3 campus (let's say each of 1000 people) that were already connected to a backbone. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were asked to define some variables to better understand the project and to provide:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a list of all devices that needs to be purchased&lt;/li&gt;&#xA;&lt;li&gt;a planning in form of a GANTT and WBS&lt;/li&gt;&#xA;&lt;li&gt;a list of all people needed for this&lt;/li&gt;&#xA;&lt;li&gt;budget estimation and assignment over time/people&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How would you approach this pratically ? I understand that this question is a bit vague, but if the answer can provide a &quot;model&quot; project that would be helpful to solve similar assignments&lt;/p&gt;&#xA;" OwnerUserId="21446" LastActivityDate="2015-12-18T19:10:17.823" Title="Managment Network: provide wireless access to 3 campus" Tags="|wireless|design|architecture|" AnswerCount="1" CommentCount="7" ClosedDate="2015-12-18T22:42:24.127" ContentLicense="CC BY-SA 3.0" />
  <row Id="25314" PostTypeId="2" ParentId="25307" CreationDate="2015-12-18T17:31:39.737" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/ha_failover.html#pgfId-1154529&quot; rel=&quot;nofollow&quot;&gt;Cisco&lt;/a&gt;, there are three ways for the formerly Active, now Standby, primary unit to again become Active:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Active unit failed (power or hardware)&lt;/li&gt;&#xA;&lt;li&gt;Failover link failed at startup&lt;/li&gt;&#xA;&lt;li&gt;Interface failure on active unit above threshold&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You may be able to do something with an EEM script to fail an interface on the now Active secondary unit when the now Standby primary unit comes back up, and then restore the failed interface after the unit returns to Standby. This is a real kludge because this is not the design for Active/Standby.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-18T17:31:39.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25315" PostTypeId="2" ParentId="25299" CreationDate="2015-12-18T17:55:36.677" Score="0" Body="&lt;p&gt;In regards to pulling off fiber as the run goes, yes that is possible, a pain dealing with the armored cable but is done by many people.  A fusion splicer would also not be needed, a box like this (for example only, not promoting this style or company, there are a few to pick from):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.google.com/url?sa=i&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=images&amp;amp;cd=&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwiS9LOT-uXJAhVE7yYKHRN-AcsQjRwIBw&amp;amp;url=http%3A%2F%2Fwww.alemsan.com%2FFiber_Optic.html&amp;amp;psig=AFQjCNE5W0wIUu0y8otnYvnJi2Qt3XYOBg&amp;amp;ust=1450546809899736&quot; rel=&quot;nofollow&quot;&gt;https://www.google.com/url?sa=i&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=images&amp;amp;cd=&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwiS9LOT-uXJAhVE7yYKHRN-AcsQjRwIBw&amp;amp;url=http%3A%2F%2Fwww.alemsan.com%2FFiber_Optic.html&amp;amp;psig=AFQjCNE5W0wIUu0y8otnYvnJi2Qt3XYOBg&amp;amp;ust=1450546809899736&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would allow you to &quot;peel off&quot; a strand or two. Then you would just need to put an end on the fiber, which you can do with pre-made ends that have the gel and everything you would need built in, you strip the fiber back exposing the &quot;glass&quot; then insert that into the premade jack and snap it together.  This would give you the end to plug into the above box on the inside. You would then need to purchase a fiber patch to plug into either the cameras or into a media converter to convert it to copper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example (5 strands shown below) the first strand is terminated early in the run, the second strand a little further down, and the others keep going until terminated even further or kept as spare:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-------------------MDF Splice Tray--fiber patch--camera/converter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;----------------------------------MDF Splice Tray--fiber patch--camera/converter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-------------------------------------------------------------------------------&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-------------------------------------------------------------------------------&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-------------------------------------------------------------------------------&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would not need to cut each strand every time you need a camera along the run, that would put to many splices on the last strand (to many being an arbitrary number, depends on quality of splices, distances, etc), presumably you would have 11 splices for the 12 strand before it got to its ends device.&lt;/p&gt;&#xA;" OwnerUserId="21449" LastActivityDate="2015-12-18T17:55:36.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25316" PostTypeId="2" ParentId="25312" CreationDate="2015-12-18T19:10:17.823" Score="2" Body="&lt;p&gt;As someone who interviews candidates, I can tell you that the specifics of the the network design are the least important part of the answer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What the interviewer wants to know is how you would organize and execute the project.  He/she wants to know if you can identify the missing information (lots) and identify the steps get it.  He wants to know if you can identify the resources you need to to get the job done.  Remember, they want a basic outline of the project.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interviewer was laying a trap to see if you'd dive into the technical design instead of all the project issues.  Unfortunately, it seems you took the bait.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-18T19:10:17.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25317" PostTypeId="1" AcceptedAnswerId="25318" CreationDate="2015-12-18T21:40:25.403" Score="1" ViewCount="71" Body="&lt;p&gt;I got following routing setup:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Target        Gateway      Mask&#xA;0.0.0.0       192.168.1.1  0.0.0.0&#xA;192.168.2.0   192.168.1.2  255.255.255.0&#xA;192.168.1.0   0.0.0.0      255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Router 192.168.1.1 connects to internet.&#xA;Router 192.168.1.2 connects to another LAN.&#xA;Routing works and I can reach both internet and hosts at 192.168.2.* as expected.&lt;/p&gt;&#xA;&lt;h3&gt;Then&lt;/h3&gt;&#xA;&lt;p&gt;router 192.168.1.2 has changed its IP address to 192.168.1.10. Routing tables has not been changed, they are just like above.&lt;/p&gt;&#xA;&lt;p&gt;ARP tables has both 192.168.1.2 (old) and 192.168.1.10 (new) if that could have any effect?&lt;/p&gt;&#xA;&lt;p&gt;That behavior was confusing so I did try same routing configuration with another machine (that's not been part of network before) and as I expected it did not work. Only 192.168.1.10 found from ARP tables as resolved record, which is also expected behavior.&lt;/p&gt;&#xA;&lt;p&gt;So, my question is: Why does routing to 192.168.2.* hosts still work? There's no valid route to that network anymore.&lt;/p&gt;&#xA;&lt;p&gt;OS which still connects through &amp;quot;legacy&amp;quot; route is linux 3.18.7 if that matters.&lt;/p&gt;&#xA;" OwnerUserId="21452" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-12-19T00:50:08.963" Title="Why routing still works after router IP has changed?" Tags="|routing|router|ipv4|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25318" PostTypeId="2" ParentId="25317" CreationDate="2015-12-19T00:50:08.963" Score="5" Body="&lt;p&gt;It works because the arp entry for 192.168.1.2 is still valid.  Your router determines that the next hop is 192.168.1.2 and looks in the arp cache.  Since the entry is still there, if sends the frame to that MAC address, which is still your router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wait a while, the entry will age out and the network will be unreachable.  The new computer you connected didn't have the old entry, so that's why it didn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/15372011/configuring-arp-age-timeout&quot;&gt;This article&lt;/a&gt; explains how the arp cache ages out on Linux machines.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2015-12-19T00:50:08.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25320" PostTypeId="1" AcceptedAnswerId="25321" CreationDate="2015-12-19T01:34:46.600" Score="2" ViewCount="1771" Body="&lt;p&gt;I have been learning about address classes, public and private ips, etc and was wondering which class A, B, or C ISPs typically use to distribute public ips? I was guessing it would be class A, allowing for the maximum amount of networks but I am not sure if I am grasping the concepts properly.&lt;/p&gt;&#xA;" OwnerUserId="21457" LastActivityDate="2015-12-19T02:15:48.150" Title="Which IP class do ISPs use?" Tags="|ipv4|" AnswerCount="2" CommentCount="1" ClosedDate="2015-12-19T22:07:06.090" ContentLicense="CC BY-SA 3.0" />
  <row Id="25321" PostTypeId="2" ParentId="25320" CreationDate="2015-12-19T02:10:54.640" Score="8" Body="&lt;p&gt;Network classes were deprecated in 1995 (20 years ago), so any mention of IPv4 classes is basically historical. Today, we use Classless Interdomain Routing (CIDR) and Variable Length Subnet Masks (VLSM) which make classes moot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which classes an ISP may use depends on what address space is allocated to the ISP. The large ISPs most likely have addresses in multiple classes, but some of the smaller ISPs will only have blocks from one class. You can't generalize, and you would need to check with a specific ISP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-19T02:10:54.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25322" PostTypeId="2" ParentId="25320" CreationDate="2015-12-19T02:15:48.150" Score="6" Body="&lt;p&gt;Address classes have been deprecated more than 20 years ago. The internet uses Classless Inter Domain Routing (CIDR) now and the old classful system is only relevant for some ancient routing protocols that you shouldn't be using anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sorry, but you just learned about some obsolete technology... Unless you're interested in history you should forget all that classful stuff as soon as possible.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2015-12-19T02:15:48.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25323" PostTypeId="1" AcceptedAnswerId="25324" CreationDate="2015-12-19T02:25:11.557" Score="3" ViewCount="627" Body="&lt;p&gt;I just read that specific ranges of IPs have been set aside to be used to private ip addressing. But if we already distinguish between public and private IPs why do we need to reserve space? Why cant a public ip and a private ip be the same considering other publics ips do not access the private one directly?&lt;/p&gt;&#xA;" OwnerUserId="21457" LastEditorUserId="8499" LastEditDate="2018-03-10T17:35:09.107" LastActivityDate="2018-03-10T17:35:09.107" Title="Why is space reserved for private ip addresses?" Tags="|ipv4|ip|ipv6|ip-address|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25324" PostTypeId="2" ParentId="25323" CreationDate="2015-12-19T02:32:13.050" Score="6" Body="&lt;p&gt;You actually could use public address space on your private network (nobody is preventing you from doing this), but that would be foolish since you could no longer reach those addresses on the public Internet. Any attempt to reach public Internet sites with addresses in the range you use for your private addresses would never leave your private network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for the separate private address space is that it will not conflict with any public IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-19T02:32:13.050" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25330" PostTypeId="1" AcceptedAnswerId="25331" CreationDate="2015-12-19T16:47:42.423" Score="1" ViewCount="765" Body="&lt;p&gt;this is been puzzling me for months now, i tried to google this, but results are often irrelevant, like questions about why is something not working for someone and how to deal with firewall problems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i have the opposite situation, my tunnel works when i think it should not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is my setup:&#xA;i have windows 7 running in virtualbox on ubuntu 14.04. (the nic is virtualbox NAT)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the ubuntu is connected to a Net gear router then to my cable modem then to internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i believe i have some firewalls on both windows and ubuntu but i definitely have a firewall on the router that rejects incoming packets, unless the connection was initiated from behind the firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now my question is why can i run a open vpn client in windows 7 and successfully connect to internet over udp ports?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i understand why tcp would work. tcp connections are initiated by the client in windows, therefore openvpn server replies should go thru the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but udp is stateless. it is fire and forget, my windows 7 client would fire something to openvpn server and forget, then the server would fire something back and forget, to the firewall on the router this should look like a connection being initiated from the outside, and the firewall should block this but it doesnt and my udp tunnel works? amazing stuff.&lt;/p&gt;&#xA;" OwnerUserId="21468" LastEditorUserId="21468" LastEditDate="2015-12-23T12:41:07.460" LastActivityDate="2015-12-23T12:41:07.460" Title="why does my openVPN client work over udp, given that i am behind several firewalls" Tags="|vpn|firewall|udp|" AnswerCount="1" CommentCount="3" ClosedDate="2015-12-21T15:58:15.823" ContentLicense="CC BY-SA 3.0" />
  <row Id="25331" PostTypeId="2" ParentId="25330" CreationDate="2015-12-19T17:04:06.277" Score="1" Body="&lt;p&gt;It is because the firewalls have tables which remember what you sent to where so that a hole may be opened for matching return traffic from the same source as your destination. This is true for both TCP and UDP. The table entries will eventually time out. Depending on the firewall, the timeout values may be changed, usually independently, for TCP and UDP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-19T17:04:06.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25336" PostTypeId="1" CreationDate="2015-12-20T03:16:36.317" Score="2" ViewCount="66" Body="&lt;p&gt;I tried to test the speed of my website, so I used &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;time curl &quot;http://google.com&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result ended with&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;real   0m15.589s&#xA;user    0m0.012s&#xA;sys 0m0.000s&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to see what took so long, so I timed hosts&#xA;&lt;code&gt;time host google.com&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and got&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;real   0m0.180s&#xA;user    0m0.008s&#xA;sys     0m0.004s&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And &lt;code&gt;time curl &quot;http://216.58.217.206&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and got&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;real   0m0.163s&#xA;user    0m0.000s&#xA;sys 0m0.004s&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0.18 s + 0.16 s is &lt;em&gt;much&lt;/em&gt; less than 15.58s!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does curl take so long?&lt;/p&gt;&#xA;" OwnerUserId="21477" LastActivityDate="2016-04-06T06:49:20.260" Title="Why does host+curl take longer than host alone and curl alone?" Tags="|dns|" AnswerCount="2" CommentCount="2" ClosedDate="2015-12-20T11:23:03.110" ContentLicense="CC BY-SA 3.0" />
  <row Id="25337" PostTypeId="2" ParentId="25336" CreationDate="2015-12-20T08:26:18.480" Score="0" Body="&lt;p&gt;&lt;code&gt;host google.com&lt;/code&gt; only resolves an A record. &lt;code&gt;curl &quot;http://google.com&quot;&lt;/code&gt; sends an HTTP GET request. Sending HTTP messages is much more work than resolving host names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, both &lt;code&gt;curl &quot;http://google.com&quot;&lt;/code&gt; and &lt;code&gt;host google.com&lt;/code&gt; trigger the local DNS resolver. After the desired record has been resolved, &lt;code&gt;host&lt;/code&gt; has done its work, while &lt;code&gt;curl&lt;/code&gt; is just beginning to do its actual work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short: &lt;code&gt;curl&lt;/code&gt; is a tool for HTTP. &lt;code&gt;host&lt;/code&gt; is a tool for DNS. &lt;code&gt;curl&lt;/code&gt; implicitly depends on DNS. &lt;code&gt;host&lt;/code&gt; explictily is designed for DNS.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2015-12-20T08:26:18.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25338" PostTypeId="2" ParentId="25336" CreationDate="2015-12-20T08:32:43.507" Score="0" Body="&lt;p&gt;When you do &lt;code&gt;curl &quot;http://google.com&quot;&lt;/code&gt;, you are specifying the &lt;code&gt;name&lt;/code&gt;; means it has loopup/resolve the &lt;code&gt;name&lt;/code&gt; to &lt;code&gt;IP&lt;/code&gt;(First connects to &lt;code&gt;DNS&lt;/code&gt; server, resolve the &lt;code&gt;IP&lt;/code&gt;) and then connects/&lt;code&gt;curl&lt;/code&gt; the IP(In your case Google!). It will take some time relatively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, Check the &lt;a href=&quot;http://linux.die.net/man/1/host&quot; rel=&quot;nofollow&quot;&gt;MAN&lt;/a&gt; page of &lt;code&gt;host&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;host&quot; is a simple utility for performing DNS lookups&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is only connecting to DNS/Resolving the &lt;code&gt;name&lt;/code&gt; to &lt;code&gt;IP&lt;/code&gt;. That's it!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;curl &quot;http://216.58.217.206&quot;&lt;/code&gt;, In this case, there is no need to reslove/loopup the &lt;code&gt;name&lt;/code&gt;. Because, as you know you're directly giving the &lt;code&gt;IP&lt;/code&gt;. So, simply connecting to google!&lt;/p&gt;&#xA;" OwnerUserId="17153" LastEditorUserId="17153" LastEditDate="2016-04-06T06:49:20.260" LastActivityDate="2016-04-06T06:49:20.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25339" PostTypeId="1" AcceptedAnswerId="25340" CreationDate="2015-12-20T08:59:55.603" Score="1" ViewCount="206" Body="&lt;p&gt;I'm designing a protocol similar to the DNS protocol but that may return more data. I have the option to use UDP or TCP. UDP is attractive because it is stateless, but it can also be used for DDOS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What strategies can be used in the protocol to avoid that it may used for DDOS attacks ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read somewhere that NTP is now using a nonce. How does this work ?&lt;/p&gt;&#xA;" OwnerUserId="21478" LastEditorUserId="21478" LastEditDate="2015-12-20T09:07:44.697" LastActivityDate="2015-12-20T09:32:53.477" Title="UDP protocol that can't be used for DDOS?" Tags="|udp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25340" PostTypeId="2" ParentId="25339" CreationDate="2015-12-20T09:32:53.477" Score="4" Body="&lt;p&gt;Both UDP and TCP can be used for DDOS and there is nothing in these protocols which can protect against is. But what you probably mean is not a general DDOS attack but an amplification  attack together with source spoofing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source spoofing means that the claimed source IP address of the client is different from the real source IP and thus the response will be sent not to the real client (the attacker) but to the claimed source (the target of the DDOS attack). Source spoofing is not possible with TCP since the initial handshake makes sure that the claimed client is actually the real client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An amplification attack means that the response is considerable larger then the request, i.e. typically a DNS query is small but the DNS response can be really large if it contains lots of DNS records which is common for hosts with multiple IP addresses. Combined with source spoofing this means that an attacker with low bandwidth can cause an attack with high bandwidth against the target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To protect against source spoofing use a protocol which is not affected like TCP or identify the client some other way, like through a shared secret. To protect against combining source spoofing with amplification make sure that your response is small at least as long as the client is not identified correctly to protect against source spoofing. Thus for a new client you could send a small response back containing a secret (nonce) and only for requests from clients containing this secret you will do a larger response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another protection against these kinds of attack is not at the protocol level but at the application level, in that you restrict the amount of data sent to a specific IP address, at least as long the client requesting these data was not properly identified. &lt;/p&gt;&#xA;" OwnerUserId="4063" LastActivityDate="2015-12-20T09:32:53.477" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25341" PostTypeId="1" AcceptedAnswerId="25356" CreationDate="2015-12-20T11:52:01.443" Score="0" ViewCount="494" Body="&lt;p&gt;Some of the existing daemons are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-zebra: Interface declaration and static routing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-bgpd: BGP routing protocol&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-ospfd: OSPF routing protocol &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-ospf6d: OSPF IPv6 routing protocol &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-ripd: RIP v2 routing protocol&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-ripngd: RIP Ipv6 routing protocol&lt;/p&gt;&#xA;" OwnerUserId="21054" LastActivityDate="2015-12-21T09:14:20.497" Title="How to add new daemon on Quagga Routing Suite?" Tags="|routing|quagga|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25342" PostTypeId="2" ParentId="25299" CreationDate="2015-12-20T12:28:23.233" Score="3" Body="&lt;p&gt;I have worked with this type of cable quite a bit.  I would say this is not impossible, but impractical.  The interlocking armor in the product you link to is quite strong and difficult to remove.  You'll need to remove at least a few feet of armor at each tap point.  To remove it you'll have to unravel it, pulling apart the interlock.  Doing this repeatedly without nicking the fiber at any of the tap points is not likely to work.  It will be difficult to get a bushing around the sharp edge of the armor midspan.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case I would say you're better off installing conduit if you need the protection from damage.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the media adapters - I haven't seen any functional difference between brands, unless you need manageable devices.  &lt;/p&gt;&#xA;" OwnerUserId="19640" LastActivityDate="2015-12-20T12:28:23.233" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25343" PostTypeId="1" CreationDate="2015-12-20T13:26:50.337" Score="2" ViewCount="375" Body="&lt;p&gt;When a host sends a frame to a switch, the switch maps the frame's source MAC address to the port it was received on. Then if a frame with that MAC address as the destination is received, it knows to send that frame on that port. And if it doesn't know what port to send a frame on, it sends it on all ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about if a frame is received from another switch? What if switch A sends switch B 2 frames, both with different source MAC addresses? How does switch B handle that situation?&lt;/p&gt;&#xA;" OwnerUserId="21482" LastActivityDate="2015-12-20T14:57:23.733" Title="What happens when a switch sends a frame to another switch?" Tags="|switch|mac-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25344" PostTypeId="1" CreationDate="2015-12-20T13:51:12.120" Score="2" ViewCount="376" Body="&lt;p&gt;I just want to ask a quick , really confusing question. Online on Wikipedia, it states that the MTU for ethernet is 1500. Then as written on the same page, Ethernet Frame types: Ethernet II, it states on line 9 that &quot;EtherType values must be greater than or equal to 1536 (0x0600). That value was chosen because the maximum length of the payload field of an Ethernet 802.3 frame is 1500 octets (0x05DC)&quot;. We clearly know that the MTU is 1500. In this case, 1536 bytes clearly contradicts the IEEE standard for MTU. what is going on here...???????&lt;/p&gt;&#xA;" OwnerUserId="21483" LastActivityDate="2015-12-22T03:55:05.900" Title="MTU does not tally with Ethertype for Ethernet II frame" Tags="|ethernet|mtu|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="25345" PostTypeId="2" ParentId="25343" CreationDate="2015-12-20T14:57:23.733" Score="7" Body="&lt;p&gt;Switch B associates both MAC addresess with the port it was received on.  A port can have multiple MAC addresses mapped to it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-20T14:57:23.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25347" PostTypeId="1" CreationDate="2015-12-20T18:18:17.423" Score="1" ViewCount="555" Body="&lt;p&gt;Trying to get the VPN tunnel to Azure working on a Cisco ISR 1941 but have been unable to get any traffic flowing back from Azure to site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tunnel looks to be up and a machine in Azure is receiving the pings but the local machine doesn't receive the response. I assume I've mucked up the config and am hoping someone much much more competent than I am with Cisco routers can point it out to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The subnets are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Azure Config: 192.168.200.0/24 &amp;lt;=&amp;gt; 192.168.30.0/22&#xA;Site 1: Subnet 1 192.168.1.0/24 Subnet 2 192.168.31.0/24&#xA;Site 2: Subnet 1 192.168.2.0/24 Subnet 2 192.168.32.0/24&#xA;Site 3: Subnet 1 192.168.3.0/24 Subnet 2 192.168.33.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At each site, Subnet 1 is the existing subnet for workstations and Subnet 2 is the new subnet I have introduced for machines that talk only to Azure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My config is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wfhwatgw#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 7016 bytes&#xA;!&#xA;version 15.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname wfhwatgw&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;logging buffered 51200 warnings&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip dhcp excluded-address 192.168.1.1&#xA;!&#xA;ip dhcp pool Default&#xA; import all&#xA; network 192.168.1.0 255.255.255.128&#xA; dns-server 192.168.1.10&#xA; default-router 192.168.1.1&#xA;!&#xA;!&#xA;!&#xA;ip domain name wfh.local&#xA;ip name-server 203.8.183.1&#xA;ip name-server 192.189.54.33&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;cts logging verbose&#xA;!&#xA;crypto pki trustpoint TP-self-signed-930478159&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-930478159&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-930478159&#xA;!&#xA;!&#xA;crypto pki certificate chain TP-self-signed-930478159&#xA; certificate self-signed 01&#xA;  30820229 30820192 A0030201 02020101 300D0609 2A864886 F70D0101 05050030&#xA;  30312E30 2C060355 04031325 494F532D 53656C66 2D536967 6E65642D 43657274&#xA;  69666963 6174652D 39333034 37383135 39301E17 0D313531 30323230 31303631&#xA;  335A170D 32303031 30313030 30303030 5A303031 2E302C06 03550403 1325494F&#xA;  532D5365 6C662D53 69676E65 642D4365 72746966 69636174 652D3933 30343738&#xA;  31353930 819F300D 06092A86 4886F70D 01010105 0003818D 00308189 02818100&#xA;  AA09432E 1CD882EA 4ACE6CA2 FB2D65D9 A779E861 C8D6E462 3A6DA653 DB587703&#xA;  A08486C2 C9C0E517 CA948D80 3626CB63 E15C46DA BAD47A07 21BCEDCC CF13D682&#xA;  09AA1CA8 33028713 CE4E0A46 79F4797E 96CADDA7 A41AC4A9 24851926 5707C8A5&#xA;  239794E0 2D92AF07 CEDFA3C7 6D9B2B53 923F1ACE 3DF6636A 8F3A454A 07B5A8FB&#xA;  02030100 01A35330 51300F06 03551D13 0101FF04 05300301 01FF301F 0603551D&#xA;  23041830 168014AE 9E16B1D8 6B4B306E E7139775 D2CFD1D2 B235D130 1D060355&#xA;  1D0E0416 0414AE9E 16B1D86B 4B306EE7 139775D2 CFD1D2B2 35D1300D 06092A86&#xA;  4886F70D 01010505 00038181 007EF058 8D7DD324 75F3DFCF 81A00AF7 846298E1&#xA;  17264021 83EF919A 2F80FB22 2AC0F570 A3683687 BB0E10AD 2F9E3035 13D6E497&#xA;  241AF42A 71E2158C 3A72182B F2610CBB B13529B4 015EC062 E47C9452 7FBD76A7&#xA;  F037D93C 3A1F803D 4FA093ED 03EA9CEF 75E8372E 0672F5D8 D6829951 E37786A1&#xA;  E121F71B C7D24A84 9597B4FD CD&#xA;        quit&#xA;license udi pid CISCO1941/K9 sn xxxxxx&#xA;license boot module c1900 technology-package securityk9&#xA;!&#xA;!&#xA;username admin privilege 15 secret 5 $1$EKdt$JnArUet2M7sgxD5gtABPJ/&#xA;!&#xA;redundancy&#xA;!&#xA;crypto ikev2 proposal Azure-Proposal&#xA; encryption aes-cbc-256 aes-cbc-128 3des&#xA; integrity sha1&#xA; group 2&#xA;!&#xA;crypto ikev2 policy Azure-Policy&#xA; proposal Azure-Proposal&#xA;!&#xA;crypto ikev2 keyring Azure-Keyring&#xA; peer xxx.xxx.xxx.xxx&#xA;  address xxx.xxx.xxx.xxx&#xA;  pre-shared-key xxxxxx&#xA; !&#xA;!&#xA;!&#xA;crypto ikev2 profile Azure-Profile&#xA; match address local interface Dialer1&#xA; match identity remote address xxx.xxx.xxx.xxx 255.255.255.255&#xA; authentication remote pre-share&#xA; authentication local pre-share&#xA; keyring local Azure-Keyring&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;crypto ipsec transform-set Azure-IPSec-Proposal-Set esp-aes 256 esp-sha-hmac&#xA; mode tunnel&#xA;!&#xA;!&#xA;crypto ipsec profile vti&#xA; set transform-set Azure-IPSec-Proposal-Set&#xA; set ikev2-profile Azure-Profile&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Tunnel1&#xA; ip address 169.254.0.1 255.255.255.0&#xA; ip tcp adjust-mss 1350&#xA; tunnel source Dialer1&#xA; tunnel mode ipsec ipv4&#xA; tunnel destination xxx.xxx.xxx.xxx&#xA; tunnel protection ipsec profile vti&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description ETH-SW-LAUNCH$INTF-INFO-GE 0/0$ETH-LAN$&#xA; ip address 192.168.31.254 255.255.255.0 secondary&#xA; ip address 192.168.1.1 255.255.255.0 secondary&#xA; ip address 192.168.1.254 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description WAN Connection&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; pppoe enable group global&#xA; pppoe-client dial-pool-number 1&#xA;!&#xA;interface Dialer1&#xA; mtu 1350&#xA; ip address negotiated&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; encapsulation ppp&#xA; ip tcp adjust-mss 1310&#xA; dialer pool 1&#xA; ppp chap hostname xxxxx@line.aapt.com.au&#xA; ppp chap password 0 xxxxx&#xA; ppp pap sent-username xxxxx@ip-line.aapt.com.au password 0 xxxxx&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;!&#xA;ip nat inside source list DSL_ACCESSLIST interface Dialer1 overload&#xA;ip route 0.0.0.0 0.0.0.0 Dialer1&#xA;ip route 192.168.200.0 255.255.252.0 Tunnel1&#xA;ip route 192.168.200.0 255.255.255.0 Tunnel1&#xA;!&#xA;ip access-list extended DSL_ACCESSLIST&#xA; permit ip 192.168.1.0 0.0.0.255 any&#xA; permit ip 192.168.31.0 0.0.0.255 any&#xA;!&#xA;dialer-list 1 protocol ip permit&#xA;dialer-list 2 protocol ip permit&#xA;dialer-list 3 protocol ip permit&#xA;!&#xA;!&#xA;access-list 101 permit ip 192.168.31.0 0.0.0.255 192.168.200.0 0.0.3.255&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;banner exec ^C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21347" LastActivityDate="2023-08-14T03:32:32.057" Title="Unable to receive return packets on Azure IPSEC VPN Connection" Tags="|cisco|routing|vpn|ipsec|cisco-isr|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25348" PostTypeId="1" AcceptedAnswerId="25349" CreationDate="2015-12-20T18:46:41.200" Score="0" ViewCount="115" Body="&lt;p&gt;I have a Windows server 2012 R2 machine running RRAS and DHCP. It has two ethernet interfaces: one for incoming internet traffic, and one for the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This server also forwards various ports to the local LAN. One of them is for an HTTP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try to connect to the HTTP server from outside the local network, this works fine. If I try to do the same from the local network, however, it does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen some suggestions as to how to solve this. One was changing the hosts file of the machines on the local area network. I am not interested in this solution. Another was to add a manual line to DNS on the server. I tried various things when it came to this, but with no luck. (I might not have done it in the correct manner.) The examples were to solve slightly different problems than the one I had, so I had to improvise, which might have led me to fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, what possible ways are there, and if the simplest one is to configure the DNS on the server, could anyone tell me how to do this? Preferably in a very basic way.&lt;/p&gt;&#xA;" OwnerUserId="21486" LastEditorUserId="8499" LastEditDate="2016-03-20T05:05:59.353" LastActivityDate="2016-08-17T10:56:55.137" Title="Access hosted site from behind local network?" Tags="|router|dhcp|dns|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25349" PostTypeId="2" ParentId="25348" CreationDate="2015-12-20T19:14:29.053" Score="1" Body="&lt;p&gt;I've been in this exact situation before (though not with RRAS). What you're looking for is called &lt;a href=&quot;https://en.wikipedia.org/wiki/Network_address_translation#NAT_loopback&quot; rel=&quot;nofollow&quot;&gt;NAT Loopback&lt;/a&gt;. This can be complicated to setup, so an alternative is for clients to use the servers LAN IP address when on the same network. You can do this with the hosts file (as you mentioned) or an internal DNS server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do this on your existing windows server by installing the DNS server role, then setting up forwarding (for external name resolution) and creating a zone for your domain with the appropriate records. This is called split-brain/split-horizon DNS, if you need to search for more info. Then you need to specify the DNS server in DHCP. If you're unsure what records to add to your local DNS zone, just copy all of them from your domains public DNS, and then change the necessary records pointing to your web server.&lt;/p&gt;&#xA;" OwnerUserId="20964" LastEditorUserId="8499" LastEditDate="2016-03-20T05:07:58.183" LastActivityDate="2016-03-20T05:07:58.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25351" PostTypeId="2" ParentId="18082" CreationDate="2015-12-20T19:43:25.007" Score="2" Body="&lt;p&gt;If I understand correctly, what you're asking is if the unmanaged switch can pass vlan tagged traffic to enable devices on the L2/L3 switches to communicate with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question has been asked on &lt;a href=&quot;https://serverfault.com/questions/333859/what-happens-when-a-consumer-switch-receives-a-vlan-tagged-ethernet-frame&quot;&gt;Serverfault&lt;/a&gt;, with the answer being: &lt;em&gt;maybe&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some switches will happily pass along the traffic, and some wont. It depends on the switching method used, and how the switch handles frames larger than 1518 Bytes.&lt;/p&gt;&#xA;" OwnerUserId="20964" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2015-12-20T19:43:25.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25353" PostTypeId="2" ParentId="20150" CreationDate="2015-12-20T22:26:27.170" Score="0" Body="&lt;p&gt;Proper private addresses are well-known. Occasionally addresses are added to the list but it's rare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately it seems like T-Mobile is using hijacked address space. 21.0.0.0/8 is allocated to &quot;DoD Network Information Center (DNIC)&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Detecting whether a machine is behind a NAT is easy enough, just compare the local IP the client reports for the connection (use the getsockname api call) to the remote IP the server reports for the connection. This will work regardless of whether the local IP addresses used behind the NAT are well-known private IP addresses, hijacked IP addresses or even IP addresses legitimately assigned to the network in question (sometimes it makes sense to use NAT even when your clients have legitimate public IP addresses)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However even if two machines are behind the same public IP there is no guarantee that communicating using their local addresses will work. Equally there is no guarantee that communicating with NAT traversal techniques will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So sadly if you want reliable operation you will have to implement a fallback to communicating via your servers.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="8499" LastEditDate="2016-03-20T00:07:18.287" LastActivityDate="2016-03-20T00:07:18.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25355" PostTypeId="1" AcceptedAnswerId="25368" CreationDate="2015-12-21T06:05:07.027" Score="2" ViewCount="1105" Body="&lt;p&gt;I have a issue in my network. In terms of OSI I am OK in the physical layer. My link is OK because I tested connecting a computer on a fiber link, and I was able to surf the Internet, but when I make a connection between two Cisco switches, I just have CDP - there is no propagation of VLANs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is something even stranger. I have a successful ping in a way. Example: I have a Switches A and B connected through that link. I can ping from B to A and get an answer, but ping doesn't work if I ping from A to B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems very weird to me. I believe it is a VLAN problem, but I do not understand because I can't successfully ping both ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I verified that I have the same configurations on both switch ports. I have &lt;code&gt;switchport mode trunk&lt;/code&gt; and the native VLAN is 1. I think that the problem is because of a broadcast storm, but I do not know how to verify that. The other situation that I have in my network is this is a multivendor network. My &quot;core&quot; switch is a 3Com. I have Cisco switches, HP switches and TP-Link switches with RSTP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I have a same version of STP in all switches? Could it be a physical problem? Could I have problems with the fiber link? In the moment when the fail occurred, a person was working near to the rack where the fiber ends. I have two transceivers, and I always test between gigabit ethernet ports. &lt;/p&gt;&#xA;" OwnerUserId="16271" LastEditorUserId="8499" LastEditDate="2019-01-04T06:15:44.437" LastActivityDate="2019-01-04T06:15:44.437" Title="Trunk link between Cisco switches does not allow internet to the end users" Tags="|cisco|switch|vlan|spanning-tree|trunk|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25356" PostTypeId="2" ParentId="25341" CreationDate="2015-12-21T09:14:20.497" Score="1" Body="&lt;p&gt;The best guide I found on the topic is &lt;a href=&quot;http://www.nongnu.org/quagga/zhh.html&quot; rel=&quot;nofollow&quot; title=&quot;Zebra Hacking HOWTO&quot;&gt;Zebra Hacking HOWTO&lt;/a&gt;. &#xA;Other sources of information can be found &lt;a href=&quot;http://www.nongnu.org/quagga/resources.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. You need to understand how 'threads' and timers work there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I personally prefer look at source code of quagga. It seems not so readable for the first couple hours, but later they're getting OK.&lt;/p&gt;&#xA;" OwnerUserId="2453" LastActivityDate="2015-12-21T09:14:20.497" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25357" PostTypeId="1" CreationDate="2015-12-21T10:54:21.113" Score="1" ViewCount="63" Body="&lt;p&gt;Dears,&#xA;I have a Zyxel USG20 and I defined 2 lans. The first one 192.168.1.xx and the second 192.68.2.xx&#xA;on the first I have a secure server with static IP 192.168.1.101&#xA;on the second subnet I have my TV 192.168.2.100 and I want to be able to connect to the server and use UPnP.&#xA;Is this setup possible? Can you help on this config?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R.&lt;/p&gt;&#xA;" OwnerUserId="21494" LastActivityDate="2015-12-21T10:54:21.113" Title="Access Server on different subnet" Tags="|vpn|firewall|subnet|lan|" AnswerCount="0" CommentCount="0" ClosedDate="2015-12-21T12:24:35.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="25359" PostTypeId="1" AcceptedAnswerId="25370" CreationDate="2015-12-21T11:53:58.580" Score="5" ViewCount="2531" Body="&lt;p&gt;Lets imagine that I have big LAN environment with many switches and many VLANs, for example, VLANs 5,15 and 50. I have PVST+ activated, and all of my switches have same (STP) priority.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I connect a new switch, with factory default settings, to my environment. And let's look only at VLAN 15. Nothing will change in this moment. Now, I create VLAN 15 on my new switch. (I didn't create a VLAN 15 SVI or add any ports to VLAN 15 - I only created VLAN 15.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which MAC address of this new switch will be used for the Bridge ID of VLAN 15? Will that Bridge ID be used in the Root Bridge election for VLAN 15?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastEditorUserId="8499" LastEditDate="2018-12-17T00:43:08.400" LastActivityDate="2018-12-17T00:43:08.400" Title="Which switch MAC addresses are used for the Bridge ID in STP?" Tags="|cisco|switch|switching|mac-address|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25362" PostTypeId="1" CreationDate="2015-12-21T13:42:14.727" Score="13" ViewCount="8491" Body="&lt;p&gt;I found this definition of Global Networks:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9S5td.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9S5td.png&quot; alt=&quot;Definition of Global Networks&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently does any Global Network exists (apart from Internet)? Can someone Quote some examples? Or non-global but on a country-wide scale(ATM network maybe)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doesn't every other WAN network comes under the category of &quot;Enterprise Network&quot;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know are there any other global networks other than the internet? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I was reading about Transport layer protocol when this line caught my eye:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;More than one transport layer protocol may be available to network applications. For example, the internet has two protocols - TCP and UDP. Each of these protocols provides a different set of transport layer services to in invoking applications&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;more specifically this line:&#xA;&lt;code&gt;For example, the internet has two protocols -TCP and UDP&lt;/code&gt;&lt;br/&gt;&#xA;What are some examples of non-internet Transport layer protocols?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The book briefly talked about &lt;code&gt;Telephone network&lt;/code&gt; as WAN(Apart from the internet). But that implemented &lt;code&gt;circuit-switched network&lt;/code&gt;. I doubt that those even had a Transport layer protocol. So, is there any other network that provides &lt;code&gt;Transport-Layer services&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="21421" LastEditorUserId="8499" LastEditDate="2016-12-20T15:56:50.120" LastActivityDate="2019-01-04T08:08:43.133" Title="Are there any global network other than the Internet?" Tags="|internet|network-core|transport-protocol|layer4|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="25363" PostTypeId="1" CreationDate="2015-12-21T14:03:22.300" Score="1" ViewCount="711" Body="&lt;p&gt;From my understanding so far, to estimate forward delay, the following formula should be used.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(end-to-end_bpdu_propagation_delay + message_age_overestimate +&#xA;tx_halt_delay + max_frame_lifetime)/2&#xA;(14 + 6 + 1 + 8) / 2 (With Default values)&#xA;15 (Round Figure)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understood the formula except why the Message Age Overestimate needs to be taken into account for this calculation.&lt;/p&gt;&#xA;" OwnerUserId="21500" LastEditorUserId="775" LastEditDate="2015-12-22T10:26:09.817" LastActivityDate="2015-12-22T10:26:09.817" Title="How Forward Delay Timer is estimated in Spanning Tree Protocol" Tags="|ethernet|protocol-theory|spanning-tree|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25364" PostTypeId="1" AcceptedAnswerId="25369" CreationDate="2015-12-21T14:21:19.087" Score="2" ViewCount="2615" Body="&lt;p&gt;I have a problem with vyatta 6.2 - static routing &#xA;&lt;a href=&quot;https://i.stack.imgur.com/20P2W.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/20P2W.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to have internet in network 192.168.0.&lt;em&gt;, I can ping e.g 192.168.0.59 but I have no internet connection in network 192.168.0.&lt;/em&gt;.&#xA;I tried to add static route but but nothing happened, &lt;code&gt;set protocols static route 192.168.1.0/24 next-hop 192.168.0.100&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ethernet eth0 {&#xA;     address 192.168.1.220/24&#xA;     description LAN_01&#xA;     hw-id 00:23:54:da:d8:2e&#xA; }&#xA; ethernet eth1 {&#xA;     address 192.168.0.100/24&#xA;     description LAN_02&#xA;     hw-id 10:fe:ed:04:12:db&#xA; }&#xA;&#xA;gateway-address 192.168.1.1&#xA;&#xA;root@ROUTER2# ping google.pl&#xA;PING google.pl (46.134.212.153) 56(84) bytes of data.&#xA;64 bytes from public103577.xdsl.centertel.pl (46.134.212.153): icmp_req=1 ttl=128 time=18.5 ms&#xA;64 bytes from public103577.xdsl.centertel.pl (46.134.212.153): icmp_req=2 ttl=128 time=18.9 ms&#xA;&#xA;root@ROUTER2# ping 192.168.0.59&#xA;PING 192.168.0.59 (192.168.0.59) 56(84) bytes of data.&#xA;64 bytes from 192.168.0.59: icmp_req=1 ttl=128 time=10.7 ms&#xA;64 bytes from 192.168.0.59: icmp_req=2 ttl=128 time=0.300 ms&#xA;&#xA;root@ROUTER2# show service nat rule 10 &#xA; outbound-interface eth0&#xA; source {&#xA;     address 192.168.0.0/24&#xA; }&#xA; type masquerade&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;thank you in advance for your help&lt;/p&gt;&#xA;" OwnerUserId="21503" LastActivityDate="2015-12-21T17:43:48.667" Title="vyatta static routing between 2 lan" Tags="|routing|linux|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25365" PostTypeId="1" CreationDate="2015-12-21T14:32:57.830" Score="-1" ViewCount="105" Body="&lt;p&gt;We are using More switches in our LAN setup,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We just want to know how many Switches we have crossed to reach the destination IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="21502" LastActivityDate="2016-07-20T20:19:46.050" Title="I need to know the switch IP" Tags="|cisco|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="25366" PostTypeId="1" CreationDate="2015-12-21T15:09:32.153" Score="2" ViewCount="72" Body="&lt;p&gt;Assume the Help Desk is in VLAN 2 and Sales is in VLAN 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When PCs come to the Help Desk for troubleshooting, for example a fresh install of Windows, they get an IP address in the subnet of VLAN 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A PC carries it's IP address back to the related department when it's transferred there because of the DHCP IP release time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the given IP address is not valid in the destination VLAN (VLAN 5 in this example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the best strategy (Cisco switch configurations or our Microsoft DHCP server) to avoid this kind of problem?&lt;/p&gt;&#xA;" OwnerUserId="21505" LastEditorUserId="8499" LastEditDate="2015-12-21T17:39:20.290" LastActivityDate="2015-12-22T05:09:58.330" Title="PC gets IP address from the Help Desk, and when it goes back to related department with different VLAN, no connection" Tags="|cisco|vlan|dhcp|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-12T23:57:31.707" ContentLicense="CC BY-SA 3.0" />
  <row Id="25368" PostTypeId="2" ParentId="25355" CreationDate="2015-12-21T17:03:33.237" Score="3" Body="&lt;p&gt;You should really run the same version of STP on all the switches. That means converting the Cisco switches to the same STP version as the other switches. Cisco has many documents about PVST and MST interactions if you search for them, and there is this one: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/72844-MST.html&quot; rel=&quot;nofollow&quot;&gt;Configuration example to migrate Spanning Tree from PVST+ to MST&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-21T17:03:33.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25369" PostTypeId="2" ParentId="25364" CreationDate="2015-12-21T17:11:20.223" Score="1" Body="&lt;p&gt;You don't need a static route in this situation. Your router has an interface in the two /24 networks so they are automatically added to its routing table as directly connected interfaces. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your configuration looks like it should work, so I would check anything not in your post such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.0.0/24 client IP settings&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Default gateway should be 192.168.0.100&lt;/li&gt;&#xA;&lt;li&gt;I would look here first. Your first ping to .59 took 10ms (vs 0.3ms) which may mean an arp request was made. This is unusual, since the host should have previously contacted your router in an attempt to reach the internet and should already be in the routers arp cache. Unless it isn't configured to use the router as its GW.&lt;/li&gt;&#xA;&lt;li&gt;Can they ping hosts in the 192.168.1.0 network?&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Firewall settings on the router&lt;/li&gt;&#xA;&lt;li&gt;DNS&lt;/li&gt;&#xA;&lt;li&gt;Conflicting NAT settings. You only need one NAT rule for basic translation.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20964" LastEditorUserId="20964" LastEditDate="2015-12-21T17:43:48.667" LastActivityDate="2015-12-21T17:43:48.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25370" PostTypeId="2" ParentId="25359" CreationDate="2015-12-21T17:15:23.100" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Which MAC address of this new switch will be used for the Bridge ID of&#xA;  VLAN 15? Will that Bridge ID be used in the Root Bridge election for&#xA;  VLAN 15? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6000-series-switches/41263-catmac-41263.html#span_mac&quot; rel=&quot;noreferrer&quot;&gt;Cisco&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;MAC Addresses for Spanning Tree Computation&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;MAC addresses used for Spanning Tree calculations are stored in an&#xA;  EEPROM present in the Supervisor module. Regardless of the types of&#xA;  line modules installed, the Layer 2 MAC addresses for VLANs do not&#xA;  change unless you replace the Supervisor module. If you do replace the&#xA;  Supervisor module, the Layer 2 MAC addresses of all VLANs change to&#xA;  those specified in the address allocator on the new Supervisor module.&#xA;  In the fixed configuration Catalyst switches, MAC addresses for VLANs&#xA;  cannot be changed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Each switch with that VLAN in the layer-2 domain will think it is the root bridge for that VLAN, and it will send out BPDUs with its bridge ID saying that until it receives a better BPDU for that VLAN. That means it it is used in the root bridge selection.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-21T17:25:49.860" LastActivityDate="2015-12-21T17:25:49.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25371" PostTypeId="2" ParentId="25363" CreationDate="2015-12-21T17:33:47.940" Score="1" Body="&lt;p&gt;Cisco has a document which describes this: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/19120-122.html&quot; rel=&quot;nofollow&quot;&gt;Understanding and Tuning Spanning Tree Protocol Timers&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Message age overestimate&lt;/strong&gt;—The purpose of this parameter is to account for the age of the BPDU since origination. Assume that each&#xA;  bridge increases the BPDU message age by 1 sec. The formula is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Message_age_overestimate &#xA;= (dia – 1) x overestimate_per_bridge &#xA;= dia – 1 &#xA;= 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/19120-122.html#default&quot; rel=&quot;nofollow&quot;&gt;Default Values of Spanning Tree Protocol Timers&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;forward delay&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The movement of a port into the listening state indicates that there is a change in the active STP topology and that a port will go from blocking to forwarding. So the listening and learning periods during which the forward delay runs must cover this consecutive period:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Time from when the first bridge port enters the listening state (and&#xA;stays there through the subsequent reconfiguration) to when the last&#xA;bridge in the bridged LAN hears of the change in the active topology&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;In addition, you need to count the same delay that you use to&#xA;calculate max age (message age overestimate and BPDU propagation&#xA;delay).&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Time for the last bridge to stop forwarding frames that are received&#xA;on the previous topology (maximum transmission halt delay), until the&#xA;last frame that is forwarded on the previous topology disappears&#xA;(maximum frame lifetime)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This amount of time is necessary in order to be sure that you do not&#xA;get duplicated frames.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Therefore, twice the time of the forward delay (listening time + learning time) contains all these parameters.&lt;/em&gt;&lt;/strong&gt; The formula is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2 x forward delay &#xA;= end-to-end_BPDU_propagation_delay + Message_age_overestimate + &#xA;    Maximum_frame_lifetime + Maximum_transmission_halt_delay &#xA;= 14 + 6 + 7.5 + 1 = 28.5 &#xA;&#xA;forward_delay &#xA;= 28.5 /2 &#xA;= 15 (rounded)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-22T05:48:07.493" LastActivityDate="2015-12-22T05:48:07.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25372" PostTypeId="2" ParentId="25365" CreationDate="2015-12-21T18:40:48.493" Score="1" Body="&lt;p&gt;If the switches are without management, you cant know because they are blind, meaning they wont/arent being treated as a node/hop like routers are&lt;/p&gt;&#xA;" OwnerUserId="21510" LastActivityDate="2015-12-21T18:40:48.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25373" PostTypeId="1" CreationDate="2015-12-21T19:06:49.537" Score="1" ViewCount="105" Body="&lt;p&gt;How would I add 0.0.15.255 to 172.1.6.255, talking about IPv4 networks here. I have done things like 192.168.1.15 plus 0.0.1.30 to be 192.168.2.45. but when it goes over the limit of 255, I just do not now how to do this... Help? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;link to full question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://cs.stackexchange.com/questions/51011/how-would-i-add-0-0-15-255-to-172-1-6-255/51012#51012&quot;&gt;https://cs.stackexchange.com/questions/51011/how-would-i-add-0-0-15-255-to-172-1-6-255/51012#51012&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cant use special symbols here..&lt;/p&gt;&#xA;" OwnerUserId="21511" LastEditorUserId="-1" LastEditDate="2017-04-13T12:48:37.203" LastActivityDate="2015-12-21T19:46:19.937" Title="How would I add 0.0.15.255. to 172.1.6.255.?" Tags="|ipv4|ip|" AnswerCount="1" CommentCount="13" ClosedDate="2015-12-21T20:42:00.213" ContentLicense="CC BY-SA 3.0" />
  <row Id="25374" PostTypeId="2" ParentId="25373" CreationDate="2015-12-21T19:17:37.453" Score="1" Body="&lt;p&gt;With basic subnetting, you take an address and mask, convert both to binary, and &lt;code&gt;AND&lt;/code&gt; the two together to get a subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, &lt;code&gt;172.1.5.255/20&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address 172.1.5.255 = 10101100.00000001.00000101.11111111&#xA;Mask 255.255.240.0  = 11111111.11111111.11110000.00000000&#xA;                      ===================================&#xA;Subnet              = 10101100.00000001.00000000.00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Convert it back to decimal, and you have your subnet. Then you can add &lt;code&gt;1&lt;/code&gt; in the 20th bit to get the next subnet, etc.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-21T19:19:18.677" LastActivityDate="2015-12-21T19:19:18.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25377" PostTypeId="2" ParentId="25362" CreationDate="2015-12-22T03:38:04.123" Score="6" Body="&lt;p&gt;There are quite a few global networks other than internet, mostly used for scientific research or military / diplomatic needs.  They may or may not use IP as the needs of their users dictate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, you can find the current map of the &lt;a href=&quot;https://www.glif.is/about/&quot; rel=&quot;noreferrer&quot;&gt;Global Lambda Integrated Facility&lt;/a&gt; (GLIF) &lt;a href=&quot;https://www.glif.is/publications/maps/GLIF_5-11_World_2k.jpg&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;, which is one such network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.internet2.edu/&quot; rel=&quot;noreferrer&quot;&gt;Internet2&lt;/a&gt; is also a separate initiative, and while the primary Internet2 network is focused on North America, it is &lt;a href=&quot;http://www.internet2.edu/vision-initiatives/partnerships/international-partnerships/international-partners/&quot; rel=&quot;noreferrer&quot;&gt;interconnected with similar networks&lt;/a&gt; in other countries.&lt;/p&gt;&#xA;" OwnerUserId="653" LastActivityDate="2015-12-22T03:38:04.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25378" PostTypeId="2" ParentId="25344" CreationDate="2015-12-22T03:55:05.900" Score="3" Body="&lt;p&gt;The short answer is because that is what the spec requires - values between 1500 and 1536 are undefined and should not be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant text of the 802.3-2012 spec is as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This two-octet field takes one of two meanings, depending on its&#xA;  numeric value. For numerical evaluation, the first octet is the most&#xA;  significant octet of this field.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;a) If the value of this field is less than or equal to 1500 decimal    (05DC hexadecimal), then the Length/ Type field indicates the number of MAC client data octets contained in the subsequent MAC Client Data field of the basic frame (Length interpretation).&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;b) If the value of    this field is greater than or equal to 1536 decimal (0600    hexadecimal), then the Length/Type field indicates&#xA;  the Ethertype of    the MAC client protocol (Type interpretation).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Length and Type    interpretations of this field are mutually&#xA;  exclusive.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are historic (practical) reasons for making the lower bound on type to be substantially clear of the upper bound of length, given the vagaries of vendor implementations available at the time.&lt;/p&gt;&#xA;" OwnerUserId="653" LastActivityDate="2015-12-22T03:55:05.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25379" PostTypeId="2" ParentId="25309" CreationDate="2015-12-22T04:23:17.573" Score="0" Body="&lt;p&gt;If the RANCID server is really on the same L2 segment as both switch management interfaces (which I sort of doubt, but maybe you make this work via some OOB tunnel magic), and it's a *nix host with iptables/ipfw/etc., then you can do something reasonably horrible like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Add a static ARP entry for each switch on the RANCID server using the real switch management MAC address.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Give them completely different IP addresses.  We'll call them (MAC-A, IP-A), and (MAC-B, IP-B)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure the RANCID server to talk to IP-A and IP-B (say 192.168.1.1 and 192.168.1.2, or some subnet you're not otherwise using)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Mangle outgoing packets to IP-A and IP-B to rewrite dst_ip to be 10.0.0.1&lt;/li&gt;&#xA;&lt;li&gt;Mangle incoming packets to match src_mac of MAC-A and MAC-B and rewrite src_ip to be IP-A and IP-B, respectively, so the RANCID process will be happy&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This will &lt;em&gt;only&lt;/em&gt; work if your RANCID server is on the same L2 segment as the switch management interfaces (and you're using telnet - this won't work with any protocol that has any modicum of security awareness).  And it's horrible.&lt;/p&gt;&#xA;" OwnerUserId="653" LastActivityDate="2015-12-22T04:23:17.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25380" PostTypeId="2" ParentId="25366" CreationDate="2015-12-22T05:09:58.330" Score="1" Body="&lt;p&gt;If you move the PC from the Help Desk to the related department, it should release its VLAN 2 IP address as soon as you disconnect it (assuming it is cabled) and it should get a new lease in VLAN 5 when it is reconnected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is receiving an address via a Wireless LAN connection, then it may be that you have the same SSID on two different APs attached to two different VLANs, which will cause you several problems.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-12-22T05:09:58.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25383" PostTypeId="1" CreationDate="2015-12-22T11:49:53.457" Score="9" ViewCount="4980" Body="&lt;p&gt;I have a Cisco router configured NAT (4 static NAT and dynamic NAT). My problem is that I can't access internal servers using public IP addresses from the internal network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know what the problem is. I did a lot of Google searching about this problem, and I learned that most firewall/routers automatically handle this situation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case of Cisco, NAT hairpinning is the one of the solutions (I don't know if I am correct). How can i do that?.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QsK82.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QsK82.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i need to access the server using the IP address &lt;code&gt;202.192.68.235&lt;/code&gt; from my PC, but I can't.&lt;/p&gt;&#xA;" OwnerUserId="16394" LastEditorUserId="8499" LastEditDate="2015-12-22T16:35:52.460" LastActivityDate="2017-09-10T21:11:53.840" Title="Cisco NAT hairpinning" Tags="|cisco|routing|router|nat|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="25386" PostTypeId="1" AcceptedAnswerId="25389" CreationDate="2015-12-22T16:35:18.223" Score="2" ViewCount="2820" Body="&lt;p&gt;I have this problem that I think its hard to solve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, How can I know the correct last Subnet Address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example : 10.0.0.0 /18&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnets = 1024&#xA;Host    = 16384 - 2 = 16382&#xA;256-192 = 64&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I came up with this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.0&#xA;10.0.64.0&#xA;10.0.128.0&#xA; ..to..&#xA;10.?.?.?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I know the last subnet. Is there any formula. I don't know it because 1024 Subnets is very large to type.&lt;/p&gt;&#xA;" OwnerUserId="21529" LastActivityDate="2015-12-22T17:16:32.137" Title="Determining the last subnet address" Tags="|subnet|" AnswerCount="1" CommentCount="3" ClosedDate="2015-12-22T20:31:11.913" ContentLicense="CC BY-SA 3.0" />
  <row Id="25387" PostTypeId="1" CreationDate="2015-12-22T16:49:23.650" Score="1" ViewCount="511" Body="&lt;p&gt;I play with Packet Tracer 6.2 using IPv4 and IPv6 addresses, trying to ping routers using the envelope icon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When both routers are IPv4 or IPv6, clicking envelope correctly chooses between ICMP and ICMPv6 packets. But I can't seem to use it when source server uses IPv6 and destination both IPv4 and IPv6. Envelope chooses IPv4 and fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I failed to use complex PDU - the source ip is 0.0.0.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to ping from console, ping using IPv6 has 100% success rate. I can live with that, but is there some more comfortable way like Mr. Envelope?&lt;/p&gt;&#xA;" OwnerUserId="21528" LastEditorUserId="33" LastEditDate="2015-12-23T02:27:27.673" LastActivityDate="2015-12-23T02:27:27.673" Title="Force ICMPV6 packet using envelope icon" Tags="|packet-tracer|icmpv6|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25389" PostTypeId="2" ParentId="25386" CreationDate="2015-12-22T17:03:51.130" Score="1" Body="&lt;p&gt;Write out the mask in binary and apply it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001010 . 00000000 . 00000000 . 00000000 = 10.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Mask = 18-bits, so the maximum (aka wild card mask) is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000 . 00000000 . 00111111 . 11111111 = 0.0.63.255&#xA;11111111 . 11111111 . 11000000 . 00000000 = 255.255.192.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The left most 18 bits represent the network, while the 1's represent the hosts on the network. To find the broadcast address, just maintain whatever the first 18 bits are in the original 10.0.0.0 address, and replace the following 14 bits with 1's. In order to get the next subnet, simply increment the left hand side:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001010 . 00000000 . 00111111 . 11111111 = 10.0.63.255/18&#xA;00001010 . 00000000 . 01111111 . 11111111 = 10.0.127.255/18&#xA;00001010 . 00000000 . 10111111 . 11111111 = 10.0.191.255/18&#xA;00001010 . 00000000 . 11111111 . 11111111 = 10.0.255.255/18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so on...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, simply change all of the host bits (right most 14 bits in this case) with 0's while maintaining the first 18 bits' original values to find the network address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the last subnet would have to be, while keeping the first octet in tact (RFC 1918 address):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00001010 . 11111111 . 11000000 . 00000000 = 10.255.192.0/18&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are no subnets that begin higher than that, assuming a /18 CIDR.&lt;/p&gt;&#xA;" OwnerUserId="3836" LastEditorUserId="3836" LastEditDate="2015-12-22T17:16:32.137" LastActivityDate="2015-12-22T17:16:32.137" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25392" PostTypeId="1" AcceptedAnswerId="25395" CreationDate="2015-12-22T19:00:13.563" Score="2" ViewCount="441" Body="&lt;p&gt;I'm looking for some wired client isolation on our public IPv4 VLAN. Since we have a &lt;code&gt;/23&lt;/code&gt; block, isolation is a kind of feature that's really useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But we don't have switches capable of PVLAN. To circumvent the issue and avoid wasting public IPv4 addresses with /30 links, I've come across a solution looking through the web that involves setting up a port on a given switch to be the &quot;uplink port&quot; with some untagged VLANs, and just a single VLAN on the access ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Port 24: VLAN 100,101,102,103,104 =&amp;gt; Untagged&#xA;Port 01: VLAN 101                 =&amp;gt; Untagged&#xA;Port 02: VLAN 102                 =&amp;gt; Untagged&#xA;Port 03: VLAN 103                 =&amp;gt; Untagged&#xA;Port 04: VLAN 104                 =&amp;gt; Untagged&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally the question: will this really work as expected? If yes how can I cascade switches using this approach?&lt;/p&gt;&#xA;" OwnerUserId="10528" LastEditorUserId="33" LastEditDate="2015-12-23T02:11:56.453" LastActivityDate="2015-12-23T02:11:56.453" Title="How to achieve Private VLAN (PVLAN) isolation without PVLAN support on switches" Tags="|vlan|private-vlan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25395" PostTypeId="2" ParentId="25392" CreationDate="2015-12-23T01:18:33.827" Score="3" Body="&lt;p&gt;The short answer is no - PVLAN functionality is there for a reason - it changes the way the default flooding and learning mechanisms work to ensure that hosts in a VLAN don't see each other, while being able to see their gateway devices and other &quot;public&quot; resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, you could re-create something functionally equivalent using a lot of ACLs either on the switch (at either L2 or L3 depending on hardware capabilities), or on the hosts themselves (L3) to restrict traffic flow between all public hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your requirements/ruleset, this could either be really simple (bar traffic to any other hosts on the same subnet except the gateway), or very tedious (some inter-host traffic allowed, but different for each host).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you go down this path, look into some automation tooling (Ansible etc.) to make this easier.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2015-12-23T01:18:33.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25397" PostTypeId="1" CreationDate="2015-12-23T04:14:47.417" Score="2" ViewCount="8786" Body="&lt;p&gt;How can I connect one VLAN to two different routers ports? Should I do it, or will be better if I connect switches with each other and then connect one of them into router?&lt;/p&gt;&#xA;" OwnerUserId="21539" LastEditorUserId="8499" LastEditDate="2015-12-23T05:03:48.207" LastActivityDate="2016-05-22T19:47:22.017" Title="Can I connect one VLAN to two different routers ports?" Tags="|routing|switch|vlan|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25398" PostTypeId="2" ParentId="25397" CreationDate="2015-12-23T04:30:40.803" Score="0" Body="&lt;p&gt;Switches are designed to switch within VLANs, and routers route between networks (VLANs). Cisco routers can bridge, but that is an expensive way to switch. You didn't say what router model, so I can't be specific on how to do it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-23T04:30:40.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25401" PostTypeId="2" ParentId="25262" CreationDate="2015-12-23T12:04:12.610" Score="-2" Body="&lt;p&gt;Look at this little example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;int tunnel 0&#xA;tunnel source fa0/0&#xA;tunnel mode gre multipoint&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19511" LastActivityDate="2015-12-23T12:04:12.610" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="25403" PostTypeId="1" CreationDate="2015-12-23T12:35:33.673" Score="2" ViewCount="307" Body="&lt;p&gt;So basically ive been configuring a ton of site-to-site VPN's previously, but i have never got the theory behind it 100% straight..&#xA;Youtube is filled with videos on how to configure a site-to-site connection, that is obviously no issue but i'm looking for a video or text that describes the different phases and possibilities.. Like what is Phase 1 and Phase 2, and what kind of encryptions and algorithm are available and why exactly do we prefer to use one over another?&#xA;All the configuration videoes out there basically just tells you to use this and this because its the best, it never compares the different possibilites and goes further in depth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know a video or tutorial on this without having to read or view additional 3 hours footage of stuff i already know before getting to the point?&lt;/p&gt;&#xA;" OwnerUserId="21549" LastActivityDate="2015-12-23T13:14:12.920" Title="Site to Site VPN Theory" Tags="|cisco-asa|vpn|cisco-ios|" AnswerCount="1" CommentCount="3" ClosedDate="2015-12-24T13:58:52.870" ContentLicense="CC BY-SA 3.0" />
  <row Id="25404" PostTypeId="2" ParentId="25403" CreationDate="2015-12-23T13:14:12.920" Score="0" Body="&lt;p&gt;The sample chapter on &quot;VPNs and VPN Technology&quot; from the Cisco Press book &quot;Cisco Secure Virtual Private Networks&quot; is a pretty good summary of IPSec VPNs and how all the bits and pieces fit together. You can find it here: &lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=24833&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscopress.com/articles/article.asp?p=24833&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2015-12-23T13:14:12.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25405" PostTypeId="1" AcceptedAnswerId="25408" CreationDate="2015-12-23T16:38:09.907" Score="1" ViewCount="125" Body="&lt;p&gt;I am looking to have multiple Ubuntu server machines with 3 network cards each, and I am looking into bonding the connections for an increased throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I require a switch which supports some sort of standard when setting the network cards to bind with mode 0 (round robin)? Various sites suggest that the router has to support LACP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, do the network cards need to have the same speed?&lt;/p&gt;&#xA;" OwnerUserId="21551" LastEditorUserId="8499" LastEditDate="2015-12-23T18:34:12.447" LastActivityDate="2016-02-21T23:00:09.260" Title="Do I need a special switch when using Ubuntu bonding in mode 1?" Tags="|switch|ieee-802.1ax|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25408" PostTypeId="2" ParentId="25405" CreationDate="2015-12-23T18:29:21.827" Score="1" Body="&lt;p&gt;It's not the router which needs to support LACP, it the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your network interface cards need to connect at the same speed or you won't be able to channel all of them. This shouldn't be a problem since most NICs today run at 10/100/1000 and will autodetect the connection speed. All your NICs from a single server need to connect to the same switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understand that bonding the interfaces will not increase throughput for a single traffic flow. A traffic flow will only use one interface. The increased throughput comes when you have multiple traffic flows since each interface will handle a subset of all the flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Channel bonding really works best if you have a power of two (2, 4, 8) interfaces in the channel. Other numbers of interfaces mess with the algorithm used to select which interface will get which flow, resulting in sub-optimal flow balancing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-23T19:28:52.190" LastActivityDate="2015-12-23T19:28:52.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25409" PostTypeId="2" ParentId="5954" CreationDate="2015-12-23T18:48:23.437" Score="0" Body="&lt;p&gt;As others have noted, there is a free, open source solution called &lt;em&gt;Avahi&lt;/em&gt; (&lt;a href=&quot;http://www.avahi.org&quot; rel=&quot;nofollow&quot;&gt;http://www.avahi.org&lt;/a&gt;) that can work as a mDNS/Bonjour proxy.  The machine this software runs on must have network interfaces to each VLAN/subnet you would like mDNS services to be advertised to/from.  For the actual services to work, however, you must have inter VLAN routing enabled or allow TCP/UDP connections to the mDNS enabled device in your access lists or firewall.  Other options include Cisco or Ubiquiti wifi controllers which can also serve as mDNS proxies, or if using a Mac you can create a proxy for each service (&lt;a href=&quot;https://kb.acronis.com/sites/default/files/content/2013/01/39490/wanbonjour_1.pdf&quot; rel=&quot;nofollow&quot;&gt;https://kb.acronis.com/sites/default/files/content/2013/01/39490/wanbonjour_1.pdf&lt;/a&gt;).  The problem with this last solution is you have to create a proxy for each individual service, and you have to redo it every time the machine reboots.&lt;/p&gt;&#xA;" OwnerUserId="21553" LastActivityDate="2015-12-23T18:48:23.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25411" PostTypeId="1" CreationDate="2015-12-23T22:35:06.193" Score="2" ViewCount="590" Body="&lt;p&gt;I am trying to create a network with the following features in AWS:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A private subnet with one EC2 instance, called 'Traffic Source'&lt;/li&gt;&#xA;&lt;li&gt;All HTTP(S) traffic from the Traffic Source subnet destined for 0.0.0.0/0 is routed to an AWS Elastic Load Balancer&lt;/li&gt;&#xA;&lt;li&gt;The AWS Elastic Load Balancer routes traffic to an Auto-scaling group&lt;/li&gt;&#xA;&lt;li&gt;The Auto-scaling Group has a standard NAT Machine Image as its Launch Profile&lt;/li&gt;&#xA;&lt;li&gt;All HTTP(S) originating from the Auto-scaling Group, destined for 0.0.0.0/0 is routed to an Internet Gateway&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm having trouble with configuring the route for Step 2, above: routing 0.0.0.0/0 traffic from the Traffic Source to the Load Balancer. Route Tables in AWS, as far as I know, only take a single IP address in CIDR format or a resource ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AWS Elastic Load Balancers of course have &lt;em&gt;several&lt;/em&gt; IP addresses, a canonical DNS name and no resource ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I route traffic from a private subnet in AWS VPC to an internal AWS Elastic Load Balancer using the Route Tables feature in AWS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to internal constraints at my organization, the new NAT Gateway product at AWS is not an option I can use.&lt;/p&gt;&#xA;" OwnerUserId="13584" LastEditorUserId="13584" LastEditDate="2015-12-24T01:00:17.163" LastActivityDate="2016-02-22T03:04:20.787" Title="Routing traffic to a load-balanced, autoscaling NAT layer on AWS" Tags="|router|nat|load-balancer|automation|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ClosedDate="2017-08-12T23:52:04.410" ContentLicense="CC BY-SA 3.0" />
  <row Id="25412" PostTypeId="2" ParentId="25411" CreationDate="2015-12-23T23:01:12.490" Score="1" Body="&lt;p&gt;If you are unable to use NAT Gateway because it isn't supported by Cloud Formation yet, try a combination of custom Cloud Formation resource types and AWS lambda functions--which then use the JavaScript AWS API to create, read, update and delete NAT Gateway settings.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create Custom Resource Types in your Cloud Formation templates&lt;/li&gt;&#xA;&lt;li&gt;Your Custom Resource Types will call AWS Lambda Functions, which you write&lt;/li&gt;&#xA;&lt;li&gt;Use the AWS API in your AWS Lambda Functions to create, read, update and delete NAT Gateway resources&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For more detailed examples on how to do this, see the page linked &lt;a href=&quot;http://www.spacevatican.org/2015/12/20/cloudformation-nat-gateway/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13584" LastActivityDate="2015-12-23T23:01:12.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25413" PostTypeId="1" CreationDate="2015-12-24T02:36:51.797" Score="1" ViewCount="65" Body="&lt;p&gt;I have just started up my own business in developing networks for small companies and I have my first gig. The gig will be in a small church and it only has one computer but he wants to expand and integrate media cameras inside of the church and he also has 2 other churches that he may consider doing the same thing. My question is, what would be some ideas in expanding this church's network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking of building a Remote server to connect the churches data together and for the media cameras to store its data. I was also considering putting a BYOD server in there as well. What are your thoughts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS I am also partnered with cisco is there any products that you may suggest? &lt;/p&gt;&#xA;" OwnerUserId="21557" LastActivityDate="2015-12-24T13:44:04.007" Title="Small church organization" Tags="|cisco|route-server|cisco-small-business|byod|" AnswerCount="1" CommentCount="2" ClosedDate="2015-12-24T17:42:24.887" ContentLicense="CC BY-SA 3.0" />
  <row Id="25415" PostTypeId="2" ParentId="25413" CreationDate="2015-12-24T05:56:19.137" Score="0" Body="&lt;p&gt;I think it would depend on what they will do with the media from the cameras. Are they using them as security? Or for filming sermons? If it's the second, they'll likely want them on a website for people to view or on DVDs to give out. So, if it is only one church I would say you don't need a remote server, but possibly if it's multiple locations wanting to put the media in one spot to upload to a website or burn to DVDs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For their network, do they want guest to have WiFi? Most basic small business WiFi routers have built in guest WiFi options as well, which I would imagine the church would want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More info into what they want will help narrow down a design.&lt;/p&gt;&#xA;" OwnerUserId="21558" LastEditorUserId="21558" LastEditDate="2015-12-24T13:44:04.007" LastActivityDate="2015-12-24T13:44:04.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25416" PostTypeId="1" AcceptedAnswerId="25418" CreationDate="2015-12-24T10:32:39.383" Score="0" ViewCount="69" Body="&lt;p&gt;i've heard somewhere that my public ip adress is changed every 24h (on midnight) by my router. At least when I make a hard reset of that router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;=&gt; But how does that relate to e.g. the long-term banning system on IRC chats which is maintained even months, i think? They rely on user indentification by IP adresses, because the username can be changed easily.&lt;/p&gt;&#xA;" OwnerUserId="21564" LastEditorUserId="21564" LastEditDate="2015-12-24T10:37:46.153" LastActivityDate="2015-12-24T11:46:03.327" Title="when exactly does a non static public ip adress change?" Tags="|router|dhcp|ip|" AnswerCount="2" CommentCount="2" ClosedDate="2015-12-24T13:57:31.220" ContentLicense="CC BY-SA 3.0" />
  <row Id="25417" PostTypeId="2" ParentId="25416" CreationDate="2015-12-24T10:51:08.627" Score="0" Body="&lt;p&gt;Depends largely on who's handing it out and what settings they've got. I'll use my home address as an example. For my previous ISP, my devices were left on 24/7, and I had the same address for around 2 years (even followed me across a house move, which I wasn't expecting).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current one, on the other hand, seems to reset it around every month (makes all my services stutter until they find themselves again).&lt;/p&gt;&#xA;" OwnerUserId="20228" LastActivityDate="2015-12-24T10:51:08.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25418" PostTypeId="2" ParentId="25416" CreationDate="2015-12-24T11:46:03.327" Score="3" Body="&lt;p&gt;As Jozef Woods pointed out, it is up to your ISP when your dynamic IP adress might change. With all the ISPs that I've encountered, the IP adress has remained the same until i've chosen to change it either by turning of my modem/router and keep it of for a while or changed the mac adress/interface identifier facing the ISP(making the ISP believe it is a different device). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to your question regarding ip bans. They are a bit useless when it comes to clients with dynamic IPs. As you pointed out, a nickname can easily be changed if it would be banned and the same goes for IPs if you're on a dynamic range. But in lack of better alternatives IP bans are pretty easy to implement and somewhat effective because some users are on static IPs and others don't know how to change IP and hence keep the same banned IP unless the ISP has an automatic forced renewal of the IP adresses.&lt;/p&gt;&#xA;" OwnerUserId="14973" LastActivityDate="2015-12-24T11:46:03.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25419" PostTypeId="1" AcceptedAnswerId="25420" CreationDate="2015-12-24T16:51:31.223" Score="1" ViewCount="100" Body="&lt;p&gt;In a small office where I set up the network, we recently started to experience WAN problems on the (V)DSL line. Specifically, up to three times per day the upload link breaks down to almost zero resulting in problems with any activities needing upload bandwith (e.g. sending email attachments). A simple reboot of the DSL modem suffices to solve the problem, the upload link immediately comes back again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The telco technician came to check the connections and stated that there are quality issues with the house connection line. Literally, he said something about 1200 FEC and 300 CRC errors in 10 minutes of measuring (not that these numbers would mean much to me). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internet provider will send me a replacement for the modem just to rule it out as an error source. I think that's prudent, after all we did not have any connection issues in more than 10 years. On the other hand, the modem we have is only two years old and also never showed any problems until two weeks ago when this started. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to my actual question: about 4 weeks ago, i.e. 2 weeks before we started experiencing the described issues, I replaced the Firewall that does the pppoe dialing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering that a reboot of the DSL modem (router in bridge mode) solves the issue each time, &lt;strong&gt;is it theoretically possible that the Firewall behind the modem is somehow responsible for the break down of the upload link?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="20652" LastEditorUserId="8499" LastEditDate="2019-01-03T02:02:08.483" LastActivityDate="2019-01-03T02:02:08.483" Title="DSL upload link breaks down. Where to look and not to look?" Tags="|firewall|layer1|cable|pppoe|adsl|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25420" PostTypeId="2" ParentId="25419" CreationDate="2015-12-24T16:56:11.597" Score="1" Body="&lt;p&gt;It is highly unlikely that the firewall is to blame. The most likely cause is the wiring as the technician explained. You should hire a cable installer to replace or repair the bad wiring, test, give you the test results, and guarantee his work.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-24T16:56:11.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25421" PostTypeId="1" AcceptedAnswerId="25424" CreationDate="2015-12-24T17:31:15.833" Score="3" ViewCount="12891" Body="&lt;p&gt;I keep noticing that web pages I have open are exchanging messages with third party servers without my permission.  This is somewhat annoying, and I would like to find out which pages they are so I can close them.  I copied an IP address - 72.21.91.121 - from the TCPdump output, and Googled &quot;reverse dns lookup 72.21.91.121&quot; to see if I could find a hostname that would give me a clue as to the URL of the page and indicate which tab I should close (I tend to have like 20 to 50 tabs open at a time because I can't close anything).  I got the website lookip.net, which told me that there was no reverse DNS lookup found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I would like to know what is the reason for this.  Is this a bad lookup service?  Would I have better luck using a different one?  Or does this host just not have a hostname associated with it (that doesn't make sense; I thought all hosts had hostnames associated with them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that if this is a third party server, the hostname wouldn't be the same as the site that's sending the packets, but it would at least be a good starting point.  I'm not very good at this, but it's something I could get better at as I learn more about how this stuff works.  Right now I'm just a novice at this networking stuff.  All I have to work with is a basic understanding of networking principles and TCP/IP.  I would like to learn more.  A lot more.&lt;/p&gt;&#xA;" OwnerUserId="20762" LastActivityDate="2020-09-05T21:05:48.810" Title="Why can't I do a reverse DNS lookup on this IP address?" Tags="|dns|" AnswerCount="3" CommentCount="0" ClosedDate="2019-02-12T05:09:00.553" ContentLicense="CC BY-SA 3.0" />
  <row Id="25423" PostTypeId="2" ParentId="25421" CreationDate="2015-12-24T19:45:12.253" Score="1" Body="&lt;p&gt;Not all hosts have DNS names in a public DNS server. DNS name are just to make it easier for humans, and they are not really required for networking. If this is happening when you open web pages, it is likely that these are ad servers or something similar.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-24T19:45:12.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25424" PostTypeId="2" ParentId="25421" CreationDate="2015-12-24T20:36:37.247" Score="8" Body="&lt;p&gt;Short answer: There is not requirement that IP addresses provide a reverse lookup, so there are many IP addresses that do not have any reverse DNS lookup zone associated with them.&lt;/p&gt;&#xA;&lt;p&gt;Long answer: DNS was really designed to do look ups from a human readable name to an IP address. When you do normal DNS query, say for &lt;code&gt;www.example.com&lt;/code&gt;&amp;quot;, the DNS query is actually a series of queries from least specific to most specific asking &amp;quot;what is the IP address of host www in domain &lt;code&gt;example.com&lt;/code&gt;?&amp;quot; It may look a bit like this (simplistic):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The root servers are asked for information about &lt;code&gt;com&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The &amp;quot;com&amp;quot; servers are asked for information about &lt;code&gt;example&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The &amp;quot;example&amp;quot; servers are asked for information about &lt;code&gt;www&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;You get a response of &lt;code&gt;192.0.2.4&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;However, this won't work well when you do a DNS query for an IP address, such as &lt;code&gt;192.0.2.4 &lt;/code&gt;mainly because unlike a host/domain/URL, the most specific information point is at the end. So DNS changes things a bit and asks &amp;quot;what is the server and domain of host &lt;code&gt;4&lt;/code&gt; in &lt;code&gt;2.0.192.IN-ADDR-ARPA&lt;/code&gt;?&amp;quot; which may look more like this (simplistic):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;code&gt;IN-ADDR-ARPA&lt;/code&gt; servers are asked for information about &lt;code&gt;192.0.2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;The &lt;code&gt;192.0.2&lt;/code&gt; servers are asked for information about &lt;code&gt;4&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;You get a response of &lt;code&gt;www.example.com&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Take note, that while one server may contain the information for both the &lt;code&gt;example.com&lt;/code&gt; zone and the &lt;code&gt;2.0.192.IN-ADDR-ARPA&lt;/code&gt; zones, they could also be two different servers.&lt;/p&gt;&#xA;&lt;p&gt;Further, it is often the case that the servers are run by two different companies. For instance, if you pay CompanyX to host your website on their server, you may control the DNS zone for your domain pointing to the IP address of CompanyX's serve (which may be hosting many different domains from different clients) but CompanyX controls the zone for the reverse lookup of the IP address. Their reverse lookup for that IP address would likely reflect a server/domain of CompanyX's.&lt;/p&gt;&#xA;&lt;p&gt;Even when an entity is entitled to control both the forward and reverse zones, they are not required to provide DNS services for either. You are perfectly within your rights to register a domain name and not provide any DNS service for it.&lt;/p&gt;&#xA;&lt;p&gt;The end result is that this means that even if you do get a response to a reverse lookup, it may have no relation to the domain name of the service you are accessing. You may be accessing &lt;code&gt;www.example.com&lt;/code&gt; but the reverse lookup of that IP address may give you &lt;code&gt;server37.companyx.example&lt;/code&gt; or something else entirely.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33968" LastEditDate="2020-09-05T21:05:48.810" LastActivityDate="2020-09-05T21:05:48.810" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25425" PostTypeId="1" AcceptedAnswerId="25426" CreationDate="2015-12-24T21:15:29.360" Score="3" ViewCount="198" Body="&lt;p&gt;I was reading &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7106/how-do-you-calculate-the-prefix-network-subnet-and-host-numbers/7117#7117&quot;&gt;How do you calculate the prefix, network, subnet, and host numbers?&lt;/a&gt;, and I noticed that he divided the network space into 4 subnetworks of 256 addresses, but he needed only 100 per subnet. If you have for example three contiguous static IP addresses, that means that you cannot separate them into different subnetworks considering also the broadcast and subnetwork IP addressess, right? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;128.42.5.4/30&#xA;128.42.5.5/30&#xA;128.42.5.6/30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21337" LastEditorUserId="8499" LastEditDate="2018-03-09T20:31:07.670" LastActivityDate="2018-03-09T20:31:07.670" Title="Can I always separate two IP addressess into two subnetworks?" Tags="|ipv4|ip|subnet|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25426" PostTypeId="2" ParentId="25425" CreationDate="2015-12-24T21:22:41.580" Score="5" Body="&lt;p&gt;That depends. If you are looking for something like loopback addresses, you could have three &lt;code&gt;/32&lt;/code&gt; subnets. With point-to-point links, you could use &lt;code&gt;/31&lt;/code&gt; which is two addresses in the subnet. A &lt;code&gt;/30&lt;/code&gt; subnet also gives you two usable addresses, but you lose the subnet and broadcast from the four addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each one less in the CIDR notation gives you twice as many addresses in the host portion of the address. Except for &lt;code&gt;/31&lt;/code&gt; and &lt;code&gt;/32&lt;/code&gt;, you lose two addresses from the number of addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your edit to use &lt;code&gt;/30&lt;/code&gt;, all three of the addresses you list, and &lt;code&gt;128.42.5.7/30&lt;/code&gt;, are in the subnet &lt;code&gt;128.42.5.4/30&lt;/code&gt;. The subnet address, &lt;code&gt;128.42.5.4/30&lt;/code&gt;, and the broadcast address, &lt;code&gt;128.42.5.7/30&lt;/code&gt;, are not usable for host addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-24T22:04:15.963" LastActivityDate="2015-12-24T22:04:15.963" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25427" PostTypeId="2" ParentId="25425" CreationDate="2015-12-24T22:35:31.897" Score="3" Body="&lt;p&gt;If it's a Private Network, it's better to have proper subnets with network address, Gateway and Broadcast address. Makes the network easier to troubleshoot &lt;/p&gt;&#xA;" OwnerUserId="21571" LastActivityDate="2015-12-24T22:35:31.897" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25428" PostTypeId="2" ParentId="25421" CreationDate="2015-12-24T22:39:26.770" Score="-4" Body="&lt;p&gt;Some Domain names pay extra for privacy and Security. &lt;/p&gt;&#xA;" OwnerUserId="21571" LastActivityDate="2015-12-24T22:39:26.770" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25429" PostTypeId="1" AcceptedAnswerId="25430" CreationDate="2015-12-24T22:43:54.783" Score="1" ViewCount="3194" Body="&lt;p&gt;I'm new to the networking world, and I'm trying to make a simple example yet I can't seem to get it to work.&#xA;What I'm trying is just to make 2 routers situated in different areas to communicate (ping) using another router in the middle (as an ABR).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fYtn1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fYtn1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;router 0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial2/0&#xA; ip address 20.1.1.2 255.255.255.252&#xA;&#xA;router ospf 1&#xA; network 20.1.1.0 0.0.0.3 area 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;router 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial2/0&#xA; ip address 20.1.1.1 255.255.255.252&#xA;&#xA;&#xA;interface Serial3/0&#xA; ip address 20.1.2.1 255.255.255.252&#xA;&#xA;&#xA;router ospf 1&#xA; network 20.1.1.0 0.0.0.3 area 1&#xA; network 20.1.2.0 0.0.0.3 area 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;router 2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial3/0&#xA; ip address 20.1.2.2 255.255.255.252&#xA;&#xA;router ospf 1&#xA; network 20.1.2.0 0.0.0.3 area 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong here?&lt;/p&gt;&#xA;" OwnerUserId="14341" LastEditorUserId="8499" LastEditDate="2018-12-22T21:04:29.243" LastActivityDate="2018-12-22T21:04:29.243" Title="OSPF cannot communicate inter-area" Tags="|cisco|routing|router|ospf|packet-tracer|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25430" PostTypeId="2" ParentId="25429" CreationDate="2015-12-24T22:50:04.453" Score="4" Body="&lt;p&gt;You don't have an Area 0. Areas can only talk to Area 0. This is an OSPF basic feature which helps prevent routing loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 1 needs to be in Area 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial2/0&#xA; ip address 20.1.1.2 255.255.255.252&#xA;!&#xA;router ospf 1&#xA; network 20.1.1.0 0.0.0.3 area 1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 20.0.0.1 255.255.255.255&#xA;!&#xA;interface Serial2/0&#xA; ip address 20.1.1.1 255.255.255.252&#xA;!&#xA;interface Serial3/0&#xA; ip address 20.1.2.1 255.255.255.252&#xA;!&#xA;router ospf 1&#xA; network 20.0.0.1 0.0.0.0 area 0&#xA; network 20.1.1.0 0.0.0.3 area 1&#xA; network 20.1.2.0 0.0.0.3 area 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial3/0&#xA; ip address 20.1.2.2 255.255.255.252&#xA;!&#xA;router ospf 1&#xA; network 20.1.2.0 0.0.0.3 area 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just understand that Area 1 is not exchanging routes with Area 2. Each of those non-0 areas is exchanging routes with Area 0.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-25T01:06:28.257" LastActivityDate="2015-12-25T01:06:28.257" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25433" PostTypeId="2" ParentId="25429" CreationDate="2015-12-25T01:23:27.127" Score="1" Body="&lt;p&gt;You need Area 0, it's a special area that is responsible for exchanging inter-area information. In your case, you can simply fix that by turning one area to Area 0.&lt;/p&gt;&#xA;" OwnerUserId="20657" LastActivityDate="2015-12-25T01:23:27.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25435" PostTypeId="2" ParentId="20896" CreationDate="2015-12-25T07:02:39.057" Score="0" Body="&lt;p&gt;Theoretically &quot;Yes&quot; , including conditions that 'UE' that means mobile phone is capable of receiving 4*4 and radio conditions are favorable. This 300Mbps also consists overhead in form of control signalling and measurement information for UE about 50 Mbps. If more than one users are there in one cell it will distributed among other UEs too . &lt;/p&gt;&#xA;" OwnerUserId="21575" LastActivityDate="2015-12-25T07:02:39.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25439" PostTypeId="1" AcceptedAnswerId="25446" CreationDate="2015-12-25T10:52:05.237" Score="4" ViewCount="66737" Body="&lt;p&gt;As the question says, i need an answer. I cannot find the power button.&lt;/p&gt;&#xA;" OwnerUserId="21577" LastEditorUserId="8499" LastEditDate="2015-12-25T15:03:53.443" LastActivityDate="2021-01-18T05:50:56.657" Title="How do I power on devices in CCNA Packet Tracer?" Tags="|cisco|" AnswerCount="8" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25441" PostTypeId="1" AcceptedAnswerId="25444" CreationDate="2015-12-25T14:46:43.850" Score="0" ViewCount="79" Body="&lt;p&gt;I want to create static routes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router A: IP route 192.168.20.0 255.255.255.0   10.1.1.2&#xA;Router A: IP route 172.13.0.0   255.255.0.0     10.2.2.2&#xA;Router A: IP route 10.3.3.0     255.255.255.252 10.2.2.2&#xA;Router A: IP route 192.168.30.0 255.255.255.0   10.2.2.2&#xA;&#xA;Router B: IP route 172.14.0.0   255.255.0.0     10.2.2.1&#xA;Router B: IP route 192.168.30.0 255.255.255.0   10.3.3.2&#xA;Router B: IP route 10.4.4.0     255.255.255.252 10.3.3.2&#xA;Router B: IP route 192.168.20.0 255.255.255.0   10.3.3.2&#xA;&#xA;Router C: IP route 192.168.30.0 255.255.255.0   10.4.4.2&#xA;Router C: IP route 172.14.0.0   255.255.0.0     10.1.1.1&#xA;Router C: IP route 10.2.2.0     255.255.255.252 10.1.1.1&#xA;Router C: IP route 172.13.0.0   255.255.0.0     10.1.1.1&#xA;&#xA;Router D: IP route 172.13.0.0   255.255.0.0     10.3.3.1&#xA;Router D: IP route 192.168.20.0 255.255.255.0   10.4.4.1&#xA;Router D: IP route 10.1.1.0     255.255.255.252 10.4.4.1&#xA;Router D: IP route 172.14.0.0   255.255.0.0     10.4.4.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gvRcu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gvRcu.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br/&gt;&#xA;I was wondering, what about the 2Mbps Link, should I route it, too?&lt;/p&gt;&#xA;" OwnerUserId="21579" LastEditorUserId="8499" LastEditDate="2015-12-25T17:50:52.390" LastActivityDate="2015-12-25T17:50:52.390" Title="build static route" Tags="|routing|" AnswerCount="2" CommentCount="1" ClosedDate="2015-12-25T17:44:51.723" ContentLicense="CC BY-SA 3.0" />
  <row Id="25444" PostTypeId="2" ParentId="25441" CreationDate="2015-12-25T17:37:54.540" Score="1" Body="&lt;p&gt;The answer depends on what you're trying to do.  If you don't create static routes, the link will not be used.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By using static routes as you have, you have no redundancy in your network even though you have multiple paths to each network.  This would be a good application for a routing protocol.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-25T17:37:54.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25445" PostTypeId="2" ParentId="25441" CreationDate="2015-12-25T17:38:06.897" Score="0" Body="&lt;p&gt;For the 2Mbit link, you might want to create a floating static route. This is a route with a higher administrative distance than your &quot;primary&quot; route to a subnet, so it will only be used in case the primary route in unavailable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you're using static routes, you'll need an AD of 2 or higher for your floating route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, on cisco devices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterC(config)# ip route 172.13.0.0 255.255.0.0 10.5.5.1 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20964" LastActivityDate="2015-12-25T17:38:06.897" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25446" PostTypeId="2" ParentId="25439" CreationDate="2015-12-25T18:12:09.477" Score="5" Body="&lt;p&gt;When you double click on a device in Packet Tracer, there is a section for the physical parts of the device (I believe the far right tab, but I can't be sure I'm not close to my computer with Packet Tracer). Here you can change and add drives, interfaces by drag and drop. On that same page there is also the power switch.&lt;/p&gt;&#xA;" OwnerUserId="21558" LastEditorUserId="42205" LastEditDate="2017-12-16T17:16:39.837" LastActivityDate="2017-12-16T17:16:39.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25451" PostTypeId="1" AcceptedAnswerId="25452" CreationDate="2015-12-26T02:08:54.750" Score="1" ViewCount="2072" Body="&lt;p&gt;Im trying to connect 2 AS (each using a separate OSPF) with BGP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/abfkE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/abfkE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i tried so far is:&#xA;Router TTCore4: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA;neighbor 10.0.0.34 remote-as 200&#xA;network 172.16.1.0 mask 255.255.255.0 &#xA;&#xA;router ospf 1&#xA;redistribute bgp 100 metric 1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;router TelefonicaCore1: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA;neighbor 10.0.0.33 remote-as 100&#xA;network 172.16.5.128 mask 255.255.255.192 &#xA;&#xA;router ospf 1&#xA;redistribute bgp 100 metric 1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and for the end routers (bizerte and berlin) i set a last resort to: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;for bizerte: ip route 0.0.0.0 0.0.0.0 10.0.0.106 &amp;lt;= TTCore4 interface s1/1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for berlin: ip route 0.0.0.0 0.0.0.0 10.0.0.084 &amp;lt;= TelefonicaCore1 s1/0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever i try to ping from Bizerte to Berlin, i get the &quot;UUUUU&quot; from the ping  (unreachable) &#xA;So how can this be done? do i have to redistribute opsf inside bgp? that would give me huge routing table? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: the ospf is working and the bizerte router can ping the TTCore4 router, and same thing for the berlin router.&lt;/p&gt;&#xA;" OwnerUserId="14341" LastEditorUserId="8499" LastEditDate="2019-01-04T23:25:42.210" LastActivityDate="2019-01-04T23:25:42.210" Title="Distribute eBGP to OSPF" Tags="|cisco|routing|bgp|ospf|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25452" PostTypeId="2" ParentId="25451" CreationDate="2015-12-26T02:38:44.107" Score="2" Body="&lt;p&gt;If you aren't going to use BGP to advertise all your routes for an AS, then why use BGP at all? BGP tables usually &lt;em&gt;are&lt;/em&gt; quite large.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have a problem with your default routes because you are setting the next hop to an address which is clearly &lt;em&gt;not&lt;/em&gt; the next hop. If you want, for example, the default route (for unknown IPv4 addresses) to go out to AS200, you should put the default route on TTCore4, pointing to AS200, and use the &lt;code&gt;default-information originate&lt;/code&gt; command on TTCore4 in OSPF. The same thing could be done in AS200. This would eliminate using BGP between those ASes in favor of static default routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you redistribute OSPF into BGP, or you use static routes (specific, aggregate, or default), TTCore4 has no more idea how to reach Berlin than Bizerte does.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-26T02:38:44.107" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="25453" PostTypeId="2" ParentId="25355" CreationDate="2015-12-26T03:00:22.677" Score="0" Body="&lt;p&gt;So it's a common issue with Fiber, especially between switches. What it sounds like you need to do is what I've heard referred to as, &quot;roll the fiber&quot;. Basically on one end of the Fiber cable, swap them around. Think of cross over cable regarding copper/Ethernet. &lt;/p&gt;&#xA;" OwnerUserId="881" LastActivityDate="2015-12-26T03:00:22.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25461" PostTypeId="2" ParentId="25355" CreationDate="2015-12-26T17:52:11.237" Score="0" Body="&lt;p&gt;Unless you are using VTP (assuming you are not since you have a mixed environment), multiple VLANS won't be propagated automatically across trunk links unless you have specifically manually created each vlan on each switch and allowed it to be propagated on each trunk interface (by default Cisco allows all vlans). I'm assuming you have already done this, but just wanted to mention it. In regards to the native vlan 1 connectivity between each switch, those should by default be carried across your dot1q interfaces. In regards to your ping not working from A to B,do you have any vrf's on switch A? If so you will need to make sure you source from the correct VRF when pinging. If there are spanning tree issues, loops, or native vlan mismatches etc, you'll be able to see evidence and clues of this by turning on terminal monitor from your telnet or ssh session on your Cisco switches. If you are already directly consoled to the Cisco switches you won't need to do this, and you should see live logging messages with any stp errors. You can also do show logging, to see past stp error logs. Ron's advice to have same version of STP on all switches is excellent, and will also help to simplify things removing chance of further possible STP complexities/anomalies.&lt;/p&gt;&#xA;" OwnerUserId="21592" LastActivityDate="2015-12-26T17:52:11.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25465" PostTypeId="2" ParentId="18180" CreationDate="2015-12-26T23:10:21.700" Score="3" Body="&lt;p&gt;First of all you may want to remove the unnecessary spanning-tree configuration on your secondary uplink. STP calculates the cost metric based on the link speed. Your 100Mbit/sec CU uplink has a default cost of 19 and your primary 1Gbit/sec SM Fibre uplink got a cost of 4, so no need to set it manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also remove the &quot;access vlan configuration&quot; since your trunk configuration with native vlan 666 will be preferred. Also change your allowed vlan configuration to match the primary link. I do not know which vlans you actually use, but inconsistency may become a big pain in case your primary link fails.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interface GigabitEthernet2/0/28&#xA; description &quot;downlink trunk BldgB 100M-Backup&quot;&#xA; switchport access vlan 666              -&amp;gt; unnecessary&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 666&#xA; switchport trunk allowed vlan 2-99,101-109,111-4094&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; shutdown&#xA; speed 100&#xA; duplex full&#xA; spanning-tree vlan 99 port-priority 128 -&amp;gt; unnecessary&#xA; spanning-tree vlan 99 cost 50           -&amp;gt; unnecessary&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An interesting counter from Gi1/0/28 (Site A) are the input errors on the interface. Might be a layer 1 issue but since you do not have any crc errors and the realibility is 255/255 it may be due to repluging cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since there are no obvious configuration issues I would recommand re-enabling the port and posting the output of:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site A:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show spanning-tree interface gi1/0/28&#xA;show spanning-tree detail&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Site B: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show spanning-tree interface gi2/0/1&#xA;show spanning-tree detail&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Last but not least could you provide the following information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Which IOS release are you running on the stacks?&lt;/li&gt;&#xA;&lt;li&gt;Does your Service Provider provide transparent L2 services (BPDUs received on  both sides? ... you may check if CDP packets are received on both sites via show cdp neighbors) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-12-26T23:10:21.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25468" PostTypeId="1" CreationDate="2015-12-27T11:01:59.780" Score="0" ViewCount="520" Body="&lt;p&gt;I was pinging one of my workstation and the result of my ping, the ttl is be 64 and the workstation is running windows 8.1?&#xA;Also i cant access to the PC form DNS name?&#xA;I want to know why and how i cant fix it?&#xA;thanks...&lt;/p&gt;&#xA;" OwnerUserId="21601" LastActivityDate="2015-12-27T22:00:34.817" Title="The TTL result from the windows client is wrong" Tags="|ping|" AnswerCount="2" CommentCount="2" ClosedDate="2017-08-12T23:50:39.437" ContentLicense="CC BY-SA 3.0" />
  <row Id="25469" PostTypeId="2" ParentId="25024" CreationDate="2015-12-27T12:21:50.580" Score="1" Body="&lt;p&gt;For layer 1 (Physical) you may compare (if you compare only the radio interface):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Electromagnetic spectrum (radio frequencies)&lt;/li&gt;&#xA;&lt;li&gt;Channel width&lt;/li&gt;&#xA;&lt;li&gt;Spectral efficiency&lt;/li&gt;&#xA;&lt;li&gt;Signal levels&lt;/li&gt;&#xA;&lt;li&gt;Modulation&lt;/li&gt;&#xA;&lt;li&gt;Antennas, feeders, power of transmitters, sensitivity of receivers and other parameters&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And these maybe are on the border between layer 1 and 2 :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;channel coding&lt;/li&gt;&#xA;&lt;li&gt;media access method&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="5576" LastActivityDate="2015-12-27T12:21:50.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25470" PostTypeId="2" ParentId="25029" CreationDate="2015-12-27T12:40:39.363" Score="1" Body="&lt;p&gt;On application layer you can read the IMEI of any Android device as described &lt;a href=&quot;https://stackoverflow.com/questions/1972381/how-to-get-the-devices-imei-esn-programmatically-in-android&quot;&gt;here&lt;/a&gt;. For iOS maybe there is a similar method. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On lower level wireless operators can detect IMEI to use it for TAC/IMEI filtering when applying network features to specific devices or provide it to third parties as described in @LovaNirinaAndrianasolo 's answer.&lt;/p&gt;&#xA;" OwnerUserId="5576" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2015-12-27T12:40:39.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25471" PostTypeId="2" ParentId="25468" CreationDate="2015-12-27T14:38:26.010" Score="1" Body="&lt;p&gt;The TTL field in an IPv4 packet is only decremented when the packet is processed by a router. If both computers are on the same subnet, this is not necessary so the TTL will remain unchanged.&lt;/p&gt;&#xA;" OwnerUserId="20964" LastEditorUserId="20964" LastEditDate="2015-12-27T14:44:15.977" LastActivityDate="2015-12-27T14:44:15.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25473" PostTypeId="1" AcceptedAnswerId="25474" CreationDate="2015-12-27T17:46:43.137" Score="2" ViewCount="390" Body="&lt;p&gt;There are two entries in this table. From my understanding first is used for all outgoing traffic (local address of my modem is 192.168.1.1 ), and part of OS which is responsible for networking just passes packet to modem which send it to ISP etc.&#xA;But, I am not sure what is second entry for. At first I thought that it is used for incoming traffic but destination address seems wrong since local address of host is 192.168.1.3 according to ifconfig&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Kernel IP routing table&#xA;Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface&#xA;0.0.0.0         192.168.1.1     0.0.0.0         UG        0 0          0 eth0&#xA;192.168.1.0     0.0.0.0         255.255.255.0   U         0 0          0 eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ifconfig:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eth0      Link encap:Ethernet  HWaddr xx:xx:xx:xx:xx:xx  &#xA;          inet addr:192.168.1.3  Bcast:192.168.1.255  Mask:255.255.255.0&#xA;          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1&#xA;          RX packets:592510 errors:0 dropped:0 overruns:0 frame:0&#xA;          TX packets:398904 errors:0 dropped:0 overruns:0 carrier:0&#xA;          collisions:0 txqueuelen:1000 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, am I wrong about first entry?&#xA;What is purpose of second one?&lt;/p&gt;&#xA;" OwnerUserId="21604" LastActivityDate="2016-01-09T16:26:48.850" Title="What are entries in kernel IP table?" Tags="|routing|ipv4|ip|linux|" AnswerCount="2" CommentCount="0" ClosedDate="2019-01-13T03:45:13.820" ContentLicense="CC BY-SA 3.0" />
  <row Id="25474" PostTypeId="2" ParentId="25473" CreationDate="2015-12-27T17:53:41.040" Score="2" Body="&lt;p&gt;The first entry with the destination of &lt;code&gt;0.0.0.0&lt;/code&gt; with a mask of &lt;code&gt;0.0.0.0&lt;/code&gt; means that any IPv4 packets which don't match any other entries will be sent to the gateway &lt;code&gt;192.168.1.1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second entry of &lt;code&gt;192.168.1.0&lt;/code&gt; with a mask of &lt;code&gt;255.255.255.0&lt;/code&gt; means that any IPv4 packets withing the range of &lt;code&gt;192.168.1.0/24&lt;/code&gt; will be sent on the same link as this host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, any packets destined for the local network will use ARP (or the ARP cache) to build a frame for the local network. Any other packets will ARP (or use the ARP cache) for the gateway MAC address to build the frame.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-27T17:53:41.040" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25475" PostTypeId="2" ParentId="20998" CreationDate="2015-12-27T19:29:53.057" Score="0" Body="&lt;p&gt;When approaching design issues, I always follow the &lt;a href=&quot;https://en.wikipedia.org/wiki/KISS_principle&quot; rel=&quot;nofollow&quot;&gt;KISS principle&lt;/a&gt; - keep it simple.  I dumb switches are, I assume, layer 2 switches - so call them layer 2 switches.  They get offended when you call them dumb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That diagram shows 2 remote sites, which adds complexity not worded in your post.  It is common for ip telephony devices to be on a unique VLAN, so this is inline with your want for all phones to reach their server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of segregating out the engineering computers, you can certainly do that and you would then have a layer 3 boundary between them and the other computers, ...but why?  Security?  Are you going to enable some network/router based security?  If so, what?  I am hinting at the KISS principle here.  Do you really need to do all that?  A remarkable basic reason to segment a LAN is addressing/DHCP server limitations.  So, how many computers on the LAN?  If not more than 250 or so, you might rethink adding the complexity.  A simple layer 3 boundary is not a significant security measure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-12-27T19:29:53.057" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25477" PostTypeId="2" ParentId="3697" CreationDate="2015-12-27T20:14:58.533" Score="3" Body="&lt;p&gt;It represents the subnet (subnetwork) mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Re-write the IP address as computers read it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.0.0 converts to binary/base2/'bits' as 11000000.10101000.00000000.00000000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) The number of bits (from left to right) that represent the subnet address is specified as 16 ('/16').&lt;/p&gt;&#xA;&#xA;&lt;p&gt;16 bits, or 11000000.10101000 (192.168) is the network address and 0.0, or 00000000.00000000, is the host address - in this case a broadcast address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's referred to a mask because you are telling the computer to ignore that number of bits when calculating the host address, or perhaps that the network wears those number of bits as it's identifier, or mask.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2015-12-27T20:21:30.230" LastActivityDate="2015-12-27T20:21:30.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25478" PostTypeId="2" ParentId="25355" CreationDate="2015-12-27T20:28:48.663" Score="0" Body="&lt;p&gt;If possible, connect/link the switches in a hub and spoke fashion rather than a ring fashion.  Each uplink should be configured as a trunk.  Be sure the trunk type (802.1q probably) is the same on both ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have multiple VLANs, which it sounds like you do, route between them on your core/hub device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP should not really come in to play much in the hub/spoke topology.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-12-27T20:28:48.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25480" PostTypeId="2" ParentId="25473" CreationDate="2015-12-27T21:32:51.393" Score="4" Body="&lt;p&gt;What &lt;code&gt;route -n&lt;/code&gt; (or &lt;code&gt;netstat -rn&lt;/code&gt;) is showing you needs a bit of interpretation - a &quot;gateway&quot; of &lt;code&gt;0.0.0.0&lt;/code&gt; means that the next hop for any packet sent to this subnet is the actual destination host, not a router.  If the &quot;gateway&quot; is not &lt;code&gt;0.0.0.0&lt;/code&gt;, then all packets destined for this subnet will actually be sent to the MAC address of the gateway (which will then handle their next-hop forwarding).  So, in your case, your routing table has a route for the locally attached segment, and then a route for &quot;everything else&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general flow of IP packet forwarding from any host is shown in this flow chart:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cf6B9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cf6B9.png&quot; alt=&quot;Host IP Packet Flow&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general gist of this is that the host (on ethernet or wifi) ultimately is trying to find the MAC address to send this packet to, and the routing table will help it decide (either the MAC of the actual destination host, if it's on the same segment, or the MAC address of the router for this segment).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to your question in another answer about how does your host see an ARP - ARP requests are transmitted using a broadcast destination MAC, which means they will be seen by every host in the same broadcast domain, regardless of whether they are attached to the same bridge or not.  A router will not forward them into another broadcast domain, but a bridge (like your wireless AP in this case) will transmit the ARP across your local network.&lt;/p&gt;&#xA;" OwnerUserId="653" LastActivityDate="2015-12-27T21:32:51.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25481" PostTypeId="2" ParentId="25468" CreationDate="2015-12-27T22:00:34.817" Score="0" Body="&lt;p&gt;Some default ttl values:&#xA;&lt;a href=&quot;http://www.netresec.com/?page=Blog&amp;amp;month=2011-11&amp;amp;post=Passive-OS-Fingerprinting&quot; rel=&quot;nofollow&quot;&gt;http://www.netresec.com/?page=Blog&amp;amp;month=2011-11&amp;amp;post=Passive-OS-Fingerprinting&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each device can pick it's ttl up to 255 when sending a ip packet, the recommendation is 64, allowing for 64 layer 3 hops before a packet is dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To double check the number of hops, use traceroute.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2015-12-27T22:00:34.817" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25482" PostTypeId="1" AcceptedAnswerId="25483" CreationDate="2015-12-28T00:12:34.293" Score="2" ViewCount="1398" Body="&lt;p&gt;I have a router with some inter-vlan connections on, the router is connected to a switch, which is connected to 3 PC's on different vlans and then the switch is connected to another router which is the DHCP server. I cannot seem to get the DHCP requests working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Structure&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1&lt;/code&gt; - &lt;code&gt;Switch&lt;/code&gt;: &lt;code&gt;3 PC's&lt;/code&gt; (PC1: VLAN30, PC2: VLAN40, PC3: VLAN50), &lt;code&gt;R2 - DHCP Router&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1 Commands&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1.30&#xA;encapsulation dot1Q 30&#xA;ip address 172.16.30.1 255.255.255.224&#xA;&#xA;interface GigaEth0/1.40&#xA;encap dot1Q 40&#xA;ip add 172.16.40.1 255.255.255.224&#xA;&#xA;int GigaEth0/1.50&#xA;encap dot1Q 50&#xA;ip add 172.16.50.1 255.255.255.224&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch commands&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC 1 - switchport access vlan 30&#xA;PC 2 - switchport access vlan 40&#xA;PC 3 - switchport access vlan 50&#xA;Link back to R1 - trunk link&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DHCP Router&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address 172.16.30.1&#xA;ip dhcp excluded-address 172.16.40.1&#xA;ip dhcp excluded-address 172.16.50.1&#xA;&#xA;ip dhcp pool forVLAN30&#xA;network 172.16.30.0 255.255.255.224&#xA;default-router 172.16.30.1&#xA;ip dhcp pool forVLAN40&#xA;network 172.16.40.0 255.255.255.224&#xA;default-router 172.16.40.1&#xA;ip dhcp pool forVLAN50&#xA;network 172.16.50.0 255.255.255.224&#xA;default-router 172.16.50.1&#xA;- link back to switch - &#xA;ip address 172.16.50.2 255.255.255.224&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For some reason the VLAN50 PC can get the DHCP request and IP but all others fail, I have tried adding &lt;code&gt;helper-addresses&lt;/code&gt; to see if that helps but they end up at the DHCP router and then just give up.&lt;/p&gt;&#xA;" OwnerUserId="15592" LastEditorUserId="8499" LastEditDate="2015-12-28T00:52:48.897" LastActivityDate="2015-12-28T01:11:35.837" Title="DHCP requests not working with inter-vlan - simulation -" Tags="|cisco|vlan|ipv4|dhcp|packet-tracer|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25483" PostTypeId="2" ParentId="25482" CreationDate="2015-12-28T00:47:29.273" Score="1" Body="&lt;p&gt;DHCP requests are sent from the hosts to the DHCP server via broadcast, and broadcasts don't normally cross a layer-3 boundary (router). You can either directly connect the DHCP server to each layer-2 domain, or you can use helper addresses. One way to achieve this is to use a trunk link from the switch to the DHCP router (replace interfaces as needed for the link):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 30 - 50&#xA; switchport mode trunk&#xA; switchport mode nonegotiate&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DHCP Router:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1.30&#xA; encapsulation dot1Q 30&#xA; ip address 172.16.30.2 255.255.255.224&#xA; no shutdown&#xA;!&#xA;interface GigabitEthernet0/1.40&#xA; encapsulation dot1Q 40&#xA; ip address 172.16.40.2 255.255.255.224&#xA; no shutdown&#xA;!&#xA;interface GigabitEthernet0/1.50&#xA; encapsulation dot1Q 50&#xA; ip address 172.16.50.2 255.255.255.224&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another way is to put helper addresses on the R1 interfaces:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1.30&#xA; encapsulation dot1Q 30&#xA; ip address 172.16.30.1 255.255.255.224&#xA; ip helper-address 172.16.50.2&#xA;!&#xA;interface GigabitEthernet0/1.40&#xA; encapsulation dot1Q 40&#xA; ip address 172.16.40.1 255.255.255.224&#xA; ip helper-address 172.16.50.2&#xA;!&#xA;interface GigabitEthernet0/1.50&#xA; encapsulation dot1Q 50&#xA; ip addres 172.16.50.1 255.255.255.224&#xA;! Helper is not needed since the broadcast need not be routed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-28T00:47:29.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25484" PostTypeId="2" ParentId="25482" CreationDate="2015-12-28T01:11:35.837" Score="0" Body="&lt;p&gt;Thank you to @RonMaupin for his help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a bit of trying everything, I realised that while I had set the switch to R1 as a trunk link, I had not set the switch to R2 - DHCP Router as a trunk link, so it was set as an access port and only allowed VLAN50 through, hence why 30,40 could not connect. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you are having a similar problem to me, check if your helper-addresses are sorted, that could have been the problem from the start, and also check your trunk links.&lt;/p&gt;&#xA;" OwnerUserId="15592" LastActivityDate="2015-12-28T01:11:35.837" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25485" PostTypeId="2" ParentId="24734" CreationDate="2015-12-28T02:47:25.677" Score="2" Body="&lt;p&gt;Troubleshooting is required.  First identify the culprit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turn off VRRP (or simply power off one of those routers).  Does that fix it?  If so look at the VRRP config.  Otherwise, power off a VSS switch.  Does that fix it?  Start by identifying the problem...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure if you are talking FEX's here but ideally those are NOT dual homed (as in your diagram), provided that your servers are.  The proper way to do it is shown below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/W2liB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/W2liB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2015-12-28T02:47:25.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25486" PostTypeId="1" CreationDate="2015-12-28T04:55:24.970" Score="1" ViewCount="68" Body="&lt;p&gt;There are 2 router let it be X and Y. For X I have registered on ddns and got a hostname for the router and applied that for remote management. In Y router I have applied the fixed public IP of router X as a DNS server. When I am getting connected to router Y I am able to download(though at a very low speed) but web pages are not opeaning.&lt;/p&gt;&#xA;" OwnerUserId="21613" LastActivityDate="2015-12-28T13:29:01.690" Title="Applying IP of a router in another router as a DNS server" Tags="|routing|dns|" AnswerCount="1" CommentCount="3" ClosedDate="2015-12-28T18:17:59.533" ContentLicense="CC BY-SA 3.0" />
  <row Id="25487" PostTypeId="1" AcceptedAnswerId="25492" CreationDate="2015-12-28T05:17:48.137" Score="3" ViewCount="506" Body="&lt;p&gt;I found out our DMZ zone is not as secure as it should be. &#xA;We use NAT to translate internet services from DMZ to internet.&#xA;We have some developers out of organization. Some of them connect via client-to-client tunnel to specific server. But for some we open ssh/rdp ports on translated addresses. &#xA;The point is: when developer connects to his specific server, he has access to all other servers in DMZ zone. &lt;a href=&quot;https://i.stack.imgur.com/8eqWP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8eqWP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;So being in one subnet with other servers, he has network access to all other servers. This is very insecure practice. I see here 3 solutions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create iptables/firewall template and apply it locally on each server in DMZ zone. The problem here: it makes much manual work. Developer has root/administrator access so he can disable firewall on his server. To prevent it we should configure separate permissions, which makes more manual work. &lt;/li&gt;&#xA;&lt;li&gt;Put every DMZ host in separate zone with /31 subnet. On internet firewall create virtual static router for each server. Actually, I like it more. The problem is here: still has manual work on creating each server. Mess in internet firewall in static routes and rules. &lt;/li&gt;&#xA;&lt;li&gt;Deploy enterprise solution, such as cloudstack or openstack. The problem is here: we are small hosting company that hosts only services that we develop. We have about 10 servers that have remote access from foreign developers. Next year we plan for 10 more. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Dear gurus need your suggestions.&lt;/p&gt;&#xA;" OwnerUserId="14498" LastEditorUserId="8499" LastEditDate="2018-12-12T02:00:30.447" LastActivityDate="2018-12-12T02:00:30.447" Title="How to secure DMZ and client-to-client tunnel?" Tags="|vlan|subnet|security|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="25490" PostTypeId="1" CreationDate="2015-12-28T09:14:52.517" Score="1" ViewCount="1193" Body="&lt;p&gt;I have a Cisco SG300-28 switch with the latest firmware which is colocated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My colocation facility has hooked up a KVM like device to the serial console, so I can ssh into the switch to configure it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to do the following.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Reset the switch to factory defaults&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Convert it to Layer 3 mode&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make it so that it the web interface answers on the ip address the facility has given me can be logged into via a web browser.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(For the sake of examples please assume the web address is 203.0.113.66 and it's a /28.  The actual ip address is a real routable ip).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried many permutations on snippets I've seen on the web, but haven't gotten the switch to serve its web interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone could provide me with an example of what to type, so I can get the switch working that would be great.&lt;/p&gt;&#xA;" OwnerUserId="21620" LastEditorUserId="21620" LastEditDate="2016-01-01T10:05:44.863" LastActivityDate="2018-01-21T02:32:36.527" Title="Getting SG300 setup from console to L3 switch with web access" Tags="|cisco|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25491" PostTypeId="2" ParentId="25490" CreationDate="2015-12-28T09:37:54.087" Score="1" Body="&lt;p&gt;You can &lt;code&gt;erase&lt;/code&gt; the &lt;code&gt;startup-config&lt;/code&gt; and &lt;code&gt;reload&lt;/code&gt; to get the factory configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you mean Layer-3, not Level 3, and it is a Layer-3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A best practice for security is to disable the HTTP server and HTTP secure-server in Cisco devices, but you can enable it with the &lt;code&gt;ip http server&lt;/code&gt; command. You will need to have a configured IP address on the switch which you can reach for the web interface to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without a complete network design, we can't begin to guess how you have it connected or your needs, and we would just be guessing on a proper configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is all very simple stuff for a switch, and I would &lt;em&gt;strongly&lt;/em&gt; recommend you get someone who knows how to do this to configure it for you. It is not a simple thing like a home router, and it sounds like you don't have a firewall protecting it, which seems a very foolish idea.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-28T09:37:54.087" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25492" PostTypeId="2" ParentId="25487" CreationDate="2015-12-28T10:10:48.957" Score="3" Body="&lt;p&gt;You didn't mention the switch model, but a lot of switches support Private VLANs which only allow a switch port to access the configured uplink switch port. This is often used in hosting to prevent one hosted server from being able to access another hosted server. You can isolate each switch port from all the other switch ports to provide your customers privacy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wikipedia has an article which can give you an overview of &lt;a href=&quot;https://en.wikipedia.org/wiki/Private_VLAN&quot; rel=&quot;nofollow&quot;&gt;Private VLANs&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Secure hosting&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Private VLANs in hosting operation allows segregation between&#xA;  customers with the following benefits:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;No need for separate IP subnet for each customer.&lt;/li&gt;&#xA;  &lt;li&gt;Using Isolated VLAN, there is no limit on the number of customers.&lt;/li&gt;&#xA;  &lt;li&gt;No need to change firewall's interface configuration to extend the    number of configured VLANs.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Actual configurations will differ between switch manufacturers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-28T10:10:48.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25495" PostTypeId="2" ParentId="25486" CreationDate="2015-12-28T13:29:01.690" Score="0" Body="&lt;p&gt;I don't understand why you set X as the DNS of Y? The DNS is only used to resolve the hostname&amp;lt;-&gt;ip pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a particular reason why you want X to be the DNS of Y or it is the same for you? Because if it is the same, you could set X as the gateway of Y and use a public DNS for Y; for instance the Google DNSs (&lt;code&gt;8.8.8.8&lt;/code&gt; or &lt;code&gt;8.8.4.4&lt;/code&gt;) or Open Dns (&lt;code&gt;208.67.222.222&lt;/code&gt; or &lt;code&gt;208.67.220.220&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="21626" LastActivityDate="2015-12-28T13:29:01.690" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25498" PostTypeId="2" ParentId="25109" CreationDate="2015-12-28T16:50:27.983" Score="1" Body="&lt;p&gt;A sip outbound proxy is a sip proxy, but just given a more specific name/role. The outbound proxy is set on the user agent for all outbound calls. A generic sip proxy could be used for routing between service providers, carriers, etc. Or it could be used as an outbound proxy for certain devices. For reference:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.voip-info.org/wiki/view/SIP+outbound+proxy&quot; rel=&quot;nofollow&quot;&gt;http://www.voip-info.org/wiki/view/SIP+outbound+proxy&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.voip-info.org/wiki/view/SIP+proxy&quot; rel=&quot;nofollow&quot;&gt;http://www.voip-info.org/wiki/view/SIP+proxy&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21558" LastActivityDate="2015-12-28T16:50:27.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25501" PostTypeId="2" ParentId="25001" CreationDate="2015-12-28T21:14:25.017" Score="0" Body="&lt;p&gt;So I think it's important here to get the terminology correct, even though it's VERY common that people use the wrong terms.  Properly, an &lt;strong&gt;&lt;em&gt;access point&lt;/em&gt;&lt;/strong&gt; allows &lt;strong&gt;&lt;em&gt;wireless clients&lt;/em&gt;&lt;/strong&gt; to connect to the existing network (which is usually, but not exclusively, a wired ethernet network).  This is distinct from a &lt;strong&gt;&lt;em&gt;router&lt;/em&gt;&lt;/strong&gt;, which forwards packets from one computer network to another, and often includes functionality such as network address and/or port translation.  The confusion arises because many very common devices, especially home &quot;wifi routers&quot; put all of this functionality into a single device.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;power&quot; of a router can mean a lot of things, and it's not at all clear what's being asked here.  At least one important distinction would be whether we're talking about &quot;how good is this system at sending and receiving wireless signals&quot; but another might be &quot;how good is this device at doing packet forwarding?&quot;  - these might well be very different things for a given device.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In large deployments, you can have lots of access points that cover a large area (think about a large commercial building) but none of these access points are actually doing the routing or NAT/PAT functionality.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So... all that said, it will really help us answer the question if you describe in better detail what you're asking and use the terminology most appropriate.  I briefly looked over the relevant wikipedia pages and they seem to be reasonably well written:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[1] &lt;a href=&quot;https://en.wikipedia.org/wiki/Wireless_access_point&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Wireless_access_point&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[2] &lt;a href=&quot;https://en.wikipedia.org/wiki/Router_(computing)&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Router_(computing)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[3] &lt;a href=&quot;https://en.wikipedia.org/wiki/Network_address_translation&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Network_address_translation&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13955" LastActivityDate="2015-12-28T21:14:25.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25504" PostTypeId="1" AcceptedAnswerId="25506" CreationDate="2015-12-28T23:46:20.677" Score="1" ViewCount="1567" Body="&lt;p&gt;I am interested in finding the IP addresses assigned to devices attached to each interface on a Cisco 2960X switch. It seems like &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/address-resolution-protocol-arp/118630-technote-ipdt-00.html&quot; rel=&quot;nofollow&quot;&gt;IPDT&lt;/a&gt; is exactly what I'm looking for. However it seems like the refresh interval is a bit odd.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I understand it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IPDT is updated the first time traffic from a new device is detected&lt;/li&gt;&#xA;&lt;li&gt;settings for number of devices attached to the port via &lt;code&gt;ip device tracking max N&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;maximum number of probe times is 255&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Cisco docs on IPDT seem very scarce, so I figured I'd ask here:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there any way to force a refresh of this data?&lt;/li&gt;&#xA;&lt;li&gt;Is there a way to reset the probe count once it's hit the max specified?&lt;/li&gt;&#xA;&lt;li&gt;(is there even a way to see how many times ip device track info was probed for?)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The reason I'm interested in a way to force a refresh is two-fold. For one when a device is unplugged, I would expect it to disappear, but it doesn't. Also, for a switch where I've just enabled IPDT, not all devices plugged in appear immediately (though given enough time they do show up).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, this is what I did to enable IPDT:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure terminal       &#xA;ip device tracking              &#xA;int range Gi1/0/1-47&#xA;ip device tracking max 1  &#xA;ip device tracking probe count 255&#xA;ip device tracking probe interval 30&#xA;end&#xA;wr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21635" LastActivityDate="2015-12-29T00:26:54.803" Title="Cisco 2960X &amp; IPDT" Tags="|cisco|cisco-ios|cisco-catalyst|arp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25506" PostTypeId="2" ParentId="25504" CreationDate="2015-12-29T00:26:54.803" Score="0" Body="&lt;p&gt;I don't think you are going to find exactly like what you want. The document to which you refer is the documentation; there's not a lot to this feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refreshes happen automatically under the two circumstances detailed in the document, and there is nothing in place to force a refresh:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ARP probe is sent under two circumstances:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The link associated with a current entry in the IPDT database moves    from a DOWN to an UP state, and the ARP entry has been populated.&lt;/li&gt;&#xA;  &lt;li&gt;A link already in the UP state that is associated with an entry in    the IPDT database has an expired probe interval.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You could shutdown/no shutdown a port to force a refresh, but that seems rather extreme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rather than changing the probe count, you could shorten the interval. Sending 255 probes every 30 seconds seems like a lot; it is nearly 10 per second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could get a close calculation for the number of time a port was probed by showing how long the port was up, divide that by the probe interval, and multiply that by the number of probes configured per interval.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also other features such as DHCP snooping which will build a database of MAC addresses and the DHCP assigned IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If what you have doesn't suffice, you can always request added feature from Cisco, although your requested features may or may not make it into a future release. Cisco may also share a roadmap of planned enhancements to you.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-29T00:26:54.803" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25516" PostTypeId="1" CreationDate="2015-12-29T15:32:10.300" Score="4" ViewCount="3237" Body="&lt;p&gt;Resume: I'm have a really basic network cenario with some new switches that I just bought. After configuring a LAG (without LACP) between them, I started to have ping losses and high latency. I also experienced connectivity lost from the switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In details:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have 4 Cisco Small Business: 1 SG500 24p and other 3 SG300 24p.&lt;/li&gt;&#xA;&lt;li&gt;Their interfaces are all Gigabit.&lt;/li&gt;&#xA;&lt;li&gt;The SG500 is L3 enabled, being the gateway of my network.&lt;/li&gt;&#xA;&lt;li&gt;I have a DHCP/DNS server hosted on a Windows Server, that provides this services.&lt;/li&gt;&#xA;&lt;li&gt;All the switches are with their most recent firmware.&lt;/li&gt;&#xA;&lt;li&gt;All cables are CAT6, in a dedicated network rack.&lt;/li&gt;&#xA;&lt;li&gt;The SG500 gateway is a Draytek firewall/router, with one internet link.&lt;/li&gt;&#xA;&lt;li&gt;SG500 is the root bridge on the STP.&lt;/li&gt;&#xA;&lt;li&gt;No VLANs, just the defaults.&lt;/li&gt;&#xA;&lt;li&gt;No VOIP.&lt;/li&gt;&#xA;&lt;li&gt;At the moment of the configuration, only the servers were up, the company was empty. No large traffic.&lt;/li&gt;&#xA;&lt;li&gt;All SG300 are plugged in the SG500, in a star topology.&lt;/li&gt;&#xA;&lt;li&gt;My Notebook, where I made the ping probes, was cabled to a SG300.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I configured the switches with just one cable on their uplink to the (SG500) and they worked like a charm.&#xA;After doing this, I decided to join another interface on the uplink, aggregating both of them to have a little more throughput.&#xA;So, I access the switches, one by one, by console, and made the command on the selected interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;channel-group 1 mode on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just this!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After doing this, I made new tests on the network. I started to have some &lt;strong&gt;ping losses&lt;/strong&gt;. The pings that survived, had &lt;strong&gt;&gt;20ms latency&lt;/strong&gt;. I started to ping the SG500 and had the same results: losses and high latency. My SSH sessions with the switches started do drop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is my running-config. The SG300 have no configs. Basically the same. I've double-checked the ports and configs on them too.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-CORE#show run&#xA;config-file-header&#xA;SW-CORE&#xA;v1.4.1.3 / R800_NIK_1_4_194_194&#xA;CLI v1.0&#xA;set system queues-mode 4&#xA;&#xA;file SSD indicator encrypted&#xA;@&#xA;ssd-control-start&#xA;ssd config&#xA;ssd file passphrase control unrestricted&#xA;no ssd file integrity control&#xA;ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0&#xA;!&#xA;spanning-tree priority 8192&#xA;voice vlan oui-table add 0001e3 Siemens_AG_phone________&#xA;voice vlan oui-table add 00036b Cisco_phone_____________&#xA;voice vlan oui-table add 00096e Avaya___________________&#xA;voice vlan oui-table add 000fe2 H3C_Aolynk______________&#xA;voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone&#xA;voice vlan oui-table add 00d01e Pingtel_phone___________&#xA;voice vlan oui-table add 00e075 Polycom/Veritel_phone___&#xA;voice vlan oui-table add 00e0bb 3Com_phone______________&#xA;bonjour interface range vlan 1&#xA;hostname SW-CORE&#xA;no passwords complexity enable&#xA;username cisco password encrypted 7af78c911d5b48bea1dc2449d9d89513abeb4be5 privilege 15&#xA;ip ssh server&#xA;ip telnet server&#xA;!&#xA;interface vlan 1&#xA;ip address 192.168.42.1 255.255.254.0&#xA;no ip address dhcp&#xA;!&#xA;interface gigabitethernet1/1/7&#xA;channel-group 1 mode on&#xA;!&#xA;interface gigabitethernet1/1/8&#xA;channel-group 1 mode on&#xA;!&#xA;interface gigabitethernet1/1/9&#xA;channel-group 2 mode on&#xA;!&#xA;interface gigabitethernet1/1/10&#xA;channel-group 2 mode on&#xA;!&#xA;interface gigabitethernet1/1/11&#xA;channel-group 3 mode on&#xA;!&#xA;interface gigabitethernet1/1/12&#xA;channel-group 3 mode on&#xA;!&#xA;interface Port-channel1&#xA;description UPLINK_SG300-C&#xA;!&#xA;interface Port-channel2&#xA;description UPLINK_SG300-B&#xA;!&#xA;interface Port-channel3&#xA;description UPLINK_SG300-A&#xA;!&#xA;exit&#xA;ip default-gateway 192.168.42.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And my CDP info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-CORE#show cdp nei&#xA;Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge&#xA;                  S - Switch, H - Host, I - IGMP, r - Repeater, P - VoIP Phone&#xA;                  M - Remotely-Managed Device, C - CAST Phone Port,&#xA;                  W - Two-Port MAC Relay&#xA;&#xA;    Device ID       Local      Adv  Time To Capability   Platform     Port ID&#xA;                    Interface  Ver. Live&#xA;------------------ ----------- ---- ------- ---------- ------------ -----------&#xA;   34628878d043      gi1/1/7    2     139      S I     Cisco           gi26&#xA;                                                       SG300-28&#xA;                                                       (PID:SRW2024&#xA;                                                       -K9)-VSD&#xA;   34628878d043      gi1/1/8    2     139      S I     Cisco           gi25&#xA;                                                       SG300-28&#xA;                                                       (PID:SRW2024&#xA;                                                       -K9)-VSD&#xA;   34628878c838      gi1/1/9    2     125      S I     Cisco           gi26&#xA;                                                       SG300-28&#xA;                                                       (PID:SRW2024&#xA;                                                       -K9)-VSD&#xA;   34628878c838     gi1/1/10    2     125      S I     Cisco           gi25&#xA;                                                       SG300-28&#xA;                                                       (PID:SRW2024&#xA;                                                       -K9)-VSD&#xA;   34628878c2ab     gi1/1/11    2     148      S I     Cisco           gi25&#xA;                                                       SG300-28&#xA;                                                       (PID:SRW2024&#xA;                                                       -K9)-VSD&#xA;   34628878c2ab     gi1/1/12    2     148      S I     Cisco           gi26&#xA;                                                       SG300-28&#xA;                                                       (PID:SRW2024&#xA;                                                       -K9)-VSD&#xA;&#xA;&#xA;&#xA;SW-CORE#show cdp nei det&#xA;---------------------------------------------&#xA;Device-ID: 34628878d043&#xA;Advertisement version: 2&#xA;Platform: Cisco SG300-28 (PID:SRW2024-K9)-VSD&#xA;Capabilities: Switch IGMP&#xA;Interface: gi1/1/7, Port ID (outgoing port): gi26&#xA;Holdtime: 136&#xA;Version: 1.4.1.3&#xA;Duplex: full&#xA;Native VLAN: 1&#xA;SysName: SG300-C&#xA;SysObjectID: 0.0&#xA;Addresses:&#xA;          IP 192.168.42.13&#xA;          IPv6 fe80::3662:88ff:fe78:d043 (link-local)&#xA;---------------------------------------------&#xA;Device-ID: 34628878d043&#xA;Advertisement version: 2&#xA;Platform: Cisco SG300-28 (PID:SRW2024-K9)-VSD&#xA;Capabilities: Switch IGMP&#xA;Interface: gi1/1/8, Port ID (outgoing port): gi25&#xA;Holdtime: 135&#xA;Version: 1.4.1.3&#xA;Duplex: full&#xA;Native VLAN: 1&#xA;SysName: SG300-C&#xA;SysObjectID: 0.0&#xA;Addresses:&#xA;          IP 192.168.42.13&#xA;          IPv6 fe80::3662:88ff:fe78:d043 (link-local)&#xA;---------------------------------------------&#xA;Device-ID: 34628878c838&#xA;Advertisement version: 2&#xA;Platform: Cisco SG300-28 (PID:SRW2024-K9)-VSD&#xA;Capabilities: Switch IGMP&#xA;Interface: gi1/1/9, Port ID (outgoing port): gi26&#xA;Holdtime: 121&#xA;Version: 1.4.1.3&#xA;Duplex: full&#xA;Native VLAN: 1&#xA;SysName: SG300-B&#xA;SysObjectID: 0.0&#xA;Addresses:&#xA;          IP 192.168.42.12&#xA;---------------------------------------------&#xA;Device-ID: 34628878c838&#xA;Advertisement version: 2&#xA;Platform: Cisco SG300-28 (PID:SRW2024-K9)-VSD&#xA;Capabilities: Switch IGMP&#xA;Interface: gi1/1/10, Port ID (outgoing port): gi25&#xA;Holdtime: 180&#xA;Version: 1.4.1.3&#xA;Duplex: full&#xA;Native VLAN: 1&#xA;SysName: SG300-B&#xA;SysObjectID: 0.0&#xA;Addresses:&#xA;          IP 192.168.42.12&#xA;---------------------------------------------&#xA;Device-ID: 34628878c2ab&#xA;Advertisement version: 2&#xA;Platform: Cisco SG300-28 (PID:SRW2024-K9)-VSD&#xA;Capabilities: Switch IGMP&#xA;Interface: gi1/1/11, Port ID (outgoing port): gi25&#xA;Holdtime: 144&#xA;Version: 1.4.1.3&#xA;Duplex: full&#xA;Native VLAN: 1&#xA;SysName: SG300-A&#xA;SysObjectID: 0.0&#xA;Addresses:&#xA;          IP 192.168.42.11&#xA;---------------------------------------------&#xA;Device-ID: 34628878c2ab&#xA;Advertisement version: 2&#xA;Platform: Cisco SG300-28 (PID:SRW2024-K9)-VSD&#xA;Capabilities: Switch IGMP&#xA;Interface: gi1/1/12, Port ID (outgoing port): gi26&#xA;Holdtime: 143&#xA;Version: 1.4.1.3&#xA;Duplex: full&#xA;Native VLAN: 1&#xA;SysName: SG300-A&#xA;SysObjectID: 0.0&#xA;Addresses:&#xA;          IP 192.168.42.11&#xA;---------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, my questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is this a problem with link aggr.?&lt;/li&gt;&#xA;&lt;li&gt;Is there any config on the switch that may perform to help in this case? Something on the ports.. ?&lt;/li&gt;&#xA;&lt;li&gt;Is this a problem with Small Business Switches? Anyone here have good experiences with this switches?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15878" LastActivityDate="2016-03-22T04:09:10.323" Title="Basic Link Aggregation scenario with high ping latency" Tags="|cisco|switch|latency|ieee-802.1ax|cisco-small-business|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25517" PostTypeId="1" CreationDate="2015-12-29T15:35:53.240" Score="3" ViewCount="367" Body="&lt;p&gt;In my problem I have a company to which was given the block of addresses 172.14.200.192/26 and the whole network is connected like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qCrie.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qCrie.png&quot; alt=&quot;Network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The objective is to figure out the L1, L2 and L3 subnet addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since it's a 26 bit mask I assume I should be able to create 4 subnets with 62 hosts each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's throwing me off here is the 192, because 172.14.200.192 -&gt; 172.14.200.|11|000000|, makes it so that the bits borrowed to create subnets are filled already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did another exercise where the address block was 44.44.44.0/26, so 3 subnets could be 44.44.44.64, 44.44.44.128 and 44.44.44.192. Did I do that one right? What am I getting wrong here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean, can I even create subnets? Or do I have only one, the .192 with 62 hosts and broadcast at .255?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I just thought that the point might be to borrow the first 2 from the last 6 bits to be able to create 4 networks. But those would only be able to have 14 hosts each, so even though the provided link below teaches to create subnetworks, I still can't answer the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDITthe2nd: As sugested below, the answer could be (and most likely is) to borrow one bit and create two /27, each with 30 hosts and borrow another bit in one of those to create two /28, each with 14 hosts. The /27 would go to L2, with 29 computers and the /28's would go to L1 and L3.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L2 -&amp;gt; 172.14.200.|11|0|00000 / 27 -&amp;gt; 172.14.200.192/27&#xA;&#xA;L1 -&amp;gt; 172.14.200.|11|10|0000 / 28 -&amp;gt; 172.14.200.224/28&#xA;&#xA;L3 -&amp;gt; 172.14.200.|11|11|0000 / 28 -&amp;gt; 172.14.200.240/28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDITthe3rd: The above was a nice step, but I failed to take into account the 172.14.200.212/30 segment, which takes away the .212 - .215 block. As such, the .192/27 block is the one to be divided:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L2: 172.14.200.224/27 -&amp;gt; gives me 30 hosts&#xA;&#xA;L3: 172.14.200.192/28 -&amp;gt; gives me 14 hosts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The last block is divided again:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L1: 172.14.200.216/29 -&amp;gt; gives me 6 hosts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The remaining block, 172.14.200.208/29 will overlap with the .212 - .215 block, but I only need 3 subnets.&lt;/p&gt;&#xA;" OwnerUserId="21647" LastEditorUserId="21647" LastEditDate="2015-12-29T23:25:33.493" LastActivityDate="2015-12-29T23:25:33.493" Title="Calculating IPV4 subnet addresses" Tags="|ipv4|subnet|" AnswerCount="2" CommentCount="4" ClosedDate="2015-12-29T21:08:07.500" ContentLicense="CC BY-SA 3.0" />
  <row Id="25518" PostTypeId="2" ParentId="25517" CreationDate="2015-12-29T16:59:00.967" Score="1" Body="&lt;p&gt;You can divide a /26 into four /28 or one /27 and two /28, right? VLSM.&lt;/p&gt;&#xA;" OwnerUserId="21648" LastActivityDate="2015-12-29T16:59:00.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25521" PostTypeId="2" ParentId="23393" CreationDate="2015-12-29T18:48:36.360" Score="2" Body="&lt;p&gt;I believe you also have a set a security level for the interfaces in an ASA. From what I remember, there's three things that need to be configured for each interface:&lt;br&gt;&#xA;Name&#xA;Security Level&#xA;IP Address&lt;/p&gt;&#xA;" OwnerUserId="21651" LastActivityDate="2015-12-29T18:48:36.360" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25522" PostTypeId="2" ParentId="25517" CreationDate="2015-12-29T18:50:25.623" Score="-1" Body="&lt;p&gt;26 bit mask address only allow u to have maximum of 62 hots&lt;/p&gt;&#xA;" OwnerUserId="13605" LastEditorUserId="13605" LastEditDate="2015-12-29T18:59:51.693" LastActivityDate="2015-12-29T18:59:51.693" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25527" PostTypeId="1" CreationDate="2015-12-30T00:55:55.267" Score="3" ViewCount="51" Body="&lt;p&gt;We are in the process of building a new campus which will be 10 single-story buildings on 20 acres. The buildings are laid out in a U shape. The bottom of the U will host all IT services (servers, DC, SAN, Internet PoP, etc.) All of the other buildings will have a dedicated wiring closet to connect desktops/APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the best practices or design guidelines for physically connecting all of these buildings with fiber/conduit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Ideas:&lt;/strong&gt; Should it be built as home-runs from the DC to each wiring closet. Or should we &quot;island-hop&quot; from wiring closet to wiring closet. Or should we create a star layout with the DC and wiring closets running to a central point in the U layout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been reading the Cisco Validated Designs and am including it as a basis for my design.&lt;/p&gt;&#xA;" OwnerUserId="21660" LastActivityDate="2015-12-30T01:46:54.443" Title="Fiber Trenching Design (L1)" Tags="|design|fiber|architecture|layer1|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25528" PostTypeId="2" ParentId="22871" CreationDate="2015-12-30T01:34:43.100" Score="1" Body="&lt;p&gt;I don’t believe Juniper platforms have any compatible &lt;code&gt;show&lt;/code&gt; outputs that allow access to that information and it doesn’t look like &lt;code&gt;show bgp neighbor&lt;/code&gt; fits the bill quite right.  They do, however, have some appealing logging options within the &lt;code&gt;traceoptions&lt;/code&gt; stanza that log to &lt;code&gt;/log&lt;/code&gt; directory.  Although I can’t confirm the configuration below gives you &lt;em&gt;exactly&lt;/em&gt; what you’re used to receiving with &lt;code&gt;performance-statistics&lt;/code&gt;, I’m confident it will provide more.&lt;/p&gt;&#xA;&lt;p&gt;I would test this myself, but my organization might frown on me self-initiating BGP route updates for thousands of routes (event soft resets).&lt;/p&gt;&#xA;&lt;p&gt;Give this a try:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[edit protocols bgp]&#xA;user@host:A# show&#xA;traceoptions {&#xA;    file bgp-perf size 10k;&#xA;    flag update detail;&#xA;    flag all;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;sup&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos12.1/topics/topic-map/bgp-troubleshooting.html#id-13235512&quot; rel=&quot;nofollow noreferrer&quot;&gt;Juniper TechLibrary - Understanding Trace Operations for BGP Protocol Traffic&lt;/a&gt;&lt;/sup&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Just as a warning, &lt;code&gt;detailed&lt;/code&gt; and &lt;code&gt;all&lt;/code&gt; flag options are extremely CPU intensive and are only amplified in larger deployments.  Use them sparingly (if at all) in production networks.  The flags emphasized below are the ones that should be most relevant towards what you’re trying to achieve.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;BGP protocol-specific trace options:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;4byte - as-4-byte AS events.&lt;/li&gt;&#xA;&lt;li&gt;bfd - BFD protocol events.&lt;/li&gt;&#xA;&lt;li&gt;damping - Damping operations.&lt;/li&gt;&#xA;&lt;li&gt;graceful-restart - Graceful restart events.&lt;/li&gt;&#xA;&lt;li&gt;keepalive - BGP keepalive messages.&lt;/li&gt;&#xA;&lt;li&gt;nsr-synchronization - Nonstop active routing synchronization events.&lt;/li&gt;&#xA;&lt;li&gt;open - BGP open packets. These packets are sent between peers when they are establishing a connection.&lt;/li&gt;&#xA;&lt;li&gt;packets - All BGP protocol packets.&lt;/li&gt;&#xA;&lt;li&gt;refresh - BGP refresh packets.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;update - BGP update packets. These packets provide routing updates to BGP systems.&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Global tracing options:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;all - All tracing operations&lt;/li&gt;&#xA;&lt;li&gt;general - All normal operations and routing table changes (a combination of the normal and route trace operations)&lt;/li&gt;&#xA;&lt;li&gt;normal - Normal events&lt;/li&gt;&#xA;&lt;li&gt;policy - Policy processing&lt;/li&gt;&#xA;&lt;li&gt;route - Routing information&lt;/li&gt;&#xA;&lt;li&gt;state - State transitions&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;task - Routing protocol task processing&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;timer - Routing protocol timer processing&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Trace options flag modifiers:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;detail - Detailed trace information.&lt;/li&gt;&#xA;&lt;li&gt;filter - Filter trace information. Applies only to route and damping tracing flags.&lt;/li&gt;&#xA;&lt;li&gt;receive - Packets being received.&lt;/li&gt;&#xA;&lt;li&gt;send - Packets being transmitted.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="3191" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2015-12-30T01:34:43.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25529" PostTypeId="2" ParentId="25527" CreationDate="2015-12-30T01:46:54.443" Score="4" Body="&lt;p&gt;This is a budget question. The cheapest option is to daisy-chain each building. The &quot;cost conscious&quot; option is to link each building back to a central location. And finally, the most future-proof (and expensive) option is a full mesh.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would not recommend the cheap option as the failure of a single link splits the network in half. I wouldn't do the expensive option either as it's far more complicated, and it's unlikely you'll need it -- most of your traffic will be to the DC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(If you have multiple strands to each building, you can create a mesh with cross-connects as needed at the central hub.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2015-12-30T01:46:54.443" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25530" PostTypeId="1" AcceptedAnswerId="25537" CreationDate="2015-12-30T03:59:31.943" Score="1" ViewCount="1438" Body="&lt;p&gt;There are three interfaces, TRUST (security level 100), UNTRUST (security level 0), and DMZ (security level 50).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am on a network coming into the firewall via the UNTRUST interface.  The switch I am able to use ICMP with but not SSH to (timeout) is connected via the DMZ interface.  There are three rules which each included the same service group (including icmp, tcp/ssh, udp/tftp, tcp/telnet, udp/syslog).  These rules are applied as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DMZ Interface (incoming)&#xA;    DMZ_network any IP permit&#xA;&#xA;TRUST Interface (incoming)&#xA;    DMZ_switch my_laptop service_group permit&#xA;&#xA;UNTRUST Interface (incoming)&#xA;    my_laptop DMZ_switch service_group permit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I am able to ICMP, and I see increment on the rules that have been applied, but I receive connection-timeout for SSH connection attempts.  I've spent too much time hitting my head on the proverbial wall to not reach out for an assist here.  I appreciate anyone and everyone who takes time to read or answer this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;lzer&lt;/p&gt;&#xA;" OwnerUserId="7534" LastActivityDate="2015-12-30T13:16:59.247" Title="ASA Firewall Can PING cannot SSH to switch on different interface" Tags="|cisco-asa|firewall|access-control|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25531" PostTypeId="2" ParentId="25530" CreationDate="2015-12-30T07:17:46.327" Score="0" Body="&lt;p&gt;I believe you should have an ACL in the OUT direction for the DMZ interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic will enter the untrusted interface for which you have an ACL - fine&#xA;Then traffic will exit (out) the DMZ interface where the switch management is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence why you need to permit &quot;laptop_ip dmz_switch any_service_you_want&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You do not need to worry about the &quot;return&quot; traffic as the ASA will keep the state&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if it is clear what I wrote above&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&#xA;Ravi&lt;/p&gt;&#xA;" OwnerUserId="1497" LastActivityDate="2015-12-30T07:17:46.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25532" PostTypeId="2" ParentId="24896" CreationDate="2015-12-30T08:05:08.673" Score="1" Body="&lt;p&gt;1000BASE-TX has not gained wide recognition, largely due to the expense of Cat 6 and 7 cable requirements and the rising cost of 1000BASE-T products.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I constantly wrestle with this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some vendors(Fiberstore) erroneously call 1000base-t SFP a 1000base-tx SFPs. &lt;/p&gt;&#xA;" OwnerUserId="15431" LastEditorUserId="15431" LastEditDate="2015-12-30T08:12:22.080" LastActivityDate="2015-12-30T08:12:22.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25533" PostTypeId="1" AcceptedAnswerId="25540" CreationDate="2015-12-30T10:29:38.663" Score="3" ViewCount="444" Body="&lt;p&gt;I apologize for the stupid question; I'm trying to wrap my head around the basics of networking. Also, please feel free to direct me to the right SE forum, if this is not the right place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are &lt;strong&gt;modems&lt;/strong&gt; (the devices that map between digital and analog data) needed to connect &lt;strong&gt;routers&lt;/strong&gt; (the devices at the networking level that implement some routing algorithm to move packets around)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My initial thought is: assuming links are &lt;em&gt;not&lt;/em&gt; digital (so, say, some kind of copper wire), communicating routers must either:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;be able to translate waves to bits to read the appropriate headers for addressing, or&lt;/li&gt;&#xA;&lt;li&gt;use some kind of a device (a modem?) to do the translation for them.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would appreciate any insight into the &lt;em&gt;role of modems in routing&lt;/em&gt;. As a source I have Kurose &amp;amp; Ross, 6th edition, so a simple pointer to a relevant section of the book could also help me a lot.&lt;/p&gt;&#xA;" OwnerUserId="21664" LastEditorUserId="8499" LastEditDate="2018-03-07T22:47:40.450" LastActivityDate="2018-03-07T22:47:40.450" Title="Are modems needed to connect routers?" Tags="|switch|router|ethernet|internet|modem|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25537" PostTypeId="2" ParentId="25530" CreationDate="2015-12-30T13:16:59.247" Score="2" Body="&lt;p&gt;Considering that your ruleset is correct... Have you checked on the switch side? There might be an access-class configured on your vty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;p.s. you may want to use packet-tracer on ASA to check if traffic would be permited or just check the logbuffer via CLI/ASDM to see what is really going on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if you need any help.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2015-12-30T13:16:59.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25539" PostTypeId="1" CreationDate="2015-12-30T14:22:15.420" Score="3" ViewCount="3788" Body="&lt;p&gt;Cisco recently made available Firepower management via ASDM along with Firesight VM. I am using ASDM to manage and I am unable to see &quot;Create new policy&quot; under Configuration-&gt;Asa Firepower configuration-&gt;Access policy. The only policy I see is default policy and there is no button to enable it.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/A41Mj.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/A41Mj.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Have control and malware license applied. I tried rebooting firepower module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone had the same issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am running Asa 5515x version 9.5(1)5, Firepower 6 and ASDM 7.5(2). The latest Java as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing that may not be relevant: ASDM can't connect to Firepower module when I am connecting via public ip address from outside. I need to connect from inside or connect to vpn and then use inside ip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="4608" LastEditorUserId="4608" LastEditDate="2015-12-30T14:54:49.657" LastActivityDate="2020-07-15T06:37:00.543" Title="Manage Cisco ASA Firepower ASDM" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25540" PostTypeId="2" ParentId="25533" CreationDate="2015-12-30T14:59:56.377" Score="3" Body="&lt;p&gt;Modems are only needed to translate signals between analog and digital circuits. Some devices called modems aren't really modems in the strictest sense. For instance, many variants of ethernet use copper, but ethernet uses digital signals, and you wouldn't call a device which connects to a copper circuit using ethernet a modem, although I know people who do. Modem don't need to connect to routers since you could connect a modem to a switch or other networking device, depending on the network design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many different layer-1 technologies - some use modems, and some don't. I'm not really clear by what you mean about the role of modems in networking because you use modems where they are needed to connect analog circuits to digital circuits. It really depends on the network design. It's almost like asking what is the role of UTP cables in networking; you use UTP where it is needed for a particular network design. The same is true for modems, routers, switches, or any other network component.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2015-12-30T14:59:56.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25541" PostTypeId="2" ParentId="13265" CreationDate="2015-12-30T15:03:10.160" Score="1" Body="&lt;p&gt;To remove Panorama rule from Panos. Select the rule and below click on override on firewall and delete the rule. Commit and save changes on that particular box. What is DG? &lt;/p&gt;&#xA;" OwnerUserId="21671" LastActivityDate="2015-12-30T15:03:10.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25545" PostTypeId="1" CreationDate="2015-12-30T18:20:45.160" Score="1" ViewCount="295" Body="&lt;p&gt;I have a Cisco 819 with 4G which is a &quot;spoke&quot; and has a layer 3 DMVPN connection to the &quot;hub.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uY6tY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uY6tY.png&quot; alt=&quot;Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This (C819HG-4G-V-K9) router does not support EIGRP, therefore I cannot establish adjacency to the DMVPN &quot;hub.&quot; It is hearing eigrp hellos over the tunnel interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a router which does support EIGRP which I would like to &quot;pass-through&quot; the unsupported router, and establish an adjacency with the hub.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My router is connected to the vlan 1 on the 819 router and I am seeing these debug messages as a result of &quot;debug ip packet&quot; with access list specifying only EIGRP: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Dec 30 12:37:52.849 EST: IP: s=172.22.201.162 (Vlan1), d=224.0.0.10, len 60, input feature, MCI Check(108), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE&#xA;  Dec 30 12:37:52.849 EST: IP: s=172.22.201.162 (Vlan1), d=224.0.0.10, len 60, unroutable&#xA;  Dec 30 12:37:56.000 EST: IP: s=10.242.244.1 (Tunnel100), d=224.0.0.10, len 60, input feature, packet consumed, MCI Check(108), rtype 0, forus FALSE, sendself FALSE, mtu 0, fwdchk FALSE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the (unsupported) 819/4g router is seeing both eigrp hello multicast packets but an adjacency is not established because:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The hello seen on the tunnel interface is not passed through to the VLAN 1&lt;/li&gt;&#xA;&lt;li&gt;The hello seen on the VLAN 1 is &quot;unroutable&quot; and is not forwarded onto the tunnel interface&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A static route is defined for default traffic to use the ip address at the &quot;hub&quot; router, which I am able to ping from the CLI of the &quot;spoke&quot; 819/4g router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All traffic from the EIGRP router is statically destined to the 819/4g router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way that I can establish the EIGRP adjacency &quot;across&quot; the 819/4g to the DMVPN &quot;hub&quot;, without having EIGRP running on the 4g router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried connecting the router to the WAN/gigabit interface of the 819/4g router without luck, so I thought it might work connecting it to a VLAN/switchport.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could I add the tunnel to the VLAN so that communication on the tunnel will be heard across the VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not permitted to make additional configuration the the DMVPN-HUB which is running EIGRP.&lt;/p&gt;&#xA;" OwnerUserId="2477" LastEditorUserId="2477" LastEditDate="2015-12-30T18:26:07.470" LastActivityDate="2015-12-30T18:26:07.470" Title="EIGRP adjacency &quot;forward&quot; through DMVPN router not supporting EIGRP" Tags="|cisco|vpn|multicast|eigrp|" AnswerCount="0" CommentCount="2" ClosedDate="2019-03-31T00:09:52.673" ContentLicense="CC BY-SA 3.0" />
  <row Id="25549" PostTypeId="2" ParentId="22871" CreationDate="2015-12-31T03:18:35.720" Score="2" Body="&lt;p&gt;The way that I ended up doing this was imperfect; it had a lot of potential for noise, and only works if you have a clear start and end time, but at the time it was the best way I could come up with.&lt;br/&gt;&#xA;I did it by executing the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show system processes extensive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then feeding the router the routes, then executing the command again and summing up the differences in time for each process except the idle process between the two execution of the command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be possible to get a more accurate number by only counting the difference in time for the &lt;em&gt;rpd&lt;/em&gt; process, but for my own purposes this wasn't adequate because the time didn't seem to increase if I fed the router routes which it already had.&lt;/p&gt;&#xA;" OwnerDisplayName="user19357" LastActivityDate="2015-12-31T03:18:35.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25550" PostTypeId="1" CreationDate="2015-12-31T06:24:17.163" Score="0" ViewCount="1791" Body="&lt;p&gt;I'm taking an AWS Lab to better familiarize myself with creating a VPC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The instructions describe the example network we are to create in the lab like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4224a.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4224a.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My background is in software, not networking, so the second paragraph sent me on a hunt to refresh my networking knowledge so that I can understand more clearly what I'm creating and how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I stumbled upon this excellent &lt;a href=&quot;https://www.youtube.com/watch?v=WX5GaH5ootc&quot; rel=&quot;nofollow noreferrer&quot;&gt;video on TCP/IP addressing&lt;/a&gt; and it states that &lt;strong&gt;10.0.0.0&lt;/strong&gt; is a Class A network which has a default subnet mask of &lt;strong&gt;255.0.0.0&lt;/strong&gt;, but the lab I'm taking says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The VPS itself is a Class B network in the 10.0.0.0 space...[with a&#xA;  subnet] of 255.255.0.0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So what gives? How is the VPC a Class B network but it is in a Class A space (10.0.0.0)?&lt;/p&gt;&#xA;" OwnerUserId="21683" LastActivityDate="2015-12-31T17:11:38.663" Title="How can a Class B network be in the 10.0.0.0 space?" Tags="|ipv4|vpc|" AnswerCount="2" CommentCount="2" ClosedDate="2015-12-31T19:04:53.837" ContentLicense="CC BY-SA 3.0" />
  <row Id="25552" PostTypeId="2" ParentId="25550" CreationDate="2015-12-31T06:34:43.660" Score="2" Body="&lt;p&gt;First, classful routing has been dead for 20 years, replaced by CIDR and VLSM in 1995, and is really only useful as a historical reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The class of an address is determined by the first bits of the address. Some people mistakenly have decided that any &lt;code&gt;/8&lt;/code&gt; is a Class A, any &lt;code&gt;/16&lt;/code&gt; is a Class B, and any &lt;code&gt;/24&lt;/code&gt; is a Class C. It's true those are the default network sizes for those classes, but that doesn't mean that &lt;code&gt;10.0.0.0/16&lt;/code&gt; is a Class B network.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class A addresses start with &lt;code&gt;0&lt;/code&gt; as the first bit.&lt;/li&gt;&#xA;&lt;li&gt;Class B addresses start with &lt;code&gt;10&lt;/code&gt; as the first two bits.&lt;/li&gt;&#xA;&lt;li&gt;Class C addresses start with &lt;code&gt;110&lt;/code&gt; as the first three bits.&lt;/li&gt;&#xA;&lt;li&gt;Class D addresses start with &lt;code&gt;1110&lt;/code&gt; as the first four bits.&lt;/li&gt;&#xA;&lt;li&gt;Class E addresses start with &lt;code&gt;1111&lt;/code&gt; as the first four bits.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2015-12-31T07:11:08.733" LastActivityDate="2015-12-31T07:11:08.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25554" PostTypeId="2" ParentId="25539" CreationDate="2015-12-31T13:47:57.003" Score="3" Body="&lt;p&gt;I have the same configuration and software release.&#xA;On your screenshot, the Acces control policy has an out of date status. This means you need to deploy ASA FirePower change with ASDM Deploy button.&lt;/p&gt;&#xA;&lt;p&gt;It will create a task to apply the newest firepower configuration, then wait a few minutes for that task to complete. When Acces Control Policy shows &amp;quot;up to date on device&amp;quot; your access control policy should work correctly.&lt;/p&gt;&#xA;" OwnerUserId="21689" LastEditorUserId="55891" LastEditDate="2020-07-15T06:37:00.543" LastActivityDate="2020-07-15T06:37:00.543" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="25559" PostTypeId="2" ParentId="25550" CreationDate="2015-12-31T17:11:38.663" Score="3" Body="&lt;p&gt;Just to add one footnote to @RonMaupin's answer: although classful routing is long dead, many people informally use the terms &quot;Class A, B and C&quot; as shorthand for subnet masks.   So when someone calls a network a Class A network, they simply mean it has a mask of /8 or 255.0.0.0.  Similarly, when they call something a Class B or Class C network, they merely mean it has a mask of /16 or /24, respectively.  That is the sense it is used in the quote you posted.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2015-12-31T17:11:38.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25562" PostTypeId="1" CreationDate="2015-12-31T19:23:36.523" Score="1" ViewCount="177" Body="&lt;p&gt;I'm trying to setup a small network, consisting of 3 routers and switches, and one L3 Switch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Txcgb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Txcgb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have activated PAT on both router R1 and R2, to translate from the private IP addresses to the public IP addresses, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When pinging from host Bizerte or the server to the all the public addresses, everything works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have set up a port forwarding on router R3 to forward all incoming packets on port 80 to the server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I telnet from R1 to &lt;code&gt;41.224.0.3:80&lt;/code&gt; it works fine, and the translation is successful, but when I try to use the same command using the Bizerte host, the translation fails, and checking the server, I can't even ping on the router R3 (&lt;code&gt;172.16.5.65&lt;/code&gt;).&#xA;Checkig the server means pining from the server to R3 router, or vice-versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to restore connectivity, I have to &lt;code&gt;shutdown&lt;/code&gt; the interface &lt;code&gt;e0&lt;/code&gt; (e0 on the R3 router which is directly connected to the server.), and &lt;code&gt;no shutdown&lt;/code&gt; it again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the routers configurations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;resource policy&#xA;!&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;no ip dhcp use vrf connected&#xA;!&#xA;ip dhcp pool bizerte&#xA;   network 172.16.1.0 255.255.255.0&#xA;   default-router 172.16.1.1 &#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;! &#xA;!&#xA;!&#xA;!&#xA;interface Ethernet0&#xA; ip address 172.16.1.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; half-duplex&#xA;!&#xA;interface FastEthernet0&#xA; ip address 41.224.0.1 255.255.255.248&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; speed auto&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 41.224.0.6&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip nat inside source list 1 interface FastEthernet0 overload&#xA;!&#xA;access-list 1 permit 172.16.1.0 0.0.0.255&#xA;no cdp log mismatch duplex&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R3:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R3&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;resource policy&#xA;!&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;no ip dhcp use vrf connected&#xA;ip dhcp excluded-address 172.16.5.65 172.16.5.66&#xA;!&#xA;ip dhcp pool ariana&#xA;   network 172.16.5.64 255.255.255.192&#xA;   default-router 172.16.5.65 &#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;! &#xA;!&#xA;!&#xA;!&#xA;interface Ethernet0&#xA; ip address 172.16.5.65 255.255.255.192&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; half-duplex&#xA;!&#xA;interface FastEthernet0&#xA; ip address 41.224.0.3 255.255.255.248&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; speed auto&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 41.224.0.6&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip nat inside source list 1 interface FastEthernet0 overload&#xA;ip nat inside source static tcp 172.16.5.66 80 interface FastEthernet0 80&#xA;!&#xA;access-list 1 permit 172.16.5.64 0.0.0.63&#xA;no cdp log mismatch duplex&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the NAT debug output and Wireshark capture, it seems that the router R3 actually sends a respond to router R1, but router R1 is not routing/forwarding back the response to the host (Bizerte here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NAT debug output:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router R1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar 1 00:20:24.607: NAT: [0] Allocated Port for 172.16.1.3 -&amp;gt; 41.224.0.1: wanted 1043 got 1043&#xA;*Mar 1 00:20:24.607: NAT*: i: tcp (172.16.1.3, 1043) -&amp;gt; (41.224.0.3, 80) [176]&#xA;*Mar 1 00:20:24.611: NAT*: i: tcp (172.16.1.3, 1043) -&amp;gt; (41.224.0.3, 80) [176]&#xA;*Mar 1 00:20:24.611: NAT*: s=172.16.1.3-&amp;gt;41.224.0.1, d=41.224.0.3 [176]&#xA;*Mar 1 00:20:24.635: NAT*: o: tcp (41.224.0.3, 80) -&amp;gt; (41.224.0.1, 1043) [1098]&#xA;*Mar 1 00:20:24.639: NAT*: s=41.224.0.3, d=41.224.0.1-&amp;gt;172.16.1.3 [1098]&#xA;*Mar 1 00:20:24.639: NAT*: i: tcp (172.16.1.3, 1043) -&amp;gt; (41.224.0.3, 80) [177]&#xA;*Mar 1 00:20:24.639: NAT*: s=172.16.1.3-&amp;gt;41.224.0.1, d=41.224.0.3 [177] R1#&#xA;*Mar 1 00:20:44.811: NAT*: o: tcp (41.224.0.3, 80) -&amp;gt; (41.224.0.1, 1043) [1107]&#xA;*Mar 1 00:20:44.815: NAT*: s=41.224.0.3, d=41.224.0.1-&amp;gt;172.16.1.3 [1107]&#xA;*Mar 1 00:20:44.847: NAT*: i: tcp (172.16.1.3, 1043) -&amp;gt; (41.224.0.3, 80) [178]&#xA;*Mar 1 00:20:44.847: NAT*: s=172.16.1.3-&amp;gt;41.224.0.1, d=41.224.0.3 [178]&#xA;*Mar 1 00:20:44.851: NAT: i: tcp (172.16.1.3, 1043) -&amp;gt; (41.224.0.3, 80) [179]&#xA;*Mar 1 00:20:44.851: NAT: s=172.16.1.3-&amp;gt;41.224.0.1, d=41.224.0.3 [179] R1#&#xA;*Mar 1 00:20:47.967: NAT*: i: tcp (172.16.1.3, 1043) -&amp;gt; (41.224.0.3, 80) [180]&#xA;*Mar 1 00:20:47.967: NAT*: s=172.16.1.3-&amp;gt;41.224.0.1, d=41.224.0.3 [180] R1#&#xA;*Mar 1 00:20:53.747: NAT*: i: tcp (172.16.1.3, 1043) -&amp;gt; (41.224.0.3, 80) [181]&#xA;*Mar 1 00:20:53.747: NAT*: s=172.16.1.3-&amp;gt;41.224.0.1, d=41.224.0.3 [181] R1#&#xA;*Mar 1 00:21:05.107: NAT*: i: tcp (172.16.1.3, 1043) -&amp;gt; (41.224.0.3, 80) [182]&#xA;*Mar 1 00:21:05.111: NAT*: s=172.16.1.3-&amp;gt;41.224.0.1, d=41.224.0.3 [182] R1#&#xA;*Mar 1 00:21:27.723: NAT*: i: tcp (172.16.1.3, 1043) -&amp;gt; (41.224.0.3, 80) [183]&#xA;*Mar 1 00:21:27.723: NAT*: s=172.16.1.3-&amp;gt;41.224.0.1, d=41.224.0.3 [183]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router R3:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar 1 00:20:55.247: NAT*: o: tcp (41.224.0.1, 1043) -&amp;gt; (41.224.0.3, 80) [176]&#xA;*Mar 1 00:20:55.251: NAT*: o: tcp (41.224.0.1, 1043) -&amp;gt; (41.224.0.3, 80) [176]&#xA;*Mar 1 00:20:55.251: NAT*: s=41.224.0.1, d=41.224.0.3-&amp;gt;172.16.5.66 [176]&#xA;*Mar 1 00:20:55.279: NAT*: i: tcp (172.16.5.66, 80) -&amp;gt; (41.224.0.1, 1043) [1098]&#xA;*Mar 1 00:20:55.283: NAT*: s=172.16.5.66-&amp;gt;41.224.0.3, d=41.224.0.1 [1098]&#xA;*Mar 1 00:20:55.287: NAT*: o: tcp (41.224.0.1, 1043) -&amp;gt; (41.224.0.3, 80) [177]&#xA;*Mar 1 00:20:55.287: NAT*: s=41.224.0.1, d=41.224.0.3-&amp;gt;172.16.5.66 [177] R3#&#xA;*Mar 1 00:21:15.291: NAT*: i: tcp (172.16.5.66, 80) -&amp;gt; (41.224.0.1, 1043) [1107]&#xA;*Mar 1 00:21:15.291: NAT*: s=172.16.5.66-&amp;gt;41.224.0.3, d=41.224.0.1 [1107]&#xA;*Mar 1 00:21:15.351: NAT*: o: tcp (41.224.0.1, 1043) -&amp;gt; (41.224.0.3, 80) [178]&#xA;*Mar 1 00:21:15.355: NAT*: s=41.224.0.1, d=41.224.0.3-&amp;gt;172.16.5.66 [178]&#xA;*Mar 1 00:21:15.355: NAT*: o: tcp (41.224.0.1, 1043) -&amp;gt; (41.224.0.3, 80) [179]&#xA;*Mar 1 00:21:15.355: NAT*: s=41.224.0.1, d=41.224.0.3-&amp;gt;172.16.5.66 [179] R3#&#xA;*Mar 1 00:21:18.523: NAT*: o: tcp (41.224.0.1, 1043) -&amp;gt; (41.224.0.3, 80) [180]&#xA;*Mar 1 00:21:18.527: NAT*: s=41.224.0.1, d=41.224.0.3-&amp;gt;172.16.5.66 [180] R3#&#xA;*Mar 1 00:21:24.291: NAT*: o: tcp (41.224.0.1, 1043) -&amp;gt; (41.224.0.3, 80) [181]&#xA;*Mar 1 00:21:24.291: NAT*: s=41.224.0.1, d=41.224.0.3-&amp;gt;172.16.5.66 [181] R3#&#xA;*Mar 1 00:21:35.651: NAT*: o: tcp (41.224.0.1, 1043) -&amp;gt; (41.224.0.3, 80) [182]&#xA;*Mar 1 00:21:35.651: NAT*: s=41.224.0.1, d=41.224.0.3-&amp;gt;172.16.5.66 [182] R3#&#xA;*Mar 1 00:21:58.123: NAT*: o: tcp (41.224.0.1, 1043) -&amp;gt; (41.224.0.3, 80) [183]&#xA;*Mar 1 00:21:58.123: NAT*: s=41.224.0.1, d=41.224.0.3-&amp;gt;172.16.5.66 [183] R3#&#xA;*Mar 1 00:22:42.831: NAT*: o: tcp (41.224.0.1, 1043) -&amp;gt; (41.224.0.3, 80) [185]&#xA;*Mar 1 00:22:42.831: NAT*: s=41.224.0.1, d=41.224.0.3-&amp;gt;172.16.5.66 [185]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14341" LastEditorUserId="8499" LastEditDate="2016-01-01T06:07:17.857" LastActivityDate="2016-01-01T06:07:17.857" Title="Network translation and port forwarding causing host to timeout" Tags="|nat|ip|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25563" PostTypeId="1" AcceptedAnswerId="25565" CreationDate="2015-12-31T20:16:47.983" Score="6" ViewCount="3609" Body="&lt;p&gt;A TCP/UDP header (Layer 4) lists the &lt;strong&gt;Source&lt;/strong&gt; Port, then the &lt;strong&gt;Destination&lt;/strong&gt; Port:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4n4EW.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4n4EW.jpg&quot; alt=&quot;TCP and UDP Header&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An IP header (Layer 3) lists the &lt;strong&gt;Source&lt;/strong&gt; IP, then the &lt;strong&gt;Destination&lt;/strong&gt; IP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IRLvy.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IRLvy.jpg&quot; alt=&quot;IPv4 Header&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An Ethernet header (L2) and a WiFi Header (L2) lists the &lt;strong&gt;&lt;em&gt;Destination&lt;/strong&gt; MAC then the &lt;strong&gt;Source&lt;/strong&gt; MAC&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Gmy5E.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Gmy5E.jpg&quot; alt=&quot;Ethernet and WiFi Header&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;My question&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Is there a reason for the switching of the Source and Destination in the L2 headers? If so, what is the reason?&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="8499" LastEditDate="2018-03-09T20:25:00.960" LastActivityDate="2019-12-16T21:33:20.177" Title="What is the reason for the different order of the Source and Destination in a L2 header?" Tags="|ethernet|ipv4|tcp|protocol-theory|udp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25565" PostTypeId="2" ParentId="25563" CreationDate="2015-12-31T20:31:05.930" Score="8" Body="&lt;p&gt;The roots of the two technologies just are not really related. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Bob Metcalfe, et al. were creating ethernet, they were not working with Vint Cerf, et al. who were creating IP. These were two completely separate efforts. When ethernet was created, it was not at all clear that IP would become dominant, and ethernet was just one of several LAN technologies that was vying for attention. IP didn't get on ethernet for a relatively long period of time because IP was originally connecting universities across the country using WAN technologies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eventually, the market forces preferred the two technologies, and they ended up the dominant technologies in their respective niches, but, although they were both conceived (1970s) and born around the same time period (ethernet in 1980, and RFC 791 in 1981), they actually didn't have much to do with each other until the 1990s, and they are still maintained by completely separate standards organizations.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-01T06:17:25.423" LastActivityDate="2016-01-01T06:17:25.423" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25567" PostTypeId="1" CreationDate="2016-01-01T03:40:47.483" Score="6" ViewCount="24693" Body="&lt;p&gt;Is it possible to block arp request? If yes, how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I can block arp request, does it mean that other machines in same network cannot find my machine?&lt;/p&gt;&#xA;" OwnerUserId="21703" LastActivityDate="2016-08-30T10:37:18.153" Title="Is it possible to block ARP request?" Tags="|arp|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="25568" PostTypeId="2" ParentId="25567" CreationDate="2016-01-01T07:21:04.720" Score="1" Body="&lt;p&gt;I don't think you understand what ARP does and the implications of disabling it. The only thing ARP does is to let a host (including your gateway, which is really just another host as far as the LAN is concerned) relate a layer-3 address to the layer-2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you disable your PC's ability to respond to ARP requests, you will essentially isolate your PC. Yes, you could still send ethernet frames out, but you wouldn't receive anything except for broadcasts and unknown unicasts. Much of networking uses request/response which would be disabled. Your gateway couldn't even find you, so something as simple as surfing the Internet would not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disabling your PC's response to ARP requests will probably require you  create custom software, and you may as well just disconnect the ethernet cable.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-01T07:21:04.720" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25569" PostTypeId="1" CreationDate="2016-01-01T11:20:15.357" Score="1" ViewCount="126" Body="&lt;p&gt;Got 4 network interfaces...&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Fiber 300mbps (only for internal communication between servers)&lt;/li&gt;&#xA;&lt;li&gt;GSM Modem (PPP, wvDial, GSM Network #1)&lt;/li&gt;&#xA;&lt;li&gt;Other GSM Modem (PPP, wvDial, GSM Network #2)&lt;/li&gt;&#xA;&lt;li&gt;Yet another GSM Modem (PPP, wvDial, GSM Network #3)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;By default, everything uses fiber connection, but I would like some applications to force to use GSM networks. So I am using &lt;code&gt;LD_PRELOAD&lt;/code&gt; param with &lt;a href=&quot;http://www.ryde.net/code/bind.c.txt&quot; rel=&quot;nofollow&quot;&gt;ip binding script&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That partially works... you can set &lt;code&gt;BIND_ADDR&lt;/code&gt; and application uses it, but the problem is with &lt;code&gt;default gateway&lt;/code&gt; that is set to fiber network... so binding ip from GSM nerwork simply effects in lack of connection at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I make it right, so after binding to ip of interfece 2 or 3 or 4, it would use gateway of that interface? Please note, that IP addresses are variable!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Happy New Year!&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="21704" LastActivityDate="2016-01-02T02:05:23.157" Title="Debian - default gateway per ip or interface" Tags="|network-access|" AnswerCount="1" CommentCount="3" ClosedDate="2016-01-07T13:55:53.490" ContentLicense="CC BY-SA 3.0" />
  <row Id="25571" PostTypeId="1" AcceptedAnswerId="25573" CreationDate="2016-01-01T14:11:07.557" Score="3" ViewCount="120" Body="&lt;p&gt;OSPF selects DR to reduce the network traffic and all the traffic are send to DR. DR gets a lot of load and needs a lot of computing resource.&#xA;Why does OSPF selects DR with the highest ip address ??  Does selecting like this ensures that best router is selected ?&lt;/p&gt;&#xA;" OwnerUserId="21408" LastActivityDate="2016-01-01T15:01:02.987" Title="DR selection on OSPF" Tags="|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25573" PostTypeId="2" ParentId="25571" CreationDate="2016-01-01T15:01:02.987" Score="7" Body="&lt;p&gt;Let me clarify a misunderstanding:  The DR is responsible for updating the LSDBs of the other routers on the network segment. It does not receive all the network traffic.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the non-DR routers make routing decisions and forward traffic.  The purpose of the DR is to reduce routing update traffic and the number of adjacencies each router needs to maintain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DR is elected based on the priority value in the hello field. This allows you, the administrator, to choose which router becomes the DR.  If more than one router has the same priority (or you don't set it), then the highest router ID is used as a tie-breaker.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that while the router ID looks like an IP address (and is often written that way), it is not an IP address -- just a (unique) number.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-01T15:01:02.987" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25575" PostTypeId="1" AcceptedAnswerId="32252" CreationDate="2016-01-01T18:37:06.630" Score="1" ViewCount="677" Body="&lt;p&gt;I have 3 Cisco sg500x-48 switches. All three switches were working correctly in a stack, but a user decided to re-cable the server toom. Since the re-cabling, the second switch will not re-join the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have stack designed in a ring using twinax from s2 - s1. No matter what I do, I cannot get the the second unit to rejoin the stack. It remains as stack ID 1 as master when the stack already has a master.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried changing Twinax cables, different combinations of ports, reboots and even a factory reset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any troubleshooting tips would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="21709" LastActivityDate="2016-06-14T15:35:05.453" Title="How can I add a Cisco sg500x into an existing stack" Tags="|cisco|switch|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25576" PostTypeId="2" ParentId="24870" CreationDate="2016-01-01T19:16:54.030" Score="2" Body="&lt;p&gt;So you &lt;em&gt;could&lt;/em&gt; do this.  However, there would be more involved.  Stieveb, is correct that your  &quot;new-fw&quot; would see two potential routes to 1.1.1.0/2? because you are trying to make a routed mode FW work like a transparent mode.  What you could do, to make it work would be to put into place NAT for the 1.1.1.0/2? network on both the temp_rtr, facing the new_fw, &lt;em&gt;and&lt;/em&gt; the new_fw facing the temp_rtr.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this way both devices see different network numbering for that range on the side that they aren't directly connected to.  I'm not saying that it's necessarily a great idea, but it would make your proposed config work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I were doing this, what I would do would be to create two copies of the config.  One for the transparent, and one for the routed.  In this way you could get rid of both routers and if something breaks due to the routed setup, you ssh into the new_fw, paste in the &quot;transparent config&quot; and move the two cables to place the my_rtr back inline.  Given what I understand from your requirements in any event! &lt;/p&gt;&#xA;" OwnerUserId="21696" LastActivityDate="2016-01-01T19:16:54.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25577" PostTypeId="2" ParentId="25575" CreationDate="2016-01-01T19:26:19.400" Score="1" Body="&lt;p&gt;Have you reset all involved switches, or just the one that won't join the stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the site can deal with the down time.  I would reset the configs, disable all other ports on the switches except the stacking ports and your management port.  Then bring them back online and config the stacking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I would request that the &quot;user&quot; be summarily executed as an abject lesson to others!!! ;)&lt;/p&gt;&#xA;" OwnerUserId="21696" LastActivityDate="2016-01-01T19:26:19.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25578" PostTypeId="2" ParentId="25569" CreationDate="2016-01-02T02:05:23.157" Score="0" Body="&lt;p&gt;There are a couple of approaches to this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One approach is to route based on source address. There is an example at &lt;a href=&quot;http://www.lartc.org/howto/lartc.rpdb.html#LARTC.RPDB.SIMPLE&quot; rel=&quot;nofollow&quot;&gt;http://www.lartc.org/howto/lartc.rpdb.html#LARTC.RPDB.SIMPLE&lt;/a&gt; (the example uses a remote source address but I don't belive there is any difference here between local and remote source addreses). You can then use this in conjuction with the script you have to force applications to bind to a particular local address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other approach is to use network namespaces. This allows you to isolate applications with seperate copies of the network stack. However it is still a fairly new feature and when I tried it I had trouble making it work. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-01-02T02:05:23.157" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25579" PostTypeId="2" ParentId="25254" CreationDate="2016-01-02T02:21:27.323" Score="0" Body="&lt;p&gt;After further sleuthing, trying different USB wifi cards I found that the problem followed the USB wifi device and didn't happen on other USB wifi devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pursuing the problem as a wifi card driver bug. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device in question is &quot;TP-Link TL-WN-722N (ath9k_htc) USB&quot;. &lt;/p&gt;&#xA;" OwnerUserId="21373" LastActivityDate="2016-01-02T02:21:27.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25580" PostTypeId="2" ParentId="25533" CreationDate="2016-01-02T02:40:54.110" Score="3" Body="&lt;p&gt;Fundamentally a circuit is needed to convert the stream of data packets from the internal form used inside the device into a form suitable for tranmission over the physical medium in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether that device is called a &quot;modem&quot; varies between different physical layers. The convention seems to be that the term &quot;modem&quot; is used when communicating across a physical layer not originally intended for data transmission (e.g. a phone line or a cable TV cable) but not when communicating across a dedicated data link (the term &quot;transceiver&quot; is more commonly used there&quot;). The term &quot;radio modem&quot; also used to be common but seems to have fallen out of favour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the old days there was a sharp distinction between the digital coding schemes used by early ethernet and the tone based approaches used by early voiceband modems but nowadays the technical line is much less sharp.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-01-03T21:27:38.013" LastActivityDate="2016-01-03T21:27:38.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25583" PostTypeId="1" AcceptedAnswerId="25584" CreationDate="2016-01-02T20:40:12.817" Score="3" ViewCount="1843" Body="&lt;p&gt;You have a router and many devices can connect to it to access the internet. From what I've read, the router assigns private interal ip addresses to the devices that are connect so it knows how to direct the traffic. The router however, is assigned one ip address by the ISP. What the world sees from any request coming from that router, whether from a desktop or a tablet, is that one ip address of the router. So how can a server tell how many users on the other end of that ip address? I know devices have their unique mac addresses, but I read that that information isn't sent to servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more concrete scenario would be for video hosting websites like youtube. How would it know how many users are using the same ip? (for view counts) Also, in places where you expect many users using the same &quot;wifi&quot; such as Starbucks, Burger King, or some university, how are devices connected differentiated on the web?&lt;/p&gt;&#xA;" OwnerUserId="21722" LastEditorUserId="8499" LastEditDate="2018-03-02T04:32:25.717" LastActivityDate="2018-03-02T04:32:25.717" Title="How do servers recognize what device requested a page, when multiple devices can share the same ip address?" Tags="|router|ip|mac-address|osi|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25584" PostTypeId="2" ParentId="25583" CreationDate="2016-01-02T21:09:22.493" Score="1" Body="&lt;p&gt;You should search for the OSI model:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/z0GVy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z0GVy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A full explanation of the OSI model is too broad to give here, but applications like browsers and web servers use the transport layer to communicate with each other, not the network layer where IP addresses are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are missing is that HTTP uses TCP as the transport protocol. By default HTTP servers listen on TCP port 80. A host using a browser will use a random, ephemeral, TCP port as its source port. NAT will do something similar for each host for which it translates the IP address, and it keeps track of which port is assigned to which host in a traffic flow. It ends up being a combination of layer-3 address (e.g. IP address), transport protocol (e.g. TCP), and layer-4 address (e.g. TCP port) for what gets used as a unique identifier.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-03-02T04:32:14.880" LastActivityDate="2018-03-02T04:32:14.880" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25586" PostTypeId="1" CreationDate="2016-01-03T00:06:10.133" Score="0" ViewCount="532" Body="&lt;p&gt;Recently I was doing some tests in a small wireless ad-hoc network and one interesting feature I've found was:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Suppose you have a hidden node problem among computers A, B and C (A and C are out of range from each other, but B can communicate with both). If A initialize the ad-hoc network and then B joined it, after that C would also be able to join it through B.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;At first glance you might think that, as C could join the network created by A, probably C could also communicate with A (of course in a true ad-hoc network it doesn't matter who initiated it, this is just a fail-safe test). In that case, it means that this network has a multi-hop feature. However, this is not the case. Nodes can only communicate with other nodes within WiFi range, therefore, they don't participate in routing or forwarding data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1st Issue&lt;/strong&gt;&lt;br&gt;&#xA;According to Wikipedia, in a wireless ad-hoc network &quot;each node participates in routing by forwarding data for other nodes&quot;. How do we reconcile this definition with the current ad-hoc network of Windows? Technically, is it correct to call a single-hop network by ad-hoc? What features can we expect from the Windows Ad-hoc Network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2nd Issue&lt;/strong&gt;&lt;br&gt;&#xA;What would be the technical challenges to develop a protocol for multi-hop ad-hoc network (if there is any)? Current computers would be too slow to forward data based on routing tables???&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3rd Issue&lt;/strong&gt;&lt;br&gt;&#xA;If your computer has an Ethernet connection with the Internet and you setup a wireless ad-hoc network, you may share your internet connection within nodes in the ad-hoc network. However, the other nodes only in the ad-hoc network are not allowed to share such internet connectivity (a popup window appears complaining about a problem with automatic IP address).&lt;br&gt;&#xA;What are the technical challenges to allow all nodes in an ad-hoc network to share internet connectivity (besides the multi-hop issue aforementioned)?&lt;/p&gt;&#xA;" OwnerUserId="20647" LastEditorUserId="20647" LastEditDate="2016-01-03T05:18:52.437" LastActivityDate="2016-01-03T05:18:52.437" Title="Features of Windows Ad-hoc Network" Tags="|wireless|ieee-802.11|internet|design|ad-hoc-wireless|" AnswerCount="1" CommentCount="9" ClosedDate="2016-01-03T11:13:38.173" ContentLicense="CC BY-SA 3.0" />
  <row Id="25587" PostTypeId="2" ParentId="25586" CreationDate="2016-01-03T04:48:31.483" Score="1" Body="&lt;p&gt;The wikipedia description is wrong. In an ad-hoc network, nodes communicate directly. What they are describing is a &lt;em&gt;wireless mesh&lt;/em&gt; network (aka: 802.11s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, your understanding of ad-hoc is flawed. &quot;A&quot; doesn't &quot;create the network&quot;. In an ad-hoc network, there are no controllers. Nodes communicate with each other directly, and independently. &quot;A&quot; may have been the first to broadcast, but that's irrelevant.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-03T04:48:31.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25588" PostTypeId="1" CreationDate="2016-01-03T07:41:23.790" Score="1" ViewCount="564" Body="&lt;p&gt;I'm new to juniper technology and I'm trying to set up mpls vpn on vMX.&#xA;Not sure if I'm missing something in configuration or if this is some kind of bug in vMX or if this is not supported on vMX.&#xA;As you can see only local/direct routes and ospf routes learned from CE are installed in forwarding table, no BGP routes are in forwarding table.&#xA;thanks for help&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@vMX1-PE&amp;gt; show route table vpn-uTik.inet.0 | no-more &#xA;&#xA;vpn-uTik.inet.0: 8 destinations, 8 routes (8 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.0.1.0/30        *[Direct/0] 00:04:44&#xA;                    &amp;gt; via ge-0/0/1.0&#xA;10.0.1.1/32        *[Local/0] 00:04:45&#xA;                      Local via ge-0/0/1.0&#xA;10.0.3.0/30        *[BGP/170] 00:04:28, localpref 100, from 10.255.0.3&#xA;                      AS path: I, validation-state: unverified&#xA;                    &amp;gt; to 10.0.12.2 via em2.0, Push 299872, Push 299824(top)&#xA;10.1.0.1/32        *[Direct/0] 00:05:36&#xA;                    &amp;gt; via lo0.1&#xA;10.5.0.5/32        *[BGP/170] 00:04:28, localpref 100, from 10.255.0.3&#xA;                      AS path: I, validation-state: unverified&#xA;                    &amp;gt; to 10.0.12.2 via em2.0, Push 299824, Push 299824(top)&#xA;10.255.255.1/32    *[OSPF/10] 00:04:35, metric 11&#xA;                    &amp;gt; to 10.0.1.2 via ge-0/0/1.0&#xA;10.255.255.3/32    *[BGP/170] 00:04:28, MED 11, localpref 100, from 10.255.0.3&#xA;                      AS path: I, validation-state: unverified&#xA;                    &amp;gt; to 10.0.12.2 via em2.0, Push 299872, Push 299824(top)&#xA;224.0.0.5/32       *[OSPF/10] 00:05:41, metric 1&#xA;                      MultiRecv&#xA;&#xA;root@vMX1-PE&amp;gt; show route forwarding-table table vpn-uTik    &#xA;Routing table: vpn-uTik.inet&#xA;Internet:&#xA;Destination        Type RtRef Next hop           Type Index    NhRef Netif&#xA;default            perm     0                    rjct      530     1&#xA;0.0.0.0/32         perm     0                    dscd      528     1&#xA;10.0.1.0/30        intf     0                    rslv      600     1 ge-0/0/1.0&#xA;10.0.1.0/32        dest     0 10.0.1.0           recv      598     1 ge-0/0/1.0&#xA;10.0.1.1/32        intf     0 10.0.1.1           locl      599     2&#xA;10.0.1.1/32        dest     0 10.0.1.1           locl      599     2&#xA;10.0.1.2/32        dest     0 52:54:0:12:34:56   ucst      608     4 ge-0/0/1.0&#xA;10.0.1.3/32        dest     0 10.0.1.3           bcst      597     1 ge-0/0/1.0&#xA;10.1.0.1/32        intf     0 10.1.0.1           locl      585     1&#xA;10.255.255.1/32    user     0 10.0.1.2           ucst      608     4 ge-0/0/1.0&#xA;224.0.0.0/4        perm     1                    mdsc      529     1&#xA;224.0.0.1/32       perm     0 224.0.0.1          mcst      525     3&#xA;224.0.0.5/32       user     1 224.0.0.5          mcst      525     3&#xA;255.255.255.255/32 perm     0                    bcst      526     1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21728" LastActivityDate="2016-01-03T07:41:23.790" Title="vMX L3 MPLS VPN routes not in forwarding table" Tags="|juniper|juniper-junos|mpls|mpls-vpn|ip-forwarding-table|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25589" PostTypeId="2" ParentId="18968" CreationDate="2016-01-03T08:00:47.583" Score="0" Body="&lt;p&gt;Consider using recieve acls. A recieve acl will get applied to all interfaces on the device, you do not need to specify individual interfaces.&#xA;&lt;a href=&quot;http://www.brocade.com/content/html/en/configuration-guide/netiron-05900-securityguide/GUID-396A52CF-1805-4C4E-BBE5-EB4673931B01.html&quot; rel=&quot;nofollow&quot;&gt;http://www.brocade.com/content/html/en/configuration-guide/netiron-05900-securityguide/GUID-396A52CF-1805-4C4E-BBE5-EB4673931B01.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5764" LastActivityDate="2016-01-03T08:00:47.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25592" PostTypeId="1" CreationDate="2016-01-03T13:52:56.333" Score="2" ViewCount="1015" Body="&lt;p&gt;I am trying to understand encapsulation of OSI model, in general it is quite clear for me but I have one question.&lt;br&gt;&#xA;Please look on this picture &lt;a href=&quot;http://www.just2good.co.uk/images/gif/ethernetFrame.gif&quot; rel=&quot;nofollow&quot;&gt;http://www.just2good.co.uk/images/gif/ethernetFrame.gif&lt;/a&gt;&lt;br&gt;&#xA;Default ethernet frame. And this is good picture for my question. You can see that IP encapsulation is shown.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand &lt;code&gt;data&lt;/code&gt; part of &lt;code&gt;Ethernet frame&lt;/code&gt; is from 46 bytes to 1500 bytes length. This mean that for upper layer protocol there is only 1500-46 = 1454 bytes. Okay. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is : this all means that packet size decreasing according with level number, I mean that network layer have packet size &amp;lt; link layer And so on, because of encapsulation &lt;code&gt;data&lt;/code&gt; part of packet is decreasing, am I right ? &#xA;But why I have found that TCP packet size is for example 64kBytes !!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is it possible if we have &lt;code&gt;1454 bytes&lt;/code&gt; for data (minus headers of upper layer) on the &lt;code&gt;data link layer&lt;/code&gt; ?????   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please explain this for me, I would be very grateful.&lt;/p&gt;&#xA;" OwnerUserId="21731" LastActivityDate="2016-01-03T17:51:18.320" Title="OSI model encapsulation" Tags="|ethernet|tcp|ip|osi|data|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25594" PostTypeId="1" AcceptedAnswerId="25595" CreationDate="2016-01-03T14:44:50.533" Score="2" ViewCount="4513" Body="&lt;p&gt;I was experimenting with some of the network monitoring commands in cmd and I noticed that there's a significant difference in the number of hops in the output of &lt;em&gt;tracert&lt;/em&gt; for different hosts. For example, when I tried to trace a packet to the Google server, the destination was reached within 4 hops. Then when I did the same thing for Pastebin, I got 15. Can someone please explain why this is so? Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PQuPD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PQuPD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21733" LastEditorUserId="8499" LastEditDate="2018-02-14T16:58:33.910" LastActivityDate="2018-05-28T18:43:21.903" Title="Difference in number of hops in Traceroute" Tags="|traceroute|next-hop|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25595" PostTypeId="2" ParentId="25594" CreationDate="2016-01-03T15:11:04.140" Score="2" Body="&lt;p&gt;The answer is simply that different hosts are on different networks, as @radhil says, and you have to take longer paths to get there.  Different providers have their own rules about whose traffic they are willing to carry, so the path you take may be chosen for business reasons, not necessarily because it's the shortest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try running the &lt;code&gt;tracert&lt;/code&gt; command without the &lt;code&gt;-d&lt;/code&gt; option (not to perform a DNS lookup on each IP address, &lt;code&gt;-n&lt;/code&gt; on &lt;code&gt;tcptraceroute&lt;/code&gt; and &lt;code&gt;mtr&lt;/code&gt;), and you will see the different domains in the path.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="41711" LastEditDate="2018-05-28T18:43:21.903" LastActivityDate="2018-05-28T18:43:21.903" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25596" PostTypeId="2" ParentId="25592" CreationDate="2016-01-03T15:16:58.073" Score="2" Body="&lt;p&gt;The answer is simply that the TCP segment can be fragmented into many IP packets.  The Maximum Segment Size (mss) is the largest TCP segment that can fit into a single IP packet.  The size of the IP packet is limited by the Maximum Transmission Unit (MTU), which is dependent on the physical media.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-03T15:16:58.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25598" PostTypeId="1" AcceptedAnswerId="25600" CreationDate="2016-01-03T17:05:00.843" Score="0" ViewCount="99" Body="&lt;p&gt;Consider the following scenario:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;AP is an access point with internet connectivity and in idle state (ie: no node is connected to it)&lt;/li&gt;&#xA;&lt;li&gt;N is a node that wants to establish an internet connection through AP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1st Issue&lt;/strong&gt;&lt;br&gt;&#xA;What is the minimum amount of packets that they must exchange in order for N establish an internet connection? (ie: be able to use standard browsers and sockets api)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2nd Issue&lt;/strong&gt;&lt;br&gt;&#xA;What are the names of those packets? Briefly, what those packets do?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Motivation&lt;/strong&gt;&lt;br&gt;&#xA;Recently I've installed WinPcap to see what packets were being exchanged between my router and my computer. As soon as you connect to the router (ie: the user is not transferring any data), several hundreds of packets are transmitted. Here goes a small list of the first packets and their correspondent time + length:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;listening on Network adapter 'Microsoft' on local host...&#xA;14:27:46,534048 len:42&#xA;14:27:46,537764 len:346&#xA;14:27:46,541692 len:42&#xA;14:27:46,541694 len:590&#xA;14:27:46,541721 len:74&#xA;14:27:46,554746 len:149&#xA;14:27:46,555292 len:74&#xA;14:27:46,568235 len:90&#xA;14:27:46,568765 len:90&#xA;14:27:46,571916 len:42&#xA;14:27:46,586545 len:42&#xA;14:27:46,588601 len:90&#xA;14:27:46,589166 len:46&#xA;14:27:46,597994 len:87&#xA;14:27:46,598158 len:67&#xA;14:27:46,603153 len:62&#xA;14:27:46,695175 len:87&#xA;14:27:46,695301 len:67&#xA;14:27:46,833377 len:42&#xA;14:27:46,835398 len:42&#xA;14:27:46,837512 len:86&#xA;14:27:46,837756 len:66&#xA;14:27:46,892574 len:85&#xA;14:27:46,944622 len:86&#xA;14:27:46,944774 len:66&#xA;14:27:46,991309 len:42&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After some seconds, even without the user transferring any data, this list continues to grow even larger (some thousands of packets).&lt;/p&gt;&#xA;" OwnerUserId="20647" LastActivityDate="2016-01-03T18:12:43.997" Title="Packets for Internet Connection" Tags="|wireless|internet|lan|packet-analysis|access-point|" AnswerCount="2" CommentCount="0" ClosedDate="2016-01-04T03:14:23.103" ContentLicense="CC BY-SA 3.0" />
  <row Id="25599" PostTypeId="2" ParentId="25592" CreationDate="2016-01-03T17:05:27.453" Score="0" Body="&lt;p&gt;Besides Ron Trunk's answer, you are incorrect about the size of the layer-3 protocol. The ethernet payload (layer-3) can be a minimum of 46 bytes and a maximum of 1500 bytes, and I'm not sure why you are subtracting the minimum from the maximum to give the layer-3 protocol a maximum of 1454 bytes; it is 1500 bytes for maximum of the layer-3 protocol in an ethernet frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you have to look at the layer-3 protocol. IPv4 needs a minimum of 20 bytes for its header, but there are options which can increase that to 60 bytes. IPv6 uses a fixed 40 bytes for its header, although it can have option headers, too. Within the layer-3 protocol, the payload (layer-3) size can vary based on the header size of the layer-3 protocol (1500 bytes - layer-3 header size).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-4 protocol will also have a header, so the payload it can deliver is further reduced (1500 bytes - layer-3 header size - layer-4 header size). The point of the layer-4 protocol is that it is the end-to-end protocol that applications use. An application can give a large datagram to the layer-4 protocol, and the layer-4 protocol handles breaking it into chunks (segments) to transmit, and reassembling the received segments on the other end into the original, large datagram to present to the receiving application. Depending on the layer-4 protocol, this may or may not be guaranteed to work. For instance, TCP guarantees to reassemble a complete datagram for the receiving application, but UDP does not.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-03T17:51:18.320" LastActivityDate="2016-01-03T17:51:18.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25600" PostTypeId="2" ParentId="25598" CreationDate="2016-01-03T17:25:03.477" Score="2" Body="&lt;p&gt;Wi-Fi has a several types of frames used for management:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Association request frames&lt;/li&gt;&#xA;&lt;li&gt;Association response frames&lt;/li&gt;&#xA;&lt;li&gt;Authentication frames&lt;/li&gt;&#xA;&lt;li&gt;Beacon frames&lt;/li&gt;&#xA;&lt;li&gt;Deauthentication frames&lt;/li&gt;&#xA;&lt;li&gt;Disassociation frames&lt;/li&gt;&#xA;&lt;li&gt;Probe request frames&lt;/li&gt;&#xA;&lt;li&gt;Probe response frames&lt;/li&gt;&#xA;&lt;li&gt;Reassociation request frames&lt;/li&gt;&#xA;&lt;li&gt;Reassociation response frames&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Wi-Fi also has a few types of frames used for control:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Request to Send (RTS) frames&lt;/li&gt;&#xA;&lt;li&gt;Clear to Send (CTS) frames&lt;/li&gt;&#xA;&lt;li&gt;Acknowledgement (ACK) frames&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Of course, the point of Wi-Fi is to transmit data, so there are also&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Data Frames.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A discussion of all these frames and how they are used can take several chapters in books, so it it too broad to discuss here. You should search for &quot;Wi-Fi frame types&quot; using Google to find full explanations of how it all works.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-03T17:25:03.477" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25601" PostTypeId="1" AcceptedAnswerId="25602" CreationDate="2016-01-03T17:30:11.723" Score="2" ViewCount="2705" Body="&lt;p&gt;It's a simple question, with switch interfaces using etherchannel,is necessary to use &lt;code&gt;bpduguard&lt;/code&gt; in these interfaces for that disable Spanning-tree? Because using mode simulation of Packet Tracer, I can see STP Packet coming and going between the links.&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="8499" LastEditDate="2018-12-22T21:11:47.960" LastActivityDate="2018-12-22T21:11:47.960" Title="Link aggregation: disable spanning tree" Tags="|cisco|switch|spanning-tree|packet-tracer|etherchannel|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25602" PostTypeId="2" ParentId="25601" CreationDate="2016-01-03T17:43:46.290" Score="2" Body="&lt;p&gt;Etherchannel has a way of fooling STP into thinking all the interfaces in a bundle are a single interface, and the etherchannel handles the STP, so you don't want to disable, or mess with, STP on etherchannels since it takes care of STP for you, and you risk creating loops if you change STP on an etherchannel. It is the same thing for an etherchannel bundle as it would be for any interface connecting to another switch: disabling STP can have very bad consequences.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-03T17:43:46.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25603" PostTypeId="2" ParentId="25598" CreationDate="2016-01-03T18:12:43.997" Score="1" Body="&lt;p&gt;On a Windows PC, odds are you are not capturing the Wi-Fi control frames -- most Wi-Fi drivers don't let you switch to &quot;monitor mode.&quot;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The average number of control frames you need is three to five.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under that assumption, the large number of packets you are seeing are seeing various process on your PC making connections to various servers.   A lot depends on the software you have on your PC.  Depending on the version, Windows might check for a valid license, software update, etc.  It also probes MS servers to see if in fact you do have Internet connectivity. Your antivirus might also do check for updates.  Email and cloud services like Dropbox can also start connections when there is Internet connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A full discussion of those applications would be better suited for Superuser, as operating systems and applications are off-topic here.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-03T18:12:43.997" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="25604" PostTypeId="1" AcceptedAnswerId="25610" CreationDate="2016-01-03T19:28:45.703" Score="11" ViewCount="20755" Body="&lt;p&gt;Is there a way to find out a computer's MAC address if we know its IP address, assuming this computer is outside our LAN? I know we can easily get the physical address of a computer in our LAN using &lt;em&gt;getmac&lt;/em&gt; or &lt;em&gt;arp&lt;/em&gt; in command prompt, but these commands don't work for other remote hosts.&lt;/p&gt;&#xA;" OwnerUserId="21733" LastEditorUserId="8499" LastEditDate="2019-01-12T17:18:18.083" LastActivityDate="2019-01-12T17:18:18.083" Title="Find MAC address of a remote computer using IP" Tags="|ip|ipv4|mac-address|arp|ip-address|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25605" PostTypeId="2" ParentId="25604" CreationDate="2016-01-03T19:37:15.323" Score="9" Body="&lt;p&gt;No. MAC addresses only have significance on a LAN. Different LAN types have difference kinds of MAC addresses. Knowing the MAC address of a host on a different LAN is meaningless.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-03T19:37:15.323" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25609" PostTypeId="1" CreationDate="2016-01-04T02:13:50.510" Score="2" ViewCount="562" Body="&lt;p&gt;I need to support between 50 and 100 simultaneous wireless clients that use a wide variety of devices, from smartphones to laptops, and the primary network load is full-screen streaming video.  My current intention is to use up to 3 access points on non-overlapping channels that use the same SSID, WPA2 config, etc.  The APs and the media server are on a wired gigabit LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since the coverage area is relatively small and the population density is very high (similar to a crowded cafeteria), the access points will likely be co-located.  Even if separated from each other as much as possible, the difference in signal strength between the access points will be negligible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If at all possible, I want to be able to use the same SSID for each AP, however most of the articles and recommendations I have read related to the use of multiple APs leave it to the client devices/drivers to decide when to roam to another AP, and my understanding is the driver decides this based solely on signal strength.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I be searching for (keyword, protocol, etc) in order to find out how to set up access points that are able to load balance based on their individual network utilization, or the bandwidth usage by associated clients?  By load balance, I mean the APs themselves initiate a &quot;forced-roam&quot;, bumping clients from an AP with more load to another AP with less load, if there is such a thing.  If this capability exists with DD-WRT or OpenWRT, that would be my target.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate any suggestions or recommendations, thanks!&lt;/p&gt;&#xA;" OwnerUserId="21742" LastActivityDate="2016-01-04T09:35:16.820" Title="Using co-located wireless access points to maximize client bandwidth" Tags="|wireless|access-point|load-balancer|" AnswerCount="1" CommentCount="4" ClosedDate="2016-01-10T18:09:25.770" ContentLicense="CC BY-SA 3.0" />
  <row Id="25610" PostTypeId="2" ParentId="25604" CreationDate="2016-01-04T03:21:05.430" Score="10" Body="&lt;p&gt;Getting a MAC address requires the ability to get broadcast traffic.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP is a broadcast protocol and is therefore only available on a LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once traffic is routed you are unable to get the MAC address as it is stripped from the packet once it crosses the boundary of a router/L3 device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches have a MAC table.&#xA;Routers have a routing table, in general.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can only get MAC addresses from a LAN.&lt;/p&gt;&#xA;" OwnerUserId="13479" LastActivityDate="2016-01-04T03:21:05.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25611" PostTypeId="2" ParentId="1505" CreationDate="2016-01-04T04:30:43.457" Score="0" Body="&lt;p&gt;It depends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an otherwise idle network it depends on whether the switching devices are &quot;store and forward&quot; or &quot;cut through&quot;. If the switching devices are store and forward then faster links will mean lower latency. However if they support cut-through switching then extra latency will be introduced as it is not possible to do cut through switching from a slower incoming link to a faster outgoing link. However unless you are playing in the high frequency trading world or similar this is likely to be negligable either way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a practical network having more capacity in the core decreases the chance that congestion from other users will be encountered. Congestion drives throughput down and latency up.  In general it is good if your core links are faster than your end user links so no one end user can saturate them (so if you are running gigabit to the desktop you should probablly be running a 10 gigabit core). &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-05-19T13:24:14.973" LastActivityDate="2016-05-19T13:24:14.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25612" PostTypeId="2" ParentId="25609" CreationDate="2016-01-04T09:35:16.820" Score="1" Body="&lt;p&gt;You &lt;em&gt;must&lt;/em&gt; use a controller based system for this. Multiple autonomous access-points are completely independent -- &quot;roaming&quot; doesn't happen; clients disassociate with one AP and associate with a new one. Roaming requires information be exchanged between APs. That means a wireless lan controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way to deploy this is via a number of sector antennas that divide the room into a series of pie slices. (this is how some ubiquiti APs do it.) The other common method is ceiling mounted &quot;cones&quot;. (DirecTV &quot;spot beams&quot; on a much smaller scale.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't listen to Ron. Multicast is suicide. In wireless, multicast is broadcast. As such, it's transmit at &lt;em&gt;basic rate&lt;/em&gt; -- which is the common rate that can be reliably received by &lt;em&gt;every&lt;/em&gt; client associated with the AP. That crappy tablet with a complete s*** radio on the far end of the cafeteria drags the entire network down to 1.1Mbps. Many APs allow tweaking of the basic-rates, but that will significantly reduce the usable range of the AP but not reduce the actual signal range. (you'd just be making a much noisier environment.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-04T09:35:16.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25613" PostTypeId="1" AcceptedAnswerId="25614" CreationDate="2016-01-04T11:13:21.013" Score="16" ViewCount="71255" Body="&lt;p&gt;Can somebody describe me what does &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;logging synchronous&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;command do ?&lt;/p&gt;&#xA;" OwnerUserId="21408" LastEditorUserId="498" LastEditDate="2016-01-06T03:57:19.657" LastActivityDate="2019-08-07T06:08:09.350" Title="What does logging synchronous command do?" Tags="|cisco|cisco-commands|logging|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25614" PostTypeId="2" ParentId="25613" CreationDate="2016-01-04T12:07:20.533" Score="18" Body="&lt;p&gt;&quot;logging synchronous&quot; prevents every logging output from immediately interrupting your console session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See command documentation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;This keeps unsolicited messages and debug output from being interspersed with solicited software output and prompts.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_l1.html#wp1020534&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_l1.html#wp1020534&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-04T12:07:20.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25615" PostTypeId="2" ParentId="24981" CreationDate="2016-01-04T12:23:44.970" Score="1" Body="&lt;p&gt;Please notice the control plane processing (BGP) runs asynchronously from the data plane forwarding. For BGP, because 192.0.0.0/25 prefix is distinct from 192.0.0.0/24, the protocol won't even try to choose between those prefixes, so both prefixes will be sent for the forwarding plane. At forwarding time, of course the longest prefix is going to take precedence for packet switching decision.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-04T12:23:44.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25616" PostTypeId="2" ParentId="23071" CreationDate="2016-01-04T12:25:00.033" Score="1" Body="&lt;p&gt;OpenFlow specifically - but also generally applicable to all of SDN - doesn't change anything about how your physical device forwards packets.  The hardware is the same, and the pipeline that already existed on that device is unchanged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What OpenFlow &lt;em&gt;does&lt;/em&gt; is move the logic for programming the packet matches and actions from on the device itself (the local firmware), to a process that is running on a different device, which may have a view of more than one network element (and thus may be able to make better decisions with a better view of the world - or not).  So, while you may configure network routing at a single controller, the controller is then distributing that information to a lot of devices to do what they have always done - match, modify, and forward packets.&lt;/p&gt;&#xA;" OwnerUserId="653" LastActivityDate="2016-01-04T12:25:00.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25617" PostTypeId="2" ParentId="24161" CreationDate="2016-01-04T12:47:07.767" Score="2" Body="&lt;p&gt;The &lt;em&gt;Controller&lt;/em&gt; doesn't do anything right away - it does not know this event has occurred.  The initial decision to be made has to be made by the device that received the packet it can't match.  It &lt;em&gt;may&lt;/em&gt; decide (due to configuration) to send that packet to the Controller, but simple math indicates that this doesn't scale (the management interface is very slow compared to the aggregate front-panel throughput of the device) and so by default unmatched packets are dropped.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the device sends the packet to the Controller (or, more likely, just the first hundred bytes or so) then of course the Controller is free to do anything it likes with this data.&lt;/p&gt;&#xA;" OwnerUserId="653" LastActivityDate="2016-01-04T12:47:07.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25618" PostTypeId="1" CreationDate="2016-01-04T13:55:42.830" Score="4" ViewCount="5945" Body="&lt;p&gt;I could not find much information on option 26 ( MTU ) from the &lt;a href=&quot;https://www.ietf.org/rfc/rfc2132.txt&quot; rel=&quot;nofollow&quot;&gt;https://www.ietf.org/rfc/rfc2132.txt&lt;/a&gt;, I learned the bellow 2 points from the blog &lt;a href=&quot;http://www.microhowto.info/howto/change_the_mtu_of_a_network_interface_using_dhcp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.microhowto.info/howto/change_the_mtu_of_a_network_interface_using_dhcp.html&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Since the MTU of all interfaces in a given subnet should normally be the same, it is best to set this option on a per-subnet basis where possible.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In all cases, the setting will not take effect on a client until its DHCP lease is renewed. You can force this by taking the interface down then bringing it back up again:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is the point 1 standardized or it's a common implementation ?&#xA;Does the design should be w.r.t  Subnet instead of interface ?&#xA;Does the design should be like, any changes w.r.t subnet, DHCP Server should check whether the particular option ( 26, as Admin can configure at any point of time) been configured ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the point-2 w.r.t client, is there any other event from client that can trigger the MTU changes like DHCP-Inform ?&lt;/p&gt;&#xA;" OwnerUserId="10748" LastActivityDate="2017-07-28T06:19:32.920" Title="DHCP Option 26 (MTU) queries" Tags="|dhcp|mtu|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-11T01:55:44.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="25620" PostTypeId="2" ParentId="25613" CreationDate="2016-01-04T16:02:15.050" Score="-2" Body="&lt;p&gt;It is for disable synchronization of unsolicited messages and debug output&lt;/p&gt;&#xA;" OwnerUserId="21749" LastActivityDate="2016-01-04T16:02:15.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25621" PostTypeId="2" ParentId="25618" CreationDate="2016-01-04T16:04:12.593" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;The &lt;em&gt;configuration&lt;/em&gt; in the DHCP server is by subnet (by developer&#xA;choice, but also the easiest thing to do unambiguously), but the MTU&#xA;option applies to the &lt;em&gt;interface&lt;/em&gt; the client receives it on. &#xA;Obviously there are cases where there might be contention here, so&#xA;what the client does if it receives competing information on the&#xA;same interface is left to the end host to resolve (if they are on&#xA;different VLANs, then the MTU can often be set per-VLAN, but there&#xA;are other more complex corner cases).&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There is a &lt;code&gt;FORCERENEW&lt;/code&gt; message that your DHCP server can issue to&#xA;clients:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ietf.org/rfc/rfc3203.txt&quot; rel=&quot;nofollow&quot;&gt;https://www.ietf.org/rfc/rfc3203.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your clients have to support this mechanism, of course.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="653" LastEditorUserId="8499" LastEditDate="2016-04-03T18:03:27.107" LastActivityDate="2016-04-03T18:03:27.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25622" PostTypeId="2" ParentId="6077" CreationDate="2016-01-04T16:28:33.853" Score="0" Body="&lt;p&gt;Conventional multihoming means a single network with multiple links. That network may be confined to a single datacenter, it may span the globe or anywhere in between. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing the same IP to multiple different servers such that each packet arrives at one of those servers is known as &quot;anycast&quot;. This is possible either with seperate networks at each site, a single network that spans all sites or combinations of the above. The advantage of having all sites on a single network is it gives you more flexibility, on the public internet there are restrictions on the size of blocks you can advertise (for ipv4 it's a minimum of /24, for IPv6 things are more complex) while within your own network you can route individual IPs if you so desire. Having your own global network can also improve service quality even for servers you don't intend to anycast because it can put you in control of a greater proportion of the network path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general anycast works well for stateless UDP based request/response protocols. Protocols that establish a communications session (including anything that uses TCP) are more problematic as internet routing can change. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A soloution for this is to use anycast for the initial contact but then move to a regular unicast IP to continue the session. A common approach to doing this is to use anycast for the DNS server but not for the actual service. The downside of the DNS approach is that sometimes the DNS resolver may use different routes to the internet from the client.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-01-04T16:28:33.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25625" PostTypeId="1" CreationDate="2016-01-04T18:10:24.937" Score="5" ViewCount="957" Body="&lt;p&gt;I am not sure if I can ask this question on this website, since this is my first question here and I am not familiar with the kind of questions that can be asked here, but it is about a routing algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was reading about the link-state routing algorithm, and in particular I was reading about the reverse-path broadcast, where it says:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Every router forwards a broadcast packet to every adjacent router, except the one where it received the packet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A router u accepts a broadcast packet p originating at router s only if p arrives on the link that is on the direct (unicast) path from u to s.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My problem is related to the second point: I don't understand what a unicast path from u to s would be. Could you please explain it to me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am also not understanding why the second point would solve the problems of having cycles in the network.&lt;/p&gt;&#xA;" OwnerDisplayName="user16355" LastActivityDate="2016-05-03T22:01:10.987" Title="How does exactly reverse-path broadcast work?" Tags="|routing|broadcast|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25627" PostTypeId="1" CreationDate="2016-01-04T20:30:17.000" Score="4" ViewCount="2681" Body="&lt;p&gt;I am trying to configure DHCP Server on a Cisco 2960-X switch to achieve port-based address allocation. I would like the IP address assigned to any device connected to that port to be the same every time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have used the following guide to achieve this: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swdhcp82.html#wp1320905&quot; rel=&quot;nofollow&quot;&gt;Configuring DHCP Features and IP Source Guard&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The commands used are explained in detail here: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr/command/ipaddr-cr-book.pdf&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS IP Addressing Services Command Reference&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried various iterations of the following command to find something that works: &lt;code&gt;address ip-address client-id string [ascii]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am not sure about is the string after &lt;code&gt;client-id&lt;/code&gt;. Does it have to match your interface name? If not how does the DHCP server know which interface to relate the assigned IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my running-config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;otg#show vlan&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                          active    Gi1/0/1, Gi1/0/3, Gi1/0/4&#xA;                                                Gi1/0/5, Gi1/0/6, Gi1/0/7&#xA;                                                Gi1/0/8, Gi1/0/9, Gi1/0/10&#xA;                                                Gi1/0/11, Gi1/0/12, Gi1/0/13&#xA;                                                Gi1/0/14, Gi1/0/15, Gi1/0/16&#xA;                                                Gi1/0/17, Gi1/0/18, Gi1/0/19&#xA;                                                Gi1/0/20, Gi1/0/21, Gi1/0/22&#xA;                                                Gi1/0/23, Gi1/0/24, Gi1/0/25&#xA;                                                Gi1/0/26, Gi1/0/27, Gi1/0/28&#xA;2    VLAN0002                         active    Gi1/0/2&#xA;140  VLAN0140                         active&#xA;1002 fddi-default                     act/unsup&#xA;1003 token-ring-default               act/unsup&#xA;1004 fddinet-default                  act/unsup&#xA;1005 trnet-default                    act/unsup&#xA;&#xA;VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2&#xA;---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------&#xA;1    enet  100001     1500  -      -      -        -    -        0      0&#xA;2    enet  100002     1500  -      -      -        -    -        0      0&#xA;&#xA;VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2&#xA;---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------&#xA;140  enet  100140     1500  -      -      -        -    -        0      0&#xA;1002 fddi  101002     1500  -      -      -        -    -        0      0&#xA;1003 tr    101003     1500  -      -      -        -    -        0      0&#xA;1004 fdnet 101004     1500  -      -      -        ieee -        0      0&#xA;1005 trnet 101005     1500  -      -      -        ibm  -        0      0&#xA;&#xA;Remote SPAN VLANs&#xA;------------------------------------------------------------------------------&#xA;&#xA;&#xA;Primary Secondary Type              Ports&#xA;------- --------- ----------------- ------------------------------------------&#xA;&#xA;---------------------------------------------------------------------------------------------------------------------&#xA;&#xA;otg#show ip dhcp pool&#xA;&#xA;Pool otgpool :&#xA; Utilization mark (high/low)    : 100 / 0&#xA; Subnet size (first/next)       : 0 / 0&#xA; Total addresses                : 254&#xA; Leased addresses               : 0&#xA; Excluded addresses             : 1&#xA; Pending event                  : none&#xA; 1 subnet is currently in the pool :&#xA; Current index        IP address range                    Leased/Excluded/Total&#xA; 192.168.100.1        192.168.100.1    - 192.168.100.254   0     / 1     / 254&#xA; 1 reserved address is currently in the pool :&#xA; Address          Client&#xA; 192.168.100.100  Gi1/0/2&#xA;&#xA;---------------------------------------------------------------------------------------------------------------------&#xA;&#xA;otg#sh run&#xA;Building configuration...&#xA;&#xA;&#xA;Current configuration : 4058 bytes&#xA;!&#xA;! Last configuration change at 06:04:30 UTC Tue Jan 5 2016&#xA;! NVRAM config last updated at 23:29:56 UTC Mon Jan 4 2016&#xA;!&#xA;version 15.0&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname otg&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$43Kk$SyzqQc5biarBjD2TD9Hw0/&#xA;enable password otgswitch&#xA;!&#xA;no aaa new-model&#xA;clock timezone UTC -5 0&#xA;clock summer-time UTC recurring&#xA;switch 1 provision ws-c2960x-24ts-l&#xA;ip dhcp use subscriber-id client-id&#xA;ip dhcp subscriber-id interface-name&#xA;!&#xA;ip dhcp pool otgpool&#xA; network 192.168.100.0 255.255.255.0&#xA; default-router 192.168.100.1&#xA; reserved-only&#xA;   address 192.168.100.100 client-id &quot;Gi1/0/2&quot; ascii&#xA;!&#xA;!&#xA;!&#xA;!&#xA;crypto pki trustpoint TP-self-signed-1160303744&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-1160303744&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-1160303744&#xA;!&#xA;!&#xA;crypto pki certificate chain TP-self-signed-1160303744&#xA; certificate self-signed 01&#xA;  3082022B 30820194 A0030201 02020101 300D0609 2A864886 F70D0101 05050030&#xA;  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274&#xA;  69666963 6174652D 31313630 33303337 3434301E 170D3136 30313035 30343239&#xA;  35365A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649&#xA;  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D31 31363033&#xA;  30333734 3430819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281&#xA;  810081CE C80CB939 C1722AA5 E3167E22 23DE4A5F EBB8168C 0DEF4392 F4624590&#xA;  11282956 58E0A473 806BBC5E 65E228F4 8FF553ED B1A07A46 CBBC80BA 22C16838&#xA;  11EEFA3B 9CD7290D D79CAEDC 4F259F57 8F30CC84 6125CD18 90917913 ECE9B8BA&#xA;  DE9F2BDC 21F62BCC 424D5D19 8FEEE8F5 E5A86568 DAF3EE8A 4CD5BE74 63E14AED&#xA;  C9BB0203 010001A3 53305130 0F060355 1D130101 FF040530 030101FF 301F0603&#xA;  551D2304 18301680 14E50E89 9DFB34B0 F88C367D D1DFE392 1849468B BC301D06&#xA;  03551D0E 04160414 E50E899D FB34B0F8 8C367DD1 DFE39218 49468BBC 300D0609&#xA;  2A864886 F70D0101 05050003 81810077 5FCAF4BC 7ABCDE2E 69FFB95E 1BBE6CE6&#xA;  584B0392 998CD1FB 226E9767 F400304B 36C1692F 54B4CF09 F461AE69 097E47F3&#xA;  64D8EB80 4CDB1E87 0FD375A7 DF45B8B0 72B6630E 5D29A00A 1679F321 CBED7B18&#xA;  370AC2D0 D8DD2DA5 AF7FECFD 44DE20D0 6D991B2F BFDA7E64 791ACC01 22031B34&#xA;  7C1FB7EC C2EAD9DC 45CB4261 00795F&#xA;        quit&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; description cart2&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; switchport port-security maximum 2&#xA; switchport port-security&#xA; ip dhcp server use subscriber-id client-id&#xA; storm-control broadcast level 10.00&#xA; storm-control multicast level 10.00&#xA; spanning-tree portfast&#xA; spanning-tree bpduguard enable&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA;!&#xA;interface GigabitEthernet1/0/5&#xA;!&#xA;interface GigabitEthernet1/0/6&#xA;!&#xA;interface GigabitEthernet1/0/7&#xA;!&#xA;interface GigabitEthernet1/0/8&#xA;!&#xA;interface GigabitEthernet1/0/9&#xA;!&#xA;interface GigabitEthernet1/0/10&#xA;!&#xA;interface GigabitEthernet1/0/11&#xA;!&#xA;interface GigabitEthernet1/0/12&#xA;!&#xA;interface GigabitEthernet1/0/13&#xA;!&#xA;interface GigabitEthernet1/0/14&#xA;!&#xA;interface GigabitEthernet1/0/15&#xA;!&#xA;interface GigabitEthernet1/0/16&#xA;!&#xA;interface GigabitEthernet1/0/17&#xA;!&#xA;interface GigabitEthernet1/0/18&#xA;!&#xA;interface GigabitEthernet1/0/19&#xA;!&#xA;interface GigabitEthernet1/0/20&#xA;!&#xA;interface GigabitEthernet1/0/21&#xA;!&#xA;interface GigabitEthernet1/0/22&#xA;!&#xA;interface GigabitEthernet1/0/23&#xA;!&#xA;interface GigabitEthernet1/0/24&#xA;!&#xA;interface GigabitEthernet1/0/25&#xA;!&#xA;interface GigabitEthernet1/0/26&#xA;!&#xA;interface GigabitEthernet1/0/27&#xA;!&#xA;interface GigabitEthernet1/0/28&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.200.245 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; ip address 192.168.100.254 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;ip default-gateway 192.168.100.1&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;banner motd ^Cto #&#xA;Welco^C&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; password otgswitch&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then enabled DHCP debug messages and here is what I receive:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jan 4 02:55:49.112: DHCPD: Reload workspace interface Vlan1 tableid 0.&#xA;Jan 4 02:55:49.112: DHCPD: tableid for 192.168.200.245 on Vlan1 is 0&#xA;Jan 4 02:55:49.112: DHCPD: client's VPN is .&#xA;Jan 4 02:55:49.112: DHCPD: using subscriber-id as client-id&#xA;Jan 4 02:55:49.112: DHCPD: using received relay info.&#xA;Jan 4 02:55:49.112: DHCPD: DHCPDISCOVER received from client 0047.6931.2f30.2f on interface Vlan1.&#xA;Jan 4 02:55:49.112: DHCPD: using received relay info.&#xA;&#xA;otg#show ip dhcp binding&#xA;Bindings from all pools not associated with VRF:&#xA;IP address          Client-ID/              Lease expiration        Type&#xA;                    Hardware address/&#xA;                    User name&#xA;192.168.100.1       0047.6931.2f30.2f       Jan 09 2016 04:53 AM    Automatic&#xA;192.168.100.5       0047.6931.2f30.2f32     Infinite                Manual&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Above we can see that the client id received by dhcp is off by 32 from what we reserved. address 192.168.100.5 client-id Gi1/0/2 ascii&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please advise on what I might be doing wrong. Would appreciate your help.&lt;/p&gt;&#xA;" OwnerUserId="21754" LastEditorUserId="21754" LastEditDate="2016-01-08T20:12:04.307" LastActivityDate="2021-10-01T17:51:40.740" Title="DHCP Server Port-Based Address Allocation on Cisco switch 2960-x" Tags="|cisco|switch|ipv4|cisco-ios|dhcp|" AnswerCount="3" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="25628" PostTypeId="1" CreationDate="2016-01-04T20:30:33.350" Score="2" ViewCount="64" Body="&lt;p&gt;GOOD EVENING PEOPLE :D&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is the differentiate between &lt;strong&gt;Basedband&lt;/strong&gt; &amp;amp; &lt;strong&gt;Broadband&lt;/strong&gt; transmission ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21753" LastActivityDate="2016-01-04T23:15:41.567" Title="Transmission of Data" Tags="|ipv6-transition|" AnswerCount="2" CommentCount="0" ClosedDate="2016-01-19T06:23:41.500" ContentLicense="CC BY-SA 3.0" />
  <row Id="25629" PostTypeId="2" ParentId="25625" CreationDate="2016-01-04T20:37:48.417" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My problem is related to the second point: I don't understand what a&#xA;  unicast path from u to s would be. Could you please explain it to me?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Unicast reverse path usually means:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Record the input interface I for the packet&lt;/li&gt;&#xA;&lt;li&gt;Take the packet IP source address A1&lt;/li&gt;&#xA;&lt;li&gt;Look up nexthop for address A1 in the unicast routing table&lt;/li&gt;&#xA;&lt;li&gt;Check the nexthop's output interface matches the input interface I&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I am also not understanding why the second point would solve the problems of having cycles in the network.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Unicast reverse path checking relies on correct UNICAST routing tables.&#xA;Correct unicast routing tables are loop-free.&#xA;Unicast routing tables provide a loop-free topology from every router towards the broadcast source address (A1).&#xA;Unicast reverse path checking ensures broadcast packets only will be accepted within the loop-free topology rooted at A1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also: &lt;a href=&quot;https://en.wikipedia.org/wiki/Reverse_path_forwarding&quot; rel=&quot;nofollow&quot;&gt;Reverse path forwarding&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-01-04T20:50:09.133" LastActivityDate="2016-01-04T20:50:09.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25630" PostTypeId="2" ParentId="25628" CreationDate="2016-01-04T20:53:47.477" Score="2" Body="&lt;p&gt;Baseband refers to a transmission which uses all the bandwidth of a medium (encoded directly on the wire), while broadband means that a transmission only uses part of the bandwidth of a medium (multiple signals can be sent at the same time, modulated on a carrier wave).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of baseband is one of the ethernet variants with &quot;BASE&quot; in the name, such as 10BASE-T. Only one frame can be transmitted at a time on one link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of broadband is cable TV/Internet. Multiple signals are traveling on one link simultaneously. Also, there was a version of ethernet using broadband called 10BROAD-36.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One caveat is that the government (FCC) has redefined broadband to mean any network signal over an arbitrary speed (I believe the threshold was originally 200 Kbps, but is now 25 Mbps).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-04T22:16:33.933" LastActivityDate="2016-01-04T22:16:33.933" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25632" PostTypeId="2" ParentId="25628" CreationDate="2016-01-04T23:15:41.567" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Baseband&quot; rel=&quot;nofollow&quot;&gt;Baseband&lt;/a&gt; means any signal that isn't modulated to carrier, or multiplexed with other signals. It's the &quot;base&quot; signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Broadband&quot; rel=&quot;nofollow&quot;&gt;Broadband&lt;/a&gt; is a wide bandwidth transmission, possibly modulated and multiplexed. It means pretty much exactly what the words &lt;em&gt;broad&lt;/em&gt; and &lt;em&gt;band&lt;/em&gt; mean. In the context of data communications it almost always means a large section of spectrum (&quot;bandwidth&quot;) divided into discrete channels -- DSL, WiFi, DOCSIS, etc.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-04T23:15:41.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25633" PostTypeId="2" ParentId="25627" CreationDate="2016-01-04T23:30:02.903" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;ip dhcp subscriber-id interface-name&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Automatically generate a subscriber identifier based on the &lt;strong&gt;short name&lt;/strong&gt; of the interface.&#xA;  A subscriber identifier configured on a specific interface takes precedence over this command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The keyword here is &lt;em&gt;short name&lt;/em&gt;. In the example, &quot;Et1/0&quot;. So, &quot;Ge1/0/4&quot;, etc. Yes, it's case sensitive.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-04T23:30:02.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25636" PostTypeId="1" CreationDate="2016-01-05T03:56:54.050" Score="3" ViewCount="396" Body="&lt;p&gt;I need to communicate for three sites through vpn. For below scenario,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JrgRD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JrgRD.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is possible to reach 10.33.209.xx/27 from 192.168.60.xx. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;please give any idea to communicate in three segment.&lt;/p&gt;&#xA;" OwnerUserId="20971" LastActivityDate="2017-08-28T02:37:09.000" Title="Ipsec site to site Vpn" Tags="|vpn|ipsec|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="25637" PostTypeId="1" CreationDate="2016-01-05T04:25:49.913" Score="2" ViewCount="65" Body="&lt;p&gt;What is meant by the sentence - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Loopback address is the highest IP address and this means that it is used by OSPF router to advertise the routing information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f 0/0 -- 192.168.45.4&#xA;f0/1 -- 192.168.34.4 &#xA;loopback 4.4.4.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this scenario, how can we say that the the loop back address - 4.4.4.4 is the highest IP address?&lt;/p&gt;&#xA;" OwnerUserId="19114" LastEditorUserId="8499" LastEditDate="2019-01-05T00:43:35.413" LastActivityDate="2019-01-05T00:43:35.413" Title="While configuring OSPF the router-Id has the highers ip address?" Tags="|cisco|routing|router|ospf|loopback|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25638" PostTypeId="2" ParentId="25637" CreationDate="2016-01-05T04:33:45.390" Score="1" Body="&lt;p&gt;It's not. You should really specifically set the OSPF router ID, but, if you don't, it will use highest IPv4 address of any loopback. If no loopbacks exist, it will use the highest IPv4 address of any active interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It prefers loopbacks since they never become disabled unless you manually disable them, so the router ID is less likely to change between router reloads. An OSPF router ID will not change until the router is reloaded, or the OSPF process is restarted.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-05T04:38:55.297" LastActivityDate="2016-01-05T04:38:55.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25641" PostTypeId="1" AcceptedAnswerId="25668" CreationDate="2016-01-05T06:38:39.213" Score="3" ViewCount="501" Body="&lt;p&gt;I have one Quagga router running on Ubuntu Trusty Tahr and I'm planning to install Lubuntu on a old laptop to turn it into a router. Will they ping each other? Thanks&lt;/p&gt;&#xA;" OwnerUserId="21054" LastEditorUserId="8499" LastEditDate="2019-01-04T19:46:16.757" LastActivityDate="2019-01-04T19:46:16.757" Title="Does quagga support cross-platform routing? (linux distros)" Tags="|routing|router|quagga|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25642" PostTypeId="2" ParentId="25641" CreationDate="2016-01-05T06:41:50.663" Score="7" Body="&lt;p&gt;Routing and network protocols are standardized. The Internet is vast heterogeneous network using routers, switches, servers, clients, etc. from many different vendors. Why would you think otherwise?&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-05T06:41:50.663" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25643" PostTypeId="1" AcceptedAnswerId="25647" CreationDate="2016-01-05T08:18:55.983" Score="9" ViewCount="3173" Body="&lt;p&gt;What is the advantage of Layer 3 switch over the Router ??&lt;/p&gt;&#xA;" OwnerUserId="21408" LastEditorUserId="8499" LastEditDate="2018-03-21T00:03:59.387" LastActivityDate="2018-03-21T00:03:59.387" Title="Advantage of layer 3 switch over Router" Tags="|switch|router|layer3|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25644" PostTypeId="2" ParentId="25643" CreationDate="2016-01-05T08:39:19.547" Score="0" Body="&lt;p&gt;You can't say that there is a &quot;advantage&quot; of a L3 switch, because it depends on the hardware and software of the device.&#xA;Generally speaking you would say that a Router, has more power in case of hardware, because it is designated to make routing decisions, but this still depends on the device.&lt;/p&gt;&#xA;" OwnerUserId="13421" LastActivityDate="2016-01-05T08:39:19.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25645" PostTypeId="1" AcceptedAnswerId="25648" CreationDate="2016-01-05T08:56:06.937" Score="2" ViewCount="390" Body="&lt;p&gt;I was told that after a collision, the first device that detects the collision and sends the JAM signal has somehow priority to send first after the collision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not believe that this is true and tried reading the IEEE 802.3 section 1 to find the details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But all I understand so far, is that after sending the JAM signal, the device tries again after a random time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My theory is that after the JAM signal ends, every device that is in the collision domain waits for a random time after which each device tries to send again. So there would not be any priority.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that any of you can clarify for me, if it is random who sends first after a collision or if any of the devices in the collision domain has any priority after a collision.&lt;/p&gt;&#xA;" OwnerUserId="21765" LastActivityDate="2016-01-05T09:24:21.873" Title="CSMA/CD who sends after collision?" Tags="|ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25646" PostTypeId="2" ParentId="25636" CreationDate="2016-01-05T09:12:49.433" Score="1" Body="&lt;p&gt;This is a so called hub and spoke configuration, if you are using Fortigate appliances, then you can follow this documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://cookbook.fortinet.com/hub-and-spoke-vpn-using-quick-mode-selectors/&quot; rel=&quot;nofollow&quot;&gt;http://cookbook.fortinet.com/hub-and-spoke-vpn-using-quick-mode-selectors/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/hub-and-spoke.115.01.html&quot; rel=&quot;nofollow&quot;&gt;http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/hub-and-spoke.115.01.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2542" LastActivityDate="2016-01-05T09:12:49.433" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25647" PostTypeId="2" ParentId="25643" CreationDate="2016-01-05T09:14:25.213" Score="11" Body="&lt;p&gt;In general, layer-3 switches move packets faster (near line rate) because everything they do is in hardware. They tend to be cheaper and cheaper to operate (power, personnel, etc.) vs. a comparable router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does come with significant limitations, however...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;reduced route table size&lt;/li&gt;&#xA;&lt;li&gt;no NAT&lt;/li&gt;&#xA;&lt;li&gt;no firewall and very limited security features&lt;/li&gt;&#xA;&lt;li&gt;limited routing protocol support, if any.&lt;/li&gt;&#xA;&lt;li&gt;possibly no IPv6 support at all (and that's not something that can be fixed with software) Granted that should be rare today. What I regularly see is IPv6 features substantially subtracting from IPv4 features.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Routers are predominantly designed to run routing protocols that regularly alter the path of traffic. They also handle numerous &lt;em&gt;high-touch&lt;/em&gt; features such as NAT, QoS, security, VRF, etc. Outside the high-end market, routers are partially or &lt;em&gt;totally&lt;/em&gt; software platforms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, it's easy to take a commodity PC with a few NICs, load linux on it, and *poof* it's a router. No matter how much you hit it with the spice-weasel, it'll never be a switch.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-05T09:14:25.213" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25648" PostTypeId="2" ParentId="25645" CreationDate="2016-01-05T09:24:21.873" Score="3" Body="&lt;p&gt;Your read of the spec is correct. After the random backoff period, the NIC is free to transmit again. The key to this working is everyone picks a different amount of time. Naturally, someone will pick a smaller number and be free to transmit first -- collision, thus, resolved. If a collision happens again, everyone pauses for a &lt;em&gt;longer&lt;/em&gt; random period. After several successive collisions, an &lt;em&gt;excessive collision&lt;/em&gt; error is raised and the packet is dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(This is all academic as nobody does half-duplex anymore. No one has made true hubs for decades.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-05T09:24:21.873" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25649" PostTypeId="2" ParentId="25627" CreationDate="2016-01-05T09:42:05.457" Score="1" Body="&lt;p&gt;Let my show you my confing, this is working. You need tree thinks to work it corrert:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1:&#xA;  &lt;code&gt;ip dhcp use subscriber-id client-id&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2: &#xA;  &lt;code&gt;ip dhcp pool Printers&#xA;   network 10.224.5.0 255.255.255.0&#xA;   default-router 10.224.5.1 &#xA;   reserved-only&#xA;   address 10.224.5.200 client-id &quot;Fa0/37&quot; ascii&#xA;   address 10.224.5.201 client-id &quot;Fa0/38&quot; ascii&#xA;   address 10.224.5.202 client-id &quot;Fa0/39&quot; ascii&#xA;   address 10.224.5.203 client-id &quot;Fa0/40&quot; ascii&#xA;   address 10.224.5.204 client-id &quot;Fa0/41&quot; ascii&#xA;   address 10.224.5.205 client-id &quot;Fa0/42&quot; ascii&#xA;   address 10.224.5.206 client-id &quot;Fa0/43&quot; ascii&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the most important is to have a virtal interface with IP address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3:&lt;br&gt;&#xA;     &lt;code&gt;interface Vlan140&#xA;     ip address 10.224.5.254 255.255.255.0&#xA;     no ip route-cache&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="21768" LastActivityDate="2016-01-05T09:42:05.457" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="25652" PostTypeId="1" CreationDate="2016-01-05T11:26:16.633" Score="0" ViewCount="1413" Body="&lt;p&gt;Secure connect &amp;amp; access across 2 separate LAN Subnets using PFSense/ Sophos?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following is an older diagram of a 2+1 level Small Business/ Startup + Co-working space, with recent expansion &amp;amp; need for integration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HKOwP.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HKOwP.gif&quot; alt=&quot;2 Suites in a Condo Building&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following changes &amp;amp; information have been outlined: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 CAT6 Networks/ LANs: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Level 3 &amp;amp; 4 LAN is integrated &amp;amp; maps off a Central Area (Green Area); which has the NAS&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ISP---WR1: Asus RT-N16 N Router w Tomato USB FW + HP ProCurve 24 GigE Managed SW + ... N/W Clients&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Look at &lt;strong&gt;adding a PfSense/ Sophos box&lt;/strong&gt; around here  &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Level 5 is a separate; a simpler &amp;amp; sparser LAN; recent expansion and sub-let&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ISP---WR3: D-Link DIR 816 + ... N/W Clients&lt;/code&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Each of the above units have their own ISP with their own Data Cap limits &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The Stuff in Green box to the upper right titled 'Load Balance ISPs' does not exist; It was the original plan that was never implemented&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;We plan to run CAT6 cable between Level 4 &amp;amp; 5, outside the building and maybe add some more cables + terminations, and maybe a Hub/ Switch inside Level 5 - &lt;em&gt;This is open/ flexible for now&lt;/em&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;We need to connect &amp;amp; give access to NAS &amp;amp; maybe MFC/ Printer/ Scanner from Level 6 LAN&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;2 possible connection &amp;amp; usage scenarios pop up in my head: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Option A:&lt;/strong&gt; Level 5 clients have Limited access purely to NAS &amp;amp; MFC; not be able to use Level 4 ISP Bandwidth&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Option B:&lt;/strong&gt; Level 5 &amp;amp; 4 clients be able to share/ switch over/ bond ISPs in some fashion? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Key Question:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;With &lt;strong&gt;Option A&lt;/strong&gt; &lt;em&gt;constraints&lt;/em&gt;, How can we &lt;strong&gt;Connect/ access across separate LAN Subnets in 2 Suites&lt;/strong&gt; in a building? &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Network Partitioning&lt;/li&gt;&#xA;&lt;li&gt;Addressing&lt;/li&gt;&#xA;&lt;li&gt;Physical Connections&lt;/li&gt;&#xA;&lt;li&gt;SubNets/ VLANs? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17163" LastEditorUserId="17163" LastEditDate="2016-01-08T06:06:25.113" LastActivityDate="2016-07-06T22:45:11.873" Title="Secure connect &amp; access across 2 separate LAN Subnets using PFSense/ Sophos?" Tags="|routing|vlan|nat|subnet|bridge|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25655" PostTypeId="1" AcceptedAnswerId="25674" CreationDate="2016-01-05T12:32:19.177" Score="2" ViewCount="4401" Body="&lt;p&gt;We are investigating some Communications issues between two sites connected via IPSec Tunnel running Cisco ASA on one side and Microtik on the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Cisco ASA we are seeing an alarmingly high number of &quot;pkts replay failed&quot; errors.  You will see the stats below show 257141 of these failures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried finding explanations for this counter using Google and Cisco searches but have not come up with anything helpful.  Can anybody shed some light on this error?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#pkts encaps: 18726388, #pkts encrypt: 18726388, #pkts digest: 18726388&#xA;#pkts decaps: 35568901, #pkts decrypt: 35568864, #pkts verify: 35568864&#xA;#pkts compressed: 0, #pkts decompressed: 0&#xA;#pkts not compressed: 18726388, #pkts comp failed: 0, #pkts decomp failed: 0&#xA;#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0&#xA;#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0&#xA;#TFC rcvd: 0, #TFC sent: 0&#xA;#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0&#xA;#pkts no sa (send): 0, #pkts invalid sa (rcv): 0&#xA;#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0&#xA;#pkts invalid prot (rcv): 0, #pkts verify failed: 0&#xA;#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0&#xA;#pkts invalid pad (rcv): 0,&#xA;#pkts invalid ip version (rcv): 0,&#xA;#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0&#xA;#pkts replay failed (rcv): 257141&#xA;#pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0&#xA;#pkts internal err (send): 0, #pkts internal err (rcv): 04&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running Cisco ASA 5545 with software version 9.1(2)&lt;/p&gt;&#xA;" OwnerUserId="2199" LastActivityDate="2016-01-06T01:47:56.840" Title="High number of &quot;pkts replay failed&quot; on Cisco ASA" Tags="|cisco-asa|vpn|ipsec|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25656" PostTypeId="2" ParentId="25643" CreationDate="2016-01-05T12:51:06.597" Score="5" Body="&lt;p&gt;Both &quot;layer-3 switch&quot; and &quot;router&quot; are essentially marketing terms - they have no definitive technical meaning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chances are that a &quot;layer-3 switch&quot; has more front-panel ports for cheaper than a &quot;router&quot;, with less support for protocols and table size, while both do all forwarding at line rate, but that's highly dependent on the specific hardware in question.&lt;/p&gt;&#xA;" OwnerUserId="653" LastActivityDate="2016-01-05T12:51:06.597" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25657" PostTypeId="1" CreationDate="2016-01-05T13:21:34.157" Score="2" ViewCount="236" Body="&lt;p&gt;I have set up a test machine on my dmz2 interface.  I need to access the inside VLAN configured on the core L3 which has a route from ASA to core L3. &#xA;Below is the basic configuration on the ASA :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I need to access from 172.25.36.10 (source DMZ2) to 172.26.119.x (inside LAN).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address &amp;lt;public ip&amp;gt; 255.255.255.224 &#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 172.26.72.2 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/2&#xA; description ASA DMZ 1&#xA; nameif DMZ1&#xA; security-level 50&#xA; ip address 172.25.43.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/4&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/5&#xA; description TEST_INT&#xA; nameif DMZ2&#xA; security-level 60&#xA; ip address 172.25.36.1 255.255.255.0 &#xA;!&#xA;access-list Test_DMZ standard permit host 172.25.36.10 &#xA;access-list DMZ2_RemoteTest extended permit ip object-group obj_172.25.36.0_24 object-group TiVo_NT &#xA;&#xA;access-group DMZ2_RemoteTest in interface DMZ2&#xA;route outside 0.0.0.0 0.0.0.0 164.164.95.33 1&#xA;route inside 172.25.33.12 255.255.255.255 172.26.72.1 1&#xA;route inside 172.25.33.52 255.255.255.255 172.26.72.1 1&#xA;route inside 172.25.35.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.78.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.88.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.90.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.94.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.96.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.102.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.104.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.108.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.110.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.112.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.114.0 255.255.254.0 172.26.72.1 1&#xA;route inside 172.26.119.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.142.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.148.0 255.255.255.0 172.26.72.4 1&#xA;route inside 172.26.150.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.156.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.157.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.158.0 255.255.255.0 172.26.72.4 1&#xA;route inside 172.26.162.0 255.255.254.0 172.26.72.4 1&#xA;route inside 172.26.166.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.168.0 255.255.255.0 172.26.72.4 1&#xA;route inside 172.26.172.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.174.0 255.255.255.0 172.26.72.1 1&#xA;route inside 172.26.178.0 255.255.255.0 172.26.72.1 1&#xA;route inside 192.168.105.0 255.255.255.0 172.26.72.3 1&#xA;route inside 192.168.123.15 255.255.255.255 172.26.72.1 1&#xA;route inside 192.168.123.230 255.255.255.255 172.26.72.1 1&#xA;route inside 192.168.149.0 255.255.255.0 172.26.72.1 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21775" LastEditorUserId="46246" LastEditDate="2022-11-18T20:14:47.880" LastActivityDate="2022-12-19T01:03:30.373" Title="Accessing inside VLANs from DMZ interface on a Cisco ASA" Tags="|cisco-asa|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25658" PostTypeId="1" AcceptedAnswerId="25660" CreationDate="2016-01-05T13:31:45.177" Score="5" ViewCount="1929" Body="&lt;p&gt;I'm trying to understand how routers make their routing decisions. This is what I'v come up with and I'd like to know whether I'm right or not:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;First check whether there is an entry in the routing table for that destination address.&lt;/li&gt;&#xA;&lt;li&gt;If there is none, send it to the default route.&lt;/li&gt;&#xA;&lt;li&gt;If there is one, make a longest-route-match, then check administrative distance and then metrics.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is that correct?&lt;/p&gt;&#xA;" OwnerUserId="21774" LastActivityDate="2016-01-05T14:05:35.127" Title="routing: understanding the default route vs. prefix length, administrative distance and metrics" Tags="|routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25659" PostTypeId="1" CreationDate="2016-01-05T13:35:17.783" Score="2" ViewCount="292" Body="&lt;p&gt;I'm pursuing the reason behind why routers add security to a domain of a server architecture and front-end HTTP and HTTPS servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Architecture:&lt;/strong&gt; Assume I get a static IP of 100.100.100.100 from an ISP and I set up the following in the server room: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; IP -&amp;gt; Server 1 (HTTP/HTTPS) &amp;lt;-LAN-&amp;gt; Switch(Server 2(Web App), Server 3(DB))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For serving all visitors, I close all ports not related to HTTP/HTTPS. So now, if I add a router between IP and server 1, which firewall rules will help me with respect to the security aspects of things? Does it just add another unnecessary level of complexity? Or am I mistaken and missing something huge here?&lt;/p&gt;&#xA;" OwnerUserId="19650" LastEditorUserId="20062" LastEditDate="2016-01-05T17:14:02.350" LastActivityDate="2017-03-01T12:16:33.910" Title="Does a router add security to front-end servers?" Tags="|router|security|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25660" PostTypeId="2" ParentId="25658" CreationDate="2016-01-05T13:46:18.603" Score="3" Body="&lt;pre&gt;&lt;code&gt;Is that correct?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to understand the difference between routing (control plane) e forwarding (data plane).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing builds the routing table by performing route selection from protocols like OSPF, BGP, static routes, so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Forwarding looks up packet destination by querying the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back to your question:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&quot;Metric&quot; usually is a parameter for selecting a route within routing process for SPECIFIC protocol.&lt;/li&gt;&#xA;&lt;li&gt;&quot;Administrative distance&quot; is a parameter for selecting a route among DISTINCT protocols.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Both &quot;metric&quot; and &quot;administrative distance&quot; lie in the control plane (routing). Thus, they are used to choose the best routes for BUILDING the routing table.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;&quot;Prefix length&quot;. Longest match first is a route lookup strategy of the data plane. For every received packet, the forwarding engine queries the routing table using the longest match algorithm in order to pick the best route FROM the routing table.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The &quot;default route&quot; can be seen just as the 'shortest prefix ever' (encompassing all other prefixes), useful as last resort option for the longest match lookup.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-01-05T14:05:35.127" LastActivityDate="2016-01-05T14:05:35.127" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="25661" PostTypeId="2" ParentId="1789" CreationDate="2016-01-05T15:39:29.127" Score="0" Body="&lt;p&gt;Check here: &lt;a href=&quot;https://supportforums.cisco.com/document/10046/how-copy-configuration-files-and-cisco-ios-routers-use-snmp&quot; rel=&quot;nofollow&quot;&gt;How to copy configuration files to and from the Cisco IOS routers that use SNMP&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Change &lt;code&gt;ccCopyProtocol&lt;/code&gt; to your desired transfer method:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;tftp&lt;/li&gt;&#xA;&lt;li&gt;ftp&lt;/li&gt;&#xA;&lt;li&gt;rcp&lt;/li&gt;&#xA;&lt;li&gt;scp&lt;/li&gt;&#xA;&lt;li&gt;sftp&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here’s a &lt;a href=&quot;http://www.rackbuzz.com/?p=128&quot; rel=&quot;nofollow&quot;&gt;bash script&lt;/a&gt; to automate configuration backups. &lt;/p&gt;&#xA;" OwnerUserId="21778" LastEditorUserId="8499" LastEditDate="2016-01-05T16:01:24.140" LastActivityDate="2016-01-05T16:01:24.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25662" PostTypeId="1" AcceptedAnswerId="25680" CreationDate="2016-01-05T15:47:31.950" Score="1" ViewCount="768" Body="&lt;p&gt;I'm having this webserver inside my network behind a firewall. I also have this VPS outside my network, which is publicly reachable. Now, I was wondering if it would be possible to tunnel a connection between these two via SSH so if people would go to my VPS with their webbrowsers they could see the content on my webserver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="21779" LastEditorUserId="8499" LastEditDate="2018-02-16T04:00:31.017" LastActivityDate="2018-02-16T04:00:31.017" Title="Tunneling HTTP request over SSH" Tags="|ssh|tunnel|proxy|" AnswerCount="1" CommentCount="0" ClosedDate="2019-01-19T00:03:08.503" ContentLicense="CC BY-SA 3.0" />
  <row Id="25663" PostTypeId="2" ParentId="25659" CreationDate="2016-01-05T15:56:45.060" Score="1" Body="&lt;p&gt;It's true that some people do what you suggest, but security should be layered. Under typical circumstances, you will probably have more ports open on your server since you will want to be able to connect to the server to maintain it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An external firewall helps protect the rest of your network, too, and it can provide secure connectivity for other devices. A firewall can have many rules, and dedicate its computing resources to protect your whole network, rather than burdening your server's processing, freeing your server to perform it's main processing task. There are also next generation firewalls which can look deeper into the traffic to recognize application-layer protocols, traffic patterns, malware, attacks, etc., and it helps to have a dedicated box for that. Intrusion detection and prevention are hot topics today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think about this: the bad guys will always find a way in if they are determined enough. Putting in layers of security will make their job more difficult, and you can make it difficult enough that you discourage all but the most determined. You have to weigh the risks with the resources that you are willing to put into securing your network. If you don't have much to lose, then it may not make much sense to spend a lot of time and money protecting it, but we are seeing more companies get into financial and legal trouble from data breaches (customers and governments are suing and even leveling criminal charges for data breaches).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-05T15:56:45.060" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25664" PostTypeId="2" ParentId="25643" CreationDate="2016-01-05T16:21:13.447" Score="1" Body="&lt;p&gt;It's all about the business requirement. To put an example, the Cisco Catalyst 3850 has a more rapid backplane than a Cisco ISR 2900 series router. Nevertheless, Cisco ISR's support way more media types than most other switches (Cisco). Some tangible hardware design of switches may actually be valuable (or not) for their use in particular conditions.&lt;/p&gt;&#xA;" OwnerUserId="21780" LastActivityDate="2016-01-05T16:21:13.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25665" PostTypeId="2" ParentId="25652" CreationDate="2016-01-05T16:27:08.120" Score="1" Body="&lt;p&gt;If I understand your question correctly (I'm not entirely sure I do), you can use routers between the two LANs to share route information, but each LAN could have its own default route to its respective ISP. That way, each LAN has a complete understanding of the networks in the other LAN and will route traffic destined for the other LAN to the other LAN instead of to the ISP on a default route. If you have overlapping addressing, there are NAT solutions to handle that, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably want to do that on the inside of the LAN firewalls, but you could also firewall between the LANs if they need to be protected from each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, as you say in the comments, you are going to us pfSense running on PCs as your routers, you will need to connect the two routers together (a direct link without a switch in between should work). You can either use static routing on each router to point to the networks on the other router (this doesn't scale, and network changes become more difficult), or you can run a routing protocol, probably OSPF, between the routers so that they share routes automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can run WAPs to give you the Wi-Fi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to make sure you have some sort of firewall between each PC running pfSense and the corresponding ISP. This can be a software firewall on the router/PCs, or, better, separate, dedicated firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This allows devices on each network access to the other network. You can restrict access between the networks with access lists on the router/PCs. Do this if you don't want all devices on each network able to access all devices on the other network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-07T19:11:27.970" LastActivityDate="2016-01-07T19:11:27.970" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25667" PostTypeId="1" AcceptedAnswerId="25671" CreationDate="2016-01-05T18:35:45.547" Score="5" ViewCount="2181" Body="&lt;p&gt;How fast data travel wirelessly than in metal? does both travel in the speed of light?&lt;/p&gt;&#xA;" OwnerUserId="21787" LastActivityDate="2018-03-19T10:46:06.850" Title="How fast data travel wirelessly than in metal?" Tags="|wireless|data|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25668" PostTypeId="2" ParentId="25641" CreationDate="2016-01-05T18:42:45.167" Score="1" Body="&lt;p&gt;Yes they can. As Everton mentioned they can already do so even before/during the installation. &#xA;Quagga is a software on top of a linux/unix kernel. Much the same as, let's say, Firefox on top of Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can install Firefox on Windows on one machine and install Chrome on Linux on another machine. Regardless, the two machines are able to talk to each other on a TCP/IP level (ping each other) long before the browsers are installed. The network configuration is done long before Firefox or Chrome are ever installed. You need of course to configure it according to normal network standards, so they must be in the same subnet or have the correct router configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're asking whether they can exchange information other than ICMP pings, that depends primarily on software configuration and your Lubuntu installation. Debian/Ubuntu/Lubuntu also has similar software for OSPF, RIP and BGP servers, that you can install. Then they would be able to exchange routing information to each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example you can install an OSPF daemon on your Lubuntu that exchanges routing information with your Quagga OSPF daemon.&#xA;Each individual program will be able to communicate with it's counterpart on the other machine. (for example BGP-&gt;BGP daemon, OSPF-&gt;OSPF daemon)&lt;/p&gt;&#xA;" OwnerUserId="21788" LastActivityDate="2016-01-05T18:42:45.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25670" PostTypeId="2" ParentId="25667" CreationDate="2016-01-05T18:52:29.940" Score="1" Body="&lt;p&gt;Radio waves travel at the speed of light of the medium (atmosphere walls, vacuum, etc.), and electricity travels through copper at about 2/3 of the speed of light in a vacuum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is really peripheral to how fast data is transferred in a network. For example, you could transfer data at 100 Mbps, 1 Gbps, etc. through copper, fiber, or radio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a lot more involved in how fast you can transfer data, and it is a subject far too large to be discussed here.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-06T00:11:47.453" LastActivityDate="2016-01-06T00:11:47.453" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="25671" PostTypeId="2" ParentId="25667" CreationDate="2016-01-05T19:04:23.663" Score="6" Body="&lt;p&gt;Electrical signals basically move at the speed of light in that particular medium. In (copper) wires that is usually around 70% - 90% of the speed of ligth (in a vacuum) or around 200,000km/s - 250,000km/s as opposed to the around 300,000km/s which light travels in vacuum. [&lt;a href=&quot;https://en.wikipedia.org/wiki/Velocity_factor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Velocity Factor&lt;/a&gt;]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even the speed of light is not constant as is often referenced. The speed of light &lt;strong&gt;in a vacuum&lt;/strong&gt; is constant and it is the maximum speed to transfer usefull information. Still even light can be slowed down (a recent experiment even &lt;em&gt;stopped&lt;/em&gt; it for some &lt;em&gt;very&lt;/em&gt; short time &lt;a href=&quot;https://www.newscientist.com/article/dn23925-light-completely-stopped-for-a-record-breaking-minute/&quot; rel=&quot;nofollow noreferrer&quot;&gt;article&lt;/a&gt; &lt;a href=&quot;https://www.youtube.com/watch?v=RkxlBKjCoA0&quot; rel=&quot;nofollow noreferrer&quot;&gt;youtube&lt;/a&gt; ) and it can even go faster than the vacuum speed (see &lt;a href=&quot;http://curious.astro.cornell.edu/physics/133-physics/general-physics/general-questions/801-has-there-been-an-experiment-that-measured-speed-faster-than-the-speed-of-light-in-vacuum-advanced&quot; rel=&quot;nofollow noreferrer&quot;&gt;Faster than light speed&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant to your question is, that &lt;em&gt;information&lt;/em&gt; information travels in the speed of it's medium. Light in glass travels slower than in vacuum. Electricity in copper wires travels slower than &lt;em&gt;c&lt;/em&gt; meaning it is slower than &quot;light speed&quot;. But it may travel slower or faster in water, iron, etc. It depends on the medium it is traveling through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://physics.stackexchange.com/questions/80043/how-fast-does-light-travel-through-a-fibre-optic-cable&quot;&gt;How fast does light travel through a fibre optics cable&lt;/a&gt; due to reflections and bending of the fibre optics, such signals also travel about 30% slower than the speed of light in vacuum. That means both signals are about as fast as each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that light is also an electro-magnetic wave. Thus is travels at light-speed in vacuum, but in a fibre-optic cable you basically send it through air, while in a copper wire, you send it through copper. &#xA;As for data transmission, that depends on the transmission frequency, dampening and bandwidth of the signal and medium. &lt;/p&gt;&#xA;" OwnerUserId="21788" LastEditorUserId="-1" LastEditDate="2017-04-13T12:40:14.187" LastActivityDate="2016-01-06T03:57:29.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25672" PostTypeId="2" ParentId="25655" CreationDate="2016-01-05T19:29:08.523" Score="3" Body="&lt;p&gt;The purpose of replay checks is to protect against malicious repetitions of packets.  This counter is showing you how many repititions IPSEC has dropped.  For more information check out this document from Cisco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/internet-key-exchange-ike/116858-problem-replay-00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/internet-key-exchange-ike/116858-problem-replay-00.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are going to have to do network traces on both sides to see which packets are being dropped.  If the packets are legitimate, and are being dropped as false positives - the you need to increase the IPsec Anti-Replay Window&lt;/p&gt;&#xA;" OwnerUserId="4822" LastActivityDate="2016-01-05T19:29:08.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25673" PostTypeId="2" ParentId="25659" CreationDate="2016-01-05T19:34:31.813" Score="0" Body="&lt;p&gt;There's multiple answers. None of which I personally consider critical, but they make sense in their entirety and especially when considering costs and benefits.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Prevent configuration errors: Router/Firewalls let you open the ports you really need to the internet. Maybe you need more access from inside of the network. You can block it at the router level, but leave the server itself &quot;open&quot;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Layered security: you can have a server in the DMZ which doesn't have access to the internal network. But on the same internet IP you want to have an access to your internal network. If the former is hacked, hackers posess access to this particular server, but not to other ones. This is assuming you have a second line of defense &quot;behind&quot; the initial router and server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Last but not least, you can configure on your firewall what goes out of the net. If you know, this particular server should only ever send packets to internet server X, you can restrict that.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The router could send multiple IPs to multiple internal devices. Still your firewall rules stay on one physical machine.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In general you are right, there is not much additional benefit in the sense of security to adding a dedicated router/firewall between the internet and your primary server(s). There's still a small benefit in using a dedicated hardware appliance in contrast to a general-purpose computer. All Linux/Unix distributions can basically do the same on one machine. And we still have a service separation in that the firewall is in the kernel while the application is usually in userspace. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question then becomes maintainability. Which IP addresses and TCP ports do you allow through to your network and where to (in case of multiple hosts). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also a dedicated firewall/router/appliance may help you in capturing traffic that is coming into and out of your network as a central point of capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For small networks or single hosts it is perfectly sufficient to have a iptables/pfSense firewall on the host, for larger networks there are many different small benefits, that make the use of a central firewall/router useful.&lt;/p&gt;&#xA;" OwnerUserId="21788" LastActivityDate="2016-01-05T19:34:31.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25674" PostTypeId="2" ParentId="25655" CreationDate="2016-01-05T20:17:41.687" Score="4" Body="&lt;p&gt;This happens occasionally when you have a very busy VPN tunnel (&gt;200 packets per second). To understand why, you have to first understand what &lt;a href=&quot;http://www.practicalnetworking.net/series/cryptography/anti-replay/&quot; rel=&quot;nofollow&quot;&gt;Anti-Replay&lt;/a&gt; is doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;Anti-Replay&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal of Anti-Replay is to prevent a malicious user from replaying a captured VPN packet. Even if the packet is protected with Encryption and &lt;a href=&quot;http://www.practicalnetworking.net/series/cryptography/message-integrity/&quot; rel=&quot;nofollow&quot;&gt;Message Integrity&lt;/a&gt;, it is undesirable for someone to 'resend' a protected packet at a later time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if I deposit $100 cash in my bank account at my local branch, at some point in time my bank branch is going to send packets to my branch headquarters that effectively state &quot;increase my balance by $100&quot;.  If I were malicious, even if I can't read the packets (due to encryption), and even if I can't change the amount to 1,000 or 10,000 (due to Message Integrity), if I simply just duplicate the packet(s) and resend them on the wire, I could theoretically continually increase my bank balance by $100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what Anti-Replay is trying to protect you from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does this by embedding what is called a Sequence number in each packet. Then each end simply tracks to see the last Sequence number received, and if the next packet received is not the next expected Sequence number, the packet is discarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is the basic (and somewhat simplified) premise of Anti-Replay. But lets take a look at how IPsec does it specifically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;Anti-Replay within IPsec&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of just looking at the last number received, each party in the secured communication maintains an Anti-Replay &lt;em&gt;Window&lt;/em&gt;.  &lt;strong&gt;By default, on a Cico ASA, the Anti-Replay window is 64 packets&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The parties participating in the IPsec tunnel then simply keep track of only the last 64 packets received. Let's illustrate how the Anti-Replay window is used in an ASA (although the example will work for any IPsec speaker).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a packet comes through with sequence number #200, the ASA will mark #200 as the &quot;last packet received&quot;, and track the previous 64 packets -- what would be packets #137-#200.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the next packet received is #150, then the ASA accepts the packet and notes that #150 was received.&lt;/li&gt;&#xA;&lt;li&gt;If the next packet received is #130, the ASA discards this packet since it fell outside of the Anti Replay Window.&lt;/li&gt;&#xA;&lt;li&gt;If the next packet received is #150 again, the ASA discards this packet since it was tracking the 64 packets before the last one received (#200) and knows that a packet with a sequence number of #150 was already received.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now lets say the next packet received is #210. This causes the 64-packet window slides forward, which means the ASA will now only accept and track packets #147-#210.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If packet #150 is received yet again, it gets dropped, since it was still being tracked and within the window.&lt;/li&gt;&#xA;&lt;li&gt;If packet #131 is received, it is now dropped, since it is now outside the Anti-Replay window.&lt;/li&gt;&#xA;&lt;li&gt;If packet #151 is received, the packet is accepted since it is both within the Anti-Replay window, and has not been received before.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And now, lets say packet #220 arrives. This advances the window, and now packets with sequence number #157-#220 are being tracked.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If packet #150 is received once more, the ASA has stopped tracking whether #150 was received already, however it still gets dropped because it now falls outside the Anti-Replay window.&lt;/li&gt;&#xA;&lt;li&gt;If packet #160 arrives, it gets accepted since it is both within the latest Anti-Replay window, and has not been received before. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And this process continues until the Sequence Number maxes out and resets back to to zero. It is worth noting, that &lt;a href=&quot;http://www.practicalnetworking.net/series/cryptography/anti-replay#finite-field&quot; rel=&quot;nofollow&quot;&gt;the Sequence Number is not an infinite field&lt;/a&gt; and does have an innate maximum. In the case of IPsec, the field is 32 bits, and therefore the Sequence Number maxes out at approximately 4.2 billion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the maximum is reached, the keys which were securing the packets &lt;em&gt;must&lt;/em&gt; be rotated to avoid a &lt;a href=&quot;http://www.practicalnetworking.net/series/cryptography/anti-replay#finite-field&quot; rel=&quot;nofollow&quot;&gt;looped sequence number vulnerability&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;The solution to &lt;em&gt;your&lt;/em&gt; Problem&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is happening in your case specifically is the window is moving forward to fast, and legitimate packets that should be accepted are being dropped because they arrive at the other end just as the Anti-Replay window moved out of range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution: Increase the Anti-Replay window. But the tricky part is what do you increase it to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A good rule of thumb is for your Anti-Replay window to be 0.5x to 1x your average Packets Per Second&lt;/strong&gt;. I suggest starting conservative (0.5x) and increasing slowly until your performance errors falls within an acceptable level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do not be over-aggressive with increasing the Anti-Replay window, because that leaves you open to inadvertently accepting a replayed packet. Increase it slowly until you are happy with the results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On an ASA, the command is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;crypto ipsec security-association replay window-size &amp;lt;new size&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should do this on both ends of the VPN tunnel.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2016-01-06T01:47:56.840" LastActivityDate="2016-01-06T01:47:56.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25677" PostTypeId="1" AcceptedAnswerId="25728" CreationDate="2016-01-05T22:36:29.427" Score="0" ViewCount="3390" Body="&lt;p&gt;I have a Ruckus 7363 AP that is connected and managed through a Ruckus Zone Director. I have a total of 4 Access Points with 3/4 working fine. The one that is not working fine is in a geographically different location, but this should not be an issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network Infrastructure is as follows:&#xA;Ruckus -&gt; Cisco POE Switch -&gt; Cisco Router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using VLAN 204 for this configuration and have configured the router as both the DHCP server and the VLAN gateway (using SVI). The port on the switch was previously configured as an access port. I was able to plug in my laptop or the ruckus and both were provided DHCP addresses. When I tried to connect a wireless client to the Ruckus AP, it would be given an APIPA address. I have since changed the port on the switch to be a trunk port as per recommendations and I am still receiving the same results. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can confirm that the DHCP server on the switch is NOT receiving DHCP requests in this method but that it WAS receiving them when my laptop was plugged in to the port. This leads me to believe the issue is isolated to the Ruckus WAP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am really at a loss as to what step to take next. I have scoured the Ruckus forums and found a few commands (such as disabling directed dhcp) that didn't work for me. I have tested connecting with Android, Blackberry and Windows clients with no success. I have also confirmed that the VLAN tag is the same through each step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am simply trying to have DHCP work for clients that connect through the wireless access point and it is proving to be more difficult than anticipated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="10348" LastActivityDate="2016-01-07T15:42:09.663" Title="Devices Not Getting DHCP Addresses from DHCP Server When Connecting Through Ruckus 7363 AP" Tags="|cisco|wireless|dhcp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25679" PostTypeId="1" AcceptedAnswerId="25824" CreationDate="2016-01-06T01:39:54.113" Score="1" ViewCount="632" Body="&lt;p&gt;I was wondering if someone could provide some networking guidance. Any ideas/suggestions are welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to figure out how to reliably connect from my office computer to a computer on-board a robot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The connection with the robot is not always good (flaky) as the robot is always moving. The connection is over a 3G router (the router on the robot is a 3G bullet from Microhard) &lt;a href=&quot;http://www.microhardcorp.com/Bullet-3G.php&quot; rel=&quot;nofollow&quot;&gt;http://www.microhardcorp.com/Bullet-3G.php&lt;/a&gt; (I am just adding the link to provide more info on my specific setup)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The robot computer runs Ubuntu server 14.04 and the office computer runs Ubuntu Desktop 14.04.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first place I looked at is setting up VPN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The robot computer could run a VPN server and allow clients to connect to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the best recommended Ubuntu-ready VPN software? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPN over UDP would work best?&#xA;What happens if the cellular connection drops temporarily to a VPN connection? Would it disconnect quickly and require a long re-connection process?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router we have also appears to have VPN support ( NAT-T VPN tunneling).&#xA;Would this be recommended? (I have seen some post stating that NAT-T VPN is not the most safe way to go about doing this)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any recommendation of the best practices will be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time and help in advance.&lt;/p&gt;&#xA;" OwnerUserId="21791" LastEditorUserId="21791" LastEditDate="2016-01-06T02:26:10.087" LastActivityDate="2016-01-10T20:09:14.027" Title="Connecting to a remote computer over cell network with flaky connection using VPN over UDP?" Tags="|vpn|udp|" AnswerCount="2" CommentCount="4" ClosedDate="2019-03-30T03:35:22.243" ContentLicense="CC BY-SA 3.0" />
  <row Id="25680" PostTypeId="2" ParentId="25662" CreationDate="2016-01-06T03:22:03.107" Score="0" Body="&lt;p&gt;At private server run 'SSH reverse tunnel' to your public VPS:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.1.1.1 = VPS public IP address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ssh -R 8080:localhost:80 vpsuser@1.1.1.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then any connection to port 8080 from your public VPS will be forwarded to port 80 of your private server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More details here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://unix.stackexchange.com/questions/46235/how-does-reverse-ssh-tunneling-work&quot;&gt;https://unix.stackexchange.com/questions/46235/how-does-reverse-ssh-tunneling-work&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="-1" LastEditDate="2017-04-13T12:37:13.227" LastActivityDate="2016-01-06T03:22:03.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25686" PostTypeId="2" ParentId="25677" CreationDate="2016-01-06T10:24:39.750" Score="0" Body="&lt;p&gt;Can you enable monitor port functionality to see all traffic going to and from Ruckus via another port with some machine running some traffic analyzer? Even tcpdump could show you a lot, let alone WireShark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also check &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1720/vm-on-a-client-connected-to-a-cisco-1262-unable-to-dhcp-but-ipv6-works-fine?rq=1&quot;&gt;another similar post&lt;/a&gt; where enabling dhcp relaying helped.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-01-06T10:24:39.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25688" PostTypeId="1" CreationDate="2016-01-06T10:54:46.510" Score="2" ViewCount="103" Body="&lt;p&gt;Can someone let me know if the following configuring is correct on our E1 controller and serial interface for bandwidth of 1984.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're currently upgrading our bandwidth from 512 to 1984, but I'm not sure if the following configuration will work for bandwidth of 1984&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;controller E1 0/0/0&#xA; channel-group 0 timeslots 1-31&#xA;!         &#xA;&#xA;!&#xA;interface Serial0/0/0:0&#xA; description - TBA&#xA; bandwidth 1984&#xA; no ip address&#xA; encapsulation frame-relay&#xA; ip route-cache flow&#xA; frame-relay lmi-type ansi&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20399" LastEditorUserId="509" LastEditDate="2016-01-06T12:35:58.700" LastActivityDate="2016-02-05T15:52:57.717" Title="Configuring channelized E1" Tags="|routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25691" PostTypeId="1" AcceptedAnswerId="25692" CreationDate="2016-01-06T13:32:27.107" Score="2" ViewCount="1491" Body="&lt;p&gt;I'm learning (or trying to) from the Windows Networking Essentials book.  I'm struggling with the concept of subnetting. I've read the pages again, googled it, been for a walk and I still don't get it!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The book gives an example of a network with two subnets, like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Subnet 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network id: 192.168.129.0&lt;br /&gt;&#xA;Subnet mask: 255.255.255.192&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Subnet 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network id: 10.80.128.0&lt;br /&gt;&#xA;Subnet mask: 255.255.224.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand why we can't just do this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Subnet a&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network id: 192.168.129.0&lt;br /&gt;&#xA;Subnet mask: 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Subnet b&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network id: 192.168.130.0&lt;br /&gt;&#xA;Subnet mask: 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand why one would borrow bits in the subnet mask as in &lt;strong&gt;1&lt;/strong&gt; &amp;amp; &lt;strong&gt;2&lt;/strong&gt;, why wouldn't you just use a different network id like &lt;strong&gt;a&lt;/strong&gt; &amp;amp; &lt;strong&gt;b&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be that I'm totally misunderstanding this, and if you have the Windows Networking Essentials book it's pp.100-108 :)&lt;/p&gt;&#xA;" OwnerUserId="21810" LastActivityDate="2016-01-06T15:07:16.733" Title="Trying to learn about subnetting and borrowing bits, can anyone shed light?" Tags="|ipv4|subnet|" AnswerCount="2" CommentCount="1" ClosedDate="2016-01-06T19:41:16.200" ContentLicense="CC BY-SA 3.0" />
  <row Id="25692" PostTypeId="2" ParentId="25691" CreationDate="2016-01-06T14:06:14.363" Score="0" Body="&lt;p&gt;It's all about having more flexibility on how you can allocate your addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Subnet 1&lt;/strong&gt; provides less host addresses than &lt;strong&gt;Subnet a&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus &lt;strong&gt;Subnet 1&lt;/strong&gt; is an option for you to save addresses (as compared to &lt;strong&gt;Subnet a&lt;/strong&gt;) for use in OTHER subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Subnet 2&lt;/strong&gt; provides more host addresses than &lt;strong&gt;Subnet b&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus &lt;strong&gt;Subnet 2&lt;/strong&gt; is an option for you build a larger LAN (as compared to &lt;strong&gt;Subnet b&lt;/strong&gt;).&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-01-06T14:14:29.400" LastActivityDate="2016-01-06T14:14:29.400" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25694" PostTypeId="2" ParentId="25691" CreationDate="2016-01-06T15:07:16.733" Score="0" Body="&lt;p&gt;One of the important factors to think about when subnetting is the size of your network (the number of host addresses you need). Different subnet masks, i.e. borrowing bits from the host part of the address, allow you to break a large network into a bunch of smaller networks. &#xA;For example, in Subnet 1 with subnet mask 255.255.255.192 (192.168.129.0/26), we have the following situation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;We see that bits for the subnet mask have been borrowed from the 4th octet&#xA;192.128.129.00|000000&lt;/li&gt;&#xA;&lt;li&gt;2^(number of bits we've borrowed) gives us the number of different subnets we can make - in this case 4&lt;/li&gt;&#xA;&lt;li&gt;Each subnet will have 2^(remaining bits) = 2^6 - 2 = 62 host addresses (we take out the broadcast and the network address) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Subnetting is a good choice when you have been assigned one large address block and need to have multiple small networks (for example, different networks for each floor in your company). This helps to reduce network congestion and is easier and more flexible to administrate.&lt;/p&gt;&#xA;" OwnerUserId="21733" LastActivityDate="2016-01-06T15:07:16.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25695" PostTypeId="2" ParentId="25688" CreationDate="2016-01-06T15:11:41.290" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can someone let me know if the following configuring is correct on our&#xA;  E1 controller and serial interface for bandwidth of 1984.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it's the correct config for using all timeslots of a framed controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This a configuration taken from an actual device (yes, the bandwidth is incorrect):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;controller E1 3/0/4&#xA; channel-group 0 timeslots 1-31&#xA;&#xA;interface Serial3/0/4:0&#xA; bandwidth 2048&#xA; ip address S.N.I.P 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; encapsulation ppp&#xA; no snmp trap link-status&#xA; no fair-queue&#xA; no cdp enable&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-06T15:11:41.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25696" PostTypeId="1" CreationDate="2016-01-06T15:13:18.530" Score="1" ViewCount="2859" Body="&lt;p&gt;Pretty much as the title says. From what I've read online it depends on the router, but looking for a bit of confirmation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main problem is that we need more devices connected to the internet than the client says they have IP addresses available instore for, so we are looking into configuring a VLAN for our devices. However our knowledge of networks is limited and we're looking for more information on this topic, but its hard to google for information when you don't know what it is you don't know about. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bit of background info: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I don't have any info about the network hardware or infrastructure. &lt;/li&gt;&#xA;&lt;li&gt;The environment is a store so I presume it is commercial grade hardware&lt;/li&gt;&#xA;&lt;li&gt;We would like to, if possible, avoid having to add a smart switch to their network &lt;/li&gt;&#xA;&lt;li&gt;We have no more details other than &quot;We don't have enough IP addresses&quot; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any help on this would be much appreciated, as would explained criticisms of our idea and suggestions of better ideas.  &lt;/p&gt;&#xA;" OwnerUserId="21814" LastEditorUserId="3675" LastEditDate="2016-01-06T15:42:36.400" LastActivityDate="2016-05-06T03:14:59.570" Title="Is a smart switch needed to make a VLAN or can a router do it?" Tags="|vlan|internet|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25697" PostTypeId="2" ParentId="25677" CreationDate="2016-01-06T15:18:52.963" Score="0" Body="&lt;p&gt;Make sure the port on the Ruckus AP is also configured as a trunk port. If that doesn't help try disabling Directed Broadcasts on the Ruckus AP. &lt;/p&gt;&#xA;" OwnerUserId="21816" LastActivityDate="2016-01-06T15:18:52.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25698" PostTypeId="2" ParentId="25696" CreationDate="2016-01-06T15:23:38.710" Score="1" Body="&lt;p&gt;Are you sure you are looking for plain old VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN is the partioning of a bridge (usually a switch) into virtual pieces.&#xA;Usually a bridge/switch feature, yes.&#xA;Many modern high-end routers can have multiple bridge contexts, can break them into multiple VLANs, can do fancy manipulation of VLAN tagging, so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you be searching for VLAN tagging (IEEE 802.1q)? Look for information about 'router on a stick'. For instance: &lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/336-cisco-router-8021q-router-stick.html&quot; rel=&quot;nofollow&quot;&gt;router on a stick&lt;/a&gt; It's a mechanism for aggregating multiple VLANs into a router.&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-01-06T16:14:37.133" LastActivityDate="2016-01-06T16:14:37.133" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25699" PostTypeId="2" ParentId="23156" CreationDate="2016-01-06T15:53:03.663" Score="0" Body="&lt;p&gt;One smart capture daemon should be able to distinguish multiple exporters by the exporter address. However, your actual capture tool is likely to restrict what you can achieve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, nfcapd seems designed so that you should run a distinct nfcapd daemon for every exporter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if you can't change the UDP destination port, perhaps you can use multiple IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run each nfcapd daemon on a distinct address, like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;exporter1 -&gt; nfcapd (port 6003, address 1.1.1.1)&lt;/li&gt;&#xA;&lt;li&gt;exporter2 -&gt; nfcapd (port 6003, address 1.1.1.2)&lt;/li&gt;&#xA;&lt;li&gt;exporter3 -&gt; nfcapd (port 6003, address 1.1.1.3)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-06T15:53:03.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25702" PostTypeId="1" AcceptedAnswerId="25703" CreationDate="2016-01-06T19:05:02.477" Score="3" ViewCount="1074" Body="&lt;p&gt;Does traceroute show the IP address of the entry port? or exit port? &#xA;For example, if there is an intermediary router in the path with 198.28.56.18 facing the source (entry port), and 65.86.24.136 facing the destination (exit port), which of these IP addresses will I see in the output of Tracert?&lt;/p&gt;&#xA;" OwnerUserId="21823" LastEditorUserId="8499" LastEditDate="2018-12-20T04:36:28.157" LastActivityDate="2018-12-20T04:36:28.157" Title="Does traceroute show the IP address of the entry port? or exit port?" Tags="|interface|traceroute|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25703" PostTypeId="2" ParentId="25702" CreationDate="2016-01-06T19:14:43.027" Score="5" Body="&lt;p&gt;It is the address on the interface which responds back to with ICMP timeout. Which, by default, would be the interface closest to the source.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-06T19:56:54.770" LastActivityDate="2016-01-06T19:56:54.770" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25704" PostTypeId="2" ParentId="25679" CreationDate="2016-01-06T20:24:17.007" Score="0" Body="&lt;p&gt;This is tangential to the question but since you said it's Ubuntu, if you are connecting via the command line you should think about using a virtual terminal like screen or tmux - you log in and start your work, get disconnected, reconnect, and start up again where you were because your console session never dropped.&lt;/p&gt;&#xA;" OwnerUserId="21819" LastActivityDate="2016-01-06T20:24:17.007" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25705" PostTypeId="1" AcceptedAnswerId="25714" CreationDate="2016-01-06T20:55:07.630" Score="1" ViewCount="1425" Body="&lt;p&gt;Hi im trying to remove ASDM from my ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ive deleted the bin file from the flash drive and did a config factory-default&#xA;But i can still connect to the ASA through ASDM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it posible to remove it? How?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to uninstall ASDM from ASA.&lt;/p&gt;&#xA;" OwnerUserId="13605" LastEditorUserId="13605" LastEditDate="2016-01-06T21:27:56.100" LastActivityDate="2016-01-07T15:08:44.547" Title="Remove ASDM from ASA" Tags="|cisco-asa|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25706" PostTypeId="2" ParentId="25705" CreationDate="2016-01-06T21:05:54.870" Score="-2" Body="&lt;p&gt;Try &lt;code&gt;no http server enable&lt;/code&gt; , this should prevent the ASA from accepting ASDM connections. &lt;/p&gt;&#xA;" OwnerUserId="21828" LastEditorUserId="8499" LastEditDate="2016-01-07T15:08:44.547" LastActivityDate="2016-01-07T15:08:44.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25710" PostTypeId="1" AcceptedAnswerId="25717" CreationDate="2016-01-06T22:12:57.710" Score="6" ViewCount="19997" Body="&lt;p&gt;I am a little confused with the bandwidth setting on Tunnel interfaces between two Cisco devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On each end I have Cisco routers with ten gig interfaces connected to my provider. &#xA;I Have a tunnel connecting two sites together. However the bandwidth statements don't seem to add up. My Tx/Rx look like they are maxed out. However the traffic on the input/output counters do not reflect the same as the bandwidth should be allowing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I really choking out in the tunnel and not using my full interface bandwidth?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Tunnel45 is up, line protocol is up &#xA;      Hardware is Tunnel&#xA;      Internet address is z.z.z.z&#xA;      MTU 17868 bytes, BW 100 Kbit/sec, DLY 50000 usec, &#xA;         reliability 255/255, txload 255/255, rxload 255/255&#xA;      Encapsulation TUNNEL, loopback not set&#xA;      Keepalive set (10 sec), retries 3&#xA;      Tunnel source x.x.x.x (TenGigabitEthernet3/4), destination y.y.y.y&#xA;       Tunnel Subblocks:&#xA;          src-track:&#xA;             Tunnel45 source tracking subblock associated with TenGigabitEthernet3/4&#xA;              Set of tunnels with source TenGigabitEthernet3/4, 11 members (includes iterators), on interface &amp;lt;OK&amp;gt;&#xA;      Tunnel protocol/transport GRE/IP&#xA;        Key disabled, sequencing disabled&#xA;        Checksumming of packets disabled&#xA;      Tunnel TTL 255, Fast tunneling enabled&#xA;      Tunnel transport MTU 9078 bytes&#xA;      Tunnel transmit bandwidth 8000 (kbps)&#xA;      Tunnel receive bandwidth 8000 (kbps)&#xA;      30 second input rate 47213000 bits/sec, 6452 packets/sec&#xA;      30 second output rate 85312000 bits/sec, 9380 packets/sec&#xA;&#xA;    interface Tunnel45&#xA;     ip address z.z.z.z&#xA;     load-interval 30&#xA;     keepalive 10 3&#xA;     tunnel source TenGigabitEthernet3/4&#xA;     tunnel destination x.x.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Router 2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Tunnel45 is up, line protocol is up &#xA;      Hardware is Tunnel&#xA;      Internet address is z.z.z.z&#xA;      MTU 9976 bytes, BW 100 Kbit/sec, DLY 50000 usec, &#xA;         reliability 255/255, txload 255/255, rxload 255/255&#xA;      Encapsulation TUNNEL, loopback not set&#xA;      Keepalive set (10 sec), retries 3&#xA;      Tunnel linestate evaluation up&#xA;      Tunnel source x.x.x.x (TenGigabitEthernet0/0/4), destination y.y.y.y&#xA;       Tunnel Subblocks:&#xA;          src-track:&#xA;             Tunnel45 source tracking subblock associated with TenGigabitEthernet0/0/4&#xA;              Set of tunnels with source TenGigabitEthernet0/0/4, 2 members (includes iterators), on interface &amp;lt;OK&amp;gt;&#xA;      Tunnel protocol/transport GRE/IP&#xA;        Key disabled, sequencing disabled&#xA;        Checksumming of packets disabled&#xA;      Tunnel TTL 255, Fast tunneling enabled&#xA;      Tunnel transport MTU 9078 bytes&#xA;      Tunnel transmit bandwidth 2000000 (kbps)&#xA;      Tunnel receive bandwidth 2000000 (kbps)&#xA;      30 second input rate 49418000 bits/sec, 5955 packets/sec&#xA;      30 second output rate 33804000 bits/sec, 4266 packets/sec&#xA;&#xA;     interface Tunnel45&#xA;     ip address z.z.z.z&#xA;     load-interval 30&#xA;     keepalive 10 3&#xA;     tunnel source TenGigabitEthernet0/0/4&#xA;     tunnel destination y.y.y.y&#xA;     tunnel bandwidth transmit 2000000&#xA;     tunnel bandwidth receive 2000000&#xA;    end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17253" LastEditorUserId="8499" LastEditDate="2018-12-22T21:15:03.963" LastActivityDate="2018-12-22T21:15:03.963" Title="Tunnel interface bandwidth?" Tags="|cisco|bandwidth|tunnel|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25711" PostTypeId="2" ParentId="25710" CreationDate="2016-01-06T22:31:07.660" Score="1" Body="&lt;p&gt;Those numbers are &quot;advisory only&quot;. They aren't a means of policing the traffic rate.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rtr3745(config-if)#tunnel ?&#xA;  bandwidth           Set tunnel bandwidth informational parameter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's information other protocols (routing, QoS, etc.) can use to select an interface, size queues, etc.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-06T22:31:07.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25712" PostTypeId="2" ParentId="25710" CreationDate="2016-01-06T22:32:05.637" Score="1" Body="&lt;p&gt;I don't think your &lt;code&gt;tunnel bandwidth&lt;/code&gt; commands are actually doing anything since you are not running RBSCP. &lt;code&gt;tunnel bandwidth transmit&lt;/code&gt; and &lt;code&gt;tunnel bandwidth receive&lt;/code&gt; are only used with RBSCP - rate based satellite control protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even an interface &lt;code&gt;bandwdith&lt;/code&gt; command only documents a bandwidth for upper-layer protocols. To actually restrict bandwidth on an interface, you need to use traffic shaping/policing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-06T22:32:05.637" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25714" PostTypeId="2" ParentId="25705" CreationDate="2016-01-06T22:47:15.590" Score="4" Body="&lt;p&gt;You &lt;em&gt;did&lt;/em&gt; uninstall it... &lt;em&gt;from the ASA&lt;/em&gt;. All that's on the ASA is installer packages. Once you've used ASDM from the firewall (https... &lt;em&gt;Install ASDM Launcher&lt;/em&gt;), then you have ASDM on your PC; it doesn't need anything from the ASA at that point. As long as the web server is enabled on the ASA, an installed instance of ASDM can connect to it.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-06T22:47:15.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25717" PostTypeId="2" ParentId="25710" CreationDate="2016-01-07T00:15:32.900" Score="5" Body="&lt;p&gt;Cisco IOS/NX-OS/etc. software does not configure the bandwidth for a virtual tunnel interface based on the physical interface to which it is assigned; instead, it applies a default &quot;bandwidth&quot; statement to the interface that depends on model of hardware and the version of software it is running (on many devices the default &quot;BW&quot; for a tunnel is 8kbps!). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As others have mentioned, this bandwidth statement does not actively affect the traffic throughput capability of the tunnel interface- tunnel traffic throughput is limited only by CPU traffic processing capability (if tunnel processing is not being performed in HW- usually not a limitation on most cisco routers unless this is being performed at scale) and the physical interface forwarding hardware. The only exception would be if BW-based QoS policies or custom routing configurations (e.g. non-default EIGRP implementation) were implemented on the tunnel interface, but based on the config you have shared that does not appear to be the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;displayed BW, txload and rxload counters&lt;/strong&gt; that you are worried about are &lt;strong&gt;cosmetic only&lt;/strong&gt; (unless the QoS/routing scenarios above apply) and will not -on their own- limit traffic throughput in any way. If you want the counters to display accurate information, configure the following on each tunnel interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface tunnel &amp;lt;Tunnel Number&amp;gt; ! e.g. int tu45&#xA;  bandwidth &amp;lt;BW in kbps&amp;gt; ! e.g. bandwidth 2000000 -(2Gbps)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21833" LastActivityDate="2016-01-07T00:15:32.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25718" PostTypeId="1" AcceptedAnswerId="25719" CreationDate="2016-01-07T07:29:26.990" Score="1" ViewCount="819" Body="&lt;p&gt;I have been scratching my head on how this can be accomplished, we all know that almost all routers have a function for &quot;private&quot; Wi-Fi and a guest Wi-Fi access, the guest Wi-Fi on your router can have a simple password or nothing at all, some routers give you the ability to schedule the access to Wi-Fi like a parental control... well the thing is that instead of assigning a password for the guest Wi-Fi, I'd like to leave it open. The catch is that when they get connected and open a page they have to register or login in order to gain full access to the Internet via the guest Wi-Fi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw this functionality a few years back in Westfield Montgomery, when you open your cell-phone or laptop looking for a hot-spot or free Wi-Fi it shows the mall free Wi-Fi, when opening an app or a browser, the first thing you see is the registration/login page. After you login in or register, you get full access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering how this is done. I would greatly appreciate it if you kindly give me some feedback on this research.&lt;/p&gt;&#xA;" OwnerUserId="21840" LastEditorUserId="8499" LastEditDate="2016-01-07T15:13:34.460" LastActivityDate="2016-01-07T15:13:34.460" Title="Ask users to register to gain access to Wi-Fi" Tags="|ieee-802.11|network-access|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25719" PostTypeId="2" ParentId="25718" CreationDate="2016-01-07T08:44:20.953" Score="3" Body="&lt;p&gt;This function is called &quot;Captive Portal&quot;.&#xA;It basically works in the following way:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;New user connects to AP &lt;/li&gt;&#xA;&lt;li&gt;All traffic of this user (identified by IP or MAC) is redirected to the portal server and access to anything else is blocked by a packet filter firewall&lt;/li&gt;&#xA;&lt;li&gt;After registration/successful login, a dedicated &quot;ALLOW&quot; - Rule is created for the user, allowing the user to bypass the redirection and access the Internet&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are many solutions for captive portals out there. Some Access Points have a captive portal system build in, too (Aruba, Aerohive, UBNT for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;Sebastian&lt;/p&gt;&#xA;" OwnerUserId="2112" LastActivityDate="2016-01-07T08:44:20.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25721" PostTypeId="1" CreationDate="2016-01-07T10:04:28.570" Score="2" ViewCount="97" Body="&lt;p&gt;What is the difference between the following scenario's. And is there any performance differ due to this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider a server provide 5 services like web, mail, file, app and ssh :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Each service and its corresponding port is bound with A different&#xA;socket (Individual socket for each service).&lt;/li&gt;&#xA;&lt;li&gt;A single socket is bound with all the services corresponding to the&#xA;port it runs (common socket for all services).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21844" LastEditorUserId="8499" LastEditDate="2017-07-09T20:32:10.187" LastActivityDate="2017-07-09T20:32:10.187" Title="Performance of a socket" Tags="|tcp|udp|layer4|" AnswerCount="2" CommentCount="2" ClosedDate="2019-02-12T05:12:52.020" ContentLicense="CC BY-SA 3.0" />
  <row Id="25722" PostTypeId="1" AcceptedAnswerId="25739" CreationDate="2016-01-07T10:29:51.080" Score="1" ViewCount="2101" Body="&lt;p&gt;I trying to do 802.1x authentication with certificates. I am stuck with a problem client machine which fails to communicate with the RADIUS server (NPS) when I connect it through a Cisco IP phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem goes away if I directly connect the client to the switch port. The NPS server allows the connection to establish if it has a required certificate .&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The NAP enabled Switch port connects to Cisco IP phone, and from there the&#xA;connection goes to client machine (this is not working). The IP&#xA;phone works, but not the LAN on client computer&lt;/li&gt;&#xA;&lt;li&gt;Switch port directly connects to client computer (this is working as&#xA;intended). The client computer talks to the NPS server.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The interesting thing here is that after establishing the connection once, the first setting which was not working does work &lt;strong&gt;until the computer is restarted .&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa group server radius radius-dot1x-group&#xA;server-private 192.168.22.122 auth-port 1812 acct-port 1813 key 7 02090A5904071!&#xA;aaa authentication dot1x default group radius-dot1x-group&#xA;aaa authorization console&#xA;aaa authorization network default group radius-dot1x-group&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration on Port&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/21&#xA;switchport access vlan 20&#xA;switchport mode access&#xA;switchport voice vlan 40&#xA;speed 100&#xA;duplex full&#xA;authentication port-control auto&#xA;authentication periodic&#xA;authentication timer reauthenticate server&#xA;dot1x pae authenticator&#xA;spanning-tree portfast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21842" LastEditorUserId="8499" LastEditDate="2016-01-07T15:20:35.010" LastActivityDate="2016-01-08T10:09:49.707" Title="802.1X authentication not working on Client Machines if connected through Cisco IP phone" Tags="|ieee-802.11|authentication|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25723" PostTypeId="2" ParentId="25721" CreationDate="2016-01-07T11:09:12.557" Score="1" Body="&lt;p&gt;You cannot bind a socket to more than one port.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-07T11:09:12.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25724" PostTypeId="2" ParentId="22325" CreationDate="2016-01-07T11:54:16.773" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I use the same port numbers for both but binding one of them to&#xA;  127.0.0.1:N and the other to 127.0.0.2:N ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, you can use the same port number on two different 127.X.X.X addresses.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are these ports same or can I use them separately ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can use them separately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See illustration below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lab@ubu10:~$ nc -l 127.0.0.1 2000 &amp;amp;&#xA;[1] 1035&#xA;lab@ubu10:~$ nc -l 127.0.0.2 2000 &amp;amp;&#xA;[2] 1036&#xA;lab@ubu10:~$ netstat -l -n&#xA;Active Internet connections (only servers)&#xA;Proto Recv-Q Send-Q Local Address           Foreign Address         State&#xA;tcp        0      0 127.0.0.2:2000          0.0.0.0:*               LISTEN&#xA;tcp        0      0 127.0.0.1:2000          0.0.0.0:*               LISTEN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-07T11:54:16.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25726" PostTypeId="1" CreationDate="2016-01-07T15:34:31.263" Score="2" ViewCount="876" Body="&lt;p&gt;It might be a stupid question, but as far as I understood the CNWD dictates the rate of a TCP flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created a &quot;load-balancer&quot; that split single packets on two paths of 10Mb/s. This introduces some reordering which prevents the growth of the congestion window.&#xA;When I measure the CWND for a single path (through captcp) it is around 600KB and the final goodput (with iperf3) is ~9Mb/s, if I do it with the combined paths the CNWD is around 200KB, but the final goodput is ~17Mb/s!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how comes that the goodput is higher even if the cwnd is limiting only 200kb outstanding in the network?&lt;/p&gt;&#xA;" OwnerUserId="21850" LastEditorUserId="8499" LastEditDate="2021-07-12T00:00:38.827" LastActivityDate="2021-07-12T00:00:38.827" Title="How can a TCP Flow with smaller congestion window have higher throughput?" Tags="|tcp|qos|congestion|load-balancing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25727" PostTypeId="2" ParentId="25721" CreationDate="2016-01-07T15:34:41.057" Score="0" Body="&lt;p&gt;A socket consists of an IP address and port combination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your OS is only going to allow a single application to bind to a single port on a given transport-layer protocol. If you have a single application which can run all the services, then that application can bind to a single port for all the services, but multiple applications cannot bind to a single port on the same transport-layer protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether or not performance would be better with a single application running all those services on a single port is going to depend on the application, and it would be off-topic here. The fact is that each of the services you list has a separate, well-known port, and it would be awkward to use a different port than the well-known port for any of those services since clients would assume the well-known ports are being used.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-07T15:34:41.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25728" PostTypeId="2" ParentId="25677" CreationDate="2016-01-07T15:42:09.663" Score="1" Body="&lt;p&gt;The issue was to do with VLAN tagging. While I was tagging on the correct VLAN, the WAP didn't respond well to this. After a support call with Ruckus we decided to untag the VLAN on the WLAN the WAP provides. By setting the Access VLAN to 1 it makes no attempt to tag the traffic. Since the port to the Ruckus is already trunked to a specific VLAN this is fine for our network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fix this issue in the future using the same method do the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Log in to Zone Director&lt;/li&gt;&#xA;&lt;li&gt;Click on &quot;Configure&quot; Tab&lt;/li&gt;&#xA;&lt;li&gt;Click on &quot;WLANs&quot; on the left menu&lt;/li&gt;&#xA;&lt;li&gt;Click &quot;Edit&quot; on the WLAN you want to provide to the WAP&lt;/li&gt;&#xA;&lt;li&gt;Click &quot;Advanced Options&quot; &lt;/li&gt;&#xA;&lt;li&gt;Set the &quot;ACCESS VLAN&quot; setting to &quot;1&quot; to untag&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Kim72.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Kim72.png&quot; alt=&quot;ACCESS VLANs&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="10348" LastActivityDate="2016-01-07T15:42:09.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25729" PostTypeId="2" ParentId="25539" CreationDate="2016-01-07T16:24:52.480" Score="0" Body="&lt;p&gt;I found out that only one Access Control Policy is allowed on setup I have. I also found deploy button. Feel stupid now:)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks everyone who tried to help!&lt;/p&gt;&#xA;" OwnerUserId="4608" LastActivityDate="2016-01-07T16:24:52.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25730" PostTypeId="1" AcceptedAnswerId="25732" CreationDate="2016-01-07T17:04:39.937" Score="2" ViewCount="505" Body="&lt;p&gt;Our network team has been using the term &quot;half managed VPN.&quot;  Is this an industry standard term, and what does it mean?&lt;/p&gt;&#xA;" OwnerUserId="21853" LastActivityDate="2016-01-07T20:03:56.320" Title="What is a half-managed VPN?" Tags="|vpn|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25731" PostTypeId="2" ParentId="14576" CreationDate="2016-01-07T17:22:29.203" Score="0" Body="&lt;p&gt;I know that the Cisco SG300-28 can do the thing you want with sending multiple untagged vlans out an interface, as i have seen that in production.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you thought about sending the multicast stream out and then configure the switch to statically join the multicast stream on ports where it is necessary. That would atleast be my prefered way of getting arround this issue.&lt;/p&gt;&#xA;" OwnerUserId="21854" LastActivityDate="2016-01-07T17:22:29.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25732" PostTypeId="2" ParentId="25730" CreationDate="2016-01-07T20:03:56.320" Score="2" Body="&lt;p&gt;No it isn't industry-standard. But I'd hazard a guess that it's a VPN managed by you and a partner - you are responsible for it up to the endpoint on your side and the partner up to their endpoint. It can be frustrating to troubleshoot these based on how free your partner is with information. I've had to practically bludgeon configurations out of partners in the past out of some misguided sense of information security on their part.&lt;/p&gt;&#xA;" OwnerUserId="21819" LastActivityDate="2016-01-07T20:03:56.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25733" PostTypeId="1" AcceptedAnswerId="25741" CreationDate="2016-01-07T20:08:04.647" Score="3" ViewCount="1484" Body="&lt;p&gt;Just wondering the theory or reason behind having the inside interface of a firewall on a different network than your primary network.  I put together a quick drawing of what i'm talking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the advantage of having the inside interface of the firewall on a different subnet, than just being on a main subnet?  In the diagram I have the inside interface as 172.16.1.2, which I see a lot in example diagrams.  But what is the benefit of it just being another &lt;a href=&quot;https://i.stack.imgur.com/bywoQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bywoQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21856" LastEditorUserId="8499" LastEditDate="2018-12-22T21:16:15.000" LastActivityDate="2018-12-22T21:16:15.000" Title="Reason behind having a separate network for firewall interfaces?" Tags="|routing|firewall|subnet|best-practices|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25734" PostTypeId="2" ParentId="25722" CreationDate="2016-01-07T20:12:39.640" Score="1" Body="&lt;p&gt;You don't say if the Cisco phone has a certificate on it as well. If it doesn't, you may have to try to enable IEEE 802.1X multiple authentication - this lets you designate a VoIP LAN and have hosts on that authenticate via MAC address, while the PC still authenticates via certificate. We had a similar problem with mini-switches plugged into 802.1x ports - if any device on the mini-switch couldn't authenticate (like, you know, a printer) the whole port would shut down. If the phone does have a cert, you still need multiple authentication turned on, it's just much easier to configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco's docs on multiple authentication start at &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_8021x/configuration/15-2mt/sec-ieee-802x-multi-auth.html#GUID-ECD4BDFA-0AA3-4474-BA56-35342811E9E6&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/ios-xml/ios/sec_usr_8021x/configuration/15-2mt/sec-ieee-802x-multi-auth.html#GUID-ECD4BDFA-0AA3-4474-BA56-35342811E9E6&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21819" LastActivityDate="2016-01-07T20:12:39.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25735" PostTypeId="2" ParentId="25733" CreationDate="2016-01-07T20:19:49.010" Score="1" Body="&lt;p&gt;Based on your diagram, the network inside the firewall is using private addressing, so NAT is needed to connect to the Internet. The NAT is performed on the firewall since it is unlikely that the core switch can do NAT. The core switch is likely a layer-3 switch, so the link to the firewall is probably a routed link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given a firewall and a layer-3 switch, you really want to do the routing on the layer-3 switch rather than the firewall. It may be possible to do the routing on the firewall, but why burden the processor on the firewall with all the services that routers may do, such as routing, QoS, NetFlow, etc., if your layer-3 switch can perform those services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The diagram seems to be pretty simple, but you would really probably have multiple VLANs/subnets on the LAN side of the core switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-07T20:19:49.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25736" PostTypeId="2" ParentId="25726" CreationDate="2016-01-07T21:38:08.383" Score="0" Body="&lt;p&gt;CNWD not dictate speed directly, it affects the speed along with other factors (at least RTT).&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-01-07T21:38:08.383" CommentCount="2" CommunityOwnedDate="2016-01-07T21:38:08.383" ContentLicense="CC BY-SA 3.0" />
  <row Id="25737" PostTypeId="2" ParentId="25733" CreationDate="2016-01-07T21:54:43.407" Score="0" Body="&lt;p&gt;Based on your diagram, there's no immediate advantage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I suspect the internal network is more complex than a single, flat LAN. In that case, the &quot;core switch&quot; is the internal (&quot;inter-vlan&quot;) router. It will be much faster at the task of routing than the firewall can &lt;em&gt;ever&lt;/em&gt; be. For starters, the firewall is a single interface (&quot;port&quot;), where as the switch has dozens (if not hundreds) of ports.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-07T21:54:43.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25738" PostTypeId="2" ParentId="25726" CreationDate="2016-01-07T22:00:04.697" Score="2" Body="&lt;p&gt;With TCP throughput, there are a lot of factors which come into play. For instance, when the window is larger on a single link, congestion along the link could be a bigger factor. Because of congestion on the single link, IP packets could be dropped, causing TCP to resend segments, thus slowing down the transfer. There is also, a QoS function called RED (Random Early Detection) which randomly drops IP packets in order to prevent queues from becoming full. This forces TCP to slow down and resend segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A window is just the amount of traffic which can be sent before needing to wait for an ACK. If it doesn't take long for the ACK to be sent back (how fast the receiver takes to send the ACK, and how long the latency is between the two hosts), your transfer may not be slowed much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real way to dictate the speed of traffic flows is to use QoS to establish queues and bandwidths for traffic based on criteria you determine (e.g. DSCP markings).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-07T22:00:04.697" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25739" PostTypeId="2" ParentId="25722" CreationDate="2016-01-07T22:03:38.610" Score="1" Body="&lt;p&gt;Setting up 802.1x &lt;em&gt;through&lt;/em&gt; a phone is a complicated mess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the &quot;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Security/TrustSec_1-99/IP_Tele/IP_Telephony_DIG.html#83010&quot; rel=&quot;nofollow&quot;&gt;Device Behind Phone Authenticates&lt;/a&gt;&quot; section of Cisco's guide:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the data device is not ready to or not capable of performing IEEE&#xA;  802.lX, the switch times out and continue to the next authentication method, such as MAB, and/or authorization type, such as Guest VLAN. If&#xA;  the device later becomes capable of performing 802.1X, perhaps because&#xA;  the operating system finished booting or a supplicant was manually&#xA;  enabled, the data device should send an EAPoL-Start message to&#xA;  explicitly tell the switch to begin authentication.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Perhaps your PC systems need to be configured to send EAPOL-Start messages explicitly. (most systems don't by default.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note: that document is, of course, w.r.t. Cisco's switches.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-07T22:03:38.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25741" PostTypeId="2" ParentId="25733" CreationDate="2016-01-07T22:21:57.093" Score="1" Body="&lt;p&gt;Usually firewall is a router, so normal configuration for router is have different subnets on different interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Your diagram, as I guess, implied that LAN is private and WAN is public IP space, so &quot;firewall&quot; really do not only Firewall work (filtering) but also NAT-router work (routing and address translation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in some cases is useful to configure firewall as transparent bridge (switch) without making influence on subnets architecture.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-01-07T22:21:57.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25742" PostTypeId="2" ParentId="25733" CreationDate="2016-01-07T23:04:34.650" Score="0" Body="&lt;p&gt;In the diagram you posted, on the right it makes reference to Vlan10 with a 10.10.0.0/24 network. Based on that observation you can infer that there is a management network that is 172.16.1.x which would be setup to configure your devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This could be for security, you don't want just anyone at your company to be able to access your firewalls web gui, or switch SSH ports etc.&lt;/p&gt;&#xA;" OwnerUserId="21860" LastActivityDate="2016-01-07T23:04:34.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25744" PostTypeId="1" AcceptedAnswerId="25745" CreationDate="2016-01-08T01:29:02.867" Score="2" ViewCount="2596" Body="&lt;p&gt;In terms of subscriber management, I understand there are two major approaches - DHCP and PPPoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I'm being very general, so give me some rope.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If using DHCP, RADIUS/AAA will authenticate the user, and then allow DHCP to happen, assign the address, etc.  If I'm using PPPoE, the PPPoE session establishes, and the address is assigned via IPCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, if I'm using PPPoE, can we use DHCP to assign the address?  And if so, how is that address conveyed to the client?  Will DHCP choose the address and be sent to the client via IPCP?&lt;/p&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2016-01-08T01:42:53.987" LastActivityDate="2021-02-14T03:59:23.723" Title="Can I use PPPoE and DHCP simultaneously?" Tags="|dhcp|pppoe|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25745" PostTypeId="2" ParentId="25744" CreationDate="2016-01-08T01:47:06.200" Score="6" Body="&lt;p&gt;According to Cisco, you cannot use DHCP with PPPoE, :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;PPPoE is not supported in conjunction with DHCP because with PPPoE the&#xA;IP address is assigned by PPP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Juniper has a whitepaper about &lt;a href=&quot;https://www.dslreports.com/r0/download/1468367%7E39a604b7c30141db72e55620ebf95879/Understanding+PPPoE+and+DHCP_200187.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding PPPoE and DHCP&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The DSL Forum now also allows using IP over Ethernet (IPoE), which is&#xA;based on DHCP. However, PPP remains the more mature and robust method&#xA;for providing many broadband services&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2021-02-14T03:59:23.723" LastActivityDate="2021-02-14T03:59:23.723" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="25746" PostTypeId="2" ParentId="24680" CreationDate="2016-01-08T02:54:43.097" Score="4" Body="&lt;p&gt;In a single NAT rule, you can specify multiple ports in the same rule by using a comma separator, or hypen for range, or combination of them both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for FTP, I use ports:  21, 990, 65000-65100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are also translating ports, you specify the translated ports in the same order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I want to temporarily point my rule at another server, I create another rule and place it above my original so that it takes precedence. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then simply disable the rule and all ports are disable with it.&lt;/p&gt;&#xA;" OwnerUserId="21865" LastActivityDate="2016-01-08T02:54:43.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25747" PostTypeId="1" AcceptedAnswerId="25748" CreationDate="2016-01-08T03:04:12.167" Score="0" ViewCount="1494" Body="&lt;p&gt;Our company uses Pakedge and Luxul switch/router/Wi-Fi equipment.  I see in a lot of the threads on Stack Exchange that Pakedge and Luxul are rarely or never mentioned, (Network Engineering, Super User, Server Fault).  However, I see Ruckus and Aruba have a littler more status online.  I have always had issues implementing and maintaining Pakedge systems (Wi-Fi managed/unmanaged) and Luxul (wifi managed/unmanaged switches managed and routers).  Constant firmware issues/upgrades/downgrades, controllers that are supposed to manage a Wi-Fi network more efficiently but don't.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for the background, now for the question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to change what equipment we use what are your experiences with, Ruckus, Aruba or Cisco?  This is for the scope of a large network setup for a Control4 system, (20 APs on six 28 port managed PoE switches).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would prefer Cisco for switches/routers, but what about its Wi-Fi? I don't really get a chance to mess around with Cisco's Wi-Fi except for low end Linksys devices, which I think Belkin owns now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to use Ruckus or Aruba now.  What should I know before I get either one?  Anyone ever have problems with either, tech-support or setup wise?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I keep having head aches with Pakedge and Luxul.  I just want something that is more reliable and least when it comes to setup.  Can't tell you how many times I have to fight with a Luxul AP just to get it setup and save the configuration I want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please share any experiences with me.&lt;/p&gt;&#xA;" OwnerUserId="21864" LastEditorUserId="8499" LastEditDate="2016-01-08T03:41:11.167" LastActivityDate="2016-01-09T00:14:16.317" Title="What is your experience with Ruckus/Aruba W-Ffi products?" Tags="|cisco|ieee-802.11|network-access|aruba|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25748" PostTypeId="2" ParentId="25747" CreationDate="2016-01-08T03:31:47.433" Score="0" Body="&lt;p&gt;If this is a large Wi-Fi deployment, you probably want to look at a system based on a wireless controller and LWAPs. The only real experience I have with such a combination is with Cisco. Cisco has a large product line of controllers, LWAPs, and WAPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately, the Cisco devices seem to perform well. There are occasional updates which we thoroughly test if the added features interest us. The wireless controller-based system allows the LWAP updates to be fairly painless since the LWAPs get their software and configurations from the controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using Local mode means that both the management and data traffic are tunneled back to the controller, which can be remote from the LWAP. This has both advantages and disadvantages. The newer Cisco switches (3850, 45xx Supervisor 8, etc.) provide some wireless controller functionality built in to the switch to allow data traffic to be dropped locally. This mode allows for seamless roaming between LWAPs, regardless of subnet/VLAN, without re-authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also use FlexConnect mode which only uses a tunnel back to the wireless controller for management traffic, but it will drop data traffic locally. Cisco called this a kludge, because roaming can only happen on the same subnet/VLAN with re-authentication. The switches with built-in controller functions can do something similar to this, on Local mode, without the kludge of FlexConnect mode.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-08T04:07:33.660" LastActivityDate="2016-01-08T04:07:33.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25752" PostTypeId="1" CreationDate="2016-01-08T06:13:58.137" Score="2" ViewCount="63" Body="&lt;p&gt;What's the name of the type of plug that has the little thing on the side that prevents it from fitting in regular 8P8C sockets? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/z7fHH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z7fHH.jpg&quot; alt=&quot;slotted rj-45 female&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21870" LastEditorUserId="8499" LastEditDate="2019-01-03T01:40:24.663" LastActivityDate="2019-01-03T01:40:24.663" Title="What's the technical name of this slotted type of RJ-45 connector?" Tags="|layer1|lan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25753" PostTypeId="2" ParentId="25752" CreationDate="2016-01-08T06:33:20.583" Score="2" Body="&lt;p&gt;That is a keyed connector, possibly an RJ-45S, suitable only for telephone systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, an inline connector, such as this, is unsuitable for UTP LAN cabling.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-09-20T05:57:27.790" LastActivityDate="2016-09-20T05:57:27.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25754" PostTypeId="1" CreationDate="2016-01-08T07:29:06.007" Score="2" ViewCount="187" Body="&lt;p&gt;what is the usage of network clock in the router? Is it something to do only with pseudowire T1/E1? What I am looking is the need of network clock - syncE in the router? What is the significance? Why is it important for any router to support so?&lt;/p&gt;&#xA;" OwnerUserId="13278" LastActivityDate="2016-01-08T17:26:22.997" Title="why network clock is required in the router?" Tags="|switch|router|ethernet|pseudowire|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25757" PostTypeId="2" ParentId="25722" CreationDate="2016-01-08T10:09:49.707" Score="0" Body="&lt;p&gt;The process work like that &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i start the PC and login in .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QSkD4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QSkD4.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unable to authenticate,from their i disabled the network card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I enable the Network card &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This time their will be no problem in NAP authentication it works fine &#xA;&lt;a href=&quot;https://i.stack.imgur.com/Pzmj4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Pzmj4.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21842" LastActivityDate="2016-01-08T10:09:49.707" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25758" PostTypeId="1" AcceptedAnswerId="25760" CreationDate="2016-01-08T11:57:34.223" Score="1" ViewCount="6362" Body="&lt;p&gt;I'm preparing a network setup for a building with five apartments and some common infrastructure, and being no network professional I'm stuck with the question of topology and overall setup that would accommodate all the necessary stuff together with a bearable level of security (family photos on a local NAS box not freely accessible from the Internet, for example). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's start with an artistic impression of the intended setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iwAiX.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iwAiX.jpg&quot; alt=&quot;Private network topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea is that each apartment has its own local network with the usual mix of smartphones, computers, NAS boxes, printers, smart waste bins etc; none of which should be accessible from outside of the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there are the common services which should be accessible throughout the building, from inside the LANs (some of them in the DMZ with provision for access from the outside). For example, each client connected in any of the separate LANs should be able to access the weather station server or the CCTV archive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have a building-wide network of Siemens Gigaset VoIP base stations. I'd like to connect them bases physically to the separate LAN routers (I can't install their own wiring from the main router), but they need to be on the same network to be able to talk to each other for the roaming to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main problem for me is the accessibility of the 'common' network from inside the separate LANs, since the typical private ranges of IP addresses are usually not routed (or routable) through the usual SOHO routers and I don't have the budget for full blown professional setup (and people to set it up for me and come whenever something goes beep). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;And the question is&lt;/strong&gt; how can I set such a network up? I'd like to keep the budget low, but if there is a Magic Box TM that will set it up for me, I can pay the adequate price.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Notes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to avoid at all costs any 'virtual' or 'cloud' solutions. The network must be functional even when there is no Internet connection available. Every piece of equipment so far present is purchased with this in mind, and I really don't want to cloudify the whole property.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since IPv6 is supported neither by many of important devices nor by my own knowledge (or, better, lack thereof), I'd like to have the whole setup solely on IPv4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will be two Internet connections, one main and one backup (I'm thinking about one of the little Ciscos with two WAN ports for this role.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firewalls left out from the diagram (and question) for the sake of simplicity, but feel free to comment on them whenever relevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for my dummy language, should something need clarification or elaboration, please comment, I'll try to respond quickly.&lt;/p&gt;&#xA;" OwnerUserId="21874" LastEditorUserId="21874" LastEditDate="2016-01-08T12:02:54.997" LastActivityDate="2016-01-08T13:16:19.383" Title="Nested private networks (private network within private network)" Tags="|routing|security|architecture|" AnswerCount="1" CommentCount="1" ClosedDate="2016-01-11T03:24:35.100" ContentLicense="CC BY-SA 3.0" />
  <row Id="25760" PostTypeId="2" ParentId="25758" CreationDate="2016-01-08T13:08:13.113" Score="4" Body="&lt;p&gt;This is a relatively simple setup that can be done with any soho (wireless) router. You have to adopt the example ip addresses I use in this answer to you actual setup and modifiy the subnets to suit your needs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router 1 set up with IPv4 Network: 192.168.10.0/24&lt;/li&gt;&#xA;&lt;li&gt;Router 2 set up with IPv4 Network: 192.168.20.0/24 &lt;/li&gt;&#xA;&lt;li&gt;Router 3 set up with IPv4 Network: 192.168.30.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Each apartment router is connected to the main router (preferably a L3 - Switch), optimally on its own VLAN. Also connected to the main router and also on its own VLAN is the &quot;common&quot; - Network, lets say 192.168.100.0/24, and your internet connection(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main router has an interface in each network. The apartment routers default route is the main router. The main routers default is, of course, the internet connections next hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say, for example, the main routers interface IP in the apartment 1 network is 192.168.10.254. On the apartments router, you would have a default route like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0.0.0.0 mask 0.0.0.0 gateway 192.168.10.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to publish something from the common network to the internet, you'd either have to setup reverse NAT or an additional DMZ network. The DMZ network only makes sense if you have more than a very few services to publish and more than 2 public IPv4 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this setup, your mission is nearly accomplished.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tricky part is the VoIP. There are a few possible solutions, depending on the apartment routers features (make/model?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best solution would be to create an additional VLAN for VoIP and configure the uplink port of each apartment router to the L3 - Switch (main router) to tag all VoIP - Traffic and send all other traffic untagged. On the port of the main router you have to set up a default vlan for the untagged apartment traffic for each apartment. But this demands an apartment router where it is possible to individually configure (LAN)ports on the device and it must support 802.1q.&lt;/p&gt;&#xA;" OwnerUserId="2112" LastEditorUserId="2112" LastEditDate="2016-01-08T13:16:19.383" LastActivityDate="2016-01-08T13:16:19.383" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25761" PostTypeId="1" AcceptedAnswerId="25762" CreationDate="2016-01-08T13:56:12.547" Score="2" ViewCount="321" Body="&lt;p&gt;I am trying to understand TCAMs and I have stumbled upon this:&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Content-addressable_memory#Ternary_CAMs&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ternary CAMs, Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The addresses are stored using &amp;quot;don't care&amp;quot; for the host part of the&#xA;address, so looking up the destination address in the CAM immediately&#xA;retrieves the correct routing entry; both the masking and comparison&#xA;are done by the CAM hardware.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This paragraph is ambigous to me. Is masking taking place with TCAMs so that the result is a network address which gets compared to the network address in the routing table or not?&lt;/p&gt;&#xA;&lt;p&gt;Because not having to calculate the network address at all while routing would be an awesome property of TCAMs.&lt;/p&gt;&#xA;" OwnerUserId="21774" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-01-22T20:52:17.247" Title="TCAMs: No need for calculating the network address?" Tags="|routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25762" PostTypeId="2" ParentId="25761" CreationDate="2016-01-08T14:09:38.310" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;This paragraph is ambigous to me. Is masking taking place with TCAMs so that the result is a network address which gets compared to the network address in the routing table or not?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, not exactly. There is not a regular masking operation taking place. There is no software querying the CAM/TCAM at forwarding time. While usual memory is designed to be queried by a 'memory address' (pointer), CAM/TCAM is a kind of memory circuit (hardware) designed to lookup by content. It does in hardware what a &lt;a href=&quot;https://en.wikipedia.org/wiki/Hash_table&quot; rel=&quot;nofollow&quot;&gt;hash table&lt;/a&gt; does in software: an associative array.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point is: TCAM can be programmed with a network prefix entry. For instance, you can insert a /24 prefix into TCAM by marking last 8 bits as &quot;DON'T CARE&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With plain binary CAM, you can't insert IP prefix, you can only insert full IP address (or MAC addresses) as lookup key.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;What I wanted to know is whether TCAMs need to calculate a network address before searching for a matching entry in their routing table.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. TCAM circuitry can DIRECTLY lookup keys against entries built with 0s and 1s and Xs (X=don't care). For instance, you could insert entry=1.0.0.X then you can lookup key=1.0.0.1. The TCAM circuitry will find and return the matching 1.0.0.X entry (plus its associated information) without doing the &quot;formal&quot; masking you seem to be picturing. However, TCAM lookup does a kind of masking to distinguish between &quot;care bits&quot; and &quot;don't care bits&quot;&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-01-22T20:52:17.247" LastActivityDate="2016-01-22T20:52:17.247" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="25763" PostTypeId="2" ParentId="25754" CreationDate="2016-01-08T14:23:05.777" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;what is the usage of network clock in the router?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Of course it has uses, though generally unrelated with classic router functions.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it something to do only with pseudowire T1/E1?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is one typical usage. Notice that not every router performs TDM-related functions.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What I am looking is the need of network clock - syncE in the router?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;SyncE is one method for providing high accuracy clocking for TDM over packet protocols.&#xA;Another mechanism is &quot;IEEE 1588-2008 Precision Time Protocol&quot;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the significance? Why is it important for any router to support so?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are functions, like E1 over pseudowire, which demand high precision clock synchronization.&#xA;But not every router performs those functions.&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-01-08T17:26:22.997" LastActivityDate="2016-01-08T17:26:22.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25764" PostTypeId="1" AcceptedAnswerId="25768" CreationDate="2016-01-08T15:28:56.740" Score="3" ViewCount="19731" Body="&lt;p&gt;The switchport port-security violation shutdown , shuts the port (err-disabled) when the policy is violated. But, for restrict and protect modes there isn't a mention of shutting a port down. So, can the policy be violated unlimited number of times when a switch port is configured with :&#xA;switchport port-security violation restrict(or protect) &lt;/p&gt;&#xA;" OwnerUserId="21879" LastEditorUserId="8499" LastEditDate="2019-01-03T03:44:53.347" LastActivityDate="2019-01-03T03:44:53.347" Title="When switchport port-security violation protect( or restrict) is configured , how many times can the security policy be breached?" Tags="|cisco|switch|mac-address|cisco-commands|port-security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25765" PostTypeId="1" AcceptedAnswerId="25770" CreationDate="2016-01-08T15:43:12.247" Score="3" ViewCount="100" Body="&lt;p&gt;My industrial server computer have two Ethernets (eth0, eth1) plus one Wi-Fi.  We have decided to assign eth1 to be a configurable IP which will not collide with eth0.  Eth0 will be 169.254.13.14 which is fixed so an engineer computer can easily connect to it and the PC will have fixed IP 169.254.13.13.  The eth0 and wlan0 are in local area network (eth1 can be reached remote).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Question about Wi-Fi&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Wi-Fi uses DHCP, as an access point.  So it will assign wireless client IP. We plan to use 169.254.13.15 as a fixed IP for the server wlan0.  So eth0 and wlan0 are on same block, same subnet.  Now, will Linux/DHCP server be able to know not to assign the two addresses mentioned above to clients?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I may have multiple wireless client (PC, or tables), but only one PC will connect to the eth0.  There is no other participants on eth0.  Will my plan work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't necessary need a routing between the eth0 and wlan0, and my software will not actually send packets across: which means, the PC on eth0 will not try to send anything to the wlan0 IP.  Client on Wi-Fi will not try to send packets to the eth0, or the PC on eth0.  The communication is point to point over the TCP/IP.&lt;/p&gt;&#xA;" OwnerUserId="20014" LastActivityDate="2016-01-08T16:37:52.563" Title="Is it ok to set Wi-Fi NIC to use same subnet with another NIC on a server?" Tags="|ethernet|dhcp|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25766" PostTypeId="1" AcceptedAnswerId="25771" CreationDate="2016-01-08T15:55:15.170" Score="1" ViewCount="265" Body="&lt;p&gt;I was studying about how port numbers work and got few questions as follows(sorry but I'm a noob and new to networking stuff but quite interested to learn all this :D )-&lt;br&gt;&lt;br&gt; &#xA;1. Where all does firewall exist- Server, client or intermediate routers and bridges.&lt;br&gt;&lt;br&gt;&#xA;2.What does it mean to add an exception to a firewall.&lt;br&gt;&lt;br&gt;&#xA;3.Opening a port means running a service that we want to be accessible to others. For others to use my running service I need to provide them my port number so that they can connect to it. If I am thinking this right way then, where does firewall come into the picture.&lt;br&gt;&lt;br&gt;&#xA;4. When I run a &lt;code&gt;netstat&lt;/code&gt; command on my windows machine then, I see lots services listening on a specific port. I'm not hosting any website so why do I need a service that listens(my pc basically acting as a server). Output looks like this. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Proto  Local Address          Foreign Address        State&#xA; TCP    0.0.0.0:80             SHIVAM-PC:0            LISTENING&#xA; TCP    0.0.0.0:135            SHIVAM-PC:0            LISTENING&#xA; TCP    0.0.0.0:445            SHIVAM-PC:0            LISTENING&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt;&#xA;What does listening port 80 mean specifically. I'm not hosting any website for http connections.Why is a service running to that listens on port 80.&lt;br&gt;&#xA;Kindly help.&lt;/p&gt;&#xA;" OwnerUserId="21881" LastActivityDate="2016-01-08T16:46:33.040" Title="Basic questions regarding port numbers and firewall" Tags="|firewall|internet|port-security|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25767" PostTypeId="1" AcceptedAnswerId="25815" CreationDate="2016-01-08T16:18:44.000" Score="1" ViewCount="146" Body="&lt;p&gt;Just upgraded to FortiOS 5.4, don't really think that makes a difference here but I don't see my CLI config changes from the GUI. Lets say I edit a firewall policy via CLI then refresh my GUI window, I don't see the change. I wonder if I should also disable automatic write to flash.&lt;/p&gt;&#xA;" OwnerUserId="21880" LastActivityDate="2016-08-07T16:59:47.840" Title="Viewing results immediately after applying CLI config ForitOS 5.4 200D" Tags="|fortigate|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25768" PostTypeId="2" ParentId="25764" CreationDate="2016-01-08T16:23:20.237" Score="7" Body="&lt;p&gt;Yes, the restrict and protect modes can be violated any number of times without shutting down the port since they are not designed to do that; they will drop packets with unknown source addresses:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=2&amp;amp;ved=0ahUKEwj8ib7YzZrKAhWISiYKHWbzDWoQFggkMAE&amp;amp;url=http%3A%2F%2Fwww.cisco.com%2Fc%2Fen%2Fus%2Ftd%2Fdocs%2Fswitches%2Flan%2Fcatalyst6500%2Fios%2F12-2SX%2Fconfiguration%2Fguide%2Fbook%2Fport_sec.pdf&amp;amp;usg=AFQjCNGniMS0_1eavbameyhIPccDtQG7Dw&amp;amp;sig2=bS8h3Aodj-0DGoWqBqzOAQ&amp;amp;cad=rja&quot; rel=&quot;noreferrer&quot;&gt;Configuring the Port Security Violation Mode on a Port&lt;/a&gt; on page 62-6:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;strong&gt;protect&lt;/strong&gt;—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the &#xA;  maximum value.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;restrict&lt;/strong&gt;—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the &#xA;  maximum value and causes the SecurityViolation counter to increment.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;shutdown&lt;/strong&gt;—Puts the interface into the error-disabled state immediately and sends an SNMP trap notification.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-08T16:23:20.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25769" PostTypeId="1" AcceptedAnswerId="25772" CreationDate="2016-01-08T16:24:23.430" Score="0" ViewCount="202" Body="&lt;p&gt;I'm using a Cisco 2851 Router and configuring through the Cisco Command-Line Interface and I'm trying to block certain https websites. Since I have heard that this router only has support for blocking http websites, I would like to have the websites such as twitter.com resolve to our company website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My router is using a IP: 10.169.145.1 and the DNS Server that all of the computers are using by default is 65.32.1.xx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: &lt;strong&gt;How can I configure the computers on the network to use the DNS that I am setting up via the Cisco CLI when telnetting into 10.169.145.1?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried putting the ip host redirect in and then changing the DNS address for a few computers, then trying to connect and ping the new name but it isn't working and I think I may be configuring the wrong DNS.&lt;/p&gt;&#xA;" OwnerUserId="18757" LastActivityDate="2016-01-08T16:59:15.517" Title="Cisco 2851 Router DNS configuration questions" Tags="|cisco|cisco-ios|dns|cisco-commands|" AnswerCount="1" CommentCount="1" ClosedDate="2016-01-10T18:05:42.517" ContentLicense="CC BY-SA 3.0" />
  <row Id="25770" PostTypeId="2" ParentId="25765" CreationDate="2016-01-08T16:37:52.563" Score="1" Body="&lt;p&gt;You will be misusing the link-local addressing (&lt;code&gt;169.254.0.0/16&lt;/code&gt;). Link-local addresses are not allowed in DNS, and any traffic with a link-local source address is not allowed to be routed. Also, link-local addresses must be assigned randomly (you are not allowed to assign a specific one to your &lt;code&gt;wlan0&lt;/code&gt; interface, and DHCP doesn't do random assignments and allow for conflicts), and special precautions must be taken since address conflicts will happen with random address assignment, and a host must determine if there is a conflict and correct it.&lt;/p&gt;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3927&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3927, Dynamic Configuration of IPv4 Link-Local Addresses&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-01-08T16:37:52.563" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="25771" PostTypeId="2" ParentId="25766" CreationDate="2016-01-08T16:46:33.040" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;A firewall can exist in any or all which you have listed, or it can&#xA;be a stand-alone device.&lt;/li&gt;&#xA;&lt;li&gt;By default, a firewall will block all incoming traffic. Adding an&#xA;exception means that you are overriding that behavior for some&#xA;traffic.&lt;/li&gt;&#xA;&lt;li&gt;The meaning of opening a port depends on the context. In the context&#xA;of a firewall, it means creating an exception for traffic destined&#xA;for that port. In the context of an end-device, it means that an&#xA;application has requested that port from the transport-layer&#xA;protocol.&lt;/li&gt;&#xA;&lt;li&gt;As far as the specifics of your OS listening to ports, you will need&#xA;to ask that question somewhere else, such as &lt;a href=&quot;https://superuser.com/&quot;&gt;Super User&lt;/a&gt; since&#xA;it is off topic here because it involves&#xA;applications/application-layer protocols, and different OSes may&#xA;have different needs for listening on ports.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2016-01-08T16:46:33.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25772" PostTypeId="2" ParentId="25769" CreationDate="2016-01-08T16:59:15.517" Score="0" Body="&lt;p&gt;Configuration of your clients is off-topic. Clients get DNS server addresses from DHCP, or it is manually configured in each client. If your router is the DHCP server, you can change it to give a different DNS server. Other than that, you really can't change the client DNS server from your router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-08T16:59:15.517" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="25774" PostTypeId="2" ParentId="25089" CreationDate="2016-01-08T19:53:10.173" Score="0" Body="&lt;p&gt;Are you sure both switches are forwarding IP packets?&lt;/p&gt;&#xA;&lt;p&gt;Usually routers have 'ip routing' enabled.&lt;/p&gt;&#xA;&lt;p&gt;Check all your devices for both 'ip routing' and 'ip cef':&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;sh run | i ip routing&lt;/p&gt;&#xA;&lt;p&gt;sh run | i ip cef&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="498" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-01-08T19:53:10.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25778" PostTypeId="1" AcceptedAnswerId="25779" CreationDate="2016-01-08T22:32:29.150" Score="1" ViewCount="82" Body="&lt;p&gt;First of all I am not a professional in the field of networking. I only have a CCNA level 1 and I am very familiar to home use routers &amp;amp; Linux administration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to configure the fallowing setup and I am not sure this could be done with a common router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Location has &lt;strong&gt;1 physical internet connection&lt;/strong&gt; and for that the provider has allocated &lt;strong&gt;3 public IP addresses&lt;/strong&gt;. For each IP the owner wants to have 3 different wireless/cable private networks with different bandwidths allocated to each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a piece of hardware that can do this setup &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If this cannot be done with only one piece of hardware what would be a an alternate network design&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Working scenario:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;They have an office connection (IP1) that provides basic connectivity to&#xA;  e-mail, search, browsing. People visiting could have access to another&#xA;  public wi-fi (IP2) with very low bandwidth. Occasionally they could&#xA;  broadcast video and a camera could be plugged in the router by cable&#xA;  and broadcast a video signal. This connection (IP3) should have the maximum&#xA;  bandwidth, however if not used the bandwidth should be shared entirely&#xA;  to the office connection (IP1).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="21885" LastEditorUserId="8499" LastEditDate="2021-07-11T23:46:23.543" LastActivityDate="2021-07-11T23:46:23.543" Title="Configuration and hardware for custom office networking" Tags="|router|qos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25779" PostTypeId="2" ParentId="25778" CreationDate="2016-01-08T22:46:30.667" Score="1" Body="&lt;p&gt;You can NAT private networks to the public addresses. Business/enterprise-class routers can easily do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rest of your question can be handled by a proper QoS configuration. QoS really needs to have a comprehensive policy defined, and it works best if traffic is marked as close to the source as possible (on your switches), and then you can set up queues, bandwidth restrictions, etc. where they are needed. Just understand that QoS will work well in your network, and for traffic exiting your network, but the Internet will not honor your QoS policies, and by the time you receive traffic from the Internet, the bandwidth has already been used (you have no real control over traffic coming from the Internet to your router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything you want to do can be handled by many different business/enterprise-grade routers. You need to do some research to find the one you want.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-08T22:46:30.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25780" PostTypeId="1" AcceptedAnswerId="25941" CreationDate="2016-01-08T23:07:59.520" Score="3" ViewCount="976" Body="&lt;p&gt;Cisco 3850/IP Base/IOS XE 3.7.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was going over my NetFlow data, and it seemed I was only catching flow in, and not out. I already had the in/out records and monitors, using the same exporter to one sensor in the monitoring suite. I set up another sensor on the monitoring software, using the next numerical port. It worked as intended for about 5 minutes, then stopped transmitting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing here? the In exporter is using 2055, the Out using 2056. This was done to allow separate sensors in software. It &lt;em&gt;did&lt;/em&gt; work for a few minutes and then it quit. There definitely seems to be a change, as the still working NetFlow sensor shows highly reduced traffic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flow record Ripon-Core-In&#xA; match ipv4 tos&#xA; match ipv4 protocol&#xA; match ipv4 source address&#xA; match ipv4 destination address&#xA; match transport source-port&#xA; match transport destination-port&#xA; match interface input&#xA; collect counter bytes long&#xA; collect counter packets long&#xA;!&#xA;!&#xA;flow record Ripon-Core-Out&#xA; match ipv4 tos&#xA; match ipv4 protocol&#xA; match ipv4 source address&#xA; match ipv4 destination address&#xA; match transport source-port&#xA; match transport destination-port&#xA; match interface output&#xA; collect counter bytes long&#xA; collect counter packets long&#xA;!         &#xA;!         &#xA;flow exporter Ripon-Core&#xA; destination 10.2.225.65&#xA; source Vlan110&#xA; transport udp 2055&#xA;!         &#xA;!         &#xA;flow exporter Ripon-Core-Out&#xA; destination 10.2.225.65&#xA; source Vlan110&#xA; transport udp 2056&#xA;!         &#xA;!         &#xA;flow monitor Ripon-Core-In&#xA;  exporter Ripon-Core&#xA; cache timeout active 900&#xA; record Ripon-Core-In&#xA;!         &#xA;!         &#xA;flow monitor Ripon-Core-Out&#xA; exporter Ripon-Core-Out&#xA; cache timeout active 900&#xA; record Ripon-Core-Out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sho flow exporter status&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Flow Exporter Ripon-Core:&#xA;  Packet send statistics (last cleared 2w2d ago):&#xA;    Successfully sent:         2666339               (3097186452 bytes)&#xA;&#xA;  Client send statistics:&#xA;    Client: Flow Monitor Ripon-Core-In&#xA;      Records added:           41619483&#xA;        - sent:                41619483&#xA;      Bytes added:             1415062422&#xA;        - sent:                1415062422&#xA;&#xA;Flow Exporter Ripon-Core-Out:&#xA;  Packet send statistics (last cleared 00:48:04 ago):&#xA;    Successfully sent:         60                    (70098 bytes)&#xA;&#xA;  Client send statistics:&#xA;    Client: Flow Monitor Ripon-Core-Out&#xA;      Records added:           1893&#xA;        - sent:                1893&#xA;      Bytes added:             64362&#xA;        - sent:                64362&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the port to which it is applied:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface TenGigabitEthernet1/0/12&#xA; switchport access vlan 110&#xA; switchport mode access&#xA; ip flow monitor Ripon-Core-In input&#xA; ip flow monitor Ripon-Core-Out output`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1068" LastEditorUserId="8499" LastEditDate="2016-03-14T18:53:29.160" LastActivityDate="2017-05-10T08:16:33.640" Title="NetFlow-working one direction only" Tags="|cisco|troubleshooting|switching|netflow|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25781" PostTypeId="1" AcceptedAnswerId="25782" CreationDate="2016-01-08T23:33:39.567" Score="2" ViewCount="329" Body="&lt;p&gt;Suppose there are 4 switches connected using a normal ethernet cables of speed 100mbps as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(S1)---100mbps----&amp;gt;(S2)----100mbps---&amp;gt;(S3)----100mbps---&amp;gt;(S4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now suppose the link between &lt;code&gt;S3&lt;/code&gt; and &lt;code&gt;S4&lt;/code&gt; suddenly becomes congested and the transmission rate decreases to 50 mbps. I have a question based on this scenario: Does the path from &lt;code&gt;S1&lt;/code&gt; to &lt;code&gt;S3&lt;/code&gt; need to adjust the transmission rate to deal with the decrease happened on the link between &lt;code&gt;S3&lt;/code&gt; to &lt;code&gt;S4&lt;/code&gt;? If yes, how ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19174" LastActivityDate="2016-01-09T00:03:12.867" Title="Understanding the effect of transmission rate change in network" Tags="|cisco|switch|ethernet|bandwidth|network-core|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25782" PostTypeId="2" ParentId="25781" CreationDate="2016-01-08T23:40:36.790" Score="3" Body="&lt;p&gt;Why would congestion on that link cause the transmission rate to drop? I think you are working from an incorrect premise. You can try to run 200 Mbps through a 100 Mbps link, but the transmission rate will stay at 100 Mbps; the excess will just be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is layer-2 (switches and ethernet) which don't have any facility for re-transmission of dropped frames. When frames are dropped, they are just lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say that S4 is a 48-port switch, and the 48 access ports are each 100 Mbps, as is the uplink port. If all 48 access ports suddenly decided to transmit 100 Mbps each through the 100 Mbps uplink port, the uplink port would transmit 100 Mbps of the 4800 Mbps of traffic trying to use it, and the other 4700 Mbps would be lost.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-09T00:03:12.867" LastActivityDate="2016-01-09T00:03:12.867" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25783" PostTypeId="2" ParentId="25747" CreationDate="2016-01-09T00:14:16.317" Score="3" Body="&lt;p&gt;There are many wireless companies, many of which I have no experience. That said, I personally have never seen or heard of any Pakedge or Luxel wireless deployments. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There has been a lot of change in this industry and probably will continue to be. If someone were to ask me a list of vendors to consider, this would be my current list (in order):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Aruba/HP&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Based on recent deployments (802.11ac), if you asked me for only one vendor, I would say Aruba. Solid code, great support (both company and community), best vendor roadmap I have seen for wireless, and a product that just works well (and even better after some knowledgeable tweaking).&lt;/li&gt;&#xA;&lt;li&gt;Biggest concern is that companies acquired by HP have not always integrated well. About a year in and so far, so good, but only time will ultimately tell.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Cisco/Meraki&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Hands down, the biggest wireless vendor in the market.&lt;/li&gt;&#xA;&lt;li&gt;Strictly speaking of the hardware, I think the Cisco wireless products are probably the best on the market. &lt;/li&gt;&#xA;&lt;li&gt;Code generally seems to have had more issues lately, and there have always been concerns about the code on the Meraki line for me. On the flip side, they are probably the quickest to find a solution when a problem is discovered in their code for their main product line.&lt;/li&gt;&#xA;&lt;li&gt;Unless you are a really big customer, I have found Cisco support a bit lacking in comparison to other vendors. I also find other vendor's online communities (Aruba/Aerohive/Ubiquiti) a bit more useful.&lt;/li&gt;&#xA;&lt;li&gt;Cisco's path forward with wireless seems a bit murky after several years into the Meraki acquisition. While Cisco normally merges their acquisitions into their existing product lines, Cisco maintains they will continue to run the separate Meraki product line. Two competing product lines doesn't make a lot of sense to me (a lot of redundancies - engineering, development, QA, marketing, sales, etc). My personal belief is that Cisco loves the licensing (financial) model of Meraki but that line isn't appealing to many of their Enterprise customers. End result seems like they can't make a decision which way to go for now.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Aerohive&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One product line that can be managed from the cloud or local controllers. Lots of features and options when using their products, keeping in line with the bigger players.&lt;/li&gt;&#xA;&lt;li&gt;Small company with solid growth over the past several years. Dell partnership should help this continue, potentially locking them into the #3 player in the market.&lt;/li&gt;&#xA;&lt;li&gt;Good support with a solid online user community.&lt;/li&gt;&#xA;&lt;li&gt;My primary concern is that I have seen a number of wireless companies stumble when they try to make the transition from smaller wireless vendor to large enterprise vendor. So far they seem to be handling it, but again only time will tell.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Ruckus&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Popular especially among carriers, they have been winning a number of enterprises as well. Still a small player (but so is everyone next to the top two), but a solid company with sound financials.&lt;/li&gt;&#xA;&lt;li&gt;Features and capabilities seem to be a bit lacking compared to what is found in other vendor solutions, but they have some key technologies (i.e. adaptive antenna arrays) that separate them from the crowd.&lt;/li&gt;&#xA;&lt;li&gt;Didn't need their support much, but didn't have any problems when I did. Their online community is a bit lacking from my perspective.&lt;/li&gt;&#xA;&lt;li&gt;Feedback I have heard is that often works great, but in some environments it can have a lot of problems.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Ubiquiti Networks&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Not really enterprise, but offers free &quot;controller&quot; software. I often refer to them as semi-enterprise.&lt;/li&gt;&#xA;&lt;li&gt;Seems to be popular among service providers and especially WISPs.&lt;/li&gt;&#xA;&lt;li&gt;Low cost. Almost consumer product low. This is the product I recommend on tight budgets for small businesses, startups or non-profits.&lt;/li&gt;&#xA;&lt;li&gt;Vendor support is only offered during warranty period, but very active online community where vendor support also participates.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Meru/Fortinet&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is one of the wireless companies that &quot;stumbled&quot; when transitioning from small to large vendors. Problems with their 802.11n wave one products and their code caused them to lose many customers prior to 802.11ac.&lt;/li&gt;&#xA;&lt;li&gt;Bad first level support, but I never had problems if I could get the case escalated past them. There used to be a couple of decent mailing lists that dried up as they lost customers and the online community they kicked off more recently is lacking.&lt;/li&gt;&#xA;&lt;li&gt;Have heard some reports that their 802.11ac products are much better and the recent acquisition by Fortinet may breath some life back into this product line yet.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Xirrus&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Been around for a long time with a particular niche product line.&lt;/li&gt;&#xA;&lt;li&gt;I haven't seen one installed in a long time or used one, but I know a couple of people who still love theirs. Can't speak for much more than that currently.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Of these, I have experience with all except Xirris within the last 3-5 years (at least 802.11n) and all have their benefits/problems. In most enterprise environments, I would only look at the top four options, the other three being more niche or small/medium deployments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hands down, Cisco and Aruba are the top players providing the best and most stable product with the widest feature sets and flexibility. If you don't want to consider too many vendors, stick to those two and you should be all right.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-01-09T00:14:16.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25786" PostTypeId="2" ParentId="22360" CreationDate="2016-01-09T07:04:59.457" Score="1" Body="&lt;p&gt;You actually have two issues :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Determining that the link is down&lt;/li&gt;&#xA;&lt;li&gt;Using that information to modify your routing.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you have a Cisco router behind the two connections, you would use IP SLA to track a remote device through each connection (typically by pinging it regularly), and then configure HSRP such that the HSRP priority on the main router is changed if ever its link goes down. Traffic will automatically move back to the main link once it's back up.&#xA;See &lt;a href=&quot;http://ciscodreamer.blogspot.fr/2009/09/ip-sla-with-hsrp.html&quot; rel=&quot;nofollow&quot;&gt;http://ciscodreamer.blogspot.fr/2009/09/ip-sla-with-hsrp.html&lt;/a&gt; for an example&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The trick, especially on an Internet connection, is finding something that you can ping which will give you a reliable indication of whether your link is down or not, or else you will get spurious failovers.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-09T07:04:59.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25787" PostTypeId="2" ParentId="17582" CreationDate="2016-01-09T07:41:42.497" Score="2" Body="&lt;p&gt;If your network uses 802.1x with Radius, you can also retrieve this information from the Called Station ID field in the Radius request. Even better, by default this will give you both the AP MAC and the SSID name the device connected to... very handy when debugging complex environments.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-09T07:41:42.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25788" PostTypeId="2" ParentId="11305" CreationDate="2016-01-09T08:02:00.397" Score="1" Body="&lt;p&gt;Depending on the level of control you have over your network environment (or how much you trust the devices connected to it), you could also look into having the video devices themselves tag their traffic with the appropriate DSCP value, and then mapping any traffic with that value to the queue you want. I have found this to be easier than listing the protocols, since the video terminal has the best knowledge of its protocols, ports and so on.&#xA;They often have a fairly consistent approach of this, tagging the media streams as AF41 (or 43 ? haven't looked this up recently).&#xA;Again, this assumes you can trust the incoming tags from the LAN on your router.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-09T08:02:00.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25791" PostTypeId="1" CreationDate="2016-01-09T08:52:35.463" Score="3" ViewCount="380" Body="&lt;p&gt;On one MikroTik router, I want to divide my users to two groups and assign each group to a separate network (two networks). How do I do that?&lt;/p&gt;&#xA;" OwnerUserId="21895" LastEditorUserId="8499" LastEditDate="2018-02-14T16:25:21.700" LastActivityDate="2018-02-14T16:25:21.700" Title="Routing users on MikroTik" Tags="|routing|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-09T23:46:55.223" ContentLicense="CC BY-SA 3.0" />
  <row Id="25792" PostTypeId="2" ParentId="25791" CreationDate="2016-01-09T12:00:37.523" Score="2" Body="&lt;p&gt;Assuming you have separated them into two vlans, or in two parts of a subnet, or some other criteria that is comprehensible at the network level, you will most likely need to setup a Policy Route, i.e. a rule that routes based on something more than just the packet's destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you have user group A in subnet 192.168.1.0/24 and user group B in subnet 192.168.2.0/24 you could create a Policy Route such that if the packet comes from subnet 192.168.1.0/24 it is sent out through line 1, and if the packet comes from the other subnet it is sent out through line 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See here : &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Policy_Base_Routing&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Policy_Base_Routing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-09T12:00:37.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25797" PostTypeId="2" ParentId="25791" CreationDate="2016-01-09T17:22:02.770" Score="0" Body="&lt;p&gt;It is pretty easy to separate users in different networks on MikroTiks with RouterOS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let say you need to separate Wi-Fi clients from Wi-Fi guests. All you need to do is to add a new virtual Wi-Fi interface, add an IP address to the interface, create a new DHCP server, and setup routes for traffic to flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a good explanation how is done. It was really helpful for me:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://networkingforintegrators.com/2013/01/how-to-run-multiple-networks-from-a-mikrotik/&quot; rel=&quot;nofollow&quot;&gt;How to run multiple networks from a Mikrotik&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21900" LastEditorUserId="8499" LastEditDate="2016-04-08T22:08:22.537" LastActivityDate="2016-04-08T22:08:22.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25798" PostTypeId="2" ParentId="23822" CreationDate="2016-01-09T17:48:13.347" Score="2" Body="&lt;p&gt;Add following line to your &lt;code&gt;rc.conf&lt;/code&gt; to instruct quagga's bgpd to retain routes upon termination:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bgpd_flags=&quot;-r&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Quagga's startup script (&lt;code&gt;/usr/local/etc/rc.d/quagga&lt;/code&gt;) documented a list of variables and settings you can configure upon startup.&lt;/p&gt;&#xA;" OwnerUserId="21904" LastActivityDate="2016-01-09T17:48:13.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25800" PostTypeId="1" AcceptedAnswerId="25801" CreationDate="2016-01-09T20:25:53.727" Score="6" ViewCount="2547" Body="&lt;p&gt;MAC address can be used to generate an IPv6 link local address.&#xA;What is the process of using MAC address to derive an IPv6 address ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the problems that can be caused due to process of using MAC address to derive an IPv6 address  and how&#xA;are they overcome?&lt;/p&gt;&#xA;" OwnerUserId="21873" LastActivityDate="2016-01-09T20:47:19.453" Title="MAC address can be used to generate an IPv6 link local address" Tags="|ipv6|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25801" PostTypeId="2" ParentId="25800" CreationDate="2016-01-09T20:34:24.750" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#appendix-A&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291, IP Version 6 Addressing Architecture, Appendix A&lt;/a&gt; has the full explanation.&lt;/p&gt;&#xA;&lt;p&gt;Basically, you split the 48-bit MAC address down the middle, insert &lt;code&gt;FFFE&lt;/code&gt; to extend it to 64 bits, and flip the U/L bit. This creates the 64-bit Interface ID which you append to the end of the 64 bits of the Global Routing Prefix and Subnet ID combination. For Link-local addresses, the created Interface ID is appended to the Link-local prefix (&lt;code&gt;FE80:0:0:0::&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;Some people are concerned that you can use a unique number, like a MAC address, to track a particular host. To correct this, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4941&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4941, Privacy Extensions for Stateless Address Autoconfiguration in IPv6&lt;/a&gt; was created. Windows and many Linux variants use random addressing by default, but this may be disabled.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-01-09T20:41:51.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25803" PostTypeId="1" AcceptedAnswerId="25804" CreationDate="2016-01-09T20:51:30.613" Score="1" ViewCount="650" Body="&lt;p&gt;I have Router, and there are three DHCP pools: &lt;code&gt;10.0.1.0/24&lt;/code&gt;, &lt;code&gt;10.0.2.0/24&lt;/code&gt;, and &lt;code&gt;10.0.3.0 /24&lt;/code&gt;. Three LANs are connected to this router. If a host on the first LAN sends a DHCP Request, how does the router decide from which DHCP pool to assign the IP address? &lt;/p&gt;&#xA;" OwnerUserId="21907" LastEditorUserId="8499" LastEditDate="2018-12-22T21:20:02.140" LastActivityDate="2018-12-22T21:20:02.140" Title="Choosing a DHCP pool from which to assign an IP address" Tags="|cisco|router|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25804" PostTypeId="2" ParentId="25803" CreationDate="2016-01-09T20:54:26.483" Score="2" Body="&lt;p&gt;The router will use the pool which is in the network assigned to the interface. Each router interface has an assigned IP address and mask. The pool which has addresses within the network (mask the interface address to get the network) is used.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-09T21:26:15.710" LastActivityDate="2016-01-09T21:26:15.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25807" PostTypeId="1" CreationDate="2016-01-10T05:21:57.867" Score="1" ViewCount="1201" Body="&lt;p&gt;While checking:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sh proc cpu history&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there is high CPU utilization which occurs at a particular time.&lt;/p&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="498" LastEditDate="2016-01-11T04:00:54.517" LastActivityDate="2016-01-11T04:00:54.517" Title="How to find the end-device causing high cpu usage in a Cisco switch?" Tags="|cisco|switch|troubleshooting|network-core|port-security|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-07T17:47:33.917" ContentLicense="CC BY-SA 3.0" />
  <row Id="25808" PostTypeId="2" ParentId="25807" CreationDate="2016-01-10T05:27:26.810" Score="4" Body="&lt;p&gt;What is driving CPU usage in a Cisco switch is probably not a single end-device. Cisco switches can normally handle a full switching load without driving the CPU utilization unusually high. This is because the switching is largely handled in hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most likely cause is a service or protocol which the switch needs to handle in software. You didn't include the &lt;code&gt;show processes cpu&lt;/code&gt; output, switch model, IOS version, and configuration. Without those, it is merely a guessing game.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-10T05:33:10.807" LastActivityDate="2016-01-10T05:33:10.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25811" PostTypeId="1" AcceptedAnswerId="26025" CreationDate="2016-01-10T09:09:29.490" Score="2" ViewCount="24900" Body="&lt;p&gt;I am very new to networking in general. For one of my assignments, I need to be able to ping two routers ( R5 must be able to ping R4 ) in different networks.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/3CBP7.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3CBP7.jpg&quot; alt=&quot;SimpleTopology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this, I set up routing in both R1 and R2. Here is the configuration for R1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1(config)#ip route 21.0.0.0 255.255.255.0 10.0.0.2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and here is the route configuration for R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)#ip route 11.0.0.0 255.255.255.0 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I might be missing an obvious thing here. R1 and R2 can ping each other. However, R2/R4 cannot ping to R5 and R1/R5 cannot ping to R4.&#xA;Lets ignore the cloud and the VPC interface shown.&#xA;Could anyone please tell me what is happening and what i am missing? I am a newbie and I have limited knowledge as I am just starting. I am using GNS3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 1:&#xA;Here are the routing tables so far.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/22Wjv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/22Wjv.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21917" LastEditorUserId="21917" LastEditDate="2016-01-10T10:03:39.330" LastActivityDate="2016-01-18T14:52:36.060" Title="Connecting two routers in different networks via Static Routing" Tags="|routing|cisco-commands|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="25812" PostTypeId="1" CreationDate="2016-01-10T11:25:53.137" Score="2" ViewCount="1405" Body="&lt;p&gt;How Netflow collector works in packet tracer to analyze the different parameters like counter bytes and counter packets &lt;/p&gt;&#xA;" OwnerUserId="21918" LastActivityDate="2016-01-11T19:35:08.887" Title="About Netflow Collector in packet tracer" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25813" PostTypeId="1" AcceptedAnswerId="25814" CreationDate="2016-01-10T11:38:13.913" Score="2" ViewCount="192" Body="&lt;p&gt;When we ping a major web site, we're roughly measuring the delay between our device and the geographic location of the server that the site has chosen to send us to. It really could be anywhere. but let's just say it's 1000 kilometers of fiber plus some copper plus some air (if I'm using my phone to ping) away from us.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The server could be only 10 km away from us but the packets are going through a far-away big city)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I use 2E+05 km/sec for the speed of signal in fiber or wire (from this &lt;a href=&quot;https://networkengineering.stackexchange.com/q/16438/21921&quot;&gt;question&lt;/a&gt;) then the round trip is roughly 10 milliseconds. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK so this is my first question here on Network Engineering SE and it's a little esoteric, but I think it's valid. For this type of &quot;medium distance&quot; connection in a part of the world with modern internet infrastructure, what fraction of a ping time comes from propagation delay, and what fraction comes from electronic buffering in routers, encoders/decoders, etc. along the way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to look at this is from the perspective of storage. During that ping time, your ping is either stored:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;in some DRAM or SRAM (or even worse sometimes - FLASH and Magnetic HD's)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;as an electromagnetic wave traveling down a fiber or in the air&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;as a current pulse traveling in a cable or circuit board or chip.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;While every situation is different, more often than not our data spends most of it's time as an electromagnetic wave or traveling current pulse. But is it typically 99.99% of the time, or 95%, or 51%? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Loosely speaking - at any moment in time how much of &quot;the internet&quot; is sitting in a buffer?&lt;/p&gt;&#xA;" OwnerUserId="21921" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-01-10T17:43:53.320" Title="Loosely speaking, at any given moment, how much of the internet is buffered?" Tags="|routing|router|internet|latency|layer1|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25814" PostTypeId="2" ParentId="25813" CreationDate="2016-01-10T12:01:07.807" Score="4" Body="&lt;p&gt;I'm not sure what you mean by buffer. There no buffering like when you want to watch a video.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides the inherent latency of the bits traveling the various media in a path, there are delays due to serialization/deserialization to get bits on/off a link, frames must be stripped so that routers can inspect the packet, delays for routing lookups, packets must be re-encapsulated in frames for the next link, possible delays for queues when there is congestion (this varies greatly depending on the traffic load, which constantly changes), and a delays for TCP when IP packets are dropped and need to be resent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of buffering like you may think of it, relatively small queues (usually less than 100 packets, possibly several for various traffic types) may be used in a router, and when a queue is full, packets are just dropped. There is also RED which randomly drops packets in a queue in order to prevent a queue from filling up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pings (ICMP in general) have a very low priority and are most likely to be dropped or put in a low-priority queue (other, higher-priority queues are served first).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is far too much chaos on the Internet to give a single answer to your question. It depends on how many hops, which medium is between each hop, the router capabilities at each hop, whether the routing in any of the hops needs to be process switched, if any of the networks through which the traffic passes have QoS policies in place (and they could all be very different), etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You question is not really on-topic, but I gave you an answer which generally explains how things work.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-10T12:01:07.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25815" PostTypeId="2" ParentId="25767" CreationDate="2016-01-10T13:17:44.967" Score="1" Body="&lt;p&gt;Solved! After the command statement is complete and you are done at that level of config either enter the command &quot;end&quot; to go back to the root or &quot;next&quot; which takes you back only one level. Moving out of the current config level will apply the command statements.&lt;/p&gt;&#xA;" OwnerUserId="21880" LastActivityDate="2016-01-10T13:17:44.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25817" PostTypeId="2" ParentId="18108" CreationDate="2016-01-10T16:10:37.130" Score="0" Body="&lt;p&gt;This was &lt;a href=&quot;https://lists.strongswan.org/pipermail/users/2015-April/007941.html&quot; rel=&quot;nofollow&quot;&gt;discussed on the strongSwan mailing list&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see from that thread, in the end it turned out that it makes no real sense to use this, at least not with strongSwan.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2016-01-10T16:10:37.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25818" PostTypeId="1" CreationDate="2016-01-10T16:12:32.593" Score="2" ViewCount="83" Body="&lt;p&gt;My teacher told me today that when we request a page on a server, the server takes the request, find if it's available in the database, &lt;b&gt;disconnect&lt;/b&gt; the user and send the requested page to the user. The server does not know if you get the packet or not. It's because the server's capacity to give service to users at a time is limited. This is why it does not keep its connection to the user. Thus, it can serve more people. He particularly gave the example of facebook and said that's why it serves millions of people and yet it doesn't get slow or hang. If that is the case then how do we get instant notification from facebook? Or how is the online friend list almost accurate always?&lt;/p&gt;&#xA;" OwnerUserId="21106" LastEditorUserId="8499" LastEditDate="2018-02-16T03:59:52.610" LastActivityDate="2018-02-16T03:59:52.610" Title="If Facebook is not connected to its server all the time then how do we get instant notifications/messages?" Tags="|internet|" AnswerCount="1" CommentCount="2" ClosedDate="2016-01-10T18:06:01.220" ContentLicense="CC BY-SA 3.0" />
  <row Id="25819" PostTypeId="1" AcceptedAnswerId="25821" CreationDate="2016-01-10T17:08:07.190" Score="5" ViewCount="19882" Body="&lt;p&gt;I understand that routes learnt via iBGP can't be redistributed to other iBGP peers to avoid loops, but then why is a iBGP connection between two routers that don't have eBGP connections needed? They won't distribute anything, right?&lt;/p&gt;&#xA;" OwnerUserId="21931" LastEditorUserId="8499" LastEditDate="2020-11-27T22:37:37.380" LastActivityDate="2020-11-27T22:37:37.380" Title="Why does iBGP require a full-mesh?" Tags="|routing|router|bgp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25820" PostTypeId="2" ParentId="25818" CreationDate="2016-01-10T17:09:06.727" Score="2" Body="&lt;p&gt;Your teacher was probably over-simplifying the explanation in order to communicate that data is not being sent 24/7 from your phone (computer, pc, laptop, roku, or any other 'client') to the Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the answer to your question is predicated upon understanding a few other concepts. Two of them, specifically: &lt;strong&gt;how HTTP Connections&lt;/strong&gt; work, and &lt;strong&gt;how Push Notifications work&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTTP has functions built in which allow multiple requests to be sent in each connection (HTTP Pipielining), as well as keeping a connection open so that additional, residual data requests can be made (HTTP Keepalives). I explain &lt;a href=&quot;https://networkengineering.stackexchange.com/a/13464/3675&quot;&gt;how a &quot;regular&quot; HTTP connection works, and how it is different when employing HTTP Keepalives and Pipelining in this thread&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the second part, the answer to How Push Notifications work on mobile phones is actually slightly off topic to this particular stack exchange. But it has already been answered in the &lt;a href=&quot;https://android.stackexchange.com/&quot;&gt;Android Stack Exchange&lt;/a&gt; in &lt;a href=&quot;https://android.stackexchange.com/a/51045&quot;&gt;this thread&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read through both of those threads and you should come to an understanding of your original question. If not, please feel free to update your question, create a new question, or add comments to this one and we can help you from there.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-01-10T17:09:06.727" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25821" PostTypeId="2" ParentId="25819" CreationDate="2016-01-10T17:26:46.757" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;...why is a iBGP connection between two routers that don't have eBGP&#xA;  connections needed? They won't distribute anything, right?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not quite right. It's not that two routers connected via iBGP cannot learn &lt;em&gt;any&lt;/em&gt; prefixes from each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose you have two WAN routers in your AS, A and B, both connected to separate WAN ASes via eBGP, and connected together via iBGP. Router A cannot learn prefixes from Router B about which Router B learned from other iBGP speakers in your AS, but it &lt;em&gt;can&lt;/em&gt; learn about prefixes which Router B learned about from eBGP or an IGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any prefixes which Router A learns about through iBGP from Router B cannot be passed on to any other iBGP speakers because those prefixes could be sent back to Router B, directly or indirectly. That's the reason for needing a full mesh or a mitigation such as route reflectors or confederations; other iBGP speakers will need to learn the prefixes which Router B &lt;em&gt;will&lt;/em&gt; share with other iBGP speaker directly from Router B since Router A is unable to pass those prefixes on.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-10T17:26:46.757" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="25822" PostTypeId="2" ParentId="1550" CreationDate="2016-01-10T17:28:10.870" Score="0" Body="&lt;p&gt;The above procedure is detailed in this video &lt;a href=&quot;https://www.youtube.com/watch?v=MnmPeZTKnoU&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=MnmPeZTKnoU&lt;/a&gt; it also explains how to break to boot if it doesn't happen the first time. Also how to fix it so it breaks to boot process every time.&lt;/p&gt;&#xA;" OwnerUserId="21932" LastActivityDate="2016-01-10T17:28:10.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25823" PostTypeId="1" AcceptedAnswerId="25825" CreationDate="2016-01-10T19:41:06.990" Score="3" ViewCount="2585" Body="&lt;p&gt;I want to block Host 192.168.1.1 from reaching 192.168.2.0/24 network and in order to implement that I've applied Extended ACL &quot;ACL_FOR_R2&quot; on R2's serial2/0 interface. Now as we all know that at the end of every access list is an implied &quot;deny all traffic&quot; criteria statement. Therefore, if a packet does not match any of your criteria statements, the packet will be blocked. So I didn't mention any statement in the ACL &quot;ACL_FOR_R2&quot; assuming we only have one statement in that ACL as &quot;deny all&quot; but the problem is when I ping from R1 to 192.168.2.2, R2 doesn't block the traffic and ping reaches to R3. WHY?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the configurations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;- R1's configurations:&#xA;&#xA;    R1#show running-config&#xA;    Building configuration...&#xA;&#xA;    Current configuration : 1557 bytes&#xA;    !&#xA;    version 12.4&#xA;    service timestamps debug datetime msec&#xA;    service timestamps log datetime msec&#xA;    no service password-encryption&#xA;    !&#xA;    hostname R1&#xA;    !&#xA;    boot-start-marker&#xA;    boot-end-marker&#xA;    !&#xA;    !&#xA;    no aaa new-model&#xA;    memory-size iomem 5&#xA;    no ip icmp rate-limit unreachable&#xA;    ip cef&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    no ip domain lookup&#xA;    !&#xA;    multilink bundle-name authenticated&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    archive&#xA;     log config&#xA;      hidekeys&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    ip tcp synwait-time 5&#xA;    ip ssh version 1&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    interface FastEthernet0/0&#xA;     no ip address&#xA;     shutdown&#xA;     duplex auto&#xA;     speed auto&#xA;    !&#xA;    interface FastEthernet0/1&#xA;     no ip address&#xA;     shutdown&#xA;     duplex auto&#xA;     speed auto&#xA;    !&#xA;    interface FastEthernet1/0&#xA;     no ip address&#xA;     shutdown&#xA;     duplex auto&#xA;     speed auto&#xA;    !&#xA;    interface Serial2/0&#xA;     ip address 192.168.1.1 255.255.255.0&#xA;     ip access-group ACL_FOR_R1 out&#xA;     serial restart-delay 0&#xA;    !&#xA;    interface Serial2/1&#xA;     no ip address&#xA;     shutdown&#xA;     serial restart-delay 0&#xA;    !&#xA;    interface Serial2/2&#xA;     no ip address&#xA;     shutdown&#xA;     serial restart-delay 0&#xA;    !&#xA;    interface Serial2/3&#xA;     no ip address&#xA;     shutdown&#xA;     serial restart-delay 0&#xA;    !&#xA;    router eigrp 1&#xA;     network 192.168.1.0&#xA;     auto-summary&#xA;    !&#xA;    ip forward-protocol nd&#xA;    !&#xA;    !&#xA;    no ip http server&#xA;    no ip http secure-server&#xA;    !&#xA;    no cdp log mismatch duplex&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    control-plane&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    banner motd ^C&#xA;    **********************************&#xA;    This is a Cisco .&#xA;    **********************************^C&#xA;    !&#xA;    line con 0&#xA;     exec-timeout 0 0&#xA;     privilege level 15&#xA;     password cisco&#xA;     logging synchronous&#xA;     login&#xA;    line aux 0&#xA;     exec-timeout 0 0&#xA;     privilege level 15&#xA;     logging synchronous&#xA;    line vty 0 4&#xA;     password cisco&#xA;     login&#xA;    line vty 5 15&#xA;     password cisco&#xA;     login&#xA;    !&#xA;    !&#xA;    end&#xA;&#xA;    R1#un all&#xA;    All possible debugging has been turned off&#xA;    R1#&#xA;&#xA;    R1#show run&#xA;    R1#show running-config&#xA;    Building configuration...&#xA;&#xA;    Current configuration : 1557 bytes&#xA;    !&#xA;    version 12.4&#xA;    service timestamps debug datetime msec&#xA;    service timestamps log datetime msec&#xA;    no service password-encryption&#xA;    !&#xA;    hostname R1&#xA;    !&#xA;    boot-start-marker&#xA;    boot-end-marker&#xA;    !&#xA;    !&#xA;    no aaa new-model&#xA;    memory-size iomem 5&#xA;    no ip icmp rate-limit unreachable&#xA;    ip cef&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    no ip domain lookup&#xA;    !&#xA;    multilink bundle-name authenticated&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    archive&#xA;     log config&#xA;      hidekeys&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    ip tcp synwait-time 5&#xA;    ip ssh version 1&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    interface FastEthernet0/0&#xA;     no ip address&#xA;     shutdown&#xA;     duplex auto&#xA;     speed auto&#xA;    !&#xA;    interface FastEthernet0/1&#xA;     no ip address&#xA;     shutdown&#xA;     duplex auto&#xA;     speed auto&#xA;    !&#xA;    interface FastEthernet1/0&#xA;     no ip address&#xA;     shutdown&#xA;     duplex auto&#xA;     speed auto&#xA;    !&#xA;    interface Serial2/0&#xA;     ip address 192.168.1.1 255.255.255.0&#xA;     ip access-group ACL_FOR_R1 out&#xA;     serial restart-delay 0&#xA;    !&#xA;    interface Serial2/1&#xA;     no ip address&#xA;     shutdown&#xA;     serial restart-delay 0&#xA;    !&#xA;    interface Serial2/2&#xA;     no ip address&#xA;     shutdown&#xA;     serial restart-delay 0&#xA;    !&#xA;    interface Serial2/3&#xA;     no ip address&#xA;     shutdown&#xA;     serial restart-delay 0&#xA;    !&#xA;    router eigrp 1&#xA;     network 192.168.1.0&#xA;     auto-summary&#xA;    !&#xA;    ip forward-protocol nd&#xA;    !&#xA;    !&#xA;    no ip http server&#xA;    no ip http secure-server&#xA;    !&#xA;    no cdp log mismatch duplex&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    control-plane&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    banner motd ^C&#xA;    **********************************&#xA;    This is a Cisco .&#xA;    **********************************^C&#xA;    !&#xA;    line con 0&#xA;     exec-timeout 0 0&#xA;     privilege level 15&#xA;     password cisco&#xA;     logging synchronous&#xA;     login&#xA;    line aux 0&#xA;     exec-timeout 0 0&#xA;     privilege level 15&#xA;     logging synchronous&#xA;    line vty 0 4&#xA;     password cisco&#xA;     login&#xA;    line vty 5 15&#xA;     password cisco&#xA;     login&#xA;    !&#xA;    !&#xA;    end&#xA;&#xA; - R2's configurations:&#xA;&#xA;R2#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 1627 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial2/0&#xA; ip address 192.168.1.2 255.255.255.0&#xA; ip access-group ACL_FOR_R2 in&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/1&#xA; ip address 192.168.2.1 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 192.168.1.0&#xA; network 192.168.2.0&#xA; auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip access-list extended ACL_FOR_R2&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;banner motd ^C&#xA;**********************************&#xA;This is a Cisco .&#xA;**********************************^C&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; password cisco&#xA; logging synchronous&#xA; login&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA; - R3's configurations:&#xA;&#xA;R3#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 1525 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R3&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial2/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/1&#xA; ip address 192.168.2.2 255.255.255.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; network 192.168.2.0&#xA; auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;banner motd ^C&#xA;**********************************&#xA;This is a Cisco .&#xA;**********************************^C&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; password cisco&#xA; logging synchronous&#xA; login&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; password cisco&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;R1#ping 192.168.2.2&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.168.2.2, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 28/46/88 ms&#xA;R1#ping 192.168.2.1&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.168.2.1, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 8/46/104 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17520" LastActivityDate="2016-01-10T20:27:16.680" Title="Why &quot;Deny all&quot; statement in ACL is not working?" Tags="|routing|acl|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25824" PostTypeId="2" ParentId="25679" CreationDate="2016-01-10T20:09:14.027" Score="1" Body="&lt;p&gt;I do this exact scenario now. My robots run ROS, but it doesn't make a difference. My company is in the states and we use Verizon 4G but again it doesn't matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic steps are&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;We run an OpenVPN server on EC2 (Ubuntu 14.04)&lt;/li&gt;&#xA;&lt;li&gt;Each client (robot) connects to the OpenVpn. We happen to run Ubuntu 14.04 on this as well. &lt;/li&gt;&#xA;&lt;li&gt;Since the robots are clients of the VPN each must have a certificate to join the VPN.&lt;/li&gt;&#xA;&lt;li&gt;Certificates possess what is called a common name. This will be unique per robot (in our case we have multiple computers per robot, so it is unique per host/computer)&lt;/li&gt;&#xA;&lt;li&gt;This common name is used alongside OpenVPN CCD functionality. This acts a sort of static assignment of IP based on cert name. &lt;a href=&quot;https://openvpn.net/index.php/open-source/documentation/howto.html#policy&quot; rel=&quot;nofollow&quot;&gt;https://openvpn.net/index.php/open-source/documentation/howto.html#policy&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;If you are wise you can then configure DNS.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Robots will essentially try indefinitely to connect to the vpn, when they connect they will receive a static ip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, we have built functionality that runs as service that will try various version of &lt;code&gt;ifdown tun0 &amp;amp;&amp;amp; ifup tun0&lt;/code&gt; and &lt;code&gt;service openvpn restart&lt;/code&gt; in order to ensure connectivity. We can afford to do this since our robots are completely autonomous except for monitoring purposes.&lt;/p&gt;&#xA;" OwnerUserId="21935" LastActivityDate="2016-01-10T20:09:14.027" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25825" PostTypeId="2" ParentId="25823" CreationDate="2016-01-10T20:20:57.040" Score="5" Body="&lt;p&gt;Normally you would be right, there is an implied &quot;deny&quot; at the end of every access list. You have found the exception however, because you use an empty access list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial2/0&#xA; ip address 192.168.1.2 255.255.255.0&#xA; ip access-group ACL_FOR_R2 in&#xA; serial restart-delay 0&#xA;!&#xA;&amp;lt;snip&amp;gt;&#xA;!&#xA;ip access-list extended ACL_FOR_R2&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/15-mt/sec-data-acl-15-mt-book/sec-access-list-ov.html&quot; rel=&quot;noreferrer&quot;&gt;documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;An interface or command with an empty access list applied to it permits all traffic into the network.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So as soon as you add any term to the ACL, it will start blocking all other traffic.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-01-10T20:20:57.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25826" PostTypeId="2" ParentId="25823" CreationDate="2016-01-10T20:27:16.680" Score="3" Body="&lt;p&gt;Your configurations are really messed up; you don't even have an ACL defined on R1, but you are applying one to the interface. The proper ways to deny the host (rather than all traffic except what you want to specifically permit) &lt;code&gt;192.168.1.1&lt;/code&gt; from reaching the &lt;code&gt;192.168.2.0/24&lt;/code&gt; network are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apply a standard access list to R2 &lt;code&gt;Serail2/1&lt;/code&gt; to prevent traffic from that host &lt;code&gt;out&lt;/code&gt; the interface with that network, while allowing any other traffic &lt;code&gt;out&lt;/code&gt; that interface and allowing any traffic from that host &lt;code&gt;out&lt;/code&gt; any other interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial2/1&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip access-group DENY_HOST in&#xA;!&#xA;ip access-list standard DENY_HOST&#xA; deny host 192.168.1.1&#xA; permit any&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could explicitly permit a different address and use the implicit &lt;code&gt;deny all&lt;/code&gt; to block everything else (it doesn't matter that the network doesn't even exit on your network):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial2/1&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip access-group PERMIT_BOGUS in&#xA;!&#xA;ip access-list standard PERMIT_BOGUS&#xA; permit 192.168.0.0 0.0.0.255&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Apply an extended access list to R2 &lt;code&gt;Serail2/0&lt;/code&gt; to drop any traffic &lt;code&gt;in&lt;/code&gt; from that host destined to that network, while allowing traffic &lt;code&gt;in&lt;/code&gt; from that host, or any other traffic, to anywhere else:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial2/0&#xA; ip address 192.168.1.2 255.255.255.0&#xA; ip access-group DENY_HOST out&#xA;!&#xA;ip access-list extended DENY_HOST&#xA; deny ip host 192.168.1.1 192.168.2.0 0.0.0.255&#xA; permit ip any any&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could explicitly permit a different address and use the implicit &lt;code&gt;deny all&lt;/code&gt; to block everything else (it doesn't matter that the network doesn't even exit on your network):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Serial2/0&#xA; ip address 192.168.1.2 255.255.255.0&#xA; ip access-group PERMIT_BOGUS out&#xA;!&#xA;ip access-list extended PERMIT_BOGUS&#xA; permit ip 192.168.0.0 0.0.0.255 any&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think you are confusing things since the implicit deny at the end will deny all traffic from any host, not just the one host, except what you explicitly permit, and that is not what your question wants to do. In any case, you need to have something in your access list.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-10T20:27:16.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25827" PostTypeId="1" AcceptedAnswerId="25828" CreationDate="2016-01-10T21:25:56.627" Score="4" ViewCount="36635" Body="&lt;p&gt;What is meaning of the &lt;code&gt;ip default-gateway&lt;/code&gt; command on a Cisco L2 switch? I read something about it on the Internet, but there was written that it allows you to Telnet to the switch. I am little bit confused. When I want to Telnet to the switch, I set the IP address of the VLAN 1 interface, and it works. &lt;/p&gt;&#xA;" OwnerUserId="21907" LastEditorUserId="8499" LastEditDate="2017-08-30T19:14:53.420" LastActivityDate="2020-06-17T18:30:24.887" Title="Meaning of the ip default-gateway L2 switch" Tags="|cisco|switch|cisco-ios|cisco-catalyst|cisco-commands|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25828" PostTypeId="2" ParentId="25827" CreationDate="2016-01-10T21:40:17.460" Score="11" Body="&lt;p&gt;&lt;strong&gt;tl;dr&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch management cannot send anything to a different layer-3 network without a default gateway. Telnet is a bidirectional protocol, and the switch, without the default gateway, would be unable to respond to the host which is attempting to establish the Telnet session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Long explanation:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default gateway on a switch has the same function as any gateway configured on a host PC. Without a default gateway, the switch management address (on VLAN 1 in your case, but it could be on any VLAN configured on the switch) cannot send traffic off its network to another network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a host (including the switch management), wants to send a packet to another host, it needs to resolve the layer-3 address (IP, etc.) to the other host's layer-2 address (MAC, etc.) in order to build a layer-2 frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The host (including the switch management) sends an ARP (Address Resolution Protocol) request via a broadcast to do the resolution. Broadcasts do not cross layer-3 boundaries (routers). The host (including the switch management) can tell if the destination layer-3 address is outside its network because it has its own layer-3 address, the destination layer-3 address, and the network mask of its network. If the destination is on a different layer-3 network, the host (including the switch management) will send the frame to the gateway's layer-2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 does basically the same thing, but IPv6 doesn't have broadcasts, so it uses a special multicast group based on the last 24 bits of the IPv6 address. This doesn't interrupt every host on the LAN, and it, in all probability, with only hit the host for which it wants to resolve the layer-2 address. Multicast doesn't cross layer-3 boundaries, either, unless a router is configured to route multicast (off by default).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-10T21:48:27.677" LastActivityDate="2016-01-10T21:48:27.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25829" PostTypeId="2" ParentId="25827" CreationDate="2016-01-11T02:21:13.287" Score="0" Body="&lt;p&gt;The short answer here is that the default gateway is the local router that gets traffic to other networks. It is the default way to get off of your network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember, routers connect networks and switches create networks. If you are off on another (non-Vlan1) network, you must route the traffic. For instance, your home LAN (x.x.x.x) and your ISP network (y.y.y.y) have a router to connect them (commonly called a cable modem).&lt;/p&gt;&#xA;" OwnerUserId="1068" LastActivityDate="2016-01-11T02:21:13.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25831" PostTypeId="1" AcceptedAnswerId="25847" CreationDate="2016-01-11T05:22:06.247" Score="2" ViewCount="2142" Body="&lt;p&gt;I am trying to help provide decent (better than ATT's awful 3Mbps-on-a-good-day DSL) internet service to a cluster of homes in our rural neighborhood.  The first house (near the main road) has good cable internet, but the provider wants extortionate prices to run service down our 1/2-mile private road.  The plan would be to have that house sign up for a separate maxed-out cable account (maybe 20-50Mbps) and try to extend that service down the road (after the cable modem, using ethernet or wireless). One neighbor believes &quot;mesh&quot; wireless networks, using Ubiquity or Meraki equipment, is the answer.  I agree, except it's a good 1000ft from that first house (the one where the modem would be) to the first house in our cluster - and it's heavily forested.  After that, it shouldn't be too hard to get wireless to the other houses, 500ft or so apart, with some decent sight-lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, how to do that first 1000ft jump ?   I'm pretty sure Cat6 won't get it.  I'm trying to figure out if fiberoptic might be the answer, but I know nothing about it (even though I'm a EE).   Is it as simple as plugging an ethernet-to-fiberoptic transceiver to each end of a 1000ft string of outdoor-rated multi-mode fiberoptic cable, and connecting one transceiver to the modem and the other to the router, wireless gear, whatever ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm cautiously (or naively) optimisitic that it can be done for $500 or so using:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B0088L4PTK&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/CableWholesales-Fiber-Indoor-Outdoor-Multimode/dp/B0088L4PTK&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B003AVRLZI&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/MC200CM-Converter-1000Mbps-multi-mode-mountable/dp/B003AVRLZI/ref=pd_sim_23_4?ie=UTF8&amp;amp;dpID=51aFD-pyuhL&amp;amp;dpSrc=sims&amp;amp;preST=_AC_UL160_SR160%2C160_&amp;amp;refRID=03W1DJ4SX6G8MXH7SD88&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please be gentle !&lt;/p&gt;&#xA;" OwnerUserId="21941" LastEditorUserId="8499" LastEditDate="2019-01-03T02:16:49.180" LastActivityDate="2019-01-03T02:16:49.180" Title="using fiberoptic for long-distance ethernet connection" Tags="|ethernet|wireless|layer1|internet|fiber|" AnswerCount="3" CommentCount="8" ClosedDate="2018-04-04T01:45:05.470" ContentLicense="CC BY-SA 3.0" />
  <row Id="25832" PostTypeId="2" ParentId="18487" CreationDate="2016-01-11T06:46:31.947" Score="2" Body="&lt;p&gt;Depending on how accurate you want all this to be, and assuming you want to stay with the SNMP polling approach, you might want to recalculate the bps value yourself, by taking the system timestamp each time you poll, and the calculating the resulting average bandwidth use between two timestamps :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BW = (InOctets2 - InOctets1) / (timestamp2 - timestamp1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's not entirely accurate because the timestamp is taken on your machine rather than on the switch at the point when it calculates InOctets, but at least you'll remove the implicit dependency on the while loop's duration.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-11T06:46:31.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25833" PostTypeId="1" AcceptedAnswerId="25844" CreationDate="2016-01-11T10:05:46.630" Score="2" ViewCount="542" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EOYvU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EOYvU.png&quot; alt=&quot;Network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to do NAT if I need translate PC IP to IP address f.e. 130.130.130.130? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set &lt;strong&gt;ip nat inside&lt;/strong&gt; and &lt;strong&gt;ip nat Outside&lt;/strong&gt; interface and there is also &lt;strong&gt;OSPF&lt;/strong&gt; between routers and server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use &lt;strong&gt;ip nat inside source static 192.168.0.100 130.130.130.130&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I need to add network 150.150.150.0/24 because of routing, I tried assign this network to LoopBack0 and add this network to OSPF, but it still no working. What I need to do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running config border :&#xA;&lt;a href=&quot;http://pastebin.com/cTuKtszi&quot; rel=&quot;nofollow noreferrer&quot;&gt;Config&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21907" LastEditorUserId="498" LastEditDate="2016-01-11T19:26:17.523" LastActivityDate="2016-01-11T19:26:17.523" Title="Static NAT using IP address from different address space" Tags="|cisco|routing|nat|ospf|troubleshooting|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="25835" PostTypeId="1" AcceptedAnswerId="25870" CreationDate="2016-01-11T11:07:25.393" Score="2" ViewCount="11136" Body="&lt;p&gt;Whar are differences between cluster and active/active failover with cisco asa 5525-x?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastActivityDate="2016-01-12T02:20:08.217" Title="Difference between cisco asa cluster and active/active failover" Tags="|cisco-asa|failover|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25837" PostTypeId="2" ParentId="22830" CreationDate="2016-01-11T11:34:10.897" Score="3" Body="&lt;p&gt;&lt;strong&gt;STM-4 = 252 x E1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simplest way is to go step-by-step through hierarchy:&lt;br&gt;&#xA;STM-1 carries up to 63 E1&lt;br&gt;&#xA;STM-4 carries up to 4 STM-1&lt;br&gt;&#xA;(if you need to go further STM-16=4*STM-4 and so on)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So STM-4 = 4 * 63 * E1 = 252 * E1&lt;/p&gt;&#xA;" OwnerUserId="21943" LastActivityDate="2016-01-11T11:34:10.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25838" PostTypeId="1" CreationDate="2016-01-11T12:34:29.117" Score="0" ViewCount="3758" Body="&lt;p&gt;I've got a bit of a problem. I have 2 Sites. HQ and Branch both are connected via a site-to-site VPN (IPsec).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HQ.: &lt;code&gt;192.168.10.x/24&lt;/code&gt;&#xA;Branch.: &lt;code&gt;192.168.25.x/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am in the HQ building and in the &lt;code&gt;192.168.10.x/24&lt;/code&gt; network, I can access the &lt;code&gt;192.168.25.x/24&lt;/code&gt; network without a problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am at home and connect via FortiGate VPN IPsec client to the HQ, I can access the &lt;code&gt;192.168.10.x/24&lt;/code&gt; network, but I cannot reach the &lt;code&gt;192.168.25.x/24&lt;/code&gt; network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've tried so far.:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Firewall policy to allow traffic from clientvpn network&#xA;(&lt;code&gt;10.10.10.x/24&lt;/code&gt;) to the &lt;code&gt;192.168.25.x/24&lt;/code&gt; network, and reverse.&lt;/li&gt;&#xA;&lt;li&gt;Adding a static route on my PC, so that the PC will try to access&#xA;the &lt;code&gt;192.168.25.x/24&lt;/code&gt; network via &lt;code&gt;10.10.10.1&lt;/code&gt; (FortiGate).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Traceroute will display only &lt;code&gt;* * *&lt;/code&gt; on the process to reach the &lt;code&gt;192.168.25.x/24&lt;/code&gt; network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any Idea? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried using the search, but I couldn't find anything similar.&lt;/p&gt;&#xA;" OwnerUserId="21945" LastEditorUserId="8499" LastEditDate="2016-03-20T17:32:28.917" LastActivityDate="2016-05-19T18:44:06.480" Title="FortiGate Site-to-Site VPN with Client VPN" Tags="|vpn|fortigate|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25839" PostTypeId="2" ParentId="25831" CreationDate="2016-01-11T13:06:07.027" Score="8" Body="&lt;p&gt;Part 1: Using fiber to run a 1000 foot ethernet link&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using fiber to run a long ethernet link is not quite as simple as you make out but it's certainly not unreasonable to DIY.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A few things you have missed.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Putting connectors on the end of fiber is a specialist job. If you don't want to involve any specialists then you need to buy pre-terminated fiber terminated with the right connectors.&lt;/li&gt;&#xA;&lt;li&gt;You should avoid sharp bends in the fiber, I would also suggest running a duct rather than direct burial even if the cable you buy is advertised as suitable for direct burial.&lt;/li&gt;&#xA;&lt;li&gt;The individual fibers breaking out of a fiber installation cable will have very little protection against damage (far less than a patchcord does). If you buy a pre-terminated cable it should come with a preattatched gland that you can use to attatch the sheath and reinforcement of the cable to something solid and then a cover that covers the breakout section during installation. The proffesional way to deal with this is to fix the cable to a patch panel and then use patchcords to connect to the media converters. For a single link that is IMO overkill but you should take reasonable steps to ensure that the individual fibers don't get disturbed.&lt;/li&gt;&#xA;&lt;li&gt;Multimode fiber comes in different grades. I would suggest getting the higest grade (OM4) to minimise the risk of problems.&lt;/li&gt;&#xA;&lt;li&gt;Media converters are often fixed speed and will not work at lower speeds. So if one or both of the devices at the ends of the fiber links only supports 100 Mbps then you should buy 100 Mbps media converters.&lt;/li&gt;&#xA;&lt;li&gt;Remember to cross transmit and receive between the two media converters. The general convention with duplex patchcords and couplers is that they are always crossed (so you get an odd number of crosses between the end devices) but your installation cable will likey have single connectors on it so you will have to thing about the crossing yourself.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Part 2: sharing an internet connection&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a technical point of view you can build an ethernet network that spans multiple houses, connect it all to a normal home/small buisness NAT router and it will work. The protocols have no idea if the endpoints are ithe same house or not. However there are a number of things to be aware of.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You will all be on the same LAN. There are obvious security implications to this.&lt;/li&gt;&#xA;&lt;li&gt;Your cable provider's terms and conditions may prohibit such usage and they may disconnect you if found out&lt;/li&gt;&#xA;&lt;li&gt;You will be sharing a public IP address, if someone in your community abuses the connection it may be difficult to determine who did it and you may find yourself all banned from online services. If people need ports forwarded there may be arguments over who gets what port.&lt;/li&gt;&#xA;&lt;li&gt;There may be local laws that put some legal responsibility on you as an ISP which you may struggle to comply with.&lt;/li&gt;&#xA;&lt;li&gt;If someone runs a connection hogging program like bittorrent they may drag down the quality of internet service for everyone.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are ways around some of these, for example you can put NAT routers behind the main NAT router to provide some isolation between lans (though at the cost of having two layers of NAT which can break some services). You may be able to buy a buisness package from your ISP that allows the first level LAN to have public IPs so each house has thir own public IP, getting a buisness package from the ISP may or may not also eliminate unfavorable terms and conditions. You can get traffic shaping routers to try and reduce the impact of the torrent traffic.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Part3: responses to comment&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I was thinking of simply laying the cable on the ground - it's all forest - except burying it in PVC where it crosses the road.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Doesn't seem like a good idea to me, a cable running along the surface is at quite high damage risk.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If unable to terminate myself, that means when the cable gets damaged, we need a whole new cable. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Rejoining a broken cable outdoors is possible but it's not a DIY job.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have no idea what you mean by crossing transmit and receive; do you mean I need two cables, with one end connected to transmit port and other to receive (on the two media converters), and vice versa on the other cable ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Normal fiber equipment uses two fibers, one for each direction. You have to cross over transmit and receive ports between the two transcivers, the fiber world has no equivilent to the AUTO-MDIX you see in the twisted pair world. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With most common fiber connector types you have both single fiber connectors and duplex (paired) connectors. It is possible to insert two single connectors into a duplex connector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Couplers and patchcords are usually duplex and crossed. So if you connect two transcivers with duplex couplers and patch cords you end up with an odd number of crosses and everything works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Installation cables usually contain at least four fibers (it is considered good practice to put in at least a couple of spares, so there is little point in a 2 fiber cable). If you buy them pre-terminated it is most likely that each fiber will be terminated on a seperate single connector (it's easier for them to fit a protective cover over the connectors for pulling the cable that way, as an asside make sure any preterminated cable you buy has this). So you have to remember to cross them over yourself when connecting them up.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-01-12T01:49:03.563" LastActivityDate="2016-01-12T01:49:03.563" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25841" PostTypeId="1" AcceptedAnswerId="25842" CreationDate="2016-01-11T13:45:38.610" Score="5" ViewCount="2546" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/De22B.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/De22B.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a simple network using OSPF. Router2 has got LoopBack0 with IP address &lt;strong&gt;10.0.2.1 255.255.255.0&lt;/strong&gt;. I add this network to OSPF:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router(config-router)#net 10.0.2.0 0.0.0.255 area 0&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I dispaly routing table in Router2 - I see there &lt;strong&gt;10.0.2.0/24&lt;/strong&gt; directly connected. But in Router3 routing table I see &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;10.0.0.0/32 is subnetted, 1 subnets&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;O       10.0.2.1 [110/65] via 10.0.0.2, 00:00:12, Serial0/0/0&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why there is prefix /32  ? &lt;/p&gt;&#xA;" OwnerUserId="21907" LastEditorUserId="498" LastEditDate="2016-01-11T19:26:29.890" LastActivityDate="2023-04-18T13:19:43.350" Title="Routing loopback using OSPF" Tags="|cisco|routing|ospf|loopback|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25842" PostTypeId="2" ParentId="25841" CreationDate="2016-01-11T14:04:27.150" Score="7" Body="&lt;p&gt;Loopback interfaces are considered as host routes, so they are always advertised with a /32 mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to advertise the whole subnet, you have to change the network type to &lt;strong&gt;point to point&lt;/strong&gt; like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface loopback 0&#xA; ip ospf network point-to-point&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then OSPF will advertise the subnet with the configured mask.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-11T14:04:27.150" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25843" PostTypeId="1" AcceptedAnswerId="25845" CreationDate="2016-01-11T14:09:58.040" Score="3" ViewCount="302" Body="&lt;p&gt;Lets say I want to set up a small packet-switching LAN using TCP/IP model with 10 hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I &lt;strong&gt;do not intend to connect my network to the Internet&lt;/strong&gt;, which implies that this is a private network and I want to assign static IPs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What would be the considerations to choose IP addresses for my hosts? &lt;/li&gt;&#xA;&lt;li&gt;What about subnet mask?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Does this fact that I am not going to connect to the internet give me the ability to choose whatever I want (in the range of 8 bits ofcourse) for the network addresses? &lt;/p&gt;&#xA;" OwnerUserId="21926" LastEditorUserId="21926" LastEditDate="2016-01-11T14:22:16.740" LastActivityDate="2016-01-11T16:38:29.490" Title="Assigning IPs for a LAN which is disconnected from the Internet (private network)" Tags="|ip|lan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25844" PostTypeId="2" ParentId="25833" CreationDate="2016-01-11T14:11:55.933" Score="2" Body="&lt;p&gt;The non-NAT router is missing a route for the address 130.130.130.130.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try injecting the required route as static route and then redistribute it into OSPF of NAT router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA; redistribute static subnets&#xA;&#xA;ip route 130.130.130.130 255.255.255.255 null0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-11T14:11:55.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25845" PostTypeId="2" ParentId="25843" CreationDate="2016-01-11T14:40:47.787" Score="4" Body="&lt;p&gt;Best practice is to use IPs from private IP address range according to the fact that you will not connect your network to the Internet:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10.0.0.0 - 10.255.255.255&lt;/li&gt;&#xA;&lt;li&gt;172.16.0.0 - 172.31.255.255&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0 - 192.168.255.255&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the subnet mask it depends on how big is the network. If you need 10 hosts, then mask would be: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(255.255.255.240) =&gt; mask for 14 hosts + network address + broadcast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fXm4x.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fXm4x.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that addresses must be from the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example you can use &lt;strong&gt;192.168.0.1 - 192.168.0.10&lt;/strong&gt; with mask &lt;strong&gt;255.255.255.240&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not a good idea to use &lt;em&gt;public IP addresses&lt;/em&gt; in your private LAN, however, it is absolutely possible to do so.&lt;/p&gt;&#xA;" OwnerUserId="21907" LastEditorUserId="8499" LastEditDate="2016-01-11T16:38:29.490" LastActivityDate="2016-01-11T16:38:29.490" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="25847" PostTypeId="2" ParentId="25831" CreationDate="2016-01-11T15:37:41.793" Score="1" Body="&lt;p&gt;If the houses are 500' apart, Wi-Fi is not the answer since, like copper UTP cabling, it is limited to 100 meters (328').&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With multi-mode fiber, you need to be aware of the distance limitation for the particular fiber interfaces you are using. Also, terminating multi-mode fiber can take experience and the proper equipment to polish the fiber ends, and a microscope to inspect them. Outdoor fiber needs to be armored, gel-filled, loose-tube fiber that is buried at least 24&quot;, or deeper if the frost-line goes deeper where you are. Stringing it overhead involves a whole other set of conditions such as load bearing cable and lightning protection. Outdoor cable cannot extend more than 50' indoors, and it should not be directly connected to your equipment (you must terminate it to your indoor cabling system, properly grounded and bonded with lightning protection even for buried fiber, which then terminates into your equipment). Outside plant cabling is an entire specialty unto itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ricky Beam pointed out, the equipment required will be well over $500, and you probably are in way over your head. Home networking (off-topic here) is nothing compared to what you are trying to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also need to check beforehand about the legalities: sharing of a single Internet account, the local and state laws regarding easements, and the National Electric Code. I got into trouble as a kid when some neighbors and I rigged our own communications wire between houses, and the local telco had a fit. You may need to hire someone who knows how to do this sort of thing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-11T15:37:41.793" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="25848" PostTypeId="2" ParentId="18487" CreationDate="2016-01-11T15:59:30.553" Score="0" Body="&lt;p&gt;Do you have the option to collect NetFlow from this device?  NetFlow timestamping is accurate so you will be able to pickup the spikes with ease using any number of flow collectors/analyzers.&lt;/p&gt;&#xA;" OwnerUserId="21950" LastActivityDate="2016-01-11T15:59:30.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25850" PostTypeId="2" ParentId="25152" CreationDate="2016-01-11T17:49:50.210" Score="1" Body="&lt;p&gt;A properly functioning switch should not make the network slow. The key is in the words &quot;properly functioning&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When dealing with cheap consumer network hardware the first thing to try is power cycling everything. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second thing to check is that on any equipment that supports configuring speed and duplex mode (unmanaged switches and home routers will probablly be in autonegotiate mode whether you like it or not) that the ports are set up correctly. Connecting a port set to forced full duplex to a port set to autonegotiate or forced half duplex will result in excruciatinly slow communications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third thing to check is the cabling. Make sure you don't have split pairs. If possible bring the equipment together into one room and hook it up with short patch cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if all of that fails it's probablly time to consider swapping out equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I've found windows file sharing often suffers from weird speed problems when nothing else does. I have no idea why.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-01-11T17:49:50.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25851" PostTypeId="2" ParentId="13085" CreationDate="2016-01-11T17:57:15.720" Score="2" Body="&lt;p&gt;At an ethernet level if you use one unmanaged switch you will only have one network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the IP level things get more complicated. Assuming that the two &quot;networks&quot; have non-overlapping subnets and there is no special routing configured then unicast traffic will not pass directly between the networks as the clients will see it is &quot;out of network&quot; and send it to the default gateway. The default gateway can then chose whether to pass it onwards to the other subnet  or not (there is also an ICMP packet type that allows the gateway to tell clients to send future packets directly)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what will happen to packets sent to the subnet broadcast address, I expect machines in the other subnet will discard them but i'm not positive on that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets sent to 255.255.255.255 will be received by all systems connected to the ethernet network. Unicast replies to them on the other hand will probablly only get through if there is a router available to do so (see above). This may confuse some systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A malicious device on one subnet could easilly detect that the other subnet exists and establish an address on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not uncommon to run multiple subnets on the same ethernet network due to address space constraints but you should not consider them isolated from a security perspective and you should be careful about anything that relies on broadcasts.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-01-11T18:10:44.630" LastActivityDate="2016-01-11T18:10:44.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25852" PostTypeId="1" CreationDate="2016-01-11T18:02:40.350" Score="2" ViewCount="236" Body="&lt;p&gt;I'm currently trying to reach my LAMP server from the outside.&#xA;My LAN server has the IP of 10.255.255.2 and lets say my WAN IP is 84.238.29.84&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shouldn't it just be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;objekt network HTTP-PAT&#xA; host 10.255.255.2&#xA; nat (inside,outside) static interface service tcp 80 80&#xA;&#xA;access-list outin extended permit tcp any object HTTP-PAT eq 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried above, and it does not work.&#xA;All I want to (to begin with) is to reach my webserver (10.255.255.2) from outside.&lt;/p&gt;&#xA;" OwnerUserId="21953" LastEditorUserId="619" LastEditDate="2016-01-11T21:21:56.547" LastActivityDate="2016-01-12T00:26:40.953" Title="ASA 5505 | 1 public IP - 2 services www, SFTP (PAT)" Tags="|cisco-asa|cli|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25853" PostTypeId="1" AcceptedAnswerId="25854" CreationDate="2016-01-11T18:09:49.063" Score="3" ViewCount="150" Body="&lt;p&gt;I've been studying subnetting and of course there's plenty I'm confused about.  One issue is as follows: my company uses AWS.  For our VPC let's say we have a private network address of 10.2.0.0 /16 CIDR.  My question is this: I have a feeling that they can offer this private address to other companies as well.  How is this possible?  I realize I'm confused about something deeper, but then again, that's precisely why I'm asking this question.  Thanks!&lt;/p&gt;&#xA;" OwnerUserId="21951" LastEditorUserId="775" LastEditDate="2021-05-04T23:40:29.437" LastActivityDate="2021-05-05T16:51:11.123" Title="How is it possible for AWS to offer the same private network address to different customers?" Tags="|nat|subnet|aws|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25854" PostTypeId="2" ParentId="25853" CreationDate="2016-01-11T18:15:24.783" Score="2" Body="&lt;p&gt;It's exactly the same way that any company can use, and reuse, the same private addresses. The private addresses don't get routed where they can conflict with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I my company uses private addresses internally, and your company uses the same private addresses internally, there is no conflict since our two companies can only communicate through a different network, and the same private addresses in each company get translated to different addresses before reaching the other company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A single company can do the same thing internally. NAT is not just to connect to the Internet, it can be used inside a company, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-11T18:25:05.617" LastActivityDate="2016-01-11T18:25:05.617" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25855" PostTypeId="2" ParentId="25853" CreationDate="2016-01-11T18:23:52.473" Score="2" Body="&lt;p&gt;&lt;s&gt;I don't know exactly how amazon does it but I can easilly see a few ways to engineer this.&lt;/s&gt;&lt;/p&gt;&#xA;&lt;p&gt;The key thing to remember is that IP addresses only matter to IP routers and endpoints. An ethernet switch with VLANSs doesn't care if VLAN1 and VLAN2 have overlapping IP ranges, all it cares about is which vlan the packet is on and which MAC address it is flowing between. So if each companies virtual private cloud had it's own VLANs and it's own routers connecting those VLANs then it would not be not a problem for those virtual clouds to have overlapping IP space.&#xA;Routers&lt;/p&gt;&#xA;&lt;p&gt;Routers can be partitioned into smaller virtual routers using &amp;quot;vrfs&amp;quot; Linux can do the same thing through the use of &amp;quot;network namespaces&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Or of course you could just use software routers (either the built in routing facilities in major operating systems or something from a router vendor) and run them inside VMs.&lt;/p&gt;&#xA;&lt;p&gt;Unfortunately as pointed out in another answer these solution's don't scale well to an operation the size of AWS. There are only about 4000 usable VLAN IDs and most routers were designed to support a handful of virtual network, not tens to hundreds of thousands. Ethernet's tree-based design is also a major scaling problem.&lt;/p&gt;&#xA;&lt;p&gt;That answer also linked to a video at &lt;a href=&quot;https://www.youtube.com/watch?v=Zd5hsL-JNY4&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=Zd5hsL-JNY4&lt;/a&gt; which explains how they actually do it. To summarize the answer is that the customer traffic is carried in an encapsulated form between VM hosts. Each packet from a client VM is wrapped in a VPC header, then wrapped in an outer IP packet before being sent across the underlay network.&lt;/p&gt;&#xA;&lt;p&gt;For hosts on the same subnet, the VM host for the source VM intercepts the arp requests from the customer VM and looks up the destination details in a mapping service based on the combination of IP address and customer. The VM host can then use the response from the mapping service to both synthesize an ARP request for the VM and to send encapsulated data packets to the VM host for the destination VM.&lt;/p&gt;&#xA;&lt;p&gt;For hosts on different subnets the VM host intercepts the arp request for the default gateway in the mapping service, determines it is a virtual gateway and crafts an apprpriate arp response. When the actual data packets are sent the VM host looks up the destination IP in the mapping service to determine where to send the encapsulated packet.&lt;/p&gt;&#xA;&lt;p&gt;For performance reasons the mapping service runs a local instance on each VM host, which caches all the information about the networks of the customer's that have VMs on that host.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2021-05-05T16:51:11.123" LastActivityDate="2021-05-05T16:51:11.123" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="25857" PostTypeId="1" AcceptedAnswerId="25858" CreationDate="2016-01-11T19:16:19.637" Score="2" ViewCount="4356" Body="&lt;p&gt;I'm testing a 802.11 wireless link using iPerf and the UDP protocol. Using the -b command at the client, I can set the bandwidth to an arbitrary number (e.g. 1 Gbps) that's much higher than the link can support (e.g., 50 Mbps). The iPerf test will then report a 95% packet loss rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is where are these UDP packets being lost? I'm assuming the client's WiFi device will only accept data for transmission at a rate that's commensurate with the quality of the wireless connection. So is the device dropping the packets generated by iPerf?&lt;/p&gt;&#xA;" OwnerUserId="21956" LastActivityDate="2016-07-15T18:13:01.553" Title="Where are UDP packets lost during iPerf test?" Tags="|udp|throughput|iperf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25858" PostTypeId="2" ParentId="25857" CreationDate="2016-01-11T19:34:07.797" Score="3" Body="&lt;p&gt;When more traffic than a link can handle is sent to a link, the interface to that link will end up dropping the packets destined for that link. This is congestion, and there are some small mitigations for congestion, such as queuing, but, when it comes to networks, packets are preferred to be dropped as soon as possible rather than delaying them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, the dropped traffic never makes it out of the interface on the device which is generating the traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-11T19:34:07.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25859" PostTypeId="2" ParentId="25812" CreationDate="2016-01-11T19:35:08.887" Score="2" Body="&lt;p&gt;NetFlow collectors work by receiving and collating NetFlow updates, and in general will keep a local connection table to mirror the connection table on the router side. Counters for bytes (or octets) and packets are sent by routers configured to keep tabs on data flows and summarize the volumes in periodic updates; this is distinct from a packet capture containing the details of each packet, and is much more compact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tables on each side use an explicit tuple of sending IP, receiving IP, protocol, and (for appropriate protocols) sending port and receiving port. This identifies the communication sufficiently that when the byte counters and packet counters are received as part of a datagram, they can be matched to the correct conversation with reasonable accuracy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also an implicit factor of time: these tables are of finite size, and the oldest entries (the ones that have been updated least recently) will get pushed out periodically in order to make room for records of conversations that are still on-going. If another packet comes in later matching the same hosts/protocol/ports, it gets noted as a new conversation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're probably using Cisco equipment, given the use of Packet Tracer, and so you should have a look at how &lt;a href=&quot;http://www.flowtraq.com/corporate/blog/tech-thoughts/configuring-flexible-netflow-export-cisco-routers/&quot; rel=&quot;nofollow&quot;&gt;Flexible NetFlow is configured&lt;/a&gt; on those platforms. Note that some of those fields are marked &quot;match&quot; and some &quot;collect&quot;. The &quot;match&quot; fields are must-have, and you'll see that they match the identifying tuple I mentioned. The others are &quot;collect&quot; and you'll see from that example that there are a lot of other fields that can be sent alongside byte and packet counts for analysis -- which means that there are a lot of potential combinations that can be sent. In the Flexible NetFlow format, which uses &lt;a href=&quot;https://www.ietf.org/rfc/rfc3954.txt&quot; rel=&quot;nofollow&quot;&gt;NetFlow v9&lt;/a&gt;, template datagrams are sent periodically to tell your NetFlow collector how to read the actual data being sent in the other datagrams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The important thing to realize when looking at that configuration is that there's no guaranteed &quot;I'll get an update every X seconds&quot; aspect -- update rates vary according to how busy the router is, and if UDP datagrams are dropped or delayed. As a result, byte and packet counter analysis is going to be at the mercy of when the data actually comes in if you're trying to do live analysis; you'll find that it's much more reliable in retrospect (even a few minutes afterward) when all of your data sources have reported in and filled in their byte/packet counts after-the-fact, and you're looking at totals for the whole conversation.&lt;/p&gt;&#xA;" OwnerUserId="82" LastActivityDate="2016-01-11T19:35:08.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25860" PostTypeId="1" AcceptedAnswerId="25862" CreationDate="2016-01-11T19:40:50.930" Score="3" ViewCount="309" Body="&lt;p&gt;My question is simple: How do packet analyzer softwares, like Wireshark, sniff and analyze the network traffic? Is it just by &lt;strong&gt;copying&lt;/strong&gt; each frame on the link and decode the payload and other fields to the user?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this question might be redundant but I really want to understand the technical method behind that since most blogs and webpages explain the general overview without considering the scientific methods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="21959" LastActivityDate="2016-01-12T21:50:24.767" Title="How packet analyzer softwares REALLY work" Tags="|cisco|ethernet|packet-analysis|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25861" PostTypeId="2" ParentId="25853" CreationDate="2016-01-11T19:44:05.987" Score="2" Body="&lt;p&gt;The real way this is done in Amazon is different from how you might imagine, as common solutions don't scale.  They did a talk in 2013 about this at re:Invent, which you can watch on YouTube:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=Zd5hsL-JNY4&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=Zd5hsL-JNY4&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the more general answer is &quot;IP addressing is a matter of perspective.&quot;  More specifically, if your hosts never want to talk to the hosts of someone else who was allocated the same IP space, no one cares that you have the same IP addresses.  If you do, and you want to talk to each other, then through the use of &lt;em&gt;some&lt;/em&gt; mechanism like NAT, you will change the IP addresses of the the hosts in network A from the &lt;em&gt;perspective&lt;/em&gt; of network B.&lt;/p&gt;&#xA;" OwnerUserId="653" LastActivityDate="2016-01-11T19:44:05.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25862" PostTypeId="2" ParentId="25860" CreationDate="2016-01-11T19:53:48.777" Score="4" Body="&lt;p&gt;Sniffing is different from analyzing - in general software like Wireshark relies on a &lt;em&gt;different&lt;/em&gt; piece of software (or hardware) to deliver the actual packets to it, commonly in a format called &quot;&lt;a href=&quot;https://wiki.wireshark.org/Development/LibpcapFileFormat&quot; rel=&quot;nofollow&quot;&gt;PCAP&lt;/a&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Parsing is pretty simple - most protocols are documented - although it's extremely time consuming to develop parsers for every protocol you might see (particularly at L4 and above).  Once a packet is parsed, analyses are done based on that data, which is well formed and not unlike analysis performed on any other kind of structured data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to how those files get created, sometimes it is as simple as asking an OS to copy all the packets the host receives to a file in PCAP format, while other times it is an extremely complex operation performed in hardware to peek into and copy a light or electron stream on a physical wire.  A common case is to use a span/mirror on a network device to copy all packets out to a port specifically for the purpose of online/offline analysis.&lt;/p&gt;&#xA;" OwnerUserId="653" LastActivityDate="2016-01-11T19:53:48.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25865" PostTypeId="1" CreationDate="2016-01-11T22:24:17.130" Score="2" ViewCount="587" Body="&lt;p&gt;My problem is that Wireshark and Scapy sniffs only ARP packets (sometimes LMNRR or DHCP - 5 packets of those in like 20 minutes..).&#xA;Basically Wireshark and Scapy sniffs 1 packet in like 1-3 minutes, and most of times it is an ARP packet. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/qHQSE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qHQSE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the Capture Options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RomY4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RomY4.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need more picture write it down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What Do I need to do to fix that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please Help me.&#xA;thanks!&lt;/p&gt;&#xA;" OwnerUserId="21962" LastActivityDate="2016-01-12T20:31:26.160" Title="Wireshark and Scapy sniffs only ARP packets most of the times (and it's one packet in 3 minutes)" Tags="|arp|wireshark|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25866" PostTypeId="2" ParentId="25627" CreationDate="2016-01-11T22:38:26.227" Score="3" Body="&lt;p&gt;Finally solved the problem!!&#xA;So I was facing problem due to loss of information in the dhcp binding table. In short the subscriber id automatically generated would not match my reservations. Here are some examples:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;port#  interface  received SID(hex)      expected SID(hex) &#xA;2      Gi1/0/2    0047-6931-2f30-2f      0047-6931-2f30-2f32 &#xA;13     Gi1/0/13   0047-6931-2f30-2f31    0047-6931-2f30-2f31-33 &#xA;24     Gi1/0/24   0047-6931-2f30-2f32    0047-6931-2f30-2f32-34 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was hitting IOS bug present in some 15.0 releases. I updated my ios to 15.2 and problem solved! Thank you for all your help. &lt;/p&gt;&#xA;" OwnerUserId="21754" LastActivityDate="2016-01-11T22:38:26.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25867" PostTypeId="1" AcceptedAnswerId="25869" CreationDate="2016-01-11T22:47:49.330" Score="2" ViewCount="3998" Body="&lt;p&gt;Two routers are connected via ethernet, to find the propagation delay between them, we calculate &lt;code&gt;Distance/Propagation_Speed&lt;/code&gt;. How do I find the propagation speed between the two routers?&lt;/p&gt;&#xA;" OwnerUserId="21963" LastActivityDate="2016-01-12T01:22:12.440" Title="How to calculate propagation speed?" Tags="|cisco|router|ethernet|bandwidth|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25868" PostTypeId="2" ParentId="25852" CreationDate="2016-01-12T00:25:29.713" Score="2" Body="&lt;p&gt;I've put an example below but with one public IP address you're never going to want to use the NAT Object rules as that assigns the public IP to the host it's going to rather than just the port with the host. Also SFTP transfers over 22 which if you ever want to be able to SSH to the device from the outside and still be able to access the SFTP server you're going to want to use a different port on the outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try using normal static NATs like so instead:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so the an actual rule would look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network HTTP_Pub&#xA;host 84.238.29.84&#xA;object HTTP_Priv&#xA;host 10.255.255.2&#xA;object service HTTP&#xA;service tcp destination eq 80&#xA;object service SFTP-ALT&#xA;service tcp destination eq 30022&#xA;object service SFTP-Int&#xA;service tcp destination eq 22&#xA;nat (outside,inside) source static any any destination HTTP_Pub HTTP_Priv HTTP HTTP&#xA;nat (outside,inside) source static any any destination HTTP_Pub HTTP_Priv HTTP HTTP&#xA;access-list outin extended permit tcp any object HTTP_Priv eq HTTP&#xA;access-list outin extended permit tcp any object HTTP_Priv eq SFTP-Int&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19171" LastEditorUserId="8499" LastEditDate="2016-01-12T00:26:40.953" LastActivityDate="2016-01-12T00:26:40.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25869" PostTypeId="2" ParentId="25867" CreationDate="2016-01-12T00:51:07.850" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Two routers are connected via ethernet, to find the propagation delay between them, we calculate Distance/Propagation_Speed. How do I find the propagation speed between the two routers?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;According to Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Propagation_delay&quot; rel=&quot;nofollow&quot;&gt;Propagation delay (Wikipedia)&lt;/a&gt; is equal to d / s where d is the distance and s is the wave propagation speed. In wireless communication, s=c, i.e. the speed of light. In copper wire, the speed s generally ranges from .59c to .77c.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You need to find both Distance and Speed for the electromagnetic waves for the specific transmission medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, for &lt;a href=&quot;https://en.m.wikipedia.org/wiki/Optical_fiber_cable&quot; rel=&quot;nofollow&quot;&gt;fiber&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Optical cables transfer data at the speed of light in glass. This is the speed of light in vacuum divided by the refractive index of the glass used, typically around 180,000 to 200,000 km/s, resulting in 5.0 to 5.5 microseconds of latency per km. Thus the round-trip delay time for 1000 km is around 11 milliseconds.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-01-12T01:22:12.440" LastActivityDate="2016-01-12T01:22:12.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25870" PostTypeId="2" ParentId="25835" CreationDate="2016-01-12T01:08:18.417" Score="1" Body="&lt;p&gt;The active/active cluster allows you to split traffic into groups so the A node handles traffic for some networks while the B node handles traffic for the others, in the event of a failover the stable unit will handle traffic for both A&amp;amp;B traffic groups (assigned on a per context basis). Active/Standby cluster handle all traffic on a single node while the other is brought into use only in the event of a failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is generally used when you're going to have more traffic than a single node can handle, if one of the units fails, instead of stopping all traffic destined to the failed ASA it will run in a degraded state until it is replaced. So essentially you're stretching you're hardware and actually utilizing it taking the risk of degradation if there's a failure instead of paying for a standby unit that essentially never sees any traffic pass through. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Forgot to clarify active/active is only available for multi-context mode since it would serve no purpose otherwise since you couldn't create the groups&lt;/p&gt;&#xA;" OwnerUserId="19171" LastEditorUserId="19171" LastEditDate="2016-01-12T02:20:08.217" LastActivityDate="2016-01-12T02:20:08.217" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25871" PostTypeId="2" ParentId="25831" CreationDate="2016-01-12T02:18:13.590" Score="1" Body="&lt;p&gt;The regulatory aspect (getting an internet provider connection at the &quot;road house&quot; rather than misusing a &quot;end-use subscriber&quot; connection until you are found out, disconnected, and possibly sued for breach of contract) is a potentially large hurdle. Don't discount that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiber-wise you'll probably be money ahead with single-mode fiber (the fiber is so much cheaper than multimode fiber that slightly more expensive connectors and SFPs are paid for by the savings on fiber cost whenever the run gets moderately long.) Might as well get reduced bend radius single-mode while you are at it - it adds little to the cost of a cable and reduces the fussiness of handling quite a bit. Slap a MicroTik RB260GSP on each end with an appropriate SFP (it's a small switch with an SFP slot for less $ than many &quot;media converters&quot; - I use 3 at present and recommend them, but I'm not in any way affiliated and an open to the concept that there might be a cheaper option I haven't found yet.) For SFPs, obsolete 4GB fiberchannel 1310 S-M SFPs do a wonderful job with gigabit ethernet and will cost you under $5 each on ebay if you shop well. 2-fiber drop without a lot of shopping (you could do better) $250, $112 for switches, $10 for SFPs, and a little budget left for terminating. Or you could spend a little more on chinese (or surplus non-chinese, if you can find them) BiDi SFPs and save more by going to 1-strand drop fiber (then again, sometimes a smart/lucky shopper can find 12-fiber drop for less than 1 fiber drop - depends what's on the market at a given moment.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireless links don't go through trees well at all, but if the land is owned by friendly (or open to negotiation/cash settlement) parties punching a hole (right of way) through the trees for a high-speed point to point wireless link (not MESH, Gawd, Not Mesh) is likely to be a lot cheaper than the mechanics of getting fiber run (the fiber itself is cheap - the hole for it is expensive.) If the land is hostile, look at &quot;very tall flagpoles&quot; (AKA towers) to get above the trees. If the cost of these things make the cable company look less rapacious, cogitate on that fact. You may also find that some other location is better to put a tower to serve your houses - long distances are not so much a problem, trees and dirt are (so if you can get signal to a mountain you can see, it might be a lot cheaper than trying to get signal through or over trees &quot;closer.&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running fiber on the ground will almost certainly introduce you to a host of ills (things that gnaw, things that stomp with hooves, people who steal it, or at least cut it with the intent of stealing it, for the copper that isn't actually in it) and not having a splicer will begin to look pound-foolish. If nothing else, look into the actual owner of the utility poles (if there are utility poles) and pole rental costs - running &quot;drop fiber&quot; or some other form of ADSS cable (but drop fiber is usually the most cost-effective form) on legitimately rented poles might be the best option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should search around and see if there are WISPs in the area already. You should also investigate what you have in local companies that will send someone out to terminate fiber, since pulling a 1000 foot fiber with connectors on and not damaging the connectors is a lot harder than pulling 1000 feet of bare cable and having it terminated after it's in place.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2016-01-12T02:29:57.317" LastActivityDate="2016-01-12T02:29:57.317" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25873" PostTypeId="2" ParentId="20265" CreationDate="2016-01-12T05:57:01.070" Score="9" Body="&lt;p&gt;It turns out this ended up as a top result on Google for the stated error message. I uninstalled WinPCap (may not be necessary) and then installed Nmap version 7.01, which solved the issue for me without using the cygwin solution mentioned in the comments of the original question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: I believe (for me) this may actually be a conflict with the winpcap version that Nessus uses. Both boxes that I've had this issue with have had both installed. So in addition to the above fix, make sure that the nessus service is shut down (if installed). I would also recommend (as others have stated) to grab the legit version of winpcap and NOT install it during the nmap install (just uncheck it in the installer). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;tl;dr&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ensure the Nessus service isn't running (if installed)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Uninstall WinPCap&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Install WinPCap from winpcap.org&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Install Nmap 7.01 (uncheck winpcap in the installer)&lt;/p&gt;&#xA;" OwnerUserId="3938" LastEditorUserId="3938" LastEditDate="2017-02-09T00:06:52.023" LastActivityDate="2017-02-09T00:06:52.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25875" PostTypeId="1" AcceptedAnswerId="25881" CreationDate="2016-01-12T07:48:53.543" Score="3" ViewCount="3152" Body="&lt;p&gt;Would I have any issues if I use a private network range in between an edge network with public ip's?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ie: (internet)&amp;lt;---&gt;12.12.12.1/30(public ip)&amp;lt;---&gt;192.168.1.1/30&amp;lt;---&gt;22.22.22.0/28(customer edge with public ips)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect no based on my understanding, but I want to crazy check myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="21964" LastActivityDate="2016-01-12T14:36:46.903" Title="Public IP's behind private network?" Tags="|routing|internet|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25876" PostTypeId="2" ParentId="25875" CreationDate="2016-01-12T08:46:15.333" Score="4" Body="&lt;p&gt;You can use private IP between two public IP network as long as you do not send to the internet packets with a private address as source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's quite common.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-01-12T08:46:15.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25878" PostTypeId="1" CreationDate="2016-01-12T11:25:18.130" Score="0" ViewCount="74" Body="&lt;p&gt;In what way/s do they differ and their characteristics that distinct them from each other?&lt;/p&gt;&#xA;" OwnerUserId="21054" LastActivityDate="2016-01-13T18:59:07.980" Title="What's the difference between Quagga's OSPFv2 implementation and Cisco Packet Tracer OSPFv2 implementation?" Tags="|cisco|quagga|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25879" PostTypeId="1" AcceptedAnswerId="28365" CreationDate="2016-01-12T12:18:18.563" Score="6" ViewCount="4392" Body="&lt;p&gt;I have a Debian Linux server with 4x 1Gb NICs, 2 onboard and 2 PCI. All NICs are configured into a single mode 4 LACP bonded interface: &lt;code&gt;bond0&lt;/code&gt;&#xA;I have two switches: Cisco SG300-28 and Cisco SG300-10, to be referred to as A and B respectively.&lt;br&gt;&#xA;The two switches are connected to each other by an LACP LAG on 2 switch ports, both links listed as active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All ports on both switches appear to be configured as trunk ports. This appears to be the default as I did a factory reset before testing this. Would that make any difference? There is only a single default VLAN at this stage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server has 2 NICs into switch A and 2 NICs into switch B (one onboard NIC and one PCI). The Linux bonding driver is clever in this respect as it works out an &lt;code&gt;Aggregator ID&lt;/code&gt; for each interface and pairs them up by switch, so only the links into one switch are ever active even though all 4 might be up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a workstation that I am testing this from, currently connected to switch A.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;                   ----------------&#xA;        ===========| Server bond0 |===========&#xA;        ||         ----------------         ||&#xA;        ||                                  ||&#xA;        ||                                  ||&#xA;  ----------------                  ----------------&#xA;  |   Switch A   |=======LAG========|   Switch B   |&#xA;  ----------------                  ----------------&#xA;         |&#xA;         |&#xA;         |&#xA;    workstation&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Initially the server reports it's using the Aggregator ID associated with Switch A. I get a solid ping from the workstation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I disconnect the 2 cables from Server to Switch A, Linux switches active Aggregator to the NICs connected to switch B, the ping continues on and remains stable. The active path at this point is &lt;code&gt;workstation -&amp;gt; Switch A -&amp;gt; inter-switch LAG -&amp;gt; Switch B -&amp;gt; Server&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I reconnect the cables from the server into Switch A, Linux keeps the aggregate ID as it is so still using Switch B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pings from workstation start being dropped as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FIrWL.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FIrWL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As soon as I disconnect Switch A again, ping returns to being solid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it fails when ping is originating from a port on Switch A going to the server Switch B but only when the server's links to Switch A are up but not active in the OS.&lt;br&gt;&#xA;This is repeatable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have run a &lt;code&gt;tcpdump&lt;/code&gt; on the Server and workstation. I can see ALL pings being transmitted from the workstation but only some of them getting a reply, per the trace above. Running a &lt;code&gt;tcpdump&lt;/code&gt; on the Server and it looks like the missing pings aren't making it that far. So they are being dropped somewhere in the switching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I reverse this broken setup to the other switch, plugging workstation into Switch B, so traffic path is... &lt;code&gt;workstation -&amp;gt; Swtich B -&amp;gt; inter-switch LAG -&amp;gt; Switch A -&amp;gt; Server&lt;/code&gt; then it works fine.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did think this might be some sort of STP issue with the port getting blocked, but the ping drop pattern is too frequent with almost every other pair of pings being dropped. Checking the log on the switch and it didn't look like any ports were being blocked on either switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also tried replacing the inter-switch LAG with a single connection, non-LAG/LACP.&lt;br&gt;&#xA;I have confirmed that the LACP settings match on all sides.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a full-time sysadmin and only a networking part-timer/amateur, to me this points to some sort of difference in configuration between the switches. But I don't know what parts of config to check for differences. They are running different firmware versions and note that these are the small business SG300 series, so not running full iOS but do have what looks like a reasonably featured CLI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My limited networking knowledge tells me it's something like an ARP issue. The server should only be presenting the MAC address to the active pair/switch. The dropped pings are possibly trying to be routed to the non-active switch/pair.&lt;br&gt;&#xA;But how could I prove that with these switches?&lt;br&gt;&#xA;I would have expected longer runs of successful and failed pings though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My next step is to do some tcpdumps to look at the ARPs and LACPDUs to see if there's a sort of &quot;storm&quot; going on causing the traffic to switch between switches every couple of seconds. Though from the Linux perspective, there's no change in active &lt;code&gt;Aggregator ID&lt;/code&gt; corresponding with the failed pings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone else have any suggestions of what else to look at here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Adding RSTP status for the port-channels...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;SwitchA#sh spanning-tree&#xA;Spanning tree enabled mode RSTP&#xA;Default port cost method:  long&#xA;&#xA;  Root ID    Priority    32768&#xA;             Address     0c:f5:a4:c2:0e:bf&#xA;             This switch is the root&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Number of topology changes 12 last change occurred 20:18:37 ago&#xA;  Times:  hold 1, topology change 35, notification 2&#xA;          hello 2, max age 20, forward delay 15&#xA;&#xA;Interfaces&#xA;  Name     State   Prio.Nbr    Cost    Sts   Role PortFast       Type        &#xA;--------- -------- --------- -------- ------ ---- -------- -----------------&#xA;...&#xA;   Po1    enabled  128.1000   20000    Frw   Desg   Yes       P2P (RSTP)     &#xA;   Po2    enabled  128.1001   20000    Dsbl  Dsbl    No            -         &#xA;   Po3    enabled  128.1002   20000    Dsbl  Dsbl    No            -         &#xA;   Po4    enabled  128.1003   20000    Dsbl  Dsbl    No            -         &#xA;   Po5    enabled  128.1004   20000    Dsbl  Dsbl    No            -         &#xA;   Po6    enabled  128.1005   20000    Dsbl  Dsbl    No            -         &#xA;   Po7    enabled  128.1006   20000    Dsbl  Dsbl    No            -         &#xA;   Po8    enabled  128.1007   20000    Frw   Desg    No       P2P (RSTP)     &#xA;&#xA;&#xA;SwitchB#sh spanning-tree&#xA;Spanning tree enabled mode RSTP&#xA;Default port cost method:  long&#xA;Loopback guard:   Disabled&#xA;&#xA;  Root ID    Priority    32768&#xA;             Address     0c:f5:a4:c2:0e:bf&#xA;             Cost        20000&#xA;             Port        Po8&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;  Bridge ID  Priority    32768&#xA;             Address     1c:de:a7:75:1a:4b&#xA;             Hello Time  2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Number of topology changes 5 last change occurred 20:26:02 ago&#xA;  Times:  hold 1, topology change 35, notification 2&#xA;          hello 2, max age 20, forward delay 15&#xA;&#xA;Interfaces&#xA;  Name     State   Prio.Nbr    Cost    Sts   Role PortFast       Type        &#xA;--------- -------- --------- -------- ------ ---- -------- ----------------- &#xA;...&#xA;   Po1    enabled  128.1000   20000    Frw   Desg   Yes       P2P (RSTP)     &#xA;   Po2    enabled  128.1001   20000    Dsbl  Dsbl    No            -         &#xA;   Po3    enabled  128.1002   20000    Dsbl  Dsbl    No            -         &#xA;   Po4    enabled  128.1003   20000    Dsbl  Dsbl    No            -         &#xA;   Po5    enabled  128.1004   20000    Dsbl  Dsbl    No            -         &#xA;   Po6    enabled  128.1005   20000    Dsbl  Dsbl    No            -         &#xA;   Po7    enabled  128.1006   20000    Dsbl  Dsbl    No            -         &#xA;   Po8    enabled  128.1007   20000    Frw   Root    No       P2P (RSTP)     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Po8 is the inter-switch LAG and Po1 is the server LAG, in both cases.&lt;br&gt;&#xA;No topology changes recorded on either switch while I've got things in their broken state (pings dropping).&lt;/p&gt;&#xA;" OwnerUserId="15284" LastEditorUserId="15284" LastEditDate="2016-01-12T17:56:28.070" LastActivityDate="2016-03-02T17:09:16.390" Title="Server link bond across 2 switches with LACP, inter-switch LAG dropping alternate pings?" Tags="|arp|ieee-802.1ax|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25881" PostTypeId="2" ParentId="25875" CreationDate="2016-01-12T12:33:32.547" Score="4" Body="&lt;p&gt;It can be done and generally works ok. It's quite common to see it in cable TV networks. There are a couple of caveats though.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If the machines on the intermediate networks need access to the internet then NAT will be needed. The NAT implementation must be flexible enough to decide based on source IP whether or not to NAT (linux NAT certainly is, I don't know about other implementations).&lt;/li&gt;&#xA;&lt;li&gt;ICMP replies sent by the routers will be generated with private source addresses and may end up getting blocked. This may cause issues with things like traceroute and path MTU discovery. As long as you don't have any low-mtu segments this shouldn't be a massive issue though.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-01-12T12:33:32.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25882" PostTypeId="2" ParentId="25838" CreationDate="2016-01-12T13:11:05.887" Score="0" Body="&lt;p&gt;There could be several issues, first get rid of the static route on the VPN client, if the route is not there then the problem is elsewhere. Post routing table while connected to VPN (route PRINT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you're not using split tunneling for the client VPN and advertise a default route, right? It should be in the routing table when connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then check whether you have defined network 10.10.10.x/24 in phase 2 of the HQ-Branch VPN on both sides as for it to communicate directly (without NAT), it &lt;strong&gt;MUST&lt;/strong&gt; be there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) For policies check whether you have correct source and destination interfaces - source should be ssl.root (or equivalent) and destination branch IPSec VPN interface&lt;/p&gt;&#xA;" OwnerUserId="16464" LastActivityDate="2016-01-12T13:11:05.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25883" PostTypeId="2" ParentId="25238" CreationDate="2016-01-12T13:23:39.583" Score="1" Body="&lt;p&gt;If you can reach LAN from your client then routing is working correctly, so you're probably mistaken in that packets from LAN to client go to the Internet (if you're not using NAT in-between).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most probable cause is the you do not have reverse policy defined, that is - you have a policy from VPN to LAN but not from LAN to VPN, do you?&lt;/p&gt;&#xA;" OwnerUserId="16464" LastActivityDate="2016-01-12T13:23:39.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25884" PostTypeId="2" ParentId="25875" CreationDate="2016-01-12T14:36:46.903" Score="3" Body="&lt;p&gt;It'll work fine, and you're best off not eating up precious public IPv4 addresses for this kind of thing anyway (I assume since you are using a /30 that it is purely an interconnect network between two layer 3 network devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to think about it is that it's just a means for the two devices on either end of your 192.168.1.0/30 segment to have a common LAN segment to exchange traffic across (one being the next hop of the other's routes, and vice versa). So long as they can communicate together (and aren't actually hosting any resources themselves), it doesn't matter to the outside world what IPs they use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll just have to keep in mind that the relevant interfaces won't be directly monitorable from the internet, which can be a plus or a minus depending on what exactly you are trying to do.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-12T14:36:46.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25885" PostTypeId="2" ParentId="25879" CreationDate="2016-01-12T16:24:43.807" Score="1" Body="&lt;p&gt;If possible (not sure how configurable those switches are) change the channel load-balance.&#xA;Example:&#xA;&lt;strong&gt;channel load-balance src-dst-mac&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other options: {dst-ip | dst-mac | src-dst-ip | src-dst-mac | src-ip | src-mac}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks to me like the lag algorithm is alternating to the links that have come up/up on the switch but aren't active on your server.&lt;/p&gt;&#xA;" OwnerUserId="21964" LastActivityDate="2016-01-12T16:24:43.807" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="25886" PostTypeId="1" CreationDate="2016-01-12T16:43:53.633" Score="3" ViewCount="780" Body="&lt;p&gt;I am new to this whole section of hosting services. I looked up online on how to self host my website, and all the websites told me to set up the software (Apache server) and open port 80 to make my IP public, that's where this question came to me. Would it be safe to open port 80 and host a website that is available for the public? I would be using my home/personal computer, and that getting hacked would give me a tough time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all in advance for the help!&lt;/p&gt;&#xA;" OwnerUserId="21972" LastActivityDate="2016-01-12T19:45:02.940" Title="Is it 'safe' to open port 80 for web hosting?" Tags="|ip|port-security|" AnswerCount="2" CommentCount="2" ClosedDate="2016-01-12T20:41:56.630" ContentLicense="CC BY-SA 3.0" />
  <row Id="25887" PostTypeId="2" ParentId="25886" CreationDate="2016-01-12T16:52:57.320" Score="1" Body="&lt;p&gt;Opening any service to the internet carries a risk. How big that risk is depends on a number of factors including.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What privilages is the server running under? A server running as root (or your operating system's equivilent) is obviously a higher risk than one running as a dedicated low-privilage user but note that privilage escalation bugs do happen.&lt;/li&gt;&#xA;&lt;li&gt;What is the server doing? A webserver than only supports static content is much lower risk than one running a complex webapp.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-01-12T16:52:57.320" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25888" PostTypeId="1" CreationDate="2016-01-12T18:25:09.160" Score="1" ViewCount="304" Body="&lt;p&gt;Are there any services or applications traversing a router that will be impacted by the command, &quot;ip options drop&quot;? I know the router warns about RSVP when you input this command, but this 4510 is not running MPLS or MPLS Traffic Engineering.  The command is new to my environment.  The only issue I am seeing on the device is that a show ip traffic shows a bunch of encapsulation failed messages.&lt;/p&gt;&#xA;" OwnerUserId="21975" LastActivityDate="2016-01-12T18:25:09.160" Title="Effects of ip options drop command on Cisco 4507 Device" Tags="|cisco|ip|security|troubleshooting|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25889" PostTypeId="2" ParentId="5457" CreationDate="2016-01-12T18:48:24.280" Score="0" Body="&lt;p&gt;fetchconfig is another tool for this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://github.com/udhos/fetchconfig&quot; rel=&quot;nofollow&quot;&gt;fetchconfig&lt;/a&gt; is a Perl script for retrieving configuration of&#xA;  multiple devices. It has been tested under Linux and Windows,&#xA;  and currently supports a variety of devices, including Cisco&#xA;  IOS, Cisco Catalyst, Cisco ASA, Cisco PIX, FortiGate&#xA;  Firewalls, ProCurve, Alcatel Ethernet Routers (aka&#xA;  Riverstone), Dell PowerConnect Switches, Terayon 3200/3500&#xA;  CMTS, Datacom DmSwitch Switches, HP MSR Routers, Mikrotik&#xA;  Routers, Tellabs MSR Routers, Juniper EX Switch JunOS, Oracle&#xA;  Acme Packet, Audiocodes Mediant, Cisco IOS XR, NEC Univerge IX.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-12T18:48:24.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25890" PostTypeId="2" ParentId="25886" CreationDate="2016-01-12T19:45:02.940" Score="0" Body="&lt;p&gt;You should run the Webserver in an isolated vitual machine withput an access to the rest of your network. You can do this with VLAN for example.&lt;/p&gt;&#xA;" OwnerUserId="21976" LastActivityDate="2016-01-12T19:45:02.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25891" PostTypeId="1" AcceptedAnswerId="25892" CreationDate="2016-01-12T19:50:58.257" Score="3" ViewCount="119" Body="&lt;p&gt;If I have 2 possible outbound paths, 1 primary, 1 secondary, and I obviously need the secondary to come up if the primary fails. The problem I am foreseeing though, if the RF signal fails, the links will stay up because there are RF devices between them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZnylO.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZnylO.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From router2 perspective, the link to router1 stays up/up even if the RF signal fails, and it will never fail over to Link 2... (R1 on left, R2 on right)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is there any way to have router2 track actual connectivity (not just the up/up link) to router 1 and have it fail over if it cannot reach it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would a routing protocol easily fix this situation? The bottom link does not yet exist, I want to theory craft this first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ios 15.2(4)m3&lt;/p&gt;&#xA;" OwnerUserId="21964" LastEditorUserId="8499" LastEditDate="2018-12-22T21:22:56.467" LastActivityDate="2018-12-22T21:22:56.467" Title="WAN failover when links stay up/up" Tags="|cisco|routing|wan|failover|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25892" PostTypeId="2" ParentId="25891" CreationDate="2016-01-12T20:20:24.113" Score="3" Body="&lt;p&gt;Based on your question about the routing protocol, I will assume you are not running one, but you are using static routes, probably static default routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could use a routing protocol, but you would need to make the connected default route on Link 2 have a worse AD than the default route received from the routing protocol. A routing protocol will also take some time to fail a neighbor, so it wouldn't be instantaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be possible, depending on your router/IOS combination, to add tracking to a static route. See: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/dial/configuration/guide/12_2sr/dia_12_2sr_book/dia_rel_stc_rtg_bckup.html&quot; rel=&quot;nofollow&quot;&gt;Reliable Static Routing Backup Using Object Tracking&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some router/IOS combinations can use BFD to detect a down neighbor when the link stays up.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-12T20:20:24.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25893" PostTypeId="2" ParentId="25865" CreationDate="2016-01-12T20:31:26.160" Score="1" Body="&lt;p&gt;reinstall libpcap and then reboot.&#xA;libpcap is what actually speaks NIC.&#xA;look for errors following reinstall in logs.&lt;/p&gt;&#xA;" OwnerUserId="21978" LastActivityDate="2016-01-12T20:31:26.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25894" PostTypeId="2" ParentId="25879" CreationDate="2016-01-12T20:49:05.077" Score="3" Body="&lt;p&gt;This is not a supported configuration. The SG line does not support multi-chassis LACP. You might be able to simulate this using two LACP bonds (one to each switch) and then bonding those together in a simple bond.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-12T20:49:05.077" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="25895" PostTypeId="1" AcceptedAnswerId="25897" CreationDate="2016-01-12T20:51:48.403" Score="4" ViewCount="672" Body="&lt;p&gt;In &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793#page-18&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc793&lt;/a&gt; : page 17 in explaining the &lt;strong&gt;No-Operation&lt;/strong&gt; TCP header option, it is cited:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This option code may be used between options, for example, to align&#xA;the beginning of a subsequent option on a &lt;strong&gt;word boundary&lt;/strong&gt;. There is&#xA;no guarantee that senders will use this option, so receivers must be&#xA;prepared to process options even if they do not begin on a &lt;strong&gt;word&#xA;boundary&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the meaning of &lt;strong&gt;word boundary&lt;/strong&gt; in this context?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Since the implementation of this option (No-Operation) in the TCP header depends on the type of OS and varies between different platforms, -please correct me if I'm wrong!-, does the notion of &lt;strong&gt;word boundary&lt;/strong&gt; have something to do with the actual &lt;strong&gt;CPU word size&lt;/strong&gt;?&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21926" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2017-01-15T14:59:33.883" Title="What is the notion of &quot;word boundary&quot; mentioned in RFC793 related to the packet processing?" Tags="|tcp|protocol-theory|packet-analysis|rfc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25896" PostTypeId="1" AcceptedAnswerId="25899" CreationDate="2016-01-12T20:51:52.603" Score="4" ViewCount="90" Body="&lt;p&gt;I am unable to understand the meaning behind the following extract from the ARP RFC 826:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For the 10Mbit Ethernet, the value in the protocol field (ar$pro) is&#xA;  taken from the set ether_type$.  This is a natural reuse of the&#xA;  assigned protocol types.  Combining this with the opcode (ar$op) would&#xA;  effectively halve the number of protocols that can be resolved under&#xA;  this protocol and would make a monitor/debugger more complex (see&#xA;  Network Monitoring and Debugging below).  It is hoped that we will&#xA;  never see 32768 protocols, but Murphy made some laws which don't allow&#xA;  us to make this assumption.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How is this method restricting the protocols that can be resolved to half? The way i see it we can resolve 2^16 protocols using this method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please suggest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="21979" LastEditorUserId="8499" LastEditDate="2018-12-27T01:02:49.583" LastActivityDate="2018-12-27T01:02:49.583" Title="ARP Packet format question" Tags="|protocol-theory|arp|rfc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25897" PostTypeId="2" ParentId="25895" CreationDate="2016-01-12T20:56:41.777" Score="2" Body="&lt;p&gt;This is a 16-bit boundary. A byte is 8 bits, a word is 16 bits, a double-word is 32 bits, and a quad-word is 64 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network protocols &lt;em&gt;must&lt;/em&gt; be processor and OS independent. You could not have a definition of word which varies on each side of a network conversation. How would a 16-bit PC deal with IP packets from a 32-bit PC if the 16-bit PC is expecting 16-bit words, but the 32-bit PC is aligning on 32-bit words? The whole Internet would be broken.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-12T21:23:26.343" LastActivityDate="2016-01-12T21:23:26.343" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="25899" PostTypeId="2" ParentId="25896" CreationDate="2016-01-12T21:44:12.267" Score="2" Body="&lt;p&gt;The ARP opcode could be expressed as a single bit (&lt;code&gt;REQUEST&lt;/code&gt; or &lt;code&gt;REPLY&lt;/code&gt;).  The argument could be made (and was, at the time) that 16-bits for both &lt;code&gt;arp$pro&lt;/code&gt; and &lt;code&gt;arp$op&lt;/code&gt; was wasteful, and that &lt;code&gt;arp$op&lt;/code&gt; should simply be the high bit of the &lt;code&gt;arp$pro&lt;/code&gt; field.  Doing this would have restricted the available &lt;code&gt;arp$pro&lt;/code&gt; space for ethernet to 15-bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;35 years ago this was a much more significant concern than it is today, and that is why the discussion is called out specifically in the RFC.&lt;/p&gt;&#xA;" OwnerUserId="653" LastActivityDate="2016-01-12T21:44:12.267" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25900" PostTypeId="2" ParentId="25860" CreationDate="2016-01-12T21:50:24.767" Score="0" Body="&lt;p&gt;That's a pretty broad question and there's not enough space here to completely answer it. So, let's look at this from a high level with some direction on how to do your own investigating from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet Frame Analysis:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark works by decoding a buffer of Ethernet Frames and showing them in its display. Basically the format seen is what is delivered above the MAC layer, or Ethernet frames. That's handy because the underlying hardware does not matter: copper, fiber, wireless. Wireshark can read frames in or write them out to storage as files in PCAP format. If you capture some packets using Wireshark and store them in a file, you can go back to it later and pick it apart.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;TCP/IP Illustrated, Volume 1 by Richard Stevens is a classic.&#xA;Although there have been many improvements, it provides the&#xA;fundamentals. &lt;/li&gt;&#xA;&lt;li&gt;Wikipedia articles offer a rich source for frame format, protocols and are pretty well kept up to date.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Sniffing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The details for capturing frames vary based on the system, with different affects on that system. If you're working on an embedded system, you can offload a frame buffer, transform it into PCAP and load it into Wireshark for analysis. If you're working on a server or laptop, Wireshark can interface directly with NICs to capture frames. In most cases this is fine, but under heavy network traffic load frames can be lost. In those cases an logic analyzer or other separate hardware can capture all of the frames in internal buffers for offload later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're working on a server, laptop, etc. you can be pretty sure that copies are made for all frames that Wireshark sees. Generally that's fine, but can impact performance for applications that require high bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a good overview of the subject:&#xA;Practical Packet Analysis, 2nd ed, Chris Sanders, 2011&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to dig deeper, then you need to dig into the OS, into drivers or into the software or firmware of an embedded system. In that case, you'll have to be looking for something specific.&lt;/p&gt;&#xA;" OwnerUserId="21971" LastActivityDate="2016-01-12T21:50:24.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25901" PostTypeId="1" AcceptedAnswerId="28020" CreationDate="2016-01-12T22:00:23.917" Score="1" ViewCount="249" Body="&lt;p&gt;Trying to set up external FTPS access for a web server we have hosted here.  I added the rule to the inbound access-list to allow it through.  But I believe I would also need to set up a PAT rule to translate the requests coming in on the external IP to the internal IP of the server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So requests on EXTERNALIP:990 would need to translated to INTERNALIP:990 correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would this be done from the CLI on a ASA 5510?&lt;/p&gt;&#xA;" OwnerUserId="21856" LastActivityDate="2016-02-20T17:27:14.823" Title="Create PAT rule for FTPS" Tags="|cisco-asa|nat|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25903" PostTypeId="1" AcceptedAnswerId="25938" CreationDate="2016-01-13T02:44:03.100" Score="3" ViewCount="755" Body="&lt;p&gt;I didn't configure any routing protocol to any of the router and tried to apply static routes in order to get out of the network and I've configured static routing in a manner that if R1 sends a ping to R3, the ping should go through R2 but the reply from R3 should come from R4 but it's not working. WHY?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the ip addresses and static ip addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip int br | i up&#xA;Serial0/0                  192.168.1.1     YES NVRAM  up                    up&#xA;Serial0/1                  192.168.4.1     YES NVRAM  up                    up&#xA;R1#show running-config |  sec ip route&#xA;ip route 192.168.2.2 255.255.255.255 192.168.1.2&#xA;&#xA;R2#show ip int br | i up&#xA;Serial0/0                  192.168.1.2     YES NVRAM  up                    up&#xA;Serial0/1                  192.168.2.2     YES NVRAM  up                    up&#xA;R2#show running-config | sec ip route&#xA;ip route 192.168.3.1 255.255.255.255 192.168.2.1&#xA;&#xA;R3#show running-config | sec ip route&#xA;ip route 192.168.4.2 255.255.255.255 192.168.3.2&#xA;R3#show ip int br | i up&#xA;Serial0/0                  192.168.3.1     YES NVRAM  up                    up&#xA;Serial0/1                  192.168.2.1     YES NVRAM  up                    up&#xA;R3#show running-config | sec ip route&#xA;ip route 192.168.4.2 255.255.255.255 192.168.3.2&#xA;&#xA;R4#show ip int br | i up&#xA;Serial0/0                  192.168.3.2     YES NVRAM  up                    up&#xA;Serial0/1                  192.168.4.2     YES NVRAM  up                    up&#xA;R4#show running-config | sec ip route&#xA;ip route 192.168.1.1 255.255.255.255 192.168.4.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/brgqG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/brgqG.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17520" LastEditorUserId="8499" LastEditDate="2019-01-04T22:08:42.580" LastActivityDate="2019-01-04T22:08:42.580" Title="Why R1 is not reachable to R3?" Tags="|routing|router|ping|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25904" PostTypeId="2" ParentId="25903" CreationDate="2016-01-13T02:52:47.710" Score="3" Body="&lt;p&gt;You don't have a route to the ping source address (&lt;code&gt;192.168.1.1&lt;/code&gt;) on R3 which goes back through R4. Your route to R3 from R1 is only for the network between R4 and R1, not the network on which the ping originated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are not pinging and replying to routers; you are pinging and replying to addresses in the IP packets. Without a route back to the source address in the destination router, the reply will be lost.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#ip route 192.168.1.1 255.255.255.255 192.168.3.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, R4 will need a route to the source address so that it knows what to do with the reply since the original source address will be the destination address of the reply.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4#ip route 192.168.1.1 255.255.255.255 192.168.4.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-13T03:55:41.100" LastActivityDate="2016-01-13T03:55:41.100" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25905" PostTypeId="1" CreationDate="2016-01-13T05:55:24.153" Score="1" ViewCount="353" Body="&lt;p&gt;I was answering some Summary Address questions,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and one problem is this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0 through 192.168.120.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;do I really need to one by one 1 to 120 convert them to binary and to find where is the exact common bits. It's too tiring to write it down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any technique to make it faster?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new in networking.&lt;/p&gt;&#xA;" OwnerUserId="21986" LastActivityDate="2016-01-13T12:26:33.710" Title="Summary address any technique?" Tags="|ipv4|ip|route-summarization|" AnswerCount="2" CommentCount="2" ClosedDate="2019-03-29T20:41:26.953" ContentLicense="CC BY-SA 3.0" />
  <row Id="25907" PostTypeId="2" ParentId="25905" CreationDate="2016-01-13T08:56:47.643" Score="3" Body="&lt;p&gt;I made this example to try and demonstrate it for you:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;You only need the first and last addresses:&#xA;&#xA;192.168.1.0&#xA;11000000.10101000.00000001.000000000&#xA;&#xA;192.168.120.0&#xA;11000000.10101000.01111000.000000000&#xA;&#xA;To summarize you look at how many bites are the same, &#xA;in this case the first 17 bites are equal:&#xA;&#xA;192.168.0.0&#xA;11000000.10101000.00000000.000000000&#xA;&#xA;= /17 or 255.255.128.0&#xA;&#xA;192.168.0.0/17 or 192.168.0.0 255.255.128.0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another example with different addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.1.0 = 00001010.00000001.00000001.00000000&#xA;10.1.2.0 = 00001010.00000001.00000010.00000000&#xA;==&#xA;00001010.00000001.000000|00.00000000 = /22&#xA;&#xA;==&#xA;10.1.0.0/22 or 10.1.0.0 255.255.252.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21058" LastEditorUserId="21058" LastEditDate="2016-01-13T09:09:04.923" LastActivityDate="2016-01-13T09:09:04.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25908" PostTypeId="2" ParentId="25905" CreationDate="2016-01-13T10:41:10.493" Score="1" Body="&lt;p&gt;It depends if you are seeking to find the single summary network that covers at least all of your list, or the shortest list of networks that covers your list exactly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the first case, what Bungicasse described works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the second case, it's not very difficult, and is a lot like the problem of handing back change for a payment with a minimal number of coins. You just go through it methodically, with subnets of decreasing size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would consider that a /17 (192.168.0.0 to 192.168.127.255) is too large, and that /18 ranges (192.168.0.0 to 192.168.63.255 or 192.168.64.0 to 192.168.127.255) do not align on the right ranges.&#xA;So you start with 2 /19 s and fill in with smaller ranges above and below them&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a /24 : 192.168.1.0 to 192.168.1.255&lt;/li&gt;&#xA;&lt;li&gt;a /23 : 192.168.2.0 to 192.168.3.255&lt;/li&gt;&#xA;&lt;li&gt;a /22 : 192.168.4.0 to 192.168.7.255&lt;/li&gt;&#xA;&lt;li&gt;a /21 : 192.168.8.0 to 192.168.15.255&lt;/li&gt;&#xA;&lt;li&gt;a /20 : 192.168.16.0 to 192.168.31.255&lt;/li&gt;&#xA;&lt;li&gt;a /19 : 192.168.32.0 to 192.168.63.255&lt;/li&gt;&#xA;&lt;li&gt;a /19 : 192.168.64.0 to 192.168.95.255,&lt;/li&gt;&#xA;&lt;li&gt;a /20 : 192.168.96.0 to 192.168.111.255,&lt;/li&gt;&#xA;&lt;li&gt;a /21 : 192.168.112.0 to 192.168.119.255&lt;/li&gt;&#xA;&lt;li&gt;a /24 : 192.168.120.0 to 192.168.120.255&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21892" LastEditorUserId="21892" LastEditDate="2016-01-13T12:26:33.710" LastActivityDate="2016-01-13T12:26:33.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25909" PostTypeId="2" ParentId="7003" CreationDate="2016-01-13T11:34:05.077" Score="0" Body="&lt;p&gt;You can use a web client to do this. NAT you'r public IP address to VCenter web client's IP address and connect to web client using web browser. Add Vcenter Host name to your 'host' file with public IP. &lt;/p&gt;&#xA;" OwnerUserId="21995" LastActivityDate="2016-01-13T11:34:05.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25911" PostTypeId="1" AcceptedAnswerId="25912" CreationDate="2016-01-13T15:30:01.453" Score="2" ViewCount="1367" Body="&lt;p&gt;Scenario:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;switch 1 has hosts of vlan 20 and 30 only&lt;/li&gt;&#xA;&lt;li&gt;switch 2 has hosts of vlan 30 only&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Neither of the switches are connected to any other switches&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why would we need to filter vlan 20 in switch 2? Is it necessary at&#xA;all?&lt;/li&gt;&#xA;&lt;li&gt;How do switches trunk a frame?(Are they looking at MAC address or&#xA;just VLAN tags?)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21879" LastEditorUserId="8499" LastEditDate="2016-01-13T21:04:50.093" LastActivityDate="2016-01-13T21:04:50.093" Title="How do 2 trunk ports communicate with each other?" Tags="|switch|vlan|mac-address|switching|trunk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25912" PostTypeId="2" ParentId="25911" CreationDate="2016-01-13T15:47:29.130" Score="1" Body="&lt;p&gt;A VLAN is a broadcast domain. Broadcasts and unknown unicasts are flooded to every port in a broadcast domain. Broadcasts received by a host interrupt the host and must be processed, even if the receiving host has no interest in the content of the broadcast, it must still process it to determine that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs can be used to reduce the size of the broadcast domain. By using two VLANs (20 and 30), you can restrict the broadcasts in one VLAN from being sent to hosts in the other VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the second switch has no ports in VLAN 20, why would you even want to send broadcasts and unknown unicasts for VLAN 20 to that switch? You can restrict what goes across the trunk to only VLAN 30 traffic, thereby reducing the traffic on the trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A MAC address is only relevant within the VLAN where the host with that MAC address is a member. The frames traveling on the trunks are tagged (or not tagged for a native VLAN) with the VLAN tag, and those frames will only be sent across a trunk which allows the VLAN in the tag. Frames are only delivered to the interface where the MAC address is connected, unless the switch doesn't know that and delivers it to all the interfaces in the VLAN, and a trunk interface will be one of those if the trunk allows that VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch will learn which interface a particular MAC address is, over time, and will only send frames with a destination MAC address to that interface. The switch MAC address table eventually times out a MAC address when it isn't used for a while. If the switch doesn't have a destination MAC address in its table, it will flood the frame to every interface in that VLAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-13T15:47:29.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25915" PostTypeId="1" AcceptedAnswerId="25916" CreationDate="2016-01-13T16:20:38.830" Score="3" ViewCount="82" Body="&lt;p&gt;I've been studying Software-defined networking and I have this question: Assume we have a topology of 2 hosts and 2 routers:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[H1]----&gt;(R1)-----&gt;(R2)-----&gt;[H2]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A message &lt;code&gt;M&lt;/code&gt; from &lt;code&gt;H1&lt;/code&gt; is ready to be tramsmitted to &lt;code&gt;H2&lt;/code&gt; so it is divided into &lt;code&gt;P&lt;/code&gt; packets such that each &lt;code&gt;p_i = M/P&lt;/code&gt;. When the first packet arrives to the first router &lt;code&gt;R1&lt;/code&gt;, is there a way to determine the total number of remaining packets generated by the application on &lt;code&gt;H1&lt;/code&gt; given only the first packet &lt;code&gt;p1&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="21963" LastActivityDate="2016-01-13T16:35:25.877" Title="Determine the size of message given the first packet" Tags="|cisco|routing|router|packet-analysis|sdn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25916" PostTypeId="2" ParentId="25915" CreationDate="2016-01-13T16:35:25.877" Score="2" Body="&lt;p&gt;The ability to determine how many more packets are expected is determined by the transport-layer protocol, or the application-layer protocols (off-topic). For instance, UDP is a best-effort, fire-and-forget, transport-layer protocol which has no such ability because the receiving UDP is not even really expecting to receive any more packets; that would be up to the application-layer protocol (off-topic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A message from an application will be divided into segments by the transport-layer protocol. The segments, including the transport-layer header must fit in the payload of a packet of MTU size, which must then fit within the payload of a frame for the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to know the header size of the transport-layer protocol, and the payload size of the network protocol for that link type in order to determine how many packets are needed for the message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can get messier if one of the links in the path has a smaller MTU size than the original link. This can cause fragmentation where the larger packets need to be fragmented to traverse the link. The receiving host will need to reassemble the packets making up the fragments of the original packets. Each fragment is a packet, so are you counting them as packets?&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-13T16:35:25.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25917" PostTypeId="1" CreationDate="2016-01-13T18:25:18.293" Score="3" ViewCount="1319" Body="&lt;p&gt;I need to configure SNMP on a Cisco switch and link it to SNMP 1.1.1.1 SolarWinds server. Please suggest commands for the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are using SNMPv3 with MD5 auth entication.&lt;/p&gt;&#xA;" OwnerUserId="19899" LastEditorUserId="8499" LastEditDate="2016-01-14T02:01:17.930" LastActivityDate="2016-01-14T02:01:17.930" Title="SNMP configuration on a Cisco switch" Tags="|cisco|switch|snmp|monitoring|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25918" PostTypeId="2" ParentId="25917" CreationDate="2016-01-13T18:45:05.813" Score="1" Body="&lt;p&gt;That should be easy: &lt;a href=&quot;https://thwack.solarwinds.com/docs/DOC-172650&quot; rel=&quot;nofollow&quot;&gt;https://thwack.solarwinds.com/docs/DOC-172650&lt;/a&gt;&#xA;And contact SolarWind tech support if you require further assistance.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-01-13T18:45:05.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25919" PostTypeId="2" ParentId="20015" CreationDate="2016-01-13T18:55:02.130" Score="1" Body="&lt;p&gt;If the axis camera is a poe device, you should be able to locate it on the poe switch due to it's power draw from the switch.&#xA;Then as mentioned by Ron and kaspend, it should be easy to work out the ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OTOH, if it isn't a poe device and still powered up, you could use a network scanning utility like nmap to scan the ip range provided by the dhcp server. Nmap is great to use if you want to know what is on your network: &lt;a href=&quot;https://nmap.org/book/man-port-scanning-techniques.html&quot; rel=&quot;nofollow&quot;&gt;https://nmap.org/book/man-port-scanning-techniques.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or use one of it's variants that has a gui such as Zenmap:- &lt;a href=&quot;https://nmap.org/zenmap&quot; rel=&quot;nofollow&quot;&gt;https://nmap.org/zenmap&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-01-13T18:55:02.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25920" PostTypeId="2" ParentId="25878" CreationDate="2016-01-13T18:59:07.980" Score="2" Body="&lt;p&gt;They should not differ much (and/or at all) and be inter-operable as OSPF v2 is a ratified standard:&#xA;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2328&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-01-13T18:59:07.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25921" PostTypeId="2" ParentId="25917" CreationDate="2016-01-13T19:19:51.237" Score="3" Body="&lt;p&gt;Cisco has all sorts of guides to configuring SNMP. For instance: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swsnmp.html&quot; rel=&quot;nofollow&quot;&gt;Configuring SNMP&lt;/a&gt;. It is possible that some switches or IOS versions will vary. There are also some decision to be made, such as SNMP ACLs, which notifications, etc. You will need to make some decision and customize your configuration.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;SNMP Configuration Guidelines&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If the switch starts and the switch startup configuration has at least&#xA;  one &lt;strong&gt;snmp-server&lt;/strong&gt; global configuration command, the SNMP agent is&#xA;  enabled.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;An SNMP group is a table that maps SNMP users to SNMP views. An SNMP&#xA;  user is a member of an SNMP group. An SNMP host is the recipient of an&#xA;  SNMP trap operation. An SNMP engine ID is a name for the local or&#xA;  remote SNMP engine.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When configuring SNMP, follow these guidelines:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;When configuring an SNMP group, do not specify a notify view. The    &lt;strong&gt;snmp-server host&lt;/strong&gt; global configuration command autogenerates a notify &#xA;  view for the user and then adds it to the group associated with that &#xA;  user. Modifying the group's notify view affects all users associated&lt;br&gt;&#xA;  with that group. See the Cisco IOS Network Management Command &#xA;  Reference for information about when you should configure notify &#xA;  views.&lt;/li&gt;&#xA;  &lt;li&gt;To configure a remote user, specify the IP address or port number for   the remote SNMP agent of the device where the user resides.&lt;/li&gt;&#xA;  &lt;li&gt;Before you configure remote users for a particular agent, configure    the SNMP engine ID, using the &lt;strong&gt;snmp-server engineID&lt;/strong&gt; global &#xA;  configuration with the &lt;strong&gt;remote&lt;/strong&gt; option. The remote agent's SNMP engine &#xA;  ID and user password are used to compute the authentication and &#xA;  privacy digests. If you do not configure the remote engine ID first,&#xA;  the configuration command fails.&lt;/li&gt;&#xA;  &lt;li&gt;When configuring SNMP informs, you need to configure the SNMP engine    ID for the remote agent in the SNMP database before you can&#xA;  send    proxy requests or informs to it.&lt;/li&gt;&#xA;  &lt;li&gt;If a local user is not associated with a remote host, the switch does    not send informs for the &lt;strong&gt;auth&lt;/strong&gt; (authNoPriv) and the &lt;strong&gt;priv&lt;/strong&gt;&#xA;  (authPriv)    authentication levels.&lt;/li&gt;&#xA;  &lt;li&gt;Changing the value of the SNMP engine ID has important side effects.    A user's password (entered on the command line) is&#xA;  converted to an  MD5 or SHA security digest based on the password&#xA;  and the local engine ID. The command-line password is then&#xA;  destroyed, as required by RFC 2274. Because of this deletion, if the value of the engine ID changes, the security digests of SNMPv3 users become invalid, and you need to reconfigure SNMP users by using the &lt;strong&gt;snmp-server user&lt;/strong&gt; username global configuration command. Similar restrictions require the &#xA;  reconfiguration of community strings when the engine ID changes.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-13T20:11:26.440" LastActivityDate="2016-01-13T20:11:26.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25925" PostTypeId="1" AcceptedAnswerId="25929" CreationDate="2016-01-14T05:29:20.743" Score="1" ViewCount="344" Body="&lt;p&gt;I read the Cisco documentation of Cisco 3850 and have not found configuration to send email when interface is down. ASA can do this. I really appreciate if anyone know how to share the configuration.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastActivityDate="2016-01-14T08:44:17.847" Title="cisco catalyst 3850: configuration to send email when any interface down" Tags="|cisco-catalyst|logging|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25928" PostTypeId="2" ParentId="24426" CreationDate="2016-01-14T08:15:47.197" Score="2" Body="&lt;p&gt;On the TCP level, since you have a real connection between a local and remote host, your connection is uniquely identified by a 4-tuple (source IP, source port, destination IP, destination port). So whether on the server or client side, the theoretical limit is pretty high, since even for a given client and server, and a specific server port, you can still open 65536 individual connections that have a unique 4-tuple. In practice, as Ron Maupin stated above, you would run into other limits first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the UDP level, since there is no connection, your socket is only identified by its local IP and port, and it's typically up to your application to deal with separating the data coming from different hosts (look at the UDPClient.Receive method in .Net for example).&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-14T08:15:47.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25929" PostTypeId="2" ParentId="25925" CreationDate="2016-01-14T08:44:17.847" Score="2" Body="&lt;p&gt;You could utilize the Embedded Event Manager with a custom policy for this. There is a good overview and documentation here from Cisco: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/configuration/xe-3se/3850/eem-xe-3se-3850-book/eem-policy-tcl.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/configuration/xe-3se/3850/eem-xe-3se-3850-book/eem-policy-tcl.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this is relatively complicated. A much easier approach would be to forward the syslog output from the 3850 to your monitoring system and trigger the mail from there. Almost any monitoring systems have a syslog collector and can scan the messages for given keywords and trigger actions if such a keyword is detected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, this solution presupposes that you have some kind of system monitoring in place. But, whoever does not? ;)&lt;/p&gt;&#xA;" OwnerUserId="2112" LastActivityDate="2016-01-14T08:44:17.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25930" PostTypeId="1" AcceptedAnswerId="25931" CreationDate="2016-01-14T10:05:20.880" Score="6" ViewCount="3415" Body="&lt;p&gt;Is there any rule in networking which says that the ping(echo request) reply should come from the same path from which the ping(echo request) has been sent? For example If I ping 192.168.2.1 from R1's se0/0, according to my configuration the ping(echo request) should go from R1-&gt;R2-&gt;R3'(se0/1) and reply(echo request reply) should come from R3-&gt;R4-&gt;R1'(se0/0) since I have given static routes on all routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configurations are as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip int br | i up&#xA;Serial0/0                  192.168.1.1     YES NVRAM  up                    up&#xA;Serial0/1                  192.168.4.1     YES NVRAM  up                    up&#xA;R1#show running-config |  sec ip route&#xA;ip route 192.168.2.2 255.255.255.255 192.168.1.2&#xA;&#xA;R2#show ip int br | i up&#xA;Serial0/0                  192.168.1.2     YES NVRAM  up                    up&#xA;Serial0/1                  192.168.2.2     YES NVRAM  up                    up&#xA;R2#show running-config | sec ip route&#xA;ip route 192.168.3.1 255.255.255.255 192.168.2.1&#xA;&#xA;R3#show running-config | sec ip route&#xA;ip route 192.168.4.2 255.255.255.255 192.168.3.2&#xA;R3#show ip int br | i up&#xA;Serial0/0                  192.168.3.1     YES NVRAM  up                    up&#xA;Serial0/1                  192.168.2.1     YES NVRAM  up                    up&#xA;R3#show running-config | sec ip route&#xA;ip route 192.168.4.2 255.255.255.255 192.168.3.2&#xA;&#xA;R4#show ip int br | i up&#xA;Serial0/0                  192.168.3.2     YES NVRAM  up                    up&#xA;Serial0/1                  192.168.4.2     YES NVRAM  up                    up&#xA;R4#show running-config | sec ip route&#xA;ip route 192.168.1.1 255.255.255.255 192.168.4.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CSy1m.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CSy1m.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17520" LastActivityDate="2016-01-28T20:44:12.873" Title="Does reply use the same path from which the ping(echo request) has been sent?" Tags="|routing|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25931" PostTypeId="2" ParentId="25930" CreationDate="2016-01-14T10:26:34.973" Score="16" Body="&lt;p&gt;There is absolutely no rule to the effect that pings follow the same path on return, quite the opposite in fact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ICMP packets are routed based on their destination, so if you have asymetrical routing somewhere in your network, the ICMP request will take one path, and the reply will take another. This is also why it is often useful when troubleshooting to get traceroutes from both ends of your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case though, are you not missing some routes ? On R1 for instance you have a route towards 192.168.2.2/32, but not towards 2.1.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-14T10:26:34.973" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25932" PostTypeId="1" CreationDate="2016-01-14T13:13:23.440" Score="3" ViewCount="587" Body="&lt;p&gt;My question is related to creating an unidirectional network cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used these tutorials:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.dgonzalez.net/papers/roc/roc.pdf&quot; rel=&quot;nofollow&quot;&gt;Receive-only UTP cables and Network Taps&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.sentinelsecurity.com.au/whitepapers/onewaycable.pdf&quot; rel=&quot;nofollow&quot;&gt;ONE-WAY CABLE FOR IDS DEPLOYMENT&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In principle it works by cutting a Category-5 cable in half, connecting the transmit pair (pins 1 and 2) of the sending side to the receive pair of the receiver side (pins 3 and 6), but you also have to connect pins 3 and 6 of the sending side to your bundle, creating some kind of loopback on the sender side. So in the end you have a point where three cables are connected and the link is working fine (you can send data in one direction etc.). If you do not create this loopback it does not work and the link does not come up on the sender side (on the receiver side it does!). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Why is that the case? Why can't I just connect the TX and RX wires of sender and receiver?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that it is related to the link pulses used for autonegotiation. My hope was that these are not present if I disable autonegotiation, which I did successfully with ethtool. (I also set the speed to 100 mbps and duplex to full.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yet the link still does not come up. So there must be more to that.&#xA;Maybe there is also some way to tell the sender side that the link it is up. But I don't know if the link status is handled by the driver or directly by the chip (AX88772B).&lt;/p&gt;&#xA;" OwnerUserId="22019" LastEditorUserId="8499" LastEditDate="2016-03-14T16:02:48.373" LastActivityDate="2018-05-04T18:33:54.483" Title="Simulate/Deactivate link status recognition for 100BASE-TX" Tags="|ethernet|autonegotiation|" AnswerCount="3" CommentCount="1" ClosedDate="2019-02-12T05:17:23.197" ContentLicense="CC BY-SA 3.0" />
  <row Id="25933" PostTypeId="1" CreationDate="2016-01-14T14:10:38.883" Score="3" ViewCount="3029" Body="&lt;p&gt;I am trying to allow an ssh session to auto-enable on my ASA.  I am enable to ssh to the asa with the public key and get directly to a non-enabled prompt, but I want that prompt to enter in enabled mode so that I can use the account for automation without storing passwords in a script. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per the cisco docs, if you specify &lt;code&gt;auto-enable&lt;/code&gt; on the &lt;code&gt;aaa authorization exec LOCAL&lt;/code&gt; line, it should automatically put an inbound localdb user in enable mode.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thinking that I might also need to set service-type, I set &lt;code&gt;service-type admin&lt;/code&gt; on the user in question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication ssh console tacacsgroup LOCAL&#xA;aaa authentication enable console tacacsgroup LOCAL&#xA;aaa authentication http console tacacsgroup LOCAL&#xA;aaa authorization command LOCAL&#xA;aaa accounting command tacacsgroup&#xA;aaa accounting enable console tacacsgroup&#xA;aaa accounting ssh console tacacsgroup&#xA;aaa authorization exec LOCAL auto-enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the user entry:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username redacted password redacted encrypted privilege 15&#xA;username redacted attributes&#xA; service-type admin&#xA; ssh authentication publickey re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed:re:da:ct:ed hashed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="154" LastEditorUserId="154" LastEditDate="2016-01-14T14:18:52.480" LastActivityDate="2017-03-05T20:35:10.780" Title="How do I auto-enable on an ssh public key login on an ASA?" Tags="|cisco-asa|ssh|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25934" PostTypeId="2" ParentId="25932" CreationDate="2016-01-14T14:44:08.490" Score="0" Body="&lt;p&gt;You are forgetting how ethernet works. An interface needs to know the line protocol is up. Ethernet (CSMA/CD, where the CS stands for Carrier Sense) listens that the line is clear before sending. When the receive pins hear a connection, the interface will work, otherwise the interface doesn't think it is connected to anything, and it will not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, on a Cisco device without the receive pins active, you can do &lt;code&gt;show interfaces FastEthernet0/0&lt;/code&gt;, and the first line of the response will be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/0 is up, line protocol is down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What you need is that the receive pins be active so that you get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/0 is up, line protocol is up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same thing happens with a fiber pair when the receive fiber strand is disconnected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing what you want to do will also cause problems for the upper-layer protocols. For example, when IP wants to send to another host on ethernet, it will ARP for the MAC address, and it will need to get a reply before it can send. You will need to create static ARP table entries in your hosts for the receiving hosts. TCP requires a bidirectional connection in order to function. There are many protocols in networking which are dependent on the request/response behavior.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-14T14:44:08.490" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="25935" PostTypeId="1" CreationDate="2016-01-14T14:56:29.853" Score="1" ViewCount="94" Body="&lt;p&gt;We have 2 pcs Cisco WAP300N and working on Access Point mode.&#xA;This devices setted in a long floor. Also LAN cable connected to each one. And SSID's are the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When someone starts to walk from begining of floor, connected first one normally. But when he reaches end of the floor, Mobile devices does not connect nearest and strong one (means 2nd one), it's stil triying to access the first one via poor signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, everybody living some stability issues with internet applications. We are living low signal level and some rupture problems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why these devices does not prefer nearest one ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can we configurate access point that WAP300N for continuous and smooth internet access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XyGAn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XyGAn.png&quot; alt=&quot;This is from WAP300N panel&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/IIiuZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IIiuZ.png&quot; alt=&quot;This is from WAP300N panel&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22022" LastActivityDate="2016-01-14T18:50:28.633" Title="2 Access Point in Long Floor - [Device Prefer Problem]" Tags="|cisco|router|network-core|access-point|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25936" PostTypeId="2" ParentId="24677" CreationDate="2016-01-14T15:34:24.303" Score="0" Body="&lt;p&gt;After trying extensively with all that was discussed here I turned to wiresharking the traffic and as it turns out there was a bug on my source that was causing the stream to be produced with a TTL of 0 (regardless of the GUI setting). &lt;/p&gt;&#xA;" OwnerUserId="20897" LastActivityDate="2016-01-14T15:34:24.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25937" PostTypeId="1" AcceptedAnswerId="25940" CreationDate="2016-01-14T15:45:02.333" Score="2" ViewCount="188" Body="&lt;p&gt;Imagine you have a ring of routers, all of which are routing multicast with PIM Sparse mode, pretend there's a single Rendevouz Point (RP) &quot;Router A&quot; for any multicast on 239.10.10.0/24. If a stream with the address 239.20.20.20 is then injected into this ring, what is the expected behavior?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/I9RyM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I9RyM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20897" LastActivityDate="2016-01-14T16:17:08.350" Title="what happens to multicast outside of the RP domain in PIM-SM?" Tags="|routing|multicast|pim|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25938" PostTypeId="2" ParentId="25903" CreationDate="2016-01-14T16:00:53.103" Score="1" Body="&lt;p&gt;In princple, Ron has correctly indicated the reason for your lab not working, but I am afraid it will not work with proposed two corrections too.&#xA;This one is OK:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3#ip route 192.168.1.1 255.255.255.255 192.168.3.2 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should mention that you don't really need this one, if you don't plan to ping 192.168.4.2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3#ip route 192.168.4.2 255.255.255.255 192.168.3.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to R4: here you had already&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R4#ip route 192.168.1.1 255.255.255.255 192.168.4.1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so nothing to correct here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is still missing to make things work, is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1#ip route 192.168.2.1 255.255.255.255 192.168.1.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, you don't need&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1#ip route 192.168.2.2 255.255.255.255 192.168.1.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but you can have it if you like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, add two routes on R1 and R3 and you'll see some !!!!! :)&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-01-14T16:00:53.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25939" PostTypeId="1" AcceptedAnswerId="25943" CreationDate="2016-01-14T16:08:03.667" Score="7" ViewCount="51821" Body="&lt;p&gt;When running &quot;ethtool eth0&quot;,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I get a line in the output that states -&gt; &lt;em&gt;Supported pause frame use: No&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does this mean my Ethernet card does not support flow control at all?&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I try to enable the flow control with &quot;ethtool -A eth0 rx on tx on&quot;,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Nothing happens, the command executes but then &quot;ethtool -a eth0&quot; still reports that it is off&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Auto negotiation appears on, but I am unsure if this effects flow control. From what I see, it can determine link flow control?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I question ethtool because when looking online at the specs of my Ethernet card, it looks like it fully supports flow control?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Lastly, I am hooked to a layer 2 switch. Does auto-negotiate have to be on for both endpoints to determine flow control?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;All in all, I just want to enable flow control on a host and a switch&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Intel® Ethernet Controller X540-AT2 &lt;/p&gt;&#xA;" OwnerUserId="21360" LastEditorUserId="21360" LastEditDate="2016-01-14T17:30:20.777" LastActivityDate="2016-01-16T04:16:41.097" Title="Enabling flow control on my ethernet NIC" Tags="|switch|ethernet|layer2|autonegotiation|10gbase|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25940" PostTypeId="2" ParentId="25937" CreationDate="2016-01-14T16:17:08.350" Score="2" Body="&lt;p&gt;If there is no RP for the second multicast group, the new multicast stream will not be routed because the routers have no place to send the stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the RP configuration in your previous question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip pim autorp listener&#xA;ip pim send-rp-announce Loopback0 scope 12 group-list 1&#xA;ip pim send-rp-discovery scope 12&#xA;!&#xA;access-list 1 permit 239.10.10.0 0.0.0.255&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this RP will not be an RP for your new stream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your new stream will need an RP and an RP mapping agent for that stream. It doesn't need to be the same RP as for the first stream. You could change the ACL on the RP to specifically announce the RP for the new stream:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 1 permit 239.10.10.0 0.0.0.255&#xA;access-list 1 permit 239.20.20.20 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or you could expand the existing range on the ACL from a &lt;code&gt;/24&lt;/code&gt; to include the new stream:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 1 permit 239.0.0.0 0.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or you can manually set the RP address on each router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 1 permit 239.20.20.20 0.0.0.0&#xA;ip pim rp-address &amp;lt;rp ip address&amp;gt; 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-14T16:17:08.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25941" PostTypeId="2" ParentId="25780" CreationDate="2016-01-14T16:27:21.983" Score="1" Body="&lt;p&gt;The configuration looks good to me though I don't recall having to use &quot;switchport mode access&quot; in configuring other Cisco devices for flexible NetFlow. (I've got an &lt;a href=&quot;http://www.flowtraq.com/corporate/blog/tech-thoughts/configuring-flexible-netflow-export-cisco-routers/&quot; rel=&quot;nofollow&quot;&gt;example configuration here&lt;/a&gt;, if you want a look at a similar one that I know worked in another environment)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen problems in the past with having both an input and an output flow monitor on the same interface in Cisco devices (not this particular one, but you never know). Since this isn't working for you, I would recommend applying an input flow monitor on all of your interfaces, rather than an input and an output on just one. You should be able to replicate the current setup by having the current input flow monitor sending to UDP/2055 and all the others sending to UDP/2056.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also look into the possibility that it's correct: perhaps you've got some kind of accidental asymmetric routing situation here, and the traffic is egressing through a different interface entirely.&lt;/p&gt;&#xA;" OwnerUserId="82" LastActivityDate="2016-01-14T16:27:21.983" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25942" PostTypeId="1" CreationDate="2016-01-14T16:47:14.363" Score="9" ViewCount="459" Body="&lt;p&gt;I am debating with a colleague about a potential configuration. We are implementing a new blade solution that has a built in 10 Gb switch and two blade servers, each having 4 10 Gb NICs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the rest of our environment is still 1 Gb. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The blade switch has four external 10GBASE-T ports which will auto-sense down to 1 Gb. We plan on LAGing these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, we will have 80 Gb of NIC bandwidth on a 10 Gb switch connected with a 4 Gb inter-switch link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think we should manually set the internal ports to 1 Gb, but he doesn't think there will be any noticeable performance problems from the above design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know if you have had any experience with a similar setup, or if you know of any problems we may anticipate.&lt;/p&gt;&#xA;" OwnerUserId="22024" LastEditorUserId="8499" LastEditDate="2016-01-15T03:11:18.093" LastActivityDate="2018-05-22T12:32:34.753" Title="10 Gb blade question" Tags="|switch|switching|10gbase|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25943" PostTypeId="2" ParentId="25939" CreationDate="2016-01-14T16:49:47.760" Score="5" Body="&lt;p&gt;Most of this doesn't matter, ethernet flow control has never been widely supported and most switch devices will respect &lt;code&gt;PAUSE&lt;/code&gt; frames, but not send them.  That being said, your questions can be addressed fairly easily:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Not exactly.  You can still send pause frames, but your card won't respect ones sent by the switch (which you will likely never get anyhow).  The driver probably doesn't send pause frames though, so any you send would have to be generated manually.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Autonegotiation has no effect on flow control on full-duplex gigabit links&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Ethtool is responding with information from the NIC driver.  It doesn't matter what the hardware supports if the driver doesn't support it, so what ethtool is telling you is important.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;No.  Unless you're working at 100Mbit, autonegotiation in general isn't going to help you (unless you're working with repeaters or other rare half-duplex gear at gigabit).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="653" LastEditorUserId="653" LastEditDate="2016-01-14T18:41:40.947" LastActivityDate="2016-01-14T18:41:40.947" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="25944" PostTypeId="2" ParentId="25935" CreationDate="2016-01-14T17:14:05.873" Score="1" Body="&lt;p&gt;It is up to the client to determine when to roam from one AP to another.  The AP does not make the decision. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try disabling low data rates on the APs to encourage roaming, but ultimately, there's not a lot you can do.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-14T17:14:05.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25947" PostTypeId="2" ParentId="25935" CreationDate="2016-01-14T18:50:28.633" Score="2" Body="&lt;p&gt;&lt;strong&gt;Turn access point transmit power down.&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the client can't hear the &quot;wrong&quot; access point, it will connect to the right one. If it hears both and is prone to making bad choices (as many clients are) you get the problem you have. If clients can hear the wrong access point when they are near the &quot;right&quot; one, the wrong one (probably both) is (are) turned up too high.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most people seem to gravitate to a &quot;more power is better&quot; approach to WiFi, which is pretty much the opposite of the truth. Lower power APs, closer to the clients (which may mean more APs) work better in nearly all cases...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...And run wired network to both APs - &quot;Wireless Range Extender&quot; is a performance-limiting mode that should be avoided. Good wireless is done with a lot of wire and fiber providing network to APs.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-01-14T18:50:28.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25949" PostTypeId="2" ParentId="25942" CreationDate="2016-01-14T20:08:55.497" Score="1" Body="&lt;p&gt;Basically, your 40 Gb link bundles will be for fault tolerance only unless you have blade-to-blade transfers on the blade switch; even a single 10 Gb server connection is more than your total uplink bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many networks and switches with mixed port speed. Cisco has a guideline based on extensive research. The access port (your server connections) to distribution port (your external connections) bandwidth ratio should be no greater than 20:1. This means that for every 20 Gb in your access port speed, you need 1 Gb uplink port speed. What you are describing (80 Gb to 4Gb) is 20:1. The recommended distribution to core ratio is much lower at 4:1.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-14T20:15:50.447" LastActivityDate="2016-01-14T20:15:50.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25951" PostTypeId="1" CreationDate="2016-01-14T21:36:45.393" Score="6" ViewCount="6600" Body="&lt;p&gt;First of all, I am not sure if I can ask this question here, and, if not, I appreciate that you indicate me the best website to ask this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been reading about ASs (Autonomous Systems), ISPs (Internet Services Providers) and RIRs (Regional Internet Registries). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I understood that there's a big entity at the top of the RIRs that actually is more powerful than RIRs, we are talking about IANA. This IANA is for example responsible for allocating IP addresses or to give ranges of addresses to RIRs (as far as I have understood). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISPs are for example the telephone companies that allow you to connect to the internet through their service. They usually give you a modem (and a router), and, when you want to access some website (for example), the request passes through their servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASs, as far as I have understood, can be many ISPs put together or just one. An AS exists because the entities that take part of that AS share the same policies, for example the same routing protocols (e.g., OSPF).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure if the description I gave are correct, but I am pretty sure they are quite incomplete. Since I have not found nothing really satisfying that describes the difference between autonomous systems, ISPs and RIRs, I decided to ask here a question with the hope of receiving an exhaustive description of what they are and what's the difference between them.&lt;/p&gt;&#xA;" OwnerDisplayName="user16355" LastEditorUserId="21926" LastEditDate="2016-01-15T13:34:23.413" LastActivityDate="2016-01-15T13:34:23.413" Title="What's the difference between autonomous systems, ISPs and RIRs?" Tags="|isp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25952" PostTypeId="1" AcceptedAnswerId="25953" CreationDate="2016-01-14T21:54:55.007" Score="2" ViewCount="4944" Body="&lt;p&gt;I just finished a Cisco CCNA video course, so I know just enough about networking to be dangerous. I have a pretty good idea of how IP's and subnets work, but one thing I haven't been able to find out is why, exactly, 255.255.255.0 is the default subnet mask in most of the routers I've seen (admittedly, nearly all consumer-grade and SOHO routers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Granted, there's not all that much of a reason for a consumer-grade router to use anything else - unless you need more than 254 IP's, or want to do something complex like organizing your network (servers on 192.168.1.X, desktops on 192.168.2.x, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That got me thinking, are those the only reasons to use 255.255.255.0? What exactly would change for people if the default mask was 255.255.0.0 instead? Is there some downside to using the latter?&lt;/p&gt;&#xA;" OwnerUserId="14423" LastActivityDate="2017-06-16T09:21:40.923" Title="Is there a downside to using a subnet mask other than 255.255.255.0?" Tags="|subnet|" AnswerCount="3" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25953" PostTypeId="2" ParentId="25952" CreationDate="2016-01-14T21:56:30.200" Score="3" Body="&lt;p&gt;Well, sometimes you find some consumer hardware with that mask hard coded here and there. But that's relatively rare and not a deciding factor. Also you want to stick within the predefined private ip ranges, that's the bigger consideration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually common practice for choosing defaults (in my neck of the woods at least) is to use the tightest mask possible and that one is an easy one for humans to deal with even if it isn't the absolute tightest. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use whatever you want though just be careful to not open up a range that starts to conflict with internet IPs. There's a list of reserved addresses at &lt;a href=&quot;https://en.m.wikipedia.org/wiki/Reserved_IP_addresses&quot; rel=&quot;nofollow&quot;&gt;https://en.m.wikipedia.org/wiki/Reserved_IP_addresses&lt;/a&gt;. E.g. 192.x.x.x/255.0.0.0 is not acceptable for private LAN use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this doesn't answer your question fully. Barring other answers I'll do some research on more concrete reasons why the default is /24 when I'm not on my phone. I strongly suspect it's either tradition, or the safest bet given that unwise users may choose nonprivate ranges.&lt;/p&gt;&#xA;" OwnerUserId="6308" LastEditorUserId="6308" LastEditDate="2016-01-14T22:15:13.010" LastActivityDate="2016-01-14T22:15:13.010" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="25954" PostTypeId="1" AcceptedAnswerId="25955" CreationDate="2016-01-14T22:47:51.857" Score="0" ViewCount="30" Body="&lt;p&gt;I have added the following iptables rules but I am still seeing successful icmp, tcp, and http traffic to that subnet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output from iptables -L:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Chain OUTPUT (policy ACCEPT)&#xA;REJECT     all  --  anywhere        199.22.124.0/21 reject-with icmp-port-unreachable&#xA;&#xA;Chain INPUT (policy DROP)&#xA;target     prot opt source          destination&#xA;REJECT     all  --  199.22.124.0/21 anywhere        reject-with icmp-port-unreachable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22031" LastEditorUserId="619" LastEditDate="2016-01-14T23:13:18.480" LastActivityDate="2016-02-14T00:30:31.577" Title="IpTables Chain not being invoked" Tags="|firewall|" AnswerCount="1" CommentCount="2" ClosedDate="2019-03-25T00:58:54.343" ContentLicense="CC BY-SA 3.0" />
  <row Id="25955" PostTypeId="2" ParentId="25954" CreationDate="2016-01-14T23:42:48.347" Score="0" Body="&lt;p&gt;I discovered that since these rules are on the router, they must be FORWARD rules, not INPUT / OUTPUT.  I'm not entirely clear how it interprets the source and destination flags, but it seems to work with -s flags.&lt;/p&gt;&#xA;" OwnerUserId="22031" LastActivityDate="2016-01-14T23:42:48.347" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25957" PostTypeId="1" AcceptedAnswerId="25959" CreationDate="2016-01-15T00:34:08.517" Score="2" ViewCount="872" Body="&lt;p&gt;Could someone please confirm if 'show inventory' command works on 'IOS (tm) C3560 Software (C3560-I9-M), Version 12.1(19)EA1d'? If no, what is version and upwards do I need this to get it working?&lt;/p&gt;&#xA;" OwnerUserId="22037" LastEditorUserId="8499" LastEditDate="2018-12-22T21:25:40.257" LastActivityDate="2018-12-22T21:25:40.257" Title="Show Inventory command on Cisco" Tags="|cisco|switch|cisco-ios|cisco-catalyst|cisco-commands|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25958" PostTypeId="2" ParentId="25951" CreationDate="2016-01-15T00:46:15.673" Score="10" Body="&lt;p&gt;You are pretty accurate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IANA is the Internet Assigned Numbers Authority. Its function is to make sure that numbers that need to be unique are actually unique. That includes protocol values, IPv4 addresses, IPv6 addresses and AS numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPv4, IPv6 and ASNs we have a distributed system: IANA doesn't assign those numbers directly to the users. They allocate big blocks of numbers to the five RIRs, the Regional Internet Registries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are five RIRs: ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC. Each RIR has its own region, and in each region the internet community (so not just paying members, everyone can participate) decides on the local policies for further allocation and assignment of those numbers. Giving each internet user their own address would be a bit inefficient, both organizationally and technically, so most addresses are allocated to the members of the RIR. They then further assign numbers to end users etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such members are called LIRs: Local Internet Registries. Often a LIR is an ISP who performs registry services for its own customers, or a large enterprise that is the registry for its departments and/or subsidiaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When someone has been allocated or assigned IP address they usually want to route them on the internet. This is done using the BGP protocol. Each network that has its own policies (including transit connections, peerings, local routing policy etc) is an Autonomous System or AS, and needs its own Autonomous System Number or ASN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you are a small network and you only connect to one upstream provider you don't have your own routing policy. You follow the policy of your provider. In that case you can let your IP addresses be announced from the ASN of the provider. That is how multiple organisations can appear as one autonomous system: one organisations controlling it and their customers using it. When you have multiple  upstreams and/or peerings you need to get your own ASN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other way around also happens: one organisation that runs multiple distinct networks. In that case one organisation will have multiple autonomous systems, each with its own ASN.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-01-15T00:46:15.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25959" PostTypeId="2" ParentId="25957" CreationDate="2016-01-15T00:49:09.243" Score="4" Body="&lt;p&gt;When you need this sort of information, you can search on Cisco's web site. It is in &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/command/cf_command_ref/show_gsr_through_show_monitor_event_trace.html#wp3909457221&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IOS Configuration Fundamentals Command Reference&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HhJDs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HhJDs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-15T00:49:09.243" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25961" PostTypeId="1" CreationDate="2016-01-15T01:14:53.717" Score="1" ViewCount="99" Body="&lt;p&gt;Is the &lt;code&gt;/32&lt;/code&gt; subnet only for loopback addresses? Can we have the subnet for the non-loopback addresses&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get the following error, when I am trying to delete the route with a &lt;code&gt;/32&lt;/code&gt; subnet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ip route del 200.200.200.234/255.255.255.255 -&#xA;&#xA;Netlink error(code 3) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13278" LastEditorUserId="8499" LastEditDate="2016-01-15T03:03:38.493" LastActivityDate="2016-01-15T03:03:38.493" Title="Can we apply the /32 subnet to the address 200.200.200.234?" Tags="|subnet|linux|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25962" PostTypeId="2" ParentId="25961" CreationDate="2016-01-15T01:28:55.283" Score="2" Body="&lt;p&gt;A &lt;code&gt;/32&lt;/code&gt; network must be routed since there is no default gateway for a device on it to use to get to addresses off the network (every other address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some cases you may see a route like this which is also contained in another route in the routing table. For instance, Cisco routers with later IOS versions will show a &lt;code&gt;/32&lt;/code&gt; route for the actual interface addresses using an &lt;code&gt;L&lt;/code&gt;, but the network route will show with a &lt;code&gt;C&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example, the &lt;code&gt;L&lt;/code&gt; route is the address applied to &lt;code&gt;interface GigabitEthernet0/1&lt;/code&gt;, while the &lt;code&gt;C&lt;/code&gt; route is the network connected to that interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;      128.190.0.0/16 is variably subnetted, 2 subnets, 2 masks&#xA;C        128.190.32.0/19 is directly connected, GigabitEthernet0/1&#xA;L        128.190.34.204/32 is directly connected, GigabitEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-15T02:09:46.927" LastActivityDate="2016-01-15T02:09:46.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25963" PostTypeId="1" CreationDate="2016-01-15T05:26:52.703" Score="1" ViewCount="743" Body="&lt;p&gt;Network diagram:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Site A (.85)----172.24.0.84/30---- (.86)Site B&#xA;    |(.66)                              |(.102)&#xA;    |                                   |&#xA;    |(172.24.0.64/30)                   |(172.24.0.100/30)&#xA;    |(.65)                              |(.101)&#xA;    -------------- Site C ---------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router configs &amp;amp; traceroute result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;site_a:&#xA;&#xA;interface FastEthernet0/0&#xA; ip address 172.24.0.85 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 172.24.0.65 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router bgp 900&#xA; no synchronization&#xA; bgp router-id 172.24.0.65&#xA; bgp log-neighbor-changes&#xA; network 172.24.0.64 mask 255.255.255.252&#xA; network 172.24.0.84 mask 255.255.255.252&#xA; timers bgp 1 3&#xA; neighbor 172.24.0.66 remote-as 100&#xA; neighbor 172.24.0.66 soft-reconfiguration inbound&#xA; neighbor 172.24.0.86 remote-as 1200&#xA; neighbor 172.24.0.86 soft-reconfiguration inbound&#xA; neighbor 172.24.0.86 route-map site_b_only in&#xA; no auto-summary&#xA;!&#xA;ip as-path access-list 1 permit ^[0-9]+_[0-9]+$&#xA;!&#xA;route-map site_b_only permit 10&#xA; match as-path 1&#xA;&#xA;_____________________________________&#xA;site_b:&#xA;&#xA;interface FastEthernet0/0&#xA; ip address 172.24.0.86 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 172.24.0.102 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router bgp 1200&#xA; no synchronization&#xA; bgp router-id 172.24.0.86&#xA; bgp log-neighbor-changes&#xA; network 172.24.0.84 mask 255.255.255.252&#xA; network 172.24.0.100 mask 255.255.255.252&#xA; timers bgp 1 3&#xA; neighbor 172.24.0.85 remote-as 900&#xA; neighbor 172.24.0.85 soft-reconfiguration inbound&#xA; neighbor 172.24.0.85 route-map site_a_only in&#xA; neighbor 172.24.0.101 remote-as 100&#xA; neighbor 172.24.0.101 soft-reconfiguration inbound&#xA; no auto-summary&#xA;!&#xA;ip as-path access-list 1 permit ^900_[0-9]*$&#xA;!&#xA;route-map site_a_only permit 10&#xA; match as-path 1&#xA;&#xA;__________________________________________&#xA;site_c:&#xA;&#xA;interface FastEthernet0/0&#xA; ip address 172.24.0.66 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 172.24.0.101 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router bgp 100&#xA; no synchronization&#xA; bgp router-id 192.168.255.2&#xA; bgp log-neighbor-changes&#xA; network 172.24.0.64 mask 255.255.255.252&#xA; network 172.24.0.100 mask 255.255.255.252&#xA; timers bgp 1 3&#xA; neighbor 172.24.0.65 remote-as 900&#xA; neighbor 172.24.0.65 soft-reconfiguration inbound&#xA; neighbor 172.24.0.102 remote-as 1200&#xA; neighbor 172.24.0.102 soft-reconfiguration inbound&#xA; no auto-summary&#xA;&#xA;_________________________________________________________&#xA;site_c#show ip bgp  &#xA;BGP table version is 4, local router ID is 192.168.255.2&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*  172.24.0.64/30   172.24.0.65              0             0 900 i&#xA;*&amp;gt;                  0.0.0.0                  0         32768 i&#xA;*  172.24.0.84/30   172.24.0.102             0             0 1200 i&#xA;*&amp;gt;                  172.24.0.65              0             0 900 i&#xA;*  172.24.0.100/30  172.24.0.102             0             0 1200 i&#xA;*&amp;gt;                  0.0.0.0                  0         32768 i&#xA;site_c#traceroute 172.24.0.85&#xA;&#xA;Type escape sequence to abort.&#xA;Tracing the route to 172.24.0.85&#xA;&#xA;  1 172.24.0.65 28 msec 16 msec 20 msec&#xA;site_c#traceroute 172.24.0.86&#xA;&#xA;Type escape sequence to abort.&#xA;Tracing the route to 172.24.0.86&#xA;&#xA;  1 172.24.0.65 24 msec 20 msec 24 msec&#xA;  2 172.24.0.86 [AS 900] 16 msec 36 msec 24 msec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How could I force traffic not to route between Site A and Site B if traffic is from Site C ? I want Site C -&gt; Site A, Site C -&gt; Site B only; but Site A and Site B have to communicate via their p2p link&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you check the traceroute result from site C to 172.24.0.86, it still passing Site A, which is wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eventually deployment will be under Linux running Quagga, this is just simulation in my lab environment running IOS. &lt;/p&gt;&#xA;" OwnerUserId="4479" LastEditorUserId="4479" LastEditDate="2016-01-15T05:51:08.540" LastActivityDate="2016-02-17T10:46:14.487" Title="Blocking BGP routes on specific path" Tags="|cisco|routing|bgp|" AnswerCount="2" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="25964" PostTypeId="1" AcceptedAnswerId="25975" CreationDate="2016-01-15T07:48:43.257" Score="1" ViewCount="127" Body="&lt;p&gt;I'm new to the networking field. I know the functionality of a routing engine but I wanted to know how it is implemented mainly? Is it a piece of hardware or software which does the work? On googling I could see &lt;a href=&quot;http://www.juniper.net/us/en/&quot; rel=&quot;nofollow&quot;&gt;Juniper&lt;/a&gt; implementing the same in hardware (which also forwards the packets) where as some other links have referred to it as a software which builds the route lookup tables.&lt;/p&gt;&#xA;" OwnerUserId="3269" LastEditorUserId="2142" LastEditDate="2016-01-15T14:14:19.687" LastActivityDate="2016-01-15T17:16:56.200" Title="Routing engine implementation" Tags="|routing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25965" PostTypeId="2" ParentId="25952" CreationDate="2016-01-15T09:58:22.700" Score="3" Body="&lt;p&gt;I guess the answer is easy: Clasful networking is not quite dead (Yes I know, I'm always writing the opposite). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When assigning an IP address many operating systems / tools (Windows, Linux ifconfig) suggest the default mask according to the class of network. As 192.168.x.y is Class-C 255.255.255.0 is suggested. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if I do something like this on a Linux system:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ifconfig eth1 10.0.0.1 &#xA;# ifconfig eth1:1 172.16.1.1 &#xA;# ifconfig eth1:2 192.168.99.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ifconfig | grep &quot;inet addr&quot;&#xA;inet addr:10.0.0.1  Bcast:10.255.255.255  Mask:255.0.0.0&#xA;inet addr:172.16.1.1  Bcast:172.16.255.255  Mask:255.255.0.0&#xA;inet addr:192.168.99.1  Bcast:192.168.99.255  Mask:255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As many system behave this way using the default will less likely break things which limits the support costs for the vendors. Also: People are used to this and would complain that the device is to complicated.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2016-01-15T09:58:22.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25966" PostTypeId="1" AcceptedAnswerId="25968" CreationDate="2016-01-15T11:54:23.323" Score="1" ViewCount="251" Body="&lt;p&gt;Last weeks I was performing some ARP spoof tests on my own network and I realized that if I tried spoofing my MAC address in the Ethernet Header. (for one packet only, I connected with a different MAC) that my messages didn't arrive on the destination anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I was doing this on a WPA2 wireless connection, I had the impression that every connection on WPA2 gets mapped to a MAC address and that all other source MAC addresses are blocked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this true? And if it is not, what else could it be that makes my packet not arrive? (I also monitored at the target end, and with my real MAC it received the package, with with a spoofed MAC it didn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be nice if someone had some references too!&lt;/p&gt;&#xA;" OwnerUserId="22051" LastActivityDate="2016-01-15T12:20:22.110" Title="Wifi/WPA2 - Are spoofed MAC's rejected?" Tags="|ethernet|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25967" PostTypeId="1" AcceptedAnswerId="25972" CreationDate="2016-01-15T12:03:33.957" Score="7" ViewCount="2263" Body="&lt;p&gt;Lately I have been doing some research on the Address Resolution Protocol, and even though I know the idea behind it I still have some questions.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Q1: Are there more types of ARP messages that I am missing aside the following?:&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ARP Request&lt;/li&gt;&#xA;&lt;li&gt;ARP Reply&lt;/li&gt;&#xA;&lt;li&gt;Gratuitous ARP Request (ARP.Protocol_Source = ARP.Protocol_Target)&lt;/li&gt;&#xA;&lt;li&gt;Gratuitous ARP Reply (Reply without a Request)&lt;/li&gt;&#xA;&lt;li&gt;ARP Probe (ARP.Protocol_Source = 0.0.0.0) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;Q2: Does ARP actually care about the Ethernet Header?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;For as far as I know ARP doesn't really care about the Ethernet Header at all. It doesn't matter if you Unicast or Broadcast the Ethernet Header because ARP will still respond, and I wouldn't be surprised if the Ethernet.Source can be different from ARP.Hardware_Source too.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Q3: Which packets fill the ARP cache?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I always thought that ARP Requests and ARP Gratuitous Requests filled the ARP cache with , are there more packets that do this (Gratuitous ARP Replies?), and is it implementation dependent in some cases?&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Q4: When are Gratuitous Replies and when Gratuitous Requests used?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If any official documentation could be quoted that would be extra helpful!&lt;/p&gt;&#xA;" OwnerUserId="22051" LastActivityDate="2021-10-14T13:19:19.273" Title="ARP Questions (Packet Types, Ethernet, Cache, Gratuitous)" Tags="|ethernet|arp|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25968" PostTypeId="2" ParentId="25966" CreationDate="2016-01-15T12:20:22.110" Score="1" Body="&lt;p&gt;Remember 802.11 is not Ethernet, so the same rules don't apply.&lt;br&gt;&#xA;If you spoof your source address, the AP considers you an unknown client-- one that hasn't associated with the AP yet, so it ignores you. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-15T12:20:22.110" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="25969" PostTypeId="2" ParentId="25964" CreationDate="2016-01-15T13:42:37.720" Score="2" Body="&lt;p&gt;The way that  the routing engine are implemented can vary from one device to other. What you neeed to know is that exist a mechanism where software and hardware work to do that. Eg: some Cisco equiment bring some cards that are on charge to do the routing stuff, providing great performance, because separate the routing process(great performance impact) from the normal process. On the other way, if the routing is taken on software, your can see the performance impact on your device.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-01-15T13:42:37.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25971" PostTypeId="1" CreationDate="2016-01-15T14:49:45.003" Score="0" ViewCount="897" Body="&lt;p&gt;I know this is a question with maybe too many possible answers, therefore i'm trying to reduce the number of path to explore. From what i've read so far, packet loss can be caused by &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;hardware performance (routers, switch,..) &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;link congestion&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;faulty cabling &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;software bugs.&lt;br/&gt;&lt;br/&gt;My situation is : i have 2 machines (MAC Os X and Windows 10) that undergo packet loss while &lt;strong&gt;others don't&lt;/strong&gt;. I mean machines from the same building, on the same floor don't suffer from that issue.&lt;br/&gt; When i ping the router from those two, lots of packet are lost (about 60 percent). I don't think it's a software bug, link congestion or a hardware issue, otherwise other machines would suffer packet loss, wouldn't they? My guess is, it might come from the cabling. Waiting for the one specialized in wiring (in order to find how the cables are connected to the router), i'm asking you guys if someone can propose other leads? Any other causes?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17044" LastEditorUserId="17044" LastEditDate="2016-01-19T13:37:55.587" LastActivityDate="2016-01-19T13:37:55.587" Title="troubleshooting packet loss" Tags="|router|packet-loss|" AnswerCount="1" CommentCount="6" ClosedDate="2016-01-15T23:02:15.960" ContentLicense="CC BY-SA 3.0" />
  <row Id="25972" PostTypeId="2" ParentId="25967" CreationDate="2016-01-15T15:05:39.320" Score="3" Body="&lt;p&gt;When in doubt, go to the source, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 826, An Ethernet Address Resolution Protocol&lt;/a&gt;&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;There are two type of ARP messages: REQUEST and REPLY.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The RFC specifies the ethernet header. An ARP request involves determining the ethernet address of the destination, so it uses the broadcast address since it doesn't know the unicast address. An ARP reply will know the ethernet address, so it will be a unicast.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Ethernet transmission layer (not necessarily accessible to the user):  &#xA;    48.bit: Ethernet address of destination  &#xA;    48.bit: Ethernet address of sender  &#xA;    16.bit: Protocol type = ether_type$ADDRESS_RESOLUTION&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;It then causes this packet to be broadcast to all stations on the&#xA;Ethernet cable originally determined by the routing mechanism.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The way the ARP cache works is OS-dependent, and there is nothing&#xA;requiring a host to maintain an ARP cache.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The use of gratuitous ARP is not officially documented, but some&#xA;hosts and OSes use it to do things like resolve address conflicts;&#xA;Wireshark has a pretty good explanation (with examples): &lt;a href=&quot;https://wiki.wireshark.org/Gratuitous_ARP&quot; rel=&quot;nofollow noreferrer&quot;&gt;Gratuitous ARP&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Gratuitous ARP&lt;/strong&gt; could mean both gratuitous ARP request or gratuitous&#xA;ARP reply. Gratuitous in this case means a request/reply that is not&#xA;normally needed according to the ARP specification (RFC 826) but could&#xA;be used in some cases. A gratuitous ARP request is an&#xA;AddressResolutionProtocol request packet where the source and&#xA;destination IP are both set to the IP of the machine issuing the&#xA;packet and the destination MAC is the broadcast address&#xA;ff:ff:ff:ff:ff:ff. Ordinarily, no reply packet will occur. A&#xA;gratuitous ARP reply is a reply to which no request has been made.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-01-15T15:26:42.940" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="25973" PostTypeId="1" CreationDate="2016-01-15T15:15:38.183" Score="2" ViewCount="3774" Body="&lt;p&gt;We have a Juniper QFX with a 10Gb port facing a 3rd party, configured as a standard trunk. Here's an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xe-0/0/1 {&#xA;    description xxxx;&#xA;    unit 0 {&#xA;        family ethernet-switching {&#xA;            interface-mode trunk;&#xA;            vlan {&#xA;                members [ vlan1 vlan2 ];&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the case above vlan1 and vlan2 are locally defined standard VLANs. The problem I have is that we use a vlan tag structure internally, and the 3rd party is not able to match it, so I'd like to rewrite their tag on ingress/egress so we can keep our internal structure. I figured this would be straightforward, but I haven't been able to make it work. I tried adding:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            vlan-rewrite {&#xA;                translate 2430 103;&#xA;            }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it seems to have no effect. Any thoughts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: VLAN config as requested:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vlans default vlan-id 1&#xA;set vlans default l3-interface irb.0&#xA;set vlans vlan1 vlan-id 103&#xA;set vlans vlan2 vlan-id 104&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22055" LastEditorUserId="22055" LastEditDate="2016-01-15T16:05:48.243" LastActivityDate="2016-07-19T13:42:43.703" Title="VLAN Tag Rewriting on Juniper QFX" Tags="|vlan|juniper|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="25975" PostTypeId="2" ParentId="25964" CreationDate="2016-01-15T17:16:56.200" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm new to the networking field. I know the functionality of a routing&#xA;  engine but I wanted to know how it is implemented mainly? Is it a&#xA;  piece of hardware or software which does the work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Usually the control plane (routing) runs only in software and the data plane (forwarding) can be implemented either in software (as in a software router) or in hardware (as in many high-performance commercial routers).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On googling I could see Juniper implementing the same in hardware&#xA;  (which also forwards the packets) where as some other links have&#xA;  referred to it as a software which builds the route lookup tables.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Forwarding tables are always built by routing processes running purely in software. The actual forwarding table itself might be a database &lt;em&gt;stored&lt;/em&gt; in specialized hardware -- but always built by software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The forwarding of actual packets (which depends on the forwarding tables built by the routing plane) can be executed either by specialized hardware, or by purely by software, or by a combination of software plus help from specialized hardware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/25658/routing-understanding-the-default-route-vs-prefix-length-administrative-dista/25660#25660&quot;&gt;routing: understanding the default route vs. prefix length, administrative distance and metrics&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-01-15T17:16:56.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25976" PostTypeId="2" ParentId="25971" CreationDate="2016-01-15T19:05:28.647" Score="1" Body="&lt;p&gt;The first thing you want to verify is that the speed/duplex settings on those systems match the switch configuration. You can also rule out any network/cable issues my taking a laptop and connecting it to the cable where one of those bad systems terminate. If the packet loss goes away it has something to do with the system not responding to ICMP packets. You can verify this by doing a file transfer to the system to determine if it reflects any problem. With 60% packet loss if it is a hard network problem that system will be not be usable from the standpoint of any other application traffic. &lt;/p&gt;&#xA;" OwnerUserId="22065" LastActivityDate="2016-01-15T19:05:28.647" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25978" PostTypeId="1" AcceptedAnswerId="32244" CreationDate="2016-01-15T20:24:53.710" Score="5" ViewCount="2154" Body="&lt;p&gt;Does anyone have a simple way to convert IPv6 addresses to dotted decimal notation? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently using a pretty ugly python script which:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Converts the IPv6 address to exploded form &lt;/li&gt;&#xA;&lt;li&gt;Splits every 2 hex characters and converts those to decimal&lt;/li&gt;&#xA;&lt;li&gt;Joins decimal numbers together with &quot;.&quot; and returns the string &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The use case for this is for SNMP lookups which as far as I know require dotted decimal notation. Is anyone aware of a simple/pretty solution to this problem?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Input:&#xA; 2607:f8b0:400a:801::200e&#xA;Output:&#xA; 38.7.248.176.64.10.8.1.0.0.0.0.0.0.32.14&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10323" LastEditorUserId="10323" LastEditDate="2016-01-15T20:42:47.743" LastActivityDate="2016-06-15T19:43:12.930" Title="Converting IPv6 to Dotted Decimal Notation" Tags="|ipv6|snmp|" AnswerCount="2" CommentCount="1" ClosedDate="2019-03-09T03:26:20.280" ContentLicense="CC BY-SA 3.0" />
  <row Id="25980" PostTypeId="2" ParentId="20701" CreationDate="2016-01-15T20:51:41.597" Score="2" Body="&lt;p&gt;Sayeed the best approach would be to configure NAT statements that map the public addresses on the outside to the inside addresses on your network.  It's not recommended to have host machines configured with public IP addresses.  This would be considered a static NAT.  I don't have nor have I ever used a Cisco 2900 series router so I can't contribute the exact code to do it.  You should be able to google your model and get the configuration guide and I can almost guarantee a section will cover performing static NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would then configure access lists that specify what addresses on the internet can reach the device and could granularly restrict that to just specific ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devices you configure with the static NAT would always show the same public IP address when seen from the internet.&lt;/p&gt;&#xA;" OwnerUserId="22068" LastActivityDate="2016-01-15T20:51:41.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25982" PostTypeId="2" ParentId="25963" CreationDate="2016-01-15T21:18:29.903" Score="1" Body="&lt;p&gt;Since you're learning routes through BGP you need to learn how it picks the preferred path.  With BGP it picks based on the number of AS it has to pass through.  Since that network is learned from both and has the same hop count both are viable routes and equal.  As shown in your routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to modify another metric in order to change the path selection.  There are a number of options.  I'll leave it to you to decide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out &lt;a href=&quot;http://packetlife.net/media/library/1/BGP.pdf&quot; rel=&quot;nofollow&quot;&gt;http://packetlife.net/media/library/1/BGP.pdf&lt;/a&gt; for a cheatsheet that contains path selection information.&lt;/p&gt;&#xA;" OwnerUserId="22068" LastActivityDate="2016-01-15T21:18:29.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25983" PostTypeId="2" ParentId="25939" CreationDate="2016-01-16T04:16:41.097" Score="7" Body="&lt;p&gt;You were closer than you think to getting it working. In fact the problem may have simply been that flow control wasn't enabled on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ethtool source code (rev 3.18) and a register interface for a part I'm familiar with, reveal an explanation for the behavior you observed. The 802.3x standard defines flow-control, but I haven't looked there in a while.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flow Control (MAC Pause) is enabled during Auto-Negotiation with 2 bits in one of the exchanged pages. It has effect only if duplex is enabled. It's also handled at the MAC layer and can be handled in hardware. So, it's possible your driver doesn't get involved at all except for setting the register bits used for Auto-Negotiation. I haven't seen a driver that actively handles MAC layer Pause frames, but then I've only worked with a few.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You started with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ethtool -A eth0 tx on rx on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, you need to make sure auto-negotiation is enabled and restart it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ethtool -A eth0 autoneg on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ethtool -r eth0&lt;/p&gt;&#xA;" OwnerUserId="21971" LastActivityDate="2016-01-16T04:16:41.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25986" PostTypeId="1" CreationDate="2016-01-16T14:02:48.277" Score="1" ViewCount="489" Body="&lt;p&gt;I have some issues regarding my site-to-site vpn konfiguration between two ASA firewalls.. &#xA;I have two firewalls FW1 and FW2 where FW1 = 192.168.1.0 and FW2 = 192.168.2.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used the following template for FW1, and obviously switched the configuration around for FW2. - This worked perfectly! Phase 1 and Phase 2 came up, and i was able to ping each end.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      object network REMOTE_NETWORK&#xA;    subnet 192.168.2.0 255.255.255.0&#xA;  object network LOCAL_NETWORK&#xA;    subnet 192.168.1.0 255.255.255.0&#xA;  access-list CRYPTOMAP_ACL line 1 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 &#xA;  group-policy GroupPolicy_REMOTE_IP internal&#xA;  group-policy GroupPolicy_REMOTE_IP attributes&#xA;    vpn-tunnel-protocol ikev1&#xA;  exit&#xA;  tunnel-group REMOTE_IP type ipsec-l2l&#xA;  tunnel-group REMOTE_IP general-attributes&#xA;  tunnel-group REMOTE_IP ipsec-attributes&#xA;    ikev1 pre-shared-key **********&#xA;&#xA;  crypto ikev1 policy 5&#xA;    group 5&#xA;    encryption aes-256&#xA;&#xA;  crypto ikev1 enable  outside&#xA;  crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac&#xA;&#xA;  crypto map CRYPTOMAP_NAME 1 match address CRYPTOMAP_ACL&#xA;  crypto map CRYPTOMAP_NAME 1 set  peer  REMOTE_PEER_IP&#xA;  crypto map CRYPTOMAP_NAME 1 set  ikev1 transform-set  ESP-AES-256-SHA&#xA;  crypto map CRYPTOMAP_NAME interface  outside&#xA;  nat (inside,outside) 1 source static LOCAL_NETWORK LOCAL_NETWORK destination static REMOTE_NETWORK REMOTE_NETWORK no-proxy-arp route-lookup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I then thought.. What if i have multiple subnets on my LAN that i need to be put through the tunnel.. What if i had three subnets for example.. So i made two network objects called LOCAL_SUBNETS and REMOTE_SUBNETS and put the following in each of them&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0/24&#xA;192.168.10.0/24&#xA;192.168.100.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.2.0/24&#xA;192.168.20.0/24&#xA;192.168.200.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changed my crypto ACL to permit ip traffic from the local object group and remote object group, and changed my nat exemption rule to match on the objects rather than the old ip-addresses.. For some reason i cannot get this to work anymore.. Phase 1 is up but i can't ping the other end no matter what i try..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the configuration on the same part as previously.. FW2 obviously has the same configuration but with ACL and NAT switched around&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    object-group network LOCAL_SUBNETS&#xA;network-object 192.168.1.0 255.255.255.0&#xA;network-object 192.168.10.0 255.255.255.0&#xA;network-object 192.168.100.0 255.255.255.0&#xA;&#xA;object-group network REMOTE_SUBNETS&#xA;network-object 192.168.2.0 255.255.255.0&#xA;network-object 192.168.20.0 255.255.255.0&#xA;network-object 192.168.200.0 255.255.255.0&#xA;access-list CRYPTOMAP_ACL extended permit ip object-group LOCAL_SUBNETS object-group REMOTE_SUBNETS &#xA;  group-policy GroupPolicy_REMOTE_IP internal&#xA;  group-policy GroupPolicy_REMOTE_IP attributes&#xA;    vpn-tunnel-protocol ikev1&#xA;  exit&#xA;  tunnel-group REMOTE_IP type ipsec-l2l&#xA;  tunnel-group REMOTE_IP general-attributes&#xA;  tunnel-group REMOTE_IP ipsec-attributes&#xA;    ikev1 pre-shared-key **********&#xA;&#xA;  crypto ikev1 policy 5&#xA;    group 5&#xA;    encryption aes-256&#xA;&#xA;  crypto ikev1 enable  outside&#xA;  crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac&#xA;&#xA;  crypto map CRYPTOMAP_NAME 1 match address CRYPTOMAP_ACL&#xA;  crypto map CRYPTOMAP_NAME 1 set  peer  REMOTE_PEER_IP&#xA;  crypto map CRYPTOMAP_NAME 1 set  ikev1 transform-set  ESP-AES-256-SHA&#xA;  crypto map CRYPTOMAP_NAME interface  outside&#xA;  nat (inside,outside) source static LOCAL_SUBNETS LOCAL_SUBNETS destination static REMOTE_SUBNETS REMOTE_SUBNETS no-proxy-arp route-lookup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone see whats wrong with my configuration?&lt;/p&gt;&#xA;" OwnerUserId="19366" LastActivityDate="2016-01-16T14:02:48.277" Title="ASA Site-to-Site VPN Configuration" Tags="|cisco-asa|vpn|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25991" PostTypeId="1" AcceptedAnswerId="25992" CreationDate="2016-01-16T18:52:53.287" Score="8" ViewCount="7339" Body="&lt;p&gt;Why do I get &lt;code&gt;% Warning: use /31 mask on non point-to-point interface cautiously&lt;/code&gt; when I use a &lt;code&gt;/31&lt;/code&gt; subnet mask over Ethernet, and why am I not able to ping from R1 to R2 when both the interfaces have accepted the &lt;code&gt;/31&lt;/code&gt; subnet mask and they both are directly connected, and in which conditions can I use &lt;code&gt;/31&lt;/code&gt; without any trouble?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show running-config interface fastEthernet 0/0&#xA;Building configuration...&#xA;&#xA;Current configuration : 107 bytes&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 216.21.5.1 255.255.255.254&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;end&#xA;&#xA;R2#show running-config interface fastEthernet 0/0&#xA;Building configuration...&#xA;&#xA;Current configuration : 107 bytes&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 216.21.5.2 255.255.255.254&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jnpdB.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jnpdB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17520" LastEditorUserId="8499" LastEditDate="2018-12-20T04:13:25.327" LastActivityDate="2018-12-20T04:13:25.327" Title="Why do I get &quot;% Warning: use /31 mask on non point-to-point interface cautiously&quot; when I use a /31 subnet mask?" Tags="|routing|ip|ipv4|subnet|interface|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="25992" PostTypeId="2" ParentId="25991" CreationDate="2016-01-16T18:57:29.517" Score="12" Body="&lt;p&gt;Your problem is that you are addressing in two separate networks: &lt;code&gt;216.21.5.0/31&lt;/code&gt; and &lt;code&gt;216.21.5.2/31&lt;/code&gt;. The addresses you are using are in the same &lt;code&gt;/30&lt;/code&gt; network, but two separate &lt;code&gt;/31&lt;/code&gt; networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to set one address as &lt;code&gt;216.21.5.0&lt;/code&gt; and the other address as &lt;code&gt;216.21.5.1&lt;/code&gt;, or set one address as &lt;code&gt;216.21.5.2&lt;/code&gt; and the other address as &lt;code&gt;216.21.5.3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The warning is because ethernet is a broadcast technology which can have multiple endpoints, but a &lt;code&gt;/31&lt;/code&gt; network can only use two endpoints. If you were configuring it on a true point-to-point medium, I don't think you would get the warning.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-16T19:14:29.243" LastActivityDate="2016-01-16T19:14:29.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25993" PostTypeId="1" CreationDate="2016-01-16T20:02:11.357" Score="4" ViewCount="711" Body="&lt;p&gt;Today I was pinging random websites, and I decided to ping a website, from which I was downloading at the speed of 2mb/s, and the ping(latency) was 10 ms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, if the answer from the server comes for around 10ms, how are these 2mb/s calculated? Any hints, links to explanations or similar are highly appreciated :)&lt;/p&gt;&#xA;" OwnerUserId="16006" LastEditorUserId="20444" LastEditDate="2016-01-20T14:40:32.520" LastActivityDate="2016-01-20T18:53:09.243" Title="Network latency and network bandwidth correlation" Tags="|bandwidth|latency|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25994" PostTypeId="2" ParentId="25993" CreationDate="2016-01-16T20:33:35.367" Score="1" Body="&lt;p&gt;Your ping time latency is how long it takes to get from one end to the other, and it has nothing to do with bandwidth which is how many bits are transferred per second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of latency as the distance between two cities. It takes a fixed amount of time to drive between the two cities. Bandwidth is like how many people you can fit in each vehicle traveling between the cities; a bus has more bandwidth than a two-seater car. It takes the bus and the car the same amount of time (latency) to get from one city to the other, but the bus delivers more people (bandwidth) in that same amount of time.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-16T20:33:35.367" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="25995" PostTypeId="1" AcceptedAnswerId="25996" CreationDate="2016-01-16T22:03:52.587" Score="2" ViewCount="6495" Body="&lt;p&gt;I just want to understand some concepts related to the firewall. Is there any difference between saying &lt;strong&gt;firewall policies&lt;/strong&gt; and &lt;strong&gt;firewall rules&lt;/strong&gt;? Can we say a firewall includes a set of policies each of which defines a set of special rules?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="21963" LastEditorUserId="509" LastEditDate="2016-01-16T22:14:05.593" LastActivityDate="2016-01-16T22:26:23.193" Title="Firewall Policies vs Firewall Rules" Tags="|firewall|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25996" PostTypeId="2" ParentId="25995" CreationDate="2016-01-16T22:20:47.957" Score="5" Body="&lt;p&gt;Though there are (as far as I know) no strict definitions, you say that &lt;em&gt;policies&lt;/em&gt; are the abstract, high level definitions of what traffic should and shouldn't be allowed. Firewall &lt;em&gt;rules&lt;/em&gt; are the translation of policies into practical configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: the policy &lt;em&gt;&quot;allow only management traffic from trusted networks&quot;&lt;/em&gt; is translated into rules which allow traffic from &lt;code&gt;192.2.0.0/24&lt;/code&gt; to &lt;code&gt;TCP/22&lt;/code&gt; and from &lt;code&gt;192.2.100.0/24&lt;/code&gt; to &lt;code&gt;TCP/3389&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-01-16T22:20:47.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25997" PostTypeId="2" ParentId="25995" CreationDate="2016-01-16T22:21:07.480" Score="1" Body="&lt;p&gt;Personally, I would agree with your definitions, but, unfortunately, different vendors have different definitions since there is no standard. I have seen firewall documentation which basically equates policy with rule, and I guess that does make sense for firewalls which can only have one policy by your definition.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-16T22:26:23.193" LastActivityDate="2016-01-16T22:26:23.193" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="25998" PostTypeId="2" ParentId="25978" CreationDate="2016-01-16T22:42:07.807" Score="4" Body="&lt;p&gt;Take a look at &lt;a href=&quot;https://pypi.python.org/pypi/IPy/&quot; rel=&quot;nofollow&quot;&gt;https://pypi.python.org/pypi/IPy/&lt;/a&gt;. It allows you to automatically parse the (many formats of the) IPv6 address and return various formats you can use to format.&lt;/p&gt;&#xA;" OwnerUserId="22093" LastActivityDate="2016-01-16T22:42:07.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="25999" PostTypeId="1" AcceptedAnswerId="26000" CreationDate="2016-01-17T01:22:14.183" Score="2" ViewCount="424" Body="&lt;p&gt;Below is a scenario. It is not a real life situation, but more a hypothetical so I can get clarification of a specific of networking behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say we have a single PC directly connected via ethernet to a router on the private side. Public side of the the router is connected the the internet via whatever means. Router has NAT enabled, and a single port forward rule.&#xA;Port forward rule is configured to send incoming traffic from public side to single PC on private side. (lets say to allow TCP pings)&#xA;PC on private side does not have a default gateway set.&#xA;Client on public side sends a TCP ping to public interface of above router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the public client get a response ?&#xA;Does the NAT modify the source IP in the incoming public packet to it's own IP before sending it to the private PC, so that the internal PC knows where to send the response ?&#xA;Or does standard NAT implementation not modify the source IP of the packet, and therefore the internal PC must use a default gateway ?&lt;/p&gt;&#xA;" OwnerUserId="22094" LastActivityDate="2016-01-17T01:31:05.647" Title="Behavior of IP packet when Default Gateway is not defined" Tags="|nat|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26000" PostTypeId="2" ParentId="25999" CreationDate="2016-01-17T01:31:05.647" Score="2" Body="&lt;p&gt;The situation you describe will not modify the source address from the outside to the inside; it only translates the inside address, in either direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With no gateway configured on the host, the host will not reply to the ping since it will know the destination will be off the network, and it cannot resolve the layer-3 address to the layer-2 address and has no gateway from which it can use the layer-2 address to create a layer-2 frame.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-17T01:31:05.647" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26001" PostTypeId="1" CreationDate="2016-01-17T05:56:55.280" Score="3" ViewCount="800" Body="&lt;p&gt;I was wondering what would happen if you send an ICMP request with the correct mac address but the wrong ip on a local network. Would the request reach the computer with the correct mac address since the switch only cares about the mac address?&lt;/p&gt;&#xA;" OwnerUserId="22095" LastEditorUserId="8499" LastEditDate="2018-03-19T19:10:26.073" LastActivityDate="2018-03-19T19:10:26.073" Title="ICMP packet with correct mac address but wrong ip address" Tags="|ip|mac-address|ip-address|icmp|mac|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26004" PostTypeId="2" ParentId="26001" CreationDate="2016-01-17T11:47:16.603" Score="7" Body="&lt;p&gt;It is as you said. The computer with that MAC address will receive the ethernet frame, since on layer 2 it's all good. Then, looking at layer 3, it will discard the IP packet, since the IP address is incorrect.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-01-17T11:47:16.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26008" PostTypeId="1" CreationDate="2016-01-17T20:00:48.277" Score="2" ViewCount="339" Body="&lt;p&gt;We currently have a Samsung router given to us by Covad. It is configured like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;              PPPoFR T1 WAN (samsung router)&#xA;              x.x.x.49/29(public address)&#xA;             gateway&#xA;                 |&#xA;                 |&#xA;__________________________________________________________________&#xA;|                                                              |&#xA;|                                                              |&#xA;ethernet port(samsung router)              ethernet port(samsung router)&#xA;|                                                              |&#xA;|                                                              |&#xA;separate firewall/NAT                                separate firewall/NAT&#xA;x.x.x.50/29(public address)                       x.x.x.51/29(public address)&#xA;|                                                              |&#xA;server LAN                                             VOIP LAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the Samsung router is routing the T1 WAN to the two firewalls, each firewall has its own public address in the same network as the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I desperately need to replicate this with a Cisco 1841 so I can get QOS going for the VOIP side. I have looked at IRB, but that mentions VLANs which seemed confusing when all of the hosts that will connect to the router have public IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how do I configure fe0/0 and fe0/1 to let their connected hosts with public IPs (x.x.x.50 and x.x.x.51) get to serial0/0/0(T1 WAN x.x.x.49)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="22103" LastEditorUserId="8499" LastEditDate="2018-02-09T02:49:22.287" LastActivityDate="2018-02-09T02:49:22.287" Title="Cisco 1841, Bridge T1 WAN to hosts with public IPs?" Tags="|cisco|routing|cisco-ios|bridge|irb|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26009" PostTypeId="2" ParentId="26008" CreationDate="2016-01-17T23:02:49.667" Score="2" Body="&lt;p&gt;In the Samsung (ibg1000???), the two ethernet ports form a switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface ethernet 0/0&#xA;  no keepalive&#xA;    switchport&#xA;    bridge-group 1&#xA;    switchport mode access&#xA;  qos&#xA;    exit qos&#xA;  no flowcontrol&#xA;  exit ethernet&#xA;interface ethernet 0/1&#xA;  no keepalive&#xA;    switchport&#xA;    bridge-group 1&#xA;    switchport mode access&#xA;  qos&#xA;    exit qos&#xA;  no flowcontrol&#xA;  exit ethernet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the 1841, the two ethernet ports are independent routed interfaces. You can simulate a switch by bridging the two ethernet ports, but I would not recommend it. Buy an external switch.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-17T23:02:49.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26010" PostTypeId="1" AcceptedAnswerId="26011" CreationDate="2016-01-18T00:41:21.880" Score="2" ViewCount="198" Body="&lt;p&gt;I am in the process of debugging an Ethernet communication issue. Basically using Wireshark to monitor the source data the stream was intermittent when the cable was removed and subsequently reconnected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm expecting the manufacturer to say their hardware doesn't stop transmission in these circumstances. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It occurred to me that due to the state of the system under test its possible that large amounts of the &gt;1400 payload could be 0x00. Could this cause problems to the receiving hardware making the transmission appear intermittent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the time all I was looking at was that the header information and first few bytes of known fixed data were correct. &lt;/p&gt;&#xA;" OwnerUserId="22106" LastEditorUserId="8499" LastEditDate="2019-01-03T01:48:38.073" LastActivityDate="2019-08-02T02:01:31.927" Title="Could long sequences of consecutive zeros cause Ethernet link problems?" Tags="|ethernet|layer1|udp|transport-protocol|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26011" PostTypeId="2" ParentId="26010" CreationDate="2016-01-18T01:19:21.097" Score="4" Body="&lt;p&gt;No, a large number of zero bits in your test data will not cause problems on ethernet. You don't specify which ethernet variant you are using, but the different encoding schemes used on the ethernet variants deal with the consecutive zero problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do a search for &quot;&lt;em&gt;ethernet encoding schemes&lt;/em&gt;&quot; to learn more about the specific encoding scheme used in your ethernet variant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recommend you hire an experienced cable installer with the proper test equipment to test your cabling. You should always start at layer-1 when troubleshooting, especially with intermittent problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One source of problems when you disconnect/reconnect a cable during a data stream is that the interface is disabled, then it must reinitialize, possibly needing to auto-negotiate, and needing to run ARP to discover the destination MAC address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-18T01:51:50.850" LastActivityDate="2016-01-18T01:51:50.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26012" PostTypeId="2" ParentId="26008" CreationDate="2016-01-18T05:17:23.340" Score="0" Body="&lt;p&gt;I think your best bet would be to put the Cisco router inside the firewall. You can mark the traffic on your switch(es), and queue it on the Cisco router interface to the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it is a good idea to separate the VoIP traffic from the regular data traffic, you can do that with VLANs or with separate interfaces into the Cisco router. It doesn't matter if the traffic merges before or after the firewall since the queuing will will happen as it leaves the router, and that can happen before the firewall, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your QoS policies will not be honored on the Internet, so all you can do is queuing on the exit interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-18T05:17:23.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26014" PostTypeId="1" CreationDate="2016-01-18T07:12:31.523" Score="3" ViewCount="295" Body="&lt;p&gt;I was trying to do tracert, and instead of getting ip addresses like I'm used to, all I see is this (below). Can anyone tell me what is going on? There are no spaces in the command, I just can't post links until I have 10 reputation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: the .net link on the 9th (last) hop takes me straight to Google&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2: our router is a Linksys EA6350 and our modem is a Motorola SURFboard SB6812&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\Raymosrunerx&amp;gt;tracert www.google.com&#xA;&#xA;Tracing route to www.google.com [2607:f8b0:4000:808::1013] over a maximum of 30 hops:&#xA;&#xA;  1    &amp;lt;1 ms    &amp;lt;1 ms    &amp;lt;1 ms  2600:8804:1900:e7:4af8:b3ff:fee8:6c70&#xA;&#xA;  2   140 ms   130 ms   126 ms  2600:8804:3f05:200::1&#xA;&#xA;  3   143 ms   117 ms    56 ms  2001:578:c00:4:6000::10&#xA;&#xA;  4   159 ms   130 ms   136 ms  2001:578:c00:4::22&#xA;&#xA;  5    94 ms   118 ms   130 ms  2001:578:1:0:172:17:248:182&#xA;&#xA;  6   158 ms   162 ms   168 ms  2001:4860:1:1:0:58f5:0:1a&#xA;&#xA;  7   154 ms   142 ms   154 ms  2001:4860::1:0:57f&#xA;&#xA;  8   137 ms   154 ms   145 ms  2001:4860:0:1::81&#xA;&#xA;  9   132 ms   146 ms   150 ms  http://dfw06s40-in-x13.1e100.net 2607:f8b0:4000:808::1013]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22109" LastEditorUserId="19543" LastEditDate="2016-01-18T14:40:13.087" LastActivityDate="2016-06-23T13:09:06.887" Title="Basic (probably) question on traceroute" Tags="|traceroute|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26016" PostTypeId="2" ParentId="26014" CreationDate="2016-01-18T07:51:52.730" Score="2" Body="&lt;p&gt;Those are &lt;a href=&quot;https://en.wikipedia.org/wiki/IPv6&quot; rel=&quot;nofollow&quot; title=&quot;Wiki&quot;&gt;IPv6&lt;/a&gt; addresses. On windows run ipconfig or linux ifconfig to see if you are on a IPv6 network =), though I thought you had to put a ipv6 flag in tracert to get it to run in that mode.&lt;/p&gt;&#xA;" OwnerUserId="16612" LastActivityDate="2016-01-18T07:51:52.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26017" PostTypeId="2" ParentId="7852" CreationDate="2016-01-18T09:33:51.400" Score="3" Body="&lt;p&gt;I have no experience blowing cables but the subject got me intereted so that's results of my googling:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;From 1994 book &quot;&lt;a href=&quot;https://books.google.ru/books?id=ollCd0FRmcoC&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fiber Optics Installations&lt;/a&gt;&quot; about CABLEJET machine:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;With one such an installntion unit it is possible, using an 8 bar&#xA;  compressor, to install ﬁbre-optic cables for the trunk-network&#xA;  (aluminum water barrier, 10 mm HDPE jacket) with lengths up to 1250&#xA;  meter and with speeds up to 1 meter per second&quot;  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;About blowing special cables to homes: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cable contains 32 single-fiber cables has an aluminium water barrier&#xA;  and diameter of 4 mm. These cables are blown up to 400 meters.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Specific distances may be outdated in this book but we can still draw a conclusion that &lt;strong&gt;blowing distance depends on fiber cable type&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cablejoints.co.uk/upload/Fibre_Optic_Cable_Blowing___Single_Length_Cable_Blowing.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Industrial suggestion&lt;/a&gt; from &quot;Thorne and Derrick UK&quot; - &lt;strong&gt;1 km to 3 km per blowing unit&lt;/strong&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/XMMtH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XMMtH.png&quot; alt=&quot;Three technics of blowing, each suggests 1 to 3 km distance&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Disclaimer: I'm not affiliated with mentioned company in any manner.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="21943" LastActivityDate="2016-01-18T09:33:51.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26018" PostTypeId="2" ParentId="26014" CreationDate="2016-01-18T09:41:58.883" Score="2" Body="&lt;p&gt;They are IP version 6 (IPv6) addresses. Your system and the internet connection are using IPv6 instead of the traditional IPv4 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 addresses use 128 bits represented as &lt;em&gt;eight&lt;/em&gt; groups of &lt;em&gt;four&lt;/em&gt; hexadecimal digits with the groups being separated by &lt;em&gt;colons&lt;/em&gt;. For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;2607:f8b0:4000:0808:0000:0000:0000:1013&lt;/em&gt; is a valid IPv6 adddress, however using methods to abbreviate it, then becomes &lt;em&gt;2607:f8b0:4000:808::1013&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2016-01-18T09:41:58.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26019" PostTypeId="1" AcceptedAnswerId="26021" CreationDate="2016-01-18T09:56:37.240" Score="2" ViewCount="12856" Body="&lt;p&gt;In Cisco IOS-XE if I want to see a specific VRF's bgp connections summary I would do:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show bgp vpnv4 unicast vrf &lt;em&gt;VRF_ID&lt;/em&gt; summary&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and the result would be as below example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;192.168.0.17    4         3549       0       0        1    0    0 42w6d    Active&#xA;192.168.214.2   4        65000  785893  785882 10816927    0    0 6w4d           89&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This works great if you have couple of VRFs but if you have tens of them this will be a tedious way to check all of them. Is there any way that I can list all bgp connections summary with VRFs IDs in it? I'm interested to have VRF's ID in the output with its connections to neighbors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks  &lt;/p&gt;&#xA;" OwnerUserId="539" LastEditorUserId="539" LastEditDate="2016-01-18T13:30:34.047" LastActivityDate="2020-05-15T05:52:43.010" Title="Show all VRFs link status summary" Tags="|cisco|cisco-ios|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26020" PostTypeId="2" ParentId="26019" CreationDate="2016-01-18T10:05:13.110" Score="0" Body="&lt;pre&gt;&lt;code&gt;show ip bgp ipv4 vrf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To display entries in the IP version 4 (IPv4) Border Gateway Protocol&#xA;  (BGP) routing table, use the show ip bgp ipv4 command in privileged&#xA;  EXEC mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip bgp ipv4 {mdt {all | rd | vrf} | multicast | tunnel | unicast}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp5.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp5.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a guess, try it and see.. I don't get to run commands at my job =/&lt;/p&gt;&#xA;" OwnerUserId="16612" LastActivityDate="2016-01-18T10:05:13.110" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26021" PostTypeId="2" ParentId="26019" CreationDate="2016-01-18T12:38:33.383" Score="2" Body="&lt;p&gt;The command 'show ip bgp all summary' will display BGP neighbor status for all address families:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip bgp all summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The command 'show bgp vpnv4 unicast all neighbors' will display BGP neighbor status for VPNv4 family, including VRF information.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show bgp vpnv4 unicast all neighbors&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However its output is quite verbose. Of course one can write an output parser for extracting the view you need from the output of 'show bgp vpnv4 unicast all neighbors'. For example, see &lt;a href=&quot;https://github.com/udhos/cisco-vrf-bgp-neigh&quot; rel=&quot;nofollow&quot;&gt;https://github.com/udhos/cisco-vrf-bgp-neigh&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\tmp\devel\cisco-vrf-bgp-neigh&amp;gt;go run src\main.go &amp;lt; output2.txt&#xA;2016/01/19 15:41:10 main: reading from stdin&#xA;2016/01/19 15:41:10 main: reading from stdin: done: 1755 lines&#xA;2016/01/19 15:41:10 main: found 16 neighbors&#xA;Neighbor        VRF            ASN    State       Uptime  Prefixes&#xA;1.1.1.1         --             11111  Idle        ?            0&#xA;1.1.1.1         --             11111  Established 27w3d      236&#xA;1.1.1.1         --             11111  Established 1y8w      4715&#xA;1.1.1.1         --             11111  Established 9w4d        94&#xA;1.1.1.1         --             11111  Established 42w5d        2&#xA;1.1.1.1         --             11111  Idle        ?            0&#xA;1.1.1.1         --             11111  Established 1y8w        10&#xA;1.1.1.1         --             11111  Established 26w2d     3450&#xA;1.1.1.1         --             11111  Established 42w5d       25&#xA;1.1.1.1         --             11111  Established 14w2d       78&#xA;1.1.1.1         --             11111  Established 44w0d      110&#xA;1.1.1.1         --             11111  Established 1y46w       61&#xA;1.1.1.1         --             11111  Established 2y38w       77&#xA;1.1.1.1         --             11111  Established 19w1d      416&#xA;1.1.1.1         --             11111  Established 1y46w      157&#xA;1.1.1.1         --             11111  Established 13w0d     3451&#xA;&#xA;C:\tmp\devel\cisco-vrf-bgp-neigh&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-01-19T17:58:30.437" LastActivityDate="2016-01-19T17:58:30.437" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26022" PostTypeId="2" ParentId="26014" CreationDate="2016-01-18T13:05:31.440" Score="2" Body="&lt;p&gt;Windows will always try to do something using IPv6 first if IPv6 is activated. What you saw in the output that you  posted is the real answer, nothing is wrong, only that your IPv6 address was used. On the way to see the &quot;normal&quot; output that everybody wants to see, I guess you have some choices:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Deactivate the IPv6 on your system, or&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On your command prompt, use the &quot;-4&quot; option instead (recommended if you need to work with IPv6 too): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\Raymosrunerx&amp;gt;tracert www.google.com -4&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here you can find some useful tips form tracert command.&#xA; &lt;a href=&quot;http://www.computerhope.com/tracert.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.computerhope.com/tracert.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorDisplayName="user10222" LastEditDate="2016-06-23T13:09:06.887" LastActivityDate="2016-06-23T13:09:06.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26025" PostTypeId="2" ParentId="25811" CreationDate="2016-01-18T14:52:36.060" Score="1" Body="&lt;p&gt;Sorry for answering rather old question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speaking about GNS-3: you can change the label of R1 or some other router if you stop the device (right-click the router, select stop), then right-click it and select configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Glad to hear you managed to add routes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R4(config)#ip route 11.0.0.0 255.255.255.0 21.0.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R5(config)# ip route 21.0.0.0 255.255.255.0 11.0.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think your problem is not solved in its entirety though - as long as R5 does not know how to reach network 10.0.0.0/24 (as a result R5 cannot ping 10.0.0.2 and vice-versa). The same goes for R4 and the network 10.0.0.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you should add a pair of routes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R4(config)#ip route 10.0.0.0 255.255.255.0 21.0.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R5(config)# ip route 10.0.0.0 255.255.255.0 11.0.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that all the IPs of your lab are pingable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, you could replace a pair of routes with one default route, the result would be the same. For R5 it would be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R5#(config)ip route 0.0.0.0 0.0.0.0 11.0.0.1&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-01-18T14:52:36.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26026" PostTypeId="2" ParentId="20868" CreationDate="2016-01-18T15:14:07.747" Score="-1" Body="&lt;p&gt;The solutions is available in &lt;a href=&quot;http://support.huawei.com/enterprise/docinforeader.action?contentId=DOC1000079693&amp;amp;partNo=10082#dc_cfg_vlan_0116&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; document, under the section:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;5.5.2  Example for Configuring Inter-Device MUX VLAN&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="17483" LastActivityDate="2016-01-18T15:14:07.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26027" PostTypeId="1" AcceptedAnswerId="26031" CreationDate="2016-01-18T15:20:19.950" Score="5" ViewCount="281" Body="&lt;p&gt;Please let me know where the gaps in my understanding are. There are many gaps, so please do not hesitate to fill them in or correct them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my knowledge, what happens on the hardware level when receiving a packet and triggering ARP, IP, or another process is the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A signal is sent to the the router and is detected by the a UART or DUART.&lt;/li&gt;&#xA;&lt;li&gt;The DUART sends an interrupt to the CPU so that it can change the bit stream into read-able bytes.&lt;/li&gt;&#xA;&lt;li&gt;The bytes that the UART has converted from the signal (in the form of a 11 bits: 1 start bit, 8 bits for data, and 2 stop bits) are then sent to the Serial Interface adapter driver.&lt;/li&gt;&#xA;&lt;li&gt;The device driver for the serial interface adapter is then triggered from the HD and brought into the RAM memory.&lt;/li&gt;&#xA;&lt;li&gt;The device driver makes &quot;virtualization&quot; of the serial interface. This virtualization of the serial interface adapter takes the bytes that were received and puts them in a &quot;frame&quot; format that will be able to be understood by a process like ARP. For instance, it might put it in an ethernet frame.&lt;/li&gt;&#xA;&lt;li&gt;The virtualizations of the serial inferface are in a buffer (queue). When the virtualization is at the front of the queue, the device driver calls the correct process (again ARP, IP, etc) depending on the &quot;protocol type&quot; of the packet.&lt;/li&gt;&#xA;&lt;li&gt;The CPU then calls that program into RAM from the HD and writes to the &quot;heap&quot; that the process was assigned so that it can make sense of the packet and do what it needs to with the packet.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Places I know are very fuzzy are the role of the Serial Interfaces Adapter's device driver and the role of the queue. Also, I know that all operations are being driven by the CPU, I just thought it would be a little redundant to repeat it in each step.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me now what is wrong with my understanding or any steps I am missing when describing what happens at the hardware level of a router when receiving a packet. &lt;/p&gt;&#xA;" OwnerUserId="3890" LastEditorUserId="3890" LastEditDate="2016-01-18T15:26:56.287" LastActivityDate="2016-01-18T16:42:34.527" Title="What happens at the hardware level of a router when a packet is received and eventually triggers a process like ARP?" Tags="|router|cisco-ios|arp|hardware|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26028" PostTypeId="2" ParentId="25991" CreationDate="2016-01-18T15:31:21.170" Score="0" Body="&lt;p&gt;Also, you could do &quot;no shutdown&quot; on relevant interfaces :)&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-01-18T15:31:21.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26031" PostTypeId="2" ParentId="26027" CreationDate="2016-01-18T16:15:01.173" Score="4" Body="&lt;p&gt;I'm not sure why you are stuck on ARP (Address Resolution Protocol). It is not used in receiving bits on the wire. It resolves a layer-3 address into a layer-2 address in order to build a layer-2 frame, but when receiving, you are stripping off the layer-2 frame. Some things, like serial interfaces, may not use ARP or frames the way ethernet does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The process inside a router, or other device, will vary greatly, depending on the vendor, model, and OS. For instance, many modern routers do much of what you describe in hardware using ASICs (Application Specific Integrated Circuits).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, read up on the OSI model and learn about the layers. It is theoretical, but it gives you an idea of how things work in independent layers. Understand how the independent layers work with each other, then concentrate on the specific mechanics inside each one.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Layer-1 is the bits on the wire and the hardware to encode/decode&#xA;them.&lt;/li&gt;&#xA;&lt;li&gt;Layer-2 is where frames and MAC addresses are.&lt;/li&gt;&#xA;&lt;li&gt;Layer-3 is where packets and IP addresses are.&lt;/li&gt;&#xA;&lt;li&gt;Layer-4 is where segments and ports (layer-4 addresses) are.&lt;/li&gt;&#xA;&lt;li&gt;Higher layers are off-topic here.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When an application wants to send data to an application in another host, it requests a connection (use of a particular port) with a layer-4 protocol, such as TCP or UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-4 protocol divides the data into datagrams called segments, and it applies the segment headers, including layer-4 source and destination addresses, such as TCP or UDP ports, to the segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-4 segments are sent to layer-3 where packet headers, including the layer-3 source and destination addresses, such as IP addresses, are applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-3 packets are sent to layer-2 where frame headers, including the layer-2 source and destination addresses, such as MAC addresses, are applied. In order to get the destination layer-2 address, layer-2 must resolve the layer-3 destination address into a layer-2 address. This is where ARP (Address Resolution Protocol) may come into play. Layer-2 first checks its ARP cache for the resolution. If it doesn't find it there, it will send an ARP request for the destination host to reply with its layer-2 address. If the layer-3 address is on a different layer-3 network, it will use the layer-2 address of the layer-3 gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 will then pass the frames on to the layer-1 hardware for serialization, and to put the resulting bits on the wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the receiving host (or gateway) gets the bits, it deserializes them, and de-encapsulates the frames, packets, and segments, passing the resulting data up to the receiving application. Note: ARP is only needed for sending, not receiving since all the addressing is already included in the received data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the receiver is a gateway (router), it will de-encapsulate the frames since they are only useful for the local LAN. The router will then inspect the layer-3 headers for the destination layer-3 addresses, and look in its routing table to see if it has next hops for the packets. If the router has no next hop for a packet, it will discard the packet, otherwise it will switch that packet to the next interface and repeat the process of encapsulating the packet into a frame for the new LAN to the next hop. The new frame will then be serialized into bits for the next link. Some routers only have hardware queues, and some have user-definable queues which may be sized according to the type of traffic. There may be priority queues which get served first. Packets may be randomly dropped in order to prevent queues from filling up, or they may just drop any packets when the queue is full.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Discussion beyond what I have described may be either device-specific, or too broad for this site.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-18T16:42:34.527" LastActivityDate="2016-01-18T16:42:34.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26032" PostTypeId="1" AcceptedAnswerId="26033" CreationDate="2016-01-18T17:28:22.387" Score="2" ViewCount="1626" Body="&lt;p&gt;I'm not sure this question needs much detail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two Linux hosts connected to a switch with 10 ports. One host has a 10 GbE NIC and the other host has a 1 GbE NIC. Obviously I can flood the 1 GbE card with udp packets. I enable symmetric flow control on the switch for both ports and &quot;as far as I know&quot; have enabled it on the host NICs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question now is, when 1 GbE cannot keep up he sends a pause frame to the switch. From what I see, a pause frame can only go Mac-to-Mac. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Therefore, the switch does not forward the pause frame to the host that is pounding the network with traffic. Is that statement true?&lt;/strong&gt;  &lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2016-01-18T17:50:34.500" Title="Can pause frames be forwarded through a layer 2 managed switch?" Tags="|ethernet|switching|layer2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26033" PostTypeId="2" ParentId="26032" CreationDate="2016-01-18T17:50:34.500" Score="1" Body="&lt;p&gt;A pause frame can be MAC-to-MAC which is host-to-host through a switch. It can also be sent to a special multicast address which a switch will not forward, but the switch itself may or may not participate in ethernet flow control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The use of ethernet flow control is implementation specific, and not widely or consistently supported. The way it works, or doesn't, on your network is going to be dependent on your network equipment and the software on those devices, and the specific hosts and OSes of the end devices.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-18T17:50:34.500" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="26035" PostTypeId="1" AcceptedAnswerId="26043" CreationDate="2016-01-18T20:32:54.747" Score="1" ViewCount="5429" Body="&lt;p&gt;Can someone explain why the first NAT config below gives me an &quot;asymmetric NAT rules&quot; (RPF) error for the connection to &quot;VPN1&quot; while the second (no &quot;any&quot; in the Manual NAT) makes the automatic NAT actually work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Automatic NAT (section 2) not working (&quot;asymmetric NAT&quot;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (Transit,Internet) source dynamic FW1 interface&#xA;!&#xA;object network FW1&#xA; host 172.1.2.3&#xA;object network VPN1&#xA; nat (Main,Internet) static interface service udp 1194 1195 &#xA;!&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This seems to work ok: (explicit destination set for manual NAT in section 1)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (Transit,Internet) source dynamic FW1 interface destination static DM_INLINE_NETWORK_51 DM_INLINE_NETWORK_51&#xA;!&#xA;object network FW1&#xA; host 172.1.2.3&#xA;object network VPN1&#xA; nat (Main,Internet) static interface service udp 1194 1195 &#xA;!&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why does this make a difference for the NAT of VPN1? I don't get it. There are different (source) interfaces involved, different source addresses obviously, so why would one prevent the other from working?&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="2329" LastEditDate="2016-01-20T07:36:30.753" LastActivityDate="2016-01-20T07:36:30.753" Title="Cisco ASA 9.1: Asymmetric NAT rules matched for forward and reverse flows (rpf)" Tags="|cisco-asa|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26036" PostTypeId="1" CreationDate="2016-01-18T21:21:56.043" Score="1" ViewCount="601" Body="&lt;p&gt;I'm trying to setup a site to site vpn but am seeing the following error in the logs.  My device is a PIX 515e.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%PIX-3-713042: IKE Initiator unable to find policy: Intf inside, Src: 10.1.1.4, Dst: 172.17.105.153&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Config is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 1.1.1.204 255.255.255.248 &#xA;!&#xA;interface Ethernet1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.1.1.1 255.255.255.0 &#xA;!&#xA;ftp mode passive&#xA;access-list 115 extended permit ip host 10.1.1.4 host 172.17.105.153 &#xA;access-list 115 extended deny ip 10.1.1.0 255.255.255.0 any&#xA;access-list outbound extended permit ip any any &#xA;access-list 120 extended permit ip host 10.1.1.4 host 172.17.105.153 &#xA;pager lines 24&#xA;logging enable&#xA;logging buffer-size 500000&#xA;logging console debugging&#xA;logging buffered debugging&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 1.1.1.205&#xA;nat (inside) 0 access-list 120&#xA;access-group OUTSIDE in interface outside&#xA;access-group outbound in interface inside&#xA;route outside 0.0.0.0 0.0.0.0 1.1.1.203 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec transform-set ESP-AES128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec security-association lifetime seconds 3600&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto dynamic-map DYNMAP100 10 match address 115&#xA;crypto dynamic-map DYNMAP100 10 set peer y.y.y.2 &#xA;crypto dynamic-map DYNMAP100 10 set transform-set ESP-AES128-SHA&#xA;crypto dynamic-map DYNMAP100 10 set security-association lifetime seconds 3600&#xA;crypto map outside 60000 ipsec-isakmp dynamic DYNMAP100&#xA;crypto map outside interface outside&#xA;crypto isakmp identity address &#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 100&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh timeout 60&#xA;ssh version 2&#xA;console timeout 0&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;tunnel-group DefaultRAGroup ipsec-attributes&#xA; pre-shared-key *&#xA;tunnel-group y.y.y.2 type ipsec-l2l&#xA;tunnel-group y.y.y.2 ipsec-attributes&#xA; pre-shared-key *&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect http &#xA;  inspect ipsec-pass-thru &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;Cryptochecksum:e65d9e3f55afd168aa7cbb7016015071&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I try to ping the remote ip ending in .153, I get a response timed out, the tunnel never comes up and I get the error shown above in the config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="864" LastActivityDate="2016-01-18T21:21:56.043" Title="IKE Initiator unable to find policy: Intf inside" Tags="|cisco|pix|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26037" PostTypeId="1" AcceptedAnswerId="26040" CreationDate="2016-01-18T22:10:00.267" Score="1" ViewCount="88" Body="&lt;p&gt;I suspect this is a very basic question, so apologies in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say a hypothetical network is multihomed, with 2 ISPs (A &amp;amp; B). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you blackhole a /32 host over ISP B, will the user accessing the network from ISP B be able to connect via ISP A? That is, will their routes reconverge once the blackhole is setup?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ask because we've got two ISPs, one with inline DDoS mitigation and one without. We would like to be able to nullroute DDoS traffic over the unprotected ISP so it is forced over the protected ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I'm referring to creating upstream blackholes with BGP communities that our ISPs support. &lt;/p&gt;&#xA;" OwnerUserId="22122" LastEditorUserId="22122" LastEditDate="2016-01-18T22:22:37.900" LastActivityDate="2016-01-19T01:03:31.533" Title="Do routes reconverge during a blackhole if multihomed?" Tags="|routing|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26038" PostTypeId="2" ParentId="26037" CreationDate="2016-01-18T22:18:48.320" Score="1" Body="&lt;p&gt;You have no control over how traffic is routed on the Internet. You can blackhole traffic you receive, but that is your routing decision on your network. You can't change your ISP's routing policies. If you are peering with an ISP via BGP, you can try to influence the ISPs routing with things like MED or AS_PATH prepending, but your ISP is free to ignore you attempts to influence how it routes. I doubt your company would allow your routing policies to be dictated by an outside company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are peering via BGP with the unprotected ISP, you can try using AS_PATH prepending to see if you can make the path through that ISP undesirable. It may or may not work.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-18T22:18:48.320" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26039" PostTypeId="2" ParentId="26037" CreationDate="2016-01-18T22:19:16.820" Score="1" Body="&lt;p&gt;I think, you need to plan withh caution the thing.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Create your blackholing process with your ISP B, eg, communities or something else. With that, your ISP B will continue announcing your routes to the world, and once detect traffic to your /32 attacked network, that traffic will be blackholed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I think you have some mechanins to announcing your routes to your ISP(i´m supposing your are using BGP). Once your network is under attack, easily you can do some routing policy, to change yoour ISP-A routing. The prepending is a good choice, you select the network prefix, and put it a bigger as-path through ISP-A. With that, world will know the existence of your attacked netwrok across 2 ISP, but BGO will decide to use the &quot;shortest&quot; AS-PATH, ISP-B, where your networrk under attack will be protected and that traffic will be route to a null route.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2016-01-18T22:25:21.230" LastActivityDate="2016-01-18T22:25:21.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26040" PostTypeId="2" ParentId="26037" CreationDate="2016-01-19T01:03:31.533" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If you blackhole a /32 host over ISP B, will the user accessing the&#xA;  network from ISP B be able to connect via ISP A? That is, will their&#xA;  routes reconverge once the blackhole is setup?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Do you mean a customer of ISP B?  If so, then no.  If they (ISP B) are black-holing a specific /32 then this prefix will be more specific than any of your other prefixes received (from you or ISP A) and will draw traffic towards it from within ISP B.  Blackholing a /32 will generally not propagate beyond an AS, so upstreams of ISP B will still receive your aggregate prefixes.  Secondly, ISP B will most likely have a higher Local Preference set on your routes (since you are a customer) than anything they receive from other ISPs, so their customers will always use your link to them, regardless of any AS Path pre-pending you configure.  This is purely an economic routing policy.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I ask because we've got two ISPs, one with inline DDoS mitigation and&#xA;  one without. We would like to be able to nullroute DDoS traffic over&#xA;  the unprotected ISP so it is forced over the protected ISP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The best you will be able to do to guarantee no lost customers is withdraw the entire prefix containing the /32 from ISP B (the one without DDoS protection) so that all traffic is forced to you via ISP A (which will presumably scrub the traffic for you).  If you simply null-route the traffic at ISP B, it will still attract the traffic from it's upstreams (and directly attached clients), but then just drop it at it's edge thanks to the null route.  AS Prepending will not override any Local Preference configured within ISP B.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-01-19T01:03:31.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26041" PostTypeId="1" AcceptedAnswerId="27932" CreationDate="2016-01-19T01:51:27.833" Score="1" ViewCount="1488" Body="&lt;p&gt;I want to put a firewall hardware product (brand called Tofino) between an RTU and PLC to block some Modbus (just Modbus, not Modbus TCP) functional codes (e.g. write coil, read coil) for device testing. This firewall product is able to do deep packet inspection on the Modbus protocol. The RTU and PLC are actually industrial legacy devices, which have been used for 15-20 years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This firewall hardware has two ethernet (RJ45) ports, IN and OUT. But the Modbus uses serial buses (should be RS485) between the RTU and PLC. Hence, to solve this issue, can I use two ethernet - RS485 converters to connect firewall hardware between the RTU and PLC? Is there any possible issue?&lt;/p&gt;&#xA;" OwnerUserId="22125" LastEditorUserId="8499" LastEditDate="2016-03-20T05:29:26.923" LastActivityDate="2017-04-26T23:39:30.103" Title="Put firewall hardware with ethernet ports between serial ports" Tags="|ethernet|firewall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26042" PostTypeId="2" ParentId="26041" CreationDate="2016-01-19T02:02:31.940" Score="1" Body="&lt;p&gt;This depends on a lot of factors. Deep packet inspection is for upper-layer protocols. Does the device do upper-layer protocols, any network protocols which a firewall may be used to block, or are are you just looking to block some codes that the serial connected device may send on what it expects as a serial connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be trying to use a torque wrench to drive a nail.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-19T02:02:31.940" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26043" PostTypeId="2" ParentId="26035" CreationDate="2016-01-19T03:19:20.807" Score="2" Body="&lt;p&gt;The difference between your two Manual NAT statements is one of them also looks for a match on the &lt;em&gt;destination&lt;/em&gt; (or &lt;em&gt;source&lt;/em&gt; on return or outside-originated traffic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you convert your NAT statements to 'layman' explanation, it will make more sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (Transit,Internet) source dynamic FW1 interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the ASA finds traffic on the &lt;code&gt;Transit&lt;/code&gt; interface that matches a source of &lt;code&gt;FW1&lt;/code&gt;, send it to the &lt;code&gt;Internet&lt;/code&gt; interface and change the &lt;em&gt;source&lt;/em&gt; &lt;code&gt;dynamically&lt;/code&gt; to the &lt;code&gt;interface&lt;/code&gt; IP of the &lt;code&gt;Internet&lt;/code&gt; interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (Transit,Internet) source dynamic FW1 interface destination static DM_INLINE_NETWORK_51 DM_INLINE_NETWORK_51&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the ASA finds traffic on the &lt;code&gt;Transit&lt;/code&gt; interface that matches a source of &lt;code&gt;FW1&lt;/code&gt; &lt;strong&gt;and a destination of &lt;code&gt;DM_INLINE_NETWORK_51&lt;/code&gt;&lt;/strong&gt;, send it to the &lt;code&gt;Internet&lt;/code&gt; interface and change the &lt;em&gt;source&lt;/em&gt; &lt;code&gt;dynamically&lt;/code&gt; to the &lt;code&gt;interface&lt;/code&gt; IP of the &lt;code&gt;Internet&lt;/code&gt; interface &lt;strong&gt;and change the &lt;em&gt;destination&lt;/em&gt; &lt;code&gt;statically&lt;/code&gt; to &lt;code&gt;DM_INLINE_NETWORK_51&lt;/code&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference is crucial:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second NAT statement only matches when &lt;code&gt;FW1&lt;/code&gt; is speaking to &lt;code&gt;DM_INLINE_NETWORK_51&lt;/code&gt;. The first NAT statement matches &lt;em&gt;any time &lt;code&gt;FW1&lt;/code&gt; is speaking.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, all your &lt;strong&gt;inbound&lt;/strong&gt; traffic (ie: crossing interfaces &lt;code&gt;Internet&lt;/code&gt; to &lt;code&gt;Transit&lt;/code&gt;) will have &lt;em&gt;return traffic&lt;/em&gt; that matches your first NAT statement. Hence, the NAT is asymmetric -- the configuration treats the traffic coming inbound differently than it does on its way out (in so far as NAT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember, this is a Dynamic NAT (also known as a PAT), which by definition can only be unidirectional. Traffic will flow from inside to outside (or &lt;code&gt;Transit&lt;/code&gt; to &lt;code&gt;Internet&lt;/code&gt;) but not the other way around.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-01-19T03:19:20.807" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="26045" PostTypeId="1" CreationDate="2016-01-19T06:40:05.450" Score="1" ViewCount="75" Body="&lt;p&gt;If a http request is sent in internet where the request will go and what will happen to the request after finding the IP address.&#xA;For example what are all the work done by egress and ingress ,DCHP.&#xA;Is there any place where i can learning every step about a web request.&lt;/p&gt;&#xA;" OwnerUserId="22131" LastEditorUserId="8499" LastEditDate="2018-02-16T03:59:01.687" LastActivityDate="2018-02-16T03:59:01.687" Title="what happens when a http request is sent into network" Tags="|internet|network-core|" AnswerCount="0" CommentCount="5" ClosedDate="2016-01-19T09:19:32.493" ContentLicense="CC BY-SA 3.0" />
  <row Id="26046" PostTypeId="2" ParentId="23525" CreationDate="2016-01-19T07:10:04.610" Score="3" Body="&lt;p&gt;If you had several IP addresses assigned to the same NIC without using VLANs, you would most likely end up in the situation requiring what MS DHCP calls superscopes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See here : &lt;a href=&quot;https://technet.microsoft.com/fr-fr/library/dd183662(v=ws.10).aspx&quot; rel=&quot;nofollow&quot;&gt;https://technet.microsoft.com/fr-fr/library/dd183662(v=ws.10).aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This allows you to group several DHCP scopes into one super-scope, and the server will then check to see if there is a match within any of those scopes, and not just the one associated with whatever IP it thinks is the primary NIC IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in your situation, assuming I understood it correctly, if you did not setup superscopes, you would not be getting an IP. Removing the second NIC IP then gets you out of that situation and back into traditional DHCP behaviour.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-19T07:10:04.610" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26047" PostTypeId="1" AcceptedAnswerId="26061" CreationDate="2016-01-19T07:59:56.483" Score="1" ViewCount="661" Body="&lt;p&gt;What is the difference between IEEE 802.11ah (HaLow) and IEEE 802.16 (WiMax).&#xA;They both run using low frequencies. Is the only difference the methods for modulation (?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="1689" LastActivityDate="2016-02-18T18:06:20.873" Title="Difference between IEEE 802.11ah and IEEE 802.16" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26049" PostTypeId="2" ParentId="25733" CreationDate="2016-01-19T09:41:49.673" Score="0" Body="&lt;p&gt;I think the separation of the interface from internal network creates an additional line of defense, which could be quite useful in case the firewall gets hacked. I mean, in addition to switching/routing, your Core switch could have some ACL-s that protect your internal resources and possibly regulate the access to the 172.16.x.x network. In fact, this separate network is a kind of DMZ.&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-01-19T09:41:49.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26050" PostTypeId="1" CreationDate="2016-01-19T10:39:42.233" Score="2" ViewCount="79" Body="&lt;p&gt;I'm having some problems with our networks and I'm wondering if anyone has some ideas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have recently moved to a cloud server (we went with UKFast) to host our network - it's main use is for the staff to remote in to the server to use select older software.&#xA;We also want to use the server to control a domain of users across all of our 8 sites (stores). We have been mildly successful in this - we have managed to set up VPN's on all the sites and attach to our domain. Some have stayed but some drop out because the public ip (wan ip) changes. This of course changes the settings for the VPN.&#xA;If we change the settings on the server side again it works fine, but again only for a while.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering if anyone would know what the best solution would be - I have briefly read around stuff like DynDns but I am unsure what would work best.&lt;/p&gt;&#xA;" OwnerUserId="22134" LastActivityDate="2016-01-19T12:32:22.487" Title="Site-to-Site VPNs" Tags="|vpn|troubleshooting|route-server|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26051" PostTypeId="2" ParentId="26050" CreationDate="2016-01-19T12:32:22.487" Score="1" Body="&lt;p&gt;It is often possible to setup VPNs with dynamic IPs, so long as the central hub has a fixed IP. This usually involves setting things up so that the VPN Concentrator uses some other criteria in the ISAKMP config to differentiate between incoming VPN establishment requests, like an FQDN for example. This does not require the use of DynDNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I personally prefer this approach as it does not introduce an outside dependency on a third-party service like DynDNS.&#xA;See one example for a Cisco approach here : &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/46242-lan-to-lan-vpn-client.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/46242-lan-to-lan-vpn-client.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But many other brands also support similar configs.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-19T12:32:22.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26058" PostTypeId="1" AcceptedAnswerId="26069" CreationDate="2016-01-19T15:18:35.343" Score="3" ViewCount="158" Body="&lt;p&gt;I know about cumulative and selective acknowledgements TCP protocol offers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know any other protocols (apart from TCP), that support cumulative acknowledgements?&lt;/p&gt;&#xA;" OwnerUserId="22144" LastActivityDate="2016-01-21T16:54:09.927" Title="What protocols apart from TCP support cumulative acknowledgements?" Tags="|tcp|osi|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26060" PostTypeId="2" ParentId="26058" CreationDate="2016-01-19T15:46:32.967" Score="2" Body="&lt;p&gt;One such protocol is OSPF, which uses a &lt;a href=&quot;http://www.tcpipguide.com/free/t_OSPFMessageFormats-3.htm&quot; rel=&quot;nofollow&quot;&gt;Database Description Sequence Number&lt;/a&gt; to keep track of database updates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure there are others.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-19T15:46:32.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26061" PostTypeId="2" ParentId="26047" CreationDate="2016-01-19T16:05:49.420" Score="3" Body="&lt;p&gt;The short answer: 802.16 is a series of standards for mid-range metro wireless networks, mainly for backhaul or device-to-device communication. 802.11ah instead, is a standard for low-power, low frequencie ap-to-enddevice communication in home automation or intra device communication for industrial machines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The long answer can be found by reading the standard(s) and/or the wikipedia articles for it ;)&lt;/p&gt;&#xA;" OwnerUserId="2112" LastActivityDate="2016-01-19T16:05:49.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26063" PostTypeId="1" CreationDate="2016-01-19T16:57:57.930" Score="3" ViewCount="4737" Body="&lt;p&gt;I want to know the appropriate cable type between:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Layer-2 and Layer-3 switch&lt;/li&gt;&#xA;&lt;li&gt;Layer-3 switch and router &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is it cross-over or straight through?&lt;/p&gt;&#xA;" OwnerUserId="22148" LastEditorUserId="8499" LastEditDate="2018-03-21T00:00:33.060" LastActivityDate="2019-05-06T12:58:20.487" Title="Cabling standard for Layer-3 switch" Tags="|switch|cisco-catalyst|layer1|cable|layer3|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26064" PostTypeId="2" ParentId="26063" CreationDate="2016-01-19T17:12:55.797" Score="5" Body="&lt;p&gt;I don't know what hardware you're specifically talking about here, but modern switches and routers support auto-MDIX which essentially eliminates the need for crossover cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you used a Cisco Catalyst tag, I'll link to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/int_hw_components/configuration_guide/b_int_152ex_2960-x_cg/b_int_152ex_2960-x_cg_chapter_011.html&quot; rel=&quot;noreferrer&quot;&gt;this Cisco page.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-01-19T17:12:55.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26066" PostTypeId="1" CreationDate="2016-01-19T18:27:37.310" Score="1" ViewCount="7995" Body="&lt;p&gt;I'm new to networking and I'm a little confused so could do with some help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently using Cisco packet tracer and I am trying to configure a fictitious network. Initially I was just trying to get my network to function as intended, which I managed to do (except for getting both networks to be able to ping the same server) however now I am trying to edit what I have done to enter the details of the specifications I have been given and now I'm stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is as follows;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Web server and DNS server with an IP address of 200.200.1.254 for internet access. The internal LAN network is the Class C IP address: 192.168.255.0 behind the firewall router provisioned with two Ethernet ports for the internal subnetted networks and one for the Web and DNS servers. I also need to think about security so the network also requires one sub-network for Admin and another for the Students.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Initially I configured one of my router port 1 to an address of 192.168.1.1 with a subnet of 255.255.255.0 to serve network 1 (lets call it the admin side).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next I configured my second router port to an address of 192.168.2.1 with a subnet of 255.255.255.0 (which will serve my DNS server)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then my third port with an address of 192.168.3.1 with a subnet mask of 255.255.255.0 and the forth with 192.168.4.1 with a subnet mask of 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Off my first port on the router as mentioned earlier I have my admin network and I have given one of the hosts an IP address of 192.168.1.2 with a subnet of 255.255.255.0 and a default gateway of 192.168.1.1 and DNS server of 192.168.2.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Off my second port on the router I have my DNS server. IP address- 192.168.2.2 subnet 255.255.255.0 default gateway -192.168.2.1 and of course the DNS server of itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Off the third port on my router I have my Web server with a IP address of 192.168.3.2 and subnet of 255.255.255.0 and default gateway of 192.168.3.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly I have my fourth port on my router serving the classroom side of the network with a 192.168.4.1 and subnet of 255.255.255.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now when I change my DNS server and Web server to the IP address to 200.200.1.254 it throws out the whole network, I have of course updated the dns server address and applied the new 192.168.255.2 IP on the host computer etc but when I try to ping the server it fails. I'm not sure if its because the gateways IPs I have originally used are not meant to deal with this new IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other question I have is that as mentioned above, I need to split the network, I have researched how to do this and I understand that I need to use a different subnet mask e.g 255.255.255.128 but when I do this, it affects my DNS server since they have a subnet of 255.255.255.0 so how can I get my DNS and web servers to serve both sides of the network? I can stop both sides (admin side and classroom side) from accessing each other fine but I cant figure out how to allow both networks access to the same DNS and Web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have done lots of research to try and avoid asking for help hence how I initially got my network to work but since my question is so long I won't list everywhere. But I have looked for answers here and YouTube etc for clarity but after two days of looking and dealing with all these numbers as a beginner, I'm not having much luck! Any help or guidance would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="22152" LastActivityDate="2017-01-23T06:04:12.823" Title="How to configure a DNS &amp; web server and allowing them to serve two different subnets" Tags="|cisco|ip|dns|packet-tracer|" AnswerCount="1" CommentCount="2" ClosedDate="2017-01-23T14:21:25.673" ContentLicense="CC BY-SA 3.0" />
  <row Id="26067" PostTypeId="2" ParentId="26063" CreationDate="2016-01-19T18:38:07.230" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I want to know the appropriate cable type between:&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Layer-2 and Layer-3 switch&lt;/li&gt;&#xA;  &lt;li&gt;Layer-3 switch and router&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;Is it cross-over or straight through?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You need to make the distinction between MDI ports and MDI-X ports.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Standard cable connects MDI to MDI-X.&lt;/li&gt;&#xA;&lt;li&gt;Crossover cable connects either MDI to MDI or MDI-X to MDI-X.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Traditionally both Layer-2 and Layer-3 switches use MDI-X ports, while routers and servers use MDI ports. But one ought to check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See detailed explanation below, from: &lt;a href=&quot;https://en.wikipedia.org/wiki/Medium-dependent_interface&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Medium-dependent_interface&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;With 10BASE-T and 100BASE-TX separate twisted pairs are used for the two directions of communication. Since twisted pair cables are conventionally wired pin to pin there are two different pinouts used for the medium dependent interface. These are referred to as MDI and MDI-X (medium dependent interface crossover). &lt;strong&gt;When connecting an MDI port to an MDI-X port a straight through cable is used while to connect two MDI ports or two MDI-X ports a crossover cable must be used.&lt;/strong&gt; Conventionally MDI is used on end devices while MDI-X is used on hubs and switches. Some network hubs or switches have an MDI port (often switchable) to connect to other hubs or switches without a crossover cable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also, modern network ports often support &lt;a href=&quot;https://en.wikipedia.org/wiki/Medium-dependent_interface&quot; rel=&quot;nofollow noreferrer&quot;&gt;Auto MDI-X&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Auto MDI-X automatically detects the required cable connection type and configures the connection appropriately, removing the need for crossover cables to interconnect switches or connecting PCs peer-to-peer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="498" LastEditorUserId="31801" LastEditDate="2019-05-06T12:58:20.487" LastActivityDate="2019-05-06T12:58:20.487" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="26068" PostTypeId="2" ParentId="26063" CreationDate="2016-01-19T19:07:10.127" Score="4" Body="&lt;p&gt;To elaborate on the other answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modern switches support &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring#auto_mdix&quot; rel=&quot;nofollow&quot;&gt;Auto MDI-X&lt;/a&gt;, which allows the switch ports to automatically determine whether they should work as MDI or MDI-X ports, and therefore precludes the user from having to determine whether they should use a Straight Through or Crossover cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But because of &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#how_auto_mdix&quot; rel=&quot;nofollow&quot;&gt;how Auto MDI-X works&lt;/a&gt;, &lt;strike&gt;it must be enabled/supported on both interfaces on either side of the cable&lt;/strike&gt; it only needs to be supported on one side of the link. &lt;BR /&gt;&#xA;&lt;sub&gt;&lt;em&gt;Thanks @Everton for the correction&lt;/em&gt;&lt;/sub&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To check if an interface supports Auto MDI-X, use these commands:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;show interfaces transceiver properties&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;show controllers ethernet-controller &amp;lt;interface&amp;gt; phy&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In either output, look for these lines (respectfully):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;Auto-MDIX : On [AdminState=1 Flags=0x00012345]&lt;/code&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;Operational Auto-MDIX: on&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To summarize:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;strong&gt;BOTH&lt;/strong&gt; interfaces support Auto-MDIX, then it doesn't matter what cable you choose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;strong&gt;only ONE&lt;/strong&gt; interface supports Auto-MDIX, then it doesn't matter what cable you choose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the rare case that &lt;strong&gt;NEITHER&lt;/strong&gt; interface supports Auto-MDIX, consider the L3 switchport as a regular L2 Switch port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your situation matches the very rare case that neither interface suports Auto-MDIX, you'll want to use the following cables:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 and Layer-3 switch -- Use a Crossover&lt;BR /&gt;&#xA;Layer-3 switch and router -- User a Straight-Through&lt;BR /&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2016-01-19T22:08:39.747" LastActivityDate="2016-01-19T22:08:39.747" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26069" PostTypeId="2" ParentId="26058" CreationDate="2016-01-19T19:15:56.253" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1350&quot; rel=&quot;nofollow noreferrer&quot;&gt;Trivial File Transfer Protocol&lt;/a&gt; (&lt;strong&gt;TFTP&lt;/strong&gt;) running over UDP/69 also includes a built-in Acknowledgement system which is cumulative over the course of a file transfer.&lt;/p&gt;&#xA;&lt;p&gt;Adding one:&lt;/p&gt;&#xA;&lt;p&gt;IPsec includes a Sequence Number in the ESP/AH header. That can also be considered a cumulative acknowledgement. Although not in the strict sense that TCP or TFTP use it.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-01-21T16:54:09.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26072" PostTypeId="1" AcceptedAnswerId="26092" CreationDate="2016-01-19T20:17:04.427" Score="1" ViewCount="478" Body="&lt;p&gt;So, here's the problem:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An access point is alternately sending L-sized packets to 2 stations,&#xA;  A and B.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The access point is transmitting to A at 10 MBits /s and to B at 2&#xA;  MBit/s.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;What's the average rate the access point is transmitting at?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The answer is not 10 + 2 / 2 = 6, but instead it's 3.33 Mbit/s. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How?&lt;/p&gt;&#xA;" OwnerUserId="22156" LastActivityDate="2016-01-20T12:06:45.570" Title="Average transmission rate on IEEE 802.11 wireless network" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26073" PostTypeId="1" AcceptedAnswerId="26074" CreationDate="2016-01-19T22:06:39.793" Score="2" ViewCount="76" Body="&lt;p&gt;When a computer X is about to send a set of frames over the network to computer Y, should the NIC card of the computer X notify the other computers' NIC cards on the same communication link before start transmitting these frames? If yes, can you explain how this process is performed? If X starts to transmit without any notification, does it mean that frames that are already on the link will get corrupted? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="21963" LastActivityDate="2016-01-19T23:04:26.017" Title="What NIC card should do before transmission" Tags="|cisco|ethernet|network-core|osi|packet-loss|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26074" PostTypeId="2" ParentId="26073" CreationDate="2016-01-19T22:10:43.510" Score="2" Body="&lt;p&gt;No notification is sent before sending frames.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-19T22:10:43.510" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26075" PostTypeId="1" AcceptedAnswerId="27970" CreationDate="2016-01-19T22:54:05.537" Score="3" ViewCount="3052" Body="&lt;p&gt;I am trying to buy an Access Point which supports Passive Power over Ethernet, 802.3af.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand the difference between the Passive Power over Ethernet and 802.3af. If the Access point supports 802.3af, do I need a switch which supports PoE features, or will any switch provide the Access Point with the power supply over ethernet.&lt;/p&gt;&#xA;" OwnerUserId="22159" LastEditorUserId="8499" LastEditDate="2019-01-03T02:02:55.317" LastActivityDate="2019-01-03T02:02:55.317" Title="Passive Power over Ethernet 802.3af Supported" Tags="|layer1|access-point|power-over-ethernet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26076" PostTypeId="2" ParentId="26075" CreationDate="2016-01-19T23:02:51.777" Score="1" Body="&lt;p&gt;If you want to power your WAP with PoE, you need the device to which the WAP connects to support PoE on the port where the WAP connects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to be careful about which PoE version your WAP needs since many 802.11ac WAPs need 802.3at (PoE+).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Power_over_Ethernet#Passive&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt; will provide you with the Passive definition, and has a nice chart to go with it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Passive&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Most passive applications use the pinout of 802.3af mode B - with DC&#xA;  plus on pins 4 and 5 and DC minus on 7 and 8 (see chart below). Data&#xA;  is then on 1-2 and 3-6. This limits operation to 100Mbit/s. Gigabit&#xA;  passive injectors use a transformer on the data pins to allow power&#xA;  and data to share the cable and is typically compatible with 802.3af&#xA;  Mode A. In the common &quot;passive&quot; PoE system, the injector does not&#xA;  communicate with the powered device to negotiate its wattage&#xA;  requirements, but merely supplies power at all times. Passive midspan&#xA;  injectors up to 12 ports simplify installations. Devices needing 5&#xA;  Volts cannot typically use PoE at 5 V on Ethernet cable beyond short&#xA;  distances (about 15 feet (4.6 m)) as the voltage drop of the cable&#xA;  becomes too significant, so a 24 V or 48 V to 5 V DC-DC converter is&#xA;  required at the remote end.[35] Passive DC-to-DC injectors also exist&#xA;  which convert a 9 V to 36 V DC input power source to a stabilized 24 V&#xA;  1 A or 48 V 0.5 A PoE feed with '+' on pins 4 &amp;amp; 5 and '−' on pins 7 &amp;amp;&#xA;  8. These DC-to-DC PoE injectors are used in various telecom applications.[36]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-19T23:53:48.097" LastActivityDate="2016-01-19T23:53:48.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26077" PostTypeId="2" ParentId="26073" CreationDate="2016-01-19T23:04:26.017" Score="0" Body="&lt;p&gt;On a switched full duplex ethernet network the card will under normal conditions just send the frames. There cannot be any collisions because of the full duplex point to point nature of the links. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On an old fassioned CSMA/CD ethernet collision domain the sender can only send if it detects the medium is free. There is still some chance of a collision because two devices could try and transmit at the same time (or at least close enough to the same time that it has to be treated as such). In that cases the devices will back-off for a random time and then try again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a switch receives multiple packets destined for a given outgoing port then it will queue them in internal buffers. If the packets keep coming in too fast then the switches buffers will fill, at this point depending on what extensions are supported the switch may send a notification (known as a &quot;pause frame&quot;) back to the previous device in the chain or it may just start dropping packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the time congestion avoidence algorithms in higher level protocols like TCP will back off the transmit rate avoiding too much packet loss even in cases where there is no effective way of notifying devices earier in the chain of full buffers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other physical layers may have different rules.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-01-19T23:04:26.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26078" PostTypeId="1" AcceptedAnswerId="26079" CreationDate="2016-01-19T23:49:00.043" Score="2" ViewCount="89" Body="&lt;p&gt;Flow control support is limited unless all equipment can use it. If a 10 GbE host and 1 GbE host are connected to a switch, the one host can overwhelm the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming flow control is not supported. In general, how does the switch control sending too fast or does it not do anything to control it? Is it left to the protocol layer, such as TCP having its own flow control algorithms as compared to UDP having no flow control?&lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2016-01-19T23:59:14.507" Title="How does a switch handle sending Ethernet traffic to a slower link?" Tags="|switch|ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26079" PostTypeId="2" ParentId="26078" CreationDate="2016-01-19T23:59:14.507" Score="1" Body="&lt;p&gt;Some switches will have some (but not a lot of) buffers for this situation. Basically, the switch will just drop frames which it cannot send from a high-speed to a low-speed link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's why you normally use lower speed ports for access ports, and the faster ports for uplink ports. Cisco recommends, at most, a 20:1 access to uplink bandwidth ratio (add up the bandwidth of all the access ports and compare it to the uplink speed); for every 20 Gb of access ports, you need at least 1 Gb in the uplink.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-19T23:59:14.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26081" PostTypeId="2" ParentId="25973" CreationDate="2016-01-20T02:51:59.087" Score="2" Body="&lt;p&gt;I'm not sure whether that is supported or not (I suspect it does) on the QFX series--the features exists in MX series and the EX9200's and was added for QFX in 13.2+.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per TechLibrary article &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos15.1/topics/task/configuration/vlan-translation-vlan-id-list-l2.html&quot; rel=&quot;nofollow&quot;&gt;Configuring VLAN Translation with a VLAN ID List&lt;/a&gt;, I would see if you have the &lt;code&gt;vlan-id-list&lt;/code&gt; or &lt;code&gt;inner-vlan-id-list&lt;/code&gt; command available, and subsititute your &lt;code&gt;vlan { members [ vlan1 vlan2 ]&lt;/code&gt; with &lt;code&gt;vlan-id-list [ vlan1 vlan2 ]&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The translation works by using the &lt;code&gt;vlan-rewrite { translate &amp;lt;external&amp;gt; &amp;lt;internal&amp;gt; }&lt;/code&gt; as you have it.&lt;/p&gt;&#xA;" OwnerUserId="13537" LastActivityDate="2016-01-20T02:51:59.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26083" PostTypeId="1" AcceptedAnswerId="26088" CreationDate="2016-01-20T05:22:29.973" Score="1" ViewCount="244" Body="&lt;p&gt;Is it just me that think there has to be something wrong with these questions/answers? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Why is this the best answer? How does the correct answer achieve the objective? The ACL says:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Deny any TCP traffic with IP addresses belonging to the 192.168.1.0 0.0.0.255 (match first 24 bits, left to right) with source port 80 to a single IP address 10.1.1.101&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then allow all other traffic that doesn't match above&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I do that ^^^ outbound of serial 0/0/0 (sample config), it does make more sense to analyze the traffic before you send it out / before it could reach the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changing the config to &quot;ip access-group 170 i&quot; won't prevent packets from 172.16.0.0/16 and 192.168.1.0/24 from reaching Branch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it was me, I would write&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;deny ip 172.16.0.0 0.0.255.255 10.1.1.0 0.0.0.255&#xA;deny ip 192.168.1.0 0.0.0.255 10.1.1.0 0.0.0.255&#xA;permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/L7ekX.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L7ekX.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) This question uses the same configs but has a different objective. How does this config/example achieve the desired objective? The port should have been on the destination address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/e1W3M.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e1W3M.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all for you time.&lt;/p&gt;&#xA;" OwnerUserId="5144" LastEditorUserId="5144" LastEditDate="2016-01-20T18:07:41.817" LastActivityDate="2016-01-20T18:07:41.817" Title="Please explain the reasoning behind these ACL question/answers?" Tags="|cisco|acl|" AnswerCount="1" CommentCount="1" ClosedDate="2016-01-20T15:32:58.163" ContentLicense="CC BY-SA 3.0" />
  <row Id="26084" PostTypeId="1" AcceptedAnswerId="26103" CreationDate="2016-01-20T05:30:04.217" Score="1" ViewCount="583" Body="&lt;p&gt;I'm configuring an Cisco 867VAE and I'm stumped how to list the current (and I assume) dynamic entries in the object group &quot;local_lan_subnets&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The factory settings for the router come with an ACL called &quot;nat-list&quot;. The first ACL entry is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10 permit ip object-group local_lan_subnets any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to make sure this entry is not permitting something it shouldn't. If I take the entry away - all dhcp connected devices lose connection to the outside interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to run this following command I've seen on a few other posts:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh running-config object-group id local_lan_subnets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it's giving me this error:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Invalid input detected at '^' marker&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm quite new to IOS and not sure if this is an ASA command - but I can't work out how to list what is in that object-group. I'm sure it shouldn't be that difficult.&lt;/p&gt;&#xA;" OwnerUserId="22167" LastActivityDate="2016-01-20T15:57:15.443" Title="List current object-group local_lan_subnets on Cisco IOS 15.5" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26085" PostTypeId="1" CreationDate="2016-01-20T05:58:00.017" Score="1" ViewCount="24" Body="&lt;p&gt;Is this possible? I can imagine that the endless looping would be problematic in some sense. What (if any) precautions are taken against this? Would it consume significant banwidt&lt;/p&gt;&#xA;" OwnerUserId="22168" LastActivityDate="2016-01-20T06:57:05.833" Title="What would happen if domain A redirected to domain B, which redirected to domain A?" Tags="|internet|" AnswerCount="1" CommentCount="2" ClosedDate="2016-01-20T15:33:26.030" ContentLicense="CC BY-SA 3.0" />
  <row Id="26086" PostTypeId="2" ParentId="26085" CreationDate="2016-01-20T06:57:05.833" Score="1" Body="&lt;p&gt;If you mean an HTTP redirect, browsers detect this and give up after so many redirects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are referring to a packet level, this is called &quot;ping-pong&quot;, and it's the reason TTL (time-to-live) exists in almost all routed protocols.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-20T06:57:05.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26087" PostTypeId="1" CreationDate="2016-01-20T08:07:29.937" Score="2" ViewCount="150" Body="&lt;p&gt;This is my first post and I would LOVE some help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm in a situation where the customer owns our intranet/&quot;VendorNet&quot;, which is a VLAN that represents all the servers and devices to which I need to communicate (e.g. remote desktop into a server). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For various reasons, I am not allowed to use wireless APs to gain wireless access to ports activated on this VLAN and must be hard-wired directly from my computer into the port. My issue is that I am not able to reach where I need to go with the 100m cat5e restriction. The customer has permitted me to use a wired, 1-port ethernet repeater to extend my range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here are my questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to plug an ethernet cable directly from my laptop's standard ethernet port into an ethernet repeater, then the ethernet repeater into a port capable of communicating over the network I'd like to access, and be able to remote desktop into a server on said network? What if this repeater is PoE/PoE+? Even if the repeater is IEEE802.3af/at (af class 1-4), will it still fry my port/network adapter? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason or another, they will only let me use a 1-port ethernet repeater and not a dumb switch or anything like that. This has really tied my hands and made efficient work a genuine challenge. Any help would be truly appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adam&lt;/p&gt;&#xA;" OwnerUserId="22169" LastActivityDate="2016-05-19T19:44:07.007" Title="IEEE802.3af/at PoE/PoE+ ethernet repeater to non-PoE laptop port for network access" Tags="|ethernet|power-over-ethernet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26088" PostTypeId="2" ParentId="26083" CreationDate="2016-01-20T08:11:17.900" Score="0" Body="&lt;p&gt;1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Short answer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FWIW I also don't see how the answer marked in green would be the correct answer. In fact I don't see how any of those answers would be the correct answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Long answer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I wanted to protect Branch I'd set incoming rules on the Branch network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, if only City_HQ is under my control, I can either drop what's incoming from Branch, or drop what's outgoing to Branch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I prefer working with incoming rules. And when I start using rules I prefer using &quot;deny any any&quot; as last resort with explicit permits before that. But that's from a firewall perspective. We are talking about routers here... YMMV&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAICS the config is almost correct but should say&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;deny tcp 192.168.1.0 0.0.0.255 host 10.1.1.101 eq 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(port should be specified on destination side)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again I don't see how any of the red or green answers (or other) would be correct.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2016-01-20T08:11:17.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26089" PostTypeId="1" AcceptedAnswerId="26105" CreationDate="2016-01-20T08:27:31.107" Score="2" ViewCount="1863" Body="&lt;p&gt;I know it's a bad practice, but I would like to know why it is not recommended. I tried to find it in RFC2328. It only said 0.0.0.0 indicates lack of DR/BDR. Does that mean I can use 0.0.0.0 on Point-to-point network?&lt;/p&gt;&#xA;" OwnerUserId="20657" LastEditorUserId="8499" LastEditDate="2018-12-22T21:30:18.007" LastActivityDate="2018-12-22T21:30:18.007" Title="Can OSPF router-id be 0.0.0.0?" Tags="|routing|ospf|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26090" PostTypeId="2" ParentId="26087" CreationDate="2016-01-20T08:32:53.353" Score="1" Body="&lt;p&gt;short answer yes you could with no problem , repeater should work &lt;strong&gt;&lt;em&gt;as a two port switch&lt;/em&gt;&lt;/strong&gt; . i believe in that if this two port repeater is POE or POE+ just main that it will need extra power adapter to provide the host with this POE but not affect its data payload . so first of all test this repeater with simple ping . &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-01-20T08:32:53.353" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26091" PostTypeId="2" ParentId="480" CreationDate="2016-01-20T08:40:24.793" Score="3" Body="&lt;p&gt;To wipe existing config, and start from default configuration where you will be asked to set initial username and password for console connection you need just few commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASR9010#admin&#xA;ASR9010(admin)#configure&#xA;ASR9010(admin-config)#commit replace&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this command just reload the device. This works very well for me on ASR9010&lt;/p&gt;&#xA;" OwnerUserId="22170" LastEditorUserId="22170" LastEditDate="2016-01-21T09:54:11.753" LastActivityDate="2016-01-21T09:54:11.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26092" PostTypeId="2" ParentId="26072" CreationDate="2016-01-20T09:00:28.527" Score="2" Body="&lt;p&gt;First, an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose the frames are 1500 bytes long, it is the same as &lt;em&gt;12000 bits&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The transmission of the frame to &lt;em&gt;A&lt;/em&gt; at 10 Mb/s takes 1.2 milliseconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The transmission of the same size frame to &lt;em&gt;B&lt;/em&gt; takes 6 milliseconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In total, to transmit 24000 bits took 7.2 milliseconds. It gives an speed of &lt;em&gt;3.33 Mb/s&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result isn't the arithmetic mean, is the &lt;em&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Harmonic_mean&quot; rel=&quot;nofollow&quot;&gt;Harmonic Mean&lt;/a&gt;&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The harmonic mean can be expressed as the reciprocal of the arithmetic mean of the reciprocals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For our case:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;=1/(((1/10)+(1/2))/2) =1/((6/10)/2) = (2/1)/(6/10) = 20/6 = 3.33&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, for two speeds &lt;em&gt;s1&lt;/em&gt; and &lt;em&gt;s2&lt;/em&gt; will be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;=(2*s1*s2)/(s1+s2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case &lt;code&gt;=(2*10*2)/(10+2) =(40/12) =3,33&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-01-20T12:06:45.570" LastActivityDate="2016-01-20T12:06:45.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26093" PostTypeId="1" CreationDate="2016-01-20T09:49:00.197" Score="1" ViewCount="255" Body="&lt;p&gt;In IPv4, we had to find the Network Address using the IP address and the subnet mask. With IPv6 there's already the Network Prefix in the IP address. &lt;p&gt;Suppose I have an IP address A: &lt;code&gt;2001:db8:a0b:12f0::1/48&lt;/code&gt; and B: &lt;code&gt;2001:2AC:CAD:0000::/64&lt;/code&gt;, the network prefix with mask for A is:&lt;code&gt;2001:0db8:0a0b:0000:0000:0000:0000:0000&lt;/code&gt; and B is: &lt;code&gt;2001:02AC:0CAD:0000:0000:0000:0000:0000&lt;/code&gt;. How can I determine whether these two devices will be able to communicate?&#xA;&lt;br/&gt;Any help will be greatly appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="15477" LastActivityDate="2016-01-20T12:12:35.613" Title="How to verify whether two devices can communicate" Tags="|ipv6|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26095" PostTypeId="1" AcceptedAnswerId="26106" CreationDate="2016-01-20T10:12:18.623" Score="1" ViewCount="734" Body="&lt;p&gt;I have added a few prefixes (called allnet) into BGP route table. The prefixes include the following;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list allnet seq 460 permit 10.69.118.0/23&#xA;ip prefix-list allnet seq 465 permit 10.69.108.0/22&#xA;ip prefix-list allnet seq 470 permit 10.69.108.0/24&#xA;ip prefix-list allnet seq 475 permit 10.69.109.0/24&#xA;ip prefix-list allnet seq 480 permit 10.69.110.0/24&#xA;ip prefix-list allnet seq 485 permit 10.69.111.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when I look for the prefixes in BGP withe the following command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show ip bgp prefix-list allnet | inc 10.69.&lt;/code&gt; None of the above prefixes appear&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; *&amp;gt;  10.69.69.0/24    10.1.243.17 0 2856 12641 65299 i&#xA; *&amp;gt;  10.69.114.0/23   10.1.243.17 0 2856 12641 65299 i&#xA; *&amp;gt;  10.69.116.0/23   10.1.243.17 0 2856 12641 65299 i&#xA; *&amp;gt;  10.69.120.0/24   10.1.243.17 0 2856 12641 65299 i&#xA; *&amp;gt;  10.69.122.0/23   10.1.243.17 0 2856 12641 65299 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I tried to add the missing prefixes again, (just in case the router didn't include it) , but when I try and add 10.69.118.0/23 I get the message its already included, see below,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list allnet permit 10.69.109.0/24&#xA;**%Insertion failed - prefix-list entry exists:** &#xA;   seq 475 permit 10.69.109.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can someone please tell me why the prefix won't appear in the BGP table even though its added?&lt;/p&gt;&#xA;" OwnerUserId="20399" LastEditorUserId="20399" LastEditDate="2016-01-20T10:14:39.180" LastActivityDate="2016-01-20T15:20:00.857" Title="Cisco BGP Route Not Appearing in Route Table" Tags="|routing|cisco-ios|" AnswerCount="1" CommentCount="11" ClosedDate="2016-01-20T15:32:25.940" ContentLicense="CC BY-SA 3.0" />
  <row Id="26097" PostTypeId="1" CreationDate="2016-01-20T11:57:37.923" Score="4" ViewCount="818" Body="&lt;p&gt;I was trying to do an exercise where we have a range of IPv4 addresses and we need to convert it both to &quot;prefix notation&quot;, e.g. a.b.c.d/x, and to &quot;address/mask&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, apparently, the following range 121.34.56.64–121.34.56.128 can neither expressed in prefix notation nor in address/mask. Why is that? I mean, they have the first 24 bits in common, so I would express the range as 121.34.56.64/24 in prefix notation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other ranges that I do not understand why they cannot be assigned a prefix notation and an address/mask notation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;128.131.9.0–128.131.9.192&lt;/li&gt;&#xA;&lt;li&gt;93.20.10.0–93.20.11.0&lt;/li&gt;&#xA;&lt;li&gt;128.242.138.0–128.242.139.127&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Maybe I am just confused about how these prefixes and masks are obtained. So, in general, which ranges cannot be expressed in prefix notation and prefix/mask notation? Is there a time where it is possible to express a range in prefix notation but not in prefix-mask (or vice-versa)? &lt;/p&gt;&#xA;" OwnerDisplayName="user16355" LastEditorDisplayName="user16355" LastEditDate="2016-01-20T12:25:43.183" LastActivityDate="2016-01-20T14:47:12.750" Title="Which ranges of IPv4 addresses cannot be expressed in prefix notation?" Tags="|ipv4|ip|prefix|" AnswerCount="4" CommentCount="0" ClosedDate="2019-03-29T03:16:58.300" ContentLicense="CC BY-SA 3.0" />
  <row Id="26098" PostTypeId="2" ParentId="26093" CreationDate="2016-01-20T12:12:35.613" Score="3" Body="&lt;p&gt;Given your additional comments, you're not asking if machines with specific addresses can communicate, you're asking if two addresses are in the same subnet. In the first case, things like routing and firewalling are relevant, the second is just math.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's no real difference between subnet calculations in IPv4 and IPv6, it's just more bits. You can use normal techniques as explained in detail in &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7106/how-do-you-calculate-the-prefix-network-subnet-and-host-numbers&quot;&gt;this question&lt;/a&gt;, or you can use a tool like &lt;code&gt;sipcalc&lt;/code&gt; to calculate this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% sipcalc 2001:db8:a0b:12f0::1/48&#xA;-[ipv6 : 2001:db8:a0b:12f0::1/48] - 0&#xA;&#xA;[IPV6 INFO]&#xA;Expanded Address    - 2001:0db8:0a0b:12f0:0000:0000:0000:0001&#xA;Compressed address  - 2001:db8:a0b:12f0::1&#xA;Subnet prefix (masked)  - 2001:db8:a0b:0:0:0:0:0/48&#xA;Address ID (masked) - 0:0:0:12f0:0:0:0:1/48&#xA;Prefix address      - ffff:ffff:ffff:0:0:0:0:0&#xA;Prefix length       - 48&#xA;Address type        - Aggregatable Global Unicast Addresses&#xA;Network range       - 2001:0db8:0a0b:0000:0000:0000:0000:0000 -&#xA;              2001:0db8:0a0b:ffff:ffff:ffff:ffff:ffff&#xA;&#xA;% sipcalc 2001:2AC:CAD:0000::/64&#xA;-[ipv6 : 2001:2AC:CAD:0000::/64] - 0&#xA;&#xA;[IPV6 INFO]&#xA;Expanded Address    - 2001:02ac:0cad:0000:0000:0000:0000:0000&#xA;Compressed address  - 2001:2ac:cad::&#xA;Subnet prefix (masked)  - 2001:2ac:cad:0:0:0:0:0/64&#xA;Address ID (masked) - 0:0:0:0:0:0:0:0/64&#xA;Prefix address      - ffff:ffff:ffff:ffff:0:0:0:0&#xA;Prefix length       - 64&#xA;Address type        - Aggregatable Global Unicast Addresses&#xA;Network range       - 2001:02ac:0cad:0000:0000:0000:0000:0000 -&#xA;              2001:02ac:0cad:0000:ffff:ffff:ffff:ffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see form the ranges, there's no overlap in these two networks.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-01-20T12:12:35.613" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26099" PostTypeId="2" ParentId="26097" CreationDate="2016-01-20T12:31:28.510" Score="7" Body="&lt;p&gt;The issue is that you end up comparing unequal things when you say &quot;I would express the range as 121.34.56.64/24 in prefix notation&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The range 121.34.56.64 to 121.34.56.128 is &lt;em&gt;contained&lt;/em&gt; in 121.34.56.64/24 (which is actually the 256 IPs from 121.34.56.0 to .255), but the two are not equivalent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason that 121.34.56.64-128 cannot be expressed as a single prefix is because of that last 128 IP. Up to 127, the 25th bit of the IP is a 0. At 128 it becomes a 1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, a single mask covering all those IPs can only be at most 24 bits long, and that results in a longer IP range than you are looking for.&#xA;So the best you can do would be 121.34.56.64/26 (from .64 to .127) and then add a .32 to cover that last .128.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other examples are similar. If you manage to find a single mask that covers all the IPs in the range, you will find that it also covers a bunch of other IPs before or after the ones you want. So to cover these ranges exactly, you need to assemble several smaller IP ranges.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastEditorUserId="21892" LastEditDate="2016-01-20T14:12:22.507" LastActivityDate="2016-01-20T14:12:22.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26100" PostTypeId="2" ParentId="26097" CreationDate="2016-01-20T12:34:22.693" Score="1" Body="&lt;p&gt;representing the IPV4 by address MASK , prefix or wildcard mask all are equivalent&#xA;but its depend on two things&lt;br&gt;&#xA; 1- if you follow classful or classless IPV4 presentation , for example if you follow classful style to present the IPV4 ,you can't present  121.34.56.X/24 OR 121.34.56.0 mask 255.255.255.0 because it is class A , as you know class A is 255.0.0.0 mask or /8 prefix .&lt;br&gt;&#xA; 2- the command on the IOS you will configure this IPV4 for it , for example you can't present IPV4 in form of IP/Prefix for certain interface in IOS but you can do so in NXOS , for EIGRP IPV4 configuration should occur in form of address and wildcard mask.    &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-01-20T12:34:22.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26101" PostTypeId="2" ParentId="26097" CreationDate="2016-01-20T12:54:19.730" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Now, apparently, the following range 121.34.56.64–121.34.56.128 can neither expressed in prefix notation nor in address/mask. Why is that? I mean, they have the first 24 bits in common, so I would express the range as 121.34.56.64/24 in prefix notation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because 121.34.56.64/24 includes the range 121.34.56.64–121.34.56.128 but ALSO includes OTHER addresses not belonging to the range 121.34.56.64–121.34.56.128.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Maybe I am just confused about how these prefixes and masks are obtained. So, in general, which ranges cannot be expressed in prefix notation and prefix/mask notation?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can write a range A-B as prefix notation when:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The first address A of the range has a sequence of H x 0's bits as least significant bits. &lt;/li&gt;&#xA;&lt;li&gt;The last address B of the range shares all the same (32-H) bits from A, AND has H x 1's for the least significant bits.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A = 1.1.240.0 = 00000001.00000001.11110000.00000000&#xA;B = 1.1.243.255 = 00000001.00000001.11110011.11111111&#xA;H = 10 bits&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you can write A-B as A/(32-H): 1.1.240.0-1.1.243.255 as 1.1.240.0/22&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a time where it is possible to express a range in prefix notation but not in prefix-mask (or vice-versa)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-20T12:54:19.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26102" PostTypeId="2" ParentId="26097" CreationDate="2016-01-20T14:13:16.260" Score="1" Body="&lt;p&gt;You must distinguish &quot;ip range&quot; and &quot;ip network&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those terms are commonly used for IP networks, but they are not equivalent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An IP range is any number of contiguous IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.1-192.168.1.10 is a range. but it's not a network, so it cannot be written with neither a prefix or a subnet mask notation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0/24 is a network (it contain the range of ip addresses 192.168.1.0 - 192.168.1.255)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;121.34.56.64 - 121.34.56.128 is also a range and not a network. The nearest network is 121.34.56.64/26 which contains the range 121.34.56.64-121.34.56.127 (and not 128).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you could write it as the sum of 2 networks : 121.34.56.64/26 and 121.34.45.128/32 (this network contain only 1 IP address)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-edited- 93.20.10.0–93.20.11.0 is not a network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;128.242.138.0–128.242.139.127 corresond to 2 networks : 128.242.138.0/24 and 128.242.139/25&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use Windows, download the solarwinds subnet calculator (it's free) to easilly see networks boundaries. You can find other network calculators online.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-01-20T14:47:12.750" LastActivityDate="2016-01-20T14:47:12.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26103" PostTypeId="2" ParentId="26084" CreationDate="2016-01-20T15:02:12.700" Score="0" Body="&lt;p&gt;Cisco has a paper, &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_acl/configuration/15-2mt/sec-object-group-acl.html&quot; rel=&quot;nofollow&quot;&gt;Object Groups for ACLs&lt;/a&gt;, which includes a section called, &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios-xml/ios/sec_data_acl/configuration/15-2mt/sec-object-group-acl.html#GUID-DB1F87DC-04B0-4A26-AA4F-B354E84A1AC5&quot; rel=&quot;nofollow&quot;&gt;Example Verifying Object Groups for ACLs&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Example Verifying Object Groups for ACLs&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following example shows how to display all object groups:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router&amp;gt; enable&#xA;Router# show object-group&#xA;Network object group auth_proxy_acl_deny_dest&#xA; host 209.165.200.235&#xA;Service object group auth_proxy_acl_deny_services&#xA; tcp eq www&#xA; tcp eq 443&#xA;Network object group auth_proxy_acl_permit_dest&#xA; 209.165.200.226 255.255.255.224&#xA; 209.165.200.227 255.255.255.224&#xA; 209.165.200.228 255.255.255.224&#xA; 209.165.200.229 255.255.255.224&#xA; 209.165.200.246 255.255.255.224&#xA; 209.165.200.230 255.255.255.224&#xA; 209.165.200.231 255.255.255.224&#xA; 209.165.200.232 255.255.255.224&#xA; 209.165.200.233 255.255.255.224&#xA; 209.165.200.234 255.255.255.224&#xA;Service object group auth_proxy_acl_permit_services&#xA; tcp eq www&#xA; tcp eq 443&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The following example shows how to display information about specific&#xA;  object group-based ACLs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# show ip access-list my_ogacl_policy&#xA;Extended IP access list my_ogacl_policy&#xA;10    permit object-group eng_service any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-20T15:57:15.443" LastActivityDate="2016-01-20T15:57:15.443" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26104" PostTypeId="1" CreationDate="2016-01-20T15:16:02.053" Score="2" ViewCount="158" Body="&lt;p&gt;I have the following AS-level topology with 3 ASes, i.e., A, B and C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BYU4Y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BYU4Y.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am asked to &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;illustrate the idea of hierarchical routing in the particular case of the Internet by describing the process by which an IP packet would be routed from a source router &lt;code&gt;X&lt;/code&gt; in &lt;code&gt;A&lt;/code&gt; to a destination router &lt;code&gt;Y&lt;/code&gt; in . Moreover, for each step, I should briefly describe which routing information is used, which protocol determines that routing information, and how routing information is transmitted to the router.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I know that within an AS there's a internal routing protocol. The most common ones are link-state or distance-vector-based protocols. OSPF (open-shortest path protocol) is a link-state based routing protocol that is quite used nowadays. Another one apparently is IS-IS.  A common, if I am not wrong, old distance-vector based protocol is RIP (routing information protocol).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are then external routing protocols, which are protocols that allow ASes to communicate. The most common one is BGP (border gateway protocol). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course from one router &lt;code&gt;X&lt;/code&gt; to send something to another router &lt;code&gt;Y&lt;/code&gt; in a different AS these two kind of protocols (internal and external) should be used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think that the &lt;code&gt;GW&lt;/code&gt;s are border routers that allow the ASes to communicate. My understanding is that &lt;code&gt;X&lt;/code&gt; should first send its packet to &lt;code&gt;GW1&lt;/code&gt; using &lt;code&gt;A&lt;/code&gt;'s internal routing protocol. Then &lt;code&gt;GW1&lt;/code&gt; would contact &lt;code&gt;GW2&lt;/code&gt; using for example &lt;code&gt;BGP&lt;/code&gt;, and the packet would then be transferred to &lt;code&gt;GW3&lt;/code&gt; (using e.g. RIP), and then from &lt;code&gt;GW3&lt;/code&gt; to &lt;code&gt;GW4&lt;/code&gt; using again maybe BGP. Once arrived at &lt;code&gt;GW4&lt;/code&gt;, again, another internal routing protocol, such as OSPF, would be used to send &lt;code&gt;A&lt;/code&gt;'s original packet to &lt;code&gt;Y&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from that, I don't think I would be able to give an exhaustive answer to the question above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated!&lt;/p&gt;&#xA;" OwnerDisplayName="user16355" LastEditorDisplayName="user16355" LastEditDate="2016-01-20T15:21:16.470" LastActivityDate="2016-01-20T15:36:03.720" Title="How hierarchical routing would work in this case?" Tags="|routing|router|protocol-theory|" AnswerCount="1" CommentCount="2" ClosedDate="2016-01-20T17:43:40.857" ContentLicense="CC BY-SA 3.0" />
  <row Id="26105" PostTypeId="2" ParentId="26089" CreationDate="2016-01-20T15:19:35.633" Score="2" Body="&lt;p&gt;I think you are confusing what the RFC says. While the Router ID is often written like an IPv4 address, it is really just a 32-bit number, and it can be written or configured as a number without the IPv4 dotted-decimal notation. I think the dotted-decimal notation to which you refer in the RFC is actually meaning an IPv4 address, not the Router ID:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Designated Router&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Designated Router selected for the attached network.  The&#xA;          Designated Router is selected on all broadcast and NBMA networks&#xA;          by the Hello Protocol.  Two pieces of identification are kept&#xA;          for the Designated Router: its Router ID and its IP interface&#xA;          address on the network.  The Designated Router advertises link&#xA;          state for the network; &lt;strong&gt;&lt;em&gt;this network-LSA is labelled with the&#xA;          Designated Router's IP address.  The Designated Router is&#xA;          initialized to 0.0.0.0, which indicates the lack of a Designated&#xA;          Router.&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As far as the Router ID in the RFC, it only says that it is an arbitrary 32-bit number. I don't see anything to prevent it from being anything in the 32-bit number range of &lt;code&gt;0&lt;/code&gt; (&lt;code&gt;0.0.0.0&lt;/code&gt;) to &lt;code&gt;4294967295&lt;/code&gt; (&lt;code&gt;255.255.255.255.255&lt;/code&gt;). Remember that you can put it in as a number or in dotted-decimal notation, but it is not an IPv4 address and does not follow IPv4 rules about the value, despite looking like an IPv4 address when using the dotted-decimal notation.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-20T16:16:20.497" LastActivityDate="2016-01-20T16:16:20.497" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26106" PostTypeId="2" ParentId="26095" CreationDate="2016-01-20T15:20:00.857" Score="1" Body="&lt;p&gt;The command &lt;code&gt;ip prefix-list&lt;/code&gt; does NOT insert prefixes into BGP route table.&#xA;That command is used to FILTER prefixes when the router announces or learns prefixes from BGP peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common Cisco idiom for locally injecting prefixes into BGP is combining the BGP &quot;network&quot; statement with static routes to Null0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp &amp;lt;ASN&amp;gt;&#xA; network 10.69.108.0 mask 255.255.255.0&#xA;&#xA;ip route 10.69.108.0 255.255.255.0 Null0 250&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-20T15:20:00.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26107" PostTypeId="2" ParentId="17194" CreationDate="2016-01-20T15:23:09.450" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I need to divide a network 172.16.0.0/12 into 3 different subnets for different purposes. One of them needs 6 host addresses, another 85 host addresses and the last 100 host addresses. It should be done so that as few addresses as possible goes unused.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First off you have to decide what exactly you mean by &quot;unused&quot;. The most sensible way to subnet depends on how you see your usage growing in the future. You clearly have a lot more space than you need so the real question becomes how do you place your current allocations into the space you have in a way that minimises the risk you will have to renumber in future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your expect your growth to come from adding more subnets and you expect some of your new subnets to be large then it makes sense to pack your subnets in a way that leaves large blocks free. On the other hand if you expect your existing subnets to grow larger then you may want to leave gaps after them which you can use to either expand the existing subnet or create another small subnet as needs dictate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would caution about being too stingy in private space. Using /24's throughout will waste some addresses sure but it makes it so much easier for humans to see what is going on. Most orgnaisations are small enough that exhaustion of private IP space is not a major issue.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now, the first subnet is easy, I can make a subnet 172.16.0.0/29 which has 2^3-2=6 usable host addresses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Fine&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm not sure how to approach the next subnet though. Is it possible to make a subnet from say 172.16.0.8-172.16.0.127?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, that is not possible. Subnets must be a power of two size and their boundry must be a multiple of their size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So having made the allocation above the first palce you could put a /25 is 172.16.0.128/25 . You could also place them at 172.16.1.0/25 172.16.1.128/25&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which arrangement makes the most sense, again it depends on expected growth. If you expect one of the subnets may need to be expanded to a /24 then it would make sense to put that one at 172.16.1.0/25 and leave 172.16.1.128/25 free.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I should also mention that the subnets should have access to the Internet. How can this be assured? I read that the whole 172.16.0.0/12 address range is private and thus they do not work in the Internet. Is this true?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Those addresses cannnot be used directly on the internet. If you only need to make outbound connections to the itnernet then you can use NAT to hide multiple private addresses behind one public address. If you need to accept inbound connections then the NAT would have to be configured to forward those connections or you would need to get public space instead (which is gettign increasingly difficult nowadays).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-01-20T15:23:09.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26108" PostTypeId="2" ParentId="26087" CreationDate="2016-01-20T15:24:31.490" Score="1" Body="&lt;p&gt;It is unlikely that the repeater will be a PoE device, except that it may power itself with PoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, your laptop should have no problem because you can plug it into a PoE switch port and not fry it. PoE will not be sent unless the end-device requests it. This was a primary concern when the PoE standards were originally created.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-20T15:24:31.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26109" PostTypeId="2" ParentId="26104" CreationDate="2016-01-20T15:36:03.720" Score="1" Body="&lt;p&gt;If AS'es A,B,C are all you have:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Both AS A and AS C could use static default routing towards AS B.&lt;/li&gt;&#xA;&lt;li&gt;AS B could point specific static route X to A and specific static route Y to C.&lt;/li&gt;&#xA;&lt;li&gt;No dynamic routing protocol between AS'es.&lt;/li&gt;&#xA;&lt;li&gt;AS B could run OSPF between GW2 and GW3.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This could be thought as if AS B would lie in a routing level hierarchically &quot;above&quot; both AS A and AS C.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-20T15:36:03.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26110" PostTypeId="2" ParentId="17194" CreationDate="2016-01-20T15:50:41.897" Score="0" Body="&lt;p&gt;You need to do this sort of thing in binary, then it becomes obvious, and you won't end up trying to do something as incorrect as, &quot;make a subnet from say &lt;code&gt;172.16.0.8-172.16.0.127&lt;/code&gt;&quot;, which you would see is impossible. You should study &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;this answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you insist upon not doing it incorrectly, you could always remember that two consecutive, identical mask lengths equal a mask length one smaller. For example, two consecutive &lt;code&gt;/27&lt;/code&gt; networks make one &lt;code&gt;/26&lt;/code&gt; network. What you show, two &lt;code&gt;/27&lt;/code&gt;, two &lt;code&gt;/28&lt;/code&gt;, and a &lt;code&gt;/30&lt;/code&gt;, could be reduced to, one &lt;code&gt;/26&lt;/code&gt;, one &lt;code&gt;/27&lt;/code&gt;, and one &lt;code&gt;/30&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, the &lt;code&gt;172.16.0.0/12&lt;/code&gt; range is a private network range, as is &lt;code&gt;10.0.0.0/8&lt;/code&gt; and 192.168.0.0/16`, and they cannot be routed on the public Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;space reserved for future use&quot; is unallocated, and may be divided into more subnets and used when the need arises. You should strive not to create a subnet so small that there is no room for growth, and you should always want some unallocated space which can be used for new subnets when you need them.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-01-20T15:50:41.897" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26111" PostTypeId="1" CreationDate="2016-01-20T16:20:08.030" Score="1" ViewCount="271" Body="&lt;p&gt;I have a list of old IP addresses of devices, they need to be switched to a new IP scheme.  At each switch in the company there patch panels that patch to the switch.  The patch panel is labeled with a letter and number like A-1.  Is there a way that I can find out what switch and port that IP is going to.  Then I would be able to find that corresponding patch panel port, and then the device to be able to Re-IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="20754" LastEditorUserId="8499" LastEditDate="2018-03-10T04:21:53.543" LastActivityDate="2018-03-10T04:22:11.717" Title="Locating device with IP address" Tags="|routing|ip-address|switchport|patch-panel|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26112" PostTypeId="2" ParentId="26111" CreationDate="2016-01-20T16:26:36.840" Score="0" Body="&lt;p&gt;Your layer-1 (cabling) labels really have no relation to the layer-3 (IP) addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can probably go into the network devices and look at the ARP and MAC address tables to figure out to which switch port a device is connected. Beyond that, you will need to trace cables and try to relate closet labeling to the labels on the floor jacks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why using DHCP is so useful since you don't need to manually change IP addresses on the hosts.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-20T16:26:36.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26113" PostTypeId="1" AcceptedAnswerId="26114" CreationDate="2016-01-20T16:43:15.053" Score="3" ViewCount="314" Body="&lt;p&gt;I am given a list of IPs, some of them have a netmask, other no.&#xA;I got the idea of how to create a mask but i'm not understanding why there are cases where an IP doesn't have a mask.&lt;/p&gt;&#xA;&lt;p&gt;Like the following:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;121.34.56.64–121.34.56.128 &amp;gt; Don't have mask&lt;/li&gt;&#xA;&lt;li&gt;128.131.9.0–128.131.9.192  &amp;gt; Don't have mask&lt;/li&gt;&#xA;&lt;li&gt;93.20.10.0–93.20.11.0      &amp;gt; Don't have mask&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;While the following actually have mask address:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;67.56.34.64-67.56.34.79 &amp;gt; Prefix notation: 67.56.34.64/28 | Address/Mask: 67.56.34.64/255.255.255.240 and so on.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;For example if I look at the third one of the addresses without mask i do the following:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;93.20.10.0–93.20.11.0&lt;/p&gt;&#xA;&lt;p&gt;93.20. 0000 101|0 . 0000 0000&lt;br /&gt;&#xA;93.20. 0000 101|1 . 0000 0000&lt;/p&gt;&#xA;&lt;p&gt;NetMask: 255.255.254.0, that is not correct.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Can somebody explain me why and how to understand when a mask exists?&lt;/p&gt;&#xA;" OwnerUserId="22186" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-03-11T02:09:42.003" Title="Understanding why some IPs don't have a mask address" Tags="|ipv4|ip|subnet|ip-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26114" PostTypeId="2" ParentId="26113" CreationDate="2016-01-20T16:54:55.283" Score="5" Body="&lt;p&gt;The reason for a mask is to divide an address into two parts: the network part and the host part. You can have a list of addresses which do not fit into one network, but they will fit into a larger network. Your example: &lt;code&gt;93.20.10.0–93.20.11.0&lt;/code&gt; will not fit into the &lt;code&gt;93.20.10.0/24&lt;/code&gt; network, but will fit into the &lt;code&gt;93.20.10.0/23&lt;/code&gt; network. The catch is that there are more addresses in the &lt;code&gt;93.20.10.0/23&lt;/code&gt; network than are in your list. That means that your list is a subset of the addresses in the &lt;code&gt;93.20.10.0/23&lt;/code&gt; network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addresses and masks are just binary numbers. We use them in the dotted-decimal notation to make it easier to read, but if you really want to understand them, you need to look at them in binary. The devices on the network, hosts, routers, etc., only see and use the binary number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should study &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;this answer&lt;/a&gt; to understand how IP addresses and masks work.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-01-20T18:29:39.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26115" PostTypeId="1" AcceptedAnswerId="26118" CreationDate="2016-01-20T18:38:21.627" Score="2" ViewCount="413" Body="&lt;p&gt;I need solution for router hardware redundancy. Two routers 2900 series with same configuration, toward same ISP. If one fail second to do failover. Can HSRP do this? Can outside interfaces be set toward same ISP with same public ip address on outside interfaces?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastEditorUserId="8499" LastEditDate="2018-12-22T21:31:43.537" LastActivityDate="2018-12-22T21:31:43.537" Title="Can I use HSRP for router hardware redundancy?" Tags="|cisco|routing|router|hsrp|fhrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26117" PostTypeId="2" ParentId="25993" CreationDate="2016-01-20T18:53:09.243" Score="1" Body="&lt;p&gt;Everything that has been written is true, but if you're using TCP, there is a strong &lt;a href=&quot;https://en.wikipedia.org/wiki/Network_performance#Algorithms_and_protocols&quot; rel=&quot;nofollow&quot;&gt;correlation&lt;/a&gt; between latency and bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP does not wait for an acknowledgement to send the next packet. It's using a window. When the window is full, the peer must wait for an ack.&#xA;Moreover, the faster ACKs are received, the faster the window can grow (it's the &lt;a href=&quot;https://en.wikipedia.org/wiki/Slow-start&quot; rel=&quot;nofollow&quot;&gt;slow start algorithm&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The stability of the latency can also come into play. &lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2016-01-20T18:53:09.243" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26118" PostTypeId="2" ParentId="26115" CreationDate="2016-01-20T18:53:23.480" Score="1" Body="&lt;p&gt;HSRP can provide first hop redundancy on your LAN. There are options to change the active router for things like router or link failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each outside interface needs its own IP address from the ISP. Each inside interface needs its own IP address plus one more for the virtual IP address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-20T18:53:23.480" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="26119" PostTypeId="1" AcceptedAnswerId="26120" CreationDate="2016-01-20T18:55:33.080" Score="3" ViewCount="273" Body="&lt;p&gt;If the transmission rate of a physical link, such as ethernet cable, between a sender and receiver is set to be 100Mbps, does it imply that the receiver will receive 100Mb of data in each second? What if the distance between the sender and receiver is very long, how does the distance affect here?&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2016-01-21T15:22:31.053" Title="Transmission Rate in terms of distance" Tags="|cisco|ethernet|latency|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26120" PostTypeId="2" ParentId="26119" CreationDate="2016-01-20T19:02:13.743" Score="1" Body="&lt;p&gt;Distance doesn't have any affect on bandwidth. The bandwidth is how many bits per second you can send or receive. It may take the initial bit longer to get to the other end with a longer distance, but, if the bits are sent consecutively at 100 Mbps, they will arrive at 100 Mbps.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-20T19:02:13.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26123" PostTypeId="1" AcceptedAnswerId="26125" CreationDate="2016-01-20T21:00:36.363" Score="1" ViewCount="2048" Body="&lt;p&gt;I was wondering if it is possible for a server to serve two different subnets? I am new to networking so I'm getting confused. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Cisco packet tracer and would like to configure a web and DNS server to be able to respond to requests from two different networks all using the same router. However my server subnet is 255.255.255.0 and one side of the network is also set to that subnet however the other side of my network has a subnet of 255.255.225.128 as I don't want both sides of the network to be able to access each other for security reasons. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible for my network to work with this set-up? I have tried to research this but haven't found any easy to understand answers for a beginner. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have of course tried it to see if it works but it fails when I make requests from one side of the network, I just wanted to know if it was possible using a class C IP address for my internal LAN network with different subnets along with a 200.200.1.254 IP for my server.&lt;/p&gt;&#xA;" OwnerUserId="22158" LastActivityDate="2021-01-27T13:01:48.857" Title="Is it possible for 1 server to serve two different subnets?" Tags="|cisco|subnet|packet-tracer|route-server|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26124" PostTypeId="1" CreationDate="2016-01-20T21:10:42.953" Score="1" ViewCount="222" Body="&lt;p&gt;I have two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Can someone simplify the knowledge of &lt;strong&gt;windowing&lt;/strong&gt; that is commonly&#xA;used by connection-oriented protocols like TCP? I generally&#xA;understand it is a technique for flow control but I still don't see&#xA;how it is implemented in a real example.&lt;/li&gt;&#xA;&lt;li&gt;If I want to know the number of packets that can be received by a&#xA;receiver in each second, is it reasonable to calculate it by&#xA;&lt;code&gt;Bandwidth * Distance&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="19107" LastEditorUserId="8499" LastEditDate="2016-01-20T21:27:58.353" LastActivityDate="2016-01-20T21:27:58.353" Title="Understanding sliding window technique via real example" Tags="|cisco|tcp|bandwidth|transport-protocol|" AnswerCount="1" CommentCount="0" ClosedDate="2020-12-21T18:23:18.430" ContentLicense="CC BY-SA 3.0" />
  <row Id="26125" PostTypeId="2" ParentId="26123" CreationDate="2016-01-20T21:10:54.403" Score="0" Body="&lt;p&gt;First, &lt;code&gt;255.255.255.0&lt;/code&gt; and &lt;code&gt;255.255.255.128&lt;/code&gt; are invalid networks. Maybe you mean &lt;code&gt;200.200.1.0/25&lt;/code&gt; and &lt;code&gt;200.200.1.128/25&lt;/code&gt; (masks of &lt;code&gt;255.255.255.128&lt;/code&gt;)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you prevent one of your networks from accessing the other for security reasons, then you cannot access servers on one network from the other network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be possible for your servers to have two NICs, one in each network. You would need to do some configuration on those servers to only allow certain applications to be used on each network. Server configuration is off-topic here, but you could ask about that on &lt;a href=&quot;https://serverfault.com/&quot;&gt;Server Fault&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility is that the ACL(s) on the router which block access from one network to the other could have an exception to allow only the specific server addresses and protocols through to the other network. The exact configurations would depend on the specific router model and software version.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2016-01-20T22:48:07.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26126" PostTypeId="2" ParentId="26124" CreationDate="2016-01-20T21:27:22.830" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;I'm not sure what you mean by a real example? If you want to see it&#xA;in action, you can use something like Wireshark to capture a TCP&#xA;conversation during a download. You could do a simple &lt;a href=&quot;https://www.google.com/search?q=tcp%20windowing&quot; rel=&quot;nofollow&quot;&gt;Internet&#xA;search&lt;/a&gt; to see a lot of contrived examples.&lt;/li&gt;&#xA;&lt;li&gt;Your calculation is far short of what is needed to calculate TCP&#xA;throughput. Also, you need to understand that dynamic factors like&#xA;congestion will constantly change the throughput, with the windows&#xA;growing and shrinking all the time to adapt to the changing network&#xA;environment. Without a lot more information, it isn't possible to,&#xA;&quot;&lt;em&gt;know the number of packets that can be received by a receiver in&#xA;each second&lt;/em&gt;,&quot;  and that number will change from second to second.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-20T21:27:22.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26127" PostTypeId="1" CreationDate="2016-01-20T23:24:23.497" Score="2" ViewCount="414" Body="&lt;p&gt;In graph theory, the length of an edge is mostly represented by a numerical value to indicate the distance between the two end nodes. Thus, in the field of networking, is it acceptable if someone uses the propagation delay between the two nodes to represent the value of the link between them? In fact, I see this sometimes in video tutorials but I wonder if it's really a an accepting value to be used or not.&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2016-01-21T01:25:01.150" Title="Measure the distance between hosts" Tags="|cisco|internet|network-core|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26128" PostTypeId="2" ParentId="26127" CreationDate="2016-01-20T23:27:58.580" Score="2" Body="&lt;p&gt;It depends on how the propagation delay is measured. Most people do this with &lt;code&gt;ping&lt;/code&gt; which is a very poor measure of the propagation delay. Also, the propagation delay may vary because of things like congestion. I think the best you can do is come up with an average propagation delay, and understand that it could be much faster or slower than that based on other factors.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-20T23:27:58.580" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26131" PostTypeId="2" ParentId="26127" CreationDate="2016-01-21T01:25:01.150" Score="2" Body="&lt;p&gt;It is an acceptable value to use, however there would need to be significant variance for it to be useable across a large network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg: you might want to take an average over a period of time for each device and multiply it by 10 or 100 in order to differentiate a lot of devices that may have a variance of less than 5ms between them.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, the mode (most commonly occurring RTT) would probably be a better number to use than the average as this would significantly reduce the effect of variance due to congestion and QoS as Ron describes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, remember that when measuring &quot;delay&quot; between two nodes, you are really measuring the latency of the link, plus the processing time of whatever operating system the node happens to be running in it's control plane, even when you are pinging an interface address on a device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen numerous examples over many years where pinging a router or switch returns a higher latency than pinging a device that is physically beyond it.  Eg: If I ping the device I'm attached to I get an RTT of 5ms, but pinging a host on the other side of a campus reachable via the same device still reports an RTT of 1ms or less.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-01-21T01:25:01.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26135" PostTypeId="1" AcceptedAnswerId="26140" CreationDate="2016-01-21T05:05:34.043" Score="2" ViewCount="338" Body="&lt;p&gt;I am configuring a firewall hardware, which is connected between my laptop and lab LAN (lab LAN is also connected to other computers as well as Internet). My objective is to allow the ping between my computer &amp;amp; another computer in the lab. Then test deny the ping function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To ping successfully, I must allow all necessary protocols that related to &quot;ping&quot; by setting firewall configuration GUI. I have tried to allow several protocols together that related to ping, such as ARP, ICMP. However, &quot;ping&quot; is unsuccessful. I think the problem is that some protocols that support &quot;ping&quot; are not listed and allowed in the configuration. Is it correct? Then what protocols I need to add as well?&lt;/p&gt;&#xA;" OwnerUserId="22125" LastActivityDate="2016-01-28T13:50:27.327" Title="Allow necessary protocols to ping when configure firewall" Tags="|firewall|arp|ping|icmp|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26139" PostTypeId="2" ParentId="596" CreationDate="2016-01-21T08:18:58.357" Score="0" Body="&lt;p&gt;you want to find:&#xA;1.At the switch, ping the IP address you want to find. If the address is on the same subnet as the switch's management address, an ARP request will be sent looking for the MAC address of the host.&#xA;2.Now you can look at the ARP cache and find the MAC address of the host you are looking for (show ip arp) and its corresponding interface.&#xA;3.You can also look for its MAC address table entry by issuing: show mac-address table address [the address]&lt;/p&gt;&#xA;" OwnerUserId="22208" LastActivityDate="2016-01-21T08:18:58.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26140" PostTypeId="2" ParentId="26135" CreationDate="2016-01-21T08:29:36.730" Score="2" Body="&lt;p&gt;You have to allow ICPM - Echo and ICMP - Reply. For ping, thats usually all you need, arp should not be blocked by a firewall. At least, not by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your ping sticks to being unsuccessful, please keep in mind that there are still some other potential issues (L2/L3 connectivity like subnetting or routing, the host you ping may have a local firewall, and so on...)&lt;/p&gt;&#xA;" OwnerUserId="2112" LastActivityDate="2016-01-21T08:29:36.730" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26141" PostTypeId="1" AcceptedAnswerId="26147" CreationDate="2016-01-21T08:48:09.047" Score="2" ViewCount="4036" Body="&lt;p&gt;I see that some servers will stop the connection once a single request is done by sending [FIN, ACK]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From wiki,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A connection can be &quot;half-open&quot;, in which case one side has terminated its end, but the other has not. The side that has terminated can no longer send any data into the connection, but the other side can. The terminating side should continue reading the data until the other side terminates as well.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In case I want to speed up the requests by avoiding repeating handshake per request. Is it possible for the client to keep communicating even the server terminated its end? Will there be any response from the server or the server just read my request without responding?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just tested, if I delayed my [FIN, ACK] packet, there is no [ACK] packet from the server. Another question, if the server doesnt respond to it, will it process my request?&lt;/p&gt;&#xA;" OwnerUserId="22209" LastEditorUserId="22209" LastEditDate="2016-01-21T11:39:35.643" LastActivityDate="2016-01-21T14:44:26.670" Title="Continue to use the same connection after receiving [FIN, ACK]" Tags="|tcp|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26143" PostTypeId="2" ParentId="26135" CreationDate="2016-01-21T10:30:02.417" Score="1" Body="&lt;p&gt;well,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;at least you need to know about ICMP-echo (leaving the PING source and walking firewall in one direction) and ICMP-echo-reply that has a different type and traverse firewall in opposite direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;moreover : &quot;modern&quot; PING can and often use both UDP and (fewer) TCP instead of ICMP, so that the shortest way to get rid of the matter is looking at deny-logs and determine what kind of rules you need to implement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;obviously that way is &quot;smart&quot; just in case you are making tests and is not for a production enviroment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;anyway be careful in opening ALL types of ICMP, at least some can be &quot;dangerous&quot; (let's say ICMP redirect)&lt;/p&gt;&#xA;" OwnerUserId="22173" LastActivityDate="2016-01-21T10:30:02.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26147" PostTypeId="2" ParentId="26141" CreationDate="2016-01-21T14:44:26.670" Score="2" Body="&lt;p&gt;I think you are confused. Did you carefully read what you quoted? The side that terminates &lt;em&gt;can&lt;/em&gt; keep &lt;em&gt;receiving&lt;/em&gt; data, but it &lt;em&gt;cannot send&lt;/em&gt; anything back into the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means that if the server terminates the connection, but the client does not, the client can send data to the server, but the server cannot send anything to the client. If the server needs to send anything back to the client to fulfill the request, it cannot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are reasons for the handshaking, and your desire to speed things up by eliminating the handshaking means that you are using the wrong transport protocol for what you want to do. It sounds like you want to use UDP instead of TCP. Any TCP features you wish to keep will need to be handled by the applications, but UDP eliminates all the handshaking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could create your own transport protocol.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-21T14:44:26.670" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26149" PostTypeId="2" ParentId="26119" CreationDate="2016-01-21T15:22:31.053" Score="0" Body="&lt;p&gt;The thing with distance is that your signal gets degraded more over longer distances for various reasons, largely due to noise. Also, since the wire's resistance increases with length, the signal power will decrease because more energy will be dissipated as heat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ethernet protocol uses differential signaling and stp cable to help avoid loss to noise and since the signal is digital, power loss isn't a huge factor until you get to very long distances, since all that is needed is an &quot;off&quot; or &quot;on&quot;. However, a combination of noise and low power can still degrade a signal enough to not be useful: if this happens, then the signal must be sent again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, in 99% of the cases a signal will be received at the same rate as it is sent, but long distances can degrade the signal enough that it has to be sent again. This can be perceived as a slower connection.&lt;/p&gt;&#xA;" OwnerUserId="22218" LastActivityDate="2016-01-21T15:22:31.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26152" PostTypeId="1" AcceptedAnswerId="28113" CreationDate="2016-01-21T16:42:49.253" Score="3" ViewCount="103" Body="&lt;p&gt;For the sake of the argument, let's talk TCP/IP, but if other technologies are more suitable, by all means, please say so!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding of classic link aggregation is a round-robin type send method for combined bandwidth and ideally line-level redundancy on whichever layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a method for bonding two connections, which mirror the data sent and uses the mirrors for real time error correction? Maybe even through checksums instead of full multiplication? Think &quot;raid for networking&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would be useful to add error correction to applications, which do not offer it themselves. One example would be VoIP over wireless networks, which often suffers from late or lost packets.&lt;/p&gt;&#xA;" OwnerUserId="20067" LastEditorUserId="20067" LastEditDate="2016-01-24T16:42:19.473" LastActivityDate="2016-02-24T02:36:06.120" Title="Can links be aggregated in a way that provides packet level redundacy?" Tags="|redundancy|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26154" PostTypeId="2" ParentId="26152" CreationDate="2016-01-21T16:53:26.480" Score="1" Body="&lt;p&gt;Ethernet doesn't provide anything like what you are describing; there just isn't any error correction in ethernet. Error correction is left to upper-layer protocols, which may or may not have any error correction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Redundant traffic flows actually cause problems in the network stack, and they use unnecessary bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, when errors are detected, such as a bad ethernet FCS (CRC), it is better to discard a bad datagram (frame, packet, segment, etc.) as soon as possible so that the upper layers will miss it and ask that it be resent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Round-robin is usually a bad idea since it can cause problems for upper-layer protocols by increasing the out-of-sequence datagrams. A better method is to use some sort of hashing so that a single data stream uses only one of the links (spread the data streams across the links).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-21T16:53:26.480" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26159" PostTypeId="1" AcceptedAnswerId="26160" CreationDate="2016-01-21T18:48:18.350" Score="1" ViewCount="251" Body="&lt;p&gt;I've found a &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/26119/transmission-rate-in-terms-of-distance&quot;&gt;similar question&lt;/a&gt; in this site but the answers were not convincing me enough so I'll make a small scenario of two routers to express my point:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two routers connected by a link of rate &lt;code&gt;1 Mbps&lt;/code&gt; and distance of 10 Miles. The &lt;code&gt;Router1&lt;/code&gt;'s buffer has 5 packets to be sent to &lt;code&gt;Router2&lt;/code&gt; each of which has a size of &lt;code&gt;1 Megabit&lt;/code&gt; (let's ignore the processing delay and queueing delay, and no congestion occurs). According to this &lt;a href=&quot;https://networkengineering.stackexchange.com/a/26120/22225&quot;&gt;answer&lt;/a&gt;, at each second, a packet will be successfully transmitted to &lt;code&gt;Router2&lt;/code&gt; without being affected by the distance! As far as I know, the distance of the medium and speed of the signal must be taken into consideration when finding the total transmission time between two nodes (Of course I am not forgetting transmission delay). If I misunderstood, please enlighten me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="22225" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2022-12-15T03:02:42.000" Title="How does distance play a role for total transmission time?" Tags="|cisco|ethernet|network-core|transport-protocol|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26160" PostTypeId="2" ParentId="26159" CreationDate="2016-01-21T18:59:00.337" Score="1" Body="&lt;p&gt;Of course distance affects transmission time. What it doesn't affect is bandwidth or the rate at which the data are transmitted or received. There is a difference between the time it takes from transmission start and reception end (transmission time), and the rate at which something is being transmitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first device will transmit at 1 Mbps, and it will be done transmitting after five seconds. It's bandwidth is 1 Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second device will  have a delay due to distance before it starts receiving, but it will receive the data at 1 Mbps when the data gets there. It will receive at a bandwidth of 1 Mbps. Distance plays no part in the rate (bandwidth) of transmission or reception.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-21T19:16:44.263" LastActivityDate="2016-01-21T19:16:44.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26162" PostTypeId="1" AcceptedAnswerId="26164" CreationDate="2016-01-21T21:42:59.270" Score="5" ViewCount="15828" Body="&lt;p&gt;I'm trying to set up a simple &quot;wall wart&quot; WiFi extender, a DLink DAP-1520. The setup is straight forward enough, but there seems to be no option for choosing a channel/frequency, so the extender will compete for bandwidth with the main AP. Is this normal? I would expect it to &lt;em&gt;avoid&lt;/em&gt; the frequency used by the main AP. Am I missing something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For context, I have been trying to learn a bit about extending WiFi networks (my expertise starts above TCP, I'm a bit lost when it comes to the lower layers). As far as I understand, the DAP-1520 is not a repeater. It's an AP with a second WiFi device that it uses to connect to the main AP. At least, that's what I gather from the fact that the configuration wants me to specify an SSID and password for the back-haul as well as for the extender itself. And they suggest to pick a different SSID. (Edit: the extender supports 2.4 OR 5 GHz for the back-haul, and dual 2.4 AND 5GHz for the use by clients). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the same frequency in this arrangement doesn't make sense top me. So I have a few questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Does a repeater necessarily re-transmit on the same frequency? Why would it not be possible to re-transmit on a different frequency?&lt;/li&gt;&#xA;&lt;li&gt;Does a repeater need a WiFi password? &lt;/li&gt;&#xA;&lt;li&gt;When setting up multiple APs, should the all operate on different frequencies? Especially if they use WiFi for the back-haul? Why would an extender be hard coded to operate on the same frequency?&lt;/li&gt;&#xA;&lt;li&gt;When setting up multiple APs, should they all share the same SSID? If not, why not? Why would the instructions for the DAP-1520 suggest using a different SSID?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have read &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13216/how-does-a-wifi-range-extender-work&quot;&gt;How does a WiFi range extender work?&lt;/a&gt;, but it doesn't really help with my confusion...&lt;/p&gt;&#xA;" OwnerUserId="22232" LastEditorUserId="22232" LastEditDate="2016-01-22T06:47:33.090" LastActivityDate="2019-09-22T23:57:01.680" Title="Why would a WiFi extender use the same channel as the primary AP?" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26163" PostTypeId="1" AcceptedAnswerId="26168" CreationDate="2016-01-21T21:52:32.080" Score="3" ViewCount="4947" Body="&lt;p&gt;If you have the destination MAC address you need in your ARP cache, surely it shouldn't have to go through the router? Or is that the point - only the router can be sure to have all of its subnet's MAC addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a follow up: do computers on the same subnet ever regularly talk to each other without going through a router? Which protocols, if any, would do that?&lt;/p&gt;&#xA;" OwnerUserId="22233" LastActivityDate="2016-01-28T16:08:03.337" Title="Do broadcast (FF:FF:FF:FF:FF:FF) packets go through the router, or directly all computers on the subnet?" Tags="|arp|layer2|broadcast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26164" PostTypeId="2" ParentId="26162" CreationDate="2016-01-21T21:53:15.170" Score="7" Body="&lt;p&gt;Simple, it only has one radio. One radio === one channel. If it has two (or more) radios, then it can use one for the mesh, and the others for clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your WLAN employs security, then every device on the WLAN needs the correct settings (i.e. password) to connect.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Note: Dual-band does not mean &quot;dual radio&quot;. And it only has two internal antenna.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2016-01-21T22:02:36.643" LastActivityDate="2016-01-21T22:02:36.643" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26165" PostTypeId="1" AcceptedAnswerId="26169" CreationDate="2016-01-21T22:06:27.660" Score="1" ViewCount="252" Body="&lt;p&gt;I am reading the RFC 826, however I am unable to get the context behind the Network monitoring and debugging section:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Network monitoring and debugging:&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The above Address Resolution protocol allows a machine to gain&#xA;  knowledge about the higher level protocol activity (e.g., CHAOS,&#xA;  Internet, PUP, DECnet) on an Ethernet cable.  It can determine which&#xA;  Ethernet protocol type fields are in use (by value) and the protocol&#xA;  addresses within each protocol type.  In fact, it is not necessary for&#xA;  the monitor to speak any of the higher level protocols involved.  It&#xA;  goes something like this:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When a monitor receives an Address Resolution packet, it always enters&#xA;  the &#xA;  in a table.  It can determine the length of the hardware and protocol&#xA;  address from the ar$hln and ar$pln fields of the packet.  If the&#xA;  opcode is a REPLY the monitor can then throw the packet away.  If the&#xA;  opcode is a REQUEST and the target protocol address matches the&#xA;  protocol address of the monitor, the monitor sends a REPLY as it&#xA;  normally would.  The monitor will only get one mapping this way, since&#xA;  the REPLY to the REQUEST will be sent directly to the requesting host.&#xA;  The monitor could try sending its own REQUEST, but this could get two&#xA;  monitors into a REQUEST sending loop, and care must be taken.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Because the protocol and opcode are not combined into one field, the&#xA;  monitor does not need to know which request opcode is associated with&#xA;  which reply opcode for the same higher level protocol.  The length&#xA;  fields should also give enough information to enable it to &quot;parse&quot; a&#xA;  protocol addresses, although it has no knowledge of what the protocol&#xA;  addresses mean.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A working implementation of the Address Resolution protocol can also&#xA;  be used to debug a non-working implementation.  Presumably a hardware&#xA;  driver will successfully broadcast a packet with Ethernet type field&#xA;  of ether_type$ADDRESS_RESOLUTION.  The format of the packet may not be&#xA;  totally correct, because initial implementations may have bugs, and&#xA;  table management may be slightly tricky.  Because requests are&#xA;  broadcast a monitor will receive the packet and can display it for&#xA;  debugging if desired.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I apologize for this vague question, however I am not able to understand what the difference between the ARP module and this process for monitor and debugging. &lt;/p&gt;&#xA;" OwnerUserId="21979" LastEditorUserId="8499" LastEditDate="2018-12-27T01:49:09.053" LastActivityDate="2018-12-27T01:49:09.053" Title="ARP Network monitoring and debugging:" Tags="|protocol-theory|arp|rfc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26167" PostTypeId="2" ParentId="26163" CreationDate="2016-01-21T22:10:59.880" Score="3" Body="&lt;p&gt;Routers interconnect layer-3 networks (i.e. IPv4, IPv6, ...) while MAC and ARP (specifically, ethernet) are layer-2 concepts.&#xA;A router is not necessary for ethernet to function, or machines within the same layer-2 network to talk to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, computers within the same subnet talk to each other all the time.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="21926" LastEditDate="2016-01-28T16:08:03.337" LastActivityDate="2016-01-28T16:08:03.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26168" PostTypeId="2" ParentId="26163" CreationDate="2016-01-21T22:38:55.900" Score="0" Body="&lt;p&gt;By definition, frames (what you have is a broadcast MAC address which goes on an ethernet frame, not an IP packet which uses a broadcast IP address) do not cross a layer-3 boundary. A router will strip off a layer-2 frame before forwarding the layer-3 packet encapsulated in the layer-2 frame. The router will create a new layer-2 frame with which to encapsulate the layer-3 packet for the next hop. Layer-2 broadcasts are not forwarded across a layer-3 boundary; neither are layer-3 broadcasts, except in special cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC addresses are only significant on the layer-2 domain because they are only needed for the layer-2 frame. A router will have an ARP cache for each ethernet interface which it has, just as a PC would have an ARP cache for each ethernet interface which it has. Neither a PC nor a router is sure to have all the MAC addresses for every device in the layer-2 domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers are only needed when a host needs to communicate with a host on a different layer-3 network. Any host can communicate with any other host on the same layer-2 network (there are some corner cases like Private VLANs where this may not be true) without going through a router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-21T23:18:08.120" LastActivityDate="2016-01-21T23:18:08.120" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26169" PostTypeId="2" ParentId="26165" CreationDate="2016-01-21T23:10:35.943" Score="0" Body="&lt;p&gt;Assume you have a LAN with multiple hosts, and you want to test an ARP implementation you are developing. You can set up one host to monitor network traffic which it receives using something like Wireshark. This host is only for monitoring and debugging your ARP implementation. If ARP used unicast, you would need to have your monitoring host participate since it would only receive frames sent directly to it, but because ARP uses broadcast, every host on the LAN, including the non-participating monitoring host, will receive ARP frames. The monitoring host can capture and decode ARP frames without participating in the testing. This allows you to see if the ARP implementation is properly encoding per the RFC.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-21T23:10:35.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26173" PostTypeId="1" CreationDate="2016-01-22T08:24:14.487" Score="2" ViewCount="20691" Body="&lt;p&gt;I know that Ethernet frames (data link layer) has a FCS in the trailer. I also know that transport layer protocols both have error detection checksums as well. My question is, what is the difference between Data Link and Transport layer error detection? Don't they both do the same thing? Seems kind of redundant. I appreciate any insights. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19051" LastEditorUserId="8499" LastEditDate="2017-07-09T03:02:42.943" LastActivityDate="2017-07-09T03:02:42.943" Title="Difference between data link and transport layer error detection?" Tags="|ethernet|layer2|osi|transport-protocol|layer4|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26174" PostTypeId="2" ParentId="25991" CreationDate="2016-01-22T08:26:08.237" Score="-1" Body="&lt;p&gt;Use a /30 prefix. A /31 prefix is not enough space for two hosts. You want R1 and R2 to be in the same network. A /30 network gives only two usable addresses which is enough for R1 and R2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;/30 = 255.255.255.252&lt;/p&gt;&#xA;" OwnerUserId="22246" LastActivityDate="2016-01-22T08:26:08.237" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26176" PostTypeId="2" ParentId="26173" CreationDate="2016-01-22T09:17:41.117" Score="6" Body="&lt;p&gt;&lt;strong&gt;Link layer Error Detection&lt;/strong&gt;: A method to verify the &lt;em&gt;integrity&lt;/em&gt; of frames when they are transmited over the media. The receiving side can verify if the received frame has been damaged on transit. If link layer detects a damaged frame, then it discards the frame and could or not ask for a retransmission. (Ethernet never asks for retransmission, it simply discards).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Transport layer Error Control&lt;/strong&gt;:  The sending side send &lt;em&gt;segments&lt;/em&gt; that are divided on multiple &lt;em&gt;packets&lt;/em&gt; at network layer and each packet on multiple &lt;em&gt;frames&lt;/em&gt; at link level. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each segment travels the network (divided as frames and packets) and is &lt;em&gt;recomposed only at the receiving side&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Between the sending and receiving side could be a lot of intermediate routers. During that transit there could be problems as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One or more frames are discarded.&lt;/li&gt;&#xA;&lt;li&gt;One or more packets get lost.&lt;/li&gt;&#xA;&lt;li&gt;Packets lose their original order.&lt;/li&gt;&#xA;&lt;li&gt;A malfunctioning router modifies the data in a packet&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These problems will pass undetected through the routers until they get to the &lt;em&gt;error control&lt;/em&gt; of the transport layer &lt;em&gt;on the receiving side&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This error control verifies that there wasn't problems on the underneath layers problems and &lt;em&gt;asks for retransmission&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Summary&lt;/strong&gt;: As most of the errors happen on the media, not on network layer (routers, for example) there is a little redundancy, however only Transport layer is under the obligation of asking for retransmission.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-01-22T15:10:26.050" LastActivityDate="2016-01-22T15:10:26.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26177" PostTypeId="1" CreationDate="2016-01-22T10:19:18.427" Score="1" ViewCount="132" Body="&lt;p&gt;How am I able to let my 2 PC over internet see one another as if they are on the same network segment?&lt;/p&gt;&#xA;" OwnerUserId="12182" LastActivityDate="2016-01-22T15:02:59.250" Title="Creating same network segment over internet" Tags="|vlan|vpn|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26178" PostTypeId="2" ParentId="26111" CreationDate="2016-01-22T10:55:06.350" Score="2" Body="&lt;p&gt;You scenario is rather obscure, but I can invent a reason to search for the physical device - no DHCP used + no remote access, some ancient devices etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK, in Cisco terms:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you log into the switch and ping the IP address, afterwards you do&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show arp | include *needed-IP*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and look for the MAC address of that IP. Then&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show mac address-table | include *needed-mac-address*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will show you the port where your device is. If the port turned up to be uplink/downlink to another switch, you go upstream/downstream and do there&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show mac address-table | include *needed-mac-address*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Repeat until found. And when found - alas, tracing cables is your next challenge :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully, you don't have a lot of network devices...&lt;/p&gt;&#xA;" OwnerUserId="21627" LastEditorUserId="8499" LastEditDate="2018-03-10T04:22:11.717" LastActivityDate="2018-03-10T04:22:11.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26179" PostTypeId="2" ParentId="25991" CreationDate="2016-01-22T11:28:07.880" Score="4" Body="&lt;p&gt;Using /31s is specified in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3021&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3021 (Using 31-Bit Prefixes on IPv4 Point-to-Point Links)&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Not all operating systems support this, especially Windows. And there are probably other system out there which do not support this RFC.&lt;/p&gt;&#xA;&lt;p&gt;So using a /31 will not work with every connection and router gives you a friendly warning.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2016-01-22T11:28:07.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26181" PostTypeId="1" CreationDate="2016-01-22T12:28:46.927" Score="5" ViewCount="224" Body="&lt;p&gt;It's time for our company to upgrade our Core switches (2x 6509 Sup720 in VSS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is if we should care about choosing a IOS image which has the certification &quot;Safe Harbor&quot; or not since the newest IOS image for Sup720 with &quot;Safe Harbor&quot; is from 15-MAR-2014 (12.2.33-SXI13), which is quite old.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are currently running 12.2.33-SXI7 which is rather old now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are your experiences with IOS stability when not choosing a &quot;Safe Harbor&quot; certified IOS for a VSS configuration?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We would prefer to jump right into the newest one available: 15.1.2-SY6, do anyone have any good or bad experience with this version in a VSS config that they could share?&lt;/p&gt;&#xA;" OwnerUserId="318" LastActivityDate="2016-01-22T15:00:48.357" Title="Cisco 6500 Series and Safe Harbor Testing" Tags="|cisco|cisco-ios|cisco-catalyst|vss|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26182" PostTypeId="1" AcceptedAnswerId="26184" CreationDate="2016-01-22T13:36:04.543" Score="4" ViewCount="737" Body="&lt;p&gt;I have one doubt, my LAN card is 100Mbps is that including both transmit and receiving bps? OR  100 Mbps of transmitting + 100 Mbps of receiving&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kindly someone clarify this.&lt;/p&gt;&#xA;" OwnerUserId="3415" LastActivityDate="2016-01-22T14:13:15.183" Title="What is 100Mbps in ethernet, is that including both transmit and receiving bps?" Tags="|ethernet|half-duplex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26183" PostTypeId="1" CreationDate="2016-01-22T14:07:18.437" Score="0" ViewCount="326" Body="&lt;p&gt;I look after an HP NNMi instance, a network management station which mainly does SNMP polling to get statistics from network devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been asked if it is possible to get utilisation statistics for a Vlan interface, but my initial investigations have revealed that the normal way to do this results in an SNMP counter sitting at 0 for input octets (ifInOctets), and therefore the ifInUtilizationPct is also sitting at 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the output side, I can at least see some counters are non-zero, but the utilisation one is 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a limitation of SNMP with respect to vlan interfaces, or is this something that can be fixed or worked around?&lt;/p&gt;&#xA;" OwnerUserId="22251" LastActivityDate="2016-02-21T20:00:08.510" Title="How would you get utilisation figures for a Vlan-interface via SNMP specifically on a H3C S12518 switch?" Tags="|vlan|snmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26184" PostTypeId="2" ParentId="26182" CreationDate="2016-01-22T14:13:15.183" Score="4" Body="&lt;p&gt;100BASE-T (fast ethernet over 2 wire pairs) is full duplex, meaning 100Mbit per direction, simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to configure a 100Mbit network interface in half duplex, meaning that the total bandwidth available for send+receive is 100Mbit (as opposed to 200Mbit for full duplex)&lt;/p&gt;&#xA;" OwnerUserId="20964" LastActivityDate="2016-01-22T14:13:15.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26185" PostTypeId="2" ParentId="26177" CreationDate="2016-01-22T14:35:19.290" Score="1" Body="&lt;p&gt;You want a VPN for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The traditional way to do this is to configure your router as a VPN server, then have clients connect to it over the internet using some VPN software. This lets them access hosts in the LAN as if they were on the network locally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A quick and easy alternative is to use some VPN software like hamachi or teamviewer. Both work differently, but will allow two (or more... depending on the software) computers to connect to each other as if on the same network, over the internet.&lt;/p&gt;&#xA;" OwnerUserId="20964" LastActivityDate="2016-01-22T14:35:19.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26186" PostTypeId="2" ParentId="26177" CreationDate="2016-01-22T14:38:12.937" Score="2" Body="&lt;p&gt;You can use VPN for that. It's the best solution. Also, if you need to work into your other PC like if you were seat in front of that, you can try TeamViewer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the other hand, like @Ron Maupin said, if you can control the routing of your organization, or enterprise, whatever, you can create a tunnel accros the internet, eg: GRE, IPsec(this one is a VPN).&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2016-01-22T15:00:43.347" LastActivityDate="2016-01-22T15:00:43.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26187" PostTypeId="2" ParentId="16655" CreationDate="2016-01-22T14:38:48.880" Score="0" Body="&lt;p&gt;The only real control over traffic that you have is traffic on your network, or the traffic leaving your network. You don't have any real control over how fast an outside server sends traffic to your network. That's why DoS attacks work. By the time the traffic reaches your network the WAN bandwidth is already used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are ways to try to mitigate this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;As JoeriBe pointed out, MikroTik has a was to prevent the incoming&#xA;traffic from being delivered to a user, but that doesn't directly&#xA;prevent the WAN bandwidth from be monopolized by the incoming&#xA;traffic, it just prevents the user from receiving all of it. This may&#xA;or may not have any effect. If the incoming traffic is TCP, it can&#xA;have the effect of changing the TCP window size, and that can slow&#xA;down the server to a degree. If the traffic is UDP, it may not&#xA;have any effect at all, except to create problems for the user.&lt;/li&gt;&#xA;&lt;li&gt;You can also come to an agreement with your ISP to limit incoming&#xA;traffic from a single source to a certain percentage of your WAN&#xA;bandwidth. This way, the traffic from a single source cannot&#xA;overwhelm your incoming bandwidth. This is the only sure way, but it&#xA;may cost some money, and you have to decide if it is worth it to your&#xA;business.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-22T18:31:04.913" LastActivityDate="2016-01-22T18:31:04.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26188" PostTypeId="2" ParentId="26177" CreationDate="2016-01-22T14:44:56.107" Score="1" Body="&lt;p&gt;You should be able to create a tunnel from one router to the other to make your two networks look as if they are directly connected. This has the benefit of letting the routing protocols, etc, work over the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to be careful if you have overlapping network addressing at both sites, but there are ways around that which involve NAT. It should only be a temporary solution to give you time to re-address one or both sides to create a common addressing scheme.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-22T15:02:59.250" LastActivityDate="2016-01-22T15:02:59.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26189" PostTypeId="2" ParentId="26181" CreationDate="2016-01-22T15:00:48.357" Score="1" Body="&lt;p&gt;You should never want to update to the latest version just because it is the latest version. In business networks, stability is paramount. The reason for going with a newer version is that it has one or more features which you need which you can't get on the older, more stable version. You need to weigh the the required feature(s) with the possibility of needing to back out of the newer version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why so many companies have labs to thoroughly test something like this. Also, you should ask Cisco for a bug scrub of any new IOS version which you are interested in. There are many time we have looked at newer IOS versions because Cisco added something we want to use, but based on the bug scrub or lab testing, we have decided to wait because there is a bug in the code which causes something we already need to not function properly. Cisco may also have workarounds for such bugs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, a lot of 6500 parts are EoS/EoL. You may want to investigate waiting until you can replace the equipment with newer equipment (e.g., 4500 switches).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-22T15:00:48.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26190" PostTypeId="2" ParentId="24101" CreationDate="2016-01-22T15:04:12.073" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/nexus-7000-series-switches/vidoe_fundamentals_vxlan.html&quot; rel=&quot;nofollow&quot;&gt;VxLAN&lt;/a&gt; can perform what you needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, it's VLAN encapsulation in IP (UDP) packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your routers do not support it you can insert VxLAN gateway in front of them.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-01-22T15:15:46.860" LastActivityDate="2016-01-22T15:15:46.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26191" PostTypeId="1" CreationDate="2016-01-22T16:51:16.273" Score="3" ViewCount="5987" Body="&lt;p&gt;I've found a couple of links (&lt;a href=&quot;http://subnettingmadeeasy.blogspot.com/2009/06/route-maps-and-access-lists.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;easier explanation&lt;/a&gt;, &lt;a href=&quot;http://www.routeralley.com/guides/route_maps.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;more detailed one&lt;/a&gt;) that attempt to explain the concept of access lists and route maps. If I understood correctly, their behaviour largely depends on where and how access lists and route maps are used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I can't grasp the concept of &lt;code&gt;permit&lt;/code&gt;/&lt;code&gt;deny&lt;/code&gt; options.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The route map statements can also be marked with a deny. If the&#xA;  statement is marked as a deny, the packets meeting the match criteria&#xA;  are sent back through the normal forwarding channels (in other words,&#xA;  destination-based routing is performed). Only if the statement is&#xA;  marked as permit and the packets meet the match criteria are all the&#xA;  set clauses applied. If the statement is marked as permit and the&#xA;  packets do not meet the match criteria, then those packets are also&#xA;  forwarded through the normal routing channel.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Okay, that makes sense. But what about this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# access-list 1 permit 10.1.1.0 0.0.0.255&#xA;Router(config)# route-map MYMAP permit 10&#xA;Router(config-route-map)# match ip address 1&#xA;Router(config-route-map)# set ip next-hop 192.168.1.1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is &lt;code&gt;permit&lt;/code&gt; in 1st and 3rd line. If the ip address matched &lt;code&gt;10.1.1.0 0.0.0.255&lt;/code&gt;, then its next hop is set to &lt;code&gt;192.168.1.1&lt;/code&gt;. Fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if I set it to &lt;code&gt;permit&lt;/code&gt;, &lt;code&gt;deny&lt;/code&gt; respectively? Or &lt;code&gt;deny&lt;/code&gt;, &lt;code&gt;permit&lt;/code&gt;? Or &lt;code&gt;deny&lt;/code&gt;, &lt;code&gt;deny&lt;/code&gt;? What would happen in such cases? I'm guessing, that the result after setting both to &lt;code&gt;deny&lt;/code&gt; would be the same as setting both to &lt;code&gt;permit&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22254" LastEditorUserId="20757" LastEditDate="2017-02-16T15:15:49.350" LastActivityDate="2017-02-16T15:15:49.350" Title="How are permit and deny in access lists and route maps evaluated?" Tags="|cisco|routing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26192" PostTypeId="2" ParentId="26191" CreationDate="2016-01-22T17:18:48.070" Score="2" Body="&lt;p&gt;You need to remember that always will be an implicit DENY into every access-list. On the same way, if you put a deny statement onyour route-map, something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xx#ip access-list 10 permit some_ip&#xA;&#xA;xx#route-map TO_EXPLAIN deny 10&#xA;xx(config-route-map)#match ip access-list 10&#xA;xx(config-route-map)#set ip next-hop xyz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this, the route map will never will do nothing 'cause the deny statement. If you want that a route map try to match something, your statement need to be a permit on some way.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-01-22T17:18:48.070" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26193" PostTypeId="2" ParentId="26183" CreationDate="2016-01-22T18:28:16.557" Score="1" Body="&lt;p&gt;I'm not familiar with this specific model, but having no counter incrementation on vlan interfaces is pretty common. It's not so much a limitation of SNMP as a limitation of how the switch itself is built. The ASICs behind the interfaces often do not allow for updating per-vlan counters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also beware that if you look at the standard MIB2 counters, you're usually seeing either physical interfaces or layer 3 Vlan interfaces (SVIs). So even if you were to read a non-zero value there, it would be packets routed to or from that VLAN on layer 3, not packets switched within that VLAN on layer 2.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-22T18:28:16.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26199" PostTypeId="1" AcceptedAnswerId="26201" CreationDate="2016-01-22T20:16:48.403" Score="0" ViewCount="1133" Body="&lt;p&gt;I just bought this router.  All I've done so far is change the default password.  I threw the latest firmware on a USB stick, shoved that in the computer (there is other stuff on the USB stick, and I wasn't sure how the router would deal with it if I put it in the router's USB port), and pointed the firmware update tool at the file. I hit start/OK/whatever it said.  Well, that was a good 30-40 minutes ago, and it's just displaying a barbershop-like sideways progress bar, and the red diag light is flashing on the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this thing dead or do I have to keep waiting?  If it's dead, how do I fix it?  I can't seem to find any info about this online, and I haven't the faintest idea how to ask in Cisco's communities (just keeps telling me access denied when I try to create an account there).&lt;/p&gt;&#xA;" OwnerUserId="22263" LastEditorUserId="8499" LastEditDate="2016-03-22T21:03:22.153" LastActivityDate="2016-08-20T00:15:20.560" Title="How long does a Cisco RV325 firmware update take?" Tags="|cisco|router|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26200" PostTypeId="1" AcceptedAnswerId="26202" CreationDate="2016-01-22T20:25:06.523" Score="0" ViewCount="190" Body="&lt;p&gt;I have the next issue :&#xA;A company has the network ID:192.168.10.0/24 , the company is composed of 10 department. What is the maximum number of the users in each department that can be covered by this address space ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i need to know the way of finding the maximum users step by step in order to finding the solution fot other issues &lt;/p&gt;&#xA;" OwnerUserId="21579" LastActivityDate="2016-01-22T21:05:07.670" Title="finding maximum number of users in department" Tags="|subnet|" AnswerCount="1" CommentCount="6" ClosedDate="2016-01-22T21:33:56.137" ContentLicense="CC BY-SA 3.0" />
  <row Id="26201" PostTypeId="2" ParentId="26199" CreationDate="2016-01-22T20:29:28.040" Score="0" Body="&lt;p&gt;Ah never mind.  I finally discovered how to actually log into their community site (it involves being on the actual main page of the community site and then clicking login from there, and not trying to click the &quot;start discussion&quot; link on the RV325 page).  I have to set the computer's IP address to 192.168.1.100.  And the fix to restarting this process is a hard reset (hold reset 10+ seconds).&lt;/p&gt;&#xA;" OwnerUserId="22263" LastActivityDate="2016-01-22T20:29:28.040" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26202" PostTypeId="2" ParentId="26200" CreationDate="2016-01-22T21:05:07.670" Score="1" Body="&lt;p&gt;You have 192.168.10.0/24 and 10 departments:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firts, i will suppose that you don' t have any requirement about your address space, because i will give you the basic answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to do its subnetting looking 10 different networks&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to remember that there is a rule for that: (2^n) where n is the number of bits&#xA;If you take 3 bits:  8 networks, NOT&#xA;If you take 4 bits: 16 networks, YES&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.0000 0000    the last octet it is in bit notation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;0000&lt;/strong&gt; 0000  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;0001&lt;/strong&gt; 0000    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;0010&lt;/strong&gt; 0000    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;0011&lt;/strong&gt; 0000 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;0100&lt;/strong&gt; 0000    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;0101&lt;/strong&gt; 0000 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;0110&lt;/strong&gt; 0000    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;0111&lt;/strong&gt; 0000&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;1000&lt;/strong&gt; 0000    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;1001&lt;/strong&gt; 0000 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;1010&lt;/strong&gt; 0000    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;1011&lt;/strong&gt; 0000           &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;1100&lt;/strong&gt; 0000    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;1101&lt;/strong&gt; 0000 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;1110&lt;/strong&gt; 0000    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.&lt;strong&gt;1111&lt;/strong&gt; 0000 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The part of the octet that i has  write in bold form, that bits now will be part of network, and ther your mask will move to 28.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On that way, you have your 10 required networks and 6 networks more. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then your network will have 2^n -2 host, cause the first address is your networks address and the last is your broadcast address. Every network will have then 14 hosts.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-01-22T21:05:07.670" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26203" PostTypeId="1" CreationDate="2016-01-22T22:53:53.710" Score="1" ViewCount="626" Body="&lt;p&gt;I am setting up a network in a business. They have five static IP addresses and prefer to keep their point of sale computers on a separate static IP addresses, separate from their customer Wi-Fi and IP camera system IP addresses. I have attached a diagram of the current setup, and I also put the make and model numbers of the hardware. The only thing not on here is the hardware I just ordered to set up public the Wi-Fi hotspots: three Ubiquiti Networks Enterprise AP Unifi (UAP) and TP-LINK TL-R470T Router. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/v9LTj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v9LTj.png&quot; alt=&quot;Network Map&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please advise the best way to set this up for the long run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: the Point of sale is on &lt;em&gt;both&lt;/em&gt; the Front-desk computers, downstairs office computers, and the iPads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is to give first priority Internet bandwidth to the office and front-desk computers, second priority to the camera system and, third priority to the public Wi-Fi hotspots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If additional hardware is needed, please let me know as well.&lt;/p&gt;&#xA;" OwnerUserId="22267" LastEditorUserId="8499" LastEditDate="2016-03-23T02:14:51.917" LastActivityDate="2016-03-23T02:14:51.917" Title="How to should I configure this network with multiple static IP addresses for security and efficiency?" Tags="|router|ip|access-point|" AnswerCount="2" CommentCount="1" ClosedDate="2019-02-12T05:21:06.220" ContentLicense="CC BY-SA 3.0" />
  <row Id="26204" PostTypeId="2" ParentId="26203" CreationDate="2016-01-22T23:05:58.797" Score="0" Body="&lt;p&gt;I'm not sure why they would want the PoS systems to have public addresses since that would be the highest priority to protect. Usually those addresses are reserved for devices which need to be accessed from the public Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you need to configure VLANs and QoS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can trunk a single VLAN for the PoS systems to the switches where the PoS systems are, and not to the other switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can mark the various packets on the switches and queue on the router WAN interface based on your priorities. You can't really control incoming traffic, and that is usually a lot more than the outgoing traffic. Marking on the router will drive up CPU utilization, and it is always best to mark it as close to the source as possible&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-22T23:05:58.797" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26205" PostTypeId="2" ParentId="26203" CreationDate="2016-01-23T01:53:52.380" Score="1" Body="&lt;p&gt;One of your goals should be to logically separate the POS systems, cameras, and other computers.  Create VLANs for each class of device, so that you can filter traffic to each (for example, you don't want your POS systems to be able to talk to cameras, other PCs, public wifi, or the Internet).  If your switches do not support VLANs, that would be the first thing I would upgrade.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-23T01:53:52.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26206" PostTypeId="1" AcceptedAnswerId="26212" CreationDate="2016-01-23T02:22:29.750" Score="2" ViewCount="654" Body="&lt;p&gt;Simple enough, question is in the title. Was trying to find an official document or RFC which designated (or reserved) ffff.ffff.ffff as the Ethernet Broadcast MAC address.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="8499" LastEditDate="2018-03-19T17:56:39.560" LastActivityDate="2018-03-19T17:56:39.560" Title="What document or standard designated ffff.ffff.ffff as the Ethernet Broadcast MAC address?" Tags="|ethernet|layer2|broadcast|standardisation|rfc|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26207" PostTypeId="2" ParentId="26206" CreationDate="2016-01-23T02:24:34.373" Score="4" Body="&lt;p&gt;Figures. I found it minutes after posting. Was looking in the IANA reservations, didn't think to look up the Ethernet RFC specification:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc894&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 894&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Broadcast Address&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The broadcast Internet address (the address on that network with a&#xA;host part of all binary ones) should be mapped to the broadcast&#xA;Ethernet address (of all binary ones, FF-FF-FF-FF-FF-FF hex).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-01-23T02:24:34.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26212" PostTypeId="2" ParentId="26206" CreationDate="2016-01-23T03:17:00.353" Score="3" Body="&lt;p&gt;Eddie is correct, but I think the IEEE 802.3 standard predates the RFC. Unfortunately I can only get the current 802.3 standard, although his answer is a valid answer, regardless of the timing. It is also defined in the 802.3 standard:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;All 1’s in the Destination Address field shall be predefined to be the&#xA;  Broadcast Address. This group shall be predefined for each&#xA;  communication medium to consist of all stations actively connected to&#xA;  that medium; it shall be used to broadcast to all the active stations&#xA;  on that medium. All stations shall be able to recognize the Broadcast&#xA;  Address. It is not necessary that a station be capable of generating&#xA;  the Broadcast Address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Technically, any MAC address with a &lt;code&gt;1&lt;/code&gt; in the I/G bit is a broadcast address, even multicast addresses, which must have that bit set to show it is a group address:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The first bit (LSB) shall be used in the Destination Address field as&#xA;  an address type designation bit to identify the Destination Address&#xA;  either as an individual or as a group address. If this bit is 0, it&#xA;  shall indicate that the address field contains an individual address.&#xA;  If this bit is 1, it shall indicate that the address field contains a&#xA;  group address that identifies none, one or more, or all of the&#xA;  stations connected to the LAN. In the Source Address field, the first&#xA;  bit is reserved and set to 0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-23T03:22:39.887" LastActivityDate="2016-01-23T03:22:39.887" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26213" PostTypeId="1" CreationDate="2016-01-23T03:36:54.977" Score="1" ViewCount="467" Body="&lt;p&gt;working on small LAN for a office, going to use windows server 2012 with AD which ip range is suitable for this. there's like 13pc's &amp;amp; 1 server&lt;/p&gt;&#xA;" OwnerUserId="17723" LastActivityDate="2016-01-23T09:56:47.113" Title="Optimal IP range for private LAN network" Tags="|ipv4|subnet|ip|lan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26214" PostTypeId="2" ParentId="26213" CreationDate="2016-01-23T03:44:33.943" Score="1" Body="&lt;p&gt;Any of the private address ranges are acceptable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.0/8&#xA;172.16.0.0/12&#xA;192.168.0.0/16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which you choose is up to you since any are larger than you need right now, but you may want to think about future growth, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-23T03:44:33.943" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26216" PostTypeId="1" AcceptedAnswerId="26217" CreationDate="2016-01-23T05:15:05.400" Score="0" ViewCount="2090" Body="&lt;p&gt;So I have this nice Cisco RV325 that I was able to set up and get working great with everything internally.  It just won't go external.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic setup:&#xA;- ISP forces me to use a Cisco 860VAE&#xA;- I have the rv325, which has a lot more ports (I need a lot of ports)&#xA;- the 860VAE works fine if I connect it to an Airport Time Capsule (let's call it ATC from now on)&#xA;- they set the 860VAE up for me, wouldn't tell me anything about it, and I know nothing about it at all.  I know not of its settings nor whether I can access them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was given an IP address and a gateway address.  I input these into the ATC, take the GE0 port from the 860VAE and connect it to the WAN port of the ATC, and all works well with the ATC in router mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now let's say I want to use the rv325 (and I do, because I need all those ports, and I like being able to have a configurable router).  I have tried:&#xA;- put in DHCP mode and connect as a client on the ATC (using WAN1 port on RV325 and normal LAN port on ATC).  No connection.  (it says in green that the port is connected but nothing happens.  I cannot talk to the outside world with that router.)  I have done this with another router so I know it can work, but it won't work with THIS router.&#xA;- put ATC in bridge mode. Put rv325 in router mode and input static IP address and gateway address.  No dice.&#xA;- remove ATC and connect directly to 860VAE exactly the same way I connected the ATC (so GE0 to WAN1).  Nothing.&#xA;- connect directly to modem (ISP swore up and down this wouldn't work but I was out of ideas so I tried it).  Nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, the router is in default settings with firmware version 1.2.1.14.  I had initially had all my network set up on it with VLANs and everything and it all worked great other than the fact that I couldn't get outside.  I could access my own servers no problem.  I turned the firewall on and off.  Nothing ever changed (never got access).  Disabled VLAN.  Nothing.  Tried it in one of the 860VAE's LAN ports.  Nothing, but then nothing else works in those, either.  Not even a basic computer.  I hate guessing, because I hate when the ISP gives me zero info, but I am forced to guess that maybe this 860VAE isn't really being a router.  No clue.  Maybe it's in bridge mode.  I have no idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?  I thought for sure that with it in DHCP mode, it would grab an IP address from the ATC and be happy.  But nope!  Why is my ATC working better than the RV325?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, I want to set this up so that it goes:&#xA;modem -&gt; force-fed router -&gt; rv325 -&gt; ATC (for its wifi and built-in hard drive)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can accomplish everything (even get the ATC to bring its drive to the party in bridge mode when hooked up to the rv325) EXCEPT outside access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help!&lt;/p&gt;&#xA;" OwnerUserId="22263" LastActivityDate="2016-08-20T07:26:34.803" Title="can't get internet connection on rv325" Tags="|cisco|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26217" PostTypeId="2" ParentId="26216" CreationDate="2016-01-23T06:07:23.230" Score="1" Body="&lt;p&gt;The answer is to make sure you check all the simple things first, like making sure the power is on and that the computer you're using is configured properly.&lt;/p&gt;&#xA;" OwnerUserId="22263" LastActivityDate="2016-01-23T06:07:23.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26218" PostTypeId="1" AcceptedAnswerId="26229" CreationDate="2016-01-23T07:44:07.377" Score="0" ViewCount="105" Body="&lt;p&gt;I'd like to know if it is possible to determine a user's location with wi-fi and incorporate that into part of the identification, authentication and authorisation mechanism of the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should be relatively easy if there are various different SSID's for varying roles and responsibilities, choosing a specific network to connect to. However, I'd like to use zero-handoff to provide a seamless experience with only one network name, and use the wi-fi to, amongst others:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ensure that if the device connecting is not within the building then&#xA;authentication fails.&lt;/li&gt;&#xA;&lt;li&gt;Determine where in the building information is being accessed from&#xA;and either allow or deny access (i.e. sensitive data from main&#xA;reception would be denied).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I don't know if this is possible or what I should be searching for to find out about any necessary technologies.  I am not a network engineer and my google searches for keywords such as &quot;wifi location based access control&quot; yield nothing of relevance.  Is this possible and what technologies (hardware and software) would be needed to enable it?&lt;/p&gt;&#xA;" OwnerUserId="22275" LastActivityDate="2016-01-23T16:09:58.063" Title="Wifi location based access control" Tags="|wireless|authentication|access-control|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26221" PostTypeId="1" AcceptedAnswerId="26228" CreationDate="2016-01-23T09:40:35.867" Score="3" ViewCount="273" Body="&lt;p&gt;how to implement traceroute without using TTL?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an interview question.&#xA;We all knew Traceroute uses TTL to get the routing path.&#xA;The question is how to implement traceroute without using TTL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="22278" LastActivityDate="2016-01-23T15:56:27.437" Title="how to implement traceroute without using TTL?" Tags="|traceroute|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26222" PostTypeId="2" ParentId="26213" CreationDate="2016-01-23T09:56:47.113" Score="1" Body="&lt;p&gt;As Ron Maupin already mentioned, anything in those three ranges defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt; will be fine, those are assigned for local networks.&lt;/p&gt;&#xA;&lt;p&gt;Personally, I wouldn't pick one of the more obvious ranges like &lt;code&gt;192.168.0.0/24&lt;/code&gt; or &lt;code&gt;10.0.0.0/24&lt;/code&gt; if you ever plan to offer services like VPN for remote workers. Most of the home routers use those by default for their local networks, so it can be wise to stay clear of ranges to prevent an overlap.&lt;/p&gt;&#xA;&lt;p&gt;I'd pick a range from the &lt;code&gt;172.16.0.0/12&lt;/code&gt; network (which seems to be less used in home routers), and not the first &lt;code&gt;/24&lt;/code&gt;, so for example &lt;code&gt;172.31.0.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-01-23T09:56:47.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26224" PostTypeId="1" CreationDate="2016-01-23T10:56:30.917" Score="2" ViewCount="177" Body="&lt;p&gt;After reading the article about &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/26634-bgp-toc.html#synch&quot; rel=&quot;nofollow noreferrer&quot;&gt;synchronization issues in BGP&lt;/a&gt;, I realised there's one thing I don't get.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kptjV.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kptjV.gif&quot; alt=&quot;http://www.cisco.com/c/dam/en/us/support/docs/ip/border-gateway-protocol-bgp/26634-bgp-toc16.gif&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;RTC in AS300 sends updates about 170.10.0.0. RTA and RTB run iBGP, so&#xA;  RTB gets the update and is able to reach 170.10.0.0 via next hop&#xA;  2.2.2.1. Remember that the next hop is carried via iBGP. In order to reach the next hop, RTB must send the traffic to RTE. Assume that RTA&#xA;  has not redistributed network 170.10.0.0 into IGP. At this point, RTE&#xA;  has no idea that 170.10.0.0 even exists. If RTB starts to advertise to&#xA;  AS400 that RTB can reach 170.10.0.0, traffic that comes from RTD to&#xA;  RTB with destination 170.10.0.0 flows in and drops at RTE.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Isn't it the key reason of why people use BGP - the fact that IGP protocols such as OSFP don't need to know about thousands of different networks from other ASes, because BGP routers handles it for them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The article states that RTE, which is an IGP router, should also know about &lt;code&gt;170.10.0.0&lt;/code&gt; advertised to RTA over BGP by RTC. If RTC advertised other prefixes as well, that would mean RTE (IGP router!!) would have to learn them as well so that RTB can communicate with AS300.&lt;/p&gt;&#xA;" OwnerUserId="22254" LastActivityDate="2016-01-23T15:30:00.543" Title="BGP synchronization" Tags="|routing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26226" PostTypeId="2" ParentId="26224" CreationDate="2016-01-23T12:04:45.990" Score="1" Body="&lt;p&gt;You are right to see the problem with RTE. This shows the difference between theory and practice.  This isn't a practical problem for several reasons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;This is a case of an AS being a transit AS.  That is, AS 100 provides connectivity between AS 300 and 400.&lt;/li&gt;&#xA;&lt;li&gt;Many ISPs (who provide transit) run BGP on all their routers, so RTE would also be a BGP speaker.&lt;/li&gt;&#xA;&lt;li&gt;Synchronization is turned off in many cases.&lt;/li&gt;&#xA;&lt;li&gt;The vast majority of ISPs run MPLS in their core.  This is a different paradigm than using an IGP to advertise reachability within the AS.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Ultimately, this isn't much of a problem because network designers have built networks that specifically avoid this issue with IGP and BGP.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-01-23T15:30:00.543" LastActivityDate="2016-01-23T15:30:00.543" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26227" PostTypeId="2" ParentId="26224" CreationDate="2016-01-23T15:23:47.743" Score="0" Body="&lt;p&gt;The problem is routers in AS100 doesn't know anything about 2.2.2.0/30 network, so they can't reach 170.10.0.0 even if they have the route to this network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you can solve this problem in four ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;build full mesh iBGP in AS100 network&lt;/li&gt;&#xA;&lt;li&gt;implement route reflector(s) in AS100 network and establish sessions between RR and every router in AS100&lt;/li&gt;&#xA;&lt;li&gt;use &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/26634-bgp-toc.html#bgpnexthop&quot; rel=&quot;nofollow&quot;&gt;next-hop self&lt;/a&gt; option&lt;/li&gt;&#xA;&lt;li&gt;use MPLS inside AS100&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22283" LastActivityDate="2016-01-23T15:23:47.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26228" PostTypeId="2" ParentId="26221" CreationDate="2016-01-23T15:56:27.437" Score="5" Body="&lt;p&gt;In theory you could send a packet with &lt;a href=&quot;http://www.networksorcery.com/enp/protocol/ip/option007.htm&quot;&gt;IP option 7&lt;/a&gt; set (record route).  This would return the path the packet took to the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice this option is not widely supported, which is exactly why traceroute uses TTL.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-23T15:56:27.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26229" PostTypeId="2" ParentId="26218" CreationDate="2016-01-23T16:09:58.063" Score="1" Body="&lt;p&gt;It is possible, and there are products on the market that do exactly that.  But before you run out and buy one consider:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your ability to control access is dependent on your ability to determine location.  This is in turn dependent on the number of access points you have.  The more access points you have, the more accurate your triangulation is.  But it's still a rather blunt instrument -- unless you're prepared to spend a lot of money and time tuning, you won't do better than 6-10 feet accuracy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This requires a controller-based wireless system.  If you don't have one already, it can get pricey.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are probably easier and cheaper ways to control access.  Understand the risks you face and see if there are other ways to mitigate them.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-23T16:09:58.063" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26232" PostTypeId="1" CreationDate="2016-01-23T21:52:48.583" Score="1" ViewCount="835" Body="&lt;p&gt;I have a Firewall that I need to use to join two different VRFs on service provider PEs.  The EGP of choice is BGP.  I have done a number of tests with different techniques, I have found two solutions that work but I havn't settled on a solution as I don't consider either perfect.  So I am putting this out there as a question with my findings to see if anyone has a better way of doing this. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vrf: Cust-A                         vrf: Cust-B &#xA;   on PE1   \                     /    on PE1&#xA;             \_____ Firewall_____/&#xA;             /                   \&#xA;vrf: Cust-A /                     \ vrf: Cust-B&#xA;   on PE2                              on PE2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the diagram above the PEs are the same PEs.  eg, Customer A and Customer B each have a 'vrf' on the two Service Provider PEs (PE1, and PE2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately the Firewall is not MPLS capable.  So now comes the problem of get BGP to distribute routes between the two MPLS VPNs which share the same AS Number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BGP set local-as&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first attempt was using a local-as on each of the VRFs and the Firewalls.  (So that's three unique AS Numbers) Local-AS actually results in both the real and the local-as number being prepended to the AS-Path.  So BGP loop prevention sees the native AS number and won't install the routes. Juniper (and I presume Cisco) provide an option to not prepend the native-as number and just prepend the local-as number.  However it turns out that that local-as number, (even though it's assigned to just the VRF), is &quot;global&quot; to the BGP process and the Cust-B vrfs will not import routes from Cust-A vrfs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To verify this I found local-as works if Cust-A and Cust-B are on physically separate devices and native-as pre pending is disabled, (tested with Juniper logical instances), however there might be downstream implications within the Service Provider PE cloud that I am unable to test.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;AS-Override&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next tool of choice was AS-Override and surprisingly the Firewall supports AS-Override which I hadn't expected.  By overriding the AS-Path learned from the PEs the routes are successfully passed across the VRFs.  This has a side-effect of creating potential loops, because routes learned from Cust-B-PE1 are readvertised, (with the AS-PATH replaced), to Cust-B-PE2 (and likewise for Cust-A).  In my lab environment this doesn't end up in the routing table only by &quot;luck&quot; that the AS-Path happens to be longer because AS-Override prepends the Native-AS after replacing all instances of the remote-as.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again I can see that this will have downstream problems in the Customer MPLS cloud when a customer is using AS-Path length to determine the route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Loops-In 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally the only option which seems available is Loops-In.  This also works, but suffers from the same problem as AS-Override.  Loops-In has the advantage that the AS-Path is left intact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Strip Private AS&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another gotcha is the use of private-as numbers by Customer CEs.  If Cust-A and Cust-B have overlapping private AS numbers, neither AS-Override or Local-AS will stop the CEs from rejecting the routes and reconfiguring CE devices for loops-in isn't practical.  So this requires the use of the strip-private-as feature on either the Firewall or the VRF instances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Current Solution&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment I have settled on using AS-Override with strip-private-as on the PEs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To stop the potential route looping I am adding a community at the Firewall on the learned routes and ensuring that I don't readvertise this community to any customer VRFs it was learned from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A Better Way&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I am interested in the best way to do this?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be noted that the VRFs have a combination of private IPv4s, public IPv4s and IPv6 addresses.  Any private IPv4s are not redistributed to the Firewalls by the PEs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB: Static routing to the Firewall is not an option.&lt;/p&gt;&#xA;" OwnerUserId="22292" LastActivityDate="2016-01-23T21:52:48.583" Title="Best way to join VRFs using BGP when VRFs are on same PE" Tags="|bgp|vrf|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26233" PostTypeId="1" AcceptedAnswerId="26237" CreationDate="2016-01-23T22:42:33.807" Score="0" ViewCount="174" Body="&lt;h3&gt;Example&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I mean the situation when you have web-host on your&#xA;(sub-net cellular internet android device) &#xA;and try to reach it from your &#xA;(IP static broad-bond internet laptop)&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Problem&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;As we all know a cellular network is sub-net and has internal IP mask types like 10.0.0.1 and so if you try connect to devices on it, you must be in its local-net. In this case it is that same cellular corporation network, and if you even have that selected device external internet IP, yet thousands of devices synchronously supported by that one same IP, because the whole corporation internal network has one external IP, so you can't directly find and reach to selected device.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Contrary Problem&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;But if it's that hard, then why you can even make requests on internet and have working services like http, or have instant messaging on your Android device? That proves you'll get &lt;strong&gt;instant&lt;/strong&gt; answers from the out-sided hosts right after you ask something, that means there is no flag determining system that continuously check you in some queue, and alert you to collect your host-sent answers, indeed you have real direct mutual link between you and out-sided hosts.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;My Weak Answer&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;By every request you'll make to internet, your net router stamps your internal IP on header of its own-self external IP, so the called host have your both networks external internetal IP and your device's internal sub-netal IP. In order to allow direct access, so to have a direct link between you and the out-sided host, you have to make the request first to define your complete external internal IP to that host.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Real Problem Is&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;How do I address that device in my laptop internet browser? Is that like this ===&gt; 233.186.15.78:10.0.2.6:80?&lt;/p&gt;&#xA;" OwnerUserId="22293" LastEditorDisplayName="user10222" LastEditDate="2016-06-22T14:29:59.517" LastActivityDate="2016-06-22T14:29:59.517" Title="How to connect to a sub-net device from internet? Is it possible?" Tags="|subnet|internet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26235" PostTypeId="1" CreationDate="2016-01-23T23:37:32.517" Score="2" ViewCount="140" Body="&lt;p&gt;I understand how the layer works to an extent, but cannot seem to figure out if the data link handles big frames more efficiently due to error detection or small frames better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming from my understanding that the data link works better with small frames as it can save time by not having to keep retransmitting larger frames when an error is detected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this reasoning correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Have not used stackexchange in a long while so apologies if these type of questions are no longer permitted&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="22296" LastActivityDate="2016-01-24T01:10:08.520" Title="In the Data Link Layer, is it better to use large or small frames?" Tags="|layer2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26237" PostTypeId="2" ParentId="26233" CreationDate="2016-01-24T00:59:02.527" Score="1" Body="&lt;p&gt;You are never going to be able to route private addresses on the public Internet. When you write, &quot;&lt;em&gt;the cellular network is sub-net and have internal ip mask types like 10.0.0.1&lt;/em&gt;,&quot; I think you mean that the mobile carriers use NAT to give clients private addresses, which cannot be routed on the public Internet, and must be translated to public addresses as they pass through the carrier's NAT router. The problem is that the translation forces the translated client to initiate since the public address is shared among many carrier clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP packet headers only have two address fields, source and destination, so there is no native IP solution to your problem. Fortunately, there is a solution to your problem which is not too far off from you idea. It is called tunneling. Tunneling encapsulates an IP packet within another IP packet. When the packet address is translated by the carrier NAT router, it is only the outer packet address which is changed. This presents some other challenges, too, since the native addressing on the networks at each end of the tunnel could be the same private networks, but there are ways around that, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many tunnel solutions, and what you most commonly find is called VPN (Virtual Private Network). There are VPN solutions for mobile phones and PCs. Some are just software on the host, some are on the edge routers, some use Internet servers, and some are combinations of any of the above.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-24T00:59:02.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26238" PostTypeId="2" ParentId="26235" CreationDate="2016-01-24T01:10:08.520" Score="1" Body="&lt;p&gt;Ethernet has no facility for error corrections or re-transmission when errors are detected. Any frames with errors are discarded immediately. Upper-layer protocols, such as TCP, must handle any missing datagrams and ask that they be re-transmitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Networks generally assume it is better to drop traffic as soon as possible. Some transport protocols, such as UDP, have no expectation that anything sent will be received, and some applications, such as VoIP or video, are tolerant of some missing data since it would be much more disruptive to ask for the missing data to be resent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The size of the layer-2 frame is only important in that it be at least as large as the minimum frame size, and no larger than the maximum frame size. You seem to be suggesting something which has been often debated about the transport segment size, especially when it comes to UDP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-24T01:10:08.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26239" PostTypeId="1" AcceptedAnswerId="26240" CreationDate="2016-01-24T01:44:12.503" Score="2" ViewCount="494" Body="&lt;p&gt;I'm reading a text (possibly outdated) and it states that large amounts of Layer 2 broadcast can degrade the performance of the workstations on the network - due to CPU interrupts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible for the network card to handle the interrupt? Or does the OS always have to get involved?&lt;/p&gt;&#xA;" OwnerUserId="22298" LastEditorUserId="8499" LastEditDate="2018-03-18T21:21:06.030" LastActivityDate="2018-03-18T21:21:06.030" Title="How are layer 2 broadcast handled" Tags="|ethernet|layer2|broadcast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26240" PostTypeId="2" ParentId="26239" CreationDate="2016-01-24T02:40:47.840" Score="2" Body="&lt;p&gt;A broadcast must be passed to the upper layers in order to evaluate it to see if it is relevant for the host, and that needs to be handled in software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Broadcasts do have an effect on host performance, but not as much as before since we now have faster and multi-core CPUs. Broadcasts also use, possibly unnecessarily, bandwidth, but we also have faster networks. Faster processors and faster networks could also mean more broadcasts, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is still a very good practice to limit the size of the broadcast domain. It used to be, &quot;Switch where you can, route where you must.&quot; That is no longer strictly true, and an emerging best practice is to use layer-3 switches, instead of layer-2 switches, as access switches. This eliminates problems with things like spanning tree, and allows more granular layer-3 security features. Very few thing we use today depend on hosts being on the same layer-2 network; we live in a layer-3 world.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-24T02:40:47.840" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26241" PostTypeId="2" ParentId="26239" CreationDate="2016-01-24T02:41:42.153" Score="1" Body="&lt;p&gt;Network stack offloading provides a mechanism for the NIC hardware to handle the partial or full stack.  Broadcasts are CPU-interrupt wasteful without offloading as the stack needs to process the packet to determine the destination IP is not its own.  With offloading, this can be done without involving the CPU.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2016-01-24T02:41:42.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26242" PostTypeId="1" AcceptedAnswerId="26243" CreationDate="2016-01-24T06:11:19.950" Score="2" ViewCount="366" Body="&lt;pre&gt;&lt;code&gt;    10.0.10.0/24      10.0.11.0/24      192.168.178.0/24     &#xA;R1 ╚════════════╝ R2 ╚════════════╝ R3 ╚════ R3 LAN ════╝ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In OSPF each router knows the full topology, so it uses the Dijkstra algorithm to calculate the path to the destination. But in EIGRP (and any other distance vector routing protocol I believe), routers only know about routes to their neighbours. How will R1 know how to reach &lt;code&gt;192.168.178.0/24&lt;/code&gt;, when this is  not a neighbour network? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The EIGRP and distance vector routing protocol tutorials I've studied do not seem to cover this.&lt;/p&gt;&#xA;" OwnerUserId="13978" LastEditorUserId="13978" LastEditDate="2016-01-24T06:16:55.343" LastActivityDate="2016-02-12T11:42:53.440" Title="How does EIGRP determine the path to far away destinations?" Tags="|eigrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26243" PostTypeId="2" ParentId="26242" CreationDate="2016-01-24T06:26:41.610" Score="4" Body="&lt;p&gt;There seems to be a confusion here : in a distance-vector routing protocol, the routers don't just get routes to their neighbors (which would be trivial in most cases) they get their neighbor's full routing table. A router can then compare the various routes it has gotten from its neighbors for a given destination network and select which appears to be the shortest to add to its own table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in your example, R2 receives R3's routing table, and will update its own table accordingly, with a route to 192.168.178.0/24, and then pass that on to R1 as part of its own routing table.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-24T06:26:41.610" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26248" PostTypeId="1" CreationDate="2016-01-24T15:50:36.753" Score="3" ViewCount="1960" Body="&lt;p&gt;I am benchmarking multicast throughput of my LAN using an application that considers all the servers as group members.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network consists of homogeneous servers (S0-S9: 192.168.21.70-79) inter-connected by gigabit switch (DELL powerconnect 5448) with multicast ip: 239.0.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything was working well until I decided to split the LAN into two independent LANs: S0-S4 on the first switch with multicast ip: 239.0.0.10 and S5-S9 on the second one with multicast ip: 239.0.0.11 where the two switches are connected via an uplink cable. After running the application on each group simultaneously, the throughput of each group drops down (almost to the half).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Noting that switches are upgraded and configured correctly. The two groups are now using IGMP snooping and querier and filtering bridge multicast messages. One of them is using IGMPv3. From servers side of view, non-concerned servers aren't receiving messages at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a conclusion, switches are forwarding multicast messages to all ports interiorly, while non-concerned ports are blocking them from being transmitted over cables. Am i right? Is there something I have missed?&lt;/p&gt;&#xA;" OwnerUserId="13402" LastEditorUserId="8499" LastEditDate="2018-03-19T15:40:46.943" LastActivityDate="2018-03-19T15:40:46.943" Title="How do switches behave on multicast?" Tags="|switch|lan|multicast|throughput|igmp|" AnswerCount="0" CommentCount="9" ClosedDate="2019-12-19T09:01:23.697" ContentLicense="CC BY-SA 3.0" />
  <row Id="26249" PostTypeId="1" CreationDate="2016-01-24T19:46:01.917" Score="0" ViewCount="493" Body="&lt;p&gt;There is not much enough details about SDN-based firewalls so I've been searching about that and lately I saw this &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/25995/firewall-policies-vs-firewall-rules&quot;&gt;post&lt;/a&gt;. In fact, some papers use both terms &lt;code&gt;flow policy&lt;/code&gt; and &lt;code&gt;firewall policy&lt;/code&gt; without giving a distinction between them to the reader witch confuses me a bit. After a long research, I've come up with the following distinction that I would like to discuss it with this community:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Firewall policies are usually installed &lt;strong&gt;proactively&lt;/strong&gt; by the network&#xA;  operator. In contrast, flow policies are installed &lt;strong&gt;reactively&lt;/strong&gt; by&#xA;  the controller after receiving a Packet-In message from the&#xA;  OpenFlow-based switch to handle the new flow. As a result, the&#xA;  controller create a new flow rule to be installed in the&#xA;  OpenFlow-nased switch and install a new flow policy in the firewall&#xA;  (If no violation occurs).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'd like to discuss with you about my finding if it is reasonable or not. If not, kindly give us an explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="22225" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-05-24T20:50:53.420" Title="Firewall policy and Flow policy in SDN" Tags="|cisco|sdn|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26252" PostTypeId="1" AcceptedAnswerId="26253" CreationDate="2016-01-24T22:11:18.513" Score="5" ViewCount="535" Body="&lt;p&gt;OSPF has an administrative distance of 110&lt;BR /&gt;&#xA;EIGRP has an administrative distance of 90&lt;BR /&gt;&#xA;RIP has an administrative distance of 120&lt;BR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But where did &lt;strong&gt;110&lt;/strong&gt;, &lt;strong&gt;90&lt;/strong&gt;, and &lt;strong&gt;120&lt;/strong&gt; come from?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Who or what entity decided the Administrative Distance values for&#xA;each of these (and all other) protocols? &lt;/li&gt;&#xA;&lt;li&gt;What document or RFC were&#xA;these values established in?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-01-24T22:18:27.747" Title="Who decided the Admin Distance Values for each protocol?" Tags="|routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26253" PostTypeId="2" ParentId="26252" CreationDate="2016-01-24T22:18:27.747" Score="2" Body="&lt;p&gt;Since AD is only local to a router, not affecting any other router, it would be the router vendors. AD is not sent to any other device; it is only used to determine which route is best in the local router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Certainly Cisco decided EIGRP should be more trustworthy than the other protocols.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-24T22:18:27.747" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26254" PostTypeId="2" ParentId="26249" CreationDate="2016-01-25T00:53:50.370" Score="2" Body="&lt;p&gt;Most of the networking terms we use -- &quot;firewall&quot;, &quot;switch&quot;,&quot;SDN&quot;,&quot;IDS&quot;,etc., are made up by equipment manufacturers as they introduce new products, and are gradually accepted by the community.  There is no technical or authoritative definition for any of them.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The distinction you make is fine as far as it goes, but don't expect everyone to follow along, especially if some company has a something that they call a firewall that reacts to in-packet messages.  There will always be attempts to blur or combine distinctions.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-25T00:53:50.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26256" PostTypeId="1" AcceptedAnswerId="26265" CreationDate="2016-01-25T01:03:27.243" Score="2" ViewCount="1982" Body="&lt;p&gt;Since NIC card receives data from memory in parallel, does it perform the transmission over the link serially? if yes, how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="20185" LastActivityDate="2022-12-15T06:30:25.100" Title="NIC transmission is serial or parallel" Tags="|cisco|ethernet|line-card|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26261" PostTypeId="1" CreationDate="2016-01-25T10:34:46.350" Score="1" ViewCount="2166" Body="&lt;p&gt;I have 2 cisco ASA 5512 units (security plus license) in an Active / Standby HA Failover cluster (I've tested both stateful and stateless failover unsuccessfully).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both units are connected (over a switching path) to a VRRP - enabled gateway, set up by our hosting center provider where the units are installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only one unit can be active (and retain the active state) in a stable way at a given time - meaning that as soon as I attempt to manually trigger failover from the currently active unit to the standby unit, the standby unit (gaining the ACTIVE role) will not be able to route traffic and will fall back to the standby role automatically within minutes - the standby unit is not able to retain stably the active state (even if L3 connectivity should be available, according to the hosting center statement).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This scenario happens with Stateful Active / standby failover as well as with stateless Active / standby failover.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is also interesting is that the 2 units are configured with 2 public IPs, namely X.X.X.1 and X.X.X.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At time t0 (before manual failover is triggered) -&gt; both Public IPs are reachable and PRIMARY Unit is Active&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At time t1 -&gt; manual failover is triggered and X.X.X.1 is no longer reachable (assigned to the SECONDARY unit now ACTIVE) -&gt; X.X.X.2 is assigned to the PRIMARY unit and is 100 % reachable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;at time t2 -&gt; cluster realizes that cannot route traffic via the SECONDARY unit and falls back to the former scenario (PRIMARY unit is ACTIVE and SECONDARY unit is STANDBY) -&gt; X.X.X.2 is no longer reachable; X.X.X.1 is again reachable;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;at time t2 + approx. 30 minutes -&gt; X.X.X.2 becomes again reachable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2 units outside interfaces are connected to the same segment with VRRP settings. According to the hosting site, there are no particular L2 settings in place concerning L2 ports connectivity upstream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like the cluster is able to route traffic (in a stable way, that is with the unit staying permanently in &quot;Active&quot; status) only when connected to one of the 2 VRRP enabled ports - the behavior described above happens no matter which ASA is connected to THAT port, and always follows the same pattern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hosting center has checked the VRRP settings (as well as L2 / switching path) and wasn't able to find any significant issues that might justify this behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of Stateful failover, I've also observed several &quot;Route Session&quot; errors in the LU updates exchanged between the 2 ASAs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on the PRIMARY ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA-fw# show failover&amp;lt;br/&amp;gt;&#xA;Failover On&amp;lt;br/&amp;gt;&#xA;Failover unit Primary&amp;lt;br/&amp;gt;&#xA;Failover LAN Interface: failover GigabitEthernet0/5 (up)&amp;lt;br/&amp;gt;&#xA;Unit Poll frequency 3 seconds, holdtime 10 seconds&amp;lt;br/&amp;gt;&#xA;Interface Poll frequency 3 seconds, holdtime 15 seconds&amp;lt;br/&amp;gt;&#xA;Interface Policy 1&amp;lt;br/&amp;gt;&#xA;Monitored Interfaces 3 of 114 maximum&amp;lt;br/&amp;gt;&#xA;failover replication http&amp;lt;br/&amp;gt;&#xA;Version: Ours 9.1(1), Mate 9.1(1)&amp;lt;br/&amp;gt;&#xA;Last Failover at: 09:14:07 UTC Jan 25 2016&amp;lt;br/&amp;gt;&#xA;        This host: Primary - Active&amp;lt;br/&amp;gt;&#xA;                Active time: 415235 (sec)&amp;lt;br/&amp;gt;&#xA;                slot 0: ASA5512 hw/sw rev (1.0/9.1(1)) status (Up Sys)&amp;lt;br/&amp;gt;&#xA;                  Interface outside (X.X.X.195): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;                  Interface inside (192.168.1.1): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;                  Interface management (192.168.99.1): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;        Other host: Secondary - Standby Ready&amp;lt;br/&amp;gt;&#xA;                Active time: 3090024 (sec)&amp;lt;br/&amp;gt;&#xA;                slot 0: ASA5512 hw/sw rev (1.0/9.1(1)) status (Up Sys)&amp;lt;br/&amp;gt;&#xA;                  Interface outside (X.X.X.200): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;                  Interface inside (192.168.1.3): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;                  Interface management (192.168.99.2): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;&amp;lt;br/&amp;gt;&#xA;Stateful Failover Logical Update Statistics&amp;lt;br/&amp;gt;&#xA;        Link : failover GigabitEthernet0/5 (up)&amp;lt;br/&amp;gt;&#xA;        Stateful Obj    xmit       xerr       rcv        rerr&amp;lt;br/&amp;gt;&#xA;        General         1518905    0          56441      9&amp;lt;br/&amp;gt;&#xA;        sys cmd         54791      0          54790      0&amp;lt;br/&amp;gt;&#xA;        up time         0          0          0          0&amp;lt;br/&amp;gt;&#xA;        RPC services    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        TCP conn        1126177    0          156        0&amp;lt;br/&amp;gt;&#xA;        UDP conn        140986     0          889        0&amp;lt;br/&amp;gt;&#xA;        ARP tbl         190094     0          606        0&amp;lt;br/&amp;gt;&#xA;        Xlate_Timeout   0          0          0          0&amp;lt;br/&amp;gt;&#xA;        IPv6 ND tbl     0          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN IKEv1 SA    4          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN IKEv1 P2    8          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN IKEv2 SA    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN IKEv2 P2    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN CTCP upd    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN SDI upd     0          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN DHCP upd    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        SIP Session     0          0          0          0&amp;lt;br/&amp;gt;&#xA;        Route Session   6842       0          0          9&amp;lt;br/&amp;gt;&#xA;        User-Identity   3          0          0          0&amp;lt;br/&amp;gt;&#xA;        CTS SGTNAME     0          0          0          0&amp;lt;br/&amp;gt;&#xA;        CTS PAC         0          0          0          0&amp;lt;br/&amp;gt;&#xA;        TrustSec-SXP    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        IPv6 Route      0          0          0          0&amp;lt;br/&amp;gt;&#xA;&amp;lt;br/&amp;gt;&#xA;        Logical Update Queue Information&amp;lt;br/&amp;gt;&#xA;                        Cur     Max     Total&amp;lt;br/&amp;gt;&#xA;        Recv Q:         0       12      135522&amp;lt;br/&amp;gt;&#xA;        Xmit Q:         0       31      1717200&amp;lt;br/&amp;gt;&#xA;&amp;lt;br/&amp;gt;&#xA;ASA-fw#&amp;lt;br/&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on the SECONDARY ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA-fw# show failover&amp;lt;br/&amp;gt;&#xA;Failover On&amp;lt;br/&amp;gt;&#xA;Failover unit Secondary&amp;lt;br/&amp;gt;&#xA;Failover LAN Interface: failover GigabitEthernet0/5 (up)&amp;lt;br/&amp;gt;&#xA;Unit Poll frequency 3 seconds, holdtime 10 seconds&amp;lt;br/&amp;gt;&#xA;Interface Poll frequency 3 seconds, holdtime 15 seconds&amp;lt;br/&amp;gt;&#xA;Interface Policy 1&amp;lt;br/&amp;gt;&#xA;Monitored Interfaces 3 of 114 maximum&amp;lt;br/&amp;gt;&#xA;failover replication http&amp;lt;br/&amp;gt;&#xA;Version: Ours 9.1(1), Mate 9.1(1)&amp;lt;br/&amp;gt;&#xA;Last Failover at: 09:14:07 UTC Jan 25 2016&amp;lt;br/&amp;gt;&#xA;        This host: Secondary - Standby Ready&amp;lt;br/&amp;gt;&#xA;                Active time: 3090024 (sec)&amp;lt;br/&amp;gt;&#xA;                slot 0: ASA5512 hw/sw rev (1.0/9.1(1)) status (Up Sys)&amp;lt;br/&amp;gt;&#xA;                  Interface outside (X.X.X.200): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;                  Interface inside (192.168.1.3): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;                  Interface management (192.168.99.2): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;        Other host: Primary - Active&amp;lt;br/&amp;gt;&#xA;                Active time: 415193 (sec)&amp;lt;br/&amp;gt;&#xA;                slot 0: ASA5512 hw/sw rev (1.0/9.1(1)) status (Up Sys)&amp;lt;br/&amp;gt;&#xA;                  Interface outside (X.X.X.195): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;                  Interface inside (192.168.1.1): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;                  Interface management (192.168.99.1): Normal (Monitored)&amp;lt;br/&amp;gt;&#xA;&#xA;Stateful Failover Logical Update Statistics&amp;lt;br/&amp;gt;&#xA;        Link : failover GigabitEthernet0/5 (up)&amp;lt;br/&amp;gt;&#xA;        Stateful Obj    xmit       xerr       rcv        rerr&amp;lt;br/&amp;gt;&#xA;        General         408964     0          1527527    6852&amp;lt;br/&amp;gt;&#xA;        sys cmd         69155      0          69153      0&amp;lt;br/&amp;gt;&#xA;        up time         0          0          0          0&amp;lt;br/&amp;gt;&#xA;        RPC services    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        TCP conn        258657     0          1127204    0&amp;lt;br/&amp;gt;&#xA;        UDP conn        34851      0          140988     0&amp;lt;br/&amp;gt;&#xA;        ARP tbl         44206      0          190171     0&amp;lt;br/&amp;gt;&#xA;        Xlate_Timeout   0          0          0          0&amp;lt;br/&amp;gt;&#xA;        IPv6 ND tbl     0          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN IKEv1 SA    30         0          4          0&amp;lt;br/&amp;gt;&#xA;        VPN IKEv1 P2    8          0          4          0&amp;lt;br/&amp;gt;&#xA;        VPN IKEv2 SA    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN IKEv2 P2    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN CTCP upd    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN SDI upd     0          0          0          0&amp;lt;br/&amp;gt;&#xA;        VPN DHCP upd    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        SIP Session     0          0          0          0&amp;lt;br/&amp;gt;&#xA;        Route Session   2010       0          0          6852&amp;lt;br/&amp;gt;&#xA;        User-Identity   47         0          3          0&amp;lt;br/&amp;gt;&#xA;        CTS SGTNAME     0          0          0          0&amp;lt;br/&amp;gt;&#xA;        CTS PAC         0          0          0          0&amp;lt;br/&amp;gt;&#xA;        TrustSec-SXP    0          0          0          0&amp;lt;br/&amp;gt;&#xA;        IPv6 Route      0          0          0          0&amp;lt;br/&amp;gt;&#xA;&amp;lt;br/&amp;gt;&#xA;        Logical Update Queue Information&amp;lt;br/&amp;gt;&#xA;                        Cur     Max     Total&amp;lt;br/&amp;gt;&#xA;        Recv Q:         0       20      1811827&amp;lt;br/&amp;gt;&#xA;        Xmit Q:         0       30      466771&amp;lt;br/&amp;gt;&#xA;&amp;lt;br/&amp;gt;&#xA;ASA-fw#&amp;lt;br/&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I was wondering if there are some debugs that might assist me in troubleshooting this issue and possibly help in identifying Hosting center related misconfig - issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I wanted to ask details on the &quot;Route Session&quot; entry and the impact of several xerr/rerr in this field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, could this be a SW bug ? I read on cisco's website of several bugs for ASA clustering under 9.1(1) release:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/release/notes/asarn91.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/release/notes/asarn91.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16189" LastEditorUserId="2142" LastEditDate="2016-01-25T12:50:00.197" LastActivityDate="2016-08-30T17:45:06.737" Title="Cisco ASA 5512 (OS 9.1(1)) HA failover issues" Tags="|cisco|cisco-asa|failover|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26262" PostTypeId="1" AcceptedAnswerId="26264" CreationDate="2016-01-25T11:41:59.940" Score="1" ViewCount="151" Body="&lt;p&gt;This is the first time im tackling a project which involves BGP routing and I have the general idea what it is, but my problem is I would need someone to suggest me on which platform BGP is best implemented, would it be NS2 or NS3 (as i read NS3 is the latest so it would seem not much helpful guidelines be published rather than ns2) or maybe there another way rather than using them and i would like to know how to properly setup its environment as well. &#xA;Just to be clear i am quite new to this and i would love to learn more about this stuff.Thank you.&lt;/p&gt;&#xA;" OwnerUserId="22326" LastActivityDate="2016-01-25T13:52:08.993" Title="Guidelines Needed for BGP Implementation" Tags="|routing|bgp|" AnswerCount="1" CommentCount="3" ClosedDate="2019-03-28T18:58:31.487" ContentLicense="CC BY-SA 3.0" />
  <row Id="26264" PostTypeId="2" ParentId="26262" CreationDate="2016-01-25T13:52:08.993" Score="3" Body="&lt;p&gt;As NS3 is built to replace NS2 it would seem to make sense to use NS3 for a completely new project. There are a number of legacy problem with NS2 that NS3 is set to resolve. However as more people are familiar with NS2 finding support will be easier in the short term, but this is a very short sighted view as this paradigm will soon change with the tide. If your project is new and you plan to support it long term NS3 would seem like the better option. Here is a short comparison of the two:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wrc-ejust.org/crn/images/Tutorials/ns2vsns3.pdf&quot; rel=&quot;nofollow&quot;&gt;http://wrc-ejust.org/crn/images/Tutorials/ns2vsns3.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5034" LastActivityDate="2016-01-25T13:52:08.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26265" PostTypeId="2" ParentId="26256" CreationDate="2016-01-25T14:12:15.713" Score="2" Body="&lt;p&gt;If you think about it you already know the answer. To spur you along it is easier to think of optical cabling than copper to think through the example. With optical cabling there is one core for Tx, and one for Rx. This alone should be enough to answer your question, but with Wave division multiplexing it muddies the waters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In answer to your question all information sent across an Ethernet network is sent serially. Multiplexing of any sort is sending multiple serial communications over the one core and is done by sending different channels over different wavelengths of light. However a fibre connection from an end device such as a server will generally only use one wavelength (e.g. 850nM for SX) to send all data serially over the wire. The same is true for copper connections. For up to FastEthernet 4 wires are needed as you have one pair for TX and another pair for Rx as they are electrically balanced. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gigabit Ethernet over copper is slightly different as the signals are modulated over what is known as 4D-PAM5. What this means is that there are 4 signals over 5 voltages and 2 bits are sent at a time, however this is still classed as serial transmission, only with more information density.&#xA;&lt;a href=&quot;http://www.hardwaresecrets.com/how-gigabit-ethernet-works/&quot; rel=&quot;nofollow&quot;&gt;http://www.hardwaresecrets.com/how-gigabit-ethernet-works/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5034" LastActivityDate="2016-01-25T14:12:15.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26266" PostTypeId="1" AcceptedAnswerId="26267" CreationDate="2016-01-25T14:18:43.463" Score="1" ViewCount="52" Body="&lt;p&gt;I need two bond ADSL+ modem with cable modem router at the office so I don't have to switch the line everytime one of them is offline, is there any software/hardware that allows me to bond two physical conections into one at my router, so everyone at the LAN is getting the two of em without having to reconfigure everything?&lt;/p&gt;&#xA;" OwnerUserId="15521" LastActivityDate="2016-01-25T14:25:57.053" Title="Bond ADSL+ line with Cable Modem line in one single router" Tags="|cable|adsl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26267" PostTypeId="2" ParentId="26266" CreationDate="2016-01-25T14:25:57.053" Score="1" Body="&lt;p&gt;I am assuming the two links are from different ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need a router with at least three interface (one for your LAN, one for each of your WAN connections).  Cisco has a feature called Optimized Edge Routing, which lets the router test each path and then choose the one with the best performance.  So it will automatically switch if one path goes down. Other manufacturers have similar features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't &quot;bond&quot; the two links, because that will cause out of order packets and reduce your performance.  You will use one or the other link, depending on the performance of each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming the two links are from different ISPs.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-25T14:25:57.053" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26268" PostTypeId="1" AcceptedAnswerId="26270" CreationDate="2016-01-25T16:00:26.467" Score="1" ViewCount="30676" Body="&lt;p&gt;I was asked this by a friend. His company is trying to set up some sort of a network where all their branches around the world can connect. They want to know if there are any laws in my country associated with &quot;Internet Breakout&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He is a lawyer at the said place and since he has no idea about technology, he asked me. I have no idea what on god's name he's talking about since I am not a networking guy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did try searching around google for what &quot;Internet Breakout&quot; is, but I have no idea how to explain this to my friend. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone could give me a quick summary of what an internet breakout is in a company network, or point me to a resource that would explain it. I would be really appreciate it.  &lt;/p&gt;&#xA;" OwnerUserId="22329" LastActivityDate="2016-01-25T20:57:25.677" Title="What is an &quot;Internet breakout&quot;" Tags="|vpn|mpls|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26270" PostTypeId="2" ParentId="26268" CreationDate="2016-01-25T17:16:37.200" Score="4" Body="&lt;p&gt;In many large networks that span nationally or globally, all traffic including Internet traffic, flows from remote sites to a central hub, such as a data center, where Internet traffic then leaves the organization via an ISP.  The advantage of this is the organization can apply security policies, filter for malware, &lt;em&gt;etc.&lt;/em&gt;, from a single, central location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast, some organizations allow Internet traffic to leave the corporate network at the remote site, via a locally connected ISP. This is known as an &quot;Internet breakout.&quot;  The advantage of this is all the Internet traffic does not need to be carried to the central site, saving on bandwidth, and the local ISP may offer cheaper pricing than the central site.   The downside is that Internet filtering and malware protection must be placed at the remote site's ISP connection as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll let someone else speak to the legal issues involving transnational Internet traffic.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-25T17:16:37.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26272" PostTypeId="1" CreationDate="2016-01-25T18:56:47.253" Score="1" ViewCount="155" Body="&lt;p&gt;Nowadays, most smartphones (or other smart mobiles) have some kind of wireless communication for short range and medium range. For short range, the most widespread technology in use is, probably, WiFi:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;standard: IEEE 802.11&lt;/li&gt;&#xA;&lt;li&gt;indoor range: 15m&lt;/li&gt;&#xA;&lt;li&gt;outdoor range: 40m&lt;/li&gt;&#xA;&lt;li&gt;frequency: 2.4GHz&lt;/li&gt;&#xA;&lt;li&gt;power consumption: 100mW&lt;/li&gt;&#xA;&lt;li&gt;throughput: 5Mbps&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For medium range, the most widespread technology in use is, probably, GSM:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;standard: ETSI GSM&lt;/li&gt;&#xA;&lt;li&gt;urban range: 500m&lt;/li&gt;&#xA;&lt;li&gt;frequency: 1500MHz&lt;/li&gt;&#xA;&lt;li&gt;power consumption: 1W&lt;/li&gt;&#xA;&lt;li&gt;throughput: 300kbps&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The differences between such technologies are mainly due to the communication protocols and the operating frequencies. Each one optimized for its own specifications.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1st Issue&lt;/strong&gt;&lt;br&gt;&#xA;Sometimes, when a technology has several updates and add-ons (as is in this case), it is not that easy to develop a simple comparison table. Therefore, does the simplified comparison above make sense or is it too unrealistic?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2nd Issue&lt;/strong&gt;&lt;br&gt;&#xA;It is well know that software developers can use WiFi features to transfer packets directly between mobiles. However, if you want to increase the range, is there any hardware constraint that would undermine using the GSM radio module (or other widespread mobile wireless technology for medium range) to transfer packets directly between smart mobiles?  &lt;/p&gt;&#xA;" OwnerUserId="20647" LastActivityDate="2016-01-25T19:51:29.437" Title="Mobile Wireless Technology" Tags="|wireless|mobile|" AnswerCount="1" CommentCount="17" ContentLicense="CC BY-SA 3.0" />
  <row Id="26274" PostTypeId="2" ParentId="26272" CreationDate="2016-01-25T19:51:29.437" Score="1" Body="&lt;p&gt;I'm not sure if you can use GSM in a peer to peer manner; but even if you would devise a way to do it in software (that is, rewrite the firmware in a GSM radio or such), I'd guess the range would not be as if you're communicating via a BTS, as both sides would be using poor, built-in antenna.&lt;/p&gt;&#xA;" OwnerUserId="22334" LastActivityDate="2016-01-25T19:51:29.437" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="26276" PostTypeId="1" AcceptedAnswerId="26278" CreationDate="2016-01-25T20:56:15.347" Score="1" ViewCount="54" Body="&lt;p&gt;Theoretically we know CSMA-CD waits random period of time before re-transmit .&#xA;What is the main purpose of  this ?&lt;/p&gt;&#xA;" OwnerUserId="21873" LastActivityDate="2016-01-25T21:06:23.810" Title="CSMA-CD waits a random period of time before re-transmitting" Tags="|ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26277" PostTypeId="2" ParentId="26268" CreationDate="2016-01-25T20:57:25.677" Score="3" Body="&lt;p&gt;In addition to Ron Trunk's answer, I might add that there are now SaaS-style solutions that put proxy/web filtering functionality in cloud nodes distributed worldwide. This allows you to have centrally-controlled security, but decentralized access which avoids backhauling Internet traffic across your MPLS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you would implement a cheap Internet link on each site, and use it to send traffic to the cloud node, where it is filtered (policy compliance, antimalware...) and passed on to the Internet. You send traffic either via a PAC file in the browser, via some sort of tunnel (GRE, IPSec) or a combination of both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've deployed this in some fairly exotic countries, with no major issues so far. We can show that we log everything if need be, and I haven't encountered any places where access to these cloud nodes is wholly blocked, except sometimes in China when the Great Firewall gets grumpy. Performance is sometimes problematic though, particularly in Latin America and Africa, but way better than the alternatives.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-01-25T20:57:25.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26278" PostTypeId="2" ParentId="26276" CreationDate="2016-01-25T20:59:36.603" Score="1" Body="&lt;p&gt;That is so that the hosts involved in the collision don't try to resend at exactly the same time and just have an infinite series of collisions, rendering the network unusable.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-25T21:06:23.810" LastActivityDate="2016-01-25T21:06:23.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26279" PostTypeId="1" CreationDate="2016-01-25T21:06:37.840" Score="0" ViewCount="3538" Body="&lt;p&gt;I have an ASA firewall in production.&#xA;When I issue the show interface command, there are lots of underruns and it keeps increasing. I have change the LAN cable, reset the interface, enable and disable flow control and even changed the device connected to that interface.&#xA;Has anyone experienced this? Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="22338" LastEditorUserId="22338" LastEditDate="2016-01-26T14:00:09.357" LastActivityDate="2016-01-28T14:37:09.280" Title="Underruns in ASA interface" Tags="|cisco|cisco-asa|errors|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26285" PostTypeId="1" CreationDate="2016-01-26T06:19:50.057" Score="3" ViewCount="1670" Body="&lt;pre&gt;&lt;code&gt;Host A: &#xA;Eth1 = Multicast incoming from upstream provider&#xA;OpenVPN_interface_point_A = point to point interface with point B&#xA;ASN = 100&#xA;&#xA;Host B: &#xA;OpenVPN_interface_point_B = point to point interface with point A&#xA;ASN = 200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How exactly can I routing specific multicast address from Eth1 to OpenVPN_interface_point_B ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both Host A and B are running Quagga BGP version 4 (I know I need to change version 4+, that's not a problem in the future)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PoC Lab:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bCcnO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bCcnO.png&quot; alt=&quot;PoC network diagram&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router A configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routerA# show run&#xA;&#xA;Current configuration:&#xA;!&#xA;password quagga&#xA;!&#xA;router bgp 1&#xA; bgp router-id 172.24.0.65&#xA; network 172.24.0.64/30&#xA; neighbor 172.24.0.66 remote-as 2&#xA; neighbor 172.24.0.66 soft-reconfiguration inbound&#xA;!&#xA; address-family ipv4 multicast&#xA; network 10.101.16.128/27&#xA; neighbor 172.24.0.66 activate&#xA; exit-address-family&#xA;!&#xA;line vty&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router A BGP details:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routerA# show ip bgp sum&#xA;BGP router identifier 172.24.0.65, local AS number 1&#xA;RIB entries 1, using 112 bytes of memory&#xA;Peers 1, using 4568 bytes of memory&#xA;&#xA;Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;172.24.0.66     4     2      35      43        0    0    0 00:17:28        1&#xA;&#xA;Total number of neighbors 1&#xA;&#xA;routerA# show ip bgp ipv4 multicast &#xA;BGP table version is 0, local router ID is 172.24.0.65&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, = multipath,&#xA;              i internal, r RIB-failure, S Stale, R Removed&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*&amp;gt; 10.101.16.128/27 0.0.0.0                  0         32768 i&#xA;&#xA;Total number of prefixes 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router B configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routerB# show run&#xA;&#xA;Current configuration:&#xA;!&#xA;password quagga&#xA;!&#xA;router bgp 2&#xA; bgp router-id 172.24.0.66&#xA; network 172.24.0.64/30&#xA; neighbor 172.24.0.65 remote-as 1&#xA; neighbor 172.24.0.65 soft-reconfiguration inbound&#xA;!&#xA; address-family ipv4 multicast&#xA; neighbor 172.24.0.65 activate&#xA; exit-address-family&#xA;!&#xA;line vty&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router B detail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routerB# show ip bgp sum&#xA;BGP router identifier 172.24.0.66, local AS number 2&#xA;RIB entries 1, using 112 bytes of memory&#xA;Peers 1, using 4568 bytes of memory&#xA;&#xA;Neighbor        V         AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;172.24.0.65     4     1      43      47        0    0    0 00:23:55        1&#xA;&#xA;Total number of neighbors 1&#xA;routerB# show ip bgp ipv4 multicast &#xA;BGP table version is 0, local router ID is 172.24.0.66&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, = multipath,&#xA;              i internal, r RIB-failure, S Stale, R Removed&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*&amp;gt; 10.101.16.128/27 172.24.0.65              0             0 1 i&#xA;&#xA;Total number of prefixes 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Host 1 iperf command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iperf -c 225.0.100.100 -u -t 0000 -i 1 -T 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router B iperf command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iperf -s -u -B 225.0.100.100 -i 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router B still can't receive multicast packet&lt;/p&gt;&#xA;" OwnerUserId="4479" LastEditorUserId="8499" LastEditDate="2019-01-04T22:38:05.223" LastActivityDate="2019-01-04T22:38:05.223" Title="Quagga (Zebra) multiprotocol BGP configuration for IP multicast routing" Tags="|routing|vpn|bgp|multicast|quagga|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26286" PostTypeId="1" CreationDate="2016-01-26T07:46:54.707" Score="1" ViewCount="30" Body="&lt;p&gt;I'm looking to directly connect a host (dual NICs) to a clustered appliance. The clustered appliance consists of two controllers each with their own NIC and VIP. In the event of a controller failure, or planned outage, a VIP will be migrated to the remaining controller. The appliance runs a couple applications, each pinned to it's own VIP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I assign everything to the same subnet I can use static routes on the host to insure the host's NIC1 talks to the VIP1 it's connected with, but if that controller fails the VIP will move to the other controller and that application would then be only accessible through the host's NIC2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The obvious solution is to introduce a switch but we were trying to avoid the added hardware. One thought was to write a small service on the host to continuously ping the VIPs and change the static routing if the pings ever fail. Any other suggestions?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;------------------------------&#xA;|                            |&#xA;|          Host              |&#xA;|                            | &#xA;| NIC1                  NIC2 |&#xA;------------------------------&#xA;   |                     |&#xA;   |                     |&#xA;   |                     | &#xA;------------------------------&#xA;| C1 (VIP1)        C2 (VIP2) |     &#xA;|                            |  &#xA;|      Dual Controller       |&#xA;|    Clustered Appliance     |&#xA;|                            |    &#xA;------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks,   &lt;/p&gt;&#xA;" OwnerUserId="22347" LastActivityDate="2016-01-26T07:46:54.707" Title="Directly Connected Multihomed Hosts" Tags="|design|" AnswerCount="0" CommentCount="2" ClosedDate="2019-03-28T18:53:56.650" ContentLicense="CC BY-SA 3.0" />
  <row Id="26289" PostTypeId="2" ParentId="23789" CreationDate="2016-01-26T13:26:40.393" Score="4" Body="&lt;p&gt;This is not a valid test, because you are using the router process to handle all the overhead of copying, decrypting, etc using scp.  Normally, the router can forward packets without involving the processor (as much) for &quot;ordinary&quot; routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you looking for a general sense of link quality (as opposed to actual throughput) I think you're better off doing pings with large packet sizes and looking for drops/errors.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-26T13:26:40.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26290" PostTypeId="1" CreationDate="2016-01-26T13:56:51.823" Score="2" ViewCount="107" Body="&lt;p&gt;I have a doubt.&#xA;Can access point communicating with a client on a low frequency channel(say 2.4GHz) change to high frequency channel(say 60GHz) once the client is within range? Is it possible from AP side (or) client side (or) both (or) neither?&lt;/p&gt;&#xA;" OwnerUserId="17322" LastActivityDate="2016-03-01T08:32:15.213" Title="How access point detects the range of clients?" Tags="|router|ieee-802.11|access-point|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26291" PostTypeId="1" AcceptedAnswerId="26294" CreationDate="2016-01-26T14:37:44.837" Score="3" ViewCount="6424" Body="&lt;p&gt;We have equipment stored in two data centres. Currently we have a layer 2 network that spans both centres. This layer 2 network is provided to us by our ISP and they also run transit on top, a single IP range that also spans both centres. This forms essentially an active/active connection&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both sites have the same default gateway&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means I can use&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;a.b.c.1/24 on site A&#xA;a.b.c.2/24 on site B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and if I have any issues on site A I can move a.b.c.1/24 to a device on site B and everything carries on working ok.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know 100% what our provider uses to achieve this apart from a VRRP instance to provide some resilience for gateway address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I am looking to install an exact copy of this setup as a backup connection. For now all I wanted was for another provider to do exactly the same thing just with a different IP range (we don't have a PI range).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This time round I have been told that the only way this can be done is if we establish a BGP peering session to them (the backup provider) and advertise the (new) IP addresses we are using at each site back to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me this didn't sound right but then I haven't done a lot of work with BGP. Is it possible that you can advertise the same IP range to a single ISP from two different sites and be able to achieve what I described above?&lt;/p&gt;&#xA;" OwnerUserId="139" LastActivityDate="2018-10-26T14:59:09.307" Title="Can BGP advertise the same IP range from multiple sites to the same ISP" Tags="|routing|bgp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26292" PostTypeId="2" ParentId="26285" CreationDate="2016-01-26T14:47:44.013" Score="2" Body="&lt;p&gt;Multicast routing is different than your unicast routing protocols like BGP. PIM is the standard for multicast routing. Every router in the path must support a common multicast routing scheme (sparse, dense, or sparse/dense mode, and any RPs which are necessary), and that usually doesn't happen across ASes because you usually don't have control over neighbor ASes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, you would create a DVMRP tunnel from one end of the multicast path to the other end of the path, and then run multicast routing (PIM) through the tunnel. This doesn't affect your BGP configuration, other than making sure you can reach the other end of the tunnel with unicast, since the tunnel will encapsulate your multicast inside unicast packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mu7ZZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mu7ZZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-26T15:48:02.927" LastActivityDate="2016-01-26T15:48:02.927" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="26294" PostTypeId="2" ParentId="26291" CreationDate="2016-01-26T15:12:33.657" Score="2" Body="&lt;p&gt;Yes you can advertise the same range (technically, an IP prefix) from two locations.  You will have to choose one as the primary and one as the backup connection.  This will operate somewhat differently from your current connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm reluctant to give you a sample configuration, since there are a lot of variables.  If you want to continue this in chat, we can work through it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-26T15:12:33.657" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="26296" PostTypeId="2" ParentId="26285" CreationDate="2016-01-26T16:51:43.713" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How exactly can I routing specific multicast address from Eth1 to OpenVPN_interface_point_B ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a configuration sketch to get you started.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host A will send multicast source network 192.168.0.0/24 to Host B by using BGP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! 1.1.1.1 = Host A&#xA;! 1.1.1.2 = Host B&#xA;&#xA;! Host A - partial quagga config for bgpd&#xA;router bgp 100&#xA; neighbor 1.1.1.2 remote-as 200&#xA; address-family ipv4 multicast &#xA;  network 192.168.0.0/24 !! replace 192.168.0.0/24 with network for multicast source&#xA;  neighbor 1.1.1.2 activate &#xA; exit-address-family &#xA;&#xA;! Host B - partial quagga config for bgpd&#xA;router bgp 200&#xA; neighbor 1.1.1.1 remote-as 100&#xA; address-family ipv4 multicast &#xA;  neighbor 1.1.1.1 activate &#xA; exit-address-family &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-01-26T16:51:43.713" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26297" PostTypeId="1" CreationDate="2016-01-26T16:51:54.140" Score="1" ViewCount="67" Body="&lt;p&gt;IP tracking sites provide some information about the location of the given IP address. How do they do so?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the world's IP addresses are given to ISPs according to geographical areas. Who gives those IP addresses to ISPs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean is there a single DHCP server on the Internet to give addresses to all the ISPs or what?&lt;/p&gt;&#xA;" OwnerUserId="16870" LastActivityDate="2016-01-26T20:15:10.167" Title="How do IP trackers find location of the given IP address?" Tags="|ip|internet|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-07T18:56:53.077" ContentLicense="CC BY-SA 3.0" />
  <row Id="26299" PostTypeId="1" CreationDate="2016-01-26T20:05:55.790" Score="1" ViewCount="780" Body="&lt;p&gt;We recently upsized our internet speed and purchased an ASA 5512 to be able to take advantage of that, as the 5505 was capped at 100mbps. So here's my issue. I'm trying to create the VLANs on the new firewall but I can't seem to assign the same VLAN to multiple ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example from old ASA 5505 configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan300&#xA; nameif DMZ&#xA; security-level 50&#xA; ip address 192.168.5.5 255.255.255.0 &#xA;!&#xA;interface Vlan400&#xA; nameif INSIDE&#xA; security-level 90&#xA; ip address 192.168.1.5 255.255.255.0&#xA;&#xA;interface Ethernet0/3&#xA; switchport access vlan 300&#xA;!&#xA;interface Ethernet0/4&#xA; switchport access vlan 300&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA; switchport access vlan 400&#xA;!&#xA;interface Ethernet0/7&#xA; switchport access vlan 400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the new firewall I have to create a subinterface for the VLAN, so the VLAN is setup on a physical interface, and it does not allow me to make the same VLAN on a different port. Does anyone know of a way to assign a VLAN from one port to another?&lt;/p&gt;&#xA;" OwnerUserId="22360" LastActivityDate="2016-01-28T16:34:31.047" Title="Need help converting ASA 5505 config to ASA 5512" Tags="|vlan|cisco-asa|firewall|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26300" PostTypeId="2" ParentId="26297" CreationDate="2016-01-26T20:15:10.167" Score="1" Body="&lt;p&gt;IP addresses are assigned by Regional Internet Registries (RIRs) and Local Internet Registries (LIRs). Where the address block came from has ZERO influence on where it's actually used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GeoIP databases are built from a number of sources, but always boil down to some measure of &quot;educated guess.&quot; The only person who knows 100% where an address is on the planet is the person using it. ISPs have a good idea (&quot;service address&quot; for any fixed line service, eg. DSL) but they rarely share that information, and even more rarely keep that information up-to-date.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Google &quot;ARIN&quot; and &quot;RIPE&quot;)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-26T20:15:10.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26301" PostTypeId="2" ParentId="26299" CreationDate="2016-01-26T20:18:54.690" Score="3" Body="&lt;p&gt;The 5505 has a single switch connecting it to the world. So you configure VLANs and assign ports to each vlan (inside, outside, dmz.) The 5510+ have multiple routed interfaces. So you setup individual interfaces (Ethernet0, etc.) for &quot;inside&quot;, &quot;outside&quot;, etc. While you can configure VLANs behind an interface, I doubt that's what you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(For example, I have 3 &quot;outside&quot; VLANs. One per ISP.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-26T20:18:54.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26302" PostTypeId="2" ParentId="26290" CreationDate="2016-01-26T20:21:11.187" Score="2" Body="&lt;p&gt;In general, no. Clients decide which radio to use and to what AP to associate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, if the client has a preference for the 60Ghz radio, it can choose to switch to it when ever it wishes.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-26T20:21:11.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26303" PostTypeId="2" ParentId="26299" CreationDate="2016-01-26T20:37:31.400" Score="3" Body="&lt;p&gt;The answer is simply &quot;no&quot;. As Ricky already told, the 5505 has an integrated switch built-in, hence you can create VLAN interfaces (which are then routed interfaces actually visible to the firewall). The larger ASA devices (honestly, I think all other Cisco firewalls except for the your old 5505) do not have such a switch built-in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While you can configure sub-interfaces and use different VLANs on the same port (802.1q trunking), you cannot assign one VLAN on multiple ports. This is what a switch does, but the ASA cannot do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a more detailed advice we would need more details about your network, such as why you need to have multiple ports with the same VLAN and what is connected to which interface. From what I see in your configuration, it seems that you simply connect multiple clients to the firewall. If this is the case: use any VLAN capable switch, connect it to your new ASA (either via one physical interface using 802.1q or multiple physical interfaces) and let both your ASA and the switch do what they were designed for.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-01-26T20:37:31.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26306" PostTypeId="1" AcceptedAnswerId="26307" CreationDate="2016-01-27T02:33:09.187" Score="4" ViewCount="138" Body="&lt;p&gt;I have a problem about Speed when accessing web servers..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Circumstances]&lt;/strong&gt;&#xA;Everything is OK, every packet flows well.&#xA;However, now I have focused on the speed...&#xA;That is, connection is ok&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Issues]&lt;/strong&gt;&#xA;Whenever I connect or access the web servers, the access speed markedly slow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it is fast sometimes...&#xA;That is, slow, fast, slow, fast --- continuous&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[The data]&lt;/strong&gt;&#xA;First, please see the below network structure.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RjaG6.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RjaG6.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[The things that I want to know]&lt;/strong&gt;&#xA;As you can see the data, the structure is not complicated.&#xA;To tell the truth, I don't know what device is the problem.&#xA;and I also don't know what can I see in order to fix it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to know whether device's problem.&#xA;If so, how can I control it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;SK&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--------------------modified---------------------&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I captured it with wireshark.&#xA;As you can see the below capture, it showed Retransmission message.&#xA;However, the frequency was very low.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If network is very good condition, only one retransmission is now showed??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Gtlry.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Gtlry.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20562" LastEditorUserId="20562" LastEditDate="2016-01-27T14:40:20.113" LastActivityDate="2016-01-27T14:40:20.113" Title="[L4, F/W]How can I deal with SPEED?" Tags="|firewall|juniper|switching|speed|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26307" PostTypeId="2" ParentId="26306" CreationDate="2016-01-27T03:10:57.950" Score="2" Body="&lt;p&gt;Here's a strategy:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start by capturing a web session with Wireshark when the response is slow.  Are you seeing timeouts/retransmissions? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you see retransmissions, then you are losing packets somewhere.  Look at your switch interfaces for errors or drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, it may be the web server.  Is it the web server that's slow, or is it the DNS server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check your firewall logs to see if there's any important information there.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-01-27T03:38:36.997" LastActivityDate="2016-01-27T03:38:36.997" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26308" PostTypeId="1" AcceptedAnswerId="26313" CreationDate="2016-01-27T05:01:50.707" Score="3" ViewCount="10022" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/UbX5X.png&quot; alt=&quot;network diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how could I setup pimd on Linux so that multicast address from 225.0.30.30 could route to 172.24.0.66/30 router on the right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this is the lab I just setup today,&#xA;&lt;img src=&quot;https://i.stack.imgur.com/7ycKh.png&quot; alt=&quot;PoC network diagram&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/Zdxqw.png&quot; alt=&quot;host 1 IP config&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/VPGV5.png&quot; alt=&quot;Router A IP config&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/uyb7X.png&quot; alt=&quot;Router B IP config&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the lab environment, I changed IP so that I don't need to run another NAT setup.&#xA;Router A and B is running pimd without any detail configuration, here is pimd -r detail for both routers:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/5ThpT.png&quot; alt=&quot;pimd -r detail on router A&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/4YvHB.png&quot; alt=&quot;pimd -r detail on router B&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After all parts glued together, I start fire &quot;iperf -c 225.0.100.100 -u -t 1 -i 1&quot; on host 1, and &quot;iperf -s -u -B 225.0.100.100 -i 1&quot; on router B; Router B receive no multicast at all, anyone know what's wrong with this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: testing Everton's suggestion, result still nothing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;test_igmpv3_join result from Router B:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/1BbyA.png&quot; alt=&quot;test_igmpv3_join&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PIM debug log from Router A after test_igmpv3_join running:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2016/01/28 13:55:03 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.22,2&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c fib_lookup_if_vif_index: high vif_index=2 &amp;gt; highest_vif_index=-1 nexthop for address 10.101.16.135&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c fib_lookup_if_vif_index: pim disabled on interface eth0 vif_index=2 ?&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c igmp_source_forward_start: could not find input interface for source 10.101.16.135&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c fib_lookup_if_vif_index: high vif_index=2 &amp;gt; highest_vif_index=-1 nexthop for address 10.101.16.135&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c fib_lookup_if_vif_index: pim disabled on interface eth0 vif_index=2 ?&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c igmp_source_forward_start: could not find input interface for source 10.101.16.135&#xA;2016/01/28 13:55:03 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.22,2&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c fib_lookup_if_vif_index: high vif_index=2 &amp;gt; highest_vif_index=-1 nexthop for address 10.101.16.135&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c fib_lookup_if_vif_index: pim disabled on interface eth0 vif_index=2 ?&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c igmp_source_forward_start: could not find input interface for source 10.101.16.135&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c fib_lookup_if_vif_index: high vif_index=2 &amp;gt; highest_vif_index=-1 nexthop for address 10.101.16.135&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c fib_lookup_if_vif_index: pim disabled on interface eth0 vif_index=2 ?&#xA;2016/01/28 13:55:03 PIM: pim_zebra.c igmp_source_forward_start: could not find input interface for source 10.101.16.135&#xA;2016/01/28 13:55:04 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.13,103&#xA;2016/01/28 13:55:04 PIM: Recv IP PIM pkt size=30 from 10.101.16.135 to 224.0.0.13 on fd=9 on ifindex=2 (sock_ifindex=2)&#xA;2016/01/28 13:55:04 PIM: Recv IP packet from 10.101.16.135 to 224.0.0.13 on eth0: size=30 ip_header_size=20 ip_proto=103&#xA;2016/01/28 13:55:04 PIM: Recv PIM packet from 10.101.16.135 to 224.0.0.13 on eth0: ttl=1 pim_version=2 pim_type=0 pim_msg_size=10 checksum=93df&#xA;2016/01/28 13:55:04 PIM: pim_hello_recv: from 10.101.16.135 on eth0&#xA;2016/01/28 13:55:04 PIM: pim_hello_recv: parse left_size=6: PIM hello TLV type=1 length=2 from 10.101.16.135 on eth0&#xA;2016/01/28 13:55:04 PIM: pim_hello_recv: PIM hello option from 10.101.16.135 on interface eth0: holdtime=105&#xA;2016/01/28 13:55:04 PIM: neighbor_timer_off: cancelling timer for neighbor 10.101.16.135 on eth0&#xA;2016/01/28 13:55:04 PIM: pim_neighbor_timer_reset: starting 105 sec timer for neighbor 10.101.16.135 on eth0&#xA;2016/01/28 13:55:04 PIM: dr_election_by_addr: on interface eth0&#xA;2016/01/28 13:55:04 PIM: Scheduling READ event on PIM socket fd=9&#xA;2016/01/28 13:55:04 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.13,103&#xA;2016/01/28 13:55:04 PIM: Recv IP PIM pkt size=30 from 10.101.16.135 to 224.0.0.13 on fd=11 on ifindex=2 (sock_ifindex=3)&#xA;2016/01/28 13:55:04 PIM: Scheduling READ event on PIM socket fd=11&#xA;2016/01/28 13:55:07 PIM: Rescheduling 30 sec hello on interface eth1&#xA;2016/01/28 13:55:07 PIM: hello_send: to 224.0.0.13 on eth1: holdt=105 prop_d=500 overr_i=2500 dis_join_supp=0 dr_prio=1 gen_id=2518d352 addrs=2&#xA;2016/01/28 13:55:07 PIM: pim_tlv_append_addrlist_ucast: number of encoded secondary unicast IPv4 addresses: 0&#xA;2016/01/28 13:55:07 PIM: pim_msg_send: to 224.0.0.13 on eth1: msg_size=34 checksum=3adb&#xA;2016/01/28 13:55:07 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.1,2&#xA;2016/01/28 13:55:09 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.13,103&#xA;2016/01/28 13:55:09 PIM: Recv IP PIM pkt size=56 from 10.101.16.135 to 224.0.0.13 on fd=9 on ifindex=2 (sock_ifindex=2)&#xA;2016/01/28 13:55:09 PIM: Recv IP packet from 10.101.16.135 to 224.0.0.13 on eth0: size=56 ip_header_size=20 ip_proto=103&#xA;2016/01/28 13:55:09 PIM: Recv PIM packet from 10.101.16.135 to 224.0.0.13 on eth0: ttl=1 pim_version=2 pim_type=4 pim_msg_size=36 checksum=b88e&#xA;2016/01/28 13:55:09 PIM: pim_pim.c pim_pim_packet: unsupported PIM message type=4 from 10.101.16.135 on eth0&#xA;2016/01/28 13:55:09 PIM: pim_sock_read: pim_pim_packet() return=-1&#xA;2016/01/28 13:55:09 PIM: Scheduling READ event on PIM socket fd=9&#xA;2016/01/28 13:55:09 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.13,103&#xA;2016/01/28 13:55:09 PIM: Recv IP PIM pkt size=56 from 10.101.16.135 to 224.0.0.13 on fd=11 on ifindex=2 (sock_ifindex=3)&#xA;2016/01/28 13:55:09 PIM: Scheduling READ event on PIM socket fd=11&#xA;2016/01/28 13:55:12 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.22,2&#xA;2016/01/28 13:55:12 PIM: pim_zebra.c fib_lookup_if_vif_index: high vif_index=2 &amp;gt; highest_vif_index=-1 nexthop for address 10.101.16.135&#xA;2016/01/28 13:55:12 PIM: pim_zebra.c fib_lookup_if_vif_index: pim disabled on interface eth0 vif_index=2 ?&#xA;2016/01/28 13:55:12 PIM: pim_zebra.c igmp_source_forward_start: could not find input interface for source 10.101.16.135&#xA;2016/01/28 13:55:15 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.22,2&#xA;2016/01/28 13:55:16 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.22,2&#xA;2016/01/28 13:55:16 PIM: pim_zebra.c fib_lookup_if_vif_index: high vif_index=2 &amp;gt; highest_vif_index=-1 nexthop for address 10.101.16.135&#xA;2016/01/28 13:55:16 PIM: pim_zebra.c fib_lookup_if_vif_index: pim disabled on interface eth0 vif_index=2 ?&#xA;2016/01/28 13:55:16 PIM: pim_zebra.c igmp_source_forward_start: could not find input interface for source 10.101.16.135&#xA;2016/01/28 13:55:16 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.22,2&#xA;2016/01/28 13:55:21 PIM: Rescheduling 30 sec hello on interface eth0&#xA;2016/01/28 13:55:21 PIM: hello_send: to 224.0.0.13 on eth0: holdt=105 prop_d=500 overr_i=2500 dis_join_supp=0 dr_prio=1 gen_id=ca948d20 addrs=2&#xA;2016/01/28 13:55:21 PIM: pim_tlv_append_addrlist_ucast: number of encoded secondary unicast IPv4 addresses: 0&#xA;2016/01/28 13:55:21 PIM: pim_msg_send: to 224.0.0.13 on eth0: msg_size=34 checksum=f07b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router A configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routerA# show run&#xA;&#xA;Current configuration:&#xA;!&#xA;password quagga&#xA;log stdout&#xA;!&#xA;interface eth0&#xA; ip pim ssm&#xA; ip igmp query-interval 125&#xA; ip igmp query-max-response-time-dsec 100&#xA;!&#xA;interface eth1&#xA; ip pim ssm&#xA; ip igmp&#xA; ip igmp query-interval 125&#xA; ip igmp query-max-response-time-dsec 100&#xA;!&#xA;interface eth2&#xA;!&#xA;interface eth3&#xA;!&#xA;interface lo&#xA;!         &#xA;!&#xA;line vty&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Quagga pimd troubleshoot details&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routerA# show ip rib 10.101.16.135&#xA;Address         NextHop         Interface Metric Preference&#xA;10.101.16.135   0.0.0.0         eth0           0          0&#xA;routerA# show ip multicast &#xA;Multicast disabled&#xA;&#xA;Zclient update socket: 7 failures=0&#xA;Zclient lookup socket: 8 failures=0&#xA;&#xA;Current highest VifIndex: -1&#xA;Maximum highest VifIndex: 31&#xA;&#xA;Upstream Join Timer: 60 secs&#xA;Join/Prune Holdtime: 210 secs&#xA;&#xA;RPF Cache Refresh Delay:    10000 msecs&#xA;RPF Cache Refresh Timer:    0 msecs&#xA;RPF Cache Refresh Requests: 5&#xA;RPF Cache Refresh Events:   2&#xA;RPF Cache Refresh Last:     00:02:20&#xA;&#xA;Scan OIL - Last: 00:02:20  Events: 2&#xA;MFC Add  - Last: --:--:--  Events: 0&#xA;MFC Del  - Last: --:--:--  Events: 0&#xA;&#xA;Interface Address         ifi Vif  PktsIn PktsOut    BytesIn   BytesOut&#xA;ioctl(SIOCGETVIFCNT=35296) failure for interface eth0 vif_index=-1: errno=9: Bad file descriptor&#xA;ioctl(SIOCGETVIFCNT=35296) failure for interface eth1 vif_index=-1: errno=9: Bad file descriptor&#xA;routerA# show ip mroute        &#xA;Proto: I=IGMP P=PIM&#xA;&#xA;Source          Group           Proto Input iVifI Output oVifI TTL Uptime  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I saw something funny &quot;Multicast disabled&quot;, so on Quagga pimd, I added config line &quot;ip multicast-routing&quot;, then I fire up iperf to send out multicast packet and show the details again,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routerA# show ip multicast &#xA;Mroute socket descriptor: 14&#xA;Mroute socket uptime: 00:08:12&#xA;&#xA;Zclient update socket: 7 failures=0&#xA;Zclient lookup socket: 8 failures=0&#xA;&#xA;Current highest VifIndex: 3&#xA;Maximum highest VifIndex: 31&#xA;&#xA;Upstream Join Timer: 60 secs&#xA;Join/Prune Holdtime: 210 secs&#xA;&#xA;RPF Cache Refresh Delay:    10000 msecs&#xA;RPF Cache Refresh Timer:    0 msecs&#xA;RPF Cache Refresh Requests: 5&#xA;RPF Cache Refresh Events:   2&#xA;RPF Cache Refresh Last:     00:13:14&#xA;&#xA;Scan OIL - Last: 00:13:14  Events: 2&#xA;MFC Add  - Last: 00:01:04  Events: 1&#xA;MFC Del  - Last: --:--:--  Events: 0&#xA;&#xA;Interface Address         ifi Vif  PktsIn PktsOut    BytesIn   BytesOut&#xA;eth0      10.101.16.134     2   2    5687       0    8519126          0&#xA;eth1      172.24.0.65       3   3       0       0          0          0&#xA;&#xA;routerA# show ip pim interface &#xA;Interface Address         ifIndex Socket Uptime   Multi Broad MLoop AllMu Prmsc Del&#xA;eth0      10.101.16.134         2      9 00:23:20   yes   yes    no    no    no  no&#xA;eth1      172.24.0.65           3     11 00:23:20   yes   yes    no    no    no  no&#xA;&#xA;routerA# show ip igmp sources &#xA;Interface Address         Group           Source          Timer Fwd Uptime  &#xA;eth1      172.24.0.65     225.0.100.100   10.101.16.135   02:48   Y 00:02:03&#xA;&#xA;routerA# show ip igmp interface &#xA;Interface Address         ifIndex Socket Uptime   Multi Broad MLoop AllMu Prmsc Del&#xA;eth1      172.24.0.65           3     10 00:23:45   yes   yes   yes    no    no  no&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but tcpdump on router B still receive no multicast packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Redo PIM debug log from Router A after test_igmpv3_join running:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2016/01/29 10:40:05 PIM: Rescheduling 30 sec hello on interface eth1&#xA;2016/01/29 10:40:05 PIM: hello_send: to 224.0.0.13 on eth1: holdt=105 prop_d=500 overr_i=2500 dis_join_supp=0 dr_prio=1 gen_id=921c168a addrs=2&#xA;2016/01/29 10:40:05 PIM: pim_tlv_append_addrlist_ucast: number of encoded secondary unicast IPv4 addresses: 0&#xA;2016/01/29 10:40:05 PIM: pim_msg_send: to 224.0.0.13 on eth1: msg_size=34 checksum=ff2a&#xA;2016/01/29 10:40:09 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.22,2&#xA;2016/01/29 10:40:09 PIM: pim_rpf.c pim_nexthop_lookup: found nexthop 0.0.0.0 for address 10.101.16.135: interface eth0 ifindex=2 metric=0 pref=0&#xA;2016/01/29 10:40:09 PIM: pim_if_find_neighbor: neighbor not found for address 0.0.0.0 on interface eth0&#xA;2016/01/29 10:40:09 PIM: pim_rpf.c pim_rpf_update: RPF'(10.101.16.135,225.0.100.100) not found: won't send join upstream&#xA;2016/01/29 10:40:09 PIM: pim_rpf.c pim_rpf_update: (S,G)=(10.101.16.135,225.0.100.100) source nexthop now is: interface=eth0 address=0.0.0.0 pref=0 metric=0&#xA;2016/01/29 10:40:09 PIM: pim_rpf.c pim_rpf_update: (S,G)=(10.101.16.135,225.0.100.100) RPF_interface(S) changed from &amp;lt;oldif?&amp;gt; to eth0&#xA;2016/01/29 10:40:09 PIM: pim_ifassert_winner_set: (S,G)=(10.101.16.135,225.0.100.100) assert state changed from ifassert_bad_state to NOINFO on interface eth1&#xA;2016/01/29 10:40:09 PIM: pim_ifassert_winner_set: (S,G)=(10.101.16.135,225.0.100.100) assert winner changed from 64.146.254.46 to 0.0.0.0 on interface eth1&#xA;2016/01/29 10:40:09 PIM: ifmembership_set: (S,G)=(10.101.16.135,225.0.100.100) membership now is INCLUDE on interface eth1&#xA;2016/01/29 10:40:09 PIM: pim_upstream_switch: PIM_UPSTREAM_JOINED: (S,G)=(10.101.16.135,225.0.100.100)&#xA;2016/01/29 10:40:09 PIM: pim_ifchannel_update_assert_tracking_desired: AssertTrackingDesired(10.101.16.135,225.0.100.100,eth1) changed from 0 to 1&#xA;2016/01/29 10:40:09 PIM: pim_forward_start: (S,G)=(10.101.16.135,225.0.100.100) oif=eth1&#xA;2016/01/29 10:40:09 PIM: send_join: can't send join upstream: RPF'(10.101.16.135,225.0.100.100)=0.0.0.0&#xA;2016/01/29 10:40:09 PIM: pim_joinprune_send: sending Join(S,G)=(10.101.16.135,225.0.100.100) to upstream=0.0.0.0 on interface eth0&#xA;2016/01/29 10:40:09 PIM: pim_joinprune_send: Join(S,G)=(10.101.16.135,225.0.100.100): upstream=0.0.0.0 is myself on interface eth0&#xA;2016/01/29 10:40:09 PIM: join_timer_start: starting 60 sec timer for upstream (S,G)=(10.101.16.135,225.0.100.100)&#xA;2016/01/29 10:40:09 PIM: pim_ifchannel_update_could_assert: CouldAssert(10.101.16.135,225.0.100.100,eth1) changed from 0 to 1&#xA;2016/01/29 10:40:09 PIM: pim_ifchannel_update_my_assert_metric: my_assert_metric(10.101.16.135,225.0.100.100,eth1) changed from 1,4294967295,4294967295,0.0.0.0 to 0,0,0,172.24.0.65&#xA;2016/01/29 10:40:09 PIM: Rescheduling 30 sec hello on interface eth0&#xA;2016/01/29 10:40:09 PIM: hello_send: to 224.0.0.13 on eth0: holdt=105 prop_d=500 overr_i=2500 dis_join_supp=0 dr_prio=1 gen_id=661e4198 addrs=2&#xA;2016/01/29 10:40:09 PIM: pim_tlv_append_addrlist_ucast: number of encoded secondary unicast IPv4 addresses: 0&#xA;2016/01/29 10:40:09 PIM: pim_msg_send: to 224.0.0.13 on eth0: msg_size=34 checksum=ef2b&#xA;2016/01/29 10:40:10 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.22,2&#xA;2016/01/29 10:40:20 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.22,2&#xA;2016/01/29 10:40:20 PIM: pim_socket_recvfromto: HAVE_IP_PKTINFO to=224.0.0.22,2&#xA;2016/01/29 10:40:22 PIM: ifmembership_set: (S,G)=(10.101.16.135,225.0.100.100) membership now is NOINFO on interface eth1&#xA;2016/01/29 10:40:22 PIM: pim_upstream_switch: PIM_UPSTREAM_NOTJOINED: (S,G)=(10.101.16.135,225.0.100.100)&#xA;2016/01/29 10:40:22 PIM: pim_ifchannel_update_assert_tracking_desired: AssertTrackingDesired(10.101.16.135,225.0.100.100,eth1) changed from 1 to 0&#xA;2016/01/29 10:40:22 PIM: pim_forward_stop: (S,G)=(10.101.16.135,225.0.100.100) oif=eth1&#xA;2016/01/29 10:40:22 PIM: pim_zebra.c del_oif: nonexistent protocol mask 2 removed OIF eth1 (vif_index=3, min_ttl=0) from channel (S,G)=(10.101.16.135,225.0.100.100)&#xA;2016/01/29 10:40:22 PIM: pim_joinprune_send: sending Prune(S,G)=(10.101.16.135,225.0.100.100) to upstream=0.0.0.0 on interface eth0&#xA;2016/01/29 10:40:22 PIM: pim_joinprune_send: Prune(S,G)=(10.101.16.135,225.0.100.100): upstream=0.0.0.0 is myself on interface eth0&#xA;2016/01/29 10:40:22 PIM: pim_ifchannel_update_could_assert: CouldAssert(10.101.16.135,225.0.100.100,eth1) changed from 1 to 0&#xA;2016/01/29 10:40:22 PIM: pim_ifchannel_update_my_assert_metric: my_assert_metric(10.101.16.135,225.0.100.100,eth1) changed from 0,0,0,172.24.0.65 to 1,4294967295,4294967295,0.0.0.0&#xA;2016/01/29 10:40:22 PIM: pim_mroute_msg: kernel upcall NOCACHE type=1 ip_p=0 from fd=14 for (S,G)=(10.101.16.135,225.0.100.100) on eth0 vifi=2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;mroute detail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routerA# show ip mroute &#xA;Proto: I=IGMP P=PIM&#xA;&#xA;Source          Group           Proto Input iVifI Output oVifI TTL Uptime  &#xA;10.101.16.135   225.0.100.100   I     eth0      2 eth1       3   1 02:47:40 &#xA;routerA# show ip mroute count&#xA;&#xA;Source          Group           Packets      Bytes WrongIf  &#xA;10.101.16.135   225.0.100.100    841231 1260164038       0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Problem solved by running iperf on host 1 with -T 10 instead of default 1. &lt;/p&gt;&#xA;" OwnerUserId="4479" LastEditorUserId="8499" LastEditDate="2020-12-11T23:37:53.437" LastActivityDate="2020-12-11T23:37:53.437" Title="config pimd on Linux to forward incoming multicast packet to OpenVPN tunnel interface" Tags="|routing|multicast|quagga|pim|" AnswerCount="1" CommentCount="6" ClosedDate="2020-12-11T23:38:04.000" ContentLicense="CC BY-SA 3.0" />
  <row Id="26309" PostTypeId="2" ParentId="26115" CreationDate="2016-01-27T06:56:21.317" Score="-2" Body="&lt;p&gt;hsrp and glbp are the good soultions for router redundancy &lt;/p&gt;&#xA;" OwnerUserId="22374" LastActivityDate="2016-01-27T06:56:21.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26311" PostTypeId="1" AcceptedAnswerId="26312" CreationDate="2016-01-27T11:17:45.377" Score="3" ViewCount="5858" Body="&lt;p&gt;Model: ACX2200&#xA;Version : 15.1X54-D10.5&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I have two Juniper routers connected back-to-back , first router is enabled     with TACACS login.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Second router is not enabled with TACACS login yet.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;So to login to second router i need to use local username and password.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When i login to first router using TACACS credentials and then  try to login to second router from first router , it prompts password field directly without giving username prompt, hence mismatching TACACS username vs local password in second router.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It is taking username of first router , but i need to force it to use local username.&lt;/p&gt;&#xA;&lt;p&gt;In Cisco we have options for SHH to specify username { -l }.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ezz3r.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ezz3r.png&quot; alt=&quot;Juniper Possible SSH completion&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6118" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-01-27T12:32:57.183" Title="How to specify username for SSH in Juniper router?" Tags="|juniper|juniper-junos|ssh|cli|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26312" PostTypeId="2" ParentId="26311" CreationDate="2016-01-27T11:23:01.253" Score="6" Body="&lt;p&gt;For some reason the Juniper documentation (&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/command-summary/ssh.html&quot;&gt;http://www.juniper.net/techpubs/en_US/junos13.2/topics/reference/command-summary/ssh.html&lt;/a&gt;) doesn't mention it, but it is possible. The command is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh &amp;lt;username&amp;gt;@&amp;lt;hostname&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-01-27T11:23:01.253" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26313" PostTypeId="2" ParentId="26308" CreationDate="2016-01-27T12:49:04.927" Score="2" Body="&lt;p&gt;This is a quick recipe using Quagga pimd:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Setup Host1 static default route towards RouterA (you could also use an static specific route for the multicast group).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Make sure Host1 source is sending multicast stream with proper TTL (high enough to reach the receivers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Make sure unicast routing towards multicast source is correct on RouterA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4) Run Quagga pimd on RouterA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ATTENTION&lt;/strong&gt;: pimd requires the zebra daemon: run zebra daemon &lt;strong&gt;before&lt;/strong&gt; starting pimd.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! RouterA: interface to source&#xA;! (pimd is enabled on eth0 just to activate multicast on it)&#xA;interface eth0&#xA; ip pim ssm&#xA;&#xA;! RouterA: interface to RouterB&#xA;! (for this simple topology, we actually only need IGMP here)&#xA;interface eth1&#xA; ip pim ssm&#xA; ip igmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;5) Install Quagga pimd on RouterB, in order to run this IGMPv3 join tool:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RouterB: &lt;code&gt;test_igmpv3_join eth1 225.0.30.30 192.168.18.132&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6) Use Quagga pimd commands on RouterA to verify multicast. For instance:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RouterA: &lt;code&gt;show ip mroute&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RouterA: &lt;code&gt;show ip mroute count&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7) If things aren't working as expected, try pimd troubleshooting commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip rib 192.168.18.132 (unicast route towards source?)&#xA;show ip multicast          (multicast enabled at all?)&#xA;show ip mroute             (kernel mcast programming is correct?)&#xA;show ip pim interface      (pim enabled on interfaces?)&#xA;show ip igmp sources       (receiver joined on interface?)&#xA;show ip igmp interface     (igmp enabled on receiver interface?)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From: &lt;a href=&quot;http://git.savannah.gnu.org/cgit/quagga.git/tree/pimd/TROUBLESHOOTING&quot; rel=&quot;nofollow&quot;&gt;http://git.savannah.gnu.org/cgit/quagga.git/tree/pimd/TROUBLESHOOTING&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-01-28T12:25:15.170" LastActivityDate="2016-01-28T12:25:15.170" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="26315" PostTypeId="1" AcceptedAnswerId="26619" CreationDate="2016-01-27T14:32:14.307" Score="3" ViewCount="875" Body="&lt;p&gt;I have a strange problem - after rebooting my Cisco 867 router running IOS 15.5 all inside NAT translations do not work until I remove and re-establish the access group on the outside interface. I'm sure there is an ordering problem on reboot but I can't figure out why. My configs are listed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ip inspect name Internet-out icmp router-traffic&#xA;  ip inspect name Internet-out tcp router-traffic&#xA;  ip inspect name Internet-out udp router-traffic&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Outside interface config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet2&#xA;ip address dhcp&#xA;ip access-group Internet in&#xA;no ip unreachables&#xA;ip inspect Internet-out out&#xA;ip nat outside&#xA;ip virtual-reassembly in&#xA;duplex auto&#xA;speed auto&#xA;no cdp enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Access group causing the issue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended Internet&#xA;permit udp any any eq domain log&#xA;permit tcp any any eq domain log&#xA;permit tcp any any eq www log&#xA;permit tcp any any eq 443 log &#xA;deny ip any any log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After a reboot - I have to manually do the following otherwise no inside NAT translations work -&quot;show ip nat translations&quot; shows nothing in the table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet2&#xA;no ip access-group Internet in&#xA;ip access-group Internet in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And like magic it all starts working. I've checked the running-config order and it is exactly the same after I issue the command to when it reboots. I'm stumped and can't figure this out.&lt;/p&gt;&#xA;" OwnerUserId="22167" LastActivityDate="2016-02-08T01:23:33.950" Title="Cisco IOS nat inside not working working after reboot" Tags="|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26318" PostTypeId="1" CreationDate="2016-01-27T19:31:03.090" Score="1" ViewCount="53" Body="&lt;p&gt;I was stimulating a program in ns2. The program consist of 4 nodes arranged as 1,2,3,4,5. Each of these nodes are connected with a 2 Mbps link, and I was sending data from node 1 to 5 through intermediate nodes 2,3 and 4. The connection used was TCP connection and was sending FTP data over it. What I'm confused is even if I set data rate to 2 Mbps and 8 Mbps im getting the same throughput and delay. shouldn't the throughput reduce due to congestion as im trying to sending data at 8 Mbps speed through 2 Mbps link?&lt;/p&gt;&#xA;" OwnerUserId="22386" LastEditorUserId="27143" LastEditDate="2016-06-14T05:16:18.803" LastActivityDate="2016-06-14T05:16:18.803" Title="sending more datarate through less bandwidth" Tags="|tcp|" AnswerCount="0" CommentCount="1" ClosedDate="2020-12-21T18:31:37.063" ContentLicense="CC BY-SA 3.0" />
  <row Id="26321" PostTypeId="1" CreationDate="2016-01-27T22:59:27.647" Score="3" ViewCount="50281" Body="&lt;p&gt;I'm trying to connect two routers together for a Cisco lab I have been given on Packet Tracer. They use a DCE connection. I've been told how to configure the routers but when I input the command &quot;clock rate 56000&quot; whilst in the interface sub-configuration, and bare in mind I've followed the instructions accurately, I get the message &quot;This command applies only to DCE interfaces.&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C0jBg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C0jBg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be causing this? I tried Googling the problem but I couldn't make sense of the solutions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aC4pV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aC4pV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22393" LastActivityDate="2016-01-28T01:33:26.163" Title="Packet Tracer: &quot;This command applies only to DCE interfaces.&quot;" Tags="|cisco|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26322" PostTypeId="2" ParentId="26321" CreationDate="2016-01-28T01:33:26.163" Score="7" Body="&lt;p&gt;As Ron pointed out, the command will take on the other device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Serial Cables can operate a variable clock rates, or frequencies. This is the duration a voltage is applied to the wire to transmit a single bit. Unlike Ethernet, who's frequencies are built into the specification itself (10BASE-T, 100BASE-TX, etc), Serial Links's frequency can be set differently on each link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But crucial to transmitting data is for both sides of the cable to use the same Frequency. So a Serial Link elects one side of the cable to be the Clock Master (if you will), and the other side of the cable simply agrees to the frequency set by the Clock Master.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Serial Cable has a DCE and a DTE side. The DCE side is elected as the Clock Master, so the device which has the DCE side of the cable connected to it must be the one which you enter the &lt;code&gt;clock rate&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To determine what side of the cable is connected, you can use the command &lt;code&gt;show controllers s0/0/0&lt;/code&gt;. Four or five lines from the top you'll see it labeled as DTE or DCE.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-01-28T01:33:26.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26323" PostTypeId="1" AcceptedAnswerId="26327" CreationDate="2016-01-28T05:45:52.743" Score="1" ViewCount="85" Body="&lt;p&gt;I've recently gotten a home lab started to start studying for the CCNA that consists of a few catalyst switches, 3 1760s and a single 1841. I've been messing around with saving configurations on a flash drive from the 1841. Is is possible for a 1760 to access the flash drive's file system on an 1841 and save to it? If so, what changes would I have to make to either or both devices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="22397" LastEditorUserId="8499" LastEditDate="2016-01-28T18:14:33.980" LastActivityDate="2016-01-28T18:14:33.980" Title="Can a Cisco 1760 save to flash on an 1841" Tags="|cisco|router|cisco-ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26324" PostTypeId="1" CreationDate="2016-01-28T06:33:07.750" Score="1" ViewCount="74" Body="&lt;p&gt;I actually posted this question yesterday.&#xA;I'm here to ask you guys again after testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;↓↓↓First of all, please see my question↓↓↓&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;My customers told me that the access speed is really slow markedly!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Circumstances]&lt;/strong&gt; Everything is OK, every packet flows well. However, now I have focused on the speed... That is, connection is ok&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[Issues]&lt;/strong&gt; Whenever I connect or access the web servers, the access speed markedly slow. &#xA;(It took for 10~20 seconds until web page has completed.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it is fast sometimes... That is, slow, fast, slow, fast --- continuous&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[The data]&lt;/strong&gt; First, please see the below network structure.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RjaG6.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RjaG6.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;strong&gt;[The things that I want to know]&lt;/strong&gt; As you can see the data, the structure is not complicated. To tell the truth, I don't know what device is the problem. and I also don't know what can I see in order to fix it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to know whether device's problem. If so, how can I control it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards, SK&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I'll let you know how I test after posting this question yesterday.&#xA;( &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/26306/l4-f-whow-can-i-deal-with-speed&quot;&gt;[L4, F/W]How can I deal with SPEED?&lt;/a&gt; ) &amp;lt;-- Yesterday question I posted.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I captured packets with wireshark. As you can see the below capture, it showed Retransmission message. However, the frequency was very low.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I assume that it is common situation that only &lt;strong&gt;one&lt;/strong&gt; retransmission is showed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Gtlry.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Gtlry.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For me, the speed is extremely normal.&#xA;But my two customers among them told its speed was really low...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You know, on the google chrome, we can measure speed using F12 button.&#xA;my customer captured this picture. (DNS lookup issue..?)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/M44mY.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/M44mY.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What should I do..?&#xA;I really want to get an advice..!&#xA;Could you give me an advice?&#xA;Regards,&#xA;SK&lt;/p&gt;&#xA;" OwnerUserId="20562" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-01-28T18:15:38.633" Title="How to assure where the problem is occurring?" Tags="|cisco|switch|troubleshooting|network-core|speed|" AnswerCount="1" CommentCount="8" ClosedDate="2016-01-28T20:59:14.653" ContentLicense="CC BY-SA 3.0" />
  <row Id="26326" PostTypeId="2" ParentId="26323" CreationDate="2016-01-28T06:39:51.097" Score="1" Body="&lt;p&gt;(Not in the manner you may be expecting.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could enable the tftp server -- and/or scp server -- and use that as the url for your copies. In that respect, it's no different than sending them to any other machine/file server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(scp) &lt;code&gt;ip scp server enable&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[update] the IOS tftp-server is for reading files, it doesn't support writing.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2016-01-28T06:51:27.593" LastActivityDate="2016-01-28T06:51:27.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26327" PostTypeId="2" ParentId="26323" CreationDate="2016-01-28T06:40:11.797" Score="0" Body="&lt;p&gt;You can't have one router directly access the file system on a different router, but you could send a file from one router to the other with something like TFTP, and receive it on the other router using the same protocol, and save it to the local file system. Cisco routers support multiple transfer protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 (sending router):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#tftp-server nvram://startup-config &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2 (receiving router):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#copy tftp: flash:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/2500-series-routers/15092-copyimage.html#copying_one_router&quot; rel=&quot;nofollow&quot;&gt;Copying From One Router to Another&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-28T07:13:19.357" LastActivityDate="2016-01-28T07:13:19.357" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26328" PostTypeId="1" AcceptedAnswerId="26332" CreationDate="2016-01-28T07:12:58.403" Score="2" ViewCount="2463" Body="&lt;p&gt;I am trying to understand how ECN flag affects TCP congestion window of sender (snd_cwnd parameter in linux).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do so,  I used scapy to generate the desired packet on HostA directed to HostB as sr(IP(src='a.a.a.a',dst='b.b.b.b')/TCP(flags=0x050)).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This  did trigger hostA to send a  tcp ecn enabled packet to hostB, but since scapy works in user space and not particularly with Linux Kernel TCP I could not extract the the congestion window parameters .&#xA;I then used StraemSocket() module of scapy to tie scapy  connection to linux TCP socket.&#xA;Hosta = server(a.a.a.a), HostB =client(b.b.b.b)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;code as below:&#xA;server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from scapy.all import *&#xA;import socket&#xA;&#xA;serversocket = socket.socket()&#xA;serversocket.bind((&quot;a.a.a.a&quot;,9876))&#xA;serversocket.listen(1)&#xA;sc,sockname = serversocket.accept()&#xA;serverstream=StreamSocket(sc)&#xA;serverstream.sr(IP(src='a.a.a.a',dst='b.b.b.b')/TCP(flags=0x050))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;client:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from scpay.all import *&#xA;import socket&#xA;clientsocket = socket.socket()&#xA;clientsocket.connect((&quot;a.a.a.a&quot;,9876))&#xA;clientstream = StreamSocket(clientsocket)&#xA;clientstream.sr(IP(src=&quot;b.b.b.b&quot;,dst=&quot;a.a.a.a&quot;)/TCP(flags=&quot;S&quot;))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as can be seen from below snapshot, 3 way handshake with ecn and cwd flags is successful( I have enabled ecn on the hosts and all intermediate routers). but wireshark just doesn’t capture the ecn flagged packet sent by server.I am not sure if the server sent the packet at all and I am really at the end of my thoughts here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Cf0OS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Cf0OS.png&quot; alt=&quot;missing ecn enabled tcp packet&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22398" LastEditorUserId="22398" LastEditDate="2016-01-28T07:26:31.477" LastActivityDate="2016-01-29T12:04:32.670" Title="Using StreamSocket() mrthod of Scapy to send ECN enabled TCP packets" Tags="|tcp|congestion|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="26330" PostTypeId="1" AcceptedAnswerId="26352" CreationDate="2016-01-28T09:08:10.107" Score="3" ViewCount="3456" Body="&lt;p&gt;I have simple VLAN network diagram .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to show how the TCI field can be used to have a VLAN number policy for this diagram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Frp96.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Frp96.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21873" LastEditorUserId="8499" LastEditDate="2016-01-28T18:13:44.100" LastActivityDate="2016-01-28T18:13:44.100" Title="TCI ( Tag control information ) use VLAN" Tags="|vlan|lan|switching|trunk|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26332" PostTypeId="2" ParentId="26328" CreationDate="2016-01-28T10:21:19.067" Score="2" Body="&lt;p&gt;&#xA;When using a &lt;code&gt;StreamSocket&lt;/code&gt;, the packets sent are sent over the TCP connection. In Scapy notation, when you type &lt;code&gt;serverstream.sr(IP(src='a.a.a.a',dst='b.b.b.b')/TCP(flags=0x050))&lt;/code&gt; (BTW, you can replace &lt;code&gt;flags=0x050&lt;/code&gt; by &lt;code&gt;flags=&quot;AE&quot;&lt;/code&gt;), it will result in sending a packet like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP(src=&quot;a.a.a.a&quot;, dst=&quot;b.b.b.b&quot;) / TCP(flags=&quot;PA&quot;) / \&#xA;    IP(src=&quot;a.a.a.a&quot;, dst=&quot;b.b.b.b&quot;)/TCP(flags=&quot;AE&quot;)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first &lt;code&gt;IP()/TCP()&lt;/code&gt; layers are not under Scapy's control, but under the server's network stack control (e.g., you cannot change the flags there with Scapy).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second &lt;code&gt;IP()/TCP()&lt;/code&gt; layers, converted as an &lt;code&gt;str()&lt;/code&gt; object, are the packet crafted by Scapy (so you have a total control over it). On the network, and for Wireshark, the packet is only raw data transported over TCP. You can guess that the fourth and sixth packets shown on your screenshot are &lt;code&gt;IP()/TCP()/IP()/TCP()&lt;/code&gt; thanks to the length of the data (40 bytes, &lt;code&gt;len(IP()/TCP())&lt;/code&gt; returns &lt;code&gt;40&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can save your capture (as PCAP, not PCAPNG) from Wireshark, and then load it in Scapy to decode it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; x = rdpcap('your_capture.cap')&#xA;&amp;gt;&amp;gt;&amp;gt; PacketList(IP(str(p[TCP].payload)) for p in x&#xA;...            if TCP in p and p[IP].len &amp;gt;= 80).show()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to control the TCP options with Scapy, then you have to create the packets and send them with &lt;code&gt;sr()&lt;/code&gt; (but then you will have to open the connection by yourself).&lt;/p&gt;&#xA;" OwnerUserId="11846" LastEditorUserId="11846" LastEditDate="2016-01-29T12:04:32.670" LastActivityDate="2016-01-29T12:04:32.670" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26333" PostTypeId="1" AcceptedAnswerId="26472" CreationDate="2016-01-28T10:22:36.493" Score="1" ViewCount="1315" Body="&lt;p&gt;I have a Question. We actually have a Cisco 1812 Router and we're Switching to an ASA 5512-X. The Problem is, the ASA 5512-X only has 6 Ports. The 1812, had 8. All in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We need to translate 3 Public IP Adresses into our Private IP Adresses for our Servers in the DMZ. We also need the other Ports. Our Situation now is, that the 3 IP Adresses are translated from the Router. But with the ASA we don't have enough Ports for this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Question is, can I &quot;forward&quot; those 3 IP Addresses from the ASA over the BLUE Port (in my Picture) to the Switch (I think i need Layer3 for this?!) and the Switch does the Translation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Translation should be: Public IP A,B or C comes in from the Internet to the ASA, get forwarded to the switch and the switch translates it to the correct private IP. Public IP A to Public IP B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have asked this in another Forum and got the answer, that an ASA can't replace a Router. Yes this is right but we don't need much functionality. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have 4 seperate subnet. One DMZ. And three AP with two different VLAN. Thats all. And you see, this er six ports. 4 for our subnets, 1 for WIFI (I Hope i can only use one for 3 APs) and 1 for DMZ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are their any other solutions? Maybe using a normal router? a newer one, not the 1812.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bwzRM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bwzRM.png&quot; alt=&quot;IsThisPossible?(Picture)&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22401" LastActivityDate="2016-02-02T13:33:41.927" Title="ASA/Router/Switch NAT for DMZ" Tags="|cisco|routing|switch|cisco-asa|nat|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26334" PostTypeId="1" CreationDate="2016-01-28T11:20:46.960" Score="0" ViewCount="89" Body="&lt;p&gt;Disclaimer: I'm a software dev so this low level stuff isn't my area of expertise! I hope I'm on the right Stack Exchange site for this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm developing a Windows application that communicates with a hardware device via TCP/IP. The device is an FPGA board which I believe runs Linux. Interaction involves the PC sending a small &quot;request&quot; message to the device, which responds with a block of data, approx 32kb in length. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I've written a very basic PC client to test the comms. I click a button which sends a request to the FPGA then reads the response back. This entire process (from clicking the button to receiving the entire 32kb response) typically takes around 2-3ms. I can keep clicking the button every second or two and the timings will remain at this level. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I've found that if I start clicking the button a little quicker (a couple of times a second) then after a few seconds this time will drop to around 12ms. It will remain at this level even if I then slow down my button clicking. If I disconnect/reconnect the client* then try again, timings are back to the 2-3ms level. (* I just close the connection then reconnect, I don't actually restart the application).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm as confident as I can be that it's not the software on the PC or FPGA, both of which are really very simple. Gut feeling is that it's something &quot;protocoly&quot;? Below are Wireshark screenshots showing traces from a &quot;fast&quot; response, and one from when it has dropped to 12ms. Any thoughts?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0emZ4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0emZ4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xvzzH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xvzzH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22403" LastActivityDate="2016-01-28T16:03:36.053" Title="Strange drop in transmission speed over TCP/IP" Tags="|tcp|" AnswerCount="1" CommentCount="3" ClosedDate="2016-01-28T16:10:38.067" ContentLicense="CC BY-SA 3.0" />
  <row Id="26335" PostTypeId="1" CreationDate="2016-01-28T12:15:14.303" Score="0" ViewCount="145" Body="&lt;p&gt;Here's the description of my problem :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've a VPN LAN-to-LAN between my company and a customer. My subnet is &lt;code&gt;192.168.37.0/24&lt;/code&gt;. The tunnel works perfectly.&#xA;But, I want to access to my customer network from an another network. The another network has this subnet : &lt;code&gt;192.168.33.0/24&lt;/code&gt;. How to configure it ?&#xA;The connection between my two networks are OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've a &lt;code&gt;Cisco ASA 5510&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="22406" LastActivityDate="2016-04-02T11:23:18.497" Title="Access to tunnel VPN from another network" Tags="|cisco-asa|vpn|nat|" AnswerCount="2" CommentCount="0" ClosedDate="2019-12-02T17:27:08.140" ContentLicense="CC BY-SA 3.0" />
  <row Id="26336" PostTypeId="1" CreationDate="2016-01-28T13:16:14.700" Score="2" ViewCount="580" Body="&lt;p&gt;In order to debug a networking problem, I introduced logging with iptables:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;for chain in INPUT FORWARD OUTPUT; do&#xA;    iptables -A $chain -j LOG --log-level info --log-prefix filter_$chain&#xA;done&#xA;for chain in PREROUTING INPUT OUTPUT POSTROUTING; do&#xA;    iptables -t nat -A $chain -j LOG --log-level info --log-prefix nat_$chain&#xA;done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now for testing purposes, I created two network namespaces and two&#xA;veth pairs, so that the network namespaces communicate via the default namespace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;namespace a               default namespace         namespace b&#xA;10.20.30.50 ---- 10.20.30.40  &amp;lt;------&amp;gt;  1.2.3.4 ---- 1.2.3.5&#xA;          veth pair          forwarding        veth pair&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I enter namespace a and ping the host 1.2.3.5 in namespace b, the echo request and reply get forwarded&#xA;in the default namespace. In the system logs, I see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat_PREROUTING [...] SRC=10.200.30.50 DST=1.2.3.5 [...] TTL=64 ID=16847 DF PROTO=ICMP TYPE=8 CODE=0 ID=14460 SEQ=1&#xA;filter_FORWARD [...] SRC=10.200.30.50 DST=1.2.3.5 [...] TTL=63 ID=16847 DF PROTO=ICMP TYPE=8 CODE=0 ID=14460 SEQ=1&#xA;nat_POSTROUTING [...] SRC=10.200.30.50 DST=1.2.3.5 [...] TTL=63 ID=16847 DF PROTO=ICMP TYPE=8 CODE=0 ID=14460 SEQ=1&#xA;&#xA;filter_FORWARD [...] SRC=1.2.3.5 DST=10.200.30.50 [...] TTL=63 ID=36035 PROTO=ICMP TYPE=0 CODE=0 ID=14460 SEQ=1&#xA;&#xA;filter_FORWARD [...] SRC=10.200.30.50 DST=1.2.3.5 [...] TTL=63 ID=16866 DF PROTO=ICMP TYPE=8 CODE=0 ID=14460 SEQ=2&#xA;filter_FORWARD [...] SRC=1.2.3.5 DST=10.200.30.50 [...] TTL=63 ID=36274 PROTO=ICMP TYPE=0 CODE=0 ID=14460 SEQ=2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wonder why only the first echo request hits the log target in the PREROUTING&#xA;and in the POSTROUTING chain, while all subsequent packages merely hit the log target&#xA;in the FORWARD chain.&lt;/p&gt;&#xA;" OwnerUserId="20139" LastEditorUserId="20139" LastEditDate="2016-01-28T13:26:06.547" LastActivityDate="2016-01-28T22:42:28.847" Title="Packets seem to bypass netfilter prerouting hook" Tags="|routing|linux|packet-analysis|logging|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26337" PostTypeId="2" ParentId="26333" CreationDate="2016-01-28T13:24:37.163" Score="1" Body="&lt;p&gt;In fact, you could implement a solution with the servers connected to the switch with your old router too. I mean, you could connect the switch to one of the router's port, have 2 ports free, and servers connect through the switch. I hope you agree that the need for NAT does not mean that every NAT-ed device must use an individual port on the router/ASA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, IMO the place for doing NAT should be ASA and your switch could be Layer2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put one ASA's port into your DMZ, give it appropriate security level, connect there the switch, tell the servers to use ASA's DMZ port as a gateway and you are done. Oh, the NAT rules, of course, - not too hard with ASDM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think, the rest of your configuration could be  somewhat optimised too (in the part of using ASA's ports), but let's stop here.&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-01-28T13:24:37.163" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26338" PostTypeId="2" ParentId="26335" CreationDate="2016-01-28T13:31:58.433" Score="0" Body="&lt;p&gt;it's a nonsense question without details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose YOUR ASA defines traffic between your and customer networks (let's say represented by 192.168.37.0/24 and 10.20.30.0/24) and 192.168.33.0/24 is NOT coming out from a VPN but is a local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can't just send pkt from 192.168.33.12 to 10.20.30.65 because the source is not included into &quot;encription domain&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so you can ask counterpart to ADD the new net into VPN (as you will do at your endpoint), or simply NAT some address from 192.168.33.0/24 into 192.168.37.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in case 192.168.33.0/24 is coming from another VPN you can only use NAT, but not redefinition of encr-domain.&lt;/p&gt;&#xA;" OwnerUserId="22173" LastActivityDate="2016-01-28T13:31:58.433" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26339" PostTypeId="2" ParentId="26135" CreationDate="2016-01-28T13:40:23.543" Score="1" Body="&lt;p&gt;you're thinking about errors at your side, but often the matter is elsewhere except under your control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;just to know what is happening pick up traffic at dump-level (read &quot;capture&quot; in cisco terms or &quot;tcpdump&quot; in unix) and look : if ICMP-echo-req is leaving your firewall in the interface nearest to destination and no ICMP-echo-reply is coming back (at same interface) : the matter is not at your device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;moreover : ARP must not walk the firewall, it's a nonsense except for very unusual cases.&lt;/p&gt;&#xA;" OwnerUserId="22173" LastActivityDate="2016-01-28T13:40:23.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26340" PostTypeId="2" ParentId="26135" CreationDate="2016-01-28T13:50:27.327" Score="0" Body="&lt;p&gt;Check the firewall logs.  If it is blocking pings, it will tell you so.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-28T13:50:27.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26341" PostTypeId="2" ParentId="20735" CreationDate="2016-01-28T13:55:45.747" Score="1" Body="&lt;p&gt;you are speaking different languages.....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the question is wrong: there is no timeout discovery or notification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if pkt X where get lost CONNECTION IS NOT; sending host will not receive ACK for that pkt wile (not)receiving host just see more and more data coming from source; when &quot;second copy&quot; arrives TCP reassemby all into a meaningful something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if TCP connection X get lost it mean that a firewall or other active device has dropped it (and allow not to rebuild except if you made a new one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so, there is no kind of timeout discovery except timeout expiration that is not a discovery nor a notification&lt;/p&gt;&#xA;" OwnerUserId="22173" LastActivityDate="2016-01-28T13:55:45.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26343" PostTypeId="1" AcceptedAnswerId="26685" CreationDate="2016-01-28T14:15:27.863" Score="0" ViewCount="3217" Body="&lt;p&gt;In case, two physical hosts have one of OpenvSwitch bridge each other.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;remote server ip: 1.1.1.1&lt;/li&gt;&#xA;&lt;li&gt;local server ip: 2.2.2.2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How to connect two OpenvSwitch bridge by geneve? and how to validate packet?&lt;/p&gt;&#xA;" OwnerUserId="22407" LastActivityDate="2016-02-10T16:59:30.177" Title="How to create Geneve tunnel with OpenvSwitch?" Tags="|tunnel|sdn|" AnswerCount="1" CommentCount="1" ClosedDate="2019-03-26T02:24:24.427" ContentLicense="CC BY-SA 3.0" />
  <row Id="26344" PostTypeId="2" ParentId="26279" CreationDate="2016-01-28T14:37:09.280" Score="1" Body="&lt;p&gt;as stated in &lt;a href=&quot;https://supportforums.cisco.com/discussion/10780211/help-underrun-errors&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/10780211/help-underrun-errors&lt;/a&gt; : underruns occours when rx-ring is full (unable to accept more pkts); it mean that NIC is unable to pass data to IP level at same speed they arrive at NIC.&lt;/p&gt;&#xA;" OwnerUserId="22173" LastActivityDate="2016-01-28T14:37:09.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26345" PostTypeId="1" AcceptedAnswerId="26355" CreationDate="2016-01-28T14:40:37.837" Score="4" ViewCount="2847" Body="&lt;p&gt;I researched a lot of native VLAN tagging resources, but I still don't understand what is the difference with VLAN tagging. Can anyone explain it simply?&lt;/p&gt;&#xA;" OwnerUserId="22407" LastEditorUserId="8499" LastEditDate="2016-01-28T18:12:28.897" LastActivityDate="2016-01-28T18:12:28.897" Title="What is native vlan tagging?" Tags="|vlan|switching|trunk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26348" PostTypeId="2" ParentId="26334" CreationDate="2016-01-28T15:58:13.477" Score="1" Body="&lt;p&gt;Going to thrown a partial answer out there.  The packet trace shows that from when the ack is sent by your PC to your FPGA, about 1ms elapses until the FPGA starts sending more traffic.  The first example shows the FPGA putting lots more bytes &quot;in flight&quot; (sent before an ack) which means the ACK delay penalty was only seen twice.  The second example shows an ack after every 2 packets, and then a 1ms delay.  This adds up quickly so that at the end of the 32kb transmission, the 10 extra acks slow it down by about 10ms.  Why the FPGA is waiting for acks more frequently is unclear, but if it's Linux based there are ways of controlling the window size, scaling, and acking in the kernel that you should probably try in order to have more deterministic behavior (the defaults often try to automatically adjust to network conditions by watching things like delays, buffer capacity, dropped packets, etc).  If you suspect the PC is at fault for some reason you can control the behavior in windows via specific registry keys.  One other thing to look at is the use/effect of Nagle's algorithm by the host/client.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastEditorUserId="6361" LastEditDate="2016-01-28T16:03:36.053" LastActivityDate="2016-01-28T16:03:36.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26349" PostTypeId="2" ParentId="26291" CreationDate="2016-01-28T15:58:59.003" Score="1" Body="&lt;p&gt;It is possible to announce a prefix in BGP to the same provider from different locations and it would work. This should be coordinated in advance with the ISP in order to accept the same prefixes from 2 locations and to manage the Inbound routing policies.&lt;/p&gt;&#xA;" OwnerUserId="14080" LastActivityDate="2016-01-28T15:58:59.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26351" PostTypeId="2" ParentId="26345" CreationDate="2016-01-28T16:05:49.430" Score="3" Body="&lt;p&gt;The native VLAN is the VLAN that is assumed when there is not a VLAN tag.  For example, if you have a VOIP phone connected to a switch, running on VLAN 10 and then your computer connected to the phone for network access.  The computer will not tag the traffic, so either the phone or the switch will assign the VLAN to the untagged traffic as it passes through.  &lt;/p&gt;&#xA;" OwnerUserId="21974" LastActivityDate="2016-01-28T16:05:49.430" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26352" PostTypeId="2" ParentId="26330" CreationDate="2016-01-28T16:12:32.593" Score="2" Body="&lt;p&gt;Except for frames in the native VLAN, when a switch puts a frame on a trunk, it inserts a VLAN tag into the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TCI is 16 bits, which increases the maximum frame size from 1518 bytes to 1522 bytes. The first four bits basically serve the purpose of layer-2 QoS. Three bits are for the priority, and one bit is for indicating whether or not the frame is eligible to be dropped if there is congestion, although in extreme congestion, it can be dropped, anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last 12 bits of the TCI are the VLAN ID. This gives 4096 different VLAN numbers (0 to 4095), the first and last of which are reserved for special purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch, receiving a tagged frame will look at the TCI before stripping it out of the frame and sending it to an access switch port which is configured for the VLAN contained in the VLAN ID of the TCI. It strips the tag out of the frame on access ports because hosts generally don't know what to do with a tagged frame. If a host supports tagged frames, the switch port to the host can be configured as a trunk port instead of an access port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VLAN numbering policy is up to the network designer. Typically, VLAN 1 is used for the native VLAN (untagged frames on trunks) because it is the default VLAN for most switches. Using VLAN 1, or even having a native VLAN at all, can open you up to some layer-2 attacks and security risks, but depending on the vendor, switch model, or software version, some switches must use VLAN 1 and/or a native VLAN. Cisco switches will not let you remove VLAN 1, but with modern IOS, you can restrict any VLAN, including VLAN 1, from a trunk, and you don't need to have a native VLAN configured for a trunk.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-28T17:05:22.657" LastActivityDate="2016-01-28T17:05:22.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26354" PostTypeId="2" ParentId="26299" CreationDate="2016-01-28T16:34:31.047" Score="0" Body="&lt;p&gt;To add to the answers you already have... The ports on the 5505 are Layer 2, meaning you assign VLANs to them and assign the IP addresses to the VLANs.  Many people have this complaint related to the 5505 upgraded to 5506, which is a similar situation that you are in.  They are layer 3 ports.  You assign the addresses directly to the ports, and you cannot have multiple ports on the same subnet like before.  This is in addition to the loss of the two POE ports.  Your only solution is to have a smart switch that can handle multiple VLANs or multiple dumb switches, one for each of your subnets, plugged into different configured ports.&lt;br&gt;&#xA;You must add additional hardware (assuming you don't have switches in the picture, since you didn't mention them) for you to maintain the same functionality and enjoy the larger speed.&lt;/p&gt;&#xA;" OwnerUserId="21974" LastActivityDate="2016-01-28T16:34:31.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26355" PostTypeId="2" ParentId="26345" CreationDate="2016-01-28T16:34:59.210" Score="4" Body="&lt;p&gt;VLAN tags are only used on trunk links. Most hosts cannot understand VLAN tags since they increase the frame size. Hosts that do understand VLAN tags may be connected with a trunk link instead of an access link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The definition of a native VLAN frame on a trunk is that it &lt;em&gt;does not&lt;/em&gt; contain a VLAN tag. All the frames in any other VLANs on the trunk &lt;em&gt;do&lt;/em&gt; contain VLAN tags. Depending on the switch model and software version, each trunk link may have a different VLAN as the native VLAN, but both ends of a trunk should agree on which VLAN is the native VLAN, otherwise various problems may arise, such as traffic being sent to the wrong VLAN or incorrectly bridging two different VLANs into one broadcast domain.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-28T16:34:59.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26356" PostTypeId="2" ParentId="26066" CreationDate="2016-01-28T17:00:39.697" Score="0" Body="&lt;p&gt;I think you are missing a key point to the networking... On a single network/subnet, all the devices must be on the same network/subnet.  So, if you have port 1 as 192.168.1.1 with a mask of 255.255.255.0, that means that all devices off that port must be in the IP range of 192.168.1.2-192.168.1.254 (since you cannot use 192.168.1.0 or 192.168.1.255) and they all must have a mask of 255.255.255.0.  You cannot just change an IP address of a device on that network to something else, that will not work for many reasons.  Same goes for 192.168.255.2.  Not sure if that is a typo, but nothing you mentioned would contain that IP address in the subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have two options that I can think of to get your desired result with the 200.200.1.254 IP address.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;leave the IP addresses in the correct subnet for each port they are plugged into, then use NAT to forward based on the port (UDP53 for DNS and TCP80 and 443 for WWW) pointing to the appropriate servers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;combine both roles (DNS and webhosting) into a single server, leave the IP address of 200.200.1.254, but make the port that it plugs into on that same subnet, possibly 200.200.1.1 mask: 255.255.255.0.  Then you just have the clients access it based on that IP address.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21974" LastActivityDate="2016-01-28T17:00:39.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26357" PostTypeId="2" ParentId="26333" CreationDate="2016-01-28T17:15:06.503" Score="0" Body="&lt;p&gt;First off, in your picture you show a 2960 switch, I am not aware of any 2960s being layer 3, they are all layer 2.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use a 2960 layer 2 switch her to meet all your needs.  On the ASA, all of the inside networks can share a single port, using sub interfaces with VLANs.  You set your switch to a trunk port with the appropriate allowed VLANs and you can then assign the appropriate ports on the switch to access the appropriate VLAN.  &lt;/p&gt;&#xA;" OwnerUserId="21974" LastActivityDate="2016-01-28T17:15:06.503" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26358" PostTypeId="2" ParentId="26324" CreationDate="2016-01-28T17:25:08.870" Score="1" Body="&lt;p&gt;To find the problem you must first know what the problem is.  &quot;Slow&quot; is a horrible description, we don't know what it is being compared to.  Do your own testing from different network segments, monitor utilization of the significant links and look for trends or a pattern of fast vs. slow.  Easiest is to rule out network VS server.  Check utilization, errors on the switch ports, etc.  A speed/duplex mismatch anywhere could cause it.  If you find nothing, then you will start looking into the servers' utilization.  If there are multiple servers responding in a HA environment, maybe the responses are different from each.  There are so many different possibilities right now, you need to narrow down the playing field until you get closer and closer.&lt;/p&gt;&#xA;" OwnerUserId="21974" LastActivityDate="2016-01-28T17:25:08.870" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26361" PostTypeId="1" CreationDate="2016-01-28T19:28:09.407" Score="8" ViewCount="394" Body="&lt;p&gt;Is ethernet describing the protocol and therefore cat5 cables became labelled ethernet cables because they are used for this protocol?&lt;/p&gt;&#xA;" OwnerUserId="22420" LastEditorUserId="8499" LastEditDate="2019-01-03T02:03:30.780" LastActivityDate="2019-01-03T02:03:30.780" Title="Is ethernet a term describing just the protocol or the interfaces also?" Tags="|ethernet|layer1|layer2|cabling|utp|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26362" PostTypeId="2" ParentId="26361" CreationDate="2016-01-28T19:54:33.523" Score="0" Body="&lt;p&gt;'Ethernet Cables' really describe RJ45.  RJ45 has standards associated to it to carry a Layer 2 (&lt;a href=&quot;https://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow&quot;&gt;see OSI model&lt;/a&gt;) signal called Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other Layer 2 signals include&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Token Ring&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;MPLS&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;MOE (metro optical &lt;em&gt;ethernet&lt;/em&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;RJ45 has two twisted pair that must have a certain amount of twists in them per foot to prevent signal crossover from power cords, radio signals, etc.  Additionally, 'the signal' can only traverse a certain amount of distance before the signal attenuates, which is in the standard.&lt;/p&gt;&#xA;" OwnerUserId="13479" LastActivityDate="2016-01-28T19:54:33.523" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26364" PostTypeId="2" ParentId="26361" CreationDate="2016-01-28T20:07:14.810" Score="1" Body="&lt;p&gt;Ethernet runs on various different media, of which UTP cabling is only one medium. There are other LAN and other technologies, such as POTS, which can use UTP cabling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UTP cabling has various registered categories. Category-5 cabling is no longer registered, and it hasn't been this century. The current registered categories are Category-3, Category-5E, Category-6, and Category-6A. Different variants of ethernet on UTP require a minimum category. For instance, 10 Mb ethernet can run on Category-3 or above, but 100 Mb ethernet requires at least Category-5E.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-01-28T20:07:14.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26365" PostTypeId="2" ParentId="25930" CreationDate="2016-01-28T20:44:12.873" Score="0" Body="&lt;p&gt;I have tested it locally. the request and reply packets may take different paths.&lt;/p&gt;&#xA;" OwnerUserId="19353" LastActivityDate="2016-01-28T20:44:12.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26366" PostTypeId="1" AcceptedAnswerId="26495" CreationDate="2016-01-28T22:38:59.970" Score="4" ViewCount="5157" Body="&lt;p&gt;New to stack exchange and Python. Hopefully this is allowed to be asked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am taking a class on Python and finally starting to dip my toe into the water.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a ton to learn but I already have a use case that I personally would find helpful and practical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an upcoming project that will require me to login and touch every device, finding all instances of &quot;ip-helper&quot; configured and altering the current IP addresses stored.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the ip-helper exists under any number of SVIs, not only would you have to be able to do a show run and find all instances of ip-helper being configured but you'd also have to be able to identify what SVI its configured under to then generate the new config that would have to be applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would anyone have a working example of a script that would do this that I can learn from and use?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would think something like this could be applied to many things when it comes to Cisco device configuration?  Finding any number of strings, checking to make sure if it is a sub configuration and what the parent would be prior to generating and applying new replacement config?&lt;/p&gt;&#xA;" OwnerUserId="22424" LastActivityDate="2023-11-14T13:09:03.913" Title="Python Script to change ip-helper IP on Cisco devices?" Tags="|cisco|automation|" AnswerCount="3" CommentCount="1" ClosedDate="2018-03-26T19:05:09.913" ContentLicense="CC BY-SA 3.0" />
  <row Id="26367" PostTypeId="2" ParentId="26336" CreationDate="2016-01-28T22:42:28.847" Score="2" Body="&lt;p&gt;This is a side effect of route cache and connection tracking. The packet of a new flow will go through the full stack, all subsequent packets match an existing flow (conntrack entry) and are immediately forwarded.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-28T22:42:28.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26368" PostTypeId="1" CreationDate="2016-01-28T22:49:15.020" Score="1" ViewCount="251" Body="&lt;p&gt;I have a Netgear FVS318N Firewall/Router, GS752TP Switch, and a Netgear WNAP210 AP. After a bit of searching, I have identified a machine that is using the lion's share of bandwidth (youtube).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to limit bandwidth rates on a device basis using the hardware I have, or alternatively, for a particular VLAN?  &lt;/p&gt;&#xA;" OwnerUserId="22425" LastEditorUserId="8499" LastEditDate="2016-01-28T23:12:32.927" LastActivityDate="2016-01-28T23:12:32.927" Title="Throttling Internet speed to device or vlan" Tags="|vlan|qos|bandwidth|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26369" PostTypeId="2" ParentId="26368" CreationDate="2016-01-28T22:57:16.920" Score="1" Body="&lt;p&gt;It's in the manual, &lt;a href=&quot;http://www.downloads.netgear.com/files/GDC/FVS318N/FVS318N_CLI.pdf&quot; rel=&quot;nofollow&quot;&gt;CLI Manual&lt;/a&gt;, starting on page 148:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Bandwidth Profile Commands&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;security bandwidth profile add&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This command configures a new bandwidth profile. After you have issued&#xA;  the &lt;code&gt;security bandwidth profile add command&lt;/code&gt;, you enter the&#xA;  security-config [bandwidth-profile] mode, and then you can configure&#xA;  one keyword and associated parameter or associated keyword at a time&#xA;  in the order that you prefer&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-01-28T23:06:37.233" LastActivityDate="2016-01-28T23:06:37.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26372" PostTypeId="2" ParentId="26361" CreationDate="2016-01-29T05:05:12.693" Score="5" Body="&lt;p&gt;The IEEE 802.3 standards define certain L1 characteristics/operation, but do not define the connectors to use to connect the devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, while 802.3 does define that 100BASE-TX will use twisted pair cabling that must meet certain characteristices (attenuation, cross talk, etc), it does not define if this must be UTP or some variation of STP. It also doesn't define a certain &quot;Category&quot; of cabling, although typically the cabling &quot;Categories&quot; are designed to meet specific requirements of the 802.3 standards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With reference to the standard not  defining the connector, this is probably best illustrated using fiber as an example. The 802.3 standards define the characteristics/operation of 1000BASE-SX, but you can find 1000BASE-SX connections that use LC, SC, MTRJ, ST or a number of other types of connectors. As long as the connector allows the connection to meet the requirements of the standard, it is perfectly okay to use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to why the cables are called Ethernet cables, I have already addressed that in &lt;a href=&quot;https://networkengineering.stackexchange.com/a/10873/33&quot;&gt;this answer to a previous question&lt;/a&gt;, so it is probably better to view that answer as well rather than for me to copy it here.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-01-29T05:05:12.693" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26373" PostTypeId="1" AcceptedAnswerId="26379" CreationDate="2016-01-29T08:51:46.157" Score="1" ViewCount="101" Body="&lt;p&gt;I have 4 routers in my LAN. All of them have different IP addresses. But I want to have one gateway address for my LAN. How can I do that ? Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-I do not want to use HSRP or any other redundancy option. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Is it possible to give same secondary ip address to all four routers so that I have one gateway address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-I have this kind of setup for redundancy. However, I have to use 4 routers. Because, my Routers do not support PIM redundancy. And actually I do not want to use a passive way of redundancy.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I have lots of static IP addresses from my ISP.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I am using NAT. But each Router has different Nat translations.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20519" LastActivityDate="2016-01-31T00:40:10.357" Title="Four router and one gateway address, can it be done ? (Cisco)" Tags="|cisco|router|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26375" PostTypeId="1" AcceptedAnswerId="26501" CreationDate="2016-01-29T09:09:27.703" Score="1" ViewCount="5528" Body="&lt;p&gt;I need to get acces to multiple remote LAN (not &lt;em&gt;specially&lt;/em&gt; at the same time) from my office (Fixed IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All these remote LAN will be connected to internet via 3 or 4G USB key and will have dynamic IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An OpenVPN Server is running in my Office&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note : I want to avoid DynDNS service to reduce cost.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ydrW1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ydrW1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;__EDIT__&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question :&#xA;How can I tunnel to my 3/4G gateway if it has dynamic IP (and no DynDNS) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first guest was to establish a first tunnel from my 3/4G gateway to my office which have a fixed IP. And then establish a second tunnel from my office to the 3/4G gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note : I have multiple 3/4G gateway with the same LAN configuration and I want to find a way to tunnel to each one.&lt;/p&gt;&#xA;" OwnerUserId="15675" LastEditorUserId="15675" LastEditDate="2016-02-02T13:38:58.933" LastActivityDate="2018-07-28T14:53:26.857" Title="Enable OpenVPN tunnel to dynamic IP without DynDNS" Tags="|vpn|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26376" PostTypeId="2" ParentId="25819" CreationDate="2016-01-29T09:15:09.843" Score="0" Body="&lt;p&gt;In a large network, the full-mesh requirement for iBGP can be a big challenge. &lt;a href=&quot;https://www.noction.com/blog/route_reflectors_an_alternative_to_full_mesh_ibgp_configuration&quot; rel=&quot;nofollow noreferrer&quot;&gt;Route Reflectors&lt;/a&gt; is an alternative to full-mesh iBGP configuration. Check out &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4456&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4456&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22433" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-10-24T07:42:29.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26379" PostTypeId="2" ParentId="26373" CreationDate="2016-01-29T12:04:11.980" Score="3" Body="&lt;p&gt;As far as I know and from experience what you want is not viable. It will mess up your LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it's possible to share the same IP on different interfaces on the same router with the ip unnumbered command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the same IP on 4 different routers who connect to the same LAN, will create routing problems and data flow inconsistencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The protocols you are unwilling to use (HSRP, VRRP, GLBP), were created to address the specific problem you are facing.&lt;/p&gt;&#xA;" OwnerUserId="22439" LastEditorUserId="-1" LastEditDate="2016-01-31T00:40:10.357" LastActivityDate="2016-01-31T00:40:10.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26380" PostTypeId="2" ParentId="26373" CreationDate="2016-01-29T13:27:24.987" Score="-1" Body="&lt;p&gt;You can probably just add default routes on all the three routers that are not the default gateway so all the traffic is directed to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So: &#xA;R1 has 192.168.1.254/24&#xA;R2 has 192.168.2.254/24&#xA;R3 has 192.168.3.254/24&#xA;R4 has 192.168.4.254/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say you want the gateway to be R1 then you will have R2, R3 and R4 to have a default route to 192.168.1.254&lt;/p&gt;&#xA;" OwnerUserId="18817" LastActivityDate="2016-01-29T13:27:24.987" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26382" PostTypeId="2" ParentId="20735" CreationDate="2016-01-29T13:46:47.373" Score="2" Body="&lt;p&gt;The indication for a timeout to be finished is not receiving an ACK for the packet that started the timer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP uses a ACK messages sent by the receiver to let the sender know a packet was correctly received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically, if a portion of bytes of the message is not ACK'd then the timer will expire and cause the timeout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read more &lt;a href=&quot;https://en.wikipedia.org/wiki/Transmission_Control_Protocol#Reliable_transmission&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; on sections Reliable transmission, Error detection and Selective acknowledgments&lt;/p&gt;&#xA;" OwnerUserId="18817" LastEditorUserId="18817" LastEditDate="2016-01-29T21:55:57.153" LastActivityDate="2016-01-29T21:55:57.153" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26387" PostTypeId="1" CreationDate="2016-01-29T22:23:25.590" Score="1" ViewCount="462" Body="&lt;p&gt;What happens with a frame with 802.1Q tag (VLAN ID) that arrives on access port? It is a part of vlan hopping theory which I don't understand completly.&lt;/p&gt;&#xA;" OwnerUserId="3481" LastActivityDate="2016-03-03T05:13:14.723" Title="VLAN tagging and access port" Tags="|vlan|" AnswerCount="1" CommentCount="1" ClosedDate="2016-03-21T19:02:47.217" ContentLicense="CC BY-SA 3.0" />
  <row Id="26390" PostTypeId="2" ParentId="25819" CreationDate="2016-01-30T05:50:33.000" Score="0" Body="&lt;p&gt;Yes if the iBGP neighbors do not need to exchange prefixes with non directly connected router then sure you don't have to do a full mesh or a Route Reflector.  So yes they won't distribute anything to non-connected peers.  &lt;/p&gt;&#xA;" OwnerUserId="4709" LastActivityDate="2016-01-30T05:50:33.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26396" PostTypeId="1" AcceptedAnswerId="26398" CreationDate="2016-01-30T18:21:35.867" Score="7" ViewCount="5935" Body="&lt;p&gt;If there are two PCs with same IP address on a LAN, what would happen if I ping that IP address from another PC on the same network and why?&lt;/p&gt;&#xA;" OwnerUserId="16870" LastEditorUserId="8499" LastEditDate="2020-11-27T03:24:10.437" LastActivityDate="2020-11-28T09:18:48.833" Title="What would happen to Ping if two PCs have same IP address with same Subnet Mask on same network?" Tags="|ip|subnet|ip-address|ping|icmp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26397" PostTypeId="2" ParentId="26396" CreationDate="2016-01-30T19:48:19.007" Score="4" Body="&lt;p&gt;The host that is nearer physically to your System will &quot;usually&quot; receive the ping. But the behaviour is undefined. Either device can receive the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could figure out which device actually receives the ICMP packets by sending an ARP request and resolving the MAC address.&lt;/p&gt;&#xA;" OwnerUserId="15706" LastActivityDate="2016-01-30T19:48:19.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26398" PostTypeId="2" ParentId="26396" CreationDate="2016-01-30T20:11:48.910" Score="14" Body="&lt;p&gt;Actually, the ping gets sent to a layer-2 address if they are on the same LAN. Assuming ethernet, the sending host may have a MAC address in its ARP cache, and the pings gets sent to the host with that MAC address (end of story).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the host needs to send an ARP request to resolve the layer-3 IP address to a layer-2 MAC address, this is where it gets tricky. The ARP request is a broadcast so that all the hosts on the LAN get it, and &lt;em&gt;both hosts with that IP address will respond with a MAC address for that IP address&lt;/em&gt;. The first ping packet will &lt;em&gt;probably&lt;/em&gt; go to the first MAC address received, and if all hosts are on the same switch, or the hosts with the duplicate addresses are on different switches than the sending host, you can't predict which one will be received first. The sending host will place the first received MAC address in its ARP cache for future use (subsequent pings, normally more than one ping is sent from a single user ping).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the meantime, the sending host will receive the MAC address from the other host, and it is &lt;em&gt;supposed to&lt;/em&gt; update its ARP cache and use that MAC address for traffic sent to that IP address. The next pings from the ping command &lt;em&gt;should&lt;/em&gt; go to the second host with that IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You just really have no way to know in which order the hosts will respond to the ARP request, assuming the sending host didn't have a MAC address for the IP address already in its ARP cache.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-03-19T03:29:37.663" LastActivityDate="2018-03-19T03:29:37.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26399" PostTypeId="1" AcceptedAnswerId="26490" CreationDate="2016-01-31T01:13:15.840" Score="2" ViewCount="1684" Body="&lt;p&gt;What is the best way to connect two HP 2530-48G (J9775A) switches using the SFP ports? The switches are a few inches apart in the same rack. Is there a SFP direct attach cable?&lt;/p&gt;&#xA;" OwnerUserId="22466" LastActivityDate="2016-02-02T19:40:20.347" Title="Linking two HP 2530-48g switches" Tags="|switch|sfp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26402" PostTypeId="2" ParentId="26399" CreationDate="2016-01-31T03:46:33.687" Score="1" Body="&lt;p&gt;You can use whatever pair of SFP's you want (SR, LR, T.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Direct Attach Cables do exist, but I'm only aware of ones for 10/40Gbe -- i.e. SFP&lt;b&gt;+&lt;/b&gt;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-01-31T03:46:33.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26406" PostTypeId="1" AcceptedAnswerId="26515" CreationDate="2016-01-31T08:11:19.963" Score="2" ViewCount="386" Body="&lt;p&gt;I configure Netflow Flexible use IPFIX protocol on a Cisco router and receive IPFIX packet from it successfully. The router exports data-sets with an exporter (source id = 0) and template-sets with another exporter (source id = 1). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was tested that before, by configuring a router on GNS3, but I received data-sets and template-sets from same exporter (source id).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it important to match data and template by their source-id and template-id? or I should match data and template by their template-id and source-ip!&lt;/p&gt;&#xA;" OwnerUserId="15430" LastActivityDate="2017-10-26T08:48:27.910" Title="The router exports IPFIX data and templates from two different source id" Tags="|cisco|netflow|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26409" PostTypeId="1" AcceptedAnswerId="26411" CreationDate="2016-01-31T18:27:52.187" Score="0" ViewCount="63" Body="&lt;p&gt;Suppose that I connected to internet -- from ADSL modem or wireless -- is a command line for linux  for PC not server or cisco switch that I can detect my partner (we have a modem 4 port LAN example) network in that service is used, for example i use net, my friend use too, I want to detect neighbor computers that use net and if is possible I can send data to his?&lt;/p&gt;&#xA;" OwnerUserId="22480" LastEditorUserId="619" LastEditDate="2016-02-01T01:22:45.260" LastActivityDate="2016-02-01T01:22:45.260" Title="what command line linux show computers that is connected to a modem?" Tags="|wireless|network-access|adsl|" AnswerCount="1" CommentCount="3" ClosedDate="2016-02-01T12:32:05.447" ContentLicense="CC BY-SA 3.0" />
  <row Id="26411" PostTypeId="2" ParentId="26409" CreationDate="2016-01-31T19:50:50.193" Score="1" Body="&lt;p&gt;Since you are all on the same LAN, yes you can send data to other computers.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no specific command to detect them, but there are a number of things you can do to find them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since all the computers use DHCP to get addresses, the odds are very high that your &quot;partner&quot; computers are numerically close to you. You can simply ping addresses near yours and wait for a reply.  For example, if your address is 192.168.0.4, and your gateway is 192.168.0.1, chances are that .2, .3 and possibly .5 are all used by other computers on your LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the computers are Windows boxes, they will find each other to support local file sharing.  You can then look in your ARP cache for their addresses using the command &lt;code&gt;arp -a&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some machines will have a firewall enabled, so they might not respond to pings.  But all have some open ports, so using a tool like NMAP will help you find them.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-01-31T19:50:50.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26412" PostTypeId="2" ParentId="25567" CreationDate="2016-01-31T20:24:18.693" Score="2" Body="&lt;p&gt;If you are looking for isolation between the desktops and only communicate with your gateway/router, investigate PVlans (private vlans):-&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Private_VLAN&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Private_VLAN&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-01-31T20:24:18.693" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26413" PostTypeId="1" CreationDate="2016-01-31T20:56:18.847" Score="-1" ViewCount="43" Body="&lt;p&gt;A computer tries to attack another computer across the Internet. The attacking computer's default gateway applies NAT using some address. The system administrator at that address, notices the attack and makes a complaint. Against which computer will this complaint be made?&lt;/p&gt;&#xA;" OwnerUserId="22483" LastActivityDate="2016-01-31T21:18:54.367" Title="NAT: Who will be blamed?" Tags="|nat|ip|" AnswerCount="1" CommentCount="3" ClosedDate="2016-02-01T12:32:17.550" ContentLicense="CC BY-SA 3.0" />
  <row Id="26414" PostTypeId="2" ParentId="26413" CreationDate="2016-01-31T21:18:54.367" Score="3" Body="&lt;p&gt;Complaints go to the owner of IP addresses, so in this case it will go to the address the person being attacked sees, which is the owner of the NAT gateway. It's up to that owner to handle this further, he's responsible for what his addresses do on the internet.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-01-31T21:18:54.367" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26415" PostTypeId="1" AcceptedAnswerId="26416" CreationDate="2016-01-31T21:47:33.667" Score="1" ViewCount="433" Body="&lt;p&gt;Im planning to get my CCNA certification but not sure how to get real time experience. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 10_ years of s/w development experience. Now with cloud and VM's I would like to understand in deep how networking works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to get the CCNA certified without much real time experience?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I just read the books and just understand the theory behind it?&lt;/p&gt;&#xA;" OwnerUserId="22486" LastActivityDate="2016-02-01T03:14:33.847" Title="CCNA certification without experience" Tags="|cisco|" AnswerCount="2" CommentCount="0" ClosedDate="2016-02-01T12:31:53.880" ContentLicense="CC BY-SA 3.0" />
  <row Id="26416" PostTypeId="2" ParentId="26415" CreationDate="2016-01-31T23:37:46.120" Score="2" Body="&lt;p&gt;Yeah, it is possible to do CCNA without any real time experience. I wouldn't go so far with a CCNP/CCIE but CCNA is made to give an introduction to the world of networking, routing, switching, ... . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you will not know it &quot;in deep&quot;. This is not the intention of a CCNA course. You well have a good base and even a bit more... . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examinations of CCNA requires that you know your theory, commands and Cisco proprietary stuff. The commands mentioned here, you should train them with something called 'packet tracer'. This is a software made by Cisco. &lt;/p&gt;&#xA;" OwnerUserId="623" LastActivityDate="2016-01-31T23:37:46.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26419" PostTypeId="2" ParentId="26415" CreationDate="2016-02-01T03:14:33.847" Score="3" Body="&lt;p&gt;Yes, that is doable.  I would take your CCNA in two parts though.  I would start with the first part and see if you are satisfied or need to go further.  Also, the CCNA is much easier to acquire (in my opinion) through the two-exam method:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;The CCENT exam&lt;/strong&gt; - This will focus on networking basics. For example: subnetting, OSI and TCP/IP models, switching, and basic routing.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;The CCNA exam&lt;/strong&gt; -  has more depth of switching, routing and WAN technology involved.  For example: Spanning Tree, more detailed routing, load balancing, Frame Relay and other WAN technologies, basic security, and access lists.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The problem with someone wanting to know the &quot;basics&quot; is that the Cisco exams have heavy focus on Cisco devices.  In other words, you will need to learn Cisco specific commands and be able to get around in a Cisco device for the simulations.  If you are wanting the basics, and don't plan on becoming a &quot;Networking Guy&quot;, you may be better off with just stopping at the CCENT.&lt;/p&gt;&#xA;" OwnerUserId="18849" LastActivityDate="2016-02-01T03:14:33.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26422" PostTypeId="1" CreationDate="2016-02-01T08:31:53.147" Score="1" ViewCount="1593" Body="&lt;p&gt;I have some Juniper switches (Model: ex4550-32f) connected together with trunk ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to allow VLAN 6 on all below interfaces because it is the main switch and connected to other switches in other locations with one connection only. Why it is blocked on some interfaces? How can I solve it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the results below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;J**U-MAIN-CORE-SW# run show spanning-tree interface vlan-id 6&#xA;Spanning tree interface parameters for instance 0&#xA;Interface    Port ID    Designated      Designated         Port    State  Role&#xA;                         port ID        bridge ID          Cost&#xA;xe-0/0/0.0     128:513      128:513  32768.5c4527ddd701      2000  FWD    DESG&#xA;ge-0/0/1.0     128:514      128:514  32768.5c4527ddd701     20000  BLK    DESG&#xA;xe-0/0/2.0     128:515      128:515  32768.5c4527ddd701      2000  BLK    DESG&#xA;xe-0/0/27.0    128:540      128:540  32768.5c4527ddd701      2000  BLK    DESG&#xA;xe-0/0/31.0    128:544       128:53  32769.6899cd9eed00      2000  FWD    ROOT**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22495" LastEditorUserId="8499" LastEditDate="2016-04-02T00:34:18.300" LastActivityDate="2017-07-26T17:48:05.070" Title="Blocking all VLANs between Juniper switches" Tags="|vlan|spanning-tree|juniper-ex|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26424" PostTypeId="1" AcceptedAnswerId="26435" CreationDate="2016-02-01T10:23:40.327" Score="7" ViewCount="2201" Body="&lt;p&gt;I am implementing a Telnet client using &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc854&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 854&lt;/a&gt;.&lt;br&gt;&#xA;I read about the negotation syntax (&lt;code&gt;DO&lt;/code&gt;, &lt;code&gt;WILL&lt;/code&gt;, &lt;code&gt;WON'T&lt;/code&gt;, etc.) and am confused by this paragraph:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;In summary, &lt;code&gt;WILL XXX&lt;/code&gt; is sent, by either party, to indicate that&lt;br /&gt;&#xA;party's desire (offer) to begin performing option &lt;code&gt;XXX&lt;/code&gt;, &lt;code&gt;DO XXX&lt;/code&gt; and&lt;br /&gt;&#xA;&lt;code&gt;DON'T XXX&lt;/code&gt; being its positive and negative acknowledgments; &lt;strong&gt;similarly,&#xA;&lt;code&gt;DO XXX&lt;/code&gt; is sent to indicate a desire (request) that the other party&lt;br /&gt;&#xA;(i.e., the recipient of the &lt;code&gt;DO&lt;/code&gt;) begin performing option &lt;code&gt;XXX&lt;/code&gt;, &lt;code&gt;WILL XXX&lt;/code&gt;&#xA;and &lt;code&gt;WON'T XXX&lt;/code&gt; being the positive and negative acknowledgments.  Since&#xA;the NVT is what is left when no options are enabled, the &lt;code&gt;DON'T&lt;/code&gt; and&lt;br /&gt;&#xA;&lt;code&gt;WON'T&lt;/code&gt; responses are guaranteed to leave the connection in a state&lt;br /&gt;&#xA;which both ends can handle.&lt;/strong&gt;  Thus, all hosts may implement their&lt;br /&gt;&#xA;TELNET processes to be totally unaware of options that are not&lt;br /&gt;&#xA;supported, simply returning a rejection to (i.e., refusing) any&lt;br /&gt;&#xA;option request that cannot be understood.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;sub&gt;(Emphasis and code formatters added.)&lt;/sub&gt;&lt;/p&gt;&#xA;&lt;p&gt;I have two questions, one per emphasized sentence:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What is the difference between the &lt;code&gt;WILL&lt;/code&gt; and &lt;code&gt;DO&lt;/code&gt; request? They can apparently be used by either party (&amp;quot;[...] &lt;code&gt;WILL XXX&lt;/code&gt; is sent, &lt;strong&gt;by either party&lt;/strong&gt; [...]&amp;quot;) and they only differ in that their &amp;quot;desire[s]&amp;quot; are an &amp;quot;offer&amp;quot; for the former and a &amp;quot;request&amp;quot; for the ladder. But what's the difference? I searched the RFC for &amp;quot;offer&amp;quot; for more information but it appears only that single time.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I don't understand the reasoning in the second sentence (&amp;quot;Since the NVT is what is left when no options are enabled [...]&amp;quot;). I thought the NVT (Network Virtual Terminal) was an abstraction of a concrete terminal, so the Telnet protocol does not need to worry about the concrete terminals' quirks on both sides? How can it be &amp;quot;left&amp;quot; then? That means it can be augmented by the Telnet options but I don't get what that means at all.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22498" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2017-01-13T06:26:13.247" Title="How do the Telnet requests &quot;DO&quot; and &quot;WILL&quot; differ?" Tags="|protocol-theory|rfc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26425" PostTypeId="1" CreationDate="2016-02-01T11:45:58.983" Score="2" ViewCount="820" Body="&lt;p&gt;It's my first question on StackExchage&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you please help me with this question?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 LANs :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;LAN A : &lt;code&gt;192.168.60.0/24&lt;/code&gt; gateway &lt;code&gt;192.168.60.1&lt;/code&gt; dns &lt;code&gt;192.168.60.2&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;LAN B : &lt;code&gt;192.168.61.0/24&lt;/code&gt; gateway &lt;code&gt;192.168.61.1&lt;/code&gt; dns &lt;code&gt;192.168.60.2&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I want to connect those two LANs with a router. Is that possible? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the modifications I need in the configurations?&lt;/p&gt;&#xA;" OwnerUserId="22496" LastEditorUserId="8499" LastEditDate="2016-03-03T01:49:59.197" LastActivityDate="2016-04-02T04:19:46.387" Title="Rounting between two LANs with two gateways" Tags="|routing|lan|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26426" PostTypeId="2" ParentId="26425" CreationDate="2016-02-01T12:08:54.647" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I want to coonect those 2 lan's with a router , Is that possible ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, that is what routers do! If you already have gateway IPs configured then that implies that you already have at least one router (or device acting as a router) configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If these are actual LAN subnets then you ideally want to route all traffic through the gateways you already have configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A much less optimal solution would be to configure your gateway device(s) to send ICMP redirects instructing the hosts to route traffic through a different gateway IP (i.e. your new router) when trying to get to one of those subnets.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;what are the modifications to do to my configurations&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With no configs posted here, it's hard to say!&lt;/p&gt;&#xA;" OwnerDisplayName="user22499" LastActivityDate="2016-02-01T12:08:54.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26428" PostTypeId="1" CreationDate="2016-02-01T13:27:19.560" Score="3" ViewCount="23998" Body="&lt;p&gt;I have a screenshot of an ethernet packet frame from Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to explain what is the meaning of these marked lines (with dots and zeros).&#xA;I searched in web, but still I don't have an answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xdfdM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xdfdM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="22502" LastActivityDate="2023-11-24T11:45:23.213" Title="Ethernet frame IG/LG bit explanation - Wireshark" Tags="|ethernet|wireshark|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26430" PostTypeId="2" ParentId="26428" CreationDate="2016-02-01T14:30:14.880" Score="9" Body="&lt;p&gt;Both the LG bit (sometimes also referred to as UL bit) and the IG bit are located in the most significant byte of each MAC address, where the IG bit is the least significant bit in this byte and the LG bit is the second least significant bit in this byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IG bit distinguishes whether the MAC address is an individual or group (hence IG) address. In other words, an IG bit of 0 indicates that this is a unicast MAC address, an IG bit of 1 indicates a multicast or broadcast address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LG or UL bit on the other hand distinguishes vendor assigned and administratively assigned MAC addresses. When you administratively change the MAC address of your device to another address, then you should set this bit to one. Many drivers and cards however do not enforce this, and I do not know one application which really relies on this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the vast majority of cases (except for broadcast messages) you will see both bits set to 0 (unicast and vendor assigned), as can be confirmed in your screenshot.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="36859" LastEditDate="2017-05-18T00:38:17.023" LastActivityDate="2017-05-18T00:38:17.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26431" PostTypeId="2" ParentId="26425" CreationDate="2016-02-01T14:40:30.190" Score="0" Body="&lt;p&gt;Yes it is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to connect those two LANs to router and assign each LANs respective interface with the ip you provided as your gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then just write command for dos server and assign its IP address.&lt;/p&gt;&#xA;" OwnerUserId="17138" LastActivityDate="2016-02-01T14:40:30.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26433" PostTypeId="2" ParentId="26422" CreationDate="2016-02-01T15:15:12.997" Score="1" Body="&lt;p&gt;It's blocked on some ports because this switch is not the root switch for that VLAN. The root switch for VLAN 6 is connected (directly, or through another switch) to port &lt;code&gt;xe-0/0/31.0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want this switch to be the root switch, you need to lower the Bridge ID. You left the priority at the default of 32768. I assume you left all the switches at the default, and the root bridge will be determined by the lowest MAC address. You should lower the priority to determine the root, otherwise the determination is left to the lowest MAC address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-01T15:15:12.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26435" PostTypeId="2" ParentId="26424" CreationDate="2016-02-01T15:34:47.567" Score="3" Body="&lt;p&gt;You send &lt;code&gt;WILL&lt;/code&gt; if you want to start performing something, and you send &lt;code&gt;DO&lt;/code&gt; if you want the other end to start performing something. Think of it as &lt;code&gt;I Will&lt;/code&gt; and &lt;code&gt;You DO&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The NVT is what is in common with the terminals on both sides. If one side can do a line length of 132, but the other side can only do a line length of 80, the two sides will come to an agreement to do a line length of 80 since both sides can do that. The side that can do 132 will either send a &lt;code&gt;WILL&lt;/code&gt; or a &lt;code&gt;DO&lt;/code&gt; to the side that can only do 80, but it will then receive a negative response to that. The side that can do 80 can send a &lt;code&gt;WILL&lt;/code&gt; or &lt;code&gt;DO&lt;/code&gt; to the side that can do 132, and it should receive a positive response since the side that can do 132 can also do 80.&lt;/p&gt;&#xA;&lt;p&gt;Don't forget to support the update (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5198&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5198&lt;/a&gt;) when implementing this.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-02-01T15:34:47.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26436" PostTypeId="1" AcceptedAnswerId="26445" CreationDate="2016-02-01T17:46:56.333" Score="2" ViewCount="1196" Body="&lt;p&gt;&lt;strong&gt;Edit Feb 4&lt;/strong&gt; The issue remains relevant, any help appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/svhWx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/svhWx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once again, I'm not a network engineer, so this must be a noob question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simple task: I have a server in my private network and I need to make it accessible from the public network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some googling i found this guide on Juniper site (&lt;a href=&quot;https://www.juniper.net/documentation/en_US/junos12.1/topics/example/nat-security-static-single-address-translation-configuring.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Example: Configuring Static NAT for Single Address Translation&quot;&gt;Configuring Static NAT for Single Address Translation&lt;/a&gt;). I did as the guide says, but still can't access my server (ping fails).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone point out where is the error in my configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, should I be able to ping from SRX CLI to translated ip (10.129.166.135). I think it should work, but right now it doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security nat destination pool DestinationNatVideo address 192.168.3.100/32&#xA;set security nat destination rule-set RuleSetVideo from interface ge-0/0/0.0&#xA;set security nat destination rule-set RuleSetVideo rule r1 match destination-address 10.129.166.135/32&#xA;set security nat destination rule-set RuleSetVideo rule r1 then destination-nat pool DestinationNatVideo&#xA;set security address-book global address VideoReceiver 192.168.3.100/32&#xA;set security policies from-zone wan to-zone trust policy server-access match source-address any&#xA;set security policies from-zone wan to-zone trust policy server-access match destination-address VideoReceiver&#xA;set security policies from-zone wan to-zone trust policy server-access match application any&#xA;set security policies from-zone wan to-zone trust policy server-access then permit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Full config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 11.2R4.3;&#xA;system {&#xA;    ports {&#xA;        console {&#xA;            log-out-on-disconnect;&#xA;            type vt100;&#xA;        }&#xA;    }&#xA;    name-server {&#xA;        10.128.1.22;&#xA;        10.128.1.23;&#xA;        8.8.8.8;&#xA;    }&#xA;    services {&#xA;        ssh {&#xA;            root-login allow;&#xA;        }&#xA;        telnet;&#xA;        xnm-clear-text;&#xA;        web-management {&#xA;            http {&#xA;                interface vlan.0;&#xA;            }&#xA;            https {&#xA;                system-generated-certificate;&#xA;                interface vlan.0;&#xA;            }&#xA;        }&#xA;        dhcp {&#xA;            pool 172.16.30.0/24 {&#xA;                address-range low 172.16.30.2 high 172.16.30.254;&#xA;                name-server {&#xA;                    10.128.1.22;&#xA;                    10.128.1.23;&#xA;                    8.8.8.8;&#xA;                }&#xA;                router {&#xA;                    172.16.30.1;&#xA;                }&#xA;            }&#xA;            pool 172.16.40.0/24 {&#xA;                address-range low 172.16.40.2 high 172.16.40.254;&#xA;                name-server {&#xA;                    10.128.1.22;&#xA;                    10.128.1.23;&#xA;                    8.8.8.8;&#xA;                }&#xA;                router {&#xA;                    172.16.40.1;&#xA;                }&#xA;            }&#xA;            pool 172.16.10.0/24 {&#xA;                address-range low 172.16.10.2 high 172.16.10.254;&#xA;                name-server {&#xA;                    10.128.1.22;&#xA;                    10.128.1.23;&#xA;                    8.8.8.8;&#xA;                }&#xA;                router {&#xA;                    172.16.10.1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        archive size 100k files 3;&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any critical;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands error;&#xA;        }&#xA;    }&#xA;    max-configurations-on-flash 5;&#xA;    max-configuration-rollbacks 5;&#xA;    license {&#xA;        autoupdate {&#xA;            url https://ae1.juniper.net/junos/key_retrieval;&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        speed 100m;&#xA;        link-mode full-duplex;&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members wan;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members [ vlan-trust all ];&#xA;                }&#xA;                native-vlan-id 1;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members [ vlan-trust all ];&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members [ vlan-trust all ];&#xA;                }&#xA;                native-vlan-id 10;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/4 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members [ vlan-trust all ];&#xA;                }&#xA;                native-vlan-id 10;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/5 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/6 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/7 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/8 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/9 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/10 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/11 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/12 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/13 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/14 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/15 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 0 {&#xA;            family inet;&#xA;        }&#xA;        unit 10 {&#xA;            family inet {&#xA;                address 172.16.10.1/24;&#xA;            }&#xA;        }&#xA;        unit 20 {&#xA;            family inet {&#xA;                address 172.16.20.1/24;&#xA;            }&#xA;        }&#xA;        unit 30 {&#xA;            family inet {&#xA;                address 172.16.30.1/24;&#xA;            }&#xA;        }&#xA;        unit 40 {&#xA;            family inet {&#xA;                address 172.16.40.1/24;&#xA;            }&#xA;        }&#xA;        unit 50 {&#xA;            family inet {&#xA;                address 172.16.50.1/24;&#xA;            }&#xA;        }&#xA;        unit 60 {&#xA;            family inet {&#xA;                address 192.168.3.1/24;&#xA;            }&#xA;        }&#xA;        unit 100 {&#xA;            family inet {&#xA;                address 10.129.166.132/25;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;snmp {&#xA;    client-list ss;&#xA;    community school-ro {&#xA;        authorization read-only;&#xA;        clients {&#xA;            10.143.255.2/32;&#xA;            10.143.255.6/32;&#xA;            10.143.255.10/32;&#xA;            10.143.255.14/32;&#xA;            10.143.255.42/32;&#xA;            10.136.7.5/32;&#xA;        }&#xA;    }&#xA;    trap-options;&#xA;    trap-group ESMA {&#xA;        categories {&#xA;            authentication;&#xA;            chassis;&#xA;            remote-operations;&#xA;            routing;&#xA;            startup;&#xA;            rmon-alarm;&#xA;            vrrp-events;&#xA;            configuration;&#xA;            services;&#xA;            chassis-cluster;&#xA;        }&#xA;        targets {&#xA;            10.143.255.2;&#xA;            10.143.255.6;&#xA;            10.143.255.10;&#xA;            10.143.255.14;&#xA;            10.143.255.42;&#xA;            10.136.7.5;&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop 10.129.166.129;&#xA;    }&#xA;}&#xA;protocols {&#xA;    stp;&#xA;}&#xA;security {&#xA;    address-book {&#xA;        global {&#xA;            address VideoReceiver 192.168.3.100/32;&#xA;        }&#xA;    }&#xA;    screen {&#xA;        ids-option untrust-screen {&#xA;            icmp {&#xA;                ping-death;&#xA;            }&#xA;            ip {&#xA;                source-route-option;&#xA;                tear-drop;&#xA;            }&#xA;            tcp {&#xA;                syn-flood {&#xA;                    alarm-threshold 1024;&#xA;                    attack-threshold 200;&#xA;                    source-threshold 1024;&#xA;                    destination-threshold 2048;&#xA;                    timeout 20;&#xA;                }&#xA;                land;&#xA;            }&#xA;        }&#xA;    }&#xA;    nat {&#xA;        source {&#xA;            rule-set trust-to-wan {&#xA;                from zone trust;&#xA;                to zone wan;&#xA;                rule source-nat-rule {&#xA;                    match {&#xA;                        source-address 0.0.0.0/0;&#xA;                    }&#xA;                    then {&#xA;                        source-nat {&#xA;                            interface;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;        destination {&#xA;            pool DestinationNatVideo {&#xA;                address 192.168.3.100/32;&#xA;            }&#xA;            rule-set RuleSetVideo {&#xA;                from interface ge-0/0/0.0;&#xA;                rule r1 {&#xA;                    match {&#xA;                        destination-address 10.129.166.135/32;&#xA;                    }&#xA;                    then {&#xA;                        destination-nat pool DestinationNatVideo;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;        proxy-arp {&#xA;            interface ge-0/0/0.0 {&#xA;                address {&#xA;                    10.129.166.135/32;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    policies {&#xA;        from-zone trust to-zone untrust {&#xA;            policy trust-to-untrust {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone trust to-zone wan {&#xA;            policy internet {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone wan to-zone trust {&#xA;            policy server-access {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address VideoReceiver;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    zones {&#xA;        security-zone trust {&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                vlan.0;&#xA;                vlan.10;&#xA;                vlan.30;&#xA;                vlan.40;&#xA;                vlan.60;&#xA;            }&#xA;        }&#xA;        security-zone untrust {&#xA;            screen untrust-screen;&#xA;        }&#xA;        security-zone wan {&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                vlan.100;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;vlans {&#xA;    management {&#xA;        vlan-id 10;&#xA;        l3-interface vlan.10;&#xA;    }&#xA;    private-eth {&#xA;        vlan-id 20;&#xA;        l3-interface vlan.20;&#xA;    }&#xA;    private-wifi {&#xA;        vlan-id 40;&#xA;        l3-interface vlan.40;&#xA;    }&#xA;    public-eth {&#xA;        vlan-id 30;&#xA;        l3-interface vlan.30;&#xA;    }&#xA;    public-wifi {&#xA;        vlan-id 50;&#xA;        l3-interface vlan.50;&#xA;    }&#xA;    vlan-trust {&#xA;        vlan-id 3;&#xA;        l3-interface vlan.60;&#xA;    }&#xA;    wan {&#xA;        vlan-id 100;&#xA;        l3-interface vlan.100;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14749" LastEditorUserId="14749" LastEditDate="2016-02-04T18:22:33.630" LastActivityDate="2016-02-04T20:31:26.853" Title="Juniper SRX-240. Single Address Translation" Tags="|nat|juniper|juniper-srx|proxy-arp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26437" PostTypeId="1" AcceptedAnswerId="26440" CreationDate="2016-02-01T18:18:41.573" Score="1" ViewCount="32" Body="&lt;p&gt;I'm currently looking at 40Gbase-LR and am curious about the advertised power budget. Here are the specifications:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Transmit max    2.30dBm &#xA;Transmit min   -7.00dBm &#xA;Receive max     2.30dBm &#xA;Receive min   -11.50dBm &#xA;Power Budget    4.50dB &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The attenuation test on the cable I want to use indicates a ~6dB drop, mostly due to insertion loss. The indicated power budget is not enough to manage that. This appears to be calculated based on Transmit min and Receive Min (-7 - -11.5=4.5), but I'm wondering if I have more flex here since the maximum transmit power is 2.3dBm (2.3 - -11.5 = 13.8).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I don't get is why the power budget is listed as 4.5dB when the specs appear to indicate it can go to 11.8dB.&lt;/p&gt;&#xA;" OwnerUserId="22513" LastActivityDate="2016-02-01T19:35:47.033" Title="Power Budget Based on Miniums?" Tags="|design|fiber|optics|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26439" PostTypeId="1" CreationDate="2016-02-01T19:20:31.970" Score="-1" ViewCount="142" Body="&lt;p&gt;Is it possible to quickly determine the number of hosts by giving only the IP prefix such as /24 ?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="22225" LastEditorUserId="22225" LastEditDate="2016-02-01T19:25:12.083" LastActivityDate="2016-02-01T21:32:20.953" Title="Determine the number of hosts from IP address prefix" Tags="|cisco|ipv4|network-core|" AnswerCount="1" CommentCount="0" ClosedDate="2016-02-02T01:08:12.073" ContentLicense="CC BY-SA 3.0" />
  <row Id="26440" PostTypeId="2" ParentId="26437" CreationDate="2016-02-01T19:35:47.033" Score="2" Body="&lt;p&gt;4.5 dB is the maximum loss where it's still guaranteed to work.  Of course, it will likely be better, but as they say, your mileage may vary.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-01T19:35:47.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26442" PostTypeId="2" ParentId="1448" CreationDate="2016-02-01T20:16:54.840" Score="0" Body="&lt;p&gt;Not sure when the support started but on the EX4200 platform with the 12.1R4.7 version you can use q-in-q.&#xA;On the &lt;em&gt;vlans&lt;/em&gt; configuration you set the &quot;outer&quot; vlan and then you use the dot1q-tunneling sub-command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vlans SERVICE-VLAN vlan-id 123&#xA;set vlans SERVICE-VLAN interface ae1.0&#xA;set vlans SERVICE-VLAN dot1q-tunneling customer-vlans 610&#xA;set vlans SERVICE-VLAN dot1q-tunneling customer-vlans 611&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Under the &lt;em&gt;ethernet-switching-options&lt;/em&gt; config there's also the global settings for dot1q-tunneling.&lt;/p&gt;&#xA;" OwnerUserId="22515" LastActivityDate="2016-02-01T20:16:54.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26443" PostTypeId="1" CreationDate="2016-02-01T20:35:18.480" Score="3" ViewCount="3145" Body="&lt;p&gt;At a small remote office my boss decided to buy a Meraki Firewall device with Wireless to replace an old Cisco ASA.  The setup looks pretty straight forward.  We have 5 public IP addresses for an e-mail server, 2 web servers, our ASA outside interface and the last one is used for PAT on the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Meraki dashboard it was easy to set up 1:1 NAT for our servers and I have the outside interface public IP configured but where do I conigure the PAT internet address that all of our internal clients use to get on the internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate the help.&lt;/p&gt;&#xA;" OwnerUserId="22517" LastActivityDate="2019-05-02T04:04:37.173" Title="Migrating from Cisco ASA 5508 to Cisco Meraki Firewall Appliance at small office" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26444" PostTypeId="2" ParentId="26439" CreationDate="2016-02-01T21:32:20.953" Score="0" Body="&lt;p&gt;A 24 bit mask is providing 2 at the power of 8 hosts. It's the difference betwen your network mask and the full 32 bit mask. Like a /30 has:&#xA;32-30 = 2; 2 at power of 2 equals 4.&lt;/p&gt;&#xA;" OwnerUserId="22518" LastActivityDate="2016-02-01T21:32:20.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26445" PostTypeId="2" ParentId="26436" CreationDate="2016-02-01T21:52:51.243" Score="2" Body="&lt;p&gt;Do you need the server to also access the public network or only reply to requests from the public network?&#xA;On the first case you use static nat (bidirectional NAT), on the second you use destination nat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your ping tests you're trying to ping an IP that, due to the proxy-arp config, is configured to respond only from the ge-0/0/0 interface. Maybe you could try to ping it like this: &lt;code&gt;ping 10.129.166.135 source 10.129.166.132&lt;/code&gt;, but I'd recommend to reconfigure the &quot;natted&quot; IP to the server since it will be easier to troubleshoot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also noticed that the vlan.60 interface is not configured in the trust zone, so besides other issues, all the traffic to/from the vlan.60 subnet will be blocked and the nat config won't be applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, I have no idea what type of public network you're connected to but the &lt;strong&gt;host-inbound-traffic&lt;/strong&gt; configuration on the &lt;strong&gt;wan&lt;/strong&gt; security zone should be reduced to the absolute minimum or, if possible, removed as this only controls the traffic to the firewall itself (for example, to allow a ssh connection or to ping the firewall from the public network).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;proposed solution with destination nat + port-forward&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This example/solution will use the address of the wan interface and map a port (5000) to the port 22 (ssh) of the internal address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security nat destination pool DestinationNatVideo address 192.168.3.100/32&#xA;set security nat destination pool DestinationNatVideo address port 22&#xA;set security nat destination rule-set RuleSetVideo from zone wan&#xA;set security nat destination rule-set RuleSetVideo rule r1 match destination-address 10.129.166.132/32&#xA;set security nat destination rule-set RuleSetVideo rule r1 match destination-port 5000&#xA;set security nat destination rule-set RuleSetVideo rule r1 then destination-nat pool DestinationNatVideo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also remove this &lt;code&gt;set security nat destination pool DestinationNatVideo address port 22&lt;/code&gt; and it &lt;strong&gt;should&lt;/strong&gt; map the port 5000 to all services of the internal IP (it's better to map one port per service instead of leaving everything open/connectable).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The version that's installed in your device is a bit old and maybe it doesn't support nat very well (or just some parts of it) so YMMV.&lt;/p&gt;&#xA;" OwnerUserId="22515" LastEditorUserId="22515" LastEditDate="2016-02-04T20:31:26.853" LastActivityDate="2016-02-04T20:31:26.853" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="26446" PostTypeId="1" AcceptedAnswerId="26457" CreationDate="2016-02-01T23:28:09.893" Score="10" ViewCount="11588" Body="&lt;p&gt;&lt;em&gt;Note this is &lt;strong&gt;not&lt;/strong&gt; a duplicate of &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/14841/why-is-the-ip-layer-aware-of-higher-layers-in-the-network-stack&quot;&gt;Why is the IP layer aware of higher layers in the network stack?&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The need for a protocol identifier (eg. the IP header's Protocol field) in packet-based communication is clear: It's either this or some sort of computationally-intensive inference algorithm. The question is: why must it exist as part of the IP header rather than in the encapsulated protocols' headers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to me that this one of those cases where theoretical clarity meets practical considerations (AKA &quot;Haskell meets Go&quot;...): On the one hand placing a &quot;protocol&quot; field in the IP header breaks the conceptual &lt;em&gt;separation of interests&lt;/em&gt; that eg. the OSI model aimed for; on the other hand forcing protocols higher up the stack to state their type in a consistent manner is much harder, and would eventually lead to a similar situation anyway (eg. if every protocol higher up the stack used its first header byte to state its type, it would look as if IP used its &lt;em&gt;last&lt;/em&gt; header byte to do the same).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is - what was the reasoning behind placing the &quot;protocol&quot; field inside the IP's packet header rather than anywhere else?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: When writing this question I pondered whether to add the word &quot;&lt;em&gt;original&lt;/em&gt;&quot; before &quot;reasoning&quot;, ie the reasoning of the team that devised &lt;em&gt;IP&lt;/em&gt;, but reckoned it was redundant as the question was phrased in the past tense (&quot;what &lt;em&gt;was&lt;/em&gt; the reasoning...&quot;). Nevertheless this seems needed, as none of the replies actually answers that question. Some insights of note:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;@immibis suggests any other form would break other protocols' models (eg. encrypted communication protocols would have to have a plaintext identification field)&lt;/li&gt;&#xA;&lt;li&gt;@Eddie essentially states that the reason is convention (acceptance of the &lt;em&gt;protocol chain&lt;/em&gt; design, though why that's the convention remains a mystery)&lt;/li&gt;&#xA;&lt;li&gt;@Ricky stresses practicality as an overarching consideration&lt;/li&gt;&#xA;&lt;li&gt;@Claudio suggests that were the protocol field a part of the encapsulated header there would be need for an additional &lt;em&gt;header identification&lt;/em&gt; step, where in the current model that takes place during the IP header's parsing&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So I'll rephrase: What's wrong with a model where instead of every header identifying the next header's type, every header identifies its &lt;em&gt;own&lt;/em&gt; type in a predetermined location (eg. in the first header byte)? Why is such a model any less desirable than the current one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit #2&lt;/strong&gt;: It seems that the answer is a combination of several of the answers given (mainly those mentioned above along with @Eddie's second addendum):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Simplicity: Breaking the principal of &lt;em&gt;layer agnosticism&lt;/em&gt; in &lt;em&gt;this particular case&lt;/em&gt; means the stack (or the model) as a whole can be simpler:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There's no &quot;protocol identification&quot; phase, neither implicit nor explicit&lt;/li&gt;&#xA;&lt;li&gt;Layer independence is improved (eg. an encrypted communications handler doesn't have to share a layer with any helper protocol)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Regulation is also greatly simplified, not having to enforce any requirements on client protocols.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Performance: Stating the protocol of an encapsulated packet ahead of the packet itself allows several types of fast routing protocols (packet filtering, QOS, cut-through switching) to be integrated into the network (internet) layer itself; these can then make decisions as quickly as a hash table can be accessed, which is all the more important considering the limited hardware this protocol was designed to run on.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This model has its disadvantages, but it seems that for the &lt;em&gt;common&lt;/em&gt; usage cases it's better suited than the alternatives.&lt;/p&gt;&#xA;" OwnerUserId="22139" LastEditorUserId="22139" LastEditDate="2019-01-03T11:59:14.090" LastActivityDate="2024-03-17T18:00:28.603" Title="Why is the protocol field part of an IP header?" Tags="|ipv4|ip|protocol-theory|" AnswerCount="5" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="26447" PostTypeId="2" ParentId="26446" CreationDate="2016-02-01T23:32:14.353" Score="2" Body="&lt;p&gt;Not a direct answer to your question, but:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On the one hand placing a &quot;protocol&quot; field in the IP header breaks the&#xA;  conceptual separation of interests that the OSI aimed for.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;TCP/IP was developed without reference to the OSI model.  While they share some commonalities, it was a separate development effort.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-01T23:32:14.353" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26448" PostTypeId="2" ParentId="26446" CreationDate="2016-02-01T23:32:24.593" Score="8" Body="&lt;p&gt;You may as well ask why an ethernet header has an Ether Type field. The network stack needs to know which protocol in the next higher layer gets the payload of the current layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason that each datagram has the protocol of the next upper layer is to create the layer independence. Each layer doesn't care what is in the payload, and it shouldn't need to look in the payload to determine where to deliver the payload. Think of the protocol number in the header as an address where the payload is to be delivered. Much like TCP port numbers are TCP addresses, they tell TCP where to deliver its payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The destination MAC address tells the network switch which switch interface to deliver the frame. The Ether Type field tells layer-2 where to deliver its payload, the Protocol field in the IP header tells layer-3 where to deliver its payload, and the port numbers in TCP and UDP tell layer-4 where to deliver its payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of an 18-wheeler truck driver who hooks up to a trailer to deliver it somewhere. He doesn't need to worry what's in the trailer, or for what it will be used; he just looks at his paperwork and delivers it to the place in the paperwork.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to remember that each of the protocols was developed independently without knowing which emerging upper-layer protocols would be used. For a long time, the primary layer-3 protocol used on ethernet was IPX. Had ethernet been created specifically for IPX, would it be so ubiquitous today? Ethernet was built to carry any layer-3 protocol by having the Ether Type field which the network stack can use to decide where the ethernet payload goes. IP does the same thing, and so do TCP and UDP. It is an easy and logical method which is why each independently-developed layer in the network stack has an equivalent. You, and anyone else interested, are free to develop your own protocol(s) for any of the layers which can easily plug into the network stack because of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It allows different layer-3 protocols to register with layer-2. You can simultaneously run IPX (0x8137), IPv4, (0x0800), ARP (0x0806), IPv6 (0x86DD), etc. protocols, and layer-2 will know which protocols have registered with it and pass the payload to the appropriate layer-3 protocol without knowing anything about the payload (or drop any packets which don't have a registered protocol). You don't want to have to have to install a different layer-2 protocol for each combination of layer-3 protocols you have, and that would be required if the layer-2 protocol must know more about the layer-3 protocol(s) in order to be able to read the packet headers. Even IPv4 and IPv6 packet headers are quite different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType#Notable_values&quot; rel=&quot;nofollow&quot;&gt;Here is an incomplete list&lt;/a&gt; of values for different layer-3 protocols which may register with layer-2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-4 protocols also register with various layer-3 protocols, and applications register with layer-4 protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your original question posited that the layers should be independent of each other, and this sort of thing actually promotes layer independence, rather than breaking it as you suggest. Layer-2 doesn't know that the payload is IPv4, it only knows that the ethertype is 0x0800, and it should pass the payload to the layer-3 protocol which has registered that ethertype.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-11T22:58:51.017" LastActivityDate="2016-02-11T22:58:51.017" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26449" PostTypeId="2" ParentId="26425" CreationDate="2016-02-02T00:21:29.480" Score="0" Body="&lt;p&gt;What you are asking is basic routing question. Yes it is quite possible.&#xA;Bring both the subnets as layer 3 on same router. So other subnet can see route point for second subnet.&#xA;This is easiest way for your situations described in your question&lt;/p&gt;&#xA;" OwnerUserId="22423" LastActivityDate="2016-02-02T00:21:29.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26451" PostTypeId="2" ParentId="26387" CreationDate="2016-02-02T01:55:45.023" Score="1" Body="&lt;p&gt;It might be an error, and the frame will be discarded. It may be an 'access' port from a service provider running 'provider bridging', then the frame will receive double tagging. It can get even more complex vlan translations. So it all depends on the full network setup.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-02T01:55:45.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26452" PostTypeId="1" CreationDate="2016-02-02T02:25:18.087" Score="1" ViewCount="3639" Body="&lt;p&gt;I am trying to locate the IP address of a managed hirschmann switch in a small network set up in a spare room for the sake of learning about them as they are used at work. The switch in question [1of7] is acting like an unmanaged switch with no trace of any IP address - How do I find its IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To eliminate the other switches that I have addresses into a new range of IPs, I linked the switch between a laptop and the gateway router, traffic passes through [I'm writing this question through the damm thing] &#xA;I ran tracert and only the gateway router comes up. It passes through traffic on all ports but no register of it on wireshark that I can see. &#xA;As well as wireshark, I tried angry IP, advanced IP, HIdiscovery, industrial HI Vision and found the addresses of 6 out of the 7 switches but can not get anything out of the 7th switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches were all Ebay purchases some new some 2nd hand unfortunately the seller didn't reset to factory settings with this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the switches have a RJ11 v.24 serial port for management, I have spent the last few days making up serial cables trying different pin outs as the Hirschmann cable is 6 weeks away from Germany. I believe it is the same as the Schneider cable which has a description of pin out there website. I am also using a USB to serial converter which opens up com port 6. On one of the known switchs that I log in through webinterface it has all the telnet/ssh/bootP/v24 enabled but I can not open a telnet session with the switch. Mainly because I have little idea what I am doing, so if the answer to the question is use a serial cable, please be specific! &lt;/p&gt;&#xA;" OwnerUserId="22523" LastActivityDate="2017-07-27T04:50:32.547" Title="Finding management IP on network" Tags="|switch|ipv4|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26453" PostTypeId="2" ParentId="26452" CreationDate="2016-02-02T02:38:35.407" Score="0" Body="&lt;p&gt;Most managed switches can have a management interface on any VLAN, which may or may not be a VLAN used on any of the ports. if you are using VLAN 10 with the &lt;code&gt;192.168.1.0/24&lt;/code&gt; subnet for the access ports, the switch management interface could be on the same, or a different, VLAN with a completely different address, such as &lt;code&gt;10.1.2.3&lt;/code&gt; with a gateway of &lt;code&gt;10.1.2.1&lt;/code&gt;, or it may not even have a configured management interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;tracert&lt;/code&gt; doesn't do any good unless the switch is a layer-3 switch and it is the gateway of the subnet you are on since it only counts router hops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is not really any &quot;magic&quot; method to discover this unless you have console access, and you would still need to know the management password. Your best bet is to contact the manufacturer about your problem.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-02T02:45:16.940" LastActivityDate="2016-02-02T02:45:16.940" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26455" PostTypeId="2" ParentId="26443" CreationDate="2016-02-02T04:28:39.317" Score="1" Body="&lt;p&gt;You are looking for the section named 1:Many NAT on this page &lt;a href=&quot;https://docs.meraki.com/display/MX/Firewall+settings&quot; rel=&quot;nofollow&quot;&gt;https://docs.meraki.com/display/MX/Firewall+settings&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant portion is summarized here.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Click the button labled &lt;strong&gt;Add 1:Many IP&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Enter the Public IP address and Uplink values&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22530" LastEditorUserId="22530" LastEditDate="2016-02-02T04:38:20.980" LastActivityDate="2016-02-02T04:38:20.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26457" PostTypeId="2" ParentId="26446" CreationDate="2016-02-02T04:59:06.013" Score="14" Body="&lt;p&gt;Remember, bits arrive on a NIC as a series of 1's and 0's. Something has to exist to dictate how the next series of 1's and 0's should be interpreted.&lt;/p&gt;&#xA;&lt;p&gt;Ethernet2 is the de facto standard for L2, as such it is assumed to interpret the first 56 bits as a Preamble, and the next 8 bits as the Preamble, and the next 48 bits as the Destination MAC, and the next 48 bits as the Source MAC, and &lt;a href=&quot;https://en.wikipedia.org/wiki/Ethernet_frame#Structure&quot; rel=&quot;nofollow noreferrer&quot;&gt;so on and so forth&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The only variation might be the somewhat antiquated &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5300/what-is-the-difference-between-ethernet-ii-and-802-3-ethernet&quot;&gt;802.3 L2 header&lt;/a&gt;, which predates the current Ethernet2 standard, but also included a &lt;a href=&quot;https://web.archive.org/web/20150314030155/http://www.wildpackets.com/resources/compendium/ethernet/frame_snap_iee8023#LLC_control&quot; rel=&quot;nofollow noreferrer&quot;&gt;SNAP header&lt;/a&gt; which served the same purpose. But, I digress.&lt;/p&gt;&#xA;&lt;p&gt;The standard, Ethernet2 L2 header has a Type field, which tells the receiving node how to interpret the 1's and 0's that follow:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WRiNM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WRiNM.png&quot; alt=&quot;Ethernet Header with Type field highlighted&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Without this, how would the receiving entity know whether the L3 header is IPv4 or IPv6? (or AppleTalk, or IPX, or IPv8, etc...)&lt;/p&gt;&#xA;&lt;p&gt;The L3 header (to the same frame as above) has the Protocol field, which tells the receiving node how to interpret the next set of 1's and 0's that follow the IP header:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/p8shv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p8shv.png&quot; alt=&quot;IP Header with Protocol field highlighted&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Again, without this, how would the receiving entity know to interpret those bits as an ICMP packet? It &lt;em&gt;could&lt;/em&gt; also be TCP, or UDP, or GRE, or another IP header, or a plethora of others.&lt;/p&gt;&#xA;&lt;p&gt;This creates a sort of &lt;em&gt;protocol chain&lt;/em&gt; to indicate to the receiving entity how to interpret the next set of bits. Without this, the receiving end would have to use heuristics (or other similar strategies) to first identify the type of header, and then interpret and process the bits. Which would add significant overhead at each layer, and noticeable delay in packet processing.&lt;/p&gt;&#xA;&lt;p&gt;At this point, it's tempting to look at the &lt;a href=&quot;https://web.archive.org/web/20220331062948/http://networksorcery.com/enp/protocol/tcp.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP header&lt;/a&gt; or &lt;a href=&quot;https://web.archive.org/web/20211206051320/http://networksorcery.com/enp/Protocol/udp.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;UDP header&lt;/a&gt; and point out that &lt;em&gt;those&lt;/em&gt; headers don't have a Type or Protocol field... but recall, once TCP/UDP have interpreted the bits, it passes its payload to the application. Which undoubtedly probably has some sort of marker to at least identify the version of the L5+ protocol. For example, HTTP has a version number built into the HTTP requests: 1.0 vs 1.1.&lt;/p&gt;&#xA;&lt;HR&gt;&#xA;&lt;p&gt;&lt;em&gt;Edit to speak to the original poster's edit:&lt;/em&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What's wrong with a model where instead of every header identifying the next header's type, every header identifies its own type in a predetermined location (eg. in the first header byte)? Why is such a model any less desirable than the current one?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Before getting into my attempt at an answer, I think it's worth noting that there is probably no definitive million dollar answer as to why one way is better or the other. In both cases, protocol identifying itself vs protocol identifying what it encapsulates, the receiving entity would be able to interpret the bits correctly.&lt;/p&gt;&#xA;&lt;p&gt;That said, I think there are a few reasons why the protocol identifying the next header makes more sense:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;#1&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;If the standard was for the first byte of &lt;em&gt;every&lt;/em&gt; header to identify itself, this would be setting a standard across &lt;em&gt;every&lt;/em&gt; protocol at &lt;em&gt;every&lt;/em&gt; layer. Which means if only one byte is dedicated we could only ever have 256 protocols. Even if you dedicated two bytes, that caps you at 65536. Either way, it puts an arbitrary cap on the number of protocols that could be developed.&lt;/p&gt;&#xA;&lt;p&gt;Whereas if one protocol was only responsible for interpreting the next, and even if only one byte was dedicated to each protocol identification field, at the very least you 'scale' that 256 maximum to each layer.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;#2&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Protocols which order their fields in such a way to allow receiving entities the option to only inspect the bare minimum to make a decision only exists if the next protocol field exists in the previous header.&lt;/p&gt;&#xA;&lt;p&gt;Ethernet2 and &amp;quot;&lt;a href=&quot;https://en.wikipedia.org/wiki/Cut-through_switching&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cut-Through&lt;/a&gt;&amp;quot; switching come to mind. This would be impossible if the first (few) bytes were forced to be a protocol identification block.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;#3&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Lastly, I don't want to take credit, but I think &lt;a href=&quot;https://networkengineering.stackexchange.com/users/4882/reirab&quot;&gt;@reirab&lt;/a&gt;'s &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/26446/why-is-the-protocol-field-part-of-an-ip-header#comment41686_26446&quot;&gt;answer in the comment&lt;/a&gt; in the comments of the original question is extremely viable:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Because then it's effectively just the last byte of the IPv4 (or whatever lower-level protocol) header in all but name. It's a &amp;quot;chicken or egg&amp;quot; problem. You can't parse a header if you don't know what protocol it is.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;sub&gt;Quoted with Reirab's permission&lt;/sub&gt;&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="43734" LastEditDate="2024-03-17T18:00:28.603" LastActivityDate="2024-03-17T18:00:28.603" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="26461" PostTypeId="1" AcceptedAnswerId="26463" CreationDate="2016-02-02T09:02:26.710" Score="1" ViewCount="1716" Body="&lt;p&gt;I have BGP running between two routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i run &quot;show ip bgp vpnv4 neighbors 1.1.1.1 received-routes&quot;, I see the advertised routes from the neighbor as &quot;valid (*)&quot;, not &quot;best (&gt;)&quot; : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WAN01#sh ip bgp vpnv4 neighbors 1.1.1.1 received-routes&#xA;     Network          Next Hop            Metric LocPrf Weight Path&#xA; *   192.168.1.0/24      1.1.1.1                             0 1 2 3 4 ?&#xA; *   192.168.2.0/24      1.1.1.1                             0 1 2 3 4 i     &#xA; *   192.168.3.0/24      1.1.1.1                             0 1 2 3 i&#xA; *   192.168.4.0/24      1.1.1.1                             0 1 2 3 4 ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The list goes on, all my 325 routes are valid, but not best.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, they are actually installed in my global routing table :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WAN01#sh ip route bgp&#xA;&#xA;B        192.168.1.0/24 [20/0] via 1.1.1.1, 1w4d&#xA;B        192.168.2.0/24 [20/0] via 1.1.1.1, 1w4d&#xA;B        192.168.3.0/24 [20/0] via 1.1.1.1, 1w4d&#xA;B        192.168.4.0/24 [20/0] via 1.1.1.1, 4d09h&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I explain this ?&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2016-02-02T09:12:56.687" Title="BGP Route installed in routing table seen as valid but not as best" Tags="|cisco|routing|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26463" PostTypeId="2" ParentId="26461" CreationDate="2016-02-02T09:12:56.687" Score="4" Body="&lt;p&gt;The &lt;code&gt;show ip bgp vpnv4 neighbors 1.1.1.1 received-routes&lt;/code&gt; shows all routes received from the neighbor before routing policies are applied (and as such doesn't show best-path information). To see which routes are &lt;strong&gt;accepted&lt;/strong&gt; and possibly installed use the &lt;code&gt;show ip bgp vpnv4 neighbors 1.1.1.1 routes&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the &lt;code&gt;received-routes&lt;/code&gt; command is only available if &lt;code&gt;soft-reconfiguration&lt;/code&gt; is configured for the neighbor.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2016-02-02T09:12:56.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26465" PostTypeId="1" AcceptedAnswerId="26480" CreationDate="2016-02-02T10:05:47.563" Score="2" ViewCount="1033" Body="&lt;p&gt;I am running a design where 2 WAN routers are connected to the same CORE switch (see drawing attached).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF advertismeents are done using SVI for vlan 103 as follows :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WAN01#&#xA;interface Vlan103&#xA; description OSPF&#xA; ip address 192.168.1.1 255.255.255.0&#xA; ip ospf dead-interval minimal hello-multiplier 5&#xA; ip ospf 1 area 0&#xA;&#xA;&#xA;WAN02#&#xA;interface Vlan103&#xA; description OSPF&#xA; ip address 192.168.1.2 255.255.255.0&#xA; ip ospf dead-interval minimal hello-multiplier 5&#xA; ip ospf 1 area 0&#xA; ip ospf cost 5&#xA;&#xA;CORE01#&#xA;interface Vlan103&#xA; description OSPF&#xA; ip address 192.168.1.254 255.255.255.0&#xA; ip ospf dead-interval minimal hello-multiplier 5&#xA; ip ospf 1 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As of now, WAN01 is advertising OSPF routes (internal &amp;amp; redistributed bgp) with a cost of 1 to my CORE switch. It's receiving routes from CORE with a cost of 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is its OSPF routing table :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;O        192.168.3.0/27 [110/2] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.7.0/24 [110/2] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.9.0/24 [110/2] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.10.0/24 [110/2] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.11.0/24 [110/2] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.12.0/24 [110/2] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.14.0/24 [110/2] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.100.3/32 [110/2] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.1.32/28 [110/2] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.1.56/29 [110/2] via 192.168.1.254, 7w0d, Vlan103&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;WAN02 is also advertising OSPF routes (internal &amp;amp; redistributed bgp backup routes) with a cost of 5 to my CORE switch. &#xA;It's receiving routes from CORE with a cost of 6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is its OSPF routing table :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;O        192.168.3.0/27 [110/6] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.7.0/24 [110/6] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.9.0/24 [110/6] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.10.0/24 [110/6] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.11.0/24 [110/6] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.12.0/24 [110/6] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.14.0/24 [110/6] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.100.3/32 [110/6] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.1.32/28 [110/6] via 192.168.1.254, 7w0d, Vlan103&#xA;O        192.168.1.56/29 [110/6] via 192.168.1.254, 7w0d, Vlan103&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VLAN 103 is not extended between WAN01 &amp;amp; WAN02, so they see each other as OSPF neighbors through CORE01 on VLAN 103.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I add VLAN 103 to my trunk link between WAN01 and WAN02, what will &#xA;happen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my knowledge, WAN02 will advertise its routes with a cost of 5 or 6 and will receive advertised routes from WAN01 with a cost of 1 or 2, essentially replacing all its OSPF routes shown above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a mechanism like split horizon (not used in OSPF) that will prevent this design to work ?&#xA;I am thinking especially of not being able to advertise routes on a link where my router has received routes for the same networks - but using a SVI must surely prevent this kind of failure? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/41nQl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/41nQl.png&quot; alt=&quot;OSPF Design&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2016-02-02T15:06:51.013" Title="OSPF split-horizon mechanism" Tags="|cisco|routing|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26466" PostTypeId="2" ParentId="26446" CreationDate="2016-02-02T10:18:19.457" Score="1" Body="&lt;p&gt;The simplest reason, is to help parsing when a packet is received. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know which protocol follow, you can develop stricter constraint. The only dynamic aspect in the IP packet is the size (the presence of IP options increase this size in multiple of four bytes). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In parsing phase, you can check ip header length, protocol. Then, in the low level packet validation, the packet data is read through a data struct (usually, icmp, tcp, udp headers) and with easy packet is validated. &lt;/p&gt;&#xA;" OwnerUserId="22542" LastActivityDate="2016-02-02T10:18:19.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26467" PostTypeId="1" CreationDate="2016-02-02T10:40:32.390" Score="0" ViewCount="807" Body="&lt;p&gt;I am having a &lt;code&gt;modem / router&lt;/code&gt; &lt;strong&gt;TD-W8951ND&lt;/strong&gt; which works fine with ADSL cable (telephone cable). Since I am changing my broadband plan (they will be providing there own modem), I need to make wifi work with Ethernet cable as the source of internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to know whether I can share my internet from ethernet cable to wifi using TD-W8951ND. If yes, how? I found a similar discussion here (not very conclusive) :-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.tomshardware.com/answers/id-1805509/link-w8951nd-150mbps-wireless-adsl2-modem-router-work-fiber-optic-gtpl-internet-broadband.html&quot; rel=&quot;nofollow&quot;&gt;http://www.tomshardware.com/answers/id-1805509/link-w8951nd-150mbps-wireless-adsl2-modem-router-work-fiber-optic-gtpl-internet-broadband.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is its User Manual:-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.tp-link.in/resources/document/TD-W8951ND_V5_User_Guide_1910010890.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.tp-link.in/resources/document/TD-W8951ND_V5_User_Guide_1910010890.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anybody please tell me if its doable or not?&lt;/p&gt;&#xA;" OwnerUserId="22543" LastActivityDate="2016-02-02T12:40:42.647" Title="TD-W8951ND: Can I use this modem as router only?" Tags="|router|ethernet|adsl|" AnswerCount="1" CommentCount="1" ClosedDate="2016-02-02T16:48:05.290" ContentLicense="CC BY-SA 3.0" />
  <row Id="26468" PostTypeId="2" ParentId="26335" CreationDate="2016-02-02T10:41:56.607" Score="1" Body="&lt;p&gt;don't worry to be french, i'm italian.........&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now, there are multiple ways to reach the goal; at least&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) static (pre-nat-interface-name,post-nat-interface-name) fake-addr real-addr links 2 addresses, one in each network, and perform a static 1:1 translation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) anything coming from X and going to Y? well give it a global address so that you need 3 elements&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.1) an access-l defining the pertinent traffic&#xA;2.2) a global address to use for PAT&#xA;2.3) a link between them, as in NAT command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that ways allow (simply) you to translate one addr into another and vice-versa or multiple addresses to just one (second solution) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;while the NAT (or PAT) addr belongs to the &quot;right&quot; (encapsulated) network you've reached the goal.&lt;/p&gt;&#xA;" OwnerUserId="22173" LastActivityDate="2016-02-02T10:41:56.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26469" PostTypeId="2" ParentId="21063" CreationDate="2016-02-02T12:23:21.480" Score="3" Body="&lt;p&gt;This is not exactly the same but may help, as it shows the far end peer address. Original command did not. But if you use &quot;bgp listen&quot;, you then lose the foreign address! Interesting question for an exam maybe. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R5#show tcp brief all&#xA;TCB       Local Address               Foreign Address             (state)&#xA;6792B388  *.179                       4.4.4.4.*                   LISTEN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22544" LastEditorUserId="8499" LastEditDate="2016-04-13T19:55:01.717" LastActivityDate="2016-04-13T19:55:01.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26470" PostTypeId="1" AcceptedAnswerId="26483" CreationDate="2016-02-02T12:34:40.377" Score="2" ViewCount="2073" Body="&lt;p&gt;In my lab I have two routers which are connected to different ISPs. &lt;br /&gt;&#xA;They're not directly connected via a wire, but they're connected via a tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Through that tunnel I used to create an iBGP peer and they exchange routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, router A sends a better route to router B which now installs it into its routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now Router B is &quot;able&quot; to reach everything through the tunnel via Router A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above scenario describes my problem and I thought the solution was to check incoming routes which come from the neighbor router in the same AS and add a higher distance so that existed routes won't change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that even a good solution? If yes, how am I able to do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my filter configuration so far, but, unfortunately, it doesn't work properly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import filter {&#xA;   if bgp_path ~ [= AS_NUMBER =] then&#xA;       {&#xA;             bgp_path.prepend(AS_NUMBER);&#xA;             bgp_path.prepend(AS_NUMBER);&#xA;             bgp_path.prepend(AS_NUMBER);&#xA;             bgp_path.prepend(AS_NUMBER);&#xA;             bgp_path.prepend(AS_NUMBER);&#xA;             bgp_path.prepend(AS_NUMBER);&#xA;             bgp_path.prepend(AS_NUMBER);&#xA;             accept;&#xA;           }&#xA;         reject;&#xA; };&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the problem seems to be more complicated:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to adjust a preference on both iBGP routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. router A has a higher preference than router B, router B will send send everything through router A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either my settings are wrong, or performing an iBGP peer through a tunnel is more than wrong. &lt;/p&gt;&#xA;" OwnerUserId="14081" LastEditorUserId="8499" LastEditDate="2019-01-05T00:11:38.417" LastActivityDate="2019-01-05T00:11:38.417" Title="bird bgp metric distance" Tags="|routing|bgp|tunnel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26471" PostTypeId="2" ParentId="26467" CreationDate="2016-02-02T12:40:42.647" Score="1" Body="&lt;p&gt;Maybe the new router that the provider will install has wifi?&#xA;From what I've read of the manual I'm not sure if this model is able to acquire or set an IP from/on a switch interface. If this is true, then what you want won't be doable.&lt;/p&gt;&#xA;" OwnerUserId="22515" LastActivityDate="2016-02-02T12:40:42.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26472" PostTypeId="2" ParentId="26333" CreationDate="2016-02-02T13:33:41.927" Score="1" Body="&lt;p&gt;Back on the stage :)  One small and unimportant detail: according to Cisco, one model of 2960 is Layer 3 capable - 2960XR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speaking about your possible configuration, it woud be nice to have two additional switches (vlan capable, not dumbs). I'd use 4 interfaces: &quot;outside&quot;, &quot;inside&quot;, &quot;DMZ&quot; and &quot;wifi&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Outside&quot; link goes to your ISP;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;DMZ&quot; - to the DMZ switch with the servers;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;WIFI&quot; connects to the additional wifi network switch. Here you define subinterfaces for 2 wifi vlans. On the switch side corresponding port should be in dot1q trunk mode. Probably you'd need WIFI AP to be in trunk mode too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Inside&quot; goes to the second additional switch, which is connecting your internal subnets; define here subinterfaces for the subnets and put switch's port into trunk mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One example of such configuration (alas, without the switches): &lt;a href=&quot;https://www.speaknetworks.com/cisco-asa-dmz-configuration-example/&quot; rel=&quot;nofollow&quot;&gt;https://www.speaknetworks.com/cisco-asa-dmz-configuration-example/&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-02-02T13:33:41.927" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="26474" PostTypeId="1" CreationDate="2016-02-02T14:13:32.747" Score="1" ViewCount="485" Body="&lt;p&gt;I'm a network-naive telecom guy. I have a Cisco 878 router.&#xA;My duty is to set up some configuration on it with the following parameters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MPLS Settings:&#xA;LAN IP: 123.123.123.123 / 1&#xA;WAN IP: 456.456.456.456 / 2&#xA;VPI: 42&#xA;VCI: 95&#xA;Speed: 2048&#xA;No VLAN (access ports)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I have managed to connect the router to my laptop via the console cable, and used a HyperTerminal to connect to the device.&#xA;I need to mention that the router is already configured for some other (ATM?) connection. We need to get rid of that and re-configure it for our new connection.&#xA;I have gone through numerous manuals and helps online, but they seem to be not working for me.&#xA;For example, my command line starts with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Refinery&amp;gt;_&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and when I press &lt;code&gt;?&lt;/code&gt; I can't find &lt;code&gt;Router&lt;/code&gt; listed in there. But all the manuals and forums are talking about &lt;code&gt;Router (Config...)&lt;/code&gt;. &#xA;Would you guide me to this?&#xA;Thanks in advance&#xA;-Amin&lt;/p&gt;&#xA;" OwnerUserId="22547" LastEditorUserId="22547" LastEditDate="2016-02-02T14:27:09.873" LastActivityDate="2016-02-02T14:47:00.860" Title="Cisco 878 Router MPLS WAN Configuration" Tags="|cisco|router|mpls|" AnswerCount="1" CommentCount="5" ClosedDate="2016-02-02T17:21:47.623" ContentLicense="CC BY-SA 3.0" />
  <row Id="26477" PostTypeId="2" ParentId="26261" CreationDate="2016-02-02T14:42:14.267" Score="2" Body="&lt;p&gt;It turned out to be Port Security enabled on ISP access switches, which was blocking frames (following failover) for approx. 30 minutes. Thanks everyone and Ron Trunk especially&lt;/p&gt;&#xA;" OwnerUserId="16189" LastActivityDate="2016-02-02T14:42:14.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26478" PostTypeId="2" ParentId="26474" CreationDate="2016-02-02T14:47:00.860" Score="1" Body="&lt;p&gt;If you are not joking :) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to have &quot;enable&quot; password for this router. If you have it, do the following :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refinery&gt;enable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Password: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refinery#configure terminal&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enter configuration commands, one per line.  End with CNTL/Z.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refinery(config)#no hostname&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router(config)#end&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router#&lt;/p&gt;&#xA;&#xA;&lt;p&gt;%SYS-5-CONFIG_I: Configured from console by console&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router#disable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router&gt;&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-02-02T14:47:00.860" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26479" PostTypeId="1" AcceptedAnswerId="26481" CreationDate="2016-02-02T15:06:27.430" Score="3" ViewCount="325" Body="&lt;p&gt;Let's say that we have two PC's and one router between them:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PC1 ----------- Router ---------- PC2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC 1 MTU is 400 bytes&#xA;PC 2 MTU is 1500 bytes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We send a packet from PC1(400) to PC2(1500)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The question is:&lt;/strong&gt;&#xA;Will there be any packet fragmentation/byte excess - how the router will act in this situation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my opinion - no, but shouldn't it fill the data with zeros, or something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, how the fragmentation works, if we switch the MTU's between two of them?&lt;/p&gt;&#xA;" OwnerUserId="22505" LastEditorUserId="8499" LastEditDate="2022-11-20T01:49:46.837" LastActivityDate="2022-11-20T01:49:46.837" Title="MTU - byte excess between two PC's" Tags="|mtu|fragmentation|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26480" PostTypeId="2" ParentId="26465" CreationDate="2016-02-02T15:06:51.013" Score="4" Body="&lt;p&gt;If you enable VLAN 103 between WAN 01 and WAN 02, you will create a layer 2 loop, which presumably will be broken by Spanning Tree protocol. So depending on the STP parameters, one of those links will be in the blocking state.  You will end up in a very similar state where you are now.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-02T15:06:51.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26481" PostTypeId="2" ParentId="26479" CreationDate="2016-02-02T16:48:49.680" Score="3" Body="&lt;p&gt;PC1 can send 400 byte packets to PC2.  No fragmentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When PC2 replies, one of two things can happen:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router interface to PC1 has an MTU of 400, then the router will fragment the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router interface is set to 1500, it will not fragment, and PC1 will drop the packets.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-02T16:48:49.680" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26482" PostTypeId="2" ParentId="26479" CreationDate="2016-02-02T16:49:11.743" Score="2" Body="&lt;p&gt;Going from a small MTU to a larger MTU will not fragment anything, nor will it cause any padding unless the layer-2 protocol has a minimum frame or payload size which is larger than the MTU. Remember that the &quot;M&quot; in MTU is for &quot;Maximum,&quot; not &quot;Minimum.&quot; Ethernet has a minimum frame size of 64 bytes and a minimum payload size of 46 bytes, so using ethernet will not cause any padding in the ethernet payload, and IP doesn't care so the packets will not be modified.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-02T16:49:11.743" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26483" PostTypeId="2" ParentId="26470" CreationDate="2016-02-02T17:01:58.940" Score="1" Body="&lt;p&gt;You problem seems to be related to the iBGP rule that iBGP routers will not advertise a route learned from another iBGP speaker. The problem is that iBGP will not change the AS_PATH, and this creates the problem of routing loops. To avoid routing loops, iBGP speaker will not advertise to any other iBGP speakers prefixes learned through iBGP. That is why iBGP requires a full-mesh (every iBGP speaker must have a connection to every other iBGP speaker) or a mitigation such as route reflectors or confederations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are trying to advertise, through the tunnel, prefixes learned from another iBGP speaker, that will not work. You need to either use eBGP through the tunnel, or set up the routers at the tunnel ends as route reflectors or separate confederations. The route reflectors must have a connection to every router for which it is a route reflector, or confederations must have a full-mesh of iBGP speakers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The methods used to modify routing for eBGP, such as AS_PATH prepending or changing the metric (MED), are for eBGP, not iBGP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-02T17:17:22.987" LastActivityDate="2016-02-02T17:17:22.987" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26484" PostTypeId="1" AcceptedAnswerId="26486" CreationDate="2016-02-02T17:28:38.713" Score="2" ViewCount="328" Body="&lt;p&gt;My ISP company has some PoPs in remote areas, as shown in diagram. It is currently, it's getting all prefixes from Local IX and getting only a default route from the upstream Internet provider. Currently, the internal network uses static routing, but I am planning to move it to OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, all the traffic shaping is done in PoP routers so that core router doesn't get burned out, and it's done by interface-based rate limiting, one customer one interface basis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my goal is to provide unlimited speed (full wire-speed) to local IX, which gives hundreds of prefixes which are constantly changing, and my service nodes (FTP, storage, local contents, etc.), while limiting Internet bandwidth by customer. Preferably, this done in the PoP routers. Again, it is not at all feasible to put separate long haul links to pop routers just for this purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to rate limit based on VLAN so that I can achieve the goal? Are there any other suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Uo0Kk.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Uo0Kk.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4472" LastEditorUserId="8499" LastEditDate="2018-12-13T00:09:36.920" LastActivityDate="2018-12-13T00:09:36.920" Title="Rate limit based on VLAN" Tags="|vlan|qos|bandwidth|isp|design|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26486" PostTypeId="2" ParentId="26484" CreationDate="2016-02-02T18:08:57.660" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible rate limit based on vlan so I can achieve the goal ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The answer is a qualified yes. It really depends on the capabilities of your router hardware and software. For instance, I know Cisco and Juniper routers have robust QoS features to allow traffic shaping and policing based on a variety of criteria, which include VLANs or IP address ranges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without knowing what equipment you are using, it is impossible to say for sure, but it is highly probable that you can do this.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-02T18:08:57.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26487" PostTypeId="1" AcceptedAnswerId="26488" CreationDate="2016-02-02T19:23:18.180" Score="6" ViewCount="8831" Body="&lt;p&gt;I have two Linux hosts connected via category 6 wire. How do the LAN cards negotiate a link speed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, I am trying to solidify if I am actually hammering a 1GbE NIC with traffic from a 10Gbe NIC or if they negotiated a 1GbE link speed. &lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2016-02-02T19:53:28.747" Title="How does auto-negotiate determine link speeds?" Tags="|ethernet|autonegotiation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26488" PostTypeId="2" ParentId="26487" CreationDate="2016-02-02T19:29:00.413" Score="7" Body="&lt;p&gt;A 10 Gb NIC connected directly to a 1 Gb either negotiates a 1 Gb connection, or it doesn't work at all. You cannot have the situation you describe unless you have something like a switch in between, where the 10 Gb NIC connects to a 10 Gb switch port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is very easy to search and find &lt;code&gt;ethernet speed negotiation&lt;/code&gt; on the Internet, such as the Wikipedia &lt;a href=&quot;https://en.wikipedia.org/wiki/Autonegotiation&quot;&gt;article&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Auto-negotiation (formerly &quot;NWay&quot;) is based on pulses similar to those&#xA;  used by 10BASE-T devices to detect the presence of a connection to&#xA;  another device. These connection present pulses are sent by Ethernet&#xA;  devices when they are not sending or receiving any frames. They are&#xA;  unipolar positive-only electrical pulses of a nominal duration of 100&#xA;  ns, with a maximum pulse width of 200 ns,[5] generated at a 16 ms time&#xA;  interval (with a timing variation tolerance of 8 ms). These pulses are&#xA;  called link integrity test (LIT) pulses in the 10BASE-T terminology,&#xA;  and are referred to as normal link pulses (NLP) in the&#xA;  auto-negotiation specification.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A device detects the failure of a link if neither a frame nor two of&#xA;  the LIT pulses is received for 50-150 ms. For this scheme to work,&#xA;  devices must send LIT pulses regardless of receiving any. Three bursts&#xA;  of Fast Link Pulses, used by autonegotiating devices to declare their&#xA;  capabilities.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Auto-negotiation uses similar pulses labeled as NLP. NLP are still&#xA;  unipolar, positive-only, and of the nominal duration of 100 ns; but&#xA;  each LIT is replaced by a pulse burst consisting of 17 to 33 pulses&#xA;  sent 125 µs apart. Each such pulse burst is called a fast link pulse&#xA;  (FLP) burst. The time interval between the start of each FLP burst is&#xA;  the same 16 milliseconds as between normal link pulses (variation&#xA;  tolerance of 8 ms). How a link code word (a 16 bit word) is encoded in&#xA;  a fast link pulse burst&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The FLP burst consists of 17 NLP at a 125 µs time interval (with a&#xA;  tolerance of 14 µs). Between each pair of two consecutive NLP (i.e. at&#xA;  62.5 µs after first NLP of the pulse pair) an additional positive pulse may be present. The presence of this additional pulse indicates&#xA;  a logical 1, its absence a logical 0. As a result, every FLP contains&#xA;  a data word of 16 bits. This data word is called a link code word&#xA;  (LCW). The bits of the link code word are numbered from 0 to 15, where&#xA;  bit 0 corresponds to the first possible pulse in time and bit 15 to&#xA;  the last.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit for the dumbed-down, plain-English version from &lt;a href=&quot;http://www.flukenetworks.com/content/auto-negotiation-how-does-it-work&quot;&gt;Fluke&lt;/a&gt;, per your comment:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In regular English, auto-negotiation is simply the method used by two&#xA;  devices to achieve the best rate possible of transmission. It allows&#xA;  them to discuss in a sense, the possible rates of transmission, then&#xA;  pick the best one that they both share. They do this by swapping&#xA;  advertisements of their own abilities using pulses called Fast Link&#xA;  Pulses (FLPs). The FLP lets one link partner know what the other is&#xA;  capable of. As they swap FLPs, the two stations detect the highest&#xA;  common denominator between them, according to the following:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;1000BASE-T&lt;/li&gt;&#xA;  &lt;li&gt;100BASE-T2 Full Duplex&lt;/li&gt;&#xA;  &lt;li&gt;100BASE-TX Full Duplex&lt;/li&gt;&#xA;  &lt;li&gt;100BASE-T2&lt;/li&gt;&#xA;  &lt;li&gt;100BASE-T4&lt;/li&gt;&#xA;  &lt;li&gt;100BASE-TX&lt;/li&gt;&#xA;  &lt;li&gt;10BASE-T Full Duplex&lt;/li&gt;&#xA;  &lt;li&gt;10BASE-T&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;For example, if station A and B are auto-negotiating with each other,&#xA;  and A is capable of 10/100/1000 full or half duplex, but B is only&#xA;  capable of 10/100 full or half duplex, then the highest common link&#xA;  rate is 100, at full duplex. As long as both sides are negotiating,&#xA;  the link will operate at the highest possible connection rate between&#xA;  them.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-02T19:53:28.747" LastActivityDate="2016-02-02T19:53:28.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26489" PostTypeId="2" ParentId="26487" CreationDate="2016-02-02T19:30:27.910" Score="1" Body="&lt;p&gt;The auto-negotiation protocol will attempt to link at the fastest speed available on both ports.   Back in the day when there was still half-duplex, full-duplex would be preferred.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You didn't mention what operating system you were using but there will be a tool (like &lt;strong&gt;ethtool&lt;/strong&gt; for Linux) to determine what capabilities each port advertises.  Generally the same tool will also tell you what link speed you ended up with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you were wondering, it is not possible to have link partners running at different speeds.&lt;/p&gt;&#xA;" OwnerUserId="14337" LastActivityDate="2016-02-02T19:30:27.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26490" PostTypeId="2" ParentId="26399" CreationDate="2016-02-02T19:40:20.347" Score="1" Body="&lt;p&gt;Checking the &lt;a href=&quot;http://www8.hp.com/us/en/products/networking-switches/product-detail.html?oid=5333809&amp;amp;jumpid=reg_r11944_usen_c-001_title_r0001#!tab=oas&quot; rel=&quot;nofollow&quot;&gt;webpage of accesories for HP 2530-48G (J9775A)&lt;/a&gt; I could not find any Direct Attach Cable for this switch, neither 10G fiber based SFPs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Among the SFPs compatible with this switch:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you want to use the SFP ports for interconection and would&#xA;like/need to avoid optical fiber cables you can use the &lt;a href=&quot;http://www8.hp.com/us/en/products/oas/product-detail.html?oid=3840394&quot; rel=&quot;nofollow&quot;&gt;HP X121 1G&#xA;SFP RJ45 T Transceiver (J8177C)&lt;/a&gt; which is 1G and suitable for your&#xA;distance.&lt;/li&gt;&#xA;&lt;li&gt;If you don´t have a restriction forcing you to avoid fiber links,&#xA;take into account that &lt;a href=&quot;http://www8.hp.com/us/en/products/oas/product-detail.html?oid=3619488&quot; rel=&quot;nofollow&quot;&gt;HP X121 1G SFP LC SX Transceiver(J4858C)&lt;/a&gt;&#xA;is a bit cheaper than the copper one (at least in list price for the&#xA;USA) and also suitable for your distance&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="76" LastActivityDate="2016-02-02T19:40:20.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26493" PostTypeId="1" AcceptedAnswerId="26494" CreationDate="2016-02-03T02:20:03.430" Score="2" ViewCount="136" Body="&lt;p&gt;What exactly is antenna aperture and how does this differ from antenna gain and receiver sensitivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am studying for the CWNA and I am having a difficult time figuring this out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wikipedia doesn't help me and the other sites I have visited haven't either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know of an easy way to differentiate between them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="16873" LastEditorUserId="16873" LastEditDate="2016-02-06T12:30:26.817" LastActivityDate="2016-02-06T12:30:26.817" Title="What exactly is antenna aperture? CWNA" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26494" PostTypeId="2" ParentId="26493" CreationDate="2016-02-03T03:02:13.630" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In electromagnetics and antenna theory, antenna aperture or effective area is a measure of how effective an antenna is at receiving the power of radio waves.&#xA;  ...&#xA;   &lt;strong&gt;The larger an antenna's aperture is, the more power it can collect from a given field of radio waves.&lt;/strong&gt;&#xA;  &lt;br&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Antenna_aperture&quot; rel=&quot;nofollow&quot;&gt;[Wikipedia]&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Aperture is a measure of how much signal a given antenna can collect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gain is how much amplification the antenna provides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Receiver sensitivity is the minimum amount of signal the receiver can work with. (i.e. how softly can you talk and still be understood.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-02-03T03:02:13.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26495" PostTypeId="2" ParentId="26366" CreationDate="2016-02-03T03:05:53.910" Score="2" Body="&lt;h2&gt;Welcome to SE!&lt;/h2&gt;&#xA;&lt;p&gt;As a network engineer I too have recently started programming in Python to better support my own internal automation efforts. In the interest of avoiding a lot of manual work handling the low-level ssh processing that comes with working with CLI, I have focused exclusively on the scripting interface that comes with the SecureCRT application. If you have SecureCRT you can review its scripting capabilities and its documentation will show you how you can use Python scripts like the one below with it. Even if you do not have SecureCRT, you can use the following code as a general outline of how you can put such a script together using native ssh daemons, provided you handle all of the low-level SSH/CLI work separately. Please note that this code was created under the assumption that you are only working with modern Cisco wired network devices with relatively recent versions of IOS.&lt;/p&gt;&#xA;&lt;h2&gt;I MAKE NO WARRANTY OF ANY KIND ON THIS CODE IN ITS CURRENT STATE. THIS IS BASIC TESTING CODE AND NOT INTENDED FOR PRODUCTION. IT MAY BREAK YOUR NETWORK!&lt;/h2&gt;&#xA;&lt;p&gt;You have been warned :)&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;# $language = &amp;quot;python&amp;quot;&#xA;# $interface = &amp;quot;1.0&amp;quot;&#xA;import sys&#xA;import re&#xA;&#xA;# Your hosts file should just be a list of IP's, each on its own line&#xA;HOSTSFILE = '\path_to\your_hosts_file.txt'&#xA;USER = 'username'&#xA;PASS = 'password'&#xA;ENABLEP = 'enablepassword'&#xA;NEW_HELPER_CMD = 'ip helper-address x.x.x.x'&#xA;&#xA;def Wait():&#xA;    # Wait for a prompt&#xA;    while True:&#xA;        if not crt.Screen.WaitForCursor(1):&#xA;            break&#xA;def Get_prompt():&#xA;    row = crt.Screen.CurrentRow&#xA;    prompt = crt.Screen.Get(row, 0, row, crt.Screen.CurrentColumn - 1).strip()&#xA;    return prompt&#xA;def Get_list_from_file(file_path):&#xA;    f = open(file_path, 'r')&#xA;    hostlist = f.readlines()&#xA;    f.close()&#xA;    return hostlist&#xA;def Log_in(host):&#xA;    login_command = '/SSH2 /L {0} /PASSWORD {1} {2}'.format(USER, PASS, host)&#xA;    try:&#xA;        crt.Session.Connect(login_command)&#xA;        crt.Session.Synchronous = True&#xA;        Wait()&#xA;        return True&#xA;    except:&#xA;        # More specific except clauses needed&#xA;        # For specific error conditions, add corresponding error messages&#xA;        return False&#xA;def Exec_mode():&#xA;    prompt = Get_prompt()&#xA;    tries = 0&#xA;    # Enter priveleged exec mode if not already there&#xA;    while tries &amp;gt; 4:&#xA;        if re.search(r'#$', prompt):&#xA;            break&#xA;        elif re.search(r'[&amp;gt;]$', prompt):&#xA;            crt.Screen.Send('enable\n')&#xA;            Wait()&#xA;            prompt = Get_prompt()&#xA;            if re.search(r'Password:', prompt):&#xA;                crt.Screen.Send('{0}\n'.format(ENABLEP))&#xA;                Wait()&#xA;        elif re.search(r'\)$', prompt):&#xA;            crt.Screen.Send('end\n')&#xA;            Wait()&#xA;        tries += 1&#xA;    if tries &amp;gt;= 4:&#xA;        # Add an error code stating that exec_mode failed&#xA;        return False&#xA;    else:&#xA;        return True&#xA;def Config_mode():&#xA;    prompt = Get_prompt()&#xA;    if re.search(r'#$', prompt):&#xA;        crt.Screen.Send('config t\n')&#xA;        Wait()&#xA;    else:&#xA;        b = Exec_mode()&#xA;        if b:&#xA;            crt.Screen.Send('config t\n')&#xA;            Wait()&#xA;    prompt = Get_prompt()&#xA;    if re.search(r'\)$', prompt):&#xA;        return True&#xA;    else:&#xA;        return False&#xA;def Pull_and_parse_config():&#xA;    Wait()&#xA;    crt.Screen.Send('term len 0\n')&#xA;    Wait()&#xA;    prompt = Get_prompt()&#xA;    # Output the runnning config&#xA;    crt.Screen.Send(r'sh running-config\n')&#xA;    crt.Screen.WaitForString(r'\n')&#xA;    # Capture config output to string var 'config'&#xA;    # Note: If there is any duplicate of the 'prompt' string in the config, it will stop the&#xA;    # capture prematurely&#xA;    config = crt.Screen.ReadString(prompt)&#xA;    Wait()&#xA;    # Split the captured config into a list, containing the interface string, old ip helper string, and&#xA;    # remaining config. Will capture each interface on the device that currently has an ip helper command&#xA;    # Note: this only captures the first ip helper command on each interface&#xA;    configlist = re.split(r'(interface [^\n]+?)\n[^!]*?(ip helper-address .+?)\n', config, flags=re.DOTALL)&#xA;    if len(configlist) &amp;gt; 1:&#xA;        configlist.pop(0)&#xA;        return configlist&#xA;    else:&#xA;        # add message stating no interfaces matched&#xA;        return False&#xA;def Update_config(configlist):&#xA;    # For each interface with an ip helper command, remove old command and add new helper command&#xA;    while len(configlist) &amp;gt; 2:&#xA;        int_id = configlist.pop(0)&#xA;        old_helper_cmd = configlist.pop(0)&#xA;        if re.search(r'interface .+', int_id) and re.search(r'ip helper-address .+', old_helper_cmd):&#xA;            Enter_config_mode()&#xA;            # Here is where you actually update the config&#xA;            # If you don't want to remove old helper command, remove &amp;quot;no {1}\n&amp;quot; from the following string&#xA;            crt.Screen.Send('{0}\n no {1}\n {2}\n'.format(int_id, old_helper_cmd, NEW_HELPER_CMD))&#xA;            Wait()&#xA;            return True&#xA;        elif not re.search(r'interface .+', int_id):&#xA;            # add error message stating invalid interface id&#xA;            return False&#xA;        else:&#xA;            # add error message stating invalid ip helper command&#xA;            return False&#xA;def Main():&#xA;    hostfile = Get_list_from_file(HOSTSFLIE)&#xA;    for host in hostfile:&#xA;        ok = Log_in(host)&#xA;        if not ok:&#xA;            # add error message stating login failed&#xA;            continue&#xA;        ok = Exec_mode()&#xA;        if not ok:&#xA;            # add error message here&#xA;            continue&#xA;        configlist = Pull_and_parse_config()&#xA;        if not configlist:&#xA;            # add error message stating config capture failed&#xA;        ok = Update_config(configlist)&#xA;        if not ok:&#xA;            # add error message stating config update failed&#xA;        else:&#xA;            # add success message stating config on host successfully updated&#xA;&#xA;Main()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You will see that this involves a fair amount of code for something that seems like it should be simple, and this performs only one specific task! If you are still new to the scripting/programming world I highly recommend you consult with a more experienced programmer before attempting to implement any scripts in your production network, particularly anything like this that involves modifying configs. Although I adapted this code from some previous work I have done, I have not tested this and I cannot guarantee that any of this will work. Nevertheless, this should provide you with a good starting point. Good luck!&lt;/p&gt;&#xA;" OwnerUserId="21833" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-02-03T03:05:53.910" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26496" PostTypeId="1" CreationDate="2016-02-03T06:20:30.910" Score="1" ViewCount="67" Body="&lt;p&gt;I live in Appleton, WI. As the title states I subscribe to Time Warner Cable. I subscribe to the 50DL and 5UL package. From the morning until around 10PM my internet is fine. However, from 10PM-3AM my connection is very sporadic. I play online games, and competing is very hard when I have 2k-9k ping for minutes at a time. The spikes only last around 5 minutes, but it happens often throughout the time frame. The odd thing is, my teamspeak connection does not drop, and I can hear my friends perfectly, despite having very high ping in team speak as well, but my friends hear me distorted. This leads me to believe it is an upload problem, but I need advice from people more knowledgeable.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's some info I can provide:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I'm using a wired connection.&lt;/li&gt;&#xA;&lt;li&gt;The issue happens to all devices in the house.&lt;/li&gt;&#xA;&lt;li&gt;My computer is virus free.&lt;/li&gt;&#xA;&lt;li&gt;I am the only person connected to the modem (wired or wireless)&lt;/li&gt;&#xA;&lt;li&gt;Reset my modem to factory default and made a complex pass code for wireless.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://i.stack.imgur.com/HQosj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Downstream and Upstream&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I vaguely remember having more than a single upstream channel. Is there anything I can do short of getting a TWC tech to come out and fix it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for the help, I appreciate your time.&lt;/p&gt;&#xA;" OwnerUserId="22562" LastActivityDate="2016-02-03T06:20:30.910" Title="Having problems with Time Warner Cable Internet" Tags="|ethernet|" AnswerCount="0" CommentCount="1" ClosedDate="2016-02-03T07:31:08.900" ContentLicense="CC BY-SA 3.0" />
  <row Id="26497" PostTypeId="2" ParentId="26470" CreationDate="2016-02-03T07:28:24.213" Score="1" Body="&lt;p&gt;If I understand correctly (as it is not clearly elaborated) the problem that you are encountering is related to how the routes are prioritized for the same prefixes learned through both providers ISPA and ISPB, for some reason when traffic leaving your network hits router B it doesn't go via ISPB link, but it goes via tunnel --&gt; router A --&gt; ISPA link, even though router B also has the routes for the same destinations received from ISPB provider. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case you want to change this behavior and you look forward to use the directly provider connected to that router once the traffic reaches it then you have to tune up or remove the Local Preference configured for iBGP session between Router A and B, as Local Preference is the parameter that can prioritize the order on how a BGP decision will be processed, for more details please refer to this link &lt;a href=&quot;http://www.techrepublic.com/blog/data-center/understand-how-the-bgp-best-path-selection-algorithm-works-on-your-router/&quot; rel=&quot;nofollow&quot;&gt;http://www.techrepublic.com/blog/data-center/understand-how-the-bgp-best-path-selection-algorithm-works-on-your-router/&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, as it was already explained previously by Ron Maupin user, the AS_PATH prepending or changing of the metric (MED) doesn't affect iBGP behavior, these attributes change only eBGP behavior and will allow you to define the policy for the incoming traffic not for outbound traffic, which means you can define the policy on how your prefixes associated to your ASN should be advertised to the entire world.&lt;/p&gt;&#xA;" OwnerUserId="14080" LastActivityDate="2016-02-03T07:28:24.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26498" PostTypeId="1" CreationDate="2016-02-03T08:09:24.987" Score="1" ViewCount="53" Body="&lt;p&gt;I have two MPLS link and one is not passing traffic the other is passing traffic. What can be the cause of it.&lt;/p&gt;&#xA;" OwnerUserId="22566" LastActivityDate="2016-02-03T08:09:24.987" Title="One of my MPLS link is not passing traffic" Tags="|troubleshooting|" AnswerCount="0" CommentCount="1" ClosedDate="2016-02-03T08:12:31.743" ContentLicense="CC BY-SA 3.0" />
  <row Id="26500" PostTypeId="1" CreationDate="2016-02-03T10:12:58.413" Score="2" ViewCount="116" Body="&lt;p&gt;After booting the device, &#xA;&quot;=&gt;&quot; sign is showing in Juniper SRX 100 router&#xA;please support.&#xA;We are trying hard to restore the OS, but still failed, kindly support us urgently.&lt;/p&gt;&#xA;" OwnerUserId="22569" LastEditorUserId="619" LastEditDate="2016-02-03T22:23:38.873" LastActivityDate="2016-02-03T22:23:38.873" Title="=&gt; sign is showing in juniper srx100" Tags="|juniper|juniper-srx|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26501" PostTypeId="2" ParentId="26375" CreationDate="2016-02-03T10:17:37.667" Score="1" Body="&lt;p&gt;My understanding is that you have multiple remote sites to connect to with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dynamic public IPs&lt;/li&gt;&#xA;&lt;li&gt;identical LAN IPs from one to the other.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Those are actually two separate issues with completely different types of solutions. Handling dynamic public IPs can be done with a standard OpenVPN configuration (no DynDNS). Once the VPN part is in place, you should NAT each LAN to a distinct private IP range, such that your workstation thinks it sees different remote LANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if all the LANs use 192.168.1.0/24, you would map the first one to (for example) 10.0.1.0/24, the second one to 10.0.2.0/24, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without knowing more about the specific hardware, it's hard to say whether this is best done on your central gateway or on the remote site gateways, though.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-02-03T10:17:37.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26503" PostTypeId="1" CreationDate="2016-02-03T10:44:52.617" Score="1" ViewCount="1249" Body="&lt;p&gt;I hope someone can help me. this is the case:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Juniper srx-100-b and I tried to configure this device completely from scratch. What I have done, in u-boot mode, I perform the command 'erase all' (twice). Now i'm lost the partitions on the device, so the device can not load JunOS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect with the console cable, I don't see any post messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions is: Is there a way to recover these partitions and install JunOS on a complete empty device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="22571" LastActivityDate="2016-03-27T18:43:37.773" Title="Juniper srx-100-b doesn't boot anymore" Tags="|juniper|juniper-junos|juniper-srx|srx|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26507" PostTypeId="2" ParentId="26503" CreationDate="2016-02-03T12:11:01.520" Score="1" Body="&lt;p&gt;The correct procedure for this would be to run &lt;code&gt;request system zeroize&lt;/code&gt; from the cli.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the device still boot to U-boot when you restart it? If so maybe you can follow this &lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB14175&amp;amp;actp=search&quot; rel=&quot;nofollow&quot;&gt;procedure&lt;/a&gt; to re-install junos.&lt;/p&gt;&#xA;" OwnerUserId="22515" LastEditorUserId="22515" LastEditDate="2016-02-03T12:17:58.537" LastActivityDate="2016-02-03T12:17:58.537" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26508" PostTypeId="1" CreationDate="2016-02-03T12:51:57.303" Score="1" ViewCount="37" Body="&lt;p&gt;I've got a problem in my site&#xA;Many members could not enter the site &#xA;&lt;a href=&quot;http://www.dasolo.org/&quot; rel=&quot;nofollow&quot;&gt;dasolo.org&lt;/a&gt; from italy&#xA;The problem is that some people walk in are also using the same network from Italy&#xA;I use, for example, infostrada network And I enter normal from the city of Naples and others have infostrada and can not enter from Rome&#xA;A network  3g can not be used by entering&#xA;My Website is not blocked&#xA;I worked to convert him from another site 'dasolo.info. and the first site was blocked in Italy&#xA;But this 'dasolo.org' is not blocked and I enter normal fromitaly ..&#xA;In your opinion, what is the problem???&#xA;thank u for help&#xA;dasolo.org&lt;/p&gt;&#xA;" OwnerUserId="22575" LastActivityDate="2016-02-03T13:18:00.197" Title="Problem with same network in my site" Tags="|switch|router|" AnswerCount="1" CommentCount="2" ClosedDate="2016-02-03T20:48:34.943" ContentLicense="CC BY-SA 3.0" />
  <row Id="26509" PostTypeId="2" ParentId="26500" CreationDate="2016-02-03T13:10:44.580" Score="2" Body="&lt;p&gt;Please review this article, hopefully it will help you:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/software/junos-security/junos-security10.2/junos-security-admin-guide/section-srx-series-tftp-loader.html&quot; rel=&quot;nofollow&quot;&gt;Installing JUNOS Software&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From u-boot:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;=&amp;gt; setenv ipaddr 10.157.70.170&#xA;=&amp;gt; setenv netmask 255.255.255.0&#xA;=&amp;gt; setenv gatewayip 10.157.64.1&#xA;=&amp;gt; setenv serverip 10.157.60.1&#xA;=&amp;gt; saveenv&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reboot into the loader:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Loader&amp;gt;install tftp://10.77.25.12/junos-srxsme-10.0R2-domestic.tgz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Of course, use network settings relevant to your environment, and an image filename that you posses.)&lt;/p&gt;&#xA;" OwnerUserId="21627" LastEditorUserId="619" LastEditDate="2016-02-03T22:21:31.697" LastActivityDate="2016-02-03T22:21:31.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26510" PostTypeId="2" ParentId="26508" CreationDate="2016-02-03T13:18:00.197" Score="1" Body="&lt;p&gt;You need to troubleshoot in some way. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I think you first need to make a DNS resolution i guess, from the site that your are not be able to enter. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;nslookup(if you are using windows) or dig(linux):&#xA;nslookup dasolo.org&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And see if you succefull get the ip address of that site. If not, you need to contact with your service provider and clear that.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;If the first is good, you need to sniff your network traffic with wireshark or something like that to see what´s happening when you tried to entablish a connecting to that site.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-02-03T13:18:00.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26513" PostTypeId="1" AcceptedAnswerId="26629" CreationDate="2016-02-03T18:24:49.607" Score="4" ViewCount="821" Body="&lt;p&gt;I have an EZVPN running between two locations, Location A has a 5520 and is the EZVPN server, Location B has a 5506 and is a EZVPN client. Currently I'm trying to set NAT and ACL(s) so that hosts on the Location B inside network can access a few servers in Location A's DMZ. Below are my packet traces from both locations. Attached are sanitized configs from both locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*LocationA-Firewall# packet-tracer input inside tcp &amp;lt;Location B inside ip&amp;gt; 443 &amp;lt;Location A DMZ server ip&amp;gt; 443 detailed&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: input&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   &amp;lt;Location B inside ip&amp;gt;  255.255.255.0   outside&#xA;Phase: 2&#xA;Type: UN-NAT&#xA;Subtype: static&#xA;Result: ALLOW&#xA;Config:&#xA;nat (dmz,outside) source static DMZ_Servers DMZ_Servers destination static (location B)-remote_network (location B)-remote_network no-proxy-arp route-lookup&#xA;Additional Information:&#xA;NAT divert to egress interface outside&#xA;Untranslate &amp;lt;Location B inside ip&amp;gt;/443 to &amp;lt;Location B inside ip&amp;gt;/443&#xA;Phase: 3&#xA;Type: ACCESS-LIST&#xA;Subtype:&#xA;Result: DROP&#xA;Config:&#xA;Implicit Rule&#xA;Additional Information:&#xA; Forward Flow based lookup yields rule:&#xA; in  id=0x73cb5f60, priority=11, domain=permit, deny=true&#xA;      hits=343658, user_data=0x5, cs_id=0x0, use_real_addr, flags=0x0, protocol=0&#xA;      src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0&#xA;      dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0&#xA;      input_ifc=dmz, output_ifc=any&#xA;Result:&#xA;input-interface: dmz&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: outside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: drop&#xA;Drop-reason: (acl-drop) Flow is denied by configured rule*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;*&lt;/p&gt;&#xA;&#xA;&lt;p&gt;===========================================================&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LocationB-Firewall# packet-tracer input inside tcp &amp;lt;Location B inside ip&amp;gt; 443 &amp;lt;Location A DMZ server ip&amp;gt; 443&#xA;&#xA;Phase: 1&#xA;Type: ACCESS-LIST&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Implicit Rule&#xA;Additional Information:&#xA;MAC Access list&#xA;&#xA;Phase: 2&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: Resolve Egress Interface&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;found next-hop &amp;lt;internet next hop&amp;gt; using egress ifc  outside&#xA;&#xA;Phase: 3&#xA;Type: UN-NAT&#xA;Subtype: static&#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside,outside) source static Location_B_Networks Location_B_Networks destination static Remote_DMZ Remote_DMZ no-proxy-arp route-lookup&#xA;Additional Information:&#xA;NAT divert to egress interface outside&#xA;Untranslate &amp;lt;Location A DMZ server ip&amp;gt;/443 to &amp;lt;Location A DMZ server ip&amp;gt;/443&#xA;&#xA;Phase: 4&#xA;Type: ACCESS-LIST&#xA;Subtype: log&#xA;Result: ALLOW&#xA;Config:&#xA;access-group OWL_inside in interface inside&#xA;access-list OWL_inside extended permit ip any4 any4&#xA;Additional Information:&#xA;&#xA;Phase: 5&#xA;Type: NAT&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:      &#xA;nat (inside,outside) source static Location_B_Networks Location_B_Networks destination static Remote_DMZ Remote_DMZ no-proxy-arp route-lookup&#xA;Additional Information:&#xA;Static translate &amp;lt;Location B inside ip&amp;gt;/443 to &amp;lt;Location B inside ip&amp;gt;/443&#xA;&#xA;Phase: 6&#xA;Type: NAT&#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 7&#xA;Type: IP-OPTIONS&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 8&#xA;Type: ACCESS-LIST&#xA;Subtype: aaa-user&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 9&#xA;Type: NAT&#xA;Subtype: rpf-check&#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside,outside) source static Location_B_Networks Location_B_Networks destination static Remote_DMZ Remote_DMZ no-proxy-arp route-lookup&#xA;Additional Information:&#xA;&#xA;Phase: 10&#xA;Type: NAT&#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 11&#xA;Type: IP-OPTIONS&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 12&#xA;Type: FLOW-CREATION&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;New flow created with id 568767, packet dispatched to next module&#xA;&#xA;Result:&#xA;input-interface: inside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: outside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: allow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On those packet traces I'm testing HTTPS access since it's one of the ports I need open across the two zones. Since it looks like the problem with Location A's ASA, I've tried the following NAT and ACL additions (outside_access_in is the ACL applied to the outside interface, dmz_access_in is the ACL applied to the DMZ):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list dmz_access_in extended permit tcp object (location B)-remote_network object-group DMZ_Servers eq https&#xA;&#xA;nat (dmz,outside) source static DMZ_Servers DMZ_Servers destination static (location B)-remote_network (location B)-remote_network no-proxy-arp route-lookup&#xA;&#xA;access-list outside_access_in extended permit tcp object (location B)-remote_network object-group DMZ_Servers eq https&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;None of those worked. Besides those ACL entries I have no entries in my ACLs concerning traffic from Location B. ASP packet captures have not helped either. Sanitized configs for both locations are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    :&#xA;    ASA Version 9.5(2) &#xA;    !&#xA;    hostname LocationB-Firewall&#xA;    domain-name company.com&#xA;&#xA;    names&#xA;    !&#xA;    interface GigabitEthernet1/1&#xA;     nameif outside&#xA;     security-level 0&#xA;     ip address dhcp setroute &#xA;    !&#xA;    interface GigabitEthernet1/2&#xA;     nameif inside&#xA;     security-level 100&#xA;     ip address (location B inside) 255.255.255.0 &#xA;    !&#xA;    interface Management1/1&#xA;     management-only&#xA;     no nameif&#xA;     no security-level&#xA;     no ip address&#xA;    !&#xA;    boot system disk0:/asa952-lfbff-k8.SPA&#xA;    ftp mode passive&#xA;    dns server-group DefaultDNS&#xA;     domain-name oscarwinski.com&#xA;    object network obj_any&#xA;     subnet 0.0.0.0 0.0.0.0&#xA;    object-group network Location_A_Networks&#xA;     network-object (Location A network).0 255.255.255.0&#xA;&#xA;    object-group network Location_B_Networks&#xA;     network-object (Location B network).0 255.255.255.0&#xA;&#xA;    object-group network Remote_DMZ&#xA;     network-object host &amp;lt;Location A dmz server IP&amp;gt;&#xA;&#xA;&#xA;    access-list LocationB_inside extended permit ip any4 any4 &#xA;  access-list outside_access_in extended permit tcp host &amp;lt;internet IP&amp;gt; object-group Location_B_Networks eq https &#xA;&#xA;&#xA;    no pager&#xA;    logging console emergencies&#xA;    logging buffered debugging&#xA;    logging asdm informational&#xA;    mtu outside 1500&#xA;    mtu inside 1500&#xA;    icmp unreachable rate-limit 1 burst-size 1&#xA;    e&#xA;    arp timeout 14400&#xA;    no arp permit-nonconnected&#xA;    nat (inside,outside) source static Location_B_Networks Location_B_Networks destination static Location_A_Networks Location_A_Networks no-proxy-arp route-lookup&#xA;    nat (inside,outside) source static Location_B_Networks Location_B_Networks destination static Remote_DMZ Remote_DMZ no-proxy-arp route-lookup&#xA;&#xA;    !&#xA;    object network obj_any&#xA;     nat (any,outside) dynamic interface&#xA;&#xA;    access-group outside_access_in in interface outside&#xA;    access-group LocationB_inside in interface inside&#xA;&#xA;    timeout xlate 3:00:00&#xA;    timeout pat-xlate 0:00:30&#xA;    timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02&#xA;    timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;    timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;    timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;    timeout tcp-proxy-reassembly 0:01:00&#xA;    timeout floating-conn 0:00:00&#xA;    user-identity default-domain LOCAL&#xA;    aaa authentication ssh console LOCAL &#xA;    http server enable&#xA;    http 192.168.1.0 255.255.255.0 inside&#xA;    http 0.0.0.0 0.0.0.0 inside&#xA;    no snmp-server location&#xA;    no snmp-server contact&#xA;    service sw-reset-button&#xA;    crypto ipsec security-association pmtu-aging infinite&#xA;    crypto ca trustpool policy&#xA;    telnet timeout 5&#xA;    no ssh stricthostkeycheck&#xA;    ssh (Location A outside interface) 255.255.255.255 outside&#xA;    ssh 0.0.0.0 0.0.0.0 inside&#xA;    ssh timeout 5&#xA;    ssh key-exchange group dh-group1-sha1&#xA;    console timeout 0&#xA;    vpnclient server (outside interface)&#xA;    vpnclient mode network-extension-mode&#xA;    vpnclient nem-st-autoconnect&#xA;    vpnclient vpngroup vpn password *****&#xA;    vpnclient username ezvpn password *****&#xA;    vpnclient enable&#xA;&#xA;    !&#xA;    dhcpd address (location B network)-(location B network) inside&#xA;    dhcpd enable inside&#xA;    !&#xA;    threat-detection basic-threat&#xA;    threat-detection statistics access-list&#xA;    no threat-detection statistics tcp-intercept&#xA;&#xA;    dynamic-access-policy-record DfltAccessPolicy&#xA;&#xA;    !&#xA;    class-map inspection_default&#xA;     match default-inspection-traffic&#xA;    !&#xA;    !&#xA;    policy-map type inspect dns preset_dns_map&#xA;     parameters&#xA;      message-length maximum client auto&#xA;      message-length maximum 512&#xA;    policy-map global_policy&#xA;     class inspection_default&#xA;      inspect dns preset_dns_map &#xA;      inspect ftp &#xA;      inspect h323 h225 &#xA;      inspect h323 ras &#xA;      inspect rsh &#xA;      inspect rtsp &#xA;      inspect esmtp &#xA;      inspect sqlnet &#xA;      inspect skinny  &#xA;      inspect sunrpc &#xA;      inspect xdmcp &#xA;      inspect sip  &#xA;      inspect netbios &#xA;      inspect tftp &#xA;      inspect ip-options &#xA;      inspect pptp&#xA;    !&#xA;    service-policy global_policy global&#xA;    prompt hostname context &#xA;&#xA;    : end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Location A below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    ASA Version 9.1(3) &#xA;    !&#xA;    hostname LocationA-Firewall&#xA;    domain-name company.com&#xA;    interface GigabitEthernet0/0&#xA;     nameif outside&#xA;     security-level 0&#xA;     ip address (location A outside) 255.255.255.240 &#xA;    !&#xA;    interface GigabitEthernet0/1&#xA;     nameif inside&#xA;     security-level 100&#xA;     ip address (location A inside) 255.255.255.0 &#xA;    !&#xA;    !&#xA;    object network (location B)-remote_network&#xA;     subnet (location B) 255.255.255.0&#xA;    object-group network (Location A)_Networks&#xA;     network-object (Location A) 255.255.255.0&#xA;    object-group network DMZ_Servers&#xA;     network-object &amp;lt;DMZ servers IPs&amp;gt;&#xA;&#xA;    access-list ezvpn_split extended permit tcp object-group (Location A)_Networks object (location B)-remote_network &#xA;&#xA;&#xA;    nat (dmz,outside) source static DMZ_Servers DMZ_Servers destination static (location B)-remote_network (location B)-remote_network no-proxy-arp route-lookup&#xA;&#xA;    nat (inside,outside) source static (Location A)_Networks (Location A)_Networks destination static (location B)-remote_network (location B)-remote_network no-proxy-arp route-lookup&#xA;&#xA;&#xA;access-group outside_access_in in interface outside&#xA;access-group inside in interface inside&#xA;access-group dmz_access_in in interface dmz&#xA;    !&#xA;    crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac &#xA;    crypto ipsec ikev1 transform-set TRANS_ESP_3DES_SHA mode transport&#xA;    crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;    crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;    crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;    crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;    crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;    crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;    crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;    crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;    crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;    crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;    crypto ipsec ikev1 transform-set ESP-AES128-SHA esp-aes esp-sha-hmac &#xA;    crypto ipsec ikev1 transform-set aes256set esp-aes-256 esp-sha-hmac &#xA;    crypto ipsec security-association pmtu-aging infinite&#xA;    crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set TRANS_ESP_3DES_SHA&#xA;    crypto dynamic-map vpn_dyn_map 1 set ikev1 transform-set aes256set&#xA;    crypto dynamic-map vpn_dyn_map 1 set reverse-route&#xA;    crypto dynamic-map vpn_dyn_map 500 set ikev1 transform-set ESP-3DES-MD5&#xA;    crypto map VPN 65535 ipsec-isakmp dynamic vpn_dyn_map&#xA;    crypto map VPN interface outside&#xA;    crypto isakmp identity address &#xA;    crypto isakmp nat-traversal 10&#xA;    crypto ikev1 enable outside&#xA;    crypto ikev1 policy 5&#xA;     authentication pre-share&#xA;     encryption aes&#xA;     hash sha&#xA;     group 2&#xA;     lifetime 86400&#xA;    crypto ikev1 policy 10&#xA;     authentication pre-share&#xA;     encryption 3des&#xA;     hash sha&#xA;     group 2&#xA;     lifetime 86400&#xA;    crypto ikev1 policy 20&#xA;     authentication pre-share&#xA;     encryption 3des&#xA;     hash md5&#xA;     group 2&#xA;     lifetime 86400&#xA;    crypto ikev1 policy 90&#xA;     authentication pre-share&#xA;     encryption aes-256&#xA;     hash sha&#xA;     group 5&#xA;     lifetime 86400&#xA;    ssh 0.0.0.0 0.0.0.0 inside&#xA;    management-access inside&#xA;    no vpn-addr-assign aaa&#xA;    no vpn-addr-assign dhcp&#xA;    group-policy DfltGrpPolicy attributes&#xA;     vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless&#xA;    !username ezvpn password &amp;lt;removed&amp;gt;&#xA;     vpn-group-policy DefaultRAGroup&#xA;    tunnel-group DefaultL2LGroup ipsec-attributes&#xA;     ikev1 pre-shared-key &amp;lt;removed&amp;gt;&#xA;    tunnel-group DefaultRAGroup ppp-attributes&#xA;     no authentication chap&#xA;     authentication ms-chap-v2&#xA;    tunnel-group ezvpn type remote-access&#xA;    tunnel-group ezvpn general-attributes&#xA;     default-group-policy ezvpnpolicy&#xA;    tunnel-group ezvpn ipsec-attributes&#xA;     ikev1 pre-shared-key &amp;lt;removed&amp;gt;&#xA;    tunnel-group (location A outside) type ipsec-l2l&#xA;    tunnel-group (location A outside) ipsec-attributes&#xA;     ikev1 pre-shared-key &amp;lt;removed&amp;gt;&#xA;    !&#xA;    class-map preset_dns_map&#xA;    class-map global-class&#xA;     match access-list global_mpc&#xA;    class-map apple_class&#xA;     match access-list dmz_access_in&#xA;    class-map inspection_default&#xA;     match default-inspection-traffic&#xA;    !&#xA;    policy-map type inspect dns preset_dns_map&#xA;     parameters&#xA;      message-length maximum 512&#xA;    policy-map type inspect http apple_map&#xA;     parameters&#xA;     match not request header host regex apple_domain&#xA;    policy-map global_policy&#xA;     description Internet_Netflow&#xA;     class inspection_default&#xA;      inspect dns preset_dns_map &#xA;      inspect ftp &#xA;      inspect h323 h225 &#xA;      inspect h323 ras &#xA;      inspect netbios &#xA;      inspect rsh &#xA;      inspect skinny  &#xA;      inspect sqlnet &#xA;      inspect sunrpc &#xA;      inspect tftp &#xA;      inspect xdmcp &#xA;      inspect http &#xA;      inspect icmp &#xA;      inspect rtsp &#xA;      inspect sip  &#xA;     class global-class&#xA;      flow-export event-type all destination 10.1.1.25&#xA;     class apple_class&#xA;      inspect http apple_map &#xA;    !&#xA;    service-policy global_policy global&#xA;    prompt hostname context &#xA;    : end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; Here's what I see in my logging after running packet traces in both directions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Location A&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb  4 10:05:08 10.255.1.1 %ASA-5-111008: User 'enable_15' executed the 'packet-tracer input dmz tcp &amp;lt;DMZ Server IP&amp;gt; 443 &amp;lt;Location B Inside IP&amp;gt; 443' command.&#xA;Feb  4 10:05:08 10.255.1.1 %ASA-5-111010: User 'enable_15', running 'CLI' from IP x.x.x.x, executed 'packet-tracer input dmz tcp &amp;lt;DMZ Server IP&amp;gt; 443 &amp;lt;Location B Inside IP&amp;gt; 443'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Location B&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb  4 08:50:30 &amp;lt;Location B Inside IP&amp;gt; %ASA-5-111008: User 'enable_15' executed the 'packet-tracer input inside tcp &amp;lt;Location B Inside IP&amp;gt; 443 &amp;lt;DMZ Server IP&amp;gt; 443' command.&#xA;Feb  4 08:50:30 &amp;lt;Location B Inside IP&amp;gt; %ASA-5-111010: User 'enable_15', running 'CLI' from IP x.x.x.x, executed 'packet-tracer input inside tcp &amp;lt;Location B Inside IP&amp;gt; 443 &amp;lt;DMZ Server IP&amp;gt; 443'&#xA;Feb  4 08:51:15 &amp;lt;Location B Inside IP&amp;gt; %ASA-7-609001: Built local-host outside:&amp;lt;DMZ Server IP&amp;gt;&#xA;Feb  4 08:51:15 &amp;lt;Location B Inside IP&amp;gt; %ASA-6-302013: Built outbound TCP connection 936480 for outside:&amp;lt;DMZ Server IP&amp;gt;/443 (&amp;lt;DMZ Server IP&amp;gt;/443) to inside:&amp;lt;Location B Inside IP&amp;gt;45/50378 (&amp;lt;Location B Inside IP&amp;gt;45/50378)&#xA;Feb  4 08:51:45 &amp;lt;Location B Inside IP&amp;gt; %ASA-6-302014: Teardown TCP connection 936480 for outside:&amp;lt;DMZ Server IP&amp;gt;/443 to inside:&amp;lt;Location B Inside IP&amp;gt;45/50378 duration 0:00:30 bytes 0 SYN Timeout&#xA;Feb  4 08:51:45 &amp;lt;Location B Inside IP&amp;gt; %ASA-7-609002: Teardown local-host outside:&amp;lt;DMZ Server IP&amp;gt; duration 0:00:30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both locations have the following logging options turned on:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging enable&#xA;logging timestamp&#xA;logging standby&#xA;logging buffer-size 1048576&#xA;logging console emergencies&#xA;logging monitor debugging&#xA;logging buffered debugging&#xA;logging trap debugging&#xA;logging asdm notifications&#xA;logging facility 23&#xA;logging host inside &amp;lt;syslog server IP&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also thought possibly adding the dmz network I wanted to get in into the split tunnel list on the EZVPN would work, it did not:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list ezvpn_split extended permit tcp object-group DMZ_Servers object (location B)-remote_network &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Added ACL statements to both configs&lt;/p&gt;&#xA;" OwnerUserId="19266" LastEditorUserId="19266" LastEditDate="2016-02-04T19:41:18.220" LastActivityDate="2016-08-06T18:43:52.970" Title="Cisco ASA NAT/ACL issues across EZVPN" Tags="|cisco-asa|vpn|nat|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26515" PostTypeId="2" ParentId="26406" CreationDate="2016-02-03T19:00:12.787" Score="1" Body="&lt;p&gt;ID was replaced with an &quot;observation domain&quot;, which is essentially the same thing, a unique 32-bit number indicating the source of the export.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the templates from one source are not necessarily the same as templates from another -- even in the same device -- and therefore the data records may be formatted differently.   You will know this is going wrong when the data seems way out of whack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be running into a configuration issue, here is some additional background into configuring flexible NetFlow:  &lt;a href=&quot;http://www.flowtraq.com/corporate/blog/tech-thoughts/configuring-flexible-netflow-export-cisco-routers/&quot; rel=&quot;nofollow&quot;&gt;http://www.flowtraq.com/corporate/blog/tech-thoughts/configuring-flexible-netflow-export-cisco-routers/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="21950" LastActivityDate="2016-02-03T19:00:12.787" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26516" PostTypeId="2" ParentId="22244" CreationDate="2016-02-03T19:46:37.093" Score="1" Body="&lt;p&gt;Using no auto-summary in all the three routers have solved the issue.&lt;/p&gt;&#xA;" OwnerUserId="22586" LastActivityDate="2016-02-03T19:46:37.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26519" PostTypeId="1" CreationDate="2016-02-03T20:49:18.623" Score="2" ViewCount="665" Body="&lt;p&gt;I need help from someone who already tried to convert a lightweight Cisco Aironet 1700 AP to an autonomous AP. I tried to do that, but I couldn't access it, even with the console port&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to telnet to it, but Cisco requires a password to be reset before we can telnet to the device. I tried the console cable, but it kept giving me a blank page.&lt;/p&gt;&#xA;" OwnerUserId="22481" LastEditorUserId="8499" LastEditDate="2016-02-03T21:28:24.253" LastActivityDate="2016-10-03T17:21:23.493" Title="Converting Lightweight AP to Autonomous AP" Tags="|cisco|wireless|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26521" PostTypeId="2" ParentId="26519" CreationDate="2016-02-04T00:45:32.580" Score="1" Body="&lt;p&gt;Use the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/access_point/15_2_4_JB/configuration/guide/scg15-2-4-Book/scg15-2-4-chap4-first.html#96723&quot; rel=&quot;nofollow&quot;&gt;mode button&lt;/a&gt; to reset it to factory defaults&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-04T00:45:32.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26522" PostTypeId="1" CreationDate="2016-02-04T09:16:01.497" Score="4" ViewCount="111" Body="&lt;p&gt;I have the following config. set up for an MPLS network on my CISCO 878:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Current configuration : 941 bytes&#xA;!&#xA;version 12.4&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname MyHost&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;resource policy&#xA;!&#xA;ip subnet-zero&#xA;ip cef&#xA;!&#xA;!&#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;controller DSL 0&#xA; mode atm &#xA; line-term cpe&#xA; line-mode 2-wire line-zero&#xA; dsl-mode shdsl symmetric annex B&#xA; line-rate auto&#xA;!         &#xA;!         &#xA;!         &#xA;!         &#xA;interface BRI0&#xA; no ip address&#xA; encapsulation hdlc&#xA; shutdown &#xA;!         &#xA;interface ATM0&#xA; ip address 10.120.240.152 255.255.255.252&#xA; no atm ilmi-keepalive&#xA; pvc 0/95 &#xA;  cbr 2048&#xA; !        &#xA;!         &#xA;interface FastEthernet0&#xA;!         &#xA;interface FastEthernet1&#xA;!         &#xA;interface FastEthernet2&#xA;!         &#xA;interface FastEthernet3&#xA;!         &#xA;interface Vlan1&#xA; ip address 10.22.33.1 255.255.255.0&#xA;!         &#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 10.120.240.151&#xA;!         &#xA;no ip http server&#xA;no ip http secure-server&#xA;!         &#xA;!         &#xA;control-plane&#xA;!         &#xA;!         &#xA;line con 0&#xA; no modem enable&#xA;line aux 0&#xA;line vty 0 4&#xA; login    &#xA;!         &#xA;scheduler max-task-time 5000&#xA;end &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, the only problem that I had setting those parameters was PVC.&#xA;I'm supposed to set:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; pvc 42/95&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it doesn't accept!&#xA;Please have a look at this configuration to see where I have gone wrong.&#xA;When I use the help, it says VPI can't be more than 35.&#xA;I used &lt;code&gt;pvc 0/95&lt;/code&gt;, but it doesn't work when I install the router.&lt;/p&gt;&#xA;" OwnerUserId="22547" LastActivityDate="2020-04-10T04:50:58.147" Title="PVC not Accepted by CISCO 878" Tags="|cisco|router|mpls|atm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26523" PostTypeId="2" ParentId="26519" CreationDate="2016-02-04T09:24:54.820" Score="2" Body="&lt;p&gt;Did you download the autonomous IOS to the AP via TFTP? This will have to be done first to get the correct software onto the AP. Look for the &quot;w8&quot; think &quot;light'w8'&quot; in the file name. More info here: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/controller/8-0/configuration-guide/b_cg80/b_cg80_chapter_01101010.html#ID1136&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/wireless/controller/8-0/configuration-guide/b_cg80/b_cg80_chapter_01101010.html#ID1136&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22455" LastActivityDate="2016-02-04T09:24:54.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26525" PostTypeId="1" AcceptedAnswerId="26702" CreationDate="2016-02-04T10:34:00.707" Score="3" ViewCount="415" Body="&lt;p&gt;I have Cisco 1921 working as L2TP server without IPsec configured as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;aaa authentication ppp default local&#xA;aaa authorization network default local &#xA;!&#xA;username User1 password 7 ***&#xA;username User2 password 7 ***&#xA;username User3 password 7 ***&#xA;username User4 password 7 ***&#xA;!&#xA;vpdn-group L2TP&#xA; accept-dialin&#xA;  protocol l2tp&#xA;  virtual-template 10&#xA; lcp renegotiation on-mismatch&#xA; no l2tp tunnel authentication&#xA; ip pmtu&#xA; ip mtu adjust&#xA;!&#xA;interface Virtual-Template10&#xA; ip unnumbered GigabitEthernet0/0.20&#xA; ip nat enable&#xA; peer default ip address pool L2TP-POOL&#xA; ppp encrypt mppe auto&#xA; ppp authentication ms-chap ms-chap-v2&#xA;!&#xA;ip local pool L2TP-POOL 172.16.28.1 172.16.28.30&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;L2TP clients work though unstable 3G connection and often loses connection. After reconnecting they often get assigned with different IP address from pool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to configure server to assign same IP addresses to each username every time?&lt;/p&gt;&#xA;" OwnerUserId="21038" LastEditorUserId="8499" LastEditDate="2018-03-19T17:40:35.940" LastActivityDate="2018-03-19T17:40:35.940" Title="Cisco 1921 VPN Clients IP address assignment" Tags="|cisco|vpn|ip-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26526" PostTypeId="1" CreationDate="2016-02-04T10:44:40.383" Score="0" ViewCount="513" Body="&lt;p&gt;Two different workstations are connected with straight through cable. Attempts to ping between hosts are unsuccessful.what should be done to make them communicate?&lt;/p&gt;&#xA;" OwnerUserId="22600" LastEditorUserId="8499" LastEditDate="2018-12-21T04:06:42.763" LastActivityDate="2018-12-21T04:06:42.763" Title="how to make two workstations communicate using straight through cable" Tags="|ethernet|layer1|cable|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26528" PostTypeId="2" ParentId="26526" CreationDate="2016-02-04T11:34:53.167" Score="3" Body="&lt;p&gt;Most computers support auto mdi-x which means that they will work with both crossover and straight-through cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To ping between the 2 PCs, you need to check the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;NIC link lights, are they both up?&lt;/li&gt;&#xA;&lt;li&gt;Are both computers assigned an IP on the same subnet? You don't have a dhcp server so you will need to either assign a static IP or use a link local address.&lt;/li&gt;&#xA;&lt;li&gt;Is there a firewall restricting ICMP packets? Windows 7 blocks incoming ICMP by default.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20964" LastActivityDate="2016-02-04T11:34:53.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26534" PostTypeId="1" AcceptedAnswerId="26618" CreationDate="2016-02-04T15:55:23.260" Score="1" ViewCount="5540" Body="&lt;p&gt;I have inherited a network using a mix of SSG140s, 350M and 550M. Each of them is configured with a Trust, Untrust and VPN VR with multiple custom zones on each (we don't use the default zones).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Zone: ISP Link]--(Untrust-VR)--(Trust-VR)--[Zone: Routed: Internal A]&#xA;                                          \&#xA;                                           -[Zone: NAT: Internal B]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am struggling to understand the difference functional difference between how some of the zone are configured. We have two flavours:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Zones with Interface Type Route and policy based NAT applied.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The policy is configured to use the egress IP (no DIP)&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Zones with Interface Type NAT, which just standard policies applied.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;With an Interface in a Zone attached to the Trust-VR set to NAT, I can see from the logs that, NAT is not applied on traffic going to other Zones attached to the same Trust-VR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As background I specifically ask because we had an issue with RTMP (TCP media streaming) over a zone configured with Policy based nat. It looked like it should work, the traffic logs shows the NAT being translated correctly but the TCP handshake never completed and no packets came back. I moved the source of the stream to a Zone with is configured with a NAT interface and it worked, the translation looked the same from the logs. This issue was specifically seen on an ssg140.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum up:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is the difference between Policy NAT with no DIP and Interface based NAT?&lt;/li&gt;&#xA;&lt;li&gt;Can I configure all Zones/Interfaces connected to the Trust-VR as NAT and not lose any functionality? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13290" LastEditorUserId="13290" LastEditDate="2016-02-06T08:50:33.073" LastActivityDate="2016-02-07T22:11:12.697" Title="Interface NAT vs Policy based NAT on Juniper SSG ScreenOS" Tags="|nat|juniper|screenos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26535" PostTypeId="2" ParentId="13465" CreationDate="2016-02-04T16:21:42.737" Score="0" Body="&lt;p&gt;Router A is not advertising that route to Router B. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Multipath: eBGP&#xA; Not advertised to any peer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router B is advertising that route to router A. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Multipath: eBGP&#xA;Advertised to update-groups:&#xA; 15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configure A to advertise 1.0.0.0 to B via ibgp. &lt;/p&gt;&#xA;" OwnerUserId="22609" LastActivityDate="2016-02-04T16:21:42.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26537" PostTypeId="1" AcceptedAnswerId="26545" CreationDate="2016-02-04T18:53:00.097" Score="9" ViewCount="3221" Body="&lt;p&gt;I know that MAC addresses are used in networks for several things, e.g. static fixed IP addresses assigned by DHCP servers or for Wireless access points. But why is it necessary in the Internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I send a packet to someone not on my local network, e.g. &lt;code&gt;www.example.com&lt;/code&gt; using a &lt;code&gt;ICMP echo&lt;/code&gt; signal. The &lt;code&gt;ICMP echo&lt;/code&gt; doesn't contain any application layer or transport layer. DNS will find out that the IP address of &lt;code&gt;www.example.com&lt;/code&gt; is &lt;code&gt;93.184.216.34&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, but how does it find out it's MAC address needed for &lt;code&gt;802.11&lt;/code&gt; data link layer? No machine on my local network knows it. Why is it even necessary to add the MAC address? The IP address will already uniquely identify it, won't it? And how do routers look up the IP address, if it is hidden beneath the data link layer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I learned that the &lt;code&gt;802.11&lt;/code&gt; header as well as the &lt;code&gt;802.3&lt;/code&gt; header contains a field for Destination MAC addresses. I know that my machine contains an ARP table which contains the MAC address of my router. But what MAC address will be written inside that field between my router and the destination router?&lt;/p&gt;&#xA;" OwnerUserId="22614" LastEditorUserId="22648" LastEditDate="2016-02-05T14:36:09.167" LastActivityDate="2016-02-05T14:36:09.167" Title="What use are MAC addresses?" Tags="|routing|ip|mac-address|" AnswerCount="4" CommentCount="9" ClosedDate="2016-02-05T16:51:46.453" ContentLicense="CC BY-SA 3.0" />
  <row Id="26538" PostTypeId="2" ParentId="26537" CreationDate="2016-02-04T19:04:13.167" Score="7" Body="&lt;p&gt;MAC addresses are layer 2 addresses.  They are used to address devices at the hardware level. Ethernet, for example, is a layer 2 protocol, and it uses MAC addresses to send data to devices.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, you need to address physical devices on the Internet.  That's where layer 2 addresses (MAC addresses) come into play.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-04T19:04:13.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26539" PostTypeId="2" ParentId="26537" CreationDate="2016-02-04T19:21:44.470" Score="3" Body="&lt;p&gt;I think the @Ron Trunk´s answer it is great for you, and, for your notation, everytime that a packet arrives to a router and is routing by some interfaces, in that moment, the source mac address field change by the owner mac address of that port, allowing fast connectivity by l2. In fact, on the moment that the packet arrives to it destination, it comes with the source mac address of the gateway of the destination network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can look in a easy and safe way that whe are talking about if you simulate with packet tracert, gns3,... and capture the traffic and compare the mac address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mac address are for l2 connectivity like ip address are for l3 connectivity&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-02-04T19:21:44.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26540" PostTypeId="1" CreationDate="2016-02-04T19:24:34.053" Score="2" ViewCount="1124" Body="&lt;p&gt;I have a 4-switch stack of Alcatel Omniswitches connected to an HP 5412 core via 8 uplinks; these are ports D11-D18. Unfortunately, the client did not yet give me access to the Alcatels, but a request has been sent out. Meanwhile, I am seeing a high amount of TX/RX traffic on several ports in IMC regarding the core. An example:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/WGwPB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WGwPB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In past experience, this is generally indicative of a loop of some sort. (Note: This is a school, and students have been known to intentionally plug in an Ethernet cord from one wall to another. We have plans to re-mediate this, believe me.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup is rather simplistic in that there are a total of 324 Cisco WAPs, each connected to one of the four switches in the Alcatel stack with a 1 Gbit uplink. Now, on the core, when I run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show lldp info remote-devices D11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(for each port. I did it one by one instead of a range to specify).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each port from D11-D17 shows the MAC address of the Alcatel stack as well as the port to which it is connected in a fashing like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PortId       : 2024 // Switch #2 port 24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so on. On port D18, however, the last port in the LAG, I see every single WAP. This is the case with both CDP and LLDP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/etQCM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/etQCM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this normal behavior?&lt;/p&gt;&#xA;" OwnerUserId="3836" LastEditorUserId="3836" LastEditDate="2016-02-04T22:11:34.873" LastActivityDate="2016-02-06T11:45:27.003" Title="CDP/LLDP over LACP Trunk Several Devices" Tags="|ieee-802.1ax|cdp|lldp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26541" PostTypeId="1" CreationDate="2016-02-04T20:12:25.863" Score="17" ViewCount="103839" Body="&lt;p&gt;I have here a dilemma. I have a device that communicates to another remote device but there is a firewall between them. It's a UDP connection, so TCP utilities don't work to test if the specific port is open. I know that we could get that from the firewall but I don't have access so I have to prove that the port is not open.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source system is a Windows 7 system and the destination system is a appliance running Linux.&lt;/p&gt;&#xA;" OwnerUserId="22121" LastEditorUserId="3024" LastEditDate="2018-06-13T01:37:50.427" LastActivityDate="2019-12-19T17:55:32.450" Title="How to verify that a UDP port is open?" Tags="|security|troubleshooting|udp|" AnswerCount="3" CommentCount="6" ClosedDate="2018-01-31T15:05:05.600" ContentLicense="CC BY-SA 4.0" />
  <row Id="26542" PostTypeId="2" ParentId="26541" CreationDate="2016-02-04T22:11:04.583" Score="13" Body="&lt;p&gt;UDP is obviously a &lt;a href=&quot;https://en.wikipedia.org/wiki/Connectionless_communication&quot; rel=&quot;nofollow noreferrer&quot;&gt;send-and-forget protocol.&lt;/a&gt; For example, during an NMap UDP scan, the only way to definitively prove that a UDP port is open is if you receive a response from that port. Keep in mind that many services may not reply to arbitrary data and require protocol or application-specific requests in order to warrant a response. Certain ICMP codes can guarantee that the port is closed, however. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc792&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 792&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1122&lt;/a&gt; give us some good information as to what to expect when a port is closed.&lt;/p&gt;&#xA;&lt;p&gt;For example, an ICMP type 3 code 3 &amp;quot;Destination Port Unreachable&amp;quot; is, for all intents and purposes, almost guaranteed to be a closed port.&lt;/p&gt;&#xA;&lt;p&gt;A full list of codes can be found here:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.iana.org/assignments/icmp-parameters/icmp-parameters.xhtml&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3836" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2019-12-19T17:55:32.450" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="26543" PostTypeId="1" CreationDate="2016-02-04T22:52:45.063" Score="1" ViewCount="111" Body="&lt;p&gt;there are some techniques used into Wireless network on chip, Ultra Wide Band Interconnect is one, I have to ask the benefit of low duty cycle pulse?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the target of communication is to maximise the duty cycle not to minimise!!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, in some papers, i found that: Ultra-Wideband interconnect (UWB-I) has the unique features of high bandwidth and low-duty cycle pulse, which make it an attractive solution for high data rate multi-processor. Any explanation pls?&lt;/p&gt;&#xA;" OwnerUserId="22617" LastActivityDate="2017-06-20T06:07:06.017" Title="What is the benefit of using a technique with low duty cycle?" Tags="|wireless|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26544" PostTypeId="2" ParentId="26537" CreationDate="2016-02-05T00:41:14.267" Score="5" Body="&lt;p&gt;Like an IP address is used at the IP level (layer 3), a MAC address is used at the MAC level (layer 2), i.e. Ethernet, Wi-Fi, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you send a packet to a host, your computer does the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;It checks if the host is on one of the directly connected networks (your local LAN, in general).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If it is, it uses ARP to map the IP to a MAC address (either via the ARP cache, or by broadcasting an ARP request on the network). This way, it'll find the destination MAC address to put in the frame.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If it isn't, it'll use the routing table to find where to send the packet (usually your default gateway, i.e. your router). Likewise, it'll use ARP to find the MAC address of said gateway (in most cases this will be in cache). It'll then use this as the destination MAC address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The source MAC address will be that of your computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the packet is delivered to a host on your local network, that's the end of the story. If it's delivered to a router, then the process starts again, with new source and destination MAC addresses on each &quot;hop&quot; that requires any (point-to-point links don't, obviously).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC addresses are needed for Layer 2 switches to be able to correctly forward frames to the right ports without having to know anything about Layer 3 (IP) addresses or anything like that. This is what makes switches designed decades ago able to correctly forward IPv6 frames, or any other Layer 3 protocol you might come up with, as long as it's correctly framed with appropriate MAC addresses.&lt;/p&gt;&#xA;" OwnerUserId="6363" LastActivityDate="2016-02-05T00:41:14.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26545" PostTypeId="2" ParentId="26537" CreationDate="2016-02-05T01:43:31.837" Score="13" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Well, but how does it find out it's [www.example.com's] MAC address needed for 802.11 data link layer? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your computer doesn't, nor does it need to do so. Since the MAC address is only used within the same L2 network, when you are sending traffic to a different L3 network, all it needs to know is that www.example.com is on a different L3 network and how to get to that L3 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally this is the default gateway for most devices, and as you point out, your computer already has the information for your router in your ARP table. The router will adjust the L2 information before it passes the traffic on to the next L3 device.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is it even necessary to add the MAC address? The IP address will already uniquely identify it, won't it? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, IP address are not necessarily unique. They must be unique on the local network, but they can be re-used. This is one of the reasons that NAT exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further, Ethernet is only one L2 protocol. IP is designed to work without concern for the underlying protocol, so you could replace Ethernet with something else (like Token Ring or Frame Relay) or you could create your own L2 protocol if you wanted. IP wouldn't care or be bothered by the change.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And how do routers look up the IP adress, if it is hidden beneath the data link layer? I don't really get it...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The L3 header is not &quot;hidden&quot; by the L2 header. The L2 header doesn't change the content that becomes the L2 payload, it is simply pre-pended or added before the L3 header. Many devices will strip off the L2 header before L3 processing, but even if this isn't always the case it doesn't obscure the meaning of the rest of the message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think of it this way, let's say I send you a message that said, &quot;How are you today?&quot; This passes through a translator who changes it to, &quot;Hello, how are you today?&quot; Can you still understand my original message even though a new &quot;header&quot; was added to it? And that additional header may be removed before final delivery to you.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But what MAC address will be written inside that field between my router and the destination router?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When your router sends the traffic to the next router (assuming they are using Ethernet), it will use the MAC address of it's interface as the source MAC address and the MAC address of the next router's interface as the destination address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are probably dozens of questions on this site that focus on different aspects of these questions. Please feel free to use the search function to find them. Here are a few to get you started:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/q/23351/33&quot;&gt;How are MAC/IP addresses used in routing&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/q/3329/33&quot;&gt;Reason for both a MAC and an IP address&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/q/24803/33&quot;&gt;IP Address vs MAC Address, how does that really work together illustration&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/q/9571/33&quot;&gt;Why use IP if we already have a MAC address?&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And since you touched on 802.11:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/q/25100/33&quot;&gt;Four layer-2 addresses in 802.11 frame header&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-02-05T01:43:31.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26548" PostTypeId="1" CreationDate="2016-02-05T07:52:18.573" Score="1" ViewCount="29" Body="&lt;p&gt;I have configured one MLPPP bundle with 6 E1`s. One of them getting utilize more than 80% while other one are just only 5 or 10 % utilize. How can i overcome from such issue. &lt;/p&gt;&#xA;" OwnerUserId="22635" LastActivityDate="2016-02-07T00:25:36.320" Title="MLPPP_Bundle_load sharing" Tags="|troubleshooting|" AnswerCount="1" CommentCount="4" ClosedDate="2019-03-26T23:08:38.197" ContentLicense="CC BY-SA 3.0" />
  <row Id="26551" PostTypeId="1" AcceptedAnswerId="26558" CreationDate="2016-02-05T13:09:17.543" Score="2" ViewCount="5973" Body="&lt;p&gt;I'm working on a program to discover all computer on a network.&#xA;What is the best way to do that&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network is 192.168.1.0&#xA;There are few machines on this network and i want to know their ips&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should i have to answer my Arp table of my computer or ping all the machines for responses one by one, or a broadcast maybe ?&lt;/p&gt;&#xA;" OwnerUserId="22641" LastActivityDate="2016-02-05T16:48:11.187" Title="Scan all ip address on a network ARP/Ping" Tags="|arp|ping|broadcast|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26554" PostTypeId="2" ParentId="26551" CreationDate="2016-02-05T13:57:38.937" Score="0" Body="&lt;p&gt;I could be wrong, but it seems in your case pinging 192.168.1.255 and checking  ARP table afterwards would show you the hosts. If your task is to discover pingable hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yeah, I forgot the IPv6...&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-02-05T13:57:38.937" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26556" PostTypeId="1" CreationDate="2016-02-05T14:26:29.100" Score="2" ViewCount="2487" Body="&lt;p&gt;I have two internet links coming to my Mikrotik router. I want to push the certain type of traffic from one internet line and rest from the other.&#xA;for e.g. I have the broadband line from which I wish to push the youtube and shopping website traffic whereas the rest of the traffic should go through the other internet leased line link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What possible configuration should be done in the Mikrotik router to do this? (It is load balancing but of a different type)&lt;/p&gt;&#xA;" OwnerUserId="22649" LastEditorUserId="8499" LastEditDate="2018-02-14T16:25:03.017" LastActivityDate="2018-02-14T16:25:03.017" Title="How to connect to use two internet connections on Mikrotik Router?" Tags="|internet|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-09T23:46:38.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="26558" PostTypeId="2" ParentId="26551" CreationDate="2016-02-05T16:48:11.187" Score="3" Body="&lt;p&gt;Since you have control of the network, (you do have admin control of the network gear; otherwise your Q is off-topic here), just look at the ARP caches on the switch(es) and router(s). Any system that is actively using the network will be known to your network gear, even if it wanted to &quot;hide&quot; from discovery/probing from other workstations/systems/programs.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2016-02-05T16:48:11.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26559" PostTypeId="2" ParentId="17935" CreationDate="2016-02-05T16:57:24.360" Score="0" Body="&lt;p&gt;A LCC is a Chassis that places the Line Cards (MSC, FP), PLIM's, etc. A FCC is the one where the whole Fabric Cards are installed (FC). There's a nice explanation regarding Multi-Chass on following blog-post:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ccie49534.com/2015/11/05/cisco-crs-multi-chassis/&quot; rel=&quot;nofollow&quot;&gt;http://ccie49534.com/2015/11/05/cisco-crs-multi-chassis/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22654" LastActivityDate="2016-02-05T16:57:24.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26560" PostTypeId="1" AcceptedAnswerId="26562" CreationDate="2016-02-05T19:00:42.370" Score="2" ViewCount="378" Body="&lt;p&gt;Is there a work-around to apply an ACL to packet originated by the router itself? How do I block certain packets not forwarded but sent by the router matching the ACL? I do not want to solve this issue by configuring ICMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, three routers, connected by R02.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R0001#sh ip int Fa0/0 | inc Internet&#xA;  Internet address is 10.0.1.1/30&#xA;R0001#&#xA;&#xA;&#xA;R0002#sh ip int Fa0/0 | inc Internet&#xA;  Internet address is 10.0.1.2/30&#xA;R0002#&#xA;R0002#sh ip int Fa0/0 | inc access list&#xA;  Outgoing access list is ipv4_out&#xA;  Inbound  access list is ipv4_in&#xA;R0002#&#xA;R0002#&#xA;R0002#show ip int Fa0/1 | inc Internet&#xA;  Internet address is 10.0.2.1/30&#xA;R0002#&#xA;R0002#sh ip int Fa0/0 | inc access list&#xA;  Outgoing access list is ipv4_out&#xA;  Inbound  access list is ipv4_in&#xA;R0002#&#xA;&#xA;&#xA;R0003#sh ip int Fa0/1 | inc Internet&#xA;  Internet address is 10.0.2.2/30&#xA;R0003#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One ICMP Echo sent from R0001 to R0002:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R0001#ping 10.0.2.2 repeat 1&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 1, 100-byte ICMP Echos to 10.0.2.2, timeout is 2 seconds:&#xA;.&#xA;Success rate is 0 percent (0/1)&#xA;R0001#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R0002 informs R0003 that its Echo Reply has been blocked:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R0003#&#xA;02:41:48: ICMP: echo reply sent, src 10.0.2.2, dst 10.0.1.1&#xA;02:41:48: ICMP: dst (10.0.2.2) administratively prohibited unreachable rcv from 10.0.2.1&#xA;R0003#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ICMP Echo did match the related rule. The Echo Reply did not match a rule of &lt;strong&gt;ipv4_out&lt;/strong&gt; ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R0002#show ip access-list ipv4_in &#xA;Extended IP access list ipv4_in&#xA;    200 deny icmp 10.0.2.0 0.0.0.3 10.0.1.0 0.0.0.3 echo-reply (3 matches)&#xA;    998 permit ip any any (1 match)&#xA;    999 deny ip any any&#xA;R0002#&#xA;R0002#show ip access-list ipv4_out&#xA;Extended IP access list ipv4_out&#xA;    200 deny icmp host 10.0.2.1 10.0.2.0 0.0.0.3&#xA;    998 permit ip any any (1 match)&#xA;    999 deny ip any any&#xA;R0002#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Even if I try another approach, there is still no match:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R0001#ping 10.0.2.2 repeat 1&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 1, 100-byte ICMP Echos to 10.0.2.2, timeout is 2 seconds:&#xA;.&#xA;Success rate is 0 percent (0/1)&#xA;R0001#&#xA;&#xA;&#xA;R0003#&#xA;02:56:15: ICMP: echo reply sent, src 10.0.2.2, dst 10.0.1.1&#xA;02:56:15: ICMP: dst (10.0.2.2) administratively prohibited unreachable rcv from 10.0.2.1&#xA;R0003#&#xA;&#xA;&#xA;R0002#show ip access-list ipv4_in &#xA;Extended IP access list ipv4_in&#xA;    998 permit ip any any (2 matches)&#xA;    999 deny ip any any&#xA;R0002#&#xA;R0002#&#xA;R0002#show ip access-list ipv4_out&#xA;Extended IP access list ipv4_out&#xA;    200 deny icmp host 10.0.2.1 10.0.2.0 0.0.0.3&#xA;    201 deny icmp host 10.0.2.2 10.0.1.0 0.0.0.3 (2 matches)&#xA;    998 permit ip any any (1 match)&#xA;    999 deny ip any any&#xA;R0002#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;SOLUTION:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the configuration as inspired by &lt;strong&gt;Everton&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended No_response_IPv4&#xA; permit icmp host 10.0.2.1 10.0.2.0 0.0.0.3&#xA; deny   ip any any&#xA;&#xA;route-map No_response permit 10&#xA; match ip address No_response_IPv4&#xA; set interface Null0&#xA;&#xA;ip local policy route-map No_response&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This prevents R0002 from informing R0003 about having blocked its Echo Reply. Otherwise, R0003 would log this message: &lt;code&gt;ICMP: dst (10.0.2.2) administratively prohibited unreachable rcv from 10.0.2.1&lt;/code&gt;. But by use of PBR, R0002 will silently discard an Echo Reply received from R0003. R0002 blocks an incoming Echo Reply from R0003 because R0002's interface has an ACL with &lt;code&gt;deny icmp host 10.0.2.1 10.0.2.0 0.0.0.3&lt;/code&gt; as a rule.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="3163" LastEditDate="2016-02-06T18:55:17.633" LastActivityDate="2016-02-07T21:21:35.867" Title="Cisco IOS: ACL on local interface" Tags="|acl|cisco-ios-12|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26562" PostTypeId="2" ParentId="26560" CreationDate="2016-02-05T19:45:44.170" Score="1" Body="&lt;p&gt;Try applying policy-based routing (PBR) to local traffic:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended DROP&#xA; permit icmp host 10.0.2.1 10.0.2.0 0.0.0.3&#xA;&#xA;route-map LOCAL_DROP permit 10&#xA; match ip address DROP&#xA; set interface null0&#xA;&#xA;ip local policy route-map LOCAL_DROP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See also &quot;Local PBR&quot;: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-02-07T21:21:35.867" LastActivityDate="2016-02-07T21:21:35.867" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26563" PostTypeId="2" ParentId="26560" CreationDate="2016-02-05T20:07:03.140" Score="0" Body="&lt;p&gt;You could also use a QoS class-map to match the traffic (you'd have to match on source IP address) and then drop the traffic in that class with a policy-map. Clunky...&lt;/p&gt;&#xA;" OwnerUserId="317" LastActivityDate="2016-02-05T20:07:03.140" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26564" PostTypeId="2" ParentId="13465" CreationDate="2016-02-05T20:14:00.093" Score="1" Body="&lt;p&gt;By default every BGP router advertises only its best routes. As A prefers route from B over external route (due to higher local preference), it doesn't advertise the external route to B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failover will work, but might take a while because:&#xA; * B has to revoke its external routes&#xA; * A has to select new best routes&#xA; * A has to advertise new best routes to B&#xA; * B has to select new best routes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want faster failover use &quot;BGP best-external&quot; (or something along these lines - search for best-external on cisco.com) on A.&lt;/p&gt;&#xA;" OwnerUserId="317" LastActivityDate="2016-02-05T20:14:00.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26565" PostTypeId="2" ParentId="16204" CreationDate="2016-02-05T20:19:04.600" Score="0" Body="&lt;p&gt;The problem &lt;em&gt;might&lt;/em&gt; be the GRE keys. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All tunnels on hub routers &lt;strong&gt;MUST&lt;/strong&gt; have the same GRE key (otherwise a spoke cannot send a packet to a non-connected hub - think it through), which means that you &lt;strong&gt;MUST&lt;/strong&gt; have multiple IP addresses on the hub routers to terminate the GRE tunnels (because you cannot differentiate them by GRE keys).&lt;/p&gt;&#xA;" OwnerUserId="317" LastActivityDate="2016-02-05T20:19:04.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26568" PostTypeId="2" ParentId="26541" CreationDate="2016-02-05T20:59:06.093" Score="13" Body="&lt;p&gt;This is a quick recipe:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Start a packet sniffer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo tcpdump -n -i eth2 icmp &amp;amp;&#xA;[1] 1409&#xA;$ tcpdump: verbose output suppressed, use -v or -vv for full protocol decode&#xA;listening on eth2, link-type EN10MB (Ethernet), capture size 262144 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) Send an UDP packet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ echo reply-me | nc -u 1.0.0.2 1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) If you receive 'ICMP port unreachable', that UDP port is closed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20:54:15.475211 IP 1.0.0.2 &amp;gt; 1.0.0.1: ICMP 1.0.0.2 udp port 1000 unreachable, length 45&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4) Otherwise, usually either the port is open or something is blocking ICMP.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-05T20:59:06.093" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26569" PostTypeId="1" AcceptedAnswerId="26570" CreationDate="2016-02-05T21:47:46.490" Score="1" ViewCount="7552" Body="&lt;p&gt;Is it possible to communicate with a device solely through a device's MAC address? Alternatively, can you get a device's IP address through its MAC address? The point is to communicate with a remote device that has a non-static IP. I would like to avoid the use of static IP's.&lt;/p&gt;&#xA;" OwnerUserId="22660" LastEditorUserId="8499" LastEditDate="2018-02-16T03:58:08.270" LastActivityDate="2018-02-16T03:58:08.270" Title="Send HTTP Request to device through Mac Address?" Tags="|ip|mac-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26570" PostTypeId="2" ParentId="26569" CreationDate="2016-02-05T21:59:32.720" Score="0" Body="&lt;p&gt;A MAC address is only relevant on the local layer-2 LAN, so even if you could use an upper-layer protocol with only the MAC address, it wouldn't do you any good since the layer-2 frame from your host will have the gateway MAC address as the destination MAC address, and your MAC address as the source MAC address. The frame will be stripped off at the gateway, losing even your source MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC addresses are layer-2 addresses, and they are only used on the local LAN. To get to a different network, you need the layer-3 network (IP) address. For applications to communicate with each other, they need to know the transport protocol (TCP, UDP, etc.) and the layer-4 address (port).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-05T21:59:32.720" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26573" PostTypeId="2" ParentId="23584" CreationDate="2016-02-06T03:23:49.703" Score="2" Body="&lt;p&gt;I had a very similar issue with an Ikev2 site to site tunnel between ASA's. Inspite of all configuration appearing to be correct, ONE side of the tunnel would route traffic back out the inside interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After hours of checking configs what tipped me off was the packet tracer output. I noted that when I ran packet-tracer on the side of the tunnel that was behaving, the first phase output was an &quot;UN-NAT&quot; which is expected. On the mis-behaving ASA, the phase one output of packet-tracer was a &quot;ROUTE-LOOKUP&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the routing config and order of operations for you cisco software. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For my configuration the issue was a route-lookup statement in the un-nat nat entry. &lt;/p&gt;&#xA;" OwnerUserId="22662" LastActivityDate="2016-02-06T03:23:49.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26575" PostTypeId="2" ParentId="26569" CreationDate="2016-02-06T06:30:14.393" Score="0" Body="&lt;p&gt;If your device has IPv6 support, you can make a connection to the link-local address, which has a deterministic relationship with the MAC address.&lt;/p&gt;&#xA;" OwnerUserId="22665" LastActivityDate="2016-02-06T06:30:14.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26577" PostTypeId="2" ParentId="26540" CreationDate="2016-02-06T11:45:27.003" Score="2" Body="&lt;p&gt;Firstly, it does look very much like you have had a broadcast/multicast storm and an external loop would do it. So, some sort of mitigation with spanning tree, loop protection, multicast rate limiting sounds like a plan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With LLDP, the packets are sent to addresses in the IEEE reserved multicast range, which should not be forwarded by an intermediate switch. So, in a switched network you should only see direct neighbours. With CDP, the announcements are sent to a multicast address in Cisco's range, which by default will be forwarded. So seeing multiple CDP devices on one port is normal in a multivendor environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your problem is that you are assuming that when you type &lt;em&gt;show lldp info&lt;/em&gt; it shows LLDP information. Actually, on the HP 5412, CDP and LLDP share a common database. You just see different views of it with &lt;em&gt;show lldp info&lt;/em&gt; and &lt;em&gt;show cdp&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the LLDP information is derived from CDP announcements, it is usually less complete. So even on the short report, you have a column (Chassis-ID, I believe) missing on all ports except D14 and D15. If anything, the thing that puzzles me is why you have only 2 LLDP entries and not 8. Certainly the behaviour on port D18 is expected, if slightly quirky.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt; Turn off the CDP receiver or mentally filter what &lt;em&gt;show lldp&lt;/em&gt; tells you on Procurve.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2016-02-06T11:45:27.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26580" PostTypeId="1" AcceptedAnswerId="26581" CreationDate="2016-02-06T12:30:24.870" Score="6" ViewCount="1193" Body="&lt;p&gt;My company has to provide support to a piece of equipment that closes the connection on every request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that in the most critical workflow, it needs to make 2 requests. The consequence is a very long wait between the two requests establishing SSL connection. The problem is even worse when GPRS is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering whether there is any way to prevent connection interruption. By looking at wireshark dump, it feels like if I could ignore FIN, the connection would remain open. Does that make any sense?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are my options?&lt;/p&gt;&#xA;" OwnerUserId="22669" LastEditorUserId="8499" LastEditDate="2018-10-27T02:27:01.933" LastActivityDate="2018-10-27T02:27:01.933" Title="Is there a way to ignore client's TCP FIN and keep TCP connection?" Tags="|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26581" PostTypeId="2" ParentId="26580" CreationDate="2016-02-06T12:42:48.900" Score="13" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does that make any sense?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The FIN is send because the sender decided that it wants to close the connection. Even if you would change the recipient that it will ignore the FIN the sender side of the application will still consider the connection closed and not send or receive any more data on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just compare it to a phone call. If the other end decided to hang up the phone and no longer talk to you it does not matter if you are trying to ignore this, the other end still will not talk to you any more.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What are my options?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This must be fixed inside the application. For example the application could reuse the existing TCP connection like done with HTTP keep-alive.&lt;/p&gt;&#xA;" OwnerUserId="4063" LastEditorUserId="4063" LastEditDate="2016-02-06T12:48:26.290" LastActivityDate="2016-02-06T12:48:26.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26584" PostTypeId="1" AcceptedAnswerId="26590" CreationDate="2016-02-06T18:47:10.933" Score="1" ViewCount="1484" Body="&lt;p&gt;I have an SRX3600 and an EX2200.  I can ping everything on the EX2200 from the SRX, but I can't ping the gateway (or anything else) on the SRX from the EX.  Another set of eyes would be wonderful.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;admin@wb-sw1&amp;gt; ping 192.168.2.1&#xA;PING 192.168.2.1 (192.168.2.1): 56 data bytes&#xA;^C&#xA;--- 192.168.2.1 ping statistics ---&#xA;2 packets transmitted, 0 packets received, 100% packet loss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The gateway shows up in the arp table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;admin@wb-sw1&amp;gt; show arp&#xA;MAC Address       Address         Name                      Interface           Flags&#xA;44:d9:e7:4c:7f:c8 192.168.1.11    192.168.1.11              vlan.10             none&#xA;44:d9:e7:4c:80:64 192.168.1.13    192.168.1.13              vlan.10             none&#xA;40:b4:f0:d6:44:00 192.168.2.1     192.168.2.1               ge-0/0/0.0          none&#xA;Total entries: 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The EX2200 has the following configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ge-0/0/0 is my link to my SRX&#xA;ge-0/0/12 &amp;amp; 24 are connected to devices on the 192.168.1.0/24 subnet.. all which can be accessed by the SRX.  Communication is only one way though; I cannot ping the gateway of the SRX from the EX.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;ge-0/0/0 {&#xA;    unit 0 {&#xA;        family inet {&#xA;            address 192.168.2.2/30;&#xA;        }&#xA;    }&#xA;}&#xA;ge-0/0/1 {&#xA;    unit 0 {&#xA;        family ethernet-switching {&#xA;            port-mode access;&#xA;        }&#xA;    }&#xA;}&#xA;ge-0/0/2 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/3 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/4 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/5 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/6 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/7 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/8 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/9 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/10 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/11 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/12 {&#xA;    unit 0 {&#xA;        family ethernet-switching {&#xA;            vlan {&#xA;                members internal-net;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;ge-0/0/13 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/14 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/15 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/16 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/17 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/18 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/19 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/20 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/21 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/22 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/23 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/24 {&#xA;    unit 0 {&#xA;        family ethernet-switching {&#xA;            vlan {&#xA;                members internal-net;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;ge-0/0/25 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/26 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/27 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/28 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/29 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/30 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/31 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/32 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/33 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/34 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/35 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/36 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/37 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/38 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/39 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/40 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/41 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/42 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/43 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/44 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/45 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/46 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/0/47 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/1/1 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/1/2 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/1/3 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;ge-0/2/0 {&#xA;    unit 0;&#xA;}&#xA;me0 {&#xA;    unit 0 {&#xA;        family inet {&#xA;            address 192.168.199.1/29;&#xA;        }&#xA;    }&#xA;}&#xA;vlan {&#xA;    unit 0 {&#xA;        family inet;&#xA;    }&#xA;    unit 10 {&#xA;        family inet {&#xA;            address 192.168.1.1/24;&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop 192.168.2.1;&#xA;    }&#xA;}&#xA;protocols {&#xA;    igmp-snooping {&#xA;        vlan all;&#xA;    }&#xA;    rstp;&#xA;    lldp {&#xA;        interface all;&#xA;    }&#xA;    lldp-med {&#xA;        interface all;&#xA;    }&#xA;}&#xA;ethernet-switching-options {&#xA;    storm-control {&#xA;        interface all;&#xA;    }&#xA;}&#xA;vlans {&#xA;    default;&#xA;    internal-net {&#xA;        vlan-id 10;&#xA;        l3-interface vlan.10;&#xA;    }&#xA;    wan;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this is the SRX:&#xA;ge-0/0/0 is the link to the EX, ge-0/0/8 is my WAN uplink&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 192.168.2.1/30;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/8 {&#xA;        enable;&#xA;        speed 1g;&#xA;        link-mode full-duplex;&#xA;        gigether-options {&#xA;            no-auto-negotiation;&#xA;        }&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 192.69.88.162/27;&#xA;            }&#xA;        }&#xA;    }&#xA;    lo0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 127.0.0.1/32;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop 192.69.88.161;&#xA;        route 192.168.1.0/24 next-hop 192.168.2.2;&#xA;    }&#xA;}&#xA;security {&#xA;    zones {&#xA;        security-zone trust {&#xA;            interfaces {&#xA;                ge-0/0/0.0;&#xA;            }&#xA;        }&#xA;        security-zone untrust {&#xA;            interfaces {&#xA;                ge-0/0/8.0;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7589" LastEditorUserId="7589" LastEditDate="2016-02-06T22:42:14.763" LastActivityDate="2016-02-07T03:20:54.710" Title="Juniper routing - one way communication" Tags="|routing|juniper|juniper-junos|juniper-srx|juniper-ex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26585" PostTypeId="2" ParentId="19701" CreationDate="2016-02-06T19:50:16.937" Score="2" Body="&lt;p&gt;I think the question you have asked is bespoke to your situation. Without anything like MPLS-TE and PCEP etc, just having ECMP between to P/PEs is a very optimal design to ensure as network flows come and go there is a good chance there is enough free bandwidth on any of the ECMP member links to support those flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a central traffic engineering solution that’s great, you can balance the LSPs unevenly and have no problems at all (as long as you can actually do that properly!).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example sake; if you have two 1G links and use ECMP. If a network flow starts and it uses 500Mbps of bandwidth over LSP1 which is load-balanced over link 1. The next flow that starts up is 300Mbps over LSP2 and is load-balanced over link 2. Now a third flow starts up that is 600Mbps over LSP1 which is load-balanced over link 1, now link1 is congested and that flow would have fitted onto link2. That is a great advantage of a centralised TE system using unequal cost multi-pathing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is best though really depend on your network. If you properly capacity mange the member links in an ECMP group (continuing our 2x 1G link example) to run at more than 50% each you will have no problems in a failure scenario. The links should have been upgraded to 10G Links by this point (or something higher than 1Gbps). Having said that, you also need to &quot;know&quot; your network and the traffic flows on it; capacity management isn't just about raw volume figures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to touch on it as it's partially related...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ECMP and Single Link Failures&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Number of connections from point A to point B = N   &#xA;N = 4&#xA;Speed of a single connection = S&#xA;S = 1000&#xA;The maximum utilisation of any single link that will still support a single link failure = LinkMax&#xA;LinkMax = S-(S/N)&#xA;LinkMax = 750&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ECMP and Multiple Link Failures&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Maximum number of link failures that we would wish to endure without exceeding capacity of remaining links = F&#xA;F = 2&#xA;N = 4&#xA;S = 1000&#xA;LinkMax = S-(S/(N-L))&#xA;LinkMax = 500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2016-02-06T22:05:34.887" LastActivityDate="2016-02-06T22:05:34.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26588" PostTypeId="2" ParentId="26548" CreationDate="2016-02-07T00:25:36.320" Score="2" Body="&lt;p&gt;Different devices and software/firmware use different load-balancing hashing algorithms, what equipment are you using and what load-balancing method are you using?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the minimal information you have given, you might just have unequal load balancing. With MLPPP you should be effectively be doing per-packet load-balancing across all the member links but that isn't always the case. If your set-up is doing per-IP balancing for example, you might have a couple of larger flows balanced onto the first link, or it may be that you have many flows between the same set of IPs which again are over-favouring for example the fist link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also check that all the links are in the MLPPP bundle and that they are running at the same or very similar speeds (user configuration for example might state one link is 2Mbps and another 8Mbps, when they should be all the same).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RFC lists various discriminator factors used to determine which member links belong to which MLPPP bundle. Ensure those factors (whatever you have configured) are matching up so that all the links are actually in the bundle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also do you have access to both ends of the bundle, is there any discrepancy between MLPPP end-points?&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2016-02-07T00:25:36.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26590" PostTypeId="2" ParentId="26584" CreationDate="2016-02-07T03:20:54.710" Score="3" Body="&lt;p&gt;Figured out what was going on.  This is unique to SRX devices as they are security devices.  I had to add host-system-services inbound ping to my trust zone, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;admin@wb1# set security zones security-zone trust interfaces ge-0/0/0.0 host-inbound-traffic system-services ping&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7589" LastActivityDate="2016-02-07T03:20:54.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26591" PostTypeId="1" CreationDate="2016-02-07T03:41:46.850" Score="2" ViewCount="21547" Body="&lt;p&gt;Cisco L2 switch &amp;lt;--trunk--&gt; CRS125 &amp;lt;--trunk--&gt; RB750G&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RB750G is the only device that handles routing &lt;/li&gt;&#xA;&lt;li&gt;CRS125 and RB750G has interfaces with untagged traffic&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am familiar with the config on Cisco side, but had no success on Mikrotik side (keep getting locked out and have to reset the device). Mikrotik has really poor documentation and the config seems inconsistent on different models.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With RB750G, I managed to get VLAN to work by setting master port to none for each port, creating a bridge for each VLAN, then creating a bridge for each trunk with allowed vlans added to the bridge &lt;a href=&quot;http://mum.mikrotik.com/presentations/ID13/khomeini.pdf&quot; rel=&quot;nofollow&quot; title=&quot;MUM VLAN in MikroTik&quot;&gt;following MUM tutorial for VLAN in MikroTik&lt;/a&gt;. Isn't this effectively soft switching everything? Not to mention this get complicated really quick as number of vlan grows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had no success with the &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Switch_Chip_Features&quot; rel=&quot;nofollow&quot;&gt;switch chip config&lt;/a&gt;. &quot;Management IP Configuration&quot; section made no sense to me and following the wiki guarantees a lockout. Do I have to create the VLANs in both switch config vlan database and router interface vlan database? &lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="8499" LastEditDate="2018-02-14T16:24:44.553" LastActivityDate="2018-02-14T16:24:44.553" Title="How to configure 802.1q trunk on Mikrotik router/switch?" Tags="|vlan|" AnswerCount="1" CommentCount="3" ClosedDate="2017-07-28T15:05:47.407" ContentLicense="CC BY-SA 3.0" />
  <row Id="26592" PostTypeId="1" AcceptedAnswerId="26603" CreationDate="2016-02-07T04:16:45.487" Score="2" ViewCount="4309" Body="&lt;p&gt;I have a Cisco 3650 switch and want to backup my IOS via tftp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;System image file is &lt;code&gt;flash:packages.conf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh flash   &#xA;cat3k_caa-base.SPA.03.03.05SE.pkg   &#xA;cat3k_caa-drivers.SPA.03.03.05SE.pkg  &#xA;cat3k_caa-infra.SPA.03.03.05SE.pkg  &#xA;cat3k_caa-iosd-universalk9.SPA.150-1.EZ5.pkg   &#xA;cat3k_caa-platform.SPA.03.03.05SE.pkg  &#xA;cat3k_caa-wcm.SPA.10.1.150.0.pkg       &#xA;packages.conf   &#xA;nvram_config  &#xA;vlan.dat&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which file i want to download for backup the current ios on cisco switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And how can i download this ios to another switch?&lt;/p&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="21915" LastEditDate="2016-02-09T12:31:35.837" LastActivityDate="2016-02-09T12:31:35.837" Title="What are .pkg files in flash drive?" Tags="|cisco|switch|cisco-ios|tftp|backups|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26593" PostTypeId="1" CreationDate="2016-02-07T10:15:06.630" Score="3" ViewCount="297" Body="&lt;p&gt;Assume the current configuration has a headquarter and remote offices that connect using a VPN client (Cisco AnyConnect).&#xA;We want to eliminate the use of the VPN client for the users' workstation. So, my plan is to install a Cisco ASA on the remote offices and with the proper configuration, being able to connect to the headquarters, directly.&#xA;Is this something that could be done? If yes, where should I concentrate on the ASA? Is the site-to-site indeed what I am looking for? Also, what information do I need from the headquarter so that I can configure the remote one (apart from the IP)? Last, does the headquarter need to do anything from their site?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance&lt;/p&gt;&#xA;" OwnerUserId="22688" LastActivityDate="2016-02-07T13:32:00.867" Title="Cisco site-to-site vpn configuration" Tags="|cisco-asa|vpn|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26595" PostTypeId="2" ParentId="22416" CreationDate="2016-02-07T10:55:29.220" Score="2" Body="&lt;p&gt;Here's a question, &lt;code&gt;Why would Linux send an ARP probe for an IP that is being locally assigned, it knows who the own of that IP will be (itself!) ?&lt;/code&gt; - You are setting the IPs so you should know which IP is free. When you &lt;code&gt;rm -rf /&lt;/code&gt; Linux doesn't check, it “just does”, because you should know if its ok to perform that operation or not. Windows (for example) has a habit of holding your hand to make it more idiot proof (in my opinion).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of an MS DHCP server, if you run a packet capture on one (which I have) you will see that they will ping an address before leasing it out to a client to ensure it isn't already taken and doesn't know about it (either due to another DHCP server or a static assignment).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you assign an IP to an interface on Linux there is no need to send out a gratuitous ARP. If another hosts wants to know the MAC for IP 1.2.3.4 it can send an ARP request. There is no benefit to gratuitously ARP out anytime an interface comes up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I have made few statements without hard evidence to back them up however as per your question you have seen for yourself the same behaviour. This just makes logical sense to me.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2016-02-07T10:55:29.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26596" PostTypeId="1" AcceptedAnswerId="26604" CreationDate="2016-02-07T11:09:44.667" Score="2" ViewCount="54" Body="&lt;p&gt;First to begin my OS is Arch Linux(a base install mostly). I have project in the making and I have opened SSH. Yesterday I had left my computer for a few hours(3/4). When I was back in my log file I've seen someone has tried to break in trough my ssh and he has failed to break my root password. So my question is : The IP the hacker was using is supposed to be owned by Microsoft, so I was wondering if the hacker could've somehow faked their IP address with that of Microsoft(from their azure server)&lt;/p&gt;&#xA;" OwnerUserId="22690" LastActivityDate="2016-02-07T14:40:39.403" Title="Faking IP adress" Tags="|ip|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26597" PostTypeId="1" AcceptedAnswerId="26610" CreationDate="2016-02-07T11:26:55.063" Score="1" ViewCount="393" Body="&lt;p&gt;Some devices have an OUI that isn't the one belonging to the manufacturer of the device. For example, my Sony mobile phone has a MAC address which belongs to Airgo Networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a database where I can find the manufacturer (Sony) that uses a wireless card with an OUI (Airgo Newtorks) that doesn't belong to the manufacturer? &lt;/p&gt;&#xA;" OwnerUserId="22691" LastEditorUserId="8499" LastEditDate="2016-02-07T17:18:12.440" LastActivityDate="2016-02-08T04:16:31.247" Title="Manufacturer and wireless cards OUI" Tags="|mac-address|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26599" PostTypeId="1" CreationDate="2016-02-07T12:26:12.280" Score="1" ViewCount="866" Body="&lt;p&gt;After explicitly assigning a Router-ID to the ospf process the &quot;old RouterID&quot; remains in the topology table of the whole ospf area. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I remove the old router ID?&#xA;What is the max age for it? (3600??)&#xA;Wont this entry cause any problems?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tnxall&lt;/p&gt;&#xA;" OwnerUserId="17447" LastEditorUserId="8499" LastEditDate="2019-01-04T23:20:55.927" LastActivityDate="2019-01-04T23:20:55.927" Title="how to remove the OLD_Router-ID from ospf toplolgy table" Tags="|routing|router|cisco-ios|ospf|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26600" PostTypeId="2" ParentId="26597" CreationDate="2016-02-07T12:48:08.657" Score="2" Body="&lt;p&gt;None that I'm aware of.  It would be difficult, because a computer manufacturer could change parts (use a different card manufacturer) at any time.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-07T12:48:08.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26601" PostTypeId="2" ParentId="26593" CreationDate="2016-02-07T12:51:59.940" Score="1" Body="&lt;p&gt;Yes, a site-to-site VPN is exactly what you are looking for.  You will need to know the crypto key (or have a certificate), isakmp, and ipsec parameters.  If you can get a copy of the asa config (or relevant parts), we can help set up your ASA.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-07T12:51:59.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26602" PostTypeId="2" ParentId="26593" CreationDate="2016-02-07T13:32:00.867" Score="2" Body="&lt;p&gt;Yes, site-to-site tunnel seems to be the solution you need. The device you install in your branch office could be Cisco ASA or something different, e.g Cisco ISR router (maybe you already have one). The information you'd need from HQ: IP address, networks that are allowed to use tunnel, PreShared Key (if you don't want to use certificate), other Phase 1 and 2 parameters. The same should be set up on the HQ side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One simple example of such setup: &lt;a href=&quot;http://bitwizards.com/blog/april-2015/how-to-set-up-a-site-to-site-vpn-with-cisco-asa-55&quot; rel=&quot;nofollow&quot;&gt;http://bitwizards.com/blog/april-2015/how-to-set-up-a-site-to-site-vpn-with-cisco-asa-55&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Khm, now I see you have an answer already  :) &lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-02-07T13:32:00.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26603" PostTypeId="2" ParentId="26592" CreationDate="2016-02-07T14:31:42.043" Score="4" Body="&lt;p&gt;Is it possible you are talking about 3650, not 3560? The switch is running in &quot;install mode&quot; and .pkg files are packages extracted from .bin. You could check the files that switch is using with a command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show version running&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Backup all these files + packages.conf (if you do not have original *.bin file)&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-02-07T14:31:42.043" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26604" PostTypeId="2" ParentId="26596" CreationDate="2016-02-07T14:35:13.217" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://security.stackexchange.com/questions/55279/how-easy-is-it-really-to-do-ip-spoofing&quot;&gt;This post&lt;/a&gt;  has some useful information regarding IP spoofing. To put it shortly, it is not a trivial thing to do. For bi-directional connections, like SSH (which uses TCP), this would be even more difficult if not impossible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most likely, the source IP was legitimate and the attack came from an azure VM either purchased or compromised by the attacker.&lt;/p&gt;&#xA;" OwnerUserId="20964" LastEditorUserId="20964" LastEditDate="2016-02-07T14:40:39.403" LastActivityDate="2016-02-07T14:40:39.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26610" PostTypeId="2" ParentId="26597" CreationDate="2016-02-07T17:17:15.803" Score="3" Body="&lt;p&gt;How do you know Airgo Networks didn't manufacture the card in the Sony device? Device manufacturers use parts from other manufacturers all the time, especially if they don't make network chipsets. Sony, itself, may not even have a registered OUI. Many PCs have MAC addresses which are not from the PC manufacturer, but from the manufacturer of the network chipset. This is not unusual, and the OUI does belong to the manufacturer (of the chipset).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are Internet sites which maintain OUI databases, but there is no database to relate the device manufacturer to a particular network chipset since each device manufacturer is free to use the lowest bid or change suppliers or contracts at any given time. Many different device manufacturers can, and do, use network chipsets from the same network chipset manufacturer, so the same OUI may be used by disparate device manufacturers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-08T04:16:31.247" LastActivityDate="2016-02-08T04:16:31.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26611" PostTypeId="2" ParentId="22416" CreationDate="2016-02-07T17:32:49.567" Score="3" Body="&lt;p&gt;Manually configuring an IP address on a device doesn't require the device to check for address conflicts. It is only if the device configures its own IP address (DHCP, etc.) that it should check for address conflicts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are not going to see a gratuitous ARP if you manually configure a device since the device has no way to change its (or request a new) address if it discovers a conflict. The purpose of the RFC is so that a device, configuring its own IP address, can detect if it needs to change the IP address it got. It can do that for things like DHCP, but it has no way to do that if you manually configure the address. In other words, the device has to trust that you, the human, know what you are doing, but it needs to verify that any address it comes up with on its own is not already in use.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-07T17:32:49.567" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26612" PostTypeId="2" ParentId="26599" CreationDate="2016-02-07T17:42:10.883" Score="2" Body="&lt;p&gt;You need to use the &lt;code&gt;clear ip ospf process&lt;/code&gt; command after you change a router ID. Alternatively, you could just restart the router, but that seems extreme.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-07T17:42:10.883" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26613" PostTypeId="2" ParentId="26591" CreationDate="2016-02-07T18:36:03.840" Score="1" Body="&lt;p&gt;If the CRS125 is just Layer 2 as you suggest then no router vLAN config is required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW RouterOS uses the term ‘trunk’ to mean an aggregation of two or more ports to provide a single logical interface (802.3ad). A normal 802.1Q port is just a port that uses vLAN tagging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To create a dot1Q trunk just add vLANs to the port and enable egress tagging on those vLANs. For example, here vLANs 10 &amp;amp; 20 are added to port ether15:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface ethernet switch vlan&#xA;add ports=ether15 vlan-id=10&#xA;add ports=ether15 vlan-id=20&#xA;/interface ethernet switch egress-vlan-tag&#xA;add tagged-ports=ether15 vlan-id=10&#xA;add tagged-ports=ether15 vlan-id=20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Mikrotik call a port with a native untagged vLAN a hybrid dot1Q trunk. This requires ingress and egress translations on the native vLAN. For example, to add native vLAN 1 to the above configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface ethernet switch vlan&#xA;add ports=ether15 vlan-id=1&#xA;add ports=ether15 vlan-id=10&#xA;add ports=ether15 vlan-id=20&#xA;/interface ethernet switch egress-vlan-tag&#xA;add tagged-ports=ether15 vlan-id=10&#xA;add tagged-ports=ether15 vlan-id=20&#xA;/interface ethernet switch ingress-vlan-translation&#xA;add new-customer-vid=1 ports=ether15 sa-learning=yes&#xA;/interface ethernet switch egress-vlan-translation&#xA;add customer-vid=1 customer-vlan-format=untagged-or-tagged ports=ether15 service-vlan-format=untagged-or-tagged&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you configure a Mikrotik switch you're pretty much configuring the switch controller chip directly. Cisco's 'switchport mode trunk' hides all this under the hood.&lt;/p&gt;&#xA;" OwnerUserId="22698" LastActivityDate="2016-02-07T18:36:03.840" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26616" PostTypeId="2" ParentId="7331" CreationDate="2016-02-07T21:03:19.267" Score="3" Body="&lt;p&gt;Okay, I'll bite. I guess you have a router for each trailer right, serving as the main router for the network. Configure a port on each with a interface with an IP in what we'll call the &quot;backbone&quot; network. For example 192.168.0.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, for a small network like this, you don't need anything fancy when it comes to routing protocols, but to make the whole shebang &quot;automagically&quot; work, I'd suggest using one. Your routers need to support it, and you want it to be nice and easy, so I'd go with RIP or something. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, hook up the interfaces you configured with a switch, and the routers should all advertise their internal networks to the other routers. If you set it up right so that the default route on each trailer router points to the WAN interface, internet connectivity shouldn't be interfered with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have a router in each trailer, then you can just configure 4 interfaces on a router with matching settings for each network, and do away with the routing protocols. The machines in the network would need their default gateway pointing at the routers IP address of course. Here you would also need to attach any WAN gear to the router and set it's default route to point to that interface, but it's doable. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-07T21:03:19.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26617" PostTypeId="2" ParentId="22325" CreationDate="2016-02-07T21:25:45.220" Score="1" Body="&lt;p&gt;It's not clear in your question whether you are tunnelling between both clients via the server, or tunnelling from each client &lt;em&gt;to&lt;/em&gt; the server.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In either case on the client side, you can bind locally to the same IP/port on both sides e.g.: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh -f client@server.com -L 2000:server.com:22 -N&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will map &lt;code&gt;127.0.0.1:2000&lt;/code&gt; on each client to the tunnel which terminates on the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the server side, you will simply see the public IP address of each client, which will have (possibly) unique source IPs bound to unique source ports.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-02-07T21:25:45.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26618" PostTypeId="2" ParentId="26534" CreationDate="2016-02-07T22:11:12.697" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the difference between Policy NAT with no DIP and Interface&#xA;  based NAT? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Interface-based NAT only works from the Trust zone to the Untrust zone (as in the default zones).  Traffic between other zones will always be routed.  The exception to all this (as you have discovered) is when the destination zone is in the Untrust VR, in which case, all traffic will be source NATted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a hang-over from back in the Netscreen days, where there were no custom zones and most boxes had &amp;lt;=3 usable interfaces.  They were automatically placed into Zones (these were actually silk-screened above the ports).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Policy-based source-NAT on the other hand will be applied whenever traffic matches the policy, regardless of zone/VR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you configure both (e.g. set the interface to NAT mode, and then configure a policy-based NAT) then the policy NAT will override the Interface NAT for that traffic.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I configure all Zones/Interfaces connected to the&#xA;  Trust-VR as NAT and not lose any functionality?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, this should work fine - as above, all this traffic will be routed unless use a Trust or Untrust zone.  If there are any NAT requirements, you can configure policy-based to override specific cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;References:&#xA;Juniper KB6725 - [ScreenOS] Configuration example using interface-based NAT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB6725&amp;amp;pmv=print&amp;amp;actp=search&amp;amp;searchid=1236690693051&amp;amp;type=currentpaging&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB6725&amp;amp;pmv=print&amp;amp;actp=search&amp;amp;searchid=1236690693051&amp;amp;type=currentpaging&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-02-07T22:11:12.697" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26619" PostTypeId="2" ParentId="26315" CreationDate="2016-02-08T01:23:33.950" Score="3" Body="&lt;p&gt;After upgrading IOS from 15.5 to 15.5.3 I was finally able to use ZBF instead of CBAC. Because of bugs in that version you could not create policies. I was then able to remove the inspect rules and substitute them for policies and also remove the access-lists. Since making these changes, the issues on reboot and the router hanging problems (yes the outside interface would hang after 4-5 hours) have gone away completely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that there are some serious bugs in CBAC for newer IOS versions and Cisco is not going to fix them according to their own documentation. My advice is to ditch CBAC and go for Zone Based Firewall in all newer IOS versions.&lt;/p&gt;&#xA;" OwnerUserId="22167" LastActivityDate="2016-02-08T01:23:33.950" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="26620" PostTypeId="1" AcceptedAnswerId="30181" CreationDate="2016-02-08T07:48:16.333" Score="1" ViewCount="1833" Body="&lt;p&gt;I have a pretty old Sonicwall TZ100 installed in my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After a recent update of Chrome, I am not longer able to manage the appliance through the SSL address &lt;code&gt;https://sonicwallip&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google Chrome is returning me the following error:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ERR_SSL_VERSION_OR_CIPHER_MISMATCH&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately there is no way to force it to go through and reach the Sonicwall login page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a solution to this issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="21626" LastEditorUserId="8499" LastEditDate="2018-02-16T04:22:27.980" LastActivityDate="2018-02-16T04:22:27.980" Title="Sonicwall TZ100 Https management" Tags="|sonicwall|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26621" PostTypeId="2" ParentId="26620" CreationDate="2016-02-08T08:08:06.960" Score="1" Body="&lt;p&gt;It sounds like your sonicwall is configured to use weak ciphers for SSL which are (rightfully) deemed insecure by your browser. I'm not familiair with sonicwall, but have seen the same problem on old ScreenOS installs. The solution would be to change cipher suites. As a workaround to login to the sonicwall, you may try to use an older browser.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-02-08T08:08:06.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26625" PostTypeId="1" CreationDate="2016-02-08T13:40:32.960" Score="2" ViewCount="4538" Body="&lt;p&gt;Online there is a lot of content mentioning the spanning tree being a l2 switch feature so I guess it comes as standard/ is a given that it available for all modern l3 switches...&#xA;(Could the answer be backed up with a reliable source for the benefit of my documentation)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: see my first comment under the first answer&lt;/p&gt;&#xA;" OwnerUserId="22706" LastEditorUserId="22706" LastEditDate="2016-02-09T11:25:43.547" LastActivityDate="2016-02-09T11:25:43.547" Title="Does the spanning tree protocol come as standard in L3 switches?" Tags="|switch|spanning-tree|layer3|" AnswerCount="1" CommentCount="2" ClosedDate="2016-02-08T15:50:01.030" ContentLicense="CC BY-SA 3.0" />
  <row Id="26626" PostTypeId="2" ParentId="26580" CreationDate="2016-02-08T14:57:39.040" Score="1" Body="&lt;p&gt;no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fin means the sender will not send any more data. Pretending you didn't receive the notification isn't going to make them send more data :)&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-02-08T14:57:39.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26627" PostTypeId="2" ParentId="26625" CreationDate="2016-02-08T15:02:46.053" Score="1" Body="&lt;p&gt;Layer-3 switches &lt;em&gt;are&lt;/em&gt; layer-2 switches, with some routing. Ports used as layer-3 ports will not use STP since it doesn't make sense to use it on a routed link, but the ports used as layer-2 switch ports will have STP. In most layer-3 switches, how a port is used (layer-2 or layer-3) can be changed by configuration. It is also possible to disable STP on many layer-2 or layer-3 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Sebastian pointed out, the are far too many switch manufacturers and models for there to be any single source to add to your documentation.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-08T15:02:46.053" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26628" PostTypeId="1" AcceptedAnswerId="28268" CreationDate="2016-02-08T15:51:18.640" Score="2" ViewCount="270" Body="&lt;p&gt;I'm just wondering, do you need to have a certain privilege level to set up a SPAN port on a Cisco switch? if so, what minimum level is required to set up a SPAN port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no networking experience, so I'm not sure if this is a dumb question or not. I just need a answer as I'm working on a tool to interact with a switch, and this came to mind. &lt;/p&gt;&#xA;" OwnerUserId="22709" LastEditorUserId="8499" LastEditDate="2016-03-30T14:25:14.773" LastActivityDate="2016-03-30T14:30:24.350" Title="Privilege level on a Cisco switch" Tags="|cisco|switch|mirror|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26629" PostTypeId="2" ParentId="26513" CreationDate="2016-02-08T15:59:17.860" Score="1" Body="&lt;p&gt;Here's the solution after a lot of pounding my head against this problem: 1) Take out the nat statements at Location B since they interfere with the VPN tunnel:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside,outside) source static Location_B_Networks Location_B_Networks destination static Location_A_Networks Location_A_Networks no-proxy-arp route-lookup&#xA;nat (inside,outside) source static Location_B_Networks Location_B_Networks destination static Remote_DMZ Remote_DMZ no-proxy-arp route-lookup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) Keep the DMZ statement in the split tunnel ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list ezvpn_split extended permit tcp object-group DMZ_Servers object (location B)-remote_network &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) I had the access list entry switch around for no good reason. It was this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list dmz_access_in extended permit tcp object (location B)-remote_network object-group DMZ_Servers eq https&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when it should have been this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list dmz_access_in extended permit tcp object-group DMZ_Servers object (location B)-remote_network eq https&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19266" LastActivityDate="2016-02-08T15:59:17.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26631" PostTypeId="1" AcceptedAnswerId="26632" CreationDate="2016-02-08T20:29:33.690" Score="6" ViewCount="279" Body="&lt;p&gt;Suppose I have a switch that supports &lt;code&gt;Gigabit Connections&lt;/code&gt; and &lt;code&gt;Auto Uplink&lt;/code&gt;. Also, suppose that I have 4 clients (A, B, C and D), each with &lt;code&gt;100Mbps NIC's&lt;/code&gt; connected to the &lt;code&gt;Gigabit Switch&lt;/code&gt; such that the max bandwidth from all clients is &lt;code&gt;400Mbps&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have a server with a &lt;code&gt;1Gbps NIC&lt;/code&gt; connected to the switch. All clients access a resource on the server simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, can each client receive the resource on the server @ &lt;code&gt;100Mbps&lt;/code&gt; speed, meaning that there is a total of &lt;code&gt;600Mbps&lt;/code&gt; bandwidth remaining or is the &lt;code&gt;1Gbps&lt;/code&gt; shared over 4 connections?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See drawing for the layout of network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5TjT7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5TjT7.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22713" LastEditorUserId="22713" LastEditDate="2016-02-10T22:49:18.377" LastActivityDate="2016-02-10T22:49:18.377" Title="Merging multiple clients to one gigabit" Tags="|switch|bandwidth|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26632" PostTypeId="2" ParentId="26631" CreationDate="2016-02-08T20:34:03.000" Score="5" Body="&lt;p&gt;Theoretically you could consume 400 Mbit/s of the server's bandwidth with that setup, provided that everything works perfectly.&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-08T20:34:03.000" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26634" PostTypeId="1" CreationDate="2016-02-09T03:16:01.827" Score="2" ViewCount="2651" Body="&lt;p&gt;I have a HP 2810-48G that I would like to configure for a voice vlan. On our other HP switches (2800, 2610, 2530, etc.) I would navigate to the correct vlan and then type &quot;voice&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the 2810 when I do this I get &quot;invalid input: voice&quot;. I've looked for an explantion and found a post that says that LLDP-MED is not supported on the 2800 series. Yet, I have it working on a 2824 (J4903A Configuration Editor; Created on release #I.10.77). Any ideas? Perhaps my 2810 has an old firmware? It is running firmware #N.11.64. It is hard to understand why this feature would work on a 2824 and not the newer 2810-48G - what am I missing?&lt;/p&gt;&#xA;" OwnerUserId="22466" LastActivityDate="2016-02-09T06:46:30.703" Title="HP Procurve - Configure Voice VLAN" Tags="|vlan|hp|hp-procurve|voice|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26636" PostTypeId="2" ParentId="26634" CreationDate="2016-02-09T06:46:30.703" Score="2" Body="&lt;p&gt;I just checked, the voice option is not available on a 2810-24G running software  N.11.69. You can still set the QoS values manually though. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-09T06:46:30.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26637" PostTypeId="1" CreationDate="2016-02-09T07:28:57.093" Score="3" ViewCount="967" Body="&lt;p&gt;We have got a three core switches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ML1 - HP 5406zl (J8697A) firmware:K.15.14.0007&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ML2 - HP 5406zl (J8697A) firmware:K.15.14.0007&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ML3 - HP 5412zl (J8698A) firmware:K.15.16.0008&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently I created 2 new VLANS (Vlan ID 200 - CISCO-WIFI-MGMT,201 - Cisco-WIFI-REDUNDANT) on all three core switches.&#xA;After that Im unable to see any vlan with ID above 200 in VLAN menu -&gt; Vlan port assignment menu on every core switch.&#xA;Here is the VLAN config of core switch ML1 which is a primary gateway for all vlans (VRRP master)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;vlan 1&#xA;   name &quot;Default&quot;&#xA;   no untagged A2-A16,A19,A21-A24,C3,C5-C19,D4-D8&#xA;   untagged A17-A18,A20,B1-B24,C20-C22,D1-D3,E1-E24&#xA;   tagged A1,C1-C2,C4&#xA;   ip address 10.20.2.155 255.255.0.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   ip helper-address 10.20.9.32&#xA;   vrrp vrid 1&#xA;      virtual-ip-address 10.20.2.155&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 2&#xA;   name &quot;Servus&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.15.254 255.255.252.0&#xA;   vrrp vrid 2&#xA;      virtual-ip-address 10.16.15.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 3&#xA;   name &quot;Office3&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.19.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   ip helper-address 10.20.9.32&#xA;   vrrp vrid 3&#xA;      virtual-ip-address 10.16.19.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 4&#xA;   name &quot;Office4&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.23.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   ip helper-address 10.20.9.32&#xA;   vrrp vrid 4&#xA;      virtual-ip-address 10.16.23.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 5&#xA;   name &quot;Office5&quot;&#xA;   untagged A5-A8,A12&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.27.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   ip helper-address 10.20.9.32&#xA;   vrrp vrid 5&#xA;      virtual-ip-address 10.16.27.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 6&#xA;   name &quot;Office6&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.31.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   ip helper-address 10.20.9.32&#xA;   vrrp vrid 6&#xA;      virtual-ip-address 10.16.31.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 7&#xA;   name &quot;Office7&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.35.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   ip helper-address 10.20.9.32&#xA;   vrrp vrid 7&#xA;      virtual-ip-address 10.16.35.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 8&#xA;   name &quot;Office8&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.39.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   ip helper-address 10.20.9.32&#xA;   vrrp vrid 8&#xA;      virtual-ip-address 10.16.39.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 9&#xA;   name &quot;Management&quot;&#xA;   untagged A3-A4,A9,A22,C4-C6,C9,C11-C15,C17,C19&#xA;   tagged A1,B1-B24,C1-C3,C7-C8,C21-C22,D1-D8&#xA;   ip address 10.16.131.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 9&#xA;      virtual-ip-address 10.16.131.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 10&#xA;   name &quot;Server&quot;&#xA;   untagged A1,C1-C3,C7-C8,C10,D4-D8&#xA;   tagged B1-B24,C21-C22,D1-D3&#xA;   ip address 10.16.3.254 255.255.252.0&#xA;   vrrp vrid 10&#xA;      virtual-ip-address 10.16.3.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 11&#xA;   name &quot;Factory1&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.43.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 11&#xA;      virtual-ip-address 10.16.43.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 12&#xA;   name &quot;Factory2&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.47.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 12&#xA;      virtual-ip-address 10.16.47.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 13&#xA;   name &quot;Factory3&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.51.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 13&#xA;      virtual-ip-address 10.16.51.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 14&#xA;   name &quot;Factory4&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.55.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 14&#xA;      virtual-ip-address 10.16.55.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 15&#xA;   name &quot;Factory5&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.59.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 15&#xA;      virtual-ip-address 10.16.59.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 16&#xA;   name &quot;Factory6&quot;&#xA;   tagged A1,A16,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.63.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 16&#xA;      virtual-ip-address 10.16.63.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 17&#xA;   name &quot;Factory7&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.67.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 17&#xA;      virtual-ip-address 10.16.67.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 18&#xA;   name &quot;Factory8&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.71.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 18&#xA;      virtual-ip-address 10.16.71.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 19&#xA;   name &quot;Factory9&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.75.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 19&#xA;      virtual-ip-address 10.16.75.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 20&#xA;   name &quot;Maschinen&quot;&#xA;   untagged A13-A15&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip access-group &quot;engelmaschinen&quot; in&#xA;   ip address 10.16.11.254 255.255.252.0&#xA;   vrrp vrid 20&#xA;      virtual-ip-address 10.16.11.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 22&#xA;   name &quot;DMZ_MPLS&quot;&#xA;   untagged A24&#xA;   tagged A1,A22,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   no ip address&#xA;   exit&#xA;vlan 23&#xA;   name &quot;dmz_engel_sk&quot;&#xA;   untagged A2&#xA;   tagged A22,C21-C22&#xA;   no ip address&#xA;   exit&#xA;vlan 26&#xA;   name &quot;DMZ&quot;&#xA;   tagged A1,A22,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   no ip address&#xA;   exit&#xA;vlan 30&#xA;   name &quot;Transfer&quot;&#xA;   untagged A21&#xA;   tagged C21-C22&#xA;   ip address 10.16.95.254 255.255.252.0&#xA;   vrrp vrid 30&#xA;      virtual-ip-address 10.16.95.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 55&#xA;   name &quot;QS_Labor&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.7.254 255.255.252.0&#xA;   vrrp vrid 55&#xA;      virtual-ip-address 10.16.7.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 90&#xA;   name &quot;Dialin VPN&quot;&#xA;   tagged A1,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   no ip address&#xA;   exit&#xA;vlan 92&#xA;   name &quot;Video&quot;&#xA;   tagged A1,A22,B1-B24,C1-C3,C5-C9,C11-C12,C21-C22,D1-D8&#xA;   no ip address&#xA;   exit&#xA;vlan 96&#xA;   name &quot;WLAN_ZKW&quot;&#xA;   tagged A1,B1-B24,C1-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.107.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 96&#xA;      virtual-ip-address 10.16.107.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 97&#xA;   name &quot;WLAN_PSK&quot;&#xA;   tagged A1,B1-B24,C1-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.111.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 97&#xA;      virtual-ip-address 10.16.111.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 98&#xA;   name &quot;Guest_LAN&quot;&#xA;   tagged A1,A22,B1-B24,C1-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.115.100 255.255.252.0&#xA;   exit&#xA;vlan 99&#xA;   name &quot;Voice&quot;&#xA;   tagged A1-A12,A15,B1-B24,C1-C9,C11-C12,C21-C22,D1-D8&#xA;   ip address 10.16.99.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   qos priority 5&#xA;   voice&#xA;   vrrp vrid 99&#xA;      virtual-ip-address 10.16.99.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 200&#xA;   name &quot;Cisco-WIFI-MGMT&quot;&#xA;   untagged A10-A11,C16,C18&#xA;   tagged C21-C22&#xA;   ip address 10.16.203.254 255.255.252.0&#xA;   ip helper-address 10.16.0.1&#xA;   ip helper-address 10.16.0.2&#xA;   vrrp vrid 200&#xA;      virtual-ip-address 10.16.203.254&#xA;      priority 255&#xA;      enable&#xA;      exit&#xA;   exit&#xA;vlan 201&#xA;   name &quot;Cisco-WIFI-REDUNDANT&quot;&#xA;   untagged A19&#xA;   tagged C21-C22&#xA;   no ip address&#xA;   exit&#xA;vlan 998&#xA;   name &quot;TK_Internet&quot;&#xA;   untagged A23&#xA;   tagged C21-C22,D2&#xA;   no ip address&#xA;   exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;show vlan output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&#xA;VLAN ID Name                             | Status     Voice Jumbo&#xA;  ------- -------------------------------- + ---------- ----- -----&#xA;  1       Default                          | Port-based No    No&#xA;  2       Servus                           | Port-based No    No&#xA;  3       Office3                          | Port-based No    No&#xA;  4       Office4                          | Port-based No    No&#xA;  5       Office5                          | Port-based No    No&#xA;  6       Office6                          | Port-based No    No&#xA;  7       Office7                          | Port-based No    No&#xA;  8       Office8                          | Port-based No    No&#xA;  9       Management                       | Port-based No    No&#xA;  10      Server                           | Port-based No    No&#xA;  11      Factory1                         | Port-based No    No&#xA;  12      Factory2                         | Port-based No    No&#xA;  13      Factory3                         | Port-based No    No&#xA;  14      Factory4                         | Port-based No    No&#xA;  15      Factory5                         | Port-based No    No&#xA;  16      Factory6                         | Port-based No    No&#xA;  17      Factory7                         | Port-based No    No&#xA;  18      Factory8                         | Port-based No    No&#xA;  19      Factory9                         | Port-based No    No&#xA;  20      Maschinen                        | Port-based No    No&#xA;  22      DMZ_MPLS                         | Port-based No    No&#xA;  23      dmz_engel_sk                     | Port-based No    No&#xA;  26      DMZ                              | Port-based No    No&#xA;  30      Transfer                         | Port-based No    No&#xA;  55      QS_Labor                         | Port-based No    No&#xA;  90      Dialin VPN                       | Port-based No    No&#xA;  92      Video                            | Port-based No    No&#xA;  96      WLAN_ZKW                         | Port-based No    No&#xA;  97      WLAN_PSK                         | Port-based No    No&#xA;  98      Guest_LAN                        | Port-based No    No&#xA;  99      Voice                            | Port-based Yes   No&#xA;  200     Cisco-WIFI-MGMT                  | Port-based No    No&#xA;  201     Cisco-WIFI-REDUNDANT             | Port-based No    No&#xA;  998     TK_Internet                      | Port-based No    No&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the screenshot of the vlan port assignment menu:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iyAR7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iyAR7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So as you can see that I can not see complete name of VLAN ID 200 (CISCO-WIFI-MGMT) and all the VLANS with higher ID than 200 which is for example VLAN 201 and 998 (CISCO-WIFI-REDUNDANT and TK_Internet)&#xA;I do not know if I did some mistakes in my config or it is a firmware bug or some kind of HP limitation.&#xA;At the moment I can not really perform a firmware upgrade of core switches or reboot them, can somebody suggest me what should I try to fix this issue ?&#xA;I also tried to rename both new vlans and it was not helpful. &lt;/p&gt;&#xA;" OwnerUserId="19851" LastEditorUserId="8499" LastEditDate="2016-02-09T08:31:58.120" LastActivityDate="2016-03-10T11:18:56.830" Title="HP Procurve VLAN menu BUG" Tags="|switch|vlan|hp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26641" PostTypeId="2" ParentId="25200" CreationDate="2016-02-09T09:01:23.543" Score="2" Body="&lt;p&gt;Normally, if you nest telnet sessions, you just need to exit the last one to get back to the previous one. In your case, the chain would be Putty-&gt;Commander-&gt;Member. By exiting the Member session, you'll get back to the commander. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-09T09:01:23.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26642" PostTypeId="1" CreationDate="2016-02-09T09:59:58.743" Score="0" ViewCount="98" Body="&lt;p&gt;I have a certain problem with blocking certain websites using the hosts file on Windows/Mac&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically i added several websites in the hosts file like this&#xA;127.0.0.1 xxxxx.com and as expected using a browser I cannot access the said websites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem is, I am doing this to simulate the internet disconnect for my application which seems to still work even with that website blocked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically what it does is put a file on a cloud storage and downloads a file from that cloud storage. I cannot go with the browser to the download/upload links but the application somehow still is able to upload/download files from that website.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the format I tried to use in the hosts file:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;127.0.0.1 xxxx.com &lt;br&gt;&#xA;127.0.0.1 yy.xxxx.com&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what exactly am I doing wrong? or is there any other way of simulating a dropped internet connection without the use of other 3rd party applications?&lt;/p&gt;&#xA;" OwnerUserId="22729" LastActivityDate="2016-02-09T10:05:47.283" Title="Blocking certain websites using hosts file Windows/Mac" Tags="|internet|" AnswerCount="1" CommentCount="1" ClosedDate="2016-02-09T10:13:54.667" ContentLicense="CC BY-SA 3.0" />
  <row Id="26643" PostTypeId="2" ParentId="26642" CreationDate="2016-02-09T10:05:47.283" Score="1" Body="&lt;p&gt;Use a proper firewall to block access to required endpoints. Using hosts file is unreliable, as not all applications are using it to resolve hostnames to IP addresses. A starting point can be Windows Firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know what IP endpoints application is accessing you can use netstat (in all Win PCs) or Wireshark (need to download).&lt;/p&gt;&#xA;" OwnerUserId="12203" LastActivityDate="2016-02-09T10:05:47.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26644" PostTypeId="1" CreationDate="2016-02-09T10:05:59.817" Score="0" ViewCount="30" Body="&lt;p&gt;Trying to get my head around digital signatures and hit a slight block. The book I am using gives the following information&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Device A hashes a message to create a message digest &lt;/li&gt;&#xA;&lt;li&gt;Device A encrypts the digest with device A's private key to create a&#xA;signature &lt;/li&gt;&#xA;&lt;li&gt;Device A adds the signature to the message &lt;/li&gt;&#xA;&lt;li&gt;Device A encrypts the whole message (including the signature) using device B's public key&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Device A sends the message to device B&#xA;&lt;br&gt;&lt;br&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Device B decrypts the message with device B's private key &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Device B splits the signature off of the message &lt;/li&gt;&#xA;&lt;li&gt;Device B decrypts the signature using device A's public key to get&#xA;the message digest &lt;/li&gt;&#xA;&lt;li&gt;Device B hashes the message to get a message digest&lt;/li&gt;&#xA;&lt;li&gt;If the message digest device B created is the same as the one&#xA;decrpyted, the message has not been tampered with&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;All fine, but how does device B know what hashing algorithm was used to create the message digest?&lt;/p&gt;&#xA;" OwnerUserId="19719" LastEditorUserId="8499" LastEditDate="2018-02-16T04:22:17.537" LastActivityDate="2018-02-16T04:22:17.537" Title="How is a message digest decrypted?" Tags="|security|" AnswerCount="1" CommentCount="1" ClosedDate="2016-02-09T10:12:18.743" ContentLicense="CC BY-SA 3.0" />
  <row Id="26645" PostTypeId="2" ParentId="26644" CreationDate="2016-02-09T10:10:16.760" Score="1" Body="&lt;p&gt;The hashing method needs to be configured the same on both sides. It could be manually configured, or it could be negotiated during the connection set up. It all depends on the systems and software involved.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-09T10:10:16.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26646" PostTypeId="2" ParentId="26637" CreationDate="2016-02-09T10:13:39.523" Score="1" Body="&lt;p&gt;This isn't  a bug. Firstly, yes, the VLAN names are too long to be shown in the Menu interface. Secondly, there's a limit on how many VLANs you can see in the menu in the first place - 32. Your VLAN 200 is the 32nd, so no new VLANs can be shown. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Menu interface of ProCurve / ProVision switches is limited. Same applies to the Web GUI. Stuggi's right, you should get comfy with the CLI. That's the only interface with full management capabilities. &lt;/p&gt;&#xA;" OwnerUserId="10799" LastEditorUserId="10799" LastEditDate="2016-02-09T10:20:00.753" LastActivityDate="2016-02-09T10:20:00.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26649" PostTypeId="2" ParentId="26631" CreationDate="2016-02-09T12:49:53.837" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is, can each client receive the resource on the server @&#xA;  100Mbps speed, meaning that there is a total of 600Mbps bandwidth&#xA;  remaining or is the 1Gbps shared over 4 connections?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Link utilization will depend on how applications+protocols work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, one could have the server trying to send a constant-rate 2Gbps multicast stream that the four clients would like to receive.&#xA;However, the 1Gbps server link will drop half of the traffic, and receivers' 100Mbps link will only be able to deliver 5% of the original traffic (100Mbps/2000Mbps).&#xA;And all this while links are running at full capacity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If however, you are running an web server, and all your traffic is HTTP, the traffic pattern is likely:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;every client would be limited to its 100Mbps link.&lt;/li&gt;&#xA;&lt;li&gt;the server 1Gbps link would run at most at 400Mbps.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="498" LastEditorUserId="498" LastEditDate="2016-02-09T13:00:03.813" LastActivityDate="2016-02-09T13:00:03.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26650" PostTypeId="1" AcceptedAnswerId="26674" CreationDate="2016-02-09T13:16:29.603" Score="0" ViewCount="249" Body="&lt;p&gt;Ive got a setup where im using 5 x Ubquity UAP AC PROs as wireless access points. The rest of the wired network is connected straight from the smart switch (Netgear GS716T), via a patch panel, to a mixture of AV / TV devices (sonos, TVs, set top boxes etc) and in wall cat6 sockets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im going to add some of the cat6 sockets to a VLAN and filter their traffic via openDNS. (the rest of them and the AV / TV devices will be unfiltered). This will be done via the smart switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the wireless network im going to setup a main and a guest network. The main network will be unfiltered and the guest network will be filtered through openDNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where ive got the issue, the wireless (main &amp;amp; guest) network is setup and managed via the Ubquity controller, but i cant setup DNS filtering through there, this needs to be done on the network smart switch. As the each wifi access points would be plugged into a port, that port would be filtered or not, because both the guest and and main network go through that port, both the guest and the main network would then have the same filtering. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way i could tag / identify the wireless guest network so although both the main the guest wireless network are running through the same port only the guest wireless traffic would be filtered and not the main wireless traffic ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could this be done by targeting the SSID or some other method ? &lt;/p&gt;&#xA;" OwnerUserId="19472" LastActivityDate="2016-02-10T06:25:32.867" Title="Only DNS filter guest wireless network, but not main wireless network running through same port on switch" Tags="|switch|dns|route-filter|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26651" PostTypeId="1" CreationDate="2016-02-09T14:22:57.910" Score="2" ViewCount="72" Body="&lt;p&gt;I have a domain name that is using a public IP, when I send two requests, one to the domain name and one to the IP I get different headers in each one, in one of them 4 cookies are set, in the other one only 2 are set. Using nslookup and some online tools, I can see the domain name is linked with the ip, so I'm finally testing the same thing (IP and domain name) but getting different responses. The public IP is translated into one private inside my LAN, the firewall that is making this does not insert anything. This is really weird.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can be wrong?&lt;/p&gt;&#xA;" OwnerUserId="22736" LastEditorUserId="8499" LastEditDate="2018-02-16T03:57:52.663" LastActivityDate="2018-02-16T03:57:52.663" Title="Different responses IP and domain name" Tags="|internet|troubleshooting|" AnswerCount="1" CommentCount="2" ClosedDate="2016-02-09T18:31:32.347" ContentLicense="CC BY-SA 3.0" />
  <row Id="26652" PostTypeId="1" CreationDate="2016-02-09T14:32:01.070" Score="1" ViewCount="1843" Body="&lt;p&gt;I've just moved into a new shared office and bought a Gigabit switch to add ethernet sockets to the network, in addition to having WiFi access from a shared wireless access point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've connected all devices up to the network and setup static IP's for each device. I haven't touched the wireless access point's configuration as it's shared for the office and I don't want to screw up anyone else's internet access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a quick diagram to show an overview of the office's network setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/30Qky.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/30Qky.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I'm having is that no device on the network has internet access (except for devices connecting through the router). However, each device &lt;strong&gt;can&lt;/strong&gt; communicate with each other if I ping one device from another. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the best way of debugging this issue? I'm no genius when it comes to networking, but I know the basics. I need internet access from the NAS and as it's a &lt;strong&gt;wired&lt;/strong&gt; device I can't access files from it remotely. I can connect to the internet through the shared wireless access point, but this kind of defeats me buying the additional hardware to setup the network like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried messing around with ip configurations for hours, as well as contacting I.T support for the office space but they didn't know what was wrong and said just to use the Wifi. I have a feeling some sort of restriction may be in place higher up in the network which is out of my control which says only the router's mac address is allowed internet. Is this a possibility? Any advice would be appreciated!&lt;/p&gt;&#xA;" OwnerUserId="22735" LastEditorUserId="22735" LastEditDate="2016-02-09T14:37:34.830" LastActivityDate="2016-02-09T16:30:38.263" Title="Multiple devices connected over Gigabit switch but no internet access?" Tags="|switch|router|wireless|ipv4|network-access|" AnswerCount="2" CommentCount="4" ClosedDate="2016-02-10T16:06:33.183" ContentLicense="CC BY-SA 3.0" />
  <row Id="26654" PostTypeId="2" ParentId="26652" CreationDate="2016-02-09T14:42:56.223" Score="1" Body="&lt;p&gt;If all connected devices can conmmunicate each other, then you should see if you have put the default gateway in all your pcs. Also, if your switch are capable, can put some loopback interfaces in, eg, your gigabit switch 1, to troubleshoot from here to your network, and tried a ping test from here to your pc, notice that this ip address mus be in the same network of your equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From here, you need to review your connectivity, and see if you are good with the distances for UTP(100 meters) and cable types used(crossover cables for the connections between switches)&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-02-09T14:42:56.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26657" PostTypeId="2" ParentId="26651" CreationDate="2016-02-09T16:22:54.580" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I have a domain name that is using a public IP, when I send two requests, one to the domain name and one to the IP I get different headers in each one, in one of them 4 cookies are set, in the other one only 2 are set.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(...)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What can be wrong?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Make sure your HTTP client is sending the same request for both cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Request line format: &lt;code&gt;Method SP Request-URI SP HTTP-Version CRLF&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exemple for request line: &lt;code&gt;GET http://www.w3.org/pub/WWW/TheProject.html HTTP/1.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In example above, Request-URI is &lt;code&gt;http://www.w3.org/pub/WWW/TheProject.html&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your client puts an IP addresses in the place of the hostname &lt;code&gt;www.w3.org&lt;/code&gt;, the web server might issue a different result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also: &lt;a href=&quot;https://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html&quot; rel=&quot;nofollow&quot;&gt;https://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-09T16:22:54.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26658" PostTypeId="2" ParentId="26652" CreationDate="2016-02-09T16:30:38.263" Score="0" Body="&lt;p&gt;You could try to remove all static IP addresses and let your PCs and NAS to get the IP address automatically. If there is a dhcp server, you should get the proper IP configuration together with the gateway address. If not, continue with IT support.&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-02-09T16:30:38.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26659" PostTypeId="1" AcceptedAnswerId="26661" CreationDate="2016-02-09T16:30:56.013" Score="2" ViewCount="1519" Body="&lt;p&gt;Can we send raw IP packets over UDP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are raw IP Packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP is a connectionless and unreliable protocol, is it?&lt;/p&gt;&#xA;" OwnerUserId="22744" LastEditorUserId="8499" LastEditDate="2016-12-18T19:21:50.987" LastActivityDate="2016-12-19T14:57:06.437" Title="Sending raw IP packets over UDP" Tags="|udp|layer4|" AnswerCount="3" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26660" PostTypeId="1" AcceptedAnswerId="26666" CreationDate="2016-02-09T17:20:30.073" Score="1" ViewCount="1445" Body="&lt;p&gt;I am trying to configure WAN redundancy across a pair of links, using ip sla to monitor link state and switch routes if one fails. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The design uses Loopback0 as a NAT interface, with the two WAN interfaces as transit networks. The ISP routers will have dynamic routing such that the IP assigned to Loopback0 will be accessible over either link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The config currently looks like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;track 100 ip sla 1 reachability&#xA;!&#xA;interface Loopback0&#xA; ip address 1.2.3.224 255.255.255.254&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description COLT WAN&#xA; ip address 1.2.3.9 255.255.255.254&#xA; ip virtual-reassembly in&#xA; duplex full&#xA; speed 100&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description INSIDE LAN&#xA; ip address 172.200.0.1 255.255.0.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex full&#xA; speed 100&#xA;!         &#xA;interface GigabitEthernet0/1/0&#xA; description VODAFONE INTERCONNECT&#xA; switchport access vlan 100&#xA; no ip address&#xA; duplex full&#xA; speed 100&#xA; no cdp enable&#xA;!         &#xA;interface Vlan100&#xA; description VODAFONE WAN&#xA; ip address 1.2.3.135 255.255.255.254&#xA; ip virtual-reassembly in&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 1.2.3.134 track 100&#xA;ip route 0.0.0.0 0.0.0.0 1.2.3.8 200&#xA;!&#xA;ip sla 1&#xA; icmp-echo 1.2.3.134 source-ip 1.2.3.135&#xA; frequency 5000&#xA;ip sla schedule 1 life forever start-time now&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The router can ping &lt;code&gt;1.2.3.8&lt;/code&gt; and &lt;code&gt;1.2.3.134&lt;/code&gt;, and both of these can ping &lt;code&gt;1.2.3.224&lt;/code&gt;. I have also verified that the redundant routing works if one of the links are down, although this doesn't appear to have any relation to this NAT issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;code&gt;172.200.0.0/24&lt;/code&gt; I am able to ping &lt;code&gt;172.200.0.1&lt;/code&gt;, &lt;code&gt;1.2.3.224&lt;/code&gt;, &lt;code&gt;1.2.3.9&lt;/code&gt; and &lt;code&gt;1.2.3.135&lt;/code&gt; but not &lt;code&gt;1.2.3.8&lt;/code&gt; or &lt;code&gt;1.2.3.134&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="22741" LastActivityDate="2016-02-09T19:48:19.550" Title="Cisco IOS multi WAN with NAT on Loopback0 with ip sla" Tags="|cisco|nat|loopback|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26661" PostTypeId="2" ParentId="26659" CreationDate="2016-02-09T17:38:36.307" Score="2" Body="&lt;p&gt;IP packets are layer 3.  UDP is layer 4.   That means that UDP packets are encapsulated &lt;em&gt;inside&lt;/em&gt; IP packets, not the other way around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, it is possible to tunnel IP packets, in which case you would have IP inside UDP inside another IP, but that is a special case.  For learning about the protocols, you can ignore that for now&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-09T17:38:36.307" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="26662" PostTypeId="2" ParentId="26660" CreationDate="2016-02-09T17:38:53.123" Score="0" Body="&lt;p&gt;The problem is that traffic to internet is routed directly to the WAN ports, and thus are not NATted. To achieve what you want, you need a default route pointing at your &quot;outside&quot; interface, which in this case is your loopback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, just adding a static route pointing to your loopback wont work, because the NATted traffic needs to be routed also. So you have to create a routemap for policy based routing, steering only &quot;unNATted&quot; traffic to the loopback interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gi0/1 &#xA; ip policy route-map loopback-nat&#xA;&#xA;access-list 101 permit ip 172.200.0.1 0.0.255.255 any &#xA;&#xA;route-map loopback-nat permit 10&#xA; match ip address 101&#xA; set interface Loopback0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is assuming that the rest of your NAT configuration is correct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list 101 interface Loopback0 overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/6505-nat-on-stick.html&quot; rel=&quot;nofollow&quot;&gt;this article&lt;/a&gt; for more explanation.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastEditorUserId="8049" LastEditDate="2016-02-09T19:02:12.080" LastActivityDate="2016-02-09T19:02:12.080" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="26664" PostTypeId="1" AcceptedAnswerId="26667" CreationDate="2016-02-09T18:59:37.543" Score="11" ViewCount="699" Body="&lt;p&gt;RFCs such as &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5952&quot; rel=&quot;nofollow noreferrer&quot;&gt;5952 - &amp;quot;A Recommendation for IPv6 Address Text Representation&amp;quot;&lt;/a&gt; and&#xA;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2373&quot; rel=&quot;nofollow noreferrer&quot;&gt;2373 - &amp;quot;IP Version 6 Addressing Architecture&amp;quot;&lt;/a&gt; each outline the commonly used hexadecimal and colon based notation that is typically used for representing an IPv6 address, or the leading portion of an IPv6 CIDR.&lt;/p&gt;&#xA;&lt;p&gt;E.g. &lt;em&gt;2001:0db8:85a3::8a2e:0370:7334&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;However, the RFCs do not appear to suggest a name for this ubiquitous format.&#xA;Is there a name for this format, similar to how IPv4 has a named &lt;a href=&quot;https://en.wikipedia.org/wiki/Dot-decimal_notation&quot; rel=&quot;nofollow noreferrer&quot;&gt;dot-decimal notation&lt;/a&gt;? If so, what is the proper name to use when referring to this standard IPv6 notation?&lt;/p&gt;&#xA;" OwnerUserId="22751" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2022-03-27T15:10:27.250" Title="What is the proper name for hexadecimal like standard notation of an IPv6 address?" Tags="|ipv6|rfc|terminology|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26665" PostTypeId="1" AcceptedAnswerId="26668" CreationDate="2016-02-09T19:00:21.193" Score="2" ViewCount="1553" Body="&lt;p&gt;If we are sending packets to a router, are we only allowed to have 1 packet on the &quot;link&quot; at a time? So if I have 2 packets, do I have to wait for the first packet to reach the router before I can start transmitting the second packet onto link? This would mean that the transmission delay is lower than the propagation delay then if I am correct?&lt;/p&gt;&#xA;" OwnerUserId="22754" LastActivityDate="2016-02-09T19:18:54.130" Title="Is it possible to send multiple packets on a single link to a router?" Tags="|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26666" PostTypeId="2" ParentId="26660" CreationDate="2016-02-09T19:02:15.830" Score="0" Body="&lt;p&gt;I think you are doing this incorrectly. The WAN failover should be independent of your NAT. Try something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;track 100 ip sla 1 reachability&#xA;!&#xA;interface Loopback0&#xA; ip address 1.2.3.224 255.255.255.254&#xA; ip virtual-reassembly in&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description COLT WAN&#xA; ip address 1.2.3.9 255.255.255.254&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex full&#xA; speed 100&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description INSIDE LAN&#xA; ip address 172.200.0.1 255.255.0.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex full&#xA; speed 100&#xA;!         &#xA;interface GigabitEthernet0/1/0&#xA; description VODAFONE INTERCONNECT&#xA; switchport access vlan 100&#xA; no ip address&#xA; duplex full&#xA; speed 100&#xA; no cdp enable&#xA;!         &#xA;interface Vlan100&#xA; description VODAFONE WAN&#xA; ip address 1.2.3.135 255.255.255.254&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA;!&#xA;ip nat inside source list 10 interface Loopback0 overload&#xA;!&#xA;access-list 10 permit 172.200.0.0 0.0.255.255&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 1.2.3.134 track 100&#xA;ip route 0.0.0.0 0.0.0.0 1.2.3.8 200&#xA;!&#xA;ip sla 1&#xA; icmp-echo 1.2.3.134 source-ip 1.2.3.135&#xA; frequency 5000&#xA;ip sla schedule 1 life forever start-time now&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You NAT from the inside interface &lt;code&gt;GigabitEthernet0/1&lt;/code&gt; to the outside interfaces &lt;code&gt;GigabitEthernet0/0&lt;/code&gt; and &lt;code&gt;Vlan100&lt;/code&gt;. You use the &lt;code&gt;Loopback0&lt;/code&gt; interface as the address for the translation, not an outside interface, with the &lt;code&gt;ip nat inside source list 10 interface Loopback0 overload&lt;/code&gt; command.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-09T19:48:19.550" LastActivityDate="2016-02-09T19:48:19.550" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26667" PostTypeId="2" ParentId="26664" CreationDate="2016-02-09T19:15:28.293" Score="10" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5952&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5952&lt;/a&gt; gives you the canonical IPv6 format. That is explained in the RFC itself:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This document defines a canonical textual representation format.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;4.  A Recommendation for IPv6 Text Representation&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;A recommendation for a canonical text representation format of IPv6&#xA;addresses is presented in this section.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;There are people who incorrectly call a fully uncompressed (eight words of four hexadecimal digits each) the canonical format but the RFC refer to this as conventional notation.&lt;/p&gt;&#xA;&lt;p&gt;When zero words are replaced with &lt;code&gt;::&lt;/code&gt; it is a compressed address format, and when used with IPv4 notation, such as &lt;code&gt;::ffff:10.11.12.13&lt;/code&gt; it is a mixed, or compressed and mixed, address format.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit based on the question edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;There is no official name for the IPv6 notation, but RFC 5952, among others, refers to it as &lt;code&gt;hexadecimal&lt;/code&gt; notation.&lt;/p&gt;&#xA;&lt;p&gt;Even the IPv4 address notation commonly called &lt;code&gt;dotted-decimal&lt;/code&gt; notation is not really in any RFC defining IPv4. It is mentioned in &lt;a href=&quot;https://www.ietf.org/rfc/rfc3795.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3795, Survey of IPv4 Addresses in Currently Deployed IETF Application Area Standards Track and Experimental Documents&lt;/a&gt;, an informational RFC which specifically states:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This memo provides information for the Internet community.  It does&#xA;not specify an Internet standard of any kind.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In conclusion, there is no official name for the general IPv6 format, and you may call it whatever you wish. I think it is important to distinguish between the various IPv6 address formats. My company has a requirement to use the RFC 5952 canonical format rather than the conventional format.&lt;/p&gt;&#xA;&lt;p&gt;Note: I left the rest of my answer in as useful information.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-02-09T21:47:52.303" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26668" PostTypeId="2" ParentId="26665" CreationDate="2016-02-09T19:18:54.130" Score="3" Body="&lt;p&gt;Packets are serialized and sent one bit at a time, and the bits from each packet cannot be mixed because the receiving end has no way to sort out which bits received belong to which packet, so one packet at a time is sent on a link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-09T19:18:54.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26670" PostTypeId="1" AcceptedAnswerId="26673" CreationDate="2016-02-10T00:43:39.077" Score="1" ViewCount="10149" Body="&lt;p&gt;I'm very confused by Cisco versions, but perhaps I'm just over thinking it. Are IOs versions and ASA versions the same? E.g. If I have an ASA 5510 and I type &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it comes back with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco Adaptive Security Appliance Software Version 8.3(2)&#xA;Device Manager Version 6.9(4)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;does that mean it's running IOS 8.3? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or will accept IOS 8.3 level commands?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or do ASA devices have their own version separate from the IOS versions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(p.s. the version numbers above are made up so they won't make sense). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;More generally, how do you know which commands a Cisco device is going to accept? If you show up at a clients and start trying to do named access lists (which apparently started with IOS 11.2?) how do you know if they are going to work? Or do you just try, curse and revert to older commands on the fly if they aren't recognized?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've searched long and hard and nothing seems to show what versions which commands should work on.&lt;/p&gt;&#xA;" OwnerUserId="22760" LastActivityDate="2016-02-10T04:17:25.293" Title="Cisco IOS versions vs Cisco ASA versions?" Tags="|cisco|cisco-asa|cisco-ios|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26671" PostTypeId="1" AcceptedAnswerId="26672" CreationDate="2016-02-10T02:29:14.380" Score="1" ViewCount="1358" Body="&lt;p&gt;Currently I am learning about load balance method available on SonicWALL. I have some question regarding the load balance methods for 1) round robin 2) spill over 3) percentage. Assuming there are two connection available for Internet connection:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does round robin utilize all link so the bandwidth throughput&#xA;will be increased, for example if we had two 4 Mbps connection so the&#xA;total throughput will be 8 Mbps?&lt;/li&gt;&#xA;&lt;li&gt;In spill over, does it also will increase bandwidth throughput if the&#xA;primary link is overloaded?&lt;/li&gt;&#xA;&lt;li&gt;Percentage makes me a bit confused. If I have 2 links, can I use both&#xA;links 100%? What is the downside if you assign 100% for both links?&lt;/li&gt;&#xA;&lt;li&gt;How do I chose the correct method, and can someone explain and give me&#xA;an explanation on how to chose those method based on&#xA;situation/advantage/disadvantages?&lt;/li&gt;&#xA;&lt;li&gt;Will all of those methods be shifted to the secondary link if the primary link fails?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8154" LastEditorUserId="8499" LastEditDate="2016-02-10T04:58:24.683" LastActivityDate="2016-02-10T04:58:24.683" Title="SonicWALL Load Balance Term" Tags="|router|internet|sonicwall|failover|load-balancing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26672" PostTypeId="2" ParentId="26671" CreationDate="2016-02-10T02:47:28.877" Score="0" Body="&lt;p&gt;A quick Internet search turns up &lt;a href=&quot;http://help.mysonicwall.com/sw/eng/405/ui2/23100/Network/WAN_Failover_Load_Balancing.htm&quot; rel=&quot;nofollow&quot;&gt;Network &gt; WAN Failover &amp;amp; LB&lt;/a&gt; directly from the source:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You need to choose a load balancing method. By default, the SonicWALL&#xA;  will select Basic Active/Passive Failover as the method, but there are&#xA;  four load balancing methods available:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Basic Active/Passive Failover: When this setting is selected, the    SonicWALL security appliance only sends traffic through the Secondary &#xA;  WAN interface if the Primary WAN interface has been marked inactive. &#xA;  The SonicWALL security appliance is set to use this as the default &#xA;  load balancing method. If the Primary WAN fails, then the SonicWALL &#xA;  security appliance reverts to this method instead of the ones &#xA;  described below. This mode will automatically return back to using &#xA;  the Primary WAN interface once it has been restored (Preempt and &#xA;  failback to Primary WAN when possible setting) preempt mode). This &#xA;  item has an associated Preempt and fail back to Primary WAN when &#xA;  possible checkbox. When this checkbox is selected, the SonicWALL &#xA;  security appliance switches back to sending its traffic across the &#xA;  Primary WAN interface when it resumes responding to the SonicWALL &#xA;  security appliance’s checks (the WAN’s physical link is restored, or &#xA;  the logical probe targets on the WAN port resume responding).&lt;/li&gt;&#xA;  &lt;li&gt;Per Connection Round-Robin: When this setting is selected, the    SonicWALL security appliance load-balances outgoing traffic on a &#xA;  per-destination basis. This is a simple load balancing method and, &#xA;  though not very granular, allows you to utilize both links in a basic &#xA;  fashion (instead of the method above, which does not utilize the &#xA;  capability of the Secondary WAN until the Primary WAN has failed). &#xA;  The SonicWALL security appliance needs to examine outbound flows for &#xA;  uniqueness in source IP and destination IP and make the determination &#xA;  as to which interface to send the traffic out of and accept it back &#xA;  on. Please note this feature will be overridden by specific static &#xA;  route entries.&lt;/li&gt;&#xA;  &lt;li&gt;Spillover-Based: When this settings is selected, the user can specify  when the SonicWALL security appliance starts sending traffic&#xA;  through the Secondary WAN interface. This method allows you to control&#xA;  when and if the Secondary interface is used. This method is used if&#xA;  you do not want outbound traffic sent across the Secondary WAN unless&#xA;  the Primary WAN is overloaded. The SonicWALL security appliance has a&#xA;  non-Management Interface exposed hold timer set to 20 seconds – if the&#xA;  sustained outbound traffic across the Primary WAN interface exceeds&#xA;  the administrator defined Kbps, then the SonicWALL security appliance&#xA;  spills outbound traffic to the Secondary WAN interface (on a&#xA;  per-destination basis). The user entry box should not have a default&#xA;  entry and be left empty for the user. Please note this feature will be&#xA;  overridden by specific static route entries.&lt;/li&gt;&#xA;  &lt;li&gt;Percentage-Based: When this setting is selected, you can specify the    percentages of traffic sent through the Primary WAN and&#xA;  Secondary WAN    interfaces. This method allows you to actively&#xA;  utilize both Primary    and Secondary WAN interfaces. Only one entry&#xA;  box is required    (percentage for Primary WAN), as the SonicWALL will&#xA;  auto-populate a    non-user-editable entry box with the remaining&#xA;  percentage assigned to    the Secondary WAN interface. Please note&#xA;  this feature will be    overridden by specific static route entries.&lt;/li&gt;&#xA;  &lt;li&gt;Use Source and Destination IP Addresses Binding: This checkbox enables you to maintain a consistent mapping of traffic flows with a&#xA;  single outbound WAN interface. This method uses only the source IP&#xA;  address and the destination IP address when establishing&#xA;  load-balancing assignments. The load-balancing nodes discards all&#xA;  other information, including source or destination TCP port numbers.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The SonicWALL assigns interfaces based on individual traffic flows (source IP address and TCP port to a destination IP address and TCP port). A single traffic flow will not be spread across multiple links. This prevents the problems caused by out-of-order packet delivery (slows TCP and kills many UDP applications, especially real-time traffic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Round-robin - A single traffic flow needing more bandwidth than a single link will still be capped at the bandwidth of the link to which it is assigned. With a lot of traffic flows, you will get close to the combined bandwidth of both links since different traffic flows will be assigned to different links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spillover-based - You specify at what percentage of the bandwidth the primary link uses before starting to use the secondary link, but, again, each traffic flow will only flow over a single link, so a traffic flow needing more than the configured percentage will not use the second link and be capped at the bandwidth of the primary link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Percentage-based -. You can define the the flow percentages each link gets. For instance primary 75%, secondary 25% will use the primary link for the first three flows, but the fourth flow (assuming the first three flows are still active) will be assigned to the secondary link. This is useful if the different links have disparate bandwidths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should consider that the primary use for multiple WAN connections is failover. If you use bandwidth larger than one link, you will be crippled to some degree in the event of a link failure. This may or may not matter to you, and management often says this doesn't matter until a failure actually happens.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-10T03:38:51.443" LastActivityDate="2016-02-10T03:38:51.443" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="26673" PostTypeId="2" ParentId="26670" CreationDate="2016-02-10T04:15:40.680" Score="9" Body="&lt;p&gt;Cisco has a whole bunch of different operating systems for a variety of products:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;IOS&lt;/strong&gt; runs on most Cisco routers and switches.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;IOS XE&lt;/strong&gt; is a more modern, modular version of IOS.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;IOS XR&lt;/strong&gt; runs on high-end routers.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;NX-OS&lt;/strong&gt; runs on the Nexus line of datacenter switches.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;ASA OS&lt;/strong&gt; runs on Cisco ASA devices.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;AireOS&lt;/strong&gt; runs on Access Points.&lt;/li&gt;&#xA;&lt;li&gt;And I'm probably forgetting a lot of other devices and appliances.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Version numbers for all these operating systems are unrelated. And even within the same OS there can be different release trains for different platforms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know which commands should work on a specific device, you can check the &lt;a href=&quot;http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp&quot;&gt;Cisco Feature Navigator&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastEditorUserId="8499" LastEditDate="2016-02-10T04:17:25.293" LastActivityDate="2016-02-10T04:17:25.293" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26674" PostTypeId="2" ParentId="26650" CreationDate="2016-02-10T06:25:32.867" Score="3" Body="&lt;p&gt;I assume you are using OpenDNS' web filtering functionality here, and it looks like that essentially involves using their DNS servers to handle lookups, rather than your own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could define two SSIDs, associate them with different VLANs (on a single physical port) behind the APs, and then simply differentiate the settings that you provide to clients over DHCP (since you have two vlans, you'll need two scopes). For a user in the guest vlan, your DHCP would provide the OpenDNS settings, for your standard unfiltered users you would provide settings pointing to your internal DNS or whatever else you want.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-02-10T06:25:32.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26678" PostTypeId="1" AcceptedAnswerId="26681" CreationDate="2016-02-10T12:44:32.307" Score="1" ViewCount="3214" Body="&lt;p&gt;Is it possible to set the privilege level of my account on a cisco switch from level 1 to level 15? if so, what command should i use? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have the enable password for the switch.&lt;/p&gt;&#xA;" OwnerUserId="22709" LastActivityDate="2016-02-10T14:07:12.743" Title="setting a users privilege level" Tags="|cisco|switch|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26679" PostTypeId="2" ParentId="26678" CreationDate="2016-02-10T14:00:29.280" Score="0" Body="&lt;p&gt;You can attach a privilege level to a local user account:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enable&#xA;conf t&#xA;username bob privilege 15 secret XXX&#xA;exit&#xA;write&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-10T14:00:29.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26681" PostTypeId="2" ParentId="26678" CreationDate="2016-02-10T14:01:37.753" Score="2" Body="&lt;p&gt;Thats can only be done by an user with more priviledges than you, it´s like root user and normal users, root can change what a normal user see. But if you have the enable password,.. you can try.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, the command is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username &quot;your_user&quot; privilege privilege-level&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, you can see more info here:&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/command/reference/fsecur_r/srfpass.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/command/reference/fsecur_r/srfpass.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2016-02-10T14:07:12.743" LastActivityDate="2016-02-10T14:07:12.743" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26683" PostTypeId="1" AcceptedAnswerId="26734" CreationDate="2016-02-10T15:42:04.947" Score="0" ViewCount="424" Body="&lt;p&gt;I'm using Meraki and I've created a VLAN (111) that broadcasts over its own SSID wirelessly. I've added the VLAN ID (111) to the HP hardware switches involved and added all ports as tagged to the VLAN in the configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can get internet and intranet access while associated on the new VLAN (111) but nothing can ping the devices on the 111 VLAN. I have not set up any additional firewall rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some additional hardware switch mapping i have to do to allow 2 way communication? Or where do i even start?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Procurve config:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/F7mFP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/F7mFP.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SSID config:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Tb4lp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Tb4lp.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN config:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aLDZP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aLDZP.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22773" LastEditorUserId="22773" LastEditDate="2016-02-10T16:05:51.897" LastActivityDate="2016-09-13T03:18:07.530" Title="VLAN can reach all other VLANs but nothing can reach it" Tags="|routing|switch|vlan|hp-procurve|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="26685" PostTypeId="2" ParentId="26343" CreationDate="2016-02-10T16:59:30.177" Score="2" Body="&lt;p&gt;This is possible using the top-of-tree Open vSwitch code (I tried with OVS 2.4, but couldn't get the &lt;code&gt;vport_geneve&lt;/code&gt; kernel module to load&amp;#8212;I admit I may have done something wrong). This procedure should get you there:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Start by cloning the OVS repository (&lt;code&gt;git clone https://github.com/openvswitch/ovs.git&lt;/code&gt;), then follow the instructions from the repository to compile, install, and run OVS. You'll need to do this on both servers, obviously. The servers need to be running Linux &gt;= 3.18 (I used kernel 3.19.0-49 on Ubuntu 14.04.2).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure the Open vSwitch and Geneve kernel modules are loading correctly (&lt;code&gt;sudo lsmod | grep openvswitch&lt;/code&gt;), and that commands like &lt;code&gt;ovs-vsctl show&lt;/code&gt; are working correctly before proceeding. If you are seeing errors, stop and go back over the instructions for compiling and installing OVS.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Add a bridge and Geneve port to each server:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ovs-vsctl add-br br-int&lt;br&gt;&#xA;ovs-vsctl add-port br-int geneve0 -- set interface geneve0 type=geneve options:remote_ip=&amp;lt;remote server address&amp;gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Now attach VMs (or network namespaces using veth pairs) to the OVS bridge you created on each server. These VMs/namespaces should be able to communicate with each other over the Geneve tunnel between the OVS instances. (Note that you'll have to perform manual IP configuration for these VMs/namespaces, as there is no DHCP running there.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Although I haven't written specifically about Geneve tunneling, examples of similar configurations can be found on my website. You can see a list of all OVS-related articles at &lt;a href=&quot;http://blog.scottlowe.org/tags/#OVS&quot; rel=&quot;nofollow&quot;&gt;http://blog.scottlowe.org/tags/#OVS&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="22775" LastActivityDate="2016-02-10T16:59:30.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26686" PostTypeId="1" AcceptedAnswerId="26688" CreationDate="2016-02-10T17:19:41.413" Score="1" ViewCount="391" Body="&lt;p&gt;I think this is a simple yes/no question but I may be wrong.  I work in a warehouse sized building where 4 networks are broadcasting but only 1 is being used, as in, no one logs in to the other networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, will this cause collisions or conflicts for the users/network that is being used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Sorry, first post here and was just 'given' the network.  I'll have to check the WAP's specifically but they are within range of each other but all on Ch 11 of the 2.4 GHz range.  Eventually, these networks will be split and used but as of now we only have traffic on 1 of the 4.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our office building has the these networks all on different channels.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The better question may be &quot;Will I see improvement on the used network if I stop the broadcast of the unused or change their channels?&quot;&lt;/p&gt;&#xA;" OwnerUserId="22776" LastEditorUserId="22776" LastEditDate="2016-02-10T17:34:50.210" LastActivityDate="2016-02-10T20:42:36.043" Title="Will wifi networks on same 2.4GHz channel conflict if only 1 is being used?" Tags="|wireless|subnet|troubleshooting|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26688" PostTypeId="2" ParentId="26686" CreationDate="2016-02-10T17:43:23.170" Score="0" Body="&lt;p&gt;Having WAPs in radio range of each other on the same channel is causing interference. You should look at adjusting the channels or positioning and radio power levels to reduce interference. If all the WAPs get used at the the same time, the interference will get worse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The proper way to do this is to get a wireless site survey performed. This will help you decide the proper quantity, placement, channels and radio power levels for optimum Wi-Fi performance, and help you identify possible radio shadows. It will also identify sources and frequencies of outside interference.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-10T17:43:23.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26692" PostTypeId="2" ParentId="26686" CreationDate="2016-02-10T20:42:36.043" Score="1" Body="&lt;p&gt;An AP is broadcasting beacons as long as the radio is enabled. (every 100ms by default) So it will cause interference as long as it's on, regardless of the number of clients associated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Hiding the SSID doesn't stop beacons; it only keeps the SSID(s) out of those beacons.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-02-10T20:42:36.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26693" PostTypeId="2" ParentId="26683" CreationDate="2016-02-10T21:03:13.797" Score="0" Body="&lt;p&gt;I could be way off base as I haven't touched a Procurve in a long time but I think because you have trunk ports configured on the Meraki that you need to trunk on the Procurve side as well and tag for the VLANs you want to pass. See this link for possibilities: &lt;a href=&quot;https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Recommended_Configuration_for_Trunk_Link_to_Non-Meraki_Switches&quot; rel=&quot;nofollow&quot;&gt;https://documentation.meraki.com/MS/Port_and_VLAN_Configuration/Recommended_Configuration_for_Trunk_Link_to_Non-Meraki_Switches&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="358" LastActivityDate="2016-02-10T21:03:13.797" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26694" PostTypeId="1" AcceptedAnswerId="26705" CreationDate="2016-02-10T21:38:28.090" Score="28" ViewCount="16844" Body="&lt;p&gt;I thought the 1000M ment that it was capable of Gigabit speed but it isn't, I noticed then that it stated 10/100Mbps. What does this 1000M mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/irX3P.jpg&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/irX3P.jpg&quot; alt=&quot;Network Switch 1000M vs 100Mbps&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22783" LastActivityDate="2016-06-08T09:07:01.460" Title="What does the 1000M on a network switch mean?" Tags="|switch|" AnswerCount="8" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26695" PostTypeId="2" ParentId="26694" CreationDate="2016-02-10T21:43:59.433" Score="42" Body="&lt;p&gt;It looks like ports 25 and 26 are gigabit ports, while 1-24 are 10/100 Mbps ports. It's quite common to have a couple of 1 Gbps ports on 10/100 Mbps switches as uplink ports.&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-10T21:43:59.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26696" PostTypeId="2" ParentId="26694" CreationDate="2016-02-10T21:44:21.320" Score="3" Body="&lt;p&gt;Notice that it has 2 SFP ports capable of 1 Gbps.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-10T21:44:21.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26697" PostTypeId="2" ParentId="26694" CreationDate="2016-02-10T21:44:27.157" Score="10" Body="&lt;p&gt;Ports 25/26 are capable of 1000Mbps. These would appear to be combo SFP/Copper ports, which will only allow you to use one or the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ports 1-24 are not.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-02-10T21:44:27.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26700" PostTypeId="1" AcceptedAnswerId="26704" CreationDate="2016-02-11T00:51:07.847" Score="1" ViewCount="217" Body="&lt;p&gt;I'm sorry for being basic in writing this question.  I think the details have been covered though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's happening here is, two separate networks are being brought into an isolated area over a microwave radio connection.  I may need to move the Layer 3 for these isolated devices to be on &lt;em&gt;their&lt;/em&gt; side of the microwave connection (the far side).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How will I have a single Layer 3 switch on the &lt;em&gt;far&lt;/em&gt; side of the microwave connection, be able to participate in OSPF areas for both segregated networks, and not break anything.  The networks are merged at the Layer 2 switches that connect to the microwave at both ends.  I use trunks and VLANs to re-separate the traffic here, but am lost about what to do with Layer 3/OSPF.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;NET A  (10.142.x.x)                                                    NET A               &#xA;OSPF AREA 7                                                            OSPF AREA 7&#xA;                       L2 SWITCH (to) MICROWAVE RADIO (to) L2 SWITCH &#xA;NET B  (10.143.x.x)                                                    NET B&#xA;OSPF AREA 107                                                          OSPF AREA 107&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="7534" LastEditorUserId="8499" LastEditDate="2020-01-10T09:49:48.293" LastActivityDate="2020-01-10T09:49:48.293" Title="Segregated OSPF Networks, cross same physical path, how to segregate back out at other end?" Tags="|cisco|routing|switch|ospf|cisco-catalyst|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26701" PostTypeId="1" AcceptedAnswerId="26703" CreationDate="2016-02-11T01:22:57.840" Score="5" ViewCount="191" Body="&lt;p&gt;At one time IPv6 was supposed to have built-in security. I don't know how it was supposed to be implemented, but my guess is that perhaps, if your stack and application supported it, you could simply click a button which would secure the connection in an opportunistic way, or connect securely but fall back to insecure if not supported, similar to how the Philip Zimmerman's zfone works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happened to this? Is it in use, or is it an optional feature, which could be implemented down the road? Is it a standard, and what is the name of it?&lt;/p&gt;&#xA;" OwnerUserId="5231" LastEditorUserId="5231" LastEditDate="2017-08-13T15:40:52.263" LastActivityDate="2017-08-13T15:40:52.263" Title="IPv6 built-in security?" Tags="|ipv6|security|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26702" PostTypeId="2" ParentId="26525" CreationDate="2016-02-11T02:31:06.013" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to configure server to assign same IP addresses to each username every time?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you configure the 1921 LNS to request authentication from a RADIUS server, yes, it is possible, since you can use RADIUS to attach a specific address for every user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know whether it is possible with local user authentication on the Cisco router itself.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-11T02:31:06.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26703" PostTypeId="2" ParentId="26701" CreationDate="2016-02-11T02:36:44.487" Score="6" Body="&lt;p&gt;To be honest, it's a bit of a botched job. People (including Big Name Vendors) still look at IPSec as a means of tunneling. In IPv6, the IPSec headers were meant to allow any socket from any application to be encrypted. The only system I'm aware of doing this is &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/ipv6/command/reference/ipv6_book/ipv6_08.html#wp2228381&quot;&gt;Cisco's OSPFv3 security&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-02-11T02:36:44.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26704" PostTypeId="2" ParentId="26700" CreationDate="2016-02-11T03:01:42.163" Score="2" Body="&lt;p&gt;Just remember that OSPF areas are assigned by interface, and OSPF areas, like 7 and 107 that you show, cannot directly exchange routes. The separate VLANs will use separate SVI interfaces, and each interface can be in a different OSPF area. You could have the layer-3 switch be in both areas without any problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also have separate OSPF processes if you want, but that seems unnecessary since you have different area numbers. Separate OSPF processes will allow you to have the same area number without mixing the two separate areas.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-11T03:07:48.053" LastActivityDate="2016-02-11T03:07:48.053" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26705" PostTypeId="2" ParentId="26694" CreationDate="2016-02-11T03:28:22.790" Score="33" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I thought the 1000M ment that it was capable of Gigabit speed&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The 1000M is clearly labelling indicator lights showing that the ports in question are running at gigabit speeds.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;but it isn't, I noticed then that it stated 10/100Mbps. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Have you tested all the ports?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The line you highlighted part of says&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;24 port 10/100 + 2 SFP/1000T combo&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;24 port 10/100&quot; indicates that your switch has 24 ports that are capable of 10/100 speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;2 SFP/1000T combo&quot; indicates that your switch has two gigabit ports which can be used either directly for 1000BASE-T copper or used with a SFP module (for gigabit fiber).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since only ports 25 and 26 have &quot;1000M&quot; lights it's pretty clear that ports 1-24 are the 10/100 ports and ports 25-26 are the gigabit ports. If you connect two devices to ports 25 and 26 you should get gigabit speeds between them. If you don't you might want to check the configuration to make sure noone has locked the ports to a lower speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's very common in switches to have a couple of ports that are faster than the rest. This makes sense because in general you want your backbones to be faster than your access ports.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-02-12T10:11:59.287" LastActivityDate="2016-02-12T10:11:59.287" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26706" PostTypeId="1" CreationDate="2016-02-11T04:09:44.897" Score="1" ViewCount="4831" Body="&lt;p&gt;I am investigating some CPEs that might not be properly tagging frames. What can I use to reliably capture the raw packet with 802.1q tag? It becomes a problem because the driver/firmware might be stripping the tag before the packet is passed on to wireshark/tcpdump. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same goes with generating tagged traffic. How can I know for sure the frames sent out on the wire are actually tagged when I generate QinQ frames with Ostinato, but the OS driver (such as Windows 10 + Intel ANT) doesn't  even support VLAN features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NICs I am using are all Intel (i340-T4 etc). The CPE in question are some Mikrotik RB4xx/7xx with Atheros switching chip and some unmanaged switches (testing how they handled tagged frames). I suspect there are some bugs in switch chip tagging that's why I don't decided to take a look into what's actually being sent/received. From what I have read most Intel NICs process VLAN tags in hardware and do not pass it up.&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2016-02-11T15:26:40.300" LastActivityDate="2016-08-09T21:10:48.863" Title="How to reliably see VLAN tags on a client?" Tags="|vlan|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26707" PostTypeId="1" AcceptedAnswerId="33216" CreationDate="2016-02-11T05:18:58.457" Score="1" ViewCount="91" Body="&lt;p&gt;I have some 2920 that are running in our DC which for some reason was never stacked, and now I'd like to fix that after the fact. I have all the gear, and I've done stack installations on brand new switches before, but what I can't find any info on is what will happen with the port configurations on the switches when you stack them? Will the be kept or do I have to redo them?&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-08-17T22:02:51.567" Title="Stacking HPE 2920" Tags="|hp|hp-procurve|stacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26709" PostTypeId="2" ParentId="26706" CreationDate="2016-02-11T05:59:00.510" Score="1" Body="&lt;p&gt;By client, do you mean a host like a PC?. Most don't understand VLAN tags, and the switch ports to which it is connected is probably an access ports which doesn't send VLAN tags, anyway. If you have a host that does send VLAN tags, you need to make sure that it is connected to a trunk port which allows that VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, you use what the switch has built in to see VLANs from the trunks. This varies by switch model. Managed switches will tag VLANs on the trunks if properly configured. You need to make sure that the trunks are set to allow all the VLANs which you are expecting.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-11T05:59:00.510" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26710" PostTypeId="1" AcceptedAnswerId="26711" CreationDate="2016-02-11T06:20:59.010" Score="5" ViewCount="21432" Body="&lt;p&gt;What is the difference between Switch Fabric Capacity and Forwarding Rate of a switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what other types of speed or bandwidth are there for switching?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ld8P0.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ld8P0.png&quot; alt=&quot;Here&amp;#39;s the image from Dell N2000 series Switches comparison&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16870" LastEditorUserId="8499" LastEditDate="2020-02-09T20:50:34.563" LastActivityDate="2020-02-09T20:50:34.563" Title="Switch Fabric Capacity vs Forwarding Rate" Tags="|switch|switching|bandwidth|speed|switching-modes|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26711" PostTypeId="2" ParentId="26710" CreationDate="2016-02-11T07:05:31.537" Score="3" Body="&lt;p&gt;Remember that what you are looking at is marketing material.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Switch Fabric Capacity is listed in bits per second (bps) and is usually double what it really does since the vendors count full duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Forwarding Rate is measured in packets per second (pps) and is based on an arbitrary packet size which make the vendor look good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really need to dig into each switch individually to uncover the dirt. For instance, I know of a particular switch which has respectable backplane numbers, but when you look at the 10 Gb line cards, each three ports use a single ASIC which is only capable of 12 Gbps. You would need to use one 10 Gb SFP+ and two 1 Gb SFPs on a single ASIC to use it without lost frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a question for which the answer depends on the make and model of the switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-11T07:05:31.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26713" PostTypeId="1" CreationDate="2016-02-11T08:42:27.823" Score="2" ViewCount="1243" Body="&lt;p&gt;In the below image what would be the ip address in the outer ip header when packet goes from R1 to R2. If the ip address in the outer header is 172.16.0.1 , how does it travels the internet as its not a public ip address ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GWp5q.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GWp5q.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22793" LastEditorUserId="22793" LastEditDate="2016-02-11T13:24:50.060" LastActivityDate="2016-02-23T20:05:06.143" Title="Packet flow in GRE Tunnel" Tags="|vpn|ipsec|tunnel|gre|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26714" PostTypeId="1" AcceptedAnswerId="26715" CreationDate="2016-02-11T09:02:36.240" Score="0" ViewCount="843" Body="&lt;p&gt;We are having a cisco layer 3 switch and a layer 2 switch. We don't have access to the cisco layer 3 switch(Its access is with higher authorities). I am having a PXE server configured which is connected to layer 3 switch. Layer 2 switch is cisco 2960 series switch is also connected from the layer 3 switch, and is configured for different vlan and also DHCP (with snooping enabled) configured.Snooping is enabled in layer2 switch, so that only the DHCP ips from this switch will be given. I am able to connect to PXE server from the PC which is connected to layer3 switch. But when I tried using it from PC connected to layer2 switch, I am not able to boot with PXE server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please tell me what are the things need to be done for accessing PXE server.&lt;/p&gt;&#xA;" OwnerUserId="15397" LastActivityDate="2016-02-11T10:23:33.257" Title="Problem Accessing PXE server from a different vlan using Cisco switch" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="2" ClosedDate="2016-02-12T21:26:48.183" ContentLicense="CC BY-SA 3.0" />
  <row Id="26715" PostTypeId="2" ParentId="26714" CreationDate="2016-02-11T10:23:33.257" Score="0" Body="&lt;p&gt;You need to configure IP helper on the router to make the PXE-boot packages transverse broadcast domains, aka. if your PXE server is in another subnet than your clients, you need to tell the router to forward broadcasts to the PXE server. It's quite similar to how you get a DHCP server to issue leases in a non-local subnet. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-11T10:23:33.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26717" PostTypeId="2" ParentId="26706" CreationDate="2016-02-11T10:31:56.053" Score="0" Body="&lt;p&gt;It shouldn't be impossible since you essentially have the same problem with WLAN-cards, they also hide all the ugly business with WiFi from the OS, and only give it the ethernet frames. But there's still software available that let's you see all the WiFi specific packet info. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check how different NICs handle VLAN tagging when you generate packages. A lot of NICs these days have VLAN support, and they should be your best bet if you want to generate traffic with VLAN tags, since they obviously know how to tag traffic correctly. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-11T10:31:56.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26719" PostTypeId="1" AcceptedAnswerId="26725" CreationDate="2016-02-11T13:26:03.977" Score="1" ViewCount="203" Body="&lt;p&gt;Ive got a project where i have to use some existing wiring and some new wiring as we can not run new wiring in one part of the building.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment my network diagram looks like this &lt;a href=&quot;https://i.stack.imgur.com/hpcKs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hpcKs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Becuase i cant run a new cable direct from the router to the switch i was thinking of using cat6 rj45 couplers like this - &lt;a href=&quot;http://www.amazon.co.uk/gp/product/B00QV2KJJS?psc=1&amp;amp;redirect=true&amp;amp;ref_=oh_aui_search_detailpage&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.amazon.co.uk/gp/product/B00QV2KJJS?psc=1&amp;amp;redirect=true&amp;amp;ref_=oh_aui_search_detailpage&lt;/a&gt; - I know this is a non solution, but would using something like this strip out VLAN info that was set on the switch and prevent it from reaching the router ? &lt;/p&gt;&#xA;" OwnerUserId="19472" LastEditorUserId="8499" LastEditDate="2019-01-03T02:09:34.897" LastActivityDate="2022-12-02T17:02:24.440" Title="Would using a cat6 rj45 coupler strip VLAN out when connecting 2 VLAN aware devices ?" Tags="|layer1|cable|cabling|utp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26720" PostTypeId="2" ParentId="26719" CreationDate="2016-02-11T13:48:40.427" Score="3" Body="&lt;p&gt;If your devices are not 10G, your coupler should work, I've seen it in practice. The idea of stripping out the VLAN info seems to be very strange, you'd rather lose overall connectivity than that. &lt;/p&gt;&#xA;" OwnerUserId="21627" LastEditorUserId="21627" LastEditDate="2016-02-11T15:16:51.447" LastActivityDate="2016-02-11T15:16:51.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26721" PostTypeId="2" ParentId="26713" CreationDate="2016-02-11T14:34:57.037" Score="2" Body="&lt;p&gt;In the outer IP header, it would definitely be &lt;code&gt;1.1.1.10&lt;/code&gt; /  &lt;code&gt;2.2.2.10&lt;/code&gt;, as this is what is used to route the packet to the tunnel endpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you may not even need IP addresses on the tunnel interfaces, you could use &lt;code&gt;ip unnumbered&lt;/code&gt; as it's a point-to-point link.&lt;/p&gt;&#xA;" OwnerUserId="6363" LastActivityDate="2016-02-11T14:34:57.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26723" PostTypeId="2" ParentId="26694" CreationDate="2016-02-11T15:08:36.880" Score="2" Body="&lt;p&gt;The following excerpt is taken from the &lt;strong&gt;Allied Telesis&lt;/strong&gt; website at &lt;a href=&quot;http://www.alliedtelesis.co.uk/p-2122.html&quot; rel=&quot;nofollow&quot;&gt;http://www.alliedtelesis.co.uk/p-2122.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The WebSmart AT-FS750/24 features 24 10/100TX ports with 2 combo tri-speed copper/SFP ports for Gigabit connections.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As others have stated, those two ports only (25 and 26) are capable of operating at Gigabit speed, the others are 10/100.&lt;/p&gt;&#xA;" OwnerUserId="22806" LastActivityDate="2016-02-11T15:08:36.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26725" PostTypeId="2" ParentId="26719" CreationDate="2016-02-11T15:21:04.303" Score="2" Body="&lt;p&gt;There is no such thing as an ethernet coupler. The wiring specifications call for a single, continuous cable. Putting in a coupler does bad things like adding impedance mismatches and untwisted pairs which prevents the cabling from meeting specifications. When using something like this, the cabling will no longer pass the required test suite for the cabling category.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the ANSI/TIA/EIA 568 Commercial Building Telecommunications Cabling Standard:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Only one transition point or consolidation point between the&#xA;  horizontal cross connect and the telecommunications outlet shall be&#xA;  allowed, and bridged taps and splices are not allowed in the copper&#xA;  horizontal.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also, when mixing Category-5E and Category-6 in a cable plant, the cable plant can only be rated as Category-5E since the cable plant is rated as the lowest category of any part it contains. The Category-6 cabling ends up as expensive Category-5E cabling, even if it can pass the Category-6 test suite.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-11T15:27:29.043" LastActivityDate="2016-02-11T15:27:29.043" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26726" PostTypeId="2" ParentId="26710" CreationDate="2016-02-11T15:51:51.870" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the difference between Switch Fabric Capacity and Forwarding Rate of a switch?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch Fabric Capacity&lt;/strong&gt;: It usually means the maximum rate the hardware can move information between cards/ports. However it does not account for time spent looking up output port for frames and packets, for instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Forwarding Rate&lt;/strong&gt;: It usually means the maximum rate the system can actually perform full forwarding for frames/packets, including delays with store-and-forward, MAC/route table lookup, and so on.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-11T15:51:51.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26729" PostTypeId="1" CreationDate="2016-02-11T16:58:54.113" Score="1" ViewCount="2166" Body="&lt;p&gt;Got an alert from Observium this morning that one of our spine switches is down. Seemed a little strange. If this was the case, other things would be alerting too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turns out the switch is up and running, but after 2+ years it decided to stop responding to SNMP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So i did the usual&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no snmp-server&#xA;&#xA;snmp-server community blah ro&#xA;snmp-server chassis-id &amp;lt;switch hostname&amp;gt;&#xA;snmp-server contact &amp;lt;blah@company.com&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Checked the log to make sure it started&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;switch hostname&amp;gt;#sh log | i %SNMP-5&#xA;2y39w: %SNMP-5-WARMSTART: SNMP agent on host &amp;lt;switch hostname&amp;gt; is undergoing a warm start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looks good, but SNMP is still not responding. SNMP counters don't change. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;switch hostname&amp;gt;#sh snmp&#xA;Chassis: &amp;lt;switch hostname&amp;gt;&#xA;Contact: &amp;lt;blah@company.com&amp;gt;&#xA;Location: &amp;lt;Switch Location&amp;gt;&#xA;121127521 SNMP packets input&#xA;    0 Bad SNMP version errors&#xA;    2 Unknown community name&#xA;    0 Illegal operation for community name supplied&#xA;    0 Encoding errors&#xA;    52622307 Number of requested variables&#xA;    0 Number of altered variables&#xA;    12869109 Get-request PDUs&#xA;    160 Get-next PDUs&#xA;    0 Set-request PDUs&#xA;121127516 SNMP packets output&#xA;    0 Too big errors (Maximum packet size 1500)&#xA;    0 No such name errors&#xA;    0 Bad values errors&#xA;    0 General errors&#xA;    121127473 Response PDUs&#xA;    0 Trap PDUs&#xA;SNMP global trap: disabled&#xA;&#xA;SNMP logging: disabled&#xA;SNMP agent enabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can i get SNMP back to life without rebooting this switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: Last night the switch died and fell off the face of the earth. I went to the datacenter this morning to troubleshoot and the console was full of following messages. It appears we may have a network loop somewhere that causes memory fragmentation. More troubleshooting needed.....&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2y39w: %SYS-2-MALLOCFAIL: Memory allocation of 1696 bytes failed from 0x26C184, alignment 8&#xA;Pool: I/O  Free: 7432  Cause: Memory fragmentation&#xA;Alternate Pool: None  Free: 0  Cause: No Alternate pool&#xA;&#xA;-Process= &quot;Pool Manager&quot;, ipl= 0, pid= 5&#xA;-Traceback= 8A3600 BE91B4 BECE60 26C188 270A1C 270B70 758DA8 752FEC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21393" LastEditorUserId="21393" LastEditDate="2016-02-12T22:09:50.487" LastActivityDate="2016-02-12T22:09:50.487" Title="SNMP Stopped working on Catalyst 3560" Tags="|cisco|cisco-catalyst|snmp|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26730" PostTypeId="2" ParentId="26694" CreationDate="2016-02-11T17:02:17.623" Score="0" Body="&lt;p&gt;It means [1000 mega bits per second] or [1 giga bit per second] depending on how you refer to your network ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is just a measure of the network speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1000M = 1000Mbp/s = 1Gbps&lt;/p&gt;&#xA;" OwnerUserId="22812" LastActivityDate="2016-02-11T17:02:17.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26731" PostTypeId="1" AcceptedAnswerId="43249" CreationDate="2016-02-11T17:04:23.573" Score="3" ViewCount="1210" Body="&lt;p&gt;I'm trying to setup a very simple OSPF network with Vyatta. From the best of my knowledge they let all traffic in by default, and I haven't set any firewall rules. The vyatta instances are launched as virtual instances inside DevStack, and I've allowed ICMP messages to get inside them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network looks like this:&#xA; &lt;a href=&quot;https://i.stack.imgur.com/KOOYN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KOOYN.png&quot; alt=&quot;Network topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I'm able to ping from:&lt;/strong&gt;&lt;br&gt;&#xA;* 10.0.1.4 (R1 eth1) to  10.0.1.6 (R2 eth0) and vice versa&lt;br&gt;&#xA;* 10.0.2.7  (R3 eth0) to 10.0.2.5 (R2 eth1) and vice versa  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I try to ping from R1 to R2 on the address 10.0.2.5 I never get back any reply on R1. When sniffing traffic with tcpdump on R2 I can see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;16:31:29.540951 IP 10.0.1.4 &amp;gt; 10.0.2.5: ICMP echo request, id 7301, seq 14, length 64&#xA;16:31:29.541297 IP 10.0.2.5 &amp;gt; 10.0.1.4: ICMP echo reply, id 7301, seq 14, length 64&#xA;16:31:30.540303 IP 10.0.1.4 &amp;gt; 10.0.2.5: ICMP echo request, id 7301, seq 15, length 64&#xA;16:31:30.540536 IP 10.0.2.5 &amp;gt; 10.0.1.4: ICMP echo reply, id 7301, seq 15, length 64&#xA;16:31:31.541623 IP 10.0.1.4 &amp;gt; 10.0.2.5: ICMP echo request, id 7301, seq 16, length 64&#xA;16:31:31.542315 IP 10.0.2.5 &amp;gt; 10.0.1.4: ICMP echo reply, id 7301, seq 16, length 64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems that the request is received and a reply is sent back, but it never gets back to R1. I can verify this by sniffing on eth0 on R0 without seeing any traffic going trough the interface. This is a big confusion for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same thing happens when I try to ping from R3 to 10.0.1.6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to ping from R1 to R3 and sniff traffic with tcpdump on both R2 and R3 I can see that the requests goes trough R2 but never reaches R3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output from tcpdump on R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;16:38:13.230972 IP 10.0.1.4 &amp;gt; 10.0.2.7: ICMP echo request, id 7302, seq 5, length 64&#xA;16:38:14.230283 IP 10.0.1.4 &amp;gt; 10.0.2.7: ICMP echo request, id 7302, seq 6, length 64&#xA;16:38:15.232537 IP 10.0.1.4 &amp;gt; 10.0.2.7: ICMP echo request, id 7302, seq 7, length 64&#xA;16:38:16.241314 IP 10.0.1.4 &amp;gt; 10.0.2.7: ICMP echo request, id 7302, seq 8, length 64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routing table on R1 shows that it should send the requests with destination of 10.0.2.0/24 to R2 on ip 10.0.1.6 and routing table on R3 shows that it should send the requests with destinations of 10.0.1.0/24 to R2 on ip 10.0.2.5. This is also confirmed with the output from above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is output from the ip route and configuration from R1, R2, R3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ip route for R1:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;vyatta@R1:~$ show ip route&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,&#xA;       I - ISIS, B - BGP, &amp;gt; - selected route, * - FIB route&#xA;&#xA;C&amp;gt;* 10.0.0.0/24 is directly connected, eth0&#xA;O   10.0.1.0/24 [110/10] is directly connected, eth1, 17:04:56&#xA;C&amp;gt;* 10.0.1.0/24 is directly connected, eth1&#xA;O   10.0.1.4/32 [110/10] is directly connected, lo, 16:15:49&#xA;C&amp;gt;* 10.0.1.4/32 is directly connected, lo&#xA;O&amp;gt;* 10.0.2.0/24 [110/20] via 10.0.1.6, eth1, 17:03:23&#xA;C&amp;gt;* 127.0.0.0/8 is directly connected, lo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ip route for R2:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyatta@R2:~$ show ip route&#xA;&#xA;Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,&#xA;       I - ISIS, B - BGP, &amp;gt; - selected route, * - FIB route&#xA;&#xA;    O   10.0.1.0/24 [110/10] is directly connected, eth0, 01:39:14&#xA;C&amp;gt;* 10.0.1.0/24 is directly connected, eth0&#xA;O   10.0.1.4/32 [110/20] via 10.0.1.4 inactive, 00:51:29&#xA;O   10.0.2.0/24 [110/10] is directly connected, eth1, 01:39:08&#xA;C&amp;gt;* 10.0.2.0/24 is directly connected, eth1&#xA;C&amp;gt;* 127.0.0.0/8 is directly connected, lo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ip route for R3:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyatta@R3:~$ show ip route&#xA;Codes: K - kernel route, C - connected, S - static, R - RIP, O - OSPF,&#xA;       I - ISIS, B - BGP, &amp;gt; - selected route, * - FIB route&#xA;&#xA;O&amp;gt;* 10.0.1.0/24 [110/20] via 10.0.2.5, eth0, 17:07:20&#xA;O&amp;gt;* 10.0.1.4/32 [110/30] via 10.0.2.5, eth0, 16:20:33&#xA;O   10.0.2.0/24 [110/10] is directly connected, eth0, 17:08:05&#xA;C&amp;gt;* 10.0.2.0/24 is directly connected, eth0&#xA;C&amp;gt;* 127.0.0.0/8 is directly connected, lo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1 configuration&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyatta@R1:~$ show configuration                                                 &#xA;interfaces {&#xA;    ethernet eth0 {&#xA;        address 10.0.0.5/24&#xA;    }&#xA;    ethernet eth1 {&#xA;        address 10.0.1.4/24&#xA;    }&#xA;    loopback lo {&#xA;        address 10.0.1.4/32&#xA;    }&#xA;}&#xA;protocols {&#xA;    ospf {&#xA;        area 0.0.0.0 {&#xA;            network 10.0.1.0/24&#xA;        }&#xA;    }&#xA;}&#xA;service {&#xA;    ssh {&#xA;    }&#xA;}&#xA;system {&#xA;    config-management {&#xA;        commit-revisions 20&#xA;    }&#xA;    console {&#xA;        device ttyS0 {&#xA;            speed 9600&#xA;        }&#xA;    }&#xA;    host-name R1&#xA;    login {&#xA;        user vyatta {&#xA;            authentication {&#xA;                encrypted-password ****************&#xA;            }&#xA;            level admin&#xA;        }&#xA;    }&#xA;    ntp {&#xA;        server 0.vyatta.pool.ntp.org {&#xA;        }&#xA;        server 1.vyatta.pool.ntp.org {&#xA;        }&#xA;        server 2.vyatta.pool.ntp.org {&#xA;        }&#xA;    }&#xA;    package {&#xA;        repository community {&#xA;            components main&#xA;            distribution stable&#xA;            url http://packages.vyatta.com/vyatta&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        global {&#xA;            facility all {&#xA;                level notice&#xA;            }&#xA;            facility protocols {&#xA;                level debug&#xA;            }&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2 configuration&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyatta@R2:~$ show configuration                               &#xA;interfaces {&#xA;    ethernet eth0 {&#xA;        address 10.0.1.6/24&#xA;        hw-id 00:0c:29:9f:5f:22&#xA;    }&#xA;    ethernet eth1 {&#xA;        address 10.0.2.5/24&#xA;        hw-id 00:0c:29:9f:5f:23&#xA;    }&#xA;    loopback lo {&#xA;    }&#xA;}&#xA;protocols {&#xA;    ospf {&#xA;        area 0.0.0.0 {&#xA;            network 10.0.1.0/24&#xA;            network 10.0.2.0/24&#xA;        }&#xA;    }&#xA;}&#xA;service {&#xA;    ssh {&#xA;    }&#xA;}&#xA;system {&#xA;    config-management {&#xA;        commit-revisions 20&#xA;    }&#xA;    console {&#xA;        device ttyS0 {&#xA;            speed 9600&#xA;        }&#xA;    }&#xA;    host-name R2&#xA;    login {&#xA;        user vyatta {&#xA;            authentication {&#xA;                encrypted-password ****************&#xA;            }&#xA;            level admin&#xA;        }&#xA;    }&#xA;    ntp {&#xA;        server 0.vyatta.pool.ntp.org {&#xA;        }&#xA;        server 1.vyatta.pool.ntp.org {&#xA;        }&#xA;        server 2.vyatta.pool.ntp.org {&#xA;        }&#xA;    }&#xA;    package {&#xA;        repository community {&#xA;            components main&#xA;            distribution stable&#xA;            url http://packages.vyatta.com/vyatta&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        global {&#xA;            facility all {&#xA;                level notice&#xA;            }&#xA;            facility protocols {&#xA;                level debug&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration for R3&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyatta@R3:~$ show configuration                               &#xA;interfaces {&#xA;    ethernet eth0 {&#xA;        address 10.0.2.7/24&#xA;    }&#xA;    loopback lo {&#xA;    }&#xA;}&#xA;protocols {&#xA;    ospf {&#xA;        area 0.0.0.0 {&#xA;            network 10.0.2.0/24&#xA;        }&#xA;    }&#xA;}&#xA;service {&#xA;    ssh {&#xA;    }&#xA;}&#xA;system {&#xA;    config-management {&#xA;        commit-revisions 20&#xA;    }&#xA;    console {&#xA;        device ttyS0 {&#xA;            speed 9600&#xA;        }&#xA;    }&#xA;    host-name R3&#xA;    login {&#xA;        user vyatta {&#xA;            authentication {&#xA;                encrypted-password ****************&#xA;            }&#xA;            level admin&#xA;        }&#xA;    }&#xA;    ntp {&#xA;        server 0.vyatta.pool.ntp.org {&#xA;        }&#xA;        server 1.vyatta.pool.ntp.org {&#xA;        }&#xA;        server 2.vyatta.pool.ntp.org {&#xA;        }&#xA;    }&#xA;    package {&#xA;        repository community {&#xA;            components main&#xA;            distribution stable&#xA;            url http://packages.vyatta.com/vyatta&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        global {&#xA;            facility all {&#xA;                level notice&#xA;            }&#xA;            facility protocols {&#xA;                level debug&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can someone tell me what I'm missing? It's a really simple configuration but from what I've read it should work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Muff&lt;/p&gt;&#xA;" OwnerUserId="22810" LastEditorUserId="22810" LastEditDate="2016-02-15T06:41:41.087" LastActivityDate="2017-08-14T21:54:50.120" Title="OSPF can't ping other network segments" Tags="|ospf|ping|icmp|network-access|vyatta|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26732" PostTypeId="1" AcceptedAnswerId="26733" CreationDate="2016-02-11T17:10:52.957" Score="2" ViewCount="1925" Body="&lt;p&gt;Please explain it in terms of metric.I am confused on what kind of metric is used by both of them. Also explain terms like cost,hops, hop count in the context.&lt;/p&gt;&#xA;" OwnerUserId="22814" LastActivityDate="2016-02-20T07:15:45.647" Title="what is the difference between distance vector and link state principle?" Tags="|routing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26733" PostTypeId="2" ParentId="26732" CreationDate="2016-02-11T17:56:32.307" Score="2" Body="&lt;p&gt;Distance-vector protocols use a vector (direction) and a simple hop count (how many routers it must pass through) to determine how to get to a network. A router will look at the number of hops as the metric to determine the best path to send traffic destined for a particular network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link-state protocols let each router get a complete picture of the area in which they reside. The metric is an arbitrary number, often called cost. Since each router knows all the paths to a particular network in its area, it compares the costs for each possible path to arrive at the path which it will use to send traffic destined for a particular network. Cost can be based on things like bandwidth (the usual default), or it can be any arbitrary number the network designer may wish to use. The cost for a path to a network is the aggregated costs for each link in the path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One problem with distance-vector routing is that it can send traffic to slower links which have less hops than faster links which have more hops, whereas link-state routing doesn't care about the number of hops, only the cost, to get to the destination network, and the cost can reflect something important like the bandwidth of the path. Distance-vector routing also has convergence problems compared to link-state routing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-11T18:21:20.167" LastActivityDate="2016-02-11T18:21:20.167" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26734" PostTypeId="2" ParentId="26683" CreationDate="2016-02-11T18:33:33.583" Score="2" Body="&lt;p&gt;So it looks like the problem was that the device i had connected to the network over wifi had the network type set to &quot;public&quot;, which didn't allow other computers on the network to reach it. Sorry for confusing everyone.&lt;/p&gt;&#xA;" OwnerUserId="22773" LastActivityDate="2016-02-11T18:33:33.583" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26735" PostTypeId="2" ParentId="26694" CreationDate="2016-02-11T19:13:06.673" Score="0" Body="&lt;p&gt;You have two gigabit ports on that switch (10/100/1000), and the rest are 10/100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're working on that network, I'd recommending future-proofing by upgrading to a switch where all ports are gigabit-capable, even if some of your devices may not be at the moment.&lt;/p&gt;&#xA;" OwnerUserId="22820" LastActivityDate="2016-02-11T19:13:06.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26738" PostTypeId="1" AcceptedAnswerId="26739" CreationDate="2016-02-11T20:37:11.043" Score="4" ViewCount="260" Body="&lt;p&gt;While IP addresses are often dynamically assigned during runtime, hardware&#xA;addresses (so called MAC addresses) are usually statically allotted when a network interface card is manufactured. What happens when an attacker connects to the same network as his target and assigns his network card the same MAC address as the one of his target’s system?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand this is called MAC spoofing. Since routers cannot tell to which port the correct system is attached, packets will likely be routed to both devices. An attacker can thus gain access to sensitive information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would a user or a sender come to know that an attacker has gained access to sensitive information? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/12961/does-mac-filtering-provide-security-against-mac-spoofing-in-wired-networks&quot;&gt;MAC filtering&lt;/a&gt; provides absolutely zero security (Wired networks).&lt;/p&gt;&#xA;" OwnerUserId="22780" LastEditorUserId="8499" LastEditDate="2018-03-10T00:00:00.490" LastActivityDate="2018-03-10T00:00:00.490" Title="How do we prevent loss of sensitive information from MAC spoofing?" Tags="|mac-address|security|mac|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26739" PostTypeId="2" ParentId="26738" CreationDate="2016-02-11T20:49:25.843" Score="7" Body="&lt;p&gt;MAC spoofing is more about LAN disruption than stealing information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you have a mistaken idea about routers. Routers do not route to MAC addresses, and on a LAN, a router is simply another host. On a LAN, packets are encapsulated in a frame, and are switched based on the frame. The packet doesn't contain MAC addresses, only the frames do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches are what really get disrupted with MAC spoofing since switches switch based on the MAC address, and switches maintain a MAC address table for which MAC address is on which port. As traffic comes in from a host, the MAC address table is updated so that traffic destined for a MAC address can be sent to the correct port (if there is no entry for a MAC address, it will be flooded to all ports). MAC address spoofing will cause the MAC address table to constantly change, and frames destined for the spoofed address will be sent to to different ports at different times, depending on which port is currently in the MAC address table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC filtering is really less than useless. If your switch has something like Cisco's DHCP snooping and ARP inspection, you can prevent the problem of MAC spoofing. You should investigate what you can do for LAN security (this is a huge topic with entire books written about it, and it is a topic too large for this site).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-12T07:14:35.367" LastActivityDate="2016-02-12T07:14:35.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26740" PostTypeId="2" ParentId="23985" CreationDate="2016-02-11T20:58:32.063" Score="2" Body="&lt;p&gt;I think you are confused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an MPLS VPN the layer 2 or layer 3 traffic being carried over an Label Switched Path is not encapsulated - MPLS does not provide an encapsulation method - it is a transport method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MPLS labels are inserted (usually) above say an the Ethernet header and below the IP header, and it provides a transport mechanism across a packet switch network. It does not provide any encapsualtion method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;payload&quot; is label switched across the LSP, only a transport service is being provided (in the case of simple layer 2 Ethernet VPN or a layer 3 IP VPN).&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2016-02-11T20:58:32.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26743" PostTypeId="2" ParentId="23571" CreationDate="2016-02-11T22:37:40.130" Score="1" Body="&lt;p&gt;You have two options when you cable a server like that, with one patch going to swtich A and another to B. Either have the server use one link at the time, aka. fail-over, or stack the switches and do LACP. LACP requires that all member ports are connected the same switch, but with stacking you can get around this.&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-11T22:37:40.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26745" PostTypeId="1" AcceptedAnswerId="26750" CreationDate="2016-02-12T03:26:40.467" Score="1" ViewCount="147" Body="&lt;p&gt;My organization currently has a pair of Nexus 7010's (Sup-1's) in one of our smaller data centers as our core switch (we still currently implement a Core-Dist-Access model). Long story short, this data center ended up not expanding out as was originally forecasted and the 7010's ended up being overkill, both in terms of capacity as well as rackspace/power. Due to upcoming EOL's on the 70xx architecture and the age of our current gear, we are looking at replacing these with something newer and smaller. I was initially looking at Nexus 77xx's as it is recommended upgrade path for the 70xx's, but I feel that this is still overkill. Instead I am interested in the Nexus 6004's as a smaller form factor replacement. I know from the documentation that the 6004 provides layer-2 feature parity, but I have not been able to find any information regarding its layer-3 features and capacity as it compares to the 70xx's and 77xx's. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone here have any experience implementing 6004's in a core layer-3 data center role that can provide insight on its layer-3 capabilities? Alternatively, does anyone have any documentation that compares the 6004 with either 70xx's or 77xx's on layer-3 capabilities?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: VDC is not a requirement for us.&lt;/p&gt;&#xA;" OwnerUserId="21833" LastEditorUserId="8499" LastEditDate="2018-03-21T00:03:36.083" LastActivityDate="2018-03-21T00:03:36.083" Title="Cisco Nexus 6004 Layer 3 capabilities" Tags="|cisco|switch|layer3|cisco-nexus-7k|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26746" PostTypeId="2" ParentId="6851" CreationDate="2016-02-12T03:42:29.067" Score="-2" Body="&lt;p&gt;In the above topo &#xA;A --- R1 ---- R2 ---- C &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once R2 receives the packet from R1 -- it will be sending out an ARP request to find out C's MAC address and only after C's reply will it be able to forward the packet to C. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that correct? &lt;/p&gt;&#xA;" OwnerUserId="22834" LastActivityDate="2016-02-12T03:42:29.067" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26748" PostTypeId="2" ParentId="26745" CreationDate="2016-02-12T04:55:22.247" Score="0" Body="&lt;p&gt;All you really need to do is read the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/nexus-6000-series-switches/datasheet-c78-732277.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;data sheet&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Large-Scale Fabric (Layer 2 and Layer 3): Leaf-and-Spine Architecture&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Data center architecture is changing to more efficiently support&#xA;  multiple, high-traffic applications. New, large-scale nonblocking&#xA;  fabrics promote high-volume east-west or north-south traffic. The&#xA;  Cisco Nexus 6004EF is an excellent leaf or spine node in a Layer 2 or&#xA;  Layer 3 fabric design. As a high-density, low-latency switch, it&#xA;  flattens the network architecture to support connections that scale to&#xA;  more than 10,000 servers with large bisectional bandwidth. The&#xA;  leaf-and-spine design helps ensure low-latency fabric with a low hop&#xA;  count. Spine switches create a nonblocking, low-latency fabric,&#xA;  forwarding packets between leaves. Leaf switches provide connectivity&#xA;  to servers. A highly meshed architecture helps ensure high network&#xA;  availability with little impact on customer traffic if a failure&#xA;  occurs. The Cisco Nexus 6004EF can be deployed as a Layer 2 or Layer 3&#xA;  spine or leaf switch (Figure 8) for design flexibility.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Buy the correct license:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6FV6W.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6FV6W.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco also maintains a large set of documents about its products, including the &lt;a href=&quot;http://www.cisco.com/c/en/us/support/switches/nexus-6004-switch/model.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Nexus 6004 Switch&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-12T04:55:22.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26749" PostTypeId="2" ParentId="25516" CreationDate="2016-02-12T05:22:14.853" Score="1" Body="&lt;p&gt;You said &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The SG300 have no configs&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For a port channel to work. you need to have the same port channel configured in the downstream SG300 switches. Also check that you have set at least one side of the channel to active mode, the other can be either passive or active. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/optical/cpt/r9_3/command/reference/cpt93_cr/cpt93_cr_chapter_01000.html#wp2979412301&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/optical/cpt/r9_3/command/reference/cpt93_cr/cpt93_cr_chapter_01000.html#wp2979412301&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-12T05:22:14.853" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26750" PostTypeId="2" ParentId="26745" CreationDate="2016-02-12T05:24:18.613" Score="3" Body="&lt;p&gt;We use the 6001 as a small core in a context which sounds fairly similar to yours, a small datacenter where a 7k is overkill.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's turned out quite well for us in that role, however we do regret not getting the Enterprise LAN license initially, as we eventually required some more advanced routing features (BGP especially) that we did not have and adding the license after the fact turned out to be costly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not had a chance to investigate its capabilities in a more &quot;up to date&quot; SDN-style datacenter. But for basic DC L3 duty connecting server VLANs and DMZs, mostly statically, to a DC Firewall, it works just fine.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-02-12T05:24:18.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26751" PostTypeId="2" ParentId="5595" CreationDate="2016-02-12T06:13:26.913" Score="0" Body="&lt;p&gt;As per my opinion distance vector protocol is named as such because it contains the information of the exact distance and where exactly it needs to head to reach the destination. The 2 major quality of a distance vector protocol is that it will send the updates periodically and it's update would contain information only about directly connected neighbors whereas link state protocol sends information of all the known routes and does send it non-periodically (triggered update).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand BGP is said to be a path vector protocol because first it has many attributes by which path selection criteria can be tuned, even if we consider default metric which is AS path attribute, it doesn't know how the other AS is going to route the traffic (remember the Golden Rule of BGP) i.e., it is unaware that how many other routers/hops it needs to pass by.&#xA;Secondly routes learned from other neighbors are never passed on unless validated by IGP (Rule of synchronization) differentiating it from link state routing protocol. BGP however does send triggered updates. Even neighbors need to manually configured unlike any distance vector or link state routing protocols.&lt;/p&gt;&#xA;" OwnerUserId="22837" LastEditorUserId="8499" LastEditDate="2016-02-12T06:24:36.403" LastActivityDate="2016-02-12T06:24:36.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26752" PostTypeId="1" CreationDate="2016-02-12T07:15:35.097" Score="1" ViewCount="1620" Body="&lt;p&gt;If the LAN port of a wireless access point is 100 Mbps, then what is the need of 150 Mbps wireless speed? Why do they give 150 Mbps wireless speed?&lt;/p&gt;&#xA;" OwnerUserId="16870" LastEditorUserId="8499" LastEditDate="2017-12-03T03:23:20.213" LastActivityDate="2017-12-03T03:23:20.213" Title="150 Mbps access point with 100 Mbps LAN port" Tags="|ethernet|wireless|ieee-802.11|layer2|access-point|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26754" PostTypeId="2" ParentId="26752" CreationDate="2016-02-12T07:40:04.483" Score="2" Body="&lt;p&gt;Virtually all professional WAPs (what are on topic on this site) have 1 Gbps ethernet ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A WAP is a translating bridge, it translates from ethernet to Wi-Fi and back. You need to understand that you have two different, independently-developed technologies being bridged. One technology, ethernet, has standards for different speeds (10 Mbps, 100 Mbps, 1000 Mbps, and 10,000 Mbps) on UTP. Each bump in speed costs more, and it took some years between bumps in speed. On the other hand, Wi-Fi was developed for its medium (radio), and it has multiple standards, each with its own maximum theoretical speed. Because of real-world obstacles, it is unlikely that you can get anywhere near the theoretical maximum speed on a WAP. To bridge these disparate technologies, you need to use what each technology offers and balance the price/performance ratio, otherwise your product won't sell.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-12T08:23:31.050" LastActivityDate="2016-02-12T08:23:31.050" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="26755" PostTypeId="1" CreationDate="2016-02-12T07:49:58.573" Score="3" ViewCount="9817" Body="&lt;p&gt;I'm configuring a Juniper SRX240 router, and I wanted to set up the HTTPS protocol for web management, as opposed to plain HTTP which is working fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configure HTTPS as documented &lt;a href=&quot;http://www.junosworkbook.com/workbooks/jncia/configuring-junos-web-manager-access&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;, but whenever I attempt to access web management over HTTPS, I'm immediately shown one of many error pages depending on the browser I'm using. The errors vary but suggest that the page cannot be found or the server cannot be reached. If I try with HTTP it works just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did try changing the HTTPS web management port from 443 to use 8080 instead, and instead of seeing an error page immediately it would just try to load until it timed out. I've also tried restarting the web-management service, and the router itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've had a look at the httpd log and it indicates that HTTP requests are being listened for on port 80, but there's no mention of HTTPS anywhere in the log. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the relevant configuration settings:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;system services&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;services {&#xA;    web-management {&#xA;        http {&#xA;            interface ge-0/0/1.0;&#xA;        }&#xA;        https {&#xA;            system-generated-certificate;&#xA;            interface ge-0/0/1.0;&#xA;        }&#xA;        session {&#xA;            idle-timeout 10;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;interfaces&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ge-0/0/1 {&#xA;        description &quot;Management Interface&quot;;&#xA;        unit 0 {&#xA;            description &quot;Management Interface&quot;;&#xA;            family inet {&#xA;                address 192.168.1.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;security zones&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;functional-zone management {&#xA;            interfaces {&#xA;                ge-0/0/1.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            http;&#xA;                            https;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    http;&#xA;                    https;&#xA;                }&#xA;            }&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22839" LastEditorUserId="22839" LastEditDate="2016-02-12T21:01:31.517" LastActivityDate="2017-02-07T03:37:03.153" Title="Cannot access web management through HTTPS despite being configured" Tags="|juniper|juniper-junos|juniper-srx|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26757" PostTypeId="2" ParentId="26731" CreationDate="2016-02-12T09:05:38.387" Score="2" Body="&lt;p&gt;On R1, you have :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ethernet eth1   address 10.0.1.4/24&#xA;loopback lo address 10.0.1.4/32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Change the loopback IP address, it should be better.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-02-12T09:05:38.387" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="26761" PostTypeId="1" AcceptedAnswerId="26763" CreationDate="2016-02-12T11:37:38.867" Score="3" ViewCount="4404" Body="&lt;p&gt;I am working on a project where I will send data from one country to another which will be, according to the data sent, processed for commanding devices connected to the computer. The problem is: I can't send the data to IP address of the PC because the PC will turn on and off while I am not with it, so I won't be able to know the IP address each time it changes since it is dynamic, but I need to send the data to the MAC address itself of the device which will be static. How can I do that??&lt;/p&gt;&#xA;" OwnerUserId="22846" LastActivityDate="2016-02-12T12:02:37.230" Title="How to send packets to MAC address instead of IP address" Tags="|ip|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26762" PostTypeId="2" ParentId="26242" CreationDate="2016-02-12T11:42:53.440" Score="1" Body="&lt;p&gt;EIGRP is kind of hybrid protocol who act as distance vector as well as link state protocol. &#xA;EIGRP doesn’t send link-state packets as OSPF does instead, it sends traditional distance-vector updates containing information about networks plus the cost of reaching them from the perspective of the advertising router. And EIGRP has link-state characteristics as well, it synchronizes routing tables between neighbors at startup and then sends specific updates only when topology changes occur. This makes EIGRP suitable for very large networks.&lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2016-02-12T11:42:53.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26763" PostTypeId="2" ParentId="26761" CreationDate="2016-02-12T12:02:37.230" Score="6" Body="&lt;p&gt;You can't. MAC adresses are local so you can only connect to the MAC adress of a device that is on the same LAN (broadcast domain) as you are. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use a dyndns service that updates a DNS name with the curent IP adress and connect to the DNS name to accomplish your goal. Or let the dynamic system send a heartbeat to you, so that you know when it's there and how to reach it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you should have a layer-2 VPN connection to the other machine you can get the IP adress for a given MAC adress via the arp protocol. I can elaborate on that if you are sure you can go that route.&lt;/p&gt;&#xA;" OwnerUserId="19765" LastActivityDate="2016-02-12T12:02:37.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26764" PostTypeId="1" CreationDate="2016-02-12T12:31:20.260" Score="2" ViewCount="2687" Body="&lt;p&gt;I have a pfSense 2.2.6 box that is connected with a WAN link that supports native IPv6. IPv6 is working great, and my clients can access IPv6 services on the Internet and also on the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'm unable to ping the clients from the Internet, although I have created an IPv6 rule on the WAN link (and LAN as well) that permits IPv6 ICMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything I'm missing?&lt;/p&gt;&#xA;" OwnerUserId="22848" LastActivityDate="2017-04-08T01:08:20.043" Title="pfSense: ICMP Ping allowed, but not possible" Tags="|ipv6|pfsense|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26765" PostTypeId="2" ParentId="26755" CreationDate="2016-02-12T14:39:53.363" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos11.4/topics/concept/zone-functional-understanding.html&quot; rel=&quot;nofollow&quot;&gt;Juniper&lt;/a&gt; the &lt;em&gt;functional-zone&lt;/em&gt; is supposed to be used with the dedicated management interfaces (fxp0). Since this device doesn't have dedicated management interfaces (unless it's set-up as chassis cluster - which in that case interface ge-0/0/0 is assigned to fxp0), you can't use the &lt;em&gt;functional zone&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you have everything configured for interface ge-0/0/1 but you show the configuration of interface ge-0/0/15, so maybe there's a mistake there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if you want to use a non dedicated management interface, you have to use a &quot;normal&quot; security zone. If you want to use the dedicated interface, then you can use the functional zone.&lt;/p&gt;&#xA;" OwnerUserId="22515" LastEditorUserId="8499" LastEditDate="2016-03-13T21:31:40.890" LastActivityDate="2016-03-13T21:31:40.890" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26767" PostTypeId="1" AcceptedAnswerId="26770" CreationDate="2016-02-12T15:50:26.777" Score="2" ViewCount="1638" Body="&lt;p&gt;Nexus 7k&#xA;NXOS 6.2(8a)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to configure a voice vlan but the command does not seem available?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something I am missing to enable that?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet4/1&#xA;  description AV_Hotline_501&#xA;  switchport&#xA;  switchport access vlan 501&#xA;  spanning-tree port-priority 128&#xA;  no shutdown&#xA;&#xA;(config-if)# switchport ?&#xA;  &amp;lt;CR&amp;gt;       &#xA;  access     Set access mode characteristics of the interface&#xA;  autostate  Include or exclude this port from vlan link up calculation&#xA;  dot1q      Configure dot1q EtherType value&#xA;  host       Set port host&#xA;  mode       Enter the port mode&#xA;  monitor    Configures an interface as span-destination&#xA;  trunk      Configure trunking parameters on an interface&#xA;  vlan       Set VLAN translation mapping&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Voice does not show up in switchport details&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name: Ethernet4/1&#xA;  Switchport: Enabled&#xA;  Switchport Monitor: Not enabled &#xA;  Operational Mode: access&#xA;  Access Mode VLAN: 501 (AV_hotline_501)&#xA;  Trunking Native Mode VLAN: 1 (default)&#xA;  Trunking VLANs Allowed: 1-4094&#xA;  FabricPath Topology List Allowed: 0&#xA;  Pruning VLANs Enabled: 2-1001&#xA;  Administrative private-vlan primary host-association: none&#xA;  Administrative private-vlan secondary host-association: none&#xA;  Administrative private-vlan primary mapping: none&#xA;  Administrative private-vlan secondary mapping: none&#xA;  Administrative private-vlan trunk native VLAN: none&#xA;  Administrative private-vlan trunk encapsulation: dot1q&#xA;  Administrative private-vlan trunk normal VLANs: none&#xA;  Administrative private-vlan trunk private VLANs: none&#xA;  Operational private-vlan: none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17253" LastActivityDate="2016-02-12T17:01:02.407" Title="Nexus 7000 - switchport Voice configuration" Tags="|voice|cisco-nexus|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26768" PostTypeId="1" AcceptedAnswerId="26773" CreationDate="2016-02-12T15:58:10.170" Score="2" ViewCount="369" Body="&lt;p&gt;Attaching office studio layout with my proposed Ubiquiti AP placement. All 28 desks occupied with heavy WiFi users that like to complain;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the placement the best possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you think that one UniFi AP is enough or shall I install two?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Orange wall is made of wooden shelves, so not actually a wall. I don't know why it is marked orange on the drawing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ilkOQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ilkOQ.png&quot; alt=&quot;studio&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22854" LastEditorUserId="22854" LastEditDate="2016-02-12T17:22:57.060" LastActivityDate="2016-02-12T23:57:43.010" Title="Wireless AP placement" Tags="|wireless|design|ubiquiti|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26769" PostTypeId="2" ParentId="26768" CreationDate="2016-02-12T16:02:12.293" Score="0" Body="&lt;p&gt;That's what wireless site surveys are for. You should hire someone with the proper knowledge and equipment to perform the survey, which will tell you the quantity, placement, frequencies, radio power, etc. that you should use for the best performance and to reduce or eliminate radio shadows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having us look at a map is merely a guessing game without knowing what else is going on in the airwaves there.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-12T16:02:12.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26770" PostTypeId="2" ParentId="26767" CreationDate="2016-02-12T16:50:19.620" Score="3" Body="&lt;p&gt;I haven't been able to confirm this in any documentation yet, but I have looked for the &quot;switchport voice&quot; command on the copper ports on my own Nexus 7k and it is not an option for me either:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config)# int eth4/14&#xA;(config-if)# switchport ?&#xA;  &amp;lt;CR&amp;gt;       &#xA;  access     Set access mode characteristics of the interface&#xA;  autostate  Include or exclude this port from vlan link up calculation&#xA;  dot1q      Configure dot1q EtherType value&#xA;  host       Set port host&#xA;  mode       Enter the port mode&#xA;  monitor    Configures an interface as span-destination&#xA;  trunk      Configure trunking parameters on an interface&#xA;  vlan       Set VLAN translation mapping&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can confirm that the command is available on a Nexus 2248TP connected back to one of my n5548's- I don't have a n7k-hosted n2k to test with. You're also not the only one who has &lt;a href=&quot;https://supportforums.cisco.com/discussion/12030446/voice-vlan-nexus-7000&quot; rel=&quot;nofollow&quot;&gt;asked this question before&lt;/a&gt; without a solid answer. Based on what I see here, and the understanding that when the Nexus 70xx's were designed they were built solely to be DC core/aggregation switches and weren't built to be as flexible architecturally as newer iterations of Nexus HW, I can only surmise that an access-layer feature like voice vlans was not built into Nexus 7k line cards. I wish I had a better answer for you, but since there doesn't seem to be any documentation publicly available to confirm this, I would suggest contacting your nearest Cisco SE if you have access to one and see if they can provide a better answer from the Nexus engineering teams.&lt;/p&gt;&#xA;" OwnerUserId="21833" LastActivityDate="2016-02-12T16:50:19.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26771" PostTypeId="2" ParentId="26768" CreationDate="2016-02-12T16:55:28.953" Score="2" Body="&lt;p&gt;As @RonMaupin says, the best way to answer your question is with a wireless survey.  But as a first approximation, the best place to put your AP is in the center of the room.  If all 28 chairs are using wifi, then having more that one AP will improve your performance -- in that case you spread the APs out.   Also, the AP speed settings can help improve your performance.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-12T16:55:28.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26772" PostTypeId="2" ParentId="26767" CreationDate="2016-02-12T17:01:02.407" Score="3" Body="&lt;p&gt;The Nexus 7000 was never intended to be an access layer switch, so they didn't include the voice vlan command.  However, you can accomplish the same thing with these commands (data vlan 100, voice vlan 200)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int eth 1/1&#xA;switchport mode trunk&#xA;switchport trunk native vlan 100&#xA;switchport trunk allowed vlan 100,200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-12T17:01:02.407" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26773" PostTypeId="2" ParentId="26768" CreationDate="2016-02-12T17:03:18.447" Score="2" Body="&lt;p&gt;I'd go with two nodes so if one fails or reboots, the other can take over. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For such a small office, I wouldn't bother hiring someone to do a wireless site survey unless you're in a very noise RF environment. For what you'd pay for a site survey, you can just hang another node or two. Just place the nodes temporarily where you think you want them, then walk around and see how well they work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hang them on the ceiling if possible, most of the Unifi nodes have antennas that are optimized for ceiling mounting. PoE power means just running an ethernet cable above the drop ceiling to the node (or running a cable along pipes or beams if you have an exposed ceiling)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd probably hang them right around where those 2 black dots are on the diagram, maybe moving them one seat closer to the top of the diagram to put them more central and provide better coverage through the wall to the conference room. If that wall is particularly solid (i.e. metal reinforced concrete) you may end up having to put a node in the conference room, but regular office walls (even with metal studs) shouldn't be a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found that the Unifi controller is not good at auto-channel assignment so make sure the nodes aren't using overlapping channels.&lt;/p&gt;&#xA;" OwnerUserId="1714" LastEditorUserId="1714" LastEditDate="2016-02-12T17:32:06.387" LastActivityDate="2016-02-12T17:32:06.387" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="26779" PostTypeId="2" ParentId="26764" CreationDate="2016-02-12T19:15:59.607" Score="1" Body="&lt;p&gt;I'm not familiar with the pfSense product line, but ICMP is stateless, and on Cisco firewalls if you aren't &quot;inspecting&quot; ICMP you have to explicitly allow 'echo-reply' or ICMP as a whole on the outbound (or whatever interface you want ping replies to come from) interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cisco parlance, for your issue, that would be modifying the inside access-list to allow ICMP replies back out.&lt;/p&gt;&#xA;" OwnerUserId="22861" LastActivityDate="2016-02-12T19:15:59.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26780" PostTypeId="2" ParentId="26752" CreationDate="2016-02-12T19:28:01.480" Score="0" Body="&lt;p&gt;Wireless connectivity is a half-duplex medium. So while a single PC connected wirelessly at 150Mbps to the AP that is connected to the LAN at 100Mbps seems silly, the idea is that many PCs or hosts will be connected to the AP, sharing that 150Mbps half-duplex connection. The 100Mbps wired connection is probably full-duplex, so you are still getting better throughput on the wired side even if it is listed as 2/3rds the speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside to KorXo's port-channel answer, port-channeling is a redundancy mechanism, not a speed improvement mechanism. The hashing algorithm of a port-channel typically only sends data down one of the links, not both. Even the best hashing algorithm (in my opinion) of src-dest-ip mixed with src-dest-port will only send each TCP/UDP connection down the same one link. Now a new connection to the same server will use a different source port, so might use the 2nd link, but you are still only using a 1Gb link for each connection. You get no better throughput because of that.&lt;/p&gt;&#xA;" OwnerUserId="22861" LastActivityDate="2016-02-12T19:28:01.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26782" PostTypeId="2" ParentId="20015" CreationDate="2016-02-12T19:38:32.727" Score="0" Body="&lt;p&gt;You can use the Axis IP Utility to find the camera on the local network, even if the IP address is wrong for that network. You can then use it to change the IP to the right setting. The tool can be downloaded from here &lt;a href=&quot;http://www.axis.com/fi/en/support/downloads/axis-ip-utility&quot; rel=&quot;nofollow&quot;&gt;http://www.axis.com/fi/en/support/downloads/axis-ip-utility&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, as Ron Trunk said, Wireshark can help you find out what IP is configured in it by looking at the traffic going over the network, even though the IP might be wrong it'll still send some traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MAC address on Axis cameras is the same as the serial number, just add : in between every 2 numbers and letters. The serial number is printed on a small silver sticker on the camera, on the bottom on that model if I remember correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also set the IP using ARP through the command line if you prefer, but you have to know the MAC (aka. serial number) of the camera to do so. It's exactly the same thing as the IP Utility does, but it might be useful in a pinch. See the cameras manual on how to do that, or just google &quot;Axis ARP&quot; or something along those lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you could reset it using the reset button on the camera, this will reset the camera to DHCP, and allow you to get connectivity back. I've seen some cases where the camera jams itself somehow, and you can access it even if you know the IP, and you can't reset it using the IP utility either. Then a reset is the only way to get the camera to behave itself.&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-12T19:38:32.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26783" PostTypeId="1" CreationDate="2016-02-12T23:25:38.657" Score="4" ViewCount="923" Body="&lt;p&gt;I´m experiencing a weird problem with a Catalyst 6509, 2XSUP7203BXL and 2XWS-X6704-10GE. After initial configuration with a static route, injecting packets or testing a ddos against my router, with 250-300 mbit and 50.000 packets or even less in Tengigabit interfaces, it starts to increase cpu usage and it is freezed in 10 seconds, more or less. Checking cpu usage, IP INPUT is using all the time of cpu, i think it is software switched, is it correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried upgrading ios to 15.1, downgrading IOS to 12.2 (2009 version) and with IOS 12.2 (September 2014) and moved fiber to another 6704-10GE card with no luck, same behaviour in another module. My cards are installed in SLOT 1 and Slot 4, i heard about of limitations in 6513 but not in 6509.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Some info:&#xA;&#xA;Cisco IOS Software, s72033_rp Software (s72033_rp-ADVENTERPRISEK9_WAN-M), Version 12.2(33)SXI14, RELEASE SOFTWARE (fc2)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2014 by Cisco Systems, Inc.&#xA;Compiled Thu 04-Sep-14 00:37 by prod_rel_team&#xA;&#xA;ROM: System Bootstrap, Version 12.2(17r)SX7, RELEASE SOFTWARE (fc1)&#xA;&#xA;cisco WS-C6509-E (R7000) processor (revision 1.4) with 983008K/65536K bytes of memory.&#xA;Processor board ID SMG1133N5U1&#xA;SR71000 CPU at 600Mhz, Implementation 0x504, Rev 1.2, 512KB L2 Cache&#xA;Last reset from s/w reset&#xA;3 Virtual Ethernet interfaces&#xA;148 Gigabit Ethernet interfaces&#xA;8 Ten Gigabit Ethernet interfaces&#xA;1917K bytes of non-volatile configuration memory.&#xA;8192K bytes of packet buffer memory.&#xA;&#xA;65536K bytes of Flash internal SIMM (Sector size 512K).&#xA;Configuration register is 0x2102&#xA;&#xA;#show module&#xA;Mod Ports Card Type Model Serial No.&#xA;--- ----- -------------------------------------- ------------------ -----------&#xA;1 4 CEF720 4 port 10-Gigabit Ethernet WS-X6704-10GE SAD104209JK&#xA;2 24 CEF720 24 port 1000mb SFP WS-X6724-SFP SAL14523JKH&#xA;3 24 CEF720 24 port 1000mb SFP WS-X6724-SFP SAL10499QHT&#xA;4 4 CEF720 4 port 10-Gigabit Ethernet WS-X6704-10GE SAL1249C9L5&#xA;5 2 Supervisor Engine 720 (Active) WS-SUP720-3BXL SAD084301NF&#xA;6 2 Supervisor Engine 720 (Hot) WS-SUP720-3BXL SAD083400TH&#xA;7 48 CEF720 48 port 10/100/1000mb Ethernet WS-X6748-GE-TX SAL09518H8V&#xA;8 48 CEF720 48 port 10/100/1000mb Ethernet WS-X6748-GE-TX SAL13410ULX&#xA;&#xA;Mod MAC addresses Hw Fw Sw Status&#xA;--- ---------------------------------- ------ ------------ ------------ -------&#xA;1 0019.5671.290e to 0019.5671.2911 2.4 12.2(14r)S5 12.2(33)SXI1 Ok&#xA;2 e05f.b972.c5f4 to e05f.b972.c60b 5.0 12.2(18r)S1 12.2(33)SXI1 Ok&#xA;3 0019.aa6f.90d8 to 0019.aa6f.90ef 2.5 12.2(14r)S5 12.2(33)SXI1 Ok&#xA;4 0021.a07f.3b54 to 0021.a07f.3b57 2.7 12.2(14r)S5 12.2(33)SXI1 Ok&#xA;5 0011.21ba.6ea4 to 0011.21ba.6ea7 4.0 8.5(4) 12.2(33)SXI1 Ok&#xA;6 0011.21a1.185c to 0011.21a1.185f 4.0 8.5(4) 12.2(33)SXI1 Ok&#xA;7 0016.46e8.a6b8 to 0016.46e8.a6e7 2.3 12.2(14r)S5 12.2(33)SXI1 Ok&#xA;8 0027.0da7.ecd0 to 0027.0da7.ecff 3.2 12.2(18r)S1 12.2(33)SXI1 Ok&#xA;&#xA;Mod Sub-Module Model Serial Hw Status&#xA;---- --------------------------- ------------------ ----------- ------- -------&#xA;1 Distributed Forwarding Card WS-F6700-DFC3BXL SAD11070CG8 5.3 Ok&#xA;2 Centralized Forwarding Card WS-F6700-CFC SAL145132LL 4.1 Ok&#xA;3 Centralized Forwarding Card WS-F6700-CFC SAL1030WL08 3.0 Ok&#xA;4 Distributed Forwarding Card WS-F6700-DFC3BXL SAD090303ZF 3.0 Ok&#xA;5 Policy Feature Card 3 WS-F6K-PFC3BXL SAD081006SX 1.3 Ok&#xA;5 MSFC3 Daughterboard WS-SUP720 SAD0836078V 2.1 Ok&#xA;6 Policy Feature Card 3 WS-F6K-PFC3BXL SAD08330B2V 1.3 Ok&#xA;6 MSFC3 Daughterboard WS-SUP720 SAD08320JKD 2.1 Ok&#xA;7 Centralized Forwarding Card WS-F6700-CFC SAL100193VC 2.0 Ok&#xA;8 Centralized Forwarding Card WS-F6700-CFC SAL1338YXD0 4.1 Ok&#xA;&#xA;Mod Online Diag Status&#xA;---- -------------------&#xA;1 Pass&#xA;2 Pass&#xA;3 Pass&#xA;4 Pass&#xA;5 Pass&#xA;6 Pass&#xA;7 Pass&#xA;8 Pass&#xA;&#xA;#show platform hardware pfc mode&#xA;PFC operating mode : PFC3BXL&#xA;&#xA;#show platform hardware capacity&#xA;System Resources&#xA;PFC operating mode: PFC3BXL&#xA;Supervisor redundancy mode: administratively sso, operationally sso&#xA;Switching resources: Module Part number Series CEF mode&#xA;1 WS-X6704-10GE CEF720 dCEF&#xA;2 WS-X6724-SFP CEF720 CEF&#xA;3 WS-X6724-SFP CEF720 CEF&#xA;4 WS-X6704-10GE CEF720 dCEF&#xA;5 WS-SUP720-3BXL supervisor CEF&#xA;6 WS-SUP720-3BXL supervisor CEF&#xA;7 WS-X6748-GE-TX CEF720 CEF&#xA;8 WS-X6748-GE-TX CEF720 CEF&#xA;&#xA;Power Resources&#xA;Power supply redundancy mode: administratively redundant&#xA;operationally redundant&#xA;System power: 2771W, 0W (0%) inline, 2513W (91%) total allocated&#xA;Powered devices: 0 total, 0 Class3, 0 Class2, 0 Class1, 0 Class0, 0 Cisco&#xA;&#xA;Flash/NVRAM Resources&#xA;Usage: Module Device Bytes: Total Used %Used&#xA;1 dfc#1-bootflash: 15990784 0 0%&#xA;2 dfc#2-bootflash: 15990784 0 0%&#xA;3 dfc#3-bootflash: 15990784 0 0%&#xA;4 dfc#4-bootflash: 15990784 0 0%&#xA;5 RP bootflash: 65536000 0 0%&#xA;5 SP sup-bootdisk: 512106496 343056384 67%&#xA;5 SP const_nvram: 129004 676 1%&#xA;5 SP nvram: 1964024 18464 1%&#xA;6 slavenvram: 1964024 19488 1%&#xA;6 slaveconst_nvram: 129004 676 1%&#xA;6 slavesup-bootdisk: 512024576 343040000 67%&#xA;6 slavebootflash: 65536000 16796472 26%&#xA;7 dfc#7-bootflash: 15990784 0 0%&#xA;8 dfc#8-bootflash: 15990784 0 0%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;configuration is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;upgrade fpd auto version 12.2 &#xA;service timestamps &#xA;debug datetime msec &#xA;service timestamps &#xA;log datetime msec &#xA;service password-encryption &#xA;service counters max age 5 &#xA;no service dhcp &#xA;! &#xA;hostname ipcore6509e &#xA;! &#xA;boot-start-marker &#xA;boot system sup-bootflash:s72033-adventerprisek9_wan-mz.122-33.SXI14.bin &#xA;boot system sup-bootflash:s72033-adventerprisek9-mz.151-1.SY1.bin &#xA;boot-end-marker aaa new-model &#xA;! &#xA;aaa session-id common &#xA;clock timezone Spain 1 &#xA;no ip domain-lookup &#xA;udld enable&#xA;no mls acl &#xA;tcam share-global &#xA;mls netflow interface &#xA;mls cef error action freeze &#xA;mls cef maximum-routes ip 768 &#xA;!&#xA;spanning-tree mode pvst &#xA;diagnostic bootup level minimal &#xA;!&#xA;redundancy main-cpu auto-sync running-config mode sso !&#xA;vlan internal allocation policy ascending vlan access-log ratelimit 2000&#xA;!&#xA;interface TenGigabitEthernet4/1 &#xA; switchport &#xA; switchport trunk encapsulation dot1q &#xA; switchport trunk allowed vlan 110 &#xA; switchport mode trunk&#xA;!&#xA;interface Vlan90 &#xA; description vlan management &#xA; ip address 10.67.95.1 255.255.255.0 &#xA; shutdown &#xA;! &#xA;interface Vlan110 &#xA; description adamo uplink 10g &#xA; ip address myuplink 255.255.255.252 &#xA; no ip redirects &#xA; no ip unreachables &#xA; no ip route-cache &#xA;! &#xA;router bgp myas &#xA; no synchronization &#xA; bgp log-neighbor-changes &#xA; bgp graceful-restart restart-time 120 &#xA; bgp graceful-restart stalepath-time 360 &#xA; bgp graceful-restart &#xA; neighbor myupstream remote-as 35699 &#xA; no auto-summary &#xA;! &#xA;ip classless &#xA;ip forward-protocol nd &#xA;ip route 0.0.0.0 0.0.0.0 mygateway &#xA;! &#xA;no ip http server &#xA;no ip http secure-server &#xA;! &#xA;control-plane &#xA;! &#xA;dial-peer cor custom &#xA;! &#xA;line con 0 &#xA;line vty 0 4 &#xA; transport input ssh &#xA;line vty 5 15 &#xA; transport input all &#xA;!&#xA;ntp clock-period 17179928 &#xA;ntp server 130.206.3.166 &#xA;! &#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and show process cpu example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU utilization for five seconds: 18%/3%; one minute: 8%; five minutes: 9% 327 103416 21228 4871 0.07% 27.33% 13.07% 0 IP Input&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22866" LastEditorUserId="8499" LastEditDate="2016-02-13T00:42:16.077" LastActivityDate="2016-02-13T00:42:16.077" Title="Problems with Cisco SUP720-3BXL and X6704-10GE" Tags="|cisco|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26784" PostTypeId="2" ParentId="26783" CreationDate="2016-02-12T23:49:16.000" Score="2" Body="&lt;p&gt;If you are sending packets toward IP addresses of the device, it will need to handle those packets in the CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider enabling CoPP: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/copp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/copp.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-12T23:49:16.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26786" PostTypeId="2" ParentId="26768" CreationDate="2016-02-12T23:57:43.010" Score="0" Body="&lt;p&gt;You could do your own wireless survey and then select the best channels to use for your two WAPs. &#xA;Here is a discussion on doing your own survey:- &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://community.ubnt.com/t5/UniFi-Wireless/Using-Unifi-AP-for-site-surveys/m-p/775750#M59596&quot; rel=&quot;nofollow&quot;&gt;http://community.ubnt.com/t5/UniFi-Wireless/Using-Unifi-AP-for-site-surveys/m-p/775750#M59596&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless your clients cannot do 802.11a don't advertise anything in the 2.4GHz range...you'll receive complaints when someone uses the microwave or some other interferer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For load balancing the clients, here is another discussion that may help:-&#xA;&lt;a href=&quot;https://community.ubnt.com/t5/UniFi-Wireless/How-to-load-balance-with-Unifi-AP/td-p/1259634&quot; rel=&quot;nofollow&quot;&gt;https://community.ubnt.com/t5/UniFi-Wireless/How-to-load-balance-with-Unifi-AP/td-p/1259634&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-02-12T23:57:43.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26788" PostTypeId="1" CreationDate="2016-02-13T06:47:51.577" Score="1" ViewCount="160" Body="&lt;p&gt;The first thing many people say when deploying a wireless network in a new location is &quot;get a site survey&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a large deployment involving hundreds of AP's, I can see the wisdom in paying for a site survey as it gives a good baseline for the deployment and saving 10 nodes can more than pay for the survey (especially since they are likely to be expensive &quot;enterprise&quot; quality nodes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in a small deployment with &amp;lt; 10 nodes, is a formal site survey worth the money?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been quoted prices between $300 - $500 for a small office site survey and for that price, I could just add 3 - 5 additional nodes. (assuming something like the &quot;cheap&quot; Ubiquiti $100 nodes that would be typical in a small office deployment, not $1000+ Cisco or Meraki nodes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've overseen 100+ node deployments where I felt the survey was well worth the money, but I've also spent $500 on site survey for 3 node deployments where I felt that the site survey was overkill and I could have added 3 more nodes to cover areas where signal proved to be inadequate (and indeed &lt;em&gt;have&lt;/em&gt; added nodes beyond what the site survey said was &quot;optimal&quot;). And that &quot;site survey&quot; consisted of some diagrams showing theoretical (ideal) node coverage along with a walkthrough with a high gain antenna showing potential wifi coverage at a (relative) few points. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some rule of thumb to determine when a site survey is worth the money? &lt;/p&gt;&#xA;" OwnerUserId="1714" LastEditorUserId="1714" LastEditDate="2016-02-13T08:13:34.387" LastActivityDate="2016-02-13T19:25:01.207" Title="Is it worth paying for a Wifi site survey for a small deployment?" Tags="|wireless|ieee-802.11|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26789" PostTypeId="2" ParentId="26788" CreationDate="2016-02-13T08:07:40.007" Score="3" Body="&lt;p&gt;It really depends what your objective is. If you're looking to run VoWifi with its sensitivity to coverage issues, or if you have something very different from a garden-variety office (say an industrial plant with metallic structures every which way) you should probably go for the survey, and find someone competent to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the site is both small (under 5 to 10 APs) and fairly &quot;standard&quot; I tend to eyeball it based on a good set of plans of the site and some indications as to where people are, and it usually turns out pretty well. We leave some slack in the wiring so we can adjust things if necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I find that the biggest problem tends to be people on site telling me &quot;we need 3 APs&quot; because they are thinking only of signal propagation, but they are forgetting entirely about user density in our world of multi-device always-connected users... so getting the AP count right, and making the site manager agree to an increased AP count and cost, tends to be hardest.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-02-13T08:07:40.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26791" PostTypeId="2" ParentId="10481" CreationDate="2016-02-13T14:22:19.947" Score="0" Body="&lt;p&gt;GRE is also used for doing SPAN across networks via Layer 3.  Check following article as an example.&#xA;&lt;a href=&quot;https://supportforums.cisco.com/document/139236/understanding-spanrspanand-erspan&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/document/139236/understanding-spanrspanand-erspan&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2982" LastActivityDate="2016-02-13T14:22:19.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26792" PostTypeId="1" AcceptedAnswerId="26795" CreationDate="2016-02-13T14:30:27.940" Score="1" ViewCount="965" Body="&lt;p&gt;Why does my SonicWall fail to allocate DHCP addresses to my virtual subnet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to configure our VoIP phones.  I have configured our sonicwall TZ 215 to have two networks on the LAN:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Interface X0:  192.168.1.x&lt;/li&gt;&#xA;&lt;li&gt;Interface X0:V10 10.100.10.x&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have configured DHCPD on the sonicwall to allocate a static address, 10.100.1.82, to a phone with a specific mac address connecting over the X0 physical interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works fine, if the static DHCP entry  on the SonicWall allocates the address to the 192.X network.  However, when I configure the static DHCP entry to allocate a 10.x address on the virtual interface subnet, the Sonic Wall does not provide a DHCP response to the phone.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a few config images:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lease Scopes&#xA;&lt;a href=&quot;https://i.stack.imgur.com/BNGUI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BNGUI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network Diagram:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/L1Wib.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L1Wib.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22876" LastActivityDate="2016-02-13T18:11:25.520" Title="SoniWall DHCPD does not allocate subnet addresses" Tags="|subnet|dhcp|sonicwall|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26794" PostTypeId="1" AcceptedAnswerId="29022" CreationDate="2016-02-13T18:04:41.860" Score="2" ViewCount="833" Body="&lt;p&gt;I'm trying to find a command that will show me the max number of span sessions i can have on a single switch, but so far i havent been able to find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any show command that does this??&lt;/p&gt;&#xA;" OwnerUserId="22709" LastActivityDate="2016-03-25T18:39:50.937" Title="Max Number of span sessions" Tags="|cisco|mirror|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26795" PostTypeId="2" ParentId="26792" CreationDate="2016-02-13T18:11:25.520" Score="1" Body="&lt;p&gt;You need to replace the switch with a managed switch that supports VLANs for this to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Sonicwall X0 interface is configured as a trunk, with to VLANs: a &quot;native&quot; VLAN for untagged frames, and V10 for frames tagged with VLAN ID 10. Frames that arrive at the Sonicwall untagged come in at interface X0, and frames that are tagged with VLAN ID 10 come in at interface X0:V10.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch you have does not support VLANs. This means that it will send all traffic to the Sonicwall untagged. So regardless of what you configure on the IP Phone, traffic will arrive only on interface X0, and never on X0:V10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order for this to work, you would need to configure the switchports to the Sonicwall and to the IP Phones with an untagged &quot;native&quot; VLAN and a tagged VLAN 10. So you need to have a managed switch that supports VLANs instead of the unmanaged switch.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-02-13T18:11:25.520" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26796" PostTypeId="1" CreationDate="2016-02-13T18:21:13.623" Score="4" ViewCount="6839" Body="&lt;p&gt;Do you know if any outage is expected or any blip in service when changing LACP rate to fast from slow?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface x/x&#xA;lacp rate fast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any experience or info would be appreciated&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luke&lt;/p&gt;&#xA;" OwnerUserId="14132" LastActivityDate="2017-10-16T15:02:43.247" Title="Cisco - Changing LACP rate from slow to fast" Tags="|cisco|cisco-commands|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="26797" PostTypeId="1" AcceptedAnswerId="26798" CreationDate="2016-02-13T18:21:55.290" Score="2" ViewCount="347" Body="&lt;p&gt;The address space for IPv6 multicast addresses is very large (something like 2^112) and so I'm imagining it might not be so hard to get my hands on a million or so of them at some point, and try using the internet as a pub/sub broker between some thousands of devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty new to multicast but it doesn't seem like it was designed for something like this, and the feeling I get from browsing around the topic is that there's not much confidence in the multicast implementations in the internet networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also generally wondering what public multicast can be used for at the moment and whether the use case above would be abusing the system.&lt;/p&gt;&#xA;" OwnerUserId="22883" LastEditorUserId="8499" LastEditDate="2019-01-04T23:23:41.780" LastActivityDate="2019-01-04T23:23:41.780" Title="Are there limits to the number of global IPv6 multicast addresses in use at a time?" Tags="|routing|ipv6|internet|multicast|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26798" PostTypeId="2" ParentId="26797" CreationDate="2016-02-13T19:11:17.770" Score="2" Body="&lt;p&gt;You can easily get your hands on a &lt;code&gt;/48&lt;/code&gt; IPv6 prefix. this will allow you to have 65,536 &lt;code&gt;/64&lt;/code&gt; subnets, each subnet with a possible &lt;code&gt;18,446,744,073,709,551,616&lt;/code&gt; addresses. ISPs will not advertise any prefix longer than &lt;code&gt;/48&lt;/code&gt;, so your subnets will be aggregated into that single &lt;code&gt;/48&lt;/code&gt; address summary on the Internet. This means that, from the perspective of the Internet, all your subnets are at the same location, even if you have multiple locations with private links between them. At any point where your sites connect to the Internet, you would need to advertise the &lt;code&gt;/48&lt;/code&gt; prefix since the ISP for each point will not advertise any prefix longer than that. Basically, you would need to get a &lt;code&gt;/48&lt;/code&gt; prefix for each site you have, but fortunately, that is really not a problem. Most companies get smaller prefixes (&lt;code&gt;/44&lt;/code&gt;, &lt;code&gt;/40&lt;/code&gt;, &lt;code&gt;/36&lt;/code&gt;, or &lt;code&gt;/32&lt;/code&gt;) and chop them into longer prefixes for different sites and advertisement to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast requires multicast routing on every router in the path. This is not enabled on the Internet routers, so you can multicast within you company, but you cannot multicast across the Internet. You would need to create a tunnel between sites in order to get multicast from one location to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 has a dedicated multicast range (&lt;code&gt;ff00::/8&lt;/code&gt;) with hard restrictions based on flags (third nibble) and scopes (fourth nibble). You need to take these flags and scopes into account when deciding on which multicast address(es) to use. Still, you have a ridiculously large number of multicast addresses which may be used. It is important for your company to define a unified, consistent multicast policy, otherwise it can get out of hand pretty quickly.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-13T19:48:01.200" LastActivityDate="2016-02-13T19:48:01.200" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="26799" PostTypeId="2" ParentId="26788" CreationDate="2016-02-13T19:25:01.207" Score="0" Body="&lt;p&gt;A wireless site survey can tell you about &quot;invisible&quot; problems like multipath or external interference. You need to discover if any neighbors subscribe to the (incorrect) philosophy of cranking radio power to the highest possible level. You could be directly under or over one of these (radio is three dimensional). You will get a good idea of WAP quantity, placement, frequencies, radio power, etc. If you have a large deployment, it is a good idea to have a followup wireless site survey after implementation, under working conditions, in order to tweak these things.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-13T19:25:01.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26800" PostTypeId="2" ParentId="26794" CreationDate="2016-02-13T19:49:48.143" Score="1" Body="&lt;p&gt;I'm unaware of any command that shows the maximum number of SPAN sessions allowed (on a Cisco switch), although I've also never seen more than two allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see how many SPAN sessions are configured by the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show monitor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-13T19:49:48.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="26801" PostTypeId="2" ParentId="17498" CreationDate="2016-02-13T23:50:34.593" Score="1" Body="&lt;p&gt;Although this question is rather old, someone may find it while googling the very same problem, so here comes our &quot;solution&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We couldn't figure out the source of the problem, as the problem was non-reproducable and only happened about once a day on varying access-ports, with about 500 access-ports with the exactly same config in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After updating all 2960 to a release from the 15.x line, the problems disappared. The config didn't change, so it seems to have been silently fixed in one of the releases in between.&lt;/p&gt;&#xA;" OwnerUserId="14263" LastActivityDate="2016-02-13T23:50:34.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26802" PostTypeId="1" AcceptedAnswerId="27843" CreationDate="2016-02-14T07:13:18.517" Score="2" ViewCount="164" Body="&lt;p&gt;I'm an intern in a non-technological firm. it's a big company with 99 PCs and network printers. And they have the messiest Racks and LAN ever. I'm supposed to go through it, make a schema of the existing topology and make a simulation of a solution that can run the 6 floor building without the existing mess.&#xA;this is my first time doing anything like this. Are there any set of steps that I should follow in order to get started?&lt;/p&gt;&#xA;" OwnerUserId="22889" LastActivityDate="2016-02-15T22:45:00.097" Title="How to evaluate and do a network simulation for an already existing LAN?" Tags="|switch|router|ethernet|lan|" AnswerCount="2" CommentCount="0" ClosedDate="2019-03-25T00:26:34.727" ContentLicense="CC BY-SA 3.0" />
  <row Id="26803" PostTypeId="2" ParentId="17065" CreationDate="2016-02-14T09:24:26.870" Score="0" Body="&lt;p&gt;In scenario where server is behind NAT I would try to put server in DMZ. For IPSec behind NAT roadwarrior scenario might work. StrongSwan provides information how to configure IPsec on server and client in roadwarrior scenario on &lt;a href=&quot;https://github.com/strongswan/strongswan#roadwarrior-case&quot; rel=&quot;nofollow&quot;&gt;page&lt;/a&gt;, but this is in case where client is behind NAT, not server. More details about &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos15.1x49/topics/concept/ipsec-nat-traversal-understanding.html&quot; rel=&quot;nofollow&quot;&gt;NAT-T&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="10618" LastEditorUserId="10618" LastEditDate="2016-02-14T10:46:26.863" LastActivityDate="2016-02-14T10:46:26.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26804" PostTypeId="1" CreationDate="2016-02-14T09:56:06.423" Score="1" ViewCount="113" Body="&lt;p&gt;I have currently got several VPN's on-premise that are setup on the outside interface and using the default gateway on the interface as an originating source of the VPN tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although the outside interface has been configured with a block of IP's - of which I would like a new VPN I am creating to originate from another IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed there is a 'Tunnelled' option under the static routes section that allows you to set a default tunnel - although in my case I would like to have more than one origin for VPN's on the outside interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is - is it possible to have more than one originating source?&lt;/p&gt;&#xA;" OwnerUserId="22890" LastActivityDate="2023-12-14T03:01:40.197" Title="Manually specify a tunnel gateway for an IPSec VPN Connection (ASA)" Tags="|cisco|cisco-asa|ipsec|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26805" PostTypeId="1" AcceptedAnswerId="26816" CreationDate="2016-02-14T10:54:36.117" Score="2" ViewCount="2359" Body="&lt;p&gt;I have new 2960 L2 switch, I can't ping 8.8.8.8 from switch but having internet on clients that connected to same switch&lt;/p&gt;&#xA;" OwnerUserId="21915" LastActivityDate="2016-02-14T18:51:31.490" Title="I can't ping 8.8.8.8 from 2960 L2 switch?" Tags="|cisco|routing|switch|troubleshooting|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26806" PostTypeId="2" ParentId="26805" CreationDate="2016-02-14T11:07:17.130" Score="3" Body="&lt;p&gt;That's pretty normal. Looks like your switch doesn't have the default gateway set, try &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip default-gateway &amp;lt;IP of your gateway&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in the &lt;em&gt;enable&lt;/em&gt; mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since clients connected to this switch can reach Google public DNS, they have information on where to look for the gateway. Switch from the context of the network connectivity of it's management interface is an ordinary network host.&lt;/p&gt;&#xA;" OwnerUserId="10496" LastActivityDate="2016-02-14T11:07:17.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26807" PostTypeId="1" AcceptedAnswerId="26810" CreationDate="2016-02-14T11:56:00.277" Score="6" ViewCount="724" Body="&lt;p&gt;I was wondering the following:&#xA;Assume I am attached to a switch with an Ethernet Cable and I try to spoof the source/origin MAC address of an Ethernet frame with FF:FF:FF:FF:FF:FF. How would it behave?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1: Would the switch drop this packet? Or do switches in general only look at the destination address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2: Would routers drop this packet? Or do they only look at the destination and IP addresses involved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3: Could this effectively result in all replies on link layer level (like ARP for example) to be broadcasted over the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope you can help!&lt;/p&gt;&#xA;" OwnerUserId="22051" LastActivityDate="2016-02-14T14:24:51.127" Title="Spoofing Ethernet with Source as Broadcast" Tags="|switch|router|ethernet|broadcast|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26808" PostTypeId="1" AcceptedAnswerId="26809" CreationDate="2016-02-14T12:25:12.633" Score="2" ViewCount="1007" Body="&lt;p&gt;Consider a following scheme:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Server(TTL=64) &amp;lt;--&amp;gt; RouterA(TTL=64) &amp;lt;--&amp;gt; RouterB(TTL=64) &amp;lt;--&amp;gt; Desktop(TTL=128)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Desktop sends a package to the Server, this package on the netowrk card of desktop has ttl equal to 128. What would be TTL of the package when it will pass RouterB - 127, 64 or 63 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to test it? I'm using Linux and run command &lt;code&gt;ping google.com -t 100&lt;/code&gt;, but I recieve only TTL of response.&lt;/p&gt;&#xA;" OwnerUserId="16788" LastActivityDate="2016-02-14T13:33:02.767" Title="How does TTL of package changes?" Tags="|ipv4|packet-path|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26809" PostTypeId="2" ParentId="26808" CreationDate="2016-02-14T13:33:02.767" Score="4" Body="&lt;p&gt;The ttl(time to live) value will depend of the initial value of your ttl field(that is depending of your operatins system).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you can find some common values:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://learningnetwork.cisco.com/thread/58345&quot; rel=&quot;nofollow&quot;&gt;https://learningnetwork.cisco.com/thread/58345&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using windows(not 95 version)127 will be your result because it is just one jump has happens, the ttl value change(decrease) on the way that a packes passes by one router or some devices betwenn 2 networks. On that way, once the packet get into router b, and it forwarded to router A, on that moment the ttl value is dereceased by one.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-02-14T13:33:02.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26810" PostTypeId="2" ParentId="26807" CreationDate="2016-02-14T14:24:51.127" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Q1: Would the switch drop this packet? Or do switches in general only look at the destination address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This would depend on the particular switch's behavior. Different switches will behave differently (based on vendor/model and configuration). However you should expect these to be dropped because broadcast is not a valid source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches look at both the source and destination addresses. Destination for delivery and source for learning. They will also look at both for other features as well.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q2: Would routers drop this packet? Or do they only look at the destination and IP addresses involved.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This would depend on the particular routers's behavior. Different routers will behave differently (based on vendor/model and configuration). However in general the router will be stripping off the L2 header and replacing it anyhow, so I would expect the router to be a bit more &quot;lenient&quot; when it comes to what is/isn't a valid frame. I wouldn't count on it working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router (like just about any network device) will also look at the source/destination MAC. The destination to ensure it is for delivery on that particular interface and the source to potentially update the ARP table. No device should insert a broadcast MAC into their ARP table for a unicast address, although we all know software is programmed by humans and anything is possible with bugs.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q3: Could this effectively result in all replies on link layer level (like ARP for example) to be broadcasted over the network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Want to take a guess at my answer here? This would depend on the particular networks's behavior as a whole. Different networks will behave differently (based on vendors/models and configurations). My guess is that on the majority of networks, this would not result in the scenario you describe.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-02-14T14:24:51.127" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="26815" PostTypeId="1" AcceptedAnswerId="26817" CreationDate="2016-02-14T18:07:57.050" Score="1" ViewCount="186" Body="&lt;p&gt;Does an unmanaged switch deals with providing the DHCP offers to servers, or it needs the router to assign the IP to switch first, and switch takes it from there?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I want to Achieve?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want two machines communicate within LAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Setting&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My network setting for &lt;code&gt;eth0&lt;/code&gt; is (i.e. &lt;code&gt;/etc/network/interfaces&lt;/code&gt;): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;auto eth0&#xA;iface eth0 inet dhcp &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I do restart the eth0 while it is connected to the switch, however at the end of its DHCP discovery, it states he following: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;No DHCPOFFERS received. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19650" LastEditorUserId="8499" LastEditDate="2020-02-09T20:55:33.983" LastActivityDate="2020-02-09T20:55:33.983" Title="Unmanage Switch and DHCP Offer's Functionality" Tags="|switch|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26816" PostTypeId="2" ParentId="26805" CreationDate="2016-02-14T18:51:31.490" Score="1" Body="&lt;p&gt;You need to have an SVI with a proper IP address and mask for the VLAN, and you need to have the correct default gateway set for that SVI. The VLAN for that SVI needs to be allowed on the trunk(s) back to the router. Your switch will be just another host on the VLAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-14T18:51:31.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="26817" PostTypeId="2" ParentId="26815" CreationDate="2016-02-14T18:56:34.197" Score="2" Body="&lt;p&gt;You need to have a DHCP server on your LAN. An unmanaged layer-2 switch doesn't participate in anything above layer-2.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-14T18:56:34.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27816" PostTypeId="1" CreationDate="2016-02-14T20:47:04.437" Score="4" ViewCount="926" Body="&lt;p&gt;What are the biggest differences between WPA and WPA2 and why is AES so much safer than TKIP?&lt;/p&gt;&#xA;" OwnerUserId="22895" LastActivityDate="2016-02-16T01:16:09.583" Title="What's the difference between WPA and WPA2?" Tags="|security|ieee-802.11|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27817" PostTypeId="1" AcceptedAnswerId="27819" CreationDate="2016-02-14T21:23:03.273" Score="3" ViewCount="603" Body="&lt;h1&gt;TL;DR&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Given &lt;code&gt;8.8.8.8&lt;/code&gt;, what do I call its &lt;code&gt;8.8.8.0&lt;/code&gt; or &lt;code&gt;8.8.8.1&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Why do I need this information?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I'm working on a program that resolves the location of IP addresses. To reduce the number of API requests it makes, I replace the last octet of each IP address with &lt;code&gt;0&lt;/code&gt; and cache the results, presuming that whole subnet belongs to the same location anyway.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;What do I need to know?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I need to name the database column for that value, and I'd like to do that properly. What word should I choose for a column name? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, is there something I need to know about &lt;code&gt;8.8.8.0&lt;/code&gt; vs &lt;code&gt;8.8.8.1&lt;/code&gt;? Should I prefer one over another?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/9609/in-networking-is-there-a-word-for-the-first-n-bytes-of-an-ip-address&quot;&gt;this question&lt;/a&gt; but there doesn't seem to be an answer to my question on that page.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="22896" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-02-15T11:02:48.547" Title="What do I call the first IP of the block?" Tags="|ipv4|terminology|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27818" PostTypeId="1" AcceptedAnswerId="27820" CreationDate="2016-02-14T21:25:25.083" Score="3" ViewCount="38340" Body="&lt;p&gt;How can I delete a VLAN config from a Cisco 887VA with IOS 15.3?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some testing I have created VLAN2 and no longer need it but now I can't get rid of it from &lt;code&gt;show running-config&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From config mode I tried:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;interface vlan 2&lt;/code&gt; → &lt;code&gt;shutdown&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;no vlan 2&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;write mem&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But even after reload the VLAN is still showing up &lt;code&gt;running-config&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not that it's a big issue but it's polluting the config...&lt;/p&gt;&#xA;" OwnerUserId="7971" LastActivityDate="2020-02-28T12:26:48.433" Title="Deleting VLAN on Cisco 887" Tags="|cisco|vlan|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27819" PostTypeId="2" ParentId="27817" CreationDate="2016-02-14T21:31:29.283" Score="6" Body="&lt;p&gt;The first IP address in a prefix is usually called the &lt;em&gt;network address&lt;/em&gt;. In most setups, the first assignable address is the &lt;em&gt;gateway&lt;/em&gt;, though any IP address within a prefix could be configured as gateway. So assuming &lt;code&gt;8.8.8.8&lt;/code&gt; is in a /24 network, &lt;code&gt;8.8.8.0&lt;/code&gt; would be the &lt;em&gt;network address&lt;/em&gt; and &lt;code&gt;8.8.8.1&lt;/code&gt; the &lt;em&gt;gateway&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, is there something I need to know about 8.8.8.0 vs 8.8.8.1? Should I prefer one over another?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's hard for us to tell, we don't know your application, but if you're looking at /24's, I'd take &lt;code&gt;8.8.8.0&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-02-14T21:31:29.283" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27820" PostTypeId="2" ParentId="27818" CreationDate="2016-02-14T21:53:24.123" Score="11" Body="&lt;p&gt;&lt;code&gt;no vlan 2&lt;/code&gt; deletes VLAN 2 from the VLAN database. If you want to delete the VLAN2 SVI, you need to type &lt;code&gt;no interface vlan2&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-02-14T21:53:24.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27821" PostTypeId="2" ParentId="27818" CreationDate="2016-02-14T21:57:22.933" Score="0" Body="&lt;p&gt;There are two ways how to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1.)&lt;/strong&gt; Check the whole configuration of SVI Vlan 2 - is there command switchport access vlan 2 ? If yes, just change it to default - switchport access vlan 1, then remove vlan 2 again and verify via show vlan command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2.)&lt;/strong&gt; If you are using only default Vlans 1 and 1002 - 1005 you can just delete the whole vlan.dat from flash and reload the switch. This will delete your unwanted Vlan for sure.&lt;/p&gt;&#xA;" OwnerUserId="22090" LastActivityDate="2016-02-14T21:57:22.933" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27822" PostTypeId="1" AcceptedAnswerId="30475" CreationDate="2016-02-15T10:45:19.530" Score="3" ViewCount="3187" Body="&lt;p&gt;This is what I have done in my GNS3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WVx5f.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WVx5f.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R3 - Router &lt;/li&gt;&#xA;&lt;li&gt;R4 - Switch&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have installed GNS3 and trying to enable on Router as mentioned above depict.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to enabled &lt;strong&gt;&lt;em&gt;DHCP&lt;/em&gt;&lt;/strong&gt; on Cisco router R3 ?&lt;/p&gt;&#xA;" OwnerUserId="13630" LastEditorUserId="13630" LastEditDate="2020-11-24T12:09:26.100" LastActivityDate="2020-11-24T12:09:26.100" Title="How to enable DHCP Cisco router" Tags="|cisco|router|dhcp|cisco-commands|gns3|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="27823" PostTypeId="2" ParentId="22595" CreationDate="2016-02-15T10:50:57.053" Score="2" Body="&lt;p&gt;Actually, it shows that Telstra Global (which as the name implies, has a global presence) is connected to Level 3 (which also has a global presence).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at the round-trip times, you'll notice that hops 3 and 4 are about 150 ms away from Sydney (hops 1 and 2), so most certainly in California, close to hop 5 (which is clearly identified as being in Los Angeles), so we can deduct that Telstra has a point of presence there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are in Sydney:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  1 i-0-11-0-0.sydp01.bi.telstraglobal.net (202.84.220.210) [AS 4637] 4 msec&#xA;  2 i-0-1-0-7.sydp-core03.bi.telstraglobal.net (202.84.223.9) [AS 4637] 3 sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These are in California, still on the Telstra network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  3 i-0-4-0-6.1wlt-core01.bx.telstraglobal.net (202.84.141.41) [AS 4637] 149 msec&#xA;  4 i-0-5-0-1.tlot02.bi.telstraglobal.net (202.84.253.38) [AS 4637] 148 sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This one is in Los Angeles, on the Level 3 network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  5 8-3-2.edge1.LosAngels.Level3.net (4.68.70.69) [AS 3356] 148 msec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interconnects between networks often happen in shared facilities (known as colocation or tele housing facilities), or through Internet eXchange (IX) points (which are also usually hosted in such facilities), so it's just cables or fibres within a building in those cases. Otherwise, they use dedicated links from one of the network's POPs to the other one's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are then links between facilities (points of presence), which can use any possible technology, including cables (mostly for shorter distances nowadays), optical fibre, wireless links, satellite links, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;ideal&quot; long-distance high-speed link uses optical fibre, as it provides very high throughput (up to several terabits/s using DWDM), minimal latency and high reliability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_international_submarine_communications_cables&quot; rel=&quot;nofollow noreferrer&quot;&gt;crisscross of cables&lt;/a&gt; laid on the bottom of the oceans, though most are concentrated on a few routes with a lot of demand. Africa and Latin America get a lot less connectivity that the North America-Europe path!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most ASes are &quot;multi-homed&quot;, and connected to other ASes via multiple paths, and they usually also have internal redundancy. If a path fails, traffic is rerouted to another path until repairs can be performed. This can be done at Layer 2 using SDH &quot;rings&quot; and/or at Layer 3 using internal routing protocols (EIGRP, OSPF, IS-IS...) within an AS, and BGP between ASes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In situations where there are few links (especially if there's a single link with a very high throughput and older ones with lower bandwidth), one link (or sometimes several that go through the same area) going down can have consequences on available bandwidth, or may force rerouting through a less optimal path (e.g. traffic between parts of Asia and Europe that need to go through North America, rather than a more direct path), which would increase latency. An example of such an issue is documented &lt;a href=&quot;https://en.wikipedia.org/wiki/2008_submarine_cable_disruption&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Common causes for fibre cuts include the dreaded &lt;a href=&quot;https://en.wikipedia.org/wiki/Excavator&quot; rel=&quot;nofollow noreferrer&quot;&gt;excavator&lt;/a&gt; (mostly for ground-based fibres, but that may include the approaches of submarine cables), fishing trawlers, anchors and earthquakes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cables are laid down (and repaired) by large telecommunications companies or joint-ventures between several of them. I would think that most of it is privately financed nowadays on the most utilised paths, though of course links to underdeveloped places may get public financing/aid. Cables are laid down using specialised ocean-going vessels that hold huge spools of fibre cables, and also have the capabilities to fetch a cable from the seafloor for repairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://youtu.be/XQVzU_YQ3IQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;Video explaining laying down fiber&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6363" LastEditorUserId="6363" LastEditDate="2017-08-20T23:24:58.757" LastActivityDate="2017-08-20T23:24:58.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27824" PostTypeId="2" ParentId="27817" CreationDate="2016-02-15T11:02:48.547" Score="2" Body="&lt;p&gt;You're making the assumption that all networks are &lt;code&gt;/24&lt;/code&gt;s (equivalent of a pre-CIDR &quot;Class C&quot;, with a subnet mask of &lt;code&gt;255.255.255.0&lt;/code&gt;), which is definitely not the general case. There are lots of much smaller and much larger blocks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should try to find out the CIDR network the IP is part of, and make a note of that network. A CIDR network is defined by its starting address and prefix-length.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The starting address can be called:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the start address&lt;/li&gt;&#xA;&lt;li&gt;the network address&lt;/li&gt;&#xA;&lt;li&gt;the prefix&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Depending on what exactly you are trying to achieve, different levels of granularity may be needed. It may be enough for you to know that a given block is allocated to a single ISP and has a single &quot;route&quot; in BGP. Or you may want to know the specific company the network is assigned to.&lt;/p&gt;&#xA;" OwnerUserId="6363" LastActivityDate="2016-02-15T11:02:48.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27825" PostTypeId="2" ParentId="10108" CreationDate="2016-02-15T12:52:17.313" Score="2" Body="&lt;p&gt;The answer is actually on &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_Resolution_Protocol&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Sender hardware address (SHA)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Media address of the sender. In an ARP request this field is used to&#xA;  indicate the address of the host sending the request. &lt;strong&gt;In an ARP&#xA;  reply this field is used to indicate the address of the host that the&#xA;  request was looking for. (Not necessarily address of the host replying&#xA;  as in the case of virtual media.) Note that switches do not pay&#xA;  attention to this field, particularly in learning MAC addresses. The&#xA;  ARP PDU is encapsulated in Ethernet frame, and that is what Layer 2&#xA;  devices examine.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="22910" LastEditorUserId="8499" LastEditDate="2016-02-15T15:02:36.977" LastActivityDate="2016-02-15T15:02:36.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27826" PostTypeId="1" AcceptedAnswerId="27827" CreationDate="2016-02-15T14:26:07.153" Score="1" ViewCount="1031" Body="&lt;p&gt;I currently taking a computer networking course and there are some terms that really confusing me and i can't find the &quot;connection&quot; between them.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I have a network with hosts and routers, and lets say &lt;strong&gt;host A&lt;/strong&gt; want to send a packet to &lt;strong&gt;host B&lt;/strong&gt; and there are many routers and links between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought that first of all the network doing the STP algorithm, to find the best tree to send packets between LANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How the &lt;em&gt;routing&lt;/em&gt; in A is going? &#xA;How does he know what is the path that is the &quot;best&quot; for him to send the packets to B?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And what is &lt;em&gt;forwarding&lt;/em&gt; differ from this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I learned about &lt;em&gt;Distance vectors&lt;/em&gt; and &lt;em&gt;Link states&lt;/em&gt; that solve problems for routers, but, if &lt;strong&gt;A&lt;/strong&gt; knows the path to &lt;strong&gt;B&lt;/strong&gt;, why on earth the routers need to run this algorithm and not just sent the packets by how A told them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And last, I'll be happy if someone elaborate me on ECMP and the connection between this to what I asked above , because I struggle to figure it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(sorry about the english, not my native language)&lt;/p&gt;&#xA;" OwnerUserId="24542" LastEditorUserId="16654" LastEditDate="2016-02-15T14:56:40.053" LastActivityDate="2016-02-16T11:40:14.437" Title="STP, Distance vectors, LS and ECMP confusing" Tags="|routing|ospf|ip-forwarding-table|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27827" PostTypeId="2" ParentId="27826" CreationDate="2016-02-15T15:03:58.467" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I thought that first of all the network doing the STP algorithm, to&#xA;  find the best tree to send packets between LANs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Spanning Tree is not a routing protocol, but a protocol to avoid loops in a network. Therefore, whenever the network topology changes (links comes up/goes down), Spanning Tree is gathering information about the network and the link between all involved switches. It does then determine a root bridge (= root switch), and starting from that root bridge defines which links are to be used to distribute data from one point to the next. After Spanning tree is done, there will be exactly one link in use for every possible connection, and the others links will be blocked (disabled). However, this is a protocol operating on Layer 2 of the network, and has nothing do with IPs or routing.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Second,how the routing in A is going? how does he know what is the&#xA;  path that is the &quot;best&quot; for him to send the packets to B?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In most cases, communication happens between workstations and servers, which don't participate in any routing protocol nor do they have any further knowledge about the network topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most hosts only know 2 things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Their own IP address and subnet mask. Usually a local IPv4 address e.g. looks like 192.168.0.42 with a 255.255.255.0 subnet - so the host would know that it can directly communicate with all other hosts using a 192.168.0.x IP address.&lt;/li&gt;&#xA;&lt;li&gt;The default gateway is either gained by DHCP or manually configured, and is responsible for all communications outside the local network. If, for example, our host A with 192.168.0.42 wants to communicate with host B, using 192.168.17.23, host A will determine that the target is outside of his own network, and will direct all traffic to it's default gateway. Host A doesn't care how his gateway will get the traffic to host B - he just sends it to the gateway and is done.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The default gateway, some kind of router, will then take a look in his local routing table and, based on the destination IP address, forward the packet to the next router. It doesn't care how that router is going to get the traffic to host B, it only knows &quot;This is the next hop on the way to the destination network&quot;.&#xA;At some point, the packet will arrive at a router which is directly connected to the same network as host B. That router will then send the packet to host B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every participant in that process only decides where the next hop for a packet is, and send the packet to that station. They will not know or take into consideration the complete route the packet has to take - only the next step.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;and what is forwarding differ from this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;Forwarding is the term used for the action done by any station participating in the distribution of a packet that is neither the source nor the destination. Host A is the source or sender, Host B is the destination or receiver. All routers in between them will only be forwarding the packet, as they are neither source nor target of that communication, but just relays.&lt;/s&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to correct myself on that point. Forwarding, in networking terms, usually refers to &quot;relaying data that you received for somebody else on Layer 2&quot;. Switches forward frames they receive, by determining if their Forwarding Table/CAM Table (Cisco) knows on which the port the destination MAC address is, and then sending it there, or flooding it on all ports if they don't know where the destination MAC address is located.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers route. (Ha!) They do the same as switches, but on Layer 3 (IP). They take a look at their routing table to determine where to send a specific packet on it's journey to it's destination IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often, forwarding and routing are mixed up (like I did), but in network terminology, forwarding is Layer 2, routing is Layer 3.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I learned about Distance vectors and Link states that solve problems&#xA;  for routers, but, if A know the path to B, why on earth the routers&#xA;  need to run this algorithm and not just sent the packets by how A told&#xA;  them?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're confusing routing protocols with the actual routing. Some routing protocols actually know the whole topology of a network, while others only know the routing table of their neighbors. All of these protocols share that they're used to fill the router's routing table, so it can make decision about which is the best path for a packet to a given destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make that decision, some routing protocols actually gather all network topology information, so that they might actually know or at least guess the complete route a packet might take - but that is not their decision. Every router takes the decision which way to forward a packet in the very moment the packet arrives, depending on where it's destination is.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And last, i'll be happy if someone elaborate me on ECMP and the&#xA;  connection between this to what i asked above , because i struggle to&#xA;  figure it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Equal-cost multi-path routing is simply a way to distribute traffic with the same source and destination over several links, which all have the same &quot;cost&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine it like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're going from Los Angeles to New York (by car). Checking Google Maps, you find out that there are two possible routes, one via Denver, the other one via Albuquerque. Both routes are exactly 2800 miles long and take exactly the same time. You, as a driver, would now have to equal-cost routes to choose one from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as a network packet, you don't make those decisions, but the routers make them. The router in LA could now choose to send the first packet via Denver, the second via Albuquerque, the third one via Denver and so on. It would result in both links/routes being equally used, without having a traffic jam on one route and no traffic on the other one. In short - it's just a way to distribute traffic over to equal links to avoid congestion.&lt;/p&gt;&#xA;" OwnerUserId="14263" LastEditorUserId="14263" LastEditDate="2016-02-16T11:40:14.437" LastActivityDate="2016-02-16T11:40:14.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27828" PostTypeId="2" ParentId="27826" CreationDate="2016-02-15T15:06:29.190" Score="3" Body="&lt;p&gt;You are mixing different concepts, so the first step is to make clear each one:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;STP&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A device in a LAN can communicate to another device on the same LAN directly. When a device is in a LAN it uses the &lt;strong&gt;MAC address&lt;/strong&gt; to identify the other devices.&lt;/li&gt;&#xA;&lt;li&gt;Being in a LAN means that the device periodically sends unicast (peer to peer) frames and &lt;strong&gt;broadcast&lt;/strong&gt; (peer to everyone) frames.&lt;/li&gt;&#xA;&lt;li&gt;A LAN can be be formed by one or &lt;strong&gt;multiple&lt;/strong&gt; switches.&lt;/li&gt;&#xA;&lt;li&gt;To avoid LAN failures because cable or fiber problems, network admins usually make &lt;strong&gt;redundant connections&lt;/strong&gt;. Redundant connections create &lt;strong&gt;loops&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;STP&lt;/strong&gt; is a protocol that let the switches negotiate which redundant paths must be blocked to avoid loops &lt;strong&gt;in a LAN&lt;/strong&gt;. Every switch that receives a frame repeats that frame through out all its ports except the blocked ports.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Routing&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;A router connects two or more LANs. Remember that a device can know the MAC address of devices &lt;em&gt;only&lt;/em&gt; on the &lt;strong&gt;same&lt;/strong&gt; LAN. To overcome this problem we need to use a level 3 protocol, for example, IP.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The router uses routing protocols (based on distance vector and link state) to find the best path to IP networks not directly attached to it. The device in the LAN is aware that there is a router but is not aware of the routing table.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A device (&lt;strong&gt;host A&lt;/strong&gt;) that needs to communicate to a device on other LAN (&lt;strong&gt;host B&lt;/strong&gt;) sends the packet to the router, and it's router's duty to &lt;strong&gt;forward&lt;/strong&gt; it to the next router using the best path according to the results of the routing protocols.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2016-02-15T15:06:29.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27829" PostTypeId="1" AcceptedAnswerId="28087" CreationDate="2016-02-15T16:43:37.423" Score="1" ViewCount="3710" Body="&lt;p&gt;I'm config access-list on Cisco Router and this information is not show with SNMP.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;step 1 : Config access-list and [show access-list]!&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/qp4z2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qp4z2.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;step 2 : I use CISCO-ACL-MIB With &quot;iReasoning MIB Browser&quot; i'm connected to device and not get output from access-list.&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/fK1bR.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fK1bR.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*I use GNS3 and my Configration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show running-config  &#xA;Building configuration...  &#xA;&#xA;Current configuration : 1684 bytes  &#xA;!  &#xA;version 12.4  &#xA;service timestamps debug datetime msec  &#xA;service timestamps log datetime msec  &#xA;no service password-encryption  &#xA;!  &#xA;hostname R1  &#xA;!  &#xA;boot-start-marker  &#xA;boot-end-marker  &#xA;!  &#xA;!  &#xA;no aaa new-model  &#xA;memory-size iomem 5  &#xA;no ip icmp rate-limit unreachable  &#xA;!  &#xA;ip cef  &#xA;no ip domain lookup  &#xA;!  &#xA;!  &#xA;ip tcp synwait-time 5  &#xA;!  &#xA;interface FastEthernet0/0  &#xA;!  &#xA;interface FastEthernet0/1  &#xA;!  &#xA; serial restart-delay 0  &#xA;!  &#xA;interface Vlan1  &#xA; ip address 172.16.98.63 255.255.255.0  &#xA;!  &#xA;router ospf 1  &#xA; log-adjacency-changes  &#xA; network 10.0.0.0 0.255.255.255 area 1  &#xA;!  &#xA;no ip http server  &#xA;no ip http secure-server  &#xA;!&#xA;access-list 10 deny   10.0.0.0 0.255.255.255  &#xA;access-list 122 deny   icmp 10.0.0.0 0.255.255.255 host 1.1.1.24 echo-reply  &#xA;snmp-server community public RW  &#xA;no cdp log mismatch duplex  &#xA;!  &#xA;control-plane  &#xA;! &#xA;line con 0  &#xA; exec-timeout 0 0  &#xA; privilege level 15  &#xA; logging synchronous  &#xA;line aux 0  &#xA; exec-timeout 0 0  &#xA; privilege level 15  &#xA; logging synchronous  &#xA;line vty 0 4  &#xA; login  &#xA;!  &#xA;!  &#xA;end  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22692" LastEditorUserId="509" LastEditDate="2016-02-16T08:26:20.320" LastActivityDate="2016-02-23T15:22:33.590" Title="Access-list Information from Cisco SNMP" Tags="|cisco|snmp|acl|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="27830" PostTypeId="1" AcceptedAnswerId="27836" CreationDate="2016-02-15T16:59:48.690" Score="22" ViewCount="10143" Body="&lt;p&gt;I know that both TCP and UDP are built on top of IP, and I know the differences between TCP &amp;amp; UDP, but I'm confused about what exactly &quot;raw ip&quot; is. Would it be fair to say that TCP &amp;amp; UDP both implement IP, but that IP in and of itself isn't capable of transferring data? Or is IP some very low level form of communication, which is further abstracted by TCP and UDP?&lt;/p&gt;&#xA;" OwnerUserId="22916" LastEditorUserId="8499" LastEditDate="2018-10-27T02:10:04.363" LastActivityDate="2018-10-27T02:10:04.363" Title="What do TCP/UDP add to &quot;raw ip&quot;?" Tags="|ip|tcp|layer3|udp|layer4|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27832" PostTypeId="2" ParentId="27830" CreationDate="2016-02-15T17:04:38.580" Score="4" Body="&lt;p&gt;IP is an OSI layer-3 protocol, while TCP and UDP are OSI layer-4 protocols. As a layer-3 protocol, IP can carry many different layer-4 protocols. TCP and UDP are probably the most common, but they are not the only ones. Layer-4 protocols are what applications use as their end-to-end connections. IP transports layer-4 protocols from network to network (host-to-host). Layer-2 protocols, like ethernet, transport layer-3 protocols on a LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should research the OSI model, but realize that it is a conceptual model, and the real world often doesn't exactly match.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-15T17:04:38.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27836" PostTypeId="2" ParentId="27830" CreationDate="2016-02-15T19:26:36.617" Score="22" Body="&lt;p&gt;IP is a &lt;a href=&quot;http://www.practicalnetworking.net/packet-traveling/osi-model/#osi-layer-3&quot; rel=&quot;noreferrer&quot;&gt;Layer 3&lt;/a&gt; protocol. TCP/UDP are &lt;a href=&quot;http://www.practicalnetworking.net/packet-traveling/osi-model/#osi-layer-4&quot; rel=&quot;noreferrer&quot;&gt;Layer 4&lt;/a&gt; protocols. They each serve different purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Layer 3 is in charge of end to end delivery&lt;/strong&gt;. Its sole function is adding whatever is necessary to a packet to get a packet from one host to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Layer 4 is in charge of service-to-service delivery&lt;/strong&gt;. Its sole function is to segregate data streams. Your computer can have multiple programs running, each which sends/receives bits on to the wire. IE: You could have multiple browser tabs running, streaming internet radio, running a download, running some &lt;em&gt;legal&lt;/em&gt; torrents, using a chat application, etc. All of these receive 1s and 0s from the wire, and Layer 4 segregates each data streams to the unique application that needs them. Here is an illustration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/weffJ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/weffJ.png&quot; alt=&quot;L4 segregating Data Streams&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP is unable to deliver a packet to the correct service/application. And TCP/UDP is unable to deliver a packet from one end of the internet to the other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both TCP and IP work together to enable them both to achieve the &quot;end-goal&quot; of Internet communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data that needs to get from one host to another is generated by the upper layers of the OSI model. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This data is passed down to L4 which will add the information necessary to deliver the data from service to service, like a TCP header with a Source and Destination Port. The Data and the L4 header is now referred to as a segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then the Segment will be passed to L3 which will add the information necessary to deliver the segment from end to end, like an IP header with a Source an Destination IP address. The L3 header and the segment can now be referred to as a Packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This process is known as &lt;a href=&quot;http://www.practicalnetworking.net/packet-traveling/osi-model/#encap-decap&quot; rel=&quot;noreferrer&quot;&gt;Encapsulation and De-encapsulation&lt;/a&gt; (or sometimes decapsulation). Here is an animation of how it works:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6dKkj.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6dKkj.gif&quot; alt=&quot;Encapsulation and De-encapsulation, used with permission from Practical Networking.net&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this doesn't make sense, I suggest reading more about the &lt;a href=&quot;http://www.practicalnetworking.net/packet-traveling/osi-model&quot; rel=&quot;noreferrer&quot;&gt;OSI model&lt;/a&gt;, and how each layer has different responsibilities that all work together to accomplish &lt;a href=&quot;http://www.practicalnetworking.net/packet-traveling/packet-traveling&quot; rel=&quot;noreferrer&quot;&gt;moving a packet across the Internet&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2016-02-17T04:40:18.077" LastActivityDate="2016-02-17T04:40:18.077" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="27837" PostTypeId="2" ParentId="27830" CreationDate="2016-02-15T20:12:22.220" Score="9" Body="&lt;p&gt;IP can transmit data just fine, the problem is what happens when that data gets to the other end. The only identification information is the IP addresses of the hosts and a protocol number. Neither of which provide any way to distinguish what socket the data is for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible for programs to use IP directly through what are known as &quot;raw sockets&quot; but the lack of a proper mechanism for deciding which socket to send data to raises security and performance concerns (the kernel has to send the data to all raw sockets for a given protocol number). For this reason the ability to open &quot;raw sockets&quot; is usually restricted to root (or your platform's equivilent). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP is a fairly minimal layer over IP. It adds port numbers to identify what socket the data is for and a checksum (to reject corrupt packets). The application remains responsible for dealing with lost packets, controlling congestion and splitting the data into appropriate sized packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP is a more complex protocol that in addition to providing port numbers and checksums splits byte-streams into packets, reassembles then at their destination and provides congestion control and recovery features.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-02-15T21:16:37.407" LastActivityDate="2016-02-15T21:16:37.407" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27838" PostTypeId="1" AcceptedAnswerId="27850" CreationDate="2016-02-15T20:31:33.677" Score="3" ViewCount="2577" Body="&lt;p&gt;I have looked through as much Cisco, and other, documentation as I could find on the subject, but I couldn't find a solid answer on this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default action for an interface that exceeds the configured storm-control level is to drop the traffic.  However, what happens to an interface when you configure one of the optional behaviors?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would seem that the traffic &lt;em&gt;would&lt;/em&gt; continue to be dropped, in addition to the configured behavior.  But I can't find evidence of this.  Here I've configured a storm-control action of &lt;em&gt;'trap'&lt;/em&gt;, along with rise and fall thresholds.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;storm-control action trap&#xA;storm-control broadcast level 40.00 30.00&#xA;storm-control multicast level 40.00 30.00&#xA;storm-control unicast level 40.00 30.00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7534" LastEditorUserId="8499" LastEditDate="2016-03-17T14:44:15.133" LastActivityDate="2016-03-17T14:44:15.133" Title="Cisco Storm-Control default action when an optional action is configured" Tags="|cisco|switch|security|storm-control|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="27839" PostTypeId="2" ParentId="27838" CreationDate="2016-02-15T20:44:15.660" Score="1" Body="&lt;p&gt;Storm control options have pretty descriptive names like &lt;code&gt;shutdown&lt;/code&gt; or &lt;code&gt;trap&lt;/code&gt;. Shutdown will shut the port down, and trap will send an SNMP trap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have the drop option, the first number will be the point at which the traffic will be suppressed (dropped), and it will continue to be suppressed until the traffic drops below the second number, at which point it will again flow through the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All three options will prevent excessive traffic, either by dropping it or disabling the port. Trap will also send SNMP traps. Depending on how you have SNMP configured, you could get a trap when a port is shut down by the shutdown option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can flood SNMP with the trap option, so you should configure the storm control trap rate in the SNMP configuration.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-15T22:45:14.483" LastActivityDate="2016-02-15T22:45:14.483" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="27840" PostTypeId="2" ParentId="26802" CreationDate="2016-02-15T20:45:10.610" Score="3" Body="&lt;p&gt;This is an insanely broad question, but an outline is possible. Here's what I'd do if I was thrust into this situation.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Determine the goal. Am I &quot;cleaning up&quot; the mess without changing things. Meaning, literally organizing/cleaning up cabling, mounting, etc... while trying to &quot;hold the line&quot; with everything working as-is. Or am I &quot;cleaning up&quot; in the sense of getting ready for ongoing maintenance or future expansion. Locate the person who is responsible for this project and make sure they are on board.  (ie, who will be buying me things I say I need; software, labeling systems, cables, mounting hardware, tools)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Inventory. (Spend two work days reading about how to label and track things before lifting a finger.) Make an inventory of everything out to the wall jacks. Everything. Every cable, patch, rack, router, switch. Model numbers, serial numbers too. Everything. Get inventory/configuration-management software, or roll your own scheme if no money available. Label EVERYTHING as you along.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Possess. Gain administration ability on everything in inventory. Get in. Break in. (...or turn it off and then figure out who was responsible &amp;lt;- that's a joke. :) Integrate this admin knowledge into your CMDB/knowledge-base whatever.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Change. Pick something that qualifies as part of &quot;this mess&quot;. Replace it with some industry standard thing/method that is better. Repeat.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="49" LastActivityDate="2016-02-15T20:45:10.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27842" PostTypeId="2" ParentId="27826" CreationDate="2016-02-15T22:32:56.193" Score="2" Body="&lt;p&gt;&lt;strong&gt;About Route Cost and Distance Vectors&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As xpac said, different routing protocols use different methods to find the best route to a specific network. The idea of a routing protocol is that it allows routers to learn from other routers what networks are attached to which router, instead of you typing everything into every router by hand. A route is basically the &quot;way&quot; to a specific network. As you can have multiple ways to take you to the island of Manhattan from New Jersey for example, you can have multiple routes to a network. A router broadcasts to it's neighbours all the networks it has attached locally. The next router takes this info in, and sees if it has got any of the routes already in memory (called the routing table). If it doesn't, it adds it. If it has, it checks if that route is better than the one it already has, and if it is, it adds it higher up than the old one in the routing table. And when it's done, it sends out all the routes it now knows of onwards to it's neighbours (only exception is that it doesn't send back routes to the router it got them from). This way the network as a whole learns of every network connected to every router in that network, and every possible path to take to get from one network to the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The crux in the matter is how the router determines which way is the &quot;best&quot; one to take, and this is where Route Costs and Distance Vectors come in to play. Every routing protocol takes a different approach to calculating the route cost or metric of a route. Distance vector protocols, such as RIP, looks at how many hops there are in a route, and calculates a metric from that, since fewer hops means faster processing since fewer routers have to forward the packet. This is quite old-school thinking, and dates from a time when routers were slow and bandwidth quite inconsequential. These days routers are quite fast, and the hop-count not that important. Newer protocols have been developed, and some use another approach called link-state. One such, OSPF, factor in a lot of different metrics, and are a lot more complex (OSPF factors in bandwidth and how it learned of a route for example).&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-15T22:32:56.193" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27843" PostTypeId="2" ParentId="26802" CreationDate="2016-02-15T22:45:00.097" Score="2" Body="&lt;p&gt;I like the OODA loop, Observe, Orient, Decide, Act, which basically means you observe the current situation, come up with a game plan, decide on how to proceed, and act on that plan. Then you loop back up and start the cycle over. Try to break the project up into manageable chunks, for example what you can get done in a service window. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd start with Craig's 4 steps. It's important that you spend a lot of time getting to know &quot;the proper way&quot; of doing things in this industry. You won't get it right every time, but you'll spend less time reworking your own creation later on when you gain more experience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have all the intel you can coerce out of your current setup, I'd clean up the L2 networks of every floor one by one. It's the most manual place to attack something like this, and it helps to have clean-ish racks when you break something by accident later. Don't try to get it perfect, just get it manageable for now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then attack the L3 backbone of the network. Tidy it up and get it running smoothly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then attack the server room last. By now you should have a pretty good idea of what you have and what you would like to have. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this, you can start on the higher level stuff, like reorganizing the IP addressing scheme, add redundancy and better performance, the things that doesn't make the network function any better in a binary sense (connectivity/no connectivity) but improve the quality of the network service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The progression of fixing a messy network is basically the same as troubleshooting it, start with L1 and move up in the model when you have the previous layer licked. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-15T22:45:00.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27844" PostTypeId="2" ParentId="27822" CreationDate="2016-02-15T22:47:52.593" Score="1" Body="&lt;p&gt;Exactly what you asked for: &lt;code&gt;service dhcp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you probably wanted:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfdhcp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfdhcp.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The trick is that the pool has to be in the same network as assigned to an interface. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-15T22:47:52.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27845" PostTypeId="2" ParentId="20721" CreationDate="2016-02-15T22:51:09.647" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Will using a desktop without a special NIC introduce lag?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not at anything you'll be running through it, but I've seen some desktop MOBO NICs start to fluke out when you try to push around 700 Mbps at them. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-15T22:51:09.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27848" PostTypeId="2" ParentId="27816" CreationDate="2016-02-16T01:16:09.583" Score="3" Body="&lt;p&gt;WPA and WPA2 in very simple terms are two different methods for and end device and AP to exchange encryption keys. Depending on your platform, you can support WPA and/or WPA2 with either TKIP or AES.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TKIP and AES are the two methods by which the data is encrypted.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What are the biggest differences between WPA and WPA2 and why is AES so much safer than TKIP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If it helps, think of the difference as pressing a paper towel to a three inch gash on your arm versus getting stitches at the emergency room. One is an immediate solution that mitigates the problem at hand, the other is a better, longer term solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WEP was broken (badly) and needed to be fixed. However standards bodies sometimes move much slower than solutions are needed. So WPA/TKIP was provided as a &lt;em&gt;better&lt;/em&gt; solution than WEP that could be implemented purely in code/software/drivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, TKIP is WEP with a few extra features, provided to the community largely by a major network vendor they had previously developed as proprietary enhancements. While it provided fixes to many of the problems with WEP, it is still based on WEP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WPA was derived from a draft of the 802.11i amendment from the IEEE. There were some changes from the draft to the finalized version of 802.11i, which is why the 802.11i standard version is called WPA2. Ultimately the differences are relatively trivial in the grand scheme of things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For encryption, the IEEE selected AES for 802.11i. This was a much stronger encryption than WEP however many existing wireless devices were not capable of handling the demands of AES, often requiring new wireless adapters to be installed/used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of this limitation to AES, it was allowed to run either WPA/WPA2 with TKIP instead of AES until the IEEE finalized 802.11n. 802.11n no longer allowed support for TKIP, so an access point was supposed to disable the HT (high throughput) data rates if it were used and operate like an 802.11a/g device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since that time, only WPA/AES or WPA2/AES are supported officially by the 802.11 standards.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-02-16T01:16:09.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27850" PostTypeId="2" ParentId="27838" CreationDate="2016-02-16T06:36:49.737" Score="2" Body="&lt;p&gt;Always blocking traffic, in your case all kind of multicast,unicast in addition. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your choice can be shutdown port or send snmp trap, but all of it would be happen after blocking.&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/31sga/configuration/guide/config/bcastsup.pdf&quot; rel=&quot;nofollow&quot;&gt;cisco off doc&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22919" LastEditorUserId="22919" LastEditDate="2016-02-16T06:59:19.773" LastActivityDate="2016-02-16T06:59:19.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27851" PostTypeId="1" CreationDate="2016-02-16T08:55:45.150" Score="2" ViewCount="1653" Body="&lt;p&gt;I'm currently in the process of converting a ScreenOS configuration to a JunOS router and am a bit confused by the current configuration of two bridge groups on the old router. It's my understanding that bridge groups aim to bridge two or more interfaces as a physical bridge would. However, on the ScreenOS router, the two bridge groups only have one interface each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does having a bridge group with one interface serve any purpose, or can it be configured as a regular interface would? I've looked at the setup of both bgroups, and they are configured exactly the same way as the other interfaces on the router are. The only difference is that the interfaces sit under a bgroup, which to me appears to be redundant. If my understanding of this is skewed, please correct me - I'll admit that this is the first time I've had to work with bridge groups, and there seems to be little about them on the Internet for me to work with. &lt;/p&gt;&#xA;" OwnerUserId="22839" LastActivityDate="2016-05-21T01:56:03.073" Title="Is there any reason to have a bridge group with only one interface?" Tags="|juniper|juniper-junos|screenos|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="27852" PostTypeId="2" ParentId="5990" CreationDate="2016-02-16T10:17:23.477" Score="0" Body="&lt;p&gt;The basic answer to this issue lies in the &lt;code&gt;%TUN-5-RECURDOWN: 0 temporarily disabled due to recursive routing&lt;/code&gt; error message. When the Routing Process needs to decide where to route a specific packet, it essentially needs to find out what interface to send the packet out of. In case of a GRE tunnel, Recursive Routing occurs when a more advantageous route (lower metric) to the tunnel endpoints gets learned through the tunnel it self. When that happens we will end up with a Recursive Loop where the traffic is identified to be routed via the Tunnel which is identified to be routed via the Ethernet (or Serial) interface which again is identified to be routed via the Tunnel; Resulting in an infinitive loop:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ingress Interface -&gt; Tun. Interface -&gt; Eth. Interface -&gt; Tun. Interface -&gt; etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If dynamic routing needs to be enabled on the tunnel this situation can be resolved in one of many ways (more options may exist):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Add static routes to the tunnel endpoints with a net mask of /32 to ensure that these always will be the preferred routes.&lt;/li&gt;&#xA;&lt;li&gt;Apply a &lt;strong&gt;&lt;em&gt;distribution-list&lt;/em&gt;&lt;/strong&gt; outbound on the tunnel interface (configured under the routing protocol configuration) to filter the tunnel endpoint addresses from getting advertised.&lt;/li&gt;&#xA;&lt;li&gt;Change the metric of the routes learned through the tunnel by changing the properties of the tunnel interface (&lt;strong&gt;&lt;em&gt;delay&lt;/em&gt;&lt;/strong&gt; / &lt;strong&gt;&lt;em&gt;bandwidth&lt;/em&gt;&lt;/strong&gt;), resulting in these routes being less attractive than the same routes learned over the Ethernet (or Serial) interface.&lt;/li&gt;&#xA;&lt;li&gt;Use FVRF to create a logical routing table segregation (see more about solving Recursive Route by FVRF here: &lt;a href=&quot;http://www.packetu.com/2013/10/15/using-gre-tunnel-vrf-separate-physical-interface/&quot; rel=&quot;nofollow&quot;&gt;http://www.packetu.com/2013/10/15/using-gre-tunnel-vrf-separate-physical-interface/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22941" LastEditorUserId="22941" LastEditDate="2016-02-16T10:40:53.520" LastActivityDate="2016-02-16T10:40:53.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27853" PostTypeId="1" AcceptedAnswerId="27855" CreationDate="2016-02-16T10:39:01.030" Score="3" ViewCount="1592" Body="&lt;p&gt;I'm little bit confusing about the flow of things that happen during a voyage of packet in the internet.&lt;br&gt;&#xA;my basic question is : &lt;strong&gt;What is the connection between OSPF and forwarding tables?&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose there are lets say 10 ASes, each AS has some routers and switches within it. Now, host A in some AS want to send IP datagram to host B which is in other AS. Now, first of all, the AS use OSPF protocol. By this, each router know what is the &quot;cost&quot; of send datagram to the another routers in the AS? &#xA;And another question: when datagram arrives to a router, and in the forwarding table there is no match, it floods to all of its interfaces (?) , but, OSPF give each router the best path it need to choose, so why forwarding tables are needed anyway? i'm so confused and can't find connections between things. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(sorry about the english, it is not my native language)&lt;/p&gt;&#xA;" OwnerUserId="24542" LastEditorUserId="24542" LastEditDate="2016-02-16T10:52:36.647" LastActivityDate="2018-05-03T09:24:12.227" Title="OSPF, BGP &amp; Forwarding tables" Tags="|routing|router|ip|ospf|ip-forwarding-table|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27854" PostTypeId="2" ParentId="19892" CreationDate="2016-02-16T10:59:27.137" Score="3" Body="&lt;p&gt;We had problems using &quot;ALG&quot; or SIP inspection using SIP clients.&#xA;The problem was the ASA was keeping sessions open when the call was terminated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What was happening was the when we made a second call we had no voice over the call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;note: We haven't had problems with the provider that was providing voip for our SIP trunk's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But...&#xA;The moment we disabled the SIP inspection in total on the ASA, all SIP clients where working perfectly and registration to our own sip server was restored much faster if we had a network disconnect of somekind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also i did lots of research in this on the web and everywhere you see to disable the SIP inspection. I have tried to find a workaround or tune the inspection but nothing worked as good as just disabling the inspection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe this is not the best answer but couldnt comment yet(just signed up) and maybe my reaction can help in somekind of way.&lt;/p&gt;&#xA;" OwnerUserId="22937" LastActivityDate="2016-02-16T10:59:27.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27855" PostTypeId="2" ParentId="27853" CreationDate="2016-02-16T11:00:25.990" Score="5" Body="&lt;p&gt;Routing protocols, in general, are used to populate the routing tables and not to forward packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Between two AS it is generally BGP that is used to exchange routes, and within an AS, it can be OSPF, but could also be IS-IS, EIGRP or any routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A given router can use several routing protocols at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say a router is configured to use OSPF and BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router will keep in memory different routing tables:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;one for routes learn trough OSPF&lt;/li&gt;&#xA;&lt;li&gt;one for routes learn trough BGP&lt;/li&gt;&#xA;&lt;li&gt;one for routes added statically by the router administrator&lt;/li&gt;&#xA;&lt;li&gt;one for network directly connected&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The forwarding table is built by selecting routes within all those tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For each network that exists in at least one routing table, the router select the best one and put it in its forwarding table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the router receive a packet, it looks only in its forwarding table to decide where to send it. Where the route comes from has no importance at this point.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2018-05-03T09:24:12.227" LastActivityDate="2018-05-03T09:24:12.227" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="27856" PostTypeId="1" AcceptedAnswerId="41144" CreationDate="2016-02-16T11:44:21.453" Score="2" ViewCount="2978" Body="&lt;p&gt;I'm new here.&#xA;I am facing a problem in which I can't apply my Site to Site VPN successfully on Packet Tracer, and I'm really baffled. Tried to consult youtube and all but can't get it running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where have I gone wrong with the commands?&#xA;This is the link to my packet tracer file: &lt;a href=&quot;https://drive.google.com/file/d/0B4fC7OcAZvRIQ3JWbF83T1R0SnM/view?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;Version 2.pkt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;HQ CONFIG:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto isakmp enable&#xA;crypto isakmp policy 1&#xA;authentication pre-share&#xA;encryption 3des&#xA;hash sha&#xA;group 2&#xA;exit&#xA;crypto isakmp key 0 address 200.0.0.9 0.0.0.0&#xA;crypto ipsec transform-set VPN-MAP esp-3des esp-sha-hmac &#xA;ip access-list extended vpns2s&#xA;permit ip 192.168.3.0 0.0.0.255 192.168.1.0 0.0.0.255&#xA;exit&#xA;crypto map VPN-MAP 1 ipsec-isakmp&#xA;description VPN connection to BRANCH&#xA;match address vpns2s&#xA;set peer 200.0.0.9&#xA;set pfs group2&#xA;set transform-set VPN-MAP&#xA;exit&#xA;interface S0/0/0&#xA;crypto map VPN-MAP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;BRANCH CONFIG:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto isakmp enable&#xA;crypto isakmp policy 1&#xA;authentication pre-share&#xA;encryption 3des&#xA;hash sha&#xA;group 2&#xA;exit&#xA;crypto isakmp key 0 address 200.0.0.1 0.0.0.0&#xA;crypto ipsec transform-set VPN-MAP esp-3des esp-sha-hmac&#xA;ip access-list extended vpns2s&#xA;permit ip 192.168.1.0 0.0.0.255 192.168.3.0 0.0.0.255&#xA;exit &#xA;crypto map VPN-MAP 10 ipsec-isakmp&#xA;description VPN connection to HQ&#xA;match address vpns2s&#xA;set peer 200.0.0.1&#xA;set pfs group2&#xA;set transform-set VPN-MAP&#xA;exit&#xA;interface S0/0/1&#xA;crypto map VPN-MAP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After applying the commands it apparently doesn't work..&lt;/p&gt;&#xA;" OwnerUserId="22943" LastEditorUserId="509" LastEditDate="2016-02-16T12:24:21.680" LastActivityDate="2017-05-18T14:31:47.090" Title="Packet Tracer: Site to Site VPN" Tags="|vpn|packet-tracer|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="27857" PostTypeId="1" AcceptedAnswerId="27876" CreationDate="2016-02-16T12:10:06.107" Score="6" ViewCount="1018" Body="&lt;p&gt;Due to its limitations (small hop count, slow convergence, possibly large periodic updates), RIPv2 has always been deemed inferior to alternatives like OSPF and IS-IS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, over the years, people used to argue that both configuration simplicity and low impact on CPU would remain somewhat useful for corner-case applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this still hold true? Nowdays, CPUs are faster, links are speedier, the other complex IGP alternatives are widely known.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone please point specific use cases for considering RIPv2 in &lt;strong&gt;modern&lt;/strong&gt; networking engineering?&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-16T22:04:59.620" Title="Are there specific, concrete use cases for RIPv2 in modern network engineering?" Tags="|routing|rip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27859" PostTypeId="2" ParentId="27822" CreationDate="2016-02-16T14:05:37.210" Score="1" Body="&lt;p&gt;configuration for dhcp from cisco router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Router(config)# service dhcp&#xA;&#xA; Router(config)# ip dhcp excluded-address low-address [high-address]  &#xA; Router(config)# ip dhcp pool name &#xA; Router(config)# no ip dhcp conflict logging &#xA;&#xA;Router(dhcp-config)# network network-number [mask | /prefix-length]&#xA;&#xA;Router(dhcp-config)# domain-name domain  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22947" LastEditorUserId="509" LastEditDate="2016-02-16T14:16:26.673" LastActivityDate="2016-02-16T14:16:26.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27860" PostTypeId="1" AcceptedAnswerId="27863" CreationDate="2016-02-16T14:06:43.627" Score="1" ViewCount="4796" Body="&lt;p&gt;I have recently been getting Internet dropouts and in my logs, I see that there is SPI and Xmas attacks going on. What are these attacks? I assume I get these drop outs because my router is not able to reject all of these requests?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9tuSp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9tuSp.jpg&quot; alt=&quot;Syslog from Router&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Can a moderator move this question if this is in the wrong area?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S 2 The IP shown in the picture is not the only IP that is &quot;attacking&quot; me&lt;/p&gt;&#xA;" OwnerUserId="22713" LastEditorUserId="22713" LastEditDate="2016-02-16T15:02:04.980" LastActivityDate="2017-07-10T20:48:25.863" Title="What is an SPI and Xmas Attack" Tags="|router|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27861" PostTypeId="2" ParentId="27860" CreationDate="2016-02-16T14:20:12.083" Score="1" Body="&lt;p&gt;Your &lt;strong&gt;WAN IP address&lt;/strong&gt; is being port-scanned systematically looking for a vulnerability. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router should block all this incoming traffic from reaching your LAN, however it imposes a high toll in router's performance because its processor does not have enough capacity to process and dump the packets fast enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is nothing you can do to stop the attacks from hitting your router, except reboot the router in hope that the ISP assigns your connection another IP address. &lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2016-02-16T14:20:12.083" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="27862" PostTypeId="2" ParentId="27860" CreationDate="2016-02-16T14:41:54.040" Score="2" Body="&lt;p&gt;Xmas &quot;attack&quot; is a XMas Tree Packet, aka a TCP packet with every flag set. It makes no sense to set all flags, and systems back in the '90s used to crash when they see one. That's what it's called an &quot;attacK&quot;. These days they are used for OS fingerprinting as different operating systems respond differently to nonsense packets. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-16T14:41:54.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27863" PostTypeId="2" ParentId="27860" CreationDate="2016-02-16T14:43:01.960" Score="3" Body="&lt;p&gt;SPI and Xmas attacks are two techniques to identify vulnerabilities in your router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SPI attack is basically a port scan, it will tell to the attacker which ports are opened, for example HTTP  / HTTPS / SSH / RDP...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Xmas attack sent packets with all IP / TCP / UDP (or other protocols) option sets.&#xA;Different operating systems or router firmware (Linux / Cisco / Windows / Juniper...) will respond differently to those options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the response will likely tell the attacker what kind of router you have. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the attacker has identified the Operating Systems and the ports open, it can try to exploit known vulnerabilities in this specific system / application.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-02-16T15:59:33.263" LastActivityDate="2016-02-16T15:59:33.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27865" PostTypeId="2" ParentId="27857" CreationDate="2016-02-16T15:40:10.450" Score="5" Body="&lt;p&gt;RIP is nearly universally supported, even on small routers which don't support OSPF or IS-IS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose you had a network with only two routers with a few LANs connected to each one. It would be easier to set up RIP than it would be to configure static routes, and any changes to the networks on one or the other router would automatically propagate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your routers don't support OSPF, or its configuration is more complex than warranted for your site, RIP could work.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-16T15:40:10.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27869" PostTypeId="1" AcceptedAnswerId="27870" CreationDate="2016-02-16T17:30:38.977" Score="2" ViewCount="4616" Body="&lt;p&gt;I have a setup of two routers like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; internet ---- Router A ---- Router B  -- Host A&#xA;                  \               \&#xA;                webserver       Host B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Webserver resides in a DMZ and all ports on Router B are closed.&lt;/li&gt;&#xA;&lt;li&gt;Router A and B have a different subnet mask&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've written a script which outputs a html page (which should be hosted by the webserver) showing all online Hosts. It uses &lt;code&gt;arp-scan&lt;/code&gt; but it only works &quot;behind&quot; router B. So Host A and Host B can see each other but the webserver can not see the Hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I resolved this issue by making a LAN-to-LAN network between the two routers. But now I caused a security threat by putting the hosts together with the webserver (with open ports) on one network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How can I let my webserver still &lt;code&gt;arp-scan&lt;/code&gt; Hosts on the network without having hosts exposed to security threats?&lt;/strong&gt; (I can provide extra information if desired. Excuse me if haven't used correct terminology)&lt;/p&gt;&#xA;" OwnerUserId="22957" LastActivityDate="2016-02-16T17:41:56.750" Title="arp-scan different subnet" Tags="|router|arp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27870" PostTypeId="2" ParentId="27869" CreationDate="2016-02-16T17:36:10.597" Score="4" Body="&lt;p&gt;You are trying to use a layer-2 broadcast across a layer-3 device (router). That's not how it works. ARP is restricted to the local LAN for requests, and replies are to the requesting host, so they will not be sent across layer-3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to use ARP to scan, you would need a scan device on each LAN you want to scan. You could have it report back to a central location.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-16T17:41:56.750" LastActivityDate="2016-02-16T17:41:56.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27872" PostTypeId="1" AcceptedAnswerId="27874" CreationDate="2016-02-16T19:23:06.623" Score="1" ViewCount="34" Body="&lt;p&gt;i have this statement:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit ip host 30.0.10.2 host 20.0.0.3 &#xA;access-list 101 deny ip any host 20.0.0.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but ip &quot;20.0.0.2&quot; blocking after assign this asl to router.&#xA;why?&lt;/p&gt;&#xA;" OwnerUserId="22960" LastActivityDate="2016-02-16T19:41:16.380" Title="acl block ip is not in parameters" Tags="|cisco|cisco-ios|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27874" PostTypeId="2" ParentId="27872" CreationDate="2016-02-16T19:41:16.380" Score="3" Body="&lt;p&gt;Access lists have an implicit &quot;deny all&quot; at the end of every ACL.  If you want to allow other traffic, you need to add a third line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-02-16T19:41:16.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27876" PostTypeId="2" ParentId="27857" CreationDate="2016-02-16T22:04:59.620" Score="10" Body="&lt;p&gt;I have often deployed RIP on the edge of MPLS VPNs on PE-CE links to give customers dynamic routing into their own VRF to good effect (though admittedly less and less these days).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case it is a perfectly valid use - small RIB size (especially with a default out, local-site prefixes in), convergence time often isn't an issue (often only a single link to the site), hop count is fixed (eg: 1).  Due to the meager control-plane requirements, this provides a &lt;em&gt;very&lt;/em&gt; scalable solution for hundreds or thousands of CEs per PE. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ron has mentioned - not all CE devices support BGP, and no (sane) carrier wants to run OSPF or ISIS across a network boundary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to have become very hip in the last decade of Networking to hate on RIP or imply that using it is somehow a reflection of poor design/architecture decisions, but I tend to prefer simplicity and The Right Tool for the Job™.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-02-16T22:04:59.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27877" PostTypeId="1" AcceptedAnswerId="27880" CreationDate="2016-02-16T22:28:17.210" Score="4" ViewCount="9376" Body="&lt;p&gt;I've been using wireshark and noticed that I no longer see UDP but QUIC, why is this the case?&lt;/p&gt;&#xA;" OwnerUserId="22963" LastEditorUserId="22963" LastEditDate="2016-02-18T18:25:00.400" LastActivityDate="2016-02-18T18:25:00.400" Title="Why do i only see QUIC and not UDP during capture in wireshark?" Tags="|wireshark|udp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27878" PostTypeId="2" ParentId="27877" CreationDate="2016-02-16T23:27:03.727" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/QUIC&quot; rel=&quot;nofollow&quot;&gt;QUIC&lt;/a&gt; runs atop UDP, so a QUIC packet &lt;em&gt;is&lt;/em&gt; a (normal) UDP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark currently treats all UDP packets to or from ports 80 and 443 as QUIC packets - even if they aren't.  Are the UDP packets in question going to or from one of those ports?  And &lt;em&gt;are&lt;/em&gt; they, in fact, QUIC?&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2016-02-16T23:27:03.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27879" PostTypeId="2" ParentId="27877" CreationDate="2016-02-16T23:27:42.480" Score="1" Body="&lt;p&gt;If you see QUIC, you &lt;em&gt;are&lt;/em&gt; seeing UDP. Unless you are sending UDP segments without QUIC, you won't see only UDP.&lt;/p&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-tsvwg-quic-protocol-02&quot; rel=&quot;nofollow noreferrer&quot;&gt;A UDP-Based Secure and Reliable Transport for HTTP/2 draft-tsvwg-quic-protocol-02&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;QUIC (Quick UDP Internet Connection) is a new multiplexed and&#xA;secure    transport atop UDP, designed from the ground up and&#xA;optimized for&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2016-02-16T23:27:42.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27880" PostTypeId="2" ParentId="27877" CreationDate="2016-02-17T00:11:32.757" Score="6" Body="&lt;p&gt;Wireshark uses dissectors and lua scripts to analyze and classify capture traffic (or parts thereof).  What is displayed in the &lt;em&gt;Protocol&lt;/em&gt; field of Wireshark's &lt;em&gt;Packet List Pane&lt;/em&gt; is the information returned that is most specific after analyzing the data and will determine how the data is presented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the UDP dissector is the most specific dissector for the captured data, than the &lt;em&gt;Protocol&lt;/em&gt; column will show UDP. However many types of UDP traffic will be identified (SIP, RTP, DNS, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same is true for TCP traffic as well. Typically you will see this as HTTP, FTP, IRC, etc.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I've using wireshark and noticed that I no longer see UDP but QUIC, why is this the case?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In your case because the traffic has been analyzed as QUIC data. It may or may not be QUIC traffic; no program of this type is perfect, but Wireshark will be correct more often than not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;QUIC is one of the &quot;newer&quot; classifications, as it appears to have been added in 1.11.3/1.12.0. If you were using a version of Wireshark prior to these versions, the same traffic may likely have been classified as UDP (or another protocol).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't want the QUIC protocol to be identified, simply go to the &quot;Analyze&quot; menu and select &quot;Enabled Protocols&quot; from the list. Find the entry for QUIC and uncheck the box.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-02-17T00:11:32.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27881" PostTypeId="1" AcceptedAnswerId="27882" CreationDate="2016-02-17T00:30:23.500" Score="2" ViewCount="4315" Body="&lt;p&gt;I have a port on a switch configured with port-security and sticky option.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/18&#xA;...&#xA; switchport port-security maximum 2&#xA; switchport port-security&#xA; switchport port-security mac-address sticky&#xA; switchport port-security mac-address sticky 78e7.d1b4.8e14&#xA; switchport port-security mac-address sticky 0060.b955.c003 vlan voice&#xA;...&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The IP phone is no longer connected to this port. If I show the MAC addresses on the port, both addresses are shown.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show mac address-table int fa0/18&#xA; Mac Address Table&#xA;-------------------------------------------&#xA;Vlan Mac Address Type Ports&#xA;---- ----------- -------- -----&#xA; 491 0060.b955.c003 STATIC Fa0/18&#xA; 413 78e7.d1b4.8e14 STATIC Fa0/18&#xA;Total Mac Addresses for this criterion: 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I view only the active MAC address, not including sticky addresses no longer there? &lt;code&gt;show mac address-table dynamic&lt;/code&gt; does not show the one still there because it is now &lt;code&gt;static&lt;/code&gt; due to being recorded by the sticky statement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By &lt;em&gt;active&lt;/em&gt;, I mean that the device is still connected and sending packets on that port - as opposed to just still be recorded as a sticky mac address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Netdisco, for example, is somehow able to tell the difference when it performs its &lt;em&gt;macsuck&lt;/em&gt; operation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;select mac, port, active from node where port = 'FastEthernet0/18';&#xA;&#xA;mac                 port                active&#xA;78:e7:d1:b4:8e:14   FastEthernet0/18    true&#xA;00:60:b9:55:c0:03   FastEthernet0/18    false&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1518" LastEditorUserId="1518" LastEditDate="2016-02-17T01:07:54.413" LastActivityDate="2017-10-28T15:54:11.237" Title="How to view active MAC address only on a port" Tags="|cisco|cisco-commands|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27882" PostTypeId="2" ParentId="27881" CreationDate="2016-02-17T00:58:41.620" Score="3" Body="&lt;p&gt;As long as the MAC is statically assigned to the port, it will always appear in the tables. As far as the switch is concerned, it's always &quot;active&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to know it's there is to ping it, check the dhcp snooping tables, etc. MAC port learning will not work.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-02-17T00:58:41.620" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27883" PostTypeId="2" ParentId="27881" CreationDate="2016-02-17T00:58:58.123" Score="1" Body="&lt;p&gt;A switch learns that a particular MAC address is on a port due to traffic on that port. It will retain this in the MAC address table until it times out the entry (which is reset when there is more traffic from that MAC address on that port). You can specifically tell the port that the MAC address entry should never expire, as you do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco switches allow you to adjust the timeout period for the MAC address table with the &lt;code&gt;mac address-table aging-time&lt;/code&gt; command. (Some IOS versions have the dashes differently.)&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-17T00:58:58.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27886" PostTypeId="1" AcceptedAnswerId="27887" CreationDate="2016-02-17T05:54:55.697" Score="3" ViewCount="155" Body="&lt;p&gt;While I'm testing the STP function in several different Switches, I found Some Switches use single MAC address for all LAN ports (e.g. Buffalo's BS-G2108M, Netgear's GS716Tv3), while some other Switches assign one MAC per LAN port (e.g. ELECOM's EHB-SG2A08-PL)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why use &quot;one MAC per port&quot; design for STP function? Someone said that STP self-loop may not work correctly if &quot;one MAC per port&quot; design is not used. Is it True? And is there any other advantages or disadvantages by using &quot;one MAC per port&quot; design?&lt;/p&gt;&#xA;" OwnerUserId="22930" LastActivityDate="2016-02-17T06:13:27.907" Title="Why use one MAC per port design in L2 switch for STP function" Tags="|switch|mac-address|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27887" PostTypeId="2" ParentId="27886" CreationDate="2016-02-17T06:13:27.907" Score="0" Body="&lt;p&gt;The one-MAC-per-port design decision really has nothing to do with STP since all the MAC addresses will be relatively in the same ballpark as far as value, and STP takes into account the port number when making decisions. It is likely that the separate MAC addresses per port are easier to use for the switch's STP port decision if the MAC addresses increase in value as the port number increases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP will not loop if the same MAC address is used for all the ports. On the contrary, it would be more likely to loop if the MAC addresses are different, but it is unlikely that such a problem would get through product testing, or survive long in implementations.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-17T06:13:27.907" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27889" PostTypeId="1" AcceptedAnswerId="30544" CreationDate="2016-02-17T06:52:08.940" Score="2" ViewCount="1920" Body="&lt;p&gt;We have 2 P2P (8M X 2) connection in between HQ and Factory with Cisco 2951 routers at both ends. We are running these links with OSPF cost set to 90. Both links are active and running simultaneously for backup and increased bandwidth (2 X 8M = 16M). So hosts from LAN side sending traffic to both the links. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in the case of one link goes down host interruption occurs for a while during other link takes over all the outbound traffic. I'm wondering why not we combine these WAN links together act as a single interface so that users don't feel the interruption. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read several article on Cisco web portal on this but can't decide which technology will suit this scenario most as EtherChannel, MFR, BVI etc? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any easy way to combine these interface together having both the links running at the same time. &lt;/p&gt;&#xA;" OwnerUserId="17316" LastActivityDate="2016-08-17T01:56:03.000" Title="How to aggregate multiple WAN interfaces (GE) together on Cisco Routers?" Tags="|cisco|router|wan|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="27890" PostTypeId="2" ParentId="27889" CreationDate="2016-02-17T07:23:49.567" Score="1" Body="&lt;p&gt;As @YLearn writes, if you are going through a service provider, you need to have its cooperation, and with two separate providers, your options aren't good at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have direct connections via something like dark fiber, you have some options. Since you say you are using P2P, you could use MLPPP. This, and the other options will lag if your interface still shows up while the link is down (can happen with things like metro ethernet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to leave it as is and enable BFD (assuming your license permits it, or you get the proper license) to detect a failover faster. This has the advantage of failing faster than most of the other options, even if the interface still shows up when the link is down.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-17T07:23:49.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27892" PostTypeId="1" AcceptedAnswerId="27916" CreationDate="2016-02-17T09:37:51.567" Score="1" ViewCount="490" Body="&lt;p&gt;We use a Cisco SG300 for small routing issues in one Part of our Network, now we want to create a cross connect between two locations. Between both Location we use a dark fibre from a provider. On the one side we want to connect the Darkfibre on one SFP Port of the SG300 (with C&lt;a href=&quot;http://www.cisco.com/c/en/us/support/interfaces-modules/mgblx1-gigabit-ethernet-lx-mini-gbic-sfp-transceiver/model.html&quot; rel=&quot;nofollow&quot;&gt;isco MGBLX1 Gigabit Ethernet LX Mini-GBIC SFP Transceiver&lt;/a&gt;) and on the other side we want connect to the SFP+ Port of the ISR 2921 (with &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/interfaces_modules/transceiver_modules/compatibility/matrix/GE_Tx_Matrix.html&quot; rel=&quot;nofollow&quot;&gt;1000BASE-LX/LH SFP transceiver module, MMF/SMF, 1310nm, DOM&lt;/a&gt;) and provide a Network access over the Ethernet Port of the ISR 2921. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We want connect two networks over this cross connect. Are there some problems with or is this applicable? The Darkfibre distance between both Locations are about 4km, and we realize only a few VoIP Channels over this connection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the GLC-LH-SMD= compatible with the MGBLX1? &lt;/p&gt;&#xA;" OwnerUserId="20772" LastEditorUserId="8499" LastEditDate="2016-10-27T23:57:19.557" LastActivityDate="2016-10-27T23:57:19.557" Title="Is a connect between Cisco SG300 and Cisco ISR 2921 a good choice for cross connect?" Tags="|cisco|switch|sfp|cisco-isr|cisco-sg300|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27894" PostTypeId="2" ParentId="25963" CreationDate="2016-02-17T10:46:14.487" Score="0" Body="&lt;p&gt;There are a couple of methods that allow use of administrative criteria for traffic management. These criteria are called &lt;a href=&quot;https://networklessons.com/bgp/how-to-configure-bgp-local-preference-attribute/&quot; rel=&quot;nofollow&quot;&gt;local-pref&lt;/a&gt; and prepend. If the amount of traffic, coming from a site must be decreased, one or two prepends must be placed in AS-path. Thus, the AS-path is artificially extended using 1-2 AS, making it look like your network is announced by someone, located 1-2 autonomous system further from us. As a result, part of the routers, which previously considered the path through this uplink the best one, will choose other paths. Thus, it is possible to balance the load of the incoming links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to control traffic is to mark your announcements with special flags – community, that tell the provider’s router where and how to announce your networks.  For instance, “to site A with three prepends, to site B normally”. There is no standard set of community flags, which is why they need to be stipulated with administrators of your ISP. Usually, these flags are indicated in the description of the autonomous system that can be found in the comments field of RIPE database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to learn how to do this, it is vital to understand how routing is performed between the component parts of the large Internet and what is &lt;a href=&quot;http://bgp.us/routing/&quot; rel=&quot;nofollow&quot;&gt;BGP routing&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22432" LastActivityDate="2016-02-17T10:46:14.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27895" PostTypeId="1" CreationDate="2016-02-17T11:58:18.683" Score="1" ViewCount="165" Body="&lt;p&gt;What should happen when I configure the below ACL on an interface in a cisco 7600 box?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list TEST&#xA; 10 deny ip any any&#xA; 20 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Basically, when I ping the directly connected IP to this interface, all I observe is the hardware counters are incremented for permit rule, while the packets are getting dropped at software?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know such an access-list has no meaning, but then too how the packets are processed in this scenario?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[R1](g4/1)-------------------------(g4/1)[R2]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Access-list TEST configured on R2 int g4/1for ingressing traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping from R2 to R1 interface 4/1, and you get the below observations :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show tcam interface g4/1 acl in ip mod 4&#xA;&#xA;* Global Defaults shared&#xA;&#xA;Entries from Bank 0&#xA;&#xA;Entries from Bank 1&#xA;&#xA;deny ip any any    &#xA;permit ip any any(5 matches)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2# show ip access-list TEST&#xA;&#xA;Extended IP access list TEST&#xA;10 deny ip any any (5 matches)&#xA;20 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22981" LastEditorUserId="33" LastEditDate="2016-02-17T18:44:43.923" LastActivityDate="2016-07-16T21:34:45.257" Title="How does ACL lookup happens for below mentioned configuration?" Tags="|cisco|acl|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27897" PostTypeId="1" AcceptedAnswerId="27902" CreationDate="2016-02-17T12:37:57.880" Score="5" ViewCount="802" Body="&lt;p&gt;I have a question regarding ARP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;strong&gt;host A&lt;/strong&gt; wants to send a message to &lt;strong&gt;host B&lt;/strong&gt; and the ARP table of &lt;strong&gt;host A&lt;/strong&gt; does not contain a MAC address for &lt;strong&gt;host B&lt;/strong&gt; then he sends an ARP request and &lt;strong&gt;host B&lt;/strong&gt; replies with its MAC adress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now what happens if there is a third &lt;strong&gt;host C&lt;/strong&gt; on the net whose ARP table is also empty. While this third &lt;strong&gt;host C&lt;/strong&gt; receives and ignores &lt;strong&gt;host As&lt;/strong&gt; ARP request does it process the ARP reply of &lt;strong&gt;host B&lt;/strong&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words: do hosts on a network learn other hosts MAC addresses from ARP replies not addressed to them ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At university I've heard that that is the way switches learn which hosts are reachable via their ports but not if hosts do the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance !&lt;/p&gt;&#xA;" OwnerUserId="22985" LastActivityDate="2016-02-17T19:48:29.500" Title="Learn MAC addresses via replies to other hosts requests" Tags="|mac-address|arp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27898" PostTypeId="1" CreationDate="2016-02-17T12:48:55.483" Score="0" ViewCount="9482" Body="&lt;p&gt;How to get VLAN information of switch through IP address?&lt;/p&gt;&#xA;" OwnerUserId="22982" LastActivityDate="2016-02-17T23:59:55.030" Title="how to get vlan information through IP address" Tags="|switch|router|" AnswerCount="2" CommentCount="3" ClosedDate="2016-02-19T13:09:17.670" ContentLicense="CC BY-SA 3.0" />
  <row Id="27901" PostTypeId="1" AcceptedAnswerId="28036" CreationDate="2016-02-17T13:19:35.100" Score="1" ViewCount="538" Body="&lt;p&gt;How can i set TCP option 28 (user timeout option) into the TCP header? &#xA;i'm trying to send TCP packet between two Linuxes via HPING (If there is a better tool which will help to set TCP option 28 please tell me), and till now i didn't success to set the user timeout option. (I'm looking into the sniffer and the option 28 didn't exist).&lt;/p&gt;&#xA;" OwnerUserId="22990" LastActivityDate="2016-02-21T08:43:03.170" Title="TCP user timeout option" Tags="|tcp|linux|" AnswerCount="1" CommentCount="1" ClosedDate="2019-03-24T00:53:40.887" ContentLicense="CC BY-SA 3.0" />
  <row Id="27902" PostTypeId="2" ParentId="27897" CreationDate="2016-02-17T13:22:51.233" Score="5" Body="&lt;p&gt;As per &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC826&lt;/a&gt;, the answer is NO.&lt;/p&gt;&#xA;&lt;p&gt;The algorithm in the RFC clearly state that the address is added in the local table only if the host is the target of the packet.&lt;/p&gt;&#xA;&lt;p&gt;However Host C will update its table if it already has an old entry for host A and its not up to date.&lt;/p&gt;&#xA;&lt;p&gt;It's possible that some specific implementation of ARP do listen to ARP query to populate the cache, but there's no way to know it without testing.&lt;/p&gt;&#xA;&lt;p&gt;EDIT in response to comments :&lt;/p&gt;&#xA;&lt;p&gt;The RFC mention that :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Negative conditionals indicate an end of processing and a discarding&#xA;of the packet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Then in the algorithm we have :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;?Am I the target protocol address?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Yes:&#xA;  If Merge_flag is false, add the triplet &amp;lt;protocol type,&#xA;      sender protocol address, sender hardware address&amp;gt; to&#xA;      the translation table.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So since for host C the answer to the above question is No, it doesn't go to the step &amp;quot;add sender hardware to the translation table&amp;quot;, it just stop processing.&lt;/p&gt;&#xA;&lt;p&gt;Also, as mentioned by  &lt;a href=&quot;https://networkengineering.stackexchange.com/users/14263/xpac&quot;&gt;xpac&lt;/a&gt; and &lt;a href=&quot;https://networkengineering.stackexchange.com/users/8499/ron-maupin&quot;&gt;Ron Maupin&lt;/a&gt; , in a modern, switched environment, host C will not even see the answer from B to A.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-02-17T19:48:29.500" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="27903" PostTypeId="2" ParentId="27853" CreationDate="2016-02-17T13:24:47.803" Score="1" Body="&lt;p&gt;A router has numerous ways of learning the best paths toward individual IP prefixes: they might be directly connected, configured as static routes or learned through dynamic routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each dynamic routing protocol (including RIP) has its own set of internal data structures, known as OSPF/IS-IS database, EIGRP topology table or BGP table. The routing protocol updates its data structures based on routing protocol updates exchanged with its neighbors, eventually collecting all the relevant information. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both BGP and OSPF associate IP next hops with IP prefixes, but BGP simply uses the value of the next-hop attribute attached to the BGP route, whereas OSPF computes the IP address of the next-hop OSPF router with the SPF algorithm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The results of intra-routing-protocol route selection are inserted in the IP routing table (RIB) based on administrative distance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, we would use RIB to forward IP packets, but we can’t as some entries in it (static routes and BGP routes) could have next hops that are not directly connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Forwarding Tables (FIB)were introduced to make layer-3 switching deterministic. When IP routes are copied from RIB to FIB, their next hops are resolved, outgoing interfaces are computed and multiple entries are created when the next-hop resolution results in multiple paths to the same destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, when the BGP route from the previous printout is inserted into FIB, its next-hop is changed to point to the actual next-hop router. The information about the recursive next-hop is retained, as it allows the router to update the FIB (CEF table) without rescanning and recomputing the whole RIB if the path toward the BGP next-hop changes.&lt;/p&gt;&#xA;" OwnerUserId="22432" LastActivityDate="2016-02-17T13:24:47.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27905" PostTypeId="1" CreationDate="2016-02-17T14:06:19.010" Score="4" ViewCount="292" Body="&lt;p&gt;I am currently working on a DDoS detection problem from Netflow data from an ISP’s perspective. Very large datasets are available to me for analysis. Though I have done considerable amount of work, still I am not yet convinced about the selection of the right set of features that will eventually help us in identifying the DDoS attack(s). Any suggestions in this regard will be very helpful.&lt;/p&gt;&#xA;" OwnerUserId="22975" LastActivityDate="2016-05-14T05:42:15.020" Title="Set of features to characterize DDoS from Netflow data" Tags="|netflow|" AnswerCount="1" CommentCount="3" ClosedDate="2017-08-13T06:14:55.150" ContentLicense="CC BY-SA 3.0" />
  <row Id="27906" PostTypeId="2" ParentId="18869" CreationDate="2016-02-17T14:08:44.233" Score="1" Body="&lt;p&gt;Your idea is quite good. Using libpcap to capture all arp-broadcasts and learn the MAC and IP adresses of all active  nodes will work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do this on a box in our network to compile a list of all nodes and have a searchable arp table. It listens on a vlan trunk and has no IP address in most of the VLANs. It's a little daemon in perl i hacked together in one afternoon.&lt;/p&gt;&#xA;" OwnerUserId="19765" LastActivityDate="2016-02-17T14:08:44.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27907" PostTypeId="1" AcceptedAnswerId="27946" CreationDate="2016-02-17T14:12:35.083" Score="1" ViewCount="1151" Body="&lt;p&gt;I am running a small experiment to isolate bandwidth with flowvisor (version 1.4, version 1.0 of openflow) implementing a port based slicing. With mininet, I create a topology that consists of a host h1 (&lt;code&gt;10.0.0.1&lt;/code&gt;), connected to a switch, called s3, connected to another host, h2 (&lt;code&gt;10.0.0.2&lt;/code&gt;), this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;h1 ----- s3 ------ h2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To achieve this I use this mininet command to run my custom topology (called simpletopo.py): &lt;code&gt;sudo mn --custom simpletopo.py --topo mytopo --switch ovsk --controller remote --mac --arp --link tc&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want all traffic going to port &lt;code&gt;666&lt;/code&gt; from h1 to h2 (and vice versa) to have a bandwidth of 1Mbps, and all traffic going to port &lt;code&gt;555&lt;/code&gt; from h1 to h2 (and vice versa) to have a bandwidth of 1Gbps. To achieve this, I create two queues in switch s3, q0 and q1. q0 is for the 1Mbps traffic and q1 for 1Gbps traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I create the two slices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fvctl add-slice slice1 tcp:127.0.0.2:6643 generic@email.com&#xA;fvctl add-slice slice2 tcp:127.0.0.3:6653 generic@email.com&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I allocate flowspace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fvctl -f pass add-flowspace --queues=1 --forced-queue=1 flow1 3 100 in_port=2,tp_dst=666 slice1=7&#xA;fvctl -f pass add-flowspace --queues=1 --forced-queue=1 flow2 3 100 in_port=1,tp_src=666 slice1=7&#xA;fvctl -f pass add-flowspace --queues=1 --forced-queue=1 flow3 3 100 in_port=1,tp_dst=666 slice1=7&#xA;fvctl -f pass add-flowspace --queues=1 --forced-queue=1 flow4 3 100 in_port=2,tp_src=666 slice1=7&#xA;fvctl -f pass add-flowspace --queues=0 --forced-queue=0 flow5 3 100 in_port=2,tp_dst=555 slice2=7&#xA;fvctl -f pass add-flowspace --queues=0 --forced-queue=0 flow6 3 100 in_port=1,tp_src=555 slice2=7&#xA;fvctl -f pass add-flowspace --queues=0 --forced-queue=0 flow7 3 100 in_port=1,tp_dst=555 slice2=7&#xA;fvctl -f pass add-flowspace --queues=0 --forced-queue=0 flow8 3 100 in_port=2,tp_src=555 slice2=7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I use the queue option to tell flowvisor which slices are available to each flowspace and the forced-queue option to force flowvisor to change the output actions for enqueue actions in the queue specified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I run two POX controllers, one for each slice:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;./pox.py --verbose pox.openflow.of_01 --address=127.0.0.2 --port=6643 pox.forwarding.l2_learning&#xA;./pox.py --verbose pox.openflow.of_01 --address=127.0.0.3 --port=6653 pox.forwarding.l2_learning&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I run the topology with mininet. At this point, the two slices work fine, each one controlls its traffic. Traffic uses all bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to throttle the bandwidth. To achieve this I create the queues mentioned above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I create the queues like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo ovs-vsctl -- set Port s3-eth1 qos=@newqos -- set Port s3-eth2 qos=@newqos -- --id=@newqos create QoS type=linux-htb other-config:max-rate=1000000000 queues=0=@q0,1=@q1 -- --id=@q0 create Queue other-config:min-rate=1000000 other-config:max-rate=1000000 -- --id=@q1 create Queue other-config:min-rate=1000000000 other-config:max-rate=1000000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run tests with iperf, I got all traffic throttled to 1 Mbps. When I run &lt;code&gt;sudo ovs-ofctl queue-stats s3&lt;/code&gt;, I see that all traffic passes through &lt;code&gt;queue 0&lt;/code&gt; (default queue for openflow) and no traffic passes through &lt;code&gt;queue 1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's going wrong? Is there something wrong with flowvisor or the creation of queues? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot.&lt;/p&gt;&#xA;" OwnerUserId="20576" LastEditorUserId="20576" LastEditDate="2016-02-19T08:32:05.137" LastActivityDate="2016-05-10T13:51:53.693" Title="Problem configuring QoS with FlowVisor and OpenVswitch" Tags="|qos|openflow|mininet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27910" PostTypeId="1" AcceptedAnswerId="27912" CreationDate="2016-02-17T15:22:10.957" Score="2" ViewCount="359" Body="&lt;p&gt;I made a topology that has 3 routers and 3 switches , one of the switches has VLans created on , when I setup one of the routers as a Dhcp server I face a problem that I couldn't assign IPs for PCs that belongs to another vlans than a defualt vlan (vlan 1) , although I create sub interfaces and assign their default gateway IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so , am I missing something here ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt; &lt;/p&gt;&#xA;" OwnerUserId="22993" LastActivityDate="2016-02-17T15:33:58.540" Title="assign IP for pc vlan via dhcp server" Tags="|vlan|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27912" PostTypeId="2" ParentId="27910" CreationDate="2016-02-17T15:33:58.540" Score="2" Body="&lt;p&gt;You can use a single DHCP server to serve multiple VLAN, but to do so you need to setup DHCP relay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It must be setup on each device that act as a gateway for a VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must also set a different DHCP pool for each VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exact steps depends on the equipment used so its difficult to give you a more precise answer.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-02-17T15:33:58.540" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27913" PostTypeId="2" ParentId="27898" CreationDate="2016-02-17T15:40:59.783" Score="1" Body="&lt;p&gt;An IP address contains no information about VLANs or switches. IP is a layer-3 protocol which is carried inside layer-2 frames, such as ethernet. Layer-3 is blissfully unaware of which layer-2 protocol is encapsulating it. An ethernet frame may have VLAN information in the ethernet header (see &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1Q&quot; rel=&quot;nofollow&quot;&gt;802.1Q&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-17T16:54:05.820" LastActivityDate="2016-02-17T16:54:05.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27914" PostTypeId="1" AcceptedAnswerId="27915" CreationDate="2016-02-17T15:41:23.210" Score="3" ViewCount="3640" Body="&lt;p&gt;Can someone provide me an example of how Equal-cost multi-path routing uses hashing to decided which packet goes to which? I apologize for that but all I found online are just a definition of ECMP.&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2021-03-24T02:28:30.997" Title="Example of ECMP uses hashing technique" Tags="|cisco|routing|router|ospf|ecmp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27915" PostTypeId="2" ParentId="27914" CreationDate="2016-02-17T15:55:41.177" Score="2" Body="&lt;p&gt;ECMP takes place when multiple output (equal-cost) paths are available for forwarding packets to the same network destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hash function must map information from the incoming packet to the output interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, let me make up an illustrative overly simple hashing function for this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Picture every output interface with an ifIndex like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Fa0: ifIndex 1&lt;/li&gt;&#xA;&lt;li&gt;Fa1: ifIndex 2&lt;/li&gt;&#xA;&lt;li&gt;Fa2: ifIndex 3&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Number of interfaces: 3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Given the destination IP address A.B.C.D, take the least significant byte D.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: IP = 1.0.0.5, D = 5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Divide the value of D by the number of interfaces, take the remainder, then and add one to it.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;D = 5&#xA;Number of interfaces = 3&#xA;Remainder plus 1: 5 % 3 + 1 = 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4) Use the result as ifIndex and throw the packet at its interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: For IP 1.0.0.5, write the packet to output interface Fa2 (ifIndex=3).&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-17T15:55:41.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27916" PostTypeId="2" ParentId="27892" CreationDate="2016-02-17T15:59:50.703" Score="1" Body="&lt;p&gt;You need to look at the standard for each. The MGBLX1 and the GLC-LH-SMD both have support for 1000BASE-LX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you really need to do is make sure that these are compatible with the fiber which you are using. You can contact you provider to verify this.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-17T15:59:50.703" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27917" PostTypeId="2" ParentId="27914" CreationDate="2016-02-17T16:03:47.413" Score="1" Body="&lt;p&gt;The load balancing can be configures (on Cisco devices) to be per packet or per destination.&lt;/p&gt;&#xA;&lt;p&gt;Quote from &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5212-46.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;How Does Load Balancing Work ?&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;For process-switching—load balancing is on a per-packet basis&lt;/p&gt;&#xA;&lt;p&gt;For fast-switching—load balancing is on a per-destination basis&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;More detailed, in the same article:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; Per-Destination and Per-Packet Load Balancing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You can set load-balancing to work per-destination or per-packet. Per-destination load balancing means the router distributes the&#xA;packets based on the destination address. Given two paths to the same&#xA;network, all packets for destination1 on that network go over the&#xA;first path, all packets for destination2 on that network go over the&#xA;second path, and so on. This preserves packet order, with potential&#xA;unequal usage of the links. If one host receives the majority of the&#xA;traffic all packets use one link, which leaves bandwidth on other&#xA;links unused. A larger number of destination addresses leads to more&#xA;equally used links. To achieve more equally used links use IOS&#xA;software to build a route-cache entry for every destination address,&#xA;instead of every destination network, as is the case when only a&#xA;single path exists. Therefore traffic for different hosts on the same&#xA;destination network can use different paths. The downside of this&#xA;approach is that for core backbone routers carrying traffic for&#xA;thousands of destination hosts, memory and processing requirements for&#xA;maintaining the cache become very demanding.&lt;/p&gt;&#xA;&lt;p&gt;Per-packet load-balancing means that the router sends one packet for destination1 over the first path, the second packet for (the same)&#xA;destination1 over the second path, and so on. Per-packet load&#xA;balancing guarantees equal load across all links. However, there is&#xA;potential that the packets may arrive out of order at the destination&#xA;because differential delay may exist within the network. In Cisco IOS&#xA;software, except the release 11.1CC, per packet load balancing does&#xA;disable the forwarding acceleration by a route cache, because the&#xA;route cache information includes the outgoing interface. For&#xA;per-packet load balancing, the forwarding process determines the&#xA;outgoing interface for each packet by looking up the route table and&#xA;picking the least used interface. This ensures equal utilization of&#xA;the links, but is a processor intensive task and impacts the overall&#xA;forwarding performance. This form of per-packet load balancing is not&#xA;well suited for higher speed interfaces.&lt;/p&gt;&#xA;&lt;p&gt;Per-destination or per-packet load-balancing depends on the type of switching scheme used for IP packets. By default, on most Cisco&#xA;routers, fast switching is enabled under interfaces. This is a demand&#xA;caching scheme that does per-destination load-balancing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="74650" LastEditDate="2021-03-24T02:28:30.997" LastActivityDate="2021-03-24T02:28:30.997" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="27918" PostTypeId="2" ParentId="27897" CreationDate="2016-02-17T16:06:12.700" Score="2" Body="&lt;p&gt;All the hosts see the ARP request, but only the requester will see the ARP reply. Since ARP replies are unicast back to the requester, Host C will never even see the ARP reply from Host B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How hosts populate their ARP caches is not how switches populate their MAC address tables. Switches look at all the traffic coming through switch ports to populate their MAC address tables.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-17T16:06:12.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27919" PostTypeId="2" ParentId="27898" CreationDate="2016-02-17T16:46:47.597" Score="0" Body="&lt;p&gt;If you are running a Cisco switch, you can try to read the &lt;a href=&quot;http://www.oidview.com/mibs/9/CISCO-VTP-MIB.html&quot; rel=&quot;nofollow&quot;&gt;CISCO-VTP-MIB&lt;/a&gt; with an SNMP tool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nms-server2:/home/ccarring&amp;gt; snmpwalk -c public 14.32.100.10 vtpVlanState&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More information: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/41003-catalystVLANinfo.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/41003-catalystVLANinfo.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-17T16:46:47.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27920" PostTypeId="1" AcceptedAnswerId="27944" CreationDate="2016-02-17T18:16:27.730" Score="1" ViewCount="2973" Body="&lt;p&gt;I have RMA'd PA-3020 which is secondary FW02 for one of the office. PA sent this with 6.0.6 OS whereas my primary FW01 is on 5.0.12.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured FW02 via console and later downgraded it to 5.0.12 which went smoothly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I issued HA Config to this FW01 and tried to commit but this stuck after 70%. I did Force Commit as well but that too didn't helped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence I am unable to now rack this new FW02. Can someone please assist me here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am on call with PA TAC now and they saw this too for the 1st time. Need expert advise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks everyone in advance for time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rgds&#xA;Rounak&lt;/p&gt;&#xA;" OwnerUserId="17487" LastActivityDate="2016-05-26T16:00:17.997" Title="New RMA'd PA-3020 failing Auto Commit" Tags="|firewall|palo-alto|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27921" PostTypeId="2" ParentId="27895" CreationDate="2016-02-17T19:12:51.883" Score="1" Body="&lt;p&gt;If you deny in the first line &lt;code&gt;10 deny ip any any&lt;/code&gt; than all packages will meet this rule and will denied by th router so the second rule &lt;code&gt;20 permit ip any any&lt;/code&gt; will never meet with packages. in one word no packages will pass trough on this interface. I don't understand why do want to deny all ip (tcp/udp) packages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW: all ACL's have an implicit &lt;code&gt;deny any any&lt;/code&gt; at end of all rules...&lt;/p&gt;&#xA;" OwnerUserId="21768" LastActivityDate="2016-02-17T19:12:51.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27922" PostTypeId="1" AcceptedAnswerId="27924" CreationDate="2016-02-17T20:05:53.533" Score="3" ViewCount="3508" Body="&lt;p&gt;Google search for 0.0.0.0 says that &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In the Internet Protocol Version 4, the address 0.0.0.0 is a non-routable meta-address used to designate an invalid, unknown or non-applicable target. To give a special meaning to an otherwise invalid piece of data is an application of in-band signaling.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which makes me wonder that if I add this IP address as whitelisted entry in the firewall, would it mean that the machine will be accessible to every network outside? Or will it only allow the requests originating from the machine itself?&lt;/p&gt;&#xA;" OwnerUserId="23006" LastActivityDate="2016-02-17T22:42:30.070" Title="What happens if I add 0.0.0.0 as a whitelisted IP?" Tags="|ipv4|subnet|ip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27923" PostTypeId="2" ParentId="27922" CreationDate="2016-02-17T20:25:25.133" Score="2" Body="&lt;p&gt;(This is more a security SE question)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In networking circles (like this one), you should never, &lt;em&gt;ever&lt;/em&gt;, see a packet with zero as an address. Anyone sending &quot;zero&quot; across the internet is (a) broken, or (b) &lt;em&gt;trying to break something&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A machine talking to itself will use a loopback address (eg. 127.0.0.1)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-02-17T20:25:25.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27924" PostTypeId="2" ParentId="27922" CreationDate="2016-02-17T22:42:30.070" Score="3" Body="&lt;p&gt;As @RickyBeam pointed out, &lt;code&gt;0.0.0.0&lt;/code&gt; is not a routable address. However, in access lists in firewalls it can be used with a netmask other than the implicit &lt;code&gt;/32&lt;/code&gt; to indicate the entire IPv4 address space: &lt;code&gt;0.0.0.0/0&lt;/code&gt;. In that case, any IPv4 address would match the condition.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-02-17T22:42:30.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27925" PostTypeId="2" ParentId="27856" CreationDate="2016-02-17T23:09:31.270" Score="0" Body="&lt;p&gt;You need to remove the quad zero mask on the crypto isakmp key line. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you may want to try and use dynamic crypto maps, just to see if your ACL's are backwards.&lt;/p&gt;&#xA;" OwnerUserId="22968" LastActivityDate="2016-02-17T23:09:31.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27927" PostTypeId="1" AcceptedAnswerId="27928" CreationDate="2016-02-18T00:49:30.627" Score="3" ViewCount="961" Body="&lt;p&gt;I am currently announcing 8 /24 Subnets over BGP. I am planning to move our servers to a other datacenter, but i want to keep all IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible that i announce the prefixes on 2 locations and tell that traffic from IP 1.1.1.1 should go to location A and traffic from IP 1.1.1.2 should go to location B?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no direct connection between the 2 datacenters, no traffic exchanger is possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Location A isnt stable, there are nearly everyday network problems. Location B is stable and should not get disturbed because of location A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know i can announce the prefix on multiple locations, but then the shorter path will be used. I need a way to tell other routers that the IP X is on location A and IP Y is on location B. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the best way to perform this using BGP?&lt;/p&gt;&#xA;" OwnerUserId="23010" LastEditorUserId="8499" LastEditDate="2019-01-05T00:02:24.377" LastActivityDate="2019-01-05T00:02:24.377" Title="BGP - use prefix on 2 locations" Tags="|routing|bgp|ospf|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="27928" PostTypeId="2" ParentId="27927" CreationDate="2016-02-18T01:52:00.150" Score="3" Body="&lt;p&gt;Possible script:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Move every /24 prefix in BGP one at a time.&lt;/li&gt;&#xA;&lt;li&gt;Before moving the first /24 prefix, establish an IP tunnel between the two locations.&lt;/li&gt;&#xA;&lt;li&gt;When you need to move one IP of a given /24 prefix, make location A to forward that address (a /32 route) thru the tunnel to location B.&lt;/li&gt;&#xA;&lt;li&gt;As soon as every address from one /24 prefix is going to location B via tunnel, move its BGP prefix announcement from location A to B.&lt;/li&gt;&#xA;&lt;li&gt;Repeat steps 3-4 for every /24 prefix.&lt;/li&gt;&#xA;&lt;li&gt;Bring down the tunnel.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-18T01:52:00.150" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="27929" PostTypeId="1" AcceptedAnswerId="27930" CreationDate="2016-02-18T03:30:00.900" Score="3" ViewCount="40" Body="&lt;p&gt;wondering is it possible to archive running config to two destinations weekly (schedules archive) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;means can we have two paths ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to use two path commands which overwrites the old path command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;Saad B&lt;/p&gt;&#xA;" OwnerUserId="22037" LastActivityDate="2016-02-18T03:38:38.400" Title="Cisco Archives," Tags="|cisco|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27930" PostTypeId="2" ParentId="27929" CreationDate="2016-02-18T03:38:38.400" Score="3" Body="&lt;p&gt;No, not natively with the &lt;code&gt;archive&lt;/code&gt; command. However, there are things like kron that can run commands and scripts on a schedule. You could also setup an EEM to trigger similar to the way &lt;code&gt;archive&lt;/code&gt; works (save the config on change.) And of course, you can have an external management system retrieve the configs as necessary. (search my previous answers for my snmp scripts)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-02-18T03:38:38.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27931" PostTypeId="2" ParentId="27927" CreationDate="2016-02-18T03:46:39.133" Score="1" Body="&lt;p&gt;If both sites use the same ISP, and the ISP's AS is the same at both sites, this may be possible. You could work with the ISP to announce to it some &lt;code&gt;/32&lt;/code&gt; addresses on a temporary basis. The ISP's AS would still announce to the Internet that it has your &lt;code&gt;/24&lt;/code&gt;, but it can route longer prefixes internally. This is not something that you can just assume the ISP will do, but &lt;em&gt;some&lt;/em&gt; ISPs may accommodate such things from time to time. An ISP typically will not help you at all to move to a different ISP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-18T03:46:39.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27932" PostTypeId="2" ParentId="26041" CreationDate="2016-02-18T04:40:13.527" Score="3" Body="&lt;p&gt;TL;DR: It is impossible to answer your question (as currently written). Frankly, I am tempted to close the question because there really isn't enough information to answer it (i.e you aren't providing any vendor/model numbers or enough detail).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally speaking, an Ethernet interface will not be able to speak to a serial interface. So if you are talking about a something that allows you to simply plug a RS485 connection into an RJ45 port (i.e. something goofy like cutting one end off a RJ45 cable and connecting the individual wires to the terminals), then no this will not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are talking about an actual device (at least $50+ draws it's own power via power supply or PoE) that will convert the serial signal into Ethernet data and back on the other end, then the answer is maybe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two types of Modbus that I am aware of, Modbus serial and Modbus TCP. If your firewall says it can do DPI of Modbus, it may be speaking strictly of Modbus TCP. If you converters are converting Modbus serial to Modbus TCP, then this may work. If your devices are converting the serial to Ethernet in any other way (as one example, a proprietary format that encapsulates serial data in encryption for security), then the answer is at best back to a big question mark and quite possibly no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if we assume that your firewall can actually understand the Modbus information in the Ethernet traffic, it still doesn't mean the answer is that it will work. Just because a firewall can identify it as Modbus traffic doesn't necessarily mean it will be able to filter out specific Modbus function codes based on this information. Without knowing what firewall you are talking about, we are again back to the issue that you haven't provided enough information.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-02-18T04:40:13.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27935" PostTypeId="1" CreationDate="2016-02-18T09:17:14.573" Score="2" ViewCount="2500" Body="&lt;p&gt;I have a problem with UDP-Multicast with Kubernetes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to Kubernetes-Nodes each of them running a pod:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kubernetes-Node-1:&lt;br&gt;&#xA;   - eth0: 192.168.0.2/24&lt;br&gt;&#xA;   - docker0: 10.1.1.1/24&lt;br&gt;&#xA;Pod1 on Kubernetes-Node-1:&lt;br&gt;&#xA;    - eth0: 10.1.1.2/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kubernetes-Node-2:&lt;br&gt;&#xA;   - eth0: 192.168.0.3/24&lt;br&gt;&#xA;   - docker0: 10.1.3.1/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pod2 on Kubernetes-Node-2:&lt;br&gt;&#xA;   - eth0: 10.1.3.2/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so we have following topology:&lt;br&gt;&#xA;Pod1---Kubernetes-Node-1---Kubernetes-Node-2---Pod2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want that  Pod1 and Pod2 can send each other multicast packages (on 228.8.8.8:45588), for Cluster-Discovery.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I configured 2 routes with smcroute on Kubernetes-Node-1 and Kubernetes-Node-2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mroute from eth0 group 228.8.8.8 to docker0&#xA;mroute from docker0 group 228.8.8.8 to eth0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I create multicast-packages direct on eth0 of kubernetes-node-1 (mcsender -t32 -ieth0 228.8.8.8:45588), the packages get to eth0 on kubernetes-node-2, then over the mroute to docker0 on Kubernetes-node-2 and then to eth0 on Pod2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Problem occurs when the packages are created on Pod1:&#xA;Pod1 creates packages, that can be seen with tcpdump on kubernetes-node-1 on docker0 and because of the mroute also on eth0. Unfortunately the packages can't be seen on kubernetes-node2 - not on eth0 and not on docker0...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone ideas what the problem might be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Kubernetes-Node-1:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip mroute&#xA;    (10.1.1.2, 228.8.8.8)          Iif: docker0    Oifs: eth0&#xA;&#xA;&#xA;&#xA;netstat -nrv&#xA;        Kernel IP routing table&#xA;        Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface&#xA;        0.0.0.0         192.168.0.1    0.0.0.0         UG        0 0          0 eth0&#xA;        192.168.0.0    0.0.0.0         255.255.255.0   U         0 0          0 eth0&#xA;        10.1.1.0      0.0.0.0         255.255.0.0     U         0 0          0 docker0&#xA;        4.5.5.1         10.1.1.1      255.255.255.255 UGH   0      0        0 docker0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the end there could be more Kubernetes-Nodes running Pods, that should commuticate over Multicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help :)&lt;/p&gt;&#xA;" OwnerUserId="23016" LastEditorUserId="2142" LastEditDate="2016-04-24T21:13:45.950" LastActivityDate="2016-10-22T03:47:50.733" Title="Multicast doesn't get forwarded correctly" Tags="|routing|troubleshooting|multicast|udp|" AnswerCount="2" CommentCount="5" ClosedDate="2016-10-22T04:04:14.857" ContentLicense="CC BY-SA 3.0" />
  <row Id="27936" PostTypeId="1" CreationDate="2016-02-18T09:27:18.713" Score="1" ViewCount="1001" Body="&lt;p&gt;&lt;strong&gt;Given&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;ESXi host with 1 NIC&lt;/li&gt;&#xA;&lt;li&gt;Inside the host, there're 2 virtual switches: switch1 and switch2&lt;/li&gt;&#xA;&lt;li&gt;In switch1, there's 1 WAN interface&lt;/li&gt;&#xA;&lt;li&gt;In swtich2, there's 4 VLANs: VLAN10, VLAN20, VLAN30, and VLAN40&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Existing Situation:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;pfsense is used between switch1 and switch2 for routing&lt;/li&gt;&#xA;&lt;li&gt;VM in each VLANs can access the Internet&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Purpose:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;prevent VM in VLAN40 access VM of other VLANs&lt;/li&gt;&#xA;&lt;li&gt;allow VM access each other within VLAN40&lt;/li&gt;&#xA;&lt;li&gt;allow VM in VLAN40 access the Internet&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I have done to achieve the Purpose:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I have created 3 firewall rules in VLAN40, which is illustrated as below image&lt;a href=&quot;https://i.stack.imgur.com/3NGV3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3NGV3.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I have created an aliases, RFC1918, which includes: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10.0.0.0/8&lt;/li&gt;&#xA;&lt;li&gt;172.16.0.0/12&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0/16&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Are the firewall rules set correctly to achieve the purpose?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23011" LastActivityDate="2016-02-18T10:42:51.663" Title="Network Segregation by pfsense + ESXi VLAN" Tags="|vlan|firewall|pfsense|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27938" PostTypeId="1" CreationDate="2016-02-18T10:03:16.693" Score="1" ViewCount="207" Body="&lt;p&gt;Is it possible to get support for BFD for OSPF on vyatta 6.2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot find any information about it on the internet. The only thing I've seen is that the support is available on Brocade Vyatta 5400 vRouter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know?&lt;/p&gt;&#xA;" OwnerUserId="22810" LastEditorUserId="22810" LastEditDate="2016-02-18T10:08:43.367" LastActivityDate="2016-02-18T10:08:43.367" Title="BFD support for OSPF vyatta 6.2?" Tags="|routing|router|ospf|vyatta|bfd|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27939" PostTypeId="2" ParentId="27927" CreationDate="2016-02-18T10:03:40.717" Score="0" Body="&lt;p&gt;What you can do is advertise the prefix to a second ISP and then monitor if the prefix propagates to at least part of the rest of the world. (Some networks will prefer the path over your first ISP; this is normal.) Then ask your first ISP to stop advertising the prefix, and make sure that they propagate your own advertisement through them.&lt;/p&gt;&#xA;" OwnerUserId="22432" LastActivityDate="2016-02-18T10:03:40.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27941" PostTypeId="2" ParentId="27936" CreationDate="2016-02-18T10:42:51.663" Score="3" Body="&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;prevent VM in VLAN40 access VM of other VLANs&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is done by rule 2, unless any of your VMs in the other VLANs gets a public IP address. If you are sure that won't happen, you're fine.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;allow VM access each other within VLAN40&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Access within the VLAN is switched and shouldn't even arrive at the firewall.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;allow VM in VLAN40 access the Internet&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;pfsense will be the local DNS server, I assume from your first rule. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short: Yes, should work, unless some pfsense- or ESXi-specific thing happens that I didn't think of. ;)&lt;/p&gt;&#xA;" OwnerUserId="14263" LastActivityDate="2016-02-18T10:42:51.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27942" PostTypeId="1" AcceptedAnswerId="27943" CreationDate="2016-02-18T13:04:33.683" Score="1" ViewCount="415" Body="&lt;p&gt;My ISP has given me a router with the following information..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RtVGn.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RtVGn.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router is provided by the ISP and the gateway/routerIP is already preset inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I were to add a firewall behind the router as per above,  and i would like to place my servers behind the firewall BUT&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;no NAT is to be set on the firewall&lt;/li&gt;&#xA;&lt;li&gt;the servers are to have the public IPs allocated by the ISP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Does that means i would need to further subnet the allocate public IP range given by the ISP into 2 different network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - for network between firewall external interface and ISP router internal interface (202.110.110.1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - for network between firewall internal interface and the rest of the servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and i will have a total of 4 ips (for network and broadcast) wasted&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is my understanding correct ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;Noob&lt;/p&gt;&#xA;" OwnerUserId="23023" LastActivityDate="2016-02-18T14:16:02.547" Title="ISP assigned router and IP range - adding a firewall behind" Tags="|routing|router|firewall|subnet|lan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27943" PostTypeId="2" ParentId="27942" CreationDate="2016-02-18T14:16:02.547" Score="1" Body="&lt;p&gt;You're understanding is correct. Note that this would require that the ISP change the subnet mask on its side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However there's other alternatives :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can ask you ISP to provide an interconnection network (likely a /31, possibly a /30).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the ISP is not willing to spend additional public IP, the link between the ISP router and your firewall can be configured as unnumbered. Once again, it depends of what your ISP is willing to do...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since on a point to point link, there's only one possible destination (the other equipment on the link), IP addresses are not necessary.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-02-18T14:16:02.547" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27944" PostTypeId="2" ParentId="27920" CreationDate="2016-02-18T14:37:48.487" Score="2" Body="&lt;p&gt;In my experience replacing a device in HA with different PanOS version, I encountered problem exporting config from a device and imparting it to another with different version. There are small differences in the XML between version that make commit process fail.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are you importing and exporting config from a device to another or you are just configuring it one of the devices from a scractch?&lt;/li&gt;&#xA;&lt;li&gt;Are you commiting via console or GUI?&lt;/li&gt;&#xA;&lt;li&gt;Just as curiosity. You are planning a downtime, why not upgrated to last version branch 7.X or at least 6.1.X?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2016-02-18T14:37:48.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27945" PostTypeId="1" CreationDate="2016-02-18T14:43:13.190" Score="2" ViewCount="198" Body="&lt;p&gt;Can I access the software modul of sourcefire with ip address from my inside ip subnet over the inside physical port? And to use management ports only for managing ASAs.&lt;/p&gt;&#xA;" OwnerUserId="3481" LastActivityDate="2016-02-18T16:25:37.173" Title="ASA sourcefire port for managment" Tags="|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27946" PostTypeId="2" ParentId="27907" CreationDate="2016-02-18T14:55:58.100" Score="3" Body="&lt;p&gt;Finally I figured out what was wrong:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After creating the qos and queues, it's necessary to define the flows, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo ovs-ofctl add-flow s3 in_port=1,dl_type=0x0800,nw_proto=6,tp_dst=666,priority=100,actions=set_queue:1,normal&#xA;&#xA;sudo ovs-ofctl add-flow s3 in_port=1,dl_type=0x0800,nw_proto=6,tp_dst=555,priority=100,actions=set_queue:0,normal&#xA;&#xA;sudo ovs-ofctl add-flow s3 in_port=2,dl_type=0x0800,nw_proto=6,tp_dst=666,priority=100,actions=set_queue:1,normal&#xA;&#xA;sudo ovs-ofctl add-flow s3 in_port=2,dl_type=0x0800,nw_proto=6,tp_dst=555,priority=100,actions=set_queue:0,normal&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way we are telling openflow which traffic must pass through each queue. However, with this procedure, I have seen that it is not necessary to use the options queue and forced-queue of flowvisor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ovs-ofctl add-flow&amp;lt;bridge&amp;gt;&amp;lt;match-field&amp;gt;actions=set_queue:&amp;lt;queue&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By taking this action, the packets that is output the port will be output the specified queue. Different switch has different numbers of supported queues.&#xA;(&lt;a href=&quot;http://www.pica8.com/document/v2.3/html/ovs-commands-reference/&quot; rel=&quot;nofollow&quot;&gt;http://www.pica8.com/document/v2.3/html/ovs-commands-reference/&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="20576" LastActivityDate="2016-02-18T14:55:58.100" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27947" PostTypeId="2" ParentId="27945" CreationDate="2016-02-18T15:37:37.403" Score="2" Body="&lt;p&gt;Not without some modification, you need to put a cable between one of your local ports to the management port, we Always use port GigabitEthernet1/8(ASA5506)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/8&#xA; nameif Firewizz-Management&#xA; security-level 100&#xA; zone-member MANAGEMENT&#xA; ip address 10.203.7.250 255.255.255.0&#xA;!&#xA;interface Management1/1&#xA; management-only&#xA; nameif management&#xA; security-level 0&#xA; no ip address&#xA;!&#xA;&#xA;object network obj_PAT_FirePower_Management_From_WAN&#xA; nat (Firewizz-Management,WAN) static interface service tcp https 8443&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sourcefire:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    &amp;gt; show network&#xA;===============[ System Information ]===============&#xA;Hostname                  : XXXX.LOCAL&#xA;DNS Servers               : 10.203.7.250&#xA;Management port           : 8443&#xA;IPv4 Default route&#xA;  Gateway                 : 10.203.7.250&#xA;&#xA;======================[ eth0 ]======================&#xA;State                     : Enabled&#xA;Channels                  : Management &amp;amp; Events&#xA;Mode                      :&#xA;MDI/MDIX                  : Auto/MDIX&#xA;MTU                       : 1500&#xA;MAC Address               : 54:A2:74:27:90:B8&#xA;----------------------[ IPv4 ]----------------------&#xA;Configuration             : Manual&#xA;Address                   : 10.203.7.251&#xA;Netmask                   : 255.255.255.0&#xA;Broadcast                 : 10.203.7.255&#xA;----------------------[ IPv6 ]----------------------&#xA;Configuration             : Disabled&#xA;&#xA;===============[ Proxy Information ]================&#xA;State                     : Disabled&#xA;Authentication            : Disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope it helped ;)&#xA;If you cant get it working say what is't and ill get back on it.&lt;/p&gt;&#xA;" OwnerUserId="22937" LastEditorUserId="22937" LastEditDate="2016-02-18T16:25:37.173" LastActivityDate="2016-02-18T16:25:37.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27948" PostTypeId="1" CreationDate="2016-02-18T16:06:37.907" Score="1" ViewCount="37" Body="&lt;p&gt;there is a link between two places and I want to have handover IP through my switches can anyone have any idea about this?&lt;/p&gt;&#xA;" OwnerUserId="22982" LastActivityDate="2016-02-18T23:13:47.093" Title="how to fetch Handover IP of our link" Tags="|routing|switch|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-13T06:16:23.093" ContentLicense="CC BY-SA 3.0" />
  <row Id="27949" PostTypeId="2" ParentId="2122" CreationDate="2016-02-18T16:17:10.623" Score="-1" Body="&lt;p&gt;option 43 hex f104.0a13.03d1 is not correct use this for&lt;/p&gt;&#xA;&#xA;&lt;p&gt;option 43 hex f1080a1303d1&lt;/p&gt;&#xA;" OwnerUserId="23026" LastActivityDate="2016-02-18T16:17:10.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27950" PostTypeId="1" AcceptedAnswerId="27952" CreationDate="2016-02-18T16:27:10.937" Score="2" ViewCount="1144" Body="&lt;p&gt;Ok people, same drill on router-on-stick inter-vlan routing between a Cisco router and Cisco switch. Except this time, it's the expensive Nexus instead of Catalyst.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2911#show vlans&#xA;&#xA;Virtual LAN ID:  1 (IEEE 802.1Q Encapsulation)&#xA;&#xA;   vLAN Trunk Interface:   GigabitEthernet0/2&#xA;&#xA; This is configured as native Vlan for the following interface(s) :&#xA;GigabitEthernet0/2&#xA;&#xA;   Protocols Configured:   Address:              Received:        Transmitted:&#xA;        Other                                           0                7772&#xA;&#xA;   1431 packets, 403183 bytes input&#xA;   7772 packets, 551049 bytes output&#xA;&#xA;Virtual LAN ID:  100 (IEEE 802.1Q Encapsulation)&#xA;&#xA;   vLAN Trunk Interface:   GigabitEthernet0/2.100&#xA;&#xA;   Protocols Configured:   Address:              Received:        Transmitted:&#xA;           IP              10.0.0.1                     2                   3&#xA;        Other                                           0                  13&#xA;&#xA;   2 packets, 128 bytes input&#xA;   16 packets, 1798 bytes output&#xA;&#xA;Virtual LAN ID:  200 (IEEE 802.1Q Encapsulation)&#xA;&#xA;   vLAN Trunk Interface:   GigabitEthernet0/2.200&#xA;&#xA;   Protocols Configured:   Address:              Received:        Transmitted:&#xA;           IP              10.1.0.1                     0                   3&#xA;        Other                                           0                  28&#xA;&#xA;   0 packets, 0 bytes input&#xA;   31 packets, 2488 bytes output&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is my 2911 router interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet0/2&#xA; no ip address&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/2.100&#xA; encapsulation dot1Q 100&#xA; ip address 10.0.0.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface GigabitEthernet0/2.200&#xA; encapsulation dot1Q 200&#xA; ip address 10.1.0.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is one of nexus trunk interface and vlan output.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet1/48&#xA;  switchport mode trunk&#xA;&#xA;interface Vlan100&#xA;  no shutdown&#xA;  ip address 10.1.0.13/24&#xA;&#xA;interface Vlan200&#xA;  no shutdown&#xA;  ip address 10.0.0.13/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But 2911 and Nexus still can't ping each other's vlan inter ip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong or missing that's necessary in addition to what we usually do on a Catalyst?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Update: After Ron M's catch]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C#          ping 10.0.0.1&#xA;PING 10.0.0.1 (10.0.0.1): 56 data bytes&#xA;64 bytes from 10.0.0.1: icmp_seq=0 ttl=254 time=0.804 ms&#xA;64 bytes from 10.0.0.1: icmp_seq=1 ttl=254 time=0.57 ms&#xA;64 bytes from 10.0.0.1: icmp_seq=2 ttl=254 time=0.534 ms&#xA;64 bytes from 10.0.0.1: icmp_seq=3 ttl=254 time=0.536 ms&#xA;64 bytes from 10.0.0.1: icmp_seq=4 ttl=254 time=0.526 ms&#xA;&#xA;--- 10.0.0.1 ping statistics ---&#xA;5 packets transmitted, 5 packets received, 0.00% packet loss&#xA;round-trip min/avg/max = 0.526/0.593/0.804 ms&#xA;C#          ping 10.1.0.1&#xA;PING 10.1.0.1 (10.1.0.1): 56 data bytes&#xA;64 bytes from 10.1.0.1: icmp_seq=0 ttl=254 time=0.769 ms&#xA;64 bytes from 10.1.0.1: icmp_seq=1 ttl=254 time=0.56 ms&#xA;64 bytes from 10.1.0.1: icmp_seq=2 ttl=254 time=0.534 ms&#xA;64 bytes from 10.1.0.1: icmp_seq=3 ttl=254 time=0.522 ms&#xA;64 bytes from 10.1.0.1: icmp_seq=4 ttl=254 time=0.53 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user10221" LastEditorDisplayName="user10221" LastEditDate="2016-02-18T16:54:31.813" LastActivityDate="2016-02-18T16:54:31.813" Title="intervlan router-on-stick with Nexus" Tags="|vlan|cisco-nexus|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27952" PostTypeId="2" ParentId="27950" CreationDate="2016-02-18T16:42:21.993" Score="1" Body="&lt;p&gt;VLAN 100 is on different networks in the two devices:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2911 is &lt;code&gt;10.0.0.0/24&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/2.100&#xA; encapsulation dot1Q 100&#xA; ip address 10.0.0.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nexus is &lt;code&gt;10.1.0.0/24&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan100&#xA;  no shutdown&#xA;  ip address 10.1.0.13/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VLAN 200 is on different networks in the two devices:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2911 is &lt;code&gt;10.1.0.0/24&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/2.200&#xA; encapsulation dot1Q 200&#xA; ip address 10.1.0.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nexus is &lt;code&gt;10.0.0.0/24&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan200&#xA;  no shutdown&#xA;  ip address 10.0.0.13/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, you don't want &lt;code&gt;ip nat inside&lt;/code&gt; on &lt;code&gt;interface GigabitEthernet0/2&lt;/code&gt; since it doesn't have an IP address. You only need it on the subinterfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-18T16:42:21.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27953" PostTypeId="1" AcceptedAnswerId="27961" CreationDate="2016-02-18T17:10:06.690" Score="2" ViewCount="1982" Body="&lt;p&gt;I have been looking around and it seems list this would be a simple question so I am sorry if there is a duplicate somewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a switch that is carrying a vlan 20 which is holding a /24 . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the network is 10.10.0.1 /24&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended jimmys_wireless&#xA; deny   ip any 10.11.0.0 0.0.0.255&#xA; deny   ip any 10.12.0.0 0.0.0.255&#xA; deny   ip any 172.16.1.0 0.0.0.255&#xA; permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have tried doing something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended jimmys_wireless&#xA; permit ip any 10.10.0.0 0.0.0.255&#xA; permit ip any 10.10.0.1 0.0.0.255 # default gateway&#xA; deny ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get an ip but cannot get out to the internet at all. this network should only have access to internet and its own network. I want this because if I change the network or add anything, I wound have to update the blacklist to deny it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit I have this set this for in . I think I tried this for in and I couldn't get an IP.&lt;/p&gt;&#xA;" OwnerUserId="23008" LastEditorUserId="23008" LastEditDate="2016-02-18T17:22:56.003" LastActivityDate="2016-02-23T21:07:26.420" Title="Cisco ACLs: Whitelist approach to ACLs" Tags="|cisco|routing|switch|acl|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27954" PostTypeId="2" ParentId="19367" CreationDate="2016-02-18T17:18:27.720" Score="0" Body="&lt;p&gt;&quot;We understand that JUNOS uses a per-flow load balancing algorithm despite the statement &quot;per-packet&quot; in the policy to enable load-balancing&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Found that statement to be quite true when using iperf for testing some load-balancing scenarios. With a single iperf session, traffic is not load balanced at all, but when enabling paralell iperf sessions, the traffic gets load-balanced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although Juniper documentation suggests otherwise!&#xA;&lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos13.2/topics/usage-guidelines/mpls-configuring-load-balancing-across-rsvp-lsps.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/documentation/en_US/junos13.2/topics/usage-guidelines/mpls-configuring-load-balancing-across-rsvp-lsps.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder if the above is applicable as from JUNOS13.2&lt;/p&gt;&#xA;" OwnerUserId="23028" LastActivityDate="2016-02-18T17:18:27.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27955" PostTypeId="2" ParentId="27953" CreationDate="2016-02-18T17:20:07.380" Score="0" Body="&lt;p&gt;You need to look at whether it's applied inbound or outbound (you didn't specify), and the source and destination on each line. It's also important on which interface (you didn't specify) you apply the ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to think it through and select the correct interface, correct direction, and the correct source and destination for what you want to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better explanation would help us to help you.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-18T21:56:43.567" LastActivityDate="2016-02-18T21:56:43.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27956" PostTypeId="2" ParentId="27935" CreationDate="2016-02-18T17:23:51.913" Score="0" Body="&lt;p&gt;There might be several issues:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I'm not sure about your topology, but am wild guessing it is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pod1 ---- Kubernetes-Node-1 ---- Kubernetes-Node-2 ---- Pod2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This looks like a multicast loop to me:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mroute from eth0 group 228.8.8.8 to docker0 mroute from docker0 group 228.8.8.8 to eth0&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check that your UNICAST routing tables towards the multicast source is correct. Does Kubernetes-Node-2 have UNICAST route for Pod1's address?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you take advice, I think that running OSPF+PIM+IGMP is usually more practical than static multicast routing.&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="23016" LastEditDate="2016-02-21T18:04:17.703" LastActivityDate="2016-02-21T18:04:17.703" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27959" PostTypeId="1" AcceptedAnswerId="27960" CreationDate="2016-02-18T19:32:29.833" Score="2" ViewCount="307" Body="&lt;p&gt;I have a Cisco AS2511-RJ I am using as a terminal server to 3560 switches, I also have an SRX100 and SRX210 that I would like to connect to using the Cisco Terminal Server but I am unable to achieve this, I get gibberish when using the Terminal Server config for the Cisco devices, I would be grateful for help or directions if it is at all possible to connect to the SRX devices using the AS2511.&lt;/p&gt;&#xA;" OwnerUserId="21920" LastActivityDate="2016-02-18T20:24:25.173" Title="Configure Cisco AS2511-RJ as terminal server for Juniper SRX" Tags="|cisco|juniper|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27960" PostTypeId="2" ParentId="27959" CreationDate="2016-02-18T20:24:25.173" Score="2" Body="&lt;p&gt;Gibberish means the port speed is wrong -- or flow control isn't setup correctly and it's overflowing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nothing at all means the wiring is wrong. Don't assume Cisco and Juniper use the same pinouts. Of course, it could simply be DTE vs DCE (tx/rx swapped)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's how I have a line configured to access a 2948G-L3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line ....&#xA; session-timeout 30 &#xA; no motd-banner&#xA; exec-timeout 0 0&#xA; modem DTR-active&#xA; transport input telnet&#xA; stopbits 1&#xA; speed 38400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(authentication is required on that port)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-02-18T20:24:25.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27961" PostTypeId="2" ParentId="27953" CreationDate="2016-02-18T21:16:21.623" Score="1" Body="&lt;p&gt;The ACL you're setting up has to be applied to the VLAN interface as incoming, and should simply look like this: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended jimmys_wireless&#xA; /*permits here*/&#xA; deny ip any 10.0.0.0 0.0.0.255&#xA; deny ip any 172.16.0.0 0.15.255.255&#xA; deny ip any 192.168.0.0 0.0.255.255&#xA; permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way, all local addresses are banned, all public addresses (a.k.a. &quot;The Internet&quot;) are allowed. You don't need to allow the gateway IP address, as it is just used to relay traffic for Internet IPs. But, as it won't be the destination IP of any IP packet, it doesn't need to be allowed in your ACL.&lt;/p&gt;&#xA;" OwnerUserId="14263" LastEditorUserId="23008" LastEditDate="2016-02-22T15:01:45.193" LastActivityDate="2016-02-22T15:01:45.193" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27962" PostTypeId="1" AcceptedAnswerId="27965" CreationDate="2016-02-18T23:06:20.677" Score="5" ViewCount="426" Body="&lt;p&gt;I'm taking a computer networking course and i struggle to get to flow of things when it comes to learning switches and routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say we have a AS with LANs that connected with switches, and there also router in each LAN .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when a station in LAN A want so send packet to the far most station in entirely different LAN B,  and A connected only to one switch, the switch &quot;learn&quot; A, and update its forwarding table and broadcast the packet. But when the data will come eventually to a router, is it true to say that the router already used OSPF to know how to forward the packet? I'll be happy i somone can clarify this to me with maybe more informative example , thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="24542" LastEditorUserId="8499" LastEditDate="2019-01-04T20:33:51.690" LastActivityDate="2019-01-04T20:33:51.690" Title="Learning switches and routers" Tags="|routing|router|ip|ospf|switching|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27963" PostTypeId="2" ParentId="27962" CreationDate="2016-02-18T23:13:45.863" Score="1" Body="&lt;p&gt;When you connect two OSPF routers that have adjacency, the switch that comes in between to connect those routers can be considered as a dumb switch/bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use one port to connect to Router A and second port to Router C. Mac addresses get learned by the switch to enable switching between the routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you do with the rest of ports in the switch is a different open-ended discussion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch doesn't care about ip address or OSPF. (again I doubt you are going through layer 3 switch in the intro course). All it does is using the mac addresses of the interfaces Router A and B are using.&#xA;Then it's up to the routers to form adjacency.&lt;/p&gt;&#xA;" OwnerDisplayName="user10221" LastActivityDate="2016-02-18T23:13:45.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27964" PostTypeId="2" ParentId="27948" CreationDate="2016-02-18T23:13:47.093" Score="1" Body="&lt;p&gt;I believe you are looking for failover not handover. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For fail over both routers can have the same IP as long as the secondary is set to Active = no - If both show the same IP you would have conflict. All you would need after that is a heart beat link, and have the secondary router kick in if the first goes offline. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for method, it would greatly depend on the router, and setup protocols of the routers.&lt;/p&gt;&#xA;" OwnerUserId="23035" LastActivityDate="2016-02-18T23:13:47.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27965" PostTypeId="2" ParentId="27962" CreationDate="2016-02-18T23:21:28.643" Score="4" Body="&lt;p&gt;When a host wants to send something to a host in a different LAN, the sending host can tell it is sending to a different LAN because its own network and mask are configured in it. Based on that knowledge, it knows it needs to send the traffic to its configured gateway (router). It may have the MAC address of the gateway in its ARP cache, or it may not. If it doesn't, it needs to use ARP to resolve the gateway's IP address to its MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once it has the gateway's MAC address, it can encapsulate the IP packet in the ethernet frame, and send the frame to the gateway. The router will get the frame and strip the frame off the packet. It will inspect the packet and look to see if it has a route to the destination IP address in its routing table. The routing table could be populated in multiple ways, including routing protocols like OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router cannot find a route to the destination, it drops the packet. If it does find a route, it will switch the packet to the outbound interface where it will apply a new layer-2 frame for the outbound interface. This may involve ARP, again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the second router gets the frame from the first router, it will repeat the process that the first router did. It will send the frame it created out the LAN interface toward the receiving host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches will learn the MAC address of devices connected to the switch ports as those devices send traffic through the port. The switch updates its MAC address table. Switches don't have forwarding tables the way routers do, but they will send a frame to a port where the destination MAC address is known, and they will flood frames with unknown destination MAC addresses to all ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers get route information to populate their forwarding tables from multiple sources. The most common source is from the directly connected networks. Routes can be statically configured, or they can be learned via a routing protocol (RIP, OSPF, IS-IS, BGP, etc.). Traffic without a route in the forwarding table will be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your router already knows the route to the destination (directly connected, statically configured, or dynamically learned from a routing protocol) it will forward it out the proper interface toward the destination. If it has not already learned the route to the destination, the traffic will be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have new questions beyond clarification, you need to ask a new question, but this question is really too broad to get into more detail than what I have outlined above.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-19T09:21:16.213" LastActivityDate="2016-02-19T09:21:16.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27966" PostTypeId="1" AcceptedAnswerId="30587" CreationDate="2016-02-18T23:55:52.043" Score="3" ViewCount="359" Body="&lt;p&gt;(There was a previous question that resolved the VLAN issue.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a section of topology where a 2911 is acting as an internal NAT router. (We don't have enough private IP addresses to give to all our lab servers and networking equipment. So we have our own reserved addresses that aren't routable across the corporate network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2911 is using one private IP address to NAT lab IP addresses&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet0/0&#xA; ip address 192.16.25.94 255.255.255.0&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/2&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/2.100&#xA; encapsulation dot1Q 100&#xA; ip address 10.0.0.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface GigabitEthernet0/2.200&#xA; encapsulation dot1Q 200&#xA; ip address 10.1.0.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;&#xA;ip nat inside source list 1 interface GigabitEthernet0/0 overload&#xA;ip route 0.0.0.0 0.0.0.0 192.16.25.1&#xA;!&#xA;access-list 1 permit any&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have 16 Nexus switches, but I'm showing one as a sample here. (If I can get this going, the rest should be easy).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 1,100,102-103,200&#xA;&#xA;vrf context management&#xA;&#xA;interface Vlan1&#xA;&#xA;interface Vlan100&#xA;  no shutdown&#xA;  ip address 10.0.0.22/24&#xA;&#xA;interface Vlan200&#xA;  no shutdown&#xA;  ip address 10.1.0.22/24&#xA;&#xA;interface Ethernet1/1&#xA;  switchport access vlan 200&#xA;&#xA;interface Ethernet1/40&#xA;  switchport access vlan 100&#xA;&#xA;&#xA;interface Ethernet1/48&#xA;  switchport mode trunk&#xA;&#xA;interface Ethernet1/49&#xA;  switchport access vlan 200&#xA;&#xA;interface Ethernet1/50&#xA;  switchport access vlan 200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While a Nexus can ping the default GW of each VLAN , it can't ping outside of the 2911 network.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PING 10.0.0.1 (10.0.0.1): 56 data bytes&#xA;64 bytes from 10.0.0.1: icmp_seq=0 ttl=254 time=0.765 ms&#xA;64 bytes from 10.0.0.1: icmp_seq=1 ttl=254 time=0.571 ms&#xA;64 bytes from 10.0.0.1: icmp_seq=2 ttl=254 time=0.547 ms&#xA;64 bytes from 10.0.0.1: icmp_seq=3 ttl=254 time=0.54 ms&#xA;64 bytes from 10.0.0.1: icmp_seq=4 ttl=254 time=0.534 ms&#xA;&#xA;--- 10.0.0.1 ping statistics ---&#xA;5 packets transmitted, 5 packets received, 0.00% packet loss&#xA;round-trip min/avg/max = 0.534/0.591/0.765 ms&#xA;2# ping 10.1.0.1&#xA;PING 10.1.0.1 (10.1.0.1): 56 data bytes&#xA;64 bytes from 10.1.0.1: icmp_seq=0 ttl=254 time=0.785 ms&#xA;64 bytes from 10.1.0.1: icmp_seq=1 ttl=254 time=0.565 ms&#xA;64 bytes from 10.1.0.1: icmp_seq=2 ttl=254 time=0.557 ms&#xA;64 bytes from 10.1.0.1: icmp_seq=3 ttl=254 time=0.532 ms&#xA;64 bytes from 10.1.0.1: icmp_seq=4 ttl=254 time=0.538 ms&#xA;&#xA;--- 10.1.0.1 ping statistics ---&#xA;5 packets transmitted, 5 packets received, 0.00% packet loss&#xA;round-trip min/avg/max = 0.532/0.595/0.785 ms&#xA;&#xA;2# ping 192.16.25.1&#xA;PING 192.16.25.1 (192.16.25.1): 56 data bytes&#xA;ping: sendto 192.16.25.1 64 chars, No route to host&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I missing to make NAT &amp;amp; Routing work? Also, is this just the Nexus management? Can hosts connected to the Nexus talk to outside already?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the 2911 can ping anything by the way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Update]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C(config)# vrf context management&#xA;C(config-vrf)# ip route 0.0.0.0/0 10.1.0.1 (same result with 10.0.0.1)&#xA;C(config-vrf)# ping 192.16.25.94&#xA;PING 192.16.25.94 (192.16.25.94): 56 data bytes&#xA;ping: sendto 192.16.25.94 64 chars, No route to host&#xA;Request 0 timed out&#xA;ping: sendto 192.16.25.94 64 chars, No route to host&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user10221" LastEditorUserId="8499" LastEditDate="2016-03-20T22:42:22.230" LastActivityDate="2016-05-20T03:56:44.890" Title="2911 as default GW for Nexus" Tags="|cisco-nexus-7k|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="27969" PostTypeId="1" CreationDate="2016-02-19T04:36:36.390" Score="1" ViewCount="437" Body="&lt;p&gt;As the title states, AP does not proceed beyond anonymous.&#xA;Just a rookie here. Is there an &quot;enable&quot; that I missed. Using the Browser GUI to set-up.&#xA;Should I read the 500 page Configuration Guide?&#xA;Feel free to chuckle and all suggestions gratefully accepted.&#xA;Thanks,&#xA;Gary&lt;/p&gt;&#xA;" OwnerUserId="23039" LastActivityDate="2016-02-19T21:02:36.483" Title="Cisco 1250 Series AP, DHCP is not assigning IP Addresses remains at 0.0.0.0" Tags="|cisco|access-point|" AnswerCount="1" CommentCount="3" ClosedDate="2019-03-24T01:03:50.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="27970" PostTypeId="2" ParentId="26075" CreationDate="2016-02-19T06:41:12.863" Score="2" Body="&lt;p&gt;Speaking from my experience, most devices indicating they are being powered by &quot;passive PoE&quot; means that the device does not support standards based PoE (802.3af or 802.3at). While standards based devices &quot;negotiate&quot; power needs, a passive device simply expects the power to be automatically provided.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be required to use the vendor's power injectors and/or switch hardware to provide power to those devices. You may or may not be able to use a standards based PoE power source that can be configured to provide power without negotiation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;End devices that are compliant with 802.3af should work with any device that supplies 802.3af or 802.3at power, even if from a different vendor. End devices that are compliant with 802.3at should work with any device that supplies 802.3at and may work with devices that supply 802.3af depending on they need the extra power that 802.3at can provide and/or if they can operate in a lower power mode on 802.3af.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a choice, always go with a devices that supports standards based PoE. It gives you more options due to the interoperability between devices of different vendors.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-02-19T06:41:12.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27971" PostTypeId="2" ParentId="27969" CreationDate="2016-02-19T06:59:05.687" Score="2" Body="&lt;p&gt;If you connect a computer on the same switch port does it obtain an IP address trough DHCP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand what's going on, you will have to connect a serial console, then look at the console messages when the AP boot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will find a less-than-500-pages guide here :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/access_point/1250/quick/guide/ap1250qs.html#wp41325&quot; rel=&quot;nofollow&quot;&gt;Quick Start Guide: Cisco Aironet 1250 Series Access Point&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-02-19T06:59:05.687" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27973" PostTypeId="1" AcceptedAnswerId="27991" CreationDate="2016-02-19T08:17:46.647" Score="4" ViewCount="221" Body="&lt;p&gt;We have a few fiber optic connections between our buildings, and admittedly we haven't a bloody clue about them (other than &quot;all buildings have SMF, except one that has MMF because reasons, and we're not 100% sure it's actually MMF because $BOSS[-1] was too smart for his own good and left exactly zero documentation&quot;). Yeah, it's that kind of place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So even after reading the NANOG &quot;Fiber 101&quot; .pdf I still remain confused about several things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The SMF connections use a single bidirectional fiber, and have transceivers with &quot;1310 / 1550 nm&quot; written on them – is that the same thing as CWDM?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The MMF connections are apparently OM1, and use two separate fibers per connection.&lt;br&gt;&#xA;So a) generally, does MMF hardware &lt;em&gt;always&lt;/em&gt; use separate Rx &amp;amp; Tx fibers, or can a single bidirectional fiber be used with MMF?&lt;br&gt;&#xA;And b) if that's possible, can &lt;em&gt;our&lt;/em&gt; old OM1 fibers be used as four bidirectional links instead of two paired unidirectional ones? (Merely curious.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What are the possible reasons MMF would have been used for this particular link? (Our guess is &quot;it's only 300 meters away so MMF was cheaper&quot;... no, we can't call and ask.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3955" LastEditorUserId="8499" LastEditDate="2018-03-09T23:43:39.263" LastActivityDate="2018-03-09T23:43:39.263" Title="ELI5 – basic questions regarding MMF" Tags="|fiber|cable|layer1|cabling|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27974" PostTypeId="1" AcceptedAnswerId="27984" CreationDate="2016-02-19T08:26:32.437" Score="3" ViewCount="477" Body="&lt;p&gt;Do you know if I turn on UDLD the 5K and 2K will speak UDLD to each other and do you feel this is a benefit to detect any link issues between the 5K and the FEX?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="14132" LastEditorUserId="8499" LastEditDate="2018-03-18T19:39:26.120" LastActivityDate="2018-03-18T19:39:26.120" Title="UDLD on Nexus 5548 and Nexus 2232" Tags="|cisco|switch|spanning-tree|cisco-nexus|udld|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27975" PostTypeId="2" ParentId="27973" CreationDate="2016-02-19T08:57:04.810" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;No, that is not the same as CWDM.&lt;/li&gt;&#xA;&lt;li&gt;Most fiber is connected with separate Tx and Rx fibers. There is&#xA;nothing unusual about the MMF connections.&lt;/li&gt;&#xA;&lt;li&gt;MMF used to be cheaper, the fiber transceivers still are, and it was pretty&#xA;common to install it in a building and SMF between buildings.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You may find yourself limited by what you can do with OM1 in the future. As you get faster connections (think 10 Gbps) you will find the distance is limited (~33 meters/100 feet at 10 Gbps for OM1).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-19T08:57:04.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27976" PostTypeId="2" ParentId="27974" CreationDate="2016-02-19T09:05:41.040" Score="2" Body="&lt;p&gt;Any Cisco device which can run UDLD can use it with any other Cisco device which can run UDLD. Enabling UDLD can help prevent STP problems. UDLD must be enabled on both devices to actually work, and you should only enable it on ports which are connected to other devices running UDLD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A lot of Cisco routers don't have UDLD, and some can log &quot;unknown protocol&quot; on some ports where it is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, it is a good practice to run it where you can.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-19T09:05:41.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27977" PostTypeId="2" ParentId="25838" CreationDate="2016-02-19T09:51:57.743" Score="1" Body="&lt;p&gt;You could try an easy solution: when connected via FortiClient, NAT your source IP address to the HQ network's range. For this, enable 'NAT' in the policy from client tunnel to HQ_LAN. From this point on, your client will be treated as any host on the HQ network, including routing and policing to the branch network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an alternative, you could build a second phase2 just for the 10.10.10.x network, on both sides of the HQ-BR tunnel, add this network to the tunnel policies on both sides, and add routes in Branch and on the client PC. That last requirement almost always justifies NATting instead.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-02-19T09:51:57.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27978" PostTypeId="2" ParentId="25235" CreationDate="2016-02-19T10:27:11.440" Score="4" Body="&lt;p&gt;First off, this behavior is as expected.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and whether forwarding is permitted or not. After these decisions, subsequent traffic belonging to the same session is forwarded without any further decisions to make. (As a point aside, in Fortinet firewalls established sessions are indeed offloaded from the CPU to a network processing ASIC at that point - which is incapable of looking up routes or policies. The principle holds true even if traffic is not offloaded, though.)    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when the tunnel goes down, the route across is deleted from the Routing Table and VPN sessions are deleted. The next best route to a private network usually is the default route, so for arriving traffic destined to the network behind the tunnel new sessions are created and routed out the WAN interface (where they are discarded at the next router, hopefully).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the tunnel is coming up again, new sessions are correctly routed and forwarded across the tunnel because their first packet trigger the decisions I mentioned above. Existing sessions are not affected - this would imply that with every change of the routing table, the FGT would have to re-evaluate each session if there was a better route than before. This is impractible at least. Traffic will follow the &quot;wrong&quot; route until the session is timed out.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an easy fix for this kind of scenario: create static blackhole routes on the FGT for all private, RFC1918 networks you might use behind VPN tunnels, with 192.168.x.x/24, 172.16.x.y/16 and 10.x.y.z/8 being the most popular. You need to set the distance parameters for these blackhole routes to 254 to keep them inactive as long as other, intended routes exist. The trick is that for blackhole routes, the FGT will not create sessions. So when the tunnel is down and the tunnel route discarded, the blackhole route is used - packets will be discarded immediately. Each packet arriving will trigger a session setup and a routing decision and eventually will be forwarded across the tunnel right after it comes up again.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Fortinet support forums you will find a couple of threads explaining this. This post offers a bulk command file ready to import all RFC1918 blackhole routes: &lt;a href=&quot;https://forum.fortinet.com/FindPost/120872&quot; rel=&quot;nofollow&quot;&gt;https://forum.fortinet.com/FindPost/120872&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-02-19T10:27:11.440" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27979" PostTypeId="2" ParentId="25973" CreationDate="2016-02-19T11:56:11.123" Score="0" Body="&lt;p&gt;Check out &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos14.1/topics/reference/configuration-statement/interface-edit-vlans-qfx-series.html&quot; rel=&quot;nofollow&quot;&gt;Juniper Docs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would do it like&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;set vlans vlan1 interface xe-0/0/3.0 mapping 2430 swap&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Do not confgure the vlan1 inside # edit interface xe-0/0/3.0 fam eth-sw hirachy &lt;/p&gt;&#xA;" OwnerUserId="1679" LastActivityDate="2016-02-19T11:56:11.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27980" PostTypeId="1" AcceptedAnswerId="28009" CreationDate="2016-02-19T12:43:03.687" Score="6" ViewCount="1269" Body="&lt;p&gt;Suppose you have a network like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                   +-------------------------+         +---------------------------+&#xA;                   |                         |         |                           |&#xA;                   |                         |         |                           |&#xA;+--------+         |           core          |---------|           core            |&#xA;| radius |---------|         switch #1       |---------|         switch #2         |&#xA;| server |         |                         |         |                           |&#xA;+--------+         |                         |         |                           |&#xA;                   +-------------------------+         +---------------------------+&#xA;                         |            |                      |               |&#xA;                   +-----------+ +-----------+         +-------------+ +-----------+&#xA;                   |  access   | |  access   |         |   access    | |  access   |&#xA;                   | switch #1 | | switch #2 |         | switch #N-1 | | switch #N |&#xA;                   +-----------+ +-----------+         +-------------+ +-----------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to make sure that it is not possible to connect a device (pc or another switch) to the network that is not allowed. Therefore I am thinking about using 802.1x to authenticate the switches. My plan is to follow the best practices as explained in slides 79 and 80 of &lt;a href=&quot;https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-convery-switches.pdf&quot; rel=&quot;noreferrer&quot;&gt;this presentation&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem raises when I need to connect the two core switches with multiple ethernet cables because 1Gbps is not enough but using a fiber is too expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am reading &lt;a href=&quot;http://whp-aus1.cold.extweb.hp.com/pub/networking/software/Security-Oct2005-59906024-Chap08-PortAccess%288021x%29.pdf&quot; rel=&quot;noreferrer&quot;&gt;this document&lt;/a&gt; from HP where they say&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To help maintain security, the switch does not allow 802.1X and LACP to both be enabled at the same time on the same port. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So I am wondering if this limitation is due to the HP products or by the design of the protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main doubt is that an attacker unplugs one of the ethernet cables between the core switches and attaches another switch, which can intercept the traffic since the switch is not using 802.1x on the trunk ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It it possile to use 802.1x with trunk ports?&lt;/p&gt;&#xA;" OwnerUserId="23024" LastEditorUserId="23024" LastEditDate="2016-02-19T12:48:44.823" LastActivityDate="2018-06-14T07:08:38.553" Title="Can I use 802.1x and LACP to secure the networking infrastructure?" Tags="|ieee-802.1ax|ieee-802.1x|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27981" PostTypeId="1" CreationDate="2016-02-19T12:54:34.367" Score="3" ViewCount="3302" Body="&lt;p&gt;What is a common/best practice value for 'active flow time-out' for flow generation from packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With 'active flow time-out' I refer to the time limit when the current flow (src ip,dest ip, src port, dest port, proto) is considered ended if no new packet arrives within this time-limit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like this value ranges from 15 secs to 45 minutes, however the number of flows and characteristics depends on this timeout value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tx.&lt;/p&gt;&#xA;" OwnerUserId="23046" LastActivityDate="2018-12-20T22:00:58.663" Title="What is a common setting for NetFlow Active Flow Timeout?" Tags="|cisco|cisco-ios|netflow|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27982" PostTypeId="1" CreationDate="2016-02-19T13:04:10.040" Score="4" ViewCount="8100" Body="&lt;p&gt;In case of multicast routing, I encountered source based tree and shared cost based tree.What is the difference between source based tree and shared core based tree? In which case they are used? what is reverse path forwading and how is it used?&lt;/p&gt;&#xA;" OwnerUserId="22814" LastEditorUserId="36720" LastEditDate="2020-10-01T07:13:20.993" LastActivityDate="2020-10-01T17:55:51.543" Title="What is the difference between source based tree and shared cost-based tree?" Tags="|multicast|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="27983" PostTypeId="1" CreationDate="2016-02-19T13:16:24.443" Score="7" ViewCount="2731" Body="&lt;p&gt;My main concern is why is the address 01-00-5E- and how? Especially 5 and E??&lt;/p&gt;&#xA;" OwnerUserId="22814" LastEditorUserId="22814" LastEditDate="2016-02-19T22:01:50.110" LastActivityDate="2021-11-16T16:54:39.630" Title="How is Multicast IP mapped to Multicast Mac address?" Tags="|mac-address|multicast|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="27984" PostTypeId="2" ParentId="27974" CreationDate="2016-02-19T13:29:03.370" Score="4" Body="&lt;p&gt;The thing is the Nexus 2000s aren't autonomous switches. They are essentially line cards for the 5ks (or 7ks) and have no independent existence, so you can't run the normal protocols across those fex-fabric links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my knowledge, you simply can't run UDLD across a fex-fabric port (there's even a bug, CSCub14112, related to the fact that the UDLD config wasn't being removed from fex-fabric ports in certain conditions on the 5ks), though there may be a similar feature embedded in the proprietary control protocol Cisco uses between the 5k and a FEX.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-02-19T13:29:03.370" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="27985" PostTypeId="1" CreationDate="2016-02-19T13:49:18.620" Score="3" ViewCount="270" Body="&lt;p&gt;I recently installed Cisco DCNM (Data Center Network Manager) and my trial license has expired but I would like to continue to use the free Essentials license for my 5K switches.  Can anyone advise what I need to do to apply the license?  Is it just a matter of taking the .lic files from each switch and assigning them to the switch in the DCNM UI?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice is appreciated&lt;/p&gt;&#xA;" OwnerUserId="23047" LastEditorUserId="14613" LastEditDate="2016-08-30T09:31:03.400" LastActivityDate="2016-08-30T13:32:15.440" Title="DCNM Lincense Allocation" Tags="|cisco|cisco-nexus-5k|nms|nx-os|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27986" PostTypeId="2" ParentId="27983" CreationDate="2016-02-19T13:59:55.833" Score="4" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;An IP host group address is mapped to an Ethernet multicast address&#xA;by placing the low-order 23-bits of the IP address into the low-order&#xA;23 bits of the Ethernet multicast address 01-00-5E-00-00-00 (hex).&#xA;Because there are 28 significant bits in an IP host group address,&#xA;more than one host group address may map to the same Ethernet&#xA;multicast address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://datatracker.ietf.org/doc/html/rfc1112&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1112&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="498" LastEditorUserId="36720" LastEditDate="2021-11-16T16:54:39.630" LastActivityDate="2021-11-16T16:54:39.630" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="27987" PostTypeId="1" AcceptedAnswerId="27990" CreationDate="2016-02-19T14:50:29.557" Score="3" ViewCount="3029" Body="&lt;p&gt;I'm implementing a new TACACS server on our network after having removed the old TACACS server which we no longer own.  I've already gotten the implementation working with the NX-OS devices, but when attempting to add the &lt;code&gt;tacacs-server host x.x.x.x key 7 ENCRYPTED_KEY&lt;/code&gt; command I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;%Invalid encrypted key:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did notice that the encrypted keys on the NX-OS devices are listed in alphanumeric, but the old tacacs keys on the IOS15 devices are listed in hexadecimal.  Do I need to run the keys through a different hashing algorithm on the TACACS server for the IOS15 devices?&lt;/p&gt;&#xA;" OwnerUserId="23048" LastActivityDate="2017-12-06T11:48:48.687" Title="TACACS Implentation server key error" Tags="|cisco-ios|tacacs|cisco-nx-os|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="27989" PostTypeId="1" CreationDate="2016-02-19T15:21:58.240" Score="5" ViewCount="2436" Body="&lt;h2&gt;Question (short)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;How to set up 2 totally different dynamic l2l vpn tunnels on an ASA5506 &lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Question (extended)&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;We have a Cisco ASA5506 Security Appliance and we want to set up 2 dynamic VPN setups.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Tunnel for various windows clients;&lt;/li&gt;&#xA;&lt;li&gt;Tunnel to a branch office with dynamic ip using DynDNS.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We can set up the tunnels individually without a problem but cant get them working both at once.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;VPN 1 (windows clients)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;Cisco ASA5506 config&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;group-policy l2tp-ipsec_policy internal&#xA;&#xA;group-policy l2tp-ipsec_policy attributes&#xA;  dns-server value 10.100.3.1&#xA;  vpn-tunnel-protocol l2tp-ipsec            &#xA;  default-domain value vbv.local&#xA;&#xA;  banner value U bent nu aangemeld op het netwerk, zet uw VPN verbinding uit wanneer u klaar bent.&#xA;  wins-server value 10.100.3.1&#xA;  dns-server value 10.100.3.1&#xA;  vpn-filter value VBV_VPN_CLIENT_FILTER&#xA;  split-tunnel-policy tunnelspecified&#xA;  split-tunnel-network-list value VBV_VPN_CLIENTS  &#xA;exit&#xA;&#xA;tunnel-group DefaultRAGroup general-attributes&#xA;  default-group-policy l2tp-ipsec_policy&#xA;  address-pool POOL-VPN_VBVLOCAL        &#xA;  authentication-server-group VBV_LDAP LOCAL&#xA;  password-management&#xA;  strip-realm&#xA;exit    &#xA;&#xA;tunnel-group DefaultRAGroup ipsec-attributes&#xA;  pre-shared-key *****&#xA;exit&#xA;&#xA;tunnel-group DefaultRAGroup ppp-attributes&#xA;  authentication pap&#xA;  no authentication chap&#xA;  no authentication ms-chap-v1&#xA;  no authentication ms-chap-v2&#xA;exit&#xA;&#xA;crypto ipsec transform-set winClient esp-3des esp-sha-hmac&#xA;crypto ipsec transform-set winClient mode transport&#xA;&#xA;crypto dynamic-map dynWinVPN 500 set ikev1 transform-set winClient&#xA;&#xA;crypto map cmap_WAN-GLASVEZEL 500 ipsec-isakmp dynamic dynWinVPN&#xA;&#xA;&#xA;crypto isakmp enable WAN-GLASVEZEL&#xA;&#xA;crypto isakmp policy 10&#xA;  authentication pre-share&#xA;  encryption 3des&#xA;  hash sha&#xA;  group 2&#xA;  lifetime 86400&#xA;exit&#xA;&#xA;access-list VBV_VPN_CLIENT_FILTER extended permit object-group obj-VBVLOCAL_VPN_AllowedServices any any log notifications&#xA;access-list VBV_VPN_CLIENTS extended permit ip object-group obj-VBVLOCAL_VPN_AllowedNetworks any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Above on itself working perfectly, i know about the PAP auth but the reason is the LDAP verification. (cant get that working with mschapv2 and is of later concern).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;VPN 2 (site to site to branch office)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;Cisco ASA5506 config&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac&#xA;&#xA;crypto dynamic-map ***.dyndns.org 100 set pfs group1&#xA;crypto dynamic-map ***.dyndns.org 100 set ikev1 transform-set ESP-3DES-SHA&#xA;crypto dynamic-map ***.dyndns.org 100 set security-association lifetime seconds 86400&#xA;crypto dynamic-map ***.dyndns.org 100 set security-association lifetime kilobytes 9216000&#xA;&#xA;crypto map cmap_WAN-GLASVEZEL 100 ipsec-isakmp dynamic ***.dyndns.org&#xA;&#xA;crypto ikev1 policy 2&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;!&#xA;&#xA;tunnel-group ***.dyndns.org type ipsec-l2l&#xA;tunnel-group ***.dyndns.org general-attributes&#xA; default-group-policy grpPol_vbvjb&#xA;tunnel-group ***.dyndns.org ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; peer-id-validate nocheck&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;code&gt;Branch office Cisco 881 router&lt;/code&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto isakmp policy 1&#xA; encr 3des&#xA; authentication pre-share&#xA; group 2&#xA;!&#xA;crypto isakmp policy 2&#xA; encr 3des&#xA; hash md5&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key ****** address ***&#xA;crypto isakmp invalid-spi-recovery&#xA;crypto isakmp keepalive 15&#xA;!&#xA;crypto ipsec security-association lifetime kilobytes 9216000&#xA;crypto ipsec security-association lifetime seconds 86400&#xA;!&#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac&#xA;!&#xA;crypto map SDM_CMAP-***_BACKUP 1 ipsec-isakmp&#xA; description TUNNEL-***_BACKUP_****&#xA; set peer *****&#xA; set transform-set ESP-3DES-SHA&#xA; set pfs group1&#xA; match address 171&#xA;!&#xA;access-list 171 remark VPN-IPSEC-***_BACKUP&#xA;access-list 171 permit ip 192.168.10.0 0.0.0.255 10.100.0.0 0.0.3.255 log&#xA;access-list 177 permit icmp any host 10.100.3.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Same story here, fully working on its own but can't combine with the setup from above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in short, i can set up both VPN setups and get them working but i cannot get them working in one configuration.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Keynotes&lt;/h3&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Works seperately but not toghether;&lt;/li&gt;&#xA;&lt;li&gt;Branch office uses dynDNS because it has no static IP;&lt;/li&gt;&#xA;&lt;li&gt;Windows VPN Clients use 2l2 with ldap server verification;&lt;/li&gt;&#xA;&lt;li&gt;Strange this i see is site2site uses defaultRAGroup and clients defaultl2lgroup.&lt;/li&gt;&#xA;&lt;li&gt;How can i check catch correct crypto dynamic map?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope someone in here can help so we do not have to call Cisco TAC.&lt;/p&gt;&#xA;" OwnerUserId="22937" LastEditorUserId="22937" LastEditDate="2016-02-19T15:52:52.453" LastActivityDate="2019-08-25T06:02:30.333" Title="Cisco ASA multiple dynamic VPN support (defaultRAGroup-defaultl2lGroup)" Tags="|cisco|cisco-asa|cisco-ios|cisco-ios-15|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="27990" PostTypeId="2" ParentId="27987" CreationDate="2016-02-19T15:29:27.827" Score="2" Body="&lt;p&gt;To answer your question: Yes. ;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem solution is actually easy, as it turns out - I will be quoting what I found out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The NX-OS password scheme is a normal rotation cipher. This is the sequence:&#xA;&#xA;3 22 4 5 18 0 21 5 18 3 10 5 16 22 4 16 24 17 12 5 21 18 5 22 19 7&#xA;&#xA;This means for 'cisco123'&#xA;&#xA;c + 3 = f&#xA;i + 22 - 26 (i+22 is &amp;gt; 26) = i - 4 = e&#xA;s + 4 = w&#xA;c + 5 = h&#xA;o + 18 - 26 (o+18 is &amp;gt; 26) = o - 8 = g&#xA;&#xA;Numbers and other non-alphabetic characters are unchanged.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Source: Comments on &lt;a href=&quot;http://blog.ipspace.net/2007/11/type-7-decryption-in-cisco-ios.html&quot; rel=&quot;nofollow&quot;&gt;http://blog.ipspace.net/2007/11/type-7-decryption-in-cisco-ios.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way - decrypt the key, enter it cleartext on your first IOS device, copy the decrypted key from &lt;code&gt;show run&lt;/code&gt; - you're done.&lt;/p&gt;&#xA;" OwnerUserId="14263" LastActivityDate="2016-02-19T15:29:27.827" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="27991" PostTypeId="2" ParentId="27973" CreationDate="2016-02-19T16:05:36.517" Score="4" Body="&lt;p&gt;To elaborate on Ron's answer:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;What you have is Bi-directional fiber modules, and they use one wave-length for TX and one for RX. The downside is that they come in pairs of upstream and downstream modules, since the wavelengths need to be switched in the downstream module. This is a downside since you now need to stock 2 different spare parts instead of one. Upside is that they use half the amount of fiber strands. They can also be quite costly, off-brand they are usually 3-5 times more expensive than their regular two-strand counterparts.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I've never seen or heard of a BiDi module for MMF. If you need more capacity, I'd say invest in new SMF fiber runs instead of esoteric modules. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check the mantle of the MMF cable, it'll usually tell you how old the cable is. If it's older than about 2005, I'd say they pulled MMF to save money. Or they just spec'd it because of old habits.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;About CWDM:&#xA;CWDM uses optics to merge and split apart (mux and de-mux) several different wavelengths. This way, you can cram 8 signals into the same pair of fiber, and have them enter and exit anywhere along the whole length of a fiber pair by installing add-drop multiplexers. The modules for CWDM has a narrower bandwidth than normal modules to allow for more signals, and they come in 8 different wavelength versions. CWDM saves you a lot when you need a lot of bandwidth and don't want to buy a lot of dark fiber, but it's quite costly when it comes to the muxers and all the different modules you need to stock as spares. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-19T16:05:36.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27992" PostTypeId="1" CreationDate="2016-02-19T16:43:01.670" Score="1" ViewCount="1095" Body="&lt;p&gt;I have asked following question related HSRP setup and here is the diagram and detail: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/24940/hsrp-issue-both-device-active-stats/24943?noredirect=1#comment39020_24943&quot;&gt;HSRP issue both device active stats&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: I have cached on our cacti monitoring, traffic is flowing asymmetric, currently &lt;code&gt;SW1&lt;/code&gt; is active in HSRP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In cacti its showing following going out from &lt;code&gt;SW1&lt;/code&gt; and traffic coming in from &lt;code&gt;SW2&lt;/code&gt;, I believe who ever is active in HSRP should send and receive traffic on same switch right? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1 - Traffic going out &#xA;SW2 - Traffic coming in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea which ISP router is active R1 or R2, what if ISP side R2 router is active one in HSRP?&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-05-19T21:47:36.820" Title="HSRP traffic flow asymmetric" Tags="|cisco|failover|hsrp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27994" PostTypeId="2" ParentId="27992" CreationDate="2016-02-19T16:52:09.573" Score="1" Body="&lt;p&gt;No. HSRP defines the first hop for hosts sending traffic off the LAN. it has nothing to do with how traffic coming from somewhere else is routed, and any router connected to the LAN will put it on the LAN, otherwise you are adding inefficiencies. HSRP is on the LAN, not in front of the LAN in the routers. The routers communicate with HSRP messages on the LAN, and you may or may not have any other connections between the routers, so they would have no way to send the packets to the other router, anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The diagram shows HSRP on a link between the routers? That doesn't seem right since there are no hosts on that link. HSRP is only for hosts with configured gateways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you really want to do is to make sure that your HSRP priorities (higher is better, like bowling) line up with your STP priorities (lower is better, like golf), so that both HSRP and STP want to deliver to the same place, otherwise you can get inefficient switching where frames are sent to the root switch, then need to be sent back to a different switch for routing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-19T16:52:09.573" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="27995" PostTypeId="2" ParentId="27982" CreationDate="2016-02-19T16:53:39.690" Score="2" Body="&lt;p&gt;&lt;strong&gt;Source-based tree&lt;/strong&gt;: A non-shared multicast distribution tree (forwarding/replication state on intermediate routers) is built for every SOURCE,GROUP pair. Source-based tree is unidirectional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Shared tree&lt;/strong&gt;: A per-group multicast distribution tree is built on routers, shared by all group's senders and receivers. The shared tree might be bidirectional.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-19T16:53:39.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="27997" PostTypeId="1" CreationDate="2016-02-19T17:20:02.863" Score="4" ViewCount="250" Body="&lt;p&gt;Looking for design principles in regards to a Campus Area Network? We are a medium sized company with &amp;lt; 250 employees spread across 4 offices. We will soon be combining 2 offices into 1 larger campus.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Should we utilize L2 or L3 for WiFi in each building? Since the buildings will all be close in proximity together and have outdoor APs I want to make sure any staff/guest can connect in any building without being disconnected when roaming around the campus. We will utilize the same SSID for staff connections across the entire campus. Currently we have Ruckus Wireless gear for the WiFi.&lt;/li&gt;&#xA;&lt;li&gt;I understand keeping L2 networks small to keep down broadcast traffic. Would there be any major downfalls to spanning the L2 network between all buildings on campus? Splitting up different departments and services onto different VLANs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since the new offices have not been built yet I want to get things planned for the best availability of growth.&lt;/p&gt;&#xA;" OwnerUserId="3449" LastActivityDate="2017-06-15T07:33:29.223" Title="Campus Area Network questions" Tags="|ieee-802.11|design|layer2|layer3|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="27998" PostTypeId="1" AcceptedAnswerId="27999" CreationDate="2016-02-19T17:22:08.093" Score="1" ViewCount="535" Body="&lt;p&gt;As I've come to understand, water can interfere with wireless data links over vast bodies of water due to the signal reflecting off the water. What alternatives are there to transfer data wireless with an ok speed (e.g. ~50-100 mbit/s) over a mostly calm body of water with a distance of about 30 km? Or is satellite the most viable alternative? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, it's on a boat. One of the points. &lt;/p&gt;&#xA;" OwnerUserId="23053" LastActivityDate="2016-02-19T18:12:50.477" Title="Wifi link over water" Tags="|wireless|point-to-point|" AnswerCount="1" CommentCount="1" ClosedDate="2019-03-24T01:04:37.073" ContentLicense="CC BY-SA 3.0" />
  <row Id="27999" PostTypeId="2" ParentId="27998" CreationDate="2016-02-19T17:26:19.960" Score="0" Body="&lt;p&gt;I'd try alcon wireless, or wave wifi. They tend to specialize in marine wifi connectivity. Satellite is ok, albeit expensive, as long as you're not doing any latency sensitive computing (VoIP, Internet gaming, etc)&lt;/p&gt;&#xA;" OwnerUserId="22994" LastActivityDate="2016-02-19T17:26:19.960" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28002" PostTypeId="2" ParentId="27997" CreationDate="2016-02-19T18:22:06.330" Score="1" Body="&lt;p&gt;I like to keep broadcast domains the &quot;standard&quot; /24, that has always worked fine for me. Separating departments into different /24's is a good idea, that makes your firewall rules and ACLs easier. Printers and other garbage I like to put into a different L2 network just to keep things tidier. Management traffic into another as well. L3 roaming is nice on WiFi since you can keep the department/subnet logic working there as well then. Remember to leave room for growth between your networks, for example allocate a /22 for each department and assign them the first /24. If that department grows, you can easily allocate another /24, and if you did everything right, you don't need to change any firewall rules.  &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-02-19T18:22:06.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28003" PostTypeId="2" ParentId="27981" CreationDate="2016-02-19T19:00:53.253" Score="1" Body="&lt;p&gt;I'm not sure if we can say that there is a best practice for this case. &#xA;It's not a mandatory parameter to have your Netflow software working fine. I'm saying that it is not mandatory cause I don't have it configured on my Cisco devices and my Netflow software works fine.&#xA;Anyway, take a look on this link where they explain a little bit better this question: &lt;a href=&quot;https://www.manageengine.com/products/netflow/help/index.html&quot; rel=&quot;nofollow&quot;&gt;https://www.manageengine.com/products/netflow/help/index.html&lt;/a&gt;&#xA;It is from a specific manufacturer but maybe it works like a standard explanation.&lt;/p&gt;&#xA;" OwnerUserId="17284" LastActivityDate="2016-02-19T19:00:53.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28004" PostTypeId="2" ParentId="27966" CreationDate="2016-02-19T20:02:50.773" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/12918911/nexus-default-gateway&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/12918911/nexus-default-gateway&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT generally doesn't like &quot;any&quot; as the source IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try modifying &lt;code&gt;any&lt;/code&gt; to &lt;code&gt;10.0.0.0 0.0.1.255&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tend to use extended ACLs with &lt;code&gt;any&lt;/code&gt; as the destination IP addresses, which NAT is fine with, but then you would need to update your NAT statement as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, are you happy with setting up the management port or do you want to try the SVI? It may not make a difference but I have seen it not work many times with that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your Nexus switches, can you pick one of the SVIs on the Nexus and shut the other down? Then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int vlan &amp;lt;x&amp;gt;&#xA;management&#xA;&#xA;ip route 0.0.0.0/0 vlan &amp;lt;x&amp;gt; &amp;lt;router subinterface IP for vlan x&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;don't put the default route in the management VRF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure whether technically this makes it L3 from a Nexus perspective, but as long as the client's default gateways are the router subinterface IP addresses, it shouldn't matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like I say, I have not used Nexus, so it may not help, but it's worth a try.&lt;/p&gt;&#xA;" OwnerDisplayName="user10221" LastEditorUserId="8499" LastEditDate="2016-03-20T22:39:11.090" LastActivityDate="2016-03-20T22:39:11.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28006" PostTypeId="1" CreationDate="2016-02-19T23:19:54.663" Score="5" ViewCount="689" Body="&lt;p&gt;Is it possible to use Active PoE splitter that does comply to 802.3af, with passive PoE injector?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;802.3af does autonegotiate&lt;/li&gt;&#xA;&lt;li&gt;Does negotiation take passive PoE into account?  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit:&lt;/em&gt;&lt;br&gt;&#xA;Acording to: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2078/poe-is-compatible-with-gigabit-ethernet/2079&quot;&gt;This answer @ networkengineering&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Polarity is required on data pairs, and ambiguously implemented for spare pairs, with the use of a diode bridge.  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That would mean, unless the negotiation does not allow fallback to spare pairs, or let's the DC pass through (dangerous?), or just does not operate at all (would be useless), it should work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: The device also has to power itself before it can do anything, which means it has to by default tap into both possible powersources internally. Even if that is a low current path.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to: &lt;a href=&quot;http://www.gocsc.com/uploads/white_papers/AE0F4756CB164FB58717FF0D6F2CCE6C.pdf&quot; rel=&quot;nofollow&quot;&gt;Fundamentals of Power&#xA;Over Ethernet&lt;/a&gt;, page 5, flowchart.  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Negotiation is managed/initated by injector&lt;/li&gt;&#xA;&lt;li&gt;The splitter does provide a signature  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Which does imply, given the standard (previous quote), it should automatically inteligently use the power on the spare lines.&lt;/p&gt;&#xA;" OwnerDisplayName="user23063" LastEditorUserId="36720" LastEditDate="2018-05-12T19:53:39.527" LastActivityDate="2022-06-28T01:29:21.810" Title="PoE active splitter (802.3af) w/ passive injector?" Tags="|power-over-ethernet|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="28007" PostTypeId="1" AcceptedAnswerId="33834" CreationDate="2016-02-20T01:37:23.457" Score="3" ViewCount="9247" Body="&lt;p&gt;I am currently trying to understand what exactly is FDM and TDM. I understand the definitions, but I am having trouble visualizing it. First, in Circuit switching a connection between host A and host B must be made where we have created a path for the connection to travel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if we are talking about FDM, and we have 4 users is that saying that the 4 users are going to use that very same path created but at different frequencies? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if we are talking about TDM, and we have 4 users is that also saying that for that same path users will get to use it at different times?&lt;/p&gt;&#xA;" OwnerUserId="22754" LastActivityDate="2019-03-04T20:21:09.257" Title="How does FDM and TDM work in relation to Circuit Switching?" Tags="|switch|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28008" PostTypeId="2" ParentId="27997" CreationDate="2016-02-20T01:59:02.317" Score="-1" Body="&lt;p&gt;This will provide a good baseline for everyone of your requirements, however small or large your campus is.&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-campus/index.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/solutions/enterprise/design-zone-campus/index.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22720" LastActivityDate="2016-02-20T01:59:02.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28009" PostTypeId="2" ParentId="27980" CreationDate="2016-02-20T03:30:01.430" Score="5" Body="&lt;p&gt;802.1x was specifically designed for end-point devices to authenticate to network switches and was not designed for switch-to-switch connections. Because of this, it is highly unlikely that you will find any switches that can be a 802.1x client, so the answer to your Y question is no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your X concern (see &lt;a href=&quot;http://mywiki.wooledge.org/XyProblem&quot; rel=&quot;nofollow noreferrer&quot;&gt;XY problem&lt;/a&gt;)- preventing a malicious entity from monitoring and intercepting traffic can only be reasonably accomplished by maintaining &lt;em&gt;physical security&lt;/em&gt; of your network hardware and cabling infrastructure. As @Ron mentioned, it is trivial to configure a device to act as a network tap that can be placed between any one of your switches -provided that physical access can be attained- that can then passively monitor traffic on your network, regardless of whether you have 802.1x configured. MACSEC would be an example of a technical measure that could potentially prevent this type of attack.&lt;/p&gt;&#xA;" OwnerUserId="21833" LastEditorUserId="21833" LastEditDate="2017-07-31T20:27:30.120" LastActivityDate="2017-07-31T20:27:30.120" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28012" PostTypeId="1" AcceptedAnswerId="28016" CreationDate="2016-02-20T06:43:57.843" Score="2" ViewCount="664" Body="&lt;p&gt;I'm teaching assistant in a Networking 101 course. From my past experience with such courses, I found that some students gets lost when we have to run some algorithms manually with pen and paper, and doing examples in projected presentations is very time consuming task and  is lacking any interactivity. Therefore, students finds such courses as uninteresting and boring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying to find some software that will allow me to put nodes and connect them in lines, than run a protocol of my choice and have visualization of algorithms such as spanning trees ready in seconds, so we could watch how each nodes operate. While trying to find such software I was only able to find &lt;a href=&quot;http://www.brianlinkletter.com/open-source-network-simulators/&quot; rel=&quot;nofollow&quot;&gt;simulators that allows connecting&lt;/a&gt; virtual machines into a virtual network and than watching the traffic through WireShark. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know a way to visualize the core network algorithms in a way that will be pleasant to students? &lt;/p&gt;&#xA;" OwnerUserId="23067" LastActivityDate="2018-05-04T14:15:41.553" Title="Computer network protocols visualization" Tags="|routing|ethernet|switching|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28013" PostTypeId="2" ParentId="26732" CreationDate="2016-02-20T07:15:45.647" Score="1" Body="&lt;p&gt;The difference between DV and LS protocols actually has nothing to do with choice of metric; the common misconception that it does is simply because the only non-proprietary DV protocol in common use (RIPV2) uses hop count as its metric, and none of the LS protocols do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a now-obsolete Cisco-proprietary DV routing protocol called IGRP, which was almost identical to RIPV1 except that it used a composite metric based on bandwidth and delay (the same one used in the current proprietary EIGRP) instead of hop count.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real difference is in what routers advertise to each other. In LS they only advertise what networks they have working direct connections to (that's what a router's &quot;link state&quot; means); eventually all the routers in the network have a complete list of their own and everybody else's direct connections, and then essentially consider all possible ways of getting from themselves to any of the other networks in the list, calculate the metric for each way, and pick the ones with the lowest metrics and install them as routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In DV, routers not only advertise their own directly-connected networks, they advertise networks that they've heard about from other routers; in other words, they send out their whole routing tables. Each route they advertise includes a calculated metric which can be, but does not have to be, the number of routers they'd need to send a packet destined for a particular network to go through (&quot;hop count&quot;). Because much of the information each router sends was determined indirectly, DV routing is sometimes referred to as &quot;routing by rumor&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, in DV routers advertise actual routes; in LS routers advertise link states. In LS, every router knows exactly who's directly connected to whom (&quot;the topology of the network&quot;); in DV they only who has some way of reaching whom.&lt;/p&gt;&#xA;" OwnerUserId="23065" LastActivityDate="2016-02-20T07:15:45.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28015" PostTypeId="2" ParentId="28012" CreationDate="2016-02-20T12:01:33.660" Score="-1" Body="&lt;p&gt;I think you are looking for something as &lt;a href=&quot;https://www.gns3.com&quot; rel=&quot;nofollow&quot;&gt;https://www.gns3.com&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22937" LastActivityDate="2016-02-20T12:01:33.660" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28016" PostTypeId="2" ParentId="28012" CreationDate="2016-02-20T12:13:44.137" Score="3" Body="&lt;p&gt;One way to do it would be to run some devices with whatever protocol you want to study and use &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wireshark&lt;/a&gt; (with appropriate filtering) to see what actually happens. It's a great way to learn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark could appear difficult at first glance, but it's indeed quite easy to use and to read the packets since it decode many things for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way that would be great for you I think is &lt;a href=&quot;https://www.netacad.com/about-networking-academy/packet-tracer/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Packet Tracer&lt;/a&gt;.&#xA;It has the advantage of not requiring any hardware and it has built-in the wireshark-like function of examining packets.&#xA;However it has never been clear to me if you can use it freely outside of Cisco official training. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, &lt;a href=&quot;http://virl.cisco.com/work/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Virtual Internet Routing Lab&lt;/a&gt;, is more advanced than Packet Tracer, and you may be eligible to the Academic Edition. But you need a lot of memory (RAM) to run it.&#xA;(Thanks to  &lt;a href=&quot;http://chat.stackexchange.com/users/131322/eddie&quot;&gt;Eddie&lt;/a&gt; for the info about VIRL)&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2018-05-04T14:15:41.553" LastActivityDate="2018-05-04T14:15:41.553" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="28017" PostTypeId="1" AcceptedAnswerId="28018" CreationDate="2016-02-20T15:07:29.253" Score="1" ViewCount="13853" Body="&lt;p&gt;I want to find out which phase 2 is associated with a particular phase 1 on cisco ASA device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several phase 1 and phase 2 on the device. With the following commands, I can see the active SAs :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   show crypto isakamp sa details&#xA;   show crypto ipsec sa details&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But there is only one active for each phase. The configuration itself does not explicitly say &quot;This phase 2 is associated with this phase 1&quot; like Fortigate 60D from Fortinet for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Referring to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa70/configuration/guide/config/ike.html&quot; rel=&quot;nofollow&quot;&gt;this doc&lt;/a&gt; on cisco website, I understand VPNs tunnels are established after trying each phase configuration until a match is found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to know on cisco ASA devices which phase 2 is associated with a particular phase 1 ?&lt;/p&gt;&#xA;" OwnerUserId="23050" LastActivityDate="2016-02-23T20:52:46.783" Title="How to identify IPsec phase 2 on particular phase 1" Tags="|cisco-asa|vpn|ipsec|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28018" PostTypeId="2" ParentId="28017" CreationDate="2016-02-20T16:27:17.167" Score="2" Body="&lt;p&gt;Another useful vpn show command is:   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;show vpn-sessiondb detail l2l&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/command/reference/cmd_ref/s7.html#wp1306284&quot; rel=&quot;nofollow&quot;&gt;ASA Command Reference Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should give you what you are looking for.  This command gives quite a bit of information for each tunnel that is negotiated.  This can also be utilized to view other types of VPNs.  The syntax may be slightly different depending on code version.&lt;/p&gt;&#xA;" OwnerUserId="14230" LastActivityDate="2016-02-20T16:27:17.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28020" PostTypeId="2" ParentId="25901" CreationDate="2016-02-20T17:27:14.823" Score="2" Body="&lt;p&gt;My apologies for the late response, I've been AFK due to life issues.  You have probably already got this working.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as your NAT statement translates ExternalIp to InternalIp without port requirements, you should be fine using port 990 on the same server for FTPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using a static NAT similar to the below, port requirements would only need to be taken in consideration for ACLs:   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;object network WEB-SVR&lt;br&gt;&#xA;  host 10.1.1.1&lt;br&gt;&#xA;nat (DMZ,outside) static 8.8.8.8&lt;/em&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing to be careful of is to be sure to allow the required access through the firewall ACLs as there is most likely a port range configured for the service that will need to be allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you and take care,&lt;br&gt;&#xA; -D&lt;/p&gt;&#xA;" OwnerUserId="14230" LastActivityDate="2016-02-20T17:27:14.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28022" PostTypeId="1" AcceptedAnswerId="28024" CreationDate="2016-02-20T20:24:31.130" Score="5" ViewCount="7607" Body="&lt;p&gt;I currently have a set of four virtual hosts on a private network, with a fifth host running pfSense to act as the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When communicating with hosts outside of the private network, all traffic is routed via the pfSense gateway (10.0.0.1). However, when two hosts on the same subnet communicate, they do not do so via the gateway. I have gathered that these hosts realise they are on the same subnet and switch and opt to communicate via MAC address w/ARP rather than using the IP gateway I have set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like these hosts to communicate via the gateway so that I can monitor the traffic between the hosts on the private network. I have attempted to set static routes, for example:&#xA;&lt;code&gt;ip route add 10.0.0.4 via 10.0.0.1 dev eth0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first traceroute subsequent to this will correctly route via the gateway:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@file-server ~ # traceroute 10.0.0.4&#xA;traceroute to 10.0.0.4 (10.0.0.4), 30 hops max, 60 byte packets&#xA; 1  10.0.0.1 (10.0.0.1) 0.241ms 0.287ms 0.274ms&#xA; 2  10.0.0.4 (10.0.0.4) 0.559ms 0.567ms 0.574ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I then perform the traceroute again however, the route stops using the gateway.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@file-server ~ # traceroute 10.0.0.4&#xA; 1  10.0.0.4 (10.0.0.4) 0.345ms 0.376ms 0.362ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My guess would be that perhaps my host has populated its ARP table with the MAC address of the traceroute target after the initial traceroute, and opts to use that for communication in future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that is the case, I am not sure how to counter it. I believed that my static route would take precedent over any other decisions taken by the system. I would like to research further, but I am not actually sure where to look to solve this issue as I am not sure why my static route is not adhered to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please provide insight as to why my static route is only adhered to with my initial traceroute, and how I would go about forcing a static route to the gateway for same-subnet communications?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;**Edit: ** I should add that this set-up is for experimentation, so I am not restricted to solely things that would be a good idea in the real world. &lt;/p&gt;&#xA;" OwnerUserId="23080" LastEditorUserId="23080" LastEditDate="2016-02-20T20:59:58.113" LastActivityDate="2021-09-10T16:47:39.617" Title="Force use of gateway for communication on same subnet" Tags="|routing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28024" PostTypeId="2" ParentId="28022" CreationDate="2016-02-20T20:36:32.493" Score="4" Body="&lt;p&gt;You would have to capture packets to be sure, but I suspect what is going on is an ICMP Redirect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a Router receives a packet for which a better next-hop exists, it can send an ICMP Redirect to the original sender to inform them to use the better next-hop when trying to speak to that same destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The initial sender will update its routing table temporarily with the new information. I believe for 10 minutes, but this is probably different with each OS/vendor/implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is generally a way to disable ICMP redirects at the Router. And there is more than likely a way to disable accepting ICMP redirects on the Host. If not specifically, then indirectly by blocking it with an ACL or iptables entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read more about ICMP Redirects here:&#xA;&lt;a href=&quot;http://www.cymru.com/gillsr/documents/icmp-redirects-are-bad.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.cymru.com/gillsr/documents/icmp-redirects-are-bad.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The are now-a-days considered a security vulnerability, but when they were created they were based on good intentions. As the Internet got bigger, and less trust-able, however, their use has been significantly reduced -- and discouraged, for that matter.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-02-20T20:36:32.493" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28025" PostTypeId="1" AcceptedAnswerId="28026" CreationDate="2016-02-20T23:02:47.283" Score="3" ViewCount="1291" Body="&lt;p&gt;Networking community, I have hit a snag and was hoping for advice or suggestions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/x332L.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/x332L.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am having trouble getting Router 2 to transmit traffic between the Firewall WAN port (internet) and Router 1 and vice versa and am not sure what to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Firewall (pfSense) is configured on the LAN side with 3 x VLAN's.  (VLAN11, VLAN12, VLAN13). I have configured Switch1 with the appropriate Trunk/Access ports to allow for all devices to communicate with each other and the WAN (Internet access).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The VLAN addressing scheme from pfSense is: 192.168.11.X (VLAN11), 12.X (VLAN12), etc, etc.  &lt;/li&gt;&#xA;&lt;li&gt;Router 1: is configured as a DHCP server for all devices attached to G0/1&lt;/li&gt;&#xA;&lt;li&gt;NAT is enabled and configured&lt;/li&gt;&#xA;&lt;li&gt;OSPF is configured and enabled (For learning purposes) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The following are various configurations I have attempted, I feel I am very close, but am missing one small thing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Config 1:&lt;/strong&gt;&#xA;Router 2: with manual G0/1 configuration&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Router 2: G0/1: ip = 192.168.13.30 255.255.255.0&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router 2 has all of the information in its routing table from Router 1&lt;/li&gt;&#xA;&lt;li&gt;Router 1 has all of the information in its routing table from Router 2&lt;/li&gt;&#xA;&lt;li&gt;Router 2 CAN ping everything behind Router 1 (off G0/1)&lt;/li&gt;&#xA;&lt;li&gt;Router 2 CAN ping server 1 &amp;amp; 2 (which reside on VLAN13)&lt;/li&gt;&#xA;&lt;li&gt;Router 2 cannot ping the WAN address on pfSense&lt;/li&gt;&#xA;&lt;li&gt;Router 1 cannot ping the servers which reside on VLAN 13 or pfSense WAN address&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration excerpt from Config_1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;ROUTER 2:&lt;/strong&gt; Configuration excerpt:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description PrimaryWANDesc_&#xA; ip address 192.168.200.5 255.255.255.252&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.13.15 255.255.255.0&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router ospf 10&#xA; network 192.168.13.0 0.0.0.255 area 0&#xA; network 192.168.200.4 0.0.0.3 area 0&#xA; default-information originate&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip nat inside source list 1 interface GigabitEthernet0/1 overload&#xA;!&#xA;!&#xA;!&#xA;access-list 1 permit 192.168.0.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;ROUTER 1:&lt;/strong&gt; Configuration excerpt:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA;ip address 192.168.200.6 255.255.255.252&#xA;ip address 192.168.200.6 255.255.255.252&#xA;ip nat outside&#xA;ip virtual-reassembly in&#xA;&#xA;duplex auto&#xA;speed auto&#xA;&#xA;!&#xA;interface GigabitEthernet0/1&#xA;ip address 192.168.2.254 255.255.255.0&#xA;ip nat inside&#xA;ip virtual-reassembly in&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;router ospf 10&#xA;network 192.168.200.4 0.0.0.3 area 0&#xA;network 192.168.2.0 0.0.0.255 area 0&#xA;default-information originate&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip nat inside source list 1 interface GigabitEthernet0/0 overload&#xA;!&#xA;!         &#xA;!         &#xA;access-list 1 permit 192.168.0.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Config 2:&lt;/strong&gt;&#xA;I have also recently tried the following to no avail: &#xA;On Router 2, G0/1: &quot;ip address dhcp&quot; (Allowing pfSense to dynamically assign IP) &#xA;- Router 2 has all of the information in its routing table from Router 1&#xA;- Router 1 has all of the information in its routing table from Router 2&#xA;- Router 2 CAN ping server 1 &amp;amp; 2 (which reside on VLAN13) &#xA;- Router 2 CAN ping the WAN address on pfSense &#xA;- Router 2 CAN ping everything behind Router 1 (off G0/1) &#xA;- Router 1 cannot ping the servers which reside on VLAN 13 &#xA;- Router 1 cannot ping the WAN address on pfSense &#xA;- pfSense cannot ping Router2 eth0/0 ip address&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Currently trying: going back and configuring the port on the switch that Router2, G0/1 is attached to, to 'Trunk' mode. Then I am going to manually reconfigure the G0/1 port again on the router..&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Thank you again for any assistance or advice. Please let me know if I can provide any further details to aid.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Update: After removing NAT and OSPF 'default-information originate'&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;Router2 Configuration&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 192.168.31.254 255.255.255.0&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description PrimaryWANDesc_&#xA; ip address 192.168.200.5 255.255.255.252&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.13.15 255.255.255.0&#xA; ip address dhcp&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router ospf 10&#xA; network 192.168.13.0 0.0.0.255 area 0&#xA; network 192.168.200.4 0.0.0.3 area 0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;Router1: Configuration&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 192.168.225.254 255.255.255.0&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 192.168.200.6 255.255.255.252&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.2.254 255.255.255.0&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router ospf 10&#xA; network 192.168.200.4 0.0.0.3 area 0&#xA; network 192.168.2.0 0.0.0.255 area 0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Updated&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description PrimaryWANDesc_&#xA; ip address 192.168.200.5 255.255.255.252&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address dhcp&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router ospf 10&#xA; network 150.10.93.0 0.0.0.255 area 0&#xA; network 192.168.30.0 0.0.0.255 area 0&#xA; network 192.168.200.4 0.0.0.3 area 0&#xA; default-information originate&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip default-network 192.168.13.0&#xA;ip route 192.168.13.0 255.255.255.0 152.14.93.152 110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Firewall packet capture info&lt;/h2&gt;&#xA;&#xA;&lt;h2&gt;Ping sent from Router1 and Router2 to firewall WAN:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;18:15:26.000811 IP 192.168.200.6 &amp;gt; 150.10.93.152: ICMP echo request, id 117, seq 0, length 80&#xA;18:15:27.998919 IP 192.168.200.6 &amp;gt; 150.10.93.152: ICMP echo request, id 117, seq 1, length 80&#xA;18:15:29.998894 IP 192.168.200.6 &amp;gt; 150.10.93.152: ICMP echo request, id 117, seq 2, length 80&#xA;18:15:31.998897 IP 192.168.200.6 &amp;gt; 150.10.93.152: ICMP echo request, id 117, seq 3, length 80&#xA;18:15:33.998902 IP 192.168.200.6 &amp;gt; 150.10.93.152: ICMP echo request, id 117, seq 4, length 80&#xA;18:15:37.506098 IP 192.168.13.115 &amp;gt; 150.10.93.152: ICMP echo request, id 143, seq 0, length 80&#xA;18:15:37.506118 IP 150.10.93.152 &amp;gt; 192.168.13.115: ICMP echo reply, id 143, seq 0, length 80&#xA;18:15:37.506597 IP 192.168.13.115 &amp;gt; 150.10.93.152: ICMP echo request, id 143, seq 1, length 80&#xA;18:15:37.506602 IP 150.10.93.152 &amp;gt; 192.168.13.115: ICMP echo reply, id 143, seq 1, length 80&#xA;18:15:37.506971 IP 192.168.13.115 &amp;gt; 150.10.93.152: ICMP echo request, id 143, seq 2, length 80&#xA;18:15:37.506976 IP 150.10.93.152 &amp;gt; 192.168.13.115: ICMP echo reply, id 143, seq 2, length 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;Router 2&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router2 eth0/1 now receives an statically assigned address from the firewall &lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Default Route configured to VLAN13 Address (192.168.13.1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;interface GigabitEthernet0/1&#xA; ip address dhcp&#xA; duplex auto&#xA; speed auto&lt;/p&gt;&#xA;&#xA;&lt;p&gt;router ospf 10&#xA; network 150.10.93.0 0.0.0.255 area 0&#xA; network 192.168.13.0 0.0.0.255 area 0&#xA; network 192.168.200.4 0.0.0.3 area 0&#xA; default-information originate&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 192.168.13.1 110&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;&lt;strong&gt;pfSense configuration&lt;/strong&gt;&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 13 has DHCP disabled&lt;/li&gt;&#xA;&lt;li&gt;Server1, Server2, and Router2 are mapped via their MAC address to a  statically assigned IP address: (E.g. Router2: 192.168.13.115)&lt;/li&gt;&#xA;&lt;li&gt;NAT is configured for Router2: with If (upstream) | Protocol (TCP) | Scr. address: * (any) | Src. Ports: * | Dest. address * | Dest. ports (other) | NAT IP 192.168.13.115 | NAT Port (Http)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23081" LastEditorUserId="23081" LastEditDate="2016-02-21T23:57:04.103" LastActivityDate="2016-02-21T23:57:04.103" Title="Help getting Cisco Router to forward on path information to pfSense and vise versa" Tags="|cisco|routing|router|firewall|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28026" PostTypeId="2" ParentId="28025" CreationDate="2016-02-20T23:54:20.607" Score="0" Body="&lt;p&gt;Since Router 1 is on an outside interface of Router 2, it will not be able to originate traffic to the inside of Router 2. You have configured inside source NAT on Router 2, and this is one-way. Addresses are translated from the inside to the outside. When traffic is originated from the inside, NAT creates a table entry in order for responding traffic to be translated, but it has no table entry for traffic originated from the outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running NAT on links where you are running a routing protocol is a very bad idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit based on your updated information:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need or want the firewall to know about the routes on the other side of Router 2, you will need to somehow get the routes into the firewall's routing table, otherwise any traffic for the unknown networks will be sent toward the default route for the firewall, and that should be the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router, including the routing process of your firewall, needs to have a route in its routing table for any network to which it is expected to forward traffic. A default route can be used to encompass all networks, and any more specific routes in the routing table are used. Since your firewall's routing table has no routes to the networks on the other side of Router 2, it will use its default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can configure your firewall to participate in OSPF with your two routers, and that will place those routes in the firewall's routing table. It will also let you originate the default route into OSPF from the firewall, and then you should remove that from the other routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other, less desirable, solution is to manually configure static routes in your firewall for the networks to which it has no direct connection. This doesn't scale, and when you add, remove, or change those networks, you will need to manually change the static routes in the firewall.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-21T23:32:44.810" LastActivityDate="2016-02-21T23:32:44.810" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="28027" PostTypeId="2" ParentId="1217" CreationDate="2016-02-21T00:51:08.860" Score="0" Body="&lt;p&gt;an additional option is &lt;a href=&quot;http://ostinato.org/&quot; rel=&quot;nofollow&quot;&gt;ostinato&lt;/a&gt;. it has many of the features of ixia/spirent and can be deployed in a manager+drone mode of operation and has a GUI and python interface.  it's also capable of doing PCAP replays which is surprisingly handy.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;cisco's packaged this as part of their VIRL toolkit for a while as well.&lt;/p&gt;&#xA;" OwnerUserId="84" LastActivityDate="2016-02-21T00:51:08.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28028" PostTypeId="1" AcceptedAnswerId="28031" CreationDate="2016-02-21T01:15:17.683" Score="6" ViewCount="10402" Body="&lt;p&gt;I'm pretty new to networking and I'm currently playing about with the traceroute command on the Windows command line. Do you happen to have any tips/know any resources that are helpful in learning how to analyse the data that comes from traceroutes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance I have this data:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tracing route to poiparau.oyster.net.ck [202.65.32.127]&#xA;over a maximum of 30 hops:&#xA;&#xA;  1     2 ms     2 ms     4 ms  gw.wireless.iqsalford.quintain.lan [10.222.208.1] &#xA;  2    14 ms     8 ms     8 ms  gw-vlan1577.man-xmr.tcw.ask4.net [78.109.190.225] &#xA;  3     6 ms     2 ms     3 ms  man-xmr-edge1-r1.tcw.ask4.net [81.23.63.237] &#xA;  4     *       48 ms    18 ms  lon-xmr-10ge.thn-tcw.core.ask4.net [81.23.51.246] &#xA;  5     *        9 ms    15 ms  te0-7-0-16.ccr21.lon01.atlas.cogentco.com [149.6.185.233] &#xA;  6     8 ms    11 ms     8 ms  be2871.ccr42.lon13.atlas.cogentco.com [154.54.58.185] &#xA;  7   148 ms    83 ms    88 ms  be2490.ccr42.jfk02.atlas.cogentco.com [154.54.42.85] &#xA;  8    84 ms    84 ms    85 ms  be2807.ccr42.dca01.atlas.cogentco.com [154.54.40.110] &#xA;  9    97 ms    96 ms     *     be2113.ccr42.atl01.atlas.cogentco.com [154.54.24.222] &#xA; 10   142 ms   112 ms   114 ms  be2690.ccr22.iah01.atlas.cogentco.com [154.54.28.130] &#xA; 11   149 ms   149 ms   148 ms  be2066.ccr22.lax01.atlas.cogentco.com [154.54.7.54] &#xA; 12   147 ms   148 ms   147 ms  be2017.rcr21.lax04.atlas.cogentco.com [154.54.0.237] &#xA; 13   148 ms   150 ms   148 ms  te0-0-0-3.agr12.lax04.atlas.cogentco.com [154.24.35.14] &#xA; 14   240 ms     *        *     38.104.210.158 &#xA; 15   213 ms     *      243 ms  72.234.202.81 &#xA; 16   226 ms   205 ms   218 ms  72.234.202.82 &#xA; 17   216 ms   222 ms   211 ms  64.110.51.131 &#xA; 18   339 ms   336 ms   336 ms  64.110.51.132 &#xA; 19   333 ms   341 ms   365 ms  poiparau.oyster.net.ck [202.65.32.127] &#xA;&#xA;Trace complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm aware that the number at the far most left refers to an individual hop and that 3 packets are sent for each hop with the times representing the time it took to reach the destination and come back. And I can see that the right most column has the name/ip address but can one tell anymore from traceroute readings?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there ways of comparing one traceroute reading to another effectively? Are there particular times in the day when tracerouting makes for more interesting results? Does tracerouting from a computer with a slow connection affect the time taken?&lt;/p&gt;&#xA;" OwnerUserId="23083" LastActivityDate="2016-02-21T04:21:59.090" Title="Tips on analyzing traceroute readings" Tags="|traceroute|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28029" PostTypeId="2" ParentId="28028" CreationDate="2016-02-21T01:22:36.607" Score="1" Body="&lt;p&gt;What you claimed to know about traceroute is basically correct. It is a very old tool which, in some ways, hasn't completely kept up with modern networking protocols and practices. Traceroute can be a useful tool on your own network where you know what should be expected, and that can be compared to the results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is far less useful when used over networks over which you have no control since some transit ASes will treat it differently than &quot;real&quot; traffic. In fact, you can be left scratching your head because some traffic actually succeeds, and you use traceroute to try to figure out where a problem may be with other traffic, only to have traceroute completely fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often, there may be routers which don't respond, per administrator configuration, or it may not work well across things like MPLS, where traffic is switched, rather than routed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the version or type of traceroute, you can get very different results. At the very least, some transit ASes may route TCP differently than UDP or ICMP, or outright look for traceroute traffic and purposely forward it over a different path. When you use other tools to simulate traceroute, you can get very different results simply by putting more traditional data in the packets you send. The idea is to keep outsiders from trying to discover the AS's internal network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-21T04:21:59.090" LastActivityDate="2016-02-21T04:21:59.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28030" PostTypeId="2" ParentId="28028" CreationDate="2016-02-21T01:55:51.867" Score="5" Body="&lt;p&gt;Pretty much every post I see along these lines recommends the following document:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.nanog.org/meetings/nanog47/presentations/Sunday/RAS_Traceroute_N47_Sun.pdf&quot; rel=&quot;noreferrer&quot;&gt;Practical Guide To (Correctly) Troubleshooting with Traceroute&lt;/a&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traceroute can you send you down the rabbit hole, I would read the entire thing, in fact, I'm going to read over it again.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take care!&lt;/p&gt;&#xA;" OwnerUserId="14230" LastActivityDate="2016-02-21T01:55:51.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28031" PostTypeId="2" ParentId="28028" CreationDate="2016-02-21T03:00:07.197" Score="4" Body="&lt;p&gt;I highly recommend the &lt;a href=&quot;https://www.nanog.org/meetings/nanog47/presentations/Sunday/RAS_Traceroute_N47_Sun.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Traceroute Guide&lt;/a&gt; posted by &lt;a href=&quot;https://networkengineering.stackexchange.com/users/14230/dareuja&quot;&gt;dareuja&lt;/a&gt;. There isn't a more complete single resource on interpreting the results (that I know of, at least).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are a few tips I've picked up over the years from correctly reading the output. If you're unfamiliar with how tracreoute works, there is some good info in &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/12496&quot;&gt;this thread&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;1. Understand the difference between traffic going TO a router vs THROUGH a router&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each line in a traceroute represents the time in milliseconds (ms) it took for that particular router to respond to the initiating client with a TTL Expired message. Each hop is usually tested 3 times, so you get 3 different values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 10th router in the chain received the packet VIA the 9th router in the chain. And often, the TTL Expired response passed back through the 9th router in the chain on the way back to the initiating client (not always, but usually).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, in this example, the 10th router in the chain is processing a packet sent TO it (sort of, I'll explain in a moment). While the 9th router in the chain is processing a packet that was sent THROUGH it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; 9    97 ms    96 ms     *     be2113.ccr42.atl01.atlas.cogentco.com [154.54.24.222] &#xA;10   142 ms   112 ms   114 ms  be2690.ccr22.iah01.atlas.cogentco.com [154.54.28.130] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A lot of people look at the output you posted and at the missed response in the 3rd attempt on hop 9 and claim there is a problem at hop 9.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there is none, because the next three packets sent (to hop 10) all went THROUGH hop 9, and they got there just fine. So there isn't a problem with the missed response at router 9.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why the missed response?  Good question... and the subject of the next tip:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;2. A single missed response is usually not reason for concern&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router vendors these days spend millions of dollars on improving their hardware and software to the point where the routers are able to receive and forward packets at near-line speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a packet is passing through a router like this, it is passing through a specially designed channel that is built specifically for super fast processing. This is usually known as the &lt;em&gt;data plane&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a router has to do something special to a packet, that is outside simply forwarding it, it has to be passed to the router's CPU (or brain, if you will). This type of traffic has to be processed by the router's &lt;em&gt;control plane&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In all cases, the Router will put more effort into delivering a packet through its data plane, as it does into processing a packet sent to its control plane.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, what can happen is at the moment of the Traceroute attempt, that particular router may be dealing with processing millions of other packets going THROUGH it, and won't bother itself with interrupting that process to process the packet going TO it. So the packet is simply discarded, and shows up in the traceroute as a missed hop *.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what SHOULD you concern yourself with when reading the traceroute?  Good question... read on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;3. What SHOULD you concern yourself with in a typical traceroute&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traceroute is best suited to detect and determine where latency exists in the end to end path.  But a single spike in latency usually means nothing. For example:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; 1     2 ms     2 ms     4 ms  gw.wireless.iqsalford.quintain.lan [10.222.208.1] &#xA; 2    14 ms     8 ms     8 ms  gw-vlan1577.man-xmr.tcw.ask4.net [78.109.190.225] &#xA; 3     6 ms     2 ms     3 ms  man-xmr-edge1-r1.tcw.ask4.net [81.23.63.237] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can look at the first result of hop 2, and see a jump to 14ms and think that was a big proportionate jump. But if you look at the response times for hop 3, you see 6ms, 2ms, and 3ms. Well, each of these 3 attempts went THROUGH the router at hop2, and if there were able to get TO hop 3, THROUGH 1 and 2, and back all in 2/3/6ms, you have no problems there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(note, this isn't the best example, because 14ms is still lighting fast, but it was the best example of it in the provided output).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you want to be concerned with is if you see a CONSISTENT increase in latency at a SPECIFIC hop where the response times increases throughout the rest of the traceroute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;HOWEVER&lt;/strong&gt;, sometimes the latency increase is expected, and perfectly normal. Specifically when you are crossing long WAN links.  For example:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; 6     8 ms    11 ms     8 ms  be2871.ccr42.lon13.atlas.cogentco.com [154.54.58.185] &#xA; 7   148 ms    83 ms    88 ms  be2490.ccr42.jfk02.atlas.cogentco.com [154.54.42.85] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here you are jumping from LON to JFK, across the Atlantic Ocean. The jump in latency is expected. Had this hop been between two routers in closer proximity, and because the latency increased persisted throughout the rest of the traceroute, this would have been reason for concern, and a good indication of latency at a particular router.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-02-21T03:43:18.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28032" PostTypeId="1" CreationDate="2016-02-21T04:15:19.610" Score="1" ViewCount="1494" Body="&lt;p&gt;I have two Cisco Nexus switches with EIGRP Routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 1: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SWITCH1(config-if)# sh run&#xA;&#xA;!Command: show running-config&#xA;!Time: Sun Feb 21 05:29:57 2016&#xA;&#xA;version 5.0(3)U5(1f)&#xA;no feature telnet&#xA;no telnet server enable&#xA;feature eigrp&#xA;feature interface-vlan&#xA;feature hsrp&#xA;feature lacp&#xA;feature dhcp&#xA;feature vtp&#xA;&#xA;username admin password 5 ####################################  role network-admin&#xA;no password strength-check&#xA;ip domain-lookup&#xA;hostname ALS-CORE-NX1&#xA;ipv6 access-list copp-system-acl-dhcpc6&#xA;  10 permit udp any any eq 546&#xA;ipv6 access-list copp-system-acl-dhcps6&#xA;  10 permit udp any ff02::0001:0002/128 eq 547&#xA;  20 permit udp any ff05::0001:0003/128 eq 547&#xA;ip access-list copp-system-acl-eigrp&#xA;  10 permit eigrp any 224.0.0.10/32&#xA;ipv6 access-list copp-system-acl-eigrp6&#xA;  10 permit 88 any ff02::000a/128&#xA;ip access-list copp-system-acl-icmp&#xA;  10 permit icmp any any&#xA;ip access-list copp-system-acl-igmp&#xA;  10 permit igmp any any&#xA;ip access-list copp-system-acl-ntp&#xA;  10 permit udp any any eq ntp&#xA;  20 permit udp any eq ntp any&#xA;ip access-list copp-system-acl-pimreg&#xA;  10 permit pim any any&#xA;ip access-list copp-system-acl-ping&#xA;  10 permit icmp any any echo&#xA;  20 permit icmp any any echo-reply&#xA;ip access-list copp-system-acl-routingproto1&#xA;  10 permit tcp any gt 1024 any eq bgp&#xA;  20 permit tcp any eq bgp any gt 1024&#xA;  30 permit udp any 224.0.0.0/24 eq rip&#xA;  40 permit tcp any gt 1024 any eq 639&#xA;  50 permit tcp any eq 639 any gt 1024&#xA;  70 permit ospf any any&#xA;  80 permit ospf any 224.0.0.5/32&#xA;  90 permit ospf any 224.0.0.6/32&#xA;ip access-list copp-system-acl-routingproto2&#xA;  10 permit udp any 224.0.0.0/24 eq 1985&#xA;  20 permit 112 any 224.0.0.0/24&#xA;ip access-list copp-system-acl-snmp&#xA;  10 permit udp any any eq snmp&#xA;  20 permit udp any any eq snmptrap&#xA;ip access-list copp-system-acl-ssh&#xA;  10 permit tcp any any eq 22&#xA;  20 permit tcp any eq 22 any&#xA;ip access-list copp-system-acl-stftp&#xA;  10 permit udp any any eq tftp&#xA;  20 permit udp any any eq 1758&#xA;  30 permit udp any eq tftp any&#xA;  40 permit udp any eq 1758 any&#xA;  50 permit tcp any any eq 115&#xA;  60 permit tcp any eq 115 any&#xA;ip access-list copp-system-acl-tacacsradius&#xA;  10 permit tcp any any eq tacacs&#xA;  20 permit tcp any eq tacacs any&#xA;  30 permit udp any any eq 1812&#xA;  40 permit udp any any eq 1813&#xA;  50 permit udp any any eq 1645&#xA;  60 permit udp any any eq 1646&#xA;  70 permit udp any eq 1812 any&#xA;  80 permit udp any eq 1813 any&#xA;  90 permit udp any eq 1645 any&#xA;  100 permit udp any eq 1646 any&#xA;ip access-list copp-system-acl-telnet&#xA;  10 permit tcp any any eq telnet&#xA;  20 permit tcp any any eq 107&#xA;  30 permit tcp any eq telnet any&#xA;  40 permit tcp any eq 107 any&#xA;ipv6 access-list copp-system-acl-v6routingProto2&#xA;  10 permit udp any ff02::0066/128 eq 2029&#xA;  20 permit udp any ff02::00fb/128 eq 5353&#xA;ipv6 access-list copp-system-acl-v6routingproto1&#xA;  10 permit 89 any ff02::0005/128&#xA;  20 permit 89 any ff02::0006/128&#xA;  30 permit udp any ff02::0009/128 eq 521&#xA;ip access-list copp-system-dhcp-relay&#xA;  10 permit udp any eq bootps any eq bootps&#xA;ip access-list customer-acl&#xA;  10 permit ip 10.0.23.0/24 any&#xA;  20 deny ip 10.0.0.0/8 any&#xA;  30 permit ip any any&#xA;class-map type qos class-fcoe&#xA;class-map type queuing class-fcoe&#xA;  match qos-group 1&#xA;class-map type queuing class-all-flood&#xA;  match qos-group 2&#xA;class-map type queuing class-ip-multicast&#xA;  match qos-group 2&#xA;class-map type network-qos class-fcoe&#xA;  match qos-group 1&#xA;class-map type network-qos class-all-flood&#xA;  match qos-group 2&#xA;class-map type network-qos class-ip-multicast&#xA;  match qos-group 2&#xA;class-map type control-plane match-any copp-icmp&#xA;  match access-group name copp-system-acl-icmp&#xA;class-map type control-plane match-any copp-ntp&#xA;  match access-group name copp-system-acl-ntp&#xA;class-map type control-plane match-any copp-s-arp&#xA;class-map type control-plane match-any copp-s-bfd&#xA;class-map type control-plane match-any copp-s-bpdu&#xA;class-map type control-plane match-any copp-s-dai&#xA;class-map type control-plane match-any copp-s-default&#xA;class-map type control-plane match-any copp-s-dhcpreq&#xA;  match access-group name copp-system-acl-dhcps6&#xA;class-map type control-plane match-any copp-s-dhcpresp&#xA;  match access-group name copp-system-acl-dhcpc6&#xA;  match access-group name copp-system-dhcp-relay&#xA;class-map type control-plane match-any copp-s-eigrp&#xA;  match access-group name copp-system-acl-eigrp&#xA;  match access-group name copp-system-acl-eigrp6&#xA;class-map type control-plane match-any copp-s-glean&#xA;class-map type control-plane match-any copp-s-igmp&#xA;  match access-group name copp-system-acl-igmp&#xA;class-map type control-plane match-any copp-s-ipmcmiss&#xA;class-map type control-plane match-any copp-s-l2switched&#xA;class-map type control-plane match-any copp-s-l3destmiss&#xA;class-map type control-plane match-any copp-s-l3mtufail&#xA;class-map type control-plane match-any copp-s-l3slowpath&#xA;class-map type control-plane match-any copp-s-pimautorp&#xA;class-map type control-plane match-any copp-s-pimreg&#xA;  match access-group name copp-system-acl-pimreg&#xA;class-map type control-plane match-any copp-s-ping&#xA;  match access-group name copp-system-acl-ping&#xA;class-map type control-plane match-any copp-s-ptp&#xA;class-map type control-plane match-any copp-s-routingProto1&#xA;  match access-group name copp-system-acl-routingproto1&#xA;  match access-group name copp-system-acl-v6routingproto1&#xA;class-map type control-plane match-any copp-s-routingProto2&#xA;  match access-group name copp-system-acl-routingproto2&#xA;class-map type control-plane match-any copp-s-selfIp&#xA;class-map type control-plane match-any copp-s-ttl1&#xA;class-map type control-plane match-any copp-s-v6routingProto2&#xA;  match access-group name copp-system-acl-v6routingProto2&#xA;class-map type control-plane match-any copp-snmp&#xA;  match access-group name copp-system-acl-snmp&#xA;class-map type control-plane match-any copp-ssh&#xA;  match access-group name copp-system-acl-ssh&#xA;class-map type control-plane match-any copp-stftp&#xA;  match access-group name copp-system-acl-stftp&#xA;class-map type control-plane match-any copp-tacacsradius&#xA;  match access-group name copp-system-acl-tacacsradius&#xA;class-map type control-plane match-any copp-telnet&#xA;  match access-group name copp-system-acl-telnet&#xA;policy-map type control-plane copp-system-policy &#xA;  class copp-s-selfIp&#xA;    police pps 500 &#xA;  class copp-s-default&#xA;    police pps 400 &#xA;  class copp-s-l2switched&#xA;    police pps 200 &#xA;  class copp-s-ping&#xA;    police pps 100 &#xA;  class copp-s-l3destmiss&#xA;    police pps 100 &#xA;  class copp-s-glean&#xA;    police pps 500 &#xA;  class copp-s-l3mtufail&#xA;    police pps 100 &#xA;  class copp-s-ttl1&#xA;    police pps 100 &#xA;  class copp-s-ipmcmiss&#xA;    police pps 400 &#xA;  class copp-s-l3slowpath&#xA;    police pps 100 &#xA;  class copp-s-dhcpreq&#xA;    police pps 300 &#xA;  class copp-s-dhcpresp&#xA;    police pps 300 &#xA;  class copp-s-dai&#xA;    police pps 300 &#xA;  class copp-s-igmp&#xA;    police pps 400 &#xA;  class copp-s-eigrp&#xA;    police pps 200 &#xA;  class copp-s-pimreg&#xA;    police pps 200 &#xA;  class copp-s-pimautorp&#xA;    police pps 200 &#xA;  class copp-s-routingProto2&#xA;    police pps 4000 &#xA;  class copp-s-v6routingProto2&#xA;    police pps 1600 &#xA;  class copp-s-routingProto1&#xA;    police pps 4000 &#xA;  class copp-s-arp&#xA;    police pps 200 &#xA;  class copp-s-ptp&#xA;    police pps 1000 &#xA;  class copp-s-bfd&#xA;    police pps 350 &#xA;  class copp-s-bpdu&#xA;    police pps 6000 &#xA;  class copp-icmp&#xA;    police pps 200 &#xA;  class copp-telnet&#xA;    police pps 500 &#xA;  class copp-ssh&#xA;    police pps 500 &#xA;  class copp-snmp&#xA;    police pps 500 &#xA;  class copp-ntp&#xA;    police pps 100 &#xA;  class copp-tacacsradius&#xA;    police pps 400 &#xA;  class copp-stftp&#xA;    police pps 400 &#xA;control-plane&#xA;  service-policy input copp-system-policy &#xA;vtp mode transparent&#xA;vtp domain BASEVTP&#xA;hardware profile portmode 64x10G&#xA;snmp-server user admin network-admin auth md5 ################################# priv ################################# localizedkey&#xA;ntp server 10.1.3.20 use-vrf management&#xA;&#xA;vrf context management&#xA;  ip route 0.0.0.0/0 10.1.2.1 1&#xA;vlan 1-3&#xA;vlan 4&#xA;vlan 5&#xA;vlan 6&#xA;vlan 7&#xA;vlan 8&#xA;vlan 10&#xA;vlan 23&#xA;vlan 24&#xA;vlan 25&#xA;vlan 28&#xA;vlan 40&#xA;vlan 41&#xA;vlan 42&#xA;vlan 43&#xA;vlan 44&#xA;vlan 45&#xA;vlan 46&#xA;vlan 47&#xA;vlan 48&#xA;vlan 49&#xA;vlan 50&#xA;vlan 51&#xA;vlan 53&#xA;vlan 54&#xA;vlan 60&#xA;vlan 61-64&#xA;vlan 100&#xA;vlan 101&#xA;vlan 200&#xA;vlan 256-257&#xA;service dhcp&#xA;ip dhcp relay&#xA;&#xA;&#xA;interface Vlan1&#xA;  ip address 10.0.1.3/24&#xA;  no shutdown&#xA;  bandwidth 500&#xA;&#xA;interface Vlan2&#xA;  ip address 10.1.2.2/24&#xA;  no shutdown&#xA;  bandwidth 500&#xA;&#xA;interface Vlan4&#xA;  ip address 10.1.4.2/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.1.4.1 &#xA;  no shutdown&#xA;&#xA;interface Ethernet1/1&#xA;  switchport access vlan 2&#xA;  speed 1000&#xA;&#xA;interface Ethernet1/2&#xA;  no switchport&#xA;  ip address 172.16.1.1/24&#xA;  ip router eigrp CORE&#xA;&#xA;interface Ethernet1/3&#xA;&#xA;interface Ethernet1/4&#xA;&#xA;interface Ethernet1/5&#xA;&#xA;interface Ethernet1/6&#xA;&#xA;interface Ethernet1/7&#xA;&#xA;interface Ethernet1/8&#xA;&#xA;interface Ethernet1/9&#xA;&#xA;interface Ethernet1/10&#xA;&#xA;interface Ethernet1/11&#xA;  switchport mode trunk&#xA;&#xA;interface Ethernet1/12&#xA;&#xA;interface Ethernet1/13&#xA;&#xA;interface Ethernet1/14&#xA;&#xA;interface Ethernet1/15&#xA;&#xA;interface Ethernet1/16&#xA;&#xA;interface Ethernet1/17&#xA;&#xA;interface Ethernet1/18&#xA;&#xA;interface Ethernet1/19&#xA;&#xA;interface Ethernet1/20&#xA;&#xA;interface Ethernet1/21&#xA;&#xA;interface Ethernet1/22&#xA;&#xA;interface Ethernet1/23&#xA;&#xA;interface Ethernet1/24&#xA;&#xA;interface Ethernet1/25&#xA;&#xA;interface Ethernet1/26&#xA;&#xA;interface Ethernet1/27&#xA;&#xA;interface Ethernet1/28&#xA;&#xA;interface Ethernet1/29&#xA;  switchport access vlan 7&#xA;&#xA;interface Ethernet1/30&#xA;&#xA;interface Ethernet1/31&#xA;&#xA;interface Ethernet1/32&#xA;&#xA;interface Ethernet1/33&#xA;&#xA;interface Ethernet1/34&#xA;&#xA;interface Ethernet1/35&#xA;&#xA;interface Ethernet1/36&#xA;&#xA;interface Ethernet1/37&#xA;&#xA;interface Ethernet1/38&#xA;&#xA;interface Ethernet1/39&#xA;&#xA;interface Ethernet1/40&#xA;&#xA;interface Ethernet1/41&#xA;&#xA;interface Ethernet1/42&#xA;&#xA;interface Ethernet1/43&#xA;&#xA;interface Ethernet1/44&#xA;&#xA;interface Ethernet1/45&#xA;&#xA;interface Ethernet1/46&#xA;&#xA;interface Ethernet1/47&#xA;&#xA;interface Ethernet1/48&#xA;&#xA;interface Ethernet1/49/1&#xA;&#xA;interface Ethernet1/49/2&#xA;&#xA;interface Ethernet1/49/3&#xA;&#xA;interface Ethernet1/49/4&#xA;&#xA;interface Ethernet1/50/1&#xA;&#xA;interface Ethernet1/50/2&#xA;&#xA;interface Ethernet1/50/3&#xA;&#xA;interface Ethernet1/50/4&#xA;&#xA;interface Ethernet1/51/1&#xA;&#xA;interface Ethernet1/51/2&#xA;&#xA;interface Ethernet1/51/3&#xA;&#xA;interface Ethernet1/51/4&#xA;&#xA;interface Ethernet1/52/1&#xA;&#xA;interface Ethernet1/52/2&#xA;&#xA;interface Ethernet1/52/3&#xA;&#xA;interface Ethernet1/52/4&#xA;&#xA;interface mgmt0&#xA;  ip address 10.1.2.30/24&#xA;line console&#xA;line vty&#xA;boot kickstart bootflash:/n3000-uk9-kickstart.5.0.3.U5.1f.bin &#xA;boot system bootflash:/n3000-uk9.5.0.3.U5.1f.bin &#xA;router eigrp CORE&#xA;  address-family ipv4 unicast&#xA;    autonomous-system 3&#xA;    redistribute direct route-map default&#xA;ip eigrp event-history errors&#xA;ip eigrp event-history cli size small&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SWITCH2# sh run&#xA;&#xA;!Command: show running-config&#xA;!Time: Sun Feb 21 05:32:01 2016&#xA;&#xA;version 5.1(3)N2(1)&#xA;hostname SWITCH2#&#xA;&#xA;no feature telnet&#xA;feature eigrp&#xA;feature interface-vlan&#xA;feature hsrp&#xA;feature lacp&#xA;feature dhcp&#xA;feature lldp&#xA;feature vtp&#xA;&#xA;username admin password 5 ####################################  role network-admin&#xA;ip domain-lookup&#xA;ip access-list customer-acl&#xA;  10 permit ip 10.0.23.0/24 any&#xA;  20 deny ip 10.0.0.0/8 any&#xA;  30 permit ip any any&#xA;class-map type qos class-fcoe&#xA;class-map type queuing class-fcoe&#xA;  match qos-group 1&#xA;class-map type queuing class-all-flood&#xA;  match qos-group 2&#xA;class-map type queuing class-ip-multicast&#xA;  match qos-group 2&#xA;class-map type network-qos class-fcoe&#xA;  match qos-group 1&#xA;class-map type network-qos class-all-flood&#xA;  match qos-group 2&#xA;class-map type network-qos class-ip-multicast&#xA;  match qos-group 2&#xA;snmp-server user admin network-admin auth md5 #################################### priv #################################### localizedkey&#xA;ntp server 10.1.3.20 use-vrf management&#xA;&#xA;vrf context management&#xA;  ip route 0.0.0.0/0 10.1.2.1 1&#xA;  ip route 0.0.0.0/0 10.1.5.1&#xA;vlan configuration 8&#xA;route-map COREMAP permit 10&#xA;service dhcp&#xA;ip dhcp relay&#xA;&#xA;&#xA;interface Vlan1&#xA;  no shutdown&#xA;  bandwidth 500&#xA;  ip address 10.0.1.1/24&#xA;&#xA;interface Vlan2&#xA;  no shutdown&#xA;  ip address 10.1.2.1/24&#xA;&#xA;interface Vlan3&#xA;  no shutdown&#xA;  ip address 10.1.3.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.1.3.1 &#xA;&#xA;interface Vlan4&#xA;  no shutdown&#xA;  ip address 10.1.4.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.1.4.1 &#xA;&#xA;interface Vlan5&#xA;  no shutdown&#xA;  ip address 10.1.5.3/24&#xA;  hsrp 5 &#xA;    timers  1  3&#xA;    ip 10.1.5.1 &#xA;  ip dhcp relay address 10.0.23.11 &#xA;&#xA;interface Vlan6&#xA;  no shutdown&#xA;  ip address 10.1.6.3/24&#xA;  hsrp 6 &#xA;    timers  1  3&#xA;    ip 10.1.6.1 &#xA;&#xA;interface Vlan7&#xA;  no shutdown&#xA;  ip address 10.1.7.3/24&#xA;  hsrp 1 &#xA;    timers  1  3&#xA;    ip 10.1.7.1 &#xA;&#xA;interface Vlan8&#xA;  no shutdown&#xA;  ip address 10.1.8.1/24&#xA;  ip arp 10.1.8.50 03BF.0A01.0832&#xA;&#xA;interface Vlan9&#xA;  no shutdown&#xA;  ip address 10.0.9.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.9.1 &#xA;&#xA;interface Vlan10&#xA;  no shutdown&#xA;  ip address 10.0.10.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.10.1 &#xA;&#xA;interface Vlan20&#xA;  no shutdown&#xA;  ip address 10.0.20.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.20.1 &#xA;&#xA;interface Vlan21&#xA;  no shutdown&#xA;  ip address 10.0.21.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.21.1 &#xA;&#xA;interface Vlan22&#xA;  no shutdown&#xA;  ip address 10.0.22.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.22.1 &#xA;&#xA;interface Vlan23&#xA;  no shutdown&#xA;  ip address 10.0.23.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.23.1 &#xA;&#xA;interface Vlan24&#xA;  no shutdown&#xA;  ip address 10.0.24.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.24.1 &#xA;&#xA;interface Vlan25&#xA;  no shutdown&#xA;  ip address 10.0.25.3/24&#xA;  hsrp 7 &#xA;    preempt &#xA;    timers  1  3&#xA;    ip 10.0.25.1 &#xA;&#xA;interface Vlan26&#xA;  no shutdown&#xA;  ip address 10.0.26.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.26.1 &#xA;&#xA;interface Vlan27&#xA;  no shutdown&#xA;  ip address 10.0.27.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.27.1 &#xA;&#xA;interface Vlan28&#xA;  no shutdown&#xA;  ip address 10.0.28.3/24&#xA;  hsrp 1 &#xA;    timers  1  3&#xA;    ip 10.0.28.1 &#xA;&#xA;interface Vlan40&#xA;  no shutdown&#xA;  ip address 10.0.40.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.40.1 &#xA;&#xA;interface Vlan41&#xA;  no shutdown&#xA;  ip address 10.0.41.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.41.1 &#xA;&#xA;interface Vlan42&#xA;  no shutdown&#xA;  ip address 10.0.42.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.42.1 &#xA;&#xA;interface Vlan43&#xA;  no shutdown&#xA;  ip address 10.0.43.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.43.1 &#xA;&#xA;interface Vlan44&#xA;  no shutdown&#xA;  ip address 10.0.44.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.44.1 &#xA;&#xA;interface Vlan45&#xA;  no shutdown&#xA;  ip address 10.0.45.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.45.1 &#xA;&#xA;interface Vlan46&#xA;  no shutdown&#xA;  ip address 10.0.46.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.46.1 &#xA;&#xA;interface Vlan47&#xA;  no shutdown&#xA;  ip address 10.0.47.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.47.1 &#xA;&#xA;interface Vlan48&#xA;  no shutdown&#xA;  ip address 10.0.48.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.48.1 &#xA;&#xA;interface Vlan49&#xA;  no shutdown&#xA;  ip address 10.0.49.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.49.1 &#xA;&#xA;interface Vlan50&#xA;  no shutdown&#xA;  ip address 10.0.50.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.50.1 &#xA;&#xA;interface Vlan53&#xA;  no shutdown&#xA;  ip access-group customer-acl out&#xA;  ip address 10.0.53.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.53.1 &#xA;&#xA;interface Vlan54&#xA;  no shutdown&#xA;  ip address 10.0.54.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.54.1 &#xA;&#xA;interface Vlan60&#xA;  no shutdown&#xA;  ip access-group customer-acl out&#xA;  ip address 10.0.60.3/24&#xA;  hsrp 1 &#xA;    ip 10.0.60.1 &#xA;&#xA;interface Vlan61&#xA;  no shutdown&#xA;  ip access-group customer-acl out&#xA;  ip address 10.0.61.3/24&#xA;  hsrp 1 &#xA;    ip 10.0.61.1 &#xA;&#xA;interface Vlan62&#xA;  no shutdown&#xA;  ip access-group customer-acl out&#xA;  ip address 10.0.62.3/24&#xA;  hsrp 1 &#xA;    ip 10.0.62.1 &#xA;&#xA;interface Vlan63&#xA;  no shutdown&#xA;  ip access-group customer-acl out&#xA;  ip address 10.0.63.3/24&#xA;  hsrp 1 &#xA;    ip 10.0.63.1 &#xA;&#xA;interface Vlan64&#xA;  no shutdown&#xA;  ip access-group customer-acl out&#xA;  ip address 10.0.64.3/24&#xA;  hsrp 1 &#xA;    timers  1  3&#xA;    ip 10.0.64.1 &#xA;&#xA;interface Vlan100&#xA;  no shutdown&#xA;  ip address 10.0.100.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.100.1 &#xA;&#xA;interface Vlan101&#xA;  no shutdown&#xA;  ip address 10.0.101.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.0.101.1 &#xA;&#xA;interface Vlan311&#xA;  no shutdown&#xA;  ip address 10.3.11.3/24&#xA;  hsrp 7 &#xA;    timers  1  3&#xA;    ip 10.3.11.1 &#xA;&#xA;interface port-channel1&#xA;  switchport access vlan 7&#xA;  speed 10000&#xA;&#xA;interface port-channel2&#xA;  switchport access vlan 7&#xA;  speed 10000&#xA;&#xA;interface port-channel3&#xA;  switchport access vlan 7&#xA;  speed 10000&#xA;&#xA;interface port-channel4&#xA;  switchport access vlan 7&#xA;  speed 10000&#xA;&#xA;interface port-channel5&#xA;  switchport access vlan 7&#xA;  speed 10000&#xA;&#xA;interface Ethernet1/1&#xA;  switchport access vlan 2&#xA;  speed 1000&#xA;&#xA;interface Ethernet1/2&#xA;  no switchport&#xA;  ip address 172.16.1.2/24&#xA;  ip router eigrp CORE&#xA;&#xA;interface Ethernet1/3&#xA;&#xA;interface Ethernet1/4&#xA;&#xA;interface Ethernet1/5&#xA;&#xA;interface Ethernet1/6&#xA;&#xA;interface Ethernet1/7&#xA;&#xA;interface Ethernet1/8&#xA;&#xA;interface Ethernet1/9&#xA;  switchport mode trunk&#xA;&#xA;interface Ethernet1/10&#xA;  switchport mode trunk&#xA;&#xA;interface Ethernet1/11&#xA;  switchport mode trunk&#xA;&#xA;interface Ethernet1/12&#xA;  switchport mode trunk&#xA;&#xA;interface Ethernet1/13&#xA;  switchport mode trunk&#xA;&#xA;interface Ethernet1/14&#xA;  switchport mode trunk&#xA;&#xA;interface Ethernet1/15&#xA;  switchport access vlan 7&#xA;  channel-group 4 mode active&#xA;&#xA;interface Ethernet1/16&#xA;  switchport access vlan 7&#xA;  channel-group 4 mode active&#xA;&#xA;interface Ethernet1/17&#xA;  switchport access vlan 7&#xA;  channel-group 5 mode active&#xA;&#xA;interface Ethernet1/18&#xA;  switchport access vlan 7&#xA;  channel-group 5 mode active&#xA;&#xA;interface Ethernet1/19&#xA;&#xA;interface Ethernet1/20&#xA;&#xA;interface Ethernet1/21&#xA;  switchport access vlan 2&#xA;  speed 1000&#xA;&#xA;interface Ethernet1/22&#xA;&#xA;interface Ethernet1/23&#xA;&#xA;interface Ethernet1/24&#xA;&#xA;interface Ethernet1/25&#xA;&#xA;interface Ethernet1/26&#xA;&#xA;interface Ethernet1/27&#xA;  switchport access vlan 7&#xA;  channel-group 2 mode active&#xA;&#xA;interface Ethernet1/28&#xA;  switchport access vlan 7&#xA;  channel-group 2 mode active&#xA;&#xA;interface Ethernet1/29&#xA;  switchport access vlan 7&#xA;  channel-group 1 mode active&#xA;&#xA;interface Ethernet1/30&#xA;  switchport access vlan 7&#xA;  channel-group 1 mode active&#xA;&#xA;interface Ethernet1/31&#xA;  switchport mode trunk&#xA;  speed 1000&#xA;&#xA;interface Ethernet1/32&#xA;  switchport mode trunk&#xA;  speed 1000&#xA;&#xA;interface mgmt0&#xA;  ip address 10.1.2.15/24&#xA;line console&#xA;line vty&#xA;boot kickstart bootflash:/n5000-uk9-kickstart.5.1.3.N2.1.bin&#xA;boot system bootflash:/n5000-uk9.5.1.3.N2.1.bin &#xA;router eigrp CORE&#xA;  address-family ipv4 unicast&#xA;    autonomous-system 3&#xA;    redistribute direct route-map default&#xA;    redistribute static route-map default&#xA;ip route 0.0.0.0/0 10.1.2.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Part of logs (truncated for question length limit):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2016 Feb 21 03:53:40.741490 eigrp: CORE [9196] (default-base)  DUAL: Removing dest 10.0.1.0/24, nexthop 172.16.1.1&#xA;2016 Feb 21 03:53:40.741506 eigrp: CORE [9196] (default-base) ipigrp2_urib_rtuninstall: 10.0.1.0/24 via 172.16.1.1 not in urib, not sent to urib, del pending &#xA;2016 Feb 21 03:53:40.741520 eigrp: CORE [9196] (default-base)    Found serno 10&#xA;2016 Feb 21 03:53:40.741533 eigrp: CORE [9196] (default-base) ipigrp2_rtdelete L1963: 10.1.2.0/24 via 172.16.1.1&#xA;2016 Feb 21 03:53:40.741547 eigrp: CORE [9196] (default-base) ipigrp2_urib_rtuninstall: 10.1.2.0/24 via 172.16.1.1 not in urib, not sent to urib, del pending &#xA;2016 Feb 21 03:53:40.741563 eigrp: CORE [9196] (default-base)  DUAL: Removing dest 10.1.2.0/24, nexthop 172.16.1.1&#xA;2016 Feb 21 03:53:40.741578 eigrp: CORE [9196] (default-base) ipigrp2_urib_rtuninstall: 10.1.2.0/24 via 172.16.1.1 not in urib, not sent to urib, del pending &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the end, it looks like EIGRP doesn't like something and removes the incoming route advertisements, and my google-fu has not yielded anything that points me in the right direction. &#xA;I have yet to configure any authentication, to make the setup simple for the moment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="23084" LastEditorUserId="23084" LastEditDate="2016-02-21T05:42:50.963" LastActivityDate="2016-07-19T21:50:55.767" Title="Cisco Nexus 5k EIGRP Configuration" Tags="|routing|router|eigrp|cisco-nexus-5k|cisco-nx-os|" AnswerCount="1" CommentCount="18" ContentLicense="CC BY-SA 3.0" />
  <row Id="28033" PostTypeId="1" CreationDate="2016-02-21T04:56:53.427" Score="1" ViewCount="1959" Body="&lt;p&gt;I own a Hewlett-Pacard &lt;strong&gt;ProCurve 2650&lt;/strong&gt; switch. I want to switch on power-over-ethernet on one of the ports. I have no idea how to do it, so my question is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does the 2650 support &lt;strong&gt;PoE&lt;/strong&gt;?&lt;/li&gt;&#xA;&lt;li&gt;How do I enable it using CLI?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;(I know the answer might be very easy, but bear with me).&lt;/p&gt;&#xA;" OwnerUserId="15440" LastActivityDate="2017-12-27T22:26:43.860" Title="How to enable PoE on HP ProCurve 2650" Tags="|ethernet|hp-procurve|cli|power-over-ethernet|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28034" PostTypeId="1" CreationDate="2016-02-21T06:36:07.503" Score="1" ViewCount="92" Body="&lt;p&gt;I am developing an SMS based system, and I was asked if the cell phone model has a significant effect on the arrival time of the SMS. Although, I'm a bit sure it doesn't because of my testing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tested my system on different phone models, from old phones to smart phones, and the SMS arrives on time almost instantly. Although, it would still be nice to have some real proof if it affects, or not, the arrival time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I googled this, but it just resulted in how cell phone and SMS work. &lt;/p&gt;&#xA;" OwnerUserId="23085" LastEditorUserId="8499" LastEditDate="2016-03-22T23:24:33.253" LastActivityDate="2016-07-21T12:30:28.643" Title="Does the cell phone model affect the arrival time of SMS" Tags="|wireless|mobile|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28036" PostTypeId="2" ParentId="27901" CreationDate="2016-02-21T08:43:03.170" Score="0" Body="&lt;p&gt;After a lot of investigations to tcp injection tools,&#xA;I found that SCAPY is the best one which helped me to inject the options i need into the tcp header.&lt;/p&gt;&#xA;" OwnerUserId="22990" LastActivityDate="2016-02-21T08:43:03.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28038" PostTypeId="1" AcceptedAnswerId="28039" CreationDate="2016-02-21T10:33:22.077" Score="1" ViewCount="630" Body="&lt;p&gt;I appreciate there is an answer&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1037/vlan-and-subnet-relationship&quot;&gt; here &lt;/a&gt; already. As well as reading this and seeing this &lt;a href=&quot;https://www.youtube.com/watch?v=twYeSRvdEtc&quot; rel=&quot;nofollow noreferrer&quot;&gt;video&lt;/a&gt; I am still slightly confused...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a company has 2 offices (on the same floor in close proximity of each other)&#xA;Office one (Marketing) and office two (Finance) both have 5 computers and share 1 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand I can set up a VLAN to separate traffic for the 2 departments so each dept only receives 'their' own packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I still don't understand is subnetting - &#xA;If I setup a subnet of 255.255.255.0 on that switch does that mean the IP address for each dept is different? E.g. 192.168.1.x = Marketing Computers &amp;amp; 192.168.2.x = Finance Computers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OR as the subnet is set-up on the switch the 3rd octet of the IP address of both offices will be the same?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Will 2 separate switches be better?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="22706" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-02-21T10:52:49.293" Title="VLAN and Subnet relationship with 2 offices sharing a switch" Tags="|switch|vlan|subnet|ip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28039" PostTypeId="2" ParentId="28038" CreationDate="2016-02-21T10:52:49.293" Score="0" Body="&lt;p&gt;You may be confusing things. With a switch, only the host for which a packet is destined will receive that packet. Switches know nothing about layer-3 (IP packets). The packets are encapsulated inside layer-2 frames when sent to a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch is a layer-2 device, and it switches layer-2 frames based on the layer-2 (MAC address). The switch will learn the MAC address of each host, and to which port each host is connected. It will deliver a frame to the port on which the destination host is connected. The only frames which are delivered to all ports are the frames for which the switch doesn't know the port (it learns every time a host sends a frame), or broadcast frames (a switch, or multiple switches connected to each other, with a single VLAN is a single broadcast domain), which ARP uses to resolve the layer-3 (IP) address to a layer-2 (MAC) address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs allow you to break up the broadcast domain. Your small network shouldn't be suffering from excessive broadcasts unless there is a malfunctioning host. If a host on one VLAN needs to contact a host on a different VLAN is must go through a router. Routers switch at layer-3 (IP packets) between different networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as subnetting, you should read &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;this answer&lt;/a&gt;, which has everything you need to know about that.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-02-21T10:52:49.293" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28044" PostTypeId="2" ParentId="20358" CreationDate="2016-02-21T15:16:45.063" Score="4" Body="&lt;p&gt;I think this is a situation where you need to get someone who knows what they are doing in to advise. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One ethernet port can have plenty of capacity, that isn't a problem per-se but there are many things that need to be thought about in a situation like this and your question makes me suspect you are in over your head.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off what does that &quot;one port&quot; connect to? is it connected to a network that hands out public IPs and is open to the internet or is it behind some sort of firewall/nat? Is this in a building where you already have offices? if so is the port routed back to your existing network or to somewhere else? is the network open to anyone else you don't trust? Depending on the answers to your questions you may or may not want to put your own firewall/NAT between the port and your device. If the port is a new (to you) connection to the internet how much bandwidth to the internet is actually available? is it sufficient for your needs or do you need to order a new connection to the building from an ISP? if so how cooperative will the building owners be with you doing that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly once you've figured that out you need to figure out how you are going to distribute your network around the office. I would reccomend against a purely wireless setup, while it can work if the radio spectrum is queit and load is low there are no gaurantees. Clearly for a wired soloution you will need an ethernet switch (possiblly behind a router or firewall of some sort as per the previous paragraph) but you also need to think about how you are going to get cables from that switch to your devices. Are you buying this office or renting it? If the former will the landlord let you install cabling round the office? Do the cables need to pass through any fire barriers? if so do you know what the local regulations are for such barriers?&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-02-21T15:27:08.630" LastActivityDate="2016-02-21T15:27:08.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28045" PostTypeId="1" AcceptedAnswerId="28046" CreationDate="2016-02-21T17:11:02.437" Score="2" ViewCount="599" Body="&lt;p&gt;I need suggestion related this issue. We are getting DDoS every two days and its small DDoS last for 5 to 10 min. but sometime its longer in that case we call ISP and they &lt;code&gt;null&lt;/code&gt; route specific targeted IP for sometime and we moved service to new IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now question is, is it possible we setup private BGP with our ISP and we do null route from our router so it trigger &lt;code&gt;blackhole null&lt;/code&gt; route on ISP route? In short we need control of doing null routing, calling every time ISP isn't good solution because sometime they are busy then we have to wait in line. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone suggest what we should do?  We are small company and can't effort buying outside service to scrub DDoS they are expensive. &lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-02-21T17:13:51.297" Title="BGP null route when DDoS?" Tags="|cisco|bgp|isp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28046" PostTypeId="2" ParentId="28045" CreationDate="2016-02-21T17:13:51.297" Score="7" Body="&lt;p&gt;The only answer we can give you is 'talk to your ISP'. Remotely triggered blackholing (RTBH) is an often used technique, but we can't tell if your ISP supports this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using RTBH, you can announce to your upstream which target IP's should be blackholed, either over a dedicated BGP sessions or by tagging target prefixes with a specific community.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-02-21T17:13:51.297" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28049" PostTypeId="2" ParentId="28034" CreationDate="2016-02-21T19:46:08.910" Score="1" Body="&lt;p&gt;When SMS messages are delivered depends on the carrier, not the device to which the messages are delivered. When a cell tower sends something to a phone, the phone gets it right away. The antenna is layer-1, but the message is in an upper-layer. Does the antenna type affect how soon voice traffic is sent to the phone? No. That could cause a delay in the conversation on the handset. The real source of delays are in the carrier(s), and/or PSTN, network(s).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-21T19:46:08.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28050" PostTypeId="1" CreationDate="2016-02-21T23:39:10.833" Score="2" ViewCount="2323" Body="&lt;p&gt;Can some tell me what for monitoring optical power on my 7200 series router .&#xA;The interface has a SFP 1000BASE-LX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sh int gig0/0 transceiver ,doesnt give me the required information( Optical power in dBm)&lt;/p&gt;&#xA;" OwnerUserId="450" LastEditorUserId="450" LastEditDate="2016-02-21T23:46:11.243" LastActivityDate="2016-02-22T00:09:03.973" Title="Cisco Digital Optical Monitoring Command" Tags="|cisco-commands|optics|optical|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28051" PostTypeId="2" ParentId="28050" CreationDate="2016-02-21T23:54:49.530" Score="1" Body="&lt;p&gt;You will need the part number to determine SFP compatibility. This is from &#xA;&lt;a href=&quot;https://supportforums.cisco.com/document/75181/digital-optical-monitoring-dom&quot; rel=&quot;nofollow&quot;&gt;Digital Optical Monitoring - DOM&lt;/a&gt;, which has a link to the compatibility matrix:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;DOM Support on Cisco Transeivers&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Not all transceivers support DOM, a list of capable transceivers is&#xA;  available at:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/interfaces_modules/transceiver_modules/compatibility/matrix/OL_8031.html&quot; rel=&quot;nofollow&quot;&gt;DOM compability Matrix&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;How to use DOM&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Following command can be used to turn on/off DOM for all transceivers&#xA;  type in the system&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)#transceiver type all&#xA;Router(config-xcvr-type)#monitoring&#xA;Router(config-xcvr-type)#end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Once enabled, DOM can be accessed via CLI using &lt;code&gt;show interface transceiver&lt;/code&gt; command&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-22T00:09:03.973" LastActivityDate="2016-02-22T00:09:03.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28053" PostTypeId="1" AcceptedAnswerId="44397" CreationDate="2016-02-22T01:08:07.060" Score="1" ViewCount="130" Body="&lt;p&gt;Does somebody have experience with the &lt;a href=&quot;http://euro.dell.com/eu/en/gen/networking/pwcnt_6248/pd.aspx?refid=pwcnt_6248&amp;amp;s=gen&quot; rel=&quot;nofollow&quot;&gt;Dell PowerConnect 6248&lt;/a&gt; for the datacenter usage with high traffic? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it run stable and can it passthrough 10gbit? How is your performance experience?&lt;/p&gt;&#xA;" OwnerUserId="23010" LastActivityDate="2017-09-23T00:05:18.393" Title="Dell PowerConnect 6248 experience" Tags="|switch|dell|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28054" PostTypeId="1" CreationDate="2016-02-22T01:08:09.083" Score="1" ViewCount="1316" Body="&lt;p&gt;How does the sequence number at the destination node change? Does it become max of seq of RREQ in its current sequence number, or does the dst node increment sequence number by one? Please give an example!! &lt;/p&gt;&#xA;" OwnerUserId="23104" LastEditorUserId="8499" LastEditDate="2016-03-23T04:06:42.087" LastActivityDate="2018-03-13T17:53:59.853" Title="Sequence number in AODV" Tags="|routing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28055" PostTypeId="2" ParentId="28054" CreationDate="2016-02-22T01:15:57.483" Score="1" Body="&lt;p&gt;It is spelled out in &lt;a href=&quot;https://www.ietf.org/rfc/rfc3561.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 3561&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;6.1. Maintaining Sequence Numbers&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Every route table entry at every node MUST include the latest&#xA;  information available about the sequence number for the IP address of &#xA;  the destination node for which the route table entry is maintained. &#xA;  This sequence number is called the &quot;destination sequence number&quot;. It &#xA;  is updated whenever a node receives new (i.e., not stale) information &#xA;  about the sequence number from RREQ, RREP, or RERR messages that may &#xA;  be received related to that destination.  AODV depends on each node &#xA;  in the network to own and maintain its destination sequence number to &#xA;  guarantee the loop-freedom of all routes towards that node. A &#xA;  destination node increments its own sequence number in two &#xA;  circumstances:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Immediately before a node originates a route discovery, it MUST&#xA;    increment its own sequence number.  This prevents conflicts with&#xA;    previously established reverse routes towards the originator of a&#xA;    RREQ.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Immediately before a destination node originates a RREP in&#xA;    response to a RREQ, it MUST update its own sequence number to the&#xA;    maximum of its current sequence number and the destination&#xA;    sequence number in the RREQ packet.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;When the destination increments its sequence number, it MUST do so&#xA;  by treating the sequence number value as if it were an unsigned&#xA;  number. To accomplish sequence number rollover, if the sequence&#xA;  number has already been assigned to be the largest possible number&#xA;  representable as a 32-bit unsigned integer (i.e., 4294967295), then&#xA;  when it is incremented it will then have a value of zero (0). On&#xA;  the other hand, if the sequence number currently has the value&#xA;  2147483647, which is the largest possible positive integer if 2's&#xA;  complement arithmetic is in use with 32-bit integers, the next&#xA;  value will be 2147483648, which is the most negative possible&#xA;  integer in the same numbering system. The representation of&#xA;  negative numbers is not relevant to the increment of AODV sequence&#xA;  numbers.  This is in contrast to the manner in which the result of&#xA;  comparing two AODV sequence numbers is to be treated (see below).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In order to ascertain that information about a destination is not&#xA;  stale, the node compares its current numerical value for the sequence&#xA;  number with that obtained from the incoming AODV message. This&#xA;  comparison MUST be done using signed 32-bit arithmetic, this is&#xA;  necessary to accomplish sequence number rollover. If the result of&#xA;  subtracting the currently stored sequence number from the value of&#xA;  the incoming sequence number is less than zero, then the information&#xA;  related to that destination in the AODV message MUST be discarded, &#xA;  since that information is stale compared to the node's currently &#xA;  stored information.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The only other circumstance in which a node may change the&#xA;  destination sequence number in one of its route table entries is in&#xA;  response to a lost or expired link to the next hop towards that&#xA;  destination.  The node determines which destinations use a particular&#xA;  next hop by consulting its routing table. In this case, for each&#xA;  destination that uses the next hop, the node increments the sequence&#xA;  number and marks the route as invalid (see also sections 6.11, 6.12).&#xA;  Whenever any fresh enough (i.e., containing a sequence number at&#xA;  least equal to the recorded sequence number) routing information for&#xA;  an affected destination is received by a node that has marked that &#xA;  route table entry as invalid, the node SHOULD update its route table&#xA;  information according to the information contained in the update. A&#xA;  node may change the sequence number in the routing table entry of a&#xA;  destination only if:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;it is itself the destination node, and offers a new route to&#xA;    itself, or&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;it receives an AODV message with new information about the&#xA;    sequence number for a destination node, or&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;the path towards the destination node expires or breaks.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-22T01:22:16.387" LastActivityDate="2016-02-22T01:22:16.387" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28056" PostTypeId="1" CreationDate="2016-02-22T01:54:52.207" Score="2" ViewCount="11712" Body="&lt;p&gt;I am having trouble configuring pfSense to accept the OSPF routing tables of attached routers.  Any advice would be appreciated! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have installed the Quagga OSPFd package, but I am not certain it is configured correctly at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All OSPF tables are being updated and shared amongst all connected routers.  It is just the final hop between the last router and pfSense.  The directly connected router is capable of pinging pfSense, and pfSense is capable of pinging the routers.  However, none of the other routers are able to receive a response if they ping the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am happy to go either one of two directions: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Find a way for the directly connected router to share all of its routing information with pfSense, and exclude pfSense from OSPF.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure OSPF on pfSense.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Note: If it would be helpful, I can screenshot in some pfSense information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is the code from Router2 which is directly attached to pfSense:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description PrimaryWANDesc_&#xA; ip address 192.168.200.5 255.255.255.252&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.13.115 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router ospf 10&#xA; network 150.10.93.0 0.0.0.255 area 0&#xA; network 192.168.13.0 0.0.0.255 area 0&#xA; network 192.168.200.4 0.0.0.3 area 0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 192.168.30.1 110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Thank you again in advance,&lt;/p&gt;&#xA;" OwnerUserId="23081" LastActivityDate="2019-11-04T12:49:34.200" Title="Trouble configuring pfSense firewall to obtain OSFP route information from attached routers" Tags="|routing|router|firewall|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28057" PostTypeId="1" CreationDate="2016-02-22T03:28:59.570" Score="3" ViewCount="6404" Body="&lt;p&gt;So, recently I had read somewhere that when we write ACLs to permit local IP addresses to access those in an IP NAT pool, it's said that, &quot;..when interesting traffic has been matched with the access list, it's pulled into the NAT process to be translated.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, my question is: how exactly does this pulling process work? When the ACL is detected, is it first checked with any other process that might use it (NAT for example), and then if it fails that check, only does it apply it to it's default traffic filtering function, or how does it work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what else comes under the category of &quot;interesting traffic?&quot;&lt;/p&gt;&#xA;" OwnerUserId="20062" LastEditorUserId="8499" LastEditDate="2016-03-23T05:24:47.357" LastActivityDate="2018-03-15T13:59:27.860" Title="What all is classified as &quot;Interesting traffic?&quot;" Tags="|nat|acl|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28058" PostTypeId="2" ParentId="28057" CreationDate="2016-02-22T03:37:33.510" Score="3" Body="&lt;p&gt;Interesting traffic is literally the traffic you are interested in for a particular reason. In the case you describe, traffic that is permitted by the ACL is the interesting traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When traffic is coming from an inside interface, destined for an outside interface, it is compared against the ACL to see if it should be translated before it is sent through the outside interface. Traffic that matches the ACL is what is interesting to the NAT process.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-22T03:37:33.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28062" PostTypeId="1" AcceptedAnswerId="28063" CreationDate="2016-02-22T08:35:59.467" Score="1" ViewCount="302" Body="&lt;p&gt;Host OS Ubuntu with live IP address 1.2.3.4 .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And a Ubuntu VM running in Virtual Box with NAT network configuration. I need to SSH my VM from external network with IP address 3.3.3.3 . So I configure port forwarding on my host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this configuration I successfully SSH my VM from external IP 3.3.3.3 at IP address 1.2.3.4 . When I check auth.log of VM to have a look on SSH logs, Their was no SSH connection entry from IP 3.3.3.3 . All connection was established on 10.0.2.2. But real IP of all connections is 3.3.3.3 . I have some use cases for which real Source Address is important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wondering if i could find a way to have a real source IP of connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not strong knowledge of Networks, I am a student of networks. So I apologize in advance if you feel difficulty in understanding or you found this basic. &lt;strong&gt;And I would be greatly thankful if you could suggest me alternative&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: I done port forwarding with help of this &lt;a href=&quot;https://nsrc.org/workshops/2014/btnog/raw-attachment/wiki/Track2Agenda/ex-virtualbox-portforward-ssh.htm&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use Case: &#xA;I have deployed SSH Honeypots in my VM. Any one who will try to SSH my Live IP 1.2.3.4 at port 22, will be forwarded to SSH honeypot. In honeypot VM all SSH sessions are logged. So in logs I need the real IP of attacker(3.3.3.3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;br&gt;&#xA;Sorry i forgot to mention, I have also added port 2222 in ssh config (/etc/ssh/sshd_config) of my VM. And command I use for SSh &lt;code&gt;#ssh vmusername@1.2.3.4 -p 2222&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="23110" LastEditorUserId="23110" LastEditDate="2016-02-25T13:02:30.150" LastActivityDate="2016-02-25T13:02:30.150" Title="How to get real source address of a packets in NAT'd VM" Tags="|nat|ssh|network-discovery|" AnswerCount="1" CommentCount="3" ClosedDate="2016-02-25T15:28:21.953" ContentLicense="CC BY-SA 3.0" />
  <row Id="28063" PostTypeId="2" ParentId="28062" CreationDate="2016-02-22T12:01:01.547" Score="1" Body="&lt;p&gt;I expect the best approach here would be to forget using the built in NAT in virtualbox and instead set up a host only network and then use standard iptables NAT on the host. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-02-22T12:01:01.547" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="28069" PostTypeId="1" CreationDate="2016-02-22T17:10:37.900" Score="1" ViewCount="111" Body="&lt;p&gt;My office is running a dual nexus 5k core, with catalyst 4506 closet switches at the user level. Today, I applied the following commands on one of the 4506s:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no switchport trunk native vlan 64&#xA;&#xA;no switchport trunk allowed vlan 64,68&#xA;&#xA;no switchport block unicast&#xA;&#xA;no ip access-group ACL-ALLOW in&#xA;&#xA;no authentication event fail action next-method&#xA;&#xA;no authentication event server dead action authorize vlan 64&#xA;&#xA;no authentication event server alive action reinitialize&#xA;&#xA;no authentication host-mode multi-auth&#xA;&#xA;no authentication order dot1x mab&#xA;&#xA;no authentication priority dot1x mab&#xA;&#xA;no authentication port-control auto&#xA;&#xA;no authentication periodic&#xA;&#xA;no authentication timer reauthenticate server&#xA;&#xA;no authentication violation restrict&#xA;&#xA;no mab&#xA;&#xA;no snmp trap mac-notification change added&#xA;&#xA;no snmp trap mac-notification change removed&#xA;&#xA;no dot1x pae authenticator&#xA;&#xA;no dot1x timeout quiet-period 300&#xA;&#xA;no dot1x timeout tx-period 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This resulted in the core losing all connection to several, &quot;core&quot; vlans that are not associated within the catalyst switches. After consoling into the core (due to the radius being no longer reachable), it appeared to take on only the vlans that were within the switch I applied the commands to. Given that the commands were only to user switchports, and they were only in reference to ise configuration, i believed them to be inoculate. Has anybody seen or experienced this before? If so, what was the problem?&lt;/p&gt;&#xA;" OwnerUserId="23117" LastEditorUserId="2142" LastEditDate="2016-02-22T17:47:43.630" LastActivityDate="2016-05-22T19:52:18.570" Title="Core Dropped VLANs and Pickedu up Access VLANS?" Tags="|vlan|cisco-catalyst|cisco-nexus-5k|cisco-ise|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28070" PostTypeId="1" AcceptedAnswerId="28072" CreationDate="2016-02-22T17:33:21.147" Score="2" ViewCount="1195" Body="&lt;p&gt;Having issues getting my asa to talk to my squid box. HTTP works fine, not https. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I am not trying to do ssl bump or anything of that nature. Simply log the CONNECT messages. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;ASA 5520.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show wccp&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Global WCCP information:&#xA;Router information:&#xA;    Router Identifier:                   192.168.200.73&#xA;    Protocol Version:                    2.0&#xA;&#xA;Service Identifier: web-cache&#xA;    Number of Cache Engines:             1&#xA;    Number of routers:                   1&#xA;    Total Packets Redirected:            2589&#xA;    Redirect access-list:                wccp-traffic-http&#xA;    Total Connections Denied Redirect:   0&#xA;    Total Packets Unassigned:            1&#xA;    Group access-list:                   wccp-servers&#xA;    Total Messages Denied to Group:      0&#xA;    Total Authentication failures:       0&#xA;    Total Bypassed Packets Received:     0&#xA;&#xA;Service Identifier: 70&#xA;    Number of Cache Engines:             0&#xA;    Number of routers:                   0&#xA;    Total Packets Redirected:            0&#xA;    Redirect access-list:                wccp-traffic-https&#xA;    Total Connections Denied Redirect:   0&#xA;    Total Packets Unassigned:            0&#xA;    Group access-list:                   wccp-servers&#xA;    Total Messages Denied to Group:      0&#xA;    Total Authentication failures:       0&#xA;    Total Bypassed Packets Received:     0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's like it doesn't even see it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;show run | inc wccp&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list wccp-traffic-https extended deny ip host 192.168.201.248 any &#xA;access-list wccp-traffic-https extended permit tcp object-group PROXY_USERS any eq https &#xA;access-list wccp-servers extended permit ip host 192.168.201.248 any &#xA;access-list wccp-traffic-http extended deny ip host 192.168.201.248 any &#xA;access-list wccp-traffic-http extended permit tcp object-group PROXY_USERS any eq www &#xA;wccp web-cache redirect-list wccp-traffic-http group-list wccp-servers password *****&#xA;wccp 70 redirect-list wccp-traffic-https group-list wccp-servers password *****&#xA;wccp interface inside web-cache redirect in&#xA;wccp interface inside 70 redirect in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;debug info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LNP-ASA5520#  debug wccp subblocks &#xA;LNP-ASA5520# debug wccp packets&#xA;LNP-ASA5520# debug wccp events&#xA;LNP-ASA5520# &#xA;WCCP-PKT:S00: Received valid Here_I_Am packet from 192.168.201.248 w/rcv_id 00000059&#xA;&#xA;WCCP-PKT:S00: Sending I_See_You packet to 192.168.201.248 w/ rcv_id 0000005A&#xA;&#xA;WCCP-PKT:S00: Received valid Here_I_Am packet from 192.168.201.248 w/rcv_id 0000005A&#xA;&#xA;WCCP-PKT:S00: Sending I_See_You packet to 192.168.201.248 w/ rcv_id 0000005B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not sure why it will not connect via service group 70.  I see no errors anywhere. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the squid side:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;gre tunnel is up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wccp0     Link encap:UNSPEC  HWaddr C0-A8-C9-F8-30-30-3A-30-00-00-00-00-00-00-00-00  &#xA;      inet6 addr: fe80::5efe:c0a8:c9f8/64 Scope:Link&#xA;      UP POINTOPOINT RUNNING NOARP  MTU:1476  Metric:1&#xA;      RX packets:36748 errors:0 dropped:0 overruns:0 frame:0&#xA;      TX packets:18 errors:0 dropped:0 overruns:0 carrier:0&#xA;      collisions:0 txqueuelen:0 &#xA;      RX bytes:4317057 (4.1 MiB)  TX bytes:1080 (1.0 KiB)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;prerouting is ok. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Chain PREROUTING (policy ACCEPT)&#xA;target     prot opt source               destination         &#xA;DNAT       tcp  --  anywhere             anywhere             tcp dpt:http to:192.168.201.248:3128&#xA;DNAT       tcp  --  anywhere             anywhere             tcp dpt:https to:192.168.201.248:3128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;squid.conf just in case. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    #Access Lists&#xA;#acl manager proto cache_object&#xA;acl localhost src 127.0.0.1/32&#xA;acl internal src 192.168.200.0/21&#xA;acl wireless src 192.168.100.0/31&#xA;&#xA;#Ports allowed through Squid&#xA;acl Safe_ports port 80 #http&#xA;acl Safe_ports port 443 #https&#xA;acl SSL_ports port 443&#xA;acl SSL method CONNECT&#xA;acl CONNECT method CONNECT&#xA;&#xA;#allow/deny&#xA;http_access allow localhost&#xA;http_access allow internal&#xA;http_access allow wireless&#xA;http_access deny !Safe_ports&#xA;http_access deny CONNECT !SSL_ports&#xA;http_access deny all&#xA;&#xA;#nameservers&#xA;dns_nameservers 192.168.201.1 8.8.8.8&#xA;#WCCPv2 items&#xA;http_port 3128 intercept&#xA;wccp_version 2&#xA;wccp2_router 192.168.200.73&#xA;wccp2_forwarding_method gre&#xA;wccp2_return_method gre&#xA;wccp2_service standard 0 password=XXXXXXXXXX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4122" LastActivityDate="2017-03-19T07:30:24.490" Title="ASA / WCCP issue with https service group 70" Tags="|cisco|cisco-asa|tunnel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28071" PostTypeId="2" ParentId="28069" CreationDate="2016-02-22T18:14:27.213" Score="0" Body="&lt;p&gt;Not sure why this worked, but the vlans were re-added to the nexus cores and everything came back up. &lt;/p&gt;&#xA;" OwnerUserId="23117" LastActivityDate="2016-02-22T18:14:27.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28072" PostTypeId="2" ParentId="28070" CreationDate="2016-02-22T18:33:59.483" Score="1" Body="&lt;p&gt;It seems that the ASA was not recognizing a standard service.  I had to add to the squid.conf then it started talking. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 35 wccp2_service dynamic 70 password=************&#xA; 36 wccp2_service_info 70 protocol=tcp flags=dst_ip_hash priority=240 ports=443&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4122" LastActivityDate="2016-02-22T18:33:59.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28077" PostTypeId="2" ParentId="28056" CreationDate="2016-02-23T02:00:46.907" Score="2" Body="&lt;p&gt;After a bit more searching I discovered a few more links (thanks to Ron above for one of them) that helped clarify how to run OSPF on pfSense. Specifically, for my purposes, how to have have the pfSense box share its routing table and paths with all other routers within your network.  (Note: Assuming user is familiar with OSPF)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first step is to download the Quagga OSPFd package to pfSense. (I was running pfSense v. 2.2.4)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the package installs, look for it under services&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first tab under OSPFd, is the Global Settings.  Here all you need to do (minimum) is to set the Router ID to the pfSense WAN address) and then set the area to 0.0.0.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QYdEL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QYdEL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under the next tab, add the WAN and the LAN interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PvkM1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PvkM1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, we are just configuring the WAN address.  By setting the 'interface' to the WAN interface, and once again set the area to 0.0.0.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fx7c0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fx7c0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This worked for me, hope someone will find it useful.&lt;/p&gt;&#xA;" OwnerUserId="23081" LastActivityDate="2016-02-23T02:00:46.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28078" PostTypeId="1" AcceptedAnswerId="28079" CreationDate="2016-02-23T06:19:26.387" Score="1" ViewCount="1926" Body="&lt;p&gt;I created new dhcp pool in server 2012 called &lt;strong&gt;vlan 41&lt;/strong&gt;,routed with default gateway in router, added &lt;strong&gt;interface vlan 41&lt;/strong&gt; on core switch 3650.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;interface Vlan41&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip address 10.10.41.250 255.255.255.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip helper-address 10.10.10.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i can't ping to this interface from server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Routed 10.10.41.0 255.255.255.0&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Other dhcp pools are working fine&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="21915" LastEditDate="2016-02-24T04:43:57.370" LastActivityDate="2016-02-24T04:43:57.370" Title="I cannot ping from server to new vlan interface" Tags="|cisco|switch|router|vlan|" AnswerCount="1" CommentCount="1" ClosedDate="2016-02-23T22:50:18.363" ContentLicense="CC BY-SA 3.0" />
  <row Id="28079" PostTypeId="2" ParentId="28078" CreationDate="2016-02-23T07:54:29.097" Score="1" Body="&lt;p&gt;Can not comment to the original question. So i write it here:&#xA;try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Conf t&#xA;interface Vlan41&#xA;sh&#xA;no sh&#xA;end&#xA;wr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and now try to ping from th server.&lt;/p&gt;&#xA;" OwnerUserId="21768" LastActivityDate="2016-02-23T07:54:29.097" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="28080" PostTypeId="2" ParentId="28022" CreationDate="2016-02-23T08:18:32.263" Score="4" Body="&lt;p&gt;You want to look into two features called &lt;strong&gt;private VLAN&lt;/strong&gt; and &lt;strong&gt;ARP proxy&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;When your host's VLAN is configured as a private VLAN, the switch will forbid your host (let's assume it has IP &lt;code&gt;10.0.0.3&lt;/code&gt;) from communicating with other hosts in the same VLAN, as for instance &lt;code&gt;10.0.0.4&lt;/code&gt;. When I say forbid, I mean that it will not forward ethernet frames incoming from a host in the VLAN to another host in the same VLAN. That means no ARP, no ICMP, nothing.&lt;/p&gt;&#xA;&lt;p&gt;That's a bit against everything we learned in networking class but that's how it works. Bear with me because that is not all there is to know with private VLAN.&lt;/p&gt;&#xA;&lt;p&gt;The VLAN where our two hosts (host &lt;code&gt;.3&lt;/code&gt; and &lt;code&gt;.4&lt;/code&gt;) are configured is known as the &lt;strong&gt;secondary VLAN&lt;/strong&gt;.&#xA;You can configure a port (typically the gateway's) to be a little special : this port will be in another VLAN, the &lt;strong&gt;primary&lt;/strong&gt; VLAN. Both VLAN are linked somehow (configuration varies with vendors) in the switch's config. A host in the &lt;strong&gt;primary&lt;/strong&gt; VLANs will be able to communicate (i.e. the switch will allow frames to be forwarded) with any hosts, whether they are in the &lt;strong&gt;primary&lt;/strong&gt; or the &lt;strong&gt;secondary&lt;/strong&gt; VLAN. And for the return frames : hosts in the &lt;strong&gt;secondary&lt;/strong&gt; VLAN -while still unable to talk to each other- are allowed to send frames  to hosts in the &lt;strong&gt;primary&lt;/strong&gt; VLAN.&lt;/p&gt;&#xA;&lt;p&gt;From an IP point of view, all hosts of both VLANs should be in the same subnet.&lt;/p&gt;&#xA;&lt;p&gt;So there we are. Our hosts (&lt;code&gt;10.0.0.3&lt;/code&gt; and &lt;code&gt;.4&lt;/code&gt;) cannot communicate between them but can communicate with the gateway (&lt;code&gt;10.0.0.1&lt;/code&gt;), and, per extension, the rest of the internet.&lt;/p&gt;&#xA;&lt;p&gt;That can be very useful for hosting providers that do not want different clients to communicate and do not want to waste IP addresses in a lot of /30 networks. But that is not what you want. Yet.&lt;/p&gt;&#xA;&lt;p&gt;The twin feature of private VLAN is &lt;strong&gt;ARP proxy&lt;/strong&gt;. That is just a config on the gateway to instruct it to respond on ARP requests originated from host &lt;code&gt;.3&lt;/code&gt;, and asking for &lt;code&gt;10.0.0.4&lt;/code&gt;'s MAC, with its own MAC address. The gateway then initiate its own ARP request to &lt;code&gt;10.0.0.4&lt;/code&gt;. This time host &lt;code&gt;.4&lt;/code&gt; sees it (the gateway is in the primary VLAN, remember?) and responds.&lt;/p&gt;&#xA;&lt;p&gt;This way, the gateway is performing some sort of legitimate man-in-the-middle between your two host, and can control the traffic. It may perform an ICMP redirect, you might want to disable that.&lt;/p&gt;&#xA;&lt;p&gt;That's it. You can now control traffic between hosts in the same subnet. Well, you need a switch with the correct features, of course ! ;)&lt;/p&gt;&#xA;&lt;p&gt;(or you can use two different VLAN, as Ron outlined.)&lt;/p&gt;&#xA;&lt;p&gt;EDIT : some more information about how &lt;strong&gt;private VLANs&lt;/strong&gt; work.&lt;/p&gt;&#xA;&lt;p&gt;The primary (say VLAN ID 10) and secondary VLAN (ID 20) have different 802.1q numbers.&lt;/p&gt;&#xA;&lt;p&gt;A frame from the gateway will travel your switched network tagged with ID 10. Switches will then forward your frame to trunk ports, and access ports in VLAN 10 &lt;strong&gt;and&lt;/strong&gt; 20, because of the relation between primary and secondary VLANs that is configured on the device.&lt;/p&gt;&#xA;&lt;p&gt;A frame from an isolated host will travel your network tagged as VLAN 20. It will be forwarded on trunk ports, and access ports in VLAN 10 &lt;strong&gt;but not&lt;/strong&gt; access ports in VLAN 20.&lt;/p&gt;&#xA;&lt;p&gt;There is no communication involved between switches because none is required : it is only a matter of local treatment. But it is advised to have the same primaries/secondaries config on all switches, or expect headaches.&lt;/p&gt;&#xA;&lt;p&gt;If you send frames to your hosts tagged, you will have to play with &lt;code&gt;allowed vlan&lt;/code&gt; and some VLAN mapping magic. Refer to your vendor's doc.&lt;/p&gt;&#xA;&lt;p&gt;Also, I only talked about &lt;strong&gt;isolated&lt;/strong&gt; secondary VLANs. There are also &lt;strong&gt;community&lt;/strong&gt; secondary VLANs, but that is for another time/another edit.&lt;/p&gt;&#xA;" OwnerUserId="564" LastEditorUserId="564" LastEditDate="2021-09-10T16:47:39.617" LastActivityDate="2021-09-10T16:47:39.617" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="28081" PostTypeId="1" AcceptedAnswerId="28082" CreationDate="2016-02-23T09:54:46.423" Score="0" ViewCount="76" Body="&lt;p&gt;If a custom base station was placed in an area with mobile devices nearby, would they automatically fall back to 2G from 3G, since the 2G signal was stronger? Or would the 3G signal need to be suppressed completely by a noise generator for a fallback to happen ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The nearby target mobiles phones would be 70% Androids,20% iPhones and 10% 2G Only phones, this is Indian Mobile network specific question.&lt;/p&gt;&#xA;" OwnerUserId="23126" LastActivityDate="2016-02-23T10:31:16.897" Title="Mobile phone fallback with custom basestation" Tags="|wireless|mobile|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28082" PostTypeId="2" ParentId="28081" CreationDate="2016-02-23T10:31:16.897" Score="1" Body="&lt;p&gt;That depends on the setting on the device. Per default the devices won't automatically fall back to 2G just because it is stronger. You will have to force them to by suppressing the 3G signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know anything about Indian law, but I would suggest to check legality of this before implementing any mobile network jammer!&lt;/p&gt;&#xA;" OwnerUserId="2112" LastActivityDate="2016-02-23T10:31:16.897" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28084" PostTypeId="1" CreationDate="2016-02-23T12:53:26.263" Score="4" ViewCount="674" Body="&lt;p&gt;I'm researching various tunneling technologies and I have a fairly good understanding covering some of the basics. In a site-to-site VPN the edge routers could appear as only one hop away. I've also read that it's possible to make it appear as a flat network i.e. everything on the same LAN. This is the piece i am missing, can someone help me to understand how this is possible?&lt;/p&gt;&#xA;" OwnerUserId="13244" LastEditorUserId="-1" LastEditDate="2016-02-24T06:14:41.330" LastActivityDate="2016-02-24T06:14:41.330" Title="Tunneling query" Tags="|tunnel|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28085" PostTypeId="2" ParentId="28084" CreationDate="2016-02-23T13:01:41.277" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I've also read that it's possible to make it appear as a flat network i.e. everything on the same LAN. This is the piece i am missing, can someone help me to understand how this is possible?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Some tunneling technologies provide Ethernet over IP services. For instance, research about these topics:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;L2TPv3&lt;/li&gt;&#xA;&lt;li&gt;EoMPLS&lt;/li&gt;&#xA;&lt;li&gt;VXLAN&lt;/li&gt;&#xA;&lt;li&gt;EtherIP (RFC3378)&lt;/li&gt;&#xA;&lt;li&gt;Ethernet over GRE&lt;/li&gt;&#xA;&lt;li&gt;Cisco OTV (Overlay Transport Virtualization)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-23T13:01:41.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28086" PostTypeId="2" ParentId="19387" CreationDate="2016-02-23T14:08:46.480" Score="2" Body="&lt;p&gt;The 500_Series_Admin_Guide.pdf states the following:&#xA;There are two different ways to update images across the stack:&#xA;• Image can be updated prior to connecting a unit to the stack. This is the&#xA;recommended method.&#xA;• Upgrade device or stack. If the stack is updated, the slave units are&#xA;automatically updated. This is done as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Copy image from TFTP/SCP server to master, using the Upgrade/&#xA;Backup Firmware/Language page.&lt;/li&gt;&#xA;&lt;li&gt;Change the active image, using the Active Image page.&lt;/li&gt;&#xA;&lt;li&gt;Reboot, using the Reboot page.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23130" LastActivityDate="2016-02-23T14:08:46.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28087" PostTypeId="2" ParentId="27829" CreationDate="2016-02-23T15:22:33.590" Score="2" Body="&lt;p&gt;A lot of the time when you come across MIBs not populating, its simply because the MIB package is not compatible with the version of IOS that is running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you take a look at this Cisco tool &lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/MainServlet&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://tools.cisco.com/ITDIT/MIBS/MainServlet&lt;/a&gt; you can see which MIBs are compatible with your version of IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you search for a C3725 running ADVSECURITYK9-M, Version 12.4(3) you wont see &quot;CISCO-ACL-MIB&quot;, and consequently when I load that MIB up, I am unable to grab any information from the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;IOS Info&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#sh ver&#xA;Cisco IOS Software, 3700 Software (C3725-ADVSECURITYK9-M), Version 12.4(3), RELEASE SOFTWARE (fc2)&#xA;&#xA;&#xA;ROM: ROMMON Emulation Microcode&#xA;ROM: 3700 Software (C3725-ADVSECURITYK9-M), Version 12.4(3), RELEASE SOFTWARE (fc2)&#xA;&#xA;R3 uptime is 19 minutes&#xA;System returned to ROM by unknown reload cause - suspect boot_data[BOOT_COUNT] 0x0, BOOT_COUNT 0, BOOTDATA 19&#xA;&#xA;----snip-----&#xA;&#xA;Cisco 3725 (R7000) processor (revision 0.1) with 124928K/6144K bytes of memory.&#xA;Processor board ID FTX0945W0MY&#xA;R7000 CPU at 240MHz, Implementation 39, Rev 2.1, 256KB L2, 512KB L3 Cache&#xA;4 FastEthernet interfaces&#xA;DRAM configuration is 64 bits wide with parity enabled.&#xA;55K bytes of NVRAM.&#xA;1024K bytes of ATA System CompactFlash (Read/Write)&#xA;&#xA;Configuration register is 0x2102&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SNMP/Access List Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended TestName&#xA; permit ip any any&#xA;!&#xA;access-list 90 permit any&#xA;snmp-server community test RO 90&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;iReasoning MIB Browser&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Zob2d.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zob2d.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4271" LastActivityDate="2016-02-23T15:22:33.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28088" PostTypeId="1" AcceptedAnswerId="28089" CreationDate="2016-02-23T15:46:50.587" Score="1" ViewCount="209" Body="&lt;p&gt;We have several buildings on campus. In our main building we have a core switch which is a Cisco 3560X (with a C3KX-NM-1G module installed) and a Cisco SR2024, among other switches. In another building I have a LinkSys SRW2008. These two buildings were connected via fiber between the LinkSys SRW2008 and the Cisco SR2024 switch using a Mini-GBIC MGBSX1 connector on each end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Over the weekend, the SR2024 died (no power). I'd like to move the fiber connection in the main building to one of the C3KX-NM-1G ports in the 3560X. At first I just moved it, but the port immediately went to error. I removed the fiber from the Mini-GBIC and did a &lt;code&gt;shut&lt;/code&gt; and &lt;code&gt;no shut&lt;/code&gt;. That has removed the error. I then connected the fiber back, but the port still shows no connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there something I need to do to get the port to recognize the link? I thought it would do so automatically, but in my very limited understanding of the Cisco IOS, I was obviously wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help me configure this link so I can get that part of our network back up?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="23131" LastActivityDate="2016-02-23T15:56:25.117" Title="Connect Cisco 3560x with LinkSys SRW2008 via Fiber" Tags="|cisco|cisco-ios|fiber|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28089" PostTypeId="2" ParentId="28088" CreationDate="2016-02-23T15:56:25.117" Score="0" Body="&lt;p&gt;I don't think the MGBSX1 is compatible with the 3560X with the C3KX-NM-1G module. It seems these are the transceivers compatible with your switch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GLC-SX-MMD&lt;br&gt;&#xA;GLC-LH-SMD&lt;br&gt;&#xA;GLC-ZX-SM&lt;br&gt;&#xA;GLC-ZX-SMD&lt;br&gt;&#xA;GLC-BX-D&lt;br&gt;&#xA;GLC-BX-U&lt;br&gt;&#xA;SFP-GE-S&lt;br&gt;&#xA;SFP-GE-L&lt;br&gt;&#xA;SFP-GE-Z&lt;br&gt;&#xA;CWDM SFP&lt;br&gt;&#xA;DWDM SFP&lt;br&gt;&#xA;GLC-EX-SMD  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the compatibility chart at &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/interfaces_modules/transceiver_modules/compatibility/matrix/GE_Tx_Matrix.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Gigabit Ethernet Transceiver Modules Compatibility Matrix&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-23T15:56:25.117" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28090" PostTypeId="1" AcceptedAnswerId="28091" CreationDate="2016-02-23T16:08:16.490" Score="2" ViewCount="929" Body="&lt;p&gt;I've been trying to get 2547oDMVPN with 'mpls nhrp' setup in a VIRL environment and I have gotten it to work with some of the examples I've seen online, but all the examples online have had the hub as the route reflector and have used the Tunnel interface for BGP peering.  If I use my Tunnel interface as my iBGP peer source things work, but if I don't, then for some reason things stop?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the output of some of my show commands that I believe to be the issue, but I don't know how to fix.  In the 'show ip cef vrf CLASS detail' I see the prefix and it gets recursively resolved to my tunnel interface.  In the 'show mpls forwarding-table' it says to drop the labels?  Thank you in advance for any help.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;show mpls forwarding-table&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IR-01#show mpls forwarding-table &#xA;Local Outgoing Prefix Bytes Label Outgoing Next Hop &#xA;Label Label or Tunnel Id Switched interface &#xA;305 202 0.0.0.0/0[V] 0 drop &#xA;307 205 10.10.1.0/24[V] 0 drop &#xA;308 No Label 10.30.1.0/24[V] 0 aggregate/CLASS &#xA;313 307 10.50.1.0/24[V] 0 drop&#xA;&#xA;&#xA;IR-01#show ip cef vrf CLASS detail &#xA;IPv4 CEF is enabled and running&#xA;VRF CLASS&#xA;17 prefixes (17/0 fwd/non-fwd)&#xA;Table id 0x2&#xA;Database epoch: 0 (17 entries at this epoch)&#xA;&#xA;0.0.0.0/0, epoch 0, flags [rib defined all labels, default route]&#xA;local label info: other/305&#xA;recursive via 10.10.0.251 label 202&#xA;recursive via 10.10.0.250/31&#xA;nexthop 1.0.2.10 Tunnel102&#xA;0.0.0.0/8, epoch 0&#xA;Special source: drop&#xA;drop&#xA;0.0.0.0/32, epoch 0, flags [receive]&#xA;Special source: receive&#xA;receive&#xA;10.10.1.0/24, epoch 0, flags [rib defined all labels]&#xA;local label info: other/307&#xA;recursive via 10.10.0.251 label 205&#xA;recursive via 10.10.0.250/31&#xA;nexthop 1.0.2.10 Tunnel102&#xA;10.30.1.0/24, epoch 0, flags [attached]&#xA;local label info: other/308&#xA;attached to Null0&#xA;10.30.1.0/31, epoch 0, flags [attached, connected]&#xA;attached to Loopback1&#xA;10.30.1.1/32, epoch 0, flags [receive, local, source eligible]&#xA;Interface source: Loopback1 flags: local, source eligible&#xA;receive for Loopback1&#xA;10.30.1.32/30, epoch 0, flags [attached, connected, cover dependents, need deagg]&#xA;Covered dependent prefixes: 2&#xA;need deagg: 2&#xA;attached to GigabitEthernet0/2.20&#xA;10.30.1.32/32, epoch 0, flags [receive]&#xA;Interface source: GigabitEthernet0/2.20 flags: none&#xA;Dependent covered prefix type cover need deagg, cover 10.30.1.32/30&#xA;receive for GigabitEthernet0/2.20&#xA;10.30.1.33/32, epoch 0, flags [receive, local, source eligible]&#xA;Interface source: GigabitEthernet0/2.20 flags: local, source eligible&#xA;receive for GigabitEthernet0/2.20&#xA;10.30.1.35/32, epoch 0, flags [receive]&#xA;Interface source: GigabitEthernet0/2.20 flags: none&#xA;Dependent covered prefix type cover need deagg, cover 10.30.1.32/30&#xA;receive for GigabitEthernet0/2.20&#xA;10.50.1.0/24, epoch 0, flags [rib defined all labels]&#xA;local label info: other/313&#xA;recursive via 10.50.0.251 label 307&#xA;recursive via 10.50.0.250/31&#xA;nexthop 1.0.2.10 Tunnel102&#xA;127.0.0.0/8, epoch 0&#xA;Special source: drop&#xA;drop&#xA;224.0.0.0/4, epoch 0&#xA;Special source: drop&#xA;drop&#xA;224.0.0.0/24, epoch 0, flags [receive]&#xA;Special source: receive&#xA;receive&#xA;240.0.0.0/4, epoch 0&#xA;Special source: drop&#xA;drop&#xA;255.255.255.255/32, epoch 0, flags [receive]&#xA;Special source: receive&#xA;receive&#xA;&#xA;&#xA;IR-01#sh ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;      1.0.0.0/8 is variably subnetted, 3 subnets, 2 masks&#xA;C        1.0.2.0/24 is directly connected, Tunnel102&#xA;L        1.0.2.30/32 is directly connected, Tunnel102&#xA;H        1.0.2.50/32 is directly connected, 00:07:01, Tunnel102&#xA;      10.0.0.0/8 is variably subnetted, 15 subnets, 3 masks&#xA;O        10.10.0.20/30 [110/1001] via 1.0.2.10, 00:42:50, Tunnel102&#xA;O        10.10.0.24/30 [110/1002] via 1.0.2.10, 00:42:50, Tunnel102&#xA;O        10.10.0.250/31 [110/1001] via 1.0.2.10, 00:42:50, Tunnel102&#xA;O        10.10.0.254/31 [110/1002] via 1.0.2.10, 00:42:50, Tunnel102&#xA;C        10.30.0.0/30 is directly connected, GigabitEthernet0/1&#xA;L        10.30.0.2/32 is directly connected, GigabitEthernet0/1&#xA;O        10.30.0.4/30 [110/2] via 10.30.0.1, 10:43:28, GigabitEthernet0/1&#xA;C        10.30.0.32/30 is directly connected, GigabitEthernet0/2.10&#xA;L        10.30.0.33/32 is directly connected, GigabitEthernet0/2.10&#xA;C        10.30.0.64/30 is directly connected, GigabitEthernet0/3&#xA;L        10.30.0.65/32 is directly connected, GigabitEthernet0/3&#xA;C        10.30.0.250/31 is directly connected, Loopback0&#xA;L        10.30.0.251/32 is directly connected, Loopback0&#xA;O        10.30.0.253/32 [110/2] via 10.30.0.1, 10:43:28, GigabitEthernet0/1&#xA;O        10.50.0.250/31 [110/2001] via 1.0.2.10, 00:42:40, Tunnel102&#xA;      192.168.0.0/24 is variably subnetted, 4 subnets, 2 masks&#xA;S        192.168.0.0/24 [1/0] via 10.30.0.66&#xA;O E2     192.168.0.10/32 [110/100] via 10.30.0.1, 10:42:44, GigabitEthernet0/1&#xA;C        192.168.0.30/32 is directly connected, Loopback100&#xA;O E2     192.168.0.50/32 [110/100] via 10.30.0.1, 10:43:16, GigabitEthernet0/1&#xA;IR-01# sh ip route vrf CLASS &#xA;&#xA;Routing Table: CLASS&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is 10.10.0.251 to network 0.0.0.0&#xA;&#xA;B*    0.0.0.0/0 [200/0] via 10.10.0.251, 00:42:06&#xA;      10.0.0.0/8 is variably subnetted, 7 subnets, 4 masks&#xA;B        10.10.1.0/24 [200/0] via 10.10.0.251, 00:42:06&#xA;S        10.30.1.0/24 is directly connected, Null0&#xA;C        10.30.1.0/31 is directly connected, Loopback1&#xA;L        10.30.1.1/32 is directly connected, Loopback1&#xA;C        10.30.1.32/30 is directly connected, GigabitEthernet0/2.20&#xA;L        10.30.1.33/32 is directly connected, GigabitEthernet0/2.20&#xA;B        10.50.1.0/24 [200/0] via 10.50.0.251, 00:42:06&#xA;IR-01# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16456" LastEditorUserId="16456" LastEditDate="2016-02-23T16:31:31.980" LastActivityDate="2016-02-23T16:48:08.707" Title="2547oDMVPN with Loopback as iBGP source interface" Tags="|mpls|mpls-vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28091" PostTypeId="2" ParentId="28090" CreationDate="2016-02-23T16:20:30.417" Score="2" Body="&lt;p&gt;&lt;strong&gt;Edit based on the provided bug link:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is obviously a bug. The workaround is given, and I think you need to use the tunnel interface as prescribed in the workaround until there is a code fix. We don't have magic solutions to a code bug. See the text I highlighted from the &lt;a href=&quot;https://tools.cisco.com/bugsearch/bug/CSCut61985/?referring_site=bugquickviewredir&quot; rel=&quot;nofollow&quot;&gt;bug report&lt;/a&gt; on the last line below:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Symptom:&lt;/strong&gt; Packet forwarding succeeds between DMVPN spoke nodes when going over spoke-hub-spoke path but fails when when going over the&#xA;  direct spoke-spoke path. Forwarding over the direct spoke-spoke will&#xA;  fail when either the source or endpoint is a directly connected&#xA;  interface address on the spoke node within a VRF, the interface has a&#xA;  /32 mask and MPLSoDMVPN using 'mpls nhrp' is configured on the DMVPN&#xA;  tunnel interfaces.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Additionally, using Loopback interfaces to perform iBGP peering across&#xA;  the Spokes will also fail, irrespective of the netmask on the loopback&#xA;  interfaces since iBGP peering will still be done using /32 prefix.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Conditions:&lt;/strong&gt; MPLSoDMVPN [2547oDMVPN] setup with &quot;mpls nhrp&quot; configuration. Requirement is to setup direct spoke-to-spoke Tunnels.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Workaround:&lt;/strong&gt; Change the interface mask to be something other than /32 like /31. Though this ends up wasting an address per such&#xA;  interface.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;&lt;em&gt;In case of iBGP peering over loopback interfaces, use Tunnel interface.&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-23T16:48:08.707" LastActivityDate="2016-02-23T16:48:08.707" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28093" PostTypeId="2" ParentId="28084" CreationDate="2016-02-23T16:42:38.923" Score="1" Body="&lt;p&gt;The main thing that makes things &quot;appear on the same LAN&quot; are broadcast messages of one type or another (depending on the type of LAN and what exactly we mean by &quot;appear on&quot;). Specifically, in the case of Ethernet (as an example), all nodes that can receive and respond to data-link layer broadcast messages (e.g., ARP) will appear to be on the local LAN (more properly, the same &lt;em&gt;broadcast domain&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to create the illusion of a node being on the local LAN, all a device or service has to do is handle two-way transmission of link-layer broadcast messages and responses. So two broadcast domains that are joined by a VPN connection using devices that accept and encapsulate and de-encapsulate all broadcasts and responses will effectively become one broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course the network layer addressing will have to arranged accordingly.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2016-02-23T16:42:38.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28094" PostTypeId="1" CreationDate="2016-02-23T16:43:58.627" Score="-1" ViewCount="43" Body="&lt;p&gt;I configured a VPN tunnel between 2 locations, and I provided access to VM machines from one point to other. I want to know the data utilization for a few systems. How do I find data utilization for these machines for an interval of 10 days?&lt;/p&gt;&#xA;" OwnerUserId="23132" LastEditorUserId="8499" LastEditDate="2016-02-23T19:20:42.523" LastActivityDate="2016-02-23T19:20:42.523" Title="I want to know how to find the data utilization for an interface for last 10 days" Tags="|routing|" AnswerCount="1" CommentCount="2" ClosedDate="2019-03-24T00:28:20.463" ContentLicense="CC BY-SA 3.0" />
  <row Id="28095" PostTypeId="2" ParentId="28084" CreationDate="2016-02-23T17:15:27.180" Score="4" Body="&lt;p&gt;Yes it is possible, and Everton gave you some features that help you do that, but...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...&lt;strong&gt;please don't do it !&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know a single LAN over two (or more) distant sites seems nice for machine migration (it can keep the same IP) or auto-discovering protocols, but by bridging two remote LAN you create a &lt;strong&gt;single failure domain&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By bridging remote LAN, you will forward every broadcast, every multicast, every broadcast storm, every shitty multicast packet that will triggeer some bug on oh-so-bugged multicast stacks on some hosts... Even for legitimate broadcast it is bad, because all of these have to be treated by everyone before being considered irrelevant by 99% of your hosts. That costs CPU. &lt;em&gt;LAN do not scale !!&lt;/em&gt; (Hint : the &quot;L&quot; stands for &quot;Local&quot; :) )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://blog.ipspace.net/2012/05/layer-2-network-is-single-failure.html&quot; rel=&quot;nofollow&quot;&gt;Ivan Pepelnjak's&lt;/a&gt; blog post for more detailed explanation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to move a host without having to change it's IP address, consider using a mechanism where the host (or its hypervisor if applicable) announces a /32 route to your router. &lt;a href=&quot;http://www.projectcalico.org/&quot; rel=&quot;nofollow&quot;&gt;Calico&lt;/a&gt; does it with BGP, for instance.&lt;/p&gt;&#xA;" OwnerUserId="564" LastEditorUserId="564" LastEditDate="2016-02-23T18:51:17.690" LastActivityDate="2016-02-23T18:51:17.690" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28096" PostTypeId="1" AcceptedAnswerId="28122" CreationDate="2016-02-23T17:56:39.710" Score="1" ViewCount="36586" Body="&lt;p&gt;I am confused to what happened to the slave's IP address. Before I set both my units to Active/Active cluster, I could reach each of them with their own IP. Now, I can still reach the master unit with the same IP. However: I can no longer reach my slave unit on the IP I used to reach it on prior to setting up the Cluster. What happened to it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do they share the same IP now that they are in a cluster? If so: How can I manage each of them from the web interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not: Is there any way I can find the other unit without scanning my entire network manually?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The specific units I'm operating are &lt;code&gt;FortiGate 60D&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;From what I can tell: They do share the same IP. A lot of my results on Google comes up with the CLI command: &lt;code&gt;exec ha manage 1&lt;/code&gt;. I appear to be in the slave unit when I run that command. So now when I try to retrieve the IP address using this command: &lt;code&gt;get system interface&lt;/code&gt;: It gives me the same IP address as my master unit have on the internal interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I can manage the slave interface from the HTML GUI?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I've been &quot;Googling&quot; around for the last 5 hours with no progress.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="23136" LastEditorUserId="23136" LastEditDate="2016-02-23T18:18:31.217" LastActivityDate="2021-01-07T17:57:02.503" Title="FortiGate HA (A/A) Cluster: How can I manage the slave unit from the web GUI?" Tags="|router|ipv4|firewall|ip|fortigate|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28097" PostTypeId="2" ParentId="28096" CreationDate="2016-02-23T18:25:42.273" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;execute ha manage ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You need to run this from the CLI. Once the primary is active, the slave is inaccessible via the IP.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;execute ha manage ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This command, including the (space) &quot;?&quot; gives the results of a number ie: 0 or 1&#xA;0 is generally the primary, whereas 1 is generally the secondary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If in the primary:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;execute ha manage 1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This will take you to the secondary&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;execute ha manage 0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This will take you from the secondary to the primary&lt;/p&gt;&#xA;" OwnerUserId="23137" LastActivityDate="2016-02-23T18:25:42.273" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28098" PostTypeId="2" ParentId="28094" CreationDate="2016-02-23T19:18:32.000" Score="2" Body="&lt;p&gt;Not enough information on the hardware used. But if your &quot;routers&quot; support snmp you could use something like mrtg or some other vendor solution to monitor your interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example of a similar question:&#xA;&lt;a href=&quot;https://serverfault.com/questions/535875/how-to-monitor-per-port-bandwidth-using-snmp&quot;&gt;https://serverfault.com/questions/535875/how-to-monitor-per-port-bandwidth-using-snmp&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2016-02-23T19:18:32.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28099" PostTypeId="1" CreationDate="2016-02-23T19:34:10.000" Score="2" ViewCount="263" Body="&lt;p&gt;Most high end network equipment (switches and routers) can act as a NTP-server for hosts in the network, but I cant find any information on how stable these are. Does anyone have any information or insight?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: So, my actual question is: Are switches and routers usable as ntp servers in a network? Or should we go for specific hardware?&lt;/p&gt;&#xA;" OwnerUserId="16331" LastEditorUserId="16331" LastEditDate="2016-02-23T19:50:15.857" LastActivityDate="2016-02-23T20:51:21.333" Title="How stable are clocks in network equipment" Tags="|switch|router|ntp|" AnswerCount="3" CommentCount="2" ClosedDate="2019-02-12T05:31:31.047" ContentLicense="CC BY-SA 3.0" />
  <row Id="28100" PostTypeId="2" ParentId="28099" CreationDate="2016-02-23T19:41:36.040" Score="2" Body="&lt;p&gt;I have no clue about the internal clock stability, but it doesn't matter much since you absolutely want those devices to be be synchronized, i.e. be NTP clients of a trusted source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the only way to ensure that logs (or snmp traps or whatever monitoring you use) are consistent among the devices, to allow a good interpretation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course there should be no significant deviation between two NTP update. I have no real data about this but I never saw this problem arise with properly configured devices.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-02-23T19:41:36.040" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28101" PostTypeId="2" ParentId="26713" CreationDate="2016-02-23T20:05:06.143" Score="2" Body="&lt;p&gt;While Configuring GRE tunnel you may have specify source and destination address. That Source and destination IP are 1.1.1.10 and 2.2.2.10. These IPs will be routed in the internet and helps to bring up GRE tunnel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once tunnel is up we can assign IP between two end point which in this case is 172.16.0.0/24 network. So any tunnel with IP address on top of it at the end points are called numbered and without IP are called un-numbered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Advantage of using ip address on the tunnel interface is, we can run any dynamic routing protocol to route any traffic over the tunnel.  &lt;/p&gt;&#xA;" OwnerUserId="22917" LastActivityDate="2016-02-23T20:05:06.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28102" PostTypeId="2" ParentId="28099" CreationDate="2016-02-23T20:12:08.220" Score="2" Body="&lt;p&gt;Clocks of network devices usually DO NOT have high-quality oscillators. Because those oscillators are expensive hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all you need is to distribute wall clock time through NTP (with millisecond precision) , they might suffice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need high accuracy for services like TDM over packet, you will likely need either SyncE or PTP (precision time protocol), for sub-microsecond precision, and clock sources with high-accuracy oscillator (as you said, specific hardware).&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-23T20:12:08.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28103" PostTypeId="2" ParentId="20276" CreationDate="2016-02-23T20:17:53.360" Score="3" Body="&lt;p&gt;I believe officially vSRX needs 4 GB RAM, 2 CPU and a min of 16 GB disk space. If this requirement is not met, an instance can behave abnormally and will be hard to debug. Maybe you are facing a display-only issue, but with packet processing and some feature enabled, surely you will be struggling with control and data plane memory. &lt;/p&gt;&#xA;" OwnerUserId="22917" LastEditorUserId="8499" LastEditDate="2016-02-23T22:01:34.067" LastActivityDate="2016-02-23T22:01:34.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28104" PostTypeId="2" ParentId="28017" CreationDate="2016-02-23T20:35:50.830" Score="0" Body="&lt;p&gt;One way is to display it with the specific peer ip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check Phase 1 Tunnel&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA#show crypto isakmp sa detail | b [peer IP add]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Check Phase 2 Tunnel&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA#show crypto ipsec sa peer [peer IP add]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Display the PSK&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA#more system:running-config | b tunnel-group [peer IP add]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Display Uptime, etc.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA#sh vpn-sessiondb detail l2l | b [peer IP add]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23140" LastEditorUserId="8499" LastEditDate="2016-02-23T20:52:46.783" LastActivityDate="2016-02-23T20:52:46.783" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28105" PostTypeId="2" ParentId="28084" CreationDate="2016-02-23T20:46:00.827" Score="1" Body="&lt;p&gt;Theres a few ways to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One easy way is just to build a virtual ethernet link. The VPN software creates a virtual ethernet interface on both ends and forwards frames between them. You can then use bridging to connect the virtual ethernet interfaces to real ones. I have successfully done this using both vtun and openvpn. I preffer openvpn because it has built-in bridge functionality that allowsone openvpn instance to serve multiple clients. There are also similar solotions from the proffesional networking world but I don't have personal experiance with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The upside of this approach is that pretty much everything (unless it's very latency sensitive) that works on a LAN just works. Broadcasts get to where they need to go, hosts can seamlessly move from one site to another without changing their addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The downside of this approach is that the overhead can be relatively high. Firstly the growth in packet size from the extra headers means that full size packets from your LAN won't fit in a normal internet MTU. So either they have to be fragmented somehow or the network you run your tunnel over needs to support jumbo frames. Secondly a load of pointless broadcast chatter can end up going down the tunnel. Thirdly it can be difficult to keep local traffic local and avoid triangle routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are fancier systems too that emulate some aspects of an ethernet network while trying to avoid some of the above problems but again I have no personal experiance with them.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-02-23T20:46:00.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28106" PostTypeId="2" ParentId="28099" CreationDate="2016-02-23T20:51:21.333" Score="0" Body="&lt;p&gt;The answer to your question depends on the level of accuracy which you need. For network logs and PCs/servers running normal applications, it is more than accurate enough. Very precise applications may require a dedicated GPS clock in the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;show ntp status&lt;/code&gt; command on Cisco devices gives you a lot of information.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Clock is synchronized, stratum 3, reference is 149.125.221.49 &#xA;nominal freq is 250.0000 Hz, actual freq is 249.9981 Hz, precision is 2**21&#xA;ntp uptime is 6979200 (1/100 of seconds), resolution is 4016&#xA;reference time is DA773F8B.E3CD5B84 (14:28:59.889 CST Tue Feb 23 2016)&#xA;clock offset is -0.3724 msec, root delay is 18.04 msec&#xA;root dispersion is 7.97 msec, peer dispersion is 0.14 msec&#xA;loopfilter state is 'CTRL' (Normal Controlled Loop), drift is 0.000007535 s/s&#xA;system poll interval is 1024, last update was 248 sec ago.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-23T20:51:21.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28110" PostTypeId="2" ParentId="27983" CreationDate="2016-02-23T22:57:20.973" Score="5" Body="&lt;p&gt;The &lt;code&gt;01-00-5E&lt;/code&gt; is commonly called the OUI (Organizationally Unique Identifier), which the IEEE (the group which assigns them) calls MA-L (MAC Address Block Large). Don't read a lot more into it than that. A MAC address does have two flag bits (the two least significant bits in the OUI), and the OUI for multicast correctly uses these bits to identify it as a universal, group MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OUI for multicast was acquired from the IEEE by the creators of multicast. It cost $1000 for an OUI, which was a lot of money at the time, so the cost was split in half. Each of the two people who put up the money got to own half the addresses possible with the OUI. That means that of the 24 address bits (48 MAC address bits minus the 24 OUI bits), each person got 23 bits for addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's why the IP to MAC mapping only uses 23 bits when the multicast group part of an IP address requires 28 bits (Class D, multicast, addresses start with &lt;code&gt;1110&lt;/code&gt; as the first four bits, leaving 28 of the 32 bits in an IP address for the multicast group). Because of mapping 28 bits into 23 bits, each multicast MAC address represents 32 different multicast IPv4 addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-23T23:41:25.670" LastActivityDate="2016-02-23T23:41:25.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28111" PostTypeId="1" AcceptedAnswerId="28112" CreationDate="2016-02-23T23:00:41.930" Score="2" ViewCount="129" Body="&lt;p&gt;While learning networking concepts I learn a network hardware port can be switch port to carry MAC headers or Routed port to carry L3 info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, Cisco MLS concepts as I understand a switch port can carry both MAC and Layer 3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="22423" LastEditorUserId="8499" LastEditDate="2018-12-21T05:02:56.367" LastActivityDate="2018-12-21T05:02:56.367" Title="Cisco MLS - single port carry L2 and L3 packets" Tags="|cisco|routing|switch|router|layer3|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28112" PostTypeId="2" ParentId="28111" CreationDate="2016-02-23T23:17:26.030" Score="1" Body="&lt;p&gt;Even with Cisco MLS, each port is defined as a layer-2 switch port (with the &lt;code&gt;switchport&lt;/code&gt; command) or a layer-3 router port (with the &lt;code&gt;no switchport&lt;/code&gt; command). You can have virtual ports call SVIs for the VLANs of which the layer-2 switch ports are members.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In essence, a layer-3 switch is a layer-2 switch with built-in layer-3 routing. Remember that it is still a layer-2 switch, and the routing features may fall short of what you get with a dedicated router. You will also find hardware not normally associated with LAN switching (e.g., WAN ports) unavailable for most layer-3 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has moved routing features in hardware (ASICs) to ease the processor and memory requirements normally associated with routing. A simple search of the Internet for &lt;code&gt;cisco mls&lt;/code&gt; turns up a lot of hits, including &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/switch/configuration/guide/fswtch_c/xcfmsov.html&quot; rel=&quot;nofollow&quot;&gt;Multilayer Switching Overview&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;MLS provides high-performance Layer 3 switching for Cisco routers and&#xA;  switches. MLS switches IP data packets between subnets using advanced&#xA;  application-specific integrated circuit (ASIC) switching hardware.&#xA;  Standard routing protocols, such as Open Shortest Path First (OSPF),&#xA;  Enhanced Interior Gateway Routing Protocol (Enhanced IGRP), Routing&#xA;  Information Protocol (RIP), and Intermediate System-to-Intermediate&#xA;  System (IS-IS), are used for route determination.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You will also find hits with links to Cisco documentation on how to configure MLS, including examples.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-23T23:17:26.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28113" PostTypeId="2" ParentId="26152" CreationDate="2016-02-24T02:36:06.120" Score="1" Body="&lt;p&gt;Have I heard of such a system? no Could such a system be built? absoloutely! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An obvious simple method would be to give each packet an ID number in your &quot;expander&quot;. Then in your &quot;contractor&quot; you check if the sequence number has already been received. If it hasn't you de-encapsulate the data. If it has you drop the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Linux provides &quot;TUN&quot; and &quot;TAP&quot; interfaces which let you create virtual network interfaces from userspace so it shouldn't be too hard to whip up a prototype of such an idea. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-02-24T02:36:06.120" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28114" PostTypeId="1" CreationDate="2016-02-24T02:52:26.487" Score="36" ViewCount="8855" Body="&lt;p&gt;I always have seen Ethernet Standards written in the form &quot;&lt;em&gt;low value/middle value/max value&lt;/em&gt;&quot;, and always wondered why. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Won't a router just reproduce a lower speeds anything below its maximum if it's configured as such, therefore making &quot;/&quot; unnecessary? &lt;/p&gt;&#xA;" OwnerUserId="23147" LastEditorUserId="8499" LastEditDate="2018-12-20T21:14:39.177" LastActivityDate="2018-12-20T21:14:39.177" Title="Why are Ethernet Standards written in the form of 10/100/1000? Why not just 1000?" Tags="|ethernet|layer1|bandwidth|standardisation|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28115" PostTypeId="2" ParentId="28114" CreationDate="2016-02-24T03:41:04.870" Score="26" Body="&lt;p&gt;Good question. To answer it fully would involve a pretty deep look at Ethernet Wiring. But I'll try to explain it in simpler language. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All three speeds (10, 100, 1000) run over the same physical wiring: Unshielded Twisted Pair (&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#utp&quot;&gt;UTP&lt;/a&gt;).  UTP is made up of 4 &lt;em&gt;pairs&lt;/em&gt; of wires (8 total wires) -- each pair is &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#why_twisted_pair&quot;&gt;twisted around each other&lt;/a&gt;. Each pair of wires work together to send signals across to the other end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What enables the same physical cabling to carry bits across the wire at such vastly different speeds are the different ways each of the 4 pairs of wires are used. We'll have to discuss three separate ideas: Standards and Wire Usage, Bits Transmitted, and Frequency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;Standards and Wire Usage&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#100base-tx&quot;&gt;100BASE-TX&lt;/a&gt; is the predominant standard that governs transmission rates of 100mbps over UTP. It does this by dedicating one pair of wires for transmission, and the other pair of wires for receiving -- the remaining two pairs are unused. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#1000base-t&quot;&gt;1000BASE-T&lt;/a&gt; is the predominant standard that governs transmission rates of 1000mbps over UTP. It does this by using all four wire pairs, at the same time, in both directions. Each pair is responsible for carrying about 250Mbps of traffic at a time, providing for a total throughput of 1000Mbps, or 1Gbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;Bits Transmitted&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the other differences between 100BASE-TX and 1000BASE-T is that each transmit bits across the wire differently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, at any given time a certain voltage signal on the wire represents a certain value. In 100BASE-TX, there are only two possible values that can exist: a value of &lt;strong&gt;&lt;code&gt;0&lt;/code&gt;&lt;/strong&gt; or a value of &lt;strong&gt;&lt;code&gt;1&lt;/code&gt;&lt;/strong&gt;. You could say that at any given instance, a single bit can be &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#sending_bits&quot;&gt;transferred across the wire&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 1000BASE-T, there are &lt;em&gt;four&lt;/em&gt; possible voltage values that can exist on the wire: &lt;strong&gt;&lt;code&gt;00&lt;/code&gt; &lt;code&gt;01&lt;/code&gt; &lt;code&gt;10&lt;/code&gt; &lt;code&gt;11&lt;/code&gt;&lt;/strong&gt;. Or, said differently, each instance of signal being applied to UTP in the 1000BASE-T standard transfers &lt;em&gt;two bits&lt;/em&gt; at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;Frequency&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;100BASE-TX calls for a &lt;a href=&quot;https://www.google.com/search?q=utp%20frequency&quot;&gt;frequency of 100Mhz&lt;/a&gt;, which means each a signal can be applied and read by the other side 100 million times per second. This ends up being the speed at which each pair of wires can transmit either a &lt;code&gt;1&lt;/code&gt; or a &lt;code&gt;0&lt;/code&gt;. This is what gets 100BASE-TX its 100Mbps speed, because each 'instance' of signal being applied equates to a single bit being transmitted. And since there are two pairs being used (one in each direction), that equates to 100Mbps in one direction, and 100Mbps in the other, or a total of 100Mbps full duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1000BASE-T calls for the use of 125Mhz frequency, which means a signal can be read off the (pair of) wires 125 million times per second. Since each instance of a signal being applied in 1000BASE-T sends two bits across the wire, this means each pair can transfer 250 million bits across the wire per second, or 250Mbps. Since there are four pairs being used, this grants a total of 1000Mbps, or 1gbps speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;Summary&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are some of the methods that a single physical cabling specification (UTP) is able to transmit data at such vast different speeds (10Mbps, 100Mbps, 1000Mbps -- or 10/100/1000). Think of it from the terms of technology evolution -- engineers found new ways to transmit data over the same wire. As such, the single wire can do multiple speeds at the same time. A single UTP wire can do 10, 100, or 1000 million bits per second, hence the wires and interfaces are labeled 10/100/1000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;sup&gt;I'm afraid I don't know the specifics of how 10BASE-T transferred bits across the wire, so I can't describe how that works like I did the other two standards&lt;/sup&gt;&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="23159" LastEditDate="2016-02-24T15:38:22.343" LastActivityDate="2016-02-24T15:38:22.343" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28116" PostTypeId="2" ParentId="28114" CreationDate="2016-02-24T03:43:07.287" Score="7" Body="&lt;p&gt;It really boils down to needing to support legacy devices and cabling. Cisco has a pretty good document, &lt;a href=&quot;http://docwiki.cisco.com/wiki/Ethernet_Technologies&quot;&gt;Ethernet Technologies&lt;/a&gt;, which explains a lot in depth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet has been around for a very long time. It was commercialized in 1981 at 10 Mbps. At first, it was pretty expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remember ethernet cards costing $750 at a time when that was a lot of money. It took many years and a lot of argument for it to reach 100 Mbps, and a little while for the current 100BASE-TX standard to emerge as the winner. At the time, it was pretty expensive compared to 10BASE-T, so it was relegated to data centers and high-speed needs for a long time. The ports were built with backward compatibility with 10BASE-T because that was the most prevalent out there, and you may need to connect with that from a switch, router, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The price of 100 Mbps finally came down when 1000Base-T was released. Again, it was quite expensive compared to 100Base-TX, and it remained in data centers an big servers for a long time before the price came down. And it needed to be compatible with the more prevalent slower speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10GBASE-T is now in the premium position, used primarily in data centers and on servers. It, too will eventually become mainstream, built into most new equipment, but it will need to maintain backward compatibility for many years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;40 and 100 Gbps Ethernet currently have a niche in the market, and market forces will determine which, and which standard of each, becomes the most prevalent. As they become more common, prices for 10GBASE-T will drop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The R&amp;amp;D has already been done for the slower speeds, and ethernet is basically built on a chip now, so it really doesn't cost any more to offer the slower speeds since there are still legacy devices around which need the slower speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco document in the link above was written a long time ago, but the principles are still valid, and the first question is basically the same thing you are asking.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Review Questions&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Q - Shouldn't all 10Base-T networks just be upgraded to 100 Mbps? Why&#xA;  or why not?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A - Not necessarily-if the current 10Base-T network is repeater-based,&#xA;  replacing the repeaters with 10/100 nonsaturating switches would&#xA;  result in an automatic n times increase in the average available&#xA;  bandwidth for each end station.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Q - Which 100Base version(s) are recommended? Why?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A - 100Base-TX is recommended if the horizontal wiring is Category5 or&#xA;  better UTP. If the horizontal cabling is Category 3, 100BaseT4 can be&#xA;  used, but it may be difficult to acquire (some reports indicate that&#xA;  because 100Base-TX was available more than a year before T4, it&#xA;  captured as much as 95 percent of the market). 100Base-T2 is not&#xA;  available.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Q - Which 1000Base version(s) are recommended? Where would they be&#xA;  used?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A - 1000Base-T, is recommended if the horizontal cabling is Category 5&#xA;  or better UTP. 1000Base-SX can be used if the horizontal cabling is&#xA;  multimode optical fiber, as well as for some multimode backbones.&#xA;  1000Base-LX can be used for either single-mode or multimode optical&#xA;  fiber (see Table 7-5). 1000Base-CX can be used for short-haul&#xA;  equipment-room jumpers up to 25 meters.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Q - What cable types should be used for new networks? For upgrading&#xA;  existing networks? Why?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A - New or replacement UTP links may be Category 5E or better to allow&#xA;  for data rate growth to 1000 Mbps. Multimode fiber may be used as&#xA;  indicated in Table 7-5 for 1000Base-SX, or as noted in the paragraph&#xA;  following Table 7-5 for 1000Base-LX. (These fibers will also provide&#xA;  future support for shorter distances [between 100 and 300 meters,&#xA;  depending on the wavelength] at 10,000 Mbps.) To be truly future-proof&#xA;  and to ensure that you will be able to operate longer-distance&#xA;  backbones, choose single-mode fiber.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Q - How do you know when a network needs to be upgraded? Where do you&#xA;  start?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A - There are several ways:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Your users will tell you (but often only after they have crossed the    frustration threshold).&lt;/li&gt;&#xA;  &lt;li&gt;Your network management system should be capable of indicating the    load characteristics for each DCE port.&lt;/li&gt;&#xA;  &lt;li&gt;Your organization is considering adding new applications (such as    multimedia) that will require more communication bandwidth.&lt;/li&gt;&#xA;  &lt;li&gt;Your organization is growing, and there are not sufficient DCE ports    in the right locations to accommodate the additional users.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;After you have determined the need, you can consider the options.&#xA;  Remember that the network elements with the longest useful life (the&#xA;  link media, followed by the network servers and network switches) can&#xA;  also be the most expensive to replace. Choose with an eye to future&#xA;  growth, and consider reusing these elements wherever possible.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-24T07:46:46.807" LastActivityDate="2016-02-24T07:46:46.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28117" PostTypeId="2" ParentId="28114" CreationDate="2016-02-24T04:13:35.460" Score="43" Body="&lt;p&gt;They include this because not all ports are able to run at multiple speeds or certain speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running at only one speed was probably most common when 100BASE-TX first came out and a number of switches had fixed 100BASE-TX ports as uplink ports with 10BASE-T ports for providing access. However, it is common for many GBIC/SFP based ports to only run at a certain designated speed (for example 100 Mbps or 1000 Mbps).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moving forward, you will start seeing support for some lower speeds getting dropped. Cisco is no longer providing support for 10BASE-T with their new &quot;multi-Gig&quot; ports. I am not sure if this is a design choice by Cisco or also part of the IEEE 802.3bz amendment that is still in the works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also will find most (AFAIK all, but not 100% certain) ports on the Cisco Nexus platform will no longer support 10BASE-T and are designated as 100/1000 ports (or 1000/10000 ports which don't support 100BASE-TX).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And it isn't only Cisco. Other vendors providing 10G capability often limit the ports to 1/10G or 100/1000/10000 speeds. As examples, HP has several products that follow the dual-speed model and Extreme tends to use the tri-speed model for their 10G copper ports.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2016-02-24T15:03:42.310" LastActivityDate="2016-02-24T15:03:42.310" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28118" PostTypeId="1" CreationDate="2016-02-24T04:34:33.253" Score="1" ViewCount="641" Body="&lt;p&gt;Had a crash showing on a EOL/EOS 4510R. Can the crash be determined from the first few sections of the crash dump file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also had a crash a month ago, and I consistently see the same &lt;code&gt;BusErrAddr=D00010A0&lt;/code&gt; in the two crash dump files, as well as a number of hits on the Internet; what is special about this addr?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;System returned to ROM by power-on.&#xA;...&#xA;Last reset from Abort&#xA;&#xA;s-oc2-3h-bb2#more crashinfo:data&#xA;&#xA;Last powerfail: 06/15/2013 21:38:24&#xA;&#xA;Current time: 02/23/2016 20:31:30&#xA;&#xA;Last reload status: 00000C00 038D0000&#xA;&#xA;&#xA;&#xA;Last crash: 02/23/2016 18:34:45&#xA;&#xA;Build: 12.2(54)SG ENTSERVICESK9&#xA;buildversion addr: 12F841B4&#xA;&#xA;pc=1234D8E8 lr=1234D8E4 msr=40029030 vector=00000300&#xA;cr=42024022 ctr=123EF2F8 xer=00000000&#xA;r0=1234D8E4 r1=1433A098 r2=0000C000 r3=194FD9C4&#xA;r4=18947FC0 r5=18D3C120 r6=00000000 r7=13204E98&#xA;r8=18947FC0 r9=000000F3 r10=00000000 r11=00000000&#xA;r12=00000000 r13=FFFFFFFF r14=11D1D160 r15=126BAD1C&#xA;r16=00000001 r17=00000001 r18=142B5CB8 r19=1433A820&#xA;r20=1853F4E4 r21=00000001 r22=144EBC00 r23=00000000&#xA;r24=3B7E6A54 r25=1433A228 r26=00000000 r27=00000001&#xA;r28=1433A150 r29=194FD96C r30=00000014 r31=00000000&#xA;dec=0003BEC8 tbu=0000790A tbl=5BFF5ACA&#xA;dar=00000000 dsisr=00000000 hid0=8000C000&#xA;&#xA;ErrDr1=00 ErrDr2=00 ErrStsCpu=72 ErrStsPci=00&#xA;BusErrAddr=D00010A0&#xA;Single bit ECC count 0&#xA;&#xA;&#xA;Traceback: 1234D8E8 1234D8E4 1234D8E4 1234D8E4 1234D8E4 1234DAD4 123EF318 1222F128 12230214 123C42A0 11F94484 11F94C6C 11F0AD78 11F0&#xA;DAB8 11F05CA4 11F09B3C 12346EEC 123483CC 11E5FC38 11E5FCA4 11D1CD58 11D1D0C0 11D1D2A0 108DA264 108D1254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;And, yes, it's an old image, thank you.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="630" LastEditorUserId="619" LastEditDate="2016-02-24T05:41:06.980" LastActivityDate="2016-02-24T05:47:43.980" Title="Cisco 4510R crash &quot;Last reset from Abort&quot;" Tags="|cisco-catalyst|cisco-4500|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28119" PostTypeId="1" CreationDate="2016-02-24T05:19:34.390" Score="0" ViewCount="621" Body="&lt;p&gt;I am using Meraki MX80 for NAT. There are a bunch of internal subnets, and the NAT works as expected. A colleague raised the question, what happens if a packet spoofs its source IP to something that's not in those internal subnets. Will such packets be dropped?&lt;/p&gt;&#xA;" OwnerUserId="20524" LastActivityDate="2016-02-24T15:29:00.500" Title="IP spoofing behind Meraki NAT" Tags="|nat|ip|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-13T18:29:02.383" ContentLicense="CC BY-SA 3.0" />
  <row Id="28120" PostTypeId="2" ParentId="28118" CreationDate="2016-02-24T05:47:43.980" Score="2" Body="&lt;p&gt;Yes, the crashdump contains a great deal of information. The ones I have archived here are 200-300k of information. Cisco can make sense of what's in there; end-users, not so much. (as this is an EOL device, Cisco won't bother.) However, there is a tool to look at the trace-back information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In all likelihood, this is a sign of bad RAM. There were problems with a batch of systems a while back.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-02-24T05:47:43.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28121" PostTypeId="1" AcceptedAnswerId="28124" CreationDate="2016-02-24T06:44:51.907" Score="1" ViewCount="13200" Body="&lt;p&gt;If I have been assigned the address &lt;code&gt;164.12.130.0/23&lt;/code&gt; in a network block. What is the maximum number of subnets that can be defined?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What will be the IP addresses of those subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not a Home Work question. I came across this question while reading up an article.&lt;/p&gt;&#xA;" OwnerUserId="23148" LastEditorUserId="23148" LastEditDate="2016-02-24T06:52:20.133" LastActivityDate="2018-08-24T07:46:23.860" Title="Maximum number of Subnets" Tags="|subnet|ip|" AnswerCount="1" CommentCount="1" ClosedDate="2016-02-24T15:51:58.397" ContentLicense="CC BY-SA 3.0" />
  <row Id="28122" PostTypeId="2" ParentId="28096" CreationDate="2016-02-24T10:31:32.637" Score="3" Body="&lt;p&gt;Clustered Fortigate units become ONE unit in terms of L3 IP addresses, L2 MAC addresses, policies, objects etc. Only a few HA parameters along with the hostname are not mirrored from master to slave(s). The primary's IP addresses are used for the cluster; all slave addresses are overwritten. The real MAC addresses are hidden as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Active management of a slave unit is so uncommon that it's restricted to the CLI. Rebooting, shutting down, separating from the cluster come to my mind. To monitor CPU, memory and throughput you have GUI controls in System &gt; Config &gt; HA &gt; HA statistics.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's an exception to every rule. On Fortigate models starting in midrange (100D and up) you often find 'management ports'. These are physical ports which you can dedicate to management only - they will not route. They are the only ports that can be in the same subnet as other ports on the Fortigate. You can connect to each cluster unit then via GUI.&lt;br&gt;&#xA;The Fortigate 60D does not have these special kind of ports.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-02-24T10:31:32.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28123" PostTypeId="1" CreationDate="2016-02-24T10:51:33.613" Score="0" ViewCount="72" Body="&lt;p&gt;I'm interested in the individual history of the probe request specifically - when and where the agreements were made for the protocol to function as it does today.  Anyone have any good history lessons to share?&lt;/p&gt;&#xA;" OwnerUserId="23155" LastActivityDate="2016-06-16T02:14:02.457" Title="History of the probe request?" Tags="|wireless|ip|packet-analysis|access-point|" AnswerCount="1" CommentCount="0" ClosedDate="2019-03-09T03:25:27.633" ContentLicense="CC BY-SA 3.0" />
  <row Id="28124" PostTypeId="2" ParentId="28121" CreationDate="2016-02-24T10:54:01.247" Score="9" Body="&lt;p&gt;A &lt;code&gt;/23&lt;/code&gt; block contains 512 addresses. 2^(32-23)=512&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use them to make any number of subnets that you want. For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2 subnets of 256 addresses (254 hosts, 1 for subnet and one for broadcast)&lt;/li&gt;&#xA;&lt;li&gt;4 subnets of 128 addresses (126 hosts, 1 for subnet and one for broadcast)&lt;/li&gt;&#xA;&lt;li&gt;8 subnets of 64 addresses (62 hosts, 1 for subnet and one for broadcast)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and so on... up to&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;128 subnets of 4 addresses (2 hosts, 1 for subnet and one for broadcast) &lt;code&gt;*This is the max number of useful subnets&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;256 subnets of 2 addresses (May be used for point-to-point-links. &lt;a href=&quot;http://www.faqs.org/rfcs/rfc3021.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3021&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;In addition you can mix and match, for example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 subnet of 256 addresses and 2 of 128 addresses&lt;/li&gt;&#xA;&lt;li&gt;2 subnets of 128 addresses, 3 of 64 addresses and 2 of 32 addresses.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;It's your necessity the thing that should determine which subnetting is the most useful.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2018-08-24T07:46:23.860" LastActivityDate="2018-08-24T07:46:23.860" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="28126" PostTypeId="1" AcceptedAnswerId="28134" CreationDate="2016-02-24T14:23:13.220" Score="6" ViewCount="59115" Body="&lt;p&gt;On a CAT 7 Ethernet cable each twisted pair is individually shielded, and all pairs together are inside a shielded jacket:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6yZ8x.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6yZ8x.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Colors of the wires may change, for instance I recently got my hands on a cable where the wires were all different:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;red &amp;amp; orange&lt;/li&gt;&#xA;&lt;li&gt;yellow &amp;amp; brown&lt;/li&gt;&#xA;&lt;li&gt;white &amp;amp; blue&lt;/li&gt;&#xA;&lt;li&gt;black &amp;amp; aqua&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When crimping a RJ-45 plug, should we follow the same order as in 568B, i.e. the four twisted pairs go to pins 1-2 4-5 7-8 3-6, as in the figure... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FoeXV.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FoeXV.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;... or any order of the wires (provided they match at both cable ends, of course) will work fine? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a CAT 7 cable, a wire is protected from crosstalk from its pair because of the twisting, and is protected from crosstalk from all other wires because of the double shielding, so I'd lean towards the second option. &lt;/p&gt;&#xA;" OwnerUserId="19543" LastEditorUserId="8499" LastEditDate="2018-03-02T22:23:51.230" LastActivityDate="2022-10-13T20:33:38.440" Title="CAT7 Ethernet cable: order of wires in the clamp" Tags="|ethernet|layer1|cable|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28127" PostTypeId="2" ParentId="28126" CreationDate="2016-02-24T14:44:14.937" Score="4" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;In a CAT 7 cable, a wire is protected from crosstalk from its pair because of the twisting, and is protected from crosstalk from all other wires because of the double shielding, so I'd lean towards the second option.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Umm no. The pair as a whole is protected from crosstalk with other things by a combination of the twisting and the use of differential signaling. The shielding helps a bit, too, but it's not the main line of defense (witness that most categories of twisted pair don't have it. The two wires within a pair most definitely interact with each other).&lt;/p&gt;&#xA;&lt;p&gt;You need to make sure that the wires are paired correctly (that is that the pairs of pins that are supposed to connect to a twisted pair or wires are actually connected to a twisted pair of wires) or the cable will have terrible signal integrity and crosstalk, and will most likely be unusable for anything over 10BASE-T (and even 10BASE-T is probably a crapshoot).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="31800" LastEditDate="2022-10-13T20:33:38.440" LastActivityDate="2022-10-13T20:33:38.440" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="28130" PostTypeId="2" ParentId="28119" CreationDate="2016-02-24T15:29:00.500" Score="1" Body="&lt;p&gt;Agree with Ron Maupin.  More details would need to be provided.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that being said, the default behavior would be to drop the packet if it doesn't hold the route for the IP address.  Your packets would send out but the firewall wouldn't be able to return the ingress packets over the same session, thus your route would break.  If your device that was spoofing the IP was also configured to respond to the same spoofed IP, then it may work.  Of course, none of the spoofed traffic would work if your Meraki wasn't set to NAT the said spoofed subnet/IP in the first place.&lt;/p&gt;&#xA;" OwnerUserId="23139" LastActivityDate="2016-02-24T15:29:00.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28131" PostTypeId="1" AcceptedAnswerId="28133" CreationDate="2016-02-24T15:30:51.340" Score="3" ViewCount="4181" Body="&lt;p&gt;Is it just computers that are called hosts? Or routers are called hosts as well?&lt;/p&gt;&#xA;" OwnerUserId="23113" LastActivityDate="2019-12-09T19:13:50.760" Title="Are routers called hosts as well in a TCP/IP network?" Tags="|router|ip|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28132" PostTypeId="2" ParentId="28131" CreationDate="2016-02-24T15:41:17.277" Score="1" Body="&lt;p&gt;&quot;host(s)&quot; is not synonymous with a type of device.  Rather, it identifies a system that is &quot;hosting&quot; data or service(s).  A router could be considered a host in the proper context.  A router could, although there is more clear terminology for it, be considered a host for a specific route to a said subnet that needs the route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose I was speaking more to the vernacular of IT/IS circles I work within than official definition.  &lt;/p&gt;&#xA;" OwnerUserId="23139" LastEditorUserId="23139" LastEditDate="2016-02-24T16:40:33.103" LastActivityDate="2016-02-24T16:40:33.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28133" PostTypeId="2" ParentId="28131" CreationDate="2016-02-24T15:42:05.310" Score="6" Body="&lt;p&gt;Although in some literature a host is any system that has an IP address, it more generally refers to &amp;quot;end systems&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;A definition of host is given in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122#section-1.1.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1122&lt;/a&gt; :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;1.1.1  Internet Hosts&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;     A host computer, or simply &amp;quot;host,&amp;quot; is the ultimate consumer of&#xA;     communication services.  A host generally executes application&#xA;     programs on behalf of user(s), employing network and/or&#xA;     Internet communication services in support of this function.&#xA;     An Internet host corresponds to the concept of an &amp;quot;End-System&amp;quot;&#xA;     used in the OSI protocol suite [INTRO:13].&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Following this definition, routers are not hosts (nor switches for example).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-02-24T15:42:05.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28134" PostTypeId="2" ParentId="28126" CreationDate="2016-02-24T15:58:03.080" Score="7" Body="&lt;p&gt;Category-7 cable has not yet been recognized by ANSI/TIA/EIA. The only currently recognized cables are Category-3 (still talking about eliminating it), Category-5E, Category-6 (may not be recognized in the next revision), and Category-6A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are referencing an ANSI/TIA/EIA color code, so it is no surprise that un-recognized cabling has different colors. If Category-7 cabling is ever recognized, the manufacturers will need to adhere to the ANSI/TIA/EIA standards to be able to call the cable they produce by the recognized category.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using this for ethernet, you will still need to follow the ethernet pinout of pairs: 1-2, 3-6, 4-5, and 7-8. Not pairing correctly will cause you no end of grief. Also, You need to make sure your equipment can proper ground the shielding. Most new equipment from the major manufacturers does this correctly, but some of the cheap stuff doesn't. Without proper connection of the shield in all the connectors (continuous the length of the cable, from one device to the device on the other end), and the shield is properly grounded on both ends, you wasted a lot of money on expensive cable that doesn't perform as it should.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-24T16:09:52.690" LastActivityDate="2016-02-24T16:09:52.690" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28135" PostTypeId="1" AcceptedAnswerId="43309" CreationDate="2016-02-24T16:21:27.830" Score="2" ViewCount="382" Body="&lt;p&gt;Most of the reading I've done about P2P networks are either about small scale simple mesh networks, where every peer can talk to another, or about high level protocols such as bittorrent, where data comes from a variety of sources, and locations can be decentralized by using a distributed hash table. But it still uses IP for routing packets, so packets will go to an ISP and large nodes and then filter back down to a small node again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is because of the number of IP addresses, no one node can store them all, so packets have to be passed up to large nodes first, in the same way that a letter goes to the main sorting office of a country first, then to a city etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given a very large network, would be possible to route a packet in an efficient manner without using high level addressing and passed between nodes of equal size, e.g. without saying &lt;code&gt;217.34.33.243&lt;/code&gt;, don't know where that goes, send it to &lt;code&gt;217&lt;/code&gt; block, and they can send it on to subdivision &lt;code&gt;34&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not quite sure what the right terms are for what I'm asking, so that would be useful as well. I'm calling it peer-to-peer and decentralized, but I'm not sure if that's correct.&lt;/p&gt;&#xA;" OwnerUserId="16633" LastEditorUserId="8499" LastEditDate="2017-08-16T18:20:27.793" LastActivityDate="2017-08-17T02:20:28.410" Title="Is an entirely decentralised peer-to-peer network feasible? How far could it be scaled?" Tags="|routing|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="28136" PostTypeId="1" CreationDate="2016-02-24T16:44:19.847" Score="3" ViewCount="2747" Body="&lt;p&gt;I have a project which i'm struggling with and wondered if someone can offer some advise on the best way to achieve my goal (i'm new to Juniper).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment I have 2 juniper srx240, one connected a 100Mb fibre, and the other connected to 10 Mb EFM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to set them up to allow for automatic fail over from one ISP to the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Idea being if the main 100Mb goes down that the backup automatically kicks back in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also need to setup 3 virtual routing instances, and two dmz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;idea being there is one instance for WAN, internet and VOIP traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attached is a picture to help explain the setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be greatly appreciated&lt;a href=&quot;https://i.stack.imgur.com/4jsFj.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4jsFj.jpg&quot; alt=&quot;n&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="23169" LastActivityDate="2016-11-21T03:37:14.457" Title="how to setup dual ISP fail over with 2 routers" Tags="|juniper|failover|srx|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28137" PostTypeId="2" ParentId="28126" CreationDate="2016-02-24T17:00:33.697" Score="2" Body="&lt;p&gt;Yes, the pin position and wire-pairs are set and must be consistent. You can not pick any two wires and call them a pair.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Pin position 4 &amp;amp; 5 are the first pair.&lt;/li&gt;&#xA;&lt;li&gt;Pin position 1 &amp;amp; 2 are the second pair.&lt;/li&gt;&#xA;&lt;li&gt;Pin position 3 &amp;amp; 6 are the third pair.&lt;/li&gt;&#xA;&lt;li&gt;Pin position 7 &amp;amp; 8 are the fourth pair.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4UjsX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4UjsX.png&quot; alt=&quot;Pin Positions and Pairs&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;em&gt;Edit: In Hindsight, everything I had wrote after this didn't really speak to the original question, so I'll edit it out and instead just leave links&lt;/em&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In a CAT 7 cable, a wire is protected from crosstalk from its pair because of the twisting, and is protected from crosstalk from all other wires because of the double shielding.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The shielding helps with reducing inbound crosstalk, but the main protection against inbound crosstalk (otherwise known as EMI - eloctro magnetic interference). is simply the twists themselves.  You can read more about how both Crosstalk and EMI is reduced &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#why_twisted_pair&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2016-02-24T17:24:54.400" LastActivityDate="2016-02-24T17:24:54.400" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28138" PostTypeId="2" ParentId="28136" CreationDate="2016-02-24T17:51:07.647" Score="0" Body="&lt;p&gt;I run this setup with a few clients of mine on varying SRX models.  First, I would suggest that you cluster your SRXs, which requires getting them to a matching firmware version (always use JTAC's recommendation for your model).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you haven't setup a cluster before, here's a link to get you started:&#xA;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB15504&amp;amp;actp=search&quot; rel=&quot;nofollow&quot;&gt;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB15504&amp;amp;actp=search&lt;/a&gt;&#xA;You can also call JTAC and they'll actually assist you in configuring the cluster and the failover routing if you prefer.  Also, to do this properly, you'll want two leads coming from your ISP's box(modem, L3 switch, or whatever it is).  If your ISP won't accommodate this, then you can use a switch but that just adds a point of failure.  Doing all of this will allow either one of your SRXs to run either one of your ISPs at any given time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the ISP failover/traffic splitting there are varying configuration possiblities.  The simplest, is to just modify your static routes to include a qualified-next-hop.  Again, there are several ways to configure the actual failover/HA portion between your ISPs but clustering your SRXs and connecting both ISPs to them is the best redundancy you can achieve. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your traffic routing between ISPs for Voice and Data, are you going to be running your Voice network/subnet across the same physical switch stack as your data network?  Basically, you'll need to create a separate interface/sub-interface on your Junipers and then assign that to a separate Security Zone.  Once you've done this, you can NAT/route according to your needs.&lt;/p&gt;&#xA;" OwnerUserId="23139" LastEditorUserId="23139" LastEditDate="2016-02-24T18:02:38.743" LastActivityDate="2016-02-24T18:02:38.743" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28139" PostTypeId="1" AcceptedAnswerId="28142" CreationDate="2016-02-24T18:37:01.783" Score="0" ViewCount="961" Body="&lt;p&gt;I know this is the DHCP process:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Discover&lt;/strong&gt;: Host broadcasts “DHCP discover” message  &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Offer&lt;/strong&gt;: DHCP server responds with “DHCP offer” message &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Request&lt;/strong&gt;: host requests IP address: “DHCP request” message&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Acknowledge&lt;/strong&gt;: DHCP server sends address: “DHCP acknowledge” message&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My question is, &lt;em&gt;how the DHCP server knows who sent the broadcast if the sending computer don't have an IP yet?&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="23170" LastActivityDate="2016-02-24T21:05:06.617" Title="How DHCP works?" Tags="|ip|dhcp|" AnswerCount="3" CommentCount="1" FavoriteCount="0" ClosedDate="2016-02-25T00:40:58.737" ContentLicense="CC BY-SA 3.0" />
  <row Id="28140" PostTypeId="2" ParentId="28126" CreationDate="2016-02-24T18:56:40.307" Score="4" Body="&lt;p&gt;There are many different color codes in the world, depending on where you are, which industry the cabling is intended for, and which companies' products you use. I am unfamiliar with any color code that matches the color-pairs you provided although the colors are used in some of them. Doesn't mean it doesn't exist somewhere, simply that I am unaware of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also come across cables that are bought because it is cheap that doesn't adhere to any color codes. The manufacturers use whichever colors they can acquire that happens to be the least expensive at the time. As a step up, I have seen cables that follow the color codes, but are inconsistent within the same cable (for example, first pair may be white/blue, second pair white-orange/orange, third a pale green/darker green, and the fourth a &quot;translucent&quot; brown/solid brown).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While you can sometimes get away with changing the order of the pairs, the pairs themselves must be maintained. If you mix individual wires between multiple pairs, then you negate the advantages of twisted pair wiring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Twisted pair wiring is also sometimes referred to as balanced pair as the two individual wires in the pair carry equal and opposite signals which helps negate the impact of outside EMI and crosstalk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more resources by searching online, but I will provide Wikipedia links for quick reference if you want to know more:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Balanced_line&quot; rel=&quot;nofollow&quot;&gt;Balanced line&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Twisted_pair&quot; rel=&quot;nofollow&quot;&gt;Twisted Pair&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Differential_signaling&quot; rel=&quot;nofollow&quot;&gt;Differential Signalling&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-02-24T18:56:40.307" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28141" PostTypeId="2" ParentId="28139" CreationDate="2016-02-24T19:00:10.417" Score="1" Body="&lt;p&gt;The sending computer is known by its physical address (MAC address).&lt;/p&gt;&#xA;" OwnerUserId="23172" LastActivityDate="2016-02-24T19:00:10.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28142" PostTypeId="2" ParentId="28139" CreationDate="2016-02-24T19:09:36.733" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;how the DHCP server knows who sent the broadcast if the sending computer don't have an IP yet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The server usually identifies the client by its MAC address. However, it might use the field 'client identifier' option, if present.&lt;/p&gt;&#xA;&lt;p&gt;See also:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2131&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2131&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="498" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-02-24T19:09:36.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28143" PostTypeId="1" AcceptedAnswerId="28144" CreationDate="2016-02-24T19:11:40.447" Score="0" ViewCount="430" Body="&lt;p&gt;My &lt;code&gt;ifconfig&lt;/code&gt; configuration is &lt;code&gt;inet addr:192.168.1.3&lt;/code&gt; and when I try to get know the router ip by executing &lt;code&gt;ip route show | grep -i 'default via'| awk '{print $3 }'&lt;/code&gt; i get &lt;code&gt;192.168.1.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remember this ipv4 addresses from provider handbook, so they are roughly the same for all ethernet and routers config in my district. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How can I get know my real &lt;code&gt;ip&lt;/code&gt; address?&lt;/li&gt;&#xA;&lt;li&gt;Who and where assigns me unique &lt;code&gt;ip&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;li&gt;Why do provider assign this standard ip for everyone? &lt;/li&gt;&#xA;&lt;li&gt;If I get know my unique id will I be able to establish TCP | UDP connection? How does transmission works &lt;code&gt;unique_ip&lt;/code&gt; -&gt; 'router_ip' -&gt; 'ethernet_ip' will not it be passed to my friend why share with me router? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23174" LastActivityDate="2016-02-24T19:28:51.460" Title="How do my router obtain normal ip address" Tags="|router|ipv4|" AnswerCount="1" CommentCount="1" ClosedDate="2016-02-24T21:00:18.270" ContentLicense="CC BY-SA 3.0" />
  <row Id="28144" PostTypeId="2" ParentId="28143" CreationDate="2016-02-24T19:28:51.460" Score="2" Body="&lt;p&gt;I'm not completely following your question. Any IP address assigned to your computer is a real IP address which your computer uses. It may be a private IP address which can be reused in different networks, or it may be a public address which is supposed to be unique in the world (I think this is what you mean). IP addresses are assigned to your computer either by being statically assigned, or being assigned through DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to know the public IP address assigned to your router, then you can look in your router, or browse one of the websites which will tell you what your public IP address is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP owns one or more blocks of public IP addresses, and it will assign your router an address via DHCP or PPP. Since some RIRs no longer have nay blocks of public IPv4 addresses to assign to the ISPs, many ISP have started using CGN which will assign private IP addresses to your router. This causes a double-NAT, which causes all kinds of problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP does not assign your private IP addresses, you do that. There are three blocks of private IP addresses (&lt;code&gt;10.0.0.0/8&lt;/code&gt;, &lt;code&gt;172.16.0.0/12&lt;/code&gt;, and &lt;code&gt;192.168.0.0/16&lt;/code&gt;) which you can use to assign your private IP addressing. The router manufacturers all used to use &lt;code&gt;192.168.0.0/24&lt;/code&gt;, but in recent years, they have mostly moved to using &lt;code&gt;192.168.1.0/24&lt;/code&gt;. It doesn't matter which block of private addresses you use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your router is running NAT which translates all your private addresses to a single public address (assuming your ISP isn't using CGN). In order to reach your LAN from the public Internet, you will need to set up NAT forwarding rules to be able to translate from the public IP address to one of your private IP addresses. This is known as port forwarding, and it is done by TCP or UDP port number, and you can only have one TCP or UDP port reach one private IP address inside your LAN. For instance, if you run a web server (nominally port 80), you can configure your router to forward any traffic arriving on the public address using port 80 to the web server inside your LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-24T19:28:51.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28145" PostTypeId="1" CreationDate="2016-02-24T19:29:15.937" Score="1" ViewCount="128" Body="&lt;p&gt;RTR configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname T-RTR&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;enable secret 5 $1$g2ly$xT6VHT1gXBTLuXp6uJlp./&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;multilink bundle-name authenticated&#xA;!&#xA;cts logging verbose&#xA;!&#xA;!&#xA;license udi pid CISCO1921/K9 sn FGL1943200R&#xA;!&#xA;!&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address dhcp&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1.10&#xA; encapsulation dot1Q 10&#xA; ip address 172.16.10.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1.20&#xA; encapsulation dot1Q 20&#xA; ip address 172.16.20.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1.30&#xA; encapsulation dot1Q 30&#xA; ip address 172.16.30.1 255.255.255.0&#xA;!&#xA;router rip&#xA; version 2&#xA; network 172.16.0.0&#xA; network 192.168.1.0&#xA; no auto-summary&#xA; passive-interface GigabitEthernet 0/1&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;banner motd ^C Unauthorized Access is prohibited!^C&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Network topology: &lt;a href=&quot;https://drive.google.com/open?id=0B_gP-IlJx8dsN1BCTElKa1gwMmIySVdKYVp3Q3pRdXpfM3dv&quot; rel=&quot;nofollow&quot;&gt;https://drive.google.com/open?id=0B_gP-IlJx8dsN1BCTElKa1gwMmIySVdKYVp3Q3pRdXpfM3dv&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BR: it's an RV320 if you guys need some info let me know. It's running DHCP to provide IP addresses to the attached routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;s&gt;I cannot ping from any host on the &lt;code&gt;172.16.x.x&lt;/code&gt; network to my BR interface &lt;code&gt;192.168.1.1&lt;/code&gt;.&lt;/s&gt; - FIXED&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;S&gt;I cannot ping from my BR to RTR g0/1 interface (Where intervlan routing is). &lt;/s&gt;- FIXED&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot ping from any of my hosts to the &lt;code&gt;internet&lt;/code&gt; or my &lt;code&gt;WAN&lt;/code&gt; interface on BR (&lt;code&gt;192.168.13.81/24&lt;/code&gt; with &lt;code&gt;gateway 192.168.13.254&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of my Internal LAN can ping each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;RTR&lt;/code&gt; can ping &lt;code&gt;192.168.13.81&lt;/code&gt;, &lt;code&gt;Internet&lt;/code&gt;,&lt;code&gt;192.168.13.254&lt;/code&gt; and &lt;code&gt;192.168.1.1&lt;/code&gt; (pretty much everything).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i ran debug ICMP on RTR, then tried to ping from BR to int g0/1.x (subinterfaces) on RTR but i get nothing on the debug.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My BR has RIPv2 enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RTR Routing Table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is 192.168.1.1 to network 0.0.0.0&#xA;&#xA;S*    0.0.0.0/0 [254/0] via 192.168.1.1&#xA;      172.16.0.0/16 is variably subnetted, 8 subnets, 2 masks&#xA;R        172.16.1.0/24 [120/2] via 192.168.1.1, 00:00:03, GigabitEthernet0/0&#xA;C        172.16.10.0/24 is directly connected, GigabitEthernet0/1.10&#xA;L        172.16.10.1/32 is directly connected, GigabitEthernet0/1.10&#xA;C        172.16.20.0/24 is directly connected, GigabitEthernet0/1.20&#xA;L        172.16.20.1/32 is directly connected, GigabitEthernet0/1.20&#xA;C        172.16.30.0/24 is directly connected, GigabitEthernet0/1.30&#xA;L        172.16.30.1/32 is directly connected, GigabitEthernet0/1.30&#xA;R        172.16.60.0/24 [120/2] via 192.168.1.1, 00:00:03, GigabitEthernet0/0&#xA;      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C        192.168.1.0/24 is directly connected, GigabitEthernet0/0&#xA;L        192.168.1.2/32 is directly connected, GigabitEthernet0/0&#xA;R     192.168.13.0/24 [120/1] via 192.168.1.1, 00:00:03, GigabitEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23175" LastEditorUserId="23175" LastEditDate="2016-02-27T13:05:35.077" LastActivityDate="2016-02-27T13:05:35.077" Title="Trouble connecting a small network.. pinging" Tags="|troubleshooting|ping|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28146" PostTypeId="2" ParentId="28145" CreationDate="2016-02-24T19:47:57.320" Score="2" Body="&lt;p&gt;The issue is most likely that the BR has not route to your 172.16.0.0/16 network so cannot send any response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could NAT all traffic coming from your network in 172.16.0.0/16 to your 'external' IP address : 192.168.1.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your network is actually routable within the school lan without NAT, then you must ensure your rip configuration is working.&#xA;(as said by Ron, first add &quot;version 2&quot; in rip configuration)&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-02-24T19:53:56.773" LastActivityDate="2016-02-24T19:53:56.773" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="28147" PostTypeId="1" CreationDate="2016-02-24T20:02:39.270" Score="2" ViewCount="284" Body="&lt;p&gt;I want to compute the relationship between delay (latency) with distance and betweenness. More specifically, if I know (let's assume) that the distance and betweenness values for two different autonomous systems (one sender &amp;amp; one receiver) is 2 and 3 respectively, is there a formula or something like that to estimate the latency between these two ASes? I would appreciate any help. &lt;/p&gt;&#xA;" OwnerUserId="8042" LastEditorUserId="8499" LastEditDate="2016-02-24T20:14:32.660" LastActivityDate="2016-08-26T01:50:35.823" Title="Estimating latency via distance and betweenness" Tags="|routing|internet|latency|speed|network-access|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28151" PostTypeId="2" ParentId="28139" CreationDate="2016-02-24T21:05:06.617" Score="1" Body="&lt;p&gt;Any frame sent across a broadcast domain has some bits set in it's PDU which identifies the sending device in that domain: the MAC address. That address is the only one which is needed to carry a message to a certain destination (in this case, the DHCP client). In this particular case, when the broadcast message is sent to 255.255.255.255 the special ff:ff:ff:ff:ff:ff MAC address is used for destination, which means that all devices in the domain should recieve the message.&#xA;The following table contains the value of some of the attributes of the DHCPDISCOVER and DHCPOFFER messages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Attribute        | DHCPDISCOVER      | DHCPOFFER&#xA;-----------------+-------------------+-------------------&#xA;Source MAC       | &amp;lt;Client MAC&amp;gt;      | &amp;lt;Server MAC&amp;gt;&#xA;Destination MAC  | ff:ff:ff:ff:ff:ff | &amp;lt;Client MAC&amp;gt;&#xA;Source IP        | 0.0.0.0           | &amp;lt;Server IP&amp;gt;&#xA;Destination IP   | 255.255.255.255   | 255.255.255.255&#xA;Transport        | UDP               | UDP&#xA;Source Port      | 68                | 67&#xA;Destination Port | 67                | 68&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the client sends the DHCPDISCOVER message every device in the broadcast domain recieves that message, in which the client's own MAC address is included as the source. One of the recipient devices of that message is the DHCP server, which in turns may answer with a DHCPOFFER to the MAC address of the client, and that's why the client gets the message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it happens that the broadcast domain is also a colision domain (like a HUB) then every device connected in that network recieves every message sent across that network and all but the device owning the message's destination MAC address will silently discard the message.&#xA;If, on the contrary, the network is switched (or bridged) then it is a broadcast domain but not a colision domain (every single paired physical connection between two devices is a colision domain). In such a network the switches or bridges understand the IP protocol and also the Address Resolution Protocol (ARP), which helps that device remember in which port is found an originating MAC address and when a message is sent to a specific MAC address, creating a map of MAC address - IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the DHCP server sends a message to a known MAC address, such as the one of the DHCP client's one, the intermediate switches or bridges know exactly to which port should they transmit the message because they remember where the DHCPDISCOVER (with the source MAC address matching the current message's destination) came from. In the case they don't remember, they simply send the message to every port, similarly to the case of the HUB (that is the purpose of ARP poisoning, for example).&lt;/p&gt;&#xA;" OwnerUserId="23180" LastActivityDate="2016-02-24T21:05:06.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28152" PostTypeId="1" AcceptedAnswerId="28153" CreationDate="2016-02-24T21:17:06.910" Score="2" ViewCount="156" Body="&lt;p&gt;I could really use some help getting the devices (Including the routers) which sit behind Router2 eth0/0 to access the web.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is a brief overview of the my network topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BBKTn.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BBKTn.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current configuration is as such:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All routers (including pfSense) are participating in OSPF&lt;/li&gt;&#xA;&lt;li&gt;pFsense is connected directly to the WAN&lt;/li&gt;&#xA;&lt;li&gt;pFsense is configured with 3 VLANs (VLAN 11, 12, 13)&lt;/li&gt;&#xA;&lt;li&gt;Router 2, Router 2 are sitting on VLAN13 (192.168.13.x)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;At present:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router 2 is capable of contacting pfSense WAN, and capable of pining outside addresses&lt;/li&gt;&#xA;&lt;li&gt;pfSense and Router 2 are capable of pinging any and all devices behind Router 1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, here is the issue:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router 1 can ping the WAN port on pfSense&lt;/li&gt;&#xA;&lt;li&gt;Router 1 CANNOT ping anything beyond the WAN port.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The following briefly shows the configuration of Router2 and Router1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description PrimaryWANDesc_&#xA; ip address 192.168.200.5 255.255.255.252&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.30.150 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!         &#xA;router ospf 10&#xA; network 150.10.90.0 0.0.0.255 area 0&#xA; network 192.168.13.0 0.0.0.255 area 0&#xA; network 192.168.200.4 0.0.0.3 area 0&#xA;!         &#xA;ip forward-protocol nd&#xA;!         &#xA;ip http server&#xA;no ip http secure-server&#xA;!         &#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1 192.168.13.1 110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; ip address 192.168.200.6 255.255.255.252&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!         &#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.24.254 255.255.255.0&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!         &#xA;router ospf 10&#xA; network 192.168.200.4 0.0.0.3 area 0&#xA; network 192.168.24.0 0.0.0.255 area 0&#xA;!         &#xA;ip forward-protocol nd&#xA;!         &#xA;no ip http server&#xA;no ip http secure-server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Packet Captures from pinging the outside (beyond the WAN connection on pfSense)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 2 ping:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;16:07:33.194621 IP 192.168.13.150 &amp;gt; 150.10.90.1: ICMP echo request, id 20, seq 0, length 80&#xA;16:07:33.195461 IP 150.10.90.1 &amp;gt; 192.168.13.150: ICMP echo reply, id 20, seq 0, length 80&#xA;16:07:33.195888 IP 192.168.13.150 &amp;gt; 150.10.90.1: ICMP echo request, id 20, seq 1, length 80&#xA;16:07:33.196636 IP 150.10.90.1 &amp;gt; 192.168.13.150: ICMP echo reply, id 20, seq 1, length 80&#xA;16:07:33.196964 IP 192.168.13.150 &amp;gt; 150.10.90.1: ICMP echo request, id 20, seq 2, length 80&#xA;16:07:33.197753 IP 150.10.90.1 &amp;gt; 192.168.13.150: ICMP echo reply, id 20, seq 2, length 80&#xA;16:07:33.198081 IP 192.168.13.150 &amp;gt; 150.10.90.1: ICMP echo request, id 20, seq 3, length 80&#xA;16:07:33.199293 IP 150.10.90.1 &amp;gt; 192.168.13.150: ICMP echo reply, id 20, seq 3, length 80&#xA;16:07:33.199622 IP 192.168.13.150 &amp;gt; 150.10.90.1: ICMP echo request, id 20, seq 4, length 80&#xA;16:07:33.200359 IP 150.10.90.1 &amp;gt; 192.168.13.150: ICMP echo reply, id 20, seq 4, length 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router 1 ping:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;16:07:37.586067 IP 192.168.200.6 &amp;gt; 150.10.90.1: ICMP echo request, id 190, seq 0, length 80&#xA;16:07:39.584913 IP 192.168.200.6 &amp;gt; 150.10.90.1: ICMP echo request, id 190, seq 1, length 80&#xA;16:07:41.584978 IP 192.168.200.6 &amp;gt; 150.10.90.1: ICMP echo request, id 190, seq 2, length 80&#xA;16:07:43.584984 IP 192.168.200.6 &amp;gt; 150.10.90.1: ICMP echo request, id 190, seq 3, length 80&#xA;16:07:45.584962 IP 192.168.200.6 &amp;gt; 150.10.90.1: ICMP echo request, id 190, seq 4, length 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please let me know if I can provide any more information if it will aid in helping address this issue.&lt;br&gt;&#xA;Thank you again!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have gone back and placed the following configuration into the firewall:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;- zebra.conf&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; !&#xA;    password password&#xA;    log syslog&#xA;    !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;- ospfd.conf&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;password password&#xA;log syslog&#xA;interface bce0&#xA;interface em0&#xA;&#xA;&#xA;router ospf&#xA;  ospf router-id 150.10.90.1&#xA;  log-adjacency-changes detail&#xA;  network 150.10.90.0/23 area 0.0.0.0&#xA;  network 192.168.50.0/24 area 0.0.0.0&#xA;  default-information originate always&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The OSPF Database of the routers are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Router 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF Router with ID (192.168.31.254) (Process ID 10)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;150.10.90.1     150.10.90.1     459         0x80000020 0x007FB6 2&#xA;192.168.31.254  192.168.31.254  852         0x8000001E 0x0027FB 2&#xA;192.168.225.254 192.168.225.254 344         0x800001BC 0x00E92C 2&#xA;&#xA;                Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;192.168.13.115  192.168.31.254  852         0x80000001 0x009262&#xA;192.168.200.6   192.168.225.254 607         0x8000000E 0x00D902&#xA;&#xA;                Type-5 AS External Link States&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;0.0.0.0         150.10.90.1     494         0x80000002 0x008642 0&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Router 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OSPF Router with ID (192.168.225.254) (Process ID 10)&#xA;&#xA;                Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;150.10.90.1     150.10.90.1     577         0x80000020 0x007FB6 2&#xA;192.168.31.254  192.168.31.254  970         0x8000001E 0x0027FB 2&#xA;192.168.225.254 192.168.225.254 461         0x800001BC 0x00E92C 2&#xA;&#xA;                Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;192.168.13.115  192.168.31.254  970         0x80000001 0x009262&#xA;192.168.200.6   192.168.225.254 724         0x8000000E 0x00D902&#xA;&#xA;                Type-5 AS External Link States&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;0.0.0.0         150.10.90.1     612         0x80000002 0x008642 0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23081" LastEditorUserId="8499" LastEditDate="2018-12-22T21:48:25.743" LastActivityDate="2018-12-22T21:48:25.743" Title="Trouble in multi-hop routing environment with non-directly connected devices receiving web access" Tags="|cisco|routing|router|firewall|ospf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28153" PostTypeId="2" ParentId="28152" CreationDate="2016-02-24T21:23:23.497" Score="1" Body="&lt;p&gt;You are creating a default route on Router 2, but you are not originating it in OSPF, so it doesn't get sent to Router 1. You can originate it on Router 2, set a default route on Router 1, or, better yet, originate it on the firewall so that it gets into OSPF from there (you can then eliminate it on Router 2). Originating it in Router 2 could be problematic because your firewall is now participating in OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since Router 1 doesn't have a default route (either specifically configured, or from a routing protocol), it has no route to anything on the Internet, so the router will drop traffic to routes it doesn't have in its routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;FYI:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You seem to want all your interfaces on each router to participate in OSPF. You can do this with a single network statement:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network 0.0.0.0 255.255.255.255 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Doing it that way will put the networks from every interface into OSPF, and it will try to connect neighbors on all the interfaces. This will save you from needing to add network statement every time you bring up a new interface. If you have any interfaces on which you don't want to try to form neighbors, you can use the &lt;code&gt;passive-interface &amp;lt;interface&amp;gt;&lt;/code&gt; command to still use the interface's network, but not send hellos on the interface. You probably want to do this with the WAN interface since you don't want the ISP to neighbor with your network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-24T21:32:33.787" LastActivityDate="2016-02-24T21:32:33.787" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28154" PostTypeId="1" CreationDate="2016-02-24T21:28:02.453" Score="5" ViewCount="263" Body="&lt;p&gt;Can I order a 1000BASE-LX transceiver from any source and it will be compatible with all others 1000BASE-LX ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would a link with a Juniper 1000BASE-LX and a TrendNet 1000BASE-LX transceiver work? &lt;/p&gt;&#xA;" OwnerUserId="23181" LastEditorUserId="8499" LastEditDate="2018-03-09T23:45:00.963" LastActivityDate="2018-03-09T23:45:00.963" Title="Are all same type fiber optic transceiver compatible?" Tags="|fiber|layer1|transceiver|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28155" PostTypeId="2" ParentId="28154" CreationDate="2016-02-24T21:35:03.477" Score="6" Body="&lt;p&gt;1000BASE-LX is a standard the same way 1000BASE-T is. You expect any copper interfaces with 1000BASE-T to interoperate, and you should expect the same thing with fiber 1000BASE-LX interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-24T21:35:03.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28156" PostTypeId="2" ParentId="28154" CreationDate="2016-02-24T21:42:04.257" Score="2" Body="&lt;p&gt;Unless you want to connect one SMode transceiver with a MMode transceiver, you will get your link UP, because they are standars of the market, and only can be negative the transmision distance from one to other, or wavelength mistmatch(850, 1310 or 1550 nm) . Here, on Wikipedia: &lt;a href=&quot;https://es.wikipedia.org/wiki/Gigabit_Ethernet&quot; rel=&quot;nofollow&quot;&gt;https://es.wikipedia.org/wiki/Gigabit_Ethernet&lt;/a&gt;, you can find the transmission distance of each one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, if you are on the working range, all the tranceiver will work normally.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2016-02-24T21:49:02.350" LastActivityDate="2016-02-24T21:49:02.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28157" PostTypeId="2" ParentId="28154" CreationDate="2016-02-24T21:45:12.803" Score="3" Body="&lt;p&gt;While this is true on the fiber side of the system, and SHOULD be true on the thing with the transceiver socket (SFP, typically, for current Gigabit stuff) it is evidently not always true for certain annoying manufacturers that like to lock you into their house-brand transceivers at far above the cost of standard/generic/standards-compliant transceivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of many reasons I avoid certain brands by default.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-02-24T21:45:12.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28163" PostTypeId="2" ParentId="24965" CreationDate="2016-02-25T03:13:18.187" Score="1" Body="&lt;p&gt;As far as I can tell on Linux both approaches are possible. As long as the responses get back to the box doing the NAT it really doesn't matter whether it's through explicit routes or through allocating multiple IPs to the internet-facing interface. The NAT engine is hit before any routing decisions (including the decision on whether to accept the packet locally) are made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other implementations may be less flexible. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-03-06T21:08:56.633" LastActivityDate="2016-03-06T21:08:56.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28164" PostTypeId="2" ParentId="28147" CreationDate="2016-02-25T03:33:01.337" Score="1" Body="&lt;p&gt;Not really.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly &quot;Latency between AS's&quot; doesn't really make much sense as a concept. Many AS's span the globe. The latency between two geographically close points in dfferent AS's can easilly be far less than the latency between two geographically distant points in the same AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default way of keeping traffic between two globe-spanning ASs local was/is to use &lt;a href=&quot;https://en.wikipedia.org/wiki/Hot-potato_and_cold-potato_routing&quot; rel=&quot;nofollow&quot;&gt;&quot;hot potato&quot;&lt;/a&gt; routing. Basically you get the traffic out of your AS as quickly as possible and let the destination AS worry about where in the world the user is. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some ASs may instead chose to request and respect &quot;multi-exit discriminators&quot; in the routing information they receive so that local traffic stays local while long distance traffic remains in the source AS for longer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that AS's can range from something that sits in a single room to something that spans the globe the number of AS's involved isn't really going to be a good indication of latency either.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-08-26T01:50:35.823" LastActivityDate="2016-08-26T01:50:35.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28167" PostTypeId="1" CreationDate="2016-02-25T06:02:03.817" Score="1" ViewCount="781" Body="&lt;p&gt;For my current understanding of RSTP, the proposal flag and agreement flag should not be set to &quot;1&quot; at the same time, and they should also not be set when the network topology is stable, which means there is no topology change happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I check the RSTP BPDU packet of a Switch device, the following BPDU flags setting is shown.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1d90t.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1d90t.png&quot; alt=&quot;802.1w RSTP BPDU packet&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any mistake in my understanding?&lt;/p&gt;&#xA;" OwnerUserId="22930" LastActivityDate="2016-02-25T06:02:03.817" Title="proposal flag and agreement flag in 802.1w RSTP BPDU packet" Tags="|spanning-tree|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28168" PostTypeId="2" ParentId="27920" CreationDate="2016-02-25T08:08:32.797" Score="1" Body="&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PA TAC declared buggy behavior and blamed it on to the OS version. The process to sync a 5.0.12 with 6.0.6 was not recommended. Later post upgrading the standalone box to the latest version (as per the new box) resolved the issue.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;ORIGINAL answer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@KorXo: Many thanks.&#xA;After many hours of conversation with PA TAC:-&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;No 2 different versions can be synced in HA peers. (The member have to match the ver)&lt;/li&gt;&#xA;&lt;li&gt;Yes, The XML files have differences&lt;/li&gt;&#xA;&lt;li&gt;I have configured the management for the 2nd device to be synced &amp;amp; then wanted it to import all the configuration from Primary firewall&lt;/li&gt;&#xA;&lt;li&gt;But the Auto commit was failing for the new device. Via GUI as well as CLI&lt;/li&gt;&#xA;&lt;li&gt;Also due to standard across firm, I am not allowed to switch the FW to 6.x or 7.x OS as of now&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Ultimately PA TAC is analyzing the returned box and will provide the reason for auto/force commit failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take home for me was the below URLs which are quite helpful. This may help you as well. Please check.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--How to Factory Reset a Palo Alto Networks Device (use HTTPS:// before all the urls)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;live.paloaltonetworks.com/t5/Management-Articles/How-to-Factory-Reset-a-Palo-Alto-Networks-Device/ta-p/56029&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--How to SSH into Maintenance Mode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;live.paloaltonetworks.com/t5/Management-Articles/How-to-SSH-into-Maintenance-Mode/ta-p/59635&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--How to Configure Management Interface from Maintenance Mode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;live.paloaltonetworks.com/t5/Configuration-Articles/How-to-Configure-Management-Interface-from-Maintenance-Mode/ta-p/53004&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--Setup a RMA Replacement Firewall &lt;/p&gt;&#xA;&#xA;&lt;p&gt;live.paloaltonetworks.com/docs/DOC-2134&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--Transfer Licenses from RMA Device &lt;/p&gt;&#xA;&#xA;&lt;p&gt;live.paloaltonetworks.com/docs/DOC-6278&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--Set Up a High Availability Replacement Device&lt;/p&gt;&#xA;&#xA;&lt;p&gt;live.paloaltonetworks.com/docs/DOC-6416&lt;/p&gt;&#xA;" OwnerUserId="17487" LastEditorUserId="775" LastEditDate="2016-05-26T16:00:17.997" LastActivityDate="2016-05-26T16:00:17.997" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28176" PostTypeId="1" AcceptedAnswerId="28177" CreationDate="2016-02-25T14:28:14.860" Score="3" ViewCount="4979" Body="&lt;p&gt;It's more than usual to find NAT translating IPv4 private addresses (such as 192.168.0.0/16 or 10.0.0.0/8) to non private addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible that NAT translates even IPv6 link-local addresses (such as FE80::/64) to non local IPv6 addresses instead of allocating a non local IPv6 address directly to the host? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's possibile, is it a common approach?&lt;/p&gt;&#xA;" OwnerUserId="17087" LastActivityDate="2018-06-08T19:42:29.883" Title="IPv6 NAT with Link-Local Address" Tags="|ipv4|nat|ip|ipv6|ip-link-local|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28177" PostTypeId="2" ParentId="28176" CreationDate="2016-02-25T14:37:41.710" Score="3" Body="&lt;p&gt;IPv6 doesn't have NAT. NAT is a hack or kludge in order to forestall the depletion of IPv4 addresses until IPv6 could become ubiquitous. NAT breaks the end-to-end connectivity which is fundamental to the IP design. IPv6 restores the end-to-end connectivity.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-25T14:37:41.710" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28181" PostTypeId="2" ParentId="28114" CreationDate="2016-02-25T17:54:07.843" Score="3" Body="&lt;p&gt;Pure Ethernet hubs used to only run &lt;em&gt;one&lt;/em&gt; speed - you'd not be able to connect a 10 mbit device (or other hub, switch, router at that speed) to a 100mbit hub.&#xA;That was extremely inconvenient, so dual-speed hubs (basically a two port switch) got built. Those were the breakthrough for 100mbit Ethernet in home/SOHO markets. Same goes of course for switches with dualspeed ports later.&#xA;The marketing term to differentiate from the old single-speed stuff was '10/100' and it was so heavily marketed you can't even imagine.&lt;/p&gt;&#xA;" OwnerUserId="620" LastActivityDate="2016-02-25T17:54:07.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28183" PostTypeId="2" ParentId="28176" CreationDate="2016-02-25T19:31:39.473" Score="3" Body="&lt;p&gt;Remember, the IPv6 equivalent to RFC1918 IPv4 address is &lt;em&gt;NOT&lt;/em&gt; Link Local addresses (FE80::/10).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;The &lt;em&gt;closest&lt;/em&gt; IPv6 equivalent to what we know as &amp;quot;Private IPv4 addresses&amp;quot; is known as &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4193&quot; rel=&quot;nofollow noreferrer&quot;&gt;Unique Local Addresses (ULA)&lt;/a&gt;&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This document defines an IPv6 unicast address format that is globally&#xA;unique and is intended for local communications, usually inside of a&#xA;site.  These addresses are not expected to be routable on the global&#xA;Internet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;ULA Address space exists to address 'internal only' resources, that will never need global route-ability, but might need internal route-ability.&lt;/p&gt;&#xA;&lt;p&gt;For example, many offices have Printers which operate on a network. There is no reason for the Printer to be accessible (or to be accessing) the Internet, as such, Printers are a good candidate for ULA address space.&#xA;&lt;sup&gt;&lt;em&gt;There are always exceptions, of course&lt;/em&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;p&gt;Or maybe an office has an internal only ticketing system (or CMS, or RMS, or People Portal, or ...) that should only be accessible from the internal, corporate network. If such a tool has no business being accessed from the public Internet, then these might be a perfect candidate for ULA address space.&lt;/p&gt;&#xA;&lt;p&gt;That being said, Ron is correct, in &lt;strong&gt;IPv6 there is no NAT&lt;/strong&gt;. It was built so NAT could be omitted entirely. And if you properly implement IPv6, you will not be using NAT.&lt;/p&gt;&#xA;&lt;p&gt;HOWEVER, &lt;em&gt;if&lt;/em&gt; there is going to be something NATed in IPv6 (despite best practices), it would be a ULA address to a Global address. It surely won't be link-local address space.&lt;/p&gt;&#xA;&lt;p&gt;Link-Local addresses (FE80::/10) exists only for &lt;em&gt;local network&lt;/em&gt; communication... aka, you communicating with your neighbor, and potentially your router. It is, by definition, not meant to be used to speak to anything on the other side of a router. As such, intrinsincly, &lt;strong&gt;you should never come across or try to NAT a Link-Local address to a Global address&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The IPv4 equivlent to the Link-Local address space is the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3927&quot; rel=&quot;nofollow noreferrer&quot;&gt;169.254.0.0/16&lt;/a&gt; range.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This document describes how a host may&#xA;automatically configure an interface with an IPv4 address within the&#xA;169.254/16 prefix that is valid for communication with other devices&#xA;connected to the same physical (or logical) link.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2018-06-08T19:42:29.883" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="28184" PostTypeId="1" CreationDate="2016-02-25T19:45:08.613" Score="2" ViewCount="404" Body="&lt;p&gt;I want to setup an 881 router such that it gets its IP address via DHCP. But I also want to setup a backup IP address in case it failed to obtain an IP via DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried setting secondary IP address but the moment I configured &lt;code&gt;ip address dhcp&lt;/code&gt;, the config for secondary IP disappeared.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to setup fallback IP?&lt;/p&gt;&#xA;" OwnerUserId="22375" LastEditorUserId="8499" LastEditDate="2018-12-22T21:50:54.117" LastActivityDate="2018-12-22T21:50:54.117" Title="How to configure Cisco IOS DHCP client to have a backup IP address?" Tags="|cisco|router|cisco-ios|dhcp|cisco-commands|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28185" PostTypeId="1" AcceptedAnswerId="28187" CreationDate="2016-02-25T19:50:23.300" Score="1" ViewCount="3298" Body="&lt;p&gt;I'm trying to test a new B2B VPN that I've configured.  I tried to ping to it from a host on my end, which fails.  So I ran a traceroute that show the packets dying out at a multi-layer switch right before the firewall/ASA (which I'll call R1).  I logged into that switch, and tried to trace the route from there.  Then things got strange.  I got the destination listed as the next hop, even though it's several hops away, on the other side of the firewall, and the routing table lists the inside interface of the firewall as the next hop for packets to that destination.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1# traceroute 10.6.115.135&#xA;&#xA;1 10.6.115.135 8 msec 4 msec 4 msec&#xA;2 10.6.115.135 4 msec *  0 msec&#xA;3  *  4 msec *&#xA;4  *  *  *&#xA;5  *  *  *&#xA;6  *  *  *&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since 10.6.115.135 is not connected to R1, and not listed specifically in the routing table, I have no idea why it's being listed as the next hop, or why I'm getting response times for it at first.  I'm guessing it's related to the VPN, but the VPN is configured on the router...shouldn't the next hop still have to be the router interface R1 is connected to?&#xA;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="21451" LastActivityDate="2016-02-25T19:59:24.550" Title="Traceroute showing destination as next hop, even though it isn't, then no response" Tags="|cisco|routing|vpn|traceroute|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28186" PostTypeId="2" ParentId="28184" CreationDate="2016-02-25T19:54:26.270" Score="1" Body="&lt;p&gt;You either get to have DHCP, or you get to use fixed addresses, but you don't get to use both, secondary address, or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you are getting an IP address via DHCP from an ISP (in which case, I don't think a static address would work, anyway), I don't normally like the idea of using DHCP to configure network infrastructure devices. There is just too much that can go wrong and isolate part of the network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-25T19:54:26.270" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28187" PostTypeId="2" ParentId="28185" CreationDate="2016-02-25T19:59:24.550" Score="1" Body="&lt;p&gt;A traceroute through a tunnel only shows the tunnel endpoints. The packets, including traceroute packet, are encapsulated in outer packets, which don't have the TTL set the same way as the packets carrying the traceroute, and traceroute depends on the TTL for discovering where the router hops are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tunnel fools traceroute into thinking the tunnel endpoints are directly connected. This sort of thing can happen with other protocols (e.g. MPLS), too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-25T19:59:24.550" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28188" PostTypeId="2" ParentId="28184" CreationDate="2016-02-25T20:03:04.867" Score="0" Body="&lt;p&gt;Create a loopback interface and add a static ip for it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Loopvack interfaces are never down and can be reached everytime.&lt;/p&gt;&#xA;" OwnerUserId="21768" LastActivityDate="2016-02-25T20:03:04.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28192" PostTypeId="1" CreationDate="2016-02-26T00:32:36.540" Score="2" ViewCount="340" Body="&lt;p&gt;How do I access a Meraki Device? Similar to the way in this tutorial.&#xA;&lt;a href=&quot;https://developer.cisco.com/site/cmx-mobility-services/learn/tutorials/mse-api-intro/#access-map-image-from-floor-specific-info&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco DevNet: CMX Mobility Services - Tutorials - MSE API Introduction&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is snapshot of the Public IP of my Meraki device&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sjkbv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sjkbv.jpg&quot; alt=&quot;Meraki Summary Report Page&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I replaced the Public IP in the tutorial with the Public IP address of my meraki device- the APIs do not work. I am able to use those APIs when connecting to the Public IP specified int he tutorial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a SSL certificate preloaded in the tutorial  - the purpose of  certificate is to ensure the identity of the remote computer (as in msesandbox.cisco.com). Do I need to install a certificate on my Meraki device too? My take is it should not be necessary - at least to start with I should be able to use http (instead of https).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping to the public IP address of the Meraki device does not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what am I missing here? Any suggestions / pointers? Please help.&lt;/p&gt;&#xA;" OwnerUserId="23223" LastEditorUserId="8499" LastEditDate="2018-03-15T01:03:10.327" LastActivityDate="2019-12-05T09:02:20.323" Title="Accessing Meraki Device using CMX - MSE API" Tags="|cisco|management|meraki|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28194" PostTypeId="1" CreationDate="2016-02-26T01:25:10.207" Score="0" ViewCount="48" Body="&lt;p&gt;My school tried to save money, so they decide to use an installed cable for phone, CCTV, and ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used two pairs for ethernet, one for phone, and one for a CCTV camera. The phone and camera work fine, but not the ethernet connection. Sometimes, I get an APIPA address (&lt;code&gt;169.x.x&lt;/code&gt;), or the card shows connected, then cable disconnected.&lt;/p&gt;&#xA;" OwnerUserId="23227" LastEditorUserId="8499" LastEditDate="2018-03-20T23:48:05.420" LastActivityDate="2018-03-20T23:48:05.420" Title="Mixed Use Four-pair Cable" Tags="|troubleshooting|layer1|cable|cabling|utp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28197" PostTypeId="2" ParentId="28194" CreationDate="2016-02-26T02:45:54.673" Score="2" Body="&lt;p&gt;The first thing I would do is disconnect the phone and CCTV temporerally. If the Ethernet suddenly starts working you have an interference problem. If not then there is some problem with the ethernet wiring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I think it's far more likely that you have a broken wire or a bad connection than an interference problem. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-02-26T02:45:54.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28198" PostTypeId="2" ParentId="20296" CreationDate="2016-02-26T02:50:53.360" Score="1" Body="&lt;p&gt;The translation information used by linux nat is available in /proc/net/ip_conntrack&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively rather than mess arround with nat you might want to look into the queue target in iptables along with libipq. This will let you mess with the packets in userland without having to mess around with NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://linux.die.net/man/3/libipq&quot; rel=&quot;nofollow&quot;&gt;http://linux.die.net/man/3/libipq&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-02-26T02:50:53.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28201" PostTypeId="1" AcceptedAnswerId="28204" CreationDate="2016-02-26T06:59:10.813" Score="2" ViewCount="491" Body="&lt;p&gt;Is the file sharing of two PCs, connected with a crossover cable, both directions or only one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would I be able to connect to a PC and play LAN games over this mini-network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would this be extremely fast?&lt;/p&gt;&#xA;" OwnerUserId="22783" LastEditorUserId="8499" LastEditDate="2018-12-21T04:01:49.607" LastActivityDate="2018-12-21T04:01:49.607" Title="What can I do with a crossover ethernet cable?" Tags="|ethernet|lan|layer1|cable|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28202" PostTypeId="1" AcceptedAnswerId="28258" CreationDate="2016-02-26T07:28:49.527" Score="1" ViewCount="2647" Body="&lt;p&gt;Recently we've got a SRX240 router, and I'm doing first steps in understanding JunOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to make really damn simple thing, here is the situation.&#xA;We've got a huge intranet in our organization, every sub-organization has it's own subnet, and should use addresses from it only without any additional NATs or something else, but, still, we can restrict access from subnets from other sub-organizations to prevent unnecessary activity from it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the first time I simplified task as much as possible &lt;em&gt;(I'm configuring device from console port)&lt;/em&gt; — block ALL incoming traffic to configured VLAN, but unfortunately all I got is losing access to assigned to VLAN IP-address, &lt;strong&gt;but NOT to the hosts connected to this VLAN&lt;/strong&gt;. They are still accessible from anywhere, and this is wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology is pretty simple too — one VLAN from 0 to 15 port, uplink might be connected to any of them. More details here: &lt;a href=&quot;https://i.stack.imgur.com/e2Dn9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/e2Dn9.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.1X44-D60.2;&#xA;system {&#xA;    time-zone Europe/Moscow;&#xA;    root-authentication {&#xA;        encrypted-password &quot;HIDDED_DATA&quot;; ## SECRET-DATA&#xA;    }&#xA;    services {&#xA;        ssh;&#xA;        telnet;&#xA;        xnm-clear-text;&#xA;        web-management {&#xA;            http {&#xA;                interface vlan.0;&#xA;            }&#xA;            https {&#xA;                system-generated-certificate;&#xA;                interface vlan.0;&#xA;            }&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        archive size 100k files 3;&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any critical;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands error;&#xA;        }&#xA;    }&#xA;    max-configurations-on-flash 5;&#xA;    max-configuration-rollbacks 5;&#xA;    license {&#xA;        autoupdate {&#xA;            url https://ae1.juniper.net/junos/key_retrieval;&#xA;        }&#xA;    }&#xA;    ntp {&#xA;        server 10.20.30.51 version 1 prefer;&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/4 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/5 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/6 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/7 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/8 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/9 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/10 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/11 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/12 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/13 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/14 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/15 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members MAIN_VLAN;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 0 {&#xA;            family inet {&#xA;                filter {&#xA;                    input TestBlock;&#xA;                    output TestBlock;&#xA;                }&#xA;                address 10.20.30.99/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop 10.20.30.1;&#xA;    }&#xA;}&#xA;security {&#xA;    policies;&#xA;    zones {&#xA;        security-zone trust {&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                vlan.0;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;firewall {&#xA;    family inet {&#xA;        filter TestBlock {&#xA;            term blockall {&#xA;                then {&#xA;                    discard;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;vlans {&#xA;    MAIN_VLAN {&#xA;        vlan-id 10;&#xA;        interface {&#xA;            ge-0/0/1.0;&#xA;            ge-0/0/2.0;&#xA;            ge-0/0/3.0;&#xA;            ge-0/0/4.0;&#xA;            ge-0/0/5.0;&#xA;            ge-0/0/6.0;&#xA;            ge-0/0/7.0;&#xA;            ge-0/0/8.0;&#xA;            ge-0/0/9.0;&#xA;            ge-0/0/10.0;&#xA;            ge-0/0/11.0;&#xA;            ge-0/0/12.0;&#xA;            ge-0/0/13.0;&#xA;            ge-0/0/14.0;&#xA;            ge-0/0/15.0;&#xA;            ge-0/0/0.0;&#xA;        }&#xA;        l3-interface vlan.0;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What did I miss? Or maybe I use completely wrong approach to achieve this goal?.. &lt;/p&gt;&#xA;" OwnerUserId="23232" LastEditorUserId="23232" LastEditDate="2016-02-27T17:10:16.063" LastActivityDate="2016-02-28T08:08:41.293" Title="Juniper SRX240 firewall family inet issue on VLAN" Tags="|vlan|firewall|juniper|srx|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28203" PostTypeId="1" CreationDate="2016-02-26T08:39:41.743" Score="0" ViewCount="1735" Body="&lt;p&gt;I need to do a password recovery on an ASA5525X. I only have a 30 minute window to get it done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA got locked out. No access to SSH or console access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Console access got locked out because I accidentally did:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no aaa authentication serial console LOCAL &#xA;no aaa authentication ssh console ACS LOCAL&#xA;no aaa authentication enable console ACS LOCAL&#xA;no aaa authentication http console LOCAL&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to revert these changes so I can have console access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have physical access to the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I don't have a back of the current running configuration. How do i&#xA;do a password recovery with out loosing my current running&#xA;configuration?&lt;/li&gt;&#xA;&lt;li&gt;Can I see what exactly is in the startup configuration before I&#xA;reboot my ASA.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="450" LastEditorUserId="509" LastEditDate="2016-02-26T15:37:00.443" LastActivityDate="2016-02-26T15:55:49.063" Title="password recovery ASA" Tags="|cisco-asa|ssh|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28204" PostTypeId="2" ParentId="28201" CreationDate="2016-02-26T08:40:14.633" Score="4" Body="&lt;p&gt;Most of the modern NICs (network interface cards) do not require a crossover Ethernet cable. You can connect them with a straight-through cable and the NIC will flip one of the ends into crossover (the technology is called Auto-MDIX). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back in the early days this was a requirement when you wanted to connect two computers to use a crossover cable but since NICs evolved with this technology, it is no longer a requirement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And yes, you will be able to play LAN or exchange files between these two computers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will be fast enough to play - 100Mbps or 1Gbps (depends on your NIC).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers.&lt;/p&gt;&#xA;" OwnerUserId="15483" LastEditorUserId="23139" LastEditDate="2016-02-26T18:26:59.417" LastActivityDate="2016-02-26T18:26:59.417" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28205" PostTypeId="2" ParentId="28203" CreationDate="2016-02-26T09:00:55.237" Score="2" Body="&lt;p&gt;Since you didn't save the configuration, simply rebooting the unit will get you back to the previous configuration. I.E. the last one that was saved, and you will recover access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's other configuration change that were not saved, they will be lost altogether.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has already happened that a Cisco device worked for years with configuration update never saved, and then rebooted and.... troubles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About seeing the configuration prior to reboot, there's no way I'm aware of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt; if the config was saved then&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Performing Password Recovery for the ASA 5500 Series Adaptive Security&#xA;  Appliance&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To recover passwords, perform the following steps:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 1 Connect to the security appliance console port according to the&#xA;  &quot;Accessing the Command-Line Interface&quot; section on page 2-4.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 2 Power off the security appliance, and then power it on.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 3 During the startup messages, press the Escape key when prompted&#xA;  to enter ROMMON.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 4 To set the security appliance to ignore the startup&#xA;  configuration at reload, enter the following command:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;rommon #1&gt; confreg&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The security appliance displays the current configuration register&#xA;  value, and asks if you want to change the value:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Current Configuration Register: 0x00000011&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Configuration Summary:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;boot TFTP image, boot default image from Flash on netboot failure&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Do you wish to change this configuration? y/n [n]:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 5 Record your current configuration register value (the number&#xA;  that is similar to 0x00000011 in the example above,) so you can&#xA;  restore it later.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 6 Enter Y to change the configuration and press Y.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The security appliance prompts you for new values.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 7 Accept the default values for all settings (which is N for all&#xA;  settings by the way,) except for the &quot;disable system configuration?&quot;&#xA;  value; at that prompt, enter Y.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 8 Reload the security appliance by entering the following&#xA;  command:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;rommon #2&gt; boot&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The security appliance loads a default configuration instead of the&#xA;  startup configuration.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 9 Enter privileged EXEC mode by entering the following command:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;hostname&gt; enable&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 10 When prompted for the password, press Return.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The password is blank.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 11 Load the startup configuration by entering the following&#xA;  command:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;hostname# copy startup-config running-config&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 12 Enter global configuration mode by entering the following&#xA;  command:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;hostname# configure terminal&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 13 Change the passwords in the configuration by entering the&#xA;  following commands, as necessary.  Note:  the second word &quot;password&quot;&#xA;  below is where you enter your actual password since the password&#xA;  &quot;password&quot; is not a password at all.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;hostname(config)# password password&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;hostname(config)# enable password password&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;hostname(config)# username name password password&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 14 Change the configuration register to load the startup&#xA;  configuration at the next reload by entering the following command:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;hostname(config)# config-register value&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Where value is the configuration register value you noted in Step 5&#xA;  and 0x1 is the default configuration register. For more information&#xA;  about the configuration register, see the Cisco Security Appliance&#xA;  Command Reference.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 15 Save the new passwords to the startup configuration by&#xA;  entering the following command:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;hostname(config)# copy running-config startup-config&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 16 You will need to repeat steps 4 through 8, except this time at&#xA;  step seven press N for the &quot;disable system configuration?&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Source : &lt;a href=&quot;https://supportforums.cisco.com/document/79016/asa-password-recovery&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/document/79016/asa-password-recovery&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-02-26T15:55:49.063" LastActivityDate="2016-02-26T15:55:49.063" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28206" PostTypeId="1" AcceptedAnswerId="36769" CreationDate="2016-02-26T09:24:26.873" Score="1" ViewCount="207" Body="&lt;p&gt;I have a hidden SSID network. I know that although the SSID is hidden, someone can sniff the Wi-Fi channels to get my SSID, and with that SSID he can use some OpenWRT-ish things to spoof my Wi-Fi network to force me type my password to authenticate his device. That is unacceptable, and I am looking for better security for my Wi-Fi network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What options do I have? How can 802.1X be used, I need to keep it as simple as possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have D-Link DWS-4026 that manages D-Link wifi access points, user credentials are stored in AD.&#xA;My AD is not the CA of my infrastructure, I can change that, should I?&#xA;Will users be asked to input their logins and passwords two times, for windows login and for connecting to wifi?&lt;/p&gt;&#xA;" OwnerUserId="19133" LastEditorUserId="33" LastEditDate="2017-03-05T20:38:15.013" LastActivityDate="2017-03-05T20:38:15.013" Title="802.1X for Wi-FI" Tags="|ieee-802.11|security|aaa|ieee-802.1x|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28207" PostTypeId="1" AcceptedAnswerId="30812" CreationDate="2016-02-26T10:41:41.820" Score="1" ViewCount="2753" Body="&lt;p&gt;Situation:&#xA;We bought new ASA5512-X. It worked everything okay. I had access over SSH on the ManagementPort which was directly connected to my PC. &#xA;Then I realised there is a configuration already on it. I googled this: &lt;a href=&quot;http://www.itnotes.eu/?p=599&quot; rel=&quot;nofollow&quot;&gt;Reset ASA How To&lt;/a&gt;So i wanted to erase the config with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; conf t&#xA;&#xA;&amp;gt; write erase&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;because i read here &lt;a href=&quot;http://www.cisco.com/web/techdoc/dc/reference/cli/nxos/commands/fund/write_erase.html&quot; rel=&quot;nofollow&quot;&gt;Write Erase Command&lt;/a&gt; that it will clear my configuration and I continued on with configuring everything new over Console Cable (I should have checked at this point if I can connect to ASA with Console Cable ...). What I didn't think off, that I will immidatly loose connection to the ASA. Then i realised the ASA is rebooting. Why? (ASA is on my Desk)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I am not able to get Access on Management Port via DHCP, nether static IP 192.168.1.X. Because there is no configuration -&gt; &lt;code&gt;write erase&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now the strange thing is, **I can't even get Access via Serial Cable. That is my main prolem!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Question is: How can i get Access again AND what does &quot;&lt;code&gt;write erase&lt;/code&gt;&quot; really do? I don't think it's only clearing EVERY Configuration, can it be that it also cleared my disk?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Procedure: When I cannoct over console I do following:&#xA;I use old Server with WIN2012R2.&#xA;Connect blue Serial Cable to SerialPort on Server and on Console Port on ASA&#xA;Then I try to connect via Putty to ASA. (Used COM1, COM2. More comes aren't shown in Device Manager).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: Today my USB-to-Serial Adapter Calbe arrived. I can now Access my old Router (so the connection is fine) but I can't connect to the ASA over the Consolee cable ... I rally don't know what's wrong. I also tested every Speed which is avaible from Tera Term Pro. &lt;/p&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="22401" LastEditDate="2016-02-29T21:06:42.763" LastActivityDate="2016-05-30T07:00:41.173" Title="CISCO ASA5512-X no Console Output" Tags="|cisco|cisco-asa|management|network-access|" AnswerCount="2" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="28208" PostTypeId="1" CreationDate="2016-02-26T10:42:25.273" Score="1" ViewCount="652" Body="&lt;p&gt;I did a tcpdump capture, and when inspecting the reults, I saw some data I couldn't understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say the hostname of the box I did the capture on was box1.blah&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw traffic like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;box2.blah:45134 &gt; box3.blah:7802&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I know what that traffic is, it's traffic used for the application failover function of HP NNMi, box2 being my primary NNMi box and box3 being my failover box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that the box1 NIC goes into promiscuous mode when tcpdump is started, but I thought you could only see traffic not addressed to you when using old school hubs, wireless, broadcast or multicast traffic ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of these situations are true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what's going on?&lt;/p&gt;&#xA;" OwnerUserId="23237" LastActivityDate="2016-05-26T15:35:36.987" Title="Seeing traffic not addressed to me using tcpdump, how does that work?" Tags="|wireless|multicast|broadcast|tcpdump|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28209" PostTypeId="2" ParentId="28207" CreationDate="2016-02-26T10:55:23.190" Score="1" Body="&lt;p&gt;The default serial settings in Putty are not adapted to connect to a Cisco device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try those settings :&#xA;(I.E. change Flow control to &quot;None&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Twvfn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Twvfn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit in response to the last sentence of the original post.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should not be afraid to appear as &quot;dumb&quot;. We all did mistake, often much more serious than this one. Only people that do nothing never do mistakes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would not trust at all someone that claims he never made error. It's a liar.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I do trust people that do mistakes, endorse them, and do their best to correct them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Errors are one of the best way to learn... (see you will learn how to connect to a Cisco device trough serial console, which is still a must-have skill in network engineering).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-02-26T13:49:24.313" LastActivityDate="2016-02-26T13:49:24.313" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="28210" PostTypeId="1" CreationDate="2016-02-26T11:36:55.627" Score="0" ViewCount="83" Body="&lt;p&gt;I am currently planning a lab setup for an academic situation. &#xA;We have host pc's that students use and we wish them to both have access to the internet and networking kit in the lab.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The university has Standard student images which would be applied to the host machine and from that we can run extra VM's. &#xA;The VM's will give the students access to the kit via Ethernet. This should allow them to both console in via our terminal server or emulate a VM as a pc within a Topology. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem we face both internet connectivity and VM traffic will be using one NIC by deafult. Yes we could use Vlans to stop VM's getting internet access however students could alter the Vlans from the VM's or use clashing Vlans on the kit when emulating a pc in the topology. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;MY question to the community is, is there any alternative to allow for a separation of traffic with ONE NIC on the host pc taking into consideration the use of cisco kit both on the university production network and in our labs. (They CAN NOT communication as it could cause clashes.)&#xA;VM's can not have internet access due to students ability to use that to hack and do generally dubious activities but the host machine/OS NEEDS Internet access.  &lt;/p&gt;&#xA;" OwnerUserId="23238" LastActivityDate="2016-02-26T11:53:28.903" Title="Separate network connection With One NIC" Tags="|network-access|lab|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-13T18:00:24.180" ContentLicense="CC BY-SA 3.0" />
  <row Id="28211" PostTypeId="2" ParentId="28210" CreationDate="2016-02-26T11:53:28.903" Score="1" Body="&lt;p&gt;I would go with VLAN at the OS level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose the students don't have administrative privilege on the operating system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so you can configure 2 virtual adapters in the operating systems, one for the desktop access to the internet and the other connected to the VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With proper VLAN filtering the student should not be able to mess up things.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-02-26T11:53:28.903" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28212" PostTypeId="1" AcceptedAnswerId="28213" CreationDate="2016-02-26T11:53:45.337" Score="1" ViewCount="659" Body="&lt;p&gt;I have a Vyatta router with eth0 and eth1 on the same network segment ex. 99.99.99.0/24 where eth0 is .1 and eth1 is .2 and this is the wan network segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The traffic to the default gateway is through eth0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there is an internal network ex. 1.1.1.0/24 with an email server on it .10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to achieve is all the internal traffic to be NAT-ed through eth0 except the mail traffic wHich I want to be through eth1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PxsWR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PxsWR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23239" LastEditorUserId="8499" LastEditDate="2016-02-26T15:20:19.030" LastActivityDate="2016-02-26T15:20:19.030" Title="Mail server behind Vyatta NAT with two WAN connections" Tags="|routing|nat|vyatta|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28213" PostTypeId="2" ParentId="28212" CreationDate="2016-02-26T12:53:42.120" Score="1" Body="&lt;p&gt;It's possible using Policy Based Routing (PBR).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the fact you have 2 interfaces in the same network makes it difficult because you cannot choose witch interface the router will use to reach the next-hop and you can only specify it by IP (and not interface) in Vyatta PBR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do you have both interface in the same LAN? It will cause many issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least you could have one interface with IP in the 99.99.99.0/24 network and the other interface with IP in the 1.1.1.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if both are actually in the same network segment that would dramatically simplify the configuration...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK misunderstood where the 1.1.1.0/24 was placed.&#xA;The question remains... why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not a good setup. Whatever the reason behind having 2 interfaces in the same IP network is, there should be a better solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this configuration I don't see how to achieve what you want. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you set another network between Vyatta eth1 and your gateway (a /30 for example) , then you can do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 2 following last comment :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to have your email server NATed to a different IP, to avoid blacklisting, then it's easy to do without bothering with 2 interfaces.&#xA;You don't even have to set the IP on the interface, it works with nat rules only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - remove the configuration on eth1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - set your nat source rule like:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;rule 10 {&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; description &quot;Mail server&quot;&#xA; outbound-interface eth0&#xA; source&#xA;     address 1.1.1.10/32&#xA; translation {&#xA;     address 99.99.99.2&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;rule 20 {&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; description &quot;all other machines&quot;&#xA; outbound-interface eth0&#xA; source&#xA;     address 1.1.1.0/24&#xA; translation {&#xA;     address 99.99.99.1&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can even specify only TCP port 25 in rule 10 (add &quot;protocol tcp&quot; and &quot;source port 25&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, the key point here is to have the NAT rule for the mail server having a lower number than the more generic network NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 - Set a nat destination rule like:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;rule 10 {&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; description &quot;Mail server&quot;&#xA; inboud-interface eth0&#xA; destination&#xA;     address 99.99.99.2&#xA;     port 25  #add 80/443/110/143 if needed&#xA; protocol tcp&#xA; translation {&#xA;     address 1.1.1.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-02-26T14:19:59.127" LastActivityDate="2016-02-26T14:19:59.127" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="28214" PostTypeId="2" ParentId="10628" CreationDate="2016-02-26T14:29:57.330" Score="2" Body="&lt;p&gt;We have different models (GS752TXS and GS752TP, last one non-stackable) but I think this is a comparable setup since we also use it with a voice network (but in different VLAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I activated SNMP on the devices with a custom secret and installed a Ubuntu VM with &lt;a href=&quot;http://www.cacti.net/&quot; rel=&quot;nofollow&quot;&gt;Cacti&lt;/a&gt; on it and I really like it. It really takes some time to get a well functioning setup with all measurements but today I´ve integrated a lot of our central devices (switches, firewall, vmware-servers, ...) and it &lt;em&gt;really&lt;/em&gt; is a very good tool to answere a lot of questions... about stability, performance, traffic and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With our Netgear switches (and on the firewall) we´re counting traffic for all LAGs and some specific ports. That might be exactly what you want to have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would give it a try.... but to be honest: In most cases it´s NOT the switch ;-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is your Voice-network a problem or transfer speeds of the &quot;normal&quot; network? I hope you´re using QOS properly...!? With activated 802.1p we really have no problems here.&lt;/p&gt;&#xA;" OwnerUserId="23247" LastActivityDate="2016-02-26T14:29:57.330" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="28215" PostTypeId="2" ParentId="28208" CreationDate="2016-02-26T14:39:19.523" Score="1" Body="&lt;p&gt;Look at the actual hardware destination of the packet. Just because the IP was not a broadcast doesn't mean the hardware destination can't be. Functions like failover often operate via broadcast traffic (sent to ff:ff:ff:ff:ff:ff) which will be seen by every port on the subnet.  If the destination is a mac address that is not your PC, and the switch should have learned it (i.e. that host is active) then the packet should not have been sent to you for the reason you stated.  If you have the capture file, open it with a tool like Wireshark and you will be able to drill into a lot of detail.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2016-02-26T14:39:19.523" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28217" PostTypeId="2" ParentId="28202" CreationDate="2016-02-26T15:44:48.353" Score="0" Body="&lt;p&gt;So a couple suggestions and questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only see one VLAN and one corresponding L3 interface.  Are you planning on adding more VLANs and interfaces for other subnets?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You don't have any policies set.  Even if you want the SRX to pass traffic between interfaces/sub-interfaces on the same VLAN and subnet, you have to have a policy permitting that.  The exception to this is your switch ports.  Those ports are able to communicate between each other without a policy.  In your case, and again, I'm not exactly sure where your trying to get your traffic to/from, you need a policy like trust-to-trust permit.  Let me show you:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What you have is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;security {&#xA;policies;&#xA;zones {&#xA;    security-zone trust {&#xA;        host-inbound-traffic {&#xA;            system-services {&#xA;                all;&#xA;            }&#xA;            protocols {&#xA;                all;&#xA;            }&#xA;        }&#xA;        interfaces {&#xA;            vlan.0;&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is nothing under policies.  What you need is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;security {&#xA;policies;&#xA;    from-zone trust to-zone trust {&#xA;        policy permit-all {&#xA;            match {&#xA;                source-address any;&#xA;                destination-address any;&#xA;                application any;&#xA;            }&#xA;            then {&#xA;                permit;&#xA;                 }&#xA;            }&#xA;    }&#xA;zones {&#xA;    security-zone trust {&#xA;        host-inbound-traffic {&#xA;            system-services {&#xA;                all;&#xA;            }&#xA;            protocols {&#xA;                all;&#xA;            }&#xA;        }&#xA;        interfaces {&#xA;            vlan.0;&#xA;        }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If there was certain traffic you didn't want your SRX to allow from trust to trust then your policies would like a little different and wouldn't permit all.&lt;/p&gt;&#xA;" OwnerUserId="23139" LastEditorUserId="23139" LastEditDate="2016-02-26T17:45:06.713" LastActivityDate="2016-02-26T17:45:06.713" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28218" PostTypeId="1" AcceptedAnswerId="28222" CreationDate="2016-02-26T16:49:16.067" Score="2" ViewCount="2274" Body="&lt;p&gt;LACP between a R1-2210 VRTX 10Gb Switch &amp;amp; Cisco 3650 Stack will not bundle properly. Has anybody seen this/have any ideas? Running what is currently the latest firmware on the VRTX Switch and CAT3K_CAA-UNIVERSALK9-M on the Stack. As a side note- we do have LACP bundles between Dell 630s that are working fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1-2210 VRTX 10Gb Switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface tengigabitethernet0/1&#xA;  channel-group 4 mode auto&#xA;  switchport mode trunk&#xA;!&#xA;interface tengigabitethernet0/2&#xA;  channel-group 4 mode auto&#xA;  switchport mode trunk&#xA;!&#xA;interface Port-channel4&#xA; description LINK_TO_CORE&#xA; switchport mode trunk&#xA;!&#xA;#show lacp protocol-state te0/1&#xA;LACP State Machines:&#xA;          Receive FSM:           Defaulted State&#xA;          Mux FSM:               Collecting Distributing State&#xA;          Periodic Tx FSM:       Slow Periodic State&#xA;  Control Variables:&#xA;          BEGIN:                 FALSE&#xA;          LACP_Enabled:          TRUE&#xA;          Ready_N:               FALSE&#xA;          Selected:              SELECTED&#xA;          Port_moved:            FALSE&#xA;          NNT:                   FALSE&#xA;          Port_enabled:          TRUE&#xA;  Timer counters:&#xA;          periodic tx timer:     22&#xA;          current while timer:   0&#xA;          wait while timer:      0&#xA;!&#xA;#show lacp protocol-state te0/2&#xA; LACP State Machines:&#xA;          Receive FSM:           Defaulted State&#xA;          Mux FSM:               Detached State&#xA;          Periodic Tx FSM:       Slow Periodic State&#xA;  Control Variables:&#xA;          BEGIN:                 FALSE&#xA;          LACP_Enabled:          TRUE&#xA;          Ready_N:               FALSE&#xA;          Selected:              UNSELECTED&#xA;          Port_moved:            FALSE&#xA;          NNT:                   FALSE&#xA;          Port_enabled:          TRUE&#xA;  Timer counters:&#xA;          periodic tx timer:     14&#xA;          current while timer:   0&#xA;          wait while timer:      0&#xA;!&#xA;#show lacp statistics te0/1 (Same output on te0/2)&#xA;te0/1 LACP statistics:&#xA;  LACP Pdus sent:                45&#xA;  LACP Pdus received:            0&#xA;!&#xA;#show lacp Port-Channel 4&#xA;Port Type 10 Gigabit Ethernet&#xA;   Attached Lag id:&#xA;   Actor&#xA;           System Priority:1&#xA;           MAC Address:    f8:b1:56:74:c3:f1&#xA;           Admin Key:      1003&#xA;           Oper Key:       1003&#xA;   Partner&#xA;           System Priority:0&#xA;           MAC Address:    00:00:00:00:00:00&#xA;           Oper Key:       0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco 3650 Stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface Port-channel4&#xA; description LINK TO VRTX TE1-2&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet2/1/4&#xA; switchport mode trunk&#xA; channel-protocol lacp&#xA; channel-group 4 mode active&#xA;!&#xA;interface GigabitEthernet3/1/4&#xA; switchport mode trunk&#xA; channel-protocol lacp&#xA; channel-group 4 mode active&#xA;!&#xA;#sho ether sum&#xA;4      Po4(SD)         LACP      Gi2/1/4(I)  Gi3/1/4(I)&#xA;!&#xA;#sho int po4&#xA;Port-channel4 is down, line protocol is down (notconnect)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configurations are identical on our functioning Port Channels to our Dell 630s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate any insight from the community.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your time!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Chris.&lt;/p&gt;&#xA;" OwnerUserId="14166" LastActivityDate="2016-02-26T18:29:48.920" Title="LACP in Stand-Alone between Cisco 3650 Stack &amp; Dell VRTX R1 2210 10gb Switch" Tags="|cisco|switch|ieee-802.1ax|dell|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28220" PostTypeId="2" ParentId="27851" CreationDate="2016-02-26T17:52:29.330" Score="1" Body="&lt;p&gt;xpac is the right assumption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the bgroup on ScreenOS is primarly for grouping interfaces for easier configuration assignment.  A brige-group is not to be confused with a networking bridge (similar to a switch).  A bridge-group is poor terminalogy on Juniper's part for sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On JUNOS, you would actually find that a Security Zone takes the place of a bridge-group and then some.  All of your policies, NATs, IPsec VPNS and more are based off of your Security Zones rather than the interfaces themselves.  So Security Zones take the place of a bridge-group but also do a whole lot more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="23139" LastActivityDate="2016-02-26T17:52:29.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28221" PostTypeId="2" ParentId="26503" CreationDate="2016-02-26T18:03:06.477" Score="0" Body="&lt;p&gt;The correct process for beginning with a blank configuration is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@hostname# delete&#xA;user@hostname# set system root-authentication plain-text-password&#xA;user@hostname# commit&#xA;user@hostname&amp;gt; request system reboot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;request system zeroize&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Will give you a default configuration if you read here:&#xA;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos15.1/topics/reference/command-summary/request-system-zeroize.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/techpubs/en_US/junos15.1/topics/reference/command-summary/request-system-zeroize.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23139" LastActivityDate="2016-02-26T18:03:06.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28222" PostTypeId="2" ParentId="28218" CreationDate="2016-02-26T18:29:48.920" Score="0" Body="&lt;p&gt;You have a speed mismatch when using fiber. You are trying to connect 1 Gb to 10 Gb and that won't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can get the C3KX-NM-10G for your Cisco 3560. It can have either four 1 Gb SFPs (copper or fiber), or two 10 Gb SFPs. This will allow you to connect the Cisco and Dell in the way you are attempting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;FYI:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be aware the the Cisco will default to use PVST for STP. I don't know if the Dell can do that, but you should probably change that on the Cisco before connecting to non-Cisco equipment.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-26T18:29:48.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28223" PostTypeId="1" AcceptedAnswerId="28232" CreationDate="2016-02-26T19:24:36.707" Score="0" ViewCount="622" Body="&lt;p&gt;I found this that shows how to do what I want: &lt;a href=&quot;https://supportforums.cisco.com/document/24851/how-configure-vpn-client-automatic-vpn-initiation&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/document/24851/how-configure-vpn-client-automatic-vpn-initiation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone tell me what am I supposed to put for the Network property? Not sure what IP this represents.&lt;/p&gt;&#xA;" OwnerUserId="4481" LastActivityDate="2016-02-27T04:17:32.670" Title="Configuring Cisco client to auto reconnect" Tags="|cisco|vpn|" AnswerCount="1" CommentCount="2" ClosedDate="2016-02-27T15:18:40.933" ContentLicense="CC BY-SA 3.0" />
  <row Id="28224" PostTypeId="1" AcceptedAnswerId="28228" CreationDate="2016-02-26T20:45:52.560" Score="-1" ViewCount="195" Body="&lt;p&gt;If I need to connect my two sites through a secured MPLS connection and I call a service provider to install one for me so will they connect me to a total different network cloud where they have only LSRs ruuning or do they use the common network through which the whole traffic pass.&lt;/p&gt;&#xA;" OwnerUserId="23142" LastActivityDate="2016-02-26T23:26:13.900" Title="Is MPLS a total different network then internet?" Tags="|routing|router|mpls|mpls-vpn|" AnswerCount="1" CommentCount="3" ClosedDate="2016-02-27T05:27:07.290" ContentLicense="CC BY-SA 3.0" />
  <row Id="28225" PostTypeId="1" AcceptedAnswerId="28242" CreationDate="2016-02-26T21:16:44.987" Score="2" ViewCount="419" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EgNzP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EgNzP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a lab setup.  Fundamentally, I'm dealing with two switches and a router.  From the bottom to the top of the topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a trunk coming into a switch.  This trunk carries traffic from multiple VMs, each assigned a VLAN.  From this switch, I separate the incoming vlans through access ports to yet another switch.  At this switch, there's a trunk heading to a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I try to ping from VM to router, I only have connectivity through a single VLAN.  If I disable interfaces, networking works for each VLAN separately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this suggest some sort of loop?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My target is to guarantee that traffic is flowing only through certain access ports between the switches.  By the way, if I trunk everything across the topology, everything works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(edit to include image)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ok heres my config file... I was able to successfull ping between two switches using only access port on totally different vlans (vlan 10 and vlan 20)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry about the wrapped text... dont know how to make it show line by line on this site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch1 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show running-config &#xA;Building configuration...&#xA;&#xA;Current configuration : 1847 bytes &#xA;! &#xA;version 12.2 &#xA;no service timestamps log datetime msec &#xA;no service timestamps debug datetime msec &#xA;no service password-encryption &#xA;! &#xA;hostname Switch &#xA;! &#xA;! &#xA;! &#xA;! &#xA;! &#xA;spanning-tree mode pvst &#xA;! &#xA;interface FastEthernet0/1&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/2&#xA; switchport access vlan 10 &#xA;! &#xA;interface FastEthernet0/3 &#xA; switchport access vlan 10 &#xA;! &#xA;interface FastEthernet0/4&#xA; switchport access vlan 10 &#xA;! &#xA;interface FastEthernet0/5 &#xA; switchport access vlan 10 &#xA;! &#xA;interface FastEthernet0/6&#xA; switchport access vlan 10 &#xA;! &#xA;interface FastEthernet0/7&#xA; switchport access vlan 10 &#xA;! &#xA;interface FastEthernet0/8&#xA; switchport access vlan 10 &#xA;! &#xA;interface FastEthernet0/9&#xA; switchport access vlan 10 &#xA;! &#xA;interface FastEthernet0/10&#xA; switchport access vlan 10 &#xA;! &#xA;interface FastEthernet0/11&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/12&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/13 &#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/14&#xA; switchport access vlan 20&#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/15&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/16&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/17&#xA; switchport access vlan 20&#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/18&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/19&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/20&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/21 &#xA;! &#xA;interface FastEthernet0/22 &#xA;! &#xA;interface FastEthernet0/23 &#xA;! &#xA;interface FastEthernet0/24 &#xA;! &#xA;interface GigabitEthernet0/1 &#xA;! &#xA;interface GigabitEthernet0/2 &#xA;! &#xA;interface Vlan1&#xA; no ip address&#xA; shutdown &#xA;! &#xA;! &#xA;! &#xA;! &#xA;line con 0 &#xA;! &#xA;line vty 0 4 &#xA; login &#xA;line vty 5 15 &#xA; login &#xA;! &#xA;! &#xA;end&#xA;&#xA;Switch#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;heres Switch 2 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show running-config &#xA;Building configuration...&#xA;&#xA;Current configuration : 2097 bytes &#xA;! &#xA;version 12.2 &#xA;no service timestamps log datetime msec &#xA;no service timestamps debug datetime msec &#xA;no service password-encryption &#xA;! &#xA;hostname Switch &#xA;! &#xA;! &#xA;! &#xA;! &#xA;! &#xA;spanning-tree mode pvst &#xA;! &#xA;interface FastEthernet0/1&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/2&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/3&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/4&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/5&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/6&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/7&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/8&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/9&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/10&#xA; switchport access vlan 10 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/11&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/12&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/13&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/14&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/15&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/16&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/17&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/18&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/19&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/20&#xA; switchport access vlan 20 &#xA; switchport mode access &#xA;! &#xA;interface FastEthernet0/21 &#xA;! &#xA;interface FastEthernet0/22 &#xA;! &#xA;interface FastEthernet0/23 &#xA;! &#xA;interface FastEthernet0/24 &#xA;! &#xA;interface GigabitEthernet0/1 &#xA;! &#xA;interface GigabitEthernet0/2 &#xA;! &#xA;interface Vlan1&#xA; no ip address shutdown &#xA;! &#xA;interface Vlan10&#xA; no ip address &#xA;! &#xA;! &#xA;! &#xA;! &#xA;line con 0 &#xA;! &#xA;line vty 0 4&#xA; login &#xA;line vty 5 15&#xA; login &#xA;! &#xA;! &#xA;end&#xA;&#xA;Switch#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23257" LastEditorUserId="8499" LastEditDate="2016-03-03T22:34:53.980" LastActivityDate="2016-03-04T06:04:55.563" Title="Trunk -&gt; Separate VLANS -&gt; Trunk -&gt; Router" Tags="|vlan|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="28226" PostTypeId="2" ParentId="28225" CreationDate="2016-02-26T21:23:57.063" Score="1" Body="&lt;p&gt;It depends of the brand of the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many switches will let tagged traffic pass trough the ports configured in access mode, so creating many loops that may be cut by spanning tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the spanning tree status of each ports (&quot;forwarding&quot; or &quot;blocking&quot;) on both switches and you will have your answer.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-02-26T21:23:57.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28228" PostTypeId="2" ParentId="28224" CreationDate="2016-02-26T23:26:13.900" Score="0" Body="&lt;p&gt;Most providers use the same network backbone for their MPLS traffic as their regular Internet traffic but your MPLS traffic is private and takes priority over Internet traffic.&lt;/p&gt;&#xA;" OwnerUserId="21857" LastActivityDate="2016-02-26T23:26:13.900" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28229" PostTypeId="1" CreationDate="2016-02-27T00:04:34.460" Score="1" ViewCount="115" Body="&lt;p&gt;I am currently having trouble gaining internet access from the PC.  Any suggestions or advice would be most welcome :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sJ4rT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sJ4rT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to diagnose a much larger issue, I have scaled my lab configuration down to just the basics. &#xA;- pfsense firewall&#xA;- 1 x router: e0: 192.168.10.10, e1: 192.168.20.1&#xA;- 1 x PC: static IP address (attached to the Router)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to Ping, traceroute, and telnet to the outside (74.125.224.72 (aka Google)) from the PC, but when I open a web browser, the system just times out.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 192.168.10.10 255.255.255.0&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.20.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!         &#xA;ip nat inside source list 1 interface GigabitEthernet0/0 overload&#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 192.168.10.1&#xA;!&#xA;access-list 1 permit 192.168.20.0 0.0.0.255 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;PCAP from firewall of PC-Telnet to: 74.125.224.72&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;18:50:04.436603 IP 192.168.10.10.49400 &amp;gt; lax17s02-in-f8.1e100.net.http: tcp 0&#xA;18:50:04.475986 IP lax17s02-in-f8.1e100.net.http &amp;gt; 192.168.10.10.49400: tcp 0&#xA;18:50:04.476401 IP 192.168.10.10.49400 &amp;gt; lax17s02-in-f8.1e100.net.http: tcp 0&#xA;18:50:05.375308 &#xA;18:50:15.375257 &#xA;18:50:25.375135 &#xA;18:50:33.093910 IP 192.168.10.10.49400 &amp;gt; lax17s02-in-f8.1e100.net.http: tcp 2&#xA;18:50:33.133231 IP lax17s02-in-f8.1e100.net.http &amp;gt; 192.168.10.10.49400: tcp 0&#xA;18:50:35.451082 &#xA;18:50:35.714407 IP 192.168.10.10.49400 &amp;gt; lax17s02-in-f8.1e100.net.http: tcp 5&#xA;18:50:35.753729 IP lax17s02-in-f8.1e100.net.http &amp;gt; 192.168.10.10.49400: tcp 0&#xA;18:50:38.442287 IP 192.168.10.10.49400 &amp;gt; lax17s02-in-f8.1e100.net.http: tcp 5&#xA;18:50:38.481624 IP lax17s02-in-f8.1e100.net.http &amp;gt; 192.168.10.10.49400: tcp 0&#xA;18:50:40.034061 IP 192.168.10.10.49400 &amp;gt; lax17s02-in-f8.1e100.net.http: tcp 3&#xA;18:50:40.073419 IP lax17s02-in-f8.1e100.net.http &amp;gt; 192.168.10.10.49400: tcp 0&#xA;18:50:40.073669 IP lax17s02-in-f8.1e100.net.http &amp;gt; 192.168.10.10.49400: tcp 1418&#xA;18:50:40.073750 IP lax17s02-in-f8.1e100.net.http &amp;gt; 192.168.10.10.49400: tcp 264&#xA;18:50:40.073757 IP lax17s02-in-f8.1e100.net.http &amp;gt; 192.168.10.10.49400: tcp 0&#xA;18:50:40.074082 IP 192.168.10.10.49400 &amp;gt; lax17s02-in-f8.1e100.net.http: tcp 0&#xA;18:50:40.074165 IP 192.168.10.10.49400 &amp;gt; lax17s02-in-f8.1e100.net.http: tcp 0&#xA;18:50:40.074174 IP 192.168.10.10.49400 &amp;gt; lax17s02-in-f8.1e100.net.http: tcp 0&#xA;18:50:40.113467 IP lax17s02-in-f8.1e100.net.http &amp;gt; 192.168.10.10.49400: tcp 0&#xA;18:50:42.995028 CDPv2, ttl: 180s, Device-ID 'Router', length 349&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Wireshark pcap&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YeR7B.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YeR7B.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all again for your time,&lt;/p&gt;&#xA;" OwnerUserId="23081" LastEditorUserId="23081" LastEditDate="2016-02-27T00:31:09.607" LastActivityDate="2016-02-27T00:31:09.607" Title="Firewall/Router not translating correctly" Tags="|routing|router|firewall|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28231" PostTypeId="2" ParentId="19103" CreationDate="2016-02-27T04:03:21.217" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.11-2012.pdf&quot; rel=&quot;nofollow&quot;&gt;IEEE 802.11-2012&lt;/a&gt; 18.3.10.6 controls for OFDM encoded wireless transmissions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;CCA shall detect a medium busy condition when the carrier sense/clear&#xA;  channel assessment (CS/CCA) mechanism detects a channel busy&#xA;  condition.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The definition of &quot;busy&quot; depends on whether or not a valid OFDM transmission is demodulated.  If one is and the receive level is equal to or greater that the minimum MCS sensitivity (e.g. -82 dBm for 20 MHz channels), then CCA will report the channel busy within 4 microseconds with a probability greater than 90%.  If a valid OFDM transmission is not received (i.e. a preamble is not successfully decoded), then the receiver defines a channel as busy if energy is  greater than 20 dB above the MCS minimum sensitivity (e.g -62 dBm for 20 MHz channels).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A node is required to determine the state of the channel before it determines if it can transmit and must defer if the channel is not clear.&lt;/p&gt;&#xA;" OwnerUserId="23266" LastEditorUserId="28361" LastEditDate="2016-08-25T15:41:54.157" LastActivityDate="2016-08-25T15:41:54.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28232" PostTypeId="2" ParentId="28223" CreationDate="2016-02-27T04:17:32.670" Score="1" Body="&lt;p&gt;The Network property in a section of the auto-initiation list defines a subnet on which the client must be for auto initiation to be triggered.  What you put there depends on your network's configuration.  In the example provided by Cisco, a client with an IP address in 110.110.110.0/24 would be classified under the [ChicagoWLAN] section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should note that the link you provided refers to software no longer available from or supported by Cisco.  The IPsec VPN Client reached end of life on July 29, 2014.&lt;/p&gt;&#xA;" OwnerUserId="23266" LastActivityDate="2016-02-27T04:17:32.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28233" PostTypeId="2" ParentId="16062" CreationDate="2016-02-27T05:22:16.950" Score="3" Body="&lt;p&gt;I was able to do what you wanted using Cisco IOS DHCP and option 82 snooping.  I may not be using the right terms.  But, basically I needed to assign IP addresses to kitchen printers based on the station in the kitchen they were at.  If one of these printers died during a dinner shift, the store manager would need to be able to put a new printer configured with DHCP in and have it be configured with the same address as the printer removed.  I also needed all 8 printers to be in the same broadcast domain and I could not use helper to send to a windows 2012 server as the store needed to continue to work even if my wan went down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did this with the following command on each switch port:&#xA;&lt;code&gt;ip dhcp snooping vlan 3 information option format-type circuit-id override string broil&lt;/code&gt; (or whatever is relevant to you)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use an ASCII to hex converter and convert your string to hex&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then on the DHCP server be it a switch or a router set up a DHCP class.  For my broil above it is this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp class broil&#xA;   relay agent information&#xA;      relay-information hex 010562726f696c*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;it is &lt;code&gt;010 &amp;lt;number of characters in your string so 5 since broil is 5 characters&amp;gt;&amp;lt;whatever your string converts to&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how my pool is set up.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool Kitchen&#xA; network 10.102.1.0 255.255.255.0   &#xA; default-router 10.102.1.1&#xA; lease infinite&#xA; class broil&#xA; address range 10.102.1.160 10.102.1.160&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And finally in order to make this address available to another device should the one in that switch port fail, I set up a kron job to issue &lt;code&gt;clear ip dhcp bind *&lt;/code&gt; every 5 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe for ALL of this to work I needed the following additional commands on my ios switch that is my dhcp server&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp relay information trust-all ip dhcp subscriber-id&#xA;interface-name&#xA;&#xA;ip dhcp snooping vlan 3 (our vlan of course) ip dhcp snooping&#xA;information option allow-untrusted ip dhcp snooping&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and on any port linking your DHCP server switch to any other switches that may be used for this (along with that switches uplink to your DHCP server switch)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp snooping trust&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thats basically it.  Works like a charm and FINALLY allowed us to get off of IP to serial printing which was a train wreck.&lt;/p&gt;&#xA;" OwnerUserId="23267" LastEditorUserId="8499" LastEditDate="2016-02-27T05:29:37.160" LastActivityDate="2016-02-27T05:29:37.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28237" PostTypeId="1" CreationDate="2016-02-27T10:56:30.167" Score="0" ViewCount="783" Body="&lt;p&gt;There are three small buildings, around 100 feet (30 meters) apart from each. 100mb/s internet endpoint is in the window of the second floor of the main building. I drew a scheme in scale:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AwWV8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AwWV8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Equipment that is currently used:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B006QB1RPY&quot; rel=&quot;nofollow noreferrer&quot;&gt;Asus RT-N66U&lt;/a&gt; in the window main building.&lt;/li&gt;&#xA;&lt;li&gt;Router &lt;a href=&quot;http://www.amazon.co.uk/RT-N10U-Wireless-Router-Repeater-Access/dp/B006JFY72C&quot; rel=&quot;nofollow noreferrer&quot;&gt;Asus RT-N10U&lt;/a&gt; in the window of the secondary building.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Currently, routers are connected via repeater mode.&#xA;Both routers are indoor, but antenna of the second router is extended outdoor via an antenna cable. If the antenna is placed indoor, it does not pick up a signal from the main building at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to get wifi in the workshop. I can not use cables or powerline adapters. Currently, I can barely get a signal outdoor of the workshop (from secondary building router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please recommend, should I buy a third router or antenna? And what the ideal place to put it? Or should I just throw away current routers and buy more powerful equipment (e.g. Ubiquiti)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="23271" LastEditorUserId="23271" LastEditDate="2016-02-27T16:02:45.557" LastActivityDate="2016-02-28T20:33:38.500" Title="Connect three buildings nearby in a single WiFi network" Tags="|wireless|" AnswerCount="2" CommentCount="2" ClosedDate="2017-08-13T17:58:46.800" ContentLicense="CC BY-SA 3.0" />
  <row Id="28241" PostTypeId="2" ParentId="28237" CreationDate="2016-02-27T15:16:07.060" Score="1" Body="&lt;p&gt;If you have a direct line of sight between the three buildings, you could try a DIY directional WiFi antenna, made from an old satilite dish. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or build your own wifi cell tower.&lt;/p&gt;&#xA;" OwnerUserId="23275" LastActivityDate="2016-02-27T15:16:07.060" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="28242" PostTypeId="2" ParentId="28225" CreationDate="2016-02-27T15:26:50.533" Score="0" Body="&lt;p&gt;The issue is that many forms of spanning tree protocol work on the whole port, not on individual VLANS. So they think there is a loop in your setup and start blocking ports despite the ports being on different vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are more advanced variants of spanning tree protocol ( MSTP, some vendor specific stuff) that you may be able to use if your hardware supports them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disabling spanning tree protocol completely may also be an option, obviously if you do that you have to take manual responsibity for ensuring there are no loops.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-02-27T15:26:50.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28243" PostTypeId="1" CreationDate="2016-02-27T15:36:51.203" Score="2" ViewCount="2076" Body="&lt;p&gt;I have a gateway rv320 cisco(lets name it BR) and inter router Cisco 1921 (lets name it RTR)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i was having trouble pinging the lan port on the BR from my hosts, but someone helped me fix that issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, my hosts cannot ping the internet (&lt;code&gt;google.com&lt;/code&gt;).&lt;br&gt;&#xA;My RTR can ping the INTERNET.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for some reason it gets dropped at the PC's default gateway.&#xA;Tracert only goes up to the default gateway (172.16.10.1) and does not seem to go past that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my config from my RTR&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname T-RTR&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;enable secret 5 $1$g2ly$xT6VHT1gXBTLuXp6uJlp./&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;multilink bundle-name authenticated&#xA;!&#xA;cts logging verbose&#xA;!&#xA;!&#xA;license udi pid CISCO1921/K9 sn FGL1943200R&#xA;!&#xA;!&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address dhcp&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1.10&#xA; encapsulation dot1Q 10&#xA; ip address 172.16.10.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1.20&#xA; encapsulation dot1Q 20&#xA; ip address 172.16.20.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1.30&#xA; encapsulation dot1Q 30&#xA; ip address 172.16.30.1 255.255.255.0&#xA;!&#xA;router rip&#xA; version 2&#xA; passive-interface GigabitEthernet0/1&#xA; network 172.16.0.0&#xA; network 192.168.1.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;banner motd ^C Unauthorized Access is prohibited!^C&#xA;!&#xA;line con 0&#xA; password Group1&#xA; login&#xA;line aux 0&#xA;line 2&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport output pad telnet rlogin lapb-ta mop udptn v120 ssh&#xA; stopbits 1&#xA;line vty 0 4&#xA; login&#xA; transport input none&#xA;!&#xA;scheduler allocate 20000 1000&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My routing table: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is 192.168.1.1 to network 0.0.0.0&#xA;&#xA;S*    0.0.0.0/0 [254/0] via 192.168.1.1&#xA;      172.16.0.0/16 is variably subnetted, 6 subnets, 2 masks&#xA;C        172.16.10.0/24 is directly connected, GigabitEthernet0/1.10&#xA;L        172.16.10.1/32 is directly connected, GigabitEthernet0/1.10&#xA;C        172.16.20.0/24 is directly connected, GigabitEthernet0/1.20&#xA;L        172.16.20.1/32 is directly connected, GigabitEthernet0/1.20&#xA;C        172.16.30.0/24 is directly connected, GigabitEthernet0/1.30&#xA;L        172.16.30.1/32 is directly connected, GigabitEthernet0/1.30&#xA;      172.17.0.0/24 is subnetted, 3 subnets&#xA;R        172.17.10.0 [120/1] via 192.168.1.3, 00:00:18, GigabitEthernet0/0&#xA;R        172.17.20.0 [120/1] via 192.168.1.3, 00:00:18, GigabitEthernet0/0&#xA;R        172.17.30.0 [120/1] via 192.168.1.3, 00:00:18, GigabitEthernet0/0&#xA;      192.168.1.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C        192.168.1.0/24 is directly connected, GigabitEthernet0/0&#xA;L        192.168.1.2/32 is directly connected, GigabitEthernet0/0&#xA;R     192.168.13.0/24 [120/1] via 192.168.1.1, 00:00:15, GigabitEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CELjK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CELjK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23175" LastEditorUserId="509" LastEditDate="2016-03-01T20:31:38.843" LastActivityDate="2016-08-29T02:12:36.703" Title="Can't Ping INTERNET from clients but I CAN from Internal Routers" Tags="|cisco|troubleshooting|ping|wan|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28247" PostTypeId="2" ParentId="28243" CreationDate="2016-02-27T19:02:59.527" Score="0" Body="&lt;p&gt;It looks like your problem could be that the path to the &lt;code&gt;192.168.13.0&lt;/code&gt; network is 40 hops (per the routing table of BR), and that far exceeds the RIP maximum hop count of 15 (16 hops being infinite for RIP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be able to solve this by creating a static route on BR and redistributing that into RIP with a much lower metric.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-27T19:02:59.527" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28249" PostTypeId="1" CreationDate="2016-02-27T20:24:19.133" Score="1" ViewCount="1458" Body="&lt;p&gt;I have a switch HPE 1920-8G-PoE+ that is connected to two computers and two access points: Ubiquiti UniFi AP-Pro n450.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The access points receive data from many devices. The two computers send UDP segments to these devices (to the specific IP address) and exchange UDP segments between them (multicast address). The IP address of the wireless devices are in a known range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to filter the multicast UDP segments that are sent to the two access points? In other words I would like to configure the two ethernet ports used by the access points in such a way that they block all the multicast traffic which is not destined for the wireless devices.&lt;/p&gt;&#xA;" OwnerUserId="23279" LastEditorUserId="8499" LastEditDate="2018-11-04T20:35:33.767" LastActivityDate="2018-11-04T20:35:33.767" Title="HPE 1920-8G-PoE+ multicast filtering" Tags="|switch|multicast|udp|hp|access-point|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28250" PostTypeId="2" ParentId="28249" CreationDate="2016-02-27T20:37:40.177" Score="1" Body="&lt;p&gt;Switches are not like hubs. Hubs repeat every frame out every port. Switches selectively send the layer-2 frames to the port where the receiving host is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches are layer-2 devices, so they only look at the layer-2 frames, not the layer-3 (IP, etc.) packets, or the layer-4 (TCP, UDP, etc.) segments. Switches learn the MAC addresses which are connected on each port from the traffic through each port, and they only send frames destined for a MAC address on a port to that port. Switches &lt;em&gt;will&lt;/em&gt; flood broadcast frames to every port (but that's the point of a broadcast, it is destined to every host on the broadcast domain), as well as unicasts which are not yet in its MAC address table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HPE 1920-8G-PoE+ is also a layer-3 switch. Layer-3 is where you will find IP packets, but layer-3 routing only sends IP packets to the ports which have the network of the destination IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You didn't include any configuration, but I seriously doubt you have a problem with traffic which is not destined to a host connected to your WAPs traveling to your WAPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your comment about this being multicast, you need to use IGMP snooping to deal with your problem. Multicast frames, like broadcast frames, are usually sent to all switch ports in the same broadcast domain. IGMP snooping lets a switch snoop on IGMP messages to determine which switch ports should receive frames for which multicast groups. &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=2&amp;amp;ved=0ahUKEwj1gfjiipnLAhUL12MKHb0hD4oQFghLMAE&amp;amp;url=http%3A%2F%2Fwww8.hp.com%2Fh20195%2Fv2%2FGetPDF.aspx%2Fc04394247.pdf&amp;amp;usg=AFQjCNEAOEcLZr61HoGLiaQxCHuv0J10Gg&amp;amp;sig2=LaIEOeQtuoaCiNBXDMz5RA&amp;amp;cad=rja&quot; rel=&quot;nofollow&quot;&gt;Your switch&lt;/a&gt; supports IGMP snooping:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;strong&gt;IGMP snooping&lt;/strong&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;improves network performance through multicast filtering, instead of&#xA;  flooding traffic to all ports&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You could also break up your layer-2 broadcast domain with VLANs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-02-27T23:32:43.447" LastActivityDate="2016-02-27T23:32:43.447" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28256" PostTypeId="2" ParentId="28201" CreationDate="2016-02-28T07:57:26.107" Score="1" Body="&lt;p&gt;Both directions, yes, and yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's gigabit capable then it will auto mdx (no crossover cable necessary) if it's only 100 mb then you're better off using a crossover cable, but you can check for auto mdx somewhere in the settings for you network adapter, Linux it's just ethtool I think.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seen people get a 40 gbit point to point connecting going, it's beautiful.&lt;/p&gt;&#xA;" OwnerUserId="23288" LastActivityDate="2016-02-28T07:57:26.107" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28257" PostTypeId="1" CreationDate="2016-02-28T08:07:10.507" Score="1" ViewCount="1323" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1rTvJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1rTvJ.png&quot; alt=&quot;topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm experimenting with BIRD, and I want to converge  simple network topology. I wonder how a minimal configuration file bird6.conf should look so that, for example, PC 1 can reach network between R2 and R4 and so on. I don't want any filters or other features, I am curious only about the reachability of the network nodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have learned the concept of how the BIRD works, but I don't know which steps leads to converged network. For example on Cisco routers, you just type the directly connected networks, and router will advertise these, or with ospfv3 it's a similar problem, but in place of networks you type just interfaces. So I don't know if I am supposed to write just interfaces with assigned IPv6 addr into bird6.conf or should I write interfaces and directly connected networks, or neighbors etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my try of R1 router.. Is this supposed to work or not? If not, so what is missing? I would like to, if you someone could post the minimal config of router R1, so I can learn from it, or just write basic steps what add into config file.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;log syslog all;&#xA;&#xA;router id 1.1.1.1;&#xA;&#xA;protocol device {&#xA;    scan time 10;&#xA;}&#xA;&#xA;protocol kernel {&#xA;    export all;&#xA;    scan time 15;&#xA;}&#xA;&#xA;&#xA;protocol ospf MyOSPF {&#xA;&#xA;    import all;&#xA;&#xA;&#xA;&#xA;    area 0 {&#xA;            interface &quot;eth0&quot; {&#xA;                    cost 5;&#xA;                    type broadcast;&#xA;                    hello 5; retransmit 2; wait 10; dead 20;&#xA;            };&#xA;&#xA;&#xA;    };&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23287" LastEditorDisplayName="user10222" LastEditDate="2016-06-03T07:24:53.060" LastActivityDate="2018-10-12T14:40:03.160" Title="A minimum OSPFv3 config of BIRD routers from topology" Tags="|ospf|linux|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28258" PostTypeId="2" ParentId="28202" CreationDate="2016-02-28T08:08:41.293" Score="1" Body="&lt;p&gt;If I understand your topology correctly, you are using the SRX as a layer-2 device between your ISP router and the hosts in the branch (in place of the managed switch in the drawing). &#xA;&lt;a href=&quot;https://i.stack.imgur.com/NIon6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NIon6.png&quot; alt=&quot;Branch topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case you will have to run the SRX in &quot;&lt;strong&gt;Transparent Mode&lt;/strong&gt;&quot;, in stead of the default &quot;Routed Mode&quot;. This has a couple of caveats and limitations, so be sure to check the &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos12.1x47/topics/concept/security-layer2-bridging-transparent-mode-overview.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to do a couple of things to make this work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, get rid of all the &quot;VLAN&quot; configuration, and start using a bridge domain:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    ge-0/0/0 {&#xA;        uniy 0 {&#xA;            family bridge {&#xA;                interface-mode access;&#xA;                vlan-id 10;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 { ## and the same for all other ge- interfaces&#xA;        uniy 0 {&#xA;            family bridge {&#xA;                interface-mode access;&#xA;                vlan-id 10;&#xA;            }&#xA;        }&#xA;    }&#xA;    irb {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.20.30.99/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;bridge-domains {&#xA;    branch_vlan {&#xA;        domain-type bridge;&#xA;        vlan-id 10;&#xA;        routing-interface irb.0;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, you must add interfaces to security zones. Normally I would recommend to put the &quot;uplink&quot; in a seperate zone, because that will make your policies much easier. I will assume that the uplink is in ge-0/0/0. If it really is impossible to predict in which port the uplink will be, you will have to put all interfaces in the same zone and figure it out with the policies.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;security {&#xA;    zones {&#xA;        security-zone intranet {&#xA;            interfaces {&#xA;                ge-0/0/0.0;&#xA;            }&#xA;        }&#xA;        security-zone branch {&#xA;            interfaces {&#xA;                ge-0/0/1.0;&#xA;                ge-0/0/2.0;  ## etcetera for all other ge- interfaces&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you can set policies on traffic to and from the intranet&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;security {&#xA;    address-book {&#xA;        global {&#xA;            address allowed-subnet 10.0.10.0/24; ## just an example to illustrate the point&#xA;        }&#xA;    }&#xA;    policies {&#xA;        from-zone branch to-zone intranet {&#xA;            policy allow-some-traffic {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address allowed-subnet;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone intranet to-zone branch {&#xA;            policy allow-some-traffic {&#xA;                match {&#xA;                    source-address allowed-subnet;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;&#xA;                }&#xA;            }&#xA;        }           &#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These security policies have an implicit &quot;deny&quot;, so all traffic not specified is dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you're this far, the SRX is working as transparent firewall, but unfortunately you can no longer manage it remotely since we didn't specify any rules for that. Assuming you would want to manage the device from the &quot;Intranet&quot; side only, we need to allow traffic to the SRX device (host-inbound-traffic) in the intranet zone:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;security {&#xA;    zones {&#xA;        security-zone intranet {&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;            }&#xA;        }       &#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will need to reboot the switch after you commit the configuration (you'll get a warning to do this):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root# commit&#xA;warning: Interfaces are changed from route mode to transparent mode. Please reboot the device or all nodes in the HA cluster!&#xA;commit complete&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-02-28T08:08:41.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28259" PostTypeId="1" AcceptedAnswerId="28297" CreationDate="2016-02-28T12:20:27.633" Score="0" ViewCount="656" Body="&lt;p&gt;What command(s), softwares/tools can I used to measure the convergence time in Quagga running an OSPF network? Thanks :)&lt;/p&gt;&#xA;" OwnerUserId="21054" LastActivityDate="2016-02-29T21:24:21.470" Title="How to measure the convergence time of OSPF in Quagga?" Tags="|routing|ospf|quagga|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28265" PostTypeId="2" ParentId="28237" CreationDate="2016-02-28T20:33:38.500" Score="1" Body="&lt;p&gt;You have 4 options as far as I see it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: VPN connect to each building using a VPN and share the configuration that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2: Mesh networks, using multiple APs you can create a mesh network creating hops for distances (though normally used for large buildings with little Ethernet cables available to use)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3: direction attena aiming at another directional attena and creating a link there either as a local VPN or very secure 802.x ... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;4: a long subterranean cable. ethernet cables lose their usefulness at 100m. 30m is ok&lt;/p&gt;&#xA;" OwnerUserId="23299" LastActivityDate="2016-02-28T20:33:38.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28268" PostTypeId="2" ParentId="26628" CreationDate="2016-02-29T07:53:17.887" Score="2" Body="&lt;p&gt;There is no privilege level which specifically allows users to change only monitor port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to make a view (&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cfg/configuration/15-e/sec-usr-cfg-15-e-book/sec-role-base-cli.html#GUID-277FCB86-F32B-4CFB-9347-3D016F26ED2C&quot; rel=&quot;nofollow&quot;&gt;Role-Based CLI Access&lt;/a&gt;) which only allows a specific command, and assign it to the privileges:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;SUMMARY STEPS&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;enable view&lt;/li&gt;&#xA;  &lt;li&gt;configure terminal&lt;/li&gt;&#xA;  &lt;li&gt;parser view &lt;em&gt;view-name&lt;/em&gt; [inclusive]&lt;/li&gt;&#xA;  &lt;li&gt;secret [0 | 5] &lt;em&gt;encrypted-password&lt;/em&gt;&lt;/li&gt;&#xA;  &lt;li&gt;commands &lt;em&gt;parser-mode&lt;/em&gt; {exclude | include-exclusive | include} [all] [interface &lt;em&gt;interface-name&lt;/em&gt; | &lt;em&gt;command&lt;/em&gt;]&lt;/li&gt;&#xA;  &lt;li&gt;end&lt;/li&gt;&#xA;  &lt;li&gt;enable [&lt;em&gt;privilege-level&lt;/em&gt; | &lt;em&gt;view view-name&lt;/em&gt;]&lt;/li&gt;&#xA;  &lt;li&gt;show parser view all&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="23310" LastEditorUserId="8499" LastEditDate="2016-03-30T14:30:24.350" LastActivityDate="2016-03-30T14:30:24.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28269" PostTypeId="1" AcceptedAnswerId="28285" CreationDate="2016-02-29T08:25:08.183" Score="1" ViewCount="162" Body="&lt;p&gt;I was simulating TCP used by dailymotion.com, and I noticed that when I increased packet error rate, the consumed BW was increased. How?&lt;/p&gt;&#xA;" OwnerUserId="23142" LastEditorUserId="8499" LastEditDate="2016-02-29T15:00:03.263" LastActivityDate="2016-02-29T15:00:03.263" Title="Why does throughput (consumed BW) increase when the packet error rate is increased in the TCP?" Tags="|tcp|bandwidth|throughput|congestion|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28270" PostTypeId="2" ParentId="28243" CreationDate="2016-02-29T08:28:58.727" Score="0" Body="&lt;p&gt;Try &lt;code&gt;#ping 192.168.13.81 source 172.16.10.1&lt;/code&gt; on RTR, you can confirm RTR is working fine if this doesn't get reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, change RV320 mode to &quot;router mode&quot; instead of &quot;gateway mode&quot;, it might works ok. It will break the internet connection, but it might be just how rv320 router works if that works fine(you cannot ping rv320 wan interface with gateway mode).&lt;/p&gt;&#xA;" OwnerUserId="23310" LastEditorUserId="8499" LastEditDate="2016-03-01T03:03:00.080" LastActivityDate="2016-03-01T03:03:00.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28272" PostTypeId="1" AcceptedAnswerId="28274" CreationDate="2016-02-29T09:25:20.807" Score="0" ViewCount="98" Body="&lt;p&gt;I tried to connect to my HP V1910 Switch; I tried with a console cable and putty but I get only a black screen and can't do anything. I also tried to use the default ip address printed on the switch, using putty(both telnet and ssh), but always get the following black screen and can't do anything about it.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/64fHd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/64fHd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;putty &#xA;After ping failed, I checked with nmap -Pn to check if the switch is visible to the network and it's up:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jdicK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jdicK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22889" LastActivityDate="2016-02-29T09:50:41.320" Title="Cannot connect to my l3 switch from pc" Tags="|switch|ping|hp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28273" PostTypeId="1" CreationDate="2016-02-29T09:46:52.880" Score="0" ViewCount="145" Body="&lt;p&gt;I am currently picking up a job that has been half completed!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At present, there are five patch panels, four of which are dotted around the building connecting to offices. These have a fiber line routing back to the main networking room.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue I have is that there is another patch panel, with 400+ jacks in the networking room.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the number of patch panel ports doesn't amount to the same number as in the networking room panel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is it possible to go patch panel to network room and port in a office? The issue in testing is that the patch panels currently don't correlate to any port on the wall, and the network room has a different numbering system, so I don't really want to test 400+ ports at this stage!&lt;/p&gt;&#xA;" OwnerUserId="23313" LastEditorUserId="8499" LastEditDate="2016-02-29T14:34:13.483" LastActivityDate="2016-02-29T14:34:13.483" Title="Patch Panel Confusion" Tags="|patch-panel|" AnswerCount="3" CommentCount="2" ClosedDate="2019-03-23T02:58:46.867" ContentLicense="CC BY-SA 3.0" />
  <row Id="28274" PostTypeId="2" ParentId="28272" CreationDate="2016-02-29T09:50:41.320" Score="0" Body="&lt;p&gt;I had to change the baud rate to 38400 while using the console cable.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/tsSxV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tsSxV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22889" LastActivityDate="2016-02-29T09:50:41.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28275" PostTypeId="2" ParentId="28273" CreationDate="2016-02-29T11:23:18.880" Score="1" Body="&lt;p&gt;I don't understand what kind of answer you expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to figure out how the cabling is done. There must be some kind of logic and you should be able to find it without testing all 400 cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to use a tone generator and a probe to identify in which panel a few jacks are connected and how each patch panel is linked to the main patch in the networking room.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking to the numbering at each side you should be able to guess the logic in the numbering... if there's any.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-02-29T11:23:18.880" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28276" PostTypeId="2" ParentId="28273" CreationDate="2016-02-29T11:35:14.827" Score="0" Body="&lt;p&gt;Hmm, if everything is fiber...  One possible, quick and dirty approach - assuming you have access to a pair of Cisco switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the &quot;office patch panel&quot;, connect some portion of the ports, let's say 48, to every port of the first switch. Go to the main room and look for active ports using your second switch. Spanning-tree should allow for multiple connections. When all found, run &quot;show cdp neighbors&quot; and write down the inter-connected ports. When done, a decent chunk of your 400 main room panel ports would be mapped. Continue with the rest.&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-02-29T11:35:14.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28277" PostTypeId="2" ParentId="28273" CreationDate="2016-02-29T11:57:41.947" Score="0" Body="&lt;p&gt;Second thought. It would be very unusual to have every &quot;office panel&quot; port to be connected directly to the main networking room panel port. You'd rather have some number of fiber links between the panels (and main room panels meant to connect to the server side switches or servers themselves). BTW, in one case I have seen &quot;the main room&quot; panel was not meant to be a part of computer network at all, it was a part of some ancient phone system. &lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-02-29T11:57:41.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28280" PostTypeId="1" AcceptedAnswerId="28287" CreationDate="2016-02-29T13:38:54.597" Score="2" ViewCount="228" Body="&lt;p&gt;Could I have a server that spoof the same &lt;em&gt;IP/MAC address&lt;/em&gt; of my server on the same L2 network that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - does not do any conflict on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - And on the same time when capturing packets on my server, I receive packets from that spoofer contains my IP and MAC, hence those packets seem to be generated from my server?&lt;/p&gt;&#xA;" OwnerUserId="23315" LastEditorUserId="8499" LastEditDate="2020-12-11T23:39:50.367" LastActivityDate="2020-12-11T23:39:50.367" Title="Spoofing the L2/L3 information and replication across L2" Tags="|mac-address|ip-address|network-access|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28281" PostTypeId="1" AcceptedAnswerId="28282" CreationDate="2016-02-29T13:55:45.857" Score="2" ViewCount="6105" Body="&lt;p&gt;These are my first questions asked into this forum so could you please help me? These were asked during a job interview:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How does the ping work when we launch an ICMP echo request message from an internal LAN private IPv4 source address towards a public IPv4 destination address (example &lt;code&gt;8.8.8.8&lt;/code&gt; - Google server) without enabling the NAT/PAT protocol on our default/internal gateway router?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the ping is unsuccessful (receiving the requested timed out/time exceeded) ICMP error type, which next-hop node will prevent forwarding the traffic (ICMP control) packets towards the Internet? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Which methods we should use in order to obtain a successful echo reply ping?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have thought of a possible answer, which I will share with you after the response in order to see if it's valid or not.&lt;/p&gt;&#xA;" OwnerUserId="23064" LastEditorUserId="8499" LastEditDate="2016-03-17T23:07:59.923" LastActivityDate="2016-05-23T14:14:39.157" Title="How does the ping work from a private IP source address towards a public IP destination address without NAT enabled?" Tags="|ipv4|firewall|nat|ping|isp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28282" PostTypeId="2" ParentId="28281" CreationDate="2016-02-29T14:16:17.090" Score="1" Body="&lt;p&gt;Private IPv4 addresses are defined by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt;, in which you will find:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Because private addresses have no global meaning, routing information&#xA;about private networks shall not be propagated on inter-enterprise&#xA;links, and packets with private source or destination addresses&#xA;should not be forwarded across such links. Routers in networks not&#xA;using private address space, especially those of Internet service&#xA;providers, are expected to be configured to reject (filter out)&#xA;routing information about private networks. If such a router receives&#xA;such information the rejection shall not be treated as a routing&#xA;protocol error.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Without NAT/PAT, the ICMP packet will be dropped by your ISP router. Most of the time, it will be silently drop, but you may have some ICMP message back, depending of the configuration your ISP made.&lt;/p&gt;&#xA;&lt;p&gt;To have a successful ping reply from an Internet host to a echo request originated by a private IP address there's no other option than NAT/PAT.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-17T23:03:29.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28283" PostTypeId="2" ParentId="28281" CreationDate="2016-02-29T14:17:18.063" Score="-2" Body="&lt;p&gt;This is my formal answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the packet leaves my internal network, the next hop which will block forwarding it into the Internet will be the firewall from the private LAN of the internet service provider or an edge router with an config/installed an ACL rule which prevents forwarding traffic originating with a private ip source address into the Internet ?&#xA;Another possibility to receive an echo reply is using a proxy server instead of a NAT configured gateway (accepting the echo request/reply messages) or installing a secure private IPSec VPN tunnel towards the public destination address which we want our traffic to reach (of course the vpn tunnel solution must be authorized and configured on both peers/terminal nodes).&lt;/p&gt;&#xA;" OwnerUserId="23064" LastEditorUserId="23064" LastEditDate="2016-03-17T22:59:39.417" LastActivityDate="2016-03-17T22:59:39.417" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28284" PostTypeId="2" ParentId="28269" CreationDate="2016-02-29T14:40:00.263" Score="0" Body="&lt;p&gt;TCP is a reliable transport protocol, and it will request missing segments to be resent. The segments get sent, get lost or corrupted, and resent. This causes more data to be sent.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-29T14:40:00.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28285" PostTypeId="2" ParentId="28269" CreationDate="2016-02-29T14:47:33.440" Score="4" Body="&lt;p&gt;Errors in transmission are detected in TCP layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The receiving TCP layer discards the damaged segment, forcing the sender to sent the segment again. &lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2016-02-29T14:47:33.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28286" PostTypeId="2" ParentId="28280" CreationDate="2016-02-29T14:58:02.623" Score="1" Body="&lt;p&gt;The short answer is, &quot;No.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have the same MAC address on two hosts on the same layer-2 network, you will have problems. Switches learn the MAC address which is connected to each port as frames come into the ports, and they populate their MAC address table with this information. A switch will then send frames destined for that MAC address only to that one switch port from its MAC address table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have the same MAC address on more than one port, the switch's MAC address table will constantly be changing, and some frames will be delivered to one port, and some frames will be delivered to the other ports. You will not duplicate the frames to multiple ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is called MAC spoofing, and it is a common DoS attack on LANs to disrupt the LAN. This can be mitigated with LAN security features such as DHCP snooping an ARP inspection.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-29T14:58:02.623" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28287" PostTypeId="2" ParentId="28280" CreationDate="2016-02-29T15:04:43.283" Score="2" Body="&lt;p&gt;The duplicate MAC and IP address will create a conflict on the network.  2 nodes will reply to ARP requests for the MAC address, and 2 nodes will be capable of responding to communication directed at the IP address.  The predominant symptom will be retransmissions which will degrade throughput.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is unlikely the spoofing server will send traffic to itself, and if it did, it is unlikely its network interface would transmit them on the wire.  Therefore, it is unlikely your server would see traffic from the spoofing server as your own.&lt;/p&gt;&#xA;" OwnerUserId="23266" LastActivityDate="2016-02-29T15:04:43.283" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28288" PostTypeId="1" AcceptedAnswerId="28289" CreationDate="2016-02-29T15:19:16.590" Score="1" ViewCount="111" Body="&lt;p&gt;Consider a client application that will establish a connection to server when it detects a electricity disruption event (though physical sensors tapped into the electricity system). The said electricity disruption could also cause some remote network equipment to persistently fail, which lays somewhere in the SYN packet's path, causing the packet to silently lost. The scenario assumes an alternative path exist between client and server, such that the re-transmission(s) of SYN packet can eventually reach the server. However, the normal fast re-transmission algorithm cannot help this situation because the round-trip-time estimator is yet to converge, instead, an rather long initial re-transmission timeout (RTO) is used (typically 3 sec). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is: how to achieve faster re-transmission? &#xA;Of course the trivial solution is to reduce the initial RTO, but without prior knowledge on the RTT, setting an arbitrarily small value is not optimal and potentially leads to unnecessary re-transmissions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another question is: Is it necessary to take into account the routing protocol, since it takes time for routing tables to converge to the new topology after link failure.&lt;/p&gt;&#xA;" OwnerUserId="23320" LastEditorUserId="23320" LastEditDate="2016-02-29T16:59:17.450" LastActivityDate="2016-02-29T17:23:50.027" Title="If a TCP SYN packet is likely to be associated with a link failure, how to achieve faster re-transmission?" Tags="|routing|tcp|ip|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28289" PostTypeId="2" ParentId="28288" CreationDate="2016-02-29T17:23:50.027" Score="0" Body="&lt;p&gt;Absent a direct sensor, such as you have proposed, the fastest way a link-down is communicated across the network is via the routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your client could be running a routing protocol with the routers (often not allowed in networks) in the network to have the latest routing information, Unfortunately, that information doesn't get sent up to the application, or any layer above layer-3. It would take a custom modification of the routing protocol to create such a connection, and it would likely be tied to a specific application.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-29T17:23:50.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28290" PostTypeId="1" AcceptedAnswerId="28291" CreationDate="2016-02-29T17:52:55.227" Score="1" ViewCount="291" Body="&lt;p&gt;I am looking for a fast and a diverse library for my game engine network. I have searched for a while, and I decided to use a simple one because of being fast to understand. I saw there are better choices which use multicast and IPv6. I want to know what are the effects on latency between a IPv4 and a non-multicast network for IPv6 with multicast network.&lt;/p&gt;&#xA;" OwnerUserId="23323" LastEditorUserId="8499" LastEditDate="2016-02-29T19:58:03.893" LastActivityDate="2016-02-29T19:58:03.893" Title="How much influence does multicast and IPv6 have on latency?" Tags="|ipv6|multicast|latency|speed|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28291" PostTypeId="2" ParentId="28290" CreationDate="2016-02-29T17:59:16.857" Score="0" Body="&lt;p&gt;There is no inherent latency difference between any of the layer-3 protocols (IPv4, IPv6, or multicast on either). Multicast requires all the routers in the path to run multicast routing, and that's why you can't multicast on the Internet unless you do it through a tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to be more concerned about the layer-4 protocols. TCP has more overhead than UDP, but it reliable. You may be able to transfer more data in UDP during a specific time period, but if any data are lost en route, UDP does nothing to try to recover from that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond that, the question ventures into an area which requires opinion-based answers which are off-topic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-02-29T17:59:16.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28293" PostTypeId="1" CreationDate="2016-02-29T19:41:16.107" Score="2" ViewCount="6072" Body="&lt;p&gt;I need assistance configuring VPN setup between Fortigate and Juniper devices (GRE over IPSec).&lt;/p&gt;&#xA;&lt;p&gt;I have the topology as follows:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/I4lFp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I4lFp.png&quot; alt=&quot;Topology&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;What I need to do is create a route-based IPSec tunnel between the devices to encapsulate another tunnel (GRE tunnel) within. I had similar setup between this Juniper and Cisco 2921 and it worked just fine, however, I am having real trouble setting this one up as I don't have necessary expertise with either.&lt;/p&gt;&#xA;&lt;p&gt;Don't know if it is supposed to work that way, but...&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I want IPSec tunnel to be between 203.0.113.1 and 203.0.113.2 public addresses;&lt;/li&gt;&#xA;&lt;li&gt;I want GRE tunnel to initiate from loopback interface and communicate to remote endpoint's loopback (10.255.255.1 and 10.255.255.2) which I have routes for to reach via IPSec tunnel (st0.0 and ipsec interfaces accordingly);&lt;/li&gt;&#xA;&lt;li&gt;I want GRE interfaces to have IP addresses 192.168.0.1 and 192.168.0.2 respectively (and have OSPF running between these, configuration not included).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;&lt;strong&gt;Juniper side&lt;/strong&gt;&lt;/h2&gt;&#xA;&lt;p&gt;&lt;strong&gt;Interface configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;interface fe-0/0/0 {&#xA;    unit 0 {&#xA;        family inet {&#xA;            address 203.0.113.1/24;&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;interface lo0 {&#xA;    unit 0 {&#xA;        family inet {&#xA;            address 10.255.255.1/32;&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;interface st0&#xA;    unit 0 {&#xA;        family inet;&#xA;    }&#xA;}&#xA;&#xA;interface gr-0/0/0 {&#xA;    unit 0 {&#xA;        clear-dont-fragment-bit;&#xA;        tunnel {&#xA;            source 10.255.255.1;&#xA;            destination 10.255.255.2;&#xA;            allow-fragmentation;&#xA;        }&#xA;        family inet {&#xA;            mtu 1400;&#xA;            address 192.168.0.1/30;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;IKE configuration (edit security ike):&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;proposal ike-prop {&#xA;    authentication-method pre-shared-keys;&#xA;    dh-group group5;&#xA;    authentication-algorithm sha1;&#xA;    encryption-algorithm aes-256-cbc;&#xA;    lifetime-seconds 28800;&#xA;}&#xA;policy ike-policy {&#xA;    mode main;&#xA;    proposals test-ike-prop;&#xA;    pre-shared-key ascii-text &amp;quot;test999&amp;quot;;&#xA;}&#xA;gateway ike-gw {&#xA;    ike-policy test-ike-policy;&#xA;    address 203.0.113.2;&#xA;    dead-peer-detection;&#xA;    nat-keepalive 10;&#xA;    local-identity inet 203.0.113.1;&#xA;    remote-identity inet 203.0.113.2;&#xA;    external-interface fe-0/0/0.0;&#xA;    version v1-only;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;IPSec configuration (edit security ipsec):&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;proposal test-ipsec-prop {&#xA;    protocol esp;&#xA;    authentication-algorithm hmac-sha1-96;&#xA;    encryption-algorithm aes-256-cbc;&#xA;    lifetime-seconds 3600;&#xA;}&#xA;&#xA;policy ipsec-policy {&#xA;    perfect-forward-secrecy {&#xA;        keys group5;&#xA;    }&#xA;    proposals ipsec-prop;&#xA;}&#xA;&#xA;vpn ipsec-vpn {&#xA;    bind-interface st0.0;&#xA;    df-bit clear;&#xA;    ike {&#xA;        gateway ike-gw;&#xA;        proxy-identity {&#xA;            local 10.255.255.1/32;&#xA;            remote 10.255.255.2/32;&#xA;            service junos-gre;&#xA;        }&#xA;        ipsec-policy ipsec-policy;&#xA;    }&#xA;    establish-tunnels immediately;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Route configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;routing-options {&#xA;    static {&#xA;        route 10.255.255.2/32 next-hop st0.0;&#xA;        #Default route exists, but not included&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Firewall configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Firewall configuration not included, however, all traffic is permitted as follows:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;From GRE to IPSec interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From IPSec to GRE interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From Wan1 to IPSec interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From IPSec to Wan1 interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From Loopback to IPSec interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From IPsec to Loopback interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From GRE to Protected network&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From Protected network to GRE&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h2&gt;&lt;strong&gt;Fortigate side&lt;/strong&gt;&lt;/h2&gt;&#xA;&lt;p&gt;&lt;strong&gt;Interface configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;config system settings&#xA;    set allow-subnet-overlap enable&#xA;end&#xA;&#xA;config system interface&#xA;    edit &amp;quot;wan1&amp;quot;&#xA;        set vdom &amp;quot;root&amp;quot;&#xA;        set ip 203.0.113.2 255.255.255.0&#xA;        set allowaccess ping&#xA;        set type physical&#xA;        set weight 1&#xA;        set alias &amp;quot;WAN&amp;quot;&#xA;    next&#xA;    edit &amp;quot;ipsec&amp;quot;&#xA;        set vdom &amp;quot;root&amp;quot;&#xA;        set ip 203.0.113.2 255.255.255.255&#xA;        set type tunnel&#xA;        set remote-ip 203.0.113.1&#xA;        set interface &amp;quot;wan1&amp;quot;&#xA;    next&#xA;    edit &amp;quot;gre&amp;quot;&#xA;        set vdom &amp;quot;root&amp;quot;&#xA;        set ip 192.168.0.2 255.255.255.255&#xA;        set allowaccess ping ssh&#xA;        set type tunnel&#xA;        set remote-ip 192.168.0.1&#xA;        set mtu 1400&#xA;        set interface &amp;quot;ipsec&amp;quot;&#xA;    next&#xA;end&#xA;&#xA;config system gre-tunnel&#xA;    edit &amp;quot;gre&amp;quot;&#xA;        set interface &amp;quot;ipsec&amp;quot;&#xA;        set local-gw 203.0.113.2&#xA;        set remote-gw 203.0.113.1&#xA;    next&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;IKE configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;config vpn ipsec phase1-interface&#xA;    edit &amp;quot;ike&amp;quot;&#xA;        set interface &amp;quot;wan1&amp;quot;&#xA;        set proposal aes256-sha1&#xA;        set peertype one&#xA;        set mode aggressive&#xA;        set localid &amp;quot;203.0.113.2&amp;quot;&#xA;        set remote-gw 203.0.113.1&#xA;        set peerid &amp;quot;203.0.113.1&amp;quot;&#xA;        set psksecret test999&#xA;    next&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;IPSec configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;config vpn ipsec phase2-interface&#xA;    edit &amp;quot;ipsec&amp;quot;&#xA;        set dst-addr-type ip&#xA;        set keepalive enable&#xA;        set phase1name &amp;quot;ike&amp;quot;&#xA;        set proposal aes256-sha1&#xA;        set protocol 47&#xA;        set src-addr-type ip&#xA;        set dst-start-ip 203.0.113.1&#xA;        set keylifeseconds 3600&#xA;        set src-start-ip 203.0.113.2&#xA;    next&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Route configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;config router static&#xA;    edit 2&#xA;        set device ipsec&#xA;        set dst 10.255.255.1 255.255.255.255&#xA;    next&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Firewall configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Firewall configuration not included, however, all traffic is permitted as follows:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;From GRE to IPSec interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From IPSec to GRE interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From Wan1 to IPSec interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From IPSec to Wan1 interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From Loopback to IPSec interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From IPsec to Loopback interface&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From GRE to Protected network&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From Protected network to GRE&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Please, advise if this kind of setup could at all work and what could be wrong here? I played with local/remote identities and could get IPSec to come up, show up in security-association table, however, never could get GRE interface to come up and have pingable remote address. Neither I could ping remote loopback via IPSec tunnel.&lt;/p&gt;&#xA;&lt;p&gt;If any debug/output needed to troubleshoot just post in comments. Thanks!&lt;/p&gt;&#xA;&lt;p&gt;Maybe you have some good resource on setting this up? Was not able to find anything on Fortinet/Juniper websites that would be helpful to setup between these two vendors. You can definitely find ones to setup with Cisco.&lt;/p&gt;&#xA;&lt;p&gt;Note: addresses used are not public, but allocated for use in example code: &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5735&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc5735&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2093" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-12-05T18:55:18.333" Title="GRE over IPsec between Juniper SRX100 and Fortigate 100D" Tags="|juniper|ipsec|fortigate|gre|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28297" PostTypeId="2" ParentId="28259" CreationDate="2016-02-29T21:24:21.470" Score="3" Body="&lt;p&gt;You can use a common non-Quagga-specific recipe:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Fire a continuous ping test over the main path established by OSPF.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Disrupt the main path.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Wait until OSPF restores connectivity for ping.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Record how much time elapsed between steps 2 and 3.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-02-29T21:24:21.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28298" PostTypeId="1" AcceptedAnswerId="28300" CreationDate="2016-02-29T21:53:18.677" Score="3" ViewCount="1635" Body="&lt;p&gt;In section 6.3.3 (&lt;a href=&quot;https://books.google.com/books?id=BvaFreun1W8C&amp;amp;lpg=PA512&amp;amp;ots=--Qk0KD_cK&amp;amp;dq=Given%20the%20current%2064-KB%20maximum%20advertised%20window%20size%2C%20TCP%20fast%20retransmit%20mechanism%20is%20able%20to%20detect%20up%20to%20three%20dropped%20packets%20per%20window%20in%20practice.&amp;amp;pg=PA512#v=onepage&amp;amp;q=Given%20the%20current%2064-KB%20maximum%20advertised%20window%20size,%20TCP%20fast%20retransmit%20mechanism%20is%20able%20to%20detect%20up%20to%20three%20dropped%20packets%20per%20window%20in%20practice.&amp;amp;f=false&quot; rel=&quot;nofollow&quot;&gt;page 512&lt;/a&gt;) of the book Computer Networks: A Systems Approach, by Peterson &amp;amp; Davie, I found the following statement:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Given the current 64-KB maximum advertised window size, TCP’s fast retransmit mechanism is able to detect up to three dropped packets per window in practice.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My question is: &lt;strong&gt;why &quot;up to&quot; 3 dropped packets?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I may have sketched part of the argument, but I'm still not sure about it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Assume a (max. ?) MSS of 1 kB&lt;/li&gt;&#xA;&lt;li&gt;Assume one currently has min(congestion_wnd, advertised_wnd) = 64 kB&lt;/li&gt;&#xA;&lt;li&gt;I'll think of window sizes in terms of packets, so I'll consider a packet to have size 1 kB, and thus a window size of 64 packets.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Say that a TCP sender is currently transmitting a window of size 64 packets, starting at sequence number p. Say that packet p + d is dropped. We can detect the dropped packet and re-transmit it if the sender has (at least) 4 more packets to send after packet p + d (i.e. +3 subsequent packets to generate 3 duplicate ACKs + 1 re-transmission). This leaves us with 64 - 4 = 60 'slots' on which we can have dropped packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cost of a dropped packet is 5 packets, i.e. the 1 dropped packet + 3 subsequent packets to get 3 duplicate ACKs + 1 re-transmission. This gives us a credit of x = 60 / 5 = 12 packets to drop, which is larger than 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where is my logic failing? I'm also doubtful about the validity of my assumptions regarding packet and MSS size in byte, but the statement seems to combine (mix up?) packets and byte sizes, which may contribute to the confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="23332" LastActivityDate="2016-02-29T22:42:23.690" Title="Why is TCP Fast Retransmit able to detect &quot;up to&quot; 3 dropped packets?" Tags="|tcp|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28300" PostTypeId="2" ParentId="28298" CreationDate="2016-02-29T22:42:23.690" Score="0" Body="&lt;p&gt;Based on their understanding of the Fast Retransmit algorithm, I believe the authors are giving you their real-world idea of what to expect. Understand, this is the authors' idea. Even your argument is made with some assumptions which may, or may not, be congruent with the authors' assumptions. You could contact the authors for clarification. A simple search turns up a verified e-mail address for Larry Peterson at the University of Arizona.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2581&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2581, TCP Congestion Control&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;3.2 Fast Retransmit/Fast Recovery&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;A TCP receiver SHOULD send an immediate duplicate ACK when an out-&#xA;of-order segment arrives. The purpose of this ACK is to inform the&#xA;sender that a segment was received out-of-order and which sequence&#xA;number is expected. From the sender's perspective, duplicate ACKs&#xA;can be caused by a number of network problems.  First, they can be&#xA;caused by dropped segments. In this case, all segments after the&#xA;dropped segment will trigger duplicate ACKs. Second, duplicate ACKs&#xA;can be caused by the re-ordering of data segments by the network (not&#xA;a rare event along some network paths [Pax97]). Finally, duplicate&#xA;ACKs can be caused by replication of ACK or data segments by the&#xA;network. In addition, a TCP receiver SHOULD send an immediate ACK&#xA;when the incoming segment fills in all or part of a gap in the&#xA;sequence space. This will generate more timely information for a&#xA;sender recovering from a loss through a retransmission timeout, a&#xA;fast retransmit, or an experimental loss recovery algorithm, such as&#xA;NewReno [FH98].&lt;/p&gt;&#xA;&lt;p&gt;The TCP sender SHOULD use the &amp;quot;fast retransmit&amp;quot; algorithm to detect&#xA;and repair loss, based on incoming duplicate ACKs. The fast&#xA;retransmit algorithm uses the arrival of 3 duplicate ACKs (4&#xA;identical ACKs without the arrival of any other intervening packets)&#xA;as an indication that a segment has been lost. After receiving 3&#xA;duplicate ACKs, TCP performs a retransmission of what appears to be&#xA;the missing segment, without waiting for the retransmission timer to&#xA;expire.&lt;/p&gt;&#xA;&lt;p&gt;After the fast retransmit algorithm sends what appears to be the&#xA;missing segment, the &amp;quot;fast recovery&amp;quot; algorithm governs the&#xA;transmission of new data until a non-duplicate ACK arrives. The&#xA;reason for not performing slow start is that the receipt of the&#xA;duplicate ACKs not only indicates that a segment has been lost, but&#xA;also that segments are most likely leaving the network (although a&#xA;massive segment duplication by the network can invalidate this&#xA;conclusion). In other words, since the receiver can only generate a&#xA;duplicate ACK when a segment has arrived, that segment has left the&#xA;network and is in the receiver's buffer, so we know it is no longer&#xA;consuming network resources.  Furthermore, since the ACK &amp;quot;clock&amp;quot;&#xA;[Jac88] is preserved, the TCP sender can continue to transmit new&#xA;segments (although transmission must continue using a reduced cwnd).&lt;/p&gt;&#xA;&lt;p&gt;The fast retransmit and fast recovery algorithms are usually&#xA;implemented together as follows.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When the third duplicate ACK is received, set ssthresh to no more&#xA;than the value given in equation 3.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Retransmit the lost segment and set cwnd to ssthresh plus 3*SMSS.&#xA;This artificially &amp;quot;inflates&amp;quot; the congestion window by the number&#xA;of segments (three) that have left the network and which the&#xA;receiver has buffered.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For each additional duplicate ACK received, increment cwnd by&#xA;SMSS. This artificially inflates the congestion window in order&#xA;to reflect the additional segment that has left the network.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Transmit a segment, if allowed by the new value of cwnd and the&#xA;receiver's advertised window.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the next ACK arrives that acknowledges new data, set cwnd to&#xA;ssthresh (the value set in step 1). This is termed &amp;quot;deflating&amp;quot;&#xA;the window.&lt;/p&gt;&#xA;&lt;p&gt;This ACK should be the acknowledgment elicited by the&#xA;retransmission from step 1, one RTT after the retransmission&#xA;(though it may arrive sooner in the presence of significant out-&#xA;of-order delivery of data segments at the receiver).&#xA;Additionally, this ACK should acknowledge all the intermediate&#xA;segments sent between the lost segment and the receipt of the&#xA;third duplicate ACK, if none of these were lost.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Note: This algorithm is known to generally not recover very&#xA;efficiently from multiple losses in a single flight of packets [FF96].&#xA;One proposed set of modifications to address this problem can be found&#xA;in [FH98].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-02-29T22:42:23.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28301" PostTypeId="1" CreationDate="2016-02-29T23:02:13.360" Score="5" ViewCount="15135" Body="&lt;p&gt;I have a network consisting of two HP 2810 switched. Attached to each switch is, on one port, a multicast video coder, and on a different port, a decoder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two VLANs - a control VLAN (running on the default VLAN) and a video VLAN. Ideally, I would like to use IGMP snooping on the video VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I turn off IGMP snooping on the switches, the decoders can decode the stream from either the local coder or the remote coder. However, if I turn on IGMP snooping, the decoder can only join the multicast group on the local switch. It would appear the the IGMP requests do not get passed on to the other switch when a decoder requests to listen to the stream from the remote coder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the system to work bi-directionally - e.g., a decoder on either switch can listen to the stream from the local coder or remote coder.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I need to configure on the switches, and how?&lt;/p&gt;&#xA;" OwnerUserId="23334" LastEditorUserId="8499" LastEditDate="2018-03-19T20:50:25.593" LastActivityDate="2018-03-19T20:50:25.593" Title="Inter-switch IGMP on a VLAN with two switches, and a multicast source per switch" Tags="|switching|layer2|multicast|igmp|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28302" PostTypeId="2" ParentId="28301" CreationDate="2016-02-29T23:21:18.843" Score="3" Body="&lt;p&gt;There is a problem with IGMP snooping across switches since the IGMP message on one switch doesn't get send to the other switch, so the switch with the source will not know that the port to the other switch should receive the multicast frames. Cisco has a &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/68131-cat-multicast-prob.html&quot; rel=&quot;nofollow&quot;&gt;document which describes the problem&lt;/a&gt; (and Cisco-specific solutions). This is not a vendor-specific problem, but a solution would be vendor-specific. From what I can tell, for the HP 2810, you will need to manually set the switch-to-switch ports to &lt;code&gt;Forward: Causes the switch to forward all IGMP and IP multicast transmissions through the port.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco's explanation of the problem:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Understand the Problem and Its Solutions&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;By default, the Catalyst switches have IGMP snooping enabled. With&#xA;  IGMP snooping, the switch snoops (or listens) for IGMP messages on all&#xA;  the ports. The switch builds an IGMP snooping table that basically&#xA;  maps a multicast group to all the switch ports that have requested it.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Assume that, without any prior configuration, Receiver 1 and Receiver&#xA;  2 have signaled their intentions to receive a multicast stream for&#xA;  239.239.239.239 that maps to the L2 multicast MAC address of 01.00.5e.6f.ef.ef. Both Switch 1 and Switch 2 create an entry in their snooping tables for these receivers in response to the IGMP reports&#xA;  that the receivers generate. Switch 1 enters port Gigabit Ethernet&#xA;  2/48 in its table, and Switch 2 enters port Fast Ethernet 1/0/47 in&#xA;  its table.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; At this point, the multicast source has not started its traffic, and none of the switches knows about the switch mrouter port.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When the source on Switch 1 starts to stream multicast traffic, Switch&#xA;  1 has &quot;seen&quot; the IGMP report from Receiver 1. As a result, Switch 1&#xA;  delivers the multicast out port Gigabit Ethernet 2/48. But, since&#xA;  Switch 2 &quot;absorbed&quot; the IGMP report from Receiver 2 as part of the&#xA;  IGMP snooping process, Switch 1 does not see an IGMP report (multicast&#xA;  request) on port Gigabit Ethernet 2/46. As a result, Switch 1 does not&#xA;  send any multicast traffic out to Switch 2. Therefore, Receiver 2&#xA;  never gets any multicast traffic, even though Receiver 2 is in the&#xA;  same VLAN but merely on a different switch than the multicast source.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The reason for this issue is that IGMP snooping is not really&#xA;  supported on any Catalyst platform without an mrouter. The mechanism&#xA;  &quot;breaks down&quot; in the absence of an mrouter port. If you want a fix for&#xA;  this solution, you must have the switches somehow learn or know of an&#xA;  mrouter port. The Solutions section of this document explains the&#xA;  procedure. But how does the presence of an mrouter port on the&#xA;  switches remedy the situation?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Basically, when the switches learn or statically know about an mrouter&#xA;  port, two critical things occur:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The switch &quot;relays&quot; the IGMP reports from the receivers to the mrouter port, which means that the IGMP reports go toward the&#xA;  multicast router. The switch does not relay all the IGMP reports.&#xA;  Instead, the switch sends only a few of the reports to the mrouter.&#xA;  For the purpose of this discussion, the number of reports is not&#xA;  important. The multicast router only needs to know if there is at&#xA;  least one receiver that is still interested in the multicast&#xA;  downstream. In order to make the determination, the multicast router&#xA;  receives the periodic IGMP reports in response to its IGMP queries.&lt;/li&gt;&#xA;  &lt;li&gt;In a source-only multicast scenario, in which no receivers have yet &quot;joined&quot; in, the switch only sends the multicast stream out its&#xA;  mrouter port.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;When the switches know their mrouter port, Switch 2 relays out the&#xA;  IGMP report that the switch received from Receiver 2 to its mrouter&#xA;  port. This port is Fast Ethernet 1/0/33. Switch 1 gets this IGMP&#xA;  report on the switch port Gigabit Ethernet 2/46. From the perspective&#xA;  of Switch 1, the switch has received merely another IGMP report. The&#xA;  switch adds that port into its IGMP snooping table and begins to send&#xA;  out the multicast traffic on that port as well. At this point, both&#xA;  the receivers receive the requested multicast traffic, and the&#xA;  application works as expected.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;But how do the switches identify their mrouter port so that IGMP&#xA;  snooping works as it is expected to work in a simple environment like&#xA;  this? The Solutions section provides some answers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;HP's explanation of the problem:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When the switch receives an IGMP Join, it accepts the host request and&#xA;  begins forwarding the IGMP traffic. This means ports that have not&#xA;  joined the group and are not connected to routers or the IGMP Querier&#xA;  will not receive the group's multicast traffic.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It appears that you could set the switches up as IGMP Queriers:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Using the Switch as Querier&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Querier Operation&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The function of the IGMP Querier is to poll other IGMP-enabled devices&#xA;  in an IGMP-enabled VLAN to elicit group membership information. The&#xA;  switch performs this function if there is no other device in the VLAN,&#xA;  such as a multicast router, to act as Querier. Although the switch&#xA;  automatically ceases Querier operation in an IGMP-enabled VLAN if it&#xA;  detects another Querier on the VLAN, you can also use the Command&#xA;  Prompt to disable the Querier capability for that VLAN.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt; A Querier is required for proper IGMP operation. For this reason, if you disable the Querier function on a switch, ensure that&#xA;  there is an IGMP Querier (and, preferably, a backup Querier) available&#xA;  on the same VLAN.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If the switch becomes the Querier for a particular VLAN (for example,&#xA;  the DEFAULT_VLAN), then subsequently detects queries transmitted from&#xA;  another device on the same VLAN, the switch ceases to operate as the&#xA;  Querier for that VLAN. If this occurs, the switch Event Log lists a&#xA;  pair of messages similar to these:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I 01/15/01 09:01:13 igmp: DEFAULT_VLAN: Other Querier detected&#xA;I 01/15/01 09:01:13 igmp: DEFAULT_VLAN: This switch is no longer Querier&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;In the above scenario, if the other device ceases to operate as a&#xA;  Querier on the default VLAN, then the switch detects this change and&#xA;  can become the Querier as long as it is not pre-empted by some other&#xA;  IGMP Querier on the VLAN. In this case, the switch Event Log lists&#xA;  messages similar to the following to indicate that the switch has&#xA;  become the Querier on the VLAN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I 01/15/01 09:21:55 igmp: DEFAULT_VLAN: Querier Election in process&#xA;I 01/15/01 09:22:00 igmp: DEFAULT_VLAN: This switch has been elected as Querier&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-01T00:00:15.147" LastActivityDate="2016-03-01T00:00:15.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28303" PostTypeId="2" ParentId="28301" CreationDate="2016-02-29T23:59:56.100" Score="4" Body="&lt;p&gt;This is an all too common problem. Snooping requires either a full multicast router, or an &lt;em&gt;igmp querier&lt;/em&gt; in the network (one per broadcast domain.) Both periodically send out multicast group requests to learn who's interested in what. That information has a lifetime (usually a multiple of the query interval, which is 125s by default), so after a few minutes without a querier, your multicast streams simply stop. (or the switch begins flooding to all ports, which is the opposite of the intent of enabling snooping)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command is: &lt;code&gt;vlan ## ip igmp querier&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-02-29T23:59:56.100" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28305" PostTypeId="2" ParentId="19048" CreationDate="2016-03-01T04:52:05.460" Score="0" Body="&lt;p&gt;I see this post is fairly old and you may have found an answer already. But here is my solution for this sort of thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Double NATting as you designed it. However, to make it work, you will need to create two virtual routers and assign the interfaces on each side to different VRs and then configure NAT. It works and I have done it many times. &lt;/p&gt;&#xA;" OwnerUserId="23343" LastActivityDate="2016-03-01T04:52:05.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28308" PostTypeId="1" AcceptedAnswerId="28312" CreationDate="2016-03-01T05:34:52.137" Score="2" ViewCount="650" Body="&lt;p&gt;The network segment between a router and a switch is considered as a collision domain? or a broadcast domain? &lt;/p&gt;&#xA;" OwnerUserId="21879" LastActivityDate="2016-03-01T14:07:49.890" Title="Collision and Broadcast Domain" Tags="|lan|switching|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28310" PostTypeId="2" ParentId="28308" CreationDate="2016-03-01T06:35:48.403" Score="1" Body="&lt;p&gt;Here is an example that should clear it up !&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Router1 -- Switch -- Router2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Both the routers share one broadcast domain but have two separate collision domains.&#xA;So, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Router1 and Switch : 1st collision domain&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Router2 and Switch : 2nd collision domain&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A broadcast domain generally means the area in which any broadcast packet would move till it hits a roadblock ( like another L3 device ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A collision domain is simply building separate pipes for each connected device that would reduce the probability of packet collisions.&lt;/p&gt;&#xA;" OwnerUserId="13861" LastActivityDate="2016-03-01T06:35:48.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28311" PostTypeId="2" ParentId="28308" CreationDate="2016-03-01T06:36:06.613" Score="3" Body="&lt;p&gt;It's both of them. It's a collision domain and it's also (a part of) broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Collision domain is defined as &quot;&lt;a href=&quot;https://en.wikipedia.org/wiki/Collision_domain&quot; rel=&quot;nofollow&quot;&gt;where data packets can collide with one another when being sent&lt;/a&gt;&quot;. So if you connect switch and router directly, collision domain is only between this router and switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Broadcast domain is defined as &quot;&lt;a href=&quot;https://en.wikipedia.org/wiki/Broadcast_domain&quot; rel=&quot;nofollow&quot;&gt;in which all nodes can reach each other by broadcast at the data link layer&lt;/a&gt;&quot;. So if you are using L2 switch, it will extend broadcast domain further.&lt;/p&gt;&#xA;" OwnerUserId="23310" LastActivityDate="2016-03-01T06:36:06.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28312" PostTypeId="2" ParentId="28308" CreationDate="2016-03-01T06:45:27.220" Score="3" Body="&lt;p&gt;That depends on whether the connection between the router and the switch is half duplex or full duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a full duplex link each direction is it's own collision domain, which means there are two collision domains, but neither can experience any collisions as both a permanently clear to send (ignoring flow control). &#xA;Also - cue discussion on whether a full duplex link has a collision domain at all....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a half duplex link (not sure why you would want this) then the send and receive share the collision domain. In that case there is one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the link between the router and the switch is non-trunking (e.g. not 802.1Q) then there is likely a single broadcast domain. &#xA;However, if you are running multiple VLANs, then there is a broadcast domain for each VLAN on the trunk.&lt;/p&gt;&#xA;" OwnerUserId="23348" LastActivityDate="2016-03-01T06:45:27.220" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28313" PostTypeId="2" ParentId="27989" CreationDate="2016-03-01T06:57:26.330" Score="1" Body="&lt;p&gt;Try changing the crypto map sequence number for the dynamic entry to a higher one  (e.g. &gt;500), see this note:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/46242-lan-to-lan-vpn-client.html#crypto&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/46242-lan-to-lan-vpn-client.html#crypto&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23348" LastActivityDate="2016-03-01T06:57:26.330" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28314" PostTypeId="2" ParentId="23360" CreationDate="2016-03-01T08:31:04.260" Score="0" Body="&lt;p&gt;The issue may be that the Internet Gateway (linksys) router does perform NAT/PAT for the 192.168.200.0/24 network but not for the the 192.168.201.0/24 network.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-01T08:31:04.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28315" PostTypeId="2" ParentId="26290" CreationDate="2016-03-01T08:32:15.213" Score="1" Body="&lt;p&gt;Enterprise wireless equipment (Cisco/Aruba/Xirrus/Ruckus etc) already does this. Different vendors have different names for it but 'active band steering' is a commonly used term.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most client devices will connect to the strongest available signal at 2.4GHz and stay there. Within certain parameters the wireless system will then try and force the client to associate using a different frequency (in WiFi typically 5GHz channels) by sending disassociation packets or refusing connection attempts on the 2.4GHz radio. Some vendors allow you to configure the 'aggression' level which is used (how many times the system refuses 2.4GHz connection attempts).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client devices are dumb, the network is smart. There will be some outlier devices (old smartphones / pos scanners etc) that just won't connect with band steering enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://meraki.cisco.com/blog/2011/04/using-spectrum-wisely-with-band-steering/&quot; rel=&quot;nofollow&quot;&gt;This post from meraki&lt;/a&gt; explains in more detail.&lt;/p&gt;&#xA;" OwnerUserId="16288" LastActivityDate="2016-03-01T08:32:15.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28317" PostTypeId="1" AcceptedAnswerId="28347" CreationDate="2016-03-01T13:30:42.347" Score="1" ViewCount="122" Body="&lt;p&gt;If I have a client on a 128k MPLS circuit going through a Cisco 2900 router and using QoS that's splitting it up into two 64k tunnels, is it possible for traffic to spike up to 256k for a short period of time or is this physically impossible even if data is showing it's not? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NcDH3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NcDH3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23351" LastActivityDate="2016-03-02T07:34:59.450" Title="Overutilized spikes on a 128k circuit" Tags="|cisco|mpls|bandwidth|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28318" PostTypeId="2" ParentId="28308" CreationDate="2016-03-01T14:07:49.890" Score="1" Body="&lt;p&gt;Each switch port is a separate collision domain. A switch is a bridge, and bridges separate collision domains, unlike hubs, where every hub port is in the same collision domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VLAN is a broadcast domain. If the whole switch is, or multiple, connected switches are, a single VLAN, then you have a single broadcast domain. Routers break up broadcast domains, and to get from one VLAN to another, you must pass through a router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-01T14:07:49.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28321" PostTypeId="1" CreationDate="2016-03-01T15:34:34.173" Score="4" ViewCount="1223" Body="&lt;p&gt;We want to set up a LAN-to-LAN tunnel VPN between our company and a customer, but the connection doesn’t work. Here’s the network diagram: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xsPNJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xsPNJ.png&quot; alt=&quot;network-diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below the full Cisco ASA configuration: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;:&#xA;ASA Version 9.1(2) &#xA;!&#xA;hostname ASA&#xA;domain-name mycompany.local&#xA;enable password czov.cpL9DkL/AOc encrypted&#xA;passwd 2KFQnbNIdI.2KYOU encrypted&#xA;names&#xA;ip local pool Pool.Lyon 192.168.69.100-192.168.69.150 mask 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/0&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description LAN&#xA; speed 100&#xA; duplex full&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.6.9.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/2&#xA; description Connexion Internet&#xA; nameif outside&#xA; security-level 0&#xA; ip address 192.168.1.200 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/4&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/5&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management0/0&#xA; management-only&#xA; nameif management&#xA; security-level 100&#xA; ip address 192.168.2.1 255.255.255.0 &#xA;!&#xA;boot system disk0:/asa912-smp-k8.bin&#xA;ftp mode passive&#xA;clock timezone CEST 1&#xA;clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;dns domain-lookup inside&#xA;dns server-group DefaultDNS&#xA; name-server 10.6.9.5&#xA; name-server 10.3.3.5&#xA; domain-name mycompany.local&#xA;object network RemoteLANCustomer&#xA; subnet 172.31.30.84 255.255.255.252&#xA; description Reseau Local Customer&#xA;object network LocalLAN&#xA; subnet 10.6.9.0 255.255.255.0&#xA; description LAN mycompany&#xA;object network HoteDistantCustomer&#xA; host 109.x.x.4&#xA;object network vHANDLYO&#xA; host 10.6.9.5&#xA;object service RDP&#xA; service tcp source eq 3389 destination eq 3389 &#xA;object network LANTours&#xA; subnet 10.3.7.0 255.255.255.0&#xA;access-list outside_cryptomap extended permit ip 10.6.9.0 255.255.255.0 172.31.30.84 255.255.255.252 &#xA;access-list outside_access_in extended permit tcp any object vHANDLYO eq 3389 &#xA;pager lines 24&#xA;logging enable&#xA;logging trap notifications&#xA;logging asdm debugging&#xA;logging host inside 10.3.3.100&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;mtu management 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm733.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (inside,outside) source dynamic LocalLAN interface&#xA;nat (inside,outside) source static vHANDLYO vHANDLYO no-proxy-arp&#xA;access-group outside_access_in in interface outside&#xA;route outside 0.0.0.0 0.0.0.0 192.168.1.1 1&#xA;route inside 10.0.0.0 255.0.0.0 10.6.9.15 1&#xA;route outside 109.x.x.4 255.255.255.255 192.168.1.1 1&#xA;route outside 172.31.30.84 255.255.255.252 192.168.1.1 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;http server enable&#xA;http 192.168.1.0 255.255.255.0 management&#xA;http 10.0.0.0 255.0.0.0 inside&#xA;snmp-server host inside 10.3.3.50 community ***** version 2c&#xA;snmp-server location France&#xA;snmp-server contact contact@mycompany.fr&#xA;snmp-server community *****&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport&#xA;crypto ipsec ikev2 ipsec-proposal DES&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES192&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map outside_map 1 match address outside_cryptomap&#xA;crypto map outside_map 1 set pfs &#xA;crypto map outside_map 1 set peer 109.x.x.4 &#xA;crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map outside_map 1 set security-association lifetime seconds 3600&#xA;crypto map outside_map interface outside&#xA;crypto ca trustpool policy&#xA;crypto ikev2 policy 1&#xA; encryption aes-256&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 3600&#xA;crypto ikev2 policy 10&#xA; encryption aes-192&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 20&#xA; encryption aes&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 30&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 40&#xA; encryption des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 enable outside&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 policy 30&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 3600&#xA;telnet 10.0.0.0 255.0.0.0 inside&#xA;telnet timeout 5&#xA;ssh 10.0.0.0 255.0.0.0 inside&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;dhcpd dns 10.6.9.5 10.3.3.5 interface inside&#xA;dhcpd lease 28800 interface inside&#xA;dhcpd domain mycompany.local interface inside&#xA;dhcpd option 3 ip 10.6.9.16 10.6.9.15 interface inside&#xA;dhcpd option 6 ip 10.6.9.5 10.3.3.5 interface inside&#xA;dhcpd option 42 ip 10.6.9.5 10.3.3.5 interface inside&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;ntp server 10.6.9.5 source inside&#xA;ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1&#xA;webvpn&#xA; enable outside&#xA; anyconnect image disk0:/anyconnect-win-3.1.08009-k9.pkg 1&#xA; anyconnect enable&#xA; tunnel-group-list enable&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-clientless&#xA;group-policy GroupPolicy_ClientVPN internal&#xA;group-policy GroupPolicy_ClientVPN attributes&#xA; wins-server value 10.6.9.5&#xA; dns-server value 10.6.9.5&#xA; vpn-tunnel-protocol ssl-client &#xA; default-domain value mycompany.local&#xA;group-policy GroupPolicy_109.x.x.4 internal&#xA;group-policy GroupPolicy_109.x.x.4 attributes&#xA; vpn-tunnel-protocol ikev1 &#xA;username * encrypted privilege 15&#xA;username * encrypted privilege 15&#xA;tunnel-group 109.x.x.4 type ipsec-l2l&#xA;tunnel-group 109.x.x.4 ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;tunnel-group ClientVPN type remote-access&#xA;tunnel-group ClientVPN general-attributes&#xA; address-pool Pool.Lyon&#xA; default-group-policy GroupPolicy_ClientVPN&#xA;tunnel-group ClientVPN webvpn-attributes&#xA; group-alias ClientVPN enable&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect icmp &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;Cryptochecksum:a0b795c9e166e7284056fe3de509b867&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ISP router configuration is detailled in the network diagram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the customer's firewall there isn't any traffic from the Cisco ASA.&#xA;Can someone explain to me the different step to set up the tunnel properly?&lt;/p&gt;&#xA;" OwnerUserId="22406" LastEditorUserId="22406" LastEditDate="2016-05-21T20:20:46.837" LastActivityDate="2017-09-07T02:38:20.147" Title="VPN LAN-to-LAN with Cisco ASA and ISP router" Tags="|routing|cisco-asa|vpn|nat|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28322" PostTypeId="1" AcceptedAnswerId="28331" CreationDate="2016-03-01T15:42:46.640" Score="2" ViewCount="456" Body="&lt;p&gt;We have a set of ~40 embedded devices, each one equipped with a wifi module. All the devices are connected to the same wireless network. All the devices send packets to the same &quot;master&quot; computer. Each device sends at 10KB/s, 50 pps.&#xA;Data is sent using UDP, mainly because our application can tolerate out-of-order or missed packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In our current configuration each device sends to a different multicast address, and the computer joins as many multicast groups as the number of devices. The same multicast address is &lt;strong&gt;not&lt;/strong&gt; shared by multiple devices. Now the problem is that linux has a limit of 20 multicast groups that can be joined by the system, so we can't scale such a configuration to 40 devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore I have two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Is there any drawback in increasing the number of multicast groups that can be joined on Linux from 20 to, say, 100?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Is there any advantage in using a different multicast address for each device? Could I send data from all the devices to the same multicast address?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23355" LastActivityDate="2016-03-01T20:16:10.473" Title="Using as many multicast groups as transmitting devices" Tags="|multicast|udp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28323" PostTypeId="2" ParentId="28322" CreationDate="2016-03-01T15:48:07.280" Score="2" Body="&lt;p&gt;Yes, you can increase the max number of multicast memberships.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check out:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/proc/sys/net/ipv4/igmp_max_memberships&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By default it is set to 20, but you can change the value to 40 (or more).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Proper way to do this would be via sysctl setting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the second part, if all the devices were in the same multicast group, all the devices would recieve all the other packets from all the other devices (as in broadcast), which can cause more power usage and/or processing power usage on embedded devices. &lt;/p&gt;&#xA;" OwnerUserId="1220" LastActivityDate="2016-03-01T15:48:07.280" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28325" PostTypeId="2" ParentId="28243" CreationDate="2016-03-01T17:41:28.710" Score="1" Body="&lt;p&gt;Well, my problem is solved. It looks like RIPv2 was working fine on both BR and RTR. I went to Firewall &gt; Block WAN requests [x] (in my br)  and unchecked it. It was checked by default. I also went to ACL and allowed any traffic from any lan and now i can go out the internet with my clients and servers.. I will be modifying the ACL to secure my network once im done with the rest of the project. THANKS TO EVERYONE! for helping!&lt;/p&gt;&#xA;" OwnerUserId="23175" LastActivityDate="2016-03-01T17:41:28.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28326" PostTypeId="1" AcceptedAnswerId="28328" CreationDate="2016-03-01T17:43:16.850" Score="0" ViewCount="214" Body="&lt;p&gt;I am studying hard for my ‎100-101 ICND1 exam, and a big part of that effort is using GNS3 to mock up lab scenarios so I can get my hands dirty configuring routers and switches* manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing I'm finding a lack of is good lab scenarios to use. I did find this PDF, and it appears to be part of a larger manual for the Cisco Network Academy: &lt;a href=&quot;http://www.chipps.com/2/Lab9-1.pdf&quot; rel=&quot;nofollow&quot;&gt;Lab 9.6.1: Basic EIGRP Configuration Lab&lt;/a&gt;. This is exactly the type of thing I am looking for, and I was hoping someone would recognize it and tell me what the exact title is and if it is generally available for purchase without having to enroll. I am more than willing to pay for this resource, but the Cisco Network Academy site is less than obvious about what I have to do in order to get access to just the book.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I am aware of the common misconception that GNS3 can't emulate L2 switches. I was of that same view until recently, when the GNS3 support folks told me about IOU. I can now simultaneously run router devices and switch devices in GNS3 and practice all my R/S config skills in a native environment.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="22417" LastEditorUserId="22417" LastEditDate="2016-03-01T18:21:39.270" LastActivityDate="2016-03-01T18:34:41.257" Title="What book is this CCNA lab exercise from?" Tags="|cisco|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28327" PostTypeId="2" ParentId="28326" CreationDate="2016-03-01T18:25:10.627" Score="1" Body="&lt;p&gt;You can purchase the Cisco Networking Academy course and lab books at bookstores. A simple Internet search will turn up many sources for the materials.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-01T18:25:10.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28328" PostTypeId="2" ParentId="28326" CreationDate="2016-03-01T18:34:41.257" Score="1" Body="&lt;p&gt;The title of the manual is &quot;Routing Protocols and Concepts - CCNA Exploration Labs and Study Guide.&quot;&lt;/p&gt;&#xA;" OwnerUserId="22417" LastActivityDate="2016-03-01T18:34:41.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28329" PostTypeId="1" AcceptedAnswerId="28330" CreationDate="2016-03-01T19:12:24.583" Score="14" ViewCount="24408" Body="&lt;p&gt;If PC1 sends an Ethernet frame to Switch1 which forwards the frame to Switch2 which in turn forwards the frame to PC2, does any decapsulation happen that changes the source MAC address? &lt;/p&gt;&#xA;" OwnerUserId="23113" LastEditorUserId="8499" LastEditDate="2018-03-10T00:39:28.727" LastActivityDate="2018-03-10T00:39:28.727" Title="Does the source MAC address of a frame change when it passes through several switches?" Tags="|switch|ethernet|switching|mac-address|" AnswerCount="2" CommentCount="2" ClosedDate="2020-01-19T15:10:37.477" ContentLicense="CC BY-SA 3.0" />
  <row Id="28330" PostTypeId="2" ParentId="28329" CreationDate="2016-03-01T19:15:04.240" Score="13" Body="&lt;p&gt;No. If all the switches are layer-2 switches, the frames are switched without any changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only with routers, including layer-3 switches where the packets need to cross to other VLANs, will the frames be stripped and rewritten for the new network or VLAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-01T19:15:04.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28331" PostTypeId="2" ParentId="28322" CreationDate="2016-03-01T20:16:10.473" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any advantage in using a different multicast address for each&#xA;  device?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, unless your application &lt;em&gt;needs&lt;/em&gt; distinct destination multicast addresses.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Could I send data from all the devices to the same multicast address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, of course, unless some behavior in your application opposes it.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-03-01T20:16:10.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28332" PostTypeId="1" AcceptedAnswerId="28400" CreationDate="2016-03-01T20:42:03.820" Score="1" ViewCount="1096" Body="&lt;p&gt;Running Juniper SRX device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within a routing-instance, I removed two /25 static routes and replaced it with a single /24 static route.  This /24 static route starts on the same IP, just a bigger subnet.  Note that 172.18.10.10 is a blackhole; 10.10.201.128/25 is NOT being used yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Config for routing-instance A:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[omitted]&#xA;routing-options {&#xA;    static {&#xA;        inactive: route 10.212.17.0/24 next-hop 10.212.210.17;&#xA;        route 10.10.200.0/25 next-hop 172.18.10.2;&#xA;        route 10.10.201.0/25 next-hop 172.18.10.6;&#xA;        route 10.10.201.128/25 next-hop 172.18.10.10;&#xA;    }&#xA;[omitted]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;New config for routing-instance A:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[omitted]&#xA;routing-options {&#xA;    static {&#xA;        inactive: route 10.212.17.0/24 next-hop 10.212.210.17;&#xA;        route 10.10.200.0/25 next-hop 172.18.10.2;&#xA;        route 10.10.201.0/24 next-hop 172.18.10.6;&#xA;    }&#xA;[omitted]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After making this change,  I can no longer route from some places (but not all) to 10.10.201.0/25 hosts.  At first I thought this might be caused by a summarization issue, but then I realized that two other random networks within the &lt;strong&gt;same&lt;/strong&gt; routing instance (let us call it routing instance B) and on the &lt;strong&gt;same&lt;/strong&gt; router (not going through ebgp connections from other sites) do not have similar behavior.  Specifically, 10.212.200.0/24 cannot reach 10.10.201.0/25, but 10.212.203.0/24 can.  Again, both 10.212.200/24 and 10.212.203/24 are coming from the &lt;strong&gt;same&lt;/strong&gt; routing instance on the &lt;strong&gt;same&lt;/strong&gt; physical router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So...I checked the security flow to look at the traffic, and I found that traffic was able to route from 10.10.201.0/25 to the appropriate hosts, however some hosts were unable to respond with an echo response:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Session ID: 6726, **Policy name: HQ-VPN-DMZ_To_Trust**/30, Timeout: 2, Valid&#xA;  In: 10.10.201.3/152 --&amp;gt; 10.212.200.1/63851;icmp, If: ge-0/0/7.0, Pkts: 1, Bytes: **84**&#xA;  Out: 10.212.200.1/63851 --&amp;gt; 10.10.201.3/152;icmp, If: ge-0/0/4.0, Pkts: 0, Bytes: **0**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So...I checked the policy hit-count, and saw that the hit-count was increasing.  The policy is listed below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy HQ-VPN-DMZ_To_Trust {&#xA;    match {&#xA;        source-address [ *omitted* 10.212.210.18/32 10.10.201.0/25 ];&#xA;        destination-address any;&#xA;        application any;&#xA;    }&#xA;    then {&#xA;        permit;&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since the source IP is 10.10.201.3, the policy hit-counter should NOT have been increasing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is: How is it possible that the policy was blocking that return echo response from 10.212.200.1 -&gt; 10.10.201.3, when it is clearly permitted?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should note that when I added the specific static route...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[omitted]&#xA;routing-options {&#xA;    static {&#xA;        inactive: route 10.212.17.0/24 next-hop 10.212.210.17;&#xA;        route 10.10.200.0/25 next-hop 172.18.10.2;&#xA;        route 10.10.201.0/24 next-hop 172.18.10.6;&#xA;        route 10.10.201.0/25 next-hop 172.18.10.6;&#xA;    }&#xA;[omitted]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;...back into the routing-instance config, everything started working again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since we are on this topic, how is it possible that 10.10.201.0/25 static route would work, but 10.10.201.0/24 static route would &lt;strong&gt;not&lt;/strong&gt; work?  10.10.201.0/25 is summarized within 10.10.201.0/24!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The show route output differences are shown below (one with the /25 in, and one with the /24 in):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With /24:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x@x&amp;gt; show route 10.10.201.0        &#xA;&#xA;inet.0: 919 destinations, 1825 routes (919 active, 0 holddown, 1 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;0.0.0.0/0          *[BGP/80] 18w6d 22:42:17, localpref 100&#xA;                      AS path: YYYY AAAA I&#xA;                    &amp;gt; to 104.x.x.x via ge-0/0/0.0&#xA;                    [BGP/80] 7w4d 10:38:07, localpref 50, from 10.99.1.23&#xA;                      AS path: YYYY BBBB I&#xA;                    &amp;gt; to 10.99.1.2 via ge-0/0/15.0&#xA;                    [OSPF/150] 14w5d 02:01:25, metric 1, tag 0&#xA;                    &amp;gt; to 10.99.1.2 via ge-0/0/15.0&#xA;&#xA;DMZ.inet.0: 101 destinations, 101 routes (101 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.10.201.0/24     *[Static/5] 00:49:33&#xA;                    &amp;gt; to 172.18.10.6 via ge-0/0/7.0&#xA;&#xA;tunnel.inet.0: 90 destinations, 113 routes (73 active, 0 holddown, 25 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;0.0.0.0/0          *[BGP/80] 18w6d 22:42:17, localpref 100&#xA;                      AS path: YYYY AAAA I&#xA;                    &amp;gt; to 104.x.x.x via ge-0/0/0.0&#xA;&#xA;lan-vr.inet.0: 58 destinations, 83 routes (58 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;0.0.0.0/0          *[BGP/80] 18w6d 22:42:17, localpref 100&#xA;                      AS path: YYYY AAAA I&#xA;                    &amp;gt; to 104.x.x.x via ge-0/0/0.0&#xA;                    [OSPF/150] 7w4d 10:38:06, metric 0, tag 0&#xA;                    &amp;gt; to 10.212.6.20 via ge-0/0/1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With /25:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x@x# run show route 10.10.201.0 &#xA;&#xA;inet.0: 921 destinations, 1829 routes (921 active, 0 holddown, 1 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.10.201.0/25     *[Static/5] 01:04:04&#xA;                    &amp;gt; to 172.18.10.6 via ge-0/0/7.0&#xA;                    [OSPF/150] 01:04:02, metric 1, tag 0&#xA;                    &amp;gt; to 10.99.1.2 via ge-0/0/15.0&#xA;&#xA;DMZ.inet.0: 102 destinations, 102 routes (102 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.10.201.0/25     *[Static/5] 01:04:06&#xA;                    &amp;gt; to 172.18.10.6 via ge-0/0/7.0&#xA;&#xA;tunnel.inet.0: 91 destinations, 114 routes (74 active, 0 holddown, 25 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.10.201.0/25     *[Static/5] 01:04:04&#xA;                    &amp;gt; to 172.18.10.6 via ge-0/0/7.0&#xA;&#xA;lan-vr.inet.0: 59 destinations, 84 routes (59 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.10.201.0/25     *[Static/5] 01:04:04&#xA;                    &amp;gt; to 172.18.10.6 via ge-0/0/7.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13969" LastEditorUserId="13969" LastEditDate="2016-03-03T23:29:40.393" LastActivityDate="2016-03-04T04:17:42.573" Title="Juniper JUNOS security policy incorrectly blocking traffic that is explicitly permitted" Tags="|routing|firewall|juniper-junos|juniper-srx|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28336" PostTypeId="1" AcceptedAnswerId="28337" CreationDate="2016-03-02T00:00:43.753" Score="1" ViewCount="41" Body="&lt;p&gt;So this question has more to do with what useful packet information can be picked up by an IDS sensor (for example) based on its placement on an internal network. Suppose we have a sensor placed at a core switch, and the payload of an inbound packet from an external source contains some activity of interest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would the Source IP reflect the external host which sent the traffic, or would that information be stripped and replaced with the IP of an intermediary network device which routed the traffic? Is there a common circumstance in which sensor placement would mean constantly seeing an internal IP as the source rather than the external host?&lt;/p&gt;&#xA;" OwnerUserId="23366" LastActivityDate="2016-03-02T00:12:14.723" Title="Is External Source IP info routinely stripped/replaced as it traverses through internal network?" Tags="|packet-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28337" PostTypeId="2" ParentId="28336" CreationDate="2016-03-02T00:12:14.723" Score="1" Body="&lt;p&gt;Most commonly, the source IP of a packet from an external source will be unchanged.  It is possible that your border router or firewall could translate that address to an internal (i.e., private) address, but that is uncommon. Your firewall administrator can tell you if that is the (unlikely) case.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-02T00:12:14.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28341" PostTypeId="1" AcceptedAnswerId="28377" CreationDate="2016-03-02T02:27:23.087" Score="3" ViewCount="2618" Body="&lt;p&gt;I'm running into what should be a very easy problem to solve- I need to see all routes coming from one specific next-hop on a few cisco ASR 1002-X's that I have in my network. Normally this should be as easy as a &lt;code&gt;| inc x.x.x.x&lt;/code&gt; filter on &lt;code&gt;show ip route&lt;/code&gt;, but all of the output is coming up on two lines due to the length of the interface names, making the filter useless. Here is some example output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;Router&amp;gt;#sh ip route &#xA;&#xA;&amp;lt;legend omitted&amp;gt;    &#xA;&#xA;D*EX  0.0.0.0/0 [170/51968] via 10.x.x.58, 7w0d, GigabitEthernet0/2/0.140&#xA;      10.0.0.0/8 is variably subnetted, 294 subnets, 13 masks &#xA;D EX     10.x.x.23/32 &#xA;           [170/5120] via 10.x.x.78, 5w1d, GigabitEthernet0/2/0.142 &#xA;D        10.x.x.0/24 &#xA;           [90/3584] via 10.x.x.58, 2w3d, GigabitEthernet0/2/0.140 &#xA;D        10.x.x.0/13 &#xA;           [90/4864] via 10.x.x.68, 7w0d, GigabitEthernet0/2/0.141 &#xA;D        10.x.x.0/30 &#xA;           [90/4608] via 10.x.x.68, 7w0d, GigabitEthernet0/2/0.141 &#xA;D        10.x.x.4/30 &#xA;           [90/5376] via 10.x.x.58, 7w0d, GigabitEthernet0/2/0.140 &#xA;D        10.x.x.253/32 &#xA;           [90/133120] via 10.x.x.58, 7w0d, GigabitEthernet0/2/0.140 &#xA;D        10.x.x.254/32 &#xA;           [90/132352] via 10.x.x.68, 7w0d, GigabitEthernet0/2/0.141 &#xA;D        10.x.x.0/14 &#xA;           [90/3328] via 10.x.x.58, 7w0d, GigabitEthernet0/2/0.140&#xA;...&amp;lt;etc&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No matter what I do (including increasing the terminal width to 256 chars), the output is always on two lines, removing the ability to use the pipe/inc filter. I'm aware I can redirect to file, copy to my desktop, and then start doing some manual searching via a text editor, but that is all very time-consuming when I'm in the middle of troubleshooting an issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there a way to filter a list of all routes on a router by next-hop IP, even when the next-hop IP is displayed on the second line of output of &lt;code&gt;show ip route&lt;/code&gt;?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="21833" LastActivityDate="2016-03-02T23:49:50.403" Title="Show all routes from one next-hop via CLI" Tags="|cisco|cisco-ios|cisco-commands|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28343" PostTypeId="2" ParentId="28341" CreationDate="2016-03-02T04:02:55.760" Score="0" Body="&lt;p&gt;Have you tried using the &lt;code&gt;show ip route | sec X.X.X.X&lt;/code&gt;? The section option should provide more output than the single line inc option. &lt;/p&gt;&#xA;" OwnerUserId="599" LastActivityDate="2016-03-02T04:02:55.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28345" PostTypeId="1" CreationDate="2016-03-02T06:58:08.673" Score="3" ViewCount="2825" Body="&lt;p&gt;I work in a company that installs CCTV, and with this we often have to do networking to allow remote viewing of these devices. One thing I have noticed is that when you are connected to the network (Via WIFI or LAN) you cant connect to the device using the external IP, so I've had to set the app to have 2 &quot;Devices&quot;, one internal and one external. The internal connects directly to the internal IP of the device, and the external connects to the device via the public IP and forwarded ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, is there a way to make it so that you can connect using the external IP even though you are connected to the internal network? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clients want &quot;simple&quot; and there are a few that cant figure out that you use internal for when connected to the network and external for not, so i would like to simplify this to one button if its possible.&lt;/p&gt;&#xA;" OwnerUserId="23376" LastActivityDate="2016-03-02T07:23:42.407" Title="Connecting to network device from inside and outside network" Tags="|routing|ip|internet|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28346" PostTypeId="2" ParentId="28345" CreationDate="2016-03-02T07:23:42.407" Score="3" Body="&lt;p&gt;What you are looking for is called &quot;NAT Hairpin&quot; or &quot;NAT reflection&quot; or &quot;NAT loopback&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may not be supported by the customer gateway, and the exact way to configure it depends of course of the box used as gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quoted from &lt;a href=&quot;https://en.wikipedia.org/wiki/Network_address_translation&quot; rel=&quot;nofollow&quot;&gt;this article&lt;/a&gt; in Wikipedia&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;NAT loopback&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;NAT loopback, also known as NAT hairpinning or NAT reflection,[9] is a&#xA;  feature in many consumer routers[10] which permits the access of a&#xA;  service via the public IP address from inside the local network. This&#xA;  eliminates the need for using separate domain name resolution for&#xA;  hosts inside the network than for the public network for a website,&#xA;  for example.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following describes an example network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Public address: 203.0.113.1. This is the address of the WAN interface on the router.&#xA;Internal address of router: 192.168.1.1&#xA;Address of the server: 192.168.1.2&#xA;Address of a local computer: 192.168.1.100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;If a packet is sent to the public address by a computer at&#xA;  192.168.1.100, the packet would normally be routed to the default gateway (the router), unless an explicit route is set in the&#xA;  computer's routing tables. A router with the NAT loopback feature&#xA;  detects that 203.0.113.1 is the address of its WAN interface, and&#xA;  treats the packet as if coming from that interface. It determines the&#xA;  destination for that packet, based on DNAT (port forwarding) rules for&#xA;  the destination. If the data were sent to port 80 and a DNAT rule&#xA;  exists for port 80 directed to 192.168.1.2, then the host at that&#xA;  address receives the packet.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If no applicable DNAT rule is available, the router drops the packet.&#xA;  An ICMP Destination Unreachable reply may be sent. If any DNAT rules&#xA;  were present, address translation is still in effect; the router still&#xA;  rewrites the source IP address in the packet. The local computer&#xA;  (192.168.1.100) sends the packet as coming from 192.168.1.100, but the&#xA;  server (192.168.1.2) receives it as coming from 203.0.113.1. When the&#xA;  server replies, the process is identical as for an external sender.&#xA;  Thus, two-way communication is possible between hosts inside the LAN&#xA;  network via the public IP address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-02T07:23:42.407" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28347" PostTypeId="2" ParentId="28317" CreationDate="2016-03-02T07:34:59.450" Score="1" Body="&lt;p&gt;It's impossible to say for sure without having more information about what type of link you have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still, keep in mind how the tools usually measure this bandwidth. The router doesn't maintain a &quot;bandwidth&quot; metric that you can read from SNMP. Rather, it has counters for the number of bytes that have been input and output. So your monitoring tool will poll that number at set intervals and calculate&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(ByteCount(SecondPoll) - ByteCount(FirstPoll)) / (SecondPoll - FirstPoll)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem with this is that you have the router providing the byte count when it receives the poll request (and it may be counting bytes as they are queued, not necessarily as they are emitted), and the tool counting time when it sends the poll request. This allows for all sorts of fun problems with buffering in various places that can lead to unexpected spikes in the data because you end up violating the unstated assumption that time delta between byte count values is the same as between the polling requests. You can also get issues with counter resets and rollovers, though most tools are good at detecting that.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-03-02T07:34:59.450" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28348" PostTypeId="1" AcceptedAnswerId="28366" CreationDate="2016-03-02T07:50:29.343" Score="1" ViewCount="3345" Body="&lt;p&gt;my team and I just don't seem to get NetFlow on a Catalyst 3560 switch to work.&#xA;let me show you the config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; flow exporter NETFLOW-EXPORTER&#xA; destination 10.10.10.12&#xA; source Vlan100&#xA; transport udp 2055&#xA;!&#xA;!&#xA;flow record NETFLOW-RECORD&#xA; match ipv4 tos&#xA; match ipv4 protocol&#xA; match ipv4 source address&#xA; match ipv4 destination address&#xA; match transport source-port&#xA; match transport destination-port&#xA; match interface input&#xA; collect interface output&#xA; collect counter bytes long&#xA; collect counter packets long&#xA;!&#xA;!&#xA;flow monitor NETFLOW-MONITOR&#xA; record NETFLOW&#xA; exporter NETFLOW&#xA; statistics packet protocol&#xA; statistics packet size&#xA; cache timeout active 60&#xA;&#xA;interface range GigabitEthernet 0/1-52&#xA; ip flow ingress&#xA; ip flow egress&#xA; ip flow monitor NETFLOW-MONITOR input&#xA; ip flow monitor NETFLOW-MONITOR output&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, we are at a point where we added pretty much everything. The exporter still does not seem to send anything to the destination:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Flow Exporter NETFLOW-EXPORTER:&#xA;Description:              User defined&#xA;Export protocol:          NetFlow Version 9&#xA;Transport Configuration:&#xA;    Destination IP address: 10.10.10.12&#xA;    Source IP address:      10.10.100.254&#xA;    Source Interface:       Vlan100&#xA;    Transport Protocol:     UDP&#xA;    Destination Port:       2055&#xA;    Source Port:            61154&#xA;    DSCP:                   0x0&#xA;    TTL:                    255&#xA;    Output Features:        Not Used&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The destination: 10.10.10.12 is running a PRTG instance where this switch is configured. SNMP information seem to work just fine, it's just NetFlow that wont show anything. The config on the PRTG should be fine (IP and port are a match)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any Ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance :)&lt;/p&gt;&#xA;" OwnerUserId="18743" LastActivityDate="2016-03-04T10:12:55.713" Title="NetFlow v9 on Cisco Catalyst 3560 not working" Tags="|cisco|cisco-ios|cisco-catalyst|netflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28349" PostTypeId="1" CreationDate="2016-03-02T08:34:20.457" Score="1" ViewCount="102" Body="&lt;p&gt;I'm trying to understand the MTU management when creating IPSec packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a IP packets already has the MTU, the resulting IPSec packet will be too large for the outbound link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a &lt;strong&gt;IPSec fragmentation&lt;/strong&gt; process to resolve this ? Like sending mutiple framgented IPSec packets, to be remuxed at the reciever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, I'm in a project which relies on adding some data on the IP packet before IPSec-transforming it. The MTU is thus critical here, because it bounds the amount of data we can add on the packet...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also seen that &lt;a href=&quot;https://www.zeitgeist.se/2013/11/26/mtu-woes-in-ipsec-tunnels-how-to-fix/&quot; rel=&quot;nofollow&quot; title=&quot;MSS Reduction&quot;&gt;MSS size reduction&lt;/a&gt; is an option. How can I specify it on the uphill link ?&lt;/p&gt;&#xA;" OwnerUserId="17011" LastEditorUserId="8499" LastEditDate="2016-03-02T16:15:03.523" LastActivityDate="2016-03-02T16:15:03.523" Title="MTU when creating IPSec Packets" Tags="|ipsec|mtu|packet-path|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28350" PostTypeId="2" ParentId="28329" CreationDate="2016-03-02T08:52:47.327" Score="3" Body="&lt;p&gt;The MAC address is a unique identifier which is used by hosts on the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switch were to change the destination MAC, the frame would not get delivered to the appropriate host. In the cases that it would, for example if the frame gets flooded, the destination host would drop it because it would no longer be destined for the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switch were to change the source MAC address, the destination host would use this MAC address for any responses (including updating any ARP entries with bad data). This would result in the same situation I already described, just for all return traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could mechanisms be developed to do this? I am sure they could. But there is no reason to do so at this point and this would only complicate networking and add unnecessary processing. We are not close to exhausting the available MAC address pool so there is no need for something like MAT (don't know if the concept of MAC address translation even exists anywhere so maybe I just coined a term?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answered by @YLearn&#xA;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5337/why-dont-switches-rewrite-mac-addresses&quot;&gt;Why don't switches rewrite mac-addresses?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6118" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-03-02T08:52:47.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28351" PostTypeId="2" ParentId="2594" CreationDate="2016-03-02T10:16:24.107" Score="0" Body="&lt;p&gt;we can classify devices into two..&#xA;1.DCE &#xA;2.DTE&#xA;to connect similar device Ex. DCE and DCE ..use crossover cable&#xA;similarly, to connect DTE and DTE use cross over cable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To connect different devices DTE and DCE or DCE and DTE use Straight through cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(check which devices are DTE and which devices DCE) &lt;/p&gt;&#xA;" OwnerUserId="23379" LastActivityDate="2016-03-02T10:16:24.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28352" PostTypeId="1" AcceptedAnswerId="28359" CreationDate="2016-03-02T11:29:52.873" Score="2" ViewCount="132" Body="&lt;p&gt;I was reading the following extract:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A LFN is a network that offers a high bandwidth but also a very high&#xA;  delay. An example could be a satellite connection. These connections&#xA;  offer a high bandwidth but the delay is also quite high since you have&#xA;  to send your signal 22000 miles up to the satellite and another 22000&#xA;  miles down to reach the receiver. You can expect a round trip time&#xA;  anywhere between about 500-1000 ms.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The problem here is that when the sender sends some data, it has to be&#xA;  wait a very long time for an acknowledgment of the receiver before it&#xA;  can send the next data. During the time we are waiting, nothing&#xA;  happens so we don’t utilize the full bandwidth of our link.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Given that we don't utilize full bandwidth of our link when the sender has to wait for a long time for an acknowledgement, what do we actually mean when we say this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does full utilization of bandwidth means that the sender needs to pump the data continuously? Also, let me know if the data transfer rate of the sender bears any relation to the bandwidth of the link?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I have perceived, data transfer rate of the sender is independent of bandwidth of the link as long as it is less than the latter. Am I correct?&lt;/p&gt;&#xA;" OwnerUserId="17721" LastActivityDate="2016-03-02T21:00:34.590" Title="full utilization of bandwidth and its physical significance" Tags="|bandwidth|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28356" PostTypeId="1" AcceptedAnswerId="28361" CreationDate="2016-03-02T12:44:22.020" Score="2" ViewCount="1298" Body="&lt;p&gt;Does IPSec work below or above the network(IP) layer? If below then how does a router read the destination IP address which is encrypted inside the IPSec encryption?&lt;/p&gt;&#xA;" OwnerUserId="23375" LastActivityDate="2016-03-02T13:30:54.987" Title="Which layer does IPSec work" Tags="|ipsec|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28357" PostTypeId="1" AcceptedAnswerId="28367" CreationDate="2016-03-02T12:46:37.453" Score="0" ViewCount="993" Body="&lt;p&gt;If the length of a packet by attaching GRE-IP header results in bigger size than router MTU, what happen on More Fragment Flag and Frag Offset field of that packet?&lt;/p&gt;&#xA;" OwnerUserId="23383" LastEditorUserId="8499" LastEditDate="2022-11-20T01:42:20.213" LastActivityDate="2022-11-20T01:42:20.213" Title="More Fragment flag and Frag Offset field after GRE fragmentation" Tags="|ip|mtu|gre|fragmentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28359" PostTypeId="2" ParentId="28352" CreationDate="2016-03-02T12:59:48.210" Score="4" Body="&lt;p&gt;Suppose this scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sender and the receiver share a &lt;em&gt;1 Mbps bandwith media&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the sender needs to send a file of &lt;em&gt;2 Mbit&lt;/em&gt;, in an ideal world it will take &lt;em&gt;2 seconds&lt;/em&gt; using the full bandwith.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in the real world we have two problems:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The 2 Mbit file must be divided in chunks because the sending and receiving buffers are limited and because it gives you a more detailed control of errors.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The media has a propagation delay from end to end.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Let's make each chunk of &lt;em&gt;25000 bits&lt;/em&gt; long, giving us a total of 800 chunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's suppose the media has a propagation delay of &lt;em&gt;10 milliseconds&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Start-Stop protocol:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Protocols using a start-stop technique send each chunk and stops until an acknowledge returns, in that case and supossing zero errors, to send each chunk of 2500 bits takes &lt;em&gt;20 milliseconds&lt;/em&gt; and give us a bandwith use of &lt;strong&gt;125 Kbps&lt;/strong&gt;. In that fashion it will take 16 seconds to transmit the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Sliding Window protocol:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sliding window technique allows to send chunks one after another and receive acknowledgments in an asynchronous way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ssupposing a window of &lt;em&gt;10&lt;/em&gt; then the sender put 10 chunks on the media. It takes &lt;em&gt;100 milliseconds&lt;/em&gt; and before sending the next one, the acknowledge for the first chunk must have arrived. If everything is right and there are zero errors, it will be 110 milliseconds for 25000 bits giving us a use of &lt;strong&gt;227 Kbps&lt;/strong&gt; ( more efficient that the first case). It will take 8,8 seconds to send the file.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bigger chunk (5000 bits) can give us &lt;strong&gt;455&lt;/strong&gt; Kbps and a transfer time of 4,4 seconds. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;All this supossing zero errors.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bandwith is a limit but the data transfer is a result of the protocol used, the propagation delay and the errors in the media.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-03-02T17:54:05.267" LastActivityDate="2016-03-02T17:54:05.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28361" PostTypeId="2" ParentId="28356" CreationDate="2016-03-02T13:30:54.987" Score="3" Body="&lt;ul&gt;&#xA;&lt;li&gt;IPSec Tunnel Mode.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;IPSec is above the IP layer, but inside the encrypted IPSec packet, there is the original IP and payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPSec wraps the original packet, encrypts it, adds a new IP header and sends it to the other side of the VPN tunnel.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IPSec Transport Mode&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now IPSec only protects the data, and uses the original IP header, just changing the protocol field.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2016-03-02T13:30:54.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28364" PostTypeId="2" ParentId="28349" CreationDate="2016-03-02T15:35:41.750" Score="2" Body="&lt;p&gt;The VPN client can reduce the MSS.  As the article you linked to shows, different clients have different values for doing so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't need a separate fragmentation process, because the IP fragmentation &quot;process&quot; will fragment the packet if it's too big.  Although from my experience, many clients will set the DF flag.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-02T15:35:41.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28365" PostTypeId="2" ParentId="25879" CreationDate="2016-03-02T16:02:12.740" Score="4" Body="&lt;p&gt;This problem happens because Linux bonding in 802.3ad mode sets all slave interfaces to the same hardware mac address (&quot;borrowed&quot; from the first enslaved interface). Then LACP PDUs are transmitted using this same mac address and each of the switches thinks it has direct connection to the server. At the same time, bonding drops packets which are received on it's inactive aggregator. Most probably this issue: &lt;a href=&quot;https://sourceforge.net/p/bonding/discussion/77913/thread/520c70a8/#2b21&quot; rel=&quot;nofollow&quot;&gt;https://sourceforge.net/p/bonding/discussion/77913/thread/520c70a8/#2b21&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: There's workaround in current kernels: &lt;a href=&quot;https://github.com/opencomputeproject/OpenNetworkLinux/blob/master/packages/base/any/kernels/3.2.65-1%2Bdeb7u2/patches/network-bonding-lacp-fix-incorrect-mux-state.patch&quot; rel=&quot;nofollow&quot;&gt;https://github.com/opencomputeproject/OpenNetworkLinux/blob/master/packages/base/any/kernels/3.2.65-1%2Bdeb7u2/patches/network-bonding-lacp-fix-incorrect-mux-state.patch&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23389" LastEditorUserId="23389" LastEditDate="2016-03-02T17:09:16.390" LastActivityDate="2016-03-02T17:09:16.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28366" PostTypeId="2" ParentId="28348" CreationDate="2016-03-02T16:06:33.383" Score="0" Body="&lt;p&gt;Your Flow Monitor doesn't match your Flow Record or Flow Exporter. You have &lt;code&gt;record NETFLOW&lt;/code&gt; and &lt;code&gt;exporter NETFLOW&lt;/code&gt;. Try something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flow monitor NETFLOW-MONITOR&#xA; record NETFLOW-RECORD&#xA; exporter NETFLOW-EXPORTER&#xA; statistics packet protocol&#xA; statistics packet size&#xA; cache timeout active 60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You also don't need the old NetFlow commands on the interface, so you can remove:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ip flow ingress&#xA; ip flow egress&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the way I have seen it work successfully, albeit only used on layer-3 interfaces, and only in one direction or the other:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flow record NETFLOW-RECORD&#xA; match ipv4 tos&#xA; match ipv4 protocol&#xA; match ipv4 source address&#xA; match ipv4 destination address&#xA; match transport source-port&#xA; match transport destination-port&#xA; collect interface input&#xA; collect interface output&#xA; collect counter bytes&#xA; collect counter packets&#xA;!&#xA;flow exporter NETFLOW-EXPORTER&#xA; destination 10.10.10.12&#xA; transport udp 2055&#xA; source Vlan100&#xA;!&#xA;flow monitor NETFLOW-MONITOR&#xA; record NETFLOW-RECORD&#xA; exporter NETFLOW-EXPORTER&#xA; cache timeout inactive 15&#xA; cache timeout active 60&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can try it in both directions on a layer-2 interface, but I think your problem is the incorrect Flow Record and Flow Exporter in the Flow Monitor.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface range GigabitEthernet 0/1-52&#xA; ip flow monitor NETFLOW-MONITOR input&#xA; ip flow monitor NETFLOW-MONITOR output&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is from &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/15-2_2_e/flexible_netflow/configuration_guide/b_fnf_1522e_3750x_3560x_cg/b_fnf_1522e_3750x_3560x_cg_chapter_010.html#reference_C63398C01C7C41E1AEC2BCEE4915A909&quot; rel=&quot;nofollow&quot;&gt;Configuring Flexible NetFlow&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;NetFlow is supported only on the network services module. Only one&#xA;  flow monitor per interface and per direction is supported by the&#xA;  network services module.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I understand it, you need IOS 15.x, and at least the IP Base license with the Network Services Module for Flexible NetFlow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are trying to apply it to non-module ports, G0/1-48, which doesn't work, anyway. It should only work on G0/49-52, but I'm not sure you can use it on the 3560 at all. I saw a note generated from Cisco TAC saying that this only works on a 3750X:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The netflow module is only available in the 3750x's. You're out of&#xA;  luck.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Sent from Cisco Technical Support Android App&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-04T10:12:55.713" LastActivityDate="2016-03-04T10:12:55.713" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="28367" PostTypeId="2" ParentId="28357" CreationDate="2016-03-02T16:31:10.757" Score="0" Body="&lt;p&gt;Often, IP packets will need to be fragmented before encapsulation by GRE. The tunnel interface will have a smaller MTU than the physical router interface (physical interface MTU - GRE packet overhead). The tunnel interface is treated as a real interface, and the IP packets entering the tunnel will need to be fragmented before GRE encapsulation.&lt;/p&gt;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7588&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7588, A Widely Deployed Solution to the Generic Routing Encapsulation (GRE) Fragmentation Problem&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;2.2. A Widely Deployed Solution&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Many vendors have implemented a configurable GRE fragmentation&#xA;solution. In its default configuration, the solution behaves as&#xA;follows:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When the GRE ingress node receives a fragmentable packet with&#xA;length greater than the GMTU, it fragments the incoming packet and&#xA;encapsulates each fragment within a complete GRE header and GRE&#xA;delivery header. Fragmentation logic is as specified by the&#xA;payload protocol.&lt;/li&gt;&#xA;&lt;li&gt;When the GRE ingress node receives a non-fragmentable packet with&#xA;length greater than the GMTU, it discards the packet and sends an&#xA;ICMP PTB message to the packet's source.&lt;/li&gt;&#xA;&lt;li&gt;When the GRE egress node receives a GRE delivery packet fragment,&#xA;it silently discards the fragment without attempting to reassemble&#xA;the GRE delivery packet to which the fragment belongs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;In non-default configurations, the GRE ingress node can execute any&#xA;of the procedures defined in RFC 4459.&lt;/p&gt;&#xA;&lt;p&gt;The solution described above is widely deployed on the Internet in&#xA;its default configuration. However, the default configuration is not&#xA;always appropriate for GRE tunnels that carry IPv6.&lt;/p&gt;&#xA;&lt;p&gt;IPv6 requires that every link in the Internet have an MTU of 1280&#xA;octets or greater. On any link that cannot convey a 1280-octet&#xA;packet in one piece, link-specific fragmentation and reassembly must&#xA;be provided at a layer below IPv6.&lt;/p&gt;&#xA;&lt;p&gt;Therefore, the default configuration is appropriate for tunnels&#xA;that carry IPv6 only if the network is engineered so that the GMTU&#xA;is guaranteed to be 1280 bytes or greater. In all other scenarios,&#xA;a non-default configuration is required.&lt;/p&gt;&#xA;&lt;p&gt;In the non-default configuration, when the GRE ingress router&#xA;receives a packet lager than the GMTU, the GRE ingress router&#xA;encapsulates the entire packet in a single GRE and delivery header.&#xA;It then fragments the delivery header and sends the resulting&#xA;fragments to the GRE egress node, where they are reassembled.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;And:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;3.3.1.1. IPv4 Payloads&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;By default, if the payload is fragmentable, the GRE ingress node&#xA;fragments the incoming packet and encapsulates each fragment within a&#xA;complete GRE header and GRE delivery header. Therefore, the GRE&#xA;egress node receives several complete, non-fragmented delivery&#xA;packets. Each delivery packet contains a fragment of the GRE&#xA;payload. The GRE egress node forwards the payload fragments to their&#xA;ultimate destination where they are reassembled.&lt;/p&gt;&#xA;&lt;p&gt;Also by default, if the payload is not fragmentable, the GRE&#xA;ingress node discards the packet and sends an ICMPv4 Destination&#xA;Unreachable message to the packet's source. The ICMPv4 Destination&#xA;Unreachable message code equals 4 (fragmentation needed and DF&#xA;set). The ICMPv4 Destination Unreachable message also contains a&#xA;next-hop MTU (as specified by [RFC1191]), and the next-hop MTU is&#xA;equal to the GMTU associated with the tunnel.&lt;/p&gt;&#xA;&lt;p&gt;The GRE ingress node supports a non-default configuration option&#xA;that invokes an alternative behavior. If that option is&#xA;configured, the GRE ingress node fragments the delivery packet.&#xA;See Section 3.3.2 for details.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791, INTERNET PROTOCOL&lt;/a&gt;, has a complete discussion on fragmentation, including examples:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Example 2:&lt;/p&gt;&#xA;&lt;p&gt;In this example, we show first a moderate size internet datagram&#xA;(452   data octets), then two internet fragments that might result&#xA;from the   fragmentation of this datagram if the maximum sized&#xA;transmission   allowed were 280 octets.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; 0                   1                   2                   3&#xA; 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|Ver= 4 |IHL= 5 |Type of Service|       Total Length = 472      |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|     Identification = 111      |Flg=0|     Fragment Offset = 0 |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|   Time = 123  | Protocol = 6  |        header checksum        |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                         source address                        |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                      destination address                      |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                             data                              |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                             data                              |&#xA;\                                                               \&#xA;\                                                               \&#xA;|                             data                              |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|             data              |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&#xA;                   Example Internet Datagram&#xA;&#xA;                           Figure 6.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Now the first fragment that results from splitting the datagram&#xA;after   256 data octets.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; 0                   1                   2                   3&#xA; 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|Ver= 4 |IHL= 5 |Type of Service|       Total Length = 276      |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|     Identification = 111      |Flg=1|     Fragment Offset = 0 |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|   Time = 119  | Protocol = 6  |        Header Checksum        |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                         source address                        |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                      destination address                      |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                             data                              |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                             data                              |&#xA;\                                                               \&#xA;\                                                               \&#xA;|                             data                              |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                             data                              |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&#xA;                   Example Internet Fragment&#xA;&#xA;                           Figure 7.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And the second fragment.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; 0                   1                   2                   3&#xA; 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|Ver= 4 |IHL= 5 |Type of Service|       Total Length = 216      |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|     Identification = 111      |Flg=0|  Fragment Offset  =  32 |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|   Time = 119  | Protocol = 6  |        Header Checksum        |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                         source address                        |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                      destination address                      |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                             data                              |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|                             data                              |&#xA;\                                                               \&#xA;\                                                               \&#xA;|                             data                              |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;|            data               |&#xA;+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&#xA;                   Example Internet Fragment&#xA;&#xA;                           Figure 8.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-02T22:05:07.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28368" PostTypeId="1" CreationDate="2016-03-02T18:45:57.857" Score="1" ViewCount="538" Body="&lt;p&gt;I want to only allow the device that is connected to the switch port with a specific MAC address and a static IP address to access the network. If the device MAC or IP address is changed, it will not be allowed to access the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use the MAC address table, but I also want to restrict the IP address. How can I accomplish this?&lt;/p&gt;&#xA;" OwnerUserId="23391" LastEditorUserId="8499" LastEditDate="2016-03-03T02:00:35.603" LastActivityDate="2016-06-02T23:42:31.760" Title="MAC address and IP address over Cisco and HP switches L2 and L3" Tags="|cisco|ip|mac-address|hp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28369" PostTypeId="1" AcceptedAnswerId="38477" CreationDate="2016-03-02T18:50:44.867" Score="0" ViewCount="640" Body="&lt;p&gt;We have three small business PoE switches, SG220-50P purchased from two places. They are each randomly rebooting at different times every few days, and sometimes only after a few hours. They have been doing this basically since we purchased them. I initially thought the devices were defective, but I haven't seen anything regarding this model, and I wouldn't expect to get 3 bad ones from two different sources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've enabled flash logging, and nothing abnormal is recorded, it's not even showing power down. They just come back up as if it were a normal boot. I updated the firmware two times now, and that hasn't helped. Resetting to factory seems to help for a while, but then the problem comes back. &#xA;The devices are on a UPS that isn't overloaded. They are each consuming about 35W on PoE, with a max of 375 available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would you recommend to troubleshoot this issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm new to networking admin, so sorry if my question is unrefined.&lt;/p&gt;&#xA;" OwnerUserId="23311" LastActivityDate="2017-01-30T06:39:20.410" Title="Three SG220-50P switches are rebooting randomly every few hours or days" Tags="|switch|troubleshooting|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="28370" PostTypeId="2" ParentId="28368" CreationDate="2016-03-02T19:05:55.797" Score="1" Body="&lt;p&gt;You can enable DHCP snooping, ARP inspection, etc. A host with a statically assigned IP address would need an exception to be manually entered in the switch for the port where the statically address host is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use 802.1X to verify that the host is allowed to connect to the network. This requires more infrastructure than just the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use VACLs to restrict traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-02T19:05:55.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28371" PostTypeId="2" ParentId="28352" CreationDate="2016-03-02T21:00:34.590" Score="2" Body="&lt;p&gt;You might want to give RFC 2488 a look. It addresses your question and offers recommendations to alleviate the effects on satellite links.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2488&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2488&lt;/a&gt;&#xA;Enhancing TCP Over Satellite Channels using Standard Mechanisms&lt;/p&gt;&#xA;" OwnerUserId="21892" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-02T21:00:34.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28372" PostTypeId="1" CreationDate="2016-03-02T21:22:20.637" Score="2" ViewCount="1490" Body="&lt;p&gt;Is there any way to create a virtual interface of sorts between two VDCs on a single Nexus 7000 switch?  I've read that a physical cable is required (which is lame) however I wasn't sure if this was a feature that was added in a newer NX-OS release.  I'm currently running NX-OS v6.2(14).&lt;/p&gt;&#xA;" OwnerUserId="19932" LastActivityDate="2016-12-09T16:12:16.747" Title="Communication between VDCs on Cisco Nexus 7000 via virtual interface" Tags="|cisco|cisco-nx-os|cisco-nexus|virtual|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28373" PostTypeId="1" AcceptedAnswerId="28387" CreationDate="2016-03-02T21:59:02.653" Score="6" ViewCount="7385" Body="&lt;p&gt;According to my understanding, the network switch will look out for the specific MAC address and then it will forward the frame so basically it doesn't broadcast the frames then why do we make VLANs? Is it to connect two distant machines or any other security related issue is handled via making VLANs?&lt;/p&gt;&#xA;" OwnerUserId="23142" LastEditorUserId="8499" LastEditDate="2018-10-27T02:52:55.710" LastActivityDate="2021-01-27T16:20:48.610" Title="Why do we use VLAN?" Tags="|switch|vlan|mac-address|lan|broadcast|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28374" PostTypeId="2" ParentId="28373" CreationDate="2016-03-02T22:12:27.467" Score="7" Body="&lt;p&gt;Besides the unknown unicast flooding that you allude to, broadcasts are necessary to the operation of ethernet. Some protocols require broadcasts. For instance, hosts use ARP requests (broadcasts) to resolve layer-3 to layer-2 addresses. Multicasts are are flooded to every port in the broadcast domain, albeit IGMP snooping, if supported and configured, can mitigate this behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs do control all of the above, but beyond that, VLANs will separate by layer-3 in order to allow you to place layer-3 controls like firewalls, ACLs, QoS, etc. between VLANs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-02T22:12:27.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28375" PostTypeId="2" ParentId="28372" CreationDate="2016-03-02T22:27:36.920" Score="3" Body="&lt;p&gt;There is no way to do what you want to do. VDCs virtualize control plane and data plane in protected memory so that each is an independent virtual device, just like independent physical devices. You can, of course, ask Cisco to consider adding this feature in a future NX-OS release.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/nx-os/virtual_device_context/configuration/guide/b-7k-Cisco-Nexus-7000-Series-NX-OS-Virtual-Device-Context-Configuration-Guide.pdf&quot; rel=&quot;nofollow&quot;&gt;Cisco Nexus 7000 Series NX-OS Virtual Device Context Configuration Guide&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Communication Between VDCs&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Cisco NX-OS software does not support direct communication between&#xA;  VDCs on a single physical device.&#xA;  You must make a physical connection from a port allocated to one VDC&#xA;  to a port allocated to the other VDC to allow the VDCs to communicate.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-02T22:27:36.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28377" PostTypeId="2" ParentId="28341" CreationDate="2016-03-02T23:49:50.403" Score="1" Body="&lt;p&gt;You can look at routes in multiple ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;show ip rib route&lt;/code&gt; command shows what's in the RIB like &lt;code&gt;show ip route&lt;/code&gt;, and I suppose it depends on the IOS version, but I see &lt;code&gt;show ip rib route&lt;/code&gt; output on single lines where &lt;code&gt;show ip route&lt;/code&gt; shows output on two lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;show ip cef&lt;/code&gt; command shows what's in the FIB, in a very compressed format, just &lt;code&gt;Prefix Next Hop Interface&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-02T23:49:50.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28378" PostTypeId="1" AcceptedAnswerId="28379" CreationDate="2016-03-03T00:26:53.350" Score="2" ViewCount="4434" Body="&lt;p&gt;I am trying to configure multi area OSPF on several routers (in packet tracer) to a switched core &lt;code&gt;area 0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly, I could either choose to configure OSPF using router interface IP address(es) and quad zero &lt;code&gt;0.0.0.0&lt;/code&gt; wildcard mask, or alternatively the subnet identifier IP address(es) (of connected networks) and the appropriate wildcard mask(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't seem to find much information on which is most appropriate for my particular topology, or if there are any real differences in these approaches.&lt;/p&gt;&#xA;" OwnerUserId="23395" LastEditorUserId="8499" LastEditDate="2018-03-19T17:42:58.400" LastActivityDate="2018-03-19T17:42:58.400" Title="Multi-area OSPF, Use Wildcard/Subnet IP address OR Quad zero and interface IP address?" Tags="|cisco|ospf|interface|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28379" PostTypeId="2" ParentId="28378" CreationDate="2016-03-03T00:44:16.943" Score="2" Body="&lt;p&gt;What you need to understand is that the network statement is to determine which interface(s) will participate in OSPF, not to advertise the prefix of the network statement. If you have multiple interfaces within an IP address range, for a specific area, you can include them with a single network statement using a wildcard mask that encompasses all the desired interfaces. By using the &lt;code&gt;0.0.0.0&lt;/code&gt; wildcard mask, you can include an individual interface for an area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One method for including all the interfaces in a single area is to use the all-encompassing network statement:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network 0.0.0.0 255.255.255.255 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If there are interfaces where you would like to advertise the network on the interfaces, but not send OSPF hellos on the interface, you can use the above network statement, and use the &lt;code&gt;passive-interface&lt;/code&gt; command for each interface for you don't want to send hellos, such as networks where there are no routers participating in OSPF (end-user networks). You can also use the &lt;code&gt;passive-interface default&lt;/code&gt; command to not send hellos out any interface by default, then use a &lt;code&gt;no passive-interface&lt;/code&gt; command to allow hellos on certain interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It just boils down to your particular requirements on a router. The network statements can be very flexible, but, if it is really convoluted where you need to set each interface individually, the design probably needs to be rethought. In many cases, using the single interface command can work well, especially when used with passive interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-03T01:08:37.007" LastActivityDate="2016-03-03T01:08:37.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28380" PostTypeId="1" AcceptedAnswerId="28381" CreationDate="2016-03-03T04:34:00.087" Score="1" ViewCount="91" Body="&lt;p&gt;I am in a class which conforms to the material in the Cisco Companion Guides, and I am currently using the &lt;a href=&quot;http://www.ciscopress.com/store/scaling-networks-companion-guide-9781587133282&quot; rel=&quot;nofollow&quot;&gt;Scaling Networks&lt;/a&gt; textbook.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In it, the book explains how to adjust the percentage of interface bandwidth the EIGRP process is allowed to use, and that the default is 50%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only reason my teacher can give as to why this limit would be reached is when EIGRP is implemented on incredibly slow links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a scenario one would ever expect to see?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any other real-world scenarios in which this limit could be reached?&lt;/p&gt;&#xA;" OwnerUserId="10804" LastEditorUserId="8499" LastEditDate="2019-01-05T01:24:12.953" LastActivityDate="2019-01-05T01:24:12.953" Title="In what situations would the EIGRP process use the default 50% of the configured interface bandwidth?" Tags="|cisco|routing|bandwidth|eigrp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28381" PostTypeId="2" ParentId="28380" CreationDate="2016-03-03T04:53:37.700" Score="1" Body="&lt;p&gt;By default, EIGRP will not use more than 50% the bandwidth configured on the interface. It could use more than 50% of the actual interface bandwidth if the bandwidth command is greater than actual the interface bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP could use up to the default 50% configured interface bandwidth if the interface is relatively slow slow, or the configured interface bandwidth is lower than the actual interface bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the interface speed, if the configured interface bandwidth accurately reflects the actual interface bandwidth, the EIGRP bandwidth could reach the default 50% if there are a lot of network changes which require many updates, such as flapping links, but it would need to be an extreme circumstance in modern networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was important in the past with slow WAN links, but the reality is that EIGRP uses a relatively small amount of the bandwidth available on modern network interfaces. It's probably something you won't need to deal with outside lab scenarios or exams.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-03T05:26:37.013" LastActivityDate="2016-03-03T05:26:37.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28384" PostTypeId="1" CreationDate="2016-03-03T10:20:55.417" Score="1" ViewCount="772" Body="&lt;p&gt;I have found many articles, possible solutions to this topic, but no one seems to have the same problem as me. I am working on a Cisco 1812 Router with IOS 12.4. I have found some things like hairpinning and DNS doctoring but those methods doesn't sound the right one, because every solution targets on the problem that you can't access it over its domainname. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have 2 extern ip addresses x.x.x.100 and x.x.x.101 which get nated to the inside addresses i.i.i.100 and i.i.i.101. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so x.x.x.100 -&gt; i.i.i.100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and x.x.x.101 -&gt; i.i.i.101&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source route-map SDM_RMAP_1 interface FastEthernet0 overload&#xA;    ip nat inside source static i.i.i.100 x.x.x.100 route-map SDM_NAT_TEST&#xA;    ip nat inside source static i.i.i.101 x.x.x.101 route-map DM_RMAP_1&#xA;&#xA;interface FastEthernet0&#xA; description Interface Outside&#xA; ip address &amp;lt;external IP&amp;gt; 255.255.255.240&#xA; ip access-group Internet in&#xA; ip nat outside&#xA; ip inspect firewall out&#xA; ip virtual-reassembly&#xA; ip tcp adjust-mss 1452&#xA; duplex auto&#xA; speed auto&#xA; crypto map vpn&#xA; service-policy output CLEAR-TOS&#xA;!         &#xA;interface FastEthernet1&#xA; description Interface Inside&#xA; ip address 172.16.18.1 255.255.255.0&#xA; ip flow ingress&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA; no keepalive&#xA;! &#xA;interface FastEthernet2&#xA;    description DMZ&#xA;     ip address i.i.i.i 255.255.255.0&#xA;     ip access-group DMZ_IN in&#xA;     no ip unreachables&#xA;     ip flow ingress&#xA;     ip nat inside&#xA;     ip inspect firewall out&#xA;     ip virtual-reassembly&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In Interface FE2 are the Webserver which get natted. FE0 is my outgoing Interface to my Provider. And FE1 is my Internal Network where every client connects to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no problem to reach to Webserver in the DMZ from the Inside Interface with his i.i.i.100 - IP. But i can't access him with his external IP x.x.x.100. You can reach him when you are on the Outside of my network (like you try to connect with your phone). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Funny thing is, i can ping his External IP but if i want to navigate in Firefox to this IP the connection will get refused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There isn't a problem with the DNS, because I want to reach him with his IP. If i navigate to his internal IP, no Problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to fix this, because if you connect to an VPN you can't access it anymore, because the DNS from the VPN will connect you to the external IP. This was the first time a recognized this behavoir.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BIG EDIT: &lt;strong&gt;I didn't configure this router&lt;/strong&gt;, it was someone else which isn't reachable anymore. So I have to figure everything out which is done on this one.&lt;/p&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="22401" LastEditDate="2016-03-09T15:58:03.920" LastActivityDate="2016-03-09T15:58:03.920" Title="Access Extern IP behind NAT" Tags="|cisco|nat|ip|" AnswerCount="0" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28387" PostTypeId="2" ParentId="28373" CreationDate="2016-03-03T13:54:11.880" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;According to my understanding, the network switch will look out for the specific MAC address and then it will forward the frame so basically it doesn't broadcast the frames then why do we make VLANs?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While VLAN is a tool often used to reduce the size of the broadcast domain, its major underlying goal was &lt;strong&gt;to partition a physical LAN device (switch, bridge) into multiple logical portions (VLANs)&lt;/strong&gt;. Think of a single physical device offering Ethernet LAN services for multiple departments within an organization. Every department would get a piece of that single physical device -- that is, some ports restricted into a VLAN. Thus one would not need to buy dedicated LAN hardware for every department.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-03-03T13:54:11.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28390" PostTypeId="1" CreationDate="2016-03-03T15:52:09.957" Score="2" ViewCount="676" Body="&lt;pre&gt;&lt;code&gt;object network obj-10.15.X.Y&#xA; host 10.15.X.X&#xA; nat (inside,outside) static 1.1.1.1&#xA;&#xA;sh xlate | in 1.1.1.1                 &#xA;NAT from inside:10.15.X.Y to outside:1.1.1.1&#xA;&#xA;access-list External_Access extended permit ip object-group WhiteList host 10.15.X.Y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;applied on the outside interface  - in bound.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to access the public IP address (1.1.1.1) from one of the IP addresses in the object-group Whitelist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the above ACL the correct one since I already have the NAT in place?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or should I use something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list External_Access extended permit ip object-group WhiteList host 1.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="450" LastEditorUserId="8499" LastEditDate="2016-03-03T15:58:18.170" LastActivityDate="2016-03-03T17:08:01.263" Title="ASA NAT &amp; ACL question" Tags="|cisco-asa|nat|acl|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28391" PostTypeId="2" ParentId="28390" CreationDate="2016-03-03T16:39:52.080" Score="0" Body="&lt;p&gt;Looks like an old ASA 8.something. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your inside interface should be set to security-level 100 and outside to 0. You shouldnt need an ACL to route to the outside and NAT the traffic. &lt;/p&gt;&#xA;" OwnerUserId="4493" LastActivityDate="2016-03-03T16:39:52.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28392" PostTypeId="2" ParentId="28390" CreationDate="2016-03-03T17:07:01.033" Score="0" Body="&lt;p&gt;it will be as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list External_Access extended permit ip object-group WhiteList object obj-10.15.X.Y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;because your IP address is 10.15.X.X and you are including 10.15.X.Y in the ACL, or you can do as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list External_Access extended permit ip object-group WhiteList host 10.15.X.X&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23409" LastEditorUserId="8499" LastEditDate="2016-03-03T17:08:01.263" LastActivityDate="2016-03-03T17:08:01.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28393" PostTypeId="2" ParentId="28225" CreationDate="2016-03-03T17:07:22.653" Score="0" Body="&lt;p&gt;This is an older question but I'm curious as to how you're able to send multiple VLAN packets over an access port to another switch. Your statement... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;&lt;em&gt;I separate the incoming VLANs through access ports to yet another switch. At this switch...&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To send multiple VLANs to another switch, both ports on the switches should be configured as trunk ports, and the port going to the router should also be configured as a trunk. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only frames that belong to the native VLAN will be untagged and can be seen to native assigned ports.&lt;/p&gt;&#xA;" OwnerUserId="23406" LastActivityDate="2016-03-03T17:07:22.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28394" PostTypeId="2" ParentId="28390" CreationDate="2016-03-03T17:07:51.863" Score="4" Body="&lt;p&gt;Since ASA 8.3 code, the interface ACLs expect the &lt;strong&gt;real-ip&lt;/strong&gt; in each statement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, your real-ip is &lt;code&gt;10.15.x.x&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, your ACL entry will have to look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list External_Access extended permit ip object-group WhiteList host 10.15.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alternatively, and I think more easily, you can just use the object reference directly in the ACL statement:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list External_Access extended permit ip object-group WhiteList object obj-10.15.X.Y&#xA;                                                                      ^^^^^^^^^^^^^^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another way of looking at it is in 8.3+ code, the NAT happens &lt;em&gt;before&lt;/em&gt; the ACL. In 8.2- code, the NAT happens &lt;em&gt;after&lt;/em&gt; the ACL.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-03-03T17:07:51.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28395" PostTypeId="1" AcceptedAnswerId="28419" CreationDate="2016-03-03T18:05:23.700" Score="6" ViewCount="2122" Body="&lt;p&gt;Each interface on a Cisco ASA has a security level. By default the ASA ACL allows traffic from higher to lower security level, but not the other way around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: Which security level does a site-to-site remote VPN network have? Is it the same security level as the interface that the connection profile is associated with?&lt;/p&gt;&#xA;" OwnerUserId="23411" LastEditorUserId="23411" LastEditDate="2016-03-04T09:46:34.277" LastActivityDate="2016-03-04T17:11:14.290" Title="Which security level does a remote site-to-site VPN network have?" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28400" PostTypeId="2" ParentId="28332" CreationDate="2016-03-04T04:17:42.573" Score="2" Body="&lt;p&gt;The two routes you are summarising have different destination addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route 10.10.201.0/25 next-hop 172.18.10.6;&#xA;route 10.10.201.128/25 next-hop 172.18.10.10;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;after your change, the entire /24 is pointing to 172.18.10.6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The security policy is not blocking the traffic - the fact that you see an entry in the flow table shows that it is being permitted.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are seeing in the session table is that the return traffic is not coming back for whatever reason.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without knowing your topology it's a bit hard to know why, but I would suggest that 10.212.200.1 has a route back to 10.10.201.3 via the router with 172.16.10.10 as an interface.  After you make your change, it is possible you create asymmetric routing (the return traffic comes back on a different interface) and the SRX just drops it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually looking at your routing output, I think the problem is that you are leaking routes between routing-instances (most likely via a policy that specifically matches on the /25), and when you put the /24 in, it removes that entry from all your routing-instances.  This may explain the other issues you have when you apply this route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you please attach the output of &lt;code&gt;show configuration routing-options&lt;/code&gt; and &lt;code&gt;show configuration policy-options&lt;/code&gt;?  This should confirm the presence of route-leaking.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-03-04T04:17:42.573" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28401" PostTypeId="2" ParentId="17037" CreationDate="2016-03-04T08:04:59.500" Score="2" Body="&lt;p&gt;It's mostly the same way you have configured your first ZF7363.&#xA;Since you are using ZD to manage ZF, you need to follow these steps.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Configure your ZD with your required parameter(WLAN GROUP, IP Address and so on).&lt;/li&gt;&#xA;&lt;li&gt;Connect your ZD into the network.&lt;/li&gt;&#xA;&lt;li&gt;(optional)Enable DHCP server in ZD(Either if there is no other DHCP server available, or if you configure each ZF with static ip address)&lt;/li&gt;&#xA;&lt;li&gt;Connect ZF into the network.&lt;/li&gt;&#xA;&lt;li&gt;Approve your ZF in ZD dashboard(it might not be required depending on ZD configuration). &lt;/li&gt;&#xA;&lt;li&gt;Assign WLAN group to ZF.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You just need to repeat step 4-6 for each ZF.&lt;/p&gt;&#xA;" OwnerUserId="23310" LastEditorUserId="23310" LastEditDate="2016-03-04T22:32:45.840" LastActivityDate="2016-03-04T22:32:45.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28403" PostTypeId="1" CreationDate="2016-03-04T08:39:47.443" Score="1" ViewCount="3146" Body="&lt;p&gt;I have Cisco 2500 series wireless LAN controller. I have to configure the WLC in such a way that it receives an IP address on my local LAN, and while the clients connect to the WAPs, they get the IP range of another network. In a way, I want the controller to route the traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current LAN address is &lt;code&gt;192.168.1.0/24&lt;/code&gt;, and the WLC IP address is &lt;code&gt;192.168.1.150&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the controller to assign IP addresses from &lt;code&gt;10.10.10.0/24&lt;/code&gt; to the wireless clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried it but could not work. I read it somewhere that controller just bridges but doesn't route. Is that true? If so, what are my options? If I let the wireless clients to get addresses from the LAN IP address, I will run short of IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am new here. If my way of asking is incorrect then forgive me. Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="8499" LastEditDate="2016-03-04T09:02:57.073" LastActivityDate="2016-03-04T09:22:51.780" Title="Regarding the DHCP issue with wireless LAN controller" Tags="|cisco|wireless|dhcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28404" PostTypeId="2" ParentId="28403" CreationDate="2016-03-04T08:45:26.090" Score="0" Body="&lt;p&gt;The controller just bridges the the Wi-Fi traffic. You need to connect it to a switch which has a VLAN for the user traffic. This VLAN can have its own IP network range, be routed, and have DHCP specific to that VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, I have seen multiple ports on the WLC channeled to a switch. A single port is probably insufficient for all the Wi-Fi clients. More recent Cisco WLCs have 10 Gb ports to help with that problem.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-04T08:52:35.133" LastActivityDate="2016-03-04T08:52:35.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28406" PostTypeId="2" ParentId="28403" CreationDate="2016-03-04T09:22:51.780" Score="2" Body="&lt;p&gt;A possible setup is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 - Have the ports on the WLC configured as a LAG / EtherChannel, in order to provide increase bandwidth and fault tolerance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is done in the &quot;Controller / General&quot; page, there's a drop down menu for &quot;LAG mode on next reboot&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course you must have your switch configured accordingly with a LAG / EtherChannel for the ports your WLC is connected on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - On the switch configure the LAG/EtherChannel as a Trunk interface, with the native VLAN being the WLC management VLAN (i.e. in your case the VLAN in which you have the 192.168.1.0 network), and allow whichever VLAN you want the Wifi clients to use. (let's say VLAN 10 for example)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 - On the WLC configure an interface for the Wifi clients in the chosen VLAN (10), in the &quot;Controller / Interface&quot; Menu&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4 - on your router configure the WifiClient VLAN (10) gateway. You may set on the router an IP Helper / DHCP relay to direct DHCP request to your DHCP server if you choose to not set one directly in the VLAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5 - set the DHCP server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6 - create an WLAN and associate it with the interface created in step 3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that during the LAG and management network configuration you should be connected with the serial console since it's quite easy to loose communication with the controller while you configure this.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-04T09:22:51.780" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28408" PostTypeId="1" AcceptedAnswerId="28410" CreationDate="2016-03-04T09:43:19.937" Score="5" ViewCount="10318" Body="&lt;p&gt;What are the most significant differences between how a Linux bridge and an Open vSwitch work?&lt;/p&gt;&#xA;" OwnerUserId="22810" LastEditorUserId="35913" LastEditDate="2018-10-19T23:44:27.300" LastActivityDate="2019-05-22T15:12:37.857" Title="Difference between Linux Bridge and Open vSwitch" Tags="|switch|linux|bridge|sdn|virtual|" AnswerCount="1" CommentCount="0" ClosedDate="2021-01-05T02:42:18.797" ContentLicense="CC BY-SA 3.0" />
  <row Id="28409" PostTypeId="1" AcceptedAnswerId="28411" CreationDate="2016-03-04T09:46:55.903" Score="2" ViewCount="902" Body="&lt;p&gt;Each interface on a Cisco ASA has a security level. By default the ASA ACL allows traffic from higher to lower security level, but not the other way around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: When I add an additional ACL rule, does the implicit rule still apply if my inserted rule doesn't match?&lt;/p&gt;&#xA;" OwnerUserId="23411" LastActivityDate="2016-03-04T11:29:16.273" Title="Does inserting the first ACL rule remove the implicit &quot;to less secure&quot; ACL rule?" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28410" PostTypeId="2" ParentId="28408" CreationDate="2016-03-04T10:07:34.483" Score="11" Body="&lt;p&gt;Open vSwitch has a section on that in their &lt;a href=&quot;http://docs.openvswitch.org/en/latest/faq/general/&quot; rel=&quot;noreferrer&quot;&gt;FAQ&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q: Why would I use Open vSwitch instead of the Linux bridge?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A: Open vSwitch is specially designed to make it easier to manage VM network configuration and monitor state spread across many physical hosts in dynamic virtualized environments. Refer to &lt;a href=&quot;http://docs.openvswitch.org/en/latest/intro/why-ovs/&quot; rel=&quot;noreferrer&quot;&gt;Why Open vSwitch?&lt;/a&gt; for a more detailed description of how Open vSwitch relates to the Linux Bridge.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The entire list of features/differences (&lt;a href=&quot;http://docs.openvswitch.org/en/latest/intro/why-ovs/&quot; rel=&quot;noreferrer&quot;&gt;Why Open vSwitch?&lt;/a&gt;) is quite long, you should check it out if you want to know all the details. The short version is that Open vSwitch is targeted at large multi-server virtualisation environments, so it is focused on logical abstraction and management; the Linux bridge is fast and reliable, but lacks all fancy control features.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastEditorUserId="43292" LastEditDate="2019-05-22T15:12:37.857" LastActivityDate="2019-05-22T15:12:37.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="28411" PostTypeId="2" ParentId="28409" CreationDate="2016-03-04T11:29:16.273" Score="2" Body="&lt;p&gt;No, specific rule takes the implicit ANY-&gt;ANY LESS SECURE rule down. If your rule is not matched, the packet will proceed to the implicit DENY.&lt;/p&gt;&#xA;" OwnerUserId="21627" LastActivityDate="2016-03-04T11:29:16.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28413" PostTypeId="1" AcceptedAnswerId="28414" CreationDate="2016-03-04T12:16:16.663" Score="14" ViewCount="1381" Body="&lt;p&gt;I hear/read much about IPv4 and IPv6 and nothing about IPv5. Where did it get lost in the discussion?&lt;/p&gt;&#xA;" OwnerUserId="23435" LastActivityDate="2016-03-25T23:14:24.943" Title="What happened to IPv5?" Tags="|ipv4|ipv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28414" PostTypeId="2" ParentId="28413" CreationDate="2016-03-04T12:34:54.663" Score="19" Body="&lt;p&gt;The first four bits in the IP header are used to store the Protocol version (4 or 6).&#xA;The version 5 was assigned to another protocol, the &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Stream_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;Internet Steam Protocol&lt;/a&gt; and so was not available for the successor of IPv4.&lt;/p&gt;&#xA;&lt;p&gt;Internet Steam Protocol is defined by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1819&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1819&lt;/a&gt; in which you will find in section 1.2:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Both ST2 and IP apply the same addressing schemes to identify&#xA;different hosts.&#xA;ST2 and IP packets differ in the first four bits,&#xA;which contain the internetwork protocol version number: &lt;strong&gt;number 5 is&#xA;reserved for ST2&lt;/strong&gt; (IP itself has version number 4). As a network layer&#xA;protocol, like IP, ST2 operates independently of its underlying&#xA;subnets. Existing implementations use ARP for address resolution, and&#xA;use the same Layer 2 SAPs as IP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Quoted from &lt;a href=&quot;http://archive.oreilly.com/pub/post/what_ever_happened_to_ipv5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;O'Reilly archive&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;But, what ever happened to IPv5?&lt;/p&gt;&#xA;&lt;p&gt;IPng, Internet Protocol next generation, was conceived in 1994 with a goal for implementations to start flooding out by 1996 (yeah,&#xA;like that ever happened). IPv6 was supposed to be the &amp;quot;god-send&amp;quot; over&#xA;the well-used IPv4: it increased the number of bytes used in&#xA;addressing from 4 bytes to 16 bytes, it introduced anycast routing, it&#xA;removed the checksum from the IP layer, and lots of other&#xA;improvements. One of the fields kept, of course, was the version field&#xA;-- these 8 bits identify this IP header as being of version &amp;quot;4&amp;quot; when there is a 4 in there, and presumably they would use a &amp;quot;5&amp;quot; to identify&#xA;this next gen version. Unfortunately, that &amp;quot;5&amp;quot; was already given to&#xA;something else.&lt;/p&gt;&#xA;&lt;p&gt;In the late 1970's, a protocol named ST -- The Internet Stream Protocol -- was created for the experimental transmission of voice,&#xA;video, and distributed simulation. Two decades later, this protocol&#xA;was revised to become ST2 and started to get implemented into&#xA;commercial projects by groups like IBM, NeXT, Apple, and Sun. Wow did&#xA;it differ a lot. ST and ST+ offered connections, instead of its&#xA;connection-less IPv4 counterpart. It also guaranteed QoS. ST and ST+,&#xA;were already given that magical &amp;quot;5&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;And now as the Internet clock ticks, our PCs don't use IPv5. So we're moving onto 6.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-25T23:14:24.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28417" PostTypeId="2" ParentId="28395" CreationDate="2016-03-04T15:22:00.667" Score="3" Body="&lt;p&gt;VPNs bypass the security level function/component of the ASA, so the security-level rules don't apply to it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-04T15:22:00.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28419" PostTypeId="2" ParentId="28395" CreationDate="2016-03-04T16:23:03.570" Score="5" Body="&lt;p&gt;See this: &lt;a href=&quot;https://serverfault.com/questions/368947/what-is-the-asa-packet-process-order-when-there-is-both-a-vpn-and-route-in-place&quot;&gt;What is the ASA packet process order when there is both a VPN and route in place?&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Documented information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Non-encrypted packets go through the packet process partially quoted at the bottom of this answer. They must be part of an existing connection or have an &lt;strong&gt;interface ACL&lt;/strong&gt; allowing them in or they are dropped (they can be dropped for other reasons also).&lt;/li&gt;&#xA;&lt;li&gt;Encrypted packets bypass &lt;strong&gt;interface ACLs&lt;/strong&gt; and but are still subject to ACLs associated with their tunnel. The tunnel for an encrypted packet (and thereby which ACLs are relevant) is determined by the cryptomap that the packet matches.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Conclusion based on the answer linked above:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;An encrypted packet goes through the packet process twice, bypassing the interface ACLs the first time and then matching the tunnel ACLs the second time and therefore not being dropped. On the second pass it passes the NAT steps in the process via the &quot;nat 0&quot; command that is part of the VPN config.&lt;/li&gt;&#xA;&lt;li&gt;As far as I can tell, the only thing that security levels actually do in an ASA is cause a default &quot;allow any to any&quot; ACL to be created for traffic going from a high security to low security interface. &lt;strong&gt;Packets are not checked against security levels during packet processing&lt;/strong&gt;, they are checked against ACLs. It seems that the security levels are just a construct to help administrators understand how the ASA works out of the box.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;See below, all emphasis is mine:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For an inbound, &lt;strong&gt;encrypted packet&lt;/strong&gt;, the security appliance uses the source address and ESP SPI to determine the decryption parameters. After the security appliance decrypts the packet, it compares the inner header of the decrypted packet to the permit ACEs in the &lt;strong&gt;ACL associated with the packet SA&lt;/strong&gt;. If the inner header fails to match the proxy, the security appliance drops the packet. It the inner header matches the proxy, the security appliance routes the packet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;By default, the ASA lets IPsec packets bypass &lt;strong&gt;interface ACLs&lt;/strong&gt;. [...] IPsec authenticates and deciphers packets that arrive from an IPsec tunnel, and subjects them to evaluation against the &lt;strong&gt;ACL associated with the tunnel&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/vpn/asa_91_vpn_config/vpn_ike.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;The packet is reached [sic] at the ingress interface.&lt;/li&gt;&#xA;  &lt;li&gt;Once the packet reaches the internal buffer of the interface, the&#xA;  input counter of the interface is incremented by one.&lt;/li&gt;&#xA;  &lt;li&gt;Cisco ASA first looks at its internal connection table details in&#xA;  order to verify if this is a current connection. If the packet flow&#xA;  matches a current connection, then the Access Control List (ACL)&#xA;  check is bypassed and the packet is moved forward.&lt;/li&gt;&#xA;  &lt;li&gt;If packet flow does not match a current connection, then the TCP&#xA;  state is verified. If it is a SYN packet or UDP (User Datagram&#xA;  Protocol) packet, then the connection counter is incremented by one&#xA;  and the packet is sent for an ACL check. If it is not a SYN packet,&#xA;  the packet is dropped and the event is logged.&lt;/li&gt;&#xA;  &lt;li&gt;The packet is processed as per the interface ACLs...&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113396-asa-packet-flow-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4889" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2016-03-04T17:11:14.290" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28424" PostTypeId="2" ParentId="28368" CreationDate="2016-03-04T22:49:01.597" Score="0" Body="&lt;p&gt;the best way to do it would be port security with sticky option. that way you can learn and remember the first mac address on the port and the port will go down if it detects any other mac address.&lt;/p&gt;&#xA;" OwnerUserId="23409" LastActivityDate="2016-03-04T22:49:01.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28426" PostTypeId="1" AcceptedAnswerId="28523" CreationDate="2016-03-05T03:03:29.747" Score="2" ViewCount="811" Body="&lt;p&gt;Background: long time Netscreen, JunOS, FortiOS administrator, now with a customer who has an ASA running 8.3(2). They have decided to install a new SSL certificate into their ASA for the purposes of the SSL-VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went to Enom, a Commodo reseller, and followed their instructions for generating a .CSR. Received the certificate back, and tried to install it. Install attempts fail with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Error: Failed to parse or verify imported certificate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also received three intermediate certificates. When I go to the CA screen of my ASA, I can import the certificate identified as AddTrustExternalCARoot, but not the other two. Trying to import them fails with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Info: INFO: Certificate has the following attributes:&#xA;Fingerprint: &amp;lt;hash&amp;gt;&#xA;% Error in saving certificate: status = FAIL&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have followed some instructions on the web which involve importing my certificate into my local Windows (10) system, exporting them back out, and then trying to import those into the ASA.  Same problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ENOM has punted my request for support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The customer doesn't have Cisco support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any ideas where I can learn how to import my Commodo certificate?&lt;/p&gt;&#xA;" OwnerUserId="15019" LastEditorUserId="8499" LastEditDate="2018-02-16T04:22:04.817" LastActivityDate="2018-02-16T04:22:04.817" Title="How Do I Install My Commodo SSL Cert Into A ASA 8.3(2)?" Tags="|cisco-asa|sslvpn|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28427" PostTypeId="1" AcceptedAnswerId="28429" CreationDate="2016-03-05T09:28:10.063" Score="2" ViewCount="1124" Body="&lt;p&gt;In 2016, is IP multicast still a thing not to rely on with IPv4?&lt;/p&gt;&#xA;&lt;p&gt;Is the only alternative still to duplicate packets?&lt;/p&gt;&#xA;&lt;h3&gt;Context:&lt;/h3&gt;&#xA;&lt;p&gt;This question is related to P2Peers (plural) topology, with one sender and many receivers over the Internet (broadcast like).&lt;/p&gt;&#xA;&lt;p&gt;Lot of the multicast information is dated now (wikipedia -&amp;gt; 2010, others 2006), but many say that it is problematic and reserved to research.&lt;/p&gt;&#xA;&lt;p&gt;The goal is to avoid sending the same data multiple times to different IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="23457" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-03-06T04:18:17.243" Title="Multicast on the Internet" Tags="|ipv4|internet|multicast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28429" PostTypeId="2" ParentId="28427" CreationDate="2016-03-05T09:50:44.820" Score="3" Body="&lt;p&gt;Multicast is often used within an ISP network to distribute tv and radio channels. But it's limited to the ISP. Usually there are no multicast interconnects between ISPs so global multicast is still not really usable.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-03-05T09:50:44.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28431" PostTypeId="1" CreationDate="2016-03-05T14:33:14.930" Score="1" ViewCount="226" Body="&lt;p&gt;if i add a device of int fa0/0 will the interface assume the devices mac address? &#xA;i noticed that this interface has a BIA what is it used for?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/0 is administratively down, line protocol is down&#xA;  Hardware is Gt96k FE, address is c201.1360.0000 (bia c201.1360.0000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23463" LastEditorUserId="509" LastEditDate="2016-03-05T17:13:28.043" LastActivityDate="2016-03-05T18:47:02.823" Title="sh int fa0/0 mac address question" Tags="|cisco|mac-address|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28432" PostTypeId="1" AcceptedAnswerId="28433" CreationDate="2016-03-05T14:34:43.457" Score="1" ViewCount="137" Body="&lt;p&gt;Given IPv6 address &lt;code&gt;2001:0000:0000:0000:1111:0000:0000:0000&lt;/code&gt;, should it be abbreviated as: &lt;code&gt;2001::1111:0:0:0&lt;/code&gt; or &lt;code&gt;2001:0:0:0:1111::&lt;/code&gt;? It seems I didn't see any specification talking about it.&lt;/p&gt;&#xA;" OwnerUserId="17014" LastActivityDate="2016-03-05T15:13:26.280" Title="IPv6 address abbreviateion" Tags="|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28433" PostTypeId="2" ParentId="28432" CreationDate="2016-03-05T15:13:26.280" Score="5" Body="&lt;p&gt;From &lt;a href=&quot;https://www.ietf.org/rfc/rfc5952.txt&quot; rel=&quot;noreferrer&quot;&gt;RFC5952&lt;/a&gt; - IPv6 Text Representation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4.2.3.  Choice in Placement of &quot;::&quot;&#xA;&#xA;   When there is an alternative choice in the placement of a &quot;::&quot;, the&#xA;   longest run of consecutive 16-bit 0 fields MUST be shortened (i.e.,&#xA;   the sequence with three consecutive zero fields is shortened in 2001:&#xA;   0:0:1:0:0:0:1).  When the length of the consecutive 16-bit 0 fields&#xA;   are equal (i.e., 2001:db8:0:0:1:0:0:1), the first sequence of zero&#xA;   bits MUST be shortened.  For example, 2001:db8::1:0:0:1 is correct&#xA;   representation.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In short: &lt;code&gt;2001::1111:0:0:0&lt;/code&gt; is correct.&lt;/p&gt;&#xA;" OwnerUserId="14263" LastActivityDate="2016-03-05T15:13:26.280" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28435" PostTypeId="2" ParentId="28427" CreationDate="2016-03-05T17:14:37.450" Score="0" Body="&lt;p&gt;The real problem is that the Internet is made up of many different ISPs which are connected together. Each ISP is independent and negotiates any connections with other ISPs. Multicast comes in two basic flavors: DM (Dense Mode) and SM (Sparse Mode).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In DM (and at the start of, and periodically during, SM), multicast is flooded across every router and router port. This just isn't practical to do on the Internet, and ISPs which have nothing to do with the source or ultimate destinations of the multicast traffic would be forced to carry it, using their precious bandwidth for no reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SM initially, and periodically, floods the way DM does, but it will eventually back off of sending multicast traffic everywhere. That requires an RP (Rendezvous Point) for each multicast group. Someone would need to purchase and maintain these RPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, there are a limited number of multicast groups. The groups would need to be registered and assigned to companies the way IP addresses are. In a global multicast, only one assignee in the world could use a multicast group at any given time.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-05T17:30:13.127" LastActivityDate="2016-03-05T17:30:13.127" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28437" PostTypeId="2" ParentId="28431" CreationDate="2016-03-05T18:47:02.823" Score="2" Body="&lt;p&gt;A device connected to a switch uses its own interface's MAC address for L2 communication.  The burned in address (BIA) on the switch interface is used in L2 communication originated by or addressed to the switch itself.&lt;/p&gt;&#xA;" OwnerUserId="23266" LastActivityDate="2016-03-05T18:47:02.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28438" PostTypeId="1" CreationDate="2016-03-05T19:01:51.990" Score="2" ViewCount="3864" Body="&lt;p&gt;I should probably start by explaining the topography. We have two different Internet connections with separate firewalls. One is an ASA, and one is a Meraki. The default gateway for all the servers behind the firewalls is the ASA (10.100.200.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I am having is that we have a site-to-site connection on the Meraki (10.100.200.2), and the traffic destined for the subnet (192.168.100.0) on the other side of the site-to-site connection can't find its way because it is trying to go through the ASA's default gateway (10.100.200.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I set a static route on the server that is trying to send traffic to the subnet (192.168.100.0) to use the Meraki's default gateway (10.100.200.2), it works. How do I set a static route on the ASA so that any traffic that comes through the ASA uses the Meraki's default gateway to get out?&lt;/p&gt;&#xA;" OwnerUserId="23467" LastEditorUserId="8499" LastEditDate="2016-03-05T19:19:10.073" LastActivityDate="2017-05-30T21:10:32.323" Title="Route traffic from ASA to other firewall default gateway" Tags="|routing|cisco-asa|vpn|subnet|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28439" PostTypeId="2" ParentId="28438" CreationDate="2016-03-05T19:15:09.010" Score="0" Body="&lt;p&gt;Did you try to set a static route on the ASA so that it sends any traffic destined for 192.168.100.0/24 to 10.100.200.2? Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname(config)# route &amp;lt;if_name&amp;gt; &amp;lt;dest_ip&amp;gt; &amp;lt;mask&amp;gt; &amp;lt;gateway_ip&amp;gt; [distance]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco has many &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/route_static.html#wp1121521&quot; rel=&quot;nofollow&quot;&gt;documents&lt;/a&gt; explaining these things, just do a search..&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-05T19:15:09.010" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28441" PostTypeId="1" AcceptedAnswerId="28442" CreationDate="2016-03-05T20:13:06.313" Score="2" ViewCount="1938" Body="&lt;p&gt;I was making an IPv6 exercise in which I had to configure two Router Interface: &lt;code&gt;G0/0&lt;/code&gt; and &lt;code&gt;G0/1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;G0/0&lt;/code&gt; uses &lt;code&gt;2001:DB8:FADE:00FF::/64&lt;/code&gt; and I have to use to next subnet for &lt;code&gt;G0/1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the answer, but What I don't get to understand is, how to move the bits:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;G0/0 2001:DB8:FADE:00FF::1/64 &#xA;G0/1 2001:DB8:FADE:0100::1/64&#xA;&#xA;00FF - 0000 0000 1111 1111&#xA;0100 - 0000 0001 0000 0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's say:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000F - 0000 0000 0000 1111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is going on after? The last bits back to zero, while I increment +1 on third part? Like &lt;code&gt;0000 0000 0001 0000 = 0010 (Hex)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know how develop this binaries until the Hex value gets &lt;code&gt;FFFF&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00FF - 0000 0000 1111 1111     &#xA;       0000 0001 0000 0000&#xA;       0000 0001 0000 0001&#xA;       0000 0001 0000 0010&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Trying to simplify, the fourth part reaches &lt;code&gt;1111&lt;/code&gt; while previous parts keep the values, after&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  0000 0001 0001 1111&#xA;  0000 0001 0010 1111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, the third part starts to build until &lt;code&gt;1111&lt;/code&gt;, the next is second part and etc.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct? I'm not getting to develop that values :\&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="8499" LastEditDate="2018-03-12T00:24:08.440" LastActivityDate="2018-03-12T00:24:08.440" Title="IPv6 Subnetting" Tags="|ip|subnet|ipv6|ip-address|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28442" PostTypeId="2" ParentId="28441" CreationDate="2016-03-05T20:56:26.207" Score="3" Body="&lt;p&gt;IPv6 is easy when it comes to this since you aren't really doing subnetting the way IPv4 does. Under normal circumstances, with very few exceptions, you have one subnet size (&lt;code&gt;/64&lt;/code&gt;). All you need to do is be able to count in hexadecimal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An IPv6 address is just a single 128-bit number. There are two parts: the Network ID, and the Interface ID. Each is 64-bits. You only need to concentrate in the Network ID for what you want to do. The text representation of IPv6 is broken into words separated by colons for ease of reading. Some would call this oxymoronic when it comes to big, ugly IPv6 addresses, but try to read one without the colons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Decimal, you count &lt;code&gt;0&lt;/code&gt; to &lt;code&gt;9&lt;/code&gt;. When you get to &lt;code&gt;9&lt;/code&gt;, the next step is to increment the next higher digit and start over at &lt;code&gt;0&lt;/code&gt; (&lt;code&gt;9&lt;/code&gt; goes to &lt;code&gt;10&lt;/code&gt;). The same applies to Hexadecimal, except that you count &lt;code&gt;0&lt;/code&gt; to &lt;code&gt;f&lt;/code&gt; (&lt;code&gt;f&lt;/code&gt; goes to &lt;code&gt;10&lt;/code&gt;). If you want to throw Binary into the mix, each four Binary digits equal one Hexadecimal digit. Hexadecimal &amp;lt;-&gt; Binary is much, much easier than throwing Decimal into the mix the way IPv4 does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you are confusing yourself by thinking about blocks. In your example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000F = 0000 0000 0000 1111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you ask what comes next. What happens when you look at it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;000F = 0000000000001111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Binary counts the same way as Decimal or Hexadecimal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Binary  Decimal Hexadecimal&#xA;    0       0        0&#xA;    1       1        1&#xA;   10       2        2&#xA;   11       3        3&#xA;  100       4        4&#xA;  101       5        5&#xA;  110       6        6&#xA;  111       7        7&#xA; 1000       8        8&#xA; 1001       9        9&#xA; 1010      10        a&#xA; 1011      11        b&#xA; 1100      12        c&#xA; 1101      13        d&#xA; 1110      14        e&#xA; 1111      15        f&#xA;10000      16       10&#xA;10001      17       11&#xA;10010      18       12&#xA;10011      19       13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so on...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's really all simple counting. You should just get comfortable with doing it in Hexadecimal. One big reason you do IPv4 in Binary is that you need to do bitwise operations to figure out where the boundaries are, but with IPv6, you are really just given a single 64-bit boundary. There is far less bit manipulation.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-05T23:56:05.000" LastActivityDate="2016-03-05T23:56:05.000" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28444" PostTypeId="1" AcceptedAnswerId="28445" CreationDate="2016-03-05T21:51:27.623" Score="1" ViewCount="1616" Body="&lt;p&gt;If I set the receiving window to zero (receiver), does this automatically pause the timer for the unacknowledged segments at the sender?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any RFC or spec about this?&#xA;&lt;br/&gt;&lt;br/&gt;&#xA;Example: &lt;br/&gt;&#xA;S sends Seg1, Seg2. &lt;br/&gt;&#xA;C receives Seg1, 2 and ACK the Seg1. And sets the receive window to 0. &lt;br/&gt;&#xA;And waits for a few seconds until it would ACK the Seg2.&lt;br/&gt;&#xA;After this time it sends the ACK for Seg2 and with it a new window size.&lt;br/&gt;&#xA;Will the timer have been timed out for Seg2?&lt;/p&gt;&#xA;" OwnerUserId="23472" LastEditorUserId="8499" LastEditDate="2018-12-26T04:28:04.980" LastActivityDate="2018-12-26T04:28:04.980" Title="TCP Window Size Zero" Tags="|tcp|protocol-theory|transport-protocol|layer4|rfc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28445" PostTypeId="2" ParentId="28444" CreationDate="2016-03-05T22:02:17.300" Score="1" Body="&lt;p&gt;A simple Internet search will turn up a lot of information on this subject. if you add &lt;code&gt;rfc&lt;/code&gt; to your search, you will get links to the RFCs. For instance, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 793, TRANSMISSION CONTROL PROTOCOL&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Note that when the receive window is zero no segments should be&#xA;acceptable except ACK segments. Thus, it is be possible for a TCP to&#xA;maintain a zero receive window while transmitting data and receiving&#xA;ACKs. However, even when the receive window is zero, a TCP must&#xA;process the RST and URG fields of all incoming segments.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Based on the comments and discussion, the timer is not paused, it continues to run and may expire. If the ACK for the expired timer is received before the window size is reset, the timer is moot since the segment(s) was acknowledged. If the window size is reset before the ACK is received, the timer has already expired since it continued to run, and the sender will immediately resend the unacknowledged segment(s). It will not resume a paused timer and wait for it to expire.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-06T00:00:51.970" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="28446" PostTypeId="1" AcceptedAnswerId="28447" CreationDate="2016-03-05T23:49:16.300" Score="7" ViewCount="86545" Body="&lt;p&gt;It is clear that hosts on two different VLANs can't directly communicate on a single switch, but how do they communicate to each other at all? Do they use a router? How does it work?&lt;/p&gt;&#xA;" OwnerUserId="23142" LastEditorUserId="8499" LastEditDate="2016-03-06T01:24:43.463" LastActivityDate="2021-04-30T03:17:45.350" Title="How can hosts on two different VLANs communicate?" Tags="|routing|switch|vlan|switching|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28447" PostTypeId="2" ParentId="28446" CreationDate="2016-03-05T23:51:31.000" Score="10" Body="&lt;p&gt;Two separate VLANs must communicate through a layer-3 device, like a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices on a VLAN communicate with each other using layer-2. Layer-3 must be used to communicate between separate layer-2 domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the most common communications (layer-2 is ethernet and layer-3 is IP), when a host on a VLAN wants to communicate with another host on the same VLAN, it discovers the other hosts layer-2 (e.g. MAC) address with something like ARP, and it sends the frame to the MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a host on one VLAN wants to send something to a host on another VLAN, it must use a layer-3 (e.g. IP) address. The host will use layer-2 to send the frames to its defined gateway (router). The router will strip off the layer-2 frame and inspect the layer-3 packet for the destination layer-3 address. The router will then look up the next hop for the layer-3 address. It will then create a new layer-2 frame for the layer-3 packet based on the layer-2 LAN on the interface where it needs to send the packet for the next hop. Other routers which may be in the path to the end LAN will repeat this process until the frame is placed on the final VLAN, where the receiving host gets the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should search for the OSI model and learn how it works. Just remember that it is a model, and some things in the real world don't necessarily work exactly like the model would predict, but it will give you a gross understanding of how data travel from an application on one host to an application on another host.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-06T04:15:59.883" LastActivityDate="2016-03-06T04:15:59.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28449" PostTypeId="1" AcceptedAnswerId="28450" CreationDate="2016-03-06T02:50:20.513" Score="2" ViewCount="154" Body="&lt;p&gt;I have a Cisco 2500 series WLC, and a 1700 series LWAP.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In this case, what provides the AP the DHCP IP address, my router or the&#xA;WLC??&lt;/li&gt;&#xA;&lt;li&gt;There is already a PoE port in the WLC, yet when I connect my LWAP to&#xA;the WLC, it does not get a DHCP IP address and the LWAP keeps searching for&#xA;the controller. Why is it so?&lt;/li&gt;&#xA;&lt;li&gt;I know that the only way to have the routing done in the&#xA;controller is via VLAN using the switches. Please suggest me how to&#xA;create VLANs and do the routing via it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IizeZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IizeZ.png&quot; alt=&quot;MY SCENARIO &quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="8499" LastEditDate="2016-03-06T03:02:14.113" LastActivityDate="2016-03-06T03:27:45.820" Title="Wireless LAN Controller" Tags="|vlan|wireless|dhcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28450" PostTypeId="2" ParentId="28449" CreationDate="2016-03-06T02:58:31.240" Score="1" Body="&lt;p&gt;The LWAP will get its IP address from the DHCP server for the VLAN to which its management interface is attached, just like any other host on a VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LWAP should also get option 43 from the DHCP server to indicate which WLC it should use. You can read about it in &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/97066-dhcp-option-43-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;DHCP OPTION 43 for Lightweight Cisco Aironet Access Points Configuration Example&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;3&quot;&gt;&#xA;  &lt;li&gt;Add the Option 43 line with this syntax:&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;option 43 hex &amp;lt;hexadecimal string&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The hexadecimal string in step 3 is assembled as a sequence of the TLV&#xA;  values for the Option 43 suboption: Type + Length + Value. Type is&#xA;  always the suboption code 0xf1. Length is the number of controller&#xA;  management IP addresses times 4 in hex. Value is the IP address of the&#xA;  controller listed sequentially in hex.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For example, suppose there are two controllers with management&#xA;  interface IP addresses, 192.168.10.5 and 192.168.10.20. The type is&#xA;  0xf1. The length is 2 * 4 = 8 = 0x08. The IP addresses translate to&#xA;  c0a80a05 (192.168.10.5) and c0a80a14 (192.168.10.20). When the string&#xA;  is assembled, it yields f108c0a80a05c0a80a14. The Cisco IOS command&#xA;  that is added to the DHCP scope is:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;option 43 hex f108c0a80a05c0a80a14&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The WLC doesn't do routing, and neither do switches. Routing is handled in a router (a layer-3 switch includes a router). You must trunk the VLANs to a router for it to route between the VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs and routing are very fundamental networking. An answer on how to do these is far too broad, and the possible answer far too large, to be answered here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would strongly suggest that you hire someone who knows what to do to accomplish what you want done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can connect WLCs and LWAPs like you do with users. In the diagram below, users can connect to any of the switches, as can WLCs and APs. Each switch can have one or more VLANs, or you could have a single switch with one or more VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mtJmp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mtJmp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-06T03:27:45.820" LastActivityDate="2016-03-06T03:27:45.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28451" PostTypeId="2" ParentId="28449" CreationDate="2016-03-06T03:05:53.517" Score="2" Body="&lt;p&gt;The WLC does not physically sit between the AP and the rest of the LAN.  In your scenario, your router should connect directly to the switch (&quot;normal switch&quot;).  The WLC and AP should also have their own individual connections to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The router will provide an address to the AP.&lt;/li&gt;&#xA;&lt;li&gt;Connecting the AP to the PoE port is not currently supported by&#xA;Cisco.&lt;/li&gt;&#xA;&lt;li&gt;In this small network, there is no need for multiple VLANs.  The AP will find the controller because they are on the same VLAN.  If youwere to have them on different VLANs, you could use either DHCP options (as @ronmaupin explains) or use DNS (my preference).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-03-06T03:08:30.480" LastActivityDate="2016-03-06T03:08:30.480" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28454" PostTypeId="1" CreationDate="2016-03-06T10:04:51.940" Score="2" ViewCount="523" Body="&lt;p&gt;What's the interest of Designated Port in STP algorithm ?I didn't get their goal,we have both RootPort and DesignatedPort&lt;/p&gt;&#xA;" OwnerUserId="23480" LastActivityDate="2016-03-07T14:33:51.817" Title="Spanning Tree -DesignatedPort" Tags="|spanning-tree|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28456" PostTypeId="1" AcceptedAnswerId="28466" CreationDate="2016-03-06T13:06:06.877" Score="2" ViewCount="594" Body="&lt;p&gt;I have Dell PowerConnect 5524.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW01(config-dhcp)# option 43 hex f104ac1338fa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;got&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Option code 43 is not a valid HEX string.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Strange. Its worked ok for me on Cisco device. Looking at User Guide:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;hex hex-string—Specifies dotted hexadecimal data: Each byte in&#xA;  hexadecimal character strings is two hexadecimal digits. Bytes are&#xA;  separated by a period or colon&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Trying&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW01(config-dhcp)# option &#xA;  ip-list              Specify an IP address list.&#xA;  POSITIVE INTEGER     Specify the DHCP option code number&#xA;SW01(config-dhcp)# option 43 &#xA;  ascii                ASCII.&#xA;  hex                  Specify Option type as Hexadecimal.&#xA;  ip                   Specify Option type as IP address.&#xA;SW01(config-dhcp)# option 43 hex &#xA;  WORD                 Specify Option type as Hexadecimal.&#xA;SW01(config-dhcp)# option 43 hex f1.04.ac.13.38.fa&#xA;Option code 43 is not a valid HEX string.&#xA;SW01(config-dhcp)# option 43 hex f1:04:ac:13:38:fa&#xA;Option code 43 is not a valid HEX string.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Question - how do i configure option 43 on this switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="23482" LastActivityDate="2016-03-06T20:29:24.500" Title="DHCP option 43 on switch Dell PowerConnect 5500" Tags="|switch|dhcp|dell|wlc|powerconnect|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28458" PostTypeId="2" ParentId="28454" CreationDate="2016-03-06T14:39:37.800" Score="2" Body="&lt;p&gt;The Root port in a switch is the port connecting to the root bridge or has the lowest cost to the root bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The designated port is a port on a link with lowest cost to root bridge. So on a segment with two switches, neither being the root, the switch with shortest path to the root bridge will have the designated port on that segment and the other one will be blocking. On a link where the port on one side is a root port, the other side will be a designated port.&#xA;You could say that the designated port is the one responsible for forwarding traffic to a segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Found this picture that might help explain it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tAplG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tAplG.jpg&quot; alt=&quot;Topology of three STP switches connected in a triangle with 3 segments.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sw1 being the root bridge has only got designated ports. The other port on those two links are both root ports as they connect to Sw1. Sw3 which has got the lowest cost to the root bridge(Sw1) has got the Designated port(DP) on the third segment which leaves Blocking state for Sw2 since that link is not the shortest path to the root.&lt;/p&gt;&#xA;" OwnerUserId="14973" LastEditorUserId="14973" LastEditDate="2016-03-06T23:08:17.000" LastActivityDate="2016-03-06T23:08:17.000" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28459" PostTypeId="1" AcceptedAnswerId="28460" CreationDate="2016-03-06T16:31:40.177" Score="3" ViewCount="734" Body="&lt;p&gt;I want to configure port-security on a c2960 cisco switch to allow maximum of 10 MAC addresses per port. However two of the switch ports will be connected to a Wi-Fi access point for wireless users. If more than 9 clients connect to the WiFi access point will a security violation occur?&lt;/p&gt;&#xA;" OwnerUserId="15536" LastActivityDate="2016-03-06T17:03:22.020" Title="Will a Wi-Fi Access point affect maximum addresses configured via port-security" Tags="|cisco-catalyst|access-point|port-security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28460" PostTypeId="2" ParentId="28459" CreationDate="2016-03-06T17:03:22.020" Score="6" Body="&lt;p&gt;That depends on how the access point is configured. If it's configured as a router you'll only see one address of the access point itself, but if it's configured as a bridge between the wireless and the wired network, you'll see a MAC address for every connected client.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-03-06T17:03:22.020" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28461" PostTypeId="1" CreationDate="2016-03-06T17:23:53.117" Score="2" ViewCount="757" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WHKrt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WHKrt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;While calculating RTT for each packet in Wireshark, it occurs to me that several packets sent may have less corresponding respond packets. For example, as shown in the figure attached to this question, the client sent packet #10 and #11, but will only receive packet #14 as a response. The server returns the ACK# of #11, so how can I determine the RTT for #10? Will this be regarded as one transmission round or two?&lt;/p&gt;&#xA;" OwnerUserId="23489" OwnerDisplayName="Cf Wang" LastEditorUserId="23489" LastEditDate="2016-03-06T18:52:36.403" LastActivityDate="2016-06-04T20:48:54.673" Title="In TCP, does a client side packet have RTT since the server will send a cumulative ACK instead of ACK for each packet?" Tags="|tcp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28463" PostTypeId="2" ParentId="28461" CreationDate="2016-03-06T18:29:13.413" Score="2" Body="&lt;p&gt;I'm not sure this really answers your question, but keep in mind that TCP spends its time trying to determine the RTT of the &lt;em&gt;network&lt;/em&gt;, not that of each packet. The packet RTTs are a means to end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP implementations have all kinds of special cases to handle RTT estimations in the presence of different events : retransmissions, multiple retransmissions, etc... the difficulty being to ignore things that would give you a poor RTT estimation, but not ignore events that would signal an actual substantial change in the network RTT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in the case of cumulative ACKs, most likely TCP will just ignore packet #10 and can determine the RTT from packets #11 and #14.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-03-06T18:29:13.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28466" PostTypeId="2" ParentId="28456" CreationDate="2016-03-06T19:34:49.987" Score="2" Body="&lt;p&gt;You will have difficulties towards configuring dhcp on the dell 5524 which is a layer 2 switch. A good switch in my experience, but it isn't a layer 3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should use a layer 3 switch that provides the wanted dhcp options and/or relay the dhcp packets from your 5524 to a dedicated dhcp server (*nix dhcpd or window$ dhcp).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See this link for some more information:&#xA;&lt;a href=&quot;http://en.community.dell.com/support-forums/network-switches/f/866/t/19501905&quot; rel=&quot;nofollow&quot;&gt;http://en.community.dell.com/support-forums/network-switches/f/866/t/19501905&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-03-06T19:34:49.987" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28468" PostTypeId="2" ParentId="25696" CreationDate="2016-03-06T22:04:21.770" Score="1" Body="&lt;p&gt;First some background:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing to note is that there is a distinction between VLANs and subnets. A VLAN is a group of Ethernet devices that are isolated at layer 2 from other groups of Ethernet devices on the same physical infrastructure. A subnet is a block of IP addresses defined by the subnet mask where the devices within the block know they can reach each other without going via a gateway/router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often there is a one to one mapping between subnets and VLANs but there doesn't have to be. There are some caveats with running multiple subnets on the same VLAN but for the most part it's workable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a general rule if more than one VLAN needs to pass through a switch then that switch should support VLANs. IF a router is going to connect two VLANs on the same physical infrastructure then either the router needs to support VLANs or it needs to have a seperate connection to the switch for each VLAN.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There are several possible soloutions to &quot;Not enough IPs&quot; depending on what exactly the problem is, what equipment is present, how cooperative different stakeholders are and so-on.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Run a new subnet on the same layer 2 domain. Either have the existing gateway handle both subnets (with NAT if needed) or have a &quot;router on a stick&quot; (possibly with NAT) routing between the subnets x&lt;/li&gt;&#xA;&lt;li&gt;Run multiple subnets on seperate VLANS over the existing physical infrastructure. Again you could either have the existing gateway router handle both VLANs or have a &quot;router on a stick&quot; (possiblly with NAT) has the advantage you can separate DHCP and broadcasts will stay constrained to the individual VLANs but the downside that the switches will need to support VLANs and be configured to put the correct port on the correct VLAN&lt;/li&gt;&#xA;&lt;li&gt;Run the new devices on new physical infrastructure. Either have two seperate ports on the existing gateway router or have a router (possiblly with NAT) joining the existing and new networks. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-05-06T03:14:59.570" LastActivityDate="2016-05-06T03:14:59.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28469" PostTypeId="2" ParentId="28454" CreationDate="2016-03-06T23:07:39.703" Score="0" Body="&lt;p&gt;Actually you might find useful to approach the spanning tree operations in terms of network segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A segment is a collision domain or, technically speaking, a portion of a network where connected devices use the same physical layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for instance, the cat5 wire that connects a switchport with a PC is a segment, and if 2 switchports of 2 different switches are connected to an old hub in which a common IP subnet is assigned, these 2 ports are on the same segment, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the spanning tree point of view, in a single segment only 1 switchport is allowed to forward frames to that segment, and it is the designated port, and any other port should be blocked unless there is a switch that choose the segment as the best path to the root bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed, every switch choose which of its segments is the best one to reach the root bridge (and in which it defines one and only one root port).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in a segment that is not selected by anyone as a path to the root bridge (ie. a leaf of our tree), one designated port is elected and is in charge of the forwarding of the frames into that segment.&#xA;In a segment that is used by one or multiple switches to reach the root bridge (ie. a node of our tree - eg. a typical connection between 2 switch in cascade), the switch with the best BID will have its switchport in designated mode, and all the other switches will have 1 port each in root mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, a designated port forwards traffic from the root of the tree of STP to its leaves, while the root ports forward the frame from the leaves and the nodes up to the root (or to the proper intermediate note).&lt;/p&gt;&#xA;" OwnerUserId="17572" LastEditorUserId="17572" LastEditDate="2016-03-06T23:40:59.633" LastActivityDate="2016-03-06T23:40:59.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28470" PostTypeId="1" AcceptedAnswerId="28492" CreationDate="2016-03-06T23:52:22.337" Score="1" ViewCount="672" Body="&lt;p&gt;Everything I've read on this says this should work, but for some reason it's just not happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got a switch connected to a DHCP server (192.168.10.3) in VLAN 10, and two machines in VLAN 7: a client and a rogue DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 15.0&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;ip routing&#xA;!&#xA;!&#xA;!&#xA;ip dhcp snooping vlan 7,10&#xA;ip dhcp snooping&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/2&#xA; description Good DHCP server&#xA; switchport access vlan 10&#xA; ip dhcp snooping trust&#xA;!&#xA;interface FastEthernet0/3&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/4&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/5&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/6&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/7&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/8&#xA; switchport access vlan 7&#xA;!&#xA;interface FastEthernet0/9&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/10&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/11&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/12&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/13&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/14&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/15&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/16&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/17&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/18&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/19&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/20&#xA; description Client&#xA; switchport access vlan 7&#xA; spanning-tree portfast&#xA;!&#xA;interface FastEthernet0/21&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/22&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/23&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/24&#xA; description Rogue DHCP server&#xA; switchport access vlan 7&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan7&#xA; ip address 192.168.7.1 255.255.255.0&#xA; ip helper-address 192.168.10.3&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.10.1 255.255.255.0&#xA;!&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;no cdp run&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; speed 19200&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Observations:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When the rogue server is down, the client gets an IP from the good DHCP server and the appropriate entries are populated in the DHCP snooping database&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the good DHCP server is down, and the rogue server is up, the client gets an IP from the rogue DHCP server. By &quot;down&quot; I mean either the port is shutdown or I just remove the scope on the server so it doesn't respond.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The DHCP snooping debugs show the good DHCP server sending a DHCPOFFER. Yet the rogue server still wins.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What am I missing here? The switch is a 3560 running 15.0(2)SE5. I'm not running IP source guard or DAI.&lt;/p&gt;&#xA;" OwnerDisplayName="user6423" LastEditorUserId="8499" LastEditDate="2016-03-07T01:04:09.937" LastActivityDate="2016-03-07T14:50:52.007" Title="DHCP snooping not blocking rogue server" Tags="|cisco|cisco-ios|dhcp|dhcp-snooping|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28471" PostTypeId="1" CreationDate="2016-03-07T02:47:28.580" Score="1" ViewCount="285" Body="&lt;p&gt;My understanding: The NSSA can receive route information from the external AS but cannot receive external AS route info from internal areas so to perform this operation they must be running BGP and OSPF.&lt;/p&gt;&#xA;" OwnerUserId="23142" LastEditorUserId="8499" LastEditDate="2016-03-07T03:04:49.810" LastActivityDate="2016-03-07T04:10:58.193" Title="Must an ABR in a Not-So-Stubby-Area (NSSA) run two routing protocols like OSPF and BGP to import external AS routes?" Tags="|routing|bgp|ospf|stub|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28472" PostTypeId="2" ParentId="28471" CreationDate="2016-03-07T02:59:14.200" Score="1" Body="&lt;p&gt;You have a misunderstanding; there is nothing in OSPF which has any requirement for BGP, or any other routing protocol. The OSPF concept of AS doesn't mean that it must be a BGP AS; it means that it is a network outside the scope of the OSPF areas connected to the area 0 for the OSPF area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The outside AS can be as simple as connected routes of a router which are not natively injected into OSPF. Using redistribution to get the connected routes into OSPF makes them external routes (routes from a different AS) inside OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, you could have two OSPF ASes which can redistribute routes from one to the other using redistribution. As far as OSPF is concerned redistribution from any source into OSPF is injecting routes from a different AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A stub area which has routes redistributed into is would need to be NSSA.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-07T04:10:58.193" LastActivityDate="2016-03-07T04:10:58.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28473" PostTypeId="1" AcceptedAnswerId="28475" CreationDate="2016-03-07T04:13:21.337" Score="2" ViewCount="2698" Body="&lt;p&gt;I was very familiar with this stuff years ago... but I think I may have forgotten some basics. I'm running two images of NX-OS in GNS3. I've configured both as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Router 1&#xA;interface Ethernet2/1&#xA;  ip address 192.168.2.101/24&#xA;  no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Router 2&#xA;interface Ethernet2/1&#xA;  ip address 192.168.2.102/24&#xA;  no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I can't ping each other. &lt;code&gt;sh int status&lt;/code&gt; shows the links as connected: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Eth2/1        --                 connected routed    full    1000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Results of the ping though are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;N7K-2(config)# ping 192.168.2.101&#xA;PING 192.168.2.101 (192.168.2.101): 56 data bytes&#xA;2016 Mar  7 03:58:21.792494 netstack: [3107] (default) Send packet on Ethernet2/1 (mbuf_prty 7): s=192.168.2.102, d=192.168.2.101, nh=192.168.2.101, proto=1 (icmp), ip_len=84, id=0c2b, ttl=255&#xA;2016 Mar  7 03:58:21.792524 netstack: [3107] (default) Send packet on Ethernet2/1 (mbuf_prty 7): s=192.168.2.102, d=192.168.2.101, proto=1 (icmp), ip_len=21504, id=2b0c, ttl=255&#xA;Request 0 timed out&#xA;2016 Mar  7 03:58:23.793836 netstack: [3107] (default) Send packet on Ethernet2/1 (mbuf_prty 7): s=192.168.2.102, d=192.168.2.101, nh=192.168.2.101, proto=1 (icmp), ip_len=84, id=0c2c, ttl=255&#xA;2016 Mar  7 03:58:23.793999 netstack: [3107] (default) Send packet on Ethernet2/1 (mbuf_prty 7): s=192.168.2.102, d=192.168.2.101, proto=1 (icmp), ip_len=21504, id=2c0c, ttl=255&#xA;Request 1 timed out&#xA;2016 Mar  7 03:58:25.795381 netstack: [3107] (default) Send packet on Ethernet2/1 (mbuf_prty 7): s=192.168.2.102, d=192.168.2.101, nh=192.168.2.101, proto=1 (icmp), ip_len=84, id=0c2d, ttl=255&#xA;2016 Mar  7 03:58:25.795544 netstack: [3107] (default) Send packet on Ethernet2/1 (mbuf_prty 7): s=192.168.2.102, d=192.168.2.101, proto=1 (icmp), ip_len=21504, id=2d0c, ttl=255&#xA;Request 2 timed out&#xA;2016 Mar  7 03:58:27.797338 netstack: [3107] (default) Send packet on Ethernet2/1 (mbuf_prty 7): s=192.168.2.102, d=192.168.2.101, nh=192.168.2.101, proto=1 (icmp), ip_len=84, id=0c2e, ttl=255&#xA;2016 Mar  7 03:58:27.797436 netstack: [3107] (default) Send packet on Ethernet2/1 (mbuf_prty 7): s=192.168.2.102, d=192.168.2.101, proto=1 (icmp), ip_len=21504, id=2e0c, ttl=255&#xA;Request 3 timed out&#xA;2016 Mar  7 03:58:29.798765 netstack: [3107] (default) Send packet on Ethernet2/1 (mbuf_prty 7): s=192.168.2.102, d=192.168.2.101, nh=192.168.2.101, proto=1 (icmp), ip_len=84, id=0c2f, ttl=255&#xA;2016 Mar  7 03:58:29.799104 netstack: [3107] (default) Send packet on Ethernet2/1 (mbuf_prty 7): s=192.168.2.102, d=192.168.2.101, proto=1 (icmp), ip_len=21504, id=2f0c, ttl=255&#xA;Request 4 timed out&#xA;&#xA;--- 192.168.2.101 ping statistics ---&#xA;5 packets transmitted, 0 packets received, 100.00% packet loss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This isn't surprising, considering &lt;code&gt;show cdp neigh&lt;/code&gt; is empty. I just can't figure out why.&lt;/p&gt;&#xA;" OwnerUserId="4051" LastActivityDate="2016-03-07T05:07:07.180" Title="Can't ping between two directly connected routers (gns3)" Tags="|cisco|routing|ping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28474" PostTypeId="2" ParentId="22540" CreationDate="2016-03-07T04:35:03.183" Score="1" Body="&lt;p&gt;SSH into Prime and run 'root'. (You might need to enter 'root_enable&quot; as a precursory task.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See here for more detils:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/prime_infrastructure/3-0/command/reference/cli30/cli211_appendix_011.html#wp8104678890&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/wireless/prime_infrastructure/3-0/command/reference/cli30/cli211_appendix_011.html#wp8104678890&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you can view the linux shell. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enter 'cd /opt/CSCOlumos/conf/ifm/template/inventoryTagsInTemplate'&#xA;then 'ls' &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hey presto you can see the 'CLITemplateDbVariablesQuery.properties' file is here&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From here you can type 'more CLITemplateDbVariablesQuery.properties' to view the contents of the file.  :)&lt;/p&gt;&#xA;" OwnerUserId="19081" LastActivityDate="2016-03-07T04:35:03.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28475" PostTypeId="2" ParentId="28473" CreationDate="2016-03-07T05:07:07.180" Score="2" Body="&lt;p&gt;Problem ended up actually being an error in GNS3:  &lt;code&gt;Unable to create NIO Ethernet for bridge ethernet0.vnet&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution here was to run the following command (as admin): &lt;code&gt;sc config npf start= auto&lt;/code&gt; and restart the computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More details on the bug report: &lt;a href=&quot;https://github.com/GNS3/gns3-gui/issues/840&quot; rel=&quot;nofollow&quot;&gt;https://github.com/GNS3/gns3-gui/issues/840&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4051" LastActivityDate="2016-03-07T05:07:07.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28481" PostTypeId="1" CreationDate="2016-03-07T11:10:22.227" Score="0" ViewCount="1642" Body="&lt;p&gt;I would like my BGP peer SNMP alarms to contain the neighbor description within the alarm which will contain e.g. transit provider name/CID/etc. Currently my alarms just contain an ambiguous IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been searching extensively and I can't find anything.&#xA;The only solution I have discovered so far is to enter descriptions manually on our SNMP monitoring suite.&lt;/p&gt;&#xA;" OwnerUserId="23501" LastActivityDate="2017-06-15T17:36:24.590" Title="BGP Neighbor description OIDs (Juniper+Cisco)" Tags="|bgp|snmp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28484" PostTypeId="1" AcceptedAnswerId="28495" CreationDate="2016-03-07T12:59:55.990" Score="0" ViewCount="219" Body="&lt;p&gt;OK, TCP &lt;em&gt;is&lt;/em&gt; a multiplexed protocol...&#xA;I have several applications which need to connect to an appliance which only accepts 16 concurrent TCP connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am in full control of the applications and the network between them and the enter preformatted text hereappliance...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I place between my application and my appliance to accept more than 16 connections on one hand, and still cap to 16 connections on the other hand ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+--------+                         +-----+&#xA;| App 1  |---(10cnx on tcp/1234)---|     |&#xA;+--------+                         |     |                         +-----+&#xA;                                   | ??? |---(16cnx on tcp/1234)---| HSM |&#xA;+--------+                         |     |                         +-----+&#xA;| App 2  |---(10cnx on tcp/1234)---|     |&#xA;+--------+                         +-----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Seems impossible to me, but after &lt;a href=&quot;https://devcentral.f5.com/articles/3-really-good-reasons-you-should-use-tcp-multiplexing&quot; rel=&quot;nofollow&quot;&gt;that&lt;/a&gt;, I wonder...&lt;/p&gt;&#xA;" OwnerUserId="23504" LastActivityDate="2016-03-08T10:43:02.340" Title="TCP multiplexing or proxying" Tags="|tcp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28485" PostTypeId="2" ParentId="10870" CreationDate="2016-03-07T13:06:09.343" Score="2" Body="&lt;p&gt;UTP means Unshielded Twisted Pair. Four twisted pair cable is often used for Ethernet applications but can be used for other data, voice, or audio applications.&lt;/p&gt;&#xA;" OwnerUserId="23505" LastActivityDate="2016-03-07T13:06:09.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28486" PostTypeId="1" CreationDate="2016-03-07T13:17:34.033" Score="3" ViewCount="3700" Body="&lt;p&gt;Is there any particular reason as of why we should assign IP addresses to the largest subnet first? Could anyone give a simple example of why this is the better option?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I have two subnets: one for 40 hosts, and the second one for 4 hosts.&#xA;How come that starting with the smaller subnet would cause a bigger waste of IPs? The hosts take the same number of IPs no matter what IPs were assigned to them.&lt;/p&gt;&#xA;" OwnerUserId="20505" LastActivityDate="2016-04-06T19:10:49.473" Title="Why largest subnets should be assigned IPs first?" Tags="|subnet|" AnswerCount="2" CommentCount="2" ClosedDate="2019-03-17T00:56:49.937" ContentLicense="CC BY-SA 3.0" />
  <row Id="28487" PostTypeId="2" ParentId="18997" CreationDate="2016-03-07T13:22:36.287" Score="9" Body="&lt;p&gt;The minimum MTU for IPv4 is 68 bytes. Specifically from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc791&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Every internet module must be able to forward a datagram of 68&#xA;octets without further fragmentation.  This is because an internet&#xA;header may be up to 60 octets, and the minimum fragment is 8 octets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;However such a low MTU would be extremely inefficient.&lt;/p&gt;&#xA;&lt;p&gt;IPv6 sets a much higher minimum of 1280 bytes and requires links that can't support that MTU to provide a link-specific fragmentation and reassembly layer.  From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2460&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2460&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;IPv6 requires that every link in the internet have an MTU of 1280&#xA;octets or greater.  On any link that cannot convey a 1280-octet&#xA;packet in one piece, link-specific fragmentation and reassembly must&#xA;be provided at a layer below IPv6.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Presumablly the motivation is to stop low MTU links from driving inefficiency across the network. I assume 1280 bytes was chosen to allow for a packet to be wrapped in some encapsulation/tunneling crap and still fit in a standard ethernet frame.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-07T19:08:53.587" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28488" PostTypeId="2" ParentId="28486" CreationDate="2016-03-07T13:25:32.067" Score="2" Body="&lt;p&gt;It because you can't start the network for 40 hosts immediately after the network for four hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the network for four hosts is &lt;code&gt;10.0.0.0/29&lt;/code&gt;, the network for 40 hosts would need to start at &lt;code&gt;10.0.0.64/26&lt;/code&gt;. That means you have dead addresses from &lt;code&gt;10.0.0.8&lt;/code&gt; to &lt;code&gt;10.0.0.63&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, if the network for 40 hosts is &lt;code&gt;10.0.0.0/26&lt;/code&gt;, the network for 4 hosts can be &lt;code&gt;10.0.0.64/29&lt;/code&gt;, leaving no dead addresses in between.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-07T13:25:32.067" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28489" PostTypeId="2" ParentId="19470" CreationDate="2016-03-07T14:20:47.610" Score="2" Body="&lt;p&gt;Generally you clone a MAC because you want the new device to look &quot;the same&quot; as the old one to an external authority.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some providers require clients to register a MAC address before using it either explicitly through some kind of registration form or implicitly through some action. Examples of such impliicit registration include cable modems that will only accept the first MAC address they see after reset and wifi providers that use some kind of web based login form (technically the latter may use IP addresses to track users but due to the way DHCP is designed IPs tend to follow MACs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes it is easier and/or cheaper to clone a MAC address than it is to get a registration changed. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-03-07T14:20:47.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28490" PostTypeId="2" ParentId="28454" CreationDate="2016-03-07T14:33:51.817" Score="3" Body="&lt;p&gt;I'll try to answer this to make you get the idea, without diving deeply into details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP builds a tree.&#xA;So, think of these port roles from the perspective of direction you're going over this tree - upstream (to the Root Bridge) or downstream (from the Root Bridge).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Root Port basically is an upstream port, and Designated Port is a downstream port.&#xA;The Root Port receives BPDUs from the Root Bridge (directly or indirectly), caches them, and replicates out its Designated Ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does it matter? &#xA;The ultimate goal of STP to ensure that there's only one logical path between any two points in the topology - that's how it makes the topology loop-free.&#xA;That's why there may be only one Root Port per switch - this is the only exit point on a switch to reach the Root Bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Designated Port, on a contrary, is the port that sends BPDUs and connects the segment to the Root Bridge (that's why the Root Bridge has all its ports as Designated). So, there're multiple Designated ports per switch - as many as the number of the physical segments (from port to port, or, collision domain like matteo have mentioned) the particular switch serves.&#xA;Keeping in mind the goal of the STP, it's obvious that there may be only one Designated port per segment (to ensure only one logical path from the segment towards the Root Bridge).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These port roles are exactly about how the tree is actually built.&#xA;Once the Root Bridge is elected you have the root of the tree. Now, you need to construct the tree itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tree is constructed in a downstream manner, i.e. from the Root Bridge down the rest of the topology.&#xA;This is done through the exchange of BPDUs. In most STP versions (I won't touch different 'additions' from STP toolkit or MSTP here to avoid overcomplicating things) the Root Bridge is the only source of BDPUs - rest of the switches just receive them, cache for some time, and replicate downstream the topology (changing few parameters in them).&#xA;Look at the picture below and imagine the process of the construction of the tree:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MwX8F.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MwX8F.jpg&quot; alt=&quot;Example STP topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Root Bridge is elected, and all of its ports are Designated.&#xA;The fact that there is already a Root Bridge means that to this point all switches has all necessary information to construct a tree - they were exchanging BDPUs for some time and now all they know who is the Root Bridge and where it is located, in terms of direction (the port), the distance (the cost to reach it), and the upstream switch on the way to it.&lt;/li&gt;&#xA;&lt;li&gt;Downstream bridges each elects exactly one Root Port - the path to the Root.&lt;/li&gt;&#xA;&lt;li&gt;Once the Root port is elected, each bridge elects its Designated ports.&lt;/li&gt;&#xA;&lt;li&gt;If the Designated port (the downstream port) is also receiving BPDUs, this means that it's connected to the similar Designated port - i.e. you have two ports that both lead to the Root Bridge - this directly violates the goal of STP because you have two logical paths to the same point (the Root Bridge), and it's essentially a loop (imagine frames flow from the Root Bridge, exit from one of these Designated ports and going into another, getting back to the Root Bridge).&#xA;So, to avoid this, STP simply blocks one of this ports thus breaking the loop.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19378" LastActivityDate="2016-03-07T14:33:51.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28491" PostTypeId="1" AcceptedAnswerId="28588" CreationDate="2016-03-07T14:49:08.637" Score="3" ViewCount="3722" Body="&lt;p&gt;I found tons and tons of 2.4GHz signal amplifiers on the Internet. Really damn &lt;a href=&quot;http://www.aliexpress.com/item/4W-Wifi-Wireless-Broadband-Amplifier-Router-2-4Ghz-Power-Range-Signal-Booster-Free-Shipping/2035126682.html&quot; rel=&quot;nofollow&quot;&gt;affordable ones&lt;/a&gt;, too. But I could literally not find a single 5GHz amplifier. Why is that? Am I just too stupid to find them or is it simply not possible to amplify 5Ghz in the same fashion for some reason? If so, why?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I am NOT talking about repeaters and I am not looking for antennas or anything. This is just about amplifiers.)  &lt;/p&gt;&#xA;" OwnerUserId="16804" LastEditorUserId="16804" LastEditDate="2016-03-09T18:51:57.413" LastActivityDate="2016-05-13T19:56:41.130" Title="Is it possible to amplify a 5GHz wifi signal?" Tags="|wireless|" AnswerCount="1" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="28492" PostTypeId="2" ParentId="28470" CreationDate="2016-03-07T14:50:52.007" Score="1" Body="&lt;p&gt;From what I see your configuration should work.&#xA;Also, the goal of DHCP snooping on untrusted ports is to filter out the DHCP-server specific messages, like OFFERs.&#xA;Please, provide us with the &lt;strong&gt;show ip dhcp snooping&lt;/strong&gt; output, and with the &lt;strong&gt;show ip dhcp snooping statistics detail&lt;/strong&gt; output as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if you still have &lt;strong&gt;debug ip dhcp snooping&lt;/strong&gt; output, it would probably help to see it as well.&#xA;Right now for me it looks like a software bug. Probably you should at least search the Cisco BST tool for this.&lt;/p&gt;&#xA;" OwnerUserId="19378" LastActivityDate="2016-03-07T14:50:52.007" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28494" PostTypeId="1" AcceptedAnswerId="28597" CreationDate="2016-03-07T15:29:55.653" Score="2" ViewCount="4412" Body="&lt;p&gt;I have littel experience in this kind of setups, so please bear with me. I think the question is kind of basic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to install a router in a LAN since I'll have to have it mandle a VPN tonnel later. In short I have to go from this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;lt; PUBLIC IP &gt;&lt;strong&gt;[DSL Modem]&lt;/strong&gt;&amp;lt;192.168.1.1&gt; ------ &amp;lt;192.168.1.0&gt;&lt;strong&gt;[A BUNCH OF SERVERS]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;lt; PUBLIC IP &gt;&lt;strong&gt;[DSL Modem]&lt;/strong&gt;&amp;lt;192.168.0.1&gt; --- &amp;lt;192.168.0.2&gt;&lt;strong&gt;[Mikrotik Routerboard]&lt;/strong&gt;&amp;lt;192.168.1.1&gt; --- &amp;lt;192.168.1.0&gt;&lt;strong&gt;[A BUNCH OF SERVERS]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I NATted the services I need to forward to the servers using the DSL modem interface (mail, rdp, ssh, etc). Now with the new setup I'm really confused on how should I procede.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it sensible to have 2 NAT &quot;hops&quot;? DSL modem forwarding all services requests from the WAN to 192.168.0.2 (again by using the NAT interface) and then forwarding them again to the server (from the router)? Does NAT work this way? Is there another smarter way to solve this?&lt;/p&gt;&#xA;" OwnerUserId="23511" LastEditorUserId="8499" LastEditDate="2018-02-14T16:23:54.647" LastActivityDate="2018-02-14T16:23:54.647" Title="NAT Network setup with DSL modem and Mikrotik router" Tags="|vpn|nat|adsl|" AnswerCount="3" CommentCount="1" ClosedDate="2017-08-09T23:46:18.870" ContentLicense="CC BY-SA 3.0" />
  <row Id="28495" PostTypeId="2" ParentId="28484" CreationDate="2016-03-07T15:30:03.453" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What can I place between my application and my appliance to accept more than 16 connections on one hand, and still cap to 16 connections on the other hand ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;An application level gateway that understands the application protocol in question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the TCP connections are carrying some kind of request/response protocol the gateway will need to recognise the beginning and end of each request and response, merge the stream of requests from different clients to send them to the device and somehow keep track of which request belongs to which client so it can send the responses back to the correct client. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-03-07T15:30:03.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28498" PostTypeId="2" ParentId="5337" CreationDate="2016-03-07T19:01:34.873" Score="0" Body="&lt;p&gt;Rewriting the MAC address would add considerable complexity (the switch would have to know about higher level protocols like arp so it could rewrite address resoloution), would make troubleshooting harder, would prevent protocols like STP from working and would generally be a PITA. It's also not normally needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is not to say it's not possible. ebtables (the layer 2 counterpart to iptables) does have some options for MAC address translation. This can be useful if you have switches that don't use per-vlan MAC tables and you want to do some layer 2 filtering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ebtables.netfilter.org/examples/example1.html&quot; rel=&quot;nofollow&quot;&gt;http://ebtables.netfilter.org/examples/example1.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-03-07T19:01:34.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28499" PostTypeId="1" AcceptedAnswerId="28587" CreationDate="2016-03-07T23:40:02.680" Score="1" ViewCount="274" Body="&lt;p&gt;For one of our customers we have 1 NOC router with ~10 L2L VPNS running OSPF. We are slowly trying to migrate these L2L tunnels to a DMVPN solution. We decided to implement a second router as the DMVPN Hub (DMVPN was mysteriously breaking L2L tunnels when both on the same router as soon as ISAKMP SAs expired).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original router is the DR and our newly implemented router is the BDR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the documentation I have come across stress that the hub needs to be the DR. Can we implement phase 2 DMVPN with our hub as a BDR? What are any possible implications for running with this configuration? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="14166" LastActivityDate="2016-03-14T19:40:39.303" Title="OSPF DMVPN Hub as a BDR" Tags="|cisco|routing|vpn|ospf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28501" PostTypeId="1" AcceptedAnswerId="28525" CreationDate="2016-03-08T07:53:07.230" Score="1" ViewCount="11910" Body="&lt;p&gt;I have to configure an IP EPABX e.g., an NEC 9100 series. I have an HP managed PoE switch. We have existing VLANs 5 and 50. VLAN 5 is for wireless/guests, and VLAN 50 is for the Internet. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 5: Ports 1,2,3,4&lt;/li&gt;&#xA;&lt;li&gt;VLAN 50:Ports 35,36,37,38&lt;/li&gt;&#xA;&lt;li&gt;Ports 45,46,47,48 are for uplinks to other switches&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have to configure VLAN 10 for VoIP on the existing switch. My office wants me to configure the EPABX with the static IP 192.168.1.1. Then the VoIP phones will receive the IP addresses from 192.168.1.0/24. PCs need to be connected to the VoIP phones, and the PCs should get IP addresses from 10.2.107.0.24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my first task with any EPABX. Is it possible? Is the EPABX able to route?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fwMSl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fwMSl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="8499" LastEditDate="2016-03-09T05:56:46.710" LastActivityDate="2016-03-09T15:58:11.930" Title="Configuration of voice VLAN in HP switch" Tags="|routing|vlan|switching|hp|voice|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28502" PostTypeId="2" ParentId="28494" CreationDate="2016-03-08T08:18:25.673" Score="1" Body="&lt;p&gt;The scenario you describe works, you can &quot;chain NATs&quot; without problem, for example&#xA;[Public IP]:58000 -&gt;NATed by DSL modem on 192.168.0.2:58000 -&gt;NATed by mikrotik on 192.168.1.55:80&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you can use the &quot;DMZ&quot; feature on your modem to redirect all incoming ports to 192.168.0.2 and do the NAT on Mikrotik only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you can set up your DSL modem in bridge mode (if it can do that) so all incoming connections are directly sent (bridged) to Mikrotik router, which will do the NAT.&lt;/p&gt;&#xA;" OwnerUserId="20569" LastActivityDate="2016-03-08T08:18:25.673" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28505" PostTypeId="2" ParentId="28484" CreationDate="2016-03-08T10:43:02.340" Score="0" Body="&lt;p&gt;you're going to need application protocol logic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;one way to do this would be to structure this as an HTTP application.. if you did that your ??? box could be an HTTP intermediary that spoke HTTP/2 on the backside.. then you would only need one connection on that side (and you can arbitrarily mux the active sessions within http/2). &lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-03-08T10:43:02.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28506" PostTypeId="1" AcceptedAnswerId="28508" CreationDate="2016-03-08T11:43:19.673" Score="1" ViewCount="863" Body="&lt;p&gt;I currently have two links which form a Port-Channel from 1 cisco device to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to change the port-channel config from&lt;/p&gt;&#xA;&#xA;&lt;p&gt;channel-group 1 mode on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&#xA;&lt;p&gt;channel-group 1 mode active&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that the Port-Channel is now running LACP, so I can also turn on lacp rate fast&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To prevent any outage I was going to shut 1 of the interfaces in the Port-Channel change to LACP and rejoin the port-channel, but I was wondering is it possible to have 1 link running &quot;on&quot; and 1 link running &quot;active&quot; LACP in the same Port-Channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luke&lt;/p&gt;&#xA;" OwnerUserId="14132" LastActivityDate="2016-03-08T15:13:13.690" Title="Port-Channel Interface Configuration EtherChannel and LACP in same Port-Channel" Tags="|cisco-ios|ieee-802.1ax|cisco-nexus|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28508" PostTypeId="2" ParentId="28506" CreationDate="2016-03-08T12:20:07.780" Score="2" Body="&lt;p&gt;Immediately: NO.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the interface configurations differ, one or the other interface will not join the port-channel. You should never mess with the interface configuration directly -- aside from putting it in the port-channel and turning it on/off.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-03-08T12:20:07.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28510" PostTypeId="1" AcceptedAnswerId="28511" CreationDate="2016-03-08T13:45:53.177" Score="1" ViewCount="67" Body="&lt;p&gt;I have a Java based system and it is using an API for additional features, the API has a built-in SSL connection on you just have to enable it in the code, and I was able to enable it but I still want to make sure that it really is SSL. Is there anyway for me to check this using any network monitoring tools?&lt;/p&gt;&#xA;" OwnerUserId="23537" LastEditorUserId="8499" LastEditDate="2018-02-16T04:21:48.417" LastActivityDate="2018-02-16T04:21:48.417" Title="whats the best way to check if my API connection is SSL using network monitoring tools?" Tags="|monitoring|network-discovery|" AnswerCount="1" CommentCount="1" ClosedDate="2016-03-08T18:55:15.890" ContentLicense="CC BY-SA 3.0" />
  <row Id="28511" PostTypeId="2" ParentId="28510" CreationDate="2016-03-08T13:49:10.317" Score="1" Body="&lt;p&gt;One way is to use Wireshark to capture some of the data and verify that the traffic uses TCP port 443.  If you capture the initial handshake, you can see the SSL negotiation taking place.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-08T13:49:10.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28513" PostTypeId="2" ParentId="28506" CreationDate="2016-03-08T15:13:13.690" Score="0" Body="&lt;p&gt;You are going to need to shut this down on both sides, make your changes, then bring it back up if you want to do it safely and correctly. If you try to do this with either side up, you are likely to cause one or more ports to go into &lt;code&gt;errdisable&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not even sure why you need to run LACP between Cisco devices if PAgP is working today. Why do you need to send LACP control packets every second instead of every 30 seconds? PAgP fails over extremely fast, much faster than routing protocols like OSPF.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-08T15:13:13.690" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28515" PostTypeId="2" ParentId="28501" CreationDate="2016-03-08T16:31:03.270" Score="0" Body="&lt;p&gt;Basically, you need to define the VLANs correctly. Set up a VoIP VLAN, in your case 50, as a tagged VLAN for your ports where the phones will be connected, but untagged for your PBX. The data VLANs will be untagged on the ports where they are today.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple Internet will give you a lot of hits with example, such as &lt;a href=&quot;http://community.hpe.com/t5/ProCurve-ProVision-Based/How-to-assign-a-port-to-two-different-Vlans-voice-and-data/td-p/5687709&quot; rel=&quot;nofollow&quot;&gt;this one&lt;/a&gt; from MichaelvLonden, Advisor :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf&#xA;&#xA;vlan 11                                              (this creates vlan 11)&#xA;&#xA;vlan 12 voice                                    (this creates vlan 12 and labels it as voice vlan)&#xA;&#xA;vlan 11 untagged 1                         (interface 1 is added to the access vlan 11)&#xA;&#xA;vlan 12 tagged 1                            (interface 1 is added to the voice vlan 12)&#xA;&#xA;end&#xA;&#xA;wr m&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just adjust the VLAN and interface numbers (data and VoIP) for your particular usage.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-08T16:31:03.270" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28516" PostTypeId="1" AcceptedAnswerId="28518" CreationDate="2016-03-08T17:01:36.130" Score="4" ViewCount="907" Body="&lt;p&gt;Am sorry if my question is silly. But I want to clear that i doesn't mean just playing audio or video from a remote server.I am asking about conventional broadcasting as exists in Television and Radio (one transmitter{here i mean transmitting once unlike transmitting data differently for different number of receivers.}. As of my knowledge if I start streaming live on any Internet Service(Say You Tube ), it will start sending me data over internet like a point to point communication, even if I open  the same video in another tab my browser  will create a new connection with YouTube server and that will start a new point to point communication.&#xA;&lt;strong&gt;But what if we place server or router @ home b/w receiver and transmitter which gives a unique url to broadcast related communication over internet and every time when another receiver{connected after router} requests that content the router will provide access to a copy of that content&lt;/strong&gt;&#xA;I have just asked this because a HYBRID internet could me more faster and the service like live streaming &lt;code&gt;that sucks majority of bandwidth of internet  and  for which internet is not a right protocol&lt;/code&gt;  could be done over above mentioned channel.By labelling communications as PUBLIC , PRIVATE and BROADCAST&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Plz correct me if i have choosen wrong community&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="23548" LastEditorUserId="8499" LastEditDate="2019-01-05T03:39:25.073" LastActivityDate="2019-01-05T03:39:25.073" Title="Is the real broadcasting on internet possible" Tags="|routing|internet|multicast|broadcast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28518" PostTypeId="2" ParentId="28516" CreationDate="2016-03-08T17:17:30.070" Score="6" Body="&lt;p&gt;I don't think you really understand that the Internet is just a collection of many ISPs which connect to other ISPs. Each ISP has its own policies. Also, IP has a single source and a single destination address for each IP packet. Actual broadcasts, from the perspective of IP (broadcast destination address), are restricted to a single broadcast domain, and a broadcast cannot cross a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP does have multicast which is used with a single source, multiple receivers. Like broadcast, multicast is normally restricted to a single broadcast domain. To get around that, multicast routing was developed, but it is different than regular IP routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With multicast, each and every router in a path from source to destination must be configured for multicast with the same multicast policies. Also, you would end up forcing ISPs to either always carry multicast traffic for which it may have no users (wastes a lot of precious bandwidth and the ISPs will never agree to this), or the ISPs will need to purchase and maintain special equipment just for the multicast traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-08T17:25:42.820" LastActivityDate="2016-03-08T17:25:42.820" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="28519" PostTypeId="2" ParentId="28516" CreationDate="2016-03-08T17:22:57.943" Score="4" Body="&lt;p&gt;Many places, such as television and radio stations, do &quot;broadcast&quot; live programming over the Internet.  The problem they all have is a matter of scale.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every connection (listener) requires a separate stream of data.  So 10,000 viewers require the data stream to be duplicated 10,000 times.  It doesn't matter if they are all watching in sync or not.  The equipment and data circuit costs can be substantial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast is another option, but as @Ronmaupin explains, it requires all the ISPs to cooperate.  The costs would be substantial and they would only do so if it was in their financial interest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage of Internet broadcasting is that broadcasters can identify individual users, and therefore charge money for the service, or collect information about you to sell to advertisers or other third parties.  In traditional &quot;over the air&quot; broadcasting, this is difficult or impossible to do. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-08T17:22:57.943" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28523" PostTypeId="2" ParentId="28426" CreationDate="2016-03-08T19:40:06.490" Score="3" Body="&lt;p&gt;The answer appears to be: the Commodo cert is SHA-2, which 8.3(2) doesn't support. So, either get the cert re-cut as SHA-1 (not a good idea) or upgrade to a newer firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nuts.&lt;/p&gt;&#xA;" OwnerUserId="15019" LastActivityDate="2016-03-08T19:40:06.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28525" PostTypeId="2" ParentId="28501" CreationDate="2016-03-08T21:10:37.443" Score="2" Body="&lt;p&gt;NOTE: Adjusted from an answer I accidentally &lt;a href=&quot;https://superuser.com/a/1019502/438726&quot;&gt;posted&lt;/a&gt; on an old question&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your layer 3 (IP) is kinda irrelevant! Your PCs can be (and should be) on a different subnet completely decoupled from your &lt;code&gt;voice&lt;/code&gt; vlan. Now, to the point. As I wrote in the previous post and with the help of &lt;a href=&quot;https://community.spiceworks.com/topic/409714-hp-procurve-vlan-configuration-for-voip&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; post:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Keep your up-links tagged (I tend to use ports at the end  - i see you do too ... ++)&lt;/li&gt;&#xA;&lt;li&gt;Voice is also tagged based on the above link&lt;/li&gt;&#xA;&lt;li&gt;Data will always be untagged on access ports (servers might be an exception - this is mainly for desktops)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, to the config (&lt;code&gt;#&lt;/code&gt; and after are comments):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 5&#xA;   name &quot;guests&quot;&#xA;   untagged 1-4 # wifi ports&#xA;   tagged 45-48 # uplinks&#xA;&#xA;vlan 10&#xA;   name &quot;voice&quot;&#xA;   tagged 35-38,45-48  # Includes uplinks - based on the prev post voice is tagged&#xA;   untagged 12 # This is the EPABX... i just assumed 12... adjust&#xA;   qos priority 6 # based on the previous post, L2 priority I assume&#xA;   voice&#xA;   exit &#xA;&#xA;vlan 50&#xA;   name &quot;data&quot; &#xA;   untagged 35-38 &#xA;   tagged 45-48 # uplinks&#xA;   exit &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's going on?:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;your data remain the same (vlan 50) and wifi guests (vlan 5)&lt;/li&gt;&#xA;&lt;li&gt;voice vlan sends tagged to the phones (35-38) and also (if needed) to your uplinks. Phones should pick-up tagged traffic but forward untagged packets to the data - which belongs to vlan 50&lt;/li&gt;&#xA;&lt;li&gt;you send your voice traffic untagged to the EPABX via port 12 (I might be wrong here, you might have to tag it)&lt;/li&gt;&#xA;&lt;li&gt;Nothing changes on the guest wifi&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now depending on what the EPABX is (I have not configured one of those...) it might require tagged traffic on both data and voice so it can route between them... not sure&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the question how the PCs are getting IPs: You can think of VLANs as separate LANs, each one using a different switch so your phones are completely separate from the PCs. Then notice that on ports 35-38 we send both vlan 10 and 50 with the difference that 50 has a &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1Q&quot; rel=&quot;nofollow noreferrer&quot;&gt;dot1q&lt;/a&gt; tag on the frame. Each phone has a simple bridge/switch. It keeps the tagged traffic for itself and is forwarding all the untagged to the PC port. So, for example, when the PC is doing a DHCP request:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;DHCP req. is broadcast&lt;/li&gt;&#xA;&lt;li&gt;The phone will receive an untagged frame from the PC port which will forward to the switch (as is, no tag added)&lt;/li&gt;&#xA;&lt;li&gt;The switch sees the frame on port 36 &lt;em&gt;without&lt;/em&gt; a tag so it knows it belongs to vlan 50 (if the phone was doing the DHCP the frame would have a tag and the switch will see it as vlan 10)&lt;/li&gt;&#xA;&lt;li&gt;The switch will forward the frame on all ports that belong to vlan 50, including uplinks. On the uplinks the switch is adding a tag to the frame before sending it.&lt;/li&gt;&#xA;&lt;li&gt;The DHCP server for PCs is on the same vlan (50), sees the request and sends a reply&lt;/li&gt;&#xA;&lt;li&gt;The reply is received from the switch which now knows the PCs mac address is untagged on port 36 so it forwards the frame to that port&lt;/li&gt;&#xA;&lt;li&gt;The phone receives the DHCP reply frame, but since it is untagged it does not look into it, it directly forwards it to the PC&lt;/li&gt;&#xA;&lt;li&gt;PC now has an IP! (few ACKs go up and down the same way)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, if the phone was doing the DHCP:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Step 3: Switch would see vlan 10&lt;/li&gt;&#xA;&lt;li&gt;Step 4-5: The same but for vlan 10 which means that different DHCP server receives the request&lt;/li&gt;&#xA;&lt;li&gt;Step 6: The switch now knows the phone's MAC is behind port 36... but this time it is &lt;em&gt;tagged&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;Step 7: The phone receives a tagged frame so it keeps it/looks into it and does not forward&lt;/li&gt;&#xA;&lt;li&gt;Step 8: Phone now got an IP, note that the PC saw no traffic at all. Completely separate network&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Finally, note that since we are talking for a switch, we are staying on OSI Layer 2. Everything involving vlans is in this layer. We have not yet setup any routing. If for any reason your phones should be able to talk to the PCs, then a layer 3 router is required to connect the two networks (currently completely independent from each other)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helps&lt;/p&gt;&#xA;" OwnerUserId="23556" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2016-03-09T08:41:34.017" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28526" PostTypeId="2" ParentId="28494" CreationDate="2016-03-08T22:33:19.653" Score="0" Body="&lt;p&gt;You can have double NAT if you want but you will find it easier to purchase a router that has a DSL modem built in. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also have your current modem act only as a modem and bridge the connection to the new router using something like PPPoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you absolutely cannot change your set up then it will work but it will be a hassle if you have to port forward anything . If you port forward port 25 (SMTP) on the outside interface of your modem to your mikrotik routers outside interface (192.168.0.2), you will also need to port forward port 25 on your mikrotik routers outside interface to the internal resource on the LAN. You'll be doing everything twice basically. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming your public ip is 1.1.1.1 and you want to forward SMTP traffic from the DSL modem to an email server on your LAN at 192.168.1.5 it would look like the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.1.1.1:25[DSL Modem]  -&gt;  192.168.0.2:25[Mikrotik Router] -&gt; 192.168.1.5:25[Email Server]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VPN tunnel should be fine as long as you have NAT-T on both ends of the tunnel and the other side has a static IP without NAT. You can set your side to be dynamic and only have it initiate the connection&lt;/p&gt;&#xA;" OwnerUserId="23560" LastActivityDate="2016-03-08T22:33:19.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28532" PostTypeId="1" AcceptedAnswerId="28533" CreationDate="2016-03-09T03:53:13.753" Score="1" ViewCount="499" Body="&lt;p&gt;In any sort of ARQ, when is a packet considered delivered? Is it when ACK is sent or when ACK is received? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would think it's when it's sent, as it has been received on the receiver end. However, it's not completely confirmed yet so the sender doesn't know it's delivered.&lt;/p&gt;&#xA;" OwnerUserId="23079" LastEditorUserId="8499" LastEditDate="2018-10-19T06:11:29.823" LastActivityDate="2018-10-19T06:11:29.823" Title="Is a packet considered delivered when ACK is sent or when ACK is received?" Tags="|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28533" PostTypeId="2" ParentId="28532" CreationDate="2016-03-09T04:02:07.050" Score="4" Body="&lt;p&gt;I assume you mean TCP segments. Packets don't get ACKs; IP is connectionless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether it is considered as having been received is a matter of perspective. Certainly, the receiver is happy to consider the TCP segment as received as soon as it gets it. On the other hand, the sender is not satisfied that any of the segments sent in a window have been received until it receives an ACK. If its timer expires before an ACK is received, it is obligated to resend the segments in the window without an ACK.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-09T09:40:19.857" LastActivityDate="2016-03-09T09:40:19.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28537" PostTypeId="1" AcceptedAnswerId="28545" CreationDate="2016-03-09T08:27:40.123" Score="0" ViewCount="3474" Body="&lt;p&gt;I install snmpd, snmp and snmp-mibs-downloader package on my debian jessie.&lt;/p&gt;&#xA;&lt;p&gt;Some mib's on my linux Responded but UCD-SNMP-MIB in not responded.&lt;/p&gt;&#xA;&lt;p&gt;e.g:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;root@MRT:/etc/snmp# snmpwalk -v1 -c public localhost DISMAN-EVENT- MIB::sysUpTimeInstance&#xA;DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (458675) 1:16:26.75&#xA;root@MRT:/etc/snmp# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;But this is no responsed:&lt;/p&gt;&#xA;&lt;p&gt;e.g 1:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;root@MRT:/etc/snmp# snmpwalk -v1 -c public localhost UCD-SNMP-MIB::ucdavis&#xA;End of MIB&#xA;root@MRT:/etc/snmp# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;e.g 2:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;root@MRT:/etc/snmp#  snmpget -v 2c -c public localhost .1.3.6.1.4.1.2021.4.6&#xA;UCD-SNMP-MIB::memAvailReal = No Such Object available on this agent at this OID&#xA;root@MRT:/etc/snmp# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and My snmp config file:&lt;/p&gt;&#xA;&lt;p&gt;/etc/snmp/snmpd.config&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    ###############################################################################&#xA;#&#xA;# EXAMPLE.conf:&#xA;#   An example configuration file for configuring the Net-SNMP agent ('snmpd')&#xA;#   See the 'snmpd.conf(5)' man page for details&#xA;#&#xA;#  Some entries are deliberately commented out, and will need to be explicitly activated&#xA;#&#xA;###############################################################################&#xA;#&#xA;#  AGENT BEHAVIOUR&#xA;#&#xA;&#xA;#  Listen for connections from the local system only&#xA;#agentAddress  udp:172.16.98.24:161&#xA;#  Listen for connections on all interfaces (both IPv4 *and* IPv6)&#xA;agentAddress udp:161,udp6:[::1]:161&#xA;&#xA;&#xA;&#xA;###############################################################################&#xA;#&#xA;#  SNMPv3 AUTHENTICATION&#xA;#&#xA;#  Note that these particular settings don't actually belong here.&#xA;#  They should be copied to the file /var/lib/snmp/snmpd.conf&#xA;#     and the passwords changed, before being uncommented in that file *only*.&#xA;#  Then restart the agent&#xA;&#xA;#  createUser authOnlyUser  MD5 &amp;quot;remember to change this password&amp;quot;&#xA;#  createUser authPrivUser  SHA &amp;quot;remember to change this one too&amp;quot;  DES&#xA;#  createUser internalUser  MD5 &amp;quot;this is only ever used internally, but still change the password&amp;quot;&#xA;&#xA;#  If you also change the usernames (which might be sensible),&#xA;#  then remember to update the other occurances in this example config file to match.&#xA;&#xA;&#xA;&#xA;###############################################################################&#xA;#&#xA;#  ACCESS CONTROL&#xA;#&#xA;&#xA;                                                 #  system + hrSystem groups only&#xA;view   systemonly  included   .1.3.6.1.2.1.1&#xA;view   systemonly  included   .1.3.6.1.2.1.25.1&#xA;&#xA;                                                 #  Full access from the local host&#xA;#rocommunity public  localhost&#xA;                                                 #  Default access to basic system info&#xA; rocommunity public  default    -V systemonly&#xA;                                             #  rocommunity6 is for IPv6&#xA; rocommunity6 public  default   -V systemonly&#xA;&#xA;                                             #  Full access from an example network&#xA;                                             #     Adjust this network address to match your local&#xA;                                             #     settings, change the community string,&#xA;                                             #     and check the 'agentAddress' setting above&#xA;#rocommunity public  &#xA;#rocommunity public  Meta.local&#xA;                                             #  Full read-only access for SNMPv3&#xA; rouser   authOnlyUser&#xA;                                                 #  Full write access for encrypted requests&#xA;                                                 #     Remember to activate the 'createUser' lines above&#xA;#rwuser   authPrivUser   priv&#xA;&#xA;#  It's no longer typically necessary to use the full 'com2sec/group/access' configuration&#xA;#  r[ow]user and r[ow]community, together with suitable views, should cover most requirements&#xA;&#xA;&#xA;&#xA;###############################################################################&#xA;#&#xA;#  SYSTEM INFORMATION&#xA;#&#xA;&#xA;#  Note that setting these values here, results in the corresponding MIB objects being 'read-only'&#xA;#  See snmpd.conf(5) for more details&#xA;sysLocation    Sitting on the Dock of the Bay&#xA;sysContact     Me &amp;lt;me@example.org&amp;gt;&#xA;                                                 # Application + End-to-End layers&#xA;sysServices    72&#xA;&#xA;&#xA;#&#xA;#  Process Monitoring&#xA;#&#xA;                               # At least one  'mountd' process&#xA;proc  mountd&#xA;                               # No more than 4 'ntalkd' processes - 0 is OK&#xA;proc  ntalkd    4&#xA;                           # At least one 'sendmail' process, but no more than 10&#xA;proc  sendmail 10 1&#xA;&#xA;#  Walk the UCD-SNMP-MIB::prTable to see the resulting output&#xA;#  Note that this table will be empty if there are no &amp;quot;proc&amp;quot; entries in the snmpd.conf file&#xA;&#xA;&#xA;#&#xA;#  Disk Monitoring&#xA;#&#xA;                           # 10MBs required on root disk, 5% free on /var, 10% free on all other disks&#xA;disk       /     10000&#xA;disk       /var  5%&#xA;includeAllDisks  10%&#xA;&#xA;#  Walk the UCD-SNMP-MIB::dskTable to see the resulting output&#xA;#  Note that this table will be empty if there are no &amp;quot;disk&amp;quot; entries in the snmpd.conf file&#xA;&#xA;&#xA;#&#xA;#  System Load&#xA;#&#xA;                               # Unacceptable 1-, 5-, and 15-minute load averages&#xA;load   12 10 5&#xA;&#xA;#  Walk the UCD-SNMP-MIB::laTable to see the resulting output&#xA;#  Note that this table *will* be populated, even without a &amp;quot;load&amp;quot; entry in the snmpd.conf file&#xA;&#xA;&#xA;&#xA;###############################################################################&#xA;#&#xA;#  ACTIVE MONITORING&#xA;#&#xA;&#xA;                                #   send SNMPv1  traps&#xA; trapsink     localhost public&#xA;                                    #   send SNMPv2c traps&#xA;#trap2sink    localhost public&#xA;                                    #   send SNMPv2c INFORMs&#xA;#informsink   localhost public&#xA;&#xA;#  Note that you typically only want *one* of these three lines&#xA;#  Uncommenting two (or all three) will result in multiple copies of each notification.&#xA;&#xA;&#xA;#&#xA;#  Event MIB - automatically generate alerts&#xA;#&#xA;                                   # Remember to activate the 'createUser' lines above&#xA;iquerySecName   internalUser       &#xA;rouser          internalUser&#xA;                                   # generate traps on UCD error conditions&#xA;defaultMonitors          yes&#xA;                                   # generate traps on linkUp/Down&#xA;linkUpDownNotifications  yes&#xA;&#xA;&#xA;&#xA;###############################################################################&#xA;#&#xA;#  EXTENDING THE AGENT&#xA;#&#xA;&#xA;#&#xA;#  Arbitrary extension commands&#xA;#&#xA; extend    test1   /bin/echo  Hello, world!&#xA; extend-sh test2   echo Hello, world! ; echo Hi there ; exit 35&#xA;#extend-sh test3   /bin/sh /tmp/shtest&#xA;&#xA;#  Note that this last entry requires the script '/tmp/shtest' to be created first,&#xA;#    containing the same three shell commands, before the line is uncommented&#xA;&#xA;#  Walk the NET-SNMP-EXTEND-MIB tables (nsExtendConfigTable, nsExtendOutput1Table&#xA;#     and nsExtendOutput2Table) to see the resulting output&#xA;&#xA;#  Note that the &amp;quot;extend&amp;quot; directive supercedes the previous &amp;quot;exec&amp;quot; and &amp;quot;sh&amp;quot; directives&#xA;#  However, walking the UCD-SNMP-MIB::extTable should still returns the same output,&#xA;#     as well as the fuller results in the above tables.&#xA;&#xA;    &#xA;#&#xA;#  &amp;quot;Pass-through&amp;quot; MIB extension command&#xA;#&#xA;#pass .1.3.6.1.4.1.8072.2.255  /bin/sh       PREFIX/local/passtest&#xA;#pass .1.3.6.1.4.1.8072.2.255  /usr/bin/perl PREFIX/local/passtest.pl&#xA;&#xA;# Note that this requires one of the two 'passtest' scripts to be installed first,&#xA;#    before the appropriate line is uncommented.&#xA;# These scripts can be found in the 'local' directory of the source distribution,&#xA;#     and are not installed automatically.&#xA;&#xA;#  Walk the NET-SNMP-PASS-MIB::netSnmpPassExamples subtree to see the resulting output&#xA;&#xA;&#xA;#&#xA;#  AgentX Sub-agents&#xA;#&#xA;                                           #  Run as an AgentX master agent&#xA; master          agentx&#xA;                                           #  Listen for network connections (from localhost)&#xA;                                           #    rather than the default named socket /var/agentx/master&#xA;#agentXSocket    tcp:localhost:705&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;/etc/snmp/snmp.config&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;#  Listen for connections from the local system only&#xA;#agentAddress  udp:127.0.0.1:161&#xA;#  Listen for connections on all interfaces (both IPv4 *and* IPv6)&#xA;#agentAddress udp:161,udp6:[::1]:161&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Where is wrong?!&lt;/p&gt;&#xA;&lt;h1&gt;tnx&lt;/h1&gt;&#xA;" OwnerUserId="22692" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-05-03T02:05:30.660" Title="Linux UCD-SNMP-MIB no response" Tags="|snmp|linux|" AnswerCount="1" CommentCount="1" ClosedDate="2018-05-03T02:08:59.387" ContentLicense="CC BY-SA 3.0" />
  <row Id="28538" PostTypeId="1" CreationDate="2016-03-09T08:30:39.940" Score="1" ViewCount="93" Body="&lt;p&gt;this could be a really stupid question but i haven't found any solution on the internet. One of our customers owns a bunch of Cisco Catalys Switches and wants from us to review the configs. So he had sent me a lot of *.jar files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm common with reading running-configs from Cisco devices and in years of reviewing i have only seen these config files als plain text.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any possibility to extract the running config from that *.jar file? The files contain two merely two files, where my machine is saying these are executables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help!&lt;/p&gt;&#xA;" OwnerUserId="23565" LastActivityDate="2016-03-09T09:16:39.680" Title="Reading Catalyst 4500X / 2960 / etc. configuration" Tags="|switch|cisco-catalyst|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28539" PostTypeId="1" AcceptedAnswerId="28541" CreationDate="2016-03-09T09:13:08.573" Score="1" ViewCount="869" Body="&lt;p&gt;If all the areas learn routes to the other areas through Area 0, does it mean that two non-backbone areas cannot communicate with each other? What does ABR do then?&lt;/p&gt;&#xA;" OwnerUserId="23142" LastEditorUserId="8499" LastEditDate="2018-12-22T22:10:18.463" LastActivityDate="2018-12-22T22:10:18.463" Title="How is inter-area routing carried out in OSPF?" Tags="|routing|router|ospf|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28540" PostTypeId="2" ParentId="28538" CreationDate="2016-03-09T09:16:39.680" Score="2" Body="&lt;p&gt;These .jar files are probably configuration backups made with &lt;a href=&quot;http://www.cisco.com/c/en/us/products/cloud-systems-management/network-assistant/index.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Network Assistant&lt;/a&gt;. These files are compressed (zipped) with a java extention, but you can extract them with WinZip or WinRAR or any other decompression software of choice.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-03-09T09:16:39.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28541" PostTypeId="2" ParentId="28539" CreationDate="2016-03-09T09:31:31.853" Score="2" Body="&lt;p&gt;You are correct. Non-Area 0 areas cannot directly communicate; all inter-area traffic is through Area 0. An ABR is a router with one foot in in Area 0, and another foot in a different area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The one exception where you may have two non-Area 0 areas connected to each other involves a virtual link, but even then, the area not touching Area 0 must communicate using the virtual link to Area 0. This is not a recommended solution since traffic will not be direct between the two non-Area 0 areas, but it is available if there are no other options. It may also be used if you have a disconnected Area 0 to join the disconnected part of Area 0, but, again, this is not a recommended solution.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-09T09:41:09.607" LastActivityDate="2016-03-09T09:41:09.607" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28542" PostTypeId="1" AcceptedAnswerId="29370" CreationDate="2016-03-09T10:29:45.713" Score="2" ViewCount="1743" Body="&lt;p&gt;I tried to enable both LLDP and CDP from the web interface of my V1910 switch, but every time I select enable the session logs out. I found a command to enable the LLDP from the the switch's terminal. But I couldn't find the equivalent to enable the CDP compatibility. Any ideas to why I can't enable these two protocols from the web interface or how I can enable CDP from terminal?&lt;/p&gt;&#xA;" OwnerUserId="22889" LastEditorUserId="8499" LastEditDate="2016-03-09T11:08:28.433" LastActivityDate="2017-04-20T07:01:41.997" Title="Couldn't activate the CDP compatibility in the HP V1910 web interface" Tags="|switch|hp|lldp|cdp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28543" PostTypeId="2" ParentId="28542" CreationDate="2016-03-09T10:51:10.377" Score="0" Body="&lt;p&gt;From what I can glean from the user manual, HP considers CDP a mode of LLDP. The manual calls it &quot;the CDP compatibility of LLDP.&quot; You need to enable LLDP and CDP both globally and on the port.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;LLDP-CDP PDUs use only SNAP encapsulation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.manualslib.com/manual/633028/Hp-V1910.html?term=cdp&amp;amp;selected=1&amp;amp;page=239#manual&quot; rel=&quot;nofollow&quot;&gt;Here is the manual&lt;/a&gt;, and the bottom of page 239 and page 240 have the instructions.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-09T10:51:10.377" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28545" PostTypeId="2" ParentId="28537" CreationDate="2016-03-09T12:38:45.637" Score="1" Body="&lt;p&gt;If I read correctly your SNMPd config, you allow your &lt;code&gt;&quot;public&quot; community&lt;/code&gt; to read only the OID contained in the group &lt;code&gt;systemonly&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;view   systemonly  included   .1.3.6.1.2.1.1&#xA;view   systemonly  included   .1.3.6.1.2.1.25.1&#xA;&#xA;                                                 #  Full access from the local host&#xA;#rocommunity public  localhost&#xA;                                                 #  Default access to basic system info&#xA; rocommunity public  default    -V systemonly&#xA;                                             #  rocommunity6 is for IPv6&#xA; rocommunity6 public  default   -V systemonly&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It works with &lt;code&gt;MIB::sysUpTimeInstance&lt;/code&gt; because this OID is contained in the system MIB: &lt;code&gt;(iso(1) identified-organization(3) dod(6) internet(1) mgmt(2) mib-2(1) system(1) sysUpTime(3) sysUpTimeInstance(0))&lt;/code&gt; which correspond with the systemonly ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to read the UCD-SNMP-MIB::memAvailReal (OID:  .1.3.6.1.4.1.2021.4.6) which is contained in the private MIB, you must add this OID to the group &lt;code&gt;systemonly&lt;/code&gt;. Add this line :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;view   systemonly  included   .1.3.6.1.4.1.2021&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this line you will allow the &lt;code&gt;public community&lt;/code&gt; to read all the private MIB.&lt;/p&gt;&#xA;" OwnerUserId="19274" LastActivityDate="2016-03-09T12:38:45.637" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28547" PostTypeId="1" AcceptedAnswerId="28548" CreationDate="2016-03-09T13:54:56.430" Score="1" ViewCount="5747" Body="&lt;p&gt;Also explain when do we use this feature (Please explain for both VOIP &amp;amp; Traditional telephony system)? Why we use this feature? what problems shall we face if we don't use '9' before making outbound call? explain this in reference to North American Numbering Plan.&lt;/p&gt;&#xA;" OwnerUserId="17520" LastActivityDate="2020-12-29T23:12:46.010" Title="Why and when do we use digit '9' before making an outbound call?" Tags="|voip|voice|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28548" PostTypeId="2" ParentId="28547" CreationDate="2016-03-09T14:23:53.080" Score="5" Body="&lt;p&gt;In traditional &lt;strong&gt;public&lt;/strong&gt; telephony in USA exists the North American Numbering Plan that defines this:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;NPA&lt;/strong&gt;  (Numbering plan Area Code) 3 digits&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;NXX&lt;/strong&gt;  (Central Office) 3 digits&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;xxxx&lt;/strong&gt; (Subscriber Number) 4 digits&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;If you call whitin the same area code you don't need to dial it, so you can dial NXX-xxxx (&lt;em&gt;7 digits&lt;/em&gt;)&lt;/p&gt;&#xA;&lt;p&gt;If you call to another area code you need to dial it, so you have to dial NPA-NXX-xxxx (&lt;em&gt;10 digits&lt;/em&gt;).&lt;/p&gt;&#xA;&lt;p&gt;If you need to call to a foreign country you have to use the &lt;strong&gt;international prefix&lt;/strong&gt;: &lt;em&gt;011&lt;/em&gt; (for example: 011 + country code + number).&lt;/p&gt;&#xA;&lt;p&gt;In addition, the &lt;a href=&quot;https://www.nationalnanpa.com/number_resource_info/n11_codes.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;NANPA defines N11 codes&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;211  Community Information and Referral Services&lt;/li&gt;&#xA;&lt;li&gt;311  Non-Emergency Police and Other Governmental Services&lt;/li&gt;&#xA;&lt;li&gt;411  Local Directory Assistance&lt;/li&gt;&#xA;&lt;li&gt;511  Traffic and Transportation Information (US); Provision of Weather&#xA;and Traveller Information Services (Canada)&lt;/li&gt;&#xA;&lt;li&gt;611  Repair Service&lt;/li&gt;&#xA;&lt;li&gt;711  Telecommunications Relay Service (TRS)&lt;/li&gt;&#xA;&lt;li&gt;811  Access to One Call Services to Protect Pipeline and Utilities&#xA;from Excavation Damage (US); Non-Urgent Health Teletriage Services&#xA;(Canada)&lt;/li&gt;&#xA;&lt;li&gt;911  Emergency&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;The administrator of a &lt;strong&gt;private PBX&lt;/strong&gt; has a group of internal extensions with their own numeration. For example &lt;em&gt;[300-399 accounting]&lt;/em&gt;, &lt;em&gt;[400-499 sales]&lt;/em&gt;, &lt;em&gt;[800-899 management]&lt;/em&gt;, etc.&lt;/p&gt;&#xA;&lt;p&gt;To determine easily if an user is dialing to another extension or to an outside number a group of rules can be set in this way:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;User dials a number beginning with a number between 2 and 8 -&amp;gt; Internal call (connect directly to the number dialed).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Dial a number beginning with 9 -&amp;gt; External (ditch the '9' and send the rest of the numbers to the local telco).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;0 seems to be a good choice, however can be confusing because the &lt;strong&gt;international prefix&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;9 is a good choice. The only restrictions are:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;None of the extensions can begin with 9.&lt;/li&gt;&#xA;&lt;li&gt;There is not direct dialing of &lt;em&gt;911&lt;/em&gt;, people will need to dial &lt;em&gt;9911&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Modern PBXs can be set using rules by number length, so the rules can be modified to:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Dial 911 -&amp;gt; Emergency Call -&amp;gt; Send the call&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Dial a number beginning with 9 plus more than 2 digits -&amp;gt; External (ditch the '9' and send the rest of the numbers to the local telco).&lt;/p&gt;&#xA;&lt;p&gt;In that way, both numbers work (911 and 9911).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="8499" LastEditDate="2020-12-29T23:12:46.010" LastActivityDate="2020-12-29T23:12:46.010" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="28551" PostTypeId="1" CreationDate="2016-03-09T16:23:35.447" Score="1" ViewCount="851" Body="&lt;p&gt;I have a project which I'm struggling with and wondered if someone can offer some advise on the best way to achieve my goal (I'm new to Juniper).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment I have 2 juniper SRX240s, one connected a 100Mb fiber, and the other connected to 10 Mb EFM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to set them up to allow for automatic fail over from one ISP to the other. The idea is that if the main 100Mb goes down, the backup automatically kicks in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also need to setup 3 virtual routing instances, and two DMZs, with the idea that there is one instance for WAN, Internet, and VOIP traffic. Attached is a picture to help explain the setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The company wishes to use VRRP instead of a chassis cluster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've set it up VRRP, however, both routers are in a master state, and they are sending advertisements but not receiving. I suspect there is an issue with the security configuration, but I can't seem to find what it is. Would someone take a look to see when I'm going wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this stage, I want standard VRRP on the LAN side (172.16 range), then later on use VRRP route instance tracking for the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces ge-0/0/0 vlan-tagging&#xA;set interfaces ge-0/0/0 unit 126 description DMZ-1&#xA;set interfaces ge-0/0/0 unit 126 vlan-id 126&#xA;set interfaces ge-0/0/0 unit 126 family inet address 172.16.126.253/24&#xA;set interfaces ge-0/0/0 unit 137 description backup-mpls&#xA;set interfaces ge-0/0/0 unit 137 vlan-id 137&#xA;set interfaces ge-0/0/0 unit 346 vlan-id 346&#xA;set interfaces ge-0/0/0 unit 346 family inet address x.x.x.x/30&#xA;set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members vlan-trust&#xA;set interfaces ge-0/0/2 unit 0 family ethernet-switching vlan members vlan-trust&#xA;set interfaces ge-0/0/3 unit 0 family ethernet-switching vlan members vlan-trust&#xA;set interfaces ge-0/0/4 vlan-tagging&#xA;set interfaces ge-0/0/4 unit 20 description users-data&#xA;set interfaces ge-0/0/4 unit 20 vlan-id 20&#xA;set interfaces ge-0/0/4 unit 20 family inet address 172.16.93.253/24 vrrp-group 1 virtual-address 172.16.93.254&#xA;set interfaces ge-0/0/4 unit 20 family inet address 172.16.93.253/24 vrrp-group 1 priority 100&#xA;set interfaces ge-0/0/4 unit 20 family inet address 172.16.93.253/24 vrrp-group 1 accept-data trust&#xA;set interfaces ge-0/0/15 unit 0 family ethernet-switching vlan members vlan-trust&#xA;set interfaces vlan unit 0 family inet address 192.168.1.1/24&#xA;set protocols stp&#xA;set security screen ids-option untrust-screen icmp ping-death&#xA;set security screen ids-option untrust-screen ip source-route-option&#xA;set security screen ids-option untrust-screen ip tear-drop&#xA;set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024&#xA;set security screen ids-option untrust-screen tcp syn-flood attack-threshold 200&#xA;set security screen ids-option untrust-screen tcp syn-flood source-threshold 1024&#xA;set security screen ids-option untrust-screen tcp syn-flood destination-threshold 2048&#xA;set security screen ids-option untrust-screen tcp syn-flood timeout 20&#xA;set security screen ids-option untrust-screen tcp land&#xA;set security nat source rule-set trust-to-untrust from zone trust&#xA;set security nat source rule-set trust-to-untrust to zone untrust&#xA;set security nat source rule-set trust-to-untrust rule source-nat-rule match source-address 0.0.0.0/0&#xA;set security nat source rule-set trust-to-untrust rule source-nat-rule then source-nat interface&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any&#xA;set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit&#xA;set security zones security-zone trust host-inbound-traffic system-services all&#xA;set security zones security-zone trust host-inbound-traffic protocols all&#xA;set security zones security-zone trust host-inbound-traffic protocols vrrp&#xA;set security zones security-zone trust interfaces vlan.0&#xA;set security zones security-zone untrust screen untrust-screen&#xA;set security zones security-zone untrust interfaces ge-0/0/0.346 host-inbound-traffic system-services all&#xA;set security zones security-zone untrust interfaces ge-0/0/0.346 host-inbound-traffic protocols all&#xA;set security zones security-zone voip host-inbound-traffic system-services all&#xA;set security zones security-zone voip host-inbound-traffic protocols all&#xA;set security zones security-zone mpls host-inbound-traffic system-services all&#xA;set security zones security-zone mpls host-inbound-traffic protocols all&#xA;set routing-instances cce instance-type virtual-router&#xA;set routing-instances cce interface ge-0/0/4.20&#xA;set routing-instances internet instance-type virtual-router&#xA;set routing-instances internet interface ge-0/0/0.346&#xA;set routing-instances internet routing-options static route 0.0.0.0/0 next-hop x.x.x.141&#xA;set routing-instances voip instance-type virtual-router&#xA;set routing-instances voip interface ge-0/0/4.70&#xA;set vlans vlan-trust vlan-id 3&#xA;set vlans vlan-trust l3-interface vlan.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you can see what I’m missing that would be great.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/6nuBc.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6nuBc.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23169" LastEditorUserId="8499" LastEditDate="2016-03-09T21:11:37.420" LastActivityDate="2016-03-09T21:50:57.310" Title="VRRP dual ISP setup" Tags="|juniper|failover|vrrp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28556" PostTypeId="1" AcceptedAnswerId="28695" CreationDate="2016-03-09T17:42:20.320" Score="3" ViewCount="1984" Body="&lt;p&gt;My objective is to replace a Nortel 5520 stack with a stack of Cisco 2960s.&#xA;The old working configuration was using mlt trunk between 5520 and BNT layer 2/3 switch. I will use LACP for the trunk between the Cisco and BNT switches, and PVST is activated on the Cisco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GaonQ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GaonQ.jpg&quot; alt=&quot;schema&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make the configurations of all switches, I followed chapter 7.7 of this document : Nortel Networks L2/3 Ethernet Switch Module for IBM eServer BladeCenter (&lt;a href=&quot;https://lenovopress.com/redp3586.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://lenovopress.com/redp3586.pdf&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is that bld1 and bld2 aren’t reachable if both Gbesm are powered on, but if only one is up, the configuration is working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NBT switches :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* bc-io1          /**** bc-io2 is the same **** /&#xA;&amp;gt; /c/sys&#xA;&amp;gt;         hprompt ena&#xA;&amp;gt; /c/sys/access/user&#xA;&amp;gt;         admpw &quot;xxxxx&quot;&#xA;&amp;gt; /c/sys/ssnmp&#xA;&amp;gt;         name &quot;bc-io1&quot;&#xA;&amp;gt;         wcomm &quot;public&quot;&#xA;/c/port INT1                 &#xA;        pvid 11&#xA;&#xA;/**** INT1 ... INT14 are identical ****/&#xA;&#xA; /c/port INT14&#xA;        pvid 11&#xA;&#xA;/c/port EXT1&#xA;        dis&#xA;&#xA; /**** EXT1 ... EXT4 are identical, EXT5-6 not used ****/&#xA;&#xA;/c/port EXT6&#xA;        tag ena&#xA;        pvid 11&#xA;        tagpvid ena&#xA;/c/l2/bpdugrd ena&#xA;/c/l2/vlan 1&#xA;        def 0&#xA;/c/l2/vlan 10&#xA;        ena&#xA;        name &quot;Admin&quot;&#xA;        def INT1 INT2 INT3 INT4 INT5 INT6 INT7 INT8 INT9 INT10 INT11 INT12 INT13 INT14 EXT1 EXT2 EXT3 EXT4 EXT5 EXT6&#xA;/c/l2/vlan 11&#xA;        ena&#xA;        name &quot;PROD1&quot;&#xA;        def INT1 INT2 INT3 INT4 INT5 INT6 INT7 INT8 INT9 INT10 INT11 INT12 INT13 INT14 EXT1 EXT2 EXT3 EXT4 EXT5 EXT6&#xA;/c/l2/vlan 12&#xA;        ena&#xA;        name &quot;PROD2&quot;&#xA;        def INT1 INT2 INT3 INT4 INT5 INT6 INT7 INT8 INT9 INT10 INT11 INT12 INT13 INT14 EXT1 EXT2 EXT3 EXT4 EXT5 EXT6&#xA;/c/l2/stg 1/off&#xA;/c/l2/stg 1/port EXT1/off&#xA;/c/l2/stg 1/port EXT2/off&#xA;/c/l2/stg 1/port EXT3/off&#xA;/c/l2/stg 1/port EXT4/off&#xA;/c/l2/stg 10/clear&#xA;/c/l2/stg 10/brg/prior 65535&#xA;/c/l2/stg 10/add 10&#xA;/c/l2/stg 11/clear&#xA;/c/l2/stg 11/brg/prior 65535&#xA;/c/l2/stg 11/add 11&#xA;/c/l2/stg 12/clear&#xA;/c/l2/stg 12/brg/prior 65535&#xA;/c/l2/stg 12/add 12&#xA;/c/l2/lacp/port EXT1&#xA;        mode active&#xA;/c/l2/lacp/port EXT2&#xA;        mode active&#xA;        adminkey 17&#xA;/c/l2/lacp/port EXT3&#xA;        mode active&#xA;        adminkey 17&#xA;/c/l2/lacp/port EXT4&#xA;        mode active&#xA;        adminkey 17&#xA;/c/l3/frwd/off&#xA;&amp;gt;&amp;gt; bc-io1 - Configuration#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 13689 bytes&#xA;!&#xA;! Last configuration change at 15:11:18 UTC Wed Mar 9 2016 by manager&#xA;! NVRAM config last updated at 14:16:34 UTC Mon Mar 7 2016 by manager&#xA;!&#xA;version 15.0&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;service sequence-numbers&#xA;!&#xA;hostname sw-ipu-stk&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $$$$&#xA;!&#xA;username manager secret 5 $$$$$&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login default local&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;switch 1 provision ws-c2960s-24ts-l&#xA;switch 2 provision ws-c2960s-24ts-l&#xA;!&#xA;!&#xA;ip domain-name srs.net&#xA;udld aggressive&#xA;&#xA;!&#xA;mls qos map cos-dscp 0 8 16 24 32 46 46 56&#xA;mls qos srr-queue output cos-map queue 1 threshold 3 4 5&#xA;mls qos srr-queue output cos-map queue 2 threshold 1 2&#xA;mls qos srr-queue output cos-map queue 2 threshold 2 3&#xA;mls qos srr-queue output cos-map queue 2 threshold 3 6 7&#xA;mls qos srr-queue output cos-map queue 3 threshold 3 0&#xA;mls qos srr-queue output cos-map queue 4 threshold 3 1&#xA;mls qos srr-queue output dscp-map queue 1 threshold 3 32 33 40 41 42 43 44 45&#xA;mls qos srr-queue output dscp-map queue 1 threshold 3 46 47&#xA;mls qos srr-queue output dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23&#xA;mls qos srr-queue output dscp-map queue 2 threshold 1 26 27 28 29 30 31 34 35&#xA;mls qos srr-queue output dscp-map queue 2 threshold 1 36 37 38 39&#xA;mls qos srr-queue output dscp-map queue 2 threshold 2 24&#xA;mls qos srr-queue output dscp-map queue 2 threshold 3 48 49 50 51 52 53 54 55&#xA;mls qos srr-queue output dscp-map queue 2 threshold 3 56 57 58 59 60 61 62 63&#xA;mls qos srr-queue output dscp-map queue 3 threshold 3 0 1 2 3 4 5 6 7&#xA;mls qos srr-queue output dscp-map queue 4 threshold 1 8 9 11 13 15&#xA;mls qos srr-queue output dscp-map queue 4 threshold 2 10 12 14&#xA;mls qos queue-set output 1 threshold 1 100 100 50 200&#xA;mls qos queue-set output 1 threshold 2 125 125 100 400&#xA;mls qos queue-set output 1 threshold 3 100 100 100 400&#xA;mls qos queue-set output 1 threshold 4 60 150 50 200&#xA;mls qos queue-set output 1 buffers 15 25 40 20&#xA;mls qos&#xA;!&#xA;crypto pki trustpoint HTTPS_SS_CERT_KEYPAIR&#xA; enrollment selfsigned&#xA; serial-number&#xA; revocation-check none&#xA; rsakeypair HTTPS_SS_CERT_KEYPAIR&#xA;!&#xA;!&#xA;crypto pki certificate chain HTTPS_SS_CERT_KEYPAIR&#xA; ...&#xA; !&#xA;spanning-tree mode pvst&#xA;spanning-tree loopguard default&#xA;spanning-tree portfast bpduguard default&#xA;spanning-tree portfast bpdufilter default&#xA;spanning-tree extend system-id&#xA;spanning-tree vlan 10-12 priority 24576&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;errdisable recovery cause link-flap&#xA;errdisable recovery interval 60&#xA;port-channel load-balance dst-ip&#xA;!&#xA;!&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;ip ssh logging events&#xA;ip ssh version 2&#xA;lldp run&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;macro global description cisco-global&#xA;!&#xA;interface Port-channel1&#xA; description UP_BC1-IO1&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; storm-control broadcast level 5.00&#xA; spanning-tree bpdufilter enable&#xA;!&#xA;interface Port-channel2&#xA; description UP_BC2-IO2&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; storm-control broadcast level 5.00&#xA; spanning-tree bpdufilter enable&#xA;!&#xA;!&#xA;interface Port-channel5&#xA; description UP_sw-core&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 1,11&#xA; switchport mode trunk&#xA; storm-control broadcast level 5.00&#xA; spanning-tree bpdufilter enable&#xA;!&#xA;interface Port-channel6&#xA; description UP_sw-admin&#xA; switchport trunk native vlan 10&#xA; switchport trunk allowed vlan 10&#xA; switchport mode trunk&#xA; storm-control broadcast level 5.00&#xA;!&#xA;interface FastEthernet0&#xA; ip address 10.0.0.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description BC1-IO1-1&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; storm-control broadcast level 5.00&#xA; channel-group 1 mode active&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; description BC1-IO1-2&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; storm-control broadcast level 5.00&#xA; channel-group 1 mode active&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA; description BC1-IO2-1&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; shutdown&#xA; storm-control broadcast level 5.00&#xA; channel-protocol lacp&#xA; channel-group 2 mode active&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA; description BC1-IO2-2&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; shutdown&#xA; storm-control broadcast level 5.00&#xA; channel-protocol lacp&#xA; channel-group 2 mode active&#xA;!&#xA;interface GigabitEthernet1/0/5&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/6&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/7&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/8&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/9&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/10&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/11&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/12&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/13&#xA; description UP_sw-core&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 1,11&#xA; switchport mode trunk&#xA; storm-control broadcast level 5.00&#xA; channel-protocol lacp&#xA; channel-group 5 mode active&#xA;!&#xA;interface GigabitEthernet1/0/14&#xA; description UP_sw-core&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 1,11&#xA; switchport mode trunk&#xA; storm-control broadcast level 5.00&#xA; channel-protocol lacp&#xA; channel-group 5 mode active&#xA;!&#xA;interface GigabitEthernet1/0/15&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/16&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/17&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/18&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/19&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/20&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/21&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/22&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/23&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/24&#xA; description sw-adm-23&#xA; switchport trunk native vlan 10&#xA; switchport trunk allowed vlan 10&#xA; switchport mode trunk&#xA; storm-control broadcast level 5.00&#xA; channel-protocol lacp&#xA; channel-group 6 mode active&#xA;!&#xA;interface GigabitEthernet1/0/25&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/26&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/27&#xA;!&#xA;interface GigabitEthernet1/0/28&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/1&#xA; description BC1-IO2-1&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; storm-control broadcast level 5.00&#xA; channel-group 1 mode active&#xA;!&#xA;interface GigabitEthernet2/0/2&#xA; description BC1-IO2-2&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; storm-control broadcast level 5.00&#xA; channel-group 1 mode active&#xA;!&#xA;interface GigabitEthernet2/0/3&#xA; description BC1-IO2-3&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; shutdown&#xA; storm-control broadcast level 5.00&#xA; channel-protocol lacp&#xA; channel-group 2 mode active&#xA;!&#xA;interface GigabitEthernet2/0/4&#xA; description BC1-IO2-4&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; shutdown&#xA; storm-control broadcast level 5.00&#xA; channel-protocol lacp&#xA; channel-group 2 mode active&#xA;!&#xA;interface GigabitEthernet2/0/5&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/6&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/7&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/8&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/9&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/10&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/11&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/12&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/13&#xA; description UP_sw-core&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 1,11&#xA; switchport mode trunk&#xA; storm-control broadcast level 5.00&#xA; channel-protocol lacp&#xA; channel-group 5 mode active&#xA;!&#xA;interface GigabitEthernet2/0/14&#xA; description UP_sw-core&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 1,11&#xA; switchport mode trunk&#xA; storm-control broadcast level 5.00&#xA; channel-protocol lacp&#xA; channel-group 5 mode active&#xA;!&#xA;interface GigabitEthernet2/0/15&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/16&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/17&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/18&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/19&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/20&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/21&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/22&#xA;!&#xA;interface GigabitEthernet2/0/23&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/24&#xA; description sw-adm-24&#xA; switchport trunk native vlan 10&#xA; switchport trunk allowed vlan 10&#xA; switchport mode trunk&#xA; storm-control broadcast level 5.00&#xA; channel-protocol lacp&#xA; channel-group 6 mode active&#xA;!&#xA;interface GigabitEthernet2/0/25&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/26&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/27&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet2/0/28&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan10&#xA; ip address 172.1.2.250 255.255.255.0&#xA;!&#xA;ip default-gateway 172.1.2.254&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;!&#xA;snmp-server community public RO&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; length 0&#xA; transport preferred none&#xA; transport input ssh&#xA; transport output ssh&#xA;line vty 5 15&#xA; length 0&#xA; transport preferred none&#xA; transport input ssh&#xA; transport output ssh&#xA;!&#xA;ntp server 172.1.2.1&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you could help me with this configuration I would be graceful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some tests, I succeeded pinging a blade if only 1 of its eth interfaces is up, even if both inner switches are up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the pb seems to be concentrated inside the bladecenter between inner switches and blades. Yet, in the previous working configuration under redhat, this interfaces were bound with mode 6 (adaptive load balancing). It seems that I should change for mode 1 active-backup...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be a Broadcom driver pb (but I can't change it, I am stuck with this old redhat version) ?&lt;/p&gt;&#xA;" OwnerUserId="23573" LastEditorUserId="8499" LastEditDate="2016-05-14T16:47:31.937" LastActivityDate="2017-04-10T00:55:26.873" Title="LACP trunk between BNT layer2/3 switch and Cisco 2960s stack on a bladeCenter H" Tags="|cisco|vlan|spanning-tree|ieee-802.1ax|stacking|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28559" PostTypeId="2" ParentId="28551" CreationDate="2016-03-09T21:50:57.310" Score="1" Body="&lt;p&gt;From the looks of your config, &lt;code&gt;ge-0/0/4.20&lt;/code&gt; is not in the &lt;code&gt;trust&lt;/code&gt; security zone.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; set security zone security-zones trust interface ge-0/0/4.20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;should fix things and get your VRRP adjacency established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also need to remove the routing-instances if you want to policy between &lt;code&gt;trust&lt;/code&gt; and &lt;code&gt;untrust&lt;/code&gt; to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing-instances always 'seem' like the right answer for isolation, but they add a lot of unnecessary complexity.  Zones and policies work just fine.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-03-09T21:50:57.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28562" PostTypeId="1" CreationDate="2016-03-10T01:56:11.787" Score="1" ViewCount="414" Body="&lt;p&gt;I have a 3750x with TACACS AAA configured. If I login using TACACS, CLI commands run fine, no wait between commands. However, if I disconnect from network, taking away the ability to hit the tacacs server or I log in using local account (still disconnected from server), there is a 30 second CLI delay. I am assuming AAA is still trying to hit the TACACS server and is using a default timer. Below is a link to a user with similar issues. I read the 2 suggestions but am still unclear as to which direction I need to be looking. &#xA;Below is my relevant AAA: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tacacs-server host 10.x.x.x&#xA;tacacs-server host 10.x.x.x    &#xA;tacacs-server key......... &#xA;tacacs-server timeout 10&#xA;tacacs-server directed-request&#xA;&#xA;aaa new-model&#xA;aaa authentication login default group tacacs+ local&#xA;aaa authentication enable default group tacacs+ enable&#xA;aaa authorization console&#xA;aaa authorization config-commands&#xA;aaa authorization exec default group tacacs+ local&#xA;aaa authorization commands 1 default group tacacs+ if-authenticated &#xA;aaa authorization commands 15 default group tacacs+ if-authenticated&#xA;aaa accounting exec default start-stop group tacacs+&#xA;aaa accounting commands 1 default start-stop group tacacs+&#xA;aaa accounting commands 15 default start-stop group tacacs+&#xA;aaa accounting connection default start-stop group tacacs+&#xA;aaa accounting system default start-stop group tacacs+&#xA;aaa session-id common&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7639/aaa-authorization-timeout&quot;&gt;AAA Authorization Timeout&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23590" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-03-10T19:23:29.507" Title="AAA Authorization" Tags="|cli|aaa|cisco-3750|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28564" PostTypeId="1" CreationDate="2016-03-10T02:56:04.700" Score="1" ViewCount="855" Body="&lt;p&gt;On the Internet, there are many types of packets: VoIP, Audio, Video. As QoS is used to prioritize packets based on DSCP or VLAN priority. who set these bits for each and every packet. Like Audio gets DSCP 000111 (for example), Video gets DSCP 001100?&lt;/p&gt;&#xA;" OwnerUserId="23592" LastEditorUserId="8499" LastEditDate="2018-12-13T00:15:06.260" LastActivityDate="2018-12-13T00:15:06.260" Title="How packets get differentiated to prioritize?" Tags="|router|vlan|qos|dscp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28565" PostTypeId="2" ParentId="28564" CreationDate="2016-03-10T03:04:07.150" Score="1" Body="&lt;p&gt;An application may set the priorities, a switch may set the priorities, a router may set the priorities, or really any device through which your packets travel may set the priorities. Switches may even set layer-2 priorities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When designing your QoS policies, you need to determine the trust points. These would be the demarcation places where packets on one side have untrusted priorities. As the packets pass this point, they should be classified and marked. Generally, it is better to mark the packets as close to the source as possible so that they have correct markings for as long as they are in your network. Also, marking the packets on routers may cause an undue burden on the routers, driving up CPU utilization unacceptably. Marking on the switches, as traffic comes into a port or VLAN, is much less burdensome all the way around (the load is split among many access switches rather than a few routers), and it is very close to the source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which type of traffic gets which priority is also up to your QoS design. A very complex QoS design with many different priorities is not actually practical, and it is a big mistake people make when first setting up QoS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, your markings and QoS policies are only good inside your own network. Other networks, including your ISP, and any other ISPs through which your packets travel, will not honor your markings and QoS policies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN priority is something very different which has to do with root bridge selection in STP, but you can mark packet priorities based on which VLAN, among other criteria.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-10T03:36:54.667" LastActivityDate="2016-03-10T03:36:54.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28568" PostTypeId="1" AcceptedAnswerId="28572" CreationDate="2016-03-10T06:45:51.843" Score="2" ViewCount="6506" Body="&lt;p&gt;I understand is UDLD is almost BFD for layer2. Meaning in a control plane and forwarding plane separated router architecture BFD if running on the control plane can detect control plane failures but UDLD cannot be used for that purpose. Now when we use BFD in distributed mode, where forwarding plane takes care of bfd packets, would it be in different from UDLD ? Won't having UDLD and BFD configured together be redundant ?&lt;/p&gt;&#xA;" OwnerUserId="15656" LastActivityDate="2016-03-14T18:51:28.927" Title="What is the difference between UDLD and BFD?" Tags="|cisco|juniper|udld|bfd|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28570" PostTypeId="1" AcceptedAnswerId="28813" CreationDate="2016-03-09T20:03:03.240" Score="3" ViewCount="3236" Body="&lt;p&gt;Is it possible to map C-VLANs from single-tagged interface to S-VLANs on double-tagged interface while retaining capability for all customers to access the service on different tagged switch port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The figure below probably better illustrates what I'm trying to achieve here. I've been told by multiple people that this is not quite possible without secondary switch, but they couldn't really explain why. The switch in place is Cisco Nexus 3548, but I'd like know the opinion in general what are possibilities to do all this on a single machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tQEk4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tQEk4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5566" OwnerDisplayName="squirrely" LastActivityDate="2016-03-18T13:40:55.190" Title="VLAN mapping on double to single-tagged interface" Tags="|cisco|switch|vlan|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28571" PostTypeId="2" ParentId="19831" CreationDate="2016-03-10T11:45:04.213" Score="0" Body="&lt;p&gt;It might definitely work. But the  problem that arises when you are not configuring static IP's , then in that case /24 can assign 1.1.1.1, 1.1.1.2 as well and /23 can also assign the same - especially if you have same range in DNS/DHCP. so there could be potential IP conflicts that could arise &lt;/p&gt;&#xA;" OwnerUserId="23601" LastActivityDate="2016-03-10T11:45:04.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28572" PostTypeId="2" ParentId="28568" CreationDate="2016-03-10T13:26:46.540" Score="3" Body="&lt;p&gt;There's actually quite a significant difference between UDLD and BFD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDLD was mainly designed to prevent layer 2 bridging loops between directly connected devices, where a switch would put a port into the forwarding state, in the case of STP for example, when it stops receiving BPDUs due to a uni-directional link. To that end, it sends echo PDUs out the port and listens for replies. There may however be other cases where having UDLD is also beneficial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BFD is to detect a loss of bidirectional communications between routers that are not necessarily directly connected, to facilitate a quicker route reconvergence in case of neighbor failure by triggering a reconvergence regardless of EGP timers. BFD is session based and can for example be used on physical interfaces, tunnels, AToM xconnects and the like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDLD will place the interface into err-disabled shutdown where BFD won't. Therefore BFD will not stop STP loops from forming and not replace UDLD as such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information about UDLD:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10591-77.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10591-77.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information about BFD: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/fs_bfd.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_0s/feature/guide/fs_bfd.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23603" LastEditorUserId="23603" LastEditDate="2016-03-14T18:51:28.927" LastActivityDate="2016-03-14T18:51:28.927" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28573" PostTypeId="1" CreationDate="2016-03-10T13:47:09.207" Score="0" ViewCount="110" Body="&lt;p&gt;Default gateway of my hostel in college is not the router. Infact, its the server of my college which is 10.x.x.x. So is someone wants to connect to the router to change its setting how would someone do that if he/she doesnt know the address of the router?&#xA;Can anyone explain this as I am not able to grasp the concept of Default Gateway.&lt;/p&gt;&#xA;" OwnerUserId="23605" LastActivityDate="2016-03-10T15:52:13.260" Title="Default Gateway is the server not the router" Tags="|router|" AnswerCount="2" CommentCount="2" ClosedDate="2016-03-10T20:39:25.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="28574" PostTypeId="2" ParentId="28573" CreationDate="2016-03-10T14:02:30.083" Score="1" Body="&lt;p&gt;I will answer the part of the question that doesn't violate the posting guidelines; &quot;What is a default gateway?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A default gateway in networking is the device that &quot;knows&quot; where to forward traffic to. When your PC makes a request, that request is sent to the default gateway if the request is not bound for the local subnet; that default gateway then &quot;knows&quot; either by being programmed or by some routing protocol where to send your request. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server, or default gateway in your case is most likely a proxy to prevent or log your access of certain web based resources.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2016-03-10T14:02:30.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28576" PostTypeId="1" CreationDate="2016-03-10T14:50:39.080" Score="0" ViewCount="1170" Body="&lt;p&gt;I am running a ASA 5545 and I would like to throttle some outgoing traffic without dropping it, when it is bursting over a certain speed limit.&#xA;Has anyone been able to do this on ASA5545 ?&#xA;I am aware that some ASA have restricted capabilities regarding traffic shaping... The problem is that I cannot really test before asking... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="23608" LastActivityDate="2016-03-10T23:06:09.777" Title="Cisco ASA 5545 traffic shaping possibility?" Tags="|cisco-asa|firewall|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="28577" PostTypeId="2" ParentId="28576" CreationDate="2016-03-10T14:57:43.760" Score="0" Body="&lt;p&gt;You can use policy/class-maps to throttle and shape traffic. In the example below I am restricting traffic to 20 Mbps. After creating the policy I apply the map to the inside interface. Ignore the &quot;TCP-STATE-BYPASS&quot; part of the config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map 20_Mbps&#xA; match any&#xA;&#xA;policy-map inside_policy&#xA; class TCP-STATE-BYPASS&#xA;  set connection advanced-options tcp-state-bypass&#xA; class 20_Mbps&#xA;  police input 20980000&#xA;  police output 20980000&#xA;&#xA;service-policy inside_policy interface inside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4271" LastActivityDate="2016-03-10T14:57:43.760" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28579" PostTypeId="2" ParentId="28573" CreationDate="2016-03-10T15:52:13.260" Score="-2" Body="&lt;p&gt;A default gateway is a device connected to the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a device (PC, Tablet,etc.) needs to connect to an address outside the LAN, then sends the packets to the Default Gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Default Gateway is connected to other networks, so it is able to forward the packets outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case as a Default Gateway is a proxy server that &quot;maybe&quot; is filtering protocols (bittorrent, streaming) or destinations (adult content, gambling,etc.) before sending the packets to the real Default Gateway.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2016-03-10T15:52:13.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28582" PostTypeId="2" ParentId="24663" CreationDate="2016-03-10T18:20:38.543" Score="1" Body="&lt;p&gt;Configuring Multiple WAN Subnets Using Static ARP with SonicOS Enhanced (SW3726)&#xA;&lt;a href=&quot;https://support.software.dell.com/kb/sw3726&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw3726&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23615" LastActivityDate="2016-03-10T18:20:38.543" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28583" PostTypeId="2" ParentId="28562" CreationDate="2016-03-10T19:23:29.507" Score="2" Body="&lt;p&gt;Define the local group for the secondary AAA method for authorization, that way if the servers are down it'll use the local priv level for the user account (make sure it's set to 15 for full access) and continue from there.&lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2016-03-10T19:23:29.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28584" PostTypeId="2" ParentId="28576" CreationDate="2016-03-10T23:06:09.777" Score="2" Body="&lt;p&gt;Traffic shaping is not supported on the 5500-X series devices and the 5540 or below. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/82310-qos-voip-vpn.html#anc6&quot; rel=&quot;nofollow&quot;&gt;Reference&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2016-03-10T23:06:09.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28585" PostTypeId="1" CreationDate="2016-03-10T23:16:39.740" Score="3" ViewCount="612" Body="&lt;p&gt;I have a L3 3Com 5500G, and I'm trying to assign an outbound packet filtering on one GigabitEthernet, however, the only available feature is inbound.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="23618" LastEditorUserId="509" LastEditDate="2016-04-10T21:57:04.330" LastActivityDate="2019-04-26T22:00:40.947" Title="Outbound Packet-Filtering on 3Com 5500G" Tags="|acl|3-com|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28586" PostTypeId="2" ParentId="3854" CreationDate="2016-03-10T23:37:00.200" Score="2" Body="&lt;p&gt;First you must deny the packets from host 3 to host 1; then permit any thing else.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 deny ip host 192.168.1.51 host 192.168.1.34&#xA;access-list 101 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;however, if you want only to deny the ping, you must use icmp instead of ip in the deny part:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 deny icmp host 192.168.1.51 host 192.168.1.34 echo&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23618" LastEditorUserId="8499" LastEditDate="2016-03-11T01:21:36.613" LastActivityDate="2016-03-11T01:21:36.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28587" PostTypeId="2" ParentId="28499" CreationDate="2016-03-11T00:07:02.903" Score="3" Body="&lt;p&gt;So before the explanation you could configure a separate OSPF area (or possibly the second ospf process) that is purely for the DMVPN, that way the hub is the DR for that OSPF instance, you can initially make the cost higher to go over the DMVPN than adjust the cost when you're ready to cutover.&lt;/p&gt;&#xA;&lt;p&gt;Another solution could be to run EIGRP over the DMVPN instead since it's all Cisco equipment you don't really have to worry about interoperability, but seeing how you already run OSPF in your LAN you're probably much more comfortable and experienced with it.&lt;/p&gt;&#xA;&lt;p&gt;The only other option (I'm aware of at least) would be to a dual hub topology which may break some things since you you already have L2L tunnels to each site on one of the hubs, I've never had to attempt to configure this in tandem though so I'm unsure what the result would be. You may want to do this after the fact though anyways in order to have some redundancy should the DR go down.&lt;/p&gt;&#xA;&lt;p&gt;The reason that this needs to be configured this way is because the hub is what creates the NHRP mappings in between all the sites, with the nhrp multicast map each site sends it's updates to the hub and the hub then forwards it onto all the other spokes. The spokes learn of the routes in the NHRP 'cloud' but since the DR isn't part of that topology it has no way of sending updates through NHRP since the BDR doesn't send out updates until it becomes the DR, with no way to forward the updates there is no way to propagate the information needed for the spoke-to-spoke tunnels. Furthermore the spoke routers cannot form an adjacency with the DR making it since as defined in the RFC 2328 'On broadcast and NBMA networks, all routers become adjacent to both the designated router and the backup designated router' &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328#page-95&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reference Sec. 10.4&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Let me know if this helps or if you have any more questions!&lt;/p&gt;&#xA;" OwnerUserId="19171" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-11T00:07:02.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28588" PostTypeId="2" ParentId="28491" CreationDate="2016-03-11T00:32:51.983" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But I could literally not find a single 5GHz amplifier. Why is that? Am I just too stupid to find them or is it simply not possible to amplify 5Ghz in the same fashion for some reason? If so, why?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;On the very page you linked to, when I scrolled way down to the &quot;More Products&quot; section of the page, I found &lt;a href=&quot;http://www.aliexpress.com/item/5-8GHZ-5W-wifi-signal-booster-wireless-amplifier-broadband-signal-extender-router-stronger-FREE-SHIPPING/32297337537.html?spm=2114.10010108.100009.2.Y3Akhd&quot;&gt;this item&lt;/a&gt; which is similar to the product you linked. Granted, it is in a lot of 10, but I am sure a bit more searching on the site will produce single units.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But to answer more of the heart of your question, any signal can be amplified no matter the frequency. By stating that, I don't intend to simplify this issue as it is much more complex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Namely, 802.11 is two way communication. Boosting/amplifying the signal is generally done on the transmit side to increase the transmit power. However they are often designed not to amplify the the received power. Why? Because they would have to try to filter out the non-802.11 signals before amplifying the signal or they would simply amplify the noise as well. Since signal quality is what you are really after, boosting the signal and the noise an equal amount doesn't improve the signal quality at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Filtering out non-802.11 signals and other sources of interference is more complicated. So generally when you are using a signal amplifier, you are expected to use one on both sides. When you have two devices transmitting at significantly different power levels, you can experience a number of issues due to much lower data rates in one direction or complete lack of signal in one direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it has been mentioned, I must also point out that most areas of the world have some sort of organization/government body that oversees the use of the RF spectrum in their jurisdiction. Make sure you adhere to local laws as you may have legal/financial repercussions if you do not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, make sure whatever you are doing is &quot;friendly&quot; to any neighbors as well. If you affect others and they discover that it was your fault for impacting something they expect to have available to them, you never know how they will react. It's overly extreme, but people shoot other people for cutting them off on the expressway, and many would consider breaking their Internet access a worse offense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going beyond those issues, 802.11 design today is generally no longer as much about &quot;coverage&quot; as it is about &quot;capacity.&quot; Any sort of amplifier/extender/repeater gains an increase in coverage at the potential loss of capacity. The trend is lower power to produce more smaller &quot;cells&quot; to allow for more client devices and more bandwidth per device. Just because you can make a cell bigger, doesn't mean that you should. The demand for such devices is decreasing, so expect them to become rarer over time.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-03-11T00:32:51.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28589" PostTypeId="2" ParentId="20282" CreationDate="2016-03-11T01:40:43.283" Score="1" Body="&lt;p&gt;If you're OK with the workstation using a local IP address, and that getting translated to one of your static IP addresses at the SonicWALL, all you need to do is setup 1:1 NAT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://support.software.dell.com/kb/sw7979&quot; rel=&quot;nofollow&quot;&gt;UTM: SonicOS Enhanced how to configure NAT Policies (SW7979)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're basically just making two NAT rules, one for inbound to the spare IP address, and one for outbound from the local IP address.&lt;/p&gt;&#xA;" OwnerUserId="23620" LastEditorUserId="8499" LastEditDate="2016-03-11T01:57:59.943" LastActivityDate="2016-03-11T01:57:59.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28590" PostTypeId="2" ParentId="28585" CreationDate="2016-03-11T01:44:24.553" Score="1" Body="&lt;p&gt;You didn't detail what you have tried, but from what I find in the manual, &lt;a href=&quot;http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02583472-1.pdf&quot; rel=&quot;nofollow&quot;&gt;3Com SuperStack® 4 Switch 5500G-EI Family&#xA;Configuration Guide&lt;/a&gt;, Chapter 8, ACL Configuration, page 205, &lt;strong&gt;inbound&lt;/strong&gt; is the only ACL option:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;packet-filter inbound ip-group&lt;/strong&gt; &lt;em&gt;acl_number&lt;/em&gt; &lt;strong&gt;[ rule&lt;/strong&gt; &lt;em&gt;rule&lt;/em&gt; &lt;strong&gt;[ link-group&lt;/strong&gt; &lt;em&gt;acl_number&lt;/em&gt; &lt;strong&gt;rule&lt;/strong&gt; &lt;em&gt;rule&lt;/em&gt; &lt;strong&gt;] ]&lt;/strong&gt; | &lt;strong&gt;link-group&lt;/strong&gt; &lt;em&gt;acl_number&lt;/em&gt; &lt;strong&gt;[ rule&lt;/strong&gt; &lt;em&gt;rule&lt;/em&gt; &lt;strong&gt;] }&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-11T01:44:24.553" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28591" PostTypeId="1" AcceptedAnswerId="28592" CreationDate="2016-03-11T06:10:04.287" Score="2" ViewCount="70" Body="&lt;p&gt;I want to manage the DHCP of my Wi-Fi traffic from my wireless LAN controller.I don't have a VLAN. It is just that i am using single interface e.g., Management interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have assigned the DHCP pool from the DHCP scope option. I have kept the pool form 192.168.1.100 to 192.168.1.150. But every time I connect to the SSID of the controller, I am not getting an IP address from the pool, but I'm getting an IP address which is not indicated in the pool e.g., 192.168.1.7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to specify this scope somewhere in the interface or WLAN? Please help.&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="8499" LastEditDate="2016-03-11T06:24:40.553" LastActivityDate="2016-03-11T06:24:40.553" Title="DHCP in Wirelss LAN Controller" Tags="|vlan|wireless|dhcp|cisco-wlc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28592" PostTypeId="2" ParentId="28591" CreationDate="2016-03-11T06:21:05.117" Score="1" Body="&lt;p&gt;The controller just bridges the the Wi-Fi traffic; you get DHCP from a DHCP server, either on the LAN or on a different LAN with the aid of a helper address in the router port for the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You normally want to trunk multiple VLANs to a WLC: one for management, and one or more for Wi-Fi clients. These VLANs use one or more DHCP servers for any DHCP clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have twice asked this question in other ways. The answer remains the same, your WLC has nothing to do with DHCP. You need a DHCP controller for the VLAN of the Wi-Fi clients. I don't believe you have the grasp of networking necessary to accomplish this, and I &lt;em&gt;strongly&lt;/em&gt; suggest you hire a contractor with the expertise to do this.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-11T06:21:05.117" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28593" PostTypeId="1" CreationDate="2016-03-11T07:29:18.027" Score="1" ViewCount="33" Body="&lt;p&gt;I am setting up a small network for my office, I have a ZTE F660 router which is provided by my ISP and I am considering buying a couple of LINKSYS LAPAC1200 with POE access points. My question is, do I need my current router to support this feature? or I just plug it and it's working?&#xA;Do I need another devices to power my AP with POE?&lt;/p&gt;&#xA;" OwnerUserId="23624" LastEditorUserId="23624" LastEditDate="2016-03-11T07:37:27.757" LastActivityDate="2016-03-11T07:37:27.757" Title="Do I need a a special device to use an AP with POE with a home router?" Tags="|access-point|power-over-ethernet|" AnswerCount="0" CommentCount="1" ClosedDate="2016-03-11T08:02:35.723" ContentLicense="CC BY-SA 3.0" />
  <row Id="28597" PostTypeId="2" ParentId="28494" CreationDate="2016-03-11T11:51:57.633" Score="2" Body="&lt;p&gt;Don't know what DSL modem you're using, but you're probably better to make that DSL modem work in bridge mode and have your MikroTik router working as a normal WAN router facing WAN and LAN sides. That way you'll have no issues with VPN, be able to forward traffic as you like and set up a good firewall. This is very typical and good setup. And this is how I'd do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you haven't got enough control over your DSL modem, then sure, you can do chained NAT, forward everything to MT router or, as Benoit suggested, set up a DMZ feature. That way you'll still be able to bring the VPN tunnel up, but only as a client.&lt;/p&gt;&#xA;" OwnerUserId="5566" LastActivityDate="2016-03-11T11:51:57.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28600" PostTypeId="2" ParentId="23311" CreationDate="2016-03-11T13:12:24.270" Score="1" Body="&lt;p&gt;If you need use the Wi-Fi router as an AP for one SSID, disable DHCP (server and relay) on the Wi-Fi router and connect it to the switch by a LAN port of Wi-Fi Router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this setup, Wi-Fi clients get an IP address from the LAN DHCP (I assume it is the main router &quot;vigor&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then do QoS on the router based on different client IP addresses. It switches the Wi-Fi router to an AP (bridge) mode.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="8499" LastEditDate="2016-03-11T13:24:31.070" LastActivityDate="2016-03-11T13:24:31.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28602" PostTypeId="1" AcceptedAnswerId="28604" CreationDate="2016-03-11T15:45:14.660" Score="3" ViewCount="76" Body="&lt;p&gt;I'm designing a custom application, which needs a custom IP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to identify the traffic, I need an open protocol number, left for development.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In layer 2, I used the &lt;code&gt;0x88b5&lt;/code&gt; : &lt;em&gt;&quot;available for public use for prototype development&quot;&lt;/em&gt; (&lt;a href=&quot;http://standards-oui.ieee.org/ethertype/eth.txt&quot; rel=&quot;nofollow&quot; title=&quot;source&quot;&gt;source&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does such a protocol number exist for the IP layer ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched &lt;a href=&quot;http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&quot; rel=&quot;nofollow&quot; title=&quot;here&quot;&gt;IANA Protocol Registry&lt;/a&gt;, but wasn't able to find one.&lt;/p&gt;&#xA;" OwnerUserId="17011" LastEditorUserId="8499" LastEditDate="2016-03-11T16:09:47.370" LastActivityDate="2016-03-11T16:09:47.370" Title="IP Protocol left for development" Tags="|ip|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28604" PostTypeId="2" ParentId="28602" CreationDate="2016-03-11T16:02:45.917" Score="2" Body="&lt;p&gt;You should check the &lt;a href=&quot;http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&quot; rel=&quot;nofollow&quot;&gt;IANA Protocol Registry&lt;/a&gt;. It depends on what you want to do. For instance, protocol 61 or 63 may fit. You just need to study to see which one is for you.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-11T16:02:45.917" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28606" PostTypeId="1" AcceptedAnswerId="29611" CreationDate="2016-03-11T16:33:12.443" Score="3" ViewCount="860" Body="&lt;p&gt;In the &lt;a href=&quot;http://www.manualslib.com/manual/429481/Cisco-Spa509g.html?page=53&quot; rel=&quot;nofollow&quot;&gt;manual&lt;/a&gt; it says I have to create a 128x48 bmp image with 1-bit per pixel, but when i upload it to the phone, it merely displays a full black image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;creating the image with gimp, saving it as a 1-bit indexed bmp.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;convert input.bmp -colors 2 -type Bilevel -depth 1 output.bmp&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;the latter produces the following output when calling &lt;code&gt;identify output.bmp&lt;/code&gt;:&#xA;&lt;code&gt;output.bmp BMP 128x48 128x48+0+0 1-bit sRGB 2c 914B 0.000u 0:00.000&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which looks completely up to specs to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone tell what i'm doing wrong, or give me pointers to debug the problem.&lt;/p&gt;&#xA;" OwnerUserId="23636" LastActivityDate="2016-04-15T20:54:26.993" Title="How do I format an image for display on a Cisco SPA 303" Tags="|cisco|telephony|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28608" PostTypeId="1" AcceptedAnswerId="28609" CreationDate="2016-03-11T18:13:42.947" Score="3" ViewCount="819" Body="&lt;p&gt;Trying to Static NAT inside Web Server to allow access from outside (Network) client.  Not working so far.  I’m testing this in my Lab before putting to production, but still cannot bring up the web page.  I tried tracing via netflow, and to me it looks like data is being transferred back to client.  But I can’t get the page up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Equipment:&lt;/strong&gt;&#xA;- 2x2801 Cisco Router&#xA;- 1x3750 Cisco Router&#xA;- 1XMBA -&gt; client&#xA;- 1xMBP running VM Fusion Windows IIS as the web server.  Web server IP is 10.10.0.18&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I put the client and server on same network segment with no routers inbetween I can bring up the page on the client.  I can also get to the page via the host browser regardless of network configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1 -&gt; hostname e2911&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA;ip address 12.1.1.2 255.255.255.192&#xA;ip nat outside&#xA;ip nat enable&#xA;&#xA;interface FastEthernet0/1.11&#xA;description connection to Lab&#xA;encapsulation dot1Q 11&#xA;ip address 172.30.10.1 255.255.255.248&#xA;&#xA;ip nat inside source list 100 interface FastEthernet0/0 overload&#xA;ip nat inside source static tcp 10.10.0.18 8888 12.131.157.66 8888 extendable&#xA;ip route 0.0.0.0 0.0.0.0 fa0/0&#xA;ip route 10.10.0.0 255.255.0.0 172.30.10.3&#xA;ip route 172.18.10.0 255.255.255.0 172.18.10.5&#xA;!&#xA;access-list 100 permit ip 172.18.10.0 0.0.0.255 any&#xA;access-list 100 permit ip 172.30.10.0 0.0.0.255 any&#xA;access-list 100 permit ip 10.10.0.0 0.0.255.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SW -&gt; hostname 3750SW&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet1/0/2&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet1/0/3&#xA; switchport access vlan 11&#xA; switchport mode access&#xA;!&#xA;interface Vlan11&#xA; description Lab vlan&#xA; ip address 172.30.10.2 255.255.255.248&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 172.18.10.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2 -&gt; hostname lab&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address 10.10.0.1 10.10.0.20&#xA;!&#xA;ip dhcp pool LAB&#xA;   network 10.10.0.0 255.255.0.0&#xA;   default-router 10.10.0.1&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 172.30.10.3 255.255.255.248&#xA; ip flow monitor MONITOR-1 output&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA; !&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 10.10.0.1 255.255.0.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip nat inside source list 1 interface FastEthernet0/0 overload&#xA;ip route 0.0.0.0 0.0.0.0 172.30.10.1&#xA;!&#xA;access-list 1 permit 10.10.0.0 0.0.255.255&#xA;access-list 1 permit any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;WebServer:&lt;/strong&gt;&#xA;10.0.0.18&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Outside Client:&lt;/strong&gt;&#xA;12.1.1.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dropbox.com/s/4sixernn1sgd9ye/netflow_examples_web_help?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;netflow - trace excerpts&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6oALi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6oALi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23631" LastEditorUserId="3075" LastEditDate="2016-03-11T18:16:19.993" LastActivityDate="2016-03-11T20:41:31.480" Title="Unable to static NAT to internal Web Server" Tags="|cisco|nat|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28609" PostTypeId="2" ParentId="28608" CreationDate="2016-03-11T18:26:54.380" Score="1" Body="&lt;p&gt;Try removing the NAT commands from the lab router.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-11T18:26:54.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28610" PostTypeId="1" CreationDate="2016-03-11T20:27:19.060" Score="2" ViewCount="790" Body="&lt;p&gt;What I want is that only certain devices get remote access to my network.&#xA;I want to achieve this by using MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring this in my main router is not an option because it's too much work to add MAC addresses each time I personally want to connect something in my house.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what I though, is it maybe possible:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add a second router, switch off its DHCP. And use it as MAC address &quot;GATE&quot;?&#xA;Connect my server to that router, so if a device wants to connect its MAC address needs to be listed in my router. I can still connect personal devices to my main router and easy connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My story maybe sounds noob-ish, I am new to this.&lt;/p&gt;&#xA;" OwnerUserId="23639" LastEditorUserId="8499" LastEditDate="2016-03-11T20:58:11.040" LastActivityDate="2016-03-13T13:42:13.980" Title="Using router as remote door to gain access to LAN network" Tags="|router|mac-address|network-access|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28611" PostTypeId="2" ParentId="28610" CreationDate="2016-03-11T20:32:56.867" Score="2" Body="&lt;p&gt;IP packets only have layer-3 IP addresses, not MAC addresses. MAC addresses are layer-2 addresses, and they do not cross routers since routers strip off the layer-2 frame at each router hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will not see the MAC addresses from any remote sites.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-11T20:32:56.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28612" PostTypeId="2" ParentId="28608" CreationDate="2016-03-11T20:41:31.480" Score="0" Body="&lt;p&gt;NAT with an inside source means that the conversation needs to originate from inside (web server). I think you want to use inside destination to specifically let outside originated conversations get to the web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside destination NAT will also allow you to load share across multiple servers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-11T20:41:31.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28613" PostTypeId="2" ParentId="22247" CreationDate="2016-03-11T21:22:31.007" Score="1" Body="&lt;p&gt;If your only requirement is to just block users (intruders), you can simply write a couple of lines of EEM script.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the current state of the interface is up, the script would shutdown this interface when it goes down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the current state is down, the script would shutdown the port when it goes up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, the user calls to verify his identity and the &quot;no shut&quot; is applied on verification and demand.&lt;/p&gt;&#xA;" OwnerUserId="23618" LastActivityDate="2016-03-11T21:22:31.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28617" PostTypeId="1" AcceptedAnswerId="28620" CreationDate="2016-03-12T06:24:17.423" Score="1" ViewCount="553" Body="&lt;p&gt;What happend when send TCP packet with SYN + FIN flag set or another multi violating flag ?&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="23646" LastActivityDate="2016-03-12T09:35:08.007" Title="What happend when send TCP packet with SYN + FIN flag set or another multi violating flag?" Tags="|tcp|" AnswerCount="1" CommentCount="0" ClosedDate="2019-03-21T01:27:09.260" ContentLicense="CC BY-SA 3.0" />
  <row Id="28618" PostTypeId="2" ParentId="28568" CreationDate="2016-03-12T06:51:55.587" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the difference between UDLD and BFD?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;While both UDLD and BFD are designed to detect issues between devices, UDLD is a L2 mechanism and BFD is a L3 mechanism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDLD is designed to detect failure on a single L2 link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BFD is designed to detect failures in between two L3 peers. This can span more than a single L2 link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This leads us to your next question.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Won't having UDLD and BFD configured together be redundant ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In some cases yes, but in others no. You would have to evaluate your situation to determine this, keeping in mind that one is attempting to detect L2 failures, while the other is trying to detect L3 failures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's look at a concrete example. Consider two routers (R1 &amp;amp; R2) on the same network connected by fiber to a switch utilizing link aggregation on two ports each (R1/P1, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One day a single strand (R1/P1's transmit strand) has failed. R1/P1 is still able to receive from the switch so could believe the link to be up. Because R1 can believe R1/P1 to be up, it will send traffic to the switch on that port, which will be lost as the switch believes it to be down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the BFD session traffic is being carried on R1/P2, BFD may not detect the problem while UDLD would detect the L2 failure.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-03-12T06:51:55.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28619" PostTypeId="1" AcceptedAnswerId="28621" CreationDate="2016-03-12T09:13:54.597" Score="2" ViewCount="2255" Body="&lt;p&gt;I have a general question about where to put the DHCP and how it will work on subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if I have a topology as this one with an IP range of 172.33.0.0/22 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SULq6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SULq6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I would like to split the network in first two subnets one outside the&#xA;pfSense (for Network A/B) and one inside (Network C/D/E) to &lt;code&gt;172.33.0.0/23&lt;/code&gt; and &lt;code&gt;172.33.2.0/23&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then further divide the inside netowrk (C/D/E) into another subnet with unequal size to &lt;code&gt;172.33.2.0/24&lt;/code&gt;, &lt;code&gt;172.45.3.0/25&lt;/code&gt; and &lt;code&gt;172.45.3.128/25&lt;/code&gt;&#xA;I hope I calculated the subnets correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now my question where would I put the DHCP to perform the subnetting?&#xA;And also where would I put it if I'd like to split up the Network A/B in also 2 subnets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to configure one DHCP Server on the router to perform the division in two subnets first and then another one on the pfSense for the further division into the unequal subnets? &lt;/p&gt;&#xA;" OwnerUserId="23464" LastActivityDate="2016-03-12T14:28:48.453" Title="Where to put DHCP Server with subnets" Tags="|dhcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28620" PostTypeId="2" ParentId="28617" CreationDate="2016-03-12T09:35:08.007" Score="1" Body="&lt;p&gt;Many scanning tools use SYN FIN packets, because many intrusion detection systems did not catch these in the past,but now any system can safely assume that SYN FIN packets are malicious..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SYN FIN PSH&lt;/code&gt;, &lt;code&gt;SYN FIN RST&lt;/code&gt;, &lt;code&gt;SYN FIN RST PSH&lt;/code&gt; , and other variants on &lt;code&gt;SYN FIN&lt;/code&gt; also exist. These packets may be used by attackers who are aware that intrusion detection systems may be looking for packets with just the SYN and FIN bits set, Again, these are clearly malicious..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although The method to handle this flag combinations is not conveyed in the RFC of TCP so it's treated differently by OS ( each OS generate his own error response but the violation is always detected )&lt;/p&gt;&#xA;" OwnerUserId="14476" LastActivityDate="2016-03-12T09:35:08.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28621" PostTypeId="2" ParentId="28619" CreationDate="2016-03-12T14:04:25.403" Score="3" Body="&lt;p&gt;You should put your DHCP server on whatever network you put your infrastructure services for your clients, such as DNS, Active Directory, etc.  Assuming for example, you put it on network A, you configure the pfSense router to enable DHCP relay on Networks C, D, and E.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When clients broadcast a DHCP Discover message, the router will forward those packets as unicast to the DHCP server.  In essence the router relays the DHCP data between the clients and the DHCP server.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you separate A and B, you would configure &lt;code&gt;ip helper-address&lt;/code&gt; on the router interface on the B network.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-12T14:04:25.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28622" PostTypeId="2" ParentId="28619" CreationDate="2016-03-12T14:28:48.453" Score="1" Body="&lt;p&gt;Remember that DHCP does not do subnetting. You design your subnets, configure your routers to allow the different subnets to communicate, and finally add DHCP servers to distribute addresses to devices in those subnets. The DHCP server needs to be configured according to how you've done your subnetting of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can place DHCP servers wherever you like if you design redundancy appropriately : I run just a handful of DHCP servers for a corporate network of almost 2000 locations. The trick is setting up DHCP Relay functionality (aka ip helper in the Cisco world) so that a subnet without a local DHCP server can be served by a server elsewhere.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-03-12T14:28:48.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28624" PostTypeId="1" AcceptedAnswerId="28625" CreationDate="2016-03-12T18:04:46.953" Score="1" ViewCount="1505" Body="&lt;p&gt;Can you use SFP stacking with trunking?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have two Prosafe S3300-28x switches stacked using two SFP cables.  These switches also have two 10Gig ports, which we would like to connect to a separate Prosafe XS708E 10Gig switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea being that all the 10Gig traffic happens across the 10Gig switch, but it still has access to the rest of the network via the trunked 10Gig connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Diagram:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Prosafe S3300-28X -----10Gig trunk 1-----&#xA;    |      |                            |&#xA;   SFP    SFP                    Prosafe XS708E&#xA;    |      |                            |&#xA;Prosafe S3300-28X -----10Gig trunk 2-----&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each 1Gig host has a connection to each S3300, and each 10Gig host has a connection to the 10Gig switch as well as two connections to the S3300 stack.  Essentially, we are looking for complete redundancy on the 1Gig, not too fussed about the 10Gig, that's more of a nice-ty, but would still like it to work in case one of the S3300's dies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem we have is that it appears as if the 10Gig trunk 2 (when plugged in) causes a loop in the network, and one of the trunks promptly gets disabled.  What I want to know is how can I connect these three switches, with a trunk, to be a fail over?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our thought was that the trunking should handle the looping, but it seems like it doesn't.  Is there something else we should be doing instead of trunking?&lt;/p&gt;&#xA;" OwnerUserId="23658" LastEditorUserId="775" LastEditDate="2018-07-30T14:08:58.540" LastActivityDate="2018-07-30T14:08:58.540" Title="Netgear SFP and trunking between three switches" Tags="|spanning-tree|trunk|sfp|stacking|netgear-prosafe|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="28625" PostTypeId="2" ParentId="28624" CreationDate="2016-03-12T18:40:29.220" Score="2" Body="&lt;p&gt;What you are running into isn't a trunking problem. This behavior is what STP does in order to prevent loops. STP will create a loop-free layer-2 by sending BPDUs to determine the possible paths to the root bridge, and it selects one path and blocks the others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your switch stack is a true stack (appears to be a single switch), you should be able to use a LAG to fool STP into treating the two links as if they were one link. This will also balance traffic flows across the two links, and switch to the remaining link if one fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the &lt;a href=&quot;http://www.downloads.netgear.com/files/GDC/S3300/S3300_SWA_27Aug2014.pdf&quot; rel=&quot;nofollow&quot;&gt;Reference Manual&lt;/a&gt;, page 117:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Link Aggregation Groups&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Link aggregation groups (LAGs), which are also known as port channels,&#xA;  allow you to combine multiple full-duplex Ethernet links into a single&#xA;  logical link. Network devices treat the aggregation as if it were a&#xA;  single link, which increases fault tolerance and provides load&#xA;  sharing. You assign the LAG VLAN membership after you create a LAG.&#xA;  The LAG by default becomes a member of the default management VLAN&#xA;  (that is, VLAN 1).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A LAG interface can be either static or dynamic, but not both. All&#xA;  members of a LAG must participate in the same protocols. A static port&#xA;  channel interface does not require a partner system to be able to&#xA;  aggregate its member ports.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Static LAGs are supported. When a port is added to a LAG as a static&#xA;  member, it neither transmits nor receives LAGPDUs. The switch supports&#xA;  26 LAGs. The LAGs menu contains the links described in the following&#xA;  sections.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;LAG Configuration on page 117&lt;/li&gt;&#xA;  &lt;li&gt;LAG Membership on page 119&lt;/li&gt;&#xA;  &lt;li&gt;LACP Configuration on page 120&lt;/li&gt;&#xA;  &lt;li&gt;LACP Port Configuration on page 120&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-12T19:19:18.323" LastActivityDate="2016-03-12T19:19:18.323" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28627" PostTypeId="1" CreationDate="2016-03-13T05:09:04.433" Score="3" ViewCount="4240" Body="&lt;p&gt;I have Ruckus wireless configured and ready. It was working fine until last week, and now, all of a sudden, it is giving me problems with some clients.&#xA;I have assigned a pool of 50 IP addresses to the DHCP range, and there are hardly 20 clients who use the Wi-Fi at the same time. Yet some devices don't get an IP address and fail to join the WAP. Even if the device joins the WAP, it shows limited access and gives an IP address in the range of ``169.254.0.0/16. When I restart it, it works fine and every client can join the WAP.&lt;br&gt;&#xA;What could be the problem?&lt;br&gt;&#xA;I am using Ruckus R700 multimedia hotzone wireless AP. I am having problems with both 2.4G as well as 5G. I am getting the DHCP from my router/firewall. I have managed one of the AP to get the DHCP from the router/firewall and I have used other 6 APs to just bridge. In this bridged APs, I have disabled the DHCP. Some one told me about flushing the DHCP. Is there commands for that?&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="27121" LastEditDate="2016-06-13T06:41:27.413" LastActivityDate="2016-06-13T06:41:27.413" Title="Rukus wireless experiencing problem with DHCP" Tags="|wireless|dhcp|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="28633" PostTypeId="2" ParentId="11007" CreationDate="2016-03-13T13:06:56.830" Score="0" Body="&lt;p&gt;A media access control address (MAC address), also called physical address, is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used as a network address for most IEEE 802 network technologies, including Ethernet and WiFi. Logically, MAC addresses are used in the media access control protocol sublayer of the OSI reference model.&#xA;you can find more information about a media access control address on the website &lt;a href=&quot;http://wlan-wifi.com/mac-address&quot; rel=&quot;nofollow&quot;&gt;http://wlan-wifi.com/mac-address&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23672" LastActivityDate="2016-03-13T13:06:56.830" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28634" PostTypeId="1" AcceptedAnswerId="28642" CreationDate="2016-03-13T13:28:52.477" Score="5" ViewCount="1126" Body="&lt;p&gt;My first post in this forum! At my work place, we use VLANs to break out our network, and to keep network traffic segregated. I'm a little confused with our VLAN structure because I've had comments from contractors saying that we aren't using VLANs, and when I've asked other contractors on their thoughts, they have said its all fine and dandy! So my question to you guys, is this, considering the below example, are these VLANs?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.0/24&#xA;192.168.2.0/24&#xA;192.168.3.0/24&#xA;192.168.89.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The way I understand it, because the 3rd octet is different, these are VLANs, even though the subnet is the same at 255.255.255.0. Our switches are routing the traffic fine, and our router is routing traffic fine as well, which makes me believe we are right and these are indeed VLANs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like we have subnetted our network out rather than use VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer Ron's question, we have a Meraki firewall, which then feeds into a mixture of Dell and Cisco switches. On the Meraki firewall there is a page called 'Addressing and VLANs'. This is where we have our &quot;VLANs&quot; configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I used a class C network in my original post, but we use a class A network using a class B subnet. Our native VLAN is then 10.0.0.0/16.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On our Meraki firewall the VLANs are filled out as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN 2 - 10.2.0.0/16&#xA;VLAN 3 - 10.3.0.0/16&#xA;VLAN 4 - 10.4.0.0/16&#xA;VLAN 5 - 10.5.0.0/16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So what I understand from responses is that what I thought was VLANs are in fact subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default, the Meraki unit routes traffic between VLANs but rules have been created to stop this. Coming out of the Meraki unit, the port heading into our core switches (3 x stacked Dell PowerConnect switches) is set to a trunk port. The power connect then pipes the VLANs, via trunks, to other switches at our distribution layer, and then the distribution layer pipes the VLANs to the access layer, which then has ports in access mode. It might be worth noting at this point that we have a DHCP server on our main office LAN on our DC, and the other VLANs are served a DHCP address from the Meraki unit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So devices which we have on VLAN 2, e.g. IP cameras, can't be accessed from VLAN 3. So I imagine we are using subnets in place of VLANs. How would a VLAN look in this example? Would I use the subnet of 10.0.0.0/16 and that breaks out to VLANs? Would these VLANs then use the same IP address range of 10.0.0.0? I apologise if this is frustrating to answer. I've watched a fair few YouTube videos, but I'm not blessed with the best of brains and I end up more confused!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our VLANs on the Meraki unit look like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/OFQMb.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OFQMb.png&quot; alt=&quot;Screen Shot from our Meraki config page&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user23673" LastEditorDisplayName="user23673" LastEditDate="2016-03-13T22:57:13.497" LastActivityDate="2016-07-01T02:18:57.693" Title="VLAN Confirmation" Tags="|vlan|" AnswerCount="6" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28635" PostTypeId="2" ParentId="28624" CreationDate="2016-03-13T13:38:25.603" Score="0" Body="&lt;p&gt;I agree with Ron. The setup that you gave is very similar to what I've created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 3 Dell PowerConnect 5548 switches stacked using HDMI cables, and two Dell N3024 switches, which are in turn stacked using a QSFP cable. The two N3024 switches have a QSFP break out cable in each, which runs off to various other devices, but four of the cables connect back to the Dell PowerConnects with SFP+ cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using LACP, I've bonded the cables together, meaning the switches can use the entire bandwidth of 40Gbps. If a cable is accidentally removed or fails, then the LAG won't break, but of course the bandwidth goes down. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that helps!&lt;/p&gt;&#xA;" OwnerDisplayName="user23673" LastEditorUserId="8499" LastEditDate="2016-03-13T19:52:40.437" LastActivityDate="2016-03-13T19:52:40.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28637" PostTypeId="2" ParentId="28634" CreationDate="2016-03-13T13:43:52.187" Score="0" Body="&lt;p&gt;Though i am also new here, i recently got the chance to learn about VLANs. And by that i can say, when you have more than one subnet configured in a single switch then it should be VLAN.&#xA;To confirm about it why don't you telnet or ssh and do the show vlan command to make sure about the naming and the vlan number.Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="23114" LastActivityDate="2016-03-13T13:43:52.187" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28639" PostTypeId="2" ParentId="28634" CreationDate="2016-03-13T14:07:04.203" Score="0" Body="&lt;p&gt;Technically, those are separate subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VLAN is configured on your network hardware like a cisco switch. VLANs almost always contain separate subnets. You can configure your L3 switch to route between them for instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you describe are probably subents in different VLANs.&lt;/p&gt;&#xA;" OwnerUserId="18743" LastActivityDate="2016-03-13T14:07:04.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28641" PostTypeId="2" ParentId="28634" CreationDate="2016-03-13T15:45:11.293" Score="1" Body="&lt;p&gt;The example you provided list 3 different IP (layer 3 endpoint addresses) subnets. VLAN technology usually refers to a 802.1Q protocol with inserts a special tag in a layer 2 frame header.&#xA;So &quot;subnet&quot; and &quot;VLAN&quot; are usually independent terms. You may have a number of disparate subnets in a VLAN. You may have endpoints in the same subnet to be in different VLANs. This confusing situation is conventionally solved in a way that LANs are designed as every VLAN represents (combine, equal or whatever verd fits here) a separate subnet. &lt;/p&gt;&#xA;" OwnerUserId="17411" LastActivityDate="2016-03-13T15:45:11.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28642" PostTypeId="2" ParentId="28634" CreationDate="2016-03-13T16:05:06.357" Score="4" Body="&lt;p&gt;You are right, but for the wrong reasons.  I think you have some confusion about VLANs and subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, VLANs are layer 2 constructs and subnets are layer 3 constructs.  That means they can be completely independent of each other.  VLANS are configured on switches, which use MAC addresses for forwarding and do not understand IP addressing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnets are configured on routers, which use IP addressing for forwarding and do not understand MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it is very common to have one VLAN per subnet and vice versa, it is not necessary.  You can have multiple subnets on a VLAN and have the same subnet on multiple VLANs.  but I will admit, these are unusual cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the practice of using the third octet to determine the subnet/VLAN is also common, but again not necessary. As you learn IP addressing better, you will see why that is not always the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your additional information, you are in fact using VLANs.&#xA;As you show on the Meraki firewall, each VLAN has a subnet associated with it.  This is the normal way to do things.  So VLAN 2 has the subnet 10.2.0.0/16, and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bottom line:  Your network seems to be configured consistent with good practice.  Your confusion seems to be your misunderstanding of what the difference between subnets and VLANs are.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="8499" LastEditDate="2016-03-14T01:00:29.277" LastActivityDate="2016-03-14T01:00:29.277" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28644" PostTypeId="1" AcceptedAnswerId="28645" CreationDate="2016-03-13T18:53:20.160" Score="2" ViewCount="1378" Body="&lt;p&gt;I would like to replace a Gigaset SL400 with a Panasonic KX-TPA50. Both phones are  DECT. Since DECT is a standard, does that mean the new phone should just work with my current base station?&lt;/p&gt;&#xA;" OwnerUserId="23678" LastEditorUserId="8499" LastEditDate="2016-03-13T19:46:15.187" LastActivityDate="2016-03-13T19:47:32.530" Title="Are DECT cordless phones interchangeable?" Tags="|telephony|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28645" PostTypeId="2" ParentId="28644" CreationDate="2016-03-13T19:26:14.017" Score="2" Body="&lt;p&gt;DECT 6.0 is a standard, but many vendors' implementations are proprietary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://en.wikipedia.org/wiki/Digital_Enhanced_Cordless_Telecommunications#DECT_6.0&quot; rel=&quot;nofollow&quot;&gt;Digital Enhanced Cordless Telecommunications&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;DECT 6.0 products do not support &quot;GAP&quot;; therefore, phones of differing&#xA;  brands are not guaranteed to work together. For example, a GE 28105EE1&#xA;  DECT 6.0 headset will not receive calls if registered to a Uniden base&#xA;  unit.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also, the Panasonic model is a SIP phone, and I see no mention of SIP in the specifications of the Gigaset model.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-13T19:47:32.530" LastActivityDate="2016-03-13T19:47:32.530" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28646" PostTypeId="1" AcceptedAnswerId="28647" CreationDate="2016-03-13T19:52:07.547" Score="2" ViewCount="1009" Body="&lt;p&gt;I'd like to use WLAN Web authentication, but have no experience with it. I'd like to use such an authentication for staff members and external people, whereby the external people when logged are only permitted internet access. The staff on the other hand should also get access to specific internal servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to distinguish between two logged in users if they are either staff members or guests and then forward/redirect the traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the Cisco Web authentication on a WLC controller that has a lot of options, but I couldn't find anything regarding this specific requirement &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/115951-web-auth-wlc-guide-00.html&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone experience with such a device?&lt;/p&gt;&#xA;" OwnerUserId="23464" LastEditorUserId="8499" LastEditDate="2016-03-13T19:56:20.017" LastActivityDate="2016-03-13T20:13:56.407" Title="Access control with WLAN web authentication" Tags="|wlc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28647" PostTypeId="2" ParentId="28646" CreationDate="2016-03-13T20:05:42.860" Score="1" Body="&lt;p&gt;I think you are looking at this incorrectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, you would have multiple SSIDs, including one for guests. The VLAN for the guest SSID would only be allowed to be routed to the Internet, while other SSIDs would be on networks which have various internal access restrictions, or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often, 802.1X is used for such authentication, but there are other authentication methods, and Cisco WLCs support several (see &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wlan-security/82135-wlc-authenticate.html&quot; rel=&quot;nofollow&quot;&gt;Authentication on Wireless LAN Controllers Configuration Examples&lt;/a&gt;). A guest would only be able to be authenticated on the guest SSID since the guest credentials will not exist for the other SSIDs.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;Authentication on WLCs&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;The Cisco Unified Wireless Network (UWN) security solution bundles&#xA;  potentially complicated Layer 1, Layer 2, and Layer 3 802.11 Access&#xA;  Point (AP) security components into a simple policy manager that&#xA;  customizes system-wide security policies on a per-wireless LAN (WLAN)&#xA;  basis. The Cisco UWN security solution provides simple, unified, and&#xA;  systematic security management tools.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;These security mechanisms can be implemented on WLCs.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Layer 1 Solutions&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Restrict client access based on the number of consecutive failed&#xA;  attempts.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Layer 2 Solutions&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;None Authentication&lt;/strong&gt; —When this option is selected from the Layer 2 Security drop-down list, No Layer 2 authentication is performed on the&#xA;  WLAN. This is the same as the open authentication of the 802.11&#xA;  standard.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Static WEP&lt;/strong&gt; —With Static Wired Equivalent Privacy (WEP), all APs and client radio NICs on a particular WLAN must use the same&#xA;  encryption key. Each sending station encrypts the body of each frame&#xA;  with a WEP key before transmission, and the receiving station decrypts&#xA;  it using an identical key upon reception.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;802.1x&lt;/strong&gt; —Configures the WLAN to use the 802.1x based authentication. The use of IEEE 802.1X offers an effective framework&#xA;  in order to authenticate and control user traffic to a protected&#xA;  network, as well as dynamically vary encryption keys. 802.1X ties a&#xA;  protocol called Extensible Authentication Protocol (EAP) to both the&#xA;  wired and WLAN media and supports multiple authentication methods.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Static WEP + 802.1x&lt;/strong&gt; —This Layer 2 security setting enables both 802.1x and Static WEP. Clients can either use Static WEP or 802.1x authentication in order to connect to the network.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Wi-Fi Protected Access (WPA)&lt;/strong&gt; —WPA or WPA1 and WPA2 are standard-based security solutions from the Wi-Fi Alliance that provide&#xA;  data protection and access control for WLAN systems. WPA1 is&#xA;  compatible with the IEEE 802.11i standard but was implemented before&#xA;  the standard's ratification. WPA2 is the Wi-Fi Alliance's&#xA;  implementation of the ratified IEEE 802.11i standard.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;By default, WPA1 uses Temporal Key Integrity Protocol (TKIP) and&#xA;  message integrity check (MIC) for data protection. WPA2 uses the&#xA;  stronger Advanced Encryption Standard encryption algorithm using&#xA;  Counter Mode with Cipher Block Chaining Message Authentication Code&#xA;  Protocol (AES-CCMP). Both WPA1 and WPA2 use 802.1X for authenticated&#xA;  key management by default. However, these options are also available:&#xA;  PSK, CCKM, and CCKM+802.1x. If you select CCKM, Cisco only allows&#xA;  clients which support CCKM. If you select CCKM+802.1x, Cisco allows&#xA;  non-CCKM clients also.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;CKIP&lt;/strong&gt; —Cisco Key Integrity Protocol (CKIP) is a Cisco-proprietary security protocol for encrypting 802.11 media. CKIP improves 802.11&#xA;  security in infrastructure mode using key permutation, MIC, and&#xA;  message sequence number. Software release 4.0 supports CKIP with&#xA;  static key. For this feature to operate correctly, you must enable&#xA;  Aironet information elements (IEs) for the WLAN. The CKIP settings&#xA;  specified in a WLAN are mandatory for any client that attempts to&#xA;  associate. If the WLAN is configured for both CKIP key permutation and&#xA;  MMH MIC, the client must support both. If the WLAN is configured for&#xA;  only one of these features, the client must support only this CKIP&#xA;  feature. WLCs only support static CKIP (like static WEP). WLCs do not&#xA;  support CKIP with 802.1x (dynamic CKIP).&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Layer 3 Solutions&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;None&lt;/strong&gt;—When this option is selected from the Layer 3 security drop-down list, no Layer 3 authentication is performed on the WLAN.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; The configuration example for No Layer 3 authentication and No Layer 2 authentication is explained in the None Authentication&#xA;  section.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Web Policy (Web Authentication and Web Passthrough)&lt;/strong&gt; —Web authentication is typically used by customers who want to deploy a&#xA;  guest-access network. In a guest-access network, there is initial&#xA;  username and password authentication, but security is not required for&#xA;  the subsequent traffic. Typical deployments can include &quot;hot spot&quot;&#xA;  locations, such as T-Mobile or Starbucks.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Web authentication for the Cisco WLC is done locally. You create an&#xA;  interface and then associate a WLAN/service set identifier (SSID) with&#xA;  that interface.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Web authentication provides simple authentication without a supplicant&#xA;  or client. Keep in mind that web authentication does not provide data&#xA;  encryption. Web authentication is typically used as simple guest&#xA;  access for either a &quot;hot spot&quot; or campus atmosphere where the only&#xA;  concern is the connectivity.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Web passthrough is a solution through which wireless users are&#xA;  redirected to an acceptable usage policy page without having to&#xA;  authenticate when they connect to the Internet. This redirection is&#xA;  taken care of by the WLC itself. The only requirement is to configure&#xA;  the WLC for web passthrough, which is basically web authentication&#xA;  without having to enter any credentials.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;VPN Passthrough&lt;/strong&gt; —VPN Passthrough is a feature which allows a client to establish a tunnel only with a specific VPN server.&#xA;  Therefore, if you need to securely access the configured VPN server as&#xA;  well as another VPN server or the Internet, this is not possible with&#xA;  VPN Passthrough enabled on the controller.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-13T20:13:56.407" LastActivityDate="2016-03-13T20:13:56.407" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28648" PostTypeId="2" ParentId="28646" CreationDate="2016-03-13T20:09:27.703" Score="1" Body="&lt;p&gt;You can do this with Cisco ISE. The idea is that your users get assigned different guest types, and ISE will return an ACL name to the WLC depending on the guest type. You would then tune the ACL on the WLC to allow access to whatever resources are appropriate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nevertheless, I would tend to agree with Ron Maupin's answer, in that you probably want to separate categories that are as fundamentally different as staff and guests by using different SSIDs, and use the mechanism I described above only to differentiate guests (e.g. short-term and long-term guests, or guests vs staff BYOD devices...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also keep in mind that the configurations on ISE and the WLCs are not exactly intuitive, and are - to my eyes at least - prone to relatively subtle mistakes that can have serious security consequences.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-03-13T20:09:27.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28652" PostTypeId="1" CreationDate="2016-03-13T21:57:44.310" Score="2" ViewCount="217" Body="&lt;p&gt;I'm planning the network for my company's new office space. I'm not an expert so I'd like to present my plan and ask y'all nice folk to tell me if and where I'm making mistakes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assumptions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Office is 7500 sq feet on 2 floors with wood floors and almost completely open space other than a couple of walls (dry wall)&lt;/li&gt;&#xA;&lt;li&gt;We currently have 8 wired Computers, 3 wireless printers (that could be wired) 10 BYOD devices mostly mobile phones and 6 VOIP phones.&lt;/li&gt;&#xA;&lt;li&gt;All computers must back up to a Central NAS -8 disk Synology Mirrored RAID (I'd like to use this because we have it)&lt;/li&gt;&#xA;&lt;li&gt;All Wired computers must Share files Cross platform to Network attached file server. Which I have yet to buy.&lt;/li&gt;&#xA;&lt;li&gt;Only one section of workstations transfer large amounts of data to and from file server the rest is mostly to and from internet.&lt;/li&gt;&#xA;&lt;li&gt;Need multiple wireless networks Internal and guest.&lt;/li&gt;&#xA;&lt;li&gt;Work stations are mostly all Apple but need to be able to have cross platform access to file server.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My current plan:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Modem cisco provided by ISP&lt;/li&gt;&#xA;&lt;li&gt;Router Cisco with WLAN on to cover one end of building (Completely open warehouse space)&lt;/li&gt;&#xA;&lt;li&gt;Smart Switch Cisco SG200-24. &lt;/li&gt;&#xA;&lt;li&gt;Cisco Aironet 2800 Series Wireless AP to connect middle and other end of building both Up and Down stairs.&lt;/li&gt;&#xA;&lt;li&gt;Consumer grade AP probably a netgear router in AP mode for guest network&lt;/li&gt;&#xA;&lt;li&gt;All LANS connected to Switch.&lt;/li&gt;&#xA;&lt;li&gt;All VOIP connected to switch.&lt;/li&gt;&#xA;&lt;li&gt;NAS Backup connected to Switch&lt;/li&gt;&#xA;&lt;li&gt;File Server Connected to Switch&lt;/li&gt;&#xA;&lt;li&gt;Both APs Connected to switch - Create a VLAN for Netgear Guest WLAN to separate it from internal Network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For the wireless setup is the cisco 2800 overkill? And do I need a controller for that AP?&lt;/li&gt;&#xA;&lt;li&gt;Do I really need to assign network priority to the VOIP phones?&lt;/li&gt;&#xA;&lt;li&gt;I've read many documents on Trunking and still not sure about it. Is there an advantage to trunking the Switch to the Router?&lt;/li&gt;&#xA;&lt;li&gt;Do I need to setup a VLAN for the guest AP or can I connect the AP to the router instead and by doing so will that separate it from my internal Network?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23679" LastEditorUserId="8499" LastEditDate="2018-11-04T18:59:41.817" LastActivityDate="2018-11-04T18:59:41.817" Title="Building New Network and Need fast connection to central database between 20 wired and 20 wireless devices" Tags="|switch|router|wireless|ieee-802.11|best-practices|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28653" PostTypeId="2" ParentId="28652" CreationDate="2016-03-13T22:25:15.060" Score="1" Body="&lt;p&gt;If you want to do the Wi-Fi correctly, you need to perform a wireless site survey. I recommend you hire someone with expertise to perform this. The site survey will determine the number of WAPs, channels, radio power, sources of interference, and help to eliminate radio shadows. It will likely be the case that having the WAP built into the router is not optimal since router placement is constrained, which limits the WAP placement, and it can't be moved as necessary to respond to new sources of interference or other reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also need to make sure you don't exceed maximum cable lengths. Cable lengths will be (much) longer that a simple linear measurement. For instance, you need a 10' service loop at each end, and going up and down walls is often forgotten. The horizontal cable (solid-core) is limited to 90 meters, and you can have two 5 meter patch/workstation cables (stranded, one on each end).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to provide seamless Wi-Fi roaming you may want a WLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should probably check the legal problems you may create by allowing guest access to the Internet. Your company could be on the hook for bad things a guest user does from your network. Many companies now outsource this to a vendor which specializes in this to keep it all off the company network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trunking the layer-2 switch to a router is necessary if multiple VLANs are involved. You cannot get from one VLAN to another without going through a layer-3 device (router). A layer-3 switch can do it all internally because it has a router inside.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-13T22:25:15.060" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28655" PostTypeId="2" ParentId="28634" CreationDate="2016-03-13T22:59:37.463" Score="1" Body="&lt;p&gt;You are confusing two different things. VLANs and subnets (networks) are not mutually exclusive, and are almost always used together, one-to-one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your edit, it seems that you are, indeed, using VLANs, and you have a different network assigned to each VLAN. Trunks carry VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As several others have explained here, VLANs are a layer-2 construct. The ethernet frames, which encapsulate your IP packets, have the option of having a VLAN tag in the frame header to separate which frames are in which VLAN on a trunk. The IP addresses are in the layer-3 packet header which is encapsulated in the layer-2 frame. The two concepts have nothing to do with each other, except that it is an almost universal practice to have each layer-3 network use a different layer-2 VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should learn about the &lt;a href=&quot;https://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow&quot;&gt;OSI model&lt;/a&gt;. Understand that it is just a model, and the real world doesn't always match, but it is useful to understand it since the first four layers match networking pretty well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also classful networking is dead, and it has been since 1995, killed by CIDR and VLSM. You can forget the Class A/B/C stuff in your network since you are using CIDR and VLSM.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-13T22:59:37.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28656" PostTypeId="1" AcceptedAnswerId="28658" CreationDate="2016-03-14T01:04:28.010" Score="2" ViewCount="433" Body="&lt;p&gt;As we know, RSTP merges &quot;disabled&quot;, &quot;blocking&quot;, &quot;listening&quot; states of STP into one &quot;discarding&quot; state. However, when a port is linked down, let's say no physical link on the port, is there still a state inside it? If it has, is it in &quot;disabled&quot; state or &quot;discarding&quot; state?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because in some switch's configuration page, I can only see ports in &quot;disabled&quot; state when they are linked down, so I'm confused with its state.&lt;/p&gt;&#xA;" OwnerUserId="22930" LastActivityDate="2016-03-14T01:45:30.527" Title="In RSTP, does port have a state when there is no link on it?" Tags="|spanning-tree|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28657" PostTypeId="1" AcceptedAnswerId="28671" CreationDate="2016-03-14T01:08:56.750" Score="2" ViewCount="2613" Body="&lt;p&gt;I am trying to read about RTAG7 hashing in ASICs. I am unable to find good literature on it. Can someone please explain what is the RTAG7 hash?&lt;/p&gt;&#xA;" OwnerUserId="23687" LastActivityDate="2016-04-13T17:03:45.157" Title="What is RTAG7 hash" Tags="|juniper|network-core|asics|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28658" PostTypeId="2" ParentId="28656" CreationDate="2016-03-14T01:45:30.527" Score="2" Body="&lt;p&gt;A port which is down, either manually disabled, or down due to no link protocol, doesn't play a part in STP or RSTP, so there is no STP or RSTP state. When a port comes up is when STP or RSTP will take notice of it and perform the proper STP calculations on it, assigning a state to the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some documentation assigns such a port a state of &quot;Disabled,&quot; but that is a port role rather than an STP state. Cisco claims that RSTP rolls this into the Discarding state, but since the switch will never try to send any frames to the port, it isn't really Discarding.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-14T01:45:30.527" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28663" PostTypeId="1" AcceptedAnswerId="28664" CreationDate="2016-03-14T12:04:38.403" Score="4" ViewCount="1627" Body="&lt;p&gt;I am studying OSPF, and It seems to me that totally stub areas just saves the day. Why do we need stub areas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be more clear, as I read, I understand that OSPF areas designed as star topology, so there is one backbone area, and the other areas. So other areas connected to backbone area thru an ABR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I define that area as stub, how are the type 3 LSAs coming from backbone used, because there is only one connection to backbone area (a complete default route is enough indeed)?. In other words, can you give me a sample topology, that I should define the area as stub, but not totally stub?&lt;/p&gt;&#xA;" OwnerUserId="23700" LastEditorUserId="8499" LastEditDate="2016-03-14T12:16:47.247" LastActivityDate="2016-03-14T12:32:17.097" Title="Stub Vs Totally Stub Areas ın OSPF" Tags="|routing|ospf|stub|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28664" PostTypeId="2" ParentId="28663" CreationDate="2016-03-14T12:24:27.410" Score="3" Body="&lt;p&gt;You can have multiple ABRs which connect an area to Area 0. With a stub area, a router in the area could choose the best ABR in the path to the destination, but with a totally stubby area, it will just choose the nearest ABR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, if you have two ABRs for your area (Area 1), each ABR will have, at least Area 0 and Area 1 interfaces, but one of them could also have an Area 2 interface, or it could be directly connected to an Area 2 ABR with a low cost, but the other ABR would have a higher cost to get to Area 2. It would make sense, when sending traffic to Area 2, to send it to the ABR with the lowest cost to Area 2, but a totally stubby area doesn't know how to do that.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-14T12:32:17.097" LastActivityDate="2016-03-14T12:32:17.097" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28666" PostTypeId="2" ParentId="28627" CreationDate="2016-03-14T14:15:32.330" Score="3" Body="&lt;p&gt;Solved: Finally i got where i was wrong. Actually, Ruckus by default, on standalone mode has the dhcp lease of 8 hours and that could have caused the problem. So what i did, with the help of technical support, is that i decreased the lease to 4 hours . Previously, i had the dhcp scope of 50 hosts and i increased the range to 100. Now the device is working fine. The command to decrease dhcp lease is :&quot;set dhcps leasetime 14400&quot;. There is no way to change dhcp lease time from gui in standalone mode&lt;/p&gt;&#xA;" OwnerUserId="23114" LastActivityDate="2016-03-14T14:15:32.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28667" PostTypeId="1" AcceptedAnswerId="32203" CreationDate="2016-03-14T15:08:36.973" Score="3" ViewCount="17592" Body="&lt;p&gt;I have HP 5500 L3 switch. I wanted to delete the particular port configuration and wanted to reconfigure it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the command set is different from Cisco, can anyone help me?&lt;/p&gt;&#xA;" OwnerUserId="22728" LastEditorUserId="36720" LastEditDate="2020-01-02T13:59:49.060" LastActivityDate="2021-08-27T09:27:44.247" Title="How can I delete the L3 switch port configuration?" Tags="|hp|hp-comware|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28668" PostTypeId="1" CreationDate="2016-03-14T15:26:17.330" Score="4" ViewCount="1839" Body="&lt;p&gt;Given a non-PTP switch (e.g. no hardware support for time stamping), how can one make it to be as close as possible to a PTP compliant switch. I am thinking here to configure the switch such that the PTP traffic has the highest priority (which is kind of super basic configuration). Can you please suggest other possible configurations? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I am aware that in general such configurations are hardware dependent given the switch capabilities. Therefore I am looking for all kind of crazy options.&lt;/p&gt;&#xA;" OwnerUserId="23702" LastEditorUserId="8499" LastEditDate="2016-03-14T15:40:15.260" LastActivityDate="2017-12-17T06:29:27.993" Title="Non-PTP compliant switch" Tags="|switch|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28669" PostTypeId="2" ParentId="28667" CreationDate="2016-03-14T15:53:57.763" Score="0" Body="&lt;p&gt;actually I've got HP switches 2600 series and after writing &quot;erase&quot; and clicking &quot;tab&quot; button I see choices which I can make: erase config, flash, or start-up config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But to erase configuration for only one port what about deleting this port (if it's logical only) and write setting again? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I don't understand why you cannot try specific commands which you would like to erase with &quot;no&quot; commands: like &#xA;&quot;no ip address&quot;&#xA;or &#xA;&quot;no auto-detect&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last method is most common.&#xA;Unfortunnatelly no L3 swtich is close to me.&lt;/p&gt;&#xA;" OwnerUserId="17499" LastActivityDate="2016-03-14T15:53:57.763" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28670" PostTypeId="2" ParentId="28668" CreationDate="2016-03-14T16:01:58.107" Score="0" Body="&lt;p&gt;Since you are referring to a switch which doesn't recognize PTP, you are probably safe to assume the switch will not negotiate unicast PTP packets. The switch will also ignore the link multicast PTP packets. The other multicast packets have special multicast addresses, and special treatment could be given based on those addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, switches don't look beyond the ethernet frame into the IP packet, so it may not be able to be done on some switches, but the switch could mark the frames and packets with specific COS and DSCP. Some switches can give some priority based on COS, but the queues are pretty small.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-14T16:01:58.107" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="28671" PostTypeId="2" ParentId="28657" CreationDate="2016-03-14T17:00:19.487" Score="3" Body="&lt;p&gt;It is an enhanced hashing. This hashing technique takes into account multiple packet parameters like SRC IP , DST IP, SRC Mac etc instead of only SRC Mac or SRC IP etc&lt;/p&gt;&#xA;" OwnerUserId="23707" LastActivityDate="2016-03-14T17:00:19.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28672" PostTypeId="2" ParentId="10685" CreationDate="2016-03-14T17:54:07.443" Score="2" Body="&lt;p&gt;You will have used the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ca enroll TP-NAME&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where TP-NAME is the name of your trustpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All you will need to do now is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ca import TP-NAME certificate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where TP-NAME is the same as the one you used for creating the CSR (using the enroll command)&lt;/p&gt;&#xA;" OwnerUserId="23705" LastEditorUserId="8499" LastEditDate="2016-03-14T17:57:14.250" LastActivityDate="2016-03-14T17:57:14.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28674" PostTypeId="1" AcceptedAnswerId="28680" CreationDate="2016-03-14T18:51:55.147" Score="1" ViewCount="2317" Body="&lt;p&gt;I am trying to setup a site to site VPN tunnel, between two networks, one with a Sophos UTM, the other a Cisco 5515X.&#xA;The ASA side of the tunnel is configured with a public peer, private address subnet (192.168.71.0) while the Sophos side is compelled to use the same IP address as tunnel peer and host (3.3.3.50 - this is a fake address.)&#xA;Tunnel is up, I can see traffic passing through it from the Sophos UTM's network, but there is nothing coming back out from the Cisco side.&#xA;This is my first time having to configure an ASA for this, and I am completely stumped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please can someone tell me what I am missing? My Cisco ASA configuration is below. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac &#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto map REMOTE2LOCAL 1 match address REMOTE_to_LOCAL&#xA;crypto map REMOTE2LOCAL 1 set pfs &#xA;crypto map REMOTE2LOCAL 1 set peer 3.3.3.50 &#xA;crypto map REMOTE2LOCAL 1 set ikev1 transform-set REMOTE_LOCAL&#xA;crypto map REMOTE2LOCAL interface outside&#xA;crypto ca trustpool policy&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 policy 10&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash md5&#xA; group 2&#xA; lifetime 86400&#xA;&#xA;crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac&#xA;&#xA;object network mgmt71vpn&#xA; subnet 192.168.71.0 255.255.255.0&#xA;object network REMOTE.50&#xA; host 3.3.3.50&#xA;&#xA;nat (inside,outside) source static mgmt71vpn mgmt71vpn destination static REMOTE.50 REMOTE.50 no-proxy-arp route-lookup&#xA;access-list REMOTE_to_LOCAL extended permit ip object mgmt71vpn object REMOTE.50 &#xA;access-list outside_in extended permit ip host 3.3.3.50 192.168.71.0 255.255.255.0&#xA;access-group outside_in in interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="23709" LastActivityDate="2016-03-14T19:59:26.560" Title="Cisco ASA - Sophos UTM Site to Site VPN No response from other network" Tags="|cisco-asa|vpn|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28675" PostTypeId="2" ParentId="28667" CreationDate="2016-03-14T18:58:11.570" Score="0" Body="&lt;p&gt;Try &quot;Undo&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;for example: while in the Gigabitethernet interface# Undo port access&lt;/p&gt;&#xA;" OwnerUserId="23618" LastActivityDate="2016-03-14T18:58:11.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28677" PostTypeId="2" ParentId="28499" CreationDate="2016-03-14T19:40:39.303" Score="0" Body="&lt;p&gt;Thank you for the input, Fallacy!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We ended up (which now seems obvious in hindsight) creating a separate area for the DMVPN network. All spokes are properly seeing our newly implemented router as the DR and NHRP is working as intended.&lt;/p&gt;&#xA;" OwnerUserId="14166" LastActivityDate="2016-03-14T19:40:39.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28678" PostTypeId="1" AcceptedAnswerId="28681" CreationDate="2016-03-14T19:48:05.453" Score="2" ViewCount="2404" Body="&lt;p&gt;So I've been tasked with creating a topology map of the network, but on some devices I find that CDP is either not an option, or has been explicitly disabled.  How can I find neighbors in these situations?  I know I can use LLDP or SNMP, but I'm not sure HOW to use those commands to find neighbors.&lt;/p&gt;&#xA;" OwnerUserId="23048" LastActivityDate="2017-03-29T14:39:36.717" Title="Finding neighbors when CDP is disabled" Tags="|cisco|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28679" PostTypeId="2" ParentId="28678" CreationDate="2016-03-14T19:54:02.053" Score="0" Body="&lt;p&gt;If you enable LLDP on the devices which support it, you basically use it the same way as CDP on Cisco devices. How it is enabled or used on other devices is dependent on the device make/model/software version.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-14T19:54:02.053" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28680" PostTypeId="2" ParentId="28674" CreationDate="2016-03-14T19:59:26.560" Score="1" Body="&lt;p&gt;Here's the configuration for the ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route outside 192.168.26.50 255.255.255.255 &amp;lt;default gateway IP address&amp;gt;&#xA;&#xA;crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac &#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto map REMOTE2LOCAL 1 match address REMOTE_to_LOCAL&#xA;crypto map REMOTE2LOCAL 1 set pfs &#xA;crypto map REMOTE2LOCAL 1 set peer 3.3.3.50 &#xA;crypto map REMOTE2LOCAL 1 set ikev1 transform-set REMOTE_LOCAL&#xA;crypto map REMOTE2LOCAL interface outside&#xA;crypto ca trustpool policy&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 policy 10&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash md5&#xA; group 2&#xA; lifetime 86400&#xA;&#xA;crypto ipsec ikev1 transform-set REMOTE_LOCAL esp-3des esp-md5-hmac&#xA;&#xA;object network mgmt71vpn&#xA; subnet 192.168.71.0 255.255.255.0&#xA;object network REMOTE.50&#xA; host 192.168.26.50&#xA;&#xA;nat (inside,outside) source static mgmt71vpn mgmt71vpn destination static REMOTE.50 REMOTE.50&#xA;access-list REMOTE_to_LOCAL extended permit ip object mgmt71vpn object REMOTE.50 &#xA;access-list outside_in extended permit ip host 192.168.26.50 192.168.71.0 255.255.255.0&#xA;access-group outside_in in interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then on the Sophos box NAT your protected subnets to the 192.168.26.50 address when destined to the 192.168.71.0/24 network. Let me know if you have any issues with that or if you need more help.&lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2016-03-14T19:59:26.560" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28681" PostTypeId="2" ParentId="28678" CreationDate="2016-03-14T20:03:22.850" Score="4" Body="&lt;p&gt;LLDP works just like CDP. So instead of &lt;code&gt;show cdp neig&lt;/code&gt; you use &lt;code&gt;show lldp neig&lt;/code&gt;. But chances are good that LLDP is disabled as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without CDP, LLDP or physical access (following the cables) you'll have rely on the device configuration. Temporarily enabling one or both protocols is out of the option? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;sh mac-address-table&lt;/code&gt; and &lt;code&gt;show arp&lt;/code&gt; you are able to see the device manufacture connected to a port. This might help to map your network but will take a lot of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can to all those things either via the command line or using SNMP (best for writing scripts to do the discovery for you).&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="3675" LastEditDate="2016-03-14T20:38:03.677" LastActivityDate="2016-03-14T20:38:03.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28682" PostTypeId="2" ParentId="13269" CreationDate="2016-03-14T21:44:08.850" Score="2" Body="&lt;p&gt;The RSP720 in the router has two processing engines. The route processor (RP) and the switch processor (SP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you log-in to the console/telnet/ssh on a 7600 that's running IOS on both the RP and the SP (Native mode), you log-in to the RP by default. The spanning-tree function is however performed by the SP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After logging into the box try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;term mon&#xA;remote command switch debug spanning-tree bpdu receive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should see some output. The debug must also be turned off using the &lt;code&gt;remote command switch&lt;/code&gt; command.&lt;/p&gt;&#xA;" OwnerUserId="23603" LastEditorUserId="8499" LastEditDate="2016-03-14T22:10:28.967" LastActivityDate="2016-03-14T22:10:28.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28683" PostTypeId="1" AcceptedAnswerId="28684" CreationDate="2016-03-14T22:38:13.537" Score="3" ViewCount="2095" Body="&lt;p&gt;There is &lt;em&gt;route53&lt;/em&gt; which in the context of AWS is their DNS service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I've heard the term &quot;route66&quot; on different occasions in the context of DNS, but it never made sense to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried searching Google for what Route 66 is, but the answers are irrelevant, and the best I reached is that it's the name of an old road in the US.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there such a thing as &quot;route66&quot; in the context of DNS?&lt;/p&gt;&#xA;" OwnerUserId="23712" LastActivityDate="2017-09-23T09:59:13.177" Title="What is route 66 in the context of DNS?" Tags="|routing|dns|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28684" PostTypeId="2" ParentId="28683" CreationDate="2016-03-14T22:45:19.373" Score="2" Body="&lt;p&gt;I believe you are referring to port numbers. TCP and UDP (layer-4 protocols) use addresses, commonly called port numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both TCP and UDP use port 53 for DNS. If you want to know which port numbers are registered for which service, you can look in the &lt;a href=&quot;http://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml&quot; rel=&quot;nofollow&quot;&gt;IANA Service Name and Transport Protocol Port Number Registry&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Type in any port number, and it will take you to the entries for that port.&#xA; According to the port registry, port 66 is registered for &lt;code&gt;Oracle SQL*NET&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, on the other hand, you mean DHCP Option 66, that is for mass provisioning of VoIP phones. See &lt;a href=&quot;https://www.incognito.com/tips-and-tutorials/dhcp-options-in-plain-english/&quot; rel=&quot;nofollow&quot;&gt;DHCP Options in Plain English&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Carries the FQDN or IP address (or cluster identifier) that the device&#xA;  should use to download the file specified in option 67.  Note that&#xA;  often the data put into option 66 does not actually appear in the DHCP&#xA;  packet as option 66, but may have been moved into the “sname” field of&#xA;  the DHCP packet.  Additionally, the FQDN may have been resolved to an&#xA;  IP address and also placed in the “siaddr” field of the DHCP packet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-14T23:22:54.337" LastActivityDate="2016-03-14T23:22:54.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28685" PostTypeId="2" ParentId="27905" CreationDate="2016-03-14T23:15:05.800" Score="1" Body="&lt;p&gt;It all depends what's your desired level of complexity. I wrote a tool like that some time ago and I ended up simplifying it a lot at the end - initial idea would result in a lot of coding. So what I ended up with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;list of protocol &amp;amp; port combinations that I consider frequent offenders (ie. udp/123, udp/80, udp/19, udp/161, udp/53 etc) &lt;/li&gt;&#xA;&lt;li&gt;assumption that genuine use of above protocols should &quot;never&quot; cause more then &lt;em&gt;xyz&lt;/em&gt; packet-per-second towards single destination host&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now you need something [*] that will &quot;listen&quot; to netflow and collect data into some sort of buckets. Since I use sampled netflow I made a rule that threshold for given IP need to be exceeded twice within 30s - this helps ruling out false positives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above is obviously good for amplification attacks, I applied similar logic to tcp/80 &amp;amp; tcp/443 with SYN flag set, also works relatively well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[*] My &quot;something&quot; is: pmacct (www.pmacct.net) + RabbitMQ + my own bucket holding daemon written in Python. When alert is triggered, operator can instruct tool to take action (blackhole, flowspec or off-ramp to commercial scrubber), which is fed back to BGP using ExaBGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="3326" LastActivityDate="2016-03-14T23:15:05.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28689" PostTypeId="1" AcceptedAnswerId="28694" CreationDate="2016-03-15T09:50:14.187" Score="2" ViewCount="800" Body="&lt;p&gt;I am working on a monitoring application, using &lt;a href=&quot;http://docs.sharpsnmp.com/en/latest/tutorials/v3-operations.html#inform-operation&quot; rel=&quot;nofollow&quot;&gt;SharpSNMPLib&lt;/a&gt; on C#. I was using SNMP Traps but found out that there are some traps that are lost. Now I am using SNMP Informs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you think that this counters the loss (because Informs are acknowledged traps), or is it pretty much the same thing?&lt;/p&gt;&#xA;" OwnerUserId="23723" LastEditorUserId="8499" LastEditDate="2016-03-15T13:22:05.650" LastActivityDate="2016-03-15T13:47:36.447" Title="Do SNMP Informs guarantee that there is no loss?" Tags="|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28691" PostTypeId="1" AcceptedAnswerId="28693" CreationDate="2016-03-15T11:10:47.750" Score="4" ViewCount="624" Body="&lt;p&gt;I would like to ask, what part of frame is actually read in cut-through mode of switching? I understand that as soon as he read the destination MAC address it can forward. However, how will switch learn the source MAC address and populate his CAM table when he doesn't read the source MAC?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or if it sees that he doesn't know the dest. MAC address switch reads the rest of the frame and send it out of all port, while learning the source MAC address in process? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="16890" LastActivityDate="2017-08-29T06:41:40.360" Title="Learning of MAC addresses with cut-through switching?" Tags="|switch|mac-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28692" PostTypeId="2" ParentId="28691" CreationDate="2016-03-15T11:52:16.047" Score="1" Body="&lt;p&gt;Look a cut-through switch receives and examines only the first 6 bytes of a frame, which carries the DMAC address. However cut-through switches wait until a few more bytes of the frame have been evaluated before they decide whether to forward or drop the packet.&lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2016-03-15T11:52:16.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28693" PostTypeId="2" ParentId="28691" CreationDate="2016-03-15T12:11:46.970" Score="9" Body="&lt;p&gt;Cut-trough switching is not a standard. Actually it violates the 802.1D standard in some (minor) aspects.&lt;/p&gt;&#xA;&lt;p&gt;So each vendor implement it on its own way and there's not a single answer to this question.&lt;/p&gt;&#xA;&lt;p&gt;Beginning to forward the frame immediately after the destination mac address has been read doesn't prevent the switch to read the source mac while transmitting it, this could be a way to learn it with an optimal latency.&lt;/p&gt;&#xA;&lt;p&gt;However most cut-trough switches will examine more than the single destination address field prior to decide to forward it.&lt;/p&gt;&#xA;&lt;p&gt;In &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/nexus-5020-switch/white_paper_c11-465436.html&quot; rel=&quot;noreferrer&quot;&gt;this article&lt;/a&gt; from Cisco you will find more information on this subject and more specificaly this paragraph :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Examining More Fields&lt;/p&gt;&#xA;&lt;p&gt;Switches do not necessarily have cut-through&#xA;and store-and-forward &amp;quot;modes&amp;quot; of operation. As stated earlier,&#xA;cut-through switches usually receive a predetermined number of bytes,&#xA;depending on the type of packet coming in, before making a forwarding&#xA;decision.&lt;/p&gt;&#xA;&lt;p&gt;The switch does not move from one mode to the other as&#xA;dictated by configuration, speed differential, congestion, or any&#xA;other condition.&lt;/p&gt;&#xA;&lt;p&gt;For example, in the case of a configuration that&#xA;permits or denies packets with certain IPv4 TCP port ranges, the&#xA;cut-through switch examines 54 bytes before it makes a forwarding&#xA;decision. For a non-IP packet, the switch may receive the first 16&#xA;bytes of the frame, if the user has configured some kind of QoS policy&#xA;based on the IP precedence bits in the type-of-service (ToS) byte or&#xA;on the differentiated services code point (DSCP) bits.&lt;/p&gt;&#xA;&lt;p&gt;Figure 3 shows&#xA;a standard IPv4 packet structure in an Ethernet ARPA frame. The&#xA;cut-through switch takes in 54 bytes of the Ethernet header (not&#xA;counting the 8 bytes of the preamble, which serves only to wake up the&#xA;transceiver and indicate the arrival of a frame) and, depending on the&#xA;vendors' design, may then run a policy engine against the pertinent&#xA;fields in the IPv4 header to determine whether, for example, the TCP&#xA;destination port matches the ACL, or the source IP address is in the&#xA;range of that ACL.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-08-29T06:41:40.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28694" PostTypeId="2" ParentId="28689" CreationDate="2016-03-15T13:47:36.447" Score="0" Body="&lt;p&gt;It really depends on the sender. For instance, if it is a fatal event, it is unlikely that the sender will be able to resend an unacknowledged event. In general, informs are more reliable than traps, but there is no guarantee that a sender &lt;em&gt;will&lt;/em&gt; resend an unacknowledged inform, only that the sender &lt;em&gt;can&lt;/em&gt; resend an unacknowledged inform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how Cisco explains informs, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/xe-3se/5700/snmp-xe-3se-5700-book/nm-snmp-inf-req-review.html&quot; rel=&quot;nofollow&quot;&gt;SNMP Inform Request&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;SNMP Inform Request&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The SNMP Inform Request feature supports sending inform requests. SNMP&#xA;  asynchronous notifications are usually sent as SNMP traps.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Traps are less reliable than informs because an acknowledgment is not&#xA;  sent from the receiving end when a trap is received; however, an SNMP&#xA;  manager that receives an inform acknowledges the message with an SNMP&#xA;  response PDU. If the sender does not receive a response for an inform,&#xA;  the inform can be sent again.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-15T13:47:36.447" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28695" PostTypeId="2" ParentId="28556" CreationDate="2016-03-15T14:36:33.547" Score="1" Body="&lt;p&gt;Finally, it works...&#xA;I restarted from scratch and shzbt's Indications of where to search, brought me to some clue.&#xA;I use lacp for my trunks and pvst on all switches :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;bnt config :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/c/port INT1                   &#xA;        pvid 11&#xA;                    /**** INT1 ... INT14 are identical ****/&#xA;    /c/port INT14&#xA;        pvid 11&#xA;&#xA;/c/port EXT1&#xA;        tag ena&#xA;        pvid 11&#xA;                    /**** EXT1 ... INT4 are identical ****/&#xA;&#xA;/c/port EXT5        /**** and EXT6 ****/ &#xA;        dis&#xA;&#xA;/c/l2/vlan 1&#xA;        def EXT5 EXT6&#xA;/c/l2/vlan 10&#xA;        ena&#xA;        name &quot;ADMIN&quot;&#xA;        def INT1 ... INT14 EXT1 ... EXT4&#xA;/c/l2/vlan 11&#xA;        ena&#xA;        name &quot;PROD1&quot;&#xA;        def INT1 ... INT14 EXT1 ... EXT4&#xA;/c/l2/vlan 12&#xA;        ena&#xA;        name &quot;PROD1&quot;&#xA;        def INT1 ... INT14&#xA;/c/l2/stg 1/clear&#xA;/c/l2/stg 1/add 1 10 11 12&#xA;/c/l2/lacp/Port EXT1     /**** and EXT2 to EXT4 ****/&#xA;        mode active&#xA;        adminkey 17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco Config :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; !&#xA;spanning-tree mode pvst&#xA;spanning-tree loopguard default&#xA;spanning-tree portfast bpduguard default&#xA;spanning-tree portfast bpdufilter default&#xA;spanning-tree extend system-id&#xA;spanning-tree vlan 10-12 priority 24576&#xA;!&#xA;&#xA;interface Port-channel1&#xA; description UP_BC1-IO1&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10,11&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; storm-control broadcast level 5.00&#xA;!&#xA;interface Port-channel2&#xA; description UP_BC2-IO2&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10,11&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; storm-control broadcast level 5.00&#xA;!&#xA;...&#xA;!&#xA;interface GigabitEthernet1/0/1             /*** and Gi1/0/2,Gi2/0/1-2  ***/&#xA; description BC1-IO1-1&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10-12&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; storm-control broadcast level 5.00&#xA; channel-group 1 mode active&#xA;!&#xA;interface GigabitEthernet1/0/3             /*** and Gi1/0/4,Gi2/0/3-4  ***/&#xA; description BC1-IO2&#xA; switchport trunk native vlan 11&#xA; switchport trunk allowed vlan 10,11&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; storm-control broadcast level 5.00&#xA; channel-group 2 mode active&#xA;!&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thank you !&lt;/p&gt;&#xA;" OwnerUserId="23573" LastActivityDate="2016-03-15T14:36:33.547" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28696" PostTypeId="1" AcceptedAnswerId="28701" CreationDate="2016-03-15T15:25:05.800" Score="2" ViewCount="1090" Body="&lt;p&gt;I have used Link Local protocol several times but only to link two computers or a computer and another device to transfer files via FTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But does Link Local protocol work for multiple hosts. Let's say that I would like to build an office Network WITHOUT access to Internet at all. If I have approximately 30 Hosts would a router bring any benefit to it or it is the same if I use let's say 7 switches and let every computer get its IP address using Link Local.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand, using NAT every computer would be able to know on which port to send a frame directed towards a specific IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I install printers on the Network and File Storage Servers would the application protocols that normally discover servers on the network work the same ?&lt;/p&gt;&#xA;" OwnerUserId="23730" LastActivityDate="2016-03-15T16:13:44.600" Title="Is it possible to build a fully functional LAN without any router, only with a switch?" Tags="|switch|ip|switching|network-discovery|ip-link-local|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28697" PostTypeId="1" CreationDate="2016-03-15T15:30:14.837" Score="2" ViewCount="289" Body="&lt;p&gt;And what are the advantages of creating subnetworks if computers are assigned different IP addresses from the same range and can communicate with each other also with switches?&lt;/p&gt;&#xA;" OwnerUserId="23730" LastActivityDate="2016-05-14T23:12:44.003" Title="What are the differences between a private network and a subnetwork?" Tags="|routing|switch|subnet|ip|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28698" PostTypeId="1" CreationDate="2016-03-15T15:38:52.210" Score="6" ViewCount="2405" Body="&lt;p&gt;Is configuring the SPAN port same for a routed port vs a switch port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a routed port on my layer-3 3560G for which I need to configure SPAN and capture packets ingress and egress for troubleshooting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the configuration on the source port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/23&#xA; description Uplink to ISP&#xA; no switchport&#xA; ip address X.x.x.x y.y.y.y&#xA; load-interval 30&#xA; speed 100&#xA; duplex full&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is what I have configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;monitor session 1 source interface Gi0/23&#xA;monitor session 1 destination interface Gi0/5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is SPAN port configuration different on a switch port vs routed port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, how do we configure SPAN port on a router?&lt;/p&gt;&#xA;" OwnerUserId="450" LastEditorUserId="286" LastEditDate="2016-10-18T10:00:58.833" LastActivityDate="2018-03-12T21:51:28.727" Title="How to monitor SPAN port for a routed port on 3560G" Tags="|switch|router|mirror|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28699" PostTypeId="1" AcceptedAnswerId="28700" CreationDate="2016-03-15T15:39:57.347" Score="2" ViewCount="1594" Body="&lt;p&gt;Built inbound ICMP connection for faddr 10.1.6.3/1 gaddr 10.24.5.2/0 laddr 10.4.1.2/0&lt;/p&gt;&#xA;" OwnerUserId="23732" LastActivityDate="2016-03-15T16:00:16.393" Title="Which is source IP and destination IP for this Cisco ASA Firewall Log?" Tags="|nat|firewall|syslog|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28700" PostTypeId="2" ParentId="28699" CreationDate="2016-03-15T16:00:16.393" Score="2" Body="&lt;p&gt;A five second google search told me that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;faddr = foreign address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;gaddr = global address (after NAT)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;laddr = local address (pre NAT)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is an inbound connection, the source IP address is the foreign one : &lt;code&gt;10.1.6.3&lt;/code&gt;&#xA;The original destination address is &lt;code&gt;10.24.5.2&lt;/code&gt; which has been translated to the final destination address &lt;code&gt;10.4.1.2&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-15T16:00:16.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28701" PostTypeId="2" ParentId="28696" CreationDate="2016-03-15T16:06:12.800" Score="2" Body="&lt;p&gt;Routers only route between LANs. You can have a fully functional LAN, including DHCP, without a router. You only need a router if you need to be able to communicate with other LANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you refer to &quot;Link Local,&quot; I think you are really meaning &lt;a href=&quot;https://support.microsoft.com/en-us/kb/220874&quot; rel=&quot;nofollow&quot;&gt;APIPA&lt;/a&gt;. This will actually determine if a host is trying to use an already used link-local address and change it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Frames do not get &quot;&lt;em&gt;directed towards a specific IP address&lt;/em&gt;;&quot; frames have MAC addresses which a switch will use to send a frame send to a specific switch port. You are confusing layer-2 frames and layer-3 packets. A LAN is a layer-2 concept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether or not you have DHCP on a LAN, the LAN can function normally, and printers, etc. can be discovered the same way they would if DHCP was on the LAN, assuming the devices were assigned IP addresses in the LAN network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-15T16:13:44.600" LastActivityDate="2016-03-15T16:13:44.600" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28702" PostTypeId="2" ParentId="28698" CreationDate="2016-03-15T16:11:33.680" Score="1" Body="&lt;p&gt;A routed port is specifically &lt;em&gt;not&lt;/em&gt; a switch port. You are putting the &lt;code&gt;no switchport&lt;/code&gt; command on the port to disable the switching functions. It becomes a router interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SPAN will not work on a switch port which is routed.  Some Cisco devices (very few) can use ERSPAN to route SPAN traffic, but the 3560G is not one of them. SPAN and RSPAN are layer-2 only and ERSPAN is across layer-3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/document/139236/understanding-spanrspanand-erspan&quot; rel=&quot;nofollow&quot;&gt;Understanding SPAN,RSPAN,and ERSPAN&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Local SPAN:&lt;/strong&gt; Mirrors traffic from one or more interface on the switch&#xA;  to one or more interfaces on the same switch.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Remote SPAN (RSPAN):&lt;/strong&gt; An extension of SPAN called remote SPAN or RSPAN.&#xA;  RSPAN allows you to monitor traffic from source ports distributed over&#xA;  multiple switches, which means that you can centralize your network&#xA;  capture devices. RSPAN works by mirroring the traffic from the source&#xA;  ports of an RSPAN session onto a VLAN that is dedicated for the RSPAN&#xA;  session. This VLAN is then trunked to other switches, allowing the&#xA;  RSPAN session traffic to be transported across multiple switches. On&#xA;  the switch that contains the destination port for the session, traffic&#xA;  from the RSPAN session VLAN is simply mirrored out the destination&#xA;  port.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Encapsulated remote SPAN (ERSPAN):&lt;/strong&gt; encapsulated Remote SPAN (ERSPAN),&#xA;  as the name says, brings generic routing encapsulation (GRE) for all&#xA;  captured traffic and allows it to be extended across Layer 3 domains.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ERSPAN is a Cisco proprietary feature and is available only to&#xA;  Catalyst 6500, 7600, Nexus, and ASR 1000 platforms to date. The ASR&#xA;  1000 supports ERSPAN source (monitoring) only on Fast Ethernet,&#xA;  Gigabit Ethernet, and port-channel interfaces.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The latest information I have is that Cisco is planning to add ERSPAN support to &lt;em&gt;some&lt;/em&gt; Catalyst 3K and 4K switches in code versions to be released later in 2016, albeit there were no guarantees.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-21T23:25:53.753" LastActivityDate="2016-03-21T23:25:53.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28703" PostTypeId="1" AcceptedAnswerId="28706" CreationDate="2016-03-15T16:35:16.340" Score="1" ViewCount="1282" Body="&lt;p&gt;I've set up a new VLAN (VLAN 11) to service subnet &lt;code&gt;10.0.11.0\24&lt;/code&gt;. It's primarily for wired PCs. I have DHCP working. I can browse all of my network, file shares, ping interfaces etc. I can't get my new VLAN devices out onto the Internet, or communicating with &lt;code&gt;192.168.2.0/24&lt;/code&gt; which is connected site-to-site VPN. Where have I gone wrong? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I do all my firewall config through ASDM. I find CLI on the ASA confusing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Hardware Used:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Firewall - Cisco ASA 5510&lt;/li&gt;&#xA;&lt;li&gt;Core Switch - Dell Force10 50s Stacked&lt;/li&gt;&#xA;&lt;li&gt;DHCP - Windows Server 2008R2 (VM)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch Config (Relevant Parts):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet 1/1&#xA; description Uplink to Cisco ASA5510&#xA; no ip address&#xA; portmode hybrid&#xA; switchport&#xA; no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sh vlan&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NUM    Status    Description                     Q Ports&#xA;1      Active                                    U Gi 0/1-23,25-43&#xA;                                                 U Gi 1/1-44&#xA;10     Active                                    T Gi 0/1,44&#xA;                                                 T Gi 1/1&#xA;11     Active                                    T Gi 0/1&#xA;                                                 U Gi 0/24&#xA;                                                 T Gi 1/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sh ip int br&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vlan 1                   192.168.1.230   YES Manual up                    up&#xA;Vlan 10                  10.0.10.251     YES Manual up                    up&#xA;Vlan 11                  10.0.11.251     YES Manual up                    up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;sh ip route&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       Destination        Gateway                      Dist/Metric Last Change&#xA;       -----------        -------                      ----------- -----------&#xA; *S    0.0.0.0/0          via 192.168.1.250, Vl 1              1/0       81w5d&#xA;  C    10.0.10.0/24       Direct, Vl 10                        0/0        4d6h&#xA;  C    10.0.11.0/24       Direct, Vl 11                        0/0       2d23h&#xA;  C    192.168.1.0/24     Direct, Vl 1                         0/0       81w5d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Firewall Config:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh run &#xA;: Saved&#xA;: &#xA;: Serial Number: *****&#xA;: Hardware:   ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz&#xA;:&#xA;ASA Version 9.1(6) &#xA;!&#xA;hostname LDHQFW&#xA;enable password 6OKb.d/KJtTCYuU9 encrypted&#xA;xlate per-session deny tcp any4 any4&#xA;xlate per-session deny tcp any4 any6&#xA;xlate per-session deny tcp any6 any4&#xA;xlate per-session deny tcp any6 any6&#xA;xlate per-session deny udp any4 any4 eq domain&#xA;xlate per-session deny udp any4 any6 eq domain&#xA;xlate per-session deny udp any6 any4 eq domain&#xA;xlate per-session deny udp any6 any6 eq domain&#xA;passwd 2KFQnbNIdI.2KYOU encrypted&#xA;names&#xA;ip local pool VPN 10.1.11.1-10.1.11.254 mask 255.255.255.0&#xA;ip local pool AC-10 10.0.0.1-10.0.0.50 mask 255.255.255.0&#xA;ip local pool 172.16.10.0 172.16.10.1-172.16.10.200 mask 255.255.255.0&#xA;&#xA;&#xA;!&#xA;interface Ethernet0/0&#xA; nameif Outside&#xA; security-level 0&#xA; ip address x.x.x.185 255.255.255.248 &#xA;!&#xA;interface Ethernet0/1&#xA; nameif Inside&#xA; security-level 100&#xA; ip address 192.168.1.171 255.255.255.0 &#xA;!&#xA;interface Ethernet0/1.10&#xA; description HQ_Servers&#xA; vlan 10&#xA; nameif VLAN_10&#xA; security-level 100&#xA; ip address 10.0.10.252 255.255.255.0 &#xA;!&#xA;interface Ethernet0/1.11&#xA; description HQ_PCs&#xA; vlan 11&#xA; nameif VLAN_11&#xA; security-level 100&#xA; ip address 10.0.11.252 255.255.255.0 &#xA;&#xA;&#xA;!&#xA;interface Ethernet0/2&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Ethernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management0/0&#xA; shutdown&#xA; nameif Management&#xA; security-level 100&#xA; no ip address&#xA;!&#xA;boot system disk0:/asa916-k8.bin&#xA;boot system disk0:/asa915-k8.bin&#xA;boot system disk0:/asa913-k8.bin&#xA;boot system disk0:/asa912-k8.bin&#xA;ftp mode passive&#xA;&#xA;&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring&#xA;dns domain-lookup Inside&#xA;dns server-group DefaultDNS&#xA; name-server 192.168.1.221&#xA; name-server 192.168.1.225&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network 192.168.0.0_24&#xA; subnet 192.168.0.0 255.255.255.0&#xA;object network 192.168.1.0_24&#xA; subnet 192.168.1.0 255.255.255.0&#xA;object network 192.168.2.0_24&#xA; subnet 192.168.2.0 255.255.255.0&#xA; description MFG&#xA;object network NETWORK_OBJ_192.168.1.0_24&#xA; subnet 192.168.1.0 255.255.255.0&#xA;object network 192.168.1.96_27&#xA; subnet 192.168.1.96 255.255.255.224&#xA;object network myvpn&#xA; subnet 10.1.11.0 255.255.255.0&#xA;object network NETWORK_OBJ_10.1.11.0_24&#xA; subnet 10.1.11.0 255.255.255.0&#xA;object network insidenat&#xA;&#xA;&#xA; subnet 10.250.250.0 255.255.255.0&#xA;object network ComcastGateway&#xA; host x.x.x.x&#xA;object network 192.168.6.0_24&#xA; subnet 192.168.6.0 255.255.255.0&#xA;object network LDHQFS_FTPServer&#xA; host 192.168.1.227&#xA;object network FTPServer_ext&#xA; host x.x.x.186&#xA;object service FTP2&#xA; service tcp source range 1 65535 destination eq 35262 &#xA;object network LDHQWS_Internal&#xA; host 192.168.1.226&#xA;object network LDHQEC_EXT&#xA; host x.x.x.187&#xA;object service RDP&#xA; service tcp source range 1 65535 destination eq 3389 &#xA;object network RouterVLAN2&#xA; host 192.168.0.2&#xA;object network MFG_Inside-Network&#xA; subnet 192.168.2.0 255.255.255.0&#xA;object network 192.168.50.0_24&#xA; subnet 192.168.50.0 255.255.255.0&#xA;object network LDHQSQL&#xA;&#xA;&#xA; host 192.168.1.222&#xA;object network NETWORK_OBJ_10.0.0.0_26&#xA; subnet 10.0.0.0 255.255.255.192&#xA;object service ftp_ssl_tls&#xA; service tcp source range 1 65535 destination eq 990 &#xA; description implicit ftp&#xA;object service ftp_passive&#xA; service tcp source range 1 65535 destination range 51200 51300 &#xA;object network LDHQEC_INT&#xA; host 192.168.1.228&#xA;object network LDHQUB_INT&#xA; host 192.168.1.218&#xA; description Ubuntu Server Interior IP Address&#xA;object network LDHQUB_EXT&#xA; host x.x.x.188&#xA; description External Ip Address&#xA;object network HQ_PCs&#xA; subnet 10.0.11.0 255.255.255.0&#xA; description HQ_PCs&#xA;object network HQ_Printers&#xA; subnet 10.0.12.0 255.255.255.0&#xA; description HQ_Printers&#xA;object network HQ_Servers&#xA; subnet 10.0.10.0 255.255.255.0&#xA;&#xA;&#xA; description HQ_Servers&#xA;object network HQ_Wireless&#xA; subnet 10.0.13.0 255.255.255.0&#xA; description HQ_Wireless&#xA;object network VPN_IPs_172&#xA; subnet 172.16.10.0 255.255.255.0&#xA; description VPN IP Address Pool 172.16.10.0\24&#xA;object network VPN_Public_IP&#xA; host x.x.x.185&#xA; description VPN Public Address&#xA;object network CoreSwitch_VLAN11&#xA; host 10.0.11.251&#xA;object network Router_VLAN_11&#xA; host 10.0.11.250&#xA;object-group network LDHQ&#xA; description All Headquarters networks&#xA; network-object object 192.168.0.0_24&#xA; network-object object 192.168.1.0_24&#xA; network-object object 192.168.2.0_24&#xA; network-object object HQ_PCs&#xA; network-object object HQ_Printers&#xA; network-object object HQ_Servers&#xA; network-object object HQ_Wireless&#xA;object-group service FTPPassive tcp&#xA;&#xA;&#xA; port-object range 51200 51300&#xA; port-object eq ftp&#xA;object-group service DM_INLINE_TCP_1 tcp&#xA; port-object eq www&#xA; port-object eq https&#xA;object-group service FTP_Ports tcp&#xA; port-object range 51200 51300&#xA; port-object eq 990&#xA; port-object eq ftp&#xA; port-object eq ftp-data&#xA;object-group network d90_home&#xA; network-object 10.10.10.0 255.255.255.0&#xA; network-object 10.10.5.0 255.255.255.0&#xA;access-list Outside_access_in extended permit tcp any object LDHQFS_FTPServer object-group FTP_Ports &#xA;access-list Outside_access_in extended permit ip object-group LDHQ any4 &#xA;access-list Outside_access_in extended permit icmp any4 any4 &#xA;access-list Outside_access_in extended permit tcp any object LDHQEC_INT object-group DM_INLINE_TCP_1 &#xA;access-list Outside_access_in extended permit tcp any object LDHQUB_INT eq www &#xA;access-list Inside_access_in extended permit ip object-group LDHQ any4 &#xA;access-list HQ_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0 &#xA;access-list LDHQ_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0 &#xA;access-list LD_10_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0 &#xA;access-list LD_10_splitTunnelAcl standard permit 10.1.11.0 255.255.255.0 &#xA;access-list crypto_allowmyvpnaccess extended permit ip object myvpn object insidenat &#xA;&#xA;&#xA;access-list LD_6_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0 &#xA;access-list LD_6_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0 &#xA;access-list Outside_cryptomap extended permit ip object 192.168.1.0_24 object 192.168.2.0_24 &#xA;access-list Outside_cryptomap extended permit ip 10.0.0.0 255.255.255.0 object 192.168.2.0_24 &#xA;access-list LDCorp_MFG_Networks standard permit 192.168.1.0 255.255.255.0 &#xA;access-list LDCorp_MFG_Networks standard permit 192.168.2.0 255.255.255.0 &#xA;pager lines 24&#xA;logging enable&#xA;logging timestamp&#xA;logging emblem&#xA;logging trap debugging&#xA;logging history debugging&#xA;logging asdm informational&#xA;logging facility 16&#xA;logging host Inside 192.168.1.226 format emblem&#xA;logging debug-trace&#xA;mtu Outside 1500&#xA;mtu Inside 1500&#xA;mtu VLAN_10 1500&#xA;mtu VLAN_11 1500&#xA;mtu Management 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-743.bin&#xA;no asdm history enable&#xA;&#xA;&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (Inside,Inside) source dynamic any interface destination static LDHQUB_EXT LDHQUB_INT description U-Turn for Feedback.mydomain.com&#xA;nat (Inside,Inside) source dynamic any interface destination static LDHQEC_EXT LDHQEC_INT description U-Turn for enterprise\parts.mydomain.com&#xA;nat (Inside,Outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 inactive&#xA;nat (Inside,Outside) source static LDHQ LDHQ destination static 192.168.1.96_27 192.168.1.96_27 no-proxy-arp route-lookup inactive&#xA;nat (Outside,Inside) source static myvpn myvpn destination static insidenat insidenat inactive&#xA;nat (Inside,Outside) source static 192.168.1.0_24 192.168.1.0_24 destination static 192.168.6.0_24 192.168.6.0_24 no-proxy-arp route-lookup inactive&#xA;nat (Inside,Outside) source static 192.168.2.0_24 192.168.2.0_24 destination static 192.168.1.0_24 192.168.1.0_24 no-proxy-arp route-lookup&#xA;nat (Inside,Outside) source static 192.168.1.0_24 192.168.1.0_24 destination static 192.168.2.0_24 192.168.2.0_24 no-proxy-arp route-lookup&#xA;nat (Outside,Outside) source static 192.168.1.0_24 192.168.1.0_24 destination static 192.168.1.96_27 192.168.1.96_27 no-proxy-arp route-lookup inactive&#xA;nat (Inside,Outside) source static 192.168.1.0_24 192.168.1.0_24 destination static 192.168.1.96_27 192.168.1.96_27 no-proxy-arp route-lookup inactive&#xA;nat (Inside,Outside) source static any any destination static 192.168.50.0_24 192.168.50.0_24 no-proxy-arp route-lookup inactive&#xA;nat (Inside,Outside) source static any any destination static VPN_IPs_172 VPN_IPs_172 no-proxy-arp route-lookup&#xA;nat (Inside,Outside) source static LDHQ LDHQ destination static VPN_IPs_172 VPN_IPs_172 no-proxy-arp route-lookup&#xA;nat (Outside,Inside) source static any any destination static LDHQEC_EXT LDHQEC_INT&#xA;nat (any,Inside) source static any any destination static LDHQUB_EXT LDHQUB_INT&#xA;nat (Inside,Outside) source static LDHQ LDHQ destination static d90_home d90_home no-proxy-arp route-lookup&#xA;!&#xA;object network LDHQFS_FTPServer&#xA; nat (Inside,Outside) static FTPServer_ext&#xA;!&#xA;nat (Inside,Outside) after-auto source dynamic any interface&#xA;&#xA;&#xA;access-group Outside_access_in in interface Outside&#xA;access-group Inside_access_in in interface Management&#xA;route Outside 0.0.0.0 0.0.0.0 x.x.x.190 1 &#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;aaa-server AD protocol ldap&#xA;aaa-server AD (Inside) host 192.168.1.225&#xA; server-port 389&#xA; ldap-base-dn DC=LDI_NETWORK,DC=COM&#xA; ldap-scope subtree&#xA; ldap-login-password *****&#xA; ldap-login-dn CN=CiscoVPN,CN=Managed Service Accounts,DC=LDI_NETWORK,DC=COM&#xA; server-type microsoft&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL &#xA;aaa authentication http console LOCAL &#xA;aaa local authentication attempts max-fail 5&#xA;&#xA;&#xA;http server enable&#xA;http 192.168.1.0 255.255.255.0 Management&#xA;http 192.168.1.0 255.255.255.0 Inside&#xA;http 192.168.0.0 255.255.255.0 Inside&#xA;http 10.0.10.0 255.255.255.0 Inside&#xA;snmp-server host Inside 192.168.1.226 community ***** udp-port 514&#xA;snmp-server host-group Inside NETWORK_OBJ_192.168.1.0_24 poll community *****&#xA;snmp-server location LD HQ&#xA;snmp-server contact Nicholas Dininno&#xA;snmp-server community *****&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac &#xA;&#xA;&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport&#xA;crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES192&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES&#xA;&#xA;&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal DES&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES&#xA;crypto map Outside_map 10 match address Outside_cryptomap&#xA;crypto map Outside_map 10 set pfs &#xA;crypto map Outside_map 10 set peer x.x.x.99 &#xA;crypto map Outside_map 10 set ikev1 transform-set ESP-AES-256-SHA&#xA;crypto map Outside_map 10 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256&#xA;crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map Outside_map interface Outside&#xA;crypto ca trustpoint _SmartCallHome_ServerCA&#xA; no validation-usage&#xA; crl configure&#xA;crypto ca trustpoint ASDM_TrustPoint0&#xA; enrollment self&#xA;&#xA;&#xA; subject-name CN=LDHQFW&#xA; keypair LDAnyConnect&#xA; crl configure&#xA;crypto ca trustpoint ASDM_TrustPoint1&#xA; enrollment terminal&#xA; subject-name CN=work.mydomain.com,O=My Company Inc,C=US&#xA; keypair VPN_1_8_2016_Req&#xA; crl configure&#xA;crypto ca trustpoint ASDM_TrustPoint3&#xA; enrollment self&#xA; subject-name CN=192.168.1.171&#xA; crl configure&#xA;crypto ca trustpool policy&#xA;crypto ca certificate chain _SmartCallHome_ServerCA&#xA;&#xA;crypto ikev2 policy 1&#xA; encryption aes-256&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 10&#xA; encryption aes-192&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 20&#xA; encryption aes&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 30&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;&#xA;crypto ikev2 policy 40&#xA; encryption des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 enable Outside client-services port 443&#xA;crypto ikev2 remote-access trustpoint ASDM_TrustPoint1&#xA;crypto ikev1 enable Outside&#xA;crypto ikev1 policy 10&#xA; authentication crack&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 20&#xA; authentication rsa-sig&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 30&#xA; authentication pre-share&#xA; encryption aes-256&#xA;hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 40&#xA; authentication crack&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 50&#xA; authentication rsa-sig&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 60&#xA; authentication pre-share&#xA; encryption aes-192&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 70&#xA; authentication crack&#xA; encryption aes&#xA;&#xA;&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 80&#xA; authentication rsa-sig&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 90&#xA; authentication pre-share&#xA; encryption aes&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 100&#xA; authentication crack&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 110&#xA; authentication rsa-sig&#xA; encryption 3des&#xA;&#xA;&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 120&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 130&#xA; authentication crack&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 140&#xA; authentication rsa-sig&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto ikev1 policy 150&#xA; authentication pre-share&#xA; encryption des&#xA;&#xA;&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet 192.168.1.0 255.255.255.0 Inside&#xA;telnet 192.168.1.0 255.255.255.0 Management&#xA;telnet timeout 5&#xA;ssh stricthostkeycheck&#xA;ssh 0.0.0.0 0.0.0.0 Outside&#xA;ssh 192.168.1.0 255.255.255.0 Inside&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;management-access Inside&#xA;vpn-addr-assign local reuse-delay 10&#xA;dhcpd auto_config Inside&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics host&#xA;threat-detection statistics port&#xA;threat-detection statistics protocol&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;ntp server 192.168.1.250 source Inside&#xA;ssl trust-point ASDM_TrustPoint1 Outside&#xA;&#xA;&#xA;ssl trust-point ASDM_TrustPoint3 Inside&#xA;webvpn&#xA; enable Outside&#xA; anyconnect-essentials&#xA; anyconnect image disk0:/anyconnect-win-3.1.05170-k9.pkg 1&#xA; anyconnect image disk0:/anyconnect-macosx-i386-3.1.04074-k9.pkg 2&#xA; anyconnect profiles AC_LDVPN_client_profile disk0:/AC_LDVPN_client_profile.xml&#xA; anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml&#xA; anyconnect enable&#xA; tunnel-group-list enable&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-tunnel-protocol ikev1 ikev2 ssl-clientless&#xA;group-policy GroupPolicy_AC_LDVPN internal&#xA;group-policy GroupPolicy_AC_LDVPN attributes&#xA; wins-server none&#xA; dns-server value 192.168.1.225 192.168.1.221&#xA; vpn-tunnel-protocol ikev1 ikev2 ssl-client &#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value LDCorp_MFG_Networks&#xA; default-domain none&#xA; webvpn&#xA;  anyconnect profiles value AC_LDVPN_client_profile type user&#xA;group-policy GroupPolicy_x.x.x.99 internal&#xA;group-policy GroupPolicy_x.x.x.99 attributes&#xA;&#xA;&#xA; vpn-tunnel-protocol ikev1 ikev2 &#xA;group-policy HQ internal&#xA;group-policy HQ attributes&#xA; dns-server value 192.168.1.220 192.168.1.221&#xA; vpn-tunnel-protocol ssl-client &#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value LD_6_splitTunnelAcl&#xA;username ******* password ******** encrypted privilege 15&#xA;tunnel-group HQ type remote-access&#xA;tunnel-group HQ general-attributes&#xA; address-pool 172.16.10.0&#xA; authentication-server-group AD&#xA; default-group-policy HQ&#xA;tunnel-group HQ ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA;tunnel-group x.x.x.99 type ipsec-l2l&#xA;tunnel-group x.x.x.99 general-attributes&#xA; default-group-policy GroupPolicy_x.x.x.99&#xA;tunnel-group x.x.x.99 ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;tunnel-group AC_LDVPN type remote-access&#xA;tunnel-group AC_LDVPN general-attributes&#xA;&#xA;&#xA; address-pool 172.16.10.0&#xA; authentication-server-group AD&#xA; default-group-policy GroupPolicy_AC_LDVPN&#xA;tunnel-group AC_LDVPN webvpn-attributes&#xA; group-alias AC_LDVPN enable&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;&#xA;&#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA; class class-default&#xA;  user-statistics accounting&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;service call-home&#xA;call-home reporting anonymous&#xA;call-home&#xA; contact-email-addr me@mydomain.com&#xA; contact-name Nicholas&#xA; phone-number 732-474-8723&#xA; profile CiscoTAC-1&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;&#xA;&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;Cryptochecksum:xxxxx&#xA;: end&#xA;&#xA;LDHQFW#      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2yPsL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2yPsL.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2yPsL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2yPsL.png&quot; alt=&quot;Updated Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23733" LastEditorUserId="8499" LastEditDate="2019-01-05T00:39:22.530" LastActivityDate="2019-01-05T00:39:22.530" Title="VLANs: No Internet Access" Tags="|routing|switch|vlan|cisco-asa|firewall|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28704" PostTypeId="1" AcceptedAnswerId="28860" CreationDate="2016-03-15T17:06:03.727" Score="8" ViewCount="3635" Body="&lt;p&gt;I am doing some work in a factory that is quite new, and have been asked to terminate some network cables - simple enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However on looking up at the cable trays, which are suspended from the ceiling, I see in various places, &quot;Someone&quot; has run 3-phase power cables in-amongst the (eg aprox 20) cat7 cables, for many meters, they have also CABLE TIED a network cable to that power cable as they are dropped down to each machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was always taught that running network cables and power/lighting together was a no-no. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I right to be concerned about this? or is Cat 7 fairly interference-proof?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;Photo added for general amusement - one of many examples. light blue = network, silver = power (coming from the power conduit, through the network tray and then down...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/d5rnC.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/d5rnC.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20260" LastEditorUserId="8499" LastEditDate="2018-03-09T20:51:12.737" LastActivityDate="2018-03-09T20:51:12.737" Title="Running Cat 7 STP cables in the same cable trays as 3-phase power cables" Tags="|layer1|cabling|cable|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28705" PostTypeId="2" ParentId="28697" CreationDate="2016-03-15T17:06:09.277" Score="0" Body="&lt;p&gt;A private network is normally a network in one of the RFC 1918 private address ranges:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.0/8&#xA;172.16.0.0/12&#xA;192.168.0.0/16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A subnet, or network, is explained pretty well in &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;this answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hosts can communicate on the same network, or, with routers, across different networks. Networks are layer-3 concepts, and switches switch at layer-2. You should probably study the &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwjyzbyllsPLAhXFw4MKHVJsClcQFggdMAA&amp;amp;url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FOSI_model&amp;amp;usg=AFQjCNE-WujowlSWqKKibFK87N9r6U7HlA&amp;amp;sig2=4Y822A4uV_EF5hO5GvpqRg&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSI Model&lt;/a&gt;, but remember that it is just a model, and the real world doesn't always work exactly how the model prescribes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most cases, a single network (or subnet if you prefer) is assigned to a a single LAN (or VLAN). This constitutes a layer-2 broadcast domain. That means that every broadcast is sent to, and interrupts, every host. It is also often difficult or impossible to put any controls, like security, QoS, etc. within a single LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Breaking a LAN up into separate networks on separate LANs will ease the problem of broadcasts, and it allows you to install controls at layer-3. It also requires a router to be able to get from one network to another.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-03-15T17:45:19.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28706" PostTypeId="2" ParentId="28703" CreationDate="2016-03-15T17:13:34.920" Score="2" Body="&lt;p&gt;Routers route between networks. You don't route from one network to the same network: This is probably your problem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.0.11.0 255.255.255.0 10.0.11.251&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All your other routes are to &lt;code&gt;192.168.1.171&lt;/code&gt;, a hop on a different network (the firewall inside interface):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.1.171&#xA;ip route 10.0.11.0 255.255.255.0 10.0.11.251&#xA;ip route 172.16.10.0 255.255.255.0 192.168.1.171&#xA;ip route 192.168.2.0 255.255.255.0 192.168.1.171&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.1.171&#xA;ip route 10.0.11.0 255.255.255.0 192.168.1.171&#xA;ip route 172.16.10.0 255.255.255.0 192.168.1.171&#xA;ip route 192.168.2.0 255.255.255.0 192.168.1.171&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess I don't understand the purpose of the Cisco 1921 router. You are routing the same networks on both the 1921 and the ASA. It looks like you are using the ASA as the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could remove the 1921 and change DHCP to point the gateways to the ASA itself. Alternatively, you could move DHCP to the 1921 and remove the VLANs from the ASA. In either case, you only need the VLANs on one of the devices, and have the &lt;code&gt;192.168.1.0/24&lt;/code&gt; link between them (you don't need to use a &lt;code&gt;/24&lt;/code&gt; because a &lt;code&gt;/31&lt;/code&gt; or, more traditionally, a &lt;code&gt;/30&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using static routing, as you have configured, doesn't scale, and, as you have discovered, causes you to manually make changes, which increases the possibility of problems or errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want both the router and the ASA, you can use OSPF to exchange routes. The ASA would the inject the default route into OSPF, and the 1921 would inject the VLAN routes into OSPF. Each device would automatically learn the routes from the other device through OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on what you have, I would just eliminate the Cisco 1921 router, and change the gateways provided by the ASA. You would need to make the VLAN interfaces on the ASA be inside interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-15T20:39:25.460" LastActivityDate="2016-03-15T20:39:25.460" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28707" PostTypeId="1" AcceptedAnswerId="28709" CreationDate="2016-03-15T17:25:11.437" Score="9" ViewCount="3519" Body="&lt;p&gt;Why is the ICMP protocol considered to run at layer 3 on the Wikipedia page (same layer as IP) when the ICMP protocol data is a payload of the IP packet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the article on Wikipedia that states that ICMP is in the same layer as IP protocol. I am confused about this.&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_protocol_suite&quot; rel=&quot;noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Internet_protocol_suite&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23730" LastEditorUserId="8499" LastEditDate="2018-03-21T00:48:11.677" LastActivityDate="2021-01-11T21:31:42.977" Title="Why is the ICMP protocol considered to run at layer 3 on the Wikipedia page?" Tags="|ipv4|protocol-theory|layer3|osi|icmp|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28708" PostTypeId="2" ParentId="28704" CreationDate="2016-03-15T17:25:51.293" Score="4" Body="&lt;p&gt;You need to ask the AHJ (Authority Having Jurisdiction), such as your local fire or building inspector. Those are the guys who will make the final determination, and they can fine you and shut the building down until violations are remediated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When running cabling, you should also consult the ANSI/TIA-569-C &lt;em&gt;Commercial Building Standard for Telecommunications Pathways and Spaces&lt;/em&gt;. Here is an &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=2&amp;amp;ved=0ahUKEwjouK7VmMPLAhUKk4MKHU30D6IQFggkMAE&amp;amp;url=https%3A%2F%2Fwww.belden.com%2Fdocs%2Fupload%2F2030.pdf&amp;amp;usg=AFQjCNFQGQtC3-BmISygbABu0px1kRUEYQ&amp;amp;sig2=UjcaYMX-rCvXpPWvNuc__w&amp;amp;cad=rja&quot; rel=&quot;nofollow&quot;&gt;overview document&lt;/a&gt;, and what it says about that:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Power Separation&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Co-installation of telecommunications cable and power cable is&#xA;  governed by applicable electrical code for safety. In addition, the&#xA;  following precautions should be considered in order to reduce noise&#xA;  coupling from sources such as electrical power wiring, radio frequency&#xA;  (RF) sources, large motors and generators, induction heaters, and arc&#xA;  welders;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Increased physical separation&lt;/li&gt;&#xA;  &lt;li&gt;Electrical branch circuit line, neutral, and grounding conductors    should be maintained close together (e.g., twisted, sheathed, taped,&lt;br&gt;&#xA;  or bundled together) for minimizing inductive coupling into&lt;br&gt;&#xA;  telecommunications cabling&lt;/li&gt;&#xA;  &lt;li&gt;Use of surge protectors in branch circuits can further limit the    propagation of electrical surges.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Use of fully enclosed, grounded metallic raceway or grounded conduit&#xA;  or use of cable installed close to a grounded metallic surface will&#xA;  also limit inductive noise coupling.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The NEC (National Electric Code), NFPA 70, also has much to say about cabling. It has been adopted by all 50 states and most local jurisdictions. It doesn't just deal with power lines; there is quite a bit of it which deals with low-voltage (network) cabling.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-15T21:53:10.630" LastActivityDate="2016-03-15T21:53:10.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28709" PostTypeId="2" ParentId="28707" CreationDate="2016-03-15T17:31:21.170" Score="8" Body="&lt;p&gt;There is much controversy about which protocols run at which layers in the models. Understand that the models, e.g. OSI Model, are just models,  and the real world is often different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are people on both sides of ICMP layer placement. Remember that Wikipedia is maintained by everyone, including you. If you disagree with what is in an article, you are free to change it, or add something explaining why it should be a layer-4 protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also other sources you should consult. In the end, you make up your own mind about where you think it belongs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-16T16:12:55.540" LastActivityDate="2016-03-16T16:12:55.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28713" PostTypeId="1" CreationDate="2016-03-15T20:17:57.173" Score="2" ViewCount="1241" Body="&lt;p&gt;What are the possible and efficient ways to load-balance users among multiple PPPoE servers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried with VRRP. Is there any other efficient way?&lt;/p&gt;&#xA;" OwnerUserId="23428" LastEditorUserId="8499" LastEditDate="2016-03-16T14:16:18.463" LastActivityDate="2016-04-17T10:09:54.040" Title="Load balancing among multiple PPPoE servers" Tags="|pppoe|load-balancing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28716" PostTypeId="1" CreationDate="2016-03-15T22:25:43.923" Score="4" ViewCount="29099" Body="&lt;p&gt;I have the feeling the more I read about MSTP, the more confused I get. So here we are in order to make things clear once and for all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli_rel_4_0_1a/CLIConfigurationGuide/MST.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli_rel_4_0_1a/CLIConfigurationGuide/MST.html&lt;/a&gt; says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A CIST is a collection of the ISTs in each MST region. The CIST is the&#xA;  same as an IST inside an MST region, and the same as a CST outside an&#xA;  MST region.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Later in the document it says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An MST region looks like a single switch to the CIST.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which contradicts the sentence above, AFAIAC.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now to the questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Now what &lt;em&gt;exactly&lt;/em&gt; are the CST, the IST, and the CIST? Can someone draw me a simple MSTP topology with CST in red, IST in yellow, and CIST in green, so as to have a final reference without any ambiguous texts to be interpreted? :)&lt;/li&gt;&#xA;&lt;li&gt;Which of them is relevant considering the actual protocol, i.e. the BPDUs? I.e. What happens when an ISL inside a region drops? What happens when an ISL between regions drops? Which parts of the network will recompute their topology and why?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/atSiP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/atSiP.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="2329" LastEditDate="2016-03-16T12:54:51.353" LastActivityDate="2018-03-10T17:48:38.373" Title="Multiple spanning tree terminology (CST/IST/CIST) and exact behavior" Tags="|spanning-tree|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28717" PostTypeId="2" ParentId="28716" CreationDate="2016-03-15T23:02:56.677" Score="4" Body="&lt;p&gt;You jumped ahead to configuring MST instead of reading the Cisco documentation describing MST, &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24248-147.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding Multiple Spanning Tree Protocol (802.1s)&lt;/a&gt;. This document has multiple, colored diagrams, and a pretty good explanation of terms.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The IEEE 802.1s committee adopted a much easier and simpler approach&#xA;  that introduced MST regions. Think of a region as the equivalent of&#xA;  Border Gateway Protocol (BGP) Autonomous Systems, which is a group of&#xA;  switches placed under a common administration.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In order to clearly understand the role of the IST instance, remember&#xA;  that MST originates from the IEEE. Therefore, MST must be able to&#xA;  interact with 802.1q-based networks, because 802.1q is another IEEE&#xA;  standard. For 802.1q, a bridged network only implements a single&#xA;  spanning tree (CST). The IST instance is simply an RSTP instance that&#xA;  extends the CST inside the MST region.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The IST instance receives and sends BPDUs to the CST. The IST can&#xA;  represent the entire MST region as a CST virtual bridge to the outside&#xA;  world.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It all makes a lot more sense with the diagrams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also see &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/spantree.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;STP and MST&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;IST, CIST, and CST Overview&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Unlike other spanning tree protocols, in which all the spanning tree&#xA;  instances are independent, MST establishes and maintains IST, CIST,&#xA;  and CST spanning trees:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;An IST is the spanning tree that runs in an MST region.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Within each MST region, MST maintains multiple spanning tree instances. Instance 0 is a special instance for a region, known as&#xA;  the IST. All other MST instances are numbered from 1 to 4094.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The IST is the only spanning tree instance that sends and receives BPDUs. All of the other spanning tree instance information&#xA;  is contained in MSTP records (M-records), which are encapsulated&#xA;  within MST BPDUs. Because the MST BPDU carries information for all &#xA;  instances, the number of BPDUs that need to be processed to support&#xA;  multiple spanning tree instances is significantly reduced.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;All MST instances within the same region share the same protocol timers, but each MST instance has its own topology&#xA;  parameters, such as root bridge ID, root path cost, and so forth.&#xA;  By default, all VLANs are assigned to the IST.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;An MST instance is local to the region; for example, MST instance 1 in region A is independent of MST instance 1 in region&#xA;  B, even if regions A and B are interconnected.  &lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;A CIST is a collection of the ISTs in each MST region.&lt;/li&gt;&#xA;  &lt;li&gt;The CST interconnects the MST regions and single spanning trees.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;The spanning tree computed in a region appears as a subtree in the CST&#xA;  that encompasses the entire switched domain. The CIST is formed by the&#xA;  spanning tree algorithm running among switches that support the&#xA;  802.1w, 802.1s, and 802.1D standards. The CIST inside an MST region is the same as the CST outside a region.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For more information, see the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/spantree.html#wp1098510&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Spanning Tree Operation Within an MST&#xA;  Region&quot; section&lt;/a&gt; and the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/spantree.html#wp1098546&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;Spanning Tree Operations Between MST&#xA;  Regions&quot; section&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/I9EFs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I9EFs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Only the CST instance sends and receives BPDUs, and MST instances add&#xA;  their spanning tree information into the BPDUs to interact with&#xA;  neighboring switches and compute the final spanning tree topology.&#xA;  Because of this, the spanning tree parameters related to BPDU&#xA;  transmission (for example, hello time, forward time, max-age, and&#xA;  max-hops) are configured only on the CST instance but affect all MST&#xA;  instances. Parameters related to the spanning tree topology (for&#xA;  example, switch priority, port VLAN cost, and port VLAN priority) can&#xA;  be configured on both the CST instance and the MST instance.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;MST switches use Version 3 BPDUs or 802.1D STP BPDUs to communicate&#xA;  with 802.1D switches. MST switches use MST BPDUs to communicate with&#xA;  MST switches.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;IEEE 802.1s Terminology&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Some MST naming conventions used in the prestandard implementation&#xA;  have been changed to include identification of some internal and&#xA;  regional parameters. These parameters are used only within an MST&#xA;  region, compared to external parameters that are used throughout the&#xA;  whole network. Because the CIST is the only spanning tree instance&#xA;  that spans the whole network, only the CIST parameters require the&#xA;  external qualifiers and not the internal or regional qualifiers.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The CIST root is the root bridge for the CIST, which is the unique instance that spans the whole network.&lt;/li&gt;&#xA;  &lt;li&gt;The CIST external root path cost is the cost to the CIST root. This cost is left unchanged within an MST region. Remember that an MST&#xA;  region looks like a single switch to the CIST. The CIST external root &#xA;  path cost is the root path cost calculated between these virtual&#xA;  switches and switches that do not belong to any region.&lt;/li&gt;&#xA;  &lt;li&gt;The CIST regional root was called the IST master in the prestandard implementation. If the CIST root is in the region, the CIST regional&#xA;  root is the CIST root. Otherwise, the CIST regional root is the&#xA;  closest switch to the CIST root in the region. The CIST regional root&#xA;  acts as a root bridge for the IST.&lt;/li&gt;&#xA;  &lt;li&gt;The CIST internal root path cost is the cost to the CIST regional   root in a region. This cost is only relevant to the IST, instance 0.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-15T23:29:51.783" LastActivityDate="2016-03-15T23:29:51.783" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28721" PostTypeId="1" AcceptedAnswerId="28731" CreationDate="2016-03-16T05:53:11.263" Score="1" ViewCount="101" Body="&lt;p&gt;Say you have 2 WiFi-enabled devices (e.g. 2 smartphones running a Linux-based OS) A and B, within range of each other, and within range of an access point of some WLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of them have their Wi-Fi enabled, however B is not connected to the WLAN network (A is and has an IP address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is it possible for A to become aware of the existence of B?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under these circumstances, B doesn't have an IP address assigned to it, so a 'ping sweep' across the range of IPs of the WLAN A is connected to is pointless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, since Wi-Fi is enabled, their PHY and MAC layers are operational. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there some PHY/MAC layer feature/protocol in 802.11 which can be exploited so that one of the devices becomes aware of the MAC addresses surrounding it?&#xA;E.g. some MAC-level challenge/response protocol, beacons of some sort?&lt;/li&gt;&#xA;&lt;li&gt;If A runs an application which listens on its wlan0 interface - e.g. built with libpcap or tcpdump - can it become aware of B by examining the captured frames?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23332" LastEditorUserId="17011" LastEditDate="2016-03-16T10:55:16.447" LastActivityDate="2016-03-16T10:55:16.447" Title="Detecting MAC addresses in a shared medium using WLAN/802.11 features" Tags="|ieee-802.11|mac-address|mac|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28722" PostTypeId="1" AcceptedAnswerId="28729" CreationDate="2016-03-16T08:12:05.473" Score="2" ViewCount="85" Body="&lt;p&gt;I'm playing around with BGP on Quagga.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have three routers, R1, R2 and R3, connected in sequence and have R2 and R3 send a few routes to R1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;R1 -- R2 -- R3&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration of R1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 10&#xA;router-id 1.1.1.1&#xA;network 10.10.10.0 255.255.255.0&#xA;network 12.12.12.0 255.255.255.0&#xA;network 192.168.2.0 255.255.255.0&#xA;neighbor 192.168.2.23 remote-as 10&#xA;neighbor 10.10.10.2 remote-as 20&#xA;neighbor 10.10.10.2 route-map D1 in&#xA;exit&#xA;&#xA;ip as-path access-list 20 permit 30$&#xA;&#xA;route-map D1 deny 90&#xA;match as-path 20&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration of R2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 20&#xA;router-id 2.2.2.2&#xA;network 10.10.10.0 255.255.255.0&#xA;network 20.20.20.0 255.255.255.0&#xA;neighbor 10.10.10.1 remote-as 10&#xA;neighbor 20.20.20.3 remote-as 30&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration of R3:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 30&#xA;router-id 3.0.3.33&#xA;network 20.20.20.0 255.255.255.0&#xA;network 30.30.30.0 255.255.255.0&#xA;neighbor 20.20.20.2 remote-as 20&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This setup ended up that &lt;strong&gt;route-map on R1 has removed all routes it has received.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought I would only remove routes from AS 30?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no experience on Cisco routers or else, so I cannot tell if it is an implementation bug or intended.&lt;/p&gt;&#xA;" OwnerUserId="20657" LastEditorUserId="17011" LastEditDate="2016-03-16T10:55:07.540" LastActivityDate="2016-03-16T10:55:07.540" Title="Confused about route-map" Tags="|router|bgp|quagga|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28723" PostTypeId="1" AcceptedAnswerId="28727" CreationDate="2016-03-16T09:17:55.093" Score="9" ViewCount="10938" Body="&lt;p&gt;I have been reading the &lt;code&gt;IPv6 Flow Label Specification&lt;/code&gt; (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6437&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6437&lt;/a&gt;) and I would like to ask about the purpose of setting this label.&lt;/p&gt;&#xA;&lt;p&gt;In case of just using the 2-tuple (source address, destination address), the packets will reach the destination.&lt;/p&gt;&#xA;&lt;p&gt;And since some hosts do not support the functions of the flow label field, this label might end up having a value of 0 anyways.&lt;/p&gt;&#xA;" OwnerUserId="23751" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2022-09-14T14:17:45.057" Title="Usage of Flow label in IPv6 header?" Tags="|ip|ipv6|protocol-theory|rfc|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28724" PostTypeId="1" AcceptedAnswerId="28746" CreationDate="2016-03-16T09:22:13.693" Score="1" ViewCount="309" Body="&lt;p&gt;I have the following IPv6 addresses range, with netmask 64 :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;A:B:C:D:E:0000:0000:0000&lt;/code&gt; -&gt; &lt;code&gt;A:B:C:D:E:0000:0000:FFFF&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to assign some of them to virtual machines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I use &lt;code&gt;A:B:C:D:E:0000:0000:0000&lt;/code&gt; or should I start with &lt;code&gt;::1&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="23750" LastEditorUserId="17011" LastEditDate="2016-03-16T10:06:33.953" LastActivityDate="2016-03-16T15:29:53.353" Title="Proper way to use IPv6 address range" Tags="|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28725" PostTypeId="1" CreationDate="2016-03-16T09:34:10.613" Score="1" ViewCount="881" Body="&lt;p&gt;I would like to know whether is there any option to convert the non-PoE switches, Cisco 2960X-48TS-L and Cisco 2960X-24TS-L, to PoE Switches.&lt;/p&gt;&#xA;" OwnerUserId="23753" LastEditorUserId="8499" LastEditDate="2016-03-16T14:20:40.950" LastActivityDate="2016-03-16T14:20:40.950" Title="Enable PoE on Cisco non-PoE switches" Tags="|cisco|switch|power-over-ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28726" PostTypeId="2" ParentId="28725" CreationDate="2016-03-16T09:42:38.617" Score="4" Body="&lt;p&gt;You cannot convert switches so they become POE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you can use special devices that are called &quot;POE Injectors&quot; in addition to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They exist in 24 and 48 ports (and other size) versions. &lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-16T09:42:38.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28727" PostTypeId="2" ParentId="28723" CreationDate="2016-03-16T09:48:12.927" Score="1" Body="&lt;p&gt;The purpose of flow label is  to maintain the sequential flow of the packets belonging to a communication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source labels the sequence to help the router identify that a particular packet belongs to a specific flow of information. Basically it is designed to avoid reordering of data packets.&lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2016-03-16T09:48:12.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28729" PostTypeId="2" ParentId="28722" CreationDate="2016-03-16T10:33:56.233" Score="2" Body="&lt;p&gt;Like access lists, route-maps have an implicit &quot;deny all&quot; at the end.  Stanza 90 denies packets it matches, and then everything else is denied by the implicit deny.  You need a &quot;permit all&quot; statement at the end like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip as-path access-list 20 permit 30$&#xA;&#xA;route-map D1 deny 90&#xA;match as-path 20&#xA;&#xA;route-map D1 permit 100&#xA;&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-16T10:33:56.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28731" PostTypeId="2" ParentId="28721" CreationDate="2016-03-16T10:46:06.830" Score="3" Body="&lt;p&gt;For A to detect B, it has go into &quot;monitor mode&quot; and listen on every channel (there's no guarantee B is even on the same channel) for 802.11 headers.  But doing so means A is no longer associated with the WLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;B might be sending out probes requests, but that also isn't guaranteed. Even if it is, you still have the problem of identifying B if you don't already know its MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark, for example, does what you are looking for.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-16T10:46:06.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28732" PostTypeId="1" AcceptedAnswerId="28733" CreationDate="2016-03-16T11:01:14.297" Score="1" ViewCount="495" Body="&lt;p&gt;it sounds a bit strange, but how can i find out the IP Address which i can connect to? The Switch works fine, but i need to do some changes. &#xA;I have console access to it, but i want it, because it's more comfortable, to do over SSH. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;rsa &amp;amp; dsa keys are generated und ip ssh server enabled. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I only need to know which IP address the Switch has. It is our only DELL Switch in the company. The others are Cisco.&lt;/p&gt;&#xA;" OwnerUserId="22401" LastActivityDate="2016-03-16T13:54:36.830" Title="DELL Powerconnect 5324 SSH" Tags="|switch|ip|ssh|dell|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28733" PostTypeId="2" ParentId="28732" CreationDate="2016-03-16T11:19:40.983" Score="1" Body="&lt;p&gt;You have to look in the configuration of &lt;code&gt;interface vlan 1&lt;/code&gt; (in a &quot;&lt;code&gt;show running-config&lt;/code&gt;&quot; result)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's no IP address under interface vlan 1, then you can configure it with the following commands (thanks to &lt;a href=&quot;http://www.stevejenkins.com/blog/2011/05/dell-powerconnect-5324-setup-tasks/&quot; rel=&quot;nofollow&quot;&gt;Steve Jenkins&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;console&amp;gt; enable&#xA;console# config&#xA;console# interface vlan 1&#xA;console(config-if)# ip address 192.168.1.222 /24&#xA;console(config-if)#ip default-gateway 192.168.1.1&#xA;console(config-if)# exit&#xA;config(config)# exit&#xA;console#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will find the manual at &lt;a href=&quot;http://www.dell.com/support/home/us/en/19/product-support/product/powerconnect-5324/manuals&quot; rel=&quot;nofollow&quot;&gt;this Dell support page&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="8499" LastEditDate="2016-03-16T13:54:36.830" LastActivityDate="2016-03-16T13:54:36.830" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28734" PostTypeId="1" AcceptedAnswerId="28745" CreationDate="2016-03-16T12:16:26.617" Score="1" ViewCount="1151" Body="&lt;p&gt;I was thinking about capturing iPhone traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have created a hosted network to which I can connect my iPhone. I'm able to filter the traffic for server IP addresses which are known, such as Google, Facebook etc. (&lt;code&gt;ping &amp;lt;address&amp;gt;&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that I have to monitor the ethernet connection on my PC, and my PC gets a lot of background ethernet actions. Is it somehow possible to just display the activity from the hosted network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: The IP address from which the packages my iPhone sends is the same as my PC's IP address.&lt;/p&gt;&#xA;" OwnerUserId="23757" LastEditorUserId="8499" LastEditDate="2016-03-16T13:58:41.807" LastActivityDate="2017-09-02T19:02:13.143" Title="Wireshark filter the Wireless Hosted Network (Win7/8/10)" Tags="|wireshark|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28735" PostTypeId="1" AcceptedAnswerId="28736" CreationDate="2016-03-16T12:54:17.287" Score="1" ViewCount="346" Body="&lt;p&gt;I'm currently creating a tool that will allow users to configure SPAN ports on a Cisco switch, and I was going to implement a feature that would allow a user to create a VLAN and add ports to it so it can be set as a source for the SPAN port without having to configure it on command line. But I can't see a reason why a user would set up a VLAN on a local session, it would make more sense to me if they simply just assigned the ports they want to monitor instead of assigning them to a VLAN and then assigning the VLAN as the source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain to me why I would use a VLAN, or is my statement above correct, and there is no need to set up a VLAN?&lt;/p&gt;&#xA;" OwnerUserId="22709" LastEditorUserId="220" LastEditDate="2016-03-16T14:30:33.170" LastActivityDate="2016-03-16T14:30:33.170" Title="VLANs on a span port" Tags="|cisco|switch|vlan|mirror|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28736" PostTypeId="2" ParentId="28735" CreationDate="2016-03-16T13:32:39.827" Score="1" Body="&lt;p&gt;There are different types of span. You can either use local span if you're all computers are on the same switch or you can use remote span but most of the switches does not support a remote span.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason behind using VLAN is, you can monitor all ports that belongs to a particular VLAN in a single command.&lt;/p&gt;&#xA;" OwnerUserId="22728" LastEditorUserId="22728" LastEditDate="2016-03-16T14:19:02.307" LastActivityDate="2016-03-16T14:19:02.307" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28738" PostTypeId="1" AcceptedAnswerId="28743" CreationDate="2016-03-16T13:56:47.740" Score="1" ViewCount="658" Body="&lt;p&gt;I have a router with two interfaces, the interface &lt;code&gt;0/0&lt;/code&gt; has an IP address of &lt;code&gt;72.40.40.1 255.255.254.0&lt;/code&gt;, and it is connected to another router that has the same IP address, mask, and interface. When I try to ping the other router, it pings its own interface, and I can't reach the other router to make sure it works.&lt;/p&gt;&#xA;" OwnerUserId="23760" LastEditorUserId="8499" LastEditDate="2016-03-16T15:08:56.963" LastActivityDate="2016-03-16T15:08:56.963" Title="How to ping a router which has same IP address and mask?" Tags="|cisco|routing|router|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28739" PostTypeId="2" ParentId="28738" CreationDate="2016-03-16T14:07:40.060" Score="8" Body="&lt;p&gt;If you have two routers with the same IP in the same subnet, then nothing is sure to work. An IP-address must be unique in the subnet.&lt;/p&gt;&#xA;" OwnerUserId="23741" LastActivityDate="2016-03-16T14:07:40.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28741" PostTypeId="1" AcceptedAnswerId="28753" CreationDate="2016-03-16T14:39:33.490" Score="1" ViewCount="374" Body="&lt;p&gt;Can they be made to announce their presence somehow using layer 2 frames without them be connected to any network or access point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can their MAC address be found?&lt;/p&gt;&#xA;" OwnerUserId="23730" LastEditorUserId="8499" LastEditDate="2016-03-16T14:46:37.283" LastActivityDate="2016-03-16T23:13:24.453" Title="Do wireless devices such as smartphones transmit beacon equivalent frames such as APs do?" Tags="|wireless|mac-address|mobile|ad-hoc-wireless|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28742" PostTypeId="1" AcceptedAnswerId="28744" CreationDate="2016-03-16T14:45:02.627" Score="1" ViewCount="392" Body="&lt;p&gt;Supposing the IP address is correct and the gateway IP address is also correct, but the mask is different than the one in the router/default gateway.&lt;/p&gt;&#xA;" OwnerUserId="23730" LastEditorUserId="8499" LastEditDate="2016-03-16T14:53:18.613" LastActivityDate="2016-03-16T16:03:42.300" Title="What are the problems that can arise if a network host has the subnet mask configured improperly?" Tags="|router|ipv4|subnet|ip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28743" PostTypeId="2" ParentId="28738" CreationDate="2016-03-16T14:55:24.613" Score="3" Body="&lt;p&gt;Peter is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your router will look in it's ARP table for the MAC address associated with the IP address you've asked it to PING. Since the IP address is used by your &lt;code&gt;0/0&lt;/code&gt; interface, there will always be a permanent ARP table entry for the IP address with the &lt;code&gt;0/0&lt;/code&gt; interfaces' MAC address, so it will never even send an ARP broadcast, knowing the IP address is local.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can add two unique secondary IP addresses to both routers' interfaces, in a different (otherwise unused) subnet, you could ping the other router at that secondary address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, after answering your question as written, to expand on Peter's answer, if two devices in a subnet are using the same IP address, they will both reply to ARP requests, providing unpredictable results when other hosts try to reach the routers or anything beyond those routers. Based on timing of the ARP replies being received, packets may go to/through one router or the other. That may or may not be a problem (if any state-tracking devices are in the path, such as firewalls or VPN tunnels, it WILL be a problem), but it is definitely considered an incorrect configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is likely to be a better, more reliable way to do whatever is being attempted by using the same IP address on two routers - since you mentioned you're trying to make sure the other router works, you might want to look into HSRP (Cisco proprietary) or VRRP (industry standard), where the two routers have unique IP addresses (in your case, &lt;code&gt;72.40.40.2&lt;/code&gt; and &lt;code&gt;72.40.40.3&lt;/code&gt; would be good choices if available, or maybe &lt;code&gt;72.40.41.253&lt;/code&gt; and &lt;code&gt;72.40.41.254&lt;/code&gt;, but any two unique IP addresses in the subnet), and share a &quot;standby&quot; IP address (&lt;code&gt;72.40.40.1&lt;/code&gt;) that is used by clients connecting to/through the router(s).  Only one router at a time uses the standby IP address, and they communicate to coordinate fail-over / fail-back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If HSRP or VRRP is not available, or will not work, another method is to give each router it's own IP address and add both routers as equal cost routes on the devices that send traffic through them. If the routers are supposed to be the default gateway for client machines, this may not work, and it can cause duplicate packets to be sent out in some cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going more esoteric, if the devices are Cisco switches that support stacking modules, and they're connecting to the same switch or another stacked switch, Multi-chassis Etherchannel might do what you're looking for redundancy-wise - it would be a way to bond both interfaces and give the port group a single IP address. VSS can do similar things in higher end switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hard to know what direction to go in to resolve the multiple hosts with one IP address problem you've reported without knowing what other problem was being addressed to create this situation.&lt;/p&gt;&#xA;" OwnerUserId="23764" LastEditorUserId="8499" LastEditDate="2016-03-16T15:06:56.930" LastActivityDate="2016-03-16T15:06:56.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28744" PostTypeId="2" ParentId="28742" CreationDate="2016-03-16T14:57:55.770" Score="3" Body="&lt;p&gt;A host masks its own IP address and the destination IP address. If the results are equal, the destination is on the same network, and the host will look for the destination MAC address in its ARP cache, send an ARP request if it is not found, then send the resulting frame via layer-2. If the network is not the same, the host will send the frame to its configured gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the host mask is larger than the network mask, the host will not be able to communicate with all the IP addresses in the network since it will send packets for those addresses outside the mask to the gateway, which will ignore them because they are on the same network as the gateway sees it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the host mask is smaller than the network mask, the host will not be able to communicate with hosts in any other networks encompassed by the mask since it will never send the packets to the gateway as it must to reach those networks.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-16T16:03:42.300" LastActivityDate="2016-03-16T16:03:42.300" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28745" PostTypeId="2" ParentId="28734" CreationDate="2016-03-16T15:09:23.010" Score="0" Body="&lt;p&gt;According to:&#xA;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/dd815243%28v=vs.85%29.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/desktop/dd815243%28v=vs.85%29.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireless Hosted Networking creates virtual wireless adapters, including a SoftAP adapter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that adapter shows up in the list of interfaces Wireshark can capture on, choosing the SoftAP adapter instead of the adapter your computer uses for it's Internet connection should narrow down what packets you see and let you see the iPhone's Wi-Fi IP and MAC addresses, which will both be different from your computer's addresses.  If you've been capturing on the hosting computer's Internet-facing interface, you're probably seeing the iPhone's traffic after it gets NATed to the same IP and MAC addresses as your computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you switch which interface you're capturing on, you can filter by the MAC address of your iPhone:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://ask.wireshark.org/questions/14368/capture-filter-mac&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ask.wireshark.org/questions/14368/capture-filter-mac&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find an iPhone's Wi-Fi MAC address in:&lt;br&gt;&#xA;Settings: General: About&lt;br&gt;&#xA;under &quot;Wi-Fi Address&quot;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also filter on the IP address of the iPhone. If you can't figure that address out with a short capture on the AP interface, you can find it by tapping the blue-circled &quot;i&quot; next to the SSID (network name) of your hosted Wi-Fi in Settings: Wi-Fi.&lt;/p&gt;&#xA;" OwnerUserId="23764" LastEditorUserId="-1" LastEditDate="2017-09-02T19:02:13.143" LastActivityDate="2017-09-02T19:02:13.143" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28746" PostTypeId="2" ParentId="28724" CreationDate="2016-03-16T15:21:23.487" Score="0" Body="&lt;p&gt;Though it is possible to allocate addresses to virtual machines from the link prefix connecting the physical machine to a router, that is not the approach I would recommend.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rather I would recommend that you get the hosting provider to route a shorter prefix to your physical machine. The prefix length you need depend on the number of VMs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For 1 VM you need a /64&lt;/li&gt;&#xA;&lt;li&gt;For 2 - 14 VMs you need a /60&lt;/li&gt;&#xA;&lt;li&gt;For 9 - 194 VMs you need a /56&lt;/li&gt;&#xA;&lt;li&gt;For 84 - 2702 VMs you need a /52&lt;/li&gt;&#xA;&lt;li&gt;For 776 - 37641 VMs you need a /48&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Those numbers are assuming the provider only hand out prefixes on nibble boundaries and that you want a /64 per VM. The overlap between the ranges is because I allowed for an HD-ratio anywhere between 80% and 95%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reasons I would recommend getting a prefix routed to the physical machine and subdivide that into a link prefix per VM are twofold.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A link prefix per VM give you better isolation between the VMs.&lt;/li&gt;&#xA;&lt;li&gt;The router no longer need to do neighbor discovery for each VM, which reduce memory usage on the router and traffic on the physical link.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If the hosting provider for some reason refuse to route a prefix to your physical machine, then you can instead bridge between virtual and physical interfaces. This has multiple drawbacks:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Some VM network bridging implementations have problems with packets being transferred between guest and host. This can lead to scenarios where your guests can communicate with the world but not with the host.&lt;/li&gt;&#xA;&lt;li&gt;The MAC address you allocate to each VM will be directly visible to the hosting provider's router. In case the hosting provider are filtering traffic based on MAC address, it may cause legitimate traffic from your VMs to be dropped. That can require dirty workarounds.&lt;/li&gt;&#xA;&lt;li&gt;It would be possible for the VMs to spoof each other's IP addresses.&lt;/li&gt;&#xA;&lt;li&gt;More traffic and memory will be needed for neighbor discovery.&lt;/li&gt;&#xA;&lt;li&gt;More CPU cycles will be needed since each VM need to process each ND packet. This can be mitigated if the bridging implementation understands IPv6 anycast and limits which VM will see each packet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="5842" LastEditorUserId="5842" LastEditDate="2016-03-16T15:29:53.353" LastActivityDate="2016-03-16T15:29:53.353" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="28747" PostTypeId="1" AcceptedAnswerId="28750" CreationDate="2016-03-16T16:04:29.870" Score="1" ViewCount="415" Body="&lt;p&gt;I have created a bar chart in Java that will display the current percent load on a each destination port per SPAN session. I have a refresh time of 30 seconds using the &lt;code&gt;show interfaces&lt;/code&gt; command to update the values of the chart, and I was wondering if I put the refresh time to 5 or 10 seconds, would this cause any performance issues on the Cisco switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no experience with Cisco switches, otherwise I would be off figuring this out myself.&lt;/p&gt;&#xA;" OwnerUserId="22709" LastEditorUserId="8499" LastEditDate="2016-03-16T16:16:02.773" LastActivityDate="2016-03-16T16:53:12.273" Title="Destination port load on a SPAN session" Tags="|cisco|switch|monitoring|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28748" PostTypeId="2" ParentId="28707" CreationDate="2016-03-16T16:07:19.080" Score="12" Body="&lt;p&gt;The original RFC for ICMP, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc777&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC777&lt;/a&gt; state that:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ICMP, uses the basic support of IP as if it were a higher level&#xA;protocol, however, &lt;strong&gt;ICMP is actually an integral part of IP,&lt;/strong&gt; and must&#xA;be implemented by every IP module.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This statement is also present in RFC792 which obsoletes RFC777.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2018-03-02T07:38:02.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28749" PostTypeId="2" ParentId="28747" CreationDate="2016-03-16T16:18:26.907" Score="0" Body="&lt;p&gt;The answer to this will greatly depend on the particular switch model and current switching load. This could impact low-end models which have a heavy load, but it may be negligible on high-end switches. For instance, a switch doing a lot of things which eat CPU processing, like QoS marking, DHCP snooping, dynamic ARP inspection, IGMP snooping, etc., may  have its CPU utilization impacted if it is a low-end device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no one-size-fits-all answer to your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, are you using the &lt;code&gt;load-interval&lt;/code&gt; command on the interface(s)? This will determine the time period over which the interface statistics are calculated. If you leave it at the default of 60 seconds, your 30 second refresh will include statistics over a 60 second time period.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-16T16:53:12.273" LastActivityDate="2016-03-16T16:53:12.273" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28750" PostTypeId="2" ParentId="28747" CreationDate="2016-03-16T16:24:09.737" Score="1" Body="&lt;p&gt;The SPAN feature has no impact on the performance. SPAN port features vary among switch vendors. Because of this, the impact SPAN has on switch operation can vary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a packet received on a port is transmitted on the internal switching bus. Every line card in the switch starts storing this packet in its internal buffers. At the same time, the Encoded Address Recognition Logic (EARL) receives the header of the packet and computes a result index that it sends to all the line cards via the result bus. Whether one or several ports eventually transmit the packet has absolutely no influence on the switch operation.&lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2016-03-16T16:24:09.737" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28751" PostTypeId="2" ParentId="28707" CreationDate="2016-03-16T16:37:36.403" Score="0" Body="&lt;p&gt;ICMP works only on Network Layer. You can test in Cisco Packet Tracer in &lt;strong&gt;simulation&lt;/strong&gt;. Run ping from PC to Destination. In simulation click on any packet. Then it displays Seven Layers(OSI). You will figured out. (I cleared my doubt in this way)   &lt;/p&gt;&#xA;" OwnerUserId="23732" LastActivityDate="2016-03-16T16:37:36.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28753" PostTypeId="2" ParentId="28741" CreationDate="2016-03-16T18:39:25.867" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Do wireless devices such as smartphones transmit beacon equivalent frames such as APs do?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A wireless client does not transmit beacon frames. However if a device is configured to provide service (i.e. tethering, etc), then it is acting as an access point and would transmit beacons.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can they be made to announce their presence somehow using layer 2 frames without them be connected to any network or access point?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not only can they, they do so on a regular basis. Client devices use &quot;probe requests&quot; to aid in discovery of nearby networks. This would be somewhat similar to the device shouting out &quot;Are there any networks nearby?&quot;  For more details, feel free to reference this other question about &lt;a href=&quot;https://networkengineering.stackexchange.com/q/17100/33&quot;&gt;How do wifi clients detect SSIDs from APs?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can their MAC address be found?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If they use their real MAC address, then yes. Some devices have started using fake MAC addresses when probing networks, however this can cause a number of problems in certain wireless environments.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-03-16T18:39:25.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28754" PostTypeId="1" CreationDate="2016-03-16T18:48:48.760" Score="1" ViewCount="3656" Body="&lt;p&gt;I have a bunch of phones that are tagged as VLANID 20 with priority 7. I have the router setup with VLAN Tagging as well to mark VLANID 20. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question in terms of switches. Do the switches need to be layer-3 for QoS and VLAN to work or can they also be layer-2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct that even if the switches pass VLAN ID tags and QoS, unless they are layer-3 and read the VLAN tags that tagging with QoS is pointless because the switches won't be trying to do QoS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, my goal is to try and separate 50 VoIP phones from 70 computers to improve quality of voice.&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="8499" LastEditDate="2018-03-21T01:15:14.540" LastActivityDate="2018-03-21T01:15:14.540" Title="VLAN Tags and QoS" Tags="|switch|vlan|layer2|qos|layer3|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28755" PostTypeId="2" ParentId="28754" CreationDate="2016-03-16T19:02:07.737" Score="2" Body="&lt;p&gt;Most business-grade, layer-2 switches support VLANs. You configure trunks to carry the multiple VLANs between switches and routers. How to do this, specifically, will depend on the switch model(s). VLAN tags are only used on trunks; frames on access ports are not tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN tagging really has nothing to do with IP QoS. Layer-2 frames have a COS, and layer-3 packets have a TOS, or DSCP. Different frames or packets with the same VLAN tag can have different QoS markings. As Daniel points out in the comment, the COS is only applied on frames with VLAN tags, but tagged frames only exist on trunks, not on access ports. Your switch(es) may support the minimal layer-2 QoS, and you would need to set the switch(es) up to apply COS markings and and queues on the switch(es), but this assumes your switches support layer-2 QoS, which is not normally very robust. Where you will really make a difference is with the layer-3 marking and router queuing based on those markings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VoIP data traffic is typically set to &lt;code&gt;EF&lt;/code&gt; (Expedited Forwarding), but you aren't doing that. Also, VoIP control traffic, on the same VLAN, is usually marked differently. A VoIP phone will, by default, mark its packets correctly, and you only need to trust on the VoIP VLAN. Marking VoIP the same as network control information, &lt;code&gt;7&lt;/code&gt;, is not usually a good thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to really understand is that your QoS markings and policies are only good on your network. Unless you have an agreement in place with your ISP ($$$), your ISP will not honor your QoS markings and policies. Also, any other carriers through which your packets travel will not honor your QoS markings or policies, and will likely mark them all to BE (Best Effort). If your VoIP problems are on the Internet, you can try to fix what is on you network, but you will have no control of the packet treatment on the Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-16T22:03:37.540" LastActivityDate="2016-03-16T22:03:37.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28756" PostTypeId="1" AcceptedAnswerId="28758" CreationDate="2016-03-16T19:23:17.230" Score="2" ViewCount="4855" Body="&lt;p&gt;Often in the interviews there is a question 'how many hosts this network can have and how many subnetworks?'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say we have &lt;code&gt;/30&lt;/code&gt; network. It has 4 addresses total, minus it's own network address and broadcast we have 2. I know these 2 can be hosts. Can they be networks?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if each of them is, say, wifi router with their own &lt;code&gt;192.168.56.X&lt;/code&gt; network. Are those wifi netowroks subnetworks of /30 and 2 router's addresses in /30 'mother' networks their &lt;em&gt;network adresses&lt;/em&gt;? &lt;/p&gt;&#xA;" OwnerUserId="10298" LastActivityDate="2016-03-27T12:38:33.990" Title="What's the difference between host and network address?" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="1" ClosedDate="2019-03-18T00:16:55.930" ContentLicense="CC BY-SA 3.0" />
  <row Id="28758" PostTypeId="2" ParentId="28756" CreationDate="2016-03-16T20:23:12.747" Score="4" Body="&lt;p&gt;It's funny you e-mailed me about this question, I'm writing another blog post at the moment that answers this very question. I should have it posted in the next few hours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: The &lt;a href=&quot;http://www.oznetnerd.com/2016/03/27/subnetting-made-easy-part-6/&quot; rel=&quot;nofollow&quot;&gt;blog post&lt;/a&gt; has now been published.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, let's get started on your question :)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Let's say we have /30 network. It has 4 addresses total, minus it's&#xA;  own network address and broadcast we have 2. I know these 2 can be&#xA;  hosts.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is spot on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 32 bits in an IP address. As you've got a /30 that means 30 of those bits are &quot;reserved&quot; network bits. As you know, you're not &quot;allowed&quot; to change network bits otherwise you're more than likely end up with IP address conflicts. This therefore leaves you with 2 &quot;Host&quot; bits which you are &quot;allowed&quot; to play with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you correctly point out, these 2 bits result in 4 addresses. However, when we use the 2 ^ n - 2 formula to determine the number of usable host addresses we're left with two addresses. As you already know, we subtract 2 in this formula to account for the first and last addresses in the subnet as they are the network and broadcast addresses respectively and cannot be assigned to a host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if I understand your question correctly you're asking can a /30 be used to create a couple of subnets. To calculate the number of subnets we'll get we need to use a formula which differs slightly from the one mentioned above - this formula is 2 ^ n (note that we do not subtract 2 here). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say we use the two host bits in this calculation - 2 ^ 2 = 4 subnets. However, as this uses &lt;strong&gt;all&lt;/strong&gt; of the host bits we don't have any left to allocate to the wifi routers. Because of this it would be more appropriate to use only 1 host bit for the subnet and leave the other bit for the hosts. Therefore our subnet calculation would look like this: 2 ^ 1 = 2 subnets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, we hit an issue here too. As as we've only got one host bit left we won't have any usable addresses because 2 ^ 1 - 2 = 0. Therefore the answer is no, you cannot subnet a /30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note: OK I may be fibbing a little here... there are some situations where you can use /31 and even /32 addresses (for example, loopback interfaces and point to point links) but they're another kettle of fish.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if you were asking about a /29 address instead, then the answer would be yes, you can use this network address to create two subnets with a couple of hosts each. Let's look at why:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;29 bits are reserved for the network and therefore we cannot use them. This leaves us with 3 bits.&lt;/li&gt;&#xA;&lt;li&gt;If we use one of these bits for our subnets we'd be given two subnets (2 ^ 1 = 2). This leaves us with 2 bits for hosts.&lt;/li&gt;&#xA;&lt;li&gt;Running these 2 left over bits through the above mentioned formula, we're left with two hosts per subnet (2 ^ 2 - 2 = 2).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The above means we'd have two subnets with two usable host addresses each. Or to word it a little differently, we'd have four usable addresses spread across two subnets.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2016-03-27T12:38:33.990" LastActivityDate="2016-03-27T12:38:33.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28762" PostTypeId="1" AcceptedAnswerId="28765" CreationDate="2016-03-16T21:35:51.773" Score="1" ViewCount="6786" Body="&lt;p&gt;Let's say I have two connected switches. I specifically configure (force) one of them to use full duplex and the other one I configure to use autonegotiation. Why does this config fail and the autoneg. function just can't adjust to the other port's full duplex? &lt;/p&gt;&#xA;" OwnerUserId="23777" LastEditorUserId="23777" LastEditDate="2016-03-17T19:33:31.367" LastActivityDate="2016-03-17T19:33:31.367" Title="Forced full duplex and autonegotiation" Tags="|switch|autonegotiation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28763" PostTypeId="2" ParentId="28707" CreationDate="2016-03-16T21:39:41.713" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is the ICMP protocol considered to run at layer 3 on the Wikipedia page?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As others have noted, the models are just that, models. So not everything in the real world always fits neatly into the models. ICMP is one such area where people will sometimes debate on which layer (L3, L3.5, or L4) it exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Despite these debates, ICMP is generally considered a L3 or network protocol because it isn't a transport layer protocol and L3.5 isn't an actual layer. Specifically, ICMP only provides structured data in the IP packet; it doesn't add anything that is considered another layer of headers like a L4 protocl like TCP or UDP do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, while ICMP does require IP to function, it is implemented as part of the IP protocol and only exists to communicate information about the network layer. For example, ping (Echo requests and Echo replies) only provide information about L3 reachability. They don't provide any information about any higher layer protocols.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is the ICMP protocol considered to run at layer 3 on the Wikipedia page (same layer as IP) when the ICMP protocol data is a payload of the IP packet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Whether the payload of an IP packet is raw data or a higher layer protocol is irrelevant to IP (L3). Or another way to say that would be just because an IP packet has a payload doesn't mean the payload is sourced from a higher layer protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same applies to L2, there are many examples (STP, CDP, and so on) of L2 frames containing data that has nothing at all to do with a L3 or higher protocol (i.e. no IP headers, etc). Again, just because the frame has a payload doesn't mean the payload is sourced from a higher layer protocol.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-03-16T21:39:41.713" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28764" PostTypeId="1" AcceptedAnswerId="28770" CreationDate="2016-03-16T21:39:51.567" Score="1" ViewCount="106" Body="&lt;p&gt;the 5 packages 333 -&gt; 337. What are those and why does the client do this? More generally, why does the client send five SYN-messages to the server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FCusI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FCusI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23557" LastEditorUserId="23557" LastEditDate="2016-03-16T21:46:12.367" LastActivityDate="2020-12-22T15:48:42.753" Title="Five consequtive SYN-messages from client to server" Tags="|tcp|protocol-theory|wireshark|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28765" PostTypeId="2" ParentId="28762" CreationDate="2016-03-16T21:41:59.177" Score="2" Body="&lt;p&gt;When you specifically set the speed and duplex on one side of a link, that side will not negotiate, so there is no negotiation which takes place. The other side can detect, not negotiate, the link speed and adjust to it, but because there is no negotiation, it sets the default duplex, based on the speed. The default duplex for 10BASE-T and 100BASE-TX is Half Duplex. The default duplex for 1000BASE-T is Full Duplex, and 10GBASE-T only has Full Duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a document with a table which shows what happens when different speed/duplex setting are configured on each end of a link: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/17053-46.html&quot; rel=&quot;nofollow&quot;&gt;Troubleshooting Cisco Catalyst Switches to NIC Compatibility Issues&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Why Is It That the Speed and Duplex Cannot Be Hardcoded on Only One Link Partner?&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;As indicated in Table 1, a manual setup of the speed and duplex for&#xA;  full-duplex on one link partner results in a duplex mismatch. This&#xA;  happens when you disable autonegotiation on one link partner while the&#xA;  other link partner defaults to a half-duplex configuration. A duplex&#xA;  mismatch results in slow performance, intermittent connectivity, data&#xA;  link errors, and other issues. If the intent is not to use&#xA;  autonegotiation, both link partners must be manually configured for&#xA;  speed and duplex for full-duplex settings.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-16T22:30:00.247" LastActivityDate="2016-03-16T22:30:00.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28766" PostTypeId="1" AcceptedAnswerId="28767" CreationDate="2016-03-16T21:58:14.540" Score="2" ViewCount="1499" Body="&lt;p&gt;I know that switches learn MAC addresses of connected devices on their own by ARP and ARP Reply messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can a newly started switch learn the MAC address of default router on its own by ARP, or do we have to configure it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please shed some light on how a device learns about default gateway in a network (network has a Device connected to switch, switch connected to default router only) where every device is new, does not have any information about other devices.&lt;/p&gt;&#xA;" OwnerUserId="10188" LastEditorUserId="8499" LastEditDate="2016-03-16T22:18:02.043" LastActivityDate="2016-03-16T22:25:14.310" Title="Switch learning MAC address of default router" Tags="|switch|mac-address|arp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28767" PostTypeId="2" ParentId="28766" CreationDate="2016-03-16T22:16:39.310" Score="3" Body="&lt;p&gt;Switches don't use ARP to learn MAC addresses. Switches lean which MAC address is on which port simply by inspecting the source addresses on frames which come into the switch ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches don't understand layer-3 (except for layer-3 switches). To the switch, a router is just another host on the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the above is from the perspective of layer-2 switch operation. A switch may have a management address, but, again, this is just another host on the LAN, and the management will use ARP and have a configured gateway and learn its MAC address with ARP, but it really has nothing to do with how the switching operates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A host wishing to send an IP packet to another host will look in its ARP cache for the MAC address. If there isn't an entry in its ARP cache, it will send an ARP request to resolve the layer-3 IP address to the layer-2 MAC address. It will then build a layer-2 frame with this information and send it to the switch. If the destination IP address is on a different network, the host will look for the MAC address of its configured gateway in its ARP cache, and send an ARP request if it isn't in there, build a frame and send it out, just as it would for any other host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the frames come into the switch, the switch will look at the source MAC addresses, and use that to build its MAC address table, not the same as an ARP cache. When a switch receives a frame with a destination MAC address which isn't in its MAC address table, it will flood the frame out every port; it does not use ARP requests to discover this. It doesn't take a switch very long to build its MAC table since it take only one frame from each host to populate the MAC address table.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-16T22:25:14.310" LastActivityDate="2016-03-16T22:25:14.310" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="28768" PostTypeId="2" ParentId="28762" CreationDate="2016-03-16T22:24:36.020" Score="1" Body="&lt;p&gt;In addition to Ron answer, Auto-MDIX does not negotiate speed and duplex, it auto-configures which pairs in the cable are used for Transmit and Receive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But on some switches auto-mdix is disabled if you manually set speed and duplex, which could lead to some confusion.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-16T22:24:36.020" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28769" PostTypeId="1" AcceptedAnswerId="28773" CreationDate="2016-03-16T22:51:15.580" Score="2" ViewCount="75" Body="&lt;p&gt;I was troubleshooting one of my servers when I noticed something odd. In the PCAPs I took from my server, I found non-broadcast traffic where my server was neither source or destination. The traffic is TCP conversations between other servers on the same VLAN. My server (a MacMini) is attached to a cisco 2960.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm suspecting a config issue on the switch, but I'm not sure what to look for... any advise would be appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="170" LastActivityDate="2016-03-17T04:42:53.977" Title="My server can see traffic between other servers" Tags="|cisco|mac|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28770" PostTypeId="2" ParentId="28764" CreationDate="2016-03-16T22:55:57.420" Score="1" Body="&lt;p&gt;When you see SYN segments originating from five different ports on a host, you could have five different applications on the same host trying to open TCP connections to the same application on another host, or you could have one application trying to open five different TCP connections, or any combination in between.&lt;/p&gt;&#xA;&lt;p&gt;A TCP connections is uniquely identified by four different things: source IP address, source TCP port number, destination IP address, and destination TCP port number. If all four of those are the same thing, then you have something in a single TCP connection, but if even one is different, it is part of a different TCP connection. When you look at those four data in combination, you see SYN for five different TCP connections.&lt;/p&gt;&#xA;&lt;p&gt;Why the host is creating five different TCP connections is an application-layer question, which is off-topic here, but one or more applications are trying to open TCP connections. One example is a web browser that can open multiple TCP connections to a web server in order to download different parts of a page at the same time.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2020-12-22T15:48:42.753" LastActivityDate="2020-12-22T15:48:42.753" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="28771" PostTypeId="2" ParentId="28741" CreationDate="2016-03-16T23:13:24.453" Score="3" Body="&lt;p&gt;802.11 specifies clients &lt;em&gt;listen&lt;/em&gt; for AP beacons. They don't broadcast anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, real world implementations (Windows, iOS, etc.) actively hunt for known SSIDs when they aren't associated. These probes will broadcast a MAC, but in the case of recent-ish iOS, Apple randomizes the MAC for these probes. (to thwart attempts at passive tracking)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-03-16T23:13:24.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28772" PostTypeId="2" ParentId="17117" CreationDate="2016-03-17T00:46:52.263" Score="2" Body="&lt;p&gt;Like every receiving amplifier, it is better put it near antenna. &#xA;Total power budget is the same whether put it near antenna or near BTS, BUT - &#xA;if you put it down it collects and amplifies noise which appears in cable.&#xA;If you put it up it doesn't amplify noise from cable, so noise figure is better when receiving amplifier is near antenna. It's general principle, also applies with classic TV VHF and UHF antenna amplifiers.&lt;/p&gt;&#xA;" OwnerUserId="23782" LastActivityDate="2016-03-17T00:46:52.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28773" PostTypeId="2" ParentId="28769" CreationDate="2016-03-17T04:42:53.977" Score="2" Body="&lt;p&gt;This sounds like something you could encounter when running a Microsoft NLB cluster somewhere in that VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under some conditions (using unicast mode, or an improperly configured multicast mode) the switch cannot determine where the cluster MAC address lives, and then has to flood packets exchanged with the cluster on all ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See here for details: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/107995-configure-nlb-00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/107995-configure-nlb-00.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-03-17T04:42:53.977" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28774" PostTypeId="1" CreationDate="2016-03-17T04:43:10.700" Score="1" ViewCount="14263" Body="&lt;p&gt;I haven't found a guide on the web and am wondering if anyone can point me to a how-to or show me the steps. Basically, I'd like to craft something like this: &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B00GN5OHIW&quot; rel=&quot;nofollow&quot;&gt;http://www.amazon.com/CableRack-Rollover-Console-Cable-Cisco/dp/B00GN5OHIW&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a USB connector, Category-5E cabling and RJ45 jacks. I assume there's some converting that has to be done in the middle to convert the USB's four wires to Category-5E's eight wires.&lt;/p&gt;&#xA;" OwnerUserId="19051" LastEditorUserId="8499" LastEditDate="2019-01-03T01:37:59.320" LastActivityDate="2019-01-03T01:37:59.320" Title="How do I build a USB-to-rollover RJ45 Cisco console cable?" Tags="|cisco|switch|layer1|cable|cabling|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28775" PostTypeId="2" ParentId="28774" CreationDate="2016-03-17T04:54:01.433" Score="2" Body="&lt;p&gt;What you are looking at is &lt;strong&gt;&lt;em&gt;not&lt;/em&gt;&lt;/strong&gt; just a simple cable, but a USB-to-serial adapter with electronics built in to handle the conversion. It isn't an ethernet cable, and it doesn't require Category-5E. Cisco has had serial-to-serial rollover cables forever, using telephone-grade cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a standard Cisco rollover cable, which comes with just about every Cisco device, all you need is a USB-to-serial adapter, and the software which comes with the adapter. This is just those two things combined.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-17T04:54:01.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28778" PostTypeId="1" AcceptedAnswerId="28779" CreationDate="2016-03-17T06:22:10.970" Score="2" ViewCount="445" Body="&lt;p&gt;First of all thank you everyone for helping me out and thank you for such a wonderful platform like this; it's been a boon to someone as novice like me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is: I read about the Cisco's OEAP feature in wireless LAN controller, and I am confused if this feature needs a VPN to be set in both office and remote site, or does it work without a VPN as well? From the article, I understood there is no need for a VPN, but my client insists the only way to get this done is via VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where I got the information: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_01110000.pdf&quot; rel=&quot;nofollow&quot;&gt;Configuring OfficeExtend Access Points&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="8499" LastEditDate="2016-03-17T14:35:07.170" LastActivityDate="2016-03-17T14:35:07.170" Title="OEAP feature in Cisco wireless LAN controller" Tags="|cisco|wireless|wlc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28779" PostTypeId="2" ParentId="28778" CreationDate="2016-03-17T06:51:18.423" Score="2" Body="&lt;p&gt;You are both somewhat right. In general, there are two reasons to use a VPN from a remote location:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Security. Encrypt traffic over the internet. This is always a good idea.&lt;/li&gt;&#xA;&lt;li&gt;Reachability. If you're still using IPv4 (like everybody else), you're probably using private (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt;) addresses at one or both locations. The VPN will tunnel traffic across the internet so that hosts using private addresses can reach eachother without using NAT.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Both these points can be addressed by the OEAP without using a VPN, but this will require some additional steps.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Security. All traffic between access point and controller (CAPWAP tunnel) can be encrypted, but this might not be enabled by default. Also, if you want to authenticate the OEAPs properly, you might need to set up a proper PKI. Depending on the security policy at your company, this might or might not be enough.&lt;/li&gt;&#xA;&lt;li&gt;Reachability. The OEAP needs to be able to reach the controller. This can be done by forwarding UDP ports 5246 and 5247 to the controller. If the controller uses a private IPv4 address, support for NAT must be enabled on the controller.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Check out CIsco's &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wireless/aironet-600-series-officeextend-access-point/113003-office-extend-config-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; for more details.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-17T06:51:18.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28780" PostTypeId="1" AcceptedAnswerId="28781" CreationDate="2016-03-17T07:25:12.860" Score="1" ViewCount="4119" Body="&lt;p&gt;I have two devices which come up with default IP addresses:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Device 1 - &lt;code&gt;192.168.168.168 mask 255.255.255.0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Device 2 - &lt;code&gt;192.168.1.254   mask 255.255.255.0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I can commonly deduce that both the devices are part of the &lt;code&gt;192.168.0.0/16&lt;/code&gt; network. Is that a correct assumption?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I ask is because I want to manage both the devices at the same time, and I will be connecting both of these devices to a dumb ethernet switch (no VLANs etc. - really dumb). I plan to also connect a PC to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am thinking of using &lt;code&gt;192.168.2.5/16&lt;/code&gt; as the IP address of the PC. Let me know if I will be able to access the device, or is this not a good practice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot change the default IP addresses the devices have when they come up. When the devices go to a bad state, and I factory default them, these are the IP addresses they come up with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when the packet from the PC with &#xA;src-ip : &lt;code&gt;192.168.2.5/16&lt;/code&gt; &amp;amp; dst-ip : &lt;code&gt;192.168.168.168&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;comes to device 1 (assuming that the dumb switch just sent it on all ports), why will device-1 not respond?&lt;/p&gt;&#xA;" OwnerUserId="23786" LastEditorUserId="8499" LastEditDate="2020-04-24T22:10:51.787" LastActivityDate="2020-04-25T09:22:01.873" Title="Accessing devices on different subnets using a switch" Tags="|switch|subnet|switching|layer2|layer3|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28781" PostTypeId="2" ParentId="28780" CreationDate="2016-03-17T07:32:21.643" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Now I can commonly deduce that both the devices are part of the 192.168.0.0/16 network. Is that a correct assumption.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, that's incorrect. You're using netmask &lt;code&gt;255.255.255.0&lt;/code&gt;, so that are two different &lt;code&gt;/24&lt;/code&gt;s. Just because you &lt;em&gt;can&lt;/em&gt; summarize them to a &lt;code&gt;/16&lt;/code&gt; doesn't make it a &lt;code&gt;/16&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want this to work, you'll need to change the netmask on all devices to &lt;code&gt;/16&lt;/code&gt;, &lt;em&gt;or&lt;/em&gt; place a router which is connected to both &lt;code&gt;/24&lt;/code&gt;s and routes packets between them.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-03-17T07:32:21.643" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28782" PostTypeId="2" ParentId="27838" CreationDate="2016-03-17T08:03:24.343" Score="-4" Body="&lt;p&gt;cisco system is more help this program.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Te1/0/1&#xA;channel-group 1 mode active&#xA;description &quot;Uplink to Core&quot;&#xA;exit&#xA;interface port-channel 1&#xA;class of service trust ip-dscp&#xA;switchport mode trunk&#xA;switchport trunk native vlan 10&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23789" LastEditorUserId="509" LastEditDate="2016-03-17T10:33:39.960" LastActivityDate="2016-03-17T10:33:39.960" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28785" PostTypeId="2" ParentId="28774" CreationDate="2016-03-17T11:57:37.203" Score="2" Body="&lt;p&gt;You can do it, all you need is a USB-Serial converter chip, and wiring that in properly with the incoming USB cable and the outgoing cable with the 8P8C connector on the end. You can even buy complete boards which has the chip and assorted power components installed. But the cost for all these approaches are larger than the cost of an off-the-shelf USB-Serial adapter.&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-03-17T11:57:37.203" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28790" PostTypeId="1" AcceptedAnswerId="28792" CreationDate="2016-03-17T14:08:09.620" Score="2" ViewCount="473" Body="&lt;p&gt;I just got a pair of Cisco APs and a WLC in order to play around for my CCNA Wireless certification. I'm having troubles connecting all 3 devices together. I believe I need a switch to connect them. In the WLC there are 2 ports which aren't Ethernet though (see picture):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/w1o33.jpg&quot; alt=&quot;Cisco Devices&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it possible to connect the APs directly to the WLC?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If I need a switch, through which interface should I connect it?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21236" LastEditorUserId="8499" LastEditDate="2016-03-17T15:07:44.227" LastActivityDate="2016-03-17T15:07:44.227" Title="How to connect Cisco AP1242 with WLC4402?" Tags="|cisco|access-point|wlc|cisco-wireless|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28792" PostTypeId="2" ParentId="28790" CreationDate="2016-03-17T15:02:17.157" Score="2" Body="&lt;p&gt;You can connect each AP to the controller directly, because you only have two APs and you happen to have two distribution ports on the controller.  If you wanted to connect more than two APs to your WLC4402 you would need a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ports that &quot;are not ethernet&quot; actually are ethernet, but you can't plug any cable directly into them.  They're called SFP ports, and you must insert a transceiver into the port before it's usable.  In your case you probably want to purchase a couple GLC-T copper transceivers so you can use CAT5/6 with a regular RJ-45 connector, although fiber transceivers are also supported by the controller.  You could also buy only one SFP transciever and use it to connect the controller to an old switch if you happen to have one.  From there you can connect &amp;lt;= 48 APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you read the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/controller/4400/quick/guide/ctrlv32.html&quot; rel=&quot;nofollow&quot;&gt;quick start guide&lt;/a&gt; for the WLC?  It has a lot of good info!&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-03-17T15:02:17.157" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28793" PostTypeId="2" ParentId="28790" CreationDate="2016-03-17T15:04:51.007" Score="1" Body="&lt;p&gt;The WLC should connect to a switch via ethernet. Normally it is configured using a trunk so that you can have multiple VLANs: one for the WLC management address, and one or more for the various SSIDs the LWAPs will use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LWAPs will connect to switches closest to where they need to be, and they will get their addresses, and the address of the WLC, from DHCP (option 43 will give the LWAPs the IP address of the WLC).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZneqC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZneqC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-17T15:04:51.007" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28794" PostTypeId="1" AcceptedAnswerId="28797" CreationDate="2016-03-17T15:15:16.070" Score="1" ViewCount="119" Body="&lt;p&gt;I'll consider IPv6 headers for this question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume that the simplest IP lookup scheme implementation would just look at the 'Destination Address' field in the IP header of an incoming IP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I suspect that &quot;real world&quot; implementations in routers are more complex, looking at other fields, e.g.: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;'Flow Label', 'Source Address', 'Port' numbers for flow identification; &lt;/li&gt;&#xA;&lt;li&gt;Decrement the 'Hop Limit' and decide whether to drop a packet if it reaches 0; &lt;/li&gt;&#xA;&lt;li&gt;Even some 'Extension Headers'.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My questions are:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Which IPv6 header fields are usually checked by current forwarding engine implementations to perform a &quot;common&quot; IP lookup?&lt;/li&gt;&#xA;&lt;li&gt;Is any of the IPv6 'Extension Headers' usually checked when performing a &quot;common&quot; IP lookup?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23332" LastEditorUserId="8499" LastEditDate="2019-01-04T22:40:07.510" LastActivityDate="2019-01-04T22:40:07.510" Title="Which fields in the IPv6 header are checked during an IP lookup?" Tags="|routing|router|ipv6|ip-forwarding-table|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28796" PostTypeId="1" AcceptedAnswerId="28798" CreationDate="2016-03-17T15:54:46.843" Score="-1" ViewCount="93" Body="&lt;pre&gt;&lt;code&gt;psea399#show Cellular 0/1/0 radio history all&#xA;&#xA;psea399   03:51:51 PM Thursday Mar 17 2016 UTC&#xA;&#xA;&#xA;&#xA;      111111111111111111111111111111111111111111111111111111111111&#xA;      111111111111111111111111111111111111111111111111111111111111&#xA;      000000000000000000000000000000000000000000000000000000000000&#xA;  140&#xA;  130&#xA;  120&#xA;  110 ************************************************************&#xA;  100 ************************************************************&#xA;   90 ************************************************************&#xA;   80 ************************************************************&#xA;   70 ************************************************************&#xA;   60 ************************************************************&#xA;   50 ************************************************************&#xA;   40 ************************************************************&#xA;   30 ************************************************************&#xA;   20 ************************************************************&#xA;   10 ************************************************************&#xA;     0....5....1....1....2....2....3....3....4....4....5....5....6&#xA;               0    5    0    5    0    5    0    5    0    5    0&#xA;               RSSI(-dBm) per second (last 60 seconds)&#xA;&#xA;&#xA;&#xA;      111111111111111111111111111111111111111111111111111111111111&#xA;      111111111111111111111111111111111111111111111111111111111111&#xA;      000000000000000000000000000000000000000000000000000000000000&#xA;  140&#xA;  130&#xA;  120&#xA;  110 ############################################################&#xA;  100 ############################################################&#xA;   90 ############################################################&#xA;   80 ############################################################&#xA;   70 ############################################################&#xA;   60 ############################################################&#xA;   50 ############################################################&#xA;   40 ############################################################&#xA;   30 ############################################################&#xA;   20 ############################################################&#xA;   10 ############################################################&#xA;     0....5....1....1....2....2....3....3....4....4....5....5....6&#xA;               0    5    0    5    0    5    0    5    0    5    0&#xA;                RSSI(-dBm) per minute (last 60 minutes)&#xA;              * = maximum RSSI   # = average RSSI&#xA;&#xA;&#xA;&#xA;      111111111111111111111111111111111111111111111111111111111111111111111111&#xA;      111111111111111111111111111111111111111111111111111111111111111111111111&#xA;      000000000000000000000000000000000000000000000000000000000000000000000000&#xA;  140&#xA;  130&#xA;  120&#xA;  110 ########################################################################&#xA;  100 ########################################################################&#xA;   90 ########################################################################&#xA;   80 ########################################################################&#xA;   70 ########################################################################&#xA;   60 ########################################################################&#xA;   50 ########################################################################&#xA;   40 ########################################################################&#xA;   30 ########################################################################&#xA;   20 ########################################################################&#xA;   10 ########################################################################&#xA;     0....5....1....1....2....2....3....3....4....4....5....5....6....6....7..&#xA;               0    5    0    5    0    5    0    5    0    5    0    5    0&#xA;               RSSI(-dBm) per hour (last 72 hours)&#xA;             * = maximum RSSI   # = average RSSI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23802" LastEditorUserId="8499" LastEditDate="2018-12-22T22:20:27.923" LastActivityDate="2018-12-22T22:20:27.923" Title="I have a Cisco 2921, CIS-3G-ANTM1919D (3G Antenna) is attached to it. Please confirm if this is optimum" Tags="|cisco|router|wireless|cisco-ios|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28797" PostTypeId="2" ParentId="28794" CreationDate="2016-03-17T16:05:24.803" Score="2" Body="&lt;p&gt;If you are referring to the routing of an IPv6 packet, it is really only the destination address which plays a part in that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Hop Count field is first inspected to see if the packet should be dropped. If the packet is not dropped, the field is decremented and the packet is forwarded, or dropped, based on the destination address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only extension header normally examined by a router is the Hop-By-Hop Options extension header, but many routers will deny packets with this extension header, or ignore it altogether.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other fields may be examined by various services enabled on a router. For example, if the router is configured for QoS, the Traffic Class field may be used for queuing. ACLs configured in the router may care about the source and destination addresses, the protocol and port numbers in the payload, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Flow Label field hasn't been widely supported since the use of it isn't mandated, and it has various &quot;&lt;em&gt;possible&lt;/em&gt;&quot; uses. A good use would be to keep all packets in a single traffic flow from being spread across multiple paths. This use requires the source host and routers in the path to support it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which fields are examined and used by a router really depends on which services are configured and enabled on the router. The IPv6 packet header is simpler than an IPv4 packet header. The only really complex things could be if you have configured IPv6 Mobility, and the router needs to use the related extension headers: Hop-by-Hop Options, Routing, and Mobility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the packet destination is the router itself (e.g. routing protocol data), the other extension headers which are used by the packet destination may be examined and used, especially the Authentication Header for OSPFv3.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-17T16:05:24.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28798" PostTypeId="2" ParentId="28796" CreationDate="2016-03-17T16:34:19.427" Score="1" Body="&lt;p&gt;Nominally, a higher RSSI is better, but understand that RSSI is arbitrarily defined by a particular vendor, and you can't compare it with other models, or, sometimes, with the same model which has a different software version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can search the Internet for RSSI (Received Signal Strength Indication) to find explanations like &lt;a href=&quot;https://en.wikipedia.org/wiki/Received_signal_strength_indication&quot; rel=&quot;nofollow&quot;&gt;Received signal strength indication&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has some documentation on 3G RSSI. You can search for your particular equipment, for example: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/access/1800/1861/software/feature/guide/mrwlsgsm.html&quot; rel=&quot;nofollow&quot;&gt;Configuring 3G Wireless WAN on Modular and Fixed ISRs (HWIC-3G-GSM, HWIC-3G-HSPA, PCEX-3G-HSPA-x)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt; The RSSI should be better than -90 dBm for steady and reliable&#xA;  connection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-17T16:47:39.523" LastActivityDate="2016-03-17T16:47:39.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28801" PostTypeId="1" AcceptedAnswerId="28808" CreationDate="2016-03-17T18:15:40.213" Score="1" ViewCount="452" Body="&lt;p&gt;I have the Following VLANs:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Systems&lt;/li&gt;&#xA;&lt;li&gt;Logistics&lt;/li&gt;&#xA;&lt;li&gt;Marketing&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I need that:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All VLANs can go out to the Internet&lt;/li&gt;&#xA;&lt;li&gt;Logistics and Marketing can access servers on the Systems VLAN&lt;/li&gt;&#xA;&lt;li&gt;Logistics and Marketing cannot see with each other&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So I've made the following schema:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JYFNf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JYFNf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router at the top should route between VLANs&lt;/li&gt;&#xA;&lt;li&gt;Switch immediately connected to the router is VLAN-unaware&lt;/li&gt;&#xA;&lt;li&gt;The 3 switches below are VLAN-aware&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is it right?&lt;/p&gt;&#xA;" OwnerUserId="19092" LastEditorUserId="8499" LastEditDate="2016-03-17T18:45:24.960" LastActivityDate="2016-03-17T20:43:55.943" Title="Can I use a VLAN-unaware switch in a hierarchical switch topology?" Tags="|switch|vlan|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28802" PostTypeId="2" ParentId="28780" CreationDate="2016-03-17T18:39:11.267" Score="2" Body="&lt;p&gt;Switches are not hubs. Hubs repeat a signal on all ports, but switches selectively send frames to only the ports where the host with the destination MAC address is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't seem to understand the difference between layer-2 and layer-3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An IP address is a layer-3 address. A host will have an IP address, mask, and configured gateway. If the destination IP address is not on the same network, as defined by the mask, it will send the packet to its configured gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches don't see layer-3 IP addresses since they don't strip off the layer-2 frame to inspect the IP packet; they look at the layer-2 MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch learns which MAC addresses are connected to which ports by inspecting the source MAC address of any frames coming into the ports, and it populates its MAC address table with this. If the switch doesn't have a MAC address in its table, it will flood the frame to all ports. Switches will quickly learn MAC addresses since it only takes one frame from a host to populate the MAC address table with a MAC address. If the switch has the MAC address in its MAC address table, it will only send frames destined to that MAC address to the port it finds in its MAC address table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a host wants to send something to a particular IP address, it needs to get the layer-2 destination MAC address (resolve the layer-3 IP address to a layer-2 MAC address). To do this, it looks in its ARP cache to see if there is an entry for this. If it doesn't have this in its ARP cache, it will send an ARP request to find the MAC address. Once it has the MAC address, it will create an ethernet frame which encapsulates the IP packet. It then sends the frame to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the IP address is on a different network, as defined by the mask, it will use the MAC address of the configured gateway, and it will use the above process to get the MAC address of the gateway.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-17T18:49:16.723" LastActivityDate="2016-03-17T18:49:16.723" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28803" PostTypeId="1" AcceptedAnswerId="28807" CreationDate="2016-03-17T19:28:02.170" Score="9" ViewCount="9921" Body="&lt;p&gt;Regarding ARP requests, I got to believe that the destination MAC address was in all situations the broadcast address.&lt;/p&gt;&#xA;&lt;p&gt;Yet I got across this Wireshark capture:&lt;/p&gt;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/gFHoC.png&quot; alt=&quot;ARP wireshark capture&quot; /&gt;&lt;/p&gt;&#xA;&lt;p&gt;I just cannot understand the 3rd request from my router. Why is the destination MAC address of the request set to my NIC and not as broadcast? The last ARP request from the router is exactly how I would assume it to be (i.e., using the broadcast MAC address)&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;(.1 is a router, .100 my PC, .103 second PC)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="23777" LastEditorUserId="43734" LastEditDate="2023-02-19T16:16:17.163" LastActivityDate="2023-02-19T16:16:17.163" Title="ARP request with unicast MAC?" Tags="|arp|wireshark|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="28805" PostTypeId="1" AcceptedAnswerId="28858" CreationDate="2016-03-17T19:56:52.763" Score="3" ViewCount="1480" Body="&lt;p&gt;I had a discussion a while ago, related how to stop DDoS. Read this first: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/28045/bgp-null-route-when-ddos/28046?noredirect=1#comment43701_28046&quot;&gt;BGP null route when DDoS?&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Finally, we talked to the ISP, and it agreed on setting up a BGP trigger so the next time a DDoS happens, we can trigger RTBH to null route (DDoS) the target IP address to stop traffic at the PE.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt; I am not an expert in BGP, so my question is how/what I need to configure on my router, and how can I trigger a null route from my router so it will null traffic at the ISP edge router?&lt;/p&gt;&#xA;&lt;h1&gt;Scenario in GNS:&lt;/h1&gt;&#xA;&lt;p&gt;Here i am trying to trigger RTBH from R2 router to R1 so it will null route 172.16.10.100 at R1 (ISP router), But its not working, what i am missing here?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;R1: ISP Router&#xA;R2: My Router&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I have configured iBGP between this two router and trying to simulate RTBH to understand.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;R1:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Do i need to configure anything else on R1 to accept trigger?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)# router bgp 64520&#xA;...&#xA;...&#xA;R1(config)# ip route 192.0.2.1 255.255.255.255 Null0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;R2:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)# route-map RTBH&#xA;R2(config-route-map)# match tag 666&#xA;R2(config-route-map)# set ip next-hop 192.0.2.1&#xA;R2(config-route-map)# set origin igp&#xA;R2(config-route-map)# set community no-export&#xA;&#xA;R2(config)# router bgp 64520&#xA;R2(config-router)# redistribute static route-map RTBH&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Trying to trigger Null route&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)# ip route 172.16.10.100 255.255.255.255 Null0 tag 666&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2019-01-05T00:04:56.347" Title="BGP RTBH setup with ISP" Tags="|cisco|routing|bgp|isp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28806" PostTypeId="2" ParentId="28805" CreationDate="2016-03-17T20:19:27.433" Score="2" Body="&lt;p&gt;You need to coordinate this with your ISP. Cisco has some documents, such as &lt;a href=&quot;https://www.cisco.com/c/dam/en_us/about/security/intelligence/blackhole.pdf&quot; rel=&quot;nofollow&quot;&gt;REMOTELY TRIGGERED BLACK HOLE FILTERING&lt;/a&gt;, which may help you understand what you need to coordinate with your ISP, and how to configure what you agree on.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;OVERVIEW&lt;/strong&gt; This section describes RTBH filtering and how it is used for both destination-based and source-based filtering. This section&#xA;  includes the following topics:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Benefits of Remotely Triggered Black Hole Filtering&lt;/li&gt;&#xA;  &lt;li&gt;Remotely Triggered Black Hole Filtering Within the Service Provider    Security Framework&lt;/li&gt;&#xA;  &lt;li&gt;Destination-Based&lt;/li&gt;&#xA;  &lt;li&gt;Source-Based&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;There are two methods for deploying RTBH filtering. The first, and&#xA;  easier, way is called the next hop method, in which the next hop&#xA;  attribute is set on the trigger and is sent in the route update to its&#xA;  iBGP peers at the edge. The second method is to use BGP communities.&#xA;  In the latter method, the trigger sets the BGP community for a route&#xA;  and sends it to the edge routers using iBGP. The edge routers use a&#xA;  route map to match this community and set attributes locally, such as&#xA;  next hop and other routing metrics.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-17T20:19:27.433" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28807" PostTypeId="2" ParentId="28803" CreationDate="2016-03-17T20:37:31.537" Score="15" Body="&lt;p&gt;In an attempt to refresh an expired, or expiring, ARP entry, many Client OS's will issue a &quot;targeted&quot; ARP query to the MAC address they already expect. Most of the time, this prompts a response from the intended target and allows the entry to be refreshed without sending a broadcast to the entire network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will be the first time I've seen it with a Router, but it isn't too big of a stretch to think a Router vendor somewhere will have implemented ARP in the same way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Nearly a Year Later Edit&lt;/em&gt;: I found a quote in &lt;a href=&quot;https://www.ietf.org/rfc/rfc1122.txt&quot; rel=&quot;noreferrer&quot;&gt;RFC 1122&lt;/a&gt; that describes this behavior:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;2.3.2  Address Resolution Protocol -- ARP&#xA;   2.3.2.1  ARP Cache Validation&#xA;      An implementation of the Address Resolution Protocol (ARP)&#xA;      MUST provide a mechanism to flush out-of-date cache&#xA;      entries.  If this mechanism involves a timeout, it SHOULD be&#xA;&#xA;      ...&#xA;&#xA;      IMPLEMENTATION:&#xA;           Four mechanisms have been used, sometimes in&#xA;           combination, to flush out-of-date cache entries.&#xA;&#xA;           ...&#xA;&#xA;           (2)  Unicast Poll -- Actively poll the remote host by&#xA;                periodically sending a point-to-point ARP Request&#xA;                to it, and delete the entry if no ARP Reply is&#xA;                received from N successive polls.  Again, the&#xA;                timeout should be on the order of a minute, and&#xA;                typically N is 2.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2017-01-11T03:59:00.283" LastActivityDate="2017-01-11T03:59:00.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28808" PostTypeId="2" ParentId="28801" CreationDate="2016-03-17T20:43:55.943" Score="3" Body="&lt;p&gt;In response to &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So if the middle switch should be vlan-aware. Can I use below 3&#xA;  switches vlan unaware? (Considering that each of the 3 switches has&#xA;  only one VLAN)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes you can, by configuring the port that connect to the router in trunk mode and the other ports on the central switch in access mode , each in appropriate VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I strongly recommend that you go for 4 VLAN aware switches. The additional management capabilities and flexibility it will give you largely compensate the additional cost (which is not so much).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-17T20:43:55.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28810" PostTypeId="1" AcceptedAnswerId="28811" CreationDate="2016-03-17T23:31:18.710" Score="3" ViewCount="1948" Body="&lt;p&gt;I was explained that in order to support many types of speeds with a switch (i.e. one port is for instance 100 Mb/s and the other is 1 Gb/s), &lt;strong&gt;store-and-forward mode&lt;/strong&gt; is required. I would like to ask why is this option necessary? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On top of that, port buffering was mentioned in particular, leading me to possible misconception that shared memory is not desired or even possible. &lt;/p&gt;&#xA;" OwnerUserId="23777" LastActivityDate="2016-03-20T00:50:37.117" Title="Switching mix of Ethernet speeds?" Tags="|switch|switching-modes|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28811" PostTypeId="2" ParentId="28810" CreationDate="2016-03-17T23:37:39.900" Score="4" Body="&lt;p&gt;If the frames entering the switch are using a 1G port, but are being forwarded out a 100M port, then it's likely that frames are coming in faster than they are going out.  So they need to be buffered until they can all be transmitted.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-17T23:37:39.900" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28812" PostTypeId="1" CreationDate="2016-03-18T01:43:14.020" Score="-2" ViewCount="49" Body="&lt;p&gt;T568A or T568B?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which one (1, 2, or 3)?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Straight-through&lt;/li&gt;&#xA;&lt;li&gt;Cross-Over&lt;/li&gt;&#xA;&lt;li&gt;Roll-Over&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23815" LastEditorUserId="8499" LastEditDate="2019-01-03T02:15:23.273" LastActivityDate="2019-01-03T02:15:23.273" Title="Category-6 cable for CCTV" Tags="|ethernet|layer1|cable|utp|" AnswerCount="1" CommentCount="2" ClosedDate="2016-03-18T05:35:42.510" ContentLicense="CC BY-SA 3.0" />
  <row Id="28813" PostTypeId="2" ParentId="28570" CreationDate="2016-03-18T02:01:08.937" Score="4" Body="&lt;p&gt;What you're proposing is not going to be possible in a single box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we focus just on C-TAG 300, then from the switch port perspective traffic on the Customer-facing/left-most port in your diagram will require ingress frames to have the outer (S-Tag) popped off and traffic dropped into C-VLAN 300 on the switch (so it can be passed to other tagged member interfaces).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When traffic is returning towards this interface however, you will only be able to push a single S-TAG onto C-TAG 300 frames that egress this port either 500 OR 600.  The switch has no way of differentiating traffic back to each customer, as any MAC being learnt from this port would be in VLAN 300 from the switch point of view, and not an associated S-VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be possible using two switches (or dare I suggest it, one switch with a cable looped back to itself), but not particularly scalable as the number of S-Tags increases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a very ghetto ASCII network diagram of how this would work: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                           Switch 1           Switch 2&#xA;                         +----------+         +-------+&#xA; --[600 300]--[500 300]--|-+-(500)--|--[300]--|-(300)-|---[ ]---&#xA;     Customer-facing     | +-(600)--|--[300]--|-(   )-|--[300]-- &#xA;                         +----------+         +-------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the left, You would have the port facing your customers trunked for both S-Tags, and then define VLANs on the switch for both S-VLANs (500 and 600).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would then have a port in each S-VLAN &lt;em&gt;untagged&lt;/em&gt; connected to Switch 2 - this would send out frames with only the payload of each Q-in-Q frame which in this example would be a frame with single C-Tag 300 on it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On switch 2, you would define VLAN 300 (and other C-VLANs) and have tagged-ports allowing VLAN 300 facing Switch 1.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may not be immediately obvious from my masterpiece diagram, but Switch 2 has just one big VLAN 300 with four physical interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you can have your other ports with VLAN 300 singly tagged (or untagged) going off to your various services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it turns out, it doesn't look like the Nexus 3548 is capable of Q-in-Q:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/net_mgmt/xnc/nexus_data_broker/deploy_config/2-0/b_Nexus_Data_Broker_Configuration_Guide_20/b_Nexus_Data_Broker_Configuration_Guide_20_chapter_01.html#task_DAE52B272314417F893582FB06A7BCB9&quot; rel=&quot;nofollow&quot;&gt;Cisco Documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ability to configure Q-in-Q is available only for Cisco Nexus 3000 and 3100 Series switches. Q-in-Q is automatically enabled when you configure a VLAN ID for an edge port, if the VLAN ID is maintained on the edge port.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="33" LastEditDate="2016-03-18T05:54:08.667" LastActivityDate="2016-03-18T05:54:08.667" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28814" PostTypeId="2" ParentId="28812" CreationDate="2016-03-18T02:15:23.890" Score="1" Body="&lt;p&gt;If this is residential cabling, it is off-topic here, but you should familiarize yourself with &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=4&amp;amp;ved=0ahUKEwjjzaHXjsTLAhUhsoMKHaPvAboQFggvMAM&amp;amp;url=http%3A%2F%2Fwww.vyskocil.net%2Ffirma%2Fdokumenty%2Fdownload.asp%3Fid%3D156&amp;amp;usg=AFQjCNEQ730yEmB8aUxvAAvQSiqA_YROyg&amp;amp;sig2=C44KwaZ8SMPjf0Lues6O3g&amp;amp;cad=rja&quot; rel=&quot;nofollow&quot;&gt;ANSI/TIA/EIA-570-B Residential Telecommunications Infrastructure Standard&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is commercial cabling, the usual is T568B, but either could be used, as long as &lt;em&gt;all&lt;/em&gt; cabling is done the same. The standard calls for straight-through cabling from end-to-end on a cable run for UTP cabling (fiber is crossed-over). All crossover or rollover, splitting, etc. &lt;em&gt;must&lt;/em&gt; be done outside of the WAO (Work Area Outlet).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-18T02:15:23.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28815" PostTypeId="2" ParentId="28716" CreationDate="2016-03-18T04:02:11.713" Score="7" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Now what exactly are the CST, the IST, and the CIST? Can someone draw me a simple MSTP topology with CST in red, IST in yellow, and CIST in green, so as to have a final reference without any ambiguous texts to be interpreted? :)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I like to visualise them like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DNeru.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DNeru.png&quot; alt=&quot;MSTP Instances&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-03-18T04:02:11.713" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28816" PostTypeId="2" ParentId="28810" CreationDate="2016-03-18T04:10:07.387" Score="4" Body="&lt;p&gt;Shared memory and port buffering are not mutually exclusive:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets payloads will be stored in shared memory prior to being transmitted (think how inefficient it would be to store a broadcast frame 48 different times in order to flood it out each port).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port buffering comes into play when multiple packets arrive at the switch from different ingress interfaces, all destined for one (or more) common egress interfaces.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-03-18T04:10:07.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28818" PostTypeId="1" AcceptedAnswerId="28821" CreationDate="2016-03-18T08:13:10.263" Score="1" ViewCount="93" Body="&lt;p&gt;I could use some help with my way of calculating usable subnets and usable hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the way i normally do it:&lt;br&gt;&#xA;169.199.109.137 (class B)&lt;br&gt;&#xA;255.255.255.192&lt;/p&gt;&#xA;&#xA;&lt;p&gt;network | host&lt;br&gt;&#xA;169.199 | 109.137&lt;br&gt;&#xA;255.255 | 255.192 = 11111111.11000000 = 10(1) 6(0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2^10 = 1024 usable subnets&lt;br&gt;&#xA;2^6 = 64-2 = 62 usable hosts&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that is the way I normally do it but my teacher would like to me use another method since i have use my own method wrong on multiple occasions.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;His version:&lt;br&gt;&#xA;222.152.18.64 (class C)&lt;br&gt;&#xA;255.255.255.248&lt;/p&gt;&#xA;&#xA;&lt;p&gt;network bits (n), subnet bits (s) and host bits (h)&lt;br&gt;&#xA;nnnnnnnn.nnnnnnnn.nnnnnnnn.sssshhhh&lt;br&gt;&#xA;then from that he gets the numbers he needs above the 2^?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2^? = ? usable subnets&lt;br&gt;&#xA;2^? = ?-2 = ? usable hosts&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand how his way works, how he gets the correct amount of n, s and h, and what to place above the 2^&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am one week into learning about ip's and subnetting, so when you give me a way to learn his way do explain it so I would understand it.&lt;/p&gt;&#xA;" OwnerUserId="23719" LastEditorUserId="220" LastEditDate="2016-03-18T14:07:56.340" LastActivityDate="2016-03-18T14:07:56.340" Title="my way and my teachers way need some explaining on how to use his method" Tags="|subnet|" AnswerCount="1" CommentCount="3" ClosedDate="2016-03-18T15:32:26.653" ContentLicense="CC BY-SA 3.0" />
  <row Id="28819" PostTypeId="2" ParentId="28713" CreationDate="2016-03-18T08:49:39.943" Score="3" Body="&lt;p&gt;PPPoE it's a L2 protocol, you cannot use a L3 redundancy protocol like VRRP. You can put how many PPPoE server as you want on the same broadcast domain and the redundancy will be guaranteed. The client send the PADI in broadcast, every BRAS reply with PADO but the client will discard all PADO packets except the first one. If your server has some advanced features like PADO delay,  use them for have the control of BRAS selection &lt;/p&gt;&#xA;" OwnerUserId="23824" LastEditorUserId="23824" LastEditDate="2016-03-18T08:57:08.320" LastActivityDate="2016-03-18T08:57:08.320" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28820" PostTypeId="2" ParentId="22247" CreationDate="2016-03-18T09:06:55.127" Score="-1" Body="&lt;p&gt;Shut down unused ports and enable port security on the others. Anyway if someone is able to clone an existing MAC address, there is no way to stop him. &lt;/p&gt;&#xA;" OwnerUserId="23824" LastActivityDate="2016-03-18T09:06:55.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28821" PostTypeId="2" ParentId="28818" CreationDate="2016-03-18T09:07:06.657" Score="1" Body="&lt;p&gt;Your teachers way and your way are exactly the same, just written down differently. To use your way as the teachers way, replace the 1's you wrote down with s and the 0's with h. So:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network | host&#xA;169.199 | 109.137&#xA;255.255 | 255.192 = 11111111.11000000 =       10(1) 6(0)&#xA;nnnnnnnn.nnnnnnnn | ssssssss.sshhhhhh = 16(n) 10(s) 6(h)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2^s = 1024 usable subnets&#xA;2^h = 64-2 = 62 usable hosts&lt;/p&gt;&#xA;" OwnerUserId="220" LastActivityDate="2016-03-18T09:07:06.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28822" PostTypeId="1" CreationDate="2016-03-18T09:46:10.340" Score="1" ViewCount="634" Body="&lt;p&gt;I have been tasked to setup a VPN tunnel with an external party's network, but I hit a bit of snag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently running a Cisco ASA 5510 with private subnets of &lt;code&gt;10.1.2.0/24&lt;/code&gt; on the &quot;inside&quot; network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other site I wish to connect to has a private subnet of &lt;code&gt;10.0.0.0/8&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, there is a conflict on both private subnets, and I need to perform OUTSIDE NAT to NAT my ongoing host traffic of &lt;code&gt;10.1.2.0/24&lt;/code&gt; to &lt;code&gt;192.168.1.0/24&lt;/code&gt; (the other party has insisted I used this subnet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other party does not wish to make changes on their end, so everything has to be done on my firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have looked at some resources online:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.packetu.com/2013/12/09/source-destination-nat-ios-vpn/&quot; rel=&quot;nofollow&quot;&gt;http://www.packetu.com/2013/12/09/source-destination-nat-ios-vpn/&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;http://www.packetu.com/2012/01/02/asa-vpn-with-address-overlap/&quot; rel=&quot;nofollow&quot;&gt;http://www.packetu.com/2012/01/02/asa-vpn-with-address-overlap/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems easy to effect this from configuration, however, I am already running several VPN tunnels at the moment for this network, and I am concerned the change to outbound NAT might affect my other tunnels or configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, I already have other remote sites of with subnets of &lt;code&gt;192.168.1.X&lt;/code&gt;, &lt;code&gt;192.168.2.X&lt;/code&gt;, etc. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How do I ensure that the outbound NAT will have no effect on my&#xA;existing tunnels?&lt;/li&gt;&#xA;&lt;li&gt;Would having an outbound NAT with same subnet as one of my existing&#xA;remote sites cause an issue?&lt;/li&gt;&#xA;&lt;li&gt;Can I 'tailor' a specific NAT behavior just for a particular VPN&#xA;Tunnel (just for this specific other party), and will this resolve&#xA;any potential conflict?&lt;/li&gt;&#xA;&lt;li&gt;I also have a specific set of ACLs that deal with the same subnet of&#xA;the outbound NAT of &lt;code&gt;192.168.1.X&lt;/code&gt;. Will there be issues?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20768" LastEditorUserId="8499" LastEditDate="2016-03-18T14:07:15.457" LastActivityDate="2016-03-18T14:07:15.457" Title="VPN tunnel with duplicate subnets" Tags="|cisco-asa|vpn|nat|cisco-ios|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28823" PostTypeId="2" ParentId="24680" CreationDate="2016-03-18T10:19:44.020" Score="-1" Body="&lt;p&gt;You can use multiple port on the NAT rules, separated by &quot;,&quot; &lt;/p&gt;&#xA;" OwnerUserId="23824" LastActivityDate="2016-03-18T10:19:44.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28825" PostTypeId="1" AcceptedAnswerId="28826" CreationDate="2016-03-18T12:15:04.783" Score="1" ViewCount="86" Body="&lt;p&gt;If PPP is enabled for both compression and encryption, which one happens first,&#xA;compression or encryption, before the PPP sends the data over the physical link?&lt;/p&gt;&#xA;" OwnerUserId="6118" LastEditorUserId="8499" LastEditDate="2016-03-18T14:10:32.440" LastActivityDate="2016-03-18T14:10:32.440" Title="PPP compression and encryption: which one happens first?" Tags="|ppp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28826" PostTypeId="2" ParentId="28825" CreationDate="2016-03-18T12:33:46.200" Score="4" Body="&lt;p&gt;Compression technologies rely on the fact that the data has patterns that can be &quot;coded.&quot; Here's a simple (simplistic?) example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Instead of repeating long strings of 1s or 0s, use the string &quot;00&quot; &#xA;followed by the number of 0s.  So a string of 20 0s could be&#xA;represented by &quot;0014&quot; (hex 14 = 20).  This would shorten the stream by&#xA;16 bytes.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if you encrypt the data, then it appears to be random -- i.e. there should be no discernible patterns.  This would make compression impossible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So a shorter answer to your question is: compress first, then encrypt.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-18T12:33:46.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28828" PostTypeId="2" ParentId="28570" CreationDate="2016-03-18T13:40:55.190" Score="1" Body="&lt;p&gt;If I understand you correctly, this is possible with a single switch, but it's not pretty.  As Benjamin suggested, you can loop a cable back onto the switch.  One interface is configured as an 802.1q tunnel, while the other interface is configured as a trunk to only allow the C-VLANs.  The 802.1q tunnel interface will push/pop the S-VLAN as appropriate.  It's definitely not scalable.  Cisco offers this feature on their Metro gear.  In the past it's been referred to flexible VLAN matching and allows for the the manipulation of the tags in several ways.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2016-03-18T13:40:55.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28829" PostTypeId="1" AcceptedAnswerId="28831" CreationDate="2016-03-18T14:03:28.560" Score="2" ViewCount="162" Body="&lt;p&gt;I have a network switch that supports up to and including 1000 Mbps. If I have a &lt;code&gt;Client A&lt;/code&gt; with 100 Mbps and &lt;code&gt;Client B&lt;/code&gt; with 1000 Mbps connection, will:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;the connection between &lt;code&gt;A&lt;/code&gt;and &lt;code&gt;B&lt;/code&gt; be limited to 100 Mbps, therefore the data sent is not buffered? Since each port negotiates with the selected/default speed, &lt;code&gt;A&lt;/code&gt; would default to 100 Mbps and &lt;code&gt;B&lt;/code&gt; would default to 1000 Mbps.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;the data sent be buffered? If this is the case, where is the buffer stored?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22713" LastActivityDate="2016-03-18T14:24:17.097" Title="Faster to slower port speed" Tags="|switch|speed|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28831" PostTypeId="2" ParentId="28829" CreationDate="2016-03-18T14:24:17.097" Score="2" Body="&lt;p&gt;The traffic between the two hosts will be limited to the speed of the slowest link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches have a &lt;em&gt;very small&lt;/em&gt; amount of buffering for situations like this. If the host with the faster link tries to stream a lot of data to the host with the slower link, many frames will be discarded, and ethernet has no facility for retransmission. You would depend on the upper-layer protocols (TCP or the application) to retransmit lost data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some hosts and switches support &lt;a href=&quot;https://en.wikipedia.org/wiki/Ethernet_flow_control&quot; rel=&quot;nofollow&quot;&gt;ethernet flow control&lt;/a&gt;, but implementation and support of this can be very spotty.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-18T14:24:17.097" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28835" PostTypeId="1" CreationDate="2016-03-18T20:58:10.830" Score="2" ViewCount="219" Body="&lt;p&gt;I'm facing a weird situation. Office LAN configuration is :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A Netgear router as the main router&lt;/li&gt;&#xA;&lt;li&gt;An Ubuntu PC with UniFi controller software&lt;/li&gt;&#xA;&lt;li&gt;10 UniFi APs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;At anytime, the latency between a computer and the main router using a wired connection is 0.300 ms and 0.400 ms. Using Wi-Fi, the latency can vary from 1 ms to 1000 ms and, eventually, a timeout. If at the exact same time, I check the latency using a wired computer, it's still 0.300ms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked the bandwidth and it's always low. I'm assuming a device on the network is creating latency. I installed ntop to monitor the network, but I found nothing obvious. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="23834" LastEditorUserId="8499" LastEditDate="2016-03-18T21:11:40.043" LastActivityDate="2016-03-19T19:38:20.470" Title="Random latency on a wireless LAN" Tags="|network-core|latency|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28836" PostTypeId="2" ParentId="28835" CreationDate="2016-03-18T21:02:44.437" Score="3" Body="&lt;p&gt;You need to discover what is on the airwaves. It sounds like you are experiencing wireless interference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can hire a company to come in and do a wireless site survey. This will give you information about what is going on in the airwaves, how many WAPs are necessary, where the best  WAP placements are, how to adjust the radio power and channels for best performance, etc.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-18T21:02:44.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28841" PostTypeId="1" CreationDate="2016-03-19T09:04:03.650" Score="1" ViewCount="1014" Body="&lt;p&gt;I'm trying to simulate a Site-to-Site VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what my network looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Zmhtw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zmhtw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VPN tunnel stands for connecting &lt;code&gt;Technology center router&lt;/code&gt; to &lt;code&gt;R1&lt;/code&gt;, the running configurations for &lt;code&gt;Technology center router&lt;/code&gt; are these:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1713 bytes&#xA;!&#xA;version 15.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname TCR&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO2901/K9 sn FTX1524158U&#xA;license boot module c2900 technology-package securityk9&#xA;!&#xA;!&#xA;!&#xA;crypto isakmp policy 10&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA;!&#xA;crypto isakmp key cisco address 10.2.2.2&#xA;!&#xA;!&#xA;!&#xA;crypto ipsec transform-set VPN-SET esp-3des esp-sha-hmac&#xA;!&#xA;crypto map VPN-MAP 10 ipsec-isakmp &#xA; description VPN connection to R1&#xA; set peer 10.2.2.2&#xA; set transform-set VPN-SET &#xA; match address 100&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/0/0&#xA; bandwidth 64000&#xA; ip address 10.1.1.1 255.0.0.0&#xA; clock rate 128000&#xA; crypto map VPN-MAP&#xA;!&#xA;interface Serial0/0/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1/0&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/1/1&#xA; switchport mode access&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1/2&#xA; switchport mode access&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1/3&#xA; switchport mode access&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.0.1 255.255.255.0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;access-list 100 permit ip 192.168.0.0 0.0.0.255 192.168.1.0 0.0.0.255&#xA;access-list 100 permit ip 192.168.0.0 0.0.0.255 192.168.2.0 0.0.0.255&#xA;access-list 100 permit ip 192.168.0.0 0.0.0.255 192.168.3.0 0.0.0.255&#xA;access-list 100 permit ip 192.168.0.0 0.0.0.255 192.168.4.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line 0/2/0 0/2/7&#xA; login&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the running configurations for &lt;code&gt;R1&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1503 bytes&#xA;!&#xA;version 15.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO2901/K9 sn FTX1524PZ05&#xA;license boot module c2900 technology-package securityk9&#xA;!&#xA;!&#xA;!&#xA;crypto isakmp policy 10&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA;!&#xA;crypto isakmp key cisco address 10.1.1.1&#xA;!&#xA;!&#xA;!&#xA;crypto ipsec transform-set VPN-SET esp-3des esp-sha-hmac&#xA;!&#xA;crypto map VPN-MAP 10 ipsec-isakmp &#xA; description VPN connection to TCR&#xA; set peer 10.1.1.1&#xA; set transform-set VPN-SET &#xA; match address 100&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/0/0&#xA; bandwidth 64000&#xA; ip address 10.2.2.2 255.0.0.0&#xA; clock rate 128000&#xA; crypto map VPN-MAP&#xA;!&#xA;interface Serial0/0/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1/0&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/1/1&#xA; switchport mode access&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1/2&#xA; switchport mode access&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1/3&#xA; switchport mode access&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.1.1 255.255.255.0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;access-list 100 permit ip 192.168.1.0 0.0.0.255 192.168.0.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line 0/2/0 0/2/7&#xA; login&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why &lt;code&gt;R1&lt;/code&gt; and  &lt;code&gt;Technology center router&lt;/code&gt; can't ping on each other ?&lt;/p&gt;&#xA;" OwnerUserId="23849" LastEditorUserId="14263" LastEditDate="2016-03-19T13:53:56.877" LastActivityDate="2016-03-19T13:53:56.877" Title="Site-to-Site VPN: Can't ping between two routers through cloud" Tags="|routing|vpn|packet-tracer|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28845" PostTypeId="1" AcceptedAnswerId="28854" CreationDate="2016-03-18T12:05:39.070" Score="2" ViewCount="417" Body="&lt;p&gt;I have learned SNMP recently. Basically, I understood it by making a comparison with a normal database system. So let me just run you through an overview of my understanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, we have a central database (the big tree), which consists of all the information about the system, network, interfaces and other resources in a structured manner as described by MIB files. Each piece of information is identified by an OID (object identifier). Using various commands like &lt;code&gt;snmpget&lt;/code&gt;, &lt;code&gt;snmpwalk&lt;/code&gt;, &lt;code&gt;snmpbulkwalk&lt;/code&gt; etc, the SNMP MASTER can fetch each piece of information or many at a time from the agent. These commands are actually querying the central database for information and sending it to the MASTER.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MASTER can update this central database by using a &lt;code&gt;snmpset&lt;/code&gt; command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;snmptrap&lt;/code&gt; or &lt;code&gt;snmpinform&lt;/code&gt; are the commands that agent uses to tell the MASTER about the occurrence of an event. So, if I do the following: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmptrap -v 2c -c public localhost &quot;&quot; NET-SNMP-EXAMPLES-MIB::netSnmpExampleHeartbeatNotification netSnmpExampleHeartbeatRate i 9323&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The agent will the MASTER that his &lt;code&gt;netSnmpExampleHeartbeatRate&lt;/code&gt; is &lt;code&gt;9323&lt;/code&gt;. So, is this information stored in the central database under the OID - &lt;code&gt;.1.3.6.1.4.1.8072.2.3.2.1&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$snmptranslate NET-SNMP-EXAMPLES-MIB::netSnmpExampleHeartbeatRate -On&#xA;.1.3.6.1.4.1.8072.2.3.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried a &lt;code&gt;snmpget&lt;/code&gt; to confirm it. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$snmpget -v2c -c public localhost NET-SNMP-EXAMPLES-MIB::netSnmpExampleHeartbeatRate&#xA;NET-SNMP-EXAMPLES-MIB::netSnmpExampleHeartbeatRate = No Such Object available on this agent at this OID&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See, it tells no object available. What I understand is that it is not stored anywhere. &lt;code&gt;snmptrap&lt;/code&gt; sends the information, and that is it. Now I have understood that I can log the trap information. But does it store it anywhere in a place which can be queried? Did I miss anything?&lt;/p&gt;&#xA;" OwnerUserId="23892" OwnerDisplayName="0aslam0" LastEditorUserId="8499" LastEditDate="2016-03-19T17:39:35.543" LastActivityDate="2016-03-19T17:56:38.527" Title="Does snmptrap store the traps?" Tags="|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28847" PostTypeId="1" AcceptedAnswerId="28849" CreationDate="2016-03-19T13:46:54.977" Score="9" ViewCount="18168" Body="&lt;p&gt;As I know, NAT is the system, that divides IP addresses into two categories - public and private. Public represents the local network from the outside and private represents the device from the inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnetting divides one IP address into the part that represents the network from outside and the part that represents the device on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remembering that every IP addresses is 32 bit, having two of them (in NAT) gives an opportunity to use more IP addresses (both on the inside and on the outside), than in the situation with subnetting. Why would we need subnet masks then?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I ask google for my IP from computer and from my phone, I see the very same public IP, and when I scan the local network with nmap, I see only private IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why do we need subnet masks, if we have NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.&#xA;When the server sends out the signal to my PC, does it send it only to my public IP and the router remembers which private IP needs it, or does the server send out both, the public and the private IPs?&lt;/p&gt;&#xA;" OwnerUserId="23853" LastActivityDate="2022-12-19T13:41:44.123" Title="What is the purpose of subnetting, if we have NAT?" Tags="|nat|subnet|ip|" AnswerCount="7" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28849" PostTypeId="2" ParentId="28847" CreationDate="2016-03-19T16:00:44.750" Score="10" Body="&lt;p&gt;NAT and subnetting solve two different problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem 1: Previously IP addresses were divided into classes A, B and C. A class C address had a default subnet mask of 255.255.255.0 meaning 24 bits decide which network and the last 8 bits are for the host. With 8 bits for hosts you could have 2^8 - 1 = 254 IP addresses that are part of the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Historically it was not recommended to have more than around 250 IPs on the same network because of broadcasts flooding the network which meant that class B networks, which have a default subnet mask of 255.255.0.0 with 16 bits for hosts, have way too many addresses for a single network. Even more so with a class A network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also most of the time we require many smaller networks with just a few hosts which is why we subnet. Subnetting is basically moving the boundary between the host and network part of the address. So by decreasing the number of addresses on each network, you can increase the number of networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem 2 is that, even with subnetting, we have way too few addresses for every device to get its own, which is why we've got NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT or in this case PAT works by letting multiple private adresses share a single public IP address by mapping to a port number. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, in the IPv4 address space, we have a few reserved blocks of addresses which are meant to be used locally on a private network, e.g. 192.168.0.0 with a subnet mask of 255.255.255.0. This network can be used on multiple sites at the same time because they are private and not allowed to be used on the Internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when a device with a private IP wants to go out on the Internet, the private IP is mapped to a public IP address, together with a port number which means that multiple devices on a local network can share on a single public IP. This extends the number of devices that can access the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the server is on the same network as your PC it will communicate with your private IP. If the server is on the Internet, it will communicate with your public IP on a specific port which your router maps to your private IP.&lt;/p&gt;&#xA;" OwnerUserId="14973" LastEditorUserId="23862" LastEditDate="2016-03-20T11:41:37.753" LastActivityDate="2016-03-20T11:41:37.753" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="28850" PostTypeId="2" ParentId="28847" CreationDate="2016-03-19T16:04:21.367" Score="8" Body="&lt;p&gt;Let me see if I can clear up some misunderstanding for you:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;NAT is the system that divides IP addresses into two categories -&#xA;  public and private. Public represents the local network from the&#xA;  outside and private represents the device from the inside.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not quite.  NAT simply translates IP addresses from one set to another. As you use the terms, &quot;public&quot; means addresses that are globally unique and routable on the Internet.  &quot;Private&quot; addresses are not globally unique and therefore not routable on the Internet.  As NAT is normally used, your public address is the globally unique address that is the source address of all the packets you send on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Subnetting divides one IP address into the part that represents the&#xA;  network from outside and the part that represents the device on the&#xA;  network.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Take out the phrase &quot;from outside&quot; and your definition is correct.  Subnetting has nothing to do with &quot;inside&quot; or &quot;outside.&quot; Networks exist both on the &quot;inside&quot; as well as &quot;outside&quot; and therefore you need a way to identify networks and how to reach them.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When I ask google for my IP from computer and from my phone, I see the&#xA;  very same public IP, and when I scan the local network with nmap, I&#xA;  see only private IPs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You see the same IP because your router or firewall is translating the &quot;inside&quot; IPs of your phone and PC to a single public source address as your packets flow through the router.  When the return traffic flows through the router, it translates the destination address to the addresses on your PC or phone.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When the server sends out the signal to my PC, does it send it only to&#xA;  my public IP and the router remembers which private IP needs it, or&#xA;  does the server send out both, the public and the private IPs?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IP packets only have a source and destination address, which on the Internet can be considered &quot;public&quot; IPs.  The server has no idea if you are using NAT or not.   Yes, your router keeps track of the translation.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Remembering that every IP addresses is 32 bit, having two of them (in&#xA;  NAT) gives an opportunity to use more IP addresses (both on the inside&#xA;  and on the outside), than in the situation with subnetting. Why would&#xA;  we need subnet masks then?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I confess I'm not sure of the point you're trying to make here, or how you believe NAT would allow more addresses.   Your private address may be 192.168.1.100, translated into a public address.  My private address is also 192.168.1.100 translated into a different public address.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-19T16:04:21.367" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28851" PostTypeId="1" CreationDate="2016-03-19T16:09:42.150" Score="2" ViewCount="158" Body="&lt;p&gt;We have a pair of HP 2910al-24G switches that are used internally at one of our locations.  They are both updated with the most recent firmware and software and are operating fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During a routine inspection of our firewall logs, we discovered that both of these switches appeared to be originating a series of ICMP packets to a consistent set of addresses.  No other traffic to/from that address can be seen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The log entries are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2016-03-19 08:32:45 crit    ICMP ping id=0! From 10.1.1.53 to 18.213.146.12, proto 1 (zone Trust, int bgroup0). Occurred 1 times.&#xA;2016-03-19 08:32:15 crit    ICMP ping id=0! From 10.1.1.52 to 18.213.177.108, proto 1 (zone Trust, int bgroup0). Occurred 1 times.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any idea of what these packets are?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config file from one of the switches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show config&#xA;&#xA;&#xA;Startup configuration:&#xA;&#xA;&#xA;; J9145A Configuration Editor; Created on release #W.15.14.0007&#xA;; Ver #05:18.63.ff.35.05:b1&#xA;hostname &quot;sw13&quot;&#xA;module 1 type j9145a&#xA;module 2 type j9008a&#xA;module 3 type j9008a&#xA;timesync sntp&#xA;sntp unicast&#xA;sntp server priority 1 191.168.1.30&#xA;no telnet-server&#xA;time daylight-time-rule continental-us-and-canada&#xA;time timezone -480&#xA;web-management ssl&#xA;ip authorized-managers 191.168.1.93 255.255.255.255 access manager&#xA;ip authorized-managers 191.168.1.90 255.255.255.255 access manager&#xA;ip authorized-managers 191.168.1.92 255.255.255.255 access manager&#xA;ip authorized-managers 191.168.1.21 255.255.255.255 access manager&#xA;ip authorized-managers 191.168.1.51 255.255.255.255 access manager&#xA;ip authorized-managers 191.168.1.58 255.255.255.255 access manager&#xA;ip authorized-managers 191.168.1.104 255.255.255.255 access manager&#xA;ip authorized-managers 191.168.1.30 255.255.255.255 access manager&#xA;ip authorized-managers 191.168.1.29 255.255.255.255 access manager&#xA;ip default-gateway 191.168.1.1&#xA;ip ssh filetransfer&#xA;interface 1&#xA;   name &quot;xy-sw1&quot;&#xA;   exit&#xA;interface 2&#xA;   name &quot;xy-sw2&quot;&#xA;   exit&#xA;interface 3&#xA;   name &quot;xy-sw3&quot;&#xA;   exit&#xA;interface 4&#xA;   name &quot;xy-sw4&quot;&#xA;   exit&#xA;interface 5&#xA;   name &quot;xy-lin14&quot;&#xA;   exit&#xA;interface 6&#xA;   name &quot;xy-esxi1-nic6&quot;&#xA;   exit&#xA;interface 7&#xA;   name &quot;xy-esxi1-nic7&quot;&#xA;   exit&#xA;interface 8&#xA;   name &quot;xy-esxi3-nic7&quot;&#xA;   exit&#xA;interface 9&#xA;   name &quot;xy-esxi3-nic6&quot;&#xA;   exit&#xA;interface 10&#xA;   name &quot;xy-sw12&quot;&#xA;   exit&#xA;interface 13&#xA;   name &quot;xy-esxi2-nic6&quot;&#xA;   exit&#xA;interface 14&#xA;   name &quot;xy-esxi2-nic7&quot;&#xA;   exit&#xA;interface 15&#xA;   name &quot;xy-win3&quot;&#xA;   exit&#xA;interface 19&#xA;   name &quot;Office&quot;&#xA;   exit&#xA;interface 20&#xA;   name &quot;Office&quot;&#xA;   exit&#xA;interface 21&#xA;   name &quot;Mgt Port xy-ids1&quot;&#xA;   exit&#xA;interface 23&#xA;   name &quot;xy-sw14&quot;&#xA;   exit&#xA;snmp-server community &quot;supersecret...&quot; unrestricted&#xA;vlan 1&#xA;   name &quot;DEFAULT_VLAN&quot;&#xA;   untagged 1-24,A1-A2,B1-B2&#xA;   ip address 191.168.1.52 255.255.252.0&#xA;   exit&#xA;spanning-tree&#xA;spanning-tree priority 1&#xA;no tftp client&#xA;no tftp server&#xA;no autorun&#xA;no dhcp config-file-update&#xA;password manager&#xA;password operator&#xA;&#xA;&#xA;xy-sw13# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23857" LastEditorUserId="8499" LastEditDate="2016-03-19T23:37:58.567" LastActivityDate="2018-01-29T14:12:18.903" Title="Mystery ICMP Packets from HP 2910 Switch" Tags="|switch|icmp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="28852" PostTypeId="2" ParentId="8126" CreationDate="2016-03-19T17:34:07.380" Score="-1" Body="&lt;p&gt;I will explain this in simple word&#xA;As you know there are L2 &amp;amp; L3 protocols, for the L2 protocols we don't have IP address relate to Multicast Frame exchange between group members and thus we must select Multicast MAC address (IEEE). Now for the the L3 protocols there is IP address relate to Multicast Packet and thus by using this and MAC address &quot;01-00-5E&quot; we can create Multicast MAC-address for Frame exchange between group members. &lt;/p&gt;&#xA;" OwnerUserId="23858" LastActivityDate="2016-03-19T17:34:07.380" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28854" PostTypeId="2" ParentId="28845" CreationDate="2016-03-19T17:56:38.527" Score="0" Body="&lt;p&gt;A device sends a trap because of an event. The sending device may, or may not, log the event somewhere, but it doesn't keep it in a database. The trap is just a signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, a switch could send an SNMP trap or inform when a switch port goes down (e.g. a user has disconnected or shut down his PC). The switch may, or may not, be configured to log such event in its log (which is only so big and eventually gets overwritten), or to a more permanent logging server. You can send an SNMP get to see the status of the switch ports, but not to ask for a copy of the event. The event happened, maybe got logged somewhere, and you were informed about the event.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-19T17:56:38.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28855" PostTypeId="2" ParentId="28835" CreationDate="2016-03-19T19:34:01.767" Score="0" Body="&lt;p&gt;You could use some higher-end wireless equipment and do a spectral scan of your Wi-Fi frequency range to select best frequency for your Wi-Fi router. Ubiquiti, MikroTik, and few other manufacturers of Wi-Fi gear have such an ability (even SOHO routers). They're not very expensive and quite powerful, also providing a toolkit to inspect what's happening to your network (wired and wireless).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I bet when you experience high pings on Wi-Fi, your CCQ drops to a low %. This can be caused by a number of factors, but mostly by interference from nearby devices operating on same or nearby channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, remember that wireless communication is two-way thing; the interference may affect AP as much as client.&lt;/p&gt;&#xA;" OwnerUserId="5566" LastEditorUserId="8499" LastEditDate="2016-03-19T19:38:20.470" LastActivityDate="2016-03-19T19:38:20.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28856" PostTypeId="2" ParentId="28847" CreationDate="2016-03-19T19:41:47.430" Score="3" Body="&lt;p&gt;The internet was built without NAT: it's a later invention. NAT imposes three very strict limitations on networks. Firstly, you can't address hosts behind NAT directly. Secondly, there must be a single gateway linking the network to the rest of the internet. Thirdly, the gateway must track the TCP source and destination ports of every connection through it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the internet core, there are a large number of networks that have more than one gateway. The gateways are not aware of one another's network traffic, and they are stateless: they do not track the TCP sequence numbers of every connection through them. This greatly improves their performance. How is a packet routed through the correct gateway to the correct network? Via routing tables, which match the network prefix.&lt;/p&gt;&#xA;" OwnerUserId="23860" LastActivityDate="2016-03-19T19:41:47.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28857" PostTypeId="1" AcceptedAnswerId="28859" CreationDate="2016-03-19T19:58:12.573" Score="6" ViewCount="22896" Body="&lt;p&gt;The term &lt;strong&gt;usec&lt;/strong&gt; appears in the &lt;code&gt;delay&lt;/code&gt; field of the &lt;code&gt;show interface&lt;/code&gt; command on a router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# show interfaces fastethernet 0&#xA; Fast Ethernet0 is up, line protocol is up &#xA;   Hardware is DEC21140, address is 0000.0c0c.1111 (bia 0002.eaa3.5a60)&#xA;   Internet address is 10.0.0.1 255.0.0.0&#xA;   MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, rely 255/255, load 1/255&#xA;                                   ^^^^^^^^^^^^&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://en.wikipedia.org/wiki/Microsecond&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia&lt;/a&gt;, a usec is a microsecond:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A microsecond is an SI unit of time equal to one millionth (0.000001 or 10−6 or 1/1,000,000) of a second. Its symbol is μs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are values associated with each interface, based upon the interface's speed:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;An &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/interface/command/reference/finter_r/irfshoin.html#wp1056673&quot; rel=&quot;noreferrer&quot;&gt;ethernet&lt;/a&gt; (10 Mbps) interface has a delay of 1000 usec.&lt;/li&gt;&#xA;&lt;li&gt;A &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/interface/command/reference/finter_r/irfshoin.html#wp1018148&quot; rel=&quot;noreferrer&quot;&gt;fast ethernet&lt;/a&gt; (100 Mbps) interface has a delay of 100 usec.&lt;/li&gt;&#xA;&lt;li&gt;A &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/interface/command/reference/finter_r/irfshoin.html#wp1058046&quot; rel=&quot;noreferrer&quot;&gt;gigabit ethernet&lt;/a&gt; (1000 Mbps) interface has a delay of 10 usec.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In effect, the lower the delay usec, the higher the interface speed. But &lt;strong&gt;what is delay really measure of? What goes into the calculation to determine that a 100 Mbps link has a delay of 100 usec (and so on)?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can't be the time it takes for a &quot;bit&quot; to cross the wire, because voltage applied to any interface speed traverses at the speed of light. It can't be a measurement of how many bits can be sent over a given time frame (because that is the Bandwidth measurement).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what is usec &lt;em&gt;really&lt;/em&gt; a measure of?&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="8499" LastEditDate="2016-03-19T20:19:10.860" LastActivityDate="2016-03-20T02:17:10.593" Title="What is &quot;usec&quot; and &quot;delay&quot; a measurement of?" Tags="|cisco|interface|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28858" PostTypeId="2" ParentId="28805" CreationDate="2016-03-19T20:07:15.817" Score="5" Body="&lt;p&gt;Most RTBH implementations at ISPs require you to announce a subnet (let it be a /32) with appropriate BGP community (again, at most ISPs it's 666) to trigger RTBH at PE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like you're on right track. I'd also check for something like &lt;code&gt;set community additive 64520:666&lt;/code&gt; on R2.&lt;/p&gt;&#xA;" OwnerUserId="5566" LastActivityDate="2016-03-19T20:07:15.817" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28859" PostTypeId="2" ParentId="28857" CreationDate="2016-03-19T20:17:20.983" Score="1" Body="&lt;p&gt;That is a measurement of the time between bits as they are placed on the &quot;wire.&quot; For instance, a 1 Gbps interface will send one frame every 10 microseconds, but a 100 Mbps interface does that 10 times slower. It is basically the serialization delay imposed by the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This number is used by EIGRP in its metric calculations, as are all the numbers on the line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec, rely 255/255, load 1/255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/interface/command/reference/finter_r/irfshoin.html#wp1017950&quot; rel=&quot;nofollow&quot;&gt;Interface Commands&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/interface/configuration/guide/finter_c/icfgenrl.html#wp1090579&quot; rel=&quot;nofollow&quot;&gt;Cisco document&lt;/a&gt; that explains more:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Setting Interface Delay&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Higher-level protocols might use delay information to make operating&#xA;  decisions. For example, IGRP can use delay information to&#xA;  differentiate between a satellite link and a land link. To set a delay&#xA;  value for an interface, use the following command in interface&#xA;  configuration mode:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Setting the delay value sets an informational parameter only; you&#xA;  cannot adjust the actual delay of an interface using this&#xA;  configuration command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ine.com/2009/12/23/ccna-eigrps-use-of-bandwidth-and-delay/&quot; rel=&quot;nofollow&quot;&gt;This CCNA &quot;Core Knowledge&quot; document&lt;/a&gt; explains:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Setting bandwidth or delay on an interface does not change any physical properties of the interface at all; you are just changing&#xA;  the values that the interface reports for EIGRP metric purposes&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The DELAY command is a powerful command for manipulating EIGRP paths.&#xA;  Since the BANDWIDTH command can end up impacting a lot of other&#xA;  configurations (like QoS), we can use the DELAY command to manipulate&#xA;  EIGRP metrics (and therefore, paths) without having to touch the&#xA;  BANDWIDTH command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-20T02:17:10.593" LastActivityDate="2016-03-20T02:17:10.593" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="28860" PostTypeId="2" ParentId="28704" CreationDate="2016-03-19T21:07:45.160" Score="4" Body="&lt;p&gt;Legal and compliance questions aside, from pure technical perspective, the answer to your question is - it depends. Out of my own practice: even cheap UTP network cables, even twisted around 230V power cables for many meters in household environments, somehow seem to work fine and still have good bandwidth with no interruptions with all the washing machines and kettles running. Also from my experience, UTP wiring around fluorescent lightning in hanging ceilings has some effect to max speeds which FTP cable fully sorts out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The theory is - the more current you run through 3-phase cable the more field you create around it which is interference for normal communication. Especially if loads are inductive. But Cat. 7 is very robust cable, so based on my observations, you'd probably be fine. But still, consider your local laws and regulations for cable installations.&lt;/p&gt;&#xA;" OwnerUserId="5566" LastActivityDate="2016-03-19T21:07:45.160" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28862" PostTypeId="2" ParentId="28810" CreationDate="2016-03-20T00:50:37.117" Score="0" Body="&lt;p&gt;Even if all ports are the same speed switches need to be able to use store and forward as a fallback. Otherwise when the network started to get busy a large number of packets would end up being dropped because their outgoing port was blocked with another transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding speeds if the incoming and outgoing ports are different speeds then the switch must take steps to accomodate that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the outgoing port is slower than the incoming port then it can start outgoing trasnmission as soon as it has received the frame headers and determined the destination port but it will end up having to buffer the bulk of the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the outgoing port is faster than the incoming port then it can't start transmission until it is sure it has received a sufficient proportion of the frame. Since &quot;Ethernet II&quot; frames don't have a length field that practically means wating for the end of packet marker making the switch effectively &quot;store and forward&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to shared memory verses per port buffers it would be possible to build a pure shared memory based switch but the demands on the shared memory system would be extremely high. The shared memory would have to be able to support multiple simultanious streams of data running at different speeds and writing to different parts of the memory. The total bandwidth of the shared memory would have to be extremely high.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-03-20T00:50:37.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28863" PostTypeId="2" ParentId="28847" CreationDate="2016-03-20T01:30:22.530" Score="2" Body="&lt;p&gt;The OP is mixing 2 very different concepts.&#xA;Subnetting is a routing concept that allows for segmentation and a hierarchical routing structure. Think in terms of a phone number with (areacode) Exchange-terminal. In routing there is an Autonomous System Number (areacode) Network (exchange) and host (-terminal). If you think in those terms, the subnet mask determines the size of the exchange-terminal range. This is what routing protocols use to send packets to and from the correct addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As noted above, a NAT translates between 2 networks that cannot route between them. In most cases this is between the public internet address and the private RFC1918 private space that can be used over and over in different locations. The NAT device keeps track of which flows map to the address and ports on two sides of the network space. While this is in your router, which is the IP layer, it is not a function of routing, but works at the transport layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps&lt;/p&gt;&#xA;" OwnerUserId="23867" LastActivityDate="2016-03-20T01:30:22.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28864" PostTypeId="1" CreationDate="2016-03-20T08:51:42.243" Score="4" ViewCount="4011" Body="&lt;p&gt;I have the following Questions regarding Delays and throughput&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is transmission rate same as Bandwidth?&lt;/li&gt;&#xA;&lt;li&gt;What is throughput and while calculating throughput why do we&#xA;consider transmission delay. Shouldn't we also consider the&#xA;propagation delay?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I know the question might sound silly,but please help. &lt;/p&gt;&#xA;" OwnerUserId="23487" LastEditorUserId="8499" LastEditDate="2016-03-20T17:21:57.777" LastActivityDate="2017-12-15T20:20:08.797" Title="Delays and throughput" Tags="|bandwidth|throughput|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28865" PostTypeId="1" AcceptedAnswerId="28868" CreationDate="2016-03-20T10:30:54.407" Score="3" ViewCount="253" Body="&lt;p&gt;I acknowledge the fact that satellite internet maybe quite slow and have high latency. This is generally true for TCP applications like HTTP, FTP etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a UDP VPN connection was to be setup between two hosts THROUGH satellite internet, wouldn't that in effect reduce the latency and prompt for a faster internet or am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="22713" LastActivityDate="2016-03-20T15:17:36.477" Title="Satellite Internet Connection - Faster Speed?" Tags="|internet|udp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28868" PostTypeId="2" ParentId="28865" CreationDate="2016-03-20T15:17:36.477" Score="6" Body="&lt;p&gt;I think you are confusing cause and consequence as they relate to latency.&lt;/p&gt;&#xA;&lt;p&gt;A satellite connection has high latency. That's an inescapable effet of the distance the signal has to travel to reach the satellite (typically in geostationary orbit), even at the speed of light.&lt;/p&gt;&#xA;&lt;p&gt;This affects TCP connections most because TCP acknowledges packets as they are received, and imposes a limit on the number of bytes that can be &amp;quot;in flight&amp;quot; between the endpoints at any given time. This is the TCP window, and it determines the max bandwidth for a single TCP session on your link as WindowSize  /latency. As the latency increases, the max bandwidth for your session decreases.&lt;/p&gt;&#xA;&lt;p&gt;If you use UDP, you are no longer constrained by a limit like the TCP window size, so you can in theory reach a much higher bandwidth for that connection. However, the latency is still there, you have just avoided one of its effects.&lt;/p&gt;&#xA;&lt;p&gt;Ultimately, if your application really needs TCP, typically because it requires high reliability of its data transfer, you will probably be better off tuning your TCP parameters than switching to UDP, because in the latter case you would end up having to reimplement reliability higher up the stack. There are a number of RFCs that deal with how to use TCP in high-latency environments, such as &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1323&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc1323&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21892" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-20T15:17:36.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28869" PostTypeId="2" ParentId="14683" CreationDate="2016-03-20T17:06:40.530" Score="-1" Body="&lt;p&gt;I found this which helps me when using the show chassis command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LDIw8.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LDIw8.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23879" LastEditorUserId="8499" LastEditDate="2016-03-20T17:47:17.540" LastActivityDate="2016-03-20T17:47:17.540" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28872" PostTypeId="1" CreationDate="2016-03-20T21:46:16.433" Score="2" ViewCount="1038" Body="&lt;p&gt;How does TCP improve the ability of IP to send really large files? Show me the math. (Calculate the max packet that IP can send and multiply by the maximum fragments. Compare that to what TCP can do.)&lt;/p&gt;&#xA;" OwnerUserId="23882" LastEditorUserId="8499" LastEditDate="2016-03-20T22:54:30.647" LastActivityDate="2016-03-23T07:37:32.887" Title="Does TCP improve the ability of IP to send really really large files?" Tags="|tcp|ip|network-core|" AnswerCount="3" CommentCount="4" ClosedDate="2016-03-23T11:53:51.667" ContentLicense="CC BY-SA 3.0" />
  <row Id="28873" PostTypeId="1" AcceptedAnswerId="28874" CreationDate="2016-03-20T22:00:49.373" Score="2" ViewCount="2110" Body="&lt;p&gt;From what I gathered, CSMA detects that a medium is idle by checking for the occurence of the interpacket gap (IFS, 96 bits of 0s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering however what happens when you send an Ethernet frame which includes an IFS as its payload over the wire. Intuitively, it should cause another sender listening on the wire to immediately start its transmission, thus causing a collision. Is that expected or am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="23883" LastActivityDate="2016-03-20T22:23:34.997" Title="Ethernet, the interpacket gap and idle detection" Tags="|ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28874" PostTypeId="2" ParentId="28873" CreationDate="2016-03-20T22:23:34.997" Score="2" Body="&lt;p&gt;In ethernet, a sender must wait until no others are sending. This means that there is no traffic detected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are confusing the IPG with with traffic. The IPG is an idle time, and an ethernet frame will not contain idle time. The &lt;em&gt;minimum&lt;/em&gt; IPG is a long enough time to send 96 bits on the medium, but it is &lt;em&gt;idle&lt;/em&gt; time.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-20T22:23:34.997" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28875" PostTypeId="2" ParentId="28872" CreationDate="2016-03-20T22:34:47.230" Score="4" Body="&lt;p&gt;IP is a layer-3 protocol, and TCP is a layer-4 protocol. Neither protocol understands files. An application will send data to layer-4 (TCP), and TCP will break the data into chunks and encapsulate it in TCP segments. TCP will pass the segments to layer-3 (IP), which in turn encapsulates the segments in packets. IP will pass the packets to layer-2 (ethernet), which encapsulates the packets in frames. Ethernet will then pass the frames to the hardware (driver) which serializes the frames to bits on the wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP is one of many layer-4 protocols. It is a connection-oriented protocol which creates a bi-directional conversation with TCP on the other end. TCP provides guarantees for delivery and reassembly of out-of-order segments, and this is why it is often used for files transfers, but an application could use something like UDP, which doesn't have any guarantees. With UDP, the application must take on the responsibilities to get all data and reassemble it into the correct order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwjbj6PtrdDLAhUHmh4KHaEMAG4QFggdMAA&amp;amp;url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FOSI_model&amp;amp;usg=AFQjCNE-WujowlSWqKKibFK87N9r6U7HlA&amp;amp;sig2=0iKHsr46gW7rcwblQQuqSg&quot; rel=&quot;nofollow&quot;&gt;This Wikipedia article&lt;/a&gt; may help you understand the OSI Model.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-20T22:55:43.860" LastActivityDate="2016-03-20T22:55:43.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28876" PostTypeId="2" ParentId="28872" CreationDate="2016-03-20T23:32:13.487" Score="1" Body="&lt;p&gt;TCP provides three features that IP alone does not have:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Guaranteed delivery.  If a packet is lost, TCP will detect and&#xA;resend it.&lt;/li&gt;&#xA;&lt;li&gt;Packet ordering.  If packets arrive out of order, TCP can&#xA;reassemble them in the correct order.&lt;/li&gt;&#xA;&lt;li&gt;Transmission rate control.  TCP allows the receiver to tell the sender to slow down or speed up as necessary.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-20T23:32:13.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28880" PostTypeId="2" ParentId="17673" CreationDate="2016-03-21T04:37:10.363" Score="2" Body="&lt;p&gt;The only thing you need to do to make this work, is to create the switch virtual interfaces (SVIs) on the L3 switch and assign them IP addresses for both VLAN 1 and VLAN 2. Then you need to setup your end devices with the default gateway address, which would be the IP address of the SVI in the approperiate VLAN and turn on routing on the L3 switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You do not need to configure default gateways on the L2 switches. You would have to do this, if you would like to have L2 switch as a default gateway for your end devices...&#xA;Then the scenario would be to make an SVI on the L2 switch and point the default-gateway to the L3 switch which would make the routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also... The ports connected to the switches can be normal access ports, unless you want to have 2 different VLANs on the same L2 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that I helped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards! &lt;/p&gt;&#xA;" OwnerUserId="22574" LastActivityDate="2016-03-21T04:37:10.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28882" PostTypeId="1" AcceptedAnswerId="28910" CreationDate="2016-03-21T06:15:04.780" Score="2" ViewCount="279" Body="&lt;p&gt;The working of BPDU filter configured globally is described as follows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If that port receives a BPDU it loses its Portfast status and&#xA;  transitions through the normal Blocking, Learning, Listening, and&#xA;  Forwarding state, as necessary&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What is the purpose of the global BPDU filter? Why doesn't it work the same way as BPDU filter configured on a port?&lt;/p&gt;&#xA;" OwnerUserId="4289" LastEditorUserId="4289" LastEditDate="2016-03-23T13:15:59.520" LastActivityDate="2016-03-23T13:15:59.520" Title="Strange Global BPDU Filter" Tags="|switch|spanning-tree|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28883" PostTypeId="2" ParentId="28882" CreationDate="2016-03-21T07:07:58.943" Score="2" Body="&lt;p&gt;The different behavior of the two commands is because they serve a different purpose. Both having the same name is confusing though. They could have named the global command something like &quot;edge protect&quot;. Portfast ports are spanning-tree edge ports, so only meant to be connected to systems that don't run spanning tree. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The global BPDU filter command is there to detect when a port has been   incorrectly configured as an edge port and make it participate in spanning tree.&lt;/li&gt;&#xA;&lt;li&gt;BPDU filter on the port is meant to connect two different spanning tree domains that shouldn't talk with each other. You have to be absolutely sure there will be no layer 2 loops. That is why you cannot set this globally.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The different purpose is also the reason the two work differently in sending BPDUs: configured on the port will send no BPDUs, configured on globally, it will send for ten hello timers (=11 BPDUs, one at the beginning, plus one every hello timer).&lt;/p&gt;&#xA;" OwnerUserId="220" LastEditorUserId="1392" LastEditDate="2016-03-22T05:47:32.867" LastActivityDate="2016-03-22T05:47:32.867" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28885" PostTypeId="1" CreationDate="2016-03-21T09:20:57.563" Score="0" ViewCount="545" Body="&lt;p&gt;How can I match the IP:Port pair in Linux to handle that packet via some particular table? Is that possible or traffic marking is the only way I can go? &lt;/p&gt;&#xA;" OwnerUserId="19133" LastEditorUserId="8499" LastEditDate="2016-03-21T17:11:35.457" LastActivityDate="2016-04-21T11:39:30.510" Title="Linux policy routing based on port number" Tags="|routing|linux|pbr|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-12T17:58:40.093" ContentLicense="CC BY-SA 3.0" />
  <row Id="28886" PostTypeId="2" ParentId="28885" CreationDate="2016-03-21T10:22:56.740" Score="2" Body="&lt;p&gt;I don't know of any other way as marking the packets via iptables in the mangle chain and then use policy routing to base the routing on the mark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in my humble opinion &quot;traffic marking&quot; is the only way to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit: A general explanation for policy-routing with iptables and ip can be found &lt;a href=&quot;http://www.taitclarridge.com/techlog/2009/10/iptables-route-traffic-from-specific-interface-to-a-specific-gateway.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; (this was the first explanation i found that takes into account that iptables and ip use different numeral systems (decimal / hexadecimal))&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="19765" LastEditorUserId="19765" LastEditDate="2016-04-21T11:39:30.510" LastActivityDate="2016-04-21T11:39:30.510" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28887" PostTypeId="1" AcceptedAnswerId="28896" CreationDate="2016-03-21T11:16:23.477" Score="3" ViewCount="933" Body="&lt;p&gt;&lt;strong&gt;My Plan (Short Version)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually we have three access points directly connected to our router. I want all of them to connect to a switch and from there only one cable to the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Hardware:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Router: Cisco 1812&lt;/li&gt;&#xA;&lt;li&gt;Switch: Dell Powerconnect 5324&lt;/li&gt;&#xA;&lt;li&gt;Access Points: Cisco Aironet AIR-SAP702I-E-K9 (3 Pieces)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My Plan (Longer Version):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, we have a Cisco router 1812 with three access points directly connected to it. Everything works fine, but I think it is waste of ports. Also, I need a free port next week because of new hardware. The access points have two SSIDs (Private, Guest), with VLAN40 (Private) and VLAN50 (Guest) on it. What I want is that one port on the router be a trunk Port which carries both VLANs, and I want to use four Ports on the DELL PowerConnect 5324. One for the link to the router, and three for the access points. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How should I configure the ports on the switch and the port on the&#xA;router? I think the router's port should be &lt;code&gt;switchport mode trunk&lt;/code&gt;,&#xA;or do I even have to change it because it is actually configured&#xA;like this? (I'll post the configuration below!)&lt;/li&gt;&#xA;&lt;li&gt;How does this even work? Because the Port doesn't have VLAN50&#xA;configured. FYI: VLAN10 is DMZ-VLAN, it has nothing to do with the&#xA;AP.&lt;/li&gt;&#xA;&lt;li&gt;Do I only need to add VLAN 40 &amp;amp; VLAN 50 to allowed VLANs on the 4 Ports? &lt;/li&gt;&#xA;&lt;li&gt;Is there a standard protocol for VLAN numbers? Because how does the&#xA;Switch know, which AP has VLAN40 if it is only configured on the&#xA;router? Can those two different pieces of hardware communicate well,&#xA;even if they are from two different companies?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ROUTER:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet6&#xA; description AccesPoint1&#xA; switchport access vlan 10&#xA; switchport trunk native vlan 40&#xA; switchport mode trunk&#xA;!         &#xA;interface FastEthernet7&#xA; description AccessPoint2&#xA; switchport access vlan 10&#xA; switchport trunk native vlan 40&#xA; switchport mode trunk&#xA;!         &#xA;interface FastEthernet8&#xA; description AccessPoint3&#xA; switchport access vlan10 &#xA; switchport trunk native vlan 40&#xA; switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ACCESS POINTS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0&#xA; no ip address&#xA; no ip route-cache&#xA; duplex auto&#xA; speed auto&#xA; hold-queue 160 in&#xA;!         &#xA;interface GigabitEthernet0.1&#xA; encapsulation dot1Q 1&#xA; no ip route-cache&#xA;!         &#xA;interface GigabitEthernet0.40&#xA; encapsulation dot1Q 40 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; no bridge-group 1 source-learning&#xA;!         &#xA;interface GigabitEthernet0.50&#xA; encapsulation dot1Q 50&#xA; no ip route-cache&#xA; bridge-group 50&#xA; bridge-group 50 spanning-disabled&#xA; no bridge-group 50 source-learning&#xA;!         &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think I don't need to post the VLAN Configuration itself, ACLs, or something else because it shouldn't be changed; only the interfaces need to be configured another Way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch isn't configured yet because I hope there will be some nice input and help here.&lt;/p&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="8499" LastEditDate="2016-03-21T17:24:41.000" LastActivityDate="2016-03-21T17:39:34.897" Title="Cisco Router with Dell Switch VLAN Configuration" Tags="|cisco|switch|vlan|trunk|dell|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28888" PostTypeId="1" CreationDate="2016-03-21T12:02:07.350" Score="4" ViewCount="2472" Body="&lt;p&gt;I am broading up more this unanswered question: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/26387/vlan-tagging-and-access-port&quot;&gt;VLAN tagging and access port&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume I am trying to accomplish Double Tagging Attack. From my understanding, prerequisites of this attack is to be connected to access port, which has the same VLAN as Native VLAN on trunk ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an attacker, I create frame with two tags inside. The inner tag being the VLAN of my target and the outer tag being the tag of Native VLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what happens when access port sees the tagged traffic? It would make sense that it would just discard it, preventing this attack from happening. From the materials what I've seen, switch strips the VLAN tag and since it was native VLAN, it doesn't add new tag on trunk link, therefore it passes my frame with target VLAN, effectively reaching my target. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would understand that this can happen if I use it with combination of Switch spoofing and creating trunk link between my PC and Switch (using DTP for example). But then, there is no reason to double tag it, because I am on trunk link and there is no need for modification and I can just use my target VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone clarify this for me?&lt;/p&gt;&#xA;" OwnerUserId="16890" LastEditorUserId="16890" LastEditDate="2016-03-21T12:09:06.493" LastActivityDate="2016-03-21T13:25:01.863" Title="What happens with tagged traffic on access port of Cisco switch?" Tags="|cisco|switch|vlan|security|trunk|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28892" PostTypeId="2" ParentId="28888" CreationDate="2016-03-21T13:25:01.863" Score="3" Body="&lt;p&gt;Please check this -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Double tagging VLAN hopping attack takes advantage 802.1Q tagging and tag removal process of many types of switches. Many switches remove only one 802.1Q tag. In Double tagging attack, an attacker changes the original frame to add two VLAN tags. An outer tag, which is of his own VLAN and an inner hidden tag of the victim's VLAN. &lt;strong&gt;Here the attacker's PC must belong to the native VLAN of the trunk link.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the double tagged frame reaches the switch, the switch can only see the outer tag of the VLAN that the interface really belongs to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Switch OmniSecuSW1 will now remove the outer VLAN Tag and will forward to all the ports belong to native VLAN (in this example, VLAN1). One copy of that frame is forwarded to the trunk link to reach the next switch OmniSecuSW2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the frame reaches OmniSecuSW2, it will open the frame to see the second tag. OmniSecuSW2 will now assume that frame belongs to VLAN 100 and it is forwarded to VLAN 100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For further reference -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.omnisecu.com/ccna-security/what-is-double-tagging-attack-how-to-prevent-double-tagging-attack.php&quot; rel=&quot;nofollow&quot;&gt;http://www.omnisecu.com/ccna-security/what-is-double-tagging-attack-how-to-prevent-double-tagging-attack.php&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-03-21T13:25:01.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28893" PostTypeId="2" ParentId="24784" CreationDate="2016-03-21T14:17:13.057" Score="0" Body="&lt;p&gt;Allow port forward on TCP 21 to your server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same for TCP 50000 - 50100 following advice of &lt;a href=&quot;https://wiki.filezilla-project.org/Network_Configuration#Active_mode&quot; rel=&quot;nofollow&quot;&gt;https://wiki.filezilla-project.org/Network_Configuration#Active_mode&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Worked for me on Meraki MX64w&lt;/p&gt;&#xA;" OwnerUserId="23902" LastActivityDate="2016-03-21T14:17:13.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28894" PostTypeId="1" CreationDate="2016-03-21T16:01:46.533" Score="2" ViewCount="5213" Body="&lt;p&gt;I have trouble understanding the concept of bisection bandwidth in high performance computing clusters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wikipedia article on bisection bandwidth, and online materials say that bisection bandwidth is the minimum number of links one have to cut to partition the network in two equal parts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding from reading research papers in networking (like MapReduce) keep saying that bisection bandwidth represents the &quot;lower bound&quot; on the bandwidth that the network can &quot;push through&quot;. Is it a correct intuition? If yes, how do I reconcile it with the definition from Wikipedia et al.? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a perspective of one single node, does bisection bandwidth roughly represent the &lt;em&gt;average&lt;/em&gt; bandwidth that the node can have to any other node in the network?&lt;/p&gt;&#xA;" OwnerUserId="1526" LastEditorUserId="8499" LastEditDate="2018-12-20T21:24:08.670" LastActivityDate="2018-12-20T21:24:08.670" Title="Understanding bisection bandwidth" Tags="|switch|bandwidth|network-core|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28896" PostTypeId="2" ParentId="28887" CreationDate="2016-03-21T17:39:34.897" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;On the switch, the four ports should all be the same:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Make VLAN 40 untagged. &lt;/li&gt;&#xA;&lt;li&gt;Make VLAN 50 tagged.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You don't have to make any changes to the router.  You can use any port you've shown us, as they are all configured the same.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;By default, Cisco will allow all VLANs on a trunk port.  You don't have to explicitly allow VLAN 50, although it's generally a good idea to only allow the ones you need.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you want to specify which VLANs, then yes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There's no standard for VLAN numbers.  The VLAN information (VID) is carried in the 802.1q Ethernet frame.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-21T17:39:34.897" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28897" PostTypeId="2" ParentId="28894" CreationDate="2016-03-21T18:09:27.537" Score="3" Body="&lt;p&gt;This is one of those terms for which multiple definitions have been created. Also, remember that Wikipedia is maintained by everyone, including you. It can often end up with a definition from an individual's perspective, especially with relatively obscure topics, such as this. You, or anyone else, is free to edit or add to Wikipedia articles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most people don't require bisectional bandwidth to have two equal parts; you can use bisectional bandwidth on any network which has been arbitrarily bisected, even if the parts are not equally sized. It may be that the Wikipedia author believes bisecting means creating two equal parts, but it only means creating two parts, equal or not, from a whole.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the author of &lt;em&gt;&lt;a href=&quot;http://etherealmind.com/bisectional-bandwidth-l2mp-trill-bridges-design-value/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bisectional Bandwidth. And why L2MP and Trill/RBridges is important?&lt;/a&gt;&lt;/em&gt; does a good job of explaining it by using it to demonstrate a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is usually meant by bisectional bandwidth is the available bandwidth between two parts of a network. This can be created by STP blocking links that can't be used to move traffic except in a failure of a forwarding link. By using something other than STP, you may be able to suddenly double the bisectional bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The term is not normally applied to individual nodes. Instead, it applies to links between the switches.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-16T01:18:03.227" LastActivityDate="2017-01-16T01:18:03.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28899" PostTypeId="2" ParentId="20273" CreationDate="2016-03-21T18:17:03.687" Score="4" Body="&lt;p&gt;Weirdly enough I just answered a similar question here: &lt;a href=&quot;https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1&quot;&gt;https://unix.stackexchange.com/questions/269909/ipsec-rightsubnet-to-wide-cannot-override-routing-table-ipsec-route-some-pack?atw=1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will answer similarly: what you're doing is VPN concentration. There are various vendor-specific ways to do this, some very straightforward, some extremely esoteric, but my recommendation is to avoid ALL that and configure your network from a layer 3 level, with IPsec doing lower level connection glue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically in your case, you'd create IPsec links between the branch office and the main office but instead of specifying each office's subnets directly in the IPsec config, you'd create /30 point-to-point links between them, then use GRE on top of that to either statically point subnets to each link, or (far better) use OSPF to redistribute your routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point to point links with routing logic is far more scalable versus a bunch of static routes with directly connected subnets. In the latter (which you're currently using) you have to constantly reconfigure IPsec to be aware of what can route where, even when you're adding one subnet. As you add more than one subnet, the complexity grows exponentially and quickly becomes untenable. Add in firewall / security policies and security planes at various points and you've quickly got a huge glut of configuration on your hands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point to point links will completely remove the complexity, because routing now lies in the typical routing spots: static tables, or dynamic routing protocols like OSPF and BGP. If you leverage OSPF and BGP you will never have to add routes throughout your network; you simply add a subnet and the route will propagate automatically throughout all the offices. Also your security will be straightforward, as you can now place security planes in logical places, rather than working out where they sort of fit in IPsec-land.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will most likely require a weekend overhaul of your remote office configurations to the main office. However once this is in place, future changes and adjustments will be extremely straightforward; in your current config, any change will require a number of manual ripple changes throughout the network, and the complexity will introduce errors.&lt;/p&gt;&#xA;" OwnerUserId="23909" LastEditorUserId="-1" LastEditDate="2017-04-13T12:37:13.227" LastActivityDate="2016-03-21T18:17:03.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28900" PostTypeId="2" ParentId="2800" CreationDate="2016-03-21T18:18:51.430" Score="10" Body="&lt;p&gt;This is directly addressed by the &lt;em&gt;ANSI/TIA/EIA 568-B Commercial Building Telecommunications Cabling Standard&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Connecting Hardware and Polarity&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Optical fiber shall be installed with odd numbered fibers having&#xA;  Position A at one end and Position B at the other. Even numbered&#xA;  fibers will have position A and B reversed from the odd numbered&#xA;  fibers. When using the 568SC connector or other duplex connectors, the&#xA;  above polarity must be maintained.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When using copper cabling, it must be straight through from termination to termination, but optical cabling must be cross from one termination to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason fiber cabling is crossed is simple: when connecting fiber from one device to another, the fiber strands need to be cross so that Tx goes to Rx on each end. For this reason, fiber patch cables are crossed, but when you have horizontal cabling, you have two fiber patch cords which cancel each other out. When the horizontal cabling is crossed, you end up with three crossed cables, making the whole a crossed cable, leading to success.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-21T18:28:08.557" LastActivityDate="2016-03-21T18:28:08.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28902" PostTypeId="2" ParentId="27981" CreationDate="2016-03-21T19:04:36.820" Score="3" Body="&lt;p&gt;It is wholly dependent on the software that is collecting the flow. You would need to look up what the software vendor recommends and configure your devices accordingly. If it is higher you will get flows reporting the full flow duration instead of the say 60 second interval that is expected by certain platforms. This leads to incorrect flow accounting and general misinformation. Take the reverse for shorter flow expiration timers. If you can't find any information for your export product I would recommend 60 seconds, it is the most common in my experience.&lt;/p&gt;&#xA;" OwnerUserId="16282" LastActivityDate="2016-03-21T19:04:36.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28903" PostTypeId="1" AcceptedAnswerId="28905" CreationDate="2016-03-21T20:29:12.673" Score="3" ViewCount="2851" Body="&lt;p&gt;Student here. Could someone please explain to me the difference between these two? I'm using a serial connection for this. Does the latter refer to one individual serial terminal session? Why would one use line configuration mode over global? Thanks, I appreciate any help.&lt;/p&gt;&#xA;" OwnerUserId="19051" LastActivityDate="2016-03-21T21:17:22.357" Title="Cisco IOS CLI -- Difference between global configuration and console line configuration mode (using line console 0 command)?" Tags="|cisco|switch|ethernet|cisco-ios|cli|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28904" PostTypeId="2" ParentId="28903" CreationDate="2016-03-21T21:08:57.927" Score="4" Body="&lt;p&gt;It doesn't matter if you are connected to the router via console, telnet, SSH, etc., you configure a specific feature in the mode for that specific feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to configure global commands, you do that in global configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are configuring interfaces, you do that in interface configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are configuring lines, you do that in line configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are configuring a routing protocol, you do that in router configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Etc.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-21T21:08:57.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28905" PostTypeId="2" ParentId="28903" CreationDate="2016-03-21T21:17:22.357" Score="6" Body="&lt;p&gt;Global configuration mode is for configuring global parameters. This is the default mode when you enter configuration mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some commands will cause you to enter a more specific configuration mode. Line configuration mode (similar to interface configuration mode) is entered when you specify a line to configure. Line configuration mode is then where you enter configuration appropriate to that specific line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you are in a specific configuration mode, if you prompt for help (i.e. type &quot;?&quot;) you will only be shown commands that are relevant to that configuration mode rather than commands that are relevant in global configuration mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the output of line configuration mode from one of my test switches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Test(config-line)#?&#xA;Line configuration commands:&#xA;  access-class            Filter connections based on an IP access list&#xA;  accounting              Accounting parameters&#xA;  authorization           Authorization parameters&#xA;  autocommand             Automatically execute an EXEC command&#xA;  autocommand-options     Autocommand options&#xA;  data-character-bits     Size of characters being handled&#xA;  databits                Set number of data bits per character&#xA;  default                 Set a command to its defaults&#xA;  domain-lookup           Enable domain lookups in show commands&#xA;  editing                 Enable command line editing&#xA;  escape-character        Change the current line's escape character&#xA;  exec                    Configure EXEC&#xA;  exec-banner             Enable the display of the EXEC banner&#xA;  exec-character-bits     Size of characters to the command exec&#xA;  exec-timeout            Set the EXEC timeout&#xA;  exit                    Exit from line configuration mode&#xA;  flowcontrol             Set the flow control&#xA;  full-help               Provide help to unprivileged user&#xA;  help                    Description of the interactive help system&#xA;  history                 Enable and control the command history function&#xA;  international           Enable international 8-bit character support&#xA;  ip                      IP options&#xA;  length                  Set number of lines on a screen&#xA;  location                Enter terminal location description&#xA;  logging                 Modify message logging facilities&#xA;  login                   Enable password checking&#xA;  modem                   Configure the Modem Control Lines&#xA;  monitor                 Copy debug output to the current terminal line&#xA;  motd-banner             Enable the display of the MOTD banner&#xA;  no                      Negate a command or set its defaults&#xA;  notify                  Inform users of output from concurrent sessions&#xA;  padding                 Set padding for a specified output character&#xA;  parity                  Set terminal parity&#xA;  password                Set a password&#xA;  privilege               Change privilege level for line&#xA;  refuse-message          Define a refuse banner&#xA;  rotary                  Add line to a rotary group&#xA;  rxspeed                 Set the receive speed&#xA;  session-timeout         Set interval for closing connection when there is no input traffic&#xA;  special-character-bits  Size of the escape (and other special) characters&#xA;  speed                   Set the transmit and receive speeds&#xA;  start-character         Define the start character&#xA;  stop-character          Define the stop character&#xA;  stopbits                Set async line stop bits&#xA;  terminal-type           Set the terminal type&#xA;  timeout                 Timeouts for the line&#xA;  transport               Define transport protocols for line&#xA;  txspeed                 Set the transmit speeds&#xA;  vacant-message          Define a vacant banner&#xA;  width                   Set width of the display terminal&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice that while some of the commands are the same (or similar), many of the global configuration mode commands you might expect are not present, such as &lt;code&gt;aaa&lt;/code&gt;, &lt;code&gt;boot&lt;/code&gt; or &lt;code&gt;cdp&lt;/code&gt;. This last would be present in interface configuration mode, but there is no CDP on the console so it is not present.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-03-21T21:17:22.357" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28906" PostTypeId="2" ParentId="22247" CreationDate="2016-03-21T22:00:53.787" Score="1" Body="&lt;p&gt;There is no way to prevent this, but this not what you should worry about.&#xA;What you need to worry about are the guys scanning your networks, patiently building knowledge on cracks in your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to do is to prevent exploitation, use a very strict access control, bring in pen tester, find things that are misconfigured, understand perfectly your network, and train people (not to click on well crafted emails, not to go on weird web sites, be cautious about removable devices, etc.).&lt;/p&gt;&#xA;" OwnerUserId="23911" LastEditorUserId="8499" LastEditDate="2016-03-21T22:39:23.757" LastActivityDate="2016-03-21T22:39:23.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28907" PostTypeId="1" CreationDate="2016-03-21T22:21:39.567" Score="5" ViewCount="183" Body="&lt;p&gt;My company has begun leasing new office space, and our modem was installed in a room without ethernet, a little ways from the router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a bundle of unused telephone lines (RJ-11) which run from the modem room to the router room. I propose to splice an ethernet connector onto the ends of these phone lines, and use them to connect the modem and router. To provide enough pins, I may even need to combine two separate cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would this be detrimental to performance? I would not expect gigabit or higher speeds from such a line, however the modem is only a 45 Mbps DSL modem. It doesn't need the maximum speed. If this hack performed at 50% of the speed of a regular cable, it would be sufficient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that correct? Or am I missing something? Thanks! :)&lt;/p&gt;&#xA;" OwnerUserId="23912" LastEditorUserId="8499" LastEditDate="2019-01-03T01:39:52.077" LastActivityDate="2019-01-03T01:39:52.077" Title="Will using phone lines (RJ-11) in place of ethernet (RJ-45), in this case, be detrimental to performance?" Tags="|ethernet|layer1|cable|cabling|utp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28908" PostTypeId="2" ParentId="28907" CreationDate="2016-03-21T22:28:17.260" Score="2" Body="&lt;p&gt;Category-3 cable, is used for 10BASE-T ethernet (10 Mbps), but it can't branch or have a bunch of connections, and you aren't allowed to splice. If you need anything faster, you need to use Category-5E, installed to specification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would be better off using the Category-3 cable to extend from the DMARC to where you can place the modem close to the router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-21T22:28:17.260" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28909" PostTypeId="2" ParentId="27851" CreationDate="2016-03-21T23:20:35.140" Score="2" Body="&lt;p&gt;The bridge-group in ScreenOS is identical to a VLAN in Junos.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In ScreenOS you can either assign a security-zone/IP Addresses to a physical port, or alternatively, assign them to a bridge-group that contains multiple ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Junos, you would assign security-zones/IP Addresses to a &lt;code&gt;vlan.x&lt;/code&gt; interface which is bound to a VLAN via the &lt;code&gt;l3-interface&lt;/code&gt; command, and then multiple ports can be members of that VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for having a single-port bridge-group would be to allow simpler changes in the future - in ScreenOS, if you had a single L3 port in a zone, and wanted to change it to two, it would involve:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;creating a bridge-group and assigning it to the zone&lt;/li&gt;&#xA;&lt;li&gt;removing the security zone from the existing L3 interface (and IP)&lt;/li&gt;&#xA;&lt;li&gt;putting both interfaces into the bridge-group&lt;/li&gt;&#xA;&lt;li&gt;adding the IP to the bridge-group&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This would be a disruptive change, whereas in Junos it could be handled in a single commit.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-03-21T23:20:35.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28910" PostTypeId="2" ParentId="28882" CreationDate="2016-03-21T23:36:07.420" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the purpose of the global BPDU filter? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Portfast is a feature that should only be implemented on ports that do not receive BPDUs (or need to send them). In other words, it should only be implemented on edge ports. So if you receive BPDUs on such a port, how do you want to handle it? &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Do nothing&lt;/strong&gt; - Simply ignore the BPDUs and continue operating as configured.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Err on the side of caution&lt;/strong&gt; - Disable the port.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Something in between&lt;/strong&gt; - Switch out of portfast mode and allow STP to run over the link normally.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Two features give you the ability to respond in any of the three above ways, BPDU filter and BPDU guard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to do nothing, simply apply BPDU filter at the interface level. The only time I have ever seen this used wisely is when you are handing off to a customer (and have taken other precautions to avoid issues).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since end users generally should not be allowed to connect their own switches to the network, most places today seem to go with option two, utilizing BPDU guard coupled with err-disable recovery. This will shut down the port automatically if a device sending BPDUs (or one that will loop BPDUs back to the interface) is connected to the network. Interfaces will automatically be re-enabled after a set time and will stay re-enabled if the condition were removed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Global configuration of BPDU filter is the middle of the road and allows you to apply the command automatically to any port where you have enabled portfast. If BPDUs are detected it will drop the portfast mode. This would allow you to plug in another switch device without losing access or risking a L2 loop. I can't think of many reasons today to use this, although in the past when BPDU guard didn't have an err-disable recovery option (i.e. re-enabling ports was a manual process) it could be a better choice than BPDU guard, protecting the network while not increasing load on IT staff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, the interface versions of BPDU filter/guard both supersede the global configuration. In other words, you can use the interface command to disable a globally enabled feature on a portfast enabled interface. Additionally, while the global version only apply to interfaces with portfast enabled, you can enable either on an interface that does not have portfast enabled. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why doesn't it work the same way as BPDU filter configured on a port?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because it wasn't designed that way. It was designed to provide additional configuration options to tailor the operation to the needs of your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, you could have a situation where you wanted a portfast enabled port but did not want to send or receive BPDUs. If both global and interface commands worked the same, you would have issues trying to configure it this way if both acted the same as the global configuration. Conversely, if you wanted the &quot;middle of the road&quot; above but both acted like the interface command, you would have issues.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2016-03-22T03:52:07.280" LastActivityDate="2016-03-22T03:52:07.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28911" PostTypeId="1" AcceptedAnswerId="32479" CreationDate="2016-03-21T23:44:46.567" Score="3" ViewCount="595" Body="&lt;p&gt;Trying to learn and play around with VPNs, similar setup worked fine in my home lab, PAT seems to be causing problems and I know it's config related, just not sure where. Connection is over an ISP that dynamically assigns IPs and this setup should allow a dynamic connection regardless if the public IPs change, that's the goal anyways. Please take a look and let me know what you think. I am an amateur at configuring IPsec over GRE and probably made a simple mistake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FQDN DMVPN hub config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel2&#xA; ip address 172.16.64.1 255.255.255.0&#xA; no ip redirects&#xA; ip mtu 1440&#xA; no ip next-hop-self eigrp 1&#xA; no ip split-horizon eigrp 1&#xA; ip nhrp authentication string&#xA; ip nhrp map multicast dynamic&#xA; ip nhrp network-id 1&#xA; tunnel source GigabitEthernet0/0&#xA; tunnel mode gre multipoint&#xA; tunnel key 1&#xA; tunnel protection ipsec profile myprofile&#xA;&#xA;crypto ipsec profile myprofile&#xA; set transform-set set &#xA;&#xA;crypto ipsec transform-set set esp-aes &#xA; mode tunnel&#xA;&#xA;crypto isakmp key key address 0.0.0.0 &#xA;&#xA;crypto isakmp policy 1&#xA; encr aes 256&#xA; hash md5&#xA; authentication pre-share&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Spoke config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel2&#xA; ip address 172.16.64.2 255.255.255.0&#xA; no ip redirects&#xA; ip mtu 1440&#xA; ip nhrp authentication string&#xA; ip nhrp map multicast dynamic&#xA; ip nhrp network-id 1&#xA; ip nhrp nhs dynamic nbma fqdn.net&#xA; tunnel source FastEthernet0/0&#xA; tunnel mode gre multipoint&#xA; tunnel key 1&#xA; tunnel protection ipsec profile myprofile&#xA;&#xA;crypto isakmp policy 1&#xA; encr aes 256&#xA; hash md5&#xA; authentication pre-share&#xA;crypto isakmp key key address 0.0.0.0 0.0.0.0&#xA;crypto ipsec transform-set set esp-aes &#xA;crypto ipsec profile myprofile&#xA; set security-association lifetime kilobytes 102400&#xA; set transform-set set&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following is the debug output I receive, I know it's related to the proxy IPs, not sure how to resolve this. Google hasn't been much help:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Mar 21 23:03:36.665: IPSEC(validate_proposal_request): proposal part #1&#xA;*Mar 21 23:03:36.665: IPSEC(validate_proposal_request): proposal part #1,&#xA;  (key eng. msg.) INBOUND local= 172.16.48.2:0, remote= 98.x.x.x:0,&#xA;    local_proxy= 174.x.x.x/255.255.255.255/47/0,&#xA;    remote_proxy= 192.168.1.43/255.255.255.255/47/0,&#xA;    protocol= ESP, transform= esp-aes  (Tunnel-UDP), &#xA;    lifedur= 0s and 0kb, &#xA;    spi= 0x0(0), conn_id= 0, keysize= 128, flags= 0x0&#xA; *Mar 21 23:03:36.665: map_db_find_best did not find matching map&#xA;*Mar 21 23:03:36.665: IPSEC(ipsec_process_proposal): proxy identities not supported&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23913" LastEditorUserId="23913" LastEditDate="2016-06-23T23:10:55.807" LastActivityDate="2016-06-23T23:10:55.807" Title="FQDN DMVPN ISAKMP established IPsec fails negotiation" Tags="|vpn|ipsec|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28912" PostTypeId="2" ParentId="19396" CreationDate="2016-03-21T23:45:17.693" Score="1" Body="&lt;p&gt;BPDUs are only tagged in Cisco's PVST/PVST+ and other vendor-specific variants.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All BPDUs in IEEE standards-based STP variants eg: 802.1d, 802.1w, 802.1s (STP, RSTP, MSTP) are sent without any 802.1Q header. &lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-03-21T23:45:17.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28916" PostTypeId="1" CreationDate="2016-03-22T10:57:52.560" Score="3" ViewCount="2571" Body="&lt;p&gt;I'm no expert in this field, so I thought I would come on here and get some opinions.  I have issues accessing certain websites, one example is codility.com.  As I understand it (and correct me if I am wrong) 1500 is a pretty standard MTU setting?  However, on the sites I have issues accessing this gives me massive packet loss i.e.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping -s 1464 -c1 codility.com&#xA;PING codility.com (52.71.87.144) 1464(1492) bytes of data.&#xA;&#xA;--- codility.com ping statistics ---&#xA;1 packets transmitted, 0 received, 100% packet loss, time 0ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the same thing on say Google, works every time:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping -s 1464 -c1 google.com&#xA;PING google.com (216.58.213.174) 1464(1492) bytes of data.&#xA;72 bytes from lhr26s02-in-f174.1e100.net (216.58.213.174): icmp_seq=1 ttl=54 (truncated)&#xA;&#xA;--- google.com ping statistics ---&#xA;1 packets transmitted, 1 received, 0% packet loss, time 0ms&#xA;rtt min/avg/max/mdev = 25.234/25.234/25.234/0.000 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have to bring MTU down to around 1200 in order to not drop packets on Codility:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping -s 1172 -c1 codility.com&#xA;PING codility.com (52.71.87.144) 1172(1200) bytes of data.&#xA;1180 bytes from ec2-52-71-87-144.compute-1.amazonaws.com (52.71.87.144): icmp_seq=1 ttl=43 time=119 ms&#xA;&#xA;--- codility.com ping statistics ---&#xA;1 packets transmitted, 1 received, 0% packet loss, time 0ms&#xA;rtt min/avg/max/mdev = 119.048/119.048/119.048/0.000 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In fact, the exact highest value seems to be 1204:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping -s 1176 -c1 codility.com&#xA;PING codility.com (52.71.87.144) 1176(1204) bytes of data.&#xA;1184 bytes from ec2-52-71-87-144.compute-1.amazonaws.com (52.71.87.144): icmp_seq=1 ttl=43 time=123 ms&#xA;&#xA;--- codility.com ping statistics ---&#xA;1 packets transmitted, 1 received, 0% packet loss, time 0ms&#xA;rtt min/avg/max/mdev = 123.843/123.843/123.843/0.000 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From 1205 or higher, I get complete packet loss:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping -s 1177 -c1 codility.com&#xA;PING codility.com (52.71.87.144) 1177(1205) bytes of data.&#xA;&#xA;--- codility.com ping statistics ---&#xA;1 packets transmitted, 0 received, 100% packet loss, time 0ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone give me a bit of general advice and information here?  Is this normal?  Should I set my MTU permanently to 1200?  What affect will this have?  From what I have looked at the router I use I believe has an MTU of 1500 so am I looking at ISP issue here?&lt;/p&gt;&#xA;" OwnerUserId="23922" LastEditorUserId="8499" LastEditDate="2016-03-22T14:18:02.050" LastActivityDate="2016-03-22T14:18:02.050" Title="MTU affects access to some sites" Tags="|mtu|" AnswerCount="2" CommentCount="5" ClosedDate="2016-03-22T19:22:26.790" ContentLicense="CC BY-SA 3.0" />
  <row Id="28917" PostTypeId="2" ParentId="28916" CreationDate="2016-03-22T12:49:41.137" Score="1" Body="&lt;p&gt;Definitely do not set your MTU to 1200 - this will cause you performance issues elsewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you provide more information on your topology?  Is it just your PC and a router, or is this a corporate environment where there is a bigger network between you and the Internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you are testing for supported MTU you'll need to use one of the following commands to ensure that the Do-Not-Fragment bit is set in the ICMP request:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Linux: &lt;code&gt;ping -s 1480 -M do codility.com&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Mac OS X: &lt;code&gt;ping -s 1480 -D codility.com&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Windows: &lt;code&gt;ping -l 1480 -f codility.com&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;otherwise ping will happily report that it received back a packet of any size (even though it may have been fragmented into smaller frames in order to be received).  eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; bdale@lojack:~$ ping -s 5000 codility.com&#xA; PING codility.com (52.71.87.144) 5000(5028) bytes of data.&#xA; 5008 bytes from ec2-52-71-87-144.compute-1.amazonaws.com (52.71.87.144): icmp_req=1 ttl=38 time=242 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(no, I don't have interfaces capable of 5000 byte frames all the way between myself and AWS!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try to isolate the issue a bit further - is it a problem between you and AWS (where codility is hosted)? - Try the same ping test on 52.71.87.150 (live host in the same AWS subnet) and see if you get the same results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Run a traceroute between yourself and both these addresses and then to another site hosted on AWS (prlog.com) - does your traffic follow the same path?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does your network connect directly to AWS already via a VPN?  You may be routing all AWS addresses over this tunnel which would give a reduced MTU (but more like 1350 bytes as opposed to 1200).  If this is the case, you will need to adjust tcp-mss settings on your router so that TCP traffic passing over this tunnel is clamped down below 1200 bytes.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-03-22T12:49:41.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28918" PostTypeId="2" ParentId="28916" CreationDate="2016-03-22T12:53:15.663" Score="4" Body="&lt;p&gt;First of all: the 1500 packet size is for the whole packet. With several layers of protocol headers and other overhead there is less than 1500 bytes for the payload. The &quot;-s&quot; option of ping sets the size of the payload, not of the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the other half:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Somewhere between your host and your target there seems to be a line with a smaller MTU. The router at that line has two options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;splitting the packet into smaller fragments that will fit into that MTU (which most routers won't do because it's more work for them)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;drop the packet and send back a message to the source ip saying &quot;packet dropped, send smaller packages. I can fit up to 1200 bytes through the line&quot;. The sender can then send smaller packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The latter will be an ICMP packet. Malconfigured firewalls might drop the ICMP-packet (because some people think that ICMP is &quot;only used by hackers&quot;) so the sender never knows what happened to the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This process is called PMTU Discovery and it needs ICMP to function.&lt;/p&gt;&#xA;" OwnerUserId="19765" LastEditorUserId="19765" LastEditDate="2016-03-22T13:03:26.207" LastActivityDate="2016-03-22T13:03:26.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28919" PostTypeId="1" AcceptedAnswerId="28921" CreationDate="2016-03-22T13:32:51.880" Score="2" ViewCount="97" Body="&lt;p&gt;I have following configuration for my home lab -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/exInI.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/exInI.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured 4 VLAN interfaces - 10.10.10.10(R1-Vlan 100), 20.20.20.20(R2-Vlan 200), 30.30.30.30(R3-Vlan 300) and 40.40.40.40(R4-Vlan 400). There is one Routing Interface(192.168.1.10) on switch which is connected to my WiFi DSL Modem so that I can access everything over WiFi also. From the Switch I am able to telnet to all the routers, but my problem is regarding configuration for accessing Server(4 Virtual Machines). I want to access server over remote desktop connection and also want to use server for SPAN, and I want to provide internet access to the server. How should I configure VLAN on my switch and how will be the routing done?&#xA;Switch - 3550&#xA;Routers - 2811.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&#xA;Manish&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-03-22T15:15:30.957" Title="Voice Home Lab Cisco Devices" Tags="|voice|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28921" PostTypeId="2" ParentId="28919" CreationDate="2016-03-22T14:23:03.477" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Activate ip routing on the 3550 switch (in configuration mode enter the &quot;ip routing&quot; command) .&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On R1-R4 set the switch as the default gateway (gateway of last resort ip route 0.0.0.0 0.0.0.0 [ip address of switch interface]). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set the switch as default gateway on the VMs &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On the switch set the DSL Modem as gateway of last resort commad: ip route 0.0.0.0 0.0.0.0 [ip address of the dsl modem]&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So in conclusion the switch need an ip in the vlan and the routers.&#xA;If the routers will access other Subnets they go to the switch and the switch will route the packet to the other subnet (in its routing table interfaces will appear as connected).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand it right you want the VMs in different VLANs and have only one physical intherface attached to the server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--&gt; go to the switch configure the attached port as trunk &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope it will work (= &lt;/p&gt;&#xA;" OwnerUserId="21212" LastEditorUserId="21212" LastEditDate="2016-03-22T15:15:30.957" LastActivityDate="2016-03-22T15:15:30.957" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="28924" PostTypeId="1" AcceptedAnswerId="28926" CreationDate="2016-03-22T16:56:11.230" Score="2" ViewCount="1338" Body="&lt;p&gt;According to this &lt;a href=&quot;http://portforward.com/help/alt-to-pf.htm&quot; rel=&quot;nofollow&quot;&gt;article&lt;/a&gt;, if you cannot forward ports on your router (no access to router admin panel for example), you can sign up for a VPN service and setup a port forward on the VPN to get around the router admin panel limitation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is that possible though? Wouldn't you need to port forward on both the VPN and the router since there's now two layers of NAT? One layer of NAT from the router and the second layer of NAT from the VPN.&lt;/p&gt;&#xA;" OwnerUserId="23928" LastActivityDate="2016-03-22T17:31:25.117" Title="How can VPN port forwarding be an alternative to port forwarding on the router?" Tags="|routing|vpn|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28925" PostTypeId="1" AcceptedAnswerId="28930" CreationDate="2016-03-22T17:02:03.240" Score="2" ViewCount="91" Body="&lt;p&gt;My company have signed up for BT Business Broadband. We have IP Phones supplied by an external company. We have been led to believe that BT Business Broadband blocks IP Phones other than their own. Is this true?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, we have foolishly bought a switch for 28 computers/phones, but didn't think of PoE (Particularly handy for cable management). To be honest Web Development is more our bag and we know base network stuff. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways, The 28-port switch, We are thinking of noting down each port the IP phone is plugged into, and then route that to a switch with PoE capabilities. Would this then power the phones, or would the original switch need to do that?&lt;/p&gt;&#xA;" OwnerUserId="23929" LastEditorUserId="8499" LastEditDate="2016-03-22T17:28:15.667" LastActivityDate="2016-03-22T17:28:15.667" Title="PoE Query - IP Phones" Tags="|power-over-ethernet|telephony|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28926" PostTypeId="2" ParentId="28924" CreationDate="2016-03-22T17:04:35.857" Score="0" Body="&lt;p&gt;A tunnel just encapsulates your packets inside an outer packet. You don't NAT within the tunnel. If the tunnel endpoint is on the inside the NAT, you NAT the outer packets of the tunnel, and forward the tunnel port if the tunnel is originated from outside. If the tunnel endpoint is in the router, this isn't necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tunnel creates a network link, just as if you ran a cable between the endpoints.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-22T17:31:25.117" LastActivityDate="2016-03-22T17:31:25.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28927" PostTypeId="1" CreationDate="2016-03-22T12:39:14.240" Score="7" ViewCount="52736" Body="&lt;p&gt;I have a small LAN network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each table has a switch, and the laptops are connected to that switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a host which is using a large amount of the Internet bandwidth, and I would like to find out which one. I have that user's IP address (the guy who is using large amount of bandwidth), but there are many computers, so I cannot see to whom that IP address belongs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way I can find the list of IP addresses connected to a switch (may be Unix command), so that I can visit each desk, run a command, and check all the active IP addresses (computers) connected to that switch, and based on that I can find out to which switch that specific IP address is connected?&lt;/p&gt;&#xA;" OwnerUserId="24268" OwnerDisplayName="Dipesh Ramesh" LastEditorUserId="40371" LastEditDate="2018-11-05T01:25:26.807" LastActivityDate="2018-11-06T17:53:30.817" Title="Check all the active IP addresses on a switch" Tags="|switch|ip|ip-address|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="28928" PostTypeId="2" ParentId="28927" CreationDate="2016-03-22T13:03:46.803" Score="1" Body="&lt;p&gt;Unix command for listing ip addresses on a network segment&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arp -a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NMAP command to list (most of) computer  in an IP range&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nmap -sP 192.168.1.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switches cannot be seen on network, since it is a transparent device. &lt;/p&gt;&#xA;" OwnerUserId="23955" OwnerDisplayName="MUY Belgium" LastActivityDate="2016-03-22T13:03:46.803" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28930" PostTypeId="2" ParentId="28925" CreationDate="2016-03-22T17:12:38.040" Score="3" Body="&lt;p&gt;Your question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We have been led to believe that BT Business Broadband blocks IP&#xA;  Phones other than their own. Is this true?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;is off topic here. You will need to ask BT, but it doesn't matter if you are not going to send VoIP traffic over the BT network (outside of your network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your phones need PoE, they must be directly connected to a PoE switch, or you can use an inline power injector between the switch and the phone. Also, most PoE phones can use an external power adapter.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-22T17:12:38.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28931" PostTypeId="2" ParentId="28925" CreationDate="2016-03-22T17:15:04.897" Score="2" Body="&lt;p&gt;Where do you live? If it's US they aren't allowed to do that legally. All you'll have to do is find a SIP provider and have your Call Manager of whatever flavor register to it. You may run into QoS issues using just standard ISP broadband though with latency and jitter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PoE is industry standard so almost any PoE switch will be able to power it, make sure you know the phone wattage and the power supply capabilities of the switch though because some may have all PoE ports but the power supply limits the amount of active ports to 24.&lt;/p&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2016-03-22T17:15:04.897" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28932" PostTypeId="1" CreationDate="2016-03-22T17:49:33.800" Score="2" ViewCount="457" Body="&lt;p&gt;Our company is comparing and discussing network security models and I would like to know what the &quot;best&quot; model is based on objective measurable data. To aid in this, I am looking for a summary and statistical comparison of networking models such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A &quot;flat network&quot; where servers are on the same network as clients&lt;/li&gt;&#xA;&lt;li&gt;A DMZ model in which all servers exist in a single DMZ &lt;/li&gt;&#xA;&lt;li&gt;A siloed network where there are multiple secured or hardened islands or silos&lt;/li&gt;&#xA;&lt;li&gt;Potentially other configurations or layouts&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Such a study should quantify and compare things like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Percentage of companies with a given model which have experienced a breach&lt;/li&gt;&#xA;&lt;li&gt;Vulnerabilities detected by Vulnerability scanners compared by model&lt;/li&gt;&#xA;&lt;li&gt;Costs of breaches versus cost of maintenance for a given model&lt;/li&gt;&#xA;&lt;li&gt;Measurement and comparison of revenue and business lost to complexities of the models and the impact to customer confidence and customer recommendations&lt;/li&gt;&#xA;&lt;li&gt;Etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My feeling is that the general security wisdom is &quot;use a DMZ,&quot; but I am questioning if real-world data actually backs up the value of this model. My preliminary search was unable to find any such study or analysis. Does any such data exist or have any studies been undertaken to analyze and quantify the security of various network topologies?&lt;/p&gt;&#xA;" OwnerUserId="14254" LastEditorUserId="14254" LastEditDate="2016-03-25T18:37:17.433" LastActivityDate="2016-03-25T23:04:44.530" Title="Comparison of Network Security Models" Tags="|security|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="28934" PostTypeId="1" CreationDate="2016-03-22T17:53:24.183" Score="1" ViewCount="27" Body="&lt;p&gt;As known, RIVER protocol is a geographic, V2V, street-based protocol which relies on anchor points (intersection points). How can it detect these anchor points without resorting to fixed infrastructures (or RSUs)? Is V2V communication behind that?  &lt;/p&gt;&#xA;" OwnerUserId="20609" LastEditorUserId="8499" LastEditDate="2016-03-22T18:40:58.570" LastActivityDate="2016-03-22T18:40:58.570" Title="The relation between street-aware routing in VANETs and V2V communication" Tags="|routing|" AnswerCount="0" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28935" PostTypeId="2" ParentId="28927" CreationDate="2016-03-22T18:06:03.940" Score="5" Body="&lt;p&gt;Switches will know the MAC addresses, but not the IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches are layer-2 devices, and the ethernet headers contain MAC addresses. A switch will create and maintain a MAC address table, which relates each MAC address with the port to which the device with that MAC address is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP is a layer-3 protocol, and IP addresses are in the packet headers, which are encapsulated inside the ethernet frame. A switch doesn't strip off the frame to look at the IP headers (router do that).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to relate the IP address to the MAC address. This is what ARP does. You can ARP with the IP address to discover the MAC address. Then, if your switch models have commands to do this, display the MAC address table of each switch to discover to which port the MAC address is connected. If the switches are all connected together, you may find the MAC address on a port which connects to a different switch, and you would then need to move to the switch on the connection and repeat the process until you find a host port.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-22T18:20:52.470" LastActivityDate="2016-03-22T18:20:52.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28936" PostTypeId="1" AcceptedAnswerId="43936" CreationDate="2016-03-22T21:04:55.867" Score="2" ViewCount="2887" Body="&lt;p&gt;I have a Cisco 2851 with NAT configured as so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list 111 interface GigabitEthernet0/1 overload&#xA;ip nat inside source static 192.168.16.16 64.xxx.xxx.233&#xA;ip nat inside source static 192.168.16.2 64.xxx.xxx.245&#xA;ip nat inside source static 192.168.16.20 64.xxx.xxx.246&#xA;ip route 0.0.0.0 0.0.0.0 64.xxx.xxx.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to forward only outside traffic from &lt;code&gt;64.xxx.xxx.233&lt;/code&gt; to port 81 to the inside host 192.168.16.12, leaving all other ports as above. This command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static tcp 192.168.16.12 81 64.xxx.xxx.233 81&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;results in this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;similar static entry (192.168.16.16 -&amp;gt; 64.xxx.xxx.233) already exists&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can give me some direction how to get this single port directed to another host given the above?&lt;/p&gt;&#xA;" OwnerUserId="23933" LastEditorUserId="8499" LastEditDate="2016-03-22T22:55:41.633" LastActivityDate="2017-09-05T21:02:32.680" Title="Cisco 2851 Static NAT - Similar Static Entry Already Exists" Tags="|cisco|nat|ip-forwarding-table|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28937" PostTypeId="2" ParentId="28936" CreationDate="2016-03-22T21:17:07.553" Score="0" Body="&lt;p&gt;You need to understand the different NAT versions. NAT &lt;strong&gt;inside source&lt;/strong&gt; translates &lt;strong&gt;source&lt;/strong&gt; addresses packets originating on the &lt;strong&gt;inside&lt;/strong&gt;, and it maintains tables for returning traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to translate addresses from outside which are destined to the inside, you need to use &lt;strong&gt;inside destination&lt;/strong&gt; NAT. This version of NAT can also be used to load balance among multiple inside destinations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/technologies/tk648/tk361/tk438/technologies_white_paper09186a0080091cb9.html&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS Network Address Translation Overview&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Enabling translation of inside destination addresses&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside destination { list &amp;lt;acl&amp;gt; pool &amp;lt;name&amp;gt; | static &amp;lt;global-ip&amp;gt; &amp;lt;local-ip&amp;gt; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;This command is similar to the source translation command. For dynamic&#xA;  destination translation to make any sense, the pool should be a&#xA;  rotary-type pool.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the outside address is already in the NAT tables with a different rule, you will not be able to have a different translation for it since a lookup of the address will only return one of the table entries.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-22T21:38:52.090" LastActivityDate="2016-03-22T21:38:52.090" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28938" PostTypeId="1" AcceptedAnswerId="28940" CreationDate="2016-03-23T00:14:13.407" Score="4" ViewCount="15899" Body="&lt;p&gt;I'm using Putty to connect via a serial connection to the console. I have a &lt;code&gt;line con 0&lt;/code&gt; password set, as shown by &lt;code&gt;show running-config&lt;/code&gt;. I close this session (via Putty), reconnect, and the CLI prompt shows the last state I was in (in enable mode), and it does not prompt for a password. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went into configuration -&gt; line console 0 -&gt; login local and it just returns the root with no indication that this command took effect. Either way, when I restart the session, it still does not prompt for password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I get a serial session to prompt for a password at the start of a serial session, and how do I refresh the serial session?&lt;/p&gt;&#xA;" OwnerUserId="19051" LastEditorUserId="8499" LastEditDate="2016-03-23T02:19:40.590" LastActivityDate="2016-03-23T19:51:17.373" Title="Cisco IOS -- How do I make the console prompt for a password upon serial line session 0 connection?" Tags="|cisco|switch|ethernet|cisco-ios|cli|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28939" PostTypeId="2" ParentId="28938" CreationDate="2016-03-23T00:28:14.857" Score="2" Body="&lt;p&gt;It sounds like you are just disconnecting and reconnecting. Disconnecting is not a &quot;hang up&quot; and does not cause the user on console to logoff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the &quot;exit&quot; command to log off and you should be prompted for the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is also why you always want to set the &quot;exec-timeout&quot; on your lines. Otherwise, if someone connects to the console and forgets to log off, someone else may come along after them, connect and get access they shouldn't.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-03-23T00:28:14.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28940" PostTypeId="2" ParentId="28938" CreationDate="2016-03-23T00:29:53.663" Score="2" Body="&lt;p&gt;YLearn is correct in that you are not properly disconnecting the session. If I understand the way you have this configured (password on the line, &lt;code&gt;login local&lt;/code&gt; on the line, and no global username and password configured), when you properly disconnect the session by &lt;code&gt;exit&lt;/code&gt;, you will find yourself locked out of the router. If you use &lt;code&gt;login local&lt;/code&gt; it doesn't look for the password under the line configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-110/45843-configpasswords.html#pw-line&quot; rel=&quot;nofollow&quot;&gt;Telnet, Console and AUX Port Passwords on Cisco Routers Configuration Example&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;Configure Passwords on the Line&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;To specify a password on a line, use the &lt;strong&gt;password&lt;/strong&gt; command in line&#xA;  configuration mode. To enable password checking at login, use the&#xA;  &lt;strong&gt;login&lt;/strong&gt; command in line configuration mode.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; To find additional information on the commands used in this document, use the Command Lookup Tool (registered customers only).&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Configuration Procedure&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;In this example, a password is configured for all users attempting to&#xA;  use the console.&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;&lt;p&gt;From the privileged EXEC (or &quot;enable&quot;) prompt, enter configuration&#xA;  mode and then switch to line configuration mode using the following&#xA;  commands. Notice that the prompt changes to reflect the current&#xA;  mode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#configure terminal&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;router(config)#line con 0&#xA;router(config-line)#&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Configure the password, and enable password checking at login.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-line)#password letmein&#xA;router(config-line)#login&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Exit configuration mode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-line)#end&#xA;router#&#xA;%SYS-5-CONFIG_I: Configured from console by console&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Do not save configuration changes to &lt;strong&gt;line con 0&lt;/strong&gt; until your ability to log in has been verified.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Under the line console configuration, login is a required configuration command to enable password checking at login. Console&#xA;  authentication requires both the &lt;strong&gt;password&lt;/strong&gt; and the &lt;strong&gt;login&lt;/strong&gt;&#xA;  commands to work.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is how to use &lt;code&gt;login local&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;Configure Local User-Specific Passwords&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;To establish a username-based authentication system, use the&#xA;  &lt;strong&gt;username&lt;/strong&gt; command in global configuration mode. To enable password checking at login, use the &lt;strong&gt;login local&lt;/strong&gt; command in line&#xA;  configuration mode.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Configuration Procedure&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;In this example, passwords are configured for users attempting to&#xA;  connect to the router on the VTY lines using Telnet.&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;&lt;p&gt;From the privileged EXEC (or &quot;enable&quot;) prompt, enter configuration&#xA;  mode and enter username/password combinations, one for each user for&#xA;  whom you want to allow access to the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#configure terminal&#xA;  Enter configuration commands, one per line.  End with CNTL/Z.&#xA;  router(config)#username russ password montecito&#xA;  router(config)#username cindy password belgium&#xA;  router(config)#username mike password rottweiler&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Switch to line configuration mode, using the following commands.&#xA;  Notice that the prompt changes to reflect the current mode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#line vty 0 4&#xA;router(config-line)#&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Configure password checking at login.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-line)#login local&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Exit configuration mode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-line)#end&#xA;router#&#xA;%SYS-5-CONFIG_I: Configured from console by console&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; In order to disable auto Telnet when you type a name on the CLI, configure &lt;strong&gt;no logging preferred&lt;/strong&gt; on the line that is used.&#xA;  While &lt;strong&gt;transport preferred none&lt;/strong&gt; provides the same output, it also&#xA;  disables auto Telnet for the defined host that are configured with the&#xA;  &lt;strong&gt;ip host&lt;/strong&gt; command. This is unlike the &lt;strong&gt;no logging preferred&lt;/strong&gt; command, which stops it for undefined hosts and lets it work for the&#xA;  defined ones.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-23T19:51:17.373" LastActivityDate="2016-03-23T19:51:17.373" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28941" PostTypeId="1" CreationDate="2016-03-23T02:32:47.047" Score="1" ViewCount="1629" Body="&lt;p&gt;how can I find the public IP address of a private IP address if i don't have access to the device?&lt;/p&gt;&#xA;" OwnerUserId="23942" LastActivityDate="2016-03-23T03:00:45.890" Title="Converting private ip to public ip" Tags="|ipv4|ip|" AnswerCount="1" CommentCount="3" ClosedDate="2016-03-23T07:47:29.297" ContentLicense="CC BY-SA 3.0" />
  <row Id="28942" PostTypeId="2" ParentId="24173" CreationDate="2016-03-23T02:59:04.740" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://tcpreplay.synfin.net/wiki/usage&quot; rel=&quot;nofollow&quot;&gt;TCPReplay&lt;/a&gt; can be used to replay UDP traffic from a filtered and exported packet capure. Note that it will not work with multiple TCP streams due to issues with the sequence numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also be able to get this to work with &lt;a href=&quot;http://www.thegeekstuff.com/2012/04/nc-command-examples/&quot; rel=&quot;nofollow&quot;&gt;netcat&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, there is not yet a way to do multiple TCP streams, but fortunately that is not an issue for you.&lt;/p&gt;&#xA;" OwnerUserId="14254" LastActivityDate="2016-03-23T02:59:04.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28943" PostTypeId="2" ParentId="28941" CreationDate="2016-03-23T03:00:01.510" Score="1" Body="&lt;p&gt;I used a friend's suggestion and checked at my Facebook (or as he said Google too) security options and by hovering on the location, IP was shown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/P6jfc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/P6jfc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/k13IY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k13IY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23942" LastActivityDate="2016-03-23T03:00:01.510" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28945" PostTypeId="2" ParentId="28927" CreationDate="2016-03-23T03:20:30.580" Score="2" Body="&lt;p&gt;Can you manage your switches?? Let me explain, can you log in into your switches and write commands on it?. If you can do that, you can, eg, ping from your PC to the IP address that is eating your bandwidth, then, like someone said before, check:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arp -a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;that must shown tuples on the form of IP --- MAC: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;x.x.x.x ----- xxxx.xxxx.xxxx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The on switches, you can check by commands by what port switches learn that MAC, and get into the wire until you get what you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember: This is only possible if you have switches with managment capabilities.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-03-23T03:20:30.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28946" PostTypeId="2" ParentId="28872" CreationDate="2016-03-23T07:37:32.887" Score="1" Body="&lt;p&gt;Actually TCP run atop of IP (ie. you can't run TCP exclusively without IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short: multiple protocols are involved during a file transfer, and the assumption that TCP/IP is always better (than UDP/IP for instance) for large file transmission can be technically not exact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is because, as said above, we have many protocols involved (have a look at &lt;a href=&quot;http://docs.oracle.com/cd/E23823_01/html/816-4554/ipov-6.html#ipov-7&quot; rel=&quot;nofollow&quot;&gt;http://docs.oracle.com/cd/E23823_01/html/816-4554/ipov-6.html#ipov-7&lt;/a&gt;), and each one of them can implement features in an exclusive, complimentary or even duplicate way with respect to each others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Practical example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;FTP: run atop of TCP/IP, it's reliable in case of unreliable networks (when there is rumor, when devices or links over the Internet fail, etc.)&lt;/li&gt;&#xA;&lt;li&gt;TFTP: run atop of UDP/IP, it's easier by design, it's totally unable to manage unreliable networks (and situation in which packets are not delivered in the proper order) but it has less overhead&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you're transferring files in your local - reliable and deterministic - LAN you will probably require less time with TFTP than FTP, but if something goes wrong the result will be a corrupted file or a connection abort (requiring you to restart everything and lose more time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if questionable from a real point prospective, no one will stop you from using UDP and than write an application protocol that implements the features of TCP, like retransmission, windowing, congestion avoidance, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nowadays, btw, I would say that the most promising protocol is WEBDAV (HTTP), that runs on TCP/IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But going back to your question my answer would be: TCP can be considered a better choice for developing an application protocol for large file transfers, because it has some built-in features that we can use out of the box, like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Congestion avoidance: if a link become congested the 2 peers can dynamically lower the speed&lt;/li&gt;&#xA;&lt;li&gt;Sequencing: if packets containing the payload of a file cross different paths and arrive at destination in a different order, TCP can rebuild the payload properly&lt;/li&gt;&#xA;&lt;li&gt;Error management: actually managed complimentary with other protocols, if part of the transmission is lost or corrupted, a retransmission of those data is automatically performed&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17572" LastActivityDate="2016-03-23T07:37:32.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28947" PostTypeId="1" AcceptedAnswerId="43250" CreationDate="2016-03-23T07:49:46.333" Score="4" ViewCount="3216" Body="&lt;p&gt;&lt;strong&gt;Situation:&lt;/strong&gt;&#xA;Our Stacked Switch (two WS-C2960X-48LPS-L - 15.2(2)E3 - 192.168.10.19 - VLAN 10) wont be reachable via ICMP or SNMP by the Cisco Prime Infrastructure (172.16.2.103 - VLAN1[nativ]) and back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found out following &lt;strong&gt;facts:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; show arp on 192.168.10.19:&#xA; Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA; Internet  172.16.2.103            5   0050.5698.af6a  ARPA   Vlan1&#xA; Internet  192.168.10.254        151   0000.0c9f.f00a  ARPA   Vlan10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For general there wont be any arp entry for the 172.16.2.103 because the traffic will first go to the default gateway...&lt;/li&gt;&#xA;&lt;li&gt;It is just for this address (as far as I know) all other devices could ping the switch &lt;/li&gt;&#xA;&lt;li&gt;If I delete the arp entry it will work for a few minutes after that the switch generates the entry seen a few lines above&lt;/li&gt;&#xA;&lt;li&gt;there arent any ACLs as the standard - permit line &lt;/li&gt;&#xA;&lt;li&gt;I already searched for a bug report at the cisco website but havn't found anything about this.&lt;/li&gt;&#xA;&lt;li&gt;we had another IOS version bevor this one and it havn't worked eather&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As a workaround I could make a static arp entry with the MAC address of the default gateway or the Prime and it will work stable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you any guesses why this happens or how to solve it, so I havn't to change the entry if the Server or the Default Gateway (redundant ip) changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BgIHJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BgIHJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Running Config of 192.168.10.19:&#xA;version 15.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname SW_19-POE&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 *******&#xA;!&#xA;username **** privilege 15 secret 5 ********&#xA;&#xA;no aaa new-model&#xA;clock timezone cet 1 0&#xA;clock summer-time MEZ recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;switch 1 provision ws-c2960x-48lps-l&#xA;switch 2 provision ws-c2960x-48lps-l&#xA;!&#xA;!&#xA;no ip domain-lookup&#xA;ip domain-name *****.local&#xA;ip device tracking probe delay 10&#xA;!&#xA;udld aggressive&#xA;&#xA;authentication mac-move permit&#xA;!&#xA;mls qos map cos-dscp 0 8 16 26 32 46 48 56&#xA;mls qos queue-set output 1 threshold 2 3200 3200 100 3200&#xA;mls qos queue-set output 1 threshold 3 3200 3200 100 3200&#xA;mls qos&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode rapid-pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;!&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;!&#xA;interface Port-channel1&#xA; description UPLINK TO 192.168.10.18&#xA; switchport mode trunk&#xA; ip device tracking maximum 0&#xA; storm-control broadcast level pps 500&#xA; nmsp attachment suppress&#xA;!&#xA;interface Port-channel2&#xA; switchport mode trunk&#xA; storm-control broadcast level pps 500&#xA;!&#xA;interface Port-channel3&#xA; switchport mode trunk&#xA; storm-control broadcast level pps 500&#xA;!&#xA;interface Port-channel4&#xA; switchport mode trunk&#xA; storm-control broadcast level pps 500&#xA;!&#xA;interface range GigabitEthernet1/0/1-47&#xA; switchport mode access&#xA; switchport voice vlan 56&#xA; switchport port-security maximum 2&#xA; switchport port-security violation  restrict&#xA; switchport port-security&#xA; no logging event link-status&#xA; priority-queue out&#xA; no snmp trap link-status&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; spanning-tree portfast&#xA; spanning-tree bpduguard enable&#xA;!&#xA;&#xA;interface GigabitEthernet1/0/48&#xA; switchport mode access&#xA; switchport voice vlan 56&#xA; priority-queue out&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; spanning-tree portfast&#xA; spanning-tree bpduguard enable&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/49&#xA; description UPLINK 192.168.10.18&#xA; switchport mode trunk&#xA; priority-queue out&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; channel-group 1 mode on&#xA;!&#xA;interface GigabitEthernet1/0/50&#xA; switchport mode trunk&#xA; priority-queue out&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; channel-group 2 mode on&#xA;!&#xA;interface GigabitEthernet1/0/51&#xA; switchport mode trunk&#xA; priority-queue out&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; channel-group 3 mode on&#xA;!&#xA;interface GigabitEthernet1/0/52&#xA; switchport mode trunk&#xA; priority-queue out&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; channel-group 4 mode on&#xA;!&#xA;interface range GigabitEthernet2/0/1-47&#xA; switchport mode access&#xA; switchport voice vlan 56&#xA; switchport port-security maximum 2&#xA; switchport port-security violation  restrict&#xA; switchport port-security&#xA; no logging event link-status&#xA; priority-queue out&#xA; no snmp trap link-status&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; spanning-tree portfast&#xA; spanning-tree bpduguard enable&#xA;!&#xA;interface GigabitEthernet2/0/48&#xA; switchport mode access&#xA; switchport voice vlan 56&#xA; priority-queue out&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; spanning-tree portfast&#xA; spanning-tree bpduguard enable&#xA;!&#xA;interface GigabitEthernet2/0/49&#xA; description UPLINK 192.168.10.18&#xA; switchport mode trunk&#xA; priority-queue out&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; channel-group 1 mode on&#xA;!&#xA;interface GigabitEthernet2/0/50&#xA; switchport mode trunk&#xA; priority-queue out&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; channel-group 2 mode on&#xA;!&#xA;interface GigabitEthernet2/0/51&#xA; switchport mode trunk&#xA; priority-queue out&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; channel-group 3 mode on&#xA;!&#xA;interface GigabitEthernet2/0/52&#xA; switchport mode trunk&#xA; priority-queue out&#xA; mls qos trust dscp&#xA; storm-control broadcast level pps 500&#xA; channel-group 4 mode on&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.10.19 255.255.255.0&#xA; no ip redirects&#xA; no ip route-cache&#xA;!&#xA;ip default-gateway 192.168.10.254&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip access-list standard permit_line&#xA; permit 172.16.2.104&#xA; permit 172.16.2.103&#xA;&#xA;ip access-list standard permit_snmp&#xA; permit 172.16.2.103&#xA; deny   any&#xA;!&#xA;logging host 172.16.2.103&#xA;!&#xA;snmp-server community ****** RW permit_snmp&#xA;snmp-server community ****** RO permit_snmp&#xA;snmp-server community ****** RW permit_snmp&#xA;snmp-server community ****** RO permit_snmp&#xA;snmp-server location ******&#xA;snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart&#xA;snmp-server enable traps port-security&#xA;snmp-server enable traps envmon fan shutdown supply temperature status&#xA;snmp-server host 172.16.2.103 ******&#xA;!&#xA;&#xA;&#xA;Switch Core:&#xA;&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;clock timezone cet 1&#xA;clock summer-time MEZ recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;switch 1 provision ws-c3750g-12s&#xA;switch 2 provision ws-c3750g-12s&#xA;switch 3 provision ws-c3750x-24&#xA;switch 4 provision ws-c3750x-12s&#xA;stack-mac persistent timer 0&#xA;system mtu routing 1500&#xA;udld enable&#xA;&#xA;ip routing&#xA;&#xA;!&#xA;mls qos map cos-dscp 0 8 16 26 32 46 48 56&#xA;mls qos queue-set output 1 threshold 2 3200 3200 100 3200&#xA;mls qos queue-set output 1 threshold 3 3200 3200 100 3200&#xA;mls qos&#xA;!&#xA;!&#xA;license boot level ipservices switch 3&#xA;!&#xA;spanning-tree mode rapid-pvst&#xA;spanning-tree portfast bpduguard default&#xA;spanning-tree extend system-id&#xA;spanning-tree vlan 1-168,170-1000 priority 8192&#xA;spanning-tree vlan 169,1001-1005 priority 0&#xA;!&#xA;vlan internal allocation policy ascending&#xA;&#xA;!&#xA;interface rage  Port-channel1-22&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;storm-control broadcast level pps 500&#xA;!&#xA;!&#xA;interface Port-channel33&#xA;switchport mode access&#xA;!&#xA;&#xA;interface range GigabitEthernet1/0/1-7&#xA;description some other switches&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;priority-queue out &#xA;mls qos trust dscp&#xA;storm-control broadcast level pps 500&#xA;channel-group 1 mode on&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/8&#xA;description Channel_Link_to_SW_18+19-POE&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;priority-queue out &#xA;mls qos trust dscp&#xA;storm-control broadcast level pps 500&#xA;channel-group 8 mode on&#xA;!&#xA;interface range GigabitEthernet1/0/9-12&#xA;description some other switches or routers&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;mls qos trust dscp&#xA;storm-control broadcast level pps 500&#xA;channel-group 9 mode on&#xA;!&#xA;!&#xA;interface range GigabitEthernet2/0/1-7&#xA;description some other switches or routers&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;priority-queue out &#xA;mls qos trust dscp&#xA;storm-control broadcast level pps 500&#xA;channel-group 11 mode active&#xA;!&#xA;!&#xA;interface GigabitEthernet2/0/8&#xA;description Channel_Link_to_SW_18+19-POE&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;priority-queue out &#xA;mls qos trust dscp&#xA;storm-control broadcast level pps 500&#xA;channel-group 8 mode on&#xA;!&#xA;interface range GigabitEthernet2/0/9-12&#xA;description some other switches or routers&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;priority-queue out &#xA;mls qos trust dscp&#xA;storm-control broadcast level pps 500&#xA;channel-group 9 mode on&#xA;!&#xA;!&#xA;interface range GigabitEthernet3/0/1-4&#xA;!&#xA;!&#xA;interface GigabitEthernet3/0/5&#xA;switchport access vlan 43&#xA;switchport mode access&#xA;no logging event link-status&#xA;speed 100&#xA;duplex full&#xA;no snmp trap link-status&#xA;no cdp enable&#xA;spanning-tree portfast&#xA;spanning-tree bpduguard enable&#xA;spanning-tree guard root&#xA;!&#xA;interface GigabitEthernet3/0/6&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode access&#xA;no logging event link-status&#xA;no snmp trap link-status&#xA;spanning-tree portfast&#xA;spanning-tree bpduguard disable&#xA;!&#xA;interface range GigabitEthernet3/0/7-10&#xA;description switches&#xA;switchport access vlan 180&#xA;!&#xA;!&#xA;interface GigabitEthernet3/0/11&#xA;switchport access vlan 180&#xA;!&#xA;interface GigabitEthernet3/0/12&#xA;switchport trunk encapsulation dot1q&#xA;switchport trunk allowed vlan 1&#xA;switchport mode trunk&#xA;storm-control broadcast level pps 500&#xA;storm-control multicast level pps 500&#xA;spanning-tree portfast trunk&#xA;spanning-tree bpduguard disable&#xA;spanning-tree guard root&#xA;!&#xA;interface GigabitEthernet3/0/13&#xA;switchport access vlan 15&#xA;!&#xA;interface GigabitEthernet3/0/14&#xA;switchport access vlan 15&#xA;!&#xA;interface GigabitEthernet3/0/15&#xA;!&#xA;interface GigabitEthernet3/0/16&#xA;!&#xA;interface GigabitEthernet3/0/17&#xA;description HP-BLADE04-18&#xA;switchport access vlan 180&#xA;!&#xA;interface GigabitEthernet3/0/18&#xA;switchport access vlan 66&#xA;!&#xA;interface range GigabitEthernet3/0/19-22&#xA;switchport access vlan 56&#xA;!&#xA;!&#xA;interface GigabitEthernet3/0/23&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;no logging event link-status&#xA;no snmp trap link-status&#xA;!&#xA;interface GigabitEthernet3/0/24&#xA;switchport access vlan 541&#xA;switchport mode access&#xA;spanning-tree portfast&#xA;!&#xA;iterface GigabitEthernet3/1/4&#xA;!&#xA;interface range TenGigabitEthernet3/1/1-2&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;priority-queue out &#xA;mls qos trust dscp&#xA;storm-control broadcast level pps 500&#xA;channel-group 31 mode active&#xA;!&#xA;&#xA;!&#xA;interface range GigabitEthernet4/0/1-12&#xA;description Channel_Link_to_SW_1&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;priority-queue out &#xA;mls qos trust dscp&#xA;storm-control broadcast level pps 500&#xA;channel-group 1 mode on&#xA;!&#xA;!&#xA;interface range TenGigabitEthernet4/1/1-2&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;priority-queue out &#xA;mls qos trust dscp&#xA;storm-control broadcast level pps 500&#xA;channel-group 31 mode active&#xA;!&#xA;!&#xA;interface Vlan1&#xA;ip address 172.16.3.68 255.255.0.0&#xA;!&#xA;interface Vlan2&#xA;no ip address&#xA;!&#xA;interface Vlan10&#xA;ip address 192.168.10.252 255.255.255.0&#xA;no ip proxy-arp&#xA;!&#xA;interface Vlan180&#xA;ip address 192.168.180.2 255.255.255.0&#xA;standby 180 ip 192.168.180.1&#xA;standby 180 timers 2 6&#xA;standby 180 priority 150&#xA;standby 180 preempt&#xA;!&#xA;interface Vlan181&#xA;ip address 192.168.181.2 255.255.255.0&#xA;!&#xA;interface Vlan254&#xA;ip address 158.158.254.3 255.255.255.240&#xA;!&#xA;interface Vlan700&#xA;no ip address&#xA;!&#xA;!&#xA;router eigrp 100&#xA;network 158.158.254.3 0.0.0.0&#xA;network 172.16.3.68 0.0.0.0&#xA;network 192.168.180.2 0.0.0.0&#xA;network 192.168.181.2 0.0.0.0&#xA;passive-interface Vlan180&#xA;passive-interface Vlan181&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 172.16.2.101&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip access-list standard permit_line&#xA;permit 172.16.2.104&#xA;permit 172.16.2.103&#xA;&#xA;ip access-list standard permit_snmp&#xA;permit 172.16.2.103&#xA;!&#xA;ip sla enable reaction-alerts&#xA;logging trap debugging&#xA;logging 172.16.2.103&#xA;!&#xA;snmp-server community ******** RW 1 &#xA;snmp-server community ******** RO permit_snmp &#xA;snmp-server community ******** RW permit_snmp&#xA;snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart&#xA;snmp-server enable traps envmon fan shutdown supply temperature status&#xA;snmp-server host 172.16.2.103 ******** &#xA;!&#xA;!&#xA;line con 0&#xA;logging synchronous&#xA;stopbits 1&#xA;line vty 0 4&#xA;logging synchronous&#xA;line vty 5 15&#xA;access-class permit_line in&#xA;logging synchronous&#xA;!&#xA;ntp clock-period 36029501&#xA;ntp server 130.149.17.21 prefer&#xA;mac address-table aging-time 14400&#xA;end&#xA;&#xA;Switch 18:&#xA;&#xA;&#xA;clock timezone cet 1 0&#xA;clock summer-time MEZ recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;switch 1 provision ws-c2960s-48ts-l&#xA;authentication mac-move permit&#xA;!&#xA;!&#xA;ip domain-name ******.local&#xA;udld aggressive&#xA;!&#xA;spanning-tree mode rapid-pvst&#xA;spanning-tree portfast bpduguard default&#xA;spanning-tree extend system-id&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;interface Port-channel1&#xA;description UPLINK to SW_Core&#xA;switchport mode trunk&#xA;storm-control broadcast level pps 500&#xA;!&#xA;interface Port-channel2&#xA;description UPLINK TO SW_19-POE&#xA;switchport mode trunk&#xA;storm-control broadcast level pps 500&#xA;!&#xA;interface FastEthernet0&#xA;no ip address&#xA;!&#xA;interface range GigabitEthernet1/0/1-48&#xA;switchport mode access&#xA;no logging event link-status&#xA;priority-queue out &#xA;no snmp trap link-status&#xA;mls qos trust dscp&#xA;storm-control broadcast level pps 500&#xA;no cdp enable&#xA;spanning-tree portfast&#xA;spanning-tree bpduguard enable&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/49&#xA;description UPLINK TO SW_Core&#xA;switchport mode trunk&#xA;priority-queue out &#xA;storm-control broadcast level pps 500&#xA;channel-group 1 mode on&#xA;!&#xA;interface GigabitEthernet1/0/50&#xA;description UPLINK TO SW_Core&#xA;switchport mode trunk&#xA;priority-queue out &#xA;storm-control broadcast level pps 500&#xA;channel-group 1 mode on&#xA;!&#xA;interface GigabitEthernet1/0/51&#xA;description UPLINK TO SW_19-POE&#xA;switchport mode trunk&#xA;priority-queue out &#xA;storm-control broadcast level pps 500&#xA;channel-group 2 mode on&#xA;!&#xA;interface GigabitEthernet1/0/52&#xA;description UPLINK TO SW_19-POE&#xA;switchport mode trunk&#xA;priority-queue out &#xA;storm-control broadcast level pps 500&#xA;channel-group 2 mode on&#xA;!&#xA;interface Vlan1&#xA;no ip address&#xA;no ip route-cache&#xA;shutdown&#xA;!&#xA;interface Vlan10&#xA;ip address 192.168.40.18 255.255.255.0&#xA;no ip redirects&#xA;no ip route-cache&#xA;!&#xA;ip default-gateway 192.168.10.254&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip access-list standard permit_line&#xA;permit 172.16.2.104&#xA;permit 172.16.2.103&#xA;!&#xA;ip access-list standard permit_snmp&#xA;permit 172.16.2.103&#xA;deny any&#xA;logging host 172.16.2.103&#xA;!&#xA;snmp-server community ******** RW permit_snmp &#xA;snmp-server community ******** RO permit_snmp &#xA;snmp-server community ******** RW permit_snmp &#xA;snmp-server community ******** RO permit_snmp&#xA;snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart&#xA;snmp-server enable traps envmon fan shutdown supply temperature status&#xA;snmp-server host 172.16.2.103 ******** &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21212" LastEditorUserId="21212" LastEditDate="2016-03-24T16:28:37.003" LastActivityDate="2017-08-14T22:10:26.290" Title="Wrong dynamic ARP entry - IP Address couldn't pinged" Tags="|cisco|switch|mac-address|arp|" AnswerCount="2" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="28948" PostTypeId="2" ParentId="28864" CreationDate="2016-03-23T08:19:15.033" Score="0" Body="&lt;p&gt;Transmission rate is not same as bandwidth.&#xA;Channel Bandwidth – the range of signal bandwidths allowed by a communication channel without significant loss of energy (attenuation).&#xA;Channel Capacity or Maximum Data rate – the maximum rate (in bps) at which data can be transmitted over a given communication link, or channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A typical method of performing a measurement is to transfer a 'large' file from one system to another system and measure the time required to complete the transfer or copy of the file. The throughput is then calculated by dividing the file size by the time to get the throughput in megabits, kilobits, or bits per second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the definition I would say they would be considering propagation delay also.&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-03-23T08:19:15.033" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28949" PostTypeId="2" ParentId="23963" CreationDate="2016-03-23T08:25:58.093" Score="0" Body="&lt;p&gt;Open standards encourage interoperability, competition, and innovation. They also guarantee that no single company’s product can monopolize the market, or have an unfair advantage over its competition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good example of this is when purchasing a wireless router for the home. There are many different choices available from a variety of vendors, all of which incorporate standard protocols such as IPv4, DHCP, 802.3 (Ethernet), and 802.11 (Wireless LAN). These open standards also allow a client running Apple’s OS X operating system to download a web page from a web server running the Linux operating system. This is because both operating systems implement the open standard protocols, such as those in the TCP/IP protocol suite.&lt;/p&gt;&#xA;" OwnerUserId="23949" LastActivityDate="2016-03-23T08:25:58.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28950" PostTypeId="1" CreationDate="2016-03-23T08:45:45.087" Score="2" ViewCount="1638" Body="&lt;p&gt;I have &lt;strong&gt;VLAN 11,12,13&lt;/strong&gt;. i need to use these vlans to L2 switch port( call it as port 3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;11 for printer, 12 for PC(dhcp from server), 30 for cisco phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connected as from port to Cisco IP Phone, then to 8 port switch(non configurable), from 8 port switch to PC and Printer, how can i configure the port 3?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am using cisco 2960 as L2 switch&lt;/p&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="21915" LastEditDate="2016-03-23T11:38:24.923" LastActivityDate="2016-03-23T11:38:24.923" Title="How can i access three vlans on one port?" Tags="|cisco|switch|vlan|switching|trunk|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28951" PostTypeId="1" AcceptedAnswerId="28959" CreationDate="2016-03-23T09:18:32.960" Score="2" ViewCount="2839" Body="&lt;p&gt;I'm looking to set up InterVLAN routing with one layer 3 switch within Packet Tracer (multiswitch), and then have 12 machines connect to these switch. The 12 machines are split between 4 VLAN's as shown below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ukqy5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ukqy5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also configured the switch to split into four DHCP pools with a default router of the respective VLAN. All machines have picked up DHCP, and I've confirmed this by checking the bindings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interfaces for all connections (F0/1-12) have been configured as trunks, and IP routing has also been enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With all that in mind, each machine can communicate with one another in the same VLAN, but not in other VLAN's, so I'm thinking there's something I still need to configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my switch configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 2800 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SW1-L3&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip dhcp excluded-address 192.168.10.1 192.168.10.10&#xA;ip dhcp excluded-address 192.168.20.1 192.168.20.10&#xA;ip dhcp excluded-address 192.168.30.1 192.168.30.10&#xA;ip dhcp excluded-address 192.168.40.1 192.168.40.10&#xA;!&#xA;ip dhcp pool SALES&#xA;network 192.168.10.0 255.255.255.0&#xA;default-router 192.168.10.2&#xA;ip dhcp pool MARKETING&#xA;network 192.168.20.0 255.255.255.0&#xA;default-router 192.168.20.2&#xA;ip dhcp pool IT&#xA;network 192.168.30.0 255.255.255.0&#xA;default-router 192.168.30.2&#xA;ip dhcp pool HR&#xA;network 192.168.40.0 255.255.255.0&#xA;default-router 192.168.40.2&#xA;&#xA;ip routing&#xA;!&#xA;&#xA;interface FastEthernet0/1&#xA;switchport access vlan 10&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/2&#xA;switchport access vlan 10&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/3&#xA;switchport access vlan 10&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/4&#xA;switchport access vlan 20&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/5&#xA;switchport access vlan 20&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/6&#xA;switchport access vlan 20&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/7&#xA;switchport access vlan 30&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/8&#xA;switchport access vlan 30&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/9&#xA;switchport access vlan 30&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/10&#xA;switchport access vlan 40&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/11&#xA;switchport access vlan 40&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/12&#xA;switchport access vlan 40&#xA;switchport mode trunk&#xA;&#xA;interface Vlan1&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Vlan10&#xA;ip address 192.168.10.2 255.255.255.0&#xA;!&#xA;interface Vlan20&#xA;ip address 192.168.20.2 255.255.255.0&#xA;!&#xA;interface Vlan30&#xA;ip address 192.168.30.2 255.255.255.0&#xA;!&#xA;interface Vlan40&#xA;ip address 192.168.40.2 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let me know if I'm missing anything here. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="23950" LastActivityDate="2016-03-23T11:28:21.870" Title="InterVLAN routing with one layer 3 switch" Tags="|vlan|switching|layer3|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28952" PostTypeId="2" ParentId="10530" CreationDate="2016-03-23T10:09:26.280" Score="0" Body="&lt;p&gt;dghfet us call PC1 port as &quot;p1&quot; and PC2 port as &quot;p2&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only Direct route would be present in the Forwarding table. Direct routes get created when an interface is configured with an IP address.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Forwarding Table of PC1:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Route (with Prefix)     Nexthop/Interface &#xA;10.10.10.0/24                 p1 &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Forwarding Table of PC2:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Route (with Prefix)     Nexthop/Interface &#xA;192.168.1.0/24                p2 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you initiate ping from PC1 for IP 192.168.1.1, PC1 would first try to find the nexthop for that IP 192.168.1.1.&#xA;It would do a Forwarding Table lookup against IP 192.168.1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For comparison against entry 10.10.10.0/24, the following steps would take place:&#xA;1 192.168.1.1 AND 255.255.255.0 = 192.168.1.0 (say X)&#xA;2 X (192.168.1.0) does not match 10.10.10.0; So Forwarding Table lookup would fail. &lt;/p&gt;&#xA;" OwnerUserId="23951" LastActivityDate="2016-03-23T10:09:26.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28953" PostTypeId="2" ParentId="28950" CreationDate="2016-03-23T10:14:01.187" Score="0" Body="&lt;p&gt;I don't think this will be possible. PC Port on Phone is an access port and you can't change it to trunk port. Why don't you connect PC directly to Phone and then phone to 8 port switch. One trunk to 8-port switch from data switch and your problem is solved. &lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-03-23T10:14:01.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28954" PostTypeId="2" ParentId="28950" CreationDate="2016-03-23T10:56:54.833" Score="0" Body="&lt;p&gt;If the 8 Port switch is an unmanaged switch it doesn't add VLAN headers which identivy at wich mac address table the Managed switch look and forward.&#xA;You can only have at least 2 VLANs in this topology. &#xA;One nativ and one Voice VLAN if your managed swtich provides the voice vlan option:&#xA;config:&lt;br&gt;&#xA;switch#(config):int fa0/3 &lt;br&gt;&#xA;switch#(config-if):switchport mode trunk&lt;br&gt;&#xA;switch#(config-if):switchport trunk nativ vlan &lt;strong&gt;x&lt;/strong&gt;&lt;br&gt;&#xA;switch#(config-if):switchport voice vlan &lt;strong&gt;x&lt;/strong&gt;&lt;br&gt;&lt;/p&gt;&#xA;" OwnerUserId="21212" LastEditorUserId="21212" LastEditDate="2016-03-23T11:11:20.343" LastActivityDate="2016-03-23T11:11:20.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28955" PostTypeId="2" ParentId="28950" CreationDate="2016-03-23T11:13:00.210" Score="2" Body="&lt;p&gt;I don't think its possible to configure the phone's second port as trunk port. You can configure a separate voice VLAN for the phone, but the phone's access port will be an access port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from that, even if it was possible, how do you want to achieve VLAN configuration on an unmanaged switch? You want to separate the VLANs 11 and 12, which indicates you need the VLAN information in the packet header. As the unmanaged switch is not VLAN-aware, it won't remove the VLAN information and send the tagged frames to the host and printer connected to the switch. And I'd guess thats not true for all unmanaged switches, some of them may just drop VLAN tagged packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all I'd strongly suggest to rethink your network design. To help you further this direction, we need more information about the circumstances. Why not connect the phone and printer directly to the managed switch?&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-03-23T11:13:00.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28956" PostTypeId="2" ParentId="28950" CreationDate="2016-03-23T11:14:26.143" Score="0" Body="&lt;p&gt;You are using the phone as a swtich. I don't know if the phone can do that. If you would add a switch (say named 'fred') where the phone is, and plug the phone into that switch, yout would have to configure trunking between 'fred' and 'Data Port 3' and you'd have to configure trunking between 'fred' and the 8-Port switch (which, as Pompi said, is not possible, because it is unmanaged).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, if you want those vlans to talk to each other, you'd need some kind of routing functionality, like a L3 switch or a router.&lt;/p&gt;&#xA;" OwnerUserId="23741" LastActivityDate="2016-03-23T11:14:26.143" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28957" PostTypeId="1" CreationDate="2016-03-23T11:15:10.050" Score="2" ViewCount="303" Body="&lt;p&gt;It is told that &lt;a href=&quot;http://www.fp7-trend.eu/system/files/content-public/248-trend-friends-workshop-gent-14-february-2012-presentations/wp1powerconsumptionofbasestationsalblfconte.pdf&quot; rel=&quot;nofollow&quot;&gt;mobile Base Stations consume approximately 1 kW of power non-stop&lt;/a&gt;. Meantime &lt;a href=&quot;http://energy-surprises.blogspot.com.ee/2014/08/mobile-network-energy-in-fridge-units.html&quot; rel=&quot;nofollow&quot;&gt;I read that watching a movie every week at your mobile phone consumes as much energy by the network as powering a refrigerator for year or two.&lt;/a&gt; Does it mean that power, used by base stations is proportional to the data transfer amount and is about 1 kWh per GB and average can be much lower than 1kW? BTW, why is power consumption so high if mobile does not consume so much communicating with the same station?&lt;/p&gt;&#xA;" OwnerUserId="23952" LastEditorUserId="23952" LastEditDate="2016-03-23T12:10:27.503" LastActivityDate="2017-02-24T05:02:33.077" Title="Does base station electric power consumption depend on the traffic?" Tags="|wireless|mobile|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28959" PostTypeId="2" ParentId="28951" CreationDate="2016-03-23T11:28:21.870" Score="1" Body="&lt;p&gt;You'll need to apply the:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;command on all of the interfaces. As the interfaces are currently configured as trunks and you've got PC's connected to those interfaces, the PC traffic will be hitting the switch on the native VLAN (VLAN 1) because they're not tagging their packets. &#xA;You will be able to able to confirm this using one or both of these commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show mac address-table &#xA;show ip arp &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above commands will tell you which VLAN the switch sees each of the PC's on. &lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-03-23T11:28:21.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28960" PostTypeId="1" AcceptedAnswerId="28965" CreationDate="2016-03-23T11:44:24.923" Score="2" ViewCount="1942" Body="&lt;p&gt;I'd like to understand why trying to connect to a server in the same network, using the public IP address (provided by the router/NAT), and the port doesn't' work. (I'll assume two interfaces in the router/NAT, one connected to the internet, and the other connected to the private network. I will also assume I'm using TCP.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see the diagram here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7TKNF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7TKNF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a NAT table which allows connections to my internal 192.168.1.4:80 host, which is running an http server.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP internal  |  Port internal |  IP external  Port external |  Port nat &#xA;192.168.1.4         80                *            *             80     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I connect from host B with ip 8.8.8.9 and port 55231, this entry would be added:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.4         80             8.8.8.9       55231           80     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And everything would work correctly. The 'loopback problem' comes when trying to connect to (80.53.56.67,80) from an internal host, such as host A 192.168.1.4 with port 60000. The datagram sent by this host would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IPsrc:192.168.1.4, IPdst:IPnat, Proto:TCP|| PortSrc: 50243, PortDst: 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, a new entry would be added to the NAT table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.4       50243        IPnat       80       60000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The datagram replies of the server would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IPsrc:192.168.1.4, IPdst:IPnat, Proto:TCP||PortSrc: 80, PortDst: 60000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't see the problem here; in my opinion it should work correctly. I can't see why this wouldn't work. Is it the order in which the NAT-routing is done?&lt;/p&gt;&#xA;" OwnerUserId="23459" LastEditorUserId="23459" LastEditDate="2016-03-23T20:04:10.327" LastActivityDate="2016-03-23T20:20:13.977" Title="Understanding NAT loopback problem" Tags="|nat|snat|dnat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28962" PostTypeId="1" AcceptedAnswerId="28966" CreationDate="2016-03-23T13:40:24.460" Score="5" ViewCount="16445" Body="&lt;p&gt;So my question is quite clear I think. If two applications use different transport layer protocols (e.g. TCP and UDP or something else) can they open the same port number?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does the OS do the multiplexing if this is the case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How many transport protocols can be in an OS networking stack?&#xA;If the number of different protocols is unlimited does that mean that a computer can basically have unlimited open ports to communicate through?&lt;/p&gt;&#xA;" OwnerUserId="23730" LastEditorUserId="8499" LastEditDate="2016-12-22T18:21:54.890" LastActivityDate="2016-12-22T18:21:54.890" Title="Can two different applications bind the same port on a host if they use different protocols?" Tags="|tcp|protocol-theory|udp|transport-protocol|layer4|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28963" PostTypeId="2" ParentId="28962" CreationDate="2016-03-23T13:58:44.490" Score="4" Body="&lt;p&gt;Ports are an individual parameter of both UDP and TCP, so yes they are different.  Because each transport protocol has its own stack, they operate independently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your second question, unless you are trying to stay within the OSI or TCP/IP model, you don't need a transport protocol -- or you can make up your own.  You can use any mechanism you like to multiplex connections.  Ports are just one such mechanism.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-23T13:58:44.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28965" PostTypeId="2" ParentId="28960" CreationDate="2016-03-23T14:33:11.653" Score="0" Body="&lt;p&gt;I think I understand your question now. You are asking about hairpin routing. Some routers support this, but some don't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routers which support this specifically look for traffic which should hairpin. The routers which don't support this do normal routing, and they send traffic destined for external addresses out the WAN interface, per the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is completely dependent on the router make, model, and software version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens on the routers which don't support this is that the traffic from the inside host to the external server address has the destination address looked up in the routing table, and that points to the WAN interface, so the the traffic is sent to the WAN interface, which is an outside interface, so the inside source address gets translated, per the inside source NAT rules, to an outside address (usually the WAN interface address), and the traffic is sent out the WAN interface. This is all based on normal routing rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The traffic will travel to the ISP router, which will promptly drop it since it is coming in from an interface where the destination address is. Routers drop traffic destined for the network from which it originates.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-23T20:20:13.977" LastActivityDate="2016-03-23T20:20:13.977" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="28966" PostTypeId="2" ParentId="28962" CreationDate="2016-03-23T14:47:49.263" Score="11" Body="&lt;p&gt;Think of it this way: TCP is one street, UDP is another street, and port numbers are the addresses of the houses (ports) on the streets, just as they are layer-4 addresses. Each street has the same address numbers for the houses. An application can move into the house at 80 TCP St., but when another application wants to move into the same house, it finds the house already occupied, so it can't move in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, one application could move into 9876 TCP St., and a different application could move into 9876 UDP Ln. at the same time. The OS doesn't need to multiplex this since traffic destined for these houses travels on different streets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will be a practical limit to the number of transport protocols an OS can have, but that will vary by OS. In theory, there is no limit. Some transport layer protocols don't use addresses like ports.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-23T20:51:18.840" LastActivityDate="2016-03-23T20:51:18.840" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28969" PostTypeId="1" CreationDate="2016-03-23T16:13:23.653" Score="1" ViewCount="81" Body="&lt;p&gt;I want to use a Cisco 2600 to route through four different IP subnet addresses of my servers through DHCP interconnected together with four switches on a router. How do i achieve it? &lt;/p&gt;&#xA;" OwnerUserId="23966" LastEditorUserId="8499" LastEditDate="2016-04-24T00:31:50.473" LastActivityDate="2016-06-23T01:09:11.320" Title="How to achieve routing through three different IP subnets on a Cisco router?" Tags="|cisco|routing|router|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28970" PostTypeId="1" CreationDate="2016-03-23T16:18:38.230" Score="1" ViewCount="1698" Body="&lt;p&gt;I have a virtual chassis of 2 EX4600-40f. The 4 ports (0/0/1, 0/0/2, 0/0/3, 0/0/4) where my ESX are connected are configured in trunk mode with some vlans.&#xA;I would like to copy the traffic (tagged) of my 4 ESX to a port (1/0/27) in order to analyze it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I already configured an analyzer on the swtich :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;input {&#xA;    ingress {&#xA;        interface xe-0/0/1.0;&#xA;        interface xe-0/0/2.0;&#xA;        interface xe-0/0/3.0;&#xA;        interface xe-0/0/4.0;&#xA;    }&#xA;    egress {&#xA;        interface xe-0/0/1.0;&#xA;        interface xe-0/0/2.0;&#xA;        interface xe-0/0/3.0;&#xA;        interface xe-0/0/4.0;&#xA;    }&#xA;}&#xA;output {&#xA;    interface xe-1/0/21.0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ports to be mirrored config :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xe-0/0/2 {&#xA;    unit 0 {family ethernet-switching {&#xA;            interface-mode trunk;&#xA;            vlan {&#xA;                members [ 15 51 123 207 2260-2263 ];&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;port to connect the network analyzer :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xe-1/0/21 {&#xA;unit 0 {&#xA;    family ethernet-switching {&#xA;        interface-mode access;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I have incorrect vlan tag on packet received by the server on the port 1/0/21, half of the traffic is tagged and the rest is not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do ?&#xA;Is it possible to mirror a trunk port and keep tags?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for your answers&lt;/p&gt;&#xA;" OwnerUserId="23965" LastEditorUserId="23965" LastEditDate="2016-03-25T13:26:20.930" LastActivityDate="2019-10-24T04:48:41.660" Title="Juniper mirroring trunk ports" Tags="|vlan|juniper-ex|mirror|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28971" PostTypeId="1" AcceptedAnswerId="28972" CreationDate="2016-03-23T16:48:19.743" Score="4" ViewCount="85" Body="&lt;p&gt;I recently became the IT guy at a remote school with onsite staff. The network setup is a bit messy right now. I am curious about the best standards to use. Below is a map of the current network that provides internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/meMgO.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/meMgO.jpg&quot; alt=&quot;Network Map&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the network is a bit of a mix of methods. There is one Ethernet cable running underground along the lines. There is a coaxial cable running from the satellite on the roof to the modem located next to the server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I often run into weak connections further out, especially at 19 and 23 which will drop out for days during sand storms, rain, or snow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have heard running dual lines helps. I was also thinking doing something like looping 19 back to the server to make one large circle. This would require a lot of work, but so would digging up the lines that are in place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A central network location that all lines branch off of might also be an option. I have a lot of Wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some standards that could accomplish my goal?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Joel&lt;/p&gt;&#xA;" OwnerUserId="23964" LastActivityDate="2016-03-23T17:01:44.850" Title="Ensuring Network Stablity" Tags="|ethernet|internet|lan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28972" PostTypeId="2" ParentId="28971" CreationDate="2016-03-23T17:01:44.850" Score="2" Body="&lt;p&gt;You are probably running into distance limitations of Ethernet over copper.  If you're going to dig, then you should use fiber-optic cable instead of copper.    It's more expensive, but not a big increase compared to the cost of digging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regardless of what you choose, you will need to use network switches instead of hubs, especially at 23 and 26.   That will also solve your distance problem. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-23T17:01:44.850" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="28973" PostTypeId="1" AcceptedAnswerId="29685" CreationDate="2016-03-23T18:12:57.133" Score="2" ViewCount="1627" Body="&lt;p&gt;I was playing with an EIGRP Lab in GNS3, and came across a very weird oddity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZhOP4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZhOP4.png&quot; alt=&quot;EIGRP Lab Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the oddity:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2# show ip eigrp topology&#xA;&amp;lt;~-~-~ output ommitted ~-~-~&amp;gt;&#xA;P 10.4.5.0/24, 1 successors, FD is 309760   &amp;lt;----&#xA;        via 10.2.3.3 (332800/307200), FastEthernet0/0&#xA;P 10.3.4.0/24, 1 successors, FD is 307200&#xA;        via 10.2.3.3 (307200/281600), FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice for 10.4.5.0/24, I am seeing two different values displayed for Feasible Distance. The line with the arrow reports the FD as &lt;code&gt;309760&lt;/code&gt;. The line just below it reports the FD as &lt;code&gt;332800&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I included the route for 10.3.4.0/24 as a comparison, In that route (as I expect it to be), the FD in the first line matches the FD in the second line (both &lt;code&gt;307200&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the EIGRP route in more detail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2# show ip eigrp topology 10.4.5.0/24&#xA;IP-EIGRP (AS 99): Topology entry for 10.4.5.0/24&#xA;  State is Passive, Query origin flag is 1, 1 Successor(s), FD is 309760&#xA;  Routing Descriptor Blocks:&#xA;  10.2.3.3 (FastEthernet0/0), from 10.2.3.3, Send flag is 0x0&#xA;      Composite metric is (332800/307200), Route is Internal&#xA;      Vector metric:&#xA;        Minimum bandwidth is 10000 Kbit     &amp;lt;---- &#xA;        Total delay is 3000 microseconds    &amp;lt;----&#xA;        Reliability is 255/255&#xA;        Load is 1/255&#xA;        Minimum MTU is 1500&#xA;        Hop count is 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We can use the highlighted values to calculate the EIGRP Metric using the default K-values and this formula:  256 * (BW + Delay). Which equates to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;256 * (1000 + 300) = 332800&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the Feasible distance to 10.4.5.0/24 on R2 is 332800. And the &lt;code&gt;show ip route&lt;/code&gt; output is indeed showing this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2# show ip route 10.4.5.0&#xA;Routing entry for 10.4.5.0/24&#xA;  Known via &quot;eigrp 99&quot;, distance 90, metric 332800, type internal&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But for whatever reason, in the EIGRP topology table, I am seeing this other strange value &lt;code&gt;309760&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2# show ip eigrp topology&#xA;P 10.4.5.0/24, 1 successors, FD is 309760&#xA;        via 10.2.3.3 (332800/307200), FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is causing the 309760 value? Why am I seeing two different values in what I thought was always the Feasible Distance? Why is the 10.4.5.0/24 route the only one in my network that is showing two different values?&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2017-08-28T13:22:06.000" Title="Why am I seeing two different values for Feasible Distance?" Tags="|eigrp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28974" PostTypeId="2" ParentId="28973" CreationDate="2016-03-23T19:25:15.810" Score="0" Body="&lt;p&gt;You interpretation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Notice for &lt;code&gt;10.4.5.0/24&lt;/code&gt;, I am seeing two different values displayed&#xA;  for Feasible Distance. The line with the arrow reports the FD as&#xA;  &lt;code&gt;309760&lt;/code&gt;. The line just below it reports the FD as &lt;code&gt;332800&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;is incorrect. The FD is &lt;code&gt;309760&lt;/code&gt;. The cost to the destination is &lt;code&gt;332800&lt;/code&gt;. You would not normally see any duplicate information as you seem to think the command shows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfeigrp.html#wp1023119&quot; rel=&quot;nofollow noreferrer&quot;&gt;EIGRP Commands&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Feasible distance. The feasible distance is the &lt;em&gt;best metric to reach&#xA;  the destination &lt;strong&gt;or the best metric that was known when the route&#xA;  went active&lt;/em&gt;&lt;/strong&gt;. This value is used in the feasibility condition check.&#xA;  If the reported distance of the router (the metric after the slash) is&#xA;  less than the feasible distance, the feasibility condition is met and&#xA;  that path is a feasible successor. Once the software determines it has&#xA;  a feasible successor, it need not send a query for that destination.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The first number is the EIGRP metric that represents the cost to the&#xA;  destination. The second number is the EIGRP metric that this peer&#xA;  advertised.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/16406-eigrp-toc.html#feasibleandreported&quot; rel=&quot;nofollow noreferrer&quot;&gt;Enhanced Interior Gateway Routing Protocol&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;Feasible Distance, Reported Distance, and Feasible Successor&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;Feasible distance is the best metric along a path to a destination&#xA;  network, including the metric to the neighbor advertising that path.&#xA;  Reported distance is the total metric along a path to a destination&#xA;  network as advertised by an upstream neighbor. A feasible successor is&#xA;  a path whose reported distance is less than the feasible distance&#xA;  (current best path). Figure 3 illustrates this process:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9FbYo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9FbYo.png&quot; alt=&quot;eigrp3.gif&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Router One sees that it has two routes to Network A: one through&#xA;  Router Three and another through Router Four.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The route through Router Four has a cost of 46277376 and a reported    distance of 307200.&lt;/li&gt;&#xA;  &lt;li&gt;The route through Router Three has a cost of 20307200 and a reported    distance of 307200.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Note that in each case EIGRP calculates the reported distance from the&#xA;  router advertising the route to the network. In other words, the&#xA;  reported distance from Router Four is the metric to get to Network A&#xA;  from Router Four, and the reported distance from Router Three is the&#xA;  metric to get to Network A from Router Three. EIGRP chooses the route&#xA;  through Router Three as the best path, and uses the metric through&#xA;  Router Three as the feasible distance. Since the reported distance to&#xA;  this network through Router Four is less than the feasible distance,&#xA;  Router One considers the path through Router Four a feasible&#xA;  successor.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When the link between Routers One and Three goes down, Router One&#xA;  examines each path it knows to Network A and finds that it has a&#xA;  feasible successor through Router Four. Router One uses this route,&#xA;  using the metric through Router Four as the new feasible distance. The&#xA;  network converges instantly, and updates to downstream neighbors are&#xA;  the only traffic from the routing protocol.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Let us look at a more complex scenario, shown in Figure 4.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZiEcb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZiEcb.png&quot; alt=&quot;eigrp4.gif&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;There are two routes to Network A from Router One: one through Router&#xA;  Two with a metric of 46789376 and another through Router Four with a&#xA;  metric of 20307200. Router One chooses the lower of these two metrics&#xA;  as its route to Network A, and this metric becomes the feasible&#xA;  distance. Next, let us look at the path through Router Two to see if&#xA;  it qualifies as a feasible successor. The reported distance from&#xA;  Router Two is 46277376, which is higher than the feasible distance -&#xA;  so this path is not a feasible successor. If you were to look in the&#xA;  topology table of Router One at this point (using &lt;strong&gt;show ip eigrp&#xA;  topology&lt;/strong&gt;), you would only see one entry for Network A - through&#xA;  Router Four. (In reality there are two entries in the topology table&#xA;  at Router One, but only one will be a feasible successor, so the other&#xA;  will not be displayed in &lt;strong&gt;show ip eigrp topology&lt;/strong&gt;; you can see the&#xA;  routes that are not feasible successors using &lt;strong&gt;&lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/iproute/command/reference/1rfeigrp.html#wp1023119&quot; rel=&quot;nofollow noreferrer&quot;&gt;show ip eigrp&#xA;  topology all-links&lt;/a&gt;&lt;/strong&gt;).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Let us suppose that the link between Router One and Router Four goes&#xA;  down. Router One sees that it has lost its only route to Network A,&#xA;  and queries each of its neighbors (in this case, only Router Two) to&#xA;  see if they have a route to Network A. Since Router Two does have a&#xA;  route to Network A, it responds to the query. Since Router One no&#xA;  longer has the better route through Router Four, it accepts this route&#xA;  through Router Two to Network A.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The &lt;strong&gt;Feasible Distance&lt;/strong&gt; is the best metric (&lt;em&gt;at least as reported&#xA;when the router became active&lt;/em&gt;) to the destination.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;strong&gt;Metric to the Destination&lt;/strong&gt; is the sum of all the metrics&#xA;between the router on which you are reporting and the destination.&lt;/li&gt;&#xA;&lt;li&gt;The &lt;strong&gt;Advertised Distance&lt;/strong&gt; is distance another router tells you is&#xA;its metric to the destination.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Among the other routers reporting an &lt;strong&gt;Advertised Distance&lt;/strong&gt;, your router will compare all the &lt;strong&gt;Advertised Distances&lt;/strong&gt; to the &lt;strong&gt;Feasible Distance&lt;/strong&gt;. Any routers with an &lt;strong&gt;Advertised Distance&lt;/strong&gt; less than the &lt;strong&gt;Feasible Distance&lt;/strong&gt; will become &lt;strong&gt;Feasible Successors&lt;/strong&gt;, and the router with the best &lt;strong&gt;Advertised Distance&lt;/strong&gt; will be the &lt;strong&gt;Successor&lt;/strong&gt;. If there are no routers reporting an &lt;strong&gt;Advertised Distance&lt;/strong&gt; less than the &lt;strong&gt;Feasible Distance&lt;/strong&gt;, there will be no &lt;strong&gt;Successors&lt;/strong&gt; or &lt;strong&gt;Feasible Successors&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your problem with the two different values is that they are two different things. The first is the &lt;strong&gt;Feasible Distance&lt;/strong&gt;, which may be the best metric for the route &lt;em&gt;reported at the time when the route became active&lt;/em&gt;, but it may no longer be the metric to the destination (the original best path may be down, or something may have changed on the path, e.g. using the &lt;code&gt;bandwidth&lt;/code&gt; or &lt;code&gt;delay&lt;/code&gt; interface commands). The second number is the metric to the destination.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-23T22:24:17.610" LastActivityDate="2016-03-23T22:24:17.610" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="28975" PostTypeId="1" CreationDate="2016-03-24T01:11:01.313" Score="2" ViewCount="285" Body="&lt;p&gt;I have an existing simple network with internet connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have four access points that do not offer true guest access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We would like to have four access points that offer wireless for the whole network and wireless for guest internet only. It would be best that the wireless user or guest would be able to connect to one of them and stay connected as they walk in and out of range of the ap/repeater&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a router or ap or repeater that would work in this scenario?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how do large hotels and such handle this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for the noob question.&lt;/p&gt;&#xA;" OwnerUserId="23973" LastEditorUserId="8499" LastEditDate="2018-03-15T01:02:35.133" LastActivityDate="2022-02-10T17:39:35.650" Title="How to create a network with many access points or repeaters and guest access" Tags="|wireless|ieee-802.11|network|network-access|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="28978" PostTypeId="1" CreationDate="2016-03-24T06:35:59.510" Score="3" ViewCount="868" Body="&lt;p&gt;Is there any way to check if an IP address is a real IP address or private IP address?&lt;/p&gt;&#xA;" OwnerUserId="23979" LastEditorUserId="8499" LastEditDate="2018-12-23T04:15:05.227" LastActivityDate="2018-12-23T04:15:05.227" Title="Is there any way to check if an IP address is a real IP address or private IP address?" Tags="|ip|ipv4|subnet|ipv6|ip-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28979" PostTypeId="2" ParentId="28978" CreationDate="2016-03-24T06:45:39.450" Score="4" Body="&lt;p&gt;First, private IP addresses &lt;em&gt;are&lt;/em&gt; real IP addresses. I assume you mean which IP addresses can be routed on the public Internet vs. which IP addresses cannot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check to see if the IP address is in one of the ranges marked as &lt;code&gt;False&lt;/code&gt; under &lt;code&gt;Global&lt;/code&gt; in the &lt;a href=&quot;http://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml&quot;&gt;IANA IPv4 Special-Purpose Address Registry&lt;/a&gt;. If it is, it cannot be routed on the public Internet. Also, multicast addresses (&lt;code&gt;224.0.0.0/4&lt;/code&gt;) cannot be routed on the public Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do the same thing for IPv6 with the &lt;a href=&quot;http://www.iana.org/assignments/iana-ipv6-special-registry/iana-ipv6-special-registry.xhtml&quot;&gt;IANA IPv6 Special-Purpose Address Registry&lt;/a&gt;. The globally routable IPv6 addresses all fall in the &lt;code&gt;2000::/3&lt;/code&gt; range, but there are address ranges within that which are not routable on the public Internet, and any multicast IPv6 address (&lt;code&gt;ff00::/8&lt;/code&gt;) is not routable on the public Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-24T07:01:19.433" LastActivityDate="2016-03-24T07:01:19.433" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="28980" PostTypeId="1" AcceptedAnswerId="28981" CreationDate="2016-03-24T08:46:02.337" Score="3" ViewCount="1667" Body="&lt;p&gt;I have a network where I am looking to alias an IP address/port and redirect it to another machine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VyOS is on my network at 192.168.55.1 and I have another device on the network at 192.168.55.66. I would like to redirect all traffic from 192.168.55.1 port 7000 to 192.168.55.66 port 22. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is, would this be a DNAT or an SNAT or some other rule? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this feature doesn't exactly exist in VyOS, can it be done in general by setting up a Linux box as a router? &lt;/p&gt;&#xA;" OwnerUserId="23980" LastEditorUserId="8499" LastEditDate="2018-03-19T18:01:45.433" LastActivityDate="2018-03-19T18:01:45.433" Title="Alias IP Address in VyOS" Tags="|nat|ip-address|vyatta|dnat|vyos|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28981" PostTypeId="2" ParentId="28980" CreationDate="2016-03-24T10:24:47.637" Score="1" Body="&lt;p&gt;It would be a NAT destination rule like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nat destination rule 70&#xA; inbound interface eth0  *change the interface by yours*&#xA; destination &#xA;    address 192.168.551&#xA;    port 700&#xA; translation&#xA;    address 192.168.55.66&#xA;    port 22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I never test a destination rule that translate to another IP in the same network but it should work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder what lead you to such a need, that seems a curious design.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-24T10:24:47.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28983" PostTypeId="1" AcceptedAnswerId="28985" CreationDate="2016-03-24T10:55:31.983" Score="2" ViewCount="89" Body="&lt;p&gt;**Why each and every single port on Layer 2 switches need to have it's own MAC address?&#xA;This question has been asked and answered with each has it's own MAC and one of the purposes was STP protocol use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is that are these mac addresses used for etherchannel load balancing whenever the portchannel configured to load balance based on src-dst mac?is the source mac in cisco command indicating to the port mac address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks, &#xA;Ethem &lt;/p&gt;&#xA;" OwnerUserId="23982" LastActivityDate="2016-03-24T11:09:15.307" Title="port on Layer 2 switches Mac Address usage" Tags="|cisco-commands|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28984" PostTypeId="1" AcceptedAnswerId="28988" CreationDate="2016-03-24T11:07:21.550" Score="3" ViewCount="761" Body="&lt;h1&gt;Symptom&lt;/h1&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ssh to remote-host works. &lt;/li&gt;&#xA;&lt;li&gt;Simple output like &lt;code&gt;ls&lt;/code&gt; works. &lt;/li&gt;&#xA;&lt;li&gt;But more output like &lt;code&gt;find /&lt;/code&gt; fails.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Solution&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;In our case we reduced the MTU to 1200 on eth0 (IPv4) and the symptoms disappeared.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Question&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;AFAIK there is something call &lt;a href=&quot;https://en.wikipedia.org/wiki/Path_MTU_Discovery&quot; rel=&quot;nofollow&quot;&gt;Path MTU Discovery&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Wikipedia:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Many network security devices block all ICMP messages for perceived security benefit&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If this is the reason, how to debug this?&lt;/p&gt;&#xA;" OwnerUserId="23983" LastEditorUserId="23983" LastEditDate="2016-03-24T11:12:27.030" LastActivityDate="2016-03-24T17:30:32.237" Title="Manual setting MTU still needed today?" Tags="|mtu|network-discovery|packet-path|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28985" PostTypeId="2" ParentId="28983" CreationDate="2016-03-24T11:09:15.307" Score="1" Body="&lt;p&gt;No, the source mac address that used in the algorithm is the source mac address in the Ethernet frame to be transmitted (I.E. the mac address of the host that sent the frame), it has nothing to do with the switch port mac address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(and many switches don't have a per-port mac address).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-24T11:09:15.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28988" PostTypeId="2" ParentId="28984" CreationDate="2016-03-24T13:11:56.577" Score="4" Body="&lt;p&gt;Path MTU Discovery works by sending packets of various sizes to a target with the DF (Don't Fragment&quot; bit turned on. If a router in the path has a smaller MTU, its behavior should be to send back an ICMP message which states the packet needed to have been fragmented, but the DF bit was set to 1. Often this packet even includes the size of the MTU of the link which required fragmentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To debug this, you simply have to do Path MTU discovery, manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Send a ping to a target, in my example, I'll use Google's DNS server (8.8.8.8). Set your DF bit in your ping to on, to prevent your ping from being fragmented. Set your packet size to some large number, or the standard MTU of 1500. Note that some ping implementations set the size of just the payload, which means you have to account for the 8 byte ICMP header, and 20 byte IP header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a Windows PC, here is the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\eddie&amp;gt;ping -f -l 1472 -i 1 8.8.8.8&#xA;&#xA;Pinging 8.8.8.8 with 1472 bytes of data:&#xA;Reply from 10.200.192.1: TTL expired in transit.&#xA;Reply from 10.200.192.1: TTL expired in transit.&#xA;Reply from 10.200.192.1: TTL expired in transit.&#xA;Reply from 10.200.192.1: TTL expired in transit.&#xA;&#xA;Ping statistics for 8.8.8.8:&#xA;    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice I received TTL expired from my first router. That is what I want to see, it tells me nothing in the path between me and my first router required fragmentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would have looked like this if so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\eddie&amp;gt;ping -f -l 1473 -i 1 8.8.8.8&#xA;&#xA;Pinging 8.8.8.8 with 1473 bytes of data:&#xA;Packet needs to be fragmented but DF set.&#xA;Packet needs to be fragmented but DF set.&#xA;Packet needs to be fragmented but DF set.&#xA;Packet needs to be fragmented but DF set.&#xA;&#xA;Ping statistics for 8.8.8.8:&#xA;    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Either way, do this progressively, increasing the TTL by 1 each time. At some point in the path, you'll encounter the error message above (Packet needs to be fragmented by DF set). When that happens, you'll know exactly what router between you and the target had a smaller link size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it happened when the TTL is set to 8, then you can run a traceroute to the target, and the 8th hop will be the router that couldn't fragment the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If at any time, instead of getting &lt;code&gt;Packet needs to be fragmented but DF set&lt;/code&gt; or &lt;code&gt;TTL expired in transit&lt;/code&gt;, then you then know also where in the path a Firewall exists and is blocking the return ICMP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Adding Helpful information from the comments:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@YLearn adds:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;be aware that the return packets could take a different route back and&#xA;  there could be a problem on the return path rather than a firewall/ACL&#xA;  on the outgoing path&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;@ &lt;a href=&quot;https://networkengineering.stackexchange.com/users/23983/guettli&quot;&gt;guettli&lt;/a&gt; &lt;em&gt;(Original Poster)&lt;/em&gt; adds:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;on linux these options are needed: &lt;code&gt;ping -M do -s 1472 8.8.8.8&lt;/code&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/users/33/ylearn&quot;&gt;enter link description here&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-03-24T17:30:32.237" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28989" PostTypeId="1" CreationDate="2016-03-24T14:18:02.817" Score="1" ViewCount="1436" Body="&lt;p&gt;I'm trying to configure QoS on a Cisco 5525-X ASA and feel like I'm beginning to get a handle on it but the queue-limit and tx-ring-limit calculations are losing me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've got right now is a 100Mbps connection shared between video conferencing and internet traffic.  I want to put the video traffic into a low latency queue to ensure it runs smoothly.  From what I understand I'll need to create an ACL to catch all video conferencing traffic and apply that to a service policy.  The documentation isn't making a few points clear, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a hierarchical priority queue, is the queue-limit to be calculated based on the entire 100Mbps bandwidth, or just the amount I want to dedicate to video traffic?  I don't want video traffic to take up the ENTIRE bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With traffic shaping enabled, I plan to set the traffic shape to the full 100Mbps connection.  From what I understand this should buffer any packets that would exceed the bandwidth rather than drop them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running my calculations off of tables 19-1 and 19-2 in &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/conns-qos.html#75446&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/configuration/firewall/asa-firewall-cli/conns-qos.html#75446&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23048" LastActivityDate="2016-03-24T14:18:02.817" Title="Configuring QoS on Cisco ASA 5525-X" Tags="|cisco|qos|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28990" PostTypeId="1" CreationDate="2016-03-24T14:24:48.840" Score="3" ViewCount="87" Body="&lt;p&gt;I have an FPGA that outputs packets to a fixed IP and MAC address.  That then feeds into a 40G Arista switch.  The Unicast UDP packets correctly route to the destination IP and MAC.  We now have another consumer who would like the same data.  Can the Arista switch replicate the data and give it a new IP/Mac.  How would you go about doing that?&lt;/p&gt;&#xA;" OwnerUserId="23987" LastActivityDate="2017-10-05T17:55:08.937" Title="Arista 40G switch capeablities" Tags="|arista|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="28991" PostTypeId="1" AcceptedAnswerId="29001" CreationDate="2016-03-24T15:47:00.343" Score="3" ViewCount="1878" Body="&lt;p&gt;I have a PC (in the successive diagrams &lt;code&gt;pc1&lt;/code&gt;) equipped with a network interface that can be directly connected to another PC or to a managed switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to be able to get the MAC address of the closest device in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to be more precise:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Situation #1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----+       +----------------+       +---------------+&#xA;| pc1 |-------| managed switch |-------| other devices |&#xA;+-----+       +----------------+       +---------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case, I want to get the MAC address of the managed switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Situation #2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----+       +-----+&#xA;| pc1 |-------| pc2 |&#xA;+-----+       +-----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case, I want to get the mac address of pc2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I use to retrieve the MAC address of the first network device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Update&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know, I cannot use ARP, because in PC1's ARP table, I'll see all the MAC addresses related to the IP addresses on the ethernet segment, but I have no way in general to know the IP address of the device at the other end of the cable (this is painful in the case of the switch). This is why I am looking for something like ping at the data link layer with a TTL of 1.&lt;/p&gt;&#xA;" OwnerUserId="23024" LastEditorUserId="8499" LastEditDate="2016-03-24T21:34:40.183" LastActivityDate="2016-03-25T00:02:38.410" Title="Get MAC address of directly connected network neghbor" Tags="|ethernet|mac-address|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="28992" PostTypeId="2" ParentId="28991" CreationDate="2016-03-24T16:19:49.137" Score="1" Body="&lt;p&gt;Ethernet frames have no concept of hops like you want. You are trying to impose a layer-3 concept on layer-2. Ethernet is not hierarchical the way IP is. Switches transparently switch frames, and the MAC addresses in the frames are the source and destination end-points, not any device in between the two endpoints. &lt;a href=&quot;https://en.wikipedia.org/wiki/Ethernet_frame#Structure&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ethernet frames&lt;/a&gt; are pretty simple with very few fields (no TTL or equivalent, which is why broadcast storms are so bad on ethernet):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nsK8t.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nsK8t.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are asking for is not really possible. Ethernet at layer-2 is just a group of equal peers (all look like like they are directly connected to all others).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-25T00:02:38.410" LastActivityDate="2016-03-25T00:02:38.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28995" PostTypeId="2" ParentId="28969" CreationDate="2016-03-24T16:44:57.853" Score="2" Body="&lt;p&gt;To have the router forward dhcp packets you'll need to configure dhcp-relay on each of the router's (sub-?)interfaces that aren't local to the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface &amp;lt;number&amp;gt;&#xA;ip helper-address &amp;lt;dhcp-server address&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19171" LastActivityDate="2016-03-24T16:44:57.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="28997" PostTypeId="1" AcceptedAnswerId="28998" CreationDate="2016-03-24T18:30:40.747" Score="1" ViewCount="91" Body="&lt;p&gt;I'm in charge of the network in my company and i have to check the visited websites.&lt;br/&gt;&lt;br/&gt;We have a edgeMAX router (firmware version 1.8) with DPI and enabling netflow exporting.&lt;br/&gt;DPI (as is it implemented in the edgeMAX router) is not accurate enough for watching which websites people visit.&lt;br/&gt;I have installed nfdump on my imac and it's working well, i have retrieved lot of detailed information such as: protocol, source/destination addresses and so on.&lt;br/&gt; And now i'm looking for getting the website names from IP addresses.&lt;br/&gt;For that purpose i've tried &lt;strong&gt;whois&lt;/strong&gt; command but the output is not easy to parse and for some cases, i can't get a name.&lt;br/&gt;&lt;strong&gt;So my question is: is there other tools with a more human readable output ?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="17044" LastActivityDate="2016-03-24T18:37:34.260" Title="sniffing through my company's lan" Tags="|monitoring|packet-analysis|management|netflow|" AnswerCount="1" CommentCount="2" ClosedDate="2016-03-25T08:52:52.457" ContentLicense="CC BY-SA 3.0" />
  <row Id="28998" PostTypeId="2" ParentId="28997" CreationDate="2016-03-24T18:37:34.260" Score="1" Body="&lt;p&gt;You cannot get the website trough the IP address since behind a single IP there can be many web sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to do in order to get the web site is to inspect the content of http packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be aware that there may be strong legal issue about this, depending on the country.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-24T18:37:34.260" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="28999" PostTypeId="2" ParentId="18717" CreationDate="2016-03-24T18:39:49.227" Score="0" Body="&lt;p&gt;Another thing you can do is copying the output of more system:running-config to a notepad, make the interface changes. Remove the checksums and copy it back to the flash of the asa using ftp or tftp. Then do clear configure factory-default. After this, do copy disk0:/modified-config running-config.&#xA;This will preserve all configuration and just changes the interfaces. (Don't forget to unshut the interfaces and do a configuration comparison with Notepad++ Compare or other tool.)&lt;/p&gt;&#xA;" OwnerUserId="23991" LastActivityDate="2016-03-24T18:39:49.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29001" PostTypeId="2" ParentId="28991" CreationDate="2016-03-24T20:04:27.067" Score="4" Body="&lt;p&gt;802.3 has no concept of &quot;link partner identity&quot;. As such, you cannot reliably determine the MAC of any directly connecting device. However, there are higher level application protocols (CDP, LLDP, etc.) that attempt to address this.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-03-24T20:04:27.067" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29002" PostTypeId="1" AcceptedAnswerId="29003" CreationDate="2016-03-24T21:42:34.460" Score="3" ViewCount="4605" Body="&lt;p&gt;So in the following two routing table entries:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;BGP route advertising &lt;code&gt;10.1.1.0/24&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Static route advertising &lt;code&gt;10.1.0.0/16&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Which would be selected? I know that static routes are chosen over BGP (and other) routes, and more specific routing entries are chosen over less specific, however, which one takes precedence? I want to say the static route, however I'm just not sure.&lt;/p&gt;&#xA;" OwnerUserId="23997" LastEditorUserId="8499" LastEditDate="2016-03-24T22:55:14.257" LastActivityDate="2016-03-27T10:31:17.357" Title="A more specific BGP route vs. a less specific static route, which is selected?" Tags="|routing|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29003" PostTypeId="2" ParentId="29002" CreationDate="2016-03-24T21:47:24.723" Score="6" Body="&lt;p&gt;A more specific route is what is used to forward packets. The two prefixes you have are really that, two separate prefixes, just as if they were in completely different network blocks. You are trying to compare apples to oranges&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, on the other hand, the the prefixes were equal length, the static route would be used (assuming default ADs are used).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-24T21:47:24.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29005" PostTypeId="1" CreationDate="2016-03-25T03:43:07.773" Score="2" ViewCount="796" Body="&lt;p&gt;I know that gigabit ethernet needs to use all four pairs of wires. The idea is that POTS is such low frequency that I believe it should be possible to separate it from the gigabit signal using a filter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other technical problem that makes it difficult? e.g. The effect of a filter on gigabit signal timing (I'm just making this up. I don't actually know much about how ethernet signaling works.)&lt;/p&gt;&#xA;" OwnerUserId="24002" LastEditorUserId="8499" LastEditDate="2018-03-20T23:33:45.240" LastActivityDate="2018-03-20T23:33:45.240" Title="Is it possible to carry POTS and gigabit ethernet over the same Cat 5e/6 cable?" Tags="|layer1|cabling|utp|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29006" PostTypeId="2" ParentId="29005" CreationDate="2016-03-25T04:52:29.650" Score="0" Body="&lt;p&gt;This is expressly forbidden by the standards; you are not allowed to mix applications in the same eight-conductor sheath, even on different pairs, but you can mix applications on a 25-pair sheath, as long as the applications are electrically compatible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would never get such mixed use to pass the required tests. You will create impedance mismatches and asynchronous echoes from splitting off the applications, and it would cause problem with the various measurements (e.g. frequency, insertion loss, NEXT, PSNEXT, FEXT, ELFEXT, PSELFEXT, return loss, propagation delay, delay skew, balance, longitudinal conversion transfer loss, etc.). POTS also uses a high voltage to indicate RING, and this would be detrimental to network equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why, in a world of VoIP, would you want to remain with POTS?&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-25T05:09:33.647" LastActivityDate="2016-03-25T05:09:33.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29007" PostTypeId="1" CreationDate="2016-03-25T09:23:11.407" Score="1" ViewCount="1740" Body="&lt;p&gt;The binary string below should be a (hidden) IP-address in any way. How do I convert it to decimal? Since the number contains too many octets I dont know how to convert it. It should lead to this IPv4: 83.226.175.75&lt;/p&gt;&#xA;&#xA;&lt;p&gt;binary string:     001101110011010001110101001100000100010001101011011010100011001001010001&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but it makes no sense! The first 8 bits in the string refers to decimal 55, and the IP-address should begin with 83. can we find a general rule to link this length of binary numbers to an IP address? Well, it cannot be IPv6, the string is to short...&lt;/p&gt;&#xA;" OwnerUserId="24005" LastActivityDate="2016-03-26T20:09:17.080" Title="convert binary to IP-address" Tags="|ip-address|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29008" PostTypeId="2" ParentId="29007" CreationDate="2016-03-25T10:49:59.220" Score="4" Body="&lt;p&gt;An IP address is either IPv4 : 32 bits or IPv6 : 128 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus your binary string is NOT an IP address.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-25T10:49:59.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29009" PostTypeId="1" CreationDate="2016-03-25T12:58:09.523" Score="1" ViewCount="227" Body="&lt;p&gt;What are the control bits forbidden sequences in a segment? Only SYN + FIN and SYN + URG come as candidates to my mind, do you know others? Is there somewhere a list of these?&lt;/p&gt;&#xA;" OwnerUserId="24004" LastActivityDate="2018-10-12T08:00:04.673" Title="Control bits forbidden combination" Tags="|tcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29011" PostTypeId="2" ParentId="29009" CreationDate="2016-03-25T14:03:19.197" Score="1" Body="&lt;p&gt;You should consult the source. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 793, TRANSMISSION CONTROL PROTOCOL&lt;/a&gt; defines and describes TCP, and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793#section-3.9&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section 3.9, Event Processing&lt;/a&gt; discusses what happens during processing, step-by-step.&lt;/p&gt;&#xA;&lt;p&gt;There is no simple table of invalid combinations in the RFC, but you are walked step-by-step through what happens in each state when different events happen, including receiving segments with control flags set. If you understand how TCP processes received segments, you could create a table, but that is really beside the point: processing as the RFC specifies will result in invalid combinations being handled correctly as errors.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-25T14:13:26.790" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29012" PostTypeId="1" CreationDate="2016-03-25T15:26:24.757" Score="2" ViewCount="221" Body="&lt;p&gt;Can someone tell me when does TCP send the data to the application layer (when receiving it) and if the message is divided into multiple segments does it wait till they all arrive to forward to application layer? what happens specifically , I tried searching online but I couldnt find an answer &lt;/p&gt;&#xA;" OwnerUserId="23893" LastActivityDate="2016-08-24T00:06:28.547" Title="TCP and Application layer" Tags="|tcp|osi|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29013" PostTypeId="2" ParentId="29012" CreationDate="2016-03-25T15:55:53.127" Score="0" Body="&lt;p&gt;You should go to the source document, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 793, TRANSMISSION CONTROL PROTOCOL&lt;/a&gt;. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793#section-3.8&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section 3.8, Interfaces&lt;/a&gt; describes this:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Receive&lt;/p&gt;&#xA;&lt;p&gt;Format:  RECEIVE (local connection name, buffer address, byte&#xA;count) -&amp;gt; byte count, urgent flag, push flag&lt;/p&gt;&#xA;&lt;p&gt;This command allocates a receiving buffer associated with the&#xA;specified connection.  If no OPEN precedes this command or the calling&#xA;process is not authorized to use this connection, an error is&#xA;returned.&lt;/p&gt;&#xA;&lt;p&gt;In the simplest implementation, control would not return to the&#xA;calling program until either the buffer was filled, or some error&#xA;occurred, but this scheme is highly subject to deadlocks. A more&#xA;sophisticated implementation would permit several RECEIVEs to be&#xA;outstanding at once.  These would be filled as segments arrive. This&#xA;strategy permits increased throughput at the cost of a more elaborate&#xA;scheme (possibly asynchronous) to notify the calling program that a&#xA;PUSH has been seen or a buffer filled.&lt;/p&gt;&#xA;&lt;p&gt;If enough data arrive to fill the buffer before a PUSH is seen, the&#xA;PUSH flag will not be set in the response to the RECEIVE. The buffer&#xA;will be filled with as much data as it can hold. If a PUSH is seen&#xA;before the buffer is filled the buffer will be returned partially&#xA;filled and PUSH indicated.&lt;/p&gt;&#xA;&lt;p&gt;If there is urgent data the user will have been informed as soon as&#xA;it arrived via a TCP-to-user signal. The receiving user should thus be&#xA;in &amp;quot;urgent mode&amp;quot;.  If the URGENT flag is on, additional urgent data&#xA;remains.  If the URGENT flag is off, this call to RECEIVE has returned&#xA;all the urgent data, and the user may now leave &amp;quot;urgent mode&amp;quot;.  Note&#xA;that data following the urgent pointer (non-urgent data) cannot be&#xA;delivered to the user in the same buffer with preceeding urgent data&#xA;unless the boundary is clearly marked for the user.&lt;/p&gt;&#xA;&lt;p&gt;To distinguish among several outstanding RECEIVEs and to take care&#xA;of the case that a buffer is not completely filled, the return code is&#xA;accompanied by both a buffer pointer and a byte count indicating the&#xA;actual length of the data received.&lt;/p&gt;&#xA;&lt;p&gt;Alternative implementations of RECEIVE might have the TCP allocate&#xA;buffer storage, or the TCP might share a ring buffer with the user.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-03-25T15:55:53.127" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29014" PostTypeId="1" AcceptedAnswerId="29015" CreationDate="2016-03-25T16:16:15.707" Score="2" ViewCount="7290" Body="&lt;p&gt;I am trying to understand Linux bridging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say I have a Linux bridge with two veth interfaces and a vNic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bridge: br0&#xA;Interfaces: veth1, veth2, and eth1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if I do &lt;code&gt;brctl showmacs br0&lt;/code&gt;, it shows me a list of port no#s/ MAC address etc. Like: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; $ brctl showmacs br0&#xA; port no mac addr                is local?       ageing timer &#xA;&#xA;   1     00:50:56:8f:96:e5       yes                0.00&#xA;&#xA;   2     f2:2b:f5:fa:17:9c       yes                0.00&#xA;&#xA;   3     0e:fd:9d:0a:2c:4f       yes                0.00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Question1: How is the above table constructed? I assume its called the forwarding database?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Frame Bridging&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if a frame gets generated at veth1 with destination MAC address of veth2. It will just go to the bridge, the bridge will look up its forwarding database and it will be sent to the veth2's port on the bridge. Simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question 2:&#xA;But if a frame gets generated at veth1 with a destination MAC address that's not a bridge port then how does the bridging works? I assume the bridge floods all the ports with this frame. But then what? IF a port accepts the flooding frame, does it notify the bridge that I have this MAC address? If no port on the bridge is the receiver, how does the bridge know what's the uplink port or the port to which it should sent the frame to, in this event where no of bridge ports are the intended receivers?&lt;/p&gt;&#xA;" OwnerUserId="24013" LastEditorUserId="8499" LastEditDate="2016-03-25T17:07:04.517" LastActivityDate="2017-02-08T11:58:35.283" Title="Understanding Linux Bridging" Tags="|linux|bridge|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29015" PostTypeId="2" ParentId="29014" CreationDate="2016-03-25T17:05:00.943" Score="4" Body="&lt;p&gt;The way switches (bridges) work is that a switch builds a MAC address table which relates MAC addresses to the port(s) where the MAC addresses are connected. When a frame comes into a switch port, the switch will update its MAC address table to show that the source MAC address in the frame is connected to that port. Each port can have multiple MAC addresses associated with it, but there is only one port for each MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a frame comes into a switch, the switch will update its MAC address table with the source MAC address in the frame, and it will look to see if the destination MAC address is in its MAC address table. If the destination MAC address is in the table, the frame will be switched to the corresponding port. If the destination MAC address is not in the MAC address table, or the destination MAC address is the broadcast address or a multicast address, the frame will be flooded to all switch ports.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-25T17:05:00.943" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29016" PostTypeId="1" AcceptedAnswerId="29038" CreationDate="2016-03-25T17:32:09.143" Score="3" ViewCount="6069" Body="&lt;p&gt;I built a simple Network with 2 routers, the problem is that i cant reach to other router, somehow there's problem i couldn't figure out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the configurations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router0:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pMqcc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pMqcc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Router1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TCvjD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TCvjD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;doesn't work...&lt;/p&gt;&#xA;" OwnerUserId="23760" LastActivityDate="2016-07-05T14:50:02.190" Title="I can't ping the other router using OSPF protocol, Why?" Tags="|ospf|network-discovery|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29017" PostTypeId="1" AcceptedAnswerId="29841" CreationDate="2016-03-25T17:35:28.367" Score="0" ViewCount="33" Body="&lt;p&gt;Here is case:&#xA;I have many PC's/Laptops which has windows 7 or windows 8.&lt;br&gt;&#xA;I wanted to upgrade all of those machines to Windows 10. All we have is wireless connectivity. No ethernet cables are used for this upgrade.&lt;br&gt;&#xA;At the same time i wanted to check how much data is downloaded at each PC/Laptop?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought of using any third party software that catches amount of data downloaded, but in OS upgrades, third party softwares wont work.&lt;br&gt;&#xA;Second, i thought of using information from WAP(Wireless Access Point) a particular PC/Laptop is associated with, but we dont have that luxury to ask for WAP data.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other thought would be really appreciated.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I dont find any relevant tags either for this question. Suggest some tag as well so that we can ask appropriate experts.&lt;/p&gt;&#xA;" OwnerUserId="10188" LastActivityDate="2016-04-22T00:59:14.267" Title="Data downloaded while upgrading to Windows 10?" Tags="|wireless|network-core|network-access|" AnswerCount="1" CommentCount="5" ClosedDate="2019-03-15T20:26:18.083" ContentLicense="CC BY-SA 3.0" />
  <row Id="29019" PostTypeId="2" ParentId="29016" CreationDate="2016-03-25T17:47:27.500" Score="0" Body="&lt;p&gt;If these are your only two routers, you have a problem: there is no common network on which these routers can communicate. Routers need a common network between them in order to even communicate with IP, much less with a protocol (e.g. OSPF) which uses IP. OSPF could never form a neighbor relationship if the FastEthernet ports on these routers are connected to the other router as the only links between the routers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-25T17:47:27.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29022" PostTypeId="2" ParentId="26794" CreationDate="2016-03-25T18:39:50.937" Score="1" Body="&lt;p&gt;found a command that will show me the number of spans sessions on a switch.&#xA;After you enter into config mode, enter in the command &lt;code&gt;monitor session ?&lt;/code&gt; to get the number of a span sessions on that switch.&lt;/p&gt;&#xA;" OwnerUserId="22709" LastActivityDate="2016-03-25T18:39:50.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29025" PostTypeId="2" ParentId="26701" CreationDate="2016-03-25T19:10:54.430" Score="3" Body="&lt;p&gt;The security bit you're referring to is &lt;a href=&quot;https://en.wikipedia.org/wiki/IPsec&quot; rel=&quot;nofollow&quot;&gt;IPsec&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It exists, is in use, and is pretty cool. But it hasn't yet been applied to all or lots of traffic as was originally dreamed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/IPsec#Standards_status&quot; rel=&quot;nofollow&quot;&gt;the WP article&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IPsec was developed in conjunction with IPv6 and was originally required to be supported by all standards-compliant implementations of IPv6 before RFC 6434 made it only a recommendation. IPsec is also optional for IPv4 implementations. IPsec is most commonly used to secure IPv4 traffic.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="23971" LastActivityDate="2016-03-25T19:10:54.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29028" PostTypeId="1" AcceptedAnswerId="29029" CreationDate="2016-03-25T20:55:50.623" Score="7" ViewCount="3341" Body="&lt;p&gt;As I understand it, when Host Alice knows Host Bob's IPv6 address but not its MAC, Alice sends an NDP Neighbor Solicitation (NS) message to the &lt;em&gt;solicited-node multicast address&lt;/em&gt; for Bob.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alice knows Bob's unicast address, so why send the NS to a multicast? What purpose is served by some other hosts possibly receiving the packet?&lt;/p&gt;&#xA;" OwnerUserId="23971" LastEditorUserId="8499" LastEditDate="2018-12-23T04:16:06.880" LastActivityDate="2021-01-04T01:10:39.473" Title="Why is the NDP Neighbor Solicitation message sent to the solicited-node address?" Tags="|ip|ipv6|protocol-theory|multicast|ndp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29029" PostTypeId="2" ParentId="29028" CreationDate="2016-03-25T21:15:48.123" Score="6" Body="&lt;p&gt;I don't think you quite understand that Alice needs Bob's MAC address before she can send anything to him. What &lt;em&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4861, Neighbor Discovery for IP version 6 (IPv6)&lt;/a&gt;&lt;/em&gt; says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861#section-4.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;4.3&lt;/a&gt;.  Neighbor Solicitation Message Format&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Nodes send Neighbor Solicitations to request the link-layer address&#xA;of a target node while also providing their own link-layer address to&#xA;the target. Neighbor Solicitations are multicast when the node needs&#xA;to resolve an address and unicast when the node seeks to verify the&#xA;reachability of a neighbor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;When used as the equivalent of ARP in IPv4, Alice does not know Bob's MAC address, so Alice can't send anything to Bob's IPv6 address. Alice needs to resolve Bob's IPv6 address to his MAC address in order to be able to send anything to Bob. Alice does this by sending a request to the solicited node multicast address, based on the last 24 bits of Bob's IPv6 address, so it is likely that only Bob will receive the request.&lt;/p&gt;&#xA;&lt;p&gt;Contrast this to ARP in IPv4 where ARP requests are sent to the broadcast address, interrupting all hosts on the LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2021-01-04T01:10:39.473" CommentCount="8" ContentLicense="CC BY-SA 4.0" />
  <row Id="29030" PostTypeId="2" ParentId="28704" CreationDate="2016-03-25T22:18:52.523" Score="5" Body="&lt;p&gt;Theres two seperate issues to consider, safety and interference. The authorities tend to mostly be concerned with the former. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Capacitive and inductive coupling are highy unlikely to be strong enough to cause a hazard, so the safety side of things is mostly about making sure mains doesn't get onto the signal lines even under circumstances of insulation failure. How this is achived will vary between countries and possiblly withing a country. Without knowing both what country you are in and the type of cables involved it's hard to tell if they are compliant or not. AIUI in the UK it would be compliant if the mains cables had an earthed metal layer, if the insulation on the data cables was rated to mains voltage or if the screen in the data cable was protectively earthed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interference side of things depends on a number of factors. In general two cables merely crossing each other are less of an issue than long runs in close parallell. Distance helps, higher twist rates helps and shielding helps. It also depends a lot on what exactly is flowing in the power cables, nice clean 50Hz isn't going to have much impact on ethernet even at high currents but if a lot of high frequency crap gets onto the power lines then that can be much worse.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-03-25T22:18:52.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29032" PostTypeId="2" ParentId="28932" CreationDate="2016-03-25T23:04:44.530" Score="3" Body="&lt;p&gt;There is no &quot;best&quot; as you are trying to define it. There is only a &quot;best for you&quot; which is something that you need to determine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Security can be viewed from a number of different ways. For instance, I was once taught that security is a balance between securing a device and usability. A &lt;em&gt;very&lt;/em&gt; secure system is one that is entirely disconnected, embedded in 10' of concrete, and buried 300' underground in an undisclosed location. This would also be very maintainable as you wouldn't have to worry about patches, updates, password refreshes, etc. However it is also a system that is entirely unusable. Your company will need to make the best judgments about where between extremes your own operations and user base would be comfortable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond that, is the risk vs. cost balance. Much like redundancy (and the redundancy vs. security is another balance to consider when you allocate resources), you will need to evaluate your individual risks, how much risk your company is willing to take, and how much money they have available and are willing to spend on security.  Most companies won't want to spend more on securing something than it is worth. You will never walk into a retail store to find a $2 anti-theft tag on a $1 pack of gum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And of course, when counting the costs there are always the &quot;soft&quot; costs. Extra staff (or more knowledgeable staff) to maintain the required level of security (or redundancy). Support costs. Extra complexity that could result in extra lost time/productivity when there is a problem. End user support issues. And on and on and on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately in life, both security and redundancy also have diminishing returns.  By this I mean that you can make fairly significant steps to increase either (or both) for relatively little cost. But the further you want to increase those benefits, the steeper the costs get.  For instance, you can get a 90% uptime (at 100% capacity) with relatively few costs, but to get 99% (at 100% capacity) expect to pay quite a bit more. To get to 99.999% (at 100% capacity), will likely cost you at least double your costs to get to 99%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond the issue of &quot;best&quot; is that you are looking for studies to back your decision up. This is also problematic as most companies do not disclose details of their security. Sure, they may say they use product X or vendor Y, but they generally won't provide a full picture. Why? Because the more information they reveal, the easier it would be to exploit any vulnerabilities in the system. The most secure companies will reveal almost nothing at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trying to get an &quot;average&quot; of all companies is trying to treat apples and oranges the same (as well as bananas, grapes, kiwi, peaches, pears, pineapples, ...). Most knowledgeable professionals will tell you there is a world of difference between how different types of companies/businesses perceive and address security. Retail, financial, banking, web-based, edu, manufacturing, services, software design, intellectual property, and so on have different needs and risks. Trying to lump them all together into some &quot;average&quot; just doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the comments you keep looking for a &quot;magic bullet&quot; answer, so instead let's compare this to something outside IT. Would you try to find out if a property you were interested in buying was priced fairly by averaging all the property sales in the country? No, you look for &quot;comparables&quot; preferably in the same neighborhood, of the same type (residential vs. commercial, single family vs. condo, etc), with a similar number of bedrooms/baths, square footage, etc. You then evaluate how the costs compare based on the features (full finished basement, three car garage, pool, etc), condition (upgraded kitchen, new roof, etc), location (quiet non-busy street, good school district, near shopping or public transit, etc) and any other important aspects of the properties before making your best judgement on how the prices compare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does a quantitative study that takes place in New York city providing the average cost of an apartment as $X help if you are looking for an apartment in Chicago? Neither would a study averaging security models of all companies help your company.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-03-25T23:04:44.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29033" PostTypeId="2" ParentId="18526" CreationDate="2016-03-26T01:33:50.933" Score="0" Body="&lt;p&gt;I would assume that the &quot;IP Address WAN&quot; is the IP that should be used on the outside port of your router. The &quot;LAN&quot; block will then be routed to that IP with the assumption that your router will pick it up and forward it to the LAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Theres a couple of ways you could handle this, you could set up your router to have two subnets on the LAN, the public block your ISP has given you and a private block. The router would then be configured to do NAT for traffic between the private subnet and the internet while leaving traffic to/from the public subnet and traffic between the two lan subnets un-natted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option may be to have a single private subnet on the LAN and use explict NAT rules to map the additional public IPs to particular private IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whichever option you go for your router needs to be flexible enough to support it. If you have bought a typical home router it may well not have the options you need. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-03-26T01:33:50.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29034" PostTypeId="1" CreationDate="2016-03-26T03:18:29.623" Score="1" ViewCount="331" Body="&lt;p&gt;I have 2 sheds basically, one shed has a router (used as bridge) and a time clock.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The time clock will be fine in the summer but in the winter I think I need some kind of insulation to protect it. (maybe sticky on 1 side?) they are not cheap devices. &#xA;The router used as a bridge needs both insulation and a fan for cooling I'm guessing. I plan on building a box with vents and wiring in a little fan but I'm not sure of which insulation to use? or heat supply to use. (at night when the temps drop the device will not be in use and will have no heat source of it's own.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other shed has a camera systems dvr. Ill put a little fan in and some vents                                               also there are lots of wires and self-made heat, but I should probably line the box in some kind of insulation for the really cold nights?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts or idea's would be greatly appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a perfect situation I would purchase the best outdoor wifi-extender or router and remove the DVR and place all 20 camera's on the cloud. Unfortunately my client does not want to spend the money for good equipment nor does he want to run heat in the 2 buildings all winter long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;crazy-mess of things&quot;     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;where clients end up with NO previous IT support&lt;/p&gt;&#xA;" OwnerUserId="24022" LastActivityDate="2016-03-27T15:35:16.420" Title="I would like to insulate for winter and allow cooling in the summer for some equipment that is in a building with no heat or AC" Tags="|router|wireless|environmental-monitoring|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29035" PostTypeId="2" ParentId="29016" CreationDate="2016-03-26T06:07:50.043" Score="1" Body="&lt;p&gt;as Ron mentioned before there is no common network between  your routers and every single interface is on a separate network and the reason is that the wild card mask that you have configured on each of these interfaces which give you the option to have interfaces on the same network only using the 1st octet (.255) 2nd octet (.1)cannot be changed.&#xA;You can fix that by using a different wild card mask such 0.0.8.255 and here the ping can work and all your interfaces will be on the same network but you will be losing the benefit of the router which is separating between 2 different networks &#xA;Better practice is to change the IP addresses on the interfaces and have both of the connected interfaces to be on the same network.&lt;/p&gt;&#xA;" OwnerUserId="23982" LastActivityDate="2016-03-26T06:07:50.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29036" PostTypeId="1" CreationDate="2016-03-26T06:44:57.313" Score="1" ViewCount="240" Body="&lt;p&gt;i am trying to backup my checkpoint using putty pscp with the cmd:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;pscp -r admin@&amp;lt;ip address&amp;gt;:/var/log/CPbackup/backups/R77/&amp;lt;file_name.tgz&amp;gt; D:\test_location_on_windows&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get the error:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Protocol error: Illegal file descriptor format&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried looking around google for this, really couldn't find much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate any help.&lt;/p&gt;&#xA;" OwnerUserId="15569" LastActivityDate="2016-03-26T06:44:57.313" Title="Putty pscp Illegal file descriptor format error" Tags="|checkpoint|" AnswerCount="0" CommentCount="2" ClosedDate="2016-03-26T09:42:07.537" ContentLicense="CC BY-SA 3.0" />
  <row Id="29037" PostTypeId="1" AcceptedAnswerId="29039" CreationDate="2016-03-26T08:21:49.337" Score="1" ViewCount="193" Body="&lt;p&gt;I have a question, and I have some confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to create subnets for six different teams. All IP addresses should start with 172.168.1.x only.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Team 1 -&amp;gt; 5 Hosts&#xA;Team 2 -&amp;gt; 16 Hosts&#xA;Team 3 -&amp;gt; 13 Hosts&#xA;Team 4 -&amp;gt; 37 Hosts&#xA;Team 5 -&amp;gt; 65 Hosts&#xA;Team 6 -&amp;gt; 12 Hosts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like it is not possible. I think I have to reduce the host count from some team.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone can help?&lt;/p&gt;&#xA;" OwnerUserId="17052" LastEditorUserId="8499" LastEditDate="2016-03-26T18:46:03.390" LastActivityDate="2016-03-26T18:46:03.390" Title="Subnet creation exceeding number of hosts" Tags="|ipv4|subnet|ip|" AnswerCount="1" CommentCount="1" ClosedDate="2019-03-18T00:18:49.520" ContentLicense="CC BY-SA 3.0" />
  <row Id="29038" PostTypeId="2" ParentId="29016" CreationDate="2016-03-26T08:50:52.407" Score="6" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/KuJJQ.png&quot; alt=&quot;working ospf drawing&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I imagine your setup to be something like this)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your OSPF adjacency is not coming up because the IP addresses on the facing interfaces between R1 and R2 are not in the same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As soon as you use two IP addresses that are in the same subnet (as in the drawing above), you will have IP connectivity between R1 and R2, and your OSPF adjacency can be established :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router R1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet0/0&#xA; ip address 72.40.42.1 255.255.254.0&#xA; duplex full&#xA; speed 1000&#xA; media-type gbic&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet1/0&#xA; ip address 72.40.40.1 255.255.254.0&#xA; negotiation auto&#xA;!&#xA;&amp;lt;...&amp;gt;&#xA;!&#xA;router ospf 1&#xA; router-id 1.1.1.1&#xA; network 72.40.40.0 0.0.1.255 area 0&#xA; network 72.40.42.0 0.0.1.255 area 0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router R2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface GigabitEthernet0/0&#xA; ip address 72.40.43.1 255.255.254.0&#xA; duplex full&#xA; speed 1000&#xA; media-type gbic&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet1/0&#xA; ip address 72.40.46.1 255.255.254.0&#xA; negotiation auto&#xA;!&#xA;&amp;lt;...&amp;gt;&#xA;!&#xA;router ospf 1&#xA; router-id 2.2.2.2&#xA; network 72.40.42.0 0.0.1.255 area 0&#xA; network 72.40.46.0 0.0.1.255 area 0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Please note that 72.40.42.1/23 and 72.40.43.1/23 are in the same subnet) &amp;lt;&amp;lt; as pointed out above, this is the crucial point&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your OSPF comes up now :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh ip ospf nei&#xA;&#xA;Neighbor ID     Pri   State           Dead Time   Address         Interface&#xA;2.2.2.2           1   FULL/DR         00:00:38    72.40.43.1      GigabitEthernet0/0&#xA;R1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sh ip ospf nei&#xA;&#xA;Neighbor ID     Pri   State           Dead Time   Address         Interface&#xA;1.1.1.1           1   FULL/BDR        00:00:37    72.40.42.1      GigabitEthernet0/0&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you are able to check the reachability of the OSPF-learned network by pinging :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#ping 72.40.40.1&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 72.40.40.1, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 20/32/48 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The crucial point is that the IP addresses on the link between R1 and R2 have to be in the same subnet (or you need to configure static routes or other less elegant tricks).&#xA;Otherwise, R1 will have no way to know how to reach R2, and vice-versa.&lt;/p&gt;&#xA;" OwnerUserId="22215" LastEditorUserId="22215" LastEditDate="2016-03-26T08:56:09.763" LastActivityDate="2016-03-26T08:56:09.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29039" PostTypeId="2" ParentId="29037" CreationDate="2016-03-26T08:54:33.037" Score="6" Body="&lt;p&gt;In other words you have a /24 network that you want to divide in 6 networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's reorder the teams by size:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Team 5 : 65 hosts  &#xA;Team 4 : 32 hosts  &#xA;Team 2 : 16 hosts  &#xA;Team 3 : 13 hosts  &#xA;Team 6 : 12 hosts  &#xA;Team 1 : 5 hosts&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and compare them with subnet sizes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A /24 network comprise 256 addresses from which you must remove the network, broadcast and gateway addresses leaving 253 addresses for hosts.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/25 : 125 hosts  &#xA;/26 :  61 hosts  &#xA;/27 :  29 hosts  &#xA;/28 :  13 hosts  &#xA;/29 :   5 hosts &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So we see that we need at a minimum:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Team 5 : 65 hosts -&amp;gt; /25  &#xA;Team 4 : 32 hosts -&amp;gt; /26  &#xA;Team 2 : 16 hosts -&amp;gt; /27  &#xA;Team 3 : 13 hosts -&amp;gt; /28  &#xA;Team 6 : 12 hosts -&amp;gt; /28  &#xA;Team 1 :  5 hosts -&amp;gt; /29  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Can we divide a /24 network to fit all those networks in ?&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;A way to look at it would be:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Divide the /24 in two /25 networks.&lt;br&gt;&#xA;The first /25 is assigned to &lt;code&gt;Team5&lt;/code&gt;, the second /25 is further sub-netted.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Divide the second /25 in two /26 networks.&lt;br&gt;&#xA;The first /26 is assigned to &lt;code&gt;Team4&lt;/code&gt;, the second is further sub-netted.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Divide the second /26 in two /27 networks.&lt;br&gt;&#xA;The first /27 is assigned to &lt;code&gt;Team2&lt;/code&gt;, the second is further sub-netted.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Divide the second /27 in two /28 networks.&lt;br&gt;&#xA;the two /28 are assigned to &lt;code&gt;Team3&lt;/code&gt; and &lt;code&gt;Team6&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Nothing left for &lt;code&gt;Team1&lt;/code&gt;... ...too bad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could for example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Group Team 1 with another team (so both team will use the same&#xA;network).  &lt;/li&gt;&#xA;&lt;li&gt;User for another team 2 networks, i.e.:&lt;br&gt;&#xA;Separate the the first /25 that was assigned to Team 5 in two /26 networks.&lt;br&gt;&#xA;Assign the first one to the first 63 hosts of Team5.&lt;br&gt;&#xA;Subnet the second one in four /28 networks&lt;br&gt;&#xA;Assign the first /28 to the other members of Team 5, the second one to team 1 and you have two /28 available.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-03-26T16:42:13.107" LastActivityDate="2016-03-26T16:42:13.107" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29040" PostTypeId="2" ParentId="28970" CreationDate="2016-03-26T11:36:29.510" Score="-1" Body="&lt;p&gt;Try to put interface xe-1/0/21 in trunk mode instead of access. I recall by experience on MX platform that I had to set a similar option on mirror port while doing layer2 mirroring for the packets to keep the tag. So maybe the same trick will do the job on EX.  I didnt find documentation on this though. &lt;/p&gt;&#xA;" OwnerUserId="15900" LastEditorUserId="-1" LastEditDate="2016-03-26T19:20:39.230" LastActivityDate="2016-03-26T19:20:39.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29043" PostTypeId="2" ParentId="259" CreationDate="2016-03-26T14:31:41.007" Score="1" Body="&lt;p&gt;While IPv4 addresses are no longer being given out like candy that doesn't mean it's nessacery or practical to get rid of IPv4 completely in the near future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turning up ipv6 is a good first step &lt;a href=&quot;https://networkengineering.stackexchange.com/a/261/20201&quot;&gt;https://networkengineering.stackexchange.com/a/261/20201&lt;/a&gt; does a good job of covering that. This lets you interact with v6 only devices on the internet, it reduces the load on your NATs and therefore reduces the number of external IPs/Ports needed to serve those NATs. With big services like google and facebook supporting IPv6 it is likely a significant proportion of internet traffic will move over (i've seen figures as high as 70% ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next question you need to ask yourself is whether your organisation is big enough to be at risk of running out of &lt;em&gt;private&lt;/em&gt; IPv4. For the vast majority of organsiations the answer will be no. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the answer is no I see little reason to remove private IPv4 from existing deployments in the near future. Getting rid of private IPv4 may simplify administration a bit in the long term but in the short term it's going to bring a lot of extra breakage for little gain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are running out of public v4 the next step would be to audit your public v4 usage. Look for wasted public v4 addresses that could be freed up by changing subnetting. Look for systems that could migrate from public ipv4 to ipv6 or private ipv4. Consider schemes like load balancers and DNAT which can apply a small pool of public V4 addresses to precisely where they are needed and in some cases share a public v4 address among multiple services. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider deploying a NAT64/DNS64 gateway so that new systems can be made v6 only and still have access to resources on the ipv4 internet. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-03-26T14:31:41.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29044" PostTypeId="1" CreationDate="2016-03-26T14:53:21.940" Score="1" ViewCount="2065" Body="&lt;p&gt;I have been learning how internet data travels in different kind of Broadband access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In case of telephone broadband, voice signals travels through the telephone line. At the user premise, the modem coverts the voice signals into digital information. The Fiber Optic medium transfers light pulses. Now, here are few questions in my mind after learning that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(1) If the telephone infrastructure is migrated from copper wires to the Fiber Optic cables, then how the data transmission will take place ? Because, the Fiber Optic medium transfers light pulses&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2) Will I need a different kind of MODEM if I migrate my internet connection from ADSL broadband to Fiber Optic access ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(3) In case of Television cable internet, what kind of signals travels through the cable ? And what makes Cable internet faster than ADSL ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in Advance !!!&lt;/p&gt;&#xA;" OwnerUserId="24027" LastActivityDate="2016-03-26T23:56:15.987" Title="In Fiber Optic Telephone line, how light signals are converted to the voice signals?" Tags="|internet|fiber|cable|adsl|" AnswerCount="2" CommentCount="1" ClosedDate="2016-03-27T08:07:18.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="29045" PostTypeId="2" ParentId="29034" CreationDate="2016-03-26T15:55:58.880" Score="2" Body="&lt;p&gt;This seems &lt;em&gt;very&lt;/em&gt; tenuous as far as being on topic. However.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply build or buy a very well insulated box (rack case), and provide vents that can be opened, or closed, depending on temperatures inside and out - assist with fans as required. If the router is on all night and makes heat, sufficient insulation will be all that's required. Otherwise a basic ceramic heater and a thermostat. Be sure to check the devices specified operating temperature range, so that you are not heating the enclosure beyond what the device actually requires - many things are quite happy to be quite cold, so long as moisture is kept out of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What type of insulation really does not matter - whatever is easy. Foam sheets, loose cellulose and a frame/box to contain it, etc. If you have a wifi antenna inside the box, don't use foil-faced insulation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, take the thoroughly professional approach of dropping the cheapskate client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit, add:&lt;/strong&gt; On the hot side, it will cost much less to run an air conditioner that cools the well-insulated box than to run one to cool a whole building, if it gets too hot for just fans to be effective.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2016-03-27T15:35:16.420" LastActivityDate="2016-03-27T15:35:16.420" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29049" PostTypeId="2" ParentId="29007" CreationDate="2016-03-26T19:54:24.287" Score="1" Body="&lt;p&gt;Nope. They don't match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Decimal IP notation is just an easier way to represent a binary IP. You can change a decimal IP to a binary IP and back, but there is no other way for them to magically convert to other numbers.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.google.com/search?q=how%20to%20convert%20decimal%20IP%20to%20binary&amp;amp;ie=utf-8&amp;amp;oe=utf-8&quot; rel=&quot;nofollow&quot;&gt;To convert a decimal IP to binary&lt;/a&gt;, we split up the four octets, and convert each decimal number to its binary representation.&lt;br&gt;&#xA;So for your IP, 83.226.175.75:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;83 → 01010011&lt;/li&gt;&#xA;&lt;li&gt;226 → 11100010&lt;/li&gt;&#xA;&lt;li&gt;175 → 10101111&lt;/li&gt;&#xA;&lt;li&gt;75 → 01001011&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Put them all back together, and your binary IP is 01010011111000101010111101001011. Notice that's a totally different binary number than what you've got. In particular, it's much shorter.&lt;br&gt;&#xA;(And it's not contained anywhere within your binary number.)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To convert from binary to decimal, we do the opposite (which you started): break it into 8-bit chunks and convert each one to its decimal representation.&lt;br&gt;&#xA;If we try to convert your binary number to a decimal IP, we get this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;00110111 → 55&lt;/li&gt;&#xA;&lt;li&gt;00110100 → 52&lt;/li&gt;&#xA;&lt;li&gt;01110101 → 117&lt;/li&gt;&#xA;&lt;li&gt;00110000 → 48&lt;/li&gt;&#xA;&lt;li&gt;01000100 → 68&lt;/li&gt;&#xA;&lt;li&gt;01101011 → 107&lt;/li&gt;&#xA;&lt;li&gt;01101010 → 106&lt;/li&gt;&#xA;&lt;li&gt;00110010 → 50&lt;/li&gt;&#xA;&lt;li&gt;01010001 → 81&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If we put those decimal numbers together like an IP, it would be 55.52.117.48.68.107.106.50.81. That's clearly not an IP. It could be two IPs, smushed together, plus an extra octet, but that's not something I'd expect to encounter in networking.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Perhaps if you tell us where that string came from, somebody can give you a better idea what it means&lt;/p&gt;&#xA;" OwnerUserId="23971" LastEditorUserId="23971" LastEditDate="2016-03-26T20:09:17.080" LastActivityDate="2016-03-26T20:09:17.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29050" PostTypeId="2" ParentId="29044" CreationDate="2016-03-26T20:39:59.827" Score="2" Body="&lt;p&gt;I'll answer your heading question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two ways that voice can be carried over fiber lines: analog and digital.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an analog system, voice can be carried over a fiber line by modulating an LED (light emitting diode) with a microphone and associated circuitry. The circuitry modulates the light signal by varying the power to the LED based on the frequency and strength of the sound wave that is picked up by the microphone. So the light traveling through the the fiber cable has the same characteristics as the sound wave. Then on the other end it is converted back into an electric wave and then sound wave by a phototransistor and speaker, respectively (and associated circuitry).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a digital system, the microphone feeds an ADC (analog to digital converter), which converts the electric signal into raw digital data numbered levels called a &quot;bitstream&quot; that represents the analog sound wave. The ADC (usually) then feeds an audio coder, which converts the digital bitstream into a codec format that can be packaged into &quot;blocks&quot; of sound data suitable for being sent as &quot;packets&quot; or &quot;cells&quot; over a network infrastructure like the Internet or a private phone company network. The audio coder puts out a coded bitstream that will then be sent to an LED that will be modulated to be &quot;on&quot; or &quot;off&quot; based on the 1's and 0's in the bitstream. This digital signal goes through the fiber line to the other end (through the voice network controlled by the phone company) where it is received and converted back into electrical pulses by a phototransistor, then fed into a audio codec decoder, then into a DAC (digital to analog converter), which feeds a speaker that converts the analog electrical wave from the DAC into a sound wave that moves the air. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is grossly oversimplified of course, but it's basically how it works. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pretty much any signal that you can send over a wire can be converted into light by modulation of an LED (or other light source) and then sent over a fiber line. Then it is converted back into an electrical signal on the other end by a phototransistor.&lt;/p&gt;&#xA;" OwnerUserId="22067" LastActivityDate="2016-03-26T20:39:59.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29051" PostTypeId="2" ParentId="29044" CreationDate="2016-03-26T23:37:28.887" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In case of telephone broadband, voice signals travels through the telephone line. At the user premise, the modem coverts the voice signals into digital information.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A dialup modem converts between digital signals and analog signals in the voice-band hence why you couldn't use your phone at the same time as your dialup modem..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A DSL modem is generally designed to avoid the voice band. It uses higher frequency signals, filters are used to prevent these high frequency signals reaching the voice equipment allowing voice and DSL to coexist on the same line at the same time.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(1) If the telephone infrastructure is migrated from copper wires to the Fiber Optic cables, then how the data transmission will take place ? Because, the Fiber Optic medium transfers light pulses&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Analog voice over fiber is possible in theory but i've never heard of any provider doing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If voice is sent over fiber then generaly it will be digitised first. Then the digital data streams will be merged in some way (there are MANY different ways of doing this) and sent down the fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The core of the phone network has been mostly digital for many years. It's much easier to merge, split and switch digital data streams without causing quality problems than it is analog voice signals.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(2) Will I need a different kind of MODEM if I migrate my internet connection from ADSL broadband to Fiber Optic access ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Terminology varies a bit depending on the exact type of fiber access you are talking about and what exactly you are connecting to it. Devices for GPON seem to be reffered to as &quot;modems&quot;, while devices for dedicated fiber tend to be reffered to as &quot;transcivers&quot; or &quot;media converters&quot; but yes you will need a device to convert from the signals used on the long distance fibers and that device will be different from your DSL modem.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;(3) In case of Television cable internet, what kind of signals travels through the cable ? And what makes Cable internet faster than ADSL ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With both DSL and cable the data signals are modulated onto high frequency carriers. The exact modulation schemes are different to suit the different types of cable and to allow coexistance with other services on those cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main reason cable internet is faster is because cable TV cable has better performance (that is it degrades the signals less) at high frequencies than phone pairs do. Phone pairs were designed for analog voice at up to a few kHz and their high frequency performance is pretty poor. Frankly it's amazing that DSL works as well as it does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the downside Cable internet has to share the cable with cable TV services which take up a lot more bandwidth than voice does. Cable TV cables are also a shared medium which can lead to congestion problems. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-03-26T23:56:15.987" LastActivityDate="2016-03-26T23:56:15.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29053" PostTypeId="2" ParentId="19503" CreationDate="2016-03-27T02:00:28.810" Score="2" Body="&lt;p&gt;I had to make a similar change recently. I needed to add two additional subnets. Though I used CLI rather than ASDM. With version 9.1, I created some new objects for the subnets and then it was just a matter of adding the additional subnets to the split-tunnel ACL (if used) as well as adding additional NAT rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network {REMOTE_VPN_USER_SUBNET}&#xA; subnet 10.0.1.0 255.255.255.0&#xA;object network {EXISTING_VPN_ACCESSIBLE_SUBNET_1}&#xA; subnet 10.0.2.0 255.255.255.0&#xA;object network {NEW_VPN_ACCESSIBLE_SUBNET_2}&#xA; subnet 10.0.3.0 255.255.254.0&#xA;object network {NEW_VPN_ACCESSIBLE_SUBNET_3}&#xA; subnet 10.0.4.0 255.255.255.0&#xA;&#xA;split-tunnel-network-list value {YOUR_SPLIT-TUNNEL_LIST}&#xA;access-list {YOUR_SPLIT-TUNNEL_LIST} standard permit 10.0.1.0 255.255.255.0 &#xA;access-list {YOUR_SPLIT-TUNNEL_LIST} standard permit 10.0.2.0 255.255.255.0 &#xA;access-list {YOUR_SPLIT-TUNNEL_LIST} standard permit 10.0.3.0 255.255.255.0 &#xA;&#xA;nat (RELEVANT_INTERFACE_OR_VLAN_NAME,outside) source static {EXISTING_VPN_ACCESSIBLE_SUBNET_1} {EXISTING_VPN_ACCESSIBLE_SUBNET_1} destination static {REMOTE_VPN_USER_SUBNET} {REMOTE_VPN_USER_SUBNET} no-proxy-arp route-lookup&#xA;nat (RELEVANT_INTERFACE_OR_VLAN_NAME,outside) source static {NEW_VPN_ACCESSIBLE_SUBNET_2} {NEW_VPN_ACCESSIBLE_SUBNET_2} destination static {REMOTE_VPN_USER_SUBNET} {REMOTE_VPN_USER_SUBNET} no-proxy-arp route-lookup&#xA;nat (RELEVANT_INTERFACE_OR_VLAN_NAME,outside) source static {NEW_VPN_ACCESSIBLE_SUBNET_3} {NEW_VPN_ACCESSIBLE_SUBNET_3} destination static {REMOTE_VPN_USER_SUBNET} {REMOTE_VPN_USER_SUBNET} no-proxy-arp route-lookup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8218" LastActivityDate="2016-03-27T02:00:28.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29054" PostTypeId="1" AcceptedAnswerId="29061" CreationDate="2016-03-27T04:05:00.523" Score="6" ViewCount="4871" Body="&lt;p&gt;I understand that most &lt;em&gt;ports&lt;/em&gt; that support SFP+ transceivers can step down to allow an SFP to be plugged into it, but my question is around the transceivers/optics themselves. Can an SFP+ &lt;em&gt;transceiver&lt;/em&gt; run at 1GbE, for example a 10GBASE-SR SFP+, or would the only solution be to get an SFP specifically? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is that, SFP+ transceivers should be used for 10GbE and SFP for 1GbE and this lack of backward compatibility is one of the few reasons 10GBASE-T is appealing (due to auto-negotiation). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt; - It appears that there are some dual-rate optics out there. Link to Finisar's offering: &lt;a href=&quot;https://www.finisar.com/sites/default/files/downloads/finisar-ftlx8574d3bcv-1g-10g-850nm-multimode-datacom-sfp-transceiver-product-specification-revb.pdf&quot; rel=&quot;noreferrer&quot;&gt;https://www.finisar.com/sites/default/files/downloads/finisar-ftlx8574d3bcv-1g-10g-850nm-multimode-datacom-sfp-transceiver-product-specification-revb.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19636" LastEditorUserId="19636" LastEditDate="2016-08-04T19:47:47.747" LastActivityDate="2019-01-09T11:54:42.133" Title="SFP+ transceiver's ability to do 1GbE" Tags="|ethernet|sfp|optics|10gbase|layer1|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29056" PostTypeId="2" ParentId="29054" CreationDate="2016-03-27T04:43:44.043" Score="1" Body="&lt;p&gt;The various optical ethernet standards use different wavelengths, light sources, and fiber diameter. Copper-based ethernet sources can change frequencies, and use, relatively, the same medium (Category-6A can run all the current ethernet standards which use UTP). A laser or LED  would need to change the light source, so you just change the SFP/SFP+ module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SFP and SFP+ modules are specific to the standard which they support. For example, even among 1 Gb optics, there are multiple (a half dozen, or so), standards requiring different SFPs, toss in the different 10 Gb SFP+s&#xA;(another half dozen, or so), and you have around a dozen different 1 and 10 Gb optical ethernet standards, most requiring a different transceiver.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-27T18:50:27.820" LastActivityDate="2016-03-27T18:50:27.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29057" PostTypeId="1" CreationDate="2016-03-27T10:07:11.450" Score="2" ViewCount="3511" Body="&lt;p&gt;I've set up an Ubuntu 14.04 virtual machine with two network adapters.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;eth0 (bridged adapter) - 192.168.0.105&lt;/li&gt;&#xA;&lt;li&gt;eth1 (NAT) - 10.0.3.15&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have performed ping commands to ensure everything is fine:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping -I eth0 www.cnn.com&#xA;PING turner.map.fastly.net (185.31.17.73) from 192.168.0.105 eth0: 56(84) bytes of data.&#xA;64 bytes from 185.31.17.73: icmp_seq=1 ttl=55 time=29.6 ms&#xA;&#xA;ping -I eth1 www.cnn.com&#xA;PING turner.map.fastly.net (185.31.17.73) from 10.0.3.15 eth1: 56(84) bytes of data.&#xA;From 10.0.3.15 icmp_seq=1 Destination Host Unreachable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since I would like eth1 to be able to access Internet through the eth0 adapter, I have bridged them based on &lt;a href=&quot;https://wiki.debian.org/BridgeNetworkConnections&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; Debian tutorial.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the command &lt;code&gt;ifconfig&lt;/code&gt; shows me the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;br0 - 10.0.3.16&lt;/li&gt;&#xA;&lt;li&gt;eth0 (bridged adapter) - No IP&lt;/li&gt;&#xA;&lt;li&gt;eth1 (NAT) - No IP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I can ping CNN like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping www.cnn.com&#xA;PING turner.map.fastly.net (23.235.43.73) from 10.0.3.16 br0: 56(84) bytes of data.&#xA;64 bytes from 23.235.43.73: icmp_seq=1 ttl=63 time=26.6 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but can't ping with the individual interfaces anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does it happen? How can I be sure that I can now indeed access the Internet via eth1?&lt;/p&gt;&#xA;" OwnerUserId="23119" LastActivityDate="2016-10-09T12:15:16.453" Title="Why do my network adapters do not show IP addresses when bridged?" Tags="|linux|bridge|" AnswerCount="1" CommentCount="2" ClosedDate="2016-10-09T18:17:47.370" ContentLicense="CC BY-SA 3.0" />
  <row Id="29058" PostTypeId="2" ParentId="19526" CreationDate="2016-03-27T10:24:33.170" Score="1" Body="&lt;p&gt;Based on your comment:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm trying to prevent any routes with a tag of 12000 from being&#xA;  redistributed into the MPLS.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Any routes redistributed into OSPF from EIGRP will be OSPF external routes. It is easy to redistribute only internal routes from OSPF into BGP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA; redistribute ospf 1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can use a route map to match a tag and deny redistribution:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map FROM_OSPF deny 10&#xA; match tag 12000&#xA;route-map FROM_OSPF permit 20&#xA;!&#xA;router bgp 100&#xA; redistribute ospf 1 route-map FROM_OSPF&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can also use a route map to set the routes with the tag to the BGP community &lt;code&gt;no-advertise&lt;/code&gt; and/or &lt;code&gt;no-export&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map FROM_OSPF permit 10&#xA; match tag 12000&#xA; set community no-advertise  no-export&#xA;route-map FROM_OSPF permit 20&#xA;!&#xA;router bgp 100&#xA; redistribute ospf 1 route-map FROM_OSPF&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/49111-route-map-bestp.html#tables&quot; rel=&quot;nofollow noreferrer&quot;&gt;Route-Maps for IP Routing Protocol Redistribution Configuration&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/STCdG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/STCdG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nqXcK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nqXcK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-27T20:03:34.217" LastActivityDate="2016-03-27T20:03:34.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29059" PostTypeId="2" ParentId="29002" CreationDate="2016-03-27T10:31:17.357" Score="1" Body="&lt;p&gt;I read this question as &quot;&lt;em&gt;How will traffic to subnet 10.1.1.0/24 be routed if there is a static route to 10.1.0.0/16 and a more specific BGP-learned route to 10.1.1.0/24 ?&lt;/em&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that case the answer would be : the more specific route will be selected, whatever the difference in administrative distances between the respective protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example : Router junos2 advertises 10.1.1.0/24 to router junos1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router junos1 has a static route to 10.1.0.0/16, discarding traffic to that less-specific prefix :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;junos1 configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@junos1&amp;gt; show configuration | display set&#xA;set interfaces em0 unit 0 family inet address 172.16.100.1/30&#xA;set routing-options static route 10.1.0.0/16 discard&#xA;set protocols bgp local-as 111&#xA;set protocols bgp group AS-222 type external&#xA;set protocols bgp group AS-222 peer-as 222&#xA;set protocols bgp group AS-222 neighbor 172.16.100.2 family inet unicast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router junos1 is receiving the more specific route from neighbour junos2 via BGP :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@junos1&amp;gt;show route receive-protocol bgp 172.16.100.2&#xA;&#xA;inet.0: 4 destinations, 5 routes (4 active, 0 holddown, 0 hidden)&#xA;  Prefix          Nexthop          MED     Lclpref    AS path&#xA;* 10.1.1.0/24             172.16.100.2                            222 I&#xA;  172.16.100.0/30         172.16.100.2                            222 I&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Checking the routing table, we see both routes are installed :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@junos1&amp;gt; show route&#xA;&#xA;inet.0: 4 destinations, 5 routes (4 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.1.0.0/16        *[Static/5] 00:10:58&#xA;                      Discard&#xA;10.1.1.0/24        *[BGP/170] 00:12:01, localpref 100&#xA;                      AS path: 222 I&#xA;                    &amp;gt; to 172.16.100.2 via em0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For addresses within prefix 10.1.1.0/24, the more specific, BGP-learned route is preferred (even with an AD of 170 against 5 for the static route) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@junos1&amp;gt; show route 10.1.1.1&#xA;&#xA;inet.0: 4 destinations, 5 routes (4 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;10.1.1.0/24        *[BGP/170] 00:13:30, localpref 100&#xA;                      AS path: 222 I&#xA;                    &amp;gt; to 172.16.100.2 via em0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which can be demonstrated by pinging 10.1.1.1 - traffic is not being discarded :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;@junos1&amp;gt; ping rapid 10.1.1.1&#xA;PING 10.1.1.1 (10.1.1.1): 56 data bytes&#xA;!!!!!&#xA;--- 10.1.1.1 ping statistics ---&#xA;5 packets transmitted, 5 packets received, 0% packet loss&#xA;round-trip min/avg/max/stddev = 0.410/0.772/1.528/0.391 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22215" LastActivityDate="2016-03-27T10:31:17.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29060" PostTypeId="1" AcceptedAnswerId="29062" CreationDate="2016-03-27T11:36:06.550" Score="1" ViewCount="46" Body="&lt;p&gt;Dont know if its a good practice or not, but is there any portable cheap hardware for simple laser LOS transmission between two APs?&lt;/p&gt;&#xA;" OwnerUserId="20921" LastActivityDate="2016-03-27T12:28:07.317" Title="Any laser transmission solution for WLAN" Tags="|wireless|switching|" AnswerCount="1" CommentCount="1" ClosedDate="2016-03-28T08:47:52.110" ContentLicense="CC BY-SA 3.0" />
  <row Id="29061" PostTypeId="2" ParentId="29054" CreationDate="2016-03-27T12:20:28.510" Score="10" Body="&lt;p&gt;Short answer: in theory yes, in practice no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long answer:&#xA;There are SFP+ optics which can also work at 1 GbE, I've talked (sorry, no other source than that) to people who were experimenting with it and were able to get it running. Unfortunately it is highly dependable on the device you plug the optics in, i.e. not every device in the test was able to tell the transceiver to step down to 1 GbE.&lt;/p&gt;&#xA;" OwnerUserId="550" LastActivityDate="2016-03-27T12:20:28.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29062" PostTypeId="2" ParentId="29060" CreationDate="2016-03-27T12:28:07.317" Score="1" Body="&lt;p&gt;The term for such equipment is &quot;free space optical&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately it's not cheap.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-03-27T12:28:07.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29063" PostTypeId="1" AcceptedAnswerId="29070" CreationDate="2016-03-27T13:38:07.240" Score="18" ViewCount="29717" Body="&lt;p&gt;Can my MAC address be identified by a web site when I access the site?&#xA;Does it make a difference if the site requires me to upload files?&lt;/p&gt;&#xA;" OwnerUserId="24045" LastEditorUserId="8499" LastEditDate="2016-03-27T20:08:19.413" LastActivityDate="2016-03-27T21:12:39.257" Title="Can my MAC address be identified by a web site?" Tags="|mac-address|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29064" PostTypeId="2" ParentId="29005" CreationDate="2016-03-27T15:41:33.750" Score="3" Body="&lt;p&gt;Encode the telephone signal, assign it to a VLAN, send it across with the rest of the data, as data, pick off the VLAN, decode the signal. Any other route is madness. (If doing POTS at all. VoIP obviously solves it at a higher level.)&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-03-27T15:41:33.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29065" PostTypeId="1" CreationDate="2016-03-27T16:17:14.433" Score="1" ViewCount="459" Body="&lt;p&gt;I noticed (based on activity lights) that VLAN traffic between two switch ports are being sent to many switch ports. Heres my scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port 1 is a &quot;mode access&quot; switchport for VLAN 100 (untagged 100).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port 2 is a &quot;mode access&quot; switchport for VLAN 101 (untagged 101).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port 5 is a trunk for VLAN 100 and VLAN 101 (tagged 100, tagged 101).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the host on Port 1 talking to the host on Port 2. When they are talking to each other (Unicast), I see port 1, 2, and 5 light up, indicating that its also sending the unicast traffic to port 5. Why is it sending traffic to port 5 when the switch is fully capable of figuring out that the hosts are on Port 1 and Port 2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding in the past with switches is that it builds a CAM table of mac addresses it sees on ports. It's CAM table should tell the switch that the source and destination hosts are on Ports 1 and 2. Theres no reason it should also go to 5 since there is no host there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 100&#xA; ip address dhcp&#xA;!&#xA;interface vlan 101&#xA;!&#xA;interface ge1&#xA; switchport mode access&#xA; switchport access vlan 100&#xA;!&#xA;interface ge2&#xA; switchport mode access&#xA; switchport access vlan 101&#xA;!&#xA;interface ge5&#xA; switchport trunk allowed vlan add 100,101&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24048" LastEditorUserId="24048" LastEditDate="2016-03-27T17:50:35.427" LastActivityDate="2016-03-28T06:30:19.510" Title="VLAN Traffic being sent to many ports" Tags="|cisco|switch|vlan|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29067" PostTypeId="2" ParentId="29065" CreationDate="2016-03-27T16:47:44.387" Score="0" Body="&lt;p&gt;The traffic you see on port 5, is most likely just broadcast traffic, like ARP, generated from the clients. &#xA;The CAM table only function as a port &amp;lt;-&gt; MAC address mapper, so the switch knows where to send the frames.&#xA;I would advise you, to do a packet capture, if you are suspects anything unusual.&lt;/p&gt;&#xA;" OwnerUserId="13421" LastActivityDate="2016-03-27T16:47:44.387" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29068" PostTypeId="2" ParentId="29063" CreationDate="2016-03-27T16:53:23.933" Score="16" Body="&lt;p&gt;No, a remote site will only learn what public IP address you're using, not the MAC address of your device, &lt;em&gt;unless&lt;/em&gt; you're using IPv6 with a &lt;a href=&quot;https://en.wikipedia.org/wiki/IPv6_address#Modified_EUI-64&quot;&gt;EUI-64 address&lt;/a&gt;. In that case, your MAC address could be derived from the IPv6 address.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-03-27T16:53:23.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29069" PostTypeId="2" ParentId="29063" CreationDate="2016-03-27T19:50:19.293" Score="3" Body="&lt;p&gt;You should study the &lt;a href=&quot;https://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow&quot;&gt;OSI Model&lt;/a&gt;. MAC addresses are layer-2 addresses in a frame, but frames are stripped off at a router. IP addresses are layer-3 addresses in the packet. Only packets will cross a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hosts and switches use MAC addresses in the frames to deliver frames to the correct host (including a gateway, which is just another host on layer-2) on a LAN. When a gateway (router) gets the frame from a host, it strips off the frame header to get to the packet, and it routes the packet based on the IP address. When the router sends the packet out the new interface, it will create a new frame encapsulation for the new link, using its own MAC address for the new frame. As a packet moves from router-to-router to its final destination, the only surviving source MAC address will be that of the final router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-27T19:50:19.293" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="29070" PostTypeId="2" ParentId="29063" CreationDate="2016-03-27T21:12:39.257" Score="21" Body="&lt;p&gt;In general it is not possible for a web site that you access to learn your MAC address. However there are special cases where the server could learn your MAC address:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;IPv6 supports assigning addresses in a way which embed the MAC address in the IP address. For privacy reasons this way of assigning IPv6 addresses is not very common.&lt;/li&gt;&#xA;&lt;li&gt;If you are directly attached to the same network segment as the web server, it will be able to see your MAC address. (But this is probably not the scenario you had in mind.)&lt;/li&gt;&#xA;&lt;li&gt;I have seen some ISPs embed the MAC address of the customer's equipment in reverse DNS records (the format was &lt;code&gt;x1-6-&lt;/code&gt; followed by the MAC address).&lt;/li&gt;&#xA;&lt;li&gt;There might be scripting capabilities in the browser which would allow scripts to learn the MAC address of the client machine and send it to the server. I do not know whether javascript can acquire the MAC address of the client machine, but I know that it can find the &lt;a href=&quot;https://security.stackexchange.com/q/94783/47143&quot;&gt;local IP&lt;/a&gt; address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="5842" LastEditorUserId="-1" LastEditDate="2017-03-17T13:14:44.993" LastActivityDate="2016-03-27T21:12:39.257" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29072" PostTypeId="1" CreationDate="2016-03-27T23:53:17.383" Score="3" ViewCount="225" Body="&lt;p&gt;I am Computer and Communication Engineer, and I read many books about data communication and networking, all discussing basic concepts like OSI &#xA;Model, topology in general, multiplexing, etc., but I still have a question which cable type is used with each topology. That's a general question. To be specific:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Do I need to read TIA-568 to know cable types and attenuation versus&#xA;distance and Frequency?&lt;/li&gt;&#xA;&lt;li&gt;Do I need to purchase IEEE 802 to know the details of what actually&#xA;happens in the lower layers? Will that be a benefit?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Otherwise, which Documents or standards do I still need? Should I know how each layer in the OSI Model Works?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am asking these questions because I am not sure what should I do to have practical experience in addition to general concepts (above mentioned) in books.&lt;/p&gt;&#xA;" OwnerUserId="24055" LastEditorUserId="8499" LastEditDate="2020-12-19T20:05:02.853" LastActivityDate="2020-12-19T20:05:02.853" Title="Do I need to read standards to understand how networks work?" Tags="|osi|rfc|standardisation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="29073" PostTypeId="2" ParentId="29072" CreationDate="2016-03-28T00:40:40.257" Score="4" Body="&lt;p&gt;It is a very good idea to have a general understanding of everything you can get your hands on, but what you really need to be an expert in depends on the job.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I used to be heavily involved in designing and overseeing cable&#xA;plant implementations, and I studied and earned the RCDD (Registered&#xA;Communications Distribution Designer) and the RCDD/NTS (Network&#xA;Transport Systems) certifications (both require at least two years&#xA;of experience and strong references, so they are not just paper&#xA;certifications), but I haven't worked on cabling itself for a long&#xA;time. On the other hand, if you need to order transceiver modules&#xA;for your equipment, it is quite helpful to know about different&#xA;cable media, and which standards apply to each.&lt;/li&gt;&#xA;&lt;li&gt;You should clearly understand the most common IEEE 802 standards (you can get most for free),&#xA;although it is unlikely that you will need to know much about Token&#xA;Bus, Token Ring, FDDI, etc. You will need to be able to troubleshoot&#xA;things, and if you don't understand how this stuff works, you are at&#xA;a big disadvantage.&lt;/li&gt;&#xA;&lt;li&gt;Understanding the way ethernet, IP (both IPv4 and IPv6), TCP, UDP,&#xA;switching (including the related 802 standards for thing like&#xA;VLANs), routing (especially OSPF and BGP) all work are the absolute minimums.&#xA;You should be familiar with the ethernet, IP (both IPv4 and IPv6),&#xA;and transport (TCP and UDP) header fields, and the functions of each&#xA;field. Depending on the job, you may need more specialized&#xA;knowledge, like the various Wi-Fi (802.11) standards and headers,&#xA;firewall technologies, data center technologies, etc.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-28T01:10:57.087" LastActivityDate="2016-03-28T01:10:57.087" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="29074" PostTypeId="2" ParentId="29065" CreationDate="2016-03-28T04:42:40.717" Score="2" Body="&lt;p&gt;VLANs create isolated segments. The only way anything on port 1 (vlan 100) can talk to anything on port 2 (vlan 101) is for something in both VLANs (&lt;em&gt;port 5&lt;/em&gt;) to pass the traffic along. I'll go out on a (very short) limb and say there's a router on port 5 that's handling inter-vlan traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(note: the switch has a dynamic address on vlan 100 and no address on vlan 101, so it isn't the router)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-03-28T04:42:40.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29075" PostTypeId="2" ParentId="29054" CreationDate="2016-03-28T04:59:08.520" Score="1" Body="&lt;p&gt;It depends on the transceiver and the device to which it's attached. (for the record, one can run a 1000Mbps SFP down to 10Mbps, not that anyone actually &lt;em&gt;does&lt;/em&gt;) You'll have to check the specifications of &lt;em&gt;both&lt;/em&gt; to know if it can work. If it does, it's unlikely to be able to auto-sense which speed to run.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-03-28T04:59:08.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29076" PostTypeId="2" ParentId="29065" CreationDate="2016-03-28T06:30:19.510" Score="3" Body="&lt;p&gt;&lt;em&gt;Why is [the switch] sending traffic to port 5 when the switch is fully capable of figuring out that the hosts are on Port 1 and Port 2?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch is &lt;strong&gt;not&lt;/strong&gt; capable of figuring out that hosts in two different vlans are communicating with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only a device such as a router is capable of routing traffic between two vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, you probably have a configuration called &quot;&lt;a href=&quot;http://blog.alwaysthenetwork.com/tutorials/router-on-a-stick-tutorial/&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;router on a stick&quot;&gt;router on a stick&lt;/a&gt;&quot; :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sxtzB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sxtzB.png&quot; alt=&quot;router on a stick illustration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way for two hosts in two different vlans to communicate with each other is via the router, over a &lt;strong&gt;trunk&lt;/strong&gt; (connection carrying several different vlans) which in your case seems to be connected to port 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All traffic from the host on port 1 to the host on port 2 is initially tagged with vlan 100, leaves the switch via port 5, out to the router where it gets vlan 101 assigned to it, then goes back to the switch and only then it can leave port 2. And vice versa.&lt;/p&gt;&#xA;" OwnerUserId="22215" LastActivityDate="2016-03-28T06:30:19.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29077" PostTypeId="2" ParentId="10593" CreationDate="2016-03-28T07:29:00.400" Score="-1" Body="&lt;pre&gt;&lt;code&gt;set protocols static route 192.168.1.0/24 next-hop 10.100.0.204 distance 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24060" LastEditorUserId="509" LastEditDate="2016-03-28T08:32:11.587" LastActivityDate="2016-03-28T08:32:11.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29079" PostTypeId="2" ParentId="12626" CreationDate="2016-03-28T12:20:43.877" Score="1" Body="&lt;p&gt;The MAC or repeater (hub) is is notified of a collision by the PHY&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a MAC is informed of a collision it goes through the collision detected procedure (random backoff).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a repeater (hub) is informed of a collision it generates a &quot;JAM signal&quot; on all ports to ensure that the collision is detected by the MACs that sent the colliding frames and that other hosts correctly detect the line as busy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How the phy detects the collision is media type specific. For coaxial ethernet it is based on the DC voltage on the coax &lt;a href=&quot;https://books.google.co.uk/books?id=MRChaUQr0Q0C&amp;amp;pg=PA54&amp;amp;lpg=PA54&amp;amp;dq=coaxial+ethernet+collision+detection&amp;amp;source=bl&amp;amp;ots=oGaQGcNnkN&amp;amp;sig=OayChWr1zEIc8heoihW6Dm-p8JY&amp;amp;hl=en&amp;amp;sa=X&amp;amp;redir_esc=y#v=onepage&amp;amp;q=coaxial%20ethernet%20collision%20detection&amp;amp;f=false&quot; rel=&quot;nofollow&quot;&gt;https://books.google.co.uk/books?id=MRChaUQr0Q0C&amp;amp;pg=PA54&amp;amp;lpg=PA54&amp;amp;dq=coaxial+ethernet+collision+detection&amp;amp;source=bl&amp;amp;ots=oGaQGcNnkN&amp;amp;sig=OayChWr1zEIc8heoihW6Dm-p8JY&amp;amp;hl=en&amp;amp;sa=X&amp;amp;redir_esc=y#v=onepage&amp;amp;q=coaxial%20ethernet%20collision%20detection&amp;amp;f=false&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The common variants of twisted pair and fiber ethernet are full duplex at an electricial level but for compatibility reasons and to allow operation in networks with repeaters (hubs) they needed to be able to operate in a half duplex mode. This is done by treating simultanious activity on the transmit and receive datapaths as a collision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that links running in full duplex mode do not use CSMA/CD, collisions simply can't happen there. At 10Mbps CSMA/CD was the norm. In the early days of 100Mbps CSMA/CD was still used to support hubs (repeaters) but as switches (bridges) took over and autonegotiation matured full duplex became the norm. At 1Gbps half duplex mode exists in the standards but afaict noone ever sold a hub making it kinda pointless. At higher speeds half duplex is not supported at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CSMA/CD nowadays is a feature for compatbility with legacy equipment. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-03-31T13:25:15.993" LastActivityDate="2016-03-31T13:25:15.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29080" PostTypeId="1" AcceptedAnswerId="29081" CreationDate="2016-03-28T12:55:41.550" Score="1" ViewCount="147" Body="&lt;p&gt;If I use the &lt;code&gt;archive&lt;/code&gt; command for automatic backup, does it use memory in switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am planning to set path through TFTP.&lt;/p&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="8499" LastEditDate="2018-12-17T01:28:52.197" LastActivityDate="2018-12-17T01:28:52.197" Title="Does the archive command use memory in switch?" Tags="|cisco|switch|router|cisco-commands|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29081" PostTypeId="2" ParentId="29080" CreationDate="2016-03-28T13:15:09.787" Score="2" Body="&lt;p&gt;The &lt;code&gt;archive&lt;/code&gt; command places you in &lt;code&gt;archive mode&lt;/code&gt;. If you are using this to back up your configuration (&lt;code&gt;archive config&lt;/code&gt;) you are writing a copy of the configuration to a file in the file system, not RAM memory of the switch.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/fundamentals/command/reference/cf_book/cf_a1.html#wp1018716&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS Configuration Fundamentals Command Reference&lt;/a&gt;:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Usage Guidelines&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt; Before using this command, you must configure the &lt;strong&gt;path&lt;/strong&gt; command in order to specify the location and filename prefix for the&#xA;  files in the Cisco IOS configuration archive.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Cisco IOS configuration archive is intended to provide a mechanism&#xA;  to store, organize, and manage an archive of Cisco IOS configuration&#xA;  files to enhance the configuration rollback capability provided by the&#xA;  &lt;strong&gt;configure replace&lt;/strong&gt; command. Before this feature was introduced, you could save copies of the running configuration using the &lt;strong&gt;copy&#xA;  running-config&lt;/strong&gt; &lt;em&gt;destination-url&lt;/em&gt; command, storing the target file&#xA;  either locally or remotely. However, this method lacked any automated&#xA;  file management. On the other hand, the Configuration Replace and&#xA;  Configuration Rollback feature provides the capability to&#xA;  automatically save copies of the running configuration to the Cisco&#xA;  IOS configuration archive. These archived files serve as checkpoint&#xA;  configuration references and can be used by the &lt;strong&gt;configure replace&lt;/strong&gt;&#xA;  command to revert to previous configuration states.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The &lt;strong&gt;archive config&lt;/strong&gt; command allows you to save Cisco IOS&#xA;  configurations in the configuration archive using a standard location&#xA;  and filename prefix that is automatically appended with an incremental&#xA;  version number (and optional time stamp) as each consecutive file is&#xA;  saved. This functionality provides a means for consistent&#xA;  identification of saved Cisco IOS configuration files. You can specify&#xA;  how many versions of the running configuration are kept in the&#xA;  archive. After the maximum number of files has been saved in the&#xA;  archive, the oldest file is automatically deleted when the next, most&#xA;  recent file is saved. The &lt;strong&gt;show archive&lt;/strong&gt; command displays&#xA;  information for all configuration files saved in the Cisco IOS&#xA;  configuration archive.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following example shows how to save the current running&#xA;  configuration to the Cisco IOS configuration archive using the&#xA;  &lt;strong&gt;archive config&lt;/strong&gt; command. Before using the &lt;strong&gt;archive config&lt;/strong&gt; command, you must configure the &lt;strong&gt;path&lt;/strong&gt; command to specify the&#xA;  location and filename prefix for the files in the Cisco IOS&#xA;  configuration archive. In this example, the location and filename&#xA;  prefix are specified as disk0:myconfig as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure terminal&#xA;!&#xA;archive&#xA; path disk0:myconfig&#xA; end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;You then save the current running configuration in the configuration&#xA;  archive, as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;archive config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The show archive command displays information on the files saved in&#xA;  the configuration archive as shown in the following sample output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# show archive&#xA;&#xA;&#xA;There are currently 1 archive configurations saved.&#xA;The next archive file will be named disk0:myconfig-2&#xA; Archive #  Name &#xA;   0 &#xA;   1       disk0:myconfig-1 &amp;lt;- Most Recent &#xA;   2 &#xA;   3 &#xA;   4 &#xA;   5 &#xA;   6 &#xA;   7 &#xA;   8 &#xA;   9 &#xA;   10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-28T13:15:09.787" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29089" PostTypeId="1" AcceptedAnswerId="29090" CreationDate="2016-03-28T21:54:49.277" Score="2" ViewCount="826" Body="&lt;p&gt;In the Stop-and-Wait algorithm, the sender needs to re-transmit the frame if the acknowledgement received is corrupted during transmission. But just the fact that the sender received an acknowledgement from the receiver means that the frame was received. Why does it matter whether it is corrupted or not? Why is there a need to re-transmit?&lt;/p&gt;&#xA;" OwnerUserId="24085" LastEditorUserId="8499" LastEditDate="2016-03-28T22:00:35.313" LastActivityDate="2016-03-28T22:16:29.460" Title="Stop-and-Wait ARQ algorithm" Tags="|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29090" PostTypeId="2" ParentId="29089" CreationDate="2016-03-28T22:11:07.913" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But just the fact that the sender received an acknowledgement from the&#xA;  receiver means that the frame was received.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That statement is just not true since a negative acknowledgement means that the sent frame was damaged or a duplicate, and the sender must resend the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are both positive and negative acknowledgements. If the acknowledgement is corrupt, it can't be trusted, and it is considered a negative acknowledgement, forcing the frame to be resent.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-28T22:16:29.460" LastActivityDate="2016-03-28T22:16:29.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29091" PostTypeId="1" AcceptedAnswerId="29238" CreationDate="2016-03-28T22:58:13.537" Score="3" ViewCount="897" Body="&lt;p&gt;I have set up NTP on a Cisco IOS device running IOS 15.2M, and this is my bare-bones config used for testing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list standard IPV4-ACL-NTP-PEER&#xA; permit &amp;lt;UP.STREAM.NTP.SERVER&amp;gt; log&#xA;!&#xA;ip access-list standard IPV4-ACL-NTP-SERVE&#xA; permit any log&#xA;!&#xA;ip access-list standard IPV4-ACL-NTP-SERVE-ONLY&#xA; permit any log&#xA;!&#xA;ntp logging&#xA;ntp access-group peer IPV4-ACL-NTP-PEER&#xA;ntp access-group serve IPV4-ACL-NTP-SERVE&#xA;ntp access-group serve-only IPV4-ACL-NTP-SERVE-ONLY&#xA;ntp update-calendar&#xA;ntp server &amp;lt;UP.STREAM.NTP.SERVER&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routers can sync with the upstream server without any issues:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER#show ntp associations&#xA;&#xA;  address                 ref clock       st   when   poll reach  delay  offset   disp&#xA;*~&amp;lt;UP.STREAM.NTP.SERVER&amp;gt;  .PPS.            1     73    256   377  0.660   0.060  2.591&#xA; * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The router does not respond to ntp queries when I use ntpd or ntpdate on a linux machine. I have verified using debugging (and the ACL logging) that the packets do arrive at the router and are seen/processed by the NTP code and that they are matched against the relevant ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having only &quot;server&quot; or &quot;serve-only&quot; configured does not make a difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I change IPV4-ACL-NTP-PEER to include the client IP, the router responds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read a number of different documents/guides and as far as I can understand, I should not need (and not not want) to put a client in the peer ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I am mainly trying to understand WHY it works like this and what I am doing wrong, not just put the IP in the peer ACL and &quot;get it working&quot;.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not control the upstream NTP server and can not use authentication. I also do not control (most) of the clients.&lt;/p&gt;&#xA;" OwnerUserId="24086" LastEditorUserId="24086" LastEditDate="2016-03-28T23:32:30.747" LastActivityDate="2016-04-02T09:17:53.197" Title="IOS does not respond to NTP queries unless client is in &quot;peer&quot; ACL" Tags="|cisco-ios|ntp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29097" PostTypeId="1" AcceptedAnswerId="29105" CreationDate="2016-03-29T05:30:44.280" Score="1" ViewCount="166" Body="&lt;p&gt;Within the &lt;a href=&quot;http://www.alliedtelesis.com.au/p-1956.html&quot; rel=&quot;nofollow&quot;&gt;AT-9924SP&lt;/a&gt; series a console command such as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;show config dynamic&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;displays part of the config but then prompts the console again: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--More--  (&amp;lt;space&amp;gt; = next page, &amp;lt;CR&amp;gt; = one line, C = continuous, Q = quit)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is anyone aware of a command or config to have the console command return the entire config in the &quot;continuous&quot; form - from a single console command? &lt;/p&gt;&#xA;" OwnerUserId="23890" LastEditorUserId="8499" LastEditDate="2016-03-29T20:54:44.123" LastActivityDate="2016-03-29T20:54:44.123" Title="AT-9924 - is there a way to have console commands continuous?" Tags="|switch|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29101" PostTypeId="1" CreationDate="2016-03-29T13:03:06.190" Score="1" ViewCount="715" Body="&lt;p&gt;We have a Netscreen router as the default gateway. I have a windows 7 machine in the network. I deleted the ARP cache on this windows machine using the command &quot;arp -d&quot;. As soon as I did that, there was an ARP request from my windows 7 machine and I see that there are two responses from the GW (packet #1168 and 1170 in the below table).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1167 6.585819       Vmware_a9:70:dc       Broadcast             ARP      42     Who has 10.218.16.1? Tell 10.218.22.221&#xA;1168 6.588741       Netscreen_ff:50:01    Vmware_a9:70:dc       ARP      60     10.218.16.1 is at 06:22:bc:ff:50:01   &#xA;1170 6.590643       Netscreen_ff:50:01    Vmware_a9:70:dc       ARP      60     10.218.16.1 is at 06:22:bc:ff:50:01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried out a different machine in a different network and found that the router responded with only 1 response per request (this router seems to be a Cisco router)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2698 15:58:09.094908000 Vmware_85:6c:cf       Broadcast             ARP      42     Who has 10.211.32.1?  Tell 10.211.34.212   &#xA;2699 15:58:09.096329000 Cisco_e0:3f:01        Vmware_85:6c:cf       ARP      60     10.211.32.1 is at 00:00:0c:9f:f0:20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In both the cases, the ARP cache immediately had an entry for the default gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I cannot understand, is why the default gw is sending out two responses for one request?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers will be greatly appreciated. &lt;/p&gt;&#xA;" OwnerUserId="24104" LastEditorUserId="24104" LastEditDate="2016-03-29T13:11:30.440" LastActivityDate="2016-03-29T13:11:30.440" Title="Why would a default gateway send two ARP responses to one ARP request?" Tags="|arp|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29103" PostTypeId="1" CreationDate="2016-03-29T13:33:57.213" Score="2" ViewCount="31153" Body="&lt;p&gt;Sorry if this is a noob-ish question, but I am a bit lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are currently having some network issues, that seem to be manifesting in what appear to me to be odd ways.  End result is I have some backup jobs that are failing due to network connection being lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network that we are dealing with is a stack of 6 Cisco 3850's (running  IOS-XE 03.06.04.E) doing L3 routing for our entire network.  This stack, in addition to doing the L3 routing is hosting clients for this building as well as many of our servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While troubleshooting the backup failures, I found some odd results that I am hoping someone might be able to help me with.  I performed a copy of a 20GB file from server A (port Gi6/0/44) to server B (port Gi6/0/38), both on the same VLAN.  The odd thing is that the rxload of the sending port goes to 2xx/255 (sh cont util shows 99% receive) and the txload of the receiving port goes to 2xx/255 (sh cont util shows 99% transmit) which seems exactly backwards to me.  Additionally, the receiving port has lots of output drops/errors.  Below is the sh int for the 2 interfaces during file copy.  Also, reliability for the ports seems to degrade during the transfer, going down as far as 200/255 that I have seen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Sending port&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GigabitEthernet6/0/44 is up, line protocol is up (connected)&#xA;  Hardware is Gigabit Ethernet, address is f09e.63dc.63ac (bia f09e.63dc.63ac)&#xA;  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 72/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 00:01:17&#xA;  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 283590000 bits/sec, 23371 packets/sec&#xA;  5 minute output rate 1897000 bits/sec, 2367 packets/sec&#xA;     5392809 packets input, 8181417474 bytes, 0 no buffer&#xA;     Received 4 broadcasts (4 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 4 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     491872 packets output, 38490525 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Receiving Port&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GigabitEthernet6/0/38 is up, line protocol is up (connected)&#xA;  Hardware is Gigabit Ethernet, address is f09e.63dc.63a6 (bia f09e.63dc.63a6)&#xA;  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 249/255, txload 239/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 00:01:10&#xA;  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 171702&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  30 second input rate 3667000 bits/sec, 6244 packets/sec&#xA;  30 second output rate 938277000 bits/sec, 77528 packets/sec&#xA;     440644 packets input, 30590281 bytes, 0 no buffer&#xA;     Received 15 broadcasts (1 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 1 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     5001112 packets output, 7564904837 bytes, 0 underruns&#xA;     171702 output errors, 0 collisions, 0 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am not sure where to go or what to look for with what I am seeing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Stanfosd&lt;/p&gt;&#xA;" OwnerUserId="24102" LastEditorUserId="8499" LastEditDate="2018-12-23T04:22:35.490" LastActivityDate="2018-12-23T04:22:35.490" Title="Output drops/errors on Cisco 3850" Tags="|cisco|switch|cisco-catalyst|troubleshooting|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29105" PostTypeId="2" ParentId="29097" CreationDate="2016-03-29T14:41:38.437" Score="2" Body="&lt;p&gt;Apparently, you can only set it to be from 4 to 99 lines per page, but you can turn paging off:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SET TTy [History=0..99] [PAGe=4..99] [PRompt={string-15|DEFault|OFf}] [TYpe={Dumb|Vt100}] [IDLEtimeout={10..4294967294|OFF|0}]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The &lt;strong&gt;page&lt;/strong&gt; parameter sets the number of lines of command output&#xA;  displayed on the terminal screen before the switch pauses and waits&#xA;  for the user to press a key to continue. This number may range from 4&#xA;  to 99. The default is 22 for both asynchronous ports and Telnet&#xA;  connections. If &lt;strong&gt;page&lt;/strong&gt; is set to off, paging is disabled.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To turn off paging:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To set PAGE mode off for all subsequent Telnet connections, use the&#xA;  command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set tt pag=of&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-29T15:51:25.547" LastActivityDate="2016-03-29T15:51:25.547" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29106" PostTypeId="1" CreationDate="2016-03-29T15:05:50.617" Score="0" ViewCount="566" Body="&lt;p&gt;127.0.0.1 is used as loopback the address to one's own computer. But how can it be done ? Is it possible for creating a local webpage using this address.? And what kind of a server do we need for using 127.0.0.1. Many softwares make use of 127.0.0.1 for displaying the troubleshooting page with the help of the ports. Is it possible for anyone to create a page and display the page onto his own computer. &#xA;       I have created a webpage which i want to display onto a local computer instead of using the internet. So, i want to make use of IPv4 loopback address..&lt;/p&gt;&#xA;" OwnerUserId="24109" LastActivityDate="2016-03-29T15:27:02.750" Title="How to work with Loopback address 127.0.0.1?" Tags="|network-discovery|" AnswerCount="2" CommentCount="1" ClosedDate="2016-03-29T15:59:06.550" ContentLicense="CC BY-SA 3.0" />
  <row Id="29107" PostTypeId="2" ParentId="29106" CreationDate="2016-03-29T15:25:53.493" Score="0" Body="&lt;p&gt;Anything sent to an address in the &lt;code&gt;127.0.0.0/8&lt;/code&gt; range is looped right back into the host. This is used for testing higher-layer protocols, so yes you can use it to test things like web pages. Protocols above OSI layer-4 are explicitly off-topic here, so we can't help you configure your web server/browser to do this.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5735&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5735, Special Use IPv4 Addresses&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;127.0.0.0/8 - This block is assigned for use as the Internet host loopback address.  A datagram sent by a higher-level protocol to an&#xA;address anywhere within this block loops back inside the host.  This&#xA;is ordinarily implemented using only 127.0.0.1/32 for loopback.  As&#xA;described in [RFC1122], Section 3.2.1.3, addresses within the entire&#xA;127.0.0.0/8 block do not legitimately appear on any network anywhere.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-03-29T15:25:53.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29108" PostTypeId="2" ParentId="29106" CreationDate="2016-03-29T15:27:02.750" Score="2" Body="&lt;p&gt;Think of the loopback as a separate network interface on your computer.  You can ping, or open TCP or UDP connections to it.  If you create a web server on that device, you tell it to listen (bind) on one or more interfaces.  If it is listening on the loopback address, you would browse to 127.0.0.1 to access the server.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-29T15:27:02.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29109" PostTypeId="2" ParentId="29103" CreationDate="2016-03-29T17:01:00.460" Score="1" Body="&lt;p&gt;As I wrote in my comment, your thinking that the &lt;code&gt;txload&lt;/code&gt; is backwards is because you are not looking at it from the perspective of the switch instead of the servers. The most likely cause of a large &lt;code&gt;output errors&lt;/code&gt; number is that you are overrunning the output queue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has many documents on troubleshooting interface errors, e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/12027-53.html&quot; rel=&quot;nofollow&quot;&gt;Troubleshooting Switch Port and Interface Problems&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;output errors&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Description:&lt;/strong&gt; Cisco IOS &lt;strong&gt;sh interfaces&lt;/strong&gt; counter. The sum of all errors that prevented the final transmission of datagrams out of the&#xA;  interface. &lt;strong&gt;Common Cause:&lt;/strong&gt; This issue is due to the low Output Queue&#xA;  size.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-29T17:01:00.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29110" PostTypeId="1" AcceptedAnswerId="30806" CreationDate="2016-03-29T17:06:35.053" Score="1" ViewCount="7218" Body="&lt;p&gt;I have a Wago 750-352 Ethernet Coupler which I believe has been assigned an IP address already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In attempting to use the Wago BootP Server to connect to the device I am unable to connect to it.  I believe this is because the device already has a static IP and therefore will not listen over BootP.  I have triple checked MAC address in the config file, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to perform a factory reset such that I can erase the existing IP address in the EEPROM and connect via BootP without the Wago &quot;communication Cable 750-923&quot;?&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="8499" LastEditDate="2018-03-19T17:46:34.170" LastActivityDate="2018-03-19T17:46:34.170" Title="Wago PLC - assign IP address/factory reset" Tags="|ethernet|dhcp|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29111" PostTypeId="2" ParentId="29110" CreationDate="2016-03-29T17:16:12.193" Score="0" Body="&lt;p&gt;You should check the documentation. You may need special, proprietary cables for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;ved=0ahUKEwjskpycsebLAhXIlYMKHWXXCa8QFggdMAA&amp;amp;url=http%3A%2F%2Fwww.wago.com%2Fwagoweb%2Fdocumentation%2F750%2Feng_manu%2Fcoupler_controller%2Fm07500352_00000000_0en.pdf&amp;amp;usg=AFQjCNGZZTZ5oz0VPIB8gurUt0Dutr3Q0A&amp;amp;sig2=mE_dTSNrJjExGdCcefMSpg&amp;amp;cad=rja&quot; rel=&quot;nofollow&quot;&gt;WAGO-I/O-SYSTEM 750&#xA;ETHERNET Fieldbus Coupler&#xA;750-352&#xA;10/100 Mbit/s; digital and analog Signals&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;8.2.3 Assigning IP Address via WAGO-ETHERNET-Settings&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This program is used to configure an IP address via serial&#xA;  communications interface, to reset the fieldbus coupler parameters to&#xA;  the factory settings and to delete and extract the Flash File System&#xA;  in which the HTML pages of the fieldbus coupler are stored.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;WAGO communication cables or WAGO radio-link adapters can be used for&#xA;  data communication.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-29T17:16:12.193" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29112" PostTypeId="2" ParentId="29103" CreationDate="2016-03-29T19:12:45.880" Score="3" Body="&lt;p&gt;You're running the interface at 94% of capacity -- 938M out of 1000M -- &lt;em&gt;without&lt;/em&gt; flow control. The hardware buffer space is very limited (and shared between several ports in a group) so this is expected behavior when running near the limit. There's not much that can be done here: use a better switch (deeper buffers, faster ports, etc.), move things around to be in different groups, enable flow-control (limited support on the 3850.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-03-29T19:12:45.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29113" PostTypeId="2" ParentId="9612" CreationDate="2016-03-29T19:40:43.167" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/a/9613/23971&quot;&gt;The top answer&lt;/a&gt; is good. In case it helps, here's a description in terms of your phonebook analogy. Real networking terms in parentheses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on their name (IP address) you know they live in your neighborhood (broadcast domain). First you look in your phonebook (ARP cache) to see if you already know their address (MAC address). If they're not in the phonebook, you go outside and shout (broadcast), “Where does Steve live?” loud enough for everyone to hear (ARP request). Assuming Steve does in fact live there and he's awake, he replies—just to you, not shouting—“Here's my address” (ARP reply). You write it down in your phonebook for future reference (ARP caching).&lt;/p&gt;&#xA;" OwnerUserId="23971" LastEditorUserId="23971" LastEditDate="2018-12-07T16:50:16.477" LastActivityDate="2018-12-07T16:50:16.477" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29115" PostTypeId="1" AcceptedAnswerId="32443" CreationDate="2016-03-30T00:16:55.130" Score="2" ViewCount="12449" Body="&lt;p&gt;Hi I use traditional Direct Console cable to connect from HP Switch to PC.&#xA;I changed the settings for Putty as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what documentation says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Connect a serial console session with the switch, using the black&#xA;  console cable that would have shipped in the box of any ProCurve&#xA;  switch. The part number of that cable is 5184-1894. The part number is&#xA;  stamped directly on the connectors.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Use a VT100-compliant terminal emulator such as Hyper Terminal or Tera&#xA;  Term Pro to make the serial connection with the switch. Use the&#xA;  following COM port settings to create a terminal session with the&#xA;  Switch 4000m: Any baud rate from 2400 to 115200 (the switch&#xA;  automatically senses the speed). * 8 data bits, 1 stop bit, no parity,&#xA;  XON/XOFF flow control. * For Windows Terminal program, also disable&#xA;  (uncheck) the “Use Function, Arrow, and Ctrl Keys for Windows” option.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't know where is disable (uncheck) the “Use Function, Arrow, and Ctrl Keys for Windows” option is?&lt;/p&gt;&#xA;" OwnerUserId="5962" LastEditorUserId="8499" LastEditDate="2016-03-30T00:20:58.853" LastActivityDate="2016-07-04T03:07:58.557" Title="Connecting HP Procurve 2626 Switch to PC" Tags="|switch|hp-procurve|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29116" PostTypeId="2" ParentId="29115" CreationDate="2016-03-30T00:32:19.120" Score="0" Body="&lt;p&gt;It's under &lt;code&gt;File&lt;/code&gt;-&gt;&lt;code&gt;Properties&lt;/code&gt;-&gt;&lt;code&gt;Settings&lt;/code&gt; in HyperTerminal:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C5f0i.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C5f0i.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-30T00:38:24.727" LastActivityDate="2016-03-30T00:38:24.727" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29118" PostTypeId="2" ParentId="821" CreationDate="2016-03-30T02:50:22.913" Score="0" Body="&lt;p&gt;Aluminium is cheaper than copper but has higher resistivity and is more prone to unreliable terminations. Copper clad aluminium is an attempt to get some of the advantages of copper while keeping the price down. It's a clever idea in theory (in a high frequency system most current flows in the surface of the conductor anyway) but it's nonstandard and i've seen reports that it is unreliable in practice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The categories of cable are mostly about the high frequency performance. Higher categories have better high frequency performance. This is acheived through higher twist rates (which better reject high frequency capactive and inductive coupling), higher quality materials, more careful control of the geometry and in some cases shielding. The category you need will depend on the speeds you are operating at and the distance you are operating over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would generally suggest going for cat6 solid copper cable for installation wiring to end devices, it's not terriblly expensive will support 1000BASE-T with ease ans on short runs should support 10GBASE-T . If you want to run 10GBASE-T on long links you might want to splash out on cat6A but last I checked it was substantially more expensive than cat6 and it's not clear if 10GBASE-T will ever become more than a niche product.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For backbones I would seriously consider fiber at this point. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-03-30T02:50:22.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29119" PostTypeId="2" ParentId="13079" CreationDate="2016-03-30T03:44:22.300" Score="0" Body="&lt;p&gt;There are a few reasons why connections to servers a long distance away are frequently slower than more local servers.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The sender doesn't know how many packets it can safely send into the channel at once. It has to guess based on the acknowledgements coming back from the destination. The higher the latency the longer it takes for the speed to settle down ot the available capacity.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Older versions of TCP had a hard limit on how much data could be &quot;in flight&quot; at one time. Later extensions raised this limit but some systems may not support them or may have a local hardcoded limit.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The more hops there are in the chain the more likely one of them is to have problems at any given time. Longer distances typically mean more hops.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Local traffic (especially in europe) is frequently passed directly from content provider to access provider over cheap peering links. Long distance traffic has to pass over more expensive transit links to major worldwide networks (often but not always teir 1 providers). If either the content or access provider is a cheapskate these links may be undersized.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-03-30T03:44:22.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29120" PostTypeId="2" ParentId="23854" CreationDate="2016-03-30T04:41:36.270" Score="0" Body="&lt;p&gt;A repeater (aka hub) is a relatively simple device. It decodes and regenerates the wire-level encoding and participates in a minor way in collision enforcement but it does not buffer frames or make any descisions about where a frame is destined for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bridge (aka switch) is a far more complex device that works on a scale of full frames and keeps a table of MAC addresses so it can send packets where they need to go.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;if that's the case, why do repeaters still exist?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because it takes decades for legacy equipment that was made in massive volume to completely go away.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1) Bridges cost more than repeaters?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They used to but the economics have shifted over the years. The digital electronics that form the core of a switch became dirt cheap so the cost advantages of hubs went away. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2) Bridges introduce a higher overhead?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends on how exactly you define &quot;overhead&quot;. A frame in a bridge will spend a little longer in transit than a frame in a repeater. On the other hand bridges allow the use of full duplex links which eliminate the overhead of CSMA/CD.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-03-30T04:41:36.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29124" PostTypeId="1" AcceptedAnswerId="29126" CreationDate="2016-03-30T07:25:55.113" Score="2" ViewCount="68" Body="&lt;p&gt;Trying to set up an anycast DNS setup. For the time being, we have two routers, R01 and our Mgmt router that we're using until we move to SDN (in testing phases).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem we're having is the DNS receives the query on 10.1.2.8 like it should but it responds via 10.99.0.130 using NAT. The box that the DNS server is on has a gateway of last resort set to .1 for upgrades and other traffic, and 10.1.2.8 is configured on the loopback interface. How do we force responses back through the way it came (through R01)?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;             Internet&#xA;BGP AS 64000   +   +      Static Routed&#xA;Aggregating +--+   +----+ 10.99.0.128/29&#xA;10.1.2.0/24 |           | SNAT on .130&#xA;   +--------+-+    +----+------------+&#xA;   |R01       |    |Mgmt/OOB Rtr     |&#xA;   |          |    |                 |&#xA;   +-----+----+    +---------+-------+&#xA;      .2 |                   | .1&#xA;         |  172.19.0.0/24    |&#xA;    +----+----+--------------+---+&#xA;              |&#xA;              | .4&#xA;      +---------------+&#xA;      |DNS Service    |&#xA;      |Anycast        |&#xA;      |VIP 10.1.2.8/32|&#xA;      +---------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4917" LastEditorUserId="8499" LastEditDate="2018-02-15T05:23:27.073" LastActivityDate="2018-02-15T05:23:27.073" Title="Anycasted Service responding from regular IP address" Tags="|routing|bgp|anycast|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29125" PostTypeId="1" CreationDate="2016-03-30T07:29:33.243" Score="1" ViewCount="1852" Body="&lt;p&gt;I need to IP whois database of ARIN and RIPE. I can find RIPE database:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;ftp://ftp.ripe.net/ripe/dbase/split/ripe.db.inetnum.gz&quot; rel=&quot;nofollow&quot;&gt;ftp://ftp.ripe.net/ripe/dbase/split/ripe.db.inetnum.gz&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I can't find ARIN database like this. How can I find ARIN full database?&lt;/p&gt;&#xA;" OwnerUserId="17007" LastActivityDate="2016-03-30T09:07:21.807" Title="ARIN Ip database" Tags="|arin|" AnswerCount="1" CommentCount="2" ClosedDate="2016-03-30T16:46:52.780" ContentLicense="CC BY-SA 3.0" />
  <row Id="29126" PostTypeId="2" ParentId="29124" CreationDate="2016-03-30T07:59:18.320" Score="1" Body="&lt;p&gt;Your DNS server doesn't know where the packet(s) came from. Thus responses will follow whatever the route table says is the best path to the destination -- which is a different path if the origin was R01.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need some sort of &lt;em&gt;policy-based routing&lt;/em&gt; on the server -- route based on src, not dest; anything &lt;em&gt;from&lt;/em&gt; 10.1.2.8 should be forwarded to 172.19.0.2. How to set that up on your (unspecified) host OS is off-topic here. (as it isn't a router)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-03-30T07:59:18.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29127" PostTypeId="2" ParentId="29125" CreationDate="2016-03-30T09:07:21.807" Score="5" Body="&lt;p&gt;As &lt;a href=&quot;https://networkengineering.stackexchange.com/users/619/ricky-beam&quot;&gt;Ricky Beam&lt;/a&gt; told in comment, the ARIN database is not available in a downloadable (archive) format.&lt;/p&gt;&#xA;&lt;p&gt;But you can query it directly using REST.&lt;/p&gt;&#xA;&lt;p&gt;As stated in the &lt;a href=&quot;https://www.arin.net/resources/whoisrws/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARIN WHOIS-RWS web page&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ARIN’s Whois RESTful Web Service (Whois-RWS) is the new directory&#xA;service for accessing registration data contained within ARIN’s&#xA;registration database.&#xA;(...)&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;How do I use the ARIN Whois RESTful Web Service?&lt;/strong&gt;&lt;br /&gt;&#xA;Several websites offer a lot of general documentation about RESTful services. Use your favorite search engine to find how-to&#xA;documentation. For specifics about using ARIN’s RESTful service,&#xA;please read our &lt;a href=&quot;https://www.arin.net/resources/whoisrws/whois_api.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Whois-RWS Documentation&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Note the the link you provide for the RIPE database is only a subset of the RIPE DB, as explained in the &lt;a href=&quot;https://www.ripe.net/manage-ips-and-asns/db/faq/faq-db&quot; rel=&quot;nofollow noreferrer&quot;&gt;RIPE Database FAQ&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Can I download the RIPE Database?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;You cannot download the RIPE Database in the way you can download software from the Internet. This is because the database is dynamic&#xA;and is constantly being updated. It is also subject to European Data&#xA;Protection Laws.&lt;/p&gt;&#xA;&lt;p&gt;We produce daily snapshots which are available to the public. You can find these files at our FTP site at:&#xA;&lt;a href=&quot;ftp://ftp.ripe.net/ripe/dbase/ripe.db.gz&quot; rel=&quot;nofollow noreferrer&quot;&gt;ftp://ftp.ripe.net/ripe/dbase/ripe.db.gz&lt;/a&gt;&#xA;or split by object type at: &lt;a href=&quot;ftp://ftp.ripe.net/ripe/dbase/split&quot; rel=&quot;nofollow noreferrer&quot;&gt;ftp://ftp.ripe.net/ripe/dbase/split&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;These daily snapshots exclude the object types: person, role, organisation and mntner. For data protection reasons, personal data is&#xA;not available in bulk format.&lt;/p&gt;&#xA;&lt;p&gt;Another way to &amp;quot;download&amp;quot; the RIPE Database is to become a Near-Real-Time Mirror (NRTM). This means that you run a copy of the&#xA;database at your site that keeps up-to-date with the master server by&#xA;regularly downloading the most recent updates. All personal data is&#xA;excluded from the NRTM download and updates. You must be authorised to&#xA;become a NRTM.&lt;/p&gt;&#xA;&lt;p&gt;If you are interested, please contact ripe-dbm@ripe.net explaining why you want to become a NRTM.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-03-30T09:07:21.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29129" PostTypeId="1" CreationDate="2016-03-30T11:50:19.943" Score="0" ViewCount="313" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Z2xRK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z2xRK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All devices on the network use CAT6 Ethernet cable.&lt;/li&gt;&#xA;&lt;li&gt;Router has DHCP enabled.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I want to seperate the above network to incoporate another network which it's main use is for IP cameras (not implemented yet). Both networks need to access the NAS as a 'shared resource', but both networks should not be able to talk to one another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I isolate both networks from each other whilst sharing a resource which is important to both?&lt;/p&gt;&#xA;" OwnerUserId="23609" LastActivityDate="2016-06-29T13:49:00.013" Title="Isolate networks whilst sharing NAS" Tags="|routing|switch|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29131" PostTypeId="2" ParentId="29129" CreationDate="2016-03-30T12:21:33.473" Score="-1" Body="&lt;p&gt;I would suggest you to connect NAS to the router instead of switch and camera also(if you have only one camera). 3 different networks would do. &lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-03-30T12:21:33.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29134" PostTypeId="1" AcceptedAnswerId="29136" CreationDate="2016-03-30T13:53:37.790" Score="1" ViewCount="506" Body="&lt;p&gt;Is it possible to limit the number of hosts on a network / subnet to a specific number like 237,17 or 20?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to read up on using subnet-masks, but with these trailing 1's and 0's it seems that i can only limit the number of hosts to   hosts=(2^n)-2 where n = number of 0's and the -2 stands for the broadcast address and the gateway.&lt;/p&gt;&#xA;" OwnerUserId="24125" LastActivityDate="2021-01-23T08:36:57.160" Title="Can I limit the number of hosts on a subnet to a specific number?" Tags="|routing|ip|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29135" PostTypeId="1" AcceptedAnswerId="29138" CreationDate="2016-03-30T14:10:30.050" Score="2" ViewCount="2719" Body="&lt;p&gt;I'm setting up a High Availability Cluster with two pfSense SG-4860 routers. I have a question about setting up the network. Here is the diagram they provide:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Wor73.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Wor73.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a question about the WAN part. One of their prerequisites is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;A High Availability cluster needs three IP addresses in each subnet along with a separate unused subnet for the Sync interface. For WANs,&#xA;  this means that a /29 subnet or larger is required for an optimal&#xA;  configuration.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My question is: does this mean I need three external IP addresses from my ISP, or is it possible to do these internally with one external IP address from the ISP? Which would provide the best solution? I guess I'm just confused when it comes to this part of the network. Any feedback would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found this link on Super User: &lt;a href=&quot;https://superuser.com/questions/709158/can-an-isp-provide-two-static-ips-over-a-single-cable&quot;&gt;Can an ISP provide two static IPs over a single cable?&lt;/a&gt; Is this generally the way a network handles more than one IP address from an ISP?&lt;/p&gt;&#xA;" OwnerUserId="23029" LastEditorUserId="-1" LastEditDate="2017-03-20T10:04:42.970" LastActivityDate="2017-06-30T00:28:43.023" Title="pfSense - High Availibility Cluster" Tags="|switch|router|wan|pfsense|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29136" PostTypeId="2" ParentId="29134" CreationDate="2016-03-30T14:36:48.683" Score="3" Body="&lt;p&gt;As you said you cannot have a network that has a custom number of available IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be various way to effectively limit the number of possible hosts on the networks but it greatly depends of you network topology / equipment / configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could limit if physically for wired networks, but I guess in most case this is not very practical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe the more practical / secure way is to implement access control lists (firewall rules) on the router that will drop the traffic for unwanted IP addresses for each network.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-03-30T14:36:48.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29138" PostTypeId="2" ParentId="29135" CreationDate="2016-03-30T14:45:08.770" Score="1" Body="&lt;p&gt;The requirement is that each router have its own IP address (that's two), and there needs to be a virtual IP address (that makes three). If you are doing this on the public side, you will need three public addresses from your ISP, and that will require a maximum mask length of &lt;code&gt;/29&lt;/code&gt; since &lt;code&gt;/30&lt;/code&gt; will only give you two usable addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what you mean by, &quot;routing these to the switch,&quot; since switches don't know anything about IP addresses or routing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-30T14:45:08.770" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="29139" PostTypeId="1" AcceptedAnswerId="43265" CreationDate="2016-03-30T15:18:54.627" Score="4" ViewCount="587" Body="&lt;p&gt;Here is the setup:&#xA; - We have two routers R1 and R2 in two distant locations and in the same AS0.&#xA; - AS0 is connected to AS1 via both R1 and R2 receive some AS1 route (one and the same prefix) from both sessions&#xA; - R1 and R2 have iBGP session with no filters&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal:&#xA; - We want to force R1 to choose its locally received route towards AS1&#xA; - We want to force R2 to also choose its locally received route towards AS1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:&#xA;With a single router in the network we force preference using the local-preference attribute. Can we also use the local-preference in the above described setup?&lt;/p&gt;&#xA;" OwnerUserId="21628" LastActivityDate="2017-08-15T08:12:17.357" Title="Can two routers with an iBGP session maintain different local preferences?" Tags="|bgp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29140" PostTypeId="1" CreationDate="2016-03-30T15:20:05.907" Score="1" ViewCount="5315" Body="&lt;p&gt;Does a VTP server switch, with a VTP domain configured on it, advertise the VTP domain name to a client switch, so that the VTP domain is automatically configured on client switch?&lt;/p&gt;&#xA;" OwnerUserId="21408" LastEditorUserId="8499" LastEditDate="2019-01-04T06:07:27.033" LastActivityDate="2019-01-04T06:07:27.033" Title="VTP and VTP domain" Tags="|cisco|switch|vlan|trunk|vtp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29141" PostTypeId="2" ParentId="29140" CreationDate="2016-03-30T15:24:38.163" Score="0" Body="&lt;p&gt;I believe:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VTP server does advertise domain name in protocol packets&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco client does choose to pick up the domain name when a)it's set to client mode and b)it's domain name is empty&lt;/p&gt;&#xA;" OwnerUserId="1554" LastActivityDate="2016-03-30T15:24:38.163" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29142" PostTypeId="2" ParentId="29134" CreationDate="2016-03-30T15:31:37.810" Score="0" Body="&lt;p&gt;Limit the DHCP pool for the subnet and write an ACL to block the addresses not in the pool.&lt;/p&gt;&#xA;" OwnerUserId="24140" LastActivityDate="2016-03-30T15:31:37.810" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29143" PostTypeId="2" ParentId="29140" CreationDate="2016-03-30T15:35:15.000" Score="4" Body="&lt;p&gt;If you have not previously configured a switch to be in a VTP domain, it will become part of the VTP domain from the first VTP advertisement it sees. See the sections which I emphasized below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html&quot; rel=&quot;nofollow&quot;&gt;Configuring VTP&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;The VTP Domain&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A VTP domain (also called a VLAN management domain) consists of one&#xA;  switch or several interconnected switches under the same&#xA;  administrative responsibility sharing the same VTP domain name. A&#xA;  switch can be in only one VTP domain. You make global VLAN&#xA;  configuration changes for the domain.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;&lt;em&gt;By default, the switch is in the VTP no-management-domain state until it receives an advertisement for a domain over a trunk link (a&#xA;  link that carries the traffic of multiple VLANs) or until you&#xA;  configure a domain name.&lt;/em&gt;&lt;/strong&gt; Until the management domain name is specified&#xA;  or learned, you cannot create or modify VLANs on a VTP server, and&#xA;  VLAN information is not propagated over the network.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;&lt;em&gt;If the switch receives a VTP advertisement over a trunk link, it&#xA;  inherits the management domain name and the VTP configuration revision&#xA;  number. The switch then ignores advertisements with a different domain&#xA;  name or an earlier configuration revision number.&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Caution&lt;/strong&gt; &lt;em&gt;Before adding a VTP client switch to a VTP domain, always verify that its VTP configuration revision number is lower than the&#xA;  configuration revision number of the other switches in the VTP domain.&#xA;  Switches in a VTP domain always use the VLAN configuration of the&#xA;  switch with the highest VTP configuration revision number. If you add&#xA;  a switch that has a revision number higher than the revision number in&#xA;  the VTP domain, it can erase all VLAN information from the VTP server&#xA;  and VTP domain. See the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wp1310607&quot; rel=&quot;nofollow&quot;&gt;&quot;Adding a VTP Client Switch to a VTP Domain&quot;&#xA;  section&lt;/a&gt; for the procedure for verifying and resetting the VTP&#xA;  configuration revision number.&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When you make a change to the VLAN configuration on a VTP server, the&#xA;  change is propagated to all switches in the VTP domain. VTP&#xA;  advertisements are sent over all IEEE trunk connections, including&#xA;  Inter-Switch Link (ISL) and IEEE 802.1Q. VTP dynamically maps VLANs&#xA;  with unique names and internal index associates across multiple LAN&#xA;  types. Mapping eliminates excessive device administration required&#xA;  from network administrators.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If you configure a switch for VTP transparent mode, you can create and&#xA;  modify VLANs, but the changes are not sent to other switches in the&#xA;  domain, and they affect only the individual switch. However,&#xA;  configuration changes made when the switch is in this mode are saved&#xA;  in the switch running configuration and can be saved to the switch&#xA;  startup configuration file.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For domain name and password configuration guidelines, see the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wp1225071&quot; rel=&quot;nofollow&quot;&gt;&quot;VTP&#xA;  Configuration Guidelines&quot; section&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-30T15:58:45.457" LastActivityDate="2016-03-30T15:58:45.457" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29146" PostTypeId="1" CreationDate="2016-03-30T16:41:57.217" Score="1" ViewCount="188" Body="&lt;p&gt;I have 2 subnets on a switch, connected to a router.  The attached diagram should show the setup.  The firewall controls communications between the 10.45.45.0/25 and the 10.75.75.0/24 subnets, however, the firewall is the gateway for the 45 subnet, not the 75 subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For traffic to get from 45 -&gt; 75, there is 1 hop, the firewall.&#xA;For traffic to get from 75 -&gt; 45 there are 2 hops, switch, then firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic will not pass from 75 -&gt; 45 when the gateway is set to the switch, but will when it is set to the firewall, even though the switches default route is the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any idea what would cause this to happen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DNTnq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DNTnq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14317" LastEditorUserId="8499" LastEditDate="2016-03-30T16:49:28.820" LastActivityDate="2016-03-30T17:43:38.277" Title="Subnet routing with different routes" Tags="|routing|firewall|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29147" PostTypeId="1" CreationDate="2016-03-30T16:45:08.997" Score="2" ViewCount="2674" Body="&lt;p&gt;Is is safe to block inbound traffic with source IP 0.0.0.0/32 at my firewall box. I understand it's a non-routable IP, but it used for DHCP Discovery, so packets are not discarded with that source IP unless specified. My intent is to stop UDP floods source 0.0.0.0 from crossing from WAN to LAN.&lt;/p&gt;&#xA;" OwnerUserId="21826" LastActivityDate="2017-03-12T07:58:47.497" Title="Blocking 0.0.0.0 Inbound" Tags="|firewall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29148" PostTypeId="2" ParentId="29146" CreationDate="2016-03-30T16:55:17.353" Score="1" Body="&lt;p&gt;Is there a reason you are avoiding giving vlan45 an ip on the switch? I'd give it a routable IP then gateway to the firewall. If the switch is layer two, the firewall will need a separate/sub-interface to make the hop with. Google router-on-a-stick. Also, keep in mind many, if not most, firewalls are not full featured routers. Make sure your firewall can do the job.&lt;/p&gt;&#xA;" OwnerUserId="21826" LastActivityDate="2016-03-30T16:55:17.353" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29150" PostTypeId="2" ParentId="29147" CreationDate="2016-03-30T16:57:06.307" Score="1" Body="&lt;p&gt;By default, a firewall should block all traffic originating from the outside to the inside. It should only allow outside-originated traffic which you have explicitly configured it to allow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why did you allow such traffic in the first place? If you are not providing DHCP from one side of the firewall to the other, it should be fine for that traffic to be blocked.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-30T16:57:06.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29151" PostTypeId="2" ParentId="29134" CreationDate="2016-03-30T17:01:36.813" Score="1" Body="&lt;p&gt;Maybe. It depends greatly on your network setup. Our SDN setup lets me impose a hard limit at the DHCP source, but we don't use that feature. On a standard cisco, juniper, or procurve deploment, I don't know of a way to limit the number of hosts. I also can't think of a use case for limiting the number of hosts. Wouldn't you instead want to Permit only certain hosts? That would be much safer.&lt;/p&gt;&#xA;" OwnerUserId="21826" LastEditorUserId="21826" LastEditDate="2016-03-30T17:27:16.500" LastActivityDate="2016-03-30T17:27:16.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29153" PostTypeId="2" ParentId="29146" CreationDate="2016-03-30T17:43:38.277" Score="0" Body="&lt;p&gt;Since the switch is a layer-3 switch, you should make it the gateway for the VLANs, and have a routed link (&lt;code&gt;/30&lt;/code&gt; or &lt;code&gt;/31&lt;/code&gt;) from the layer-3 switch to the firewall. This is the standard practice, and it allows the layer-3 switch to route the LAN, and the firewall to route the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need some way for the firewall to know that the LAN networks are on the layer-3 switch, and you can do this with static routes, or via a routing protocol. You will also need to set up a default route on the layer-3 switch to the firewall, or you can receive it from the firewall if you use a routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since both LAN networks will use the layer-3 switch as the router, traffic will automatically be routed between them.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-30T17:43:38.277" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29154" PostTypeId="1" CreationDate="2016-03-30T18:11:20.950" Score="0" ViewCount="1326" Body="&lt;p&gt;I was trying to use a Cisco Meraki Z1 router, but because of some reasons, I cannot connect it to the Internet in my office. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I when inserted the RJ cable to the Internet port, the LEDS were glowing. &#xA;Also, I could test the Internet speed from &lt;code&gt;setup.meraki.com&lt;/code&gt;. But then when I try to access Internet through Wi-Fi, it says no Internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have used the same thing at home, where I directly connected it to the modem, and there it worked perfectly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me know what am I doing wrong? &lt;/p&gt;&#xA;" OwnerUserId="24145" LastEditorUserId="8499" LastEditDate="2016-03-30T20:06:55.680" LastActivityDate="2016-06-09T02:50:09.800" Title="Not connecting to Internet using Cisco Meraki Z1" Tags="|cisco|router|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-13T20:31:21.853" ContentLicense="CC BY-SA 3.0" />
  <row Id="29155" PostTypeId="1" CreationDate="2016-03-30T19:53:34.773" Score="1" ViewCount="2202" Body="&lt;p&gt;Why OOB management preferred? can you do it using blade?&lt;/p&gt;&#xA;" OwnerUserId="24147" LastActivityDate="2016-03-30T20:57:51.297" Title="can you explain OOB Management in easy terms?" Tags="|oob|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29156" PostTypeId="2" ParentId="29155" CreationDate="2016-03-30T20:04:56.403" Score="1" Body="&lt;p&gt;In-band management goes away if the network goes down. When using in-band management, it is possible to render the device unable to be reached from the network, and that requires an on-site visit to correct the situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most enterprise-grade network devices have a serial console port which can be connected to a modem (or some other communication device) which can be used to perform device management over a phone line (or some other distance connection) for out-of-band management.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-30T20:04:56.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29157" PostTypeId="2" ParentId="29155" CreationDate="2016-03-30T20:08:12.190" Score="1" Body="&lt;p&gt;Not a very precise question, but here goes...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OOBM is generally used in situations where you have a risk of having your production access cut off, and you want to make sure you still have admin access to your environment in that type of situation, to fix whatever went wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples include :&#xA;- management access to a WAN router through a POTS line or 3G modem so you can check on the status of the router if the WAN circuit is down.&#xA;- management access to a datacenter network even if some major incident has occured. One common example is when you add a vlan to a trunk and forget the &quot;add&quot; keyword, thus cutting off all other vlans including the management one... which is no longer an issue with OOBM.&#xA;- ILO cards on servers also allow you to access the server even if its production OS is corrupted. The idea is the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Blade server chassis typically offer something similar : you have a means to access the Blade Server chassis itself, and from there an interface provides you with functionality similar to that of an ILO card.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-03-30T20:08:12.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29158" PostTypeId="1" CreationDate="2016-03-30T20:19:20.883" Score="3" ViewCount="454" Body="&lt;p&gt;The 5500 manual says one shouldn't use VLAN 1 on access ports. Furthermore, it couldn't be added to trunk ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the manual gives no reason. Normally, all VLANs are tagged on trunk ports. Is VLAN 1 not tagged? Is VLAN 1 then local to a switch only?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Isn't it possible to leave VLAN 1 on all access ports untagged and forward it tagged on the trunks?&lt;/p&gt;&#xA;" OwnerUserId="24146" LastEditorUserId="8499" LastEditDate="2016-03-30T20:28:13.483" LastActivityDate="2016-06-28T21:59:35.083" Title="3Com and &quot;VLAN 1&quot;" Tags="|vlan|3-com|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29159" PostTypeId="2" ParentId="29158" CreationDate="2016-03-30T20:27:02.587" Score="0" Body="&lt;p&gt;VLAN 1 is usually the native (untagged) VLAN. Using VLAN 1, and native VLANs in general, poses some security risk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access ports should not use VLAN tags since most end-devices (some servers may) don't understand VLAN tags. Tags are used on trunks, where multiple VLANs are on the same link, in order to distinguish which frames belong to which VLAN. You can have one untagged (native) VLAN on a trunk since you can distinguish it from the tagged frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some devices do not let you disable VLAN 1. It is likely that your switch requires VLAN 1 on a trunk, so you can't configure it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-03-30T20:27:02.587" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29160" PostTypeId="1" CreationDate="2016-03-30T20:27:32.557" Score="0" ViewCount="761" Body="&lt;p&gt;I have a SonicWALL with X0=&lt;code&gt;10.11.10.0/24&lt;/code&gt; and X2=&lt;code&gt;192.168.11.0/24&lt;/code&gt;. The downstairs MikroTik ports 1-19 are in &lt;code&gt;192.168.11.0/24&lt;/code&gt;, and ports 21-24 are in &lt;code&gt;10.11.10.0/24&lt;/code&gt; I am assuming port 20 will be my trunk port to the 2nd MikroTik upstairs. on the 2nd MikroTik, I want port 1 to be the trunk, with Ports 2-20 on &lt;code&gt;192.168.11.0/24&lt;/code&gt;, and ports 21-24 on &lt;code&gt;10.11.10.0/24&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I am trying to do it this way is that this is a business in an older home, and I only have one Category-5E cable that is between my downstairs MikroTik and the upstairs MikroTik.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this doable, and if so, can someone help me out on the configurations, as I am new to the VLAN game?&lt;/p&gt;&#xA;" OwnerUserId="24148" LastEditorUserId="8499" LastEditDate="2018-02-14T16:23:32.107" LastActivityDate="2018-02-14T16:23:32.107" Title="Help with VLAN Configuration between 2 MikroTik CRS125-24G Devices" Tags="|vlan|sonicwall|" AnswerCount="1" CommentCount="4" ClosedDate="2017-08-09T23:45:52.190" ContentLicense="CC BY-SA 3.0" />
  <row Id="29161" PostTypeId="2" ParentId="29158" CreationDate="2016-03-30T20:28:17.277" Score="2" Body="&lt;p&gt;Normally, &lt;em&gt;all but the native vlan&lt;/em&gt; are tagged on trunk ports. Some vendors do prefer tagging everything on trunk ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;don't use VLAN 1&quot; is a Best Practice&amp;trade; (aka. religion.) People prefer to avoid baked in defaults so there are fewer surprises down the road. If you have a simple enough network, there's no reason VLAN 1 cannot be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 1 does have special meaning to (eg) spanning-tree.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-03-30T20:28:17.277" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29162" PostTypeId="1" CreationDate="2016-03-30T20:49:23.420" Score="0" ViewCount="162" Body="&lt;p&gt;There are lots of tools like nmap and I am using one for android that discovers every (?) host on the network that I am connected to. I do not understand what kind of packets are send by the program to find out these hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do they send broadcast packets? Do they calculate all the possible IPs in their network using the subnet mask and then send ICMP packets to each of those addresses and then expect answers?&lt;/p&gt;&#xA;" OwnerUserId="23730" LastActivityDate="2016-04-01T08:54:06.757" Title="What kind of packets do tools like nmap use to discover other hosts on the network they are scanning?" Tags="|ethernet|icmp|network-discovery|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29164" PostTypeId="2" ParentId="29155" CreationDate="2016-03-30T20:57:51.297" Score="1" Body="&lt;p&gt;In addition to @RonMaupin and @JeremyGibbons' answers, many organizations use a physically separate network to manage their devices to improve device security.  The idea is they can connect to the devices using a network that has highly restricted access, and no access from outside the organization (e.g. the Internet).  Only administrators are connected to the management network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many devices have separate ethernet interfaces just for this purpose.  You will see it labeled as &quot;management interface&quot; or &quot;service port.&quot;  You can configure the device so that it only allows the management interface to gain access to the device configuration (CLI, GUI, etc).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-03-30T20:57:51.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29166" PostTypeId="1" CreationDate="2016-03-30T22:33:51.687" Score="1" ViewCount="50" Body="&lt;p&gt;As known, Road-based using Vehicular Traffic Proactive routing (RBVT-P) is an unicast algorithm whose uses CPs (Connectivity Packets) for route discovery&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The confusion here is that CPs are sent in Unicast mode while some references said that it is sent to all nodes witch corresponds to broadcast mode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for answering, &lt;/p&gt;&#xA;" OwnerUserId="20609" LastActivityDate="2016-03-30T22:33:51.687" Title="Unicast forwarding in RBVT-P routing protocol" Tags="|routing|ad-hoc-wireless|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29168" PostTypeId="1" AcceptedAnswerId="29169" CreationDate="2016-03-31T04:00:45.800" Score="4" ViewCount="4078" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fbGx2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fbGx2.png&quot; alt=&quot;Wireshark trace from my PC when it was assigned an IP from DHCP server.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is a &lt;strong&gt;DHCP OFFER&lt;/strong&gt; message is destined to IP: 10.0.0.21 (which was assigned to my PC by DHCP server later) before even the system configured it? When the host is still asking for an IP address, how can server send a unicast message? The host's IP address will still be &lt;strong&gt;0.0.0.0&lt;/strong&gt; So, can anyone explain this?&lt;/p&gt;&#xA;" OwnerUserId="24153" LastEditorUserId="8499" LastEditDate="2016-04-02T22:25:46.677" LastActivityDate="2016-04-02T22:25:46.677" Title="How can a DHCP OFFER message be unicast?" Tags="|dhcp|protocol-theory|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29169" PostTypeId="2" ParentId="29168" CreationDate="2016-03-31T04:33:41.867" Score="3" Body="&lt;p&gt;While an address of &lt;code&gt;0.0.0.0&lt;/code&gt; can be used as a source address for DHCP, it shouldn't be used as a destination address on the network. The server can send a unicast message since it knows the host's MAC address. Remember that all traffic delivered to the host is on layer-2, so the important address is the MAC address.&lt;/p&gt;&#xA;&lt;p&gt;This is important because a DHCP server may not be on the same LAN as the requesting host. A DHCP Offer may need to be routed, via layer-3, back to the network where the requesting host is connected.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fdiKE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fdiKE.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Thanks to richarb for providing the link to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1542#section-3.1.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Clarifications and Extensions for the Bootstrap Protocol&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;3.1.1 The BROADCAST flag&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Normally, BOOTP servers and relay agents attempt to deliver&#xA;BOOTREPLY messages directly to a client using unicast delivery.&#xA;The IP destination address (in the IP header) is set to the BOOTP&#xA;'yiaddr' address and the link-layer destination address is set to&#xA;the BOOTP 'chaddr' address.  Unfortunately, some client&#xA;implementations are unable to receive such unicast IP datagrams&#xA;until they know their own IP address (thus we have a &amp;quot;chicken and&#xA;egg&amp;quot; issue).  Often, however, they can receive broadcast IP&#xA;datagrams (those with a valid IP broadcast address as the IP&#xA;destination and the link-layer broadcast address as the link-layer&#xA;destination).&lt;/p&gt;&#xA;&lt;p&gt;If a client falls into this category, it SHOULD set (to 1) the&#xA;newly-defined BROADCAST flag in the 'flags' field of BOOTREPLY&#xA;messages it generates.  This will provide a hint to BOOTP servers and&#xA;relay agents that they should attempt to broadcast their BOOTREPLY&#xA;messages to the client.&lt;/p&gt;&#xA;&lt;p&gt;If a client does not have this limitation (i.e., it is perfectly&#xA;able to receive unicast BOOTREPLY messages), it SHOULD NOT set the&#xA;BROADCAST flag (i.e., it SHOULD clear the BROADCAST flag to 0).&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  DISCUSSION:&#xA;&#xA;     This addition to the protocol is a workaround for old host&#xA;     implementations.  Such implementations SHOULD be modified so&#xA;     that they may receive unicast BOOTREPLY messages, thus making&#xA;     use of this workaround unnecessary.  In general, the use of&#xA;     this mechanism is discouraged.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-04-02T15:39:28.880" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="29170" PostTypeId="1" AcceptedAnswerId="29181" CreationDate="2016-03-31T07:12:37.123" Score="1" ViewCount="1244" Body="&lt;p&gt;I am trying to setup a load balancer behind my ASA 5515. (Running Cisco IOS version 9.1.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to group the ports to do a static nat, with a service-group statement?&#xA;For instance, I want to be able to NAT ports 80 and 443 (and other ports).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My service group:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group service webServices&#xA;   service-object tcp destination eq www &#xA;   service-object tcp destination eq https&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My network object:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network lb01&#xA;   host 192.168.1.13&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My hopeful nat statement (which fails woefully):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (dmz,outside) static interface service tcp object-group webServices object-group webServices&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please can someone correct me?&#xA;Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="23709" LastEditorUserId="23709" LastEditDate="2016-04-03T00:31:32.423" LastActivityDate="2016-07-19T19:37:43.767" Title="Cisco ASA 5515 NAT with service-group definition" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29171" PostTypeId="1" AcceptedAnswerId="29174" CreationDate="2016-03-31T09:13:14.270" Score="0" ViewCount="2541" Body="&lt;p&gt;I want to say 192.168.0.0/16 contains more IP addresses, 86 more to be precise? I've simply subtracted 168 from 254.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone clarify how you can determine which has more IP addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="24157" LastActivityDate="2016-03-31T11:49:42.137" Title="Which CIDR block contains the most IP addresses, 192.168.0.0/16 or 169.254.0.0/16?" Tags="|ipv4|ip-address|" AnswerCount="1" CommentCount="3" ClosedDate="2019-03-17T21:18:52.197" ContentLicense="CC BY-SA 3.0" />
  <row Id="29172" PostTypeId="1" CreationDate="2016-03-31T09:15:22.573" Score="1" ViewCount="860" Body="&lt;p&gt;I have a question about store and forward in the following setup-up. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                       Store and Forward Mechanism&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;PC1 &amp;lt;-&gt; Switch (in port) &amp;lt;-------------------------------------&gt; Switch (out port) &amp;lt;-&gt; PC2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       |                        switch                            |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The link speed between PC1 and Switch (in port) is 1Gbit/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The link speed between Switch (out port) and PC2 is 1Gbit/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder what would be the delay to send a packet of size S from PC1 to PC2? Is it going to be (2 x S / 1Gbit) or (3 x S / 1Gbit) because of the store and forward?&#xA;Does (in principle) the store and forward mechanism &quot;operate&quot; at least at 1Gbit/s frequency?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="23702" LastEditorUserId="23702" LastEditDate="2016-03-31T11:28:48.240" LastActivityDate="2016-06-29T22:20:18.963" Title="Store and forward latency" Tags="|switch|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29174" PostTypeId="2" ParentId="29171" CreationDate="2016-03-31T09:55:57.557" Score="12" Body="&lt;p&gt;These IP blocks contain exactly the same number of IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An IP is made of 4 bytes, separated by dots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each byte can take (theorically) the value from 0 to 255, meaning 256 different values, but I will be more precise just after.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/16 in CIDR notation means that the first 16 bits (or first two bytes) never change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.0.0/16 means all the IPs starting from 192.168.0.0 to 192.168.255.255 (notice 192.168 has not moved)&lt;/li&gt;&#xA;&lt;li&gt;169.254.0.0/16 means all the IPs starting from 169.254.0.0 to 169.254.255.255 (notice 169.254 has not moved)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;BUT: by convention, you cannot take the very first and the very last address of the subnet. The first is called &quot;network address&quot;, and the last is called &quot;broadcast address&quot; (it means packets sent to this last address are actually sent to all hosts in the subnet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to this convention, each /16 block contains 256 x 256 (the last two bytes) = 65536 IP, minus the first and the last address I mentioned just above, so :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;65534 IPs&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="24158" LastEditorUserId="24158" LastEditDate="2016-03-31T11:49:42.137" LastActivityDate="2016-03-31T11:49:42.137" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29175" PostTypeId="2" ParentId="29162" CreationDate="2016-03-31T10:10:46.353" Score="1" Body="&lt;p&gt;Each &quot;discovery&quot; tool, like nmap, has its own recipe in matters of discovery, and you can make some very trivial scans as some more advanced. Each tool is not equivalent in terms of capability. In order to keep my answer simple, I will not describe all the internal tricks that a complex and exhaustive tool like nmap can do. (But you can find a complete description of how nmap works just on discovery &lt;a href=&quot;https://nmap.org/book/man-host-discovery.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of host discovery &lt;em&gt;on the same subnet&lt;/em&gt;, the simplest and most basic way to do it, is to send pings to each IP address in the subnet, and expect a reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To give an answer to your question, the most widely used packets sent to do this are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ICMP type 8 (echo request), expecting a type 0 (echo reply)&lt;/li&gt;&#xA;&lt;li&gt;TCP SYN on a specific port, expecting a TCP ACK&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The problem is that you will not discover hosts which do not choose to reply, like the ones running their own firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sending a broadcast packet is not a reliable solution either, because some hosts do not reply to broadcast, often for the same reason (their own firewall).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A way to make this technique more efficient is to check immediately the ARP table of the scanning host, and to check if there is any MAC address associated with the IP we sent the packet on just before, because ARP traffic is not blocked by an IP firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to go further, ARP discover is not reliable either on some networks (like some wireless spots) where security restricts traffic only between the host and the gateway. So you will not be able to &quot;talk&quot; to other hosts directly connected to the network, excepting the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just one last thing: you are talking about &quot;the network you are connected to&quot;. If the network contains several subnets, you lose the ARP visibility as soon as you are trying to scan another subnet than the one you are in (the ARP scope is never wider than the subnet).&lt;/p&gt;&#xA;" OwnerUserId="24158" LastEditorUserId="24158" LastEditDate="2016-04-01T08:54:06.757" LastActivityDate="2016-04-01T08:54:06.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29176" PostTypeId="1" CreationDate="2016-03-31T10:14:13.273" Score="2" ViewCount="15375" Body="&lt;p&gt;The switch is running at a remote location and is connected to a network with the IP address &lt;code&gt;10.10.10.10&lt;/code&gt;. How can I change the IP address to &lt;code&gt;10.10.10.11&lt;/code&gt; via telnet? The switch has to stay reachable and must not get an IP address via DHCP.&lt;/p&gt;&#xA;" OwnerUserId="23017" LastEditorUserId="67102" LastEditDate="2021-01-12T11:03:10.553" LastActivityDate="2021-01-12T11:54:54.740" Title="How can I change the IP address of a running switch (HP 2510)?" Tags="|switch|switching|hp|hp-procurve|ip-address|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="29177" PostTypeId="2" ParentId="29168" CreationDate="2016-03-31T10:58:01.827" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.freesoft.org/CIE/RFC/2131/30.htm&quot; rel=&quot;nofollow&quot;&gt;4.4.1 Initialization and allocation of network address&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The client begins in INIT state and forms a DHCPDISCOVER message.&lt;br&gt;&#xA;  The client should wait a random time between one and ten seconds to&lt;br&gt;&#xA;  desynchronize the use of DHCP at startup.  The client sets&#xA;  'ciaddr'(client IP Address)  to 0x00000000.  The client MAY request&#xA;  specific parameters by    including the 'parameter request list'&#xA;  option.  The client MAY    suggest a network address and/or lease time&#xA;  by including the    'requested IP address' and 'IP address lease time'&#xA;  options.  The    client MUST include its hardware address in the&#xA;  'chaddr'(client hardware address) field for use in delivery of DHCP&#xA;  reply messages.  The client MAY include a different unique identifier&#xA;  in the 'client identifier' option.  If    the client does not include&#xA;  the 'client identifier' option, the    server will use the contents of&#xA;  the 'chaddr' field to identify the    client's lease.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The client generates and records a random transaction identifier&#xA;  and    inserts that identifier into the 'xid' field.  The client&#xA;  records its    own local time for later use in computing the lease&#xA;  expiration.  &lt;strong&gt;The    client then broadcasts the DHCPDISCOVER on the&#xA;  local hardware    broadcast address to 0xffffffff IP broadcast address&#xA;  and 'DHCP    server' UDP port.&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If the 'xid'(transaction id) of an arriving DHCPOFFER message does&#xA;  not match the 'xid' of the most recent DHCPDISCOVER message, the&#xA;  DHCPOFFER message    must be silently discarded.  Any arriving DHCPACK&#xA;  messages must be    silently discarded.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The client collects DHCPOFFER messages over a period of time,&#xA;  selects    one DHCPOFFER message from the (possibly many) incoming&#xA;  DHCPOFFER    messages (e.g., the first DHCPOFFER message or the&#xA;  DHCPOFFER message    from the previously used server) and extracts the&#xA;  server address from    the 'server identifier' option in the DHCPOFFER&#xA;  message.  The time    over which the client collects messages and the&#xA;  mechanism used to    select one DHCPOFFER are implementation&#xA;  dependent.  The client may    perform a check on the suggested address&#xA;  to ensure that the address    is not already in use.  For example, if&#xA;  the client is on a network    that supports ARP, the client may issue&#xA;  an ARP request for the    suggested request.  When broadcasting an ARP&#xA;  request for the    suggested address, the client must fill in its own&#xA;  hardware address    as the sender's hardware address, and 0 as the&#xA;  sender's IP address,    to avoid confusing ARP caches in other hosts&#xA;  on the same subnet.  If    the network address appears to be in use,&#xA;  the client sends a    DHCPDECLINE message to the server and waits for&#xA;  another DHCPOFFER. As    the client does not have a valid network&#xA;  address, the client must    broadcast the DHCPDECLINE message.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="20572" LastEditorUserId="8499" LastEditDate="2016-03-31T14:40:16.683" LastActivityDate="2016-03-31T14:40:16.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29178" PostTypeId="1" CreationDate="2016-03-31T11:01:49.217" Score="2" ViewCount="232" Body="&lt;p&gt;I wanted to understand how does the Sourcefire NGIPS understand which application has initiated the traffic. I am aware that the protocol is learned from the ports, but, how does it determine that so and so application has initiated this traffic? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g., RDP traffic being generated by &quot;RDP Client&quot;, HTTP traffic being generated by &quot;Mozilla Firefox&quot;&lt;/p&gt;&#xA;" OwnerUserId="6393" LastEditorUserId="8499" LastEditDate="2018-12-27T02:45:30.340" LastActivityDate="2018-12-27T02:45:30.340" Title="How does Sourcefire IPS understand which application is sending the packet?" Tags="|cisco|firewall|security|intrusion-prevention|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29179" PostTypeId="1" AcceptedAnswerId="29288" CreationDate="2016-03-31T12:19:40.680" Score="2" ViewCount="5295" Body="&lt;p&gt;I am running MX960 for a while now, and I see the minor alarms. Please can someone help on how to clear them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 alarms currently active&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Alarm time Class Description&#xA;2015-07-13 03:22:54 WAT Minor CB 2 Fabric Chip 1 Not Online&#xA;2015-07-13 03:22:53 WAT Minor CB 2 Fabric Chip 0 Not Online&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, when I run the command show chassis fabric summary, I get the following output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hw_tanyu_n@domsc-dca-2.cm&amp;gt; show chassis hardware  &#xA;Hardware inventory:  &#xA;Item             Version  Part number  Serial number     Description  &#xA;Chassis                                JN11D7BCBAFA      MX960  &#xA;Midplane         REV 03   710-013698   ACAA3047          MX960 Backplane  &#xA;FPM Board        REV 03   710-014974   ZJ3196            Front Panel Display  &#xA;PDM              Rev 03   740-013110   QCS151450MM       Power Distribution Module  &#xA;PEM 0            Rev 10   740-013683   QCS151270XZ       DC Power Entry Module  &#xA;PEM 1            Rev 10   740-013683   QCS151270UE       DC Power Entry Module  &#xA;PEM 2            Rev 10   740-013683   QCS151270WT       DC Power Entry Module  &#xA;PEM 3            Rev 10   740-013683   QCS151270WL       DC Power Entry Module  &#xA;Routing Engine 0 REV 12   740-013063   9012000137        RE-S-2000  &#xA;Routing Engine 1 REV 15   740-013063   9009077464        RE-S-2000  &#xA;CB 0             REV 10   710-021523   ZG1033            MX SCB  &#xA;CB 1             REV 10   710-021523   ZG1045            MX SCB  &#xA;CB 2             REV 10   710-021523   ZG1061            MX SCB  &#xA;FPC 0            REV 18   750-021566   ZJ9129            DPCE 4x 10GE R  &#xA;  CPU            REV 04   710-022351   ZK1084            DPC PMB  &#xA;  PIC 0                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;    Xcvr 0       REV 03   740-014289   CB19BQ04J         XFP-10G-SR  &#xA;  PIC 1                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;    Xcvr 0       REV 03   740-014289   CB19BQ094         XFP-10G-SR  &#xA;  PIC 2                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;    Xcvr 0       REV 03   740-014289   CB19BQ04E         XFP-10G-SR  &#xA;  PIC 3                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;    Xcvr 0       REV 03   740-014289   T13L07468         XFP-10G-SR  &#xA;FPC 1            REV 18   750-021566   ZJ9110            DPCE 4x 10GE R  &#xA;  CPU            REV 04   710-022351   ZK1153            DPC PMB  &#xA;  PIC 0                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;    Xcvr 0       REV 03   740-014289   CB19BQ04D         XFP-10G-SR  &#xA;  PIC 1                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;    Xcvr 0       REV 03   740-014289   CB18BQ06P         XFP-10G-SR  &#xA;  PIC 2                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;    Xcvr 0       REV 03   740-014289   CB19BQ04C         XFP-10G-SR  &#xA;  PIC 3                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;    Xcvr 0       REV 01   740-014279   JNXFL099          XFP-10G-LR  &#xA;FPC 2            REV 23   750-021679   ZK2167            DPCE 40x 1GE R  &#xA;  CPU            REV 04   710-022351   ZK1143            DPC PMB  &#xA;  PIC 0                   BUILTIN      BUILTIN           10x 1GE(LAN)  &#xA;    Xcvr 0                NON-JNPR     PM32F7Q           SFP-SX  &#xA;    Xcvr 1                NON-JNPR     AM122429K12       SFP-SX  &#xA;    Xcvr 2       REV 01   740-031850   17T459600037      SFP-LX10  &#xA;    Xcvr 3       REV 01   740-031850   17T459600022      SFP-LX10  &#xA;    Xcvr 4       REV 02   740-013111   B192241           SFP-T  &#xA;    Xcvr 5       REV 02   740-013111   B192160           SFP-T  &#xA;    Xcvr 6                NON-JNPR     AN13342D5U        SFP-T  &#xA;    Xcvr 7                NON-JNPR     AN13342D5S        SFP-T  &#xA;    Xcvr 8       REV 01   740-013111   8268923           SFP-T  &#xA;    Xcvr 9       REV 02   740-014132   PGS4SS1           SFP-T  &#xA;  PIC 1                   BUILTIN      BUILTIN           10x 1GE(LAN)  &#xA;  PIC 2                   BUILTIN      BUILTIN           10x 1GE(LAN)  &#xA;    Xcvr 0       REV 02   740-014132   PGS4SPT           SFP-T  &#xA;    Xcvr 1                NON-JNPR     AN1209QYM5        SFP-T  &#xA;    Xcvr 2                NON-JNPR     AN141487EK        SFP-T  &#xA;    Xcvr 9                NON-JNPR     FNS15208975       SFP-LX10  &#xA;  PIC 3                   BUILTIN      BUILTIN           10x 1GE(LAN)  &#xA;    Xcvr 1                NON-JNPR     EA140300181683    SFP-LX10  &#xA;    Xcvr 2       OMPATI   NON-JNPR     A2161803          SFP-LX10  &#xA;    Xcvr 3       OMPATI   NON-JNPR     A2161790          SFP-LX10  &#xA;    Xcvr 4                NON-JNPR     EA151100120133    SFP-LX10  &#xA;FPC 3            REV 30   750-021566   CACX0766          DPCE 4x 10GE R  &#xA;  CPU            REV 08   710-022351   CADA0266          DPC PMB  &#xA;  PIC 0                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;    Xcvr 0       REV 02   740-014279   URD0S29           XFP-10G-LR  &#xA;  PIC 1                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;  PIC 2                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;  PIC 3                   BUILTIN      BUILTIN           1x 10GE(LAN/WAN)  &#xA;    Xcvr 0       se-LR    NON-JNPR     1446P-10111       XFP-10G-LR  &#xA;FPC 4            REV 38   750-021679   CACK6943          DPCE 40x 1GE R  &#xA;  CPU            REV 08   710-022351   CABC1995          DPC PMB  &#xA;  PIC 0                   BUILTIN      BUILTIN           10x 1GE(LAN)  &#xA;    Xcvr 0                NON-JNPR     EC150900381704    SFP-LX10  &#xA;    Xcvr 1       REV 02   740-013111   JNGETF3068        SFP-T  &#xA;  PIC 1                   BUILTIN      BUILTIN           10x 1GE(LAN)  &#xA;  PIC 2                   BUILTIN      BUILTIN           10x 1GE(LAN)  &#xA;    Xcvr 0                NON-JNPR     EC150900380578    SFP-LX10  &#xA;  PIC 3                   BUILTIN      BUILTIN           10x 1GE(LAN)  &#xA;Fan Tray 0       REV 05   740-014971   VT0507            Fan Tray  &#xA;Fan Tray 1       REV 05   740-014971   VT0498            Fan Tray  &#xA;&#xA;{master}  &#xA;hw_tanyu_n@domsc-dca-2.cm&amp;gt;  &#xA;&#xA;&#xA;hw_tanyu_n@domsc-dca-2.cm&amp;gt; show chassis fabric summary  &#xA;Plane   State    Uptime  &#xA; 0      Online   266 days, 6 hours, 43 minutes, 49 seconds  &#xA; 1      Online   266 days, 6 hours, 43 minutes, 49 seconds  &#xA; 2      Online   1465 days, 21 hours, 25 minutes, 34 seconds  &#xA; 3      Online   1465 days, 21 hours, 25 minutes, 34 seconds  &#xA; 4      Offline  &#xA; 5      Offline  &#xA;&#xA;{master}  &#xA;hw_tanyu_n@domsc-dca-2.cm&amp;gt;  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;PS: I am not very familiar with Juniper&lt;/p&gt;&#xA;" OwnerUserId="24161" LastEditorUserId="8499" LastEditDate="2016-04-04T13:44:45.563" LastActivityDate="2016-04-04T16:39:08.400" Title="Alarm: CB 2 Fabric Chip 1 Not Online" Tags="|juniper|juniper-junos|juniper-mx|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="29180" PostTypeId="2" ParentId="29176" CreationDate="2016-03-31T12:46:35.470" Score="2" Body="&lt;p&gt;If you have more than one VLAN running (lets say 10 with 10.10.10.10 and 20 ) on the switch you could give the switch an IP address in another VLAN Interface (i. e. VLAN 20 with 20.20.20.20); check if you could connect to it (20.20.20.20) and if it is so you can change the IP address (10.10.10.10) while connected via telnet to the other VLAN interface (20.20.20.20) on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please think of it and check (2nd VLAN will be routed to your location and so on) if this will be a oppertunity for you befor doing it.&lt;/p&gt;&#xA;" OwnerUserId="21212" LastActivityDate="2016-03-31T12:46:35.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29181" PostTypeId="2" ParentId="29170" CreationDate="2016-03-31T12:46:39.797" Score="1" Body="&lt;p&gt;I think I fixed it.&#xA;Final configuration (though the ASA complained a few times about overlap) is&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network lb01&#xA;  host 192.168.72.11&#xA;&#xA;object-group service webServices&#xA; service-object tcp destination eq www &#xA; service-object tcp destination eq https&#xA;&#xA;object network lb01&#xA; nat (dmz,outside) static interface&#xA;&#xA;&#xA;access-list outside_in extended permit object-group webServices any object lb01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It works and only the ports in the service group get NAT'ed.&lt;/p&gt;&#xA;" OwnerUserId="23709" LastActivityDate="2016-03-31T12:46:39.797" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29182" PostTypeId="1" AcceptedAnswerId="29188" CreationDate="2016-03-31T12:52:18.047" Score="1" ViewCount="768" Body="&lt;p&gt;Weird.&#xA;We just got a Brocade ADX 1000 for server load balancing.&#xA;Config is setup to emulate the basic load balancer configuration in their guide (real servers, VIP and management IP are all members of the same subnet).&#xA;Yet we can't ping or reach the VIP at all, with Layer 3. We can arping it to know that it's there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this restricted by licensing (just found out the licenses are circa 2013 and 2014) or is there something wrong with our configuration? I would be grateful for any pointers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our basic configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    !&#xA;server real prod-web01 192.168.72.11&#xA; port http&#xA; port http keepalive&#xA; port http url &quot;GET /status.html&quot;&#xA; port ssl&#xA; port ssl keepalive&#xA; port ssl url &quot;GET /status.html&quot;&#xA;!&#xA;server real prod-web02 192.168.72.12&#xA; port http&#xA; port http keepalive&#xA; port http url &quot;GET /status.html&quot;&#xA; port ssl&#xA; port ssl keepalive&#xA; port ssl url &quot;GET /status.html&quot;                                  &#xA;!                                                                 &#xA;!                                                                 &#xA;server virtual prod-webVIP 192.168.72.13                       &#xA; predictor round-robin                                            &#xA; port http                                                        &#xA; port ssl sticky                                                  &#xA; bind http prod-web01 http prod-web02 http                  &#xA; bind ssl prod-web01 ssl prod-web02 ssl   &#xA;!&#xA;vlan 1 name DEFAULT-VLAN by port                                  &#xA;!                                                                 &#xA;aaa authentication web-server default local                       &#xA;enable telnet authentication                                      &#xA;enable super-user-password .....                                  &#xA;no enable aaa console                                             &#xA;hostname lb01                                                   &#xA;ip dns domain-name mng.dom                                        &#xA;ip dns server-address 8.8.8.8 192.168.71.3 192.168.71.4 192.168.71.5&#xA;ip route 0.0.0.0 0.0.0.0 192.168.72.1                             &#xA;!                                                                 &#xA;no telnet server                                                  &#xA;username admin password .....                                                                    &#xA;no snmp-server enable traps locked-addr                           &#xA;no web-management ui-history-collect                              &#xA;!                                                                 &#xA;interface management 1                                            &#xA; ip address 192.168.72.253 255.255.255.0                          &#xA;!                                                                 &#xA;interface ethernet 1                                              &#xA; ip address 192.168.70.70 255.255.255.0                           &#xA;!                                                                 &#xA;access-list 10 permit any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23709" LastActivityDate="2016-04-01T09:06:02.220" Title="Brocade ADX 1000 load balancing: Can't reach the VIP" Tags="|brocade|load-balancer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29183" PostTypeId="1" CreationDate="2016-03-31T13:34:17.560" Score="1" ViewCount="3499" Body="&lt;p&gt;I recently took a job at a school. This is only my second position as an IT professional. My only experience with corporate networks is in a large school district at another school. They used VLANs to separate traffic based on device type: VoIP, wireless APs, desktops etc. They had one domain with an extensive OU tree to manage AD, and all VLANs were bridged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At my new position, the network is set up far differently. They use three different domains at each site to segregate each user and device type. One domain each for admin and teacher, classroom, and lab computers. Each domain gets a VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a common implementation? I want to find out what the best practice would be, and if this can cause network performance issues.  &lt;/p&gt;&#xA;" OwnerUserId="24162" LastEditorUserId="24162" LastEditDate="2016-03-31T18:22:22.210" LastActivityDate="2016-03-31T18:22:22.210" Title="General best practice for VLANs and domains" Tags="|vlan|design|best-practices|performance|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29184" PostTypeId="2" ParentId="29183" CreationDate="2016-03-31T14:13:06.837" Score="2" Body="&lt;p&gt;You may consider the following general guidelines when implementing VLANs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Grouping devices by traffic patterns – Devices that communicate&#xA;extensively between each other are good candidates to be grouped into&#xA;a common VLAN. &lt;/li&gt;&#xA;&lt;li&gt;Grouping devices for security – It is often a good    practice to put&#xA;servers and key infrastructure in their own VLAN,    isolating them&#xA;from the general broadcast traffic and enabling    greater&#xA;protection.&lt;/li&gt;&#xA;&lt;li&gt;Grouping devices by traffic types – As discussed&#xA;in this How To, VoIP quality is improved by isolating VoIP devices to&#xA;their own VLAN. Other traffic types may also warrant their own VLAN.&#xA;Traffic types include network management traffic, IP multicast&#xA;traffic such as video, file and print services, email, Internet&#xA;browsing, database access, shared network applications, and traffic&#xA;generated by peer-to-peer applications. &lt;/li&gt;&#xA;&lt;li&gt;Grouping devices geographically – In a network with limited&#xA;trunking, it may be    beneficial to combine the devices in each&#xA;location into their own    VLAN.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In your case (if I got it right) looks like they are grouping VLANS by &quot;Department&quot; (teachers, labs, classrooms...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you may find some useful information regarding network implementation on an educational environment (Chapter 3): &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Education/SchoolsSRA_DG/SchoolsSRA-DG.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/solutions/Enterprise/Education/SchoolsSRA_DG/SchoolsSRA-DG.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21236" LastActivityDate="2016-03-31T14:13:06.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29185" PostTypeId="2" ParentId="29178" CreationDate="2016-03-31T14:54:08.363" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am aware that the protocol is learnt from the ports...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is the way conventional firewalls do it. Next-Gen firewalls and IPSs can do deep packet inspection, among other things, to determine what the traffic is. For instance, it will read the payload of packets in a flow, and it can see that the HTTP requests are coming from Mozilla Firefox the same way that the HTTP server can: by the contents of the HTTP requests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since software changes all the time, and new software regularly appears, it is important that you keep the code on the device up to date; a subscription is mandatory for current protection.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-03-31T15:53:54.800" LastActivityDate="2016-03-31T15:53:54.800" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29187" PostTypeId="1" CreationDate="2016-03-31T16:26:42.190" Score="2" ViewCount="941" Body="&lt;p&gt;I'm investigating an issue with an iPhone controllable hardware, which operates in IBSS / Ad Hoc mode. Since the hardware generation of iPhone6 &amp;amp; Co the iDevices can't connect to the hardware anymore, which creates the wifi network with a deprecated Microchip 802.11 b listening only to 1 / 2 Mbit / s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've narrowed down the problem with wireshark (see screenshots):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) The Microchip wifi Beacon announces the network, I assume the BSSID is randomly assigned in IBSS / Ad Hoc mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.a) The iPhone5 sends a probe request to destination broadcast and receives the probe response announcing that the Microchip can only listen on 1 / 2 Mbit / s. Further conversation works just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.b) The iPhone6 sends a probe request to the randomly assigned BSSID and never receives a probe response, therefore not knowing that the Microchip can only listen on 1 / 2 Mbit / s and starts talking at 12 Mbit / s in further conversation, which obviously doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question now is which of the two wifi firmwares behaves not according to the 802.11-2012 standard?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either iPhone6 Broadcom WiFi firmware, that sends the Probe Request to the BSSID of the Ad Hoc network (instead of the MAC of the Microchip WiFi chip or the Microchip firmware, that doesn't answer the Probe Request when sent to the BSSID of the Ad Hoc network it created initially?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't found anything in the 802.11-2012 standard, yet, what the appropriate destination address of a probe request in an 802.11 Ad Hoc network would be (broadcast or the BSSID of the beacon). Is there an expert out there, who can give some insights and probably references to the standard where that is defined?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've attached the captured packets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://owncloud.tu-berlin.de/index.php/s/2rCwF4DefWhyBOs&quot; rel=&quot;nofollow&quot;&gt;iPhone6 - not working&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://owncloud.tu-berlin.de/index.php/s/KZCqAO1hxyFdh9J&quot; rel=&quot;nofollow&quot;&gt;iPhone5 - working&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Microchip WiFi chip is 00:1e:c0:08:32:1b,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the iPhone6 is 74:1b:b2:81:7d:69,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the iPhone5 is 00:88:65:8c:33:AA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are some relevant packets in the iPhone6 capture:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;186 Probe Requests from iPhone6 to unknown MAC 7a:7b:01:79:c4:b5 regarding SSID=Anova at 1Mbit        (I assume randomly assigned MAC for Ad Hoc / IBSS)&#xA;No Probe Response, cause there is no device with that MAC…&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;203… Null Function from iPhone6 to Anova at 6Mbit&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;210 first Beacon from iPhone6 with SSID=Anova at 1Mbit&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;294 … WEP join? from iPhone6 via IPv6mcast_16/_fb/_02 at 12Mbit (as the Microchip chip understands 1 / 2Mbit only this ends in nothing&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The iPhone5 addresses the Microchip WiFi chip with it's MAC address correctly, not with the randomly assigned BSSID.&lt;/p&gt;&#xA;" OwnerUserId="24168" LastEditorUserId="33" LastEditDate="2016-04-07T22:26:42.700" LastActivityDate="2016-04-07T22:26:42.700" Title="Destination address in a probe request in an 802.11 Ad Hoc network?" Tags="|ieee-802.11|ad-hoc-wireless|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="29188" PostTypeId="2" ParentId="29182" CreationDate="2016-03-31T17:08:04.590" Score="1" Body="&lt;p&gt;Fixed.&#xA;Apparently I am not supposed to add the VIP to the network the mgmt1 interface is on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Had to use the dsr method in order to get the load balancing to function.&#xA;Can't complain but I would have like to do it without dsr (having to create loopback interfaces on the real servers, with the VIP's address).&lt;/p&gt;&#xA;" OwnerUserId="23709" LastEditorUserId="23709" LastEditDate="2016-04-01T09:06:02.220" LastActivityDate="2016-04-01T09:06:02.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29195" PostTypeId="2" ParentId="29176" CreationDate="2016-03-31T20:33:18.800" Score="3" Body="&lt;p&gt;It can be problematic to change an address remotely. The best option is to do it in person from the directly attached console. To move the switch to a different subnet, that is indeed what is required. In your case, it's still in the same subnet with the same gateway, so you can just telnet in and change it. The instant the command is entered, your telnet session will stop, but you should be able to telnet to the new address and continue. (save the config, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When moving to a different subnet, the gateway has to be changed as well. You'll lose contact the instant either the gateway or address are changed. And the address has to change first. If you have machines in both networks, and changing the address of the switch will not otherwise break the network, then logging in to each network allows you a &lt;em&gt;local&lt;/em&gt; path (not through a gateway) to the switch in either subnet. Change the address, go to the machine in the other network and continue your work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have console (out-of-band) access, none of this mess is required.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-03-31T20:33:18.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29196" PostTypeId="2" ParentId="29172" CreationDate="2016-03-31T20:37:55.803" Score="1" Body="&lt;p&gt;Internal switching delay will be down in the nanoseconds. Thus you're only looking at the time to receive the frame plus the time to transmit the frame. I.e. a hair over 2S when there's zero contention.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-03-31T20:37:55.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29198" PostTypeId="2" ParentId="29160" CreationDate="2016-03-31T22:43:13.337" Score="1" Body="&lt;p&gt;As he is using CRS switches correct links would be:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:CRS_examples&quot; rel=&quot;nofollow&quot;&gt;CRS examples&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:CRS_features&quot; rel=&quot;nofollow&quot;&gt;CRS features&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Basically, what I would do is reset the switch and make all ports part of the same switch with ether1 being the master port. Then I would specify VLAN for separation and proper tagging for trunk ports. This way you would have full speed switching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generic VLAN stuff on Mikrotik is CPU bound so while it would work on CRS it would not be very fast.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2016-03-31T22:43:13.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29199" PostTypeId="1" AcceptedAnswerId="29200" CreationDate="2016-04-01T02:24:03.713" Score="0" ViewCount="291" Body="&lt;p&gt;In my working environment that I managed for almost 2 years running network that had multiple subnet on it .The subnet are 192.168.61.0/24 and 192.168.64.0/24. The question is the subnet was run without logically separated with VLAN or physically separated with LAN, but it run well and how it possible? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because as I know in order those 2 subnet to work it must on the same subnet mask and in this case it would be using netmask /17 or the network must be separated either with a LAN or VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main switch HP ProCurve 2530-48G which is connected with router SonicWall TZ105 and it is connected with only 1 port on the router (X0). The switch was managed by me and the router was managed by our HQ in Japan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the diagram of our network:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/V3sQb.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V3sQb.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Nzi0Z.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nzi0Z.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8154" LastActivityDate="2016-04-01T02:29:01.363" Title="Multiple subnet exist on not seperated network segment?" Tags="|subnet|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29200" PostTypeId="2" ParentId="29199" CreationDate="2016-04-01T02:29:01.363" Score="4" Body="&lt;p&gt;It may be seen, today, as a poor design, but it's a perfectly valid configuration. The nodes in one subnet are mostly unaware of those in the other subnet. (yes, they can see each others broadcast traffic, but it isn't a problem.) This is no different from running other layer-3 protocols within the same broadcast domain.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-04-01T02:29:01.363" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29203" PostTypeId="1" CreationDate="2016-04-01T09:38:52.540" Score="0" ViewCount="384" Body="&lt;p&gt;I'm new to OVS and I'm working on an OVS project, and i read a lot of documents about it but i didn't find anything that can make things clear to me about matching a packet and in userspace and datapath and if there is a match then what the ovs do ?&#xA;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="24185" LastActivityDate="2016-04-14T10:51:28.613" Title="Matching a packet in OVS" Tags="|switch|openflow|packet-path|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29207" PostTypeId="2" ParentId="25032" CreationDate="2016-04-01T11:04:16.523" Score="-2" Body="&lt;p&gt;You can test you bandwidth width the good old speedtest via CLI : &lt;a href=&quot;https://blog.nousefreak.be/blog/cli-speedtest&quot; rel=&quot;nofollow&quot;&gt;https://blog.nousefreak.be/blog/cli-speedtest&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24187" LastActivityDate="2016-04-01T11:04:16.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29208" PostTypeId="2" ParentId="25032" CreationDate="2016-04-01T11:17:04.363" Score="2" Body="&lt;p&gt;I'm not aware of what Red5 in particular is/how it uses the bandwidth, but with voice and videoconferencing, bandwidth itself is just half of the story. You need to check for jitter and delay, which are critical for that kind of applications. If jitter is high, you'll experience what you're describing: &quot;choppy&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have Cisco routers at customer, you can use IP SLA[1] to test for video/voice, along with very detailed analysis of performance data. Measuring bandwidth is not enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[1]. &lt;a href=&quot;http://www.cisco.com/c/dam/en_us/solutions/medianet/docs/IP_SLA_Video_Operation_Across_Platforms.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/dam/en_us/solutions/medianet/docs/IP_SLA_Video_Operation_Across_Platforms.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2016-04-01T11:17:04.363" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29210" PostTypeId="1" AcceptedAnswerId="42306" CreationDate="2016-04-01T12:49:17.160" Score="1" ViewCount="13533" Body="&lt;p&gt;I tried connecting to the switch console. But I always get black screen and can't type anything. I changed the speed to different values ( | 1200 | 2400 | 4800 | 9600 | 19200 |38400 | 57600), I still get the same black screen.&lt;/p&gt;&#xA;" OwnerUserId="22889" LastActivityDate="2019-02-23T03:00:18.897" Title="Cannot access serial connection with putty to the HP Procurve 2524" Tags="|switch|hp-procurve|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="29216" PostTypeId="1" CreationDate="2016-04-01T17:10:12.820" Score="1" ViewCount="1797" Body="&lt;p&gt;A solution I was given for this question...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*THE CIDR block includes all addresses of the form 1010 1010 0001 **** **** **** **** **** (where * may be 0 or 1). Thus this block represents the IP addresses from 172.16.0.0 to 172.31.255.255. The netid is 1010 1010 0001 and the CIDR block contains 2^20 addresses.*&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I fully understand that the CIDR block has 2^20 host ID addresses and that it is in a Class B network. I thought I could simply state that the netid is 172.16 but I am meant to provide it in binary form, however I cannot understand how this translates to 1010 1010 0001.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that 00010000 represents 16 and I understand why there are only 12 bits of the netid but I don't understand where 1010 1010 came from as this represents 170. I would have put 1010 1100 representing 172.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also don't understand how the block represents the IP addresses from 172.16.0.0 to 172.31.255.255. I have done alot of research on the internet but I can't seem to find anything that will help out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone could possibly provide an explanation I would really appreciate it.&lt;/p&gt;&#xA;" OwnerUserId="24157" OwnerDisplayName="ellefc" LastActivityDate="2016-04-01T19:07:43.153" Title="What range of IP addresses is represented by the CIDR block 172.16.0.0/12?" Tags="|ip|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29217" PostTypeId="2" ParentId="29216" CreationDate="2016-04-01T17:28:25.003" Score="0" Body="&lt;p&gt;While I cannot see that this in security related in any way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to your first question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;172 in binary should be 10101100, as you stated. This looks like a mistake in writing of the source you got the answer from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to your second question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you express the octets in decimal form with dots separating them, think of that as half of the second octet is &quot;counting up&quot;, i.e. goes from &lt;/p&gt;&#xA;&#xA;&lt;p&gt;16 (00010000) to 17 (00010001)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;all the way up to&lt;/p&gt;&#xA;&#xA;&lt;p&gt;31 (00011111).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So much to the 16 to 31 gap.&lt;/p&gt;&#xA;" OwnerDisplayName="SmokeDispenser" LastActivityDate="2016-04-01T17:28:25.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29218" PostTypeId="2" ParentId="29216" CreationDate="2016-04-01T17:28:44.237" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I don't understand where 1010 1010 came from as this represents 170. I would have put 1010 1100 representing 172.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You are right and the solution sheet is wrong. Probably just a typo on the part of whoever wrote the solution sheet.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;also don't understand how the block represents the IP addresses from 172.16.0.0 to 172.31.255.255.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;1010 1100 0001 0000 0000 0000 0000 0000 is 172.16.0.0&lt;br&gt;&#xA;1010 1100 0001 1111 1111 1111 1111 1111 is 172.31.255.255&lt;/p&gt;&#xA;" OwnerUserId="20201" OwnerDisplayName="Peter Green" LastEditorUserId="8499" LastEditDate="2016-04-01T19:07:43.153" LastActivityDate="2016-04-01T19:07:43.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29219" PostTypeId="2" ParentId="29216" CreationDate="2016-04-01T17:33:31.233" Score="1" Body="&lt;p&gt;The answer is incorrect (hey, it happens).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are right that 172 is 0x10101100.  That was a mistake on their part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 20 bits of host address, when added to the netid, give you all the addresses from 172.16.0.0 to 172.31.255.255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Honestly, IMO, they're making it more complicated than it needs to be.  I've been doing this a long time and the only time I see things like &quot;netid&quot; is in textbooks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more point:  Address classes (A,B, C) were replaced by CIDR (The C stands for Classless), so it makes no sense to say it's a class B address.  Furthermore all that happened in 1993 (I'm guessing before you were born), so address classes are very much obsolete. Yet, for some reason, they keep teaching it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-01T17:33:31.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29221" PostTypeId="1" AcceptedAnswerId="29222" CreationDate="2016-04-01T19:25:02.120" Score="2" ViewCount="132" Body="&lt;p&gt;I am familiar with trunk ports (switchport mode trunk) and access ports (switchport mode access), but what is the proper term for a port that does not have a &lt;code&gt;switchport mode&lt;/code&gt; command? It wouldn't be a trunk port or a switchport so do you just call it a port?&lt;/p&gt;&#xA;" OwnerUserId="22530" LastEditorUserId="8499" LastEditDate="2016-04-01T19:43:31.673" LastActivityDate="2016-04-07T23:47:48.053" Title="Interface Terminology" Tags="|cisco|switch|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29222" PostTypeId="2" ParentId="29221" CreationDate="2016-04-01T19:42:19.970" Score="2" Body="&lt;p&gt;In the context of switch ports, any port that has no explicitly stated &lt;em&gt;mode&lt;/em&gt; is using the default (access). In the context of non-switch ports, we don't call those &quot;&lt;em&gt;ports&lt;/em&gt;&quot;; we call them &quot;&lt;em&gt;interfaces&lt;/em&gt;&quot; -- short for &lt;em&gt;routed interface&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Yes, you'll find &lt;em&gt;port&lt;/em&gt; and &lt;em&gt;interface&lt;/em&gt; used interchangeably.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-04-01T19:42:19.970" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29223" PostTypeId="1" CreationDate="2016-04-01T20:00:49.563" Score="1" ViewCount="175" Body="&lt;p&gt;Youtube had previously registered the CIDR block 208.65.152.0/22 that contains the IP addresses 208.65.152.0 - 208.65.155.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pakistan then registered the CIDR block 208.65.153.0/24 that contains the IP addresses 208.65.153.0 - 208.65.153.255. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to the longer prefix, Youtube traffic was thus directed to Pakistan however what about the IP addresses 208.65.152.0-208.65.152.255 that is not contained in Pakistan's newly registered CIDR?  Was traffic still delivered there? #confused&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would appreciate clarification here! Thanks&lt;/p&gt;&#xA;" OwnerUserId="24157" LastActivityDate="2016-04-02T00:37:38.180" Title="Was ALL Youtube traffic diverted to Pakistan despite some IP addresses not falling in the CIDR block that Pakistan registered. block" Tags="|ipv4|ip-address|" AnswerCount="1" CommentCount="2" ClosedDate="2016-04-03T09:34:02.673" ContentLicense="CC BY-SA 3.0" />
  <row Id="29227" PostTypeId="2" ParentId="28716" CreationDate="2016-04-01T21:34:31.453" Score="1" Body="&lt;p&gt;I've given this a lot of thought and I am attaching a technical drawing of my own. Especially the CIST and CST part in BenjaminDale's drawing didn't really make sense to me: why would the CIST be linking the instances? I currently see it the following way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4YY2A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4YY2A.png&quot; alt=&quot;Spanning Tree Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's discuss.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2016-04-01T21:34:31.453" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29228" PostTypeId="1" AcceptedAnswerId="29229" CreationDate="2016-04-01T23:04:45.170" Score="3" ViewCount="476" Body="&lt;p&gt;Let us say there are two Networks: A (10.100.90.0) and B(192.168.1.0). Network A has a DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We know that when multiple devices are connected to network A, the devices get the IP address from the DHCP server connected to network A (e.g. 10.100.90.1,100.100.90.2 etc.). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let us say we have connected to a (new) switch to network A. The devices connected to this switch get IP addresses from the DHCP server in network A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LnqT5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LnqT5.png&quot; alt=&quot;Network Configuration&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As we see in the diagram, there is a router in between two networks. I am using a load balancing router. I want the Laptop 0 to get its IP address from the DHCP server connected on the network A side (ignore the server on Network B side; it does nothing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I should change the way I ask the question!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I use a (external) DHCP server instead of the router to assigning the IP addresses to the devices connected to it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update-1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ip-Helper address command works!!! But the DHCPREQUEST Packet is being rejected by the DHCP Server. No DHCPOffer is being sent back to the client?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update-2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I added a pool of addresses for network B in DHCP server and laptop 0 was able to get an ip address from the DHCP Server! :-)&lt;/p&gt;&#xA;" OwnerUserId="24207" LastEditorUserId="24207" LastEditDate="2016-04-02T00:18:28.587" LastActivityDate="2016-04-02T00:18:28.587" Title="I am trying to configure DHCP to assign IP Address from other network!" Tags="|switch|router|dhcp|internet|network-access|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29229" PostTypeId="2" ParentId="29228" CreationDate="2016-04-01T23:42:37.993" Score="1" Body="&lt;p&gt;Your DHCP server can serve addresses for both LANs, but the configuration of the server is off-topic here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want Laptop 0 on Network B to get an address from the DHCP server on Network A, you need to put in a helper address on the router interface for Network B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1 ! assuming this is the interface for Network B&#xA; ip helper-address 10.100.90.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, you can use an external DHCP server. I detailed how to do that above. This is how DHCP is done in large deployments so that the DHCP servers can be consolidated. You can have multiple helper addresses to servers in separate places for redundancy, and the hosts will use whichever responds first.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-01T23:47:43.363" LastActivityDate="2016-04-01T23:47:43.363" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29230" PostTypeId="1" AcceptedAnswerId="29232" CreationDate="2016-04-02T00:05:13.517" Score="1" ViewCount="93" Body="&lt;p&gt;In my company I have a LAN 192.168.100.0/24. My desktop PC at work has an IP address 192.168.100.100 and LogMeIn IP 25.50.70.30. Only from inside that LAN I can access my server located at 192.168.101.20 in a subnet 192.168.101.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my house via internet I use a laptop with LogMeIn Hamachi to connect to my desktop in a company. The laptop has LogMeIn IP 25.50.60.30. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What command I have to use to add persistent rout in the laptop, that I can ping and RDP from the laptop from my home to the server at work?&lt;/p&gt;&#xA;" OwnerUserId="20555" LastActivityDate="2016-04-02T02:59:39.703" Title="How to configure persistent routes?" Tags="|routing|lan|" AnswerCount="1" CommentCount="2" ClosedDate="2016-04-02T08:12:40.190" ContentLicense="CC BY-SA 3.0" />
  <row Id="29231" PostTypeId="2" ParentId="29223" CreationDate="2016-04-02T00:37:38.180" Score="1" Body="&lt;p&gt;The most specific route is preferred. 24 is longer (&quot;more specific&quot;) than 22, so it will be used. If they announced only one /24, then they only took over that one /24 out of the larger /22.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-04-02T00:37:38.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29232" PostTypeId="2" ParentId="29230" CreationDate="2016-04-02T02:59:39.703" Score="1" Body="&lt;p&gt;Short answer:  you can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your desktop PC is behind a firewall which both prevents external devices (like your home PC) from initiating connections to internal devices andalso provides network address translation (NAT) where the internal IP 192. 168.100.100 gets translated to a public address.   This translation is temporary -- it only lasts as long as the PC is connecting to external devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These firewall features are put in place to protect the organization from external attacks  What you are asking to do is defeat these protections, which puts your organization at risk from Internet attacks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logmein acts as an intermediary -- your desktop PC connects to it, and so does your home PC.  Logmein then bridges the two connections together so you can control your desktop from home.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need remote access to your PC or server, ask your administrator if VPN access is possible.  If not, Logmein is the next best thing, assuming your compnay approves of what you're doing.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-02T02:59:39.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29233" PostTypeId="1" CreationDate="2016-04-02T03:03:13.353" Score="0" ViewCount="1161" Body="&lt;p&gt;I have very little knowledge of the Cisco ASR series. We are planning to buy a ASR 1001X series router, but I have a  question related to hardware redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to buy two Cisco ASR series routers, or will a single ASR be enough, and it will provide all kinds of redundancy? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am clueless about this hardware. Please advice me how I can make low cost advantage of an ASR, because buying two routers is expensive.   &lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2018-12-23T04:24:14.493" LastActivityDate="2018-12-23T04:24:14.493" Title="ASR 100X series hardware redundancy?" Tags="|cisco|router|network-core|redundancy|cisco-asr|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29234" PostTypeId="2" ParentId="29233" CreationDate="2016-04-02T03:17:48.727" Score="1" Body="&lt;p&gt;You can search Cisco for this type of information. For instance, the Cisco document, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/asr1000/configuration/guide/chassis/asrswcfg/High_Availability.html#pgfId-1058882&quot; rel=&quot;nofollow noreferrer&quot;&gt;High Availability Overview&lt;/a&gt;, has a table:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Hardware Redundancy Overview on the Cisco ASR 1000 Series Routers&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Some models of the Cisco ASR 1000 Series Routers offer hardware&#xA;  redundancy within the same Cisco ASR 1000 Series Router through the&#xA;  following methods:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Allowing two Route Processors (RPs) in the same Cisco ASR 1000 Series    Router&lt;/li&gt;&#xA;  &lt;li&gt;Allowing two Enhanced Services Processors (ESPs) in the same Cisco    ASR 1000 Series Router&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;No hardware redundancy is supported for the following hardware:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;SPA interface processors (SIPs)—A SIP must be reloaded, and traffic    briefly interrupted, for a SIP upgrade to complete.&lt;/li&gt;&#xA;  &lt;li&gt;Shared port adapters (SPAs)—A SPA must be reloaded, which will    briefly interrupt traffic to that SPA, for a SPA software subpackage&lt;br&gt;&#xA;  update to complete.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Hardware redundancy on the Cisco ASR 1000 Series Routers gives users&#xA;  the following benefits:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;A failover option—If a processor fails, the standby processor    immediately becomes the active processor with little or no delay. The &#xA;  failover happens completely within the same router, so a second&lt;br&gt;&#xA;  standby router is not needed.&lt;/li&gt;&#xA;  &lt;li&gt;No downtime upgrades—Using features like ISSU, a software upgrade can    be handled on the standby processor while the active processor &#xA;  continues normal operation.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Hardware redundancy is available on the Cisco ASR 1006 Router only at&#xA;  this time.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;provides a hardware redundancy overview.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cCPB4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cCPB4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you can see, it depends on the particular router model and part.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-02T03:44:16.203" LastActivityDate="2016-04-02T03:44:16.203" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29238" PostTypeId="2" ParentId="29091" CreationDate="2016-04-02T09:17:53.197" Score="3" Body="&lt;p&gt;After doing a &quot;sidegrade&quot; from 15.2M to 12.2SRE on the router, the following configuration now works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 80 permit &amp;lt;UP.STREAM.NTP.SERVER&amp;gt; log&#xA;access-list 81 permit &amp;lt;MY.CLIENT.NETWORK&amp;gt; log&#xA;ntp logging&#xA;ntp access-group peer 80&#xA;ntp access-group serve-only 81&#xA;ntp update-calendar&#xA;ntp server &amp;lt;UP.STREAM.NTP.SERVER&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;..of course, going from 15.2M to 12.2SRE means there is no longer any IPv6 support, but it proves that the issue is an IOS regression. I am going to try the latest 15.2M as soon as possible and then open a ticket with the TAC if the issue persists there.&lt;/p&gt;&#xA;" OwnerUserId="24086" LastActivityDate="2016-04-02T09:17:53.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29239" PostTypeId="1" AcceptedAnswerId="29240" CreationDate="2016-04-02T11:01:18.773" Score="3" ViewCount="1092" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zl5AR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zl5AR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Segment 237, the client (10.xxx) sends a POST request to server (128xxx) with a payload of (TCP Len) 4096.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Segment 238, the client continue with the transmission with a payload of 1460 (seq 4097-5557)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-239, the server 128.x.x.x acknowledges the receipt of segment 238 with an Ack=1461 (right??)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point it seems the Ack for 237 is missing, because the server hasn’t received it (the first 1-4096 bytes of data) yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-However, at 243, the server tells the client, the server is actually missing data with sequence number from 1-1460 (these missing data is from segment 237, and not 238??), and sequence number 1461-4097 (partially from 237) has been received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-244, the server updates the SACK, saying it is missing data with sequence number from 1-1460, and sequence number 1461-5557 has been received (assuming the seq num between 4097-5557 is from segment 238 which the server acknowledged previous in 239).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I interrupting this correctly? Please correct me if I am wrong, because I do not see any retransmission of the missing seq num 1-1460 later on in the trace: &lt;a href=&quot;https://www.cloudshark.org/captures/1a890ba09b92&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cloudshark.org/captures/1a890ba09b92&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be greatly appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="21504" LastEditorUserId="8499" LastEditDate="2018-02-16T03:57:37.493" LastActivityDate="2018-02-16T03:57:37.493" Title="Wireshark trace - POST data with SLE and SRE missing sequence numbers" Tags="|ethernet|wireless|tcp|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29240" PostTypeId="2" ParentId="29239" CreationDate="2016-04-02T11:38:43.757" Score="2" Body="&lt;p&gt;I think you are misinterpreting the initial ACK. That first segment is 4150 bytes long, which is way more than you can fit into most standard segments, and is typically an indication that the host is doing TCP Large Segment Offload, which allows the application layer (including PCap) to think you are sending large segments, but the NIC is actually splitting them into smaller segments compatible with the MSS/MTU limitations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here instead of sending one segment with a data size of 4096 bytes, you are probably sending three: two of 1460 bytes, and one of 1176 bytes (or something like that). So frame 238 in this capture is actually the 4th segment &lt;em&gt;actually&lt;/em&gt; sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The series of ACKs looks bizarre, as if you had out of order packet delivery in this network. It would have seemed more logical if you had first received segment 243 &amp;amp; 244 (you got the segment for bytes 1461 to 5557, so you SACK that) and then the first packet arrived and got ACKed (packet 239), and then at packet 245 everything gets caught up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I honestly don't see how you can end up with this particular sequence of segments, unless:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There are multiple paths of different latency being taken by packets&#xA;from the client to the server,&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;There is something which is fiddling with the initial ACK, sending&#xA;it even though the server hasn't actually received that first&#xA;segment.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Could there be a WAN optimization device such as a Riverbed somewhere between client and server? They have mechanisms which try to ACK some segments as quickly as possibly in order to accelerate the session's throughput ramp-up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I may be completely wrong here; that's a really unusual sequence!&lt;/p&gt;&#xA;" OwnerUserId="21892" LastEditorUserId="8499" LastEditDate="2016-04-02T14:25:07.357" LastActivityDate="2016-04-02T14:25:07.357" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29242" PostTypeId="1" AcceptedAnswerId="29243" CreationDate="2016-04-02T15:42:41.507" Score="3" ViewCount="4679" Body="&lt;p&gt;I am wondering if the following scenario is possible to setup VRRP using two routers (and forgetting about network redundancy upstream or redundancy on the switch): &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Data center provides 1 single uplink cable to their network.&lt;/li&gt;&#xA;&lt;li&gt;Data center provides 4 separate IP allocations to me (all on separate&#xA;subnets).&lt;/li&gt;&#xA;&lt;li&gt;Connect the DC uplink cable to a single switch.&lt;/li&gt;&#xA;&lt;li&gt;Connect the WAN ports of both router to the same switch as the DC uplink cable.&lt;/li&gt;&#xA;&lt;li&gt;Setup a Virtual IP between the two routers (on the WAN side).&lt;/li&gt;&#xA;&lt;li&gt;Have a second switch with both routers LAN ports being connected to this.&lt;/li&gt;&#xA;&lt;li&gt;Have a virtual IP for both routers on the LAN side.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is the above the correct way to achieve this? Or would the routers need to be directly connected via two uplinks to the DC routers?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the above scenario does work, how should I go about protecting the switch from being exposed on the WAN side of the routers (firewall) - as there is a web / ssh management interface - any tips?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Lastly, can I assign the multiple IP allocations (on separate subnets) to my both routers, even though the routers are not directly connected to the DC routers, but passing through the WAN side switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any assistance (and forgive my ignorance).&lt;/p&gt;&#xA;" OwnerUserId="24217" LastEditorUserId="8499" LastEditDate="2018-12-23T04:25:28.293" LastActivityDate="2018-12-23T04:25:28.293" Title="How to setup VRRP with two routers and a single uplink (Internet connection)" Tags="|switch|router|vrrp|ubiquiti|fhrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29243" PostTypeId="2" ParentId="29242" CreationDate="2016-04-02T16:07:09.837" Score="1" Body="&lt;p&gt;You can use VRRP, assuming your routers support it, but it requires at least two or three IP addresses in the same network. You need an address for each of the routers, and one address for the virtual address (some implementations of VRRP allow the virtual address to be the real address of one of the routers). The routers also need to be able to communicate with each other on the LAN where VRRP is used. You do this by connecting the router interfaces to the same layer-2 LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing this on the WAN side of your routers will give the Data Center redundant access to your routers, but you will still have a Single-Point-of-Failure from your routers to the Data Center. The network for your link to the Data Center must be, at most, &lt;code&gt;/29&lt;/code&gt;, since any longer mask will not provide more than two usable addresses, and the link will require, at least, three addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing this on the LAN side of your routers provides the hosts on the LAN with router redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To protect the switch, you could place a transparent firewall between the Data Center and the switch, or you could use an unmanaged switch. You may want the firewall if your routers need protection, too. If your Data Center link only has two addresses, the firewall could terminate the link, and then it can provide a different network for your routers. Placing a router between your equipment and the Data Center creates another SPoF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers route between networks, so having multiple networks attached to a router is normal.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-02T16:07:09.837" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29247" PostTypeId="2" ParentId="13307" CreationDate="2016-04-02T21:12:31.180" Score="1" Body="&lt;p&gt;I guess the answer is that there is no answer, except that there is no standard that has stated this requirement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, you have to perform half a dozen lookups &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/44800-mactoport44800.html&quot; rel=&quot;nofollow&quot;&gt;like this&lt;/a&gt; when you'd like to use SNMP or some management GUI (which often use snmp in their backend) while the CLIs normally have a command ready to just show the addresses in one single step.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2016-04-02T21:12:31.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29248" PostTypeId="2" ParentId="6260" CreationDate="2016-04-02T21:17:28.927" Score="0" Body="&lt;p&gt;In fact we never really found out what was going on here. In the meantime the DC switches were replaced with higher end gear since there had been other problems with those devices.&lt;/p&gt;&#xA;" OwnerUserId="2329" LastActivityDate="2016-04-02T21:17:28.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29250" PostTypeId="1" CreationDate="2016-04-03T06:08:40.140" Score="6" ViewCount="1248" Body="&lt;p&gt;I am trying to configure inter-VLAN routing, but I can't route using MLS. I attached the image. Please check and give the answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In switch0 I created VLANs 2 and 4; in switch1 only VLAN 3; in switch2 VLANs 5 and 6. I want to communicate between all the VLANs. Please tell me the configuration in L3 switch. I have not configured that because of lack of knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please refer to the image and give me reply, thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the IP addresses which I gave to the corresponding VLANs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 2 IP = 192.168.11.0&lt;/li&gt;&#xA;&lt;li&gt;VLAN 3 IP = 192.168.12.0&lt;/li&gt;&#xA;&lt;li&gt;VLAN 4 IP = 192.168.13.0&lt;/li&gt;&#xA;&lt;li&gt;VLAN 5 IP = 192.168.14.0&lt;/li&gt;&#xA;&lt;li&gt;VLAN 6 IP = 192.168.15.0&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YXqNv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YXqNv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The layer-3 switch configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing &#xA;! &#xA;spanning-tree mode pvst &#xA;! &#xA;interface FastEthernet0/1&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk &#xA;! &#xA;interface FastEthernet0/2&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk &#xA;! &#xA;interface FastEthernet0/3&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk &#xA;! &#xA;! &#xA;interface Vlan1&#xA; no ip address&#xA; shutdown &#xA;interface Vlan2&#xA; ip address 192.168.11.100 255.255.255.0&#xA;interface Vlan4&#xA; ip address 192.168.13.100 255.255.255.0 &#xA;interface Vlan5&#xA; ip address 192.168.14.100 255.255.255.0 &#xA;interface Vlan6&#xA; ip address 192.168.15.100 255.255.255.0 &#xA;ip classless&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch 0 configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW0#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1163 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SW0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;end              &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch 1 configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1&amp;gt;&#xA;SW1&amp;gt;en&#xA;SW1#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1290 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SW1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/5&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch 2 configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW2#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1140 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SW2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 5&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 6&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24225" LastEditorUserId="8499" LastEditDate="2018-03-17T01:13:20.673" LastActivityDate="2018-03-17T01:13:20.673" Title="Inter-VLAN Routing" Tags="|routing|switch|vlan|layer3|switching-modes|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29252" PostTypeId="1" CreationDate="2016-04-03T07:49:27.917" Score="0" ViewCount="546" Body="&lt;p&gt;I need to establish a WLAN Bridge over a distance of approximately 400m. I found this equipment: &lt;a href=&quot;https://www.ligowave.com/products/apc-propeller-2&quot; rel=&quot;nofollow&quot;&gt;https://www.ligowave.com/products/apc-propeller-2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand it needs to connect over LAN to the internetrouter. In this case i am not able to lay a cable to the outside from the internetrouter. So I need to connect over WLAN. The logical construct will be something like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;internetrouter (from ISP) &amp;lt;---WLAN----&gt; WLAN Bridge &amp;lt;---400m distance---&gt; WLAN Bridge &amp;lt;---LAN or WLAN ---&gt; access point or end devices (like Laptop, samrtphone,...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What kind of equipment do I need and how is this scenario called?&lt;/p&gt;&#xA;" OwnerUserId="16844" LastActivityDate="2017-09-27T05:13:35.233" Title="WLAN Bridge connected over WLAN to the internet" Tags="|wireless|bridge|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29258" PostTypeId="1" AcceptedAnswerId="29296" CreationDate="2016-04-03T12:24:39.077" Score="2" ViewCount="122" Body="&lt;p&gt;I'm new to OFDM, so I have a basic question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a 8 channel OFDM using 8PSK. To me a single symbol using 8PSK means 8 bits, hence one byte of data. Since I have 8 channels, that would mean 64 bytes. This would equate to a single OFDM symbol of 64 bytes? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going on further a payload of 16 OFDM symbols would mean 16*64 bytes of data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not too sure of the relationship between bits, symbols and OFDM symbols even though it appears to be simple. &lt;/p&gt;&#xA;" OwnerUserId="24231" LastActivityDate="2016-04-04T22:25:00.517" Title="OFDM symbol, data amount" Tags="|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29259" PostTypeId="2" ParentId="29252" CreationDate="2016-04-03T13:35:11.337" Score="2" Body="&lt;p&gt;You need a point-to-point link. This means 2 directionnal WIFI antennas looking at each other and providing the transport between the two sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With two PtP devices in 5Ghz band, you can acheive like 100Mbps speed over 400m, more with the AC version (maybe 200Mbps, 300Mbps.. depends on many factors)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device you link on your post is the same kind, but works with 2.4Ghz band, which is much much more crowded than 5Ghz, you have big chances to get a less reliable link with 2.4Ghz than 5Ghz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the transport method, you can use &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;bridging as you suggest, so both sides of the link will be in the same subnet, really easy to set up.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;routing (different subnets on both sides).This is preferred because you won't have unwanted traffic like broadcast or multicast &quot;pollute&quot; your link, but it's more complicated to set up than bridging and may require configuration on clients.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20569" LastEditorUserId="20569" LastEditDate="2016-04-04T08:54:47.580" LastActivityDate="2016-04-04T08:54:47.580" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29263" PostTypeId="1" AcceptedAnswerId="29264" CreationDate="2016-04-03T15:21:37.707" Score="-1" ViewCount="31" Body="&lt;p&gt;A NOOB question - I'm accessing internal development environment resources:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;http://10.1.2.3:8080/xyz&#xA;http://localhost:8080/xyz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm trying to configure an iOS &lt;a href=&quot;https://stackoverflow.com/a/33306373/47281&quot;&gt;security exception&lt;/a&gt; which requires a domain name (not IP I believe).  How do you determine the domains?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have these dev resources on servers running different OS's: OSX, Windows 7, and Solaris.&lt;/p&gt;&#xA;" OwnerUserId="24238" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2016-04-03T16:39:44.350" Title="Determining domain names based on IP address?" Tags="|ip|" AnswerCount="1" CommentCount="1" ClosedDate="2016-04-03T20:27:54.790" ContentLicense="CC BY-SA 3.0" />
  <row Id="29264" PostTypeId="2" ParentId="29263" CreationDate="2016-04-03T15:31:44.480" Score="2" Body="&lt;p&gt;Generally, you can do a reverse DNS lookup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;dig -x a.b.c.d&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I'm assuming the first address is inside your organization, so it probably has the same domain as you. localhost is your computer.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-04-03T16:39:44.350" LastActivityDate="2016-04-03T16:39:44.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29265" PostTypeId="1" AcceptedAnswerId="29267" CreationDate="2016-04-03T16:34:26.343" Score="1" ViewCount="189" Body="&lt;p&gt;Is there an any option in cisco Router we can restrict &lt;code&gt;MTU&lt;/code&gt; size to something smaller? default is &lt;code&gt;1514&lt;/code&gt; but for experiment i want to allow &lt;code&gt;512&lt;/code&gt; only and if packet if bigger than 512 discard them.&lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-04-03T17:26:15.247" Title="Cisco restrict MTU size" Tags="|cisco|network-core|mtu|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="29266" PostTypeId="2" ParentId="29250" CreationDate="2016-04-03T16:39:01.740" Score="0" Body="&lt;p&gt;You have the same configuration for all the switches. Based on your question and diagrams, I think you need to change the layer-2 access switches' configurations to something like this (for the leftmost layer-2 switch in the bottom diagram):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname L2SWITCH0&#xA;!&#xA;no ip routing&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; no switchport trunk encapsulation dot1q&#xA; no switchport mode trunk&#xA; switchport access VLAN 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA; no switchport trunk encapsulation dot1q&#xA; no switchport mode trunk&#xA;!&#xA;interface FastEthernet0/3&#xA; no switchport trunk encapsulation dot1q&#xA; no switchport mode trunk&#xA;!&#xA;interface FastEthernet0/4&#xA; no switchport trunk encapsulation dot1q&#xA; no switchport mode trunk&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA; switchport access VLAN 4&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan2&#xA; no ip address 192.168.11.100 255.255.255.0&#xA;!&#xA;interface Vlan3&#xA; no ip address 192.168.12.100 255.255.255.0&#xA;!&#xA;interface Vlan4&#xA; no ip address 192.168.13.100 255.255.255.0&#xA;!&#xA;interface Vlan5&#xA; no ip address 192.168.14.100 255.255.255.0&#xA;!&#xA;interface Vlan6&#xA; no ip address 192.168.15.100 255.255.255.0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-03T17:29:23.230" LastActivityDate="2016-04-03T17:29:23.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29267" PostTypeId="2" ParentId="29265" CreationDate="2016-04-03T17:19:31.373" Score="3" Body="&lt;p&gt;You can do this with policy based routing, although this is an example of filtering any packet bigger than 512 bytes, it does not make your router fragment packets to 512 bytes.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended Filter&#xA; permit ip any any&#xA;&#xA;router-map Filter&#xA; match ip address Filter&#xA; match length 1 512&#xA; set interface Null0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the inbound interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip policy route-map filter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This method will only work on inbound traffic coming in through the interface you have set the policy on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to filter outbound traffic from the router, instead of an interface level command, use the following global command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip local policy route-map filter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also match only certain traffic by modifying what the access-list matches, or if using the global level command, and you want to filter outbound traffic only on a certain interface, you can do an extra &lt;code&gt;match &amp;lt;out-bound interface&amp;gt;&lt;/code&gt; command in the route map&lt;/p&gt;&#xA;" OwnerUserId="15472" LastEditorUserId="8499" LastEditDate="2016-04-03T17:26:15.247" LastActivityDate="2016-04-03T17:26:15.247" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29271" PostTypeId="1" CreationDate="2016-04-03T21:44:09.717" Score="0" ViewCount="197" Body="&lt;p&gt;I have a question about network masks.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Host A IP : 10.0.0.1/24&lt;/li&gt;&#xA;&lt;li&gt;Host B IP : 10.0.0.2/25&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Why is PC1 able to ping PC2, but when PC2 tries to ping PC1, it times out?  Can I get a detailed explanation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit for clarification:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On PC1 we did &lt;code&gt;ping -c2 10.0.0.2&lt;/code&gt;, and we did get a reply successfully from PC2. On PC2 we did &lt;code&gt;ping -c2 10.0.0.1&lt;/code&gt;, and we did not get a reply successfully from PC1. We want to know why this happened? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/umHYK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/umHYK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt; We used &lt;code&gt;10.0.0.200/25&lt;/code&gt; instead, and were able to ping PC1 to PC2, but not PC2 to PC1, which is what we wanted. Can someone explain why this is?&lt;/p&gt;&#xA;" OwnerUserId="24250" LastEditorUserId="8499" LastEditDate="2018-12-23T04:27:17.460" LastActivityDate="2018-12-23T04:27:17.460" Title="Simple network mask question" Tags="|cisco|ipv4|subnet|ip-address|packet-tracer|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="29272" PostTypeId="1" AcceptedAnswerId="29273" CreationDate="2016-04-04T00:12:36.897" Score="10" ViewCount="21902" Body="&lt;p&gt;What is the difference between broadcast addresses &lt;code&gt;ff.ff.ff.ff.ff.ff&lt;/code&gt; (Layer 2) and &lt;code&gt;255.255.255.255&lt;/code&gt; (Layer 3)?&lt;/p&gt;&#xA;" OwnerUserId="24153" LastEditorUserId="8499" LastEditDate="2016-04-04T00:41:52.323" LastActivityDate="2020-03-08T00:38:50.470" Title="What is the difference between layer-2 and layer-3 broadcasts? Please explain with an example" Tags="|layer2|broadcast|layer3|" AnswerCount="3" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29273" PostTypeId="2" ParentId="29272" CreationDate="2016-04-04T00:40:49.800" Score="9" Body="&lt;p&gt;You need to understand the difference between layer-2 and layer-3 for an answer to have any real meaning for you, and I suspect you don't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A layer-2 network is a LAN, and all hosts on it are peers. A LAN is bounded by layer-3. The layer-2 frames are delivered to the host with the destination MAC address in the frame. I one host wants to send something to all the hosts on the LAN, it will address the frame(s) with the &lt;code&gt;ffff:ffff:ffff&lt;/code&gt; MAC address. Each host is obligated to strip the frame and inspect the packet to see if the packet is meant for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A layer-3 network is usually, but not always, on a layer-2 LAN. Router use layer-3 to send packets between LANs. A host on a LAN cannot send a layer-3 packet without first encapsulating it in a layer-2 frame, and that requires layer-2 MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need ARP (or an equivalent, see IPv6) to resolve the layer-3 address to a layer-2 address. When a host sends a packet to another host on the same LAN, it first looks in its ARP cache to see if it has a layer-2 address for the layer-3 address. If it does not, it sends an ARP request. The ARP request is broadcast at layer-2 to all hosts on the LAN, looking for the host which owns the layer-3 address. The host owning that address will respond with an ARP reply, giving the requesting host its MAC address. In this case, a layer-2 broadcast gets the attention of all the hosts on the LAN, but only the host with the layer-3 address responds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A layer-3 broadcast packet is meant for all hosts on the layer-3 network. When a host needs to resolve the layer-3 broadcast, it uses the layer-2 broadcast address for the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two types of layer-3 broadcast: the limited broadcast, &lt;code&gt;255.255.255.255&lt;/code&gt;, as you noted, and the network broadcast, the highest IP address in a network. The limited broadcast can never cross a router, while a network broadcast may cross a router if the router has been configured that way, although that is considered a security risk, and routers do not allow this, by default, but that was not always the case.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-04T00:47:58.603" LastActivityDate="2016-04-04T00:47:58.603" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29274" PostTypeId="2" ParentId="29271" CreationDate="2016-04-04T01:19:55.047" Score="1" Body="&lt;p&gt;It's because the two PCs are on different networks. The PC with &lt;code&gt;10.0.0.1/24&lt;/code&gt; is on a network which spans hosts &lt;code&gt;10.0.0.1&lt;/code&gt; to &lt;code&gt;10.0.0.254&lt;/code&gt;, while the PC with &lt;code&gt;10.0.0.200/25&lt;/code&gt; is on a network with hosts from &lt;code&gt;10.0.0.129&lt;/code&gt; to &lt;code&gt;10.0.0.254&lt;/code&gt;, but the network doesn't include the first PC with the address &lt;code&gt;10.0.0.1&lt;/code&gt;. Clearly the second host thinks the first host is on a different network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When an IP host wants to send something to another IP host, it first looks to see if the destination IP address is on the same network as itself. If not, it sends the traffic to its configured gateway.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-04T01:25:47.513" LastActivityDate="2016-04-04T01:25:47.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29279" PostTypeId="1" AcceptedAnswerId="29280" CreationDate="2016-04-04T07:28:02.467" Score="1" ViewCount="850" Body="&lt;p&gt;I am from India and we are designing a video website for rural India. I am planning to setup WIFI broadcast tower within a village of approx 1 sq KM radius. I want to support 300 - 500 simultaneous users streaming at 500 kbps each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking I would mount 3-4 TP LINK CPE210 antenna (&lt;a href=&quot;http://www.tp-link.com/en/products/details/CPE210.html&quot; rel=&quot;nofollow&quot;&gt;http://www.tp-link.com/en/products/details/CPE210.html&lt;/a&gt;) on a single pole at the center of the village and have them wired to single SOHO router  that ultimately connect to an high speed broadband.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you think antennas like the CPE210 is good for such an scenario? Or in your expert opinion, what is the alternate design I could pursue? &lt;/p&gt;&#xA;" OwnerUserId="24259" LastActivityDate="2016-04-04T09:55:16.707" Title="Support upto 300-500 users streaming at 500 kbps in 1 sq KM radius" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29280" PostTypeId="2" ParentId="29279" CreationDate="2016-04-04T09:55:16.707" Score="4" Body="&lt;p&gt;I think the antenna choice is the least of your problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;500 users require 250 MB throughput.  I would be surprised if you can get that kind of Internet bandwidth in rural India.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume you can. Commercial Wifi routers can practically handle 40-50 simultaneous users.  If you have one on each channel, that's only 150 users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under ideal conditions, you can expect no more than 25 Mb throughput on each channel.  That's only 75Mb on all 3 channels.  And you will have far from ideal conditions.  Your clients will be farther away from the APs and will have to use lower data rates.  That will greatly reduce your throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would not expect a wireless client to work reliably more than 50-75 m from the access point under ideal conditions.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, if you were to set this up, you could only support a small percentage of your target users.  They would experience poor performance and would likely reject your solution as unusable.    &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-04T09:55:16.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29281" PostTypeId="1" AcceptedAnswerId="41482" CreationDate="2016-04-04T11:28:15.430" Score="3" ViewCount="267" Body="&lt;p&gt;I have recently seen a few pictures of optical fibre connectors taken by a microscope after those connectors had been cleaned. The picture states, that the connector fails IEC 61300-3-35 norm. Like theese two bellow:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XCpZL.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XCpZL.jpg&quot; alt=&quot;Example 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uxFqI.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uxFqI.jpg&quot; alt=&quot;Example 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the network with theese connectors is up and running without any problems and it was running ok even before cleaning the connectors. The installation is cca 10 years old.&#xA;My question is: when is the right time to re-weld optical pigtails, are theese pictures  really alarming or we can wait another year without any new pigtail's welding?&lt;/p&gt;&#xA;" OwnerUserId="24262" LastEditorUserId="8499" LastEditDate="2016-04-04T13:52:12.583" LastActivityDate="2017-05-25T20:02:11.123" Title="When is the connector's damage a good reason for a new pigtail welding?" Tags="|fiber|cable|layer1|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="29283" PostTypeId="1" AcceptedAnswerId="29284" CreationDate="2016-04-04T11:54:20.720" Score="0" ViewCount="2259" Body="&lt;ul&gt;&#xA;&lt;li&gt;/8&lt;/li&gt;&#xA;&lt;li&gt;/15&lt;/li&gt;&#xA;&lt;li&gt;/29&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What are the subnet masks for the following slash address blocks?&#xA;Can any one explain why?&lt;/p&gt;&#xA;" OwnerUserId="24263" LastActivityDate="2016-04-04T13:18:45.337" Title="What are the subnet masks for the following slash address blocks?" Tags="|subnet|" AnswerCount="2" CommentCount="0" ClosedDate="2016-04-04T19:22:09.680" ContentLicense="CC BY-SA 3.0" />
  <row Id="29284" PostTypeId="2" ParentId="29283" CreationDate="2016-04-04T12:10:07.783" Score="2" Body="&lt;p&gt;The subnet mask is a 32 bit number, just like an IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number after the slash tells you the number of consecutive 1s in the mask.  So in the first example, there are eight consecutive ones:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111 00000000 00000000 00000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you write that in dotted decimal notation, you get &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;255.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The next example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111 11111110 00000000 00000000&#xA;&#xA;or 255.254.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'll leave the last one to you ;)&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-04-04T12:16:17.943" LastActivityDate="2016-04-04T12:16:17.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29285" PostTypeId="2" ParentId="25636" CreationDate="2016-04-04T12:47:15.723" Score="0" Body="&lt;p&gt;Assuming you have set up the VPNs in interface mode (a.k.a. route-based), you need 2 things for this to work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- two routes to the other 2 networks&#xA;2- policies to allow the traffic&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's call the 3 sites A,B,C and the firewall FGT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If A can ping B, and B can ping C then you already have a route to network B in FGT A, and a route to network C in FGT B. You also have return routes in place, on FGT B to network A and network C.&#xA;Reversing the traffic: if you can ping from B to A, and from C to B then you have 2 policies on each FGT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key point for the necessary additions to your routes and policies to enable traffic from A to C is that the FGTs will drop traffic from &quot;unknown&quot; sources, that is, from networks they don't have a route to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FGT A doesn't &quot;know&quot; about network C, and vice versa. So you need an additional route on FGT A to network C pointing to the tunnel interface to FGT B (the only tunnel interface here), and also one more route on FGT C to network A pointing to the (only) tunnel interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you have to add network C to both policies on FGT A (as destination and as source, respectively). The same applies to FGT C, allowing network A in the policies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does sound like a lot of effort for a WAN network with only 3 nodes. Having 4, 5,... nodes in between creates a substantial amount of configuration needs UNLESS you design your networks in a suitable manner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all networks behind the firewalls could be supernetted then policies and routes only have to be created once. Example: create networks A,B,C as 10.121.1.0/24, 10.121.2.0/24, 10.121.3.0/24. The only route needed on any FGT would be 10.121.0.0/16, and in the only 2 policies needed on any FGT you would have one destination 10.121.0.0/16 and one source 10.121.0.0/16. That's how hub-and-spoke VPNs are set up ideally.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-04-04T12:47:15.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29286" PostTypeId="2" ParentId="29283" CreationDate="2016-04-04T13:18:45.337" Score="2" Body="&lt;p&gt;If you found this page and are just looking for a quick lookup table, here it is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/32 255.255.255.255&#xA;/31 255.255.255.254&#xA;/30 255.255.255.252&#xA;/29 255.255.255.248&#xA;/28 255.255.255.240&#xA;/27 255.255.255.224&#xA;/26 255.255.255.192&#xA;/25 255.255.255.128&#xA;/24 255.255.255.0&#xA;/23 255.255.254.0&#xA;/22 255.255.252.0&#xA;/21 255.255.248.0&#xA;/20 255.255.240.0&#xA;/19 255.255.224.0&#xA;/18 255.255.192.0&#xA;/17 255.255.128.0&#xA;/16 255.255.0.0&#xA;/15 255.254.0.0&#xA;/14 255.252.0.0&#xA;/13 255.248.0.0&#xA;/12 255.240.0.0&#xA;/11 255.224.0.0&#xA;/10 255.192.0.0&#xA;/9 255.128.0.0&#xA;/8 255.0.0.0&#xA;/7 254.0.0.0&#xA;/6 252.0.0.0&#xA;/5 248.0.0.0&#xA;/4 240.0.0.0&#xA;/3 224.0.0.0&#xA;/2 192.0.0.0&#xA;/1 128.0.0.0&#xA;/0 0.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24086" LastActivityDate="2016-04-04T13:18:45.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29288" PostTypeId="2" ParentId="29179" CreationDate="2016-04-04T14:56:30.603" Score="2" Body="&lt;p&gt;First, let's bang out some terminology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DPC: Dense Port Concentrator&lt;/strong&gt; - This is an older line card architecture, it predates MPC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MPC: Modular Port Concentrator&lt;/strong&gt; - This is the newer architecture for line cards, MPC's also have many &quot;sub-architectures&quot; as well (MPC    Type 1, Type 2, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SCB: Switch Control Board&lt;/strong&gt; - These are fabric cards, they are what connect the FPC's together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's how the DPCs and SCBs fit together:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fOsDt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fOsDt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The boxes in green are the SCB's, they provide 2 fabric planes to each of the line PFE's on the line cards. DPCs/MPCs have either 1, 2, or 4 PFE's - obviously the example is assuming the DPC's have 4.  Also note the 2 grey boxes, they act as spare planes should any others fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper has a couple Knowledge Base (KB) articles that helps troubleshoot fabric problems that are a bit less obvious, this is just for future reference (I'll post them below).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the output you provided, it just looks like one of your SCB's rebooted, either by an administrator or just a potential hardware fault.  If the same SCB has rebooted 2 or more times (and it wasn't an engineer intentionally rebooting it), you should open a case with JTAC and see what they have to say.  You can verify why it rebooted by looking at the logs (&quot;show log messages&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to that, I see that two of the planes are offline (this corresponds to the alarm/offline planes), seeing as you have 3 SCB's, I believe you should see 6 (4 Active/2 Spare).  From what I see, it appears that your 3rd SCB has been disabled, or is just down for another reason.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Plane   State    Uptime  &#xA; 0      Online   266 days, 6 hours, 43 minutes, 49 seconds    ##SCB0&#xA; 1      Online   266 days, 6 hours, 43 minutes, 49 seconds    ##SCB0&#xA; 2      Online   1465 days, 21 hours, 25 minutes, 34 seconds  ##SCB1&#xA; 3      Online   1465 days, 21 hours, 25 minutes, 34 seconds  ##SCB1&#xA; 4      Offline                                               ##SCB2&#xA; 5      Offline                                               ##SCB2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your original question relates to planes 4 and 5, which correspond to SCB2.  The second KB article will help with this more accurately.  I'd strongly advise making sure another engineer isn't working on this, or that the SCB isn't offline intentionally - if it was offlined but another engineer due to errors then turning it back online might cause problems.  If you don't see any evidence that it was offlined intentionally, work through the article and see what happens.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB23173&quot; rel=&quot;nofollow noreferrer&quot;&gt;Resolution Guide - MX - Troubleshooting Fabric Planes&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB23067&quot; rel=&quot;nofollow noreferrer&quot;&gt;Instructions to Offline/Online MX Fabric Plane and MX SCB&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3075" LastEditorUserId="3075" LastEditDate="2016-04-04T16:39:08.400" LastActivityDate="2016-04-04T16:39:08.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29291" PostTypeId="1" AcceptedAnswerId="29292" CreationDate="2016-04-04T16:48:35.953" Score="2" ViewCount="684" Body="&lt;p&gt;The question is fairly simple, and maybe a bit remedial to most reading this, but I've been searching the web for something definitive about this point.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that the RST flag is intended to terminate a TCP connection immediately, and that so far as the sending host is concerned, the conversation is over the moment the RST or RST/ACK packet is sent. But do hosts that receive that RST or RST/ACK packet &quot;honor&quot; it on the spot by not sending any acknowledgment of the RST?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, do hosts immediately drop the conversation upon receipt of a RST or RST/ACK packet?  Any exceptions?&lt;/p&gt;&#xA;" OwnerUserId="23366" LastEditorUserId="8499" LastEditDate="2018-12-23T04:32:17.343" LastActivityDate="2018-12-23T04:32:17.343" Title="Is there ever an occasion where a host will respond to a RST or RST/ACK packet with an ACK?" Tags="|ipv4|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29292" PostTypeId="2" ParentId="29291" CreationDate="2016-04-04T17:12:31.820" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://www.ietf.org/rfc/rfc793.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 793, TRANSMISSION CONTROL PROTOCOL&lt;/a&gt; explains, in detail, how TCP works:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Reset Processing&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In all states except SYN-SENT, all reset (RST) segments are&#xA;  validated   by checking their SEQ-fields.  A reset is valid if its&#xA;  sequence number   is in the window.  In the SYN-SENT state (a RST&#xA;  received in response   to an initial SYN), the RST is acceptable if&#xA;  the ACK field   acknowledges the SYN.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The receiver of a RST first validates it, then changes state.  If&#xA;  the   receiver was in the LISTEN state, it ignores it.  If the&#xA;  receiver was   in SYN-RECEIVED state and had previously been in the&#xA;  LISTEN state,   then the receiver returns to the LISTEN state,&#xA;  otherwise the receiver   aborts the connection and goes to the CLOSED&#xA;  state.  If the receiver   was in any other state, it aborts the&#xA;  connection and advises the user   and goes to the CLOSED state.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-04T17:12:31.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29294" PostTypeId="2" ParentId="20790" CreationDate="2016-04-04T19:28:40.263" Score="1" Body="&lt;p&gt;Had a look at the cs200 switch from the documentation found at &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/small-business-200-series-smart-switches/data_sheet_c78-634369.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/switches/small-business-200-series-smart-switches/data_sheet_c78-634369.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears the CS200 switch doesn't support routing. You will have to create a trunk port from switch1 to the router while on the router connected to switch1, create what is known as router-on-a-stick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/336-cisco-router-8021q-router-stick.html&quot; rel=&quot;nofollow&quot;&gt;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/336-cisco-router-8021q-router-stick.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My 2 cents for your network implementation, wifi (currently half-duplex csma-ca) is a convenience that is great for mobile users. If you want reliability, stability and performance for your workers, you really should consider wired connectivity (full duplex) as primary.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-04-04T19:28:40.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29295" PostTypeId="2" ParentId="10715" CreationDate="2016-04-04T21:56:24.273" Score="0" Body="&lt;p&gt;On a wired bus signal, losses are fairly small, and so it is fairly easy to detect collisions. IIRC coax ethernet does it by looking at the DC level on the line, but it would be equally possible to do it by comparing the signal on the bus to the signal you are trying to transmit.&lt;/p&gt;&#xA;&lt;p&gt;That just doesn't work for radio. Signal loss between transmitter and receiver is massive, tens of dB at least. In the face of the strong outgoing signal, it is impractical to detect the incoming signal which is operating in the same frequency spectrum and is massively weaker. This basically rules out collision detection as an approach for wireless systems.&lt;/p&gt;&#xA;&lt;p&gt;P.S. Twisted pair and fiber Ethernet uses separate data channels for each direction, so there are no collisions on the wire. A &amp;quot;collision&amp;quot; is detected simply by detecting activity on both channels at once.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="31800" LastEditDate="2022-11-11T10:04:42.347" LastActivityDate="2022-11-11T10:04:42.347" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="29296" PostTypeId="2" ParentId="29258" CreationDate="2016-04-04T22:25:00.517" Score="1" Body="&lt;p&gt;8PSK means an eight symbol alphabet that have different phases. The Number of bits you can represent with an alphabet of size 8 is log2(8) = 3 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the number of carriers/channels the total bits is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Carrier number * 3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I this would represent the number of bits in a single OFDM symbol.&lt;/p&gt;&#xA;" OwnerUserId="24279" LastActivityDate="2016-04-04T22:25:00.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29300" PostTypeId="1" CreationDate="2016-04-05T01:54:27.850" Score="4" ViewCount="1281" Body="&lt;p&gt;I understand that the 100base-TX Ethernet standard is from 1995, and was originally designed for older and poorer grade CAT-5 cabling than what is now commonly available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the introduction of the newer and faster ethernet speeds, and higher grade cables to support those speeds, why hasn't the maximum specified signalling distance for 100base-T increased when it is used on these same higher grade cables?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like 100base-TX should be fully reliable for considerably further distance than is specified by the standards when it is run on, for example, CAT-5e, CAT-6 or CAT-7 cable.&lt;/p&gt;&#xA;" OwnerUserId="20529" LastEditorUserId="8499" LastEditDate="2018-03-20T23:19:47.960" LastActivityDate="2018-03-20T23:19:47.960" Title="Why is the 100base-TX maximum distance unchanged from the original specification on better cable?" Tags="|ethernet|layer1|cabling|cable|utp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29301" PostTypeId="1" AcceptedAnswerId="29302" CreationDate="2016-04-05T02:13:14.033" Score="3" ViewCount="178" Body="&lt;p&gt;I'm running a simulation in Riverbed modeler, and I've got two broadcast domains, each having one Ethernet advanced hub and 16 Ethernet advanced stations connected to it through 10Base-T links. Subsequently, another 10Base-T link has been adopted to connect together the hubs and switch, whereby the switch (ethernet advanced switch) would be in the middle of both hubs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TmfTa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TmfTa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After executing the simulation the results are like this;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Traffic forwarded by switch : 4 Mbps&lt;/li&gt;&#xA;&lt;li&gt;Traffic received by switch : 8 Mbps&lt;/li&gt;&#xA;&lt;li&gt;Point to point through switch to hub1 : 4 Mbps&lt;/li&gt;&#xA;&lt;li&gt;Point to point through switch to hub2 : 2 Mbps&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've studied all the possible factors, such as collision count in collision domains, queuing delay for point to points, and the questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why does the switch behave in this manner?&lt;/li&gt;&#xA;&lt;li&gt;Why does the traffic being forwarded to hub1 vary from the traffic&#xA;being forwarded to hub2?&lt;/li&gt;&#xA;&lt;li&gt;Why is the traffic on the point-to-point throughput to hub2 2 Mbps,&#xA;whereas the traffic on the point-to-point throughput to hub1 is 4&#xA;Mbps?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've read all about the switch technologies, but I haven't found any relative topic that describes how a switch behaves in such cases. Any source or suggestion would be highly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This scenario is in an office (100m x 100m).&lt;/p&gt;&#xA;" OwnerUserId="24287" LastEditorUserId="8499" LastEditDate="2016-04-05T02:36:28.163" LastActivityDate="2016-04-05T02:42:34.427" Title="Switch Trafficking" Tags="|switch|ethernet|lan|switching|network-discovery|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29302" PostTypeId="2" ParentId="29301" CreationDate="2016-04-05T02:27:51.383" Score="2" Body="&lt;p&gt;You don't actually have &lt;em&gt;any&lt;/em&gt; point-to-point links. A hub is a layer-1 device, basically, a multi-port cable, while switches are layer02 devices which only deliver frames to where they are destined. All your links are shared links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike hubs, switches don't forward every frame out every port. Switches learn which MAC addresses are on which ports, and they deliver traffic destined for a particular MAC address to the port where that MAC address is found. Also, unlike hubs, each switch port is a collision domain, and there will be no collisions on the switch, itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must also be sure that the switch ports are not configured for full duplex. Otherwise, you will get a lot of errors. Ethernet has no facility for retransmission for damaged frames; they are just dropped.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-05T02:42:34.427" LastActivityDate="2016-04-05T02:42:34.427" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29303" PostTypeId="2" ParentId="29300" CreationDate="2016-04-05T03:36:01.550" Score="3" Body="&lt;p&gt;The distance limitation is based on minimum frame size (64bytes) and the propagation time to all nodes so collision detection (the &lt;em&gt;CD&lt;/em&gt; part of CSMA/CD) can happen. 100B-TX exists on half-duplex hubs. That part of the standard still applies to even 1000base specs -- although, if the signal can make it further, it can work in &lt;em&gt;out-of-spec&lt;/em&gt; situations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Note: no one uses hubs anymore, but the spec is still the spec. Those devices still work... if you have them, and &lt;em&gt;I do&lt;/em&gt;.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-04-05T03:36:01.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29304" PostTypeId="2" ParentId="29300" CreationDate="2016-04-05T05:04:55.113" Score="3" Body="&lt;p&gt;Newer/faster standards utilize much higher frequencies in the cable where certain negative characteristics of the cable will have more of an effect, such as NEXT (near end cross talk). Newer cable grades are primarily designed to address these issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other characteristics of the cable standards do not change significantly with higher grade cable and have more of an impact on Examples of such characteristics:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;attenuation/insertion loss - the difference between Cat5e and Class FA (also sometimes referred to as &quot;Cat7A&quot;) is only 3.7dB, compared to the difference in NEXT which is almost 35dB.&lt;/li&gt;&#xA;&lt;li&gt;propagation delay - (mentioned in Ricky's answer as well) consistent across all cable categories&lt;/li&gt;&#xA;&lt;li&gt;return loss - a 2dB difference between Cat5e and the rest of the standards&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These latter characteristics have more to do with the limitations of sending low voltage electrical signals on copper wires. As such, they won't ever change much even with other improvements to the cable and these are also the factors that primarily go into determining the &quot;distance&quot; a signal can be sent on a link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So even with a better grade of cable, that doesn't really have much impact on the distance a signal can be sent reliably on a cable used for networking.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-04-05T05:04:55.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29305" PostTypeId="1" AcceptedAnswerId="29309" CreationDate="2016-04-05T07:07:13.677" Score="2" ViewCount="73" Body="&lt;p&gt;I have a computer with 6 Ethernet interfaces.&#xA;The computer is used for logging and will continously log all data on all interfaces.&#xA;No packet loss is acceptable and therefore no other applications are allowed to run on the computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to connect these same 6 data streams to a separate computer that will visualize the data in real time.&#xA;The second computer only have one interface.&#xA;The visualization is not as critical as the logging, so it is not as big a deal if I loose a packet here or there in this transfer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What hardware setup should I use to connect my 6 sources to 7 destinations?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clarification: this is my &lt;em&gt;current&lt;/em&gt; setup. The number of interfaces might change over time so I would prefer a setup that is configurable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XWm9j.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XWm9j.jpg&quot; alt=&quot;6 sources are sent to 7 destinations&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24289" LastActivityDate="2016-04-05T12:16:28.233" Title="What setup should be used to send traffic from multiple sources to both a dedicated destination per source and a common destination for all sources?" Tags="|routing|switching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29307" PostTypeId="1" AcceptedAnswerId="29308" CreationDate="2016-04-05T09:41:35.967" Score="1" ViewCount="10381" Body="&lt;p&gt;I am currently trying to trace the syslogs on Junos&lt;br&gt;&#xA;I ran the &quot;&lt;strong&gt;show log&lt;/strong&gt;&quot; command and the resulting messages I see don't contain that for the date I wish to check. I even ran the command &quot;&lt;strong&gt;show log messages | match Jul&lt;/strong&gt;&quot;&lt;br&gt;&#xA;I wish to get the log messages dating July 2015, but these are the available files.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-rw-rw-r--  1 root  wheel   525630 Apr  5 10:24 messages  &#xA;-rw-rw-r--  1 root  wheel   136795 Apr  2 16:35 messages.0.gz  &#xA;-rw-rw-r--  1 root  wheel   137106 Mar 23 19:41 messages.1.gz  &#xA;-rw-rw-r--  1 root  wheel   132270 Jan 10 08:58 messages.10.gz  &#xA;-rw-rw-r--  1 root  wheel   133097 Dec 28 12:48 messages.11.gz  &#xA;-rw-rw-r--  1 root  wheel   149600 Dec 15 11:29 messages.12.gz  &#xA;-rw-rw-r--  1 root  wheel   141467 Dec  3 00:54 messages.13.gz  &#xA;-rw-rw-r--  1 root  wheel   157455 Nov 15 09:49 messages.14.gz  &#xA;-rw-rw-r--  1 root  wheel   101622 Oct  9 15:41 messages.15.gz  &#xA;-rw-rw-r--  1 root  wheel    85758 Sep 26  2015 messages.16.gz  &#xA;-rw-rw-r--  1 root  wheel    79048 Sep 17  2015 messages.17.gz  &#xA;-rw-rw-r--  1 root  wheel    80556 Sep  7  2015 messages.18.gz  &#xA;-rw-rw-r--  1 root  wheel    92779 Aug 29  2015 messages.19.gz  &#xA;-rw-rw-r--  1 root  wheel   129535 Mar 14 16:25 messages.2.gz  &#xA;-rw-rw-r--  1 root  wheel   132642 Mar  3 11:23 messages.3.gz  &#xA;-rw-rw-r--  1 root  wheel   145808 Feb 23 06:48 messages.4.gz  &#xA;-rw-rw-r--  1 root  wheel   154648 Feb 16 07:00 messages.5.gz  &#xA;-rw-rw-r--  1 root  wheel   144492 Feb 16 06:09 messages.6.gz  &#xA;-rw-rw-r--  1 root  wheel   135718 Feb  9 10:15 messages.7.gz  &#xA;-rw-rw-r--  1 root  wheel   134724 Jan 30 03:59 messages.8.gz  &#xA;-rw-rw-r--  1 root  wheel   139855 Jan 19 15:46 messages.9.gz  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wish to know if there is any possibility to get that for July 2015&lt;/p&gt;&#xA;" OwnerUserId="24161" LastEditorUserId="509" LastEditDate="2016-04-05T09:58:20.530" LastActivityDate="2016-09-13T02:29:00.767" Title="How to view old Log messages on Junos" Tags="|juniper-junos|juniper-mx|logging|syslog|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29308" PostTypeId="2" ParentId="29307" CreationDate="2016-04-05T09:58:06.543" Score="5" Body="&lt;p&gt;If you don't see those logs there anymore, they've most likely been rotated to reduce disk space used, but it could be that &lt;code&gt;messages.19.gz&lt;/code&gt; contains logs from July, it all depends on when that log was created. So you could use &lt;code&gt;show log messages.19.gz&lt;/code&gt; to check that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can change the number of files stored on disk:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set file messages archive files 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Make sure there's enough free space to store these logs. In most setups, only the most recent logs are stored locally on devices, and a centralized log system is used for storing logs for longer periods of time. &lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-04-05T09:58:06.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29309" PostTypeId="2" ParentId="29305" CreationDate="2016-04-05T11:12:20.477" Score="1" Body="&lt;p&gt;You could use a switch with the capability to mirror several ports to a single one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This feature is called &quot;mirroring&quot; or &quot;SPAN&quot;, it will replicate the traffic from mirrored port(s) to the mirroring one (on which of course you attach the visualization computer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some switch models will allow you to mirror only a single source port while other can mirror several source ports to a single one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally the mirroring port will have higher speed than the others, or you may loose some packets (mirroring 6 x 1Gb/s to 1 x 1Gb/s)... but you said it's fine this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as the switch backplane has enough bandwidth to handle all the flux simultaneously you should not loose any packet to the logging computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Optionally you can setup a VLAN for each source / destination pair to isolate them from each other.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="8499" LastEditDate="2016-04-05T12:16:28.233" LastActivityDate="2016-04-05T12:16:28.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29310" PostTypeId="1" AcceptedAnswerId="29319" CreationDate="2016-04-05T13:03:53.627" Score="4" ViewCount="879" Body="&lt;p&gt;Is there a legal way that complies with the USA-NFPA fire code, to put regular non-plenum network devices above a drop ceiling in a plenum airspace?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Background:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In many places in the United States, a licensed electrician is not required to install low-voltage cabling such as network and phone cables into residential or commercial buildings, nor is wiring inspection required. However, it is still important for unlicensed installers to follow electrical and fire safety rules outlined in the National Fire Protection code book.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example it is not acceptable to install general purpose network electrical devices directly in a &lt;strong&gt;&quot;plenum airspace&quot;&lt;/strong&gt;, which is where the open air above a drop/suspended ceiling is used as an air return for the building ventilation. There is risk of a smoldering plastic fire in the hidden space, which is both fueled by the moving forced air fanning the flames, and the burning fumes are sucked into the building air circulation and can potentially unknowingly poison, injure, or kill building occupants.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plenum rated network devices and plenum rated cables are specifically designed for plenum airspace use, with special expensive low smoke and self-extinguishing plastics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Further discussion for the inexperienced:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wikipedia: &lt;em&gt;Plenum space&lt;/em&gt;&lt;br&gt;&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Plenum_space&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Plenum_space&lt;/a&gt;&lt;br&gt;&#xA;(Yeah, um, I created this article back in 2012. The illustrations are my own work.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Article: &lt;em&gt;What Lurks in the Ceiling&lt;/em&gt;, Mar 24, 2011&lt;br&gt;&#xA;Electrical Construction and Maintenance Magazine&lt;br&gt;&#xA;&lt;a href=&quot;http://ecmweb.com/low-voltagecommunications/what-lurks-ceiling&quot; rel=&quot;nofollow&quot;&gt;http://ecmweb.com/low-voltagecommunications/what-lurks-ceiling&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Questions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If a non-plenum device is partially or completely sealed off, such as&#xA;putting the device in a covered metal enclosure with an electrical&#xA;outlet inside, and the enclosure is itself installed by a licensed&#xA;electrician for the device, is this sufficient to comply with the&#xA;code? If a device failure and electrical fire were to break out, the&#xA;metal enclosure would likely contain the fire, limit burning, and&#xA;limit spread.&lt;/li&gt;&#xA;&lt;li&gt;Alternately, if that is not sufficient, would a gasketed metal&#xA;enclosure with cable clamps or rubber bushings to limit air exchange&#xA;through the punched cable openings be acceptable? This would further&#xA;choke off the air circulation for any potential device overheating&#xA;and fire so that it rapidly uses up its air supply in the enclosure,&#xA;and go out.&lt;/li&gt;&#xA;&lt;li&gt;If an approved enclosure for a non-plenum device is available and&#xA;workable, is it possible to cool the non-plenum device in some&#xA;approved manner that limits air exchange and potential fire spread,&#xA;such as a sealed air-to-air heat exchanger? (Also known as a fan&#xA;blowing air in a circle inside, and a second fan blowing air on the&#xA;enclosure shell on the outside.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20529" LastEditorUserId="20529" LastEditDate="2016-04-06T10:20:48.353" LastActivityDate="2016-04-06T10:20:48.353" Title="What type of enclosure can be used for non-plenum electronics in a plenum space?" Tags="|cable|safety|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29311" PostTypeId="2" ParentId="29310" CreationDate="2016-04-05T13:24:38.240" Score="1" Body="&lt;p&gt;Unfortunately, in the U.S., there is no one single solution. While all 50 states, and most local jurisdictions, have adopted the NEC (NFPA 70), there are still many local jurisdictions, including those which have adopted the NEC, with varying laws and rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer to your question can only be found by asking the AHJ (Authority Having Jurisdiction), such as the local building inspector or fire marshal. Basically, someone with authority to fine you and shut the building down until local code violations are remediated. There are instances where there are multiple AHJs, which don't completely see eye to eye on what is, or isn't, acceptable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, it is doubtful, in many jurisdictions, that you can do what you want to do.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-05T15:45:05.557" LastActivityDate="2016-04-05T15:45:05.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29313" PostTypeId="1" CreationDate="2016-04-05T13:35:26.240" Score="1" ViewCount="801" Body="&lt;p&gt;I have 3 Aironet Access Points. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 are running on Version 15.3(3)JBB1 and when I factory resetted and its actually running on Version 15.2(4)JB3a.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to copy the Configuration of on of the AP to the resetted one. But they are not on the same software and I think, this is the reason why i don't work right. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We don't have an active contract (I asked) with Cisco. Is it possible to get the Image from one AP to another? And which file is it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the output of the flash:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AP#show flash: &#xA;&#xA;Directory of flash:/&#xA;&#xA;    2  -rwx           4   Sep 4 2015 14:32:44 +00:00  FOC17304FJT&#xA;    3  -rwx         405   Mar 1 1993 00:00:19 +00:00  env_vars&#xA;   44  drwx         768  Jul 31 2013 06:41:27 +00:00  c1140-k9w7-mx.153-3.JBB1&#xA;    5  -rwx        9010  Jul 31 2013 06:41:33 +00:00  event.log&#xA;    4  -rwx        2572  Dec 10 2015 14:18:02 +00:00  private-config&#xA;    7  drwx         128  Jul 31 2013 06:37:10 +00:00  c1140-rcvk9w8-mx&#xA;   43  drwx           0  Jul 31 2013 06:38:16 +00:00  configs&#xA;    6  -rwx        5182  Dec 10 2015 14:18:02 +00:00  config.txt&#xA;   10  -rwx        7192  Dec 10 2015 14:18:02 +00:00  private-multiple-fs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;c1140-k9w7-mx.153-3.JBB1&lt;/code&gt; is a fodler where I think the image is stored. But I need a tar file (for upgrading with gui). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I do? Are isn't it possible to upgrade the one AP and i have to stay at 15.2 with this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AP#copy flash:/c1140-k9w7-mx.153-3.JBB1/c1140-k9w7-xx.153-3.JBB1 ftp://ftpuser:ftppassword@IP//home/upload/&#xA;Address or name of remote host [IP]? &#xA;Destination filename [/home/upload/c1140-k9w7-xx.153-3.JBB1]? &#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;7954956 bytes copied in 7.184 secs (1107316 bytes/sec)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it isn't there:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ls -la /home/upload/&#xA;insgesamt 28&#xA;drwxr-xr-x 2 ftpuser ftpuser 4096 Apr  5 15:45 .&#xA;drwxr-xr-x 5 root    root    4096 Apr  5 11:59 ..&#xA;-rw-r--r-- 1 ftpuser ftpuser  220 Apr  5 11:59 .bash_logout&#xA;-rw-r--r-- 1 ftpuser ftpuser 3515 Apr  5 11:59 .bashrc&#xA;-rw-r--r-- 1 root    root    5015 Apr  5 13:46 config.txt&#xA;-rw-r--r-- 1 ftpuser ftpuser  675 Apr  5 11:59 .profile&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UPDATE2: show Flash on resetted AP&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AP2#show flash: &#xA;&#xA;Directory of flash:/&#xA;&#xA;    2  -rwx        1892   Mar 1 1993 00:16:52 +00:00  event.log&#xA;    3  -rwx        1909   Apr 5 2016 12:51:55 +00:00  private-config&#xA;    4  -rwx        3096   Apr 5 2016 12:51:55 +00:00  private-multiple-fs&#xA;    5  drwx        2048   Jan 1 1970 00:00:03 +00:00  ap1g1-k9w7-mx.152-4.JB3a&#xA;  198  -rwx         286   Mar 1 1993 01:14:07 +00:00  env_vars&#xA;  199  -rwx        5425   Apr 5 2016 12:51:55 +00:00  config.txt&#xA;&#xA;131334144 bytes total (118214656 bytes free)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="22401" LastEditDate="2016-04-05T13:54:33.760" LastActivityDate="2016-04-06T15:06:53.410" Title="Copy Software from on IOS-Device to another" Tags="|cisco|cisco-ios|access-point|aironet|" AnswerCount="2" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="29314" PostTypeId="2" ParentId="29313" CreationDate="2016-04-05T13:38:15.460" Score="1" Body="&lt;p&gt;EDIT: As per Ron's comment, if you can't get the licensed IOS from Cisco than you don't have the correct licensing required to upgrade.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="4634" LastEditDate="2016-04-05T13:50:27.043" LastActivityDate="2016-04-05T13:50:27.043" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29315" PostTypeId="1" CreationDate="2016-04-05T14:06:48.483" Score="2" ViewCount="254" Body="&lt;p&gt;Why there is no channel 37 in WLAN 5 GHz band. what is the reason behind it&lt;/p&gt;&#xA;" OwnerUserId="24301" LastActivityDate="2016-04-05T14:36:44.047" Title="WLAN 5GHz there is no channel 37" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29316" PostTypeId="2" ParentId="29315" CreationDate="2016-04-05T14:36:44.047" Score="3" Body="&lt;p&gt;The original channel designations assumed 5 MHz spacing, and were made long before anyone thought of Wi-Fi.  Since Wi-fi signals are 20 MHz wide, they take up 4 channels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there is a channel 37 (and 38, and 39 ...), but it is part of the 20MHz bandwidth of a single Wi-fi signal (using channel 36).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-05T14:36:44.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29317" PostTypeId="2" ParentId="20683" CreationDate="2016-04-05T14:56:01.947" Score="0" Body="&lt;p&gt;Everything you posted is possible, except for this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;However I would like not to do the same on the other side of cables. Hence I would like to have two 100Mbit connection, but the ethernet cable in the router from one connection will have nonsense on the unused wires&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It &lt;em&gt;is&lt;/em&gt; possible to split a single 8-wire UTP cable into two 100Mbps cables that only require 4-wires. But then both sides of the two wires would require two router ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of the 8-wires are grouped together into 4-pairs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DIrrE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DIrrE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the Gigabit standard (&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#1000base-t&quot; rel=&quot;nofollow noreferrer&quot;&gt;1000BASE-T&lt;/a&gt;), all four pairs are used. And data can be sent/received on wire pin position 1 - 8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the FastEthernet standard (&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#100base-tx&quot; rel=&quot;nofollow noreferrer&quot;&gt;100BASE-TX&lt;/a&gt;), only pairs 2 and 3 are used, and data can be sent/received on wire pin positions 1, 2, 3, or 6. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can take one UTP cable with all 8 pairs, and split them out into two 8P8C connectors (also commonly referred to as RJ-45 jacks) that only use pairs 2 and 3. But on the other side, you could only connect one of the split-UTP cables to the correct Pair 2 and Pair 3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You wouldn't be able use Pairs 2&amp;amp;3 on one side of the cable and Pairs 1&amp;amp;4 on the other. Those pin positions are essentially disabled when your NIC speed is set to 100Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other side would also have to use two different 8P8C connectors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said. I think your simplest solution is to just use a switch. Then your two wall ports can be extended into as many switch ports as necessary, and then on the other side you would still only need two router ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even a simple hub will do if you're just trying to get one or two extra ports out of your already existing wall-run.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-04-05T14:56:01.947" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29319" PostTypeId="2" ParentId="29310" CreationDate="2016-04-05T16:48:32.250" Score="5" Body="&lt;h3&gt;Vent the Device into the Room's Airspace&lt;/h3&gt;&#xA;&lt;p&gt;If you seal off the device from the &amp;quot;plenum airspace&amp;quot; and vent it into the room, then, from the point of view of smoke, fire, and air handling the device is no longer in the plenum but rather in the room.  This way the device can physically occupy the space above suspended ceiling without requiring a flame-test rating for plenums.&lt;/p&gt;&#xA;&lt;h3&gt;Duct the Return Air&lt;/h3&gt;&#xA;&lt;p&gt;Usually the &amp;quot;plenums&amp;quot; where I am inclined to install equipment are in the return air path.  I have found that it is often a straightforward matter to duct the return air from the room to the air handler.  There is good, easily-installed flex duct that I have used for this purpose.&lt;/p&gt;&#xA;&lt;p&gt;By ducting the return air, the volume above the ceiling ceases to be a plenum thereby relieving the plenum-rating requirements.  This also has the added benefit of improving indoor air quality because you no longer have that giant plenum filled with all manner of awful things off-gassing and throwing particulate into your air supply.&lt;/p&gt;&#xA;" OwnerUserId="2662" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-04-05T16:48:32.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29320" PostTypeId="1" CreationDate="2016-04-05T17:46:52.683" Score="3" ViewCount="7641" Body="&lt;p&gt;I am getting quotes for Structured Cabling and one guy is saying that I can use 40G MPO from my distribution switch up to a 40G MPO patch panel connection and across a 40G MPO trunk but then break it out to 4 x 10G LC ports which I agree with but then he says that I can use each of those four 10G LC duplex cables to connect to four separate physical machines.  Is this possible with NX-OS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be using a Cisco 5696Q with mostly QSFP line cards as my distribution switch and 6001T's as my ToR's and building out a total of 12 racks.  So I will have one rack with my distribution switch gear and the other 11 will all have ToR 6001T.&#xA;I am asking for patch panel quotes for all 12 racks.&lt;br&gt;&#xA;I am new Cisco and NX-OS so please let me know if this is possible or not and if you need more info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;FOLLOW UP&lt;/em&gt;&lt;/strong&gt;&#xA;What is best practice in this case?&#xA;1. Should I not use breakouts but instead change some of the line cards from QSFP to 10G LC   OR&#xA;2. Keep line cards 40G for higher density and use break out configuration when 10G is needed.&lt;/p&gt;&#xA;" OwnerUserId="24305" LastEditorUserId="24305" LastEditDate="2016-04-06T19:19:08.413" LastActivityDate="2020-03-31T17:41:06.413" Title="1 x 40G QSFP to 4 x 10G SFP+ Can these 4 x 10G breakouts go to different hosts?" Tags="|cisco|cisco-nexus-5k|cisco-nx-os|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29321" PostTypeId="1" AcceptedAnswerId="29325" CreationDate="2016-04-05T18:33:56.233" Score="14" ViewCount="50318" Body="&lt;p&gt;I have a relatively dumb question. Suppose the Switch just started, and it received a frame that contains a destination MAC address for a network device not in its MAC addresses table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens then? Does it broadcast (MAC address &lt;code&gt;ff:ff:ff:ff:ff:ff&lt;/code&gt;) and receive answers from connected devices, or is there a protocol dedicated for that which is used? I don't think the switch uses the ARP (Address Resolution Protocol)? &lt;/p&gt;&#xA;" OwnerDisplayName="user24308" LastEditorUserId="8499" LastEditDate="2018-03-07T21:21:29.030" LastActivityDate="2021-07-09T14:42:02.327" Title="How does a switch learn a MAC address not in its lookup table?" Tags="|switch|mac-address|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29322" PostTypeId="1" AcceptedAnswerId="29324" CreationDate="2016-04-05T18:38:15.300" Score="0" ViewCount="160" Body="&lt;p&gt;I have one router with two PCs connected to it, via a LAN cable. Is there a way for me to find the IP address of the other PC?&lt;/p&gt;&#xA;" OwnerUserId="24310" LastEditorUserId="8499" LastEditDate="2016-04-05T23:30:31.727" LastActivityDate="2016-04-05T23:30:31.727" Title="How to find the IP adress of computer with which I am sharing the Internet" Tags="|router|lan|" AnswerCount="2" CommentCount="2" ClosedDate="2016-04-06T10:44:02.597" ContentLicense="CC BY-SA 3.0" />
  <row Id="29323" PostTypeId="2" ParentId="29321" CreationDate="2016-04-05T18:43:38.833" Score="4" Body="&lt;p&gt;When a switch receives a frame, it updates its MAC address table with the source MAC address and the port on which it received the frame. If the destination MAC address isn't in its MAC address table (unknown unicast), it floods the frame to all ports, except the port on which the frame was received.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-05T18:45:44.920" LastActivityDate="2016-04-05T18:45:44.920" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29324" PostTypeId="2" ParentId="29322" CreationDate="2016-04-05T18:44:17.723" Score="1" Body="&lt;p&gt;Yes, you can use a program called &lt;code&gt;netscan&lt;/code&gt;, it scans your network and returns all of your devices connected to the network including the IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check it out here:&#xA;&lt;a href=&quot;https://www.softperfect.com/products/networkscanner/&quot; rel=&quot;nofollow&quot;&gt;https://www.softperfect.com/products/networkscanner/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ther's also apps on your cell phone you can use.&lt;/p&gt;&#xA;" OwnerUserId="10329" LastActivityDate="2016-04-05T18:44:17.723" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29325" PostTypeId="2" ParentId="29321" CreationDate="2016-04-05T18:59:38.437" Score="34" Body="&lt;p&gt;Good question. I'll answer it with an animation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/h5yvl.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/h5yvl.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Host A sends the frame, the switch does not have &lt;em&gt;anything&lt;/em&gt; in its MAC address table. Upon receiving the frame, it records Host A's &lt;em&gt;MAC Address to Switch Port&lt;/em&gt; mapping. Since it doesn't know where the destination MAC address is, it &lt;strong&gt;floods&lt;/strong&gt; the frame out all ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This assures that &lt;em&gt;if&lt;/em&gt; host B exists (which at this point, the switch does not know yet), that it will receive it. Hopefully, upon receiving the frame, Host B will generate a response frame, which will allow the Switch to learn the MAC address mapping from the return frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read more about how a Switch works &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-switch/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt; (where I took the animation from). I would also suggest reading the entire article series for a closer look at &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/packet-traveling/&quot; rel=&quot;noreferrer&quot;&gt;how a packet moves through a network&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One last note regarding the terms &lt;em&gt;Flooding&lt;/em&gt; vs &lt;em&gt;Broadcast&lt;/em&gt;. A switch never &lt;em&gt;broadcasts&lt;/em&gt; frames, a &lt;em&gt;broadcast&lt;/em&gt; is not an action a switch can take. A switch can only &lt;em&gt;flood&lt;/em&gt; a frame. A &lt;em&gt;broadcast&lt;/em&gt; is simply a frame with a destination MAC address of &lt;code&gt;ffff.ffff.ffff&lt;/code&gt;.  This is often confused because the end effect is the same, but &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-switch/#broadcasts&quot; rel=&quot;noreferrer&quot;&gt;they are actually different&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-04-05T18:59:38.437" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29326" PostTypeId="2" ParentId="29203" CreationDate="2016-04-05T20:03:56.517" Score="0" Body="&lt;p&gt;Packets received into OVS hit the datapath module first. If there is an entry in the flow cache, corresponding action is applied on the packet. If there is no entry, an &quot;upcall&quot; happens and the packet is sent to the user space over netlink protocol via the dpif interface. Actually there are queues present to buffer upcalls to the userspace where the handling is done. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="24312" LastActivityDate="2016-04-05T20:03:56.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29327" PostTypeId="1" CreationDate="2016-04-05T20:22:57.400" Score="1" ViewCount="1742" Body="&lt;p&gt;How do I get the DHCP relay function of a Cisco ASA working over a site-to-site VPN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ops center is behind a 5510 ASA with a 3560 core switch. The DHCP server is at IP 10.0.10.153.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The remote location is behind a 5505 ASA, with no layer 3 switches or routers at the site, just a layer 2 switch behind the ASA. The local network is 10.29.8.0/24 with the ASA's inside IP being 10.29.8.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VPN is set up between the two locations and traffic between 10.29.8.0/24 and 10.0.0.0/8 is being tunneled. There's no problem in reaching the DHCP server from that local network (10.29.8.x to 10.0.153) so the connection is fine between the two as long as the IP is already present and we're routing between the two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've set the DHCP Relay Agent on the remote ASA as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dhcprelay server 10.0.10.153 outside&#xA;dhcprelay enable inside&#xA;dhcprelay setroute inside&#xA;dhcprelay timeout 60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where my problem is, I believe, is that I have to make some changes to the ACL for the crypto map, but I'm getting very confused reading through the documentation and posts I can find on this subject.&lt;/p&gt;&#xA;" OwnerUserId="24313" LastActivityDate="2024-01-28T21:56:46.903" Title="DHCP Relay on Cisco ASA over site-to-site VPN" Tags="|cisco-asa|dhcp|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29328" PostTypeId="2" ParentId="20535" CreationDate="2016-04-05T20:24:13.260" Score="2" Body="&lt;p&gt;Let's say you have multiple openflow enabled switches with virtual and physical hosts connected to the same controller. As long as they are reachable through the network when you link the switch to the controller, controller is aware of them. You can check this in the controller's topology. (Eg: In the case of ovs, you do &quot;ovs-vsctl set-controller br0 tcp::6633&quot; and the switch will come up in the topology gui of ODL). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of adding flows and forwarding, you can a) set-fail-mode br0 secure and add flows manually through ofctl or rest api (or) b) enable the switch to behave as a learning switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note- Whenever there is no flow entry in the switch and it is NOT a learning switch, it will send a packet_in to the controller and wait for instructions (packet_out). &lt;/p&gt;&#xA;" OwnerUserId="24312" LastActivityDate="2016-04-05T20:24:13.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29329" PostTypeId="2" ParentId="29321" CreationDate="2016-04-05T22:20:14.193" Score="7" Body="&lt;p&gt;The switch doesn't &lt;em&gt;use&lt;/em&gt; ARP, but ARP can help in preventing this situation from occurring in the first place, for two reasons:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If node A is sending an IP packet to node B which isn't in its ARP cache, it will first send an ARP request (which is a broadcast packet, and will automatically be flooded to all ports by the switch). When node B sends its ARP reply, the switch will learn its MAC address. So, by the time actual data transfer happens, the switch already knows the MAC addresses of the participants, and doesn't need to flood data packets.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Many devices, when their link goes up, will send a &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7713/how-does-gratuitous-arp-work&quot;&gt;gratuitous ARP&lt;/a&gt; packet. In addition to updating the ARP caches of other nodes on the network, the GARP will also fill the switch's MAC address table.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;IPv6 doesn't use ARP, but &lt;a href=&quot;https://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol&quot; rel=&quot;noreferrer&quot;&gt;NDP&lt;/a&gt; fulfills a similar purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So overall, although switches certainly &lt;em&gt;will&lt;/em&gt; flood frames to unicast addresses they haven't learned, it's not necessary as often as you might think, because it will usually have the opportunity to learn nodes' addresses from broadcast frames beforehand. However, you can definitely observe it with a switch that's had its MAC table &lt;a href=&quot;https://en.wikipedia.org/wiki/MAC_flooding&quot; rel=&quot;noreferrer&quot;&gt;overflowed&lt;/a&gt; or that has just rebooted.&lt;/p&gt;&#xA;" OwnerUserId="6328" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-04-05T22:20:14.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29330" PostTypeId="2" ParentId="29322" CreationDate="2016-04-05T22:56:53.780" Score="0" Body="&lt;p&gt;netscan works fine.  If there are only two PCs connected to that router(I believe you mean a simple home router where all ports are in same LAN network), then you may just run wireshark or any packet capture tool in your PC and the chances are high that you would see some broadcast packets from the other PC. Source IP would be the other PCs IP.&#xA;OR, you can just login to router and check the DHCP client lists/ARP table.&lt;/p&gt;&#xA;" OwnerUserId="24321" LastActivityDate="2016-04-05T22:56:53.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29331" PostTypeId="2" ParentId="29320" CreationDate="2016-04-05T23:00:41.287" Score="7" Body="&lt;p&gt;A 1x40G QSFP port can be fanned-out to 4x10G SFP+ ports.  You need to configure that 40G port as 4 Tengig ports in the switch. The break out cables on the other end can go to different hosts.&lt;/p&gt;&#xA;" OwnerUserId="24321" LastActivityDate="2016-04-05T23:00:41.287" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29332" PostTypeId="1" CreationDate="2016-04-06T02:44:16.610" Score="1" ViewCount="679" Body="&lt;p&gt;We have Default routes till date with our ISP and now we are planning to run BGP with ISP, reason we want RTBH triggering. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Do we need to run eBGP or iBGP?   &lt;/li&gt;&#xA;&lt;li&gt;If we run iBGP then does our router will hold full BGP table ~512k?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Actually we just want to do RTBH triggering and don't want to do high level of BGPing. It's going to be very simple implementation of BGP. &lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-04-06T03:41:20.650" Title="iBGP vs eBGP peering with ISP" Tags="|cisco|bgp|network-core|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29333" PostTypeId="2" ParentId="29332" CreationDate="2016-04-06T02:55:18.630" Score="3" Body="&lt;p&gt;You will likely run eBGP, since your AS number and the ISPs AS number are different.  If you do not have an AS number, you can use one of the private AS numbers (analogous to private IP addresses).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also do not need full routes, as you only have one path to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the details of RTBH routing, you need to talk to your ISP and follow their requirements.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="33" LastEditDate="2016-04-06T03:41:20.650" LastActivityDate="2016-04-06T03:41:20.650" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29334" PostTypeId="1" AcceptedAnswerId="29336" CreationDate="2016-04-06T04:13:02.947" Score="3" ViewCount="2245" Body="&lt;p&gt;Using Wireshark to capture ICMP packets (Windows) using ping to &lt;code&gt;google.com&lt;/code&gt;, I can see the &lt;code&gt;source-MACAddr&lt;/code&gt; of the ICMP Echo replies is not the same as the MAC address of my direct router (which is the &lt;code&gt;dest-MACAddr&lt;/code&gt; of the &lt;code&gt;icmpEchoRequest&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK, the MAC address of a packet sent to my PC should belong to my direct router, so I wonder where did that MAC address come from? &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My router, named &lt;code&gt;All-HSRP-routers_06&lt;/code&gt; (Wireshark), has its MACAddr as &lt;code&gt;00-00-0c-07-ac-06&lt;/code&gt; (I got it from &lt;code&gt;arp -a&lt;/code&gt; for the MAC address of the default gateway's IP address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mentioned strange MAC address is &lt;code&gt;00-25-45-1d-14-21&lt;/code&gt;, from a router named &lt;code&gt;CiscoInc_1d:14:21&lt;/code&gt; (Wireshark).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another interesting fact is that whatever IP address I ping to, the source MAC address of &lt;code&gt;icmp-echo-reply&lt;/code&gt; is always the strange one, but not my router's MAC address.&lt;/p&gt;&#xA;" OwnerUserId="19860" LastEditorUserId="8499" LastEditDate="2020-11-27T22:57:15.547" LastActivityDate="2020-11-27T22:57:15.547" Title="Strange router's MAC address from ICMP Echo Reply?" Tags="|router|mac-address|ping|icmp|hsrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29335" PostTypeId="2" ParentId="29334" CreationDate="2016-04-06T04:37:01.923" Score="0" Body="&lt;p&gt;I hope you are pinging to the router's IP address. Can you share the router model#? Typically, the mac-address of the interface through which the router sends out ICMP echo reply will be the SRC MAC of that packet.  If that interface is tagged to multiple VLANs, then the VLAN MAC (which might be different than interface MAC) will be used in the response packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, make sure there is no duplicate IP in the network. If there is duplicate, you may be receiving the response from another host.&lt;/p&gt;&#xA;" OwnerUserId="24321" LastActivityDate="2016-04-06T04:37:01.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29336" PostTypeId="2" ParentId="29334" CreationDate="2016-04-06T06:09:16.800" Score="8" Body="&lt;p&gt;You are confused. What you claim is your router's MAC address is not your router's MAC address. The MAC address is in the range, &lt;code&gt;0000.0C07.ACxx&lt;/code&gt;, which is the MAC address range for HSRP. The &lt;code&gt;06&lt;/code&gt; on the end of the MAC address is the HSRP group number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HSRP uses virtual IP and MAC addresses. You send to the virtual addresses to transit the router, but anything coming back will have the actual router interface MAC address. Depending on how your network is configured, you may sometimes get a different MAC address because the return traffic is from the other router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MAC address you are seeing is the real MAC address of the router's interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-06T06:09:16.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29338" PostTypeId="1" CreationDate="2016-04-06T06:17:47.093" Score="-2" ViewCount="400" Body="&lt;p&gt;In the OSI model, Layer 2 uses MAC addresses, and Layer 3 uses IP addresses. Suggest and explain a way to replace MAC addresses with IP addresses, such that a MAC address is no longer required, and each device in a LAN uses only one single IP address?&lt;/p&gt;&#xA;" OwnerUserId="24323" LastEditorUserId="8499" LastEditDate="2016-04-06T06:37:30.573" LastActivityDate="2016-04-06T07:03:09.300" Title="Can we replace the MAC address with an IP address?" Tags="|network-core|" AnswerCount="1" CommentCount="1" ClosedDate="2016-04-06T10:52:50.613" ContentLicense="CC BY-SA 3.0" />
  <row Id="29339" PostTypeId="2" ParentId="29338" CreationDate="2016-04-06T06:34:31.433" Score="1" Body="&lt;p&gt;While studying the OSI model, you missed the point about the layers being independent. Layer-2, which has addresses, encapsulates layer-3, which has addresses, and that encapsulates layer-4, which has addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having independent layers simplifies things. For instance, you can have ethernet at layer-2, or any number of other layer-2 protocols, each of which have their own addressing. Whichever layer-2 protocol you use can carry IPv4, or any of the layer-3 protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We now have IPv6. If you only had a single address for layer-2 and layer-3, it would be very difficult to have networks which run both IPv4 and IPv6. Ethernet switches use MAC addresses, and are ignorant (with a few exceptions) to the layer-3 protocol carried as payload in the ethernet frames. This allows a single network to carry any number of layer-3 protocols simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably assume the whole world uses ethernet and IP, but that is not the case. Those two protocols now dominate, but each were developed, independently, around the same time, and each are maintained by different standards bodies. Ethernet was primarily used for IPX for a long time, while IP ran on WAN circuits to connect universities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as having a single IP address on each device goes, IPv6 not only allows multiple addresses on a single device, but it requires it for communication with any device not on your LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-06T07:03:09.300" LastActivityDate="2016-04-06T07:03:09.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29340" PostTypeId="1" CreationDate="2016-04-06T07:54:43.867" Score="0" ViewCount="104" Body="&lt;p&gt;I have a requirement to deploy Cisco and HP WAPs in the same campus, in a secured manner. The Cisco has a WLC (Wireless LAN Controller), and an ISE, but HP has no WLC. In this scenario, how do I deploy both brands of WAPs in the campus, without compromising the Security. For more clarity, I have old HP WAPs and new Cisco WAPs, a Cisco WLC, and an ISE (yet to be deployed). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We only have HP now. Cisco is yet to be supplied. Any plan which secures the wireless with the described infrastructure is welcome. First of all, I would like to know whether such a multi-branded WAP solution will work and how to secure it. I have old HP ProCurve 530, MSM-420 and MSM-422 in the campus, and now I am getting Cisco 2702-i, along with a WLC and ISE. How do I integrate the old HP WAPs and deploy the new infrastructure. We don't have RADIUS/LDAP/AD, so far.&lt;/p&gt;&#xA;" OwnerUserId="24326" LastEditorUserId="8499" LastEditDate="2016-04-06T14:34:00.223" LastActivityDate="2016-04-06T20:00:22.880" Title="How do I deploy WAPs of different brands in a secured fashion in a single campus?" Tags="|cisco|wireless|hp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29341" PostTypeId="2" ParentId="29203" CreationDate="2016-04-06T08:08:01.783" Score="1" Body="&lt;p&gt;Things happens in kernel module(datapath) are very fast compared to &lt;code&gt;userspace&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First packet hits the kernel module, at very first time there will be no cache. It will send the packet to userspace, then the packet is routed. In this process, the kernel module make &lt;code&gt;hash&lt;/code&gt; cache of the header of packet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the subsequent packet hits the kernel module, then OVS calculate the &lt;code&gt;hash&lt;/code&gt; for the header of the subsequent packet and checks whether that hash already present or not. If it is there, it will route or send it to userspace. Check &lt;a href=&quot;https://www.google.co.in/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=video&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwiLjbrwxvnLAhVCG6YKHYQQB7gQtwIIGzAA&amp;amp;url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3Dd2r68RfjxlM&amp;amp;usg=AFQjCNEb8Ner1LoASIHVo6fhppcPdA5aKQ&amp;amp;sig2=wxHOVUEFjQixi00iFsD-YA&amp;amp;bvm=bv.118443451,d.dGo&quot; rel=&quot;nofollow noreferrer&quot;&gt;this video&lt;/a&gt; and &lt;a href=&quot;https://www.google.co.in/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwjbvLCax_nLAhVKv5QKHUBYB6EQFggbMAA&amp;amp;url=http%3A%2F%2Fopenvswitch.org%2Fslides%2FOpenStack-131107.pdf&amp;amp;usg=AFQjCNFo5Pfuy_pF6ehfFx3IsUuLR4VL6g&amp;amp;sig2=gk73TUb1YOuG1hbVUSX5Kw&amp;amp;bvm=bv.118443451,d.dGo&quot; rel=&quot;nofollow noreferrer&quot;&gt;PPT&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oUiD0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oUiD0.png&quot; alt=&quot;OVS&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="17153" LastEditorUserId="17153" LastEditDate="2016-04-14T10:51:28.613" LastActivityDate="2016-04-14T10:51:28.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29342" PostTypeId="2" ParentId="1467" CreationDate="2016-04-06T08:41:31.433" Score="1" Body="&lt;p&gt;Short for cyclic redundancy check, a common technique for detecting data transmission errors. Transmitted messages are divided into predetermined lengths that are divided by a fixed divisor. According to the calculation, the remainder number is appended onto and sent with the message. When the message is received, the computer recalculates the remainder and compares it to the transmitted remainder. If the numbers do not match, an error is detected.&lt;/p&gt;&#xA;" OwnerUserId="24328" LastActivityDate="2016-04-06T08:41:31.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29343" PostTypeId="2" ParentId="29320" CreationDate="2016-04-06T08:42:32.520" Score="4" Body="&lt;p&gt;The Cisco 5696Q supports this according to the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/nexus-5624q-switch/datasheet-c78-733100.html&quot; rel=&quot;nofollow&quot;&gt;Cisco datasheet&lt;/a&gt;. There are instructions on &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5600/sw/interfaces/7x/b_5600_Interfaces_Config_Guide_Release_7x/b_6k_Interfaces_Config_Guide_Release_7x_chapter_0110.html#task_D8580D9D3B594BC4AD44332DA74803F9&quot; rel=&quot;nofollow&quot;&gt;how to configure it&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These 4 ports will behave like individual ports but be aware that they &lt;strong&gt;are the same QSFP&lt;/strong&gt; (and the same cable until the breakout happens). If it breaks all four of them break. This may sound silly but I've seen people expecting redundancy when connecting all ports of a system to one QSFP.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2016-04-06T08:42:32.520" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29347" PostTypeId="2" ParentId="26366" CreationDate="2016-04-06T12:01:19.280" Score="0" Body="&lt;p&gt;You could use PrettyGoodTerminal to run the below Python script to get the helper addresses and relevant SVI names and build your update config as you need:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import re&#xA;&#xA;# report status back to PGT if you need    &#xA;ActionResult = &quot;ip helper not found&quot;&#xA;&#xA;result = Terminal.ExecCommand(&quot;sh ip int brief&quot;,&quot;#&quot;)&#xA;commandResult = result[0]&#xA;timedout = result[1]&#xA;if not timedout:&#xA;  for thisLine in commandResult.splitlines():&#xA;    ifList = filter(None, thisLine.split(&quot; &quot;))&#xA;    if ifList[4] == &quot;up&quot; and ifList[5] == &quot;up&quot;:&#xA;      ifName = ifList[0]&#xA;      result = Terminal.ExecCommand(&quot;sh run int {0}&quot;.format(ifName), &quot;#&quot;)&#xA;      ifconfig = result[0]&#xA;      timedout = result[1]&#xA;      if not timedout:&#xA;        helperAddresses = re.findall(r'ip helper-address.*',ifconfig)&#xA;        if len(helperAddresses) &amp;gt; 0:&#xA;          # report status back to PGT if you need&#xA;          ActionResult = &quot;ip helper found&quot;&#xA;          # Here you have the SVI name in ifName and the helperAddresses list containing the defined ip helper-addresses&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can also build a nice Visual Script with the above Python code added to a Command element, then add another Command element to execute the constructed update script. Like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/lFslL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lFslL.png&quot; alt=&quot;Visual Script to update ip helper-address&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just let me know if you need help with PGT ;-)&lt;/p&gt;&#xA;" OwnerUserId="24335" LastEditorUserId="24335" LastEditDate="2016-04-06T12:21:05.590" LastActivityDate="2016-04-06T12:21:05.590" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29348" PostTypeId="1" AcceptedAnswerId="29365" CreationDate="2016-04-06T13:46:56.433" Score="3" ViewCount="11243" Body="&lt;p&gt;I have a server and a client on different machines and on different locations.&#xA;I'm trying to capture TCP packets with tcpdump on an interface of the server machine. I've injected an identifier in the payload of the packets to I can identify those packets when the output from tcpdump is displayed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The full command I'm using is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -l  -AnXSs 0 -i eth0 -tt tcp port 7778 | tee tcpdump_test &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I give tcpdump the option &lt;code&gt;-s 0&lt;/code&gt; (display the whole packet) together with the  other options shown above, tcpdump seem to miss packets arriving at the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if I give tcpdump the option &lt;code&gt;-s 100&lt;/code&gt; (display the first 100 bytes of the packet) together with the other options above, tcpdump seem to give me all packets that I expect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The larger packets I send over TCP, the higher ratio of missing packets I experience. &lt;strong&gt;An import note is that I receive all tcp packets on the client and the server as I'm expecting, I just can't see all of them arriving on the interface if I'm specifying the flag &lt;code&gt;-s 0&lt;/code&gt; to tcpdump&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the situation when I'm losing packets and turning off tcpdump I get this output from tcpdump: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;126639 packets captured                                                                    &#xA;1544770 packets received by filter                                                           &#xA;1416694 packets dropped by kernel &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However when I turn off tcpdump in the situation when I don't lose packets I get this output from tcpdump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2006 packets captured&#xA;2006 packets received by filter&#xA;0 packets dropped by kernel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is it not capturing all TCP packets, and what can I do to make it capture all TCP packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running it on Linux SUSU with tcpdump version 4.5.1&#xA;and libpcap version 1.5.3&lt;/p&gt;&#xA;" OwnerUserId="22810" LastEditorUserId="22810" LastEditDate="2016-04-07T07:20:25.517" LastActivityDate="2016-04-07T07:40:10.233" Title="tcpdump not capturing all TCP packets when capturing whole packets" Tags="|tcp|packet-analysis|packet-loss|tcpdump|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29350" PostTypeId="2" ParentId="29313" CreationDate="2016-04-06T15:06:53.410" Score="0" Body="&lt;p&gt;Try this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On AP make tftp server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA; tftp-server flash:c1140-k9w7-mx.153-3.JBB1/c1140-k9w7-xx.153-3.JBB1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On AP2 download IOS from AP tftp&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy tftp: flash:&#xA;!And fill all required parameters&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It need AP's have connection between each other&lt;/p&gt;&#xA;" OwnerUserId="23195" LastActivityDate="2016-04-06T15:06:53.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29352" PostTypeId="1" AcceptedAnswerId="29353" CreationDate="2016-04-06T15:53:11.083" Score="2" ViewCount="2878" Body="&lt;p&gt;Looking through the documentation for Arista EOS - the &lt;code&gt;configuration replace&lt;/code&gt; command was only introduced in 4.14, leaving &amp;lt;4.14 without any form of replacing configurations (versus simply merging).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Short of using manual commands, what is the preferred way to load a configuration from file on EOS &amp;lt;=4.13 which will replace the running configuration entirely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;running-config&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! device: arista-test (DCS-7124S, EOS-4.13.10M)&#xA;!&#xA;! boot system flash:EOS.swi&#xA;!&#xA;transceiver qsfp default-mode 4x10G&#xA;!&#xA;hostname arista-test&#xA;ip name-server vrf default 8.8.8.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;new-config&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! device: arista-test (DCS-7124S, EOS-4.13.10M)&#xA;!&#xA;! boot system flash:EOS.swi&#xA;!&#xA;transceiver qsfp default-mode 4x10G&#xA;!&#xA;hostname arista-test-new&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then run &lt;code&gt;copy flash:new-config running-config&lt;/code&gt; and the output will be,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! device: arista-test (DCS-7124S, EOS-4.13.10M)&#xA;!&#xA;! boot system flash:EOS.swi&#xA;!&#xA;transceiver qsfp default-mode 4x10G&#xA;!&#xA;hostname arista-test-new&#xA;ip name-server vrf default 8.8.8.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whereas the desired output would be,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! device: arista-test (DCS-7124S, EOS-4.13.10M)&#xA;!&#xA;! boot system flash:EOS.swi&#xA;!&#xA;transceiver qsfp default-mode 4x10G&#xA;!&#xA;hostname arista-test-new&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24344" LastEditorUserId="24344" LastEditDate="2016-04-06T16:44:01.660" LastActivityDate="2016-08-04T17:37:41.190" Title="Arista: Configuration diffs and archiving" Tags="|arista|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29353" PostTypeId="2" ParentId="29352" CreationDate="2016-04-06T15:53:11.083" Score="1" Body="&lt;p&gt;I wrote up a small bash script to automate this process using an Arista &lt;code&gt;alias&lt;/code&gt; to call it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create the directory &lt;code&gt;/mnt/flash/bin&lt;/code&gt; and within it create the following file,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;config-replace&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/bin/bash&#xA;&#xA;APPLY_CHANGES=1&#xA;&#xA;ARCHIVE_RETENTION=30&#xA;CONFIG_ARCHIVE=&quot;/mnt/flash/config&quot;&#xA;TMP_DIR=&quot;/var/tmp&quot;&#xA;&#xA;NEW_CONFIG=&quot;$1&quot;&#xA;RUNNING_CONFIG=&quot;/mnt/flash/config/.running-config&quot;&#xA;TMP_CONFIG=&quot;/var/tmp/new-config&quot;&#xA;&#xA;function error()&#xA;{&#xA;    echo &quot;$@&quot;&#xA;    exit 0&#xA;}&#xA;&#xA;function cli()&#xA;{&#xA;    FastCli -p15 -c &quot;$@&quot;&#xA;}&#xA;&#xA;function cleanup()&#xA;{&#xA;    [ -f &quot;$TMP_CONFIG&quot; ] &amp;amp;&amp;amp; rm $TMP_CONFIG&#xA;}&#xA;&#xA;trap cleanup EXIT&#xA;&#xA;[ -z &quot;$NEW_CONFIG&quot; ] &amp;amp;&amp;amp; error &quot;Configuration file must be set&quot;&#xA;[ ! -f &quot;$NEW_CONFIG&quot; ] &amp;amp;&amp;amp; error &quot;Configuration file ($NEW_CONFIG) doesn't exist&quot;&#xA;[ ! -d &quot;$CONFIG_ARCHIVE&quot; ] &amp;amp;&amp;amp; mkdir -p $CONFIG_ARCHIVE&#xA;&#xA;# Backup existing configuration to a file&#xA;[ ! -f &quot;/mnt/flash/config/.running-config&quot; ] &amp;amp;&amp;amp; UPDATE_RUNNING_CONFIG=1&#xA;[ -n &quot;$UPDATE_RUNNING_CONFIG&quot; ] &amp;amp;&amp;amp; cli &quot;copy running-config file:/mnt/flash/config/.running-config&quot;&#xA;&#xA;DIFF_PRINT=$(diff -up -I 'last modified at' $RUNNING_CONFIG $NEW_CONFIG)&#xA;[ $(echo &quot;$DIFF_PRINT&quot; | wc -l) -le 1 ] &amp;amp;&amp;amp; error &quot;Configuration is the same, no changes made&quot;&#xA;&#xA;# Show the existing differences&#xA;echo &quot;$DIFF_PRINT&quot;&#xA;echo &quot;---&quot;&#xA;read -p &quot;Do you want to apply the changes? [y/N]: &quot; APPLY&#xA;&#xA;[[ ! &quot;$APPLY&quot; == &quot;y&quot; ]] &amp;amp;&amp;amp; error &quot;Aborted&quot;&#xA;&#xA;diff -I 'last modified at' \&#xA;--new-line-format='%l&#xA;' \&#xA;--old-line-format='no %l&#xA;' \&#xA;--unchanged-line-format='%l&#xA;' \&#xA;$RUNNING_CONFIG $NEW_CONFIG | \&#xA;sed -E '/^no !$/d; /^$/d; s/^no\s{3}/   no/g' &amp;gt; $TMP_CONFIG&#xA;&#xA;NEGATE_LINE=&#xA;while IFS='' read LINE; do&#xA;    if [[ &quot;$LINE&quot; == &quot;no&quot;* ]]; then&#xA;        NEGATE_LINE=1&#xA;    elif [ -n &quot;$NEGATE_LINE&quot; ] &amp;amp;&amp;amp; [[ &quot;$LINE&quot; == &quot;   &quot;* ]]; then&#xA;        continue&#xA;    else&#xA;        NEGATE_LINE=&#xA;    fi&#xA;    echo &quot;$LINE&quot;&#xA;done &amp;lt; $TMP_CONFIG &amp;gt; $TMP_CONFIG.tmp&#xA;mv $TMP_CONFIG{.tmp,}&#xA;&#xA;if [ -n &quot;$APPLY_CHANGES&quot; ]; then&#xA;&#xA;    cli &quot;copy file:$TMP_CONFIG running-config&quot;&#xA;&#xA;    # Backup and rotate configurations&#xA;    while read FILE; do&#xA;        IFS='.' read -ra FILE_PARTS &amp;lt;&amp;lt;&amp;lt; &quot;$FILE&quot;&#xA;        NEW_FILE=&quot;/mnt/flash/config/arista.conf.$(( ${FILE_PARTS[2]} + 1 )).gz&quot;&#xA;        mv $FILE $NEW_FILE&#xA;        [ -z &quot;$LAST_FILE&quot; ] &amp;amp;&amp;amp; LAST_FILE=$NEW_FILE&#xA;    done &amp;lt; &amp;lt;(find /mnt/flash/config -type f -name &quot;*.gz&quot; | sort -Vr)&#xA;    [ -f &quot;$LAST_FILE&quot; ] &amp;amp;&amp;amp; rm $LAST_FILE&#xA;    gzip -c /mnt/flash/config/.running-config &amp;gt; $CONFIG_ARCHIVE/arista.conf.0.gz&#xA;&#xA;    find /mnt/flash/config -type f -name &quot;*.gz&quot; | tail -n+${ARCHIVE_RETENTION} | xargs rm&#xA;    rm /mnt/flash/config/.running-config&#xA;&#xA;fi&#xA;&#xA;exit&#xA;alias load &quot;bash /mnt/flash/bin/config-replace %1&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then from the CLI interface - add the alias&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enable&#xA;conf term&#xA;alias load &quot;bash /mnt/flash/bin/config-replace %1&quot;&#xA;write&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then to use the new command, just upload a new configuration file to a location of your choosing - and from the run environment just call the &lt;code&gt;load&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arista-test# load /mnt/flash/startup-config&#xA;&#xA;Copy completed successfully.&#xA;--- /mnt/flash/config/.running-config   2016-04-06 16:46:09.000000000 +0100&#xA;+++ /mnt/flash/startup-config   2016-04-06 16:43:46.000000000 +0100&#xA;@@ -1,13 +1,13 @@&#xA;-! device: arista-sw1 (DCS-7124S, EOS-4.13.10M)&#xA;+! Startup-config last modified at  Wed Apr  6 16:06:56 2016 by admin&#xA;+! device: arista-test (DCS-7124S, EOS-4.13.10M)&#xA; !&#xA; ! boot system flash:EOS.swi&#xA; !&#xA;-hostname arista-test&#xA;-ip name-server vrf default 8.8.8.8&#xA;+hostname arista-test-new&#xA;---&#xA;Do you want to apply the changes? [y/N]:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then if you press &lt;code&gt;y&lt;/code&gt; - it will apply the differentiated changes (including negating the respective commands) - and create a configuration backup in &lt;code&gt;/mnt/flash/config&lt;/code&gt; for up to &lt;code&gt;$ARCHIVE_RETENTION&lt;/code&gt; versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is inspired from the JunOS approach, so its likely I'll write a &lt;code&gt;rollback&lt;/code&gt; alias too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its a shame Arista is lacking these basic configuration management tools.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Find the script here, &lt;a href=&quot;https://gist.github.com/anonymous/51d86cb90e51683ee417317aee86f306&quot; rel=&quot;nofollow&quot;&gt;https://gist.github.com/anonymous/51d86cb90e51683ee417317aee86f306&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24344" LastActivityDate="2016-04-06T15:53:11.083" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29355" PostTypeId="1" AcceptedAnswerId="29399" CreationDate="2016-04-06T16:24:19.740" Score="3" ViewCount="1111" Body="&lt;p&gt;My understanding of Arista's implementation of MC-LAG is relatively weak, so its likely I've misunderstood a deliberate limitation of how the &lt;code&gt;mlag&lt;/code&gt; works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking a basic example,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://eos.arista.com/mlag-basic-configuration/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2MTxz.png&quot; alt=&quot;Mlag&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch1: &#xA;  vlan10-svi: 192.168.0.1/24&#xA;switch2: &#xA;  vlan10-svi: 192.168.0.2/24&#xA;switch3: &#xA;  vlan10-svi: 192.168.0.3/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in a given scenario of switch3 pinging each of the SVI's on switch1 and switch2, I'd expect to see,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ping 192.168.0.1&#xA;80 bytes from 192.168.0.1: icmp_req=1 ttl=64 time=0.338 ms&#xA;# ping 192.168.0.2&#xA;80 bytes from 192.168.0.2: icmp_req=1 ttl=64 time=0.338 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whereas in reality,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ping 192.168.0.1&#xA;80 bytes from 192.168.0.1: icmp_req=1 ttl=64 time=0.338 ms&#xA;# ping 192.168.0.2&#xA;1 packets transmitted, 0 received, 100% packet loss, time 0ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is also the same when attempting to ping each respective SVI from switch1 &amp;lt;=&gt; switch2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the either port on the portchannel on switch3 is shutdown - then reachability of each respective switch is possible - but it is never possible to ping both switch1 and switch2.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now, I understand that &lt;a href=&quot;https://eos.arista.com/active-active-router-redundancy-using-varp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;VARP&lt;/a&gt; is likely the tool used to allow reachability of both devices (and in fact, does); but in the example where each switch needs to be independently accessed (eg. for management outside of &lt;code&gt;ma1&lt;/code&gt;) - it doesn't appear to be possible.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is this simply L3 limitation/design of Arista's MLAG?&lt;/li&gt;&#xA;&lt;li&gt;Should it be possible to ping between the mlag peers (not using the mlag peer link)&lt;/li&gt;&#xA;&lt;li&gt;Should it be possible for switch3 to be able to ping both switch1 and switch2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="24344" LastEditorUserId="24344" LastEditDate="2016-04-06T16:43:45.720" LastActivityDate="2016-07-06T23:45:11.860" Title="Arista: Unexpected results when pinging MLAG SVI" Tags="|arista|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29356" PostTypeId="1" AcceptedAnswerId="29357" CreationDate="2016-04-06T17:31:46.000" Score="3" ViewCount="110" Body="&lt;p&gt;I don't think this question has been asked here before because I've searched for an answer but couldn't find it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming we have a VPN connection (site-to-site or client-to-site) from site A to site B - if a machine in site A connects to site B, is it necessary that it becomes a part of the site B network, e.g. can it access the same local resources like shared drives, printers, etc that local machines in site B can?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, how does this work? Nothing that I know about VPN covers this aspect of it. VPN is supposed to provide you a safe/secure route from site A to site B through the Internet, so that you don't need to use a leased line to transfer data securely. Where does the idea of local machines in Site A having the same network level access as local machines in Site B come in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see any VPN protocols having anything in their specifications/implementation to support this. How does this happen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, do local machines in Site A get a site B IP address assigned to them like site B local machines do?&lt;/p&gt;&#xA;" OwnerUserId="24345" LastEditorUserId="8499" LastEditDate="2016-04-06T17:53:27.383" LastActivityDate="2016-04-06T19:11:38.523" Title="VPN - How does the client become a part of the private network?" Tags="|vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29357" PostTypeId="2" ParentId="29356" CreationDate="2016-04-06T17:48:51.497" Score="1" Body="&lt;p&gt;This question is really broad, and much depends on the products used, and the specific implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, a VPN is a tunnel, which looks like a point-to-point link. A network-to-network VPN can certainly be made to look like the networks are connected with a simple point-to-point cable. Also, a host-to-network VPN can be made to look like the host is a host on the network where it is connected via VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A tunnel, such a a VPN, merely encapsulates packets inside other packets, hiding the complexity of the actual path from the endpoint networks/devices. The inner packets are usually addressed as if they were on the target network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Addressing can be handled in a few ways, and security depends on the security applied. NAT could be applied to packets leaving and/or coming into a VPN. Traffic coming into a network via VPN may be restricted by various security features on the target VPN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-06T19:11:38.523" LastActivityDate="2016-04-06T19:11:38.523" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="29358" PostTypeId="2" ParentId="28486" CreationDate="2016-04-06T19:10:49.473" Score="3" Body="&lt;p&gt;I'll add to what @RonMaupin is trying to say by using this analogy. When you are packing the trunk of a car, you start by putting in the largest items first and make your way down to the smallest. In this way, the space in the trunk is optimized because the smaller objects can fit in the free space left behind from the putting the large objects in first. You can certainly start with the small objects, but you run the risk of running out of open space and will have to rip out everything and start over. By optimizing the space utilization from the start, you can more easily anticipate when you will run out of space. The same principal applies to subnetting. &lt;/p&gt;&#xA;" OwnerUserId="5785" LastActivityDate="2016-04-06T19:10:49.473" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="29360" PostTypeId="2" ParentId="29340" CreationDate="2016-04-06T20:00:22.880" Score="2" Body="&lt;p&gt;This will depend greatly on what &quot;secured&quot; is supposed to mean in this situation - RADIUS allowing you to use WPA2-enterprise is fairly decent, just slapping WPA2-personal on APs is generally kinda-low security, but may be adequate for some uses. Radius saves you from (and identifies) &quot;password sharers.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial response was (and mostly remains) - Very tediously for the stuff without central control. Having moved from no central control to a system with central command/control (UniFi), the difference is night and day, even on a relatively small campus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multi-branded APs generally works fine so long as the SSIDs, security settings, and password or authentication method are &lt;strong&gt;exactly the same&lt;/strong&gt; across any set that you want to work as a set, and you don't care about missing statistics, etc. from those that are not part of the centralized system.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-04-06T20:00:22.880" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29363" PostTypeId="1" CreationDate="2016-04-07T03:48:11.867" Score="2" ViewCount="467" Body="&lt;p&gt;If I have a GPON ISP, is it possible, and if possible, is it faster or better, to use a GPON ONT&amp;lt;-&gt;SFP adapter directly into a server rather than using a GPON ONT&amp;lt;-&gt;GigabitEthernet interface or router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, how can you get the full 1.25 Gbps upstream, 2.5Gbps downstream available on the GPON to a server?&lt;/p&gt;&#xA;" OwnerUserId="24356" LastActivityDate="2018-06-11T21:38:33.123" Title="Is a direct GPON ONT connection faster than through an ethernet ONT?" Tags="|ethernet|fiber|sfp|" AnswerCount="1" CommentCount="4" ClosedDate="2018-06-12T02:11:44.213" ContentLicense="CC BY-SA 3.0" />
  <row Id="29365" PostTypeId="2" ParentId="29348" CreationDate="2016-04-07T07:40:10.233" Score="6" Body="&lt;p&gt;Found the solution to my own question with the help and hint from @Guy Harris. &#xA;The kernel was dropping packets due to that the buffer tcpdump uses got overfull when capturing whole TCP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From tcpdump man page:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;packets dropped by kernel (this is the number of packets that were dropped, due to a lack of buffer space, by the packet capture mechanism in the OS     on   which tcpdump is running, if the OS reports that information to applications; if not, it will be reported as 0).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The kernel puts captured packets in a fixed-size capture buffer. If tcpdump doesn't empty that buffer quickly enough, the kernel will begin overwriting old packets in the buffer and correspondingly incrementing the dropped counter. The value of that counter is what you see as &quot;dropped by kernel&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The capture buffer can be re sized by giving &lt;code&gt;tcpdump&lt;/code&gt; the &lt;code&gt;-B&lt;/code&gt; option to specify new buffer size in KiB&lt;/p&gt;&#xA;" OwnerUserId="22810" LastActivityDate="2016-04-07T07:40:10.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29366" PostTypeId="1" AcceptedAnswerId="29368" CreationDate="2016-04-07T08:12:32.820" Score="1" ViewCount="541" Body="&lt;p&gt;I'm currently studying about the CSMA protocol and I struggle to understand the meaning of &quot;listen&quot; in the well known definition:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;CSMA is based on the principle &quot;sense before transmit&quot; or &quot;listen before talk&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For example: Consider stations A,B. Let's say the cable is idle. So, A starts to transmit (it is true to say that only when finished transmitting, the propagation begins?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, B want to transmit some frame. How B knows that A is transmitting? There is something that A sends to the other station before it start transmitting?&lt;/p&gt;&#xA;" OwnerUserId="24542" LastEditorUserId="2142" LastEditDate="2016-08-24T13:37:01.507" LastActivityDate="2016-08-24T13:37:01.507" Title="What does &quot;listen&quot; mean in the CSMA protocol?" Tags="|ethernet|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29368" PostTypeId="2" ParentId="29366" CreationDate="2016-04-07T09:14:30.270" Score="2" Body="&lt;p&gt;If &lt;em&gt;station A&lt;/em&gt; needs to transmit, it tries to detect the presence of a carrier signal from another node before attempting it. If  there is no carrier then it starts to transmit and this transmission starts to propagate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It means that while the &lt;strong&gt;first bit&lt;/strong&gt; reach the farthest point of the media, station A is &lt;strong&gt;still&lt;/strong&gt; transmitting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's suppose that station B needs to transmit, it detects a carrier in the media and then waits for the transmission in progress to end before initiating its own transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The propagation delay is not the same for each media (air, coaxial cable, UTP, fiber optic, etc.). That's why there is a &lt;em&gt;distance limit&lt;/em&gt; for each media. To be sure that whenever a station needs to use the media every other station is aware of the state of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exceeding the recommended distance limit will cause &lt;em&gt;late collisions&lt;/em&gt;: A type of collision that happens further than is allowed. It will decrease the throughput of the communication link because the data error will go up to the upper layers.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-04-07T09:23:47.897" LastActivityDate="2016-04-07T09:23:47.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29369" PostTypeId="2" ParentId="29366" CreationDate="2016-04-07T09:15:35.787" Score="2" Body="&lt;p&gt;In an Ethernet segment (a collision domain), all the stations are connected to a common media or cable.   In the original Ethernet implementation, it was a physical coax cable that ran though the building -- each station was connected to this cable.  So when A transmits, B and everyone else can measure the electrical signal and detect that A is transmitting.  Because it is a cable, the signals propagate at near the speed of light (about 0.6c).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-07T09:15:35.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29370" PostTypeId="2" ParentId="28542" CreationDate="2016-04-07T09:21:46.247" Score="1" Body="&lt;p&gt;I finally found a way to activate the CDP compatibility on a HP V1910-24G Switch: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; [MySwitch] lldp compliance cdp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then I activate the cdp in the proper interfaces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; [interface 1] lldp compliance admin-status cdp txrx&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22889" LastEditorUserId="509" LastEditDate="2017-04-20T07:01:41.997" LastActivityDate="2017-04-20T07:01:41.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29371" PostTypeId="2" ParentId="29210" CreationDate="2016-04-07T09:24:26.430" Score="0" Body="&lt;p&gt;Since I couldn't connect using the console cable directly, I installed a dhcp server temporarily, then I accesses the leased ip address to my HP Procurve switch, changed the IP into a static one and accessed the switch terminal through a telnet connection. afterward I stopped the dhcp server since I don't really need it any more.&lt;/p&gt;&#xA;" OwnerUserId="22889" LastActivityDate="2016-04-07T09:24:26.430" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29372" PostTypeId="1" AcceptedAnswerId="29596" CreationDate="2016-04-07T10:45:35.640" Score="1" ViewCount="900" Body="&lt;p&gt;Is it possible to get L2VPN xconnect state in IOS-XR routers over SNMP? It should have 7 possible states(&lt;em&gt;Up&lt;/em&gt;, &lt;em&gt;Down&lt;/em&gt;, &lt;em&gt;Admin Down&lt;/em&gt;, &lt;em&gt;Unresolved&lt;/em&gt;, &lt;em&gt;Standby&lt;/em&gt;, &lt;em&gt;Standby Ready&lt;/em&gt;, &lt;em&gt;Partially Programmed&lt;/em&gt;):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:r1#show l2vpn xconnect group TEST-GROUP xc-name TEST-XCONNECT        &#xA;Legend: ST = State, UP = Up, DN = Down, AD = Admin Down, UR = Unresolved,&#xA;        SB = Standby, SR = Standby Ready, (PP) = Partially Programmed&#xA;&#xA;XConnect                   Segment 1                       Segment 2                &#xA;Group      Name       ST   Description            ST       Description            ST    &#xA;------------------------   -----------------------------   -----------------------------&#xA;TEST-GROUP TEST-XCONNECT&#xA;                      UP   Gi0/1/0/1.2            UP       192.0.2.27   2110   UP    &#xA;----------------------------------------------------------------------------------------&#xA;RP/0/RSP0/CPU0:r1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At least for example polling pseudo-wire packet statistics over SNMP in IOS-XR is not supported.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2016-04-15T11:55:05.633" Title="L2VPN xconnect state in IOS-XR routers over SNMP" Tags="|snmp|cisco-ios-xr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29373" PostTypeId="2" ParentId="2024" CreationDate="2016-04-07T10:47:50.117" Score="1" Body="&lt;p&gt;Specifically concerning &lt;strong&gt;negotiate&lt;/strong&gt; or &lt;strong&gt;nonegotiate&lt;/strong&gt; ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default, the &lt;em&gt;negotiation&lt;/em&gt; port setting is &lt;strong&gt;on&lt;/strong&gt;, that is , the ability to negotiate a &lt;em&gt;trunk&lt;/em&gt; port (if not a &lt;em&gt;trunk&lt;/em&gt; the port becomes an &lt;em&gt;access&lt;/em&gt; port.) To see all a ports settings use the useful command &lt;strong&gt;show interfaces switchport&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: &lt;strong&gt;nonegotiation&lt;/strong&gt; can be used on an &lt;strong&gt;access&lt;/strong&gt; link as well, a clue why it is used - it saves on network activity and CPU cycles, because &lt;strong&gt;DTP&lt;/strong&gt; is off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A port set with &lt;strong&gt;nonegotiate&lt;/strong&gt; still forms a &lt;em&gt;trunk link&lt;/em&gt; with (and only with) an opposing port set to &lt;strong&gt;trunk&lt;/strong&gt;. Both ports must be set using &lt;strong&gt;switchport mode trunk&lt;/strong&gt; command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I confess I am all theory and not a networking pro! Happy to be corrected&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: using &lt;em&gt;nonegotiation&lt;/em&gt; is used when linking a Cisco switch to a non Cisco switch that does not understand &lt;strong&gt;DTP&lt;/strong&gt;, and so gets confused by DTP messages. The DTP protocol agrees the &lt;strong&gt;encapsulation&lt;/strong&gt; between the two interfaces, all switches will use the IEEE 802.1Q standard (all Cisco switches do now as well, ISL is legacy.) so there is the common theme, there is no need for &lt;em&gt;negotiating&lt;/em&gt;. If you know definitely which ports will &lt;strong&gt;trunk&lt;/strong&gt; and which will be &lt;strong&gt;access&lt;/strong&gt;, hard code them that way and turn off &lt;em&gt;negotiation&lt;/em&gt;, which can cause problems&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.netsage.net/?p=610&quot; rel=&quot;nofollow&quot;&gt;My full blog answer&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24363" LastEditorUserId="24363" LastEditDate="2016-04-15T09:21:09.950" LastActivityDate="2016-04-15T09:21:09.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29374" PostTypeId="1" AcceptedAnswerId="29383" CreationDate="2016-04-07T12:25:25.713" Score="0" ViewCount="8055" Body="&lt;p&gt;In the HP Procurve manual it says to use the following command to up load a file from the switch to a tftp server: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;HP2512# copy startup-config tftp 13.28.227.105 d:\configs\sw2512&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case, my tftp server is on a ubuntu 14.04 LTS machine, so I did the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;HP2512# copy startup-config tftp myIP /tftpboot/swconf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it didn't work : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Transport Error.&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="22889" LastEditorUserId="8499" LastEditDate="2017-08-01T13:16:51.050" LastActivityDate="2017-08-01T13:16:51.050" Title="Can't upload the config file of an HP Procurve switch inti a tftp server on ubuntu" Tags="|switch|hp-procurve|tftp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29375" PostTypeId="1" AcceptedAnswerId="30129" CreationDate="2016-04-07T13:46:32.483" Score="2" ViewCount="1422" Body="&lt;p&gt;How 2 ASes connect with each other? Is there just a link (cable) between two, or it has to be an IXP (Internet Exchange Point) there to link 2 ASes?&lt;/p&gt;&#xA;" OwnerUserId="14512" LastActivityDate="2016-05-03T22:32:09.123" Title="How two Autonomous systems connect with each other?" Tags="|routing|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29376" PostTypeId="2" ParentId="29375" CreationDate="2016-04-07T14:21:51.613" Score="2" Body="&lt;p&gt;Both are used very often: private interconnects are often used between a BGP transit customer and its upstream networks as well as between networks which need to exchange a lot of traffic, to offload this traffic from IXP links. BGP sessions via IXPs are often used to connect with a lot of networks without having to set up private interconnects with each network.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-04-07T14:21:51.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29377" PostTypeId="2" ParentId="29375" CreationDate="2016-04-07T14:51:18.923" Score="1" Body="&lt;p&gt;Both forms are used for interconnecting 2 ASes. Think this, right now, yor are located is some place on earth, and your network belong to some provider who is been announcing to the internet by some AS. Then, you can reach eg, Microsoft, who i'm not sure, but i think belong to another AS how maybe is located at the other side of earth, what i saying is that between you and the whole internet, exist a lots of ASes where your network(your IP belong to that network) is announced. Also, maybe, by some case, you access one IP that is located in some AS beside you&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-04-07T14:51:18.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29378" PostTypeId="1" AcceptedAnswerId="29380" CreationDate="2016-04-07T15:06:45.677" Score="1" ViewCount="966" Body="&lt;p&gt;I have this configuration on an interface of my CISCO switch (switch 1).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switchport access vlan 52  &#xA; switchport mode access  &#xA; switchport port-security  &#xA; switchport port-security aging time 5  &#xA; switchport port-security violation restrict  &#xA; spanning-tree portfast  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now when I connect another switch (switch 2) to this interface, then a PC (PC 1) to switch 2, all works fine. But when I connect another PC (PC 2) to switch 2, PC 1 goes automatically out of network, leaving only PC 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, only one device can be connected to switch 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the logs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Security violation occurred, caused by MAC address a0b3.cc9c.796a on port GigabitEthernet2/26.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2d02h: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address a0b3.cc9c.796a on port GigabitEthernet2/26.&#xA;2d02h: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address a0b3.cc9c.796a on port GigabitEthernet2/26.&#xA;2d02h: %PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address a0b3.cc9c.796a on port GigabitEthernet2/26.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What could be the problem? How can I solve the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: I am new to Networking&lt;/p&gt;&#xA;" OwnerUserId="24161" LastEditorUserId="8499" LastEditDate="2016-04-07T16:11:41.397" LastActivityDate="2016-04-07T16:11:41.397" Title="Switch can't connect more than 1 device to network. 1st device automatically disconnected when 2nd is connected" Tags="|cisco-catalyst|cisco-commands|" AnswerCount="2" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29379" PostTypeId="2" ParentId="29378" CreationDate="2016-04-07T15:12:18.130" Score="-3" Body="&lt;p&gt;If I am understanding this correctly your setup is &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                           PC1&#xA;Switch 1 &amp;lt;----&amp;gt; Switch 2 &amp;lt;&#xA;                           PC2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If this is the case, the connection between your two switches needs to be a trunk, not an access port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 1 &amp;lt;---trunk---&gt; Switch 2, off of Switch 2, each PC connects to an access port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access ports are basically a host port, where you should usually only have one end device. If there are to be multiple hosts behind it, the inter-switch connection needs to be a trunk.&lt;/p&gt;&#xA;" OwnerUserId="17253" LastActivityDate="2016-04-07T15:12:18.130" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29380" PostTypeId="2" ParentId="29378" CreationDate="2016-04-07T15:25:06.387" Score="2" Body="&lt;p&gt;The problem is, that by default, maximum number of secure mac address is 1. So when the switch 1 learns about the first PC, it will save MAC of PC as secure MAC. Second PC's MAC is not secure, therefore port-security violation occurs, restricting traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can solve this by increasing maximum number of secure MAC adresses using command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch1(config-if)#switchport port-security maximum 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT: Fixed up the syntax&lt;/p&gt;&#xA;" OwnerUserId="16890" LastEditorUserId="16890" LastEditDate="2016-04-07T16:04:19.527" LastActivityDate="2016-04-07T16:04:19.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29381" PostTypeId="1" CreationDate="2016-04-07T15:42:45.640" Score="1" ViewCount="4505" Body="&lt;p&gt;I inherited a small setup for a VM complex. It is centrally connected via a Juniper EX Switch Stack (as a virtual chassis). Connected to it via lag/trunks (carrying all the same vlans) are 4 Dell blade chassis with integrated switches (6348). The Juniper has RSTP enabled however nothing specific configured. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Dell chassis switches do not have spanning-tree enabled, and chassis3 (which is an older chassis than the 6348) is being elected root bridge currently. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any good reason spanning-tree would be disabled in this setup or was this just a bad setup from the beginning?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iSDMy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iSDMy.png&quot; alt=&quot;Juniper-Dell complex&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17253" LastEditorUserId="509" LastEditDate="2016-04-10T21:59:10.517" LastActivityDate="2016-07-10T07:15:56.540" Title="Reason to disable spanning-tree?" Tags="|juniper|spanning-tree|dell|juniper-ex|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29382" PostTypeId="2" ParentId="9629" CreationDate="2016-04-07T16:20:58.843" Score="2" Body="&lt;p&gt;This is an old question, but I recently ran into this same issue, and after some trial and error, I was able to come up with a solution.  The following applies to ASA Version 9.1.  I have two VLANs on our network: one for PCs, and one for VoIP.  I wanted the VoIP VLAN to use its own outside address, separate from the outside address used by the PCs.  Here's what the configuration ended up looking like (IP addresses have been obfuscated slightly).  These are only the pertinent parts of the configuration, not a complete dump:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: ASA Version 9.1(2) &#xA;&#xA;interface Ethernet0/0&#xA;!&#xA;interface Ethernet0/1&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/6&#xA; switchport access vlan 50&#xA;!&#xA;interface Vlan1&#xA;  nameif outside&#xA;  security-level 0&#xA;  ip address 65.65.65.10 255.255.255.192 &#xA;!&#xA;interface Vlan2&#xA; nameif net-inside&#xA; security-level 100&#xA; ip address 10.1.10.1 255.255.248.0 &#xA;!&#xA;interface Vlan50&#xA; nameif net-voip&#xA; security-level 100&#xA; ip address 172.16.0.1 255.255.255.0 &#xA;!&#xA;object network net-voip&#xA; subnet 172.16.0.0 255.255.255.0&#xA; nat (net-voip,outside) dynamic 65.65.65.20&#xA;!&#xA;nat (net-inside,outside) after-auto source dynamic any interface&#xA;!&#xA;dhcpd ping_timeout 750&#xA;dhcpd auto_config outside&#xA;dhcpd address 172.16.0.100-172.16.0.127 net-voip&#xA;dhcpd dns 8.8.8.8 interface net-voip&#xA;dhcpd enable net-voip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also included the part of my configuration which sets up DHCP on the VoIP VLAN for the phones.  One snag I ran into (which should've been obvious in retrospect), the &lt;code&gt;net-voip&lt;/code&gt; VLAN needs to have a security level higher than the outside VLAN, otherwise it won't be allowed out.  &lt;/p&gt;&#xA;" OwnerUserId="24372" LastEditorUserId="8499" LastEditDate="2016-04-07T16:32:24.113" LastActivityDate="2016-04-07T16:32:24.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29383" PostTypeId="2" ParentId="29374" CreationDate="2016-04-07T17:28:26.237" Score="2" Body="&lt;p&gt;It's most likely a tftpd configuration problem: it is rather picky. Check you are running as a user with write permissions, that SELinux isn't preventing writes; read very carefully the man page, especially the bits about --create and --permissive. If that doesn't get you anywhere, crank up the verbosity and check the syslogs. &lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2016-04-07T17:28:26.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29384" PostTypeId="1" AcceptedAnswerId="29404" CreationDate="2016-04-07T15:48:05.093" Score="2" ViewCount="1845" Body="&lt;p&gt;What is the purpose of checking errors in almost every layer of a network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I don't see the purpose of using a checksum in TCP given that CRC has already been checked in lower layers. Or checking md5sum in application layer given that TCP has it's own checksum technique. Isn't it inefficient?&lt;/p&gt;&#xA;" OwnerUserId="24378" OwnerDisplayName="Carlos Pinzón" LastEditorUserId="24378" LastEditDate="2016-04-07T20:34:02.950" LastActivityDate="2016-04-08T03:00:33.990" Title="Why are there error detection methods in almost every layer of a network?" Tags="|errors|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29385" PostTypeId="2" ParentId="29384" CreationDate="2016-04-07T16:27:15.687" Score="0" Body="&lt;p&gt;As Daniel said:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The checksum at higher levels checks for errors at higher levels. Not doing that would assume that all processing from the channel up is 100% error free, which is not necessarily true either. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That pretty much sums it up. The multi-level error checking will also catch errors that occur during transmission between layers since no data line is noise-free.&lt;/p&gt;&#xA;" OwnerDisplayName="KilowattLaser" LastActivityDate="2016-04-07T16:27:15.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29387" PostTypeId="2" ParentId="29384" CreationDate="2016-04-07T17:42:12.383" Score="2" Body="&lt;p&gt;Remember that each layer is independent of every other layer, and the original design of each protocol in a layer is that &lt;em&gt;my layer&lt;/em&gt; cannot depend on &lt;em&gt;your layer&lt;/em&gt; doing any error detection, or the error detection which &lt;em&gt;my layer&lt;/em&gt; requires. Also, if you have a datagram which is destined for a particular layer (e.g. ARP for layer-2, or ICMP for layer-3), the layer for which the datagram is destined wants to be sure the datagram is valid as received, and it wasn't mangled between layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To your point, IPv6 has actually dropped error detection on packets because it assumes that the layers above and below it will perform error detection.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-07T17:42:12.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29390" PostTypeId="1" AcceptedAnswerId="29392" CreationDate="2016-04-07T18:43:10.347" Score="4" ViewCount="4522" Body="&lt;p&gt;When a computer, &lt;strong&gt;Computer A&lt;/strong&gt;, wants to communicate with &lt;strong&gt;Computer B&lt;/strong&gt;, it (Computer A) will use &lt;strong&gt;MAC&lt;/strong&gt; and &lt;strong&gt;IP&lt;/strong&gt; addresses. It will send the packet of information to &lt;strong&gt;Switch&lt;/strong&gt;, which, based upon the &lt;strong&gt;MAC&lt;/strong&gt; destination address contained in the packet of information, will look on its lookup table if the computer that owns the mentioned MAC Destination Address is available on the &lt;strong&gt;LAN&lt;/strong&gt; network, right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is unable to locate the computer on the LAN (suppose here that the lookup table is full), will it send it to &lt;strong&gt;Router&lt;/strong&gt;, or does &lt;strong&gt;Computer A&lt;/strong&gt; decide to send directly to the &lt;strong&gt;MAC&lt;/strong&gt; address of the &lt;strong&gt;Network Interface Card&lt;/strong&gt; of &lt;strong&gt;Router&lt;/strong&gt; (the link with the WAN or the Internet for my LAN)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a little bit confused related to the way that switches communicate with routers. When and how is this done?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/342wH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/342wH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user24308" LastEditorUserId="8499" LastEditDate="2018-03-09T23:24:35.800" LastActivityDate="2021-01-30T07:45:05.827" Title="Communication between a Switch and Router?" Tags="|routing|switch|router|switching|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29391" PostTypeId="1" AcceptedAnswerId="29406" CreationDate="2016-04-07T18:47:08.793" Score="1" ViewCount="1037" Body="&lt;p&gt;I have one Cisco WLC 5508 with 40 access points and I need to implement HA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, as I understand, I need to buy the 5508 HA version of the controller. What is the differences between standard and HA versions? Or is it just different license/image? Am I right that I don't need to buy AP licenses for HA version? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, as I understand, I can buy additional 10 licenses for APs for the main controller and standard version of the WLC without additional licenses. Am I right?&lt;/p&gt;&#xA;" OwnerUserId="24375" LastEditorUserId="24375" LastEditDate="2016-04-07T19:25:00.997" LastActivityDate="2016-04-08T11:03:20.640" Title="Cisco WLC 5508 HA licensing" Tags="|wlc|cisco-wlc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29392" PostTypeId="2" ParentId="29390" CreationDate="2016-04-07T18:48:44.123" Score="6" Body="&lt;p&gt;A host will first determine if the destination IP address is on the same network. If not, it will send the IP packet to its configured gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch doesn't decide this, and, to a switch, a router is just another host. The MAC address to which a frame is delivered is determined by the host before the host encapsulates the packet in a frame.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-07T18:48:44.123" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="29394" PostTypeId="2" ParentId="29381" CreationDate="2016-04-07T19:09:25.307" Score="-1" Body="&lt;p&gt;In STP when a new link on a port comes up it takes almost a minute for STP to listen on that port and make sure there isn't a loop back to itself before allowing frames to pass. Some services like DHCP will timeout during this wait. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only reason I know of to turn off STP is on access ports for hosts so they come up immediately. With that said its best practice to enable BPDU guard or filter to immediately shut that port down if a loop does occur.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your setup, the Juniper stack w/ RSTP provides protection from loops. If there is any way a loop could be created on the Dell switches I would enable STP everywhere, otherwise I would leave it be.&lt;/p&gt;&#xA;" OwnerUserId="5746" LastActivityDate="2016-04-07T19:09:25.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29395" PostTypeId="2" ParentId="29384" CreationDate="2016-04-07T19:22:20.247" Score="2" Body="&lt;p&gt;You didn't specify what protocol or media TCPs running on in your case, but assuming IP, the checksums calculated by the sender and checked by the receiver only verify the packet headers, not the pay load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As pointed out by others TCP can run on other protocols and media that may not provide data integrity, but TCP in accordance with &lt;a href=&quot;http://www.ietf.org/rfc/rfc793.txt&quot; rel=&quot;nofollow&quot;&gt;RFC793&lt;/a&gt;, must guarantees data integrity, thus it does a check of the data itself.&lt;/p&gt;&#xA;" OwnerUserId="5746" LastEditorUserId="5746" LastEditDate="2016-04-08T00:18:58.330" LastActivityDate="2016-04-08T00:18:58.330" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29396" PostTypeId="1" AcceptedAnswerId="29412" CreationDate="2016-04-07T19:37:26.727" Score="1" ViewCount="2689" Body="&lt;p&gt;I tried to setup simple L2 bridging on vMX.2 vMX devices: two VLANs (two bridging domains) per device, and trunk links between both. The end devices, VPCs, attached to access ports on each vMX, were unable to communicate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain this to me? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8XCvq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8XCvq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration I used is below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ge-0/0/1 {&#xA;    description &quot; trunk link vMX1-&amp;gt;vMX2 handle traffic of VLANID 400,500&quot;;&#xA;    unit 0 {&#xA;        family bridge {&#xA;            interface-mode trunk;&#xA;            vlan-id-list [ 400 500 ];&#xA;        }&#xA;    }&#xA;}&#xA;ge-0/0/2 {&#xA;    description &quot;vMX-1-&amp;gt;VLAN BLUE/VLANID 400&quot;;&#xA;    unit 0 {&#xA;        family bridge {&#xA;            interface-mode access;&#xA;            vlan-id 400;&#xA;        }&#xA;    }&#xA;}&#xA;ge-0/0/3 {&#xA;    description &quot;vMX-1-&amp;gt;VLAN RED /VLANID 500&quot;;&#xA;    unit 0 {&#xA;        family bridge {&#xA;            interface-mode access;&#xA;            vlan-id 500;&#xA;        }&#xA;    }&#xA;}&#xA;irb {&#xA;    unit 400 {&#xA;        family inet {&#xA;            address 172.21.17.254/24;&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;&#xA;root@vMX-1&amp;gt; show configuration bridge-domains&#xA;BLUE {&#xA;    domain-type bridge;&#xA;    vlan-id 400;&#xA;    routing-interface irb.400;&#xA;}&#xA;RED {&#xA;    domain-type bridge;&#xA;    vlan-id 500;&#xA;}&#xA;&#xA;root@vMX-1&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24376" LastEditorUserId="8499" LastEditDate="2016-04-07T22:41:55.477" LastActivityDate="2016-04-08T18:09:32.417" Title="Setup layer-2 bridging between two Juniper vMX" Tags="|juniper|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29397" PostTypeId="1" AcceptedAnswerId="29398" CreationDate="2016-04-07T20:30:31.873" Score="1" ViewCount="247" Body="&lt;p&gt;I have just started learning about the different layers of the Internet. As I understand  it, the Transport layer is responsible for extending the Network layer's host-to-host delivery service to process-to-process delivery by multiplexing application messages from host processes to the network edge and demultiplexing network datagrams from the network edge to the appropriate processes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conceptually, why do we need the Transport layer at all? Can't the host processes take responsibility for multiplexing segments, and the network edge can be responsible for demultiplexing them once they reach the correct host? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thinking is that, by providing a Transport layer, we can have a &quot;separation of concerns&quot; between creating a message, delivering it to the network, and then delivering it to the appropriate host, but I'm not sure if this is a partial/whole answer. Any clarification would be much appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I read &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/18510/what-is-the-need-for-transport-layer&quot;&gt;this post&lt;/a&gt; that asks a similar question, and the answer is that it having a Transport layer which implements a protocol that guarantees reliability etc. simplifies applications at Layer 5, but I'm more concerned with the Transport layer overall, regardless of the protocol that's being run on it.&lt;/p&gt;&#xA;" OwnerUserId="24377" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-12-20T02:20:08.127" Title="Purpose of the Transport Layer from a Conceptual Perspective" Tags="|protocol-theory|transport-protocol|layer4|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29398" PostTypeId="2" ParentId="29397" CreationDate="2016-04-07T20:47:06.997" Score="1" Body="&lt;p&gt;It really depends on which layer-3 protocol you are using. IP, itself, allows up to 256 different processes to attach to it, and some of those processes are used by IP itself (e.g. ICMP). This is rather limiting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding layer-4 allows a layer-4 to define a way to have more processes to attach to the network stack. For example, TCP and UDP have up to 65536 addresses (ports) each, to which processes may attach. Other layer-4 protocols can allow more, or less, processes to attach. You can also have different layer-4 protocols, which serve different purposes, (e.g. connection-oriented, connectionless, custom for a specific purpose, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can certainly let an application multiplex for itself. You can do this with TCP or UDP, for example, HTTP servers multiplex requests which come into TCP port 80. When an application does this, it needs to provide for its own protocol (e.g. HTTP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-4 on one host talks to layer-4 on another host, and delivers datagrams between applications. Layer-3 is concerned with delivering packets between networks, and layer-2 is concerned with delivering frames on a LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-08T18:48:30.667" LastActivityDate="2016-04-08T18:48:30.667" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29399" PostTypeId="2" ParentId="29355" CreationDate="2016-04-07T21:34:32.953" Score="2" Body="&lt;p&gt;It would appear this is a simple one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believed that the peer link should only contain the &lt;code&gt;mlag&lt;/code&gt; communication VLAN (rather than everything), so on the peer link port channel simply replacing,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk allowed vlan 4094&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk allowed vlan 10,4094&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Immediately provided ICMP response from both sw3 to sw1,sw2 and between sw1 and sw3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show spanning tree&lt;/code&gt; confirms there are no blocked interfaces, so Arista is clearing working some voodoo to prevent L2 loops with the mlag peer link.&lt;/p&gt;&#xA;" OwnerUserId="24344" LastActivityDate="2016-04-07T21:34:32.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29400" PostTypeId="2" ParentId="29187" CreationDate="2016-04-07T22:23:14.040" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;1.) The Microchip wifi Beacon announces the network, I assume the BSSID is randomly assigned in IBSS / Ad Hoc mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To some degree, this is true. For clarity, from IEEE-802.11-2012 section 10.1.4.1:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When a STA starts a BSS, that STA shall determine the BSSID of the BSS. If the BSSType indicates an infrastructure BSS, then the STA shall start an infrastructure BSS and the BSSID shall be equal to the STA’s dot11StationID. The value of the BSSID shall remain unchanged, even if the value of dot11StationID is changed after the completion of the MLME-START.request primitive. If the BSSType indicates an IBSS, the STA shall start an IBSS, and the BSSID shall be an individual locally administered IEEE MAC address as defined in 9.2 of IEEE Std 802-2001. The remaining 46 bits of that MAC address shall be a number selected in a manner that minimizes the probability of STAs generating the same number, even when those STAs are subjected to the same initial conditions. The value SSID parameter shall be used as the SSID of the new BSS. It is important that designers recognize the need for statistical independence among the random number streams among STAs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, the first STA to start in the IBSS should generate the BSSID, however further STA's that join the IBSS should adopt this value.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2.b) The iPhone6 sends a probe request to the randomly assigned BSSID and never receives a probe response, therefore not knowing that the Microchip can only listen on 1 / 2 Mbit / s and starts talking at 12 Mbit / s in further conversation, which obviously doesn't work.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I will start by noting that there isn't a single probe response in this capture. This leads me to believe that there is some sort of problem with how this capture was obtained. As such, there is no way to determine if the Microchip device has responded with a probe response or not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, we can assume that a probe response has been sent and recevied at some point because it appears your iPhone6 has joined the IBSS. Take a look at the beacon frames at 19.85 seconds into the capture. You now see both the Microchip and the iPhone6 sending beacon frames for &quot;Anova 1&quot; with the same BSSID. Since they have synchronized the BSSID, this would indicate they have both become part of the same IBSS.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The question now is which of the two wifi firmwares behaves not according to the 802.11-2012 standard?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Based on the evidence at hand, and technically speaking, they both appear to be adhering to the standard. We would need a better capture to make any further determinations.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I'm investigating an issue with an iPhone controllable hardware, which operates in IBSS / Ad Hoc mode. Since the hardware generation of iPhone6 &amp;amp; Co the iDevices can't connect to the hardware anymore, which creates the wifi network with a deprecated Microchip 802.11 b listening only to 1 / 2 Mbit / s.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It looks like the IBSS is established. You need to start looking at why the two are not actually communicating.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-04-07T22:23:14.040" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29401" PostTypeId="2" ParentId="29221" CreationDate="2016-04-07T23:34:50.323" Score="1" Body="&lt;p&gt;You could call it either an interface or port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will sometimes hear people try to create distinct meanings for the two terms. For example that &quot;port&quot; is hardware (i.e. where you connect the cable) and &quot;interface&quot; is software. Or perhaps port is L2 and interface is L3/routed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reality is that to my knowledge, the terms &quot;port&quot; and &quot;interface&quot; really do not have a clear distinction industry wide. When and how they are used in my experience seems to depend largely on personal preference and background (i.e. which vendors/platforms you are familiar with, environments in which you have worked, etc). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco of today generally seems to try to use the term &quot;port&quot; when referring to the &quot;hardware entity&quot; and &quot;interface&quot; when referring to a &quot;logical entity&quot; such as you will find in &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/controller/7-4/configuration/guides/consolidated/b_cg74_CONSOLIDATED/b_cg74_CONSOLIDATED_chapter_011010.html&quot; rel=&quot;nofollow&quot;&gt;this example&lt;/a&gt;. However in the past they have used the two terms a bit differently, such as the use of port in CatOS. When it comes to calling something a &quot;trunk port&quot; or an &quot;access port&quot;, you are really calling out the difference in the mode of operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is only one context I can think of in which I know I have always seen a very consistent use of these two terms industry wide. When referring to a passive connection point (such as on the wall behind your desk or on a patch panel), always use port and never interface. However, to keep it confusing, passive connection points may also be referred to as a jack, socket, or outlet as well.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2016-04-07T23:47:48.053" LastActivityDate="2016-04-07T23:47:48.053" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29404" PostTypeId="2" ParentId="29384" CreationDate="2016-04-08T03:00:33.990" Score="4" Body="&lt;p&gt;If a packet gets corrupted on the wire, then the Ethernet FCS should catch that. However, many switches and routers will strip off the FCS, route the packet, and then compute a new FCS. If the packet gets corrupted while being shuffled around inside the switch (which happens occasionally), then you will end up with a corrupt packet that has a valid Ethernet FCS. This is why error detection is performed at multiple levels. It is also common to perform checks at even higher levels - say, checking the hash of a large downloaded file just in case something else about the transfer got screwed up (packet corrupted such that tcp missed the error, or perhaps the server sent the wrong data to the tcp stack in the first place, or the data got corrupted when read off of the disk or out of the server's RAM and the TCP segment offload engine on the NIC got bad data, etc.).&lt;/p&gt;&#xA;" OwnerUserId="20021" LastActivityDate="2016-04-08T03:00:33.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29405" PostTypeId="2" ParentId="22360" CreationDate="2016-04-08T10:50:36.863" Score="0" Body="&lt;p&gt;Well, I am anti-Cisco solution Designer. We also have this situation around a year ago. We were using satellite backhaul for voice and data. Else, we were also connected redundant to a local operator via 3G connection. All we did is that we use a simple E1 to Ethernet convertor (Chinese converter). this converter has a DTE V.35 port for satellite and to transport this data we connect one port with VOIP gateway. As gateway was connected to data and Voice. Then for 3G connection we used the WAN port of the VOIP GW to a simple layer 2 swtich with activating the port preference. 3G and satellite were on 1+1 HSB. Then for that 3G connection we used a simple router with a SIM port on at WAN.Then we created a VPN from that remote site to the HUB site. You can use VPN of the router and get it connected to the HUB site. It is much more cheaper solution than Cisco. Its all about you skill and thinking. EVery item we used was a chinese made......&lt;/p&gt;&#xA;" OwnerUserId="24389" LastActivityDate="2016-04-08T10:50:36.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29406" PostTypeId="2" ParentId="29391" CreationDate="2016-04-08T11:03:20.640" Score="1" Body="&lt;p&gt;Most of what you are looking for is explained here :&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/wireless/aironet-1130-ag-series/qa_c67-714540.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/wireless/aironet-1130-ag-series/qa_c67-714540.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no HW difference that I'm aware of, however if you buy an -HA version of the controller, it can only ever be an HA controller, you can't convert it to be a primary controller, whereas the reverse is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't need to buy licenses for the HA controller, as it &quot;adopts&quot; the primary's licenses for up to 90 days, the assumption being that that is enough time for you to repair your primary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm afraid I do not quite understand your final question.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-04-08T11:03:20.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29407" PostTypeId="2" ParentId="7022" CreationDate="2016-04-08T12:27:14.700" Score="0" Body="&lt;p&gt;you could use port redundancy on the Sonicwall if it is NSA2600 or above &amp;amp; Sonicos 6.2 and above. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://documents.software.dell.com/sonicos/6.2/administration-guide/network/configuring-interfaces/network-interfaces/configuring-interfaces/configuring-link-aggregation-and-port-redundancy?ParentProduct=849&quot; rel=&quot;nofollow&quot;&gt;https://documents.software.dell.com/sonicos/6.2/administration-guide/network/configuring-interfaces/network-interfaces/configuring-interfaces/configuring-link-aggregation-and-port-redundancy?ParentProduct=849&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="24392" LastActivityDate="2016-04-08T12:27:14.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29410" PostTypeId="1" CreationDate="2016-04-08T16:07:15.780" Score="4" ViewCount="1531" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The NEXT value for a given cable type is generally expressed in&#xA;  decibels per feet or decibels per 1000 feet. NEXT value varies with&#xA;  the frequency of transmission. The higher the NEXT value, the greater&#xA;  the cable’s ability to reject crosstalk at its local connection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm trying to understand how one would calculate NEXT (Near-end Crosstalk). I assume the effect would be greatest at the source of the noise?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, given some arbitrary figures:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;signal power at source 1 watt&lt;/li&gt;&#xA;&lt;li&gt;NEXT crosstalk 10dB/1000 feet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have been told that it's similar to a SNR ratio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this mean that at 1000 feet, we would expect one tenth of the signal to leak to the adjacent pair?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would one calculate the crosstalk closer to the source?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect I'm missing a couple of pieces of the puzzle, any help would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;T.I.A.&lt;/p&gt;&#xA;" OwnerUserId="13244" LastEditorUserId="8499" LastEditDate="2016-04-08T22:56:43.187" LastActivityDate="2019-03-19T08:45:43.573" Title="NEXT Crosstalk calculation" Tags="|cable|layer1|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29412" PostTypeId="2" ParentId="29396" CreationDate="2016-04-08T17:59:18.470" Score="1" Body="&lt;p&gt;Try setting &lt;code&gt;flexible-vlan-tagging&lt;/code&gt; and &lt;code&gt;encapsulation flexible-ethernet-services&lt;/code&gt; on the physical interfaces. This works for similar setups I have in production.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: on a vMX this might be confusing. By &quot;physical&quot; interface I mean ge-n/n/n rather than the &quot;logical&quot; ge-n/n/n.0&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastEditorDisplayName="user661" LastEditDate="2016-04-08T18:09:32.417" LastActivityDate="2016-04-08T18:09:32.417" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29413" PostTypeId="2" ParentId="29410" CreationDate="2016-04-08T19:04:32.783" Score="4" Body="&lt;p&gt;When you send a signal on a wire pair, a copy of that signal is induced on the adjacent pairs in two directions. The induced signal back toward the sending point is call NEXT (Near-end Crosstalk), and the induced signal heading away from the sending point is called FEXT (Far-end Crosstalk). This signal induction happens along the length of the cable (a long wire is an antenna). When you send a signal from one end of a cable, you measure NEXT at that end of the cable, and you measure FEXT at the other end of the cable. It's not simply the signal induced at the near end which is measured, but from the whole cable length, since the far end of the cable will also be inducing a signal back toward the sending end, as will happen along the whole cable length. That's why NEXT is measured per a particular length.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You measure NEXT and FEXT to determine the resistance of the cabling to a signal induced from within the cable sheath. These values are measured on all pairs, and the worst values are used to rate the cable. Since NEXT is a measure of difference in signal strength between a disturbing pair and a disturbed pair, a larger number (less crosstalk) is more desirable than a smaller number (more crosstalk). NEXT varies by frequency, and you must measure it at different frequencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not like SNR, which would compare a received signal (on the far end) to noise on the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given your 10 dB number for NEXT, that would mean the signal returning toward the sender on a different pair is 1/10 as strong as the signal sent out. This would be a very bad NEXT number. For example, on Category-5E horizontal cabling, you need a minimum NEXT value of 50.3 dB at 10 MHz per 100 meters, and 35.3 dB at 100 MHz per 100 meters.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-08T21:16:07.583" LastActivityDate="2016-04-08T21:16:07.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29416" PostTypeId="1" AcceptedAnswerId="29422" CreationDate="2016-04-09T10:11:43.890" Score="2" ViewCount="974" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/port_sec.html#wp1055296&quot; rel=&quot;nofollow&quot;&gt;Port security offers three violation mode options&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;• &lt;strong&gt;protect&lt;/strong&gt;—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value.&lt;br&gt;&#xA;  • &lt;strong&gt;restrict&lt;/strong&gt;—Drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value and causes the SecurityViolation counter to increment.&lt;br&gt;&#xA;  • &lt;strong&gt;shutdown&lt;/strong&gt;—Puts the interface into the error-disabled state immediately and sends an SNMP trap notification.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Protect&lt;/em&gt; and &lt;em&gt;restrict&lt;/em&gt; behave the same w/r/t forwarding behavior, but &lt;em&gt;restrict&lt;/em&gt; generates log messages and a counter, and &lt;em&gt;protect&lt;/em&gt; does not. I can't see why I wouldn't want that information, in case I need to troubleshoot or verify operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this just a case of an old option hanging around despite a newer and better alternative? Or is there some scenario I'm not thinking of where the log entries and counters would be a problem?&lt;/p&gt;&#xA;" OwnerUserId="23971" LastEditorUserId="8499" LastEditDate="2020-01-12T00:35:12.840" LastActivityDate="2020-01-12T00:35:12.840" Title="Why would you use port security mode “protect?”" Tags="|cisco|switch|cisco-ios|cisco-catalyst|port-security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29417" PostTypeId="1" AcceptedAnswerId="29478" CreationDate="2016-04-09T10:24:39.877" Score="6" ViewCount="23631" Body="&lt;p&gt;While studying about TCP i notice that is very similar to Go-Back-N, but ,i think i'm missing something very important:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;a href=&quot;http://www.ccs-labs.org/teaching/rn/animations/gbn_sr/&quot; rel=&quot;noreferrer&quot;&gt;http://www.ccs-labs.org/teaching/rn/animations/gbn_sr/&lt;/a&gt; we can see that in GBN , the server gives ack to every packet that coming. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &lt;a href=&quot;https://www.scribd.com/doc/2631780/56/Is-TCP-Go-Back-N-or-Selective-Repeat&quot; rel=&quot;noreferrer&quot;&gt;https://www.scribd.com/doc/2631780/56/Is-TCP-Go-Back-N-or-Selective-Repeat&lt;/a&gt; p.&lt;strong&gt;65&lt;/strong&gt;,  it says: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is TCP Go-Back-N or Selective Repeat?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt; similarity of TCP with Go-Back-N&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;1.TCP :cumulative ack for the last correctively received, in-order seg&lt;br&gt;&#xA;  2.cumulative and correctly received but out-of-order segs are not individually acked ⇒ TCP sender need only maintain&#xA;  &lt;em&gt;SendBase&lt;/em&gt; and  &lt;em&gt;NextSeqNum&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What is the meaning of cumulative ACK? and what is the difference between selective ACK? and why TCP uses the first one?&lt;/p&gt;&#xA;" OwnerUserId="24542" LastEditorUserId="24542" LastEditDate="2016-04-09T10:41:11.520" LastActivityDate="2020-06-13T19:37:30.503" Title="TCP and Go-Back-N" Tags="|tcp|packet-loss|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29419" PostTypeId="2" ParentId="29250" CreationDate="2016-04-09T11:08:37.170" Score="1" Body="&lt;p&gt;You still need to configure the VLAN 3 SVI on the L3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also need to set trunk mode and encapsulation on Fa0/24 of all three L2 switches.&lt;/p&gt;&#xA;" OwnerUserId="23971" LastActivityDate="2016-04-09T11:08:37.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29420" PostTypeId="1" AcceptedAnswerId="29424" CreationDate="2016-04-09T13:39:34.950" Score="2" ViewCount="361" Body="&lt;p&gt;I am planning to migrate an /22 Subnet into a other datacenter. Currently i have announced every /24er seperatly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My plan is, that i create a /22 subnet with the AS from the new datacenter on ripe. After i have migrated a /24 block i unannounce that /24 announcement and migrate the next ip block. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does i understand it correctly, that when i stop the announcement of the /24 subnet, it will fall back to the less specific announcement and the IPs will be routed into the new datacenter?&lt;/p&gt;&#xA;" OwnerUserId="23010" LastEditorUserId="8499" LastEditDate="2019-01-04T22:12:29.157" LastActivityDate="2019-01-04T22:12:29.157" Title="BGP - less specific route" Tags="|routing|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29421" PostTypeId="1" CreationDate="2016-04-09T14:24:01.650" Score="1" ViewCount="682" Body="&lt;p&gt;I have a pair of Cisco ASAs running in active/standby failover mode which I manage using the management interface. Lately, I frequently have to travel and the VPN to the university's LAN has different IP subnet from the ASA management interface. So, I cannot access the management interface when using different IP subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is this is due to asymmetric routing issue and the only way to overcome this is by using multiple context mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, I am not clear about the changes of configuration to be made on ASAs. The ASA uses EIGRP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: The pair of ASAs that I am responsible to are not the firewall for entire university campus, just for a single network which contains freenas servers for a few researchers. The VPN gateway is at different firewall and managed by official IT team.&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="5014" LastEditDate="2016-04-09T14:38:22.557" LastActivityDate="2023-12-14T02:04:20.503" Title="Cisco ASA - multiple context configuration for management interface" Tags="|cisco-asa|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29422" PostTypeId="2" ParentId="29416" CreationDate="2016-04-09T14:36:02.347" Score="2" Body="&lt;p&gt;It really depends on your philosophy and resources. You can quickly fill a switch log with violations, making it hard to troubleshoot real problems (switch logs can only be so big). You really need to use a separate logging server with something like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want to log violations. To some people it is enough to just drop the traffic. In some cases, the extra overhead and traffic of logging a lot of violations is too much, or they may not have the logging infrastructure necessary to take advantage of it. The three different modes give you the flexibility to choose.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-09T14:36:02.347" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29424" PostTypeId="2" ParentId="29420" CreationDate="2016-04-09T14:53:00.690" Score="3" Body="&lt;p&gt;You can use aggregate routes, and announce only those, or you can announce the aggregate and individual routes. As long a one of the individual routes in an aggregate are in your routing table, the aggregate route will be announced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Creating an aggregate route will also create a route to &lt;code&gt;Null0&lt;/code&gt;, so that any traffic coming in for that aggregate which doesn't match any of the individual routes, will be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply announcing a less specific route, rather than using an aggregate will not work, unless you have the aggregate route in your routing table, since BGP only announces routes to which it has a path.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-09T23:27:41.887" LastActivityDate="2016-04-09T23:27:41.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29428" PostTypeId="1" CreationDate="2016-04-09T17:24:27.410" Score="2" ViewCount="176" Body="&lt;p&gt;I have a router, R1, that is serving as a default gateway on a network segment. Let's say port eth0 has an ip of 10.0.0.1/24 and is connected to a switch, S1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another port on the router, eth1, is part of a VPLS running over an MPLS network. I would like to connect to other end of the VPLS network to S1, so that the network clients on the other end of the tunnel can use R1 as a default gateway, so the setup looks like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Port eth0 of R1 connected to S1&lt;/li&gt;&#xA;&lt;li&gt;Port eth1 (VPLS port) connected to S1&lt;/li&gt;&#xA;&lt;li&gt;Other clients connected to S1 can use R1 as default gateway and communicate with clients on the other end of the tunnel&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But when I do so, I get large amounts of TCP retransmissions and duplicate ACKs when clients from the other end of the tunnel tries to route through R1, and performance is obivously very low.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing? Is it simply not possible to do something like this, where R1 is both a default gateway, and provides the VPLS interface? Will I need to use another router to terminate the VPLS connections?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I should note that the VPLS tunnel itself is working as expected, as is any client that is connected directly to S1 and using R1 as a gateway. It is only when R1 is connected to S1 both via the normal interface and the VPLS interface that things go awry.&lt;/p&gt;&#xA;" OwnerUserId="16936" LastActivityDate="2016-04-09T17:24:27.410" Title="VPLS interface on router switched to other interface on same router" Tags="|routing|mpls|vpls|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29430" PostTypeId="1" CreationDate="2016-04-09T19:25:39.343" Score="1" ViewCount="1232" Body="&lt;p&gt;I'm not sure if this should go here or on one of the electronics pages, please advise me if this is misplaced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I work at a local hardware store, and I along with the other staff all agree that an internet connection would be extremely useful. Only issue is, my boss doesn't see the usefulness of it, and won't purchase broadband.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a random idea pop up in my head the other day when someone was talking to me about dial-up. That used sound over the phone line in order to create a connection. My first thought was that I could set up some kind of dial-up server at my home to share my internet connection with the shop, but that would cost a fortune in phone bills and both my house and the shop needs it's phone line open.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found a few walkie-talkies in a cupboard in my house, which made me think, as the distance between the shop and my house is within the walkie-talkie's range, would it be possible to convert the data on my network into sound, transmit it across the walkie talkie to the shop over one pair, then visa versa in return?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that the speed would be incredibly slow, but the main thing we would be using it for is email, so speed isn't all that important. But other than speed and the fact that I would have to actually make it, is there anything else in the way of me doing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if this is a possibility, what would be the most efficient way of sending the data. My idea at current involves compressing the data, encrypting it, and transmitting the binary data for that in 2 pitches (high = 1, low = 0), however I understand that that only allows me one channel of communication. 7&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a fairly decent knowledge of both programming and electronics, but networking is a bit beyond me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any answers :)&lt;/p&gt;&#xA;" OwnerUserId="24426" LastActivityDate="2016-10-07T03:56:35.707" Title="Converting network data to sound, and streaming around 500M using RF (walkie-talkie style). How possible is it?" Tags="|wireless|network-access|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29432" PostTypeId="2" ParentId="29430" CreationDate="2016-04-09T20:31:20.310" Score="2" Body="&lt;p&gt;This is absolutely possible, but it will be much slower than you think. Your assumption that you can use a modem to convert data into an anolog sound signal and transmit it over the walkie talkie is correct. See this modem that I designed exactly for that purpose: &lt;a href=&quot;http://unsigned.io/projects/micromodem/&quot; rel=&quot;nofollow&quot;&gt;http://unsigned.io/projects/micromodem/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the speed of such a modem is only 1200 bits per second. And you simply wont get much more than that over a walkie-talkie audio link. For an in-depth explanation of this, have a look at this post I wrote to someone else about the limits of walkie-talkie data rates: &lt;a href=&quot;http://unsigned.io/forum/viewtopic.php?id=48&quot; rel=&quot;nofollow&quot;&gt;http://unsigned.io/forum/viewtopic.php?id=48&lt;/a&gt; (the explanation is the second post in the thread)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to do this over RF, you should use a modern wireless bridge running in the 5GHz band for example. There is many on the market, and I use one particular brand myself extensively in my work to set up wireless connections like the one you are talking about with distances anywhere from a few hundred meters to several kilometers. The speeds you can get on these can easily reach hundreds of megabits, but does require proper installation, alignment and configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in short, while it is possible to do what you want with a pair of walkie talkies, speed would simply be too slow. You can get other gear for the task that is specifically suited to actual internet connections.&lt;/p&gt;&#xA;" OwnerUserId="16936" LastEditorUserId="16936" LastEditDate="2016-04-09T20:57:59.480" LastActivityDate="2016-04-09T20:57:59.480" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="29433" PostTypeId="1" CreationDate="2016-04-09T21:03:37.923" Score="0" ViewCount="839" Body="&lt;p&gt;If an ISP sets up cable modems in bridge mode and lets users change the mac address on their internal router (or completely change routers), which then assigns a new IP address, how can the ISP track who has what IP address at any given time?  Are there additional unique identifiers sent from the cable modem that allows the ISP to tie all traffic to the customer regardless of mac address or IP address?&lt;/p&gt;&#xA;" OwnerUserId="24431" LastActivityDate="2016-04-09T21:15:01.303" Title="How does an ISP keep track of who has which IP address?" Tags="|router|mac-address|isp|cable|" AnswerCount="1" CommentCount="1" ClosedDate="2016-04-10T10:26:41.780" ContentLicense="CC BY-SA 3.0" />
  <row Id="29434" PostTypeId="2" ParentId="29433" CreationDate="2016-04-09T21:15:01.303" Score="2" Body="&lt;p&gt;That depends on the ISP. Some ISPs use PPPoA or PPPoE where you log in using a username and password. In those cases it is easy to identify the customer. Some ISPs provide fibre to the home and use identifiers attached to the ethernet ports to identify the customer. I'm currently working on software to manage such identifiers for IPv6. And yes, cable modems are also identifiable by the ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How this identification affects address assignment again depends on the ISP. Some ISPs just assign you fixed/static addresses where your customer identification is linked to your IP addresses and other ISPs just let their DHCP servers assign some addresses to the customers and only use the customer identifier for logging and legal traceability requirements.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-04-09T21:15:01.303" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29435" PostTypeId="2" ParentId="29300" CreationDate="2016-04-09T21:31:37.297" Score="1" Body="&lt;p&gt;Further to Ricky's point, you can run out of spec in situations where you are on a switch because then there are no collisions to contend with. I personally have run 500 feet without issues. Signal attenuation is the limiting factor when there are no collision domains.&lt;/p&gt;&#xA;" OwnerUserId="24432" LastActivityDate="2016-04-09T21:31:37.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29436" PostTypeId="2" ParentId="29381" CreationDate="2016-04-09T22:14:34.623" Score="1" Body="&lt;p&gt;Without much information to examine your setup, it sounds like a bad implementation of 802.1w.&#xA;You'd want root 802.1d/w/s on your distribution switch (perhaps your juniper stack) and not your core or access switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spanning tree will protect your infrastructure from layer2 misconfigs but it has been known to have taken down the core/distribution/access switches due to some unexpected mishaps.&#xA;Any connection from your distribution to your core switch could be a point-to-point layer 3, using a /30 if you like and run some l3 protocol like ospf if you have one or many distribution switches to your cores.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If link-up speed and/or vendor protocol compatibility are issues, you could create L3 ospf point-to-point between your distribution to your access switches (dell 6348) and leave the access as spanning tree root. &#xA;That may require some good planning and some capacity for expansion if you implement more servers later on.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-04-09T22:14:34.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29437" PostTypeId="1" CreationDate="2016-04-09T22:46:51.400" Score="1" ViewCount="15985" Body="&lt;p&gt;I have tried configuring the serial interfaces and it is working for two devices which is my HQ1 and HQ2:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;HQ1 - IP address &lt;code&gt;120.244.121.136&lt;/code&gt; on &lt;code&gt;Serial0/0/0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;HQ2 - IP address &lt;code&gt;120.244.121.139&lt;/code&gt; on &lt;code&gt;Serial0/0/0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The above two do ping, however, when I do the bottom two, they are not pinging, and I am getting an error regarding overlaps with &lt;code&gt;serial0/0/0&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RM1 - IP address &lt;code&gt;120.244.121.140&lt;/code&gt; on &lt;code&gt;Serial0/0/0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;HQ1 - IP address &lt;code&gt;120.244.121.143&lt;/code&gt; on &lt;code&gt;Serial0/1/1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Each has a subnet mask of &lt;code&gt;255.255.255.0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="24435" LastEditorUserId="8499" LastEditDate="2016-04-10T00:32:48.953" LastActivityDate="2016-04-10T00:32:48.953" Title="Overlapping with Serial0/0/0" Tags="|cisco|ping|interface|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29438" PostTypeId="2" ParentId="29437" CreationDate="2016-04-09T23:14:30.803" Score="1" Body="&lt;p&gt;Your problem is that, on the HQ1 router, you are attempting to put the same network on multiple routed interfaces. I think you mean these serial interfaces to be for point-to-point links. You should use a network (&lt;code&gt;/31&lt;/code&gt; or, if you are more traditional, &lt;code&gt;/30&lt;/code&gt;) for your point-to-point links. You would then have two usable addresses for the links, and one of the two addresses goes on one end of the link, and the other address goes on the other end of the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could use any other network size, but you need to use separate networks on the two interfaces in the same router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers route between networks; they don't route from one network to the same network. How will the routing table know to which of the two interfaces in the same network it should forward packets for that network?&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-09T23:14:30.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29442" PostTypeId="1" AcceptedAnswerId="29445" CreationDate="2016-04-10T02:38:19.403" Score="1" ViewCount="3051" Body="&lt;p&gt;I think I mostly understand how subnetting/subnet masks work. However, there is one example that tripped me up while doing some practice questions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a subnet address like 125.95.39.0 and a subnet mask of 255.255.255.128, I understand that the possible IP addresses for this subnet range from 125.95.39.1 to 125.95.39.126. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, what about a subnet address like 125.95.39.129 that has a subnet mask of 255.255.255.192? What does this notation imply? I'm confused about this particular address because the last octet of this address is non-zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm correct, this mask allows for 62 hosts in the network. Is 125.95.39.129 one of the hosts in this network, or are the possible IP address for this subnet &#xA;125.95.39.129  to 125.95.39.190? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="24377" LastEditorUserId="24377" LastEditDate="2016-04-10T03:30:48.950" LastActivityDate="2016-04-10T08:10:57.587" Title="Subnetting: What does it mean if the last octet in a subnet address is non-zero?" Tags="|subnet|" AnswerCount="1" CommentCount="3" ClosedDate="2016-04-10T09:56:15.690" ContentLicense="CC BY-SA 3.0" />
  <row Id="29443" PostTypeId="1" AcceptedAnswerId="29532" CreationDate="2016-04-10T03:38:41.630" Score="3" ViewCount="1417" Body="&lt;p&gt;I have three questions about the relationship between IP addresses, subnet masks, and forwarding tables:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If the address 125.95.39.129 is in a router's forwarding table (and maps to interface &lt;em&gt;x&lt;/em&gt;), does it imply that only packets whose destination is exactly 125.95.39.129 will be forwarded on &lt;em&gt;x&lt;/em&gt;? Or, will we have to use the technique in &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7106/how-do-you-calculate-the-prefix-network-subnet-and-host-numbers&quot;&gt;this post&lt;/a&gt; to find the subnet to which this host belongs, and then any packet whose destination belongs to that subnet will be forwarded on &lt;em&gt;x&lt;/em&gt;?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Let's say that there is another address, 125.95.39.60 in the router's forwarding table, but it is in the forwarding table twice, and both times, it has a different subnet mask (let's call them y and z) associated with it. Accordingly, each entry also maps to a different interface. What does it mean if the same IP address is mapped to two different subnet masks in the forwarding table? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What if the forwarding table also has 125.95.39.0 and is associated with mask &lt;em&gt;m&lt;/em&gt; and interface &lt;em&gt;i&lt;/em&gt;? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My thinking is that, in the case of #1, we do an exact match between an incoming packet's destination address and that forwarding table entry and only forward on interface &lt;em&gt;x&lt;/em&gt; if they're exactly the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that my answer to #1 is correct, for #3, would we forward a packet on &lt;em&gt;i&lt;/em&gt; only if the packet's destination is not 125.95.39.60, which is more specific than 125.95.39.0?&lt;/p&gt;&#xA;" OwnerUserId="24377" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-04-13T19:11:03.200" Title="Subnetting: Subnets, IPs, and Forwarding Tables" Tags="|routing|subnet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29445" PostTypeId="2" ParentId="29442" CreationDate="2016-04-10T08:10:57.587" Score="0" Body="&lt;p&gt;125.95.39.129 is already within the host portion of your subnet. Your correct network address would be 125.95.39.128/26 (255.255.255.192)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may split an ip address range into multiple subnets even within the same octet. In case you are using a /26 subnet mask you divide the ip address range into segments of 2^6 (64) therefore you could divide a conventional /24 (255.255.255.0) range into 4x /26 ranges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.g.&#xA;125.95.39.0/26&#xA;125.95.39.64/26&#xA;125.95.39.128/26&#xA;125.95.39.192/26&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2016-04-10T08:10:57.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29447" PostTypeId="1" AcceptedAnswerId="29985" CreationDate="2016-04-10T10:01:30.387" Score="4" ViewCount="2887" Body="&lt;p&gt;At a remote site where I can't easily set up SPAN and do a regular packet capture, I need to see the VLAN of incoming frames on a trunk interface. Is there a debug command for a Cisco Catalyst 3560X that will show me the layer 2 header or VLAN of every incoming frame on an interface? Or another approach to identifying the VLAN of incoming frames using only what I have onboard a 3560X?&lt;/p&gt;&#xA;" OwnerUserId="2128" LastEditorUserId="509" LastEditDate="2016-04-10T21:59:26.127" LastActivityDate="2016-04-27T07:14:46.677" Title="&quot;debug&quot; to show vlan of incoming frames" Tags="|cisco-ios|cisco-catalyst|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29454" PostTypeId="2" ParentId="24552" CreationDate="2016-04-11T01:37:05.343" Score="4" Body="&lt;p&gt;Sounds like a half close&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What are Half Closed Connections? Or: It's Not a Bug--it's a Feature!&lt;/p&gt;&#xA;&lt;p&gt;Every TCP connection consists of two half-connection which are closed&#xA;independently of each other. So if one end sends a FIN, then the other&#xA;end is free to just ACK that FIN (instead of FIN+ACK-ing it), which&#xA;signals the FIN-sending end that it still has data to send&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://superuser.com/questions/298919/what-is-tcp-half-open-connection-and-tcp-half-closed-connection&quot;&gt;https://superuser.com/questions/298919/what-is-tcp-half-open-connection-and-tcp-half-closed-connection&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="24386" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-04-11T01:37:05.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29456" PostTypeId="1" AcceptedAnswerId="41498" CreationDate="2016-04-11T02:28:52.450" Score="4" ViewCount="18878" Body="&lt;p&gt;I am running new cat 6 cable from my router to my office so I can get my computer hardwired instead of using WiFi. When looking at what I need to get to connect the cable to a wall plate, I'm seeing 2 main options:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 1, which seems to be more common, is to get what I believe is called a Cat 6 wall jack:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://images10.newegg.com/NeweggImage/ProductImage/12-998-148-02.jpg&quot; rel=&quot;nofollow&quot;&gt;http://images10.newegg.com/NeweggImage/ProductImage/12-998-148-02.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 2 is to get a female-to-female wall conntector:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://images10.newegg.com/productimage/A3XT_1_20150906523390131.jpg&quot; rel=&quot;nofollow&quot;&gt;http://images10.newegg.com/productimage/A3XT_1_20150906523390131.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 2 seems like it would be simpler, as I wouldn't need to actually wire the cable itself to the jack; I simply plug it in. Is there an advantage to using a wall jack and doing my own wiring?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I do already have some RJ45 connectors and a crimping tool for them; so if I need to cut the ethernet cable down to a shorter size; that's not an issue.&lt;/p&gt;&#xA;" OwnerUserId="24450" LastEditorUserId="8499" LastEditDate="2018-03-20T23:09:18.010" LastActivityDate="2018-03-20T23:09:18.010" Title="Is there a difference between using a cat 6 wall jack vs using a female-to-female connector?" Tags="|ethernet|layer1|cabling|utp|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29457" PostTypeId="2" ParentId="29456" CreationDate="2016-04-11T04:34:00.970" Score="4" Body="&lt;p&gt;Both will work fine.  They're called keystone jacks and snap into a keystone wall plate with one, two, four...openings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first option requires a punchdown tool to punch your conductors into place and is more typical because we run cable from a spool and cut it to length.  If you're already using a premade cable with male ends then perhaps the F-F option is easier for you.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-04-11T04:34:00.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29458" PostTypeId="2" ParentId="29456" CreationDate="2016-04-11T07:29:09.383" Score="1" Body="&lt;p&gt;The issue with the female-to-female wall connector is that you need to be able to run the cat6 cable with the already attached male connector thru the wall/pipe. This might be an issue in some cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can get away with it, this is probably the better approach since correctly wiring a cat6 jack (to actually pass the test as a cat6 connection with an instrument) can be a bit hard for a novice.&lt;/p&gt;&#xA;" OwnerUserId="24086" LastEditorUserId="24086" LastEditDate="2016-04-18T18:16:16.700" LastActivityDate="2016-04-18T18:16:16.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29459" PostTypeId="1" CreationDate="2016-04-11T09:13:47.033" Score="4" ViewCount="1045" Body="&lt;p&gt;Given that Ethernet cables are everywhere and use for all kinds of links and it is assumed they are physically guarded, hence typical installations do not leverage any &quot;secure&quot; mechanisms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say despite having added &quot;physical security&quot; in the form of &quot;conduits&quot; for the cable, what if someone is able to drill or cut their way in an undetected manner and adds a listening device or MIM on it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If crooks are ingenious enough to create ATM skimming devices that emulate the entire physical/ electronic structure &amp;amp; interface then I am sure someone with enough incentive can find a way to physically tap in. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, typically between long distance sites VPN is leveraged. What could one do in such scenarios? Do we leverage VPN for such links or are there other ways / mechanisms in tech/ protocol stack &amp;amp; standards? &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Communication on a physical Ethernet link, between 2 devices:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Typically operates at Layer 2 - Data Link layer  &lt;/li&gt;&#xA;&lt;li&gt;Medium Access Control (MAC) uses Carrier Sense Multiple Access/ Collision Detect (CSMA/ CD) ; Wireless Networks use CSMA/ CA. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It is possible to do MAC ID spoofing as well as listen to the cross talk on an Ethernet link, so various attacks at that layer are possible as outlined below.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say there is physical exposure (which cannot be physically secured) of Ethernet link passing through a public corridor between 2 offices in a building, what ways can you secure the link? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From experts on SE, What are &lt;strong&gt;recommended&lt;/strong&gt; practices, mechanisms, protocols that can be leveraged/ used to secure communication on physically exposed Ethernet links? &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Mechanisms at Layer 1/2&lt;/li&gt;&#xA;&lt;li&gt;Mechanisms at Layer 3 &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;http://www.sanog.org/resources/sanog7/yusuf-L2-attack-mitigation.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.sanog.org/resources/sanog7/yusuf-L2-attack-mitigation.pdf&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;http://www.slashroot.in/tcp-layer-2-security-threats-and-attacks&quot; rel=&quot;nofollow&quot;&gt;http://www.slashroot.in/tcp-layer-2-security-threats-and-attacks&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://www.sans.org/reading-room/whitepapers/intrusion/detecting-responding-data-link-layer-attacks-33513&quot; rel=&quot;nofollow&quot;&gt;https://www.sans.org/reading-room/whitepapers/intrusion/detecting-responding-data-link-layer-attacks-33513&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-convery-switches.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.blackhat.com/presentations/bh-usa-02/bh-us-02-convery-switches.pdf&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://www.cisco.com/web/ME/exposaudi2009/assets/docs/layer2_attacks_and_mitigation_t.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.cisco.com/web/ME/exposaudi2009/assets/docs/layer2_attacks_and_mitigation_t.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17163" LastEditorUserId="8499" LastEditDate="2019-01-03T01:39:03.830" LastActivityDate="2019-01-03T01:39:03.830" Title="What practices/ mechanisms/ protocols can be used to secure communication on physically exposed Ethernet links?" Tags="|ethernet|security|layer1|layer2|layer3|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="29466" PostTypeId="1" CreationDate="2016-04-11T12:54:43.217" Score="5" ViewCount="480" Body="&lt;p&gt;So, a Juniper SRX 220 in a shared use building. Two networks, 192.168.30.0/24 (The shared use) and 192.168.31.0/24 (the private network). We had once cable modem, and it currently allows only the 31.0 network across a VPN to corporate. Now they put in a Point to Point Fiber, and we need to send all traffic on the 31.0 across the P2P, and all 30.0 across the Cable modem. GE0/0 - Cable GE0/1 - LAN GE0/2 - Fiber P2P&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, the default route is to 0/0, and traffic for corporate across the VPN st.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since they now want all traffic on the 31.0 (including Internet bound traffic) to go across the VPN to the main office for tracking purposes, I will need to change the default route for the 31.0 network, while leaving the 30.0 network default route the 0/1 default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not been able to find anything to help me do this, thoughts on how to proceed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wrongly posted this over on ServerFault, so apologize for the cross post since I couldn't move the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24467" LastActivityDate="2018-03-06T19:32:14.187" Title="Juniper SRX routing based on Network" Tags="|routing|juniper|srx|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29467" PostTypeId="2" ParentId="29459" CreationDate="2016-04-11T13:28:58.767" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1AE&quot; rel=&quot;nofollow&quot;&gt;802.1AE is the IEEE MAC Security standard&lt;/a&gt; (also known as MACsec) which defines connectionless data confidentiality and integrity for media access independent protocols. It is standardized by the IEEE 802.1 working group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IEEE 802.1AE (MACsec) standard specifies a set of protocols to meet the security requirements for protecting data traversing Ethernet LANs. This norm assures incomplete network operations by identifying unauthorized actions on a LAN and preventing communication from them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MACsec allows unauthorised LAN connections to be identified and excluded from communication within the network. In common with IPsec and SSL, MACsec defines a security infrastructure to provide data confidentiality, data integrity and data origin authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By assuring that a frame comes from the station that claimed to send it, MACSec can mitigate attacks on Layer 2 protocols.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-11T13:28:58.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29470" PostTypeId="2" ParentId="26706" CreationDate="2016-04-11T17:05:47.370" Score="1" Body="&lt;p&gt;You need to be sure that you are connected to a trunk port, only with this you will receive tagged frames. On that way, you can connect your PC and with wireshark, sniff the traffic with IP 0.0.0.0, it means ALL traffic. &#xA;I think you can take your traffic and see what you want with this scenario.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-04-11T17:05:47.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29472" PostTypeId="1" AcceptedAnswerId="29473" CreationDate="2016-04-11T18:08:59.777" Score="1" ViewCount="489" Body="&lt;ol&gt;&#xA;&lt;li&gt;How many interfaces can we group as a link aggregation on a Cisco&#xA;switch?&lt;/li&gt;&#xA;&lt;li&gt;How many interfaces, if they all are full duplex?&lt;/li&gt;&#xA;&lt;li&gt;Can we check the value of used bandwidth of ether channel group?&lt;/li&gt;&#xA;&lt;li&gt;How many groups can we make on a Cisco switch?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22993" LastEditorUserId="8499" LastEditDate="2018-03-07T20:59:42.720" LastActivityDate="2018-03-07T20:59:42.720" Title="questions about link aggregation" Tags="|cisco|switch|switching|bandwidth|etherchannel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29473" PostTypeId="2" ParentId="29472" CreationDate="2016-04-11T18:18:48.057" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;Up to eight ports in a channel group.&lt;/li&gt;&#xA;&lt;li&gt;Up to eight ports in a channel group.&lt;/li&gt;&#xA;&lt;li&gt;Yes you can (see below); it's an interface.&lt;/li&gt;&#xA;&lt;li&gt;It depends on the switch model (see below).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For #3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/interface/command/reference/finter_r/irfshoin.html#wp1019959&quot; rel=&quot;nofollow&quot;&gt;Interface Commands (show interfaces - show interfaces vg-anylan)&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following is sample output from the show interfaces port-channel&#xA;  command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# show interfaces port-channel 1&#xA;&#xA;&#xA;Port-channel1 is up, line protocol is up&#xA;  Hardware is FEChannel, address is 0000.0ca8.6220 (bia 0000.0000.0000)&#xA;  MTU 1500 bytes, BW 400000 Kbit, DLY 100 usec, rely 255/255, load 1/255&#xA;  Encapsulation ARPA, loopback not set, keepalive not set, fdx&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;    No. of active members in this channel: 4&#xA;        Member 0 : Fast Ethernet1/0/0&#xA;        Member 1 : Fast Ethernet1/1/0&#xA;        Member 2 : Fast Ethernet4/0/0&#xA;        Member 3 : Fast Ethernet4/1/0&#xA;  Last input 01:22:13, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Queueing strategy: fifo&#xA;  Output queue 0/40, 0 drops; input queue 0/75, 0 drops&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     223 packets input, 11462 bytes, 0 no buffer&#xA;     Received 1 broadcasts, 0 runts, 0 giants&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;     0 watchdog, 0 multicast&#xA;     0 input packets with dribble condition detected&#xA;     192 packets output, 13232 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For #4:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/12025-49.html&quot; rel=&quot;nofollow&quot;&gt;System Requirements to Implement EtherChannel on Catalyst&#xA;  Switches&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 6500/6000 Series Switches That Run CatOS&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;With software release 6.3(1) and later releases, the maximum supported number of EtherChannels is 126 for a 6- or 9-slot chassis &#xA;  and 63 for a 13-slot chassis due to how the spanning-tree feature &#xA;  handles port IDs.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 6500/6000 Series Switches That Run Cisco IOS Software&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;With Release 12.2(18)SXE and later releases, a Catalyst 6500 series switch supports a maximum of 128 EtherChannels. With releases earlier &#xA;  than Release 12.2(18)SXE, a Catalyst 6500 series switch supports a &#xA;  maximum of 64 EtherChannels.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 5500/5000 Series Switches&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[not specified]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 4500/4000 Series Switches That Run CatOS&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[not specified]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 4500/4000 Series Switches That Run Cisco IOS Software&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Catalyst 4500/4000 switches support a maximum of 64 EtherChannels. You can form an EtherChannel with up to eight compatibly configured &#xA;  Ethernet interfaces on any module and across modules in a Catalyst &#xA;  4500/4000 switch.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 3750 Series Switches&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The Catalyst 3750 series switches support a maximum of 12 EtherChannels with configuration on a stack if the switch runs Cisco &#xA;  IOS Software Release 12.1. The Catalyst 3750 series switches can &#xA;  support a maximum of 48 etherchannels on the switch stack if the &#xA;  switch runs Cisco IOS Software Release12.2 or later.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 3560 Series Switches&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[not specified]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 3550 Series Switches&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[not specified]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 2900XL/3500XL Series Switches&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The Catalyst 2900XL/3500XL series switches support a maximum of 12 EtherChannel port groups in the switch.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 2970 Series Switches&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The Catalyst 2970 series switches support a maximum of 12 EtherChannels with configuration on the switch.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 2960 Series Switches&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[not specified]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 2950/2955 Series Switches&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Catalyst 2950/2955 series switches allow up to six port groups. The port groups can all have source as a basis, all have destination as a &#xA;  basis, or be a combination of source and destination bases. All ports &#xA;  in the group must be the same type. For example, the ports must all &#xA;  have source as a basis or all have destination as a basis.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 2940 Series Switches&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The Catalyst 2940 series switches support a maximum of six EtherChannels with eight ports per EtherChannel.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst Express 500 Series Switches&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Catalyst Express 500 support up to 6 Fast EtherChannel or Gigabit EtherChannel groups.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 1900/2820 Series Switches&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Catalyst 1900/2820 series switches support only two port FECs.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 2948G-L3, 4908G-L3, and 4840G Switches&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Catalyst 2948G-L3 switch router supports up to 16 FECs with up to four adjacent Fast Ethernet ports per channel and one GEC.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Catalyst 4908G-L3 switch router supports up to four GECs with up to    four Gigabit Ethernet ports per channel.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Catalyst 8500 Series Switch Routers and Cisco 7000 Series Router&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Catalyst 8510 Campus Switch Router (CSR) supports up to four port    FECs as one Layer 3 forwarding path.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-11T21:54:06.410" LastActivityDate="2016-04-11T21:54:06.410" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29476" PostTypeId="1" CreationDate="2016-04-11T21:56:10.113" Score="1" ViewCount="468" Body="&lt;p&gt;I am trying to optimize the access control list rules on a Cisco SG500X-48 Small Business switch (on Layer 3). The general aim is to regulate the traffic between two VLANs (e.g., 10 and 30) in such a way that VLAN 30 has access to VLAN 10, but only for specific protocols, while VLAN 10 has no access at all to VLAN 30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus far I have configured the switch only for ICMP and HTTP as an initial test, like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Extended IP access list VLAN 10 Test 1&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit  icmp 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 ace-priority 10 type echo-reply code any&#xA;permit  tcp 192.168.30.0 0.0.0.255 any 192.168.10.0 0.0.0.255 www ace-priority 20&#xA;permit  tcp 192.168.10.0 0.0.0.255 www 192.168.30.0 0.0.0.255 any ace-priority 21&#xA;deny    ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 ace-priority 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and applied this as an ingress ACL with an explicit &quot;permit&quot; to VLAN 10. As a result:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 30 can ping VLAN 10&lt;/li&gt;&#xA;&lt;li&gt;VLAN 30 can access VLAN 10 on HTTP (but cannot access any other service in VLAN 10)&lt;/li&gt;&#xA;&lt;li&gt;VLAN 10 has no access to VLAN 30 whatsoever&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So far, so good. However, as I need to configure such ACL entries for multiple protocols on multiple VLANs, I wondered if I couldn´t minimize the required entries by first allowing the requests from VLAN 30 to VLAN 10 from TCP any to any port:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;permit  tcp 192.168.30.0 0.0.0.255 any 192.168.10.0 0.0.0.255 &lt;strong&gt;any&lt;/strong&gt; ace-priority 20&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and then permitting the replies from VLAN 10 only for the ports corresponding to the services that I wish to allow to respond to the requests:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;permit  tcp 192.168.10.0 0.0.0.255 &lt;strong&gt;www&lt;/strong&gt; 192.168.30.0 0.0.0.255 any ace-priority 21&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;permit  tcp 192.168.10.0 0.0.0.255 &lt;strong&gt;telnet&lt;/strong&gt; 192.168.30.0 0.0.0.255 any ace-priority 22&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;permit  tcp 192.168.10.0 0.0.0.255 &lt;strong&gt;ssh&lt;/strong&gt; 192.168.30.0 0.0.0.255 any ace-priority 23&lt;/code&gt;&#xA;…&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, this doesn´t seem to work, as when I configured and applied to VLAN 10 the following ACL on the switch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Extended IP access list VLAN 10 Test 2&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit  icmp 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 ace-priority 10 type echo-reply code any&#xA;permit  tcp 192.168.30.0 0.0.0.255 any 192.168.10.0 0.0.0.255 any ace-priority 20&#xA;permit  tcp 192.168.10.0 0.0.0.255 www 192.168.30.0 0.0.0.255 any ace-priority 21&#xA;deny    ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 ace-priority 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VLAN 30 lost access to VLAN 10 on HTTP. On the contrary, and for a reason as of yet inexplicable to me, VLAN 10 suddenly was able to access VLAN 30 on HTTP, which of course shouldn´t happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched the web for a deeper explanation of how ACL rules work, but was unable to find anything explaining this behaviour. I guess I might be missing something fundamental. Could you please enlighten me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance for your time.&lt;/p&gt;&#xA;" OwnerUserId="23165" LastActivityDate="2016-04-11T21:56:10.113" Title="Optimizing access control lists on a Cisco SG500X-48 Small Business switch" Tags="|cisco|switch|layer3|access-control|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29478" PostTypeId="2" ParentId="29417" CreationDate="2016-04-12T00:06:26.130" Score="17" Body="&lt;p&gt;To add to the previous answer: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &quot;Cumulative ACK&quot; implies that all the bytes sent by the sender (so far) have been received correctly by the receiver. In order words, when the sender receives an ACK with sequence number &lt;code&gt;n&lt;/code&gt;, the receiver is telling the sender that it has received every byte up to and including &lt;code&gt;n-1&lt;/code&gt; and it is expecting byte &lt;code&gt;n&lt;/code&gt; next. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In &quot;selective ACKs&quot;, the receiver sends ACKs for every packet that it has received, regardless of whether it was the packet that the receiver was expecting or not (i.e. whether the packet was out-of-order or not). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;E.g. Let's assume that sender S sends 3 packets: &lt;code&gt;pkt1&lt;/code&gt; (seq # = 100), &lt;code&gt;pkt2&lt;/code&gt; (seq # = 200), and &lt;code&gt;pkt3&lt;/code&gt; (seq # = 300), but &lt;code&gt;pkt2&lt;/code&gt; gets lost in transmission.&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;With GBN:&lt;/strong&gt; When the receiver R gets &lt;code&gt;pkt1&lt;/code&gt;: It sends &lt;code&gt;ACK=200&lt;/code&gt;, telling the sender that it has received all the bytes up to (but not including) 200 and is expecting byte 200 next. Now, &lt;code&gt;pkt2&lt;/code&gt; got lost, but &lt;code&gt;pkt3&lt;/code&gt; was received by the receiver. So, the receiver will send ACK=200 again and drop &lt;code&gt;pkt3&lt;/code&gt; because it is out-of-order. S will then have to re-transmit &lt;code&gt;pkt2&lt;/code&gt; AND &lt;code&gt;pkt3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once &lt;code&gt;pkt2&lt;/code&gt; is retransmitted and successfully received, R will send ACK=300 (i.e. it has received everything up to, but not including, byte 300 and is expecting byte 300, i.e. &lt;code&gt;pkt3&lt;/code&gt;). Once &lt;code&gt;pkt3&lt;/code&gt; is transmitted successfully, it will ACK that too.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;With Selective Repeat (SR):&lt;/strong&gt; Once R receives &lt;code&gt;pkt1&lt;/code&gt;, it will send an ACK for it. Once it receives &lt;code&gt;pkt3&lt;/code&gt;, it will send an ACK specifically for this packet too and will NOT drop the packet even though &lt;code&gt;pkt3&lt;/code&gt; is out-of-order (it will buffer it). Eventually, &lt;code&gt;pkt2&lt;/code&gt; will timeout on the sender's end, so the sender will retransmit &lt;code&gt;pkt2&lt;/code&gt;. If it's successful the receiver will send an ACK for it too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice that, with SR, you didn't have to retransmit &lt;code&gt;pkt3&lt;/code&gt; even though &lt;code&gt;pkt2&lt;/code&gt; was lost. This is beneficial because it prevents the sender from having to retransmit the packets that had already been successfully received by the receiver (it's pointless, right? Why send &lt;code&gt;pkt3&lt;/code&gt; again when it was already delivered?). This helps avoid congestion in the network because you're not constantly retransmitting packets that DON'T need to be retransmitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In general, TCP's congestion control can be described as a combination/hybrid of GBN and Selective Repeat.&lt;/strong&gt; Here's why:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP is similar to GBN because both protocols have a limit on the number of &#xA;unACK'd packets that the sender can send into the network. However, TCP is different from GBN because GBN requires the re-transmission of every unACK'd&#xA;packet when packets are lost, but TCP only retransmits the oldest unACK'd one. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP is similar to selective repeat because, when packets are lost due to congestion, the protocols do not require the sender to retransmit EVERY unACK'd packet sent by the sender. The sender just retransmits the oldest unACK'd packet. TCP is different from selective repeat because SR requires individual acknowledgement of each packet that was sent by the receiver; but rather than selectively ACKing every packet, TCP sends an ACK for the next packet that it is expecting (like GBN) and buffers the ones that it has received so far, even if they're out of order (like SR). That's why it can be considered a hybrid. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.    &lt;/p&gt;&#xA;" OwnerUserId="24377" LastActivityDate="2016-04-12T00:06:26.130" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29482" PostTypeId="1" CreationDate="2016-04-12T07:09:37.153" Score="1" ViewCount="988" Body="&lt;p&gt;I've read up on Nmap's website on host discovery but i'm still confused on what it actually is and does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a syn scan I did on an IP address and then a syn scan without host discovery. The regular syn scan came back clean while the no host discovery mode came back with an open port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;syn&quot; part I understand, but what is this &quot;host discovery&quot; part that my scan is performing?&lt;/p&gt;&#xA;" OwnerUserId="24285" LastEditorUserId="509" LastEditDate="2016-04-12T14:40:40.090" LastActivityDate="2016-05-12T15:13:07.103" Title="What Is Host Discovery ( port scanning)?" Tags="|network-discovery|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29483" PostTypeId="2" ParentId="23476" CreationDate="2016-04-12T08:09:18.503" Score="2" Body="&lt;p&gt;That is official documentation from Cisco, so I don't doubt that. &#xA;As far as L2 header is concerned it is added depending on the L2 technology(Ethernet, Frame Relay etc.)&#xA;The document is not taking L2 header in consideration, but when you will calculate packet size for VoIP Packet, it will be taken into consideration.&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-04-12T08:09:18.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29484" PostTypeId="1" CreationDate="2016-04-12T08:28:20.163" Score="2" ViewCount="2765" Body="&lt;p&gt;Cisco IOS routers display input and output &lt;em&gt;bps&lt;/em&gt; and &lt;em&gt;pps&lt;/em&gt; values for &lt;code&gt;load-interval&lt;/code&gt; time period in &lt;code&gt;sh int&lt;/code&gt; output. For example here is &lt;code&gt;load-interval&lt;/code&gt; set to 30 seconds:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C1921#sh int Gi0/1 | i rate &#xA;  30 second input rate 0 bits/sec, 0 packets/sec&#xA;  30 second output rate 0 bits/sec, 0 packets/sec&#xA;C1921#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I correct that &quot;input rate&quot; is simply an average value of &lt;code&gt;packets input&lt;/code&gt;(for &lt;em&gt;pps&lt;/em&gt;) and &lt;code&gt;bytes&lt;/code&gt;(for &lt;em&gt;bps&lt;/em&gt;) counters for &lt;code&gt;load-interval&lt;/code&gt; period of time? Both &lt;code&gt;packets input&lt;/code&gt; and &lt;code&gt;bytes&lt;/code&gt; counters are seen in &lt;code&gt;sh int&lt;/code&gt; output.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="8499" LastEditDate="2018-12-23T04:51:43.947" LastActivityDate="2018-12-23T04:51:43.947" Title="How exactly is &quot;input rate&quot; calculated in IOS &quot;sh int&quot; output?" Tags="|cisco|cisco-ios|cisco-commands|interface|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29485" PostTypeId="2" ParentId="29057" CreationDate="2016-04-12T08:38:40.117" Score="0" Body="&lt;p&gt;bridged adpter in VMWare works as an adapter directly connected to the network. That means it will get IP Address in the range of your NIC IP. If a virtual adapter is configured for NAT then it will get IP Address from internal DHCP of VMWare and the range will be different than the bridged network. &#xA;You are saying that you have bridged eth0 and eth1. Bridged adapter and NAT adapter can't be bridged(Bridge, Switch are L2 terms). You will have to configure some routing table to connect them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bridged Networking&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bridged networking connects a virtual machine to a network by using the network adapter on the host&#xA;system. If the host system is on a network, bridged networking is often the easiest way to give the virtual&#xA;machine access to that network.&#xA;When you install Workstation on a Windows or Linux host system, a bridged network (VMnet0) is set up&#xA;for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NAT Networking&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With NAT, a virtual machine does not have its own IP address on the external network. Instead, a separate&#xA;private network is set up on the host system. In the default configuration, a virtual machine gets an address&#xA;on this private network from the virtual DHCP server. The virtual machine and the host system share a&#xA;single network identity that is not visible on the external network. When you install Workstation on a Windows or Linux host system, a NAT network (VMnet8) is set up for&#xA;you. When you use the New Virtual Machine wizard to create a new virtual machine and select the typical&#xA;configuration type, the wizard configures the virtual machine to use the default NAT network.&#xA;You can have only one NAT network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Host-Only Networking&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host-only networking creates a network that is completely contained within the host computer. Host-only&#xA;networking provides a network connection between the virtual machine and the host system by using a&#xA;virtual network adapter that is visible on the host operating system.&#xA;When you install Workstation on a Windows or Linux host system, a host-only network (VMnet1) is set up&#xA;for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please check VMWare documentation(chapter 5)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pubs.vmware.com/workstation-11/topic/com.vmware.ICbase/PDF/ws11-using.pdf&quot; rel=&quot;nofollow&quot;&gt;http://pubs.vmware.com/workstation-11/topic/com.vmware.ICbase/PDF/ws11-using.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-04-12T08:38:40.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29486" PostTypeId="2" ParentId="29482" CreationDate="2016-04-12T09:55:16.933" Score="2" Body="&lt;p&gt;Only the hosts that pass on the Host Discovery phase (marked as discovered) will be considered for later port scanning phase. What can be confusing is that during Host Discovery you can use a simpler form of port scanning as a criteria to &quot;discover&quot; the hosts. But this is limited to &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;-PS  (TCP SYN Ping)&lt;/li&gt;&#xA;&lt;li&gt;-PA  (TCP ACK Ping)&lt;/li&gt;&#xA;&lt;li&gt;-PU  (UDP Ping)&lt;/li&gt;&#xA;&lt;li&gt;-PY  (SCTP INIT Ping)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you specify -Pn, host discovery phase is bypassed and port scanning will be done for every target IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probably what is happening is when you perform a regular scan, nmap is not marking the IP address as discovered because it fails the host discovery tests, so is not considered for later port scan phase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read more about it here&lt;br&gt;&#xA;&lt;a href=&quot;https://nmap.org/book/nmap-phases.html&quot; rel=&quot;nofollow&quot;&gt;https://nmap.org/book/nmap-phases.html&lt;/a&gt;&lt;br&gt;&#xA;&lt;a href=&quot;https://nmap.org/book/man-host-discovery.html&quot; rel=&quot;nofollow&quot;&gt;https://nmap.org/book/man-host-discovery.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15900" LastEditorUserId="15900" LastEditDate="2016-04-12T10:05:06.580" LastActivityDate="2016-04-12T10:05:06.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29487" PostTypeId="1" CreationDate="2016-04-12T10:08:10.620" Score="1" ViewCount="1012" Body="&lt;p&gt;What is the recommended storm-control threshold value of broadcast and multicast on Cisco IOS catalyst switches for ports connected to users?&lt;/p&gt;&#xA;" OwnerUserId="5014" LastEditorUserId="8499" LastEditDate="2018-03-19T20:57:52.300" LastActivityDate="2018-03-19T20:57:52.300" Title="Recommended Cisco storm-control broadcast and multicast threshold value for user PC" Tags="|switch|cisco-catalyst|multicast|broadcast|storm-control|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29488" PostTypeId="2" ParentId="29487" CreationDate="2016-04-12T12:54:13.677" Score="1" Body="&lt;p&gt;You might find &lt;a href=&quot;http://www.netcraftsmen.com/resource/protecting-a-cisco-catalyst-6500-switch-against-layer-2-loops/&quot; rel=&quot;nofollow&quot;&gt;this article&lt;/a&gt; helpful:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This article presents the steps I took to develop a solution to&#xA;  protect the Catalyst 6500 in the presence of a Layer 2 loop. These&#xA;  steps include the following:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;How to simulate of a Layer 2 loop&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;How to monitor the control plane traffic&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Control plane policing&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Storm control&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Hardware rate limiting&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Design recommendations&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-12T12:54:13.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29490" PostTypeId="2" ParentId="29459" CreationDate="2016-04-12T14:33:08.707" Score="2" Body="&lt;p&gt;This question is almost too broad to be on-topic here.&lt;/p&gt;&#xA;&lt;p&gt;Layer-1 is the physical layer, your first defense. Using conduit or ducting is a layer-1 defense, as well as a policy which requires any switch ports that are not currently used to be disabled, ensuring that unused network cables are not cross-connected in the data closet, and limiting access to data closets and other area where the physical network is exposed.&lt;/p&gt;&#xA;&lt;p&gt;If you want a standard for layer-2 authentication, it's 802.1X, although it is becoming easier by the day to bypass it (see &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwjenKTVn4nMAhUEhYMKHZLSD_kQFggdMAA&amp;amp;url=https%3A%2F%2Fwww.defcon.org%2Fimages%2Fdefcon-19%2Fdc-19-presentations%2FDuckwall%2FDEFCON-19-Duckwall-Bridge-Too-Far.pdf&amp;amp;usg=AFQjCNE_tmb9mgL_L3eLH8CdIrg9Klye9A&amp;amp;sig2=-_QsmwnsIxyeU3Njkr2AEg&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bridge Too Far&lt;/a&gt;), and 802.1AE, which extends 802.1X with MKA (MACsec Key Agreement) for authentication and encryption. There are entire books (e.g. from Cisco Press: &lt;a href=&quot;http://www.ciscopress.com/store/lan-switch-security-what-hackers-know-about-your-switches-9781587052569&quot; rel=&quot;nofollow noreferrer&quot;&gt;LAN Switch Security: What Hackers Know About Your Switches&lt;/a&gt;, by Eric Vyncke, Christopher Paggen) about LAN security. Port security on switches can be set up to only allow a single (or limited number of) MAC address at any given time, or in any given time period, to prevent connection of hubs, switches, APs, etc., including a port disable (requiring manual intervention or for a given time period) if violations are detected (care needs to be taken for things like VoIP phones where PCs are connected to the phone since the phone itself will have one or more MAC addresses). Disable most layer-2 protocols (e.g. CDP/LLDP, DTP, PAgP/LACP, VTP, etc.) since they are vulnerable to attack. Specifically limit VLANs on trunks (manually prune VLANs). Use DHCP Snooping in conjunction with Dynamic ARP Inspection and IP Source Guard. And much, much more.&lt;/p&gt;&#xA;&lt;p&gt;For a layer-3, standards-based solution, which can be used alone or combined with others, IPsec was developed for IPv6, but later retrofitted to include both IPv4 and IPv6 in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1825&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1825, Security Architecture for the Internet Protocol&lt;/a&gt; and its replacements, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2401&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2401&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4301&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4301&lt;/a&gt;, and various extension and modification RFCs.&lt;/p&gt;&#xA;&lt;p&gt;Beyond layer-3, you get into a bunch of application-layer authentication methods (e.g. SSL), but you only asked about security up to layer-3, and applications and application-layer protocols are off-topic here.&lt;/p&gt;&#xA;&lt;p&gt;Security should use a layered approach, and you need to balance the cost (not only direct cost, but other factors, e.g. time, business disruption, etc., too) to the level of risk you are willing to tolerate. Determine if the cost to implement a security method, and compare it to the risk involved. You will never be 100% secure, but you can make it so difficult that only the most determined intruders will get it, so you try to make it not worth their time and efforts. For example, would you go to great time and effort to break into a network to get a simple calculator application, even if it is much better than the Windows calculator? It may be worth it if the calculator has a proprietary calculation that is worth millions of dollars.&lt;/p&gt;&#xA;&lt;p&gt;Auditors will often be satisfied that you have identified and rated a security risk, but you have not remediated it, if you can show that the remediation is more expensive than the risk involved. For example (don't depend on this if you are really building), building in a 100-year flood plain, where there is a 1% chance (each year) that that a flood will destroy your building, you don't need flood insurance, while building in a 10-year flood plain, where there is a 10% chance (each year) that a flood will destroy your building, requires flood insurance. Something like an almost bullet-proof physical security can mitigate the need for advanced layer-2 security (e.g. 802.1x), if the cost for implementing the layer-2 security is high (e.g. 802.1x requires an infrastructure, and it is often disruptive to the business).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-04-12T15:15:35.110" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29492" PostTypeId="1" AcceptedAnswerId="29495" CreationDate="2016-04-12T15:05:41.803" Score="1" ViewCount="751" Body="&lt;p&gt;I am trying to configure VLAN on an HP 2524 switch. If I configure VLANs and plug devices into the switch, I can not access the network with these devices. I set the ports in the default VLAN to &quot;no,&quot; and in the new VLAN to &quot;tagged.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't matter if the IP addressing of the VLAN is set to manual, DHCP/BOOTP, or disabled. There is a correctly working DHCP server in the network.&lt;/p&gt;&#xA;" OwnerUserId="24493" LastEditorUserId="8499" LastEditDate="2016-04-12T16:06:38.057" LastActivityDate="2016-04-12T16:06:38.057" Title="VLAN configuration on an HP 2524 Switch" Tags="|switch|hp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29493" PostTypeId="2" ParentId="23476" CreationDate="2016-04-12T15:47:27.663" Score="1" Body="&lt;p&gt;Layers are independent of each other, and layer-2 headers are very simple and are not usually concerned with anything above layer-2 (PPP is an exception since it has a bridge to layer-3) since the point of layer-2 is to switch frames as quickly as possible. Some switches can use COS on trunk links, and trunks add 802.1Q tags into the existing frame header, including a three-bit COS value, which can be used for prioritizing frames, and this may, or may not, be employed with VoIP (depending on the switches or layer-2 protocol involved), but it really doesn't add another header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your second question depends on several things, not the least of which is that there is no single VoIP protocol, and some VoIP protocols are proprietary. Your link only gives the example for one VoIP encoding method (G.729). It also explains that you could have GRE, or not, and, since VoIP is normally unicast traffic, GRE is probably unnecessary. You don't provide enough information to accurately answer your second question, and, if you are using a proprietary VoIP protocol, it may not be able to be answered with certainty.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-12T15:47:27.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29494" PostTypeId="2" ParentId="29484" CreationDate="2016-04-12T15:54:51.060" Score="2" Body="&lt;p&gt;Those are the average input and output rates, seen by the interface (in the last 30 seconds, for your example). The &lt;code&gt;load-interval &amp;lt;seconds&amp;gt;&lt;/code&gt; command will let you change the time period, but I believe that 30 seconds is the shortest time period accepted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are incorrect about it being bytes. It is bits per second (bps). Bytes per second is Bps (upper-case &lt;code&gt;B&lt;/code&gt;), but bits per second is bps (lower-case &lt;code&gt;b&lt;/code&gt;). That interface is a 1 Gbps (1,000,000,000 bps) interface. If that interface sent the maximum bps for one second during the 30 second interval, and nothing else, you would see &lt;code&gt;33,333,333&lt;/code&gt; as the output rate. Basically, you take the number of bits transferred in a direction (input or output) and divide it by the &lt;code&gt;load-interval&lt;/code&gt; number of seconds to arrive at the &lt;code&gt;bits/sec&lt;/code&gt; rate for that direction. The same thing happens for packets.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-11T19:43:42.350" LastActivityDate="2016-06-11T19:43:42.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29495" PostTypeId="2" ParentId="29492" CreationDate="2016-04-12T16:04:11.357" Score="1" Body="&lt;p&gt;Most end-devices don't understand VLAN tags, because of this, access ports (those where end-devices are connected) don't normally use tags. Tags are used on trunk links to distinguish traffic in one VLAN from traffic in other VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tag on trunk ports, not access ports.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-12T16:04:11.357" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29496" PostTypeId="1" AcceptedAnswerId="29512" CreationDate="2016-04-12T17:00:18.897" Score="1" ViewCount="1698" Body="&lt;p&gt;I'm new to networking, but I did some research, and I could not determine the source of the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to prioritize gaming traffic by port, destination, or anything else I decide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured the pfSense box to prioritize gaming traffic by destination, using rules on the LAN interface to put the gaming traffic in a qGame queue on tier 5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, I tried to play, and everything was OK. I then opened some YouTube videos, and the games were not lagging, but when I opened another 25 computers on the network, the game started lagging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Game traffic was going to the qGame queue, and I observed it was small traffic, as I expected, and any other traffic was going to the qLink and qDefault traffic queues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I performed another experiment. I put a PC with torrent download on the network, and I put its IP address in a LAN rule to send its traffic to the qp2p queue. The torrent PC traffic was indeed going to the qp2p traffic queue that has a priority of 1, and the qDefault queue with a priority of 3. With that unspecified traffic, I started a YouTube video, and I pinged a DNS server to see the latency. The ping was a normal 200-400 ms with YouTube videos and low torrent traffic. After a minute, the ping got high, and the video was stopping, and I started to lose ping traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Torrent traffic that was going to the qp2p queue with a priority of 1 was taking more bandwidth than the qDefault that has a priority of 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I stopped the torrent PC to use the Internet and for other reasons.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pfTop: Up Queue 1-16/16, View: queue&#xA;QUEUE               BW SCH  PR  PKTS BYTES DROP_P DROP_B QLEN BORR SUSP P/S            B/S&#xA;root_em0         1000K cbq   0  9784  953K      0      0    0    0    0         &#xA;qInternet       1000K cbq         0     0      0      0    0    0    0         &#xA;qACK            190K cbq   6     0     0      0      0    0    0    0         &#xA;qDefault       90000 cbq   3  9784  953K      0      0    0 3997    0         &#xA;qP2P           40000 cbq         0     0      0      0    0    0    0         &#xA;qGames          190K cbq   5     0     0      0      0    0    0    0         &#xA;qOthersHigh    90000 cbq   4     0     0      0      0    0    0    0         &#xA;qOthersLow     50000 cbq   2     0     0      0      0    0    0    0         &#xA;root_em1          100M cbq   0 18568   21M      0      0    0    0    0         &#xA;qLink             20M cbq   2 18568   21M      0      0    0  703    0         &#xA;qInternet       4096K cbq         0     0      0      0    0    0    0         &#xA;qACK            778K cbq   6     0     0      0      0    0    0    0         &#xA;qP2P            163K cbq         0     0      0      0    0    0    0         &#xA;qGames          778K cbq   5     0     0      0      0    0    0    0         &#xA;qOthersHigh     368K cbq   4     0     0      0      0    0    0    0         &#xA;qOthersLow      204K cbq   3     0     0      0      0    0    0    0   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is a lower priority queue taking more bandwidth that a high priority queue? Do borrow options override the priority with the CBQ scheduler?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way for the qP2P queue to take only that extra traffic without causing the qDefault queue traffic to lag?  &lt;/p&gt;&#xA;" OwnerUserId="24495" LastEditorUserId="8499" LastEditDate="2016-04-12T18:21:37.480" LastActivityDate="2016-04-13T07:52:52.527" Title="pfSense traffic shaping with CBQ" Tags="|pfsense|" AnswerCount="1" CommentCount="5" ClosedDate="2016-04-13T13:10:20.977" ContentLicense="CC BY-SA 3.0" />
  <row Id="29499" PostTypeId="1" AcceptedAnswerId="29504" CreationDate="2016-04-12T20:15:06.400" Score="0" ViewCount="49" Body="&lt;p&gt;Im new to networking and i've been fiddling with Cisco's Packet Tracer for students&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every device has a CLI you can access via console cable or other means to configure your network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to my dismay I've browsed through available routers and switches to discover only high end expensive devices offer these fine grained configuration facilities&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: Is there just no way to put this knowleadge to use with a lower budget? If so, I can't seem identify CLI enabled devices on the price ranges I can afford&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="24500" LastActivityDate="2016-04-12T21:09:23.563" Title="Affordable CLI enabled devices?" Tags="|cli|packet-tracer|" AnswerCount="1" CommentCount="7" ClosedDate="2016-04-13T13:11:12.117" ContentLicense="CC BY-SA 3.0" />
  <row Id="29504" PostTypeId="2" ParentId="29499" CreationDate="2016-04-12T21:09:23.563" Score="2" Body="&lt;p&gt;There are plenty of systems on the market that have a CLI. Some are even very close to the Cisco IOS CLI you've been learning. However, at the end of the day, ever vendor will have their own flavor of CLI. Yes, many dirt-cheap, &quot;web-managed&quot; products will be lacking a physical console. (a console is, after all, extra hardware that adds to the material and production costs.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to work with Cisco gear, then do so. It doesn't take &quot;millions&quot; to get a decent collection of routers and switches. No, you will not find current generation kit on ebay (or anywhere else) for pennies. But older, end-of-life gear can be found for sub-100$ -- &lt;em&gt;we&lt;/em&gt; know it's possible because &lt;em&gt;we've all&lt;/em&gt; bought the things.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-04-12T21:09:23.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29505" PostTypeId="1" AcceptedAnswerId="29506" CreationDate="2016-04-12T21:15:32.530" Score="1" ViewCount="161" Body="&lt;p&gt;I try to understand how queries from end-users to the DNS server, can posion the cache of the DNS server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example : I try to understand how can attackers that may take control over a computer , can poison the cache of the DNS server that answer that computer's queries?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For my understanding, if the attackers hijacked the DNS server ,they can poison it's cache. If i want to get the ip of lets say www.google.com , how the attackers use my query to poison the dns server cache?&lt;/p&gt;&#xA;" OwnerUserId="24542" LastEditorUserId="24542" LastEditDate="2016-04-12T22:14:48.510" LastActivityDate="2016-04-12T22:28:26.610" Title="Understanding DNS cache poisoning" Tags="|dns|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29506" PostTypeId="2" ParentId="29505" CreationDate="2016-04-12T22:23:12.177" Score="1" Body="&lt;p&gt;If the DNS, which your computer uses to resolve domain names into IP addresses, is compromised, your PC can be redirected to a malicious IP address, and your PC can be compromised that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of resolving to the real &lt;code&gt;www.google.com&lt;/code&gt; IP address, your browser can be directed to the &lt;code&gt;www.evilhackersite.com&lt;/code&gt; IP address, and the web server there can exploit vulnerabilities in your browser. It may pretend to be Google in order to watch you click on something and steal a password, it may plant malware on you machine, then redirect you to the real Google, or it may exploit some other browser/user weakness altogether.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a machine (one to which others may connect, like a server) which registers with DNS, if the machine is compromised, the malware could register a bad IP address with DNS, causing problems for others, or your machine's DNS queries could be intercepted and redirected before they ever leave your machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if your machine is compromised, it could be part of an attack directed at the DNS server to overload it, so that it has no time to validate that its cache entries are correct with more authoritative sources.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-12T22:28:26.610" LastActivityDate="2016-04-12T22:28:26.610" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29507" PostTypeId="1" AcceptedAnswerId="29511" CreationDate="2016-04-12T23:34:29.770" Score="1" ViewCount="2011" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is this explanation of how to determine, mathematically, if a destination IP address is in the same subnet as the sender, correct or not?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is this what the computer does or does it do the math differently?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7106&quot;&gt;How do you calculate the prefix, network, subnet, and host numbers?&lt;/a&gt; is a great entry and covers a lot of ground, but to answer my question, I have to extrapolate and so I am left with the question as to whether or not my extrapolation is correct.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;To determine if a packet is to be handed off to the switch to deal with, or forwarded to the router (gateway), we need to determine if the destination address is within the same network or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do that, we can simply apply the netmask to the destination address so as to&#xA;extract the network prefix. If we get the same value as the prefix for the&#xA;computer, then it is on the same network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this example, let's assume the user is doing a &lt;code&gt;ping&lt;/code&gt; to a computer with &#xA;the IP address of &lt;code&gt;192.168.22.45&lt;/code&gt;. Let's apply the netmask of our computer &#xA;against this IP address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;    11000000.10101000.00010110.00101101  (192.168.22.45 - IP address)&#xA;AND 11111111.11111111.11111111.00000000  (255.255.255.0 - Netmask)&#xA;    -----------------------------------&#xA;  = 11000000.10101000.00010110.00000000  (192.168.22.0 - Prefix)&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, let's compare the prefix gotten to the prefix we got with the IP &#xA;address of our computer earlier: &lt;code&gt;192.168.22.0&lt;/code&gt; is not equal to &lt;code&gt;192.168.1.0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or in binary with Boolean logic, we compare the two prefix using the &#xA;Exclusive-OR operator. If we get all 0s, then the two prefix are equal and &#xA;therefore, are in the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;    11000000.10101000.00010110.00000000  (Destination prefix - 192.168.22.0)&#xA;XOR 11000000.10101000.00000001.00000000  (Local computer prefix - 192.168.1.0)&#xA;    -----------------------------------&#xA;  = 00000000.00000000.00010111.00000000&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1518" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-04-13T18:47:02.890" Title="Is this explanation correct - how to determine if an IP address is on the same subnet" Tags="|subnet|" AnswerCount="1" CommentCount="5" ClosedDate="2019-03-16T18:29:18.880" ContentLicense="CC BY-SA 3.0" />
  <row Id="29508" PostTypeId="1" CreationDate="2016-04-13T02:24:25.343" Score="1" ViewCount="50" Body="&lt;p&gt;first of all, I'm not a network engineer. I have a wired network between 2 houses and we share the same modem/internet connection. The router connected to the modem has wifi, but is only has range for 1 house. On the other house, I have a &lt;a href=&quot;http://www.nexxtsolutions.com/us/nyx150#features&quot; rel=&quot;nofollow noreferrer&quot;&gt;Nyx150 wireless router, model NW230NXT57&lt;/a&gt; that I bought from RadioShack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the wired network I have a NAS and another small server. The wired network runs with ip 192.168.1.x. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other side, the wifi network created by the nyx150 runs on 192.168.0.x. I can connect to the server and NAS by entering their ip, but I can't find them on my computer, nor can I use the iTunes Server capabilities of the NAS if I'm connected to the wifi. It works fine if I connect my mac to LAN, I guess because the computer and NAS will be on the same network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the config I tried to do on the main router:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IP Range: 192.168.1.100 onwards&lt;/li&gt;&#xA;&lt;li&gt;DHCP: enabled&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is the config I tried to do on the Nyx150 Router (connected via LAN to the main router):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;LAN Config: 192.168.1.50 (should work because this IP is &quot;free&quot; on the WAN side)&lt;/li&gt;&#xA;&lt;li&gt;WAN Config: I wanted to give the device the ip 192.168.1.2 (which is also free and outside the main router's DHCP range), but I get the error: &lt;code&gt;ERROR: WAN NET is same as LAN&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0w5Na.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0w5Na.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this is a cheap router, but as I bought it, the sales guy at RadioShack assured me that I could be on the same network running on wifi or LAN, but I have not been able to find out the right config. I even found blogs explaining that this is not possible. Is this true? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="24508" LastActivityDate="2016-04-13T02:29:09.677" Title="Problem with subnet created by Nyx150 wireless router" Tags="|wireless|access-point|" AnswerCount="1" CommentCount="1" ClosedDate="2016-04-13T11:46:24.193" ContentLicense="CC BY-SA 3.0" />
  <row Id="29509" PostTypeId="2" ParentId="29508" CreationDate="2016-04-13T02:29:09.677" Score="0" Body="&lt;p&gt;You likely have two problems. First, you possibly have multiple DHCP servers in one network. I'm unclear on how your two routers are linked. The WAN of one connected to the LAN of the other (internet connected) one would be ok.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, and here's the meat: you are trying to use protocols designed to not span subnets &lt;em&gt;across subnets&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-04-13T02:29:09.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29510" PostTypeId="2" ParentId="20625" CreationDate="2016-04-13T04:21:29.020" Score="1" Body="&lt;p&gt;The &lt;code&gt;tc&lt;/code&gt; system only shapes outgoing packets on an interface (unless you are using ingress filtering, which you are not). As such, unless the computer on which you are running these commands is the server, no shaping will take place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, as @Teun Vink said, port 21 is only for FTP control. To add to what he said about port 20, if you are using FTP in its passive mode (most likely), it is unlikely that you will be able to shape it based solely on &lt;code&gt;tc&lt;/code&gt; filters as it will be using random high ports. In this case, you will likely need to use a combination of &lt;code&gt;iptables&lt;/code&gt; to match the stream and set fwmarks, and &lt;code&gt;tc&lt;/code&gt; rules to match.&lt;/p&gt;&#xA;" OwnerUserId="19385" LastActivityDate="2016-04-13T04:21:29.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29511" PostTypeId="2" ParentId="29507" CreationDate="2016-04-13T06:59:13.840" Score="1" Body="&lt;p&gt;Yes, there is a mathematical way (and that is how the computer does it unless I'm much mistaken).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your computer is X netmask M&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other computer is Y.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The computers are on the same network if (X &amp;amp; M) = (Y &amp;amp; M) where &amp;amp; is bitwise AND.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better answer than mine would go into the source code of the network stack :)&lt;/p&gt;&#xA;" OwnerUserId="22874" LastEditorUserId="22874" LastEditDate="2016-04-13T18:47:02.890" LastActivityDate="2016-04-13T18:47:02.890" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29512" PostTypeId="2" ParentId="29496" CreationDate="2016-04-13T07:52:52.527" Score="0" Body="&lt;p&gt;router can control traffic that is going to the internet only and can't control income traffic &lt;/p&gt;&#xA;&#xA;&lt;p&gt;router can control income traffic only if its tcp packets. tcp traffic have  congestion control .so the receiver can control how much traffic he want from the sender &lt;/p&gt;&#xA;&#xA;&lt;p&gt;there is udp packets that can't be controlled by local router it need a isp router so isp router can take all the income traffic from the internet and decide which packets need to be deliver and which should be delayed or dropped &lt;/p&gt;&#xA;" OwnerUserId="24495" LastActivityDate="2016-04-13T07:52:52.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29513" PostTypeId="1" CreationDate="2016-04-13T08:13:44.883" Score="0" ViewCount="312" Body="&lt;p&gt;Is it possible to read out the time a switch port has been in down state on Cisco switches e.g. 2960x.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Br&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Frank&lt;/p&gt;&#xA;" OwnerUserId="24515" LastEditorUserId="8499" LastEditDate="2018-03-16T21:26:27.863" LastActivityDate="2018-03-16T21:26:27.863" Title="Read out down time of switch port" Tags="|cisco|switch|cisco-catalyst|monitoring|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29514" PostTypeId="2" ParentId="29513" CreationDate="2016-04-13T08:41:20.163" Score="3" Body="&lt;p&gt;You can query the switch via SNMP to read the ifLastChange field from the standard MIB-2, which gives you the value of the sysUpTime counter when the interface last changed state. You have to read the current sysUpTime value as well to make sense of it, of course, and I recall there are some caveats if that last change is too far in the past because the field is a 32 bit counter counting hundreth-of-a-second ticks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't believe you can do the same directly from CLI, but you can implement object tracking on the interface state to get the same result.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-04-13T08:41:20.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29516" PostTypeId="1" CreationDate="2016-04-13T10:41:56.783" Score="-1" ViewCount="1096" Body="&lt;p&gt;I started to use Motorola RFS4000 with wing 5.7 on board. After few weeks I had to reset test configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After hard reset using reset button I don't have access to this device any more. None of standard login/passwords work. &#xA;I'm connected by console cable, and I tried: admin/admin, admin/motorola , admin/Symbol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have a similar problem?&lt;/p&gt;&#xA;" OwnerUserId="19128" LastEditorUserId="22463" LastEditDate="2020-04-05T08:24:23.783" LastActivityDate="2020-04-05T08:24:23.783" Title="Motorola RFS4000 - After Reset I Can't Log In" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="29522" PostTypeId="2" ParentId="29516" CreationDate="2016-04-13T14:36:15.813" Score="2" Body="&lt;p&gt;The default username and password after a reset are &lt;strong&gt;reset&lt;/strong&gt; and &lt;strong&gt;FactoryDefault&lt;/strong&gt; respectively.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-04-13T14:36:15.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29524" PostTypeId="1" CreationDate="2016-04-13T14:53:50.007" Score="4" ViewCount="9057" Body="&lt;p&gt;If a server accepts TCP connections, does it ALWAYS respond to a SYN message by sending a SYN/ACK message or does it ever have a blacklist of IP addresses that it does not respond to? That is, does the TCP protocol state that all open and listening ports must respond to a SYN message?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any clarification would be much appreciated&lt;/p&gt;&#xA;" OwnerUserId="24157" LastActivityDate="2018-07-08T06:03:22.107" Title="Is a SYN message ALWAYS responded to with a SYN/ACK message?" Tags="|tcp|transport-protocol|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29525" PostTypeId="1" CreationDate="2016-04-13T15:10:35.633" Score="1" ViewCount="561" Body="&lt;p&gt;I'm trying to configure our router so that if BGP goes down our interface, FastEthernet0/0/0.3861 59.X.X.X would change from administrative down (SHUT) to UP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this can be achieved with Cisco Enhanced Object Tracking. Alternatively, if I could configure the Tunnel interface (1) to be in standby mode while BGP is up and when bgp fails, to change from standby to up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry if this is confusing, but anyone with Cisco skills will probably understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;our_production_router2#show run &#xA;&#xA;Building configuration...&#xA;&#xA;Current configuration : 17642 bytes &#xA;! &#xA;! &#xA;Last configuration change at 14:54:15 UTC Wed Apr 13 2016 by johnsonmatthey\pattec0 &#xA;! &#xA;version 15.4 &#xA;service timestamps debug datetime msec &#xA;service timestamps log datetime msec &#xA;service password-encryption &#xA;! &#xA;hostname jmeu-gurgaon02 &#xA;! &#xA;boot-start-marker &#xA;boot-end-marker &#xA;! &#xA;! &#xA;logging buffered 51200 warnings &#xA;enable password 7 ****************** &#xA;! &#xA;aaa new-model &#xA;! &#xA;! &#xA;ip dhcp excluded-address 10.10.10.1 &#xA;! &#xA;ip dhcp pool ccp-pool &#xA; import all &#xA; network 10.10.10.0 255.255.255.128 &#xA; default-router 10.10.10.1 &#xA;  lease 0 2&#xA;!&#xA;! &#xA;! &#xA;no ip bootp server &#xA;no ip domain lookup &#xA;ip domain name routers.matthey.com &#xA;ip name-server 192.168.1.233 &#xA;ip name-server 192.168.1.253 &#xA;ip cef &#xA;no ipv6 cef &#xA;! &#xA;multilink bundle-name authenticated &#xA;! &#xA;cts logging verbose &#xA;! &#xA;! &#xA;! &#xA;interface Loopback0 &#xA; ip address 10.41.252.72 255.255.255.255 &#xA; no ip redirects &#xA; no ip unreachables &#xA; no ip proxy-arp &#xA; ip flow ingress &#xA;! &#xA;interface Loopback1 &#xA; description BT Peering Loopback &#xA; ip address 10.1.243.106 255.255.255.255 &#xA;! &#xA;interface Tunnel1 &#xA; description Tunnel to jmeu-london-colo01 &#xA; bandwidth 20000 &#xA; ip address 10.9.249.34 255.255.255.252 &#xA; no ip redirects &#xA; no ip unreachables &#xA; no ip proxy-arp &#xA; ip mtu 1420 &#xA; ip hello-interval eigrp 65100 10 &#xA; ip hold-time eigrp 65100 180 &#xA; ip flow ingress &#xA; ip flow egress &#xA; ip tcp adjust-mss 1140 &#xA; keepalive 4 6 &#xA; tunnel source x.x.x.x &#xA; tunnel destination x.x.x.x &#xA; tunnel path-mtu-discovery &#xA; crypto map JMEU-VPN &#xA;! &#xA;interface Tunnel3 &#xA; description Tunnel to jmeu-taloja01 &#xA; bandwidth 256 &#xA; ip address 10.41.248.18 255.255.255.252 &#xA; no ip redirects &#xA; no ip unreachables &#xA; no ip proxy-arp &#xA; ip flow ingress &#xA; ip tcp adjust-mss 1340 &#xA; keepalive 4 6 &#xA; tunnel source x.x.x. &#xA; tunnel destination x.x.x.x &#xA; crypto map JMEU-VPN &#xA;! &#xA;interface Tunnel4 &#xA; description p2p tunnel to Manesar &#xA; bandwidth 256 &#xA; backup interface Tunnel3 &#xA; ip address 10.41.249.170 255.255.255.252 &#xA; no ip redirects &#xA; no ip unreachables &#xA; no ip proxy-arp &#xA; ip flow ingress &#xA; ip tcp adjust-mss 1340 &#xA; keepalive 4 6 &#xA; tunnel source x.x.x. &#xA; tunnel destination x.x.x.x &#xA; crypto map JMEU-VPN &#xA;! &#xA;interface Embedded-Service-Engine0/0 &#xA; no ip address &#xA; shutdown &#xA;! &#xA;interface GigabitEthernet0/0 &#xA; description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$ &#xA; ip address 192.168.230.129 255.255.255.192 &#xA; ip mtu 1420 &#xA; ip tcp adjust-mss 1140 &#xA; duplex auto &#xA; speed auto &#xA;! &#xA;interface GigabitEthernet0/1 &#xA; bandwidth 10000 &#xA; no ip address &#xA; no ip redirects &#xA; no ip unreachables &#xA; no ip proxy-arp &#xA; ip mtu 1420 &#xA; ip flow ingress &#xA; ip tcp adjust-mss 1140 &#xA; duplex auto &#xA; speed 10 &#xA; no cdp enable &#xA; no mop enabled &#xA;! &#xA;interface GigabitEthernet0/1.2997 &#xA; description CID:  &#xA; bandwidth 10000 &#xA; encapsulation dot1Q 2997 &#xA; ip address 10.1.243.166 255.255.255.252 &#xA; no cdp enable &#xA;! &#xA;interface FastEthernet0/0/0 &#xA; no ip address &#xA; ip access-group Permitted-Inbound-Internet in &#xA; duplex auto &#xA; speed auto &#xA;! &#xA;interface FastEthernet0/0/0.3861 &#xA; encapsulation dot1Q 3861 &#xA; ip address x.x.x.x 255.255.255.252 &#xA; ip access-group Permitted-Inbound-Internet in &#xA; no ip redirects &#xA; no ip unreachables &#xA; no ip proxy-arp &#xA; ip mtu 1420 &#xA; ip tcp adjust-mss 1400 &#xA; no cdp enable &#xA; crypto map JMEU-VPN &#xA;! &#xA;interface FastEthernet0/0/1 &#xA; no ip address &#xA; duplex auto &#xA; speed auto &#xA;! &#xA;! &#xA;router eigrp 65100 &#xA; network 10.0.0.0 &#xA; network 192.168.230.0 &#xA; redistribute static metric 1500 1000 255 1 1500 route-map allow-static-routes &#xA; redistribute bgp 65304 metric 1500 1000 255 1 1500 &#xA;! &#xA;router bgp 65304 &#xA; bgp log-neighbor-changes &#xA; neighbor 10.1.243.165 remote-as 12641 &#xA; ! &#xA; address-family ipv4 &#xA;  network 10.41.252.2 mask 255.255.255.255 &#xA;  network 10.41.252.72 mask 255.255.255.255 &#xA;  network 192.168.230.128 mask 255.255.255.192 &#xA;  neighbor 10.1.243.165 activate &#xA;  neighbor 10.1.243.165 soft-reconfiguration inbound &#xA; exit-address-family &#xA;! &#xA;ip forward-protocol nd &#xA;! &#xA;ip http server &#xA;ip http access-class 23 &#xA;ip http authentication local &#xA;no ip http secure-server &#xA;ip http timeout-policy idle 600 life 86400 requests 10000 &#xA;ip flow-export source Loopback0 &#xA;ip flow-export version 5 &#xA;! &#xA;ip tacacs source-interface Loopback0 &#xA;! &#xA;logging trap notifications &#xA;logging source-interface Loopback0 &#xA;logging host 192.168.1.222 &#xA;logging host 10.16.1.252 &#xA;logging host 192.168.151.154 &#xA;! &#xA;route-map allow-static-routes permit 10 &#xA; match ip address 10 &#xA;! &#xA;route-map static-to-bgp permit 10 &#xA; match tag 111 &#xA;! &#xA;! &#xA;key 7 095B411B1501071D07051023282524 &#xA;access-list 1 permit 192.168.230.0 0.0.0.255 &#xA;access-list 10 remark redistribute-statics-first-line-dummy &#xA;access-list 10 permit 10.10.10.0 0.0.0.255 &#xA;access-list 23 permit 10.10.10.0 0.0.0.127 &#xA;access-list 23 permit 10.10.10.0 0.0.0.7 &#xA;! &#xA;! &#xA;! &#xA;control-plane &#xA;! &#xA;!&#xA;&#xA;!&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21461" LastEditorUserId="8499" LastEditDate="2016-04-13T17:28:48.680" LastActivityDate="2017-02-07T21:43:31.000" Title="Cisco Enhanced Object Tracking" Tags="|cisco|routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29526" PostTypeId="2" ParentId="29524" CreationDate="2016-04-13T15:12:25.440" Score="1" Body="&lt;p&gt;TCP is at layer-4, but IP is at layer-3. TCP doesn't have any sort of a blacklist, nor does it particularly care about IP addresses. Don't confuse the TCP in a host with how a firewall protects the host. You should read &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 793, TRANSMISSION CONTROL PROTOCOL&lt;/a&gt;, which defines TCP, to learn how TCP works. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793#section-3.4&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section 3.4, Establishing a connection&lt;/a&gt;, goes into detail about what happens, including anomalies.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-04-13T15:12:25.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29527" PostTypeId="2" ParentId="29524" CreationDate="2016-04-13T15:13:19.073" Score="1" Body="&lt;p&gt;In so far as TCP, yes, a &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/24068/why-do-we-need-a-3-way-handshake-why-not-just-2-way/24072#24072&quot;&gt;SYN&lt;/a&gt; will always be followed with a &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/24068/why-do-we-need-a-3-way-handshake-why-not-just-2-way/24072#24072&quot;&gt;SYN/ACK&lt;/a&gt; response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a Server or Firewall (or software Firewall) is employed, and a particularly blacklisted IP is sending the SYN, then in that case, it is like if TCP (for that IP address) is turned off. So the SYN will &quot;fall on deaf ears&quot;, per say, and no response will be generated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But note that this is an outside entity acting on TCP's behalf. TCP by itself does not exist for security, its job is to simply create a reliable data stream. If Something &lt;em&gt;else&lt;/em&gt; wants to decide who the reliable data stream should be formed with, then that is outside the scope of TCP.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-04-13T15:13:19.073" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29528" PostTypeId="2" ParentId="29525" CreationDate="2016-04-13T15:47:58.350" Score="1" Body="&lt;p&gt;If you want to change the state of an interface based on an event, you should look at the Cisco Embedded Event Manager scripting: &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-embedded-event-manager-eem/config_guide_eem_configuration_for_cisco_integrated_services_router_platforms.html&quot; rel=&quot;nofollow&quot;&gt;EEM Configuration for Cisco Integrated Services Router Platforms&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on an event, the script can perform something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER(config-applet)# action 1.2 cli command &quot;interface g0/1&quot;&#xA;ROUTER(config-applet)# action 1.3 cli command &quot;no shut&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Example 1: Command Execution with Logged Event&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This example illustrates the use of EEM to execute show commands when&#xA;  a particular&#xA;  event occurs and collect the output and save it in some location that&#xA;  you can use for troubleshooting later. Figure 2 shows the topology.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Challenge &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This example shows how to collect CPU usage and interface&#xA;  output when the Open Shortest Path First (OSPF) neighbor is down in&#xA;  router B.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Solution &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;EEM is configured to check for an OSPF-neighbor-down syslog&#xA;  message; if it occurs, it executes the following command and saves the&#xA;  output in flash memory:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;show cpu process&lt;/li&gt;&#xA;  &lt;li&gt;show interfaces&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;The configuration follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterB#sh run&#xA;Building configuration...&#xA;Current configuration : 1137 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname RouterB&#xA;ip cef&#xA;!&#xA;interface Loopback0&#xA;ip address 2.2.2.2 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/0&#xA;ip address 192.168.1.1 255.255.255.0&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA;no ip address&#xA;shutdown&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;router ospf 1&#xA;log-adjacency-changes&#xA;network 192.168.1.0 0.0.0.255 area 0&#xA;line con 0&#xA;exec-timeout 0 0&#xA;line aux 0&#xA;line vty 0 4&#xA;login&#xA;!&#xA;scheduler allocate 20000 1000&#xA;!&#xA;webvpn cef&#xA;!&#xA;event manager applet OSPF&#xA;event syslog pattern &quot;Neighbor Down: Dead timer expired&quot;&#xA;action 1.0 cli command &quot;enable&quot;&#xA;action 1.1 cli command &quot;sh proc cpu | append flash:cpu_info&quot;&#xA;action 1.2 cli command &quot;show interface | append flash:interface_info&quot;&#xA;action 1.6 syslog msg &quot;OSPF NEIGHBOR DOWN&quot;&#xA;!&#xA;end&#xA;RouterB#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-13T15:47:58.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29529" PostTypeId="1" CreationDate="2016-04-13T17:06:30.610" Score="4" ViewCount="2448" Body="&lt;p&gt;Assume i have no cef enabled and there are 2 paths with the same cost ( both traffic share count = 1)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show ip route 20.20.20.1&#xA;Routing entry for 20.20.20.0/24&#xA;  Known via &quot;eigrp 10&quot;, distance 90, metric 156160, type internal&#xA;  Redistributing via eigrp 10&#xA;  Last update from 192.168.10.2 on FastEthernet0/0, 00:57:33 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 192.168.20.2, from 192.168.20.2, 00:57:33 ago, via FastEthernet0/1&#xA;      Route metric is 156160, traffic share count is 1&#xA;      Total delay is 5100 microseconds, minimum bandwidth is 100000 Kbit&#xA;      Reliability 255/255, minimum MTU 1500 bytes&#xA;      Loading 1/255, Hops 1&#xA;    192.168.10.2, from 192.168.10.2, 00:57:33 ago, via FastEthernet0/0&#xA;      Route metric is 156160, traffic share count is 1&#xA;      Total delay is 5100 microseconds, minimum bandwidth is 100000 Kbit&#xA;      Reliability 255/255, minimum MTU 1500 bytes&#xA;      Loading 1/255, Hops 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;q1) if i have ip route-cache set on both my interfaces, does that means that &#xA;packets to the same destination will always exit the same interface even if the 2 paths have the same traffic share count ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;q2) if i have two unequal cost paths, with difference traffic share count (e.g. 60,40) and ip route-cache on both interfaces. &#xA;Does that means that if the &quot;40 share&quot; path is ever taken to reach a particular destination (e.g. 20.20.20.2),  subsequent attempts to reach 20.20.20.2, will always take the &quot;40 share&quot;  path ?&lt;/p&gt;&#xA;" OwnerUserId="16635" LastActivityDate="2018-01-20T03:54:16.510" Title="eigrp load balacing - per packet or per destination" Tags="|cisco|routing|router|eigrp|load-balancing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29530" PostTypeId="1" CreationDate="2016-04-13T17:36:26.490" Score="2" ViewCount="470" Body="&lt;p&gt;First, a disclosure:  This is my first Cisco device ever.  Only ever used dumb hubs/switches and computers before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We need to use an ASA 5505 to route UDP traffic from one (otherwise air-gapped) private network (192.168.3.x, &lt;em&gt;inside&lt;/em&gt;) to another (otherwise air-gapped) network (10.10.10.x, &lt;em&gt;outside&lt;/em&gt;).  Each network currently has &amp;lt; 5 machines connected by a simple unmanaged switch.  The 5505 will have its one &lt;em&gt;outside&lt;/em&gt; port connected to the &lt;em&gt;outside&lt;/em&gt; switch and its one &lt;em&gt;inside&lt;/em&gt; port connected to the &lt;em&gt;inside&lt;/em&gt; switch.  Traffic is only allowed to flow from &lt;em&gt;inside&lt;/em&gt; to &lt;em&gt;outside&lt;/em&gt; not the reverse, hence UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've managed to get it to work for &lt;strong&gt;ONE&lt;/strong&gt; machine on the &lt;em&gt;outside&lt;/em&gt;, by setting that machine's address as the gateway.  However, it is NOT actually a gateway, it is just a Windows desktop, so this will not work for my actual requirements.  But I cannot figure out how to have the firewall just route all traffic received from the &lt;em&gt;inside&lt;/em&gt; to the &lt;em&gt;outside&lt;/em&gt; network.  It is probably quite simple, but it escapes me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Oh, we've not yet been able to get anything to connect via telnet or SSH to the 5505, but we (barely) managed to get the web/java interface to work from a Windows Embedded Standard 7 desktop (one of the &lt;em&gt;inside&lt;/em&gt; machines).  Apologies in advance if this is an inappropriate question here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My running-config.cfg values (from a backup made by the GUI) are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Cryptochecksum: f11dee8e 05035a66 fe2a7a49 813a2eed &#xA; : Saved&#xA; : Written by enable_15 at 10:02:20.369 UTC Wed Apr 13 2016&#xA; !&#xA; ASA Version 8.2(5) &#xA; !&#xA; hostname ciscoasa&#xA; names&#xA; !&#xA; interface Ethernet0/0&#xA;  switchport access vlan 2&#xA; !&#xA; interface Ethernet0/1&#xA; !&#xA; interface Ethernet0/2&#xA; !&#xA; interface Ethernet0/3&#xA; !&#xA; interface Ethernet0/4&#xA; !&#xA; interface Ethernet0/5&#xA; !&#xA; interface Ethernet0/6&#xA; !&#xA; interface Ethernet0/7&#xA; !&#xA; interface Vlan1&#xA;  nameif inside&#xA;  security-level 100&#xA;  ip address 192.168.3.1 255.255.255.0 &#xA; !&#xA; interface Vlan2&#xA;  nameif outside&#xA;  security-level 0&#xA;  ip address 10.10.10.100 255.255.255.0 &#xA; !&#xA; ftp mode passive&#xA; pager lines 24&#xA; logging asdm informational&#xA; mtu inside 1500&#xA; mtu outside 1500&#xA; icmp unreachable rate-limit 1 burst-size 1&#xA; no asdm history enable&#xA; arp timeout 14400&#xA; nat-control&#xA; global (outside) 1 interface&#xA; nat (inside) 1 0.0.0.0 0.0.0.0&#xA; route outside 0.0.0.0 0.0.0.0 10.10.10.10 1&#xA; timeout xlate 3:00:00&#xA; timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA; timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA; timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA; timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA; timeout tcp-proxy-reassembly 0:01:00&#xA; timeout floating-conn 0:00:00&#xA; dynamic-access-policy-record DfltAccessPolicy&#xA; http server enable&#xA; http 192.168.3.0 255.255.255.0 inside&#xA; no snmp-server location&#xA; no snmp-server contact&#xA; snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA; crypto ipsec security-association lifetime seconds 28800&#xA; crypto ipsec security-association lifetime kilobytes 4608000&#xA; telnet timeout 5&#xA; ssh timeout 5&#xA; console timeout 0&#xA; dhcpd auto_config outside&#xA; !&#xA; dhcpd address 192.168.3.5-192.168.3.36 inside&#xA; !&#xA;&#xA; threat-detection basic-threat&#xA; threat-detection statistics access-list&#xA; no threat-detection statistics tcp-intercept&#xA; webvpn&#xA; !&#xA; class-map inspection_default&#xA;  match default-inspection-traffic&#xA; !&#xA; !&#xA; policy-map type inspect dns preset_dns_map&#xA;  parameters&#xA;   message-length maximum client auto&#xA;   message-length maximum 512&#xA; policy-map global_policy&#xA;  class inspection_default&#xA;   inspect dns preset_dns_map &#xA;   inspect ftp &#xA;   inspect h323 h225 &#xA;   inspect h323 ras &#xA;   inspect rsh &#xA;   inspect rtsp &#xA;   inspect esmtp &#xA;   inspect sqlnet &#xA;   inspect skinny  &#xA;   inspect sunrpc &#xA;   inspect xdmcp &#xA;   inspect sip  &#xA;   inspect netbios &#xA;   inspect tftp &#xA;   inspect ip-options &#xA; !&#xA; service-policy global_policy global&#xA; prompt hostname context &#xA; no call-home reporting anonymous&#xA; Cryptochecksum:f11dee8e05035a66fe2a7a49813a2eed&#xA; : end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I hope that is useful.  Thanks for looking at this.&lt;/p&gt;&#xA;" OwnerUserId="24536" LastEditorUserId="24536" LastEditDate="2016-04-13T19:15:23.500" LastActivityDate="2016-04-14T01:26:08.697" Title="Cisco ASA 5505 routing from one private LAN to another" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29531" PostTypeId="2" ParentId="23765" CreationDate="2016-04-13T17:38:16.953" Score="1" Body="&lt;p&gt;From your description I can say that it is very much possible, and in any PBX. You should check with your PBX provider if the GSM and Analog Gateway are compatible with it or not. If they are compatible the call forwarding part won't be a hassle.&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-04-13T17:38:16.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29532" PostTypeId="2" ParentId="29443" CreationDate="2016-04-13T18:18:04.673" Score="3" Body="&lt;p&gt;You're asking a good questions. And to answer them properly we have to explore &lt;a href=&quot;http://www.practicalnetworking.net/packet-traveling/key-players/#routers&quot; rel=&quot;nofollow noreferrer&quot;&gt;Routers&lt;/a&gt; and &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-router/&quot; rel=&quot;nofollow noreferrer&quot;&gt;how they function&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router's populate Routing Tables (which you are calling a Forwarding Table, the terms are synonymous). A Routing Table contains many mappings of either &lt;strong&gt;a network to an interface&lt;/strong&gt; or &lt;strong&gt;a network to a next-hop IP&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are multiple ways a Router can learn entries for its Routing Table. The two which are relevant to your questions are &lt;strong&gt;Directly Connected Routes&lt;/strong&gt; or &lt;strong&gt;Static Routes&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A Directly Connected route is a mapping learned due to an interface's configuration. &lt;/li&gt;&#xA;&lt;li&gt;A Static Route is a mapping learned by an administrator manually telling the Router about the location of a particular network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a router's interface &lt;code&gt;X&lt;/code&gt; is configured with the IP address 125.95.39.129, with a mask of 255.255.255.0, the Router can use the technique in &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7106/how-do-you-calculate-the-prefix-network-subnet-and-host-numbers&quot;&gt;this post&lt;/a&gt; to determine that the Network (or Subnet) this IP address resides in is 125.95.39.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, the Router will add to its Routing Table that the &lt;em&gt;Network&lt;/em&gt; &lt;strong&gt;125.95.39.0/24 maps to Interface X&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should this same Router now come across a packet destined to the to 125.95.39.129 (the Router's own interface X IP address), the Router will forward the packet to its CPU for processing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should this same Router now come across a packet destined to &lt;em&gt;any other IP address in the network&lt;/em&gt; (125.95.39.&lt;strong&gt;0&lt;/strong&gt; - &lt;strong&gt;.255&lt;/strong&gt;), the Router will forward the packet out Interface &lt;code&gt;X&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR /&gt;&#xA;Let us now imagine an administrator configures the Router for two Static Routes that claim:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;125.95.39.68/32 exists out Interface &lt;code&gt;Y&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;125.95.39.64/28 exists out Interface &lt;code&gt;Z&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both of these networks contain IP addresses in the same network as the one connected to Interface &lt;code&gt;X&lt;/code&gt;. So in essence, you have three overlapping routes. It is common, and perfectly acceptable, for a Routing Table to have entries that overlap. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, should the router receives a packet destined to...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;... 125.95.39.55, this packet matches only one route and will be forwarded out Interface &lt;code&gt;X&lt;/code&gt;&lt;BR /&gt;&#xA;... 125.95.39.65, this packet matches two routes, and will be forwarded out Interface &lt;code&gt;Z&lt;/code&gt;&lt;BR /&gt;&#xA;... 125.95.39.68, this packet matches all three routes, and will be forwarded out Interface &lt;code&gt;Y&lt;/code&gt;&lt;BR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What governs this behavior is the rules of Overlapping routes. In all cases, what determines which route will be selected follows these rules:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Most Specific Route&lt;/li&gt;&#xA;&lt;li&gt;Best (lowest) Administrative Distance&lt;/li&gt;&#xA;&lt;li&gt;Best (lowest) Route Metric&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the second case above (packet destined to 125.95.39.65), the /28 static route is more specific than the /24 directly connected route, so /28 is chosen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the third case above (packet destined to 125.95.39.68), the /32 static route is more specific than the /28 static, and /24 directly connected, so the /32 gets chosen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should there be two routes with the same specificity (aka, two /32 routes, or two /24 routes, etc), Administrative Distance would break the tie. &lt;strong&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/26252/who-decided-the-admin-distance-values-for-each-protocol&quot;&gt;Administrative Distance&lt;/a&gt;&lt;/strong&gt; is an arbitrary number set to 'rate' and set difference preferences for different sources of learning routes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, Static Routes typically have a Administrative Distance of 1, and Directly Connected routes have an Administrative Distance of 0. Which means should a /24 Static Route exist as well as /24 Directly Connected route, the Directly Connected route would be preferred.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Metric&lt;/strong&gt; is a final tie breaker, it is an arbitrary value associated with each Route to specify how preferred that particular route is compared to other routes learned from the same mechanism and for with the same specificity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;H3&gt;Summary / TLDR&lt;/H3&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answers to your questions are in the explanation above. But to summarize...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.#1 -- it depends how 125.95.39.129 is in the Router's forwarding table. AKA, as a /32 route? As a /24 route?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.#2 -- Most specific route will always take precedence&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.#3 -- Most specific route will always take precedence, followed by Administrative Distance&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-04-13T19:11:03.200" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29534" PostTypeId="2" ParentId="21063" CreationDate="2016-04-13T18:55:40.870" Score="2" Body="&lt;p&gt;For UDP you can use &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# show udp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and if you want to see detail of a particular socket then&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# show socket &amp;lt;PID&amp;gt; detail&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20572" LastEditorUserId="8499" LastEditDate="2016-04-13T19:52:07.687" LastActivityDate="2016-04-13T19:52:07.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29535" PostTypeId="1" AcceptedAnswerId="29536" CreationDate="2016-04-13T19:16:52.810" Score="4" ViewCount="626" Body="&lt;p&gt;Like take this example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ztdhi.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ztdhi.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also not mentioned in image, lets take:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Segment 1 is between switch 1 and switch 2 &lt;/li&gt;&#xA;&lt;li&gt;Segment 2 is between switch 2 and switch 3&lt;/li&gt;&#xA;&lt;li&gt;Segment 3 is between switch 3 and switch 1&lt;/li&gt;&#xA;&lt;li&gt;All lines have equal bandwidth capacity&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If someone in segment 2 wants to send something to someone in segment 3, then he can't just go through switch 3 cause the port is blocked. So has to go through switch 2 and then to switch 1 to finally reach segment 3. Is this right? In this case didn't Spanning tree make him go through the more costly path?&lt;/p&gt;&#xA;" OwnerUserId="24539" OwnerDisplayName="pong lenis" LastEditorUserId="8499" LastEditDate="2016-04-13T22:08:12.977" LastActivityDate="2022-01-13T04:01:16.337" Title="I'm confused on how spanning tree works" Tags="|spanning-tree|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29536" PostTypeId="2" ParentId="29535" CreationDate="2016-04-13T19:26:02.523" Score="7" Body="&lt;p&gt;Yes it did make him go through a more costly path. Maybe you aren't confused on how it works, maybe you're confused on what it's for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spanning-tree is for stopping network loops. It finds short paths from the root to each edge, and closes other paths between edges - it's not about making every connection as short as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider your picture - you get the same problem if you close Switch 1 &amp;lt;-&gt; Switch 2, or Switch 1 &amp;lt;-&gt; Switch 3 instead, the problem just moves around. It's impossible for your picture to have no loops, and one hop from anywhere to anywhere.&lt;/p&gt;&#xA;" OwnerUserId="2880" LastActivityDate="2016-04-13T19:26:02.523" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29537" PostTypeId="2" ParentId="29535" CreationDate="2016-04-13T19:28:44.663" Score="4" Body="&lt;p&gt;STP is about providing a loop-free environment, and path cost is a secondary concern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key is that it elects a root switch. The best metric to the root switch is the metric used to send traffic, not the best metric to the destination. This forces the traffic to travel toward the root switch in order to get to its destination. If you look at the topology, you can see how this eliminates loops.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-13T19:28:44.663" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29538" PostTypeId="1" CreationDate="2016-04-13T20:12:29.867" Score="2" ViewCount="312" Body="&lt;p&gt;The full topology is on &lt;a href=&quot;https://www.utexas.edu/its/network/reports/UniversityNetworkReport2015.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;page 7&lt;/a&gt; I do not understand why the NAT boxes are only connected to edge. Why not have links from core to edge carrying traffic without NAT and links from core to A10 then to edge for traffic requiring edge?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The current core architecture is illustrated in Figure 7. It remains a&#xA;  pair of Cisco Nexus 7010s, the border a pair of Catalyst 6509s, some &#xA;  distribution/remote cores use Catalyst 6509s. NAT is provided by a &#xA;  pair of A10 AX3530 (primarily wireless, although an option is &#xA;  available for unit wired networks and forthcoming wired 802.1x &#xA;  initiative).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/F1hDV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/F1hDV.png&quot; alt=&quot;topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34" LastEditorUserId="34" LastEditDate="2016-04-13T23:04:35.587" LastActivityDate="2016-05-16T00:05:36.997" Title="What are the NAT boxes for in the topogogy?" Tags="|nat|topology|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29539" PostTypeId="2" ParentId="29513" CreationDate="2016-04-13T20:18:50.637" Score="0" Body="&lt;p&gt;From the CLI, the last input or output lines could be a rough indicator. Keep in mind, a quiet interface could be off by a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using other management engines, syslog will show interface state changes. SNMP traps/informs can also be setup to signal state changes.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-04-13T20:18:50.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29540" PostTypeId="2" ParentId="29538" CreationDate="2016-04-13T20:27:28.037" Score="0" Body="&lt;p&gt;NAT is the process which translates the addresses. It should be placed at the edge of an addressing domain, where the addresses need to be translated. If you entire company uses the same addressing, it will be at the edge of the company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you translate addresses in the middle of an address domain, the addressing will be incorrect inside the addressing domain, and the traffic may not be routed correctly (depending on the translation direction) since the addressing domain knows nothing about the new addressing. Also, incoming traffic may have the routing problem since the edge of the addressing domain knows nothing about the foreign addressing, and it cannot route the traffic to the translation point.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-13T20:27:28.037" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29541" PostTypeId="2" ParentId="29538" CreationDate="2016-04-13T20:35:55.557" Score="0" Body="&lt;p&gt;Its hard to say for sure without knowing the configuration. But my best guess would assume the two arrows of 20gbps links each indicate the NAT device sits &quot;within&quot; the edge routers. So something like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Edge --&amp;gt; NAT --&amp;gt; Edge --&amp;gt; Core&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be done using VRFs (or even VLANs). But again this is simply a guess, and no definitive answer can exist without looking at the configuration.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-04-13T20:35:55.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29544" PostTypeId="2" ParentId="29530" CreationDate="2016-04-14T01:26:08.697" Score="2" Body="&lt;p&gt;Here's partial answer (to the SSH problem):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, you need to generate the encryption keys&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip domain-name mycorp.com&#xA;crypto key generate rsa modulus 2048&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, you need to configure user accounts&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username jfl privilege 15 password opensesame&#xA;!&amp;lt;additional accounts&amp;gt;&#xA;aaa authentication ssh console local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, allow SSH from the desired addresses&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh 192.168.3.0 255.255.255.0 inside&#xA;ssh version 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-14T01:26:08.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29545" PostTypeId="1" AcceptedAnswerId="29547" CreationDate="2016-04-14T02:57:37.103" Score="3" ViewCount="501" Body="&lt;p&gt;I know an advertising window is set by the receiver to inform the sender not to send more than what is advertised in the receiver's window to avoid packet loss due to overflow of packets at receiver(Flow control). This window size is 16 bits(65535 is the max value). So this limits sender from sending more than 65535 bytes? &lt;/p&gt;&#xA;" OwnerUserId="24153" LastActivityDate="2022-04-18T12:21:23.333" Title="What is the maximum value that a receiver can set in its advertising window" Tags="|ipv4|tcp|congestion|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29546" PostTypeId="1" AcceptedAnswerId="29746" CreationDate="2016-04-14T03:10:30.147" Score="8" ViewCount="26077" Body="&lt;p&gt;Pretty simple question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the industry best practice? In a &lt;strong&gt;small&lt;/strong&gt; business which has computers which require static IP addresses is it better to set static IP addresses for devices on the devices themselves, or in the router/managed switch? All non-static IP requiring devices can use DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="24090" LastEditorUserId="24090" LastEditDate="2016-04-14T05:43:12.043" LastActivityDate="2020-09-01T15:31:01.653" Title="Best practice - Set static IP in device or router?" Tags="|switch|router|best-practices|" AnswerCount="6" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29547" PostTypeId="2" ParentId="29545" CreationDate="2016-04-14T03:30:46.940" Score="4" Body="&lt;p&gt;The Window Size field in each TCP header indicates the amount of empty space, in bytes, remaining in the receive buffer. The field is 16 bits in TCP, but with the Windows Scale option, values larger than 65535 can be used. Windows scale option increases the Window Size from 16 bit to 30 bit. Instead of changing the field size, however, the header still holds a 16 bit value, and an option is defined that applies a scaling factor to the 16 bit value. Window Scale RFC is 1323.&lt;/p&gt;&#xA;&lt;p&gt;Before RFC-1323, the TCP window size was limited to 64K. This implied that without window scaling, TCP could only send 64k of data before waiting for an ACK. This RFC defines a new TCP option that allows a window size larger than 64K of data before window scaling.&#xA;(TCP/IP Illustrated Vol. 1.)&lt;/p&gt;&#xA;" OwnerUserId="20572" LastEditorUserId="78487" LastEditDate="2022-04-18T12:21:23.333" LastActivityDate="2022-04-18T12:21:23.333" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="29552" PostTypeId="1" AcceptedAnswerId="29554" CreationDate="2016-04-14T04:23:54.883" Score="2" ViewCount="981" Body="&lt;p&gt;If I am sitting at the command line of a host and have an IP and port for a destination, is there any way to tell if the network path involves a firewall, or if it's being evaluated by a ruleset of some kind? I assume there's no way to tell because a network path that's not dropped (that's allowed by a firewall ruleset) would appear exactly the same as a network path with no firewall evaluation involved, but looking to confirm that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe more generally, is a firewall always involved (at some level) when I have multiple VLANs on my network, or could traffic route between VLANs (with different gateway IP addresses) without being evaluated by firewall rules?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to determine how early to involve our InfoSec team in troubleshooting efforts when we lose connectivity - in some cases, we're crossing VLAN boundaries but the two different VLANs have open access to each other (all traffic allowed). Does this have to be configured by a firewall (and a ruleset), or is it possible that the switches can be configured to consider this traffic open (traversing VLAN without a firewall)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24547" LastActivityDate="2016-04-14T05:08:18.513" Title="Is it possible to tell if a firewall is present on my network path?" Tags="|vlan|firewall|troubleshooting|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29554" PostTypeId="2" ParentId="29552" CreationDate="2016-04-14T05:08:18.513" Score="4" Body="&lt;p&gt;Traffic can be routed between VLANs by a router, there is no requirement for a firewall (which ultimately is really a router with some filtering features, anyway).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no way to say for sure whether you are crossing a firewall or other filtering mechanism on your network path. The best you can do is try to detect side effects of a firewall's presence, usually more because of its advanced security features than because of its ruleset. For example, if you capture traffic at either end, and the absolute TCP sequence numbers don't match, you probably have a firewall in between, rewriting them. Or if you have a session ending with a TCP RST, and that packet doesn't make it to the other side, it was probably dropped by a firewall. There are other effects that can be visible in various TCP/IP headers, but they are usually pretty subtle and more a clue than a definite sign a FW is present.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-04-14T05:08:18.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29557" PostTypeId="1" AcceptedAnswerId="29561" CreationDate="2016-04-14T09:32:02.040" Score="3" ViewCount="3507" Body="&lt;p&gt;Background: We own /24 as well as /23 blocks provider independent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am talking to an ISP, say ISP-A for a 10G line with a IPVPN line (2 links - actual inbound + IPVPN link for clean traffic when there is a attack) for DDOS mitigation. When there is a attack my ISP filters the attack the send the clean traffic through IPVPN. This is a proposal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For redundancy purpose, we are planning to have an another ISP-B but still want to use the ISP-As DDOS mitigation. When we asked this, ISP-A said, we cannot do mitigation for blocks less than /24, technically they cannot advertise less than /24 due some memory issues etc and said it is kind of internet limitation not BGP or theirs(ISP-A).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain more on it?&lt;/p&gt;&#xA;" OwnerUserId="22114" LastEditorUserId="16930" LastEditDate="2016-04-14T21:04:54.790" LastActivityDate="2016-09-27T14:37:16.717" Title="Multi-homing and BGP routing with less than /24" Tags="|routing|bgp|isp|asymmetric-routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29559" PostTypeId="1" AcceptedAnswerId="29565" CreationDate="2016-04-14T10:23:42.783" Score="0" ViewCount="1985" Body="&lt;p&gt;I have been assigned for my first project ever as network engineer, things seems to be going smoothly, but there's something which is not clear to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After configuring VLANs on the Core, IP routing is enabled, and everything going as plan, he told me to configure the port between the Core and The Perimeter Firewall on a Separate VLAN and to make it as access Port, whys that?&#xA;I mean shouldn't be a trunk between Core and Firewall so that it passes VLANs to the internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’m a total noob in networking, got the basic Theory knowledge but nothing practical until now.&lt;/p&gt;&#xA;" OwnerUserId="24554" LastActivityDate="2016-04-14T11:57:48.950" Title="Uplink between Firewall and Coreswitch" Tags="|firewall|switching|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29560" PostTypeId="1" AcceptedAnswerId="29564" CreationDate="2016-04-14T10:35:44.773" Score="2" ViewCount="6704" Body="&lt;p&gt;I'm having some issues with some access list configuration regarding a topology. The lab requirements are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Deny any host with even-numbered IP addresses from the BM_R1 LAN from&#xA;accessing hosts on the BM_R3 LAN.&lt;/li&gt;&#xA;&lt;li&gt;Hosts with odd-numbered IP addresses on the BM_R1 LAN should be able&#xA;to ping any other destination.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The two networks to which the access list refers are &lt;code&gt;172.16.1.128/25&lt;/code&gt; (R3 LAN) and &lt;code&gt;172.16.1.160&lt;/code&gt; (R1 LAN). I've tried changing the wildcard bits to 0.0.0.254 for even IP addresses on both. I've also tried placing them on either R1 or R3, but it did not work. What am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="24555" LastEditorUserId="8499" LastEditDate="2018-12-23T04:55:36.750" LastActivityDate="2018-12-23T04:55:36.750" Title="Access list policy with odd and even filtering" Tags="|cisco|router|ipv4|acl|lab|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29561" PostTypeId="2" ParentId="29557" CreationDate="2016-04-14T10:53:15.673" Score="6" Body="&lt;p&gt;Most transit provider will refuse to announce tough BGP a prefix longer than /24. (I.E. /25 for example)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's related to the size of the routing tables in the routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to understand that the prefix you announce will be propagated to almost all routers on the Internet, and that's a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each prefix announced take some memory in each router, and computational resources when the router has to pick up a route to forward a packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Allowing people to announce long prefixes would dramatically increase the numbers of routes in each router all over the world, which is not desirable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's actually many many prefix longer than /24 announced on the Internet, even many /32, because each ISP doesn't enforce this rule and there's no practical way to force them to do so, and partially because of historical reason (from time when this good practice didn't exist).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the beginning of the Internet, there was very few routes and no central authority, no rules. Then the Internet grow bigger and bigger and it started to be an issue when some routers were no more able to handle the routing table in memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that the Internet routing table grow so big lead to this consensus that we shouldn't anymore allow it.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-09-27T14:37:16.717" LastActivityDate="2016-09-27T14:37:16.717" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29562" PostTypeId="1" CreationDate="2016-04-14T11:19:55.193" Score="0" ViewCount="271" Body="&lt;p&gt;Just got an simple question.Its abt reading a plane IP packet. In a standard IP packet RFC 791, there are multiple fields, the IP packet header size is 20 bytes.  Now when i look at following packet and see the highlighted sections i see Version is IPv4 and header length is 20 bytes (which is true and we ack that).However the binary values on the left side are confusing .  For the version the binary value is 0100 which is decimal  is 4 and is true (IPv4) but for Header length  the binary is 0101 which should be 5 but it shows 20 bytes!!!! How? Also since the IHL (IP header length) field in IP header is only 4 bits the max decimal value can only be 15 (if 1111). Now how come it can show the header length as 20. Now sure what u am missing but i request experts to take a moment to answer this. &lt;a href=&quot;https://i.stack.imgur.com/7HUSf.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7HUSf.jpg&quot; alt=&quot;IPpacket&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24556" LastEditorUserId="8499" LastEditDate="2018-12-27T01:05:08.167" LastActivityDate="2018-12-27T01:05:08.167" Title="IP packet reading" Tags="|ip|protocol-theory|wireshark|rfc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29563" PostTypeId="2" ParentId="29562" CreationDate="2016-04-14T11:39:23.553" Score="4" Body="&lt;p&gt;The unit used in the Length field is not bit nor even byte but 32bits words.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the value 5 correspond to five 32 bits words = 160 bits = 20 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the max value is then 15 x 32 bits = 60 bytes (40 for options).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-04-14T11:52:07.497" LastActivityDate="2016-04-14T11:52:07.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29564" PostTypeId="2" ParentId="29560" CreationDate="2016-04-14T11:56:25.073" Score="1" Body="&lt;p&gt;When creating ACLs in a Cisco router, you use wildcard masks. Where you have a bit set to &lt;code&gt;0&lt;/code&gt; in the wildcard mask, that bit must exactly match in the address. Remember that addresses and masks, including wildcard masks, are really just 32-bit numbers. This only works for IPv4; IPv6 uses CIDR notation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list 10 deny 192.168.2.0 0.0.1.255   ! denies anything between 192.168.2.0 and 192.168.3.255&#xA;ip access-list 10 deny 192.168.2.0 0.0.1.254   ! denies only even addresses between 192.168.2.0 and 192.168.3.255&#xA;ip access-list 10 deny 192.168.2.1 0.0.1.254   ! denies only odd addresses between 192.168.2.0 and 192.168.3.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is something that used to be taught in Cisco classes, but it's not actually very useful in the real world. If you must use non-contiguous wildcard masks, you should probably rethink the network design.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-14T12:41:24.920" LastActivityDate="2016-04-14T12:41:24.920" CommentCount="16" ContentLicense="CC BY-SA 3.0" />
  <row Id="29565" PostTypeId="2" ParentId="29559" CreationDate="2016-04-14T11:57:48.950" Score="1" Body="&lt;p&gt;This is general design question which all network designers may have. i will explain it very simply.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;if you want to apply security filtering profiles for inter VLAN routing, its good to have a trunk between core switch and router. And do the routing on firewall.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you are provides internet connectivity through firewall and you needs to filter all traffic in common manner for all VLANs, you can use different VLAN between core switch and firewall. then add default route to firewall and apply internet traffic filtering at firewall.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;this two methods are depends on your requirement.&lt;/p&gt;&#xA;" OwnerUserId="21995" LastActivityDate="2016-04-14T11:57:48.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29566" PostTypeId="1" AcceptedAnswerId="29569" CreationDate="2016-04-14T14:24:38.693" Score="1" ViewCount="669" Body="&lt;p&gt;So, I've been checking Google along with the RFC 7348 about VxLAN functionality. I believe I do have a good grasp of what the purpose of the protocol is, what it does and how it does it etc but I fail to see the purpose of the Optional Outer 802.1Q. The RFC standard states (page 11): &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The outer VLAN tag is optional. If present, it may be used for&#xA;  delineating VXLAN traffic on the LAN.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;br/&gt;Can anyone help me with this part of the sentence? What does &quot;delineating VXLAN traffic on the VLAN implies&quot;? What does this do? :S&lt;br/&gt;&#xA;As far as I understand it, the Optional Inner 802.1Q serves the purpose to forward traffic in already established VLAN environments. In essence, it &quot;stretches&quot; existing L2 infrastructures by expanding their number of available groups to ~16M from ~4K by also offering L3 isolation which is the whole point after all. But what about the Outer 802.1Q? What am I missing here?&lt;/p&gt;&#xA;" OwnerUserId="24561" LastEditorUserId="24561" LastEditDate="2016-04-14T15:23:32.080" LastActivityDate="2016-04-14T16:47:00.103" Title="VxLAN optional outer 802.1Q purpose?" Tags="|ieee-802.1x|rfc|vxlan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29569" PostTypeId="2" ParentId="29566" CreationDate="2016-04-14T16:47:00.103" Score="3" Body="&lt;p&gt;Presumably, the outer vlan ID is used if you want to carry both your VXLAN trunk and a bunch of other non-VXLAN VLANs together on a traditional 802.1q trunk. So you end up with an outer .1q trunk just like you've always done, and an inner VXLAN trunk. The switches involved in this trunk have no knowledge of VXLAN, to them it's just another flow, like any other UDP traffic.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-04-14T16:47:00.103" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29570" PostTypeId="1" AcceptedAnswerId="29699" CreationDate="2016-04-14T17:56:10.693" Score="3" ViewCount="695" Body="&lt;p&gt;ASA version 9.1 configured with SSL VPN to Windows AnyConnect Secure Mobility Client version 3.1. VPN Filter ACL is configured to allow all traffic and ICMP, and is attached to group policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPN connects successfully (AnyConnect client says &quot;connected&quot;) but cannot route any traffic over the VPN. Cannot ping any internal host behind the ASA, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Observations:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internal network (behind ASA): 10.111.11.0/24&#xA;Network on client computer: 192.168.1.0/24 (sits behind another ASA - that is not relevant though because doesn't work on other n/w having no ASA firewall either)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASDM reports one AnyConnect session active on the ASA. Reports also that the above ACL is going to be used. The first rule of that ACL (see below config) got 1900 hits so traffic arrives but seems to not find its way back? VPN ACLs are meant to automatically be bidirectional so it SHOULD work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Windows client computer I can see a Cisco network adapter has been created when the VPN connects with IP address 192.168.20.1. Network configuration claims that 192.168.20.2 is the default gateway, which should be the ASA - but I cannot ping 192.168.20.2.&#xA;A &quot;route print&quot; on the client computer shows 192.168.20.2 to be the default gateway as well. &#xA;(These addresses are valid - they are assigned from local pool RemoteWorkerPool 192.168.20.1-192.168.20.254, see below config).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot ping the client IP address (192.168.20.1) from within the ASA (does the AnyConnect client respond to the ping usually?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running a &quot;show vpn-sessiondb detail svc filter name &quot; command shows &quot;Filter name: RemoteVPNACL&quot; in the SSL section, which fits to my configuration - the ACL is being used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SSL Ciphers:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &quot;show ssl&quot; command brings up the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Accept connections using SSLv2, SSLv3 or TLSv1 and negotiate to SSLv3 or TLSv1&#xA;Start connections using SSLv3 and negotiate to SSLv3 or TLSv1&#xA;Enabled cipher order: rc4-sha1 dhe-aes128-sha1 dhe-aes256-sha1 aes128-sha1 aes256-sha1 3des-sha1&#xA;Disabled ciphers: des-sha1 rc4-md5 null-sha1&#xA;SSL trust-points:&#xA;  outside interface: TrustPoint1&#xA;  NP Identity Ifc interface:&#xA;Certificate authentication is not enabled&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This also seems okay - I use username / password authentication. I could not find anything in Cisco documentation that the 3.1 client would not work with ASA version 9.1, but it's not 100% clear. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Solution Attempts:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration was originally created by ASDM wizard and resulted in this problem. Have re-created the configuration plainly from CLI, same result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connected the Windows client to another internet connection which is not behind any firewall. Same result - VPN connects but no traffic can flow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have configured IPSec VPN for AnyConnect on top of this configuration - same result, I get a connection, but no traffic flows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco VPN troubleshooter did not give me any useful hint. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure there is a very basic error somehwere, but cannot find it. I am lacking knowledge on how one goes about debugging or troubleshooting AnyConnect VPN connections apart from above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration (relevant parts):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&#xA;crypto key generate rsa label RSA_KEYPAIR noconfirm&#xA;&#xA;crypto ca trustpoint TrustPoint1&#xA;   revocation-check none&#xA;   id-usage ssl-ipsec&#xA;   no fqdn&#xA;   subject-name CN=ASA&#xA;   enrollment self&#xA;   keypair RSA_KEYPAIR&#xA;&#xA;crypto ca enroll TrustPoint1 noconfirm&#xA;ssl trust-point TrustPoint1 outside&#xA;&#xA;ip local pool RemoteWorkerPool 192.168.20.1-192.168.20.254&#xA;&#xA;sysopt connection permit-vpn &#xA;&#xA;access-list RemoteVPNACL permit ip 192.168.20.0 255.255.255.0 any &#xA;access-list RemoteVPNACL permit icmp 192.168.20.0 255.255.255.0 any &#xA;&#xA;group-policy RemoteWorkerPolicy internal&#xA;group-policy RemoteWorkerPolicy attributes&#xA;  vpn-tunnel-protocol ssl-client&#xA;  address-pools value RemoteWorkerPool&#xA;  vpn-filter value RemoteVPNACL&#xA;  dns-server value 10.111.11.5&#xA;  vpn-idle-timeout 30&#xA;&#xA;username nepclientvpn password xxxxxxxxxxxxx&#xA;username nepclientvpn attributes&#xA;  vpn-group-policy RemoteWorkerPolicy&#xA;&#xA;tunnel-group vpnclient type remote-access   &#xA;&#xA;tunnel-group vpnclient general-attributes&#xA;  address-pool RemoteWorkerPool&#xA;  default-group-policy RemoteWorkerPolicy&#xA;&#xA;tunnel-group vpnclient webvpn-attributes&#xA;  group-alias nepRemote1 enable &#xA;&#xA;webvpn&#xA;  tunnel-group-list enable &#xA;  anyconnect image disk0:/anyconnect-win-3.1.05182-k9.pkg 1&#xA;  anyconnect image disk0:/anyconnect-macosx-i386-3.1.05160-k9.pkg 2&#xA;  enable outside&#xA;  anyconnect enable&#xA;&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="8294" LastEditorUserId="8294" LastEditDate="2016-04-14T18:31:00.920" LastActivityDate="2016-04-18T21:24:48.797" Title="ASA 5510 AnyConnect SSL VPN to Windows 3.1 client - connected but no traffic routed" Tags="|cisco-asa|vpn|sslvpn|cisco-anyconnect|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29571" PostTypeId="1" CreationDate="2016-04-14T18:04:02.373" Score="2" ViewCount="235" Body="&lt;p&gt;How can I identify the sender's address, the receiver and what type of message does the frame carry on its payload?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The frame looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FF FF FF FF FF FF 08 24 F5 CE D3 AC 08 06 00 01 08 00 06 04 00 01 08 24 F5 CE D3 AC 83 78 2A 7F 00 00 00 00 00 00 83 78 29 6F 00 00 00 00 00 00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24564" LastEditorUserId="8499" LastEditDate="2016-04-14T18:14:14.613" LastActivityDate="2016-04-14T18:29:23.693" Title="how to identify addresses on an ethernet frame" Tags="|cisco|lan|wireshark|mpls-vpn|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29572" PostTypeId="1" CreationDate="2016-04-14T18:22:39.700" Score="1" ViewCount="48" Body="&lt;p&gt;My colleague configured the following three networks list this (Each machine has three NICs):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eth0: 192.168.0.0/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eth1: 10.10.0.0/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eth2: 10.0.0.0/8&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest to change eth1 to 172.16.0.0/16 but he think his previous configuration is correct. I was wondering if the configuration is correct. If it is not, what is the disadvantage?&lt;/p&gt;&#xA;" OwnerUserId="24566" LastEditorUserId="24566" LastEditDate="2016-04-14T18:41:07.987" LastActivityDate="2016-05-14T18:58:17.023" Title="Is the nesting network in one machine correct?" Tags="|subnet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29573" PostTypeId="2" ParentId="29571" CreationDate="2016-04-14T18:29:23.693" Score="2" Body="&lt;p&gt;The first six octets are the destination address. Your example has the broadcast destination address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next six bytes are the source address. In your example: &lt;code&gt;0824:F5CE:D3AC&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next sequence of bytes can be confusing. If the next two bytes are &lt;code&gt;8100&lt;/code&gt; you have a four-byte 802.1Q VLAN tag. Otherwise, the two bytes represent the EtherType or length. if the two bytes are &lt;code&gt;0600&lt;/code&gt; or greater, they are the EtherType, otherwise it is the payload length If there is an 802.1Q tag, it will be inserted here, and it will be four bytes long. Your example has &lt;code&gt;0806&lt;/code&gt; so the EtherType is ARP, meaning this is an ARP request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, you have the payload, followed by a four-byte Frame Check Sequence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many sources for this information, just search for &lt;code&gt;ethernet frame header&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-14T18:29:23.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29575" PostTypeId="2" ParentId="29572" CreationDate="2016-04-14T18:35:16.020" Score="1" Body="&lt;p&gt;The problem is that two of the interfaces have overlapping networks. This will cause confusion in the OS. Only one of the interfaces will be used for traffic destined to the overlap of the interfaces. For example, this could cause a response to incoming requests from &lt;code&gt;10.10.0.1&lt;/code&gt; (one of the 65,534 usable addresses which could overlap) on &lt;code&gt;eth2&lt;/code&gt; to be sent to &lt;code&gt;eth1&lt;/code&gt;, and the requesting host will never get a response.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-14T18:35:16.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29576" PostTypeId="2" ParentId="29572" CreationDate="2016-04-14T18:36:04.197" Score="0" Body="&lt;p&gt;eth 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Address:   10.0.0.0&lt;br&gt;&#xA;Netmask:   255.0.0.0 = 8&lt;br&gt;&#xA;Wildcard:  0.255.255.255&lt;br&gt;&#xA;=&gt;&#xA;Network:   10.0.0.0/8&lt;br&gt;&#xA;Broadcast: 10.255.255.255&lt;br&gt;&#xA;HostMin:   10.0.0.1&lt;br&gt;&#xA;HostMax:   10.255.255.254&lt;br&gt;&#xA;Hosts/Net: 16777214   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;eth 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Address:   10.10.0.0&lt;br&gt;&#xA;Netmask:   255.255.0.0 = 16&lt;br&gt;&#xA;Wildcard:  0.0.255.255&lt;br&gt;&#xA;=&gt;&#xA;Network:   10.10.0.0/16&lt;br&gt;&#xA;Broadcast: 10.10.255.255&lt;br&gt;&#xA;HostMin:   10.10.0.1&lt;br&gt;&#xA;HostMax:   10.10.255.254&lt;br&gt;&#xA;Hosts/Net: 65534&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both are conflicting.&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-04-14T18:36:04.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29577" PostTypeId="1" CreationDate="2016-04-14T18:43:46.053" Score="-1" ViewCount="435" Body="&lt;p&gt;How many frames will be neeed to transmit a file of 80,480 KB file? Is there a mathematical calculation for this? &lt;/p&gt;&#xA;" OwnerUserId="24564" LastActivityDate="2016-07-05T22:18:18.890" Title="How to know how many frames will be needed to transmit a file" Tags="|cisco|ethernet|wireshark|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29579" PostTypeId="1" CreationDate="2016-04-14T20:07:43.323" Score="1" ViewCount="281" Body="&lt;p&gt;We just ran into the same problem outlined in this post:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/3808/kemp-load-balancers-using-ucarp-vrrp-multicast-mac-address-not-being-picked/29578&quot;&gt;KEMP load balancers using UCARP (VRRP) - multicast MAC address not being picked up&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only work-around that I was able to do was to disable the &quot;User Virtual MAC Addresses&quot; option on the Kemp. That option has the following text: &quot;By default, the HA subsystem only switches IP addresses and uses gratuitous ARPs. Enabling this option [turning virtual mac address on] will force the MAC address to also be switched. This option is only needed if gratuitous ARPs are not allowed.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the &quot;virtual mac&quot; option enabled, the VIP of one of the Kemp load balancers gets the multicast mac (like you have): 00-00-5e-00-05-01 Disabling this option, the VIP gets a unicast MAC: 00-10-f3-3e-12-32&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now HA failover takes a few mins while the ARP table expires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd love to know what anyone else had done to get around this with PowerConnect 5.1.1.7 firmware and make it work like it did in 4.x firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="24569" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2019-05-01T12:01:35.383" Title="Dell PowerConnect Firmware Update / Kemp VRRP" Tags="|multicast|vrrp|powerconnect|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29583" PostTypeId="2" ParentId="29577" CreationDate="2016-04-14T22:04:32.790" Score="2" Body="&lt;p&gt;There's no straight answer just as there's no magical formula to get this. Frames are layer 2 and some of them they carry layer 3 packets, which contain layer 3 protocol info as well as data payload, but not necessarily in the same packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A partial answer is &quot;at least the same amount of packets needed to transmit the file&quot;, and so the amount of packets varies depending on MTU which will fragment the packet size; it varies if there's noise in the link which can lead to packet loss and therefore packet retransmission; it also depends on the application used to transmit the file: ftp, scp, sftp, etc or even tftp, while the first are tcp (allowing packet retransmission), tftp for example uses udp and doesn't really care if the packet was delivered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, there's a number of things to take into consideration before giving a definite answer. I would setup a wireshark sniffer and perform a transfer test just for fun and check all the capture information to see how much of it is data vs how much is protocol info.&lt;/p&gt;&#xA;" OwnerUserId="24575" LastActivityDate="2016-04-14T22:04:32.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29585" PostTypeId="1" AcceptedAnswerId="29594" CreationDate="2016-04-14T23:32:18.067" Score="2" ViewCount="5811" Body="&lt;p&gt;I am trying to understand DCTCP behavior. For that I  am using RED queue discipline on switch port. I am generating traffic using iperf3 for 30 seconds. To capture the packets i am using tcpdump. However the tcpdump file is too large.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I wish to extract the packets that have been marked with ECN. Can someone please suggest a way so that I can filter only those packets that have ECN bit set in TCP headers ? Thanks in advance.  &lt;/p&gt;&#xA;" OwnerUserId="23374" LastActivityDate="2016-04-15T09:46:58.053" Title="Extract packets with ECN notification set." Tags="|tcp|wireshark|packet-analysis|tcpdump|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29590" PostTypeId="1" CreationDate="2016-04-15T06:02:59.220" Score="1" ViewCount="2609" Body="&lt;p&gt;on the catalyst IOS I hadn't had any problems with activating the ssh auth via public key, but on the Nexus OS I can't seem to find the option. Is it even implemented in some NX-OS version?&lt;/p&gt;&#xA;" OwnerUserId="24583" LastActivityDate="2016-08-12T08:06:48.130" Title="Nexus OS authenticate via ssh key" Tags="|cisco|ssh|cisco-nx-os|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29592" PostTypeId="2" ParentId="9455" CreationDate="2016-04-15T07:33:23.310" Score="1" Body="&lt;p&gt;SSDP is the &lt;a href=&quot;https://en.wikipedia.org/wiki/Simple_Service_Discovery_Protocol&quot; rel=&quot;nofollow&quot;&gt;Simple Service Discovery Protocol&lt;/a&gt;.  As that Wikipedia article says, it is &quot;a text-based protocol based on &lt;a href=&quot;https://en.wikipedia.org/wiki/HTTPU&quot; rel=&quot;nofollow&quot;&gt;HTTPU&lt;/a&gt;&quot; and &quot;uses the User Datagram Protocol (UDP) as the underlying transport protocol.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, yes, it's an HTTP-based protocol, and, yes, it runs atop UDP rather than TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it's not what's used for normal Web site access.  &lt;em&gt;That&lt;/em&gt; traffic will be shown by Wireshark as &quot;HTTP&quot;, not &quot;SSDP&quot;, and will run over TCP, &lt;em&gt;if&lt;/em&gt; it's not &quot;secure HTTP&quot; (&quot;https&quot;) traffic.  If it's &quot;secure HTTP&quot;, it'll show as &quot;SSL&quot; (Secure Sockets Layer, although the current versions of that protocol are called Transport Layer Security, or TLS), and &lt;em&gt;won't&lt;/em&gt; show up as HTTP unless &lt;a href=&quot;https://wiki.wireshark.org/SSL#SSL_dissection_in_Wireshark&quot; rel=&quot;nofollow&quot;&gt;Wireshark can decrypt it&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And your display filter &quot;ip.addr == 192.168.0.1&quot; will show that traffic only if it's HTTP traffic to or from 192.168.0.1; if that's not the address of the machine on which you're running Wireshark, and not the address of the site to which you're browsing, the traffic between your machine and that site will &lt;em&gt;not&lt;/em&gt; have 192.168.0.1 as an IP address (not even if the traffic is being routed &lt;em&gt;through&lt;/em&gt; 192.168.0.1) and thus won't be matched by that filter.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2016-04-15T07:33:23.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29594" PostTypeId="2" ParentId="29585" CreationDate="2016-04-15T09:46:58.053" Score="1" Body="&lt;p&gt;You can load the packet trace in Wireshark, and apply the filter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tcp.flags.ecn==1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to see only packets with the ECN-Echo bit set in the TCP header, and &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tcp.flags.cwr==1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;to see only the packets with the ECN-CWR (Congestion Window Reduced) bit set in the TCP header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.wireshark.org/docs/dfref/t/tcp.html&quot; rel=&quot;nofollow&quot;&gt;Here is the list of TCP filters&lt;/a&gt; in Wireshark. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also be interested in filtering on ECN-CE flags in the IP header, which you can do with&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip.dsfield.ecn == 0x03&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.wireshark.org/docs/dfref/i/ip.html&quot; rel=&quot;nofollow&quot;&gt;Here is the list of IP filters&lt;/a&gt; in Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To see what it &lt;em&gt;should&lt;/em&gt; look like, you can download &lt;a href=&quot;https://wiki.wireshark.org/SampleCaptures?action=AttachFile&amp;amp;do=get&amp;amp;target=tcp-ecn-sample.pcap&quot; rel=&quot;nofollow&quot;&gt;this sample capture&lt;/a&gt; from the &lt;a href=&quot;https://wiki.wireshark.org/SampleCaptures&quot; rel=&quot;nofollow&quot;&gt;Wireshark Sample Captures&lt;/a&gt; page. This capture includes packets with ECN events.&lt;/p&gt;&#xA;" OwnerUserId="19700" LastActivityDate="2016-04-15T09:46:58.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29595" PostTypeId="2" ParentId="29590" CreationDate="2016-04-15T10:08:08.263" Score="1" Body="&lt;p&gt;You can generate an SSH server key based on your security requirements. The default SSH server key is an RSA key that is generated using 1024 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/6_x/nx-os/security/configuration/guide/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6-x/b_Cisco_Nexus_7000_NX-OS_Security_Configuration_Guide__Release_6-x_chapter_01000.pdf&quot; rel=&quot;nofollow&quot;&gt;Here is the link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22728" LastEditorUserId="27121" LastEditDate="2016-06-13T06:41:22.993" LastActivityDate="2016-06-13T06:41:22.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29596" PostTypeId="2" ParentId="29372" CreationDate="2016-04-15T11:55:05.633" Score="2" Body="&lt;p&gt;CISCO-IETF-PW-MIB::cpwVcTable provides pseudo-wire VC status and some other configuration data.&#xA;CISCO-IETF-PW-MIB::cpwVcPerfTotalTable gives per-VC packets and bytes 64-bit counters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With net-snmp utils you can try queries like (works on ASR9K):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmptable -v2c -c public -M /usr/share/snmp/CISCO -m CISCO-IETF-PW-MIB -IR -Ci YOUR_ROUTER_NAME_OR_IP cpwVcTable&#xA;snmptable -v2c -c public -M /usr/share/snmp/CISCO -m CISCO-IETF-PW-MIB -IR -Ci YOUR_ROUTER_NAME_OR_IP cpwVcPerfTotalTable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24589" LastActivityDate="2016-04-15T11:55:05.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29600" PostTypeId="1" AcceptedAnswerId="29603" CreationDate="2016-04-15T14:43:46.053" Score="1" ViewCount="1068" Body="&lt;p&gt;Please can anyone help me confirming something : Is every protocol (OSPF, RIP, EIGRP,BGP) needs to have the route in the RIB in order to be able to REDISTRIBUTE it into another protocol ? Is there any exception ?&lt;/p&gt;&#xA;" OwnerUserId="12149" LastEditorUserId="2142" LastEditDate="2016-04-15T15:49:54.370" LastActivityDate="2016-04-15T16:42:17.623" Title="Does a route need to be in the RIB in order to be redistributed?" Tags="|routing|bgp|ospf|eigrp|rip|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="29601" PostTypeId="2" ParentId="19129" CreationDate="2016-04-15T14:47:23.090" Score="1" Body="&lt;p&gt;Documentation is quite sparse on these topics.  Location scans are sent even if you are associated to a wireless network.  They are used for geofencing as well as by apps and websites to help determine your location.  Location scans are also used by Apple to pair up with GPS coordinates to help with allowing other people's WiFi-only devices (iPod Touch) to determine their location.  This so-called 'crowd sourcing' of location info allows them to determine traffic speed, etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PNO scans and ePNO scans are only used when you are unassociated and the device is locked.  They are used to automatically connect to networks for which you have a profile when the device is in a low-power state.  In my testing the device does not probe for networks by name unless the network is configured with a hidden SSID (one more reason to not use hidden SSIDs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Auto-Join scans are specifically associated with Captive WiFi Networks and Public Hotspots.  This would include 802.11u/Hotspot 2.0/Passpoint networks, captive portal networks (Panera, Starbucks, etc.) and EAP-SIM networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my testing with iOS 9.x there was no difference in the structure of the Probe Request frames sent by the device.  Except in certain circumstances they are all sent to the Broadcast/Null SSID; you can't tell a Location Scan from a PNO Scan from an Auto-Join scan by looking at the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that most of this is from observation and packet captures using my own devices, not from Apple's documentation.&lt;/p&gt;&#xA;" OwnerUserId="24595" LastActivityDate="2016-04-15T14:47:23.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29603" PostTypeId="2" ParentId="29600" CreationDate="2016-04-15T16:20:41.710" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/8606-redist.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/8606-redist.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note: The mechanics of route redistribution is proprietary on Cisco&#xA;  routers. The rules for redistribution on a Cisco router dictate that&#xA;  the redistributed route be present in the routing table. It is not&#xA;  sufficient that the route be present in the routing topology or&#xA;  database.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="12149" LastEditorUserId="8499" LastEditDate="2016-04-15T16:42:17.623" LastActivityDate="2016-04-15T16:42:17.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29604" PostTypeId="2" ParentId="5489" CreationDate="2016-04-15T16:30:54.657" Score="2" Body="&lt;p&gt;I ran into an issue with these taking our whole network down.&#xA;6 Extreme Stacks, 3 HP switches various models and several atleast 8 of these netgear gs108's&#xA;Gs108T with no spanning tree turned on looped to itself and hooked to any switch except extreme switches with ELRP turned on will eventually take the whole network down.  It looks like a broadcast storm or multicast storm.  I had a laptop hooked up on a spanned/mirrored port and what you will see is that there are a lot of dup-acks and tcp retransmission packets going through the network for the equipment or pcs that are having issues. &#xA;My suggestion to see what its doing for yourself is to turn on mac-address tracking and watch what happens.  The netgear basically will become a network blackhole.  When I performed this experiment to figure out why I was seeing a loop and spanning tree was not taking care of it I found to my horror all the mac addresses on the network started moving from switch to switch finally to the netgear.  I found that ELRP could detect the loop so I turned that on to help prevent that from happening again.  This cost our company a lot of money in downtime and replacing a few switches along with a trip to Alaska for a week to troubleshoot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These switches were chosen to replace dumb netgear switches.  Think twice before deploying them in critical environments.  One person plugging one in without configuring it can take down the whole network.  BTW they come with spanning tree turned off on all the ports&lt;/p&gt;&#xA;" OwnerUserId="24597" LastActivityDate="2016-04-15T16:30:54.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29605" PostTypeId="2" ParentId="3808" CreationDate="2016-04-15T17:06:07.903" Score="5" Body="&lt;p&gt;I was able to resolve the issue. On the Kemp (with HA pair) you have the option of using a &quot;Virtual MAC Address&quot;. If this box isn't checked, then the MAC of a load balancer VIP is that of the physical interface of the active Kemp unit. If this box is checked, then the MAC address of the VIP is a VRRP MAC. As you mentioned above the VRRP RFC states that the MAC being &quot;00:00&quot;{blah} with the last octet being the Router ID. The default Kemp HA [router] ID is 01. On my Powerconnects using Firmware 5.1.x.x I'm not using VRRP but I ran some traces and determined that the Powerconnect will drop a VRRP frame if the router ID is the same as itself. They do this EVEN if VRRP isn't configured and in that mode they default to 01. So changing the Kemp HA router ID to something like 22 (0x16) resulted in everything working.&lt;/p&gt;&#xA;" OwnerUserId="24569" LastActivityDate="2016-04-15T17:06:07.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29606" PostTypeId="2" ParentId="29579" CreationDate="2016-04-15T17:08:14.870" Score="1" Body="&lt;p&gt;I posted this on the other thread but I resolved the problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to resolve the issue. On the Kemp (with HA pair) you have the option of using a &quot;Virtual MAC Address&quot;. If this box isn't checked, then the MAC of a load balancer VIP is that of the physical interface of the active Kemp unit. If this box is checked, then the MAC address of the VIP is a VRRP MAC. The VRRP RFC states that the MAC will be being &quot;00:00&quot;{blah} with the last octet being the Router ID eg &quot;:01&quot;. The default Kemp HA [router] ID is 01. On my PowerConnects using Firmware 5.1.x.x I'm not using VRRP but I ran some traces and determined that the PowerConnect will drop a VRRP frame if the router ID is the same as itself. They do this EVEN if VRRP isn't configured and in that mode they default to 01. So changing the Kemp HA router ID to something like 22 (0x16) resulted in everything working.&lt;/p&gt;&#xA;" OwnerUserId="24569" LastActivityDate="2016-04-15T17:08:14.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29611" PostTypeId="2" ParentId="28606" CreationDate="2016-04-15T20:54:26.993" Score="2" Body="&lt;p&gt;I had the same problem, and then I took a look at the example image they provided in their guide (here: &lt;a href=&quot;https://supportforums.cisco.com/document/51231/configuring-bmp-logo-spa303-and-spa50xg-ip-phones&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/document/51231/configuring-bmp-logo-spa303-and-spa50xg-ip-phones&lt;/a&gt;) by using identify.&#xA;Turns out their bmp is BMP version 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I re-encoded my image from a monochrome png using :&#xA;&quot;convert test.png -depth 1 -type Bilevel BMP3:test.bmp&quot;&#xA;and IT WORKED HALLELUJAH!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I feel like the 5 hours I wasted on that are completely justified.&#xA;Peace out.&lt;/p&gt;&#xA;" OwnerUserId="24605" LastActivityDate="2016-04-15T20:54:26.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29612" PostTypeId="1" AcceptedAnswerId="29716" CreationDate="2016-04-15T23:46:56.170" Score="2" ViewCount="268" Body="&lt;p&gt;I have a cisco 881 and a 6509 sup720 I have tried to configure both for pat but am having issues doing so. no translation traffic is generated. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;881 configuration&#xA;version 15.1&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname bdrrtr&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;no aaa new-model&#xA;!&#xA;service-module wlan-ap 0 bootimage autonomous&#xA;crypto pki token default removal timeout 0&#xA;!         &#xA;ip source-route&#xA;no ip routing&#xA;no ip cef&#xA;!&#xA;no ip domain lookup&#xA;no ipv6 cef&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA;!&#xA;interface FastEthernet1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface FastEthernet2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface FastEthernet3&#xA; no ip address&#xA;!&#xA;interface FastEthernet4&#xA; ip address 70.80.90.99 255.255.255.248&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; no ip route-cache&#xA; duplex full&#xA; speed auto&#xA; ipv6 dhcp client pd hint xxx&#xA; ipv6 dhcp client pd comcast&#xA;!&#xA;interface Wlan-GigabitEthernet0&#xA; description Internal switch interface connecting to the embedded AP&#xA; no ip address&#xA;!&#xA;interface wlan-ap0&#xA; description Embedded Service module interface to manage the embedded AP&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; ip address 10.1.0.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; no ip route-cache&#xA;!&#xA;ip default-gateway 70.80.90.100&#xA;ip forward-protocol nd&#xA;ip http server&#xA;ip nat inside source list 1 interface FastEthernet4 overload&#xA;ip route 0.0.0.0 0.0.0.0 FastEthernet4 70.80.90.100&#xA;!&#xA;access-list 1 permit 10.1.0.0 0.0.255.255&#xA;!&#xA;snmp-server community public RO&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line 2&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport input all&#xA; stopbits 1&#xA;line vty 0 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;isp is comcast buisness 5 static with netgear cg3000dcr modem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;fa/3 client plugged in client using ip 10.1.0.18 default gw 10.1.0.1&#xA;from the router I can ping 8.8.8.8 from the client I can ping 10.1.0.1 70.80.90.99 but not 70.80.90.100 or any external ip. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;show nat translations  is blank&lt;/p&gt;&#xA;&#xA;&lt;p&gt;from the 6509 i set up vlan99 with the external ip defaut route to that interface and same results. I do not have any routing protocols enabled yet on either. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bdrrtr#show spanning-tree vlan 1&#xA;&#xA;VLAN1 is executing the ieee compatible Spanning Tree protocol&#xA;Bridge Identifier has priority 32768, address xxx.xxx.xxx&#xA;Configured hello time 2, max age 20, forward delay 15&#xA;Current root has priority 32768, address xxx.xxx.xxx&#xA;Root port is 4 (FastEthernet3), cost of root path is 19&#xA; Topology change flag not set, detected flag not set&#xA; Number of topology changes 3 last change occurred 1w1d ago&#xA;      from FastEthernet0&#xA; Times:  hold 1, topology change 35, notification 2&#xA;      hello 2, max age 20, forward delay 15 &#xA; Timers: hello 0, topology change 0, notification 0, aging 300&#xA;&#xA;Port 1 (FastEthernet0) of VLAN1 is forwarding&#xA;  Port path cost 19, Port priority 128, Port Identifier 128.1.&#xA;  Designated root has priority 32768, address xxx.xxx.xxx&#xA;  Designated bridge has priority 32768, address xxx.xxx.xxx&#xA;  Designated port id is 128.1, designated path cost 19&#xA;  Timers: message age 0, forward delay 0, hold 0&#xA;  Number of transitions to forwarding state: 1&#xA;  BPDU: sent 349073, received 0&#xA;&#xA;Port 4 (FastEthernet3) of VLAN1 is forwarding&#xA;  Port path cost 19, Port priority 128, Port Identifier 128.4.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Fa3 is plugged in to the 6509 and fa0 is plugged in to the laptop. &lt;/p&gt;&#xA;" OwnerUserId="4646" LastEditorUserId="4646" LastEditDate="2016-04-19T02:50:08.807" LastActivityDate="2016-04-19T12:13:38.233" Title="Lab cisco Pat not creating any translations" Tags="|nat|lab|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="29613" PostTypeId="1" AcceptedAnswerId="29619" CreationDate="2016-04-16T00:39:05.427" Score="3" ViewCount="1024" Body="&lt;p&gt;I'm reading about TCP-CUBIC and I found this phrases:&lt;/p&gt;&#xA;&lt;p&gt;CUBIC runs in three different modes (Ha, 2008):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If cwnd is less than the window size that (standard) TCP would reach at time t after the last loss event, then CUBIC is in the &lt;strong&gt;TCP mode&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If cwnd is less than Wmax, then CUBIC is in the concave region.&lt;/p&gt;&#xA;&lt;p&gt;If cwnd is larger than Wmax, CUBIC is in the convex region.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;What exacly means CUBIC is running in TCP Mode? This is the &amp;quot;balance point&amp;quot;? It is the point where the window is exactly in the middle between the concavely and convexly?&lt;/p&gt;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24252" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-05-05T06:44:50.510" Title="TCP-CUBIC: What's TCP Mode?" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29616" PostTypeId="1" AcceptedAnswerId="29617" CreationDate="2016-04-16T02:49:24.667" Score="0" ViewCount="728" Body="&lt;p&gt;I've been reading about a VLANS for a while, couple of times. And I believe I just can't get a catch at something.. Or maybe missunderstand some part, because I can't get it working the way I want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would really appreciate some help, cause I believe the best way to learn things is by trying, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have been setting up this home LAB for playing around. The setup is below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router TP-LINK WDR3600 with dd-wrt.&#xA;The interfaces on the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ath0 - Wi-Fi interface, running in client mode to connect to gateway&#xA;ath0.1 - AP mode. SSID#1 192.168.0.0/24 network&#xA;ath0.2 - AP mode. SSID#2 10.100.10.0/24 network&#xA;ath1 - AP mode used to bridge another AP to 192.168.0.0/24&#xA;vlan1 - ethernet ports (dd-wrt default)&#xA;vlan2 - WAN port (dd-wrt default).&#xA;vlan30 - the VLAN created by me in order to seperate two ports from vlan2.&#xA;br0 - containing ath0, ath0.1, ath1, vlan1, vlan2&#xA;br1 - containing ath0.2, vlan30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;DHCP configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;br0 - 192.168.0.0 network&#xA;br1 - 10.100.10.0 network&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VLAN port assignment on the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LAN 1:&#xA;    vid: 1&#xA;    ports: 0t 3 4 5 &#xA;VLAN 2:&#xA;    vid: 2&#xA;    ports: 0t 1 &#xA;VLAN 30:&#xA;    vid: 30&#xA;    ports: 0t 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Explanation: 0 is CPU, 1 is WAN, 2-5 are the other ethernet ports on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So at first my goal was to simply make a separate subnet, so I created &lt;code&gt;SSID#2 on ath0.2.&lt;/code&gt; I wanted to add my Hyper-V server (connected on the ethernet port) to that subnet, so I created additional vlan30 and assigned &lt;code&gt;port 2  to VLAN30&lt;/code&gt;. &#xA;Then I created &lt;code&gt;br1(ath0.2(SSID#), vlan30)&lt;/code&gt; so that I could reach that Hyper-V server from SSID#2. Everything is working as expected.&#xA;Great it was finally working!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the tricky part comes in. I have another cable attached to the router and the smart switch at the end of it. I have some devices connected there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to add some of these devices to the VLAN1 and some to the VLAN30.&#xA;So I changed my router VLAN port membership to as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LAN 1:&#xA;    vid: 1&#xA;    ports: 0t 3 4 5 &#xA;VLAN 2:&#xA;    vid: 2&#xA;    ports: 0t 1 &#xA;VLAN 30:&#xA;    vid: 30&#xA;    ports: 0t 2 3t&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(An uplink to a switch is port 3)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And changed the port membership of the switch to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN 1:&#xA;    vid: 1&#xA;    ports: 1u x 3u 4u 5u 6u 7u 8u &#xA;VLAN 30:&#xA;    vid: 30&#xA;    ports: 1t 2u x  x  x  x  x  x &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(the uplink to a router is on port 1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This is what I want to achieve:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;So I was hoping, that when I plug a device to port 2 on the switch, it would get an IP from 10.100.10.0, when I plug it to any other port it would get an IP from 192.168.0.0.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can get an IP from 192.168.0.0 but not from the 10.100.10.0. I believe I am surely missing something about t/u and trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understood, to have trunk port you can use default switches vlan with untaged port. I want it, so that I could setup more vlans using single cable from router to switch. At least I think that I need to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies if the question seems too long, just wanted to give all the information I could.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit#1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have confirmed that I successfully setup VLAN30 on the first side (the router). Everything was working. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other end lays a NETGEAR switch. &#xA;On the netgear docs, I read that a way to setup trunk is basically leaving the port untagged to the default VLAN on the switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I basically want to ask this am I correct thinking that, with the following setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SWITCH 1:&#xA;VLAN1: 3u 4u 5u&#xA;VLAN30: 2u 3t&#xA;&#xA;SWITCH2&#xA;VLAN1: 1u 3u 4u 5u 6u 7u 8u (port1 should become trunk according to NETGEAR docs)&#xA;VLAN30: 1t 2u &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would be able to reach VLAN30 on SWICTH2 port2? And VLAN1 on ports 3,4,5,6,7,8?&lt;/p&gt;&#xA;" OwnerUserId="24610" LastEditorUserId="24610" LastEditDate="2016-04-16T04:51:31.533" LastActivityDate="2016-04-16T04:51:31.533" Title="VLAN trunk (noob question)" Tags="|vlan|" AnswerCount="1" CommentCount="3" ClosedDate="2016-04-16T17:18:45.630" ContentLicense="CC BY-SA 3.0" />
  <row Id="29617" PostTypeId="2" ParentId="29616" CreationDate="2016-04-16T03:50:31.183" Score="0" Body="&lt;p&gt;It's almost always the case that you've missed a connection required for the basic services - folks forget that a VLAN really is a separate network, and needs every service either directly set up on it (simplest) or via a &quot;helper&quot; route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not clear that you ever got VLAN30 set up and working correctly in the first switch, which you should certainly do before worrying about getting it working on another switch. Also check to see if a manually set address in the VLAN30 range works on the port that is VLAN30 before you get too wound up about the DHCP working - step by step verification is key when figuring out WHERE the holes in a VLAN setup are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without knowing the particular terminology of your switch/router I'm wondering if you needed to define something like &quot;ath0.30&quot; to access/provide services to the tagged VLAN30. But I'm also finding your question a bit muddy to wade through exactly what you have done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tagged, untagged and trunk are related in that VLANS on a trunk are tagged; depending on the exact era and VLAN setup of the switch that works in various ways. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have some switches that only have &quot;trunk&quot; and &quot;device&quot; as options -&#xA;everyting on a &quot;trunk&quot; port is tagged, and a trunk port can be a&#xA;member of several VLANs. Nothing on a Device port is tagged, and it&#xA;can only be a member of one VLAN. That is an older switch model.&lt;/li&gt;&#xA;&lt;li&gt;More recent ones have &quot;tagged&quot; and &quot;untagged&quot; and can have both&#xA;tagged and untagged traffic on the same port, and each port has an&#xA;assigned PVID - the VLAN to which untagged incoming traffic is&#xA;assigned. Typically tagged traffic matching the PVID is untagged as it leaves the port, though that may be a setting that can be changed, depending on the switch.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-04-16T03:50:31.183" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29619" PostTypeId="2" ParentId="29613" CreationDate="2016-04-16T05:14:46.910" Score="3" Body="&lt;p&gt;Cubic functions can have both convex and concave portions, meaning that they can grow more slowly in some portions(concave) and more quickly in others(convex). In addition to that CUBIC also has a TCP friendly region that operates when window is small to ensure that CUBIC is not penalized relative to regular TCP. More specifically, the window size of standard TCP in terms of time elapsed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jQKfg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jQKfg.png&quot; alt=&quot;BIC and CUBIC comaprison&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-04-16T05:14:46.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29621" PostTypeId="1" AcceptedAnswerId="29668" CreationDate="2016-04-16T09:41:03.127" Score="0" ViewCount="483" Body="&lt;p&gt;I have been trying to understand the mechanism of static routing. I connected two of 2621XM routers forming their networks on different subnets but unfortunately even though I am doing static routing commands properly the connection is not being established for some reason. I am pinging PC1 with router 2 but its not working. Is says timed out.&#xA;Network 1 is 192.168.10.0/25 which is left side of router 1.&#xA;Network 2 is 192.168.10.0/29 which is on right of router 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Aw0l4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Aw0l4.jpg&quot; alt=&quot;The connection is as following&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/open?id=0B9H4l69kKWweRUNoTVZVX0FQM1E&quot; rel=&quot;nofollow noreferrer&quot;&gt;Due to link restriction I have uploaded complete configuration properly at this google drive link.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24613" LastEditorUserId="24613" LastEditDate="2016-04-16T13:00:16.797" LastActivityDate="2017-08-12T08:37:35.490" Title="Static Routing Or Connecting 2621XM routers" Tags="|cisco|routing|router|cisco-ios|ping|" AnswerCount="3" CommentCount="6" ClosedDate="2019-01-31T23:08:40.977" ContentLicense="CC BY-SA 3.0" />
  <row Id="29622" PostTypeId="1" AcceptedAnswerId="30493" CreationDate="2016-04-16T12:27:27.263" Score="5" ViewCount="1357" Body="&lt;p&gt;For a long time, I have this kind of silly question: How we can say some network protocols are working in X layer of the OSI model?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, HTTP working in L7 of OSI, OSPF is L3, ICMP is L4, TCP and UDP are L4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone suggest how I can understand easily?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;since we can say BGP is a routing protocol, but it is using TCP for L4 as a transport protocol. So, is BGP L3 or L4?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RIP is a L3 protocol, but it is using UDP for transport.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DHCP uses both UDP and BOOTP header, so in which layer is DHCP working?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kindly give me your suggestion to understand better.&lt;/p&gt;&#xA;" OwnerUserId="3415" LastEditorUserId="8499" LastEditDate="2016-04-17T01:07:27.137" LastActivityDate="2016-05-31T17:44:24.197" Title="How we can assume which network protocol is working in which OSI Layer?" Tags="|bgp|dhcp|protocol-theory|osi|rip|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29623" PostTypeId="1" AcceptedAnswerId="29626" CreationDate="2016-04-16T12:35:03.810" Score="1" ViewCount="1620" Body="&lt;p&gt;When I try the &lt;code&gt;sh mac address-table int gi 1/0/19&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh mac address-table int gi 1/0/19&#xA;          Mac Address Table&#xA; -------------------------------------------&#xA;&#xA;Vlan    Mac Address       Type        Ports&#xA;----    -----------       --------    -----&#xA;  20    38ed.1855.ed28    DYNAMIC     Gi1/0/19&#xA;  30    38ed.1855.ed28    DYNAMIC     Gi1/0/19&#xA;Total Mac Addresses for this criterion: 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I connected an IP phone on VLAN 30 and a PC on VLAN 20. The switch is a Cisco 2960 48-port, IOS version 15.0(2a)EX5.&lt;/p&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="8499" LastEditDate="2016-04-17T01:08:29.923" LastActivityDate="2016-04-17T01:08:29.923" Title="MAC address table showing the same MAC address on one port" Tags="|cisco|switch|port-security|mac|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29624" PostTypeId="1" AcceptedAnswerId="29627" CreationDate="2016-04-16T13:05:09.497" Score="1" ViewCount="80" Body="&lt;p&gt;I am setting up our small office of around 30 users, divided into 2 rooms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plan A:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1x Router&lt;/li&gt;&#xA;&lt;li&gt;1x 48-port smart switch&lt;/li&gt;&#xA;&lt;li&gt;2x Wi-Fi APs&lt;/li&gt;&#xA;&lt;li&gt;Room A (10m x 7m) has developers which need 1Gbps link, 17 Users. &#xA;So, 20 LAN ports, 1 wireless AP (less than 5 users).&lt;/li&gt;&#xA;&lt;li&gt;Room B (5m x 7m) has developers which need 1Gbps link, 13 Users.  So,&#xA;16 LAN ports, 1 wireless AP (less than 5 users).&lt;/li&gt;&#xA;&lt;li&gt;All the users get wired to the 48 port switch, and I end up running 17&#xA;cables into the second room (running 17 cables of 20m would be&#xA;approximately 350m of cabling).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Plan B:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1x Router&lt;/li&gt;&#xA;&lt;li&gt;1x 48-port smart switch&lt;/li&gt;&#xA;&lt;li&gt;1x 24-port unmanaged switch&lt;/li&gt;&#xA;&lt;li&gt;2x Wi-Fi APs&lt;/li&gt;&#xA;&lt;li&gt;Room A users and AP get connected to the smart switch. Room B users&#xA;and AP get connected to the 24-port unmanaged switch, and we connect&#xA;the 24-port switch to the smart switch. I end up using less wire here&#xA;(one wire of 25m), but my link from Room A to Room B suffers because&#xA;of a bottleneck if 3-4 users are transferring data between Room A and&#xA;Room B.&lt;/li&gt;&#xA;&lt;li&gt;Is there a way to connect Switch A to Switch B with a higher&#xA;bandwidth line (maybe more than 1Gbps)? I know I cannot connect 2x&#xA;lines from Switch A to Switch B. Is there any way around it?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13382" LastEditorUserId="8499" LastEditDate="2016-04-17T01:00:04.940" LastActivityDate="2016-04-17T01:00:04.940" Title="All to one vs Many to Many" Tags="|switch|lan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29625" PostTypeId="2" ParentId="29622" CreationDate="2016-04-16T13:14:13.463" Score="0" Body="&lt;p&gt;The OSI model is just a model, one of many, and it reflects an ideal. The real world doesn't fit so neatly into the models, and there is much controversy about which protocols operate in which layers of the OSI model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSes have never really adopted the OSI model. Application programmers tend to lump those layers 5, 6, and 7 into the application because OSes don't provide the separate services. If you think about it, web browser applications use all three of those layers: session, presentation, and application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to routing protocols, you can distinguish the routing part from the communication part. Routing happens at layer-3 because packets are switched based on the layer-3 protocol (IPv4, IPX, IPv6, etc.) address. The communication between instances of a routing protocol on separate routers can conceptually be an application-to-application function. BGP uses TCP for this, but other routing protocols use other protocols to communicate. You could say that BGP routes at layer-3 and transfers prefixes using layer-4.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-16T13:14:13.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29626" PostTypeId="2" ParentId="29623" CreationDate="2016-04-16T13:33:58.620" Score="2" Body="&lt;p&gt;Your Cisco VoIP phone is also a switch which negotiates a trunk link with the switch to which it connects. It shows up on both VLANs because it is on both VLANs. This is normal behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the reason you need to be careful when configuring port security on your switch. You would probably need to allow three connections, two for the phone, and one for the PC connected to the phone.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-16T13:33:58.620" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29627" PostTypeId="2" ParentId="29624" CreationDate="2016-04-16T14:00:37.753" Score="1" Body="&lt;p&gt;You can only connect switch ports at the lowest common speed between the connected ports. Some switches can bond multiple ports to look like a single link, but unmanaged switches can't be configured that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typical users are not using the full bandwidth all the time. Cisco recommends a 20:1 access to uplink bandwidth ratio for access switches. For every 20 access ports at 1 Gb, you need 1 Gb in the uplink. &lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-16T14:00:37.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29629" PostTypeId="1" CreationDate="2016-04-16T15:11:20.843" Score="3" ViewCount="8310" Body="&lt;p&gt;We have a Dell stack switch (running RSTP) connected with a couple of Cisco switches (running PVST), and recently, something happened. I'm not sure where, but in our network, we started getting packet loss. Our network is big; it distributes to different, remote locations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea who configured switches etc. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it possible for RSTP and PVST to work together?&lt;/li&gt;&#xA;&lt;li&gt;Does it require any special configuration?&lt;/li&gt;&#xA;&lt;li&gt;In the core switch, I am sometimes seeing 'PortFast' Link UP and DOWN on the console. Is it because of spanning tree? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2016-04-17T00:54:49.463" LastActivityDate="2016-10-14T21:16:17.950" Title="RSTP and PVST mix in switch fabric" Tags="|cisco|spanning-tree|packet-loss|dell|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29630" PostTypeId="1" CreationDate="2016-04-16T15:54:19.350" Score="1" ViewCount="158" Body="&lt;p&gt;I know this is a repeated question here, but I cant find any previous threads discussing the headers. Is my understanding of this correct? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the scenario. Two hosts on different networks connected to a router &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host A&#xA;10.1.1.1/24 (MAC: AAAA.AAAA.AAAA)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host B&#xA;10.2.2.2/24 (MAC: BBBB.BBBB.BBBB)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my understanding of when host A pings host B.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Host A pings Host B&lt;/li&gt;&#xA;&lt;li&gt;Host A first looks at Host B IP, performs the calculation in relation to its own subnet mask, it realizes its on a different network.&lt;/li&gt;&#xA;&lt;li&gt;Host A knows to send it to its default gateway.&lt;/li&gt;&#xA;&lt;li&gt;Since ping must be encapsulated, Host A creates an IP header with the+ source of itself (10.1.1.1) and destination of Host B (10.2.2.2).&lt;/li&gt;&#xA;&lt;li&gt;Ping then floats down the TCP/IP model, and now must build a Ethernet frame header. &lt;/li&gt;&#xA;&lt;li&gt;It plugs in itself as the source mac (AAAA.AAAA.AAAA) but it does not know the gateway's MAC. So it broadcast out FFFF.FFFF.FFFF.&lt;/li&gt;&#xA;&lt;li&gt;The router replies with a unicast of it's gateway mac&lt;/li&gt;&#xA;&lt;li&gt;Host A plugs in the router's gateway mac into the Ethernet frame header. And off goes the packet.&lt;/li&gt;&#xA;&lt;li&gt;The router then strips the layer 2, and sends the packet to host B.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="24618" LastActivityDate="2016-04-16T17:53:02.460" Title="ARP 101, Two Hosts Different Networks" Tags="|routing|arp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29633" PostTypeId="2" ParentId="29630" CreationDate="2016-04-16T17:45:18.417" Score="1" Body="&lt;p&gt;yes, that process is correct. Regarding the step &quot;It plugs in itself as the source mac (AAAA.AAAA.AAAA) but it does not know the gateway's MAC. So it broadcast out FFFF.FFFF.FFFF.&quot; Keep in mind that host A will first check it's ARP table to check whether the Routers MAC is already present in the arp table.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same when the router receives the packet / frame it will check for Layer 2 addressing next Layer 3 addressing. In case of a multiaccess network like Ethernet the router will next check it's own ARP table to check whether it knows Host B's MAC. If not it will perform an ARP lookup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adam &lt;/p&gt;&#xA;" OwnerUserId="24620" LastEditorUserId="24620" LastEditDate="2016-04-16T17:53:02.460" LastActivityDate="2016-04-16T17:53:02.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29634" PostTypeId="1" AcceptedAnswerId="29636" CreationDate="2016-04-16T21:27:01.370" Score="5" ViewCount="842" Body="&lt;p&gt;Two companies wants to exchange some private prefixes (4K prefixes) using eBGP.&#xA;Each company will have two border routers (with OSPF as IGP, and mutual redistribution &amp;amp; aggregate in eBGP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, this is a dual-homed design between the two companies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you advise to run iBGP between the two border routers inside each company, or stick with only an IGP between them? Is there any best practice in this case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK, iBGP would be good if I'm redistributing a huge amount of prefixes (INET table), but I couldn't see any other real benefits for this case.&lt;/p&gt;&#xA;" OwnerUserId="12149" LastEditorUserId="8499" LastEditDate="2019-01-05T00:02:55.090" LastActivityDate="2019-01-05T00:02:55.090" Title="Is there benefit to iBGP peering between CEs in a BGP dual-homed design?" Tags="|cisco|routing|bgp|design|dual-homed|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29635" PostTypeId="2" ParentId="29629" CreationDate="2016-04-16T21:50:19.853" Score="1" Body="&lt;p&gt;It is possible to mix PVST and MST (RSTP requires MST), but it needs some planning, and it can be fragile, as you have discovered. You would probably be better off using the same STP version across all your switches. You could change the STP on the Cisco  switches to match the rest of the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has several documents about how to interoperate with non-Cisco switches (e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24248-147.html&quot; rel=&quot;nofollow&quot;&gt;Understanding Multiple Spanning Tree Protocol&lt;/a&gt;), or how to convert the Cisco switches to MST (e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/72844-MST.html&quot; rel=&quot;nofollow&quot;&gt;Configuration example to migrate Spanning Tree from PVST+ to MST&lt;/a&gt;). There are also a lot of other documents about this subject, which you will find if you do a Google search.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-16T21:50:19.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29636" PostTypeId="2" ParentId="29634" CreationDate="2016-04-16T22:07:34.460" Score="2" Body="&lt;p&gt;&lt;em&gt;Disclaimer: This all really depends on information you haven't provided, and there could be circumstances which dictate you do it differently, e.g. you only want to advertise some internal routes through one border router, and some through another.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you run iBGP between the two border routers, you avoid redistribution problems, which could cause routing loops. The two border routers would be able to directly exchange BGP prefixes without the fear of creating routing loops because of the iBGP rule about not advertising prefixes which were learned through iBGP to another iBGP speaker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you only run an IGP between them, you must redistribute BGP prefixes into the IGP, and vice versa, in both directions, and, without careful planning and configuration, you could re-advertise the same prefixes back to the source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's really just easier and safer to use iBGP between the border routers to advertise prefixes learned through eBGP. If you have more than two border routers, you need to remember that iBGP requires a full mesh between the iBGP speakers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-16T22:07:34.460" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29638" PostTypeId="2" ParentId="29629" CreationDate="2016-04-16T23:19:41.223" Score="1" Body="&lt;p&gt;In this scenario, theory is a thing and real world is other. I have faced this same enviroment with Dell-Force10 (OS9) and Cisco switches several times. We have no problem with STP and PVST but we have strange behaviour when we mix RSTP and PVST+. My &quot;solution&quot; for this case is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Do you need a single STP instance? Use slow and classical STP and PVST. &lt;/li&gt;&#xA;&lt;li&gt;Can you keep two separate instances of STP? Use RSTP and PVST+ and deactive STP in interconnection links.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Good luck with troubleshoting if you still want to mix rapid versions because it's a headache. &lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2016-04-16T23:19:41.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29640" PostTypeId="2" ParentId="29622" CreationDate="2016-04-17T05:16:33.257" Score="0" Body="&lt;p&gt;Protocols within a suite are defined with a specific purpose in order to make the design and operation easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These protocols inside the protocol stack communicate with other layers based on either type of media( bits, frames, packets, segments etc ) or transport ( TCP or UDP ) or the kind of desired application ( this is dependent on the software implementation, but it might require use of additional suites like IPsec ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can always tell which protocol works on which layer, if knowing that the protocol conforms the purpose of that particular layer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g TCP works at the Transport layer because although it complements the function of IP, it provides a method of transportation between two hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps :)&lt;/p&gt;&#xA;" OwnerUserId="8544" LastActivityDate="2016-04-17T05:16:33.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29641" PostTypeId="1" AcceptedAnswerId="29643" CreationDate="2016-04-17T06:34:21.433" Score="3" ViewCount="3197" Body="&lt;p&gt;Here is some information about my situation. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All firewalls have been turned off and everything involved has been&#xA;restarted multiple times. &lt;/li&gt;&#xA;&lt;li&gt;Client isolation on the router is disabled by default, the router is using factory DD WRT settings.&lt;/li&gt;&#xA;&lt;li&gt;Both computers are setup to connect to an 802.1x (school) network that uses certificates for authentication. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When I go into the DD WRT page, I can see that it has assigned two local IP addresses to both of my devices on the LAN. I wish to ping one device from another device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Heres what happens when I do the following things:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ping &amp;lt; ip of other computer &gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;request timeout for icmp_seq 0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To my understanding this means a route to the destination was found, but it did not respond in a certain amount of time. Good job router! but why is there no response? I am 99% sure that my firewall is off, and that I am not running any antivirus software at the moment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;plowing along&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;arp &amp;lt; ip of other computer &gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&amp;lt; correct hostname! &gt; &amp;lt; ip of other computer &gt; at (incomplete) on en5 ifscope [ethernet]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ok so my computer resolved the hostname but could not resolve the targets mac address. Am I correct in thinking that this should have resolved the mac address? Otherwise that would mean that my computers are on two different OSI level 2 networks even though they are plugged into the same router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does any of this make any sense? Networking is still pretty new to me, I really don't know what else I should try at this point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also links to articles that might help my understanding are welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="24631" LastActivityDate="2016-04-17T09:07:19.570" Title="Why can't two computers connected to the same DD WRT router ping eachother?" Tags="|router|lan|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ClosedDate="2016-04-17T10:44:06.120" ContentLicense="CC BY-SA 3.0" />
  <row Id="29643" PostTypeId="2" ParentId="29641" CreationDate="2016-04-17T08:47:24.257" Score="2" Body="&lt;p&gt;&quot;Ok so my computer resolved the hostname but could not resolve the targets mac address. Am I correct in thinking that this should have resolved the mac address? Otherwise that would mean that my computers are on two different OSI level 2 networks even though they are plugged into the same router.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP is used to map Layer 3 to Layer 2 addresses. If both computers are ondifferent networks, the host on network A  wishing to communicate with the host on network B will need to know the MAC of the interface on the router facing the network A (default gateway), of course assuming you did the ARP test from one of the computers. You should be able to check on the router in it's ARP table whether it has all the L3 to L2 mappings. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the dd-wrt version? Have a look at:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://svn.dd-wrt.com/ticket/3736&quot; rel=&quot;nofollow&quot;&gt;http://svn.dd-wrt.com/ticket/3736&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adam &lt;/p&gt;&#xA;" OwnerUserId="24620" LastEditorUserId="24620" LastEditDate="2016-04-17T09:07:19.570" LastActivityDate="2016-04-17T09:07:19.570" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29645" PostTypeId="1" AcceptedAnswerId="29672" CreationDate="2016-04-17T11:02:24.533" Score="1" ViewCount="11261" Body="&lt;p&gt;How can I allow my laptop MAC address on every port with port security? Is it even possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try, I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW2(config-if)#switchport port-security mac-address XXXX.XXXX.XXXX&#xA;Found duplicate mac-address XXXX.XXXX.XXXX.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="8499" LastEditDate="2016-04-17T14:00:54.993" LastActivityDate="2016-10-11T17:26:56.017" Title="How can I allow the same MAC address on different ports with port security?" Tags="|cisco|switch|security|mac-address|port-security|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29648" PostTypeId="2" ParentId="29645" CreationDate="2016-04-17T13:58:47.123" Score="1" Body="&lt;p&gt;That defeats the purpose of one aspect of port security: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;If traffic with a secure MAC address that is configured or learned on one secure port attempts to access another secure port in the same&#xA;  VLAN, applies the configured violation mode.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The MAC address table of the switch will only allow a single MAC address on a single port so that it knows, in a deterministic manner, to which port it should send traffic with that destination address. MAC address spoofing is an attack which will cause disruption by bouncing the MAC address table among two or more ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This aspect of port security prevents that from happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port security can be used without specifying exact MAC addresses. A port can dynamically learn a MAC address, and keep it on that port for a specified time period.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has documents which explain port security in detail, e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/port_sec.html&quot; rel=&quot;nofollow&quot;&gt;Chapter: Port Security&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Port Security with Dynamically Learned and Static MAC Addresses&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can use port security with dynamically learned and static MAC&#xA;  addresses to restrict a port's ingress traffic by limiting the MAC&#xA;  addresses that are allowed to send traffic into the port. When you&#xA;  assign secure MAC addresses to a secure port, the port does not&#xA;  forward ingress traffic that has source addresses outside the group of&#xA;  defined addresses. If you limit the number of secure MAC addresses to&#xA;  one and assign a single secure MAC address, the device attached to&#xA;  that port has the full bandwidth of the port.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A security violation occurs in either of these situations:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;When the maximum number of secure MAC addresses is reached on a secure port and the source MAC address of the ingress traffic is &#xA;  different from any of the identified secure MAC addresses, port &#xA;  security applies the configured violation mode.&lt;/li&gt;&#xA;  &lt;li&gt;If traffic with a secure MAC address that is configured or learned on one secure port attempts to access another secure port in the&#xA;  same VLAN, applies the configured violation mode.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt; After a secure MAC address is configured or learned on one secure port, the sequence of events that occurs when port security&#xA;  detects that secure MAC address on a different port in the same VLAN&#xA;  is known as a MAC move violation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;See the &quot;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/port_sec.html#wp1055296&quot; rel=&quot;nofollow&quot;&gt;Configuring the Port Security Violation Mode on a Port&lt;/a&gt;&quot;&#xA;  section for more information about the violation modes.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;After you have set the maximum number of secure MAC addresses on a&#xA;  port, port security includes the secure addresses in the address table&#xA;  in one of these ways:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;You can statically configure all secure MAC addresses by using the &lt;strong&gt;switchport port-security mac-address&lt;/strong&gt; &lt;em&gt;mac_address&lt;/em&gt; interface configuration command.&lt;/li&gt;&#xA;  &lt;li&gt;You can allow the port to dynamically configure secure MAC addresses with the MAC addresses of connected devices.&lt;/li&gt;&#xA;  &lt;li&gt;You can statically configure a number of addresses and allow the rest to be dynamically configured.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;If the port has a link-down condition, all dynamically learned&#xA;  addresses are removed.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Following bootup, a reload, or a link-down condition, port security&#xA;  does not populate the address table with dynamically learned MAC&#xA;  addresses until the port receives ingress traffic.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A security violation occurs if the maximum number of secure MAC&#xA;  addresses have been added to the address table and the port receives&#xA;  traffic from a MAC address that is not in the address table.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can configure the port for one of three violation modes: protect,&#xA;  restrict, or shutdown. See the &quot;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/port_sec.html#wp1103004&quot; rel=&quot;nofollow&quot;&gt;Configuring Port Security&lt;/a&gt;&quot;&#xA;  section.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To ensure that an attached device has the full bandwidth of the port,&#xA;  set the maximum number of addresses to one and configure the MAC&#xA;  address of the attached device.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-17T15:27:17.403" LastActivityDate="2016-04-17T15:27:17.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29650" PostTypeId="1" CreationDate="2016-04-17T14:25:03.960" Score="1" ViewCount="1567" Body="&lt;p&gt;I have two Cisco switches in the same VLAN, physically connected to each other.  One of the switches is a 3650, and the other is a 4948. On the 3650, I can see MAC flapping messages between 2 ports, one of which is the port that has the cable that goes to the other switch.  On the 4948, I don't see any MAC flapping messages despite the fact that I have seen the same MAC address on the port that goes to the 3650, and on another port on this switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is this happening and how can I fix it so that I also see MAC flapping messages on the 4948?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following logging configuration:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;logging buffered informational &lt;/li&gt;&#xA;&lt;li&gt;logging buffered 64000 &lt;/li&gt;&#xA;&lt;li&gt;logging event link-status global&lt;/li&gt;&#xA;&lt;li&gt;logging event link-status (configured under each physical interface, since the global configuration didn't seem to be working)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6dh3o.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6dh3o.png&quot; alt=&quot;Diagram..&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4547" LastEditorUserId="8499" LastEditDate="2020-02-09T20:59:11.827" LastActivityDate="2020-02-09T20:59:11.827" Title="Cisco switch not showing MAC flapping messages" Tags="|cisco|switch|switching|mac-address|switchport|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29651" PostTypeId="2" ParentId="29650" CreationDate="2016-04-17T14:32:27.500" Score="1" Body="&lt;p&gt;You probably don't have MAC flapping on the 4948. MAC flapping is where traffic from a MAC address is originated on more than one port in a short period of time. It seems to be happening on the 3650, but not happening on the 4948. This is specific to the switch, and the error will not be sent to other network devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That it is happening on one switch, but not the other, is a clue to help you troubleshoot where the problem may lie. This is probably caused by a layer-2 loop. You should investigate how the switches are connected, both directly and indirectly. There may be an STP misconfiguration on how the ports showing the MAC address are connected. This may be caused by someone plugging in a hub or dumb switch into multiple ports. Unfortunately, you may need physically check things out. Using portfast with BPDU guard on access ports may prevent this situation.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-17T15:24:08.090" LastActivityDate="2016-04-17T15:24:08.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29654" PostTypeId="1" CreationDate="2016-04-17T18:05:18.887" Score="1" ViewCount="45" Body="&lt;p&gt;If I want to send a frame of 1kb size to a destination, and the frame has to go through other devices such as routers, bridges, hubs and other computers, how will the physical addresses of the sender and receiver change on the frame through  the road it reaches the destination?&lt;/p&gt;&#xA;" OwnerUserId="24564" LastActivityDate="2016-04-17T18:17:56.430" Title="Physical Adresses on a frame." Tags="|cisco|ethernet|mac-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29655" PostTypeId="2" ParentId="29654" CreationDate="2016-04-17T18:17:56.430" Score="1" Body="&lt;p&gt;Frames will not cross layer-3 boundaries (routers). The layer-2 addresses will remain unchanged on the layer-2 domain, but the frame will be stripped when it encounters a layer-3 device.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-17T18:17:56.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29660" PostTypeId="1" AcceptedAnswerId="29662" CreationDate="2016-04-18T01:35:21.667" Score="3" ViewCount="1963" Body="&lt;p&gt;I am confused by the terms Bisection Bandwidth, Full Bisection Bandwidth, and (Over/Under)-subscription. How do they all relate to one another in Data centres and in the general sense?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe providing a clos fat tree toplogy example in this context would be really helpful in understanding and will be greatly appreciated. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="4094" LastActivityDate="2016-04-18T02:42:43.153" Title="Significance of Bisection Bandwidth, Full Bisection Bandwidth, Subscription and their differences" Tags="|bandwidth|terminology|oversubscription|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29662" PostTypeId="2" ParentId="29660" CreationDate="2016-04-18T01:55:21.040" Score="5" Body="&lt;p&gt;It's not really all that difficult. When you bisect a network, such as a data center, the bisection bandwidth is the bandwidth usable to get from one side of the bisection to the other, possibly asymmetric values, depending on the topology. There may be links between the two sides which are unavailable for use due to things like STP blocking, and they don't count.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One definition of full bandwidth would be a 1:1 ratio between the aggregate bandwidth which the hosts in one section have to the available bandwidth between the two sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another definition of full bandwidth is that there is no unavailable bandwidth between the two sections, regardless of the subscription ratio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Over-subscription is where the aggregate bandwidth of the hosts in one section is greater than the available bandwidth to the other section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under-subscription is where the aggregate bandwidth of the hosts in one section is less than the available bandwidth to the other section.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, you would have full bandwidth between any two sections, no matter how you bisect the network. Practically, this is often not feasible, due to things like cost. Studies have been done on what level of over-subscription is acceptable at various points in a network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-18T02:42:43.153" LastActivityDate="2016-04-18T02:42:43.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29665" PostTypeId="1" AcceptedAnswerId="76150" CreationDate="2016-04-18T05:08:42.937" Score="3" ViewCount="3988" Body="&lt;p&gt;According to my textbook, with TDM, each circuit gets all of the bandwidth periodically during brief intervals of time (that is, during slots).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we have a circuit switched network where each link uses TDM with 24 slots and has a bit rate of 1.536 Mbps. Also suppose we have to send a file of 640,000 bits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How come we divide the bit rate (bandwidth) by 24? I thought each slot gets the full 1.536 Mbps?&lt;/p&gt;&#xA;" OwnerUserId="22754" LastActivityDate="2021-09-08T20:11:00.027" Title="Time Division Multiplexing and Transmission Rate" Tags="|bandwidth|tdmoe|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29666" PostTypeId="2" ParentId="29665" CreationDate="2016-04-18T06:23:22.157" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;According to my textbook, with TDM, each circuit gets all of the bandwidth periodically during brief intervals of time (that is, during slots).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, that's correct.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If we have a circuit switched network where each link uses TDM with 24 slots and has a bit rate of 1.536 Mbps.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's typical for T1 line, in which line is made from 24 DS0 64kbit/s channels. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How come we divide the bit rate (bandwidth) by 24? I thought each slot gets the full 1.536 Mbps?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, the line would be then 24x1.5Mbit/s, not 1.5Mbit/s. The whole idea of TDM is that you take a line, clocked appropriately (for T1 it's usually Stratum 3 class clock), to fit a defined number of DS0 channels. Your specific service can get one DS0 (64kbit/s), two (128kbit/s), three (192kbit/s) - and up to full bandwidth of the link (1.5Mbit/s). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think about it this way: each second, 1.5Mbit is sent over the link according to clocking of the line. Depending on how many channels (DS0's) you were allocated in your service specification, you'll be able to send that much of bits over the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, in Europe we use E1's, that have 30 channels, each at 64kbit/s for 2Mbit/s, but again, the service can get anything from one channel up to full set of channels - to the level of 2Mbit/s.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2016-04-18T06:23:22.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29668" PostTypeId="2" ParentId="29621" CreationDate="2016-04-18T07:23:55.690" Score="0" Body="&lt;p&gt;@Khopcha&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the CLI to configure both routers. There's no sens and value  in configuring the settings via the Packet Tracer GUI. If you have an IOS image file go for gns3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my experience the problem with people learning static routing is that they forget that routing is a two way process. Router 1 will need to have a static route for the 192.168.10.0/29 network and R2 will need to have static routing for the 192.168.10.0/25 network. Configuring the routers you can specify either the Next hop IP address or the outgoing interface. In case of multiaccess networks like Ethernet it's not recommended to specify the outgoing interface because this will create a directly connected static route, so the router will try to ARP ALL destination devices. It can cause performance issue and if ARP proxy is disabled on R2 all ARP requests  coming from R1 will fail.  So in your type of configuration you could go for either the next hop ip or outgoing interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&#xA;Adam&lt;/p&gt;&#xA;" OwnerUserId="24620" LastActivityDate="2016-04-18T07:23:55.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29669" PostTypeId="1" AcceptedAnswerId="29678" CreationDate="2016-04-18T07:38:54.330" Score="5" ViewCount="3481" Body="&lt;p&gt;Why does IKE use UDP, and handle any retransmission itself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Larger IKE packets may cause UDP fragmentation and are dropped by some ISPs: &lt;a href=&quot;https://www.ietf.org/proceedings/84/slides/slides-84-ipsecme-2.pdf&quot; rel=&quot;nofollow&quot;&gt;IKE over TCP&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="24661" LastEditorUserId="8499" LastEditDate="2018-12-13T15:36:27.130" LastActivityDate="2018-12-13T15:36:27.130" Title="Why does IKE use UDP instead of TCP?" Tags="|tcp|udp|transport-protocol|fragmentation|ike|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29670" PostTypeId="1" CreationDate="2016-04-18T09:04:19.667" Score="0" ViewCount="748" Body="&lt;p&gt;I'm currently a trainee, and I am assigned to do a task where I have to find out whether it is possible if a switch can get its certificate by contacting the TACACS-Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To explain what I'm trying to say, I will describe my situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My company is currently accessing all switches on remote locations via &lt;a href=&quot;http://en.wikipedia.org/wiki/Telnet&quot; rel=&quot;nofollow&quot;&gt;Telnet&lt;/a&gt; (which is of course insecure). It is planned to switch to SSH. But because the switches are not in secured locations, my company doesn't want to keep the certificates for SSH on the switch itself, but on the TACACS server, and when logging into the switch, the switch gets the certificate from the server to authenticate. We're currently using TACACS for default authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible that the switch can get the certificate from the TACACs server?&lt;/p&gt;&#xA;" OwnerUserId="24662" LastEditorUserId="3232" LastEditDate="2016-08-23T22:08:59.640" LastActivityDate="2016-08-23T22:08:59.640" Title="CISCO Switch SSH Certificate via TACACS-Server" Tags="|cisco|switch|ssh|authentication|tacacs|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29672" PostTypeId="2" ParentId="29645" CreationDate="2016-04-18T11:32:07.327" Score="3" Body="&lt;p&gt;Please allow me to join the discussion. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would you even want to allow your Laptop MAC address on all switch ports with port security ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The port security feature is mainly meant to increase Layer 2 security e.g. prevent MAC overflow attacks on a switch. It's not meant to prevent unauthorized devices to be connected to a RJ45 socket aka Ethernet port. Normally you configure the RJ 45 sockets in your office that are terminated on a Patch Panel and connected to the switch to allow a certain amount of MAC the given port can learn before taking any action (protect, restrict, shutdown). In doing so you're preventing from a possible MAC overflow attack's that can be executed against your switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again (it's my personal opinion) the question doesn't make much sense. If you can prove there's a real life reason why you would even care of configuring it that way, let me know. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adam&lt;/p&gt;&#xA;" OwnerUserId="24620" LastActivityDate="2016-04-18T11:32:07.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29676" PostTypeId="1" CreationDate="2016-04-18T13:53:24.547" Score="3" ViewCount="586" Body="&lt;p&gt;I would like to know the difference between ISP connections and IX connections? Basically we are evaluating some of the ISPs to get our edge circuits. While doing some research on it, came across to peering connections to IX locations. How do they help us? When I search in peering database, companies are having ISP links as well as IX links. How do they use it? Any pointers will be helpful? Sorry if it is a beginner question, could not find the correct difference and usage of these two models.&lt;/p&gt;&#xA;" OwnerUserId="22114" LastActivityDate="2016-04-18T16:18:36.403" Title="ISP connections Vs IX Connections" Tags="|isp|peering|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29678" PostTypeId="2" ParentId="29669" CreationDate="2016-04-18T15:31:55.387" Score="5" Body="&lt;p&gt;Originally, UDP was chosen over TCP because of its lower latency and processing requirements. Also, if ISPs followed the IETF standards, this wouldn't be an issue. There has been a movement to add TCP as an alternative, and there was a draft RFC (&lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-ipsecme-ike-tcp-01&quot; rel=&quot;nofollow noreferrer&quot;&gt;A TCP transport for the Internet Key Exchange draft-ietf-ipsecme-ike-tcp-01&lt;/a&gt;), which expired.&lt;/p&gt;&#xA;&lt;p&gt;The problem you describe really lies in two places: cheap consumer-grade equipment, and ISPs which don't follow the IETF standards, especially when implementing CGN. Many in the IETF have no sympathy for either of those situations, which is why the proposed RFC expired, and, I suppose, the point is that the standards become meaningless when the tail wags the dog: the IETF doesn't want to be bullied into new standards simply because vendors and ISPs don't/won't follow other, existing standards (e.g. handling fragmentation).&lt;/p&gt;&#xA;&lt;p&gt;Some equipment vendors have created workarounds (e.g., UDP packets encapsulated by TCP), but that is far from universal or standardized.&lt;/p&gt;&#xA;&lt;p&gt;You could lobby or join the IETF to express your support of a standard for using TCP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2016-04-18T15:31:55.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29679" PostTypeId="2" ParentId="29669" CreationDate="2016-04-18T15:45:04.347" Score="4" Body="&lt;p&gt;IKE is mean to encapsulate other communication. If that &quot;other communication&quot; requires all the L4 error correction that TCP offers, than the &quot;other communication&quot; should use TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this way, IKE/IPsec are only responsible for creating a secure transport. Not a reliable one. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine transferring VOIP through an IPsec/IKE tunnel. VOIP largely (and intentionally) uses UDP, but if this VOIP traffic goes over an IPsec tunnel, and if the IPsec tunnel used TCP, your call may be delayed while IPsec is sorting out re-transmissions for dropped packets -- thereby negating the benefits of using UDP for VOIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Putting it another way, it doesn't add any benefit to have two independent functions handling error correction. If your data stream cares about error correction, use TCP. If your data stream doesn't, or wants to manage error correction itself, use UDP. The transporting of these UDP or TCP packets should not interfere or cause conflict with what you chose for your data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the only protocol that would add no additional error correction would be UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example: If both IPsec used TCP and the underlying data used TCP, should a packet be dropped in transit, &lt;em&gt;both&lt;/em&gt; the IPsec function and the TCP function would &lt;em&gt;each&lt;/em&gt; request a re-transmission. Which would not be ideal.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-04-18T15:45:04.347" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29680" PostTypeId="2" ParentId="29676" CreationDate="2016-04-18T16:18:36.403" Score="1" Body="&lt;p&gt;The Internet is really just a bunch of networks connected together. Consumers and businesses connect to ISPs as customers. ISPs connect to other ISPs, either as customers of larger ISPs, or as peers at Internet Exchange Points (IXPs). At IXPs, ISPs can often peer with multiple other ISPs and CDNs, reducing costs by having a single location for connections, instead of running connections to multiple places in order to connect to multiple peers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-18T16:18:36.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29681" PostTypeId="1" AcceptedAnswerId="29686" CreationDate="2016-04-18T16:27:32.297" Score="3" ViewCount="206" Body="&lt;p&gt;Since there are many evil characters on the net scanning ports and ip blocks programmatically, can I misdirect an attempt to break into my system by setting the dmz port to a dead ip address or perhaps a honeypot on my lan?&lt;/p&gt;&#xA;" OwnerUserId="24670" LastActivityDate="2016-04-18T17:16:26.243" Title="Does port forwarding dmz to a 'dead ip' improve security for my lan?" Tags="|ipv4|port-security|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29682" PostTypeId="2" ParentId="19420" CreationDate="2016-04-18T16:28:05.950" Score="2" Body="&lt;p&gt;&lt;code&gt;1.3.6.1.4.1.9.9.13.1.3.1.3&lt;/code&gt; is an OID for &lt;code&gt;ciscoEnvMonTemperatureStatusTable&lt;/code&gt;in &lt;code&gt;CISCO-ENVMON-MIB&lt;/code&gt;, and it is marked as &lt;code&gt;MAX-ACCESS not-accessible&lt;/code&gt; in mib. So, snmpget will always fail on it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;snmpget -v1 -c public abn21 .1.3.6.1.4.1.9.9.13.1.3&#xA;Error in packet&#xA;Reason: (noSuchName) There is no such variable name in this MIB.&#xA;Failed object: SNMPv2-SMI::enterprises.9.9.13.1.3&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But snmpwalk will succeed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;snmpwalk -v1 -c public abn21 .1.3.6.1.4.1.9.9.13.1.3&#xA;SNMPv2-SMI::enterprises.9.9.13.1.3.1.2.1005 = STRING: &quot;SW#1, Sensor#1, GREEN &quot;&#xA;SNMPv2-SMI::enterprises.9.9.13.1.3.1.3.1005 = Gauge32: 29&#xA;SNMPv2-SMI::enterprises.9.9.13.1.3.1.4.1005 = INTEGER: 59&#xA;SNMPv2-SMI::enterprises.9.9.13.1.3.1.5.1005 = INTEGER: 0&#xA;SNMPv2-SMI::enterprises.9.9.13.1.3.1.6.1005 = INTEGER: 1&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same with cisco mibs in /usr/share/snmp/CISCO:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;snmpwalk -v1 -c public -M /usr/share/snmp/CISCO  -m CISCO-ENVMON-MIB -IR abn21 ciscoEnvMonTemperatureStatusTable&#xA;CISCO-ENVMON-MIB::ciscoEnvMonTemperatureStatusDescr.1005 = STRING: SW#1, Sensor#1, GREEN &#xA;CISCO-ENVMON-MIB::ciscoEnvMonTemperatureStatusValue.1005 = Gauge32: 29 degrees Celsius&#xA;CISCO-ENVMON-MIB::ciscoEnvMonTemperatureThreshold.1005 = INTEGER: 59 degrees Celsius&#xA;CISCO-ENVMON-MIB::ciscoEnvMonTemperatureLastShutdown.1005 = INTEGER: 0 degrees Celsius&#xA;CISCO-ENVMON-MIB::ciscoEnvMonTemperatureState.1005 = INTEGER: normal(1)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note snmp entries ids like &lt;code&gt;1.2&lt;/code&gt;, &lt;code&gt;1.3&lt;/code&gt; ... and sensor instance &lt;code&gt;1005&lt;/code&gt; (may vary in your case)  in snmpwalk output - using such complete OID you can access table entries directly with snmpget:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;snmpget -v1 -c public  abn21 .1.3.6.1.4.1.9.9.13.1.3.1.2.1005&#xA;SNMPv2-SMI::enterprises.9.9.13.1.3.1.2.1005 = STRING: &quot;SW#1, Sensor#1, GREEN &quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: snmp version (1 or 2c) doesn't matter here.&lt;/p&gt;&#xA;" OwnerUserId="24589" LastEditorUserId="8499" LastEditDate="2016-04-18T17:09:33.053" LastActivityDate="2016-04-18T17:09:33.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29683" PostTypeId="2" ParentId="29670" CreationDate="2016-04-18T17:02:29.750" Score="1" Body="&lt;p&gt;The short answer is no, because the SSH authentication happens before the login authentication (where the TACACS server is contacted). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if it were possible to download the certificate, you would then have the problem of verifying that the device that downloaded it is in fact the right switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect having the certificate on the switch is relatively low risk.  It would be very, very difficult (but not impossible) to steal the private key to impersonate the switch.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-18T17:02:29.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29685" PostTypeId="2" ParentId="28973" CreationDate="2016-04-18T17:14:51.813" Score="1" Body="&lt;p&gt;Try &quot;clear ip eigrp neighbors&quot; and then revisit the &quot;show ip eigrp topology&quot; output. Now it should reflect the correct values for the Feasible Distance and the Reported/Advertised Distance.&lt;/p&gt;&#xA;" OwnerUserId="24672" LastActivityDate="2016-04-18T17:14:51.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29686" PostTypeId="2" ParentId="29681" CreationDate="2016-04-18T17:16:26.243" Score="5" Body="&lt;p&gt;If you don't configure port forwarding then your NAT box will just drop the packets. If you configure port forwarding or a DMZ forwarding to an unused IP address then incoming packets will trigger ARP lookups on your LAN. Lots of wasted CPU cycles and lots of broadcast traffic on your LAN, and in the end the packets still get dropped...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if you ask this question you are probably not experienced enough to run a honeypot in a safe way, causing a major weakness in your network. You NEVER run a honeypot inside your real network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short: don't&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-04-18T17:16:26.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29687" PostTypeId="1" AcceptedAnswerId="29693" CreationDate="2016-04-18T17:35:38.403" Score="1" ViewCount="1132" Body="&lt;p&gt;We have a stack of 6, 48 port 3750 cisco switches and I would like to setup mirroring across the stack to send the data to a network analyser.   I have done mirroring before on a single switch, but never on a stack of swtiches.   My question is, what sort of things do I need to consider when trying to monitor a stack of c3750 switches with multiple vlans if I want to monitor all of the traffic on all VLANS with my network analyzer?   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since each switch is already stacked, do I only need to setup a single monitor port on one of the switches?   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I specify the port range that I want to monitor, should I just set the source port as being the various vlans I want to monitor, and then set the destination port as being a single port?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switch 1 provision ws-c3750-48ts&#xA; switch 2 provision ws-c3750-48ts&#xA; switch 3 provision ws-c3750-48ts&#xA; switch 4 provision ws-c3750-48ts&#xA; switch 5 provision ws-c3750-48p&#xA; switch 6 provision ws-c3750-48p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sorry for asking multiple questions in a single post, I can break it up if needed - it just seems like all of the questions are a part of the overall question regarding configuring SPAN across a switch stack.&lt;/p&gt;&#xA;" OwnerUserId="4994" LastEditorUserId="8499" LastEditDate="2018-12-23T05:02:23.737" LastActivityDate="2018-12-23T05:02:23.737" Title="Mirroring Ports on a Cisco 3750 Stack" Tags="|cisco|switch|cisco-catalyst|mirror|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="29688" PostTypeId="1" AcceptedAnswerId="29690" CreationDate="2016-04-18T17:45:37.527" Score="2" ViewCount="1251" Body="&lt;p&gt;There's nothing written about it on the internet. Nothing about if it's currently possible to carry out, or how to counter it. Just this definition copy pasta everywhere:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;STP (Spanning-Tree Protocol) mangling refers to the technique used for&#xA;  the attacker host to be elected as the new root bridge of the spanning&#xA;  tree. The attacker may start either by forging BPDUs (Bridge Protocol&#xA;  Data Units) with high priority assuming to be the new root, or by&#xA;  broadcasting STP Configuration/Topology Change Acknowledgement BPDUs&#xA;  to get his host elected as the new root bridge. By taking over the&#xA;  root bridge, the attacker will be able to intercept most of the&#xA;  traffic.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also another question, what's a Configuration/Topology Change Acknowledgement BPDU?&lt;/p&gt;&#xA;" OwnerUserId="24539" LastActivityDate="2016-04-18T17:56:28.360" Title="Can anyone explain STP mangling?" Tags="|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29690" PostTypeId="2" ParentId="29688" CreationDate="2016-04-18T17:56:28.360" Score="1" Body="&lt;p&gt;Switches send out BPDUs (Bridge Protocol Data Units) to elect a root bridge. Initially, every switch assumes it is the root bridge,until it receives a superior BPDU. This is an ongoing process. Also, when a switch notices a change in the topology (link up/down), it will send TCN (Topology Change Notification) BPDUs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you haven't correctly configured, or your switches don't support, the available STP security/stability measures (e.g. root guard), an attacker could send out BPDUs in order to take over from the root bridge. STP creates a loop-free environment by having the switches send traffic toward the root bridge. An attacker could have traffic sent toward it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-18T17:56:28.360" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29693" PostTypeId="2" ParentId="29687" CreationDate="2016-04-18T18:18:54.017" Score="1" Body="&lt;p&gt;A switch stack basically works like a single switch with a single configuration, much like a chassis switch with multiple blades.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would configure SPAN the same way you do on a single switch. You can set up all the traffic to go to a single monitor port on any of the switches, although you could easily overload the single port and drop a lot of traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For understanding your traffic mix and quantities, NetFlow may be a better solution.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-18T18:18:54.017" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29694" PostTypeId="2" ParentId="542" CreationDate="2016-04-18T18:39:20.143" Score="0" Body="&lt;p&gt;When assigning the Port, set the zone to LAN or whichever subnet you want to share with and then for mode, choose &quot;PortShield Switch Mode&quot;. It will then give you the option of a port (X0 for instance) to link to. Now your new port is a switch port connected to the X0 LAN.&lt;/p&gt;&#xA;" OwnerUserId="24677" LastActivityDate="2016-04-18T18:39:20.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29696" PostTypeId="1" AcceptedAnswerId="29698" CreationDate="2016-04-18T20:13:36.030" Score="2" ViewCount="203" Body="&lt;p&gt;Networking newb here. Under what circumstances could you fail to ping a remote server with the ping command, but still be able to connect to it via other means (as long as it was still TCP/IP)?&lt;/p&gt;&#xA;" OwnerUserId="24682" LastEditorUserId="8499" LastEditDate="2020-12-19T20:13:01.950" LastActivityDate="2020-12-19T20:13:01.950" Title="ping server vs. connecting to server" Tags="|ip|tcp|ping|icmp|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29697" PostTypeId="2" ParentId="29696" CreationDate="2016-04-18T20:15:59.967" Score="4" Body="&lt;p&gt;ICMP echo requests or replies could be blocked anywhere in the path, including at the endpoint itself. There are many circumstances or reasons this may be the case.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-18T20:15:59.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29698" PostTypeId="2" ParentId="29696" CreationDate="2016-04-18T20:16:00.913" Score="4" Body="&lt;p&gt;Many possible reasons, but the most likely is that there is a firewall or access list that is blocking ICMP. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-18T20:16:00.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29699" PostTypeId="2" ParentId="29570" CreationDate="2016-04-18T21:24:48.797" Score="2" Body="&lt;p&gt;If both sides indicate that there is a security association established, then it's like the encryption is working and there is some other problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to check out is what is the default gateway for the machines that are on the LAN and do they have a way to route packets to 192.168.1.0/24.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2016-04-18T21:24:48.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29701" PostTypeId="2" ParentId="29696" CreationDate="2016-04-18T23:38:10.127" Score="3" Body="&lt;p&gt;As a [self-professed] newb, you will advance more quickly in your network understanding if you flip your thinking around. So instead, ask:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why would you think &quot;ping&quot; (aka ICMP ECHO packets) would be in any way related to &quot;connect to it&quot; (aka open a TCP socket)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Success of ICMP ECHO does tell you some facts (eg, IP works between the two points, the end thing responds to ICMP ECHO REQuests, and more.) But you wouldn't jump to the erroneous conclusion that ICMP ECHO success tells you anything explicitly about TCP success.&lt;/p&gt;&#xA;" OwnerUserId="49" LastActivityDate="2016-04-18T23:38:10.127" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29703" PostTypeId="1" CreationDate="2016-04-19T03:28:25.710" Score="1" ViewCount="5197" Body="&lt;p&gt;I have typically known 'flat network' to be a non-vlan network, typically a single /24. We have a new hire (security analyst) at my company and he asked the desktop support supervisor if he had &quot;trouble getting your job done on this flat network&quot;. I'm a bit unsure how he means this, unless he is referring to it being a layer 2 domain as opposed to a routed site. Currently the site in question is multiple vlans, each in it's own /24 with the site as a /16. It's all L2, except for intervlan routing in the core.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I wrong in my usage of 'flat network', or am I missing something here?&lt;/p&gt;&#xA;" OwnerUserId="1068" LastEditorUserId="8499" LastEditDate="2018-03-07T21:37:47.400" LastActivityDate="2018-03-07T21:37:47.400" Title="what is the industry standard meaning of &quot;flat network&quot;" Tags="|vlan|network|terminology|topology|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29704" PostTypeId="2" ParentId="29703" CreationDate="2016-04-19T03:38:41.373" Score="3" Body="&lt;p&gt;There is no official definition, and it means different things to different people. In general, the term, &quot;flat network,&quot; means that the network isn't hierarchical (network engineer definition), or it is not security segmented (security engineer definition). You could have multiple VLANs all terminating in a single layer-3 device, and some consider that to be a flat network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Networks with hierarchies and/or security segmentation aren't usually considered flat networks, but it depends on the audience.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-19T03:38:41.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29707" PostTypeId="1" AcceptedAnswerId="29710" CreationDate="2016-04-19T05:53:32.240" Score="1" ViewCount="1239" Body="&lt;p&gt;Want to be sure I'm approaching this correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to have a list of allowed MACs that can access any switch company wide (these devices can plug into any switch and be allowed access).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do this I would have a list of the MAC addresses and then programmatically apply this list to each switch's switch ports I have enabled for port security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a different or more efficient way of going about this?&lt;/p&gt;&#xA;" OwnerUserId="13362" LastActivityDate="2016-04-19T08:03:38.987" Title="List of allowed mac addresses for port security" Tags="|cisco|switch|mac-address|port-security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29708" PostTypeId="2" ParentId="20890" CreationDate="2016-04-19T06:26:19.323" Score="2" Body="&lt;p&gt;I upgraded to 5.4.0 and it fixed the issue.  Prior to upgrading I could reproduce the issue by rebooting the PPPoE router and the VPN would not come back up with debug showing the error &quot;could not locate phase1 configuration&quot;.  This is no longer an issue after upgrading.  The VPN auto reconnects after a reboot.  Time will tell, but I suspect that future power outages will no longer require human intervention to re-establish the VPN tunnel.&lt;/p&gt;&#xA;" OwnerUserId="24659" LastActivityDate="2016-04-19T06:26:19.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29710" PostTypeId="2" ParentId="29707" CreationDate="2016-04-19T08:03:38.987" Score="4" Body="&lt;p&gt;Go for IEEE 802.1x Port-Based Authentication. Port security was not really designed for that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&#xA;Adam&lt;/p&gt;&#xA;" OwnerUserId="24620" LastActivityDate="2016-04-19T08:03:38.987" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29711" PostTypeId="1" AcceptedAnswerId="29712" CreationDate="2016-04-19T10:14:15.363" Score="0" ViewCount="88" Body="&lt;p&gt;I was trying to access Paypal dev blog but got a connection timed out error instead. Other sites are working fine. So I did a trace route if I would see something flaky. Indeed something came up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3IVaE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3IVaE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would anyone able to tell me what I am looking at here? Is this normal?&lt;/p&gt;&#xA;" OwnerUserId="24697" LastEditorUserId="1563" LastEditDate="2016-04-19T22:47:58.780" LastActivityDate="2016-04-19T22:47:58.780" Title="Is this trace normal?" Tags="|traceroute|" AnswerCount="1" CommentCount="0" ClosedDate="2016-04-20T19:56:46.503" ContentLicense="CC BY-SA 3.0" />
  <row Id="29712" PostTypeId="2" ParentId="29711" CreationDate="2016-04-19T10:44:36.180" Score="0" Body="&lt;p&gt;It seems there's a loop within &lt;a href=&quot;https://wq.apnic.net/whois-search/static/search.html?query=219.93.218.177&quot; rel=&quot;nofollow&quot;&gt;TMNet&lt;/a&gt; network (Malaysia).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Different traceroute from Europe to the Paypal Dev Blog IP are perfectly normal and reach the intended destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;a href=&quot;http://ops.pacific.net.sg/tools/traceroute.php?host=173.0.94.50&amp;amp;submit=Traceroute!&quot; rel=&quot;nofollow&quot;&gt;traceroute made from Singapour&lt;/a&gt; is also normal :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Traceroute from Pacnet Singapore to 173.0.94.50  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;HOST: kirchhoff.pacific.net.sg    Loss%   Snt   Last   Avg  Best  Wrst&#xA;  StDev&lt;br&gt;&#xA;    1.|-- vl8.scipk006.pacific.net.  0.0%    10    0.3   4.4   0.2  36.2  11.3&lt;br&gt;&#xA;    2.|-- te0-1-0-1.gw3.sjc1.10026.  0.0%    10  172.3 172.4 172.3 172.6   0.1&lt;br&gt;&#xA;    3.|-- sjo-b21-link.telia.net     0.0%    10  177.8 178.0 177.6 179.1   0.5&lt;br&gt;&#xA;    4.|-- paypal-ic-310953-sjo-b21.  0.0%    10  172.8 172.8 172.6 172.9   0.1&lt;br&gt;&#xA;    5.|-- 64.4.244.158               0.0%    10  177.4 177.5 177.4 178.0   0.2&lt;br&gt;&#xA;    6.|-- 64.4.244.104               0.0%    10  179.7 181.9 179.6 192.1   3.7&lt;br&gt;&#xA;    7.|-- 64.4.244.43                0.0%    10  202.3 202.3 202.2 202.5   0.1&lt;br&gt;&#xA;    8.|-- 64.4.244.196               0.0%    10  198.4 198.1 198.0 198.4   0.1&lt;br&gt;&#xA;    9.|-- ???                       100.0    10    0.0   0.0   0.0   0.0   0.0&lt;br&gt;&#xA;   10.|-- devblog.paypal.com        10.0%    10  200.6 200.6 200.4 200.8   0.1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-04-19T10:44:36.180" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29713" PostTypeId="1" AcceptedAnswerId="43143" CreationDate="2016-04-19T11:31:52.240" Score="1" ViewCount="2665" Body="&lt;p&gt;The owner of a business site (in the UK) with about 10 independent business on it (of which I occupy one) is thinking of installing a leased line for shared use by those businesses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He is asking what the safest/securest way is to enable the line to be shared between the businesses while at the same time keeping the businesses LANs separate with no communication between them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="24700" LastEditorUserId="24700" LastEditDate="2016-05-11T13:33:03.193" LastActivityDate="2017-08-10T14:46:28.740" Title="How can a leased line be securely shared between businesses?" Tags="|firewall|security|" AnswerCount="6" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="29716" PostTypeId="2" ParentId="29612" CreationDate="2016-04-19T12:13:38.233" Score="1" Body="&lt;p&gt;You have routing turned off, so the router won't forward packets. You can enable it with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ip routing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks to @ronmaupin for noticing that. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-19T12:13:38.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29717" PostTypeId="1" AcceptedAnswerId="29718" CreationDate="2016-04-19T12:17:06.637" Score="0" ViewCount="652" Body="&lt;p&gt;I saw a question which required me to subnet for 400 host. I used a class B IP address but I wanted to use a Class C address and borrow some of the network bits and change them into host, N.N.N.X to N.N.X.X I wanted to know if this is okay, because now the subnet mask looks more like a class B subnet mask.&lt;/p&gt;&#xA;" OwnerUserId="5709" LastActivityDate="2016-04-19T13:05:18.987" Title="Am I allowed to change the network bits in a class C subnet mask?" Tags="|ipv4|subnet|ip|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29718" PostTypeId="2" ParentId="29717" CreationDate="2016-04-19T12:35:14.730" Score="4" Body="&lt;p&gt;Classful networking is not used anymore. You can use whaever mask you need. Just be sure that RFC 1918 specifies private IPv4 addresses and those shouldnt appear on the Internet ( They will be probably dropped by first firewall )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, if the question fully specifies that you HAVE TO consider classful addressing which is obsolate, you can not modify the mask. Thats why it was so wasteful and it is not used anymore&lt;/p&gt;&#xA;" OwnerUserId="16890" LastActivityDate="2016-04-19T12:35:14.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29719" PostTypeId="2" ParentId="29717" CreationDate="2016-04-19T12:36:21.523" Score="1" Body="&lt;p&gt;Classfull addressing is deprecated for more than 20 years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We now use &lt;a href=&quot;https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Classless Inter-Domain Routing&lt;/a&gt; (CIDR) which allow you to subnet networks the way you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for 400 hosts, you will use a /23 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7106/how-do-you-calculate-the-prefix-network-subnet-and-host-numbers&quot;&gt;this answer&lt;/a&gt; for more information about subnetting.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-04-19T13:05:18.987" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29720" PostTypeId="2" ParentId="29713" CreationDate="2016-04-19T12:56:31.693" Score="1" Body="&lt;p&gt;I think you probarly need to implement VLANs on that building to separate different kinds of traffics, and also share the media. If by some reason you want to connect to another place, a L2VPN is what you need, to securely the traffic, avoiding interception and that stuff.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-04-19T12:56:31.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29721" PostTypeId="2" ParentId="29713" CreationDate="2016-04-19T13:07:46.713" Score="0" Body="&lt;p&gt;This question is probably not worded well. Why install a leased line if you don't want communications between sites?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can put routers and/or firewalls on each end of a leased line, and you can put in rules/ACLs to limit the communications to/from certain hosts/servers/networks, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any good firewall can block traffic between the businesses using the same leased line. Basically, you can separate the businesses by VLAN, and forbid traffic between the VLANs. Firewalls normally default to block everything, and then only allow what you specifically configure them to allow.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-11T14:09:12.790" LastActivityDate="2016-05-11T14:09:12.790" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29722" PostTypeId="1" AcceptedAnswerId="29726" CreationDate="2016-04-19T13:24:59.273" Score="1" ViewCount="375" Body="&lt;p&gt;I'm looking for a router / switch that will allow me to share a single external internet connection between two completely separate networks, which want to be totally isolated from each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IE one internet connection modem connected to the 800 WAN socket, a switch connected to the LAN port 1 with a bunch of machines on, and another switch connected to LAN port 2 with another bunch of machines on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want all machines to be able to see out to the internet (and ideally set up some port forwarding back in), but I don't want the two groups of machines to be able to see each other at all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will be a DHCP server running on each group, and I want no leakage between them at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think from what I've read that a Cisco series 800 router should support this using VLANS (internet on vlan 0, machines on vlans 1 and 2, and routes between 1&gt;0 and 2&gt;0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, before I go and actually buy one I was wondering if anyone with some real Cisco experience  could confirm if this will work in reality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically considering either an 851 or 871, unless someone can suggest something more effective.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Greg.&lt;/p&gt;&#xA;" OwnerUserId="24702" LastActivityDate="2016-04-19T13:47:01.860" Title="Cisco 800 series router, VLAN" Tags="|cisco|vlan|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29723" PostTypeId="2" ParentId="29722" CreationDate="2016-04-19T13:36:41.807" Score="0" Body="&lt;p&gt;I think you want to get the IOS license with the zone-based firewall in the router. You can set up different security zones, and prevent communications between the zones. Also, the Internet connection should not use a VLAN, it should be a routed link.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...unless someone can suggest something more effective.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You asked about these specific models, and that is on-topic, but product and/or resource recommendations are off-topic here.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-19T13:36:41.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29724" PostTypeId="1" AcceptedAnswerId="29728" CreationDate="2016-04-19T13:46:15.193" Score="1" ViewCount="111" Body="&lt;p&gt;I have a server rack with an HP 2810-24G in it, and a data cabinet with an HP 1800-24G. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the clients connect with gigabit to the 1800-24G, and all the servers are connected with gigabit to the 2810-24G. How can I create a multi-gigabit link between the switches so that more than one client can reach the server at gigabit speeds simultaneously?&lt;/p&gt;&#xA;" OwnerUserId="24705" LastActivityDate="2016-04-19T14:30:40.410" Title="How can I create a multi-gigabit link between these switches?" Tags="|switch|hp|trunk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29726" PostTypeId="2" ParentId="29722" CreationDate="2016-04-19T13:47:01.860" Score="1" Body="&lt;p&gt;Yes it will work with VLANs with the proper ACL that deny all traffic between VLAN 1 and 2, but I'm not sure that VLANs are supported on the 851 models.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/800-series-routers/product_data_sheet0900aecd8028a9a9.html&quot; rel=&quot;nofollow&quot;&gt;datasheet for the 851 &lt;/a&gt; doesn't list VLAN or 802.1q in the feature list (except in the Wireless part)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/800-series-routers/product_data_sheet0900aecd8028a976.html&quot; rel=&quot;nofollow&quot;&gt;datasheet for the 871&lt;/a&gt; model does explicitly say it supports VLANs but only with the &lt;code&gt;Advanced IP Services Feature Set&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you have to be careful about the licenses that are included with the router you choose. &lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-04-19T13:47:01.860" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29728" PostTypeId="2" ParentId="29724" CreationDate="2016-04-19T14:23:27.113" Score="1" Body="&lt;p&gt;Both of your switches support &lt;code&gt;IEEE 802.3ad Link Aggregation Protocol (LACP) and HP port trunking&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the feature specifically made to do what you want, it combines several physical links into a single logical one. This provide both additional bandwidth and fault-tolerance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the 1810 model this is limited to 4 link per trunk. (source: &lt;a href=&quot;http://h20195.www2.hp.com/v2/GetDocument.aspx?docname=4AA2-6799ENW&amp;amp;doctype=data%20sheet&amp;amp;doclang=EN_US&amp;amp;searchquery=&amp;amp;cc=us&amp;amp;lc=en&quot; rel=&quot;nofollow&quot;&gt;this datasheet&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you can have 4Gbs between the 2 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;LACP works by balancing different flows between links. A single flow will pass on a single link (so 1Gbs max).  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The term &quot;trunk&quot; used by HP in context of LACP can lead to confusion, it has nothing to do with the &quot;trunk&quot; mode of operation related to VLANs&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-04-19T14:30:40.410" LastActivityDate="2016-04-19T14:30:40.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29729" PostTypeId="1" CreationDate="2016-04-19T14:26:40.517" Score="1" ViewCount="992" Body="&lt;p&gt;There is a device on my network connected via ethernet. Seeing as how hubs are hard to find or ridiculously expensive these days, what hardware can I use if I'm interested in sniffing the traffic to/from the device? Do I get a managed switch and enable port mirroring or are there other options out there that I can look at?&lt;/p&gt;&#xA;" OwnerUserId="1453" LastActivityDate="2017-06-25T13:11:59.487" Title="Sniffing a Device's Traffic on LAN" Tags="|ethernet|lan|troubleshooting|pcap|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29730" PostTypeId="2" ParentId="29729" CreationDate="2016-04-19T14:34:34.567" Score="2" Body="&lt;p&gt;If you are using a switch, i guess the only passive option to sniff the traffic for/from that machine is configuring port mirroring(on a capable switch) on the interface connected to that device. There is another way, an ACTIVE scenario called MITM, man in the middle, where you need to spoof the device identity for the switch point of wiew, receiving and sendig your own data, and the device data, to de other people.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But i recommend you the first option, the second has some &quot;deep legal stuff&quot;, cause you are able to &quot;change&quot; the information sended a received from that device.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-04-19T14:34:34.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29731" PostTypeId="2" ParentId="29729" CreationDate="2016-04-19T14:34:53.027" Score="1" Body="&lt;p&gt;As you suggested, it sounds like you should mirror the traffic. You can capture traffic specific to the port where that device is connected. You will need a switch with that capability.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-19T14:34:53.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29738" PostTypeId="2" ParentId="29729" CreationDate="2016-04-19T19:27:25.293" Score="0" Body="&lt;p&gt;Another option is a &lt;a href=&quot;https://wiki.wireshark.org/CaptureSetup/Ethernet#Capture_using_a_network_tap&quot; rel=&quot;nofollow&quot;&gt;network tap&lt;/a&gt;.  See that section for some additional information.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2016-04-19T19:27:25.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29739" PostTypeId="1" AcceptedAnswerId="29743" CreationDate="2016-04-19T20:27:07.233" Score="3" ViewCount="11984" Body="&lt;p&gt;We have Cisco C3850 running &lt;code&gt;ipbase&lt;/code&gt; license recently we decided to run &lt;code&gt;BGP&lt;/code&gt; protocol for that we need &lt;code&gt;ipservices&lt;/code&gt; license. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: Do i need to buy new license or i have already that i just need to activate using &lt;code&gt;right-to-use&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#show switch&#xA;Switch/Stack Mac Address : 6c99.8962.2801 - Local Mac Address&#xA;Mac persistency wait time: Indefinite&#xA;                                             H/W   Current&#xA;Switch#   Role    Mac Address     Priority Version  State&#xA;------------------------------------------------------------&#xA;*1       Active   6c99.8962.2801     15     M0      Ready&#xA; 2       Standby  c414.3c9b.4190     1      M0      Ready&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;License:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#show license right-to-use&#xA; Slot#  License name   Type     Count   Period left&#xA;----------------------------------------------------------&#xA; 1      ipbase       permanent     N/A   Lifetime&#xA;&#xA;License Level on Reboot: ipbase&#xA;&#xA;&#xA; Slot#  License name   Type     Count   Period left&#xA;----------------------------------------------------------&#xA; 2      ipbase       permanent     N/A   Lifetime&#xA;&#xA;License Level on Reboot: ipbase&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Summary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#show license right-to-use usage&#xA; Slot#  License Name     Type     usage-duration(y:m:d)  In-Use  EULA&#xA;-----------------------------------------------------------------------&#xA; 1      ipservices     permanent    0 :0 :0                no    no&#xA; 1      ipservices     evaluation   0 :0 :0                no    no&#xA; 1      ipbase         permanent    2 :0 :14               yes   yes&#xA; 1      ipbase         evaluation   0 :0 :0                no    no&#xA; 1      lanbase        permanent    0 :0 :0                no    no&#xA; 1      apcount        evaluation   0 :0 :0                no    no&#xA; 1      apcount        base         0 :0 :0                no    no&#xA; 1      apcount        adder        0 :0 :0                no    no&#xA;&#xA; Slot#  License Name     Type     usage-duration(y:m:d)  In-Use  EULA&#xA;-----------------------------------------------------------------------&#xA; 2      ipservices     permanent    0 :0 :0                no    no&#xA; 2      ipservices     evaluation   0 :0 :0                no    no&#xA; 2      ipbase         permanent    2 :0 :14               yes   yes&#xA; 2      ipbase         evaluation   0 :0 :0                no    no&#xA; 2      lanbase        permanent    0 :0 :0                no    no&#xA; 2      apcount        evaluation   0 :0 :0                no    no&#xA; 2      apcount        base         0 :0 :0                no    no&#xA; 2      apcount        adder        0 :0 :0                no    no&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can't i just activate using following command?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#license right-to-use activate ?&#xA;  apcount     configure the AP-count licenses on the switch&#xA;  ipbase      activate ipbase license on the switch&#xA;  ipservices  activate Ipservices license on the switch&#xA;  lanbase     activate lanbase license on the switch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Update:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;In following command its showing this, Does that means i already have license and i just need to Activate it? Look at &lt;code&gt;Index 1&lt;/code&gt; what that means? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#show license right-to-use detail&#xA;Index 1:  License Name: ipservices&#xA;           Period left: Lifetime&#xA;           License Type: permanent&#xA;           License State: Not Activated&#xA;           License Count: Non-Counted&#xA;           License Location: Slot 1&#xA;Index 2:  License Name: ipservices&#xA;           Period left: 90&#xA;           License Type: evaluation&#xA;           License State: Not Activated&#xA;           License Count: Non-Counted&#xA;           License Location: Slot 1&#xA;Index 3:  License Name: ipbase&#xA;           Period left: Lifetime&#xA;           License Type: permanent&#xA;           License State: Active, In use&#xA;           License Count: Non-Counted&#xA;           License Location: Slot 1&#xA;Index 4:  License Name: ipbase&#xA;           Period left: 90&#xA;           License Type: evaluation&#xA;           License State: Not Activated&#xA;           License Count: Non-Counted&#xA;           License Location: Slot 1&#xA;Index 5:  License Name: lanbase&#xA;           Period left: Lifetime&#xA;           License Type: permanent&#xA;           License State: Not Activated&#xA;           License Count: Non-Counted&#xA;           License Location: Slot 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="2142" LastEditDate="2019-03-11T18:05:06.777" LastActivityDate="2021-10-19T18:34:57.530" Title="How to C3850 activate license to ipservices" Tags="|cisco|switch|bgp|license|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29740" PostTypeId="1" AcceptedAnswerId="29741" CreationDate="2016-04-19T20:41:06.797" Score="1" ViewCount="156" Body="&lt;p&gt;We're trying to debug a connection issue, and I can't find any solid documentation one way or the other. I'm not positive of the hardware we're using, but we can assume Cisco for now, as I doubt there's much difference for this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take the following example ACL entry:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;1800 permit tcp 10.74.10.50/32 10.74.150.21/32 range 10000 19999&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will this work? I questioned this, as a &lt;code&gt;/32&lt;/code&gt; traditionally means nothing beyond the subnet ID and broadcast address are usable. I was told that subnetting works differently for ACL entries, and that the &lt;code&gt;/32&lt;/code&gt; here means that &lt;em&gt;only&lt;/em&gt; the address given will be permitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone let me know which is correct?&lt;/p&gt;&#xA;" OwnerUserId="4051" LastEditorUserId="8499" LastEditDate="2016-04-21T20:22:00.363" LastActivityDate="2016-04-21T20:22:00.363" Title="Are ip:subnet combinations in ACLs different than everywhere else?" Tags="|cisco|ipv4|subnet|acl|network-access|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29741" PostTypeId="2" ParentId="29740" CreationDate="2016-04-19T20:54:20.997" Score="3" Body="&lt;p&gt;A /32 mask is often referred to as a host address, and it means a subnet with a single host.  That is normal IP addressing and it works in ACLs or routing or anywhere else you use IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to mention:  For Cisco IOS, ACLs are written with a &quot;wildcard&quot; mask, which is the one's complement of the subnet mask.  So 255.255.255.0 would be written as 0.0.0.255.  A /32 would be written as 0.0.0.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NX-OS does use the slash notation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASAs use the standard net mask.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-19T20:54:20.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29742" PostTypeId="2" ParentId="29740" CreationDate="2016-04-19T20:54:42.417" Score="2" Body="&lt;p&gt;Cisco router ACLs use wildcard masks for IPv4, not CIDR notation, like you have. A wildcard mask is the inverse of the network mask, so you are counting the number of &lt;code&gt;0&lt;/code&gt; bits, instead of the number of &lt;code&gt;1&lt;/code&gt; bits. For a 32-bit mask, you can use the &lt;code&gt;host&lt;/code&gt; keyword. Numbered, extended ACLs are in the &lt;code&gt;100&lt;/code&gt; to &lt;code&gt;199&lt;/code&gt; and &lt;code&gt;1300&lt;/code&gt; to &lt;code&gt;1999&lt;/code&gt; range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You example would be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 1800 permit tcp host 10.74.10.50 host 10.74.150.21 range 10000 19999&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 1800 permit tcp 10.74.10.50 0.0.0.0 10.74.150.21 0.0.0.0 range 10000 19999&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-19T20:54:42.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29743" PostTypeId="2" ParentId="29739" CreationDate="2016-04-19T22:47:28.267" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/system_management/configuration_guide/b_sm_3se_3850_cg/b_sm_3se_3850_cg_chapter_0100.html&quot; rel=&quot;noreferrer&quot;&gt;This Cisco Config Guide&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Permanent licenses—Purchased with a specific feature set with no expiration date.&#xA;Evaluation licenses—Pre-installed on the switch and is valid for only a 90 day in-use period.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can run &lt;code&gt;license right-to-use activate ip-services all accepteula&lt;/code&gt; to activate ipservices, and then restart the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general if you activate an image you don't have a license for it will warn you that you must purchase or deactivate in 90 days, etc.&lt;/p&gt;&#xA;" OwnerUserId="5746" LastActivityDate="2016-04-19T22:47:28.267" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29744" PostTypeId="2" ParentId="29546" CreationDate="2016-04-20T00:39:23.027" Score="1" Body="&lt;p&gt;If you are planning a long term network, I guess you should use static IP address on your workstations, so that you can apply security policies on a domain controller, or control Internet access by user profiles. DHCP is the perfect way when you don't need to apply special policies to specific users, all PCs shares a profile and do what it permitted.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorDisplayName="user10222" LastEditDate="2016-06-21T05:18:18.430" LastActivityDate="2016-06-21T05:18:18.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29745" PostTypeId="2" ParentId="29546" CreationDate="2016-04-20T01:30:36.000" Score="4" Body="&lt;p&gt;Theres advantages to both approaches. It's down to you to decide which is more relavent on your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage of setting on the device is that the devices can still talk to each other if the dhcp server goes down or if a rouge DHCP server shows up. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage of setting on the DHCP server is that you don't have to go round to every machine individually if you ever need to do a mass renumbering.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-04-20T01:30:36.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29746" PostTypeId="2" ParentId="29546" CreationDate="2016-04-20T01:47:20.730" Score="7" Body="&lt;p&gt;This is what I think you're trying to ask:  When I have a DHCP network but want a handful of hosts to have static IPs, is it best to &lt;em&gt;reserve&lt;/em&gt; the IPs on my DHCP server or set &lt;em&gt;static&lt;/em&gt; IPs on the hosts themselves? If that's your question, edit it and I'll take out this paragraph.&lt;/p&gt;&#xA;&lt;p&gt;The only benefit I see of configuring static IPs on select hosts themselves is that the address is permanently set and not relying on the interface's MAC to reacquire the &amp;quot;reserved&amp;quot; IP.  However, reserving the address already handed out by DHCP is quick and easy and doesn't require any access to the host.  For instance, if I put a wireless print server on my WLAN and want it to maintain a specific address but don't care what, I can reserve the address it is assigned without ever touching the print server.&lt;/p&gt;&#xA;&lt;p&gt;As an aside, you mention this is a small business.  For an office of five or 10 people I would personally set static IPs as a best practice.  No DHCP server needed, nothing ever changes, and perhaps it adds just a tiny extra bit of security in that one can't just plug a device into the network and have instant access.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2020-08-31T21:39:01.353" LastActivityDate="2020-08-31T21:39:01.353" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="29748" PostTypeId="1" CreationDate="2016-04-20T02:54:09.323" Score="0" ViewCount="1491" Body="&lt;p&gt;Is message segmentation and switching the same thing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Segmentation is when the max transmission unit is smaller than the size of the data packet, so we have to break it up into multiple packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switching is just breaking up the packet to get to a destination, for some reason?&lt;/p&gt;&#xA;" OwnerUserId="23079" LastActivityDate="2016-04-20T14:41:43.627" Title="Message segmentation vs message switching?" Tags="|tcp|switching|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29749" PostTypeId="1" AcceptedAnswerId="29752" CreationDate="2016-04-20T04:57:26.727" Score="2" ViewCount="488" Body="&lt;p&gt;I am trying to block IP range of one company , I have looked ASN number of it and found the prefixes.They look like this - &lt;a href=&quot;http://bgp.he.net/AS32934#_prefixes&quot; rel=&quot;nofollow&quot;&gt;http://bgp.he.net/AS32934#_prefixes&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;31.13.68.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does that mean , does it mean D class IP is from 0 to 24 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;31.13.68.1&#xA;31.13.68.2&#xA;31.13.68.3&#xA;.&#xA;.&#xA;.&#xA;31.13.68.24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or it means something else  , But  i can see more prefixes like 31.13.68.89 here at  &lt;a href=&quot;https://www.robtex.com/route/31.13.68.0-24---facebook-inc.html&quot; rel=&quot;nofollow&quot;&gt;https://www.robtex.com/route/31.13.68.0-24---facebook-inc.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24724" LastActivityDate="2017-08-14T06:14:17.390" Title="What range is this in IPV4" Tags="|ipv4|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29750" PostTypeId="2" ParentId="29748" CreationDate="2016-04-20T06:33:18.660" Score="3" Body="&lt;p&gt;&lt;strong&gt;Segmentation (or rather fragmentation)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although in some literature you may find the term &lt;code&gt;segmentation&lt;/code&gt; to refer to the process of dividing an IP packet that is bigger than the &lt;code&gt;Maximum Transfer Unit&lt;/code&gt; (MTU) of the link,  the correct term is &lt;code&gt;fragmentation&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://networkengineering.stackexchange.com/users/24620/adam86&quot;&gt;@adam86&lt;/a&gt; answer for what segmentation refers to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switching&lt;/strong&gt;&lt;br&gt;&#xA;Switching is totally different, it refers to the process, performed by devices commonly known as &lt;code&gt;switch&lt;/code&gt;, although the official term is &lt;code&gt;mac bridge&lt;/code&gt;, which transfer (unchanged), an Ethernet frame from a LAN to another LAN.&lt;br&gt;&#xA;Mac bridges are defined by the IEEE standard 802.1D&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In modern Ethernet networking, switching is performed when a switch receives an Ethernet frame on one of its ports and transfers it to another port on which the receiver is attached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch use the destination MAC address present in the Ethernet frame to select the port to send the frame to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The term &quot;switching&quot; come from the fact the frame is recopied from one port to another one, by opposition with older hubs which send the frame to all ports (except the one on which the frame was received).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-04-20T14:41:43.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29751" PostTypeId="2" ParentId="29749" CreationDate="2016-04-20T06:58:19.290" Score="4" Body="&lt;p&gt;No, /24 is CIDR notation and refers to a 24-bit mask - so that particular prefix means 31.13.68.0-255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more on CIDR notation via Google/Wikipedia.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-04-20T06:58:19.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29752" PostTypeId="2" ParentId="29749" CreationDate="2016-04-20T06:59:55.857" Score="9" Body="&lt;p&gt;&lt;code&gt;31.13.68.0/24&lt;/code&gt; is a network in CIDR notation. It encompasses all IP addresses between &lt;code&gt;31.13.68.0&lt;/code&gt; and &lt;code&gt;31.13.68.255&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can get more explanation on CIDR easily by searching on the Internet, here is the quote from &lt;a href=&quot;https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing#CIDR_notation&quot; rel=&quot;nofollow noreferrer&quot;&gt;wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;CIDR notation&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;CIDR notation is a compact representation of an IP address and its&#xA;  associated routing prefix. The notation is constructed from an IP&#xA;  address, a slash ('/') character, and a decimal number. The number is&#xA;  the count of leading 1 bits in the routing mask, traditionally called&#xA;  the network mask. The IP address is expressed according to the&#xA;  standards of IPv4 or IPv6.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The address may denote a single, distinct interface address or the&#xA;  beginning address of an entire network. The maximum size of the&#xA;  network is given by the number of addresses that are possible with the&#xA;  remaining, least-significant bits below the prefix. The aggregation of&#xA;  these bits is often called the host identifier.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.100.14/24 represents the IPv4 address 192.168.100.14 and its associated routing prefix 192.168.100.0, or equivalently, its subnet mask 255.255.255.0, which has 24 leading 1-bits.  &#xA;&#xA;the IPv4 block 192.168.100.0/22 represents the 1024 IPv4 addresses from 192.168.100.0 to 192.168.103.255.  &#xA;&#xA;the IPv6 block 2001:db8::/48 represents the block of IPv6 addresses from 2001:db8:0:0:0:0:0:0 to 2001:db8:0:ffff:ffff:ffff:ffff:ffff.&#xA;&#xA;::1/128 represents the IPv6 loopback address. Its prefix size is 128, the size of the address itself.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Before the implementation of CIDR, IPv4 networks were represented by&#xA;  the starting address and the subnet mask, both written in dot-decimal&#xA;  notation. Thus, 192.168.100.0/24 was often written as&#xA;  192.168.100.0/255.255.255.0.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The number of addresses of a subnet may be calculated as 2^(address size&#xA;  - prefix size), in which the address size is 128 for IPv6 and 32 for IPv4. For example, in IPv4, the prefix size /29 gives: 2^(32-29) = 2^3 = 8&#xA;  addresses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You refer to &quot;D class IP&quot; , but classfull addressing is totally deprecated, for 20 years...&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-08-14T06:14:17.390" LastActivityDate="2017-08-14T06:14:17.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29753" PostTypeId="2" ParentId="29748" CreationDate="2016-04-20T07:06:56.747" Score="1" Body="&lt;p&gt;TCP breaks up a message into small pieces known as segments. This process is called segmentation. Keep in mind that TCP is a byte stream protocol. It's up to Layer 4 to create chunks not bigger than the Maximum Segment Size which is the largest segment (piece of data) that can be transferred in an IP packet which in turn is limited by MTU that is the maximum size of a packet that can traverse a given physical link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;@JFK The term segmentation is sometime used to refer to the process of dividing an ethernet frame that is bigger than the Maximum Transfer Unit (MTU) of the link&lt;/p&gt;&#xA;&#xA;&lt;p&gt;isn't this called fragmentation? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&#xA;Adam &lt;/p&gt;&#xA;" OwnerUserId="24620" LastEditorUserId="24620" LastEditDate="2016-04-20T07:08:11.433" LastActivityDate="2016-04-20T07:08:11.433" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29756" PostTypeId="1" CreationDate="2016-04-20T08:22:04.073" Score="2" ViewCount="205" Body="&lt;p&gt;I'm using a couple of CISCO1941/K9 (Version 15.2(2)T1) routers  and I've noticed that every time I discover them using Cisco Configuration Professional I get this warning :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IPS-4-SIGNATURE&#xA;      Sig:1102 Subsig:0 Sev:100 Impossible IP Packet [192.168.X.Y:8 -&gt; 192.168.X.Y:0] VRF:NONE RiskRating:100&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;After a quick research I found that could be a Land attack (not my case) or a false positive (and I believe so).Link :&lt;a href=&quot;https://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=1102&amp;amp;signatureSubId=0&quot; rel=&quot;nofollow&quot;&gt;https://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=1102&amp;amp;signatureSubId=0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover it seems that there are some bugs causing this warning (see Cisco Bug: CSCsr49100) but they were found on a different device. Link :&lt;a href=&quot;https://quickview.cloudapps.cisco.com/quickview/bug/CSCsr49100&quot; rel=&quot;nofollow&quot;&gt;https://quickview.cloudapps.cisco.com/quickview/bug/CSCsr49100&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm quite sure that the warning is caused by a bug but my boss doesn't think so and I have to find a way to convince her.I tried sniffing the traffic on the 192.168.X.Y subnet but there aren't any suspicious packets before the warning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to find out the packet that is causing the warning on the router (after finding it if it's normal I'll have the proof that it's a bug) ?&lt;/p&gt;&#xA;" OwnerUserId="23207" LastActivityDate="2016-04-20T11:10:07.980" Title="IP Impossible packet Cisco 1941" Tags="|cisco|router|cisco-ios|ip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29757" PostTypeId="1" AcceptedAnswerId="29758" CreationDate="2016-04-20T08:44:35.597" Score="4" ViewCount="1583" Body="&lt;p&gt;Desperately I'm trying to cascade two Cisco SG200-26. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The use case seems simple: No tagging should be needed, we just want each switch to behave exactly like two small switches. &#xA;But just when cascaded, the last VLAN behind the second switch stops working (e.g. no DHCP). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Image &lt;a href=&quot;https://i.stack.imgur.com/oXWtd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt; gives an overview: Our company uses three rooms. Spread over these rooms we need two VLANs. Since there are separate Ethernet cables available, we didn't plan to use tagging. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus we configured both switches as it can be seen in image [2]: No tagging, just access mode, 2 ports in VLAN 1 for maintenance (not connected while daily business), 16 ports in VLAN 2 for the yellow network, and 8 ports in VLAN 3 for the green network (office 2). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two cables connecting the switches, one for each VLAN. As a consequence of this we think there's no trunk needed, just port-based VLANs, isn't it? Within our company, there's no connection between the two VLANs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When testing the switches separately, all is working fine - the VLANs seem properly separated. Just when we cascade the switches, VLAN 3 doesn't work behind the second switch (Office 1). I don't even get an IP address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I replace the 8 ports for VLAN 3 with another switch (e.g. Netgear GS108) all is working fine. Interesting enough, it doesn't matter if I put the Netgear for VLAN 3 next to the first switch (server room) or next to the second switch (office 1). So it's truly the cascade which brings up the problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connecting a PC instead of the second switch for VLAN 3 works fine. But when I connect the switch, the same PC would not get an IP anymore. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we tried so far without any success: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using only two VLAN (i.e. getting rid of the maintenance VLAN). &lt;/li&gt;&#xA;&lt;li&gt;Having all ports configured as trunk (&quot;default&quot;). &lt;/li&gt;&#xA;&lt;li&gt;All ports in general mode, without filtering, allowing tagged and untagged traffic. &lt;/li&gt;&#xA;&lt;li&gt;All ports in access mode but the connections between the switches as trunk. &lt;/li&gt;&#xA;&lt;li&gt;Same as above but setting the connections to tagged. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It's just switches, no routers, so I wouldn't expect trouble with DHCP. It should be transparent, isn't it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please, feel free to assume infinite stupidity from my side. My experience with these switches is limited. I'm pretty sure I'm doing something wrong. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, any help is deeply appreciated - we're running out of ideas. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oXWtd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oXWtd.png&quot; alt=&quot;Overview of our company&amp;#39;s LAN&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24709" LastEditorUserId="42290" LastEditDate="2017-12-14T13:47:40.973" LastActivityDate="2017-12-14T13:47:40.973" Title="Trouble Cascading VLANs Cisco Switches" Tags="|cisco|switch|vlan|lan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29758" PostTypeId="2" ParentId="29757" CreationDate="2016-04-20T08:51:38.563" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;There are two cables connecting the switches, one for each VLAN. As a consequence of this we think there's no trunk needed, just port-based VLANs, isn't it? Within our company there's no connection between the two VLANs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is your problem. By using two different links, you have created a loop in your network. The Cisco SG200 switches can't use per-VLAN Spanning Tree, so the Spanning Tree mechanism will disable one of those two links to prevent the loop from bringing down the entire network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My advise: trunk the link between the two switches. You can use link aggregation (LAG) to increase the throughput if you want.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-04-20T08:51:38.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29759" PostTypeId="2" ParentId="20893" CreationDate="2016-04-20T08:59:14.037" Score="1" Body="&lt;p&gt;When the topology is as described :&#xA;Host A - Switch A - Switch B - Host B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, Host A will know the IP address of Host B (the destination that it wants to communicate to). Assuming the IP addresses of the two Hosts are in the same network, Host A uses ARP to get the mac address of the destination. This is a broadcast frame that is forwarded out the ports of Switch A - and Switch B - to Host B, which sees it is the intended recipient and replies with its own MAC address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host A later uses this MAC address and send the packet to Switch A. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch A sees the MAC address and forwards this packet out of the interface appropriate by referring to its own MAC table. &#xA;Similar operation occurs at Switch B - that later reached the destination Host B. &lt;/p&gt;&#xA;" OwnerUserId="24726" LastActivityDate="2016-04-20T08:59:14.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29760" PostTypeId="1" AcceptedAnswerId="29763" CreationDate="2016-04-20T09:40:42.190" Score="0" ViewCount="12213" Body="&lt;p&gt;I'm a first year network engineering student and just got into Cisco today, so please bear with me..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to setup two switches to connect to each other via a router&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;.&#xA;  &lt;a href=&quot;https://i.stack.imgur.com/BflYN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BflYN.png&quot; alt=&quot;like this&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;but I can't seem to make devices from the A switch to connect to devices from the B switch. I tried searchinig on Youtube and found one that works but it uses a DHCP server to assign IPs to the connected devices like this..&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;.&#xA;  &lt;a href=&quot;https://i.stack.imgur.com/abNqr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/abNqr.png&quot; alt=&quot;dhcp&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is there a way to connect devices from the A switch to B switch via a router without DHCP server ? If yes, can you help me configure it? I have uploaded the .pkt file if needed&lt;/p&gt;&#xA;" OwnerUserId="24728" LastEditorUserId="24728" LastEditDate="2016-04-20T09:47:05.387" LastActivityDate="2016-04-20T10:34:52.993" Title="Connecting/configuring two switches to a router?" Tags="|cisco|switch|router|packet-tracer|" AnswerCount="2" CommentCount="2" ClosedDate="2016-04-20T16:27:21.880" ContentLicense="CC BY-SA 3.0" />
  <row Id="29762" PostTypeId="1" CreationDate="2016-04-20T10:04:10.407" Score="1" ViewCount="623" Body="&lt;p&gt;We have a Cisco 886 router, running IOS 15.3, which is configured with SNMP v3. The username is &lt;code&gt;testAdmin&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any command to identify, whether this user has read-only permission or read-write?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&lt;br&gt;&#xA;Sumesh.&lt;/p&gt;&#xA;" OwnerUserId="24463" LastEditorUserId="16930" LastEditDate="2016-04-20T11:40:40.747" LastActivityDate="2016-08-18T13:27:38.650" Title="how to check user permissions in snmpv3" Tags="|cisco|router|cisco-ios|snmp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29763" PostTypeId="2" ParentId="29760" CreationDate="2016-04-20T10:16:48.327" Score="0" Body="&lt;p&gt;You don't need DHCP to make them talk to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First make sure you can ping the default gateway (it's the LAN facing interface of the router Fa0/0 and Fa0/1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the IP addressing. The router has two directly attached networks. To make it work only proper IP addressing is required. Did you configure VLAN's ? &lt;/p&gt;&#xA;" OwnerUserId="24620" LastEditorUserId="24620" LastEditDate="2016-04-20T10:34:52.993" LastActivityDate="2016-04-20T10:34:52.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29764" PostTypeId="2" ParentId="29760" CreationDate="2016-04-20T10:16:55.617" Score="0" Body="&lt;p&gt;Just configure static IPs on your terminals, with good netmasks / subnets, and then:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;for the switch A sub-network, give Router0.Fa0/0 adress as default gateway;&lt;/li&gt;&#xA;&lt;li&gt;and for the switch B sub-network, give Router0.Fa0/1 adress ad default gateway.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And then, on your router, add the two sub-netorks on your routing table. &lt;/p&gt;&#xA;" OwnerUserId="24528" LastActivityDate="2016-04-20T10:16:55.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29766" PostTypeId="2" ParentId="29756" CreationDate="2016-04-20T11:10:07.980" Score="1" Body="&lt;p&gt;Since the log message says it's a Land attack, you could look in your sniffer trace for packets with port=0.  If you don't find any, that's a good indication it's a false positive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, look to see if you can identify the source of the packets in the log message.  If it is a device you control, you can inspect that device to give it a clean bill of health (or fix it if it isn't).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-20T11:10:07.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29767" PostTypeId="2" ParentId="29762" CreationDate="2016-04-20T11:43:27.597" Score="2" Body="&lt;p&gt;the command:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;show snmp user&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;will tell you which group the user belongs to, and the command &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;show snmp group&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;will list the groups and the read or write views associated.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-04-20T11:43:27.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29768" PostTypeId="2" ParentId="29757" CreationDate="2016-04-20T11:44:10.457" Score="1" Body="&lt;p&gt;There is a LOOP between the SG200-26(server room) and SG200-26(office1) switches, i think your probarly need to implement some etherchannel to use the 2 links like one and get more bandwith. Once you do that, convert it into a trunk port and allow vlan 2 and 3, that´s it, its simple. By other hand, if you read your logs, you ccan see &lt;strong&gt;mac-address flapping&lt;/strong&gt; between the 2 switches, and with that, topology changes. If you troubleshoot spanning-tree you can see that one of the 2 ports on one on the switches is in &lt;strong&gt;DISCARDING&lt;/strong&gt; state, that is the reason why you can´t communicate on that VLAN&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-04-20T11:44:10.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29773" PostTypeId="1" CreationDate="2016-04-20T12:52:05.987" Score="1" ViewCount="1501" Body="&lt;p&gt;I want to know what is TXOP and what is service period in 802.11n or 802.11e. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any relation or difference between TXOP and SP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Devaa&lt;/p&gt;&#xA;" OwnerUserId="24734" LastActivityDate="2016-09-17T14:44:41.840" Title="TXOP and Service Period in 802.11e" Tags="|wireless|ieee-802.11|qos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29775" PostTypeId="2" ParentId="29773" CreationDate="2016-04-20T13:18:54.527" Score="2" Body="&lt;p&gt;A TXOP is a transmission opportunity granted by the Access Point to the Station.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a given period of time during which the station can send as many frame as it wishes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A service period is related to power saving. It's the period during which the Station listen before going back to sleep. It is initiated by the Station and allow the Access Point to send traffic destined to the Station that have been buffered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short :  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;TXOP , QoS mechanism, AP initiated, traffic from Station to AP  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Service Period, Power saving mechanism, Station initiated, traffic from AP to Station&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-04-20T13:18:54.527" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29777" PostTypeId="1" CreationDate="2016-04-20T17:22:24.197" Score="1" ViewCount="306" Body="&lt;p&gt;I currently have a total of 4 locations with clustered SRX650's. Each location also has redundant internet connections. We'll call the locations Office1, Office2, DC1, DC2. Currently the offices are not directly connected and connect to both DC over every possible combination of providers. I'll use &quot;O#&quot;, &quot;D#&quot; and &quot;P#&quot; as shorthand for the locations and providers. For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;O1-P1 -&gt; D1-P1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;O1-P2 -&gt; D1-P1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;O1-P1 -&gt; D1-P2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;O1-P2 -&gt; D1-P2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each provider-pair connection is a distinct IPSec VPN and OSPF is used for route propagation. Using this topology any one internet connection at each location can fail, simultaneously, and traffic will still flow. The problem I'm having now is that traffic between Office1 and Office2 can take an asymmetric route and the SRX at each office don't seem to allow that traffic to pass.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having tried the no-syn-check and no-sequence-check flow options, how do I let the asymmetric traffic pass or if there's no good way to do that, what network design would best suit? I'm not a network engineer by anything other than on-the-job work by myself so I'm very open to better ideas than my implementation!&lt;/p&gt;&#xA;" OwnerUserId="24741" LastActivityDate="2016-07-19T21:34:27.407" Title="Juniper SRX650: redundantly connected locations and asymmetric routing" Tags="|routing|ospf|juniper|juniper-srx|asymmetric-routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29779" PostTypeId="1" CreationDate="2016-04-20T17:49:56.593" Score="1" ViewCount="65" Body="&lt;p&gt;Like many folks, I have a crappy ISP. Every couple of minutes, my ISP will drop a handful of packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For &quot;normal&quot; activity such as web browsing, emailing, or even netflix, it works great; no one notices a few packets out of a thousand every 7-12 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I happen to work on a VPN over this connection, and invariable the VPN is not resistant to droppage of any packets. My ssh/rdp/whatever sessions get bounced quite frequently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With tools such as mosh I can continue to function, but can get quite annoyed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, one of my company's offices also has an unreliable Internet connection and the L2L IPSEC tunnels seem very sensitive to that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the best way to establish a VPN across an unreliable ISP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*edit: I should mention I live in a rural area and exactly one &quot;choice&quot; for ISP&lt;/p&gt;&#xA;" OwnerUserId="24743" LastEditorUserId="24743" LastEditDate="2016-04-20T18:25:30.233" LastActivityDate="2016-04-20T18:25:30.233" Title="VPN over Crappy ISP" Tags="|cisco|vpn|isp|ssh|" AnswerCount="0" CommentCount="6" ClosedDate="2016-04-20T21:29:05.163" ContentLicense="CC BY-SA 3.0" />
  <row Id="29781" PostTypeId="2" ParentId="29777" CreationDate="2016-04-20T18:42:45.063" Score="1" Body="&lt;p&gt;With stateful firewalls, you will always have this issue with asymmetric routing.  It's unavoidable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One idea is to put the firewall behind the border routers, so that all traffic always flows through the same firewall no matter which path is used.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-20T18:42:45.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29782" PostTypeId="1" CreationDate="2016-04-20T20:17:43.517" Score="1" ViewCount="452" Body="&lt;p&gt;I have a few questions, but all under the same umbrella topic:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If I find out a MAC address of a machine on a LAN, and I spoof my MAC to match that particular machine and join their LAN, how will things in the network behave?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I read something that lead me to believe IPv6 has MAC addresses &quot;encoded&quot; in them. Am I wrong in this interpretation? Would it be very bad if someone knew my IPv6 address - could this give them my MAC address also?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can I get a &lt;em&gt;legal&lt;/em&gt; programmable NIC that lets me change its MAC?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Do phones have an equivalent to MAC addresses? I heard it was UUID, but I wasn't sure.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerDisplayName="user108251" LastEditorUserId="8499" LastEditDate="2016-04-20T20:58:38.740" LastActivityDate="2016-04-20T23:05:35.887" Title="Few questions about MAC addresses and related material" Tags="|mac-address|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="29784" PostTypeId="2" ParentId="29782" CreationDate="2016-04-20T20:50:44.757" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;Your first question is answered in &lt;a href=&quot;https://networkengineering.stackexchange.com/a/26739/8499&quot;&gt;this answer&lt;/a&gt;, &lt;a href=&quot;https://networkengineering.stackexchange.com/a/11284/8499&quot;&gt;this answer&lt;/a&gt;, &lt;a href=&quot;https://networkengineering.stackexchange.com/a/28286/8499&quot;&gt;this answer&lt;/a&gt;, etc. You should search this site to see if your question has been previously answered.&lt;/li&gt;&#xA;&lt;li&gt;If you use SLAAC to assign IPv6 addresses, the 48-bit MAC address is&#xA;converted to a modified 64-bit EUI. This has been of concern, and&#xA;most OSes, by default, use privacy extensions/random address&#xA;generation. See &lt;a href=&quot;https://networkengineering.stackexchange.com/a/25801/8499&quot;&gt;this answer&lt;/a&gt; about this question.&lt;/li&gt;&#xA;&lt;li&gt;You can change the MAC address which is used with most NICs, but I&#xA;don't know of any which can be changed in the hardware. You are&#xA;supposed to set the U/L bit when using your own MAC address, but I&#xA;really don't see that being followed. I am not aware of there being&#xA;anything illegal about changing your MAC address.&lt;/li&gt;&#xA;&lt;li&gt;VoIP phones that run on LANs which use MAC addresses (e.g. ethernet&#xA;or Wi-Fi) will have MAC addresses.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;MAC addresses are only significant on a LAN, and just about anyone on a LAN can get your MAC address from the host ARP cache after communicating with your host at layer-3. To send a layer-3 packet to your host, a host will need to use something like ARP (IPv4) or ND (IPv6) to get your layer-2 address (MAC). Your host will also use ARP (a layer-2 broadcast) to discover the MAC addresses of other hosts, and it announces your MAC address to other hosts.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-04-20T23:05:35.887" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29785" PostTypeId="1" CreationDate="2016-04-20T21:24:50.497" Score="4" ViewCount="20254" Body="&lt;p&gt;So there are 4 fields I'm considering. Source/destination of each the MAC address and the IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the datagram is going through a few hosts, which of these values will be changing. From what I understand, both of the destination addresses do not change, but one of the sources do change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As each of the hosts process the data packet, I think they change only one of these values, and I think it's the source MAC address. Is that true?&lt;/p&gt;&#xA;" OwnerUserId="23079" LastEditorUserId="8499" LastEditDate="2016-04-20T21:35:34.533" LastActivityDate="2016-09-07T17:31:50.853" Title="When a datagram moves through a network, do the MAC or IP addresses change?" Tags="|ip|internet|mac-address|ip-address|data|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29786" PostTypeId="2" ParentId="29785" CreationDate="2016-04-20T21:33:34.307" Score="2" Body="&lt;p&gt;Ideally, the source and destination IP addresses don't change. In practice, NAT may be used, and, depending on the NAT used, either the source, destination, or both IP addresses may be changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a LAN, source and destination MAC addresses do not change; they are specific to the LAN on which the frame originated. You may be confused by the fact that a layer-3 device (e.g. a router) will strip off the frame, which contains the source and destination MAC addresses. If the layer-3 device sends the packet out a different interface, it will create a new frame, based on the new LAN, to which it is sending the packet. In this case, the new frame will have different source and destination MAC addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-20T21:33:34.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29788" PostTypeId="1" AcceptedAnswerId="29790" CreationDate="2016-04-20T21:43:45.017" Score="1" ViewCount="150" Body="&lt;p&gt;For example, TCP is full duplex. Can it be built on top of non-full-duplex underlying communications?&lt;/p&gt;&#xA;" OwnerUserId="24749" LastEditorUserId="8499" LastEditDate="2016-04-20T21:48:02.793" LastActivityDate="2016-04-22T13:19:07.517" Title="Is it possible to implement full-duplex upper layers over simplex or half-duplex lower layers?" Tags="|tcp|duplex|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29789" PostTypeId="2" ParentId="29788" CreationDate="2016-04-20T21:46:22.410" Score="0" Body="&lt;p&gt;Ethernet, or other layer-1/layer-2 LAN protocols, may be half duplex, but that doesn't change TCP. That is the point of the layered network: each layer is independent of the other layers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-20T21:46:22.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29790" PostTypeId="2" ParentId="29788" CreationDate="2016-04-20T23:56:15.807" Score="1" Body="&lt;p&gt;First some basic definitions.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Simplex: can only transmit data in one direction.&lt;/li&gt;&#xA;&lt;li&gt;Half duplex: can transmit data in both directions but not at the same time.&lt;/li&gt;&#xA;&lt;li&gt;Full duplex: can transmit data in both directions at the same time.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Obviously a simplex link can only move data in one direction, so we can't build a full duplex link out of &lt;em&gt;one&lt;/em&gt; simplex link. However we can build a full duplex link out of two seperate simplex links. This is how many practical network physical layers work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about a half duplex link? well it comes down to exactly what we mean by &quot;at the same time&quot;. To send information in both directions over a half duplex link we need some method for switching directions. That may be a fixed ratio time division, it may be some kind of carrier sense based protocol, whatever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the direction switching happens fast enough then higher levels won't notice. As far as they are concerned they put data into a transmit buffer and pull it out of a receive buffer. The exact details of how it got from the transmit buffer at one end to the receive buffer at the other don't matter much as long as it arrives in a reasonablly timely manner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general on a half duplex channel you have to wait until reception is complete before starting transmission. Since signals don't travel instantly this inevitablly means there is some dead time during a direction change. CSMA type protocols where there are not fixed time-slots are likely to introduce more dead time. You have something of a compromise between bandwidth and latency, rapid switching allows low latency communications but increases the ammount of dead time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting back to the Internet, half duplex was traditionally used on local area networks (notablly Ethernet). Such networks ran over relatively short distances and had relatively high bandwidths. So the extra latency and reduced bandwidth from half duplex operation were negligable compared to the bandwidth restrictions and latency seen on WAN links. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-04-22T13:19:07.517" LastActivityDate="2016-04-22T13:19:07.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29791" PostTypeId="2" ParentId="6610" CreationDate="2016-04-21T00:07:55.637" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I don't know that much in detail how full-duplex works and I wonder if collisions can occur in them. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Take a UTP cable for an example - are some cables within it reserved for data going one way and the other wires for data going the other way? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That depends on which version of Ethernet you are talking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10BASE-T and 100BASE-TX have a seperate pair of wires for each direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1000BASE-T uses all four pairs in both directions at the same time. They use echo cancellation techniques to seperate transmitted and received data. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can two frames going in the same direction crash with each other?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, Dumb multiport repeaters (hubs) are not allowed in full duplex networks. Bridges (switches) queue frames for each port in an output buffer and send them out one at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that while frames cannot collide on the wire in a full duplex ethernet network they can be dropped if the buffers overflow either because of a speed change or because multiple sources are sending to the same destination.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-04-21T00:07:55.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29793" PostTypeId="1" AcceptedAnswerId="29917" CreationDate="2016-04-21T02:27:26.920" Score="2" ViewCount="6052" Body="&lt;p&gt;I'm trying to solve a problem here...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a gateway, a switch, and three APs with matching vlans configured with tagged SSIDs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN 1 - Default (We don't use this--no SSID)&#xA;VLAN 2 - Admin&#xA;VLAN 4 - Operations&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The gateway connects to the switch on port 46 and three APs are on ports 1-3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch's ports are tagged as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(T=Tagged/U=Untagged)&#xA;PORT 1  - 2T 4T (PVID 2)&#xA;PORT 2  - 2T 4T (PVID 2)&#xA;PORT 3  - 2T 4T (PVID 2)&#xA;PORT 46 - 2T 4T (PVID 2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The gateway is configured to tag all traffic on all ports except for VLAN 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this configuration the users on the APs are unable to communicate with the gateway on port 46. As such, no IP addresses are being distributed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I change the configuration to make VLAN 2 untagged then the AP users can connect to the gateway, but they are treated as being on VLAN 2 no matter what. That would look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(T=Tagged/U=Untagged)&#xA;PORT 1  - 2U 4T (PVID 2)&#xA;PORT 2  - 2U 4T (PVID 2)&#xA;PORT 3  - 2U 4T (PVID 2)&#xA;PORT 46 - 2T 4T (PVID 2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I missing something here or is this a case of misbehaving equipment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: Here are the models of equipment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway: Linksys LRT224&#xA;Switch: Dell PC 2748&#xA;APs: Engenius EAP350&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To answer the question that you &lt;em&gt;must&lt;/em&gt; be asking... Most of this was donated to the non-profit that I'm working for so we didn't get any say in what we're using here. Just trying to make the best of it! ;-)&lt;/p&gt;&#xA;" OwnerUserId="24754" LastEditorUserId="24754" LastEditDate="2016-04-22T01:59:54.647" LastActivityDate="2016-04-24T20:35:10.617" Title="VLAN tagging between switch and router" Tags="|switch|vlan|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29798" PostTypeId="1" CreationDate="2016-04-21T06:31:26.280" Score="1" ViewCount="192" Body="&lt;p&gt;Is there a limitation in the number of access switches can be connected to HP 10xxx in the core with IRF configuration?&lt;/p&gt;&#xA;" OwnerUserId="22114" LastActivityDate="2016-08-23T18:43:24.883" Title="HP IRF and number of access switches" Tags="|hp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29802" PostTypeId="2" ParentId="18532" CreationDate="2016-04-21T06:58:47.030" Score="-1" Body="&lt;p&gt;packet --- when data is in layer 3 we call it as packet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;frame ---- when data sent from layer 3 to layer 2 (data link) we call it as frame&lt;/p&gt;&#xA;" OwnerUserId="24734" LastActivityDate="2016-04-21T06:58:47.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29803" PostTypeId="1" AcceptedAnswerId="29804" CreationDate="2016-04-21T07:29:23.550" Score="1" ViewCount="432" Body="&lt;p&gt;I'm currently learning the reference models. It's said that TCP/IP supports only connectionless communication in the Internet Layer but both connectionless and connection-oriented in the Transport Layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what happens when a TCP segment goes through the Internet Layer? Does the Internet Layer simply cares nothing about the sequence at the sender, and then handle all these stuff by the Transport Layer at the receiver?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm really confused. Any help will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="24764" LastEditorUserId="8499" LastEditDate="2018-03-18T21:41:37.197" LastActivityDate="2018-03-18T21:41:37.197" Title="How does a TCP segment go through the Internet Layer in TCP/IP?" Tags="|ip|tcp|osi|layer3|layer4|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29804" PostTypeId="2" ParentId="29803" CreationDate="2016-04-21T08:19:30.703" Score="2" Body="&lt;p&gt;When the &lt;em&gt;TCP segment&lt;/em&gt; is passed to the lower level (&lt;em&gt;IP&lt;/em&gt;) it does the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Packetize the segment (break it in chunks).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check where is the IP destination address using ARP if the destination is in the same subnet or through the default gateway if it is on another subnet).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Form packets with the chunks of TCP segment putting correctly the source and destination IP address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Internet Layer doesn't understand or care if the original data is TCP, UDP, ICMP or other thing. It simply sends the data.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2016-04-21T08:19:30.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29807" PostTypeId="1" AcceptedAnswerId="29814" CreationDate="2016-04-21T09:12:29.823" Score="1" ViewCount="184" Body="&lt;p&gt;My main problem started when i installed 4 &lt;code&gt;gigabit&lt;/code&gt; &lt;code&gt;NIC&lt;/code&gt; into my computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 4 &lt;code&gt;NIC&lt;/code&gt; are connected to &lt;code&gt;GB&lt;/code&gt; &lt;code&gt;linksys&lt;/code&gt; switches, each in different location,1 of the 4 gives &lt;code&gt;GB&lt;/code&gt; and the others are stuck on &lt;code&gt;100 mbs&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i move the cable of the &lt;code&gt;GB&lt;/code&gt; to another &lt;code&gt;NIC&lt;/code&gt; the other &lt;code&gt;NIC&lt;/code&gt; change to &lt;code&gt;GB&lt;/code&gt;, so i checked all the cable using digital network tester, but it seems all the cables are good.&#xA;I tried to change the switches, same problem, so what do you suggest?&lt;/p&gt;&#xA;" OwnerUserId="24767" LastEditorUserId="8499" LastEditDate="2018-12-23T05:14:05.847" LastActivityDate="2018-12-23T05:14:05.847" Title="Gigabit NIC stuck on 100mbs" Tags="|switch|ethernet|layer1|cable|interface|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29808" PostTypeId="1" CreationDate="2016-04-21T09:33:56.810" Score="1" ViewCount="490" Body="&lt;p&gt;Can the Cisco 3650 do the job of distribution/core layer? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have at least 250 devices that will be connected to the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More info :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco 3650 is needed for inter-vlan routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gcxMT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gcxMT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24768" LastEditorUserId="8499" LastEditDate="2018-12-23T05:16:02.927" LastActivityDate="2018-12-23T05:16:02.927" Title="Network distribution/core design implementation" Tags="|cisco|switch|cisco-catalyst|network-core|design|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29809" PostTypeId="2" ParentId="29808" CreationDate="2016-04-21T09:41:42.480" Score="0" Body="&lt;p&gt;IMO, it is not a core/distribution switch. It is an access switch with integrated wireless controller and it also support PoE. However without complete requirement it is not possible to comment on this.&lt;/p&gt;&#xA;" OwnerUserId="22114" LastActivityDate="2016-04-21T09:41:42.480" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29810" PostTypeId="2" ParentId="29807" CreationDate="2016-04-21T10:43:12.050" Score="0" Body="&lt;p&gt;What is the make and model of the cable tester? I bet it's not a cable certifier, so it won't tell you if the cable is of sufficient quality to support gigabit connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need better cables.&lt;/p&gt;&#xA;" OwnerUserId="2128" LastActivityDate="2016-04-21T10:43:12.050" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29812" PostTypeId="1" AcceptedAnswerId="29815" CreationDate="2016-04-21T11:51:49.257" Score="2" ViewCount="5158" Body="&lt;p&gt;We have 2 internet connections coming in to our building - neither are great (2 different routers from different providers). Are there technologies in  Network Switches to support active switching or load balancing across the two connections? I know this maybe standard but I am not familiar with the names of the protocols to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we want to achieve is for the switch to automatically send data down connection A if connection B if it is not performing well, and vise-versa. Equally if both connections are performing for the load to be split between both connections? Crucially though, for it to do this without manual intervention all the time. And lastly if we can also set what type of traffic should be prioritised and/or by the device on the network (so for example people cabled computers take precedence over mobile phones).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure this is common knowledge but I need to start somewhere. Searching on Google just gives lot of manuals to various switches but I need that basic understanding first, so anything which could aid that learning would be helpful.&lt;/p&gt;&#xA;" OwnerUserId="24774" LastEditorUserId="8499" LastEditDate="2019-01-04T22:13:34.220" LastActivityDate="2024-01-31T07:53:03.030" Title="Managing multiple internet connections to a single switch" Tags="|routing|switch|router|internet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29814" PostTypeId="2" ParentId="29807" CreationDate="2016-04-21T12:01:45.873" Score="0" Body="&lt;p&gt;after hours of troubleshooting and testing, i changed the whole cable despite the cable tester shows that nothing wrong with it, and despite it was working , but showing 100 mbs, but for no reason i known after changing the cable the NIC shows GB, thanks&lt;/p&gt;&#xA;" OwnerUserId="24767" LastActivityDate="2016-04-21T12:01:45.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29815" PostTypeId="2" ParentId="29812" CreationDate="2016-04-21T12:53:41.983" Score="2" Body="&lt;p&gt;Yes, there are devices which can load balance and/or provide fail-over, but specific product and resource recommendations are explicitly off-topic here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will want to be very careful about load balancing. You will get out-of-order packet delivery and asymmetric routing, which can cause problems and actually slow your Internet speed. This will also break NAT unless you have a public IPv4 address which both ISPs will route. Getting your own block of IPv4 addresses can be costly, and it requires both ISPs to cooperate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it sounds like a good idea on the surface, this is not something you should attempt unless you really know what you are doing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-21T12:53:41.983" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29816" PostTypeId="2" ParentId="29807" CreationDate="2016-04-21T12:57:41.940" Score="1" Body="&lt;p&gt;The reason that your 1000BASE-T interfaces connect using 100BASE-TX is that your cables are not correctly built. 1000BASE-T requires all four pairs to be correctly wired, while 100BASE-TX only requires two pairs. Using a two-pair cable on 1000BASE-T will cause it to negotiate to 100BASE-TX.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-21T12:57:41.940" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29817" PostTypeId="2" ParentId="29803" CreationDate="2016-04-21T13:01:53.427" Score="2" Body="&lt;p&gt;TCP is a layer-4 protocol. It breaks your application data into segments, and it applies  headers to the segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your layer-3 protocol (IP) will then encapsulate the segments into packets, and it applies the layer-3 headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your layer-2 protocol (probably ethernet) will then encapsulate the packets into frames, and it will apply frame headers to the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-1 will the turn the resulting frames into bits on the wire.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-21T13:01:53.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29819" PostTypeId="1" CreationDate="2016-04-21T13:49:34.160" Score="0" ViewCount="813" Body="&lt;p&gt;I have two routers, named Router0 and Router1, that are connect to a switch on ports &lt;code&gt;FA0/1&lt;/code&gt; and &lt;code&gt;FA0/2&lt;/code&gt;, respectively. Now lets say this network has an address of &lt;code&gt;201.201.201.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would the IP host address of both router interfaces that connect to this switch be the same, e.g. &lt;code&gt;.1&lt;/code&gt; for Router0 &lt;code&gt;FA0/0&lt;/code&gt;, and &lt;code&gt;.1&lt;/code&gt; for Router1 &lt;code&gt;FA0/0&lt;/code&gt;, or would the Router1 interface be &lt;code&gt;.2&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know in the real world, if you're connecting countries, you would not use this setup as its not ideal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/P5e9c.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/P5e9c.png&quot; alt=&quot;network with cisco packet tracer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24778" LastEditorUserId="8499" LastEditDate="2016-04-21T18:52:48.520" LastActivityDate="2023-04-26T10:02:55.337" Title="Two routers connected to a switch= same IP host address?" Tags="|router|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29823" PostTypeId="1" AcceptedAnswerId="29858" CreationDate="2016-04-21T14:33:15.570" Score="4" ViewCount="2760" Body="&lt;p&gt;I understand seq/ack is used to provide a reliable connection service. But it seems that during TCP data transmission the ACK bit is &lt;strong&gt;ALWAYS&lt;/strong&gt; set, as demonstrated in the following picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose A has just acked a packet from B, and now A wants to send something to B. What is the point of A setting the ACK bit and ACK number, which are already known to B?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A related question: wouldn't it be more clear to always separate ACK control segment from data segment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pic from internet:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aVMVB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aVMVB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24749" LastEditorUserId="2142" LastEditDate="2018-01-07T12:51:11.943" LastActivityDate="2019-03-10T19:08:16.293" Title="Why is TCP acknowledging all the time?" Tags="|tcp|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29824" PostTypeId="2" ParentId="29819" CreationDate="2016-04-21T14:35:47.960" Score="1" Body="&lt;p&gt;Devices on the same IP network must have different addresses. Your routers' &lt;code&gt;f0/0&lt;/code&gt; interfaces will be in the same network, so they will need to have different addresses. The addresses can be any of the usable network addresses, e.g. &lt;code&gt;201.201.201.1&lt;/code&gt; to &lt;code&gt;201.201.201.254&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-21T15:43:42.403" LastActivityDate="2016-04-21T15:43:42.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29825" PostTypeId="2" ParentId="29793" CreationDate="2016-04-21T14:56:43.440" Score="0" Body="&lt;p&gt;I think you misunderstand VLAN tagging. Frames should be tagged on a trunk link, for example, router-to-switch or switch-to-switch, but you don't normally tag frames on access ports since most end-devices don't understand VLAN tags. You set the VLAN for the access ports, but you don't tag frames on the access ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs are tagged on trunk links in order to distinguish the traffic for each VLAN on links where multiple VLANs are traversing, but an access link only has a single VLAN, so VLAN tags are unnecessary.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-21T14:56:43.440" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29826" PostTypeId="2" ParentId="29823" CreationDate="2016-04-21T15:06:53.077" Score="1" Body="&lt;p&gt;The ACK bit is continuously used as part of the process of transferring data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the purpose of TCP is to be a reliable protocol, it has to have some way to acknowledge that all pieces of data were correctly received. The ACK associated with the Acknowledgment number is used to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.ietf.org/rfc/rfc793.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC793&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Reliability:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The TCP must recover from data that is damaged, lost, duplicated, or&#xA;delivered out of order by the internet communication system.  This&#xA;is achieved by assigning a sequence number to each octet&#xA;transmitted, and requiring a positive acknowledgment (ACK) from the&#xA;receiving TCP.  If the ACK is not received within a timeout&#xA;interval, the data is retransmitted.  At the receiver, the sequence&#xA;numbers are used to correctly order segments that may be received&#xA;out of order and to eliminate duplicates.  Damage is handled by&#xA;adding a checksum to each segment transmitted, checking it at the&#xA;receiver, and discarding damaged segments.&#xA;&#xA;As long as the TCPs continue to function properly and the internet&#xA;system does not become completely partitioned, no transmission&#xA;errors will affect the correct delivery of data.  TCP recovers from&#xA;internet communication system errors.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Flow Control:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TCP provides a means for the receiver to govern the amount of data&#xA;sent by the sender.  This is achieved by returning a &quot;window&quot; with&#xA;every ACK indicating a range of acceptable sequence numbers beyond&#xA;the last segment successfully received.  The window indicates an&#xA;allowed number of octets that the sender may transmit before&#xA;receiving further permission.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="29756" LastEditDate="2016-12-15T05:52:40.777" LastActivityDate="2016-12-15T05:52:40.777" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29827" PostTypeId="2" ParentId="29808" CreationDate="2016-04-21T15:32:43.560" Score="3" Body="&lt;p&gt;The 3650 will switch layer-2 at wire speed, even if you have it fully populated. You cannot get more traffic into the switch than it has ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to routing, there are too many variables to answer with the little information you have provided. Certainly, any configuration which causes the routing to be process switched will severely impact performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A problem you will have is the access to distribution bandwidth ratio, but this will be a concern with any distribution switch. You don't say over how many access switches the user will be spread, but let's assume six 48-port access switches connected to you distribution switch. That gives you just over 40 users per switch. If the users ports are 1 Gbps ports, that means that you should have, at least, 2 Gbps uplinks from each access switch to the distribution switch in order to meet Cisco's recommendation of a 20:1 access to distribution bandwidth ratio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next bandwidth ratio you need to worry about is the distribution to core bandwidth ratio. Cisco recommends this be no more than 4:1. For each 4 Gbps bandwidth coming into your distribution, you need at least 1 Gbps from the distribution to the network core.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether or not a 3650 will meet your needs depends on how you configure your network topology, and what sort of routing controls you use, but it could work in some cases with 250 users. I have seen the Cisco 3K switches used as distribution switches for a lot more than 250 users with no problems. You just need to carefully plan the use.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-21T19:30:08.360" LastActivityDate="2016-04-21T19:30:08.360" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29828" PostTypeId="1" AcceptedAnswerId="29830" CreationDate="2016-04-21T15:39:55.107" Score="1" ViewCount="92" Body="&lt;p&gt;If I have ten servers, each with 100BASE-TX ethernet network cards, and I place a 1000BASE-T network switch between them, all servers are communicating as fast as they can, will the switch be handling at its capacity, or is it only bound to the network capacity of the 100BASE-TX ethernet cards, resulting in the switch operating at 100BASE-TX speed?&lt;/p&gt;&#xA;" OwnerUserId="24784" LastEditorUserId="8499" LastEditDate="2016-04-21T19:03:39.000" LastActivityDate="2016-04-21T19:03:39.000" Title="How to leverage a gigabit switch on a network without gigabit devices?" Tags="|switch|ethernet|speed|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29829" PostTypeId="2" ParentId="29828" CreationDate="2016-04-21T15:50:36.060" Score="1" Body="&lt;p&gt;Each switch port will operate at the speed of the established link on that port. The ports are independent of each other when it comes to negotiating the speed. Ports where devices have connected at 1 Gbps will operate at 1 Gbps, but ports where devices have connected at 100 Mbps will only operate at 100 Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where you introduce a bottleneck (e.g. traffic coming in a port at 1 Gbps, or multiple 100 Mbps ports, destined to single port which only has a 100 Mbps connection), you will probably drop a lot of frames. This can't be helped, and it is the way switches work.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-21T19:01:05.533" LastActivityDate="2016-04-21T19:01:05.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29830" PostTypeId="2" ParentId="29828" CreationDate="2016-04-21T16:01:25.660" Score="2" Body="&lt;p&gt;The secondary limitation in how a network switch performs (primary being the link rate between the switch and the device) is the switch fabric speed (usually expressed in gigabits) and packet forwarding rate (in millions of packets/sec).  If all devices are connected at 100mbps not many modern switches would still have a bottleneck (they usually anticipate something close to the total of all ports at highest speed.)  To directly answer your question: the switch will not constrain the traffic or act in a derated manner, the switch fabric speed operates independently of the link rates of any of the attached devices.&lt;/p&gt;&#xA;" OwnerUserId="6361" LastActivityDate="2016-04-21T16:01:25.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29832" PostTypeId="1" CreationDate="2016-04-21T17:15:08.990" Score="0" ViewCount="854" Body="&lt;p&gt;I have just started network programming and I am a bit confused Does the read and write operations behavior {in regards to blocking or not} change depending if we have a regular file descritpor or a socket descriptor (UDP socket or TCP socket).&lt;/p&gt;&#xA;" OwnerUserId="23751" LastActivityDate="2016-04-21T17:56:47.560" Title="Blocking vs Non blocking IO?" Tags="|udp|" AnswerCount="1" CommentCount="1" ClosedDate="2016-04-21T18:56:38.597" ContentLicense="CC BY-SA 3.0" />
  <row Id="29833" PostTypeId="2" ParentId="29832" CreationDate="2016-04-21T17:56:47.560" Score="1" Body="&lt;p&gt;Blocking I/O&#xA;*  here the calling system does not return control to the caller&#xA;until the operation finished.&#xA;*as for a result, the caller is blocked and&#xA;cannot perform other activities during that specified time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Non-blocking Synchronous I/O&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*here  call returns control to the caller immediately and the&#xA;caller  not made to wait.&#xA;* The invoked system immediately returns one&#xA;of two responses:&#xA;. If the call was executed and the results were ready,&#xA;then the caller is told of that. Alternatively, the invoked system can&#xA;tell the caller that the system has no resources (no data in the&#xA;socket) to perform the requested action.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Non-blocking Asynchronous I/O&#xA;*means that the calling function returns control to the caller&#xA;immediately, reporting that the requested action was started. &#xA;*here&#xA;invoked system will notify the caller (by callback for example), when&#xA;the result is ready for processing.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="24793" LastActivityDate="2016-04-21T17:56:47.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29835" PostTypeId="1" AcceptedAnswerId="29836" CreationDate="2016-04-21T18:09:24.223" Score="0" ViewCount="48" Body="&lt;p&gt;Could someone please help me with this doubt I have regarding how the &lt;strong&gt;Bit Rate is decided for a network/link because for the maximum bit rate one need to be aware of the channel/link bandwidth,right?So how does,say a MODEM/ or any transmitting device&lt;/strong&gt; figure out the bandwidth of the link based on which it can then fix the symbols,levels or bit rate etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="24792" LastActivityDate="2016-04-21T18:40:08.650" Title="What decides the Bit Rate on a channel/link?" Tags="|routing|switch|ethernet|lan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29836" PostTypeId="2" ParentId="29835" CreationDate="2016-04-21T18:40:08.650" Score="1" Body="&lt;p&gt;A general answer for a general question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modem (or other device) tries the highest speed it can.  If that doesn't work, it tries it's next lowest speed, and so on, until it finds a speed that works.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-21T18:40:08.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29837" PostTypeId="1" CreationDate="2016-04-21T20:55:25.570" Score="5" ViewCount="1080" Body="&lt;p&gt;Topology:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Client   -&amp;gt;       Client Router        -&amp;gt; CLOUD &amp;lt;-        Server Router          &amp;lt;- Server&#xA;10.0.1.5    10.0.1.1 &amp;lt;-NAT-&amp;gt; 100.1.1.1             200.1.1.1 &amp;lt;-NAT-&amp;gt; 192.168.1.1    192.168.1.100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have control over the server router. It has multiple routable public IP addresses - let's say 200.1.1.1 through 200.1.1.6.&lt;/li&gt;&#xA;&lt;li&gt;The server router provides NAT to all of the machines behind it. The IPsec server is running on one of the machines on the NAT network at 192.168.1.100. I have configured that router to forward &lt;em&gt;all&lt;/em&gt; traffic that it sees coming to 200.1.1.2 over to the server at 192.168.1.100. Clients would connect to 200.1.1.2.&lt;/li&gt;&#xA;&lt;li&gt;The server router is an appliance and thus it cannot run the IPsec server itself.&lt;/li&gt;&#xA;&lt;li&gt;The server itself believes its IP address to be 192.168.1.100, but as I said, it is reachable at 200.1.1.2. The router forwards only on destination IP, so IKE/ISAKMP/etc packets should be able to be forwarded directly to the server from the router.&lt;/li&gt;&#xA;&lt;li&gt;It is not possible to move the VPN server into a configuration where it has direct knowledge of its publicly routable IP. (i.e. it cannot be moved so its network interface connects directly to the Internet, but must instead remain behind the NAT and have traffic forwarded to it.)&lt;/li&gt;&#xA;&lt;li&gt;I do NOT have control over the client router. It puts all clients behind a NAT. It does have IPsec VPN Passthrough enabled.&lt;/li&gt;&#xA;&lt;li&gt;I could likely make this work with L2TP but would prefer to do pure IPsec if it is possible.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Just to eliminate the chance that I'm completely clueless, my understanding of IPsec is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;An IPsec/L2TP VPN establishes an IPsec tunnel between two endpoints. It then passes L2TP traffic over that tunnel. L2TP traffic is not encrypted, so IPsec serves as the encryption method, while L2TP serves as the &quot;VPN&quot;.&lt;/li&gt;&#xA;&lt;li&gt;A pure IPsec VPN would instead directly transmit IP packets over the IPsec tunnel. A client machine could perform a standard DHCP request over the tunnel, receive an IP address from the far end's DHCP server, and then transmit raw IP packets over the IPsec tunnel as they would appear if the client device was directly connected to the far-end LAN.&lt;/li&gt;&#xA;&lt;li&gt;In L2TP/IPsec, the L2TP server handles IP address assignments; in pure IPsec, it is just as if you plugged a LAN cable into the remote LAN and thus whatever infrastructure is there is what you connect to.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If I'm wrong, please correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there anything preventing me from doing a pure IPsec VPN in this topology? &lt;/li&gt;&#xA;&lt;li&gt;I'm using Linux and would be using the Swan series (Strongswan/Openswan perhaps) of IPsec servers. Is there a way to accomplish this using these tools? The clients would be iOS devices, Macs and possibly a couple of Windows PCs.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13884" LastActivityDate="2018-06-04T08:02:38.067" Title="Can I do a pure IPSec VPN (no L2TP) with NAT-T where the server is inside a NAT?" Tags="|vpn|ipsec|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29838" PostTypeId="2" ParentId="29837" CreationDate="2016-04-21T21:12:14.020" Score="2" Body="&lt;p&gt;Nothing prevent you to do this. The NAT-Traversal is your friend, it will encapsulate (part of) IPSEC in UDP on port 4500.&lt;/p&gt;&#xA;&lt;p&gt;You will find some information in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3715&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc3715&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3947&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc3947&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The tricky part is that you cannot use the peer IP address as the identity, (especially with StrongSwan where this is the default I think - unsure) so you must declare in your configuration the identity of each host (usually in the form of @id).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-04-21T21:12:14.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29839" PostTypeId="1" AcceptedAnswerId="29862" CreationDate="2016-04-21T21:54:22.760" Score="0" ViewCount="217" Body="&lt;p&gt;Say I've got:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a home server with a consumer fiber optic Internet connection via FTTH nearing 1gbps downstream/upstream&lt;/li&gt;&#xA;&lt;li&gt;a dedicated server with the exact same hardware specifications in a data center with a data-center-grade 1gbps downstream/upstream link to the Internet&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Which connection will be faster? Since there is more congestion at the data center, shouldn't the home connection seem faster?&lt;/p&gt;&#xA;" OwnerUserId="24798" LastActivityDate="2016-04-22T16:22:38.613" Title="What would be faster between a consumer 1gbps symmetrical Internet connection and a 1gbps data center link to the Internet?" Tags="|internet|bandwidth|speed|" AnswerCount="1" CommentCount="1" ClosedDate="2016-04-22T15:03:37.397" ContentLicense="CC BY-SA 3.0" />
  <row Id="29840" PostTypeId="1" CreationDate="2016-04-21T22:44:30.693" Score="1" ViewCount="884" Body="&lt;p&gt;I am working with a client who needs to be able to view centralized logs for dhcp binds from their multiple 4510's. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to send a log of each DHCP binding to their syslog server? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would this information be included in the usual message logging?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes to either, can you please direct me to the necessary documentation for configuring the switch to send logs of dhcp bindings to a syslog server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24799" LastActivityDate="2017-09-14T16:12:22.167" Title="Configuring Cisco 4500 series to send DHCP bind info to syslog server?" Tags="|cisco|dhcp|syslog|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29841" PostTypeId="2" ParentId="29017" CreationDate="2016-04-22T00:59:14.267" Score="-1" Body="&lt;p&gt;Unless I have a control over network, I can not find it.&lt;/p&gt;&#xA;" OwnerUserId="10188" LastActivityDate="2016-04-22T00:59:14.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29843" PostTypeId="2" ParentId="29812" CreationDate="2016-04-22T01:55:18.910" Score="2" Body="&lt;p&gt;If you are using Cisco router with both Internet connections coming in to the same router you could:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Configure both WAN interfaces&lt;/li&gt;&#xA;&lt;li&gt;Configure IP SLA&lt;/li&gt;&#xA;&lt;li&gt;Map SLA to track object&lt;/li&gt;&#xA;&lt;li&gt;Add 2X default routes matching the separate track objects removing the route if it does not meet the required criteria of the SLA probe.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The SLA functions in Cisco IOS allow you to track: (From Cisco Website)&#xA;•Connection loss&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•Timeout&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•Round-trip time threshold&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•Average jitter threshold&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•One-way packet loss&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•One-way jitter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•One-way mean opinion score (MOS)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•One-way latency &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you could essentially have both WAN interfaces active whilst removing a route if it is performing badly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/44sg/configuration/guide/Wrapper-44SG/swipsla.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/44sg/configuration/guide/Wrapper-44SG/swipsla.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24802" LastActivityDate="2016-04-22T01:55:18.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29844" PostTypeId="1" AcceptedAnswerId="29845" CreationDate="2016-04-22T02:09:11.790" Score="4" ViewCount="1659" Body="&lt;p&gt;I'm trying to understand the basic mechanics of how throttling works.  Here are two scenarios:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario 1: A hotel offers a fast and slow connection option to its guests.  Let's say the slow plan is 500Kbps.  But the hotel's ISP connection is 1Gbps.  If there is only one guest accessing the network and that guest is using the slow plan his data is presumably reaching the hotel router at a faster rate than the LAN is allowing it to be conveyed to the guest's device.  To me this implies the packets are queuing up in a sense or being cached somewhere.  Is this accurate? If so where does this queuing occur? Does it happen on the hotel network or is it more likely the ISP would be doing the throttling on the hotel's behalf&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario 2: If an ISP decides to throttle its users I would expect a similar queuing to occur at the edge of its network if the sum total of the permitted throughput on the ISP's own network is slower than the rate at which packets arrive from backbone providers or networks it is peered with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For both scenarios I'm trying to wrap my head around how the queuing or caching (not sure what is the correct term) of packets works.  I'm assuming that the packets are forced to sit in memory on networking equipment.  But that must carry a cost and overhead that I've never heard mentioned when people talk about bandwidth throttling.  And furthermore it looks to me like an external cost that the throttled network imposes on the adjacent unthrottled networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not a network engineer so doubtless I am not grasping some concepts about how throttling works.  I would be very grateful if someone would enlighten me.&lt;/p&gt;&#xA;" OwnerUserId="24801" LastActivityDate="2016-04-22T02:52:19.787" Title="How does bandwidth throttling work" Tags="|routing|bandwidth|peering|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29845" PostTypeId="2" ParentId="29844" CreationDate="2016-04-22T02:26:16.323" Score="5" Body="&lt;p&gt;Mostly, the packets get dropped. Some packets may get buffered in queues, but the queues aren't very big. Policing is probably what the hotel uses, and policing is simply dropping traffic in excess of the allowed bandwidth. With TCP (HTTP runs on TCP), the TCP will react to lost packets and slow down, shrinking the window size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even with queuing, you probably run into some variant RED (Random Early Detection), which randomly drops queued packets in order to prevent queues from filling, triggering TCP to slow down. If buffers fill and drop packets based on full buffers, different TCP flows can become synchronized (not good).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP probably just limits the actual link speed (DSL and cable can limit the number of channels available to a customer). This is the easiest thing to do.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-22T02:52:19.787" LastActivityDate="2016-04-22T02:52:19.787" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29846" PostTypeId="2" ParentId="29840" CreationDate="2016-04-22T02:42:28.533" Score="1" Body="&lt;p&gt;I don't believe there is any facility for logging details of each binding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can log when high or low thresholds are met, and you can configure the SNMP server to send traps on some events, but I don't know of any way to log details of each binding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where you would use central, full-featured DHCP server(s), instead of IOS DHCP servers. The switches could then simply use helper address(es) pointing to the central DHCP server(s) on each VLAN, so you interface configurations could be identical for this. You would just need to add a scope for each VLAN on the DHCP server(s).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-22T02:42:28.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29847" PostTypeId="1" AcceptedAnswerId="29849" CreationDate="2016-04-22T06:12:19.690" Score="0" ViewCount="88" Body="&lt;p&gt;I have  Hp V1910 switch in FIVE different areas. My aim is I want to create a multiple vlan in all switches (means 192.168.1.1/24 and 192.168.1.2/24).MY aim is to access both vlans in my computer. How it possible? If I do trunk between switch port to my lap.is it work? or please tell me how it possible&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: No need to communicate both vlans. Only I need access both network in my PC.Is it possible in this HP model Switches? IS work this Scenario?&lt;/p&gt;&#xA;" OwnerUserId="24225" LastActivityDate="2016-05-11T18:18:55.683" Title="V-lan routing.Need access both vlan from single computer" Tags="|vlan|switching|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29848" PostTypeId="1" CreationDate="2016-04-22T06:21:56.947" Score="1" ViewCount="2317" Body="&lt;p&gt;I am having 2 VLAN &lt;br&gt;&#xA;VLAN1 - IP range 192.168.1.100 to 192.168.1.149 subnet 255.255.255.0 i.e. I have 50 host in VLAN1&lt;br&gt;&#xA;VLAN2 - IP range 192.168.1.200 to 192.168.1.249 subnet 255.255.255.0 i.e. I have another 50 host in VLAN2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want to communicate in between the above 2 VLAN, for that I can place router with multiple sub interface equal to number of VLAN's i.e. in our case 2. The issue is that same subnet IP cannot be assigned to different sub-interface over the router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a solution to this I see many tutorials using complete different set of IP having differing by subnet. But then what is point to subnet, since we already have altered the subnet. That can be done any way even without VLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the solution keeping same subnet IP's. Do share some tutorial or configured .cpt file.&lt;/p&gt;&#xA;" OwnerUserId="24804" LastEditorUserId="24804" LastEditDate="2016-04-22T08:36:07.223" LastActivityDate="2016-04-22T15:41:19.790" Title="Inter VLAN Routing with same subnet IP" Tags="|vlan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29849" PostTypeId="2" ParentId="29847" CreationDate="2016-04-22T06:30:30.400" Score="2" Body="&lt;p&gt;Yes it's possible, all modern operating system (I.E. Linux, Windows, MacOS) can handle VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will have to create 2 virtual adapter on your computer. The exact method depends of your operating system but a quick internet search will easily lead you to methods to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to retain reliable network (Internet) access you will configure a gateway only on one of this adapter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that configuring PCs is out of scope here, so we will not help you further on this specific task. But if needed you may ask on &lt;a href=&quot;https://superuser.com/&quot;&gt;superuser&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2017-03-20T10:04:42.970" LastActivityDate="2016-04-22T06:30:30.400" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29850" PostTypeId="2" ParentId="29848" CreationDate="2016-04-22T06:52:53.240" Score="2" Body="&lt;p&gt;There's some confusion here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose you wanted to say :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN1 IP range 192.168.1.100 - 199   &#xA;VLAN2 IP range 192.168.1.200 - 299&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First the IP range 192.168.1.200 - 299 doesn't exist, an IP address cannot be higher than x.x.x.255.&#xA;IP addresses are binary numbers, coded on 32 bits. &#xA;The decimal representation &quot;192.168.1.200&quot; is just that, a representation of a binary number, made to be more conveniently handled by human.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fourth number in the decimal notation correspond to the last 8 bits in binary. 8 bits in binary give 256 value in decimal, thus 0 -&gt; 255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second routing deal with networks / subnetworks, not IP range, and those network are also truly expressed in binary, so they are bound by power of 2 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.100 to 199 doesn't correspond to a network so you can't route this sole specific network range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0/24 is a network that contains 256 IP addresses and can be divided for example in 4 subnets like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.0/26 I.E. 192.168.1.0 to 63&#xA;192.168.1.64/26 I.E. 192.168.1.64 to 127&#xA;192.168.1.128/26 I.E. 192.168.1.128 to 192.168.1.191&#xA;192.179.1.192/26 I.E. 192.168.1.192 to 192.168.1.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You need to redesign your addressing to fit in actual networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will find more information about subnet in this excellent answer :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/16930&quot;&gt;How do you calculate the prefix, network, subnet, and host numbers?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;br&gt;&#xA;if you want to have 2 VLANs with 50 host in each you can use:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN1 with network 192.168.1.0/26&lt;br&gt;&#xA;VLAN2 with network 192.168.1.64/26 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On your router you set:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN1 interface with IP 192.168.1.1 , subnet mask 255.255.255.192&lt;/li&gt;&#xA;&lt;li&gt;VLAN2 interface with IP 192.168.1.65, subnet mask 255.255.255.192&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In the first vlan you can use IP addresses 192.168.1.2 to 192.168.1.62, so 61 possible hosts&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the second vlan you can use IP addresses 192.168.1.66 to 192.168.1.126, so again 61 possible hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Why 61 and not 64?&lt;/em&gt;&lt;br&gt;&#xA;Well first it's actually 62, since the router IS a host  but you usually don't count it as a machine that can be connected in the network.&lt;br&gt;&#xA;Second the network address and the broadcast address are reserved and cannot be used by hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once again you CANNOT decide to have a (sub)network that has an arbitrary number of IP (like 50), it's always a power of 2 size (minus the network and broadcast address).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-04-22T09:18:08.020" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29852" PostTypeId="2" ParentId="5110" CreationDate="2016-04-22T08:12:52.603" Score="1" Body="&lt;p&gt;Mike!  Thank you for sharing this!&#xA;I used this workaround with twice NAT, and it works also!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have twice NAT  (ASA OS v 9.5):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;nat (outside,inside) source dynamic ANY X destination GroupM GroupN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I have group of servers &quot;GroupN&quot; on my inside and I NAT them to outside to IP addresses &quot;GroupM&quot;. Clients from outside (any) can access my servers and when external clients go through ASA their sources are replaced to IP address X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here isn't possible to use dns  keyword. But with your workaround I've created set of auxiliary object NATs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network My_Server1_on_Inside&#xA; host &amp;lt;NATed IP of Server1&amp;gt;&#xA; nat (outside,inside) static &amp;lt;Real IP of server1&amp;gt; dns&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;AND I've got DNS doctoring working correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, Cisco in it's documentation says that this task is impossible :)&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115753-dns-doctoring-asa-config.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115753-dns-doctoring-asa-config.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best Regards,&#xA;Sergey&lt;/p&gt;&#xA;" OwnerUserId="24807" LastEditorUserId="24807" LastEditDate="2016-04-22T08:22:40.100" LastActivityDate="2016-04-22T08:22:40.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29854" PostTypeId="1" AcceptedAnswerId="29857" CreationDate="2016-04-22T09:15:56.220" Score="1" ViewCount="18991" Body="&lt;p&gt;How can I use 1.1.1.35 as gateway to reach 2.2.2.168/29 (.248) with the configuration below? I can ping 1.1.1.35 so it is reachable. When I traceroute it it uses gateway 1.1.1.1.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# route -n&#xA;Kernel IP routing table&#xA;Destination     Gateway         Genmask         Flags Metric Ref    Use Iface&#xA;0.0.0.0         1.1.1.1         0.0.0.0         UG    0      0        0 eth1&#xA;10.30.2.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0&#xA;10.40.2.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0&#xA;10.50.2.0       0.0.0.0         255.255.255.0   U     0      0        0 eth0&#xA;192.168.200.100 10.40.2.1       255.255.255.255 UGH   0      0        0 eth0&#xA;192.168.200.101 10.40.2.1       255.255.255.255 UGH   0      0        0 eth0&#xA;192.168.200.102 10.40.2.1       255.255.255.255 UGH   0      0        0 eth0&#xA;1.1.1.0         0.0.0.0         255.255.255.224 U     0      0        0 eth1&#xA;&#xA;# ip route list&#xA;default via 1.1.1.1 dev eth1 &#xA;10.30.2.0/24 dev eth0  scope link &#xA;10.40.2.0/24 dev eth0  proto kernel  scope link  src 10.40.2.36 &#xA;10.50.2.0/24 dev eth0  scope link &#xA;192.168.200.100 via 10.40.2.1 dev eth0 &#xA;192.168.200.101 via 10.40.2.1 dev eth0 &#xA;192.168.200.102 via 10.40.2.1 dev eth0 &#xA;1.1.1.0/27 dev eth1  proto kernel  scope link  src 1.1.1.10 &#xA;&#xA;eth0      Link encap:Ethernet  HWaddr ..... &#xA;          inet addr:10.40.2.36  Bcast:10.40.2.255  Mask:255.255.255.0&#xA;&#xA;eth1      Link encap:Ethernet  HWaddr .....  &#xA;          inet addr:1.1.1.10  Bcast:1.1.1.31  Mask:255.255.255.224&#xA;          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1&#xA;&#xA;root@mymachine:~# route add -net 2.2.2.168 netmask 255.255.255.248 gateway 1.1.1.35&#xA;SIOCADDRT: Network is unreachable&#xA;&#xA;traceroute to 1.1.1.35 (1.1.1.35), 30 hops max, 60 byte packets&#xA; 1  1.1.1.1 (1.1.1.1)  0.224 ms  0.207 ms  0.194 ms&#xA; 2  * * *&#xA; 3  * * *&#xA;&#xA;PING 1.1.1.35 (1.1.1.35) 56(84) bytes of data.&#xA;64 bytes from 1.1.1.35: icmp_seq=1 ttl=63 time=0.362 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24368" LastActivityDate="2016-04-22T12:24:08.753" Title="Static Routing SIOCADDRT: Network is unreachable" Tags="|routing|ipv4|ip|" AnswerCount="1" CommentCount="3" ClosedDate="2016-04-22T14:59:25.617" ContentLicense="CC BY-SA 3.0" />
  <row Id="29856" PostTypeId="1" AcceptedAnswerId="29861" CreationDate="2016-04-22T11:45:49.587" Score="1" ViewCount="325" Body="&lt;p&gt;I have several Cisco 2960 switches here, all configured for RSTP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;15.0(2)SE6&#xA;C2960-LANBASEK9-M&#xA;&#xA;spanning-tree mode rapid-pvst&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Topology is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S1 -- S2 -- S4&#xA;  \        /&#xA;   \__S3__/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I change the bridge ID on S3 so that it will become root bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then have the following debug output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Apr  7 12:25:27.173: RSTP(1): updt roles, received superior bpdu on Gi0/2&#xA;Apr  7 12:25:27.173: RSTP(1): Gi0/1 is now root port&#xA;Apr  7 12:25:27.173: RSTP(1): Gi0/2 blocked by re-root&#xA;Apr  7 12:25:27.173: RSTP(1): Gi0/2 is now designated&#xA;Apr  7 12:25:27.182: STP[1]: Generating TC trap for port GigabitEthernet0/1&#xA;Apr  7 12:25:27.182: RSTP(1): updt roles, received superior bpdu on Gi0/1&#xA;Apr  7 12:25:27.182: RSTP(1): we become the root bridge&#xA;Apr  7 12:25:27.182: RSTP(1): Gi0/1 is now designated&#xA;Apr  7 12:25:27.182: RSTP(1): transmitting a proposal on Gi0/2&#xA;Apr  7 12:25:27.190: RSTP(1): received an agreement on Gi0/2&#xA;Apr  7 12:25:27.199: STP[1]: Generating TC trap for port GigabitEthernet0/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At which point in this log is the RSTP process finished and will start forwarding frames again? My thought is at 27.190, a total of 13 ms. Is this assumption correct or is the last line in the log still part of the RSTP process?&lt;/p&gt;&#xA;" OwnerUserId="24815" LastEditorUserId="24815" LastEditDate="2016-04-22T11:51:12.013" LastActivityDate="2016-04-22T14:26:15.240" Title="Cisco 2960: RSTP finished when?" Tags="|cisco|switch|spanning-tree|cisco-2960|ieee-802.1w|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="29857" PostTypeId="2" ParentId="29854" CreationDate="2016-04-22T12:24:08.753" Score="3" Body="&lt;p&gt;When you use static routing, you need to provide the next hop to the destination, and &lt;code&gt;1.1.1.35&lt;/code&gt; can't be the next hop from your host, since your host is not on the same network as &lt;code&gt;1.1.1.35&lt;/code&gt;. You can't dictate a multihop path through a network from your host; you can only tell it the next hop to use, and the next hop must either be directly connected to the destination, or it must have a next hop toward the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have &lt;code&gt;1.1.1.1&lt;/code&gt; as the default gateway, which will be used for any &lt;em&gt;off-net&lt;/em&gt; destination (any destination &lt;em&gt;not&lt;/em&gt; in the same network as &lt;code&gt;1.1.1.0/27&lt;/code&gt;, which is your network on &lt;code&gt;eth1&lt;/code&gt;). You can't use a gateway which is not directly reachable from your host because you can't get a layer-2 (MAC) address for a host or gateway not directly connected to your host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to provide a route to &lt;code&gt;2.2.2.168/29&lt;/code&gt; (which, by the way, doesn't include &lt;code&gt;2.2.2.248&lt;/code&gt;) on the &lt;code&gt;1.1.1.1&lt;/code&gt; gateway which points to &lt;code&gt;1.1.1.35&lt;/code&gt;, assuming &lt;code&gt;1.1.1.35&lt;/code&gt; is directly attached to &lt;code&gt;1.1.1.1&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-22T12:24:08.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29858" PostTypeId="2" ParentId="29823" CreationDate="2016-04-22T13:58:23.997" Score="3" Body="&lt;p&gt;acks themselves are not acknowledged - so your notion that the peer already knows the information in the seemingly redundant ack is not necessarily true.. and its free to encode it this way, so doing so helps prevent retrasmissions from lost acks at no cost.&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-04-22T13:58:23.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29859" PostTypeId="2" ParentId="7157" CreationDate="2016-04-22T14:04:13.067" Score="2" Body="&lt;p&gt;(this post is in the context of Ethernet, other procols may vary)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What criteria is used to know the boundaries of a collision domain?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A collision domain is an area of a network where collisions can happen and where only one packet may be successfully transmitted at a time. It passes through repeaters (hubs) but not through bridges (switches).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All half duplex ethernet connections are part of a collision domain, that domain may be limited to a single physical layer connection (which may be either point to point or multipoint) or it may pass through repeaters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full duplex connections must be point to point and can't connect to a repeater. In this case there is simply no possibility of collison and hence no collision domain.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does an ethernet switch break up a collision domain?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Repeaters (hubs) work at a low level, they do not have the ability to buffer frames or to identify the intended destinition of a frame. So if they detect a collision then all they can do is output jam signals to ensure every device in the collision domain sees the collision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bridges (switches) work at a higher level. They process complete frames and forward them based on destination mac address. If a bridge detects a collision it will perform the CSMA/CD procedure just like an end device would. There is no need to repeat the collision out of other ports.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are broadcast domains and collision domains mutually exclusive?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They are different concepts at different layers. A broadcast domain may cover multiple collision domains, or (if all the links are full duplex) there may be no collision domains at all but there is still a broadcast domain.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-04-22T18:00:58.923" LastActivityDate="2016-04-22T18:00:58.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29860" PostTypeId="2" ParentId="2420" CreationDate="2016-04-22T14:16:04.503" Score="0" Body="&lt;p&gt;At a low level the big indicator of duplex mismatches is large numbers of &quot;late collisions&quot; reported on the half duplex end of the link. The full duplex end is unlikely to show errors. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At a higher level a common indicator of duplex mismatch is that pings work but more complex stuff either fails completely or works with abysmal performance. Protocols like TCP will try to send data in both directions at the same time, on a correctly operating full duplex link this obviously works fine, on a correctly operating half duplex link it also works fine as ethernet will buffer the packets until the line is free but on a duplex mismatched link it's practically gauranteed to result in late collisions and hence dropped packets.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-04-22T14:16:04.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29861" PostTypeId="2" ParentId="29856" CreationDate="2016-04-22T14:26:15.240" Score="0" Body="&lt;p&gt;I think you mean to ask when the switches have all converged. STP, including RSTP` is an ongoing process. BPDUs are being sent and received all the time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will begin forwarding on G0/2 when it becomes a designated port at 12:25:27.173, and you will begin forwarding on G0/1 when it becomes a designated port at 12:25:27.182 None of that means the switches on the other end of those links aren't still blocking for a few more milliseconds, which appears to be the case for the switch connected to G0/2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without looking at the other switches, you cannot tell when they have all converged, which may take just a little longer than S3. With what you have provided, you can't tell when they are all in agreement.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-22T14:26:15.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29862" PostTypeId="2" ParentId="29839" CreationDate="2016-04-22T14:31:30.003" Score="0" Body="&lt;p&gt;It's really down to the individual providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Residential links are often shared at the pysical layer (PON), datacenter links are usually point to point. So that's a point in favor of the datacenter. Unlikely to be very significant in practice though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real question is what is happening further back in the network. A high quality provider will manage their network such that there is enough spare capacity that links rarely get saturated and customers can max out their connections (this generally means that their internal links should be faster than their fastest customer link, e.g. if they have gigabit customer their internal links should be 10 gigabit or better). They will set their pricing such that this is sustainable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A provider that provides unmetered service at a bargin basement price on the other hand is more likely to leave links congested. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Size of the provider can also matter, a big provider is more likely to have direct peering links to other big providers but on the other hand they are more likely to let peering politics stand in the way of providing a high quality service to their customers.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-04-22T16:22:38.613" LastActivityDate="2016-04-22T16:22:38.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29863" PostTypeId="1" AcceptedAnswerId="29864" CreationDate="2016-04-22T14:56:14.757" Score="1" ViewCount="1271" Body="&lt;p&gt;I am curious as to whether udp multicast creates a lot of unnecessary traffic on an internal LAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume the obvious answer to me is yes, but is it enough to congest the switch and slow down all other traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If machines are using DHCP and IP addresses are not consistently assigned to the same node, I am thinking the best way to send data is via multicast.  &lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2017-01-02T01:39:35.830" Title="Does UDP multicast overwhelm the network?" Tags="|multicast|udp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="29864" PostTypeId="2" ParentId="29863" CreationDate="2016-04-22T15:05:01.103" Score="2" Body="&lt;p&gt;Not necessarily. Switches which support IGMP snooping can listen in on IGMP requests from hosts, and send only to those switch ports where hosts have requested to become members of the multicast group. It's a little more complicated if you have multiple switches in the same broadcast domain. How you configure your switch depends on the switch model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router will not forward multicasts unless you have configured multicast routing on the router. How you configure that is dependent on the router model.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-22T15:05:01.103" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29865" PostTypeId="1" CreationDate="2016-04-22T15:30:48.657" Score="0" ViewCount="161" Body="&lt;p&gt; I have 15 systems connected with same LAN. I want to capture all the data packets(network-traffic) through every system from my single PC connected with same LAN using wireshark.Can anybody plz help me?&lt;/p&gt;&#xA;" OwnerUserId="24817" LastActivityDate="2016-06-22T02:48:03.393" Title="Capturing network traffic using wireshark" Tags="|lan|wireshark|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-14T02:01:41.390" ContentLicense="CC BY-SA 3.0" />
  <row Id="29867" PostTypeId="2" ParentId="29848" CreationDate="2016-04-22T15:41:19.790" Score="1" Body="&lt;p&gt;You may eventually enable proxy arp on each routers (sub)interface. However some things won't work well with proxy arp enabled. It would make a good transition solution, for the time you renumber your hosts.&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2016-04-22T15:41:19.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29870" PostTypeId="1" AcceptedAnswerId="29877" CreationDate="2016-04-22T18:52:08.853" Score="2" ViewCount="526" Body="&lt;p&gt;I am using GNS3, and a 3700 as L3 switch (router with ethernet switch module); everything is OK, but when I want to configure two ports as an etherchannel connection, the command &lt;code&gt;channel-group&lt;/code&gt; doesn't have &lt;code&gt;mode on&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me? &lt;/p&gt;&#xA;" OwnerUserId="24821" LastEditorUserId="8499" LastEditDate="2016-04-22T19:00:54.860" LastActivityDate="2016-05-23T08:39:14.883" Title="Is there no &quot;mode on&quot; for channel-group in GNS3?" Tags="|cisco|etherchannel|gns3|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29871" PostTypeId="1" CreationDate="2016-04-22T22:46:48.417" Score="0" ViewCount="956" Body="&lt;p&gt;Let's say that Alice would like to make SIP call to Bob. Alice initiates the call using her mobile device over a cellular network. On the other hand, Bob sits in a local network of an organisation. The traffic should go from Alice, then to Bob's organisation SIP server/gateway, which in turns routes the call to Bob's end device. It's a requirement that the traffic on the leg between Alice's mobile device and Bob's organisation SIP server/gateway is encrypted with TLS/SRTP. Therefore the SIP server/gateway needs to decrypt any incoming SRTP traffic to RTP traffic, before routing it to Bob's end device. Obviously, it also needs to encrypt any outgoing RTP traffic to SRTP for the other direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the exact name or term of this SIP server/gateway?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="24828" LastEditorUserId="49" LastEditDate="2016-04-23T17:03:45.097" LastActivityDate="2017-11-15T11:08:20.400" Title="Convert encrypted SRTP to RTP for private network" Tags="|voip|sip|" AnswerCount="2" CommentCount="2" ClosedDate="2019-01-25T01:29:33.983" ContentLicense="CC BY-SA 3.0" />
  <row Id="29873" PostTypeId="2" ParentId="29865" CreationDate="2016-04-23T00:49:24.293" Score="2" Body="&lt;p&gt;Buddy, Wireshark only shows capture traffic in a readable way for the user, this is the only function, read, decrypt, follow networks streams, and so on. What you want to do is configure some kind of mirror of all your pcs to yours. I guess, you need to read the documentation of your switch, and  it mirror capabilities. By the other hand, there is one kind of wireshark configuration that gives you what you want, but you need to install wireshark on every pc, and activate the remote capture on it.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-04-23T00:49:24.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29874" PostTypeId="1" AcceptedAnswerId="29885" CreationDate="2016-04-23T01:36:15.433" Score="7" ViewCount="20148" Body="&lt;p&gt;I'm so confused, both do the same function, converting the analog to digital, but what's the difference?&lt;/p&gt;&#xA;" OwnerUserId="23760" LastEditorUserId="8499" LastEditDate="2016-04-23T19:06:17.940" LastActivityDate="2020-02-23T15:51:42.247" Title="what is the difference between a CSU/DSU and a modem?" Tags="|layer1|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29875" PostTypeId="1" AcceptedAnswerId="29887" CreationDate="2016-04-23T04:48:01.217" Score="2" ViewCount="3462" Body="&lt;p&gt;I'm designing a network with the following scheme:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hHmRb.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hHmRb.jpg&quot; alt=&quot;Network schema&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 5 vlans, 3 on S1 and 2 on S3. I'm currently concerned with making access list. Each vlan has a web server that is configured to listen on both port 8080 and 80. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to use access lists on the router R3(for example) to permit http requests to the host(192.168.0.2) on port 80, but to deny them on port 8080.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have entered the following commands on router R3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/t5TSx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/t5TSx.jpg&quot; alt=&quot;Access lists&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this denies access on both ports, that is I can't open the web page from network 192.168.1.0/24, address 192.168.1.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On router R3 I have configured subinterfaces g0/1.10, 20, 30(for VLANs 10, 20, 30 respectively) with the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-group 100 in&#xA;ip access-group 100 out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What should I do?&lt;/p&gt;&#xA;" OwnerUserId="24839" LastEditorUserId="8499" LastEditDate="2018-12-23T05:20:32.650" LastActivityDate="2018-12-23T05:20:32.650" Title="Cisco router - deny access to host on port 8080, allow on 80" Tags="|cisco|router|cisco-ios|packet-tracer|acl|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29877" PostTypeId="2" ParentId="29870" CreationDate="2016-04-23T08:35:48.673" Score="2" Body="&lt;p&gt;The problem was existing because I was not using ether switch module ports that is added to router to handle it as switch&lt;/p&gt;&#xA;" OwnerUserId="24821" LastActivityDate="2016-04-23T08:35:48.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29879" PostTypeId="2" ParentId="29875" CreationDate="2016-04-23T10:02:47.563" Score="1" Body="&lt;p&gt;Your specified access-list looks good. The mistake is in applying it on the interface. Say you want to restrict access to web server on IP &lt;code&gt;192.168.0.2&lt;/code&gt;. You are using extended ACLs so therefore they should be places as close to destination as possible to save some processing time. You want to apply it on &lt;code&gt;interface g0/0.10&lt;/code&gt;, but only in &lt;code&gt;out&lt;/code&gt; direction. Why is that? Out means that everything that comes OUT of &lt;code&gt;g0/0.10&lt;/code&gt; interface, that is everything that is routed TO VLAN 10 from any source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to wrap this up, you should do this on &lt;code&gt;interface g0/0.10&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip access-group 100 out&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and you should be good to go. Other interfaces should be unaffected, you apply this access list ONLY on the &lt;code&gt;interface g0/0.10&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="16890" LastActivityDate="2016-04-23T10:02:47.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29880" PostTypeId="1" AcceptedAnswerId="29895" CreationDate="2016-04-23T10:06:27.063" Score="4" ViewCount="5189" Body="&lt;p&gt;I'm looking to implement, what I feel, is Telnet security when it comes to unwanted hosts initiating a Telnet connection to one of my devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can lock down a specific subnet or only allow a range of addresses or networks with an extended access list, in addition to applying this to the incoming interfaces, and also setting an inbound rule with an access class on the VTY lines, that's not a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when a connection is attempted, the following is received:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2#telnet 172.16.100.1&#xA;Trying 172.16.100.1 ...&#xA;% Destination unreachable; gateway or host down&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The pro is that the job has been done with the restriction, but the con is the output. What I don't want displayed from this output is that the host is unreachable, or that the gateway or host is down. As this implies that the connection exists, and from a security perspective, I want this connection to be a ghost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question - Is there is a way to disable ICMP messages for specific instances such as this? So that instead of displaying the above output, it displays a time out message instead? Or something along those lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure I read about it somewhere before by applying no ip unreachables on the interface, but wouldn't this lock it down on the interface? And not just for the purposes of the access list? Maybe this is the only way to do it, but I'd be interested to know if there's a more granular way of doing things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS. I haven't been maliciously hacked or anything! This is just for testing purposes. (before you start telling me I've got bigger problems than ICMP messages)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;:)&lt;/p&gt;&#xA;" OwnerUserId="23950" LastActivityDate="2016-04-23T17:33:50.673" Title="Telnet - &quot;Destination unreachable&quot; response" Tags="|cisco|icmp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29883" PostTypeId="1" CreationDate="2016-04-23T11:17:12.020" Score="0" ViewCount="155" Body="&lt;p&gt;Say I have a remote data center in LA and my office is in San Diego. When you say I have a site to site dedicated line between the data center and my office, does it mean fibre lines which do not connect to the internet but just between the office and the data center? How is this even possible? Do they lay the lines just for this purpose? Do they dig up the path between the cities just for this request? I cant visualize. Please explain&lt;/p&gt;&#xA;" OwnerUserId="21247" LastActivityDate="2017-07-11T19:53:38.950" Title="Point to Point Leased Lines - Do they lay fibres just for that purpose?" Tags="|point-to-point|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29884" PostTypeId="2" ParentId="29883" CreationDate="2016-04-23T12:50:05.667" Score="0" Body="&lt;p&gt;Short answer: &quot;Back in the day&quot; maybe they did this. Very quickly, you just got connected to the nearest POP (point-of-presence) with IP over ATM over copper, from which you got allocated a VC (virtual circuit) over a mutualized ATM line. You got a &quot;T1&quot;, a &quot;T3&quot;... Between 1995 and 2005 inter-POP ATM lines were progressively replaced by IP over MPLS over copper then fiber, and last mile was somewhat replaced by ATM over DSL over copper and now by IP over fiber.&lt;/p&gt;&#xA;" OwnerUserId="22874" LastActivityDate="2016-04-23T12:50:05.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29885" PostTypeId="2" ParentId="29874" CreationDate="2016-04-23T13:27:08.210" Score="8" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;...both does the same functions that converts the analog to digital...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That would be incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A modem will modulate (the &lt;code&gt;mo&lt;/code&gt; in modem) an analog carrier to encode digital information on it, and demodulate (the &lt;code&gt;dem&lt;/code&gt; in modem) an analog carrier to convert the encoded information back to digital information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A CSU/DSU connects two different types of digital signals. A CSU/DSU is actually two different devices, the CSU and the DSU, which may be in separate boxes. In the old days, These were separate pieces of equipment. Today, they are almost always in a single box (e.g., a DSL &quot;modem&quot;), or a single interface module for the DTE (e.g. a T1/E1 WIC for a Cisco ISR). The DSU (Data Service Unit) is what connects to your DTE (Data Terminal Equipment), and converts your DTE serial communications to frames which the CSU can understand, and vice versa. The CSU (Channel Service Unit) is what connects to the communication circuit, and places the frames from the DSU onto the communications circuit, and vice versa.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-23T18:04:17.707" LastActivityDate="2016-04-23T18:04:17.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29886" PostTypeId="2" ParentId="29883" CreationDate="2016-04-23T13:33:09.310" Score="3" Body="&lt;p&gt;Today this would likely be done by laying a fibre from your office back to a nearby PoP and from the DC to a PoP near the DC. Then most providers would create a L2 VPN (such as an MPLS pseudowire) between the PoPs across the service providers network between PoPs. It wouldn’t actually be a dedicated fibre from end-to-end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two main exceptions are if the two sites are within close proximity of each other (in relative terms, say 20Km) the sites might both hair-pin through the same provider PoP. Or if you purchase what is usually called “Dark Fibre” then you are typically paying for dedicated end to end fibre strand(s).&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2016-04-23T13:33:09.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29887" PostTypeId="2" ParentId="29875" CreationDate="2016-04-23T13:52:57.390" Score="1" Body="&lt;p&gt;You should craft an ACL for one direction. Don't put the same ACL on every interface in both directions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general ACL rules:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;An extended ACL has both the source and destination addresses. It&#xA;should be placed inbound on the source interface where the source&#xA;address is. This prevents the denied traffic from being routed at all.&lt;/li&gt;&#xA;&lt;li&gt;A standard ACL doesn't have the destination address, only the source&#xA;address. It should be placed outbound on the interface where the&#xA;destination address is. This means the traffic will be routed, but&#xA;it prevents the ACL from affecting too much traffic.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Your extended ACL 100 should only be on the router's interface for the VLAN with &lt;code&gt;192.168.1.0&lt;/code&gt; (per your comment, VLAN 20) as an inbound ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan20&#xA; ip access-group 100 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will immediately drop any TCP traffic coming into the router from &lt;code&gt;192.168.1.0/24&lt;/code&gt; destined to &lt;code&gt;192.168.0.2:8080&lt;/code&gt;, preventing the router from having to route that traffic. It will allow ICMP echos and other TCP traffic to &lt;code&gt;192.168.0.2&lt;/code&gt;, but it will deny all other traffic (ACLs have an implicit &lt;code&gt;deny any any&lt;/code&gt; as the last statement. You should probably change the ACL so that it will permit all other traffic, unless you really only want to allow hosts on that VLAN to ping and use all other TCP only with &lt;code&gt;192.168.0.2&lt;/code&gt;. The hosts on that VLAN will not be able to get to any other VLAN, except with ping.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-23T13:58:11.857" LastActivityDate="2016-04-23T13:58:11.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29889" PostTypeId="2" ParentId="29880" CreationDate="2016-04-23T14:11:44.667" Score="1" Body="&lt;p&gt;The ICMP message is not the text message you see; it is a code which means destination unreachable. The text message is created by the OS of the device on which you are running Telnet, or by the Telnet application itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco interfaces, you can use the &lt;code&gt;no ip unreachables&lt;/code&gt; command to suppress the interface from generating the ICMP destination unreachable response. This would need to be configured on the target interfaces, not the interface from which you are using Telnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ipaddr/command/reference/fipras_r/1rfip2.html#wp1019840&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS IP Command Reference, Volume 1 of 3: Addressing and Services, Release 12.2&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Usage Guidelines&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If the Cisco IOS software receives a nonbroadcast packet destined for&#xA;  itself that uses a protocol it does not recognize, it sends an ICMP&#xA;  unreachable message to the source.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If the software receives a datagram that it cannot deliver to its&#xA;  ultimate destination because it knows of no route to the destination&#xA;  address, it replies to the originator of that datagram with an ICMP&#xA;  host unreachable message.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This command affects all types of ICMP unreachable messages.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following example enables the generation of ICMP unreachable&#xA;  messages, as appropriate, on an interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface ethernet 0&#xA; ip unreachables&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-23T14:11:44.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29890" PostTypeId="2" ParentId="29880" CreationDate="2016-04-23T15:26:24.230" Score="3" Body="&lt;p&gt;You have a routing problem.  If you put an access list (access-class) on the vty interfaces, you will get a &quot;connection refused&quot; message (or a time out message).  The fact that you are getting a destination unreachable message means your router doesn't have a route to the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect that when you put on your access list on the interface, you also blocked routing protocols.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-23T15:26:24.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29895" PostTypeId="2" ParentId="29880" CreationDate="2016-04-23T17:33:50.673" Score="1" Body="&lt;p&gt;&lt;code&gt;telnet&lt;/code&gt; simply opens up a socket, or connection, to another IP:Port. There is no way to specifically block telnet to a port, without also blocking the application from functioning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could limit the functionality of telnet against a port if the application running on the port expects the request to come in formatted an exact way. But a clever enough user could then just format his request the correct way as well. If you're application requires binary formatted requests (SSL, OCSP, etc) then telnet is all but useless, as telnet sends characters in ASCII.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, there are &lt;strong&gt;four&lt;/strong&gt; possible responses to a opening a connection (aka, what four possible responses to &lt;code&gt;telnet&lt;/code&gt;). They all start after &lt;code&gt;telnet&lt;/code&gt; sends the first &lt;code&gt;SYN&lt;/code&gt; of the &lt;a href=&quot;https://networkengineering.stackexchange.com/a/24072/3675&quot;&gt;three-way-handshake&lt;/a&gt;. &lt;strong&gt;If you are trying to control the response to a Telnet, you must understand each of these four options&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Client sends &lt;code&gt;SYN&lt;/code&gt;, Server responds with TCP &lt;code&gt;SYN ACK&lt;/code&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is the connection being accepted. This is the only response that indicates the connection was accepted.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;strong&gt;Client sends &lt;code&gt;SYN&lt;/code&gt;, Server responds with an ICMP message: &lt;code&gt;Destination Unreachable - Port Unreachable&lt;/code&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;ICMP organizes its different messages into different &quot;types&quot;. The Destination Unreachable message is an ICMP Type 3 message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ICMP can also further divide the different types into various &quot;codes&quot;. The Port Unreachable message is an &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol#Destination_unreachable&quot; rel=&quot;nofollow noreferrer&quot;&gt;ICMP Type 3 Code 3 Message&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This response is the idealistic, &quot;early days of the Internet&quot; suggest response. Back when the Internet was a trustworthy place, this was very helpful. It tells you &quot;hey, the IP you tried to connect to is reachable, but the specific port you used is not active.&quot;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;strong&gt;Client sends &lt;code&gt;SYN&lt;/code&gt;, Server responds with TCP &lt;code&gt;RST&lt;/code&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It is not very rare to come across a Firewall policy where ICMP is blocked. In those cases, had a Server responded with the ICMP Type 3 Code 3 described above, it would be dropped and the Client would have received nothing (which we will talk about in #4). Or sometimes because of intricacies of NAT, the ICMP message from Server to Client won't be able to 'get back through' a one way NAT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So another way a server has to indicate the port is not accepting a connection is to respond to the SYN with a RST -- which instantly terminates the connection on the Client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a similar effect to the 2nd option described above, but it doesn't depend on ICMP being permitted from the Server back to the Client.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;&lt;strong&gt;Client sends &lt;code&gt;SYN&lt;/code&gt;, Client receives nothing in response&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The final result of a telnet, is the Client receiving nothing. It could be receiving nothing because ICMP Type3 Code3 message was blocked or never sent. Or the TCP RST message was blocked or never sent. Or it could also be receiving nothing because the IP address doesn't exist. From the perspective of the Client initiating the connection, all three of these scenarios are identical -- no response is received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This option is also sometimes referred to as &lt;em&gt;Silently Dropping&lt;/em&gt; or &lt;em&gt;Silently Refusing&lt;/em&gt; a connection. The Server (or Firewall) drops the initial SYN and sends nothing back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is typically the preferred response from a Security standpoint and a &quot;don't trust the Internet&quot; standpoint. Because it provides no information to the client.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Did the server exist? No way to tell.&lt;/li&gt;&#xA;&lt;li&gt;Is the port open? No way to tell.&lt;/li&gt;&#xA;&lt;li&gt;Did my packets make it to the server? No way to tell.&lt;/li&gt;&#xA;&lt;li&gt;Did the response packets make it back to the Client? No way to tell.&lt;/li&gt;&#xA;&lt;li&gt;Is something in transit blocking my connection attempt? No way to tell.&lt;/li&gt;&#xA;&lt;li&gt;Is something in transit blocking the Server's response? No way to tell.&lt;/li&gt;&#xA;&lt;li&gt;Could there be a slew of other reasons which prevented this from working? Yup.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The Client's response to #2 and #3 above are (near) instantaneous. As soon as the RST or ICMP Type3 Code3 message is received, the client can display an error message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With Option 4, however, the Client can only sit and wait a specific timeout, and when that time expires display to the client that the &quot;connection timed out&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most Firewall ACLs (and the like) implement this method when refusing connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;To bring it back to your question&lt;/strong&gt;, knowing the four possible outcomes above, you need to determine which outcome you want. I believe you are looking for the 4th, which means you have to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Stop the application from running on that port -- not ideal&lt;/li&gt;&#xA;&lt;li&gt;Stop the resulting &lt;code&gt;ICMP Type 3 Code 3&lt;/code&gt; from getting to the Client -- not particularly difficult, but &lt;a href=&quot;http://packetlife.net/blog/2008/oct/9/disabling-unreachables-breaks-pmtud/&quot; rel=&quot;nofollow noreferrer&quot;&gt;may block more than you intend&lt;/a&gt;. Not all means of blocking the ICMP response will have the ability to block the ICMP response as a result of a particular TCP SYN, so you there is some difficulty in identifying exactly what you want your Firewall to block&lt;/li&gt;&#xA;&lt;li&gt;Stop the resulting &lt;code&gt;TCP RST&lt;/code&gt; from getting to the Client -- a little more difficult unless your Server (or Firewall if that is doing the dropping) can be configured to simply not send the RST.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-04-23T17:33:50.673" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29896" PostTypeId="1" CreationDate="2016-04-23T17:52:06.317" Score="8" ViewCount="9895" Body="&lt;p&gt;I was studying, and I got stuck in trying to find out the best way to answer this question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;explain how a router learns about networks that can be reached from its&#xA;  interfaces and how it routes packets. You should assume that the&#xA;  router has just been connected to the network.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So, am I correct in describing it in a simple way by saying that :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router learns about networks that can be reached from its interface thanks to the switches, which themselves learn what computers are connected to each port. And once it learns, it uses the network layer to determine the best route to a destination by using IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been studying with the book &lt;em&gt;Microsoft Networking Essentials&lt;/em&gt;, and I can't seem to find a detailed enough answer to this simple question. It is somewhat confusing because of the way the book is structured.&lt;/p&gt;&#xA;" OwnerUserId="24854" LastEditorUserId="8499" LastEditDate="2016-04-23T19:01:16.603" LastActivityDate="2020-09-18T19:53:11.423" Title="How does a router learn about networks that can be reached from its interfaces?" Tags="|routing|router|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29897" PostTypeId="2" ParentId="29896" CreationDate="2016-04-23T18:16:00.863" Score="6" Body="&lt;p&gt;Your answer to the question is incorrect. There are multiple ways routers can learn which interfaces should be used for which network:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Routers implicitly know about directly connected networks when the interface is configured with an IP address and mask, either manually, or through DHCP.&lt;/li&gt;&#xA;&lt;li&gt;Routers can be configured with static routes to specific networks, or&#xA;even with a default route.&lt;/li&gt;&#xA;&lt;li&gt;Routers can exchange route information with other routers through&#xA;routing protocols.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Regardless of how a router learns a route to a network, it adds the route to its routing table, including the interface to which it should switch the traffic destined for that network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a huge subject, and the details are far too broad to be discussed here in any more detail. You can ask specific questions on a subject to limit the answer(s) to acceptable size(s).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-23T19:00:37.227" LastActivityDate="2016-04-23T19:00:37.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29901" PostTypeId="1" CreationDate="2016-04-24T04:43:18.787" Score="0" ViewCount="649" Body="&lt;p&gt;I am using Ubuntu 15 and I need to implement simple/effective Load Balancer / Fail Over System as per the below requirements:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a. It should balance the load between two different public IPs (two different servers on different VPS hosting companies). I need to balance my web application (PHP, MySQL) and also my email server (Postfix, Dovecot, Spamassasin, clamAV, amavis)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b. I don't want to use more than two servers. The project (web application+ email server) are deployed on two servers and I have only two IP addresses (IPv4).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c. I don't want single point of failure, i.e., the load balancer/failover must work on both servers, so in case one machine is down, the second will take over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen many tutorials on how to make the balancer on servers on same subnet, but I need to make it between two servers on different datacenters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would you please advise if this can be done? I would greatly appreciate if you provide me with a simple tutorial or hints to do it. I am still beginner to this technology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="24868" LastActivityDate="2016-05-24T19:17:34.343" Title="Load Balancing System For 2 Servers on Different Datacenters" Tags="|vpn|dns|sdn|load-balancer|" AnswerCount="1" CommentCount="9" ClosedDate="2017-08-14T01:59:11.767" ContentLicense="CC BY-SA 3.0" />
  <row Id="29902" PostTypeId="1" CreationDate="2016-04-24T09:04:13.100" Score="1" ViewCount="819" Body="&lt;p&gt;this is my network topology diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C0pF0.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C0pF0.jpg&quot; alt=&quot;Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Networks that are outlined in the bottom are actually vlans 10, 20, 30, 40, 50&#xA;defined on switches S1 and S3. &#xA;The routers R3 and R2 for the network have subinterfaces fa0/1.10, 20, 30, 40, 50 for vlans 10, 20, 30, 40, 50. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on access lists for router r3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to permit access on port 2016 from host 192.168.2.2 to 192.168.1.2,&#xA;and on port 2014 from host 192.168.1.2 to host 192.168.2.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I have so far:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Extended IP access list 100&#xA;    10 permit tcp host 192.168.2.2 host 192.168.1.2 eq 2016 (38 matches)&#xA;    20 permit tcp host 192.168.2.2 host 192.168.1.2 eq 2016 established&#xA;    30 permit icmp any any (17 matches)&#xA;&#xA;Extended IP access list 101&#xA;    10 permit tcp host 192.168.1.2 host 192.168.2.2 eq 2014 (3 matches)&#xA;    20 permit tcp host 192.168.1.2 host 192.168.2.2 eq 2014 established&#xA;    30 permit icmp any any (6 matches)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I applied them with following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fa0/1.30&#xA;ip access-group 100 in&#xA;int fa0/1.20&#xA;ip access-group 101 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tested it with netcat and found it does not work.&lt;/p&gt;&#xA;" OwnerUserId="24869" LastActivityDate="2016-04-27T09:19:58.963" Title="Cisco extended ACL not permitting traffic according to rules" Tags="|cisco|cisco-ios|acl|cisco-commands|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29903" PostTypeId="1" AcceptedAnswerId="29913" CreationDate="2016-04-24T10:57:57.357" Score="1" ViewCount="1274" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/baPGt.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/baPGt.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;  In server: C3650-48TS, 03.03.05SE&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW01#sh vtp sta&#xA;VTP Version capable             : 1 to 3&#xA;VTP version running             : 1&#xA;VTP Domain Name                 : TEST&#xA;VTP Pruning Mode                : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;Device ID                       : aaaa.aaaa.aaaa&#xA;Configuration last modified by xxx.xxx.xxx.xxx at 4-23-16 04:41:17&#xA;Local updater ID is xxx.xxx.xxx.xxx on interface Vl1 (lowest numbered VLAN interface found)&#xA;&#xA;Feature VLAN:&#xA;--------------&#xA;VTP Operating Mode                : Server&#xA;Maximum VLANs supported locally   : 1005&#xA;Number of existing VLANs          : 15&#xA;Configuration Revision            : 7&#xA;MD5 digest                        : 0xC1 0x5A 0x47 0xDB 0x1A 0x6E 0x8E 0x3E&#xA;                                0xF4 0xF2 0xE3 0x52 0x4B 0x44 0x85 0xB2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;working client: C2960X,  15.0(2a)EX5&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW02#sh vtp sta&#xA;VTP Version capable             : 1 to 3&#xA;VTP version running             : 1&#xA;VTP Domain Name                 : TEST&#xA;VTP Pruning Mode                : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;Device ID                       : bbbb.bbbb.bbbb&#xA;Configuration last modified by xxx.xxx.xxx.xxx at 4-23-16 04:41:17&#xA;&#xA;Feature VLAN:&#xA;--------------&#xA;VTP Operating Mode                : Client&#xA;Maximum VLANs supported locally   : 1005&#xA;Number of existing VLANs          : 15&#xA;Configuration Revision            : 7&#xA;MD5 digest                        : 0xC1 0x5A 0x47 0xDB 0x1A 0x6E 0x8E 0x3E&#xA;                                0xF4 0xF2 0xE3 0x52 0x4B 0x44 0x85 0xB2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Client not supporting VTP: C2960X,  15.0(2)EX5 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW03#sh vtp sta&#xA;VTP Version capable             : 1 to 3&#xA;VTP version running             : 1&#xA;VTP Domain Name                 : TEST&#xA;VTP Pruning Mode                : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;Device ID                       : cccc.cccc.cccc&#xA;Configuration last modified by xxx.xxx.xxx.xxx at 3-20-16 22:11:29&#xA;&#xA;Feature VLAN:&#xA;--------------&#xA;VTP Operating Mode                : Client&#xA;Maximum VLANs supported locally   : 1005&#xA;Number of existing VLANs          : 12&#xA;Configuration Revision            : 0&#xA;MD5 digest                        : 0x2C 0x19 0x9F 0x80 0x3D 0x53 0xBE 0xEA&#xA;                                0x35 0x86 0x0F 0xF8 0xAB 0x59 0x79 0x4E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;No MD5 checksum error&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;debug message is :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Apr 25 04:26:05.878: vlan manager pkt rcvd on GigabitEthernet1/0/26, length 99&#xA;Apr 25 04:26:05.878: VTP LOG RUNTIME: Summary packet received, domain = TEST, rev = 7, followers = 0, length 77, trunk Gi1/0/26&#xA;Apr 25 04:26:05.878: VTP LOG RUNTIME: Summary packet rev 7 greater than domain TEST rev 0&#xA;Apr 25 04:26:05.878: VTP LOG RUNTIME: Domain TEST currently not in updating state&#xA;Apr 25 04:26:05.878: VTP LOG RUNTIME: Summary packet with followers field zero&#xA;Apr 25 04:26:05.878: VTP LOG RUNTIME: Transmit vtp request, domain TEST, start value 0&#xA;Apr 25 04:26:06.207: vlan manager pkt rcvd on GigabitEthernet1/0/26, length 99&#xA;Apr 25 04:26:06.207: VTP LOG RUNTIME: Summary packet received, domain = TEST, rev = 7, followers = 1, length 77, trunk Gi1/0/26&#xA;Apr 25 04:26:06.207: VTP LOG RUNTIME: Summary packet rev 7 greater than domain TEST rev 0&#xA;Apr 25 04:26:06.207: VTP LOG RUNTIME: Domain TEST currently not in updating state&#xA;Apr 25 04:26:06.207: VTP LOG RUNTIME: pdu len 77, #tlvs 1&#xA;Apr 25 04:26:06.207: vlan manager pkt rcvd on GigabitEthernet1/0/26, length 382&#xA;Apr 25 04:26:06.207: VTP LOG RUNTIME: Subset packet received, domain = TEST, rev = 7, seq = 1, length = 360&#xA;Apr 25 04:26:06.207: VTP LOG RUNTIME: MD5 digest failing&#xA;calculated = 43 0B E9 E7 9D 1A 5D C0 05 94 B2 E2 C4 F2 08 F6&#xA;transmitted = C1 5A 47 DB 1A 6E 8E 3E F4 F2 E3 52 4B 44 85 B2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Other Switches under &lt;strong&gt;SW03&lt;/strong&gt; is working after i put VTP in Transparent mode only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Transparent mode debug message:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Apr 25 04:45:54.020: vlan manager pkt rcvd on GigabitEthernet1/0/25, length 99&#xA;Apr 25 04:45:54.020: VTP LOG RUNTIME: Relaying packet received on trunk Gi1/0/25 - in TRANSPARENT MODE (nc = false)&#xA;Apr 25 04:45:54.023: vlan manager pkt rcvd on GigabitEthernet1/0/27, length 60&#xA;Apr 25 04:45:54.023: VTP LOG RUNTIME: Relaying packet received on trunk Gi1/0/27 - in TRANSPARENT MODE (nc = false)&#xA;Apr 25 04:45:54.023: vlan manager pkt rcvd on GigabitEthernet1/0/26, length 60&#xA;Apr 25 04:45:54.023: VTP LOG RUNTIME: Relaying packet received on trunk Gi1/0/26 - in TRANSPARENT MODE (nc = false)&#xA;Apr 25 04:45:54.132: vlan manager pkt rcvd on GigabitEthernet1/0/25, length 99&#xA;Apr 25 04:45:54.132: VTP LOG RUNTIME: Relaying packet received on trunk Gi1/0/25 - in TRANSPARENT MODE (nc = false)&#xA;Apr 25 04:45:54.132: vlan manager pkt rcvd on GigabitEthernet1/0/25, length 366&#xA;Apr 25 04:45:54.132: VTP LOG RUNTIME: Relaying packet received on trunk Gi1/0/25 - in TRANSPARENT MODE (nc = false)&#xA;Apr 25 04:45:54.153: vlan manager pkt rcvd on GigabitEthernet1/0/26, length 99&#xA;Apr 25 04:45:54.156: VTP LOG RUNTIME: Relaying packet received on trunk Gi1/0/26 - in TRANSPARENT MODE (nc = false)&#xA;Apr 25 04:45:54.156: vlan manager pkt rcvd on GigabitEthernet1/0/26, length 366&#xA;Apr 25 04:45:54.156: VTP LOG RUNTIME: Relaying packet received on trunk Gi1/0/26 - in TRANSPARENT MODE (nc = false)&#xA;Apr 25 04:45:54.156: vlan manager pkt rcvd on GigabitEthernet1/0/27, length 99&#xA;Apr 25 04:45:54.156: VTP LOG RUNTIME: Relaying packet received on trunk Gi1/0/27 - in TRANSPARENT MODE (nc = false)&#xA;Apr 25 04:45:54.156: vlan manager pkt rcvd on GigabitEthernet1/0/27, length 366&#xA;Apr 25 04:45:54.156: VTP LOG RUNTIME: Relaying packet received on trunk Gi1/0/27 - in TRANSPARENT MODE (nc = false)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="8499" LastEditDate="2018-12-23T05:23:51.333" LastActivityDate="2018-12-23T05:23:51.333" Title="VTP not working in all switches" Tags="|cisco|switch|vlan|trunk|vtp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29905" PostTypeId="2" ParentId="29902" CreationDate="2016-04-24T11:47:25.667" Score="0" Body="&lt;p&gt;You may have your ports wrong for your applications. Try add.&quot; Permit ip any any log&quot; generate the traffic than &quot;show logging | inc 192.168.x.x&quot; this will show you what's being permitted. Warning if this has lots of traffic this can cause high cpu on router. Than just add rules accordingly.&lt;/p&gt;&#xA;" OwnerUserId="24802" LastActivityDate="2016-04-24T11:47:25.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29908" PostTypeId="2" ParentId="23800" CreationDate="2016-04-24T12:18:08.923" Score="1" Body="&lt;p&gt;I'm using HP 1920 switches in a similar setup to yours. As stated by @Ron Maupin you only need a VLAN interface for the VLAN you would like to administer the switch on. Usually this is VLAN 1. Define your VLANs under Network &gt; VLAN (in my case: 1 MGMT VLAN, 2 CUST VLAN, 3 GUEST VLAN) and assign the ports as desired. Under Network &gt; VLAN Interface assign or change the IP address for the management Interface. The factory defaults contain already a VLAN Interface on VLAN 1.&lt;/p&gt;&#xA;" OwnerUserId="24870" LastActivityDate="2016-04-24T12:18:08.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29909" PostTypeId="1" AcceptedAnswerId="30162" CreationDate="2016-04-24T12:34:15.457" Score="2" ViewCount="1545" Body="&lt;p&gt;I'm using a HP 1920 Switch with a 3 VLANs configuration combined with a pfSense Firewall. VLAN 1 is configured as Management Interface. If I connect to the switch by cable I can access the Webinterface just fine. But if I connect through VPN (openVPN on pfSense) I can't neither access the Webinterface nor ping the Switch. However I can ping the Switch from the pfSense Firewall using the internal ping tool. And I can ping other devices on the MGMT Net just fine through VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that the Switch blocks access from IPs outside the MGMT Net, which the VPN tunnel is. I have tried to define an ACL and Authorized IP but no matter what I set there I cannot access the switch Webinterface through VPN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network is setup as follows&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;MGMT Net 10.16.1.0/25 &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;VPN Tunnel 10.16.1.248/29&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Has anyone succeeded to administer an HP 1920 Switch through a VPN tunnel? How can I do this?&lt;/p&gt;&#xA;" OwnerUserId="24870" LastActivityDate="2017-03-31T14:29:26.007" Title="How to access a HP 1920 Switch Webinterface from VPN?" Tags="|switch|vpn|hp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29910" PostTypeId="2" ParentId="29902" CreationDate="2016-04-24T14:41:50.833" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;ACL's on routers are not state-full as on Firewall's.&#xA;What this means is that you need rules to allow traffic in both directions.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;TCP connections uses a well known port on the server side and normally selects a random port for the source of the connection.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Your requirements.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;host 192.168.2.2 --&amp;gt; host 192.168.1.2:2016&#xA;and &#xA;host 192.168.1.2 --&amp;gt; host 192.168.2.2:2014&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Your Setup&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fa0/1.30 !Assume 192.168.2.0/24 subnet&#xA;  ip access-group 100 in&#xA;!&#xA;int fa0/1.20 !Assume 192.168.1.0/24 subnet&#xA;  ip access-group 101 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ACL's:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Extended IP access list 100&#xA;10 permit tcp host 192.168.2.2         host 192.168.1.2 eq 2016 &#xA;20 permit tcp host 192.168.2.2 eq 2014 host 192.168.1.2 &#xA;30 permit icmp any any&#xA;&#xA;Extended IP access list 101&#xA;10 permit tcp host 192.168.1.2 eq 2016 host 192.168.2.2&#xA;20 permit tcp host 192.168.1.2         host 192.168.2.2 eq 2014&#xA;30 permit icmp any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notes:&#xA;    Remember that the return traffic will also traverse the ACL on the interface where it enters.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2016-04-27T09:19:58.963" LastActivityDate="2016-04-27T09:19:58.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29911" PostTypeId="1" AcceptedAnswerId="29914" CreationDate="2016-04-24T17:28:08.780" Score="1" ViewCount="2874" Body="&lt;p&gt;So, I have built a tool that allows users to configure &lt;code&gt;SPAN&lt;/code&gt; sessions on a Cisco switch. I'm currently trying to get the application to work for the &lt;code&gt;Nexus&lt;/code&gt; series but there is one command I'm not sure of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you are removing a port from a &lt;code&gt;SPAN&lt;/code&gt; session, you would use the following example command &lt;code&gt;no monitor session 1 interface fastethernet 0/2&lt;/code&gt;, but I'm unsure if that command works on the Nexus series. I have looked through the config guides, and all they show is how to add ports, but they don't show how to remove ports from a SPAN session. Unfortunately, I don't have access to that type of switch yet, and I would like to know the command before I test my application on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know if this the right command for removing ports from a session, or is there different command used on the &lt;code&gt;Nexus&lt;/code&gt; series?&lt;/p&gt;&#xA;" OwnerUserId="22709" LastEditorUserId="8499" LastEditDate="2016-04-24T19:40:53.633" LastActivityDate="2016-04-24T19:40:53.633" Title="Removing source ports from a SPAN session on a cisco nexus switch" Tags="|cisco|switch|cisco-commands|mirror|cisco-nexus|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29912" PostTypeId="1" AcceptedAnswerId="29915" CreationDate="2016-04-24T17:32:13.133" Score="1" ViewCount="96" Body="&lt;p&gt;I'm having some problems with the selection of components for the construction of a satellite network. For communication with satellite, I want to use DS-CDM 760 modem from Comtech. But there is a need to link it to the internal network on the Ethernet channel to connect with my WiMAX network. I need some additional hardware or can I connect directly to the server? &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I have a mobile communications system with WiMAX network. The system is installed with the server on the basis of the vehicle Ford Transit. I would like to relate it to the satellite network using PESA antenna and Comtech modem. The server is running on Windows Server 2012. And yes, if I connect it through a switch to the server it will provide me with the necessary data rate? I need to use the full potential of the modem without losing speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2SBdK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2SBdK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I'm sorry if the question seems stupid, but I'm not faced with similar earlier. :)&lt;/p&gt;&#xA;" OwnerUserId="24876" LastEditorUserId="8499" LastEditDate="2016-04-24T19:43:01.863" LastActivityDate="2016-04-24T19:43:01.863" Title="Satellite network hardware" Tags="|network-core|architecture|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29913" PostTypeId="2" ParentId="29903" CreationDate="2016-04-24T17:33:48.690" Score="2" Body="&lt;p&gt;Apparently, your VTP password is incorrect on the 2960X which doesn't work. The MD5 digest on VTP doesn't match on the last (non-working) of the three switches you show. You wrote there is no MD5 checksum error, but there is in the debug output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Apr 25 04:26:06.207: VTP LOG RUNTIME: MD5 digest failing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can use the &lt;code&gt;show vtp password&lt;/code&gt; command on a switch to show the VTP password you used on the switch. Do this on switches that do work, then on the switch which doesn't work, and you will probably discover that it doesn't exactly match. You can copy it on a working switch, then paste it in the non-working switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-24T17:39:24.763" LastActivityDate="2016-04-24T17:39:24.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29914" PostTypeId="2" ParentId="29911" CreationDate="2016-04-24T17:56:05.637" Score="1" Body="&lt;p&gt;Cisco is pretty consistent with using the &lt;code&gt;no&lt;/code&gt; in front of a command to remove or disable the command. Cisco provides many documents, such as &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/Span.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Nexus 5000 Series NX-OS Software Configuration Guide&lt;/a&gt; which detail how to configure SPAN, including removing it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Bg1dX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Bg1dX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You add a source port to a SPAN session with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config-monitor)# source interface &amp;lt;type&amp;gt; &amp;lt;slot&amp;gt; / &amp;lt;port&amp;gt; [ rx | tx | both ]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You remove a source port from a SPAN session with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config-monitor)# no source interface &amp;lt;type&amp;gt; &amp;lt;slot&amp;gt; / &amp;lt;port&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-24T19:24:39.100" LastActivityDate="2016-04-24T19:24:39.100" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29915" PostTypeId="2" ParentId="29912" CreationDate="2016-04-24T18:11:40.510" Score="0" Body="&lt;p&gt;According to the &lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwjflsPN76fMAhXHsYMKHXnGDe0QFggdMAA&amp;amp;url=http%3A%2F%2Fwww.comtechefdata.com%2Ffiles%2Fdatasheets%2Fds-cdm760.pdf&amp;amp;usg=AFQjCNGJJkH597oMS4AJ5ieA0pys8RwNQQ&amp;amp;sig2=8EDPHIXcZzcztt9_98HuKg&quot; rel=&quot;nofollow&quot;&gt;data sheet for the DS-CDM 760&lt;/a&gt;, the data rate tops out at 314 Mbps. The ethernet ports on it support 1000 Mbps. To use the full capacity of the device, you need 1 Gbps in the network path (switch, server, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see a problem, but I don't have all the information since I have no details on your network to which you wish to connect this. If the device is going to give you a new network, you will need to route between this new network and your existing network. Depending on how your network is laid out, you may be able to connect it directly to your router, or you could connect it to a layer-2 switch VLAN which runs to your router, or you could use a layer-3 switch to route it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is really all we can give you without more detail, and designing your network is not really what we do here.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-24T18:11:40.510" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29917" PostTypeId="2" ParentId="29793" CreationDate="2016-04-24T20:35:10.617" Score="2" Body="&lt;p&gt;It turns out that in these models EnGenius does not utilize the vlan setting for the SSID unless client isolation is also enabled. This seems to be true in all 300 series models. In newer models client isolation and vlan isolation are separate settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enabling isolation with tagged vlans on the trunk and WAP ports successfully routes the traffic.&lt;/p&gt;&#xA;" OwnerUserId="24754" LastActivityDate="2016-04-24T20:35:10.617" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29919" PostTypeId="1" CreationDate="2016-04-24T21:01:38.840" Score="1" ViewCount="153" Body="&lt;p&gt;I want to connect wireless camera to a local network. The wireless camera's range in line of sight is 100 meter.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if i'm creating a local network using my phone (hotspot) which gives range 30 meter in sight .. does that mean I can connect them and have a total distance 100 ~ 120meter , or the camera should be in the range of the hotspot of the phone?&lt;/p&gt;&#xA;" OwnerUserId="24881" LastEditorUserId="35913" LastEditDate="2018-10-18T08:14:55.523" LastActivityDate="2018-11-17T09:02:20.433" Title="calculating a range between wireless camera and phone?" Tags="|ip|wireless|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29921" PostTypeId="2" ParentId="29896" CreationDate="2016-04-24T23:12:53.640" Score="6" Body="&lt;p&gt;There are a few &quot;layers&quot; to get through to answer your question. Lets start at the beginning:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A device who wants to speak/access the Internet (or any network) must have an IP address.  The &lt;strong&gt;IP address serves as the identity of the device on the network&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addresses, however, do not exist on islands. Instead, &lt;strong&gt;IP Addresses exist within groups known as Networks&lt;/strong&gt;, or Local Networks, or Sub Networks, or a plethora of similar names. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason this is important is because if this &lt;em&gt;wasn't&lt;/em&gt; the case, a Router would have to know the location of &lt;em&gt;every IP address in the world&lt;/em&gt;.  Which in IPv4, means 4.2~ billion different &quot;routes&quot;. Being able to organize IP addresses into groups, means Routers don't have to learn NEARLY as many routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, &lt;strong&gt;anytime any device is configured with an IP address, it &lt;em&gt;must&lt;/em&gt; also be configured with a Subnet Mask&lt;/strong&gt;. The Subnet Mask will serve to tell the device just how many other IP addresses are within its grouping (or Network). This is all done through the process of what is called Subnetting -- you can read more about the process &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/3675&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, a device configured with the IP address &lt;code&gt;10.1.1.30&lt;/code&gt; and the Subnet Mask &lt;code&gt;255.255.255.0&lt;/code&gt; will intrinsically know the size of its Network contains every IP address in the range &lt;code&gt;10.1.1.0&lt;/code&gt; through &lt;code&gt;10.1.1.255&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router configured with the same IP address would work the same way and also intrinsically know the size of the Network it is directly connected to. Which will then tell the Router what Directly Connected network it is attached to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a router has multiple interfaces, it will repeat the same process for each interface, until it knows ALL the Networks it is directly connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR /&gt;&#xA;That said, there is so much more to all this than what was summarized above. But I wanted to focus on just answering your question. For more information, I highly suggest reading through this article series that describes &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/packet-traveling/&quot; rel=&quot;nofollow noreferrer&quot;&gt;how packets move through a network,&lt;/a&gt; and specifically the article that picks apart &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-router/&quot; rel=&quot;nofollow noreferrer&quot;&gt;how a Router routes packets&lt;/a&gt;. When you've done that, you can see it all tied together in &lt;a href=&quot;https://www.youtube.com/watch?v=rYodcvhh7b8&quot; rel=&quot;nofollow noreferrer&quot;&gt;this video&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&lt;sup&gt;Disclaimer: I wrote the aforementioned articles&lt;/sup&gt;&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-04-24T23:12:53.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29923" PostTypeId="1" AcceptedAnswerId="29955" CreationDate="2016-04-25T00:18:16.083" Score="1" ViewCount="214" Body="&lt;p&gt;I have done a decent amount of looking into setting up devices to use SNMP. Sorry in advance if my terminology appears incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I am wanting to query a switch (Netgear) status from a directly connected Linux box (RHEL).&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is the switch, the SNMP manager and server? Does this make the Linux PC, the SNMP agent and client?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Does an SNMP daemon run on the switch? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Are the below steps correct to set up the SNMP environment in a LAN:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Enable SNMP on the switch.&lt;/li&gt;&#xA;&lt;li&gt;Yum install necessary packages for SNMP and load MIBs into Linux machine.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21360" LastEditorUserId="8499" LastEditDate="2016-04-25T01:41:07.870" LastActivityDate="2016-07-25T17:42:04.433" Title="Setting up an SNMP environment" Tags="|snmp|linux|netgear-prosafe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29927" PostTypeId="1" CreationDate="2016-04-25T07:00:20.417" Score="15" ViewCount="39578" Body="&lt;p&gt;I have been told that Ethernet magnetic transformers are used for base-t Ethernet when transmission is sent over a lengthy cable. What is the purpose of the transformer? (is it for signal filtering or boosting?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, I have a circuit that has been used for an 8 wire (1000base-t) Ethernet configuration. Would the same circuit work for a 4 wire (100base-t) configuration if I connected only pins 1, 2, 3 &amp;amp; 6? if so would the performance be the same as the 8 wire configuration?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry if I may not be coherent in my question as I am not too familiar with Ethernet hardware. Thank you for reviewing my question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. I am unsure about how data is transmitted over Ethernet. Is it that all differential pairs (DA: pins 1 &amp;amp; 2, DB: pins 3 &amp;amp; 6, DC: pins 4 &amp;amp; 5, DD: pins 8 &amp;amp; 7) are busses where data can be transmitted both ways (unlike the UART where RX has to be connected to TX)? and in case I am just using 2 pairs, would I be connecting only DA and DB? Is there also an issue with connecting a 4 wire device to a network that uses 8 wires?&lt;/p&gt;&#xA;" OwnerUserId="24888" LastEditorUserId="8499" LastEditDate="2016-04-25T12:37:21.020" LastActivityDate="2022-11-11T10:04:26.060" Title="What is the purpose of an Ethernet magnetic transformer, and how are they used?" Tags="|ethernet|hardware|layer1|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29929" PostTypeId="1" CreationDate="2016-04-25T09:18:03.023" Score="1" ViewCount="79" Body="&lt;p&gt;As the title says. And since we are doing our own Support. Would it be recommended? I am talking about the Main firewall of the ISP, the Firewall that routes your data to the Router before exiting to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course everyone has their own opinions but I would like to have an answer based from experience or from advanced theoretical knowledge.&lt;/p&gt;&#xA;" OwnerUserId="14255" LastEditorUserId="14255" LastEditDate="2016-04-25T12:39:16.953" LastActivityDate="2016-04-25T12:39:16.953" Title="Would you recommend IPtables/Netfilter as a main firewall for an ISP?" Tags="|firewall|network-core|isp|" AnswerCount="0" CommentCount="6" ClosedDate="2016-04-25T12:22:23.750" ContentLicense="CC BY-SA 3.0" />
  <row Id="29933" PostTypeId="1" AcceptedAnswerId="33843" CreationDate="2016-04-25T10:53:10.943" Score="0" ViewCount="253" Body="&lt;ol&gt;&#xA;&lt;li&gt;The Current situation:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have just started an internship in a company and one of the requirements for a succesful internship is the carrying out of a project. I decided on deploying Microsoft Direct Access as it enables Transparent and secure connection between Remote users and the internal network. &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;The Problem:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My test environment will be deployed behind a Firewall and the Company has a Cisco ASA550 in place but are reluctant to allow me use the device to simulate a test environment (probably scared I might make their network vulnerable to external attack).&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;The Question&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How does one simulate a Cisco ASA firewall  without coughing (not literally) out so much. &#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="20403" LastActivityDate="2016-08-08T12:46:24.500" Title="Deploying microsoft direct access in a test lab using Microsoft Hyper V and Cisco ASA 550" Tags="|cisco-c5500|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29934" PostTypeId="1" AcceptedAnswerId="29937" CreationDate="2016-04-25T11:33:07.970" Score="3" ViewCount="299" Body="&lt;p&gt;This is on a Nexus N5624Q.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this TA-queuing service policy : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map type queuing TA-queuing&#xA;  class type queuing queue-cos1&#xA;    bandwidth percent 20&#xA;  class type queuing queue-cos2&#xA;    bandwidth percent 10&#xA;  class type queuing queue-cos4&#xA;    bandwidth percent 15&#xA;  class type queuing queue-cos5&#xA;    bandwidth percent 5&#xA;  class type queuing class-fcoe&#xA;    bandwidth percent 0&#xA;class-map type queuing queue-cos1&#xA;  match qos-group 2&#xA;class-map type queuing queue-cos2&#xA;  match qos-group 3&#xA;class-map type queuing queue-cos4&#xA;  match qos-group 4&#xA;class-map type queuing queue-cos5&#xA;  match qos-group 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I want to apply the service policy on an interface, I get an error stating &quot;Bandwidth percent exceeds 100&quot; : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;N5624-A-1(config-if)# service-policy type queuing input TA-queuing&#xA;ERROR: Bandwidth percent exceeds 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the bandwidth parameters do not add up to 100, they only add up to 50, so I don't understand why this error keeps happening?&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2016-04-30T11:38:53.307" Title="Applying a queuing service policy" Tags="|cisco|qos|cisco-nexus|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29935" PostTypeId="2" ParentId="29933" CreationDate="2016-04-25T11:56:06.333" Score="1" Body="&lt;p&gt;You can simulate an ASA device in software emulators, several products exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although product recommendation is off topic here, searching the web for Cisco emulator should quickly lead to GNS3 which is very popular.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GNS3 require that you provide software image, and there's some licensing concern here, but since the company actually own an ASA, it may be ok (but I can't guaranty it).&#xA;Also I'm not sure it can emulate your specific model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another tool you could use is Cisco VIRL, it's not free but quite cheap, easy to install and has ASA emulation in.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-04-25T11:56:06.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29936" PostTypeId="2" ParentId="29927" CreationDate="2016-04-25T12:37:02.097" Score="3" Body="&lt;p&gt;The ethernet magnetic transformer is required by the ethernet standard. You will find this question, &quot;&lt;em&gt;&lt;a href=&quot;https://electronics.stackexchange.com/questions/27756/why-are-ethernet-rj45-sockets-magnetically-coupled&quot;&gt;Why Are Ethernet/RJ45 Sockets Magnetically Coupled?&lt;/a&gt;&lt;/em&gt;&quot; answered on the &lt;a href=&quot;https://electronics.stackexchange.com/&quot;&gt;Electrical Engineering SE&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The UTP cabling specifications call for a four-pair cable. 10BASE-T and 100BASE-TX use two of the pairs, one transmit and one  receive pair, while 1000BASE-T requires all four pairs, both transmitting and receiving at the same time. If you try to run 1000BASE-T on only two pairs, it will negotiate to 100BASE-TX.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:08.917" LastActivityDate="2016-04-25T12:37:02.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29937" PostTypeId="2" ParentId="29934" CreationDate="2016-04-25T12:50:53.193" Score="5" Body="&lt;p&gt;The default-class uses (by default) 50 percent of the available bandwidth.  You can reduce that value as part of your policy-map.  For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map type queuing TA-queuing&#xA;...&#xA;class-type queuing class-default&#xA;  bandwidth 25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-25T12:50:53.193" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29938" PostTypeId="2" ParentId="24609" CreationDate="2016-04-25T13:23:48.657" Score="2" Body="&lt;p&gt;Ran into a similar issue with Cisco WS-3850 switches connected to both Aruba and Aerohive systems.  Wireless stations roamed between WAPs ( and because the director of IT didn't believe in site surveys, even stationary clients fast roamed ) and the switches threw errors and warnings about &quot;MAC-ADDRESS-FLAP xxxx.xxxx.xxxx&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wasn't really able to resolve this, but potentially one solution - at least for Enterprise WAPs that have a controller appliance or controller server - would be to switch the WAPs from &quot;bridge mode&quot; in which traffic is directly bridged to your wired network and into &quot;tunnel mode&quot; in which traffic is routed either IP in IP or in GRE tunnels back to your controller appliance/server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a campus type network setup or you're in a single building this is not so bad, but the amount of overhead you incur depends greatly on the location of your controller relative to your WAPs.  If your clients access internal resources that are not in a centralized location then the overhead is higher.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think Cisco APs will work with a controller feature built into the WS-3850 switches that will alleviate this problem.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I &quot;resolved&quot; it by disabling ip device tracking on the switches, but this was not an ideal solution.&lt;/p&gt;&#xA;" OwnerUserId="14879" LastActivityDate="2016-04-25T13:23:48.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29939" PostTypeId="1" AcceptedAnswerId="29940" CreationDate="2016-04-25T14:30:48.900" Score="1" ViewCount="672" Body="&lt;p&gt;I have the following setup in GNS3:&lt;a href=&quot;https://i.stack.imgur.com/Yz9au.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Yz9au.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other devices to the right, but they are not needed right now. I have a DMVPN configured with Router1 as hub an Routers 2, 3 and 4 as spokes.&#xA;On the switches I have user VLANs configured as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch1 - VLAN10;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch2 - VLAN20;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch3 - VLAN30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything works fine. Now I want to add a configuration so that traffic from one VLAN, say VLAN10, always passes through the tunnel, but traffic from other VLANs (VLAN20 and VLAN30) does not. I searched extensively, but couldn't find exactly what I was looking for.&#xA;Can someone tell me the commands needed for that or point me to a guide that describes it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Configuration of Router1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 4080 bytes&#xA;!&#xA;version 15.2&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;clock timezone EET 2 0&#xA;mmi polling-interval 60&#xA;no mmi auto-configure&#xA;no mmi pvc&#xA;mmi snmp-timeout 180&#xA;no ip icmp rate-limit unreachable&#xA;ip auth-proxy max-login-attempts 5&#xA;ip admission max-login-attempts 5&#xA;!&#xA;!&#xA;!&#xA;ip dhcp excluded-address 192.168.10.1&#xA;ip dhcp excluded-address 192.168.20.1&#xA;ip dhcp excluded-address 192.168.30.1&#xA;ip dhcp excluded-address 192.168.60.2&#xA;!&#xA;ip dhcp pool NEWPOOL1&#xA; network 192.168.10.0 255.255.255.0&#xA; default-router 192.168.10.1&#xA; dns-server 8.8.8.8&#xA;!&#xA;ip dhcp pool NEWPOOL2&#xA; network 192.168.20.0 255.255.255.0&#xA; default-router 192.168.20.1&#xA; dns-server 8.8.8.8&#xA;!&#xA;ip dhcp pool NEWPOOL3&#xA; network 192.168.30.0 255.255.255.0&#xA; default-router 192.168.30.1&#xA; dns-server 8.8.8.8&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip domain name Router1.net&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;username admin privilege 15 secret 5 $1$0HIq$mwZCmYYlKzNxi1qnQ6Hiq0&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;ip ssh version 2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;crypto isakmp policy 10&#xA; encr 3des&#xA; hash md5&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key freeride address 0.0.0.0&#xA;!&#xA;!&#xA;crypto ipsec transform-set NEW esp-3des esp-sha-hmac&#xA;!&#xA;crypto ipsec profile PROTECT-DMVPN&#xA; set transform-set NEW&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Tunnel0&#xA; ip address 10.0.0.1 255.255.255.0&#xA; no ip redirects&#xA; ip mtu 1440&#xA; no ip next-hop-self eigrp 10&#xA; no ip split-horizon eigrp 10&#xA; ip nhrp authentication NHRPkey&#xA; ip nhrp map multicast dynamic&#xA; ip nhrp network-id 100&#xA; tunnel source Ethernet0/0&#xA; tunnel mode gre multipoint&#xA; tunnel key 100&#xA; tunnel protection ipsec profile PROTECT-DMVPN&#xA;!&#xA;interface Ethernet0/0&#xA; ip address 20.20.20.2 255.255.255.0&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface Ethernet0/1&#xA; no ip address&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface Ethernet0/1.10&#xA; encapsulation dot1Q 10&#xA; ip address 192.168.10.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface Ethernet0/1.20&#xA; encapsulation dot1Q 20&#xA; ip address 192.168.20.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface Ethernet0/1.30&#xA; encapsulation dot1Q 30&#xA; ip address 192.168.30.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface Ethernet0/1.60&#xA; encapsulation dot1Q 60&#xA; ip address 192.168.60.2 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface Ethernet0/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet0/3&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet1/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet1/1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet1/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet1/3&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Serial2/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;!&#xA;router eigrp 10&#xA; network 10.0.0.0 0.0.0.255&#xA; network 20.20.20.0 0.0.0.255&#xA; network 192.168.10.0&#xA; network 192.168.20.0&#xA; network 192.168.30.0&#xA; network 192.168.60.0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip nat inside source list 100 interface Ethernet0/0 overload&#xA;!&#xA;access-list 100 permit ip 192.168.10.0 0.0.0.255 any&#xA;access-list 100 permit ip 192.168.20.0 0.0.0.255 any&#xA;access-list 100 permit ip 192.168.30.0 0.0.0.255 any&#xA;access-list 100 permit ip 192.168.60.0 0.0.0.255 any&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login local&#xA; transport input ssh&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21387" LastEditorUserId="8499" LastEditDate="2018-12-23T05:25:36.903" LastActivityDate="2018-12-23T05:25:36.903" Title="Configuring traffic from certain VLANs to pass through DMVPN [GNS3]" Tags="|cisco|routing|vlan|vpn|gns3|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29940" PostTypeId="2" ParentId="29939" CreationDate="2016-04-25T14:53:07.790" Score="0" Body="&lt;p&gt;One simple way to do this is to use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html&quot; rel=&quot;nofollow&quot;&gt;PBR&lt;/a&gt; to change the route traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should redirect pings from the VLAN interfaces to the interface you want:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended VLAN10_TO_T0&#xA; permit icmp 192.168.10.0 0.0.0.255 host 50.50.50.2 echo&#xA; permit icmp 192.168.10.0 0.0.0.255 host 60.60.60.2 echo&#xA; permit icmp 192.168.10.0 0.0.0.255 host 61.61.61.2 echo&#xA;&#xA;ip access-list extended VLAN20_AND_30_TO_E0&#xA; permit icmp 192.168.20.0 0.0.0.255 host 50.50.50.2 echo&#xA; permit icmp 192.168.20.0 0.0.0.255 host 60.60.60.2 echo&#xA; permit icmp 192.168.20.0 0.0.0.255 host 61.61.61.2 echo&#xA; permit icmp 192.168.30.0 0.0.0.255 host 50.50.50.2 echo&#xA; permit icmp 192.168.30.0 0.0.0.255 host 60.60.60.2 echo&#xA; permit icmp 192.168.30.0 0.0.0.255 host 61.61.61.2 echo&#xA;&#xA;route-map VLAN10_TO_T0 permit 10&#xA; match ip address VLAN10_TO_T0&#xA; set interface Tunnel0&#xA;&#xA;route-map VLAN20_AND_30_TO_E0 permit 10&#xA; match ip address VLAN20_AND_30_TO_E0&#xA; set interface Ethernet0&#xA;&#xA;interface Ethernet0/1.10&#xA; ip policy route-map VLAN10_TO_T0&#xA;&#xA;interface Ethernet0/1.20&#xA; ip policy route-map VLAN20_AND_30_TO_E0&#xA;&#xA;interface Ethernet0/1.30&#xA; ip policy route-map VLAN20_AND_30_TO_E0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Disclaimer:&lt;/strong&gt; This is not tested; I just created it from memory.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-25T15:45:55.497" LastActivityDate="2016-04-25T15:45:55.497" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="29941" PostTypeId="2" ParentId="24780" CreationDate="2016-04-25T14:59:29.667" Score="0" Body="&lt;p&gt;You might be able to do this using OpenVPN instead, although you'd end up needing to install client software.  Assuming that the need is for something more secure than PPTP on the client end...&lt;/p&gt;&#xA;" OwnerUserId="14879" LastActivityDate="2016-04-25T14:59:29.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29942" PostTypeId="1" AcceptedAnswerId="29970" CreationDate="2016-04-25T15:12:56.013" Score="1" ViewCount="1021" Body="&lt;p&gt;Think of the following topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, R1,R2,R3, and R4 are eBGP routers. R3 and R4 also iBGP routers in order to communicate. But in some sample diagrams I noticed, for example, R9 and R8 could be an iBGP router but not eBGP router also. What may be the point in defining a router as only iBGP? Because iBGP uses underlying IGP, I see no use in adding a iBGP router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ejpyv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ejpyv.png&quot; alt=&quot;BGP Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23700" LastActivityDate="2022-01-30T01:08:11.070" Title="What is the need for iBGP-only routers?" Tags="|routing|bgp|" AnswerCount="6" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="29944" PostTypeId="1" CreationDate="2016-04-25T15:40:36.097" Score="1" ViewCount="89" Body="&lt;p&gt;I hope this is the right place to ask this question but can someone tell me how a cell modem with network fallback/forward knows what network it is connected too?  Is there typically an AT-Command that is issued that returns network information or is that determined based on what is going out of the modem?  Like how data is 4G LTE but voice communication falls back to 1xRTT for CDMA modems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking at a Modem with this fallback/forward functionality and for debugging purposes would like to know if it is on a 3G connection or 4G.&lt;/p&gt;&#xA;" OwnerUserId="24898" LastActivityDate="2016-05-17T17:41:34.187" Title="How do Cell Modems know the tower Type they are connected to?" Tags="|mobile|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29945" PostTypeId="1" AcceptedAnswerId="29947" CreationDate="2016-04-25T16:57:26.177" Score="1" ViewCount="5990" Body="&lt;p&gt;I am learning Junos. I applied the following command on my switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hw_tanyu_n@yamsc-a-DC-R1R13-asw-1.cm&amp;gt; configure&#xA;Entering configuration mode&#xA;The configuration has been changed but not committed&#xA;&#xA;{master:3}[edit]&#xA;hw_tanyu_n@yamsc-a-DC-R1R13-asw-1.cm# set interfaces ge-1/0/44 unit 0 description &quot;ydedc1-INFREP01- DC1 R1-R13 (PP 389)&quot;&#xA;&#xA;{master:3}[edit]&#xA;hw_tanyu_n@yamsc-a-DC-R1R13-asw-1.cm# set interfaces ge-1/0/44 unit 0 family ethernet-switching&#xA;&#xA;{master:3}[edit]&#xA;hw_tanyu_n@yamsc-a-DC-R1R13-asw-1.cm# set vlans MTNC_ALOM interface ge-1/0/44.0  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I proceed to &quot;commit-ing&quot; I get the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hw_tanyu_n@yamsc-a-DC-R1R13-asw-1.cm# commit&#xA;error: Access interface &amp;lt;ge-1/0/44.0&amp;gt; has more than one vlan member: mtnc_os and MTNC_ALOM&#xA;error: configuration check-out failed&#xA;&#xA;{master:3}[edit]&#xA;hw_tanyu_n@yamsc-a-DC-R1R13-asw-1.cm#    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What can I do to remove the existing vlan so that I can save the new configuration I need?&lt;/strong&gt;&lt;br&gt;&#xA;Below is the &lt;strong&gt;&quot;show interface&quot;&lt;/strong&gt;    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hw_tanyu_n@yamsc-a-DC-R1R13-asw-1.cm&amp;gt; show interfaces ge-1/0/44  &#xA;Physical interface: ge-1/0/44, Enabled, Physical link is Up&#xA;  Interface index: 319, SNMP ifIndex: 663  &#xA;  Link-level type: Ethernet, MTU: 1514, Speed: Auto, Duplex: Auto, BPDU Error: None, MAC-REWRITE Error: None, Loopback: Disabled,  &#xA;  Source filtering: Disabled, Flow control: Enabled, Auto-negotiation: Enabled, Remote fault: Online  &#xA;  Device flags   : Present Running  &#xA;  Interface flags: SNMP-Traps Internal: 0x0  &#xA;  Link flags     : None  &#xA;  CoS queues     : 8 supported, 8 maximum usable queues  &#xA;  Current address: 00:26:88:6a:53:2f, Hardware address: 00:26:88:6a:53:2f  &#xA;  Last flapped   : 2016-04-25 16:56:01 WAT (16:16:11 ago)  &#xA;  Input rate     : 504 bps (0 pps)  &#xA;  Output rate    : 504 bps (0 pps)  &#xA;  Active alarms  : None  &#xA;  Active defects : None  &#xA;  Interface transmit statistics: Disabled  &#xA;&#xA;  Logical interface ge-1/0/44.0 (Index 181) (SNMP ifIndex 280)  &#xA;    Description: connected to ESXDR-DB Service Console (10.67.53.14/24) on Patch_0389  &#xA;    Flags: SNMP-Traps 0x0 Encapsulation: ENET2  &#xA;    Bandwidth: 0  &#xA;    Input packets : 21  &#xA;    Output packets: 20761  &#xA;    Protocol eth-switch  &#xA;      Flags: None  &#xA;&#xA;{master:3}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24161" LastEditorUserId="509" LastEditDate="2016-04-26T10:06:20.917" LastActivityDate="2016-09-12T04:44:15.703" Title="Cannot commit on Junos" Tags="|switch|juniper|juniper-junos|juniper-ex|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29946" PostTypeId="1" AcceptedAnswerId="29950" CreationDate="2016-04-25T21:57:12.873" Score="1" ViewCount="1950" Body="&lt;p&gt;Cisco &lt;code&gt;ASR1001&lt;/code&gt; comes with 2.5G throughput license and later you can upgrade to 20G. I have question if i have 10G link and i get attack of 5G and i use ACL to drop all packet on ingress interface in that case does 2.5G comes in picture?  How does 2.5G throughput affect my requirement to drop all packet in Ingress. &lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-04-26T07:42:49.250" Title="Cisco ASR1001 licence throughput measurement" Tags="|cisco|throughput|cisco-asr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29947" PostTypeId="2" ParentId="29945" CreationDate="2016-04-25T22:23:33.280" Score="4" Body="&lt;p&gt;It looks like you have the VLAN mtnc_os configured on the interface as well.&#xA;When you add the MTNC_ALOM VLAN it is added to the vlan list. Your port is probably an access port and can only have one VLAN configured.&#xA;Try to reconfigure your port to a trunk port or remove the existing VLAN before comitting.&#xA;Paste the output of &quot;show interfaces ge-1/0/44&quot; if that does not help.&lt;/p&gt;&#xA;" OwnerUserId="24903" LastActivityDate="2016-04-25T22:23:33.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29948" PostTypeId="1" AcceptedAnswerId="29959" CreationDate="2016-04-26T03:02:04.147" Score="1" ViewCount="706" Body="&lt;p&gt;I'm trying to isolate a device on the network so it can't access my router's admin interface.&#xA;Is there a device that can connect to my main network over wifi then have maybe a NAT to only give internet access to devices plugged into or connected over wifi to this intermediate device?&#xA;If it can be small and portable the better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="24906" LastActivityDate="2016-04-26T13:04:57.617" Title="How to isolate a device on a network" Tags="|nat|ieee-802.11|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="29950" PostTypeId="2" ParentId="29946" CreationDate="2016-04-26T07:42:49.250" Score="3" Body="&lt;p&gt;Yes those dropped packets would factor into available throughput, and this is because ACLs are processed by the ESP [Embedded Services Processor] which measures bandwidth. All those packets are being processed by the ESP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anything beyond the licensed throughput during that point in time will not be processed. This includes both good and malicious traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information on where the various components are handled on the ASR can be found in the following document:&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-series-aggregation-services-routers/qa_c67-452124.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/routers/asr-1000-series-aggregation-services-routers/qa_c67-452124.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14613" LastActivityDate="2016-04-26T07:42:49.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29955" PostTypeId="2" ParentId="29923" CreationDate="2016-04-26T11:31:26.593" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;Partially.  The manager and agent don't really apply to this type of connection, but the switch is the SNMP server and the Linux box is the client.&lt;/li&gt;&#xA;&lt;li&gt;The SNMP daemon would need to run on the switch.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Furthermore, since most of NetGear's suite is &lt;em&gt;unmanaged&lt;/em&gt; switches, you need to ensure that your switch is a &lt;em&gt;managed&lt;/em&gt; switch.  The safe bet is if you assigned your switch an IP address, then it can be managed.  However, I would check the product documentation to be sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The below steps are correct, you'll specifically need &lt;code&gt;net-snmp-utils&lt;/code&gt; installed, and for your user you can put the MIBs into the &lt;code&gt;~/.snmp/mibs/&lt;/code&gt; directory.&lt;/p&gt;&#xA;" OwnerUserId="13537" LastActivityDate="2016-04-26T11:31:26.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29956" PostTypeId="2" ParentId="29942" CreationDate="2016-04-26T11:54:10.100" Score="0" Body="&lt;p&gt;iBGP inside of an AS is only used when: &lt;br /&gt;&#xA;- you need to configure border-routers (R3+R4) &lt;br /&gt;&#xA;- the network is too big and the OSPF limitation is reached&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You normally split a huge network in smaller areas. &lt;br /&gt;&#xA;IMHO there is no need for iBGP as an IGP like in the 2nd case. &lt;br /&gt;&#xA;You normally split big networks in smaller areas which are easier to maintain. &lt;br /&gt;&lt;/p&gt;&#xA;" OwnerUserId="14081" LastActivityDate="2016-04-26T11:54:10.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29958" PostTypeId="2" ParentId="29942" CreationDate="2016-04-26T12:53:50.767" Score="0" Body="&lt;p&gt;iBGP is for internal use on an AS, is entablished between routers on the same AS. By other hand, eBGP is between routers on different AS, is on the way that internet works. On your question, you said that why routers on the same AS some time need to learn routes learned by BG, i guess, because BGP works with the major posibilities of some routing protocols, it can be used to control the way that traffic flow on your AS: maybe you are a transit AS connected to different ISP, Providers an so on, then you can control the path that traffic get to reach some networks, and with that, saving money(maybe your L2 providers have different prices), providing the less congested link to some ISP, use the fastest link to leave your AS, and some other scenarios. &lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-04-26T12:53:50.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29959" PostTypeId="2" ParentId="29948" CreationDate="2016-04-26T13:04:57.617" Score="2" Body="&lt;p&gt;You can get the mac address of the device that you want to isolate, and put it on your router, blocking or filtering the access to the admin console. That is a basic security function on networks devices.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-04-26T13:04:57.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29962" PostTypeId="1" AcceptedAnswerId="29964" CreationDate="2016-04-26T13:11:53.190" Score="6" ViewCount="508" Body="&lt;p&gt;Could someone please help me understand the concepts of NAT? I thought I understood how this works, but I'm confused about there being two public addresses, as opposed to just one public internet address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding on NAT is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Inside Local&lt;/strong&gt; - The RFC 1918 private address or addresses before translation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Outside Local&lt;/strong&gt; - The outgoing interface IP of the router connected to the ISP (is this also an RFC 1918 private address???)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Inside Global&lt;/strong&gt; - The local IP address after translation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Outside Global&lt;/strong&gt; - The real internet address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please correct me here if I'm wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I've seen examples of the NAT translations, I understand the &lt;strong&gt;inside local&lt;/strong&gt; address is the local private IP range, with the &lt;strong&gt;inside global&lt;/strong&gt; address being the local address address after translation. What I don't understand is where the public addresses for &lt;strong&gt;outside local&lt;/strong&gt; and &lt;strong&gt;outside global&lt;/strong&gt; come from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I ask this is because when I configure PAT, I'd use the following command for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat pool test 2.2.2.2 2.2.2.2 net 255.255.255.0&#xA;access list 10 permit 192.168.100.0 0.0.0.255&#xA;ip nat pool inside source list 1 pool test overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd then apply the following on the inside local interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With the following on the serial interface going to the ISP&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By definition, I've specified the NAT pool address to use, and specified the allowed networks with the &lt;strong&gt;ip nat inside&lt;/strong&gt; command, so is there something additional I'd need to configure for the actual public addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated, as I'm having a hard time trying to grasp the concepts here.&lt;/p&gt;&#xA;" OwnerUserId="23950" LastActivityDate="2016-10-26T21:15:43.113" Title="Network Address Translation fundamentals" Tags="|cisco|nat|cisco-ios|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29964" PostTypeId="2" ParentId="29962" CreationDate="2016-04-26T13:36:42.830" Score="4" Body="&lt;p&gt;I can help you understand the names of the NAT addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each name breaks down to...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The {inside | outside} device is {globally | locally} known as &amp;lt;Address Name&amp;gt;.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the purpose of this explanation, inside and local both refer to the side of the network that the NAT inside interface is in.  Outside and global both refer to the side of the network that the NAT outside interface is in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, the &lt;strong&gt;Inside Local&lt;/strong&gt; address.  The &lt;strong&gt;Inside&lt;/strong&gt; device is &lt;strong&gt;Locally&lt;/strong&gt; known as the &lt;strong&gt;Inside Local&lt;/strong&gt; address.  On standard overload NAT, this is the private IP space that is actually assigned to hosts on your internal network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next is the &lt;strong&gt;Inside Global&lt;/strong&gt; address.  The &lt;strong&gt;Inside&lt;/strong&gt; device is &lt;strong&gt;Globally&lt;/strong&gt; known as the &lt;strong&gt;Inside Global&lt;/strong&gt; address.  On standard overload NAT, this is the public IP address of your router that the Internet sees your local hosts as.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the &lt;strong&gt;Outside Local&lt;/strong&gt; address.  The &lt;strong&gt;Outside&lt;/strong&gt; device is &lt;strong&gt;Locally&lt;/strong&gt; known as the &lt;strong&gt;Outside Local&lt;/strong&gt; address.  On standard overload NAT, this is the public Internet IP address that the internal clients direct their IP packets towards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the &lt;strong&gt;Outside Global&lt;/strong&gt; address.  The &lt;strong&gt;Outside&lt;/strong&gt; device is &lt;strong&gt;Globally&lt;/strong&gt; known as the &lt;strong&gt;Outside Global&lt;/strong&gt; address.  On standard overload NAT, this is the public IP address that the internal clients direct their IP packets towards.  Note that it is the same as the Outside Local address, since both inside clients and the public Internet see the same IP for the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as &quot;using two public IP addresses&quot;: In your example, the &quot;test&quot; pool is defining the public IP address to use.  Your other option would be to use the &quot;interface &lt;em&gt;interface&lt;/em&gt;&quot; command instead of the pool.  You only define the public IP (or pool of IPs) one time.&lt;/p&gt;&#xA;" OwnerUserId="155" LastEditorUserId="155" LastEditDate="2016-04-26T13:52:26.617" LastActivityDate="2016-04-26T13:52:26.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29965" PostTypeId="2" ParentId="29962" CreationDate="2016-04-26T13:38:34.160" Score="3" Body="&lt;p&gt;Since you used the Cisco tags, I will provide the Cisco definitions. Simply put, NAT is translating one or more addresses in packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several versions of NAT for Cisco devices: inside source, inside destination, and outside source. You seem to want to understand the inside source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT doesn't really have anything to do with RFC 1918 address space. You can NAT any addresses, public or private. The most common use does translate from local private addressing to public addressing, but that is not a requirement for NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you search, Cisco has many documents about NAT, for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/4606-8.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;NAT: Local and Global Definitions&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Term Definitions&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Cisco defines these terms as:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Inside local address&lt;/strong&gt;—The IP address assigned to a host on the inside network. This is the address configured as a parameter of the &#xA;  computer OS or received via dynamic address allocation protocols such &#xA;  as DHCP. The address is likely not a legitimate IP address assigned &#xA;  by the Network Information Center (NIC) or service provider.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Inside global address&lt;/strong&gt;—A legitimate IP address assigned by the NIC or service provider that represents one or more inside local IP &#xA;  addresses to the outside world.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Outside local address&lt;/strong&gt;—The IP address of an outside host as it appears to the inside network. Not necessarily a legitimate address, &#xA;  it is allocated from an address space routable on the inside.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Outside global address&lt;/strong&gt;—The IP address assigned to a host on the outside network by the host owner. The address is allocated from a &#xA;  globally routable address or network space.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;These definitions still leave a lot to be interpreted. For this&#xA;  example, this document redefines these terms by first defining local&#xA;  address and global address. Keep in mind that the terms inside and&#xA;  outside are NAT definitions. Interfaces on a NAT router are defined as&#xA;  inside or outside with the NAT configuration commands, &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_3/ipaddr/command/reference/ip1_i2g.html#wp1079025&quot; rel=&quot;nofollow noreferrer&quot;&gt;ip nat inside&#xA;  destination&lt;/a&gt; and &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_3/ipaddr/command/reference/ip1_i2g.html#wp1079462&quot; rel=&quot;nofollow noreferrer&quot;&gt;ip nat outside source&lt;/a&gt;. Networks to which&#xA;  these interfaces connect can then be thought of as inside networks or&#xA;  outside networks, respectively.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Local address&lt;/strong&gt;—A local address is any address that appears on the inside portion of the network.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Global address&lt;/strong&gt;—A global address is any address that appears on the outside portion of the network.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Packets sourced on the inside portion of the network have an inside&#xA;  local address as the source address and an outside local address as&#xA;  the destination address of the packet, while the packet resides on the&#xA;  inside portion of the network. When that same packet gets switched to&#xA;  the outside network, the source of the packet is now known as the&#xA;  inside global address and the destination of the packet is known as&#xA;  the outside global address.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Conversely, when a packet is sourced on the outside portion of the&#xA;  network, while it is on the outside network, its source address is&#xA;  known as the outside global address. The destination of the packet is&#xA;  known as the inside global address. When the same packet gets switched&#xA;  to the inside network, the source address is known as the outside&#xA;  local address and the destination of the packet is known as the inside&#xA;  local address.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This image provides an example.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fjsS1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fjsS1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-26T13:38:34.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29967" PostTypeId="2" ParentId="28208" CreationDate="2016-04-26T14:51:32.760" Score="1" Body="&lt;p&gt;You are probably looking at what is referred to as &lt;strong&gt;Unicast Flooding&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a switch receives a frame for which it doesn't know the destination MAC address, it &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-switch/#flooding&quot; rel=&quot;nofollow noreferrer&quot;&gt;floods&lt;/a&gt; it out all ports. There is more detail about that process and how a Switch works in this thread:  &lt;a href=&quot;https://networkengineering.stackexchange.com/a/29325/3675&quot;&gt;How does a switch learn a MAC address not in its lookup table?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is normal behavior in Ethernet networks. Nothing to be concerned about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reasons for concern would be if you see this consistently and constantly, and the 'box3' mac-address &lt;em&gt;is&lt;/em&gt; connected and sending frames regularly. &lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-04-26T14:51:32.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29968" PostTypeId="2" ParentId="29942" CreationDate="2016-04-26T14:58:50.103" Score="0" Body="&lt;p&gt;In a transit network (ie one that forwards traffic to other networks), routers which provide paths between border routers (such as Rs 5,6,7,8,9 in your drawing) must speak iBGP in order to distribute the routes the border routers receive to the other border routers.&lt;/p&gt;&#xA;" OwnerDisplayName="user661" LastActivityDate="2016-04-26T14:58:50.103" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29970" PostTypeId="2" ParentId="29942" CreationDate="2016-04-26T15:58:18.673" Score="0" Body="&lt;p&gt;The Internet is full of reasons to use iBGP. For instance, &lt;a href=&quot;http://forum.nil.com/viewtopic.php?f=10&amp;amp;t=18&quot; rel=&quot;nofollow&quot;&gt;iBGP reasons? on the NIL Forum&lt;/a&gt;. BGP also uses a standard TCP connection to exchange route information. A big reason is that you want to redistribute your IGP routes into BGP, but you don't want to redistribute the BGP routes into your IGP; this can cause routing loops. Yes, it is easier to provide a default route to the eBGP routers, but that is not always appropriate, either.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-26T15:58:18.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29976" PostTypeId="1" AcceptedAnswerId="29978" CreationDate="2016-04-26T20:09:22.283" Score="4" ViewCount="623" Body="&lt;p&gt;I have a question about NTP. We want to setup our core switches as NTP master for our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have three data centers.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Site A : Two Nexus as core&lt;/li&gt;&#xA;&lt;li&gt;Site B : two Nexus as core&lt;/li&gt;&#xA;&lt;li&gt;Site C : two 6800 (in VSS, so it's kind of one logical switch) as&#xA;core&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In sites A and B, we have servers. In site C, we have servers and clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We want our network devices (servers, clients, etc) to get their time from these switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking about setting external NTP servers from the internet on these switches and connect them as NTP peers.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Should we connect all cores switches (from all three sites) as &quot;NTP &#xA;peers&quot; all together (kind of full mesh setup)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should each site have their local switches connected as peers,&#xA;Except Site C, which a one logical switch?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Should all clients/servers be configured to use all NTP servers (so&#xA;their list of NTP servers will be all switches from all sites over&#xA;WAN)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clients/servers should only have their local NTP servers configured?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Should all core switches acting as NTP masters have their clock sync&#xA;with NTP servers on the internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only some NTP masters should be connected to the internet for&#xA;external sync? If so, would you chose a dedicated site for this or&#xA;one switches in each site?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="24933" LastEditorUserId="8499" LastEditDate="2016-04-26T20:32:10.093" LastActivityDate="2016-04-26T20:58:55.313" Title="NTP architecture questions" Tags="|cisco|cisco-ios|cisco-nexus|ntp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29977" PostTypeId="1" CreationDate="2016-04-26T20:16:09.527" Score="0" ViewCount="59" Body="&lt;p&gt;I'm building a router that uses machine learning to recognize certain network flows for bandwidth allocation and it has become apparent I will need to maintain a lookup table of users in the system. I will only have access to the data at the transport layer, and I'm unsure how to be certain who's who in a dynamic system (assuming the majority of the packet data will be encrypted).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any conventional/well known ways to do this? I've been approaching this problem as a machine learning engineer, still a newbie in networking. I can think of a few ways to use behavioral biometrics on the network traffic, but that would be a very resource heavy way of solving the problem (and not necessarily very accurate).&lt;/p&gt;&#xA;" OwnerUserId="24932" LastActivityDate="2016-04-26T20:48:34.387" Title="Identifying users at the transport layer" Tags="|routing|tcp|transport-protocol|" AnswerCount="1" CommentCount="4" ClosedDate="2016-04-28T04:56:40.630" ContentLicense="CC BY-SA 3.0" />
  <row Id="29978" PostTypeId="2" ParentId="29976" CreationDate="2016-04-26T20:26:52.410" Score="3" Body="&lt;p&gt;Unless you have a very good NTP source, you should set up your NTP servers as clients of low-stratum NTP servers elsewhere (e.g. Internet). You can, and probably should, use multiple, external servers as NTP servers for your NTP servers, but not as peers since the low-stratum NTP servers will not actually peer with you (peers should be at the same stratum).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could set up your servers at the various sites as peers, but this may add more complexity, latency, and prove unnecessary if they are getting their time from the same external servers. You probably do want to do this with your NTP servers within a single site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your core switches are true core switches (not routing, just dedicated to high-speed switching), you probably don't want to burden them with NTP requests from every device at a site. You should use the distribution routers/switches for NTP servers. The end-devices on each VLAN would get their time from the server dedicated for the VLAN on which they are addressed. The VLAN NTP servers could be the distribution or access switches for the VLAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-26T20:26:52.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29979" PostTypeId="2" ParentId="29977" CreationDate="2016-04-26T20:48:34.387" Score="2" Body="&lt;p&gt;A user can not be directly identified at the transport layer. The common ways firewalls handle this is by associating the IP address somehow with the user and then mapping any flows to a user based on source IP address. Of course this will fail if there are multiple users behind the same source IP, like in multi user systems (UNIX, Windows Terminal Server...) or if the source of the traffic is a network with NAT where multiple IP addresses are mapped to a single one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For building the association between user and IP address various methods are typically used, like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;having some kind of static mapping&lt;/li&gt;&#xA;&lt;li&gt;dynamic detection which user is logged in at a specific system by having some agent running on the system, checking against active directory or similar&lt;/li&gt;&#xA;&lt;li&gt;having a capture portal where the yet unknown user needs to login before he can access any outside resources&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="4063" LastActivityDate="2016-04-26T20:48:34.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29981" PostTypeId="2" ParentId="29976" CreationDate="2016-04-26T20:53:34.823" Score="1" Body="&lt;p&gt;I might be running an older code train that doesn't support this but I think if you go an do some checking you will find that Cisco Nexus devices will not act as an NTP server.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, you would probably benefit greatly from looking at (3) devices that does some form of Stratum 1 (GPS, CDMA/GSM, Rubidum crystal oscillator, radio, etc).  With 3 devices or more, you end up with quorum which is ideal for maintaining very synchronized time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If costs are a great barrier, there are some Open Source type projects.&lt;/p&gt;&#xA;" OwnerUserId="24935" LastEditorUserId="8499" LastEditDate="2016-04-26T20:58:55.313" LastActivityDate="2016-04-26T20:58:55.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29985" PostTypeId="2" ParentId="29447" CreationDate="2016-04-27T07:05:47.267" Score="3" Body="&lt;p&gt;Unfortunately the 3560X does not support packet capture. However, you may be able to use RSPAN (Remote SPAN) to capture traffic on the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How this would work is you would configure the remove device with a new VLAN for remote span, and setup a monitor session to go to that remote VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any devices in-between that remote VLAN must be trunked and configured. Because of this, RSPAN will not traverse most WAN links (Layer 2 Only).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example Config for Remote Device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config)#vlan &amp;lt;#&amp;gt;&#xA;switch(config-if)# remote-span&#xA;switch(config-if)#exit&#xA;switch(config)#monitor session 2 source interface Gi 0/1&#xA;switch(config)monitor session 2 destination remote vlan &amp;lt;#&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example Config for Device to SPAN to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config)#vlan &amp;lt;#&amp;gt;&#xA;switch(config-if)#remote-span&#xA;switch(config-if)#exit&#xA;switch(config)#monitor session 2 source remote vlan &amp;lt;#&amp;gt;&#xA;switch(config)#monitor session 2 destination interface fa 0/2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may also be able to use the command: &lt;code&gt;debug vlan packet&lt;/code&gt; to see any VLAN tagged packets the device is not configured for. I was not able to confirm if this was available on the 3560, and I do not have one to test.&lt;/p&gt;&#xA;" OwnerUserId="14613" LastEditorUserId="8499" LastEditDate="2016-04-27T07:14:46.677" LastActivityDate="2016-04-27T07:14:46.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="29986" PostTypeId="1" AcceptedAnswerId="29988" CreationDate="2016-04-27T07:13:33.270" Score="1" ViewCount="562" Body="&lt;p&gt;My goal is to send to a specific interface all ethernet traffic with a special ethertype. I have thus a virtual switch with &lt;code&gt;OpenVSwitch&lt;/code&gt; on my interface &lt;code&gt;eth0&lt;/code&gt;, and I use tap interfaces to retrieve specific frames in order to process them. The normal flow is sent to &lt;code&gt;tap1&lt;/code&gt;, while the special flow is sent to &lt;code&gt;tap0&lt;/code&gt;. Here is the OpenVSwitch configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ovs-vsctl show&#xA;44c95237-25bd-45fd-bb97-d596aecf5f46&#xA;Bridge brLan&#xA;    Port &quot;tap0&quot;&#xA;        Interface &quot;tap0&quot;&#xA;    Port &quot;tap1&quot;&#xA;        Interface &quot;tap1&quot;&#xA;    Port eth0&#xA;        Interface eth0&#xA;    Port brLan&#xA;        Interface brLan&#xA;            type: internal&#xA;ovs_version: &quot;2.5.0&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the bridge &lt;code&gt;brLan&lt;/code&gt;, with 3 ports (&lt;code&gt;eth0&lt;/code&gt;, &lt;code&gt;tap0&lt;/code&gt;, and &lt;code&gt;tap1&lt;/code&gt;), I'd like to switch all frames with ethertype = &lt;code&gt;0x88B5&lt;/code&gt; to &lt;code&gt;tap0&lt;/code&gt;, while all other frames are going though &lt;code&gt;tap1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made thus these OpenFlow rules:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ovs-ofctl add-flow brLan &quot;idle_timeout=0,priority=33100,in_port=1,dl_type=0x88b5,actions=output:6&quot;&#xA;# ovs-ofctl add-flow brLan &quot;idle_timeout=0,priority=33100,in_port=1,actions=output:7&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where &lt;code&gt;6&lt;/code&gt; is the ID of &lt;code&gt;tap0&lt;/code&gt; and &lt;code&gt;7&lt;/code&gt; is the ID of &lt;code&gt;tap1&lt;/code&gt;, displayed with &lt;code&gt;# ovs-ofctl show brLan&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if I send the frames to this interface &lt;code&gt;eth0&lt;/code&gt; with the ethertype &lt;code&gt;0x88B5&lt;/code&gt;, they aren't switched to &lt;code&gt;tap0&lt;/code&gt;, as shows the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ovs-ofctl dump-flows brLan&#xA;NXST_FLOW reply (xid=0x4):&#xA;cookie=0x0, duration=54229.821s, table=0, n_packets=27269, n_bytes=1636190, idle_age=0, priority=33100,in_port=1 actions=output:7&#xA;cookie=0x0, duration=54229.790s, table=0, n_packets=0, n_bytes=0, idle_age=54229, priority=33100,in_port=1,dl_type=0x88b5 actions=output:6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first flow is the normal flow of usual ethernet frames, and I see it's OK, well switched to tap1. But about the flow to &lt;code&gt;output:6&lt;/code&gt;, no frames arrive, &lt;em&gt;even though I can display them using WireShark!&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how to solve this, to make the switching of frames with ether_type = &lt;code&gt;0x88B5&lt;/code&gt; arrive to &lt;code&gt;tap0&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="17011" LastEditorUserId="8499" LastEditDate="2016-04-27T07:43:17.700" LastActivityDate="2016-05-27T09:56:29.533" Title="OpenFlow switching based on a specific ethertype" Tags="|ethernet|openflow|tap|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="29987" PostTypeId="1" AcceptedAnswerId="29990" CreationDate="2016-04-27T09:10:00.620" Score="2" ViewCount="176" Body="&lt;p&gt;Would like to ask a BGP question; in the first link picture there is no direct link on the two bottom layer3 switches but they form a ibgp neighbor with each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9RYeF.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9RYeF.jpg&quot; alt=&quot;no bottom link between layer 3 switches&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the second link picture, the layer3 switches are connected in a ring topology and iBGP is run between all routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tMcXp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tMcXp.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is which is the best topology? I will be running MPLS onwards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind Regards&lt;/p&gt;&#xA;" OwnerUserId="14255" LastEditorUserId="14255" LastEditDate="2016-04-27T09:33:36.783" LastActivityDate="2016-04-27T18:57:28.320" Title="BGP Question please" Tags="|bgp|mpls|network-core|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29988" PostTypeId="2" ParentId="29986" CreationDate="2016-04-27T09:24:53.237" Score="0" Body="&lt;p&gt;The problem was with the priorities given to the flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the 2 flows look into the &lt;strong&gt;same&lt;/strong&gt; port (&lt;code&gt;eth0&lt;/code&gt;), they &lt;strong&gt;have to&lt;/strong&gt; have different priorities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting the first flow to :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ovs-ofctl add-flow brLan &quot;idle_timeout=0,priority=44100,in_port=1,dl_type=0x88b5,actions=output:6&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This solved the problem&lt;/p&gt;&#xA;" OwnerUserId="17011" LastActivityDate="2016-04-27T09:24:53.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29989" PostTypeId="1" AcceptedAnswerId="30202" CreationDate="2016-04-27T09:52:27.573" Score="2" ViewCount="2398" Body="&lt;p&gt;I am trying to resurrect a once working VPN between two Sonicwall devices.&#xA;The branch office is the initiator and sends the request, the main office drops the packets and signals an error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IKE Initiator drop: VPN tunnel end point does not match configured VPN Policy Bound to scope&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Have you seen this error before? Can you suggest what to do about it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More details on the configuration.&#xA;I assume nothing has changed on the main office configuration. I have changed things in the branch office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The branch office has two local networks, a local one for the office devices (printer etc) and a second one for the VPN. It has only one public IP on the modem/router/all in one. The Sonicwall manages the VPN but has to go through the local network out to the modem.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                    =----= printer, wifi&#xA;modem+LAN(10.X.X.X) =----= X1-Sonicwall-VPN-X0 (192.168.X.X) =--= Tunnelling PCs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The modem is doing NAT for the local network, and the Sonicwall is doing NAT for its own network.&lt;/p&gt;&#xA;" OwnerUserId="24819" LastEditorUserId="24819" LastEditDate="2016-05-06T11:49:17.433" LastActivityDate="2016-08-04T13:33:31.770" Title="Sonicwall IKE Initiator drop" Tags="|vpn|nat|sonicwall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29990" PostTypeId="2" ParentId="29987" CreationDate="2016-04-27T10:21:48.380" Score="4" Body="&lt;p&gt;BGP does not care if the peer is directly attached or not, as long as peers can communicate with each other, so from BGP point-of-view both topologies are strictly identical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why there's an IGP running within the AS so each BGP router knows how to reach its peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that the IGP can be iBGP may cause confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Design your iBGP topology as an IGP, the same way you would do with OSPF for example, put it in place, then add the eBGP layer.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="17035" LastEditDate="2016-04-27T15:36:31.580" LastActivityDate="2016-04-27T15:36:31.580" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="29995" PostTypeId="2" ParentId="29942" CreationDate="2016-04-27T18:32:46.967" Score="0" Body="&lt;p&gt;&lt;strong&gt;eBGP&lt;/strong&gt; makes your border routers learn about best routes to reach each prefix on Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;iBGP&lt;/strong&gt; will let all your internal routers know about those external prefixes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R4 for instance should know that some prefixes are preferred through R1, even if it's directly connected to R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;iBGP does usually &lt;strong&gt;not&lt;/strong&gt; use internal routing protocol directly. If R1 anounces a prefix with its local interface as a source, either:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R3 announce this prefix through iBGP unmodified,&lt;/li&gt;&#xA;&lt;li&gt;R3 reannounce this prefix through iBGP using its loopback interface, or an internal interface (nexthop self),&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In both cases an internal routing protocol is needed to propagate internal routes (in one case including external links, in one case not).&lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2016-04-27T18:32:46.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29996" PostTypeId="1" AcceptedAnswerId="30002" CreationDate="2016-04-27T18:38:26.543" Score="1" ViewCount="1600" Body="&lt;p&gt;I have tried to find the answer online and I was trying to make sure my understanding is correct. So if someone can point me to the correct path please do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding of vlan extension are vlans that are created on switches (l2 or l3) then configure a trunk and allow the vlans to travel on it. (Please correct it if I am failing to understand it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will customers have a better experience on a network with VPLS connection? I believe it is also good for the router as it reduces workload?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it worth it to break down a network thats already using vlan extensions to put up vpls ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like others to explain these few points to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1HpaB.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1HpaB.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally my topology is like this, the bgp is ok I am going to connect the 3 l3 switches and configure them with iBGP between them. Then I will run MPLS on the L3 switches. since the organization is extending vlan 110 all the way to the gpon I was thinking that If I can configure VPLS it will improve the way the services are used on the network, as as far as I see its layer 2 configuration being done from the L3switches all the way to the gpon equipment. &lt;/p&gt;&#xA;" OwnerUserId="14255" LastEditorUserId="14255" LastEditDate="2016-04-28T06:46:50.997" LastActivityDate="2016-04-28T06:46:50.997" Title="Vlan Extension vs VPLS + need understanding" Tags="|routing|vlan|mpls|network-core|vpls|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29997" PostTypeId="1" AcceptedAnswerId="30000" CreationDate="2016-04-27T18:55:53.223" Score="6" ViewCount="1587" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6/configuration/15-2mt/ipv6-15-2mt-book/ip6-addrg-bsc-con.html&quot;&gt;This document&lt;/a&gt; shows that you can use one of these options:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface type/number  &#xA; ipv6 address ipv6-prefix/prefix-length eui-64  &#xA; ipv6 address ipv6-prefix/prefix-length link-local    &amp;lt;------format &#xA; ipv6 address ipv6-prefix/prefix-length anycast &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the other hand when you try the command line options you get these:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config-subif)# ipv6 address ?  &#xA;  WORD                General prefix name  &#xA;  X:X:X:X::X          IPv6 link-local address  &#xA;  X:X:X:X::X/&amp;lt;0-128&amp;gt;  IPv6 prefix  &#xA;  autoconfig          Obtain address using autoconfiguration&#xA;  dhcp                Obtain a ipv6 address using dhcp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the command &lt;strong&gt;ipv6 address FE80::1 link-local&lt;/strong&gt; will work without following the format pointed above. What am I missing here?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: here are some tests using the format indicated by documentation  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config-subif)#ipv6 address FE80::1/11 link-local  &#xA;                                         ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;R1(config-subif)#ipv6 address FE80::1/10 link-local &#xA;                                         ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;R1(config-subif)#ipv6 address FE80::0/10 link-local &#xA;                                         ^&#xA;% Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1647" LastEditorUserId="8499" LastEditDate="2018-12-20T04:17:30.960" LastActivityDate="2018-12-20T04:17:30.960" Title="Why is Cisco enforcing X:X:X:X::X for link-local addresses when the standard says FE80:/10?" Tags="|cisco|cisco-ios|ipv6|cisco-commands|interface|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="29998" PostTypeId="2" ParentId="29987" CreationDate="2016-04-27T18:57:28.320" Score="3" Body="&lt;p&gt;If you can directly attach 2 hosts, do it. If the link goes down, all your routing protocol will react instantly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise you will rely on routing protocols timeouts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover a more densely meshed network will guarantee a shorter path. &lt;/p&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2016-04-27T18:57:28.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30000" PostTypeId="2" ParentId="29997" CreationDate="2016-04-27T19:55:42.990" Score="7" Body="&lt;p&gt;The document to which you link claims a specific IOS version. It may be incorrect; that would not be unusual in Cisco documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In reality, having tested this on several IOS 15.X versions, you do not specify a prefix length on a link-local address since it is implicit for the link local address, as you saw in your CLI help (&lt;code&gt;ipv6 address ?&lt;/code&gt; shows &lt;code&gt;X:X:X:X::X IPv6 link-local address&lt;/code&gt;, the address without a prefix length). You do specify the prefix length on a non-link-local IPv6 address since there is no implicit prefix length.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I think specifying specific link-local addresses on your interfaces is going to be a giant pain, with little to no gain. Just enabling IPv6 on an interface will assign a unique link-local address, and that is all you really need. There is really no security risk about having the Interface ID being derived from the MAC address, since the address will never be seen off-link, and it won't be tracked across the Internet as a Global Scope address could be.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-27T19:55:42.990" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30002" PostTypeId="2" ParentId="29996" CreationDate="2016-04-27T20:19:48.863" Score="2" Body="&lt;p&gt;There are many ways to extend VLANs.  Trunks are just one way. VPLS is another. The best method to use depends on several factors, most notably, the type of media that link the two locations, the distance, whether the link is under your control, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides the concerns about reliability, cost, etc., you also have to consider the impact of spanning tree, flooding, loops, storms, etc.  Each method has different ways of mitigating these issues.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your specific question about VPLS, we would need to know a lot more information.  A diagram would be useful, along with some idea of traffic flows, and the kinds of hosts on both ends.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-27T20:19:48.863" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30003" PostTypeId="2" ParentId="29919" CreationDate="2016-04-27T21:14:29.940" Score="1" Body="&lt;p&gt;I asked my network course doctor in university, according to what he said, the receiver must exist in the range of the sender. So, even if the sender can provide more range, the only range that matters is the receivers range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so if the phone had 30 meters range, the total range for the system is 30meters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I was wrong,&quot;the only range that matters is the receivers range.&#xA;&quot; is wrong,,,  they should be in range of each other . &#xA;thanks to @Ron&lt;/p&gt;&#xA;" OwnerUserId="24881" LastEditorUserId="24881" LastEditDate="2016-04-29T22:25:13.593" LastActivityDate="2016-04-29T22:25:13.593" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30006" PostTypeId="1" AcceptedAnswerId="30007" CreationDate="2016-04-28T00:47:25.443" Score="1" ViewCount="3411" Body="&lt;p&gt;I figured this would be the best place to try and get an answer. So I'm following a packet tracer tutorial and it contains a node I've never seen before, nor can I find it, it seems to emulate (at least a part of) the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried recreating it using a cloud node and frame-relay, but then I realised the two routers connecting through it aren't on the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xDTel.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xDTel.png&quot; alt=&quot;Unknown node (internet emulation node?)&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know where I can find this node? It doesn't seem to be in packet tracer itself, maybe it's an add-on of some kind? Or is there something I have to configure in the cloud node (which it appears to closely resemble) for it to appear like this?&lt;/p&gt;&#xA;" OwnerUserId="20864" LastActivityDate="2022-04-20T12:43:50.253" Title="What is this node in packet tracer?" Tags="|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30007" PostTypeId="2" ParentId="30006" CreationDate="2016-04-28T00:56:59.603" Score="2" Body="&lt;p&gt;That's not a node, that's a cloud representing the Internet. You have no way of knowing how the Internet is connected, so it is represented as a cloud. It represents a whole lot of nodes.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-28T00:56:59.603" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30008" PostTypeId="1" CreationDate="2016-04-28T02:54:40.937" Score="1" ViewCount="7442" Body="&lt;p&gt;Running into two separate but probably similar issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First issue - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two Cisco 2900 Series routers on firmware v15.2(4)M4 trying to ssh into a Dell 5548P stack on firmware v4.1.0.8. All attempts fail instantly with - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#ssh 1.2.3.4&#xA;[Connection to 1.2.3.4 aborted: error status 0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Buffer log shows - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SSH2 CLIENT 0: Server has chosen 2056 -bit dh keys&#xA;%SSH-3-INV_MOD: Invalid modulus length&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I try to modify the DH key length on the router, attempts still fail and buffer log shows - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SSH2 CLIENT 0: Server has chosen 2056 -bit dh keys&#xA;%SSH-3-INV_MOD: Invalid modulus length  &#xA;%SSH-3-DH_RANGE_FAIL: Client DH key range mismatch with maximum configured DH key on server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SSH config on router - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SSH Enabled - version 2.0&#xA;Authentication timeout: 120 secs; Authentication retries: 3&#xA;Minimum expected Diffie Hellman key size : 1024 bits&#xA;IOS Keys in SECSH format(ssh-rsa, base64 encoded):&#xA;ssh-rsa keystringgoeshere&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SSH config on 5548P stack - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SSH Server enabled. Port: 22&#xA;RSA key was generated.&#xA;DSA(DSS) key was generated.&#xA;SSH Public Key Authentication is disabled.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There don't seem to be any in-depth settings related to the ssh server here that I can modify.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second issue - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have another two Cisco 2900 Series routers at a different site on firmware v15.4(3)M3 trying to ssh into a Dell N1548P stack on firmware v6.3.0.6. All attempts fail with - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#ssh 5.6.7.8&#xA;Password:&#xA;[Connection to 5.6.7.8 aborted: error status 0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Buffer log shows - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SSH2 CLIENT 0:  Channel open failed, reason = 1752134516&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SSH config on router - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SSH Enabled - version 2.0&#xA;Authentication methods:publickey,keyboard-interactive,password&#xA;Encryption Algorithms:aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc,aes192-cbc,aes256-cbc&#xA;MAC Algorithms:hmac-sha1,hmac-sha1-96&#xA;Authentication timeout: 120 secs; Authentication retries: 3&#xA;Minimum expected Diffie Hellman key size : 1024 bits&#xA;IOS Keys in SECSH format(ssh-rsa, base64 encoded):&#xA;ssh-rsa keystringgoeshere&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SSH config on N1548P stack - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SSH Server enabled.  Port: 22&#xA;Protocol Levels: Versions 1 and 2.&#xA;SSH Connections Currently in Use: ............. 1&#xA;Maximum number of SSH Sessions Allowed: ....... 5&#xA;SSH Session Timeout: .......................... 600&#xA;RSA key was generated.&#xA;DSA key was generated.&#xA;SSH Public Key Authentication is disabled.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this particular scenario, if I modify the router to use SSH v1, it's able to connect. Using v2, it's not. Of course, we don't want to use v1. I haven't been able to figure out what reason &quot;1752134516&quot; means.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I'm able to SSH into both switch stacks directly. It's only the routers that aren't able to connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help.&lt;/p&gt;&#xA;" OwnerUserId="24954" LastActivityDate="2019-11-10T12:51:02.887" Title="SSH failing from Cisco routers to Dell switches" Tags="|cisco|ssh|dell|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30010" PostTypeId="1" CreationDate="2016-04-28T05:44:20.877" Score="2" ViewCount="10630" Body="&lt;p&gt;When I work with multiple ISPs, they refer a connection type as a &quot;10 Gbps wave connection&quot;. What does it really mean? I can understand 10 Gbps fiber but what does &quot;wave&quot; meas?&lt;/p&gt;&#xA;" OwnerUserId="22114" LastEditorUserId="509" LastEditDate="2016-04-28T19:56:06.533" LastActivityDate="2016-07-14T07:02:07.513" Title="What does &quot;10Gbps wave connection&quot; mean?" Tags="|ethernet|fiber|isp|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30011" PostTypeId="1" CreationDate="2016-04-28T05:54:17.860" Score="1" ViewCount="900" Body="&lt;p&gt;I am creating a scenario in Packet tracer where i have two routers, and i have established an IPsec tunnel between them using ESP protocol, as show below,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/38ivq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/38ivq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have changed the packet tracer mode to simulation to test how ESP is working to encapsulate data when I access server from PC0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I accessed the webserver (192.168.2.3) from PC0 (192.168.1.2) and examine the packet at R0 and I got the following output,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Inbound PDU,&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Vbkcs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vbkcs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the above diagram, I don't understand why the source and destination address are not encapsulated ? shouldn't they be changed to the router's address. Because if there is an eavesdropper at R0, he can easily see the destination of the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;now at &lt;strong&gt;Outbound PDU&lt;/strong&gt;,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/97NO2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/97NO2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How come there are two different IP Packets, and why there is still un-encapsulated IP address in outbound packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone please explain ?&lt;/p&gt;&#xA;" OwnerUserId="14885" LastActivityDate="2016-04-28T07:59:36.307" Title="Understanding the PDU at router when using Tunneling" Tags="|ipsec|tunnel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30013" PostTypeId="2" ParentId="30010" CreationDate="2016-04-28T06:14:31.127" Score="-1" Body="&lt;p&gt;Wave is the name of a company which offer carrier transport service and IP transit, on the US west coast.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-04-28T06:14:31.127" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30014" PostTypeId="2" ParentId="30010" CreationDate="2016-04-28T06:42:59.467" Score="10" Body="&lt;p&gt;Most likely they mean a wavelength on a DWDM path. With DWDM, a fiber operator can use one single pair of fibers to carry a number of different colors (wavelengths) of light using multiplexing. Each of these colors can then be used to transmit its own signal, for example 10Gbps ethernet. This way, they are able to use a fiberpair more efficiently.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2016-04-28T07:44:39.220" LastActivityDate="2016-04-28T07:44:39.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30015" PostTypeId="1" CreationDate="2016-04-28T07:44:43.727" Score="2" ViewCount="12893" Body="&lt;p&gt;I have a Cisco ASA 5515, and I have configured as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 9.2(2)4   &#xA;&#xA;hostname ciscoasa  &#xA;enable password ********* encrypted  &#xA;names  &#xA;!  &#xA;interface GigabitEthernet0/0  &#xA; nameif Public-IP  &#xA; security-level 0  &#xA; ip address 202.67.23.37 255.255.255.0   &#xA;!  &#xA;interface GigabitEthernet0/1  &#xA; nameif CC-Camera  &#xA; security-level 50  &#xA; ip address 10.10.20.1 255.255.255.0   &#xA;!  &#xA;interface GigabitEthernet0/2  &#xA; nameif Computer-Lab  &#xA; security-level 90  &#xA; ip address 10.10.21.1 255.255.255.0  &#xA;!         &#xA;interface GigabitEthernet0/3             &#xA; nameif Private-LAN  &#xA; security-level 100  &#xA; ip address 10.10.22.1 255.255.255.0   &#xA;!  &#xA;interface GigabitEthernet0/4             &#xA; nameif Wireless  &#xA; security-level 80  &#xA; ip address 10.10.23.1 255.255.255.0  &#xA;!  &#xA;interface GigabitEthernet0/5  &#xA; shutdown  &#xA; no nameif  &#xA; no security-level  &#xA; no ip address  &#xA;!  &#xA;interface Management0/0  &#xA; management-only  &#xA; nameif management  &#xA; security-level 100  &#xA; ip address 192.168.1.1 255.255.255.0   &#xA;!  &#xA;boot system disk0:/asa922-4-smp-k8.bin  &#xA;ftp mode passive  &#xA;&#xA;object network CC-Camera-subnet  &#xA; subnet 10.10.20.0 255.255.255.0  &#xA;object network Computer-Lab  &#xA; subnet 10.10.21.0 255.255.255.0  &#xA;object network Private-LAN  &#xA; subnet 10.10.22.0 255.255.255.0  &#xA;object network Wireless  &#xA; subnet 10.10.23.0 255.255.255.0  &#xA;&#xA;!  &#xA;object network CC-Camera-subnet  &#xA; nat (CC-Camera,Public-IP) dynamic interface  &#xA;object network Computer-Lab  &#xA; nat (Computer-Lab,Public-IP) dynamic interface   &#xA;object network Private-LAN  &#xA; nat (Private-LAN,Public-IP) dynamic interface  &#xA;object network Wireless  &#xA; nat (Wireless,Public-IP) dynamic interface  &#xA;access-group Public-IP_access_in in interface Public-IP  &#xA;access-group CC-Camera_access_in in interface CC-Camera  &#xA;&#xA;route Public-IP 0.0.0.0 0.0.0.0 x.x.x.x&#xA;&#xA;timeout xlate 3:00:00  &#xA;timeout pat-xlate 0:00:30  &#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02  &#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00  &#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00  &#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute  &#xA;timeout tcp-proxy-reassembly 0:01:00  &#xA;timeout floating-conn 0:00:00  &#xA;&#xA;dynamic-access-policy-record DfltAccessPolicy  &#xA;&#xA;user-identity default-domain LOCAL  &#xA;&#xA;http server enable  &#xA;http 192.168.1.0 255.255.255.0 management  &#xA;&#xA;no snmp-server location  &#xA;no snmp-server contact  &#xA;&#xA;crypto ipsec security-association pmtu-aging infinite  &#xA;crypto ca trustpool policy  &#xA;&#xA;telnet timeout 5  &#xA;no ssh stricthostkeycheck  &#xA;ssh timeout 5  &#xA;ssh key-exchange group dh-group1-sha1  &#xA;console timeout 0  &#xA;&#xA;dhcpd address 192.168.1.2-192.168.1.254 management  &#xA;dhcpd enable management  &#xA;!&#xA;threat-detection basic-threat   &#xA;threat-detection statistics access-list  &#xA;no threat-detection statistics tcp-intercept  &#xA;&#xA;ssl encryption rc4-sha1 aes128-sha1 aes256-sha1 3des-sha1  &#xA;!  &#xA;class-map inspection_default  &#xA; match default-inspection-traffic  &#xA;!  &#xA;policy-map type inspect dns preset_dns_map  &#xA; parameters  &#xA;  message-length maximum client auto  &#xA;  message-length maximum 512  &#xA;&#xA;policy-map global_policy  &#xA; class inspection_default  &#xA;  inspect dns preset_dns_map   &#xA;  inspect ftp   &#xA;  inspect h323 h225   &#xA;  inspect h323 ras   &#xA;  inspect rsh   &#xA;  inspect rtsp   &#xA;  inspect esmtp  &#xA;  inspect sqlnet  &#xA;  inspect skinny   &#xA;  inspect sunrpc  &#xA;  inspect xdmcp  &#xA;  inspect sip   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My issue is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My client wants Facebook, YouTube, torrents, etc. to be blocked. How can I do so using ASDM? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa(config)# sh module&#xA;&#xA;Mod  Card Type                                    Model              Serial No. &#xA;---- -------------------------------------------- ------------------ -----------&#xA;   0 ASA 5515-X with SW, 6 GE Data, 1 GE Mgmt, AC ASA5515            FCH200571ES&#xA; ips Unknown                                      N/A                FCH200571ES&#xA;cxsc Unknown                                      N/A                FCH200571ES&#xA; sfr FirePOWER Services Software Module           ASA5515            FCH200571ES&#xA;&#xA;Mod  MAC Address Range                 Hw Version   Fw Version   Sw Version     &#xA;---- --------------------------------- ------------ ------------ ---------------&#xA;   0 00c8.8bd3.9f63 to 00c8.8bd3.9f6a  1.0          2.1(9)8      9.2(2)4&#xA; ips 00c8.8bd3.9f61 to 00c8.8bd3.9f61  N/A          N/A          &#xA;cxsc 00c8.8bd3.9f61 to 00c8.8bd3.9f61  N/A          N/A          &#xA; sfr 00c8.8bd3.9f61 to 00c8.8bd3.9f61  N/A          N/A          5.3.1-152&#xA;&#xA;Mod  SSM Application Name           Status           SSM Application Version&#xA;---- ------------------------------ ---------------- --------------------------&#xA; ips Unknown                        No Image Present Not Applicable&#xA;cxsc Unknown                        No Image Present Not Applicable&#xA; sfr ASA FirePOWER                  Up               5.3.1-152&#xA;&#xA;Mod  Status             Data Plane Status     Compatibility&#xA;---- ------------------ --------------------- -------------&#xA;   0 Up Sys             Not Applicable        &#xA; ips Unresponsive       Not Applicable        &#xA;&amp;lt;--- More ---&amp;gt;&#xA;&#xA;cxsc Unresponsive       Not Applicable        &#xA; sfr Up                 Up                    &#xA;&#xA;Mod  License Name   License Status  Time Remaining&#xA;---- -------------- --------------- ---------------&#xA; ips IPS Module     Disabled        perpetual     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As there is firepower module status up, I am hoping we can block certain websites, but I couldn't see the options to do so.  &lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="46246" LastEditDate="2018-06-29T04:05:41.080" LastActivityDate="2018-06-29T04:05:41.080" Title="How to configure a Cisco ASA using ASDM to block/allow traffic like websites,IP etc.?" Tags="|cisco|cisco-asa|firewall|cisco-firepower|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30017" PostTypeId="2" ParentId="30011" CreationDate="2016-04-28T07:59:36.307" Score="3" Body="&lt;p&gt;It's quite obvious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For inbound traffic, the packet analyzer shows you already decapsulated traffic. That's why you're seeing real IPs in the header, so essentially it's already decrypted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For outbound traffic, there's new external IP header with ESP, and the IPs seems to be endpoints of IPsec tunnel judging by the topology drawing. Then, there's internal IP header that's original one, carried over and encapsulated over the ESP header.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2016-04-28T07:59:36.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30022" PostTypeId="1" AcceptedAnswerId="30025" CreationDate="2016-04-28T14:15:43.763" Score="2" ViewCount="392" Body="&lt;p&gt;&lt;strong&gt;Set up:&lt;/strong&gt; I have a closed network consisting of a switch, a PC (with 2 NICs), &lt;a href=&quot;https://www.rohde-schwarz.com/vn/product/sgs100a-productstartpage_63493-9030.html&quot; rel=&quot;nofollow&quot;&gt;instrument&lt;/a&gt; and a &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/unified-communications/small-business-voice-gateways-ata/datasheet_C78-691107.html&quot; rel=&quot;nofollow&quot;&gt;router&lt;/a&gt;. The PCs primary card, instrument and the router are all connected to the switch. The secondary network card on the pc is connected to the internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem:&lt;/strong&gt; I need DHCP for the instrument so I am trying to figure out how to set up the router so that it manages IP addresses in this closed network. The instrument has to be able to communicate with the PC to run experiments. I am not sure if the router I have is sufficient for this task. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would like to have some tips on how to go about this problem because I am new with networking. &lt;/p&gt;&#xA;" OwnerUserId="24971" LastActivityDate="2016-04-28T15:10:58.650" Title="DHCP for a local network lab instrument" Tags="|switch|router|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30023" PostTypeId="1" CreationDate="2016-04-28T14:29:11.203" Score="2" ViewCount="389" Body="&lt;p&gt;When self-registering guests generate a request to their Sponsor, how can one create a REST-based link that can approve new Guests with a single click from the email message?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone successfully done this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Default options require a login to the Sponsor portal and navigating to the pending users to approve. &lt;/p&gt;&#xA;" OwnerUserId="1989" LastActivityDate="2016-05-03T06:01:16.017" Title="Cisco ISE 1.3 and 1.4 - Sponsored guest approval email - single click approval possible?" Tags="|cisco|wireless|wlc|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30025" PostTypeId="2" ParentId="30022" CreationDate="2016-04-28T15:10:58.650" Score="3" Body="&lt;p&gt;The &quot;Cisco SPA112 ATA with router&quot; provides a DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/csbpvga/spa100-200/admin_guide_SPA100/spa100_ag/new_network_setup.html&quot; rel=&quot;nofollow&quot;&gt;this guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Network Settings for the LAN and DHCP Server (SPA122 Only)&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Use the Network Setup &gt; Basic Setup &gt; Network Settings page to set the&#xA;  IP address and subnet mask for your local network. Also configure the&#xA;  settings for the built-in DHCP server (SPA122 only).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Enter the settings as described below. After making changes, click&#xA;  Submit to save your settings, or click Cancel to redisplay the page&#xA;  with the saved settings.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Router IP&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Enter the Local IP Address and Subnet Mask for your local network. The&#xA;  default setting is 192.168.15.1 with a subnet mask of 255.255.255.0.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;DHCP Server Setting&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Field    Description&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;DHCP Server&lt;/strong&gt;   &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The ATA can use the built-in DHCP server to dynamically assign IP&#xA;  addresses to connected devices. Click Enabled to enable the DHCP&#xA;  server, or click Disabled to disable this feature. Default setting:&#xA;  Enabled&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;IP Reservation:&lt;/strong&gt;   &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Click the Show DHCP Reservation button to view and manage the DHCP&#xA;  client list. Click the Hide DHCP Reservation button to hide the list.&#xA;  When the list is displayed, you can perform the following tasks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;To reserve a static IP address for a current DHCP client: Check the box for the client in the Select Clients from DHCP Tables list.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Click Add Clients. The selected clients are added to the Clients&#xA;  Already Reserved list. These clients have static IP addresses that do&#xA;  not change.&#xA;      To add a client that is not in the Select Clients from DHCP Tables list: Type a name for the client in the Enter Client Name box. Enter&#xA;  an IP address for this client in the Assign IP Address box. Enter the&#xA;  MAC address in the following format: 00:00:00:00:00:00. Click Add.&#xA;      To remove a client from the Clients Already Reserved list: Check the box for the client. Click Remove.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Default Gateway&lt;/strong&gt;   &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Enter the IP address of the default gateway to be used by the DHCP&#xA;  clients. Default setting: 192.168.15.1 (the IP address of the ETHERNET&#xA;  (LAN) interface)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Starting IP Address&lt;/strong&gt;   &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Enter the first address in the range of addresses to be assigned&#xA;  dynamically by the DHCP server. Default setting: 192.168.15.100&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Maximum DHCP Users&lt;/strong&gt;    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Enter the maximum number of devices that can dynamically receive, or&#xA;  “lease,” DHCP addresses from the DHCP server. Default setting: 50&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;IMPORTANT: Typically, the ATA can support up to five connected&#xA;  computers for business-related tasks such as web browsing and viewing&#xA;  email. The ATA is not designed to support streaming music, video,&#xA;  games, or other network traffic-intensive tasks.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Client Lease Time&lt;/strong&gt;     &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Enter the number of minutes that a dynamically assigned IP address can&#xA;  be in use, or “leased.” After this time elapses, a client device has&#xA;  to request a DHCP lease renewal. Use 0 to represent 1 day, 9999 never&#xA;  expire. Default setting: 0&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Option 66&lt;/strong&gt;     &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Provides provisioning server address information to hosts that request&#xA;  this option. Server information can be defined in one of three ways:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;None: The ATA uses its own TFTP server to source provisioning files, so it returns its own local IP address to the client.&#xA;Remote TFTP Server: The ATA was configured by using this method, and received server information through Option 66 on its WAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;interface. In response to client requests, it provides the remote TFTP&#xA;  server information.&#xA;      Manual TFTP Server: Allows the manual configuration of a configuration server address. While this option is typically used to&#xA;  provide either an IP address or a fully qualified hostname, the ATA&#xA;  will also accept and offer a full URL including protocol, path and&#xA;  filename to meet to requirements of specific clients.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Default setting: None&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;TFTP Server&lt;/strong&gt;   &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If you chose Manual TFTP Server for Option 66, enter the IP address,&#xA;  hostname, or URL of the TFTP server that is used to configure the ATA.&#xA;  Default setting: blank&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Option 67&lt;/strong&gt;     &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Provides a configuration/bootstrap filename to hosts that request this&#xA;  option. This option is used in conjunction with option 66 to allow a&#xA;  client to form an appropriate TFTP request for the file. Default&#xA;  setting: blank&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Option 159&lt;/strong&gt;    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Provides a configuration URL to clients that request this option. An&#xA;  option 159 URL defines the protocol and path information by using an&#xA;  IP address for clients that cannot use DNS. For example:&#xA;  &lt;a href=&quot;https://10.1.1.1:888/configs/bootstrap.cfg&quot; rel=&quot;nofollow&quot;&gt;https://10.1.1.1:888/configs/bootstrap.cfg&lt;/a&gt; Default setting: blank&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Option 160&lt;/strong&gt;    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Provides a configuration URL to clients that request this option. An&#xA;  option 160 URL defines the protocol and path information by using a&#xA;  fully qualified domain name for clients that can use DNS. For example:&#xA;  &lt;a href=&quot;https://myconfigs.cisco.com:888/configs/bootstrap.cfg&quot; rel=&quot;nofollow&quot;&gt;https://myconfigs.cisco.com:888/configs/bootstrap.cfg&lt;/a&gt; Default setting:&#xA;  blank&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;DNS Proxy&lt;/strong&gt;     &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When enabled, the DNS proxy relays DNS requests to the current public&#xA;  network DNS server for the proxy, and replies as a DNS resolver to the&#xA;  client device on the network. Click Enabled to enable this feature, or&#xA;  click Disabled to disable it. If DNS proxy is disabled, then DHCP&#xA;  clients will be offered DNS server information by using the Static DNS&#xA;  servers, if defined, or by using the using the servers specified for&#xA;  the INTERNET (WAN) interface. Default setting: Enabled&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-04-28T15:10:58.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30026" PostTypeId="1" CreationDate="2016-04-28T18:17:42.747" Score="1" ViewCount="1143" Body="&lt;p&gt;I know this is not the community to discuss my homework problem but I cam confused because I cannot find a formula that can find data rate for 802.11g standard given modulation, coding rate and transport layer protocol. And how does transport layer affect the data rate of 802.11g?&lt;/p&gt;&#xA;" OwnerUserId="23142" LastActivityDate="2016-05-04T19:13:30.087" Title="How to calculate the data rate in 802.11g?" Tags="|tcp|ieee-802.11|udp|transport-protocol|mac|" AnswerCount="1" CommentCount="2" ClosedDate="2016-05-05T17:08:30.660" ContentLicense="CC BY-SA 3.0" />
  <row Id="30027" PostTypeId="1" CreationDate="2016-04-28T18:50:51.813" Score="2" ViewCount="182" Body="&lt;p&gt;Is the structure of IPv6 mtree similar with the IPv4 mtree structure?&#xA;Have you guys seen any documentation about this subject?&lt;/p&gt;&#xA;" OwnerUserId="1647" LastEditorUserId="2142" LastEditDate="2016-04-29T13:01:02.217" LastActivityDate="2016-08-27T17:30:51.460" Title="Is the structure of the CEF IPv6 trie similar with the IPv4 trie structure?" Tags="|ipv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30028" PostTypeId="1" AcceptedAnswerId="30030" CreationDate="2016-04-28T18:58:39.643" Score="1" ViewCount="81" Body="&lt;p&gt;I can't seem to find a command for this, only configuration commands are listed in the documentation and &lt;strong&gt;show ipv6 nd destination&lt;/strong&gt; does not work on my system&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is on Cisco vIOS 15.2  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:  rfc2461-Regardless of the specific implementation, it is critical that the Neighbor Cache entry for a router is shared by all Destination Cache entries using that router in order to prevent redundant Neighbor Unreachability Detection probes. &quot; &lt;/p&gt;&#xA;" OwnerUserId="1647" LastEditorUserId="1647" LastEditDate="2016-04-28T20:49:55.733" LastActivityDate="2016-04-28T20:49:55.733" Title="What is the command line to inspect the IPv6 discovery cache?" Tags="|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30030" PostTypeId="2" ParentId="30028" CreationDate="2016-04-28T19:21:23.003" Score="3" Body="&lt;p&gt;The command you're looking for is &lt;code&gt;show ipv6 neighbors&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;box#show ipv6 neighbors&#xA;IPv6 Address                              Age Link-layer Addr State Interface&#xA;FE80::222:8303:4977:5A95                    0 0022.8377.5a95  REACH Gi0/0/1.841&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-04-28T19:21:23.003" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30031" PostTypeId="1" AcceptedAnswerId="30059" CreationDate="2016-04-28T19:59:22.553" Score="1" ViewCount="88" Body="&lt;p&gt;Default VLAN: &lt;code&gt;10..0.0/24&lt;/code&gt; New VLAN : &lt;code&gt;10..8.0/24&lt;/code&gt; DHCP server : &lt;code&gt;10.*.0.17&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see the DHCP offer packets making it back to my VLAN IP address namely 10.*.8.31 (from DHCP server message log)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Apr 28 15:33:13 dhcpd: DHCPOFFER on 10..8.129 to via 10..8.31&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, the DHCP offer never makes it back to my machine connected to the new VLAN (verified with Wireshark as well).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch is HP Layer-3 ProCurve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running-Config (some details redacted):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Running configuration:&#xA;*; J9588A Configuration Editor; Created on release #KA.15.17.0008&#xA;*module 1 type j9588y&#xA;module 2 type j9588x&#xA;-fault-finder broadcast-storm sensitivity high&#xA;fault-finder bad-driver sensitivity high&#xA;fault-finder bad-transceiver sensitivity high&#xA;fault-finder bad-cable sensitivity high&#xA;fault-finder too-long-cable sensitivity high&#xA;fault-finder over-bandwidth sensitivity high&#xA;fault-finder loss-of-link sensitivity high&#xA;fault-finder duplex-mismatch-hdx sensitivity high&#xA;fault-finder duplex-mismatch-fdx sensitivity high&#xA;fault-finder link-flap sensitivity high&#xA;jumbo ip-mtu 9000&#xA;power-over-ethernet redundancy n+1&#xA;qos tcp-port ipv4 22 priority 7&#xA;qos tcp-port ipv4 80 priority 1&#xA;qos tcp-port ipv4 443 priority 0&#xA;qos type-of-service diff-services&#xA;timesync sntp&#xA;sntp broadcast&#xA;sntp server priority 1 10.x.x.x&#xA;sntp server priority 2 10.x.x.x&#xA;no telnet-server&#xA;time daylight-time-rule western-europe&#xA;no web-management&#xA;web-management ssl&#xA;ip default-gateway 10.x.0.x&#xA;ip dns server-address priority 1 10.x.0.x&#xA;ip dns server-address priority 2 10.x.0.x&#xA;no ip ssh cipher aes128-cbc&#xA;no ip ssh cipher 3des-cbc&#xA;no ip ssh cipher aes192-cbc&#xA;no ip ssh cipher aes256-cbc&#xA;no ip ssh mac hmac-md5&#xA;no ip ssh mac hmac-sha1-96&#xA;no ip ssh mac hmac-md5-96&#xA;ip route 10.x.8.0 255.255.255.0 10.x.8.1&#xA;ip routing&#xA;snmp-server community &quot;public&quot; unrestricted&#xA;tls application web-ssl lowest-version tls1.2&#xA;tls application openflow lowest-version tls1.2&#xA;tls application syslog lowest-version tls1.2&#xA;tls application tr69 lowest-version tls1.2&#xA;aaa authentication ssh login public-key&#xA;oobm&#xA;ip address 10..x.x 255.255.255.0&#xA;exit&#xA;router rip&#xA;redistribute connected&#xA;exit&#xA;vlan 1&#xA;name &quot;DEFAULT_VLAN&quot;&#xA;no untagged 20-21&#xA;untagged 1-19,22-52&#xA;ip address 10.x.0.31 255.255.255.0&#xA;ip helper-address 10.x.0.17&#xA;ip igmp&#xA;exit&#xA;vlan 8&#xA;name &quot;WiredUsers&quot;&#xA;untagged 20&#xA;ip address 10.x.8.31 255.255.255.0&#xA;ip helper-address 10.x.0.17&#xA;ip igmp&#xA;exit&#xA;spanning-tree&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any suggestions as to why the DHCP offer cant hop from &lt;code&gt;10.x.8.31&lt;/code&gt; to my machine on same subnet?&lt;/p&gt;&#xA;" OwnerUserId="24982" LastEditorUserId="8499" LastEditDate="2016-04-28T20:22:25.293" LastActivityDate="2016-10-27T08:46:35.220" Title="inter vlan routing-dhcp offer reaches until newly created vlan ip but not my machine connected to the vlan" Tags="|routing|vlan|hp-procurve|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30032" PostTypeId="1" AcceptedAnswerId="30035" CreationDate="2016-04-28T20:19:52.797" Score="3" ViewCount="8860" Body="&lt;p&gt;I've recently been studying the fundamentals on IPv6, but there are some things that I don't quite understand about how the addressing is structured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that link local addresses start with FE80, unique local addresses start with FC00 and global unicast addresses start with 2001 for example. Also from what I've seen, most addresses use the /64, sometimes accompanied by EUI-64.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I don't understand is the slash notation ranges with some of the address types. For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Global Unicast&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2000::/3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Link Local&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FE80::/10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Unique Local&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FC00::/7&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the above three address types for example, could someone please explain to me what the slash notations indicate? I can't seem to find a proper explanation for this anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the &lt;strong&gt;Global Unicast&lt;/strong&gt; address for example, I've mostly seen 2001:0000 etc etc addresses. Does the notation mean the most I can go up to is 2003 as it's a /3?The same with the &lt;strong&gt;Link Local&lt;/strong&gt; and &lt;strong&gt;Unique Local&lt;/strong&gt;. The slash notations just don't make sense to me, and the books just don't seem to bring any logic to the table. I'm more than likely way off with my assumptions here, so some clarity would be good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd really like to understand this, rather than just assigning 2001:0000 etc etc &lt;strong&gt;Global Unicast&lt;/strong&gt; addresses, without truly understanding why I'm doing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="23950" LastEditorUserId="8499" LastEditDate="2018-03-12T00:30:12.990" LastActivityDate="2018-03-12T00:30:12.990" Title="IPv6 addressing (slash notation)" Tags="|ip|subnet|ipv6|ip-address|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30033" PostTypeId="2" ParentId="30032" CreationDate="2016-04-28T20:31:38.100" Score="6" Body="&lt;p&gt;The number after the slash means the number of mask bits: the number of bits in the address that don't change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, &lt;code&gt;2000::/3&lt;/code&gt; means every address from &lt;code&gt;2000::&lt;/code&gt; to &lt;code&gt;3fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to dig deeper into addressing. THE ULA range, &lt;code&gt;fc00::/7&lt;/code&gt;, has some rules. The first half of the addresses in that range, &lt;code&gt;fc00::/8&lt;/code&gt;, are reserved to be assigned by a global authority, and the second half of the addresses, &lt;code&gt;fd00::/8&lt;/code&gt;, are available to use, but you are required to use 40 random bits for the Global ID portion of the addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a few exceptions IPv6 subnets should be &lt;code&gt;/64&lt;/code&gt;. Using other subnet sizes breaks things in IPv6. Exceptions to this are things like host addresses (&lt;code&gt;/128&lt;/code&gt;) and point-to-point links (&lt;code&gt;/127&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-29T00:24:51.873" LastActivityDate="2016-04-29T00:24:51.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30034" PostTypeId="2" ParentId="30027" CreationDate="2016-04-28T20:41:14.653" Score="1" Body="&lt;p&gt;What makes you think CEF uses an mtree? It is Optimum Switching that uses an mtree, not CEF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/express-forwarding-cef/13706-20.html&quot; rel=&quot;nofollow&quot;&gt;How to Choose the Best Router Switching Path for Your Network&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Optimum Switching&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Optimum switching stores the forwarding information and the MAC header&#xA;  rewrite information in a 256 way multiway tree (256 way mtree). Using&#xA;  an mtree reduces the number of steps which must be taken when looking&#xA;  up a prefix, as illustrated in the next figure.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Cisco Express Forwarding&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Cisco Express Forwarding, also uses a 256 way data structure to store&#xA;  forwarding and MAC header rewrite information, but it does not use a&#xA;  tree. Cisco Express Forwarding uses a trie, which means the actual&#xA;  information being searched for is not in the data structure; instead,&#xA;  the data is stored in a separate data structure, and the trie simply&#xA;  points to it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I suppose it depends on what you mean by similar trie structure. Both IPv4 and IPv6 use a 256-way trie, and the data are stored in separate tables. In fact, the separate data structure for the MAC header rewrite information are nearly identical, except for minor things like the ethertype, since MAC headers don't care much about the upper-layer protocols.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-29T15:17:00.060" LastActivityDate="2016-04-29T15:17:00.060" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30035" PostTypeId="2" ParentId="30032" CreationDate="2016-04-28T21:21:54.300" Score="3" Body="&lt;p&gt;The slash notation is another way of writing the subnet mask. It works the same for IPv4 and IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number /3 indicates the number of consecutive 1's in the mask.  Since the mask is the same size as the address, that means that for IPv6, the subnet mask is three 1's followed by 125 0's (3+125=128 bits).   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For an IPv4 address it means three 1's followed by 29 0's (3+29=32 bits).  It can also be written as 192.0.0.0.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-04-28T23:07:15.230" LastActivityDate="2016-04-28T23:07:15.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30036" PostTypeId="2" ParentId="30010" CreationDate="2016-04-28T21:58:47.650" Score="4" Body="&lt;p&gt;A wavelength service is muxed onto a DWDM system, such that you get a full 10Gbps pipe non-blocking with a fixed latency and jitter (except in case of protection switching if the provider has a failure!). You're geting either a full color of light on a fiber or at least a 10gbps slot of a color of light which is muxed in a TDM fashion (that is, withOUT statistical multiplexing). In modern networks this is probably done with OTN, in the past it would've been SONET (OC-192 for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this is in contrast to an MPLS or packet-based service where the provider would provision your 10Gbps on routers/switches and you'd share some statistically-muxed packet queues with other customers. This is usually cheaper because the provider can over-provision more heavily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether you care depends on your application for the cuircuit and the quality of the provider.&lt;/p&gt;&#xA;" OwnerUserId="24983" LastActivityDate="2016-04-28T21:58:47.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30037" PostTypeId="1" AcceptedAnswerId="30038" CreationDate="2016-04-29T00:25:40.517" Score="4" ViewCount="1502" Body="&lt;p&gt;Any AAA configuration on a Cisco router begins with the command &lt;code&gt;aaa new-model&lt;/code&gt;. Per the context help:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#aaa ?&#xA;  new-model       Enable NEW access control commands and functions.(Disables OLD commands.)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What were the old commands? What major difference where there between the old commands and what you get with the new commands?&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-04-29T00:45:58.313" Title="What was the AAA &quot;old-model&quot;?" Tags="|cisco|aaa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30038" PostTypeId="2" ParentId="30037" CreationDate="2016-04-29T00:45:58.313" Score="3" Body="&lt;p&gt;Basically, the old model was just Authentication with little Authorization and no real Accounting. Maybe you just call it A instead of AAA. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching the Internet has turned up a few references:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://copyrunfail.blogspot.com/2010/02/setting-up-authentication-using-new.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Tips and Tricks&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Historically older methods of AAA have revolved around line level&#xA;  passwords and secrets. This leveraged user set passwords on the&#xA;  various access points around the router to stop someone from directly&#xA;  logging onto the device and making changes.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;aaa new-model&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This will turn the engine on and immediately overwrite/remove all line&#xA;  level passwords and old methods of authentication. With this in mind,&#xA;  if you lose connection to this router at any stage you will not be&#xA;  able to get back on as there will be no rules to govern the Auth part&#xA;  of the AAA and the default is to allow no access unless configured to&#xA;  allow &quot;no auth&quot;. (a simple reboot will however return you to the old&#xA;  setup as the command requires the usual saves)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.freeccnaworkbook.com/workbooks/ccna/configuring-aaa-authentication-lists&quot; rel=&quot;nofollow&quot;&gt;Free CCNA Workbook&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When configuring AAA New-model, authorization is not configured by&#xA;  default on newer IOS images therefore when logging into a Cisco Router&#xA;  and/or Switch with a user account that has level 15 privileges you&#xA;  will not automatically be placed into privileged mode as you were in&#xA;  the older non-aaa login local authentication method. To fix this&#xA;  you’ll need to add a AAA statement to specify console authorization.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-04-29T00:45:58.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30039" PostTypeId="1" CreationDate="2016-04-29T04:37:57.150" Score="2" ViewCount="241" Body="&lt;p&gt;I am trying to tune TCP reno parameters in order to reproduce fig 21 &lt;a href=&quot;http://simula.stanford.edu/~alizade/Site/DCTCP_files/dctcp-final.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. The author uses TCP New Reno as congestion control algorithm. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am tuning the parameters as : &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;rto_min = 10ms &lt;/li&gt;&#xA;&lt;li&gt;Set sender cwnd to 10 using ip route&lt;/li&gt;&#xA;&lt;li&gt;Set receiver rwnd to 10 using ip route&lt;/li&gt;&#xA;&lt;li&gt;Disable slow_start_after_idle&lt;/li&gt;&#xA;&lt;li&gt;Set max rmem and wmem to 16777216&lt;/li&gt;&#xA;&lt;li&gt;ECN is enabled by default&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All other options are as default for kernel v 3.19 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Topolgy is as follows : &#xA;I have two machines connected connected by 1Gbps link to switch (emulate by a machine) and a receiver connected to switch by 1Gbps link. RTT is around 590microseconds.&lt;br&gt;&#xA;Switch port connected to receiver operates in drop tail mode with max buffer size as 700KB, achieved using tc-pfifo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I generate traffic using iperf3. I create two long lived flows using iperf3 each from one sender to the common receiver as described in section 4.2.2 . When I start the short flow I get the completion time of the order of 150ms. I understand that the queue is full and hence the packets are being delayed. I also understand that the senders are not using slow start and directly entering congestion avoidance. &#xA;Is my understanding wrong ? &#xA;According to the authors the short transfer in case of TCP New Reno must be of the order of 15-35 milliseconds. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please help me understand where I am going wrong and suggest possible solutions that can help me overcome this problem ? &lt;/p&gt;&#xA;" OwnerUserId="23374" LastActivityDate="2016-06-28T19:56:46.227" Title="Tuning TCP Reno parameters to reduce delay experienced by short flows of size 20KB ?" Tags="|tcp|linux|congestion|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30041" PostTypeId="1" CreationDate="2016-04-29T08:21:38.137" Score="0" ViewCount="1986" Body="&lt;p&gt;I have two computers, each one with two network interfaces, both are ubuntu.&#xA;I want to implement bellow architecture:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nDvoE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nDvoE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to generate traffic from interface eth0:192.168.1.1 to interface 192.168.2.1 through firewall machine.&#xA;How to implement this architecture?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;by considering usage of iptables linux packet filtering in firewall machine to filter traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;another consideration: use of this architecture as a replicator of pcap files (client traffic on one interface and server traffic on another interface through firewall machine )&lt;/p&gt;&#xA;" OwnerUserId="23383" LastActivityDate="2016-11-01T18:21:10.137" Title="how to send traffic from one network interface to another network interface through second computer?" Tags="|pcap|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30042" PostTypeId="2" ParentId="30041" CreationDate="2016-04-29T10:58:07.923" Score="1" Body="&lt;p&gt;In this configuration the client machine will have directly connected route in its routing table, for both networks. Those route are of kernel type and will always be preferred over other routes you could set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So whatever your configuration is, the traffic initiated on this machine destined to 192.168.2.1 will always be considered as local and will never exit trough eth0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I doubt you could change Ubuntu routing decision on a kernel type route, but who knows?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may use a software that will generate the traffic sending it trough eth0 irrespectively of the machine routing table&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you do so, the answer will not pass trough the firewall, since the answer will be directd to 192.168.1.1 which, once again is a local address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can setup on the client machine a virtual machine, and configure the 192.168.2.1 IP address in this VM, then set on the client machine a route to send traffic destined to 192.168.2.1 via 192.168.1.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the pcap replicator I don't get it...&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-04-29T12:08:26.387" LastActivityDate="2016-04-29T12:08:26.387" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30044" PostTypeId="1" CreationDate="2016-04-29T12:12:38.990" Score="1" ViewCount="1444" Body="&lt;p&gt;I am new in juniper networks.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I have a new switch with default configuration and I have a backup of the current switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the steps to restore the backup on the new switch and how to configure a management IP?&lt;/p&gt;&#xA;" OwnerUserId="24999" LastEditorUserId="16930" LastEditDate="2016-04-29T13:33:55.127" LastActivityDate="2017-07-24T06:07:06.693" Title="How to restore a backup on new switch. what are the steps?" Tags="|ipv4|juniper|" AnswerCount="3" CommentCount="3" ClosedDate="2017-07-24T13:10:42.640" ContentLicense="CC BY-SA 3.0" />
  <row Id="30046" PostTypeId="2" ParentId="30044" CreationDate="2016-04-29T13:58:44.430" Score="0" Body="&lt;p&gt;The way I do it on routers: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the old one go into edit mode then run &quot;show | display set&quot; which will show you the set commands to put on the other device. Copy that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the new one I make sure is all clean config, go into edit mode and type &quot;load set terminal&quot; - which opens a sort of text file editor within the appliance - then I paste all the set commands from the old one and finish up with the escape character (^D).&lt;/p&gt;&#xA;" OwnerUserId="224" LastActivityDate="2016-04-29T13:58:44.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30049" PostTypeId="1" AcceptedAnswerId="30050" CreationDate="2016-04-29T15:06:20.500" Score="1" ViewCount="77" Body="&lt;p&gt;Should the native vlan be explicitly declared as an allowed vlan for a trunk port or not to send/receive frames of that native vlan.&lt;/p&gt;&#xA;" OwnerUserId="21879" LastActivityDate="2016-04-29T15:27:14.987" Title="Should the native vlan be explicitly declared as an allowed vlan" Tags="|vlan|lan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30050" PostTypeId="2" ParentId="30049" CreationDate="2016-04-29T15:27:14.987" Score="2" Body="&lt;p&gt;If you're not using the native VLAN, there is no need to allow it on the trunk.  If you do want to send/receive traffic on that VLAN then yes, allow it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-04-29T15:27:14.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30051" PostTypeId="1" AcceptedAnswerId="30060" CreationDate="2016-04-29T16:08:57.257" Score="0" ViewCount="3010" Body="&lt;p&gt;On many technical forums, in order to help solving or analyzing problems with the networks connection, I am asked to run command ipconfig/ifconfig, and show the results in public.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this safe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do some of the details shown in the results help someone who wants to hack my computer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I have to hide some of the lines shown in the results?&lt;/p&gt;&#xA;" OwnerUserId="25006" LastActivityDate="2016-04-30T08:19:57.140" Title="Is it safe to publish the ipconfig/ifconfig results?" Tags="|ip|" AnswerCount="2" CommentCount="1" ClosedDate="2016-04-30T08:51:17.963" ContentLicense="CC BY-SA 3.0" />
  <row Id="30052" PostTypeId="2" ParentId="30051" CreationDate="2016-04-29T16:10:07.887" Score="-1" Body="&lt;p&gt;Your IP config will only show private addresses and mac address, your attacker would need to know your public address to gain access to your services. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So no, there isn't harm in posting these results.&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2016-04-29T16:10:07.887" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30057" PostTypeId="2" ParentId="30039" CreationDate="2016-04-29T18:50:37.720" Score="2" Body="&lt;p&gt;The above issue was resolved and I was able to reproduce the same figure. &#xA;The authors specified that for TCP they were using 100 packets as the limit of buffer. And I was using 467 packets as buffer depth. This was the only difference which when corrected gave the results as the author has obtained. &#xA;No other setting was needed. All default settings were used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the whole process I learnt many new things about TCP which were quite interesting.&lt;/p&gt;&#xA;" OwnerUserId="23374" LastActivityDate="2016-04-29T18:50:37.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30059" PostTypeId="2" ParentId="30031" CreationDate="2016-04-29T21:10:03.350" Score="1" Body="&lt;p&gt;The solution to this was that there was no proper route from the dhcp server to the vlan. It worked after I added a&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sudo route add -net 10.36.8.0/24 gw 10.36.0.31 dev bond0 (where 10.36.0.31 is the address of the vlan) on the dhcp server. Thanks for taking the time to respond!&lt;/p&gt;&#xA;" OwnerUserId="24982" LastActivityDate="2016-04-29T21:10:03.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30060" PostTypeId="2" ParentId="30051" CreationDate="2016-04-29T22:28:17.730" Score="1" Body="&lt;p&gt;You config may include public, private, or otherwise non-public addresses. If there are public addresses or names that resolve to your public addresses, you may wish not to publish them or to mask them, especially if you are posting about configuration problems that could be abused. However, that can also hinder people from helping you, of course.&lt;/p&gt;&#xA;&lt;p&gt;Usually a computer in a home behind a box will be NATed, and thus only have private IPs, but you might have a hosted server with a public IP.&lt;/p&gt;&#xA;&lt;p&gt;The following are common addresses that everyone and anyone can have in their configurations, they are safe to publish:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10.0.0.0/8 (10.0.0.0 - 10.255.255.255): RFC1918 &amp;quot;A&amp;quot; private&lt;/li&gt;&#xA;&lt;li&gt;127.0.0.0/8 (127.0.0.0 - 127.255.255.255): localhost&lt;/li&gt;&#xA;&lt;li&gt;172.16.0.0/12 (172.16.0.0 - 172.31.255.255): RFC1918 &amp;quot;B&amp;quot; private&lt;/li&gt;&#xA;&lt;li&gt;169.254.0.0/16 (169.254.0.0/16 - 169.254.255.255): link local&lt;/li&gt;&#xA;&lt;li&gt;192.168.0.0/16 (192.168.0.0 - 192.168.255.255): RFC1918 &amp;quot;C&amp;quot; private&lt;/li&gt;&#xA;&lt;li&gt;::1/128 inet6 localhost&lt;/li&gt;&#xA;&lt;li&gt;inet6 link-scope addresses&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;There are other special addresses, but most people will not have them in their configurations without knowing very well what they are. All special addresses are listed in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6890&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6890&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;For any address, you can consult the &lt;a href=&quot;http://www.iana.org/assignments/ipv4-address-space/ipv4-address-space.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IANA&lt;/a&gt; list which will give you the Regional Internet Registry if applicable, and the &lt;em&gt;&lt;strong&gt;whois&lt;/strong&gt;&lt;/em&gt; server which will give you more information on the range in question. For a public IP address you will certainly be able to drill down to your ISP.&lt;/p&gt;&#xA;&lt;p&gt;To know your public IP address, search google for &amp;quot;what is my IP address&amp;quot;.&lt;/p&gt;&#xA;" OwnerUserId="22874" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-04-30T08:19:57.140" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30062" PostTypeId="1" AcceptedAnswerId="30064" CreationDate="2016-04-30T01:55:19.043" Score="1" ViewCount="836" Body="&lt;p&gt;I am fairly new to networking but have done manual Linux command line wireless connections and home router configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internet is full of how-to guides on transferring files between two computers, &lt;strong&gt;but what really is the theory behind what happens when two computers are connected via ethernet cable?&lt;/strong&gt; I have a Windows 10 box and an Ubuntu 14 box, and both are smart enough to detect a connection, and for some reason assign ipv6 addresses to each other. The how-to manuals explain that a cross over cable is needed to transfer files, but I don't understand why that is necessary when I can connect the computers to a designated router, without even plugging into the internet, and access websites served up from either box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there specific programs responsible for automatically detecting the connection? What happens beyond that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I apologize if I am not being specific enough. I'm hoping for a good whole-picture answer, as so much is taught piece-meal. While I am it, is learning piece-meal just how networking must be learned before the big picture comes into perspective?&lt;/p&gt;&#xA;" OwnerUserId="25012" LastEditorUserId="8499" LastEditDate="2016-04-30T02:49:25.243" LastActivityDate="2016-04-30T02:49:25.243" Title="theory: connecting two computers with ethernet cable" Tags="|ethernet|layer2|layer3|layer1|" AnswerCount="1" CommentCount="1" ClosedDate="2016-04-30T20:15:35.240" ContentLicense="CC BY-SA 3.0" />
  <row Id="30064" PostTypeId="2" ParentId="30062" CreationDate="2016-04-30T02:22:39.667" Score="2" Body="&lt;p&gt;This question is really too broad to give you a complete answer. You are really asking about a subject for which libraries exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens when you connect two hosts with a UTP cable in their ethernet ports depends on the ethernet standards. With modern equipment and 1000BASE-T capable ports, the cable does not need to be a crossover cable, and the two ethernet ports will negotiate things like MDI/MDI-X, speed, and duplex. This doesn't involve any program on your host. You need to read up on the ethernet standards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The earlier ethernet standards, without Auto-MDI/X, required crossover cables when connecting two like devices (e.g. host or router to host or router, hub or switch to hub or switch), but dissimilar devices (host or router to switch or hub) could use a straight-through cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modern OSes have IPv6 enabled by default, and they prefer IPv6. Also, IPv6 can self-configure addressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your request for the whole picture, you need to learn about the network layers. There are multiple models, but the OSI model is something everyone learns. Just understand that these are just models, and don't necessarily reflect the real world. You will learn about abstraction between the layers, and how each layer is independent of the other layers. Ethernet involves both layer-1, the physical layer (multiple different media), and layer-2. IP, both IPv4 and IPv6, are at layer-3, and TCP and UDP are at layer-4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just because the world seems to revolve around ethernet or Wi-Fi (a separate protocol from ethernet, both at layer-1 and layer-2), IP, and TCP/UDP, don't fool yourself into thinking these are the only protocols at layers 1 to 4. For instance, UTP cabling (layer-1) can be used for various layer-1/2 protocols, even POTS or token-ring, and it can transport various layer-2 protocols, like IPv4, IPX, IPv6, etc. IP is not restricted to UTP cabling, either.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-04-30T02:46:36.460" LastActivityDate="2016-04-30T02:46:36.460" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30065" PostTypeId="2" ParentId="29927" CreationDate="2016-04-30T04:31:28.847" Score="13" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;I have been told that Ethernet magnetic transformers are used for base-t Ethernet when transmission is sent over a lengthy cable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;They are always used, not just when &amp;quot;sent over a lengthy cable&amp;quot;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What is the purpose of the transformer?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The primary purpose is isolation. Typically they are also used as part of the signal conditioning, turning a pair of single-ended drives into a differential signal on transmit and establishing the correct common mode voltage for the receiver on receive. For this reason the device-side of the transformers is usually center-tapped.&lt;/p&gt;&#xA;&lt;p&gt;Isolation is a very good idea in communications  systems that are linking lots of hardware over a wide area. You don't want fault current/voltages in from faults in the mains wiring or devices to spread through your communications wiring.&lt;/p&gt;&#xA;&lt;p&gt;There are basically two options for isolation, opto and transformer. Transformer isolation has a couple of major advantages. Firstly, the signal power passes through the transformer, which means you don't need to get a power supply to the &amp;quot;isolated&amp;quot; side of the barrier. Secondly, transformers are very good at generating and receiving differential signals while providing high common mode rejection; this makes them a good combination with twisted-pair wiring. Thirdly, it is easier to design transformers for high frequency (aka high speed) than optocouplers.&lt;/p&gt;&#xA;&lt;p&gt;Transformer coupling does have some downsides; transformers don't work on DC, and small transformers that work well at high frequencies don't work well at low frequencies; but this is easily dealt with through line coding schemes that avoid low frequencies.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;P.S. I am unsure about how data is transmitted over Ethernet. Is it that all differential pairs (DA: pins 1 &amp;amp; 2, DB: pins 3 &amp;amp; 6, DC: pins 4 &amp;amp; 5, DD: pins 8 &amp;amp; 7) are busses where data can be transmitted both ways (unlike the UART where RX has to be connected to TX)? and in case I am just using 2 pairs, would I be connecting only DA and DB?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It depends on the version of Ethernet. 10BASE-T and 100BASE-TX used one pair in each direction. On older hardware, you had to manually ensure that transmitter was connected to receiver (using crossover cables if needed), but more recent hardware usually has AUTO-MDIX which figures it out automatically.&lt;/p&gt;&#xA;&lt;p&gt;1000BASE-T uses all four pairs in both directions at the same time, using echo cancellation techniques to separate received data from transmitted data.&lt;/p&gt;&#xA;&lt;p&gt;I think 10GBASE-T also uses echo cancellation techniques, but i'm not positive on that.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Is there also an issue with connecting a 4 wire device to a network that uses 8 wires?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Most devices support lower-speed modes, but not all. In particular twisted-pair to fiber media converters usually only support a single speed on the twisted-pair side. Devices that support 10GBASE-T usually also support 1000BASE-T but only sometimes support 100BASE-TX and AFAICT never support 10BASE-T.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="31800" LastEditDate="2022-11-11T10:04:26.060" LastActivityDate="2022-11-11T10:04:26.060" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="30066" PostTypeId="1" CreationDate="2016-04-30T07:09:27.833" Score="1" ViewCount="2624" Body="&lt;p&gt;I configured a Cisco ASA, and NAT was configured fine. But now, I have to open some ports there, and all it shows is this error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address x.x.x.x overlaps with public ip and the nat is not downloaded&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What could be the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco ASA version 9.2(2)4 and ASDM version 7.2(2)1&lt;a href=&quot;https://i.stack.imgur.com/251u6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/251u6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; nameif Public-IP&#xA; security-level 0&#xA; ip address x.x.x.x 255.255.255.0 &#xA;&#xA;interface GigabitEthernet0/5&#xA; nameif Global-wireless&#xA; security-level 70&#xA; ip address 192.168.0.1 255.255.255.0 &#xA;!&#xA;interface Management0/0&#xA; management-only&#xA; nameif management&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0 &#xA;&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;&#xA;object network global-wireless-subnet&#xA; subnet 192.168.0.0 255.255.255.0&#xA;&#xA;object network obj-192.168.0.205&#xA;host 192.168.0.205&#xA;nat (global-wireless,public-IP) static x.x.x.x service tcp 4370 4370&#xA;&#xA;ERROR: Address x.x.x.x overlaps with Public-IP interface address.&#xA;ERROR: NAT Policy is not downloaded&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; I read today that instead of IP, I should use address, and I am yet to test it. I will do the testing tomorrow.&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="8499" LastEditDate="2016-04-30T17:14:02.457" LastActivityDate="2016-05-01T13:49:55.247" Title="cisco ASA port forwarding problem" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30069" PostTypeId="1" AcceptedAnswerId="30070" CreationDate="2016-04-30T08:27:43.767" Score="1" ViewCount="108" Body="&lt;p&gt;One my senior in my office asked me this question.&#xA;I have a source at R1 and my destination is after 300 routers R300. Will my packet reach my destination ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host A --&gt;R1-R2-R3-.....R300--&gt;Host B&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is this a question valid ?&lt;/li&gt;&#xA;&lt;li&gt;If Yes, then how ?&lt;/li&gt;&#xA;&lt;li&gt;Can I increase my TTL more than 255 ? (I believe this is not possible)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Looking for an answer..&lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2016-04-30T15:10:17.213" Title="How to reach the destination which is after 300 routers" Tags="|routing|router|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30070" PostTypeId="2" ParentId="30069" CreationDate="2016-04-30T08:59:49.750" Score="2" Body="&lt;p&gt;A - Look at &lt;a href=&quot;http://www.ietf.org/rfc/rfc0791.txt&quot; rel=&quot;nofollow&quot;&gt;RFC0791&lt;/a&gt;&lt;br&gt;&#xA;B - Search for the IP headers definition and length&lt;br&gt;&#xA;C - draw your own conclusions  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that in real world there's no path as long as 300 hops. If I remember correctly the longest path that exists on the Internet is between 30 &amp;amp; 40 hops.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="8499" LastEditDate="2016-04-30T15:10:17.213" LastActivityDate="2016-04-30T15:10:17.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30071" PostTypeId="2" ParentId="29934" CreationDate="2016-04-30T11:38:53.307" Score="0" Body="&lt;p&gt;Note: On any interface only 75% of the bandwidth is available for QoS.&lt;/p&gt;&#xA;" OwnerUserId="3846" LastActivityDate="2016-04-30T11:38:53.307" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30072" PostTypeId="2" ParentId="30041" CreationDate="2016-04-30T16:16:00.677" Score="0" Body="&lt;p&gt;You can use &lt;a href=&quot;http://tcpreplay.appneta.com/&quot; rel=&quot;nofollow&quot;&gt;tcpreplay&lt;/a&gt; to send out a previously captured trace on a specific interface.&lt;/p&gt;&#xA;" OwnerUserId="7533" LastActivityDate="2016-04-30T16:16:00.677" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30073" PostTypeId="1" AcceptedAnswerId="30075" CreationDate="2016-04-30T22:46:31.220" Score="2" ViewCount="569" Body="&lt;p&gt;I have a strong confusion on this whether LPM is done in Data or Control Plane. &#xA;My thoughts on this is as follows if its in data plane, we will have to do it for every packet hence we will have a reduced speed for forwarding. &#xA;What I believe is that we can do everything in control plane and program the hardware after adding an identifier for the flow. Then on we need to just look at the flow identifier and forward the traffic without further lookup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is my idea correct ?&lt;/p&gt;&#xA;" OwnerUserId="25025" LastEditorUserId="775" LastEditDate="2016-05-01T20:55:47.150" LastActivityDate="2020-05-20T04:11:45.847" Title="Is Longest Prefix Matching(LPM) Done in Data or Control Plane?" Tags="|routing|ip-forwarding-table|cef|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30075" PostTypeId="2" ParentId="30073" CreationDate="2016-05-01T02:35:57.897" Score="2" Body="&lt;p&gt;Basically, the control plane is for data destined to the router itself (e.g. routing protocol updates), while the forwarding (data) plane controls what goes through the router. The forwarding plane can make decisions based on what is learned in the control plane, but the control plane itself doesn't make the forwarding decisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you are sort of describing layer-3 switching. One thing to understand is that, ideally, each packet is switched independently of any other packets. You may want to study process switching vs. other switching methods. There are many documents, e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/express-forwarding-cef/13706-20.html&quot; rel=&quot;nofollow&quot;&gt;How to Choose the Best Router Switching Path for Your Network&lt;/a&gt;, which describe the various switching methods available, but this is vendor-dependent.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-01T02:51:56.477" LastActivityDate="2016-05-01T02:51:56.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30076" PostTypeId="1" AcceptedAnswerId="44217" CreationDate="2016-05-01T05:04:50.677" Score="5" ViewCount="18004" Body="&lt;p&gt;I am running a pfSense 2.3 box with 4 NICs. Now i have 2 different ISPs (one Cable &amp;amp; one DSL). How Can i configure, that all traffic from LAN1 goes ONLY over WAN1, and all traffic from LAN2 goes ONLY over WAN2? I Dont want any Failover or LoadBalancing, just seperate each Networks &quot;Gateways&quot;. Here a simple diagram, on what i try to achieve.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ouaiX.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ouaiX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25027" LastActivityDate="2020-11-13T11:14:12.503" Title="pfSense 2.3 How to setup each Lan traffic goes only over specific gateway" Tags="|router|firewall|lan|wan|pfsense-2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30079" PostTypeId="2" ParentId="30076" CreationDate="2016-05-01T13:05:36.883" Score="0" Body="&lt;p&gt;You can do that by changing the NAT rules. (This only works for IPv4)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firewall --&gt; NAT --&gt; Outbound --&gt; &quot;Mode&quot;: Manual Outbound NAT rule generation&#xA;(AON - Advanced Outbound NAT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you can specify which subnet goes over which WAN interface:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface --&gt; Choose WAN interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source --&gt; Specify LAN subnet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8ek66.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8ek66.png&quot; alt=&quot;PfSense NAT&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uBcAC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uBcAC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user22997" LastEditorDisplayName="user22997" LastEditDate="2016-05-02T17:41:13.600" LastActivityDate="2016-05-02T17:41:13.600" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="30080" PostTypeId="2" ParentId="30066" CreationDate="2016-05-01T13:49:55.247" Score="2" Body="&lt;p&gt;If you are using static object NAT this way with the outside interface IP as a mapped IP - you have to use &quot;interface&quot; instead of using a specific interface IP.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;nat (global-wireless,public-IP) static interface service tcp 4370 4370&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="868" LastActivityDate="2016-05-01T13:49:55.247" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30084" PostTypeId="2" ParentId="25567" CreationDate="2016-05-01T19:52:35.673" Score="4" Body="&lt;p&gt;Yes, it is possible. I'm not sure if you can block only ARP requests, but as far as I know this command would block all ARP (incoming and outgoing). It's just for Linux systems:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip link set dev eth0 arp off&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;No, blocking ARP requests doesn't mean that other hosts won't find you, it means that you won't find other hosts (note that I'm talking from your host point of view, so the requests are going out not going in).&lt;/p&gt;&#xA;" OwnerUserId="23459" LastEditorUserId="23459" LastEditDate="2016-05-02T07:51:41.850" LastActivityDate="2016-05-02T07:51:41.850" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30089" PostTypeId="1" AcceptedAnswerId="30090" CreationDate="2016-05-02T01:00:01.877" Score="1" ViewCount="769" Body="&lt;p&gt;I was just making new short UTP cables, and I was happy that when I checked the cable through an Ethernet Cable Tester, all 8 wires were straight to each other and was perfect. When I plugged the UTP cable in the laptop, and plugged another end in the router, I was getting nothing, and then after some time, it started flashing. The lights stopped flashing, then started flashing, and then stopped, and it kept like that!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am confused as to why is it doing so, after all, all 8 wires were straight connected to each other. It should work, but it's not working! Sometimes, it gets connected, but takes a lot of time, and the rest of the time, the lights flash, and then stop flashing (the lights in the ethernet port plug area)!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And it's a straight cable!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me out with this issue please?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ethernet Cable Order:&#xA;&#xA;Orange (White Stripe)&#xA;Orange&#xA;Green (White Stripe)&#xA;Blue&#xA;Blue (White Stripe)&#xA;Green&#xA;Brown (White Stripe&#xA;Brown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19616" LastEditorUserId="8499" LastEditDate="2019-01-03T02:13:55.140" LastActivityDate="2019-01-03T02:13:55.140" Title="New crimped UTP cable connects and disconnects" Tags="|ethernet|layer1|internet|cable|utp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30090" PostTypeId="2" ParentId="30089" CreationDate="2016-05-02T01:12:18.830" Score="1" Body="&lt;p&gt;There is a lot more to making a working UTP cable than just having eight wires connected straight through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must meet the required measurements, such as frequency, insertion loss, NEXT, PSNEXT, FEXT, ELFEXT, PSELFEXT, return loss, propagation delay, delay skew, balance, longitudinal conversion transfer loss, etc. Splitting pairs (you seem to do this correctly), untwisting too much at the terminator, exceeding the bend radius, etc. can all cause poor cable performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is horizontal cable, it needs to be &amp;lt;= 90 meters of solid-core cable with matching terminators. If it is a patch cable, it needs to be &amp;lt;= 5 meters, and it should be stranded cable, with matching terminators. The terminators must match the cable type (stranded or solid core) and be the same category as the cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The symptoms you describe usually happen with 1000BASE-T and poor cable that can't pass the test suite. If your company doesn't own the proper tester, it can rent one by the hour.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-02T01:29:10.413" LastActivityDate="2016-05-02T01:29:10.413" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30091" PostTypeId="1" CreationDate="2016-05-02T01:41:42.460" Score="2" ViewCount="810" Body="&lt;p&gt;For below CME configuration which I configured on UC500 where ephones are not configured with dual-line feature and in button command separator 'c'(call waiting) is used.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CME_VOICE(config)#ephone-dn 10&#xA;CME_VOICE(config-ephone-dn)#number 1010&#xA;CME_VOICE(config-ephone-dn)#no huntstop&#xA;&#xA;CME_VOICE(config)#ephone-dn 11&#xA;CME_VOICE(config-ephone-dn)#number 1010&#xA;CME_VOICE(config-ephone-dn)#preference 1&#xA;CME_VOICE(config-ephone-dn)#no huntstop&#xA;&#xA;CME_VOICE(config)#ephone 8&#xA;CME_VOICE(config-ephone)#button 1c10,11&#xA;&#xA;CME_VOICE(config)#ephone 9&#xA;CME_VOICE(config-ephone)#button 1c10,11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what will happen if a guy is already busy on ephone 8 and at the same time second call to '1010' comes in? Would call ring on ephone 8? If YES, then please explain why? In my opinion since I haven't configured ephone with dual-line feature, receiving second call on that ephone is not possible even when we have configured it for call waiting. Another question is what will happen for below configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CME_VOICE(config)#ephone-dn 10 dual-line&#xA;CME_VOICE(config-ephone-dn)#number 1010&#xA;CME_VOICE(config-ephone-dn)#no huntstop&#xA;&#xA;CME_VOICE(config)#ephone-dn 11 dual-line&#xA;CME_VOICE(config-ephone-dn)#number 1010&#xA;CME_VOICE(config-ephone-dn)#preference 1&#xA;CME_VOICE(config-ephone-dn)#no huntstop&#xA;&#xA;CME_VOICE(config)#ephone 8&#xA;CME_VOICE(config-ephone)#button 1o10,11&#xA;&#xA;CME_VOICE(config)#ephone 9&#xA;CME_VOICE(config-ephone)#button 1o10,11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17520" LastEditorDisplayName="user36472" LastEditDate="2019-02-25T11:55:37.637" LastActivityDate="2021-04-27T13:44:44.387" Title="How does &quot;dual-line&quot; feature work on Cisco/Avaya IP phones for VOIP?" Tags="|voip|cisco-voip|avaya|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30095" PostTypeId="1" CreationDate="2016-05-02T11:06:51.073" Score="1" ViewCount="167" Body="&lt;p&gt;I'm trying to establish inter vlan connectivity, but I can't figure out how to do this in my network. I'd be glad if someone could advice me what should I do. Below I depicted my network topology:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HOST_A (VLAN 100, 1/0/2)            HOST_B (VLAN 100, 1/0/2)&#xA;10.0.0.2/25                         10.0.0.3/25&#xA;10.0.0.130/25                       10.0.0.131/25&#xA;            SWITCH_L3_A &amp;lt;-&amp;gt; SWITCH_L3_B &#xA;                                    HOST_C (VLAN 101, 1/0/3)&#xA;                                    10.0.1.2/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My configuration looks, more or less, like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SWITCH_L3_A:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;vlan 100&#xA; name my-vlan&#xA;!&#xA;interface vlan 100&#xA; ip address 10.0.0.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; switchport access vlan 100&#xA; switchport mode access&#xA;!&#xA;&#xA;interface GigabitEthernet1/0/24&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 100, 101 (and some other vlans)&#xA; switchport mode trunk&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SWITCH_L3_B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;vlan 100&#xA; name my-vlan-100&#xA;!&#xA;vlan 101&#xA; name my-vlan-101&#xA;!&#xA;interface Vlan101&#xA; ip address 10.0.1.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; switchport access vlan 100&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA; switchport access vlan 101&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/24&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 100 (and some other vlans)&#xA; switchport mode trunk&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to ping from HOST_B 10.0.0.131 to HOST_C 10.0.1.2 but I'm not able to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--- Edited on 02-05-2016, 15:10 ---&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other solution than mentioned by JFL?&#xA;I'd like to keep both switches to serve as L3.&lt;/p&gt;&#xA;" OwnerUserId="25054" LastEditorUserId="25055" LastEditDate="2016-05-02T19:00:27.120" LastActivityDate="2016-05-02T20:06:10.740" Title="Inter VLAN routing issue" Tags="|cisco|vlan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30096" PostTypeId="2" ParentId="30095" CreationDate="2016-05-02T11:41:43.553" Score="1" Body="&lt;p&gt;You have at least 2 issues here :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;VLAN 101 is not allowed on switch B trunk port (interface GigabitEthernet1/02/24)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;you use 2 routers (layer 3 switchs) each one having an IP address in only one VLAN&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For a router to route packet between two networks, it must be connected to both networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Basic configuration&lt;/strong&gt;&lt;br&gt;&#xA;For a simple configuration do the following&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On switch A set:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan101&#xA; ip address 10.0.1.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On switch B :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip routing&#xA;!&#xA;interface VLAN101  &#xA;  no ip address&#xA;!&#xA;interface GigabitEthernet1/0/24  &#xA; switchport trunk allowed vlan 100, 101 (and some other vlans)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The result will be that the switch A will route between VLANs 100 &amp;amp; 101.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Advanced Configuration&lt;/strong&gt;&lt;br&gt;&#xA;If you want to keep both switch as Layer 3 and use switch A as gateway for VLAN 100 and switch B as gatewat for VLAN 101, then you need to add a network between switch A and B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example below I add a VLAN 1001 with a /30 network that will be used to route between both switches, then I add a static route on each switch so it knows where to find the other network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch A  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing  &#xA;&#xA;interface Vlan100  &#xA; ip address 10.0.0.1 255.255.255.0  &#xA;&#xA;interface vlan1001  &#xA; ip address 172.16.1.1 255.255.255.252&#xA;&#xA;interface GigabitEthernet1/0/24&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 100, 101,1001&#xA; switchport mode trunk&#xA;&#xA;ip route 10.0.1.0 255.255.255.0 172.16.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch B&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing  &#xA;&#xA;interface Vlan101  &#xA; ip address 10.0.1.1 255.255.255.0  &#xA;&#xA;interface vlan1001  &#xA; ip address 172.16.1.2 255.255.255.252&#xA;&#xA;interface GigabitEthernet1/0/24&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 100, 101,1001&#xA; switchport mode trunk&#xA;&#xA;ip route 10.0.0.0 255.255.255.0 172.16.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-05-02T20:06:10.740" LastActivityDate="2016-05-02T20:06:10.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30097" PostTypeId="1" AcceptedAnswerId="30122" CreationDate="2016-05-02T16:33:25.260" Score="1" ViewCount="6809" Body="&lt;p&gt;I've configured a vlan 3 with ip address and then assigned FE port to vlan 3 , i read that this will assign the ip address to the FE interface.&#xA;I know this is really simple configuration .But really would love some help on how to assign IP addresses to FE interfaces on switches in CPT .&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   Cisco IOS Software, C2960 Software (C2960-LANBASE-M), Version 12.2(25)FX, RELEASE SOFTWARE (fc1)&#xA; !&#xA;interface FastEthernet0/1&#xA;switchport access vlan 3&#xA;switchport mode access&#xA;!&#xA;!&#xA;interface Vlan3&#xA;ip address 172.12.123.1 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21879" LastEditorUserId="8499" LastEditDate="2018-03-18T21:59:07.887" LastActivityDate="2018-03-18T21:59:07.887" Title="Assign IP address to a FastEthernet port on CPT switch" Tags="|cisco|ip|cisco-catalyst|ip-address|layer3|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30103" PostTypeId="1" CreationDate="2016-05-02T21:37:49.863" Score="1" ViewCount="200" Body="&lt;p&gt;Looking to implement a pfSense SG-2440 downstream from the primary router so that we can (road warrior) VPN in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that I'll have to forward ports 500, 50, and 51 to the pfSense device from the upstream router but am unclear on what other configuration changes I'll need to make in creating the VPN tunnel.  What other changes will I need to make to the configuration to make this VPN scenario work such that by VPNing in the client will be privy to the upstream router's network?&lt;/p&gt;&#xA;" OwnerUserId="23284" LastActivityDate="2016-07-02T08:06:32.427" Title="IPsec device downstream from router/dhcp server" Tags="|vpn|ipsec|pfsense|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30105" PostTypeId="1" AcceptedAnswerId="30107" CreationDate="2016-05-03T02:15:40.667" Score="2" ViewCount="3498" Body="&lt;p&gt;I have 3 Ubuntu VMs in VirtualBox. They are in a host-only network (LAN). Now, I turn on the wireshark capturing on VM1, and then on VM2 I ping VM3. I expect to capture the ICMP messages on VM1. However, wireshark captures nothing from the &quot;any&quot; interface. Could you please tell me why? Thanks!  &lt;/p&gt;&#xA;" OwnerUserId="14597" LastEditorUserId="14597" LastEditDate="2016-05-03T02:41:27.013" LastActivityDate="2016-05-03T02:48:27.347" Title="Using Wireshark to Capture Traffic Between VMs on a Third VM" Tags="|lan|wireshark|ping|" AnswerCount="2" CommentCount="2" ClosedDate="2016-05-03T04:57:31.010" ContentLicense="CC BY-SA 3.0" />
  <row Id="30106" PostTypeId="2" ParentId="30105" CreationDate="2016-05-03T02:31:59.783" Score="1" Body="&lt;p&gt;First, Wireshark need to be listening on one interface. When you open Wireshark, there is a list of availables interfaces on your host, physical NICs and Virtual ones, what you need to do is select the specific virtual interface. With that, the packets must be listed.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-05-03T02:31:59.783" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30107" PostTypeId="2" ParentId="30105" CreationDate="2016-05-03T02:48:27.347" Score="1" Body="&lt;p&gt;Select “Allow VMs” Promiscuous mode for the network adapter.&lt;/p&gt;&#xA;" OwnerUserId="14597" LastActivityDate="2016-05-03T02:48:27.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30109" PostTypeId="1" AcceptedAnswerId="30112" CreationDate="2016-05-03T06:25:38.603" Score="3" ViewCount="917" Body="&lt;p&gt;As far as I am aware, Autonomous System Numbers (ASNs) are assigned to entities such as Internet Service Providers and other large organizations that control blocks of IP addresses. Thus, each ASN can be mapped to its country of location. For example, ASN174 is mapped to United States. However, when it check this page: &lt;a href=&quot;http://ipinfo.io/AS174&quot; rel=&quot;nofollow&quot;&gt;http://ipinfo.io/AS174&lt;/a&gt;, this AS also controls many IP blocks that aren't located in United States (e.g. 5.83.240.0/20 is in Ireland, and 5.157.72.0/21 is in Slovenia). So my question is that where the ASN (i.e. the data center) is really located in, is it still in the United State? And, will the AS-paths that originate from IP block in Ireland and from IP block from Slovenia to a same destination host be totally different although they are from a same ASN? &lt;/p&gt;&#xA;" OwnerUserId="14512" LastEditorUserId="8499" LastEditDate="2016-05-12T02:34:42.277" LastActivityDate="2016-05-12T02:34:42.277" Title="Why does an Autonomous System have many IP blocks located in many countries?" Tags="|routing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30110" PostTypeId="2" ParentId="30103" CreationDate="2016-05-03T07:19:21.610" Score="1" Body="&lt;p&gt;First you are confusing protocol and ports.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming you want to use IPSEC , you have to allow / forward:&lt;br&gt;&#xA;&lt;em&gt;UDP port 500&lt;br&gt;&#xA;protocol 50 (ESP)&lt;br&gt;&#xA;protocol 51 (AH)&lt;/em&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;50 and 51 are protocols numbers and not ports&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore if you are using NAT between your upstream router and the pfsense, the connection will use NAT traversal on UDP 4500 as well as UDP 500.&lt;br&gt;&#xA;In this case you don't need to forward protocols 50/51 since they will be encapsulated in UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the question itself, there's nothing special to do on the upstream router, you just have to configure the VPN on the Pfsense. Of course the pfsense must be able to reach the internal network you want to give access to.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-05-03T07:19:21.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30112" PostTypeId="2" ParentId="30109" CreationDate="2016-05-03T07:44:54.647" Score="4" Body="&lt;p&gt;The country attribute in whois databases only indicates in which country the office which registered the AS number is located, it does not tell you anything about where traffic is originated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that AS numbers are not limited to a country. Cogent (AS174) has points of presence all around the world, thus it has customers located all around the world, as you can see on the page you linked. ASn's are not limited to a country.&#xA;Most likely, they have set the country attribute for those IP blocks to the country in which the customer they assigned the block to prefers. This helps preventing localisation problems like seeing webpages in a wrong language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Information in whois databases do not need to reflect the reality of the routing tables.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And, will the AS-paths that originate from IP block in Ireland and from IP block from Slovenia to a same destination host be totally different although they are from a same ASN? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;All IP blocks are originated from the same ASN (174). If the AS path for each prefix is identical is totally up to Cogent. They may choose to announce specific IP blocks to specific BGP peers or use the same policy for every IP block. The only way to tell is look at routing tables.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-05-03T07:44:54.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30113" PostTypeId="1" AcceptedAnswerId="30115" CreationDate="2016-05-03T09:04:51.223" Score="1" ViewCount="351" Body="&lt;p&gt;I am really new to this VLANs and have watched and read some tutorials and how-tos, but i can't get my setup to work. &#xA;I have the following situation:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;4 Accesspoints with 2 SSIDs (work and public)&lt;/li&gt;&#xA;&lt;li&gt;2 Switches (one for the APs and one for the internal LAN)&lt;/li&gt;&#xA;&lt;li&gt;1 CISCO ASA (Firewall that is connected to our internet service provider)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How do I have to tag the VLAN ports on both switches that my setup is working?&#xA;I made a (not so beautiful) ASCII graphic from my setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/w5v8A.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/w5v8A.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="25078" LastActivityDate="2016-05-03T09:46:32.783" Title="Accesspoints multiple VLANs" Tags="|vlan|hp-procurve|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30115" PostTypeId="2" ParentId="30113" CreationDate="2016-05-03T09:35:59.933" Score="1" Body="&lt;p&gt;Functionally speaking, a VLAN capable wifi Access Point is a switch. So you treat the link between the HP swicth and the APs the same way as between 2 switches. I.E. trunk ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note that here I use the term &quot;trunk&quot; for a port on which several tagged VLAN are allowed. In HP terminology &quot;trunk&quot; refers to link aggregation, which has nothing to do with VLANs.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you didn't provide VLAN number, I'll give some example with arbitrary numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's use :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN2 : used for APs and switches management&lt;/li&gt;&#xA;&lt;li&gt;VLAN3 : work VLAN used for both &quot;work&quot; wifi SSID and internal LAN&lt;/li&gt;&#xA;&lt;li&gt;VLAN4 : &quot;public&quot; wifi SSID&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You need to configure your ports as&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;ASA&lt;/strong&gt;  &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;port connected to the HP Switch1 : trunk with allowed VLAN 2,3 and 4&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Switch1&lt;/strong&gt;  &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;port 17 : trunk with allowed VLAN 2,3 and 4  &lt;/li&gt;&#xA;  &lt;li&gt;ports 1,2,3 &amp;amp; 4 : trunk with allowed VLAN 2,3 and 4;  and native VLAN 2 (depending on you AP model, but suitable for most AP)  &lt;/li&gt;&#xA;  &lt;li&gt;port 24 : trunk with allowed VLAN 2 and 3&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Switch2&lt;/strong&gt;  &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;port connected to switch1 : trunk with allowed VLAN 2 and 3&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you want to separate the &quot;work&quot; wifi from the internal LAN, we add VLAN5 for Internal LAN and this give us:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;ASA&lt;/strong&gt;  &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;port connected to the HP Switch1 : trunk with allowed VLAN 2,3,4 and 5&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Switch1&lt;/strong&gt;  &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;port 17 : trunk with allowed VLAN 2,3,4 and 5  &lt;/li&gt;&#xA;  &lt;li&gt;ports 1,2,3 &amp;amp; 4 : trunk with allowed VLAN 2,3 and 4;  and native VLAN 2 (depending on you AP model, but suitable for most AP)  &lt;/li&gt;&#xA;  &lt;li&gt;port 24 : trunk with allowed VLAN 2 and 5&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Switch2&lt;/strong&gt;  &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;port connected to switch1 : trunk with allowed VLAN 2 and 5&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;P.S. nice ascii drawing.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-05-03T09:46:32.783" LastActivityDate="2016-05-03T09:46:32.783" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30118" PostTypeId="1" AcceptedAnswerId="30119" CreationDate="2016-05-03T15:09:48.663" Score="4" ViewCount="724" Body="&lt;p&gt;I'm using the student version of cisco packet tracer 6.2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two vlans that are connected to the same router but they can't ping each other. Here is the config from my router and my switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My router:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;hostname Router&#xA;ip dhcp excluded-address 192.168.10.254&#xA;ip dhcp excluded-address 192.168.20.254&#xA;ip dhcp pool 10&#xA;network 192.168.10.0 255.255.255.0&#xA;ip dhcp pool 20&#xA;network 192.168.20.0 255.255.255.0&#xA;ip cef&#xA;no ipv6 cef&#xA;spanning-tree mode pvst&#xA;interface FastEthernet0/0&#xA;no ip address&#xA;duplex auto&#xA;speed auto&#xA;interface FastEthernet0/0.10&#xA;encapsulation dot1Q 10&#xA;ip address 192.168.10.254 255.255.255.0&#xA;interface FastEthernet0/0.20&#xA;encapsulation dot1Q 20&#xA;ip address 192.168.20.254 255.255.255.0&#xA;interface FastEthernet0/1&#xA;no ip address&#xA;duplex auto&#xA;speed auto&#xA;shutdown&#xA;interface Vlan1&#xA;no ip address&#xA;shutdown&#xA;ip classless&#xA;ip flow-export version 9&#xA;no cdp run&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA; login&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;and my switch:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;hostname Switch&#xA;spanning-tree mode pvst&#xA;interface FastEthernet0/1&#xA;switchport access vlan 10&#xA;interface FastEthernet0/2&#xA;switchport access vlan 20&#xA;interface FastEthernet0/3&#xA;switchport mode trunk&#xA;ports 4-24 are not configured. &#xA;interface Vlan1&#xA;no ip address&#xA;shutdown&#xA;line con 0&#xA;line vty 0 4&#xA;login&#xA;line vty 5 15&#xA;login&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25088" LastEditorUserId="509" LastEditDate="2016-05-03T15:14:35.063" LastActivityDate="2016-05-03T15:20:45.810" Title="I have two vlans on the same router that can't ping each other" Tags="|switch|router|vlan|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30119" PostTypeId="2" ParentId="30118" CreationDate="2016-05-03T15:20:45.810" Score="1" Body="&lt;p&gt;You forgot the default gateway in the DHCP configurations.  You need one for each pool:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;default-router 192.168.x.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-03T15:20:45.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30121" PostTypeId="1" AcceptedAnswerId="30123" CreationDate="2016-05-03T16:29:09.220" Score="6" ViewCount="232" Body="&lt;p&gt;There are &lt;a href=&quot;http://example.com&quot; rel=&quot;noreferrer&quot;&gt;example.com&lt;/a&gt; or &lt;a href=&quot;http://example.org&quot; rel=&quot;noreferrer&quot;&gt;example.org&lt;/a&gt; domains used for documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are MCC &lt;code&gt;001&lt;/code&gt; and MNC &lt;code&gt;01&lt;/code&gt; used for testing equipment in cell networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there MAC, IP and IPv6 addresses that are intended to use or used conventionally for testing purposes and documentation?&lt;/p&gt;&#xA;" OwnerUserId="25090" LastActivityDate="2020-07-08T11:39:29.543" Title="What MAC, IP and IPv6 addresses should I use as example for testing and documentation?" Tags="|mac-address|ip-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30122" PostTypeId="2" ParentId="30097" CreationDate="2016-05-03T16:42:11.543" Score="2" Body="&lt;p&gt;IP is a layer-3 protocol, but you have a layer-2 switch. When a port is configured as a switch (layer-2) port, you can't assign an IP address to it. It doesn't make sense to assign a layer-3 address to a layer-2 port. IP is a layer-3 protocol, so you assign it to layer-3 ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-2 switch can have a layer-3 SVI port to which you can assign an IP address, but your switch isn't a router or layer-3 switch, so an IP address on your SVI is only for switch management. If you want to have multiple VLANs and route between them, you need a router or a layer-3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had a layer-3 switch, you would need to make sure that you have IP routing enabled. You could then assign IP addresses to the ports, but you would first need to use the &lt;code&gt;no switchport&lt;/code&gt; command.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-03T16:42:11.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30123" PostTypeId="2" ParentId="30121" CreationDate="2016-05-03T16:50:00.883" Score="9" Body="&lt;p&gt;To quote from RFC 5737:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The blocks 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2),&#xA;and 203.0.113.0/24 (TEST-NET-3) are provided for use in&#xA;documentation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;And RFC 5156:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The 2001:db8::/32 are the documentation addresses [RFC3849].  They&lt;br /&gt;&#xA;are used for documentation purposes such as user manuals, RFCs, etc.&lt;br /&gt;&#xA;Addresses within this block should not appear on the public Internet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;And of course, RFC 7042:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;0x0042 is a protocol number under the IANA OUI (that is,&lt;br /&gt;&#xA;00-00-5E-00-42) to be used for documentation purposes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2062" LastEditDate="2020-07-08T11:39:29.543" LastActivityDate="2020-07-08T11:39:29.543" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="30127" PostTypeId="2" ParentId="30109" CreationDate="2016-05-03T21:51:40.880" Score="1" Body="&lt;p&gt;An AS isn't limited to one datacenter. Large ISPs have globe-spanning networks, so they can move traffic arround the world while keeping it in-network. Therefore from the point of view of the rest of the internet their network can be treated as a single network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cogent are a transit free network, so to provide their customers with access to the internet* they will need to announce all their customers to all the other transit free networks that they peer with (and likely to most of the other networks they peer with though sometimes peering politics lead to only a subset of customer prefixes being announced) and similarly provide routes for outgoing traffic to all those peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course with many/most of their peers they will be interconnected in multiple locations. They will likely use some mechanisms (such as nearest-exit routing for outgoing traffic and/or multi-exit discriminators for incoming traffic and/or artificially extending the &quot;AS path&quot;) to try and prevent traffic taking stupid routes (sending traffic across the atlantic twice is generally considered a way to annoy customers and waste money).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;* Well most of it. They have an ongoing peering spat with HE and HE consider themselves to be an &quot;IPv6 teir 1&quot; and refuse to buy IPv6 transit. So there is no IPv6 connectivity between HE and cogent.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-03T21:51:40.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30128" PostTypeId="1" CreationDate="2016-05-03T22:21:37.307" Score="6" ViewCount="10900" Body="&lt;p&gt;Could some one kindly explain what is the difference between IPv6 Unique Local Addressing and Link-Local addressing? I understand that Link-Local is for within a network, but isn't Unique Local Addressing similar to that?&lt;/p&gt;&#xA;" OwnerUserId="24740" LastEditorUserId="8499" LastEditDate="2018-03-12T00:25:40.960" LastActivityDate="2018-03-12T00:25:40.960" Title="IPv6 ULA vs Link-Local" Tags="|ip|ipv6|ip-address|ip-link-local|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30129" PostTypeId="2" ParentId="29375" CreationDate="2016-05-03T22:32:09.123" Score="2" Body="&lt;p&gt;Tecnhnically they can be interconnected by any link layer that can carry the IP packets between the two routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interconnections between ASs can be roughly divided into transit (where a provider AS providers &quot;internet access&quot; to a customer)  and peering (where two ASs exchange routes for themselves and their customers with each other). There are also possibilities in between conventional transit and conventional peering which I won't go into here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transit connections will usually be over private links (though some exchange points do allow transit relationships). So will high traffic peering interconnections. The details of these private links will depend on the distance between the routers that need to be connected. For links within a datacenter most datacenters offer cheap and simple cross-connects. For longer distance links a circuit will likely be rented from a local communication provider. The rented circuit may either be a physical fiber, a wavelength on WDM or some kind of virtual circuit (MPLS, Vlan, ATM PVC etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exchange points are used where an AS wants to peer with a large variety of other ASs but each individual peering relationship doesn't have enough traffic to justify a dedicated link. The exchange point provides connectivity between many ASs allowing the costs of physical interconnect to be spread across many peering relationhips. The exchange point typically provides an ethernet network over which the peering relationships can be established and each provider connects their router to that network (again this connection may be a simple cross-connect within a datacenter or it may be a longer distance link rented from a communication provider). &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-03T22:32:09.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30130" PostTypeId="2" ParentId="30128" CreationDate="2016-05-03T22:39:08.093" Score="7" Body="&lt;p&gt;IPv6 link-local addresses are required addresses, and they cannot be routed. They are confined to a single link, and every link has the same link-local network. The link-local address range is &lt;code&gt;fe80::/10&lt;/code&gt;. From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#section-2.5.6&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291, IP Version 6 Addressing Architecture&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;2.5.6.  Link-Local IPv6 Unicast Addresses&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Link-Local addresses are for use on a single link. Link-Local&#xA;addresses have the following format:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|   10     |&#xA;|  bits    |         54 bits         |          64 bits           |&#xA;+----------+-------------------------+----------------------------+&#xA;|1111111010|           0             |       interface ID         |&#xA;+----------+-------------------------+----------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Link-Local addresses are designed to be used for addressing on a&#xA;single link for purposes such as automatic address configuration,&#xA;neighbor discovery, or when no routers are present.&lt;/p&gt;&#xA;&lt;p&gt;Routers must not forward any packets with Link-Local source or&#xA;destination addresses to other links.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;ULA addresses can be routed (except on the public Internet). There are some rules to ULA addressing. The ULA address range is &lt;code&gt;fc00::/7&lt;/code&gt;, but the first half of the addresses, &lt;code&gt;fc00::/8&lt;/code&gt;, is reserved for assignment by a global authority. The second half of the ULA address range, &lt;code&gt;fd00::/8&lt;/code&gt;, is available for local use, but the 40-bit Global ID must be randomly chosen. From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4193&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4193, Unique Local IPv6 Unicast Addresses&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;1.  Introduction&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;This document defines an IPv6 unicast address format that is globally&#xA;unique and is intended for local communications [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4193#ref-IPV6&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPV6&lt;/a&gt;].  These&#xA;addresses are called Unique Local IPv6 Unicast Addresses and are&#xA;abbreviated in this document as Local IPv6 addresses.  They are not&#xA;expected to be routable on the global Internet.  They are routable&#xA;inside of a more limited area such as a site.  They may also be routed&#xA;between a limited set of sites.&lt;/p&gt;&#xA;&lt;p&gt;Local IPv6 unicast addresses have the following characteristics:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Globally unique prefix (with high probability of uniqueness).&lt;/li&gt;&#xA;&lt;li&gt;Well-known prefix to allow for easy filtering at site boundaries.&lt;/li&gt;&#xA;&lt;li&gt;Allow sites to be combined or privately interconnected without    creating any address conflicts or requiring renumbering of interfaces&#xA;that use these prefixes.&lt;/li&gt;&#xA;&lt;li&gt;Internet Service Provider independent and can be used for communications inside of a site without having any permanent or intermittent Internet connectivity.&lt;/li&gt;&#xA;&lt;li&gt;If accidentally leaked outside of a site via routing or DNS, there is    no conflict with any other addresses.&lt;/li&gt;&#xA;&lt;li&gt;In practice, applications may treat these addresses like global    scoped addresses.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-05-03T22:48:01.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30131" PostTypeId="2" ParentId="30128" CreationDate="2016-05-03T23:34:42.077" Score="4" Body="&lt;p&gt;Link local addresses are local to a link*. Packets to/from link local addresses cannot cross any router. Furthermore to use a link local address requires knowing what interface it relates to. The trouble is interface IDs are a machine local concept and not nessacerally stable. These restrictions severely limit the utility of link local addresses. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Unique local addresses are akin to the RFC1918 addresses of IPv4. They can be routed within a site or a group of cooperating sites but they can't be advertised on the Internet. They are treated like global scope addresses by applications, there is none of that interface ID BS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One problem with RFC1918 addresses was when an interconnection needed to be established between two private networks that had not been previously connected. There was a substatial chance that the two networks would use overlapping RFC1918 space and hence interconnection would be difficult. ULAs were designed to mitigate this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ULA block was split into two parts, the lower half (FC00::/8) was intended to be allocated by a registry body that gave a gaurantee of uniqueness. However this never actually happened** and these addresses are therefore considered reserved. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The upper half (FD00::/8) was allocated to probabalistically unique addresses. Sites are supposed to pick a /48 prefix pesudo-randomly (an algorithm is suggested but not mandated in the standard) from FD00::/8. This means that the probablity of an address collision in a group of n sites is roughly n&lt;sup&gt;2&lt;/sup&gt;/(2*2&lt;sup&gt;40&lt;/sup&gt;). &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;My guess is your confusion comes from a home/small buisness perspective on networking. In a home/small buisness network it is rare for there to be more than one &quot;link&quot; within a private network. On the other hand in larger organisations it is more common for there to be complex private networks with many &quot;link&quot;s and routing between those links.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;* a Link being a group of machines that are connected by a protocol at a lower level than IP. For example a single Ethernet VLAN (or a single ethernet network without VLANs)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;** There were concerns about the blurring line between private addresses and provider independent global addresses.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-09-20T21:01:40.357" LastActivityDate="2017-09-20T21:01:40.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30133" PostTypeId="2" ParentId="16303" CreationDate="2016-05-04T07:07:19.690" Score="1" Body="&lt;p&gt;Late to the party on this one, but to override RE-generated CoS values, you can use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set class-of-service host-outbound-traffic forwarding-class &amp;lt;FORWARDING-CLASS&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then set your re-write rules for that forwarding-class appropriately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are happy with just DSCP markings, you can assign these statically using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set class-of-service host-outbound-traffic dscp-code-point &amp;lt;DSCP-CODEPOINT&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-05-04T07:07:19.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30136" PostTypeId="1" AcceptedAnswerId="30140" CreationDate="2016-05-04T11:23:43.233" Score="1" ViewCount="1387" Body="&lt;p&gt;I'm new to IPv6 and having some issues with a configuration that was really easy/common with IPv4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My setup looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WAN (ISP managed router) &amp;lt;-&amp;gt; Router 1 ( my internal router ) &amp;lt;-&amp;gt; My workstations/devices&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With IPv4 I would assign private IPs for my workstations/Router 1 (Eg.: in subnet 192.168.0.0/24), Router 1 would also have another private IP with my ISP Router in another subnet ( Eg.: 192.168.100.0/24 ) and with NAT everything would work normally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, with IPv6, the ISP router receives and advertise a /64 IPv6 block. I was able to use dhcp6 client in Router 1 to receive the prefix and then use IPv6 autoconf to allow my workstations to get their IPv6 from that /64 block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internally, workstations can ping each other and Router 1, but they can't access the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After contacting my ISP, I was informed that with a /64 block I would only be able to use IPv6 if my workstations were connected directly to the ISP router. And, to make my setup work, I would need another /64 block. Is it true? If so, why? ( their support couldn't explain the reason )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aren't there another alternatives in this case?&lt;/p&gt;&#xA;" OwnerUserId="25114" LastActivityDate="2017-12-12T15:49:04.423" Title="IPv6: is it possible to use a /64 block when you have multiple routers?" Tags="|ipv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30137" PostTypeId="1" CreationDate="2016-05-04T11:30:09.253" Score="2" ViewCount="172" Body="&lt;p&gt;We have RS232 sensors connected to a serial device server that manages both ethernet(primary)WAN and cellular(failover)WWAN connectivity. A database application requires a single IP to manage each sensor. Currently, I'm manually switching the IPs when WAN is down (~twice per month). I'm aware of dynamic DNS services that can manage the 2 IPs and resolve into a single name, but this is not allowed in our situation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for alternative solutions to dynamic DNS.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Both the Ethernet and cellular IPs are static&lt;/li&gt;&#xA;&lt;li&gt;Ethernet is on a private WAN with the database server and cellular is publicly accessable&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="25113" LastActivityDate="2016-06-10T01:38:12.590" Title="Alternative solutions to using a dynamic DNS service to manage a failover ethernet/cellular device" Tags="|ip|failover|" AnswerCount="1" CommentCount="4" ClosedDate="2016-06-13T14:09:09.060" ContentLicense="CC BY-SA 3.0" />
  <row Id="30140" PostTypeId="2" ParentId="30136" CreationDate="2016-05-04T12:57:42.420" Score="3" Body="&lt;p&gt;Yes, IPv6 uses one /64 per LAN. Your ISP should give you a /48 or at least a /56. They get plenty of addresses from their RIR and they should distribute them properly. The whole idea behind IPv6 is to give everybody plenty of addresses, and ISPs that give you only a /64 are screwing it up... &lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-05-04T12:57:42.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30141" PostTypeId="2" ParentId="28176" CreationDate="2016-05-04T13:46:30.707" Score="2" Body="&lt;p&gt;Nat started as a kludge to work arround address shortages but over time people started to value other attributes.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A NAT hides your internal network structure from the outside world.&lt;/li&gt;&#xA;&lt;li&gt;A Nat is less likely to &quot;fail open&quot; than a non-nat firewall (for example on linux if you mistakenly enable IP routing before/without setting up proper policy in IPtables you can easilly end up with what was meant to be a firewall being a wide open router). &lt;/li&gt;&#xA;&lt;li&gt;A NAT decouples the addresses used on your external connectivity from those used inside your network. This provides a level of ISP independence that is otherwise difficult to acheive.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Many people in the IPv6 community are/were ivory tower types who deseperately wanted to belive that the only reason for using NAT was address conservation and/or to convince people that there were better soloutions to their problems than NAT. They did propose alternative soloutions but many of those soloutions carried high costs of their own (for example for &quot;hiding the network structure&quot; they recommended giving out IP addresses at random across the organisation which would massively bloat internal routing tables).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not everyone agrees with them though and as IPv6 has become more widespread NAT soloutions have become available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not really possible to do NAT with link local addresses as they are forbidden from passing over routers (and a NAT can be viewed as a special router) but it is possible to do it with &quot;Unique local&quot; addresses since semantically they are equivilent to global addresses. It is also possible to translate from one global address to another which is useful sometimes (for example when switching to a backup ISP).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-04T13:46:30.707" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30143" PostTypeId="2" ParentId="30097" CreationDate="2016-05-04T14:42:16.533" Score="0" Body="&lt;p&gt;This will give a interface on a switch an ip address but you will need to turn routing on the switch before this will work.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fa0/3&#xA;no switchport&#xA;ip address 172.12.123.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25121" LastEditorUserId="8499" LastEditDate="2016-05-04T14:44:44.873" LastActivityDate="2016-05-04T14:44:44.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30144" PostTypeId="1" CreationDate="2016-05-04T16:35:41.887" Score="3" ViewCount="506" Body="&lt;p&gt;We have multiple public IP address subnets for various purposes. I need to create an Internal Zone behind NAT that presents itself as having an external IP in External Zone B.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                [UNTRUST]         [TRUST]&#xA;&#xA;ISP---&amp;lt;---External Zone A ---&amp;lt;--- Internal Zone C&#xA;           (Public IPs)     nat    (Private IPs)&#xA;              |                                   &#xA;       routed ^&#xA;              |&#xA;          External Zone B ---&amp;lt;--- Internal Zone D&#xA;           (Public IPs)     nat    (Private IPs)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Putting a DIP pool on Zone B would seem like a logical step but then how do I construct the routing so that the Policy from D to A will be relevant to traffic going out via the ISP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this even possible? I know I could do this with a second firewall between D and B, as this the ssg would happily route traffic with a source in B to the ISP but I am not sure I can get a NAT from D to B, then a route from B to A and out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(A, B and C all work and route correctly today, currently C&amp;amp;D presents as the egress IP of zone A, I would happily accept a solution where D presents as the IP of the interface in Zone B)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware: SSG320M&#xA;Software: 6.3.0r21.0&lt;/p&gt;&#xA;" OwnerUserId="13290" LastEditorUserId="13290" LastEditDate="2017-03-13T16:31:54.497" LastActivityDate="2020-12-23T08:44:13.067" Title="Juniper NetScreen NAT from a secondary Untrusted Zone" Tags="|nat|juniper|screenos|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30145" PostTypeId="1" AcceptedAnswerId="30154" CreationDate="2016-05-04T16:52:34.393" Score="2" ViewCount="1536" Body="&lt;p&gt;I'm reading up on Netflow and playing around in PacketTracer. Currently I'm using ip flow ingress/egress only on my Routers gigabitEthernet. How much overhead is required, is Netflow supposed to be measured on all interfaces, even on switch trunklines?&lt;/p&gt;&#xA;" OwnerUserId="25125" OwnerDisplayName="watez" LastActivityDate="2016-05-04T23:09:25.883" Title="Netflow on all interfaces?" Tags="|monitoring|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30147" PostTypeId="1" AcceptedAnswerId="30149" CreationDate="2016-05-04T17:58:43.277" Score="2" ViewCount="2080" Body="&lt;p&gt;I'm configuring a &lt;code&gt;dhcp&lt;/code&gt; pool at my router (Cisco-7200) and I want to set the lease expiration to 1 hour. I checked the cisco manuals and I found this: &lt;code&gt;lease {days [hours] [minutes] | infinite}&lt;/code&gt;. So I came up with this:&#xA;&lt;code&gt;Router(dhcp-config)#lease 0 1&lt;/code&gt;. Is this the proper way to do it? Thanks for the attention.&lt;/p&gt;&#xA;" OwnerUserId="25126" LastActivityDate="2018-05-15T10:45:13.023" Title="How to setup a lease to 1 hour" Tags="|cisco|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30149" PostTypeId="2" ParentId="30147" CreationDate="2016-05-04T18:37:08.313" Score="6" Body="&lt;p&gt;In a nutshell, yes.&lt;/p&gt;&#xA;&lt;p&gt;For the future reference of others, a snippet from this document:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfdhcp.html#wp1001095&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/ip/configuration/guide/fipr_c/1cfdhcp.html#wp1001095&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Configuring the Address Lease Time&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;By default, each IP address assigned by a DHCP Server comes with a one-day lease, which is the amount of time that the address is valid. To change the lease value for an IP address, use the following command in DHCP pool configuration mode:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Command&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Router(dhcp-config)# lease {days [hours][minutes] | infinite}&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Purpose&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Specifies the duration of the lease. The default is a one-day lease.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use the show ip dhcp binding to display the lease expiration time and date of the IP address of the host.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="91" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-05-04T18:37:08.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30150" PostTypeId="2" ParentId="30026" CreationDate="2016-05-04T19:13:30.087" Score="0" Body="&lt;p&gt;The transport layer does not affect the data rate of 802.11 networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The data rate is the the rate at which the AP and client modulate frames.  This is based on the signal-to-noise ratio (SNR) between the AP and the wireless client. This is highly variable based on many conditions, including RF interference, distance, device drivers, etc. and often fluctuates over time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Throughput is what we can measure within the TCP/IP stack, which is where our transport layer comes into play. This is also highly variable depending on quite a few factors, such as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;application protocol&lt;/li&gt;&#xA;&lt;li&gt;backhaul (how the AP is connected to the wired network)&lt;/li&gt;&#xA;&lt;li&gt;wireless data rate&lt;/li&gt;&#xA;&lt;li&gt;other wireless clients in the cell&lt;/li&gt;&#xA;&lt;li&gt;RF interference&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can make educated guesses by taking the data rate (say, 54Mbps) and dividing it by two (because Wi-Fi is a half-duplex medium), then using that as a line rate for further calculations that take into account the overhead of your protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 802.11g data rates, I would refer to this article:&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.11g-2003#Technical_description&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/IEEE_802.11g-2003#Technical_description&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Modern wireless protocols (802.11n and newer) use Modulation Coding Scheme (MCS) to determine the data rate. There's a great table at &lt;a href=&quot;http://mcsindex.com&quot; rel=&quot;nofollow&quot;&gt;http://mcsindex.com&lt;/a&gt; that shows all the data rate combinations for MCS.&lt;/p&gt;&#xA;" OwnerUserId="91" LastActivityDate="2016-05-04T19:13:30.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30154" PostTypeId="2" ParentId="30145" CreationDate="2016-05-04T22:30:14.103" Score="4" Body="&lt;p&gt;When you only have one Router, then you are fine monitoring both directions &lt;em&gt;or&lt;/em&gt; both interfaces. If you monitor both directions &lt;em&gt;and&lt;/em&gt; both interfaces, you will be monitoring duplicated flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The decision of where and what direction to monitor becomes a bit more ionvolved when more Router's are involved. Take this simple example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Host X &amp;lt;----&amp;gt; Router A &amp;lt;----&amp;gt; Router B &amp;lt;----&amp;gt; Host Y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A packet going from Host X to Host Y will cross four total interfaces:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ingress Router A's left interface&lt;/li&gt;&#xA;&lt;li&gt;Egress Router A's right interface&lt;/li&gt;&#xA;&lt;li&gt;Ingress Router B's left interface&lt;/li&gt;&#xA;&lt;li&gt;Egress Router B's right interface&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you were capturing at every single one of these points, you would get the same flow data, duplicated four times. Which is obviously not very useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simple solution is to just pick one of these to monitor, but then what of the return traffic? Imagine a packet going from Host Y to Host X, that packet would also cross four possible (what I'll call) Netflow capture points:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ingress Router B's right interface&lt;/li&gt;&#xA;&lt;li&gt;Egress Router B's left interface&lt;/li&gt;&#xA;&lt;li&gt;Ingress Router A's right interface&lt;/li&gt;&#xA;&lt;li&gt;Egress Router A's left interface&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Obviously, capturing on all four of these points would also create 4x duplication of the traffic. So capturing on one of these would be sufficient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common practice is to deploy netflow on the ingress interfaces of all your 'access' routers. Which in the (again, simplistic) example above would mean setting up a capture at these points:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ingress Router A's left interface&lt;/li&gt;&#xA;&lt;li&gt;Ingress Router B's right interface&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This accounts for picking from one of the four netflow capture points to cover the forward traffic (host X to Host Y) as well as the return traffic (Host Y to Host X), without capturing duplicated traffic in the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said most production networks are significantly more complex (and rightfully so!) than what is pictured above. But you can still apply the same concept to determine the best place to set up your Netflow captures with the goal of capturing both forward and return traffic, and not duplicating any packets.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2016-05-04T23:09:25.883" LastActivityDate="2016-05-04T23:09:25.883" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30156" PostTypeId="1" CreationDate="2016-05-05T00:59:08.017" Score="4" ViewCount="682" Body="&lt;p&gt;I cut a cat5e patch cable to put a female end on the cable, but the colors for the male piece are: orange, orange/white, blue, blue/white, green, green/white, brown, brown/white. The patch cable colors are: green, light green, blue, light blue, red, pink, brown, beige. How do I make the Patch cable colors match to the Cat 5e Jack (female end)&lt;/p&gt;&#xA;" OwnerUserId="25134" LastEditorUserId="8499" LastEditDate="2018-03-20T23:27:24.613" LastActivityDate="2018-03-20T23:27:24.613" Title="Patch cable wiring/colors" Tags="|layer1|cabling|cable|utp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30157" PostTypeId="2" ParentId="30156" CreationDate="2016-05-05T01:29:52.723" Score="4" Body="&lt;p&gt;My guess would be&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;green = green&lt;/li&gt;&#xA;&lt;li&gt;light green = white/green&lt;/li&gt;&#xA;&lt;li&gt;blue = blue&lt;/li&gt;&#xA;&lt;li&gt;light blue = white/blue&lt;/li&gt;&#xA;&lt;li&gt;red = orange&lt;/li&gt;&#xA;&lt;li&gt;pink = white/orange&lt;/li&gt;&#xA;&lt;li&gt;brown = brown&lt;/li&gt;&#xA;&lt;li&gt;beige = white/brown&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can often check the colors by looking carefully at the plug where the wires go to the pins. This will also let you check if the plug was wired to 568A or 568B so you don't inadvertantly make a crossover cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I would advise against doing what you propose to do. Patchcords are made of stranded cable and wallport/patchpanel sockets are designed for solid cable. Using the wrong type of cable for the connector leads to unreliable connections. If you must have a plug on one end and a socket on the other I would suggest making up the whole assembly yourself using solid core cable and make sure that the plug is designed for solid core cable. You can get plugs for both types, again using the wrong type of plug will lead to unreliable terminations. If the vendor won't say what type of cable the plug is for don't buy.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-05T01:29:52.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30158" PostTypeId="1" CreationDate="2016-05-05T01:34:42.787" Score="1" ViewCount="84" Body="&lt;p&gt;To identify the network and the host portions of an IPv4 address, the subnet mask is compared to the IPv4 address bit by bit from left to right. What is the purpose of the host portion of an IPv4 address?  &lt;/p&gt;&#xA;" OwnerUserId="23949" LastEditorUserId="8499" LastEditDate="2018-03-11T01:47:10.570" LastActivityDate="2018-03-11T01:47:10.570" Title="IPv4 Addressing" Tags="|ipv4|ip|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30159" PostTypeId="2" ParentId="30158" CreationDate="2016-05-05T01:38:18.207" Score="2" Body="&lt;p&gt;The host portion of an IP address is what distinguishes the host addresses on a network from each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network portion tells a host if the IP address is on the same (directly to the host) or a different (to the configured gateway) network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, the answer to your question applies equally well to IPv6 also, but in IPv6, it is normally easier since the network and host portions will usually be 64 bits each (there are a few exceptions).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-05T01:55:36.303" LastActivityDate="2016-05-05T01:55:36.303" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30160" PostTypeId="2" ParentId="30158" CreationDate="2016-05-05T01:39:30.967" Score="3" Body="&lt;p&gt;The host identifies the specific host on the subnet.  To use an analogy, the network address is the name of your street.  The host address is the house number.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-05T01:39:30.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30162" PostTypeId="2" ParentId="29909" CreationDate="2016-05-05T03:29:51.593" Score="1" Body="&lt;p&gt;I ran into a similar issue with a 5412. It worked for us after making sure the switch's default gateway (where you set the switch's IP in the VLAN Mgmt section) was set to the firewall's IP on the management VLAN.&lt;/p&gt;&#xA;" OwnerUserId="25137" LastActivityDate="2016-05-05T03:29:51.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30173" PostTypeId="1" AcceptedAnswerId="38294" CreationDate="2016-05-05T08:57:30.060" Score="0" ViewCount="151" Body="&lt;p&gt;I have a D-Link switch stack, can not figure out how to fore needed switch to became a master using &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;config stacking force_master_role &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I simply do not get what will this command to and the D-Link's documentation is not helpful, so I wonder if there is a way to access stack member units separately and fire this command to see if the switch becoming the master.&lt;/p&gt;&#xA;" OwnerUserId="19133" LastActivityDate="2017-01-23T03:24:13.553" Title="Accessing D-Link stack members separately" Tags="|stacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30179" PostTypeId="1" AcceptedAnswerId="30239" CreationDate="2016-05-05T14:23:38.953" Score="3" ViewCount="4533" Body="&lt;p&gt;I am fairly new to the ASA world. Basically I have exhausted all my search options, and turning to experts here for help. I have an ASA 5506-X with 4 interfaces. ASA is running OS 9.4(2) and I am using ASDM to configure everything. ASDM is version 7.6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface 1: Outside Network 1 Verizon&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface 2: Inside Network &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface 3: Outside Network Comcast&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface 4: DMZ 192.168.1.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two outside networks, in case one goes down, it fails over to the second one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from these interfaces, ASA is also used for VPN connectivity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Problem: &#xA;I have an Skype for Business Edge Server that I would like people to access from outside. The server is connected to the DMZ and has 3 Private IPs Nated to Public IPs. I have created the NAT rules and the server is connected to the internet (meaning i can go on the server and surf the web). I can't for some reason ping the server or connect to it from outside using any of the 3 public IPs. I have opened the necessary ports using ACL, but still no luck. Any idea on how I could get this up and running? I really appreciate any help with this. Like I said, I have researched this a lot and I couldn't find any solutions. I apologize if this question has already been asked.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Config below: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Result of the command: &quot;show running-config&quot;&#xA;: Saved&#xA;: Serial Number: XXXXXXXXX&#xA;: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)&#xA;ASA Version 9.4(2) &#xA;!&#xA;hostname ASA-5506-ASA&#xA;domain-name xxxx&#xA;enable password xxxxx encrypted&#xA;names&#xA;ip local pool VPN_Pool 172.xx.xx.1-172.xx.xx.254 mask 255.255.255.0&#xA;!&#xA;interface GigabitEthernet1/1&#xA; description Verizon&#xA; nameif outside&#xA; security-level 0&#xA; ip address 207.xx.xx.xx 255.255.255.224 &#xA;!&#xA;interface GigabitEthernet1/2&#xA; nameif inside&#xA; security-level 100&#xA; ip address 172.xx.xx.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet1/3&#xA; nameif COMCAST&#xA; security-level 0&#xA; ip address 23.xx.xx.xx 255.255.255.248 &#xA;!&#xA;interface GigabitEthernet1/4&#xA; description DMZ Interface&#xA; nameif DMZ&#xA; security-level 50&#xA; ip address 192.168.1.254 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet1/5&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/6&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/7&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1/8&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management1/1&#xA; management-only&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;boot system disk0:/asa942-lfbff-k8.SPA&#xA;ftp mode passive&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring&#xA;dns domain-lookup inside&#xA;dns domain-lookup COMCAST&#xA;dns domain-lookup DMZ&#xA;dns server-group DefaultDNS&#xA; name-server 172.xx.xx.x6&#xA; domain-name xxxxx&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network obj_any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network NETWORK_OBJ_172.xx.xx.0_24&#xA; subnet 172.xx.xx.0 255.255.255.0&#xA;object network CUCM-6970&#xA; host 172.xx.xx.10&#xA;object network CUCM-69&#xA; host 172.xx.xx.10&#xA;object service RDP&#xA; service tcp source eq 3389 destination eq 3389 &#xA; description Remote Desktop&#xA;object service RDP_UDP&#xA; service udp source eq 3389 destination eq 3389 &#xA; description Remote Desktop UDP&#xA;object network RDP-Access&#xA; host 17x.xx.xx.xx&#xA; description RDP Access&#xA;object network Public_Pool&#xA; range 23.xx.xx.xx 23.xx.xx.xx&#xA;object network DMZ-Subnet&#xA; subnet 192.168.1.0 255.255.255.0&#xA;object network DMZ-Edge-Access-EXT&#xA; host 23.xx.xx.xx&#xA;object network DMZ-Edge-Access-INT&#xA; host 192.168.1.xx&#xA;object network DMZ-Edge-Web-Conf-EXT&#xA; host 23.xx.xx.xx&#xA;object network DMZ-Edge-Web-Conf-INT&#xA; host 192.168.1.xx&#xA;object network DMZ-Edge-Audio-Video-EXT&#xA; host 23.xx.xx.xx&#xA;object network DMZ-Edge-Audio-Video-INT&#xA; host 192.168.1.xx&#xA;object service Access-Edge-Federation&#xA; service tcp source eq 5061 destination eq 5061 &#xA; description Port used for Access Edge Federation&#xA;object service AV-Edge-UDP-3478&#xA; service udp source eq 3478 destination eq 3478 &#xA; description AV-Edge-UDP-3478&#xA;object service DNS&#xA; service tcp source eq domain destination eq domain &#xA; description DNS&#xA;object service DNSU&#xA; service udp source eq domain destination eq domain &#xA; description DNSU&#xA;object-group network DM_INLINE_NETWORK_1&#xA; network-object object CUCM-69&#xA; network-object object CUCM-6970&#xA;object-group service DM_INLINE_SERVICE_1&#xA; service-object tcp destination eq 6970 &#xA; service-object udp destination eq tftp &#xA;object-group service AV-Edge-TCP-50-59 tcp&#xA; description Allowing TCP Ports 50000 to 59999&#xA; port-object range 50000 59999&#xA;object-group service AV-Edge-UDP-50-59 udp&#xA; description Allowed UDP Ports 50000 to 59999&#xA; port-object range 50000 59999&#xA;access-list SplitTunnel standard permit 172.xx.63.0 255.255.255.0 &#xA;access-list SplitTunnel standard permit 172.xx.63.0 255.255.255.0 &#xA;access-list SplitTunnel standard permit 172.xx.60.0 255.255.254.0 &#xA;access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object-group DM_INLINE_NETWORK_1 &#xA;access-list COMCAST_access_in extended permit tcp any object RDP-ACCESS eq 3389 &#xA;access-list DMZ_access_in remark Allowed Port 443 for Access Edge&#xA;access-list DMZ_access_in extended permit tcp any object DMZ-Edge-Access-EXT eq https inactive &#xA;access-list DMZ_access_in remark Allowed port 5061 for access edge federation&#xA;access-list DMZ_access_in extended permit object Access-Edge-Federation any object DMZ-Edge-Access-EXT inactive &#xA;access-list DMZ_access_in remark Allowed TCP 443 for Web Conferencing&#xA;access-list DMZ_access_in extended permit tcp any object DMZ-Edge-Web-Conf-EXT eq https inactive &#xA;access-list DMZ_access_in remark Allowed TCP 443 for Audio/Video access&#xA;access-list DMZ_access_in extended permit tcp any object DMZ-Edge-Audio-Video-EXT eq https inactive &#xA;access-list DMZ_access_in remark Allowed UDP 3478 for Audio/Video&#xA;access-list DMZ_access_in extended permit object AV-Edge-UDP-3478 any object DMZ-Edge-Audio-Video-EXT inactive &#xA;access-list DMZ_access_in remark Allowed TCP Ports 50000 to 59999&#xA;access-list DMZ_access_in extended permit tcp any object DMZ-Edge-Audio-Video-EXT object-group AV-Edge-TCP-50-59 inactive &#xA;access-list DMZ_access_in remark Allowed UDP Ports 50000 to 59999&#xA;access-list DMZ_access_in extended permit udp any object DMZ-Edge-Audio-Video-EXT object-group AV-Edge-UDP-50-59 inactive &#xA;access-list DMZ_access_in extended permit ip object DMZ-Subnet any &#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;mtu COMCAST 1500&#xA;mtu DMZ 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-761.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (inside,outside) source static any any destination static NETWORK_OBJ_172.xx.63.0_24 NETWORK_OBJ_172.xx.63.0_24 no-proxy-arp route-lookup&#xA;!&#xA;object network CUCM-6970&#xA; nat (inside,outside) static interface service tcp 6970 6970 &#xA;object network CUCM-69&#xA; nat (inside,outside) static interface service udp tftp tftp &#xA;object network RDP-ACCESS&#xA; nat (inside,COMCAST) static interface no-proxy-arp service tcp 3389 3389 &#xA;object network DMZ-Subnet&#xA; nat (DMZ,COMCAST) dynamic interface&#xA;object network DMZ-Edge-Access-INT&#xA; nat (DMZ,COMCAST) static DMZ-Edge-Access-EXT&#xA;object network DMZ-Edge-Web-Conf-INT&#xA; nat (DMZ,COMCAST) static DMZ-Edge-Web-Conf-EXT&#xA;object network DMZ-Edge-Audio-Video-INT&#xA; nat (DMZ,COMCAST) static DMZ-Edge-Web-Conf-EXT&#xA;!&#xA;nat (inside,COMCAST) after-auto source dynamic any interface&#xA;nat (inside,outside) after-auto source dynamic any interface&#xA;access-group outside_access_in in interface outside&#xA;access-group COMCAST_access_in in interface COMCAST&#xA;access-group DMZ_access_in in interface DMZ&#xA;route COMCAST 0.0.0.0 0.0.0.0 23.xx.xx.xx 1&#xA;route outside 0.0.0.0 0.0.0.0 207.xx.xx.xx 50&#xA;route inside 172.xx.60.0 255.255.254.0 172.xx.63.2 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect sqlnet &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect icmp &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;Cryptochecksum:ee5c940e2787f16d3e83ef7eedf943a4&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25154" LastEditorUserId="25154" LastEditDate="2016-05-05T16:00:54.677" LastActivityDate="2016-12-21T05:44:09.527" Title="Configuring DMZ in ASA" Tags="|cisco-asa|nat|acl|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30180" PostTypeId="2" ParentId="26620" CreationDate="2016-05-05T15:04:46.817" Score="0" Body="&lt;p&gt;Appends with the old &lt;em&gt;firmware version&lt;/em&gt; and the &lt;em&gt;updated browser&lt;/em&gt;... you can:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Update SonicWALL firmware (preferred)&lt;/li&gt;&#xA;&lt;li&gt;change browser (ex Firefox) that can use older SSL version&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25157" LastActivityDate="2016-05-05T15:04:46.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30181" PostTypeId="2" ParentId="26620" CreationDate="2016-05-05T15:40:20.873" Score="1" Body="&lt;p&gt;You can change encryption settings on the Sonicwall.  If the device's IP is 192.168.0.1, log in with &lt;a href=&quot;https://192.168.0.1/diag.html&quot; rel=&quot;nofollow&quot;&gt;https://192.168.0.1/diag.html&lt;/a&gt; to get to the Diagnostic page.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Click &lt;em&gt;Internal Settings&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;Deselect &lt;em&gt;Enable RC4-Only Cipher Support&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-05-05T15:40:20.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30183" PostTypeId="1" AcceptedAnswerId="30185" CreationDate="2016-05-05T17:44:58.787" Score="3" ViewCount="448" Body="&lt;p&gt;I would like a switch to let my server know of link status. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does a trap/inform go out one or many ports?&lt;/li&gt;&#xA;&lt;li&gt;What if the link sending the trap/inform goes down, how do I retrieve traps/informs?&lt;/li&gt;&#xA;&lt;li&gt;Is this switch dependent, (e.g. dedicated management port or not)?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2016-05-05T17:53:17.967" Title="What physical port does a SNMP trap/inform go out on?" Tags="|switch|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30184" PostTypeId="1" AcceptedAnswerId="30186" CreationDate="2016-05-05T17:46:24.500" Score="1" ViewCount="3347" Body="&lt;p&gt;The IP address provided by my ISP changes. I want to know if it is shared by someone else in this world.&lt;/p&gt;&#xA;" OwnerUserId="25160" LastEditorUserId="8499" LastEditDate="2019-01-12T21:02:28.877" LastActivityDate="2019-01-12T21:02:28.877" Title="Is my dynamic IP address provided by my ISP shared?" Tags="|ip|ipv4|nat|ip-address|isp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30185" PostTypeId="2" ParentId="30183" CreationDate="2016-05-05T17:53:17.967" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;Just like any host, if the server is on the same network as the&#xA;switch management interface, it gets switched to the correct port&#xA;based on the MAC address of the destination, otherwise it gets sent&#xA;to the configured gateway for the switch from the port which&#xA;connects to the gateway, based on the gateway MAC address.&lt;/li&gt;&#xA;&lt;li&gt;Just like any host, if the path to the destination is broken&#xA;anywhere, the traps/informs don't reach the destination, and you&#xA;don't get them.&lt;/li&gt;&#xA;&lt;li&gt;Since a switch is a layer-2 device, and it is sending a layer-3&#xA;packet for SNMP, it needs to come from the layer-3 interface&#xA;(usually a logical, management interface).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-05T17:53:17.967" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30186" PostTypeId="2" ParentId="30184" CreationDate="2016-05-05T17:59:46.500" Score="3" Body="&lt;p&gt;If the ISP is using CGN (Carrier-Grade NAT), it is possible that the IP address assigned to you by the ISP is the same address as the ISP assigns to someone else in it's network, and another ISP could use the same address in it network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the ISP is assigning you a publicly routable address, it is unlikely, but not impossible, that it is reusing that address elsewhere, but it would need to be using CGN with publicly routable addresses in that case, and that is very unlikely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CGN is for conservation of publicly routable addresses, and the ISP can use non-routable addresses for that, conserving any public addresses it owns for those willing to pay for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of note is the fact that the RIRs have run out of publicly routable IPv4 addresses to assign to the ISPs, which are now implementing CGN in order to conserve their existing publicly routable addresses for those willing to pay extra for that privilege. This is causing problems for the ISP customers because that breaks things since the ISP will not forward ports across the NAT the way in which the customers have been doing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-05T18:30:54.527" LastActivityDate="2016-05-05T18:30:54.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30187" PostTypeId="1" AcceptedAnswerId="30188" CreationDate="2016-05-05T18:26:45.090" Score="4" ViewCount="488" Body="&lt;p&gt;This question is in regards to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t4/htcpp.html&quot; rel=&quot;noreferrer&quot;&gt;Control Plane Protection&lt;/a&gt;, or &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t4/htcpp.html&quot; rel=&quot;noreferrer&quot;&gt;CPPr&lt;/a&gt; -- not to be confused with &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/cpp.html&quot; rel=&quot;noreferrer&quot;&gt;Control Plane Policing&lt;/a&gt; (&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/cpp.html&quot; rel=&quot;noreferrer&quot;&gt;CoPP&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;p&gt;The major difference between CoPP and CPPr is that CPPr allows for more granular restricting of control plane traffic by separating the control plane traffic into three categories(also called &lt;em&gt;Sub-Interfaces&lt;/em&gt;):&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Control Plane &lt;strong&gt;Host&lt;/strong&gt; sub-interface&lt;/li&gt;&#xA;&lt;li&gt;Control Plane &lt;strong&gt;Transit&lt;/strong&gt; sub-interface&lt;/li&gt;&#xA;&lt;li&gt;Control Plane &lt;strong&gt;CEF-Exception&lt;/strong&gt; sub-interface&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The first and third are &lt;a href=&quot;http://www.cisco.com/c/en/us/about/security-center/understanding-cppr.html#2&quot; rel=&quot;noreferrer&quot;&gt;defined by Cisco&lt;/a&gt; as follows:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Control plane host subinterface&lt;/strong&gt;: This interface receives all control plane IP traffic that is directly destined for one of the router interfaces (physical and loopback). Examples of control plane host IP traffic include tunnel termination traffic; management traffic; and routing protocols such as SSH, SNMP, internal BGP (iBGP), and EIGRP&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Control plane CEF-exception subinterface&lt;/strong&gt;: This control plane subinterface receives all traffic that is either redirected as a result of a configured input feature in the CEF packet forwarding path for process switching or directly enqueued in the control plane input queue by the interface driver (that is, ARP, external BGP (eBGP), OSPF, LDP, Layer 2 keepalives, and all non-IP host traffic). Control Plane Protection allows specific aggregate policing of this type of control plane traffic.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;My question:&lt;/p&gt;&#xA;&lt;p&gt;Why are some routing protocols considered Control Plane Host Subinterface, and others considered Control Plane CEF-Exception subinterface?&lt;/p&gt;&#xA;&lt;p&gt;Namely from the document above: iBGP and EIGRP are Host subinterface, and eBGP and OSPF are CEF-Exception subinterface. Despite iBGP and eBGP both using TCP/179 unicast as their transports.&lt;/p&gt;&#xA;&lt;p&gt;I'm trying to understand the different functions of all three categories/sub-interfaces, and the Routing Protocols being split across two of them confuses me.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-05-05T21:39:56.837" Title="Why are some routing protocols sent to the Host sub-interface and others to the CEF-Exception sub-interface?" Tags="|cisco|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30188" PostTypeId="2" ParentId="30187" CreationDate="2016-05-05T19:16:16.120" Score="3" Body="&lt;p&gt;The description is misleading, and it's something we need to fix/standarize (I'm with Cisco, will reach out to doc guys to fix it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In reality:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Control Plane Host sub-interface - anything that hits control-plane of router, on one of it's interfaces (physical/logical); think: routing protocols, management protocols, etc.&lt;/li&gt;&#xA;&lt;li&gt;Control Plane Transit sub-interface - traffic that's software-switched and is transit to router (like different types of tunnels, depending on IOS/IOS XE version)&lt;/li&gt;&#xA;&lt;li&gt;Control Plane CEF-Exception sub-interface - anything that wasn't caught higher, and &lt;strong&gt;&lt;em&gt;doesn't fit the CEF processing chain&lt;/em&gt;&lt;/strong&gt; (software in software routers, or things like QFP in ASR1k/ISR4k) - here, the misleading part is '&lt;em&gt;directly enqueued in the control plane input queue by the interface driver (that is, ARP, external BGP (eBGP), OSPF, LDP, Layer2 Keepalives, and all non-IP host traffic)&lt;/em&gt;' - in reality, if you have multicast or non-IP traffic, along with QoS policies and/or tuning with BFD (UDP traffic but treated in special way) or SPD (buffering, again special kind of treating of selected, marked traffic) it may end up here, but normally, BGP/OSPF/LDP will hit host subinterface. Also note, that this subinterface will also get traffic with TTL&amp;lt;=1 (which may hit some BGP direct sessions and explains unclear note in the docs), packets that have IP Options set, with bad checksum and so on.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The trouble is, as feature was implemented around 12.4T, it was rewritten at least once to my knowledge for 12.4S (which became 15S), so it may behave differently on different hardware and software mixes. YMMV, so it's best to first configure the policies with some sane defaults and 'permit' actions, and then observe your platforms and network during normal work to build baseline. Then check if everything is understood and apply 'drop' actions to established thresholds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bear in mind 'normal work' should include reconvergence events. This is often missed with CoPP/CPPr and then leads to hard to troubleshoot problems.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="286" LastEditDate="2016-05-05T21:39:56.837" LastActivityDate="2016-05-05T21:39:56.837" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30190" PostTypeId="1" AcceptedAnswerId="30192" CreationDate="2016-05-05T19:32:10.893" Score="2" ViewCount="53" Body="&lt;p&gt;PacketTracer does not support the function of associating views with specific users, therefore I tried another approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to have two different users, one with privilege 15 and one with privilege 0. Privilege 0 user should only be able to use ping function and then logout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set it up accordingly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username user1 privilege 0 secret cisco&#xA;username superuser privilege 15 secret cisco1&#xA;&#xA;privilege exec level 0 ping&#xA;&#xA;line console 0&#xA;login local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However when I login again and &quot;show privilege&quot; both users has level 15 and can perform all of the tasks. This is obviously a big security flaw. Am I missing something simple here? I also tried to adding a password to console 0, all to no avail&lt;/p&gt;&#xA;" OwnerUserId="25125" LastActivityDate="2016-05-05T19:59:09.307" Title="Privilege levels" Tags="|security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30192" PostTypeId="2" ParentId="30190" CreationDate="2016-05-05T19:59:09.307" Score="2" Body="&lt;p&gt;I entered the same configuration, and I got the same results. Then I added another user &quot;user2&quot; with privs 0. But I didn't specify and commands to use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then logged in as user1 and used ping without entering &quot;enable&quot; and the ping went through just fine. But when I logged in as user2, I couldn't use ping. From what I can tell, when a user uses &quot;enable&quot;, it gives them 15 priv. The priv level you set when making that user is the level of privilege they have &lt;em&gt;without&lt;/em&gt; using enable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to enforce these privs on these users, disable their use of the enable command.&lt;/p&gt;&#xA;" OwnerUserId="25108" LastActivityDate="2016-05-05T19:59:09.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30197" PostTypeId="1" AcceptedAnswerId="30203" CreationDate="2016-05-06T00:58:53.237" Score="1" ViewCount="2110" Body="&lt;p&gt;Is it possible to use ping or tracert (Networking tools) to approximate any of the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Propagation delay to ISP&lt;/li&gt;&#xA;&lt;li&gt;Distance to ISP&lt;/li&gt;&#xA;&lt;li&gt;Link bit rate&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="25169" LastActivityDate="2016-05-06T14:30:32.753" Title="Using ping/tracert to get ISP information" Tags="|ping|traceroute|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30202" PostTypeId="2" ParentId="29989" CreationDate="2016-05-06T11:57:45.653" Score="1" Body="&lt;p&gt;I cannot answer the question about the error, however, what solved the problem for me was adding a new NAT rule to translate traffic directed to the WAN port of the Sonicwall and point it to the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this setup, tunnelling PCs can send connect to the VPN and to the local network.&lt;/p&gt;&#xA;" OwnerUserId="24819" LastActivityDate="2016-05-06T11:57:45.653" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30203" PostTypeId="2" ParentId="30197" CreationDate="2016-05-06T14:24:23.253" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I found alot of data missing like the size of udp packets, routers&#xA;  processing/queuing time and transmission speed. Also, are both times a&#xA;  packet take to reach a node and be sent back equal?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First, &lt;code&gt;ping&lt;/code&gt; uses ICMP, not UDP, and you specify the packet size when you run the command, or the OS may have a fixed packet size. It probably defaults to 64 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which OS you are using dictates which type of &lt;code&gt;traceroute&lt;/code&gt; you use (e.g. ICMP, UDP, TCP), and whether or not it uses options, all of which affects the size of the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router queuing and processing time will vary, based on the router model, how it is configured, and how busy the router link is, which may vary by day of the week, time of day, etc. For instance, a shared medium, like a cable modem, may get very busy in the evening when people come home, while a business ISP router is probably busiest during working hours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you mean bandwidth, rather than the transmission rate (which is well known for electrons traveling through copper wire, or light through fiber). The serialization rate (bandwidth) will vary by hop, and it is more important than the actual transmission speed. Also, the layer-2 protocol on each link has an affect. You will have headers for the layer-2 frames, and the size of those vary by the layer-2 protocol used on a link. For instance, ethernet will add 26 to 30 octets for the frame, and it has a 12-octet gap between frames. If a link has a half-duplex medium, you can be delayed because the medium is in use by other hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ICMP is usually low priority traffic which is queued or dropped in favor of &quot;real&quot; traffic. The performance of ICMP really doesn't reflect how real traffic performs, and many ISPs will redirect ICMP traffic in order to disguise their internal networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The path traceroute takes may not reflect anything like the path your other traffic takes. It can even be directed to secondary transit links which your other traffic only takes in the event of a failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The time it takes a packet to reach the other end can be different than the time the return packet takes to reach you, and the time it takes to process the packet at the far end and generate a return packet can vary. For instance, &lt;code&gt;ping&lt;/code&gt; gives your a round-trip time which is cumulative of the time the packets takes each way and the processing time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, using &lt;code&gt;ping&lt;/code&gt; and &lt;code&gt;traceroute&lt;/code&gt; for measurements is crude, fraught with problems, and may not reflect how your other traffic performs. It's even possible that the delay for these in your own network (short physical distance) is greater than the delay from your network perimeter to the ISP perimeter (longer distance).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-06T14:30:32.753" LastActivityDate="2016-05-06T14:30:32.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30204" PostTypeId="1" CreationDate="2016-05-06T14:24:52.703" Score="2" ViewCount="193" Body="&lt;p&gt;I have the following questions: I'm currently managing several 5512-X units running Security Plus License (several different units paired in Active / Standby failover configuration for several server stacks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The units are all running on a 9.1(7) OS vers. Recently we purchased a unit running os. 9.4(6). I was wondering if it would be possible to upgrade the ASA 5512-X units running the 9.1(7) OS vers. to the ASA os vers. 9.4(6) and retaining the functionalities sets enabled under the currently installed Security Plus license (that is, without having to purchase a new &quot;Security Plus&quot; license).&lt;/p&gt;&#xA;" OwnerUserId="16189" LastActivityDate="2016-05-06T20:04:56.767" Title="Cisco ASA Licensing Upgrade Paths" Tags="|cisco-asa|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30205" PostTypeId="1" AcceptedAnswerId="30206" CreationDate="2016-05-06T15:00:22.310" Score="1" ViewCount="78" Body="&lt;p&gt;I wrote a program that does packet communication with a server and something has been in the back of my head for sometimes :&#xA;When I analyze packets with WS I can see in the header first off two MAC addresses. One is my laptop MAC and the other one seems to be my router's MAC (would you please confirm) while I would have assumed that the other MAC would be the server's MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ip versions of the conversation I use is ipv4.&#xA;the source ip is my IP under the network (which I have no problem with) however the destination ip is the server's IP which at first I was fine with, but now that I believe the MAC is my router's I would have assumed the destinaton IP to be my router (but then how would my router know when to send the packet.. so yeah.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have browsed around and I couldn't find what I wanted to discover which is when are the packets edited on the fly, if they are.&#xA;When I received a packet the destination is my laptop's MAC and the sourc is my router's MAC which only makes sense if the packet was modified by my router when he received it, assuming then that the server doesn't even know my laptop's MAC.&#xA;Then I guess that between the server and my router, the packet's IPs are 1/server ip and 2/router ip, but once the packet reaches the router the router's ip is replaced by my laptop's ip under the network, yes ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you could confirm or deny those assumptions and maybe point me to a website which holds these infos I'd be very gratefull.&lt;/p&gt;&#xA;" OwnerUserId="25175" LastEditorUserId="8499" LastEditDate="2016-05-06T15:17:18.357" LastActivityDate="2016-05-06T15:41:22.700" Title="General network comprehension" Tags="|ipv4|mac-address|layer2|layer3|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30206" PostTypeId="2" ParentId="30205" CreationDate="2016-05-06T15:08:23.783" Score="1" Body="&lt;p&gt;You need to understand that a layer-2 frame, which contains the MAC addresses, is only good on the LAN on which it was created. On that LAN, it will not be modified (except that a trunk may add a VLAN tag, for the trunk only).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-3 devices, like routers, strip off the layer-2 frame to get to the layer-3 packet. When the router sends the packet out a new interface, it will create a new frame for the new link. Depending on the layer-2 protocol on the new link, there may or may not be MAC addresses. If it is a protocol which uses MAC addresses, the new frame will have the router's MAC address of that interface for the source address, and the next hop MAC address on that LAN for the destination MAC address. This happens at each hop since the MAC addresses are only valid for the LAN where the MAC address is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your host will encapsulate the packet in a frame with its MAC address as the source address, and the server's MAC address as the destination address only if the server is on the same layer-2 LAN. If a packet is destined for a different layer-3 network, the destination MAC address in the frame is the MAC address of the gateway configured in your host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addresses in a packet don't change unless you have NAT configured somewhere in the path. One of the primary drivers for IP was end-to-end connectivity that NAT breaks. NAT is a kludge to conserve IPv4 addresses until we can get converted to IPv6.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-06T15:41:22.700" LastActivityDate="2016-05-06T15:41:22.700" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30207" PostTypeId="1" CreationDate="2016-05-06T16:36:10.347" Score="2" ViewCount="225" Body="&lt;p&gt;I know that a martian source is a packet that the kernel did not expect it from where it come, and is mostly due to a misconfigured host on a internal network. However, what does it mean when it comes from a external network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get messages like this: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;kernel: [xxx.xxx] martian source foo from bar, on dev ethX&#xA;kernel: [xxx.xxx] ll header: 00:19:d1:a7:e5:d5:04:62:73:6d:a8:c6:08:00&lt;/p&gt;&#xA;&#xA;&lt;p&gt;where:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;foo is my public ip&#xA;bar is the source, which is another public ip&#xA;ethX is my firewall external interface&lt;/p&gt;&#xA;" OwnerUserId="25177" LastEditorUserId="8499" LastEditDate="2020-07-17T00:23:39.417" LastActivityDate="2020-07-17T00:23:39.417" Title="What does a martian source on firewall's external interface mean?" Tags="|ip|firewall|ip-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30208" PostTypeId="2" ParentId="30207" CreationDate="2016-05-06T16:40:07.630" Score="1" Body="&lt;p&gt;A martian IP address is one which is not supposed to be routed on the public Internet. It is related to a bogon IP address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-06T16:40:07.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30210" PostTypeId="1" AcceptedAnswerId="30211" CreationDate="2016-05-06T19:44:36.937" Score="1" ViewCount="1337" Body="&lt;p&gt;I have been trying to guess the syntax but, I can't figure out how to do it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qJEGb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qJEGb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the above diagram, what should be the traceroute command on R1 to force the traffic go via &lt;code&gt;R1-&amp;gt;R2-&amp;gt;R4&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="1647" LastEditorUserId="8499" LastEditDate="2018-12-23T05:54:59.607" LastActivityDate="2018-12-23T05:54:59.607" Title="How do you use strict/lose source tracerouting with Cisco IOS" Tags="|cisco|routing|cisco-commands|packet-tracer|traceroute|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30211" PostTypeId="2" ParentId="30210" CreationDate="2016-05-06T20:01:25.120" Score="2" Body="&lt;p&gt;Based on the comments, you need source routing enabled on the routers. It is disabled by default for security reasons, and the routing options in a packet will be ignored if source routing is disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your host must supply the route options in the path. You can use Cisco's extended traceroute to specify the route options, but it will not work unless you have source routing enabled on all the routers in the desired path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This also forces traffic to be process switched, and this will slow routing. If your desire is to test propagation times, you will find they are slower with source routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have finished testing, you should disable it. Your network design is fairly meaningless if the hosts determine the path which traffic will take, and it is a security problem. You are unlikely to find any businesses or Internet carriers/providers which have this enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the extended traceroute. Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router1#traceroute&#xA;Protocol [ip]: &#xA;Target IP address: 10.11.12.13&#xA;Ingress traceroute [n]: &#xA;Source address: 10.11.1.1&#xA;Numeric display [n]:&#xA;Timeout in seconds [3]: &#xA;Probe count [3]: &#xA;Minimum Time to Live [1]: &#xA;Maximum Time to Live [30]: &#xA;Port Number [33434]: &#xA;Loose, Strict, Record, Timestamp, Verbose[none]: Loose&#xA;Source route: 10.11.2.1 10.11.3.1 10.11.4.1 10.11.5.1 10.11.6.1 10.11.7.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco has documents explaining this command, e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13730-ext-ping-trace.html#ext_troute&quot; rel=&quot;nofollow&quot;&gt;Using the Extended ping and Extended traceroute Commands&lt;/a&gt;. You can search for &lt;code&gt;cisco extended traceroute&lt;/code&gt; on the Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-06T22:59:21.743" LastActivityDate="2016-05-06T22:59:21.743" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30212" PostTypeId="2" ParentId="30204" CreationDate="2016-05-06T20:04:56.767" Score="2" Body="&lt;p&gt;I am unaware of any licensing entitlement changes between 9.1 and 9.4. In general, whatever features were licensed in one version will still be available in later versions. (i.e. you don't need a new activation code)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moving to a newer release without SmartNet (or Cisco TAC explicitly providing the image) would be a violation of numerous licensing conditions.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-06T20:04:56.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30215" PostTypeId="1" CreationDate="2016-05-06T23:31:31.850" Score="1" ViewCount="1420" Body="&lt;p&gt;In the following scenario, is it possible to prioritize VOIP/RTP from x.x.x.51 through the gateway with a Cisco switch, and how? I need to prevent x.x.x.50 from saturating the WAN connection.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                    Public Internet&#xA;                         |&#xA;                         |&#xA;                  Gateway/Edge Router&#xA;                      x.x.x.49&#xA;           (WAN/10Mbps symmetrical connection to ISP)&#xA;                         |&#xA;                         |&#xA;                    Switch port 1&#xA;_________________________________________________________&#xA;Switch port 2                               Switch port 3&#xA;  |                                           |&#xA;  |                                           |&#xA;x.x.x.50                                   x.x.x.51&#xA;Firewall/NAT                               Firewall/NAT&#xA;  |                                           |&#xA;  |                                           |&#xA;LAN/Desktops                               LAN/Phone System  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do I need to tell the switch to limit the speed of port 1 to the 10/10Mbps of the gateway/WAN?&lt;/p&gt;&#xA;" OwnerUserId="22103" LastActivityDate="2016-06-05T23:58:56.497" Title="How to use a layer 3 switch for QOS between gateway and hosts?" Tags="|switch|cisco-ios|qos|voip|layer3|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30216" PostTypeId="2" ParentId="30215" CreationDate="2016-05-06T23:49:15.393" Score="1" Body="&lt;p&gt;QoS is all about fairness, as you define it. There are multiple parts to QoS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is layer-2 QoS, which uses 802.1P to set the COS bits in layer-2 headers for layer-2 domains. Cisco switches have full COS marking, but limited layer-2 queuing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is layer-3 QoS, which uses the TOS bits in IP packets. Cisco routers have pretty extensive layer-3 queuing capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also have things related to queuing, e.g. shaping and policing. You will need to decide on policies for these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First you need to classify the traffic. Basically marking the packets with separate TOS/DSCP marking for the different traffic types. This is best done as close to the traffic source as possible, and Cisco switches can do this as traffic enters the switch from the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have classified and marked the traffic, you can apply your fairness doctrine. In your case, it sounds like you want a priority queue on the WAN interface for the VoIP traffic. You will need to decide which percentage of the bandwidth to dedicate to VoIP, and configure your queuing accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understand that your QoS markings and policies will not be honored on the Internet, and that you have no real control over incoming traffic, since by the time you see the incoming traffic, the bandwidth has already been used. Since VoIP is a two-way conversation, you can have perfect QoS on your network, but still get crappy VoIP calls because there is no QoS on the Internet, and your incoming WAN link can be saturated, and your QoS policies have no real effect on that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;QoS is a really huge subject, too large for this site. You would need to provide a lot of information about your devices and their configurations, and make some decisions about a lot of things. There is no real way to say, &quot;this&quot; is the answer to how you should accomplish what you want.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-06T23:54:34.577" LastActivityDate="2016-05-06T23:54:34.577" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30217" PostTypeId="1" AcceptedAnswerId="30286" CreationDate="2016-05-07T00:24:41.083" Score="2" ViewCount="1081" Body="&lt;p&gt;I have a Cisco Aironet 1142 (AIR-LAP1142N-A-K9) running autonomous firmware (c1140-k9w7-mx.153-3.JBB1) which started frequently rebooting it self today due to watchdog timeouts. I've checked &lt;code&gt;sh proc cpu history&lt;/code&gt; and it shows that the CPU is stuck at 100% usage since it last rebooted which could explain the watchdog timeouts. But if I check &lt;code&gt;sh proc cpu&lt;/code&gt; none of the processes have any CPU usage for 5 seconds or the 5 minutes counters which is perplexing to me. The CPU will remain stuck at 100% with the Ethernet cable unplugged and a single client associated to the access point. How can I go about determining the root cause of this issue, and what exactly is causing this high CPU utilization?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sh ver&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco IOS Software, C1140 Software (C1140-K9W7-M), Version &#xA;&#xA;15.3(3)JBB1, RELEASE SOFTWARE (fc2)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2015 by Cisco Systems, Inc.&#xA;Compiled Thu 23-Jul-15 10:50 by prod_rel_team&#xA;&#xA;ROM: Bootstrap program is C1140 boot loader&#xA;BOOTLDR: C1140 Boot Loader (C1140-BOOT-M) Version 12.4(18a)JA, RELEASE SOFTWARE (fc4)&#xA;&#xA;ap1 uptime is 42 minutes&#xA;System returned to ROM by watchdog timer expired&#xA;System image file is &quot;flash:/c1140-k9w7-mx.153-3.JBB1/c1140-k9w7-xx.153-3.JBB1&quot;&#xA;Last reload reason: &#xA;&#xA;&#xA;&#xA;This product contains cryptographic features and is subject to United&#xA;States and local country laws governing import, export, transfer and&#xA;use. Delivery of Cisco cryptographic products does not imply&#xA;third-party authority to import, export, distribute or use encryption.&#xA;Importers, exporters, distributors and users are responsible for&#xA;compliance with U.S. and local country laws. By using this product you&#xA;agree to comply with applicable laws and regulations. If you are unable&#xA;to comply with U.S. and local laws, return this product immediately.&#xA;&#xA;A summary of U.S. laws governing Cisco cryptographic products may be found at:&#xA;http://www.cisco.com/wwl/export/crypto/tool/stqrg.html&#xA;&#xA;If you require further assistance please contact us by sending email to&#xA;export@cisco.com.&#xA;&#xA;cisco AIR-AP1142N-A-K9 (PowerPC405ex) processor (revision B0) with 98294K/32768K bytes of memory.&#xA;Processor board ID FTX1318S0HK&#xA;PowerPC405ex CPU at 586Mhz, revision number 0x147E&#xA;Last reset from watchdog timer expired&#xA;1 Gigabit Ethernet interface&#xA;2 802.11 Radios&#xA;&#xA;32K bytes of flash-simulated non-volatile configuration memory.&#xA;Base ethernet MAC Address: 00:22:90:91:57:C6&#xA;Part Number                          : 73-11451-05&#xA;PCA Assembly Number                  : 800-30554-02&#xA;PCA Revision Number                  : B0&#xA;PCB Serial Number                    : FOC13160ZW1&#xA;Top Assembly Part Number             : 800-31273-01&#xA;Top Assembly Serial Number           : FTX1318S0HK&#xA;Top Revision Number                  : A0&#xA;Product/Model Number                 : AIR-LAP1142N-A-K9   &#xA;&#xA;&#xA;&#xA;Configuration register is 0xF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sh proc cpu history&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ap1   02:27:11 AM Monday Mar 1 1993 UTC&#xA;&#xA;&#xA;&#xA;      111111111111111111111111111111111111111111111111111111111111&#xA;      000000000000000000000000000000000000000000000000000000000000&#xA;      000000000000000000000000000000000000000000000000000000000000&#xA;  100 ************************************************************&#xA;   90 ************************************************************&#xA;   80 ************************************************************&#xA;   70 ************************************************************&#xA;   60 ************************************************************&#xA;   50 ************************************************************&#xA;   40 ************************************************************&#xA;   30 ************************************************************&#xA;   20 ************************************************************&#xA;   10 ************************************************************&#xA;     0....5....1....1....2....2....3....3....4....4....5....5....6&#xA;               0    5    0    5    0    5    0    5    0    5    0&#xA;               CPU% per second (last 60 seconds)&#xA;&#xA;&#xA;&#xA;      1111111111111111111111111111111111111111                    &#xA;      0000000000000000000000000000000000000000                    &#xA;      0000000000000000000000000000000000000000                    &#xA;  100 ########################################                    &#xA;   90 ########################################                    &#xA;   80 ########################################                    &#xA;   70 ########################################                    &#xA;   60 ########################################                    &#xA;   50 ########################################                    &#xA;   40 ########################################                    &#xA;   30 ########################################                    &#xA;   20 ########################################                    &#xA;   10 ########################################                    &#xA;     0....5....1....1....2....2....3....3....4....4....5....5....6&#xA;               0    5    0    5    0    5    0    5    0    5    0&#xA;               CPU% per minute (last 60 minutes)&#xA;              * = maximum CPU%   # = average CPU%&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;  100                                                                         &#xA;   90                                                                         &#xA;   80                                                                         &#xA;   70                                                                         &#xA;   60                                                                         &#xA;   50                                                                         &#xA;   40                                                                         &#xA;   30                                                                         &#xA;   20                                                                         &#xA;   10                                                                         &#xA;     0....5....1....1....2....2....3....3....4....4....5....5....6....6....7..&#xA;               0    5    0    5    0    5    0    5    0    5    0    5    0  &#xA;                   CPU% per hour (last 72 hours)&#xA;                  * = maximum CPU%   # = average CPU%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sh proc cpu sorted 5sec&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CPU utilization for five seconds: 100%/0%; one minute: 100%; five minutes: 100%&#xA; PID Runtime(ms)     Invoked      uSecs   5Sec   1Min   5Min TTY Process &#xA;   1           3          28        107  0.00%  0.00%  0.00%   0 Chunk Manager    &#xA;   2           0         490          0  0.00%  0.00%  0.00%   0 Load Meter       &#xA;   3        1994        1716       1162  0.00%  0.00%  0.00%   0 Exec             &#xA;   4           0           1          0  0.00%  0.00%  0.00%   0 RO Notify Timers &#xA;   5        1650         330       5000  0.00%  0.00%  0.00%   0 Check heaps      &#xA;   6           0           1          0  0.00%  0.00%  0.00%   0 Pool Manager     &#xA;   7           0           1          0  0.00%  0.00%  0.00%   0 DiscardQ Backgro &#xA;   8           1           2        500  0.00%  0.00%  0.00%   0 Timers           &#xA;   9           0          58          0  0.00%  0.00%  0.00%   0 WATCH_AFS        &#xA;  10           0           1          0  0.00%  0.00%  0.00%   0 AAA_SERVER_DEADT &#xA;  11           0           1          0  0.00%  0.00%  0.00%   0  &#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sh run&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 5750 bytes&#xA;!&#xA;version 15.3&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;service sequence-numbers&#xA;!&#xA;hostname ap1&#xA;!&#xA;!&#xA;logging rate-limit console 9&#xA;enable secret 5 CENSORED&#xA;!&#xA;no aaa new-model&#xA;no ip source-route&#xA;no ip cef&#xA;ip domain name CENSORED&#xA;ip name-server 10.1.5.1&#xA;ip name-server 10.1.5.2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;dot11 syslog&#xA;dot11 vlan-name Guest_Wi-Fi vlan 3&#xA;dot11 vlan-name Intranet vlan 1&#xA;dot11 vlan-name Wi-Fi vlan 2&#xA;!&#xA;dot11 ssid CENSORED&#xA;   vlan 3&#xA;   authentication open &#xA;   authentication key-management wpa version 2&#xA;   wpa-psk ascii 7 CENSORED&#xA;   information-element ssidl&#xA;!&#xA;dot11 ssid CENSORED&#xA;   vlan 2&#xA;   authentication open &#xA;   authentication key-management wpa version 2&#xA;   wpa-psk ascii 7 CENSORED&#xA;   information-element ssidl&#xA;!&#xA;!&#xA;dot11 network-map&#xA;!&#xA;no ipv6 cef&#xA;!&#xA;crypto pki trustpoint TP-self-signed-2425444294&#xA; enrollment selfsigned&#xA; subject-name cn=CENSORED&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-2425444294&#xA;!&#xA;!&#xA;crypto pki certificate chain TP-self-signed-2425444294&#xA; certificate self-signed 01&#xA;    CENSORED&#xA;    quit&#xA;username admin privilege 15 secret 5 CENSORED&#xA;!&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; !&#xA; encryption vlan 2 mode ciphers aes-ccm &#xA; !&#xA; encryption vlan 3 mode ciphers aes-ccm &#xA; !&#xA; ssid CENSORED&#xA; !&#xA; ssid CENSORED&#xA; !&#xA; antenna gain 0&#xA; speed  basic-1.0 basic-2.0 basic-5.5 basic-11.0 basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15.&#xA; station-role root&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.2&#xA; description Wi-Fi&#xA; encapsulation dot1Q 2&#xA; bridge-group 2&#xA; bridge-group 2 subscriber-loop-control&#xA; bridge-group 2 spanning-disabled&#xA; bridge-group 2 block-unknown-source&#xA; no bridge-group 2 source-learning&#xA; no bridge-group 2 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.3&#xA; description Guest_Wi-Fi&#xA; encapsulation dot1Q 3&#xA; bridge-group 3&#xA; bridge-group 3 subscriber-loop-control&#xA; bridge-group 3 spanning-disabled&#xA; bridge-group 3 block-unknown-source&#xA; no bridge-group 3 source-learning&#xA; no bridge-group 3 unicast-flooding&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; !&#xA; encryption vlan 2 mode ciphers aes-ccm &#xA; !&#xA; encryption vlan 3 mode ciphers aes-ccm &#xA; !&#xA; ssid CENSORED&#xA; !&#xA; ssid CENSORED&#xA; !&#xA; antenna gain 0&#xA; peakdetect&#xA; no dfs band block&#xA; speed  basic-6.0 basic-9.0 basic-12.0 basic-18.0 basic-24.0 basic-36.0 basic-48.0 basic-54.0 m0. m1. m2. m3. m4. m5. m6. m7. m8. m9. m10. m11. m12. m13. m14. m15.&#xA; channel width 40-above&#xA; channel 5180&#xA; station-role root&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1.2&#xA; encapsulation dot1Q 2&#xA; bridge-group 2&#xA; bridge-group 2 subscriber-loop-control&#xA; bridge-group 2 spanning-disabled&#xA; bridge-group 2 block-unknown-source&#xA; no bridge-group 2 source-learning&#xA; no bridge-group 2 unicast-flooding&#xA;!&#xA;interface Dot11Radio1.3&#xA; encapsulation dot1Q 3&#xA; bridge-group 3&#xA; bridge-group 3 subscriber-loop-control&#xA; bridge-group 3 spanning-disabled&#xA; bridge-group 3 block-unknown-source&#xA; no bridge-group 3 source-learning&#xA; no bridge-group 3 unicast-flooding&#xA;!&#xA;interface Dot11Radio1.13&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0.1&#xA; description Intranet&#xA; encapsulation dot1Q 1 native&#xA; bridge-group 1&#xA; no bridge-group 1 source-learning&#xA;!&#xA;interface GigabitEthernet0.2&#xA; description Wi-Fi&#xA; encapsulation dot1Q 2&#xA; bridge-group 2&#xA; no bridge-group 2 source-learning&#xA;!&#xA;interface GigabitEthernet0.3&#xA; description Guest_Wi-Fi&#xA; encapsulation dot1Q 3&#xA; bridge-group 3&#xA; no bridge-group 3 source-learning&#xA;!&#xA;interface BVI1&#xA; mac-address 0022.9091.57c6&#xA; ip address 10.1.0.3 255.255.0.0&#xA;!&#xA;ip default-gateway 10.1.0.1&#xA;ip forward-protocol nd&#xA;ip http server&#xA;ip http secure-server&#xA;ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag&#xA;!&#xA;!&#xA;snmp-server community public RO&#xA;snmp-server chassis-id CENSORED&#xA;bridge 1 route ip&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; login local&#xA; transport input ssh&#xA;line vty 5 15&#xA; login local&#xA; transport input ssh&#xA;!&#xA;end      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sh log - After upgrading to JC firmware&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco IOS Software, C1140 Software (C1140-K9W7-M), Version 15.3(3)JC, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2015 by Cisco Systems, Inc.&#xA;Compiled Fri 11-Dec-15 12:56 by prod_rel_team&#xA;000014: *Mar  1 01:51:00.078: %SNMP-5-COLDSTART: SNMP agent on host ap1 is undergoing a cold start&#xA;000015: *Mar  1 01:51:00.112: %SSH-5-ENABLED: SSH 1.99 has been enabled&#xA;000016: *Mar  1 01:51:00.115: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset&#xA;000017: *Mar  1 01:51:00.115: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset&#xA;000018: *Mar  1 01:51:00.122: %CDP_PD-4-POWER_OK: Full power - AC_ADAPTOR inline power source&#xA;000019: *Mar  1 01:51:00.748: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up&#xA;000020: *Mar  1 01:51:01.115: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down&#xA;000021: *Mar  1 01:51:01.115: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down&#xA;000022: *Mar  1 01:51:01.136: %DOT11-6-FREQ_SCAN: Interface Dot11Radio0, Scanning frequencies for 8 seconds&#xA;000023: *Mar  1 01:51:02.168: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up&#xA;000024: *Mar  1 01:51:03.167: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up&#xA;000025: *Mar  1 01:51:10.372: %DOT11-6-FREQ_USED: Interface Dot11Radio0, frequency 2442 selected&#xA;000026: *Mar  1 01:51:10.372: %LINK-6-UPDOWN: Interface Dot11Radio0, changed state to up&#xA;000027: *Mar  1 01:51:11.372: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to up&#xA;000028: *Mar  1 01:51:24.198: %DOT11-6-ASSOC: Interface Dot11Radio1, Station   60f8.1db9.a5ce Associated KEY_MGMT[WPAv2 PSK]&#xA;000029: *Mar  1 01:51:37.173: &#xA;Cmd 0x16 Timeout d1 After 12s&#xA;&#xA;000030: *Mar  1 01:51:42.255: %EVT-4-WRN: Write of flash:/event.r1 done&#xA;000031: *Mar  1 01:51:43.059: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset&#xA;000032: *Mar  1 01:51:44.472: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down&#xA;000033: *Mar  1 01:51:45.310: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up&#xA;000034: *Mar  1 01:51:45.902: %DOT11-4-MAXRETRIES: Packet to client 60f8.1db9.a5ce reached max retries, removing the client&#xA;000035: *Mar  1 01:51:46.311: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up&#xA;000036: *Mar  1 01:51:49.651: %DOT11-6-DISASSOC: Interface Dot11Radio1, Deauthenticating Station 60f8.1db9.a5ce Reason: Sending station has left the BSS &#xA;000037: *Mar  1 01:51:49.667: %DOT11-6-ASSOC: Interface Dot11Radio1, Station   60f8.1db9.a5ce Reassociated KEY_MGMT[WPAv2 PSK]&#xA;000038: *Mar  1 01:52:03.626: %DOT11-6-DISASSOC: Interface Dot11Radio1, Deauthenticating Station 60f8.1db9.a5ce Reason: Sending station has left the BSS &#xA;000039: *Mar  1 01:52:06.311: &#xA;Cmd 0x16 Timeout d1 After 12s&#xA;&#xA;000040: *Mar  1 01:52:06.352: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset&#xA;000041: *Mar  1 01:52:07.766: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down&#xA;000042: *Mar  1 01:52:08.605: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up&#xA;000043: *Mar  1 01:52:09.605: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up&#xA;000044: *Mar  1 01:52:14.435: %DOT11-6-ASSOC: Interface Dot11Radio1, Station   60f8.1db9.a5ce Reassociated KEY_MGMT[WPAv2 PSK]&#xA;000045: *Mar  1 01:52:25.531: %DOT11-6-DISASSOC: Interface Dot11Radio1, Deauthenticating Station 60f8.1db9.a5ce Reason: Sending station has left the BSS &#xA;000046: *Mar  1 01:52:28.608: &#xA;Cmd 0x16 Timeout d1 After 12s&#xA;&#xA;000047: *Mar  1 01:52:28.652: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset&#xA;000048: *Mar  1 01:52:30.067: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to down&#xA;000049: *Mar  1 01:52:30.900: %LINK-6-UPDOWN: Interface Dot11Radio1, changed state to up&#xA;000050: *Mar  1 01:52:31.040: %DOT11-4-MAXRETRIES: Packet to client 60f8.1db9.a5ce reached max retries, removing the client&#xA;000051: *Mar  1 01:52:31.222: %DOT11-4-MAXRETRIES: Packet to client 60f8.1db9.a5ce reached max retries, removing the client&#xA;000052: *Mar  1 01:52:31.388: %DOT11-4-MAXRETRIES: Packet to client 60f8.1db9.a5ce reached max retries, removing the client&#xA;000053: *Mar  1 01:52:31.563: %DOT11-4-MAXRETRIES: Packet to client 60f8.1db9.a5ce reached max retries, removing the client&#xA;000054: *Mar  1 01:52:31.903: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to up&#xA;000055: *Mar  1 01:52:34.986: %DOT11-6-ASSOC: Interface Dot11Radio0, Station   60f8.1db9.a5ce Reassociated KEY_MGMT[WPAv2 PSK]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20347" LastEditorUserId="20347" LastEditDate="2016-05-07T01:51:35.100" LastActivityDate="2016-05-11T06:38:44.113" Title="Cisco Aironet 1142 - CPU stuck at 100% utilization" Tags="|cisco|aironet|cpu|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30220" PostTypeId="1" CreationDate="2016-05-07T13:28:49.867" Score="0" ViewCount="906" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ljN4J.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ljN4J.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I configure Inter AS option A for back-to-back VRF connectivity?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone please provide me with a sample configuration and topology for back to back VRFs ( Inter-AS option A )?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, I am looking how to configure these two ASBRs (R3 and R4) with Inter-As option A in the above topology. The iBGP peering has already been done. The only thing I am left with to start is the eBGP peering.&lt;/p&gt;&#xA;" OwnerUserId="22981" LastEditorUserId="8499" LastEditDate="2016-05-07T20:32:53.133" LastActivityDate="2016-05-07T20:32:53.133" Title="BGP Inter-AS option A" Tags="|cisco|" AnswerCount="1" CommentCount="9" ClosedDate="2019-03-14T01:24:23.657" ContentLicense="CC BY-SA 3.0" />
  <row Id="30225" PostTypeId="2" ParentId="30220" CreationDate="2016-05-07T17:10:06.353" Score="2" Body="&lt;p&gt;This is only a partial config, as I assume you already have BGP running on the PE routers, and the interfaces are in the correct vrf.  Each ASBR treats the other as a CE router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA;address-family ipv4 vrf AS-200&#xA;neighbor a.b.c.d remote-as 200&#xA;neighbor a.b.c.d activate&#xA;exit-address-family&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do the same for AS 200&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-07T17:10:06.353" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30226" PostTypeId="1" AcceptedAnswerId="30410" CreationDate="2016-05-07T17:44:21.153" Score="0" ViewCount="755" Body="&lt;p&gt;The equation for the throughput of Aloha is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;S = Ge&lt;sup&gt;-2G&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which can be thought of as G (the rate of transmission attempts) multiplied by e&lt;sup&gt;-2G&lt;/sup&gt; (the probability of one of those attempts being successful).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I came across this graph and text ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ir0Yh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ir0Yh.png&quot; alt=&quot;Graph of Aloha throughput&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And it made me question if I really understand what the x-axis represents - offered load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is 0.5 transmission attempts per frame time, referred to as 50% of offered load? (Text above graph).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there were ten stations and each station attempted one transmission per frame time, would that be 1000% offered load? If yes, why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think it's more likely that I have missed a beat somewhere and that I'm not really comprehending what is meant by &quot;offered load&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be great.&lt;/p&gt;&#xA;" OwnerUserId="13244" LastEditorUserId="13244" LastEditDate="2016-05-08T10:40:55.267" LastActivityDate="2016-08-12T14:20:34.030" Title="Throughput of Aloha" Tags="|network-access|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30231" PostTypeId="1" CreationDate="2016-05-08T00:06:46.233" Score="0" ViewCount="459" Body="&lt;p&gt;This is a very newb question and probably demonstrates misunderstanding of networking; so please be patient.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using a network managed by someone else; this network appears to have all ports blocked by the router. I can understand that I am able to send a request (such as HTTP) to another computer which &lt;em&gt;does&lt;/em&gt; have an open port on the Internet (such as &lt;code&gt;example.com:80&lt;/code&gt;) but I don't understand how the response reaches my computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server can't reply to me through port 80 or 443 because those aren't open. So I assume the router listens in some way for data, then forwards that to my computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus I have the following questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How does this mechanism work?&lt;/li&gt;&#xA;&lt;li&gt;Can I only receive data once I have requested it? In what way is it tied to the connection I have made?&lt;/li&gt;&#xA;&lt;li&gt;Would it not be possible to keep this &quot;path&quot; open until either server is closed? Meaning that a server/client/whoever can send me data constantly?&lt;/li&gt;&#xA;&lt;li&gt;Is this mechanism used in online gaming? Or is it a TCP-specific feature?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="25204" LastEditorUserId="8499" LastEditDate="2018-02-16T03:54:06.137" LastActivityDate="2018-02-16T03:54:06.137" Title="How does information reach my computer, if I do not have any ports open?" Tags="|ip|tcp|transport-protocol|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30232" PostTypeId="2" ParentId="30231" CreationDate="2016-05-08T01:09:08.947" Score="-1" Body="&lt;p&gt;Mainly, network services running on devices like servers, pc, voip phones, are associated to ports, eg: 80 for http, 443 for https, 21 for ftp, 22 for ssh. Those are well known ports, ther are lower than 1024. The thing is, by security reason, on edge devices, are places some access list to protect internal users, on that, are blocked traffic destinated to ports (mainly well known ports), that can compromise some system. Then , when you request some web page and made a request to some server on 80 port, the request from your machine is generated on sone port upper 1024, that it's not listening for nothing, but your application, on this case, your iexplorer, or mozilla, or chrome, has the possibility to open and send a receive traffic accross then, and once you get what you want, close it. I guess you need to learn and read about osi model and networking, you can begin with Computer Networks, by Tanembaun, it is a GREAT start point for you, and this stuff is easily explained.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-05-08T01:09:08.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30233" PostTypeId="1" CreationDate="2016-05-08T04:24:45.537" Score="1" ViewCount="301" Body="&lt;p&gt;Both ends are using a broadband connection. How do I set up DMVPN with dyndns on both ends; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have dyndns.org account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have any static IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The master router is a 3921, and the other end is a 2911. &lt;/p&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="21915" LastEditDate="2016-05-08T04:44:12.670" LastActivityDate="2016-11-12T06:01:36.393" Title="How do I configure DMVPN for two sites?" Tags="|cisco|routing|vpn|tunnel|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30234" PostTypeId="2" ParentId="30233" CreationDate="2016-05-08T07:21:30.430" Score="1" Body="&lt;p&gt;One of the benefits of DMVPN is that you could create a dynamic full mesh network without having to worry about end-points (static configuration of end-points peers). &#xA;VPN headends (the hubs) must be statically configured on the spokes (this is why you need a static IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;summing: DMVPN let you have to configure the hub ones, drammatically reducing the deployment complexity in VPNs and not need to modify the configuration to accept a new spoke but the head of your VPNs must be static. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;in addition, to better understand the world of DMVPN I suggest to you to read the official CISCO documentation about this topic, which discusses in detail each deployment scenario and the structure itself of DMVPN .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I leave a link if it can be useful to the reader :&#xA;&lt;em&gt;&lt;a href=&quot;http://www.cisco.com/c/dam/en/us/products/collateral/security/dynamic-multipoint-vpn-dmvpn/DMVPN_Overview.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/dam/en/us/products/collateral/security/dynamic-multipoint-vpn-dmvpn/DMVPN_Overview.pdf&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="25080" LastEditorUserId="25080" LastEditDate="2016-05-08T09:26:32.440" LastActivityDate="2016-05-08T09:26:32.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30235" PostTypeId="2" ParentId="30179" CreationDate="2016-05-08T08:24:57.880" Score="1" Body="&lt;p&gt;If you configure NAT for an inside server, that it has a public IP address on the outside interface, then you have to configure an access rule to allow the outside traffic to access the inside server that needs to reference the server’s real IP address, and not the public IP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA(config)# name 192.168.1.X skype_server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA(config)# object network DMZ-Subnet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA(config-network-object)# host skype_server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA(config-network-object)# nat (inside,outside) static &lt;strong&gt;'public_ip'&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA(config)# access-list outside_rule extended permit tcp any host skype_server eq &lt;strong&gt;'ports (if necessary)'&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA(config)# access-group outside_rule in interface outside&lt;/p&gt;&#xA;" OwnerUserId="25080" LastActivityDate="2016-05-08T08:24:57.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30238" PostTypeId="1" CreationDate="2016-05-08T15:34:45.830" Score="1" ViewCount="803" Body="&lt;p&gt;We have installed the firepower management center in our Vmware Exsi in our sfr module 5.3.1. Our ASA is 5515-x version 9.2.2 and ASDM version 7.2.2.&#xA;Management IP of ASA is 192.168.1.1 and the source fire defense center of firepower management center is 192.168.0.9 and we have installed the license for sfr module. But we don't have the url filtering license.&#xA;Both are in different networks. Now, i don't see any connection of defense center with the ASA. How am i going to block traffic or do the url filtering this way?&#xA;My requirements are simple and all i want is the ultimate solution for the url filtering. And we don't have url filtering license. How to filter the traffic?&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="46246" LastEditDate="2018-06-29T03:11:47.170" LastActivityDate="2018-08-28T05:01:08.203" Title="Url filtering using the firesight management center" Tags="|cisco-asa|firewall|cisco-firepower|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30239" PostTypeId="2" ParentId="30179" CreationDate="2016-05-08T17:07:53.190" Score="3" Body="&lt;p&gt;Your access lists for the two outside interfaces do not have the necessary permits.  For example, to permit in ICMP, you'd need a 'permit icmp' entry that would allow pings into the DMZ servers.  For your specific application ports you need to add lines for those as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now your inbound ACLs from the internet just look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;! For your Verizon connection:&#xA;!&#xA;object-group service DM_INLINE_SERVICE_1&#xA; service-object tcp destination eq 6970 &#xA; service-object udp destination eq tftp&#xA;!&#xA;object-group network DM_INLINE_NETWORK_1&#xA; network-object object CUCM-69&#xA; network-object object CUCM-6970&#xA;!&#xA;access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object-group DM_INLINE_NETWORK_1&#xA;!&#xA;!&#xA;! For your Comcast connection:&#xA;!&#xA;object network RDP-Access&#xA; host 17x.xx.xx.xx&#xA; description RDP Access&#xA;!&#xA;access-list COMCAST_access_in extended permit tcp any object RDP-ACCESS eq 3389&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All other traffic not explicitly listed here is being dropped by the Implicit Deny at the end of any ACL on the ASA.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For example to permit ICMP (for IPv4) I usually just let a few ICMP type/codes through to all destinations (in your case, I'll give an example with just those hosts that have static NAT translations).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group service ICMP_ALLOWED&#xA; service-object icmp echo&#xA; service-object icmp echo-reply&#xA; service-object icmp unreachable&#xA; service-object icmp time-exceeded&#xA;&#xA;object-group network OUTSIDE_ACCESSIBLE_HOSTS&#xA; network-object object DMZ-Edge-Access-INT&#xA; network-object object DMZ-Edge-Web-Conf-INT&#xA; network-object object DMZ-Edge-Audio-Video-INT&#xA;&#xA;access-list COMCAST_access_in line 1 extended permit object-group ICMP_ALLOWED any object-group OUTSIDE_ACCESSIBLE_HOSTS&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;(It's also worth noting as well, that if Comcast gave you those public IPs that you're using in the static NAT statements, they won't work out your Verizon connection.)&lt;/p&gt;&#xA;" OwnerUserId="44" LastEditorUserId="44" LastEditDate="2016-05-08T17:15:22.250" LastActivityDate="2016-05-08T17:15:22.250" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30240" PostTypeId="1" AcceptedAnswerId="30255" CreationDate="2016-05-08T17:39:47.210" Score="2" ViewCount="5064" Body="&lt;p&gt;I'm looking for an understanding of how the metrics are structured within EIGRP, this includes the routing table, and also the topology table. I'm sure I'm not the only one that finds the concepts of EIGRP a tad tricky to grasp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My small network has been created and I've enabled an AS of 1 on both connections for an EIGRP neighbouring relationship. This is the output from both the routing table and the topology table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh ip ro ei&#xA;     192.168.1.0/30 is subnetted, 1 subnets&#xA;D    192.168.2.0/24 [90/30720] via 192.168.1.2, 00:09:13, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know that 90 is the administrative distance, but the metric of 30720 seems high going over fast ethernet to only one hop. Could any light be shed on why this is so high in comparison to OSPF for example? I understand that this is probably a simple case of apples and oranges being two separate routing protocols, but I'm interested to know how this is calculated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh ip ei top&#xA;IP-EIGRP Topology Table for AS 1/ID(192.168.1.1)&#xA;&#xA;Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,&#xA;       r - Reply status&#xA;&#xA;P 192.168.0.0/24, 1 successors, FD is 28160&#xA;         via Connected, FastEthernet0/1&#xA;P 192.168.1.0/30, 1 successors, FD is 28160&#xA;         via Connected, FastEthernet0/0&#xA;P 192.168.2.0/24, 1 successors, FD is 30720&#xA;         via 192.168.1.2 (30720/28160), FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see from the above, the calculation is 30720/28160. The second part of this calculation also seems to be the feasible distance of 28160, with the first part being the metric of 30720 from the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone please explain to me the purpose of this calculation? And will this figure change over time? Or is this now set in stone?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="23950" LastEditorUserId="3675" LastEditDate="2016-06-13T20:09:30.273" LastActivityDate="2016-06-13T20:09:30.273" Title="EIGRP metric explanation" Tags="|cisco|routing|eigrp|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30241" PostTypeId="2" ParentId="30240" CreationDate="2016-05-08T17:59:08.740" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Could any light be shed on why this is so high in comparison to OSPF&#xA;  for example?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You simply cannot compare metrics between different routing protocols. That is the reason for the creation of administrative distance.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Could someone please explain to me the purpose of this calculation?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;EIGRP uses a complex calculation to come up with its metric. It involves the bandwidth, delay, reliability, load and MTU of a link, but, by default, it only uses the bandwidth and delay. The calculation can include many things that other routing protocols simply don't include, so you can get a very granular metric on which is the best path.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And will this figure change over time? Or is this now set in stone?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The metric for EIGRP has not changed since IGRP (it is 256 times the IGRP value), so it is unlikely to ever change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has many documents available on EIGRP. For instance, &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/16406-eigrp-toc.html#eigrpmetrics&quot; rel=&quot;nofollow noreferrer&quot;&gt;Enhanced Interior Gateway Routing Protocol&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;EIGRP Metrics&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;EIGRP uses the minimum bandwidth on the path to a destination network&#xA;  and the total delay to compute routing metrics. Although you can&#xA;  configure other metrics, we do not recommend it, as it can cause&#xA;  routing loops in your network. The bandwidth and delay metrics are&#xA;  determined from values configured on the interfaces of routers in the&#xA;  path to the destination network.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For instance, in Figure 2 below, Router One is computing the best path&#xA;  to Network A.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5Y4Yk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5Y4Yk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It starts with the two advertisements for this network: one through&#xA;  Router Four, with a minimum bandwidth of 56 and a total delay of 2200;&#xA;  and the other through Router Three, with a minimum bandwidth of 128&#xA;  and a delay of 1200. Router One chooses the path with the lowest&#xA;  metric.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Let us compute the metrics. EIGRP calculates the total metric by&#xA;  scaling the bandwidth and delay metrics. EIGRP uses the following&#xA;  formula to scale the bandwidth:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;&lt;code&gt;bandwidth = (10000000/bandwidth(i)) * 256&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;where bandwidth(i) is the least bandwidth of all outgoing interfaces on the route to the destination network represented in&#xA;  kilobits.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;EIGRP uses the following formula to scale the delay:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;&lt;code&gt;delay = delay(i) * 256&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;where delay(i) is the sum of the delays configured on the interfaces, on the route to the destination network, in tens of&#xA;  microseconds. The delay as shown in the &lt;strong&gt;show ip eigrp topology&lt;/strong&gt; or&#xA;  &lt;strong&gt;show interface&lt;/strong&gt; commands is in microseconds, so you must divide by 10 before you use it in this formula. Throughout this paper, we use&#xA;  delay as it is configured and shown on the interface.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;EIGRP uses these scaled values to determine the total metric to the&#xA;  network:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;code&gt;metric = ([K1 * bandwidth + (K2 * bandwidth) / (256 - load) + K3 * delay] * [K5 / (reliability + K4)]) * 256&lt;/code&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; These &lt;strong&gt;K&lt;/strong&gt; values should be used after careful planning. Mismatched &lt;strong&gt;K&lt;/strong&gt; values prevent a neighbor relationship from being&#xA;  built, which can cause your network to fail to converge.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; If &lt;code&gt;K5 = 0&lt;/code&gt;, the formula reduces to &lt;code&gt;Metric = ([k1 * bandwidth + (k2 * bandwidth)/(256 - load) + k3 * delay]) * 256&lt;/code&gt;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The default values for K are:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;code&gt;K1 = 1&lt;/code&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;K2 = 0&lt;/code&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;K3 = 1&lt;/code&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;K4 = 0&lt;/code&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;code&gt;K5 = 0&lt;/code&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;For default behavior, you can simplify the formula as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;metric = bandwidth + delay&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Cisco routers do not perform floating point math, so at each stage in&#xA;  the calculation, you need to round down to the nearest integer to&#xA;  properly calculate the metrics. In this example, the total cost&#xA;  through Router Four is:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In this example, the total cost through Router Four is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;minimum bandwidth = 56k &#xA;&#xA;total delay = 100 + 100 + 2000 = 2200 &#xA;&#xA;[(10000000/56) + 2200] x 256 = (178571 + 2200) x 256 = 180771 x 256 = 46277376  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;And the total cost through Router Three is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;minimum bandwidth = 128k &#xA;&#xA;total delay = 100 + 100 + 1000 = 1200 &#xA;&#xA;[(10000000/128) + 1200] x 256 = (78125 + 1200) x 256 = 79325 x 256 = 20307200  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;So to reach Network A, Router One chooses the route through Router&#xA;  Three.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note the bandwidth and delay values we used are those configured on&#xA;  the interface through which the router reaches its next hop to the&#xA;  destination network. For example, Router Two advertised Network A with&#xA;  the delay configured on its Ethernet interface; Router Four added the&#xA;  delay configured on its Ethernet, and Router One added the delay&#xA;  configured on its serial.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your bandwidth is &lt;code&gt;100000K&lt;/code&gt; so the bandwidth the calculation uses is &lt;code&gt;10000000 / 100000 = 100&lt;/code&gt;. The delay is &lt;code&gt;200&lt;/code&gt; microseconds, so the delay the calculation uses is &lt;code&gt;20&lt;/code&gt;. This bring us to &lt;code&gt;120 * 256 = 30720&lt;/code&gt;, and that is the value you report.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plugging your numbers into the example that Cisco has given above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[(10000000/100000) + 20] x 256 = (100 + 20) x 256 = 120 x 256 = 30720&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-08T22:27:26.433" LastActivityDate="2016-05-08T22:27:26.433" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30246" PostTypeId="2" ParentId="29054" CreationDate="2016-05-09T10:35:30.727" Score="0" Body="&lt;p&gt;SFP+ optical transceivers can support 1 GbE operation. They support 1GbE and 10 GbE dual rates and can be configured for 1 GbE&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-05-09T10:35:30.727" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30248" PostTypeId="1" AcceptedAnswerId="30249" CreationDate="2016-05-09T11:13:14.033" Score="1" ViewCount="779" Body="&lt;p&gt;When I move into a new dormitory, the network manager in the network center tells me my IP address, DNS address, gateway address, and stuff. I was told to just plug in my cable, enter these addresses, and then all are fine to go. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And it did work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I am wondering, what is going on when I manually change these address? &lt;strong&gt;Wouldn't there be a chance that two people under the same subnet enter the same IP address and they go into confict?&lt;/strong&gt; How to prevent that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there is a protocol called DHCP, which is set to dynamically assign IP addresses to new devices joining the network. I know DHCP pretty well, but I just can't figure out what's really going on with those manually assigned IP addresses. What protocol is used to handle those possible conflicts? And, more importantly, &lt;strong&gt;how can my device tell the router this new IP address so that the router can forward packets in the right direction?&lt;/strong&gt; &lt;/p&gt;&#xA;" OwnerUserId="25226" LastEditorUserId="8499" LastEditDate="2018-12-11T00:49:29.507" LastActivityDate="2018-12-11T00:49:29.507" Title="What happen underneath when I manually change my IP address?" Tags="|ip|ipv4|subnet|ip-address|network-discovery|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30249" PostTypeId="2" ParentId="30248" CreationDate="2016-05-09T13:15:03.767" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Wouldn't there be a chance that two people under the same subnet enter&#xA;the same IP address and they go into confict? How to prevent them ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Yes, that can, and does, happen when networks have manually configured addressing. That situation leads to unpredictable network behavior. Often, devices with the same address can't communicate on the network. Sometimes, one device works. Some OSes can detect the conflict and report it. There is no real way to prevent this from happening.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;What protocol is used to handle those possible conflict ? And more&#xA;importantly, how can my device tell the router this new IP address so&#xA;that the router can forward packets in a right direction?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Your device doesn't need to tell the router anything. The router knows the networks which are attached to its interfaces. It will ARP to resolve the layer-3 address to a layer-2 address before encapsulating the packets into frames for the network segment.&lt;/p&gt;&#xA;&lt;p&gt;IPv6 has DAD (Duplicate Address Detection) built in. For IPv4, it was not part of the original standard, but there is now &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5227&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5227, IPv4 Address Conflict Detection&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;1. Introduction&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Historically, accidentally configuring two Internet hosts with the&#xA;same IP address has often been an annoying and hard-to-diagnose&#xA;problem.&lt;/p&gt;&#xA;&lt;p&gt;This is unfortunate, because the existing Address Resolution&#xA;Protocol    (ARP) provides an easy way for a host to detect this kind&#xA;of    misconfiguration and report it to the user.  The DHCP&#xA;specification    [RFC2131] briefly mentions the role of ARP in&#xA;detecting    misconfiguration, as illustrated in the following three&#xA;excerpts from    RFC 2131:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;the client SHOULD probe the newly received address, e.g., with ARP&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The client SHOULD perform a final check on the parameters (e.g., ARP    for allocated network address)&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the client detects that the address is already in use (e.g.,    through the use of ARP), the client MUST send a DHCPDECLINE message&lt;br /&gt;&#xA;to the server&lt;/p&gt;&#xA;&lt;p&gt;Unfortunately, the DHCP specification does not give any guidance&#xA;to implementers concerning the number of ARP packets to send, the&#xA;interval between packets, the total time to wait before concluding&#xA;that an address may safely be used, or indeed even which kinds    of&#xA;packets a host should be listening for, in order to make this&#xA;determination.  It leaves unspecified the action a host should    take&#xA;if, after concluding that an address may safely be used, it&#xA;subsequently discovers that it was wrong.  It also fails to specify&#xA;what precautions a DHCP client should take to guard against&#xA;pathological failure cases, such as a DHCP server that repeatedly&#xA;OFFERs the same address, even though it has been DECLINEd multiple&#xA;times.&lt;/p&gt;&#xA;&lt;p&gt;The authors of the DHCP specification may have been justified in&#xA;thinking at the time that the answers to these questions seemed too&#xA;simple, obvious, and straightforward to be worth mentioning, but&#xA;unfortunately this left some of the burden of protocol design to each&#xA;individual implementer.  This document seeks to remedy this omission&#xA;by clearly specifying the required actions for:&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Determining whether use of an address is likely to lead to an&#xA;addressing conflict.  This includes (a) the case where the address&#xA;is already actively in use by another host on the same link, and (b)&#xA;the case where two hosts are inadvertently about to begin using the&#xA;same address, and both are simultaneously in the process of probing&#xA;to determine whether the address may safely be used (Section 2.1.).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Subsequent passive detection that another host on the network is&#xA;inadvertently using the same address.  Even if all hosts observe&#xA;precautions to avoid using an address that is already in use,&#xA;conflicts can still occur if two hosts are out of communication&#xA;at the time of initial interface configuration.  This could occur&#xA;with wireless network interfaces if the hosts are temporarily out&#xA;of range, or with Ethernet interfaces if the link between two&#xA;Ethernet hubs is not functioning at the time of address&#xA;configuration.  A well-designed host will handle not only&#xA;conflicts detected during interface configuration, but also&#xA;conflicts detected later, for the entire duration of the time&#xA;that the host is using the address (Section 2.4.).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Rate-limiting of address acquisition attempts in the case of&#xA;an excessive number of repeated conflicts (Section 2.1.).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The utility of IPv4 Address Conflict Detection (ACD) is not limited&#xA;to DHCP clients.  No matter how an address was configured, whether&#xA;via manual entry by a human user, via information received from a&#xA;DHCP server, or via any other source of configuration information,&#xA;detecting conflicts is useful.  Upon detecting a conflict, the&#xA;configuring agent should be notified of the error.  In the case where&#xA;the configuring agent is a human user, that notification may take the&#xA;form of an error message on a screen, a Simple Network Management&#xA;Protocol (SNMP) notification, or an error message sent via text&#xA;message to a mobile phone.  In the case of a DHCP server, that&#xA;notification takes the form of a DHCP DECLINE message sent to the&#xA;server.  In the case of configuration by some other kind of software,&#xA;that notification takes the form of an error indication to the&#xA;software in question, to inform it that the address it selected is&#xA;in conflict with some other host on the network.  The configuring&#xA;software may choose to cease network operation, or it may&#xA;automatically select a new address so that the host may re-establish&#xA;IP connectivity as soon as possible.&lt;/p&gt;&#xA;&lt;p&gt;Allocation of IPv4 Link-Local Addresses [RFC3927] can be thought of&#xA;as a special case of this mechanism, where the configuring agent is&#xA;a pseudo-random number generator, and the action it takes upon being&#xA;notified of a conflict is to pick a different random number and try&#xA;again.  In fact, this is exactly how IPv4 Link-Local Addressing was&#xA;implemented in Mac OS 9 back in 1998.  If the DHCP client failed to&#xA;get a response from any DHCP server, it would simply make up a fake&#xA;response containing a random 169.254.x.x address.  If the ARP module&#xA;reported a conflict for that address, then the DHCP client would try&#xA;again, making up a new random 169.254.x.x address as many times as&#xA;was necessary until it succeeded.  Implementing ACD as a standard&#xA;feature of the networking stack has the side effect that it means&#xA;that half the work for IPv4 Link-Local Addressing is already done.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-05-09T13:15:03.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30250" PostTypeId="1" AcceptedAnswerId="30251" CreationDate="2016-05-09T14:07:25.637" Score="4" ViewCount="829" Body="&lt;p&gt;From what I understand about IPv6 networks, since NAT was a hack to deal with a lack of IP addresses in IPv4, NAT is a possibility, but not a requirement in an IPv6 LAN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So taking this into account, how does the physical / logical diagram of a basic LAN change when using IPv6 without NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there still a gateway router / firewall?  Does every machine on my network require a public IP address?  Can I still use a single firewall to protect all the machines behind it?  What do the physical / logical diagrams look like?&lt;/p&gt;&#xA;" OwnerUserId="16753" LastEditorUserId="8499" LastEditDate="2018-12-21T22:23:59.777" LastActivityDate="2018-12-21T22:23:59.777" Title="Network Diagram for IPv6 LAN" Tags="|ip|nat|ipv6|lan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30251" PostTypeId="2" ParentId="30250" CreationDate="2016-05-09T14:18:07.413" Score="4" Body="&lt;p&gt;There is no real difference in IPv4 or IPv6 network diagrams. The network devices are the same things (routers, switches, firewalls, etc.), and the diagrams look the same, other than the addressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers route between networks, and IPv6 still uses networks. Firewalls are still used to protect networks. Switches are still used to connect hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since IPv6 has plenty of address space, there is no need to NAT. NAT breaks the original IP premise of end-to-end connectivity, where every device has a unique IP address. IPv6 doesn't have a NAT standard, and NAT breaks things in IPv6. NAT was developed as a short-term solution to the IPv4 address shortage, and it is expected to go away once IPv6 is ubiquitous.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-09T14:18:07.413" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30255" PostTypeId="2" ParentId="30240" CreationDate="2016-05-09T17:04:55.517" Score="5" Body="&lt;H2&gt;EIGRP Metric Formula&lt;/H2&gt;&#xA;&lt;p&gt;The EIGRP Metric is a combination of a measure of the entire path's cumulative delay, and the minimum bandwidth across the entire path. The delay value is value assigned to each 'hop' based upon that interface's speed.&lt;/p&gt;&#xA;&lt;p&gt;The metric &lt;em&gt;can&lt;/em&gt; also include factoring the interface's load and reliability, but this is often left disabled.&lt;/p&gt;&#xA;&lt;p&gt;This is all controlled by what is known as &amp;quot;K values&amp;quot;, each &amp;quot;k value&amp;quot; controls weather each of the following are considered in the EIGRP metric calculation.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;     K1 = Bandwidth  &#xA;     K2 = Load       &#xA;     K3 = Delay      &#xA;K4 &amp;amp; K5 = Reliability&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;By default, the K1 and K3 values are set to 1, and the K2/K4/K5 values are set to 0. These values can then be plugged into the full (rather complicated) EIGRP composite metric calculation:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;256 * { K1*BW + [(K2*BW)/(256-load)] + (K3*delay) } * { K5/(reliability+K4) }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If you re-write it with different spacing and add pretty colors and apply the default K Values, you can see how it gets simplified to just Delay and Bandwidth:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9XOFf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9XOFf.png&quot; alt=&quot;EIGRP Default Metric calculation&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Which means the simplified formula, with just the default K values applied ends up being this:&lt;/p&gt;&#xA;&lt;H3&gt;&lt;code&gt;**256 * (Bandwidth + Delay)**&lt;/code&gt;&lt;/H3&gt;&#xA;&lt;H2&gt;Values for Bandwidth and Delays&lt;/H2&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/eigrp-metric/#bandwidth&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bandwidth&lt;/a&gt;&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The Bandwidth value is based upon the minimum bandwidth link across the &lt;em&gt;entire path&lt;/em&gt;. But because metric values in any routing protocol consider a lower value to be superior, a formula has to be used to convert a higher bandwidth to a lower resulting metrics. That formula is as follows:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;code&gt;Bandwidth = 10^7 / BW in Kbps&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So a path with a minimum bandwidth of 100 Mbps link, would equate to 100,000 Kbps, and it's calculation would look like:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Bandwidth value = 10,000,000 / 100,000 = 100 Delay&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/eigrp-metric/#delay&quot; rel=&quot;nofollow noreferrer&quot;&gt;Delay&lt;/a&gt;&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Delay is supposed to be a calculation of the amount of time it takes a bit to be transmitted to an adjacent neighbor. But in reality it is simply a constant value based upon the interface bandwidth. However, since this factor is additive, it essentially works as a hop count. Or maybe we should say a &lt;em&gt;smart hop count&lt;/em&gt;, since it also factors each hop’s bandwidth.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The full list of each interface speed and delay value can be found here:&lt;BR /&gt;&#xA;&lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-savage-eigrp-00#section-5.5.1.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://datatracker.ietf.org/doc/html/draft-savage-eigrp-00#section-5.5.1.2&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Note that this table displays a value in Picoseconds (one trillionth of a second), and the delay value in &lt;code&gt;show interface&lt;/code&gt; is displayed in usec, or microseconds (one millionth of a second).&lt;/p&gt;&#xA;&lt;p&gt;The delay value used in the formula is the microsecond value divided by 10. For example, a path that consists of two links that are each 100mbps would equate to a total delay in usec of 200:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Delay Value = 200 / 10 = 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;Final Calculation&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;We can take the Bandwidth value determined above (100) and the Delay value determined above (20) and plug them into the &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/eigrp-metric/#default_image&quot; rel=&quot;nofollow noreferrer&quot;&gt;simplified formula&lt;/a&gt; to get us the final EIGRP Metric for a link with a minimum path bandwidth of 100mbps, and who's full path crosses two 100mbps links:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;EIGRP Metric = 256 * (Bandwidth + Delay)&#xA;EIGRP Metric = 256 * (100 + 20)&#xA;EIGRP Metric = 256 * 120&#xA;EIGRP Metric = 30720&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Which interestingly enough is the exact same value you listed in your question:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh ip ro ei&#xA;     192.168.1.0/30 is subnetted, 1 subnets&#xA;D    192.168.2.0/24 [90/30720] via 192.168.1.2, 00:09:13, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;H3&gt;Feasible Distance vs Reported Distance&lt;/H3&gt;&#xA;&lt;p&gt;Which brings us back to another concept that you might have been confused about. Namely, it has to do with the output to this command:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh ip ei top&#xA;...&#xA;P 192.168.2.0/24, 1 successors, FD is 30720&#xA;         via 192.168.1.2 (30720/28160), FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;There are two values provided for the route to &lt;code&gt;192.168.2.0/24&lt;/code&gt; via &lt;code&gt;192.168.1.2&lt;/code&gt;: &lt;strong&gt;30720&lt;/strong&gt; and &lt;strong&gt;28160&lt;/strong&gt;. Understanding these two values requires understanding &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/eigrp-terminology/#cost_terms&quot; rel=&quot;nofollow noreferrer&quot;&gt;two terms that EIGRP uses to describe cost&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The first value is what is known as the &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/eigrp-terminology/#rd_fd&quot; rel=&quot;nofollow noreferrer&quot;&gt;Feasible Distance&lt;/a&gt;. This is the Total EIGRP cost to the final destination. The value we calculated of 30720 above is the Feasible Distance to the 192.168.2.0/24 network.&lt;/p&gt;&#xA;&lt;p&gt;The second value (28160) is what is known as the &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/eigrp-terminology/#rd_fd&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reported Distance&lt;/a&gt; (also sometimes the &lt;em&gt;Advertised Distance&lt;/em&gt;). This value represents the total EIGRP cost &lt;em&gt;for my neighbor&lt;/em&gt; to get to the target network. This is the value the neighbor shares when advertising the route to the local Router.&lt;/p&gt;&#xA;&lt;p&gt;It is possible to reverse deconstruct the Reported Distance (aka, the neighbor's cost) value of 28160.&lt;/p&gt;&#xA;&lt;p&gt;We know the value for EIGRP Metric is 256 * (BW+Delay). If we take 28160 and &lt;em&gt;divide&lt;/em&gt; it by 256, we get 110. Which means BW+Delay equated to 110.&lt;/p&gt;&#xA;&lt;p&gt;We also know the full path is two 100mbps links, so obviously the neighbors path to the target network is one 100mbps link, or a total delay value of 10. Which means the Bandwidth value must have added up to 100, which we know it does when factoring a 100mbps link.&lt;/p&gt;&#xA;&lt;p&gt;Which confirms the neighbor is one, 100mbps hop away from the target network -- which means the neighbor was directly connected to the target network with a 100mbps link.&lt;/p&gt;&#xA;&lt;HR /&gt;&#xA;&lt;p&gt;Which finally lets us speak to your specific questions. At least the ones that haven't already been answered above:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Could any light be shed on why this is so high in comparison to OSPF for example?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The Metric value is a 32 bit value, which means it can be any number between 0 and 4.2~ billion. The Metric is only considered if the network is the the same size, and the route is learned from the same routing Protocol. Which means what EIGRP considers as a metric will &lt;em&gt;never&lt;/em&gt; be compared to what OSPF will consider a network.&lt;/p&gt;&#xA;&lt;p&gt;So their relative differences are irrelevant. Because if a route is learned from OSPF and EIGRP, the EIGRP route will &lt;em&gt;always&lt;/em&gt; be preferred because its Administrative Distance is lower (90 vs 110).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I understand that this is probably a simple case of apples and oranges being two separate routing protocols, but I'm interested to know how this is calculated&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Correct, the EIGRP and OSPF metric calculations are Apples and Oranges -- not to be compared. The EIGRP calculation is described thoroughly above, or in more detail in &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/eigrp-metric/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If you want a run down on the OSPF metric calculation, I'd suggest asking a new question.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;As you can see from the above, the calculation is 30720/28160. The second part of this calculation also seems to be the feasible distance of 28160, with the first part being the metric of 30720 from the routing table.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Almost. The &lt;em&gt;first&lt;/em&gt; part is the &lt;strong&gt;Feasible Distance&lt;/strong&gt; (30720).  The &lt;em&gt;second&lt;/em&gt; part is the &lt;strong&gt;Reported Distance&lt;/strong&gt; (28160). The EIGRP topology table will keep track of both of these values.  And the Routing table will take only the &lt;strong&gt;Feasible Distance&lt;/strong&gt; into consideration.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Could someone please explain to me the purpose of this calculation?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Keeping track of the Feasible Distance as well as the Reported Distance comes into play with a loop-prevention mechanism of EIGRP known as the &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/eigrp-feasibility-condition/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Feasibility Condition&lt;/a&gt;.  If multiple EIGRP routers share information about the same network, the Reported Distance of each incoming route can be compared to what the Router already knows as its best Feasible Distance to determine whether the newly learned path includes a routing loop.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;And will this figure change over time? Or is this now set in stone?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The metric will not change unless the interface goes up or down, the interface speed changes, or the number of hops change. Since those are what goes into the calculation, those are the values that will affect a re-calculation.  In a stable network, these typically will not change, and therefore the figure will not typically change.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2016-05-13T17:18:04.287" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30256" PostTypeId="1" AcceptedAnswerId="30260" CreationDate="2016-05-09T17:32:18.800" Score="2" ViewCount="119" Body="&lt;p&gt;One of my small IT customers hired a consultant to save them money. They use voip and have video surveillance cameras the owner watches remotely. They also have about 10 people in the office at any given time and offer free wifi to customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set the network up and have a basic router with qos enabled for the voip traffic. We were having upstream issues and the provider stated that we were probably hitting our upload limit of 2mb and that was causing the voip drops. I increased it to 50/5 and the problem has went away. Now the consultant has presented me with this graph that I've never seen. The speed increase happened on 4/14. There is a drop in the numbers at that time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My arugment is that, this graph only shows averages, not peaks. And the peak upstream usage is when we are having the problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you see anything different or am I interpreting this graph incorrectly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/h5EHQ.jpg&quot; alt=&quot;Analysis image[1]&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="10008" LastActivityDate="2016-05-09T20:50:32.577" Title="Can someone help me make sense of this network analysis?" Tags="|ethernet|internet|cable|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30257" PostTypeId="1" AcceptedAnswerId="30258" CreationDate="2016-05-09T18:19:34.193" Score="1" ViewCount="2798" Body="&lt;p&gt;I understand how port triggering works: When outbound traffic utilizes a specified port or set of ports, inbound traffic is forwarded through a specified port or group of port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When would you use this? Why would you use this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are examples online showing you how to do it for XBox Live gaming sessions and IRC authentication but I know I've played games using XBox Live and I've used IRC without port triggering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port triggering seems completely pointless. I must be missing something fundamental here.&lt;/p&gt;&#xA;" OwnerUserId="1820" LastEditorUserId="8499" LastEditDate="2016-05-09T19:11:45.453" LastActivityDate="2016-05-09T19:11:45.453" Title="When and/or why setup port triggering?" Tags="|routing|nat|" AnswerCount="1" CommentCount="0" ClosedDate="2016-05-11T08:36:20.850" ContentLicense="CC BY-SA 3.0" />
  <row Id="30258" PostTypeId="2" ParentId="30257" CreationDate="2016-05-09T18:45:23.007" Score="0" Body="&lt;p&gt;NAT is usually a one-way translation. You probably have one outside (public) IP address, and many inside (private) IP addresses. If traffic comes to your outside address, absent any other information, the NAT cannot determine to which inside address it should forward the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some things, you can set up port forwarding, e.g, you will forward any traffic destined to your outside address and port 80 to a web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a host inside your LAN initiates a connection to an outside host (e.g. your web browser wants to connect to a web server), it will use a random, ethereal port as the source port. For traffic to come back from the outside to this ethereal port, the NAT needs to record the port in its translation table. When traffic comes back from the outside host, destined for that ethereal port, the NAT knows to send it to the inside host address and ethereal port. This is port triggering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With NAT, you either need to manually configure port forwarding, or your NAT needs to do port triggering. Most NAT routers will automatically do port triggering without specific configuration. Some will let you change some parameters, e.g. how long it should keep the port triggering enabled without any traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-09T18:45:23.007" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="30259" PostTypeId="1" CreationDate="2016-05-09T19:56:38.867" Score="0" ViewCount="735" Body="&lt;p&gt;my company purchased a new switch brand HP and I created two VLANs on it. VLAN 2 is for the ports 47 and 49 that provide access to internet through a fiber cable and other VLAN 1, which is for the remaining ports. The switch has a total of 48 ports and wanted to know if I need to assign an IP to the VLAN2 the option VLAN Interfaces for the VLAN1 was assigned an IP that is the internal network.&lt;/p&gt;&#xA;" OwnerUserId="25236" LastActivityDate="2016-12-06T01:52:40.153" Title="Configuration interface VLAN hp switch" Tags="|switch|vlan|hp|interface|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-14T02:49:54.577" ContentLicense="CC BY-SA 3.0" />
  <row Id="30260" PostTypeId="2" ParentId="30256" CreationDate="2016-05-09T20:50:32.577" Score="2" Body="&lt;p&gt;Based on the characteristics of the graph provided, this appears to be an MS Excel generated line chart. The question is the nature of the data used to build the chart and how the data was imported. Do you even have assurance that the data represented is accurate? What time zone do the times represent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each data point on this chart represents a day and is connected by a line. Without any other frame of reference, there is no way to understand what these data points are representing. Here are some possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Daily maximum/peak&lt;/li&gt;&#xA;&lt;li&gt;Daily low&lt;/li&gt;&#xA;&lt;li&gt;Daily average&lt;/li&gt;&#xA;&lt;li&gt;Daily median&lt;/li&gt;&#xA;&lt;li&gt;Another daily measure, such as a 95% value&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The other concern is how the data is collected. If collected at five minute intervals (not uncommon), you also may not see high utilization (i.e. one minute with high utilization and four with low utilization won't necessarily look high).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, this is all somewhat meaningless as you are trying to solve a specific problem and I don't see how this chart is helpful in that endeavor unless it is providing some sort of relevant, meaningful data. This is something that I don't believe has been established with the information you have provided us.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that your issue with VoIP is just a symptom of the actual problem, not the problem itself.  You believe you have found the source of the problem by upgrading your down/up speed, but again without relevant, meaningful data you can't know this for sure.  All you know is that the symptom you are aware of seems to have been alleviated. However, this could be somewhat like spraying a numbing antiseptic onto a scrape and saying that because it doesn't hurt anymore the problem (i.e. the scrape) is fixed. The underlying problem is still there, you have simply treated a symptom of that problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ron has mentioned in the comments, for VoIP you should really be running some proper form of QoS to ensure it has the bandwidth needs it requires. Then, you should start monitoring your network so you can understand what is going on and the data you are getting out of it. This way you will be able to start understanding what is normal and what isn't normal on your network.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2016-05-09T20:50:32.577" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30261" PostTypeId="2" ParentId="30259" CreationDate="2016-05-09T20:53:39.230" Score="1" Body="&lt;p&gt;A layer-2 switch needs only one address for management -- most will not even allow more than one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As VLAN 2 in your setup is &lt;em&gt;the internet&lt;/em&gt;, you almost &lt;em&gt;certainly&lt;/em&gt; &lt;strong&gt;DO NOT&lt;/strong&gt; want I live IP address on that VLAN. (1 - it wastes an address, and 2 - you don't need your switch attacked by everything else on the internet.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-09T20:53:39.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30262" PostTypeId="1" AcceptedAnswerId="30263" CreationDate="2016-05-09T21:33:03.680" Score="4" ViewCount="776" Body="&lt;p&gt;Suppose a client has received 0 to 500, 900 to 1100 and 1300 to 2000 how will ACK and SACK look like? Does it look like this ACK: 500 SACK:900-1100 and then it asks for the packets 1100 to 1300 in new request.&lt;/p&gt;&#xA;" OwnerUserId="23142" LastActivityDate="2016-05-09T21:54:33.427" Title="What happens in SACK when there are multiple gaps in the received packets?" Tags="|tcp|packet-analysis|packet-loss|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30263" PostTypeId="2" ParentId="30262" CreationDate="2016-05-09T21:54:33.427" Score="7" Body="&lt;p&gt;The Selective ACK Option can specify more than one &amp;quot;block&amp;quot; of received traffic. Here is what the option looks like on the wire (taken from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2018#section-3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2018, Section 3&lt;/a&gt;):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;                     +--------+--------+&#xA;                     | Kind=5 | Length |&#xA;   +--------+--------+--------+--------+&#xA;   |      Left Edge of 1st Block       |&#xA;   +--------+--------+--------+--------+&#xA;   |      Right Edge of 1st Block      |&#xA;   +--------+--------+--------+--------+&#xA;   |                                   |&#xA;   /            . . .                  /&#xA;   |                                   |&#xA;   +--------+--------+--------+--------+&#xA;   |      Left Edge of nth Block       |&#xA;   +--------+--------+--------+--------+&#xA;   |      Right Edge of nth Block      |&#xA;   +--------+--------+--------+--------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;According your example:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Suppose a client has received 0 to 500, 900 to 1100 and 1300 to 2000 how will ACK and SACK look like?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Your suggestion is almost correct, except for accounting for the additional Left and Right edge of the received bytes.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;TCP ACK - 501 (in TCP header, not in SACK Option)&#xA;TCP SACK - 1st block Left Edge  - 900&#xA;TCP SACK - 1st block Right Edge - 1100&#xA;TCP SACK - 2nd block Left Edge  - 1300&#xA;TCP SACK - 2nd block Right Edge - 2000&#xA;(all in the same Segment)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;There are additional examples and use cases in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2018#section-7&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2018 Section 7&lt;/a&gt;. They are worth reading through to fully wrap your mind around it.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-05-09T21:54:33.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30265" PostTypeId="1" AcceptedAnswerId="30266" CreationDate="2016-05-10T02:53:41.657" Score="6" ViewCount="5933" Body="&lt;p&gt;What is the relationship between a switches buffer size and the effect it has on latency? I am aware of the bufferbloat issue and understand that buffers that are too large in networks of slower BW (i.e. less then 1Gbps) can degrade performance, but how large is too large? I've also read that in networks consisting of 10Gbps and greater links usually fall victim to &lt;em&gt;not enough&lt;/em&gt; buffering. Assuming that's true, why is that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand this question may be very subjective to a given workload but any general guidelines or rules of thumb that can provide a foundation would be appreciated. &lt;/p&gt;&#xA;" OwnerUserId="19636" LastEditorUserId="8499" LastEditDate="2020-02-09T04:41:06.130" LastActivityDate="2020-02-09T04:41:06.130" Title="Switch Buffer Sizing" Tags="|switch|switching|bandwidth|speed|latency|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30266" PostTypeId="2" ParentId="30265" CreationDate="2016-05-10T04:01:13.693" Score="2" Body="&lt;p&gt;Mostly, modern switches don't increase latency; they switch are wire speed, since most of it is done in hardware. Buffering traffic slows it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches tend to have very, very small buffers. The reasoning is that it is better to drop traffic early than to slow it down. Networks prefer that any traffic which will be dropped be dropped as soon as possible (if a switch must buffer traffic, it is likely to be dropped by subsequent network devices) to give a head start to detection and retransmission.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-10T04:01:13.693" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="30267" PostTypeId="2" ParentId="29320" CreationDate="2016-05-10T05:12:58.377" Score="0" Body="&lt;p&gt;yes, you can choose the QSFP LR4 PSM type ,I have project for Brocade , and EMC storage ,the 2 buliding so far the 500M , We are use the type for install, something liek the QSFP SR 4 with Breakout cable. to 10G LR ,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ryan&lt;/p&gt;&#xA;" OwnerUserId="25245" LastActivityDate="2016-05-10T05:12:58.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30268" PostTypeId="1" AcceptedAnswerId="30269" CreationDate="2016-05-10T05:48:55.293" Score="3" ViewCount="5759" Body="&lt;p&gt;I am a new learner of TCP protocol and recently a question puzzles me for a period...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question arises from the following example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose our &lt;strong&gt;MSS is 1KB&lt;/strong&gt; and the &lt;strong&gt;maximum sequece number is 30K-1&lt;/strong&gt;. We can ignore the congestion control window and assume the &lt;strong&gt;receiver's window size is constantly 30K&lt;/strong&gt; (receiver is able to instantly deliver the data in segment to the application layer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose the &lt;strong&gt;initial seqNum is 0&lt;/strong&gt;, and sender simultaneously sends out 30 packets with seqNum 0, 1K, 2K ... 28K and 29K respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The receiver successfully accepts all 30 packets and replies with 30 ACK packets accordingly, each with ack number &lt;strong&gt;1K&lt;/strong&gt;, 2K, ... 29K and 0. (&lt;em&gt;This is where the first ACK packet 1K appears&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, due to the out of order delivery, the sender gets ack number 2K &lt;strong&gt;before 1K&lt;/strong&gt;. Although for now it is still not a problem, because sender can deduce that the first two packets are accepted through the principle of accumulative acknowledgement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, sender sends two more packets with seqNum 0 and 1K with newer data (&lt;strong&gt;sequencer number 0 and 1K are reused due to sequence number looping back&lt;/strong&gt;), and receiver accepts them and reply with ACK packets &lt;strong&gt;1K&lt;/strong&gt;, 2K. (&lt;em&gt;This is where the second ACK packet 1K appears&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, this caused a problem that &lt;strong&gt;there exists two ACK packets with ack number all being 1K&lt;/strong&gt;. How can the sender tell &lt;strong&gt;which ACK packet is newer than the other&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="25246" LastEditorUserId="25246" LastEditDate="2016-05-10T06:44:53.943" LastActivityDate="2016-05-10T06:48:28.043" Title="How does a TCP sender recognize out-of-order ACK packets?" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30269" PostTypeId="2" ParentId="30268" CreationDate="2016-05-10T06:14:50.583" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Then, sender sends two more packets with seqNum 0 and 1K, and receiver accepts them and reply with ACK packets 1K, 2K.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The sequence and ACK numbers are cumulative, therefore once a packet is ACKed that sequence number will not be seen in that TCP stream ever again (well they will be eventually if the session sends enough data - see &lt;a href=&quot;https://stackoverflow.com/questions/2672734/tcp-sequence-number-question&quot;&gt;this thread&lt;/a&gt; for more information). See the &quot;Statistics &gt; Flow Graph&quot; image in &lt;a href=&quot;http://packetlife.net/blog/2010/jun/7/understanding-tcp-sequence-acknowledgment-numbers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this PacketLife post&lt;/a&gt; for information on the how the ACK and SEQ figures increment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In regards to ACK'ing out of order packets, this is done through SACK as described in &lt;a href=&quot;http://packetlife.net/blog/2010/jun/17/tcp-selective-acknowledgments-sack/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this PacketLife post.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: After reading your edited question I believe &lt;a href=&quot;https://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_timestamps&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP timestamps&lt;/a&gt; are the answer you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;TCP timestamps are used in an algorithm known as Protection Against Wrapped Sequence numbers, or PAWS (see RFC 1323 for details). &lt;strong&gt;PAWS is used when the receive window crosses the sequence number wraparound boundary.&lt;/strong&gt; In the case where a packet was potentially retransmitted it answers the question: &quot;Is this sequence number in the first 4 GB or the second?&quot; And the timestamp is used to break the tie.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2016-05-10T06:48:28.043" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="30271" PostTypeId="2" ParentId="30240" CreationDate="2016-05-10T06:41:40.497" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I know that 90 is the administrative distance, but the metric of 30720 seems high going over fast ethernet to only one hop. Could any light be shed on why this is so high in comparison to OSPF for example? I understand that this is probably a simple case of apples and oranges being two separate routing protocols, but I'm interested to know how this is calculated.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You're right - it is like comparing apples and oranges :) For exmaple, RIP's maximum metric is 15 but doesn't mean anything when compared to an EIGRP metric of 30720.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In regards to the EIGRP metric being so high - part of the reason is because EIGRP multiplies its metric by 256 in order to be backward compatible with IGRP (EIGRP's predecessor). As per &lt;a href=&quot;https://en.wikipedia.org/wiki/Enhanced_Interior_Gateway_Routing_Protocol&quot; rel=&quot;nofollow&quot;&gt;this Wikipedia entry:&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IGRP uses the same basic formula for computing the overall metric, the&#xA;  only difference is that in IGRP, the formula does not contain the&#xA;  scaling factor of 256. In fact, this scaling factor was introduced as&#xA;  a simple means to facilitate backward compatility between EIGRP and&#xA;  IGRP: In IGRP, the overall metric is a 24-bit value while EIGRP uses a&#xA;  32-bit value to express this metric. By multiplying a 24-bit value&#xA;  with the factor of 256 (effectively bit-shifting it 8 bits to the&#xA;  left), the value is extended into 32 bits, and vice versa. This way,&#xA;  redistributing information between EIGRP and IGRP involves simply&#xA;  dividing or multiplying the metric value by a factor of 256, which is&#xA;  done automaticall&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In regards to how the metric is calculated, I wrote a &lt;a href=&quot;http://www.oznetnerd.com/2015/10/24/mastering-eigrp-metric-calculations/&quot; rel=&quot;nofollow&quot;&gt;detailed blog post&lt;/a&gt; about it a little while back. The short of it is that the metric is calculated by using this formula:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;256*[(10000000/)+(/10)]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we run the figures you provided &lt;em&gt;(Vector metric: Minimum bandwidth is 100000 Kbit Total delay is 200 microseconds)&lt;/em&gt; through this formula, we get the correct metric:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10000000 / 100000 = 100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;200 / 10 = 20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;100 + 20 = 120&lt;/p&gt;&#xA;&#xA;&lt;p&gt;256 * 120 = 30720&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2016-05-11T04:27:01.043" LastActivityDate="2016-05-11T04:27:01.043" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30276" PostTypeId="2" ParentId="30265" CreationDate="2016-05-10T14:30:18.133" Score="4" Body="&lt;p&gt;First, there is a relationship between buffer size and latency only if there is congestion in the path (too many incoming packets on the input interface, or too many packets for the switching engine (ASIC/NPU/software/whatever), or too many packets in the output interface). On a &quot;lightly loaded&quot; switch, there is no relationship between buffer size and latency. There is a constant latency that is determined by the performance of the switching engine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a device that is experiencing congestion, packets sit in buffers waiting for their turn to get processed. If the waiting room gets full, newcomers cannot be accommodated, i.e. packets get dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bigger the waiting room is, more the number of packets that can be accommodated, but it gets likelier that some of them are processed really late. For this reason you could loosely say that the bigger the buffers, the more the latency. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But would you consider a dropped packet to have suffered &quot;infinite latency&quot; ? :-)&lt;/p&gt;&#xA;" OwnerUserId="22665" LastActivityDate="2016-05-10T14:30:18.133" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30277" PostTypeId="2" ParentId="7353" CreationDate="2016-05-10T19:56:05.457" Score="5" Body="&lt;p&gt;On its own packet loss per second is a relatively meaningless metric. 2 packets lost per second could be devastating to a flow of 2 packets per second, but to something sending 100pps, like a 10ms packetised VoIP call, that might be survivable. Notice how the impact of Loss Per Second has to be defined in conjunction with the traffic flow in Packets Per Second?&lt;/p&gt;&#xA;&lt;p&gt;Moving to a relevant RFC, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2330#section-12&quot; rel=&quot;nofollow noreferrer&quot;&gt;2330&lt;/a&gt; contains the following statement:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;So, for example, rather than defining a metric about a &amp;quot;packet loss probability between A and B&amp;quot;, we would define a metric about a &amp;quot;packet loss rate between A and B&amp;quot;. (A measurement given by the first definition might be &amp;quot;0.73&amp;quot;, and by the second &amp;quot;73 packets out of 100&amp;quot;.)&amp;quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="13290" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-05-10T19:56:05.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30279" PostTypeId="1" AcceptedAnswerId="30291" CreationDate="2016-05-10T22:28:53.907" Score="2" ViewCount="1252" Body="&lt;p&gt;When I'm configuring wireless interface in RouterOS or in fact most of APs in general there are basically 2 options for controlling traffic between stations connected to AP - &lt;em&gt;forward all&lt;/em&gt;, and &lt;em&gt;don't forward&lt;/em&gt; (AP isolation) it's kind of binary...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to be able to apply some at least a bit more advanced filtering between stations connected to AP. Just like in some routers it's possible to apply some basic firewall on bridge interface level between bridge ports. So lets say I could allow stations to connect with each other only on ssh port, nothing else&lt;/p&gt;&#xA;" OwnerUserId="8352" LastActivityDate="2016-05-14T08:50:56.630" Title="How to apply firewall between stations connected to AP?" Tags="|router|wireless|firewall|access-point|access-control|" AnswerCount="2" CommentCount="0" ClosedDate="2019-03-13T06:21:49.880" ContentLicense="CC BY-SA 3.0" />
  <row Id="30282" PostTypeId="1" AcceptedAnswerId="30416" CreationDate="2016-05-11T01:17:27.930" Score="3" ViewCount="2230" Body="&lt;p&gt;i'm trying to connect to my ssh test server that i setup behind a pfsense firewall via nat on port 22.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I sniff packet on my laptop (WAN side of pfsense) trying to connect to the server, SYN is send, SYN ACK received, but my computer don't care and resend.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link to the capture : &lt;a href=&quot;https://www.cloudshark.org/captures/996b00e33150&quot; rel=&quot;nofollow&quot;&gt;https://www.cloudshark.org/captures/996b00e33150&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you got idea to keep debugging this problem ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="25276" LastActivityDate="2019-01-28T10:32:01.890" Title="Spurious restransmission to a server behind pfsense NAT" Tags="|nat|tcp|lan|wireshark|pfsense|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30283" PostTypeId="2" ParentId="30137" CreationDate="2016-05-11T01:29:54.367" Score="0" Body="&lt;p&gt;Depending on your DNS implementation, you could accomplish this with &lt;a href=&quot;http://www.zytrax.com/books/dns/ch9/rr.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;round-robin&quot; DNS&lt;/a&gt;.  In its basic form, this will return a list of both IPs (your WAN private IP and the WWAN public IP if I'm reading your question correctly) to your database.  The caveat is that DNS cannot guarantee that the client (the database and/or application) will respect the change due to TTLs and/or order of the list of IPs returned in the response.  As the linked article specifies, you can control this to a certain degree with lower TTLs, &quot;split horizon&quot;, or SRV records, but that is dependent upon your DNS, as well as your application and database support of those features. So I concur that your question is better suited for &lt;a href=&quot;https://stackoverflow.com/&quot; title=&quot;Stack Overflow&quot;&gt;Stack Overflow&lt;/a&gt; or &lt;a href=&quot;https://serverfault.com/&quot; title=&quot;Server Fault&quot;&gt;Server Fault&lt;/a&gt; as &lt;a href=&quot;https://networkengineering.stackexchange.com/users/8499/ron-maupin&quot;&gt;Ron Maupin&lt;/a&gt; pointed out. There are much better ways to handle this type of situation at the application level, e.g. service discovery a la &lt;a href=&quot;https://www.consul.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Consul&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="16676" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2016-05-11T01:29:54.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30284" PostTypeId="2" ParentId="18149" CreationDate="2016-05-11T02:44:09.743" Score="2" Body="&lt;p&gt;It's a little more complex than that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hub has to have circuitry to decode the wire-level encoding of incoming data and encode outgoing data in the correct wire-level encoding. This includes handling special cases like preambles and idle ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The core logic of the hub waits for incoming data to be detected by one of the receivers. If it detects incoming data on a port then it sends that data out of all the other ports (but not out of the port it came from). If it detects incoming data on more than one port at a time then it outputs a jam signal to ensure the collision is seen throughout the collision domain.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-11T02:44:09.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30286" PostTypeId="2" ParentId="30217" CreationDate="2016-05-11T06:30:28.163" Score="2" Body="&lt;p&gt;As Ricky Beam answered in the comments, this appears to be a bug with firmware c1140-k9w7-mx.153-3.JBB1 and is resolved in at least firmware c1140-k9w7-mx.153-3.JC. The other issue I was experiencing with watchdog timeouts appear to be caused by a hardware failure.&lt;/p&gt;&#xA;" OwnerUserId="20347" LastEditorUserId="20347" LastEditDate="2016-05-11T06:38:44.113" LastActivityDate="2016-05-11T06:38:44.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30287" PostTypeId="2" ParentId="29381" CreationDate="2016-05-11T06:50:29.183" Score="2" Body="&lt;p&gt;I wouldn't disable STP in your topology. There's no need to. STP is used to ensure a loop free topology. If they haven't been already, you should bundle your Dell ports into a single port channel. As your EXs are stacked they appear as one logical switch and therefore will be able to form port channels on their end too. This results in you having a logical star topology with no loop, therefore STP will not block any ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're concerned about Chassis 3 being the root bridge you should reduce EX stack's priority to ensure that it becomes the root bridge. FYI though, if you implement port channels as I've suggested above there are no redundant paths for STP to block, therefore it doesn't matter which switch is the root bridge. (To cover off future issues though you should make your core switch the root bridge as suggested above).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP should never be disbaled unless you have an extremely good reason to do so. If you're wanting to reduce the amount of time it takes for an access port to come up, you should configure it as an &lt;a href=&quot;http://www.juniper.net/techpubs/software/junos/junos95/swconfig-layer-2/conf-stp.html#conf-stp-edge-port&quot; rel=&quot;nofollow&quot;&gt;edge port&lt;/a&gt; instead of disabling STP.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-05-11T06:50:29.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30288" PostTypeId="2" ParentId="30279" CreationDate="2016-05-11T07:46:12.440" Score="1" Body="&lt;p&gt;I can think of a couple of reasons this may be the case:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;While there are many brands of Access Point hardware, they all source the wireless chipsets that power them from a handful of manufacturers (Atmel, Broadcom, Intel, Marvell etc.).  I would suggest that it's probably an inherent limitation in these chipsets that higher-layer filtering is not supported.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There is no presumption in the 802.11 standard that the transport layer is TCP/IPv4 (even if the vast majority is).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Most commercial wireless vendors that I am familiar with (specifically Aruba and Trapeze/Juniper) only enforce L3 ACLs and Firewall policy either at a centralised hardware controller, or virtualised instance of this controller within one of their APs - essentially between the ESSID and the VLAN it attaches to, meaning that WLAN clients can only be controlled with the all-or-nothing approach of AP isolation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a somewhat related note - AP Isolation mode works well when you have a single Access Point on your network, but consider what happens when you have two or more and a client roams.  Their MAC is now learnt on the uplink interface of the original AP, and will now be able to happily communicate with clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is solved somewhat with &quot;Thin&quot; and clustered &quot;Thick&quot; APs, but stand-alone &quot;Fat&quot; APs can't do much about it.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-05-11T07:46:12.440" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30291" PostTypeId="2" ParentId="30279" CreationDate="2016-05-11T12:20:40.607" Score="1" Body="&lt;p&gt;Mikrotik RouterOS has embedded &quot;bridge firewall&quot;. You can apply filter rules with MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Bridge menu, Filter and NAT tabs. Yes, NAT.. you can also dst-NAT or SRC-NAT (and many other possibilities).&#xA;So in your case, you can add some rule to allow traffic between two MAC, and deny all others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See&#xA;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Bridge_Firewall&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#Bridge_Firewall&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update from comment:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure your AP with client isolation and add specific stations to the access-list in order to allow communication between them&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface wireless set [ find name=&quot;wlan_foo&quot; ] default-forwarding=no&#xA;&#xA;/interface wireless access-list&#xA;add interface=wlan_foo mac-address=BC:85:56:A0:E8:3F forwarding=yes&#xA;add interface=wlan_foo mac-address=40:B3:95:31:9A:FB forwarding=yes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20569" LastEditorUserId="20569" LastEditDate="2016-05-14T08:50:56.630" LastActivityDate="2016-05-14T08:50:56.630" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="30292" PostTypeId="1" AcceptedAnswerId="30305" CreationDate="2016-05-11T12:29:28.750" Score="2" ViewCount="273" Body="&lt;p&gt;And would an AP wait to transmit if a device were broadcasting to another AP on the same channel, due to CSMA/CA?&lt;/p&gt;&#xA;" OwnerUserId="25283" LastActivityDate="2016-05-11T18:18:23.890" Title="What is the difference (if any) between CSMA/CA and ARQ?" Tags="|wireless|ieee-802.11|data|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30294" PostTypeId="1" CreationDate="2016-05-11T13:14:32.460" Score="-1" ViewCount="64" Body="&lt;p&gt;&lt;strong&gt;Which maximal amount of nodes can subnet with mask 255.255.255.248 contain?&lt;/strong&gt; Kindly explain how it can be calculated&lt;/p&gt;&#xA;" OwnerUserId="25284" LastActivityDate="2016-05-11T13:24:05.900" Title="Which maximal amount of nodes can subnet with mask 255.255.255.248 contain?" Tags="|subnet|" AnswerCount="1" CommentCount="0" ClosedDate="2016-05-11T13:29:53.410" ContentLicense="CC BY-SA 3.0" />
  <row Id="30295" PostTypeId="2" ParentId="30294" CreationDate="2016-05-11T13:24:05.900" Score="0" Body="&lt;p&gt;Convert it to binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11111111111111111111111111111000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Invert it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000000000000000000000000000111&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Convert to decimal:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Subtract 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-11T13:24:05.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30296" PostTypeId="1" CreationDate="2016-05-11T14:57:51.387" Score="1" ViewCount="25678" Body="&lt;p&gt;I just realized one of my switches are not reachable by SSH and even Telnet. I just noticed that of recent, and I don't know what could be the problem.&lt;br&gt;&#xA;This Switch is in a large network, and we normally connect via TACACS authentication.&lt;br&gt;&#xA;In trying to connect, I get the following &quot;&lt;strong&gt;Network error: Connection refused&lt;/strong&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can be done in this scenario?&lt;br&gt;&#xA;Is this related to the access list? If yes what is the relationship between Access lists and SSH login to devices via TACACS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks &lt;/p&gt;&#xA;" OwnerUserId="24161" LastEditorUserId="14890" LastEditDate="2016-05-11T18:43:16.247" LastActivityDate="2016-12-08T01:23:42.773" Title="Can't SSH and Telnet my Switch" Tags="|cisco-ios|cisco-catalyst|cisco-commands|" AnswerCount="3" CommentCount="4" ClosedDate="2019-02-17T18:04:48.297" ContentLicense="CC BY-SA 3.0" />
  <row Id="30299" PostTypeId="2" ParentId="30296" CreationDate="2016-05-11T15:30:01.097" Score="2" Body="&lt;p&gt;Connection refused means the switch us alive (pingable).&#xA;So it could be an acl, or the vty lines being disabled.&#xA;It's possible someone logged in, changed the config and got thrown out.&#xA;If you are lucky the running config hasn't been saved, so you could reboot (usually a &quot;reboot in X&quot; is a good idea when messing with authentication) and hope it comes up with a saved config that still allows access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or simply as Ron Maupin said, get console access.&#xA;If it's in a remote location I would try get someone to restart it.&#xA;Do you save your logs somewhere? &#xA;Perhaps that will give a hint as to who did what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also another thought, yoy said you use TACACS, is the TACACS server reachable from the location of the switch? &#xA;Check routing and acls towards the TACACS servsr.&#xA;In general it's good practice to configure a local fallback method, so that when tacacs is not reachable you can use a local user.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2016-05-11T15:30:01.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30300" PostTypeId="2" ParentId="29713" CreationDate="2016-05-11T15:36:32.803" Score="1" Body="&lt;p&gt;If possible I would try and get a block of public IPv4 IPs big enough ( a /28 from your description) that each buisness could have their own IPv4 ip. I would also try to get a /48 of IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router on the end of the leased line from the ISP would be acting as a simple router with no NAT or firewalling. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Behind that router each buisness could have their own NAT router/firewall which would be allocated a single IPv4 address and a /56 block of IPv6. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While this does involve more hardware than having one box manage everything it means that each buisness is in control of their own network and configuration of the shared router should be very much &quot;set and forget&quot;.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-11T15:36:32.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30302" PostTypeId="1" AcceptedAnswerId="30304" CreationDate="2016-05-11T17:30:55.070" Score="6" ViewCount="15063" Body="&lt;p&gt;This question has been hanging around in my head for a while; all the way from back in 2012, when we replaced our core network switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This switch was actually a stacked pair of old 3Com 4900sx, and it was responsible for layer 3 routing between VLANs in our network. We're just a two-man IT shop, where a lot of our internal expertise is more in workstation, server, and application support, with only basic network engineering, so we engaged a consulting firm for this project. The consultant's task was to look at how our network was configured, and what growth we were having, to make sure the new switch was set up well (not just matching what we had, but also looking to the future), as well as help with the cut-over to minimize downtime. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make a long story short (&lt;a href=&quot;https://www.youtube.com/watch?v=YCP2QQH4uuQ&quot; rel=&quot;noreferrer&quot;&gt;too late&lt;/a&gt;), there were two noticeable configuration differences from the old to the new. The first difference is a much shorter ARP timeout. This makes sense to me; the rise of Wi-Fi means a device might move from one place to another and end up on a different port, invalidating cached ARP information. The second difference is the old switch used OSPF areas, but the new switch does not do any OSPF configuration at all. This part I do not understand. It's not so much that it doesn't make sense, as that I lack a frame of reference for knowing when or why one would want to use OSPF at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And so there is my question: when does it make sense to add OSPF to a network, or why would you choose OSPF over another option? I've been through several resources on this in the past, but never quite had this solved to my satisfaction.&lt;/p&gt;&#xA;" OwnerUserId="1375" LastEditorUserId="8499" LastEditDate="2020-11-27T23:21:36.860" LastActivityDate="2020-11-27T23:21:36.860" Title="When/Why to use OSPF?" Tags="|routing|router|ospf|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30304" PostTypeId="2" ParentId="30302" CreationDate="2016-05-11T17:39:03.317" Score="6" Body="&lt;p&gt;Routing protocols, such as OSPF, are to share routes between routers. If your routing is done on a single router, or a pair of routers connected to the same networks (your layer-3 switches), it doesn't make any sense to use CPU cycles for the routing protocol, since routers inherently know about directly connected networks. Both your layer-3 switches already have all the routes that the other layer-3 switch has.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF is one choice for a routing protocol, but it is an industry standard, and just about every business-grade router supports it. It is also very well understood by most network engineers, and fairly simple to configure.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-11T17:50:02.120" LastActivityDate="2016-05-11T17:50:02.120" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="30305" PostTypeId="2" ParentId="30292" CreationDate="2016-05-11T18:18:23.890" Score="2" Body="&lt;p&gt;ARQ and CSMA/CA serve different purposes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARQ (and similar mechanisms) ensure reliable communications, giving confirmation that data has been received correctly.  Received packets are acknowledged by the receiver so that the sender knows they have in fact been received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CSMA/CA is a method of sharing a common media (radio channel) among multiple senders.  It allows multiple, independent senders to use a media where only one sender can transmit at a time.  Each sender waits until the media is idle before transmitting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And to answer your second question:  Yes, that's the whole point.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-11T18:18:23.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30308" PostTypeId="1" AcceptedAnswerId="30339" CreationDate="2016-05-11T18:41:29.020" Score="1" ViewCount="11131" Body="&lt;p&gt;Clients set up with static IPs and static DNS entries pointed to my SonicWALL at 192.168.0.1 fail to resolve DNS lookup request. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client DNS -&gt; 192.168.0.1 (DNS look ups fail)&#xA;Client DNS -&gt; Dynamic (SonicWALL assigns the proper DNS server to the client)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an existing environment and need my clients DNS server to point to the SonicWALL, and have it forward the requests to the to the appropriate server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the name for it is DNS forwarding? So do I set this up? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: All my WAN / DNS settings are already configured. I just need to set up the forwarding part.&lt;/p&gt;&#xA;" OwnerUserId="25299" LastEditorUserId="8499" LastEditDate="2016-05-12T02:03:19.127" LastActivityDate="2016-05-12T14:58:35.713" Title="SonicWALL TZ 300 DNS Forwarding" Tags="|sonicwall|dns|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30310" PostTypeId="1" AcceptedAnswerId="30556" CreationDate="2016-05-11T20:16:40.387" Score="0" ViewCount="1455" Body="&lt;p&gt;Some weeks ago I installed &lt;a href=&quot;https://www.pfsense.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;pfSense&lt;/a&gt; on one of these &lt;a href=&quot;http://www.pcengines.ch/apu2c4.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;boards&lt;/a&gt;, it has been working well, but today weird things started to happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Webpages did not load properly, but only specific elements fail (date selector &lt;a href=&quot;http://gotlandsbaten.se&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; for example did not work). I've been unable to pinpoint exactly what fails, just some pages don't work as they should.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connecting my laptop outside of the firewall makes the weird behaviour disappear. Now after nuke-and-paving most of the pfSense config things seem to work reasonably well, but I still see some issues with the firewall itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When troubleshooting I started looking at the pfSense web UI, and certain pages load real slowly, most consistent is the update page, which loads slow enough for nginx to time-out most of the time:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/HX7h4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HX7h4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Zweha.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zweha.png&quot; alt=&quot;nginx 504 Gateway Time-out&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've re-installed pfSense, switched from nanobsd to normal install, but behaviour is the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I reload the page enough times it will load successfully eventually:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YkVkQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YkVkQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The spinning cog on the dashboard suffer from the same issue:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dyxxj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dyxxj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also done pfSense factory default reset, but it is still behaving weirdly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tonight internet is behaving weirdly again, even with the slimmed down config from yesterday.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example the first two connections work and the third fail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;➜  ~ curl-trace https://redmine.pfsense.org/issues/5434                                      &#xA;&#xA;Request Details:&#xA;url: https://redmine.pfsense.org/issues/5434&#xA;num_redirects: 0&#xA;content_type: text/html; charset=utf-8&#xA;response_code: 200&#xA;remote_ip: 208.123.73.75&#xA;&#xA;Timing Analysis:&#xA;time_namelookup: 0.005&#xA;time_connect: 0.197&#xA;time_appconnect: 0.963&#xA;time_pretransfer: 0.963&#xA;time_redirect: 0.000&#xA;time_starttransfer: 1.422&#xA;----------&#xA;time_total: 1.578&#xA;&#xA;➜  ~ curl-trace https://redmine.pfsense.org/issues/5434&#xA;&#xA;Request Details:&#xA;url: https://redmine.pfsense.org/issues/5434&#xA;num_redirects: 0&#xA;content_type: text/html; charset=utf-8&#xA;response_code: 200&#xA;remote_ip: 208.123.73.75&#xA;&#xA;Timing Analysis:&#xA;time_namelookup: 0.005&#xA;time_connect: 0.161&#xA;time_appconnect: 0.948&#xA;time_pretransfer: 0.948&#xA;time_redirect: 0.000&#xA;time_starttransfer: 1.486&#xA;----------&#xA;time_total: 1.643&#xA;&#xA;➜  ~ curl-trace https://redmine.pfsense.org/issues/5434&#xA;&#xA;Request Details:&#xA;url: https://redmine.pfsense.org/issues/5434&#xA;num_redirects: 0&#xA;content_type: &#xA;response_code: 000&#xA;remote_ip: &#xA;&#xA;Timing Analysis:&#xA;time_namelookup: 0.004&#xA;time_connect: 0.000&#xA;time_appconnect: 0.000&#xA;time_pretransfer: 0.000&#xA;time_redirect: 0.000&#xA;time_starttransfer: 0.000&#xA;----------&#xA;time_total: 74.512&#xA;&#xA;➜  ~ alias | grep curl-trace&#xA;curl-trace='curl -L -w &quot;@/Users/user/.curl-format&quot; -o /dev/null -s'&#xA;➜  ~ cat .curl-format&#xA;\n&#xA;Request Details:\n&#xA;url: %{url_effective}\n&#xA;num_redirects: %{num_redirects}\n&#xA;content_type: %{content_type}\n&#xA;response_code: %{response_code}\n&#xA;remote_ip: %{remote_ip}\n&#xA;\n&#xA;Timing Analysis:\n&#xA;time_namelookup: %{time_namelookup}\n&#xA;time_connect: %{time_connect}\n&#xA;time_appconnect: %{time_appconnect}\n&#xA;time_pretransfer: %{time_pretransfer}\n&#xA;time_redirect: %{time_redirect}\n&#xA;time_starttransfer: %{time_starttransfer}\n&#xA;----------\n&#xA;time_total: %{time_total}\n&#xA;\n&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Behaviour is the same when run from the firewall directly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[2.3-RELEASE][root@pfSense]/root: curl -L -w &quot;@/root/.curl-format&quot; -o /dev/null -s https://redmine.pfsense.org/issues/5434&#xA;&#xA;Request Details:&#xA;url: https://redmine.pfsense.org/issues/5434&#xA;num_redirects: 0&#xA;content_type: text/html; charset=utf-8&#xA;response_code: 200&#xA;remote_ip: 208.123.73.75&#xA;&#xA;Timing Analysis:&#xA;time_namelookup: 0.268&#xA;time_connect: 0.422&#xA;time_appconnect: 1.700&#xA;time_pretransfer: 1.700&#xA;time_redirect: 0.000&#xA;time_starttransfer: 2.137&#xA;----------&#xA;time_total: 2.904&#xA;&#xA;[2.3-RELEASE][root@pfSense]/root: curl -L -w &quot;@/root/.curl-format&quot; -o /dev/null -s https://redmine.pfsense.org/issues/5434&#xA;&#xA;Request Details:&#xA;url: https://redmine.pfsense.org/issues/5434&#xA;num_redirects: 0&#xA;content_type: &#xA;response_code: 000&#xA;remote_ip: &#xA;&#xA;Timing Analysis:&#xA;time_namelookup: 0.005&#xA;time_connect: 0.000&#xA;time_appconnect: 0.000&#xA;time_pretransfer: 0.000&#xA;time_redirect: 0.000&#xA;time_starttransfer: 0.000&#xA;----------&#xA;time_total: 74.128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And can be replicated with more household targets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[2.3-RELEASE][root@pfSense]/root: curl -L -w &quot;@/root/.curl-format&quot; -o /dev/null -s https://facebook.com&#xA;&#xA;Request Details:&#xA;url: https://facebook.com/&#xA;num_redirects: 0&#xA;content_type:&#xA;response_code: 000&#xA;remote_ip:&#xA;&#xA;Timing Analysis:&#xA;time_namelookup: 0.032&#xA;time_connect: 0.000&#xA;time_appconnect: 0.000&#xA;time_pretransfer: 0.000&#xA;time_redirect: 0.000&#xA;time_starttransfer: 0.000&#xA;----------&#xA;time_total: 74.707&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ping works when https does not:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--- 208.123.73.75 ping statistics ---&#xA;128 packets transmitted, 127 packets received, 0.8% packet loss&#xA;round-trip min/avg/max/stddev = 153.258/154.631/156.355/0.897 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;tcpdump on the internet facing interface of the pfsense looks like this when connection fails:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20:05:38.825739 IP c83-249-212-155.bredband.comhem.se.35177 &amp;gt; redmine.pfsense.org.https: Flags [S], seq 2899311544, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 24901876 ecr 0], length 0&#xA;20:05:41.825422 IP c83-249-212-155.bredband.comhem.se.35177 &amp;gt; redmine.pfsense.org.https: Flags [S], seq 2899311544, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 24904876 ecr 0], length 0&#xA;20:05:45.025395 IP c83-249-212-155.bredband.comhem.se.35177 &amp;gt; redmine.pfsense.org.https: Flags [S], seq 2899311544, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 24908076 ecr 0], length 0&#xA;20:05:48.225507 IP c83-249-212-155.bredband.comhem.se.35177 &amp;gt; redmine.pfsense.org.https: Flags [S], seq 2899311544, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 24911276 ecr 0], length 0&#xA;20:05:51.425435 IP c83-249-212-155.bredband.comhem.se.35177 &amp;gt; redmine.pfsense.org.https: Flags [S], seq 2899311544, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 24914476 ecr 0], length 0&#xA;20:05:54.625394 IP c83-249-212-155.bredband.comhem.se.35177 &amp;gt; redmine.pfsense.org.https: Flags [S], seq 2899311544, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 24917676 ecr 0], length 0&#xA;20:06:00.825409 IP c83-249-212-155.bredband.comhem.se.35177 &amp;gt; redmine.pfsense.org.https: Flags [S], seq 2899311544, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 24923876 ecr 0], length 0&#xA;20:06:13.025405 IP c83-249-212-155.bredband.comhem.se.35177 &amp;gt; redmine.pfsense.org.https: Flags [S], seq 2899311544, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 24936076 ecr 0], length 0&#xA;20:06:37.225431 IP c83-249-212-155.bredband.comhem.se.35177 &amp;gt; redmine.pfsense.org.https: Flags [S], seq 2899311544, win 65228, options [mss 1460,nop,wscale 7,sackOK,TS val 24960276 ecr 0], length 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MTU has me a bit bewildered, but pinging shows that the limit of 1500 is probably honed all the way out iirc (please correct me if I read that wrong):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[2.3-RELEASE][root@pfSense]/root: ping -s 1471 -n -c 1 redmine.pfsense.org&#xA;PING redmine.pfsense.org (208.123.73.75): 1471 data bytes&#xA;1479 bytes from 208.123.73.75: icmp_seq=0 ttl=48 time=155.314 ms&#xA;&#xA;--- redmine.pfsense.org ping statistics ---&#xA;1 packets transmitted, 1 packets received, 0.0% packet loss&#xA;round-trip min/avg/max/stddev = 155.314/155.314/155.314/0.000 ms&#xA;[2.3-RELEASE][root@pfSense]/root: ping -s 1472 -n -c 1 redmine.pfsense.org&#xA;PING redmine.pfsense.org (208.123.73.75): 1472 data bytes&#xA;&#xA;--- redmine.pfsense.org ping statistics ---&#xA;1 packets transmitted, 0 packets received, 100.0% packet loss&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I seem to be able to set both MTU and MSS in pfsense: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/rXiuh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rXiuh.png&quot; alt=&quot;pfsense MTU and MSS settings&quot;&gt;&lt;/a&gt;&#xA;But unfortunately(?) I'm currently unable to reproduce the problem. Which leads me to further believe that the problem was upstream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I prove/determine whether it is my box or the ISP that is the culprit? When I start changing the configuration (moving cables and such) the problem have a tendency to &quot;snap back&quot; into working shape for a while.&lt;/p&gt;&#xA;" OwnerUserId="15356" LastEditorUserId="15356" LastEditDate="2016-05-19T09:13:57.027" LastActivityDate="2016-05-19T09:59:23.200" Title="pfSense update page (and/or regular web pages) not loading properly" Tags="|firewall|internet|pfsense|pfsense-2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30311" PostTypeId="1" CreationDate="2016-05-11T20:31:40.750" Score="3" ViewCount="1819" Body="&lt;p&gt;I know North Korea has an internet separated from other countries', but some people say its somehow connected to our Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I asked myself: can you download sites you want (with Firefox or something else), and make your own internet infrastructure with one or more server PCs and an endless amount of routers?&lt;/p&gt;&#xA;" OwnerUserId="25302" LastEditorUserId="8499" LastEditDate="2016-05-12T02:01:27.103" LastActivityDate="2021-10-18T22:27:11.323" Title="Can you make another internet?" Tags="|internet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30312" PostTypeId="2" ParentId="30311" CreationDate="2016-05-11T20:41:18.530" Score="6" Body="&lt;p&gt;An internet is just a bunch of connected networks. There are internets all over the world, but what we call the (public) Internet (capital &quot;I&quot;) is just the largest, consisting of connected ISP networks. There is nothing to keep a different group from creating an alternative Internet, but using public IP addresses and ASes already assigned for use on the Internet would preclude it from being connected to the existing Internet. Connecting an internet to the existing Internet would require following the existing Internet addressing and policies, and is really just extending the existing Internet. You would be hard-pressed to find any ISPs or customers willing to sign up for an alternative Internet, unless you have a totalitarian regime which mandates it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-11T20:41:18.530" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30314" PostTypeId="1" CreationDate="2016-05-11T22:40:34.813" Score="1" ViewCount="4734" Body="&lt;p&gt;This is my first question on Network Engineering SE, so I apologize if it is not up to par.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to help a local business with their network setup, and I have hit a road block. Basically, they have a piece of software that requires a &quot;server&quot; computer to have the IP address &lt;code&gt;192.168.127.1&lt;/code&gt;. Subsequent &quot;client&quot; computers are numbered &lt;code&gt;192.168.127.2&lt;/code&gt;, etc. and all have a subnet mask of &lt;code&gt;255.255.128.0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue I have come across is that they recently switched Internet providers, and their new gateway/modem is set up as &lt;code&gt;192.168.2.1&lt;/code&gt;. Since each machine on the network has a static IP address on a different subnet than the gateway, they are unable to communicate with the Internet, although they can still communicate with the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial thought was to just change the local-facing interface of the gateway to &lt;code&gt;192.168.127.1&lt;/code&gt;, but that idea was shot down by the requirement of their software, so &lt;code&gt;192.168.127.1&lt;/code&gt; is already taken.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then thought perhaps I could change the subnet mask of the gateway to &lt;code&gt;255.255.128.0&lt;/code&gt;, which (&lt;em&gt;I think&lt;/em&gt;) would put the gateway and the computers on the same subnet. However, the gateway only allows &lt;code&gt;255.255.255.0&lt;/code&gt;, &lt;code&gt;255.255.255.128&lt;/code&gt;, and &lt;code&gt;255.255.255.224&lt;/code&gt; (or something very close to that last one).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So currently, we are basically stuck in an either/or, where they can either be on the LAN using a static IP address and communicate with their software, or use DHCP and be able to browse the Internet, but without the ability to access the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The strange thing is, using the static IP addresses some sites still works, such as Google. It appears that IPv6 is still able to work, but not all sites support IPv6 yet, so it is a very limited subset of the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried manually entering an IPv4 DNS server, but that also has not worked. I am no networking expert, so this may be a very elementary question, but I am hoping that someone here may be able to shed some light on this situation.&lt;/p&gt;&#xA;" OwnerUserId="25305" LastEditorUserId="8499" LastEditDate="2016-05-12T01:58:24.010" LastActivityDate="2016-05-12T01:58:24.010" Title="Communicate between router on different subnet" Tags="|routing|ipv4|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-14T02:44:07.570" ContentLicense="CC BY-SA 3.0" />
  <row Id="30315" PostTypeId="2" ParentId="30314" CreationDate="2016-05-11T23:05:06.010" Score="1" Body="&lt;p&gt;The router needs to be the gateway for the hosts, and the gateway address needs to be in the same network as the hosts. The router should be addressed with the same address that the previous router had, which will be in the same network as the existing hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router will not accommodate a valid network mask, I have to assume it is a consumer-grade router, and questions about those are off-topic here. It should be replaced with a router which can be correctly configured. As a temporary workaround. You can set a shorter mask than was previously configured, e.g. &lt;code&gt;/24&lt;/code&gt;. Just realize that any hosts added with an address in which the last octet is greater than 126 will not be able to communicate with existing devices, or vice versa. Also, anything which depends on using the &lt;code&gt;192.168.127.127&lt;/code&gt; broadcast address will not work. Also, if the network mask is shortened, the masks on the hosts could be changed to match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is all for IPv4. IPv6 doesn't work the same way, and the IPv6 network will be a &lt;code&gt;/64&lt;/code&gt;, which allows for 18,446,744,073,709,551,616 hosts.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-11T23:05:06.010" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30316" PostTypeId="1" CreationDate="2016-05-11T23:12:01.700" Score="1" ViewCount="389" Body="&lt;p&gt;Through this topology, I want to decrease the buffer size of R2 in order to generate an &lt;em&gt;ICMP Source Quench Message&lt;/em&gt;, but I have no idea how to do it. I'm open to other suggestions to generate a &lt;em&gt;Source Quench Message&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using: &lt;strong&gt;Cisco Internetwork Operating System Software IOS (tm) 2600 Software (C2691-ENTSERVICESK9-M), Version 12.3(16)&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eKlwV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eKlwV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14008" LastEditorUserId="8499" LastEditDate="2016-05-12T01:54:02.347" LastActivityDate="2016-05-12T01:54:02.347" Title="Decrease the Router's buffer size" Tags="|cisco|router|icmp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30317" PostTypeId="2" ParentId="30314" CreationDate="2016-05-11T23:15:50.520" Score="1" Body="&lt;p&gt;First, let me rant against clueless software developers who hard code IP addresses or require fixed subnets, as in this case.  There is a special place in hell for them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(End of Rant)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will probably have to go out and buy a new router (gateway/modem) that doesn't preset subnet masks.  Any commercial grade router will do, and you should ask your ISP for a recommendation.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set the new gateway address to 192.168.127.126, assuming that address is unused.  The mask will be the same as the others, 255.255.128.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Change the default gateway on every client (and server) to the new gateway address.  If you find that time consuming, you'll understand why smart people use DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set the DNS server address on the clients to the ISPs recommendation, or use a public server such as Google (8.8.8.8).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After you get everything working, go back to the software developer and kick them in the shins for me.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-11T23:15:50.520" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30318" PostTypeId="2" ParentId="30316" CreationDate="2016-05-11T23:22:10.570" Score="2" Body="&lt;p&gt;First, understand that you are doing something that you will likely never see in real life.  I don't know if routers will even generate source quench responses.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/10000-series-routers/15091-buffertuning.html&quot; rel=&quot;nofollow&quot;&gt;Here is a document that discusses how to adjust buffers&lt;/a&gt;.  I will quote only one sentence which summarizes the doument and my thoughts succinctly:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note: Normally, interface buffers should not be tuned.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-11T23:22:10.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30319" PostTypeId="2" ParentId="30316" CreationDate="2016-05-11T23:28:03.237" Score="1" Body="&lt;p&gt;It is possible, but as Ron Trunk pointed out, it is not a good idea to do it by messing with the hardware. You can use QoS to do this also. Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map Test&#xA; class class-default&#xA;  queue-limit &amp;lt;low&amp;gt; &amp;lt;high&amp;gt;&#xA;&#xA;interface Serial0/0&#xA; service-policy output Test&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/command/reference/fqos_r/qrfcmd6.html&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS Quality of Service Solutions Command Reference, Release 12.2&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-11T23:28:03.237" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30320" PostTypeId="2" ParentId="30308" CreationDate="2016-05-12T00:05:48.717" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Clients set up with static IPs and static DNS entries pointed to my&#xA;  SonicWall at 192.168.0.1 fail to resolve DNS lookup request.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You only do this if the SonicWALL is the DNS server, and, from everything I can find, the SonicWALL will not act as a DNS server.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The DNS servers are just Google's public DNS servers at 8.8.8.8 &amp;amp;&#xA;  8.8.4.4.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If that is the case, you configure the host DNS entries to those addresses, not the SonicWALL. You only configure the host DNS entries to the SonicWALL if it is your DNS server.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-12T00:05:48.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30322" PostTypeId="1" AcceptedAnswerId="30323" CreationDate="2016-05-12T01:23:50.100" Score="0" ViewCount="385" Body="&lt;p&gt;I am currently working on this project where I have to find the location of a Wi-Fi enabled device such as our smartphone based. I can configure a raspberry pi to sniff out the wireless packet and measure the received packets based on the dBm. How can I find the exact location of the device? I don't understand how to do triangulation.&lt;/p&gt;&#xA;" OwnerUserId="21147" LastActivityDate="2017-08-05T15:18:20.770" Title="How to find the detection of a WiFi-enabled device based on signal strength?" Tags="|wireless|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="30323" PostTypeId="2" ParentId="30322" CreationDate="2016-05-12T02:29:11.450" Score="1" Body="&lt;p&gt;For tracking and triangulate some devices you need to measure the signal from differents points. You need to locate on the space some devices, that is the reason why you can't get a result with one signal strength, first, you need to put on a fixed locations some references to take the signal power. One you get that measure, you need to put that data on sone algorithm that calculate the distance taking on mind the losses on a typical propagation media, first you need to elaborate some ecuation with thats variables. &lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-05-12T02:29:11.450" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30326" PostTypeId="1" AcceptedAnswerId="30327" CreationDate="2016-05-12T05:22:45.467" Score="1" ViewCount="687" Body="&lt;p&gt;I have configured a network environment, as below screenshot. Now I want the laptop n5 to connect to n10. When I run the traceroute command, it shows that the n5 can only reach to router n8. How can I let the router n8 connect to the router n1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rgkR1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rgkR1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25309" LastEditorUserId="8499" LastEditDate="2016-05-12T05:31:03.790" LastActivityDate="2016-05-12T05:31:03.790" Title="How to configure two routers to be connected with each other?" Tags="|routing|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30327" PostTypeId="2" ParentId="30326" CreationDate="2016-05-12T05:26:36.187" Score="1" Body="&lt;p&gt;You either need to run a routing protocol between the two routers so that they can share routes, or you need to put static routes on each router pointing to the other router for routes on the other router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static routes don't scale. Using a routing protocol can automatically share routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will probably learn RIP first. Something like this on each router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA; version 2&#xA; no auto-summary&#xA; network 10.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-12T05:26:36.187" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30328" PostTypeId="1" AcceptedAnswerId="30355" CreationDate="2016-05-12T07:47:04.947" Score="2" ViewCount="6153" Body="&lt;p&gt;Does anyone know of an equivalent &quot;default interface X&quot; comand for the Cisco Nexus 5000 platform?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch&amp;gt;en  &#xA;switch# conf t  &#xA;switch#(config)# default interface x  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-&gt; dead thread here about the topic:&#xA;&lt;a href=&quot;https://supportforums.cisco.com/discussion/10743451/nexus-5k-w413-default-interface&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/10743451/nexus-5k-w413-default-interface&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="509" LastEditDate="2016-05-13T05:13:23.037" LastActivityDate="2016-05-13T05:13:23.037" Title="default interface cmd on cisco nexus 5k" Tags="|cisco|cli|cisco-nexus|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30330" PostTypeId="1" CreationDate="2016-05-12T10:21:41.557" Score="1" ViewCount="9884" Body="&lt;p&gt;I am trying to monitor network devices in our company using SCOM. So far the devices are not responding to SNMP request. These devices support SNMP. Firewall is not an issue since the monitoring server is already in the company's network. Trying the command below gave the following result for one device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~$ snmpget -v 1 -c ro345iu5672 11.248.154.10 .1.3.6.1.2.1.1.1.0&#xA;Timeout: No Response from 11.248.154.10.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additional research suggested that the target SNMP device needs to enable the whole system MIB/OID-tree to be discoverable in SCOM. If any of the following OIDs are missing, you will not be able to discover the device:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;• 1.3.6.1.2.1.1.1.0 --&amp;gt; system.sysDescr&#xA;• 1.3.6.1.2.1.1.2.0 --&amp;gt; system.sysObjectID&#xA;• 1.3.6.1.2.1.1.4.0 --&amp;gt; system.sysContact&#xA;• 1.3.6.1.2.1.1.5.0 --&amp;gt; system.sysName&#xA;• 1.3.6.1.2.1.1.6.0 --&amp;gt; system.sysLocation&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I enable these OID's for a network device?&lt;/p&gt;&#xA;" OwnerUserId="25312" LastActivityDate="2016-08-13T11:10:57.343" Title="No Response SNMP" Tags="|snmp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30331" PostTypeId="2" ParentId="30330" CreationDate="2016-05-12T11:02:54.170" Score="1" Body="&lt;p&gt;You probarly need to enable SNMP on your devices, with the correct community, unless you do that, no response could be received by your SCOM. If you already done this, then you can check on the logs of your devices to see if SNMP request are received, and some kind of error, if happens. It is not, you need to check if the SNMP default port, 161, are been filtered in some place. Remember, this is only a global answer, every equipment have it owns steps to configure SNMP. If yow can't resolve, you can edit your question and put devices model.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2016-08-13T11:10:57.343" LastActivityDate="2016-08-13T11:10:57.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30332" PostTypeId="2" ParentId="30330" CreationDate="2016-05-12T11:52:26.623" Score="2" Body="&lt;p&gt;There is pretty simple scenario to access device via SNMP and get information you want.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Enable SNMP on the device, select SNMP version (v1, v2c, v3), set read/write community (it's like &quot;password&quot; in SNMP)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Find out MIB file for that device vendor/product(usually developers include .mib files with firmware versions/updates)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check exactly what that device can &quot;tell&quot; you via SNMP (check MIB file), it's usually easier to do with some software like Castle Rock SNMPc Network Manager or some else products, that can &quot;scan&quot; device using IP address, mib file, and communities you wrote in. (yeah, this is for win* systems, but I'm pretty sure there is *nix alternatives). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After you have found what exactly you need to know - you will know OID, and should use the command you wrote above to get info you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, responding for your situation. I guess you should do steps in this order:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Check network connection to this device (if we are assuming that ping is working - than you should use check 161 port as mentioned above by Orlando.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check that your device have SNMP=enabled in configuration. Check SNMP version and communities.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Check that your device know something about OID you are writing there (but I guess it's not the case cause there should be some respond at all, even with wrong OID. imo.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25314" LastActivityDate="2016-05-12T11:52:26.623" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30334" PostTypeId="1" AcceptedAnswerId="30336" CreationDate="2016-05-12T12:55:37.460" Score="0" ViewCount="1094" Body="&lt;p&gt;Linux bridges operate at layer 2 and therefore can only switch packets between interfaces whose mac addresses are contained in a single bridge; a full router operates at layer 3, and thus allows packets to be forwarded/routed to other networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering this, from a security standpoint, is the reason one would use a linux bridge to limit which systems can communicate with one another?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read the tag description of this, but it's still a little bit unclear.&lt;/p&gt;&#xA;" OwnerUserId="16753" LastActivityDate="2016-05-14T00:59:39.840" Title="What is the security purpose of a bridge?" Tags="|bridge|terminology|" AnswerCount="4" CommentCount="0" ClosedDate="2019-03-13T06:22:46.713" ContentLicense="CC BY-SA 3.0" />
  <row Id="30335" PostTypeId="2" ParentId="30334" CreationDate="2016-05-12T13:21:41.957" Score="0" Body="&lt;p&gt;Short answer: No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The choice to use a bridge or router depends much more on the topology design, type of media used, physical distance, cost, &lt;em&gt;etc&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There may be security benefits to create isolated layer 2 networks, but that is still more of a topological decision.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-12T13:21:41.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30336" PostTypeId="2" ParentId="30334" CreationDate="2016-05-12T13:28:31.540" Score="2" Body="&lt;p&gt;The &lt;em&gt;bridge / switch&lt;/em&gt; concept wasn't created as a security solution. Its main goal was to alleviate the problem that arises when there is a high number of devices attached to a single ethernet network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When ethernet networks were a bunch of hubs together you could have hundreds of workstations sharing the same &lt;strong&gt;collision domain&lt;/strong&gt; and the same &lt;em&gt;broadcast domain&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As more stations you have in a single collision domain, the chances of transmitting without collisions is lower, and the results are: more retransmissions and a perception of slow network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bridge divides the network in a number of &lt;em&gt;collision domains&lt;/em&gt; equal to the number of ports the bridge has and maintaining a single broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result is less collisions for the same number of workstations, improving the general speed of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ultimate bridge is the switch, where each workstation is inside its own collision domain, letting the workstations to use full duplex (because as there are not collisions, the workstation can transmit and receive simultaneously).&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-05-12T14:25:29.900" LastActivityDate="2016-05-12T14:25:29.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30337" PostTypeId="1" CreationDate="2016-05-12T13:59:45.803" Score="1" ViewCount="907" Body="&lt;p&gt;Can someone please reply&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does Cisco 3560 L3 Switch support VRRP with other vendor's switch? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What have been implemented here , Is there any misconfiguration in this running config? &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 7227 bytes&#xA;!&#xA;! No configuration change since last restart&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service tcp-keepalives-in&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;service password-encryption&#xA;!&#xA;hostname switcha1&#xA;!&#xA;enable secret 5 $1$Ep$ebh/HkAoj.XWyya0f.&#xA;!&#xA;no aaa new-model&#xA;clock timezone BLABLABLA 4&#xA;system mtu routing 1500&#xA;vtp mode transparent ?&#xA;ip subnet-zero ?&#xA;ip routing&#xA;no ip domain-lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;vlan 10&#xA;name LAN_A&#xA;!&#xA;vlan 20&#xA;name LAN_B&#xA;!&#xA;vlan 30&#xA;name LAN_C&#xA;!&#xA;vlan 40&#xA;name LAN_D&#xA;!&#xA;vlan 101&#xA;name 1_DFEP&#xA;!&#xA;vlan 102&#xA;name 2_DFEP&#xA;!&#xA;vlan 103&#xA;name 3_DFEP&#xA;!&#xA;vlan 104&#xA;name 4_DFEP&#xA;!&#xA;vlan 105&#xA;name 5_DFEP&#xA;!&#xA;vlan 106&#xA;name 6_DFEP&#xA;!&#xA;vlan 107&#xA;name 7_DFEP&#xA;!&#xA;vlan 108&#xA;name 8_DFEP&#xA;!&#xA;interface Port-channel1 ?&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/2&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/3&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/4&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/5&#xA;!&#xA;interface GigabitEthernet0/5&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/6&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/7&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/8&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/9&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/10&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/11&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/12&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/13&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/14&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/15&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/16&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/17&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/18&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/19&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/20&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/21&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/22&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/23&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/24&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/25&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/26&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/27&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/28&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/29&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/30&#xA;switchport access vlan 30&#xA;!&#xA;interface GigabitEthernet0/31&#xA;switchport access vlan 30&#xA;!&#xA;interface GigabitEthernet0/32&#xA;switchport access vlan 30&#xA;!&#xA;interface GigabitEthernet0/33&#xA;switchport access vlan 30&#xA;!&#xA;interface GigabitEthernet0/34&#xA;switchport access vlan 30&#xA;!&#xA;interface GigabitEthernet0/35&#xA;switchport access vlan 101&#xA;switchport mode access&#xA;!&#xA;interface GigabitEthernet0/36&#xA;switchport access vlan 102&#xA;switchport mode access&#xA;!&#xA;interface GigabitEthernet0/37&#xA;switchport access vlan 103&#xA;switchport mode access&#xA;!&#xA;interface GigabitEthernet0/38&#xA;switchport access vlan 104&#xA;switchport mode access&#xA;!&#xA;interface GigabitEthernet0/39&#xA;switchport access vlan 105&#xA;switchport mode access&#xA;!&#xA;interface GigabitEthernet0/40&#xA;switchport access vlan 106&#xA;!&#xA;interface GigabitEthernet0/41&#xA;switchport access vlan 107&#xA;!&#xA;interface GigabitEthernet0/42&#xA;switchport access vlan 108&#xA;switchport mode access&#xA;!&#xA;interface GigabitEthernet0/43&#xA;switchport access vlan 20&#xA;switchport mode access&#xA;!&#xA;interface GigabitEthernet0/44&#xA;switchport access vlan 20&#xA;switchport mode access&#xA;!&#xA;interface GigabitEthernet0/45&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/46&#xA;switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet0/47&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;channel-group 1 mode desirable&#xA;!&#xA;interface GigabitEthernet0/48&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;channel-group 1 mode desirable&#xA;!&#xA;interface GigabitEthernet0/49&#xA;!&#xA;interface GigabitEthernet0/50&#xA;!&#xA;interface GigabitEthernet0/51&#xA;!&#xA;interface GigabitEthernet0/52&#xA;!&#xA;interface Vlan1&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Vlan10&#xA;description Primary Site&#xA;ip address 192.168.1.252 255.255.255.0&#xA;standby 1 ip 192.168.1.254&#xA;standby 1 priority 110&#xA;standby 1 preempt&#xA;!&#xA;interface Vlan20&#xA;description FEP LAN&#xA;ip address 192.168.2.252 255.255.255.0&#xA;standby 2 ip 192.168.2.254&#xA;standby 2 priority 110&#xA;standby 2 preempt&#xA;!&#xA;interface Vlan30&#xA;description PDS/QAS&#xA;ip address 192.168.3.252 255.255.255.0&#xA;standby 3 ip 192.168.3.254&#xA;standby 3 priority 110&#xA;standby 3 preempt&#xA;!&#xA;interface Vlan40&#xA;description DTS&#xA;ip address 192.168.4.252 255.255.255.0&#xA;standby 4 ip 192.168.4.254&#xA;standby 4 priority 110&#xA;standby 4 preempt&#xA;!&#xA;interface Vlan101&#xA;description 1 DFEP&#xA;ip address 192.168.101.250 255.255.255.0&#xA;standby 1 ip 192.168.101.1&#xA;standby 1 priority 110&#xA;standby 1 preempt&#xA;!&#xA;interface Vlan102&#xA;description 2 DFEP&#xA;ip address 192.168.102.250 255.255.255.0&#xA;standby 1 ip 192.168.102.1&#xA;standby 1 priority 110&#xA;standby 1 preempt&#xA;!&#xA;interface Vlan103&#xA;description 3 DFEP&#xA;ip address 192.168.103.250 255.255.255.0&#xA;standby 1 ip 192.168.103.1&#xA;standby 1 priority 110&#xA;standby 1 preempt&#xA;!&#xA;interface Vlan104&#xA;description 4 DFEP&#xA;ip address 192.168.104.250 255.255.255.0&#xA;standby 1 ip 192.168.104.1&#xA;standby 1 priority 110&#xA;standby 1 preempt&#xA;!&#xA;interface Vlan105&#xA;description 5 DFEP&#xA;ip address 192.168.105.250 255.255.255.0&#xA;standby 1 ip 192.168.105.1&#xA;standby 1 priority 110&#xA;standby 1 preempt&#xA;!&#xA;interface Vlan106&#xA;description 6 DFEP&#xA;ip address 192.168.106.250 255.255.255.0&#xA;standby 1 ip 192.168.106.1&#xA;standby 1 priority 110&#xA;standby 1 preempt&#xA;!&#xA;interface Vlan107&#xA;description 7 DFEP&#xA;ip address 192.168.107.250 255.255.255.0&#xA;standby 1 ip 192.168.107.1&#xA;standby 1 priority 110&#xA;standby 1 preempt&#xA;!&#xA;interface Vlan108&#xA;description 8 DFEP&#xA;ip address 192.168.108.250 255.255.255.0&#xA;standby 1 ip 192.168.108.1&#xA;standby 1 priority 110&#xA;standby 1 preempt&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 192.168.1.1&#xA;no ip http server&#xA;!&#xA;access-list 13 deny any&#xA;no cdp run&#xA;!&#xA;control-plane&#xA;!&#xA;banner motd ^CWARNING: THIS SYSTEM IS RESTRICTED TO AUTHORIZED USAGE!&#xA;Unauthorized usage will be subject to criminal penalties, fines,&#xA;damages and/or disciplinary action. If you are not authorized to&#xA;use this system, you must exit immediately. If you are authorized&#xA;to use this system, you must do so in compliance with all laws,&#xA;regulations, conduct rules, and company security policies&#xA;applicable to this system.&#xA;This system, including any hardware components, software,&#xA;workstations, and storage spaces is subject to monitoring and&#xA;search without advanced notice. Users should have no&#xA;expectation of privacy in their use of any aspect of this system.^C&#xA;!&#xA;line con 0&#xA;password xx&#xA;login&#xA;line vty 0 4&#xA;password xx&#xA;login&#xA;line vty 5 15&#xA;password xx&#xA;login&#xA;!&#xA;ntp clock-period 36028790&#xA;ntp server 192.168.1.11&#xA;ntp server 192.168.1.12&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25318" LastEditorUserId="2142" LastEditDate="2016-05-12T14:07:29.073" LastActivityDate="2016-05-12T14:14:52.433" Title="Cisco 3650 VRRP and Show Run configuration" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30338" PostTypeId="2" ParentId="30337" CreationDate="2016-05-12T14:14:52.433" Score="3" Body="&lt;p&gt;Yes, Cisco supports VRRP.  However, you have configured HSRP on your interfaces, not VRRP.  The two protocols are not compatible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an &lt;a href=&quot;http://searchnetworking.techtarget.com/tip/Configuring-HSRP-and-VRRP-on-Cisco-routers&quot; rel=&quot;nofollow&quot;&gt;article&lt;/a&gt; showing the difference in configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Side note:  You included your login passwords in the configuration file.  I took the liberty of deleting them for you.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-12T14:14:52.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30339" PostTypeId="2" ParentId="30308" CreationDate="2016-05-12T14:58:35.713" Score="1" Body="&lt;p&gt;Ron is correct, SonicWALLs will not do DNS Proxy/redirection or act as a DNS forwarder. BUT you &lt;em&gt;can&lt;/em&gt; use &lt;strong&gt;NAT rules&lt;/strong&gt; to accomplish the same thing!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need your SonicWALL to act as a DNS resolver for LAN clients then configure a loopback NAT rule like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;PRE&gt;&#xA;Original Source: Any&#xA;Translated Source: WAN Primary IP            [Or your X1/WAN interface IP]&#xA;Original Destination: LAN Primary IP         [Or your X0/LAN interface IP]&#xA;Translated Destination: {Some Public DNS}    [Or an Address Group of DNS]&#xA;Original Service: DNS (Name Service)         [This is usually pre-defined]&#xA;Translated Service: Original&#xA;Inbound Interface: X0                        [Or your LAN interface]&#xA;Outbound Interface: Any&#xA;Comment: DNS forwarding for LAN IP&#xA;&lt;/PRE&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should look something like:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/IdUlf.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IdUlf.gif&quot; alt=&quot;SonicWALL DNS loopback NAT rule&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the screenshot I have an Address Object with both of Google's Public DNS addresses added. If my LAN Primary IP is 192.168.0.1 then I can give that out via DHCP (or assign it statically) and my LAN clients will be able to do DNS lookups against 192.168.0.1 such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nslookup www.stackexchange.com 192.168.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will of course need a Firewall rule that allows DNS traffic from the LAN/X0 Subnet to the SonicWall's LAN/X0 IP -- but this should exist by default [as an Any/Any rule].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done this on a variety of SonicWALL routers when I have swapped out consumer/home-grade routers that do DNS Proxy/Redirection and there were devices with Static IPs that I couldn't log into to adjust. Works fine.&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2016-05-12T14:58:35.713" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30340" PostTypeId="1" AcceptedAnswerId="30341" CreationDate="2016-05-12T16:32:01.843" Score="3" ViewCount="345" Body="&lt;p&gt;I am testing following ACL on Cisco 3850 L3 switch :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#show ip access-lists 101&#xA;Extended IP access list 101&#xA;    10 deny ip any any fragments&#xA;    20 permit ip any any (268 matches)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I applied access list on ISP side interface &lt;code&gt;in&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface TenGigabitEthernet1/1/1&#xA; description ISP&#xA; no switchport&#xA; ip address 61.XX.XX.158 255.255.255.252&#xA; ip access-group 101 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From remote host, I am doing ping with &lt;code&gt;-s 1500&lt;/code&gt; big packet size so it will get fragments, and the ACL will drop them. It looks like it works, too; I am not getting ping reply back. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make sure routing dropping packet or not, I ran &lt;code&gt;tcpdump&lt;/code&gt; on one of HOST machines, and I can see &lt;code&gt;ICMP&lt;/code&gt; packets coming in. It's strange why the router is not dropping them at &lt;code&gt;inbound&lt;/code&gt; ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ACL hit count is zero for fragments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#show ip access-lists 101&#xA;Extended IP access list 101&#xA;    10 deny ip any any fragments&#xA;    20 permit ip any any (4006 matches)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2022-11-20T01:42:57.377" LastActivityDate="2022-11-20T01:42:57.377" Title="Cisco IP Fragments ACL strange behavior" Tags="|cisco|firewall|acl|fragmentation|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="30341" PostTypeId="2" ParentId="30340" CreationDate="2016-05-12T17:17:05.607" Score="4" Body="&lt;p&gt;Apparently, this will treat an initial fragment the same as a non-fragment. The initial fragment will get through, but subsequent fragments in the same packet will be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/8014-acl-wp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Access Control Lists and IP Fragments&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;ACL Rules Flowchart&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The following flowchart illustrates the ACL rules when non-fragments,&#xA;  initial fragments, and non-initial fragments are checked against the&#xA;  ACL.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; The non-initial fragments themselves contain only Layer 3, never Layer 4 information, although the ACL may contain both Layer 3&#xA;  and Layer 4 information.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WxJti.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WxJti.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-12T17:17:05.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30344" PostTypeId="1" AcceptedAnswerId="30345" CreationDate="2016-05-12T19:02:06.607" Score="1" ViewCount="216" Body="&lt;p&gt;I'm a newbie to networking. I wanted to ask this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a transmitting device (host A) wishes to send packets to a host (B) which is on a remote network (LAN), (I understand that the datagrams are encapsulated by each layer while going down), I know routers are only concerned with IP addresses from the network layer, but what I don't understand is that the Cisco CCNA book says that when the packet reaches the receiving host's (B) router, the frame's control information is stripped off, and the packet is framed again for sending to host B. If this is true, what is in the control information in a frame? What is changed? Does the source hardware address from Host A change? If so, How? What source address is it replaced by?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I may sound confusing but I don't get the gist of this whole stripping of frames subject.&lt;/p&gt;&#xA;" OwnerUserId="25325" LastEditorUserId="8499" LastEditDate="2016-05-12T20:33:16.757" LastActivityDate="2016-05-12T20:33:16.757" Title="Host A to Host B on a remote LAN" Tags="|router|ipv4|mac|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30345" PostTypeId="2" ParentId="30344" CreationDate="2016-05-12T19:08:10.263" Score="0" Body="&lt;p&gt;When a layer-2 frame reaches a layer-3 device, like a router, the layer-2 frame is stripped off so that the router can read the layer-3 information. When the router switches the packet to a new interface, it creates a new frame for the new link. The information in the old frame headers (MAC addresses, etc.) were lost when the frame was stripped off, so the router creates a new frame with its own MAC address as the source address, and the other end of the link's MAC address as the destination address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all assumes that the intermediate links are something like ethernet, with MAC addresses. Other layer-2 protocols may be in a link, and not all layer-2 protocols use MAC addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-12T19:08:10.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30346" PostTypeId="1" AcceptedAnswerId="30350" CreationDate="2016-05-12T19:18:02.000" Score="1" ViewCount="481" Body="&lt;p&gt;I'd like to start off saying that I'm out of my scope here, but I could really use some help. Our ISP gave us the following to connect to our business class internet services.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Network: 97.105.48.72 &lt;/li&gt;&#xA;&lt;li&gt;Gateway: 97.105.48.73 &lt;/li&gt;&#xA;&lt;li&gt;Useable: 97.105.48.74 thru 97.105.48.78 &lt;/li&gt;&#xA;&lt;li&gt;Broadcast: 97.105.48.79 &lt;/li&gt;&#xA;&lt;li&gt;Size: /29 &lt;/li&gt;&#xA;&lt;li&gt;Subnet: 255.255.255.248 &lt;/li&gt;&#xA;&lt;li&gt;TWC DNS1: 209.18.47.61 &lt;/li&gt;&#xA;&lt;li&gt;TWC DNS2: 209.18.47.62&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm using a Cisco 3845 running IOS 12.4(13r). I have the switch ports on VLAN 10 getting served DHCP addresses from the router. That part seems to work fine. I have the connection from the ISP going into GigabitEthernet0/1, assigned 97.105.48.74. I'm able to ping out to the internet from the router. I tried to set up PAT from VLAN 10 to GigabitEthernet0/1. This is where things fall apart. End devices can ping 97.105.48.74, but not the ISP gateway or anything beyond.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone check out my config and let me know if they can spot any obvious errors? I'd really appreciate the help and I expect that my error is a simple one due to ignorance. Thank you very much.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2016.05.12 12:56:43 =~=~=~=~=~=~=~=~=~=~=~=&#xA;&#xA;TWC-Router#sho run&#xA;Building configuration...&#xA;&#xA;&#xA;Current configuration : 3005 bytes&#xA;!&#xA;! Last configuration change at 06:24:57 UTC Mon May 2 2016&#xA;version 15.1&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname TWC-Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;enable secret 5 $1$6nZJ$MHOdhhnr7fGeq2PvctzPI.&#xA;enable password 45rtfgvb$%RTFGVB&#xA;!&#xA;no aaa new-model&#xA;!&#xA;no network-clock-participate slot 2 &#xA;!&#xA;dot11 syslog&#xA;ip source-route&#xA;no ip routing&#xA;!&#xA;no ip cef&#xA;!&#xA;!&#xA;no ip dhcp conflict logging&#xA;ip dhcp excluded-address 192.168.1.1 192.168.1.20&#xA;!&#xA;ip dhcp pool twc-iamd&#xA; network 192.168.1.0 255.255.255.0&#xA; dns-server 209.18.47.61 209.18.47.62 &#xA; default-router 192.168.1.1 &#xA;!&#xA;!&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;voice-card 0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;crypto pki token default removal timeout 0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO3845-MB sn FOC12393HAM&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;cem 2/0/0&#xA; payload-size 32&#xA;!&#xA;cem 2/1/0&#xA; payload-size 32&#xA;!&#xA;cem 2/2/0&#xA; payload-size 32&#xA;!&#xA;cem 2/3/0&#xA; payload-size 32&#xA;!&#xA;! &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA; media-type rj45&#xA;!&#xA; interface GigabitEthernet0/1&#xA; ip address 97.105.48.74 255.255.255.248&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; no ip route-cache&#xA; duplex auto&#xA; speed auto&#xA; media-type rj45&#xA;!&#xA;interface Serial0/0/0&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/0/1&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/1/0&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/1/1&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface FastEthernet1/0&#xA; switchport access vlan 10&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface FastEthernet1/2&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/3&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/4&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/5&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/6&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/7&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/8&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/9&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/10&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/11&#xA;no ip address&#xA;!&#xA;interface FastEthernet1/12&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/13&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/14&#xA; no ip address&#xA;!&#xA;interface FastEthernet1/15&#xA; no ip address&#xA; no mop enabled&#xA;!&#xA;interface GigabitEthernet1/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.1.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;ip default-gateway 97.105.48.73&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip nat inside source list 1 interface GigabitEthernet0/1 overload&#xA;ip route 0.0.0.0 0.0.0.0 97.105.48.73&#xA;!&#xA;access-list 1 permit 192.168.1.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;snmp-server community public RO&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;mgcp profile default&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA; password 45rtfgvb$%RTFGVB&#xA; login&#xA; transport input all&#xA;!&#xA;scheduler allocate 20000 1000&#xA;end&#xA;&#xA;TWC-Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25326" LastEditorUserId="8499" LastEditDate="2018-12-23T06:04:37.710" LastActivityDate="2018-12-23T06:04:37.710" Title="VLAN with PAT cannot get past router" Tags="|cisco|router|vlan|nat|dhcp|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="30347" PostTypeId="1" CreationDate="2016-05-12T19:19:13.367" Score="1" ViewCount="631" Body="&lt;p&gt;I currently have an interface on each switch configured as a trunk between the two switches. I want to now add another interface on each switch to increase the bandwidth between the two. I am thinking about using a port channel, and assigning these ports to the port channel. Will I lose connectivity (temporarily) between the two switches when I do this?&lt;/p&gt;&#xA;" OwnerUserId="25327" LastEditorUserId="8499" LastEditDate="2016-05-12T20:35:47.660" LastActivityDate="2017-10-06T12:17:00.660" Title="Converting trunk interface to be in an ether-channel mode between cisco 3650 and 4500X" Tags="|cisco|switching|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30349" PostTypeId="2" ParentId="30347" CreationDate="2016-05-12T19:37:06.297" Score="0" Body="&lt;p&gt;The link will probably glitch when you do this, and if you make an error, you will likely send ports into &lt;code&gt;err-disable&lt;/code&gt;. The real way to do this is to shut the ports down, build the port channel interface, add the ports to the channel, then bring up the ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, understand that you will not increase the usable bandwidth for a single data flow. Each flow will only use one of the links in a port channel.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-12T19:37:06.297" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30350" PostTypeId="2" ParentId="30346" CreationDate="2016-05-12T19:57:51.407" Score="1" Body="&lt;p&gt;You have disabled routing on the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip routing&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will need to enable routing in order for the router to route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-12T19:57:51.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30351" PostTypeId="2" ParentId="30346" CreationDate="2016-05-12T19:58:03.820" Score="1" Body="&lt;pre&gt;&lt;code&gt;no ip routing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For **** sake. I would really like to know how that crap gets entered into the config. It's a &lt;strong&gt;&lt;em&gt;router&lt;/em&gt;&lt;/strong&gt;, and someone's perfect default is to &lt;em&gt;turn off routing&lt;/em&gt;. (Also, they turn &lt;em&gt;on&lt;/em&gt; source-route, but turn &lt;em&gt;off&lt;/em&gt; cef! As well as force all interfaces to process-switching -- &lt;em&gt;no ip route-cache&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[PS: This is not remotely the first time I've seen this. In fact, it's &lt;em&gt;so f'ing prevalent&lt;/em&gt; it's the first thing I look for.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-12T19:58:03.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30353" PostTypeId="1" CreationDate="2016-05-12T20:42:53.763" Score="2" ViewCount="1489" Body="&lt;p&gt;the CCNA guide states that the CSMA/CD protocol is used to stop devices on the same medium e.g. same wire like on a bus network transmitting simultaneously to avoid collisions. Now please tell me, if 5 hosts are connected to a hub (one on each wire) does CSMA help here? I always thought it didnt because they're on separate wires on each port on the hub, and the hub forwards all frames onto all interfaces by default, therefore making hubs half duplex, but does CSMA even come into play if the hosts are on separate wires? Another thing, if you have a full duplex ethernet cable and connect to a hub, why can't run it full duplex? Can a switch only run full duplex if a full duplex ethernet cable is connected? Does the host/device on the other end have to run full duplex too?&lt;/p&gt;&#xA;" OwnerUserId="25325" LastEditorUserId="8499" LastEditDate="2018-03-22T17:37:37.000" LastActivityDate="2018-03-22T17:37:37.000" Title="CSMA/CD Confusion/Misunderstanding" Tags="|ethernet|layer1|half-duplex|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30354" PostTypeId="2" ParentId="30353" CreationDate="2016-05-12T20:54:35.487" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;the CCNA guide states that the CSMA/CD protocol is used to stop&#xA;  devices on the same medium e.g. same wire like on a bus network&#xA;  transmitting simultaneously to avoid collisions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That really isn't correct. the CD part is Collision Detection. CSMA/CA (CA for collision avoidance) is used by other protocols, like Wi-Fi, is to try to avoid collisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A hub is really just a wire, and each port is electrically connected to all the other ports, so all the hosts are on the same wire, even though it looks like each has its own wire. If two devices connected to a hub send a frame at the same time, both frames will be repeated out the other interfaces at the same time. That is a collision; the electrical signal will interfere with each other, and the devices on the other ports will not understand either frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You seem to be confusing hubs with switches. Each port on a switch represents a separate collision domain. Switch ports are not all connected together the same way hubs are. Switches determine when, and to which port(s), to switch frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The patch cables are the same for half or full duplex operation. Devices connected to a switch do not need to be the same duplex as each other since each switch port represents a separate collision domain.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="860" LastEditDate="2016-05-12T22:12:36.137" LastActivityDate="2016-05-12T22:12:36.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30355" PostTypeId="2" ParentId="30328" CreationDate="2016-05-12T21:06:25.523" Score="4" Body="&lt;p&gt;It actually depends on the NX-OS version running on the switch (and hence the switch model). Starting with version 6.0(2)N2(1), the &lt;code&gt;default interface&lt;/code&gt; command has been added to the nexus world. Compare the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5500/sw/release/notes/6_02/Nexus5500_Release_Notes_6_02.html#pgfId-481452&quot; rel=&quot;nofollow&quot;&gt;release notes&lt;/a&gt; of this version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as I know, previous versions do not support this or any similar command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However you won't be able to run NX-OS 6 or later on the 5010 or 5020 platform, it requires the 55xx platform.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-05-12T21:06:25.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30356" PostTypeId="2" ParentId="30302" CreationDate="2016-05-12T21:24:42.237" Score="2" Body="&lt;p&gt;This link has a good intro on ospf and design of campus architectures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docstore.mik.ua/cisco/pdf/routing/OSPF&quot; rel=&quot;nofollow&quot;&gt;http://docstore.mik.ua/cisco/pdf/routing/OSPF&lt;/a&gt; Routing Protocol(1).pdf&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="4565" LastEditDate="2016-05-13T20:40:52.233" LastActivityDate="2016-05-13T20:40:52.233" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30358" PostTypeId="1" AcceptedAnswerId="30362" CreationDate="2016-05-12T20:44:08.807" Score="1" ViewCount="1194" Body="&lt;p&gt;I have two ebgp peers connected to my quagga 1.0.20160315 router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of those peers (peer1) is advertising routes with flag 0x800 (Optional Non-Transitive) in the MP_REACH_NLRI path attribute.&#xA;Also the next hop is marked as Optional Non-Transitive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My quagga router is not advertising this route to the other peer2 and I suspect this is because of the Non-Transitive flags in the path attribute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is their a way to override non-transitive flag in incoming routes and redistribute them to all the other peers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for the help.&#xA;Regards&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&#xA;I got it working by using a route map and re-writing the bgp next hop. Original route was not advertised because of Non Transitive flags.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 64496  &#xA;bgp router-id 192.168.56.1  &#xA;network 192.1.1.0/24  &#xA; !  &#xA; redistribute connected  &#xA; neighbor 192.168.20.201 remote-as 64496  &#xA; neighbor 192.168.20.201 route-reflector-client  &#xA; neighbor 192.168.20.201 update-source 192.168.20.1  &#xA; neighbor 192.168.20.201 soft-reconfiguration inbound  &#xA;redistribute connected  &#xA; neighbor 192.168.56.202 remote-as 64498  &#xA; neighbor 192.168.56.202 update-source 192.168.56.1  &#xA; neighbor 192.168.56.202 soft-reconfiguration inbound  &#xA; neighbor 192.168.56.202 route-map set-nexthop out  &#xA;!  &#xA;route-map set-nexthop permit 10  &#xA; set ip next-hop 192.168.56.1  &#xA; set metric 200  &#xA; set local-preference 5  &#xA;!   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25339" OwnerDisplayName="Sidhant101" LastEditorUserId="509" LastEditDate="2016-05-13T14:09:21.767" LastActivityDate="2016-05-13T17:39:56.480" Title="Advertise Non-Transitive Routes in Quagga" Tags="|bgp|quagga|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30359" PostTypeId="1" AcceptedAnswerId="30361" CreationDate="2016-05-13T03:16:53.247" Score="1" ViewCount="186" Body="&lt;p&gt;I know how switch learns MAC addresses after startup, but what I'm not sure about is, when the switch floods a frame (when it doesn't know the destination) does the source port (that sent the frame) also receive the frame?&lt;/p&gt;&#xA;" OwnerUserId="25334" LastEditorUserId="4889" LastEditDate="2016-05-13T23:11:14.633" LastActivityDate="2016-05-16T03:09:34.667" Title="Switch learning MAC addresses" Tags="|switch|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30360" PostTypeId="1" CreationDate="2016-05-13T03:19:32.640" Score="1" ViewCount="80" Body="&lt;p&gt;We are currently working on a university exercise and are stumped when it comes to replicating this network, what we are trying to achieve is wireless clients to obtain DHCP address's from a W2k12r2 server through a Wireless Access Points, below is our setup&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    WAP&#xA;    WAP4410N&#xA;    IP 200.10.1.5&#xA;    Subnet 255.255.255.192&#xA;    Gateway 200.10.1.1&#xA;&#xA;    RRAS/DHCP Server&#xA;    IP 200.10.1.1&#xA;    Subnet 255.255.255.192&#xA;    No Gateway set&#xA;&#xA;    Client**-----**WAP**-----**RRAS/DHCP Server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We are configuring the WAP to static connect to the wireless adapter on the lab server and then also accept clients on a seperate SSID to connect and obtain a DHCP lease from the RRAS/DHCP Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are NOT able to physically connect the WAP and the server through a switch, so one SSID is a point to point manually configured as above and the other will be a client network. So all connections occur wirelessly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two SSID's have segmentation disabled&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have two interfaces on our RRAS server one WAN and one LAN, we are using RIP to extend from a Cisco Router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Client**--**WAP**--**RRAS--CISCO--RRAS--Client(Physically wired)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When we try to ping the Cisco router and other WAN/LAN networks we can ping successfully, however once a client connects to the WAP, DHCP is not being passed through(Yes its in the DHCP bindings) and when we do manually configure the client we CAN ping the WAP and the RRAS/DHCP server on 200.10.1.1 but no further while the WAP somehow can&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We do not have firewalls enabled and there are currently no ACL on the Firewall/Cisco Router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It feels like it is something to do with the client not understanding the correct gateway however when manually assigning it to either 200.10.1.1 OR 200.10.1.5 it makes no difference in the ability to ping&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help? &lt;/p&gt;&#xA;" OwnerUserId="25333" LastActivityDate="2016-05-13T03:19:32.640" Title="University exercise - How to bridge wireless network" Tags="|cisco|wireless|dhcp|ping|dns|" AnswerCount="0" CommentCount="1" ClosedDate="2016-05-13T10:54:15.563" ContentLicense="CC BY-SA 3.0" />
  <row Id="30361" PostTypeId="2" ParentId="30359" CreationDate="2016-05-13T04:42:19.710" Score="7" Body="&lt;p&gt;No. Broadcasts are flooded out all interfaces except the one which they were received on. If they were sent on that interface too then you'd have a never ending flow of broadcast traffic.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2016-05-16T03:09:34.667" LastActivityDate="2016-05-16T03:09:34.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30362" PostTypeId="2" ParentId="30358" CreationDate="2016-05-13T06:15:59.463" Score="1" Body="&lt;p&gt;No, you cannot change the flag. Attribute MP_REACH_NLRI is defined to be Optional Non-Transitive in RFC4760. What kind of routes you are trying to advertise?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt; &#xA;Neighbor to 192.168.20.201 in same AS(64496) is iBGP, not eBGP. You should be able to fix it easily by changing local AS or neighbor AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why it wasn't working before you set nexthop is that Quagga router received routes from 192.168.20.201 but their nexthop cannot be used. You can use &lt;code&gt;neighbor &amp;lt;peer&amp;gt; next-hop-self&lt;/code&gt; to fix it instead of route-map.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also if you want to run eBGP for all routers, you don't need to configure &lt;code&gt;neighbor &amp;lt;peer&amp;gt; route-reflector-client&lt;/code&gt; which is for iBGP.&lt;/p&gt;&#xA;" OwnerUserId="20657" LastEditorUserId="20657" LastEditDate="2016-05-13T17:39:56.480" LastActivityDate="2016-05-13T17:39:56.480" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30366" PostTypeId="2" ParentId="30359" CreationDate="2016-05-13T10:41:02.000" Score="5" Body="&lt;p&gt;@OzNetNerd answer is correct however the term you choose could cause some confusion.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;When a host attached to a switch send a &lt;em&gt;broadcast&lt;/em&gt; frame, the switch replicate it to all ports, except the port on which the frame was received.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the switch receive an &lt;em&gt;unicast&lt;/em&gt; frame destined to an unknown mac address, the switch will &lt;em&gt;flood&lt;/em&gt; it to all ports, except the port on which the frame was received. The frame is still a unicast tough, and not a broadcast.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-05-13T10:41:02.000" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30367" PostTypeId="2" ParentId="17656" CreationDate="2016-05-13T10:53:17.433" Score="1" Body="&lt;p&gt;When a node wants to send a packet it will look up the destination address in it's routing table. Based on that table it will determine the IP address and interface for the next hop. If the destination is on one of the local subnets then the next hop IP address will simply be the destination. Otherwise it will be the IP address of a router (most likely the default gateway).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MAC address (if applicable) for the next hop IP address will be determined by arp (for IPv4) or neighbour discovery (for IPv6)&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-13T10:53:17.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30368" PostTypeId="1" CreationDate="2016-05-13T10:59:50.657" Score="0" ViewCount="89" Body="&lt;p&gt;Supposing I Spoofed my MAC address using Kali Linux macchanger then using aircrack to hack in a router. What kind of footprint will I be leaving behind? Will I still be tracked?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure if this question is appropriate for this site. If its inappropriate for this site, could you direct me to an appropriate site where I can ask such questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a &lt;a href=&quot;http://area51.stackexchange.com/proposals/90597/codebreakers-codehackers-hackoverflow&quot;&gt;CodeBreaker&lt;/a&gt; stackexchange, but its still in definition stage.&lt;/p&gt;&#xA;" OwnerUserId="25340" LastActivityDate="2016-05-13T19:01:10.253" Title="Can I still be tracked if I spoofed my MAC address?" Tags="|wireless|mac-address|" AnswerCount="1" CommentCount="2" ClosedDate="2016-05-13T21:55:49.230" ContentLicense="CC BY-SA 3.0" />
  <row Id="30369" PostTypeId="1" CreationDate="2016-05-13T11:21:30.580" Score="5" ViewCount="3737" Body="&lt;p&gt;Let's say a packet originates from an internal network (with a private IP). Even after this packet leaves the gateway router, the MAC address of the originating host is still somewhere in this packet (right?). Where in this packet might I look to find this originating host MAC?&lt;/p&gt;&#xA;" OwnerUserId="24285" LastActivityDate="2016-05-19T10:59:50.597" Title="Finding Source MAC Address of A Packet" Tags="|routing|layer2|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30370" PostTypeId="2" ParentId="30369" CreationDate="2016-05-13T11:30:06.970" Score="5" Body="&lt;p&gt;Your assumption is wrong, the mac address of the original host has been stripped away by the first router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could be in the payload (i.e. the DATA contains in the packet) but only if the program that generated the data included it which is unusual.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-05-13T11:30:06.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30371" PostTypeId="2" ParentId="30369" CreationDate="2016-05-13T11:30:54.140" Score="7" Body="&lt;p&gt;You can't find the source mac adress once it leaves the respectiv L2 segment , the last device that is capable of seeing the L2 adress is the gateway .&#xA;In some networks you can see the mac adress as a payload sent to another device - dhcp relay for example (ip-helper adress).&lt;/p&gt;&#xA;" OwnerUserId="6412" LastActivityDate="2016-05-13T11:30:54.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30374" PostTypeId="2" ParentId="30353" CreationDate="2016-05-13T11:40:41.370" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I always thought it didnt because they're on separate wires on each port on the hub, and the hub forwards all frames onto all interfaces by default,&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Hubs don't work with complete frames, they work at a lower level than that. When data starts arriving on one port it immediately starts being sent out on the other ports, there are no buffers (though there will be slight pipeline delays).  If a hub detects transmission on multiple ports at the same time it will generate a &quot;jam signal&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus from the point of view of CSMA/CD hubs are transparent. Devices still check that the line is idle before transmitting and if a collision happens it will be seen by all devices on the collision domain.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Another thing, if you have a full duplex ethernet cable and connect to a hub, why can't run it full duplex? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Full duplex and hubs are incompatible concepts. Full duplex implies that multiple nodes can successfully transmit at the same time but a multiport repeater (aka hub) can only handle one node transmitting at a time.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can a switch only run full duplex if a full duplex ethernet cable is connected? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For a given Ethernet physical layer standard there isn't really such a thing as a &quot;full duplex cable&quot; or a &quot;half duplex&quot; cable. Coaxial Ethernet is fundamentally half-duplex. The common variants of Twisted pair and fiber Ethernet are full-duplex at the electrical level but can operate in a half-duplex mode where sinultanious transmission and reception is treated as a collision.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does the host/device on the other end have to run full duplex too?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For a segment to operate correctly in full-duplex mode the devices at both ends of the segment must support full-duplex and be in full-duplex mode (Either through autonegotiation or manual configuration).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If for some reason one end of the segment is in full-duplex mode and the other is in half duplex mode then you get a duplex mismatch and terrible network performance. In particular this is likely to happen if a port in autonegotiation mode is connected to a port with autonegotiateion disabled and mode forced to full-duplex.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-05-13T19:46:24.750" LastActivityDate="2016-05-13T19:46:24.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30375" PostTypeId="2" ParentId="30347" CreationDate="2016-05-13T11:43:07.607" Score="2" Body="&lt;p&gt;Best way (no headache) is to default and shut the member interfaces , create the port-channel , add the member interfaces to the port-channel , no shut and only after that add the trunk configuration on the port-channel (the vlans).&#xA;There are numberous issues and tricks even when working between switches from the same vendor , like surprises after a reboot when you get different configurations between the port-channel and the member interfaces , leaving you with error-disabled interfaces or unbundled from the Po.&lt;/p&gt;&#xA;" OwnerUserId="6412" LastActivityDate="2016-05-13T11:43:07.607" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30377" PostTypeId="1" AcceptedAnswerId="30392" CreationDate="2016-05-13T12:43:08.040" Score="3" ViewCount="11940" Body="&lt;p&gt;I am aware of all the background information to &lt;strong&gt;native VLANs&lt;/strong&gt;, just to repeat here that they are used for 'control traffic', that is CDP / VTP / PAgP / DTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a router, sub-interfaces can be defined to allow different VLAN IDs over a trunk from a connected switch to communicate, each VLAN ID will be on different subnet, the sub-interfaces act as default gateways and have nothing to do with trunking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often in prominent study texts and books and answers on forums, it is always stated that you must define the &lt;strong&gt;native VLAN&lt;/strong&gt; on one of the sub-interfaces (or the physical interface in earlier scenarios).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is &lt;strong&gt;specifically&lt;/strong&gt; why do we need the &lt;strong&gt;native VLAN&lt;/strong&gt; defined on one of these sub interfaces when the connected VLANs do not need to pass control traffic (e.g. layer 2) to each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In every lab I have setup (PT and GNS3), I never have a problem missing out the native VLAN on a sub interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-subif) #**encapsulation dot1q 1 native** &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24363" LastEditorUserId="8499" LastEditDate="2020-07-18T17:51:28.643" LastActivityDate="2020-07-18T17:51:28.643" Title="Native VLAN on a router subinterface (RoAS)" Tags="|cisco|switch|vlan|switching|layer2|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30378" PostTypeId="2" ParentId="30377" CreationDate="2016-05-13T13:16:20.413" Score="1" Body="&lt;p&gt;If the interface is acting as a default gw for a subnet, then it has an IP address and is no longer a &quot;switchport&quot; as such, it is a L3 interface. A L3 interface (which is an Interface with an IP address) has only 1 vlan &quot;attached&quot; to it. This vlan is &quot;untagged&quot;, in Cisco language this means native. The native vlan is the vlan that is not tagged. So when you create a SVI you are creating the L3 instance for that L2 vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Double Tagging is a different concept. Double tagging is when an attacker puts a vlan tag on top of an exisiting vlan tag. The first tag is stripped off when it enters the switch. The packet still has its underlying tag on it, which is then used to put the packet in the corresponding vlan; thus allowing an attacker to gain access to another vlan.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="40371" LastEditDate="2017-10-20T12:25:05.433" LastActivityDate="2017-10-20T12:25:05.433" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30381" PostTypeId="2" ParentId="30334" CreationDate="2016-05-13T15:11:09.773" Score="1" Body="&lt;p&gt;Yes,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bridges were not originally designed as security devices but as a method of helping networks to scale by splitting up collision domains. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the bridge support in linux is more than just a bridge. Bridge traffic passes through ebtables and by default IP traffic on a bridge passes through iptables (this can be disabled). This allows one to implement packet filtering and can therefore allow a firewall to be introduced without breaking up the layer-2 domain. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ebtables.netfilter.org/br_fw_ia/br_fw_ia.html&quot; rel=&quot;nofollow&quot;&gt;http://ebtables.netfilter.org/br_fw_ia/br_fw_ia.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-13T15:11:09.773" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30382" PostTypeId="2" ParentId="30377" CreationDate="2016-05-13T15:32:33.113" Score="2" Body="&lt;p&gt;For 802.1q - the IEEE standard calls for a VLAN assignment on any frame traversing a trunk (i.e., Native VLAN).  By default, this is VLAN 1, but can be changed.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Native VLAN essentially carries all traffic that does not have a specific VLAN tag associated with it.  For instance, let's say you are using a cisco switch and only issue the following commands:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;config t&#xA;&lt;br&gt;&#xA;int fa0/1 &#xA;&lt;br&gt;&#xA;switchport&#xA;&lt;br&gt;&#xA;switchport mode access&#xA;&lt;br&gt;&#xA;no shut&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At that point, this specific interface is not assigned to a specific VLAN (e.g., switchport access vlan 13).  So, this interface will use the Native VLAN (whatever you defined it to be).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the IEEE specification, you must always have a Native VLAN when using 802.1q.  My personal opinion, is they put this in there as a 'fail-safe' for any frames being sent without a VLAN Tag being placed in the 802.1q VLAN Tag field within the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="25348" LastActivityDate="2016-05-13T15:32:33.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30385" PostTypeId="2" ParentId="23403" CreationDate="2016-05-13T18:22:13.563" Score="0" Body="&lt;p&gt;Assuming you are talking about TCP/UDP, if you know both connection endpoints (IP and Port), you can do whatever you want with the nodes. Remember though, that to connect to a host, it has to be expecting a connection (the other host has to be listening in a specific port, so it would kinda act like a server too).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About what you said of persistent connections (keep-alive) it's an HTTP method to receive multiple HTTP requests and responses, so it's not what you are looking for. Anyways, this is a layer 4 protocol and I think it shouldn't be discussed here.&lt;/p&gt;&#xA;" OwnerUserId="23459" LastActivityDate="2016-05-13T18:22:13.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30386" PostTypeId="2" ParentId="20627" CreationDate="2016-05-13T18:43:53.680" Score="0" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;Are voice and data transmitted differently?&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Short Answer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3G (UMTS): Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4G (LTE): No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Long Answer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3G (UMTS): At the access layer, voice and data are transmitted similarly over the UTRAN. At the core layer, voice is transmitted over a circuit-switched core via SS7 to the PSTN, and data is transmitted over a packet-switched core to the IP network (e.g. Internet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4G (LTE): Both voice and data are transmitted similarly through access layer through the E-UTRAN and EPC, which replaces both PS core and CS core of 3G. Only at the last leg, where the traffic exits the EPC, does the traffic diverge. Voice traffic is routed through CSCFs into the IMS core, and data traffic is routed through the PGW to the IP network (e.g. Internet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Atosv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Atosv.jpg&quot; alt=&quot;https://sites.google.com/site/lteencyclopedia/lte-network-infrastructure-and-elements&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Definitions&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UMTS: Universal Mobile Telecommunications System&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UTRAN: UMTS Terrestrial Radio Access Network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SS7: Signalling System 7, the standard for signalling and switching telephone calls&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PSTN: Public Service Telephone Network, the global network of interconnected telephone network operators&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LTE: Long-Term Evolution&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E-UTRAN: Evolved UTRAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EPC: Evolved Packet Core&lt;/p&gt;&#xA;" OwnerUserId="15866" LastActivityDate="2016-05-13T18:43:53.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30387" PostTypeId="2" ParentId="30368" CreationDate="2016-05-13T19:01:10.253" Score="1" Body="&lt;p&gt;Everything you do on a network can be recorded, correlated, and ultimately traced. (see also: TOR users being exposed) The longer you sit on someone else's network the more likely they are to take notice.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-13T19:01:10.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30388" PostTypeId="1" CreationDate="2016-05-13T19:28:58.053" Score="2" ViewCount="331" Body="&lt;p&gt;I want my OVS (which runs with OpenFlow14) to add flow entries for ARP with using the &lt;a href=&quot;http://ryu.readthedocs.io/en/latest/app/ofctl_rest.html&quot; rel=&quot;nofollow&quot;&gt;Ryu REST API&lt;/a&gt;. These ARP packets should be handled like a normal L2/3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setup of my bridge &lt;code&gt;br0&lt;/code&gt;:&#xA;&lt;code&gt;&#xA;sudo ifconfig eth1 0&#xA;sudo ifconfig eth2 0&#xA;sudo ifconfig eth4 0&#xA;sudo ovs-vsctl add-br br0&#xA;sudo ovs-vsctl add-port br0 eth2&#xA;sudo ovs-vsctl add-port br0 eth4&#xA;sudo ovs-vsctl add-port br0 eth1&#xA;sudo ovs-vsctl set bridge br0 protocols=OpenFlow14&#xA;sudo ifconfig br0 192.168.101.1/24 up&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I want to add flow entries for ARP with the hexcode &lt;code&gt;0xfffffffa&lt;/code&gt; for normal actions referring to &lt;a href=&quot;https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-spec-v1.4.0.pdf#page=47&quot; rel=&quot;nofollow&quot;&gt;OpenFlow 1.4 Specifications&lt;/a&gt;:&#xA;&lt;code&gt;&#xA;curl -X POST -d '{&#xA;&quot;dpid&quot;:16267930820426,&#xA;&quot;priority&quot;: 1,&#xA;    &quot;match&quot;:{&#xA;        &quot;eth_type&quot;:2054,&#xA;        &quot;in_port&quot;:3&#xA;    },&#xA;    &quot;actions&quot;:[&#xA;        {&#xA;        &quot;type&quot;:&quot;OUTPUT&quot;,&#xA;        &quot;port&quot;:0xfffffffa&#xA;        }&#xA;    ]&#xA;}' &lt;a href=&quot;http://localhost:8080/stats/flowentry/add&quot; rel=&quot;nofollow&quot;&gt;http://localhost:8080/stats/flowentry/add&lt;/a&gt;&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it just sets flow entries with action drop:&#xA;&lt;code&gt;&#xA;cookie=0x0, duration=281.451s, table=0, n_packets=0, n_bytes=0, priority=1,arp,in_port=3 actions=drop&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It worked well when using OpenFlow10 (when using the adequate hex code). But I need to switch to OpenFlow14.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried using the string &lt;code&gt;NORMAL&lt;/code&gt; as output port, but it did not work.&#xA;Does anyone have an idea what is going wrong?&lt;/p&gt;&#xA;" OwnerUserId="16734" LastEditorUserId="16734" LastEditDate="2016-05-20T09:45:09.523" LastActivityDate="2016-05-20T09:45:09.523" Title="OpenVSwitch OF1.4 Handle ARP as Normal L2/3 switch with RYU rest api" Tags="|openflow|" AnswerCount="0" CommentCount="0" ClosedDate="2019-12-20T00:14:50.900" ContentLicense="CC BY-SA 3.0" />
  <row Id="30391" PostTypeId="2" ParentId="23403" CreationDate="2016-05-13T20:42:28.850" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Assume that you wanna transfer data (reliable) between two devices on the Internet. So the chances are TCP must be used. I have a device that has static IP address and many distributed(all connected to Internet, not in the same LAN) devices that don't have static IP address. All the distributed devices have the IP address of the central device so they can initiate a request to central device. I want the central device to send data to distributed devices whenever it wants. Thanks &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To establish a TCP connection one end (the &quot;server&quot;) listens and the other end (the &quot;client&quot;) connects to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the TCP connection is established either end can send data to the other end whenever it wants.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice however your clients are likely to be behind firewalls or nats and that adds some complications.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;It is unlikely that your server will be able to initiate a connection to a listner on the client. There are tricks that can sometimes be used but they don't always work.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If a TCP connection sits idle for too long then firewalls/NATs are likely to cut it off.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Certain network glitches can cause a connection to be cut off without the endpoints realising it is cut off.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The result is that if you are deploying clients on arbitary networks and you need the server (which we assume has an IP on the public internet) to be able to send messsages to them the clients need to establish a permanent TCP connection to the server and they need to periodically send a test/keepalive message to the server. IF they get no reply to their test/keepalive message then they need to tear down the TCP connection and try establishing a new one.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-13T20:42:28.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30392" PostTypeId="2" ParentId="30377" CreationDate="2016-05-13T21:51:16.647" Score="3" Body="&lt;p&gt;With Cisco devices, you do not need to configure a native VLAN, and it is recommended that you do not configure one. Traffic that is local to the link (CDP, VTP, PAgP, DTP, etc.) will still be sent and received untagged, and it will work correctly. This traffic will never be sent beyond the link, even with a native VLAN configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having a native VLAN configured can present a security risk, as can the use of VLAN 1 (the default VLAN and default native VLAN). If you don't have a native VLAN, then any traffic spoofed to be on the native VLAN will never travel beyond the single link, and that limits any damage which may be done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can never delete VLAN 1, but you can limit which VLANs are allowed on a trunk with the &lt;code&gt;switchport trunk allowed vlan &amp;lt;list&amp;gt;&lt;/code&gt; command, and just not allow VLAN 1 by excluding it from the list.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-13T21:51:16.647" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30393" PostTypeId="1" AcceptedAnswerId="30405" CreationDate="2016-05-13T23:55:27.293" Score="3" ViewCount="194" Body="&lt;p&gt;I'm considering the possibility of moving my public addresses to IPv6 for several web applications and sites that I host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When inquiring with my ISP, the account exec replied to me with the following warning:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;I was checking in with the Engineer that is working on IPv6’s and he just sent me the following: Do they realize that if we give them IPv6 addresses they are, generally, only reachable from other IPv6 hosts?&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure if I understand what is being referred to here.  My public DNS provider has verified that their DNS services are fully v6 compliant and as long as my own equipment is capable, why would the ISP issue such a warning to me?&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-05-14T05:39:36.227" Title="Switching to public IPv6" Tags="|ipv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30394" PostTypeId="2" ParentId="30393" CreationDate="2016-05-14T00:27:39.327" Score="2" Body="&lt;p&gt;He's referring to the two being different protocols. They share the letters &quot;I&quot; and &quot;P&quot;, but are otherwise as alien to each other as IPX and Appletalk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, and IPv4 only host -- which is most of the world -- can only talk to other IPv4 hosts. The address fields are simply not large enough to accommodate v6 hosts. Also, most people don't bother with any sort of protocol bridging (&quot;proxy&quot;) to get v4 into v6. (&lt;em&gt;Just use v6, already&lt;/em&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6, on the other hand, can hold many &quot;internets&quot;. And seeing as very little of the world exists via IPv6, many people go to great lengths to allow their IPv6 infrastructure to reach the IPv4 internet. (see also: NAT64) For example, some cellphone networks are IPv6-only, but the provider runs a proxy to make IPv4 accessible -- and you don't even know it's happening.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2016-05-14T00:33:52.490" LastActivityDate="2016-05-14T00:33:52.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30395" PostTypeId="2" ParentId="30334" CreationDate="2016-05-14T00:59:39.840" Score="1" Body="&lt;p&gt;Packets are layer 3 items.  Frames are layer 2 items.  Routers route packets and bridges/switches pass frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet Protocol (IP) = layer 3.  If your endpoints have no ip addresses, they are no accessible by endpoints beyond their layer 2 domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, a VLAN is a virtual LAN, or a segregated out bridge/switch - virtually.  That could be considered a security feature.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-14T00:59:39.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30396" PostTypeId="2" ParentId="30347" CreationDate="2016-05-14T01:05:46.667" Score="0" Body="&lt;p&gt;Expect to lose connectivity - briefly.  Configure a port-channel interface on both switches and configure it as a trunk.  You might try and specify dot1q trunk.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure the new ports with channel group and set mode to &quot;on&quot; and trunk mode.  Shutdown the interface via the command line.  Do the same on the near side switch.  unshut on the far end, then unshut on the near end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Done.  If you don't shut/no shut the interfaces - they may never come up as they will be errdisable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both sides mode &quot;on&quot;.  Shut/No shut.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-14T01:05:46.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30397" PostTypeId="2" ParentId="1" CreationDate="2016-05-14T01:20:41.557" Score="0" Body="&lt;p&gt;Practically speaking - IKE, Internet Key Exchange (IKE), is synonymous with Internet Security Association Key Management Protocol (ISAKMP).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-14T01:20:41.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30399" PostTypeId="1" CreationDate="2016-05-14T02:17:03.977" Score="1" ViewCount="814" Body="&lt;p&gt;I have the following set up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Ubiquiti USG router (WAN: DHCP client: 192.168.20.100/24 GW: 192.168.20.1)&#xA;Ubiquiti USG router (LAN: DHCP server: 192.168.1.1/24)&#xA;|&#xA;Cisco 3750 Switch Port on VLAN 1 (LAN: DHCP client: 192.168.1.100/24 GW: 192.168.1.1)&#xA;Cisco 3750 Switch Port on VLAN 2 (LAN: DHCP server: 172.27.71.1/24)&#xA;|&#xA;PC (LAN: DHCP client: 172.27.71.100/24 GW: 172.27.71.1)&#xA;&#xA;Cisco 3750 Switch Port on VLAN 3 (LAN: DHCP server: 172.27.72.1/24)&#xA;|&#xA;Server (LAN: DHCP client: 172.27.72.100/24 GW: 172.27.72.1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now in order to get it working I configured IP routing and DHCP on the 3750. This allow the PC and server to communicate via the Cisco switch as it is their common gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to get internet access to the Server, I added a static routes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Ubiquiti USG:&#xA;    172.27.0.0/16 via 192.168.1.100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this didn't work! In order to get it to work I had to add another static route to the upstream router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172.27.0.0/16 via 192.168.20.100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we are getting to the questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If the Ubiquiti USG is NATing the outbound traffic, then why do I need to add a static route to the upstream router that includes the 172.27.2.0/24 subnet, isn't this out of context?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The Ubiquiti USG performs bandwidth accounting, but it doesn't list the server or the phone in its client list, it only lists the Cisco switch. If the Cisco switch does not perform NAT then why is the traffic being attributed to the switch?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What do I need to change in my setup to make the USG aware of the devices connected to the Cisco switch - while still allowing inter-Vlan communication to occur on the Cisco switch?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I know I could get it to work by defining all the VLANs on the USG and running a DHCP server for each and just running a trunk to the Cisco switch (i.e. router on a stick) but then all the inter-VLAN traffic between the vlans would have to go via the USG and that is significantly slower.&lt;/p&gt;&#xA;" OwnerUserId="25365" LastEditorUserId="25365" LastEditDate="2016-05-14T05:23:00.823" LastActivityDate="2017-01-10T13:12:27.677" Title="Static routes and multiple routers" Tags="|cisco|routing|nat|ubiquiti|accounting|" AnswerCount="2" CommentCount="32" ClosedDate="2017-08-14T03:52:39.483" ContentLicense="CC BY-SA 3.0" />
  <row Id="30401" PostTypeId="1" AcceptedAnswerId="30404" CreationDate="2016-05-14T04:11:51.520" Score="1" ViewCount="408" Body="&lt;p&gt;Yesterday, I was reading about the NAT then, during that time I endup with above doubt, I am thinking that if some application from private network makes call to outside world i.e. public network using some XYZ port,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, This entry will be stored in the NAT table, If I get the external port and external ip for that application request then, Is it possible for me to establish the some sort of connection from outside public network with the host in the private network by closing the connection which he/she made using XYZ port and immediately binding to my application with XYZ port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is not possible then, how can i connect to my application running in the private network from outside the private network?(tunnelling?)&lt;/p&gt;&#xA;" OwnerUserId="16924" LastActivityDate="2016-05-14T04:23:19.757" Title="For how much period does the NAT table entry stays there even after connection is closed?" Tags="|vpn|nat|tcp|port-security|private-vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30403" PostTypeId="2" ParentId="30399" CreationDate="2016-05-14T04:14:11.070" Score="1" Body="&lt;p&gt;To answer questions two and three (question one is for a home networking, consumer-grade device), DHCP for VLAN 2 is done on the switch, rather than the router, so the router doesn't know about them, either through DHCP or via layer-2. You could run DHCP for both VLANs on the router, then the router will know about devices on both VLANs, or you could run both VLANs on the router so that it can see all the devices via layer-2.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I know I could get it to work by defining all the VLANs on the USG and&#xA;  running a DHCP server for each and just running a trunk to the Cisco&#xA;  switch (i.e. router on a stick) but then all the inter-VLAN traffic&#xA;  between the vlans would have to go via the USG and that is&#xA;  significantly slower.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Why do you think that? it is probably slower by tens of microseconds, and you will probably be unable to see any difference or measure it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit (based on the edited question):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your router doesn't know how to get to the route defined on the switch unless you specifically configure it, or you run a routing protocol between the router and the switch. Your route doesn't know where to send the traffic destined for the &lt;code&gt;172.27.2.0/24&lt;/code&gt; network, except to drop it or send it to a default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The the need for the static route on your friend's home-network, consumer-grade router is off-topic here.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-14T05:25:27.007" LastActivityDate="2016-05-14T05:25:27.007" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30404" PostTypeId="2" ParentId="30401" CreationDate="2016-05-14T04:23:19.757" Score="0" Body="&lt;p&gt;The period the table entry remains open depends on the router model, software version, and configuration. For TCP (connection-oriented), many will keep the port open as long as the TCP connection is up, or for a configured time period with no activity. For UDP (connectionless), it will be for a configured time period. The time periods are vendor dependent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NAT table entry will have the source and destination IP addresses in the table. Unless your outside host has an IP address of a table entry, you will not be able to originate a connection from outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot originate a connection from outside unless you have some way to bypass the NAT, e.g. a tunnel, or you have configured static entries for the NAT.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-14T04:23:19.757" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="30405" PostTypeId="2" ParentId="30393" CreationDate="2016-05-14T05:39:36.227" Score="5" Body="&lt;p&gt;They are warning you because IPv4 and IPv6 are two different protocols that don't talk to each other. If you run your server on only IPv6 then it will only be reachable by users that also have IPv6. Unfortunately that is still the minority (unless you target Belgian users, almost 50% off the users there has IPv6). And as good as all users with IPv6 also still have IPv4. The problem is that because of the shortage of IPv4 addresses the ISPs can't give everybody their own IPv4 address anymore. This lowers the quality of their IPv4 connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make your server reachable in the most optimal way by everybody you need to provide both IPv4 and IPv6 side by side. That way users without IPv6 can still reach you over IPv4, and users that do have IPv6 don't need to go through the IPv4 mess. That way everybody wins, and the more services and websites support IPv6 the  quicker the whole internet becomes independent of IPv4 and we can move on to an IPv6-only internet. But for now we still need both.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-05-14T05:39:36.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30406" PostTypeId="1" CreationDate="2016-05-14T05:58:45.407" Score="3" ViewCount="6982" Body="&lt;p&gt;I have a router that has 4 VLANs configured, with an interface on each VLAN, the router serves as a gateway and provides internet access.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN  |  Interface      |  Function&#xA;---------------------------------------&#xA;  1   |  192.168.1.1/24  |  DMZ&#xA;  2   |  192.168.2.1/24  |  Phones&#xA;  3   |  192.168.3.1/24  |  Work Stations&#xA;  4   |  192.168.4.1/24  |  Servers&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The router has a single cable connecting it to a Cisco 3750 (Gi1/0/1), this connection is setup as an 802.11q trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than the trunk port, the other ports on the switch are split among the 4 VLANs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN  |  Interface&#xA;--------------------&#xA;1     |  Gi1/0/2-6&#xA;2     |  Gi1/0/7-12&#xA;3     |  Gi1/0/13-18&#xA;4     |  Gi1/0/19-24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I set up the switch so that all VLANs have internet access, via their respective gateways on the router, while still allowing any required inter-VLAN communication to occur on the switch itself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The inter-VLAN communication I require is as follows: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;from   |  to&#xA;--------------&#xA;2      |  1&#xA;3      |  1&#xA;4      |  1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would prefer to run the DHCP server on the Cisco switch, but if necessary I can run it on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;System image file is &quot;flash:c3750-advipservicesk9-mz.122-35.SE5.bin&quot;&lt;/p&gt;&#xA;" OwnerUserId="25365" LastEditorUserId="8499" LastEditDate="2018-12-23T06:09:42.463" LastActivityDate="2018-12-23T06:09:42.463" Title="Cisco 3750 configuration for static routes per VLAN" Tags="|cisco|routing|switch|vlan|cisco-catalyst|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30407" PostTypeId="2" ParentId="30406" CreationDate="2016-05-14T06:17:24.560" Score="2" Body="&lt;p&gt;The switch would need to be a layer-3 switch with routing enabled to allow communication between the VLANs; a layer-2 switch cannot route traffic between VLANs. You would configure SVIs on the layer-3 switch, and the addresses of the SVIs would be the gateways of the VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would then convert the trunk link to the router to a routed link:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet 1/0/1&#xA; no switchport&#xA; ip address &amp;lt;ip address&amp;gt; &amp;lt;mask&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will either need to run a routing protocol between the layer-3 switch and the router, or you will need to configure static routes to the VLAN network on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also need a way to have a default route on the layer-3 switch, either specifically configured to point to the router, or through a routing protocol from the router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-14T06:17:24.560" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30409" PostTypeId="1" CreationDate="2016-05-14T10:28:23.157" Score="2" ViewCount="227" Body="&lt;p&gt;Let me start with short background for better understanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have LAB at work (Cisco devices mostly), and we would like to allow other employers connect remotely from their homes, build own labs during free time (something like CCIE rack from physical devices). For that reason we are going to build &quot;Jump Host&quot;, basically Linux server used for connection to routers, switches, etc. There will be also few scripts for backup of configuration via SNMP, aliases for connection, so when user types R1, it will automatically trigger telnet to R1. And so on.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to that, devices has to be always configured with management IP address and SNMP community string. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first question is. Is somehow possible to load startup-configuration from TFTP server and override startup-configuration from NVRAM? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried used:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;boot network tftp filename x.x.x.x&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But it is not very helpful to be honest, because it is not override configuration stored in NVRAM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I was thinking about EEM applet to deny user perform copy run start and write memory. But users can easily remove EEM applet if they have access to configuration mode, aren't they? :-)&#xA;Let me put the second question. Can I somehow use privileged in order to deny using of few configuration commands? But if user has access to configuration mode there is no way how to do that probably.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know, my question is not straightforward at all. I am just wondering whether I am able ensure that startup configuration (including management IP address and SNMP string) is always loaded after reload of router and overrides configuration created by user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can not trust to users and be sure they will use only  Linux script to save their configuration to their home folders and not copy running-config to startup-config. I need to be sure it will be foolproof.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot for any idea, much appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Daniel&lt;/p&gt;&#xA;" OwnerUserId="10520" LastEditorUserId="10520" LastEditDate="2016-05-14T17:15:11.837" LastActivityDate="2023-02-14T10:21:55.050" Title="How to ensure startup-config is not changed, building CCIE rack" Tags="|cisco|cisco-ios|lab|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30410" PostTypeId="2" ParentId="30226" CreationDate="2016-05-14T10:31:40.300" Score="2" Body="&lt;p&gt;Referring to &lt;a href=&quot;http://www.mathcs.emory.edu/~cheung/Courses/558/Syllabus/00/CSMA/aloha-anal.html&quot; rel=&quot;nofollow&quot;&gt;mathcs.emory.edu&lt;/a&gt;, clarifying some terms:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;Arrival rate λ = number of new messages that arrives per time unit&lt;/p&gt;&#xA;    &#xA;    &lt;p&gt;Offered load (rate) G = number of (old and new) messages that contend for the channel per time unit&lt;/p&gt;&#xA;    &#xA;    &lt;p&gt;Throughput S = number of messages that are successfully transmitted per time unit&lt;/p&gt;&#xA;    &#xA;    &lt;p&gt;A message is successfully transmitted if its transmission does not collide with any other message transmission&lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And the offered load &lt;code&gt;G = λ/P[success]&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is 0.5 transmission attempts per frame time, referred to as 50% of offered load? (Text above graph).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is just about defining terms (See above linked page for derivation). The packet transmission time is used as time unit here.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If there were ten stations and each station attempted one transmission per frame time, would that be 1000% offered load? If yes, why?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. The number of successful/unsuccessful transmissions is also relevant for calculating G. See formula for G.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;muehsi&lt;/p&gt;&#xA;" OwnerUserId="16734" LastEditorUserId="16734" LastEditDate="2016-05-14T12:24:44.497" LastActivityDate="2016-05-14T12:24:44.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30413" PostTypeId="2" ParentId="30406" CreationDate="2016-05-14T12:11:15.380" Score="1" Body="&lt;p&gt;Your setup this like you described is something called &quot;router on a stick&quot;, you can search on the internet by the topic &quot;inter vlan routing&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is that is you already configure your scenario, and on host or devices connected to it respective vlans, already have it gateway, you must be able to communicate devices between vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But to reach the internet, here is where you need to do some configuration. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You need to create a default route that send all the traffic accross the interface connected to your ISP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip route 0.0.0.0 0.0.0.0 x&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Note: x can be a gateway provide by your isp (usually you entablish a link using an /30 network, or can be the interface connected to you ISP, this one depends of your configuration)&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;I guess you need to check if some kind of NATing is needed of if this is part of you ISP provider. It is not, you need to configure NAT on your router.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here you can reach the internet from all vlans. Now, because you want to deny access from one vlan to another, you need to create access list and applied to the subinterfaces that you created on router:&#xA;Eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   access-list 100 deny ip any 192.168.2.0 0.0.0.255&#xA;   access-list 100 deny ip any 192.168.3.0 0.0.0.255&#xA;   access-list 100 permit any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This ACL is defined to vlan 4, allowing access to internet and to vlan 1. MUST be applied INBOUND on respective vlan 4 subinterface on router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to create 2 mores to vlan 2 and 3, and do the same thing&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-05-14T12:11:15.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30414" PostTypeId="1" AcceptedAnswerId="30417" CreationDate="2016-05-14T12:15:06.087" Score="0" ViewCount="1231" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8dlCn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8dlCn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hello , i have a question ! how can i connect two pc&#xA;in different vlan connection together.it must be refer to &lt;strong&gt;loopback test&lt;/strong&gt; and &lt;strong&gt;virtual interface&lt;/strong&gt;. and which techology can i solve this ploblem!THX&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i have try set make pc1 port bind to vlan10 and pc2 port bind to vlan20 , and put them to sw1's interface g1/0/2 and sw2's interface g1/0/2.last make sw1's interface g1/0/1 and sw2's interface g1/0/1 connect use a netline and configure two interface to trunk mode.but havn't konw the answer.THX!&lt;/p&gt;&#xA;" OwnerUserId="24614" LastActivityDate="2016-05-14T23:07:47.570" Title="how to ping two vlan forwarding in a network" Tags="|vlan|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30416" PostTypeId="2" ParentId="30282" CreationDate="2016-05-14T12:35:44.203" Score="5" Body="&lt;p&gt;Found it !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a bug when running pfsense virtualized -&gt; &lt;a href=&quot;https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=165059&quot; rel=&quot;noreferrer&quot;&gt;https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=165059&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Workaround is to disable hardware checksum offload box under System &gt; Advanced on the Networking tab of pfsense.&lt;/p&gt;&#xA;" OwnerUserId="25276" LastActivityDate="2016-05-14T12:35:44.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30417" PostTypeId="2" ParentId="30414" CreationDate="2016-05-14T13:11:58.827" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Get sw1 and sw2 and define 2 vlans, vlan10 and vlan20.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Enable ip routing on your L3 switches.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Create on one of they, eg, sw1&#xA;2 vlan interfaces and set on it, his respective ip address:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;interface vlan 10&#xA;ip address x.x.10.x 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;interface vlan 20&#xA;ip address x.x.20.x 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;On pc connected to vlan 10 access port, declare it gateway like x.x.10.x, and on pc on vlan20 port, x.x.20.x&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Declare link between sw1 and sw2 link trunk port.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;With this, your vlan communication will work&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2016-05-14T13:19:10.663" LastActivityDate="2016-05-14T13:19:10.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30419" PostTypeId="2" ParentId="30409" CreationDate="2016-05-14T19:12:32.843" Score="1" Body="&lt;p&gt;The lab environment needs to be able to be torn up, torn down, erased, etc.  IP connectivity is going to get messed up.  That's the whole idea behind a terminal server and console ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might try using something like &lt;a href=&quot;https://www.docker.com/&quot; rel=&quot;nofollow&quot;&gt;Docker&lt;/a&gt;?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-14T19:12:32.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30420" PostTypeId="2" ParentId="30406" CreationDate="2016-05-14T19:28:54.227" Score="0" Body="&lt;p&gt;The 3750 is a layer 3 switch.  It should be configured as such because better/faster inter-vlan routing.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface VLAN1 &#xA;ip address 192.168.1.1 255.255.255.0&#xA;&#xA;interface VLAN2&#xA;ip addres 192.168.2.1 255.255.255.0&#xA;&#xA;interface VLAN5 //you need to first add vlan5&#xA;descript *** link to router ***&#xA;ip address 192.168.5.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;put the port linking to the router as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode access&#xA;switchport access VLAN5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;..etc.&#xA;finally the switch needs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0.0 0.0.0.0 192.168.5.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then on the router wipe out existing interface config and put&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip address 192.168.5.2 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then globally&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 192.168.0.0 0.0.255.255 192.168.5.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;your routers default route should point to the ISP gateway&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you should have 2 links between the router and switch stack.  See &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-2950-series-switches/24042-158.html&quot; rel=&quot;nofollow&quot;&gt;port-channel config guide.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-14T19:28:54.227" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30421" PostTypeId="2" ParentId="30414" CreationDate="2016-05-14T19:36:19.577" Score="-1" Body="&lt;p&gt;Typically you don't set VLAN id on the PC/endpoint.  The VLAN is set by the network equipment (switch).  You will need a router (sometimes also called a layer 3 switch) in order to route between the VLAN's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is something called inter-VLAN bridging where you essentially put both VLAN's in a configuration where each sees the others frames.  In this case, the secondary-address would enable you to talk to the other VLAN, provided each VLAN had a corresponding IP subnet associated with it.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-05-14T23:07:47.570" LastActivityDate="2016-05-14T23:07:47.570" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30423" PostTypeId="2" ParentId="30409" CreationDate="2016-05-14T22:07:37.100" Score="5" Body="&lt;p&gt;Sorry, no. ROMMON can be told to ignore any NVRAM config, but there's no documented method to override the NVRAM startup-config. (Note: I'm aware of a US DoD contractor that does this, but they have customized hardware.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a virtualized environment (GNS3, Cisco's virtual labs, etc.), it's easy to replace NVRAM entirely, or replace NVRAM contents. And this is how many (most?) modern labs are setup -- it's how Cisco's own test labs work.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-14T22:07:37.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30424" PostTypeId="1" AcceptedAnswerId="30425" CreationDate="2016-05-14T22:22:48.850" Score="3" ViewCount="26488" Body="&lt;p&gt;Consider an example where host-A is sending data to host-B. While the fragments traverses many routers in between, some of the fragments are lost. So now the router identifies this and waits for that lost packet to arrive or it just routes it to the next router? If this is true, how does the lost packet be recovered?&lt;/p&gt;&#xA;" OwnerUserId="24153" LastActivityDate="2023-10-16T08:34:49.450" Title="How does a router behave when some of the fragments of a packet is lost?" Tags="|router|packet-loss|fragmentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30425" PostTypeId="2" ParentId="30424" CreationDate="2016-05-14T22:34:33.160" Score="6" Body="&lt;p&gt;There's no mechanism to request a fragment be resent. The entire packet cannot be reassembled, so the entire packet will have to be resent. This is why Fragmentation Is Bad(tm).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers typically do not care about fragmentation. They pass things on exactly as they receive them. (unless it's the source of the fragmentation.) As such, the router will be unaware of missing fragments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I'm ignoring the practice of &quot;virtual reassembly&quot;.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-14T22:34:33.160" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="30426" PostTypeId="2" ParentId="28697" CreationDate="2016-05-14T23:12:44.003" Score="1" Body="&lt;p&gt;The private address ranges specified by the IETF are typically broken down further into smaller ranges called subnets.  A router/layer3 switch is required to route traffic (called packets) between the various subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example 10.0.0.0/8 is typically broken down to smaller networks such as 10.1.1.0/24, a subnet.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-14T23:12:44.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30427" PostTypeId="1" CreationDate="2016-05-14T23:16:05.660" Score="0" ViewCount="232" Body="&lt;p&gt;I am in desperate need of your help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am an intern working on implementing a private cloud for a company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hardware is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;layer 2 switch connected to the company network &lt;code&gt;192.1.1.0/24&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;layer 3 switch (huwaei s5700-si) connected to a&#xA;firewall (&lt;code&gt;192.168.10.254&lt;/code&gt; ip address of the management&#xA;interface), firewall is connected to the &lt;code&gt;192.1.1.0/24&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;c7000 blade system containing 4 hp Proliant gen 9 servers&lt;/li&gt;&#xA;&lt;li&gt;Cisco Catalyst Blade Switch 3020 for HP.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, I want to create these VLANs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wkrLC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wkrLC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured the port &lt;code&gt;GigabitEthernet 0/0/1&lt;/code&gt; (of the layer 3 switch) as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;port hybrid tagged vlans 1,50-52,55-63&#xA;ip-subnet vlan enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this port is connected to &lt;code&gt;GigabitEthernet 1/0/25&lt;/code&gt; of the blade switch, configured like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode trunk&#xA;switchport trunk allowed vlans all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;GigabitEthernet 1/0/24&lt;/code&gt; of the blade switch is connected to the layer 2, and the management interface &lt;code&gt;fa0/0&lt;/code&gt; has the address of &lt;code&gt;192.1.1.166&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if I connect to the company network, I can ping to the blade switch, but from the layer 3 switch, I cant. Keep in mind that I can ping from the layer 3 to any address in the network, but not to 192.1.1.166.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My ultimate goal is to be able to give virtual machines hosted on esxi hypervisors running on the Proliant servers an address from the newly created VLANs, and be able to ping to them and from them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created all these VLANs on the layer 3 with their indicated subnets and gateways, and I am able to ping the gateways.&lt;/p&gt;&#xA;" OwnerUserId="25380" LastEditorUserId="8499" LastEditDate="2016-05-15T02:22:51.283" LastActivityDate="2016-08-13T04:32:55.337" Title="Layer 2, layer 3, and blade switch problems" Tags="|switch|vlan|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-14T03:57:34.553" ContentLicense="CC BY-SA 3.0" />
  <row Id="30428" PostTypeId="2" ParentId="30302" CreationDate="2016-05-14T23:25:20.633" Score="1" Body="&lt;p&gt;You will see dynamic (automatic/automated) routing protocols like OSPF used in multi-site networks.  with OSPF, if you add a subnet (new VLAN) at remote site-x, the routing tables of the other routers in the network can get updated automatically.  Without OSPF, you might have to add that new route in every other site's router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP is widely deployed in all-Cisco networks but a big advantage of OSPF is that it is standards based.  So customer can integrate other vendors routers in the future.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-14T23:25:20.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30429" PostTypeId="2" ParentId="30427" CreationDate="2016-05-14T23:35:36.247" Score="1" Body="&lt;p&gt;I think all you want to do is to do a trunked ports between your 3020's and the LAN.  ESXi vSwitch will be able to allow you to put VM's in particular VLAN's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the firewall, it would trunk to the LAN also, being the gateway between the protected and non-protected subnets.  For non-firewalled VLAN's, the gateway could be the s5700.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, each networking device (and host) has atleast (2) trunked links to a switch fabric (stack).  This is the typical design I see.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-14T23:35:36.247" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30430" PostTypeId="1" AcceptedAnswerId="30431" CreationDate="2016-05-15T00:35:42.200" Score="3" ViewCount="30220" Body="&lt;p&gt;&lt;code&gt;wget&lt;/code&gt; is basically to retrieve HTTP contents from web servers. I want to know if wget is based on TCP or UDP? I did a search but some resources said it is TCP while others said UDP.&lt;/p&gt;&#xA;" OwnerUserId="22516" LastEditorUserId="8499" LastEditDate="2017-07-09T03:03:55.917" LastActivityDate="2017-07-09T03:03:55.917" Title="What is the transport protocol used in wget?" Tags="|tcp|ip|udp|transport-protocol|layer4|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30431" PostTypeId="2" ParentId="30430" CreationDate="2016-05-15T01:13:18.827" Score="8" Body="&lt;p&gt;By default, &lt;code&gt;wget&lt;/code&gt; uses HTTP to retrieve files. Which means &lt;code&gt;wget&lt;/code&gt; uses TCP/80... unless you specify HTTPS, in which case it uses TCP/443. &lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-05-15T01:13:18.827" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30434" PostTypeId="2" ParentId="29538" CreationDate="2016-05-15T03:29:25.357" Score="1" Body="&lt;p&gt;This is a university so most likely originally everything was on public IPs but as a result of the IP crunch there was a need to introduce private IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having the NAT at the network edge means that within the University's network traffic does not get natted. That means that internal connections within the University work just like they did in the old days when everything had a public IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hooking up a couple of NAT boxes to the edge routers and adding source-address based routes to direct traffic to the correct NAT was presumablly the easiest way to introduce NAT at the network edge for traffic sourced from private subnets while allowing the traffic sourced from public IPs to continue flowing as before. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;(note: any IPs used in this post are just examples and do not relate in any way to the real network the OPs diagram was taken from, I will assume that they are using 10.0.0.0/8 for private and 1.2.0.0/16 for public)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the NAT box is attached only to border, there needs to be 2 links between each NAT box and border router, correct?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That probablly depends on the NAT implementation. I'm pretty sure iptables could do it with only a single link to the core router, other implementions may require seperate &quot;inside&quot; and &quot;outside&quot; links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you will need for this setup is border routers that can route based on source address (normal routing is based on destination address) so that traffic from private subnets gets directed towards the NAT while traffic from public subnets flows straight through.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Without physical constraints, isn't it better to add links for core &amp;lt;--&gt; NAT &amp;lt;--&gt; border while keeping current core &amp;lt;--&gt; border links instead of attach the NAT boxes to border in the diagram?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can see a few reasons why the setup they went for may be preferable to the one you propose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly I don't think you should discount physical constraints. The core and border routers may well be in different physical locations and adding an extra cable between those locations may be expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly I expect doing it on the border routers is actually simpler. If a packet reaches a border router it's headed out of the network. Therefore the border router can have very simple rules along the lines of &quot;send anything with a source IP matching 10.0.0.0/9 to nat box a&quot; and &quot;send anything with a source IP matching 10.128.0.0/9 to nat box b&quot;. On the other hand the core routers would need more complex rules along the lines of &quot;send anything with a source IP matching 10.0.0.0/9 to nat box and a destination IP that is not in 10.0.0.0/8 or 1.2.0.0/16 to NAT box a&quot; and &quot;send anything with a source IP matching 10.128.0.0/9 to nat box and a destination IP that is not in 10.0.0.0/8 or 1.2.0.0/16 to NAT box b&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally it may simply have been a case of the border routers having the needed features and the core routers not having them. Routing based on source address is a fairly advanced feature.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-05-16T00:05:36.997" LastActivityDate="2016-05-16T00:05:36.997" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30437" PostTypeId="1" AcceptedAnswerId="30445" CreationDate="2016-05-15T08:00:02.893" Score="0" ViewCount="45" Body="&lt;p&gt;I have setup my dual e5-2697 V2 system; using VMWARE WorkStation Pro 12, to run roughly 30 VMs concurrently. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While the machines do a lot of &quot;small requests&quot;, ping type requests, nothing more then sending/receiving small kbytes of data; my overall network connection with Comcast (broadband 300mbps) is suffering from ping times. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The overall speed is still good... so downloading a large file still performs as expected, but navigating websites is slow, as if all the little pings the 30 machines create cause an overall slowdown of all the &quot;little requests&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to better manage this networking wise? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've searched for the answer, but can't seem to come up with a solution that actually improves the issue I am having. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks! &lt;/p&gt;&#xA;" OwnerUserId="25387" LastActivityDate="2016-05-15T15:00:53.770" Title="Lots of Small Requests over Broadband Connection - Slow Response Times?" Tags="|ping|vmware|virtual|" AnswerCount="1" CommentCount="5" ClosedDate="2019-03-13T06:19:47.083" ContentLicense="CC BY-SA 3.0" />
  <row Id="30440" PostTypeId="1" CreationDate="2016-05-15T12:35:51.967" Score="0" ViewCount="348" Body="&lt;p&gt;I am currently experimenting which &lt;a href=&quot;https://packetstormsecurity.com/search/files/?q=Tunnelshell&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tunnelshell&lt;/a&gt;. So, I launched it on the victim and on the attacker, executed a command via the Tunnelshell and captured the traffic via Wireshark to see what's going on under the hood. To my knowledge, all fragments must carry its offset in the original unfragmented packet to ensure that they can be reassembled on the destination host. However, as you can see in the following screenshot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LVP8p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LVP8p.png&quot; alt=&quot;IP fragmentation&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;they all have the same offset. In addition, all fragments, except the last one, must have the &quot;More Fragments&quot; flag set, but I can't find that either in any of the fragmented packets. Instead, the flag &quot;Don't fragment&quot; is set:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Wiq7A.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Wiq7A.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can they be successfully reassembled on the attacker's host?&lt;/p&gt;&#xA;" OwnerUserId="25393" LastEditorUserId="21048" LastEditDate="2017-10-20T12:26:31.757" LastActivityDate="2017-10-20T12:26:31.757" Title="Same offset in fragmented IP packets when using Covert channel" Tags="|ipv4|ip|wireshark|tunnel|fragmentation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30442" PostTypeId="2" ParentId="30440" CreationDate="2016-05-15T12:53:12.180" Score="1" Body="&lt;p&gt;It is kind of the point of covert channels, that they don't play by the normal rules. The idea is that if you follow the standard reassembly algorithm the data looks perfectly harmless. Presumably Tunnelshell runs directly over the packet layer and bypasses the normal reassembly code.&lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2016-05-15T12:53:12.180" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30443" PostTypeId="1" AcceptedAnswerId="30496" CreationDate="2016-05-15T14:06:19.860" Score="12" ViewCount="5520" Body="&lt;p&gt;I do not know if it is the right place to ask. It may be a very silly question. I assume that some processor has to process data frames for switching/routing. Modern processors have speed of few GHz. How do they handle data that is coming at a rate faster than they operate?&lt;/p&gt;&#xA;" OwnerUserId="25395" LastActivityDate="2024-01-11T01:10:07.167" Title="How can a processor handle 10 Gigabit per second or more data rate?" Tags="|speed|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30445" PostTypeId="2" ParentId="30437" CreationDate="2016-05-15T15:00:53.770" Score="2" Body="&lt;p&gt;Your behaviour of slow browsing and fast file transfers is consistent with DNS problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you stated, you are using as DNS servers 4.4.4.4 and 8.8.8.8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a common mistake assuming 4.4.4.4 is a Google DNS Server (or it was in the past, not so sure). It belongs to Level 3 Communications, and it is only open for their customers.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$whois 4.4.4.4&#xA;....&#xA;Level 3 Communications, Inc. LVLT-STATIC-4-4-16 (NET-4-4-0-0-1) 4.4.0.0 - 4.4.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I do advise you to correct it to the appropriate &lt;a href=&quot;https://developers.google.com/speed/public-dns/docs/using#important_before_you_start&quot; rel=&quot;nofollow&quot;&gt;Google DNS servers&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Google Public DNS IP addresses (IPv4) are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;8.8.8.8&#xA;8.8.4.4   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The Google Public DNS IPv6 addresses are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2001:4860:4860::8888   &#xA;2001:4860:4860::8844&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For the number of servers you have,  it maybe worth setting up a local DNS server, or at least a local DNS forwarding cache.&lt;/p&gt;&#xA;" OwnerUserId="20834" LastActivityDate="2016-05-15T15:00:53.770" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30446" PostTypeId="2" ParentId="30443" CreationDate="2016-05-15T15:02:55.877" Score="0" Body="&lt;p&gt;Today, almost all switching, and much of routing, is handled in hardware, so the processor speed comes into play for exceptions. For things like servers, it is possible that the processor isn't fast enough. This has been the case in the past. When 1 Gbps ethernet first came out, the bus used in PCs and servers could only handle 400 Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens when the processor isn't fast enough is that traffic gets dropped. A lot of traffic may be dropped, anyway, since that is how congestion is handled, if done correctly. RED (Random Early Detection) is a method used to randomly drop packets in queues in order to prevent them from filling and tail-dropping packets. This can help to prevent TCP synchronization. A lot of drops occur on switches, where multiple ports of a speed may need to send to another single port of the same speed.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-15T15:02:55.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30447" PostTypeId="1" AcceptedAnswerId="30774" CreationDate="2016-05-15T15:46:36.587" Score="1" ViewCount="996" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CSfe1.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CSfe1.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am totally stumped at the explaination I found for the Level 1 Parent routes. I thought this explaination would help me understand the route summarization questions, please let me know if there is a better way! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The line that stumps me is : &#xA;209.165.200.0/24 is variably subnetted, 5 subnets,2 masks&lt;/p&gt;&#xA;" OwnerUserId="21879" LastActivityDate="2016-05-28T14:15:08.020" Title="How to read a Routing Table" Tags="|routing|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30453" PostTypeId="2" ParentId="3145" CreationDate="2016-05-15T23:41:18.237" Score="8" Body="&lt;p&gt;Nat is a cross-layer process. It involves at least layers 3 (IP) and 4 (TCP, UDP, etc). In some cases it can also involve layer 7 (application).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A one to one NAT needs at minimum to modify the IP addresses (layer 3), IP checksums (layer 3) and TCP/UDP checksums (layer 4).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A one to many NAT needs at minum to modify the IP addresses (layer 3), IP checksums (layer 3), TCP/UDP ports (layer 4) and TCP/UDP checksums (layer 4).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such a minimal NAT will break many things (for example active-mode ftp). Most NATs will therefore go beyond the basics and also perform translation and tracking of at least some IP addresses in application data (layer 7).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-15T23:41:18.237" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30454" PostTypeId="1" CreationDate="2016-05-15T23:54:00.030" Score="2" ViewCount="399" Body="&lt;p&gt;I try to use asa 5508 on my network with 480 workstations.I connect interface1(192.168.1.0/24) to a swith with 3 linux servers,interface 2( (192.168.3.0/24) to a 48 manged switch, interface 3 (192.168.4.0/24) and interface 4(192.168.4.0/24) and interface 5 (192.168.5.0/24),Of course each segment has swith and ap connected to it.ASA 5508 act as dhcp server in each segment.It works for a day or so, then stop no one can access to the internet nor the server.My question is :Is it the right way to use asa 5508 as dhcp server for 480 clients? Can I use my linux server on dmz to be a main dhcp server for the other interfaces? Thanks for your help!!&lt;/p&gt;&#xA;" OwnerUserId="25410" LastActivityDate="2016-11-12T17:29:34.690" Title="I have cisco asa 5508 and setup as dhcp for 4 networks segments and 3 servers connected to dmz ,the asa 5508 is working for a while then stop" Tags="|routing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30456" PostTypeId="2" ParentId="3145" CreationDate="2016-05-16T02:33:35.637" Score="1" Body="&lt;p&gt;Think about how this has to be consistent across packets from the same device... at least within sessions. You could argue, therefore, that you should place this at level 5 or even higher. Just because it reaches down to modify IP headers shouldn't disqualify it from consideration from the higher layers. Lower layers might not know anything about higher layers, but higher layers can know and manipulate the lower. Indeed, Layer 6 seems appropriate. &lt;a href=&quot;https://en.wikipedia.org/wiki/OSI_model#Layer_6:_Presentation_Layer&quot; rel=&quot;nofollow&quot;&gt;From wikipedia:&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Application-layer entities may use different syntax and semantics if the presentation service provides a big mapping between them.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Mapping between addresses, even if the addresses are at level 3 instead of level 7, seems a very presentation-layer thing to do.&lt;/p&gt;&#xA;" OwnerUserId="1375" LastActivityDate="2016-05-16T02:33:35.637" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30457" PostTypeId="2" ParentId="30454" CreationDate="2016-05-16T03:45:41.393" Score="2" Body="&lt;p&gt;You can and it would be better to use a DHCP Linux server for your entire network. I would place it in your Linux DMZ/interface 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that as DHCP was designed as a network broadcast domain protocol, the DHCP requests have to be forwarded to your DHCP server; at the moment you have a different design, which is known as a multi homed DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such you have to configure DHCP relaying in each network. DHCP relaying will forward DHCP requests from each network to the specified DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/116265-configure-product-00.html&quot; rel=&quot;nofollow&quot;&gt;ASA DHCP Relay Configuration Example&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also start planning the future evolution and data usage of your network (in 2-3 years time, maybe sooner). Albeit the theoretical backplane of the 5508 is 8Gbps, depending on the firewall and NAT rules, often with ASA equipments, the speed the backbone withstands can get to half of that.&lt;/p&gt;&#xA;" OwnerUserId="20834" LastEditorUserId="20834" LastEditDate="2016-05-16T13:06:46.323" LastActivityDate="2016-05-16T13:06:46.323" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30458" PostTypeId="1" CreationDate="2016-05-16T08:11:51.127" Score="1" ViewCount="1533" Body="&lt;p&gt;Recently encountered issue of Rogue DHCP, so wanted to protect my network by implementing DHCP snooping.&#xA;Have HP 2510 Switches installed, but after searching the internet i found that HP 2510 switches does not support DHCP Snooping.&#xA;Is there any other technique to protect network from un authorised DHCP servers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="23017" LastActivityDate="2018-03-12T19:50:40.747" Title="DHCP Snooping on HP 2510 or alternate" Tags="|switching|hp-procurve|dhcp-snooping|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30459" PostTypeId="1" CreationDate="2016-05-16T10:22:51.860" Score="0" ViewCount="7895" Body="&lt;p&gt;I used &lt;code&gt;iperf3&lt;/code&gt; to measure the effect that the TCP window has on throughput. I am measuring the throughput between two virtual machines which are located on &lt;strong&gt;different&lt;/strong&gt; physical hosts. So I wrote a Python script that called &lt;code&gt;iperf3&lt;/code&gt; with different window sizes (2 KB -1024 KB) and plotted the throughput. It turned out that none of the windows sizes achieved a throughput nearly as high as I measured without defining the window size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This command measured a throughput of ~250 Mbits/s:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;iperf3 -c 10.0.0.3 -t 120&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the command I used for the following plot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;iperf3 -c 10.0.0.3 -t 120 -w &amp;lt;window size&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Y1gOT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y1gOT.png&quot; alt=&quot;iperf3 measurements with different window sizes&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain, why the throughput without specified window size is so much higher? I also can't find the default window size that is used if not specified. Does &lt;code&gt;iperf3&lt;/code&gt; use a flexible windows size if not specified?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&#xA;I uploaded two output files of &lt;code&gt;tcpdump&lt;/code&gt; &lt;a href=&quot;https://www.wetransfer.com/downloads/04eed59660749f38362a1b403da43bfe20160519162405/e158d3f44bbedcf622a47853d21bbdea20160519162405/96b9e4&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. It captured the &lt;code&gt;iperf3&lt;/code&gt; traffic with and without the &lt;code&gt;-w&lt;/code&gt; flag. Starting before &lt;code&gt;iperf3&lt;/code&gt; started until after it ended. I had a look at it in WireShark but still cannot figure out what TCP window size was used for the connections.&lt;/p&gt;&#xA;" OwnerUserId="24538" LastEditorUserId="24538" LastEditDate="2016-05-19T17:36:36.297" LastActivityDate="2016-07-15T18:30:14.380" Title="Lower throughput with fixed TCP window size?" Tags="|tcp|linux|throughput|iperf|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30460" PostTypeId="2" ParentId="23653" CreationDate="2016-05-16T12:03:34.000" Score="0" Body="&lt;p&gt;I think this is a case of the same pair of words being used for two different things in two different contexts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;port forwarding&quot; in the context of NAT routers is a rule added to the NAT implementation such that incoming connections on a given external IP and port are mapped to a given internal IP and port (often but not always external and internal ports are the same). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;port forwarding&quot; in the context of ssh is a system that forwards application-data from a TCP connection on the client side to a TCP connection on the server side over the ssh connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately rather than making a clear distinction between the two meanings the wikipedia article you linked to confusingly mixes them up.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-16T12:03:34.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30461" PostTypeId="1" AcceptedAnswerId="30473" CreationDate="2016-05-16T13:40:48.300" Score="2" ViewCount="813" Body="&lt;p&gt;What we have is a majority cabled network, CAT5e/CAT6 and fibre running at 1Gbps throught. Some wireless access points dot the buildings and supply Wi-Fi to where it is needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client now wants to install wireless APs everywhere (throwing out the existing cables) and bridges to new locations instead of fibre cables and CAT6 connections to &lt;strong&gt;static PCs&lt;/strong&gt; because &quot;it is faster, cheaper, future-proof and more efficient&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand having wireless for hard to reach places, for isolated devices and even for mobile devices. But for a new building that is going to be running a full office of 25+ PCs and printers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Is this guy a nutjob? Or am I crazy for wanting to stick with a cabled solution for static devices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Even the new 802.11ac with the right PCIe cards, will it match up to a 1Gbps fibre/copper connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Would a 802.11n 5GHz bridge be better than a fibre &quot;bridge&quot; for the 25 PCs on the other side?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WHY is cabling better than Wi-Fi? Is it the speed at which the data flows through the medium? Copper vs glass vs air? Does wireless have to jump through extra hoops to get the data sent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently finances are not an issue. I wanted to put in a 10Gbps backbone network but that got laughed at... even though it would be cheaper than the wireless overhaul that he wants...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need some good reasons why wireless would not be as good a decision as wired.&lt;/p&gt;&#xA;" OwnerUserId="25423" LastActivityDate="2016-05-16T20:58:50.027" Title="Wired vs Wireless Networks" Tags="|wireless|ethernet|lan|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30463" PostTypeId="2" ParentId="30461" CreationDate="2016-05-16T14:42:35.703" Score="1" Body="&lt;p&gt;I generally agree with you that a wired solution is superior to a wireless building assuming that PCs aren't moving around a lot and it's not purely a purely BYOD environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) You already &lt;em&gt;have&lt;/em&gt; a cabled solution; why tear it out to make way for an interference-prone wireless network?  At the very least keep the existing infrastructure in place as a fallback if the wireless doesn't work as smoothly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Are you buying wireless PCI cards for full-sized towers?  This part seems silly to me.  You already have an onboard NIC obviously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Fiber is king in my opinion.  It is secure, scalable and not prone to electrical interference of any kind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-For an office of 25 nodes 10 gbps fiber is totally unnecessary.  1 gbps should be more than enough for that number of users unless they're doing something unusual with all that bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If finances are not an issue it sounds to me like this could be (already is, I guess) a hybrid environment.  However, if the client wants wireless then I guess the client wants wireless.  A wireless test/assessment would be a good start here: hire someone to check the site for interference and noise.  Perhaps that alone will help answer the question as to whether the site is a good candidate.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-05-16T14:42:35.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30464" PostTypeId="1" AcceptedAnswerId="30465" CreationDate="2016-05-16T15:15:14.757" Score="4" ViewCount="2521" Body="&lt;p&gt;As switches don't decrease the IP &lt;em&gt;TTL&lt;/em&gt; header field, I can't detect how many steps are between a host and the router by using &lt;em&gt;tracert&lt;/em&gt;. Are there any ways to detect the number of switches between a host and the router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To define the scenario a bit further: These may be unmanaged switches, so using the administrative interface or console of the switches won't be a possibility.&lt;/p&gt;&#xA;" OwnerUserId="1667" LastEditorUserId="8499" LastEditDate="2020-07-18T17:45:24.453" LastActivityDate="2020-07-18T17:45:24.453" Title="Is there a way to detect how many switches are between a host and the router?" Tags="|switch|switching|layer2|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30465" PostTypeId="2" ParentId="30464" CreationDate="2016-05-16T15:27:37.360" Score="7" Body="&lt;p&gt;No, there isn't. Switches are transparent devices. The frames which the host sends will be the same frames as the host (a router is just a host to a switch) on the other end of the switches receives. Frames only get modified on trunks, where a VLAN tag may be placed, but then removed as it reaches the next switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Managed switches just have a virtual host which manages the switch on a VLAN attached to the switch. Managed switches are still transparent to any traffic traversing the switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-16T15:27:37.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30466" PostTypeId="1" AcceptedAnswerId="33010" CreationDate="2016-05-16T16:35:13.290" Score="0" ViewCount="554" Body="&lt;p&gt;I seem to be having trouble with communications between a Ubuntu 16.04 VM and Cisco SG-300 10 port switch. I feel like there is something obvious I MUST be missing but for the life of me I cannot figure it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Linux side, the relevant commands entered are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;modprobe 8021q   &#xA;sudo vconfig ens34 3700   &#xA;sudo ip addr add 10.0.0.1/24 dev ens34.3700  &#xA;sudo ip link set up ens34.3700&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the Cisco side, relevant commands entered are (starting from default config):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config terminal  &#xA;interface ge 1  &#xA;switchport mode trunk  &#xA;switchport trunk allowed vlan add 3700  &#xA;exit  &#xA;interface vlan3700  &#xA;ip add 10.0.0.2 255.255.255.0  &#xA;no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yet for some reason I cannot ping between the VM and the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used Wireshark to capture some traffic between the two, and what I notice is that the frames VM --&gt; Cisco switch are all tagged VLAN 3700, and the Cisco switch is able to read these frames and respond, however the responses seem to be untagged. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Linux--&gt;Cisco&#xA;&lt;a href=&quot;https://i.stack.imgur.com/9Eoh9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9Eoh9.png&quot; alt=&quot;Linux--&amp;gt;Cisco&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco--&gt;Linux&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jFm5b.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jFm5b.png&quot; alt=&quot;Cisco--&amp;gt;Linux&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does this happen? What can I do to fix it?&lt;/p&gt;&#xA;" OwnerUserId="25427" LastEditorUserId="8499" LastEditDate="2016-05-16T16:41:56.973" LastActivityDate="2016-07-11T17:32:11.490" Title="VLAN tagging between Linux and Cisco Small Business switches: fluke, bug or am I missing something?" Tags="|cisco|vlan|linux|trunk|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30467" PostTypeId="1" CreationDate="2016-05-16T16:36:00.683" Score="1" ViewCount="920" Body="&lt;p&gt;I'm using Quagga + BGP with Racoon IPSec to connect to AWS VPN tunnel. AWS provides 2 tunnels for redundancy. Everything is working with fine with Asymmetric routing in place. To test failover, I comment out a tunnels's &lt;code&gt;psk&lt;/code&gt; and restart &lt;code&gt;ipsec&lt;/code&gt;. Everything works fine for tunnel 1, but not tunnel 2. The first hurdle was specifying 2 neighbor IPs with the same ASN. After resolving that issue with &lt;code&gt;allowas-in&lt;/code&gt;, BGP failsover to the second tunnel, advertises routes, but packets are still not traversing through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please see &lt;code&gt;bgpd.conf&lt;/code&gt; below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA; router bgp 60***&#xA; no synchronization&#xA; bgp router-id 52.*.*.*&#xA; network network_1/30&#xA; network network_2/30&#xA; network local_subnet/16&#xA; neighbor remote_address_1 remote-as 9059&#xA; neighbor remote_address_2 allowas-in 1&#xA; neighbor remote_address_2 remote-as 9059&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="24398" LastActivityDate="2016-05-16T16:36:00.683" Title="Quagga BGP failover" Tags="|bgp|ipsec|quagga|" AnswerCount="0" CommentCount="5" ClosedDate="2022-11-20T01:37:13.067" ContentLicense="CC BY-SA 3.0" />
  <row Id="30468" PostTypeId="2" ParentId="30459" CreationDate="2016-05-16T17:40:36.330" Score="3" Body="&lt;p&gt;Receive window sizes (rwin) will increase and decrease automatically during a TCP session depending on how lossy the connection ends up being. It is therefore possible that when you omit the -w flag from iperf the window size is being dynamically scaled higher than your static values. Remember that maximum theoretical throughput is rwin/delay. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on that graph however it appears that your bandwidth caps out at 70Mbit or so and raising the window size isn't having any impact. As window size doesn't appear to be restricting the bandwidth, is there anything else which could be consuming it - are you performing these tests over Wifi? Alternatively, can you double check that when you set a window size greater than 256 with the -w flag, that it does actually get sent &quot;on the wire&quot; by verifying with tcpdump/Wireshark?&lt;/p&gt;&#xA;" OwnerUserId="25431" LastActivityDate="2016-05-16T17:40:36.330" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30472" PostTypeId="2" ParentId="30461" CreationDate="2016-05-16T20:25:26.370" Score="1" Body="&lt;p&gt;There are really two different questions here :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can a wireless network be used as the primary connection method for users on a medium-to-large facility? =&gt; I would answer &quot;yes, absolutely&quot;&lt;/li&gt;&#xA;&lt;li&gt;Can said wireless network entirely replace the wired network? Outside of the obvious requirement to connect the APs to something, being able to count on having absolutely everything be wireless is a tall order. IP Phones, printers, badge readers, security cameras... all those devices are still tricky to find and/or operate in a wireless-ready version.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;With the advances in wireless tech over the past few years, the reliability and performance of WiFi are such that the average user probably won't notice the difference in day to day work. So in practice, to answer your question 2), 802.11ac may not quite match a full wired Gig port, but only a very few users could possibly generate enough traffic to notice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it remains much more complex than wired networking, and requires a great many more parts to be in working order. You can have interference issues, transmit power issues, PC driver issues, authentication issues... that for the most part just don't occur on a wired network. So wireless is going to cost more to manage day-to-day, just because of the number of things that can go wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your question 3) for an inter-building bridge, I would definitely go with fibre, using wireless only if I had no other options, for all the reasons I mentioned above (reliability mostly)&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-05-16T20:25:26.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30473" PostTypeId="2" ParentId="30461" CreationDate="2016-05-16T20:58:50.027" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;1) Is this guy a nutjob? Or am I crazy for wanting to stick with a cabled solution for static devices?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would say no, not a nutjob. Nor are you crazy for wanting to keep cabling where possible. However, this is not a totally unreasonable request although it goes a bit further than it probably should. Since the network is already in place, some sort of &quot;happy medium&quot; would probably work here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several things that are driving this type of request:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In the past 5-8 years, people have become much more highly mobile and like it that way. Many end users now have multiple devices they carry that are wireless from the standard smart phone and tablet to a whole slew of other gadgets (watches, light bulbs, speakers, and so on). While wireless used to be a nice convenience, today it is often a requirement to have reliable, fast wireless where ever they expect to go.&lt;/li&gt;&#xA;&lt;li&gt;People hate cables. Mice, keyboards, network, and other connections are widely expected to be wireless. Sure, that laptop may be pretty mobile, but people hate having to connect and disconnect cables every time they want to move. They don't like the messy look of cables that often results at most desks even with &quot;desktop&quot; computers. They like to change the furniture layout in their office and the ports are no longer where they &quot;should be&quot; adding to the inconvenience and possible mess.&lt;/li&gt;&#xA;&lt;li&gt;As a result of the above, many devices today do not come with a wired network interface installed. Without things like a wired network port, laptops/tablets can be made much thinner than if they had one installed. Battery life is extended by having once less device built in to keep powered. And from the manufacturers viewpoint, the less hardware they have to put into a device, the cheaper it is  to manufacture.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2) Even the new 802.11ac with the right PCIe cards, will it match up to a 1Gbps fibre/copper connection?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3) Would a 802.11n 5GHz bridge be better than a fibre &quot;bridge&quot; for the 25 PCs on the other side?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;These are ultimately both the same question but looking at different connections and the answer is the same for both. No. A wireless connection is not as good as a wired connection in almost all cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the question shouldn't be &quot;is it as good&quot; but rather &quot;is it sufficient to meet the client's needs (current and future)?&quot; Having computers for every user with 64GB RAM, 4TB SSD storage (with RAID of course), the best CPU &amp;amp; GPU on the market and multiple large displays is probably certainly better than what they are currently using, but it is also probably overkill for what is actually needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having a solid cabling plant providing the backbone that provides service to the APs themselves is important. Since they already have a reasonably solid cable plant, moderate upgrades and added wireless coverage/capacity would seem to be in order here.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;WHY is cabling better than Wi-Fi? Is it the speed at which the data flows through the medium? Copper vs glass vs air? Does wireless have to jump through extra hoops to get the data sent?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can definitely still get much higher speeds on copper/fiber than you can wireless. Generally speaking, fiber &gt; copper &gt; RF. But again, is it really speed the client is looking for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cabling is also more &quot;stable&quot; than wireless. 802.3 is much more mature and standardized. It isn't changing as quickly, is relatively simple in comparison and as a result doesn't run into many of the client inter-operability problems that can occur on wireless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cabling can also be more secure than wireless. RF energy sent out of a device is not limited to only reaching the intended device(s). Other devices can see and potentially make use of this information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, wireless has additional overhead and there are other limitations with how 802.11 operates.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Client now wants to install wireless APs everywhere (throwing out the existing cables) and bridges to new locations instead of fibre cables and CAT6 connections to static PCs because &quot;it is faster, cheaper, future-proof and more efficient&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The the specific claims of the client:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Faster : simply not true. Wired is currently faster in nearly all cases, even if you can use the full capabilities of 802.11ac on both the AP and client. This claim should be easy to refute.&lt;/li&gt;&#xA;&lt;li&gt;Cheaper : you may want to start by reading &lt;a href=&quot;https://networkengineering.stackexchange.com/a/1015/33&quot;&gt;my answer posted to a similar question&lt;/a&gt;. While it is now almost three years old, many of the same principles apply. But if you are comparing providing brand new service to multiple end users, this is certainly true in some senses. Cabling is expensive, switch ports are expensive, and if you can serve multiple devices off of one (to an AP) then those costs are lower.&lt;/li&gt;&#xA;&lt;li&gt;Future-proof : again, true to a degree. Going back to my point #3 above, many devices no longer come with a network port. They expect wireless service to be available, so the request does take into account this need.&lt;/li&gt;&#xA;&lt;li&gt;More efficient : I guess this would depend on how one measures &quot;efficiency.&quot; Much like statistics, if you change the &quot;measure&quot; you change which is more efficient.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Again, I would personally propose some sort of happy medium here. Provide the full wireless coverage the client desires, but also propose upgrades to the current infrastructure that will benefit both the additional wireless support and the existing wired connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no reason to &quot;throw out&quot; the existing network. Make use of it where it makes sense (printers, copiers, servers, shared storage, etc) and enable the client's end users to be more mobile by losing the wires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just make sure you do it right and provide the correct information along the way. You did say that finances weren't an issue, so if it performs accurately to what you told the client, has the problems you warned them may occur, and they aren't happy, they shouldn't be upset about paying you more to transition some or all of the devices back to the wired network.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-05-16T20:58:50.027" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30474" PostTypeId="2" ParentId="4997" CreationDate="2016-05-16T20:59:21.647" Score="2" Body="&lt;p&gt;The advantages of an “area” in OSPF configuration are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;smaller routing table (no summarization by default)&lt;/strong&gt;:&#xA;fewer routing table entries as network addresses can be summarized between areas &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;smaller link-state database (LSDB)&lt;/strong&gt;:&#xA;fewer routers exchanging LSAs, minimizes processing and memory requirements &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;less-frequent SPF algorithm calculations&lt;/strong&gt;:&#xA;localizes impact of a topology change within an area. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25435" LastEditorUserId="55273" LastEditDate="2019-02-17T15:07:20.257" LastActivityDate="2019-02-17T15:07:20.257" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="30475" PostTypeId="2" ParentId="27822" CreationDate="2016-05-16T21:27:42.140" Score="2" Body="&lt;p&gt;Move to configuration mode by typing this (you exclude address that you don't want the DHCP to assign to any device, e.g. printers, static&#xA;IP addresses, etc.):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# config t&#xA;Router(conf)# ip dhcp excluded-adress &amp;lt;excluded address list&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you have to set up a pool, a pool of IP addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(conf-dhcp)# ip dhcp pool &amp;lt;pool name&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now remember the pool is all possible host of the network addresses that you will assign here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(conf-dhcp)# network &amp;lt;network&amp;gt; &amp;lt;mask or /length&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;now you set up the default gateway (which in this case is itself):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(conf-dhcp)# default-router &amp;lt;gateway address&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The line above excludes the default gateway's IP address from the pool.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting up DNS server's IP address to exclude that too:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(conf-dhcp)# dns-server &amp;lt;DNS server list&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if you want to check DHCP clients, simply type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(conf-dhcp)# ip dhcp binding&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25436" LastEditorUserId="8499" LastEditDate="2016-05-16T21:39:50.973" LastActivityDate="2016-05-16T21:39:50.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30476" PostTypeId="1" AcceptedAnswerId="30478" CreationDate="2016-05-16T21:38:50.233" Score="4" ViewCount="10134" Body="&lt;p&gt;Suppose we have a Class C Subnet (&lt;code&gt;255.255.255.0&lt;/code&gt;), why do we get to have 254 hosts on it even though we have 256 unique internal IPv4 addresses from &lt;code&gt;192.168.1.0&lt;/code&gt; to &lt;code&gt;192.168.1.255&lt;/code&gt;? Even if we scale up the number of subnets using the mask &lt;code&gt;255.255.255.254&lt;/code&gt;, why can't we have any devices on the subnet even though there is 192.168.1.0 and 192.168.1.1 available?&lt;/p&gt;&#xA;" OwnerUserId="25438" LastEditorUserId="8499" LastEditDate="2020-07-17T03:24:25.880" LastActivityDate="2020-07-17T03:24:25.880" Title="Why are number of hosts on a subnet less than the number of combinations we can make with the bits remaining?" Tags="|ip|ipv4|subnet|ip-address|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30477" PostTypeId="2" ParentId="30476" CreationDate="2016-05-16T21:46:47.753" Score="0" Body="&lt;p&gt;First ip address of any subnet (for example 102.168.0.0) is network address. It is reserved for that purpose. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last one is reserved for broadcast address. (192.168.1.255)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second address (192.168.1.1) , well, it is best for default gateway. Why? You have to set default gateway on each device maybe; which one are you gonna remember the best? 192.168.1.1 or 1.149 for example?&#xA;So the first and the last are reserved. The first is gateway...&lt;/p&gt;&#xA;" OwnerUserId="25436" LastActivityDate="2016-05-16T21:46:47.753" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30478" PostTypeId="2" ParentId="30476" CreationDate="2016-05-16T21:54:24.937" Score="4" Body="&lt;p&gt;First, classful routing is dead, and it has been for over 20 years, killed by VLSM and CIDR (see RFCs 1518 and 1519).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPv4 you cannot use the network or broadcast addresses as host address assignments. In your example, &lt;code&gt;192.168.1.0&lt;/code&gt; is the network address, and &lt;code&gt;192.168.1.255&lt;/code&gt; is the broadcast address. Those addresses have special meaning to IPv4, and assigning them to hosts causes problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a couple of exceptions to this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using a &lt;code&gt;/32&lt;/code&gt; (&lt;code&gt;255.255.255.255&lt;/code&gt;) address only gives you one possible address. This is&#xA;often used for loopback addresses, and the address must be routed.&lt;/li&gt;&#xA;&lt;li&gt;Using a &lt;code&gt;/31&lt;/code&gt; (&lt;code&gt;255.255.255.254&lt;/code&gt;) network has only two possible addresses, both of which can be used for host addresses.&#xA;used for a point-to-point link. Meaning you can use both &lt;code&gt;192.168.1.0&lt;/code&gt; and &lt;code&gt;192.168.1.1&lt;/code&gt; (the only two available addresses) as host addresses. This is per &lt;a href=&quot;https://www.ietf.org/rfc/rfc3021.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 3021 Using 31-Bit Prefixes on IPv4 Point-to-Point Links&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So, Your example of increasing the number of networks using &lt;code&gt;/31&lt;/code&gt; (&lt;code&gt;255.255.255.254&lt;/code&gt;) networks will work for point-to-point links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This only applies to IPv4, since IPv6 can use all the addresses in a subnet, even the first and last addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-16T22:08:02.240" LastActivityDate="2016-05-16T22:08:02.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30479" PostTypeId="1" CreationDate="2016-05-16T22:23:17.967" Score="3" ViewCount="2855" Body="&lt;p&gt;I have a question regarding subnet masks and my understanding (or misunderstanding of them). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when a subnet mask is used, a bitwise AND is performed using the subnet mask and the IP address(es). Traffic is exchanged (routed) between subnetworks with special gateways (routers) when the routing prefixes of the source address and the destination address differ. A router constitutes the logical or physical boundary between the subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK so far. But surely on everything has to be sent to a router/switch anyway right? So why do you need to have the subnet mask on your computer? If all data goes through the router, surely it is only the router that needs to have the subnet mask on it?&lt;/p&gt;&#xA;" OwnerUserId="19719" LastEditorUserId="8499" LastEditDate="2019-01-12T23:25:27.037" LastActivityDate="2019-01-12T23:26:10.853" Title="What is the point of a subnet mask on a local network?" Tags="|routing|switch|router|ip|subnet|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="30481" PostTypeId="2" ParentId="30479" CreationDate="2016-05-16T22:36:52.613" Score="3" Body="&lt;p&gt;What a mask does is to define the separation between the network portion of an address, and the host portion of an address. IPv4 lets you slide these two pieces around to get a network which has enough host addresses to match your needs. &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;This answer&lt;/a&gt; may help you to visualize this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use shorter masks to aggregate or summarize networks. This allows you to advertise a single route instead of a bunch of smaller routes.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But surely on everything has to be sent to a router/switch anyway&#xA;  right? So why do you need to have the subnet mask on your computer? If&#xA;  all data goes through the router, surely it is only the router that&#xA;  needs to have the subnet mask on it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not everything needs to be sent to a router. Traffic destined for the same network will never go through the router. Switches don't count since they don't participate in layer-3, where IP is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a host wants to send something to another host, it masks the destination address to see if it is on the same network as itself. If it is, it just sends the traffic directly to the host on the same network. If the destination is on another network, it sends the traffic to its configured gateway. It does this using layer-2 (e.g. MAC) addresses, not by changing the destination IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With IPv6, you basically have a single network size (&lt;code&gt;/64&lt;/code&gt;), so much of address manipulation is easier.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2019-01-12T23:26:10.853" LastActivityDate="2019-01-12T23:26:10.853" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="30483" PostTypeId="2" ParentId="30459" CreationDate="2016-05-16T23:15:00.600" Score="3" Body="&lt;p&gt;As Marco mentioned, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Receive window sizes (rwin) will increase and decrease automatically&lt;/strong&gt; during a TCP session depending on how lossy the connection ends up being. It is therefore possible that when you omit the -w flag from iperf the window size is being &lt;strong&gt;dynamically scaled higher than your static values.&lt;/strong&gt; Remember that maximum theoretical throughput is rwin/delay.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When you consider this and the take &lt;a href=&quot;https://en.wikipedia.org/wiki/TCP_window_scale_option&quot; rel=&quot;nofollow&quot;&gt;TCP Window Scaling&lt;/a&gt; into consideration, your 1,024 KB window is considerably lower than the maximum size of 1,073,725,440 bytes (about 1 GB). That's not to say that iperf would reach that size, but it is highly likely it would go well above 1,024 KB when the -w flag isn't specified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your best bet is to redo the test and run a packet capture at the same time. That way you'll be able to see the window size's value.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="8499" LastEditDate="2016-05-22T12:32:18.793" LastActivityDate="2016-05-22T12:32:18.793" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30487" PostTypeId="2" ParentId="28123" CreationDate="2016-05-17T01:28:00.890" Score="1" Body="&lt;p&gt;One idea would be to look at the minutes and reports from the IEEE 802.11 working group sessions &lt;a href=&quot;http://www.ieee802.org/11/Reports&quot; rel=&quot;nofollow&quot;&gt;at the IEEE website.&lt;/a&gt; I think they also keep the detailed proposals for all features online, you should be able to find even more details if required.&lt;/p&gt;&#xA;" OwnerUserId="16004" LastActivityDate="2016-05-17T01:28:00.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30488" PostTypeId="1" CreationDate="2016-05-17T05:55:04.837" Score="0" ViewCount="70" Body="&lt;p&gt;I want to ask a definition question. What is &quot;a network flow whose packets are sent on a single path&quot; called? Is it unsplittable flow, integral flow, or integer flow? or something else?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="25443" LastEditorUserId="25443" LastEditDate="2016-05-17T06:32:16.777" LastActivityDate="2016-05-17T06:32:16.777" Title="Flow Definition" Tags="|packet-path|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="30489" PostTypeId="2" ParentId="30464" CreationDate="2016-05-17T06:13:08.160" Score="1" Body="&lt;p&gt;If all the switches run spanning tree then you may be able to calculate it from the Spanning Tree BPDUs, as they contain the cost of the path to the root switch. You'd compare the costs seen by the host versus the costs seen by the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are obviously toplogies where this approach would fail, so even this is no general solution. As Ron wrote, a design objective of Radia Perlman's bridging was that it be transparent to hosts (and routers are hosts as far as ethernet cares).&lt;/p&gt;&#xA;" OwnerUserId="25444" LastActivityDate="2016-05-17T06:13:08.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30491" PostTypeId="2" ParentId="30488" CreationDate="2016-05-17T06:22:52.817" Score="3" Body="&lt;p&gt;There's no special name for the flow, because the path(s) taken by a flow isn't really a property of the flow so much as it is a property of the frame-forwarding devices on the path(s) and their link-sharing configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover even when link layer technologies are configured to send all packets in a flow along one link, that doesn't prevent different choices being made at the network layer, such as when a upstream link flaps and the IP next-hop changes, or when the forward path and return paths are not identical (asymmetric routing), or when there is a MPLS fast-reroute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus there's no convenient name as we always have to spell out with some care what we mean by &quot;all packets in a flow take the same path&quot; so we are clear which aspect of device configuration is being explored.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastActivityDate="2016-05-17T06:22:52.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30493" PostTypeId="2" ParentId="29622" CreationDate="2016-05-17T06:44:27.200" Score="4" Body="&lt;p&gt;The OSI model is not 100% conformed to. It is a guide line for understanding and organizing the various functions required to create a network, or an inter-network, or even the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So not everything falls perfectly within a single OSI layer.  However, understanding the primary purpose of each layer will help categorize different protocols into different layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/osi-model/#osi-layer-1&quot; rel=&quot;nofollow&quot;&gt;Layer 1&lt;/a&gt; is primarily responsible for providing a mechanism or medium to move bits (1s and 0s) from one device to another. &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/&quot; rel=&quot;nofollow&quot;&gt;Twisted Pair wiring&lt;/a&gt;, Serial cables, Fiber Optics are all considered Layer 1 technologies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wifi, though it doesn't have a physical medium, is also considered a Layer 1 technology since it has the ability to move 1s and 0s from one device to the next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anecdotally, you could consider the &lt;a href=&quot;https://en.wikipedia.org/wiki/Tin_can_telephone&quot; rel=&quot;nofollow&quot;&gt;string between two cans&lt;/a&gt; a Layer 1 &quot;technology&quot;, since it has the ability to move 1s and 0s from one device to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/osi-model/#osi-layer-2&quot; rel=&quot;nofollow&quot;&gt;Layer 2&lt;/a&gt; is concerned with what I like to call &lt;em&gt;Hop to Hop&lt;/em&gt; delivery. It is responsible for putting the 1s and 0s on whatever L1 technology is being used, as well as retrieving the 1s and 0s from whatever L1 technology is being used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Network Interface Card (NIC) is an example of a Layer 2 technology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To facilitate &quot;hop to hop&quot; delivery, Layer 2 uses a MAC address -- which is effectively the identification of a particular device's NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/osi-model/#osi-layer-3&quot; rel=&quot;nofollow&quot;&gt;Layer 3&lt;/a&gt; is responsible for what I like to call &lt;em&gt;End to End&lt;/em&gt; delivery. This is where protocols like IP exist. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Between two end points on either side of the Internet, there might be 10s or 100s of NICs that a packet must pass through. Layer 2 will get it from one NIC to the next. But Layer 3 will determine where the final destination is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/osi-model/#osi-layer-23&quot; rel=&quot;nofollow&quot;&gt;Layer 2 and Layer 3 work together&lt;/a&gt; to move Data from one end point to another through each individual &quot;NIC to NIC&quot; hops between the end points. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/osi-model/#osi-layer-4&quot; rel=&quot;nofollow&quot;&gt;Layer 4&lt;/a&gt; is responsible for segregating Network Streams. All the 1s and 0s carried by L1 arrive on your PC on the same NIC. Something has to distinguish which 1s and 0s belong to your Internet Browser,  or your Music Streaming application, or your Chat program, or Operating System updates, or a plethora of other applications that send or receive data from the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 5, 6, and 7 all blend together. I wrote a potential example of the initial intention of each of those layers on reddit, but understand that was mostly an example, not a description of how it actually works:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;L5 - Session - this could be something like HTTP cookies, keeping individual browser sessions different from the next. It is a way identify and keep track of different set of bits, within the same L4 TCP/UDP connection.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;L6 - Presentation - The bits show up as 1s and 0s. Something needs to deterimine how those 1s and 0s should be interpretted. For example, should bits be grouped into sets of 8 and converted into letters according to ASCII. Or should the bits be converted to large numbers and used to decrypt the content.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;L7 - Application - Now that L6 has turned the bits into letters, we need to turn those letters into something meaningful. For example, the letters GET /index.html HTTP/1.1 mean something in the HTTP application, they are a command to fetch the index.html page from the server.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;sup&gt;&lt;a href=&quot;https://www.reddit.com/r/networking/comments/4j677t/tried_googling_first_but_couldnt_find_the_answer/d34arud&quot; rel=&quot;nofollow&quot;&gt;Source&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;HR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the brief description of each Layer, you can then apply that knowledge to determine what layer a particular protocol operates at.  For example...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;HTTP is not a function to move 1s and 0s across a wire.&lt;/li&gt;&#xA;&lt;li&gt;HTTP is not a function that puts and pulls 1s and 0s on/off a wire&lt;/li&gt;&#xA;&lt;li&gt;HTTP is not a function that enables end to end delivery of data&lt;/li&gt;&#xA;&lt;li&gt;HTTP is not a function that segregates all the data streams from a wire.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As such, HTTP can be considered as a L5/L6/L7 protocol. I've seen this abbreviated as a L5 protocol, or L5+, or L7. It all means the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But again the OSI model is not perfect, and everything doesn't perfectly conform to a particular layer. For example...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ICMP is not a function to move 1s and 0s across a wire.&lt;/li&gt;&#xA;&lt;li&gt;ICMP is not a function that puts and pulls 1s and 0s on/off a wire&lt;/li&gt;&#xA;&lt;li&gt;ICMP is not a function that enables end to end delivery of data&lt;/li&gt;&#xA;&lt;li&gt;ICMP is not a function that segregates all the data streams from a wire.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Despite all that, ICMP is considered a L3 protocol, mainly because its primary usage (ping) tests if a packet can get from one end of the Internet to the other. AKA, it is primarily associated with end to end delivery.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the rest of the protocols you listed, this is where they typically are associated with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;L3 - OSPF, ICMP, BGP, RIP&lt;/li&gt;&#xA;&lt;li&gt;L4 - TCP, UDP&lt;/li&gt;&#xA;&lt;li&gt;L5/L6/L7 - HTTP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;DHCP is a tricky one. On one hand, it is primarily concerned with providing end hosts with IP addresses, but on the other its communication does not happen over IP. Personally, despite that, I like to consider DHCP a L3 protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/key-players/#arp&quot; rel=&quot;nofollow&quot;&gt;ARP&lt;/a&gt; is also the other often debated tricky one. It communicates without an IP (L3) header, but its purpose is to resolve IP addresses to MAC addresses -- and it is only used by L3 devices. It is sometimes considered both layers, or in between both layers. Or sometimes simply identified as a L2 protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't really matter where you land on the debate, so long as you understand the view points from both sides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully that will help you distinguish or place protocols in a particular layer. Again, keep in mind, it never works out perfectly. The OSI model is a conceptual model, not an explicit standard everyone strictly adheres to.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-05-17T06:44:27.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30495" PostTypeId="2" ParentId="30459" CreationDate="2016-05-17T12:02:53.997" Score="3" Body="&lt;p&gt;That's not a shock. These day we automatically tune the amount of RAM assigned to TCP buffers (aka the maximum TCP window size), and by specifying the window size you are turning off the automated tuning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The flat-topping at around where the bandwidth-delay product would be about 64KB suggests to me that a suitable Window Scale Option isn't being negotiated, therefore the effective TCP buffer is held at 64KB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside, you have a serious throughput issue if you are only getting 250Mbps between VMs on the same host under the most favourable circumstances. You should make sure you are using paravirtualised virtio network interfaces, and that the VMs are on the same bridge. To reason about network performance you really need to get the best case performance up to the point where hardware is the limitation.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastActivityDate="2016-05-17T12:02:53.997" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30496" PostTypeId="2" ParentId="30443" CreationDate="2016-05-17T12:18:40.380" Score="17" Body="&lt;p&gt;You are totally correct, if we have to use an instruction cycle per bit then 10Gbps would be unachievable. So the first thing to note is that we handle a word per CPU instruction -- 64 bits.&lt;/p&gt;&#xA;&lt;p&gt;Even then the worst thing we can do for performance is to have the CPU access all of the words of a packet. Thus the focus on &amp;quot;zero-copy&amp;quot; handling of packets. Some of that trickery is in the interfaces themselves: they have DMA (&amp;quot;Direct memory access&amp;quot;) so that the ethernet controller chip copies the data into RAM; they calculate the checksums so that the CPU doesn't have to access all the words in the packet to do so. Some of it is in the data structure design: we are careful to align packet buffers so we can move them by changing the ownership of a page table entry. Some of it is just careful programming to ensure that packet data is accessed the least number of times, and preferably not accessed at all until the receiving application program.&lt;/p&gt;&#xA;&lt;p&gt;Once we've done all of this the next limitation is the overhead of handling packets one at a time. Thus there are a heap of &amp;quot;segmentation offload&amp;quot; features both in the ethernet controller and in the kernel so that we handle groups of packets. We even delaying retrieving data from the ethernet controller so that these groups are larger.&lt;/p&gt;&#xA;&lt;p&gt;Finally we have special-case shortcuts, such as the kernel's &lt;code&gt;sendfile()&lt;/code&gt; call which is an express path from disk to network using the minimal amount of work.&lt;/p&gt;&#xA;&lt;p&gt;We can even use special-case routing (the forwarding of packets from one interface to another) using the hardware features of the network interface cards and treating the PCI bus as a bus between the cards rather than getting the CPU involved. That can't be done in general purpose operating systems, but vendors like Intel provide software libraries to implement such features on their ethernet controllers.&lt;/p&gt;&#xA;&lt;p&gt;Moving away from CPUs altogether, we can even build special-purpose routers where all forwarding tasks happen in hardware. Since the PCI bus would then be a limitation, they run multiple parallel busses; or even multiple parallel busses to multiple parallel crossbar switch assemblies. At one end of the market a small TCAM-based ethernet switch would be one example; at the other end of the market the Juniper M40 would be a canonical design.&lt;/p&gt;&#xA;&lt;p&gt;A typical switch will start to receive a packet, look up the destination address in the TCAM, attach a tag with the egress-port to the packet, and then DMA the still-incoming packet to the egress port's controller. Note that if the output port is congested then all that can be done on this simple switch is to throw away the ingress packet. Thus simple switches do not make a good choice for when links change speed and some queuing is desirable. Of course more sophisticated switches exist, for which you pay more.&lt;/p&gt;&#xA;&lt;p&gt;A typical router will receive a packet and hold it in a short queue. The destination IP address will be looked up in static RAM, the packet will then be exploded into cells to reduce latency, and each cell sent to a cross-bar switch to the egress card. That card will reassemble the cells into a packet, and queue the packet out the egress interface.  The queuing on the egress interface can be sophisticated.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastEditorUserId="88751" LastEditDate="2024-01-11T01:10:07.167" LastActivityDate="2024-01-11T01:10:07.167" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="30499" PostTypeId="1" AcceptedAnswerId="30502" CreationDate="2016-05-17T17:21:24.460" Score="4" ViewCount="1934" Body="&lt;p&gt;I understand the concepts of generating a VLAN.  However, on a small, closed, sophisticated network, are there any security advantages to activating VLAN tagging?&lt;/p&gt;&#xA;" OwnerUserId="607" LastEditorUserId="8499" LastEditDate="2019-01-04T05:57:18.523" LastActivityDate="2019-01-04T05:57:18.523" Title="Are there any security advantages to activating VLAN tagging?" Tags="|vlan|security|trunk|private-vlan|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30501" PostTypeId="1" AcceptedAnswerId="30504" CreationDate="2016-05-17T17:30:53.873" Score="3" ViewCount="348" Body="&lt;p&gt;I realized that all of my devices have the same public IP address (I had knowledge about the concept of public and private IP addresses, but I thought this was unique in both cases), so what I do not understand very well is how the router will know which device corresponds a response entering my LAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's an example, but it doesn't tell me how the router handle this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GS914.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GS914.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I read somewhere that it was using ports, but what if, for example, my brother and I are doing SSH, from what I understand, the router would receive answers to the same IP address (because the public IP address is shared), and to the same port (22 for SSH), then how does the router know to which device to give the corresponding answers?&lt;/p&gt;&#xA;" OwnerUserId="25457" LastEditorUserId="8499" LastEditDate="2018-12-23T06:15:07.877" LastActivityDate="2018-12-23T06:15:07.877" Title="Basic questions about Public IP addresses and used ports" Tags="|routing|ip|ipv4|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30502" PostTypeId="2" ParentId="30499" CreationDate="2016-05-17T17:32:57.123" Score="4" Body="&lt;p&gt;The security part comes from using VLANs. Users and devices on one VLAN cannot communicate with users and devices on another VLAN, except through a router. This gives you the opportunity to place restrictions (firewall, ACLs, etc.) on the VLAN-to-VLAN communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN tags are used on a trunk, where traffic from multiple VLANs travels, in order to tag the frames so that switches know which frames belongs to which VLAN. Most end-devices don't understand VLAN tags on frames, and tagging frames to an end-device will usually result in the frames being dropped. This part isn't really about security, except where it helps keep the traffic separate on trunks where there is traffic from multiple VLANs. &lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-17T17:32:57.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30503" PostTypeId="2" ParentId="29944" CreationDate="2016-05-17T17:41:34.187" Score="2" Body="&lt;p&gt;3G and 4G are incompatible from a physical layer perspective. The modem knows whether the network is 3G or 4G because it knows what PHY protocol it is using.&lt;/p&gt;&#xA;" OwnerUserId="24944" LastActivityDate="2016-05-17T17:41:34.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30504" PostTypeId="2" ParentId="30501" CreationDate="2016-05-17T17:44:50.710" Score="2" Body="&lt;p&gt;Don't confuse the well-know ports used in the destination with the source port your PC uses. Most of the time, your PC will use a random, ephemeral port when initiating communication. For instance, when you browse a web page, your PC will use port 80 (well-know port for HTTP) as the destination port, but it will choose its own port (e.g. 53277) for the source port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router using NAT will maintain a NAT table. When you initiate a connection from inside the NAT (private address) the NAT table will have an entry with the source IP address, source port (this is usually a random, ephemeral port), destination IP address, destination IP port, and the random port number your router chooses to use to replace the source port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When traffic comes back to the public IP address and the random port the NAT assigned, the NAT will reverse the process, replacing the public destination address and port with the ones from the NAT table to send back to your inside host.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-12-23T06:14:33.653" LastActivityDate="2018-12-23T06:14:33.653" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="30506" PostTypeId="1" CreationDate="2016-05-17T18:41:31.520" Score="1" ViewCount="236" Body="&lt;p&gt;I am still getting my head around securing our small network and I am not sure to what level of protection a firewall should actually give.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most firewalls have different features and levels but other than a standard firewall being included at the basic level it is not consistent what can be added. Some other features I've seen include are intrusion prevention (IPS) and Anti Virus and Anti-Phishing at the point of coming in to the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What should I look for as a minimum in a security device, or do you know of any resources which could help guide the decision to this answer?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of my main gaps of knowledge is, is anti-virus at the firewall level really required when you have end point anti virus such as Windows Defender? (I should just add we will have a Windows 2012 server as a domain controller etc sitting behind the firewall, in case that changes things).&lt;/p&gt;&#xA;" OwnerUserId="24774" LastEditorUserId="24774" LastEditDate="2016-05-17T20:15:19.713" LastActivityDate="2016-05-17T20:15:19.713" Title="What level of protection should a firewall give?" Tags="|firewall|" AnswerCount="1" CommentCount="9" ClosedDate="2016-05-17T19:52:34.247" ContentLicense="CC BY-SA 3.0" />
  <row Id="30507" PostTypeId="2" ParentId="30506" CreationDate="2016-05-17T19:02:08.080" Score="1" Body="&lt;p&gt;As soon as you connect to the Internet, your firewall logs will show that there are many attempts to break in, and these attempts continue, non-stop, 24x7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not everything is about stealing your property, some people are just malicious, and want to bring you down if they can. Some people want to take over your equipment to launch attacks, send spam, or trade child pornography from your equipment. This can have some serious repercussions for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What features you get really depends on your needs, and that is something only your company can answer. You need to decide the level of risk you are willing to tolerate, and weigh that against the resources required to get your risk down to that level. For example, if you have a bunch of naive users, the Anti-Spam, Anti-Phishing, and, perhaps, the Anti-Virus features may well be worth the cost. Only your company can decide.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-17T19:02:08.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30508" PostTypeId="2" ParentId="30499" CreationDate="2016-05-17T19:29:43.260" Score="2" Body="&lt;p&gt;By themselves, VLANs do not have any security advantages.  But using VLANs, as @ronmaupin hints at, allows you to place access control lists to restrict traffic flowing from one VLAN to another.  So, for example, you can restrict users on a insecure VLAN from reaching devices on a more secure VLAN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would use VLAN tagging if you have more than one VLAN on a physical port.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-17T19:29:43.260" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30509" PostTypeId="1" AcceptedAnswerId="30512" CreationDate="2016-05-17T21:14:31.957" Score="4" ViewCount="816" Body="&lt;p&gt;How do I tell Juniper EX4200 to push specific S-VLAN based on C-VLAN on q-in-q (dot1q-tunneling)  port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance I want to instruct EX4200 to perform Q-in-Q using these rules:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1) If a single-tag frame is received on ge-0/0/0 with C-VLAN=41, push S-VLAN=4.&#xA;2) If a single-tag frame is received on ge-0/0/0 with C-VLAN=42, push S-VLAN=4.&#xA;3) If a single-tag frame is received on ge-0/0/0 with C-VLAN=51, push S-VLAN=5.&#xA;4) If a single-tag frame is received on ge-0/0/0 with C-VLAN=52, push S-VLAN=5.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Conversely, whenever a double-tag frame is to be sent on ge-0/0/0, the outter S-VLAN ought to be removed (popped).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can this be done with Juniper EX4200? If so, please point out the specific configuration commands.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-05-18T01:28:56.583" Title="Juniper EX4200 how to select s-vlan from c-vlan on dot1q-tunneling access port?" Tags="|vlan|juniper|juniper-junos|qinq|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30512" PostTypeId="2" ParentId="30509" CreationDate="2016-05-18T01:28:56.583" Score="4" Body="&lt;p&gt;This should do what you are after:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode access&#xA;    set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members SVID4&#xA;    set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members SVID5&#xA;    set vlans SVID4 vlan-id 4&#xA;    set vlans SVID4 dot1q-tunneling customer-vlans 41-42&#xA;    set vlans SVID4 dot1q-tunneling layer2-protocol-tunneling all&#xA;    set vlans SVID5 vlan-id 5&#xA;    set vlans SVID5 dot1q-tunneling customer-vlans 51-52&#xA;    set vlans SVID5 dot1q-tunneling layer2-protocol-tunneling all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;H&lt;/p&gt;&#xA;" OwnerUserId="11927" LastActivityDate="2016-05-18T01:28:56.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30517" PostTypeId="1" AcceptedAnswerId="33465" CreationDate="2016-05-18T08:52:01.377" Score="1" ViewCount="598" Body="&lt;p&gt;I have been reading and watching some information regarding fiber networks and their deployment. One interesting point that was raised was that in a fiber network generally a DHCP server is used for the addressing but also for the bandwidth control of the end user in lieu of a traditional Radius server/PPPoE Authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have worked with Radius servers/PPPoE in conjunction with an ADSL network and this is the setup I am familiar with, however, as we move closer to fiber deployment I am considering how I would go about managing a users bandwidth/group of users bandwidth without using Radius/PPPoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone point me in the direction of how this is currently being achieved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For further info I am looking at using SDN switches running Cumulus Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As always I apologise if I am rambling or making no sense&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To clarify further I am looking at this from a service provider perspective. I am unsure as to what tools are currently being used to limit the end user to a particular speed/tariff when removing the Radius server ie the AAA/ACL. For example I want to limit customers a,b,c to xDown and xUp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the video's I have seen is the following:&#xA;&lt;a href=&quot;https://www.youtube.com/watch?v=ggxI-lpk41I&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=ggxI-lpk41I&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully I have made the situation clearer and not worse.&lt;/p&gt;&#xA;" OwnerUserId="6081" LastEditorUserId="6081" LastEditDate="2016-05-18T15:38:06.790" LastActivityDate="2016-07-26T17:17:03.033" Title="Fiber Network Bandwidth Control without Radius/PPPoE (Service Provider-Limit Client Bandwidth)" Tags="|fiber|pppoe|sdn|radius|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30518" PostTypeId="2" ParentId="30430" CreationDate="2016-05-18T10:02:05.600" Score="3" Body="&lt;p&gt;From the &lt;code&gt;wget&lt;/code&gt; manpage:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;GNU Wget is a free utility for non-interactive download of files from the Web.  It supports HTTP, HTTPS, and FTP protocols, as well as retrieval through HTTP proxies.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;HTTP, HTTPS, and FTP are all TCP protocols (and respectively use default TCP ports 80, 443, and 20/21). Therefore the answer to your question is: wget uses TCP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any source that could have said that wget uses UDP is plain wrong. Since UDP is a connectionless, unreliable, not-acknowledged protocol, it is unfit for file transfer.&lt;/p&gt;&#xA;" OwnerUserId="19543" LastEditorUserId="19543" LastEditDate="2016-05-18T10:14:14.727" LastActivityDate="2016-05-18T10:14:14.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30519" PostTypeId="1" AcceptedAnswerId="30530" CreationDate="2016-05-18T10:43:33.070" Score="1" ViewCount="53" Body="&lt;p&gt;I want to replicate data (music, video, photos, user's data) across different geographical networks. How to connect several networks into a single network to let nodes comunicate to each other? &lt;br&gt;&#xA;Example:&lt;br&gt;&#xA;I have several nodes in the network 192.168.0.0/24 and several nodes in the network 10.0.0.0/24. Nodes have to be able to replicate data from nodes in 192.168.0.1/24 to nodes in 10.0.0.0/24 and vice versa.&lt;br&gt;&lt;br&gt;&#xA;I have read about VPN but I am not sure what solution I need to use and when.&#xA;I can't decide what to use OpenVPN or IPsec or another solution. Can you suggest me what to use for data replication between networks?&lt;/p&gt;&#xA;" OwnerUserId="25480" LastActivityDate="2016-05-18T13:57:23.590" Title="How to configure a distributed network for the replication?" Tags="|routing|vpn|internet|ipsec|redistribution|" AnswerCount="1" CommentCount="2" ClosedDate="2019-03-13T06:16:11.300" ContentLicense="CC BY-SA 3.0" />
  <row Id="30520" PostTypeId="1" CreationDate="2016-05-18T10:49:14.087" Score="0" ViewCount="9517" Body="&lt;p&gt;I am wondering would router wifi signal strength drop significantly when large number of users connecting onto it? &#xA;Or is there any possible problems could arise when there is a sudden surge of large volume of people trying to connect to a single router?&lt;/p&gt;&#xA;" OwnerUserId="25479" LastActivityDate="2017-06-05T01:44:01.163" Title="number of users affecting wifi signal strength?" Tags="|router|wireless|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30521" PostTypeId="2" ParentId="30520" CreationDate="2016-05-18T12:09:18.717" Score="3" Body="&lt;p&gt;The medium for wireless communication is air/space which is limited. There is only so much of it. The more clients connecting the more medium is used less medium there is for others. The signal strength would not really be compromised. The signal strength depends on the room parameters (humidity, type of walls, other radio frequencies in operation). &#xA;There is a limited amout of clients that can connect. The limit is generally bound to the specs of the access point, but in essence would be limited to the amount of available bandwidth/space in the air within that given frequency. &#xA;So I think to answer your question, the more users connecting to an access point the less performance in general you can expect, this resulting because of shared bandwidth/medium (space). &#xA;Signal strength is more of a constant, how far that signal gets or how many clients your access point can serve is based on other factors.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2016-05-18T12:09:18.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30522" PostTypeId="1" AcceptedAnswerId="30526" CreationDate="2016-05-18T12:26:03.813" Score="2" ViewCount="79" Body="&lt;p&gt;what does it mean if an interface is reported down but there are drops on the interface?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interface X&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;displayed:&#xA;Total output drops: N&#xA;line protocol is down (notc)&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2016-05-18T12:59:44.720" Title="cisco Output Queue Droppped on down interface" Tags="|cisco|interface|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30524" PostTypeId="1" AcceptedAnswerId="30626" CreationDate="2016-05-18T12:47:22.443" Score="0" ViewCount="394" Body="&lt;p&gt;&lt;strong&gt;Objective:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am working on an embedded Linux device with the following network configuration.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Interface-1: 'wlan0' acts as an access point.&lt;/li&gt;&#xA;&lt;li&gt;Interface-2: 'eth1'  connected to Internet.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My objective is to NAT packets reaching 'wlan0' (and destined to IP's other than those in the subnet of wlan0) from the wireless clients connected to it to 'eth1'. So that the wireless clients connected to 'wlan0' will have Internet access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Solution tried:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went through few links (unfortunately I missed the references) which proposed the following solution using &lt;code&gt;iptables&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EXTIF=&quot;eth1&quot;&#xA;INTIF=&quot;wlan0&quot;&#xA;&#xA;        echo &quot;1&quot; &amp;gt; /proc/sys/net/ipv4/ip_forward&#xA;        echo &quot;1&quot; &amp;gt; /proc/sys/net/ipv4/ip_dynaddr&#xA;&#xA;        $IPTABLES -P INPUT ACCEPT&#xA;        $IPTABLES -F INPUT&#xA;        $IPTABLES -P OUTPUT ACCEPT&#xA;        $IPTABLES -F OUTPUT&#xA;        $IPTABLES -P FORWARD DROP&#xA;        $IPTABLES -F FORWARD&#xA;        $IPTABLES -t nat -F&#xA;&#xA;        route add -net 192.168.10.0/24 dev $INTIF&#xA;&#xA;        $IPTABLES -A FORWARD -i $EXTIF -o $INTIF -m state --state ESTABLISHED,RELATED -j ACCEPT&#xA;        $IPTABLES -A FORWARD -i $INTIF -o $EXTIF -j ACCEPT&#xA;        #$IPTABLES -A FORWARD -j LOG&#xA;    #Puzzled, how will the matching condition of `-o $EXTIF` be satisfied for any packets???&#xA;&#xA;        echo &quot;   Enabling SNAT (MASQUERADE) functionality on $EXTIF&quot;&#xA;        $IPTABLES -t nat -A POSTROUTING -o $EXTIF -j MASQUERADE&#xA;&#xA;I am bit new to `iptables` so have the  following clarifications&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Clarifications required:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;As I understand a packet will be traversing the &lt;code&gt;FORWARD&lt;/code&gt; chain only if it is not intended for the local host.&lt;/li&gt;&#xA;&lt;li&gt;The clarification I have is how will the matching condition of &lt;code&gt;-o $EXTIF&lt;/code&gt; be satisfied for any packets. I understand that &lt;code&gt;-i $INTIF&lt;/code&gt; will be satisfied as it is the entry interface for the packet.  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8810" LastActivityDate="2016-05-22T03:37:11.207" Title="Internet connection sharing using iptables" Tags="|ipv4|nat|ip|snat|" AnswerCount="2" CommentCount="0" ClosedDate="2019-03-12T23:21:03.817" ContentLicense="CC BY-SA 3.0" />
  <row Id="30526" PostTypeId="2" ParentId="30522" CreationDate="2016-05-18T12:59:44.720" Score="1" Body="&lt;p&gt;You need to take in mind that interface counters will save it numbers, what you see on that is the last &quot;Total output drops&quot; meassure by the interfaces on the past where it was UP. If you want to check a new link, you need to clear the number, try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[equipment]#clear counter *interface*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once you tried that, all your counters will reset to 0, and when the interface goes UP, you will seeing really what is happening&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-05-18T12:59:44.720" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30527" PostTypeId="1" AcceptedAnswerId="30533" CreationDate="2016-05-18T13:11:52.893" Score="1" ViewCount="80" Body="&lt;p&gt;Is it possible to connect several networks into one? I have read articles about site to site configuration through IPsec. But I haven't seen any articles which explain if it possible to connect 3 or more networks into one.&lt;/p&gt;&#xA;" OwnerUserId="25480" LastActivityDate="2016-05-18T18:04:27.433" Title="How to connect several private networks throug the Internet into one using IPsec or OpenVPN?" Tags="|vpn|ipsec|l2vpn|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30529" PostTypeId="1" CreationDate="2016-05-18T13:38:21.947" Score="2" ViewCount="1092" Body="&lt;p&gt;I am having a  wireshark capture of scp from my machine end to another end. I want to know, how can I determine whether it is uplink or downlink packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Uplink means that I am the source and downlink means I am the destination. As sitting in either the end point, we can say that one of them is uplink or downlink. But how do we know in case if it is router whether it is uplink or downlink?&lt;/p&gt;&#xA;" OwnerUserId="20111" LastEditorUserId="20757" LastEditDate="2016-05-19T19:10:37.917" LastActivityDate="2016-08-17T21:01:29.330" Title="How to decide packets whether it is uplink or downllink?" Tags="|wireshark|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30530" PostTypeId="2" ParentId="30519" CreationDate="2016-05-18T13:57:23.590" Score="1" Body="&lt;p&gt;You'll want to find some devices or software that are designed to establish VPN connections and read the documentation for how to set it up. Many networks use the network firewall as a VPN endpoint. You purchase and configure firewalls for each of your locations and configure VPNs between the locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Product recommendations are off-topic here, so you'll have to select one or more VPN products using some other resource. Once you have them, if you have questions about how to configure the VPNs, that is on-topic here.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2016-05-18T13:57:23.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30532" PostTypeId="2" ParentId="29621" CreationDate="2016-05-18T14:09:22.880" Score="1" Body="&lt;p&gt;Like everybody else said, we need to see your configs.  But the obvious thing I see is that your two subnets overlap.  Network 2 (192.168.10.0/29) is part of Network 1 (192.168.10.0/25).  So even if you attempt to ping something in Network 1 that is not part of Network 2 (something in the range of 192.168.10.9-192.168.10.127), the return traffic from Network 1 to Network 2 will never reach Network 2, as Network 1 believes Network 2 (192.168.10.0/29) is part of its directly attached network (192.168.10.0/25).&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2016-05-18T14:09:22.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30533" PostTypeId="2" ParentId="30527" CreationDate="2016-05-18T14:17:07.057" Score="0" Body="&lt;p&gt;Networks which are connected are called an internet. The largest collection of connected networks is the public Internet, with millions of connected networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can tunnel across intermediate connected networks using various protocols, including IPsec. There is no reason to think that you cannot have multiple tunnels from one network to other networks. Depending on the technology and protocol(s) used, you can even set up a cloud to which many sites connect, e.g. an MPLS VPN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-18T14:17:07.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30536" PostTypeId="2" ParentId="30527" CreationDate="2016-05-18T18:04:27.433" Score="0" Body="&lt;p&gt;DMVPN and MPLS VPN are the options to connect several sites. &lt;/p&gt;&#xA;" OwnerUserId="19899" LastActivityDate="2016-05-18T18:04:27.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30541" PostTypeId="1" AcceptedAnswerId="30546" CreationDate="2016-05-18T21:49:35.933" Score="2" ViewCount="589" Body="&lt;p&gt;Has anyone ever found a tool that performs a TCP traceroute with an actual established TCP session? I can launch a server/client on each end, if required. tcptraceroute &amp;amp; mtr aren't candidates here. (The docs for tcptraceroute state, &quot;It is worth noting that tcptraceroute never completely establishes a TCP connection with the destination host.&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my case, TCP traceroutes w/mtr are not showing any packet loss or congestion along the path, but actual sessions between iperf3 server &amp;amp; client do show congestion on the path between server &amp;amp; client on some sessions where the TCP packets are more substantial than simple SYN packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My theory is that a path in the middle is operating at the TCP layer and is load balanced. I'm guessing that individual TCP sessions are pinned to a single device during their lifetime. If I could use a tool that would establish a real connection and then incrementally change the TTL on the IP packet headers (without manipulating the TCP headers), I could determine if sessions really pinned somewhere in the middle and potentially which device in the middle is responsible for congestion issues.&lt;/p&gt;&#xA;" OwnerUserId="25123" LastActivityDate="2016-05-19T03:05:00.323" Title="TCP Traceroute with actual TCP session" Tags="|tcp|traceroute|congestion|" AnswerCount="1" CommentCount="5" ClosedDate="2019-03-13T06:03:58.220" ContentLicense="CC BY-SA 3.0" />
  <row Id="30542" PostTypeId="2" ParentId="2796" CreationDate="2016-05-18T22:15:43.943" Score="0" Body="&lt;p&gt;@aleks - If you know which L2L devices you no longer want to be allowed, and you know their private IP ranges, couldn't you just deny those private IPs on your Inbound ACL (the one applied to your ASA's outside interface). This might not prevent Phase 2 setup, but it would for sure not allow the traffic to pass. Just a thought (I ran across this question while googling for a different issue). &lt;/p&gt;&#xA;" OwnerUserId="25496" LastActivityDate="2016-05-18T22:15:43.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30544" PostTypeId="2" ParentId="27889" CreationDate="2016-05-18T23:54:06.507" Score="-1" Body="&lt;p&gt;You certainly can load balance at layer 3 with simple static routes.  You'll want to configure &lt;code&gt;ip load-sharing per-packet&lt;/code&gt; on each interface.  Be sure to enable Cisco Express Forwarding, CEF.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-18T23:54:06.507" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="30546" PostTypeId="2" ParentId="30541" CreationDate="2016-05-19T03:05:00.323" Score="2" Body="&lt;p&gt;It sounds like Scapy might be what you're looking for. &lt;a href=&quot;https://stackoverflow.com/questions/10336448/scapy-correct-method-to-modify-ttl-of-sniffed-traffic&quot;&gt;Here's an example&lt;/a&gt; of how to change the TTL in a packet.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2016-05-19T03:05:00.323" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30549" PostTypeId="1" CreationDate="2016-05-19T07:05:01.883" Score="1" ViewCount="106" Body="&lt;p&gt;I have both a gigabit network (all Mac Pros, gigabit switch) and a 10gig network (subset of hosts using Sonnet Twin 10G adapters, 10BGbase-T switch). How do I get machine pairs where both have 10gig to talk to each other using the 10gig NICs, but keep machine pairs where only one (or both) have only gigabit ethernet to use the gigabit network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, hostA and hostB have 10gig (and gigabit), hostC only has gigabit. I want A and B to talk 10gig, but A and C should talk gigabit. How do I get B to show up in A's Finder's under the 'shared' section and when connected, talk 10gig rather than gigabit, and at the same time, when mounting a shared volume from C have that end up via gigabit ethernet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do have a DNS server (via OS X server) that has entries for hostAX and hostBX as the 10gig IP addresses. But the user sees hostA, not hostAX in Finder and hostA (per the DNS) is a gigabit, not a 10gig address.&lt;/p&gt;&#xA;" OwnerUserId="25502" LastActivityDate="2016-05-19T07:44:53.163" Title="Hosts with both gigabit and 10GBE NICs" Tags="|routing|10gbase|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30551" PostTypeId="2" ParentId="30549" CreationDate="2016-05-19T07:44:53.163" Score="1" Body="&lt;p&gt;The hosts don't have to have same-speed nics to talk to each others. You can perfectly establish communication between host A - using 10G - and host C - using 1G.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not comfortable with dual-homing hosts, I strongly suggest you only connect the 10G adapters on 10G capable machines, and everything should be fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the 10G and 1G networks are not interconnected at layer 2, then you need to have routing between them.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-05-19T07:44:53.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30552" PostTypeId="2" ParentId="30520" CreationDate="2016-05-19T08:13:16.363" Score="0" Body="&lt;p&gt;In my experience the signal strength shouldn't change only the speed. &#xA;When more devices/users connect to the router you will start to see a performance decrease in terms of Internet speed because all the devices will be sharing the same Internet connection at the same time.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-05-19T08:13:16.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30553" PostTypeId="1" AcceptedAnswerId="30554" CreationDate="2016-05-19T08:45:04.717" Score="1" ViewCount="67" Body="&lt;p&gt;Consider a switch with an empty forwarding table. Connected clients are&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;* A (Port 1)&#xA;* B (Port 2)&#xA;* C (Port 3)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;A&lt;/code&gt; wants to send a package P to &lt;code&gt;C&lt;/code&gt;. When the switch receives this package, the switch learns that packages to &lt;code&gt;A&lt;/code&gt; should be send to Port 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch now sends this package to Port 2 and 3. If all clients are behaving correctly, only &lt;code&gt;C&lt;/code&gt; will reply (and S will get a correct entry in his forwarding table).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming &lt;code&gt;B&lt;/code&gt; is misbehaving and will always reply. The switch would then create an entry in the forwarding table that would direct all further packages destined for &lt;code&gt;C&lt;/code&gt;, to &lt;code&gt;B&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is that?&lt;/p&gt;&#xA;" OwnerUserId="25504" LastEditorUserId="25504" LastEditDate="2016-05-19T08:55:07.810" LastActivityDate="2016-05-19T09:22:27.170" Title="Switch: Misbehaving Client" Tags="|switch|ip-forwarding-table|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30554" PostTypeId="2" ParentId="30553" CreationDate="2016-05-19T09:19:23.483" Score="3" Body="&lt;p&gt;When A send a &lt;em&gt;frame&lt;/em&gt; to C, the switch learn the &lt;em&gt;mac address&lt;/em&gt; of A and &lt;em&gt;flood&lt;/em&gt; the frame to all ports except 1 (since it received the frame on this port).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such, B and C both receive the frame. Since the frame contains C mac address as destination address, B knows it is not the intended recipient and drop the frame. C process the frame and reply. The switch learns C mac address and add it to its table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only practical way for B to misbehave is to spoof the mac adress of C.&#xA;In this case both B and C will use the same mac address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This scenario leads to unpredictable results, and intermittent communication failure.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both B &amp;amp; C will respond and the switch will likely update its table with the latest.&#xA;Usually the switch will keep only one association mac address &amp;lt; - &gt; port in its table, so depending on the traffic some time the frame destined to the duplicate MAC will be sent on port 2 and some time to port 3, but it will not be sent on both ports at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some switches have (configurable) protection against mac spoofing, but this is very brand/model dependent.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-05-19T09:22:27.170" LastActivityDate="2016-05-19T09:22:27.170" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30556" PostTypeId="2" ParentId="30310" CreationDate="2016-05-19T09:59:23.200" Score="0" Body="&lt;p&gt;Unable to reproduce problem, must have been coming from the upstream network.&lt;/p&gt;&#xA;" OwnerUserId="15356" LastActivityDate="2016-05-19T09:59:23.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30558" PostTypeId="1" AcceptedAnswerId="30561" CreationDate="2016-05-19T10:57:20.683" Score="6" ViewCount="1954" Body="&lt;p&gt;What is &quot;Twisted pair with loading&quot; cable ? please explain and if possible please share a picture.&#xA;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Below image is taken from: Data And Computer Communications - 8e - WilliamStallings&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ljduB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ljduB.png&quot; alt=&quot;Point-to-Point Transmission Characteristics of Guided Media&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25507" LastEditorUserId="8499" LastEditDate="2016-11-29T22:50:44.060" LastActivityDate="2016-11-29T22:50:44.060" Title="What is &quot;Twisted pair with loading&quot; cable?" Tags="|cable|layer1|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30559" PostTypeId="2" ParentId="30369" CreationDate="2016-05-19T10:59:50.597" Score="0" Body="&lt;p&gt;The MAC Address in the header of the packet is used for addressing and will always be that of the local L2 link. The originiating MAC Address gets stripped once it leaves it's collision domain and replaced with the gateway to the next collision domain.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2016-05-19T10:59:50.597" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30561" PostTypeId="2" ParentId="30558" CreationDate="2016-05-19T11:06:42.957" Score="7" Body="&lt;p&gt;A twisted pair cable with loading is a cable that has added inductance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is a cable used for voice lines. A long span of twisted pair wires acquires capacitance and that's the case with voice lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Capacitance is harmful to voice because it reduces voltage variations and in cosequence it tends to flat out the signal by blocking higher frequencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Coils are added to counteract capacitance on the twisted pair lines by adding inductance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Load coils are placed at intervals along the wire. Load coils improve the amplitude of the voice frequency range (&lt;em&gt;300 - 4000Hz&lt;/em&gt;) but are detrimental in frequencies above 4000Hz. &lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-05-19T13:28:14.743" LastActivityDate="2016-05-19T13:28:14.743" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30562" PostTypeId="1" CreationDate="2016-05-19T11:11:54.217" Score="4" ViewCount="12838" Body="&lt;p&gt;bar &lt;code&gt;show interface link&lt;/code&gt; is there an alternative (pretty) way to display a summary of link last in use. Goal is to get a view of how long a link has been unused. &#xA;Something along the lines of:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show interface X | inc Last input&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I want to see all interfaces on a cisco switch not using ios.SH or tcl.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2016-08-18T03:03:00.213" Title="interface down time summary" Tags="|cisco|interface|downtime|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30563" PostTypeId="1" CreationDate="2016-05-19T12:02:45.737" Score="2" ViewCount="149" Body="&lt;p&gt;&lt;strong&gt;Server has a weak ephemeral diffie-hellman public key&lt;/strong&gt; on accessing Cisco ISE portal webpage for using BYOD services and Guest internet services, This issue is mostly on Google Chrome , but we cannot control everyone to stop using chrome, and entertain huge amount of complaints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any way to resolve this issue of Cisco ISE ?&lt;/p&gt;&#xA;" OwnerUserId="23017" LastActivityDate="2016-05-24T19:05:26.333" Title="Server has a weak ephemeral diffie-hellman public key on Cisco ISE" Tags="|wireless|cisco-ise|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30565" PostTypeId="2" ParentId="30558" CreationDate="2016-05-19T13:43:02.747" Score="1" Body="&lt;p&gt;Ideally for good transmission line behaviour you want the characterstic impedance of the line matched to the impedance of the devices. If they don't match then you get reflections which when translated into the frequency domain result in a non-flat frequency response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately telephone equipment is designed for an impedance of 600 or 900 ohms (depending on country) while twisted pair cable has an impedance of about 100 ohms. From some googling it seems the reason for this discrepancy is historical (bare wires on seperate insulators had a much higher characteristic impedance). On long phone lines this leads to poor frequency response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The charactersitic impedance of a line is determined by the square root of the ratio of distributed inductance to distributed capacitance. We can fake an incresed characterstic impedance by periodically inserting inductors into the line. For a balanced line the inductors have to be installed in pairs to maintain balance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These inductors were known as loading coils. This was done to improve the performance of long voice lines and I expect such lines are what the &quot;twisted pair with loading&quot; entry in your table refers to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately such coils only work correctly over a limited frequency range. For good transmission line behaviour the distance between coils needs to be small compared to the wavelength and the coils themselves must also have good inductor behaviour in the desired frequency range. Introdcing coils also reduce the effective propagation speed of the line. As a result loading coils have fallen out of favor in modern telephone networks.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-05-19T13:55:50.247" LastActivityDate="2016-05-19T13:55:50.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30566" PostTypeId="2" ParentId="30562" CreationDate="2016-05-19T13:59:56.907" Score="0" Body="&lt;p&gt;What you're looking for requires creative use of pipes like you've already suggested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a thought - why wouldn't you use a NMS and query the telemetry data to display this for you?&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2016-05-19T13:59:56.907" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30567" PostTypeId="2" ParentId="30529" CreationDate="2016-05-19T14:01:01.530" Score="2" Body="&lt;p&gt;Based on you edit for the definition of uplink and downlink, You need to inspect the source and destination IP addresses. If your IP address is the source address, by your definition, it is an uplink packet. If the destination address is your IP address, by your definition, it is a downlink packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't matter if there is a router (or even multiple routers) in between. The router will not modify the packet addresses, except if it is doing NAT. Even with NAT, the packets you inspect on your host will have your host address as either the source or destination address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-19T14:01:01.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30568" PostTypeId="2" ParentId="30562" CreationDate="2016-05-19T14:08:43.663" Score="0" Body="&lt;p&gt;You can show all the interfaces in a Cisco switch with the same command you are using. The command you are using is the &lt;code&gt;show interfaces&lt;/code&gt; command. If you do not include a specific interface, it will show all the interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-19T14:08:43.663" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="30570" PostTypeId="1" CreationDate="2016-05-19T15:55:38.873" Score="1" ViewCount="166" Body="&lt;p&gt;What I need is to provide two connections, one in each band, the problem is that my current modem router is a non-concurrent dual band router, so that it can provide just one band at time (&lt;a href=&quot;http://www.humaxdigital.com/gw/products/product.php?gid=524&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.humaxdigital.com/gw/products/product.php?gid=524&lt;/a&gt;), and another problem is that my ISP requires me to use this modem router that they provided to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A solution to my case could be I buy a new router and connect via cable to the first one, and after that create a new connection in the 2.4 GHz band with this new router. Is this possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the network diagram of my solution:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/f6nrw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f6nrw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25520" LastActivityDate="2016-05-19T16:29:07.847" Title="Is it possible to convert a 5 GHz connection from a non concurrent dual band router into a 2.4 GHz using another router?" Tags="|router|" AnswerCount="1" CommentCount="3" ClosedDate="2016-05-19T19:27:08.433" ContentLicense="CC BY-SA 3.0" />
  <row Id="30571" PostTypeId="2" ParentId="30570" CreationDate="2016-05-19T16:29:07.847" Score="1" Body="&lt;p&gt;The JFL's solution:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nvs7P.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nvs7P.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this what you wanted to explain to me?&lt;/p&gt;&#xA;" OwnerUserId="25520" LastActivityDate="2016-05-19T16:29:07.847" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30572" PostTypeId="1" CreationDate="2016-05-19T16:42:00.600" Score="2" ViewCount="28209" Body="&lt;p&gt;I would like to confirm. Is the above below information in &lt;strong&gt;bold&lt;/strong&gt; sufficient to know the utilization of my interface in percentage?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sho int fa0/8  &#xA;FastEthernet0/8 is up, line protocol is up (connected)  &#xA;  Hardware is Fast Ethernet, address is 001c.b1b8.1808 (bia 001c.b1b8.1808)  &#xA;  Description: connected to RICI_1E1  &#xA;  MTU 1500 bytes, BW 2048 Kbit, DLY 100 usec,  &#xA;     reliability 255/255, txload 23/255, rxload 22/255  &#xA;  Encapsulation ARPA, loopback not set  &#xA;  Keepalive set (10 sec)  &#xA;  Full-duplex, 100Mb/s, media type is 10/100BaseTX  &#xA;  input flow-control is off, output flow-control is unsupported  &#xA;  ARP type: ARPA, ARP Timeout 04:00:00  &#xA;  Last input 00:00:00, output 00:00:00, output hang never  &#xA;  Last clearing of &quot;show interface&quot; counters never  &#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0  &#xA;  Queueing strategy: fifo  &#xA;  Output queue: 0/0 (size/max)  &#xA;  5 minute input rate 12329000 bits/sec, 1707 packets/sec  &#xA;  5 minute output rate 2933000 bits/sec, 1331 packets/sec  &#xA;     6694535692 packets input, 5277030343947 bytes, 0 no buffer  &#xA;     Received 1079534037 broadcasts (145728815 multicasts)  &#xA;     0 runts, 0 giants, 0 throttles  &#xA;     83072 input errors, 83072 CRC, 0 frame, 0 overrun, 0 ignored  &#xA;     0 watchdog, 145728815 multicast, 0 pause input  &#xA;     0 input packets with dribble condition detected  &#xA;     4448677146 packets output, 1162660273701 bytes, 0 underruns  &#xA;     0 output errors, 0 collisions, 1 interface resets  &#xA;     0 babbles, 0 late collision, 0 deferred  &#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output  &#xA;     0 output buffer failures, 0 output buffers swapped out  &#xA;Switch#  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Utilization in = (inputRate/BW)*100&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;Utilization Out = (inputRate/BW)*100&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="24161" LastEditorUserId="8499" LastEditDate="2020-01-10T09:21:20.823" LastActivityDate="2020-01-10T09:21:20.823" Title="How to know the interface utilization on a Cisco switch?" Tags="|cisco|switch|cisco-commands|bandwidth|interface|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="30573" PostTypeId="2" ParentId="30572" CreationDate="2016-05-19T16:58:11.437" Score="5" Body="&lt;p&gt;What you are looking at is the bit rate over the last five minutes. You can change the time period, but not below 30 seconds with the &lt;code&gt;load-interval&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what you mean by &quot;utilization.&quot; It looks like you are wanting a percentage, but the percentage you come up with will be over the specific time period. If you get 40%, your interface could have been at 100% for two out of the five minutes, and completely idle for three minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I see where you are going wrong. It looks like someone used the &lt;code&gt;bandwidth&lt;/code&gt; command on the interface, and that is showing up in your &lt;code&gt;show interfaces&lt;/code&gt; output. That command doesn't really change the bandwidth on the interface; it is something which allows features, e.g. QoS, to use that as the basis for calculations, but the actual interface bandwidth isn't affected.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-19T17:20:40.813" LastActivityDate="2016-05-19T17:20:40.813" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30576" PostTypeId="1" AcceptedAnswerId="30579" CreationDate="2016-05-19T20:06:38.193" Score="6" ViewCount="33000" Body="&lt;p&gt;Can someone explain to me what differences there are between MPLS and VPLS?&#xA;Which one is the most efficient? Why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’ve read that the only difference is layer of technology: 2 (VPLS) vs 3 (MPLS). Does that mean that the routing table is managed on the local network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&lt;/p&gt;&#xA;" OwnerUserId="22406" LastEditorUserId="22874" LastEditDate="2016-05-19T21:39:50.963" LastActivityDate="2016-06-12T12:41:41.233" Title="Differences between MPLS and VPLS" Tags="|mpls|vpls|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30577" PostTypeId="1" AcceptedAnswerId="30599" CreationDate="2016-05-19T20:10:18.693" Score="3" ViewCount="1763" Body="&lt;p&gt;Can some one please help me understand the below  QOS setting on our MPLS router the service policy.. Policy map  and class map &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the basic understanding behind how these work .. I need to  in detail,  how in this particular scenario ,,traffic rate that is being  allowed , policed or dropped .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am kind of confused .. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    class-map match-any ENHANCED&#xA;     match any &#xA;    class-map match-any MGMT&#xA;     match access-group name CLASSIFY-MGMT&#xA;     match access-group name CLASSIFY-BGP&#xA;    class-map match-any ENHANCED-PLUS&#xA;     match access-group name CLASSIFY-ENHANCED-PLUS&#xA;     match ip dscp ef &#xA;     match ip precedence 5 &#xA;    !&#xA;    !&#xA;    policy-map QOS-SCHEDULER-GI0/0&#xA;     class ENHANCED-PLUS&#xA;      priority 10000&#xA;      police 10000000 conform-action transmit  exceed-action transmit &#xA;      set ip dscp ef&#xA;     class ENHANCED&#xA;    policy-map QOS-SHAPER-GI0/0&#xA;     class class-default&#xA;      shape average 50000000&#xA;      service-policy QOS-SCHEDULER-GI0/0&#xA;&#xA;     interface GigabitEthernet0/0&#xA;     description MPLS WAN Link&#xA;     bandwidth 50000&#xA;     ip address 192.168.0.30 255.255.255.252&#xA;     duplex full&#xA;     speed 100&#xA;     no cdp enable&#xA;     no mop enabled&#xA;     max-reserved-bandwidth 100&#xA;     service-policy output QOS-SHAPER-GI0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;please help . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The port capacity is 100 Mb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;need help undersanding how these commands work in respect to each other ..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;priority 10000&#xA;  police 10000000 conform-action transmit  exceed-action transmit &#xA;&#xA;shape average 50000000 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on policy map &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bandwidth 50000 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on interface &lt;/p&gt;&#xA;" OwnerUserId="450" LastEditorUserId="2142" LastEditDate="2016-05-21T11:10:32.210" LastActivityDate="2016-05-21T11:10:32.210" Title="understanding Policy map bandwidth , police, shape commands" Tags="|bandwidth|mpls|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30579" PostTypeId="2" ParentId="30576" CreationDate="2016-05-19T21:10:51.760" Score="6" Body="&lt;p&gt;MPLS is a virtual &quot;layer 3&quot; network. The customer addresses packets by IP. The PE equipment have customer IPs and serve as customer routers. The MPLS admin needs to manage at least a little of the routing (unless there have been improvements since I last administered an MPLS network, I'd be interested to know if that is the case).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPLS is a virtual &quot;layer 2&quot; network. The customer addresses packets by MAC. From the customer's point of view, the PE equipment behaves like a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for efficiency, both have their pros and cons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: this was going to be a comment on @peter-green's answer but it got too long:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To elaborate on the router that needs to know both the customer's and the provider's networking: there are usually many of them, one at each point of entry from the customer network into the provider network. They are called PE routers (Provider Edge). Of course, one PE router can handle many entry points, for many clients. You could have one PE in, say, every US State capital, and each customer could have several offices in each city, all connected to that city's PE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MPLS PE will need to be configured with the IP addresses of the customers connected to it, at least the IPs connected directly. For the adresses on each customer site, it can either take a static route (which needs the provider to act for each site modification) or it can talk some routing protocol with the CPE (Customer Premise Equipment), which is a lot more complicated but which can let the client play with his on-site IPs without bothering the provider. The PE will learn the customer IPs connected to the other PE routers by talking MP-BGP with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VPLS PE will need to know the customer's MAC addresses, but it will auto-detect them. If there are many MACs this could be a problem. As @peter-green notes, this also has a downside with Ethernet broadcasts in addition to the encapsulation overhead, but it has the upside of the provider not having to configure the customer IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this hasn't answered your questions, you'll have to specify more :)&lt;/p&gt;&#xA;" OwnerUserId="22874" LastEditorUserId="22874" LastEditDate="2016-05-20T17:22:45.130" LastActivityDate="2016-05-20T17:22:45.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30581" PostTypeId="1" CreationDate="2016-05-19T21:56:30.377" Score="3" ViewCount="274" Body="&lt;p&gt;I'm currently learning about AFDX networks and one of the main questions I have is the ability to do a mapping and port scanning of them. My understanding is that it is based on UDP connection using vitual links. Would simple tools like nmap and udp_scan work on this type of network?&lt;/p&gt;&#xA;" OwnerUserId="25525" LastActivityDate="2016-05-19T23:58:23.050" Title="AFDX (Avionics Full-Duplex Switched Ethernet) Mapping" Tags="|duplex|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30583" PostTypeId="2" ParentId="30576" CreationDate="2016-05-19T23:38:02.900" Score="2" Body="&lt;p&gt;As I understand it (having read a bit on this but not actually done it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MPLS is a protocol for building large numbers of virtual links over a shared infrastructure. The system of layered labels allows the actual data switching process in the MPLS core to be very simple and hence fast. MPLS can carry various different protocols on top. Traffic belonging to different customers is kept separate by the MPLS labels, so it doesn't matter if different customers have overlapping IP or MAC address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can run IP directly on MPLS, in that case there will need to be a router between each customer site and the provider network that is aware of both the MPLS system and the IP network it is connecting to. It can then establish routes over the MPLS links just as it would over any other underlying network. The downside is that you have one router that needs to know about both the provider's MPLS and the customer's IP routing and the customers IP subnet boundaries need to line up with their site boundaries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPLS is a protocol for building a virtual multipoint Ethernet network on top of a MPLS network (or alternatively an IP network). This is convenient, from your point of view it's like your provider gave you a big ethernet switch and plugged all your sites into it. However the convenience comes at a price, the encapsulation overhead is higher than straight IP over MPLS and any broadcasts you send into the VPLS network (and an Ethernet network will always have some broadcasts) will be immediately amplified . &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-05-20T17:48:46.650" LastActivityDate="2016-05-20T17:48:46.650" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30584" PostTypeId="2" ParentId="30581" CreationDate="2016-05-19T23:46:47.350" Score="1" Body="&lt;p&gt;You need to think about the network layers. Ethernet is a layer-1/2 protocol. IP is at layer-3, and ethernet doesn't care if it carries IPv4, IPX, IPv6, or any other layer-3 protocol. TCP, UDP, etc. are layer-4 protocols, which are on top of a layer-3 protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFDX is based on IEEE 802.3 (ethernet) at layers 1 and 2, and it should not know anything about what happens in the higher layers. Having said that, the devices connected to the network are very likely to have protections built into them. These protections may prevent such scanning, but that has nothing to do with the protocol itself. For instance, the switches often used will be designed to allow a device to connect to a predefined set of devices.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-19T23:58:23.050" LastActivityDate="2016-05-19T23:58:23.050" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30586" PostTypeId="1" CreationDate="2016-05-20T02:17:13.397" Score="1" ViewCount="1673" Body="&lt;p&gt;We are experiencing a retransmission issue on some of our computers on our LAN, when connecting to external hosts. I first started trying to trace the issue when the &lt;code&gt;npm typings install&lt;/code&gt; command was timing out on some connections to &lt;a href=&quot;https://api.typings.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://api.typings.org/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first two or three connections would return quickly, but subsequent connections would see a 3 second or 9 second connection delay, or timeout and fail. But this behaviour differed on different machines on the network. We are running Windows 10 throughout our client machines. Some computers would start seeing delayed connections after 3 or 4 successful connections. However, some would only start seeing delays after 9 or 10 connections. A couple of computers showed no delays at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I initially added some diagnostic logging to the &lt;code&gt;typings install&lt;/code&gt; command to try and see if the issue was with node or typings, or api.typings.org, as unlikely as that seemed. The logging just listed the attempted connections and showed the elapsed time. You can see the timing increasing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; ....@1.0.0 typings C:\....&#xA;&amp;gt; typings &quot;install&quot;&#xA;&#xA;  popsicle https://api.typings.org/entries/dt/zone.js/tags/0.0.0%2B20160316155526 +0ms&#xA;  popsicle https://api.typings.org/entries/dt/es6-promise/tags/0.0.0%2B20160423074304 +3s&#xA;  popsicle https://api.typings.org/entries/dt/es6-collections/tags/0.5.1%2B20160316155526 +6s&#xA;  popsicle https://api.typings.org/entries/dt/node/tags/6.0.0%2B20160514165920 +11s&#xA;typings ERR! message Unable to connect to &quot;https://api.typings.org/entries/dt/node/tags/6.0.0%2B20160514165920&quot;&#xA;typings ERR! caused by connect ETIMEDOUT 104.24.113.177:443&#xA;&#xA;typings ERR! cwd C:\....&#xA;typings ERR! system Windows_NT 10.0.10586&#xA;typings ERR! command &quot;C:\\Program Files\\nodejs\\node.exe&quot; &quot;C:\\....\\node_modules\\typings\\dist\\bin.js&quot; &quot;install&quot;&#xA;typings ERR! node -v v4.4.4&#xA;typings ERR! typings -v 0.8.1&#xA;typings ERR! code EUNAVAILABLE&#xA;&#xA;typings ERR! If you need help, you may report this error at:&#xA;typings ERR!   &amp;lt;https://github.com/typings/typings/issues&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This was inconclusive, so I tried watching the connections with Wireshark, and at this point was able to correlate those delays to TCP retransmissions. I subsequently was able to reproduce the behaviour with a trivial program written in Delphi that opened multiple HTTP or HTTPS connections to any site outside our LAN, as near to simultaneously as possible (using multiple threads).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Wireshark trace (online at: &lt;a href=&quot;https://dl.dropboxusercontent.com/u/4943090/retransmission.pcap&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://dl.dropboxusercontent.com/u/4943090/retransmission.pcap&lt;/a&gt;, 38kb) shows 3 connections out of 11 succeeding quickly, but the other 8 retransmitting after 3 seconds. Then only the last one of those retransmissions succeeds, and another 6 seconds later, the 7 remaining connections retransmit again, and again, only the last one succeeds. After this the client app gives up, but I am presuming, the pattern would continue with longer timeouts until all the connections completed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3X55E.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3X55E.png&quot; alt=&quot;Start of connection attempts&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First batch of retransmissions after 3 seconds:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XPqKN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XPqKN.png&quot; alt=&quot;First batch of retransmissions&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second batch of retransmissions after another 6 seconds:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2ydQl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2ydQl.png&quot; alt=&quot;Second batch of retransmissions&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I extended the test app to attempt as many as 100 simultaneous connections, and the computers that did not exhibit the problem for smaller batches also completed these without retransmissions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some more detail on the network:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Gigabit network internally, 100/40mbit fibre connection externally.&lt;/li&gt;&#xA;&lt;li&gt;NAT through Watchguard XTM-25 firewall.&lt;/li&gt;&#xA;&lt;li&gt;24 port Linksys SRW2024P 1Gbit switch.&lt;/li&gt;&#xA;&lt;li&gt;Windows 10 clients, 10.0.10586 - 10.0.14342, Windows Server 2012 servers&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I've run a bunch of tests on various computers on the network. Some I was able to reconfigure to try various network options. Most of the desktops and all the servers are plugged into ports on the Linksys 1Gbit switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 100mbit, 1GB and Wireless columns reflect the approximate number of connections that did not experience retransmissions in a given batch of connections. That is, if I attempted 10 simultaneous connections on a machine with 80% success, 8 of them would complete without retransmission. If I attempted 20, about 16 would complete without retranmission. The number of successful connections varied but would average at the percentages shown.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Computer     Wired Adapter                                100mbit  1GB  Wireless Adapter                        Wireless&#xA;========     =============                                =======  ===  ================                        ========&#xA;Desktop#1    Intel(R) Ethernet Connection I217-LM         100%     40%&#xA;Desktop#2    Realtek PCIe GBE Family Controller 1/10/2015 100%     80%  Dell Wireless 1703 802.11b/g/n (2.4GHz) 100%&#xA;Desktop#3    Intel(R) Ethernet Connection I219-V          100%     40%  Dell Wireless 1801 802.11bgn            100%&#xA;Server#1     Broadcom BCM5716C NetXtreme II GigE                  100%&#xA;Server#2     Broadcom NetXtreme Gigabit Ethernet                  100%&#xA;Notebook#1                                                              Broadcom 802.11ac Network Adapter       100%&#xA;Desktop#4    Realtek PCIe GBE Family Controller 5/04/2015 100%    100%&#xA;Desktop#5    Realtek PCIe GBE Family Controller                    80%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Desktop#1, I have tried many different network adapter options. Note that when we switched the desktops to 100mbit, they never experienced retransmissions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I plugged Desktop#4 into Desktop#1's port, and confirmed that the problem isn't with that specific port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have rebooted the firewall and switch to make sure there wasn't a transient issue there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There does not appear to be any issue connecting to internal hosts, only to those external to our LAN. The connections do not all need to be to the same host, but the issue definitely seems to affect a higher proportion of packets when connecting to a single host. Have only tested with HTTP and HTTPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Updated with additional config detail&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The network has a simple topology: all hosts connected to a 24 port Linksys SRW2024P 1Gbit switch (no configuration required).&lt;/li&gt;&#xA;&lt;li&gt;The WatchGuard XTM-25 LAN port is also connected to the same switch, and WAN port (also connecting at gigabit) connects to an Australian NBN fibre endpoint router (not sure of the model of this device; it's enclosed and not very accessible, no user-configurable options). The NBN connection is 100/40mbit.&lt;/li&gt;&#xA;&lt;li&gt;The wireless traffic goes through a Netgear WNR1000 802.11abn router, connected directly to the WatchGuard on a separate port.&lt;/li&gt;&#xA;&lt;li&gt;All outgoing traffic is configured through a 1-1 NAT + Dynamic NAT firewall policy with no QoS or rate limiting configured; apart from that, there are additional firewall rules that I don't think are relevant. The WatchGuard has a pretty straightforward configuration without a lot changed from factory defaults.&lt;/li&gt;&#xA;&lt;li&gt;Network adapters are entirely factory default settings; I have tried tweaking every accessible settings on the adapter on Desktop#1 without effect - only reducing the speed to 100mbit made any difference.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="25501" LastEditorUserId="25501" LastEditDate="2016-05-20T04:33:47.730" LastActivityDate="2016-05-20T18:33:07.560" Title="TCP retransmissions when we rapidly open multiple connections to the same host" Tags="|tcp|troubleshooting|packet-analysis|" AnswerCount="0" CommentCount="5" ClosedDate="2020-12-21T18:30:45.630" ContentLicense="CC BY-SA 3.0" />
  <row Id="30587" PostTypeId="2" ParentId="27966" CreationDate="2016-05-20T03:56:44.890" Score="2" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;C(config)# vrf context management&lt;/p&gt;&#xA;&lt;p&gt;C(config-vrf)# ip route 0.0.0.0/0 10.1.0.1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The issue appears to be that you've configured the default route in the Management VRF but you're pinging from outside of the Management VRF. Therefore, you're pings are failing.&lt;/p&gt;&#xA;&lt;p&gt;If you want to set up a default route for VLANs100 &amp;amp; 200, you'll need to configure the default route in the main routing table. e.g:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;C(config)# ip route 0.0.0.0/0 10.1.0.1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Note how I did not specify the management VRF before issuing the above command.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-05-20T03:56:44.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30589" PostTypeId="1" AcceptedAnswerId="30595" CreationDate="2016-05-20T08:30:04.650" Score="4" ViewCount="729" Body="&lt;p&gt;For a university telecommunications project my partner and I built a simple command-line messaging application using internet sockets in C. Part of the project was to use the application to test how the transmission time and transmission rate of a message, sent via TCP, changes with message size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To test this, we directly connected two computers together with an Ethernet cable. Computer A starts a timer, sends a message to computer B, which, after receiving the whole message, resends the message back to A, which stops the timer after receiving the entire message. The size of the message in the first test was 3 bytes, and larger and larger message sizes were tested until a message size of 32MB (2^25 bytes). We also ran the same test code using the loopback ip address, where the roles of computer A and computer B were filled by the one computer and no network transmission took place: the messages just moved around in memory. This was done as a control to test the impact of network unrelated computer processing and our software implementation choices on the transmission time. Here are the results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/k1W0n.png&quot; alt=&quot;test results&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The round trip transmission time of a 3 byte message is roughly a millisecond, with message sizes of 4 or 5 to 1460 bytes (the usual maximum segment size of TCP, noted in the graph legend as MSS) taking roughly the same time, just under 100 milliseconds, before the transmission time drops two or so orders of magnitude, after the MSS, back to a millisecond. Then there is a period of high volatility (most obvious in the third graph), where the transmission rate increases until roughly 2^17 bytes, then plateaus, smoothing out. From then on the round trip transmission time increases in a roughly linear fashion. I should add that these results were operating system independent: running the tests on any combination of windows, mac os x and ubuntu operating systems made no difference in the overall trend. Additionally, the message sizes here include data only and include neither TCP, IP nor Ethernet headers. Since the round trip transmission time of the loop-back IP address test remains multiple orders of magnitude below the LAN test over almost all message sizes, I've concluded that computer processing time made a negligible impact on the LAN test.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems to me that the trend after the MSS can be explained by the fact that, in the long run, the ratio between the number of message bytes and the number of header bytes approaches some constant, and that the larger the messages size, the lower the variance of this ratio. There might also be other constant time processing which would have more of an impact on the transmission time when there are fewer bytes and few segments being sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the trend before the MSS, I'm totally stumped. I've tried googling the issue, but nothing's come up; maybe I'm googling for the wrong things. Why is it that transmission time is roughly constant before the MSS, and drops so dramatically after the MSS? And, given this, why is it  faster to send 3 bytes than 10 bytes or 20 bytes? Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="25531" LastActivityDate="2016-05-30T10:54:47.053" Title="Why does the round-trip time of a TCP message decrease 100-fold as the message size exceeds the maximum segment size?" Tags="|tcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30590" PostTypeId="2" ParentId="30589" CreationDate="2016-05-20T08:45:48.213" Score="1" Body="&lt;p&gt;Obviously, if the size is below the MSS, the whole message is sent in a single frame and what you measure is the time it takes to send the frame, the amount of data in the single frame has little impact (especially with very little amount of data, where the data size is much smaller than headers size).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TCP three-way handshake is performed before the actual data transmission and add roughly 436 bytes.&#xA;The connection termination four-way handshake, if it occurs (depending on the software you use) may also add a significant overhead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So all in one, below MSS, the data size is negligible comparing to the whole process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the data size is greater than the MSS, the message is split into several packets (that are encapsulated in several frames), so you expect to have a kind of stair effect (with a jump at each MSS multiple).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP offload engine may also have an impact, you should check if it is enable and compare result with / without it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should also capture the traffic on both machines (with a tool like wireshark), this will give you more clue about whats happening.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-05-20T09:37:03.583" LastActivityDate="2016-05-20T09:37:03.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30591" PostTypeId="1" CreationDate="2016-05-20T10:57:20.653" Score="2" ViewCount="932" Body="&lt;p&gt;When I read a spec document of Juniper Mx104 3D router, they mention 2 things. This router has 4 X 10GBE ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.System capacity 80 gpbs&#xA;2.Packet forwarding capacity 55 to 60 Mpps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is the difference between those technically. &lt;/li&gt;&#xA;&lt;li&gt;Additionally, this router has, 4 line card slots. Assuming if I plug in 4 line cards of 2 X 10 GBE ports, I exceed the capacity of the system theoretically. Is that ok? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;How to balance between these capacity specification?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the question is relevant, please close it. &lt;/p&gt;&#xA;" OwnerUserId="22114" LastActivityDate="2018-05-06T12:53:46.763" Title="Router System Capacity Vs Packet Forwarding Capacity" Tags="|router|juniper|10gbase|line-card|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30592" PostTypeId="2" ParentId="30591" CreationDate="2016-05-20T11:45:34.633" Score="2" Body="&lt;p&gt;We cannot know for sure what Juniper refers to when stating &quot;system capacity 80gps&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we take the embedded 4 x 10G interface and we use them at full duplex then we get 80gbps. So it could refer to this fact. In this case adding line card would increase this number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MPPS is much more informative as it refers to the actual capacity of the switch of processing packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://supportforums.cisco.com/document/44101/performance-throughput-switch-mpps&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco support forum&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For example, 2960-48PST-S is 13.3 Mpps.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The figure MPPS expresses the maximum number of frames per second that&#xA;  can be processed by the device. It is not dependent on frame size but&#xA;  clearly small frames require higher packet rates.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To give you an idea of what this number says:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;smallest frames in Ethernet are 64 bytes in size, taking in account&#xA;  the preamble (8 bytes) and the minimum inter-frame gap (the last two&#xA;  counts roughly for 20.2 bytes) to fill a GE port in one direction you&#xA;  need 1484560 frame per second.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;10^9 / [(64+20.2)*8] where 8 is bits/byte.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;So a number of 13.3 MPPS is equivalent to [((13.3 M * (64+20.2) * 8))&#xA;  / 10^9 = 8.95 / 2=4.47] 4.47 GE ports filled with smallest frames&#xA;  bidirectional.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;On the other hand frames of max size 1518 bytes require 81264 fps to&#xA;  fill a GE port in one direction.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;So this number expresses the forwarding capability of the device.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A non blocking device with 48 GE ports would require 2 * 1484560 * 48&#xA;  as MPPS or higher.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Note that the MX104 support frames up to 9192 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;60mpps of 9192 bytes frames give you a max bandwidth of 4420 / 2210gbps (bidirectional / unidirectional)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;60Mpps of 64 bytes frames give only 37/18,5 gbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we are stuck with standard Ethernet MTU of 1500 we get something around 730/365gbps&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2018-05-06T07:24:46.777" LastActivityDate="2018-05-06T07:24:46.777" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="30595" PostTypeId="2" ParentId="30589" CreationDate="2016-05-20T12:51:34.557" Score="2" Body="&lt;p&gt;I will assume from your questions tag that you are using TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A likely explanation that does require some assumptions about your code is that it's an interaction between Nagle's algorithm (an algorithm designed to prevent unnessacery small packets) and TCP delayed acknowlagements (an algorithm designed to avoid sending unnessacery bare acks when an ack could share a packet with application data).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say your applicaiton sends data to the OS in two (or more) parts, first it sends a header, then it sends the actual data. I don't know for sure that this is what you are doing but it seems the most plausible explanation to me. For small messages the following sequence of events happens.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The client application sends the header to the client OS.&lt;/li&gt;&#xA;&lt;li&gt;The client OS sends the header to the server.&lt;/li&gt;&#xA;&lt;li&gt;The client application sends the body to the OS&lt;/li&gt;&#xA;&lt;li&gt;Since there is unacknowlaged data in-flight Nagle's algorithm kicks in and the OS holds back the data hoping for more.&lt;/li&gt;&#xA;&lt;li&gt;The server OS receives the header, since it's a single packet it holds back the ack hoping for an application response or a second packet to arrive from the client.&lt;/li&gt;&#xA;&lt;li&gt;We now have something of a deadlock. The client doesn't want to send out another small packet because there is already unacknowlaged data in-flight. The server doesn't want to send out an ack because there has been no application response.&lt;/li&gt;&#xA;&lt;li&gt;Eventually a timeout breaks the deadlock.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;At larger message sizes the interaction changes. Depending on the exact rules the server uses for delayed acknowlagements there can still sometimes be delays but they don't seem to be too significant in your case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possible fixes for this problem include using the TCP_NODELAY socket option and/or reworking your application code to build the complete packet before sending it to the OS in one peice.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-05-30T10:54:47.053" LastActivityDate="2016-05-30T10:54:47.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30596" PostTypeId="1" AcceptedAnswerId="36035" CreationDate="2016-05-20T13:09:26.723" Score="12" ViewCount="41195" Body="&lt;p&gt;I have a basic understanding of VRFs, VLANs and subnets. I understand that VLANs operate on L2, and subnets and VRFs (lite) on L3. What I don't understand, is why you would choose one over the other when you mostly care about segmentation.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Imagine I have only 2 devices, and I don't want them to be able to talk to each other, but I do want them to be able to access the internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;VLANs&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine I have only one switch and one router in my network. I could do as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;device 1 =&gt; VLAN 1&lt;/li&gt;&#xA;&lt;li&gt;device 2 =&gt; VLAN 2&lt;/li&gt;&#xA;&lt;li&gt;Internet =&gt; VLAN 3&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then, to prevent them from talking, I could allow traffic between vlan 1 and vlan 3, as well as traffic between vlan 2 and vlan 3. I would, however, drop all traffic flowing between vlan 1 and vlan 2. =&gt; Segmentation OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Subnets&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine I have two switches and one router in my network. I could do as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;subnet 1 =&gt; switch 1 =&gt; device 1&lt;/li&gt;&#xA;&lt;li&gt;subnet 2 =&gt; switch 2 =&gt; device 2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then, like I did with the VLANs, I could drop all packets flowing between subnet 1 and subnet 2. =&gt; Segmentation OK. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;VRFs&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine I have multiple switches and one router. I could do as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VRF 1 =&gt; Device 1&lt;/li&gt;&#xA;&lt;li&gt;VRF 2 =&gt; Device 2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I do not explicitly have to prevent anything. By default, the two VRF's won't be able to talk to each other. =&gt; Segmentation OK.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Is there any other advantage to any of the three? What is the preferred method? Why would I combine the three? What else did I miss?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit&lt;/strong&gt;&#xA;I'm really looking for an answer which compares the three options, especially VLAN (which might be using separate subnets) vs VRF segmentation. &lt;/p&gt;&#xA;" OwnerUserId="25533" LastEditorUserId="25533" LastEditDate="2016-05-20T15:46:04.950" LastActivityDate="2022-10-13T20:33:45.493" Title="VRFs, VLANs and subnets: difference" Tags="|vlan|subnet|vrf|vrf-lite|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30597" PostTypeId="1" AcceptedAnswerId="30598" CreationDate="2016-05-20T13:33:16.783" Score="3" ViewCount="1379" Body="&lt;p&gt;I have a setup like this. (Yes, I suck at Paint)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fd27d.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fd27d.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I know is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Only the ASA knows sees PCA &lt;strong&gt;AND&lt;/strong&gt; PCB. Because the ASA is the only one who is connected to both VLANS. Am I right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I want to Download a File from PCB to PCA. Does the file (10GB big), uses Route1 (the blue one) for the whole 10GB file?&#xA;OR does the ASA say to the PC something like &quot;&lt;code&gt;Hey the PC is connected to PORT1, you don't have to send the whole package over cable1 and cable2!&lt;/code&gt;&quot; and then the File never leaves the Switch and goes over Route2 (the black one)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know this, because our Server and Clients are on different VLANS. If the file never leaves the Switch, I will put the Clients with the Server they need most often on the some switch.&lt;/p&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="8499" LastEditDate="2018-12-23T06:18:42.993" LastActivityDate="2018-12-23T06:18:42.993" Title="Data Flow between VLANS" Tags="|cisco|vlan|cisco-asa|firewall|packet-path|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30598" PostTypeId="2" ParentId="30597" CreationDate="2016-05-20T14:03:12.297" Score="3" Body="&lt;p&gt;Hosts on one VLAN cannot communicate with hosts on another VLAN, except through a layer-3 device, e.g. a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VLAN is a layer-2 concept. When hosts communicate, they use layer-2 to communicate on the LAN. VLANs prevent this from happening by dividing the LAN into virtual LANs. A host needing the layer-2 (e.g. MAC) address of the destination will broadcast an ARP request for the destination host's address. A broadcast will only be sent in the LAN or VLAN (broadcast domain). It the destination is on another network, the sending host will use its configured gateway's layer-2 address as the destination layer-2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your specific case, the switch will keep the traffic in each VLAN separate, and it will only send it directly from one host port to the other if it is a layer-3 switch with routing enabled between the VLANs, and it is configured in the hosts' as the gateway. Otherwise, if the only routing is happening on the ASA, the traffic will need to travel through the ASA.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-20T14:08:56.137" LastActivityDate="2016-05-20T14:08:56.137" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="30599" PostTypeId="2" ParentId="30577" CreationDate="2016-05-20T14:04:15.623" Score="4" Body="&lt;p&gt;When decoding QOS policies I like to reverse engineer it. Start with the last command that was configured in regards to the QOS. This is usually the service-policy statement on the interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;service-policy output QOS-SHAPER-GI0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The points to a shaping parent policy with nested LLQ scheduler (QOS-SCHEDULER-GI0/0) child policy. The shaper is configured for 50Mbps. And the LLQ has one priority traffic classes with a policer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bandwidth statement on the interface is referenced when bandwidth statements exist in the parent policy. For example if you had configured two classes (one being class default) the bandwidth statements for those classes can't exceed the max_reserve x bandwidth statement on the interface. In your case the max res is 100% for a result of 50Mbps. In your actual configuration you have a shaper in the parent policy and it effectively ignores the bandwidth statement. However the bandwidth statements in the child policy, if any were present, are now bound to the bandwidth of the shaper. Hopefully your able to follow this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-packet-marking/10100-priorityvsbw.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/quality-of-service-qos/qos-packet-marking/10100-priorityvsbw.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With regard to the priority queue in the LLQ scheduler you have something called conditional policing and unconditional policing. During periods of congestion  the priority bandwidth command polices the traffic to the configured CIR. During periods of non-congestion the priority queue is able to exceed the CIR. The is call conditional policing. The police command provides an unconditional policer and polices any excess traffic during periods of congestion and non-congestion. Typically you would choose one or the other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_conmgt/configuration/xe-3s/qos-conmgt-xe-3s-book/qos-conmgt-multilevel-pq.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/qos_conmgt/configuration/xe-3s/qos-conmgt-xe-3s-book/qos-conmgt-multilevel-pq.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With both configured the unconditional takes precedence. I had to test to confirm. And with your configuration they both are configured at the same rate. Priority is configured in kbps and policers/shapers are configured in bps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand why you are configuring the exceed action to transmit and remark to ef. I think this defeats the purpose of the LLQ.&lt;/p&gt;&#xA;" OwnerUserId="25537" LastEditorUserId="509" LastEditDate="2016-05-21T08:48:23.743" LastActivityDate="2016-05-21T08:48:23.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30600" PostTypeId="2" ParentId="30596" CreationDate="2016-05-20T15:33:58.097" Score="4" Body="&lt;p&gt;IP subnets and VLANs are not mutually exclusive -- you don't choose one or the other.  It most cases, there is a one-to-one correspondence between VLANs and subnets.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your first example, assuming you're using IP, you are still going to have to assign IP subnets to the VLANs.  So you would assign a separate IP subnet to  VLAN 1 and 2.   It is up to you whether to filter by VLAN or IP address, although you'll find that since you have to route between the VLANs, filtering by IP is easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the VRF example, you have the problem of the Internet connection.  When traffic is received from the Internet, which VRF do you place it into?  To make it work as you've described, you would need two Internet connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: &#xA;The &quot;R&quot; in VRF stands for Routing.  A VRF gives you, in effect, separate independent routers, and they can have overlapping addresses and different routes. The reason for VRFs is not segmentation, per se, but to allow separate routing calculations. As an example, in your VRF 1, the default route may point to the Internet, but in VRF 2, it may point somewhere else. You can't do that (easily) with a single router, and it's near impossible in a larger network.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-05-20T16:04:14.870" LastActivityDate="2016-05-20T16:04:14.870" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30606" PostTypeId="1" AcceptedAnswerId="30610" CreationDate="2016-05-20T18:33:59.483" Score="2" ViewCount="791" Body="&lt;p&gt;Is there a difference between a bridge and a crossover cable between two machines?&lt;/p&gt;&#xA;" OwnerUserId="16753" LastEditorUserId="8499" LastEditDate="2018-12-21T04:11:50.470" LastActivityDate="2021-03-19T10:10:33.807" Title="Difference between a bridge and just a cross over cable between two machines?" Tags="|ethernet|layer1|cable|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30607" PostTypeId="1" CreationDate="2016-05-20T18:40:41.500" Score="1" ViewCount="1407" Body="&lt;p&gt;I have a lab setup like so in ESXi:&#xA;Virtual MikroTik router (192.168.2.1)&#xA;Virtual Domain Controller (192.168.2.2)&#xA;Virtual Linux Server (192.168.2.3)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The host itself is connected to a LAN with IP address of 192.168.1.150. The LAN has a physical MikroTik router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Virtual MikroTik can access the Internet and LAN devices via physical MikroTik, but physical MikroTik can't see anything on the virtual network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to connect a physical device that will talk to Virtual Linux server from physical LAN through to virtual network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I do that on MikroTik? Do I set up a dst-nat rule?&lt;/p&gt;&#xA;" OwnerUserId="25545" LastEditorUserId="8499" LastEditDate="2018-02-14T16:23:15.117" LastActivityDate="2018-02-14T16:23:15.117" Title="How to connect to a physical device to a virtual server that is connected to a virtual router" Tags="|lab|" AnswerCount="1" CommentCount="3" ClosedDate="2017-08-09T23:45:23.823" ContentLicense="CC BY-SA 3.0" />
  <row Id="30609" PostTypeId="2" ParentId="30524" CreationDate="2016-05-20T20:48:37.380" Score="0" Body="&lt;p&gt;-o $EXTIF will be satisfied because it is your egress interface for everything except your LAN. In other words the Internet. So as your LAN tries to reach some site on the Internet, it will traverse $INTIF and exit $EXTIF.&lt;/p&gt;&#xA;" OwnerUserId="24222" LastActivityDate="2016-05-20T20:48:37.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30610" PostTypeId="2" ParentId="30606" CreationDate="2016-05-20T20:51:26.730" Score="4" Body="&lt;p&gt;Yes.  A crossover cable approximates a &lt;em&gt;hub&lt;/em&gt; moreso than a &lt;em&gt;bridge&lt;/em&gt; as the hub simply forwards all frames out of all ports.  The bridge will keep a mac-address table or bridge table and will forward frames to only those ports that see traffic from said host.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-20T20:51:26.730" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30611" PostTypeId="2" ParentId="30458" CreationDate="2016-05-20T21:53:29.407" Score="0" Body="&lt;p&gt;In a test environment you will have to try a multi layered solution.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;On your L2 2510 switches try the &quot;protected-port&quot; feature available for the 2510 series&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://serverfault.com/questions/539077/hp-procurve-2512-2524-protected-port-source-port-filter-or-similar&quot;&gt;https://serverfault.com/questions/539077/hp-procurve-2512-2524-protected-port-source-port-filter-or-similar&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://serverfault.com/questions/539077/hp-procurve-2512-2524-protected-port-source-port-filter-or-similar&quot;&gt;https://serverfault.com/questions/539077/hp-procurve-2512-2524-protected-port-source-port-filter-or-similar&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;On your L3 cores update/create ACLs that permits &quot;ip helpers&quot; to your legit dhcp servers and denies rogues.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If all fails, upgrade your switches for newer models that supports the feature sets you require?&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2016-05-20T21:53:29.407" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30612" PostTypeId="2" ParentId="27997" CreationDate="2016-05-20T22:44:52.807" Score="0" Body="&lt;p&gt;This is a good question as this scenario covers tens of thousands of businesses.  Following the KISS principle is always a good idea.  You want the LAN to be a LAN.  So, you want all VLANs available to all switches.  Practically, this means uplinks (links connecting switches) are trunk links.  This way, if you ever need to put a port on the OUTSIDE VLAN, for example, all you gotta do is assign that port to that VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for WiFi, I recommend sticking with a layer 2 implementation unless you have a solid reason not to.  Again, WiFi is layer 2 connectivity so leave it as such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for VLAN's and WLANs (SSID's), keep them to a minimum.  You should not need more than 4 or so VLANs - maybe INSIDE, OUTSIDE, DMZ, GUEST.  INSIDE and GUEST WLANs (SSIDs).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-20T22:44:52.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30615" PostTypeId="1" AcceptedAnswerId="30616" CreationDate="2016-05-21T12:52:18.630" Score="4" ViewCount="277" Body="&lt;p&gt;this question has been bothering me for sometime and I've yet to receive a clear answer (it bothers me whenever I go to sleep). I would like to receive expert answers on this matter.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Who mainly provides IP addresses to domains? &lt;/p&gt;&#xA;  &#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;As in, who commands, &quot;www.google.com, 103.233.38.93 is yours; www.stackexchange.com I will assign 104.16.115.182 to you; etc.&quot;&lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a possibility of IP address assignment duplication between two domains? If yes, is it bad? What happens if there is a duplication?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;blockquote&gt;&#xA;  &lt;p&gt;The limit of IPv4 Address is 4,294,967,296. As of 2015, there are about 863,105,652 websites and 3,185,996,155 internet users. It gives us at about a total of 4,049,101,807 possible IP Address assignments. If IPv6 is not implemented and the IPv4 limit is reached, what happens to IP address assignments if it runs out of IP addresses to be assigned?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I hope to learn so much over the discussions to come! Thank you!&lt;/p&gt;&#xA;" OwnerUserId="25554" LastActivityDate="2018-08-13T16:08:41.760" Title="How are IPv4 Addresses provided uniquely to domains?" Tags="|routing|ipv4|nat|internet|dns|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30616" PostTypeId="2" ParentId="30615" CreationDate="2016-05-21T13:09:47.023" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Who mainly provides IP addresses to domains?  As in, who commands, &quot;www.google.com, 103.233.38.93 is yours;  www.stackexchange.com I will assign 104.16.115.182 to you; etc.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Normally IP addresses are given out by providers to their customers. Small hosting customers will get IPv4 IPs allocated one at a time to their servers. Some organsiations will run their own neworks and have their own blocks of IP addresses either allocated by their provider or in the case of larger organisations direct from a RIR (google for example have their own IP space, I dunno about stackexchange). IPv6 IPs being so plentiful are usually allocated in blocks even when a customer only buys a single server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addresses are allocated to networks by RIRs (ARIN, RIPE, APNIC etc). However the regular &quot;free pool&quot; of IPv4 addresses at most RIRs has now run out (there are some IP addresses held back by the RIRs for specific purpose allocations). So companies wanting more IPv4 adresses now have to buy them on the market and get the RIR to transfer them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The customer then sets up their DNS records to point their domain name(s) to the IP address(es) that are allocated to their server(s).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a possibility of IP address assignment duplication between two domains? If yes, is it bad? What happens if there is a duplication?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can host multiple hostnames on the same IP address through a process known of as name based virtual hosting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A complication in the past was that you could only have one ssl/tls certificate per IP address and using the same certificate for multiple independent sites was tricky. In principle one certificate can cover multiple hostnames but the certificate would need to be reissued each time a hostname (or wildcard group of hostnames) is added and if the hostnames belong to different domains convincing the CA that you have legitimate control of all of them may be difficult.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recent versions of tls have an extension called server name indication which allow multiple certificates per IP. Unfortunately it has taken a long time for client support to become ubiquitous. Internet Explorer on Windows XP and the default browser on android 2.x being the main browsers that don't support it. Both are in decline but that decline has been much slower than people hoped. If you have to serve non-browser clients then the picture can be less rosy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also each IP address has to be assigned to a machine. So if you want to host sites with the same public IPv4 address on different machines you will need to use some sort of reverse proxy service (with the backend links to the servers going over IPv6 or private IPv4).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The limit of IPv4 Address is 4,294,967,296. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Actually the practical limit is much lower than that. Many large blocks were assigned to special purposes. Many companies who got their addresses early got assigned much larger blocks than they really needed due to classfull addressing and even with CIDR the power of two block sizes lead to many wasted addresses. The &quot;Class E&quot; addresses are effectively unusable because some vendors interpreted &quot;reserved&quot; as &quot;refuse to have anything to do with these addresses&quot;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As of 2015, there are about 863,105,652 websites and 3,185,996,155 internet users. It gives us at about a total of 4,049,101,807 possible IP Address assignments. If IPv6 is not implemented and the IPv4 limit is reached, what happens to IP address assignments if it runs out of IP addresses to be assigned?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As IPv4 addresses get in more and more limited supply the market price of an IPv4 address is likely to rise (it's currently about $10 per IP which is pretty cheap). As the price rises people will re-evaluate what applications can really justify a public IPv4 address and what applications will have to make-do without one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are mechanisms that can be used to provide some degree of connectivity to the IPv4 internet while reducing the consumption of public IPv4. On the client side a provider can either use conventional IPv4 NAT (&quot;CGN&quot;) or they can use IPv6 based transition mechanisms like NAT64 or DS-Lite. Mobile providers have been doing this for years, fixed-line providers are just starting to trial it. I expect the lowest tier customers to be pushed behind ISP level NAT first with more expensive packages retaining a public IPV4 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT doesn't really work on the server side. You can forward ports but that doesn't really help when everyone wants ports 80 and 443. Instead the solution there is reverse proxies. These accept the TCP connections from clients and then look at what the client sends to decide where to forward the connection to. For plain http they can use the http host header (as used in name-based virtual hosting). For https if the client supports SNI then they can use the SNI information to forward the connection at a TCP level without decrypting the ssl/tls session. If SNI is not supported then the proxy must terminate the ssl/tls connection and look at the host header inside. If the certificate the server presents doesn't cover the domain the client is trying to access this will cause a certificate warning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hosting with provider operated reverse proxies is still a fairly new thing (I'm only aware of one provider doing it) but I expect it to get more common as the IPv4 crunch deepens.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2018-08-13T16:08:41.760" LastActivityDate="2018-08-13T16:08:41.760" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="30618" PostTypeId="1" AcceptedAnswerId="30622" CreationDate="2016-05-21T17:35:01.593" Score="5" ViewCount="21840" Body="&lt;p&gt;Is there any reason of choosing &quot;3&quot; only for retransmission. why not 2 or 4 or any other number?&lt;/p&gt;&#xA;" OwnerUserId="16924" LastEditorUserId="775" LastEditDate="2016-05-21T17:44:07.483" LastActivityDate="2022-09-02T15:02:46.577" Title="Why only after 3-duplicate ACK retransmission takes place in TCP?" Tags="|tcp|protocol-theory|congestion|tcpdump|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30619" PostTypeId="1" AcceptedAnswerId="30848" CreationDate="2016-05-21T17:42:54.970" Score="1" ViewCount="1096" Body="&lt;p&gt;In following topology, How does the my computer calculates the MTU of (lan cable1) to fragment the packets? Does switches have any MTU limit? If yes then, According which thing (lan cable2 or SWITCH3)  ROUTER1 fragments the packet? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On what basis MTU is calculated?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Me &amp;lt;--(lan cable1)--&gt; ROUTER1 &amp;lt;----(lan cable2)----&gt; SWITCH3 &amp;lt;----(lan cable3)----&gt; ROUTER4 &amp;lt;---(lan cable4)---&gt; SERVER(1 GB file)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advanced.&lt;/p&gt;&#xA;" OwnerUserId="16924" LastEditorUserId="16924" LastEditDate="2016-05-22T05:29:34.783" LastActivityDate="2016-05-31T13:51:37.777" Title="How MTU of other ends of router calculated?" Tags="|switch|router|tcp|ip|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30622" PostTypeId="2" ParentId="30618" CreationDate="2016-05-21T21:37:26.567" Score="8" Body="&lt;p&gt;You're referring to 'Fast Retransmit' in the TCP Reno implementation. It is basically an assumption.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2001#section-3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2001, TCP Slow Start, Congestion Avoidance, Fast Retransmit, and Fast Recovery Algorithms&lt;/a&gt; covers this:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Since TCP does not know whether a duplicate ACK is caused by a lost&#xA;segment or just a reordering of segments, it waits for a small number&#xA;of duplicate ACKs to be received.&lt;/p&gt;&#xA;&lt;p&gt;It is assumed that if there is just a reordering of the segments,&#xA;there will be only one or two duplicate ACKs before the reordered&#xA;segment is processed, which will then generate a new ACK. If three or&#xA;more duplicate ACKs are received in a row, it is a strong indication&#xA;that a segment has been lost.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The key here is that Reno wants to avoid slow-start it makes the assumption that 3 dup-acks received without any intervening packets is the receiver indicating that it wants that single segment resent(fast re-transmit). If a timeout occurs that is when Reno will trigger slow start.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2001#section-4&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2001, TCP Slow Start, Congestion Avoidance, Fast Retransmit, and Fast Recovery Algorithms, Section 4, Fast Recovery&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;After fast retransmit sends what appears to be the missing segment,&#xA;congestion avoidance, but not slow start is performed.  This is the&#xA;fast recovery algorithm.  It is an improvement that allows high&#xA;throughput under moderate congestion, especially for large windows.&lt;/p&gt;&#xA;&lt;p&gt;The reason for not performing slow start in this case is that the&#xA;receipt of the duplicate ACKs tells TCP more than just a packet has&#xA;been lost.  Since the receiver can only generate the duplicate ACK&#xA;when another segment is received, that segment has left the network&#xA;and is in the receiver's buffer.  That is, there is still data flowing&#xA;between the two ends, and TCP does not want to reduce the flow&#xA;abruptly by going into slow start.&lt;/p&gt;&#xA;&lt;p&gt;The fast retransmit and fast recovery algorithms are usually&#xA;implemented together as follows.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When the third duplicate ACK in a row is received, set ssthresh to&#xA;one-half the current congestion window, cwnd, but no less than two&#xA;segments.  Retransmit the missing segment.  Set cwnd to ssthresh&#xA;plus 3 times the segment size.  This inflates the congestion window&#xA;by the number of segments that have left the network and which the&#xA;other end has cached (3).&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Each time another duplicate ACK arrives, increment cwnd by the&#xA;segment size.  This inflates the congestion window for the&#xA;additional segment that has left the network.  Transmit a&#xA;packet, if allowed by the new value of cwnd.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the next ACK arrives that acknowledges new data, set cwnd&#xA;to ssthresh (the value set in step 1).  This ACK should be the&#xA;acknowledgment of the retransmission from step 1, one round-trip&#xA;time after the retransmission.  Additionally, this ACK should&#xA;acknowledge all the intermediate segments sent between the lost&#xA;packet and the receipt of the first duplicate ACK.  This step is&#xA;congestion avoidance, since TCP is down to one-half the rate it&#xA;was at when the packet was lost.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;The fast retransmit algorithm first appeared in the 4.3BSD Tahoe&#xA;release, and it was followed by slow start.  The fast recovery&#xA;algorithm appeared in the 4.3BSD Reno release.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="168" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-05-21T23:02:28.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30624" PostTypeId="2" ParentId="25397" CreationDate="2016-05-22T00:15:02.050" Score="1" Body="&lt;p&gt;You can, and you should.  If the switches are stacking switches then you can even have the ports on 2 separate switches.  It's a rather simple port-channel configuration on the router and switch.  Cisco has a document explaining this, &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-2950-series-switches/24042-158.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring EtherChannel and 802.1Q Trunking Between Catalyst L2 Fixed Configuration Switches and a Router (InterVLAN Routing)&lt;/a&gt;.&#xA;&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel1&#xA; switchport trunk native vlan 10&#xA; switchport mode trunk&#xA; no ip address&#xA; flowcontrol send off&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport trunk native vlan 10&#xA; switchport mode trunk&#xA; no ip address&#xA; channel-group 1 mode on&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport trunk native vlan 10&#xA; switchport mode trunk&#xA; no ip address&#xA; channel-group 1 mode on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And on the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel1&#xA; no ip address&#xA; hold-queue 150 in&#xA;!&#xA;interface Port-channel1.10&#xA; encapsulation dot1Q 10 native&#xA; ip address 10.10.10.1 255.255.255.0&#xA;!&#xA;interface Port-channel1.20&#xA; encapsulation dot1Q 20&#xA; ip address 10.10.11.1 255.255.255.0&#xA;!&#xA;&#xA;!--- Output suppressed.&#xA;&#xA;!&#xA;interface FastEthernet3/0&#xA; no ip address&#xA; channel-group 1&#xA;!&#xA;interface FastEthernet4/0&#xA; no ip address&#xA; channel-group 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yChSR.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yChSR.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-22T00:15:02.050" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30626" PostTypeId="2" ParentId="30524" CreationDate="2016-05-22T03:37:11.207" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;As I understand a packet will be traversing the FORWARD chain only if it is not intended for the local host.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Correct.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The clarification I have is how will the matching condition of -o $EXTIF be satisfied for any packets. I understand that -i $INTIF will be satisfied as it is the entry interface for the packet. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;By the time the packet hits the &quot;forward&quot; chain the routing descision (including the descision on whether the accept the packet locally or send it onwards) has been made. So the output interface is known and can be matched against in rules.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-22T03:37:11.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30635" PostTypeId="2" ParentId="25397" CreationDate="2016-05-22T19:47:22.017" Score="1" Body="&lt;p&gt;If you mean should you use a router to connect two separate switches to each other at Layer 2 then probably not no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router is designed to be a gateway between two different layer two domains rather than linking them at Layer 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want the VLAN on each switch to be a single VLAN spanning both switches then connect them to each other. If you want to use the same VLAN ID to provide two separate VLANs, one on each switch, with different subnets assigned, then sure go via the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All that said, you can often make a router bridge two interfaces together, which is effectively making the router ports &quot;switch&quot;, as switches are just bridging really. In Cisco land, they call this integrated routing and bridging.&lt;/p&gt;&#xA;" OwnerUserId="23348" LastActivityDate="2016-05-22T19:47:22.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30636" PostTypeId="2" ParentId="28069" CreationDate="2016-05-22T19:52:18.570" Score="3" Body="&lt;p&gt;This command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no switchport trunk allowed vlan 64,68&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;probably didn't do what you think it does. The switch probably read that as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no switchport trunk allowed vlan&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which would remove all vlans on the trunk&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably meant to use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk allowed vlan remove 64, 68&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23348" LastActivityDate="2016-05-22T19:52:18.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30637" PostTypeId="2" ParentId="28864" CreationDate="2016-05-22T19:59:32.827" Score="0" Body="&lt;p&gt;A lot depends on the protocols you are using.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, if you are using a protocol that has some sort of end to end flow control (e.g. TCP) then the latency end to end will &lt;strong&gt;could&lt;/strong&gt; have an effect on throughput. This effect is referred to as the BDP (bandwidth delay product - Google it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another answer to your question could be considered where you have a sub-rate service from a provider. The provider runs a fibre to your premise, this fibre could be a 1Gb/s Ethernet link. However, you contract for a 200Mb/s service. So your transmission rate is 1Gb/s, as that's the speed the bits are being sent, but your bandwidth is still 200Mb/s. This is normally controlled with a policer (if you the provider), or a shaper (if you are the subscriber).&lt;/p&gt;&#xA;" OwnerUserId="23348" LastActivityDate="2016-05-22T19:59:32.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30641" PostTypeId="2" ParentId="20887" CreationDate="2016-05-22T22:50:35.623" Score="0" Body="&lt;p&gt;If they are Cisco routers, have a look at &lt;a href=&quot;http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-embedded-event-manager-eem/index.html&quot; rel=&quot;nofollow&quot;&gt;IOS Embedded Event Manager, EEM&lt;/a&gt;.  You can have the router email you, for example, if a particular interface or subinterface goes down.  It is a very flexible system in terms of options.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-22T22:50:35.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30642" PostTypeId="1" AcceptedAnswerId="30690" CreationDate="2016-05-23T00:58:10.880" Score="1" ViewCount="218" Body="&lt;p&gt;My office has two internet connections and two routers and two networks. One network is used for the Internet connect and has great speeds. The second network runs our IP phones and is a backup internet connection - the speed is slow and is reserved for backup internet and IP phones only because the phones don't work well when we use them with the internet on that network at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to combine the two networks to minimise the cabling, make maintenance easier and reduce the fail points in our networks. There are some requirements though. I need to ensure the Internet will be drawn from the Internet router and the IP phones will go via the IP phone router and I'd prefer to do it with hardware over software like Speedify so I can ensure it will work regardless of the device connected to the network and regardless of the setup of each device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's like bridging via Windows network settings but I need to have control over how things are dealt with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices that connect to both networks include, HP printers, Mac and Windows computers, Cisco IP phones, iOS and Android devices and smart TVs&lt;/p&gt;&#xA;" OwnerUserId="25573" LastActivityDate="2016-05-24T20:02:42.003" Title="Combining Two Networks With Hardware" Tags="|cisco|bridge|speed|" AnswerCount="2" CommentCount="4" ClosedDate="2019-03-12T00:13:41.443" ContentLicense="CC BY-SA 3.0" />
  <row Id="30644" PostTypeId="2" ParentId="19068" CreationDate="2016-05-23T01:48:54.960" Score="1" Body="&lt;p&gt;I expect you need to use the redirect target in ebtables to pull the packets out of the bridge and into IP routing so that the NAT machinary can see them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I haven't actually tried it so I don't know if it will work or what if any gotchas there are.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-23T01:48:54.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30645" PostTypeId="2" ParentId="24068" CreationDate="2016-05-23T01:58:43.143" Score="1" Body="&lt;p&gt;It is not necessary at all.  It is obvious that a short message should only require one packet to the server which includes the start + message, and one packet back acknowledging it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The previous answers just describe the system without discussing the need for random sequence numbers etc.  in the first place.  The original question was about the design of TCP itself -- obviously if you use the TCP protocol then you need three messages because that is the protocol.  But why was TCP designed that way in the first place?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe the original idea was that there was no distinction between clients and servers.  Both knew the other's ports in a bidirectional manner, and either could start the conversation.  And that required Syns etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this is not, of course, how it is used today. The server listens on a well known port and does and &quot;accept&quot;, the client port number is ephemeral.  I do not even think it is possible for a server waiting on an &quot;accept&quot; to send a request to another on the &lt;em&gt;same client port&lt;/em&gt; number in normal operating systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note that this is about bidirectional initiation of the connection, which is never done today.  That is quite different from sending bidirectional messages down a connection once established.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To work around the TCP inefficiency, we use protocols like HTTP 1.1 which can reuse the same connection for multiple requests, and thus avoid the TCP handshake which was not necessary in the first place.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But Http 1.1 is relatively new.  And SSL/TLS needed a way to reuse session from the beginning due to the cost of the PKI algorithms.  So that protocol includes its own session reuse mechanism which runs on top of Http 1.1 which runs on top of TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such is the way with software.  Fudges on kludges which when combined, produce an acceptable result.&lt;/p&gt;&#xA;" OwnerUserId="25576" LastEditorUserId="25576" LastEditDate="2016-05-23T02:16:40.693" LastActivityDate="2016-05-23T02:16:40.693" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="30650" PostTypeId="1" AcceptedAnswerId="30652" CreationDate="2016-05-23T07:21:49.727" Score="3" ViewCount="1385" Body="&lt;p&gt;There is one thing I still cannot understand is persistent connection and sessions.&#xA;I will explain how I understand all network stuff.   &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Physical layer . This is just voltage levels going through wires, there is nothing difficult on this layer to understand.   &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Data link layer for example frame which contains some information about devices like MAC address. How does frame reach the destination ? Using switches for example. Switch knows which port is mapped to specific address and when frame comes it just send voltage levels to specific port.And on the other side network card receives voltage and triggers interrupt which is handled by the OS. &lt;strong&gt;I don't understand how does packet is directed to the right device using Wifi connection.&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Network layer. Just uses space defined for data in data link layer to add IP header on the top, decreasing data payload size that can be transmitted over the network in one frame&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What about my main question about persistent connection.&lt;br&gt;&#xA;I don't understand what does persistent mean in this case. I understand word persistent as following : no one else can occupy wire at the time of persistent connection. So this connection is only one-to-one. But this is not right. Persistent connection can be established while other packets are going through the same wire.&lt;br&gt;&#xA;I guess it works in a following way. Periodically client or server sends packet called heartbeat in order to accept that the opposite side is still here and stores this information for example somewhere in OS like boolean flag ( is_still_alive) in other case if response doesn't come in some period of time connection will be closed (removing flag, clearing buffers). And if packet with ACK for heartbeat comes later it will response with intent to establish connection again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess I will understand session mechanism if I understand described above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help to understand how this stuff works. I would be grateful for any help.&lt;/p&gt;&#xA;" OwnerUserId="25582" LastActivityDate="2016-05-23T11:14:11.923" Title="What is persistent connection and session" Tags="|osi|network-discovery|transport-protocol|mac|data|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30652" PostTypeId="2" ParentId="30650" CreationDate="2016-05-23T11:14:11.923" Score="6" Body="&lt;p&gt;First a word about:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I understand word persistent as following : no one else can occupy&#xA;  wire at the time of persistent connection. So this connection is only&#xA;  one-to-one. But this is not right. Persistent connection can be&#xA;  established while other packets are going through the same wire.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is &lt;em&gt;circuit-switched network&lt;/em&gt; vs &lt;em&gt;packet-switching network&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;circuit-switched network&lt;/strong&gt;&lt;br&gt;&#xA;In such networks, a physical dedicated line is established between the two hosts who wants to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The better example is the first phone networks where human operators manually connect two phone lines to establish communications on request.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/xV4pw.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xV4pw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Latter human operators where replaced with mechanisms. The enterprise internal version of such mechanism is known as &quot;PBX&quot; (Private Branch eXchange).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case you actually have a physical connection that is maintained and nobody else can use any of the circuit during that time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;packet-switching network&lt;/strong&gt;&lt;br&gt;&#xA;IP networks are packet-switched networks. As you said many packets from several applications can flow on the wire at the same time, and for a single conversation, different packets can take different routes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This allow better utilization of the link and more robust design (of course it has some drawbacks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So at the IP layer there's no &quot;connection&quot; nor &quot;session&quot; established.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's an emerging trend to identify &lt;em&gt;flows&lt;/em&gt; and apply specific switching and / or routing rules to them, and a flow can for example correspond to a TCP session but this is not what we usually refer to when speaking about connection / session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Connection&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP provide two main protocols (among others) to establish communication between two hosts : UDP and TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP is connection-less. That means (quoted from &lt;a href=&quot;https://en.wikipedia.org/wiki/Connectionless_communication&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia&lt;/a&gt;) that &quot;a message can be sent from one end point to another without prior arrangement. The device at one end of the communication transmits data addressed to the other, without first ensuring that the recipient is available and ready to receive the data&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP is connection-oriented. Before actually transmitting date, the two hosts talk to each other to check that they are both available and agree to exchange some kind of data (think of the preamble of a typical phone call). This connection is maintained until one host signal that it want to end it or after some time has passed without exchanging any data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VPN connection usually work the same way. Two hosts exchange some information (including which encryption protocol to use, some cryptography keys and user authentication mechanism etc...) and if bot agree on the terms, a connection is established and maintain. Usually some keep-alive packets are sent at regular interval to say &quot;I'm still here, don't drop the connection&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Session&lt;/strong&gt;&lt;br&gt;&#xA;Sessions are established by applications. A session can correspond to a single TCP connection, but a session can use several different TCP connection or use UDP as the transport protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A HTTP(s) session for example may use cookies to identify the user and can provide access to different resources (think about web banking). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Voice Over IP (VOIP) phone call will use the SIP protocol. SIP means &quot;Session Initiation Protocol&quot; and it can run over UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The exact mechanism of establishing / maintaining / closing a session depends on the applications used.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-05-23T11:14:11.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30655" PostTypeId="2" ParentId="28281" CreationDate="2016-05-23T14:14:39.157" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How does the ping work when we launch an ICMP echo request message from an internal LAN private IPv4 source address towards a public IPv4 destination address (example 8.8.8.8 - Google server) without enabling the NAT/PAT protocol on our default/internal gateway router?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Assuming it's a server on the public internet the ping will almost certinaly be unsuccessful. If it's a server on your own network with a public IP you may well be able to ping it successfully depending on internal routing configuration.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the ping is unsuccessful (receiving the requested timed out/time exceeded) ICMP error type, which next-hop node will prevent forwarding the traffic (ICMP control) packets towards the Internet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Theres various possibilities here depending on the configuration of different devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most likely your ISP will simply block the packet based on either reverse path filtering or an explicit block on private IP addresses. If they don't block it then likely someone else along the route will. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the packet does reach the destination server(because noone is performing filtering best practices) then a reply will be generated but that reply will not find it's way back to your network. It will either be dropped due to lack of a route or routed to somewhere in the destination network that happens to use the same private addresses you used.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Which methods we should use in order to obtain a successful echo reply ping?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Either enable some form of NAT or use legitimately aquired public IPs on your internal LAN and arrange for your ISP to route them to your gateway.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-05-23T14:14:39.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30656" PostTypeId="1" AcceptedAnswerId="30802" CreationDate="2016-05-23T15:13:47.733" Score="1" ViewCount="8419" Body="&lt;p&gt;I have to define a big amount of VLANs in a rather big amount of switches using Cisco packet tracer software. I was wondering whether there is a way to copy-paste all those commands from one switch to the others, or if it exists any kind of scripting available for that.&lt;/p&gt;&#xA;" OwnerUserId="25587" LastActivityDate="2017-10-10T02:36:40.723" Title="Cisco Packet Tracer - script copying" Tags="|cisco|switch|vlan|cisco-commands|packet-tracer|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30657" PostTypeId="1" AcceptedAnswerId="30658" CreationDate="2016-05-23T15:28:03.810" Score="0" ViewCount="1132" Body="&lt;p&gt;I'm new to networks and I was watching this video on Cybrary on Subnetting. The example h explained goes like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q. Subnetting 192.168.1.10/27 with subnet mask 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;He said 24 bits are for network address and 8 for the host (understood) &lt;/li&gt;&#xA;&lt;li&gt;He said that he'll be using 3 bits (the 3 most significant bits out of 8 bits of host address) and he used this formula : 2&lt;sup&gt;n&lt;/sup&gt; which is equal to the number of subnets (he put n = 3)&lt;/li&gt;&#xA;&lt;li&gt;He said that 5 bits are unused and he used: 2&lt;sup&gt;n&lt;/sup&gt; - 2 (plugged n = 5) which is equal to the number of hosts in each subnet.&lt;/li&gt;&#xA;&lt;li&gt;In the end he had 8 subnets each having 30 hosts which makes a total of 240 IP addresses + 8 broadcast + 8 network&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I lost him after point 1. I didn't really understand why he said he'll be using 3 bits. Is it because the network is subnetted by a number (27) more than 16 and less than 32? So if it was subnetted by 50 he would have used the 2 most significant bits and left 6 unused bits? I would then have 4 subnets each having 62 hosts making a total of 248 IP addresses + 4 network + 4 broadcast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct in the way I understood this?&lt;/p&gt;&#xA;" OwnerUserId="25589" LastActivityDate="2016-05-23T16:23:26.377" Title="Subnetting - Reason for maximum number of subnets" Tags="|subnet|network-core|" AnswerCount="1" CommentCount="0" ClosedDate="2016-05-23T16:45:55.640" ContentLicense="CC BY-SA 3.0" />
  <row Id="30658" PostTypeId="2" ParentId="30657" CreationDate="2016-05-23T16:23:26.377" Score="0" Body="&lt;p&gt;The answer is in the question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You provided &lt;code&gt;192.168.1.10/27&lt;/code&gt;. This is a Class C subnet, because the first octet (192) falls in the &lt;a href=&quot;https://www.google.com/search?q=class%20a%20class%20b%20class%20c&quot; rel=&quot;nofollow noreferrer&quot;&gt;range of 192-223&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Class C subnet has a default mask of /24, or 255.255.255.0. In Binary, the first 24 bits are 1, the last 8 bits are 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the original question used a &lt;code&gt;/27&lt;/code&gt; on a CLass C address, that means 3 bits were borrowed from the CLass C default mask (&lt;code&gt;/24&lt;/code&gt;) to get to &lt;code&gt;/27&lt;/code&gt;.  That is where he &quot;got&quot; the 3 borrowed bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;3 bits&quot; are arbitrary. Had his original question included the address &lt;code&gt;192.168.1.10/28&lt;/code&gt;, then he would be borrowing 4 bits. Had he chosen &lt;code&gt;192.168.1.10/29&lt;/code&gt;, then he would be borrowing 5 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Had he chosen the address &lt;code&gt;130.168.1.10/27&lt;/code&gt;, then he would be borrowing 11 bits. Because this is a Class &lt;strong&gt;B&lt;/strong&gt; address, with a default mask of &lt;code&gt;/16&lt;/code&gt;, and to get from &lt;code&gt;/16&lt;/code&gt; to &lt;code&gt;/27&lt;/code&gt; requires 11 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, I highly &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7106/how-do-you-calculate-the-prefix-network-subnet-and-host-numbers&quot;&gt;recommend reading the thread linked&lt;/a&gt; by &lt;a href=&quot;https://networkengineering.stackexchange.com/users/8499/ron-maupin&quot;&gt;@Ron Maupin&lt;/a&gt; for more detail on the process of Subnetting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the concept of &quot;classes&quot; in IP address is archaic. No one in the real world uses them anymore. It only persists because of Cisco's insistence of leaving it in all its training and certification material. &lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-05-23T16:23:26.377" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30659" PostTypeId="1" AcceptedAnswerId="30660" CreationDate="2016-05-23T16:49:32.290" Score="4" ViewCount="170" Body="&lt;p&gt;Why is the network layer in the OSI model considered to be connectionless when you have Virtual Circuits that are a part of the layer and is connection oriented? &lt;/p&gt;&#xA;" OwnerUserId="25568" LastActivityDate="2016-05-23T17:37:17.287" Title="Why is the network layer considered to be connectionless?" Tags="|osi|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30660" PostTypeId="2" ParentId="30659" CreationDate="2016-05-23T17:37:17.287" Score="7" Body="&lt;p&gt;Because there is no &quot;state &quot; in the network layer nor signaling for connection setup.  Packets are forwarded based on destination address and each packet is forwarded irrespective of previous traffic. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-23T17:37:17.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30661" PostTypeId="1" AcceptedAnswerId="30663" CreationDate="2016-05-23T18:45:42.487" Score="3" ViewCount="87" Body="&lt;p&gt;I know that 802.1x can track MAC addresses. If MAC address is used on one port then you can prohibit it from being used on another port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can 802.11x protocol do the same thing for IP addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My underlying question which triggered that one. Can a user connect to 802.1x using his/her credentials and after change IP address to somebody else IP address to get access to some resources which are protected based on IP address?&lt;/p&gt;&#xA;" OwnerUserId="25594" LastActivityDate="2016-05-23T20:54:18.843" Title="Is 802.1x port security enforces IP uniqueness" Tags="|ip|ieee-802.1x|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30662" PostTypeId="1" AcceptedAnswerId="30667" CreationDate="2016-05-23T19:35:59.130" Score="1" ViewCount="364" Body="&lt;p&gt;It's related to this question: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/30661/is-802-1x-port-security-enforces-ip-uniqueness&quot;&gt;Is 802.1x port security enforces IP uniqueness&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have 802.1X port security can you change a MAC address of your device (to some other unused MAC address)? Will it trigger reauthentication? Will this be prohibited?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same question for IP address. Can you change your IP address to some other unused IP address? What will happen?  Will it trigger reauthentication? Will this be prohibited?&lt;/p&gt;&#xA;" OwnerUserId="25594" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-05-24T04:09:54.520" Title="Can you change your MAC and IP address on 802.1X port?" Tags="|ip|mac-address|ieee-802.1x|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30663" PostTypeId="2" ParentId="30661" CreationDate="2016-05-23T20:54:18.843" Score="2" Body="&lt;p&gt;dot1x only establishes the user's identity; it has nothing to with IP addressing&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2016-05-23T20:54:18.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30664" PostTypeId="1" AcceptedAnswerId="30666" CreationDate="2016-05-23T22:29:08.370" Score="11" ViewCount="1584" Body="&lt;p&gt;I'm confused about Cisco IOS, and I have some question about that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco IOS is used in routers and other devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to write code (like PHP) for that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's possible, what language can I use?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing that confuses me is not how to work with Cisco IOS; it's about whether I can develop and change my router or other devices according to what I need for the network or not?&lt;/p&gt;&#xA;" OwnerUserId="25599" LastEditorUserId="775" LastEditDate="2016-05-24T11:53:40.147" LastActivityDate="2016-05-24T11:53:40.147" Title="Cisco IOS programming, automation, and information" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30666" PostTypeId="2" ParentId="30664" CreationDate="2016-05-23T22:49:50.727" Score="18" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Almost every&lt;sup&gt;Note 1&lt;/sup&gt; Cisco IOS system running at least IOS 12.2 has &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ios_tcl/configuration/12-4t/ios-tcl-12-4t-book/nm-script-tcl.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;built-in tcl shell programmability&lt;/a&gt;.  You can store tcl scripts in flash and run them.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Cisco IOS also has a light native programming environment called EEM (Embedded Event Manager).  EEM events can be triggered by a wide variety of inputs, such as packets on a certain port (via Netflow), log messages, or interface up/down.  Think of EEM as a subset of tclsh capabilities in IOS; EEM sucks less than programming in TCL, but you also get spotty feature support depending on the IOS mix you are dealing with.  EEM can be run on a cron schedule if that suits your needs.  At the bottom of &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/12878/cisco-ios-cli-prompts-any-way-to-know-which-interface-you-are-configuring/12896#12896&quot;&gt;this answer&lt;/a&gt;, I included an example EEM script; keep in mind that EEM is best for small-ish numbers of &quot;if-this, do-that&quot; statements... when you want to start defining functions and such, just bite the bullet and use &lt;code&gt;tclsh&lt;/code&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;New Cisco products support a special set of canned SDN APIs which are broader than I can explain while typing on my mobile phone; one example from this family includes &lt;a href=&quot;https://www.sdxcentral.com/resources/cisco/what-is-cisco-apic/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco APIC&lt;/a&gt;, but that's just scratching the surface of what they have available.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I would be remiss if I didn't point out that most of the Cisco scripting done in the last 20 years has been via &lt;a href=&quot;https://stackoverflow.com/questions/27896298/expect-script-for-cisco-juniper-config-backup&quot;&gt;screen-scraping&lt;/a&gt;, snmp, and (these-days) NETCONF.  Anything you can do from the CLI, can be automated via screen-scraping; I have spent a large portion of my career doing just this. Screen-scrapers usually host their scripts on an external linux system and connect to a router with the weapon of their own choice... usually that's one of these languages:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;TCL / Expect&lt;/li&gt;&#xA;&lt;li&gt;Perl... see &lt;a href=&quot;http://search.cpan.org/~schwigon/Net-SSH-Perl-2.01/lib/Net/SSH/Perl.pm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Net::SSH::Perl&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;http://search.cpan.org/~joshua/Net-Telnet-Cisco-1.10/Cisco.pm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Net::Telnet::Cisco&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;http://search.cpan.org/~dtown/Net-SNMP-v6.0.1/lib/Net/SNMP.pm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Net::SNMP&lt;/code&gt;&lt;/a&gt;, and &lt;a href=&quot;http://search.cpan.org/~muir/Cisco-Reconfig-0.9/Reconfig.pod&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;Cisco::Reconfig&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Python... see &lt;a href=&quot;https://github.com/pexpect/pexpect&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;pexpect&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;https://github.com/ktbyers/netmiko&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;netmiko&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;https://github.com/knipknap/exscript&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;exscript&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;https://github.com/etingof/pysnmp&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;pysnmp&lt;/code&gt;&lt;/a&gt;, and &lt;a href=&quot;https://github.com/mpenning/ciscoconfparse&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;ciscoconfparse&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Ruby... see &lt;a href=&quot;https://rubygems.org/gems/net-ssh/versions/3.1.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;net-ssh&lt;/code&gt;&lt;/a&gt;, &lt;a href=&quot;https://rubygems.org/gems/snmp&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;snmp&lt;/code&gt;&lt;/a&gt;, and &lt;a href=&quot;https://rubygems.org/gems/cisco&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;cisco&lt;/code&gt;&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Finally, the newer Cisco Nexus products have a Python API (such as &lt;a href=&quot;https://opennxos.cisco.com/public/api/python/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this one&lt;/a&gt; for the Nexus 9K); python APIs are  typically easier to  deal with than TCL APIs, but at this point you're restricted to the Nexus family.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;Note 1&lt;/sup&gt; The only exception I know of is the Cisco 3550, which &lt;a href=&quot;https://supportforums.cisco.com/discussion/10386446/tcl-interpreter-cisco-switches&quot; rel=&quot;nofollow noreferrer&quot;&gt;doesn't have &lt;code&gt;tclsh&lt;/code&gt; in 12.2&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="775" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2016-05-24T11:39:45.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30667" PostTypeId="2" ParentId="30662" CreationDate="2016-05-24T01:10:59.870" Score="2" Body="&lt;p&gt;And as was said in the other question, 802.1x is a layer-2 protocol. It is unaware of any layer-3 protocol(s). Changing your MAC can have several outcomes depending on the particular setup, ranging from nothing at all to permanent disabling of the port until an admin clears it. In all likelihood it would trigger reauthentication and be blocked until authenticated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addressing happens above 802.1x. As such, it has no say in the matter. Address management and security must be managed by other means.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2016-05-24T04:09:54.520" LastActivityDate="2016-05-24T04:09:54.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30669" PostTypeId="1" AcceptedAnswerId="30670" CreationDate="2016-05-24T09:29:10.130" Score="2" ViewCount="1480" Body="&lt;p&gt;There is a switch-based LAN without encrypted traffic. I want to sniff &lt;strong&gt;ALL&lt;/strong&gt; its traffic (ARP, TCP, ICMP, etc.) by plugging the laptop into one of the switch port. Then run the software on the PC to sniff the network traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course I will provide an authorized IP address to my laptop. It is an authorized test in lab environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do the sniffing? What sniffing software should I use?&lt;/p&gt;&#xA;" OwnerUserId="22125" LastActivityDate="2016-05-24T09:33:16.570" Title="How to sniff a switched LAN by plugging the laptop into a switch port" Tags="|lan|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30670" PostTypeId="2" ParentId="30669" CreationDate="2016-05-24T09:33:16.570" Score="4" Body="&lt;p&gt;The easy part: Use Wireshark for the sniffing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hard part: In a switched network you need support from the switch to get all the traffic. It is called &quot;port mirroring&quot;, &quot;span port&quot;, &quot;monitor port&quot; depending on the vendor. Without control over the switch you will not be able to capture all traffic.&lt;/p&gt;&#xA;" OwnerUserId="59" LastActivityDate="2016-05-24T09:33:16.570" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30672" PostTypeId="1" AcceptedAnswerId="30685" CreationDate="2016-05-24T10:50:37.000" Score="1" ViewCount="691" Body="&lt;p&gt;I have a network across two buildings that are quite close to each other. Each building currently has it's own network, and there is a wireless bridge between the two. Each building has it's own internet connection which is plugged into a router. The router has failover set to use the other building's connection if it's internet goes down, as well as to route traffic to servers in the other building when necessary. Each building also has several APs broadcasting the same SSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have drawn up a simplified network diagram for clarity:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SSy6D.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SSy6D.png&quot; alt=&quot;network diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, clients connected to the Wi-Fi at building A need to disconnect and reconnect when they go to building B, as the DHCP lease from building A is no longer valid. Is it possible to have clients roam between sites without doing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routers on each site are Ubiquiti EdgeRouters, and the APs are Unifi AP-Pros. The SSID cannot be changed for various reasons, however there would be no issue on having the clients using NAT to get to the main network at each building (I believe this is how the Cisco Meraki APs deal with this issue)&lt;/p&gt;&#xA;" OwnerUserId="5530" LastActivityDate="2016-05-24T19:10:49.633" Title="Wireless Roaming between different networks" Tags="|routing|wireless|dhcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30673" PostTypeId="1" AcceptedAnswerId="30678" CreationDate="2016-05-24T12:08:55.297" Score="2" ViewCount="3606" Body="&lt;p&gt;Here the diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/a2LFK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/a2LFK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been assigned to make a network where 3 headquearters are communicated securely, they must have internet connection and all of them must be able to access to the common servers located in one headquarter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've re-done a simply design of my original design so that you can understand easier my idea. I've looked up pretty much about these questions but i don't know if i'm sure about it, so here are my questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it possible to have internet internet connection through&#xA;MPLS network? I've read that it's possible, but only if am ISP offers this&#xA;service. I've looked up pretty much all about this, and I found&#xA;almost nothing. So, if it isn't possible, can I order a second&#xA;leased line for each headquarters, so that they have MPLS for&#xA;communicating with other headquarters, and the second line for&#xA;having an Internet connection?&lt;/li&gt;&#xA;&lt;li&gt;In the diagram, the MPLS router, LER, is the distribution layer&#xA;router that will route the VLANs. Am I right?&lt;/li&gt;&#xA;&lt;li&gt;For the VLANs, I need VLAN 1 to watch VLANs 2 and 3, but VLAN 2&#xA;can't see any other VLAN and VLAN 3 is the same as VLAN 2. My guess&#xA;is VLAN 1 will have 1 port in trunk mode, and the rest in untagged&#xA;mode. For VLANs 2 and 3, one port in tagged mode for the VLAN 1 and&#xA;the rest in untagged mode. Am I right?&lt;/li&gt;&#xA;&lt;li&gt;Are the firewalls correctly placed?&lt;/li&gt;&#xA;&lt;li&gt;Are &quot;Common servers&quot; correctly placed so that they can be accessed&#xA;from other headquarters through MPLS network?&lt;/li&gt;&#xA;&lt;li&gt;I've looked up info about MPLS and IPsec, but it doesn't appear a&#xA;lot of info, my question is simple, is it really possible to put&#xA;IPsec over MPLS?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Every answer is very appreciated :) Thanks&lt;/p&gt;&#xA;" OwnerUserId="25605" LastEditorUserId="8499" LastEditDate="2016-05-24T14:03:37.803" LastActivityDate="2019-09-04T11:50:11.230" Title="Have I desiged correctly my MPLS network?" Tags="|mpls|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30674" PostTypeId="1" CreationDate="2016-05-24T12:32:25.713" Score="1" ViewCount="411" Body="&lt;p&gt;IS-IS Hello packets contain IPv4(and IPv6 address). For example see the &quot;IPv4 Interface&quot; field in this IS-IS Hello packet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ tcpdump -c1 -vvvr isis.pcap&#xA;reading from file isis.pcap, link-type EN10MB (Ethernet)&#xA;12:59:55.406559 IS-IS, length 81&#xA;        L2 Lan IIH, hlen: 27, v: 1, pdu-v: 1, sys-id-len: 6 (0), max-area: 3 (0)&#xA;        0x0000:  831b 0100 1001 0000&#xA;          source-id: 0101.2812.3087,  holding time: 9s, Flags: [Level 2 only]&#xA;          lan-id:    0101.2812.3087.02, Priority: 64, PDU length: 81&#xA;          0x0000:  0206 2128 1230 8700 0900 5140 0101 2812&#xA;          0x0010:  3087 02&#xA;            IS Neighbor(s) TLV #6, length: 12&#xA;              SNPA: dead.beef.6905&#xA;              SNPA: dead.beef.6906&#xA;              0x0000:  dead beef 6905 dead beef 6906&#xA;            Protocols supported TLV #129, length: 2&#xA;              NLPID(s): IPv4 (0xcc), IPv6 (0x8e)&#xA;              0x0000:  cc8e&#xA;            IPv4 Interface address(es) TLV #132, length: 4&#xA;              IPv4 interface address: 10.128.123.87&#xA;              0x0000:  3e80 7b57&#xA;            Area address(es) TLV #1, length: 4&#xA;              Area address (length: 3): 49.0233&#xA;              0x0000:  0349 0233&#xA;            Restart Signaling TLV #211, length: 3&#xA;              Flags [none], Remaining holding time 0s&#xA;              0x0000:  0000 00&#xA;            Authentication TLV #10, length: 17&#xA;              HMAC-MD5 password: 67cb4d674c12c0df8bb1b1ad06788c46 (unchecked)&#xA;              0x0000:  3600 0000 0000 0000 0000 0000 0000 0000&#xA;              0x0010:  00&#xA;$ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In addition, both Cisco and Juniper routers show the adjacent router IPv4/IPv6 address in &lt;code&gt;show isis adjacency detail&lt;/code&gt;/&lt;code&gt;sh isis neighbors&lt;/code&gt; output. Am I correct that this IPv4/IPv6 address &lt;strong&gt;always&lt;/strong&gt; belongs to the interface where the IS-IS PDU was sent out? Is this specified in some standard? Why is the interface IPv4/IPv6 address included to IS-IS Hello packet?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2016-05-24T17:54:04.153" Title="IS-IS Hello packets and IPv4/IPv6 addresses" Tags="|is-is|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30675" PostTypeId="1" AcceptedAnswerId="30676" CreationDate="2016-05-24T13:02:30.803" Score="1" ViewCount="250" Body="&lt;p&gt;Does this mean, that someone is trying to get login over SSH/Telnet to my ASA?&#xA;If not, can someone explain me this log?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DEpK0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DEpK0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When there only is a &lt;code&gt;Built outbound UDP connection 6947 for outside:8.8.8.8/53 (8.8.8.8/53) to inside:10.0.0.168/48411 (PublicIP/48411)&lt;/code&gt; it means that I have opened a Website in Browser and it sends me an Response - Am I right?&lt;/p&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="2142" LastEditDate="2016-05-24T13:17:23.817" LastActivityDate="2016-05-24T18:08:57.197" Title="Is somebody trying to hack me?" Tags="|cisco|cisco-asa|firewall|tcp|acl|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30676" PostTypeId="2" ParentId="30675" CreationDate="2016-05-24T13:11:57.960" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does this mean that someone is trying to get login over SSH/Telnet to&#xA;  my ASA?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well, yes.   But you can expect to see that hundreds or thousands of times a day.   Welcome to the Internet.  If you don't allow SSH or telnet from the outside interface, this is just noise.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;it means that I have opened a Website in Browser and it sends me an&#xA;  Response - Am I right?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It means you have made a DNS query to Google.  If it were a website, you would see a connection to TCP port 80.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-24T13:11:57.960" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30677" PostTypeId="2" ParentId="30674" CreationDate="2016-05-24T14:15:44.457" Score="2" Body="&lt;p&gt;In essence - take a look at &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1195&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;RFC 1195&quot;&gt;RFC 1195&lt;/a&gt;, section 5.1:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;IP Interface Address -- the IP address(es) of the interface&#xA;corresponding to the SNPA over which this PDU is to be transmitted.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Why IP needs to be there? Remember that IS-IS is L2 protocol and L3 information (IPv4 or IPv6 address information) is overlay information for IS-IS. It's not needed for IS-IS itself, but needed to manage neighbourship at the L3 level for given IPv4 or IPv6 routing nodes.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-05-24T14:15:44.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30678" PostTypeId="2" ParentId="30673" CreationDate="2016-05-24T14:24:35.797" Score="5" Body="&lt;p&gt;This is quite complex to answer in simple set of questions, but let's try:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, it's possible to have internet connectivity by means of MPLS cloud, but it either means you need to self-deploy MPLS L3 VPN for yourself, or your MPLS cloud will be provided by upstream ISPs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Usually, edge routers - the ones running MPLS, are distinct from L3 switches/routers in aggregation layer, specifically, that You also add firewalls to the picture. It's doable, but usually it's better to route at the switching layer not aggregation/edge layer.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You're trying to ask very specific configuration question, not specifically technology one. It's possible to separate VLANs by means of various techniques - splitting the access ports to access and trunk is very weak and unsecure method. Please take a look at Private VLANs as one way, the other would be the firewalling segment to take responsibilities of filtering traffic between hosts or networks.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Again, hard question. In this specific topology yes, they can be placed this way. Depending on the performance required or features required, they may however be required to be positioned in a different way.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&quot;Common servers&quot; availability will be governed by configuration, not topology. We have too little data right now to decide if that's feasible or not. MPLS can be used to transport traffic of different protocols, including IPv4 and IPv6.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Yes, it's possible to use IPsec over MPLS. IPsec is IP based, MPLS is transport technology for IP - be it IPv4 or IPv6.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="286" LastActivityDate="2016-05-24T14:24:35.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30679" PostTypeId="1" AcceptedAnswerId="30680" CreationDate="2016-05-24T14:29:05.810" Score="1" ViewCount="206" Body="&lt;p&gt;I'm new to cisco and currently studying for a certification, this is just my way of practicing what I learned.. Currently I'm in a standstill because I can't seem to understand what is happening, or maybe my NAT fundamentals is off. Anyways please refer to the topology I created via Packet Tracer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/O7LxU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/O7LxU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CR running-config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;!&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 192.168.1.1 255.255.255.0&#xA; ip nat inside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/2&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/3/0&#xA; ip address 205.112.2.1 255.255.255.252&#xA; ip nat outside&#xA;!&#xA;interface Serial0/3/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip nat pool mypool 172.16.2.1 172.16.2.31 netmask 255.255.255.224&#xA;ip nat inside source list 50 pool mypool overload&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;access-list 50 permit 192.168.1.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ISP running-config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; ip address 210.125.35.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/2&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/3/0&#xA; ip address 205.112.2.2 255.255.255.252&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/3/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 205.112.2.1 &#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, &lt;code&gt;CR&lt;/code&gt; is my company router, connected via serial interface, also this is where i put my NAT configuration. &lt;code&gt;ISP&lt;/code&gt;'s is just a static route back to CR for ping purposes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i did to verify this setup is via &lt;code&gt;ping&lt;/code&gt; on PC0/PC1/PC2 to Server0 however it is unreacheable (yep understandable because CR has not route to 210.125.35.0 network) but considering NAT was configured on that router i expected it to be translated via the public IP and route it, at this point im really confused. Now another test i did was to &lt;code&gt;ping&lt;/code&gt; the 205.112.2.2 interface on ISP router it boom it translated (confirmed via &lt;code&gt;show ip nat translation&lt;/code&gt;). At this point im sure im missing something because im really confused at this point.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody help me clear things up? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @Ron Maquin said, it is a routing problem, i added a default route, but the nat translation is incrementing when i do continuous ping from PC0. As what i know, it will just reuse the assigned port to the translated IP (in this case PC0). Please correct me if im wrong, refer also to the &lt;code&gt;show ip nat translation&lt;/code&gt; output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CR#show ip nat translations &#xA;Pro  Inside global     Inside local       Outside local      Outside global&#xA;icmp 172.16.2.1:27     192.168.1.2:27     210.125.35.110:27  210.125.35.110:27&#xA;icmp 172.16.2.1:28     192.168.1.2:28     210.125.35.110:28  210.125.35.110:28&#xA;icmp 172.16.2.1:29     192.168.1.2:29     210.125.35.110:29  210.125.35.110:29&#xA;icmp 172.16.2.1:30     192.168.1.2:30     210.125.35.110:30  210.125.35.110:30&#xA;icmp 172.16.2.1:31     192.168.1.2:31     210.125.35.110:31  210.125.35.110:31&#xA;icmp 172.16.2.1:32     192.168.1.2:32     210.125.35.110:32  210.125.35.110:32&#xA;icmp 172.16.2.1:33     192.168.1.2:33     210.125.35.110:33  210.125.35.110:33&#xA;icmp 172.16.2.1:34     192.168.1.2:34     210.125.35.110:34  210.125.35.110:34&#xA;icmp 172.16.2.1:35     192.168.1.2:35     210.125.35.110:35  210.125.35.110:35&#xA;icmp 172.16.2.1:36     192.168.1.2:36     210.125.35.110:36  210.125.35.110:36&#xA;icmp 172.16.2.1:37     192.168.1.2:37     210.125.35.110:37  210.125.35.110:37&#xA;icmp 172.16.2.1:38     192.168.1.2:38     210.125.35.110:38  210.125.35.110:38&#xA;icmp 172.16.2.1:39     192.168.1.2:39     210.125.35.110:39  210.125.35.110:39&#xA;icmp 172.16.2.1:40     192.168.1.2:40     210.125.35.110:40  210.125.35.110:40&#xA;icmp 172.16.2.1:41     192.168.1.2:41     210.125.35.110:41  210.125.35.110:41&#xA;icmp 172.16.2.1:42     192.168.1.2:42     210.125.35.110:42  210.125.35.110:42&#xA;icmp 172.16.2.1:43     192.168.1.2:43     210.125.35.110:43  210.125.35.110:43&#xA;icmp 172.16.2.1:44     192.168.1.2:44     210.125.35.110:44  210.125.35.110:44&#xA;icmp 172.16.2.1:45     192.168.1.2:45     210.125.35.110:45  210.125.35.110:45&#xA;icmp 172.16.2.1:46     192.168.1.2:46     210.125.35.110:46  210.125.35.110:46&#xA;icmp 172.16.2.1:47     192.168.1.2:47     210.125.35.110:47  210.125.35.110:47&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25515" LastEditorUserId="8499" LastEditDate="2018-12-23T06:19:56.897" LastActivityDate="2018-12-23T06:19:56.897" Title="NAT Translation IP usage" Tags="|cisco|routing|router|nat|packet-tracer|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30680" PostTypeId="2" ParentId="30679" CreationDate="2016-05-24T14:49:46.313" Score="2" Body="&lt;p&gt;You have a routing problem. If the CR router does not have a route to tell it to send the traffic destined for the &lt;code&gt;210.125.35.0&lt;/code&gt; network to the outside interface, it just drops it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic is only translated from the inside interface when it is going to an outside interface, but that traffic never makes it to the outside interface; the router doesn't know what to do with it, so it just drops it. This is expected behavior for a router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-24T14:49:46.313" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30681" PostTypeId="1" AcceptedAnswerId="30682" CreationDate="2016-05-24T15:49:08.103" Score="1" ViewCount="2062" Body="&lt;p&gt;I am trying to figure out if there is a way to ping from a Cisco IP Phone? Specifically a 7945G running SCCP45.9-4-2SR1-1S  ? I have successfully gained SSH access to the CLI of the phone, however I don't see a ping command? &lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2016-05-24T17:30:33.513" Title="How to Ping from a Cisco IP Phone 7945G?" Tags="|cisco|cisco-7900-ip-phones|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30682" PostTypeId="2" ParentId="30681" CreationDate="2016-05-24T17:30:33.513" Score="2" Body="&lt;p&gt;Per Cisco's documentation, they recommend you place a workstation in the same VLAN as the phone and use that for ping, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Determine if you can ping the Cisco CallManager server from a device on the same subnet as the nonfunctional phone. If you can ping the server, you have a minimum level of IP connectivity between the two devices. This allows you to see all the packets that the phone sends and receives during the boot and registration process.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-ip-phone-7900-series/5710-phone-reg.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-ip-phone-7900-series/5710-phone-reg.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2016-05-24T17:30:33.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30683" PostTypeId="2" ParentId="30674" CreationDate="2016-05-24T17:54:04.153" Score="2" Body="&lt;p&gt;It is typically the IP address tied to the physical interface, but not always.  JunOS from Juniper, for example, sends the Router-ID which can be a loopback and not tied to a physical address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source:&#xA;&lt;a href=&quot;https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB25145&amp;amp;actp=search&quot; rel=&quot;nofollow&quot;&gt;https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB25145&amp;amp;actp=search&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2016-05-24T17:54:04.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30684" PostTypeId="2" ParentId="30675" CreationDate="2016-05-24T18:08:57.197" Score="3" Body="&lt;p&gt;watch the logs for a day.  there will thousands of attempts to access your public servers on a bunch of well known ports.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But i would not be worried.  it happens all day and night.  people actually trying to 'hack' your network or just some school kid that got a hold of metasploit&lt;/p&gt;&#xA;" OwnerUserId="25621" LastActivityDate="2016-05-24T18:08:57.197" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30685" PostTypeId="2" ParentId="30672" CreationDate="2016-05-24T18:19:49.607" Score="3" Body="&lt;p&gt;What Ron said.  A wireless controller with lightweight access points.  The access points would provide the wireless connection where ever they are located, but the connection actually comes out at the wireless controller.  So you could roam from access point to access point and keep the same address, since the controller is connected to a network.  This is a from a guy that managed Cisco wireless networks with over 600 APs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i just dont see how the APs could pass a connection from one to another without knowing about each other and/or being connected to the same wireless controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;maybe this link will help you:&#xA;&lt;a href=&quot;https://help.ubnt.com/hc/en-us/articles/205144590-UniFi-What-is-Zero-Handoff-&quot; rel=&quot;nofollow&quot;&gt;https://help.ubnt.com/hc/en-us/articles/205144590-UniFi-What-is-Zero-Handoff-&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25621" LastActivityDate="2016-05-24T18:19:49.607" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30686" PostTypeId="2" ParentId="30563" CreationDate="2016-05-24T19:05:26.333" Score="2" Body="&lt;p&gt;Your issue with Chrome has been answered before:- &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://superuser.com/questions/966855/force-chrome-to-ignore-a-weak-ephemeral-diffie-hellman-public-key&quot;&gt;https://superuser.com/questions/966855/force-chrome-to-ignore-a-weak-ephemeral-diffie-hellman-public-key&lt;/a&gt;   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We had a similar situation where the serveradmin guys had to regenerate AND test the certificates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then test in your lab environment with your network devices to iron out any bugs. There are public documents available to assist and/or place a request with TaC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo-103-Implement_Cisco_ISE_Server_Side_Certificates.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/dam/en/us/td/docs/security/ise/how_to/HowTo-103-Implement_Cisco_ISE_Server_Side_Certificates.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2016-05-24T19:05:26.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30687" PostTypeId="2" ParentId="30672" CreationDate="2016-05-24T19:10:49.633" Score="0" Body="&lt;p&gt;Depending on how far apart the two buildings are, you could also potentially shorten the DHCP lease time to where it is impossible to get from one building to another without having your lease expire.  This would force the clients to ask for a new IP when they get to the other building.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2016-05-24T19:10:49.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30688" PostTypeId="2" ParentId="29901" CreationDate="2016-05-24T19:17:34.343" Score="1" Body="&lt;p&gt;What you need is a DNS server that does health checks.  There are both on-prem and hosted options available from multiple vendors.  These can serve up DNS responses based on (among other things):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting an HTTP 200 (OK) code from the servers&lt;br&gt;&#xA;Round robin&lt;br&gt;&#xA;Client count balancing&lt;br&gt;&#xA;Client physical location&lt;br&gt;&#xA;Server response time&lt;br&gt;&#xA;Ping&lt;br&gt;&#xA;Word matches on pages (more accurate than just the HTTP 200)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is basically PBR's cousin, I feel it is on-topic for this site.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2016-05-24T19:17:34.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30689" PostTypeId="2" ParentId="30642" CreationDate="2016-05-24T19:29:38.077" Score="0" Body="&lt;p&gt;I would recommend looking into how to implement QoS with your equipment so that the phone traffic has priority over the regular data traffic.  Once that is in place, there are a number of ways to pick an internet link.  One of the easiest is to find a reliable internet IP to ping (think Google/Level3 DNS server or something), set a static default route out one ISP based on the reachability of that DNS server, and a second static default route out your secondary ISP with a higher administrative distance.  This would make the first ISP primary and fail over to the second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other ways involve using some form of WAN load balancing.  There are a number of vendors who provide hardware (usually firewalls) that can take advantage of multiple ISPs.  These can often function in highly available pairs, so that you have two physical firewalls acting as one logical one, leaving your traffic available if one fails.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2016-05-24T19:29:38.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30690" PostTypeId="2" ParentId="30642" CreationDate="2016-05-24T20:02:42.003" Score="1" Body="&lt;p&gt;This should have been setup when the IP phones went in.  The switch(es) should have been upgraded to support POE+ and IP endpoints should be daisy-chained off of IP phones when possible to reduce the required number of switchports.  As for having a dedicated circuit for SIP/PSTN connectivity that is no problem simply configure the routing accordingly.  You do not want your phone system degraded in case of primary Internet circuit outage so in no case do you want to failover to your SIP/PSTN circuit.  You should get an additional 4g LTE card in your router to act as backup Internet.  Configure routing accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LAN (switches) can switch voice and data with no impact on the voice system.  The system may, however, be degraded in terms of outside calls if you failover Internet to your PSTN circtuit.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-24T20:02:42.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30691" PostTypeId="2" ParentId="29012" CreationDate="2016-05-24T20:46:19.347" Score="1" Body="&lt;p&gt;The abstraction model for an application using TCP is a stream of bytes. Bytes will be delivered to the receiving application in the same order they were sent by the sending application but often not in the same sized chunks. If an application wants to send messages over a TCP connection it will need to provide it's own message framing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a packet is lost and needs to be retransmitted or if the network reorders packets then the receiving TCP implementation will need to hold the data after the gap back until it can deliver the data to the receiving appliation in order.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-08-24T00:06:28.547" LastActivityDate="2016-08-24T00:06:28.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30692" PostTypeId="1" AcceptedAnswerId="30759" CreationDate="2016-05-25T00:56:20.760" Score="3" ViewCount="1352" Body="&lt;p&gt;I am looking for a common MIB that supports checking of crc errors, does this depend on hardware vendor and a custom MIB like CISCO?&lt;/p&gt;&#xA;" OwnerUserId="21360" LastEditorUserId="21360" LastEditDate="2016-05-25T13:14:19.263" LastActivityDate="2016-05-27T14:09:13.850" Title="Does snmp have a standard MIB for crc errors or is it HW dependent?" Tags="|ethernet|snmp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30694" PostTypeId="1" AcceptedAnswerId="30695" CreationDate="2016-05-25T02:50:52.657" Score="3" ViewCount="1012" Body="&lt;p&gt;In IPv6, we can collapse 0's when talking about addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IPv4, can I write 192.168.1.0/24 as 192.168.1/24? Can I write 10.0.0.0/8 as 10/8? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm working on some software that takes CIDR's as arguments and some of my customers have provided these &quot;short hand CIDRs&quot;. I want to know if they are valid or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="25629" LastEditorUserId="8499" LastEditDate="2019-01-12T20:21:54.597" LastActivityDate="2019-01-12T20:21:54.597" Title="Is it ok to leave the trailing 0's off in IPv4 CIDR notation?" Tags="|ip|ipv4|subnet|ip-address|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30695" PostTypeId="2" ParentId="30694" CreationDate="2016-05-25T03:03:48.483" Score="4" Body="&lt;p&gt;Collapsing IPv4 addresses like that is not a standard the way it is with IPv6. There are some applications which can take addresses like that, but you will find that most do not. It is fine, and recommended, to leave off the leading zeros in each IPv4 octet (some things will misread leading zeros to mean octal notation), but you shouldn't collapse octets.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-25T03:03:48.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30696" PostTypeId="2" ParentId="30694" CreationDate="2016-05-25T03:16:57.433" Score="2" Body="&lt;p&gt;While it may be acceptable to write or speak that way, very few systems will accept an address entered that way. Ultimately, no engineer will enter an address like that, so there's little point coding your software to accept it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(for example, what does 10.1/8 mean? In CIDR, it's nonsense. In a classful system, that would be network == 10, host == 1, or 10.0.0.1.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-25T03:16:57.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30697" PostTypeId="1" AcceptedAnswerId="30698" CreationDate="2016-05-25T06:03:19.383" Score="1" ViewCount="935" Body="&lt;p&gt;The cable in this image:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aEEwN.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aEEwN.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is 75ft and is for my ISP. I'd like to replace it with one that is 2,000ft and run it buried outside to give internet connectivity to another building on my property. I've figured out that it is a SC/APC connector, but I have some other questions on which I'd really appreciate some insight:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Do I want single or multi-mode?   &lt;/li&gt;&#xA;&lt;li&gt;Does anyone know of another place&#xA;to buy a 2,000ft SC connector fiber cable other than a custom built&#xA;one at &lt;a href=&quot;https://buy.customcable.com/fiberConfigurator/index.cfm?AssemblyType=jumper&amp;amp;rnd=20160525014308&quot; rel=&quot;nofollow noreferrer&quot;&gt;Custom Cable&lt;/a&gt;?  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="25633" LastEditorUserId="8499" LastEditDate="2016-05-26T00:51:59.503" LastActivityDate="2016-05-26T00:51:59.503" Title="Looking to Extend Fiber Network" Tags="|fiber|cabling|cable|layer1|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30698" PostTypeId="2" ParentId="30697" CreationDate="2016-05-25T06:37:38.607" Score="2" Body="&lt;p&gt;First off, you need two of those at each end, one for each direction. Second, it looks more like SC/PC to me, not SC/APC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to just plug in your replacement cable, then you don't have a choice, because the equipment optics determines multi-mode or single mode, in other words it's not just the cable's physical connector that has to fit where you plug it in, but the fiber's mode also has to correspond to the mode of the optical equipment that you're plugging it in to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multi-mode is cheaper (never wondered if it's the fiber or the optics, probably both). For multi-mode the best you'll do over 2000 ft is 100 Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful, because if this cable plugs in to some equipment that your ISP installed in your building, it is probably NOT active optical equipment, but just a patch into another cable that runs to the ISP's optical equipment in a network room somewhere in your neighborhood. Extending the cable may not be supported by your ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of extending the ISP fiber, you may want to investigate the possibility of leaving your ISP installation as it is, and running cables between your buildings that plug in to your internal network.&lt;/p&gt;&#xA;" OwnerUserId="22874" LastActivityDate="2016-05-25T06:37:38.607" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30699" PostTypeId="2" ParentId="30697" CreationDate="2016-05-25T08:00:23.753" Score="1" Body="&lt;p&gt;Yes, I totally agree with Law29. It seems that you are only changing the length of the cable, so actually you do not need to determine whether you need multi-mode or single-mode fiber cable. The mode of the fiber has to correspond to the mode of the optical equipment that you're plugging it in to. In other words, you still have to use the same mode cable as you used before.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-05-25T08:00:23.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30701" PostTypeId="1" CreationDate="2016-05-25T09:50:39.930" Score="1" ViewCount="681" Body="&lt;p&gt;i accidentally formatted my client cisco catalyst 3560 v2 24 ps. Now no firmware inside. Lucky i got another same switch for standby. my question here, how to backup firmware from standby switch to my client switch? im new in this field.perhaps any 1 can give instruction to help...btw, the firmware is flash:/c3560-ipbasek9-mz.122-58.SE2/c3560-ipbasek9-mz.122-58.SE2.bin. ty&lt;/p&gt;&#xA;" OwnerUserId="25641" LastActivityDate="2016-05-25T10:48:13.237" Title="how to extract ios firmware from catalyst 3560 v2" Tags="|cisco-catalyst|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30704" PostTypeId="2" ParentId="30701" CreationDate="2016-05-25T10:48:13.237" Score="2" Body="&lt;p&gt;Source Healthy Switch : A&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Destination Unhealthy Switch : B&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the A switch;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A(config)#tftp-server flash:/c3560-ipbasek9-mz.122-58.SE2/c3560-ipbasek9-mz.122-58.SE2.bin&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;On the B Switch ;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enter the Rommon (Hint: Ctrl + Brk)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;rommon 1&gt; set&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;rommon 2&gt; IP_ADDRESS=192.168.X.X    (B Switch IP address Temporary)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;rommon 3&gt; IP_SUBNET_MASK=X.X.X.X    (B Switch Mask)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;rommon 4&gt; DEFAULT_GATEWAY=X.X.X.X   (Default Gateway IP)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;rommon 5&gt; TFTP_SERVER=X.X.X.X       (A Switch IP address)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;rommon 6&gt; TFTP_FILE=c3560-ipbasek9-mz.122-58.SE2.bin&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;rommon 7&gt; tftpdnld&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Invoke this command for disaster recovery only.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;WARNING: all existing data in all partitions on flash will be lost! Do you wish to continue?&#xA;  y/n:  [n]:  &lt;strong&gt;y&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;rommon 8&gt; reset&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="25644" LastActivityDate="2016-05-25T10:48:13.237" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30705" PostTypeId="1" CreationDate="2016-05-25T12:19:48.567" Score="0" ViewCount="489" Body="&lt;p&gt;I am trying to get a subnet of 32 networks from 172.26.16.0/19&#xA;will it give the range from 172.26.16.0  till 172.26.47.0 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everytime that I am using the websites for subnet calculator for 172.26.16.0/19 ,it will give the range starting from 172.26.0.0 till 172.26.31.0 and the issue is that from .0 till .15 range is already used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks for your supports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;Ethem &lt;/p&gt;&#xA;" OwnerUserId="23982" LastActivityDate="2016-05-27T11:25:25.073" Title="Subnetting Using VLSM" Tags="|vlan|" AnswerCount="2" CommentCount="3" ClosedDate="2017-02-13T17:46:19.977" ContentLicense="CC BY-SA 3.0" />
  <row Id="30706" PostTypeId="1" CreationDate="2016-05-25T12:26:16.357" Score="2" ViewCount="642" Body="&lt;p&gt;I have those 3 Interfaces configured:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address PUBLICIP 255.255.255.240 &#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.0.0.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/3&#xA; no nameif&#xA; security-level 100&#xA; ip address 172.200.0.1 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/3.99&#xA; vlan 99&#xA; nameif servers&#xA; security-level 100&#xA; ip address 172.16.18.1 255.255.255.0                                                                                                 &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;also I have a default route&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;route outside 0.0.0.0 0.0.0.0 ISP_GATEWAY 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and these NAT Rules&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside,servers) source static any any&#xA;nat (inside,outside) source static any interface unidirectional description Internetaccess&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;also&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;enable traffic between two or more interfaces which are configured with same security levels&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;enable traffic between two or more hosts connected to the same interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;activated.&lt;/p&gt;&#xA;&lt;p&gt;I am able to go on the internet with the &amp;quot;inside&amp;quot; network. But I can't ping the Gateway 172.16.18.1. Also, i have a client on Interface 3 connected with the ip 172.16.18.168/24 with the gateway 172.16.18.1. This client is alsp not able to ping 172.16.18.1.&lt;/p&gt;&#xA;&lt;p&gt;In ASDM, I'm able to ping the Gateway from the servers interface. What am I missing? I read &lt;a href=&quot;http://blog.braini.ac/?p=38&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; that i have to configure for every VLAN I have, a NAT-Statement. Is this true? Because I need 10 VLANs.&lt;/p&gt;&#xA;&lt;p&gt;I can't figure out what I'm missing. When I do Packet tracer in ASDM no ACL seems to block it.&lt;/p&gt;&#xA;&lt;p&gt;PS: the two clients are directly connected to the ports.&#xA;PS:PS: I am configuring 80% over ASDM and 20% over CLI (the way I learned in school).&lt;/p&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-11-28T23:02:25.420" Title="ASA 5512-X Can't access VLAN Gateway" Tags="|cisco|routing|vlan|cisco-asa|nat|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="30711" PostTypeId="2" ParentId="30697" CreationDate="2016-05-25T14:53:52.807" Score="2" Body="&lt;p&gt;This is something you really want to hire a cable vendor to do. Outside Plant (OSP) cabling is a specialty, and there are things you must do for safety (legal requirements), and things you must do to make sure the cable will not fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, outside cable is not allowed to extend more than 50' inside a building, you must bury it at least 24&quot;, or below the frost line, whichever is greater. Direct buried cable needs to be armored, loose-tube, and probably gel-filled. There is also grounding, bonding, and lightning protection that must be carefully done because the armor will be metallic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not something for amateurs, and the cable vendor will run bulk cable and terminate it to a cable patch panel with the appropriate type of connector.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-25T14:53:52.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30713" PostTypeId="1" CreationDate="2016-05-25T15:05:35.297" Score="1" ViewCount="304" Body="&lt;p&gt;In secureCRT SWC's console ping PCA in &lt;strong&gt;rstp demo&lt;/strong&gt; in the pic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a loop Topology and on each switch I set stp mode rstp and every ports are bind default &lt;strong&gt;vlan1&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I open the switchC's loopback 0 and my console can ping success&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But can't ping to pcA . (I have close the pc firewall)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Waiting for your good answer.Thank you!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;the topology&lt;/strong&gt;:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/NtNgg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NtNgg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;strong&gt;SWA&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;dis stp root&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mstid: 0,root bridge id:32768.70ba-ef6e-356a,extpathcost: 20,intpathcost:0&#xA;root port: g1/0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;dis stp brief&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;port g1/0/23,role designate,stp state forwarding.&#xA;port g1/0/24,role root,stp state forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SWB&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;dis stp root&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mstid: 0,root bridge id:32768.70ba-ef6e-356a,extpathcost: 20,intpathcost:0&#xA;root port: g1/0/23.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;dis stp brief&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;port g1/0/1,role designate,stp state forwarding.&#xA;port g1/0/22,role alte,stp state discarding.&#xA;port g1/0/23,role root,stp state forwarding.&#xA;port g1/0/24,role alternate,stp state discarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SWC(root bridge)&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;dis stp root&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mstid: 0,root bridge id:32768.70ba-ef6e-356a,extpathcost: 0,intpathcost:0&#xA;root port: null.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;dis stp brief&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;port g1/0/22,role designate,stp state forwarding.&#xA;port g1/0/23,role designate,stp state forwarding.&#xA;port g1/0/24,role designate,stp state forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SWD&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;dis stp root&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mstid: 0,root bridge id:32768.70ba-ef6e-356a,extpathcost: 20,intpathcost:0&#xA;root port: g1/0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;dis stp brief&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;port g1/0/23,role designate,stp state forwarding.&#xA;port g1/0/24,role root,stp state forwarding.&lt;/p&gt;&#xA;" OwnerUserId="24614" LastEditorUserId="24614" LastEditDate="2016-05-26T09:11:12.453" LastActivityDate="2017-01-23T05:04:13.203" Title="how ping a PC by another switch's console use secureCRT in rstp" Tags="|ieee-802.1w|" AnswerCount="1" CommentCount="9" ClosedDate="2017-01-23T14:20:13.393" ContentLicense="CC BY-SA 3.0" />
  <row Id="30714" PostTypeId="1" CreationDate="2016-05-25T15:11:48.493" Score="1" ViewCount="692" Body="&lt;p&gt;I have a server HP DL180 G6, connected to a Cisco switch (4948E or 2960).&#xA;The server have 2 ethernet ports and ILO shared with data port #1.&#xA;ILO setted up to request ip from DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) When I connect a notebook with Wireshark directly to port #1, I receive packets from two MAC addresses: Data Port and ILO Port, both sending dhcp requests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) When I connect a server to Switch (tested on both 4948E and 2960) and setup a SPAN monitor (mirror traffic to another port with the notebook with Wireshark) I see ONLY packets from Data port. There are NO packets from ILO port.&#xA;And there is no ILO's MAC in the Switch's CAM table too.&#xA;As a result, ILO can't get an IP from DHCP. And even when I configure a static IP for ILO - it doesn't reachable for network and NO MAC in CAM: Nobody know about ILO, even Switch. And yes, I tried to ping static ip of ILO with timeoud as result (no answer)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So the question why can it be?&#xA;Why packets disappearing without any error?&#xA;And how to get work ILO?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can somebody help with this situation please?&#xA;I mostly want to understand, why can it be.&#xA;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Further a detailed information about environment and Wireshark dumps:&lt;/strong&gt;&#xA;All devices in 1 subnet: 192.168.0.0/24&#xA;All devices in VLAN 1 (ports on switch)&#xA;DHCP server locates in subnet 172.16.0.0/24 and reachable from server (windows)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Catalyst 2960 (for example) ports config (all other config is default, after reset!):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/40&#xA;description here connected HP server's port #1 shared with ILO&#xA; switchport mode access&#xA; speed 1000&#xA; duplex full&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/41&#xA;description to notebook with Wireshark&#xA;!&#xA;monitor session 1 source interface Gi1/0/40&#xA;monitor session 1 destination interface Gi1/0/41 encapsulation replicate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Port Gi1/0/40 statistics:&lt;/strong&gt;&#xA;C2960S-48-F01#sh int gi1/0/40 controller&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GigabitEthernet1/0/40 is down, line protocol is down (notconnect)&#xA;  Hardware is Gigabit Ethernet, address is 20bb.c099.8a28 (bia 20bb.c099.8a28)&#xA;  MTU 1500 bytes, BW 100000 Kbit, DLY 100 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output 00:17:22, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     2668 packets input, 475459 bytes, 0 no buffer&#xA;     Received 2634 broadcasts (1073 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 1073 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     86283 packets output, 85216496 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 6 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 PAUSE output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&#xA;     Transmit GigabitEthernet1/0/40           Receive&#xA;     85216496 Bytes                           475459 Bytes&#xA;         1840 Unicast frames                      34 Unicast frames&#xA;        79351 Multicast frames                  1073 Multicast frames&#xA;         5092 Broadcast frames                  1561 Broadcast frames&#xA;            0 Too old frames                    5136 Unicast bytes&#xA;            0 Deferred frames                 143180 Multicast bytes&#xA;            0 MTU exceeded frames             326059 Broadcast bytes&#xA;            0 1 collision frames                   0 Alignment errors&#xA;            0 2 collision frames                   0 FCS errors&#xA;            0 3 collision frames                   0 Oversize frames&#xA;            0 4 collision frames                   0 Undersize frames&#xA;            0 5 collision frames                   0 Collision fragments&#xA;            0 6 collision frames&#xA;            0 7 collision frames                 337 Minimum size frames&#xA;            0 8 collision frames                1202 65 to 127 byte frames&#xA;            0 9 collision frames                 425 128 to 255 byte frames&#xA;            0 10 collision frames                656 256 to 511 byte frames&#xA;            0 11 collision frames                 47 512 to 1023 byte frames&#xA;            0 12 collision frames                  1 1024 to 1518 byte frames&#xA;            0 13 collision frames                  0 Overrun frames&#xA;            0 14 collision frames                  0 Pause frames&#xA;            0 15 collision frames&#xA;            0 Excessive collisions                 0 Symbol error frames&#xA;            0 Late collisions                      0 Invalid frames, too large&#xA;            0 VLAN discard frames                  0 Valid frames, too large&#xA;            0 Excess defer frames                  0 Invalid frames, too small&#xA;        10480 64 byte frames                       0 Valid frames, too small&#xA;        11860 127 byte frames&#xA;          502 255 byte frames                      0 Too old frames&#xA;         3276 511 byte frames                      0 Valid oversize frames&#xA;           19 1023 byte frames                     0 System FCS error frames&#xA;        60146 1518 byte frames                     0 RxPortFifoFull drop frame&#xA;            0 Too large frames&#xA;            0 Good (1 coll) frames&#xA;            0 Good (&amp;gt;1 coll) frames&#xA;&#xA;&#xA;C2960S-48-F01#sh int gi1/0/40 counters errors&#xA;&#xA;Port        Align-Err     FCS-Err    Xmit-Err     Rcv-Err  UnderSize  OutDiscards&#xA;Gi1/0/40            0           0           0           0          0            0&#xA;&#xA;Port      Single-Col  Multi-Col   Late-Col  Excess-Col  Carri-Sen      Runts     Giants&#xA;Gi1/0/40           0          0          0           0          0          0          0&#xA;&#xA;C2960S-48-F01#sh int gi1/0/40 counters protocol status&#xA;Protocols allocated:&#xA; GigabitEthernet1/0/40: Other, IP, Spanning Tree, CDP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Wireshark dumps from situation #1 (when server directly connected to notebook):&lt;/strong&gt;&#xA;Here is a frame from ILO (ILO own this MAC address)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Frame 11: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits) on interface 0&#xA;    Interface id: 0 (\Device\NPF_{35063BE1-6696-40E5-918D-69EF24F97E65})&#xA;    Encapsulation type: Ethernet (1)&#xA;    Arrival Time: May 25, 2016 16:12:03.817712000 RTZ 2 (����)&#xA;    [Time shift for this packet: 0.000000000 seconds]&#xA;    Epoch Time: 1464181923.817712000 seconds&#xA;    [Time delta from previous captured frame: 0.315021000 seconds]&#xA;    [Time delta from previous displayed frame: 0.000000000 seconds]&#xA;    [Time since reference or first frame: 1.358059000 seconds]&#xA;    Frame Number: 11&#xA;    Frame Length: 342 bytes (2736 bits)&#xA;    Capture Length: 342 bytes (2736 bits)&#xA;    [Frame is marked: False]&#xA;    [Frame is ignored: False]&#xA;    [Protocols in frame: eth:ethertype:ip:udp:bootp]&#xA;    [Coloring Rule Name: UDP]&#xA;    [Coloring Rule String: udp]&#xA;Ethernet II, Src: HewlettP_de:c0:50 (d8:d3:85:de:c0:50), Dst: Broadcast (ff:ff:ff:ff:ff:ff)&#xA;    Destination: Broadcast (ff:ff:ff:ff:ff:ff)&#xA;    Source: HewlettP_de:c0:50 (d8:d3:85:de:c0:50)&#xA;    Type: IPv4 (0x0800)&#xA;Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255&#xA;User Datagram Protocol, Src Port: 68 (68), Dst Port: 67 (67)&#xA;Bootstrap Protocol (Discover)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Wireshark dumps from situation #2 (when server connected to switch):&lt;/strong&gt;&#xA;Here is a frame from Data port (Port #1 own this MAC address)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Frame 78: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits) on interface 0&#xA;    Interface id: 0 (\Device\NPF_{35063BE1-6696-40E5-918D-69EF24F97E65})&#xA;    Encapsulation type: Ethernet (1)&#xA;    Arrival Time: May 25, 2016 12:58:20.776904000 RTZ 2 (����)&#xA;    [Time shift for this packet: 0.000000000 seconds]&#xA;    Epoch Time: 1464170300.776904000 seconds&#xA;    [Time delta from previous captured frame: 0.005327000 seconds]&#xA;    [Time delta from previous displayed frame: 0.000000000 seconds]&#xA;    [Time since reference or first frame: 10.956572000 seconds]&#xA;    Frame Number: 78&#xA;    Frame Length: 342 bytes (2736 bits)&#xA;    Capture Length: 342 bytes (2736 bits)&#xA;    [Frame is marked: False]&#xA;    [Frame is ignored: False]&#xA;    [Protocols in frame: eth:ethertype:ip:udp:bootp]&#xA;    [Coloring Rule Name: UDP]&#xA;    [Coloring Rule String: udp]&#xA;Ethernet II, Src: HewlettP_dd:60:9e (d8:d3:85:dd:60:9e), Dst: Broadcast (ff:ff:ff:ff:ff:ff)&#xA;    Destination: Broadcast (ff:ff:ff:ff:ff:ff)&#xA;    Source: HewlettP_dd:60:9e (d8:d3:85:dd:60:9e)&#xA;    Type: IPv4 (0x0800)&#xA;Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255&#xA;User Datagram Protocol, Src Port: 68 (68), Dst Port: 67 (67)&#xA;Bootstrap Protocol (Discover)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch's CAM table:&lt;/strong&gt;&#xA;C2960S-48-F01#sh mac address-table interface gigabitEthernet 1/0/40&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;          Mac Address Table&#xA;-------------------------------------------&#xA;&#xA;Vlan    Mac Address         Type        Ports&#xA;----    -----------         --------    -----&#xA; 1      d8:d3:85:dd:60:9e   DYNAMIC     Gi1/0/40&#xA;Total Mac Addresses for this criterion: 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19701" LastEditorUserId="2142" LastEditDate="2016-05-25T15:19:30.210" LastActivityDate="2016-05-25T15:19:30.210" Title="Packets are disappearing" Tags="|cisco|cisco-ios|cisco-catalyst|hp|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="30717" PostTypeId="1" AcceptedAnswerId="30726" CreationDate="2016-05-25T17:47:40.337" Score="0" ViewCount="990" Body="&lt;p&gt;I am looking for a specific networking feature or set of features that was used on another project that I previously worked on. (I don't know my POC for that project otherwise I would ask them.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the previous project we had one switch with a dozen or so computers plugged into it. We had at least 3 VLANs configured on the switch. I managed all the devices on one of the VLANs. I was given a block of static IPs. Some of the IP address were mapped to another device that was on a different VLAN. And that device existed on it's own VLAN with a different IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used that IP local to my VLAN to communicate with another computer on a different VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a Cisco switch, what would that feature be called?&lt;/p&gt;&#xA;" OwnerUserId="25659" LastActivityDate="2016-05-26T07:42:01.343" Title="IP address mapping between VLANs" Tags="|cisco|routing|vlan|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30719" PostTypeId="2" ParentId="30717" CreationDate="2016-05-25T19:05:35.070" Score="0" Body="&lt;p&gt;The keyword you need to search for is &lt;code&gt;Router on a Stick&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to communicate between vlans you need a Router which is connected to switch with trunk port. &lt;/p&gt;&#xA;" OwnerUserId="25644" LastActivityDate="2016-05-25T19:05:35.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30721" PostTypeId="1" CreationDate="2016-05-25T21:49:01.463" Score="8" ViewCount="717" Body="&lt;h2&gt;The Scenario in Brief&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Three types of devices can exist on our wireless networks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;AD joined, corporate owned (Windows PC/Laptop/Surface)&lt;/li&gt;&#xA;&lt;li&gt;Non-AD Joined, corporate owned (iPad/Chromebook and their flavors)&lt;/li&gt;&#xA;&lt;li&gt;Non-Corporate Owned, non-AD Joined (BYOD)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The third device (BYOD) will always exist only on a Guest network managed by PRIME and never talk with ISE other than to be denied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first device (Windows AD) will be domain joined and have Group Policy applying wi-fi configurations based on Device and user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second device are easy enough to manage with MDM solutions and Google's own For Work admin center.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;My Question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;We are deploying over 2000 units of the second type (ipad and chromebook) and have a hiccup in our deployment routine to date. We have been running an MDM export of the MAC and import into ISE, but this feels clunky and very manual. Our current setup has an Identity Endpoint group Static assignment for these devices. The process is attaching the device to a less-secure, internet only Access Point then waiting for the network support to export/import MACs slows the process down - especially when the export misses a few units (because why not in the networking world, right?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm getting mixed information from some documentation and user experiences around Onboarding, BYOD, Identity Group assignments and policies, etc. I'm fine with &quot;it can't be done, move along&quot; and we are looking at Certificates but the VAR who set ISE up was never scoped for Certificate. We have the staff in house to set it up, just not the time. Is anything we can do temporarily (to get through this summer) to expedite getting these devices authorized in ISE via a Static Group Assignment automatically (or automagically).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the ideas I was curious about is whether we can enable a policy that says devices connecting to SSID &quot;xyz&quot; with AD User &quot;adm&quot; get group assignment &quot;devType2&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts you may have are greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="25664" LastEditorUserId="775" LastEditDate="2016-05-26T13:47:17.003" LastActivityDate="2016-05-26T13:47:17.003" Title="CISCO ISE Identity Management Group assignment" Tags="|cisco|ieee-802.11|mobile|cisco-ise|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30722" PostTypeId="2" ParentId="30717" CreationDate="2016-05-26T02:39:03.307" Score="1" Body="&lt;p&gt;On a Cisco Layer 3 switch (also known as a multilayer switch), the term is inter-vlan routing. As Tolga pointed out, if you're talking about a router it's called Rotuer on a Stick.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although two different terms are used, they do exactly the same thing but they're done on different devices (switches and routers) and are connected in slightly different ways.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-05-26T02:39:03.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30723" PostTypeId="1" AcceptedAnswerId="30734" CreationDate="2016-05-26T04:42:37.220" Score="2" ViewCount="5496" Body="&lt;p&gt;Looking at this article &lt;a href=&quot;https://www.techopedia.com/definition/6062/attenuation&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; by Techopedia, The writer notes that the higher the frequency of a signal in copper cabling, the higher the attenuation across the cable. Why is this the case?&lt;/p&gt;&#xA;" OwnerUserId="24256" LastEditorUserId="8499" LastEditDate="2018-03-21T00:42:40.103" LastActivityDate="2018-03-21T00:42:40.103" Title="Why does a copper cable with higher frequency signals attract more attenuation?" Tags="|layer1|cabling|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30725" PostTypeId="2" ParentId="30723" CreationDate="2016-05-26T07:23:35.227" Score="3" Body="&lt;p&gt;Twisted-pair copper wire systems attenuate electrical signals due to factors including the interaction of the signal with the copper in the conductors as the described by the level of resistance or impedance in the wire, and the tendency of the signal to radiate, or spread out, from the wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attenuation is sensitive to carrier frequency. Higher-frequency signals generally attenuate more than lower-frequency signals. The phenomenon is not unique to copper cable, but also generally holds true in fiber optic systems, as well, although the measurement is in wavelengths, rather than frequencies, i.e., longer wavelength signals (lower frequency) signals attenuate less than shorter wavelength (higher frequency) signals.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-05-26T07:23:35.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30726" PostTypeId="2" ParentId="30717" CreationDate="2016-05-26T07:42:01.343" Score="1" Body="&lt;p&gt;Traffic between VLAN ALWAYS must be routed - it's called &lt;strong&gt;InterVlan Routing&lt;/strong&gt;.&#xA;InterVlan Routing can be achieved by using a Router, or a Layer 3 Switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, here are manuals by cisco with diagrams, all easy and graphically:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;here is manual about configuring InterVLAN Routing on a Catalyst Switch Using an External Router:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/14976-50.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/14976-50.html&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;here is manual how to configure InterVLAN Routing on L3 switch Cisco:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41860-howto-L3-intervlanrouting.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41860-howto-L3-intervlanrouting.html&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Feel free to ask details.&#xA;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="19701" LastActivityDate="2016-05-26T07:42:01.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30728" PostTypeId="1" AcceptedAnswerId="30735" CreationDate="2016-05-26T08:40:46.413" Score="1" ViewCount="54" Body="&lt;p&gt;working on a project where im making a firm, I need to get everything IT related ready for the firm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the office of the firm there are two employers, even if the firm expands that amount wont get much bigger. the firm doesnt have a server they only have one router and two pc's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when i buy broadband from a company, do i just tell them what IP i want and how many?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and how do i figure out what ip to use when i only need a max of 10 ip's?&lt;/p&gt;&#xA;" OwnerUserId="23719" LastActivityDate="2016-05-26T13:58:33.347" Title="how do I get the ip from the distributor?" Tags="|ip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30729" PostTypeId="1" CreationDate="2016-05-26T08:55:51.127" Score="1" ViewCount="3446" Body="&lt;p&gt;I have aironet-1242 and air-cap2600i AP's, infact I'm trying to upload image on to my PC through TFTP, as I assign static IP address to fastethernet or BVI interfaces and start uploading, AP connectivity gets drop and AP reverted back to DHCP, find this message &quot;Could not discover WLC using static IP. Forcing AP to use DHCP&quot; now issue is when I do &quot;show ip int brief fa0/BVI1 &quot; I get this &#xA;Interface                  IP-Address      OK? Method Status                Prot                                                                                        ocol&#xA;FastEthernet0              unassigned      YES DHCP   up                    up&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please give me the solution, how can i get DHCP assigned address, I will be very thankful.&lt;/p&gt;&#xA;" OwnerUserId="25671" LastEditorUserId="8499" LastEditDate="2018-03-19T18:36:51.707" LastActivityDate="2018-03-19T18:36:51.707" Title="AP does not have assigned IP address by DHCP" Tags="|cisco|cisco-ios|dhcp|ip-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30731" PostTypeId="2" ParentId="30729" CreationDate="2016-05-26T09:18:37.233" Score="1" Body="&lt;p&gt;Your access point are the controller based version, I.E. lightweight, that means they are supposed to connect to a Wireless Lan Controller (&quot;WLC&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At startup the access points get an IP from DHCP then try (by several methods) to join a WLC. When they fell to do so, they reset their network interface and try again until they succeed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot use such AP (with this software) without a WLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They can be converted to autonomous (standalone) mode by uploading another software into the AP. The easiest way to do so is... ...from a WLC, and it requires that you do have the software available (trough a Cisco support contract).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such AP have in their product name either &quot;L&quot; (for &quot;LightWeight&quot;) or a &quot;C&quot; (for &quot;CAPWAP based&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A standalone AP (without L or C in the name) may have been converted to lightweight mode. In this case the original software may still be present in flash, and you can reconfigure the AP to boot from the original software rather than the lightweight one.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-05-26T09:18:37.233" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30733" PostTypeId="1" CreationDate="2016-05-26T11:01:36.660" Score="2" ViewCount="3304" Body="&lt;p&gt;I recently ran across an issue where the storm-control that was configured on my port-channel interfaces caused the physical interfaces to go into a suspended state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware: 3 stacked 3850 (IOS XE release 3.7.3E) access switches connecting to a Juniper legacy core and a new 6807-XL core&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface/EtherChannel configuration:&#xA;&#xA;    interface GigabitEthernet1/1/1&#xA;     description Uplink to 6807&#xA;     switchport trunk native vlan 2248&#xA;     switchport trunk allowed vlan 2106,2248,2510&#xA;     switchport mode trunk&#xA;     load-interval 30&#xA;     auto qos trust &#xA;     channel-protocol lacp&#xA;     channel-group 1 mode active&#xA;     service-policy input AutoQos-4.0-Trust-Cos-Input-Policy&#xA;     service-policy output AutoQos-4.0-Output-Policy&#xA;    end&#xA;&#xA;    interface GigabitEthernet2/1/1&#xA;     description Uplink to 6807&#xA;     switchport trunk native vlan 2248&#xA;     switchport trunk allowed vlan 2106,2248,2510&#xA;     switchport mode trunk&#xA;     load-interval 30&#xA;     auto qos trust &#xA;     channel-protocol lacp&#xA;     channel-group 1 mode active&#xA;     service-policy input AutoQos-4.0-Trust-Cos-Input-Policy&#xA;     service-policy output AutoQos-4.0-Output-Policy&#xA;    end&#xA;&#xA;    interface Port-channel1&#xA;     description Uplink to 6807&#xA;     switchport trunk native vlan 2248&#xA;     switchport trunk allowed vlan 2106,2248,2510&#xA;     switchport mode trunk&#xA;     logging event trunk-status&#xA;     storm-control broadcast level 50.00&#xA;     storm-control multicast level 50.00&#xA;     storm-control unicast level 50.00&#xA;    end&#xA;&#xA;and&#xA;&#xA;    interface GigabitEthernet1/1/2&#xA;     description Legacy Network&#xA;     switchport trunk allowed vlan 12,30,50,111&#xA;     switchport mode trunk&#xA;     load-interval 30&#xA;     auto qos trust &#xA;     no cdp enable&#xA;     channel-protocol lacp&#xA;     channel-group 2 mode active&#xA;     service-policy input AutoQos-4.0-Trust-Cos-Input-Policy&#xA;     service-policy output AutoQos-4.0-Output-Policy&#xA;    end&#xA;&#xA;    interface GigabitEthernet2/1/2&#xA;     description Legacy Network&#xA;     switchport trunk allowed vlan 12,30,50,111&#xA;     switchport mode trunk&#xA;     load-interval 30&#xA;     auto qos trust &#xA;     no cdp enable&#xA;     channel-protocol lacp&#xA;     channel-group 2 mode active&#xA;     service-policy input AutoQos-4.0-Trust-Cos-Input-Policy&#xA;     service-policy output AutoQos-4.0-Output-Policy&#xA;    end&#xA;&#xA;    interface Port-channel2&#xA;     description Legacy Network&#xA;     switchport trunk allowed vlan 12,30,50,111&#xA;     switchport mode trunk&#xA;     logging event trunk-status&#xA;     storm-control broadcast level 50.00&#xA;     storm-control multicast level 50.00&#xA;     storm-control unicast level 50.00&#xA;    end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show etherchannel detail&lt;/code&gt; revealed that storm-control (broadcast suppression) was the issue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                Channel-group listing: &#xA;                ----------------------&#xA;&#xA;Group: 1 &#xA;----------&#xA;Group state = L2 &#xA;Ports: 2   Maxports = 16&#xA;Port-channels: 1 Max Port-channels = 16&#xA;Protocol:   LACP&#xA;Minimum Links: 0&#xA;&#xA;                Ports in the group:&#xA;                -------------------&#xA;Port: Gi1/1/1&#xA;------------&#xA;&#xA;Port state    = Up Cnt-bndl Suspend Not-in-Bndl &#xA;Channel group = 1           Mode = Active          Gcchange = -&#xA;Port-channel  = null        GC   =   -             Pseudo port-channel = Po1&#xA;Port index    = 0           Load = 0x00            Protocol =   LACP&#xA;&#xA;Flags:  S - Device is sending Slow LACPDUs   F - Device is sending fast LACPDUs.&#xA;        A - Device is in active mode.        P - Device is in passive mode.&#xA;&#xA;Local information:&#xA;                            LACP port     Admin     Oper    Port        Port&#xA;Port      Flags   State     Priority      Key       Key     Number      State&#xA;Gi1/1/1   SA      susp      32768         0x1       0x0     0x132       0x45  &#xA;&#xA;Age of the port in the current state: 0d:00h:10m:48s&#xA;&#xA;Probable reason: Broadcast suppression: Level of Gi1/1/1 is not configured. Level of Po1 is &#xA;50.00%, 50.00%.&#xA;&#xA;&amp;lt;output omitted&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I ended up removing storm-control on both port-channels because I was working in a limited window of time (cutover) and the link lights turned green and started passing traffic. I haven't been able to find much about this regarding why the interfaces went into a suspended state, as this is not the default behavior of storm-control or etherchannel (to my knowledge).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, interfaces Gi2/1/1 (to 6807) and Gi2/1/2 (to legacy) were not connected because not enough fiber was ran to accommodate this, but it is anticipated to happen in the future. So, I'm not sure if that has something to do with it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Gi1/1/1 is part of Port-channel1 to the 6807 core&lt;/li&gt;&#xA;&lt;li&gt;Gi1/1/2 is part of Port-channel2 to the legacy core&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;show etherchannel summary&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#show etherchannel summary&#xA;&#xA;&amp;lt;output omitted&amp;gt;&#xA;&#xA;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+-----------------------------------------------&#xA;1      Po1(SU)         LACP      Gi1/1/1(P)  Gi2/1/1(D)  &#xA;2      Po2(SU)         LACP      Gi1/1/2(P)  Gi2/1/2(D)  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any insight as to why Gi1/1/1 and Gi1/1/2 were in a suspended state because of storm-control would be appreciated. Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="25670" LastEditorUserId="8499" LastEditDate="2016-05-26T14:15:39.423" LastActivityDate="2016-06-25T19:00:15.030" Title="Cisco: Storm-control configuration put interface in port-channel in suspended state" Tags="|cisco|switch|security|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30734" PostTypeId="2" ParentId="30723" CreationDate="2016-05-26T13:21:10.870" Score="4" Body="&lt;p&gt;One of the main reasons is &lt;a href=&quot;https://en.wikipedia.org/wiki/Skin_effect&quot; rel=&quot;nofollow&quot;&gt;skin effect&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Skin effect is the tendency of an alternating electric current (AC) to&#xA;  become distributed within a conductor such that the current density is&#xA;  largest near the surface of the conductor, and decreases with greater&#xA;  depths in the conductor. The electric current flows mainly at the&#xA;  &quot;skin&quot; of the conductor, between the outer surface and a level called&#xA;  the skin depth. The skin effect causes the effective resistance of the&#xA;  conductor to increase at higher frequencies where the skin depth is&#xA;  smaller, thus reducing the effective cross-section of the conductor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Litz_wire&quot; rel=&quot;nofollow&quot;&gt;Litz wire&lt;/a&gt; was designed to minimize the effects.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-26T13:21:10.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30735" PostTypeId="2" ParentId="30728" CreationDate="2016-05-26T13:58:33.347" Score="1" Body="&lt;p&gt;Your ISP will allocate IP addresses.  Since you have no servers, you will have a small allocation and most likely, your PCs will be NATted.  Your ISP will give you the details.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-26T13:58:33.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30737" PostTypeId="1" AcceptedAnswerId="30902" CreationDate="2016-05-26T16:16:11.237" Score="1" ViewCount="5988" Body="&lt;p&gt;I'm trying to get a list of the users that have logged into a Cisco ACS, and the date of their last login.  Ideally, I'd like it to include the identity store that was the source of the authentication info for the login (AD, RADIUS, etc.)  I've looked in the ACS GUI, including monitoring and reports, but I mainly find things referencing monitoring the device's status itself, or broad trends.  The one section that lists user information does it for one user at a time (not practical for a large pool of users).&#xA;     I've looked online but so far all I can find is someone telling how to do it in version 4, nothing for 5.2.  Cisco's own documents don't seem to mention it either.  As a side note, upgrading the software version is not an option at this time.  &lt;/p&gt;&#xA;" OwnerUserId="21451" LastActivityDate="2016-06-01T22:55:46.297" Title="How can I get a list of users and last login dates from a Cisco ACS running v5.2?" Tags="|cisco|aaa|logging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30738" PostTypeId="2" ParentId="30733" CreationDate="2016-05-26T18:09:11.540" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Except for BPDUs, traffic storm control does not differentiate between control traffic and data traffic.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/storm.html&quot; rel=&quot;nofollow&quot;&gt;Catalyst 6500 Release 12.2SX Software Configuration Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, storm-control can cause LACP to fail. Personally, I don't use LACP for infrastructure links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(You'll have to hunt down documentation for your specific hardware and software to see what's what.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-26T18:09:11.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30740" PostTypeId="1" AcceptedAnswerId="33697" CreationDate="2016-05-26T18:54:30.950" Score="4" ViewCount="8480" Body="&lt;p&gt;We have two cisco &lt;code&gt;c3850&lt;/code&gt; they are uplink with fiber port 10G and i am seeing this error on that trunk (uplink) port&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;[c3850]-----10G----[c3850]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;TenGigabitEthernet1/1/4 is down, line protocol is down (err-disabled)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when i try to shut / no shut port i got following error&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;*May 26 10:12:02.506: %LINEPROTO-5-UPDOWN: Line protocol on Interface TenGigabitEthernet1/1/4, changed state to upsh int&#xA;*May 26 10:12:04.405: %UDLD-4-UDLD_PORT_DISABLED: UDLD disabled interface Te1/1/4, unidirectional link detected&#xA;*May 26 10:12:04.405: %PM-4-ERR_DISABLE: udld error detected on Te1/1/4, putting Te1/1/4 in err-disable state&#xA;*May 26 10:12:05.409: %LINEPROTO-5-UPDOWN: Line protocol on Interface TenGigabitEthernet1/1/4, changed state to down&#xA;*May 26 10:12:06.405: %LINK-3-UPDOWN: Interface TenGigabitEthernet1/1/4, changed state to down&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what is UDLD why it's causing this issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last week we upgrade one of switch with latest firmware &lt;code&gt;3.6.x&lt;/code&gt; but still second switch running on older code &lt;code&gt;3.3.x&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;do you think it could be version mismatch issue?&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;UPDATE&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;SW1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface Te1/1/4&#xA;---&#xA;Port enable administrative configuration setting: Follows device default&#xA;Port enable operational state: Enabled&#xA;Current bidirectional state: Unknown&#xA;Current operational state: Link down&#xA;Message interval: 7000 ms&#xA;Time out interval: 5000 ms&#xA;&#xA;Port fast-hello configuration setting: Disabled&#xA;Port fast-hello interval: 0 ms&#xA;Port fast-hello operational state: Disabled&#xA;Neighbor fast-hello configuration setting: Disabled&#xA;Neighbor fast-hello interval: Unknown&#xA;&#xA;No neighbor cache information stored&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SW2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface Te1/1/4&#xA;---&#xA;Port enable administrative configuration setting: Follows device default&#xA;Port enable operational state: Enabled&#xA;Current bidirectional state: Unidirectional&#xA;Current operational state: Disabled port&#xA;Message interval: 7000 ms&#xA;Time out interval: 5000 ms&#xA;&#xA;Port fast-hello configuration setting: Disabled&#xA;Port fast-hello interval: 0 ms&#xA;Port fast-hello operational state: Disabled&#xA;Neighbor fast-hello configuration setting: Disabled&#xA;Neighbor fast-hello interval: Unknown&#xA;&#xA;No neighbor cache information stored&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;UPDATE 2&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW2#sh interfaces te1/1/4&#xA;TenGigabitEthernet1/1/4 is down, line protocol is down (err-disabled)&#xA;  Hardware is Ten Gigabit Ethernet, address is 6c99.8962.2938 (bia 6c99.8962.2938)&#xA;  Description: Connect_to_SW1&#xA;  MTU 1500 bytes, BW 10000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not set&#xA;  Full-duplex, 10Gb/s, link type is auto, media type is SFP-10G-ACTIVE-CABLE&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 3d04h, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     825762 packets input, 163952509 bytes, 0 no buffer&#xA;     Received 173 broadcasts (121 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 121 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     362 packets output, 42206 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 3 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SW1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#sh int te1/1/4&#xA;TenGigabitEthernet1/1/4 is down, line protocol is down (notconnect)&#xA;  Hardware is Ten Gigabit Ethernet, address is 6c99.8962.38b8 (bia 6c99.8962.38b8)&#xA;  Description: Connect_to_SW2&#xA;  MTU 1500 bytes, BW 10000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not set&#xA;  Full-duplex, 10Gb/s, link type is auto, media type is SFP-10GBase-CX1&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 3d04h, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 2y4w&#xA;  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     39504875093 packets input, 4530561503783 bytes, 0 no buffer&#xA;     Received 74817556 broadcasts (70452372 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 70452372 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     5520672431 packets output, 1374955280906 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 0 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Update:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Talk to cisco support and they did some debug but no answer found, we replaced new cable but no luck. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But as soon as we disable UDLD on interface, interface brought up. and as soon as you enable UDLD interface goes to err-disable mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco TAC this this could be the spanning-tree loop, Really? UDLD run on physical layer how could spanning-tree can block or disable that port? &lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2016-06-03T16:07:37.387" LastActivityDate="2016-08-02T19:43:08.370" Title="UDLD disabled interface" Tags="|cisco|switch|spanning-tree|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30741" PostTypeId="2" ParentId="30740" CreationDate="2016-05-26T19:08:31.827" Score="0" Body="&lt;p&gt;This &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/layer2/configuration_guide/b_lay2_3se_3850_cg/b_lay2_3se_3850_cg_chapter_0111.html&quot; rel=&quot;nofollow&quot;&gt;document&lt;/a&gt; on UDLD (UniDirectional Link Detection) would be a good review for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDLD detects that both side can receive packets, not just a physical connection, before bringing a port up.  So assuming that you have verified there are no cabling issues, crossed jumper, etc, then it's a configuration setting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Likely, you have UDLD enabled on one switch but not the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try troubleshooting beginning with &lt;code&gt;show udld&lt;/code&gt; on both sides.&lt;/p&gt;&#xA;" OwnerUserId="412" LastActivityDate="2016-05-26T19:08:31.827" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30743" PostTypeId="1" AcceptedAnswerId="30755" CreationDate="2016-05-26T19:48:58.603" Score="1" ViewCount="73" Body="&lt;p&gt;My Network is as follows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;11.11.11.1 (connected interface g0/1)--(CE IP= 10.10.10.1)R1 == VPLS_Cloud == R2 (CE ip=10.10.10.2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping from router (ping 10.10.10.2 works)&#xA;ping 10.10.10.2 source g0/1 doesnt work for some reason. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh arp&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  10.10.10.1              -   XXXX.XXXX.cd00  ARPA   GigabitEthernet0/0.555&#xA;Internet  10.10.10.2             16   XXXX.XXXX.XXXX ARPA   GigabitEthernet0/0.555&#xA;Internet  12.12.12.1              -   XXXX.XXXX.XXXX ARPA   GigabitEthernet0/1&#xA;Internet  12.12.12.2             28   XXXX.XXXX.XXXX ARPA   GigabitEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can Someone figure out what the issue is ?&lt;/p&gt;&#xA;" OwnerUserId="25683" LastEditorUserId="8499" LastEditDate="2016-05-26T19:59:06.607" LastActivityDate="2016-05-27T11:28:05.157" Title="VPLS connection" Tags="|cisco|routing|router|ethernet|vpls|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30744" PostTypeId="2" ParentId="28007" CreationDate="2016-05-26T22:27:37.727" Score="1" Body="&lt;p&gt;You are essentially correct.  Think of TDM as a conveyor belt with alternating colors of buckets...  blue, red, green, yellow... blue, red, etc.  Each bucket might have a corresponding input queue which will collect outgoing data until the next bucket for that color arrives.  Naturally, this is only effective if the individual buckets are each a fraction of the overall capacity of the transmission media.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K11GA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K11GA.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25681" LastActivityDate="2016-05-26T22:27:37.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30745" PostTypeId="1" CreationDate="2016-05-27T00:13:48.823" Score="1" ViewCount="1802" Body="&lt;p&gt;I need to determine the number of hosts on my network using wireshark. From what I have gathered, this is impossible on a Windows machine. Is this the case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is for school, so I simply need to know if this is possible on a Windows machine. I believe my professor may have made a mistake.&lt;/p&gt;&#xA;" OwnerUserId="25685" LastActivityDate="2016-05-29T01:51:25.750" Title="WireShark: How can I determine how many hosts are on the same wi-fi as me?" Tags="|wireshark|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="30746" PostTypeId="1" CreationDate="2016-05-27T01:19:37.733" Score="1" ViewCount="509" Body="&lt;p&gt;I have two networks communicating with each other through a transparent firewall. My problem is that the software using these networks is reporting that it's losing packages. The number of lost packages varies, but it may be around 0.1%. This applies even with &quot;any/any&quot; rules in both directions on the firewall.&#xA;I have done some capturing with Wireshark on one side of the firewall, and I see that there are some ICMP packets generated when the firewall is connected. If I replace the firewall with a patch cable, the number of ICMP packets significantly decreases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In captures of 1.5M packets, both with and without the firewall:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;With the firewall: About 100 ICMP packets saying &lt;code&gt;Time-to-live exceeded (Fragment reassembly time exceeded)&lt;/code&gt;, and 40 to 50 &lt;code&gt;Destination unreachable (Port unreachable)&lt;/code&gt; packets.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Without the firewall: About 40 &lt;code&gt;Time-to-live exceeded (Fragment reassembly time exceeded)&lt;/code&gt; packets, and none of the &lt;code&gt;Destination unreachable&lt;/code&gt; packets.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To me, it seems like some packets are delayed/damaged by the firewall, hence the ICMP messages, but I can't really imagine how that could be. Any ideas on why this is happening, or how to best continue troubleshooting? I'm thankful for any input!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firewall is a Phoenix Contact mGuard GT/GT, and the all switches are Cisco 3650.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Regarding network throughput, the mirrored interface on the switch I'm capturing traffic from shows only about 0.25% utilization, ie 2.5 Mbit. That should be well within the limitations on the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT2: I have done some bandwidth testing through the firewall, and the results are quite bad. I'm using iperf3 on two machines connected to the switches on both sides of the firewall, and when forcing UDP traffic (the majority of the regular traffic is UDP) between them I can just send about 30Mbit/sec of data before it starts to lose packets. At 50Mbit/sec about 16% of the packets are lost and at 200Mbit/s there is a gigantic packet loss of over 80%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The firewall can't be that bad, or am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="25687" LastEditorUserId="25689" LastEditDate="2016-05-28T13:21:49.180" LastActivityDate="2016-05-28T13:21:49.180" Title="Firewall seems to damage/delay packages" Tags="|firewall|udp|icmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30747" PostTypeId="2" ParentId="30746" CreationDate="2016-05-27T01:50:10.013" Score="1" Body="&lt;p&gt;Your ICMP &lt;code&gt;Time-to-live exceeded (Fragment reassembly time exceeded)&lt;/code&gt; messages are generated by the endpoints, not the firewall. The problem is likely that the firewall can't handle the data rate at which you are sending. If you have gigabit connections, you are losing a lot of traffic, and that causes TCP segments to be resent, many of which may be dropped again, and the TCP reassembly is timing out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.phoenixcontact.com/online/portal/us?uri=pxc-oc-itemdetail:pid=2700197&quot; rel=&quot;nofollow&quot;&gt;Router - FL MGUARD GT/GT - 2700197&lt;/a&gt; (emphasis is mine):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Routers with intelligent firewall, &lt;strong&gt;&lt;em&gt;up to 200 Mbps of data throughput&lt;/em&gt;&lt;/strong&gt;,&#xA;  Gigabit connectivity, SFP Slots Stateful Inspection Firewall for&#xA;  maximum security and very simple configuration, interchangeable&#xA;  configuration memory&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In other words, your firewall doesn't have the throughput to handle the speed at which you are trying to transfer data.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-27T01:56:38.543" LastActivityDate="2016-05-27T01:56:38.543" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30748" PostTypeId="1" CreationDate="2016-05-27T02:02:40.517" Score="0" ViewCount="457" Body="&lt;p&gt;I'm quite uncertain how the diagram would look like for this scenario so I can't really attach one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario:&#xA;This is a lab setup so I am free to change almost anything.&#xA;I have a remote site that reach back to my main office via satellite links. Currently the remote site is able to surf the Internet using the main office's resources. Both the main office and remote site have Wifi capability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The remote site has the address range &lt;strong&gt;192.168.2.x/24&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main office has the address range &lt;strong&gt;192.168.1.x/24&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I wish to add a Intranet into this setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, I have the following questions.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Is it possible for a PC/smartphone on the remote site to be assigned a private IP (192.168.2.x) and use it for both Internet and Intranet access?&#xA;If yes, how?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Considering that the remote site and main office has different address range, is it possible for the Intranet to even exist in the first place?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Any suggestions and comments would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="19735" LastActivityDate="2016-06-02T11:03:44.733" Title="Providing remote sites with Internet and Intranet using main office's resources" Tags="|routing|network-access|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="30750" PostTypeId="2" ParentId="30705" CreationDate="2016-05-27T05:41:07.500" Score="-1" Body="&lt;p&gt;Variable Length Subnet Masking has granted us, as network admins, great flexibility in using, essentially arbitrary prefix lengths for subnets.  For example, being able to take the network 10.1.1.0/25 and decide to change that prefix to a /24 on a whim is has become very convenient and, frankly, essential in today's ever changing networks.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That, however, does not grant us the ability to start and/or end a subnet at an arbitrary place within a given range of addresses.  Because even though VLSM grants us flexibility in network numbering, the problem of network boundaries remains, which bleeds over from VLSM to CIDR, actually.  Consider the following... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifying a subnet of 10.1.1.0/28 is very clear...  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Network address of 10.1.1.0/28&lt;/li&gt;&#xA;&lt;li&gt;First usable address of 10.1.1.1&lt;/li&gt;&#xA;&lt;li&gt;Broadcast address of 10.1.1.15&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The same would not be true if one were to try to define a network of 10.1.1.6/28, the idea being 10.1.1.7 as the first usable address, with 10.1.1.21 as a broadcast.  The problem is that &quot;subnet&quot; (in quotes because it's really not properly defined) straddles two /28's: 10.1.1.0/28 and 10.1.1.16/28.  This is, essentially what you're trying to do, except with supernets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem you're running into is 172.26.16.0, while indeed part of the larger /19 supernet, nevertheless belongs in 172.26.16.0/20 (172.26.16.0 - 172.26.31.255), which is the second half of 172.26.0.0/19, the first half being 172.26.0.0/20.  So, to re-illustrate... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;172.26.0.0/20 (16 Class Bs) and 172.26.16.0/20 (16 Class Bs) form 172.26.0.0/19 (32 Class Bs), ranging from 172.26.0.0 - 172.26.31.255.  The other end of your desired range (172.26.47.0) is actually the tail end of 172.26.32.0/20 (172.26.32.0 - 172.26.47.255), which is in the &quot;other&quot; /19 of 172.26.0.0/18.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All this to say that while you are talking about IP supernets that are technically contiguous, you have to, nevertheless, allocate them within the boundaries in which they fall when /18s split into /19s, etc.  In other words, say I assign you a /18 supernet and you want to utilize two /20s from it.  The /18 breaks in half to form two /19s and each of those /19s break to form two /20s, so you end up with four /20s from the two /19s from the one /18.  When it comes time to use the /20's however, and you're in the scenario where just one /20 isn't going to be adequate and you commit to using an additional /20, it has to come from the same parent /19.  You cannot take a /20 from one /19 and a /20 from the other /19 and span a subnet between them, even if one does begin where the other ended, because they are from different parent networks, or supernets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps a little. &lt;/p&gt;&#xA;" OwnerUserId="25681" LastEditorUserId="25681" LastEditDate="2016-05-27T07:30:32.197" LastActivityDate="2016-05-27T07:30:32.197" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30751" PostTypeId="1" AcceptedAnswerId="30752" CreationDate="2016-05-27T07:00:12.080" Score="1" ViewCount="1348" Body="&lt;p&gt;In my company we have a software system used to transmit thousands of files of different sizes through a WAN. Senders and receivers are in different countries or even continents, and most of the connections are established through static VPN tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The system works fine, but almost every day at some point we experience periods (from minutes to hours) in which many connections are dropped. This software can close the connections if they're idle for 3 minutes, and when this happens the action is properly logged and easily identifiable. However, in most of the cases what we see in the logs of &lt;strong&gt;both sides&lt;/strong&gt; isn't a connection closed due to timeout, but  that &lt;strong&gt;'a connection was forcibly closed by the remote host'&lt;/strong&gt;.. So my conclusion is that &lt;strong&gt;it is a network device in the middle that is actively sending a RST to both endpoints&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, &lt;strong&gt;is this possible?&lt;/strong&gt;. I understand that a router can drop packets but I've been told that it cannot initiate a connection closure. Is this true? If so, &lt;strong&gt;any idea of why the TCP stack indicates, in both sides, that it was the other side who closed the connection&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="25690" LastActivityDate="2019-08-12T09:59:12.097" Title="TCP connection dropped and each endpoint points at the other one as responsible of closing it" Tags="|router|firewall|tcp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30752" PostTypeId="2" ParentId="30751" CreationDate="2016-05-27T07:38:48.490" Score="4" Body="&lt;p&gt;I've seen firewalls exhibit this exact behaviour in the wild when troubleshooting issues, spoofing RST packets. When running a capture on one end of the connection the RST will appear to be originating from the remote host - try the capture on the remote host and the RST will appear to come from the other end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to answer your question, network devices which are &quot;TCP aware&quot; can absolutely cause this situation.&lt;/p&gt;&#xA;" OwnerUserId="25431" LastActivityDate="2016-05-27T07:38:48.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30754" PostTypeId="2" ParentId="30705" CreationDate="2016-05-27T11:25:25.073" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am trying to get a subnet of 32 networks from 172.26.16.0/19 &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Unless I misunderstood what you want, you can't do that because 172.26.16.0/19 is not a correct network address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the notation in binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10101100.00011010.00010000.00000000&#xA;=====================--------------&#xA;    Network part       Host part&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In short, the host part is not all zeros, so there is something wrong with your numbers. &lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2016-05-27T11:25:25.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30755" PostTypeId="2" ParentId="30743" CreationDate="2016-05-27T11:28:05.157" Score="2" Body="&lt;p&gt;R2 doesn't have a route to 11.11.11.0, so it doesn't know where to send the echo reply.  Add a route with the next hop on 10.10.10.1.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-27T11:28:05.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30757" PostTypeId="1" CreationDate="2016-05-27T13:04:04.873" Score="0" ViewCount="691" Body="&lt;p&gt;I've read several artical about it, but can't seem to understand this. What sort of routing algorithm is typically used in the fat-tree topology?&lt;/p&gt;&#xA;" OwnerUserId="25697" LastActivityDate="2016-05-28T09:38:44.033" Title="What type of routing algorithm is typically used in the fat-tree topology?" Tags="|routing|topology|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30759" PostTypeId="2" ParentId="30692" CreationDate="2016-05-27T14:09:13.850" Score="3" Body="&lt;p&gt;It exists in the EtherLike-MIB (dot3statsFCSErrors), but just because a MIB exists doesn't mean a vendor supports it.  Most vendors have a custom MIB that supports CRC/FCS errors and it shouldn't be hard to build a list based on that.&lt;/p&gt;&#xA;" OwnerUserId="13537" LastActivityDate="2016-05-27T14:09:13.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30760" PostTypeId="2" ParentId="17793" CreationDate="2016-05-27T14:44:00.867" Score="2" Body="&lt;p&gt;Dell has the &lt;code&gt;rlstack.mib&lt;/code&gt;.  It doesn't seem to exist online (anymore), but can be retrieved from the firmware on &lt;a href=&quot;http://www.dell.com/support/home/us/en/19/product-support/product/powerconnect-5524/drivers&quot; rel=&quot;nofollow&quot;&gt;Dell Support&lt;/a&gt;, or I posted a copy on &lt;a href=&quot;https://gist.github.com/buzzsurfr/c01fbd1e6fcbd1174cc6cb7ef7647069&quot; rel=&quot;nofollow&quot;&gt;Gist&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try using a snmpwalk on &lt;code&gt;.1.3.6.1.4.1.89.107&lt;/code&gt; and see if you get any data.  If so, use the Gist or the full MIBs from the firmware to interpret.&lt;/p&gt;&#xA;" OwnerUserId="13537" LastActivityDate="2016-05-27T14:44:00.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30763" PostTypeId="2" ParentId="3634" CreationDate="2016-05-27T17:45:45.767" Score="0" Body="&lt;p&gt;You need a device that supports Port Address Translation (PAT), Dynamic Host Control Protocol (DHCP), and basic routing.  Your best bet is to get a consumer grade 'router' and test it one night and then have it on hand for if the primary device fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, a windows server can do this too, but, realistically, just go buy a $50 router. &lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-27T17:45:45.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30764" PostTypeId="2" ParentId="30737" CreationDate="2016-05-27T17:56:37.870" Score="-2" Body="&lt;p&gt;Just look in the Administrator Guide for &quot;accounting&quot; which is one of the A's in AAA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4-2/user/guide/ACS4_2UG/LgsRpts.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_server_for_windows/4-2/user/guide/ACS4_2UG/LgsRpts.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/V4Tt3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V4Tt3.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-05-31T23:21:32.417" LastActivityDate="2016-05-31T23:21:32.417" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="30765" PostTypeId="2" ParentId="30713" CreationDate="2016-05-27T18:02:06.163" Score="0" Body="&lt;p&gt;Ping is a layer3 verification tool.  It seems your main concern is your layer2 topology / configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, each switch needs to have a default gateway configured if pings are to work across different IP subnets.  If all switch management IP addresses are on the same LAN/VLAN/subnet then pings should work without having a default gateway configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what are you management IP addresses on each switch?  If they are all 2.2.2.x than ping will work, provided your layer 2 configuration is valid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, that direct link between SWB and SWC really complicates the topology and what does it really give you?  There is already a redundant path between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My recommendation is to home run each switch to SWB and minimize STP.  Get another SWB-B stacked and to dual runs to each IDF switch.  Something like below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9AN1G.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9AN1G.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-05-27T18:08:09.707" LastActivityDate="2016-05-27T18:08:09.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30768" PostTypeId="1" CreationDate="2016-05-27T20:19:45.173" Score="3" ViewCount="1644" Body="&lt;p&gt;802.3 requires 1000BASE-T interface to do autonegotiation. But many network gear can disable autoneg and force 1000M-FDX operation for 1000BASE-T interface (such as &quot;no autonegotiation / duplex full / speed 1000&quot; ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Despite that the spec requires autoneg and many gear venders also recommend to enable autoneg, my colleague insists on disabling autoneg. He prefer fixed configuration because autoneg-enabled 1000-T port sometimes &quot;falls back&quot; into 100/10M mode due to bad cable (for example one of 8 wires in Cat5 cable is cut).... Furthermore autoneg-disabled 1000BASE-T link in our lab is apparently working well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question&lt;/strong&gt;: Does something wrong occur if I set &quot;no autoneg&quot; to each end of 1000BASE-T port? (e.g. BER increase or link flap ?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK 1000BASE-X's autoneg includes remote fault signalling which detects uni-directional fiber cut. It makes senses to enable autonegotiation for all 1000BASE-X link.&lt;/p&gt;&#xA;" OwnerUserId="25701" LastEditorUserId="25701" LastEditDate="2016-05-27T20:27:05.277" LastActivityDate="2024-01-13T01:22:00.267" Title="1000BASE-T with &quot;no autonegotiation&quot;" Tags="|ethernet|autonegotiation|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30769" PostTypeId="2" ParentId="30768" CreationDate="2016-05-27T20:40:22.053" Score="7" Body="&lt;p&gt;Autonegotiation should only be disabled where necessary. Properly compliant 802.3 hardware will send and respond to information in link pulses. Only in rare instances -- i.e. metro-ethernet -- are link pulses missing. And it &lt;em&gt;is&lt;/em&gt; a violation of 802.3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting speed/duplex does not disable negotiation; it limits what is advertised.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: The Cisco 2960S's at my fingers don't even support turning off negotiation. The Adtran hardware, luckily, does. (or I'd have no internet access.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-27T20:40:22.053" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30770" PostTypeId="1" AcceptedAnswerId="34476" CreationDate="2016-05-28T00:32:16.333" Score="3" ViewCount="10174" Body="&lt;p&gt;In the past I spun up JunOS Olive in my home lab to learn JunOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it looks like Juniper has something called vMX. Is this comparable to vMX?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously its not free, but for learning purposes (learn juniper routers and switches) would vMX be the same or even better than Olive? &lt;/p&gt;&#xA;" OwnerUserId="13362" LastActivityDate="2018-10-01T20:44:20.513" Title="Is Olive the same as vMX?" Tags="|juniper|juniper-junos|juniper-ex|juniper-mx|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30771" PostTypeId="1" AcceptedAnswerId="30772" CreationDate="2016-05-28T01:22:35.417" Score="3" ViewCount="876" Body="&lt;p&gt;Are there any alternatives to meet a small auto provisioning server for a Cisco switch (Cat3850)? I'm working to setting up a &quot;plug and play&quot; capable Cisco switch (Cat3850) in small isolated lab.  I unfortunate don't have access to the DevNet sandbox. I'm constrained for compute resources in this lab and the VM host requirements for the free APIC-EM download are a bit stiff.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions? Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="25709" LastEditorUserId="8499" LastEditDate="2018-12-23T06:22:16.000" LastActivityDate="2018-12-23T06:22:16.000" Title="Alternative to Cisco APIC-EM for small lab" Tags="|cisco|switch|cisco-catalyst|lab|automation|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30772" PostTypeId="2" ParentId="30771" CreationDate="2016-05-28T02:47:45.600" Score="1" Body="&lt;p&gt;You have an ISR and a DHCP server, but you need a TFTP server, then you can just use &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3750-x-series-switches/white_paper_c11-651895.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;SmartInstall for Zero Touch Switch Deployment&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Abstract&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;SmartInstall provides a suite of capabilities that help deploy new Cisco® Catalyst® switches and manage them effectively at&#xA;very low operating costs. SmartInstall has true zero-touch switch&#xA;installation to lower operational costs. SmartInstall helps with&#xA;initial switch deployment, switch configuration management, and switch&#xA;replacement. This document will explain the practical benefits of&#xA;deploying SmartInstall, configurable options for deployment based on&#xA;different network scenarios, best practices, and customization&#xA;options.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-05-28T02:47:45.600" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30773" PostTypeId="2" ParentId="30757" CreationDate="2016-05-28T02:50:05.953" Score="2" Body="&lt;p&gt;It depends if your tree is layer 2 or layer 3.  Either way, you need a protocol that provides equal-cost multi-path (ECMP), so you can use parallel paths from source to destination.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-28T02:50:05.953" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30774" PostTypeId="2" ParentId="30447" CreationDate="2016-05-28T05:26:33.773" Score="3" Body="&lt;p&gt;The router is simply summarizing based on the default class of address the subnet happens to reside in.  By default,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;209.165.200.224/30 summarizes to a Class C network of 209.165.200.0/24&lt;/li&gt;&#xA;&lt;li&gt;172.16.4.0/28 summarizes to a Class B network of 172.16.0.0/16&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And if you were to have a 10-net address configured on your router, for example 10.20.4.0/25, it would summarize to a Class A network of 10.0.0.0/8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck in your studies.&lt;/p&gt;&#xA;" OwnerUserId="25681" LastEditorUserId="25681" LastEditDate="2016-05-28T14:15:08.020" LastActivityDate="2016-05-28T14:15:08.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30775" PostTypeId="1" CreationDate="2016-05-28T09:16:17.387" Score="1" ViewCount="219" Body="&lt;p&gt;I tried to establish an old switch in site, but VTP is not working. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Show cdp neighbor &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Got the next switch with this command. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Model: WS-C2960-24TC-L&#xA;Version : 12.2(53)SE2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to add the management VLAN and give it an IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I debug the connection?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$49nA$xGugzBL.MidsIvXB.&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;authentication mac-move permit&#xA;ip subnet-zero&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree etherchannel guard misconfig&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/24&#xA;switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2 &#xA;!&#xA;interface Vlan1&#xA;no ip address&#xA;no ip route-cache&#xA;!&#xA;interface Vlan150&#xA;ip address 10.10.150.50 255.255.255.0&#xA;no ip route-cache&#xA;!&#xA;ip default-gateway 10.10.150.1&#xA;ip http server&#xA;ip http secure-server&#xA;ip sla enable reaction-alerts&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA;password 7 08974A351F8G5K483956&#xA;login&#xA;line vty 5 15&#xA;login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I tried with another switch, and it's working fine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh vtp sta&#xA;VTP Version capable             : 1 to 3&#xA;VTP version running             : 1&#xA;VTP Domain Name                 : ABC&#xA;VTP Pruning Mode                : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;Device ID                       : xxxx.xxxx.xxxx&#xA;Configuration last modified by 0.0.0.0 at 3-1-93 00:04:03&#xA;&#xA;Feature VLAN:&#xA;--------------&#xA;VTP Operating Mode                : Client&#xA;Maximum VLANs supported locally   : 255&#xA;Number of existing VLANs          : 6&#xA;Configuration Revision            : 1&#xA;MD5 digest                        : 0xB9 0x07 0xEE 0xE3 0x27 0xEC 0xF7 0x33&#xA;                                    0x98 0x81 0x0A 0xA3 0x32 0xE9 0xD2 0xDF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Tried to reset the switch &lt;/li&gt;&#xA;&lt;li&gt;Replace with another switch, and it's working fine. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Working switch VTP STATUS&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW04#sh vtp sta&#xA;VTP Version capable             : 1 to 3&#xA;VTP version running             : 1&#xA;VTP Domain Name                 : ABC&#xA;VTP Pruning Mode                : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;Device ID                       : xxxx.xxxx.xxxx&#xA;Configuration last modified by xxx.xxx.xxx.xxx at 5-17-16 09:33:54&#xA;&#xA;Feature VLAN:&#xA;--------------&#xA;VTP Operating Mode                : Client&#xA;Maximum VLANs supported locally   : 1005&#xA;Number of existing VLANs          : 12&#xA;Configuration Revision            : 16&#xA;MD5 digest                        : 0x39 0x28 0x36 0x47 0xDE 0xDC 0xBE 0x26&#xA;                                    0x6E 0x16 0xD9 0x56 0xCC 0x4D 0xF8 0x7B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="8499" LastEditDate="2016-05-29T05:21:03.003" LastActivityDate="2016-08-27T06:23:45.693" Title="Can't establish the connection for switch" Tags="|cisco|switch|switching|vtp|switching-modes|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="30776" PostTypeId="2" ParentId="30757" CreationDate="2016-05-28T09:38:44.033" Score="0" Body="&lt;p&gt;&lt;strong&gt;Multi-path Routing:&lt;/strong&gt;&lt;br&gt;&#xA;Ex. &lt;em&gt;ECMP&lt;/em&gt;:&lt;br&gt;&#xA;        Without it, the largest cluster = 1,280 nodes. It helps to perform static load splitting among data flows. It Leads to over subscription for simple communication patterns. Routing table entries grows multiplicatively with number of paths, cost ++, lookup latency ++. &lt;/p&gt;&#xA;" OwnerUserId="25714" LastActivityDate="2016-05-28T09:38:44.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30777" PostTypeId="1" CreationDate="2016-05-28T11:48:28.590" Score="1" ViewCount="5741" Body="&lt;p&gt;I want to upload the image through TFTP, but as I start, my AP lose connectivity with TFTP and get this message &quot;Could not discover WLC using static IP forcing AP to use DHCP &quot;  is there any way to disable/stop WLC discovery and my AP keep connected with static IP. Please must reply, thanking you in anticipation. Please note that MY LAP/CAP AP is not connected with WLC, only with my laptop, So far I have not found any solution of this problem.&lt;/p&gt;&#xA;" OwnerUserId="25671" LastActivityDate="2018-10-26T10:59:04.893" Title="How to stop/pause AP discovery algorithm when connected through console and PC LAN" Tags="|cisco-commands|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30778" PostTypeId="2" ParentId="30777" CreationDate="2016-05-28T14:22:23.413" Score="2" Body="&lt;p&gt;A lightweight AP is designed to work only with a controller, so it will keep rebooting until it can find one.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you are trying to convert the AP to autonomous mode.  Follow these instructions:&#xA;&lt;a href=&quot;https://supportforums.cisco.com/document/57476/lwapp-autonomous-conversion-and-vice-versa-access-points&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/document/57476/lwapp-autonomous-conversion-and-vice-versa-access-points&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-28T14:22:23.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30780" PostTypeId="1" CreationDate="2016-05-28T15:18:44.430" Score="0" ViewCount="1493" Body="&lt;ul&gt;&#xA;&lt;li&gt;I have a cisco ASA-5505 configured to route internal network traffic &quot;10.0.50.0/24 via tunnel - gateway IP is 68.150.169.32 with the following:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;route inside 10.0.50.0 255.255.255.0 68.150.169.32 1 &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I would need to configure the gateway using a Hostname &quot;FQDN&quot; as the hostname IP is always changing, when checked I found that route accepts Hostname:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h1&gt;route inside 10.0.50.0 255.255.255.0 ?&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;configure mode commands/options:&#xA;  Hostname or A.B.C.D  The address of the gateway by which the foreign network&#xA;                       is reached.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;#&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;My problem is each time I add the hostname or any hostname like &quot;host.cisco.com&quot; I received the error ---&gt;  ERROR: % Invalid Hostname&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;DNS is configured and I can ping any host, also created a object network for the hostname and fqdn but still receive the same error&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How to configure route using a hostname as a gateway, any examples?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="25717" LastActivityDate="2017-06-23T10:09:19.953" Title="ASA 5505 - route inside - gateway is a Hostname" Tags="|cisco|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="30784" PostTypeId="2" ParentId="21074" CreationDate="2016-05-28T20:08:30.490" Score="1" Body="&lt;p&gt;You just buy another one and plug it in to the existing one with a Cat5/6 cable (or two for redundancy via an etherchannel).  If they are far apart, get the miniGBIC for multimode fiber x2 (one for each switch, or x4 2 for each) and plug it in that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/switches/sg300-28p-28-port-gigabit-poe-managed-switch/model.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/switches/sg300-28p-28-port-gigabit-poe-managed-switch/model.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco 300 Series also offers mini gigabit interface converter (mini-GBIC) expansion slots that give you the option to add fiber-optic or Gigabit Ethernet uplink connectivity to the switch.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-28T20:08:30.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30785" PostTypeId="2" ParentId="19498" CreationDate="2016-05-28T20:15:18.963" Score="-1" Body="&lt;p&gt;You want a Full Mesh VPN Topology.  The documentation is all online.  Your best bet is DMVPN but ASA's don't support tunnel interfaces, thus don't support DMVPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need assistance, contact me :-) .  http:rack.pub &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/security_manager/3-2-2/user/guide/UserGuide/vpchap.html#wp586214&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/security_management/cisco_security_manager/security_manager/3-2-2/user/guide/UserGuide/vpchap.html#wp586214&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Rewl3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Rewl3.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-28T20:15:18.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30786" PostTypeId="2" ParentId="30780" CreationDate="2016-05-28T20:27:57.270" Score="1" Body="&lt;p&gt;If you enter a hostname, it will be resolved on the spot and stored as the address to which it resolved at that point in time. You cannot route to a &lt;em&gt;dynamic&lt;/em&gt; destination via a hostname. (in fact, that doesn't work on &lt;em&gt;ANY&lt;/em&gt; platform) The only way to route to a moving target is via an active routing protocol (RIP, OSPF, etc.), or a scripted process (the way SLIP/PPP/DHCP are handled)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-28T20:27:57.270" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30787" PostTypeId="2" ParentId="30745" CreationDate="2016-05-28T21:15:36.927" Score="1" Body="&lt;p&gt;Capturing WLAN traffic on Windows depends on WinPcap and on the underlying network adapters and drivers. Promiscuous mode (mode in which you can see other machine's traffic) can be set; unfortunately, it's often crippled. In this mode many drivers don't supply packets at all, or don't supply packets sent by the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if promiscuous mode works with your WiFi adapter and drivers, you can only do that on an unprotected network. On a &quot;protected&quot; network, packets from or to other hosts will not be able to be decrypted by the adapter, and will not be captured, so that promiscuous mode works the same as non-promiscuous mode.&lt;/p&gt;&#xA;" OwnerUserId="25723" LastActivityDate="2016-05-28T21:15:36.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30788" PostTypeId="2" ParentId="30775" CreationDate="2016-05-28T22:10:56.117" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/vtp/98154-conf-vlan.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;VTP Configuration Guidelines&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;This section provides some guidelines for the configuration of VTP in the network.&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;All switches have the same the VTP domain name, unless the network&#xA;design insists for different VTP domains. Note: Trunk negotiation&#xA;does not work across VTP domains. Refer to the Data Traffic Blocked&#xA;between VTP Domains section of Troubleshooting VLAN Trunk Protocol&#xA;(VTP) for more information.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;All switches in a VTP domain must run the    same VTP version. All&#xA;switches in a VTP domain has the same VTP    password, if there is&#xA;any.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;All VTP Server switch(es) should have the    same configuration&lt;br /&gt;&#xA;revision number and it should also be the highest    in the domain.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When you move a VTP mode of a switch from Transparent    to Server,&lt;br /&gt;&#xA;VLANs configured on the VTP Transparent switch should    exist on the&#xA;Server switch.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;switch#vlan database&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;switch(vlan)#vtp domain domain-name&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;switch(vlan)#vtp {client | server | transparent}&lt;/code&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-05-28T22:10:56.117" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30789" PostTypeId="1" AcceptedAnswerId="30792" CreationDate="2016-05-28T23:23:23.320" Score="0" ViewCount="110" Body="&lt;p&gt;Can I add a wifi adapter to a juniper olive or vMX vm so it thinks its a regular Ethernet adapter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I would like to do this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;have a junos Olive/vMX VM running on an esxi host&lt;/li&gt;&#xA;&lt;li&gt;connect a wifi adapter to the host and use pass through to the VM&lt;/li&gt;&#xA;&lt;li&gt;is there some way for the junos VM to see the wifi adapter as a rotatable interface? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Olive runs on freebsd which would have the drivers for the adapter so at least the underlying OS would see it. Is there a way for the virtual router to see that wifi adapter as an interface?&lt;/p&gt;&#xA;" OwnerUserId="13362" LastEditorUserId="13362" LastEditDate="2016-05-29T00:17:35.430" LastActivityDate="2016-08-27T04:23:36.900" Title="add wifi adapter to juniper Olive or vMX" Tags="|juniper|juniper-junos|" AnswerCount="1" CommentCount="3" ClosedDate="2016-08-27T15:54:35.977" ContentLicense="CC BY-SA 3.0" />
  <row Id="30791" PostTypeId="2" ParentId="30745" CreationDate="2016-05-29T00:50:38.747" Score="1" Body="&lt;p&gt;You can capture wireless packets and identify the unique MAC addresses using Wireshark with your adapter in promiscuous mode.  Of course, this assumes all the hosts are talking while you are capturing packets. Even if you can't decrypt the packets, you will still see MAC addresses.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-05-29T01:51:25.750" LastActivityDate="2016-05-29T01:51:25.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30792" PostTypeId="2" ParentId="30789" CreationDate="2016-05-29T01:41:14.907" Score="1" Body="&lt;p&gt;Fooling a router OS to think that one sort of network is a different sort of network will lead to failure. A router needs to build the frame encapsulation for packets leaving through an interface. An ethernet frame is fundamentally different than a Wi-Fi frame. If you somehow manage to send an ethernet frame through a Wi-Fi adapter, none of the WAPs or Wi-Fi clients will understand it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-29T01:41:14.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30793" PostTypeId="2" ParentId="30775" CreationDate="2016-05-29T04:58:26.890" Score="1" Body="&lt;p&gt;Your problem is that the VTP passwords don't match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the non-working switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MD5 digest                        : 0xB9 0x07 0xEE 0xE3 0x27 0xEC 0xF7 0x33&#xA;                                    0x98 0x81 0x0A 0xA3 0x32 0xE9 0xD2 0xDF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the working switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MD5 digest                        : 0x39 0x28 0x36 0x47 0xDE 0xDC 0xBE 0x26&#xA;                                    0x6E 0x16 0xD9 0x56 0xCC 0x4D 0xF8 0x7B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can verify this by using the &lt;code&gt;show vtp password&lt;/code&gt; command on each switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-29T04:58:26.890" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30794" PostTypeId="1" CreationDate="2016-05-29T05:21:35.193" Score="0" ViewCount="762" Body="&lt;p&gt;I have a VPN between ﻿2 sites connected by a private link point to point. Now I need to find a way how to allow the Internet Traffic from branch  Through the main Firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Sonicwall tz 300 in the branch and a  NSA 3600 in the HQ. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will need an static route (default route) from Branch to HQ﻿﻿. But not sure what kind of policies I need in the HQ to make this configuration (NAT and firewall policies)&lt;/p&gt;&#xA;" OwnerUserId="25727" LastEditorUserId="8499" LastEditDate="2018-03-21T16:39:47.683" LastActivityDate="2018-12-16T20:02:10.407" Title="Routing Branch Site Internet Traffic Through Headquarters" Tags="|routing|vpn|nat|sonicwall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30798" PostTypeId="1" AcceptedAnswerId="30833" CreationDate="2016-05-29T12:57:16.010" Score="2" ViewCount="1371" Body="&lt;p&gt;I am trying to simulate a network, I am having problem directing traffic to exit the L3 Switch and to go to router for routing to outside network. (I don't want to use routing capability of switch, other than just setting a default route or something...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long Description:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZO4ay.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZO4ay.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now,I understand there is a way to do this by making the L3 Switch do the routing, but I don't want that to happen. I want the L3 switch to route only the VLAN traffic  among the VLANs it holds. All the other foreign traffic by default should be handed over to the router for routing. Is there a way this can be done withouthaving to input all routes of the foreign network in the routing table of L3 Switch.&lt;/p&gt;&#xA;" OwnerUserId="25730" LastEditorUserId="8499" LastEditDate="2018-03-21T01:05:03.173" LastActivityDate="2018-03-21T01:05:03.173" Title="Exiting to a Router from Layer 3 Switch with SVI enabled routing" Tags="|routing|switch|switching|layer3|packet-tracer|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30799" PostTypeId="2" ParentId="30794" CreationDate="2016-05-29T13:56:55.820" Score="1" Body="&lt;p&gt;HQ firewall:&lt;br&gt;&#xA;Independent of the firewall vendor, you will need an additional policy to allow traffic from the tunnel end to your WAN port (destination address 'all'). Here, you have to apply source NAT as private addresses like those used on the branch network are not routed over the internet. In a stateful firewall, reply traffic will be automatically allowed to flow from WAN port to the tunnel and eventually to the branch LAN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;branch firewall:&lt;br&gt;&#xA;As you have already stated on the branch router/firewall you need an additional default route pointing to the (private) address of the HQ firewall. The associated policy should allow 'all' as destinations, not only the private address range of the HQ, as it might do at the moment.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;edit:&lt;/strong&gt;&lt;br&gt;&#xA;On the branch firewall, you need an additional (host) route to the public address of the HQ firewall. Otherwise, this address cannot be reached when the tunnel is down. For example, add &quot;1.2.3.4/32&quot; via WAN port.&lt;br&gt;&#xA;If you already have a default route in place (pointing to WAN port) then either delete it or make sure it has a higher distance than the new default route to the tunnel.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastEditorUserId="15678" LastEditDate="2016-05-29T17:42:40.153" LastActivityDate="2016-05-29T17:42:40.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30800" PostTypeId="2" ParentId="30794" CreationDate="2016-05-29T19:18:00.833" Score="0" Body="&lt;p&gt;If it's a private link do you really need to encrypt?  Maybe so?  Just asking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, you need to disable split tunneling on the branch sites VPN/Security appliance.  Other than that just a default route pointing to the VPN peer (HQ) should do it.  Oh, and you'll need to have a route back to the branch subnets in the HQ devices so they know how to route packets.  The allowing of particular destination subnets to traverse the VPN tunnel may also be required to be configured.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-29T19:18:00.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30801" PostTypeId="2" ParentId="29129" CreationDate="2016-05-29T19:22:02.650" Score="1" Body="&lt;p&gt;&lt;del&gt;Configure VLAN &quot;cameras&quot; on the switch along with a unique subnet for them to use, say, 10.2.2.x/24.  On the router, if you have a spare ethernet port, assign it ip address 10.2.2.254/24.  If no spare ethernet interface, reconfigure link to switch as a trunk so it gets frames from both VLAN's (default and cameras).&lt;/del&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;del&gt;In any case, simply create an access list so that the only device that the cameras VLAN/subnet can access is the IP address of the NAS.&lt;/del&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;purchase a decent switch (one that supports VLANs and PoE+ for your cameras).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-05-29T19:22:02.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30802" PostTypeId="2" ParentId="30656" CreationDate="2016-05-29T20:23:24.040" Score="1" Body="&lt;p&gt;When I have to copy-paste big configurations I use a text editor. I put there all the reusable rows in this manner:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enable&#xA;!&#xA;configure terminal&#xA;!&#xA;vlan 10&#xA;!&#xA;name VLAN10&#xA;!&#xA;vlan 20&#xA;!&#xA;name VLAN20&#xA;!&#xA;exit&#xA;!&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please notice the exclamation mark ( &quot;!&quot; ) that I put below each row, it makes the text reusable! And I don't put the &quot;Switch&gt;&quot; part, just copy the text and paste it in the CLI. It doesn't look very automated, but... it's just Packet Tracer. :)&lt;/p&gt;&#xA;" OwnerUserId="25734" LastActivityDate="2016-05-29T20:23:24.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30803" PostTypeId="1" AcceptedAnswerId="30804" CreationDate="2016-05-29T21:57:18.020" Score="1" ViewCount="249" Body="&lt;p&gt;I am trying to study the traffic between the mobile and access points. So I have phone Galaxy Nexus which does not support monitoring mode but still support promiscuous mode. Unfortunately, I try many android apps Shark for root , native shark, tpacket and Tcpdump. all of them cannot capture any ieee802.11 frames(control, management and beacon frames).&lt;/p&gt;&#xA;" OwnerUserId="25735" LastActivityDate="2016-05-29T22:19:33.240" Title="Is it possible to capture ieee802.11 management and control frames from the same phone using android APP or tcpdump on root device?" Tags="|ieee-802.11|wireshark|tcpdump|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30804" PostTypeId="2" ParentId="30803" CreationDate="2016-05-29T22:19:33.240" Score="2" Body="&lt;p&gt;Without monitor mode, there will be no access to non-traffic frames. Use a 3rd device (PC) that &lt;em&gt;does&lt;/em&gt; support monitor mode to record radio traffic.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-29T22:19:33.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30805" PostTypeId="2" ParentId="30798" CreationDate="2016-05-30T00:04:08.217" Score="2" Body="&lt;p&gt;You'll need four SVIs (VLAN interfaces) on the switch to achieve what you're after. The SVIs are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 2&lt;/li&gt;&#xA;&lt;li&gt;VLAN 3&lt;/li&gt;&#xA;&lt;li&gt;VLAN 4&lt;/li&gt;&#xA;&lt;li&gt;VLAN 100 (or any other number of your choosing)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The first three VLANs allow the switch to perform routing for these three VLANs. The fourth VLAN is used for routing between the switch and the router. Through this VLAN you will need to configure a default route on the switch witch points to the router's IP address as the next hop address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that instead of using VLAN 100 you could issue the &quot;no switchport&quot; command on the switch's gi0/1 interface and use it as a layer 3 interface instead.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-05-30T00:04:08.217" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30806" PostTypeId="2" ParentId="29110" CreationDate="2016-05-30T00:22:43.367" Score="1" Body="&lt;p&gt;The Wago BootP Server should have been able to assign/reassign the device's address.  The coupler had some kind of internal short or fault that I was unaware of at the time, so this was a super unusual instance.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-05-30T00:22:43.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30807" PostTypeId="1" AcceptedAnswerId="30808" CreationDate="2016-05-30T02:16:16.180" Score="3" ViewCount="1687" Body="&lt;p&gt;Is it advisable to have multiple subnets with in a VLAN? If at all ports assigned with differently subnetted addresses are used in  a VLAN, will they be able to communicate? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume the different subnet IP addresses are on different devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: a switch with &lt;code&gt;10.0.1.0/24&lt;/code&gt; is connected to a host port of &lt;code&gt;10.0.2.0/24&lt;/code&gt;, both the ports are a member of same VLAN, will they be able to communicate?&lt;/p&gt;&#xA;" OwnerUserId="21879" LastEditorUserId="8499" LastEditDate="2018-12-11T00:50:19.703" LastActivityDate="2018-12-11T00:50:19.703" Title="Multiple Subnets in a VLAN" Tags="|vlan|subnet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30808" PostTypeId="2" ParentId="30807" CreationDate="2016-05-30T02:59:36.010" Score="3" Body="&lt;p&gt;Hosts on different networks will be unable to communicate with IP, except through a router. Routers route between networks. A host sending packets to a network different than its own network will send to its configured gateway, which is on the same network as it is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some corner cases where you would put different networks on the same VLAN, but this is certainly non-standard. If you do this for any reason, you must be sure to document it thoroughly.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-30T02:59:36.010" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30810" PostTypeId="2" ParentId="24404" CreationDate="2016-05-30T04:00:38.033" Score="8" Body="&lt;p&gt;Vlan 0 does have an use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a client requires CoS, but doesn't know the vlan, it tags its traffic with VLAN 0, which is recognized by the switch to mean the default untagged vlan of that port, whatever it may be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.1Q-2005.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://standards.ieee.org/getieee802/download/802.1Q-2005.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;page 76  Section 9.6, Table 9-2.&lt;/p&gt;&#xA;" OwnerUserId="25740" LastActivityDate="2016-05-30T04:00:38.033" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30811" PostTypeId="1" AcceptedAnswerId="30846" CreationDate="2016-05-30T06:51:22.367" Score="2" ViewCount="396" Body="&lt;p&gt;I'm studying network architecture and after looking into switched backbone networks it looks quite easy to manage and results in higher performance in comparison to other backbone networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any disadvantages associated with switched backbone networks?&lt;/p&gt;&#xA;" OwnerUserId="24256" LastActivityDate="2016-05-31T11:38:42.463" Title="Are there any reasons not to use switched backbone networks?" Tags="|switch|lan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30812" PostTypeId="2" ParentId="28207" CreationDate="2016-05-30T07:00:41.173" Score="0" Body="&lt;p&gt;It was a broken ASA, I sent it back to the Factory and they got it repaired. The Putty Setting from &lt;em&gt;JFL&lt;/em&gt; are working now, if anybody needs them.&lt;/p&gt;&#xA;" OwnerUserId="22401" LastActivityDate="2016-05-30T07:00:41.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30813" PostTypeId="1" AcceptedAnswerId="30828" CreationDate="2016-05-30T07:42:38.167" Score="1" ViewCount="682" Body="&lt;p&gt;I have read the tutorials about how to send several command lines to setup port mirroring (e.g. source port, destination port). But before sending commands to the switch, I need a administration interface, such as cmd window, or web management platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence, where I can access that admin interface? For example, for cisco Catalyst 2960 Series switch. From the destination port connected computer/laptop? Then connect the switch's IP? &lt;/p&gt;&#xA;" OwnerUserId="22125" LastEditorUserId="22125" LastEditDate="2016-05-30T08:39:32.700" LastActivityDate="2016-05-30T17:32:13.693" Title="How to access the Cisco Catalyst 2960 Series switch port mirroring webpage/admin interface?" Tags="|cisco|switch|monitoring|mirror|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30816" PostTypeId="1" AcceptedAnswerId="30817" CreationDate="2016-05-30T09:57:34.480" Score="1" ViewCount="258" Body="&lt;p&gt;So, I am working on this network simulation it is pretty basic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I initiate the first ping from 172.25.56.0/24 network to 10.151.0.0/16 network there is a loss of 2 packets. I understand, this happens because in the first two pings the arp tables are created. But I wanted to know is there a way that I can decrease these two packet drops to one packet drop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hbKSi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hbKSi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://drive.google.com/file/d/0B5GAUpOlYEi9blVBejFaV1NTWEU/view?usp=sharing&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; is the .pkt file. I have created the file using Packet Tracer 6.2 in Ubuntu 14.04 &lt;/p&gt;&#xA;" OwnerUserId="25730" LastActivityDate="2017-06-11T11:08:16.913" Title="Packet Loss of two in Router&gt;Router&gt;L3SW configuration" Tags="|routing|vlan|ping|packet-loss|packet-tracer|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30817" PostTypeId="2" ParentId="30816" CreationDate="2016-05-30T11:02:18.847" Score="1" Body="&lt;p&gt;No, since both are creating their arp-entrys.&#xA;You could decrease the drops with entering the arp-entrys yourself into the tables.&lt;br&gt;&#xA;After these two initial packets there's no loss on that connection.&#xA;And since it's just pings the drop doesn't matter in a practical way.&#xA;But that would be a nice solution if there is one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would call this &quot;ping golf&quot;.&#xA;Played faster with a traceroute(6).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Maybe I'm wrong, see comments.&lt;/p&gt;&#xA;" OwnerUserId="12215" LastEditorUserId="12215" LastEditDate="2016-05-30T13:20:27.293" LastActivityDate="2016-05-30T13:20:27.293" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30821" PostTypeId="1" CreationDate="2016-05-30T12:01:29.487" Score="1" ViewCount="771" Body="&lt;p&gt;I currently have 1x Juniper ex3300 and 1x HP ProCurve 2848 forming the core of my network with vlans 1, 10, 20 and 30 being trunked between them on ports 46-47. The ex3300 acts as the DHCP server for all vlans and routes between them and the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireless APs (airport express/extreme) connect directly to each of these switches in most cases but in some, Mikrotik RB260gs's are connected via trunk links with the same vlans across them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The directly connected APs function fine and the switchports can be placed in any VLAN and retain connectivity. The RB260gs functions correctly (serves up DHCP addresses related to VLAN, full connectivity) when my laptop is plugged in. When I plug any other device into the same port, however, the device does not receive a DHCP address and there is no connectivity&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tested this so far with an Onkyo AV Receiver, Airport Extreme, Airport Express, all of which don't pick up a DHCP address. Two windows machines do pick up DHCP (one of which only has a clean windows install on it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ive got nothing here. Anyone lend a hand?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[UPDATE] - Configs&#xA;&lt;a href=&quot;https://i.stack.imgur.com/A8hVV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/A8hVV.png&quot; alt=&quot;Mikrotik VLAN Config&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;HP CONFIG&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname &quot;MUST-CSW2-HP2848&quot;&#xA;mirror-port 39&#xA;interface 6&#xA;   name &quot;Captains_Cabin_Express&quot;&#xA;exit&#xA;interface 11&#xA;   name &quot;VIP_AP&quot;&#xA;exit&#xA;interface 20&#xA;   name &quot;ASW1-Master&quot;&#xA;exit&#xA;ip default-gateway 172.20.11.254&#xA;snmp-server community &quot;public&quot; Unrestricted&#xA;vlan 1&#xA;   name &quot;DEFAULT_VLAN&quot;&#xA;   ip address dhcp-bootp&#xA;   tagged 10&#xA;   no untagged 1-9,11-48&#xA;   exit&#xA;vlan 10&#xA;   name &quot;Ship&quot;&#xA;   untagged 1-19,21-38,40-44&#xA;   ip address 172.20.11.253 255.255.254.0&#xA;   tagged 20,45-48&#xA;   exit&#xA;vlan 20&#xA;   name &quot;Crestron&quot;&#xA;   ip address 172.20.20.253 255.255.255.0&#xA;   tagged 20,45-48&#xA;   exit&#xA;vlan 30&#xA;   name &quot;Guest&quot;&#xA;   untagged 39&#xA;   ip address 172.20.30.253 255.255.255.0&#xA;   tagged 20,45-48&#xA;   exit&#xA;vlan 99&#xA;   name &quot;Management&quot;&#xA;   exit&#xA;interface 20&#xA;   monitor&#xA;   exit&#xA;spanning-tree&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;JUNIPER CONFIG&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;****************output omitted**********************&#xA;&#xA;        dhcp {&#xA;            traceoptions {&#xA;                file dhcp_logfile;&#xA;                level all;&#xA;                flag all;&#xA;            }&#xA;            pool 172.20.10.0/23 {&#xA;                address-range low 172.20.10.50 high 172.20.11.149;&#xA;                name-server {&#xA;                    8.8.8.8;&#xA;                    8.8.4.4;&#xA;                }&#xA;                router {&#xA;                    172.20.11.254;&#xA;                }&#xA;            }&#xA;            pool 172.20.30.0/24 {&#xA;                address-range low 172.20.30.25 high 172.20.30.225;&#xA;                name-server {&#xA;                    8.8.8.8;&#xA;                    8.8.4.4;&#xA;                }&#xA;                router {&#xA;                    172.20.30.254;&#xA;                }&#xA;            }&#xA;            pool 172.20.20.0/24 {&#xA;                address-range low 172.20.20.50 high 172.20.20.225;&#xA;                name-server {&#xA;                    8.8.8.8;&#xA;                    8.8.4.4;&#xA;                }&#xA;                router {&#xA;                    172.20.20.254;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;&#xA;****************output omitted*************************&#xA;&#xA;    ge-0/0/44 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/45 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members [ Ship Guest Crestron-Control ];&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/46 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members [ Ship Guest Crestron-Control ];&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/47 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode trunk;&#xA;                vlan {&#xA;                    members [ Ship Guest Crestron-Control ];&#xA;                }&#xA;            }&#xA;        }&#xA;&#xA;**************output omitted******************&#xA;&#xA;    vlan {&#xA;        unit 0 {&#xA;            family inet;&#xA;        }&#xA;        unit 1 {&#xA;            family inet;&#xA;        }&#xA;        unit 10 {&#xA;            family inet {&#xA;                address 172.20.11.254/23;&#xA;            }&#xA;        }&#xA;        unit 20 {&#xA;            family inet {&#xA;                address 172.20.20.254/24;&#xA;            }&#xA;        }&#xA;        unit 30 {&#xA;            family inet {&#xA;                address 172.20.30.254/24;&#xA;            }&#xA;        }&#xA;        unit 100 {&#xA;            family inet {&#xA;                address 172.20.100.14/28;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;***************output omitted******************&#xA;&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop 172.20.100.1;&#xA;    }&#xA;}&#xA;protocols {&#xA;    igmp-snooping {&#xA;        vlan all;&#xA;    }&#xA;    rstp {&#xA;        bridge-priority 0;&#xA;    }&#xA;    lldp {&#xA;        interface all;&#xA;    }&#xA;    lldp-med {&#xA;        interface all;&#xA;    }&#xA;}&#xA;ethernet-switching-options {&#xA;    storm-control {&#xA;        interface all;&#xA;    }&#xA;}&#xA;vlans {&#xA;    Crestron-Control {&#xA;        description &quot;Crestron Network Resources&quot;;&#xA;        vlan-id 20;&#xA;        interface {&#xA;            ge-0/0/47.0;&#xA;            ge-0/0/44.0;&#xA;            ge-0/0/45.0;&#xA;            ge-0/0/46.0;&#xA;        }&#xA;        l3-interface vlan.20;&#xA;    }&#xA;    Guest {&#xA;        description &quot;Guest Network Resources and User Devices&quot;;&#xA;        vlan-id 30;&#xA;        interface {&#xA;            ge-0/0/47.0;&#xA;            ge-0/0/46.0;&#xA;            ge-0/0/45.0;&#xA;            ge-0/0/44.0;&#xA;            ge-0/0/10.0;&#xA;        }&#xA;        l3-interface vlan.30;&#xA;    }&#xA;    Internet_Connection {&#xA;        description &quot;Connection to Peplink30 via Bridge_MAIN&quot;;&#xA;        vlan-id 100;&#xA;        interface {&#xA;            ge-0/0/0.0;&#xA;        }&#xA;        l3-interface vlan.100;&#xA;    }&#xA;    Management {&#xA;        vlan-id 99;&#xA;        l3-interface vlan.0;&#xA;    }&#xA;    Ship {&#xA;        description &quot;Hardware and Crew&quot;;&#xA;        vlan-id 10;&#xA;        interface {&#xA;            ge-0/0/47.0;&#xA;            ge-0/0/11.0;&#xA;            ge-0/0/12.0;&#xA;            ge-0/0/13.0;&#xA;            ge-0/0/14.0;&#xA;            ge-0/0/15.0;&#xA;            ge-0/0/16.0;&#xA;            ge-0/0/17.0;&#xA;            ge-0/0/18.0;&#xA;            ge-0/0/19.0;&#xA;            ge-0/0/29.0;&#xA;            ge-0/0/44.0;&#xA;            ge-0/0/45.0;&#xA;            ge-0/0/46.0;&#xA;        }&#xA;        l3-interface vlan.10;&#xA;    }&#xA;    default {&#xA;        vlan-id 1;&#xA;        interface {&#xA;            ge-0/0/47.0;&#xA;        }&#xA;        l3-interface vlan.1;&#xA;    }&#xA;}&#xA;poe {&#xA;    interface all;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25750" LastEditorUserId="8499" LastEditDate="2018-02-14T16:22:35.323" LastActivityDate="2018-02-14T16:22:35.323" Title="Laptop can get DHCP address but other devices cannot when plugged into the same switchport" Tags="|vlan|dhcp|juniper|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30828" PostTypeId="2" ParentId="30813" CreationDate="2016-05-30T17:32:13.693" Score="1" Body="&lt;p&gt;You can connect to the console port of the switch to configure it. Use the provided console cable. This will connect you to the CLI interface, and this is how you will initially configure the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then configure an SVI with an IP address in a VLAN on the switch, and configure the default gateway in the same VLAN for the switch to use. You can use this address to manage the switch remotely. To use the CLI, you will also need to configure a password on the the VTY lines. The default would be to use telnet, but you can configure something else, e.g SSH, but that is more complicated, albeit more secure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably want to use the CLI interface, rather than the HTTP server, to manage the switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-30T17:32:13.693" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30829" PostTypeId="1" AcceptedAnswerId="30905" CreationDate="2016-05-30T17:52:10.517" Score="3" ViewCount="1651" Body="&lt;p&gt;I have multiple q-in-q S-VLANs assigned to the trunk port ge-0/0/0.&#xA;How can I read SNMP traffic counters for a specific VLAN id (S-VLAN) on that trunk port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware is Juniper EX4200-24F.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, the VLAN configuration is shown below. For instance, I need to read, thru SNMP, traffic counters for S-VLAN id=4 for packets received/sent on port ge-0/0/0.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode access&#xA;set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members SVID4&#xA;set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members SVID5&#xA;set vlans SVID4 vlan-id 4&#xA;set vlans SVID4 dot1q-tunneling customer-vlans 41-42&#xA;set vlans SVID4 dot1q-tunneling layer2-protocol-tunneling all&#xA;set vlans SVID5 vlan-id 5&#xA;set vlans SVID5 dot1q-tunneling customer-vlans 51-52&#xA;set vlans SVID5 dot1q-tunneling layer2-protocol-tunneling all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can EX4200 provide traffic counters thru SNMP for specific VLAN id on a trunk port? If so, please point out directions.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-06-02T08:52:31.347" Title="Juniper EX4200 How to read SNMP traffic counters for specific VLAN id from trunk interface?" Tags="|vlan|juniper|snmp|juniper-junos|qinq|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30830" PostTypeId="1" CreationDate="2016-05-30T19:49:00.367" Score="0" ViewCount="83" Body="&lt;p&gt;No engineer here, but I know some programming. I need to find out which device is which just using my computer. I tried using wireshark but since I only use windows 7 (don't ask but I can't use linux now) it seems it won't be possible because drivers matter. How can I filter my network's data to my computer or something similar so I know what device does what connections?&lt;/p&gt;&#xA;" OwnerUserId="25766" LastActivityDate="2016-05-31T11:03:49.613" Title="How can I identify which device is which in my network just using my computer?" Tags="|routing|packet-analysis|" AnswerCount="2" CommentCount="2" ClosedDate="2019-03-11T02:33:16.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="30831" PostTypeId="1" AcceptedAnswerId="30832" CreationDate="2016-05-30T20:24:41.713" Score="2" ViewCount="3077" Body="&lt;p&gt;I have a simple network setup as follows (both switches are layer 3, and switch 1 is also a router to reach outside network):&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jvYcI.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jvYcI.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to move an IP address from PC A to PC B (following a PC failure).  The network above is attached to eth1 on both PC's.  (eth0 is connected to an unrelated network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After failover, I issue this command from PC B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arping -U -I eth1 -c 5 172.31.253.4&#xA;ARPING 172.31.253.4 from 172.31.253.4 eth1&#xA;Sent 5 probes (5 broadcast(s))&#xA;Received 0 response(s)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see no responses are received.  If I issue ifconfig on PC B I can confirm the NIC is up and running:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;eth0: flags=4163&amp;lt;UP,BROADCAST,RUNNING,MULTICAST&amp;gt;  mtu 1500&#xA;    inet 192.168.1.15  netmask 255.255.255.0  broadcast 192.168.1.255&#xA;    ether 00:50:56:a5:19:72  txqueuelen 1000  (Ethernet)&#xA;    RX packets 27854916  bytes 15728132541 (14.6 GiB)&#xA;    RX errors 0  dropped 91  overruns 0  frame 0&#xA;    TX packets 19645321  bytes 2992871301 (2.7 GiB)&#xA;    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0&#xA;&#xA;eth1: flags=4163&amp;lt;UP,BROADCAST,RUNNING,MULTICAST&amp;gt;  mtu 1500&#xA;    inet 172.31.253.4  netmask 255.255.255.0  broadcast 172.31.253.255&#xA;    ether 00:0c:29:1e:b0:1d  txqueuelen 1000  (Ethernet)&#xA;    RX packets 13397  bytes 7034331 (6.7 MiB)&#xA;    RX errors 0  dropped 0  overruns 0  frame 0&#xA;    TX packets 11998  bytes 6102989 (5.8 MiB)&#xA;    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why is the ARP update (arping) failing?  (no responses)&lt;/li&gt;&#xA;&lt;li&gt;How should I notify switch 1 (router) that the path to the old IP has changed?   (and arping along from PC A won't reach switch 1 since it's 2 hops away)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="16787" LastEditorUserId="16787" LastEditDate="2016-05-30T23:14:27.237" LastActivityDate="2016-05-31T01:13:23.907" Title="arp update not working as expected" Tags="|switch|arp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30832" PostTypeId="2" ParentId="30831" CreationDate="2016-05-30T20:35:53.940" Score="1" Body="&lt;p&gt;A switch will update its MAC address table from any frame it receives on a port. Switches aren't interested in IP, or any other layer-3, addresses, only layer-2 (MAC) addresses. ARP is a host protocol to resolve a layer-3 address to a layer-2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the layer-2 addresses of the PCs aren't changing, the switches are unaffected by the change in IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can clear the ARP cache on the router. It will eventually time out anyway, probably during the time it takes you to notice that PC A is down and move the IP address to PC B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are trying to arping you own address, and you don't get a reply. If you arping the gateway address, you should get a reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, a layer-3 switch is primarily a layer-2 switch. The layer-3 router of the switch is separate from the layer-2 switch part, connected to the layer-2 switch via (a) virtual interface(s), as if it was a separate external device. The router is only concerned with what are connected to its layer-3 interfaces, virtual, or physical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just as if it was a separate router, the router of the layer-3 switch maintains an ARP cache for a connection to a layer-2 network, but it only knows which layer-3 interface to which it should send traffic, not which particular layer-2 port to which an individual host is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-2 switch part is just like any other layer-2 switch, it maintains a MAC address table which tells it to which port a MAC address is connected, and it knows nothing about layer-3 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router ARP cache and the MAC address table entries are temporal; they time out after a certain period of time. This time period may be configurable, depending on the switch model. The time period is probably much less than the amount of time it takes for you to notice that PC A is down, plus the amount of time it takes for you to configure PC B with the IP address from PC A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-2 part of the switch is the part concerned with the physical switch port to which PC B is connected, and it only cares about PC B's MAC address, which I doubt you changed when changing its IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router's ARP cache is only concerned with which MAC address should be related to the IP address, not the physical switch port to which PC A or B is connected. The ARP cache entry may be stale, but not for long, and probably not at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hosts, including routers, are constantly timing out ARP cache entries when traffic isn't received from the IP addresses. Assigning the IP address to PC B will cause it to ARP for the router's MAC address when it needs to contact the router, and that will change the router's ARP cache entry for that IP address to point to PC B's MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, there is nothing you need to do to the switches when PC A is disabled, and you assign the address from PC A to PC B.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-05-31T01:13:23.907" LastActivityDate="2016-05-31T01:13:23.907" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="30833" PostTypeId="2" ParentId="30798" CreationDate="2016-05-31T01:54:08.627" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I wanted to know in how many methods can we do this. If you could&#xA;  please elaborate more on this, tell me the pros and cons of using a&#xA;  particular method.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are essentially two methods:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You configure static routes on the switch for all subnets not&#xA;connected to the switch.&lt;/li&gt;&#xA;&lt;li&gt;You configure a routing protocol so that the switch and router can&#xA;exchange routing information.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For each method, you have a choice of using a default route or configuring/advertising all the known routes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A default route makes the most sense, since a full Internet routing table is over 500,000 routes.  More importantly, your switch needs to only make a simple routing decision: is the destination locally connected or not?  There is no need for additional routing information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether you configure a static default route or have the router advertise the default route via a routing protocol is up to you.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-05-31T01:54:08.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30835" PostTypeId="2" ParentId="30830" CreationDate="2016-05-31T07:01:52.427" Score="2" Body="&lt;p&gt;You can try to ping the broadcast address of your network and then check the arp table of your computer (arp -a)&#xA;You can also try with nmap on Linux.&lt;/p&gt;&#xA;" OwnerUserId="22574" LastActivityDate="2016-05-31T07:01:52.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30836" PostTypeId="1" CreationDate="2016-05-31T07:49:05.643" Score="1" ViewCount="2177" Body="&lt;p&gt;I can get the networking bits for IPv4 addresses like &lt;code&gt;17&lt;/code&gt; for &lt;code&gt;255.255.128.0&lt;/code&gt;. Similarly, how should I calculate it for IPv6 addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say, if I have a subnet mask of &lt;code&gt;ffff:ffff:ffff:ffff:0:0:0:0&lt;/code&gt; or &lt;code&gt;ffff:ffff:ffff:ffff::&lt;/code&gt;, how should I find the networking bits?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I found that the networking bits for subnet mask is a maximum of /32 in case of IPv4. What is the maximum limit of IPv6 and what is the reason behind it?&lt;/p&gt;&#xA;" OwnerUserId="25777" LastEditorUserId="8499" LastEditDate="2018-03-12T00:24:49.440" LastActivityDate="2018-03-12T00:24:49.440" Title="Calculate networking bits for IPv6" Tags="|ipv4|ip|subnet|ipv6|ip-address|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30837" PostTypeId="1" AcceptedAnswerId="30840" CreationDate="2016-05-31T07:51:34.137" Score="1" ViewCount="591" Body="&lt;p&gt;What will break the tie in this case? Maybe the age timer? If so, the router has to choose the newer one, so I'd guess that it will prefer the age field with a smaller value?&lt;/p&gt;&#xA;" OwnerUserId="16946" LastActivityDate="2016-05-31T08:35:00.323" Title="What happens when a router receives an LSA with the same sequence nr?" Tags="|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30838" PostTypeId="1" AcceptedAnswerId="30843" CreationDate="2016-05-31T08:07:49.423" Score="1" ViewCount="853" Body="&lt;p&gt;We expect that there is a switch, configured with three VLANs on one port (Trunk).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN10 -&amp;gt; 10.0.1.0/24 &#xA;VLAN20 -&amp;gt; 10.0.2.0/24 &#xA;VLAN30 -&amp;gt; 10.0.3.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A unmanaged switch is connected to this port, on this switch, there are three devices connected, which all have 3 different IPs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC A -&amp;gt; 10.0.1.100&#xA;PC B -&amp;gt; 10.0.2.100&#xA;PC C -&amp;gt; 10.0.3.100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Are they on three different VLANs, or is the VLAN tag dropped&#xA;because it is a unmanaged switch?&lt;/li&gt;&#xA;&lt;li&gt;What happens if I change the IP address of PC B to 10.0.3.101. Will it then&#xA;swap to the other VLAN?&lt;/li&gt;&#xA;&lt;li&gt;If I connect a PC instead of the switch, and I change the IP address as&#xA;above, will it then/also &quot;&lt;em&gt;swap&lt;/em&gt;?&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="8499" LastEditDate="2016-05-31T13:21:41.587" LastActivityDate="2016-06-01T13:23:02.740" Title="Swap VLAN by changing IP address of a device" Tags="|cisco|switch|vlan|trunk|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30840" PostTypeId="2" ParentId="30837" CreationDate="2016-05-31T08:35:00.323" Score="6" Body="&lt;p&gt;Found the answer to my own question. When a router encounters two instances of an LSA, it must determine which is more recent. An LSA is identified by its LS type, ID, and LSA router. For two instances of the same LSA, the LS sequence number, LS checksum, and LS age fields are used to determine which instance is more recent (thereby accounting for all the header fields). As per the standard:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The LSA having the newer LS sequence number is more recent.&lt;/li&gt;&#xA;&lt;li&gt;If the two instances have different LS checksums, then the instance having the larger LS checksum (when considered as a 16-bit unsigned integer) is considered more recent.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="16946" LastActivityDate="2016-05-31T08:35:00.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30841" PostTypeId="2" ParentId="30836" CreationDate="2016-05-31T09:03:46.610" Score="2" Body="&lt;p&gt;With a very few exceptions, IPv6 will use &lt;code&gt;/64&lt;/code&gt; networks: 64 bits for the Network ID, and 64 bits for the Interface ID. You may see &lt;code&gt;/128&lt;/code&gt; for a host address, and &lt;code&gt;/127&lt;/code&gt; or &lt;code&gt;/126&lt;/code&gt; for a point-to-point link. When you see anything less than &lt;code&gt;/64&lt;/code&gt;, e.g. &lt;code&gt;/48&lt;/code&gt;, you are seeing a network block that is to be divided into &lt;code&gt;/64&lt;/code&gt; networks.&lt;/p&gt;&#xA;&lt;p&gt;IPv6 notation only uses the CIDR notation, not a network mask. IPv4 addresses are 32 bits, so the maximum mask length is &lt;code&gt;/32&lt;/code&gt;. IPv6 addresses are 128 bits, so the maximum mask length is &lt;code&gt;/128&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;You should investigate &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291, IP Version 6 Addressing Architecture&lt;/a&gt;, and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5952&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5952, A Recommendation for IPv6 Address Text Representation&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-05-31T09:09:55.420" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="30843" PostTypeId="2" ParentId="30838" CreationDate="2016-05-31T09:20:56.867" Score="4" Body="&lt;p&gt;What an unmanaged switch will do with VLAN tagged frames is unpredictable. Some unmanaged switches will drop the tagged frames, while some may pass them on. Unmanaged switches which pass tagged frames will pass them on to the hosts connected to the switch, and most end-devices cannot use tagged frames, and they will be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, frames from the hosts through the unmanaged switch will be placed on the trunk without VLAN tags, so all the frames will be part of the native VLAN, usually VLAN 1. This will place all the traffic in the same broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A host connected to a trunk will usually not work since the host will probably not understand VLAN tags. Some servers can, but most end-devices do not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addresses have nothing to do with switches or VLANs, so changing IP addresses does not change VLANs. Switches and VLANs are layer-2, but IP addresses are layer-3.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-05-31T09:20:56.867" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30844" PostTypeId="2" ParentId="30830" CreationDate="2016-05-31T11:03:49.613" Score="0" Body="&lt;p&gt;You could open a dosbox and run &quot;netstat -na&quot; and check established connections.&lt;/p&gt;&#xA;" OwnerUserId="1558" LastActivityDate="2016-05-31T11:03:49.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30845" PostTypeId="2" ParentId="30821" CreationDate="2016-05-31T11:15:45.257" Score="3" Body="&lt;p&gt;If the networks are routed through your HP (do not have a Layer2 connection by being in the same VLAN as their DHCP Server), you need to add a IP Helper in order to allow the DHCP Broadcasts to reach their respective DHCP Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For you an interface-config on the  may look like this then:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 30&#xA;   name &quot;Guest&quot;&#xA;   untagged 39&#xA;   ip address 172.20.30.253 255.255.255.0&#xA;   ip helper-address x.x.x.x (IP Address of DHCP Server)&#xA;   tagged 20,45-48&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1558" LastEditorUserId="8499" LastEditDate="2016-05-31T11:22:44.893" LastActivityDate="2016-05-31T11:22:44.893" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30846" PostTypeId="2" ParentId="30811" CreationDate="2016-05-31T11:38:42.463" Score="4" Body="&lt;p&gt;Assuming you're referring to &lt;em&gt;packet&lt;/em&gt; switched networks;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resource guarantees. You'll need management protocols to reserve resources (switching and bandwidth) to specific flows. In a circuit switched network these are inherent part of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another is timing. You'll need specific (SyncE) hardware to keep network node clocks in sync. Think of mobile networking where RF functions are to be synchronized over the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another is jitter. Usually more severe than in circuit switched networks. To be managed through jitter buffers.&lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2016-05-31T11:38:42.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30847" PostTypeId="2" ParentId="29622" CreationDate="2016-05-31T13:01:44.187" Score="0" Body="&lt;p&gt;First of all, this is not a silly question to ask which protocol works on which x layer .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;APPLICATION LAYER:&lt;/strong&gt; BOOTP, DHCP, DNS, FTP, HTTP, HTTPS, IMAP4, PING, POP3, NSLOOKUP, NTP, SFTP, SMTP, Telnet, TFTP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PRESENTATION LAYER&lt;/strong&gt; MIME, SSL, TLS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SESSION LAYER:&lt;/strong&gt; RTP, SIP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TRANSPORT LAYER:&lt;/strong&gt; TCP, UDP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NETWORK Layer:&lt;/strong&gt; ARP, ICMP, IGMP, IP, IPSec, RARP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DATA LINK Layer:&lt;/strong&gt; L2TP, PPP, PPTP, SLIP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PHYSICAL LAYER:&lt;/strong&gt; IEEE 802.3 (Ethernet)802.5 (Token Ring), 802.11 (Wi-Fi)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is this infographic on this link that might help you which protocol works on which layer of OSI layer model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.certiology.com/computing/computer-networking/osi-layer-model.html&quot; rel=&quot;nofollow&quot;&gt;OSI Layer Model Infographics&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25781" LastEditorUserId="25781" LastEditDate="2016-05-31T13:26:38.343" LastActivityDate="2016-05-31T13:26:38.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30848" PostTypeId="2" ParentId="30619" CreationDate="2016-05-31T13:51:37.777" Score="2" Body="&lt;p&gt;MTU (Maximum transmission unit ) defines the largest size of packets (layer 3) that an interface can transmit without the need to fragment. &#xA;The MTU of an Ethernet connection by default = 1500 bytes. If a system sends packets over an Ethernet network that are larger than 1500 bytes, the data will be fragmented into smaller packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To calculate: MTU = MSS + 40 where:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MSS (Maximum segment size)  is a parameter of the options field of the TCP header that specifies the largest amount of data, specified in bytes, that a computer or communications device can receive in a single TCP segment and 40 =  IP ( 20 bytes)  + TCP ( 20 bytes).&#xA;If you set the MTU of the interface to 1492, you should see the MSS to 1452.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The TCP/IP doesn't limit the size of the data of the segment; Ethernet defines the maximum size of the dates before the encapsulation; IP defines the maximum size of the dates after the encapsulation; &#xA;At layer 2 OSI the minimum size of a frame (Ethernet) could be 64 bytes and the maximum 1518 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I think you should analyse the problem in terms of protocols, not devices.&lt;/p&gt;&#xA;" OwnerUserId="25736" LastActivityDate="2016-05-31T13:51:37.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30852" PostTypeId="1" AcceptedAnswerId="30867" CreationDate="2016-05-31T16:03:44.147" Score="1" ViewCount="5891" Body="&lt;p&gt;I have about 15-18 stacks of Cisco 3750 switches and each of the stack have 3-4 switched in it. Now, we need to upgrade the switch to 3850 ( replace all the 3750 switches with the 3850). Did anybody done this kind of projects? Please help me by providing the detail procedure on how to physically replace the switch in the production environment and how to transfer the current configurations in the switches. We need to have all the previous configuration in the new switch. The switch replacement is done in weekends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have researched almost every where, but could not find any answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="25763" LastActivityDate="2016-06-01T21:47:34.920" Title="Replacing switches in production environment (3750 to 3850)" Tags="|switch|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30854" PostTypeId="2" ParentId="30838" CreationDate="2016-05-31T16:54:15.223" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Depending on the switch, it won't be tagged at all and dropped or it will default to the default VLAN as stated above.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;As stated above, switching the IP has nothing to do with the VLANs, VLANs are layer 2 and the IP is layer 3. You can assigned whatever IP you want but if the packet is tagged with one of the 3 VLANs on the trunk then the traffic dies or falls to the default VLAN.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you just have the port configured as a trunk port with the 3 VLANs, the traffic from the PC will be dropped because it isn't tagged on any of the VLANs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25787" LastEditorUserId="25787" LastEditDate="2016-06-01T13:23:02.740" LastActivityDate="2016-06-01T13:23:02.740" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30855" PostTypeId="2" ParentId="30748" CreationDate="2016-05-31T17:00:44.337" Score="0" Body="&lt;p&gt;It sounds like all you need to do is have a DNS server at each remote site that resolves hostnames to internal addresses, overriding your external DNS records.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then when using FTP, Email, or other services that have external DNS records, it will route all the traffic to internal addresses and route the traffic over your VPN connections instead of our the WAN at the remote sites.&lt;/p&gt;&#xA;" OwnerUserId="25787" LastActivityDate="2016-05-31T17:00:44.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30857" PostTypeId="1" CreationDate="2016-05-31T17:30:21.137" Score="2" ViewCount="413" Body="&lt;p&gt;We have few access-list and all showing &lt;code&gt;counter&lt;/code&gt; for hit but one access list not showing anything.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#show access-lists 101&#xA;Extended IP access list 101&#xA;    5 permit ip 101.142.61.0 0.0.0.255 any (7 matches)&#xA;    10 deny ip any any fragments&#xA;    20 permit ip any any (202593 matches)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea why &lt;code&gt;10 deny ip any any fragments&lt;/code&gt; has no counter on it? I tried to send big packet and it dropped but no counter. &lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-05-31T20:11:17.963" Title="cisco ACL no counter" Tags="|cisco|security|fragmentation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30858" PostTypeId="2" ParentId="29622" CreationDate="2016-05-31T17:44:24.197" Score="5" Body="&lt;p&gt;In addition to what others have said regarding the services each layer provides, different layers typically also differ in terms of how far they are encapsulated within packets (and in what order they are performed at each sender/receiver along the way). For example, a common scenario is where application layer (HTTP layer 7) header and data has transport layer (TCP - layer 4) bits added to the beginning of it, which has IP (layer 3) bits added to the beginning, which has Ethernet (layer 2) data added to it. The complete message would look something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[ Ethernet bits [ IP bits [ TCP bits [ HTTP bits [ App payload ] ] ] ] ]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes sense, because lower layer functions need to be performed last at the sender, and first at the receiver. At each hop a networking device (host, router, switch) will look at the lower (outer) layers first, and only move inward as far as necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may not be 100% true all the time, but it's another way I like to think about it.&lt;/p&gt;&#xA;" OwnerUserId="16349" LastActivityDate="2016-05-31T17:44:24.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30859" PostTypeId="2" ParentId="30694" CreationDate="2016-05-31T18:35:52.547" Score="1" Body="&lt;p&gt;Juniper boxes will happily accept routes like 0/0 or 10/8.  IOS certainly doesn't, and i'm pretty sure that XR doesn't either.&lt;/p&gt;&#xA;" OwnerUserId="4095" LastActivityDate="2016-05-31T18:35:52.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30860" PostTypeId="1" AcceptedAnswerId="30886" CreationDate="2016-05-31T19:39:08.027" Score="1" ViewCount="3793" Body="&lt;p&gt;I have attempted and followed many guides and am still having issues allowing traffic from my VPN to access devices on the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://rbgeek.wordpress.com/2014/08/26/pptp-server-setup-on-mikrotik/&quot; rel=&quot;nofollow&quot;&gt;https://rbgeek.wordpress.com/2014/08/26/pptp-server-setup-on-mikrotik/&lt;/a&gt;&#xA;Is an example of one guide I have followed, and although I can connect, and ping from LAN &gt; VPN I am unable to ping from VPN &gt; LAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routerboard 750&#xA;WebFig v6.35.1 (stable)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;LAN 192.168.88.0/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PPTP Pool 192.168.200.10-192.168.200.20&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PPTP Server: Enabled&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;PPTP Profile created&lt;/code&gt; using the PPTP IP Pool for both internal and external addresses&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ip pool&#xA;add name=dhcp ranges=192.168.88.100-192.168.88.254&#xA;add name=pptp-pool ranges=192.168.200.1-192.168.200.10&amp;lt;&#xA;&#xA;&#xA;&#xA;# may/31/2016 23:02:50 by RouterOS 6.35.1&#xA;# software id = 8RIQ-2NZU&#xA;#&#xA;/ip firewall filter&#xA;add chain=input comment=&quot;default configuration&quot; protocol=icmp&#xA;add chain=input comment=&quot;VPN PPTP ACCEPT&quot; dst-port=1723 log=yes protocol=tcp&#xA;add chain=input comment=&quot;GRE ACCEPT&quot; log=yes protocol=gre&#xA;add chain=input comment=&quot;default configuration&quot; connection-state=established&#xA;add chain=input comment=&quot;default configuration&quot; connection-state=related&#xA;add chain=input comment=&quot;allow l2tp&quot; dst-port=1701 protocol=udp&#xA;add chain=input comment=&quot;allow sstp&quot; dst-port=443 protocol=tcp&#xA;add chain=input comment=&quot;web access for config&quot; dst-port=80 in-interface=ether1-gateway log=yes log-prefix=remote-access protocol=tcp&#xA;add action=drop chain=input comment=&quot;default configuration&quot; in-interface=ether1-gateway&#xA;/ip firewall nat&#xA;add action=masquerade chain=srcnat comment=&quot;default configuration&quot; out-interface=ether1-gateway to-addresses=0.0.0.0&#xA;&#xA;# may/31/2016 23:03:52 by RouterOS 6.35.1&#xA;# software id = 8RIQ-2NZU&#xA;#&#xA;/ppp profile&#xA;add local-address=pptp-pool name=pptp-profile remote-address=pptp-pool&#xA;set *FFFFFFFE dns-server=0.0.0.0 use-compression=yes&#xA;/ppp secret&#xA;add name=USERNAME password=PASSWORD profile=pptp-profile service=pptp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;From the logs&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;20:20:35 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14320-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:20:35 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,PSH), 82.132.216.62:14320-&amp;gt;82.XXX.XXX.177:1723, len 220&#xA;20:20:35 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14320-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:20:35 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,PSH), 82.132.216.62:14320-&amp;gt;82.XXX.XXX.177:1723, len 76&#xA;20:20:35 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 60&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14320-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 59&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 50&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 48&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 98&#xA;20:20:36 pptp,ppp,info,account USERNAME logged in, 192.168.200.10&#xA;20:20:36 pptp,ppp,info &amp;lt;pptp-USERNAME&amp;gt;: authenticated&#xA;20:20:36 pptp,ppp,info &amp;lt;pptp-USERNAME&amp;gt;: terminating...&#xA;20:20:36 pptp,ppp,info,account USERNAME logged out, 1 18 28 3 4&#xA;20:20:36 pptp,ppp,info &amp;lt;pptp-USERNAME&amp;gt;: disconnected&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 50&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 44&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 50&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 44&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 74&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,FIN), 82.132.216.62:14320-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,FIN), 82.132.216.62:14320-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:20:36 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14320-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:20:41 system,info PPTP Server settings changed by admin&#xA;20:20:41 system,info PPTP Server settings changed by admin&#xA;20:20:43 pptp,info TCP connection established from 82.132.216.62&#xA;20:20:43 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (SYN), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 64&#xA;20:20:43 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:20:43 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,PSH), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 208&#xA;20:20:43 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:20:43 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,PSH), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 220&#xA;20:20:43 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:20:43 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,PSH), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 76&#xA;20:20:43 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 60&#xA;20:20:44 pptp,ppp,info,account USERNAME logged in, 192.168.200.10&#xA;20:20:44 pptp,ppp,info &amp;lt;pptp-USERNAME&amp;gt;: authenticated&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 59&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 50&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 48&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 98&#xA;20:20:44 pptp,ppp,info &amp;lt;pptp-USERNAME&amp;gt;: using encoding - MPPE128 stateless&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 50&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 44&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 50&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 50&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 50&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 62&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 54&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 56&#xA;20:20:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 62&#xA;20:20:45 pptp,ppp,info &amp;lt;pptp-USERNAME&amp;gt;: connected&#xA;20:20:45 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 50&#xA;20:20:45 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 334&#xA;20:20:48 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 334&#xA;20:20:51 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 334&#xA;20:20:54 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 334&#xA;20:20:57 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 334&#xA;20:21:04 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 48&#xA;20:21:04 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;20:21:24 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 48&#xA;20:21:25 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;20:21:44 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 48&#xA;20:21:45 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;20:22:04 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 48&#xA;20:22:06 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;20:22:24 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 48&#xA;20:22:27 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;20:22:32 pptp,ppp,info &amp;lt;pptp-USERNAME&amp;gt;: terminating...&#xA;20:22:32 pptp,ppp,info,account USERNAME logged out, 109 1568 98 14 8&#xA;20:22:32 pptp,ppp,info &amp;lt;pptp-USERNAME&amp;gt;: disconnected&#xA;20:22:32 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 57&#xA;20:22:32 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto 47, 82.132.216.62-&amp;gt;82.XXX.XXX.177, len 57&#xA;20:22:32 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,FIN), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:22:32 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,FIN), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;20:22:32 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 82.132.216.62:14321-&amp;gt;82.XXX.XXX.177:1723, len 52&#xA;22:00:44 firewall,info remote-access input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (SYN), 93.174.93.94:47264-&amp;gt;82.XXX.XXX.177:80, len 40&#xA;22:01:09 firewall,info remote-access input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (SYN), 61.240.144.64:48406-&amp;gt;82.XXX.XXX.177:80, len 40&#xA;22:09:42 firewall,info remote-access input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 94.102.49.54:22-&amp;gt;82.XXX.XXX.177:80, len 40&#xA;22:57:26 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (SYN), 123.151.149.222:22200-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;22:57:26 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (RST), 123.151.149.222:22200-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;22:57:26 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (RST), 123.151.149.222:22200-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;22:57:26 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (SYN), 123.151.42.61:17122-&amp;gt;82.XXX.XXX.177:1723, len 48&#xA;22:57:27 pptp,info TCP connection established from 123.151.42.61&#xA;22:57:27 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 123.151.42.61:17122-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;22:57:27 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,PSH), 123.151.42.61:17122-&amp;gt;82.XXX.XXX.177:1723, len 196&#xA;22:57:27 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 123.151.42.61:17122-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;22:57:27 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK,FIN), 123.151.42.61:17122-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;22:57:27 firewall,info input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (ACK), 123.151.42.61:17122-&amp;gt;82.XXX.XXX.177:1723, len 40&#xA;22:59:34 firewall,info remote-access input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (SYN), 141.212.122.151:47113-&amp;gt;82.XXX.XXX.177:80, len 40&#xA;22:59:34 firewall,info remote-access input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (SYN), 141.212.122.152:38568-&amp;gt;82.XXX.XXX.177:80, len 40&#xA;22:59:35 firewall,info remote-access input: in:ether1-gateway out:(none), src-mac 00:01:5c:82:ee:47, proto TCP (SYN), 141.212.122.145:45406-&amp;gt;82.XXX.XXX.177:80, len 60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have also enabled proxy-arp on the LAN connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know why I cant get traffic to route from VPN &gt; LAN.&lt;/p&gt;&#xA;" OwnerUserId="5980" LastEditorUserId="8499" LastEditDate="2018-02-14T16:22:21.273" LastActivityDate="2018-02-14T16:22:21.273" Title="Mikrotik PPTP VPN Setup" Tags="|routing|vpn|" AnswerCount="2" CommentCount="5" ClosedDate="2017-08-09T23:43:52.173" ContentLicense="CC BY-SA 3.0" />
  <row Id="30862" PostTypeId="2" ParentId="30857" CreationDate="2016-05-31T20:11:17.963" Score="4" Body="&lt;p&gt;(This came up on DSLR recently.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has to do with the way traffic is processed. Since the first fragment carries the full layer-4 information, it is not handled as a fragment. So, it will match rule 20, and a NAT/CEF/flow entry will be created for it and all subsequent fragments will not go through the ACL -- it's part of an established flow that's already been checked.  Unless you turn off &quot;route-cache&quot; -- thus making all packets process switched (very, very bad idea) -- every individual packet is not passed through the ACL.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-05-31T20:11:17.963" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="30864" PostTypeId="2" ParentId="23566" CreationDate="2016-05-31T22:36:39.173" Score="13" Body="&lt;p&gt;Historically, both EUI-48 and MAC-48 were concatenations of a 24-bit OUI (Organizationally Unique Identifier) assigned by the IEEE and a 24-bit extension identifier assigned by the organization with that OUI assignment (NIC). The subtle difference between EUI-48 and MAC-48 was not well understood; as a result, the term MAC-48 is now obsolete and the term EUI-48 is used for both (but the terms “MAC” and “MAC address” are still used).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, EUI-48 and the MAC number of a device represent the same thing! Usually it is represented in 12 hex (e.g. 0023.a34e.abc9), equivalent to 48 bits or 6 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By implementing the EUI-64 (64-bit Extended Unique Identifier format), a host can automatically assign itself a unique 64-bit IPv6 interface identifier without the need for manual configuration or DHCP. So it's an IPv6 matter. Anyway, if you are interested about how it's calculated, it is applied to a MAC address like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 48-bit MAC address is split in half, the hex group &lt;code&gt;FFFE&lt;/code&gt; is inserted in the middle (after the 24th bit), and the seventh most-significant bit is inverted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The MAC address    0021.86b5.6e10      (48 bit) becomes &#xA;the EUI-64 address 0221.86ff.feb5.6e10 (64 bit)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MAC-Large, MAC-Small and MAC-Medium (abbreviated MA-L, MA-S and MA-M) have the all the same size. The names refer instead to number of bits within a MAC that remain governed by organization as opposed to the OUI bits governed by IEEE. If 24 bits of a MAC are governed by an organization/vendor/manufacturer, it is called a MAC-Large (this is a traditional scheme discussed so far). If 20 bits, it's MAC-Medium. If 12 bits, it's MAC-Small.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It addresses serious exhaustion problem of MAC addresses. Think how many devices are produced each day!&lt;/p&gt;&#xA;" OwnerUserId="25736" LastEditorUserId="7824" LastEditDate="2020-03-13T15:14:21.843" LastActivityDate="2020-03-13T15:14:21.843" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="30867" PostTypeId="2" ParentId="30852" CreationDate="2016-05-31T23:15:32.160" Score="2" Body="&lt;p&gt;Make sure your port names and numbers match exactly between the old and new stacks. This means that for example, GigabitEthernet1/0/1 is on the top most switch and is actually named GigabitEthernet1/0/1 on both switches. Since this is 3750 to 3850, that shouldn't be a problem. You just want to make sure the top switch is 1, the second switch is 2, etc. on both stacks. You can use the show switch detail to make sure and the switch number (I think) command to make any changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where you might run into issues is if you use a different SFP port for your fiber uplink trunks. Make sure those are in the same ports to make porting the config easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set up a TFTP server on a PC and use the copy run tftp command to copy the config over to the PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set up an IP address on the 3850 stack (and gateway if the PC will be on a different network) and use the copy command (i.e. copy tftp newconfig) to copy it over to the new stack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe 3850s also have a USB port so you can play with putting the config on a thumb drive and copy from the USB port (disk0: I think) to the flash in the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do a copy newconfig start command to copy the new config to the startup-config which is what the switch will use when reloaded. newconfig is whatever you named the file when you copied it over. start is short for &quot;startup-config&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do a show start command to make sure the copy took.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do a reload command to reload the stack and monitor the reload for errors. There might be commands in the old config that have been changed or deprecated. Cisco usually does a good job of handling these assuming the 3850 is running a newer version of IOS than the 3750.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure you are connected to the switch via a console cable when you do all this. The same PC that the console cable is connected to can also be your TFTP server connected directly to the switch to make it easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also have license file issues to deal with. At the very least, make sure that if your 3750s were running IP Base, the 3850s are at also running IP Base or IP Services and not LAN Base. The 3750s will probably be running the IOS 12 train which I do not think uses the new license PAK scheme. The 3850s are probably running IOS 15 train which may need license codes to enable certain features.&lt;/p&gt;&#xA;" OwnerUserId="23610" LastActivityDate="2016-05-31T23:15:32.160" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30868" PostTypeId="1" AcceptedAnswerId="46678" CreationDate="2016-06-01T02:28:47.223" Score="2" ViewCount="298" Body="&lt;p&gt;I'm reading about fat tree and data center topologies, but I have doubts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To lower cost, &quot;normal&quot; tree is used sharing bandwidth to many hosts. 1:1 is not common, so we see something between 2.5:1 and 8:1. Is this thinking right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can fat tree ensure a large bandwidth to hosts? There is a way to tell a host in Pod0 can send a package to another host in Pod1 like 1:1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming 1 GigE switch for all tree.&lt;/p&gt;&#xA;" OwnerUserId="24252" LastEditorUserId="21048" LastEditDate="2016-06-25T11:30:26.213" LastActivityDate="2017-12-30T09:32:48.083" Title="How can fat tree ensure bandwidth?" Tags="|switch|layer2|layer3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30870" PostTypeId="1" AcceptedAnswerId="43311" CreationDate="2016-06-01T06:42:48.957" Score="1" ViewCount="512" Body="&lt;p&gt;CONTEXT: We are searching for WIFI AP able to broadcast UDP stream on a maximum number of connections: 10, 30, 50, 100, 150, 200 (guess the WIFI point is different in term of price and technology according the number of possible clients). The goal is to use a WIFI AP as radio antenna to broadcast an audio stream (48kHz Stereo 16bit &amp;lt; 3 Mbps).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;QUESTION:&#xA;What technology / criteria must be considered in modern WIFI point to be able&#xA;1- to broadcast 3 Mbps stream&#xA;2- to manage a big number of connections (50 to 250).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks by advance for your advises, experience feedback.&#xA;(does it change something if the broadcast stream is 500 Kbps instead of 3 Mbps)&lt;/p&gt;&#xA;" OwnerUserId="25795" LastEditorUserId="25795" LastEditDate="2016-06-01T07:13:20.127" LastActivityDate="2017-08-16T17:38:11.043" Title="What WIFI AP to broadcast 3 Mbps UDP stream?" Tags="|ieee-802.11|broadcast|streaming|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30871" PostTypeId="2" ParentId="30091" CreationDate="2016-06-01T06:58:51.020" Score="3" Body="&lt;p&gt;If the huntstop attribute is set, an incoming call does not roll over (hunt) to another ephone-dn when the called ephone-dn is busy or does not answer and a hunting strategy has been established that includes this ephone-dn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the no huntstop command is used on the ephone-dn, the call would ring on the first ephone-dn and go through any hunting defined on the two channels in a dual-line ephone-dn before being sent to the next most preferred ephone-dn that also has a matching destination pattern. This will continue until an ephone-dn with huntstop configured is reached or no more dial peers (ephone-dns) have matching destinations patterns. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference in configuration between overlaid ephone-dns with call waiting and overlaid ephone-dns without call waiting is that overlaid ephone-dns with call waiting use the &lt;strong&gt;c&lt;/strong&gt; keyword in the button command and overlaid ephone-dns without call waiting use the &lt;strong&gt;o&lt;/strong&gt; keyword.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Call waiting allows phone users to know that another person is calling them while they are talking on the phone. Phone users hear a call-waiting tone indicating that another party is trying to reach them. Calls to IP phones with soft keys can be answered with the Answer soft key.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example- &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Cisco Unified IP Phone 7910 (maximum two call-waiting calls) has a button configured with a set of overlaid ephone-dns with call waiting (button 1c1,2,3,4). A call to ephone-dn 1 is answered. A call to ephone-dn 2 generates call-waiting notification. Calls to ephone-dn 3 and ephone-dn 4 will wait in line and remain invisible to the phone user until one of the two original calls ends. When the call to ephone-dn 1 ends, the phone user can then talk to the person who called ephone-dn 2. The call to ephone-dn 3 issues call-waiting notification while the call to ephone-dn 4 waits in line&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following example demonstrates call waiting for overlaid ephone-dns that are&#xA;shared on two phones:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ephone 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;button 1c1,2,3,4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ephone 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;button 1c1,2,3,4&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;A call to ephone-dn 1 rings on ephone 1 and on ephone 2. Ephone 1 answers, and the call is no longer visible to ephone 2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A call to ephone-dn 2 issues a call-waiting notification to ephone 1 and rings on ephone 2, which answers. The second call is no longer visible to ephone 1. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A call to ephone-dn 3 issues a call-waiting notification to ephone 1 and ephone 2. Ephone 1 puts the call to ephone-dn 1 on hold and answers the call to ephone-dn 3. The call to ephone-dn 3 is no longer visible to ephone 2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A call to ephone-dn 4 is issues a call-waiting notification on ephone 2. The call is not visible on ephone 1 because it has met the two-call maximum by handling the calls to ephone-dn 1 and ephone-dn 3. (Note that the call maximum is six for those phones that are able to handle six call-waiting calls, as previously described.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are a few more differences between seperator &lt;strong&gt;o&lt;/strong&gt; and &lt;strong&gt;c&lt;/strong&gt;.&#xA;For further explanation you can check &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucme/admin/configuration/guide/cmeadm.pdf&quot; rel=&quot;nofollow&quot;&gt;SRND&lt;/a&gt; for CME. If there is still some confusion, please leave a comment. I can explain it to you.&lt;/p&gt;&#xA;" OwnerUserId="20572" LastActivityDate="2016-06-01T06:58:51.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30874" PostTypeId="1" CreationDate="2016-06-01T08:54:28.863" Score="1" ViewCount="63" Body="&lt;p&gt;A fairly basic SSL question, if you don't mind:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say I have traffic flow from a client to a web server as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[client] --&gt; [public SLB:80] --&gt; [reverse proxy:80] --&gt; [internal SLB:80] --&gt; [webserver:443]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will parts of the traffic as it traverse this topology be unencrypted or will the SSL handshake succeed when a request finally lands at the web server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to determine if I need SSL certs installed on each device in the chain.&lt;/p&gt;&#xA;" OwnerUserId="25800" LastEditorUserId="8499" LastEditDate="2018-02-16T04:21:33.077" LastActivityDate="2018-02-16T04:21:33.077" Title="SSL handshake across multiple proxies and SLBs" Tags="|network|" AnswerCount="1" CommentCount="1" ClosedDate="2016-06-01T19:16:53.797" ContentLicense="CC BY-SA 3.0" />
  <row Id="30876" PostTypeId="2" ParentId="30874" CreationDate="2016-06-01T09:11:34.173" Score="1" Body="&lt;p&gt;It all depends on your SLB and proxy configuration, each of these elements can decrypt SSL or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of these intermediate elements requires SSL decryption/termination for it's basic operations. All of these elements could do it for deep packet inspection, either for security or optimized load balancing reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming :80 port on the end of the node signifies these are all HTTP LBs/proxies and assuming these elements allow for &lt;a href=&quot;https://en.wikipedia.org/wiki/HTTP_tunnel#HTTP_CONNECT_tunneling&quot; rel=&quot;nofollow&quot;&gt;HTTP Connect tunneling&lt;/a&gt;, the client will ask an HTTP Proxy to forward the TCP connection to the desired destination. Client will than establish direct SSL session with the webserver through that TCP &quot;tunnel&quot;, so you need no SSL certificates on intermediate nodes.&lt;/p&gt;&#xA;" OwnerUserId="25723" LastActivityDate="2016-06-01T09:11:34.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30878" PostTypeId="2" ParentId="30870" CreationDate="2016-06-01T11:14:04.240" Score="1" Body="&lt;p&gt;You need an access point that is capable of multicasting.  Otherwise, you will run out of channel capacity long before you exceed the access point capabilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireless clients will send and receive a various data rates depending on the distance from the access point (i.e. signal strength).  The capacity of the channel is only as fast as the slowest client.  So if you have a few clients who are operating at a low data rate (say 9Mb), you can only get three streams, as you are sending separate data streams to each client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With multicast (actually a broadcast at layer 2), you are only sending one stream that everyone listens to.  Only commercial grade access points can do multicast.  this also assumes your data source and infrastructure can also do multicast.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-01T11:14:04.240" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30879" PostTypeId="1" AcceptedAnswerId="30889" CreationDate="2016-06-01T12:04:28.230" Score="0" ViewCount="81" Body="&lt;p&gt;In a LAN network with multiple Access Points, if one of them is awful, broken or old, will the others, shiny new and happy, be hurt? Will the entire network be affected somehow by that bad AP?&lt;/p&gt;&#xA;" OwnerUserId="1922" LastActivityDate="2016-06-01T14:47:43.223" Title="Can one WIFI AP affect the others' performance?" Tags="|lan|access-point|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30881" PostTypeId="1" CreationDate="2016-06-01T12:13:15.887" Score="1" ViewCount="52" Body="&lt;p&gt;Glue servers, apparently appear in the parent of the domain. How can these be queried, when for the last few months ISPs have been blocking access to the nameserver ports due to DoS attacks with spoofed UDP packets? Or is this no longer possible?&lt;/p&gt;&#xA;" OwnerDisplayName="user25806" LastActivityDate="2016-06-01T12:51:36.990" Title="How do you check glue records if your ISP blocks access to the root servers?" Tags="|dns|" AnswerCount="1" CommentCount="2" ClosedDate="2016-06-01T19:18:00.643" ContentLicense="CC BY-SA 3.0" />
  <row Id="30882" PostTypeId="2" ParentId="30881" CreationDate="2016-06-01T12:51:36.990" Score="3" Body="&lt;p&gt;Change your ISP. Blocking access to root DNS servers with &quot;DoS prevention&quot; is not something a serious ISP would practice (unless you live in a country with government regulations in place).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, &lt;a href=&quot;https://mebsd.com/glue&quot; rel=&quot;nofollow&quot;&gt;use a web service.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25723" LastActivityDate="2016-06-01T12:51:36.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30883" PostTypeId="1" AcceptedAnswerId="30885" CreationDate="2016-06-01T13:16:20.257" Score="0" ViewCount="125" Body="&lt;p&gt;Im new here and just starting to learn about windows server, i'm very curious to   know regarding the physical topology of a server based network (windows), lets say i want to install a complete feature of a windows server, what would be the physical connection be look like?&lt;br&gt;&#xA;  I made a sample diagram but do not know if its correct. Hope you can enlighten me up. thank you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uLQPD.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uLQPD.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25808" LastActivityDate="2016-06-01T14:06:41.193" Title="Windows Server Physical Connection" Tags="|topology|" AnswerCount="1" CommentCount="1" ClosedDate="2016-06-01T19:18:25.110" ContentLicense="CC BY-SA 3.0" />
  <row Id="30884" PostTypeId="1" CreationDate="2016-06-01T13:26:54.180" Score="5" ViewCount="750" Body="&lt;p&gt;Could the ASA 5505 do a site to site VPN and still have client connected through IPSec VPN ( any connect clients ) at the same time ? I am having issues with clients not able to access local network and loosing internet in their computers once they are connected to IPSec VPN. It might be a firewall issue that I don't have much experience in, but I mentioned the site to site because this issue occurred after we established a VPN site to site connection with our other location ( Using D-Link DSR-250 on the other site if that matters ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for the help &lt;/p&gt;&#xA;" OwnerUserId="25809" LastEditorUserId="8499" LastEditDate="2018-03-22T17:35:55.123" LastActivityDate="2018-03-22T18:01:34.820" Title="ASA 5505 site to site VPN" Tags="|cisco|cisco-asa|vpn|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30885" PostTypeId="2" ParentId="30883" CreationDate="2016-06-01T14:06:41.193" Score="1" Body="&lt;p&gt;It would go modem &gt; firewall/router &gt; switch &gt; server/workstations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the workstations and servers would be plugged into the switch.&lt;/p&gt;&#xA;" OwnerUserId="25787" LastActivityDate="2016-06-01T14:06:41.193" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30886" PostTypeId="2" ParentId="30860" CreationDate="2016-06-01T14:10:58.337" Score="0" Body="&lt;p&gt;For this I now have it working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that you need to have on the ppp Secret , the internal local address of the microtik, and then you can either give a static IP for that profile, or assign it one from the DHCP pool you use for your local network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then make sure the proxy-arp is on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So an example for my setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Local network = 192.168.88.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secret:&#xA;User = USERNAME&#xA;password = PASSWORD&#xA;local address = 192.168.88.1&#xA;remote address = 192.168.88.10 (OR DHCP POOL)&lt;/p&gt;&#xA;" OwnerUserId="5980" LastActivityDate="2016-06-01T14:10:58.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30887" PostTypeId="2" ParentId="30879" CreationDate="2016-06-01T14:11:17.560" Score="1" Body="&lt;p&gt;Possibly if the AP is jumping channels constantly or isn't providing consistent connectivity to clients or the controller. Are the APs all from the same manufacturer?&lt;/p&gt;&#xA;" OwnerUserId="25787" LastActivityDate="2016-06-01T14:11:17.560" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30888" PostTypeId="1" AcceptedAnswerId="30892" CreationDate="2016-06-01T14:34:01.260" Score="7" ViewCount="303" Body="&lt;p&gt;I have been graphing ping (IPV4) responses times/vs packet size. I was expecting to see a discontinuity of around 2*MTU/BandWidth in response time around the MTU boundary (actually, around 1464 byte, MTU is 1492 on this particular segment). The rationale for my expectation is that,  2*MTU/BW being the roundtrip time of a packet with 1 MTU size, packet fragmentation will increase roundtrip times in steps of twice that amount.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alas, that's not what I see. Using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   # ping -f -c 30 -s $sz my.host&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I see a linear dependence between packet size and roundtrip like follows (size, min avg max, ms.), but no discontinuities of sort:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1159  40.575 41.778 47.200&#xA;1220  41.392 42.145 45.420&#xA;1281  41.921 43.461 46.974&#xA;1342  42.498 43.840 52.638&#xA;1403  42.813 44.037 49.272&#xA;1464  43.741 45.455 49.795&#xA;1525  45.382 50.406 59.891&#xA;1586  45.579 55.605 66.309&#xA;1647  47.498 53.464 64.518&#xA;1708  49.373 73.681 84.820&#xA;1769  49.726 80.030 101.057&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I do not know if I am being tripped by something in the way packets are being sent/reported or  if my reasoning is wrong some way or the other (and in these case where is the error).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's and ADSL llink to the internet that goes through 100MB wired ethernet, crosses a FGT60 and a zyxel on its way out, and tracepath (also ping -M do) report 1492 as MTU. I am testing from a FC22 linux box. I do not know, but it seems to me that the outside details of the network should not matter (much) viz. the qualitative result I am missing, because fragmentation should happen (at least) before leaving the local interface past the 1500 MTU mark (that's the ethernet connection MTU)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; And the (hidden) faulty piece of reasoning lies in equating the minimum transmission unit (which for tcpV4 over ethernet would be something around 64 bytes), lets call it the mTU, to the MTU - ie, in assuming that all packets will be padded to the MTU. That not being the case, the discontinuity due to fragmentation should be around mTU/Bw, around  20 times smaller than MTU/Bw and likely to be swallowed by the jitter due to varying network conditions&lt;/p&gt;&#xA;" OwnerUserId="20114" LastEditorUserId="8499" LastEditDate="2022-11-20T01:46:59.177" LastActivityDate="2022-11-20T01:46:59.177" Title="How are ping times computed" Tags="|internet|ping|icmp|fragmentation|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30889" PostTypeId="2" ParentId="30879" CreationDate="2016-06-01T14:47:43.223" Score="3" Body="&lt;p&gt;Access points don't &quot;wear out.&quot; Generally speaking, they either work or they don't.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That being said, if your old AP can't run newer protocols, it will keep others from operation at higher data rates.  A 802.11b AP will prevent newer APs from operating at g or n speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access points can (and will) interfere with each other if they are on the same channel and within range of each other.  A rule of thumb is to keep the signal level from an adjacent access point below -85 dBm within the cell area of the neighboring AP on the same channel.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-01T14:47:43.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30892" PostTypeId="2" ParentId="30888" CreationDate="2016-06-01T16:49:57.060" Score="5" Body="&lt;p&gt;I'm not sure why you would think fragmentation would double the time. If a router fragments a packet, it sends both fragments sequentially. The host on the other end will get the fragments, reassemble them, and reply. The increase in time for fragmentation should be fairly linear. It takes time for a router to fragment a packet, and it takes time for the receiving host to reassemble the fragments.&lt;/p&gt;&#xA;&lt;p&gt;Doubling the time would involve sending one fragment, getting a response, sending the next fragment, getting the response, and then reporting the time. That is not how it works.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 793, TRANSMISSION CONTROL PROTOCOL&lt;/a&gt;&lt;/em&gt;, explains how IP fragmentation works.&lt;/p&gt;&#xA;&lt;p&gt;You should also understand that ICMP (ping uses ICMP Echo and ICMP Echo Reply) is often treated differently than regular IP traffic on the Internet. It is usually low priority, and it will often be queued in favor of regular traffic, and it will be more sensitive to the variable congestion that happens. It may even take a different path than regular traffic. The added latency could end up dwarfing, by sever orders of magnitude, the latency induce by fragmentation. This can have the effect of smoothing the curve.&lt;/p&gt;&#xA;&lt;p&gt;The real way to test fragmentation is on a controlled environment to eliminate variables which are out of your control. Start testing with a point-to-point link between two hosts. Then, start to add devices (switches, routers, etc.) between the two devices, in controlled steps. Perform each test multiple times before changing the test environment. Testing on the Internet can give you unpredictable results since you have no control over the Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-06-01T16:49:57.060" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30894" PostTypeId="2" ParentId="30884" CreationDate="2016-06-01T19:59:00.580" Score="0" Body="&lt;p&gt;Yes, you can do both at the same time. Check your licensing as you may need the security plus license for a certain number of concurrent connections but for one S2S VPN and a handful of client connections you should be OK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing you want to look up is split tunneling. If you want your clients to use their local internet connection while connected to the VPN, split tunneling needs to be enabled. I can't remember the exact command off the top of my head but google cisco asa split tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than those things, what also causes issues is not NATing correctly like someone previously mentioned. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the packet tracer command in the CLI or packet tracer menu item in ASDM to help determine if traffic is being allowed in or out, if it's going through the VPN and is getting NATed like you want (or don't want) it to.&lt;/p&gt;&#xA;" OwnerUserId="23610" LastActivityDate="2016-06-01T19:59:00.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30896" PostTypeId="1" AcceptedAnswerId="30898" CreationDate="2016-06-01T21:47:17.610" Score="1" ViewCount="195" Body="&lt;p&gt;In a brand new out of the box switch, is the IOS already installed or it is auto installed when we power on the switch.&lt;/p&gt;&#xA;" OwnerUserId="25763" LastEditorUserId="4511" LastEditDate="2016-06-02T01:27:00.593" LastActivityDate="2019-01-22T23:24:46.667" Title="IOS in brand new switch" Tags="|cisco|switch|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30897" PostTypeId="2" ParentId="30852" CreationDate="2016-06-01T21:47:34.920" Score="0" Body="&lt;p&gt;RE the question about IOS being installed on out of the box switches. Yes, IOS is installed on out of the box switches. If you buy them all at the same time and the same place (and they're the same model) then they will most likely have the same IOS version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having the same (or very close) version helps when you're stacking the switches (using the stacking cables in back to turn 2 to 9 switches into a single unit). If the version numbers are too far apart, the switches will not stack and you may need to upgrade the IOS on the older versioned switches manually. There's an auto upgrade feature but it doesn't always work like &lt;em&gt;I&lt;/em&gt; would expect it to. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point here is that even though the switches might be stacked and act as one unit, each switch still has and needs its own version of IOS. Even when upgrading a stacked set of switches, you need to copy the IOS on to each separate switch. The following link is for 3750 switches and there may be a newer one for 3850s but I doubt it will be much different. This contains all sorts of commands and instructions for stacking upgrading and copying IOS files between switches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/64898-upgrade-3750-stack.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/64898-upgrade-3750-stack.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23610" LastActivityDate="2016-06-01T21:47:34.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30898" PostTypeId="2" ParentId="30896" CreationDate="2016-06-01T21:51:40.760" Score="3" Body="&lt;p&gt;Yes, IOS is installed on out of the box switches. If you buy them all at the same time and the same place (and they're the same model) then they will most likely have the same IOS version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having the same (or very close) version helps when you're stacking the switches (using the stacking cables in back to turn 2 to 9 switches into a single unit). If the version numbers are too far apart, the switches will not stack and you may need to upgrade the IOS on the older versioned switches manually. There's an auto upgrade feature but it doesn't always work like I would expect it to. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point here is that even though the switches might be stacked and act as one unit, each switch still has and needs its own version of IOS. Even when upgrading a stacked set of switches, you need to copy the IOS on to each separate switch. The following link is for 3750 switches and there may be a newer one for 3850s but I doubt it will be much different. This contains all sorts of commands and instructions for stacking upgrading and copying IOS files between switches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/64898-upgrade-3750-stack.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/64898-upgrade-3750-stack.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23610" LastActivityDate="2016-06-01T21:51:40.760" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30899" PostTypeId="1" CreationDate="2016-06-01T22:14:22.563" Score="3" ViewCount="448" Body="&lt;p&gt;I am willing to build a program that simulates the routing process of IPv6 packets over an IPv4 overlay network (tunnel). From what I have read so far I have understood that the IPv4 tunnel packets consists of appending the incoming IPv6 packet (header+data) to the header of a unique public IPv4. The facts are : IPv6 fixed header is 288 bits long while IPv4 header is only 160 bits. My question is : How would both IPv6 and IPv4 headers would fit at the same time in one IPv4 header?&lt;/p&gt;&#xA;" OwnerUserId="25816" LastEditorUserId="8499" LastEditDate="2018-03-11T01:59:01.783" LastActivityDate="2019-10-02T14:28:27.283" Title="IPv6 tunneling over IPv4" Tags="|ipv4|ip|ipv6|tunnel|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30900" PostTypeId="2" ParentId="30899" CreationDate="2016-06-01T22:27:03.723" Score="4" Body="&lt;p&gt;Tunneling involves encapsulating the packets to be tunneled inside an outer packet. The tunneled packets are the payload of the encapsulating packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will be creating a new IPv4 packet header to encapsulate the IPv6 packets, just as if the IPv6 packets were TCP segments. The new IPv4 packet headers don't really care what is in the payload, other than to set the Protocol field of the IPv4 header.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-01T22:27:03.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30902" PostTypeId="2" ParentId="30737" CreationDate="2016-06-01T22:55:46.297" Score="3" Body="&lt;p&gt;According to the Cisco TAC representative who handled my case, there is no way to get a list of users that includes their last login date, with the possible exception of looking up each user individually.  I'm not sure I believe this answer, as it seems like such a basic query that I'd be very surprised if they didn't include any way to get the answer, but that is the word from Cisco themselves.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am going to persist in trying to find a way to get that list, and if I succeed, I will update this answer.&lt;/p&gt;&#xA;" OwnerUserId="21451" LastActivityDate="2016-06-01T22:55:46.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30903" PostTypeId="2" ParentId="30884" CreationDate="2016-06-02T04:24:12.667" Score="0" Body="&lt;p&gt;As mentioned split tunneling is required, to tunnel all networks, but local net use the following;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;create standard acl:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list Local-NET standard permit host 0.0.0.0&#xA;!&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;via your group-policy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;split-tunnel-policy excludespecified&#xA;split-tunnel-network-list value Local-NET&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25820" LastEditorUserId="8499" LastEditDate="2017-07-27T13:57:12.953" LastActivityDate="2017-07-27T13:57:12.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30904" PostTypeId="2" ParentId="27892" CreationDate="2016-06-02T04:25:45.783" Score="0" Body="&lt;p&gt;MGBLX1 is the 1000BASE-LX SFP transceiver, designed for SMF with 1310nm wavelength, and GLC-LH-SMD is 1000BASE-LX/LH SFP transceiver for both MMF and SMF, also 1300-nm wavelength, with DOM support, dual LC/PC connector. It's obvious that these two modules are compatible. It seems that you can go on your project for sure.&lt;/p&gt;&#xA;" OwnerUserId="24837" LastActivityDate="2016-06-02T04:25:45.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30905" PostTypeId="2" ParentId="30829" CreationDate="2016-06-02T08:39:46.380" Score="6" Body="&lt;p&gt;Sadly the EX4200 (or any EX) is not able to do this. You would need a separate logical unit for the VLAN which has its own VLAN counters. This works for example on Junipers MX routers but not on EX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you can do however is count the packets and bytes with a firewall filter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an working example here, for VLANS 14, 571, 572. You can of course use any VLAN IDs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the filter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;firewall {&#xA;    family ethernet-switching {&#xA;        filter vlan-counters {&#xA;            interface-specific;&#xA;            term vlan-14 {&#xA;                from {&#xA;                    dot1q-tag 14;&#xA;                }&#xA;                then {&#xA;                    accept;&#xA;                    count vlan-14;&#xA;                }&#xA;            }&#xA;            term vlan-571 {&#xA;                from {&#xA;                    dot1q-tag 571;&#xA;                }&#xA;                then {&#xA;                    accept;&#xA;                    count vlan-571;&#xA;                }&#xA;            }&#xA;            term vlan-572 {&#xA;                from {&#xA;                    dot1q-tag 572;&#xA;                }&#xA;                then {&#xA;                    accept;&#xA;                    count vlan-572;&#xA;                }&#xA;            }&#xA;            term default {&#xA;                then accept;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see we have a separate term for each VLAN we want to count and a &lt;code&gt;default&lt;/code&gt; term at the end. This is important as without that last term traffic for other VLANs would be dropped. The &lt;code&gt;interface-specific&lt;/code&gt; keyword tells the switch to generate separate counters for each interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can apply this filter to your interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;set interfaces ae0.0 family ethernet-switching filter input vlan-counters &#xA;set interfaces ae0.0 family ethernet-switching filter output vlan-counters &#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that you can see the counters in the &lt;code&gt;show firewall&lt;/code&gt; output. Note that they have interface-specific extensions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Filter: vlan-counters-ae1.0-i                                  &#xA;Counters:&#xA;Name                                                Bytes              Packets&#xA;vlan-14-ae1.0-i                                   7474383                 8504&#xA;vlan-571-ae1.0-i                                        0                    0&#xA;vlan-572-ae1.0-i                                        0                    0&#xA;&#xA;Filter: vlan-counters-ae1.0-o                                  &#xA;Counters:&#xA;Name                                                Bytes              Packets&#xA;vlan-14-ae1.0-o                                   2651051                 4919&#xA;vlan-571-ae1.0-o                                  2057853                14731&#xA;vlan-572-ae1.0-o                                      644                   10&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Last but not least the SNMP part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet and byte counters displayed above are visible in SNMP under the &lt;code&gt;JUNIPER-FIREWALL-MIB::jnxFWCounterPacketCount&lt;/code&gt; and &lt;code&gt;JUNIPER-FIREWALL-MIB::jnxFWCounterByteCount&lt;/code&gt; tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;$ snmpget -v2c -cpublic 10.1.2.3 'JUNIPER-FIREWALL-MIB::jnxFWCounterByteCount.&quot;vlan-counters-ae1.0-o&quot;.&quot;vlan-571-ae1.0-o&quot;.counter&#xA;JUNIPER-FIREWALL-MIB::jnxFWCounterByteCount.&quot;vlan-counters-ae1.0-o&quot;.&quot;vlan-571-ae1.0-o&quot;.counter = Counter64: 298848&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If your program does not understand the encoded form of the OID you can translate it to the numeric form with the snmptranslate utility:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;$ snmptranslate -On 'JUNIPER-FIREWALL-MIB::jnxFWCounterByteCount.&quot;vlan-counters-ae1.0-o&quot;.&quot;vlan-571-ae1.0-o&quot;.counter'&#xA;.1.3.6.1.4.1.2636.3.5.2.1.5.21.118.108.97.110.45.99.111.117.110.116.101.114.115.45.97.101.49.46.48.45.111.16.118.108.97.110.45.53.55.49.45.97.101.49.46.48.45.111.2&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="59" LastEditorUserId="59" LastEditDate="2016-06-02T08:52:31.347" LastActivityDate="2016-06-02T08:52:31.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30906" PostTypeId="2" ParentId="29320" CreationDate="2016-06-02T08:55:49.117" Score="1" Body="&lt;p&gt;40G QSFP+ cables can be divided into two types—40G QSFP+ to QSFP+ cable or 40G QSFP+ to 4SFP+ breakout cable. The 40G QSFP to 4SFP+ breakout cable Can be used in different hosts. &lt;/p&gt;&#xA;" OwnerUserId="24835" LastActivityDate="2016-06-02T08:55:49.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30908" PostTypeId="2" ParentId="30748" CreationDate="2016-06-02T11:03:44.733" Score="3" Body="&lt;p&gt;Your question is lacking quite a bit of detail before a specific answer can be crafted. A diagram of your current equipment setup would help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given your question is about how basic routing works and you mention both locations have WiFi, i am going to assume that your network consists of 2 wireless routers, both are performing NAT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried to minimize the technical terms, since i believe it would confuse you, however the price of this decision is ambiguity and lack of detail. Regardless i think this will serve you better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a simple diagram of what i assume your network looks like:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LCa0P.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LCa0P.png&quot; alt=&quot;Network Layout&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible for a PC/smartphone on the remote site to be assigned a private IP (192.168.2.x) and use it for both Internet and Intranet access? If yes, how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Answer 1: Intranet access&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;yes it is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the client device associates with the remote location AP/Router, the DHCP server in that device will issue an IP address to the client. It will also specify a default gateway for the client to use.&#xA;On the diagram i show the client device has been assigned IP: 192.168.2.2 and gateway: 192.168.2.1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to know the function of the default gateway to understand how the client can access other networks. Here is how it works. The client can talk DIRECTLY to any other host that is on the LAN side of the remote location AP/Router. That is any host with an IP address in the range: 192.168.2.1-192.168.2.254.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the client (a host) with IP: 192.168.2.2 wants to access your file server (another host) with IP: 192.168.1.100.&#xA;Clearly 192.168.1.100 is not part of the &quot;192.168.2.1-192.168.2.254&quot; range. As a result the client cannot talk directly to the file server. Anytime a host cannot talk directly to another it uses the default gateway address (oversimplification, but routing tables is outside the scope of this question), in this case 192.168.2.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the request to get to 192.168.1.100 arrives at the remote location AP/Router, because its LAN side IP acts as the default gateway for the client. The router looks at who the client wants to talk to, then looks at the IP ranges the AP/router can talk directly to. The router has 2 ranges, one on the WAN side and one on the LAN side. The router can talk directly to the following ranges: &quot;192.168.1.1-192.168.1.254&quot; and &quot;192.168.2.1-192.168.2.254&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a match! 192.168.1.100 is inside the &quot;192.168.1.1-192.168.1.254&quot; range, the router now relays the request to the file server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Answer 1: Internet access&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again yes it is possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same example as above, however instead of requesting data from the file server (192.168.1.100) the client wants access to Google. Google has IP: 216.58.208.4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client device compares and determines that 216.58.208.4 is outside any range it can talk to directly, send the request to its default gateway (remote AP/Router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The remote AP/Router does the same comparison. Before it found that it could talk directly to the file server, however in this case it cannot talk directly to Google. So it does the same as the client, it forwards the request to its default gateway, in this case the default gateway (192.168.1.1) is the LAN side of the &quot;local AP/Router&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the &quot;local AP/Router&quot; receives the request and does the same comparison. It also realizes that it cannot talk directly to 216.58.208.4 and send the request on to the default gateway it received from the ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this way the request from the client keeps bouncing from router to router until it reaches a router that can talk directly to Google.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Info:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because i assume your setup is quite simple it is important to note that if the client and file server switched places the client would not be able to reach the file server. I.e. client associated with &quot;local AP/Router&quot; and file server connected on the LAN of the &quot;remote AP/Router&quot;. This is because &quot;local AP/Router&quot; has no knowledge of the 192.168.2.1-192.168.2.254 range and would as a result relay the request to the ISP (&quot;away&quot; from the file server), who will drop the request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering that the remote site and main office has different address range, is it possible for the Intranet to even exist in the first place?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Answer 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like others have commented, an intranet is simply a network where the resources (like a file server) can only be accessed from within the network. That is opposed to the Internet where the resources are available to the public.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The amount of sub nets is irrelevant. &lt;/p&gt;&#xA;" OwnerUserId="25825" LastActivityDate="2016-06-02T11:03:44.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30909" PostTypeId="1" CreationDate="2016-06-02T13:53:54.363" Score="7" ViewCount="6259" Body="&lt;p&gt;I am in the process of replacing some older Dell Powerconnect switches with a some Dell N2048 switches. While doing this I wanted to go ahead and segregate certain areas of my network using VLANs. Here is a simple example of what I'm trying to do:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN1: default, not used&lt;br /&gt;&#xA;VLAN10: network devices (printers, servers, etc)&lt;br /&gt;&#xA;VLAN20: Sales workstations&lt;br /&gt;&#xA;VLAN30: Support workstations&lt;br /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;etc&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have routing enabled on each of the VLAN interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I have the VLANs setup and I have the required ports set to 'Access' mode and 'untagged' with the PVID set to the appropriate VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The global gateway is set to the IP of the router. (I tried setting to the interface of the VLAN that has the network devices but it did not accept that IP) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On VLAN10 I have a port that goes to my firewall / router (Watchguard M300).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this setup I'm able to reach other workstations in the same VLAN and anybody on VLAN10 is able to reach out to the internet. Other VLANs cannot get to the internet and cannot reach other VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I set the router up with routes between the VLANs, I can then communicate across the VLANs with no issue and everyone can get to the internet. But, that is not what I want. I want the routing to be handled in the switch itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, what am I missing that is preventing inter-VLAN routing from taking place in the switch itself? I'm assuming I'm just missing something simple but for the life of me I can't figure it out. I've read through the quick-start guide, through the user guide, and watched several Dell youtube videos but I'm not finding anything that helps me out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;-- &#xA;Some additional setup information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router is on VLAN10 (router ip 192.168.10.25, switchport 1/0/1). It (router) is configured with an external interface for the internet and a single internal trusted interface that connects to the switch. Right now it has two routes defined: one points to VLAN10 and one points to VLAN20. The gateway for both of those routes is the IP for the VLAN10 interface (192.168.10.16).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;console#show vlan&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;VLAN   Name                             Ports          Type&lt;br/&gt;&#xA;  -----  ---------------                  -------------  --------------&lt;br/&gt;&#xA;  1      default                          Po1-128,       Default&lt;br/&gt;&#xA;                                         Gi1/0/1,&lt;br/&gt;&#xA;                                         Gi1/0/4-48,&lt;br/&gt;&#xA;                                         Te1/0/1-2&lt;br/&gt;&#xA;  10     Corporate                        Gi1/0/2        Static&lt;br/&gt;&#xA;  20     Network and DevOps               Gi1/0/3        Static&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;console&gt;show ip interface&lt;br/&gt;&#xA;  Default Gateway................................ 192.168.10.25&lt;br/&gt;&#xA;  L3 MAC Address................................. F48E.380A.9AB8&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Routing Interfaces:&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Interface    State   IP Address      IP Mask         Method&lt;br/&gt;&#xA;  ----------   -----   --------------- --------------- -------&lt;br/&gt;&#xA;  Vl1          Down    0.0.0.0         0.0.0.0         DHCP&lt;br/&gt;&#xA;  Vl10         Up      192.168.10.16   255.255.255.0   Manual&lt;br/&gt;&#xA;  Vl20         Up      192.168.11.1    255.255.255.0   Manual&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;console&gt;show dot1x&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Administrative Mode............... Disabled&lt;br/&gt;&#xA;  Dynamic VLAN Creation Mode........ Disabled&lt;br/&gt;&#xA;  VLAN Assignment Mode.............. Disabled&lt;br/&gt;&#xA;  Monitor Mode...................... Disabled&lt;br/&gt;&#xA;  EAPOL Flood Mode.................. Disabled&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Port      Admin Mode         Oper Mode               Reauth   Reauth&lt;br/&gt;&#xA;                                                       Control  Period&lt;br/&gt;&#xA;  --------- ------------------ ----------------------- -------- ----------&lt;br/&gt;&#xA;  Gi1/0/1   auto               N/A                     FALSE    3600&lt;br/&gt;&#xA;  Gi1/0/2   auto               Authorized              FALSE    3600&lt;br/&gt;&#xA;  Gi1/0/3   auto               Authorized              FALSE    3600&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;console#show ip route&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Route Codes: R - RIP Derived, O - OSPF Derived, C - Connected, S - Static&#xA;         B - BGP Derived, E - Externally Derived, IA - OSPF Inter Area&#xA;         E1 - OSPF External Type 1, E2 - OSPF External Type 2&#xA;         N1 - OSPF NSSA External Type 1, N2 - OSPF NSSA External Type 2&#xA;         S U - Unnumbered Peer, L - Leaked Route&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Indicates the best (lowest metric) route for the subnet.&lt;br/&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;No default gateway is configured. {NOTE: THIS WAS 192.168.10.25. Removed it to see if that would have any impact.}&lt;br/&gt;&#xA;  C      *192.168.10.0/24 [0/1] directly connected,   Vl10&lt;br/&gt;&#xA;  C      *192.168.11.0/24 [0/1] directly connected,   Vl20&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;console#show ip vlan &lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;MAC Address used by Routing VLANs:   F48E.380A.9AB8&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       Logical&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;VLAN ID   Interface        IP Address       Subnet Mask&lt;br/&gt;&#xA;  -------  --------------  ---------------  ---------------&lt;br/&gt;&#xA;  1        Vl1             0.0.0.0          0.0.0.0&lt;br/&gt;&#xA;  10       Vl10            192.168.10.16    255.255.255.0&lt;br/&gt;&#xA;  20       Vl20            192.168.11.1     255.255.255.0&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;console#show ip brief&lt;br/&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Default Time to Live........................... 64&lt;br/&gt;&#xA;  Routing Mode................................... Enabled&lt;br/&gt;&#xA;  ICMP Rate Limit Interval....................... 1000 msec&lt;br/&gt;&#xA;  ICMP Rate Limit Burst Size..................... 100 messages&lt;br/&gt;&#xA;  ICMP Echo Replies.............................. Enabled&lt;br/&gt;&#xA;  ICMP Redirect Mode............................. Enabled&lt;br/&gt;&#xA;  Maximum Next Hops.............................. 1&lt;br/&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="25828" LastEditorUserId="25828" LastEditDate="2016-06-02T14:22:55.737" LastActivityDate="2024-03-14T13:07:31.023" Title="Why is routing not working on my Dell N2048 switch" Tags="|routing|switch|vlan|dell|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="30911" PostTypeId="2" ParentId="30909" CreationDate="2016-06-02T15:57:06.510" Score="0" Body="&lt;p&gt;On the Dell N2000 series, IP routing is disabled by default and needs to be enabled.&lt;/p&gt;&#xA;&lt;p&gt;Try adding &lt;code&gt;ip routing&lt;/code&gt; or &lt;code&gt;routing&lt;/code&gt; via the configuration command line as several major Ethernet switching manufacturers, including Cisco, have ip routing disabled by default.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="36720" LastEditDate="2023-06-18T09:05:17.370" LastActivityDate="2023-06-18T09:05:17.370" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="30913" PostTypeId="2" ParentId="20133" CreationDate="2016-06-02T18:31:16.790" Score="4" Body="&lt;p&gt;Honestly, it's unthinkable for an Ethernet port not to have an individual MAC address. For a lot of reasons... LAN communication, port-channel, etc. But let's doubt it, in the world of machines everything is possible! You could check that, you have a bunch of &lt;strong&gt;show&lt;/strong&gt; commands there:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show interfaces detail&lt;/strong&gt; {&lt;strong&gt;ethernet&lt;/strong&gt; interface | &lt;strong&gt;port-channel&lt;/strong&gt; port-channel-number}, where&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;• interface — A valid Ethernet port. &#xA;• port-channel-number — A valid port-channel trunk index. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Even &lt;strong&gt;show bridge address-table&lt;/strong&gt; [&lt;strong&gt;vlan&lt;/strong&gt; vlan ] [&lt;strong&gt;ethernet&lt;/strong&gt; interface | &lt;strong&gt;port-channel&lt;/strong&gt; port-channel-number ] could help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end, the output of the &lt;strong&gt;show tech-support&lt;/strong&gt; command combines the output of a lot of other  commands. Of course, it's verbose and you have to scroll it, but you need that MAC! :)&lt;/p&gt;&#xA;" OwnerUserId="25734" LastActivityDate="2016-06-02T18:31:16.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30915" PostTypeId="1" AcceptedAnswerId="30917" CreationDate="2016-06-02T20:18:22.580" Score="-1" ViewCount="11221" Body="&lt;p&gt;What is the difference between Half duplex and Full duplex in Transmission mode?&lt;/p&gt;&#xA;" OwnerUserId="25838" LastActivityDate="2018-11-19T02:11:31.223" Title="Difference between Half duplex and Full duplex" Tags="|duplex|half-duplex|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30917" PostTypeId="2" ParentId="30915" CreationDate="2016-06-02T20:44:39.500" Score="2" Body="&lt;p&gt;Half duplex can not send and receive at the same time. It also has algorithms to detect and handle collisions (CSMA-CD). Think of it like a walkie talkie or a CB radio, only on a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full duplex can send and receive at the same time. Think of it as a telephone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One issue that can arise is sometimes you will see a 100 Mbps half duplex connection which should almost never happen. Since the 100 Mbps connection will most likely not be detecting collisions (it expects to be full duplex), it can be very very slow. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This normally happens when one side is hard set to 100/full and the other side is set to autonegotiate. The side that is set at auto will not be able to sense what the duplex is (because the other side is hard set) and use half duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, while you will see 10/half quite often on older equipment, be very very suspect if you see 100/half because you are probably looking at a duplex mismatch.&lt;/p&gt;&#xA;" OwnerUserId="23610" LastActivityDate="2016-06-02T20:44:39.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30918" PostTypeId="1" AcceptedAnswerId="32011" CreationDate="2016-06-02T22:56:24.893" Score="2" ViewCount="1958" Body="&lt;p&gt;This is very odd problem so place stay with me because it's very strange issue.&lt;/p&gt;&#xA;&lt;p&gt;We have C3850 L3 core switch and we have created VLAN interface on it and we are using it for L3 routing.&lt;/p&gt;&#xA;&lt;p&gt;I have other switches connected to C3850 core switches, so issue is if i send any traffic to any other server this switch forwarding that traffic to all its interface, just like SPAN port. ( We don't have any mirror session running on this switch)&lt;/p&gt;&#xA;&lt;p&gt;Does anybody see this kind of issue in network? look like L3 flooding.&lt;/p&gt;&#xA;&lt;p&gt;Look like this is happening Unicast Flooding: &lt;a href=&quot;https://en.wikipedia.org/wiki/Unicast_flood&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Unicast_flood&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;any idea what could be the issue of it?&lt;/p&gt;&#xA;&lt;h1&gt;Update:&lt;/h1&gt;&#xA;&lt;p&gt;After googling i found people saying reduce ARP timeout and increase MAC timeout, (Arp &amp;lt; Mac)&lt;/p&gt;&#xA;&lt;p&gt;Cisco default Arp timeout is 4 hour, and Mac timeout is 300s (5min).&lt;/p&gt;&#xA;&lt;p&gt;ARP timeout:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C3850#sh int port-channel 23 | in Timeout&#xA;  ARP type: ARPA, ARP Timeout 04:00:00 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;MAC timeout:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;C3850#show mac address-table aging-time&#xA;Vlan    Aging Time  Configured Aging Time&#xA;----    ----------  ---------------------&#xA;Global Vlan Admin Age: 300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Should i change these values? what is the best practice?&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-06-06T16:20:04.387" Title="vlan traffic flooding on all interface" Tags="|cisco|switch|vlan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30919" PostTypeId="1" AcceptedAnswerId="30920" CreationDate="2016-06-02T23:23:35.840" Score="1" ViewCount="4717" Body="&lt;p&gt;I have HSRP running on two L3 switch and i change priority to higher but it didn't failover, why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan30&#xA; description Internal_PrivateIP&#xA; ip address 10.5.0.2 255.255.248.0&#xA; no ip redirects&#xA; standby 5 ip 10.5.0.1&#xA; standby 5 priority 150&#xA; standby 5 authentication md5 key-chain foo&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SW2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan30&#xA; description Internal_PrivateIP&#xA; ip address 10.5.0.3 255.255.248.0&#xA; no ip redirects&#xA; standby 5 ip 10.5.0.1&#xA; standby 5 priority 125&#xA; standby 5 authentication md5 key-chain foo&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have changed SW1 priority to &lt;code&gt;150&lt;/code&gt; but still it is showing standby&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vl30        5    150   Standby 10.5.0.3        local           10.5.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How do i force failover without network blip?&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2019-11-19T14:42:16.047" LastActivityDate="2019-11-19T14:42:16.047" Title="HSRP change priority didn't failover" Tags="|cisco|switch|failover|hsrp|fhrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30920" PostTypeId="2" ParentId="30919" CreationDate="2016-06-03T00:26:08.383" Score="6" Body="&lt;p&gt;You forgot to use the &lt;code&gt;standby 5 preempt&lt;/code&gt; command. It is also a good idea to set a preempt delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/hot-standby-router-protocol-hsrp/9281-3.html&quot; rel=&quot;noreferrer&quot;&gt;Hot Standby Router Protocol (HSRP): Frequently Asked Questions&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Q. Which HSRP router requires that I configure preempt?&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;A.&lt;/strong&gt; An HSRP-enabled router with preempt configured attempts to assume control as the active router when its Hot Standby priority is&#xA;  higher than the current active router. The &lt;strong&gt;standby preempt&lt;/strong&gt; command&#xA;  is needed in situations when you want an occurring state change of a&#xA;  tracked interface to cause a standby router to take over from the&#xA;  active router. For example, an active router tracks another interface&#xA;  and decrements its priority when that interface goes down. The standby&#xA;  router priority is now higher and it sees the state change in the&#xA;  hello packet priority field. If preempt is not configured, it cannot&#xA;  take over and failover does not occur.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-03T00:26:08.383" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="30921" PostTypeId="1" CreationDate="2016-06-03T03:22:36.740" Score="6" ViewCount="316" Body="&lt;p&gt;I'm Having problem with CRC on E1 interface, after I found clock slips, I have configured &quot;network-clock-participate wic&quot; and &quot;network-clock-select&quot;.  But I think that is not the cause of CRC, when I ping and packet loss occurs, its always 10 consecutive packets, and CRC counter increases accordingly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: No CRC on PE side. Provider has checked the SDH, it should be error free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any advice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CE#sh run | sec troller|clock|0/1/0&#xA;network-clock-participate wic 1 &#xA;network-clock-select 1 E1 0/1/0&#xA;controller E1 0/1/0&#xA; framing NO-CRC4 &#xA; channel-group 1 timeslots 1&#xA;interface Serial0/1/0:1&#xA; description WAN to CUP&#xA; ip address 172.16.192.110 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CE#ping 172.16.192.109 re 1000 &#xA;Type escape sequence to abort.&#xA;Sending 1000, 100-byte ICMP Echos to 172.16.192.109, timeout is 2 seconds:&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!..........!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;Success rate is 99 percent (990/1000), round-trip min/avg/max = 180/187/232 ms&#xA;CE#&#xA;&#xA;CE#ping 172.16.192.109  re 1000 si 1500&#xA;Type escape sequence to abort.&#xA;Sending 1000, 1500-byte ICMP Echos to 144.217.237.73, timeout is 2 seconds:&#xA;!!..........!!!!!!!!&#xA;&#xA;Success rate is 50 percent (10/20), round-trip min/avg/max = 548/551/576 ms&#xA;&#xA;&#xA;CE#sh controllers e1&#xA;E1 0/1/0 is up.&#xA;Applique type is Channelized E1 - balanced&#xA;No alarms detected.&#xA;alarm-trigger is not set&#xA;Version info FPGA Rev: 08121917, FPGA Type: PRK1&#xA;Framing is NO-CRC4, Line Code is HDB3, Clock Source is Line.&#xA;International Bit: 1, National Bits: 11111&#xA;Data in current interval (839 seconds elapsed):&#xA;0 Line Code Violations, 0 Path Code Violations&#xA;0 Slip Secs, 0 Fr Loss Secs, 0 Line Err Secs, 0 Degraded Mins&#xA;0 Errored Secs, 0 Bursty Err Secs, 0 Severely Err Secs, 0 Unavail Secs&#xA;Total Data (last 24 hours)&#xA;0 Line Code Violations, 0 Path Code Violations,&#xA;0 Slip Secs, 0 Fr Loss Secs, 0 Line Err Secs, 0 Degraded Mins,&#xA;1 Errored Secs, 1 Bursty Err Secs, 0 Severely Err Secs, 0 Unavail Secs&#xA;CE#&#xA;&#xA;&#xA;CE#sh int s0/1/0:1&#xA;Serial0/1/0:1 is up, line protocol is up &#xA;Hardware is DSX1&#xA;Description: WAN to CUP&#xA;Internet address is 172.16.192.110/30&#xA;MTU 1500 bytes, BW 64 Kbit/sec, DLY 20000 usec, &#xA;reliability 255/255, txload 1/255, rxload 1/255&#xA;Encapsulation HDLC, crc 16, loopback not set&#xA;Keepalive set (10 sec)&#xA;Last input 00:00:00, output 00:00:00, output hang never&#xA;Last clearing of &quot;show interface&quot; counters 00:37:09&#xA;Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;Queueing strategy: fifo&#xA;Output queue: 0/40 (size/max)&#xA;5 minute input rate 0 bits/sec, 0 packets/sec&#xA;5 minute output rate 0 bits/sec, 0 packets/sec&#xA;6046 packets input, 437043 bytes, 0 no buffer&#xA;Received 218 broadcasts (0 IP multicasts)&#xA;0 runts, 0 giants, 0 throttles &#xA;123 input errors, 123 CRC, 0 frame, 0 overrun, 0 ignored, 123 abort&#xA;6605 packets output, 528735 bytes, 0 underruns&#xA;0 output errors, 0 collisions, 0 interface resets&#xA;0 unknown protocol drops&#xA;0 output buffer failures, 0 output buffers swapped out&#xA;0 carrier transitions&#xA;CE#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25844" LastEditorUserId="25844" LastEditDate="2016-06-03T03:54:00.573" LastActivityDate="2016-06-03T03:54:00.573" Title="E1 over SDH, CRC increasing" Tags="|wan|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="30925" PostTypeId="2" ParentId="29054" CreationDate="2016-06-03T07:59:02.577" Score="0" Body="&lt;p&gt;It's true that some users turn to  copper transceivers in 10GbE transmission, since 10GBASE-T is backward compatible with existing 1000BASE-T networks, meaning that it be deployed based on existing 1GbE switch infrastructures in data centers that are cabled with CAT6 cabling,or just reverse. But there are some 10GbE SFP+ transceivers supporting dual rates of Gbit/s and 10Gbit/s, like Intel E10GSFPLR (1000BASE-LX and 10GBASE-LR SFP+ transceiver).&lt;/p&gt;&#xA;" OwnerUserId="24837" LastActivityDate="2016-06-03T07:59:02.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30926" PostTypeId="1" AcceptedAnswerId="30927" CreationDate="2016-06-03T09:34:38.880" Score="1" ViewCount="4379" Body="&lt;p&gt;I'm sorry if it's a silly question but in networking things I'm a complete newbie.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have some switches (DELL) two of them are connected with SFP (fiber) along a long hall, the rest are stacked via the old stacking cable behind the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1oYVT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1oYVT.png&quot; alt=&quot;Sketch of the network&quot;&gt;&lt;/a&gt;&#xA;Would be possible to buy Cisco Catalyst switches (or other brands) and stack/uplink them to the existing DELLs via SFP?, the idea would be to replace the old Dell ones (with the old stacking cable), but depending on the compatibility of the SFP to link the two switches via Fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A SFP works only with optic fiber?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for sharing your wisdom!&lt;/p&gt;&#xA;" OwnerUserId="25854" LastActivityDate="2017-10-16T07:39:44.920" Title="Is possible to stack/uplink different brands of switches using SFP?" Tags="|cisco|dell|sfp|stacking|uplinks|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30927" PostTypeId="2" ParentId="30926" CreationDate="2016-06-03T10:05:24.660" Score="7" Body="&lt;p&gt;Yes you can &lt;em&gt;uplink&lt;/em&gt; different brand of switches using SFP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The term &lt;em&gt;stacking&lt;/em&gt; in this context means that several switches act as a single one. This is always a proprietary (and model dependent) feature, and can be done only with switches of the same brand (and not all of them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SFP doesn't work only with fiber:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;there SFP to copper converters, so you can use UTP cable between 2 SFP ports, or a standard NIC to a SFP port.  I'm not sure that this is supported on all switches, and when using SFP+ (10Gbs) ports this will downgrade to gigabit (1Gbs) as far as I know.  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/o7DNO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/o7DNO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;there's &quot;direct attach cable&quot;. Those are (generally coper) cables that have sfp(+) connectors on both end. They can be used on short distance (in the same room) and they exists for 10G speed. I'm not sure if they can be used  between switches of different brands.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dOSKo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dOSKo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-10-16T07:39:44.920" LastActivityDate="2017-10-16T07:39:44.920" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30928" PostTypeId="2" ParentId="30915" CreationDate="2016-06-03T10:11:11.453" Score="1" Body="&lt;p&gt;Half-duplex is used to describe communication where only... one side can talk at a time. Once one side has finished transmitting its data, the other side can respond. Only one node can talk at a time. If both try to talk at the same time, a collision will occur on the network. As you can understand, this method of communication is not very efficient and requires more time to send/receive larger amounts of data. Older networks used to work in half-duplex mode, due to the constraints of the network medium (coax cable) and hardware equipment (hubs). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full-duplex is used to describe communication where both sides are able to send and receive data at the same time. In these cases, there is no danger of a collision and therefore the transfer of data is completed much faster.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-06-03T10:11:11.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30929" PostTypeId="2" ParentId="30926" CreationDate="2016-06-03T10:16:40.827" Score="1" Body="&lt;p&gt;Yeah, the SFP on most enterprise switches is MOST COMMONLY used for a high-speed fibre uplink. They're there for that purpose. Obviously, you need the module to make it happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume by long haul you mean SM and not MM optical modules.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-06-03T10:16:40.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30935" PostTypeId="2" ParentId="30607" CreationDate="2016-06-03T12:58:42.480" Score="1" Body="&lt;p&gt;Here is how you accomplish a virtual MT instance acting as gateway for a bunch of VMs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ESXi:&#xA;Add 2 vSwitches. &#xA;The first one is called &quot;WAN&quot; and you add the physical NIC to that switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second is called &quot;LAN&quot; and has no physical interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure your virtual MT with 2 E1000 NICs, one connected to WAN and one to LAN. Boot the virtual MT and configure its interfaces. In the following example I will assume the MT interface &quot;Ether1&quot; is connected to the WAN and &quot;Ether2&quot; is in LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure Ether1 with 192.168.1.151/24 (or another open address). &#xA;I assume the physical MT device acts as gateway for the network and has address 192.168.1.1. Therefore your setup the default gateway on the virtual MT as 192.168.1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next we configure Ether2 with IP: 192.168.2.1/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are now done configuring the virtual MT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now change the &quot;Virtual Domain Controller&quot; and &quot;Virtual Linux Server&quot; so their NICs are bound to the &quot;LAN&quot; vSwitch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last you add a static route on the &lt;strong&gt;physical&lt;/strong&gt; MT:&#xA;DST Address: 192.168.2.0/24&#xA;Gateway: 192.168.1.151 (or what ever open address you assigned Ether1 on the virtual MT)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's it now you can reach the VM hosts and they can reach the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You question does not address this, but i would like to save you the frustration in case you want to setup a DHCP server on Ether2. It will not work unless you change the &quot;LAN&quot; vSwitch to allow promiscuous mode. That can be done in the vSwitch config.&lt;/p&gt;&#xA;" OwnerUserId="25825" LastActivityDate="2016-06-03T12:58:42.480" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30939" PostTypeId="2" ParentId="29252" CreationDate="2016-06-03T17:58:56.653" Score="0" Body="&lt;p&gt;WiFi Bridging, you need a wireless bridge.  Basically, you purchase 2 wireless bridges which are a type of access point with a directional antenna.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, each wireless bridge device will have a wired port (in addition to the wireless interface) that plugs in to the wired network.  However, there are dual mode access points that can both bridge and provide WLAN access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The wireless bridge typically needs to be placed with line of sight to the other bridge and are usually installed external (outside the building).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-06-03T17:58:56.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30940" PostTypeId="1" AcceptedAnswerId="30949" CreationDate="2016-06-03T19:40:03.060" Score="8" ViewCount="63391" Body="&lt;p&gt;I'm pinging from a Windows Box to a device that I rebooted.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PS C:\Users\administrador&amp;gt; ping 192.168.2.10&#xA;&#xA;Pinging 192.168.2.10 with 32 bytes of data:&#xA;Control-C&#xA;PS C:\Users\administrador&amp;gt; ping -t 192.168.2.10&#xA;&#xA;Pinging 192.168.2.10 with 32 bytes of data:&#xA;Request timed out.&#xA;Request timed out.&#xA;Request timed out.&#xA;Request timed out.&#xA;Request timed out.&#xA;Request timed out.&#xA;Request timed out.&#xA;Reply from 192.168.2.120: Destination host unreachable.&#xA;Reply from 192.168.2.120: Destination host unreachable.&#xA;Reply from 192.168.2.120: Destination host unreachable.&#xA;Reply from 192.168.2.120: Destination host unreachable.&#xA;Reply from 192.168.2.120: Destination host unreachable.&#xA;Reply from 192.168.2.120: Destination host unreachable.&#xA;Reply from 192.168.2.120: Destination host unreachable.&#xA;Reply from 192.168.2.120: Destination host unreachable.&#xA;Reply from 192.168.2.120: Destination host unreachable.&#xA;Reply from 192.168.2.120: Destination host unreachable.&#xA;&#xA;Ping statistics for 192.168.2.10:&#xA;    Packets: Sent = 17, Received = 10, Lost = 7 (41% loss),&#xA;Control-C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this, the host started to answer the ping probes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What's the difference between those answers?&lt;/li&gt;&#xA;&lt;li&gt;Why the ping result is showing only 41% loss instead of 100%?&lt;/li&gt;&#xA;&lt;li&gt;Is there any relation between the &quot;Destination host unreachable&quot;&#xA;answer and the fact that the machine is starting?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="15878" LastEditorUserId="8499" LastEditDate="2016-06-04T02:21:13.417" LastActivityDate="2019-09-26T16:11:13.787" Title="Difference between ping timed out and destination host unreachable" Tags="|ping|icmp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30942" PostTypeId="2" ParentId="30940" CreationDate="2016-06-03T20:17:01.310" Score="8" Body="&lt;p&gt;The &lt;code&gt;Request timed out.&lt;/code&gt; is while the destination MAC address is still in the source/router's ARP cache. The &lt;code&gt;Reply from 192.168.2.120: Destination host unreachable.&lt;/code&gt; is after the destination MAC address has timed out of the source/router's ARP cache, and the source/router no longer has, or can get, a MAC address for the destination. Eventually, the destination comes back up, and it responds to the ARP request of the source/router, and your ping is successful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to ask Microsoft about the &lt;code&gt;ping&lt;/code&gt; statistics. That is its version of &lt;code&gt;ping&lt;/code&gt;, and applications and end-device configurations are off-topic here. It seems to count any ICMP reply as a valid reply.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-04T03:35:51.023" LastActivityDate="2016-06-04T03:35:51.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30943" PostTypeId="1" AcceptedAnswerId="30970" CreationDate="2016-06-03T20:17:33.127" Score="1" ViewCount="710" Body="&lt;p&gt;TCP SYN for traceroute&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/27AyK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/27AyK.png&quot; alt=&quot;TCP-SYN Total length 58B - 14B eth - 20B IP - 24B TCP&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6UzcX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6UzcX.png&quot; alt=&quot;ICMP TTL-exceeded reply with Length field in ICMP header??&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;ICMP header shows&#xA;Length 243&#xA;[Length of original datagram: 972]&lt;/p&gt;&#xA;&lt;p&gt;Not sure how this works, as I sent a TCP-SYN of 58 Bytes frame. Please explain&lt;/p&gt;&#xA;" OwnerUserId="23972" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-06-04T23:01:19.803" Title="ICMP TTL-exceeded header shows Length: 243 [Length of original datagram: 972] in wireshark. Original TCP-SYN was 58 Bytes" Tags="|tcp|wireshark|icmp|traceroute|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30946" PostTypeId="1" CreationDate="2016-06-03T22:32:53.917" Score="1" ViewCount="92" Body="&lt;p&gt;I wanted to know whether all the ports on a switch are &lt;strong&gt;access ports&lt;/strong&gt; by default and do they belong to vlan 1? Can another vlan be made a default vlan? &lt;/p&gt;&#xA;" OwnerUserId="25871" LastActivityDate="2016-06-05T10:32:37.550" Title="VLAN Access Ports" Tags="|vlan|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30948" PostTypeId="1" AcceptedAnswerId="30950" CreationDate="2016-06-04T03:22:30.227" Score="2" ViewCount="2819" Body="&lt;p&gt;I read some papers with the term &lt;em&gt;pod&lt;/em&gt;. Specially &quot;&lt;em&gt;pod switches&lt;/em&gt;&quot;. What &lt;em&gt;pod&lt;/em&gt; means? This is an acronym? To what?&lt;/p&gt;&#xA;" OwnerUserId="24252" LastActivityDate="2022-04-18T12:22:13.157" Title="Terminology - What pod means?" Tags="|terminology|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30949" PostTypeId="2" ParentId="30940" CreationDate="2016-06-04T04:46:01.590" Score="9" Body="&lt;p&gt;First we need to understand how packets are sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a host or router tries to send an IPv4 packet* it first looks up the destination in it's routing table. Based on the routing table it determines the &quot;next hop IP address&quot; and interface. For a machine on a local subnet the &quot;next hop IP address&quot; will be the IP address of the destination, otherwise it will be the IP of a gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens next depends on the interface type. Assuming it's an Ethernet or similar interface the network stack needs to determine what MAC address to send the packet to. To do that it looks up the &quot;next hop IP address&quot; in the ARP table for the interface. If it finds a valid entry then it fills in the MAC address and sends the packet out over the Ethernet interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it doesn't find a valid ARP table entry then it will begin the ARP process to try and create one. In the meantime packets destined for that next-hop IP address will be queued up until the system knows what MAC address to send them too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the ARP process times out then on many platforms, any queued up packets will be rejected with a &quot;destination host unreachable&quot; ICMP message (some platforms just silently drop the packets).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eventually entries in the ARP table time out and need to be refreshed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On hosts/routers without a default gateway you can also get a &quot;destination host unreachable&quot; reply generated if there is no routing table entry, so the system doesn't even know what interface to ARP on.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So what happens when you power cycle a machine and ping it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first you likely already have a valid ARP table entry. Your machine puts the packets on the wire but they never get delivered because the network stack on the destination is down. You get &quot;Request timed out&quot; (with microsoft ping, linux ping doesn't display the lack of response at all).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later the ARP cache entry times out. The hop before the box you power cycled (may be your client box or a router) tries to do a new ARP lookup but fails, so it bounces the packets with ICMP errors. Often you see multiple packets get queued up and bounced at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally the network stack on the target box comes back up. ARP succeeds and the packets are sent to the target which replies to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;* With IPv6 the principles are similar but the details are different.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2019-09-26T16:11:13.787" LastActivityDate="2019-09-26T16:11:13.787" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="30950" PostTypeId="2" ParentId="30948" CreationDate="2016-06-04T06:30:28.840" Score="2" Body="&lt;p&gt;Based on the provided context, you are referring to &lt;a href=&quot;https://ieeexplore.ieee.org/document/6312192&quot; rel=&quot;nofollow noreferrer&quot;&gt;leiserson1985fat&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bCN4J.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bCN4J.jpg&quot; alt=&quot;k-ary fat tree&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here a pod has (K/2)^2 servers and 2 layers of K/2 K-port switches.&#xA;&lt;a href=&quot;https://www.slideshare.net/AnkitaMahajan2/fattree-a-scalable-fauult-tolerant&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25877" LastEditorUserId="31801" LastEditDate="2022-04-18T12:22:13.157" LastActivityDate="2022-04-18T12:22:13.157" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="30951" PostTypeId="1" AcceptedAnswerId="30954" CreationDate="2016-06-04T07:44:08.750" Score="1" ViewCount="1235" Body="&lt;p&gt;Consider a network with id 158.159.0.0. There are two subnets included, with subnet numbers 0.0.160.0 and 0.0.161.128.&#xA;Determine the subnet mask, which allows a maximum number of hosts per subnet&#xA;&lt;hr&gt;&#xA;I know a maximum number of hosts is reached with maximum 0s of Subnet Mask. So should it be 255.255.160.0 ? Or should I write different answers for both subnets ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answers found on the Internet relate to determining a number of hosts for a given Subnet Mask. Here is subnet mask not given and number of hosts also not. &lt;/p&gt;&#xA;" OwnerUserId="25878" LastEditorUserId="25878" LastEditDate="2016-06-04T07:52:01.990" LastActivityDate="2016-06-04T08:27:16.100" Title="Subnet mask, which allows a maximum number of hosts per subnet" Tags="|ip|subnet|" AnswerCount="1" CommentCount="2" ClosedDate="2016-06-06T08:45:15.893" ContentLicense="CC BY-SA 3.0" />
  <row Id="30953" PostTypeId="1" AcceptedAnswerId="30958" CreationDate="2016-06-04T08:15:58.400" Score="2" ViewCount="594" Body="&lt;p&gt;I have a multihomed setup with two ISPs with similar bandwidth characteristics. I want to route my traffic to a remote site via ipsec, so that my local network traffic goes through the tunnel and comes out of the remote site endpoint (with no regard to which one of ISP was used in the process).&#xA;This should be somewhat similar to link aggregation and lacp — in order to avoid reordering of tcp packets one stream is being sent via exactly one link even if more than one is available (based on some hashing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the similar scheme achievable with ipsec? I mean use two ISPs to route ipsec traffic, withstand failure of single ISP and do balancing over ISPs per stream (not per packet).&lt;/p&gt;&#xA;" OwnerUserId="25880" LastActivityDate="2016-06-04T13:27:25.553" Title="ipsec balancing with multihomed setup" Tags="|ipsec|isp|load-balancing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="30954" PostTypeId="2" ParentId="30951" CreationDate="2016-06-04T08:27:16.100" Score="0" Body="&lt;p&gt;160 = &lt;code&gt;1010 0000&lt;/code&gt; Thus 3 important bits: &lt;code&gt;1110 0000&lt;/code&gt; or &lt;code&gt;224&lt;/code&gt; (255.255.224.0) &lt;strong&gt;BUT&lt;/strong&gt; we know there's a 161 subnet which a /19 would step on. So, the largest 160 can be without treading into 161 is &quot;all bits&quot; -- 255.255.255.0 (/24).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, 161.128 = &lt;code&gt;1010 0001.1000 0000&lt;/code&gt; Thus 1 bit in the last octect: 255.255.255.128 (/25)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-06-04T08:27:16.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30955" PostTypeId="1" AcceptedAnswerId="30967" CreationDate="2016-06-04T09:27:31.967" Score="2" ViewCount="975" Body="&lt;p&gt;What is the difference between routing protocols and routed protocols? -&amp;amp; the simplest way of understanding it? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Parash.&lt;/p&gt;&#xA;" OwnerUserId="25881" LastActivityDate="2021-01-20T07:30:41.290" Title="What is the difference between routing protocols and routed protcols?" Tags="|routing|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30956" PostTypeId="2" ParentId="30955" CreationDate="2016-06-04T09:45:39.480" Score="1" Body="&lt;p&gt;Really plain and simple: A routed protocol is one which is designed to be routed via a given routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP = routed protocol&#xA;EIGRP = routing protocol&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP enables the routing of IP. Therefore it is a routing protocol which routes IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CLNS\CLNP = routed protocol&#xA;IS-IS = routing protocol&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IS-IS enables the routing of IP and CLNS\CLNP. Therefore it is a routing protocol which routes IP and CLNS\CLNP.&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2016-06-04T09:45:39.480" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30957" PostTypeId="1" AcceptedAnswerId="30963" CreationDate="2016-06-04T10:36:35.307" Score="1" ViewCount="326" Body="&lt;p&gt;I read wikipedia page ;but it says that we can extend over private resources publically. and user can send - receive data using public network to remote resources in perspective that it is connected to it privately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, We can use ssh to transfer the data, how is different from ssh?&#xA;basically, I am not getting core idea behind VPN.&lt;/p&gt;&#xA;" OwnerUserId="16924" LastActivityDate="2016-06-06T01:32:54.590" Title="What is VPN? How is it different from SSH?" Tags="|vpn|tcp|ip|ipsec|network-core|" AnswerCount="2" CommentCount="3" ClosedDate="2016-06-06T08:46:53.627" ContentLicense="CC BY-SA 3.0" />
  <row Id="30958" PostTypeId="2" ParentId="30953" CreationDate="2016-06-04T11:16:33.813" Score="3" Body="&lt;p&gt;Yes you can do this.  As @RickyBeam so loquaciously points out ;-), you can configure routers on both sides to use a routing protocol (OSPF for example) that allows Equal Cost Multi-Path.  Each router will learn both paths from the other router and load balance (per stream) between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your VPN tunnels must allow the routers to learn routes from each other.  For OSPF, you either need to allow multicast (GRE over IPSEC), use a Virtual Tunnel Interface (Cisco), or manually configure the neighbors as a NBMA network.  Which method you choose depends on the type of router.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-06-04T13:27:25.553" LastActivityDate="2016-06-04T13:27:25.553" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30959" PostTypeId="1" AcceptedAnswerId="30961" CreationDate="2016-06-04T11:23:25.933" Score="2" ViewCount="2368" Body="&lt;p&gt;What happens when we create the TCP connection and we wait while(1) i.e. infinite loop, &#xA;Does it get terminated automatically? or It will last forever if my connection is very good &lt;/p&gt;&#xA;" OwnerUserId="16924" LastActivityDate="2016-06-04T13:04:01.373" Title="Duration of TCP connection last in idle state(no data exchange)?" Tags="|ipv4|tcp|ip|network-core|transport-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30961" PostTypeId="2" ParentId="30959" CreationDate="2016-06-04T13:04:01.373" Score="3" Body="&lt;p&gt;Considering you are not sending any traffic, connection quality has no impact here, because TCP connection on your end-host will not terminate even if you cut the cable between the end-hosts, as long as you don't use &lt;a href=&quot;http://tldp.org/HOWTO/TCP-Keepalive-HOWTO/overview.html&quot; rel=&quot;nofollow&quot;&gt;optional TCP Keepalive&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In real life networks this is not a very practical way of keeping the connection alive. Firewalls and NATs will eventually flush out the state of this connection in their database, causing the data you might want to transmit at a later time to be dropped, triggering the re-transmission mechanisms in your end-host TCP stack that will eventually lead to session termination.&lt;/p&gt;&#xA;" OwnerUserId="25723" LastActivityDate="2016-06-04T13:04:01.373" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="30963" PostTypeId="2" ParentId="30957" CreationDate="2016-06-04T13:46:55.470" Score="1" Body="&lt;p&gt;traditionally ssh is used to connect from one host onto another host securely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a vpn connects a host to another network securely. This lets your native host access resources that might be restricted to the other network via firewall, etc. Things like printers, private databases, etc. A typical use would be to put your work laptop on the office network even when you aren't in the office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are lots of protocols that are used to do this tunneling - SOCKS is one of them and indeed most ssh implementations can establish a SOCKS tunnel for you, but that's not generally what people are thinking of when they ask about VPN.&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-06-04T13:46:55.470" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="30965" PostTypeId="2" ParentId="30946" CreationDate="2016-06-04T14:20:59.063" Score="2" Body="&lt;p&gt;In production environment things are a little more complicated, there are a lot of devices and operating systems there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if we talk about the Cisco Packet Tracer – which is one of the most recommended network simulation program in case you study for CCNA – you have not many choices. Open a switch – 2950 or 2960 model – and use the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch&amp;gt; show interfaces switchport&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will see that all those 24 FastEthernet ports are by default &lt;strong&gt;“Administrative Mode: dynamic auto”&lt;/strong&gt;, which literally means “passively waits to receive trunk negotiation messages, at which point the&#xA; switch will respond and negotiate whether to use trunking”. ( If they were “access ports” you should see &lt;strong&gt;“Administrative Mode: static access”&lt;/strong&gt;.) If you want to find more about dynamic trunking search for the DTP (Dynamic Trunking Protocol), which is a proprietary networking protocol developed by Cisco for the purpose of negotiating trunking on a link between two VLAN-aware switches, and for negotiating the type of trunking encapsulation to be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And yes, VLAN 1 is the default native VLAN and - for security reasons - Cisco recommends to change it. There a bunch of ways to do that, check for “Implementing Ethernet Virtual LANs”. But I think it's essential to fully understand the concept firstly, otherwise everything becomes confusing...&lt;/p&gt;&#xA;" OwnerUserId="25734" LastActivityDate="2016-06-04T14:20:59.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30967" PostTypeId="2" ParentId="30955" CreationDate="2016-06-04T14:54:46.640" Score="3" Body="&lt;p&gt;&lt;strong&gt;Routing protocols&lt;/strong&gt; allow routers to exchange routing information so they can learn about networks from other routers.  A router in Barcelona can learn about networks in Zagreb via a routing protocol, so that it can forward traffic to Zagreb.  Your ISP learns about networks from other ISPs via a routing protocol, so you can watch funny cat videos on YouTube.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples of routing protocols are OSPF, EIGRP, BGP and IS-IS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;routed protocol&lt;/strong&gt; is a protocol for sending data between end hosts.  To be &quot;routed,&quot; it has to have a hierarchical addressing scheme that indicates &quot;where&quot; the host is.  The hierarchy lets a router (or host) determine where the packet should be sent in order to reach it's destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Practically speaking, there is only one routed protocol in use, and that is IP (version 4 and version 6).  IP addresses have a network portion and a host portion (the subnet mask tells you how to separate the two).  The network portion of the address lets the host look in its routing table to determine what is the best way to forward the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Non-routed protocols are essentially obsolete in the age of the Internet, but NetBIOS might be one you're somewhat familiar with.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-04T14:54:46.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="30969" PostTypeId="1" AcceptedAnswerId="32065" CreationDate="2016-06-04T21:16:56.047" Score="4" ViewCount="989" Body="&lt;p&gt;Apologies if this isn't the right place for this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm converting an out-building to a home office. The structure is approximately 175 feet from the house. We're digging a trench for a 240V power line, and I'm planning to include a network cable so I can get a fast connection back to the rack in the house.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is CAT-5e suitable for this? Typically, one wouldn't run a signal cable next to a power cable. Over 175 feet, I imagine that the interference / crosstalk would be significant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm also considering running single-mode fiber. The cable prices are reasonable, and there's no real opportunity for (significant) interference from the power line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suggestions? I assume this is a solved problem, but my Google kung-fu is failing me. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen gadgets that will let you send network traffic over the power lines, but have no personal experience re:reliability or performance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I'm coming up short on tags for this post.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="25890" LastEditorUserId="8499" LastEditDate="2018-03-20T23:08:20.277" LastActivityDate="2018-03-20T23:08:20.277" Title="Direct-burial cable: fiber vs cat-5e/ cat6" Tags="|fiber|layer1|cabling|cable|utp|" AnswerCount="3" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="30970" PostTypeId="2" ParentId="30943" CreationDate="2016-06-04T23:01:19.803" Score="1" Body="&lt;p&gt;If the &quot;Length&quot; field in the ICMP header has a value of 243, then the host sending it thought the original datagram was 243*4 = 972 bytes long.  Wireshark is correctly reporting the purported length of the original datagram, so either 1) the host sending the ICMP packet didn't correctly calculate the length or 2) the packet really &lt;em&gt;did&lt;/em&gt; have a length of 972 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does the total length field of the IP header preceding the TCP header show?  If you didn't have any IP options, it &lt;em&gt;should&lt;/em&gt; specified a length of 20+24 = 44 (20 for the IPv4 header, 24 for the TCP header with the MSS option); the length field in question is in 4-byte units, so it should have been 11.  If it &lt;em&gt;didn't&lt;/em&gt; have a value of 11, but instead had a value of 243, that's a bug in the code that constructed the IPv4 header for the TCP SYN segment.&lt;/p&gt;&#xA;" OwnerDisplayName="user2373" LastActivityDate="2016-06-04T23:01:19.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="31971" PostTypeId="2" ParentId="6755" CreationDate="2016-06-05T02:37:46.170" Score="5" Body="&lt;p&gt;By default MLAG chooses primary/secondary based on switch MAC address - lowest will always become the primary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;https://eos.arista.com/forum/mlag-priorities/&quot; rel=&quot;noreferrer&quot;&gt;https://eos.arista.com/forum/mlag-priorities/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do you want to force the priority? MLAG was developed to achieve to active/active uplinks to different chassis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe Arista Warrior might be stale - but to be honest I would be making use of your support contract with Arista. At the end of the day they will be able to give you the definitive answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Searching on the Arista site brings up nothing regarding explicitly having to upgrade the secondary first. End hosts see the Sys-ID in MLAG so convergence should be sub-second.&lt;/p&gt;&#xA;" OwnerUserId="168" LastActivityDate="2016-06-05T02:37:46.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="31974" PostTypeId="2" ParentId="30946" CreationDate="2016-06-05T10:22:24.817" Score="2" Body="&lt;p&gt;The reasony why VLAN 1 is the default VLAN is not a vendor-specific implementation, but a decision made by IEEE. On page 222, 802.1Q-2014 says about &lt;strong&gt;VLAN&lt;/strong&gt; identifier &lt;strong&gt;1&lt;/strong&gt;: &lt;em&gt;The default PVID value used for classifying frames on ingress through a Bridge Port. The PVID value of a Port can be changed by management.&lt;/em&gt; In more common terms: It's the default VLAN. If a vendor decides not to comply with IEEE's decision, then it's possible that such a feature is available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Native VLAN&lt;/strong&gt;: If an incoming frame is untagged, then it is associated with VLAN 1, unless configured otherwise. Consequently every untagged frame would be forwarded anywhere. To mitigate this security risk you should configure a &lt;strong&gt;shutdown VLAN&lt;/strong&gt; on every switch. That's a VLAN which catches all untagged frames and prevents them from being forwarded because it only exists on that switch and none of its neighbors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Side note: You can get the 802.1Q-2014 document for free via the &lt;a href=&quot;http://standards.ieee.org/about/get/802/802.1.html&quot; rel=&quot;nofollow&quot;&gt;IEEE Get Program&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="3163" LastEditDate="2016-06-05T10:32:37.550" LastActivityDate="2016-06-05T10:32:37.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="31978" PostTypeId="1" AcceptedAnswerId="31982" CreationDate="2016-06-05T18:20:28.560" Score="1" ViewCount="929" Body="&lt;p&gt;What causes delay skew in a typical copper network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/Copper_cable_certification&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;: &quot;The Delay Skew test tests for the difference in propagation delay between the fastest and slowest set of wire pairs. An ideal skew is between 25 and 50 nanoseconds over a 100-meter cable...&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The speed of the propagation should be related to the conductors' lengths shouldn't it?  So how is it possible for the skew to vary by any measurable amount assuming all four pairs have almost exactly the same overall length (i.e. they weren't cut independently of one another?)&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2016-06-05T18:47:24.347" LastActivityDate="2016-06-05T22:32:14.270" Title="What typically causes delay skew?" Tags="|cable|layer1|certification|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="31979" PostTypeId="1" AcceptedAnswerId="31981" CreationDate="2016-06-05T18:37:07.750" Score="1" ViewCount="735" Body="&lt;p&gt;I'm confused with how NAT and routers work in ethernet standards. In the image below, when a request is sent from Client to Server, by the time the request packets arrive R2, then what are source IPv4 address, source MAC address, destination IPv4 address, and destination MAC address of the packets. &#xA;My own answer is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;source IP: inside global IP address of R1&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;source MAC: Client's MAC address&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;des IP: Server's IP address&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;des MAC: Server's MAC address&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Am I right? If not, correct me.&lt;a href=&quot;https://i.stack.imgur.com/IXOFf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IXOFf.png&quot; alt=&quot;R1 is a NAT server&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26905" LastEditorUserId="8499" LastEditDate="2019-01-04T21:07:17.787" LastActivityDate="2019-01-04T21:07:17.787" Title="How do NAT and routers work in ethernet standards?" Tags="|routing|router|ethernet|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="31980" PostTypeId="2" ParentId="3697" CreationDate="2016-06-05T18:53:17.037" Score="6" Body="&lt;p&gt;192.168.0.0 is private IP address starting range address (192.168.0.0 up to 192.168.255.255 Small network). It means you have used sixteen bits for network address out of thirty two bits and  bits are remaining for host addressing. for these remaining sixteen bits can be used for sub netting based on your network design and other sub netting steps illustrate in above posts.&lt;/p&gt;&#xA;" OwnerUserId="8007" LastActivityDate="2016-06-05T18:53:17.037" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="31981" PostTypeId="2" ParentId="31979" CreationDate="2016-06-05T19:09:20.247" Score="3" Body="&lt;p&gt;This question is really off-topic here. All &quot;&lt;em&gt;education, certification, or homework&lt;/em&gt;&quot; questions are explicitly off-topic here. Your answer is partially correct. I'm not going to do your work for you, but I will explain how to arrive at the correct answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't confuse different network layers. Ethernet is a layer-1/2 set of protocols, while NAT works at layer-3/4. Packets are layer-3 datagrams, and they contain the source and destination layer-3 (e.g. IPv4) addresses. Frames are layer-2 datagrams, and they contain the source and destination layer-2 (e.g. MAC) addresses. Packets are encapsulated by frames before being placed on the wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet doesn't care what upper-layer protocols it carries. It can carry various (IPv4, IPX, IPv6, etc.) layer-3 protocols, and it doesn't care. The upper-layer protocols are just the payload of ethernet frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, IPv4 doesn't care which layer-1/2 protocol carries it. IPv4 can be encapsulated by many different layer-2 protocols. In your diagram, the link between the two routers could be something like frame-relay over a serial connection, and that doesn't use MAC addresses at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC addresses are confined to the LAN on which they originate: they are the addresses used on layer-2 domain, but they do not cross layer-3 devices. When a layer-2 frame gets to a layer-3 device, e.g. a router, the frame is stripped, the packet is switched to the next interface, and a new frame for the new interface is created to encapsulate the packet. The layer-3 address is translated before the new frame encapsulation happens.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-05T20:17:08.503" LastActivityDate="2016-06-05T20:17:08.503" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="31982" PostTypeId="2" ParentId="31978" CreationDate="2016-06-05T19:12:49.560" Score="3" Body="&lt;p&gt;In twisted pair cables, different pairs have a different number of twists per inch. This helps to prevent signals on one pair from being induced on another pair. The more a pair is twisted, the longer the wires in the pair need to be for a given cable length. The different twist rates will cause different lengths between the pairs. The longer the cable, the more there is a difference in the lengths of the pairs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-05T22:32:14.270" LastActivityDate="2016-06-05T22:32:14.270" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="31985" PostTypeId="1" CreationDate="2016-06-05T22:27:42.683" Score="0" ViewCount="473" Body="&lt;p&gt;Trying to traceroute an HTTP server using TCP-SYN packets.  There are 13 hops between the two hosts, but the server responds with TTL-exceeded for TTL=13 and TTL=14. It replies with TCP SYN-ACK only when TTL=15 or higher.&#xA;If the server receives a packet with TTL=1 that is destined for itself, shouldn't it respond with TCP SYN-ACK or does it have to be more than 1. Please check the wireshark output.&lt;a href=&quot;https://drive.google.com/file/d/0B4YbN-N-GBbIMEJvT3pRazFiYmM/view?usp=sharing&quot; rel=&quot;nofollow&quot;&gt;Traceroute Wireshark Capture&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="23972" LastEditorUserId="8499" LastEditDate="2018-02-16T03:53:46.720" LastActivityDate="2018-02-16T03:53:46.720" Title="HTTP server responds with TTL- exceeded for TCP-SYN till TTL is increased by +2 from the actual number of hops" Tags="|tcp|wireshark|icmp|traceroute|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="31987" PostTypeId="2" ParentId="31985" CreationDate="2016-06-06T01:12:52.280" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If the server receives a packet with TTL=1 that is destined for&#xA;  itself, shouldn't it respond with TCP SYN-ACK?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No.  the server (or any device) will decrement the TTL counter, then test if it is zero.  If so, it will send a time-exceeded message.  If it is not zero, the packet will be sent for processing at the higher layers in the protocol stack.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-06T01:12:52.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="31988" PostTypeId="2" ParentId="30957" CreationDate="2016-06-06T01:32:54.590" Score="1" Body="&lt;h1&gt;Part 1: background&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Lets say you have a head office. You build a network in your office, and connect it to the Internet via a firewall, most likely the firewall is also doing NAT. Within your network you deploy some servers. You also subscribe to various Internet services which identify your network through an IP whitelist. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But not all your users are at head office. Some are working from home, some are working from small branch offices, some are working on the road. They still need to access your companies services, how do they do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could just have them access the services directly over the Internet but this has several problems.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The traffic may be vulnerable to sniffing or tampering as it passes through the public Internet.&lt;/li&gt;&#xA;&lt;li&gt;To firewall effectively you need to know the addresses of legitimate clients. This is a big problem for clients on the move (and a problem to a lesser extent for clients working from home).&lt;/li&gt;&#xA;&lt;li&gt;For IP-based subscription services you either have to whitelist a load of seperate IPs with the provider or provide some alternative means of authentication.&lt;/li&gt;&#xA;&lt;li&gt;It likely means that the services will all need a dedicated IPv4 address which are kinda in short supply (it would be nice if the whole world moved to IPv6 but we aren't there yet)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You could buy private circuits from a telco but again this has problems.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It's expensive, for small bandwidth requirements private circuits cost considerbally more than internet connections. &lt;/li&gt;&#xA;&lt;li&gt;It's not practical for those on the move.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Part 2: VPNs&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;A VPN solves this dilemma by creating a private network on top of a public one. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VPN endpoint usually presents itself to the operating system as a virtual network interface. When packets are sent to this interface they are passed to the VPN software. Typically the VPN software will encrypt the packet, add it's own headers and then pass the packet back to the network stack as a payload to be sent to the other endpoint of the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet then passes over a network (usually the public internet) to the other end of the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the packet reaches the other endpoint of the VPN the process is reversed. The OS receives the packet and passes it to the VPN software as a payload. The VPN software will typically validate that the packet is legitimate, decrypt it and remove the extra headers. It will then pass it back to the network stack via the virtual network interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus we effectively have a private network between the two endpoints of the VPN but the data is physically carried between the endpoints by a public network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to the simple encapsulation and deencapsulation VPN software will frequently provide other features. It will usually provide a mechanism for clients to authenticate to a server and establish a VPN session. It may provide some level of bridge or router functionality to allow a single virtual network interface on the server to serve multiple clients. It will most likely have functionality for pushing IP adresses and routing configuration to clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing on the clients may be configured to send virtually all the client's traffic down the VPN or it may be configured to only send particular traffic down the VPN. There are pros and cons to both approaches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPNs can operate at various network layers on both the &quot;inside&quot; and the &quot;outside&quot;. On the inside a VPN may carry IP packets or it may carry Ethernet frames. On the outside a VPN may operate over a transport protocol like TCP or UDP or it may operate directly over IP,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put all of this together we have a method of brining our remote sites and users onto our private network without needing to buy private network connections between them.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Part 3: ssh and socks&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;socks is a protocol for talking to proxies. It can achive some of the same goals as a VPN but operates at a higher level. Your client application makes a TCP connection to the socks proxy and then asks it to make an onward connection to the server. Once established the socks proxy passes data back and forth between the two TCP connections. If the socks proxy has access to network resources that the client can't acess directly then the client can use the proxy to access those resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike with a VPN the client application needs to be aware of socks (though there are hacks for this).  Socks does provide optional authentication but as far as I can tell unlike most VPN tools it does not provide encryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the fact that the client has to be aware of socks can be a pro and a con, on the one hand it limits the applicability. On the other hand it means that you can point only certain application at the socks proxy. In some cases you can even configure an application to use the socks proxy for only some connections (look up the firefox extension &quot;foxyproxy&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ssh is primerally a tool for remote shell access to servers. It provides encryption and authentication and is generally considered to be sufficiently secure for use directly over the public internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While primerally intended for remote console access ssh can carry other things. It can carry application data directly between a program running on the client and a program running on the server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One feature of ssh is port forwarding, there are three different modes, all forward connections at a TCP level. By default only connections from localhost are forwarded.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&quot;local&quot; the ssh client listens for TCP connections on a predetermined port. When it receives one it asks the server to connect to a predetermiend IP/port. Data is then forwarded between the two TCP connections over the ssh connection. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&quot;remote&quot; the ssh server listens for connections on a predetermined port. When it receives one it askes the client to connect to a predetermined IP/port. Data is then forwarded between the two TCP connections over the ssh connection. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&quot;dynamic&quot; the ssh client acts as a socks proxy server. When the socks client requests a connection to a particular IP/port the ssh client requests the ssh server to make a connection to that IP/port. Again data is forwarded over the ssh connection. This essentially gives you the features of socks with the encryption and authentication of ssh. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can also use ssh to carry ppp (or possiblly slip) and make an actual VPN. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-06-06T01:32:54.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="31989" PostTypeId="1" AcceptedAnswerId="31991" CreationDate="2016-06-06T01:53:06.770" Score="1" ViewCount="133" Body="&lt;p&gt;The smallest MTU between the source and destination is 600. What I don't understand is how TCP knows to only include a max of 548 bytes, so that it doesn't go over 600 with TCP and IP overhead. MTU path discovery is enabled, and I understand how it works but I don't understand how TCP is using it because there is no network activity prior to the initial handshake. Is it possible my source has cached this information somehow based on previous activity? How does TCP know how big to make the datagram? &lt;/p&gt;&#xA;" OwnerUserId="26911" LastActivityDate="2016-06-06T03:34:33.890" Title="How do these packets know what size to be?" Tags="|ipv4|tcp|mtu|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="31990" PostTypeId="2" ParentId="31989" CreationDate="2016-06-06T02:03:20.847" Score="0" Body="&lt;p&gt;TCP doesn't know. The router(s) in between will fragment IPv4 packets as necessary. The TCP segments are the payload of the IPv4 packets.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791, INTERNET PROTOCOL&lt;/a&gt; details the fragmentation process, and what the end-device needs to do to defragment the packets upon receipt. The IPv4 header has fields to facilitate the fragmentation/defragmentation process.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;1.1.  Motivation&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The Internet Protocol is designed for use in interconnected systems of&#xA;packet-switched computer communication networks.  Such a system has&#xA;been called a &amp;quot;catenet&amp;quot; [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791#ref-1&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt;].  The internet protocol provides for&#xA;transmitting blocks of data called datagrams from sources to&#xA;destinations, where sources and destinations are hosts identified by&#xA;fixed length addresses.  The internet protocol also provides for&#xA;&lt;strong&gt;fragmentation and reassembly&lt;/strong&gt; of long datagrams, if necessary, for&#xA;transmission through &amp;quot;small packet&amp;quot; networks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;1.4.  Operation&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The internet protocol implements two basic functions:  addressing and&#xA;&lt;strong&gt;fragmentation&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-06-06T02:03:20.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="31991" PostTypeId="2" ParentId="31989" CreationDate="2016-06-06T03:34:33.890" Score="4" Body="&lt;p&gt;In simple terms, yes, systems cache that information. [route-cache, FIB, etc.]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you understand how PMTUd works, you know how the maximum segment size is determined once traffic is flowing. Almost every modern network stack implements a route cache. It's a faster way to lookup a path than a full route table lookup per packet. Within the cache are parameters that normally don't exist in the main route table. The maximum segment size between a pair of hosts is but one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debian1:~/[11:29 PM]:ip route show table cache [A]&#xA;[A] from [B] via [B gw] dev eth0 &#xA;    cache  expires 543sec mtu 1444 rtt 615ms rttvar 610ms cwnd 35 advmss 1460 hoplimit 64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Across an IPSec tunnel, the MTU had to be reduced. Until I ask for something bigger than a &quot;1500&quot; packet, the cache entry remains &lt;em&gt;mtu 1500&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-06-06T03:34:33.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="31992" PostTypeId="1" CreationDate="2016-06-06T04:03:15.967" Score="1" ViewCount="523" Body="&lt;p&gt;I really need some help to explain following two scenarios as I only have little network troubleshooting skills. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am supposed to go to these clients and give a valid reason for these issues. The only reason I could think here is &quot;Slow network speed&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it could be hard to identify network problems just by reading this post, but at least few suggestions, comments or troubleshooting tips you can give help me a lot here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We did a website for a client. This website has a page that loads around &amp;lt; 2500 MySql records. We have loaded this page in several different networks. All of them took 1-2 minutes to load the whole page without any problems.&#xA;However, when we load this website on &lt;strong&gt;client's network&lt;/strong&gt; it takes hours(or sometimes doesn't event load). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Case 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We did another website for a client. It works fine on other networks, but only in &lt;strong&gt;client's network&lt;/strong&gt;, it has wired behaviours. Sometimes website loads partially. We can see links appearing on a white background without any CSS/JS and not working.&#xA;Sometimes it doesn't even load.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Please Note:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Both websites can be loaded in other networks and they behave fine.&lt;/li&gt;&#xA;&lt;li&gt;Both clients have good internet connections and able to visit other&#xA;sites like google/facebook etc. without any problems. All other&#xA;popular sites working just fine except our custom built sites.&lt;/li&gt;&#xA;&lt;li&gt;We are unable to change the architecture of the website. ex: Implement pagination.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Website info:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;PHP &gt; 5 &lt;/li&gt;&#xA;&lt;li&gt;MySql &lt;/li&gt;&#xA;&lt;li&gt;Http  &lt;/li&gt;&#xA;&lt;li&gt;Using HostSG as the Service Provider&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Can you please tell me what possible reasons causing these problems?&#xA;Is there any way to identify the exact problem?&#xA;Thanks in advance! &lt;/p&gt;&#xA;" OwnerUserId="26912" LastActivityDate="2016-06-06T04:35:28.363" Title="Website not loading/very slow only on a client's netwok" Tags="|internet|lan|latency|" AnswerCount="1" CommentCount="3" ClosedDate="2016-06-06T08:46:06.050" ContentLicense="CC BY-SA 3.0" />
  <row Id="31993" PostTypeId="2" ParentId="31992" CreationDate="2016-06-06T04:35:28.363" Score="1" Body="&lt;p&gt;Without knowing the topology of your clients' networks, I'd hazard a guess that this is an MTU issue. Ask your clients to investigate their network devices' configurations and lower their MTU (maximum transmission unit) and/or MSS (maximum segment size) if necessary. Fore more information on MTU and MSS, see &lt;a href=&quot;http://www.oznetnerd.com/2013/05/24/mtu-vs-mss-part-two/&quot; rel=&quot;nofollow&quot;&gt;my blog post entry&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-06-06T04:35:28.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="31996" PostTypeId="2" ParentId="30926" CreationDate="2016-06-06T06:47:44.903" Score="1" Body="&lt;p&gt;Different brands of switches can be connected by SFP modules via compatible cables. SFP can work through several kinds of cables, not limited to commonly-used fiber. There are also copper transceivers,like 1000BASE-T transceivers with RJ-45 which take Cat 5 as transmission medium.&lt;/p&gt;&#xA;" OwnerUserId="24837" LastActivityDate="2016-06-06T06:47:44.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="31997" PostTypeId="2" ParentId="29320" CreationDate="2016-06-06T06:59:43.517" Score="0" Body="&lt;p&gt;A fan-out cable looks very simple. It takes one (large bandwidth) physical interface and breaks it out into several (smaller bandwidth) interfaces. This 4 x 10G breakout cable takes one 40G QSFP interface on one end and uses a fan-out cable to break it into four SFP+ interfaces one the other end. These four LC modules then go to different ports.&lt;/p&gt;&#xA;" OwnerUserId="24837" LastActivityDate="2016-06-06T06:59:43.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="31998" PostTypeId="1" CreationDate="2016-06-06T08:52:42.727" Score="2" ViewCount="505" Body="&lt;p&gt;We have a system whereby we make a RESTful callback to a client's remote server. We are seeing timeouts waiting for a response when a request has apparently been sent.&#xA;Some constraints:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;it is difficult to get hold of TCP dump logs outside of the server, elsewhere on the local network.&lt;/li&gt;&#xA;&lt;li&gt;We do not have access to the client's system.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;We think that, when traffic is low, the remote proxy is killing idle connections without telling us. I have added a reaper thread for idle connections. This should have been in there already and adding it is an improvement to the system. However, I still would like to simulate the error condition on our local network and that has proven a little tricky. Our test server, a servlet container, is well-behaved in that it is correctly closing TCP connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should I go about creating a setup whereby:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;idle connections are dropped without further TCP traffic&lt;/li&gt;&#xA;&lt;li&gt;further traffic relating to those connections is ignored?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="26902" LastActivityDate="2016-08-05T15:08:55.577" Title="Simulate a proxy or server that is silently dropping pooled tcp connections?" Tags="|tcp|testing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="31999" PostTypeId="1" CreationDate="2016-06-06T09:21:25.263" Score="1" ViewCount="232" Body="&lt;p&gt;I'm reading book about networking now and can't understand one thing.&#xA;As I've read Manchester encoding uses transition of voltage to interpret incoming signal.&#xA;Question:&#xA;When I'm sending data via Ethernet using Manchester encoding how receiver&#xA;understands whether first byte is 0 or 1.&lt;/p&gt;&#xA;" OwnerUserId="26917" LastEditorUserId="8499" LastEditDate="2016-11-29T02:15:28.603" LastActivityDate="2016-11-29T02:15:28.603" Title="How first byte is determined when data is encoded via manchester encoding" Tags="|layer1|data|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32000" PostTypeId="2" ParentId="31999" CreationDate="2016-06-06T09:47:38.787" Score="0" Body="&lt;p&gt;The encoding is fixed in the standard,&lt;a href=&quot;http://www.wildpackets.com/resources/compendium/ethernet/signal_perspective&quot; rel=&quot;nofollow noreferrer&quot;&gt;see this desciption&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The frame's preamble is known, so that helps to determine what bit this is, or a collision is taking place.&lt;/p&gt;&#xA;" OwnerUserId="13967" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-06-06T09:47:38.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32001" PostTypeId="2" ParentId="31999" CreationDate="2016-06-06T09:52:20.093" Score="1" Body="&lt;p&gt;I think you are speaking of &lt;strong&gt;bits&lt;/strong&gt;, not bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before sending a frame, the sender put a preamble of 64 bits (8 bytes):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Byte 1   Byte 2   Byte 3   Byte 4   Byte 5   Byte 6   Byte 7   Byte 8  &#xA;10101010 10101010 10101010 10101010 10101010 10101010 10101010 10101011&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first 7 bytes are the same: &lt;code&gt;10101010&lt;/code&gt;. The last byte called the &lt;em&gt;Start of Frame byte&lt;/em&gt; is slightly different: &lt;code&gt;10101011&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The preamble is not officially counted as part of the Ethernet frame. The frame begins immediately after the Start of Frame, without a gap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the preamble is a fixed and known pattern, it is used by the receiver to &lt;em&gt;&quot;lock-in&quot;&lt;/em&gt; the clock and from then it can easily understand the incoming frame.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-06-06T10:03:03.503" LastActivityDate="2016-06-06T10:03:03.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32005" PostTypeId="2" ParentId="30969" CreationDate="2016-06-06T11:47:32.957" Score="1" Body="&lt;p&gt;I can think of at least a few reasons for using fiber:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Higher bandwidth&lt;/li&gt;&#xA;&lt;li&gt;Zero interference from power lines&lt;/li&gt;&#xA;&lt;li&gt;It is much better to invest now in a fast medium than getting satisfied of a copper cable and then having to redo all the work again in a few years, when you'll want to upgrade  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2016-06-06T11:47:32.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32008" PostTypeId="2" ParentId="31998" CreationDate="2016-06-06T13:35:33.173" Score="1" Body="&lt;p&gt;You could put in a router with NAT or a firewall between, and set the TCP timeout to be very low.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could try to correct the situation by using TCP keepalive. This will periodically send TCP ACKs with no data in order to keep the TCP session open.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-06T13:35:33.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32011" PostTypeId="2" ParentId="30918" CreationDate="2016-06-06T16:20:04.387" Score="2" Body="&lt;p&gt;It was HSRP asymmetric routing issue. We has HSRP and i found few VLANs are active on SW1 and few VLANs were active on SW2 and that was creating ARP flooding. as soon as i move all VLANs (HSRP) on single switch flood is gone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is the cisco doc: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/hot-standby-router-protocol-hsrp/10583-62.html#t8&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/hot-standby-router-protocol-hsrp/10583-62.html#t8&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-06-06T16:20:04.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32012" PostTypeId="1" CreationDate="2016-06-06T16:51:15.487" Score="1" ViewCount="358" Body="&lt;p&gt;I know there is a &quot;tunnel id&quot; metadata matching field which was introduced in the 1.3 openflow release, if I'm not mistaken. However, are there any actions in supporting the encapsulation and decapsulation process of a tunnel protocol, like GTP? I suppose there are, as the tunnel metadata is present in the openflow matching implementation, so in this case what are the specific encap/decap actions, in order to apply therefore the routing decisions on the actual tunneled ip packet?&lt;/p&gt;&#xA;" OwnerUserId="16946" LastEditorUserId="16946" LastEditDate="2016-06-07T10:03:52.327" LastActivityDate="2016-06-07T10:03:52.327" Title="GTP support in OpenFlow" Tags="|network-core|tunnel|sdn|openflow|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32013" PostTypeId="1" AcceptedAnswerId="32016" CreationDate="2016-06-06T19:46:09.957" Score="2" ViewCount="696" Body="&lt;p&gt;I have a Cisco 2950 switch at home with the same fiber port in this picture.  Can anyone tell me what type of port this is?  LC, SC, FC, MTRJ?  I am new to fiber optic ethernet.  I'm pretty sure this connection is using a multimode cable.  Looking to purchase a fiber cable to use in my home network stack of Cisco switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;a href=&quot;https://i.stack.imgur.com/G71Vy.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G71Vy.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23422" LastActivityDate="2016-06-23T09:42:31.780" Title="What type of fiber connection is this?" Tags="|ethernet|fiber|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32016" PostTypeId="2" ParentId="32013" CreationDate="2016-06-06T20:55:09.730" Score="5" Body="&lt;p&gt;Expanding on the comment above, it's indeed an MT-RJ connector.  I also know it's multimode because 1000base-SX is MMF-only.  Lastly, you can even make a very educated guess about the type of fiber based on the colors of the strain relief boot at the connector and the jacket/protective cover of the main cable.  In your case, orange with a beige boot is another indication of MMF (OM1 or OM2.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rDRt6.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rDRt6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-06-06T20:55:09.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32017" PostTypeId="1" AcceptedAnswerId="32018" CreationDate="2016-06-06T21:20:44.630" Score="6" ViewCount="4628" Body="&lt;p&gt;Just a curiosity, if I have a NIC that is associated with more than one IP addresses.  Does port ties to an IP or NIC?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if I have a NIC that has two IPs, 1) 192.168.8.18 and 2) 10.1.11.240&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I open port 1234 on 192.168.8.18, can I also open port 1234 on 10.1.11.240 or that will be prohibited since the NIC already had port 1234.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="26932" LastActivityDate="2016-06-21T03:27:43.667" Title="When a NIC has multiple IPs, does port ties to IP or NIC?" Tags="|ipv4|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32018" PostTypeId="2" ParentId="32017" CreationDate="2016-06-06T21:33:14.900" Score="7" Body="&lt;p&gt;When you open a port, bound to an IP address, it is called a socket. Then, if you have multiple IP addresses, on each of them, you can open ports, always if hardware permits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your question, these 2 connections can be established simultaneously. You also can have one service running on 192.168.8.18 and another on 10.1.11.240, also using the same port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.8.18:1234&lt;br&gt;&#xA;10.1.11.240:1234&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you read more info about OSI model, you can check that &quot;port&quot; relies on L4 (transport layer), and NICs exist between L2-L3. &lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="8499" LastEditDate="2016-06-21T03:27:43.667" LastActivityDate="2016-06-21T03:27:43.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32019" PostTypeId="2" ParentId="32017" CreationDate="2016-06-06T22:12:53.493" Score="-1" Body="&lt;p&gt;A Network Interface Card ( NIC ) consists of a port ( &lt;strong&gt;Hardware port&lt;/strong&gt; ) and are bind with unique MAC address ( which could be changed under special circumstances eg visualization ). Port is just a cabling device. A NIC card have a port embedded in it.Interface = NIC ( port + other component ). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can assign multiple ip address on a interface. There is only one primary address and other address bind to that interface are secondary addresses.Secondary IP address could also be advertised in routing protocols or could be used as gateways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Word &quot;Port&quot; is also used in software where it identify specific process or type of service.Software port number could be bind to any of reachable IP address.&lt;/strong&gt; &lt;/p&gt;&#xA;" OwnerUserId="26934" LastActivityDate="2016-06-06T22:12:53.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32020" PostTypeId="1" CreationDate="2016-06-06T22:43:53.120" Score="-1" ViewCount="110" Body="&lt;p&gt;I'm confused about routing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a number of routing protocols. The ones I know are RIPv2 and OSPF.&#xA;They allow routers to communicate with each other and share routing information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about BGP? &#xA;This protocol also allows communicate with each other, right? &#xA;But do they also share routing information? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your feedback.&lt;/p&gt;&#xA;" OwnerUserId="26897" LastActivityDate="2016-06-08T16:05:13.853" Title="Routing information" Tags="|routing|bgp|ospf|rip|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32021" PostTypeId="2" ParentId="32020" CreationDate="2016-06-06T22:52:09.887" Score="2" Body="&lt;p&gt;There are 2 types of routing protocols :-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IGP(Interior gateway protocol) -- (which work between same AS number (Same As number means devices managed by same admin or company)). IGP protocols are RIP, ISIS , OSPF, EIGRP. They are fast but are not much flexible and are not designed to handle thousands of routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EGP(Exterior Gateway protocol -- used to work between different AS number .It is slower than IGPs but are much more flexible and can handle lakhs of routes. example BGP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And yes BGP do share routing info . :)&lt;/p&gt;&#xA;" OwnerUserId="26934" LastActivityDate="2016-06-06T22:52:09.887" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32023" PostTypeId="1" AcceptedAnswerId="32027" CreationDate="2016-06-07T01:29:44.783" Score="2" ViewCount="1760" Body="&lt;p&gt;On a network switch, if the admin state is made &quot;UP&quot; by using a &quot;no shutdown&quot; on that physical interface then it remains &quot;UP&quot; what so ever until the port is configured as &quot;shutdown&quot;. This is the current behavior on OpenSwitch NOS. Is this correct behavior? I'd like this behavior to be as close to what network engineers would expect. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This behavior has been changed recently (last month). Earlier the behavior was that if the plug-gable module on that interface was disconnected then the admin state would say &quot;DOWN&quot;. Need to figure this out from a network engineer or current practices  stand point. I'm new to networking. Currently contributing to OpenSwitch project.&lt;/p&gt;&#xA;" OwnerUserId="21981" LastActivityDate="2016-06-07T04:10:44.763" Title="admin state Vs link state from a network engineer stand point" Tags="|switch|interface|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32025" PostTypeId="1" CreationDate="2016-06-07T02:59:41.087" Score="3" ViewCount="1169" Body="&lt;p&gt;I'm new to ASA and I'm trying my best to get our new VLAN104 (servers) pass through the ASA to the internet. I have a L3 switch which does the inter-vlan routing. Each vlan can ping across each other. Vlan1 (192.168.100.0/24) is directly connected to the ASA and can access the internet fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just recently I created a new vlan104 (id 104) (192.168.104.0/24), and moved some new VMs and storages there. I can ping as far as the core switch (HP 2920) from this new vlan. The ASA doesn't respond or blocks me. The strange thing here is, when I disconnect the 2x access switches (the LAN) from the core switch, connect my laptop straight to the core switch, assign a static VLAN104 IP address (192.168.104.xx), it goes straight to the Internet. The ping replies are fine unless/until I plug back the 2x access switches to the core switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: the servers and computers are connected to the access switches. Please see the diagram attached for your information. Should you need the configs, I'll post it upon request. Or if my english is not clear, please let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any response and assistance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/v2roA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v2roA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the current configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 9.1(2) &#xA;!&#xA;interface GigabitEthernet0/0&#xA; description Outside Interface&#xA; nameif outside&#xA; security-level 0&#xA; ip address 10.15.xx.xx 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/1&#xA; description Inside Interface&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.100.2 255.255.255.0 &#xA;!&#xA; domain-name pngngcb.local&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network inside-outside&#xA; subnet 192.168.100.0 255.255.255.0&#xA; description Inside LAN to Outside&#xA;object network 192.168.100.5&#xA; host 192.168.100.5&#xA; description mail-server&#xA;object network 192.168.100.103&#xA; host 192.168.100.103&#xA; description mail-server&#xA;object network 192.168.100.3&#xA; host 192.168.100.3&#xA; description server&#xA;object network vlan104&#xA; subnet 192.168.104.0 255.255.255.0&#xA;object-group service DM_INLINE_SERVICE_1&#xA; service-object icmp echo&#xA; service-object icmp6 echo&#xA;access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any &#xA;access-list inside_access_in remark NGCB Server - Mail &amp;amp; File Server&#xA;access-list inside_access_in extended permit ip object 192.168.100.5 any &#xA;access-list inside_access_in extended permit ip host 192.168.100.102 any &#xA;access-list inside_access_in extended permit ip host 192.168.100.111 any &#xA;access-list inside_access_in extended permit ip host 192.168.104.11 any &#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;!&#xA;object network inside-outside&#xA; nat (inside,outside) dynamic interface&#xA; nat (inside,outside) dynamic interface&#xA;object network vlan104&#xA; nat (inside,outside) dynamic interface&#xA;access-group outside_access_in in interface outside&#xA;access-group inside_access_in in interface inside&#xA;route outside 0.0.0.0 0.0.0.0 10.15.xx.xx 1&#xA;route inside 192.168.104.0 255.255.255.0 192.168.100.9 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;http server enable&#xA;http 192.168.1.0 255.255.255.0 management&#xA;http 192.168.100.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpool policy&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect ip-options &#xA;  inspect netbios &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect skinny  &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect sunrpc &#xA;  inspect tftp &#xA;  inspect sip  &#xA;  inspect xdmcp &#xA;  inspect icmp &#xA;!&#xA;&#xA;HP 2920 switch&#xA;...............&#xA;Running configuration:&#xA;&#xA;; J9729A Configuration Editor; Created on release #WB.15.12.0015&#xA;; Ver #05:18.41.ff.35.0d:9b&#xA;&#xA;hostname &quot;NGCB-SW4&quot;&#xA;module 1 type j9729a&#xA;ip default-gateway 192.168.100.2&#xA;ip route 0.0.0.0 0.0.0.0 192.168.100.2&#xA;ip routing&#xA;interface 44&#xA;   name &quot;UPLINK_TO_SW#2_LEVEL_2&quot;&#xA;   exit&#xA;interface 45&#xA;   name &quot;LINK_TO_PBX&quot;&#xA;   exit&#xA;interface 46&#xA;   name &quot;PTP_LINK_TO_MOGORU_MOTO&quot;&#xA;   exit&#xA;interface 47&#xA;   name &quot;UPLINK_TO_SW#1_LEVEL_3&quot;&#xA;   exit&#xA;interface 48&#xA;   name &quot;UPLINK_TO_ROUTER&quot;&#xA;   exit&#xA;snmp-server community &quot;public&quot; unrestricted&#xA;oobm&#xA;   ip address dhcp-bootp&#xA;   exit&#xA;vlan 1&#xA;   name &quot;DEFAULT_VLAN&quot;&#xA;   no untagged 45&#xA;   untagged 1-43,48,A1-A2,B1-B2&#xA;   tagged 44,46-47&#xA;   ip address 192.168.100.9 255.255.255.0&#xA;   ip helper-address 192.168.100.103&#xA;   exit&#xA;vlan 100&#xA;   name &quot;VoIP&quot;&#xA;   untagged 45&#xA;   tagged 1-4,6-44,46-48&#xA;   ip address 192.168.50.254 255.255.255.0&#xA;   ip helper-address 192.168.100.103&#xA;   exit&#xA;vlan 104&#xA;   name &quot;MANAGEMENT&quot;&#xA;   ip address 192.168.104.254 255.255.255.0&#xA;   ip helper-address 192.168.100.103&#xA;   exit&#xA;no tftp server&#xA;no autorun&#xA;no dhcp config-file-update&#xA;no dhcp image-file-update&#xA;password manager&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26937" LastEditorUserId="509" LastEditDate="2016-06-09T05:25:55.013" LastActivityDate="2016-06-10T00:15:56.060" Title="New VLAN cannot pass through ASA 9.1" Tags="|cisco-asa|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="32027" PostTypeId="2" ParentId="32023" CreationDate="2016-06-07T04:10:44.763" Score="2" Body="&lt;p&gt;In Cisco land, admin down is only seen when an engineer (aka admin) :) issues the &quot;shutdown&quot; command on the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/16625/what-can-cause-fastethernet-is-up-line-protocol-is-down-on-cisco-switch&quot;&gt;this thread,&lt;/a&gt; other statuses include down/down and up/down. If there is no cable connected to the port the interface is down/down. If there is a cable connected but there's an issue, the interface will be up/down.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-06-07T04:10:44.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32028" PostTypeId="1" AcceptedAnswerId="32051" CreationDate="2016-06-07T06:04:27.937" Score="1" ViewCount="3820" Body="&lt;p&gt;In a new setup we have a site where &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC--&gt;ACCSW--&gt;FW--&gt;VPNRT--&gt;ISP........Other site DHCP server(10.1.1.1)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;We are able to ping DHCP server from  ACCSW to DHCP server.&lt;/li&gt;&#xA;&lt;li&gt;PC is not getting IP from DHCP server, but by assigning stactic IP we are able to ping DHCP and remote site from PC.&#xA;3.ACCSW has VLAN 10.66.X.X/28  &lt;/li&gt;&#xA;&lt;li&gt;DHCP has scope 10.66.X.21-40&lt;/li&gt;&#xA;&lt;li&gt;Do we need to open any specific port in ourl local FW in order to allow DHCP communication?&lt;/li&gt;&#xA;&lt;li&gt;What all things we need to check in order to get IP from DHCP server&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19899" LastActivityDate="2016-06-12T02:56:39.447" Title="Not getting IP from DHCP server" Tags="|dhcp|switching|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32029" PostTypeId="2" ParentId="32028" CreationDate="2016-06-07T06:17:47.170" Score="3" Body="&lt;p&gt;DHCP runs over UDP ports 67 &amp;amp; 68, so you will need to open those for this to work. Depending on your setup you might also be missing a DHCP relay configuration on your FW to forward DHCP requests to your server.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-06-07T06:17:47.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32032" PostTypeId="1" AcceptedAnswerId="32033" CreationDate="2016-06-07T08:36:47.177" Score="0" ViewCount="355" Body="&lt;p&gt;Did any switch have many queue in each port or it have only one sharing queue?&#xA;I want to know the packet how to queue in one switch. &#xA;In switch is each port have special queue for packet receive and send?&#xA;Or the switch only have one sharing queue to the packet?&lt;/p&gt;&#xA;" OwnerUserId="25805" LastActivityDate="2019-02-08T12:26:47.630" Title="Did any switch have many queuing in each port or it have only sharing one queue?" Tags="|switch|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32033" PostTypeId="2" ParentId="32032" CreationDate="2016-06-07T08:45:51.067" Score="0" Body="&lt;p&gt;This is depending on some vendors with different technologies. &#xA;basically, switch have different queue for each port. there are two technologies, (cut-trough and store-and-forward) &#xA;cut-trough : buffering 1st 64 bit and passing rest of frame to destination port if no error occurs in first 64 bit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;store-and-forward : buffering whole frame and if no error found in frame, frame will send to destination port. &lt;/p&gt;&#xA;" OwnerUserId="21995" LastActivityDate="2016-06-07T08:45:51.067" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32034" PostTypeId="1" CreationDate="2016-06-07T12:22:35.613" Score="2" ViewCount="4774" Body="&lt;p&gt;Is there an actual difference between a CRC error and a FCS error?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading a lot, they seem like the same thing, but most switches and readings refer to them as separate entities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an overlap of these counters on a switch interface?&lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2016-06-07T16:56:34.457" Title="Difference between CRC errors and FCS errors?" Tags="|switch|ethernet|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32041" PostTypeId="1" CreationDate="2016-06-07T14:39:06.923" Score="1" ViewCount="147" Body="&lt;p&gt;Router reaches internet fine, switch vlan can not.&#xA; here is router config&#xA;&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 216.208.25.83 255.255.255.248&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1.504&#xA; description VOIP traffic&#xA; encapsulation dot1Q 504&#xA; ip address 192.168.100.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;ip http access-class 5&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;ip flow-top-talkers&#xA; top 35&#xA; sort-by bytes&#xA; cache-timeout 15000&#xA; match destination port min 0 max 65535&#xA;!&#xA;ip nat inside source list 100 interface GigabitEthernet0/0 overload&#xA;ip route 0.0.0.0 0.0.0.0 216.205.25.81&#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0&#xA;!&#xA;logging history errors&#xA;logging facility local3&#xA;logging source-interface GigabitEthernet0/1.511&#xA;logging host 172.26.1.130&#xA;!&#xA;!&#xA;snmp-server community brand RO 5&#xA;snmp-server location caclaWAN01 (Caledon, CA)&#xA;snmp-server contact operations.it@beis.com&#xA;snmp-server enable traps tty&#xA;access-list 5 permit 24.104.67.178&#xA;access-list 5 permit 74.205.253.0 0.0.0.127&#xA;access-list 5 permit 172.16.0.0 0.0.7.255&#xA;access-list 5 permit 172.16.8.0 0.0.3.255&#xA;access-list 5 permit 172.20.0.0 0.0.15.255&#xA;access-list 5 permit 172.26.0.0 0.0.15.255&#xA;access-list 5 permit 172.16.35.0 0.0.0.255&#xA;access-list 5 permit 172.17.24.0 0.0.0.255&#xA;access-list 5 permit 172.16.39.0 0.0.0.255&#xA;access-list 5 permit 192.168.100.0 0.0.0.255&#xA;access-list 5 permit 216.205.25.0 0.0.0.255&#xA;access-list 100 permit ip 172.31.41.0 0.0.0.255 any&#xA;access-list 100 permit ip 192.168.100.0 0.0.0.255 any&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; logging synchronous&#xA; login local&#xA;line aux 0&#xA;line 2&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport output pad telnet rlogin lapb-ta mop udptn v120 ssh&#xA; stopbits 1&#xA;line vty 0 4&#xA; access-class 5 in&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; login local&#xA; transport input telnet ssh&#xA;line vty 5 15&#xA; access-class 5 in&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; login local&#xA; transport input telnet ssh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;switch has a trunk port vlan 504 &#xA;config as&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; description VOICE Router&#xA; switchport trunk allowed vlan 504&#xA; switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ping wont reach internet from switch &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping 8.8.8.8 source 192.168.100.50&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.168.100.50&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but router can&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping 8.8.8.8 source 192.168.100.1&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.168.100.1&#xA;!!!!!&#xA;&#xA;&#xA;#show spanning-tree vlan 504&#xA;&#xA;VLAN0504&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    33272&#xA;             Address     00da.556d.9a80&#xA;             This bridge is the root&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    33272  (priority 32768 sys-id-ext 504)&#xA;             Address     00da.556d.9a80&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  300 sec&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;Gi1/0/2             Desg FWD 4         128.2    P2p Edge&#xA;Gi1/0/47            Desg FWD 4         128.47   P2p&#xA;Gi1/0/48            Desg FWD 4         128.48   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26956" LastEditorUserId="509" LastEditDate="2016-06-07T15:08:14.323" LastActivityDate="2017-01-03T20:02:34.143" Title="Can not reach internet from vlan on switch" Tags="|routing|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32042" PostTypeId="2" ParentId="32041" CreationDate="2016-06-07T15:15:29.627" Score="0" Body="&lt;p&gt;cardboard man errors, default gateway of dhcp for VOIP was wrong.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks guys..&lt;/p&gt;&#xA;" OwnerUserId="26956" LastActivityDate="2016-06-07T15:15:29.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32046" PostTypeId="2" ParentId="32034" CreationDate="2016-06-07T16:56:34.457" Score="4" Body="&lt;p&gt;It was my understanding that CRC is the algorithm that FCS uses to do its check. Meaning that the Frame Relay, PPP and other protocols have the CRC to be used as the algorithm to calculate the FCS as defined in their standard. Other protocols could include a FCS but use a different algorithm besides CRC.&lt;/p&gt;&#xA;" OwnerUserId="25264" LastActivityDate="2016-06-07T16:56:34.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32048" PostTypeId="1" AcceptedAnswerId="32054" CreationDate="2016-06-07T18:14:14.420" Score="1" ViewCount="331" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Rl56u.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Rl56u.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;What kind of fiber connection does the top switch use?  I know the bottom switch uses a multi-mode MTRJ connector but I want to connect the bottom switch to the top switch.  This is practice for the CCNA exam.  I am new to fiber cable connections :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="23422" LastActivityDate="2016-06-07T21:45:36.480" Title="Need fiber connection between switches" Tags="|ethernet|fiber|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32049" PostTypeId="1" CreationDate="2016-06-07T19:02:11.543" Score="2" ViewCount="3450" Body="&lt;p&gt;we have c3850 trunk with other switch 4948 and its LACP 4x1G interface bonding (etherchannel) out of 4 1G we are getting &lt;code&gt;Total output drops&lt;/code&gt; on 2 interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is all started yesterday when i upgrade software on this switch before that everything was good. doesn't make sense. I have done this upgrade on other switches to but no issue so far. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#sh int g2/0/1&#xA;GigabitEthernet2/0/1 is up, line protocol is up (connected)&#xA;  Hardware is Gigabit Ethernet, address is 1c1d.86a9.3501 (bia 1c1d.86a9.3501)&#xA;  Description: coreSW_1_W_1of4_p&#xA;  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 36/255, rxload 25/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:11, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 133157273&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 100659000 bits/sec, 61038 packets/sec&#xA;  5 minute output rate 144390000 bits/sec, 76852 packets/sec&#xA;     3445318149 packets input, 715126259616 bytes, 0 no buffer&#xA;     Received 827824 broadcasts (666658 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 666658 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     4521665906 packets output, 1080744400610 bytes, 0 underruns&#xA;     133157273 output errors, 0 collisions, 1 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Counter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#sh int g2/0/1 counters&#xA;&#xA;Port            InOctets    InUcastPkts    InMcastPkts    InBcastPkts&#xA;Gi2/0/1     718020111847     3459023952         668522         161527&#xA;&#xA;Port           OutOctets   OutUcastPkts   OutMcastPkts   OutBcastPkts&#xA;Gi2/0/1    1084965964251     4539489816         109940          86365&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Stats:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C3850#sh int g2/0/1 stats&#xA;GigabitEthernet2/0/1&#xA;          Switching path    Pkts In   Chars In   Pkts Out  Chars Out&#xA;               Processor      10458    2249522          0          0&#xA;             Route cache          0          0      18985    2870366&#xA;                   Total      10458    2249522      18985    2870366&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;EDIT:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Our total utilization on link is 400Mbps, and i am seeing all link using around ~100 Mbps individually (few bytes here and there). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not seeing any performance issue on network. this trunk is connected to other switch and they are also running same speed interface 4x1G. I have upgrade multiple switch with same software and they all working fine without any interface error. &lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2016-06-08T01:43:56.837" LastActivityDate="2016-07-08T02:21:15.017" Title="cisco Total output drops on interface" Tags="|cisco|switch|errors|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32050" PostTypeId="1" AcceptedAnswerId="32055" CreationDate="2016-06-07T20:17:50.243" Score="1" ViewCount="247" Body="&lt;p&gt;Although our devices are named things like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;atln-0102-rt06-ge0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I often see naming conventions that use sub-domains like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cr06-0102-ge0.atln.example.net&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or even:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ge0.cr06-0102.atln.example.net&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When would I want to incorporate sub-domains into the naming convention and what are the advantages?&lt;/p&gt;&#xA;" OwnerUserId="26963" LastActivityDate="2016-06-07T22:25:12.210" Title="What is the advantage in using sub-domains in network naming conventions?" Tags="|design|" AnswerCount="1" CommentCount="3" ClosedDate="2016-06-08T05:09:42.753" ContentLicense="CC BY-SA 3.0" />
  <row Id="32051" PostTypeId="2" ParentId="32028" CreationDate="2016-06-07T20:50:47.233" Score="1" Body="&lt;p&gt;You would need to enable DHCP forwarding/relay on the border devices and open the ports on the firewall. DHCP broadcast doesn't get past routers unless forwarding/relay is enabled and configured.&lt;/p&gt;&#xA;" OwnerUserId="26930" LastActivityDate="2016-06-07T20:50:47.233" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32052" PostTypeId="1" AcceptedAnswerId="32082" CreationDate="2016-06-07T21:20:57.523" Score="3" ViewCount="882" Body="&lt;p&gt;I have a ipsec vpn with a foreign company, this connects my network with their network and they have a different ip subnet. Ipsec is made by a pfsense gateway/firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure it is well configured, all ipsec params are set and the tunnel looks established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However foreign colegues cannot connect to my machines, but I have a clue!&#xA;If I run a ping from my pfsense ipsec interface to foreign ip address magically it starts working and they can connect!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they need to connect again after few hours I have to ping them again and so on.... And it works only with ping from ipsec interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For me is strange to solve a network problem with a ping. What can be the cause? Where should I focus my search?&lt;/p&gt;&#xA;" OwnerUserId="26964" LastActivityDate="2019-09-30T15:39:44.213" Title="Ping unlocks ipsec vpn" Tags="|vpn|ipsec|ping|pfsense|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32053" PostTypeId="2" ParentId="32049" CreationDate="2016-06-07T21:33:09.467" Score="-3" Body="&lt;p&gt;You don't need LACP.  Keep it simple.  Simply configure the port-channel interface and then assign your physical Ethernet ports to that port-channel group &lt;code&gt;mode on&lt;/code&gt;.  Shut the port-channel interface and the whole bundle of physical interfaces on both switches, then bring them all back online starting with the port-channel interfaces.  That should do it.  Go ahead and test bringing down individual link(s) and make sure they come back up.  If you have issues do a &lt;code&gt;show int&lt;/code&gt; and look for &lt;code&gt;errdisable&lt;/code&gt;.  That's why I'm saying admin shut them and unshut them to clear that out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see why you need LACP at all...&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-06-07T21:33:09.467" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32054" PostTypeId="2" ParentId="32048" CreationDate="2016-06-07T21:45:36.480" Score="4" Body="&lt;p&gt;From &lt;a href=&quot;http://www.andovercg.com/datasheets/cisco-2900-series-catalyst-switch.pdf&quot; rel=&quot;nofollow&quot;&gt;Cisco's Datasheet&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;100BaseFX ports: SC connector, 50/125- and 62.5/125-micron multimode fiber-optic cabling (only on Catalyst 2924C&#xA;  and 2-port and 4-port 100BaseFX modules)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-06-07T21:45:36.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32055" PostTypeId="2" ParentId="32050" CreationDate="2016-06-07T22:25:12.210" Score="1" Body="&lt;p&gt;The difference in style of naming often depends on how the network is provisioned and managed.  If all assets are inventoried in a single central database, the first might be better, especially if it already generates those unique IDs.  On the other hand, if the provisioning and configuration is done locally at individual sites (e.g. the &quot;atln&quot; in your example), then being able to delegate a subdomain such that they don't need to interact with a central repository to deploy might be desired, and so the second form is preferred.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That having been said...  In actual practice usually neither of these is a sufficient factor to turn the tide and it's just a matter of taste for the initial deployment team.  Personally, I like using the tree structure of the DNS to represent structure in the network, but I've known other Network Engineers that strongly favor the flat style of naming.&lt;/p&gt;&#xA;" OwnerUserId="6388" LastActivityDate="2016-06-07T22:25:12.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32056" PostTypeId="2" ParentId="32028" CreationDate="2016-06-07T22:54:42.360" Score="1" Body="&lt;p&gt;The DHCP protocol is being used by the PC to get an address.  So, when it sends out the request it uses a dummy filler for it's own address, but the Mac Address (I.e. the hardware Ethernet address on Ethernet) is sent in the packet.  The packet is also sent to a general (broadcast or multicast) address.  Since broad/multi-cast packets are not forwarded, it won't make it (directly) to a server on another segment.  And since there's no IP address (yet) for the original host, without help, a reply cannot be routed to the original querent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To address this the DHCP protocol has the concept of a DHCP relay (sometimes called a DHCP helper).  If there is a DHCP relay on the same Ethernet segment, it receives the original DHCP request and then updates it to have the unicast IP address for the server and it's own IP address for the reply.  Then when the reply is received, it matches it to the original request and has a Mac address to send the reply to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what you need to do is configure either the access switch or firewall to act as a DHCP relay.  Depending on the specific models either or both might be able to do this.  Note that you also need to be sure the firewall allows the traffic, and remember that in DHCP you have relayed packets with modified addresses that may affect how you filter.&lt;/p&gt;&#xA;" OwnerUserId="6388" LastEditorUserId="6388" LastEditDate="2016-06-12T02:56:39.447" LastActivityDate="2016-06-12T02:56:39.447" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32057" PostTypeId="1" CreationDate="2016-06-07T23:50:53.313" Score="1" ViewCount="1527" Body="&lt;p&gt;I had a question here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, we have two different networks. Each network has one Cisco 2960 layer 2 switch for each network in the same location. These are two individual networks. There is a link from each switch to a service provider router. The service provider has provided us two interfaces on their router, one for each network. The default gateway on each switch is the inside interface IP of the router. The service provider router does all the routing before sending it out WAN to our data center.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attached is a quick drawing put together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, we have a backup server connected to each switch for each network. In an attempt to reduce the number of backup servers, management has asked us to reduce to one backup server (for both networks) and use the other backup server as spare. My question is, how can we route between the two networks, for the sake of using single backup server. The users should still be on separate networks. Do we need to put a layer 3 device to perform the routing? Or can we add some kind of static routes on our layer 2 switch to the service provided router since it is doing all the routing? Can someone please comment?&lt;/p&gt;&#xA;" OwnerUserId="26970" LastEditorUserId="8499" LastEditDate="2018-12-21T04:57:41.700" LastActivityDate="2018-12-21T04:57:41.700" Title="Routing between two networks" Tags="|routing|layer2|layer3|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32058" PostTypeId="2" ParentId="32057" CreationDate="2016-06-07T23:56:28.697" Score="0" Body="&lt;p&gt;You cannot do this at layer-2. Layer-2 doesn't understand routers or IP. You must use a layer-3 device (router). You need to put a router between the networks. A layer-3 switch contains a router. You have to evaluate your needs, but it could be that either a stand-alone router or a layer-3 switch may work for your requirements. Routers route between networks.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-07T23:56:28.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32059" PostTypeId="1" CreationDate="2016-06-07T23:59:44.053" Score="2" ViewCount="3335" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9jhu5.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9jhu5.gif&quot; alt=&quot;Network Not work&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two vlans configured through a multilayer switch and one router with DHCP service. I configured trunk and access ports as shown in the image below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to block traffic between vlan's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.gif shows that my network currently allow send messages between Vlan10 and Vlan20, but they shouldn't see each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I block that traffic? Already configured subinterfaces and encap dot1q [vlan number].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Packet Tracer File: dropbox.com/s/y7cplt8l6zpv303/v2.pkt?dl=0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Commands used in another network with the same purpose: docs.google.com/document/d/120PfwrPki67Z2gMxoCz8Z6SidulgLCiUVLU-NqVBq3w/edit#&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yLxDx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yLxDx.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;** ROUTER CONFIG&#xA;ip dhcp pool 10&#xA; network 172.16.0.0 255.255.255.128&#xA; default-router 172.16.0.1&#xA;ip dhcp pool 20&#xA; network 172.17.0.0 255.255.255.128&#xA; default-router 172.17.0.1&#xA;ip dhcp pool vlan10&#xA; network 172.16.0.0 255.255.255.128&#xA; default-router 172.16.0.1&#xA;ip dhcp pool vlan20&#xA; network 172.17.0.0 255.255.255.128&#xA; default-router 172.17.0.1&#xA;!&#xA;&#xA;Router#sh ip int br&#xA;Interface              IP-Address      OK? Method Status                Protocol&#xA;&#xA;FastEthernet0/0        172.116.1.1     YES manual up                    up&#xA;&#xA;FastEthernet0/0.10     172.16.0.1      YES manual up                    up&#xA;&#xA;FastEthernet0/0.20     172.17.0.1      YES manual up                    up&#xA;&#xA;FastEthernet0/1        unassigned      YES unset  administratively down down&#xA;&#xA;Vlan1                  unassigned      YES unset  administratively down down&#xA;&#xA;&#xA;&#xA;Router#show vlan&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                          active    &#xA;1002 fddi-default                     act/unsup &#xA;1003 token-ring-default               act/unsup &#xA;1004 fddinet-default                  act/unsup &#xA;1005 trnet-default                    act/unsup &#xA;&#xA;VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2&#xA;---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------&#xA;1    enet  100001     1500  -      -      -        -    -        0      0&#xA;1002 fddi  101002     1500  -      -      -        -    -        0      0   &#xA;1003 tr    101003     1500  -      -      -        -    -        0      0   &#xA;1004 fdnet 101004     1500  -      -      -        ieee -        0      0   &#xA;1005 trnet 101005     1500  -      -      -        ibm  -        0      0   &#xA;&#xA;Remote SPAN VLANs&#xA;------------------------------------------------------------------------------&#xA;&#xA;&#xA;Primary Secondary Type              Ports&#xA;------- --------- ----------------- ------------------------------------------&#xA;&#xA;&#xA;&#xA;**** Switch config&#xA;&#xA;interface FastEthernet0/1&#xA; switchport trunk allowed vlan 1-19,21-1005&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport trunk allowed vlan 1-9,11-1005&#xA;!&#xA;&#xA;Switch#show vlan&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- -------------------------------&#xA;1    default                          active    Fa0/3, Fa0/4, Fa0/5, Fa0/6&#xA;                                                Fa0/7, Fa0/8, Fa0/9, Fa0/10&#xA;                                                Fa0/11, Fa0/12, Fa0/13, Fa0/14&#xA;                                                Fa0/15, Fa0/16, Fa0/17, Fa0/18&#xA;                                                Fa0/19, Fa0/20, Fa0/21, Fa0/22&#xA;                                                Fa0/23, Fa0/24, Gig0/1, Gig0/2&#xA;10   vlan10                           active    &#xA;20   vlan20                           active    &#xA;1002 fddi-default                     act/unsup &#xA;1003 token-ring-default               act/unsup &#xA;1004 fddinet-default                  act/unsup &#xA;1005 trnet-default                    act/unsup &#xA;&#xA;VLAN Type  SAID       MTU   Parent RingNo BridgeNo Stp  BrdgMode Trans1 Trans2&#xA;---- ----- ---------- ----- ------ ------ -------- ---- -------- ------ ------&#xA;1    enet  100001     1500  -      -      -        -    -        0      0&#xA;10   enet  100010     1500  -      -      -        -    -        0      0&#xA;20   enet  100020     1500  -      -      -        -    -        0      0&#xA;1002 fddi  101002     1500  -      -      -        -    -        0      0   &#xA;1003 tr    101003     1500  -      -      -        -    -        0      0   &#xA;1004 fdnet 101004     1500  -      -      -        ieee -        0      0   &#xA;1005 trnet 101005     1500  -      -      -        ibm  -        0      0   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="26971" LastEditorUserId="26971" LastEditDate="2016-06-08T02:09:57.150" LastActivityDate="2016-06-08T15:47:49.250" Title="VLans Cisco Packet tracer" Tags="|switch|vlan|network-access|trunk|packet-tracer|" AnswerCount="1" CommentCount="8" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32060" PostTypeId="2" ParentId="32057" CreationDate="2016-06-08T00:41:56.617" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Attached is a quick drawing put together.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can't see a drawing. Did you forget to upload it or is my browser playing up?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Each network has one Cisco 2960 layer 2 switch for each network in the&#xA;  same location. These are two individual networks. There is a link from&#xA;  each switch to a service provider router. The service provider has&#xA;  provided us two interfaces on their router, one for each network. The&#xA;  default gateway on each switch is the inside interface IP of the&#xA;  router. The service provider router does all the routing before&#xA;  sending it out WAN to our data center.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As the ISPs router has a leg in both networks you should be able to route between them the networks using that router. You wouldn't need to purchase any additional equipment or use an additional network card. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good way to test this theory is to ping from a PC in one network to the backup server in the other network. If this works then your backups will work too.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-06-08T00:41:56.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32062" PostTypeId="1" AcceptedAnswerId="32083" CreationDate="2016-06-08T00:45:53.163" Score="2" ViewCount="149" Body="&lt;p&gt;I am a volunteer network engineer working in a building housing refugees in Greece. It's an old school and is extremely densely populated (multiple families in each classroom). Many people have phones with WiFi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is one very good access point (Unifi) which is unproblematic, stays up and gives good coverage. I wanted to provide another access point to address a small area not already covered. I've tried four different consumer grade ones and they've all had the same problem. The signal fluctuates between full strength and nothing at all (using a WiFi analyser app, it shoots up and then disappears). Sometimes phones see it, sometimes they don't. Or you can see it and apparently connect but there is no internet access at all (you get the &quot;device is offline&quot; error).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The obvious answer is that the access point doesn't support enough clients but I've googled this and the symptoms of congestion are described as slowdown and latency. Could it also cause the symptoms I described? &lt;/p&gt;&#xA;" OwnerUserId="26972" LastEditorUserId="26972" LastEditDate="2016-06-08T18:08:23.437" LastActivityDate="2016-07-08T18:35:26.957" Title="WiFi signal drops and difficulty connecting... too many clients?" Tags="|ieee-802.11|congestion|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="32063" PostTypeId="2" ParentId="32049" CreationDate="2016-06-08T01:13:19.897" Score="1" Body="&lt;p&gt;Have you noticed a degradation in performance since doing the upgrade? If not, the issue could be that you have been experiencing the issue all along but your previous IOS version wasn't reporting the errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;let's say you are experiencing a degradation in performance though. As you're seeing output drops this typically means that the links are experiencing congestion. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you might already know, traffic is not equally split across all links in a port channel. For example, port channeling 4 x 1Gb links &lt;strong&gt;does not&lt;/strong&gt; guarantee you 4Gb of throughput. The traffic is split across the links depending on what hashing algorithm you're using. Given this, it actually possible for one link to be maxed out while the other links remain dormant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While we're on the topic of load balancing algorithms, the issue your experiencing could be related to &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/express-forwarding-cef/116376-technote-cef-00.html&quot; rel=&quot;nofollow&quot;&gt;CEF polarization&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cisco IOS introduced a concept called unique-ID/universal-ID which&#xA;  helps avoid CEF polarization. &#xA;  This algorithm, called the universal&#xA;  algorithm (the default in current Cisco IOS versions), adds a 32-bit&#xA;  router-specific value to the hash function (called the universal ID -&#xA;  this is a randomly generated value at the time of the switch boot up&#xA;  that can can be manually controlled). This seeds the hash function on&#xA;  each router with a unique ID, which ensures that the same&#xA;  source/destination pair hash into a different value on different&#xA;  routers along the path. This process provides a better network-wide&#xA;  load-sharing and circumvents the polarization issue. This unique -ID&#xA;  concept does not work for an even number of equal-cost paths due to a&#xA;  hardware limitation, but it works perfectly for an odd number of&#xA;  equal-cost paths. In order to overcome this problem, Cisco IOS adds&#xA;  one link to the hardware adjacency table when there is an even number&#xA;  of equal-cost paths in order to make the system believe that there is&#xA;  an odd number of equal-cost links. In order to configure a customized&#xA;  value for the universal ID, use: &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;6500(config)ip cef load-sharing algorithm universal &amp;lt;id&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another possible cause is &lt;a href=&quot;http://corvil.com/blog/2014/so-what-s-a-microburst-anyway-and-why-should-i-care&quot; rel=&quot;nofollow&quot;&gt;micro bursting&lt;/a&gt; which happens when you've got a speed step down (e.g a 1Gb interface connected to a 100Mb interface). If your interfaces are configured to auto negotiate their speed and duplex, check them all to ensure that they've negotiated their settings correctly.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-06-08T01:13:19.897" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32065" PostTypeId="2" ParentId="30969" CreationDate="2016-06-08T03:03:35.417" Score="4" Body="&lt;p&gt;In my personal experience &quot;interference from power lines&quot; is more of a marketing myth than reality with twisted pair cable, which is actually highly resistant to interference pickup, by design. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But fiber its the right choice 10 times out of 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Main advantage (practical) - complete electrical isolation - no lovely lighting-induced surges on the data lines frying equipment. Having had those, I strongly prefer fiber for ANY outside line, no matter how short. It's also immune to probably mythical powerline interference, if that makes you happy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Single mode fiber offers you the highest possible bandwidth now and in the future, and is relatively inexpensive. If you can get &quot;RBR&quot; (reduced bend radius) fiber for an upcharge that you'd consider small, I recommend that, too. Otherwise, just be careful about bend radius when installing the fiber. The &quot;Wisdom&quot; of multimode fiber for short links is based on cost arguments that are no longer true, in my experience, and it will become obsolete where the single-mode won't. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cost of multimode fiber suitable for high bandwidth so greatly exceeds the cost of singlemode equipment at the ends of the fiber that it makes no sense. If you shop used equipment, the prices get even better. (I have a campus covered with mostly short links of SM fiber circa 2010, because I did the math on this and also read the writing on the wall. If you had installed SM and MM fibers in 1980, your SM fiber would still be good, and your MM fiber would have been obsoleted 3-4 times already.)&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-06-08T03:03:35.417" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32067" PostTypeId="1" AcceptedAnswerId="32153" CreationDate="2016-06-08T07:46:41.840" Score="1" ViewCount="328" Body="&lt;p&gt;In a frame relay multipoint topology where the routers are running RIP, we know that RIP by default keeps split horizon on with IPv6 and we go into the RIP process an use no ip-split horizon to disable it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my question is, what command do you run to check whether split horizon is enabled on disabled on that interface with IPv6?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much thanks!&lt;/p&gt;&#xA;" OwnerUserId="20062" LastEditorUserId="8499" LastEditDate="2018-03-12T00:33:56.783" LastActivityDate="2018-03-12T00:33:56.783" Title="Checking split horizon status with IPv6" Tags="|cisco|routing|ip|ipv6|rip|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32069" PostTypeId="1" CreationDate="2016-06-08T08:41:50.183" Score="2" ViewCount="7239" Body="&lt;p&gt;How can i configure ip address to cisco switch without configuring vlan. I have configured ip with vlan.&lt;/p&gt;&#xA;" OwnerUserId="26978" LastEditorUserId="509" LastEditDate="2016-06-08T09:13:27.717" LastActivityDate="2016-06-10T10:08:37.617" Title="How can i configure ip address to cisco switch without configuring vlan" Tags="|cisco|switch|vlan|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32072" PostTypeId="2" ParentId="32069" CreationDate="2016-06-08T08:57:12.290" Score="7" Body="&lt;p&gt;A layer-2 switch can have only one management address assigned to it (on a single VLAN.) You can have as many VLANs as you like, but only one &lt;em&gt;interface vlan#&lt;/em&gt; can be &lt;em&gt;no shutdown&lt;/em&gt; at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A layer-3 switch can have secondary addresses on any routed interfaces. Routed interfaces are usually limited to VLANs, however, some switches do allow switched interface to be converted to non-switch mode (&lt;code&gt;no switchport&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, if the switch has a dedicated, out-of-band management interface, it can have an address as well. That's the only non-routed interface that supports layer-3 functions.&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2016-06-08T09:02:12.417" LastActivityDate="2016-06-08T09:02:12.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32073" PostTypeId="2" ParentId="26694" CreationDate="2016-06-08T09:07:01.460" Score="0" Body="&lt;p&gt;24-Port 10/100Mbps labelled on the switch means that there are 24 ports which handle 10/100Mbps, and 2 SFP/1000T shows that this switch can support both optical (1000BASE-X) and copper 1000BASE-T SFP modules for 1Gbps uplinks.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-06-08T09:07:01.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32075" PostTypeId="1" AcceptedAnswerId="32089" CreationDate="2016-06-08T12:56:53.853" Score="2" ViewCount="1821" Body="&lt;p&gt;I have two trunked L3 switches forming a network backbone. One is an old HP2848 and the other is a new Juniper EX3300. Currently only the EX3300 connects to our WAN Router and is trunked via 4 LACP links to the HP2848. Multiple access switches carrying 6 VLANs connect to both switches (roughly equal traffic loads).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently the EX3300 handles all interVLAN routing for all VLANs. My question is: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best way to handle InterVLAN routing? Should I enable SVIs on the HP2848 but keep the physical configuration as is? Should I setup routing on the HP2848 for 1 or 2 of the VLANs to account for its smaller CPU and use one of the trunk link cables to connect the HP2848 directly to the router? This would remove the single point of failure of the EX3300-Router link and I could maybe configure VRRP at this point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is, for most of the time, very little local traffic with the majority of all communication being towards the WAN router and on to the internet. The EX3300 and the Router are in one cupboard, the HP2848 is in another. I am not in a position to run extra cables. Traffic loads are not at a level where any CPUs are overloaded currently but traffic will increase for a period of time in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your advice is appreciated&lt;/p&gt;&#xA;" OwnerUserId="25750" LastActivityDate="2016-06-08T19:56:18.747" Title="Load balancing between multiple layer 3 switches" Tags="|routing|switch|redundancy|layer3|load-balancing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32078" PostTypeId="2" ParentId="28007" CreationDate="2016-06-08T14:51:06.127" Score="0" Body="&lt;p&gt;Originally circuit switching worked with physical circuits. When a connection was established a complete physical circuit would be tied up by each &quot;hop&quot; of the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However this is an inefficient way of running a network. An analog phone call needs about 4kHz of bandwidth. An uncompressed digital phone call needs about 64kbps of data rate. That isn't very much. We can easilly build circuits with a far greater capacity than that and a small number of high capacity circuits are cheaper than a larger number of low capacity circuits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore there is a desire to split each physical circuit into multiple &quot;virtual circuitS&quot;. For this we can use frequency division multiplexing (FDM) or time division multiplexing (TDM). Generally frequency division multipexing is associated with analog systems while time division multiplexing is associated with digital systems. The circuit switching can then work with virtual circuits instead of physical circuits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With frequency division multiplexing the signal for each virtual circuit is modulated onto a carrier (in the same way that radio systems modulate signals onto carriers). The modulated signals are then combined and sent down the circuit. At the far end the signals are seperated using frequency filters and then demodulated (again much like a radio system). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With time division multiplexing the data for each virtual circuit is sent down the physical circuit at a different time. The physical circuit will switch rapidly between virtual circuits to avoid causing undue latency. There will be headers of some sort to identify which data belongs to which virtual circuit. The virtual circuits may be either be fixed data rate with garuanteed delivery (e.g. a phone call) or variable data rate with the possibility of dropping data (e.g. a &quot;broadband&quot; internet connection). &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-06-08T14:51:06.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32079" PostTypeId="2" ParentId="32059" CreationDate="2016-06-08T15:47:49.250" Score="2" Body="&lt;p&gt;You need an access list to block inter-VLAN traffic. There will be one for each subinterface. For example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 10 deny 172.1.0.0 0.0.0.127&#xA;access-list 10 deny &amp;lt;vlan 30&amp;gt;&#xA;access-list 10 deny &amp;lt;etc&amp;gt;&#xA;access-list 10 permit any&#xA;&#xA;interface fa 0/0.10&#xA;access-group 10 out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you've never configured access list before, note the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The subnet masks in the statement are &quot;wildcard masks.&quot;  They are the&#xA;one's complement of a normal mask.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You need to add a line in your access list for every VLAN you want to block.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-08T15:47:49.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32081" PostTypeId="2" ParentId="32020" CreationDate="2016-06-08T16:05:13.853" Score="0" Body="&lt;p&gt;The routing protocols can also be configured to share different levels of information between each other, ranging from just a single default route to the full known routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multinational corporations use this approach on their global networks to provide fast routing at the local sites and stable WAN connections across the internet.&#xA; LAN-IGP &amp;lt;-&gt; WAN-BGP &amp;lt;-&gt; LAN-IGP &lt;/p&gt;&#xA;" OwnerUserId="26992" LastActivityDate="2016-06-08T16:05:13.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32082" PostTypeId="2" ParentId="32052" CreationDate="2016-06-08T18:12:17.073" Score="2" Body="&lt;p&gt;I have seen this behavior before where the VPN tunnel will only stay up when a ping is done from one end of the VPN tunnel to the other. There could be a few reasons for this. First I would check the SA lifetime on both ends of the tunnel. If there is a mismatch in either seconds or bytes for the lifetime then the VPN appliance (in your case the pfsense gateway/fiewall) with the higher SA lifetime will be able to start the VPN tunnel but it would not work the other way meaning if they tried pining you and they had a lower SA lifetime it would not be able to negotiate up to a higher SA lifetime and no VPN tunnel would start for phase 1 or phase 2. Second I would also check firewall settings on both ends as I have seen very odd firewall configurations in the past that have also caused similar behavior, but without being able to see your topology I am not sure if that is your problem.&lt;/p&gt;&#xA;" OwnerUserId="25264" LastActivityDate="2016-06-08T18:12:17.073" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32083" PostTypeId="2" ParentId="32062" CreationDate="2016-06-08T18:14:17.283" Score="2" Body="&lt;p&gt;It sounds like you have channel contention. Increase the minimum data rate on all your APs to make the cell size smaller. You want to disable low speeds so clients can't connect if signal is marginal. That has the effect of reducing the cell size.  This will reduce the number of clients on each AP and reduce channel utilization. Many small cells are better than a few large ones. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-08T18:14:17.283" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32084" PostTypeId="1" AcceptedAnswerId="32085" CreationDate="2016-06-08T19:10:57.697" Score="1" ViewCount="87" Body="&lt;p&gt;I'm in a network that provides both IPv4 and IPv6 for the nodes, and i have the IPv4 of a machine. How can I find the IPv6 assigned for this machine?&lt;/p&gt;&#xA;" OwnerUserId="26998" LastActivityDate="2016-06-08T19:29:18.680" Title="How to get the IPv6" Tags="|ipv4|ipv6|network-discovery|" AnswerCount="1" CommentCount="1" ClosedDate="2016-06-08T21:20:53.373" ContentLicense="CC BY-SA 3.0" />
  <row Id="32085" PostTypeId="2" ParentId="32084" CreationDate="2016-06-08T19:29:18.680" Score="0" Body="&lt;p&gt;If the node is in your subnet and you can ping the IPv4 address do that, then do an arp -a and find the IPv4 address and the corresponding MAC address. then do a netsh int IPv6 neighbors and find the same MAC address as you did before and that would be the IPv6 address for the same node.&lt;/p&gt;&#xA;" OwnerUserId="25264" LastActivityDate="2016-06-08T19:29:18.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32086" PostTypeId="2" ParentId="29250" CreationDate="2016-06-08T19:41:23.937" Score="0" Body="&lt;p&gt;Each IDF switch needs to have it's FastEthernet from the year 1999 set to 802.1q trunking and trunking mode (to math the other end on the core L3 switch).  Each IDF home-runs to the core layer3 switch so don't enable any additional STP.  If something is default probably leave it but otherwise take all the STP off.  Each switch needs to see all VLANs via either manual configuration of the VLAN database or VTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also need to assign each IDF switch with an IP address on int VLAN1 for management purposes and configure telnet or SSH access is possible.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-06-08T19:41:23.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32087" PostTypeId="2" ParentId="32069" CreationDate="2016-06-08T19:47:44.367" Score="0" Body="&lt;p&gt;The VLAN is configured already on all ports by default - VLAN1.  Simply assign an IP address and subnet mask to interface VLAN1.  Configure the ip default gateway so that you can remotely manage the switch via telnet, for example.  Telnet must be configured finally for the remote access to work.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-06-08T19:47:44.367" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32089" PostTypeId="2" ParentId="32075" CreationDate="2016-06-08T19:56:18.747" Score="3" Body="&lt;p&gt;Actually if your access switches connected to the so called &quot;core switches&quot; have just one uplink, either to the HP or to the Juniper, full redundancy is not an option given your constraints of no additional cabling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If also an additional cabling from the WAN router to the HP switch is not an option, even resiliency to the Juniper switch failure is not achievable as far as I can see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back to interVLAN routing, any FHRP protocol (VRRP etc.) can effectively work only assuming that a client is able to reach the backup gateway if the active one fails, but in your case if the Juniper switch goes down there is no way for the clients (connected via the switches with a unique uplink to this Juniper) to reach the HP switch.&#xA;Furthermore, even in the case you have VRRP in the example just above, the clients connected via the HP would only be able to establish interVLAN communications only with clients connected via the HP (no WAN or anything else).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="17572" LastActivityDate="2016-06-08T19:56:18.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32090" PostTypeId="1" AcceptedAnswerId="32092" CreationDate="2016-06-08T20:40:41.633" Score="1" ViewCount="543" Body="&lt;p&gt;I currently have an HP MSR20-20 router and am trying to make heads and tails of the snmpbulkwalk output.  The majority of it is what i'd expect such as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ifIndex.1 = INTEGER:1&#xA;ifDescr.1 = STRING: Ethernet0/0&#xA;ifType.1 = INTEGER: ethernetCsmacd(6)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I get to a later point in the output where I see the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mib-2.3.1.1.1.1.1.196.168.1.100 = INTEGER:1&#xA;mib-2.3.1.1.1.1.1.196.168.1.103 = INTEGER:1&#xA;mib-2.3.1.1.1.1.1.196.168.1.104 = INTEGER:1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a MIB database I can reference to understand the mib-2.3.1.1.1.1.1 and other MIBS that aren't described in a readable manner?  I'm assuming this means that the switch, which is off of ETH/0 can route to 192.168.1.100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, some other documentation would be really helpful.  I'll assume my google-fu is a bit off.  &lt;/p&gt;&#xA;" OwnerUserId="27000" LastActivityDate="2016-06-08T21:33:37.483" Title="Where to find MIBS for HP Series Router A-MSR20-20" Tags="|router|snmp|hp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32092" PostTypeId="2" ParentId="32090" CreationDate="2016-06-08T21:33:37.483" Score="2" Body="&lt;p&gt;In this case, since the OID starts with MIB-2, you need the MIB-II mib described in RFC 1213 here : &lt;a href=&quot;https://www.ietf.org/rfc/rfc1213.txt&quot; rel=&quot;nofollow&quot;&gt;https://www.ietf.org/rfc/rfc1213.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, mib-2.3.1.1.1.1.1.196.168.1.100 refers to an entry in the Address Table group (mib-2.3), which is deprecated but still available on many devices for backwards compatibility, and basically gives you access to the device's ARP table. The table is indexed by interface index and ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can usually find MIBs by just googling an OID that you have (or at least the beginning of the OID). Cisco also has a good OID lookup tool on its site at &lt;a href=&quot;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&quot; rel=&quot;nofollow&quot;&gt;http://tools.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-06-08T21:33:37.483" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32095" PostTypeId="2" ParentId="29154" CreationDate="2016-06-09T00:07:28.430" Score="1" Body="&lt;p&gt;The Meraki Z1 local status page at my.meraki.com or wired.meraki.com will:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Verify connectivity from your wireless client to the gateway&lt;/li&gt;&#xA;&lt;li&gt;Provide information on the health of the Internet connection&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="14243" LastEditorUserId="8499" LastEditDate="2016-06-09T02:50:09.800" LastActivityDate="2016-06-09T02:50:09.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32096" PostTypeId="1" AcceptedAnswerId="32097" CreationDate="2016-06-09T00:18:29.347" Score="11" ViewCount="9722" Body="&lt;p&gt;According to the notes I'm reading:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;10/100 Mbit/s Ethernet refers to the standard that can autosense which speed it needs to run between speeds of 10 Mbit/s or 100 Mbit/s.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Why would autosensing be required? Wouldn't it be best to result to 100&amp;nbsp;Mbit/s or will this impact the network in a negative way?&lt;/p&gt;&#xA;" OwnerUserId="24256" LastEditorUserId="775" LastEditDate="2016-06-09T22:29:53.543" LastActivityDate="2016-06-11T13:08:18.240" Title="What's the point of auto-sensing 10/100 Mbit/s Ethernet?" Tags="|ethernet|cabling|autonegotiation|" AnswerCount="4" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32097" PostTypeId="2" ParentId="32096" CreationDate="2016-06-09T00:26:21.640" Score="27" Body="&lt;p&gt;Some devices could only run at 10 megabit/s, so the device at the other end would autosense the speed to match. If a device that has a maximum speed of 10&amp;nbsp;Mbit/s is connected to a 10&amp;nbsp;Mbit/s / 100&amp;nbsp;Mbit/s switch, the switch needs to lower its speed on that particular port in order to effectively (efficiently) communicate with the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days, most devices will autosense between 10&amp;nbsp;Mbit/s, 100&amp;nbsp;Mbit/s, and 1000&amp;nbsp;Mbit/s, but back in the days of &quot;fast Ethernet&quot; the choices were 10&amp;nbsp;Mbit/s and 100&amp;nbsp;Mbit/s.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="3232" LastEditDate="2016-06-09T21:04:16.570" LastActivityDate="2016-06-09T21:04:16.570" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32098" PostTypeId="2" ParentId="32096" CreationDate="2016-06-09T01:25:27.927" Score="-1" Body="&lt;p&gt;It's all obsolete, in the current era. Which means whatever you are reading is obsolete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anything less than 1000Mb/s is ancient history. Fortunately for folks with antique equipment still running, myself included, most 1000 Mb/s ports will autonegotiate down to whatever the obsolete equipment is running at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point of autonegotiating is being able to speak to an obsolete device at a speed it can handle, without having to specifically configure a port to talk that slowly.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-06-09T01:25:27.927" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="32099" PostTypeId="1" CreationDate="2016-06-09T01:25:41.030" Score="1" ViewCount="65" Body="&lt;p&gt;I have two server one of them sends message in xml format to another server. The number of message varies i.e from 10000/sec to 1 million per second. The other end receives and stores it as file. Both of them are in same network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that some of the files are missing and in log from sending server I got that the message is sent. How do I check if it is lost in network? I cannot track it down in receiving end as it's old application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I use ntop like solution to track down traffic? Any other solution to track message to specific port and visualize it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IhGmC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IhGmC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10714" LastEditorUserId="10714" LastEditDate="2016-06-09T03:56:34.137" LastActivityDate="2016-06-09T03:56:34.137" Title="How to trap message between two servers?" Tags="|tcp|network-access|tcpdump|tap|" AnswerCount="0" CommentCount="3" ClosedDate="2016-06-09T04:39:47.600" ContentLicense="CC BY-SA 3.0" />
  <row Id="32100" PostTypeId="2" ParentId="24850" CreationDate="2016-06-09T01:49:42.530" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;as i myself answered the first question that they need ip address for management but point is, this is wastage of ip address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Using a public ipv4 address for management would be &quot;wastage&quot; since that is expending a scarce resource on a task that could be served by a less scarce resource.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So dont do that (see below)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In a network when it is divided into several subnetworks sometime each network has 5-6 ip addresses then assigning one ip address to switch is wastage of one address.Should it be omitted&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In general it's best not to put management addresses on general vlans but instead to have a dedicated vlan (or in a really big network multiple vlans) for management. This helps to keep management traffic seperate from user traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally you would use private IPv4 addresses on your management VLAN. For most organisations private IPv4 addreses are plentiful enough that using up a few of them for management networks is a non-issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your network is really so big that private ipv4 is a scarce resource then you might want to consider IPv6 for management but be aware that not all hardware has good ipv6 support. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-06-09T01:49:42.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32101" PostTypeId="2" ParentId="32096" CreationDate="2016-06-09T02:20:17.183" Score="14" Body="&lt;p&gt;Remember 10Mbps came first, then 100Mbps, then 1000Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The advantage of supporting multiple speeds and automatically switching between them is you can upgrade your network gradually without having to worry about what speed each device supports or replacing everything at once. You just plug a device in and it connects at the highest mutually supported speed. There are a few devices that are single speed but they are uncommon enough that it's not usually too much of a problem (though you do come across the occasional person wondering why thier Raspberry Pi won't talk to their media converter).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this is a large part of the reason twisted pair Ethernet has remained the dominant networking technology. It has been able to massively increase performance while keeping (almost) everything compatible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately with 10G the waters have got a lot muddier, afaict no devices support both 10M and 10G and some older ones don't even support 100M. I imagine the situation will be similar with the new 2.5G and 5G stuff. Fortunately newer 10G devices tend to support 100M and most 10M devices are probablly out of serivce by now so hopefully the breakage shouldn't be too painful. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-06-09T02:20:17.183" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="32102" PostTypeId="2" ParentId="32017" CreationDate="2016-06-09T02:45:48.110" Score="0" Body="&lt;p&gt;Ip sockets bind to a combination of IP version, IP address, port number and transport protocol (some operating systems may also allow sockets for non-IP protocols, I will not go into those there). Whether those IP addresses are associated with  the same NIC or not is irrelevent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yes you can bind a seperate socket (either from the same or different applications) to the same port on different addresses on the same interface. This is very common on web servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note1: if you bind a socket to 0.0.0.0 it will accept connections on ayn local IPv4 address and (while this socket exists) you will not be able to bind to the port on individual IPv4 IPs (at least not without extra socket options).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note2: If you bind a socket to :: it will accept connections on any local IPv6 address. Depending on OS, configuration and socket options it may also accept connections on any local IPv4 address.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-06-09T02:45:48.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32104" PostTypeId="2" ParentId="3697" CreationDate="2016-06-09T06:36:48.413" Score="4" Body="&lt;p&gt;one another simple explanation can be, how many address you can have in one range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ex: you have an ip a.b.c.d/x. So a,b,c,d individually can have values 0-255 so which gives us 2^3(max length is 3) = 8. so one part of ip can have 8 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now if we write ip like 10.10.0.0/x so now x/8 = total number fixed blocks we have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ex: if we have /16 so 16/8 = 2 this means we have 2 blocks free so now ip would be 10.10.0.0 so here first two blocks are fixed and we can have 0-255 in each last two blocks so &#xA;256*256 = 65536(address we can have) and in netmask would be 255.255.0.0 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;now lets say we had /18 which is not completely divisible by 8, so 18/8 = 2(fixed blocks) and 2 is left so now divide 256 twice which is 256/2 = 128, 128/2 = 64 so we got 64 now 256-64 = 192. so now our netmask would be 255.255.192.0 which means we can have 64*256 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;further, if it was /24 this means 24/8 = 3 three blocks are fixed and one is variable. netmask is 255.255.255.0 and if we had /8 this means 8/8 = 1 one block is fixed. so 255.0.0.0&lt;/p&gt;&#xA;" OwnerUserId="27006" LastEditorUserId="27006" LastEditDate="2018-10-17T12:10:42.290" LastActivityDate="2018-10-17T12:10:42.290" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="32105" PostTypeId="2" ParentId="25121" CreationDate="2016-06-09T07:18:40.857" Score="1" Body="&lt;p&gt;Sorry to tell you that few fiber optic manufacturers and suppliers update 10G copper transceiver modules. You can choose 10GbE fiber connectivity or 10G SFP+ DAC for connectivity. Then the choice would be much wider. Hope the following link helps you. &lt;a href=&quot;https://www.linkedin.com/pulse/10gbe-interconnect-solutions-overview-fern-xu?trk=mp-reader-card&quot; rel=&quot;nofollow&quot;&gt;https://www.linkedin.com/pulse/10gbe-interconnect-solutions-overview-fern-xu?trk=mp-reader-card&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-06-09T07:18:40.857" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32109" PostTypeId="1" CreationDate="2016-06-09T12:10:27.983" Score="1" ViewCount="1586" Body="&lt;p&gt;I have a setup where the ASA 5510 is acting as the default gateway for devices connected to an L2 switch connected to the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic setup is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA -&gt; L2 switch -&gt; Servers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The servers have their gw set to the subinterface ip on the ASA but for some reason, the servers cannot be pinged from the switch itself nor from the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config of the ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interface Ethernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 1.1.1.100 255.255.255.240 &#xA;!&#xA;interface Ethernet0/1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.99.1.1 255.255.255.0 &#xA;!&#xA;interface Ethernet0/1.102&#xA; vlan 102&#xA; nameif internal&#xA; security-level 100&#xA; ip address 10.1.2.2 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the default gw on the ASA goes out to the provider uplink.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the default gw on the switch is the ASA. the port on the switch connected to the fw is setup as a trunk. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The config for the L2 switch is basically this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 1&#xA;&#xA;vlan 102&#xA;&#xA;int vlan 1&#xA;ip add 10.99.1.2 255.255.255.0&#xA;&#xA;int g0/1&#xA;desc To-ASA-5510&#xA;switchport trunk encap dot1q&#xA;switchport mode trunk&#xA;&#xA;int g0/2&#xA;switchport access vlan 102&#xA;&#xA;int g0/3&#xA;switchport access vlan 102&#xA;&#xA;ip default-gateway 10.99.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The servers are connected to ports 2+3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing here?  Are there specific firewall rules that need to be created at all?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="864" LastEditDate="2016-06-09T20:16:37.267" LastActivityDate="2016-06-10T00:03:34.267" Title="ASA to L2 switch issue" Tags="|cisco-asa|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32110" PostTypeId="1" AcceptedAnswerId="32171" CreationDate="2016-06-09T12:34:47.980" Score="4" ViewCount="331" Body="&lt;p&gt;It is well known that an IS-IS L1 router chooses the nearest L1/L2 router to route inter-area traffic, if there is no route leaking as defined in RFC 2966.&#xA;However, providing that there is no route leaking, does the L1/L2 router of the source area sends the traffic to the nearest L1/L2 router of the destination area, or does it have enough information about the topology of the destination area to choose the best L1/L2 router of the destination (i.e to find the full shortest path to the final destination)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: to be precise in my question, I'm considering the case where the destination area has several L1/L2 routers. The nearest L1/L2 router of the destination area may not be the one on the shortest path from the L1/L2 router of the source area, to the final destination (in the destination area).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: with IS-IS, which L1/L2 router of the destination area would the L1/L2 router of the source area send packets to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ron's response does not answer that question, since my question doesn't apply to a network with a single L1/L2 router connecting the destination area to the backbone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/whFaz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/whFaz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the diagram. Once you reach the L1/L2 router of the first area, you have two path. You can send the traffic to the closest L1/L2 router, but the resulting path will have a cost of 1001.&#xA;But if you know the topology of the destination area, you'll send the traffic to the other L1/L2, and the path has a cost of 11.&#xA;What I wonder is how IS-IS behaves in such a case.&lt;/p&gt;&#xA;" OwnerUserId="27016" LastEditorUserId="8499" LastEditDate="2018-12-27T01:47:29.443" LastActivityDate="2018-12-27T01:47:29.443" Title="IS-IS multi-area" Tags="|routing|protocol-theory|rfc|is-is|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32112" PostTypeId="1" CreationDate="2016-06-09T13:41:27.450" Score="1" ViewCount="158" Body="&lt;p&gt;&lt;strong&gt;In class ful addressing:&lt;/strong&gt;&#xA;The network bits must match:&#xA;For class A first octect&#xA;For class B first two octects&#xA;For Class C first three Octects&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about Classless addressing? &#xA;Network ids derived from subnetmask. Is it mandatory to match first three octects in 192.168.1.1, 192.168.1.2 ipaddress?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In classless how systems feels they are on same network? On what criteria they derive network address? &lt;/p&gt;&#xA;" OwnerUserId="23732" LastActivityDate="2016-06-09T14:00:43.513" Title="Confusing about network bits in classless and classful addressing" Tags="|routing|subnet|ip-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32113" PostTypeId="1" AcceptedAnswerId="32124" CreationDate="2016-06-09T13:53:15.550" Score="2" ViewCount="1245" Body="&lt;p&gt;I am a Systems Administrator at a small firm. We are latency sensitive. When forwarding packets, what protocols use the CPU and which use the ASICs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have mostly Arista 7124's (for the most latency sensitive bits) and Cisco 4948's. I imagine that the architecture for an Arista and a Cisco Nexus switch would be similar, so if you are a Cisco guy I'd be happy to hear from you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have installed Rancid (&lt;a href=&quot;http://www.shrubbery.net/rancid/&quot; rel=&quot;nofollow&quot;&gt;http://www.shrubbery.net/rancid/&lt;/a&gt;) on a machine here and I am grabbing switch configs every hour. This means that:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There is an ssh login.&lt;/li&gt;&#xA;&lt;li&gt;Then the switch goes to enable mode.&lt;/li&gt;&#xA;&lt;li&gt;Then a show run is performed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All of that uses CPU. My boss has asked me: Am I impacting latency? How do I know?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think I am impacting latency, but I don't know that for sure. I have taken it on faith that I am not; that's why the ASICs are there, to do the heavy lifting and bring some determinism to switching speeds. Of course, some technologies could not be ASIC'ed like NAT but let's assume we are not doing that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our machines connected to the switches use a few different VLANs, and they need rather straightforward IP services I'd say: exchanging TCP and multicast UDP data- that's all. (Besides the usual supporting cast such as ARP that are necessary for TCP and UDP to work).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; that I mention the Arista and the Cisco Nexus because they are called &quot;Layer 3 switches&quot;, as described &lt;a href=&quot;http://www.cisco.com/c/en/us/products/switches/nexus-3548-switch/index.html&quot; rel=&quot;nofollow&quot; title=&quot;here for the Cisco 3548&quot;&gt;here for the Cisco 3548&lt;/a&gt; or &lt;a href=&quot;https://www.arista.com/assets/data/pdf/Datasheets/7124SX_Datasheet.pdf&quot; rel=&quot;nofollow&quot; title=&quot;7124&quot;&gt;here for the Arista 7124SX&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="27019" LastEditorUserId="8499" LastEditDate="2018-03-18T21:46:09.703" LastActivityDate="2018-03-18T21:46:09.703" Title="On a Layer 3 switch, what part does the CPU play in forwarding packets?" Tags="|switch|vlan|layer3|latency|cpu|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32114" PostTypeId="2" ParentId="32112" CreationDate="2016-06-09T14:00:43.513" Score="3" Body="&lt;p&gt;First:  Classful addressing is obsolete and is no  longer used.  It was obsolete (I'm guessing) since before you were born.  A pox on schools that keep teaching it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second: Dividing an IP address into  octets is just for the convenience of human readers.  To the computer, it is just a 32-bit address.  There is no meaning to the octets other than it makes it easier for humans to read big binary numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third:  The subnet mask defines which bits are the network ID and which are the host ID.  The 1's bits indicate the network portion of the address.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-09T14:00:43.513" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32115" PostTypeId="2" ParentId="32113" CreationDate="2016-06-09T14:15:35.090" Score="0" Body="&lt;p&gt;Switches operate at layer-2. They do not get into the frames to look at the packets (IP) or segments (TCP/UDP); all they see is the layer-2 frame header, and that is the basis for switching. Cisco switches don't do NAT, that is done on a router or firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most modern switches do the switching in hardware, and very little CPU is used for this. Consequently, switches don't normally have powerful CPUs or a lot of RAM, but this is highly dependent on the switch model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand the need to grab the switch configuration every hour. This is not something that is practiced to any degree. If you insist on doing this, you could also grab the CPU utilization when logged into the switch, but it is doubtful you are impacting much.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-09T14:15:35.090" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="32116" PostTypeId="2" ParentId="32110" CreationDate="2016-06-09T14:50:34.260" Score="0" Body="&lt;p&gt;IS-IS uses Dijkstra's algorithm, like OSPF, to route through the network. The L2 routers form the backbone. Basically, you can think of the collection of L2 routers as OSPF area 0. L1/L2 routers are ABRs, with one foot in an area, and another foot in the backbone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once a packet has reached an L2 router (including an L1/L2 router), the packet will be routed through the L2 routers via the shortest path to the L1/L2 router of the destination.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-09T14:50:34.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32119" PostTypeId="1" AcceptedAnswerId="32120" CreationDate="2016-06-09T15:43:56.283" Score="15" ViewCount="4034" Body="&lt;p&gt;Why are there three separate ranges of private IPv4 addresses of different sizes? Why not just reserve the largest (&lt;code&gt;10.0.0.0&lt;/code&gt; - &lt;code&gt;10.255.255.255&lt;/code&gt;) range and let people create &lt;code&gt;/16&lt;/code&gt; or &lt;code&gt;/24&lt;/code&gt; (or whatever) networks within that range if they need smaller networks or need to do subnetting? Is there anything wrong with having a huge number of available host addresses on your network?&lt;/p&gt;&#xA;" OwnerUserId="16349" LastEditorUserId="8499" LastEditDate="2018-12-20T21:38:48.183" LastActivityDate="2018-12-20T21:38:48.183" Title="Why are there 3 ranges of private IPv4 addresses?" Tags="|ip|ipv4|subnet|ip-address|rfc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32120" PostTypeId="2" ParentId="32119" CreationDate="2016-06-09T16:00:21.083" Score="19" Body="&lt;p&gt;Back when the RFC for private addressing was proposed, classful addressing was still common. The reasons for the three address ranges are found in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1918, Address Allocation for Private Internets&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If a suitable subnetting scheme can be designed and is supported by&#xA;the equipment concerned, it is advisable to use the 24-bit block&#xA;(class A network) of private address space and make an addressing plan&#xA;with a good growth path. If subnetting is a problem, the 16-bit block&#xA;(class C networks), or the 20-bit block (class B networks) of private&#xA;address space can be used.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-06-09T16:00:21.083" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32123" PostTypeId="1" CreationDate="2016-06-09T18:05:49.683" Score="1" ViewCount="2820" Body="&lt;p&gt;I have replaced old Cisco 1900 switches with 3850's in my plant process areas.&lt;br&gt;&#xA;Added Fiber links between 3850's for increased performance.  I can't get data transfer through the fiber uplinks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have assigned some of the LAN ports to the different VLANS and they are communicating correctly. &#xA;The Gib Fiber ports when assigned to the VLAN do not pass data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a &quot;Band-Aid&quot; I installed Fiber media convertors to connect the fiber backbone to the VLANs.  Data does pass through the convertors to the VLAN ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure what I'm missing as why the fiber ports aren't passing data as the LAN ports are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gone through several Cisco manuals and checked multiple options with no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My process is operational so I am now limited in my access to the switches until the next shutdown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="27032" LastActivityDate="2019-03-06T15:01:20.093" Title="New install Cisco 3850's not communicating over Fiber Uplinks" Tags="|cisco|switch|vlan|fiber|" AnswerCount="6" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32124" PostTypeId="2" ParentId="32113" CreationDate="2016-06-09T19:32:31.490" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/troubleshooting/cpu_util.html#pgfId-1013765&quot; rel=&quot;nofollow&quot;&gt;This article&lt;/a&gt; has a decent breakdown of what a Catalyst 3750 will use its CPU for. Notice the CPU doesn't normally process any &quot;user&quot; frames, it mainly deals with management tasks, like STP and routing tables. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least one exception is mentioned (emphasis mine):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As part of normal &lt;strong&gt;Layer 3&lt;/strong&gt; switch operation, when the IP route is not programmed into the switch hardware, the hardware punts IP packets to the CPU for IP routing. Punting occasional IP packets to the CPU is normal and expected, but if too many IP packets are punted, the CPU becomes too busy.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Later on:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If the switch TCAM is full, the hardware routes packets only for destination IP addresses that are in the TCAM. All other IP packets that had a TCAM miss are punted to the CPU.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Note that during normal operation, few or no frames or packets are sent to a 3750 CPU.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2016-06-09T19:32:31.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32125" PostTypeId="1" CreationDate="2016-06-09T20:38:53.267" Score="2" ViewCount="10918" Body="&lt;p&gt;CCENT student here and looking for some confirmation. Working on the ICND1 Odom book with a 2950 switch. I have a quick question regarding static MAC addresses, as per this passage:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ju8lU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ju8lU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is my output for show mac address-table command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XQTG2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XQTG2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Am I correct in thinking that static MAC address are the mac&#xA;addresses of the switch itself?&lt;/li&gt;&#xA;&lt;li&gt;Why are there 4 static mac addresses?&lt;/li&gt;&#xA;&lt;li&gt;In the orange highlighted part of the textbook passage, what is&#xA;meant by static mac addresses configured by port security feature?&lt;/li&gt;&#xA;&lt;li&gt;For the dynamic mac addresses (interface 1 and 24, which I have&#xA;connected out to two other switches), why are there two, and not&#xA;one, mac addresses entries learned per port?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I appreciate any insight. :)&lt;/p&gt;&#xA;" OwnerUserId="19051" LastEditorUserId="8499" LastEditDate="2016-06-09T20:53:26.067" LastActivityDate="2016-06-10T05:29:52.477" Title="Cisco question regarding static MAC addresses on switch" Tags="|cisco|switch|ethernet|cisco-ios|mac-address|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32126" PostTypeId="2" ParentId="32119" CreationDate="2016-06-09T20:48:11.980" Score="5" Body="&lt;p&gt;While not an great answer (Ron Maupin's is more accurate), I was always taught to always use the the smallest class that left 10% room for expansion. This was &quot;very important&quot; with a facility that had many Subnets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.*&lt;br&gt;&#xA;192.168.2.*&lt;br&gt;&#xA;192.168.3.*  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could all be used to isolate entire security policies. For example the .1 network require the use of a proxy, .2 Maybe for management and bypass the proxy while .3 was the DMZ. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some network equipment back then didn't even ask for a subnet. It just assumed you were using the entire class. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eventually though that gave way to classless routing but it still is important to create segments that make easy sense. &lt;/p&gt;&#xA;" OwnerUserId="27037" LastActivityDate="2016-06-09T20:48:11.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32127" PostTypeId="2" ParentId="32125" CreationDate="2016-06-09T20:50:34.733" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;The MAC address table relates the source MAC addresses for frames&#xA;which have come into a port with the port. This lets the switch know&#xA;to which port it should send frames with that destination MAC&#xA;address. The MAC addresses are from hosts connected to the ports. The CPU port is the switch itself.&lt;/li&gt;&#xA;&lt;li&gt;Static MAC addresses in the MAC address table were manually&#xA;configured. The dynamic entries in the MAC address table will time out after&#xA;a while. The table is dynamic and when a frame with a source MAC&#xA;address comes into a switch the table is updated to reflect that the&#xA;device with that MAC address is out that port. There can only be a&#xA;single port for a MAC address. Manually putting an entry in the&#xA;table bypasses all of that. The switch will automtically have static entries for itself.&lt;/li&gt;&#xA;&lt;li&gt;Only allowing traffic destined to a MAC address through a manually&#xA;configured port will help prevent ARP spoofing problems.&lt;/li&gt;&#xA;&lt;li&gt;You can have frames from many different hosts (MAC addresses) come&#xA;into a single port. This is the case when a hub or switch with many&#xA;hosts is connected to a switch port.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-09T20:58:40.877" LastActivityDate="2016-06-09T20:58:40.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32128" PostTypeId="1" AcceptedAnswerId="32129" CreationDate="2016-06-09T21:21:19.013" Score="4" ViewCount="9595" Body="&lt;p&gt;I currently have a router and I was wondering if I could connect one of the LAN ports to a switch to connect more devices through Ethernet. I need each device to have a local IP address. I know that when I plug a device to my router it assigns a local IP address, what I don't know is whether the devices connected through the switch will receive a unique IP address as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="27038" LastEditorUserId="8499" LastEditDate="2018-03-19T18:14:20.517" LastActivityDate="2019-03-17T06:54:26.010" Title="Assign IP address using Router and Switch (DHCP)" Tags="|switch|router|ethernet|dhcp|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32129" PostTypeId="2" ParentId="32128" CreationDate="2016-06-09T21:27:04.890" Score="5" Body="&lt;p&gt;Switches don't get involved in layer-3 (e.g. IP). A switch is a transparent layer-2 device, so hosts connected to a switch will have no problem getting to a DHCP server on the same LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-09T21:27:04.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32130" PostTypeId="1" AcceptedAnswerId="32135" CreationDate="2016-06-09T22:40:43.927" Score="3" ViewCount="7736" Body="&lt;p&gt;I know a router acting as a relay agent sends the DHCP messages from client to the DHCP server. When server replies back to the relay agent with the &lt;strong&gt;DHCPOFFER&lt;/strong&gt; message how will this message be sent to client, &lt;strong&gt;broadcast&lt;/strong&gt; or &lt;strong&gt;unicast&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="24153" LastEditorUserId="24153" LastEditDate="2016-06-10T16:10:54.797" LastActivityDate="2016-06-10T16:10:54.797" Title="How does a router relay DHCP packets when it is configured as a relay agent?" Tags="|router|dhcp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32131" PostTypeId="2" ParentId="32130" CreationDate="2016-06-09T23:12:44.650" Score="1" Body="&lt;p&gt;The relay agent will send the DHCPOFFER as a broadcast if the broadcast flag is set, in the same manner as the DHCP server would. As far as the client is concerned, it is dealing with a DHCP server, not a relay agent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ietf.org/rfc/rfc2131.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 2131, Dynamic Host Configuration Protocol&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Normally, DHCP servers and BOOTP relay agents attempt to deliver&#xA;  DHCPOFFER, DHCPACK and DHCPNAK messages directly to the client using&#xA;  uicast delivery.  The IP destination address (in the IP header) is set&#xA;  to the DHCP 'yiaddr' address and the link-layer destination address is&#xA;  set to the DHCP 'chaddr' address.  Unfortunately, some client&#xA;  implementations are unable to receive such unicast IP datagrams until&#xA;  the implementation has been configured with a valid IP address&#xA;  (leading to a deadlock in which the client's IP address cannot be&#xA;  delivered until the client has been configured with an IP address).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A client that cannot receive unicast IP datagrams until its protocol&#xA;  software has been configured with an IP address SHOULD set the&#xA;  BROADCAST bit in the 'flags' field to 1 in any DHCPDISCOVER or&#xA;  DHCPREQUEST messages that client sends.  The BROADCAST bit will&#xA;  provide a hint to the DHCP server and BOOTP relay agent to broadcast&#xA;  any messages to the client on the client's subnet.  A client that can&#xA;  receive unicast IP datagrams before its protocol software has been&#xA;  configured SHOULD clear the BROADCAST bit to 0.  The BOOTP&#xA;  clarifications document discusses the ramifications of the use of the&#xA;  BROADCAST bit [21].&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;&lt;em&gt;A server or relay agent sending or relaying a DHCP message directly to&#xA;  a DHCP client (i.e., not to a relay agent specified in the 'giaddr'&#xA;  field) SHOULD examine the BROADCAST bit in the 'flags' field.  If this&#xA;  bit is set to 1, the DHCP message SHOULD be sent as an IP broadcast&#xA;  using an IP broadcast address (preferably 0xffffffff) as the IP&#xA;  destination address and the link-layer broadcast address as the&#xA;  link-layer destination address.&lt;/em&gt;&lt;/strong&gt;  If the BROADCAST bit is cleared to 0,&#xA;  the message SHOULD be sent as an IP unicast to the IP address&#xA;  specified in the 'yiaddr' field and the link-layer address specified&#xA;  in the 'chaddr' field.  If unicasting is not possible, the message MAY&#xA;  be sent as an IP broadcast using an IP broadcast address (preferably&#xA;  0xffffffff) as the IP destination address and the link- layer&#xA;  broadcast address as the link-layer destination address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-09T23:31:40.587" LastActivityDate="2016-06-09T23:31:40.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32132" PostTypeId="2" ParentId="32109" CreationDate="2016-06-10T00:03:34.267" Score="1" Body="&lt;p&gt;There are two issues here:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You are trying to ping from VLAN 1 (switch) to VLAN 102 (servers).&lt;br&gt;&#xA;The ASA won't forward traffic between interfaces of the same&#xA;security level unless you explicitly allow it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;same-security-traffic permit inter-interface&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;The ASA blocks ICMP by default.  You have to allow it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;icmp enable inside&#xA;icmp enable internal&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can also look in the ASA log to see what it is blocking and why.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-10T00:03:34.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32133" PostTypeId="2" ParentId="32123" CreationDate="2016-06-10T00:10:18.947" Score="0" Body="&lt;p&gt;The 1900 switch has 100-fx ports, which as the name implies, is 100 Mb.  The Gigabit fiber ports can't operate at that speed.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-10T00:10:18.947" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32134" PostTypeId="2" ParentId="32025" CreationDate="2016-06-10T00:15:56.060" Score="1" Body="&lt;p&gt;VLAN 104 is not tagged on any ports.  You need to allow it on the ASA port and the switch uplink ports.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-10T00:15:56.060" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32135" PostTypeId="2" ParentId="32130" CreationDate="2016-06-10T00:34:01.357" Score="4" Body="&lt;p&gt;Great question. The answer can be labbed in GNS3 like so -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Topology:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QnXve.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QnXve.png&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address 192.168.10.0 192.168.10.99&#xA;!&#xA;ip dhcp pool Users&#xA;   network 192.168.10.0 255.255.255.0&#xA;   default-router 192.168.10.1&#xA;!&#xA;ip route 192.168.10.0 255.255.255.0 10.1.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA; ip address 192.168.10.1 255.255.255.0&#xA; ip helper-address 10.1.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PC (which is actually just another router):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA; ip address dhcp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now let's take a look at some packet captures -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Traffic between R1 &amp;amp; R2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ab2NA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ab2NA.png&quot; alt=&quot;Traffic between R1 &amp;amp; R2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Traffic between R2 &amp;amp; PC:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tm2Bv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tm2Bv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you see, the traffic between R1 and R2 is unicast (as you'd expect) and the traffic between R2 and PC is broadcast, the same way as it would be if R2 were the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note though that the DHCP request comes from R2's Fa0/1 interface. This therefore means that R1 needs a route to this network even though it is directly connected to R2. That explains why I've got the static route on R1.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2016-06-10T04:53:29.543" LastActivityDate="2016-06-10T04:53:29.543" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32137" PostTypeId="2" ParentId="24784" CreationDate="2016-06-10T04:37:15.637" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://documentation.meraki.com/MX-Z/NAT_and_Port_Forwarding/Active_and_Passive_FTP_Overview_and_Configuration&quot; rel=&quot;nofollow&quot;&gt;Active and Passive FTP Overview and Configuration&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under Security Appliance &gt; Firewall, configure a 1:1 NAT with the allowed inbound connections.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Two firewall rules are necessary for passive FTP to function properly:&#xA;  - The firewall must allow connections on port 21.&#xA;  - The firewall must allow connections to the ephemeral ports used by the FTP application.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="14243" LastEditorUserId="14243" LastEditDate="2016-06-19T18:47:54.310" LastActivityDate="2016-06-19T18:47:54.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32138" PostTypeId="2" ParentId="32125" CreationDate="2016-06-10T05:29:52.477" Score="1" Body="&lt;p&gt;&lt;strong&gt;Question 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Am I correct in thinking that static MAC address are the mac addresses&#xA;  of the switch itself? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, the first four MAC addresses belong to the switch itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why are there 4 static mac addresses? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As per &lt;a href=&quot;https://learningnetwork.cisco.com/thread/15380&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; link, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For L2 switches, there are mac addresses for different functions (to&#xA;  be able to communicate (when we want to telnet, ping or do snmp to the&#xA;  switch) and spanning tree (to form the bridge ID). On some&#xA;  manufactures switches, they use 1 mac address for all functions, Cisco&#xA;  does not. On the 4/5/6x00 devices, there are 1024 mac addresses&#xA;  assigned to the upervisor (1 or more for the switch, 1000 for spanning&#xA;  tree (PVST, each instance has its ' own mac address)).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 3:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In the&#xA;  orange highlighted part of the textbook passage, what is meant by&#xA;  static mac addresses configured by port security feature? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/port_sec.html&quot; rel=&quot;nofollow&quot;&gt;port security&lt;/a&gt; to define which MAC addresses should be seen on specific ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 4:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For the&#xA;  dynamic mac addresses (interface 1 and 24, which I have connected out&#xA;  to two other switches), why are there two, and not one, mac addresses&#xA;  entries learned per port?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because it's a Layer 2 network. MAC addresses will be learned on every layer 2 device between the source and destination devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're interested in finding out which MAC address belongs to which device, you can look up the &lt;a href=&quot;https://en.wikipedia.org/wiki/Organizationally_unique_identifier&quot; rel=&quot;nofollow&quot;&gt;OUI&lt;/a&gt; of MAC addresses in your output. For example, I can see you've got a few Cisco, Linksys and Netgear devices.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-06-10T05:29:52.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32139" PostTypeId="1" CreationDate="2016-06-10T05:59:25.340" Score="1" ViewCount="48" Body="&lt;p&gt;A couple of notes I read from said that asynchronous transmission does not include error checking as part of its protocol. Yet parity checks are used in asynchronous data transmission. &lt;/p&gt;&#xA;" OwnerUserId="27050" LastActivityDate="2016-06-10T05:59:25.340" Title="Is error checking included in asynchronous transmission?" Tags="|network-discovery|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32140" PostTypeId="1" AcceptedAnswerId="32143" CreationDate="2016-06-10T07:10:33.123" Score="1" ViewCount="1458" Body="&lt;p&gt;I have HP EI 5500 L3 switch, I am trying to start HTTPS on switch but it give me error &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Error: Failed to enable HTTPS server.&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This might be because of SSL certificate was not there on switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me on this.?? &lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2017-12-02T21:07:20.747" Title="Need to deploy SSL self signed certificate on HP 5500 EI L3 switch" Tags="|switch|hp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32141" PostTypeId="1" CreationDate="2016-06-10T08:16:38.540" Score="1" ViewCount="116" Body="&lt;p&gt;&lt;strong&gt;Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In our system, the Windows PC has two NICs, one for WAN and one for LAN (no gateway). For the LAN side, a Linux PC is connected through two switches. Also, switch2 is powered on/off with the Linux PC.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;    10.8.12.13/255.255.255.0 (WAN)&#xA;        PC1 (Windows)&#xA;    192.168.0.21/255.255.255.0 (LAN)&#xA;            |&#xA;        Switch 1&#xA;            |&#xA;            | (below switch and linux pc are powered on/off together)&#xA;            |&#xA;        Switch 2&#xA;            |&#xA;    192.168.0.100/255.255.255.0 (LAN)&#xA;        PC2 (Linux)&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC1 can ping PC2 (192.168.0.100) successfully when the whole system powers on while PC1 can't ping PC2 if we only shutdown and re-power on the PC2 (with switch 2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;D:\&gt;tracert 192.168.0.100&#xA;&#xA;通过最多 30 个跃点跟踪&#xA;到 UIH_RESERVED_CT_GANTRY [192.168.0.100] 的路由:&#xA;&#xA;  1     5 ms    11 ms     3 ms  10.8.12.253&#xA;  2     6 ms     1 ms     1 ms  10.6.103.81&#xA;  3     *        *        *     请求超时。&#xA;  4     *        *        *     请求超时。&#xA;  5     *        *        *     请求超时。&#xA;  6     *     ^C&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this case, when we re-plugged the PC1's NIC to the WAN (10.8.12.13), PC1 will be able to ping PC2 successfully again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't know why this happens since the route table doens't have any change before and after the re-plugging -- both have the line &quot;192.168.0.0    255.255.255.0            在链路上      192.168.0.21    266&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;===========================================================================&#xA;接口列表&#xA; 17...0c c4 7a 0d c9 ad ......Intel(R) 82574L Gigabit Network Connection #3&#xA; 13...0c c4 7a 0d c9 ac ......Intel(R) 82579LM Gigabit Network Connection&#xA;  1...........................Software Loopback Interface 1&#xA; 12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter&#xA; 16...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2&#xA; 15...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface&#xA;===========================================================================&#xA;IPv4 路由表&#xA;===========================================================================&#xA;活动路由:&#xA;网络目标        网络掩码          网关       接口   跃点数&#xA;          0.0.0.0          0.0.0.0      10.8.12.254       10.8.12.13     10&#xA;        10.8.12.0    255.255.255.0            在链路上        10.8.12.13    266&#xA;       10.8.12.13  255.255.255.255            在链路上        10.8.12.13    266&#xA;      10.8.12.255  255.255.255.255            在链路上        10.8.12.13    266&#xA;        127.0.0.0        255.0.0.0            在链路上         127.0.0.1    306&#xA;        127.0.0.1  255.255.255.255            在链路上         127.0.0.1    306&#xA;  127.255.255.255  255.255.255.255            在链路上         127.0.0.1    306&#xA;      192.168.0.0    255.255.255.0            在链路上      192.168.0.21    266&#xA;     192.168.0.21  255.255.255.255            在链路上      192.168.0.21    266&#xA;    192.168.0.255  255.255.255.255            在链路上      192.168.0.21    266&#xA;        224.0.0.0        240.0.0.0            在链路上         127.0.0.1    306&#xA;        224.0.0.0        240.0.0.0            在链路上        10.8.12.13    266&#xA;        224.0.0.0        240.0.0.0            在链路上      192.168.0.21    266&#xA;  255.255.255.255  255.255.255.255            在链路上         127.0.0.1    306&#xA;  255.255.255.255  255.255.255.255            在链路上        10.8.12.13    266&#xA;  255.255.255.255  255.255.255.255            在链路上      192.168.0.21    266&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, in our another system, only the switch2 is provided (no switch1). The same problem doesn't happen there. The only difference I know is that in this another system the LAN side NIC would be deactivated when switch2 is powered off.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;    10.8.12.13/255.255.255.0 (WAN)&#xA;        PC1 (Windows)&#xA;    192.168.0.21/255.255.255.0 (LAN)&#xA;            |&#xA;            | (below switch and linux pc are powered on/off together)&#xA;            |&#xA;        Switch 2&#xA;            |&#xA;    192.168.0.100/255.255.255.0 (LAN)&#xA;        PC2 (Linux)&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any suggestion is greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="27051" LastEditorUserId="27051" LastEditDate="2016-06-11T07:51:26.073" LastActivityDate="2016-06-11T07:51:26.073" Title="failed to ping a local peer on the windows host with 2 NICs when peer is re-powered on" Tags="|traceroute|" AnswerCount="1" CommentCount="1" ClosedDate="2016-06-13T14:12:46.560" ContentLicense="CC BY-SA 3.0" />
  <row Id="32142" PostTypeId="2" ParentId="32069" CreationDate="2016-06-10T10:08:37.617" Score="1" Body="&lt;p&gt;You can turn a layer 2 switchport into a layer 3 port and assign an IP address if you do no wish to use a vlan interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note, you must have ip routing enabled and the switch must support it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the following commands to do so.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)# ip routing&#xA;Switch(config)# interface gi 0/1&#xA;Switch(config-if)# no switchport&#xA;Switch(config-if)# ip address 10.0.0.1 255.255.255.0&#xA;Switch(config-if)# no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For some further reading and study please refer to the cisco doc : &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/37sg/configuration/guides/config/l3_int.html#wp1029778&quot; rel=&quot;nofollow&quot;&gt;Chapter: Configuring Layer 3 Interfaces&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-10T10:08:37.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32143" PostTypeId="2" ParentId="32140" CreationDate="2016-06-10T10:58:20.107" Score="1" Body="&lt;p&gt;Depending on what version of Comware you are using, you might need to use a CA Server rather than a generated selfsigned certificate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Early versions of Comware 3 and 5 seem to need a CA while later versions of Comware 5 and Comware version 7 can use a self signed certificate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the configuration guide for the 5500 it states the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Enabling the HTTPS service triggers an &#xA;  SSL handshake negotiation process. &#xA;  During the process, if the local certificate &#xA;  of the device exists, the SSL negotiation &#xA;  succeeds, and the HTTPS service can be &#xA;  started properly. If no local certificate &#xA;  exists, a certificate application process &#xA;  will be triggered by the SSL negotiation. &#xA;  Because the application process takes &#xA;  much time, the SSL negotiation often fails &#xA;  and the HTTPS service cannot be started &#xA;  normally. In that case, execute the &#xA;  ip &#xA;  https enable &#xA;  command multiple times to &#xA;  start the HTTPS service.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So if the negotiation does not start which gives you your error, trying using the &lt;strong&gt;ip https enable&lt;/strong&gt; multiple times to start the service and begin the certification application process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can view the state of HTTPS using &lt;strong&gt;display ip https&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find more information using the HP 5500 configuration guide which you can find the link to &lt;a href=&quot;http://h17007.www1.hp.com/device_help/H3C-Manuals/5500/5500-Configuration-Guide%28R2215%29.pdf&quot; rel=&quot;nofollow&quot;&gt;here (PDF document)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to configure https with a CA server, you can find the complex set of steps to do this &lt;a href=&quot;http://hpnetworkers.blogspot.co.uk/2012/02/hp-series-h3c-comware-https-howto-with.html&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-10T10:58:20.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32144" PostTypeId="2" ParentId="32141" CreationDate="2016-06-10T11:31:57.637" Score="2" Body="&lt;p&gt;It appears that when you are performing the trace route, the path is taken out of your WAN interface rather than your LAN side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each time you are powering off PC2 and SWITCH2, you are clearing the learned routes on PC1 I think and only when you remove the WAN interface it will try to learn the path to PC2 because it's the only interface available. Once it has learned both paths, it can choose where to send the PINGS correctly based on the PC1's routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you could perhaps do is setup a static route on PC1 using the following command &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;route -p add 192.168.0.0 mask 255.255.255.0 0.0.0.0 IF &amp;lt;InterfaceNumber&amp;gt; metric 2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are using 0.0.0.0 as the nexthop so that we can tell Windows to use a specific interface. You can find the interface number listed when you &lt;strong&gt;route print&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternative you can specify PC2 as the next hop if there are no other PC's you need to get to using &lt;code&gt;route -p add 192.168.0.0 mask 255.255.255.0 192.168.0.100 metric 2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Give this a go and see how this works for you. If this does not work, you can remove the static route using the following command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;route delete 192.168.0.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-10T11:31:57.637" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32145" PostTypeId="1" AcceptedAnswerId="32150" CreationDate="2016-06-10T12:26:52.753" Score="1" ViewCount="2721" Body="&lt;p&gt;Am I correct that if there is no &lt;code&gt;switch-profile&lt;/code&gt; configured for pair of Cisco Nexus 5k switches, then &lt;code&gt;conf sync&lt;/code&gt; does not work regardless that CFS(Cisco Fabric Services) is enabled over management interfaces between this pair of switches?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="8499" LastEditDate="2018-12-25T02:11:32.230" LastActivityDate="2018-12-25T02:11:32.230" Title="understand &quot;switch-profile&quot; for Nexus 5k switches" Tags="|cisco|switch|cisco-commands|cisco-nexus|cisco-nx-os|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32146" PostTypeId="1" AcceptedAnswerId="32148" CreationDate="2016-06-10T13:20:49.130" Score="1" ViewCount="1289" Body="&lt;p&gt;I am trying to grasp the idea of how a switch communicates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does a layer 2 switch require the entire stack to do it's job, same for layer 3?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a switch can support SNMP which sits on top of UDP, it must have a full stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe most switches have some type of network operating system if any at all, so it is hard to understand what a switch actually entails.&lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2016-06-10T13:41:03.257" Title="Does a switch have a full tcp/ip stack?" Tags="|switch|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32147" PostTypeId="2" ParentId="32146" CreationDate="2016-06-10T13:40:50.177" Score="4" Body="&lt;p&gt;A layer-2 switch with management capabilities has the same network stack as a client computer. What it lacks are the routing protocols and other bits found in an L3 device.&lt;/p&gt;&#xA;" OwnerUserId="15782" LastActivityDate="2016-06-10T13:40:50.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32148" PostTypeId="2" ParentId="32146" CreationDate="2016-06-10T13:41:03.257" Score="10" Body="&lt;p&gt;It may be helpful to separate the forwarding functions of the  switch from the  management functions.  We often refer to these as the &quot;forwarding plane&quot; and the management plane.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The management functions can include snmp, telnet, ssh, ftp, tfp, &lt;em&gt;etc&lt;/em&gt;.  For these to work, the switch needs an OS, and in fact most switch OS are based on some form of *nix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The forwarding function does not need any of that.  In most switches, all the forwarding is done in hardware, so there isn't a &quot;stack&quot; in the software sense.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-10T13:41:03.257" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32150" PostTypeId="2" ParentId="32145" CreationDate="2016-06-10T14:20:14.597" Score="2" Body="&lt;p&gt;Setting up the configuration synchronization mode (&lt;code&gt;conf sync&lt;/code&gt;) involves creating a switch profile (&lt;code&gt;switch-profile&lt;/code&gt;). Cisco has a lot of documents regarding this, e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/system_management/502_n1_1/b_Cisco_n5k_system_mgmt_cg_rel_502_n1_1/Cisco_n5k_system_mgmt_cg_rel_502_n1_1_chapter3.html&quot; rel=&quot;nofollow&quot;&gt;Chapter: Configuring Switch Profiles&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;Prerequisites for Switch Profiles&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;Switch profiles have the following prerequisites:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;You must enable CFSoIP distribution over mgmt0 on both switches by    entering the cfs ipv4 distribute command.&lt;/li&gt;&#xA;  &lt;li&gt;You must configure a switch profile with the same name on both    peer-switches by entering the config sync and switch-profile&lt;br&gt;&#xA;  commands.&lt;/li&gt;&#xA;  &lt;li&gt;Configure each switch as peer switch by entering the sync-peers    destination command&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;h1&gt;Configuration Guidelines and Limitations&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;Switch profiles have the following configuration guidelines and limitations:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;You can only enable configuration synchronization using the mgmt0    interface.&lt;/li&gt;&#xA;  &lt;li&gt;You must configure synchronized peers with the same switch profile    name.&lt;/li&gt;&#xA;  &lt;li&gt;Commands that are qualified for a switch profile configuration are    allowed to be configured in the configuration switch profile&lt;br&gt;&#xA;  (config-sync-sp) mode.&lt;/li&gt;&#xA;  &lt;li&gt;Supported switch profile commands relate to vPC commands. FCoE    commands are not supported.&lt;/li&gt;&#xA;  &lt;li&gt;One switch profile session can be in progress at a time. Attempts to    start another session will fail.&lt;/li&gt;&#xA;  &lt;li&gt;Supported command changes made from the configuration terminal mode    are blocked when a switch profile session is in progress. You should&lt;br&gt;&#xA;  not make unsupported command changes from the configuration terminal&lt;br&gt;&#xA;  mode when a switch profile session is in progress..&lt;/li&gt;&#xA;  &lt;li&gt;When you enter the commit command and a peer switch is reachable, the    configuration is applied to both peer switches or neither&#xA;  switch. If    there is a commit failure, the commands remain in the&#xA;  switch profile    buffer. You can then make necessary corrections and&#xA;  try the commit    again.&lt;/li&gt;&#xA;  &lt;li&gt;Cisco recommends that you enable pre-provisioning for all    Gigabit-Ethernet Modules (GEMs) and Cisco Nexus Fabric Extender&lt;br&gt;&#xA;  modules whose interface configurations are synchronized using the&lt;br&gt;&#xA;  configuration synchronization feature. Follow these guidelines in&lt;br&gt;&#xA;  Cisco Nexus Fabric Extender A/A topologies where the Fabric Extenders &#xA;  might not be online on one switch and its configuration is changed&lt;br&gt;&#xA;  and synchronized on the other switch. In this scenario, if you do not &#xA;  enable pre-provisioning, a commit fails and the configuration is&lt;br&gt;&#xA;  rolled back on both switches.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;h1&gt;Configuring Switch Profiles&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;You can create and configure a switch profile. Enter the&#xA;  switch-profile &lt;em&gt;name&lt;/em&gt; command in the configuration synchronization&#xA;  mode (config-sync).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Before You Begin&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You must create the switch profile with the same name on each switch&#xA;  and the switches must configure each other as a peer. When&#xA;  connectivity is established between switches with the same active&#xA;  switch profile, the switch profiles are synchronized.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;SUMMARY STEPS&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;configuration terminal&lt;/li&gt;&#xA;  &lt;li&gt;cfs ipv4 distribute&lt;/li&gt;&#xA;  &lt;li&gt;config sync&lt;/li&gt;&#xA;  &lt;li&gt;switch-profile name&lt;/li&gt;&#xA;  &lt;li&gt;sync-peers destination IP-address&lt;/li&gt;&#xA;  &lt;li&gt;show switch-profile name status&lt;/li&gt;&#xA;  &lt;li&gt;exit&lt;/li&gt;&#xA;  &lt;li&gt;copy running-config startup-config&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-10T14:20:14.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32153" PostTypeId="2" ParentId="32067" CreationDate="2016-06-10T16:38:52.503" Score="1" Body="&lt;p&gt;For Cisco devices, it is pretty easy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router&amp;gt; show ipv6 rip&#xA;RIP process &quot;process1&quot;, port 521, multicast-group FF02::9, pid 62&#xA;  Administrative distance is 120. Maximum paths is 1&#xA;  Updates every 5 seconds, expire after 15&#xA;  Holddown lasts 10 seconds, garbage collect after 30&#xA;  Split horizon is on; poison reverse is off&#xA;  Default routes are generated&#xA;  Periodic updates 223, trigger updates 1&#xA; Interfaces:&#xA;  Ethernet0/0&#xA; Redistribution:&#xA;  Redistributing protocol bgp 65001 route-map bgp-to-rip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice the &lt;code&gt;Split horizon is on;&lt;/code&gt; in the output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has lots of documents on this sort of thing, e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipv6/configuration/15-2mt/ipv6-15-2mt-book/ip6-rip.html&quot; rel=&quot;nofollow&quot;&gt;Chapter: Implementing RIP for IPv6&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-10T17:22:20.973" LastActivityDate="2016-06-10T17:22:20.973" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="32154" PostTypeId="1" CreationDate="2016-06-10T19:59:23.167" Score="2" ViewCount="365" Body="&lt;p&gt;I am trying to set up several VLAN's on a Cisco 3560 switch. These new segments should be able to communicate with VLAN 1 and even access the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basic IP information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway: 10.1.1.2&#xA;VLAN1:   10.1.1.1/24&#xA;VLAN2:   10.1.2.1/24&#xA;VLAN3:   10.1.3.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I managed to add the VLAN and have network connectivity within the VLAN's but have not been able to get routing to work correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's working:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Hosts in VLAN 1 one can ping the DG and access the internet&lt;/li&gt;&#xA;&lt;li&gt;VLAN 2 &amp;amp; 3 are communicating with each other. Hosts in VLAN2 (e.g. 10.1.2.2) can ping hosts in VLAN3 (e.g. 10.1.3.2) on the same switch&lt;/li&gt;&#xA;&lt;li&gt;Hosts in VLAN 2 &amp;amp; 3 can ping the interface IP of VLAN1 (10.1.1.1)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What's not working:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Hosts in VLAN 2 &amp;amp; 3 cannot ping the hosts in VLAN 1 on the same switch, or vice versa.&lt;/li&gt;&#xA;&lt;li&gt;Hosts in VLAN 2 &amp;amp; 3 cannot even ping the DG.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is the configuration on the switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh conf&#xA;&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;no service password-encryption&#xA;!&#xA;hostname Layer3&#xA;!&#xA;enable secret 5 $1$3NYq$mDR12iJm5nEorw8oDLDgr1&#xA;enable password Cisco&#xA;!&#xA;no aaa new-model&#xA;vtp domain BETA&#xA;vtp mode transparent&#xA;ip subnet-zero&#xA;ip routing&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;vlan 2&#xA; name VLAN002&#xA;!&#xA;vlan 3&#xA; name VLAN003&#xA;!&#xA;vlan 60&#xA; name Reserved-1&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 2&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 3&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport access vlan 2&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport access vlan 3&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; ip address 10.1.1.1 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; ip address 10.1.2.1 255.255.255.0&#xA;!&#xA;interface Vlan3&#xA; ip address 10.1.3.1 255.255.255.0&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 10.1.1.2&#xA;ip http server&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;&#xA;#sh vlan br&#xA;&#xA;VLAN Name                             Status    Ports&#xA;---- -------------------------------- --------- ------------------------------&#xA;1    default                          active    Fa0/1, Fa0/5, Fa0/7, Fa0/8&#xA;                                                Fa0/9, Fa0/10, Fa0/11, Fa0/12&#xA;                                                Fa0/13, Fa0/14, Fa0/15, Fa0/16&#xA;                                                Fa0/17, Fa0/18, Fa0/19, Fa0/20&#xA;                                                Fa0/21, Fa0/23, Gi0/1, Gi0/2&#xA;2    VLAN002                          active    Fa0/2, Fa0/4&#xA;3    VLAN003                          active    Fa0/3, Fa0/6&#xA;60   Reserved-1                       active&#xA;1002 fddi-default                     act/unsup&#xA;1003 token-ring-default               act/unsup&#xA;1004 fddinet-default                  act/unsup&#xA;1005 trnet-default                    act/unsup&#xA;&#xA;&#xA;&#xA;#sh ip route&#xA;&#xA;Gateway of last resort is 10.1.1.2 to network 0.0.0.0&#xA;&#xA;     10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks&#xA;C       10.1.3.0/24 is directly connected, Vlan3&#xA;C       10.1.2.0/24 is directly connected, Vlan2&#xA;C       10.1.1.0/24 is directly connected, Vlan1&#xA;S*   0.0.0.0/0 [1/0] via 10.1.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can someone point out the problem to me please?&lt;/p&gt;&#xA;" OwnerUserId="27074" LastEditorUserId="8499" LastEditDate="2016-06-10T20:20:39.727" LastActivityDate="2016-06-10T20:25:15.997" Title="Problem with Routing in VLAN" Tags="|cisco|routing|switch|vlan|layer3|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32155" PostTypeId="2" ParentId="32154" CreationDate="2016-06-10T20:17:33.773" Score="3" Body="&lt;p&gt;Normally, if you have routing enabled on this switch, you should use a routed link to the other router, not a layer-2 connection. The layer-2 connection complicates things. What you should do is set up the interface to the other router with a &lt;code&gt;no switchport&lt;/code&gt; command, and place an IP address, like &lt;code&gt;10.0.0.2 255.255.255.252&lt;/code&gt; on it, and set up the router interface to the switch with &lt;code&gt;10.0.0.1 255.255.255.252&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your hosts on VLAN 1 need to have their gateway set to &lt;code&gt;10.1.1.1&lt;/code&gt;, not &lt;code&gt;10.1.1.2&lt;/code&gt;, so that traffic destined for VLANs 2 and 3 doesn't get sent to the other router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case the other router must have routes back to VLANs 2 and 3, so that it knows to send any traffic destined for those networks to the switch. Also, you will need to tell the other router to NAT for those networks, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-10T20:25:15.997" LastActivityDate="2016-06-10T20:25:15.997" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32156" PostTypeId="1" CreationDate="2016-06-10T21:36:01.880" Score="3" ViewCount="1613" Body="&lt;p&gt;As you may already know, one of the requirements to use all the available wifi US 5GHz channels is supporting &lt;a href=&quot;https://en.wikipedia.org/wiki/Dynamic_frequency_selection#DFS&quot; rel=&quot;nofollow&quot;&gt;DFS&lt;/a&gt; on the Access Point; when DFS is enabled, it scans active and inactive 5Ghz channels for a minute at a time to ensure that there is no conflict with any radar signals which may also operate in this spectrum.  If radar pulses are detected, that channel is black-holed for at least 30 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DFS detects radar operating close to our site; however, I'm curious whether there is a list of DFS black-holed channels in the WLC... so far, I've been turning up a big zero... all I can find are SNMP traps from the controller...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Channel changed for Base Radio MAC: de:ad:be:ef:00:00 on 802.11a radio. &#xA;Old Channel: 56. New Channel: 161. Why: Radar. Energy before/after&#xA;                                        ^^^^^ &#xA;change: 0/0. Noise before/after change: 0/0. Interference before/after change: 0/0.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to find the current list of DFS-blackholed channels via the console or GUI?  If so, how?&lt;/p&gt;&#xA;" OwnerUserId="775" LastActivityDate="2016-06-11T17:20:28.613" Title="Blacklisted DFS channels on Cisco WLC" Tags="|cisco|ieee-802.11|cisco-commands|wlc|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32158" PostTypeId="2" ParentId="32128" CreationDate="2016-06-10T22:39:38.120" Score="3" Body="&lt;p&gt;Yes, your setup is correct to get IP addresses delegated through the switch from the router to your devices if it is a home setup, where your router is already set up to delegate addresses through DHCP. A setup something like the below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cloud/Internet &gt; Router (w DHCP) &gt; Switch &gt; Devices (will get IPs)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a simple breakdown of a corporate setup, it's just like the above but...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cloud/Internet &gt; Router &gt; DHCP server &gt; Switch &gt; Devices (will get IPs)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully that answers some of your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers!&lt;/p&gt;&#xA;" OwnerUserId="27076" LastActivityDate="2016-06-10T22:39:38.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32159" PostTypeId="2" ParentId="1190" CreationDate="2016-06-10T23:22:32.433" Score="-3" Body="&lt;p&gt;when Adding VLAN without removing other VLAN  use this command&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;switchport trunk allowed vlan add 30&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;this will add Vlan 30 to the trunk without removing the existing vlans in trunk interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&lt;/p&gt;&#xA;" OwnerUserId="27077" LastActivityDate="2016-06-10T23:22:32.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32166" PostTypeId="2" ParentId="32096" CreationDate="2016-06-11T13:08:18.240" Score="0" Body="&lt;p&gt;10/100 autosensing is for backwards compatibility with old hosts that are 10M only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10M was the only ethernet for a long time. When 100M was introduced, it was extremely expensive and only used for backbones or servers (and not all servers either, just the important one or two that could justify the cost).  Therefore it was assumed that 10M devices would be around for a long, long time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly enough: 10/100M NICs were so expensive that using one to talk to a 10M device was initially considered wasteful.  Why spend all that money to talk to a 10M device unless that 10M device was scheduled to be upgraded.  If it was decided NOT to upgrade &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why was 100M either so expensive initially?  Besides the fact that new tech is usually more expensive at first, at the time the only other network technology that was 100M/s was FDDI which was extremely expensive and extremely difficult to manage.  So, the 100M/s ethernet vendors could charge high prices and it would still be cheaper than FDDI.  If bread cost $100/loaf and you found a way to make it for $10/loaf, you'd charge $99/loaf for as long as you could, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remember a Cisco salesperson in 1996-ish saying &quot;we expect 10/100 switch ports to drop to $100/port eventually, so in the future we won't offer 10M... just 10/100M.&quot;  At the time this seemed like crazytalk.&lt;/p&gt;&#xA;" OwnerUserId="1243" LastActivityDate="2016-06-11T13:08:18.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32167" PostTypeId="1" AcceptedAnswerId="32170" CreationDate="2016-06-11T15:56:21.990" Score="4" ViewCount="12026" Body="&lt;p&gt;We have a 4Gb (4x1G) LAG trunk with LACP between two cisco switches (c3850&amp;lt;---&gt;c4948) and i am noticing that it is not doing proper load-balancing. I found SW1 using &lt;code&gt;src-dst-ip&lt;/code&gt; algorithm and SW2 using &lt;code&gt;src-mac&lt;/code&gt; algorithm. Are both of these algorithms supposed to be same? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the best load-balancing method that I should use? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have mixed traffic in our environment including VoIP, TCP/UDP, SAN backup nightly etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#show etherchannel load-balance&#xA;EtherChannel Load-Balancing Configuration:&#xA;        src-dst-ip&#xA;&#xA;EtherChannel Load-Balancing Addresses Used Per-Protocol:&#xA;Non-IP: Source XOR Destination MAC address&#xA;  IPv4: Source XOR Destination IP address&#xA;  IPv6: Source XOR Destination IP address &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SW2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW2&amp;gt;show etherchannel load-balance&#xA;EtherChannel Load-Balancing Configuration:&#xA;        src-mac&#xA;&#xA;EtherChannel Load-Balancing Addresses Used Per-Protocol:&#xA;Non-IP: Source MAC address&#xA;  IPv4: Source MAC address&#xA;  IPv6: Source MAC address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;EDIT:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Notes: We don't have a router, all we have is a L2 switched network. We have many servers behind trunk, so should i use src-dst-ip? or src-dst-mac ?  &lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="42718" LastEditDate="2018-11-02T03:58:00.090" LastActivityDate="2018-11-02T03:58:00.090" Title="Help optimize a LAG with LACP and two different algorithms on each side" Tags="|cisco|switch|ethernet|etherchannel|port-channel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="32168" PostTypeId="2" ParentId="32167" CreationDate="2016-06-11T16:11:31.080" Score="1" Body="&lt;p&gt;You need to remember that on a etherchannel, on bot switches you can balance the data you want to transmit (there is no problem if exist differences of the algorithm on bot ends)if you do that on bot ends, you will be getting a load balance on your link. By other hand, to choose the correct algorithm, you need to think on the form that data is transmited, if source is one ip, on mac-address, destination is one ip, one mac-address, to get the correct load balance method. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg, if the source you will be getting it is a great number of ip, i think you can tried with src-ip, if you will be getting a lot of differents mac, src-mac if what you need. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the trick for load balance, and the reason why we sometimes put a correct configuration, and we don't see nothing of load balance on our etherchannel links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember, router changes mac address and put it owns like mac address source on outbound packets, that's it, if a lan is connected to a router, and then behind a router is are connected your switches and your etherchannel, i guess you will NOT get a great differences of mac address...&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-06-11T16:11:31.080" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32169" PostTypeId="2" ParentId="32156" CreationDate="2016-06-11T17:20:28.613" Score="2" Body="&lt;p&gt;Although this seems to be an AP-based rather than WLC-based command, it would appear you can get the info you want from the AP CLI through&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show controller dot11radio1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The output includes a section called &quot;DFS Blocked Frequencies&quot; which should be what you're looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/access_point/12-4-25d-JA/Configuration/guide/cg_12_4_25d_JA/scg12-4-25d-JA-chap6-radio.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/wireless/access_point/12-4-25d-JA/Configuration/guide/cg_12_4_25d_JA/scg12-4-25d-JA-chap6-radio.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-06-11T17:20:28.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32170" PostTypeId="2" ParentId="32167" CreationDate="2016-06-11T18:12:59.710" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;We don't have router, all we have L2 switch network. We have many&#xA;  servers behind trunk, so should i use src-dsp-ip? or src-dst-mac ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You need to weigh several factors to determine which method to use in different places on your network. Different network engineers will come up with different recommendations. This is really leading to opinion-based answers, and it is probably better suited for a discussion on &lt;a href=&quot;http://chat.stackexchange.com/rooms/11177&quot;&gt;Network Engineering Chat&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has some guidance that you should understand:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_53_se/configuration/guide/3750xscg/swethchl.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Chapter: Configuring EtherChannels&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;Load-Balancing and Forwarding Methods&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;EtherChannel balances the traffic load across the links in a channel&#xA;  by reducing part of the binary pattern formed from the addresses in&#xA;  the frame to a numerical value that selects one of the links in the&#xA;  channel. EtherChannel load-balancing can use MAC addresses or IP&#xA;  addresses, source or destination addresses, or both source and&#xA;  destination addresses. The selected mode applies to all EtherChannels&#xA;  configured on the switch. You configure the load-balancing and&#xA;  forwarding method by using the &lt;strong&gt;port-channel load-balance&lt;/strong&gt; global&#xA;  configuration command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With source-MAC address forwarding, when packets are forwarded to an&#xA;  EtherChannel, they are distributed across the ports in the channel&#xA;  based on the source-MAC address of the incoming packet. Therefore, to&#xA;  provide load-balancing, packets from different hosts use different&#xA;  ports in the channel, but packets from the same host use the same port&#xA;  in the channel.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With destination-MAC address forwarding, when packets are forwarded to&#xA;  an EtherChannel, they are distributed across the ports in the channel&#xA;  based on the destination host's MAC address of the incoming packet.&#xA;  Therefore, packets to the same destination are forwarded over the same&#xA;  port, and packets to a different destination are sent on a different&#xA;  port in the channel.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With source-and-destination MAC address forwarding, when packets are&#xA;  forwarded to an EtherChannel, they are distributed across the ports in&#xA;  the channel based on both the source and destination MAC addresses.&#xA;  This forwarding method, a combination source-MAC and destination-MAC&#xA;  address forwarding methods of load distribution, can be used if it is&#xA;  not clear whether source-MAC or destination-MAC address forwarding is&#xA;  better suited on a particular switch. With source-and-destination&#xA;  MAC-address forwarding, packets sent from host A to host B, host A to&#xA;  host C, and host C to host B could all use different ports in the&#xA;  channel.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With source-IP address-based forwarding, when packets are forwarded to&#xA;  an EtherChannel, they are distributed across the ports in the&#xA;  EtherChannel based on the source-IP address of the incoming packet.&#xA;  Therefore, to provide load-balancing, packets from different IP&#xA;  addresses use different ports in the channel, but packets from the&#xA;  same IP address use the same port in the channel.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With destination-IP address-based forwarding, when packets are&#xA;  forwarded to an EtherChannel, they are distributed across the ports in&#xA;  the EtherChannel based on the destination-IP address of the incoming&#xA;  packet. Therefore, to provide load-balancing, packets from the same IP&#xA;  source address sent to different IP destination addresses could be&#xA;  sent on different ports in the channel. But packets sent from&#xA;  different source IP addresses to the same destination IP address are&#xA;  always sent on the same port in the channel.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With source-and-destination IP address-based forwarding, when packets&#xA;  are forwarded to an EtherChannel, they are distributed across the&#xA;  ports in the EtherChannel based on both the source and destination IP&#xA;  addresses of the incoming packet. This forwarding method, a&#xA;  combination of source-IP and destination-IP address-based forwarding,&#xA;  can be used if it is not clear whether source-IP or destination-IP&#xA;  address-based forwarding is better suited on a particular switch. In&#xA;  this method, packets sent from the IP address A to IP address B, from&#xA;  IP address A to IP address C, and from IP address C to IP address B&#xA;  could all use different ports in the channel.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Different load-balancing methods have different advantages, and the&#xA;  choice of a particular load-balancing method should be based on the&#xA;  position of the switch in the network and the kind of traffic that&#xA;  needs to be load-distributed. In Figure 40-5, an EtherChannel of four&#xA;  workstations communicates with a router. Because the router is a&#xA;  single-MAC-address device, source-based forwarding on the switch&#xA;  EtherChannel ensures that the switch uses all available bandwidth to&#xA;  the router. The router is configured for destination-based forwarding&#xA;  because the large number of workstations ensures that the traffic is&#xA;  evenly distributed from the router EtherChannel.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Use the option that provides the greatest variety in your&#xA;  configuration. For example, if the traffic on a channel is going only&#xA;  to a single MAC address, using the destination-MAC address always&#xA;  chooses the same link in the channel. Using source addresses or IP&#xA;  addresses might result in better load-balancing.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Figure 40-5 Load Distribution and Forwarding Methods&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8SfFa.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8SfFa.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-11T18:12:59.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32171" PostTypeId="2" ParentId="32110" CreationDate="2016-06-11T18:15:21.157" Score="3" Body="&lt;p&gt;Reference to this answer is not easy to find in any vendor/training materials, but lies in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1195&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1195&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Level 2 routers include in their level 2 LSPs a list of all [IP address, subnet mask, metric] combinations reachable in their area. In general, this information may be determined from the level 1 LSPs from all routers in the area. If we ignore resource constraints, then it would be permissible for a level 2 router to simply duplicate all [IP address, subnet mask, metric] entries from all level 1 routers in its area (with appropriate metric adjustment), for inclusion in its level 2 LSP.&lt;/p&gt;&#xA;&lt;p&gt;Any address obtained from a level 1 LSP which is not superceded by the manually configured information is included in the level 2 LSPs. In this case, the metric value announced in the level 2 LSPs is calculated from the sum of the metric value announced in the corresponding level 1 LSP, plus the distance from the level 2 router to the appropriate level 1 router.&lt;/p&gt;&#xA;&lt;p&gt;In general, the same [IP address, subnet mask] pair may be announced in level 1 LSPs sent by multiple level 1 routers in the same area. In this case (assuming the entry is not superceded by a manually configured entry), then only one such entry shall be included in the level 2 LSP. The metric value(s) announced in Level 2 LSPs correspond to the minimum of the metric value(s) that would be calculated for each of the level 1 LSP entries.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So to focus on your example.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1Zz04.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1Zz04.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Area 1 L1/L2 router knows the Area 1 topology and Level 2 topology, but does not know about the the Area 2 topology.&lt;/p&gt;&#xA;&lt;p&gt;Area 2 L1/L2 routers know Area 2 topology. They perform SPF calculation on their Area 2 topology information to calculate the cost to the destination - 1 and 1000.&lt;/p&gt;&#xA;&lt;p&gt;Area 2 L1/L2 routers advertise the destination network to other Level 2 routers (namely Area 1 L1/L2 router) with the calculated cost (1 and 1000). (but they do not advertise the topology of the Area 2 itself to the Level 2 routers!)&lt;/p&gt;&#xA;&lt;p&gt;Area 1 L1/L2 router receives these LSPs. It knows that destination is reachable from northern Area 2 L1/L2 router with cost 1 and from southern Area 2 L1/L2 router with cost 1000. Area 1 L1/L2 router adds that to its SPF calculation for Level 2 topology and calculates the total cost to reach the destination - 11 through the northern Area 2 L1/L2 router and 1001 through the southern Area 2 L1/L2 router.&lt;/p&gt;&#xA;&lt;p&gt;To answer the original question: L1/L2 router of the source area &lt;strong&gt;does not&lt;/strong&gt; send the traffic to the nearest L1/L2 router of the destination area, it &lt;strong&gt;has enough information about the cost&lt;/strong&gt; from destination area L1/L2 routers to the destination (&lt;strong&gt;but not the topology of the destination area&lt;/strong&gt;) to choose the best L1/L2 router of the destination area (i.e to find the full shortest path to the final destination).&lt;/p&gt;&#xA;" OwnerUserId="25723" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-06-11T22:16:17.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32172" PostTypeId="1" CreationDate="2016-06-11T18:24:21.627" Score="1" ViewCount="1251" Body="&lt;p&gt;Consider two scenarios:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Scenario 1: Cisco SG200-26 -&gt; 5-port Hub -&gt; &lt;em&gt;Test Machine&lt;/em&gt; &lt;/li&gt;&#xA;&lt;li&gt;Scenario 2: Cisco SG200-26 -&gt; &lt;em&gt;Test Machine&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I have a device 192.168.2.1 connected directly to the Cisco SG200-26 acting as DHCP giving out IP addresses for his own subnet (192.168.2.XXX). I'm trying to set my &lt;em&gt;Test Machine&lt;/em&gt; to a static IP on subnet 192.168.1.XXX. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In scenario 1, when I set my &lt;em&gt;Test Machine&lt;/em&gt; to DHCP, it successfully receives a 192.168.2.XXX IP but cannot access 192.168.1.XXX subnet at all, and setting it with a static IP 192.168.1.XXX conversely doesn't allow it to route to the 192.168.2.XXX subnet at all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In scenario 2 however, whether I set my &lt;em&gt;Test machine&lt;/em&gt; to DHCP (192.168.2.XXX) or static (192.168.1.XXX), in both cases, both subnets are routable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing in scenario 1 to have the static 192.168.1.XXX IP address route properly to the 192.168.2.XXX subnet as well ?&lt;/p&gt;&#xA;" OwnerUserId="27089" LastEditorUserId="28361" LastEditDate="2016-08-24T15:29:48.723" LastActivityDate="2016-08-29T14:19:12.877" Title="Static IP behind a switch not routing to other subnet" Tags="|routing|dhcp|" AnswerCount="3" CommentCount="9" ClosedDate="2019-02-28T03:21:03.523" ContentLicense="CC BY-SA 3.0" />
  <row Id="32174" PostTypeId="2" ParentId="29139" CreationDate="2016-06-11T22:58:35.890" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;For locally received routes at routers R1 &amp;amp; R2 you can use feature&#xA;  WEIGHT for specific interface. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;if you want only one router out of two as best to forward the traffic&#xA;  outside the your AS, use local preference.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8007" LastActivityDate="2016-06-11T22:58:35.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32175" PostTypeId="1" AcceptedAnswerId="32181" CreationDate="2016-06-12T04:58:04.390" Score="1" ViewCount="2280" Body="&lt;p&gt;I know these numbers are related to the MTU size but I did not get a clarity of what exactly it is and why this number.Could anyone please explain?&lt;/p&gt;&#xA;" OwnerUserId="24153" LastActivityDate="2016-06-12T09:26:31.170" Title="What is 576 bytes and 68 byte chunk when it comes to MTU?" Tags="|tcp|ip|mtu|fragmentation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32177" PostTypeId="1" AcceptedAnswerId="32178" CreationDate="2016-06-12T05:37:08.750" Score="11" ViewCount="5592" Body="&lt;p&gt;Why do LANs use MAC addressing instead of IP addressing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, why can't a network just assign an IP address to a local area network device and send the data to that, instead of the MAC address? MAC addresses seem quite redundant without understanding its function.&lt;/p&gt;&#xA;" OwnerUserId="24256" LastEditorUserId="8499" LastEditDate="2018-03-09T23:37:35.863" LastActivityDate="2020-05-08T12:22:24.477" Title="Why do LANs use MAC addressing instead of IP addressing?" Tags="|ip|mac-address|lan|ip-address|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32178" PostTypeId="2" ParentId="32177" CreationDate="2016-06-12T06:14:12.750" Score="8" Body="&lt;p&gt;You need to understand the network layers. They are independent of each other. Ethernet and IPv4 are currently the dominant protocols, but that was not always the case, and IPv4 is being replaced with IPv6, which has very different addressing. Layer-2 protocols can carry many different layer-3 protocols, and layer-3 protocols don't care which layer-2 protocol is used. You could ask the same thing of layer-4. Some layer-4 protocols have addresses. In TCP and UDP, these are called ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LANs are layer-2 broadcast domains. There are multiple layer-2 protocols, some use 48- bit MAC addresses, some use 64-bit MAC addresses, and some do something else altogether.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LANs can carry a variety of layer-3 protocols, IPv4 is only one of those. If the layer-2 devices need to be specific to a particular layer-3 protocol, it becomes a problem. If you had switches which used IPv4, what happens when you need to add IPv6 devices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past, IPX was the layer-3 protocol of choice for LANs. If switches were designed for IPX, IPv4 may not have come to the fore for the layer-3 protocol. That would have caused a complete overhaul of LAN devices. Since a layer-2 protocol can carry any number of layer-3 protocols, even at the same time, IPv4 could use the same equipment. That is happening now as IPv6 is being rolled out. You can run both IPv4 and IPv6 with the same LAN equipment.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-19T17:04:38.133" LastActivityDate="2016-06-19T17:04:38.133" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="32179" PostTypeId="2" ParentId="32177" CreationDate="2016-06-12T06:16:12.003" Score="0" Body="&lt;p&gt;MAC addresses are a low level component of an Ethernet network (and some other similar standards, such as WiFi). They allow a device to communicate with a machine on the local physical network (LAN), and cannot be routed across the Internet - because a physical hardware might in theory be plugged in anywhere in the world. MAC addresses are at Layer 2 - the data-link layer. MAC Addresses are stored in your arp table(On your PC, on command line: type &quot;arp -a&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the contrary, IP addresses cover the whole internet. Routers use IP to figure out where to route data. IP aren't helpful in interfacing with the physical hardware on your local network. IPs are found at Layer3 - Network layer. IP are stored in your routing table(On your PC, on command line: type &quot;route -n&quot; or &quot;route print&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For better understanding, I'd strongly advise you to read on the OSI model.&lt;/p&gt;&#xA;" OwnerUserId="25881" LastActivityDate="2016-06-12T06:16:12.003" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32180" PostTypeId="2" ParentId="17254" CreationDate="2016-06-12T09:19:52.407" Score="0" Body="&lt;p&gt;Another method is use L3vpn via bgp option A technique at ATT router with igp protocols at both ends and redistribute into &#xA;address-family ipv4 vrf Cust_A under  bgp 1500. it works properlyand it overcome AS loop prevention feature.&#xA;Also you can use lable swaping per route like as seemless vpn technique&lt;/p&gt;&#xA;" OwnerUserId="8007" LastActivityDate="2016-06-12T09:19:52.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32181" PostTypeId="2" ParentId="32175" CreationDate="2016-06-12T09:26:31.170" Score="6" Body="&lt;p&gt;68 bytes is the minimum size of IPv4 datagram every device must be able to forward without further fragmentation.&lt;/p&gt;&#xA;&lt;p&gt;576 bytes is the minimum size of IPv4 datagram every device has to be able to receive (it can be whole or fragmented).&lt;/p&gt;&#xA;&lt;p&gt;(according to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791&lt;/a&gt;, page 24)&lt;/p&gt;&#xA;" OwnerUserId="19676" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-06-12T09:26:31.170" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32183" PostTypeId="2" ParentId="30576" CreationDate="2016-06-12T12:41:41.233" Score="0" Body="&lt;p&gt;MPLS 2.5 layer protocol between data link layer and network layer. Mpls enables the routers for label base switching using CEF table and ip routing table. It is known by its ebabled applications.&#xA;Applications are&#xA;L3VPNs,&#xA;L2vpns,&#xA;EoMPLS,&#xA;AToMpls,&#xA;FRoMPlS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPLS virtual Private LAN services technique used to extand LAN services over services provider network using the mpls application AToMpls (Any transfer over MPLS. VPLS use the pseudowires end to end and vsi/ vfi for creating a multipoint L2VPNs based on MAC addressing.  &lt;/p&gt;&#xA;" OwnerUserId="8007" LastActivityDate="2016-06-12T12:41:41.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32184" PostTypeId="1" AcceptedAnswerId="32185" CreationDate="2016-06-12T13:46:05.243" Score="2" ViewCount="176" Body="&lt;p&gt;If a layer 2 managed switch supports management functions and entails a &quot;management plan&quot; it must require an OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is a typical network operating system, *nix based, does is have a full file system?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would I be able to write an application and run it on the cpu of the switch?&lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2016-06-12T19:23:25.357" Title="Can I run an application on a managed switch?" Tags="|switch|management|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32185" PostTypeId="2" ParentId="32184" CreationDate="2016-06-12T14:28:27.837" Score="6" Body="&lt;p&gt;You are correct that switches run an OS (Cisco IOS, HP Comware...) however they do not normally expose any means for the end-user to write and deploy additional apps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is true even when the underlying OS is *nix based (such as Cisco NX-OS for its Nexus datacenter switches).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would imagine that this approach is intended to guarantee switch reliability / performance, not to mention that layer 2 switches often have anemic general purpose system resources since almost everything is happening in hardware.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-06-12T14:28:27.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32186" PostTypeId="2" ParentId="32184" CreationDate="2016-06-12T14:31:25.767" Score="4" Body="&lt;p&gt;I think it depends what brand and what OS it is running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco devices run their own proprietary version of IOS, which as far as I know doesn't support custom applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper, on the other hand, is running JunOS based on FreeBSD, so there might be some chance, but I think it will be limited at best.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some small companies may use something like embedded linux, since they probably won't develop their own system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum it up, it depends on the manufacturer and what OS are they using. But even if you can develop application, it will have very limited resources, as network devices are designed specifically for their function and many features use special hardware instead of software (especially on switch).&lt;/p&gt;&#xA;" OwnerUserId="19676" LastActivityDate="2016-06-12T14:31:25.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32188" PostTypeId="1" AcceptedAnswerId="32190" CreationDate="2016-06-12T15:55:51.197" Score="5" ViewCount="5907" Body="&lt;p&gt;What is IP-over-DNS tunnelling please?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen this term used in the context of a captive portal. The idea was to redirect clients to the local web server and to force the DNS (?). It was achieved by manipulating the PREROUTING tables. Apparently, this enabled to avoid IP-over-DNS tunelling... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, I can't find the tutorial on which I saw this. &lt;/p&gt;&#xA;" OwnerUserId="26943" LastActivityDate="2019-05-04T01:09:59.727" Title="What is IP-over-DNS tunnelling?" Tags="|router|dns|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32190" PostTypeId="2" ParentId="32188" CreationDate="2016-06-12T18:58:44.500" Score="7" Body="&lt;p&gt;Ron is right with his comment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP-over-DNS tunneling (or more common name DNS tunneling) is a kind of attack, that allows to bypass usual network protection and send/receive data over DNS protocol, which tends to be less checked. The downside of it is a bit more complicated setup and the speed is very slow, as all data are sent inside DNS requests, which limits the amount in single packet and requires more packets to be sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some examples where this can be used is to exfiltrate data from protected network, or to browse internet at the paid airport wi-fi. This browsing internet on paid wi-fi is exactly bypassing the captive portal as you have mentioned in your question. As far as I know, it can be avoided by proper configuration of your portal, but I don't have experience with this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this explanation will make it more clear for you. If you need more information, I would recommned searching for &quot;dns tunneling&quot;&lt;/p&gt;&#xA;" OwnerUserId="19676" LastActivityDate="2016-06-12T18:58:44.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32191" PostTypeId="2" ParentId="32184" CreationDate="2016-06-12T19:23:25.357" Score="1" Body="&lt;p&gt;As a philosophy ARISTA encourages customers and partners to run standard Linux applications on their switches, publishing all necessary APIs etc.&lt;br&gt;&#xA;As for resources, ARISTA is making very low latency-switches with high port density for 10G/40G/100G, and therefore high CPU power and ample memory is provided. One example of such an integrated application is Splunk for network monitoring/statistics.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-06-12T19:23:25.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32194" PostTypeId="1" AcceptedAnswerId="32195" CreationDate="2016-06-12T21:58:30.117" Score="6" ViewCount="8627" Body="&lt;p&gt;As far as I know, both MAC and IP broadcast addresses are used to send a packet to all hosts that are connected to a local area network. Why would anyone need two addresses to send a broadcast package?&lt;/p&gt;&#xA;" OwnerUserId="26982" LastEditorUserId="81671" LastEditDate="2021-12-23T01:02:42.843" LastActivityDate="2021-12-23T01:02:42.843" Title="What is the difference between MAC and İP broadcast addresses?" Tags="|ip|ipv4|mac-address|ip-address|broadcast|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="32195" PostTypeId="2" ParentId="32194" CreationDate="2016-06-12T22:10:39.417" Score="5" Body="&lt;p&gt;Remember, IPv4 is not the only layer-3 protocol. Traffic on a LAN is delivered by a layer-2 protocol, so layer-2 protocols need a broadcast address to be able to deliver a broadcast to all hosts on a LAN. Layer-2 protocols can carry any number of layer-3 protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An IPv4 host will drop layer-3 traffic delivered to it that is not destined to its IPv4 address, a subscribed IPv4 multicast address, or an IPv4 broadcast address, even if it is delivered via a layer-2 broadcast frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv4 has two different broadcasts: the limited broadcast (&lt;code&gt;255.255.255.255&lt;/code&gt;), and the network broadcast (highest IPv4 address in the network). The limited broadcast cannot leave the network on which it originated. The network broadcast used to be enabled on network equipment, e.g. routers, by default, but it is now disabled by default. It allows traffic from one network to be sent to a different network's broadcast address, in order to broadcast to all IPv4 hosts on the other network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 has done away with broadcast altogether. You must use multicast.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-12T22:23:07.783" LastActivityDate="2016-06-12T22:23:07.783" CommentCount="17" ContentLicense="CC BY-SA 3.0" />
  <row Id="32201" PostTypeId="2" ParentId="29874" CreationDate="2016-06-13T07:54:41.300" Score="2" Body="&lt;p&gt;A CSU/DSU terminates a digital local loop, while a modem terminates an analog local loop. A CSU/DSU converts digital signals from a router to a leased line; a modem converts digital signals from a router to a phone line.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-06-13T07:54:41.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32203" PostTypeId="2" ParentId="28667" CreationDate="2016-06-13T10:31:21.253" Score="2" Body="&lt;p&gt;With later versions of ComWare you can use the default command on an interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/1&#xA;[HP-GigabitEthernet1/0/1]default&#xA;This command will restore the default settings. Continue? [Y/N]:y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It should clear the port back to just &lt;strong&gt;port link-mode bridge&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have an older version of the OS you will need to use the &lt;strong&gt;undo&lt;/strong&gt; command and negate the previous settings as the other guys mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-13T10:31:21.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32205" PostTypeId="2" ParentId="29874" CreationDate="2016-06-13T11:55:04.207" Score="1" Body="&lt;p&gt;Modem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A modem also called as modulator and demodulator, is a device that modulates one or more carrier wave signals to encode digital information for transmission and demodulates signals to decode the transmitted information. The goal is to produce a signal that can be transmitted easily and decoded to reproduce the original digital data. Modems can be used with any means of transmitting analog signals, from light emitting diodes to radio. A common type of modem is one that turns the digital data of a computer into modulated electrical signal for transmission over telephone lines and demodulated by another modem at the receiver side to recover the digital data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CSU/DSU:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A CSU/DSU (Channel Service Unit/Data Service Unit) is a hardware device about the size of an external modem that converts a digital data frame from the communications technology used on a local area network (LAN) into a frame appropriate to a wide-area network (WAN) and vice versa. For example, if you have a Web business from your own home and have leased a digital line (perhaps a T-1 or fractional T-1 line) to a phone company or a gateway at an Internet service provider, you have a CSU/DSU at your end and the phone company or gateway host has a CSU/DSU at its end.&lt;/p&gt;&#xA;" OwnerUserId="25714" LastActivityDate="2016-06-13T11:55:04.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32206" PostTypeId="2" ParentId="29874" CreationDate="2016-06-13T12:20:33.593" Score="2" Body="&lt;p&gt;The purpose of both units is to convert a signal from a form used for local transmission to a form used for long distance transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the old days modems worked by modulating signals onto a carrier and demodulating them at the other end. Interfaces for dedicated data lines generally used digital line coding schemes that didn't involve modulating a carrier. Hence the different terms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However technology marches on and the technical line isn't nearly as clear cut nowadays. Voiceband modems moved away from modulating carriers and towards multi-level digital coding schemes. High rate dedicated lines may use transmission schemes that inovlve modulating multiple carriers to best use the bandwidth/noise profile of the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The convention nowadays seems to be that &quot;Modem&quot; is used for devices that work on lines not primerally intended for data service (cable TV lines, phone lines). The term CSU/DSU is used in conjunction with T1 lines. The terms &quot;transciever&quot; or &quot;media converter&quot; are used for fiber lines.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-06-13T12:20:33.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32207" PostTypeId="1" CreationDate="2016-06-13T13:02:31.160" Score="1" ViewCount="744" Body="&lt;p&gt;I have a doubt.&#xA;I have seen in real time simulation in the packet tracer , where the router sends STP packet to switch.&#xA;Does router really does that and can you explain since STP is for l2 domain only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you in advance,&#xA;Regards,&#xA;Aps&lt;/p&gt;&#xA;" OwnerUserId="27129" LastActivityDate="2016-06-13T13:07:38.660" Title="Does router send STP Packets" Tags="|router|spanning-tree|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32208" PostTypeId="2" ParentId="32207" CreationDate="2016-06-13T13:07:38.660" Score="2" Body="&lt;p&gt;Many routers can be configured as a bridge, with or without a virtual interface, so they run STP.  It is configurable, so you can turn it off if you want.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-13T13:07:38.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32212" PostTypeId="1" AcceptedAnswerId="32213" CreationDate="2016-06-13T16:22:01.900" Score="5" ViewCount="6698" Body="&lt;p&gt;If UDP and/or TCP send packets via IP to an Internet Protocol Address, how can a layer-2 switch forward these?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible or do you need a layer-3 switch?&lt;/p&gt;&#xA;" OwnerUserId="21360" LastEditorUserId="8499" LastEditDate="2020-12-19T20:12:13.967" LastActivityDate="2020-12-19T20:12:13.967" Title="How does a layer-2 switch work with UDP?" Tags="|switch|ethernet|tcp|layer2|udp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32213" PostTypeId="2" ParentId="32212" CreationDate="2016-06-13T16:30:41.860" Score="4" Body="&lt;p&gt;Layer-2 switches are oblivious to anything above layer-2. Layer-2 protocol carry a variety of layer-3 protocols (IPX, IPv4, IPv6, AppleTalk, etc.). The layer-2 switch knows nothing about this; it only sees the layer-2 frame header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-3 protocol can carry a variety of layer-4 protocols (TCP, UDP, etc.). The layer-2 switch would need to strip the layer-2 header to look in the layer-3 packet to see which layer-3 protocol the layer-2 frame is carrying, and it doesn't do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers (layer-3 devices, including layer-3 switches) will strip the layer-2 frame to reveal the layer-3 packet. A router will then switch the layer-3 packet, based on the layer-3 header to a new interface, and create a new layer-2 frame for the new interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A layer-3 switch is really a layer-2 switch, but with a router built in. The routing part of a layer-3 switch only gets involved when a frame is destined to a layer-3 interface in the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit to answer your comment:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An application will send data to UDP, which encapsulates the data into layer-4 datagrams, including a UDP header, which are then sent to IP (either IPv4 or IPv6). IP encapsulates the UDP datagrams inside IP packets, including an IP header. IP sends the packets to ethernet, which encapsulates the IP packets inside ethernet frames, including an ethernet frame header. The ethernet frame header has the source and destination MAC addresses. Your host may not know the MAC address of the destination host. It will look in its ARP cache for the MAC address of the host with the destination IP address. If it is in the ARP cache, it uses that MAC address. If not, it will broadcast an ARP request, asking for the MAC address of the owner of the IP address. The destination host will reply with its MAC address, and the frame is built. The frame is then sent out the physical interface to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next part involves the switch. A switch will build a MAC address table with the MAC address and port. Every time a switch receives a frame on a port, it will update its table with the MAC address and which port that MAC address comes from. When the switch receives a frame from your host, it will look at the destination MAC address, and it will look that up in its MAC address table so that it can deliver the frame to the port where the destination MAC address is. If it can't find that MAC address in its table, it will flood the frame to all ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the destination host receives the frame, it will reverse the encapsulation process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, each layer is independent of the other layers, and the switch knows nothing about IP or UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The process is the same for a destination on a different network, except that your host will use the MAC address of its configured gateway (router, including the routing part of a layer-3 switch). The router will strip the frame, look at the packet, switch the packet to a different network interface, and build a new frame for the new interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-13T17:17:20.750" LastActivityDate="2016-06-13T17:17:20.750" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32214" PostTypeId="2" ParentId="32212" CreationDate="2016-06-13T16:32:35.357" Score="1" Body="&lt;p&gt;First of all, UDP and TCP are L4 terms, they exist on L4 on OSI model. If you have a L2 switch, no matter what you want to transmit, packet will be forwarded to it destination if the has a valid path, i guess a correct gateway or traffic to another pc in your LAN, no matter if they are UDP or TCP&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-06-13T16:32:35.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32218" PostTypeId="1" AcceptedAnswerId="32227" CreationDate="2016-06-13T19:39:31.680" Score="1" ViewCount="667" Body="&lt;p&gt;I recently set up a small business network, and am constantly learning more about how networking hardware works. It is my understanding that a Layer 2 device (Dell 48 port managed switch in this case) will switch traffic based on Mac Address once it learns which devices live down each port. This way not every device in the network sees every packet (obviously broadcast and multicast can be exceptions to this). In this case, I have a Dell SonicWall router connected to the switch serving DHCP. On the SonicWall there is a packet monitor feature that lets you watch for packets originating from or going to a specific IP. If I ping one computer from another computer, both connected directly to the switch, I assumed the router shouldn't be able to see the traffic. However, the packet monitor can see each ping as it happens. How is this possible? All of the traffic in the switch can't be piped back down to the router. The switch as a 100+ gbps backplane and the router is connected over a single gigabit port. Networks would never work if every packet had to be forwarded to the router first.&lt;/p&gt;&#xA;" OwnerUserId="27136" LastActivityDate="2016-06-14T04:20:48.137" Title="How does a router monitor traffic between two devices on a switch" Tags="|switch|monitoring|dell|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32222" PostTypeId="1" AcceptedAnswerId="32228" CreationDate="2016-06-13T23:20:57.127" Score="1" ViewCount="109" Body="&lt;p&gt;Let me first begin by saying I've looked around, and I haven't found a question asked that pertains to this situation exactly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially my question is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to allow subnet &lt;code&gt;S1&lt;/code&gt;to access data from subnet &lt;code&gt;S2&lt;/code&gt;, while preventing &lt;code&gt;S2&lt;/code&gt; from accessing data on &lt;code&gt;S1&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For further information, let's say that both subnets are a part of Network &lt;code&gt;N1&lt;/code&gt;, and that &lt;code&gt;S1&lt;/code&gt; is a staff subnet, while &lt;code&gt;S2&lt;/code&gt; is a student subnet. In this case, we want the teachers to be able to access data on the student computers without allowing the reverse to happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible?  If so, how would you go about accomplishing it?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's any confusion, feel free to let me know so I can alleviate it!&lt;/p&gt;&#xA;" OwnerUserId="27141" LastEditorUserId="8499" LastEditDate="2018-12-27T02:48:59.470" LastActivityDate="2018-12-27T02:48:59.470" Title="Unidirectional Subnet Communication" Tags="|firewall|subnet|security|network-access|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32224" PostTypeId="2" ParentId="32222" CreationDate="2016-06-14T00:18:33.620" Score="1" Body="&lt;p&gt;That is the sort of thing firewalls do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of examples:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Users on a network can access resources on the Internet, but Internet&#xA;users can't access the network.&lt;/li&gt;&#xA;&lt;li&gt;Test labs are done this way, so that the lab cannot damage the&#xA;production network, but the testers on the production network can run&#xA;things in the lab.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Just separate the two networks with a firewall, and set up the  firewall rules to allow, or not, traffic in the manner you choose.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-14T00:18:33.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32226" PostTypeId="1" AcceptedAnswerId="32229" CreationDate="2016-06-14T00:47:57.233" Score="2" ViewCount="76" Body="&lt;p&gt;When setting policy on an SMC with reference to &lt;em&gt;Location Awareness - &gt; Latency-based location awareness -&gt; Optimize over adapters specified below if latency to SteelHead is more than: &amp;lt;#&gt; ms&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Should the time be tested w/ traceroute from the slowest location to&#xA;the SMC?&lt;/li&gt;&#xA;&lt;li&gt;If not, how should the threshold time in milliseconds be&#xA;determined?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Right now, PCs with the SMC software installed are typically in locations where traceroute hops take &gt;250ms to reach the SMC, yet the &lt;em&gt;Optimize over adapters specified below if latency to SteelHead is more than&lt;/em&gt; setting is set to 10ms. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While this might not otherwise present a problem if it were possible to create a policy only optimizing wired adpaters using  &lt;em&gt;Adapters to Optimize&lt;/em&gt;, the client PCs are often in an office w/ a Steelhead (and where pings and hops take &gt;250ms to reach the SMC) but where creating a rule that would not apply to wireless adapters is impossible because the office lacks reliable wiring. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It therefore seems that the only current recourse is to change the &lt;em&gt;Optimize over adapters specified below if latency to SteelHead is more than&lt;/em&gt; setting higher than the number of milliseconds it takes to reach the SMC.&lt;/p&gt;&#xA;" OwnerUserId="27146" LastActivityDate="2016-06-14T04:48:31.433" Title="Setting policy on a Steelhead Mobile Controller (SMC) for &quot;Latency-based location awareness&quot;" Tags="|latency|wan-optimizer|riverbed|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32227" PostTypeId="2" ParentId="32218" CreationDate="2016-06-14T04:20:48.137" Score="2" Body="&lt;p&gt;As per &lt;a href=&quot;http://oureverydaylife.com/capture-traffic-sonicwall-31975.html&quot; rel=&quot;nofollow&quot;&gt;this page:&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The SonicWALL Packet Monitor feature allows you to capture and examine&#xA;  network traffic as it &lt;strong&gt;crosses your firewall.&lt;/strong&gt; When activated,&#xA;  Packet Monitor logs the details of packets as they &lt;strong&gt;pass through the&#xA;  device&lt;/strong&gt;, recording data such as the packet's origin, destination and&#xA;  port number. This in turn can help you to gain information about the&#xA;  conditions on your network and identify potential threats.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Given that you're using a layer 2 switch I'd say the two PCs your pinging between are on different layer 3 networks and therefore need to send their data to the SonicWall which is then performing the routing between the networks and monitoring the traffic at the same time.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-06-14T04:20:48.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32228" PostTypeId="2" ParentId="32222" CreationDate="2016-06-14T04:28:30.393" Score="1" Body="&lt;p&gt;Yes, this is possible. You need a device (e.g router, firewall, virtual appliance, etc) that does &lt;a href=&quot;https://en.wikipedia.org/wiki/Stateful_firewall&quot; rel=&quot;nofollow&quot;&gt;stateful firewalling&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way in which it works is that it watches traffic that flows from the &quot;trusted&quot; zone to the &quot;untrusted&quot; zone. When &quot;untrusted&quot; devices send traffic in response to &quot;trusted&quot; devices, the firewall will let the traffic through. However, if &quot;untrusted&quot; devices try to initiate a connection to &quot;trusted&quot; devices, the firewall will block it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wrote a &lt;a href=&quot;http://www.oznetnerd.com/2010/04/18/cbac-action-part-2/&quot; rel=&quot;nofollow&quot;&gt;blog post&lt;/a&gt; about this some time ago which demonstrated how stateful packet inspection (SPI) works.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-06-14T04:28:30.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32229" PostTypeId="2" ParentId="32226" CreationDate="2016-06-14T04:48:31.433" Score="1" Body="&lt;p&gt;I believe you are confusing which part of the Steelhead infrastructure that setting refers to. The latency that is mentioned in that setting is between your client PC (with Steelhead mobile) and the local Steelhead, not the SMC. The idea is that with a latency under 10ms you have a high likelihood of being on the same branch location as the Steelhead, so it makes sense to activate the location-aware optimizing, and thus to offload optimization to the Steelhead rather than doing it alone on the client PC (it is also possible to combine both).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the default 10ms setting makes good sense on typical wired/wireless LANs, it may even be a little high in some environments.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-06-14T04:48:31.433" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32230" PostTypeId="1" AcceptedAnswerId="32249" CreationDate="2016-06-14T05:54:53.953" Score="1" ViewCount="161" Body="&lt;p&gt;So I was understanding how inter-vlan routing happens using L3 switches (using the c3650 series) and came across something I couldn't find solid information on (or I don't know how to search for it). &#xA;I was trying to do inter vlan routing between 3 switches. I created two SVIs to represent hosts and assigned them to VLAN 10 and 20 respectively. Without using the ip-routing command, I was able to ping SVIs belonging to different VLANs on different switches! All the switches were configured with VLAN 10 and 20 but what I didn't understand is how they were able to contact each other without the routing functionality enabled! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we do RoaS, we have a router that does the routing function for us. But when it comes to an L3 switch, without enabling ip routing, how is it routing between the two SVIs? They're part of two different subnets! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had heard that this phenomenon was only because SVIs are internal to the switch and hence there's no egress ingress traffic to need routing. On enabling debugging, I came across the term &quot;LOCAL CLUSTER&quot; and on searching about it, couldn't exactly find the solution I was looking for but I feel it might have something to do with this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be much appreciated! Thanks in advance. &lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2016-06-14T14:39:25.897" Title="Local clustering with SVIs" Tags="|cisco|vlan|switching|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32231" PostTypeId="1" AcceptedAnswerId="32232" CreationDate="2016-06-14T06:05:31.987" Score="1" ViewCount="14597" Body="&lt;p&gt;It seems TCP is quite a reliable service with error checking, end-to-end delivery assurance etc/, while UDP is a connectionless unreliable service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In what occasion would application engineers use UDP over TCP?&lt;/p&gt;&#xA;" OwnerUserId="24256" LastEditorUserId="8499" LastEditDate="2016-12-19T00:13:55.137" LastActivityDate="2017-11-14T11:02:10.907" Title="When would one use UDP over TCP?" Tags="|tcp|udp|layer4|" AnswerCount="6" CommentCount="2" ClosedDate="2018-05-17T01:54:22.813" ContentLicense="CC BY-SA 3.0" />
  <row Id="32232" PostTypeId="2" ParentId="32231" CreationDate="2016-06-14T06:47:56.360" Score="8" Body="&lt;p&gt;This is a frequently asked question. The answer below is one of the best answers from another site.&#xA;&lt;a href=&quot;https://stackoverflow.com/questions/1099672/when-is-it-appropriate-to-use-udp-instead-of-tcp&quot;&gt;https://stackoverflow.com/questions/1099672/when-is-it-appropriate-to-use-udp-instead-of-tcp&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In situations where you really want to get a simple answer to another&#xA;  server quickly, UDP works best. In general, you want the answer to be&#xA;  in one response packet, and you are prepared to implement your own&#xA;  protocol for reliability or to resend. DNS is the perfect description&#xA;  of this use case. The costs of connection setups are way too high&#xA;  (yet, DNS does support a TCP mode as well).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Another case is when you are delivering data that can be lost because&#xA;  newer data coming in will replace that previous data/state. Weather&#xA;  data, video streaming, a stock quotation service (not used for actual&#xA;  trading), or gaming data comes to mind.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Another case is when you are managing a tremendous amount of state and&#xA;  you want to avoid using TCP because the OS cannot handle that many&#xA;  sessions. This is a rare case today. In fact, there are now user-land&#xA;  TCP stacks that can be used so that the application writer may have&#xA;  finer grained control over the resources needed for that TCP state.&#xA;  Prior to 2003, UDP was really the only game in town.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;One other case is for multicast traffic. UDP can be multicasted to&#xA;  multiple hosts whereas TCP cannot do this at all.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="24890" LastEditorUserId="16930" LastEditDate="2017-11-13T13:42:21.143" LastActivityDate="2017-11-13T13:42:21.143" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32235" PostTypeId="2" ParentId="32230" CreationDate="2016-06-14T07:35:47.390" Score="1" Body="&lt;p&gt;I guess you have pinged them from the switch. &#xA;It works like that because when the source IP address is not specified the device sets it to the port's IP address. &#xA;When you have couple SVIs, you have a number of IP addresses to choose from. That's why you are able to ping / connect to the switches in the different VLANs (As long as you have an SVI which belongs to that subnet) You do not need a routing because you are moving around the same subnets. The source IPs are changing depending on the subnet you want to connect to. &lt;/p&gt;&#xA;" OwnerUserId="22574" LastActivityDate="2016-06-14T07:35:47.390" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32236" PostTypeId="2" ParentId="32188" CreationDate="2016-06-14T08:00:38.727" Score="0" Body="&lt;p&gt;It's to tunnel traffic through DNS packets to your router and then onwards to its real destination. It can allow you to use paid access points without actually paying.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-06-14T08:00:38.727" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32237" PostTypeId="2" ParentId="32231" CreationDate="2016-06-14T08:03:34.400" Score="3" Body="&lt;p&gt;The answer is as simple as it can get:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;speed&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;TCP&lt;/code&gt;, due to its connection establishing and error checking mechanism is considered a slow protocol (although reliable). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While &lt;code&gt;UDP&lt;/code&gt; does not have all those time consuming mechanisms and so it is much faster, not reliable but fast. He just streams out the data and does not really care about the receiver getting the whole message or not. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is actually a trade off, &lt;strong&gt;speed&lt;/strong&gt; over &lt;strong&gt;reliability&lt;/strong&gt;, sometimes you need quick data transmission and you don't care about loosing some packets in the process, like &lt;em&gt;live chat&lt;/em&gt; and &lt;em&gt;video streaming&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But sometimes (of course) you need a reliable data transmission for your purpose, something that makes sure the receiver gets the whole message, however a little bit later. Like sending &lt;em&gt;email&lt;/em&gt; or &lt;em&gt;chatting&lt;/em&gt; in chat-rooms.&lt;/p&gt;&#xA;" OwnerUserId="21926" LastActivityDate="2016-06-14T08:03:34.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32244" PostTypeId="2" ParentId="25978" CreationDate="2016-06-14T11:38:37.600" Score="2" Body="&lt;p&gt;Python 3 is your friend:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;import sys&#xA;import ipaddress&#xA;&#xA;ip6 = ipaddress.ip_address(sys.argv[1]).exploded.replace (':','')&#xA;&#xA;&quot;.&quot;.join([str(int(ip6[index:index+2], 16)) for index in range(0,len(ip6), 2)])&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27159" LastEditorUserId="10323" LastEditDate="2016-06-15T19:43:12.930" LastActivityDate="2016-06-15T19:43:12.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32245" PostTypeId="1" CreationDate="2016-06-14T12:36:25.547" Score="1" ViewCount="836" Body="&lt;p&gt;I have this network, and I need to configure NAT in order to give Internet access to computers in VLANs 11 and 12. When I test connectivity from computers to two public IP addresses of ISP, routers 1.1.1.1 and 2.2.2.1 display the &lt;code&gt;Request timed out.&lt;/code&gt; message. Packets go to the ISP1 router but never come back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are my commands so far:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#interface serial 0/0/0&#xA;R1(config-if)#ip nat inside&#xA;R1(config-if)#exit&#xA;R1(config)#ip nat inside source static 1.1.1.2 1.1.1.1&#xA;R1(config)#ip route 0.0.0.0 0.0.0.0 1.1.1.1&#xA;R1(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ISP1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP1(config)#interface serial 0/0/0&#xA;ISP1(config-if)#ip nat outside&#xA;ISP1(config-if)#exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;show ip nat translations&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip nat translations &#xA;Pro  Inside global     Inside local       Outside local      Outside global&#xA;---  1.1.1.1           1.1.1.2            ---                ---&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 show ip route&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area&#xA;       * - candidate default, U - per-user static route, o - ODR&#xA;       P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 1.1.1.1 to network 0.0.0.0&#xA;&#xA;     1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;C       1.1.1.0/30 is directly connected, Serial0/0/0&#xA;L       1.1.1.2/32 is directly connected, Serial0/0/0&#xA;     2.0.0.0/30 is subnetted, 1 subnets&#xA;O       2.2.2.0/30 [110/66] via 10.1.11.2, 10:08:42, GigabitEthernet0/0&#xA;                   [110/66] via 10.1.12.2, 10:08:42, GigabitEthernet0/1&#xA;     10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks&#xA;C       10.1.11.0/24 is directly connected, GigabitEthernet0/0&#xA;L       10.1.11.1/32 is directly connected, GigabitEthernet0/0&#xA;C       10.1.12.0/24 is directly connected, GigabitEthernet0/1&#xA;L       10.1.12.1/32 is directly connected, GigabitEthernet0/1&#xA;O       10.2.21.0/24 [110/2] via 10.1.11.2, 10:08:42, GigabitEthernet0/0&#xA;O       10.2.22.0/24 [110/2] via 10.1.12.2, 10:08:42, GigabitEthernet0/1&#xA;S*   0.0.0.0/0 [1/0] via 1.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ISP1 show ip route&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP1#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area&#xA;       * - candidate default, U - per-user static route, o - ODR&#xA;       P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     1.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;C       1.1.1.0/30 is directly connected, Serial0/0/0&#xA;L       1.1.1.1/32 is directly connected, Serial0/0/0&#xA;     2.0.0.0/30 is subnetted, 1 subnets&#xA;O       2.2.2.0/30 [110/130] via 1.1.1.2, 00:29:20, Serial0/0/0&#xA;     10.0.0.0/24 is subnetted, 4 subnets&#xA;O       10.1.11.0/24 [110/65] via 1.1.1.2, 00:29:20, Serial0/0/0&#xA;O       10.1.12.0/24 [110/65] via 1.1.1.2, 00:29:20, Serial0/0/0&#xA;O       10.2.21.0/24 [110/66] via 1.1.1.2, 00:29:20, Serial0/0/0&#xA;O       10.2.22.0/24 [110/66] via 1.1.1.2, 00:29:20, Serial0/0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm kinda noob into networking, so I don't know what any other information I should provide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/X0Bbr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/X0Bbr.png&quot; alt=&quot;Network im working on&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27160" LastEditorUserId="8499" LastEditDate="2016-06-14T14:07:25.343" LastActivityDate="2016-06-14T14:36:50.087" Title="Static NAT doesnt work. Getting the &quot;Request timed out.&quot; message" Tags="|cisco|routing|nat|ospf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32247" PostTypeId="1" AcceptedAnswerId="32250" CreationDate="2016-06-14T13:00:28.960" Score="3" ViewCount="3882" Body="&lt;p&gt;As what I know, an open TCP scan is just a normal TCP 3-way handshake followed by RST. It is detectable because the target will log this connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the half-open TCP scan, it is defined as &quot;stealth&quot;. The explanation is that &lt;strong&gt;only a SYN packet&lt;/strong&gt; is sent, which is also a 3-way handshake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But these two seems same. I do not find what are the true difference?&lt;/p&gt;&#xA;" OwnerUserId="22125" LastActivityDate="2017-01-26T10:22:59.867" Title="what is the difference between open TCP scan and half-open (stealth) TCP scan?" Tags="|tcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32248" PostTypeId="2" ParentId="32231" CreationDate="2016-06-14T13:08:53.417" Score="0" Body="&lt;p&gt;one increasingly common reason is to use udp to wrap a new transport that can be distributed without operating system permission. QUIC is an example of this, as is SCTP over UDP ala webrtc. Tunnels/VPN also work this way, because you don't want to tunnel TCP in TCP as two layers of flow and congestion control interact poorly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Native application use of UDP might make sense, in addition to the reasons cited above, when you desire out of order delivery (i.e. avoiding head of line blocking that TCP imposes because it delivers in order).&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-06-14T13:08:53.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32249" PostTypeId="2" ParentId="32230" CreationDate="2016-06-14T14:20:50.723" Score="0" Body="&lt;p&gt;You need to understand the the layer-3 switches are really layer-2 switches with a virtual router inside. Traffic that comes into a layer-2 ports will still use layer-2 first when traffic is on the same VLAN. That means any ping from VLAN 10 to any address on VLAN 10 will travel via VLAN 10 to the pinged address. The same for VLAN 20. When you ping from VLAN 10 to VLAN 20, your gateway, one of the SVIs on one of the switches, it will place the packet onto VLAN 20, where it will be switched at layer-2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way to connect the routers with routing would be to use layer-3 interfaces. You use the &lt;code&gt;no switchport&lt;/code&gt; command on an interface, and configure that interface like a router interface. Each layer-3 switch would have its own separate set of VLANs, and it doesn't matter if they are the same numbers, they will be separate VLANs. The switches will only be connected via layer-3 interfaces, instead of the layer-2 interface you currently use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just think of it like the layer-3 switches are layer-2 switches with external routers connected to them by the SVIs. That is basically how they work.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-14T14:39:25.897" LastActivityDate="2016-06-14T14:39:25.897" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32250" PostTypeId="2" ParentId="32247" CreationDate="2016-06-14T14:35:20.297" Score="6" Body="&lt;p&gt;This is &lt;em&gt;the initiation&lt;/em&gt; of the 3-way handshake. but the scanner has no intend to complete it. This means it receives the SYN+ACK from the target (now knowing it's there), but never sends the final ACK itself (maintaining stealth). &lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2016-06-14T14:35:20.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32251" PostTypeId="2" ParentId="32245" CreationDate="2016-06-14T14:36:50.087" Score="1" Body="&lt;p&gt;You seem to be confused about how NAT works. You want to translate your network addresses to something else. NAT is configured and only works on a single router. Your ISP router doesn't need, and shouldn't have, any NAT configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT is configured on your local router. You will have both the inside and outside interfaces on R1. The &lt;code&gt;1.1.1.2&lt;/code&gt; interface will be the outside interface, and the &lt;code&gt;10.1.11.1&lt;/code&gt; and &lt;code&gt;10.1.12.1&lt;/code&gt; interfaces will be the inside interfaces. You need to translate the &lt;code&gt;10.1.11.0/24&lt;/code&gt; and &lt;code&gt;10.1.12.0/24&lt;/code&gt; addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also need to be careful with two WAN routers. If you get asymmetric routing (traffic goes out one WAN router, but comes back on the other WAN router), your NAT will break because the two WAN routers do not share a NAT table.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-14T14:36:50.087" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32252" PostTypeId="2" ParentId="25575" CreationDate="2016-06-14T15:35:05.453" Score="0" Body="&lt;p&gt;In the end, it turns out that the third switch had a hardware issue. A replacement was delivered and everything was restored. &lt;/p&gt;&#xA;" OwnerUserId="21709" LastActivityDate="2016-06-14T15:35:05.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32255" PostTypeId="1" CreationDate="2016-06-14T17:23:22.340" Score="1" ViewCount="1146" Body="&lt;p&gt;If you see following diagram we have two separate links (10G) coming from same ISP terminated on &lt;code&gt;ASR 1006&lt;/code&gt; router where we are planning to run BGP. From ASR 1006 two 10G fiber terminated to &lt;code&gt;L3&lt;/code&gt; switch.&lt;/p&gt;&#xA;&lt;p&gt;Notes: I know BGP doesn't make sense with single ISP but in future we have plan to get second ISP but for now we have only single ISP.&lt;/p&gt;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How should i perform failover link using BGP with same ISP?&lt;/li&gt;&#xA;&lt;li&gt;From Router to L3 switch should i create VLAN trunk (L2) and create VLANs on Router instead of L3 switch.&lt;/li&gt;&#xA;&lt;li&gt;Or Should i do &lt;code&gt;HSRP&lt;/code&gt; between Router to L3 switch and create VLANs on L3 switch instead of Router.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;What are the best practice out there for this kind of network?&lt;/p&gt;&#xA;&lt;p&gt;Diagram:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iYLXB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iYLXB.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h1&gt;Update:&lt;/h1&gt;&#xA;&lt;p&gt;Someone suggested run BGP on Internet connectivity but use OSPF for internal routing between Router &amp;lt;---&amp;gt; L3 switch&lt;/p&gt;&#xA;&lt;p&gt;as per above diagram if i plan to configure OSPF between Router and L3 switch then what network i will advertise on OSPF &lt;code&gt;network&lt;/code&gt; command?&lt;/p&gt;&#xA;&lt;p&gt;Example: ISP provided 10.1.1.0/24 subnet to us how do i configure BGP and OSPF for internal network?&lt;/p&gt;&#xA;&lt;p&gt;Any suggestion?&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-06-16T18:34:17.317" Title="Network redundancy design question with BGP" Tags="|cisco|switch|bgp|redundancy|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32257" PostTypeId="1" CreationDate="2016-06-14T18:40:29.313" Score="1" ViewCount="335" Body="&lt;p&gt;so i have a checkpoint firewall and a cisco router , cisco router clock os synchronized via a public NTP server,  as we know,  a route which a ntp client can also relay the ntp information,  will it relay it to checkpoint or any other vendor devices?&lt;/p&gt;&#xA;" OwnerUserId="27170" LastActivityDate="2016-06-14T19:45:37.737" Title="Will a cisco Router relay NTP information to a Checkpoint firewall?" Tags="|cisco|router|firewall|ntp|checkpoint|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32258" PostTypeId="1" CreationDate="2016-06-14T19:02:03.710" Score="0" ViewCount="46" Body="&lt;p&gt;I have a co-working space where there are around 50 devices that needs to be connected to a WiFi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The setup that I have now&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I am using 4 connections from different ISPs with varying bandwidth.&lt;/li&gt;&#xA;&lt;li&gt;All of these connections are connected as WAN to my &lt;a href=&quot;http://www.amazon.in/TP-Link-TL-R480T-Balance-Broadband-Router/dp/B0019MGNUY/ref=sr_1_1?s=computers&amp;amp;ie=UTF8&amp;amp;qid=1465930303&amp;amp;sr=1-1&amp;amp;keywords=TL-R480T%2B&quot; rel=&quot;nofollow&quot;&gt;TP-Link TL-R480T+ Load Balancer&lt;/a&gt;, which then gives me the aggregated bandwidth.&lt;/li&gt;&#xA;&lt;li&gt;The output of the Load Balancer then goes to an unmanaged ethernet switch&lt;/li&gt;&#xA;&lt;li&gt;Then from the switch, I am connecting 2 &lt;a href=&quot;http://www.amazon.in/Ubiquiti-UniFi-Enterprise-System-Range/dp/B00HXT8S9G/ref=sr_1_1?ie=UTF8&amp;amp;qid=1465930436&amp;amp;sr=8-1&amp;amp;keywords=unifi&quot; rel=&quot;nofollow&quot;&gt;UniFi AP LR&lt;/a&gt; access points to distribute the internet connection.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This works fine till 30-35 devices, but becomes very slow beyond that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to me, the Load Balancer is the bottleneck. I am not sure though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to support more than 50 devices. How can I do that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I need the load balancer to combine all my internet connections. If you are suggesting to replace that, please give an alternative that can combine 4 or more WAN connections.&lt;/p&gt;&#xA;" OwnerUserId="27171" LastActivityDate="2016-06-14T20:34:26.747" Title="Supporting 100+ WiFi Devices at a time" Tags="|load-balancer|" AnswerCount="1" CommentCount="3" ClosedDate="2019-03-09T03:33:54.583" ContentLicense="CC BY-SA 3.0" />
  <row Id="32259" PostTypeId="2" ParentId="32257" CreationDate="2016-06-14T19:45:37.737" Score="1" Body="&lt;p&gt;You have it slightly backwards actually. The NTP source, such as your router, doesn't actively relay anything of its own initiative. It can however act as a time server for other devices, and it doesn't care whether said devices are Cisco, Checkpoint, or whatever so long as they present themselves as well-behaved standards-compliant NTP clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need to activate the NTP server functionality through a command such as :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ntp master [stratum]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The stratum is usually one more than the stratum of the time server your router is getting its NTP information from.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-06-14T19:45:37.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32260" PostTypeId="1" AcceptedAnswerId="32395" CreationDate="2016-06-14T20:28:16.863" Score="1" ViewCount="94" Body="&lt;p&gt;We have a Dell N2024 switch stack on the other side of the planet. Our ISP has assigned us a /30 routing network where they have &lt;code&gt;.165&lt;/code&gt; and we have &lt;code&gt;.166&lt;/code&gt;. Currently &lt;code&gt;.166&lt;/code&gt; is assigned to a server, attached to the switch. I want to move the &lt;code&gt;.166&lt;/code&gt; IP address to the switch itself by assigning it to a vlan, and changing the server's IP to something else from a different subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem of course is that the script is run via a console into the switch which passes through the &lt;code&gt;.166&lt;/code&gt; machine whose IP I want to swap out! I have a script which works great on a staging system, if I were attached by the serial port there would be no issue. But I tried running the script via ssh in the hope that it would continue to run regardless of whether the console was still attached or not, but sadly it doesn't, and the script aborted at the point where I shut down the ports to the current &lt;code&gt;.166&lt;/code&gt; machine. A manual reset by staff at the other end took care of that, but I am now back to square one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The part of the script that is creating the problem is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ! disable GFW bond 2 ports to avoid IP address clash&#xA; interface range Gi1/0/03, Gi2/0/03&#xA; shutdown&#xA; exit&#xA;&#xA; ! create router IP address on router VLAN on old GFW bond2 address&#xA; interface vlan 4010&#xA; ip address xxx.xxx.xxx.166 255.255.255.252&#xA; exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does anyone know of a way to execute &lt;code&gt;script apply&lt;/code&gt; in some way independent of the console, e.g. an equivalent to &lt;code&gt;script apply &amp;gt; /dev/null&lt;/code&gt; or by creating a timer or some other one-shot mechanism that can execute the script outside of the console context?&lt;/p&gt;&#xA;" OwnerUserId="23055" LastEditorUserId="23055" LastEditDate="2016-06-14T20:49:22.623" LastActivityDate="2017-02-15T16:45:50.627" Title="Dell N2000: 'script apply' without a console?" Tags="|dell|powerconnect|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32261" PostTypeId="2" ParentId="32258" CreationDate="2016-06-14T20:34:26.747" Score="1" Body="&lt;p&gt;It could be the load balancer or several other things:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most APs slow down with more than 20 clients.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It could be channel contention.  Make sure you have disabled low&#xA;speeds (1-11Mbps) on each AP.&lt;/li&gt;&#xA;&lt;li&gt;It could be co-channel interference.  Make sure the APs are on&#xA;different channels.&lt;/li&gt;&#xA;&lt;li&gt;It could be that clients are not distributed evenly between APs. &#xA;Hard to fix that one without a wireless controller.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-14T20:34:26.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32262" PostTypeId="2" ParentId="16923" CreationDate="2016-06-14T20:46:51.203" Score="1" Body="&lt;p&gt;The answer is yes. This white paper describes how to use ACLs and routing maps handle inter-VLAN traffic in a more secure way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.dell.com/learn/us/en/04/shared-content~data-sheets~en/documents~dell_networking_n_series_policy_based_routing_pbr.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.dell.com/learn/us/en/04/shared-content~data-sheets~en/documents~dell_networking_n_series_policy_based_routing_pbr.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23055" LastActivityDate="2016-06-14T20:46:51.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32266" PostTypeId="1" AcceptedAnswerId="32278" CreationDate="2016-06-14T22:56:31.767" Score="3" ViewCount="13472" Body="&lt;p&gt;I am completely new to network management (I'm just a linux sysadmin, myself), and have no idea at all how to set up this thing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not for a production environment, I'm just using it for my home network (as I got it as a gift and I gladly took it :P) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've already got console access and everything (via telnet, e.g. &lt;code&gt;telnet 10.0.0.1&lt;/code&gt; etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help, please?&lt;/p&gt;&#xA;" OwnerUserId="27181" LastActivityDate="2016-06-15T08:15:36.680" Title="How do I set up a Catalyst 2960 as a dumb switch?" Tags="|cisco|switch|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32267" PostTypeId="2" ParentId="32255" CreationDate="2016-06-14T22:57:11.713" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;How should i perform failover link using BGP with same ISP?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Form the BGP neighborship loopback interface. As per &lt;a href=&quot;https://supportforums.cisco.com/discussion/10090936/bgp-neighbor-do-you-use-loopback-or-physical-interface&quot; rel=&quot;nofollow&quot;&gt;this thread&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The use of a loopback interface ensures that the neighbor stays up and is not affected by malfunctioning hardware, the main benefit from using loopbacks is that it will not bring down the BGP session when there are multiple paths between the BGP peers, which would otherwise result in tearing down the BGP session if the physical interface used for establishing the session goes down. In addition to that, it also allows the routers running BGP with multiple links between them to load balance over the available paths.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;From Router to L3 switch should i create VLAN trunk (L2) and create VLANs on Router instead of L3 switch.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. This is called router on a stick and was popular before L3 switches were widely available. However, now that they are widely available, you should use the router to connect to the WAN and use the L3 switch to handle inter-vlan traffic on the LAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing this means that if the router fails your inter-vlan traffic will still work. Also, if you add additional routers to the topology at a later date, the switch will be able to use both of them for outbound traffic as opposed to only using your current one.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;3&quot;&gt;&#xA;  &lt;li&gt;Or Should i do HSRP between Router to L3 switch and create VLANs on L3 switch instead of Router.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, do not configure HSRP between the router and switch. You should instead configure HSRP between the two L3 switches so that if one fails, the other can take over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; In response to your comment:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;i heard from many source it used for iBGP not for eBGP&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is another quote from the thread I linked to above:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;iBGP generally peers using the loopback address for the reasons mentioned by Mohamed (i.e. loopback interface always stays up therefore the iBGP session stays up as long as the IGP has a path to get to the loopback interface of the peer router).&#xA;eBGP commonly peers using the physical interface as there is generally only one path between the two eBGP peers. Although the loopback interface is sometimes used between eBGP peers to achieved load-balancing when more than one circuit link the two eBGP peers.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, loopback interfaces can be used for both iBGP and eBGP. As you have two connections to the one ISP, you should use a loopback interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In regards to your other comment:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;what should i use to provide redundancy/failover between Router and L3&#xA;  switch?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you've only got one router you simply can't have redundancy at the router level. If you want redundancy at the router level you'll need to purchase another router. In regards to switch redundancy, as I mentioned above you can attain this by implementing HSRP between the switches.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2016-06-15T03:44:52.350" LastActivityDate="2016-06-15T03:44:52.350" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32269" PostTypeId="1" AcceptedAnswerId="32271" CreationDate="2016-06-15T02:09:25.993" Score="1" ViewCount="1069" Body="&lt;p&gt;Is there a way to have &lt;a href=&quot;https://developer.apple.com/library/ios/documentation/NetworkingInternetWeb/Conceptual/NetworkingOverview/UnderstandingandPreparingfortheIPv6Transition/UnderstandingandPreparingfortheIPv6Transition.html#//apple_ref/doc/uid/TP40010220-CH213-SW16&quot; rel=&quot;nofollow&quot;&gt;this option proposed by Apple&lt;/a&gt; available in Windows? I want to test connecting an IPv6-only client to an IPv4-only server on a local environment.&lt;/p&gt;&#xA;" OwnerUserId="2426" LastActivityDate="2016-06-15T02:39:00.650" Title="DNS64/NAT64 WiFi hotspot using Windows" Tags="|ipv4|ipv6|" AnswerCount="1" CommentCount="1" ClosedDate="2016-06-15T20:57:46.737" ContentLicense="CC BY-SA 3.0" />
  <row Id="32270" PostTypeId="2" ParentId="32194" CreationDate="2016-06-15T02:32:03.220" Score="3" Body="&lt;p&gt;You use it both every time you send an IP broadcast message. For example a broadcast message lets say looking for a DHCP server in network 192.168.0.0/24 the broadcast address would be 192.168.0.255 and by sending it to that address you also need to send it to the FF:FF:FF:FF:FF:FF in order to find all the ip addresses in that range. if  you do not already have communication with any of the hosts in the network range.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-06-15T02:32:03.220" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32271" PostTypeId="2" ParentId="32269" CreationDate="2016-06-15T02:39:00.650" Score="0" Body="&lt;p&gt;Since their &quot;plan&quot; is to create your own NAT64 network, of course. The difference, however, is that Apple builds this &lt;em&gt;hack&lt;/em&gt; into their OS. To my knowledge, Microsoft has not. But that doesn't stop you from building NAT64 with whatever system/applications/technology available to you.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-06-15T02:39:00.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32272" PostTypeId="1" AcceptedAnswerId="32283" CreationDate="2016-06-15T03:21:30.400" Score="2" ViewCount="3520" Body="&lt;p&gt;We have 4x1G &lt;code&gt;Etherchannel&lt;/code&gt; on trunk and for troubleshooting i want to monitor one of its physical port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can i monitor using &lt;code&gt;SPAN&lt;/code&gt; port &lt;code&gt;mirror&lt;/code&gt; and configure its physical port for source SPAN?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Group: 99&#xA;----------&#xA;        Port-channels in the group:&#xA;        ---------------------------&#xA;&#xA;Port-channel: Po99    (Primary Aggregator)&#xA;&#xA;------------&#xA;&#xA;Age of the Port-channel   = 8d:08h:08m:05s&#xA;Logical slot/port   = 12/99          Number of ports = 4&#xA;HotStandBy port = null&#xA;Port state          = Port-channel Ag-Inuse&#xA;Protocol            =   LACP&#xA;Port security       = Disabled&#xA;&#xA;Ports in the Port-channel:&#xA;&#xA;Index   Load   Port     EC state        No of bits&#xA;------+------+------+------------------+-----------&#xA;  0     00     Gi2/0/1  Active             0&#xA;  0     00     Gi2/0/2  Active             0&#xA;  0     00     Gi2/0/3  Active             0&#xA;  0     00     Gi2/0/4  Active             0&#xA;&#xA;Time since last port bundled:    8d:08h:07m:53s    Gi2/0/4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-06-15T12:49:27.290" Title="Etherchannel physical port SPAN mirror" Tags="|cisco|switch|etherchannel|mirror|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32273" PostTypeId="2" ParentId="32266" CreationDate="2016-06-15T03:42:39.260" Score="0" Body="&lt;p&gt;Turn off routing and create two Vlans.  Set vlan 1 to be untagged on which ever ports you want, and vlan2 untagged on the other ports.  The two vlans will stay seperate and the untagged directive means that whatever you plug into that port just goes to that vlan. 2960 switch is already pretty low on the IQ scale. Create the VLANs, disable trunking and put the ports in the VLAN you want them in. That's as simple as it gets.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-06-15T03:42:39.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32277" PostTypeId="1" AcceptedAnswerId="32289" CreationDate="2016-06-15T07:00:11.930" Score="1" ViewCount="3261" Body="&lt;p&gt;I have created an channel group with LACP, I know that single TCP session will be sent over a single line. My hashing algorithm is set to source mac address.&#xA;So how can I be sure that the bandwidths of member links are summed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPD: Our friend suggests to say, that tweaking hashing algorithm on a live production is not a good idea, you can break something.&lt;/p&gt;&#xA;" OwnerUserId="19133" LastEditorUserId="19133" LastEditDate="2016-06-16T07:59:13.567" LastActivityDate="2017-08-10T04:07:39.443" Title="What iperf flags should I use to test link LACP bond total speed" Tags="|ieee-802.1ax|iperf|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32278" PostTypeId="2" ParentId="32266" CreationDate="2016-06-15T08:15:36.680" Score="2" Body="&lt;p&gt;You do not need to do anything. If the switch has no config setup, all of its ports will be in VLAN1 and the device will act as a typical unmanaged switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If some config exists, then you need to reset it to the defaults or just check if all of the ports are in the same VLAN and if they are setup as an access ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the guide on how to reset the switch to the defaults:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-2900-xl-series-switches/24328-156.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-2900-xl-series-switches/24328-156.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards! &lt;/p&gt;&#xA;" OwnerUserId="22574" LastActivityDate="2016-06-15T08:15:36.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32279" PostTypeId="1" CreationDate="2016-06-15T08:28:52.987" Score="0" ViewCount="36" Body="&lt;p&gt;I am creating a cluster setup on virtual boxes. I have Ubuntu 14.4 installed in all systems. Both the systems are having virtual box installed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have changed the ip-address to static on both virtual boxes. In the virtual box setting i have made bridge network on the virtual box default setting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now i am able to ping local machine from the virtual box on which it is installed. But not getting connection with the other machine or other machine's virtual box. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JOcCc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JOcCc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help please..&lt;/p&gt;&#xA;" OwnerUserId="27191" LastActivityDate="2016-06-15T08:37:19.163" Title="virtual box to other virtual box connectivity issue" Tags="|troubleshooting|" AnswerCount="1" CommentCount="1" ClosedDate="2016-06-15T20:58:17.440" ContentLicense="CC BY-SA 3.0" />
  <row Id="32280" PostTypeId="2" ParentId="32279" CreationDate="2016-06-15T08:37:19.163" Score="2" Body="&lt;p&gt;Did you change the mac addresses for the networks cards for those two virtual box machines? I mean... are those addresses different? That may cause problems.&#xA;Bridge connection is the same as direct connection to the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a switch in between? How do you connect those two computers?&#xA;If there's a switch be sure that there's no security policy that allows only 1 mac address on a port. That can also be the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="22574" LastActivityDate="2016-06-15T08:37:19.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32281" PostTypeId="2" ParentId="32277" CreationDate="2016-06-15T11:45:14.400" Score="0" Body="&lt;p&gt;The easiest way would be to set up a VM and then run iperf on your PC as well as the VM. Doing this ensures you have two hosts with different MAC addresses. &lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-06-15T11:45:14.400" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32282" PostTypeId="2" ParentId="32231" CreationDate="2016-06-15T12:23:19.230" Score="-1" Body="&lt;p&gt;In fact, both TCP and UDP are necessary to design of good network comms. They each do one job well. Because of the separation of comms into discrete tasks, testing and debugging is much easier &lt;/p&gt;&#xA;" OwnerUserId="27194" LastActivityDate="2016-06-15T12:23:19.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32283" PostTypeId="2" ParentId="32272" CreationDate="2016-06-15T12:49:27.290" Score="2" Body="&lt;p&gt;That is what I've found:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can You Configure SPAN on an EtherChannel Port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An EtherChannel does not form if one of the ports in the bundle is a SPAN destination port. If you try to configure SPAN in this situation, the switch tells you:&#xA;        Channel port cannot be a Monitor Destination Port &#xA;        Failed to configure span feature &#xA;        You can use a port in an EtherChannel bundle as a SPAN source port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html#anc63&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/10570-41.html#anc63&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22574" LastActivityDate="2016-06-15T12:49:27.290" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32284" PostTypeId="1" CreationDate="2016-06-15T13:07:53.383" Score="3" ViewCount="4621" Body="&lt;p&gt;I found a document on internet that will give some idea on &lt;a href=&quot;http://blog.ine.com/wp-content/uploads/2011/01/Loop-Prevention-in-OSPF.pdf&quot; rel=&quot;nofollow&quot;&gt;OSPF ABR and Loop Prevention&lt;/a&gt;. In that document, they mention This:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;ABR expects summary LSAs from Area 0 only. This means there should be at least one adjacency in FULL state built over Area 0 interface.&#xA;  In case if ABR has such adjacency, it will ignore summary-LSAs&#xA;  received over non-backbone areas. These LSAs will be installed in the&#xA;  database, but not used for SPF calculations.&lt;/li&gt;&#xA;  &lt;li&gt;ABR will accept and use summary-LSAs learned over non-backbone area if it DOES NOT have a FULL adjacency built over an Area 0&#xA;  interface. It is safe to do so, since the ABR will not be able to&#xA;  flood the summary back into Area 0 creating routing loops.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Can someone give topology that contradicts to point 1? According to my knowledge, in all the cases ABR will establish FULL neighbor relationship to some other &quot;Router&quot; (P2P) or &quot;DR&quot; (Broadcast) in Area0. Why would they specifically mention point 1. Point 2 make sense because of Point 1&lt;/p&gt;&#xA;" OwnerUserId="17153" LastEditorUserId="8499" LastEditDate="2016-06-15T16:04:37.390" LastActivityDate="2018-08-05T07:01:05.647" Title="Inter-Area Loop Prevention in OSPF" Tags="|ospf|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32286" PostTypeId="1" CreationDate="2016-06-15T14:10:39.400" Score="3" ViewCount="9428" Body="&lt;p&gt;I am a little bit confused about one fact. According to the specification, the ethernet frame maximum size is &lt;code&gt;1518&lt;/code&gt; bytes, and the IPv4 packet size Length field in an IPv4 header can be up to &lt;code&gt;65535&lt;/code&gt; bytes.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: how is it possible to have an IP packet maximum length larger than an ethernet frame, as everyone knows IPv4 packets encapsulated into ethernet frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have only one guess is fragmentation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please explain this.&lt;/p&gt;&#xA;" OwnerUserId="27197" LastEditorUserId="8499" LastEditDate="2016-06-15T16:07:37.733" LastActivityDate="2023-02-26T19:01:12.817" Title="Maximum packet size Ethernet Frame and IP packet" Tags="|ethernet|tcp|ip|packet-analysis|osi|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32287" PostTypeId="2" ParentId="32284" CreationDate="2016-06-15T14:16:11.287" Score="0" Body="&lt;p&gt;A non-backbone area should not generate summary LSAs. What number 1 is saying is that any summary LSA coming from a non-backbone area is ignored. An ABR will have at least one interface in Area 0 (backbone), and at least one interface in a non-backbone area. The ABR only uses summary LSAs received from Area 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could have an area, e.g. Area 1, which has multiple ABRs. Area 1 will get summary LSAs from Area 0 through all the ABRs, and the Area 1 routers will send those summary LSAs to all the routers in Area 1, including all the ABRs. Remember, the ABRs have interfaces in Area 1, too, and are Area 1 routers for those interfaces. The ABRs will not use the summary LSAs coming from the Area 1 interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-15T15:21:22.067" LastActivityDate="2016-06-15T15:21:22.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32288" PostTypeId="2" ParentId="32286" CreationDate="2016-06-15T14:21:26.503" Score="4" Body="&lt;p&gt;Your assumption the IPv4 is always encapsulated by ethernet is flawed. Don't confuse the network layers. Ethernet, a layer-2 protocol, can carry any numbers of layer-3 protocols, not only IPv4. On the other hand, IPv4, a layer-3 protocol, can be carried by any number of layer-2 protocols, and it doesn't care which. Some layer-2 protocols on which IPv4 is carried have larger maximum MTU sizes than does ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet and IPv4 were developed and released at about the same time, but by very different groups. It was not obvious at the time that either would end up being the dominant protocol for its network layer. Ethernet is a LAN protocol which was mostly used for IPX, and IPv4 was usually used on WANs to connect large university computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv4 can be fragmented by routers in the path, IPv6 cannot, but it specifies a minimum MTU of 1280. Lately, there is PMTUD which discovers the minimum MTU in a path before sending packets out along the path, so that packet sizes can be adjusted to fit the minimum MTU of the path before being sent.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-15T16:09:56.900" LastActivityDate="2016-06-15T16:09:56.900" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32289" PostTypeId="2" ParentId="32277" CreationDate="2016-06-15T14:42:32.257" Score="-1" Body="&lt;p&gt;Well first of all, if your switch does not support L4 parameters in hashing algorithm, then two hosts will exchange data using the same link.&#xA;If you are using two pairs of hosts to check if the link's bandwidth is doubled then 0.5 probability that each pair will use a separate physical link. Simply change the hashing algorithm parameter on your switch or, add some more host pairs to increase the probability of using separate links.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, u can use -u flag to send out udp segments, but make sure that your clients can reach your servers, even if your server is down, the client will show the bandwidth of outgoing segments that may not reach the server. &lt;/p&gt;&#xA;" OwnerUserId="19133" LastActivityDate="2016-06-15T14:42:32.257" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32290" PostTypeId="2" ParentId="26664" CreationDate="2016-06-15T14:57:23.230" Score="1" Body="&lt;p&gt;i don't think this is an answer for the question regarding the overall name for ipv6 address, but I will say that i've heard of one section of the dotted-decimal/quad of v4 which is octet, I've heard octet equate to ipv6 hextet.  as far as one of the sections of the v6 address... 4 hex characters combined are referred to as a hextet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Hextet&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Hextet&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27198" LastEditorUserId="509" LastEditDate="2016-06-15T19:43:33.853" LastActivityDate="2016-06-15T19:43:33.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32291" PostTypeId="2" ParentId="32286" CreationDate="2016-06-15T15:07:37.410" Score="0" Body="&lt;p&gt;Unless the sender sets the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791#page-8&quot; rel=&quot;nofollow noreferrer&quot;&gt;Don't Fragement&lt;/a&gt; flag, a packet can be fragmented into many Ethernet frames. The recipient assembles the fragments and processes the whole IP packet. No information of the original IP packet will be lost.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-06-15T15:07:37.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32292" PostTypeId="1" CreationDate="2016-06-15T15:29:00.837" Score="4" ViewCount="1078" Body="&lt;p&gt;I need some help. I am new to using Cisco routers (as far as setting them up my self), so forgive me if this is something simple that I am over looking or not understanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a cable internet from cox. They gave the the IP address below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 98.191.**.147 &#xA;DG: 98.191.**.129&#xA;SNM 255.255.255.224&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The IP address is the IP address that will connect the router to the ISP modem. &#xA;On the LAN side, I have the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP address 10.0.4.1&#xA;DG 10.0.4.254&#xA;SNM 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I need to do is take 10.0.4 network and tell it the Internet is at the &lt;code&gt;98.191.**.147&lt;/code&gt; network address, and connect to the Internet that way. I have been watching some YouTube videos on how to do this, but there is something I'm missing, and I cant figure it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what i have thus far :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get no internet connection on the 10 dot network. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show ip interface brief&#xA; Interface IP-Address OK? Method Status Protocol&#xA; FastEthernet0/0 10.0.4.1 YES manual up up&#xA; FastEthernet0/1 98.191.**.147 YES manual up up&#xA; Vlan1 unassigned YES unset administratively down down&#xA; Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;here is the rest...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA;ip address 10.0.4.1 255.255.255.0&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA;ip address 98.191.**.147 255.255.255.224&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface Vlan1&#xA;no ip address&#xA;shutdown&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA;login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA;ip address 10.0.4.1 255.255.255.0&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA;ip address 98.191.**.147 255.255.255.224&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface Vlan1&#xA;no ip address&#xA;shutdown&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA;login&#xA;!&#xA;!&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;    end&lt;/h2&gt;&#xA;&#xA;&lt;h2&gt;Updated Changes&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.0.4.1 255.255.255.0&#xA; ip nat inside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 98.191.**.147 255.255.255.224&#xA; ip nat outside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip nat inside source list 1 interface FastEthernet0/1 overload&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 &#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;access-list 1 permit 10.0.4.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;    end&lt;/h2&gt;&#xA;&#xA;&lt;h2&gt;startup config&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.0.4.1 255.255.255.0&#xA; ip nat inside&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 98.191.**.147 255.255.255.224&#xA; ip nat outside&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip nat inside source list 1 interface FastEthernet0/1 overload&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 FastEthernet0/1 &#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;access-list 1 permit 10.0.4.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;New Update as of 6/17/16&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#&#xA;Router#show running&#xA;Router#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 753 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;resource policy&#xA;!&#xA;mmi polling-interval 60&#xA;no mmi auto-configure&#xA;no mmi pvc&#xA;mmi snmp-timeout 180&#xA;ip subnet-zero&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.0.4.254 255.255.255.0&#xA; ip nat inside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 98.191.**.138 255.255.255.224&#xA; ip nat outside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip classless&#xA;!&#xA;ip http server&#xA;ip nat inside source list 1 interface FastEthernet0/1 overload&#xA;!&#xA;access-list 1 permit 10.0.4.0 0.0.0.255&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA; login&#xA;!&#xA;end&#xA;&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;i can ping 98.191.**.147 and get a 100% success but i try to ping 10.0.4.55 (the other pc) i get a 100% fail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words i get single directional traffic&lt;/p&gt;&#xA;" OwnerUserId="27200" LastEditorUserId="8499" LastEditDate="2019-01-04T20:39:13.097" LastActivityDate="2019-01-04T20:39:13.097" Title="Cisco Router Setup 1841" Tags="|cisco|router|nat|internet|ping|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32293" PostTypeId="2" ParentId="32292" CreationDate="2016-06-15T15:40:31.237" Score="4" Body="&lt;p&gt;Your LAN addressing is private addressing, and you cannot route that to the Internet. You will need to use NAT. You will set up the WAN interface as the &lt;em&gt;outside&lt;/em&gt; interface, and the LAN interface as the &lt;em&gt;inside&lt;/em&gt; interface. You need to then define the translation. Usually, you want the source IP address of traffic from the inside (private address) to be translated to your outside address (public address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 10.0.4.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA; ip nat inside&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 98.191.**.147 255.255.255.224&#xA; duplex auto&#xA; speed auto&#xA; ip nat outside&#xA;!&#xA;ip nat inside source list 1 interface FastEthernet0/1 overload&#xA;!&#xA;access-list 1 permit 10.0.4.0 0.0.0.255&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will translate the source address of any traffic in the &lt;code&gt;10.0.4.0/24&lt;/code&gt; network to be your WAN address of &lt;code&gt;98.191.**.147&lt;/code&gt;. This way, any reply traffic will come to your router and be translated back to the correct address on your LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you will need a default route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 98.191.**.149&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit for you update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using NAT the way you have, you will get uni-directional origination for traffic. The outside cannot originate traffic to the inside. That is because the NAT table is built as traffic comes from the inside to the outside, but the table entries don't exist if traffic is originated from the outside. The router has no idea where to send, on the inside, traffic to its outside interface. Typically, this is done with private addressing on the inside, and public addressing on the outside, and the private addresses can't be use on the public network, anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Likely, your ping from the outside is reaching the inside host, but when the inside host replies, the reply has its source address translated to the router WAN address, so the outside host doesn't see a reply from the address it is trying to ping. The ping then fails, even though it is working.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-17T16:00:57.977" LastActivityDate="2016-06-17T16:00:57.977" CommentCount="28" ContentLicense="CC BY-SA 3.0" />
  <row Id="32295" PostTypeId="1" AcceptedAnswerId="32301" CreationDate="2016-06-15T17:45:47.177" Score="1" ViewCount="772" Body="&lt;p&gt;I'm new to this SE forum so I hope I don't sound too dumb.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was setting up a new rack with servers and switches and I connected the switches up to the rest of the network but I forgot to hook up the vpc peer link bewteen two of my switches on the rack (the network guy said the two switches basically act as one looking at it from a level 2 perspective, the switches are an irf pair I guess).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;He went on to say by not connecting the two vpc peer links it created a loop in the network, which is why I had trouble communicating with some of the servers in the rack.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does not having the vpc peer links create a loop?  and what exactly is going on that makes it a loop?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I doubt it matters, but I'm using cisco Nexus 3548 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="27201" LastEditorUserId="27201" LastEditDate="2016-06-16T14:21:50.903" LastActivityDate="2016-06-16T14:21:50.903" Title="what are vpc peer links and why do I get a loop if I don't have them on my switches" Tags="|cisco|switch|vpn|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32296" PostTypeId="2" ParentId="32286" CreationDate="2016-06-15T18:31:41.873" Score="2" Body="&lt;p&gt;a) Ethernet is not the only Layer-2 transport.&lt;br/&gt;&#xA;b) IP supports fragmentation. (it's a bad idea, but it supports it.)&lt;br/&gt;&#xA;and c) Many vendors ignore that specific part of the standard and allow &quot;jumbo frames&quot;. As it's not part of any standard, there's no set number -- it ranges from 2k up to 16k.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-06-15T18:31:41.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32297" PostTypeId="1" AcceptedAnswerId="32298" CreationDate="2016-06-15T18:39:04.387" Score="1" ViewCount="382" Body="&lt;p&gt;I have a network architecture that requires a port group on a distributed vSwitch to take a trunk link in and split traffic off to access ports, per vlan. I have a quick sketch of what I am trying to do. I am unclear as to how to do this (or if it is even possible) after reviewing documentation from Vmware and other sources. I don't think private vlans are the answer, and I don't see a way to use Q-in-Q.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help or insight is greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: Traffic flows north to the internet and south to my private subnets/workstations, if that makes a difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE 2: This is all software based. The router is a Cisco VM and the &quot;devices&quot; are individual firewall VMs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/s8Oox.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/s8Oox.jpg&quot; alt=&quot;If artistic merit is part of the criteria for posting, I may get down-voted&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19365" LastEditorUserId="19365" LastEditDate="2016-06-16T15:23:07.360" LastActivityDate="2016-06-16T15:39:58.003" Title="vSphere - VLAN Filtering" Tags="|vlan|vmware|" AnswerCount="1" CommentCount="5" ClosedDate="2019-03-09T03:23:09.570" ContentLicense="CC BY-SA 3.0" />
  <row Id="32298" PostTypeId="2" ParentId="32297" CreationDate="2016-06-15T19:04:54.450" Score="3" Body="&lt;p&gt;Port groups are the ports of the virtual switch that connect to virtual machines, uplink ports are ports of the virtual switch that are mapped to physical link.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Create 3 different PortGroups on your VirtualDistributed Switch.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Assign each vlan to a different port group&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Declare the uplink like a trunk port and permit 0 - 4096 vlan tags&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On the physical switch, the port that connect to your ESXi host, change it to a trunk port, for that you need to have access to the managment of the switch, or be with someone who has it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;ADDED:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your router is a VM, you need to create a portgroup like trunk port and permit all the vlans, then, connect your VM on that port group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That´s all&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2016-06-16T15:39:58.003" LastActivityDate="2016-06-16T15:39:58.003" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32301" PostTypeId="2" ParentId="32295" CreationDate="2016-06-15T21:21:28.003" Score="1" Body="&lt;p&gt;You probably didn't create a loop in your network.  However, without the peer links, your two switches, instead of acting as one switch, are acting as two independent switches and dropping half of your traffic.  That's likely why you couldn't communicate with some of your servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A short explanation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your vPC sends traffic across both links to each of the switches.  With the vPC peer links, the switches can both forward the frames to the destination.&lt;br&gt;&#xA;Without the link, one of the switches will shut down the links to prevent loops.  So half your traffic is not reaching the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of my former colleagues wrote a &lt;a href=&quot;http://www.netcraftsmen.com/how-vpc-works/&quot; rel=&quot;nofollow&quot;&gt;more detailed explanation here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-15T21:21:28.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32302" PostTypeId="1" AcceptedAnswerId="50324" CreationDate="2016-06-15T22:25:57.820" Score="4" ViewCount="6801" Body="&lt;p&gt;According to IOS documentation*, you can initialize an SSH session from a switch/router and indicate the remote port to connect to, ex. &lt;code&gt;ssh -p 22222 1.1.1.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SCP, however, doesn't &lt;em&gt;seem&lt;/em&gt; to have that flexibility. &lt;code&gt;copy&lt;/code&gt; doesn't allow any connection-specific flags, nor is there an option to add any after entering the &lt;code&gt;scp&lt;/code&gt; address. This is a bit of an inconvenience when the remote host doesn't use the default SSH port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm 99% certain that this is a &quot;well that's obviously your answer&quot; situation, but it's worth a shot. Are there any &quot;deeper&quot; commands that &quot;unlock&quot; the ability to specify the remote host's SCP/SSH port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To help clarify, I'm referring to invoking &lt;code&gt;scp&lt;/code&gt; &lt;em&gt;from the switch&lt;/em&gt; to the remote host. So on the switch/router you would be typing &lt;code&gt;copy scp:remote local&lt;/code&gt; or &lt;code&gt;copy local scp:remote&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;sub&gt;*(Should it matter, I'm mostly using 2960, 3750(X), 3850, 4506/4507, and 6509)&lt;/sub&gt;&lt;/p&gt;&#xA;" OwnerUserId="14048" LastEditorUserId="14048" LastEditDate="2016-06-16T20:23:17.883" LastActivityDate="2022-04-07T22:14:18.877" Title="Is there a way to copy via SCP from the switch/router but specify the remote port?" Tags="|cisco|cisco-ios|cisco-commands|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32303" PostTypeId="6" CreationDate="2016-06-15T22:39:28.177" Score="0" Body="&lt;p&gt;I would like to nominate myself for the network engineering stack exchange moderation position.  I believe that a large portion of being a good moderator is also having a good knowledge of the subject at hand.  The point of moderation is not only to keep things off the site that are actively &quot;bad&quot; - harassing, etc, but also making sure that high quality Qs and As are there and poor ones are removed, attracting greater quality contributions.  I've been on the SE network in one form or another for over four years on very different communities and I've acquired a good set of knowledge as to what makes a particular site good or bad.  As a moderator, I know that there is a responsibility to lead and show members what the right way and the wrong way is, gently if need be, and then more firmly what there are no other possibilities.  &lt;/p&gt;&#xA;" OwnerUserId="178" LastEditorUserId="178" LastEditDate="2016-06-15T22:39:28.177" LastActivityDate="2016-06-15T22:39:28.177" CommentCount="1" CommunityOwnedDate="2016-06-15T22:39:28.177" ContentLicense="CC BY-SA 3.0" />
  <row Id="32304" PostTypeId="2" ParentId="30860" CreationDate="2016-06-15T22:43:11.847" Score="0" Body="&lt;p&gt;You can select &quot;proxy-arp&quot; on LAN interface to see another computer in the same subnet. For details, you can watch &quot;How to configure VPN Server on Mikrotik&quot; &lt;a href=&quot;https://www.youtube.com/edit?video_referrer=watch&amp;amp;video_id=RpJsLMs4AKk&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/edit?video_referrer=watch&amp;amp;video_id=RpJsLMs4AKk&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27207" LastActivityDate="2016-06-15T22:43:11.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32306" PostTypeId="1" AcceptedAnswerId="32307" CreationDate="2016-06-16T02:06:57.640" Score="1" ViewCount="855" Body="&lt;p&gt;We recently bought an ASR1006, and we have been told it has &lt;code&gt;16GB&lt;/code&gt; DRAM memory, but I am little confused by the &lt;code&gt;show version&lt;/code&gt; output, e.g. &lt;code&gt;processor with 9964723K/6147K bytes of memory&lt;/code&gt;, which is showing &lt;code&gt;9G&lt;/code&gt; memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is &lt;code&gt;16777216K bytes of physical memory.&lt;/code&gt; in the following output then?  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco ASR1006 (RP2) processor with 9964723K/6147K bytes of memory.&#xA;Processor board ID FXS1846Q06D&#xA;4 Ten Gigabit Ethernet interfaces&#xA;32768K bytes of non-volatile configuration memory.&#xA;16777216K bytes of physical memory.&#xA;1933311K bytes of eUSB flash at bootflash:.&#xA;78085207K bytes of SATA hard disk at harddisk:.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2018-03-07T21:59:15.130" LastActivityDate="2018-03-07T21:59:15.130" Title="Determine the DRAM size on a Cisco ASR1006" Tags="|cisco|router|cisco-ios|memory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32307" PostTypeId="2" ParentId="32306" CreationDate="2016-06-16T03:43:07.883" Score="4" Body="&lt;p&gt;&lt;code&gt;16777216K&lt;/code&gt; is 16 GB of DRAM. Your ASR1006 has 16 GB of DRAM installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the &lt;code&gt;processor with 9964723K/6147K bytes of memory&lt;/code&gt;, the first number is the amount of memory available to software processes, or process memory. The second number is the amount which has been allocated for I/O memory (interface buffers). On the ASR1000 series, the two numbers don't add up to the total DRAM, as they do on many of the routers, because the IOS is running as a process under a Linux kernel.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-16T03:43:07.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32308" PostTypeId="1" CreationDate="2016-06-16T04:29:36.387" Score="-1" ViewCount="30" Body="&lt;p&gt;I am currently studying alone computer networking.&#xA;I am wondering if I will download a movie file to my laptop in the cloud enviroment, Should I use any protocol?&#xA;Because of the size of a movie , it is important to speed fast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for reading .I am not familiar with the English language.&#xA;please answer my question. thank you!&lt;/p&gt;&#xA;" OwnerUserId="27210" LastActivityDate="2016-06-16T13:33:39.983" Title="what to use any protocol in cloud?" Tags="|tcp|" AnswerCount="1" CommentCount="2" ClosedDate="2019-03-09T03:24:04.710" ContentLicense="CC BY-SA 3.0" />
  <row Id="32309" PostTypeId="1" CreationDate="2016-06-16T08:15:12.523" Score="2" ViewCount="163" Body="&lt;p&gt;Let's say there is a no-name SFP transceiver without a label and without DDM support. Is there a device which is able to detect on what wavelength this SFP transmits? I have used JDSU light-meters previously and they ask user to select wavelength(for example 1310nm, 1550nm), but regardless of the selected wavelength, they will show optical Rx power.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2018-08-01T21:28:54.360" Title="detect SFP transmit wavelength" Tags="|optics|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32310" PostTypeId="1" AcceptedAnswerId="32314" CreationDate="2016-06-16T09:52:34.110" Score="4" ViewCount="4720" Body="&lt;p&gt;I'm using snmptrapd on linux from net-snmp package. I'm trying to make some perl script to handle snmp traps. I'm already have such script and it works with snmp v1, v2c traps and with snmpv3 traps but only when I specify &lt;code&gt;engineID&lt;/code&gt; explicitly both in config and in command sending trap. But when I configure cisco router to send me &lt;code&gt;linkDown&lt;/code&gt; trap it uses MAC address with some extra bytes as engineID. And I can see trap arrives on interface in wireshark, but snmptrapd does nothing. Is it possible to configure &lt;code&gt;snmptrapd&lt;/code&gt; to accept all traps by authenticated users without specifying &lt;code&gt;engineID&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Example configuration file for snmptrapd&#xA;#&#xA;# No traps are handled by default, you must edit this file!&#xA;#&#xA;createUser -e 0x0102030405 myuser MD5 mypassword DES myotherpassword&#xA;createUser -e 0x0102030405 myuser2 MD5 mypassword DES myotherpassword&#xA;createUser -e 0x0102030406 myuser2 MD5 mypassword DES myotherpassword&#xA;createUser cisco SHA cisco123 DES cisco123&#xA;authUser log,execute myuser&#xA;authUser log,execute myuser2&#xA;authUser log,execute cisco&#xA;authCommunity   log,execute public&#xA;perl do &quot;/usr/local/share/snmp/snmptrapdhandler.pl&quot;;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27212" LastActivityDate="2019-04-05T05:28:47.473" Title="How to receive snmp v3 traps without specific enginedID?" Tags="|snmp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32312" PostTypeId="1" AcceptedAnswerId="32324" CreationDate="2016-06-16T12:20:04.003" Score="1" ViewCount="6038" Body="&lt;p&gt;For example, in Windows OS, the TCP window size always change around 30000~60000 (of course, max 65535). The objective of window size is to inform the TCP sender and receiver, and improve the packet transmission efficiency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I heard that some OS (e.g. solaris) always use fixed window size. Then why not Windows OS always keep the window size at max 65535 or a large value? What determine the window size and always change it?&lt;/p&gt;&#xA;" OwnerUserId="22125" LastActivityDate="2016-06-17T04:08:39.380" Title="What makes TCP window size keep changing (e.g.windows)?" Tags="|tcp|" AnswerCount="1" CommentCount="1" ClosedDate="2016-06-16T21:38:39.277" ContentLicense="CC BY-SA 3.0" />
  <row Id="32313" PostTypeId="2" ParentId="32308" CreationDate="2016-06-16T13:33:39.983" Score="1" Body="&lt;p&gt;If you talk about streaming, then UDP is preferable.&#xA;Because of low overhead and supports time critical transport, while risking packet loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you talk about file transfer, then TCP is preferable.&#xA;Because of guaranteed transport, but no support for time critical transport.&lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2016-06-16T13:33:39.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32314" PostTypeId="2" ParentId="32310" CreationDate="2016-06-16T13:45:30.353" Score="3" Body="&lt;p&gt;You cannot be authenticated as user for receiving traps if you don't specify the engineID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.net-snmp.org/wiki/index.php/TUT:Configuring_snmptrapd_to_receive_SNMPv3_notifications&quot; rel=&quot;nofollow&quot;&gt;http://www.net-snmp.org/wiki/index.php/TUT:Configuring_snmptrapd_to_receive_SNMPv3_notifications&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2016-06-16T13:45:30.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32316" PostTypeId="2" ParentId="32302" CreationDate="2016-06-16T15:44:57.773" Score="-4" Body="&lt;p&gt;Yes, it is possible to specify a remote port. On your the localhost you can use the SSH config. You can also do it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ man scp&#xA;    ...&#xA;    -P port&#xA;         Specifies the port to connect to on the remote host.  Note that&#xA;         this option is written with a capital `P', because -p is&#xA;         already reserved for preserving the times and modes of the&#xA;         file.&#xA;    ...&#xA;$ scp -P 6969 /path/to/files.tgz user@remotehost:/path/to/drop/file/at&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would suggest using rsync over scp though, and you can specify the port with rsync as well:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   rsync [OPTION]... SRC [SRC]... rsync://[USER@]HOST[:PORT]/DEST&#xA;   rsync [OPTION]... rsync://[USER@]HOST[:PORT]/SRC [DEST]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27221" LastActivityDate="2016-06-16T15:44:57.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32319" PostTypeId="1" AcceptedAnswerId="33508" CreationDate="2016-06-16T16:59:37.090" Score="4" ViewCount="6949" Body="&lt;p&gt;I am trying to install Cisco ISE 2.1 to be used as a RADIUS server with 802.1x on my switches. I want to dynamically assign a VLAN based to a user who connects on the switch port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that, although my end client is authenticated and authorized by ISE, the VLAN id never gets received on the switch from ISE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On ISE, I see my end user being authenticated with the correct policy, and authorized with the policy I created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NrSJt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NrSJt.png&quot; alt=&quot;DOT1X config ISE&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As seen on this image, I want to assign VLAN 56. However, my port does not get this information and stays in the hardcoded VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the issue here? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could it be that RADIUS options 064,065,081 are not forwarded from the ISE to the switch? I have a firewall between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the configuration for dot1x on my switch :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;aaa group server tacacs+ ServISE&#xA; server-private X.X.X.X key XXXXX&#xA;aaa authentication login default local&#xA;aaa authentication login CON none&#xA;aaa authentication login VTY group ServISE local&#xA;aaa authentication dot1x default group radius local&#xA;aaa authorization console&#xA;aaa authorization exec CON none&#xA;aaa authorization exec VTY group ServISE local if-authenticated&#xA;aaa authorization network default group radius&#xA;&#xA;radius-server host X.X.X.X auth-port 1645 acct-port 1646 key 7 XXXX&#xA;&#xA;&#xA;interface FastEthernet0/10&#xA; switchport access vlan 88&#xA; switchport mode access&#xA; switchport voice vlan 372&#xA; authentication event fail action next-method&#xA; authentication event server dead action authorize vlan 56&#xA; authentication event server alive action reinitialize&#xA; authentication host-mode multi-auth&#xA; authentication port-control auto&#xA; authentication violation restrict&#xA; dot1x pae authenticator&#xA; spanning-tree portfast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is an output when the end user is authenticated through dot1x : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Dot1x Info for FastEthernet0/10&#xA; -----------------------------------&#xA; PAE                       = AUTHENTICATOR&#xA; PortControl               = AUTO&#xA; ControlDirection          = Both&#xA; HostMode                  = MULTI_AUTH&#xA; QuietPeriod               = 60&#xA; ServerTimeout             = 0&#xA; SuppTimeout               = 30&#xA; ReAuthMax                 = 2&#xA; MaxReq                    = 2&#xA; TxPeriod                  = 30&#xA;&#xA; Dot1x Authenticator Client List&#xA; -------------------------------&#xA; Supplicant                = 34e6.d735.483c&#xA; Session ID                = 84A8A830000000254EE2CCAB&#xA;     Auth SM State         = AUTHENTICATED&#xA;     Auth BEND SM State    = IDLE&#xA; Port Status               = AUTHORIZED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the output of a debug dot1x all &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;275: Jun 16 18:30:40.370: dot1x-ev(Fa0/10): dot1x_exec_reauth_interface: Reauthenticating Authenticator instances&#xA;276: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): Posting REAUTHENTICATE on Client 0xF5000034&#xA;277: Jun 16 18:30:40.370:     dot1x_auth Fa0/10: during state auth_authenticated, got event 17(reAuthenticate)&#xA;278: Jun 16 18:30:40.370: @@@ dot1x_auth Fa0/10: auth_authenticated -&amp;gt; auth_restart&#xA;279: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): 0xF5000034:auth_authenticated_exit called&#xA;280  Jun 16 18:30:40.370: dot1x-sm(Fa0/10): 0xF5000034:auth_restart_enter called&#xA;281: Jun 16 18:30:40.370: dot1x-ev(Fa0/10): Sending create new context event to EAP for 0xF5000034 (34e6.d735.483c)&#xA;282: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): 0xF5000034:auth_authenticated_restart_action called&#xA;283: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): Posting !EAP_RESTART on Client 0xF5000034&#xA;284: Jun 16 18:30:40.370:     dot1x_auth Fa0/10: during state auth_restart, got event 6(no_eapRestart)&#xA;285: Jun 16 18:30:40.370: @@@ dot1x_auth Fa0/10: auth_restart -&amp;gt; auth_connecting&#xA;286: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): 0xF5000034:auth_connecting_enter called&#xA;287: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): 0xF5000034:auth_restart_connecting_action called&#xA;288: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): Posting RX_REQ on Client 0xF5000034&#xA;289: Jun 16 18:30:40.370:     dot1x_auth Fa0/10: during state auth_connecting, got event 10(eapReq_no_reAuthMax)&#xA;290: Jun 16 18:30:40.370: @@@ dot1x_auth Fa0/10: auth_connecting -&amp;gt; auth_authenticating&#xA;291: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): 0xF5000034:auth_authenticating_enter called&#xA;292: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): 0xF5000034:auth_connecting_authenticating_action called&#xA;293: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): Posting AUTH_START for 0xF5000034&#xA;294: Jun 16 18:30:40.370:     dot1x_auth_bend Fa0/10: during state auth_bend_idle, got event 4(eapReq_authStart)&#xA;295: Jun 16 18:30:40.370: @@@ dot1x_auth_bend Fa0/10: auth_bend_idle -&amp;gt; auth_bend_request&#xA;296: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): 0xF5000034:auth_bend_request_enter called&#xA;297: Jun 16 18:30:40.370: dot1x-packet(Fa0/10): EAP code: 0x1  id: 0x4E length: 0x0005 type: 0x1  data:&#xA;298: Jun 16 18:30:40.370: dot1x-ev(Fa0/10): Sending EAPOL packet to 34e6.d735.483c&#xA;299: Jun 16 18:30:40.370: dot1x-ev(Fa0/10): Role determination not required&#xA;300: Jun 16 18:30:40.370: dot1x-registry:registry:dot1x_ether_macaddr called&#xA;301: Jun 16 18:30:40.370: dot1x-ev(Fa0/10): Sending out EAPOL packet&#xA;302: Jun 16 18:30:40.370: EAPOL pak dump Tx&#xA;303: Jun 16 18:30:40.370: EAPOL Version: 0x2  type: 0x0  length: 0x0005&#xA;304: Jun 16 18:30:40.370: EAP code: 0x1  id: 0x4E length: 0x0005 type: 0x1&#xA;305: Jun 16 18:30:40.370: dot1x-packet(Fa0/10): EAPOL packet sent to client 0xF5000034 (34e6.d735.483c)&#xA;306: Jun 16 18:30:40.370: dot1x-sm(Fa0/10): 0xF5000034:auth_bend_idle_request_action called&#xA;307: Jun 16 18:30:40.378: dot1x-ev(Fa0/10): Role determination not required&#xA;308: Jun 16 18:30:40.378: dot1x-packet(Fa0/10): Queuing an EAPOL pkt on Authenticator Q&#xA;309: Jun 16 18:30:40.378: dot1x-ev:Enqueued the eapol packet to the global authenticator queue&#xA;310: Jun 16 18:30:40.378: EAPOL pak dump rx&#xA;311: Jun 16 18:30:40.378: EAPOL Version: 0x1  type: 0x0  length: 0x0020&#xA;312: Jun 16 18:30:40.378: dot1x-ev:dot1x_auth_queue_event: Int Fa0/10 CODE= 2,TYPE= 1,LEN= 32&#xA;313: Jun 16 18:30:40.378: dot1x-packet(Fa0/10): Received an EAPOL frame&#xA;314: Jun 16 18:30:40.378: dot1x-ev(Fa0/10): Received pkt saddr =34e6.d735.483c , daddr = 0180.c200.0003, pae-ether-type = 888e.0100.0020&#xA;315: Jun 16 18:30:40.378: dot1x-packet(Fa0/10): Received an EAP packet&#xA;316: Jun 16 18:30:40.378: EAPOL pak dump rx&#xA;317: Jun 16 18:30:40.378: EAPOL Version: 0x1  type: 0x0  length: 0x0020&#xA;318: Jun 16 18:30:40.378: dot1x-packet(Fa0/10): Received an EAP packet from 34e6.d735.483c&#xA;319: Jun 16 18:30:40.378: dot1x-sm(Fa0/10): Posting EAPOL_EAP for 0xF5000034&#xA;320: Jun 16 18:30:40.378:     dot1x_auth_bend Fa0/10: during state auth_bend_request, got event 6(eapolEap)&#xA;321: Jun 16 18:30:40.378: @@@ dot1x_auth_bend Fa0/10: auth_bend_request -&amp;gt; auth_bend_response&#xA;322: Jun 16 18:30:40.378: dot1x-sm(Fa0/10): 0xF5000034:auth_bend_response_enter called&#xA;323: Jun 16 18:30:40.378: dot1x-ev(Fa0/10): dot1x_sendRespToServer: Response sent to the server from 0xF5000034 (34e6.d735.483c)&#xA;324: Jun 16 18:30:40.378: dot1x-sm(Fa0/10): 0xF5000034:auth_bend_request_response_action called&#xA;325: Jun 16 18:30:40.395: dot1x-sm(Fa0/10): Posting EAP_REQ for 0xF5000034&#xA;326: Jun 16 18:30:40.395:     dot1x_auth_bend Fa0/10: during state auth_bend_response, got event 7(eapReq)&#xA;327: Jun 16 18:30:40.395: @@@ dot1x_auth_bend Fa0/10: auth_bend_response -&amp;gt; auth_bend_request&#xA;328: Jun 16 18:30:40.395: dot1x-sm(Fa0/10): 0xF5000034:auth_bend_response_exit called&#xA;329: Jun 16 18:30:40.395: dot1x-sm(Fa0/10): 0xF5000034:auth_bend_request_enter called&#xA;330: Jun 16 18:30:40.395: dot1x-packet(Fa0/10): EAP code: 0x1  id: 0x2B length: 0x0006 type: 0xD  data:&#xA;331: Jun 16 18:30:40.395: dot1x-ev(Fa0/10): Sending EAPOL packet to 34e6.d735.483c&#xA;332: Jun 16 18:30:40.395: dot1x-ev(Fa0/10): Role determination not required&#xA;333: Jun 16 18:30:40.395: dot1x-registry:registry:dot1x_ether_macaddr called&#xA;334: Jun 16 18:30:40.395: dot1x-ev(Fa0/10): Sending out EAPOL packet&#xA;335: Jun 16 18:30:40.395: EAPOL pak dump Tx&#xA;336: Jun 16 18:30:40.395: EAPOL Version: 0x2  type:0x0  length: 0x0006&#xA;337: Jun 16 18:30:40.395: EAP code: 0x1  id: 0x2B length: 0x0006 type: 0xD&#xA;338: Jun 16 18:30:40.395: dot1x-packet(Fa0/10): EAPOL packet sent to client 0xF5000034 (34e6.d735.483c)&#xA;339: Jun 16 18:30:40.395: dot1x-sm(Fa0/10): 0xF5000034:auth_bend_response_request_action called&#xA;340: Jun 16 18:30:40.404: dot1x-ev(Fa0/10): Role determination not required&#xA;341: Jun 16 18:30:40.404: dot1x-packet(Fa0/10): Queuing an EAPOL pkt on Authenticator Q&#xA;342: Jun 16 18:30:40.404: dot1x-ev:Enqueued the eapol packet to the global authenticator queue&#xA;343: Jun 16 18:30:40.404: EAPOL pak dump rx&#xA;344: Jun 16 18:30:40.404: EAPOL Version: 0x1  type: 0x0  length: 0x0006&#xA;345: Jun 16 18:30:40.404: dot1x-ev:dot1x_auth_queue_event: Int Fa0/10 CODE= 2,TYPE= 3,LEN= 6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the output for &quot;debug radius authentication&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;685: Jun 17 09:06:23.838: RADIUS/ENCODE(000004D5):Orig. component type = DOT1X&#xA;686: Jun 17 09:06:23.838: RADIUS(000004D5): Config NAS IP: 0.0.0.0&#xA;687: Jun 17 09:06:23.838: RADIUS/ENCODE(000004D5): acct_session_id: 1237&#xA;688: Jun 17 09:06:23.838: RADIUS(000004D5): sending&#xA;689: Jun 17 09:06:23.838: RADIUS/ENCODE: Best Local IP-Address 1.1.1.1 for Radius-Server X.X.X.X&#xA;690: Jun 17 09:06:23.838: RADIUS(000004D5): Send Access-Request to X.X.X.X:1645 id 1645/16, len 236&#xA;691: Jun 17 09:06:23.838: RADIUS:  authenticator C8 97 74 7C 01 99 CE 9E - 11 D2 87 96 10 15 A4 43&#xA;692: Jun 17 09:06:23.838: RADIUS:  User-Name           [1]   29  &quot;host/MyComputer.testdomain.com&quot;&#xA;693: Jun 17 09:06:23.838: RADIUS:  Service-Type        [6]   6   Framed                    [2]&#xA;694: Jun 17 09:06:23.838: RADIUS:  Framed-MTU          [12]  6   1500&#xA;695: Jun 17 09:06:23.838: RADIUS:  Called-Station-Id   [30]  19  &quot;C8-F9-F9-C9-45-0C&quot;&#xA;696: Jun 17 09:06:23.838: RADIUS:  Calling-Station-Id  [31]  19  &quot;34-E6-D7-35-48-3C&quot;&#xA;697: Jun 17 09:06:23.838: RADIUS:  EAP-Message         [79]  34&#xA;698: Jun 17 09:06:23.838: RADIUS:   02 85 00 20 01 68 6F 73 74 2F 47 52 45 30 34 37 39 34 37 2E  [ host/MyComputer.]&#xA;699: Jun 17 09:06:23.838: RADIUS:   69 6E 74 72 61 2E 63 65 61 2E 66 72      [ testdomain.com]&#xA;700: Jun 17 09:06:23.838: RADIUS:  Message-Authenticato[80]  18&#xA;701: Jun 17 09:06:23.838: RADIUS:   02 09 C8 4B FC 82 96 B9 61 8A 24 F6 81 4A 0B C2[ Ka$J]&#xA;702: Jun 17 09:06:23.846: RADIUS:  Vendor, Cisco       [26]  49&#xA;703: Jun 17 09:06:23.846: RADIUS:   Cisco AVpair       [1]   43  &quot;audit-session-id=84A8A830000000254EE2CCAB&quot;&#xA;704: Jun 17 09:06:23.846: RADIUS:  NAS-Port-Type       [61]  6   Ethernet                  [15]&#xA;705: Jun 17 09:06:23.846: RADIUS:  NAS-Port            [5]   6   5    0&#xA;706: Jun 17 09:06:23.846: RADIUS:  NAS-Port-Id         [87]  18  &quot;FastEthernet0/10&quot;&#xA;707: Jun 17 09:06:23.846: RADIUS:  NAS-IP-Address      [4]   6   1.1.1.1&#xA;708: Jun 17 09:06:23.846: RADIUS: Received from id 1645/16 X.X.X.X:1645, Access-Challenge, len 127&#xA;709: Jun 17 09:06:23.846: RADIUS:  authenticator 71 6A C0 FC 82 FE 8A 64 - 22 FA 09 EE 44 33 5A ED&#xA;710: Jun 17 09:06:23.846: RADIUS:  State               [24]  81&#xA;711: Jun 17 09:06:23.846: RADIUS:   33 37 43 50 4D 53 65 73 73 69 6F 6E 49 44 3D 38  [37CPMSessionID=8]&#xA;712: Jun 17 09:06:23.855: RADIUS:   34 41 38 41 38 33 30 30 30 30 30 30 30 32 35 34  [4A8A830000000254]&#xA;713: Jun 17 09:06:23.855: RADIUS:   45 45 32 43 43 41 42 3B 33 36 53 65 73 73 69 6F  [EE2CCAB;36Sessio]&#xA;714: Jun 17 09:06:23.855: RADIUS:   6E 49 44 3D 67 72 65 78 70 33 31 32 61 64 6D 2F  [nID=MyComputer/]&#xA;715: Jun 17 09:06:23.855: RADIUS:   32 35 34 38 33 38 36 35 35 2F 31 38 37 35 3B   [ 254838655/1875;]&#xA;716: Jun 17 09:06:23.855: RADIUS:  EAP-Message         [79]  8&#xA;717: Jun 17 09:06:23.855: RADIUS:   01 44 00 06 0D 20[ D ]&#xA;718: Jun 17 09:06:23.855: RADIUS:  Message-Authenticato[80]  18&#xA;719: Jun 17 09:06:23.855: RADIUS:   AF 6F 4C 96 0A 75 CE 3D 4B 4C 7D ED E9 A9 94 48          [ oLu=KL}H]&#xA;720: Jun 17 09:06:23.855: RADIUS(000004D5): Received from id 1645/16&#xA;721: Jun 17 09:06:23.855: RADIUS/DECODE: EAP-Message fragments, 6, total 6 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3484" LastEditorUserId="3484" LastEditDate="2016-06-28T11:52:23.470" LastActivityDate="2016-07-26T14:46:13.327" Title="RADIUS VLAN Assignment with Cisco ISE" Tags="|cisco|vlan|radius|cisco-ise|" AnswerCount="2" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="32320" PostTypeId="1" AcceptedAnswerId="32321" CreationDate="2016-06-16T17:51:57.270" Score="3" ViewCount="156" Body="&lt;p&gt;I have several web applications that are load balanced by an F5 appliance. What I would like to know is, &lt;strong&gt;for support reasons&lt;/strong&gt;, is there a way to form an HTTP Request and have the F5 appliance route it to that specific server rather than the normal random load balancing?  Is there maybe an HTTP Header or something or does a specific rule need to be made to make this happen? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="27225" LastActivityDate="2016-06-16T18:30:48.983" Title="F5 loading balancing - Routing requests to specific server in pool when specified in the request?" Tags="|load-balancer|f5|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32321" PostTypeId="2" ParentId="32320" CreationDate="2016-06-16T18:30:48.983" Score="3" Body="&lt;p&gt;You could do this with iRules. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The admin override would request the page adding a cookie like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;http://somesite.com?override=web1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then the iRule would look for an an HTTP Cookie of &lt;code&gt;override&lt;/code&gt; using the &lt;a href=&quot;https://devcentral.f5.com/Wiki/iRules.HTTP__cookie.ashx&quot; rel=&quot;nofollow&quot;&gt;HTTP::cookie&lt;/a&gt; command. Then an &lt;code&gt;if&lt;/code&gt; or &lt;code&gt;switch&lt;/code&gt; statement matching &lt;code&gt;web1&lt;/code&gt; which would assign the session to a particular web server using the &lt;strong&gt;&lt;a href=&quot;https://devcentral.f5.com/wiki/iRules.node.ashx&quot; rel=&quot;nofollow&quot;&gt;node&lt;/a&gt;&lt;/strong&gt; command. &lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-06-16T18:30:48.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32322" PostTypeId="1" CreationDate="2016-06-16T19:34:14.153" Score="0" ViewCount="78" Body="&lt;p&gt;I have an odd situation in my current property. When connected to the wireless I need to have full bars or Internet connection is nonexistent. It won't disconnect from the wireless, just the internet stops working. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial thoughts were maybe channel contention, so I checked the channel config. I was on 6 so tried both 1 and 11. Same issue persisted. So left it on 11.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a virgin horizon box (Ireland) so the Internet is excellent when you can connect, averages about 36Mbps+, just ran a test and got 45.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has both a 2.4Ghz and 5Ghz. I use the 2.4Ghz generally. Tried the 5Ghz at one stage, but I struggle a bit with range if I'm too far from the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rebooting the box makes no difference. Anyone ever come across this?&lt;/p&gt;&#xA;" OwnerUserId="27226" LastActivityDate="2016-06-16T20:00:38.033" Title="Wireless Internet only works on full bars" Tags="|router|wireless|" AnswerCount="1" CommentCount="1" ClosedDate="2016-06-16T21:36:30.717" ContentLicense="CC BY-SA 3.0" />
  <row Id="32323" PostTypeId="2" ParentId="32322" CreationDate="2016-06-16T20:00:38.033" Score="1" Body="&lt;p&gt;if you are speaking about home WiFI solution please try following software &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.dd-wrt.com/site/index&quot; rel=&quot;nofollow&quot;&gt;http://www.dd-wrt.com/site/index&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Install that on your home router and this will fix the issue. I'm using TPLINK router at home. This helped me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck&lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2016-06-16T20:00:38.033" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32324" PostTypeId="2" ParentId="32312" CreationDate="2016-06-16T20:32:30.980" Score="3" Body="&lt;p&gt;Window sizes are used by the receiver to let the sender know how much memory (buffer) it has for that particular TCP connection. The size will keep dropping until the receiver sends am ACK to the sender which acknowledges it has received the traffic the sender has sent. At this point in time the window size is increased to accommodate the size of the traffic which had been acknowledged. For example, if 8KB of data was sent, the window size would drop by 8KB. If then 3KB is acknowledged, it will be increased by 3KB at that point in time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the sender does not send an ACK, the window size will eventually drop to 0 and the sender will stop sending new traffic to the receiver until it receives an ACK (it will resend old data if it doesn't receive an ACK within a reasonable amount of time (this is called a retransmission)). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In regards to the maximum window size, this can be increased using the window scaling option. This option is used to allow more data to be sent before the sender has to wait for an ACK. This is to ensure that high latency links can still fully utilise their links (see Long Fat Networks and &lt;a href=&quot;https://en.m.wikipedia.org/wiki/Bandwidth-delay_product&quot; rel=&quot;nofollow&quot;&gt;Bandwidth Delay Product&lt;/a&gt; for more information). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, please see &lt;a href=&quot;http://packetlife.net/blog/2010/aug/4/tcp-windows-and-window-scaling/&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt; for more information on both TCP windows and scaling.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2016-06-17T04:08:39.380" LastActivityDate="2016-06-17T04:08:39.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32325" PostTypeId="1" AcceptedAnswerId="32326" CreationDate="2016-06-16T22:38:32.110" Score="1" ViewCount="386" Body="&lt;p&gt;Can you confirm that if host 1 wants to send a broadcast packet, he will send it to the router first, and the router will send it to all machines to the LAN ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to clarify this point in order to understand dynamic arp inspection.&lt;/p&gt;&#xA;" OwnerUserId="23817" LastActivityDate="2016-06-16T23:12:15.563" Title="Broadcast packet in LAN is first sent to router?" Tags="|router|lan|broadcast|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32326" PostTypeId="2" ParentId="32325" CreationDate="2016-06-16T23:12:15.563" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can you confirm that if host 1 wants to send a broadcast packet, he will send it to the router first, and the router will send it to all machines to the LAN ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is incorrect. Broadcasts are sent by a host to all other hosts on the same subnet (PCs, phones, routers, switches, etc) at the same time. The destination MAC for a broadcast is FF:FF:FF:FF:FF:FF. If the packet was to be sent to a router or switch the destination MAC would be that of the router or switch and it would be a unicast packet as opposed to a broadcast packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now having said the above, in order for a broadcast packet to reach the other devices it will need to go through at least one switch. When the switch sees the destination MAC of FF:FF:FF:FF:FF:FF it usually sends the packet out all of its interfaces which are in the same VLAN, except for the interface the packet was received on. However, when Dynamic ARP inspection is enabled the switch is able to drop the packet instead of sending it out all interfaces if it deems it to be a malicious ARP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://kb.netgear.com/app/answers/detail/a_id/21808/~/what-is-dynamic-arp-inspection-(dai)-and-how-does-it-work-with-my-managed&quot;&gt;this page&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-06-16T23:12:15.563" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32329" PostTypeId="1" AcceptedAnswerId="32331" CreationDate="2016-06-17T11:10:49.990" Score="5" ViewCount="25821" Body="&lt;p&gt;I would like to know why we do not (and should not I guess) use 2 different networks on the same LAN/vLAN. From what I tried and understood :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Host in network A (ex: 10.1.1.0/24) can talk to each other&lt;/li&gt;&#xA;&lt;li&gt;And host in network B (ex: 10.2.2.0/24) cant talk to each other&lt;/li&gt;&#xA;&lt;li&gt;Host and network A cannot talk to host in network B which is normal since inter-LAN communications need a L3 device with routing function.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The idea/principle of a LAN/vLAN is, in the course I've followed, described as a broadcast domain. But I am confused since I can configure 2 working networks within the same LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried the same configuration but with a second switch and a different vlan number (SW1 with vlan 10 and SW2 with vlan 20). All ports of each switch are in access mode with vlan 10 and 20 respectively. I had the same result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note : each side of the topology has a host from network A and B&#xA;&lt;a href=&quot;https://i.stack.imgur.com/H1Q1p.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H1Q1p.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, nobody does that and I supposed it is for some goods reasons, but I did not find what are those reasons and that is what I am asking you ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/23769/what-blocks-a-computer-from-another-network-in-the-same-switch-from-answering-an&quot;&gt;this topic&lt;/a&gt; which seems similar, but the purpose is not the same.&lt;/p&gt;&#xA;" OwnerUserId="23050" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2022-07-11T08:21:18.510" Title="What are the reasons for not putting multiple subnets on the same VLAN?" Tags="|switch|vlan|lan|broadcast|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32330" PostTypeId="1" AcceptedAnswerId="32332" CreationDate="2016-06-17T11:16:44.347" Score="2" ViewCount="29" Body="&lt;pre&gt;&lt;code&gt;ip prefix-list DRoute seq 5 permit 0.0.0.0/0&#xA;! since there is an implicit deny the above should allow only the default to &#xA;! pass but it is not happening&#xA;&#xA;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; default-information originate&#xA; distribute-list DRoute out&#xA; no auto-summary&#xA;&#xA;do sh ip prefix det&#xA;Prefix-list with the last deletion/insertion: DRoute&#xA;ip prefix-list DRoute:&#xA;   count: 1, range entries: 0, sequences: 5 - 5, refcount: 2&#xA;   seq 5 permit 0.0.0.0/0 (hit count: 0, refcount: 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I missing here, this should be pretty simple?&lt;/p&gt;&#xA;" OwnerUserId="1647" LastActivityDate="2016-06-17T12:04:06.667" Title="RIP: def route originated locally, trying to block any other route with prefix list-not working" Tags="|rip|route-filter|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32331" PostTypeId="2" ParentId="32329" CreationDate="2016-06-17T12:00:31.880" Score="7" Body="&lt;p&gt;There's really no reason not to put multiple subnets on the same VLAN, but there's also probably no reason to do it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pro:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Allows the subnets to talk directly without a router or firewall&lt;/li&gt;&#xA;&lt;li&gt;Save's VLANs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Con:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Allows the subnets to talk directly without a router or firewall&lt;/li&gt;&#xA;&lt;li&gt;It's messy from a documentation and troubleshooting perspective&lt;/li&gt;&#xA;&lt;li&gt;More broadcast traffic&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We generally don't do it because of the messiness and lack of security. One VLAN = one subnet is easier to document and easier to troubleshoot and there's usually not a good reason to complicate things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only reason I can think of to do it is company mergers or network upgrades and for both of those I'd prefer it to be temporary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit to clarify, for the hosts on different subnets but the same VLAN to talk directly you'd need to either make them their own default gateway or add a route to the &quot;other&quot; subnet that connects it to the interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the gateway case if the host IP was 10.1.1.2 then the gateway would also be 10.1.1.2.  This will cause the host to ARP for everything on or off it's subnet.  This would allow it to talk to the second subnet on that VLAN but the only way it'll be able to talk to anything else is if there's a router/firewall running proxy arp that can help it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the route out the interface case you'd add something like &quot;route add -net 192.56.76.0 netmask 255.255.255.0 eth0&quot; to the device and then 10.1.1.2 will ARP directly on eth0 when it wants to reach 192.56.76.*.  &lt;/p&gt;&#xA;" OwnerUserId="165" LastEditorUserId="165" LastEditDate="2016-06-18T15:37:35.573" LastActivityDate="2016-06-18T15:37:35.573" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32332" PostTypeId="2" ParentId="32330" CreationDate="2016-06-17T12:04:06.667" Score="2" Body="&lt;p&gt;To use a prefix list, you have to include the word &quot;prefix&quot;, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;distribute-list prefix DRoute out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ref: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfrip.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfrip.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-17T12:04:06.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32333" PostTypeId="6" CreationDate="2016-06-17T12:17:13.260" Score="0" Body="&lt;p&gt;I've been a moderator on this stack exchange for little over a year now, and I would like to continue my job as a moderator. I've enjoyed helping this SE become a better community by trying to guard and improve the quality of questions asked and answers given. &lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2016-06-17T12:17:13.260" LastActivityDate="2016-06-17T12:17:13.260" CommentCount="3" CommunityOwnedDate="2016-06-17T12:17:13.260" ContentLicense="CC BY-SA 3.0" />
  <row Id="32335" PostTypeId="1" AcceptedAnswerId="33174" CreationDate="2016-06-17T12:38:04.330" Score="1" ViewCount="2541" Body="&lt;p&gt;What &quot;protocol&quot; services like Sonos or Chromecast use to communicate between devices over the same WiFi? In particualr, how do those devices make themselves discoverable and how do they &quot;fish&quot; for incoming communication?&lt;/p&gt;&#xA;" OwnerUserId="27242" LastEditorUserId="8499" LastEditDate="2018-11-04T18:53:07.147" LastActivityDate="2018-11-04T18:53:07.147" Title="How do devices communicate over a WiFi network?" Tags="|wireless|ieee-802.11|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32336" PostTypeId="1" AcceptedAnswerId="32452" CreationDate="2016-06-17T12:42:36.510" Score="2" ViewCount="1885" Body="&lt;p&gt;I am trying to setup a site-to-site VPN to a large telco.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are running VyOS 1.1.7 in AWS; they are using a Cisco ASA 5520.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the telco is large, and we are small, they have dictated all the required settings to us, and are unlikely to change anything on our behalf. Additionally, getting log files or more configuration information from them can be tedious.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From their perspective, they want to whitelist a single static IP of ours for all application traffic (http). So any connections we initiate to them must appear as if it came from our static IP, no matter what the rest of our internal networking architecture may look like. So we use NAT to satisfy this requirement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, we can successfully establish both an IKEv1 connection as well as an ESP connection with them, and both ICMP and TCP traffic can flow in both directions. We can ping them, they can ping us, and inbound http traffic to our application server also works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me, this means our AWS security policy is configured properly, our firewall rules are sane, our VPN settings match up, and routing our subnets is working too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that after a short amount of time, say ~10 minutes, we are no longer reachable from the telco's perspective.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On our side, the output from &lt;code&gt;show vpn ipsec sa&lt;/code&gt; indicates that the tunnels are all still up:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vyos@VPN-FW01:~$ show vpn ipsec sa&#xA;Peer ID / IP                        Local ID / IP               &#xA;------------                        -------------&#xA;&amp;lt;TELCO IP&amp;gt;                          &amp;lt;MY IP&amp;gt;                         &#xA;&#xA;Tunnel  State  Bytes Out/In   Encrypt  Hash    NAT-T  A-Time  L-Time  Proto&#xA;------  -----  -------------  -------  ----    -----  ------  ------  -----&#xA;1       up     0.0/0.0        aes128   sha1    no     2153    28800   all&#xA;2       up     0.0/0.0        aes128   sha1    no     1964    28800   all&#xA;3       up     0.0/0.0        aes128   sha1    no     1906    28800   all&#xA;4       up     0.0/0.0        aes128   sha1    no     1864    28800   all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But as you can see, no traffic has passed on the tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There doesn't seem to be anything informative in the log files either. The output of &lt;code&gt;show log&lt;/code&gt; has many entries that look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jun 17 11:46:06 VPN-FW01 pluto[18897]: &quot;peer-TELCO-IP-tunnel-1&quot; #347: sent QI2, IPsec SA established {ESP=&amp;gt;0x1e15be1f &amp;lt;0xc9355ae4}&#xA;Jun 17 11:54:26 VPN-FW01 pluto[18897]: &quot;peer-TELCO-IP-tunnel-1&quot; #14: received Delete SA payload: replace IPSEC State #338 in 10 seconds&#xA;Jun 17 11:54:36 VPN-FW01 pluto[18897]: &quot;peer-TELCO-IP-tunnel-2&quot; #348: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #338 {using isakmp#14}&#xA;Jun 17 11:54:36 VPN-FW01 pluto[18897]: &quot;peer-TELCO-IP-tunnel-2&quot; #348: sent QI2, IPsec SA established {ESP=&amp;gt;0xa48e62c1 &amp;lt;0xc67eaa07}&#xA;Jun 17 12:02:26 VPN-FW01 pluto[18897]: &quot;peer-TELCO-IP-tunnel-1&quot; #14: received Delete SA payload: replace IPSEC State #332 in 10 seconds&#xA;Jun 17 12:02:36 VPN-FW01 pluto[18897]: &quot;peer-TELCO-IP-tunnel-3&quot; #349: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #332 {using isakmp#14}&#xA;Jun 17 12:02:36 VPN-FW01 pluto[18897]: &quot;peer-TELCO-IP-tunnel-3&quot; #349: sent QI2, IPsec SA established {ESP=&amp;gt;0xe0d44968 &amp;lt;0xccc1945f}&#xA;Jun 17 12:03:56 VPN-FW01 pluto[18897]: &quot;peer-TELCO-IP-tunnel-1&quot; #14: received Delete SA payload: replace IPSEC State #333 in 10 seconds&#xA;Jun 17 12:04:06 VPN-FW01 pluto[18897]: &quot;peer-TELCO-IP-tunnel-4&quot; #350: initiating Quick Mode PSK+ENCRYPT+TUNNEL+PFS+UP to replace #333 {using isakmp#14}&#xA;Jun 17 12:04:06 VPN-FW01 pluto[18897]: &quot;peer-TELCO-IP-tunnel-4&quot; #350: sent QI2, IPsec SA established {ESP=&amp;gt;0xad009d57 &amp;lt;0xc8b2287d}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But no other errors or anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;tcpdump&lt;/code&gt; on our end doesn't show anything informative either. Many entries that look like the below, along with typical ARP traffic, NTP, etc.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    TELCO-IP.isakmp &amp;gt; ip-MY-IP.ec2.internal.isakmp: isakmp 1.0 msgid dd22ed6d: phase 2/others ? inf[E]: [encrypted hash]&#xA;12:06:59.148180 IP (tos 0x0, ttl 64, id 2672, offset 0, flags [DF], proto UDP (17), length 120)&#xA;    ip-MY-IP.ec2.internal.isakmp &amp;gt; TELCO-IP.isakmp: isakmp 1.0 msgid f8f1d9ba: phase 2/others ? inf[E]: [encrypted hash]&#xA;12:07:19.147638 IP (tos 0x0, ttl 234, id 31559, offset 0, flags [none], proto UDP (17), length 120)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But we don't see the incoming ping nor http traffic anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interesting bit is that if we ping the telco's subnet from our side, then incoming traffic, including http, works again for another ~10 minutes, before dropping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any clues?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My VyOS config is here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;firewall {&#xA;    all-ping enable&#xA;    broadcast-ping disable&#xA;    config-trap disable&#xA;    group {&#xA;        address-group TELCO-HOSTS {&#xA;            address 192.xx.yy.38&#xA;            address 192.xx.yy.39&#xA;            address 192.xx.yy.40&#xA;            address 192.xx.yy.41&#xA;        }&#xA;    }&#xA;    ipv6-receive-redirects disable&#xA;    ipv6-src-route disable&#xA;    ip-src-route disable&#xA;    log-martians enable&#xA;    name eth0in {&#xA;        default-action reject&#xA;        rule 20 {&#xA;            action accept&#xA;            description &quot;accept ICMP pings&quot;&#xA;            icmp {&#xA;                type-name echo-request&#xA;            }&#xA;            protocol icmp&#xA;        }&#xA;        rule 30 {&#xA;            action accept&#xA;            destination {&#xA;                port 22&#xA;            }&#xA;            protocol tcp&#xA;        }&#xA;        rule 40 {&#xA;            action accept&#xA;            description &quot;accept all internal traffic&quot;&#xA;            source {&#xA;                address 10.113.0.0/16&#xA;            }&#xA;        }&#xA;        rule 50 {&#xA;            action accept&#xA;            description &quot;accept expected tunneled TCP traffic from TELCO&quot;&#xA;            destination {&#xA;                port 5101,8310,8443,8080,9101,9107,9109&#xA;            }&#xA;            protocol tcp&#xA;            source {&#xA;                group {&#xA;                    address-group TELCO-HOSTS&#xA;                }&#xA;            }&#xA;        }&#xA;        rule 200 {&#xA;            action drop&#xA;        }&#xA;    }&#xA;    name eth0out {&#xA;        default-action accept&#xA;    }&#xA;    receive-redirects disable&#xA;    send-redirects enable&#xA;    source-validation disable&#xA;    state-policy {&#xA;        established {&#xA;            action accept&#xA;        }&#xA;        invalid {&#xA;            action drop&#xA;        }&#xA;        related {&#xA;            action accept&#xA;        }&#xA;    }&#xA;    syn-cookies enable&#xA;    twa-hazards-protection disable&#xA;}&#xA;interfaces {&#xA;    ethernet eth0 {&#xA;        address dhcp&#xA;        duplex auto&#xA;        firewall {&#xA;            in {&#xA;                name eth0in&#xA;            }&#xA;            out {&#xA;                name eth0out&#xA;            }&#xA;        }&#xA;        hw-id 0a:d2:b0:8e:53:f3&#xA;        smp_affinity auto&#xA;        speed auto&#xA;    }&#xA;    loopback lo {&#xA;    }&#xA;}&#xA;nat {&#xA;    source {&#xA;        rule 10 {&#xA;            description &quot;US to TELCO&quot;&#xA;            destination {&#xA;                address 192.xx.yy.0/24&#xA;            }&#xA;            outbound-interface eth0&#xA;            translation {&#xA;                address &amp;lt;MY-APP-SERVER&amp;gt;&#xA;            }&#xA;        }&#xA;        rule 500 {&#xA;            description &quot;US to anywhere else&quot;&#xA;            outbound-interface eth0&#xA;            source {&#xA;                address 10.113.0.0/16&#xA;            }&#xA;            translation {&#xA;                address masquerade&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;service {&#xA;    ssh {&#xA;        disable-password-authentication&#xA;        port 22&#xA;    }&#xA;}    &#xA;vpn {&#xA;    ipsec {&#xA;        esp-group ESP {&#xA;            compression disable&#xA;            lifetime 28800&#xA;            mode tunnel&#xA;            pfs enable&#xA;            proposal 1 {&#xA;                encryption aes128&#xA;                hash sha1&#xA;            }&#xA;        }&#xA;        ike-group IKE {&#xA;            key-exchange ikev1&#xA;            lifetime 86400&#xA;            proposal 1 {&#xA;                dh-group 5&#xA;                encryption aes256&#xA;                hash sha1&#xA;            }&#xA;        }&#xA;        ipsec-interfaces {&#xA;            interface eth0&#xA;        }&#xA;        site-to-site {&#xA;            peer &amp;lt;TELCO-STATIC-IP&amp;gt; {&#xA;                authentication {&#xA;                    mode pre-shared-secret&#xA;                    pre-shared-secret ****************&#xA;                }&#xA;                connection-type initiate&#xA;                ike-group IKE&#xA;                local-address &amp;lt;MY-IP&amp;gt;&#xA;                tunnel 1 {&#xA;                    allow-nat-networks disable&#xA;                    allow-public-networks disable&#xA;                    esp-group ESP&#xA;                    local {&#xA;                        prefix 10.113.0.0/24&#xA;                    }&#xA;                    remote {&#xA;                        prefix 192.xx.yy.38/32&#xA;                    }&#xA;                }&#xA;                tunnel 2 {&#xA;                    allow-nat-networks disable&#xA;                    allow-public-networks disable&#xA;                    esp-group ESP&#xA;                    local {&#xA;                        prefix 10.113.0.0/24&#xA;                    }&#xA;                    remote {&#xA;                        prefix 192.xx.yy.39/32&#xA;                    }&#xA;                }&#xA;                tunnel 3 {&#xA;                    allow-nat-networks disable&#xA;                    allow-public-networks disable&#xA;                    esp-group ESP&#xA;                    local {&#xA;                        prefix 10.113.0.0/24&#xA;                    }&#xA;                    remote {&#xA;                        prefix 192.xx.yy.40/32&#xA;                    }&#xA;                }&#xA;                tunnel 4 {&#xA;                    allow-nat-networks disable&#xA;                    allow-public-networks disable&#xA;                    esp-group ESP&#xA;                    local {&#xA;                        prefix 10.113.0.0/24&#xA;                    }&#xA;                    remote {&#xA;                        prefix 192.xx.yy.41/32&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27240" LastActivityDate="2019-01-12T08:44:00.950" Title="VyOS / Cisco ASA 5520 site-to-site VPN traffic drops after ~10 minutes" Tags="|cisco-asa|vpn|nat|vyatta|vyos|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32339" PostTypeId="2" ParentId="32335" CreationDate="2016-06-17T13:51:24.347" Score="3" Body="&lt;p&gt;Access points use &lt;a href=&quot;https://en.wikipedia.org/wiki/Beacon_frame&quot; rel=&quot;nofollow&quot;&gt;beacons&lt;/a&gt; to give away their position to other hosts, such as laptops and smartphones. Then these hosts connect to the access point, the same way they would connect to a wired network, although they use another transmission medium, in this case the air.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then services like the ones you mentioned just interact with the access point, which transfers the frames to the other stations (and the other way around). As far as I know, Chromecast can also interact point-to-point without a LAN, but I'm not sure if it creats an adhoc network or not.&lt;/p&gt;&#xA;" OwnerUserId="23459" LastActivityDate="2016-06-17T13:51:24.347" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32341" PostTypeId="1" AcceptedAnswerId="32350" CreationDate="2016-06-17T15:26:34.340" Score="1" ViewCount="5837" Body="&lt;p&gt;I download IOS from Cisco TAC and trying to load on ASR1006 but getting following error. I have compared bytes and they are same &lt;code&gt;671089864&lt;/code&gt; on cisco TAC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco TAC they have &lt;code&gt;MD5 hash&lt;/code&gt; &amp;amp; &lt;code&gt;SHA512&lt;/code&gt; but i am not seeing any &lt;code&gt;SHA-1&lt;/code&gt; How do i validate its correct image? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Boot image size = 671089864 (0x280004c8) bytes&#xA;&#xA;Missing or illegal ip address for variable DEFAULT_GATEWAY&#xA;Using midplane macaddr&#xA;Missing or illegal ip address for variable IP_ADDRESS&#xA;Missing or illegal ip address for variable IP_SUBNET_MASK&#xA;Package header rev 0 structure detected&#xA;Calculating SHA-1 hash...done&#xA;validate_package: SHA-1 hash:&#xA;    calculated ab6ca70a:a204b225:b6737d1a:219743dd:35a077b4&#xA;    expected   a2a1b227:5abeaabe:dca9b25f:0bdceb83:d213e622&#xA;SHA-1 hash doesn't match&#xA;boot: error executing &quot;boot bootflash:asr1000rp2-adventerprisek9.03.16.03.S.155-3.S3-ext.bin&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Update-1:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I did validate IOS and it generate correct md5sum, then why SHA-1 having issue?  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;verify /md5 (bootflash:asr1000rp2-adventerprisek9.03.16.03.S.155-3.S3-ext.bin) = 4093a0efb11f472c5d8f31e91cc0324f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Update-2:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I have re-download new IOS and got same error, it is something else not IOS&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2016-06-17T17:56:47.950" LastActivityDate="2016-06-17T20:59:38.287" Title="Cisco IOS SHA-1 hash doesn't match" Tags="|cisco|cisco-ios|cisco-asr|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32342" PostTypeId="1" AcceptedAnswerId="32343" CreationDate="2016-06-17T15:32:36.100" Score="1" ViewCount="147" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;For example: advertise all /24s from OSPF into BGP, but not the /32s.&#xA;  Impossible to do with access lists.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;the above statement can be found in this forum, in a question related to the differences between Cisco IOS ACLs and Cisco IOS prefix lists&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/789/difference-between-access-list-and-prefix-list&quot;&gt;Difference between access list and prefix list?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1647" LastEditorUserId="8499" LastEditDate="2019-01-04T23:07:52.913" LastActivityDate="2019-01-04T23:07:52.913" Title="Why is it impossible to advertise all OSPF /24 and not all /32 into BGP by using ACLs" Tags="|cisco|routing|cisco-ios|prefix|route-filter|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32343" PostTypeId="2" ParentId="32342" CreationDate="2016-06-17T15:45:40.900" Score="1" Body="&lt;p&gt;You could use ACLs to specifically do this, but you would need an ACL entry for each network, and any network changes would necessitate a change to the ACL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a prefix list, you can do every current or future network of a particular size, or range of sizes, with a single line. I think this is the sort of thing that the quote meant, but you haven't provided the source, so I can't see the context.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update based on comments:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The word, &quot;impossible,&quot; seems to be poorly explained. It is impossible to account for every possible case because the ACL would be far too large for any router. What the ACL really can't do, the prefix list can do with a single line.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-17T16:20:02.300" LastActivityDate="2016-06-17T16:20:02.300" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32344" PostTypeId="1" CreationDate="2016-06-17T16:03:35.833" Score="2" ViewCount="1506" Body="&lt;p&gt;I have two ISPs, one static and one PPPoE. I use VyOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did the configuration with two static IP providers but when it comes to PPPoE I don't know what to write as the next hop for the interface health. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface-health pppoe0 {&#xA;        failure-count 1&#xA;        nexthop ???&#xA;        success-count 1&#xA;        test 10 {&#xA;            resp-time 5&#xA;            target 8.8.8.8&#xA;            ttl-limit 1&#xA;            type ping&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is the next hop of a PPPoE connection always the same or it can change once disconnected and connected again?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="23239" LastActivityDate="2018-10-20T20:37:07.100" Title="vyos, wan load balancing with one static and one pppoe connection" Tags="|wan|load-balancing|vyatta|vyos|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32347" PostTypeId="1" AcceptedAnswerId="32348" CreationDate="2016-06-17T19:37:02.157" Score="2" ViewCount="5904" Body="&lt;p&gt;Consider the following scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host B has IP 192.168.0.100 and host A has IP 192.168.0.110 and they are connected to a Layer 3 managed switch having IP 192.168.0.254 on a particular broadcast domain (lets say VLAN 10)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Theory 1 (which I believe to be false)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When B initially tries to ping 192.168.0.110. It will send an ARP request to FF:FF:FF:FF:FF:FF asking who has 192.168.0.110 and the switch will only flood this request on all ports in the VLAN, if and only if it doesn't have an ARP entry in its own ARP table showing the entry for 192.168.0.110. If it has such an entry it won't even forward the ARP request to Host A and will reply with the MAC address for 192.168.0.110 from its own ARP cache with the MAC address of A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Theory 2 (Which I believe to be correct).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch will not intervene in the ARP process even if it has an ARP entry for the IP being queried for. If B (or any other host in this broadcast domain) sends an ARP request for 192.168.0.110 to FF:FF:FF:FF:FF:FF the switch will just broadcast it to the domain and let host A respond for itself to this ARP request. This will happen even if the switch as an ARP entry for A (192.168.0.110) in its own ARP table. The switches own ARP table is only for its own communication (from its IP 192.168.0.254) with the hosts in the VLAN, and it doesn't act like a caching ARP proxy as stipulated in Theory 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which of the above scenarios is accurate? Do some switches actually behave in the manner described in Theory 1?&lt;/p&gt;&#xA;" OwnerUserId="24379" LastEditorUserId="8499" LastEditDate="2016-06-17T22:10:35.593" LastActivityDate="2016-11-13T11:14:45.153" Title="Do any switches respond to ARP requests for IPs which don't belong to them?" Tags="|vlan|switching|arp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32348" PostTypeId="2" ParentId="32347" CreationDate="2016-06-17T19:42:23.820" Score="2" Body="&lt;p&gt;The switch, while a layer-3 switch, is only a layer-2 switch for a LAN. As a layer-2 switch, the switch doesn't get involved with the ARP request/reply, unless it is the target of the ARP request, or it is making the ARP request. Of note is that the SVI address of the layer-3 switch is just another host on the LAN, and it will update its layer-3 ARP cache when it sees the ARP request, but it will not actually interpose itself in the process between the two hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch will also update its MAC address table for the LAN with any frame coming into any of its layer-2 interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-17T19:42:23.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32350" PostTypeId="2" ParentId="32341" CreationDate="2016-06-17T20:59:38.287" Score="2" Body="&lt;h1&gt;Solution:&lt;/h1&gt;&#xA;&lt;p&gt;Talked to Cisco TAC support and they found rommon (Firmware Version) has bug, and they upgrade following two component&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;R1#upgrade rom-monitor filename bootflash:asr1000-rommon-155-3r.S1.pkg R0&#xA;&#xA;R1#upgrade rom-monitor filename bootflash:asr1000-rommon-155-3r.S1.pkg F0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-06-17T20:59:38.287" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32354" PostTypeId="1" CreationDate="2016-06-18T07:46:57.483" Score="0" ViewCount="324" Body="&lt;p&gt;I have to build a 5GbE link with a SFP+. Can i use the one that is rated for 8Gbps? And what kind of NIC should I use on host PC? &lt;/p&gt;&#xA;" OwnerUserId="27255" LastEditorUserId="8499" LastEditDate="2019-01-03T01:26:42.800" LastActivityDate="2019-01-03T01:26:42.800" Title="5GbE over fiber optic cable with SFP+" Tags="|layer1|cable|fiber|sfp|transceiver|" AnswerCount="1" CommentCount="0" ClosedDate="2016-06-20T07:20:50.560" ContentLicense="CC BY-SA 3.0" />
  <row Id="32355" PostTypeId="2" ParentId="32354" CreationDate="2016-06-18T08:02:19.523" Score="2" Body="&lt;p&gt;Both 5 Gbps and 8 Gbps are non-standard ethernet speeds, and you won't find those speeds on SFP+s. In fact, you will not find 8 Gbps ethernet at all. If you are using fiber, you will get 10 Gbps, but you must make sure of the fiber and length, which must match the SPF+, which must also match the SFP+ on the other end. Some copper SFP+s can also do 1 Gbps (possibly 100 Mbps and 10 Mbps), besides 10 Gbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some switches from members of the  NBASE-T Alliance have ports which can do 2.5  or 5 Gbps, besides the standard 10 or 100 Mbps, and 1 or 10 Gbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is unlikely that you will find a host NIC that can do either 5 or 8 Gbps. There are server NICs which can do 10 Gbps.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-18T08:02:19.523" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="32356" PostTypeId="1" AcceptedAnswerId="32357" CreationDate="2016-06-18T09:17:49.473" Score="2" ViewCount="618" Body="&lt;p&gt;I have tried without success to capture to NVRAM on a Dell 2024. Here's what I have tried:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enable&#xA;configure&#xA;monitor capture file size 512&#xA;monitor capture mode file&#xA;exit&#xA;&#xA;monitor capture start&#xA;&#xA;&amp;lt;generate traffic ...&amp;gt;&#xA;&#xA;monitor capture stop&#xA;&#xA;copy flash://cpuPktCapture.pcap scp://&amp;lt;user&amp;gt;@&amp;lt;ip&amp;gt;/home/pi/cpuPktCapture.pcap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All the monitor commands execute without an error. The copy command generates:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ERROR: File cpuPktCapture.pcap not exist!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;During capturing, &lt;code&gt;show monitor capture&lt;/code&gt; shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;g05hsw01#show monitor capture&#xA;&#xA;Operational Status............................. Enabled&#xA;Current Capturing Type......................... File&#xA;Capturing Traffic Mode......................... Tx/Rx&#xA;Line Wrap Mode................................. Disabled&#xA;RPCAP Listening Port........................... 2002&#xA;RPCAP dump file size (KB)...................... 512&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Related question: is there a way to get a listing of the files in the switch's file system?&lt;/p&gt;&#xA;" OwnerUserId="23055" LastActivityDate="2016-06-18T09:35:23.633" Title="Dell N2000: How to capture PCAP to NVRAM?" Tags="|dell|powerconnect|pcap|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32357" PostTypeId="2" ParentId="32356" CreationDate="2016-06-18T09:35:23.633" Score="1" Body="&lt;p&gt;Trying &lt;code&gt;dir&lt;/code&gt; seems to have solved your problem, showing you the real file name.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-18T09:35:23.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32358" PostTypeId="1" AcceptedAnswerId="32359" CreationDate="2016-06-18T11:15:09.217" Score="17" ViewCount="19830" Body="&lt;p&gt;We know MAC address is unique in each devices.So why can't we just send/receive data using MAC address only?&lt;/p&gt;&#xA;" OwnerUserId="25838" LastEditorUserId="25838" LastEditDate="2016-06-19T17:14:00.633" LastActivityDate="2016-06-19T17:14:00.633" Title="Why don't we use MAC address instead of IP for having &quot;Internet&quot; or doing communication?" Tags="|ipv4|ip|ipv6|mac-address|ip-address|" AnswerCount="2" CommentCount="3" ClosedDate="2016-06-20T07:16:09.540" ContentLicense="CC BY-SA 3.0" />
  <row Id="32359" PostTypeId="2" ParentId="32358" CreationDate="2016-06-18T11:34:55.467" Score="10" Body="&lt;p&gt;MAC is Media Access Control which provides physical connectivity only. IP Address provides Host or Network interface Identification and Location addressing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your second question, Let we have two connections, one is for Local connection and other is for internet or virtual machines are running in the system. what happen the IP of both connection will be different but the physical address of machine same. In this case what will you do? In this case IP address defines the address where the system will communicate. &lt;/p&gt;&#xA;" OwnerUserId="27257" LastEditorUserId="27257" LastEditDate="2016-06-18T11:42:20.627" LastActivityDate="2016-06-18T11:42:20.627" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32360" PostTypeId="1" CreationDate="2016-06-18T13:18:53.573" Score="4" ViewCount="1497" Body="&lt;p&gt;The network topology is router A and router B are directly connected with IP addresses configured on their physical interfaces &lt;code&gt;int gig 0/0/1 and gig0/0/2&lt;/code&gt;. The third &lt;code&gt;interface gig0/0/3&lt;/code&gt; is configured as a layer-2 trunk port, and VLAN 12 is allowed to pass on router A and connect to router B's &lt;code&gt;interface gig 0/0/3&lt;/code&gt; layer-2 trunk port. The IGP &lt;code&gt;ospf 100&lt;/code&gt; is configured on both routers and enabled at &lt;code&gt;int gig 0/0/1 and gig0/0/2&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have multiple IP addresses on the VLAN interface as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlanif 12&#xA;ip address 97.119.51.7 255.255.255.224&#xA;ip address 97.130.115.16 255.255.255.224 sub&#xA;ip address 97.116.60.23 255.255.255.224 sub&#xA;ip address 97.112.24.18 255.255.255.224 sub&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These are advertised in &lt;code&gt;router ospf&lt;/code&gt; by network statements in &lt;code&gt;ospf 100&lt;/code&gt;, but by mistake, network &lt;code&gt;97.119.51.0 0.0.0.31&lt;/code&gt; was skipped when configuring the OSPF process network statement. The directly connected router B does not show the route of the subinterface IP addresses of &lt;code&gt;97.130.115.16, 97.116.60.23 and 97.112.24.18&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the concept of multiple IP addresses on a interface, and where it is used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why does OSPF fail to advertise the subinterface IP address when the primary IP address network &lt;code&gt;97.119.51.0 0.0.0.31&lt;/code&gt; of VLAN 12 has been skipped in the OSPF configuration?&lt;/p&gt;&#xA;" OwnerUserId="8007" LastEditorUserId="8499" LastEditDate="2016-06-18T17:30:04.297" LastActivityDate="2019-01-05T10:02:30.543" Title="Multiple ip address on a interface advertisement" Tags="|cisco|router|ipv4|ip|ospf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32361" PostTypeId="1" CreationDate="2016-06-18T13:59:25.670" Score="1" ViewCount="331" Body="&lt;p&gt;I would like to push IOS code to Cisco devices via snmp to bulk devices.&#xA;I have linux box as ftp server with ftp, scp protocol enabled. &#xA;it would help me a lot, please tell me the procedure.&#xA;Thanks for your help in advance&lt;/p&gt;&#xA;" OwnerUserId="27260" LastActivityDate="2016-06-18T19:57:41.483" Title="Cisco IOS code copy from tftp or scp server to device using snmp" Tags="|cisco-ios|snmp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32363" PostTypeId="2" ParentId="19422" CreationDate="2016-06-18T16:15:42.593" Score="0" Body="&lt;p&gt;You can enable snmp on the switch you want to monitor and use a grapher like PRTG or Cacti to look at your traffic. &lt;/p&gt;&#xA;" OwnerUserId="27263" LastActivityDate="2016-06-18T16:15:42.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32364" PostTypeId="2" ParentId="7935" CreationDate="2016-06-18T17:09:29.303" Score="0" Body="&lt;p&gt;Increase the buffer size on the switch and log level 7 if you don't have a logging server. The other device you want to be looking at is your layer 3 since you're crossing segments.&lt;/p&gt;&#xA;" OwnerUserId="27264" LastActivityDate="2016-06-18T17:09:29.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32365" PostTypeId="2" ParentId="32360" CreationDate="2016-06-18T17:21:16.680" Score="1" Body="&lt;p&gt;You have the Cisco tag on your question, but the secondary address doesn't participate in the OSPF process. Normally, you only have one IPv4 network per VLAN, and you create multiple VLANs using subinterfaces. Subinterfaces are virtual interfaces, but they act just like real interfaces. Normally, you will define &lt;code&gt;dot1q&lt;/code&gt; encapsulation on the subinterface so that the overall physical interface forms a layer-2 trunk, and each VLAN has its own network. The physical interface itself can have a network, and may, or may not, have &lt;code&gt;dot1q&lt;/code&gt; encapsulation. If it doesn't, it will be the native VLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When configuring OSPF, the network statements tell OSPF which interfaces will participate in the OSPF process, and in which are those interfaces are. Secondary networks configured on interfaces do not participate in the OSPF process, although they may be advertised in OSPF. You can have a single OSPF network statement which encompasses multiple interfaces, e.g. &lt;code&gt;network 0.0.0.0 255.255.255.255 area 1234&lt;/code&gt; will run OSPF on all interfaces, and all the interfaces will be in Area 1234.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any interface, physical or virtual, not covered by an OSPF network statement will not participate in OSPF, and you would need to do something else, e.g. redistribution, to advertise the networks on those interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-16T21:44:24.307" LastActivityDate="2016-10-16T21:44:24.307" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32366" PostTypeId="1" AcceptedAnswerId="47184" CreationDate="2016-06-18T18:42:25.160" Score="3" ViewCount="722" Body="&lt;p&gt;Any router will automatically join at least two multicast groups on each interface. How do I see that on a Cisco router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that they all join these two groups: all multicast nodes and all routers.&lt;/p&gt;&#xA;" OwnerUserId="1647" LastEditorUserId="33" LastEditDate="2018-01-20T03:48:17.067" LastActivityDate="2018-01-20T03:48:17.067" Title="Any router will automatically join at least two multicast groups on each interface. How do I see that on a Cisco router?" Tags="|ipv6|multicast|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32367" PostTypeId="2" ParentId="32361" CreationDate="2016-06-18T18:58:47.713" Score="2" Body="&lt;p&gt;You can run command on Cisco IOS using SNMP but its little complicated and not standard practice but anyway just following this document &lt;a href=&quot;http://www.ciscozine.com/send-cisco-commands-via-snmp/&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscozine.com/send-cisco-commands-via-snmp/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would prefered using shell script to rancid tool to execute command on cisco devices. &lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-06-18T18:58:47.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32372" PostTypeId="2" ParentId="32358" CreationDate="2016-06-18T22:37:38.997" Score="7" Body="&lt;p&gt;1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for that is the routing. If you have an IP, for example 104.103.84.161 for the www.microsoft.com, every router on the Internet knows, where to send packets to this IP address. They are organized into a tree-like structure in the Internet, where the IP networks of the organizations have a global registry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of the MAC addresses, there is no such thing. From a MAC address you can only see which company manufactured the chip, but no more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC addresses are normally fixed in the NIC firmware, while IP addresses can be freely set everywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also a deeper reason: in the cases of the NIC, there is no guarantee that you want to make IP traffic on them, it is only a quasi-common standard. Earlier existed different protocols (for example, IPX, or the microsoft win2000 servers also had one) which didn't use IP, but another protocol over the NIC cards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP is the standard of the Internet, while the MAC is the standard of the Ethernet. It is not obligatory to use IP from Ethernet, for example in the ancient times there were ARCNET cards which used a quite different protocol (as I know, their &quot;MAC&quot; were much shorter, too).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or there are VPN protocols which also traffic only IP packets without an Ethernet frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, IP is the common of the Internet, and you can connect into it with everything. Most people connects with Ethernet packets but it is not needed.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Btw, having an &quot;Internet&quot; which uses MAC addresses instead of IP, would be possible, although it would require to develop the complex protocols and shared databases on every protocol layer to use them. They are developed for IP in the times where the Ethernet didn't even existed. So, the final answer to your question is the social inertia.&lt;/p&gt;&#xA;" OwnerUserId="20757" LastActivityDate="2016-06-18T22:37:38.997" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32377" PostTypeId="1" CreationDate="2016-06-19T22:44:07.267" Score="1" ViewCount="2544" Body="&lt;p&gt;We have created peer with our ISP and my ISP send community to do backhole but how do i configure that and send community string for blackhole traffic.&lt;/p&gt;&#xA;&lt;p&gt;ISP said use &lt;code&gt;64682:0&lt;/code&gt; community for RTBH, I did following config but didn't work&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 100&#xA; bgp log-neighbor-changes&#xA; redistribute static route-map RTBH&#xA; neighbor 71.xxx.xxx.61 remote-as 200&#xA; neighbor 71.xxx.xxx.61 send-community&#xA; network 70.xx.xx.0 mask 255.255.255.0&#xA;&#xA;&#xA;route-map RTBH permit 10&#xA; match tag 666&#xA; set community 64682:666&#xA;&#xA;route-map RTBH permit 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I am configured about &lt;code&gt;:0&lt;/code&gt; in community because my router not accepting that.&lt;/p&gt;&#xA;&lt;p&gt;here i am using route to send null.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;ip route 71.x.x.100 255.255.255.255 Null0 tag 666&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;What i am doing wrong?&lt;/p&gt;&#xA;&lt;h1&gt;EDIT:&lt;/h1&gt;&#xA;&lt;p&gt;I was following this Doc to setup community RTBH &lt;a href=&quot;http://cenic.org/network/bgp-blackhole-community&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://cenic.org/network/bgp-blackhole-community&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h1&gt;Update:&lt;/h1&gt;&#xA;&lt;p&gt;I have modify config with following info but still no luck and &lt;code&gt;no auto-summary&lt;/code&gt; is default in BGP&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;route-map RTBH permit 10&#xA; match tag 666&#xA; set community 64682:0&#xA; set ip next-hop 192.0.2.1&#xA;!&#xA;route-map RTBH permit 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Debug info:&lt;/p&gt;&#xA;&lt;p&gt;When i trigger null route i got following debug &lt;code&gt;debug ip routing&lt;/code&gt; logs&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;R1#&#xA;*Jun 20 15:38:23.212: RT: updating static 70.xx.xx.1/32 (0x0)  :&#xA;    via 0.0.0.0 Nu0  0 1048578&#xA;&#xA;*Jun 20 15:38:23.212: RT: rib update return code: 17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2019-01-05T00:14:42.757" Title="BGP community blackhole" Tags="|cisco|routing|bgp|security|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32378" PostTypeId="2" ParentId="32377" CreationDate="2016-06-20T01:21:46.020" Score="1" Body="&lt;p&gt;You should apply your route-map on BGP peer to send &#xA;community attribute to your ISP by this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; neighbor {ip-address| group-name} route-map map-name {in | out} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;applying route-map on &lt;code&gt;redistribute&lt;/code&gt; is for filtering routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;Look for other answers. They're definitely better than mine. :)&lt;/p&gt;&#xA;" OwnerUserId="20657" LastEditorUserId="20657" LastEditDate="2016-06-21T08:36:05.800" LastActivityDate="2016-06-21T08:36:05.800" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32381" PostTypeId="2" ParentId="32377" CreationDate="2016-06-20T06:26:26.493" Score="0" Body="&lt;p&gt;Unless you configure &quot;neighbor  send-community&quot; the communities attached to the prefix won't be sent to the neighbor.&lt;/p&gt;&#xA;" OwnerUserId="317" LastActivityDate="2016-06-20T06:26:26.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32383" PostTypeId="2" ParentId="29456" CreationDate="2016-06-20T07:47:33.130" Score="0" Body="&lt;p&gt;Actually, both two options will provide the connection. Buy technically, the first option is preferable, since Cat 6 wall jack uses solid cable which ensures better signals.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-06-20T07:47:33.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32384" PostTypeId="1" AcceptedAnswerId="32393" CreationDate="2016-06-20T08:42:06.487" Score="4" ViewCount="18014" Body="&lt;p&gt;One of my Server is sitting behind a network which is only accessible trough a IPV6 (no double stack IPv4/IPV6 available).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I access the server (SSH, HTTP, other protocols) from an network where IPv6 is not available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've search for possible technical solutions and there is 4to6 bridge or other such as &lt;a href=&quot;https://www.sixxs.net&quot; rel=&quot;nofollow&quot;&gt;https://www.sixxs.net&lt;/a&gt;  (as example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is there an other technical solution which could be similar to sixxs.net (4to6 bridge) which allow all well knowns protocols (ssh, http, ...)&lt;/li&gt;&#xA;&lt;li&gt;Is there an other solution / workaround / service which let me access my ipv6 only server from a ipv4 only network.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="27223" LastEditorUserId="27223" LastEditDate="2016-06-20T15:15:48.390" LastActivityDate="2023-06-01T14:20:12.580" Title="Access Server ipv6 from a ipv4 only network" Tags="|ipv4|ipv6|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32387" PostTypeId="1" CreationDate="2016-06-20T09:46:46.953" Score="0" ViewCount="302" Body="&lt;p&gt;i want to know if it is possible to passively send Wi-Fi frames (RTS/CTS?) to a device, knowing only the mac address. If so, is there any tool, on Kali Linux, to do a such thing? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The device is a smartphone in my Wi-Fi zone, but not in the same network.)&lt;/p&gt;&#xA;" OwnerUserId="27288" LastEditorUserId="8499" LastEditDate="2016-06-20T18:00:29.273" LastActivityDate="2016-06-20T18:00:29.273" Title="Is it possible to passively send a Wi-Fi frame to a device not in the same network?" Tags="|ieee-802.11|mac-address|linux|access-point|mobile|" AnswerCount="2" CommentCount="3" ClosedDate="2017-08-14T14:29:27.020" ContentLicense="CC BY-SA 3.0" />
  <row Id="32389" PostTypeId="2" ParentId="32387" CreationDate="2016-06-20T10:17:27.297" Score="1" Body="&lt;p&gt;I don't think this is possible based on the fact that frames are not being forwarded through to a network that is not on the same subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are saying that the device (mobile) is on a seperate network, then you would rely on layer 3 to communicate with it as it would need to pass through a gateway. The gateway being probably a router would not forward any frames on but would remove the frame from the layer 3 packet and place a new frame around it based on information from the router and forward it on, to the next device.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-20T10:17:27.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32392" PostTypeId="1" AcceptedAnswerId="32394" CreationDate="2016-06-20T12:36:44.287" Score="2" ViewCount="458" Body="&lt;p&gt;I have an existing switch configuration which works, but is not satisfactory, and I want to switch to a different configuration that seems straightforward but I cannot get to work in production, though my scripts work perfectly in a staging setup here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a rack in a distant DC. We have 2 stacked Dell N2024s, and various servers. Our ISP has supplied us with 2 subnets - one is a /26 range of public IPs, and the other is a /30 range, for routing: they have &lt;code&gt;.165&lt;/code&gt; at their end and we must have &lt;code&gt;.166&lt;/code&gt; at our end which they will use as a gateway. Currently, we have a gateway server which has the &lt;code&gt;.166&lt;/code&gt; allocated to one of its ethernet ports. What I want is to allocate &lt;code&gt;.166&lt;/code&gt; to the switch, so that other devices can stay available even if the gateway host goes down (one of which is the gateway host's iDRAC), essentially using the layer 3 routing features of the switch to make it behave a bit like a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to apply updates to both the gateway host and the switch via &lt;code&gt;screen&lt;/code&gt;, which I have set up to reboot both GFW and server if I cannot get in after the config updates, which so far has happened 100% of the time. I have however been able to collect, diagnostics, logs and PCAPs of me trying to ping the &lt;code&gt;.166&lt;/code&gt; address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a great deal of data I can share, but I will start with the basics, and perhaps anyone who is willing to help could tell me what needs to be expanded upon. The gist of the process is this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;ssh to gateway via switch, on &lt;code&gt;.166&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;connect to switch CLI via 10.x.x.x network via a different port to the &lt;code&gt;166&lt;/code&gt; interface.&lt;/li&gt;&#xA;&lt;li&gt;download the modification script to the switch&lt;/li&gt;&#xA;&lt;li&gt;run screen scripts to take down the switch ports to &lt;code&gt;.166&lt;/code&gt; on the gateway, and configure the switch with a new VLAN and give it the &lt;code&gt;.166&lt;/code&gt; ip address.&lt;/li&gt;&#xA;&lt;li&gt;collect diagnostics and capture PCAP.&lt;/li&gt;&#xA;&lt;li&gt;screen script reloads switch and reboots gateway host to get us back to the current setup.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The PCAP shows ping ICMPs arriving at the switch, but it doesn't reply. I can also see the switch sending ARP requests. Here are a few data points concerning the configuration (I have much more detail if needed), with x's to protect public subnets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip routing&lt;/code&gt; is enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am setting up the &lt;code&gt;.166&lt;/code&gt; address in vlan 4010.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 4010&#xA;ip address x.x.8.166 255.255.255.252&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the routing table after the configuration changes have been applied:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;No default gateway is configured.&#xA;C      *10.x.x.x/15 [0/0] directly connected,   Vl999&#xA;C      *x.x.8.164/30 [0/0] directly connected,   Vl4010&#xA;C      *x.x.13.192/26 [0/0] directly connected,   Vl4000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am using ACLs to manage inter-VLAN routing. I am currently allowing 'any' ip to access the router subnet from the internet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list internet-to-router&#xA;permit ip any x.x.8.164 0.0.0.3&#xA;exit&#xA;&#xA;route-map internet-routing deny 20&#xA;match ip address internet-to-router&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note I am using &lt;code&gt;deny&lt;/code&gt; in the route-map to fall back to using the routing table (shown above), but I have also tried &lt;code&gt;permit&lt;/code&gt; and that doesn't work either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see that my pings are hitting the route-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map &quot;internet-routing&quot; deny 20&#xA;     Match clauses:&#xA;       ip address (access-lists) : internet-to-router&#xA;     Set clauses:&#xA;Policy routed: 17 packets, 0 bytes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I don't get any response from &lt;code&gt;.166&lt;/code&gt;. Any suggestions would be very welcome.&lt;/p&gt;&#xA;" OwnerUserId="23055" LastEditorUserId="23055" LastEditDate="2016-06-20T14:36:09.390" LastActivityDate="2016-06-20T14:36:09.390" Title="Dell N2000: switch will not respond on configured in-band IP" Tags="|routing|vlan|ip|acl|powerconnect|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32393" PostTypeId="2" ParentId="32384" CreationDate="2016-06-20T12:44:46.497" Score="7" Body="&lt;p&gt;If the dual-stack option is not viable for you, then you will need to use the tunnel option, I believe.&lt;/p&gt;&#xA;&lt;p&gt;You can try the list on Wikipedia that has several brokers listed, and perhaps you will find a provider that suits you.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://web.archive.org/web/20220528205021/https://en.wikipedia.org/wiki/List_of_IPv6_tunnel_brokers&quot; rel=&quot;nofollow noreferrer&quot;&gt;WIKI here&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Alternatively you can perhaps setup your own tunnel if you get an intermediary server that runs IPv6 and IPv4 using the instructions listed &lt;a href=&quot;https://web.archive.org/web/20160912004129/https://www.smashnet.de/?p=736&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="89931" LastEditDate="2023-06-01T14:20:12.580" LastActivityDate="2023-06-01T14:20:12.580" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="32394" PostTypeId="2" ParentId="32392" CreationDate="2016-06-20T12:54:35.223" Score="1" Body="&lt;p&gt;The only thing that I have spotted at the moment is that you have no default route. Currently you have traffic only destined to &lt;strong&gt;x.x.8.164/30&lt;/strong&gt; routed out of VLAN 4010.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this interface goes to the internet I would expect something like the following to be added to tell it that anything not found in the routing table (ie. Internet), send out out the vlan that is connected to your providers IP.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Router(config)#ip route 0.0.0.0 0.0.0.0 x.x.x.165&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="27056" LastEditDate="2016-06-20T12:59:44.483" LastActivityDate="2016-06-20T12:59:44.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32395" PostTypeId="2" ParentId="32260" CreationDate="2016-06-20T13:12:41.107" Score="1" Body="&lt;p&gt;I was able to solve this as the host I was connected to was also connected to a second port on the switch via a different subnet. I used a backgrounded &lt;code&gt;screen&lt;/code&gt; session to keep the connection open and keep delivering commands even when my own connection disappeared. It also allowed me to script a &lt;code&gt;reboot&lt;/code&gt; command in case the update failed and I couldn't get in.&lt;/p&gt;&#xA;" OwnerUserId="23055" LastActivityDate="2016-06-20T13:12:41.107" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32399" PostTypeId="2" ParentId="32387" CreationDate="2016-06-20T13:47:49.193" Score="1" Body="&lt;p&gt;MAC addresses are only significant on the LAN on which they originated, and the frame headers containing the MAC addresses are stripped off a packet at a layer-3 boundary (router), which is necessary to get from one network to another network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a host needs to communicate with another host on a different network, the destination MAC address in the frame header is the MAC address of the sending host's configured gateway, not the MAC address of the destination host, which is meaningless on the sending hosts LAN. The gateway will then strip the frame from the packet, switch it to the next interface in the path toward the destination, and build a new frame for the next interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-20T13:47:49.193" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32400" PostTypeId="1" CreationDate="2016-06-20T13:51:41.980" Score="1" ViewCount="580" Body="&lt;p&gt;I'm currently designing a terminal-server architecture, using KVM-Over-IP technology (I'm using Gefen devices) where I have four VLANs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One VLAN for the displays at 192.168.240.0/24&lt;/li&gt;&#xA;&lt;li&gt;Three VLANs for the servers. Why three? Because there are three kinds of servers and they're grouped together. This is imposed and cannot be changed. They're at .241.0, .242.0 and .243.0 respectively.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm using a Cisco 3750G Layer 3 Switch. I've configured all the VLANs with their gateways (.1) and there's proper connectivity between the devices. So far so good. The configuration is as follows (this is an excerpt, the rest are the default values)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;!&#xA;&#xA;interface GigabitEthernet1/0/1&#xA; switchport access vlan 2&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; switchport access vlan 10&#xA;!&#xA;interface GigabitEthernet1/t0/3&#xA; switchport access vlan 20&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA; switchport access vlan 30&#xA;!&#xA;interface Vlan2&#xA; ip address 192.168.240.1 255.255.255.0&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.241.1 255.255.255.0&#xA;!&#xA;interface Vlan20&#xA; ip address 192.168.242.1 255.255.255.0&#xA;!&#xA;interface Vlan30&#xA; ip address 192.168.243.1 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, the KVM devices (these &lt;a href=&quot;http://www.gefen.com/kvm/ext-dvikvm-lan-l.jsp?prod_id=14937&quot; rel=&quot;nofollow&quot;&gt;Gefen DVI KVM devices&lt;/a&gt;) cannot &lt;em&gt;auto discover&lt;/em&gt; other KVM devices in different VLANs. That's to be expected, because broadcast messages do not cross VLAN boundaries. After further investigation, looks like these devices use multicast groups to &lt;em&gt;annonunce&lt;/em&gt; themselves, using standard TCP connections afterwards to stablish the video transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to fix the problem, I've enabled &lt;code&gt;multicast-routing distributed&lt;/code&gt; and also tried activating sparse-dense mode. Using wireshark with port mirroring I can see some &lt;code&gt;Membership Report&lt;/code&gt; messages from the devices within a VLAN, and &lt;code&gt;PIM&lt;/code&gt; protocol messages coming from the VLAN interface (.1), but the devices fail to see each other still.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, from scratch, how should I configure the 3750G so multicast traffic is shared between VLANs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: So far I've tried setting up multicast-routing as per the manual (section 47-12):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip multicast-routing distributed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On each vlan interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip pim sparse-dense-mode&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IGMP is enabled by default. This does nothing. I've also tried using MVR but I'm not sure if that's the proper tool for it.&lt;/p&gt;&#xA;" OwnerUserId="27293" LastEditorUserId="27293" LastEditDate="2016-06-21T11:15:14.530" LastActivityDate="2016-06-21T11:15:14.530" Title="Multicast forwarding through VLANs for KVM Over Ip" Tags="|cisco|switch|multicast|layer3|" AnswerCount="1" CommentCount="3" ClosedDate="2017-08-14T14:28:24.527" ContentLicense="CC BY-SA 3.0" />
  <row Id="32401" PostTypeId="2" ParentId="32377" CreationDate="2016-06-20T14:17:07.083" Score="1" Body="&lt;p&gt;The Cisco documents provide a full explanation for the options, and examples of how to configure your router, depending on the ISP requirements. Be sure to read and understand the text. It explains what you need to do, and why you need to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a very good Cisco document, and an example of one way to do this (your ISP may not do it this way):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/dam/en_us/about/security/intelligence/blackhole.pdf&quot; rel=&quot;nofollow&quot;&gt;REMOTELY TRIGGERED BLACK HOLE FILTERING — DESTINATION BASED AND SOURCE BASED&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Trigger Router&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This section provides a sample configuration listing for the trigger&#xA;  router. In this configuration, peer groups are used because it is the&#xA;  preferred way to configure a large number of BGP peers with similar&#xA;  characteristics. You must set the send-community for all these peers&#xA;  so they receive the noexport community and respect it by not&#xA;  advertising this redistributed route to any of their external peers.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Also, make sure to set no auto-summary so that specific host routes&#xA;  can be black holed. Otherwise BGP will automatically summarize the&#xA;  route based on class boundaries. Static routes are then redistributed&#xA;  into BGP after applying the black hole-trigger route map.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;trigger#sh run&#xA;Building configuration...&#xA;version 12.1&#xA;!&#xA;hostname trigger&#xA;!&#xA;ip subnet-zero&#xA;!&#xA;interface Loopback0&#xA; ip address 192.168.255.245 255.255.255.255&#xA;!&#xA;interface Null0&#xA; no ip unreachables&#xA;!&#xA;interface Ethernet0/0&#xA; ip address 192.168.4.3 255.255.255.0&#xA; half-duplex&#xA;!&#xA;router ospf 100&#xA; log-adjacency-changes&#xA; redistribute connected subnets&#xA; network 192.168.4.0 0.0.0.255 area 0&#xA;router bgp 740&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; redistribute static route-map black-hole-trigger&#xA; neighbor black-hole peer-group&#xA; neighbor black-hole remote-as 740&#xA; neighbor black-hole update-source Loopback0&#xA; neighbor black-hole send-community&#xA; neighbor 192.168.255.246 remote-as 740&#xA; neighbor 192.168.255.246 update-source Loopback0&#xA; neighbor 192.168.255.253 peer-group black-hole&#xA; no auto-summary &#xA;!&#xA;ip route 192.0.2.1 255.255.255.255 Null0&#xA;route-map black-hole-trigger permit 10&#xA; match tag 66&#xA; set ip next-hop 192.0.2.1&#xA; set local-preference 200&#xA; set origin igp&#xA; set community no-export&#xA;!&#xA;route-map black-hole-trigger deny 25&#xA;!&#xA;no scheduler allocate&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The last part of this configuration creates a route map to match the&#xA;  route tag 66 and sets route characteristics. A higher value of local&#xA;  preference is desired for choosing a route, so it is set to 200, which&#xA;  is greater than the default value of 100. Also, to make sure that&#xA;  other static routes are not affected by this route map, a deny&#xA;  statement is placed at the end.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-20T14:17:07.083" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32403" PostTypeId="1" CreationDate="2016-06-20T14:48:14.993" Score="1" ViewCount="79" Body="&lt;p&gt;You could label this a theoretical question but I consider it a design question. &#xA;Is is possible to have a large RipNG deployment using multiple RINng instances and &#xA;simulate OSPF like areas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="1647" LastActivityDate="2016-06-25T21:37:28.937" Title="Would multiple RIPng processes improve convergence times and stability and larger RIP deployments" Tags="|ipv6|rip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32404" PostTypeId="2" ParentId="32400" CreationDate="2016-06-20T15:01:23.533" Score="2" Body="&lt;p&gt;To get PIM to work on the cisco switches you can either globally set the multicast to traverse all the VLAN's using the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure&#xA;ip igmp snooping &#xA;bridge multicast filtering&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you wanted to perform it only on certain VLAN's, you will need to configure each vlan interface like so.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure&#xA;ip multicast&#xA;ip igmp&#xA;ip pim sparse&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then configure each interface with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan x&#xA;ip igmp&#xA;ip pim&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, looking quickly at the link to Gefen product you have provided, it states that jumbo frames of 8K need to be enabled. Just in case this is something that is also causing an issue for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-20T15:01:23.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32405" PostTypeId="1" AcceptedAnswerId="32406" CreationDate="2016-06-20T15:04:09.163" Score="3" ViewCount="2296" Body="&lt;p&gt;I would like to understand where advertised route are set in JunOS.&#xA;For example, in OpenBGPd it's easy, you simply set &quot;network 1.2.3.0/24&quot;.&#xA;What is the equivalent in JunOS ? I didn't find anything very clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you in advance for answering&lt;/p&gt;&#xA;" OwnerUserId="23965" LastActivityDate="2016-06-20T15:32:00.723" Title="set advertised route on Juniper" Tags="|router|bgp|juniper-junos|juniper-mx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32406" PostTypeId="2" ParentId="32405" CreationDate="2016-06-20T15:32:00.723" Score="1" Body="&lt;p&gt;JunOS does not use a network command like you would use with a cisco router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to make use of policies and create one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;For BGP you could use&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-statement my-bgp-network {&#xA;term 1 {&#xA;    from {&#xA;        route-filter 100.100.100.0/24 exact;&#xA;    }&#xA;    then accept;&#xA;}&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To configure BGP then you could use something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;protocols {&#xA;bgp {&#xA;group Love-Peer-A {&#xA;type external;&#xA;neighbor 1.1.1.1 {&#xA;export my-bgp-network;&#xA;peer-as 111;&#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope to helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-20T15:32:00.723" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32407" PostTypeId="2" ParentId="20477" CreationDate="2016-06-20T16:36:48.477" Score="0" Body="&lt;p&gt;You can now go into ASDM and under Configuration-&gt; Firewall -&gt; Objects -&gt;Network Objects/Groups and there is a small magnifying glass with &quot;Not Used&quot; near the top. Click it and it will list all of the unused object groups. It will also give you the option to delete them.&lt;/p&gt;&#xA;" OwnerUserId="27299" LastActivityDate="2016-06-20T16:36:48.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32408" PostTypeId="1" AcceptedAnswerId="50181" CreationDate="2016-06-20T17:12:33.190" Score="3" ViewCount="18676" Body="&lt;p&gt;Is there any alternative command for &lt;code&gt;show interface status&lt;/code&gt; on a switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In packet tracer (A simulation), &lt;code&gt;show interface status&lt;/code&gt; is not working. However, in GNS3 and real Cisco switches this command will work fine. But, I'm using packet tracer and I want to get a quick overview of the entire device line status and details of each interfaces which is done by &lt;code&gt;show interface status&lt;/code&gt; in real Cisco device. So, is there anyway to do this in packet tracer?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;------------------------------------------------------------------&#xA;Port      Name      Status    Vlan    Duplex   Speed   Type&#xA;------------------------------------------------------------------&#xA;Fa0/1             connected   1       full     auto    0/100BaseTX&#xA;Fa0/2             notconnect  1       auto     auto    0/100BaseTX&#xA;Fa0/3             notconnect  1       auto     auto    0/100BaseTX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/brrdO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/brrdO.png&quot; alt=&quot;Screenshot of packet tracer&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="27298" LastActivityDate="2018-06-16T02:21:41.413" Title="Alternative command for show interface status" Tags="|cisco|switch|cisco-commands|packet-tracer|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32409" PostTypeId="2" ParentId="16500" CreationDate="2016-06-20T17:45:29.363" Score="1" Body="&lt;p&gt;Simply use static NAT to assign a public IP address to a privately addressed Web application server.  Putting the workload on a different VLAN or public IP address does not fix anything.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-06-20T17:45:29.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32410" PostTypeId="1" AcceptedAnswerId="32412" CreationDate="2016-06-20T18:45:23.413" Score="2" ViewCount="812" Body="&lt;p&gt;I am studying up for CCENT, and I'm having some trouble understanding what a basic router does.  I understand one of the main functions is to split up broadcast domains.  When they say it splits broadcast domains, does that mean it only splits the WAN and the LAN? Can it split broadcast domains on LAN ports as well?&lt;/p&gt;&#xA;" OwnerUserId="21864" LastEditorUserId="8499" LastEditDate="2016-06-20T19:14:52.123" LastActivityDate="2016-06-20T19:14:52.123" Title="Router and broadcast domains" Tags="|routing|router|broadcast|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32411" PostTypeId="6" CreationDate="2016-06-20T18:45:49.363" Score="0" Body="&lt;p&gt;I will toss my hat in the ring for the open moderator position. I have been a member for almost two years, and I have actively participated for about a year. I believe Network Engineering can continue to be a quality question and answer site by and for network engineers, and I am going to work toward that end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am a fan of the current moderators, and I would like to continue to the current style of moderation. The light-touch is the Stack Exchange ideal, and the current moderators have balanced this very well. I am not looking to shake things up, and I will model my moderation style from the way moderation has been handled since the last election.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I regularly participate in the review process on those items for which I have review privileges. I do understand that the moderator votes on the reviews are binding, and this is one reason I have hesitated in volunteering for this position. I want to encourage those members of the community with such privileges to regularly exercise them; this is community-run site, and that requires community participation.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-20T18:45:49.363" LastActivityDate="2016-06-20T18:45:49.363" CommentCount="0" CommunityOwnedDate="2016-06-20T18:45:49.363" ContentLicense="CC BY-SA 3.0" />
  <row Id="32412" PostTypeId="2" ParentId="32410" CreationDate="2016-06-20T19:01:04.767" Score="2" Body="&lt;p&gt;The function of routers is to route traffic between different networks at layer-3. This can be any combination of WAN or LAN ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router strips off, and discards, the layer-2 frames from traffic received on its interfaces. A router will then use the information in the layer-3 packet to switch the packet to the next interface in a path toward the destination. It will then create a new layer-2 frame for any traffic sent out one of its interfaces. That is why it breaks up layer-2 broadcast domains; the layer-2 information doesn't survive when the layer-2 frame comes into the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some routers will allow subinterfaces and can understand and place VLAN tags on the frames. The router could be configured to route between the subinterfaces, allowing layer-3 traffic to be sent between the layer-2 broadcast domains.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-20T19:01:04.767" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32413" PostTypeId="2" ParentId="7885" CreationDate="2016-06-20T19:08:22.877" Score="4" Body="&lt;p&gt;If I understand your question correctly - you are trying to deploy an IPSec Site-to-Site &lt;strong&gt;tunnel&lt;/strong&gt; between the two routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case there are several problems in your configuration as far as I can tell:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all - you need to establish a GRE (Unencrypted) tunnel between the two routers like so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router A:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    interface Tunnel100&#xA;     tunnel source 172.16.1.1&#xA;     tunnel destination 172.17.1.1&#xA;     ip address [inner ip-address] [inner subnet-mask]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    interface Tunnel100&#xA;     tunnel source 172.17.1.1&#xA;     tunnel destination 172.16.1.1&#xA;     ip address [inner ip-address] [inner subnet-mask]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, in order for this to work there needs to be end-to-end connectivity between &lt;code&gt;172.16.1.1&lt;/code&gt; and &lt;code&gt;172.17.1.1&lt;/code&gt;.&#xA;In your config this is achieved with the &lt;code&gt;ip route 0.0.0.0 0.0.0.0 172.[...]&lt;/code&gt; line but I would suggest &lt;strong&gt;strongly against that&lt;/strong&gt;, as you will probably want to route all of your traffic through the tunnel later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Change it to &lt;code&gt;ip route 172.16.0.0 255.254.0.0 172.[...]&lt;/code&gt; instead (at least) - so only traffic in the &lt;code&gt;172.16/15&lt;/code&gt; subnet is routed through the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once Tunnel100 is up - the tunnel ends (inner ip addresses) should be pingable, e.g if the &lt;code&gt;inner ip-addresses&lt;/code&gt; are &lt;code&gt;(A) - 192.168.0.1&lt;/code&gt; and &lt;code&gt;(B) - 192.168.0.2&lt;/code&gt; you should be able to ping &lt;code&gt;192.168.0.2&lt;/code&gt; from &lt;code&gt;Router A&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping 192.168.0.2 source 192.168.0.1&#xA;[...]&#xA;!!!!!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If this is working you would probably want to add a default route through the tunnel - as mentioned above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.0.[1 or 2]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, the next thing that should be done is encryption or &quot;tunnel protection&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel100&#xA; tunnel protection ipsec profile [isakmp-profile]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Check out &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-ipsec/prod_white_paper0900aecd8034bd59.html&quot;&gt;this guide&lt;/a&gt; for a detailed explanation on isakmp profiles. It is also possible to use &lt;code&gt;default&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you might be interested in &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/flexvpn/115782-flexvpn-site-to-site-00.html&quot;&gt;this guide&lt;/a&gt; for deploying an IPSec vpn using ikev2 signaling (rather than isakmp) - the main difference being the (lack of) need to configure crypto-maps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco are slowly deprecating isakmp in a venture to replace it by ikev2, so it might be a good practice to deploy that configuration instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Iliya&lt;/p&gt;&#xA;" OwnerUserId="27300" LastActivityDate="2016-06-20T19:08:22.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32417" PostTypeId="1" CreationDate="2016-06-20T21:05:56.530" Score="4" ViewCount="1451" Body="&lt;p&gt;We have a Cisco 2921 connected to an T1 ISDN PRI with Call Manager Express. We are using CP8861 SIP phones. Everything works fine, calling in and out. To better illustrate the problem here's an example: Bob has a DID extension 101. He wants to forward calls from his extension to his cellphone 9.......... when he chooses the Forward All option on the phone. Ana has extension 102, she calls Bob at extension 101 and the call forwards to his cellphone. However, when Bob's customer Charlie calls him from the PSTN to his DID extension, Charlie gets a message saying &quot;This phone number is not available&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas? In short, phone can forward calls from internal extensions to cellphones but not calls from the PSTN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Omitted some lines with private information.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 15.6&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;card type t1 0 0&#xA;!&#xA;no aaa new-model&#xA;ethernet lmi ce&#xA;network-clock-participate wic 0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip cef&#xA;no ipv6 cef&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;isdn switch-type primary-ni&#xA;!&#xA;!&#xA;!&#xA;voice-card 0&#xA;!&#xA;!&#xA;!&#xA;voice service voip&#xA; allow-connections sip to sip&#xA; fax protocol t38 version 0 ls-redundancy 0 hs-redundancy 0 fallback none&#xA; sip&#xA;  registrar server expires max 1200 min 300&#xA;!&#xA;!&#xA;!&#xA;!&#xA;voice register global&#xA; mode cme&#xA; source-address 10.0.4.10 port 5060&#xA; max-dn 100&#xA; max-pool 50&#xA; load 8841 sip88xx.11-5-1-18&#xA; load 8861 sip88xx.11-5-1-18&#xA; load 8831 sip88xx.11-5-1-18&#xA; authenticate register&#xA; authenticate realm cisco.com&#xA; dialplan-pattern 1 786165.... extension-length 4&#xA; tftp-path flash:&#xA; create profile sync 0006163776915567&#xA;!&#xA;voice register dn  1&#xA; number 6475&#xA; name Bob&#xA; label 6475 Bob&#xA; call-forward b2bua all 97864238593&#xA;!&#xA;voice register pool  1&#xA; busy-trigger-per-button 2&#xA; id mac 40A6.E8B1.01DF&#xA; type 8861&#xA; number 1 dn 1&#xA; username 01DF password cisco&#xA; codec g711ulaw&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;controller T1 0/0/0&#xA; cablelength long 0db&#xA; pri-group timeslots 1-24&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface ISM0/0&#xA; no ip address&#xA; shutdown&#xA; !Application: CUE Running on ISM&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 10.0.4.10 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/2&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface ISM0/1&#xA; description Internal switch interface connected to Internal Service Module&#xA; no ip address&#xA;!&#xA;interface Serial0/0/0:23&#xA; no ip address&#xA; encapsulation hdlc&#xA; isdn switch-type primary-ni&#xA; isdn incoming-voice voice&#xA; no cdp enable&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 10.0.4.1&#xA;!&#xA;!&#xA;!&#xA;tftp-server flash:kern88xx.11-5-1-18.sbn&#xA;tftp-server flash:fbi88xx.BE-01-010.sbn&#xA;tftp-server flash:rootfs88xx.11-5-1-18.sbn&#xA;tftp-server flash:sip88xx.11-5-1-18.loads&#xA;tftp-server flash:vc488xx.11-5-1-18.sbn&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;voice-port 0/0/0:23&#xA;!&#xA;voice-port 0/1/0&#xA;!&#xA;voice-port 0/1/1&#xA;!&#xA;voice-port 0/1/2&#xA;!&#xA;voice-port 0/1/3&#xA; !&#xA; !&#xA; !&#xA; !&#xA;!&#xA;mgcp behavior rsip-range tgcp-only&#xA;mgcp behavior comedia-role none&#xA;mgcp behavior comedia-check-media-src disable&#xA;mgcp behavior comedia-sdp-force disable&#xA;!&#xA;mgcp profile default&#xA;!&#xA;!&#xA;!&#xA;!&#xA;dial-peer voice 1 pots&#xA; destination-pattern 9[2-9]..[2-9]......$&#xA; port 0/0/0:23&#xA; forward-digits 10&#xA;!&#xA;dial-peer voice 2 pots&#xA; destination-pattern 91[2-9]..[2-9]......$&#xA; port 0/0/0:23&#xA; forward-digits 10&#xA;!&#xA;dial-peer voice 3 pots&#xA; destination-pattern 911&#xA; port 0/0/0:23&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 4 pots&#xA; destination-pattern 9911&#xA; port 0/0/0:23&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 5 pots&#xA; destination-pattern 9011T&#xA; port 0/0/0:23&#xA; prefix 011&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27311" LastActivityDate="2017-12-20T03:02:51.670" Title="Call incoming from PSTN does not forward to cellphone number" Tags="|cisco|voip|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="32418" PostTypeId="1" CreationDate="2016-06-20T21:08:51.863" Score="0" ViewCount="736" Body="&lt;p&gt;(Please excuse me if I use the improper terminology; I'm an amateur who knows enough to be dangerous, but not enough to really be useful)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm setting up a home network and am having issues with getting all of my wall plates to work. I have 6 throughout my house located in strategic places, but only one of them is working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've verified that it's a cable problem, because I can plug my laptop directly in to my switch and access the network, but if I go through the wall plate, I don't get any connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'm reasonably confident that everything is wired correctly (568B), because I've used a tone generator on both ends of each wall plate cable and see the lights come on in the proper 1-8 sequence, with no skips, just like it does with the wall plate that &lt;em&gt;does&lt;/em&gt; work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm at a loss as to how I should diagnose the issue further. The wiring seems to be correct on all the wall plates, but only one is actually working. Where should I be looking next?&lt;/p&gt;&#xA;" OwnerUserId="27312" LastActivityDate="2016-06-21T03:42:51.200" Title="Diagnosing ethernet cable problems" Tags="|ethernet|cabling|" AnswerCount="1" CommentCount="5" ClosedDate="2016-06-21T05:20:27.480" ContentLicense="CC BY-SA 3.0" />
  <row Id="32421" PostTypeId="2" ParentId="32418" CreationDate="2016-06-21T01:29:47.860" Score="1" Body="&lt;p&gt;You are very likely missing a connection on one or more of the eight wires needed for gigabit ethernet or perhaps two are &quot;swapped&quot; i.e. in the wrong places.  You could use primitive technology like a multimeter on ohms/resistance function but I would highly suggest borrowing or renting a simple tester.  You send a signal through the conductors on one end (battery powered) and the receiver lights up if/when each conductor is connected correctly.  &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B000P1OA1O&quot; rel=&quot;nofollow&quot;&gt;https://www.amazon.com/HDE-HDE-H11-Network-Cable-Tester/dp/B000P1OA1O&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you want to shoot from the hip, remove and re punch down all your conductors at the female end and/or crimp new male ends on (if you have done that part yourself - if not, leave them be).  Remember, there are two standards - 568A and 568B.  Be sure you're using the same standard &lt;strong&gt;at both ends of each cable!&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2016-06-21T03:42:51.200" LastActivityDate="2016-06-21T03:42:51.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32422" PostTypeId="1" AcceptedAnswerId="32437" CreationDate="2016-06-21T01:34:18.413" Score="4" ViewCount="850" Body="&lt;p&gt;If we were to ignore the fact that it appears that &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5635&quot; rel=&quot;nofollow noreferrer&quot;&gt;RTBH&lt;/a&gt; has gotten much more attention and support from routing vendors than &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5575&quot; rel=&quot;nofollow noreferrer&quot;&gt;FlowSpec&lt;/a&gt;, can you please illustrate any situations where it may be beneficial to use RTBH instead of FlowSpec?&lt;/p&gt;&#xA;" OwnerUserId="1378" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-06-21T12:48:17.367" Title="RTBH vs FlowSpec" Tags="|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32424" PostTypeId="1" CreationDate="2016-06-21T03:19:44.283" Score="1" ViewCount="29" Body="&lt;p&gt;I have port forwarded for my MIS server to be accessed from outside. From inside interface, i use 10.10.2.2:8000  to get access of the MIS. But, what i want right now is to be able to access the MIS via the public ip itself from the inside interface. ie, i want to access my MIS using A.B.C.D:8000 given that A.B.C.D is my public IP. Some friends suggested me this is called source nat. Please clarify .&lt;/p&gt;&#xA;" OwnerUserId="23114" LastActivityDate="2016-06-21T03:19:44.283" Title="Regarding accessing the MIS server via the public IP from the internal interface" Tags="|cisco-asa|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32426" PostTypeId="1" AcceptedAnswerId="32427" CreationDate="2016-06-21T06:38:02.700" Score="3" ViewCount="5082" Body="&lt;p&gt;I got to know about NAT and it's use in a LAN. I am just curious to know that, is it possible for two or more than two devices to have the same private IP in a LAN ? &lt;/p&gt;&#xA;" OwnerUserId="27321" LastActivityDate="2016-06-21T07:25:37.800" Title="Can two or more than two device have same private IP in a LAN?" Tags="|nat|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32427" PostTypeId="2" ParentId="32426" CreationDate="2016-06-21T07:13:37.537" Score="2" Body="&lt;p&gt;Yes, it is possible but will only cause you issues. You will end up with IP conflicts and will see issues where some frames/packets will travel to one device and some frames/packets to the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other issue you will see is the mapping between MAC addresses and IP addresses. Each MAC address on the LAN segment will be mapped to an IP address and devices will use ARP to resolve an IP address to a MAC and place it in their ARP table. When two MAC addresses have the same IP address, you will end up sending data to the wrong device as on local LAN segment, data is being send based on MAC destination and source address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When devices use ARP to find out who has IP address 192.168.1.1 for example, the device will end up with two responses from two different devices and you might see the ARP table being constantly updated as devices on the LAN segment will think the MAC has changed for that particular IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you are using windows, type in &lt;strong&gt;arp -a&lt;/strong&gt; in command prompt to see the ARP cache and it looks similar to this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;   192.168.0.1          00-00-4e-03-01-01     dynamic&#xA;&amp;gt;   192.168.0.255        ff-ff-ff-ff-ff-ff     static&#xA;&amp;gt;   224.0.0.22            01-00-3e-6e-03-16     static&#xA;&amp;gt;   224.0.0.252           01-00-4e-4e-03-fc     static&#xA;&amp;gt;   245.254.255.250       01-00-5e-7f-ff-fa     static&#xA;&amp;gt;   245.254.255.255       ff-ff-ff-ff-ff-ff     static&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So using these details, when your Windows PC wants to send data, it will look at the destination IP address, then resolve this IP address to a MAC address so that it can use layer 2 to send the frame to the destination MAC address. If it does not know the MAC address, it will issue an ARP which is a broadcast, asking &quot;Who has IP address 192.168.1.1&quot;, and wait for a response. It should only receive one response and if there are two, you know you have more than one device with the same IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we are talking about NAT, then you can join two networks that are using the same private IP schemes but when you are connecting to the second network, passing through NAT, your IP address will be changed to the external address so you are no longer using the private IP address of the first network. The IP address will get translated to an IP address that can work on the second network and not cause any conflicts. The translated address for example could be reserved to still use an IP address in the private range, but the configuration will make sure that you are not using an address that is already used on the second network and has been added to the NAT pool of addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="27056" LastEditDate="2016-06-21T07:25:37.800" LastActivityDate="2016-06-21T07:25:37.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32428" PostTypeId="2" ParentId="32426" CreationDate="2016-06-21T07:14:26.193" Score="1" Body="&lt;p&gt;Within the same LAN segment? No. Between LAN networks, you can see the same IP address. But within that network, all the IPs have to be unique. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in Site A you've got a LAN with IPs 192.168.1.0 - 192.168.1.255&#xA;And in Site B (connected to site A via a router with NAT enabled on it) you've got a LAN with the same IPs - 192.168.1.0 - 192.168.1.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is possible. But within the same network, having two hosts both with IP 192.168.1.1 is not possible, it will clash. NAT is mainly so that you can use the same private IPs between sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just imagine if for site A we could use 192.168.1.0-255 and for site B we had to use 192.168.2.0-255. And similarly for site C,D,E... you didn't have the option to use 192.168.1 or .2 subnets? That'd lead to a lot of waste in terms of usable IP addresses wouldn't it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence, NAT allows same IP ranges to be used between segments. But no you definitely, not with NAT or anything for that matter, have two hosts on the same segment both with the same IP address. It has to be unique. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helped!&lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2016-06-21T07:14:26.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32429" PostTypeId="1" CreationDate="2016-06-21T07:31:31.403" Score="1" ViewCount="73" Body="&lt;p&gt;I have a master node and different slave nodes. I want to perform traceroute from each slave to every other slave and master and send this route to master periodically with timestamp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bruteforce approach seems to be performing a traceroute from each slave to different slaves and then send to master. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried calling &lt;code&gt;traceroute&lt;/code&gt; using &lt;code&gt;subprocess&lt;/code&gt; from my python script. But it takes a lot of time in generating the output and then sending the traceroute to master would again take a lot of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main purpose is to store the routes in master and whenever any slaves fails i can get the latest route from these logs which i have stored in the master.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have looked for other library tools as well such as &lt;code&gt;scapy&lt;/code&gt; python library and &lt;code&gt;mtr&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any pointers on how to do this in best possible way ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="27323" LastEditorUserId="27323" LastEditDate="2016-06-22T06:29:06.860" LastActivityDate="2016-06-22T06:29:06.860" Title="Route discovery between master slave and slave slave" Tags="|network-access|traceroute|" AnswerCount="0" CommentCount="3" ClosedDate="2016-06-21T08:00:14.800" ContentLicense="CC BY-SA 3.0" />
  <row Id="32431" PostTypeId="1" CreationDate="2016-06-21T08:32:11.477" Score="4" ViewCount="602" Body="&lt;p&gt;Background: we are planning to have a L3 leaf spine network with TOR(redundant mlag) and spine switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each TOR is on a specific subnet and run bgp with spine. Now, what is the recommendation to run DHCP server. Generally, if it is a flat L2 domain, we can run the DHCP anywhere and get IPs irrespective of subnet etc. But how to configure a management leaf and run DHCP under it and issue ips based on the subnet to every rack? Is there any connection between vlan/vxlan in this context?&lt;/p&gt;&#xA;" OwnerUserId="22114" LastActivityDate="2016-06-21T08:40:27.497" Title="L3 leaf-spine architecture and DHCP ip assignment" Tags="|vlan|dhcp|ecmp|vxlan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32432" PostTypeId="2" ParentId="32431" CreationDate="2016-06-21T08:40:27.497" Score="5" Body="&lt;p&gt;My guess would be to use a DHCP relay agent on your core switch/router. Configure this under each vlan interface and point it to your DHCP server. The DHCP discoveries will only stay on the LAN segment so you need a relay agent so that the broadcast can be turned into a unicast and routed to the vlan or even external IP address to offer an IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure you create scopes on your DHCP server that matches the subnet that the device is requesting an IP address from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you specify what networking gear you are using we can help you more with the specific configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-21T08:40:27.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32436" PostTypeId="1" CreationDate="2016-06-21T11:59:29.217" Score="0" ViewCount="256" Body="&lt;p&gt;How to send rate control(250Kb/s, 500Kb/s) packet in TCP/IP stack? Because In my understanding after tcp buffer filled then the Tx packets happening. Is my understanding is correct then How do I send the packet before the buffer full?&lt;/p&gt;&#xA;" OwnerUserId="2716" LastEditorUserId="2716" LastEditDate="2016-06-21T12:10:05.947" LastActivityDate="2016-06-21T13:26:39.620" Title="How to send rate control packet in TCP/IP model?" Tags="|tcp|network-core|sdn|" AnswerCount="1" CommentCount="3" ClosedDate="2020-12-21T17:46:03.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="32437" PostTypeId="2" ParentId="32422" CreationDate="2016-06-21T12:48:17.367" Score="8" Body="&lt;p&gt;Typically, FlowSpec is only used within a specific network, while RTBH is used between a network and its upstream(s). The mains reasons for this are that &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;only a few vendors support FlowSpec&lt;/li&gt;&#xA;&lt;li&gt;allowing your customers to insert FlowSpec routers into your network is risky. One bad filter and possibly one of your customers can insert blackholes which affect all your customers, not just the one inserting the rule. &lt;/li&gt;&#xA;&lt;li&gt;there have been problems with some FlowSpec implementations and applications where it killed entire networks, as can be read in &lt;a href=&quot;https://blog.cloudflare.com/todays-outage-post-mortem-82515/&quot;&gt;this post mortem&lt;/a&gt; for example. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Since RTBH is just BGP using a dedicated session and/or communities to indicate traffic towards which destinations of the &lt;em&gt;customer&lt;/em&gt; to discard, it's a lot less risky: filters are easy to write and blackholes can only affect the customer announcing it. Also, since it's just BGP, it can be implemented on any BGP speaking device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FlowSpec has some features RTBH is missing (for example the ability to match on source and destination IP's, protocols and ports), but it's mostly used within a single network. RTBH on the other hand can be used with upstream providers, allowing customers to have them drop traffic towards a target, thus not congesting their costly transit links.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-06-21T12:48:17.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32438" PostTypeId="1" CreationDate="2016-06-21T12:57:44.507" Score="1" ViewCount="548" Body="&lt;p&gt;I'm trying to sanity check my lack of understanding of a colleague's network planning exercise. It doesn't make sense to me, but maybe I'm missing something. My general networking knowledge isn't bad, but I don't have vendor-specific knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We currently have a consumer-grade Draytek router, which provides DHCP and NAT, just the same as any home broadband connection. Our WAN connection is delivered over an Ethernet circuit as a small /30 &quot;meet me&quot; network, with a single private /24 inside containing all the hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He intends to keep the Draytek router, but place a Checkpoint firewall behind it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Checkpoint firewall will perform NAT for several VLANs which will allow different groups of users to be separated from each other, via a managed switch with VLAN de-tagging on the ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will be a bridging LAN between the &quot;outside&quot; of the Checkpoint and the &quot;inside&quot; of the Draytek.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup will be like so (pink box is an IP packet, explained later):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FbibC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FbibC.png&quot; alt=&quot;Crazy network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my first question: &lt;strong&gt;Why keep the Draytek and double-NAT the outbound traffic?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also a requirement for the inbound NAT from the public IP (ie: port mapping) to a couple of internal hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, the Draytek handles the inbound NAT and will have the public IP on the external interface, but he intends that the Checkpoint should handle the inbound NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He claims that the Draytek can be configured to selectively forward, depending on destination port, incoming packets (pink packet on diagram) &lt;em&gt;without modification of the source/dest IP or hardware address&lt;/em&gt; to the Checkpoint, which will then perform inbound NAT to the internal device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This doesn't make any sense to me. As I understand it, the Checkpoint will then receive packets with the Draytek's external interface MAC address and IP, which it will NAT to the internal device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't work out the reverse path for NAT traffic either, or how/what's tracking the translation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second question: &lt;strong&gt;How can this even work?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He claims it's &quot;standard practice&quot; but can't explain it in detail. If the Draytek can't do it, he says he will buy a Cisco to replace it. I have a sneaking suspicion he doesn't know what he's on about, or am I missing something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help explain what he's trying to achieve here? Many thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="27330" LastActivityDate="2016-06-21T13:23:09.263" Title="Port-selective transparent forwarding with routing?" Tags="|routing|ipv4|nat|bridge|checkpoint|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32439" PostTypeId="2" ParentId="32438" CreationDate="2016-06-21T13:23:09.263" Score="1" Body="&lt;p&gt;He's mostly right, even if his explanation isn't as clear as it could be.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Currently, the Draytek handles the inbound NAT and will have the&#xA;  public IP on the external interface, but he intends that the&#xA;  Checkpoint should handle the inbound NAT.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This makes sense.  The firewall is a better place to do the NAT functions, as it has more features and is is more flexible than a consumer grade router.  I assume he intends to turn off NAT on the router (if he can).  If not, double NAT is an unnecessary complication, but it will work anyway.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that just because the &quot;bridging LAN&quot; has a private address, that does not mean the router has to do NAT.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;He claims that the Draytek can be configured to selectively forward,&#xA;  depending on destination port, incoming packets (pink packet on&#xA;  diagram) without modification of the source/dest IP or hardware&#xA;  address to the Checkpoint, which&#xA;  will then perform inbound NAT to the internal device.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This doesn't make any sense to me. As I understand it, the Checkpoint&#xA;  will then receive packets with the Draytek's external interface MAC&#xA;  address and IP, which it will NAT to the internal device.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think you're confused about where the /24 public network &quot;lives.&quot; It doesn't &quot;live&quot; on the router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router will be configured to forward traffic destined for the public network to the firewall (i.e., the firewall is the next hop.).  So the router is just being a router.  It will change the DMAC address to that of the firewall.   The firewall will receive the packet, change the DestIP to an internal IP and forward it on.  On the outbound path, the firewall will translate the source address to the external network and forward it to the router, which in turn will forward it to the ISP.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-21T13:23:09.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32440" PostTypeId="2" ParentId="32436" CreationDate="2016-06-21T13:26:39.620" Score="1" Body="&lt;p&gt;You need to set the PSH flag to tell the receiver to process the data even though the buffer is not full.  &lt;a href=&quot;http://packetlife.net/blog/2011/mar/2/tcp-flags-psh-and-urg/&quot; rel=&quot;nofollow&quot;&gt;Here is a good explanation&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Consider what would happen to a Telnet session, for instance, if TCP&#xA;  waited until there was enough data to fill a packet before it would&#xA;  send one: You would have to type over a thousand characters before the&#xA;  first packet would make it to the remote device. Not very useful.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This is where the PSH flag comes in. The socket that TCP makes&#xA;  available at the session level can be written to by the application&#xA;  with the option of &quot;pushing&quot; data out immediately, rather than waiting&#xA;  for additional data to enter the buffer. When this happens, the PSH&#xA;  flag in the outgoing TCP packet is set to 1 (on). Upon receiving a&#xA;  packet with the PSH flag set, the other side of the connection knows&#xA;  to immediately forward the segment up to the application.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-21T13:26:39.620" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32441" PostTypeId="1" AcceptedAnswerId="35059" CreationDate="2016-06-21T14:03:39.320" Score="4" ViewCount="892" Body="&lt;p&gt;I'm having issues with a HP 8206zl switch not delivering PoE+ to a PoE+ device, a Meraki MR42 WAP to be exact. The WAP reports that it's operating in 802.03af fallback mode, which restricts it's capabilities. The port it's connected to is part of a HP J9534A 24p Gig-T PoE+ v2 zl Module. The switch says that the device requested class 4. Attached output of the PoE port info. &lt;a href=&quot;https://i.stack.imgur.com/v7QcG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/v7QcG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the output of the PoE supply status on the switch, ample amounts of power available:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/kLt4h.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kLt4h.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried connecting the devices directly to the the switch, and they still operate in &quot;low-power mode&quot; so for some reason they don't seem to be able to negotiate 802.03at. Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="22463" LastEditorUserId="22463" LastEditDate="2016-09-19T18:38:13.240" LastActivityDate="2020-04-17T11:28:37.387" Title="HP 8206zl not delivering PoE 802.03at to Meraki AP" Tags="|switch|hp|hp-procurve|power-over-ethernet|meraki|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="32442" PostTypeId="2" ParentId="29176" CreationDate="2016-06-21T14:34:52.140" Score="1" Body="&lt;p&gt;Use the reload command to issue a delayed reload to the switch. Then make your change and see if it worked. If you messed up, the switch will reboot with the old configuration intact, enabling you to try again until you get it right. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://grumpytechie.net/2015/03/06/using-the-reload-command-with-hp-switches-hp-networking-series-part-2/&quot; rel=&quot;nofollow&quot;&gt;https://grumpytechie.net/2015/03/06/using-the-reload-command-with-hp-switches-hp-networking-series-part-2/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-06-21T14:34:52.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32443" PostTypeId="2" ParentId="29115" CreationDate="2016-06-21T14:39:36.913" Score="0" Body="&lt;p&gt;Use Putty instead!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZAG02.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZAG02.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dZzbo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dZzbo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might need to decrease the speed to 9600 baud on some devices, but the newer HPs with autosensing console lines should handle 115200 baud without a problem, just remember to hit enter two times after you open the session so the switch wakes up the serial session. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-06-21T14:39:36.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32444" PostTypeId="1" CreationDate="2016-06-21T14:56:28.020" Score="3" ViewCount="398" Body="&lt;p&gt;What will be the issue if we use &lt;code&gt;rfc1918&lt;/code&gt; private IP address range /31 or /30 in point-to-point link?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;[ISP]--------------[Router1]------rfc1918--------[L3 Switch]-------[LAN] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I heard &lt;code&gt;PMTU&lt;/code&gt; can be issue but what if i increase &lt;code&gt;9000&lt;/code&gt; MTU on point-to-point link?&lt;/p&gt;&#xA;&lt;h1&gt;EDIT:&lt;/h1&gt;&#xA;&lt;p&gt;From ISP we get &lt;code&gt;/24&lt;/code&gt; IP subnet and we are running &lt;code&gt;BGP&lt;/code&gt; on Edge router, We don't want to use NAT because our service required public IP direct on server.&lt;/p&gt;&#xA;&lt;p&gt;Whole reason was using &lt;code&gt;/24&lt;/code&gt; for host subnet and don't use any single IP from it for Point-to-Point link. My question was can i just use private IP &lt;code&gt;/30&lt;/code&gt; between Router and L3 switch?&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-06-21T18:34:49.573" Title="rfc1918 address in WAN point-to-point link" Tags="|cisco|switch|mtu|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32445" PostTypeId="2" ParentId="32444" CreationDate="2016-06-21T15:05:16.037" Score="5" Body="&lt;p&gt;If you are only using RFC1918 between your PRIVATE devices on your LAN going from your core to your edge, there is no issue.  Depending on your IGP there is nuance to the design, but beyond that, absolutely no problem there.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you cannot do, is ask or attempt to use RFC1918 between your edge-router and your ISP.  RFC1918 is unroutabl on the public internet.  If it's not, get a new ISP  :)&lt;/p&gt;&#xA;" OwnerUserId="21359" LastActivityDate="2016-06-21T15:05:16.037" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32446" PostTypeId="1" CreationDate="2016-06-21T15:31:22.870" Score="2" ViewCount="229" Body="&lt;p&gt;I have two 3560 switches, and I have 2 uplinks. The goal is to make one link green on both ports on each switch, and the other link amber (standby), so when I pull the active green link out, the other standby link would take 30 seconds to be new active link. I am lost on what I am missing. I made a root switch and the VLANs and everything. I'mot sure how I make one link active and the other standby,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;second#sh span&#xA;&#xA;VLAN0005&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    28677&#xA;             Address     001a.e3cd.9e80&#xA;             Cost        19&#xA;             Port        26 (GigabitEthernet0/26)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    28677  (priority 28672 sys-id-ext 5)&#xA;             Address     0023.abcd.b900&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Gi0/26           Root FWD 19         32.26   P2p&#xA;Gi0/28           Altn BLK 19        128.28   P2p&#xA;&#xA;&#xA;VLAN0010&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    28682&#xA;             Address     001a.e3cd.9e80&#xA;             Cost        19&#xA;             Port        26 (GigabitEthernet0/26)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    28682  (priority 28672 sys-id-ext 10)&#xA;             Address     0023.abcd.b900&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Gi0/26           Root FWD 19         32.26   P2p&#xA;Gi0/28           Altn BLK 19        128.28   P2p&#xA;&#xA;&#xA;VLAN0015&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    28687&#xA;             Address     001a.e3cd.9e80&#xA;             Cost        19&#xA;             Port        26 (GigabitEthernet0/26)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    28687  (priority 28672 sys-id-ext 15)&#xA;             Address     0023.abcd.b900&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Gi0/26           Root FWD 19         32.26   P2p&#xA;Gi0/28           Altn BLK 19        128.28   P2p&#xA;&#xA;&#xA;VLAN0020&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    28692&#xA;             Address     001a.e3cd.9e80&#xA;             Cost        19&#xA;             Port        26 (GigabitEthernet0/26)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    28692  (priority 28672 sys-id-ext 20)&#xA;             Address     0023.abcd.b900&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Gi0/26           Root FWD 19         32.26   P2p&#xA;Gi0/28           Altn BLK 19        128.28   P2p&#xA;&#xA;second#&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;new#sh span&#xA;&#xA;VLAN0005&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    28677&#xA;             Address     001a.e3cd.9e80&#xA;             This bridge is the root&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    28677  (priority 28672 sys-id-ext 5)&#xA;             Address     001a.e3cd.9e80&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Fa0/24           Desg FWD 19         32.26   P2p&#xA;Fa0/26           Desg FWD 19        128.30   P2p&#xA;&#xA;&#xA;VLAN0010&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    28682&#xA;             Address     001a.e3cd.9e80&#xA;             This bridge is the root&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    28682  (priority 28672 sys-id-ext 10)&#xA;             Address     001a.e3cd.9e80&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Fa0/24           Desg FWD 19         32.26   P2p&#xA;Fa0/26           Desg FWD 19        128.30   P2p&#xA;&#xA;&#xA;VLAN0015&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    28687&#xA;             Address     001a.e3cd.9e80&#xA;             This bridge is the root&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    28687  (priority 28672 sys-id-ext 15)&#xA;             Address     001a.e3cd.9e80&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Fa0/24           Desg FWD 19         32.26   P2p&#xA;Fa0/26           Desg FWD 19        128.30   P2p&#xA;&#xA;&#xA;VLAN0020&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    28692&#xA;             Address     001a.e3cd.9e80&#xA;             This bridge is the root&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    28692  (priority 28672 sys-id-ext 20)&#xA;             Address     001a.e3cd.9e80&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Fa0/24           Desg FWD 19         32.26   P2p&#xA;Fa0/26           Desg FWD 19        128.30   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27334" LastEditorUserId="8499" LastEditDate="2018-03-18T19:20:35.367" LastActivityDate="2018-03-18T19:20:35.367" Title="Building Spanning-tree link" Tags="|cisco|switch|switching|cisco-catalyst|spanning-tree|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32447" PostTypeId="1" CreationDate="2016-06-21T15:48:50.177" Score="2" ViewCount="227" Body="&lt;p&gt;I´m trying to configure a NVR to my company´s network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a router from which I will assign a fixed public IP to the NVR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could connect the NVR directly to the Router which has 5 different interfaces with a public IP each one, but then if I do that I wouldn´t be able to access the NVR directly from my company´s network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder If I could connect the router interface that I´m going to use as well as the NVR to a switch, then assign public IP to the NVR. at this point I need to know how can I make the NVR accesible to the other network users that are using a different public IP.&lt;/p&gt;&#xA;" OwnerUserId="27335" LastActivityDate="2017-06-06T17:11:36.533" Title="How can I figure to connect my NVR in this topology?" Tags="|cisco|switch|router|ethernet|ipv4|" AnswerCount="1" CommentCount="1" ClosedDate="2017-06-06T17:13:00.077" ContentLicense="CC BY-SA 3.0" />
  <row Id="32448" PostTypeId="2" ParentId="32446" CreationDate="2016-06-21T16:23:12.823" Score="1" Body="&lt;p&gt;From your second switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Gi0/26           Root FWD 19        128.26   P2p&#xA;Gi0/28           Altn BLK 19        128.28   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It clearly shows that STP is blocking one of the links for that VLAN. If you pull the plug on the forwarding link, STP will converge and begin forwarding on the blocked link. This is what you want, and it is the default behavior.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-21T16:23:12.823" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32449" PostTypeId="2" ParentId="32446" CreationDate="2016-06-21T16:25:42.950" Score="3" Body="&lt;p&gt;There is nothing you need to do -- the switches are already running spanning tree and one port (G0/28 on the 2nd switch) is blocking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A preferred way to configure this is to create a port-channel between the two switches.  The port channel combines the two physical interfaces into one logical interface.  You get twice the bandwidth because both links are forwarding, you still get the redundancy, and you don't have the slow convergence times of spanning tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a sample.  Do the same on both sides.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gi 0/26&#xA;channel-group 1 mode active&#xA;!&#xA;interface gi 0/28&#xA;channel-group 1 mode active&#xA;!&#xA;interface port-channel 1&#xA;switchport&#xA;switchport mode trunk&#xA;switcport trunk allowed vlan 10-20&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-21T16:25:42.950" CommentCount="32" ContentLicense="CC BY-SA 3.0" />
  <row Id="32450" PostTypeId="1" CreationDate="2016-06-21T16:26:43.707" Score="2" ViewCount="518" Body="&lt;p&gt;It is a basic question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume 2 physical machines in two different subnets. VxLAN is configured on 2 TOR switches housing these machines in different subnets in different racks. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Host A    IP: IP-A    Mac: Mac-A&#xA;&#xA;Host B    IP: IP-B    Mac: Mac-B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When A wants to talk to B, since VxLAN learns the mac addresses somehow (multicast/unicast),&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Can host A get the mac address of B from the local TOR switch's ARP table?&lt;/li&gt;&#xA;&lt;li&gt;When host A wants to talk to some random machine, say C (which is not a part of VxLAN), is there any special gateway IP or the same gateway IP is enough. In otherwords, when VxLAN is configured in switches do I need any special configuration in the server in terms of gateway IP or routes&#xA;so as to go outside of the network?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22114" LastEditorUserId="13986" LastEditDate="2016-06-22T05:16:28.780" LastActivityDate="2016-06-25T21:19:40.540" Title="VxLAN - mac table entries in a TOR switch" Tags="|routing|arp|vxlan|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32451" PostTypeId="1" CreationDate="2016-06-21T17:31:07.073" Score="2" ViewCount="1011" Body="&lt;p&gt;Just started a job where they wanted us to re-purpose a local network that wasn't in use and to create a webvpn portal to allow web access to it.  We've tried everything and looked every where and cannot seem to figure out what we are doing wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here is what is happening, if I try to navigate to the webvpn page on my local machine nothing happens, the request times out.  Looking at wireshark and looking at the ASA's packet capture, I see the https SYN packet coming through, and it is not blocked, but nothing happens and then at 30 seconds the request times out.  I don't see any SYN-ACK anywhere. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I configure the ASA to allow my remote computer address to have HTTP access to the ASA itself and I go to the address then it shows the page to download the ASDM software, but not the webvpn portal.  So it doesn't seem to be any kind of routing issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am on one of the machines connected to the internal network, and in a web browser I type the address of the internal network gateway, then it takes me to the vpn portal.  We tried adding a NAT rule to redirect outside traffic to the internal network gateway, and the NAT rule seems to be working, but we have the same problem of the request just timing out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here the output of &lt;code&gt;show run&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#  Used addresses:&#xA;#   &amp;lt;outside interface&amp;gt; - IP address of ASA's outside interface&#xA;#   &amp;lt;internal network&amp;gt;  - The network for the internal vlan, also named CILInternal&#xA;#   &amp;lt;internal gateway&amp;gt;  - The gateway addresses for machines on the internal vlan&#xA;#   &amp;lt;various address&amp;gt;   - Any address that is still part of the configuration that I don't&#xA;#                 believe is in use or does not seem relevant to this issue&#xA;#   &amp;lt;remote address&amp;gt;    - The address of my remote computer I want to connect to the SSL WebVPN&#xA;&#xA;# Anything labeled VM is a legacy network that is not currently connected&#xA;&#xA;&#xA;cilasa# sh run&#xA;: Saved&#xA;:&#xA;ASA Version 9.1(5)&#xA;!&#xA;hostname cilasa&#xA;domain-name CIL.local&#xA;enable password &amp;lt;asa password&amp;gt;&#xA;xlate per-session deny tcp any4 any4&#xA;xlate per-session deny tcp any4 any6&#xA;xlate per-session deny tcp any6 any4&#xA;xlate per-session deny tcp any6 any6&#xA;xlate per-session deny udp any4 any4 eq domain&#xA;xlate per-session deny udp any4 any6 eq domain&#xA;xlate per-session deny udp any6 any4 eq domain&#xA;xlate per-session deny udp any6 any6 eq domain&#xA;passwd &amp;lt;passwd&amp;gt; encrypted&#xA;names&#xA;name &amp;lt;various address&amp;gt; CILInternal&#xA;name &amp;lt;various address&amp;gt; DMZ_WebServer&#xA;name &amp;lt;various address&amp;gt; Outside&#xA;name &amp;lt;various address&amp;gt; Management&#xA;name &amp;lt;various address&amp;gt; PPTPUser description PPTPUser1-55 (User's VPN)&#xA;name &amp;lt;various address&amp;gt; SSTPPool&#xA;name &amp;lt;various address&amp;gt; A2008R2_51&#xA;name &amp;lt;various address&amp;gt; SSTPAdmPool description Admin SSTP IP Pool&#xA;name &amp;lt;various address&amp;gt; SSTP1 description SSTP1-3 (VPN)&#xA;name &amp;lt;various address&amp;gt; SSTPAdmInt description Internal Interface for Admin SSTP&#xA;name &amp;lt;various address&amp;gt; User51 description User51 VM access to the Internet&#xA;name &amp;lt;various address&amp;gt; User52 description User52 VM access to the Internet&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA; switchport access vlan 12&#xA; shutdown&#xA;!&#xA;interface Ethernet0/3&#xA; switchport access vlan 12&#xA;!&#xA;interface Ethernet0/4&#xA; switchport access vlan 12&#xA; shutdown&#xA;!&#xA;interface Ethernet0/5&#xA; switchport access vlan 22&#xA; switchport trunk allowed vlan 22,51-56&#xA; switchport trunk native vlan 51&#xA;!&#xA;interface Ethernet0/6&#xA; switchport access vlan 12&#xA;!&#xA;interface Ethernet0/7&#xA; switchport access vlan 12&#xA;!&#xA;interface Vlan1&#xA; management-only&#xA; nameif inside&#xA; security-level 100&#xA; ip address &amp;lt;default address&amp;gt; 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address &amp;lt;outside network&amp;gt; 255.255.255.240&#xA;!&#xA;interface Vlan12&#xA; nameif CILInternal&#xA; security-level 10&#xA; ip address &amp;lt;internal gateway&amp;gt; 255.255.255.0&#xA;!&#xA;interface Vlan22   #Legacy vlan&#xA; nameif VM&#xA; security-level 10&#xA; ip address &amp;lt;various address&amp;gt; 255.255.248.0&#xA;!&#xA;boot system disk0:/asa915-k8.bin&#xA;ftp mode passive&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring&#xA;dns domain-lookup inside&#xA;dns domain-lookup outside&#xA;dns domain-lookup CILInternal&#xA;dns server-group DefaultDNS&#xA; name-server &amp;lt;various address&amp;gt;&#xA; name-server 75.75.76.76&#xA; name-server 8.8.8.8&#xA; name-server 4.2.2.2&#xA; domain-name CIL.local&#xA;same-security-traffic permit intra-interface&#xA;object network User51  #Legacy I think&#xA; subnet &amp;lt;various address&amp;gt; 255.255.255.248&#xA; description Created during name migration&#xA;object network User52 #Legacy I think&#xA; subnet &amp;lt;various address&amp;gt; 255.255.255.248&#xA; description Created during name migration&#xA;object network SSTPAdmPool #Legacy I think&#xA; subnet &amp;lt;various address&amp;gt; 255.255.255.0&#xA;object network SSTP1 #legacy I think&#xA; host &amp;lt;various address&amp;gt;&#xA;object network CILInternal&#xA; subnet &amp;lt;internal network&amp;gt; 255.255.255.0&#xA;object network PPTPUser #legacy&#xA; host &amp;lt;various address&amp;gt;&#xA;object network SSTPPool #legacy&#xA; subnet &amp;lt;various address&amp;gt; 255.255.255.0&#xA;object network VM #legacy&#xA; subnet &amp;lt;various address&amp;gt; 255.255.248.0&#xA; description VM Machines&#xA;object network NAVWEB-DMZ #legacy&#xA; host &amp;lt;various address&amp;gt;&#xA; description Time and Expense Web Portal&#xA;object network internal_gateway&#xA; host &amp;lt;internal gateway&amp;gt;&#xA; description Gateway for the internal network&#xA;object network ssl_vpn&#xA; host &amp;lt;internal gateway&amp;gt;&#xA;object-group protocol TCPUDP&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group service RDP tcp&#xA; port-object eq &amp;lt;some port&amp;gt;&#xA;object-group service AdminPPTP tcp&#xA; port-object eq &amp;lt;some other port&amp;gt;&#xA;object-group network UserAccess&#xA; description User VM access to the Internet&#xA; network-object object User51&#xA; network-object object User52&#xA;object-group protocol DM_INLINE_PROTOCOL_1&#xA; protocol-object ip&#xA; protocol-object tcp&#xA;object-group service DM_INLINE_SERVICE_1&#xA; service-object tcp&#xA; service-object tcp destination eq https&#xA; service-object tcp destination eq www&#xA;object-group service DM_INLINE_SERVICE_2&#xA; service-object icmp&#xA; service-object tcp&#xA; service-object tcp destination eq https&#xA;object-group service DM_INLINE_SERVICE_4&#xA; service-object ip&#xA; service-object tcp&#xA; service-object tcp destination eq https&#xA;&#xA;#--------------------------------------&#xA;#       Access List Config&#xA;#--------------------------------------&#xA;&#xA;# Note:  Rules like &quot;any any ip permit&quot; are just temporary&#xA;# for diagnostics, this network is not currently&#xA;# operational&#xA;&#xA;&#xA;&#xA;access-list acl-out extended permit tcp any4 object PPTPUser eq pptp&#xA;access-list acl-out extended permit tcp any4 interface outside eq https&#xA;access-list acl-out extended permit tcp any interface outside eq https&#xA;access-list acl-out extended permit tcp interface outside interface outside eq https&#xA;access-list acl-out extended permit ip any interface outside&#xA;access-list acl-out extended permit object-group TCPUDP interface outside interface inside eq www&#xA;access-list acl-out extended permit tcp interface outside interface inside eq ssh&#xA;access-list acl-out extended permit ip any any&#xA;access-list acl-out extended permit tcp interface outside interface outside eq www&#xA;access-list acl-out extended permit tcp any4 interface outside&#xA;access-list acl-out extended permit tcp any interface outside eq ssh&#xA;access-list acl-out extended permit tcp any any eq ssh&#xA;access-list test_acl extended permit ip any4 any4&#xA;access-list outside_access_out extended permit object-group DM_INLINE_PROTOCOL_1 object CILInternal any&#xA;access-list outside_access_out extended permit udp object CILInternal any eq domain&#xA;access-list outside_access_out extended permit icmp object CILInternal any&#xA;access-list outside_access_out extended permit tcp any interface outside eq https&#xA;access-list outside_access_out extended permit object-group DM_INLINE_SERVICE_2 host &amp;lt;remote address&amp;gt; any&#xA;access-list ACL_IN extended permit ip any4 any4&#xA;access-list ACL_IN extended permit object-group DM_INLINE_SERVICE_1 any interface outside&#xA;&#xA;&#xA;#--------------------------------------&#xA;#       End Access List Config&#xA;#--------------------------------------&#xA;&#xA;&#xA;&#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;mtu CILInternal 1500&#xA;mtu VM 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-731-101.bin&#xA;asdm history enable&#xA;arp timeout 14400&#xA;arp permit-nonconnected&#xA;nat (outside,outside) source static any any destination static interface ssl_vpn net-to-net&#xA;nat (outside,outside) source static any any destination static interface internal_gateway net-to-net no-proxy-arp&#xA;nat (CILInternal,outside) source static any interface no-proxy-arp&#xA;nat (outside,CILInternal) source static any any destination static internal_gateway internal_gateway&#xA;!&#xA;object network CILInternal&#xA; nat (CILInternal,outside) dynamic interface&#xA;object network SSTPPool&#xA; nat (VM,VM) static SSTPPool no-proxy-arp route-lookup service tcp 3389 3389&#xA;object network VM&#xA; nat (VM,outside) dynamic interface&#xA;access-group outside_access_out out interface outside&#xA;!&#xA;router rip&#xA; passive-interface default&#xA; version 2&#xA;!&#xA;route outside 0.0.0.0 0.0.0.0 173.166.135.206 1&#xA;route VM SSTPPool 255.255.255.0 PPTPUser 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;http server enable&#xA;http Management 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart&#xA;sysopt connection tcpmss 0&#xA;service resetinbound interface outside&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpool policy&#xA;telnet timeout 5&#xA;ssh stricthostkeycheck&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;management-access inside&#xA;&#xA;dhcpd auto_config outside&#xA;!&#xA;dhcpd address 192.168.1.5-192.168.1.254 inside&#xA;dhcpd enable inside&#xA;!&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;ssl encryption rc4-sha1 dhe-aes128-sha1 dhe-aes256-sha1 aes128-sha1 aes256-sha1 3des-sha1 rc4-md5 des-sha1 null-sha1&#xA;&#xA;#------------------------------&#xA;#        WebVPN Config&#xA;#------------------------------&#xA;webvpn&#xA; enable outside&#xA; enable CILInternal&#xA; tunnel-group-list enable&#xA; internal-password enable&#xA;group-policy sslvpngp1 internal&#xA;group-policy sslvpngp1 attributes&#xA; vpn-tunnel-protocol l2tp-ipsec&#xA; webvpn&#xA;  url-list value webaccess&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec&#xA; webvpn&#xA;  url-list value Test_bookmark_list&#xA;group-policy GroupPolicy1 internal&#xA;group-policy GroupPolicy1 attributes&#xA; vpn-tunnel-protocol ssl-clientless&#xA;username test_user password &amp;lt;password&amp;gt; encrypted privilege 0&#xA;username test_user attributes&#xA; vpn-group-policy DfltGrpPolicy&#xA;username spu password &amp;lt;password&amp;gt; encrypted privilege 0&#xA;username spu attributes&#xA; vpn-group-policy sslvpngp1&#xA;username &amp;lt;username&amp;gt; password &amp;lt;password&amp;gt;. encrypted&#xA;username &amp;lt;username&amp;gt; attributes&#xA; group-lock value VDTG_test&#xA;tunnel-group VDTG_test type remote-access&#xA;tunnel-group VDTG_test general-attributes&#xA; default-group-policy GroupPolicy1&#xA;tunnel-group VDTG_test webvpn-attributes&#xA; group-alias Interns enable&#xA; group-url https://&amp;lt;machine on local network&amp;gt; enable&#xA;!&#xA;&#xA;#-----------------------------&#xA;#       End VPN Stuff&#xA;#-----------------------------&#xA;&#xA;&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc&#xA;  inspect xdmcp&#xA;  inspect sip&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect ip-options&#xA;  inspect pptp&#xA;  inspect icmp&#xA;policy-map CONNS&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;Cryptochecksum:020ed7a25844649339d817e33242d316&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any help would be very appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;:  It's also worth noting that machines on the inside network do have internet access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;:  The log is showing repeated &quot;Built tcp connection...&quot; and &quot;Teardown tcp... 0 SYN Timeout&quot; messages when trying to access the vpn.  At the moment, we have a NAT rule to forward all traffic to the outside interface to go to the internal gateway address, and we have access-list rules to allow all traffic to to the internal gateway with the https protocol.  The logs show that the packets have the internal gateway and port 443 as their destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;:  So many company just had one of our experts come in and re-do the entire configuration while we weren't here.  So it works now, but unfortunately I don't know what the solution was.&lt;/p&gt;&#xA;" OwnerUserId="27338" LastEditorUserId="27338" LastEditDate="2016-06-22T14:08:26.363" LastActivityDate="2016-06-22T14:08:26.363" Title="Problems connecting to clientless vpn portal on a Cisco ASA 5505" Tags="|cisco|cisco-asa|vpn|troubleshooting|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32452" PostTypeId="2" ParentId="32336" CreationDate="2016-06-21T17:54:17.420" Score="1" Body="&lt;p&gt;Following up to myself, we discovered that the AWS security policy had an effect here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we were seeing the weird &quot;disconnect after 10 minutes&quot; issue, the security policy was set to only allow inbound UDP on port 500 (whitelisted to the  peer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We changed the policy to allow all inbound traffic (on all ports) from the  peer and the problem seems to have gone away.&lt;/p&gt;&#xA;" OwnerUserId="27240" LastActivityDate="2016-06-21T17:54:17.420" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32453" PostTypeId="2" ParentId="32444" CreationDate="2016-06-21T18:28:26.293" Score="0" Body="&lt;p&gt;The situation may vary on the services you have contracted for with your ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If for example your ISP provides a 'normal' Layer 3 WAN connectivity, then your rfc1918 /30 or /31 IP addressing will not work as your WAN facing ip addresses will be unroutable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if your ISP provides your WAN connectivity through their managed business mpls vpn, they may provide you with ip addressing from rfc1918 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mpls vpn implementations are very common with business ISPs and have been around for quite awhile. And there are costs involved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/MPLS_VPN&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/MPLS_VPN&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="4565" LastEditDate="2016-06-21T18:34:49.573" LastActivityDate="2016-06-21T18:34:49.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32455" PostTypeId="2" ParentId="32446" CreationDate="2016-06-21T21:14:06.587" Score="1" Body="&lt;p&gt;I think what you are trying to do is choose which port on the two switches to be in a blocking state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have two switches and they are connected to each other with two Ethernet cables, assuming the port speed are the same, which equals same cost, spanning tree will choose which path is fastest to the root bridge, by looking at the port priority and port id. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the BPDU's coming from the root bridge/Upstream switch that count, you need to adjust the port priority to a lower value on the root bridge side, so that the adjacent switch port will receive a lower port priority BPDU compared to the second Ethernet link, causing this to be the preferred path back to the root bridge. Which in turn would set the second port to be in a blocking state, amber LED.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To view port priority numbers, use the &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show spanning-tree&lt;/strong&gt; command on a Cisco switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should see a list of ports and &lt;strong&gt;Prio.Nbr&lt;/strong&gt; something like &lt;strong&gt;128.24&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To change the port priority, you can use the following:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;switch(config-if)# spanning-tree port-priority 32&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The priority values are 0, 32, 64, 96, 128, 160, 192, and 224. All other values are rejected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="27056" LastEditDate="2016-06-21T21:34:02.983" LastActivityDate="2016-06-21T21:34:02.983" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32459" PostTypeId="1" AcceptedAnswerId="32460" CreationDate="2016-06-22T01:23:14.910" Score="2" ViewCount="1791" Body="&lt;p&gt;As I understand, when &lt;code&gt;no auto-summary&lt;/code&gt; command is used, the &lt;code&gt;network&lt;/code&gt; command could include all the interface with IP addresses included in the classful network border defined by the &lt;code&gt;network&lt;/code&gt; command. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 10.1.1.1 255.255.255.0&#xA;&#xA;interface FastEthernet0/1&#xA; ip address 10.2.2.1 255.255.255.0&#xA;&#xA;interface FastEthernet1/0&#xA; ip address 172.16.1.1 255.255.255.0&#xA;&#xA;router rip&#xA; version 2&#xA; no auto-summary&#xA; network 10.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This RIPv2 will include both FE0/0 and FE0/1. If I just want FE0/0 to be included but not FE0/1, is it possible? Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="27348" LastEditorUserId="8499" LastEditDate="2018-12-25T01:31:45.100" LastActivityDate="2018-12-25T01:31:45.100" Title="How to exclude one subnet in RIPv2?" Tags="|cisco|routing|cisco-ios|cisco-commands|rip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32460" PostTypeId="2" ParentId="32459" CreationDate="2016-06-22T01:44:51.603" Score="1" Body="&lt;p&gt;That depends on what you mean by included. You can use the &lt;code&gt;passive-interface&lt;/code&gt; command to prevent that interface from sending RIP advertisements, or you can use a distribute list to filter advertised prefixes.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfindp1.html#wpxref16654&quot; rel=&quot;nofollow&quot;&gt;Chapter: IP Routing Protocol-Independent Commands: accept-lifetime Through passive-interface&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;passive-interface&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;To disable sending routing updates on an interface, use the&#xA;  &lt;strong&gt;passive-interface&lt;/strong&gt; command in router configuration mode. To reenable the sending of routing updates, use the &lt;strong&gt;no&lt;/strong&gt; form of this&#xA;  command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;passive-interface&lt;/strong&gt; [default] {interface-type &lt;em&gt;interface-number&lt;/em&gt;}&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;no passive-interface&lt;/strong&gt; interface-type &lt;em&gt;interface-number&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfrip.html&quot; rel=&quot;nofollow&quot;&gt;Chapter: RIP Commands&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;distribute-list out (RIP, IGRP, EIGRP)&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;To suppress networks from being advertised in updates, use the&#xA;  &lt;strong&gt;distribute-list out&lt;/strong&gt; command in address family or router configuration mode. To disable this function, use the &lt;strong&gt;no&lt;/strong&gt; form of&#xA;  this command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;distribute-list&lt;/strong&gt; {&lt;em&gt;access-list-number&lt;/em&gt; | prefix &lt;em&gt;prefix-list-name&lt;/em&gt; [gateway &lt;em&gt;prefix-list-name&lt;/em&gt;]} &lt;strong&gt;out&lt;/strong&gt; [&lt;em&gt;interface-name&lt;/em&gt; |&#xA;  &lt;em&gt;routing-process&lt;/em&gt; | &lt;em&gt;as-number&lt;/em&gt;]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;no distribute-list&lt;/strong&gt; {&lt;em&gt;access-list-number&lt;/em&gt; | prefix &lt;em&gt;prefix-list-name&lt;/em&gt; [gateway &lt;em&gt;prefix-list-name&lt;/em&gt;]} &lt;strong&gt;out&lt;/strong&gt; [&lt;em&gt;interface-name&lt;/em&gt; | &lt;em&gt;routing-process&lt;/em&gt; | &lt;em&gt;as-number&lt;/em&gt;]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-22T01:44:51.603" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32461" PostTypeId="1" CreationDate="2016-06-22T03:41:56.707" Score="1" ViewCount="957" Body="&lt;p&gt;I am trying to figure out the best way to improve reliability and uptime of my network in my server rack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Facts:&lt;/strong&gt;&#xA;- Sonicwall 3600 FW/Router (active/passive) - 1 internet and 1 leased line connection, + 2 IP sec tunnels&#xA;- 2x HP2920 switches with stacking module (only 1 switch is actually in use right now)&#xA;- about 15 host machines (2 NIC) running VM's (probably about 50 VM's or so)&#xA;- Network is VLAN'ed (flat segment for the physical machines, various VLAN's for the VM's)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a production environment so I can't make major changes, and can't spend any more money, so I am trying to see how to make best use of what I have. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We tried to configure NIC bonding at the server level to connect out 1 NIC to 1 switch each , but that caused a ARP flood that brought down the whole network, so obviously we weren't doing things right. Hosts are Unix hosts. Anyone has experience in this kind of setup to provide some guidance? We are not a big shop to have all the complex networking setups that you find when Googling around - just trying to get something relatively simple that meets our needs so that I don't have hours and hours of outage if the switch goes down.&lt;/p&gt;&#xA;" OwnerUserId="27349" LastActivityDate="2016-06-22T09:30:19.477" Title="Redundant network using 2 switches" Tags="|router|vlan|switching|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32463" PostTypeId="2" ParentId="30969" CreationDate="2016-06-22T09:02:28.430" Score="0" Body="&lt;p&gt;In most home network, cat5e is always chosen as the medium for gigabit speeds or if you want 10Gbit/s links, then CAT6 is a good choice once the distance is no so long. Certainly, for bandwidth enjoyment in future, single-mode fiber or multi-mode fiber are all okay. By the way, what's your budget?&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-06-22T09:02:28.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32464" PostTypeId="2" ParentId="32461" CreationDate="2016-06-22T09:30:19.477" Score="1" Body="&lt;p&gt;If you have the HP2920's stacked together and they are being seen as one switch fabric, you can plug an Ethernet cable to each switch from each server and use LACP trunks to setup link aggregation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that when you did this last time your network went down but this will more than likely be to the fact that you did not setup an LACP trunk on your switch. You will need to make sure you configure this on the switches before connecting them to the servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had LACP configured on the server but not the switches, that the sort of behaviour I would expect to see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can start of with just one link plugged in for continuation of service and add the other once all is configured. Just be aware that there will be a brief outage while the links are aggregated. This should only be a few seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To configure the trunk on a procurve switch, use the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HP-2920(config)# trunk 47-48 trk1 lacp active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will tell the switch to send LACP control packets and try to establish a LAG between the switches and the server. If your server does not support LACP, you will need to use something like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HP-2920(config)# trunk 47-48 trk1 trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which will establish a static LAG and force one to be created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using this method you will receive redundancy between your switch and servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-22T09:30:19.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32466" PostTypeId="1" AcceptedAnswerId="32480" CreationDate="2016-06-22T11:33:32.947" Score="1" ViewCount="58" Body="&lt;p&gt;In some situations or on some locations, I'm struggling with restricted &lt;strong&gt;outgoing&lt;/strong&gt; traffic. For example a restricted LAN where outgoing traffic is only allowed on limited ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to check or test my connection or network for &lt;em&gt;incoming&lt;/em&gt; traffic on various ports. But I can't find how to do the opposite: checking on what ports I can make &lt;em&gt;outgoing&lt;/em&gt; connections from my device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how to do this? E.g. a way to probe a range of ports (regardless to what external server or IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume there a different ways to do this for different platforms: in this case I'm on OS X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I'm not dealing with a firewall or restriction on my own device, it's not a matter of local system configuration. I'm connected through a LAN which appears to have a very restrictive firewall or router or something, and I need to find out to which ports I can still connect to the outside world. &lt;/p&gt;&#xA;" OwnerUserId="18827" LastEditorUserId="18827" LastEditDate="2016-06-22T13:03:01.243" LastActivityDate="2016-06-22T22:37:24.113" Title="How to test outoing traffic on random ports? (on OS X)" Tags="|firewall|ip|network-access|testing|port-security|" AnswerCount="1" CommentCount="9" ClosedDate="2016-06-23T08:09:49.363" ContentLicense="CC BY-SA 3.0" />
  <row Id="32467" PostTypeId="1" CreationDate="2016-06-22T12:45:25.560" Score="0" ViewCount="4964" Body="&lt;p&gt;Hello i have one doubt&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.if there are four protocols connections for instance rip,OSPF,static,and direct &#xA;which routing protocol would be used , although it will take one with lowest administrative distance. what if i just want only OSPF as a routing protocol not static,rip or any other routing protocols to be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.what command we can use to change administrative distance?&lt;/p&gt;&#xA;" OwnerUserId="27360" LastActivityDate="2016-06-22T13:39:37.827" Title="changing routing protocols administrative distance" Tags="|protocol-theory|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32469" PostTypeId="2" ParentId="32467" CreationDate="2016-06-22T13:27:53.223" Score="2" Body="&lt;p&gt;According to your first question, the answer is not as easy as you might think.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When there are multiple routing protocols configured, all of them will run and form adjacencies to their next hop routers and exchange routing information. Most if not each routing protocol has a routing protocol specific information database, containing routes exchanged by this routing protocol. On cisco gear you can view them for example with &lt;code&gt;sh ip ospf database&lt;/code&gt; or &lt;code&gt;sh ip rip database&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the router has to decide which routes are placed in his actual routing information base (also called RIB or routing table). Here, the most important factor is the &quot;precision&quot; of a route. That is: the higher the prefix length is, the more exact is the route and the more preferred. Only if there are two &lt;em&gt;identical&lt;/em&gt; routes, that is same subnet address and same subnet mask or prefix length, the administrative distance comes into play.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose the following example (note that ADs are default values from Cisco):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.100.0/24 learned by OSPF, AD is 110&lt;/li&gt;&#xA;&lt;li&gt;192.168.100.128/25 learned by RIP, AD is 120&lt;/li&gt;&#xA;&lt;li&gt;192.168.200.0/24 directly connected, AD is 0&lt;/li&gt;&#xA;&lt;li&gt;192.168.200.0/24 static route, AD is 1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In this example, the first route learned by OSPF will be placed in the routing table. As the second one is more specific (25 bit prefix instead of 24) it is also added to the routing table. Note that while the second route is included in the first one, they are not equal due to the different prefix length. The third and fourth routes are identical, but the AD of directly connected routes is always 0 and hence this route is preferred.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically you can influence routing decision in at least three ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In each routing protocol, you can tweak metrics&lt;/li&gt;&#xA;&lt;li&gt;Change the AD of routing protocols&lt;/li&gt;&#xA;&lt;li&gt;Advertise more specific routes which are always preferred.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Changing the AD&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Cisco gear, you can change the AD of routing protocols like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! static routes - the last optional value (50) is the AD&#xA;ip route 192.168.100.0 255.255.255.0 1.2.3.4 50&#xA;&#xA;! OSPF - can be changed in the OSPF routing process, is slightly more complicated&#xA;! The generic command is: distance &amp;lt;AD&amp;gt; &amp;lt;source addr&amp;gt; &amp;lt;wildcard-mask&amp;gt; &amp;lt;ACL&amp;gt;&#xA;! AD is configured per source router, and an additional ACL is required&#xA;! To change AD of all routes to 85 (instead of default 110)&#xA;access-list 10 permit any&#xA;&#xA;router ospf 1&#xA;    distance 85 0.0.0.0 255.255.255.255 10&#xA;&#xA;! RIP&#xA;! For RIP, the command is:&#xA;! distance admin-distance [ prefix prefix-length | prefix mask ]&#xA;! The command needs to be entered inside the routing process, where the last &#xA;! elements are not required but can be used to conditionally change the distance&#xA;&#xA;router rip&#xA;    distance 50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Beware that you can never change the AD to be lower than or equal to 0, hence routing protocols cannot compete with directly connected routes using the administrative distance. If you need a routing protocol to override directly connected routes you should ask yourself why you need the direct connection. Technically however you could advertise more specific routes.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="3875" LastEditDate="2016-06-22T13:39:37.827" LastActivityDate="2016-06-22T13:39:37.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32471" PostTypeId="2" ParentId="24789" CreationDate="2016-06-22T14:34:57.633" Score="5" Body="&lt;p&gt;First of all, a good network diagram will always make it easier for others to understand what you are trying to say. Even a quick little diagram is better than nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made this in an attempt to understand what you were talking about:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/oHXVG.png&quot; alt=&quot;Quick diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;VLAN 103 in Mikrotik 2 can't connect/route to VoIP server (192.168.121.2) on Ether 9 in Mikrotik 1.&lt;/li&gt;&#xA;  &lt;li&gt;I need Ether 9 (VoIP server 192.168.121.2) in Mikrotik 1 to route to VLAN 103 (192.168.112.0) in Mikrotik 2.&lt;/li&gt;&#xA;  &lt;li&gt;How do i route traffic from VLAN 102 in Mikrotik 1 to Ether 3 (Mikrotik 1) and down to Ether 3 in Mikrotik 2 to the ISP which is connected on Ether 1 in Mikrotik 2?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Stop thinking about the VLANs when you are talking about routing. A router does not care what VLAN a subnet is on until it needs to exit a VLAN trucked interface. While the router is routing between subnets, it just wants to know the subnet IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without more information it is hard to know what the problem is, but it is most likely a routing problem, just like @Nick B. mentioned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of the subnets on MikroTik 1 have to have a route on MikroTik 2, and each of the subnets on MikroTik 2 have to have a route on MikroTik 1.&#xA;You can make this easier by enabling a routing protocol on both routers.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Well, i would like to know do i need a vlan trunk here in both mikrotik? If so which port should i make it a trunk? A port that has vlan which connected to the switch or the port between mikrotik (port 3 on each mikrotik)?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Trunks are only used between two switches, or between a switch and a router to create a &quot;router on a stick&quot;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;I really don't understand how mikrotik router route the traffic from one vlan suppose from vlan 103(192.168.114.0/24) in mikrotik1 to vlan103(192.168.112.0/24) in mikrotik2 as both vlan id is same but the IP is different?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since the two VLANs are on different routers with different subnet addresses, they aren't related at all. The traffic needs to be routed between the two routers.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;3&quot;&gt;&#xA;  &lt;li&gt;In mikrotik, is it possible that any ip address or vlan can route to another IP class/Vlan in the same router?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Routers by default always create a route to directly connected subnets. So nothing should prevent two VLANs on the same router from communicating, unless the VLANs are configured incorrectly or firewall rules are blocking it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @Nick B. started at, do the following on the designated routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MikroTik 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ip route add dst-address=192.168.112.0/24 gateway=192.168.30.2&#xA;/ip route add dst-address=192.168.111.0/24 gateway=192.168.30.2&#xA;/ip route add dst-address=0.0.0.0/0 gateway=192.168.30.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;MikroTik 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ip route add dst-address=192.168.121.0/24 gateway=192.168.30.1&#xA;/ip route add dst-address=192.168.99.0/24 gateway=192.168.30.1&#xA;/ip route add dst-address=192.168.168.0/24 gateway=192.168.30.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27361" LastEditorUserId="27361" LastEditDate="2016-09-01T07:38:58.520" LastActivityDate="2016-09-01T07:38:58.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32472" PostTypeId="1" AcceptedAnswerId="32486" CreationDate="2016-06-22T14:40:17.083" Score="0" ViewCount="23168" Body="&lt;p&gt;I have the following: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows 7&lt;/li&gt;&#xA;&lt;li&gt;Putty .66&lt;/li&gt;&#xA;&lt;li&gt;RJ45-DB9&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have been out of the networking field for quite sometime (10 years) and I forgot how to console into a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need to configure my PC interface with an IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I select serial/ssh/telnet for my connection on PuTTy?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone would be able to provide a step-by-step &quot;guide&quot; I'd appreciate it very much.&lt;/p&gt;&#xA;" OwnerUserId="25153" LastActivityDate="2017-07-05T14:56:51.790" Title="How to connect to a Summit switch via PuTTy using a RJ45-DB9 cable" Tags="|switch|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32473" PostTypeId="1" CreationDate="2016-06-22T15:08:11.603" Score="2" ViewCount="11002" Body="&lt;p&gt;We have a Cisco ISE 2.0 in our lab doing some 802.1X testing. To have synchonized times, we use an NTP server in the same subnet as the ISE to sync all the components (stratum 3, based on Bluecat appliances). All switches, firewalls and other components use it as timezone and it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured the same NTP server on my Cisco ISE, but even after multiple restarts it does not use it as NTP source.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ise/admin# sh run | i ntp&#xA;ntp server 146.140.66.230&#xA;ntp server 62.75.254.179&#xA;&#xA;ise/admin# sh run | i timezone&#xA;clock timezone CET&#xA;&#xA;ise/admin# sh ntp&#xA;Configured NTP Servers:&#xA;  146.140.66.230&#xA;  62.75.254.179&#xA;&#xA;synchronised to local net at stratum 11&#xA;   time correct to within 11 ms&#xA;   polling server every 64 s&#xA;&#xA;     remote           refid      st t when poll reach   delay   offset  jitter&#xA;==============================================================================&#xA;*127.127.1.0     .LOCL.          10 l   16   64  377    0.000    0.000   0.000&#xA; 146.140.66.230  192.76.247.100   3 u   51   64  377    0.221  134683. 21473.0&#xA; 62.75.254.179   5.100.133.221    2 u   41   64  377    3.941  142841. 14340.1&#xA;&#xA;* Current time source, + Candidate , x False ticker&#xA;&#xA;Warning: Output results may conflict during periods of changing synchronization.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both of them are reachable (the first one even in the same subnet), as can be also seen at the delay / jitter values. Interestingly the offset differs quite significant looking at both time servers. The offset however is roughly correct, slightly more than 2 minutes. As I do not have access to the root shell, I cannot use ntpq as indicated by this &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/119371-technote-ise-00.html&quot; rel=&quot;nofollow&quot;&gt;tech note&lt;/a&gt;. Additionally, as far as I know, none of both sersers is a Microsoft NTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to make sure it is not an NTP server issue, I configured one of our Cisco routers as NTP server, which itself uses 146.140.66.230. ISE recognizes it as stratum 4 server, but does not choose it as time source. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any hints how to tackle this one? &lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="3875" LastEditDate="2016-06-22T18:30:07.363" LastActivityDate="2017-09-08T18:45:58.297" Title="NTP synchronization issue with Cisco ISE" Tags="|cisco|ntp|cisco-ise|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32474" PostTypeId="1" AcceptedAnswerId="43237" CreationDate="2016-06-22T15:42:44.717" Score="1" ViewCount="3768" Body="&lt;p&gt;A customer has a network: 10.0.0.0/24.&#xA;The gateway 10.0.0.1/24 is represented by an SVI for VLAN 10 on a core switch.&#xA;Downstream there is an ACE Load balancer, which has a BVI.&#xA;This BVI's IP address is 10.0.0.4/24 and bridges two VLAN's 20 and 30.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;New applications are all build in the same /24.  The VIP IP allocate for these new apps also is assigned from the same /24.  As an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!-- Example application&#xA;!-- Frontend VIP IP&#xA;10.0.0.7&#xA;&#xA;!-- Backend Servers&#xA;10.0.0.8&#xA;10.0.0.9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In ARP in the Core, the SVI is (obviously) part of VLAN 10, however, the same IP is shown belonging to VLAN 20 down in the ACE per ARP.  VIP IP's show up in VLAN 20, backend servers show up in VLAN 30.  All the same /24.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!-- SVI in the core&#xA;Interface Vlan10&#xA;  ip address 10.0.0.2/24&#xA;  hsrp version 2&#xA;  hsrp 10&#xA;    preempt&#xA;    ip 10.0.0.1&#xA;  no shut&#xA;&#xA;!-- Sh ip arp output (simulated)&#xA;10.0.0.1    -    0000.0cxx.xxxx    vlan10&#xA;10.0.0.2    -    xxxx.xxxx.xxxx    vlan10&#xA;&#xA;&#xA;!-- Int/BVI config in the ACE&#xA; interface vlan 20&#xA;  bridge-group 20&#xA;  no normalization&#xA;  mac-sticky enable&#xA;  no icmp-guard&#xA;  service-policy input VIP-policy&#xA;  no shut&#xA;&#xA;Interface vlan 30&#xA;  bridge-group 20&#xA;  no normalization&#xA;  mac-sticky enable&#xA;  no icmp-guard&#xA;  service-policy input backend-server-policy&#xA;  no shut&#xA;&#xA;Interface bvi 20&#xA;  ip address 10.0.0.5 255.255.255.0&#xA;  alias 10.0.0.4 255.255.255.0&#xA;  peer ip address 10.0.0.6 255.255.255.0&#xA;  no shut&#xA;&#xA;!-- Sh arp output (simulated)&#xA;&#xA;10.0.0.1    0000.0cxx.xxxx    vlan20&#xA;10.0.0.4    xxxx.xxxx.xxxx    bvi20&#xA;10.0.0.7    xxxx.xxxx.xxxx    vlan20&#xA;10.0.0.8    xxxx.xxxx.xxxx    vlan30&#xA;10.0.0.9    xxxx.xxxx.xxxx    vlan30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How does this work (It does by the way)?  Specifically from a tagging perspective, how is it possible for the traffic to move from the endpoint through the LB and the core successfully?  Again, the only bridging is internal to the LB, not between the LB and anything else.&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2018-01-11T15:28:02.467" Title="Same subnet, 3 different VLANs - How?" Tags="|cisco|bridging|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="32475" PostTypeId="1" CreationDate="2016-06-22T17:49:30.813" Score="3" ViewCount="691" Body="&lt;p&gt;I am trying to setup a VPN connection using AWS VPC. I have generated the VPN configuration files and have sent to the client. However the client is asking for the Blue highlighted info in the attached image. I'm wondering where can I get these info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QpdyE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QpdyE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27366" LastEditorUserId="775" LastEditDate="2021-05-04T23:33:37.327" LastActivityDate="2021-05-04T23:33:37.327" Title="AWS VPC and Cisco ASA" Tags="|cisco-asa|vpn|aws|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32476" PostTypeId="2" ParentId="32472" CreationDate="2016-06-22T18:41:54.177" Score="1" Body="&lt;p&gt;You'll also need a USB to serial adapter if you computer has no serial interface. Choose serial in putty and 9600 baud, 8 data bits, no parity and 1 stop bit (96008n1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can only use ssh/telnet if you device has an IP address and is configured correctly.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2016-06-22T18:41:54.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32477" PostTypeId="1" AcceptedAnswerId="32478" CreationDate="2016-06-22T19:15:18.203" Score="1" ViewCount="114" Body="&lt;p&gt;I have Netflow V9 being sent to a server running Ubuntu 14.04. The data is communicated on port 2000 (the default for Netflow). However nothing appears to be listening on that port. (nothing shows port 2000 when I run 'netstat -ntlp'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a few rather-noobish questions:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;What service should I configure to listen on port 2000?&#xA;Where can I find this raw data? Is it by default being written to a file? &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The point of my project is to fan out the netflow data, with some of it being downsampled prior to being forwarded. Our Cisco Nexus can fan out and downsample, but my understanding is the Nexus 7000 can't fan out and downsample just one exporter, it's an all-or-none as far as downsampling goes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I can provide any additional info, please let me know. Thanks for any and all help.&lt;/p&gt;&#xA;" OwnerUserId="25330" LastActivityDate="2016-06-28T18:04:02.520" Title="Where does Netflow get Written to?" Tags="|netflow|cisco-nexus-7k|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32478" PostTypeId="2" ParentId="32477" CreationDate="2016-06-22T20:52:05.157" Score="2" Body="&lt;p&gt;You can send as much netflow traffic to a host as you like. Without some software listening on the host you wont collect any data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several options to choose from, my Debian box here comes with nfdump, pmacct, ntopng ant probably several others. There are many more options from a free and open source to very expensive commercial software. Where the data is stored depends on the software you use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past I found a combination of nfdump and nfsen (web interface for nfdump) quite useful.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorDisplayName="user2084" LastEditDate="2016-06-28T18:04:02.520" LastActivityDate="2016-06-28T18:04:02.520" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32479" PostTypeId="2" ParentId="28911" CreationDate="2016-06-22T21:57:52.537" Score="1" Body="&lt;p&gt;This is the configuration I used to accomplish my FQDN DMVPN setup.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HUB&#xA;&#xA;interface Tunnel0&#xA; ip address 10.0.0.1 255.255.255.0&#xA; no ip redirects&#xA; ip mtu 1400&#xA; ip hello-interval eigrp 100 3&#xA; ip hold-time eigrp 100 24&#xA; no ip next-hop-self eigrp 100&#xA; no ip split-horizon eigrp 100&#xA; ip nhrp authentication cisco&#xA; ip nhrp map multicast dynamic&#xA; ip nhrp network-id 1&#xA; ip nhrp registration no-unique&#xA; ip tcp adjust-mss 1360&#xA; tunnel source GigabitEthernet0/0&#xA; tunnel mode gre multipoint&#xA; tunnel key 1&#xA; tunnel protection ipsec profile cisco&#xA;&#xA;crypto isakmp policy 10&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp keycisco address 0.0.0.0        &#xA;crypto ipsec transform-set cisco esp-aes esp-sha-hmac &#xA; mode transport&#xA;crypto ipsec profile cisco&#xA; set transform-set cisco&#xA;&#xA;Spoke&#xA;&#xA;interface Tunnel0&#xA; ip address 10.0.0.2 255.255.255.0&#xA; no ip redirects&#xA; ip mtu 1400&#xA; ip hello-interval eigrp 100 3&#xA; ip hold-time eigrp 100 24&#xA; ip nhrp authentication cisco&#xA; ip nhrp map multicast dynamic&#xA; ip nhrp network-id 1&#xA; ip nhrp nhs 10.0.0.1 nbma url.net multicast&#xA; ip tcp adjust-mss 1360&#xA; tunnel source FastEthernet0/0&#xA; tunnel mode gre multipoint&#xA; tunnel key 1&#xA; tunnel protection ipsec profile cisco&#xA;&#xA;crypto isakmp policy 10&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp key cisco address 0.0.0.0 0.0.0.0&#xA;crypto ipsec transform-set cisco esp-aes esp-sha-hmac &#xA;crypto ipsec profile cisco&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23913" LastActivityDate="2016-06-22T21:57:52.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32480" PostTypeId="2" ParentId="32466" CreationDate="2016-06-22T22:09:17.123" Score="1" Body="&lt;p&gt;Use a program like NMAP to determine what ports are open to what addresses. Security operations(assuming your network has a security team) may not appreciate this as it will look suspicious when you are scanning networks for open ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://nmap.org/book/inst-macosx.html&quot; rel=&quot;nofollow&quot;&gt;https://nmap.org/book/inst-macosx.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23913" LastEditorUserId="23913" LastEditDate="2016-06-22T22:37:24.113" LastActivityDate="2016-06-22T22:37:24.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32481" PostTypeId="1" CreationDate="2016-06-23T00:28:46.453" Score="1" ViewCount="61" Body="&lt;p&gt;I have following design:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/hodBS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hodBS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I learn switching i started learning on cisco switches. Now We have 3 hp switches. We have to configure spanning tree between sw1,sw2 and sw3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I did was type spanning-tree in cli and change priority so that sw1 is root switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I have another requirement, I want to access those three switches (i.e SW1,SW2 and SW3) from SW4. I am assuming I have to stack it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, we use trunk mode between switches in cisco, do I have to do that in HP Switches?&lt;/p&gt;&#xA;" OwnerUserId="5962" LastActivityDate="2016-06-23T04:20:18.530" Title="New to HP Switching. Asking topology questions" Tags="|cisco|spanning-tree|stacking|php|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32483" PostTypeId="1" AcceptedAnswerId="32485" CreationDate="2016-06-23T02:50:52.200" Score="2" ViewCount="117" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5axMR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5axMR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions: How does etherchannel will loadbalance traffic here when traffic coming from internet, L3 will hash IP src-dst but one that traffic pass to first L2 switch (distributed) how does that traffic will loadbalance on 2G link using &lt;code&gt;src-mac&lt;/code&gt;? what src mac address it would use and shared traffic? &lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-06-23T04:39:30.073" Title="etherchannel loadbalacing logic question" Tags="|cisco|switch|etherchannel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32484" PostTypeId="2" ParentId="32481" CreationDate="2016-06-23T04:20:18.530" Score="1" Body="&lt;p&gt;I don't know what you mean exactly by &quot;I want to access 1, 2 and 3 from sw4.&quot;  If you want to log in to sw4's CLI and directly manipulate the other switches, then yes, you should stack them.  If you want traffic to be switched onto the first three switches from a device connected to sw4 then that should already be working in the default config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Trunk in Cisco means something completely different than trunk in HP.  Cisco's trunk is an interface that carries multiple tagged VLANs.  In HP, a trunk is a group of interfaces aggregated into a single logical trunk group.  In other words, LAG or link aggregation.  The whole thing is really confusing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At any rate, if you need to create something on an HP device which is analogous to Cisco's &quot;trunk&quot; you'll need to use what HP simply refers to as &quot;tagged port&quot; configuration within the VLAN context.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-06-23T04:20:18.530" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32485" PostTypeId="2" ParentId="32483" CreationDate="2016-06-23T04:32:33.667" Score="1" Body="&lt;p&gt;If the channel balancing on a switch is based on the source MAC address, and you have a single MAC address sending the traffic, then the traffic will always use the same channel member link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that a MAC address will not cross a layer-3 device. The layer-3 switch will create new frames for traffic coming from the ISP, and the source MAC address will be its own MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have multiple VLANs, the layer-3 switch &lt;em&gt;may&lt;/em&gt; have a MAC address for each, or it may have the same MAC address for all your VLANs. You can use the &lt;code&gt;show interfaces&lt;/code&gt; command to see how your Cisco layer-3 switch does it; just look at the SVIs' MAC addresses to see if they are the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the traffic gets to the first layer-2 switch, the traffic will be biased toward a single link on the channels to the other layer-2 switches, at least per VLAN, and possibly for all the traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-23T04:39:30.073" LastActivityDate="2016-06-23T04:39:30.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32486" PostTypeId="2" ParentId="32472" CreationDate="2016-06-23T05:55:35.783" Score="1" Body="&lt;p&gt;I'm not familiar with Summit switches (I have tried Cisco switches) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if your switch has Console port (usually they need either serial cable or RJ45)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im gonna assume it's RJ45. Your RJ45 cable ends with serial end just like in this picture: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/BYmiv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BYmiv.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You plug the RJ45 into the switch. The other end needs to go to your computer. If you're computer has serial port input, great.. If not, then you will need a good quality serial to USB cable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go to your device manager on your computer and find out what COM number you have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at my attachment. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/ju6jF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ju6jF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my computer it's COM9, open putty and follow the attachment picture.&lt;/p&gt;&#xA;" OwnerUserId="8208" LastEditorUserId="8499" LastEditDate="2016-06-23T06:29:25.567" LastActivityDate="2016-06-23T06:29:25.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32488" PostTypeId="2" ParentId="32472" CreationDate="2016-06-23T05:59:57.553" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2sHUy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2sHUy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here's an exampling using putty with COM9... You COM number might be different. if it's 3, then put 3 in putty (COM3)&lt;/p&gt;&#xA;" OwnerUserId="8208" LastActivityDate="2016-06-23T05:59:57.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32489" PostTypeId="1" AcceptedAnswerId="32493" CreationDate="2016-06-23T06:43:23.717" Score="1" ViewCount="217" Body="&lt;p&gt;I had a small clarification regarding the inbound outbound usage of offset-lists since I've been reading contradicting things regarding it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So say we have a simple topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/y4q5h.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/y4q5h.png&quot; alt=&quot;Image courtesy networklessons.com&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both R1 and R2 are running RIPv2 with no auto-summary and R1 has 2 loopback interfaces configured. Now, when we go to R2, by default, the metric to reach the loopbacks of R1 will be 1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now say we apply the following offset list on R2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset-list 1 in 3&#xA;access-list 1 permit 1.1.1.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if I'm right, the metric seen on R2 will be 4. Since we set an inbound metric as 3 and +1 because R1 sent his update with a hopcount of 1. That's fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for example, say I remove the access-list and offset list on R2 and add the following on R1's RIP process.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;offset-list 2 out 4&#xA;access-list 2 permit 1.1.1.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So now, my doubt is, will R2 receive the update with a metric of 4 or will it receive it with a metric of 5? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I ask is because I've learnt that when you apply an offset-list as outbound, it sends the metric as it is configured while when you set it as inbound, it adds the received metric to the offset-list value. Also if we follow the logic that routers increment hop count and then send the update out rather than increment it on receiving an update, this should be correct. But on GNS3 and in a few other places, it says that R2 will receive the update with hop count 5 when by my understanding, it should be 4. Is this a bug in GNS3 or is it how it really works?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm practicing everything with regard to Cisco 3700 series routers 12.4 IOS version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be much appreciated!&lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2016-06-23T07:05:21.720" Title="Offset-list inbound outbound clarification" Tags="|cisco|router|cisco-commands|rip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32493" PostTypeId="2" ParentId="32489" CreationDate="2016-06-23T07:05:21.720" Score="0" Body="&lt;p&gt;The metric in the offset list is added to the metric.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/iproute_rip/command/reference/irr_book/irr_rip.html&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS IP Routing: RIP Command Reference&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Usage Guidelines&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The offset value is added to the routing metric. An offset list with&#xA;  an interface type and interface number is considered extended and&#xA;  takes precedence over an offset list that is not extended. Therefore,&#xA;  if an entry passes the extended offset list and the normal offset&#xA;  list, the offset of the extended offset list is added to the metric.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Remember that the router receiving the metric will add a hop when it receives the metric. What it receives as the metric is the mectric for the previous hop, and it needs to add 1 for the hop to the previous router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your first example, the inbound offset metric (3) gets added to the R2 metric to R1 (1). The metric for R2 to the destination network totals 4 (1 actual hop, plus the 3 offset hops).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your second example, the outbound offset metric (4) gets added to the R1 metric (0), and R2 gets the metric (4), which gets added to the R2 metric to R1 (1). The metric for R2 to reach the destination network is 5 (1 actual hop, plus the 4 offset hops).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-23T07:05:21.720" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32494" PostTypeId="1" AcceptedAnswerId="32579" CreationDate="2016-06-23T07:57:31.147" Score="0" ViewCount="1026" Body="&lt;p&gt;I'm running &lt;code&gt;Sophos UTM 9&lt;/code&gt; with decrypt and scan &lt;code&gt;HTTPS&lt;/code&gt; traffic enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;WebEx&lt;/code&gt; works fine when I turn off &lt;code&gt;SSL Scanning&lt;/code&gt; for a machine, but I'm having trouble find all the URLs that &lt;code&gt;WebEx&lt;/code&gt; uses; so that I can exclude them from the &lt;code&gt;SSL Scanning&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are all the URLs that I have found within the &lt;code&gt;Web Filtering&lt;/code&gt; logs.      &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;^.*\.webex\.com&#xA;^.*\.webexconnect\.com&#xA;^.*\.ciscowebex\.com&#xA;https://webex.tt.omtrdc.net/&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have created a rule to exclude these URLs from the &lt;code&gt;SSL Scanning&lt;/code&gt; but &lt;code&gt;WebEx&lt;/code&gt; still doesn't work. I can't see anymore URL present in the logs or see anything being block in the &lt;code&gt;Firewall&lt;/code&gt;,&lt;code&gt;Application Control&lt;/code&gt; or &lt;code&gt;Intrusion Prevention System&lt;/code&gt; logs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have I missed something here? Has anyone else got &lt;code&gt;WebEx&lt;/code&gt; working through a &lt;code&gt;Sophos UTM&lt;/code&gt; with &lt;code&gt;HTTPS Decrypt and Scan&lt;/code&gt; enabled?  &lt;/p&gt;&#xA;" OwnerUserId="27376" LastEditorUserId="27376" LastEditDate="2016-06-23T08:04:11.370" LastActivityDate="2016-06-27T07:57:21.373" Title="WebEx Bypass HTTPS Scanning on a Sophos UTM" Tags="|firewall|network-access|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32496" PostTypeId="1" AcceptedAnswerId="32499" CreationDate="2016-06-23T09:24:57.983" Score="1" ViewCount="12003" Body="&lt;p&gt;My infrastructure contains exclusively D-Link switches, I wonder if there is a way to configure native vlan on trunk ports?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to configure native on DGS-3100 48&lt;/p&gt;&#xA;" OwnerUserId="19133" LastEditorUserId="19133" LastEditDate="2016-06-23T09:54:55.193" LastActivityDate="2018-06-20T18:25:17.413" Title="How to configure native vlan on D-Links switches" Tags="|vlan|trunk|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="32497" PostTypeId="2" ParentId="32013" CreationDate="2016-06-23T09:42:31.780" Score="1" Body="&lt;p&gt;It's a MTRJ connector. Besides, the supported module is 1000BASE-SX, and it's true that this is multi-mode cable, since 1000BASE-SX is only designed to work over MMF. Certainly, the color of this cable also show it's multi-mode version.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-06-23T09:42:31.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32499" PostTypeId="2" ParentId="32496" CreationDate="2016-06-23T10:37:29.263" Score="2" Body="&lt;p&gt;The DGS-3100 series supports IEEE 802.1Q VLANs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch's default is to assign all ports to a single 802.1Q VLAN named &lt;em&gt;default.&lt;/em&gt;&#xA;The &lt;em&gt;default&lt;/em&gt; VLAN has a VID = 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a port is configured with &lt;em&gt;Tagging&lt;/em&gt; enabled, then incoming frames that come with a tag will be untouched and will maintain its VID, but if they come untagged then it will put a VID number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This port will be a &quot;trunk port&quot; (capable of receiving tagged traffic from one or more VLANs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more details, here is the configuration &lt;a href=&quot;https://dl.dropboxusercontent.com/u/338963/dgs310048.pdf&quot; rel=&quot;nofollow&quot;&gt;manual&lt;/a&gt;  (&lt;strong&gt;Tagging and untagging&lt;/strong&gt;, page 68).&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-06-23T10:43:31.797" LastActivityDate="2016-06-23T10:43:31.797" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32500" PostTypeId="1" AcceptedAnswerId="32507" CreationDate="2016-06-23T11:29:16.117" Score="1" ViewCount="760" Body="&lt;p&gt;I need to change SSH port default to 1457 on my HP L3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I search on net but haven't found anything&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me.??&lt;/p&gt;&#xA;" OwnerUserId="22728" LastEditorUserId="36720" LastEditDate="2020-01-02T13:59:06.867" LastActivityDate="2020-01-02T13:59:06.867" Title="Change SSH port default to 1457 on HP EI 5500" Tags="|switch|hp|hp-comware|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32502" PostTypeId="1" AcceptedAnswerId="32508" CreationDate="2016-06-23T13:15:48.940" Score="1" ViewCount="502" Body="&lt;p&gt;A network engineer spotted some packet loss averaging 4 packets in 1000 then some body tried to use that as a cause for a performance issue. Is this a realistic assumption that that sought of loss can cause application performance issues. &lt;/p&gt;&#xA;" OwnerUserId="27380" LastActivityDate="2016-06-23T16:18:54.710" Title="can the loss of 4 packets in 1000 cause performance issues" Tags="|packet-loss|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32503" PostTypeId="1" AcceptedAnswerId="32509" CreationDate="2016-06-23T13:16:22.663" Score="3" ViewCount="5902" Body="&lt;p&gt;Recently migrated to a Cisco ASA/Sourcefire implementation in our enviroment and have been going through the logs on the ASA.  Looking over the logs I noticed multiple critical errors that kept coming in waves.  The message is a &quot;Land Attack&quot; being denied.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IP's are our external PAT POOL addresses being sent from the inside to the ASA itself.  Here is the error message from the ASA.  Below is a sample of the error message:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;06-17-2016 08:01:16 Local4.CriticalX.X.X.X.X%ASA-2-106017: Deny IP due&#xA;  to Land Attack from (external IP) to (external IP)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;After doing some wiresharking we discovered that this was happening everytime Apple devices in the network were trying to get to addresses:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;17.173.254.222&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;17.173.254.223&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;17.173.255.222&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;17.173.255.223&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Here is a packet capture from one: (1.1.1.1 = Our external Nat address)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;61065 232.862006 10.70.200.188 -&gt; 17.173.254.222 UDP Source port:&#xA;  58994  Destination port: 16384&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;61066 232.862006 10.70.200.188 -&gt; 17.173.254.222 UDP Source port:&#xA;  58994  Destination port: 16385&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;61067 232.862006 10.70.200.188 -&gt; 17.173.254.223 UDP Source port:&#xA;  58994  Destination port: 16386&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;61068 232.862006 10.70.200.188 -&gt; 17.173.254.222 UDP Source port:&#xA;  49729  Destination port: 16384&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;61069 232.862006 10.70.200.188 -&gt; 17.173.254.222 UDP Source port:&#xA;  49729  Destination port: 16385&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;61070 232.862006 10.70.200.188 -&gt; 17.173.254.223 UDP Source port:&#xA;  49729  Destination port: 16386&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;61080 232.901006 10.70.200.188 -&gt; 1.1.1.1 UDP Source port: 58994 &#xA;  Destination port: 58994&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Line 61080 is what triggers the &quot;land attack&quot; message and is repeated about 5 times before reverting back to using the correct inside local address for the source.  For some reason it is acting like Apple resorts to using the outside global address as the source address for the devices, causing the land attack log.  We have found the ports its using when this happens are common to Apple's FaceTime, iMessage, Gamecenter and iChat.  Usually 16393 - 16403.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried adding &quot;ip verify unicast source reachable-via rx&quot; on layer 3 interfaces on the core switch right before the ASA with no success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone seen this before and successfully fix it?  Looking for a solution other than blocking the 17.173.xxx.222/3 with an ACL at the core before being sent to the ASA.&lt;/p&gt;&#xA;" OwnerUserId="8817" LastActivityDate="2017-02-02T16:30:53.570" Title="Apple devices causing &quot;Land Attack&quot; on Cisco ASA" Tags="|cisco|cisco-asa|security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32504" PostTypeId="1" AcceptedAnswerId="32505" CreationDate="2016-06-23T13:20:32.700" Score="3" ViewCount="4169" Body="&lt;p&gt;After reading &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/24068/why-do-we-need-a-3-way-handshake-why-not-just-2-way&quot;&gt;Why do we need a 3-way handshake? Why not just 2-way?&lt;/a&gt; I understand that We need ACK otherwise the Server has no idea if the client ever received the SYN, and it's important that the client receives that.&#xA;Once that ACK gets through, now the server knows that it can send packets to the client. It also knows that the client knows this, so it can start sending data right away. The handshake is complete. We have a good channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I want to know If the final ACK segment (third step)&#xA;is never sent by the client. What server will do then? Is it run out of memory or something else because as far as I know When a client sends a SYN segment to the server, the server reserves memory to keep state information? What server will do with this state information If there is no ACK from client?&lt;/p&gt;&#xA;" OwnerUserId="22780" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-06-23T14:34:21.117" Title="what happens (on the server) when a client does not respond to the SYN-ACK segment (second step) of the three-way handshake used in TCP" Tags="|tcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32505" PostTypeId="2" ParentId="32504" CreationDate="2016-06-23T14:34:21.117" Score="5" Body="&lt;p&gt;the server will periodically retransmit the syn-ack and eventually timeout and abandon the connection entry if the final ack is not received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does consume some RAM and is the subject of DoS attacks. However there are operating system mitigations available - in linux minisocks are used to keep the footprint down and after a certain point you can transition to syncookies which don't require any server side state during this period. (but they have downsides).&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-06-23T14:34:21.117" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32506" PostTypeId="2" ParentId="32502" CreationDate="2016-06-23T15:15:35.687" Score="2" Body="&lt;p&gt;(Assuming TCP over public WAN)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes - your equipment is taking a performance hit when packets get dropped because data packets are being resent in response to the ones that got dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A 0.4% packet loss rounds to zero for a reason.  It's not bad for internet traffic quite honestly and many professional network engineers &lt;em&gt;might&lt;/em&gt; even say it's an acceptable drop rate for a wired internal network.  My opinion is that if you were able to instantly correct the problem and then use the application in a state of zero packet loss, it would be next to impossible to tell a difference.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2016-06-23T16:18:54.710" LastActivityDate="2016-06-23T16:18:54.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32507" PostTypeId="2" ParentId="32500" CreationDate="2016-06-23T15:38:12.737" Score="2" Body="&lt;p&gt;ProCurve-based HP switches offer this ability within the &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;[no] ip ssh port&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;command, but Comware-based devices do not have any such feature.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="15678" LastEditDate="2016-08-23T11:15:49.583" LastActivityDate="2016-08-23T11:15:49.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32508" PostTypeId="2" ParentId="32502" CreationDate="2016-06-23T15:58:13.297" Score="2" Body="&lt;p&gt;0.4% packet loss is quite high on an internal network.  Packet loss will definitely affect performance, but the effects are also dependent on RTT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Mathis Equation describes the maximum TCP theoretical throughput for a given RTT and Loss Rate:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MaxRate &amp;lt; (MSS/RTT)*(1 / sqrt(p))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where p is the probability of packet loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, with a RTT of 50mS and a probability of 1E-4, you couldn't go faster than 230Mb (assuming an MSS of 1450).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a &lt;a href=&quot;http://www.netcraftsmen.com/tcp-performance-and-the-mathis-equation/&quot; rel=&quot;nofollow&quot;&gt;short explanation.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-23T15:58:13.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32509" PostTypeId="2" ParentId="32503" CreationDate="2016-06-23T16:20:02.490" Score="3" Body="&lt;p&gt;A LAND attack, or LAN-D attack in some circles, is an attack that involves sending a host a packet with a source and destination address matching the host's IP address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea is if a host with the IP 5.5.5.5, receives a packet with a destination of 5.5.5.5 (itself) and a source of 5.5.5.5, it will respond to the packet, back to itself... potentially creating a response loop... and sometimes simply blue-screen crashing the host's OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nearly all modern operating system have been patched to make this &quot;attack&quot; useless, but the Cisco ASA (and many other security products) still protect against this type of &quot;attack&quot;. Which is to say, if the ASA seems a packet with a matching Source and Destination address, it will drop it claiming a potential LAND attack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, your inside addresses &lt;code&gt;10.70.200.0/24&lt;/code&gt; are being NAT'ed to a public address of &lt;code&gt;1.1.1.1&lt;/code&gt;. So two things can be happening, both of which might be triggering the LAND attack. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine this scenario:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Host ----- ASA ----- Upstream Router ----- Internet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenario #1&lt;/strong&gt;: Host sends a packet with SRC 10.70.200.20 and DST 1.1.1.1. Packet gets to ASA, ASA applies your PAT rule and translates it to SRC 1.1.1.1 DST 1.1.1.1 -- ASA detects matching source/destination and drops packet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Scenario #2&lt;/strong&gt;: Host sends a packet with SRC 10.70.200.20 and DST 1.1.1.1. Packet gets to ASA, ASA applies your PAT rule and translates it to SRC 1.1.1.1 DST 1.1.1.1. Packet is forwarded to Upstream Router. Upstream Router has an entry in its Routing Table telling it the 1.1.1.1 IP address exists back towards your ASA and sends it that way. ASA receives a packet with a DST of 1.1.1.1 and a SRC of 1.1.1.1 -- ASA detects matching source/destination and drops packet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience, I have seen it mostly be #2 that was in play. I don't believe (don't quote me) the ASA will watch for the land attack on traffic going from higher security level to lower security level (aka, inside to outside).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am guessing this is happening when the Apple devices are trying to talk directly to each other, they detect each other's public IP addresses using STUN or some other system, but they don't realize are on the same internal network, so they both actually share the same public IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To circumvent, you will need to create a new PAT rule so that when your inside hosts are speaking to 1.1.1.1, their source should be re-written as 1.1.1.2 (or anything &lt;em&gt;other&lt;/em&gt; than 1.1.1.1). This way the SRC and DST don't match, and don't trigger the ASA's LAND Attack defense.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-06-23T16:20:02.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32511" PostTypeId="1" CreationDate="2016-06-23T16:44:52.123" Score="3" ViewCount="3034" Body="&lt;p&gt;I have a problem that I can’t seem to resolve.   Here’s what happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 6 switches, all connected in a circular way.  ex: 1 -&gt; 2 -&gt; 3 -&gt; 4 -&gt; 5 -&gt; 6 -&gt; Back to 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This created a local network for all my SAN storages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However,  if 1 switch get Rebooted (for ex: Switch 1 rebooted),   it seems like the entire network get resets.  All of my SAN Storages will lose connection and regain connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each switch is connected to another using LAG&lt;/p&gt;&#xA;" OwnerUserId="27385" LastEditorUserId="36720" LastEditDate="2017-09-22T19:23:17.643" LastActivityDate="2018-03-21T22:41:23.947" Title="Multiple switches connected together for redundancy" Tags="|switch|switching|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32514" PostTypeId="1" AcceptedAnswerId="32658" CreationDate="2016-06-23T18:12:47.643" Score="1" ViewCount="205" Body="&lt;p&gt;I have a customer with 3 sites, 5000 users.  2 sites are Data Centers and 1 site is HQ.  The sites are connected via ring topology with 10G MetroEthernet service - that's 6 10G ports in all across 6 Dell 4048 switches - 2 switches per site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My idea is to &lt;a href=&quot;http://www.dell.com/support/manuals/us/en/19/force10-s4048-on/S4048-ON-9.10.0.0-Config-Pub/Supported-Stacking-Topologies?guid=GUID-89B3321F-92F6-4AE5-A84B-74E8756B0040&amp;amp;lang=en-us&quot; rel=&quot;nofollow&quot;&gt;stack these 6 as a single logical switch&lt;/a&gt; vs configuring them as standalone switches running VLT between the pair at each location.  I do not see any reason why I would not simply stack them as one switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have a good reason not to stack these Dell 4048's into 1 logical switch?  What's a better topology and why?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-06-29T21:26:37.817" Title="Dell 4048 - Metro Ethernet Topology?" Tags="|ethernet|stacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32515" PostTypeId="1" CreationDate="2016-06-23T19:46:23.580" Score="1" ViewCount="83" Body="&lt;p&gt;I'm trying to make an active/standby link for HSRP on TWO 3560 switches. For the standby link, I want amber colored ports for the standby link on each switch, and green ports for the active link. I have two trunk links since I have two uplinks. Here is my output so far for the &lt;code&gt;show standby&lt;/code&gt; command, but all four ports are green, and I need an amber port on each switch.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;new#sh standby&#xA;Vlan20 - Group 100&#xA;  State is Standby&#xA;    4 state changes, last state change 01:43:53&#xA;  Virtual IP address is 10.10.10.253 (learnt)&#xA;  Active virtual MAC address is 0000.0c07.ac64&#xA;    Local virtual MAC address is 0000.0c07.ac64 (v1 default)&#xA;  Hello time 3 sec, hold time 10 sec&#xA;    Next hello sent in 1.323 secs&#xA;  Preemption disabled&#xA;  Active router is 10.10.10.252, priority 190 (expires in 9.774 sec)&#xA;  Standby router is local&#xA;  Priority 100 (default 100)&#xA;  IP redundancy name is &quot;hsrp-Vl20-100&quot; (default)&#xA;Vlan40 - Group 100&#xA;  State is Standby&#xA;    4 state changes, last state change 01:43:53&#xA;  Virtual IP address is 192.10.10.253 (learnt)&#xA;  Active virtual MAC address is 0000.0c07.ac64&#xA;    Local virtual MAC address is 0000.0c07.ac64 (v1 default)&#xA;  Hello time 3 sec, hold time 10 sec&#xA;    Next hello sent in 0.752 secs&#xA;  Preemption disabled&#xA;  Active router is 192.10.10.252, priority 189 (expires in 9.187 sec)&#xA;  Standby router is local&#xA;  Priority 100 (default 100)&#xA;  IP redundancy name is &quot;hsrp-Vl40-100&quot; (default)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and other switch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh standby&#xA;Vlan20 - Group 100&#xA;  State is Active&#xA;    5 state changes, last state change 01:45:49&#xA;  Virtual IP address is 10.10.10.253&#xA;  Active virtual MAC address is 0000.0c07.ac64&#xA;    Local virtual MAC address is 0000.0c07.ac64 (v1 default)&#xA;  Hello time 3 sec, hold time 10 sec&#xA;    Next hello sent in 1.884 secs&#xA;  Preemption enabled&#xA;  Active router is local&#xA;  Standby router is 10.10.10.254, priority 100 (expires in 7.425 sec)&#xA;  Priority 190 (configured 190)&#xA;  IP redundancy name is &quot;hsrp-Vl20-100&quot; (default)&#xA;Vlan40 - Group 100&#xA;  State is Active&#xA;    5 state changes, last state change 01:45:50&#xA;  Virtual IP address is 192.10.10.253&#xA;  Active virtual MAC address is 0000.0c07.ac64&#xA;    Local virtual MAC address is 0000.0c07.ac64 (v1 default)&#xA;  Hello time 3 sec, hold time 10 sec&#xA;    Next hello sent in 1.297 secs&#xA;  Preemption enabled&#xA;  Active router is local&#xA;  Standby router is 192.10.10.254, priority 100 (expires in 7.735 sec)&#xA;  Priority 189 (configured 189)&#xA;  IP redundancy name is &quot;hsrp-Vl40-100&quot; (default)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27334" LastEditorUserId="8499" LastEditDate="2016-06-23T23:06:47.490" LastActivityDate="2016-06-24T12:37:39.423" Title="Configuring HSRP but amber ports needed on each link" Tags="|hsrp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32517" PostTypeId="1" CreationDate="2016-06-23T20:37:24.083" Score="3" ViewCount="369" Body="&lt;p&gt;I am a systems administrator by trade.  Though I have done a few wiring jobs, this is not a task that I claim to be a professional at, either by training or experience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, ethernet wiring isn't something that I've ever thought of as difficult.  There is a handful of best-practices, and bad-practices.  You watch out for those, and a basic wiring job should be smooth and successful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently, my employer hired a contractor to do the wiring for a new branch.  This contractor did a couple things that were high on my &quot;do not do&quot; list.  Before I bring these items to my employer's attention, I'd like to have some formal specs or quotes from certified specialists regarding these items.  Possibly I'm wrong, and they're not a problem at all.  Please weigh in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All cable and components are CAT6 rated, and the drops should not need anything beyond 1-gigabit + PoE.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For many of the drops, he left 1&quot; or more space between the plenum and the jack.  The pairs are mostly twisted up to the jacks, but sometimes they are untwisted further than is necessary.&#xA;My concern is signal loss.  I would like information to back that up.&lt;/li&gt;&#xA;&lt;li&gt;Most of the drops do not have wall-plates to their jacks.&#xA;My concern is that it will allow the jacks to be moved around, possibly degrading the jack's contact with the drop cables.&lt;/li&gt;&#xA;&lt;li&gt;For many of the drops, instead of a straight-run from the network stack to the destination, he terminated in a jack above the ceiling, then used a patch cable to link to another run, and repeated at the destination. So, many runs, there are actually three separate lengths of box cable connected by a pair of patch cables.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My first concern is signal loss.&#xA;My second concern is that, with time, environmental factors will degrade the quality of the connection between the jacks and the patch cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, I'm looking for written specs that support my belief that these are bad practices for wiring.  Although I appreciate the anecdotal support, that is not something that I can bring to my employer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you feel that I am wrong about any of these concerns, I would appreciate your saying so, and backing it up with specs that support you.  I am open to being wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="27390" LastEditorUserId="42290" LastEditDate="2017-12-13T09:24:49.930" LastActivityDate="2019-01-11T17:28:21.240" Title="Ethernet wiring job done wrong" Tags="|ethernet|lan|cable|best-practices|power-over-ethernet|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="32524" PostTypeId="2" ParentId="28668" CreationDate="2016-06-23T22:19:24.887" Score="1" Body="&lt;p&gt;How about using a hub rather than a switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It might be a stretch since your question has &quot;switch&quot; right there in the title, but you did say:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Therefore I am looking for all kind of crazy options.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Using a hub would avoid the jitter induced by the switch's queue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just ran a test where I measured the maximum offset after convergence between two PTP devices first on an unmanaged switch, and then on a hub.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Unmanaged switch: ~450ns&lt;/li&gt;&#xA;&lt;li&gt;Hub: ~50ns&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you can see, nearly an order of magnitude improvement.&lt;/p&gt;&#xA;" OwnerUserId="19692" LastActivityDate="2016-06-23T22:19:24.887" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32530" PostTypeId="2" ParentId="32515" CreationDate="2016-06-24T12:37:39.423" Score="1" Body="&lt;p&gt;The amber/green lights on the interfaces show whether the port is forwarding traffic or not.  Since that is a layer2 function based on STP, it is completely independent of HSRP, which is a layer 3 feature.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, the state of HSRP has no bearing on whether the ports are forwarding or not.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't think of any visual indication on the switch that would show you the state of HSRP.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-24T12:37:39.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32531" PostTypeId="1" AcceptedAnswerId="32583" CreationDate="2016-06-24T13:20:05.887" Score="2" ViewCount="708" Body="&lt;p&gt;Can anyone tell me all the commands that I need to enable logging on my email, hit count on access control entries that I use in static NAT with port translation, on my ASA 5525-X?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging enable&#xA;logging timestamp&#xA;logging mail errors&#xA;logging from-address asa@xxx.xxx&#xA;logging recipient-address asa@xxx.xxx level errors&#xA;smtp-server x.x.x.x&#xA;logging message 106100 level errors&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and of course at the end of ACEs I added &quot;log&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hit count is rising, but I don have emails.&lt;/p&gt;&#xA;" OwnerUserId="3481" LastActivityDate="2016-06-27T11:27:44.343" Title="Logging hit count ACEs that are used in NAT rules on email" Tags="|cisco-asa|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="32533" PostTypeId="1" AcceptedAnswerId="32535" CreationDate="2016-06-24T15:43:13.097" Score="1" ViewCount="95" Body="&lt;p&gt;Multimode LC connected to Catalyst 2950.  Other end of cable connected to Catalyst 2900 Series X 100baseFX connector.  When the two switches connect via fiber there seems to be no communication.  The link lights do not turn on.&#xA;Is there anything I'm doing wrong?  Could the ports be dirty?&#xA;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="23422" LastActivityDate="2016-06-24T16:50:02.420" Title="Active SC fiber connection not 'turning on' port" Tags="|lan|fiber|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="32535" PostTypeId="2" ParentId="32533" CreationDate="2016-06-24T16:50:02.420" Score="2" Body="&lt;p&gt;The 2950's optical ports are gigabit -- 1000b-SX based on &quot;multimode&quot;. That will not, &lt;em&gt;ever&lt;/em&gt;, connect to a 100b-FX peer. They are different speeds, and different signalling protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your 2950 has SFP ports, you &lt;em&gt;might&lt;/em&gt; be able to find a compatible 100bFX module for it.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-06-24T16:50:02.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32536" PostTypeId="2" ParentId="26361" CreationDate="2016-06-24T16:53:59.113" Score="0" Body="&lt;p&gt;Ethernet is a &lt;em&gt;family&lt;/em&gt; of specifications that governs a few different things&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ethernet covers all the different wiring specifications (10BASE-T, &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#100base-tx&quot; rel=&quot;nofollow&quot;&gt;100BASE-TX&lt;/a&gt;, &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#1000base-t&quot; rel=&quot;nofollow&quot;&gt;1000BASE&lt;/a&gt;-T, etc…)&lt;/li&gt;&#xA;&lt;li&gt;Ethernet describes how to &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#sending_bits&quot; rel=&quot;nofollow&quot;&gt;send bits (1s and 0s) across each wire&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Ethernet defines how to interpret those bits into &lt;a href=&quot;https://en.wikipedia.org/wiki/Ethernet_frame#Structure&quot; rel=&quot;nofollow&quot;&gt;meaningful frames&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-06-24T16:53:59.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32539" PostTypeId="1" AcceptedAnswerId="32633" CreationDate="2016-06-24T19:15:38.173" Score="2" ViewCount="246" Body="&lt;p&gt;My EX2200 is successfully giving out ip addresses over DHCP on interface ge-0/0/42. And only on that interface. Here is the config as I have it for that port, and the one next to it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ge-0/0/42 {&#xA;     unit 0 {&#xA;          family inet {&#xA;               address 10.0.0.149/32&#xA;          }&#xA;     }&#xA;&#xA;ge-0/0/44 {&#xA;     unit 0 {&#xA;          family inet {&#xA;               address 10.0.0.151/32&#xA;          }&#xA;     }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now why is 42 working properly and 44 not? I did a show configuration, and I can't see any differences between the ports. Anyone got any ideas? I have plenty of addresses in the pool, and I've tested multiple devices on that port, so it gives them out fine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set system services dhcp pool 10.0.0.0/24 address-range low 10.0.0.2&#xA;set system services dhcp pool 10.0.0.0/24 address-range high 10.0.0.252&#xA;set system services dhcp pool 10.0.0.0/24 router 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27412" LastEditorUserId="27412" LastEditDate="2016-06-24T19:25:28.647" LastActivityDate="2016-12-26T05:16:53.927" Title="DHCP giving out addresses on only one interface, Juniper EX2200" Tags="|dhcp|juniper|juniper-ex|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32541" PostTypeId="1" AcceptedAnswerId="32543" CreationDate="2016-06-24T20:29:07.423" Score="3" ViewCount="6032" Body="&lt;p&gt;So I read that when a router knows two paths with equal cost to a destination it can perform load balancing. This load balancing occurs interdomain or intradomain. I can't undestand that because I know that BGP choose the &quot;small&quot; ip address when two paths has the same cost.&lt;/p&gt;&#xA;" OwnerUserId="27414" LastActivityDate="2016-10-24T07:23:58.073" Title="What's the difference between interdomain and intradomain load balancing?" Tags="|bgp|ospf|load-balancer|load-balancing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32542" PostTypeId="2" ParentId="32309" CreationDate="2016-06-24T20:32:58.153" Score="2" Body="&lt;p&gt;Anything that conforms to the SFP MSA (&quot;specs&quot;) has an I2C interface to a PROM with those values stored within it. I have yet to see an SFP (or SFP+) that did not have that interface.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-06-24T20:32:58.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32543" PostTypeId="2" ParentId="32541" CreationDate="2016-06-24T20:39:58.500" Score="5" Body="&lt;p&gt;To answer this question, we have to define the term &quot;domain&quot;. Easily spoken, the Internet is a network of networks. In BGP terminology, there are many Autonomous Systems (AS) on the Internet, each of them being a network (or domain). One company for example may have a very large network, but is represented by a single AS, hence is a single &quot;node&quot; in BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The term interdomain routing describes the process of routing prefixes between Autonomous Systems, whereis intradomain routing refers to routing &lt;strong&gt;inside&lt;/strong&gt; a single AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Im not sure however what you mean with your last sentence. When two paths to the same destination have the same cost (that is in most basic BGP the length of the AS path, hence the number of ASs the route has crossed). For detailed discussion how BGP chooses paths look for example at this &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html&quot; rel=&quot;nofollow&quot;&gt;Cisco document&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As turned out in the comments I might have mis-interpreted the OPs question. The question actually is how load-balancing is performed and where are the differences in load-balancing in common interdomain routing protocols and intradomain routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Interdomain Routing&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP, being the de-facto standard for interdomain routing, will not perform load-balancing by default. It can however be configured to do so. Two main options exist here:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Configuring BGP to pair using loopback interface and use some unterlying routing (for example static routing or another internal routing protocol) to provide to equal paths to the opposite side, which will effectively turn on load-balancing&lt;/li&gt;&#xA;&lt;li&gt;Using the BGP multipathing feature, which is however a little more complex. One has to consider whether load-balancing should be performed with an iBGP (internal) or eBGP (external) peer or possibly both. To be candidates for multipathing, the routes must be equal in the following attributes:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Weight&lt;/li&gt;&#xA;&lt;li&gt;Local preference&lt;/li&gt;&#xA;&lt;li&gt;AS-PATH Length&lt;/li&gt;&#xA;&lt;li&gt;Origin&lt;/li&gt;&#xA;&lt;li&gt;MED&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can find detailed information on BGP multipathing by searching for this keyword or having a look at this &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2sx/feature/guide/fsxeibmp.html&quot; rel=&quot;nofollow&quot;&gt;Cisco document&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Intradomain Routing&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the internal routing protocols support easier load-balancing. As soon as the one metric being used is equal, multiple equal costs routes can be installed into the routing table. OSPF for example by default uses up to four equal cost routes. Other routing protocols such as EIGRP can even do unequal cost multipathing. Refer to the definition of the actual routing protocol to find out their default behaviour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Final sentence&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make on thing clear: it is up to the routing protocol whether equal paths can be used or not. In any case, if there are equal paths, both paths are installed into the local forwarding table on the router and other, not ruouting protocol specific, mechanisms such as CEF on Cisco routers are used for the actual load-balancing.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="3875" LastEditDate="2016-06-25T09:55:57.500" LastActivityDate="2016-06-25T09:55:57.500" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32544" PostTypeId="1" AcceptedAnswerId="33326" CreationDate="2016-06-24T21:50:05.733" Score="8" ViewCount="2203" Body="&lt;p&gt;We have a service provider (and we can't change providers) who is giving us a &quot;metro ethernet&quot; style connection between two of our locations. On each end, we plug into an ethernet port on a provider's switch and they ship frames back and forth. We get a certain bandwidth from them and they are dropping packets that burst over the bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure that a good way for us to not burst over their limit and avoid dropped packets is for us to shape our traffic to fit under the limit. I think I'm very close to understanding how to do this, but it's pretty complicated. We have a Cisco Catalyst 3560X on each side of the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I want to shape traffic down to 50 Mbps across the tunnel, it looks like the right (maybe only?) way to do it is to use shaping on the egress queues of the ports used for the link on each of our 3560s. We do not need to mark or classify any traffic, we just want to shape everything down to 50 Mbps. Here's an example port config right now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; speed auto 10 100&#xA; spanning-tree portfast disable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know I'll want to do &lt;code&gt;mls qos&lt;/code&gt; in global config mode. Then I should see something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Switch name]# show mls qos int gig0/1 queueing&#xA;GigabitEthernet0/1 &#xA;Egress Priority Queue : disabled&#xA;Shaped queue weights (absolute) :  25 0 0 0&#xA;Shared queue weights  :  25 25 25 25&#xA;The port bandwidth limit : 100  (Operational Bandwidth:100.0)&#xA;The port is mapped to qset : 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My understanding so far is the following, feel free to correct me:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All traffic will be CoS 0/unmarked so will go into egress queue 2 by default.&lt;/li&gt;&#xA;&lt;li&gt;Egress queue 2 is sharing the bandwidth equally with queue 3 and 4, and queue 1's weight is ignored.&lt;/li&gt;&#xA;&lt;li&gt;Egress queue 1 is shaped to 1/25 of the interface bandwidth, so 4 Mbps in this case.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So I get that queues 2 - 4 are each guaranteed 33% of the bandwidth (33 Mbps, right?) and queue 1 is shaped to 4 Mbps. My first question is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;With this default configuration, if &lt;strong&gt;only queue 2 is used&lt;/strong&gt;, how much&#xA;  bandwidth will it get? 100 Mbps? And if all queues were fully&#xA;  utilized, queue 1 would have 4 Mbps and queues 2 - 4 would each have&#xA;  32 Mbps (100 - 4 = 96/3 = 32)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And now the real question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To shape all unclassified egress traffic to fit into 50 Mbps, can I&#xA;  just enter&lt;br&gt;&#xA;  &lt;code&gt;srr-queue bandwidth shape 0 2 0 0&lt;/code&gt; on the interface in question and be done?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It seems like the queue sharing and shaping limits aren't guaranteed, so I might need to shape down to a nominal 45 Mbps on the egress queue if any burst over 50 Mbps is to be avoided. Can I do that by just running &lt;code&gt;srr-queue bandwidth limit 90&lt;/code&gt; combined with the above shaping? Would it be the same to instead use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;srr-queue bandwidth shape 0 1 0 0&#xA;srr-queue bandwidth limit 45&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would that shape queue 2 to 45 Mbps (on a 100 Mbps interface)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once I understand that, I'm guessing my next stop is sorting out buffer allocations and thresholds so my shaping is dropping as few packets as possible, right? That can be a separate question if necessary, but actually that seems to make a lot more sense so far.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastEditorUserId="4889" LastEditDate="2017-12-13T13:13:46.500" LastActivityDate="2017-12-13T13:13:46.500" Title="Basic Catalyst 3560 Egress Shaping" Tags="|cisco-catalyst|qos|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32547" PostTypeId="1" CreationDate="2016-06-25T00:28:52.643" Score="2" ViewCount="8516" Body="&lt;p&gt;I am taking a networking class, and I understand that payload data is part of a packet (within TCP or UDP), that is actual data that is being sent from the sender to the recipient. However, what kind of data other than an e-mail message will a computer send to the recipient? &lt;/p&gt;&#xA;" OwnerUserId="27417" LastEditorUserId="8499" LastEditDate="2018-03-02T04:34:33.033" LastActivityDate="2018-03-02T12:10:55.263" Title="What kind of data can be considered a Payload?" Tags="|tcp|osi|data|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32548" PostTypeId="2" ParentId="32547" CreationDate="2016-06-25T01:45:29.077" Score="4" Body="&lt;p&gt;If you look at the network layers, each layer of the network stack has a payload:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Layer-2 frames have a payload of layer-3 packets.&lt;/li&gt;&#xA;&lt;li&gt;Layer-3 packets have a payload of layer-4 segments.&lt;/li&gt;&#xA;&lt;li&gt;Layer-4 segments have a payload of application data.&lt;/li&gt;&#xA;&lt;li&gt;Application data can also have its own datagrams, which have&#xA;payloads, but anything above OSI layer-4 is off-topic here.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You should look at one of the network models, e.g. the OSI model, but remember that the models are just models, and the real world can often be different than any of the models predict.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any application using the network will have data as a payload to the network stack. For instance, web browsers and servers use HTTP as an application-layer protocol, and HTTP uses TCP as its layer-4 protocol, so HTTP is a payload of TCP. The browser sends requests to the server, and the server returns web pages as a result. Both the requests and results are payload of TCP segments.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-25T01:45:29.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32551" PostTypeId="1" AcceptedAnswerId="32554" CreationDate="2016-06-25T08:57:42.390" Score="3" ViewCount="133" Body="&lt;p&gt;What will happen in following situation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a server.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;User A communicates with server.&lt;/li&gt;&#xA;&lt;li&gt;User B(malicious) knows IP address of User A. He sends TCP packet with User's A IP written to it, and sequence number 4294967295(maximum 32 bit value).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Will it change/broke connection state with User A on the server?&lt;/p&gt;&#xA;" OwnerUserId="27423" LastActivityDate="2016-06-25T15:42:45.720" Title="&quot;Malicious&quot; User sending TCP packet with maximum sequence number with spoofed IP" Tags="|tcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32552" PostTypeId="2" ParentId="25262" CreationDate="2016-06-25T09:40:07.283" Score="1" Body="&lt;p&gt;Packet Tracer is a tool for basic network simulation (actually specifically designed for CCNA preparation). And simulation is the key word in this sentence: It only simulates an IOS router, and it lacks a fairly broad set of features, including but not limited to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Limited feature set regarding routing protocols (route summarization in OSPF, tweaking of some EIGRP settings such as hold time, partial support for frame relay...)&lt;/li&gt;&#xA;&lt;li&gt;No NAT Exception on the simulated ASA&lt;/li&gt;&#xA;&lt;li&gt;Missing many crypto features&lt;/li&gt;&#xA;&lt;li&gt;No suppport for multipoint GRE tunnels&lt;/li&gt;&#xA;&lt;li&gt;No support for DMVPN at all&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After all, its for CCNA-level study. So the short answer is: No you cannot. You could use GNS3 or Cisco VIRL to experiment with that topic.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-06-25T09:40:07.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32554" PostTypeId="2" ParentId="32551" CreationDate="2016-06-25T15:42:45.720" Score="4" Body="&lt;p&gt;most likely the sequence number is outside the valid window for the connection, and is simply dropped by the receiver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it happens to be in-window, then the receiver will treat it as valid data from A. TCP is insecure and un-authenticated. Its not hard to get it in-window with enough tries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can and should 'fix' this by running an authentication protocol like TLS on top of the TCP stream, or just use an authenticated transport like QUIC where the packet would never be accepted without knowing A's secret keying material.&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-06-25T15:42:45.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32556" PostTypeId="2" ParentId="32450" CreationDate="2016-06-25T21:19:40.540" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;No, host A cannot get the IP of host B, as they are in different subnets, which typically also means they are in different Layer 2 domains, so they need a Router to communicate with each other.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Just as with VLANs, you need a Router set up on the host as a default gateway to communicate with hosts in other VLANs/VXLANs.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;You can read about how VTEPs do MAC learning in &lt;a href=&quot;http://blogs.vmware.com/vsphere/2013/05/vxlan-series-how-vtep-learns-and-creates-forwarding-table-part-5.html&quot; rel=&quot;nofollow&quot;&gt;this article&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="25723" LastActivityDate="2016-06-25T21:19:40.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32557" PostTypeId="2" ParentId="32403" CreationDate="2016-06-25T21:37:28.937" Score="1" Body="&lt;p&gt;Areas are a feature of the link-state protocols. Areas reduce the amount of topology information each router can see and needs to process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RIPng is a distance-vector protocol. Distance-vector routers have no topology information past their neighbors, so there is no need for Areas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can have a large RIPng deployment. To reduce the amount of route updates, you should use route summarization. Contrary to OSPF, you can summarize routes anywhere, not just between the Areas.&lt;/p&gt;&#xA;" OwnerUserId="25723" LastActivityDate="2016-06-25T21:37:28.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32560" PostTypeId="1" AcceptedAnswerId="39844" CreationDate="2016-06-26T09:38:24.527" Score="6" ViewCount="37459" Body="&lt;p&gt;I try to solve a problem using Power Over Ethernet technology to Power supply differents devices. I would like to avoid to buy new router and try to make it work without any expensive costs (if possible). Let me explain you the situation :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a POE compatible router which is in a room, let's call it room A and 2 IP cameras which are in another room, let's call it room B. Cameras are POE compatible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a single cat 5 ethernet cable which link both rooms together. A single router port provide 15W and a single camera need 15W.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to power supply my cameras from my router over a single cable. Is there any possibility to use 2 ports (30W) on my router from room A over this single cable and split this power (2x15W) from room B for both cameras.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible and is there eventually ethernet split connectors which exist to do that ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for the help.&lt;/p&gt;&#xA;" OwnerUserId="27437" LastEditorUserId="8499" LastEditDate="2018-03-20T23:38:35.943" LastActivityDate="2020-01-23T20:24:22.590" Title="Multiple POE over a single cable" Tags="|layer1|cabling|cable|power-over-ethernet|utp|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32561" PostTypeId="1" AcceptedAnswerId="32562" CreationDate="2016-06-26T09:53:34.757" Score="0" ViewCount="443" Body="&lt;p&gt;Cisco has a &lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/MainServlet&quot; rel=&quot;nofollow&quot;&gt;MIB Locator&lt;/a&gt; which gives you a list of supported MIBs for a specific Cisco IOS Release. I have a MIB and need information on wich IOS version this MIB is supported. Does Cisco provide a database for that?&lt;/p&gt;&#xA;" OwnerUserId="22692" LastEditorUserId="3875" LastEditDate="2016-06-26T16:01:27.893" LastActivityDate="2016-06-26T16:01:27.893" Title="Cisco MIB Locator" Tags="|cisco|cisco-ios|snmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32562" PostTypeId="2" ParentId="32561" CreationDate="2016-06-26T10:54:58.060" Score="3" Body="&lt;p&gt;The feature you are looking for is on the same page you already have provided. On the bottom of the page there is a large box with the title &lt;code&gt;Search for MIB&lt;/code&gt;. You can select your MIB in question there and click submit, which will lead you to another page where only the IOS/IOS-XE versions are listed which support your MIB. On this page you can narrow down the search by multiple factors, including:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Release&lt;/li&gt;&#xA;&lt;li&gt;Platform Familiy&lt;/li&gt;&#xA;&lt;li&gt;Feature Set&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The page will then provide you with IOS versions with this specific attributes that support your MIB.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-06-26T10:54:58.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32565" PostTypeId="1" AcceptedAnswerId="34605" CreationDate="2016-06-26T13:33:25.290" Score="2" ViewCount="1139" Body="&lt;p&gt;&lt;em&gt;I have a problem with stp(spanning tree protocal),most times we always set port to stp enable.but under the below switch every ports is set stp disable.I want to know the situation about when to set stp disable.thank you!&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#               &#xA;interface GigabitEthernet1/0/1&#xA; port link-mode bridge&#xA; port access vlan 1000&#xA; stp disable    &#xA; arp detection trust&#xA;#               &#xA;interface GigabitEthernet1/0/2&#xA; port link-mode bridge&#xA; port access vlan 1000&#xA; stp disable    &#xA; arp detection trust&#xA;#               &#xA;interface GigabitEthernet1/0/3&#xA; port link-mode bridge&#xA; port access vlan 1000&#xA; stp disable    &#xA;#               &#xA;interface GigabitEthernet1/0/4&#xA; port link-mode bridge&#xA; port access vlan 3&#xA;#               &#xA;interface GigabitEthernet1/0/5&#xA; port link-mode bridge&#xA; port access vlan 3&#xA;#               &#xA;interface GigabitEthernet1/0/6&#xA; port link-mode bridge&#xA; port access vlan 4&#xA; stp disable    &#xA;#               &#xA;interface GigabitEthernet1/0/7&#xA; port link-mode bridge&#xA; port access vlan 1000&#xA; stp disable    &#xA;#               &#xA;interface GigabitEthernet1/0/8&#xA; port link-mode bridge&#xA; port access vlan 1000&#xA; stp disable    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24614" LastActivityDate="2016-09-04T15:39:00.340" Title="when is stp disable" Tags="|spanning-tree|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32566" PostTypeId="1" CreationDate="2016-06-26T14:44:59.533" Score="1" ViewCount="1507" Body="&lt;p&gt;&lt;em&gt;I have a program about to monitor the traffic of our company's switches.And we choose the centreon to make a solution.But there have less reference about the centreon program.And I only find blow link about to set the monitor.&lt;/em&gt; &lt;a href=&quot;http://letusexplain.blogspot.kr/2013/11/add-hostrouter-in-centreon-monitoring.html&quot; rel=&quot;nofollow&quot;&gt;Centreon - Add Host or Router and monitor bandwidth utilization | Let's Explain&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I get to &quot;Check_Centreon_SNMP_Traffic&quot; Topic. I have a question in how to set the &quot;Argument Example&quot;,it must to set the switch port.But i havn't learn the Macro.Does anyone have experience with centreon monitor the traffic.Thank you!&lt;/p&gt;&#xA;" OwnerUserId="24614" LastActivityDate="2016-06-26T14:44:59.533" Title="how centreon monitor switch traffic" Tags="|snmp|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32567" PostTypeId="2" ParentId="20313" CreationDate="2016-06-26T15:01:07.700" Score="7" Body="&lt;p&gt;&lt;em&gt;First and foremost, I must indicate that I am mostly active on the &lt;a href=&quot;https://security.stackexchange.com/&quot;&gt;IT Security&lt;/a&gt; StackExchange website. Since this current website may reach a different public I find it wiser to tell that, while I adopt the point of view of a potential attacker, all information in this post is given only for educational purposes, in particular in order to understand the concrete threats that are affecting networks beyond myths and oversimplified discourses.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I do not encourage nor do I approve the use of the methods described below on any unauthorized network (and I really mean it: if you want to learn get GNS3, that's what this whole thread is about :) !).&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Sorry for the length of this answer, but despite my researches I did not manage to find any satisfying resource on the web on this topic. Most &quot;proof-of-concepts&quot; are biased either by stopping at the CAM table being filled step and assuming but never really demonstrating the switch reaction, or by using some artificial tricks like clearing the switch MAC table before flooding.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;My goal here is to provide concrete steps suitable both for simulated and real environments, focusing on the issues related to GNS3 virtualization and common wrong approaches, and most importantly to provide sufficient background information to understand why things are the way they are.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For the short answer: &lt;strong&gt;yes, CAM overflow attacks can be simulated in GNS3&lt;/strong&gt;, however this goes with a few requirements:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Knowing where differences with real gears lie,&lt;/li&gt;&#xA;&lt;li&gt;Understanding what you can really expect,&lt;/li&gt;&#xA;&lt;li&gt;Using the right tools,&lt;/li&gt;&#xA;&lt;li&gt;Correct a bug currently affecting &lt;code&gt;dynamips&lt;/code&gt; (the Cisco routers emulator behind GNS3).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I will now take each of these point individually.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Knowing where difference with real gears lies&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;For performance reasons, a lot of switch things are actually not part of the IOS code but are implemented in hardware. This includes the ARL, or &lt;a href=&quot;http://computernetworkingsimplified.com/data-link-layer/basic-theory-operation-l2-switch/&quot; rel=&quot;nofollow&quot;&gt;Address Resolution Logic&lt;/a&gt;, which provides all the methods to add, remove and lookup entries in the MAC address table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, for the NM-16ESW module to work in GNS3, Dynamips had to reimplement all these normally hardware provided services, or at least push this far enough to allow an unmodified IOS to run on it correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sad thing is indeed that this is unfinished work, as stated in this &lt;a href=&quot;https://github.com/GNS3/dynamips/blob/master/common/dev_nm_16esw.c&quot; rel=&quot;nofollow&quot;&gt;module's source code&lt;/a&gt; header:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; * NM-16ESW ethernet switch module (experimental!)&#xA; *&#xA; * It's an attempt of proof of concept, so not optimized at all at this time.&#xA; * Only L2 switching will be managed (no L3 at all).&#xA; *&#xA; * To do next: QoS features (CoS/DSCP handling).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So you're warned: as stated in Łukasz's answer forget about QoS and expect some oddities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully here we are not dealing with QoS but with CAM overflow, and except the final bug (of which the correction should be included in some future GNS3 release, I hope) there are two main oddities which are of concern to us: one is affecting the MAC address table size and the other the MAC address aging process.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;First difference: the MAC address table size tops at 8189 entries&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This was the main topic of your question but is in fact a non-issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CAM overflow attack exploits the fact that a switch is not able to add any new entry to its CAM table, and therefore fallbacks into &lt;em&gt;&quot;behaving like a hub&quot;&lt;/em&gt; (as it is often described, I'll come back on this later).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most probably due to a minor bug, it seems that the MAC table is considered full at 8189 entries instead of 8192. However, full still means full: the ARL will still fail to store any supplementary entry and the CAM overflow attack will still be successful.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Second difference: the &lt;code&gt;aging-time&lt;/code&gt; setting is not honored&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;By default, MAC entries should remain the MAC address table for at least 5 minutes (=300 seconds), as defined by the &lt;code&gt;aging-time&lt;/code&gt; setting:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#show mac-address-table aging-time&#xA;Mac address aging time 300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, in real gear the whole process behind this parameter is implemented in hardware, and this setting is currently simply ignored by Dynamips' implementation of the NM-16ESW module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dynamips implements its own garbage collection system which deletes old MAC entries after only 30 seconds, making CAM overflow attacks noticeably more tricky to stabilize (but may be a good training against the &lt;em&gt;&quot;backpressure&quot;&lt;/em&gt; functionality described by Łukasz).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The code in charge of this can be found around line 2516 of the &lt;a href=&quot;https://github.com/GNS3/dynamips/blob/master/common/dev_nm_16esw.c&quot; rel=&quot;nofollow&quot;&gt;dev_nm_16esw.c&lt;/a&gt; file:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Start the MAC address ager */&#xA;data-&amp;gt;ager_tid = timer_create_entry(15000,FALSE,10,&#xA;                                    (timer_proc)bcm5600_arl_ager,data);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This launches the &lt;code&gt;bcm5600_arl_ager()&lt;/code&gt; function every 15 seconds. What this function does is to scan the whole CAM table and check a hit flag associated to each MAC address:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the flag is set, unset it,&lt;/li&gt;&#xA;&lt;li&gt;If the flag is unset, delete the MAC address from the table.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This flag is re-enabled whenever the switch receives a new packet from the corresponding MAC address, keeping active addresses in the table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You &lt;em&gt;will&lt;/em&gt; have to take this behavior into account in order to design a successful CAM overflow attack:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Using only random MAC addresses will not do it (sorry &lt;code&gt;macof&lt;/code&gt;...) since it would allow the switch to flush all faked addresses at once every 30 seconds, making the exploit unstable, &lt;/li&gt;&#xA;&lt;li&gt;Each MAC address must be used as a sender at least once every 15 seconds,&lt;/li&gt;&#xA;&lt;li&gt;Actually due to possible issues caused by the increased load, in order to avoid a single packet to be lost or arrive later you would prefer each MAC address to be used two or three times in less than 15 seconds. And don't think more would be helpful and this should be sufficient to make your flood both stable and reliable, with CAM tables consistently and constantly filled on all switches on the whole LAN.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Understanding what you can really expect&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;As explained in the introduction, a lot of literature explains this attack as &lt;em&gt;&quot;making the switch behave like a hub&quot;&lt;/em&gt;. While a good overview for the layman, this oversimplified description is wrong from a technical point of view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To understand I will recall how a switches works under normal circumstances, what's the algorithm behind them, to ensure we are all on the same page:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The switch receives an incoming packet on a some port,&lt;/li&gt;&#xA;&lt;li&gt;The switch then checks if the source MAC address is already stored in the MAC address table. If it isn't and there is a free slot, it records this new MAC address associated to its incoming port (and by the way if the address is already present but associated to another port, it will update the record with the new port). This is also the occasion to reset the aging timer associated to this entry, no matter if it is new or not.&lt;/li&gt;&#xA;&lt;li&gt;The switch then checks if the destination MAC address is already stored in the MAC address table. If it is, then this is all good and the switch outputs the packet on the interface associated to the matching CAM table entry. If it isn't, the switch will output the packet on all interfaces except the incoming one (all interfaces belonging to the same VLAN + trunk ports as long as this VLAN is not pruned).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, let's see how a switch works when the CAM overflow condition has been triggered and he did fallback into the so-called &lt;em&gt;&quot;hub&quot;&lt;/em&gt; mode... Actually all of this is just nonsense: there is no hub mode and the CAM overflow triggered strictly nothing. The switch just continues to work as it always did:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;On incoming packets, &lt;em&gt;if and only if&lt;/em&gt; the source MAC address is not present in the table will the CAM overflow have any effect since the switch will have no free slot to add this new one and will therefore skip this step. If the address is already present in the table, the switch will reset its aging timer as usual.&lt;/li&gt;&#xA;&lt;li&gt;On outgoing packets, &lt;em&gt;if and only if&lt;/em&gt; the destination MAC address is not present in the table will the switch indeed send the packet through &quot;all&quot; of its interfaces. If the MAC address is present in the table, the switch has strictly no reason to act weirdly: it will simply proceed as usual and send the packet only through the port associated to the MAC address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The main consequences of this are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Despite what is often told, CAM overflow attacks are not a magical way to turn switches into hubs. You will &lt;em&gt;not&lt;/em&gt; be forwarded all the traffic passing through the switch.&lt;/li&gt;&#xA;&lt;li&gt;You will &lt;em&gt;not&lt;/em&gt; be able to eavesdrop any already active communication (ie. any communication initiated before the MAC flood start). The devices' MAC address will be already known to the switch and legitimate packets will regularly reset the switch's aging counters. No matter how hard you flood it these devices' MAC addresses will stay in the switch's CAM table and the switch will only forward the traffic to the appropriate ports.&lt;/li&gt;&#xA;&lt;li&gt;You will most likely be able to eavesdrop &lt;em&gt;only&lt;/em&gt; a one-side communication from the router to previously inactive devices (shut down or in sleep mode for instance). In real world scenarios, at least during business hours the switch will nearly permanently have the router's MAC address in its CAM table since almost any traffic on the network will pass through it and, therefore, refresh the aging timer. The main goal of the MAC flood will therefore be to keep previously inactive devices from successfully register their MAC address too onto the switch. To give a concrete example of the result, most chances are that you will not be able to eavesdrop the user's password and requests, but you may be able to get the server provided session identifiers and data.&lt;/li&gt;&#xA;&lt;li&gt;But to end with depressing news, what you &lt;em&gt;will&lt;/em&gt; achieve is that if you take care to not overload the switches, they will happily forward your flooding packets from switch-to-switch until they contaminate the whole Layer 2 LAN. Only VLAN pruning or a Layer 3 device on the way would would limit this dissemination, without that even switches offering only unrelated VLANs ports will see their CAM table being filled-up. In other words, depending on the topology details launching the attack from VLAN 2 can allow you to access VLAN 2 traffic forwarded from several switches away and can also allow you to affect VLAN 3 switches behavior.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h1&gt;Using the right tool&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The tool classically recommended for CAM table overflow attacks is &lt;code&gt;macof&lt;/code&gt; (from the &lt;a href=&quot;https://www.monkey.org/~dugsong/dsniff/&quot; rel=&quot;nofollow&quot;&gt;dsniff&lt;/a&gt; project, unmaintained for years). However, this tool makes me the effect of a primitive barbarian from some fantasy story: brutal, inefficient and unreliable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This tool generates packets using fully random MAC addresses generated on the fly. This is wrong for two reasons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;As we saw above, every inactive MAC addresses are automatically deleted from the CAM table, temporarily freeing a large amount of slots available to record genuine MAC addresses until we managed to fill the table again (which may take a few time if the target is several switches away). And as we also saw, a single genuine packet is sufficient to update the CAM table with a true information and put a definitive end on our eavesdropping on this particular target.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Statistically half of the randomly generated MACs have the &lt;a href=&quot;https://en.wikipedia.org/wiki/MAC_address#Address_details&quot; rel=&quot;nofollow&quot;&gt;I/G group bit&lt;/a&gt; set. However, it is forbidden to use a group MAC address as sender, as stated in &lt;a href=&quot;http://standards.ieee.org/about/get/802/802.3.html&quot; rel=&quot;nofollow&quot;&gt;IEEE 802.3-2002, Section 3.2.3(b)&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In the Source Address field, the first bit is reserved and set to 0.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cisco switches (at least) are aware of that, and consider such packets as malformed and drop them. This means that half of the packets generated by &lt;code&gt;macof&lt;/code&gt; are dropped by the first switch they encounter.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;macof&lt;/code&gt; also relies on some brute-force strategy by sending its malicious packets as fast as the attacker's device and the network allow. This cause several issues:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switches may malfunction or even crash during the flooding process (I encountered several reports stating that the switch's management plane was frozen during such flooding),&lt;/li&gt;&#xA;&lt;li&gt;Due to the load caused on switch-side, these packets may not be reliably relayed from switch-to-switch, causing only the first attacker-facing switch to have its CAM table effectively overflown,&lt;/li&gt;&#xA;&lt;li&gt;Due to the load on attacker's side, either the network link is fully congested or the CPU usage maxes out. In all cases it is impossible to capture any traffic from the same device, which is sad since capturing traffic is precisely the goal of this attack. The usual advice is to stop flooding when capturing, and alternate between flooding and capturing on a regular basis (every minute for instance given the 5 minutes default aging on real gears, and regarding Dynamips' 30 seconds it becomes just hopeless). I would also advise to have enough luck to be indeed capturing when interesting information was being exchanged and enough luck to be able to properly counter the periodic MAC table cleaning which seems pretty unfeasible in such conditions.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A good CAM overflow attack tool should:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Not use more resources than necessary in order to allow a reliable eavesdropping,&lt;/li&gt;&#xA;&lt;li&gt;Generate well-formed packets (ie. no useless packets which will get dropped anyway and no packets which will make Wireshark (or an IDS...) complain),&lt;/li&gt;&#xA;&lt;li&gt;Ensure that the CAM tables remain constantly filled so new devices will have no chance to register their MAC address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;macof&lt;/code&gt; fails on these three requirements and is therefore not a suitable tool. A quick search did not revealed any relevant alternative, so I went the &lt;a href=&quot;http://www.secdev.org/projects/scapy/&quot; rel=&quot;nofollow&quot;&gt;Scapy&lt;/a&gt; route (Scapy is a Python library and interactive tool allowing to freely build and manipulate network packets).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the code I used to successfully test CAM table overflow in a GNS3 environment:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#! /usr/bin/python&#xA;&#xA;nbpkts = 8192&#xA;iface = &quot;eth0&quot;&#xA;&#xA;import sys&#xA;from scapy.all import sendpfast, Ether, IP, RandIP, RandMAC, TCP&#xA;&#xA;print(&quot;Initializing...&quot;)&#xA;&#xA;# We first build all packets...&#xA;pkts = []&#xA;for i in xrange(0, nbpkts):&#xA;  macaddr = str(RandMAC())&#xA;  # Quick-and-dirty way to ensure that the I/G remains unset&#xA;  macaddr = macaddr[:1] + &quot;0&quot; + macaddr[2:]&#xA;  # This packet structure mimics a TCP SYN sent to a HTTP server.&#xA;  # A random dst mac should also work, setting one fixed can be useful&#xA;  # to easily filter-out flood-related packets when capturing traffic.&#xA;  # You can use IPs valid for your range, but be cautious that if any&#xA;  # host is made to send some RST for instance its MAC address will be&#xA;  # registered by the switches.&#xA;  pkts.append(Ether(src=macaddr, dst=&quot;ff:ff:ff:ff:ff:ff&quot;)/&#xA;              IP(src=str(RandIP()), dst=str(RandIP()))/&#xA;              TCP(dport=80, flags=&quot;S&quot;, options=[('Timestamp', (0, 0))]))&#xA;&#xA;print(&quot;Launching attack, press Ctrl+C to stop...&quot;)&#xA;&#xA;# ...and then we send them in loop.&#xA;while True:&#xA;  # Adapt pps (Packets Per Second) to your needs. Running a complex&#xA;  # GNS3 topology on a low-end machine will take all the CPU causing&#xA;  # packet loss, pps will then need to be high to replay lost packets.&#xA;  # Given enough CPU, packet loss can remain low and pps can be lowered&#xA;  # too.&#xA;  sendpfast(pkts, iface=iface, file_cache=True, pps=5000, loop=999)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a quick-and-dirty, few-lines examples which could be improved in several ways. For instance, would it be used against real gears it may make sense to use two successive sending iterations, the first one being quick in order to rapidly take over CAM tables, and the second one working at a far more slowly pace, taking full advantage of the 5 minutes aging delay to stay below the radar as much as possible (when this default delay is changed, it is generally to be raised and no diminished, and moreover I have some doubts that someone who do not take care of enabling port security on his switches will really bother changing such kind of setting).&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Correct a bug currently affecting dynamips&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Sadly, when you are through all this, you will discover that when their CAM table is properly filled, the switches in GNS3 will not start to flood packets through &quot;all&quot; of their ports, but they will drop them instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is due to a bug affecting the &lt;code&gt;bcm5600_handle_rx_pkt()&lt;/code&gt; function in charge of handling received packets and located around line 2170 of the &lt;a href=&quot;https://github.com/GNS3/dynamips/blob/master/common/dev_nm_16esw.c&quot; rel=&quot;nofollow&quot;&gt;dev_nm_16esw.c&lt;/a&gt; file:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Source MAC address learning */&#xA;if (!bcm5600_src_mac_learning(d,p))&#xA;   return(FALSE);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Currently, when the ARL failed to store a new MAC address, the handling of the incoming is aborted, effectively resulting in the packet being drop. The fix is just to ignore the ARL status and continue processing the packet anyway, since this what real gear actually do:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/* Source MAC address learning */&#xA;bcm5600_src_mac_learning(d,p);&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've raised &lt;a href=&quot;https://github.com/GNS3/dynamips/issues/72&quot; rel=&quot;nofollow&quot;&gt;this issue&lt;/a&gt; to GNS3 teams so it can be fixed in GNS3 future updates. I also advocated to &lt;a href=&quot;https://github.com/GNS3/dynamips/issues/39&quot; rel=&quot;nofollow&quot;&gt;raise the MAC table garbage collection timeout&lt;/a&gt; from the current 15 seconds to 5 minutes in order to be closer to real gear behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Until this gets fixed upstream, it requires a manual modification and recompilation of Dynamips source code but this is a very quick and simple process (there is no need to recompile the whole GNS3, only the &lt;code&gt;dynamips&lt;/code&gt; binary, and I provided the patches in the tickets linked above).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;After you do that, you will be able to test and repeat MAC overflow attacks in GNS3 with router-based switches in a stable and predictable manner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are two final notes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;While router-based switches allow to test CAM overflow attacks, they will not allow to test proper mitigation techniques as they do not implement port security. I think this is a limitation from IOS rather than GNS3 since the relevant options are not even prevent in the shell. &lt;a href=&quot;http://evilrouters.net/cisco-iou-faq&quot; rel=&quot;nofollow&quot;&gt;IOU&lt;/a&gt; proposes these options, however due to its CAM table allowing nearly 200 million entries (compared to the 8192 of a real IOS) it seems out of reach for a traditional CAM overflow attack. So IOU is at the opposite of router-based switches: they can be used to test mitigation techniques but not to reproduce the attack. Be aware also that IOU implementation of the Spanning Tree Protocol (STP) is heavily buggy and topology loops must be avoided.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Speaking of STP and depending on the topology, becoming STP Root (&lt;code&gt;yersinia stp -attack 4&lt;/code&gt;) should induce a clearing of most MAC tables dynamic entries due to the topology change and may provide you a more efficient flooding and eavesdropping experience ;).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="27387" LastEditorUserId="27387" LastEditDate="2016-07-01T13:56:22.540" LastActivityDate="2016-07-01T13:56:22.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32571" PostTypeId="1" CreationDate="2016-06-26T17:16:03.037" Score="0" ViewCount="9310" Body="&lt;p&gt;What is a valid public IP address?  When I was checking my ID to see if it was blacklisted, it came up with the above Amanda… &quot;Please enter a valid public IP address,&quot;, so therefore my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What is a valid public IP address?&lt;/li&gt;&#xA;&lt;li&gt;Why don't I have  A valid public IP address and how did I get an&#xA;invalid one?&lt;/li&gt;&#xA;&lt;li&gt;Why is my Geo location off by over 40 miles on this my IP address ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1st IP address:&lt;code&gt;2600:1010:b00b:ecde:3862:7548:5dad:a45a&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;2nd IP address: &lt;code&gt;169.254.30.247&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;3rd IP address: &lt;code&gt;10.232.222..212&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thank you for your answer back the location services always find my exact location… And the bizarre number of ideas that I have on my 6S plus.... It's odd .&lt;/p&gt;&#xA;" OwnerUserId="27445" LastEditorUserId="8499" LastEditDate="2018-03-10T00:47:22.087" LastActivityDate="2018-03-10T00:47:22.087" Title="What is a valid public IP address?" Tags="|ipv4|ip|ipv6|ip-address|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32572" PostTypeId="2" ParentId="32571" CreationDate="2016-06-26T17:38:19.717" Score="10" Body="&lt;p&gt;You have not provided much information to use, but I will attempt to answer your questions. A valid, public IP address is one which the ISPs have agreed to route on the public Internet. For the most part, any IPv4 address, which doesn't fall into any of the ranges which IANA considers as not globally routable, is a valid, public IPv4 address.&lt;/p&gt;&#xA;&lt;p&gt;If the IPv4 address you are using to get an invalid public IP address is from behind your router, it is likely an &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1918&lt;/a&gt; private address, and those are not globally routable. In that case, any publicly routable address you may have is on the WAN interface of your router.&lt;/p&gt;&#xA;&lt;p&gt;Some IPv4 and IPv6 addresses are considered Special-Purpose Addresses, and many of those are not to be routed on the public network. The &lt;a href=&quot;http://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IANA IPv4 Special-Purpose Address Registry&lt;/a&gt; has a table of these for IPv4, and it details if they can be routed or used globally:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/N2zXv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/N2zXv.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The RIRs have run out of public IPv4 addresses to assign to ISPs, and the ISPs are turning to CGN (Carrier-grade NAT) to conserve their pools of public addresses. This means that your ISP could assign you a CGN or private address which is not globally routable. This has caused problems for some customers of the ISPs.&lt;/p&gt;&#xA;&lt;p&gt;Geolocation is not particularly accurate. There is no standard, and each service does it differently using various data gathered from various sources. My address usually shows up over 1000 miles from my location (the headquarters of my ISP, not my location). A discrepancy of 40 miles is really not too bad.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Your first address is an IPv6 address, and it is a valid, public IPv6 address. If this address is coming back as an invalid public address, it is likely that you are using something which only accepts IPv4 addresses.&lt;/p&gt;&#xA;&lt;p&gt;Your second address is a link-local IPv4 address, which is not a public IPv4 address, nor is it routable. It is listed in the IANA registry.&lt;/p&gt;&#xA;&lt;p&gt;Your third address is a private address, per RFC 1918, and while it is routable, it is not publicly routable. If this address is from your ISP, your ISP is using CGN. The address could be assigned on your network. In either case it is not routable on the public Internet, and it must be translated, either by your router or by your ISP, to a public address before it gets to the public Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-10-31T02:18:14.613" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32576" PostTypeId="2" ParentId="32531" CreationDate="2016-06-27T06:20:37.213" Score="1" Body="&lt;p&gt;Change what ever rule hit you want to send email to the specified level you want emails sent out this may require you to create a separate access rule if you only want it when it's specific traffic. Change the severity for the new specific rule's severity level and set the email alert configuration to that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit for configuration. it would look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      access-list Outside_access_in line 12 extended permit tcp host 192.168.1.1 host 172.16.1.26 eq smtp  log 1 interval 300&#xA;  access-list Outside_access_in line 13 extended permit tcp any host 172.16.1.26 eq smtp &#xA;  logging from-address asa@place.com&#xA;  logging recipient-address alerts@mycomany.com level Errors&#xA;  smtp-server 172.16.1.26 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19171" LastEditorUserId="19171" LastEditDate="2016-06-27T06:44:42.360" LastActivityDate="2016-06-27T06:44:42.360" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32577" PostTypeId="2" ParentId="32571" CreationDate="2016-06-27T06:26:18.737" Score="0" Body="&lt;p&gt;An IP address is considered public if it can be used on the Internet. Public IP addresses have different IP number ranges than private IP addresses. Public IP addresses are used by Internet servers including those for Web sites and DNS servers, broadband routers and other network gateways, or any computer connected directly to the Internet. Each public address belongs to a range or block of addresses. The Internet Assigned Numbers Authority (IANA) controls ownership of these IP ranges and assigns each block to organizations such as Internet Service Providers (ISPs) who in turn allocate individual IP addresses to customers.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-06-27T06:26:18.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32579" PostTypeId="2" ParentId="32494" CreationDate="2016-06-27T07:57:21.373" Score="0" Body="&lt;p&gt;I have found a solution after using a packet sniffer on the &lt;code&gt;WebEx&lt;/code&gt; application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to obtain all the subnet that &lt;code&gt;WebEx&lt;/code&gt; is using and exclude them from the SSL Scanning using the following expressions.   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;https:\/\/62\.109\.204\.[0-9]{1,3}&#xA;https:\/\/62\.109\.224\.[0-9]{1,3}&#xA;https:\/\/62\.109\.230\.[0-9]{1,3}&#xA;https:\/\/62\.109\.231\.[0-9]{1,3}&#xA;https:\/\/62\.109\.232\.[0-9]{1,3}&#xA;https:\/\/62\.109\.234\.[0-9]{1,3}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27376" LastActivityDate="2016-06-27T07:57:21.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32581" PostTypeId="2" ParentId="26556" CreationDate="2016-06-27T09:53:58.037" Score="1" Body="&lt;p&gt;You should act like this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create a Mangle rules that mark all Youtube packets with a RoutingMark&lt;/li&gt;&#xA;&lt;li&gt;Create a static route for this traffic on the right gateway. (Be sure to select the right RoutingMark).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Check &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Policy_Base_Routing&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23824" LastActivityDate="2016-06-27T09:53:58.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32582" PostTypeId="1" CreationDate="2016-06-27T10:51:22.167" Score="1" ViewCount="1961" Body="&lt;p&gt;I have two routers, one wireless connected to ISP1 with optical cable, and the second one connected to ISP2.&#xA;The second router is cisco 860 series, i will configure ACL lists and zone based firewall on it, so it need to be the router connected to the switch.&#xA;How do i connect the two routers to share same network? Is internet from two providers going to be in a single network (speed up)?&#xA;Do i need a third device to do this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aJ7p2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aJ7p2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually want to apply this architecture, i don't know if it is possible, Even with a load balancer i can't keep internet from two providers?&lt;/p&gt;&#xA;" OwnerUserId="27457" LastEditorUserId="17153" LastEditDate="2016-06-27T11:55:50.563" LastActivityDate="2016-06-28T08:35:57.603" Title="connecting two routers, each connected to a different ISP" Tags="|routing|router|subnet|isp|architecture|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="32583" PostTypeId="2" ParentId="32531" CreationDate="2016-06-27T11:27:44.343" Score="0" Body="&lt;p&gt;The proper way is to use a syslog server and an application to parse the resulting data. Message 106100 is an information level message, and you can change it to error level, but it will not change for any existing ACE, and all errors will end up in the log, not just the matches.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An optional syslog level (0 - 7) can be specified for the generated&#xA;  syslog messages (106100). If no level is specified, the default level&#xA;  is 6 (informational) for a new ACE. If the ACE already exists, then&#xA;  its current log level remains unchanged.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-27T11:27:44.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32586" PostTypeId="1" AcceptedAnswerId="32587" CreationDate="2016-06-27T11:52:02.487" Score="0" ViewCount="68" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JUeVn.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JUeVn.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to apply the following architecture, where i have two app servers in order to ensure high availibility.&#xA;Do i need to use two dedicated servers for load balancer or is it possible to use a virtual machine on the app servers for it?  &lt;/p&gt;&#xA;" OwnerUserId="27457" LastActivityDate="2016-06-27T11:59:28.557" Title="load balancer in high availibility" Tags="|architecture|load-balancer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32587" PostTypeId="2" ParentId="32586" CreationDate="2016-06-27T11:59:28.557" Score="2" Body="&lt;p&gt;It depends on what risk you are trying to mitigate against. If you use virtual machines, you are mitigating against software errors on the load balancers. But you are still vulnerable to a hardware failure on the host machine.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-27T11:59:28.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32591" PostTypeId="1" AcceptedAnswerId="33215" CreationDate="2016-06-27T14:50:03.537" Score="2" ViewCount="4391" Body="&lt;p&gt;&lt;strong&gt;Background information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Cisco 2911 router and a Cisco ASAv connected using a IKEv2 based IPSec tunnel. The tunnel initially comes up fine as soon as there is some traffic from the routers end. The router is mobile, hence it has changing outside addresses and is always the initiator. On ASA side, the VPN peer is hence not configured, a dynamic crypto-map is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two SAs defined for the IPSec connection, the left IP is the router's side, the right IPs are ASA. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.10.0/24 &amp;lt;=&gt; xx.xx.66.0/24&lt;/li&gt;&#xA;&lt;li&gt;192.168.10.0/24 &amp;lt;=&gt; 192.168.255.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;192.168.10.0/24 is a network behind the router, while xx.xx.66.0/24 is the network behind the ASA and 192.168.255.0/24 is the IP pool for AnyConnect clients connecting to the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fire up the tunnel as soon as the router starts and has an IP address assigned on is outside interface (Gi 0/0), the router has an NTP server configured which is in the xx.xx.66.0/24 network. This actually works fine, the IKEv2 SA is up and working, the first child SA is also up and running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem statement&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second SA (192.168.10.0/24 &amp;lt;=&gt; 192.168.255.0/24) however only works when I first initiate the SA from the routers end by sending some packets (for example with &lt;code&gt;ping 192.168.255.10 sourve vlan 10 repeat 1&lt;/code&gt;, where the .10 is completely random). Then the SA is up and I can connect to the router from the AnyConnect pool. This however is not the idea of this concept, as the tunnel should be established such that the support engineers connected to the ASA via AnyConnect can access the router and troubleshoot any issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the debug output from &lt;code&gt;debug crypto ikev2 protocol 50&lt;/code&gt;, &lt;code&gt;debug crypto ikev2 platform 50&lt;/code&gt; and &lt;code&gt;debug crypto ipsec 50&lt;/code&gt; does not show any hint that the ASA at least tries to build the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configurations&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the relevant parts of both configurations. If you are missing anything, please let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco 2911 Router, Running IOS 15.4(3)M3 w/ security license&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip cef&#xA;license boot module c2900 technology-package securityk9&#xA;!&#xA;crypto ikev2 proposal default&#xA; encryption aes-cbc-256&#xA; integrity sha512&#xA; group 14&#xA;!&#xA;crypto ikev2 keyring EzVPNKeys&#xA; peer MR-ASA&#xA;  address 146.140.xx.xx&#xA;  pre-shared-key local xxx1&#xA;  pre-shared-key remote xxx2&#xA;!&#xA;crypto ikev2 profile MobileRacks&#xA; match identity remote address xx.xx.193.9 255.255.255.255 &#xA; identity local key-id MobileRacks&#xA; authentication remote pre-share&#xA; authentication local pre-share&#xA; keyring local EzVPNKeys&#xA;!&#xA;crypto ipsec transform-set AES256-SHA-512 esp-aes 256 esp-sha512-hmac &#xA; mode tunnel&#xA;!&#xA;crypto map FlexVPN 10 ipsec-isakmp &#xA; set peer xx.xx.193.9&#xA; set transform-set AES256-SHA-512 &#xA; set pfs group14&#xA; set ikev2-profile MobileRacks&#xA; match address FlexVPN&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description outside&#xA; ip address dhcp&#xA; crypto map FlexVPN&#xA;!&#xA;interface Vlan10&#xA; description management&#xA; ip address 192.168.10.254 255.255.255.0&#xA; ip access-group VL10-MGMT-IN out&#xA; ip virtual-reassembly in&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 dhcp&#xA;!&#xA;ip access-list extended FlexVPN&#xA; permit ip 192.168.10.0 0.0.0.255 146.140.66.0 0.0.0.255&#xA; permit ip 192.168.10.0 0.0.0.255 192.168.255.0 0.0.0.255&#xA;!&#xA;ntp source Vlan10&#xA;ntp server xx.xx.66.230&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco ASAv5, Runnint ASA Version 9.6(1)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip local pool AnyConnectPool 192.168.255.10-192.168.255.254 mask 255.255.255.0&#xA;! Is used for AnyConnect, not shown here&#xA;!&#xA;interface GigabitEthernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address xx.xx.193.9 255.255.255.0 &#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif inside&#xA; security-level 100&#xA; ip address xx.xx.66.26 255.255.255.0 &#xA;!&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;!&#xA;access-list outside_cryptomap_eventrack extended permit ip xx.xx.66.0 255.255.255.0 192.168.10.0 255.255.255.0 &#xA;access-list outside_cryptomap_eventrack extended permit ip 192.168.255.0 255.255.255.0 192.168.10.0 255.255.255.0 &#xA;!&#xA;crypto ipsec ikev2 ipsec-proposal FhG-AES-IKEv2&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-512&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-256-SHA&#xA;crypto dynamic-map ConsoleServerConnectionProfile 10 match address outside_cryptomap_eventrack&#xA;crypto dynamic-map ConsoleServerConnectionProfile 10 set pfs group14&#xA;crypto dynamic-map ConsoleServerConnectionProfile 10 set ikev2 ipsec-proposal FhG-AES-IKEv2&#xA;crypto dynamic-map ConsoleServerConnectionProfile 10 set security-association lifetime seconds 3600&#xA;crypto dynamic-map ConsoleServerConnectionProfile 10 set reverse-route&#xA;crypto map MapOutside 1 ipsec-isakmp dynamic ConsoleServerConnectionProfile&#xA;crypto map MapOutside 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map MapOutside interface outside&#xA;!&#xA;crypto ikev2 policy 10&#xA; encryption aes-256&#xA; integrity sha512&#xA; group 14     &#xA; prf sha512&#xA; lifetime seconds 86400&#xA;crypto ikev2 enable outside&#xA;!&#xA;group-policy IKEv2GroupPolicy internal&#xA;group-policy IKEv2GroupPolicy attributes&#xA; vpn-tunnel-protocol ikev2 &#xA;!&#xA;tunnel-group MobileRacks type ipsec-l2l&#xA;tunnel-group MobileRacks general-attributes&#xA; default-group-policy IKEv2GroupPolicy&#xA;tunnel-group MobileRacks ipsec-attributes&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Additional Output&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the ASA's perspective, IP being a DHCP assigned outside IP of the router: &lt;code&gt;show ipsec sa peer xx.xx.xx.xx detail&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;peer address: xx.xx.222.246&#xA;    Crypto map tag: ConsoleServerConnectionProfile, seq num: 10, local addr: xx.xx.193.9&#xA;&#xA;      access-list outside_cryptomap_eventrack extended permit ip xx.xx.66.0 255.255.255.0 192.168.10.0 255.255.255.0 &#xA;      local ident (addr/mask/prot/port): (xx.xx.66.0/255.255.255.0/0/0)&#xA;      remote ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)&#xA;      current_peer: xx.xx.xx.xx&#xA;&#xA;&#xA;      #pkts encaps: 16684, #pkts encrypt: 16684, #pkts digest: 16684&#xA;      #pkts decaps: 16834, #pkts decrypt: 16834, #pkts verify: 16834&#xA;      #pkts compressed: 0, #pkts decompressed: 0&#xA;      #pkts not compressed: 16684, #pkts comp failed: 0, #pkts decomp failed: 0&#xA;      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0&#xA;      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0&#xA;      #TFC rcvd: 0, #TFC sent: 0&#xA;      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0&#xA;      #pkts no sa (send): 0, #pkts invalid sa (rcv): 0&#xA;      #pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0&#xA;      #pkts invalid prot (rcv): 0, #pkts verify failed: 0&#xA;      #pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0&#xA;      #pkts invalid pad (rcv): 0,&#xA;      #pkts invalid ip version (rcv): 0,&#xA;      #pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0&#xA;      #pkts replay failed (rcv): 0&#xA;      #pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0&#xA;      #pkts internal err (send): 0, #pkts internal err (rcv): 0&#xA;&#xA;      local crypto endpt.: xx.xx.193.9/500, remote crypto endpt.: xx.xx.222.246/500&#xA;      path mtu 1500, ipsec overhead 94(44), media mtu 1500&#xA;      PMTU time remaining (sec): 0, DF policy: copy-df&#xA;      ICMP error validation: disabled, TFC packets: disabled&#xA;      current outbound spi: 50D61913&#xA;      current inbound spi : 1BA74E8D&#xA;&#xA;    inbound esp sas:&#xA;      spi: 0x1BA74E8D (463949453)&#xA;         transform: esp-aes-256 esp-sha-512-hmac no compression &#xA;         in use settings ={L2L, Tunnel, PFS Group 14, IKEv2, }&#xA;         slot: 0, conn_id: 49152, crypto-map: ConsoleServerConnectionProfile&#xA;         sa timing: remaining key lifetime (kB/sec): (4146528/1834)&#xA;         IV size: 16 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap: &#xA;          0xFFFFFFFF 0xFFFFFFFF&#xA;    outbound esp sas:&#xA;      spi: 0x50D61913 (1356208403)&#xA;         transform: esp-aes-256 esp-sha-512-hmac no compression &#xA;         in use settings ={L2L, Tunnel, PFS Group 14, IKEv2, }&#xA;         slot: 0, conn_id: 49152, crypto-map: ConsoleServerConnectionProfile&#xA;         sa timing: remaining key lifetime (kB/sec): (4192686/1834)&#xA;         IV size: 16 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap: &#xA;          0x00000000 0x00000001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the router's perspective, &lt;code&gt;show crypto ipsec sa detail&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface: GigabitEthernet0/0&#xA;    Crypto map tag: FlexVPN, local addr xx.xx.222.246&#xA;&#xA;   protected vrf: (none)&#xA;   local  ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)&#xA;   remote ident (addr/mask/prot/port): (xx.xx.66.0/255.255.255.0/0/0)&#xA;   current_peer xx.xx.193.9 port 500&#xA;     PERMIT, flags={origin_is_acl,}&#xA;    #pkts encaps: 18179, #pkts encrypt: 18179, #pkts digest: 18179&#xA;    #pkts decaps: 18024, #pkts decrypt: 18024, #pkts verify: 18024&#xA;    #pkts compressed: 0, #pkts decompressed: 0&#xA;    #pkts not compressed: 0, #pkts compr. failed: 0&#xA;    #pkts not decompressed: 0, #pkts decompress failed: 0&#xA;    #pkts no sa (send) 0, #pkts invalid sa (rcv) 0&#xA;    #pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0&#xA;    #pkts invalid prot (recv) 0, #pkts verify failed: 0&#xA;    #pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0&#xA;    #pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0&#xA;    ##pkts replay failed (rcv): 0&#xA;    #pkts tagged (send): 0, #pkts untagged (rcv): 0&#xA;    #pkts not tagged (send): 0, #pkts not untagged (rcv): 0&#xA;    #pkts internal err (send): 0, #pkts internal err (recv) 0&#xA;&#xA;     local crypto endpt.: xx.xx.222.246, remote crypto endpt.: xx.xx.193.9&#xA;     plaintext mtu 1422, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0&#xA;     current outbound spi: 0x1BA74E8D(463949453)&#xA;     PFS (Y/N): Y, DH group: group14&#xA;&#xA;     inbound esp sas:&#xA;      spi: 0x50D61913(1356208403)&#xA;        transform: esp-256-aes esp-sha512-hmac ,&#xA;        in use settings ={Tunnel, }&#xA;        conn id: 2015, flow_id: Onboard VPN:15, sibling_flags 80000040, crypto map: FlexVPN&#xA;        sa timing: remaining key lifetime (k/sec): (4166728/1692)&#xA;        IV size: 16 bytes&#xA;        replay detection support: Y&#xA;        Status: ACTIVE(ACTIVE)&#xA;&#xA;     inbound ah sas:&#xA;&#xA;     inbound pcp sas:&#xA;&#xA;     outbound esp sas:&#xA;      spi: 0x1BA74E8D(463949453)&#xA;        transform: esp-256-aes esp-sha512-hmac ,&#xA;        in use settings ={Tunnel, }&#xA;        conn id: 2016, flow_id: Onboard VPN:16, sibling_flags 80000040, crypto map: FlexVPN&#xA;        sa timing: remaining key lifetime (k/sec): (4166663/1692)&#xA;        IV size: 16 bytes&#xA;        replay detection support: Y&#xA;        Status: ACTIVE(ACTIVE)&#xA;&#xA;     outbound ah sas:&#xA;&#xA;     outbound pcp sas:&#xA;&#xA;   protected vrf: (none)&#xA;   local  ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)&#xA;   remote ident (addr/mask/prot/port): (192.168.255.0/255.255.255.0/0/0)&#xA;   current_peer xx.xx.193.9 port 500&#xA;     PERMIT, flags={origin_is_acl,}&#xA;    #pkts encaps: 8, #pkts encrypt: 8, #pkts digest: 8&#xA;    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0&#xA;    #pkts compressed: 0, #pkts decompressed: 0&#xA;    #pkts not compressed: 0, #pkts compr. failed: 0&#xA;    #pkts not decompressed: 0, #pkts decompress failed: 0&#xA;    #pkts no sa (send) 0, #pkts invalid sa (rcv) 0&#xA;    #pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0&#xA;    #pkts invalid prot (recv) 0, #pkts verify failed: 0&#xA;    #pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0&#xA;    #pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0&#xA;    ##pkts replay failed (rcv): 0&#xA;    #pkts tagged (send): 0, #pkts untagged (rcv): 0&#xA;    #pkts not tagged (send): 0, #pkts not untagged (rcv): 0&#xA;    #pkts internal err (send): 0, #pkts internal err (recv) 0&#xA;&#xA;     local crypto endpt.: xx.xx.222.246, remote crypto endpt.: xx.xx.193.9&#xA;     plaintext mtu 1422, path mtu 1500, ip mtu 1500, ip mtu idb GigabitEthernet0/0&#xA;     current outbound spi: 0x0(0)&#xA;     PFS (Y/N): N, DH group: none&#xA;&#xA;     inbound esp sas:&#xA;&#xA;     inbound ah sas:&#xA;&#xA;     inbound pcp sas:&#xA;&#xA;     outbound esp sas:&#xA;&#xA;     outbound ah sas:&#xA;&#xA;     outbound pcp sas:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Intersting to see that the router shows two SAs, despite one of them being down, while the ASA shows only once.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bringing up the SA&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can bring up the SA from the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mobilerack1-rtr#ping 192.168.255.10 source vlan 10&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.168.255.10, timeout is 2 seconds:&#xA;Packet sent with a source address of 192.168.10.254 &#xA;&#xA;Jun 27 14:57:54.863: [ACL FlexVPN]: state = ACL notify RP action &#xA;Jun 27 14:57:55.163: IPSEC:(SESSION ID = 2) (STATES) SADB_ROOT_SM (sadb_root_process_kmi_message) called static seqno 10 dynamic seqno 0&#xA;Jun 27 14:57:55.163: [ACL FlexVPN]: state = ACL KMI create SA for PtoP &#xA;Jun 27 14:57:55.163: [KMI Forward]: state = KMI Initializing &#xA;Jun 27 14:57:55.163: [KMI Forward]: state = change priority &#xA;Jun 27 14:57:55.163: [KMI Forward]: state = forward &#xA;Jun 27 14:57:55.163: [Ident 80000008]: state = Check. redundant request &#xA;Jun 27 14:57:55.163: [Ident 80000008]: state = Allocate Session &#xA;Jun 27 14:57:55.163: [Session]: state = Session Initialization &#xA;Jun 27 14:57:55.163: [Ident 80000008]: state = Insert Peer &#xA;Jun 27 14:57:55.163: [Ident 80000008]: state = Allocate Sibling &#xA;Jun 27 14:57:55.163: [Sibling]: state = Sibling Initialization &#xA;Jun 27 14:57:55.163: [Ident 80000008]: state = Create In/Outbound SAs &#xA;Jun 27 14:57:55.163: [Ident 80000008]: state = Ident Set Replay &#xA;Jun 27 14:57:55.163: [Ident 80000008]: state = Send SAs to sibling and install them &#xA;Jun 27 14:57:55.163: [Sibling]: state = Hook Session &#xA;Jun 27 14:57:55.167: [Session]: state = Add Sibling to Session List &#xA;Jun 27 14:57:55.167: [Sibling]: state = Fill Sibling with CE data &#xA;Jun 27 14:57:55.167: [Sibling 52EE23C6]: state = Hook SA Struct to Sibling &#xA;Jun 27 14:57:55.167: [Sibling 52EE23C6]: state = Install SPI &#xA;Jun 27 14:57:55.167: [Sibling 52EE23C6]: state = Del Transient SPI &#xA;Jun 27 14:57:55.167: [Ident 80000008]: state = Check. Outbound Enable Status &#xA;Jun 27 14:57:55.167: [Ident 80000008]: state = Got Enable Outbound SA &#xA;Jun 27 14:57:55.167: [Ident 80000008]: state = Select Outbound SA &#xA;Jun 27 14:57:55.167: [Ident 80000008]: state = Install New Outbound SA &#xA;Jun 27 14:57:55.167: [Ident 80000008]: state = Set flow_installed &#xA;Jun 27 14:57:55.167: IPSEC:(SESSION ID = 2) (STATES) ident_set_flow_installed_action Sending crypto_ss_connection_open&#xA;&#xA;Jun 27 14:57:55.167: [Ident 80000008]: state = Check Install SA Declare Success &#xA;Jun 27 14:57:55.167: [Ident 80000008]: state = Declare success &#xA;Jun 27 14:57:55.167: [KMI Forward]: state = success &#xA;Jun 27 14:57:55.167: [KMI Forward]: deleting state machine &#xA;Jun 27 14:57:55.167: [ACL FlexVPN]: state = ACL KMI check result ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="3875" LastEditDate="2016-06-27T14:58:39.893" LastActivityDate="2016-07-19T01:18:49.083" Title="Cisco ASAv not building up child SA" Tags="|cisco|cisco-asa|cisco-ios|ipsec|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32592" PostTypeId="1" AcceptedAnswerId="32635" CreationDate="2016-06-27T14:59:40.573" Score="1" ViewCount="1164" Body="&lt;p&gt;I am trying to link this configuration to a real SPA 303 IP phone but I do not know where to begin with this. I have the physical IP Phone, but I want to run it through the simulated environment that I have set up for the purpose of simulating voip issues. I've searched all over the internet and have found nothing pertaining to that goal. Please provide any thoughts you have on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PAIia.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PAIia.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27391" LastEditorUserId="509" LastEditDate="2016-06-30T05:18:58.227" LastActivityDate="2016-06-30T05:18:58.227" Title="Real IP phone in GNS3 Problem" Tags="|cisco|cisco-asa|ip|voip|gns3|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32593" PostTypeId="2" ParentId="32496" CreationDate="2016-06-27T17:18:30.847" Score="0" Body="&lt;p&gt;Normaly a port can only be a member of one untagged VLAN. Dlink however has a feature documented in the manual called &quot;Asymetric VLAN&quot; that allows multiple VLANS to be untagged on the same port. This allows multipple VLANS to access the same server but not eachother. This feature needs to be enabled for it to be possible to untag multipple VLANS on the same port. From the manual:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Port 1 connect to Server; port 1, port 3, port 9 and port 17 are untagged ports; PC3 &amp;amp; PC4 are in the same VLAN#3; port 1 &#xA;is  a  untagged  member  of  VLAN#2  and  VLAN#3  (untagged  member  overlap).  Then  the  server  can  talk  with  VLAN#2,&lt;br&gt;&#xA;VLAN#3; PC3 and PC4 can talk to the server and to each ot&#xA;her; PC2 can talk to the Se&#xA;rver; VLAN#2 can’t communicate &#xA;with VLAN3. &#xA;In this example port 1 need to be untagged member in VLAN#2 &amp;amp; VLAN#3, so Asymmetric VLAN should be enabled &lt;/p&gt;&#xA;" OwnerUserId="27466" LastActivityDate="2016-06-27T17:18:30.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32594" PostTypeId="1" AcceptedAnswerId="32596" CreationDate="2016-06-27T17:21:59.090" Score="4" ViewCount="1276" Body="&lt;p&gt;I've been trying to read up on a debug output I received with &quot;FORUS FALSE&quot; on it and tried looking online for that, and then I found just a little bit about a forus packet saying it's a packet destined for the router itself but I think I saw this output on a switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not able to find any solid information on this? Could someone please explain what a forus packet is and what forus false is supposed to be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2016-06-27T18:19:30.007" Title="What exactly is a &quot;forus packet&quot;?" Tags="|switch|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32595" PostTypeId="1" AcceptedAnswerId="34397" CreationDate="2016-06-27T18:04:45.953" Score="2" ViewCount="100" Body="&lt;p&gt;We are provisioning a 4xT1 and a separate 3xT1 links to the same 2901 router with 4x VWIC3 - 2MFT T1 cards. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Verizon claims they cannot bond all 7 into a 7xT1 and have thus provisioned us these 2 links. I thought we would be able to load balance across the two links (via some agreed upon routing protocol) with some Verizon coordination; but now Verizon is saying they cannot as they go into separate routers on their end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make matters worse, they assumed, incorrectly, that these links would also go into 2 separate routers on our end as well and have given me the same DLCI's for both links. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is; if Verizon is unable/unwilling to work with us to load balance, is there some genius way of load balancing these 2 bonded frame relay links to give me a full 10 Mb of bandwidth without Verizon-side collaboration? (instead of the current and separate 6Mb and 4Mb links)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks! &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname 2901&#xA;!&#xA;enable secret cisco&#xA;!&#xA;card type t1 0 0&#xA;card type t1 0 1&#xA;card type t1 0 2&#xA;card type t1 0 3&#xA;!&#xA;no ipv6 cef&#xA;no ip source-route&#xA;ip cef&#xA;!&#xA;no ip domain lookup&#xA;ip name-server 198.6.1.142&#xA;ip name-server 198.6.100.53&#xA;!&#xA;!&#xA;controller T1 0/0/0&#xA;cablelength long 0db&#xA;channel-group 1 timeslots 1-24&#xA;!&#xA;controller T1 0/0/1&#xA;cablelength long 0db&#xA;channel-group 1 timeslots 1-24&#xA;!&#xA;controller T1 0/1/0&#xA;cablelength long 0db&#xA;channel-group 1 timeslots 1-24&#xA;!&#xA;controller T1 0/1/1&#xA;cablelength long 0db&#xA;channel-group 1 timeslots 1-24&#xA;!&#xA;interface MFR1&#xA;mtu 4470&#xA;no ip address&#xA;no ip redirects&#xA;no ip proxy-arp&#xA;encapsulation frame-relay IETF&#xA;load-interval 30&#xA;frame-relay multilink bid to gw&#xA;frame-relay lmi-type ansi&#xA;!&#xA;interface MFR1.500 point-to-point&#xA;ip address 1.130.197.162 255.255.255.252&#xA;no ip redirects&#xA;no arp frame-relay&#xA;no cdp enable&#xA;frame-relay interface-dlci 500 IETF&#xA;!&#xA;interface GigabitEthernet0/0&#xA;description CPE_LAN&#xA;ip address &amp;lt;LAN IP MASK&amp;gt;&#xA;no ip redirects&#xA;no ip proxy-arp&#xA;no ip mroute-cache&#xA;duplex auto&#xA;speed auto&#xA;no cdp enable&#xA;no shutdown&#xA;!&#xA;interface Serial0/1/0:1&#xA;description To CPE_WAN&#xA;no ip address&#xA;mtu 4470&#xA;bandwidth 1536&#xA;no ip mroute-cache&#xA;encapsulation frame-relay MFR1&#xA;!&#xA;interface Serial0/1/1:1&#xA;description To CPE_WAN&#xA;no ip address&#xA;mtu 4470&#xA;bandwidth 1536&#xA;no ip mroute-cache&#xA;encapsulation frame-relay MFR1&#xA;!&#xA;interface Serial0/1/2:1&#xA;description To CPE_WAN&#xA;no ip address&#xA;mtu 4470&#xA;bandwidth 1536&#xA;no ip mroute-cache&#xA;encapsulation frame-relay MFR1&#xA;!&#xA;interface Serial0/1/3:1&#xA;description To CPE_WAN&#xA;no ip address&#xA;mtu 4470&#xA;bandwidth 1536&#xA;no ip mroute-cache&#xA;encapsulation frame-relay MFR1&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 1.130.197.161&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MLFR 3xT1&#xA;&#xA;!&#xA;!&#xA;controller T1 0/2/0&#xA;cablelength long 0db&#xA;channel-group 2 timeslots 1-24&#xA;!&#xA;controller T1 0/2/1&#xA;cablelength long 0db&#xA;channel-group 2 timeslots 1-24&#xA;!&#xA;controller T1 0/3/0&#xA;cablelength long 0db&#xA;channel-group 2 timeslots 1-24&#xA;!&#xA;interface MFR1&#xA;mtu 4470&#xA;no ip address&#xA;no ip redirects&#xA;no ip proxy-arp&#xA;encapsulation frame-relay IETF&#xA;load-interval 30&#xA;frame-relay multilink bid to gw&#xA;frame-relay lmi-type ansi&#xA;!&#xA;interface MFR1.500 point-to-point&#xA;ip address 1.179.125.98 255.255.255.252&#xA;no ip redirects&#xA;no arp frame-relay&#xA;no cdp enable&#xA;frame-relay interface-dlci 500 IETF  &#xA;!&#xA;interface GigabitEthernet0/0&#xA;description CPE_LAN&#xA;ip address &amp;lt;LAN IP MASK&amp;gt;&#xA;no ip redirects&#xA;no ip proxy-arp&#xA;no ip mroute-cache&#xA;duplex auto&#xA;speed auto&#xA;no cdp enable&#xA;no shutdown&#xA;!&#xA;interface Serial0/1/0:1&#xA;description To CPE_WAN&#xA;no ip address&#xA;mtu 4470&#xA;bandwidth 1536&#xA;no ip mroute-cache&#xA;encapsulation frame-relay MFR1&#xA;!&#xA;interface Serial0/1/1:1&#xA;description To CPE_WAN&#xA;no ip address&#xA;mtu 4470&#xA;bandwidth 1536&#xA;no ip mroute-cache&#xA;encapsulation frame-relay MFR1&#xA;!&#xA;interface Serial0/1/2:1&#xA;description To CPE_WAN&#xA;no ip address&#xA;mtu 4470&#xA;bandwidth 1536&#xA;no ip mroute-cache&#xA;encapsulation frame-relay MFR1&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 1.179.125.97&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21964" LastEditorUserId="21964" LastEditDate="2016-06-27T22:18:22.467" LastActivityDate="2016-08-26T18:12:59.227" Title="Load balancing across 2 Multi-link frame relay links- Verizon being difficult" Tags="|load-balancing|frame-relay|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32596" PostTypeId="2" ParentId="32594" CreationDate="2016-06-27T18:19:30.007" Score="7" Body="&lt;p&gt;There's no such thing as a &quot;forus&quot; packet.  The term is a Cisco internal debugging flag that means the packet is destined for the router itself.  In debugging messages, if a packet is destined for the router, it is indicated by &quot;FORUS true&quot;, or &quot;FORUS False&quot; if not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internal flag is named &quot;FORUS&quot; as in &quot;the packet was meant 'For Us.'&quot;  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-27T18:19:30.007" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32598" PostTypeId="2" ParentId="6171" CreationDate="2016-06-27T19:21:02.900" Score="3" Body="&lt;p&gt;stead of using the untagged command you have to use the &lt;strong&gt;no tagged&lt;/strong&gt; command.&lt;/p&gt;&#xA;" OwnerUserId="27467" LastActivityDate="2016-06-27T19:21:02.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32600" PostTypeId="1" CreationDate="2016-06-27T19:39:57.787" Score="4" ViewCount="23021" Body="&lt;p&gt;The idea is that I want to have a static IP for the MAC computer always assign me the IP . please help , as would the commands ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a cisco 3650 switch core where I configured the DHCP and VLAN former systems administrator assigned an IP to MAC address as follows :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ip dhcp pool NAME&lt;/li&gt;&#xA;&lt;li&gt;host 192.168.17.137 255.255.255.0 &lt;/li&gt;&#xA;&lt;li&gt;client-identifier 0100.71cc.02XX.XX&lt;/li&gt;&#xA;&lt;li&gt;client-name NAME&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;but I do not know how to do it for a VLAN IP 17 as mentioned always assign me a static IP .&lt;/p&gt;&#xA;" OwnerUserId="27468" LastEditorUserId="8499" LastEditDate="2019-01-13T03:46:23.623" LastActivityDate="2019-01-13T03:46:23.623" Title="Assign an IP to a MAC Address to DHCP POOL" Tags="|cisco|ip|ipv4|dhcp|mac|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32601" PostTypeId="2" ParentId="32600" CreationDate="2016-06-27T20:05:46.577" Score="3" Body="&lt;p&gt;On a Cisco IOS DHCP server, it is pretty simple. In the DHCP pool configuration, use the &lt;code&gt;address&lt;/code&gt; command to assign an IP address to a MAC address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address &amp;lt;ip-address&amp;gt; hardware-address &amp;lt;mac-address&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/15-sy/dhcp-15-sy-book/dhcp-prt-bsd-aa.html#GUID-D3427E9D-D0F3-4FFE-889C-8091A84006C6&quot; rel=&quot;nofollow&quot;&gt;Preassigning IP Addresses and Associating Them to a Client&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Preassigning IP Addresses and Associating Them to a Client&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Perform this task to preassign an IP address and associate it to a&#xA;  client identified by a client ID or MAC address.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For port-based address assignment, you must perform the task in the&#xA;  &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/15-sy/dhcp-15-sy-book/dhcp-prt-bsd-aa.html#GUID-0709D49E-5CD2-46A0-BEE5-D24BFAA003BE&quot; rel=&quot;nofollow&quot;&gt;Automatically Generating a Subscriber Identifier for a DHCP Message&#xA;  Received on a Port&lt;/a&gt; task to associate the client ID with the&#xA;  subscriber ID. The subscriber ID value is based on the short name of&#xA;  the port to which the directly connected device is attached.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Configure a normal DHCP pool by supplying any DHCP options and lease&#xA;  time. Preassigned addresses are automatically excluded from normal&#xA;  dynamic IP address assignment. Preassigned addresses cannot be used in&#xA;  host pools, but there can be multiple preassigned addresses per DHCP&#xA;  address pool.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt;  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Only one IP address can be assigned per port.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Preassigned addresses (also called reserved addresses) cannot be&#xA;  cleared by using the &lt;strong&gt;clear ip dhcp binding&lt;/strong&gt; command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;SUMMARY STEPS&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;enable&lt;/li&gt;&#xA;  &lt;li&gt;configure terminal &lt;/li&gt;&#xA;  &lt;li&gt;ip dhcp pool &lt;em&gt;name&lt;/em&gt; &lt;/li&gt;&#xA;  &lt;li&gt;network &lt;em&gt;network-number&lt;/em&gt; [&lt;em&gt;mask&lt;/em&gt; | / &lt;em&gt;prefix-length&lt;/em&gt;] &lt;/li&gt;&#xA;  &lt;li&gt;address &lt;em&gt;ip-address&lt;/em&gt; client-id &lt;em&gt;string&lt;/em&gt; [ascii] &lt;/li&gt;&#xA;  &lt;li&gt;address &lt;em&gt;ip-address&lt;/em&gt; hardware-address &lt;em&gt;mac-address&lt;/em&gt; [&lt;em&gt;hardware-number&lt;/em&gt;]&lt;/li&gt;&#xA;  &lt;li&gt;end &lt;/li&gt;&#xA;  &lt;li&gt;show ip dhcp pool [&lt;em&gt;name&lt;/em&gt;]&lt;/li&gt;&#xA;  &lt;li&gt;show ip dhcp binding &lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your comments:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool Test-Pool&#xA;network 192.168.17.0/24&#xA;address 192.168.17.137 hardware-address 0100.71cc.02XX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-06-27T20:39:20.160" LastActivityDate="2016-06-27T20:39:20.160" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="32602" PostTypeId="1" CreationDate="2016-06-27T20:06:38.887" Score="2" ViewCount="673" Body="&lt;p&gt;I am studying to receive my ccna and have come across a question that, for some reason, is difficult to conceptualize (at least for me). This is a theoretical question and not what's best practice, as I am sure what I am going to present does not exist intentionally out in the real world.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Question is: How does a sending host know it's communicating with the right host on the right SUBNET? And if it can't, what are the security-related implications of this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider this setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PCA 192.168.1.1 Subnet 255.255.255.0&#xA;PCB 192.168.1.2 Subnet 255.255.255.128 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connected via a layer 2 switch on the same vlan\segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These machines are technical on different &quot;subnets&quot;, one with a range of 0-255, and the other 0-127. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PCA (192.168.1.1) sends traffic to PCB (192.168.1.2) and communication is successful, when technically it shouldn't be. These machines are on the same network address 192.168.1.0. And this test was performed in packet tracer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Choose an ip for PCB from the next subnet in the /25 network (192.168.1.128); (I have not done packet capturing on this) my assumption is that communication would be allowed 1 way, from PCA -&gt; PCB, but PCB would be aware of it's own subnet and not reply without a route configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are my assumptions\findings true?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*All tests were performed in packet tracer.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand how to determine network addresses via subnet masks and the ANDing method. But in the books, they just ask that, by convention, you should avoid overlapping subnets. In VLSM, they say provision the largest network first, then the next largest and so on, without overlapping. But there is nothing technological preventing you from having overlapping ranges and even duplicate ips (at least on a lan). I guess in my example the machines ARE on the same network 192.168.1.0, regardless of how the subnet is sliced. But what are the security implications of this? locally vs internet?&lt;/p&gt;&#xA;" OwnerUserId="27469" LastEditorUserId="8499" LastEditDate="2016-06-27T21:21:19.437" LastActivityDate="2016-08-28T18:03:30.833" Title="Different but overlapping Variable Length Subnet ranges on the same segment" Tags="|subnet|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32603" PostTypeId="2" ParentId="32602" CreationDate="2016-06-27T20:12:46.343" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;communication is successful, when technically it shouldn't be.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Why shouldn't it be? The subnet mask answers the question &quot;what's on the wire with me?&quot; In this case, both hosts &lt;em&gt;are&lt;/em&gt; on the wire together, so they can communicate at layer-2 directly. Broadcast traffic (at L3) between the two hosts won't work because they are listening at different addresses. (255 vs 127)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-06-27T20:12:46.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32604" PostTypeId="2" ParentId="32602" CreationDate="2016-06-27T20:22:42.563" Score="1" Body="&lt;p&gt;A host will mask its address and the destination address with its configured mask. If the two values are equal, it means that the destination is on the same network as the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PCA address 192.168.1.1 mask 255.255.255.0 network 192.168.1.0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address 192.168.1.1   = 11000000.10101000.00000001.00000001&#xA;mask    255.255.255.0 = 11111111.11111111.11111111.00000000&#xA;                        ===================================&#xA;network                 11000000.10101000.00000001.00000000 = 192.168.1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;PCB address 192.168.1.2 mask 255.255.255.128 network 192.168.1.0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address 192.168.1.2     = 11000000.10101000.00000001.00000010&#xA;mask    255.255.255.128 = 11111111.11111111.11111111.10000000&#xA;                          ===================================&#xA;network                   11000000.10101000.00000001.00000000 = 192.168.1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The networks for the two devices are the same. Where you would run into a problem is with an address that is higher than 192.168.1.127. In that case, PCA would think it's on the same network, and it could send something to PCB, but PCB would think it's on a different network, and it would be unable to reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really need to do addressing in binary to see how it works. &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;This answer&lt;/a&gt; is an excellent resource.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to avoid overlapping networks because of the problem I described above, and the fact that your router will not let you assign overlapping networks on different interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You assign the largest networks first to help prevent blocks of unused addresses. This is easy to see if you do this in binary.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-06-27T21:22:43.273" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32606" PostTypeId="1" CreationDate="2016-06-27T22:53:16.497" Score="3" ViewCount="660" Body="&lt;p&gt;Customer has internal networks 10.0.0.0/16, 192.168.0.0/16. Has a network of VPN tunnels, an AT&amp;amp;T MPLS network, and a few Internet (public IP links) from me. I maintain an eBGP AS. He wants to pass us all his iBGP routes from inside his MPLS to us, so we can pass them back to his firewall in the datacenter. I'm a bit confused about him passing us his private stuff, shouldnt his iBGP run only on his gear and not need to be passed to mine, since we are only providing public links? His loopback addresses are private IP range, so I wont even be able to talk to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's basically how it looks:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aO3iG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aO3iG.jpg&quot; alt=&quot;Customer Overview Setup&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8185" LastActivityDate="2019-04-10T08:28:55.460" Title="ISP's Customer wants to pass iBGP for his private IP addresses inside his WAN?" Tags="|routing|bgp|mpls|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32608" PostTypeId="1" CreationDate="2016-06-28T04:25:56.243" Score="2" ViewCount="299" Body="&lt;p&gt;How do I take this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network obj-nat_DNS1&#xA; host 10.128.33.11&#xA;object network obj-nat_DNS2&#xA; host 10.128.33.12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And change the hosts to different IPs?  I'm not trying to delete the network objects, just modifying them. I tried this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network obj-nat_DNS1&#xA; no host 10.128.33.11&#xA; host 10.128.33.21&#xA;object network obj-nat_DNS2&#xA; no host 10.128.33.12&#xA; host 10.129.22.22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I got:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ERROR: unable to delete object (obj-nat_DNS1). object is being used.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27476" LastEditorUserId="8499" LastEditDate="2016-06-28T12:04:14.847" LastActivityDate="2016-06-28T12:04:14.847" Title="Cisco ASA network object host changes with NAT" Tags="|cisco|cisco-asa|nat|firewall|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32610" PostTypeId="2" ParentId="21077" CreationDate="2016-06-28T06:16:00.117" Score="4" Body="&lt;p&gt;When you think about it, creating a circular buffer within an on-disk file is pretty complex, and not suited at all to typical disk I/O. The only way to make it even marginally feasible is to find a way to write fixed-length entries to the file, which doesn't sound like it would be a good match for a packet trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As suggested above, I would instead use the ringbuffer feature in tshark to create several files which the capture will use in turn. If you specify creating N files (5 to 10 would seem reasonable to me), and tell tshark to rotate after a fixed amount T of time, you will have a reasonable number of log files, an assurance that they won't accumulate over time, and easy access to something between &lt;code&gt;(N-1)*T&lt;/code&gt; and &lt;code&gt;N*T&lt;/code&gt; minutes of packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per the tshark manual, you would need to use the &lt;code&gt;-b&lt;/code&gt; option like so to get 6 files of 2 minutes worth of logs each (note that &lt;code&gt;-b&lt;/code&gt; must be specified twice)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-b duration:120 -b files:6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you need to view the whole capture in one go, you can then use the &lt;code&gt;mergecap&lt;/code&gt; utility to merge the N logfiles into one large one to work with in Wireshark.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-06-28T06:16:00.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32611" PostTypeId="1" CreationDate="2016-06-28T06:40:20.070" Score="0" ViewCount="2507" Body="&lt;p&gt;I have CAT7 cables running trough the walls and I need to purchase wall plates. I am only finding wall plates rated for CAT6. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this really matter or are all RJ45 plugs/sockets the same?&lt;/p&gt;&#xA;" OwnerUserId="27479" LastEditorUserId="8499" LastEditDate="2016-06-29T15:59:00.230" LastActivityDate="2017-08-24T10:54:43.007" Title="RJ45 Female wall plate cat ratings" Tags="|ethernet|layer1|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32612" PostTypeId="2" ParentId="16625" CreationDate="2016-06-28T07:28:31.130" Score="0" Body="&lt;p&gt;sometimes is the encapsulation mismatch. whick menas that keepalives will not be receiver on the far end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it's a datalink layer problem.&lt;/p&gt;&#xA;" OwnerUserId="27480" LastActivityDate="2016-06-28T07:28:31.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32613" PostTypeId="2" ParentId="32611" CreationDate="2016-06-28T08:27:10.347" Score="-1" Body="&lt;p&gt;This depends on specific situations. Maybe the following links help you to better understand this question.&#xA;&lt;a href=&quot;https://superuser.com/questions/663732/can-i-use-cat5e-jacks-with-cat6-cable&quot;&gt;https://superuser.com/questions/663732/can-i-use-cat5e-jacks-with-cat6-cable&lt;/a&gt;&#xA;&lt;a href=&quot;https://serverfault.com/questions/80014/is-there-a-difference-between-rj-45-plugs-for-cat-5e-and-cat-6&quot;&gt;https://serverfault.com/questions/80014/is-there-a-difference-between-rj-45-plugs-for-cat-5e-and-cat-6&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26940" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2016-06-29T03:54:37.157" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32614" PostTypeId="2" ParentId="32608" CreationDate="2016-06-28T08:28:58.360" Score="3" Body="&lt;p&gt;Yes, you cannot do this right away.  You have to temporarily negate everywhere the object is being used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My advice would be to copy the commands where the objects are being used, negate them and do the changes to the object.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once done, you can copy the initial command from the text file to the ASA back again.&lt;/p&gt;&#xA;" OwnerUserId="25146" LastActivityDate="2016-06-28T08:28:58.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32615" PostTypeId="2" ParentId="32582" CreationDate="2016-06-28T08:35:57.603" Score="1" Body="&lt;p&gt;You can use a load balancer device.  The load balancer will become your hosts' Gateway.  The purpose of the load balacer is to route traffics (based on a selected algorithm) to the ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One powerful open source load balancer is &lt;a href=&quot;https://www.zenloadbalancer.com/community/downloads/&quot; rel=&quot;nofollow&quot;&gt;Zen Loadbalancer&lt;/a&gt;.  You can even install it on a Virtual Machine.&lt;/p&gt;&#xA;" OwnerUserId="25146" LastActivityDate="2016-06-28T08:35:57.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32621" PostTypeId="1" AcceptedAnswerId="32647" CreationDate="2016-06-28T15:32:28.843" Score="2" ViewCount="689" Body="&lt;p&gt;Here's my problem:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 separate Internet locations; one of these locations is the &quot;main&quot; location. The other two &quot;branch&quot; locations connect to the main location over IPSec VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I need to do is connect the two branch locations to each other over their corresponding VPN tunnels through the main location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Branch 1 SonicWALL (192.168.0.1) connects to Main SonicWALL (192.168.1.1) via VPN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Branch 2 SonicWALL (192.168.2.1) connects to Main SonicWALL (192.168.1.1) via VPN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Branch 1 and Branch 2 subnets need to be able to communicate with each other through their VPNs to the Main location (i.e. 192.168.2.1 &amp;lt;-&gt; 192.168.1.1 &amp;lt;-&gt; 192.168.0.1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware that a VPN tunnel between the 2 Branch locations would achieve communication, but in the actual scenario this is not practical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible? If so, how can I achieve this? If not, what is the best solution?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's anymore information needed, please let me know and I will update the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="27489" LastActivityDate="2016-06-29T14:02:39.303" Title="SonicWALL - 2 VPN subnets need to communicate" Tags="|sonicwall|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32625" PostTypeId="1" CreationDate="2016-06-28T19:20:26.560" Score="1" ViewCount="1290" Body="&lt;p&gt;Hi im trying to make vlans talk to eachother, i have 2 3560 switches, i put addresses on the vlans just not sure why its protocol is down cuz i think its supposed to be up/up, also how do i know its working?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh ip interfa brie vlan 10&#xA;Interface              IP-Address      OK? Method Status                Protocol&#xA;Vlan10                 192.168.11.254  YES manual up                    down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27334" LastEditorUserId="2142" LastEditDate="2016-06-28T19:52:37.643" LastActivityDate="2016-06-30T07:36:41.710" Title="Making vlans talking to other vlans" Tags="|vlan|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32626" PostTypeId="1" CreationDate="2016-06-28T19:48:03.950" Score="2" ViewCount="1777" Body="&lt;p&gt;I have developed a product which provides two ethernet ports. The internal module which manages the eth is a switch with its own mac address that can be modified. To every product I am assigning a mac taken from our company database. Aiming to test both the eth ports I designed the following test:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;it is just sufficient to connect one port to the network and the other port to a known device. If I am able to ping that device it means both ports are working.&#xA;Ip addresses are given by dhcp. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually I am looking at the arp table in order to find the address of the device to be pinged. For other purposes I need to know the ip address of the product containing the 2 eth and to which I assigned the mac address. Again it would be simple to just look at the arp table, but, when the mac address has been set, the arp shall be updated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I specify I must use windows. For now I used nmap -v -sn --unprivileged but seems it is not working on our production site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be another trick/method that can be used to find the product ip or for updating the arp table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="27494" LastActivityDate="2016-06-30T23:51:40.370" Title="How to update arp table given a new device?" Tags="|ethernet|ip|mac-address|arp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32627" PostTypeId="2" ParentId="32625" CreationDate="2016-06-28T19:55:30.827" Score="2" Body="&lt;p&gt;The interface could be down because you have no ports on that VLAN that are up.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, you have already configured another VLAN interface on that switch.  On  layer 2 switches, you can only have one VLAN interface up at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want the two VLANs to talk to each other, you will need a router, or a layer 3 swith.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-06-28T19:55:30.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32629" PostTypeId="1" CreationDate="2016-06-28T21:23:58.257" Score="0" ViewCount="578" Body="&lt;p&gt;Is the IP address 224.0.0.0 routable over the internet?&lt;/p&gt;&#xA;" OwnerUserId="24713" LastEditorUserId="8499" LastEditDate="2020-07-17T03:27:05.590" LastActivityDate="2020-07-17T05:30:12.483" Title="Private Public and Special IP addressing" Tags="|routing|ip|ipv4|ip-address|multicast|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32630" PostTypeId="2" ParentId="32629" CreationDate="2016-06-28T21:39:58.627" Score="5" Body="&lt;p&gt;No. IPv4 addresses in the range &lt;code&gt;224.0.0.0/4&lt;/code&gt; are not regular addresses; they are multicast addresses. Multicast is normally confined to a single LAN. Multicast routing must be enabled on all the routers between the multicast source and the multicast group subscribers for it to be able to be routed to another LAN, and that simply isn't practical on the public Internet.&lt;/p&gt;&#xA;&lt;p&gt;There are several multicast ranges within the overall multicast address range (see &lt;a href=&quot;http://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPv4 Multicast Address Space Registry&lt;/a&gt;), and &lt;code&gt;224.0.0.0/24&lt;/code&gt; is the Local Network Control Block of addresses. Multicast packets sent to addresses in this block are not to be routed (see &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5771#section-4&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5771, IANA Guidelines for IPv4 Multicast Address Assignments, Section 4, Local Network Control Block&lt;/a&gt;).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Addresses in the Local Network Control Block are used for protocol&#xA;control traffic that is not forwarded off link.  Examples of this type&#xA;of use include OSPFIGP All Routers (224.0.0.5) [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2328&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC2328&lt;/a&gt;].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-06-28T21:39:58.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32631" PostTypeId="2" ParentId="32625" CreationDate="2016-06-28T21:49:02.343" Score="3" Body="&lt;p&gt;The VLAN interface protocol would be up if you would have a port that is up or if those VLANs were present on a trunk link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3560 is a Layer 3 switch so to route between vlans or you need to do is to type 'ip routing' command and assign proper gateways on the end devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/17673/d-link-l2-l3-network-setup/28880#28880&quot;&gt;D-Link L2 &amp;amp; L3 Network Setup&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That was a similar quesiton to yours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="22574" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-06-28T21:49:02.343" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32632" PostTypeId="2" ParentId="32621" CreationDate="2016-06-28T22:24:03.183" Score="1" Body="&lt;p&gt;Your requirements is pretty much standard. It just a hub and spoke configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have a full manual with screeshots and example here &lt;a href=&quot;https://support.software.dell.com/kb/sw12024&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw12024&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2016-06-28T22:24:03.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32633" PostTypeId="2" ParentId="32539" CreationDate="2016-06-28T23:35:19.227" Score="0" Body="&lt;p&gt;Sorry about the long wait. I've solved the problem by now, and everything was wrong. I had to reload the factory config and start from scratch. In this case, it was just a matter of not setting up my interfaces properly and looking for answers on the wrong switch. And then messing with the config to death.&lt;/p&gt;&#xA;" OwnerUserId="27412" LastActivityDate="2016-06-28T23:35:19.227" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32634" PostTypeId="2" ParentId="32511" CreationDate="2016-06-28T23:37:26.380" Score="0" Body="&lt;p&gt;Note that you haven't mentioned which models of switches you have in production. Can you post?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a simple solution (to begin with) you may want to investigate the redesign of your datacentre switching paths to make it more resilient to individual switch reboots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The image linked below is taken from Cisco but you can use any other manufacturer as long as they support what you want and are compatible with your current production switches:-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/dam/en/us/td/i/100001-200000/110001-120000/119001-120000/119801.ps/_jcr_content/renditions/119801.jpg&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/dam/en/us/td/i/100001-200000/110001-120000/119001-120000/119801.ps/_jcr_content/renditions/119801.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Placing a couple of Layer 3 distribution switches, uplinking your current switches and making these new distribution switches the spanning tree root will provide the resilience you seek.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-06-28T23:37:26.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32635" PostTypeId="2" ParentId="32592" CreationDate="2016-06-29T03:07:02.650" Score="1" Body="&lt;p&gt;I've posted about this &lt;a href=&quot;http://www.oznetnerd.com/2012/12/01/virtual-equipment-physical-equipment-big-lab/&quot; rel=&quot;nofollow&quot;&gt;on my blog a few times.&lt;/a&gt; The short of it is that you bind your PC's network card to a cloud object in GNS3. This connects your virtual (GNS3) network to your physical network. If your PC is connected to a switch, everything on that switch will have connectivity to the virtual network and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're still having connectivity issues, switch off your PC's firewall and try again.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-06-29T03:07:02.650" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32636" PostTypeId="2" ParentId="13438" CreationDate="2016-06-29T04:22:20.877" Score="1" Body="&lt;p&gt;Indeed. But anyways, there's still a way to make it more efficient — data can be put into SYN-SYNACK-ACK packets, although until the handshake's done, the data can't be used.&lt;/p&gt;&#xA;" OwnerUserId="8761" LastActivityDate="2016-06-29T04:22:20.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32637" PostTypeId="2" ParentId="30723" CreationDate="2016-06-29T06:29:03.813" Score="0" Body="&lt;p&gt;Attenuation refers to a reduction in signal strength commonly occurring while transmitting analog or digital signals over long distances. When using copper conductors, the higher the frequency signal, the more attenuation is caused along a cable length. All electrical signals transmitted down electrical conductors cause an electromagnetic field around the transmission. This field causes energy loss down the cable and gets worse depending upon the frequency and length of the cable.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-06-29T06:29:03.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32639" PostTypeId="1" AcceptedAnswerId="32669" CreationDate="2016-06-29T07:11:56.597" Score="1" ViewCount="1434" Body="&lt;p&gt;I'm sure there's answers to this all over the internet but I've tried for days and days and I just can't get it. Maybe I'm cisco dyslexic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a simple home connection and lets say my external web ip address is 1.2.3.4, and inside my asa5505 network I've got a web server running in a VM which I want to expose to the internet for HTTPS and RDP. Lets say the internal IP of that server is 10.0.0.98&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rest of the network is on a domain but this webserver is not joined to the domain and I've enabled windows firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since its a VM I can't plug it into a separate port on the ASA5505.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What commands can I issue to the 5505 to safely expose HTTPS and RDP for just that machine, while keeping the rest of the network safe and without disabling vpn which is needed for home workers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help about in asdm gives:&#xA;Cisco Adaptive Security Appliance Software Version 8.3(1) &#xA;Device Manager Version 6.3(1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIA&lt;/p&gt;&#xA;" OwnerUserId="27500" LastActivityDate="2017-07-26T12:47:18.760" Title="Cisco ASA5505 configure web server" Tags="|cisco-asa|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32640" PostTypeId="1" AcceptedAnswerId="33099" CreationDate="2016-06-29T09:25:00.233" Score="1" ViewCount="606" Body="&lt;p&gt;I want to access my 2960-X on my &quot;&lt;em&gt;server-network&lt;/em&gt;&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured a network 10.0.0.0/24 (VLAN60) on the Router, which is connected to the switch over a trunkport. Also VLAN 40, 80, 90 is configured on this trunk. VLAN1 (default VLAN on the switch) is 192.168.1.1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My play is that the switch will get the IP address 10.0.0.200. So I reach the switch without changing the IP of my server. I also want to reach him on every interface in the whole network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the solution that I have to make every Port a trunk Port, which carries VLAN1 and the VLAN(60 or 40 or 80 or 90) ? Which would be definitly not my plan. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same scenario as the Router, which is reachable through the Gateways configured for the networks. Do I have to connect the Management Port (left side) to one of the Ports on those network? &lt;/p&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="22401" LastEditDate="2016-06-29T09:59:57.783" LastActivityDate="2016-07-14T21:57:26.387" Title="Cisco 2960-X IP Address" Tags="|cisco|routing|switch|cisco-catalyst|management|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32641" PostTypeId="2" ParentId="32541" CreationDate="2016-06-29T09:53:59.793" Score="3" Body="&lt;p&gt;Two paths with equal cost is often called equal-cost multipath (ECMP) mechanism. ECMP often works well, but there are a few caveats. Before you get to the issue of running BGP over parallel links, it’s important to look at how traffic is split over multiple parallel links.&lt;/p&gt;&#xA;&lt;p&gt;The simplest way to do this is transmit packet 1 over link A, packet 2 over link B, packet 3 over link A again, packet 4 over link B, and so on. This is per-packet load balancing. The problem with per-packet load balancing is that when packets 1, 3, and 4 are 1500-byte data packets that belong to the same TCP session, but packet 2 is a small TCP ACK packet, packet 3 has to wait for packet 1 to be transmitted, but packet 4 doesn’t have to wait nearly as long behind the much shorter packet 2, so packet 4 ends up being transmitted before packet 3.&lt;/p&gt;&#xA;&lt;p&gt;So per-packet load balancing causes reordering. In theory, that’s fine, as TCP will simply buffer the reordered packets and deliver the data inside to the receiving application in the right order. However, receiving packets out of order makes TCP think there was packet loss, so it retransmits packets and slows down its transmission rate. To avoid such issues, routers and switches work hard to make sure that all packets that belong to the same TCP session (or UDP flow) are transmitted over the same link. Of course this in turn has the downside that a single TCP session can only make use of one link; thus ECMP is only useful if the traffic consists of multiple TCP sessions.&lt;/p&gt;&#xA;&lt;p&gt;Routers and switches usually aren’t in the position to keep track of individual TCP sessions so their packets can be transmitted over the same link. Instead, they look at a few fields in the IP/TCP/UDP/ICMP header and group packets together based on the contents of those fields. Some switches can’t even look inside the IP header, and thus perform load balancing based on the Ethernet MAC addresses. That doesn’t work so well, because this way all the traffic between two routers is transmitted over the same link.&lt;/p&gt;&#xA;&lt;p&gt;A more granular way to perform load balancing is based on the 3-tuple: the protocol number in the IP header (i.e., TCP, UDP, ICMP, …) and the IP source and destination addresses. This works better than just using the MAC addresses to determine which packets should be transmitted over the same link. The best way to perform ECMP is using the 5-tuple: the protocol number, the IP addresses and the TCP or UDP source and destination port numbers. Routers and switches implementing ECMP calculate a hash function over these fields and then use (part of) the resulting hash value to select the link to transmit the packet over. (See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2992&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2992&lt;/a&gt;) As the fields in the 5-tuple are the same for all packets belonging to the same session and thus the hash is the same, all packets belonging to the same session end up using the same link. This works well, but in practice, it can still take as many as a thousand TCP sessions before all the links are utilized equally.&lt;/p&gt;&#xA;&lt;p&gt;Before the ECMP algorithm can distribute packets over parallel links, routing protocols such as &lt;a href=&quot;https://noction.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP&lt;/a&gt; must first be convinced to use multiple links in parallel. There are three ways BGP and ECMP can work together:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Bundling the links at the Ethernet level, using IEEE 802.3ad or EtherChannel&lt;/li&gt;&#xA;&lt;li&gt;With one BGP session over multiple links using loopback addresses&lt;/li&gt;&#xA;&lt;li&gt;With a separate BGP session over each of the parallel links&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;For load balancing to happen, the following path attributes need to be the same for the prefixes learned over the parallel BGP sessions:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;weight&lt;/li&gt;&#xA;&lt;li&gt;local preference&lt;/li&gt;&#xA;&lt;li&gt;AS path length&lt;/li&gt;&#xA;&lt;li&gt;origin&lt;/li&gt;&#xA;&lt;li&gt;MED&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;the neighbor AS or the entire AS path (depending on IOS version)&#xA;Using a separate BGP session for each of the parallel links uses more memory and CPU cycles, so in general this is not the preferred option. However, this option does have an important benefit: unlike the two other options, this one also works if the links connect to different routers on the other side, as long as the attributes listed above are the same.&lt;/p&gt;&#xA;" OwnerUserId="22432" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-10-24T07:23:58.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32643" PostTypeId="2" ParentId="32639" CreationDate="2016-06-29T10:57:01.300" Score="0" Body="&lt;p&gt;The most basic answer resides in NAT. You have to NAT your outside HTTPS and RDP ports to the inside host address of your server. You'll also have to have a rule allowing all IPs from outside to the inside host address on your HTTPS port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd highly recommend NOT having RDP open to the internet however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer is different depending on whether you are using ASDM or CLI however, the following Cisco TAC document should point you in the right direction:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115904-asa-config-dmz-00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/115904-asa-config-dmz-00.html&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="9981" LastActivityDate="2016-06-29T10:57:01.300" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32644" PostTypeId="2" ParentId="17997" CreationDate="2016-06-29T11:02:09.040" Score="0" Body="&lt;p&gt;There is some way to load balancing without AS and PI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For outbound it achieved by  policy routing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For failover inbound traffic, is good to use dynamic DNS. When primary ISP changed, DNS name (with short enough TTL) of site changed to new IP and clients keep access to site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting DNS to two IP simultaneous can make round robin IP selection on clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Periodical changing (with period near to DNS record TTL) between two IP also can make balancing. Same effect is using DNS server that support giving different IP to different clients.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-06-29T11:02:09.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32645" PostTypeId="2" ParentId="32640" CreationDate="2016-06-29T13:36:42.220" Score="1" Body="&lt;p&gt;you need to differentiate between L2 and L3.&#xA;If you want to manage your switch from a subnet you will need to create a SVI (most probably the default GW) for that vlan on your switch.&#xA;Also be sure to enable management traffic on the vty lines.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2016-06-29T13:36:42.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32646" PostTypeId="2" ParentId="29129" CreationDate="2016-06-29T13:49:00.013" Score="0" Body="&lt;p&gt;If You &quot;like&quot; cheap unmanaged switches, You can use separate unmanaged switches for users and cameras. And connect NAS and switches to different ports of router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But unmanaged switches for untrusted users can be bad idea anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at cheap more or less managed switches like &lt;a href=&quot;http://routerboard.com/products/group/18&quot; rel=&quot;nofollow&quot;&gt;Mikrotik&lt;/a&gt; or &lt;a href=&quot;https://www.ubnt.com/edgemax/edgeswitch/&quot; rel=&quot;nofollow&quot;&gt;Ubiquiti&lt;/a&gt; if You need PoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without managed switch or using separate unmanaged switch per isolation group &#xA;only fake isolation posible. By assign multiple subnets on single router port. And only in one dynamic DHCP possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can depend on router features. What is Your router?&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-06-29T13:49:00.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32647" PostTypeId="2" ParentId="32621" CreationDate="2016-06-29T14:02:39.303" Score="1" Body="&lt;p&gt;As KorXo mentioned, this is a standard Hub and Spoke configuration, but KorXo's link is for IPv6. Here's one for &lt;strong&gt;IPv4&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://support.software.dell.com/kb/sw3552&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw3552&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also a video. Basically you create the VPN (eg. from Branch 1 to Main) but use an &lt;strong&gt;Address Object GROUP&lt;/strong&gt; that includes both the Main and Branch 2 subnets. That way Branch 1 understands the VPN to Main includes Main AND Branch 2's networks on the far side. The other sides are similarly configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative is to use Tunnel (&lt;strong&gt;route&lt;/strong&gt;) based VPNs. When you start adding additional Branch sites this makes life simpler as the VPN is just a tunnel from Branch X to Main, and ROUTES are added to allow traffic from Branch 1 to Branch X. See: &lt;a href=&quot;https://support.software.dell.com/kb/sw7902&quot; rel=&quot;nofollow&quot;&gt;https://support.software.dell.com/kb/sw7902&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either would be fine in your situation (with 2 Branch sites) but one may make more sense, so have a look at both! Then choose one, try it and open a new question if you need further assistance (try to include router models, SonicOS versions, and maybe a diagram - showing interface configurations).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2016-06-29T14:02:39.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32648" PostTypeId="2" ParentId="32611" CreationDate="2016-06-29T14:22:47.987" Score="1" Body="&lt;p&gt;Cat7 socket exists. &lt;a href=&quot;http://www.ebay.com/itm/2-pcs-RJ45-8P8C-CAT-7-Modular-plug-ethernet-network-600MHz-connector-Shielded-/191813383260?hash=item2ca8f7f45c:g:4YsAAOSwx-9WzqLe&quot; rel=&quot;nofollow&quot;&gt;http://www.ebay.com/itm/2-pcs-RJ45-8P8C-CAT-7-Modular-plug-ethernet-network-600MHz-connector-Shielded-/191813383260?hash=item2ca8f7f45c:g:4YsAAOSwx-9WzqLe&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cat7 required to make &lt;a href=&quot;https://en.wikipedia.org/wiki/ISO/IEC_11801#Category_7&quot; rel=&quot;nofollow&quot;&gt;10 Gigabit Ethernet over 100 m of copper cabling&lt;/a&gt;&#xA;If You really need to achieve this, socket category and proper grounding is important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/10_Gigabit_Ethernet#10GBASE-T&quot; rel=&quot;nofollow&quot;&gt;10GBASE-T, or IEEE 802.3an-2006 ... Category 6a is required to reach the full distance of 100 metres (330 ft) and category 6 may reach a distance of 55 metres (180 ft)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 1000BASE-T Cat5 is enough. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Sometimes Cat6 used to keep Cat5 compatibility with sloppy&#xA;installation.&lt;/li&gt;&#xA;&lt;li&gt;Wall socket much easier to replace when necessary, in compare to in-wall cabling.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It for what used higher that necessary now cables category.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="7539" LastEditDate="2016-06-29T14:37:26.837" LastActivityDate="2016-06-29T14:37:26.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32649" PostTypeId="1" AcceptedAnswerId="32651" CreationDate="2016-06-29T15:51:11.663" Score="1" ViewCount="346" Body="&lt;p&gt;We have an existing 10 G p2p link between our Datacenter ( DC) and Corporate Office ( HQ )with a service provider,  Lets call A &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When A did our install they have used a Cienna box on HQ side  , I  guess it is a fiber type converter ( SM to MM fiber ), so we ended up using  MM fiber with a 10G-SR transceiver to our 4500 swicth on HQ side .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the DC side we still ended up using MM fiber with 10G-SR module . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This circuit was up and running with out issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we are swicthing to a different Service provide . lets say B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B says that the hand off will be a SM type , and they are not providing with any Cienna box .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So should we have to use SM fiber with 10G-LR type transceiver to connect to our 4500 on HQ side and also SM fiber with 10G-R type connector on the DC side ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way we could reuse the existing MM fiber and 10G-SR modules ??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to understand how the Service providers run a p2p connection in this case  10G-ELAN , when there are differnt segments involved .  ( in this case .. they have multiple gateways between the circuit from HQ---- gateway1 -- gateway 2 -- DC) and what connector types and fiber types need to be used on each end of the segment .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help !!&lt;/p&gt;&#xA;" OwnerUserId="450" LastEditorUserId="8499" LastEditDate="2016-06-29T15:56:41.467" LastActivityDate="2016-07-09T04:23:29.210" Title="Fiber Type and transceiver model required" Tags="|fiber|isp|layer1|service-provider|transceiver|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32651" PostTypeId="2" ParentId="32649" CreationDate="2016-06-29T16:05:04.803" Score="4" Body="&lt;p&gt;You don't need to be concerned with how any ISP runs their network. All that matters to you is what they hand-off. ISP A gave you MM/10G-SR; ISP B is giving you SM/10G-LR. You will need new fiber drops &lt;em&gt;and&lt;/em&gt; new interface modules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While the existing MM fiber &lt;em&gt;might&lt;/em&gt; carry the new signal, passing SM over MM is problematic at the best of times -- and only works over a few meters. The SR modules you have absolutely will not work. They operate at 850nm, while LR operates at 1310nm.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-06-29T16:05:04.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32652" PostTypeId="2" ParentId="32602" CreationDate="2016-06-29T16:08:04.743" Score="0" Body="&lt;p&gt;About disadvantages.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Overlapped subnets is unnecessary clutter configuration, making some implications (different subnets communicate on L3 only and through router) wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: In logs on host PCA we see connection from IP 192.168.1.3. This IP belong to what subnet?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It same risk as place two non overlapped subnets in one L2 segment (broadcast segment). hosts really can communicate in L2 by using non IP protocol or by tweaking IP configuration (add static route to other subnet over interface).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-06-29T16:08:04.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32653" PostTypeId="1" CreationDate="2016-06-29T16:24:26.317" Score="2" ViewCount="17133" Body="&lt;p&gt;I have two internap NTP server and i set them up on Cisco Router but this is what i am getting. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ntp associations&#xA;&#xA;  address         ref clock       st   when   poll reach  delay  offset   disp&#xA;*~10.1.1.50       129.6.15.28      2      4     64   377  0.764 -26.612  1.962&#xA;+~10.1.1.51       129.6.15.28      2     10     64   377  0.766 -18.581  1.946&#xA; * sys.peer, # selected, + candidate, - outlyer, x falseticker, ~ configured&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Status:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ntp status&#xA;Clock is unsynchronized, stratum 3, reference is 10.1.1.50&#xA;nominal freq is 250.0000 Hz, actual freq is 250.0000 Hz, precision is 2**10&#xA;ntp uptime is 85000 (1/100 of seconds), resolution is 4000&#xA;reference time is DB1E7441.2B020CC0 (12:22:25.168 EDT Wed Jun 29 2016)&#xA;clock offset is -27.2765 msec, root delay is 78.64 msec&#xA;root dispersion is 37.11 msec, peer dispersion is 1.95 msec&#xA;loopfilter state is 'FREQ' (Drift being measured), drift is 0.000000000 s/s&#xA;system poll interval is 64, last update was 37 sec ago.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But its showing correct time, Why &lt;code&gt;show ntp status&lt;/code&gt; showing  &lt;code&gt;unsynchronized&lt;/code&gt; ??&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show clock&#xA;.12:23:41.217 EDT Wed Jun 29 2016&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;EDIT&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;ntp server vrf Mgmt-intf 10.1.1.50&#xA;ntp server vrf Mgmt-intf 10.1.1.51&#xA;!&#xA;clock timezone EST -5 0&#xA;clock summer-time EDT recurring&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have two ntp server &lt;code&gt;NTP1&lt;/code&gt; &amp;amp; &lt;code&gt;NTP2&lt;/code&gt; and NTP server syncing time with public NTP server, should i put two different public NTP server list on NTP1 &amp;amp; NTP2 server or public NTP list supposed to be same on both ntp1 and ntp2 server, what is the best practice for that?&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;UPDATE:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ntp associations detail&#xA;10.1.1.50 configured, ipv4, sane, valid, stratum 2&#xA;ref ID 199.102.46.79  , time DB1E94EB.26269DEA (14:41:47.149 EDT Wed Jun 29 2016)&#xA;our mode client, peer mode server, our poll intvl 512, peer poll intvl 512&#xA;root delay 29.98 msec, root disp 33.12, reach 377, sync dist 54.98&#xA;delay 0.14 msec, offset 27.2130 msec, dispersion 1.08, jitter 0.97 msec&#xA;precision 2**19, version 4&#xA;assoc id 37176, assoc name 10.5.3.60&#xA;assoc in packets 154, assoc out packets 155, assoc error packets 0&#xA;org time 00000000.00000000 (19:00:00.000 EST Thu Dec 31 1899)&#xA;rec time DB1E95F8.319EEF80 (14:46:16.193 EDT Wed Jun 29 2016)&#xA;xmt time DB1E95F8.319EEF80 (14:46:16.193 EDT Wed Jun 29 2016)&#xA;filtdelay =     0.84    0.84    0.85    0.14    0.15    0.84    0.84    0.79&#xA;filtoffset =   27.25   27.41   26.89   27.21   27.35   27.18   27.11   27.16&#xA;filterror =     0.97    1.00    1.03    1.06    1.09    1.12    1.15    1.18&#xA;minpoll = 6, maxpoll = 10&#xA;&#xA;10.1.1.51 configured, ipv4, our_master, sane, valid, stratum 2&#xA;ref ID 199.102.46.79  , time DB1E937E.A19C2C7C (14:35:42.631 EDT Wed Jun 29 2016)&#xA;our mode client, peer mode server, our poll intvl 512, peer poll intvl 512&#xA;root delay 29.86 msec, root disp 24.49, reach 377, sync dist 47.72&#xA;delay 0.16 msec, offset 9.3404 msec, dispersion 1.08, jitter 0.97 msec&#xA;precision 2**19, version 4&#xA;assoc id 37177, assoc name 10.5.3.61&#xA;assoc in packets 154, assoc out packets 154, assoc error packets 0&#xA;org time 00000000.00000000 (19:00:00.000 EST Thu Dec 31 1899)&#xA;rec time DB1E959A.2D3A68F6 (14:44:42.176 EDT Wed Jun 29 2016)&#xA;xmt time DB1E959A.2D3A68F6 (14:44:42.176 EDT Wed Jun 29 2016)&#xA;filtdelay =     0.83    0.80    0.84    0.16    0.84    0.17    0.83    0.78&#xA;filtoffset =    9.09    9.22    9.28    9.34    9.49    9.24    9.60    8.85&#xA;filterror =     0.97    1.00    1.03    1.06    1.09    1.12    1.15    1.18&#xA;minpoll = 6, maxpoll = 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2016-06-29T18:55:39.803" LastActivityDate="2016-06-29T18:55:39.803" Title="Cisco NTP Clock is unsynchronized" Tags="|cisco|switch|ntp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32654" PostTypeId="1" AcceptedAnswerId="34725" CreationDate="2016-06-29T17:50:58.683" Score="3" ViewCount="387" Body="&lt;p&gt;I have a two EX2200 switches that are connected to each other using OSPF routing. One switch is configured as a dhcp server and gives out IP addresses to devices on local interfaces. I set up DHCP relay using bootp on the other switch, but I can't get addresses distributed to devices connected to this switch. I can ping the two l3 switches one from the other so OSPF is working. I am fairly new to networking and I was wondering, in broad terms, what needs to be done to the ports/vlans/etc on the switch to get it to request DHCP from the other switch. No code please, I'd like to learn on my own.&lt;/p&gt;&#xA;" OwnerUserId="27412" LastActivityDate="2016-09-08T12:17:45.727" Title="DHCP Relay Juniper on two EX2200" Tags="|dhcp|juniper|juniper-junos|juniper-ex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32655" PostTypeId="2" ParentId="32653" CreationDate="2016-06-29T18:18:05.227" Score="1" Body="&lt;p&gt;According to Cisco, loss of synchronization occurs when the IOS device cannot trust the NTP server. It may be due to packet drops from network congestion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a document specific to NTP troubleshooting:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-time-protocol-ntp/116161-trouble-ntp-00.html&quot; rel=&quot;nofollow&quot;&gt;Network Time Protocol (NTP) Issues Troubleshooting and Debugging Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Loss of Synchronization&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Loss of synchronization might occur if the dispersion and/or delay&#xA;  value for a server goes very high. High values indicate that the&#xA;  packets are taking too long to get to the client from the server/peer&#xA;  in reference to the root of the clock. So, the local machine cannot&#xA;  trust the accuracy of the time present in the packet, because it does&#xA;  not know how long it took for the packet to get here.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;NTP is meticulous about time and will not synchronize with another&#xA;  device it cannot trust or cannot adjust in a way so that it can be&#xA;  trusted.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If there is a saturated link and buffering occurs along the way, the&#xA;  packets get delayed as they come to the NTP client. So, the timestamp&#xA;  contained in a subsequent NTP packet can occasionally vary a lot, and&#xA;  the local client cannot really adjust for that variance.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;NTP does not offer a method to turn off the validation of these&#xA;  packets unless you use SNTP (Simple Network Time Protocol). SNTP may&#xA;  not be much of an alternative because it is not widely supported in&#xA;  software.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If you experience loss of synchronization, you should check the links:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Are they saturated?&lt;/li&gt;&#xA;  &lt;li&gt;Are there any kinds of drops in your wide-area network (WAN) links&lt;/li&gt;&#xA;  &lt;li&gt;Is encryption occurring?&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Monitor the reach value from the &lt;strong&gt;show ntp associations detail&lt;/strong&gt;&#xA;  command. The highest value is 377. If the value is 0 or low, NTP&#xA;  packets are being received intermittently, and the local client goes&#xA;  out of sync with the server.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;debug ntp validity&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The &lt;strong&gt;debug ntp validity&lt;/strong&gt; command indicates whether the NTP packet&#xA;  failed sanity or validity checks and reveals the reason for the&#xA;  failure. Compare this output to the sanity tests specified in RFC1305&#xA;  that are used in order to test the NTP packet received from a server.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-06-29T18:18:05.227" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="32658" PostTypeId="2" ParentId="32514" CreationDate="2016-06-29T21:26:37.817" Score="0" Body="&lt;p&gt;Stacking makes for a single control plane and an outage of the entire stack during software upgrades.  Therefore, a single stack is not advisable.  For a ring topology, Dell has &lt;a href=&quot;http://www.dell.com/support/manuals/us/en/19/force10-s4048-on/S4048_ON_9.9.0.0_Config_Pub-v1/Force10-Resilient-Ring-Protocol-(FRRP)?guid=GUID-28D908FC-E158-403A-819A-6B8ADF0D7B0A&amp;amp;lang=en-us&quot; rel=&quot;nofollow&quot;&gt;Force10 Resilient Ring Protocol (FRRP)&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-06-29T21:26:37.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32660" PostTypeId="1" AcceptedAnswerId="32673" CreationDate="2016-06-29T21:58:59.600" Score="3" ViewCount="2349" Body="&lt;p&gt;I came accross this tutorial:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Topology:&#xA;&#xA;[Client PC] --- ge-0/0/0 [EX Switch] ge0/0/1 --- [DHCP Server]&#xA;&#xA;Client PC is in VLAN 10.&#xA;&#xA;The DHCP server is in VLAN 20 with the 20.20.20.2 IP address.&#xA;&#xA;The EX switch is configured as DHCP relay and performs inter VLAN routing between VLANs 10 and 20.&#xA;&#xA;Configuration:&#xA;set vlans vlan10 vlan-id 10&#xA;set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members vlan10&#xA;set vlans vlan10 l3-interface vlan.10&#xA;set interfaces vlan unit 10 family inet address 10.10.10.1/24&#xA;&#xA;set vlans vlan20 vlan-id 20&#xA;set interfaces ge-0/0/1 unit 0 family ethernet-switching vlan members vlan20&#xA;set interfaces vlan unit 20 family inet address 20.20.20.1/24&#xA;set vlans vlan20 l3-interface vlan.20&#xA;set forwarding-options helpers bootp server 20.20.20.2&#xA;set forwarding-options helpers bootp interface vlan.10&#xA;&#xA;Note: VLAN.10 Routed VLAN Interface (RVI) is configured for bootp relay, so that bootp packets in VLAN 10 will be routed to the '20.20.20.2' server in VLAN 20. Configure the specific RVIs, to which the bootp packets should be forwarded. A separate server can be configured under the 'bootp interface vlan.X' stanza for only that specific VLAN. A global server IP can also be specified (as above), which is applicable for all RVI interfaces.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have a similar setup, except that instead of two vlans on the same switch, I have two switches connected together using OSPF. In my code I am using the same setup, but I'm wondering, how many relays will I need. One at each switch, or just one on the switch without the dhcp server?&lt;/p&gt;&#xA;" OwnerUserId="27412" LastActivityDate="2016-06-30T08:15:43.253" Title="DHCP Relay for two L3 EX2200 Juniper (How many relays?)" Tags="|routing|vlan|juniper|juniper-ex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32662" PostTypeId="1" CreationDate="2016-06-30T03:06:54.867" Score="0" ViewCount="927" Body="&lt;p&gt;I am still new to networking, but I am in my senior project class to get my associates. We have to design and budget a network for 4 buildings. Two are in one city and two are in another city. I plan on giving multiple options ranging from a cheap plan to a high end plan. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The WAN link is 100 Mbps but can go up to 300 Mbps, depending on the cost. We have to use Cisco equipment and EIGRP. There are roughly 1500 users in this company but they have plans to expand. I need to have high redundancy and try to maintain low cost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I was thinking for a high end option, I could use a Cisco ASR 1001-X Router for my headquarters, where most of the users are, and then have 3 Cisco 4331 routers on the other 3 buildings. For switches, I would use the cisco meraki MS350-48 for all the client computers. But do I need a core/distribution switch at every building to move the  large amounts of data?&lt;/p&gt;&#xA;" OwnerUserId="27453" LastEditorUserId="27453" LastEditDate="2016-06-30T03:21:55.623" LastActivityDate="2016-06-30T08:03:49.817" Title="Senior Capstone project. Networking design" Tags="|cisco|" AnswerCount="1" CommentCount="4" ClosedDate="2017-08-14T18:37:10.647" ContentLicense="CC BY-SA 3.0" />
  <row Id="32663" PostTypeId="1" CreationDate="2016-06-30T05:26:03.053" Score="1" ViewCount="119" Body="&lt;p&gt;There are 3 buildings (IT system) that need to be links together but the distance between them are &lt;em&gt;very far apart&lt;/em&gt; (min between 230 - 470 km).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do one manage to provide connection between all of them? &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I mean more specifically, is there even a need to personally manage the connection between them or can the service provider handle the MPLS VPN connection?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Consequently, does the router/switch need to have some specific support like MPLS support to handle the MPLS VPN connection or does it need another specific support?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Installing &quot;P2P leased line&quot; in this case will be too expensive due to the limitation in budget (around $45000).&lt;/p&gt;&#xA;" OwnerUserId="27520" LastActivityDate="2016-06-30T09:28:06.313" Title="Does one need to personally manage MLPS VPN connection to have MPLS between building or can the ISP provide this connection for you?" Tags="|router|vpn|mpls|network-access|mpls-vpn|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32665" PostTypeId="1" AcceptedAnswerId="33233" CreationDate="2016-06-30T06:55:50.773" Score="2" ViewCount="1587" Body="&lt;h2&gt;Background and goal&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Am setting up high availability DNS servers based on Unbound. Both DNS servers has in reality twelve BGP sessions against different routers but to make this easier only one router is showed below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both DNS servers are configured with the same two addresses on localhost (&lt;code&gt;10.100.0.1&lt;/code&gt;, &lt;code&gt;10.100.0.2&lt;/code&gt;) and they both advertise these addresses with BGP. Problem is that if the DNS server that is preferred by other routers hangs, there is a timeout before BGP switches over to the second DNS server for both addresses. My goal is to have each DNS server have a primary responsibility for one of these two addresses so DNS clients do not have to wait for BGP timeout but instead handle failover as they know best. &lt;strong&gt;I do not want to add configurations to other routers, only on the DNS servers.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                    +------------+&#xA;                    |            |&#xA;                +---+  Router 1  +---+&#xA;                |   |            |   |&#xA;                |   +------------+   |&#xA;                |                    |&#xA;          +-----+----+          +----+-----+&#xA;          |          |          |          |&#xA;          |  DNS 1   |          |  DNS 2   |&#xA;          |          |          |          |&#xA;          +----------+          +----------+&#xA;&#xA;(primary) 10.100.0.1          10.100.0.1&#xA;          10.100.0.2          10.100.0.2 (primary)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Problem and question&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;In the configuration below, how can I make DNS 1 announce &lt;code&gt;10.100.0.1&lt;/code&gt; with a higher local preference so other routers choose this server instead of DNS 2 that is also announcing this IP but with lower priority?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 65002&#xA;    bgp router-id 10.0.0.1&#xA;    bgp confederation identifier 42xxx&#xA;    bgp confederation peers 65001 65002&#xA;&#xA;    network 10.100.0.1/32&#xA;    network 10.100.0.2/32&#xA;&#xA;    neighbor 10.0.0.10 remote-as 65001&#xA;    neighbor 10.0.0.10 route-map only-local-ASes out&#xA;!&#xA;ip as-path access-list only-local-ASes permit ^$&#xA;!&#xA;route-map only-local-ASes permit 10&#xA;match as-path only-local-ASes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Should I create a route-map that adds local preference 200 for only matched prefix 10.100.0.1? Problem am having is that this makes the router only announce 10.100.0.1 prefix and not both (also 10.100.0.2) at the same time with different preference.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Software&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Linux kernel 4.4.0&#xA;Ubuntu 16.04 server&#xA;Quagga 0.99.24.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27522" LastEditorUserId="8499" LastEditDate="2018-02-15T05:21:21.137" LastActivityDate="2018-02-15T05:21:21.137" Title="Preferred anycast paths for DNS with Quagga BGP" Tags="|bgp|dns|quagga|anycast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32666" PostTypeId="2" ParentId="32663" CreationDate="2016-06-30T07:36:10.780" Score="2" Body="&lt;p&gt;Unless you are going to lay your own cabling and connect the sites together, you will need to speak to a service provider to connect these two up. Usually the WAN connection will be managed by the provider with a guaranteed SLA which will be included in the service contract. Anything connected to the service provider equipment on the customer side, will be your responsibility to manage, but the actual link between the two sites will be the service provider's responsibility to maintain and manage and give you a satisfying service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The service provider will install their equipment on both sites which will support the protocol that they will  use. You will need to use a router that supports NAT and a firewall would also be advantageous for security reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router will enable you to route between the two sites and this will be your responsibility. Basically, they will provide you a path to the remote site and it will be up to you to setup the route path based on the IP range they give you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-30T07:36:10.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32667" PostTypeId="2" ParentId="32625" CreationDate="2016-06-30T07:36:41.710" Score="0" Body="&lt;p&gt;Native vlan mismmatch? &#xA;Are both sides set to trunking?&#xA;what are the allowed vlans on the link?&#xA;encapsulation set? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a few things that came to mind...Also ip routing could cause the issue depending on what your network environment setup is....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-06-30T07:36:41.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32668" PostTypeId="2" ParentId="24540" CreationDate="2016-06-30T07:53:22.473" Score="1" Body="&lt;p&gt;The PC is a host device on a single vlan, that means no need for tagging...Also remember when you have a workstation such as the one in this scenario, located in user vlan (lets say desktop vlan10) connected to one interface with no other vlans on the interface except for your desktop vlan you don't need tagging. It would be a simple access port, not trunked or tagged...PC network cards are not generally capable of deciphering VLAN tags or the other info you would see in a tagged vlan packet. You would use a trunk with tagging if you had multiple vlans running onto a network segment connected to that interface...However you do not, so no need.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="27523" LastEditDate="2017-09-27T13:06:18.313" LastActivityDate="2017-09-27T13:06:18.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32669" PostTypeId="2" ParentId="32639" CreationDate="2016-06-30T08:00:11.863" Score="1" Body="&lt;p&gt;I'd highly recommend using asdm if you are newer to cisco pix rules and ASA configuration. The process can be pretty simple....As mentioned make sure to create a NAT rule on the ASA to allow for the traffic, then nest this web server object in a group with very specific rules which will allow the desired traffic and not allow the undesired. There is also a feature built into asdm which will allow you to test the traffic flow once the rules are in place. It will go through the hops necessary and give you a go or no go =). High level summary but good luck, and if necessary holler and maybe I can be more specific.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="8499" LastEditDate="2016-06-30T13:26:23.617" LastActivityDate="2016-06-30T13:26:23.617" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32670" PostTypeId="2" ParentId="32662" CreationDate="2016-06-30T08:03:49.817" Score="1" Body="&lt;p&gt;You could go for a hub and spoke topology where you place your core router at your HQ, being your hub and then your remaining 3 buildings being satelites, will just require distribution switches that can also route back to your HQ building. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to look at how your data is going to flow. If your satelite buildings are going to access services in your HQ, you need to see what services they are going to be and how much data is going to transfer across the WAN link. This in turn will tell you if your 100/300Mbps link is going to be sufficient. If they are critical services, a redundent WAN link could be used as a backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your distribution switches could be stacked, turning 2+ switches into a single switch, while plugging trunk ports to each switch and creating aggregated links for redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to have a redundent gateways, you could make use of VRRP or Cisco's HSRP. Perhaps use MSTP to direct traffic based on VLAN's to specific VRRP instances, so that even numbered VLAN's flow to core router 1 and uneven VLAN's run to core router 2. Or perhaps even look at what is generating the most traffic and balance it out between two core routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are the satelite buildings going to host servers that are going to be used by the building? If so, make sure they are connected to distribution switches that will aggregate the connections and use stacked switches to provide connections to multiple stacked switches from the servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the servers are going to talk each other constantly, make sure that they are on the same subnet to avoid unnecessary routing and simply keep things as layer 2 where you can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use VLAN's and make sure you minimize your broadcast domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use redundent power supplies where you see fit, use UPS' for equipment providing critical services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best thing to do first before you start the design process is to analyse what the requirements of the users and services are going to be. Where are things going to be hosted and where can you expect bottlenecks and single point of failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you can look at what equipment you need. Look at how many packets per second the quipment can handle, whether it can have redundent management/fabric modules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;THere is alot more information requierd to help you more but this is what I can think of right now and I hope this gives you a bit of an idea.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-30T08:03:49.817" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32672" PostTypeId="2" ParentId="22627" CreationDate="2016-06-30T08:12:13.613" Score="1" Body="&lt;p&gt;The host will package the packet/frame with the MAC address of the router, based on the knowledge of whether the desired endpoint is on the same subnetwork (using is mask). If it is not on the subnet or network segment, it will then forward the packet/frame to the default gateway on the segment (router), which will first go through the connected switch. The switch knowing that the MAC address is not connected to the device on the incoming interface will then query the CAM table and forward the frame out of the necessary interface if MAC info is present for the desired gateway (router). If not, then the frame will be multicast out of all ports with an arp requesting the desired mac address until it receives a response from the DGW (router), which will then begin the process of establishing a link and the necessary communication. That's it in a nutshell. Hopefully, I didn't miss any important details.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="27523" LastEditDate="2019-01-16T16:12:29.613" LastActivityDate="2019-01-16T16:12:29.613" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="32673" PostTypeId="2" ParentId="32660" CreationDate="2016-06-30T08:15:43.253" Score="2" Body="&lt;p&gt;You will only need one for each VLAN. Basically where you configure the dhcp relay (IP helper) on your VLAN interface, the switch will forward the DHCP request to the IP helper you have provided. This will become unicast traffic and get routed to the DHCP server which should be the IP address you have set in &lt;strong&gt;set forwarding-options helpers bootp server 20.20.20.2&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If 20.20.20.2 is reachable, it won't matter how many hops it is away. Just make sure you have a route path going back. It won't work if the DHCP server can't reach the client that is requesting an IP address from the DHCP server and sometimes people forget that you need a route both directions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to summarize:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set DHCP relay configuration for each vlan that does not reside on the same subnet (even across internet) as the DHCP server. The configuration only needs to be set on the switch/router that is being used as the gateway. You do not need to set the configuration on edge switches or any switches that come after your gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-30T08:15:43.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32676" PostTypeId="1" CreationDate="2016-06-30T08:32:08.040" Score="1" ViewCount="923" Body="&lt;p&gt;I am very new to Cisco wireless.&#xA;The most important settings on Cisco WLCs 5508 were done by external engineer.&#xA;I have got an issue with wired guest network, my DHCP server (Cisco ASA Firewall) is not providing IP addresses to my guest clients connected over the cable,but wireless guests can get IP without any issue - wired and wireless guests are using the same scope on ASA.&#xA;Please note that when I assign a static IP to a wired guest client, everything is fine, I am prompted to authenticate and then sufr on the internet.&#xA;So I assume that tagging of the switch ports is alright.&#xA;On my switches there are two VLANS for guests (vlan 94 for wired guests ; vlan 98 for both of them guests)&#xA;On my WLC, I have got also two interfaces vlan 98 has got an IP address ; inteface with vlan identifier 94 does not have any IP, only &quot;Guest Lan&quot; option is checked.&#xA;In my WLAN section is profile for wired guests where ingress interface is vlan 94 and egress interface is vlan 98 - So I think that vlan 94 for wired guests is only for like layer 2 purpose and then its bridged to vlan 98 on the WLC - Am I right ?&#xA;In the attachment is debug log from Cisco WLC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://s000.tinyupload.com/?file_id=18306630635991333194&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://s000.tinyupload.com/?file_id=18306630635991333194&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;c8:5b:76:00:df:8d - is test client MAC.&#xA;Can somebody suggest me what I should do to make DHCP for wired guests working or what troubleshooting steps should I try ?&#xA;I can post some more detail if it will be necessary.&lt;a href=&quot;https://i.stack.imgur.com/3z4u4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3z4u4.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19851" LastActivityDate="2018-06-22T01:00:49.010" Title="Problem with DHCP for wired guest clients - Cisco WLC" Tags="|cisco|wireless|cisco-asa|dhcp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32678" PostTypeId="2" ParentId="32663" CreationDate="2016-06-30T09:28:06.313" Score="4" Body="&lt;p&gt;MPLS support is only rarely a requirement for enterprise equipment, especially relatively simple setups like the one you describe. MPLS itself is usually hidden away in the carrier networks. For your situation you basically you have two options :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you can ask a network carrier to provide a private VPN service, which will typically be MPLS based. In much of the world this includes the necessary router, so you can pretty much just plus your LAN into the routers at each site. This is probably what you had in mind with your &quot;P2P leased line&quot;.&lt;/li&gt;&#xA;&lt;li&gt;you can get Internet circuits from an ISP and build your own VPN on top of them. This is typically not MPLS but rather an IPSec VPN, which you can either have a service provider manage, or manage yourself by setting up VPN features on firewalls that you will implement at each site.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The main difference between the two is that MPLS services usually come with service level guarantees regarding availability and performance that you won't get with an ISP, but of course those guarantees come with a typically higher cost.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-06-30T09:28:06.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32682" PostTypeId="1" AcceptedAnswerId="32686" CreationDate="2016-06-30T12:06:17.703" Score="1" ViewCount="1461" Body="&lt;p&gt;Working in a QA department, I have a HP 1810-8G (J9802A) and I know it suits my requirements, since I'm actively using it.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;it supports a fully configurable mirroring port for network diagnosis (which is the most important point here)&lt;/li&gt;&#xA;&lt;li&gt;it supports 10/100/1000 MBit/s and setting a baud rate explicitly (important)&lt;/li&gt;&#xA;&lt;li&gt;it can be powered via PoE (less important)&lt;/li&gt;&#xA;&lt;li&gt;it has 8 ports (less important)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now my colleagues shall get similar switches for the reason of monitoring the traffic. Unfortunately, the number of vendors where we can buy is limited and the ones which are allowed by our company can only deliver the HP PS1810-8G (J9833A).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first sight, it looks very similar:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;can be powered via PoE&lt;/li&gt;&#xA;&lt;li&gt;it has 8 ports&lt;/li&gt;&#xA;&lt;li&gt;it supports 10/100/1000 MBit/s&lt;/li&gt;&#xA;&lt;li&gt;IMC – Intelligent Management Center, which could include the mirroring port&lt;/li&gt;&#xA;&lt;li&gt;similar price&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now my question is: is there a major difference between those two that I should know about? Or is the PS1810 simply the successor and I can use it without any issues?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(FYI: I'm new to this site. If someone would have a look at the tags and suggest an edit, maybe)&lt;/p&gt;&#xA;" OwnerUserId="4951" LastEditorUserId="8499" LastEditDate="2016-06-30T14:01:31.113" LastActivityDate="2016-06-30T14:03:32.027" Title="Difference between HP 1810-8G (J9802A) and HP PS1810-8G (J9833A)" Tags="|switch|hp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32684" PostTypeId="1" CreationDate="2016-06-30T12:39:11.270" Score="1" ViewCount="856" Body="&lt;p&gt;So when enabling object tracking on an AVF for an ISP uplink (for example), while running GLBP on another interface of the router, we specify a weight range and tell the AVF that if object loses its IP reachability, the weight is dropped below a certain limit and if that is below the lower limit specified,  that router can no longer be part of the GLBP process (or does it become an SVF?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not even sure if my question makes sense but, why is this range even required? Is there any other use of enabling this range? If the uplink goes down, why not just directly take the router out of the AVF role, what's the need for checking with a range? &lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2018-11-18T16:02:30.460" Title="Why does object tracking with GLBP need a weight range?" Tags="|router|load-balancing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32686" PostTypeId="2" ParentId="32682" CreationDate="2016-06-30T14:03:32.027" Score="2" Body="&lt;p&gt;No, this switch doesn't seem to be a successor. One thing that stands out is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;8-port Gigabit layer 2 smart-managed switch purpose built for HP Proliant Servers&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The 8-port model has an innovative design that allows it to be stacked on the HPE ProLiant MicroServer Gen8 platform.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This switch seems to be built to connect HP's proliant servers. The throughput is also far less than the standard 1810.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should perhaps looks at the HP 1820-8G which is the successor I believe. You should still be able to get that one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-06-30T14:03:32.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32688" PostTypeId="1" CreationDate="2016-06-30T15:38:45.937" Score="1" ViewCount="40312" Body="&lt;p&gt;I have created VLANs on the layer 3 switch and I would like to ping between them, how do i do so? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to allow VLAN 2 to ping VLAN 3, how? What command should I use? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;new#sh ip interf brief vlan 2&#xA;Interface              IP-Address      OK? Method Status                Protocol&#xA;Vlan2                  10.1.4.1        YES manual up                    up&#xA;&#xA;&#xA;new#sh ip interf brief vlan 3&#xA;Interface              IP-Address      OK? Method Status                Protocol&#xA;Vlan3                  10.1.2.1        YES manual up                    up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27334" LastEditorUserId="8499" LastEditDate="2018-12-21T05:19:39.770" LastActivityDate="2018-12-21T05:19:39.770" Title="How do you ping between VLANs?" Tags="|routing|switch|vlan|layer3|ping|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32690" PostTypeId="2" ParentId="32688" CreationDate="2016-06-30T16:09:14.773" Score="1" Body="&lt;p&gt;If your switch has L3 ability, you can issue the ip routing on the global config and then use the ping. Also the L3 communication between VLAN interfaces (as known as SVI on Cisco literature) starts to work. This test can be done either on the switch itself or by the hosts which are connected to their respective VLANs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use a extended ping command by using the source address from an SVI interface you've created towards the IP address of the another SVI on this switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once these interfaces are up, and you have setup the IP addresses on the hosts belonging to them, you are able to see the ARP table for each L3 interface (SVI). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="27540" LastActivityDate="2016-06-30T16:09:14.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32691" PostTypeId="1" CreationDate="2016-06-30T19:03:17.380" Score="0" ViewCount="130" Body="&lt;p&gt;Our one of static IP from Tata lease line is natted (i.e. configured in firewall) for our virtual server IP and we are using this IP globally as an RDP for ERP access. But currently we are not able to access this IP from the internet which we have recently taken in that location from the local internet service provider. Traceroute report shows that tatadc.co.in blocking this IP. &#xA;But from BSNL broadband we can access this IP. The local service provider has Airtel and Vodafone bandwidth. Can anybody explain the reason behind this.&lt;/p&gt;&#xA;" OwnerUserId="27544" LastEditorUserId="2142" LastEditDate="2016-07-04T20:44:40.547" LastActivityDate="2016-11-01T21:52:56.970" Title="Not able to access the static IP from local internet service provider's internet" Tags="|isp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32692" PostTypeId="1" CreationDate="2016-06-30T19:18:49.813" Score="0" ViewCount="1211" Body="&lt;p&gt;I have forgate 60c firewall i want to block fb and youtube in my network in some specific Ip Range , please informe me full process?  &lt;/p&gt;&#xA;" OwnerUserId="27545" LastActivityDate="2017-06-22T13:52:18.580" Title="I have forgate 60c firewall i want to block fb andyoutube in my network in some specific Ip Range , please informe me full process?" Tags="|fortigate|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32696" PostTypeId="1" AcceptedAnswerId="32703" CreationDate="2016-06-30T20:39:34.480" Score="1" ViewCount="11137" Body="&lt;p&gt;I have a long cable coming from my other room and I want to connect this cable to a raspberry pi and my laptop. I know I can just get a basic switch to solve this problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But is there such a thing as a Y cable for CAT5? I don't care if it reduces my speed to 10mbit or less. This Y cable would have to be female on one end and then output to 2 male cat5 cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can this work? If not, how come?&lt;/p&gt;&#xA;" OwnerUserId="27549" LastActivityDate="2017-05-23T19:36:28.230" Title="Split an existing CAT5 Cable into a Y cable without using a switch?" Tags="|cabling|cable|" AnswerCount="3" CommentCount="2" ClosedDate="2017-05-24T23:08:09.917" ContentLicense="CC BY-SA 3.0" />
  <row Id="32697" PostTypeId="1" AcceptedAnswerId="32741" CreationDate="2016-06-30T20:55:49.940" Score="2" ViewCount="1646" Body="&lt;p&gt;I have a stack of cisco 3750 switch (c3750-48ps) which has 4 switches total. Out of 4 one of the switch is showing fan faulty and temperature faulty. I checked the switch and found out that the speed of the fan of that switch is higher than the speed of the fan of the other switches. How can i trouble shoot this or fix this?&lt;/p&gt;&#xA;" OwnerUserId="25763" LastActivityDate="2016-07-01T14:50:26.030" Title="cisco switch fan deaulty temp defaulty" Tags="|cisco|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32699" PostTypeId="1" AcceptedAnswerId="32851" CreationDate="2016-06-30T21:45:24.363" Score="1" ViewCount="2216" Body="&lt;p&gt;We have Cisco ASR1000 Router and it has following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    flow record netflow-record&#xA;     match transport tcp destination-port&#xA;     match transport tcp source-port&#xA;     match transport udp destination-port&#xA;     match transport udp source-port&#xA;     match ipv4 destination address&#xA;     match ipv4 source address&#xA;     collect counter bytes&#xA;     collect counter packets&#xA;    !&#xA;    !&#xA;    flow exporter netflow-exporter&#xA;     description Netflow-Exporter&#xA;     destination xx.xx.xx.xx&#xA;     source TenGigabitEthernet0/0/0&#xA;     transport udp 9995&#xA;    !&#xA;    !&#xA;    flow monitor netflow-monitor&#xA;     exporter netflow-exporter&#xA;     cache timeout active 60&#xA;     record netflow-record&#xA;    !&#xA;    interface TenGigabitEthernet0/3/0&#xA;     description foo&#xA;     ip address 66.xx.xx.66 255.255.255.252&#xA;     no ip redirects&#xA;     no ip unreachables&#xA;     no ip proxy-arp&#xA;     ip flow monitor netflow-monitor input&#xA;    !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nfsen:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its running and i can see data in directory:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root@netflow 30]# ls -l /data/nfsen/profiles-data/live/r1/2016/06/30&#xA;total 168&#xA;-rw-r--r--. 1 netflow apache   276 Jun 30 15:40 nfcapd.201606301535&#xA;-rw-r--r--. 1 netflow apache   276 Jun 30 15:45 nfcapd.201606301540&#xA;-rw-r--r--. 1 netflow apache   276 Jun 30 15:50 nfcapd.201606301545&#xA;-rw-r--r--. 1 netflow apache   276 Jun 30 15:55 nfcapd.201606301550&#xA;-rw-r--r--. 1 netflow apache   276 Jun 30 16:00 nfcapd.201606301555&#xA;-rw-r--r--. 1 netflow apache   276 Jun 30 16:05 nfcapd.201606301600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when i open data i am seeing wrong date like &lt;code&gt;1969-12-31&lt;/code&gt; and port is &lt;code&gt;0&lt;/code&gt;, is it something related to cisco netflow setting? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[root@netflow 30]# nfdump -M /data/nfsen/profiles-data/live/r1  -T  -r nfcapd.201606301715 -a -c 10&#xA;Date first seen          Duration Proto      Src IP Addr:Port          Dst IP Addr:Port   Packets    Bytes Flows&#xA;1969-12-31 19:00:00.000     0.000     0    176.61.183.77:0     -&amp;gt;     xx.xx.xx.98:0           56     2688     1&#xA;1969-12-31 19:00:00.000     0.000     0    187.23.16.207:0     -&amp;gt;    xx.xx.xx.171:0           81     2349     1&#xA;1969-12-31 19:00:00.000     0.000     0    187.23.16.207:0     -&amp;gt;     xx.xx.xx.39:0            2       58     1&#xA;1969-12-31 19:00:00.000     0.000     0    187.23.16.207:0     -&amp;gt;    xx.xx.xx.239:0           81     2349     1&#xA;1969-12-31 19:00:00.000     0.000     0    169.228.66.91:0     -&amp;gt;     xx.xx.xx.62:0            1       40     1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;EDIT:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;also my cisco cache flow is empty how it's possible?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r1#show ip cache flow&#xA;IP packet size distribution (0 total packets):&#xA;   1-32   64   96  128  160  192  224  256  288  320  352  384  416  448  480&#xA;   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000&#xA;&#xA;    512  544  576 1024 1536 2048 2560 3072 3584 4096 4608&#xA;   .000 .000 .000 .000 .000 .000 .000 .000 .000 .000 .000&#xA;&#xA;IP Flow Switching Cache, 0 bytes&#xA;  0 active, 0 inactive, 0 added&#xA;  0 ager polls, 0 flow alloc failures&#xA;  Active flows timeout in 30 minutes&#xA;  Inactive flows timeout in 15 seconds&#xA;  last clearing of statistics never&#xA;Protocol         Total    Flows   Packets Bytes  Packets Active(Sec) Idle(Sec)&#xA;--------         Flows     /Sec     /Flow  /Pkt     /Sec     /Flow     /Flow&#xA;&#xA;SrcIf         SrcIPaddress    DstIf         DstIPaddress    Pr SrcP DstP  Pkts&#xA;&#xA;r1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2016-07-01T15:19:06.517" LastActivityDate="2016-08-04T22:38:01.953" Title="Cisco netflow with nfsen/nfdump" Tags="|cisco|router|netflow|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32702" PostTypeId="2" ParentId="30073" CreationDate="2016-06-30T23:05:25.947" Score="0" Body="&lt;p&gt;Longest Prefix Match relates to IP, or layer 3, forwarding.  There is no such thing as longest prefix match for MAC (layer2) addresses.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Control plane and data plane are unrelated concepts.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-06-30T23:05:25.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32703" PostTypeId="2" ParentId="32696" CreationDate="2016-06-30T23:22:06.653" Score="2" Body="&lt;p&gt;No, you can't do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike an audio or cable TV cable, UTP Ethernet has a transmit pair of wires and a receive pair. If you were to combine the transmit pair from two devices, the signals would interfere with each other and the receiver on the other end would be unable to decode the signals.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-07-01T00:54:52.557" LastActivityDate="2016-07-01T00:54:52.557" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32705" PostTypeId="2" ParentId="32665" CreationDate="2016-06-30T23:42:47.267" Score="1" Body="&lt;p&gt;What you have described is &lt;strong&gt;not&lt;/strong&gt; the way anycast works.  For anycast, you have all the DNS servers configured with the &lt;em&gt;same&lt;/em&gt; address (usually on the loopback interface), they then participate in the routing protocols and advertise that address from each DNS server.  Then the router hears the advertisement from each &lt;em&gt;running&lt;/em&gt; server (and, of course, not from any dead ones providing robustness) and is configured to do round-robin on equal cost routes.  Since DNS uses UDP (at least preferably) and is idempotent, this spreading out of the requests (and ultimately the load) does not impact the service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an additional fine tuning, you should have rules in the router for DNS over TCP where all packets in a connection need to go to the same server.  There are a number of ways to achieve this, one I have seen used is to have another server with that common address configured, but which does &lt;em&gt;not&lt;/em&gt; advertise it into the routing and you send all TCP to that one (so it ends up getting all AXFR requests, for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much more elaborate setups are also possible.  I've done some fairly complex ones...&lt;/p&gt;&#xA;" OwnerUserId="6388" LastActivityDate="2016-06-30T23:42:47.267" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32706" PostTypeId="2" ParentId="32626" CreationDate="2016-06-30T23:51:40.370" Score="2" Body="&lt;p&gt;ARP is a protocol (that's redundant, Address Resolution Protocol is, of course, a protocol) and the result of the protocol is to populate an ARP table in the devices.  So, the answer to your question of &quot;How to update arp table&quot; is to use the ARP protocol.  Any device that needs to speak IP on an Ethernet needs to participate in ARP.&lt;/p&gt;&#xA;" OwnerUserId="6388" LastActivityDate="2016-06-30T23:51:40.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32707" PostTypeId="1" CreationDate="2016-06-30T23:56:30.677" Score="0" ViewCount="997" Body="&lt;p&gt;I am very new to Cisco networking (haven't done any course either). I have been trying to learn a bit of networking myself and had no trouble in doing some of the basic stuff which i needed for my personal work. But i am planning to buy a new Cisco switch(a gigabit switch) and configure it to 2 different networks (1 being an internet and other being a private network for a specific job). I want to configure the ports in such a way that the first few slots for normal internet and the rest for my other network. For example if its a Cisco 2950 48 port switch, the first 1-16 port for my local internet network and the ports from 17-32 for my other network. Can somebody give me a run down on how to achieve this? Sorry for such a long but basic question, i am just trying to save few $$ and learning something new. Any help would be appreciated. Cheers&lt;/p&gt;&#xA;" OwnerUserId="27553" LastEditorUserId="27553" LastEditDate="2016-07-01T00:04:34.913" LastActivityDate="2021-01-27T12:41:36.483" Title="Configuring Ports on a Cisco Switch" Tags="|cisco|switch|cisco-ios|cisco-catalyst|cisco-commands|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32708" PostTypeId="2" ParentId="32707" CreationDate="2016-07-01T00:00:47.143" Score="2" Body="&lt;p&gt;First have some simulation windows (other OS) machine by using simulators such as Packet Tracer by Cisco or GNS3. Cisco Packet Tracer will give you a head start about Cisco Routers and Cisco Switches. Try to configure them. Look at boot sequence of these network devices.&lt;/p&gt;&#xA;" OwnerUserId="27552" LastActivityDate="2016-07-01T00:00:47.143" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32709" PostTypeId="2" ParentId="32639" CreationDate="2016-07-01T00:23:06.443" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/m1FLc.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m1FLc.jpg&quot; alt=&quot;This is a Visio of one of the environments I worked in about a year ago. Maybe it will give you some insight seeing it on paper, or help you cook up some ideas for a solution.&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simple Visio with multiple ASA firewalls and DMZ area with NAT and no NAT. Hope this helps, This is an actual production environment.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-07-01T00:23:06.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32710" PostTypeId="1" CreationDate="2016-07-01T00:54:29.143" Score="1" ViewCount="55" Body="&lt;p&gt;Could you tell me if my assumptions are correct and what happens in the last scenario?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say I am trying to ping an 192.168.x.x. address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If my local network is 192.168.x.x, then IPsec tunnels or not the packet will look locally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If my local network is 10.x.x.x, and my IPsec tunnel local network is 192.168.x.x, then the packet will go there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario 3: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If my local network is 10.x.x.x, and there are multiple IPsec tunnels to different networks, what does the behavior look like? Do tunnels have priority?&lt;/p&gt;&#xA;" OwnerUserId="27554" LastEditorUserId="8499" LastEditDate="2016-07-01T01:02:58.723" LastActivityDate="2016-07-01T05:05:19.113" Title="IPsec packet path with tunnels" Tags="|ipsec|tunnel|network-discovery|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32711" PostTypeId="2" ParentId="32684" CreationDate="2016-07-01T00:54:35.413" Score="0" Body="&lt;p&gt;The use of object tracking for a glbp group enables an engineer or administrator to set priority based upon weight, and priority. Highest priority amongst routers in a glbp group equals the Active virtual gateway...In addition, weight added to the config of the other members of a GLBP group determines which router will become the AVG instead of an AVG and become the primary. All routers share one vMAC for the group and one VIP in addition to also maintaining their hardware MAC. Each router also has its unique IP address in the GLBP group in addition to the VIP which is used for the entire group as an identifier at layer 3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess to answer your question, one reason we would want to use tracking is for autonomy, its much easier for our network to pick up after itself without a hitch versus manually logging into a device and changing priorities. Secondly, without tracking how would the group know if an interface or router was to go down....its similar to the concept of HSRP except GLBP allows four router to be part of a group versus HSRP which only allows two. Another function of weight or &quot;tracking&quot; is the ability to shape data traffic based on the weight assigned to routers in the group, IE R1 has a weight of 50 R2 has a weight of 30 so that means R1 in theory gets 50% of the traffic for the group and R2 would get 30%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some other features that help with traffic shaping and load balancing are round robin algorithms and source mac address. Also another important point to remember is the preempt command which is used in GLBP, as with other HA protocols, it is a good idea to stagger your timers on your routers in order to determine when a router will attempt to preempt and become AVG. I like to set one at 30 seconds preempt and the desired next AVG at 0 seconds for immediate failover or preemption. Depending on the weight and priority along with the order of the preempt command in a configuration it is possible to designate a desired router to become AVG based on the chosen values. Also as with many other protocols GLBP uses hello and hold down timers these can be configured on the interface when it is added to a GLBP group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a sample config I borrowed from a CCIE study guide. As you can see R2 is&#xA;currently the active virtual gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2.    +R1:&#xA;      +interface FastEthernet0/0&#xA;      +ip address 174.1.123.1 255.255.255.0&#xA;      +glbp 123 ip 174.1.123.254&#xA;      +glbp 123 preempt&#xA;      +glbp 123 weighting 50&#xA;      +glbp 123 load-balancing weighted&#xA;!&#xA;!&#xA;!&#xA;11. -R2:&#xA;      +interface FastEthernet0/0&#xA;      +ip address 174.1.123.2 255.255.255.0&#xA;      +glbp 123 ip 174.1.123.254&#xA;      +glbp 123 priority 50&#xA;      +glbp 123 preempt&#xA;      +glbp 123 weighting 30&#xA;!&#xA;!&#xA;!&#xA;23. +R3:&#xA;      +interface Ethernet0/0&#xA;      +ip address 174.1.123.3 255.255.255.0&#xA;      +glbp 123 ip 174.1.123.254&#xA;      +glbp 123 priority 25&#xA;      +glbp 123 preempt&#xA;      +glbp 123 weighting 20&#xA;*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lastly, &#xA;   To summarize.... GLBP is a virtual gateway protocol, with built-in load-balancing capabilities. Load balancing is based on manipulating ARP responses to the requests sent to the virtual gateway IP address. AVG role is used to load-balance and respond to ARP requests. AVF role manages one or more virtual MACs and is responsible for packet forwarding. AVG redundancy is controlled by GLBP priority and AVF redundancy is implemented using AVF weight value and two additional timers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="8499" LastEditDate="2016-07-01T01:22:30.630" LastActivityDate="2016-07-01T01:22:30.630" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="32712" PostTypeId="2" ParentId="32710" CreationDate="2016-07-01T00:59:55.817" Score="1" Body="&lt;p&gt;If an IP address to which you are sending traffic is on a different network, it will be switched or dropped by a router based on the router's routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router has a path to the destination network (a default route counts as the most general path, if you have one, but the router will take the most specific path it has), the router will switch the traffic to the router interface in the path toward the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a router doesn't have a path for the destination network, it will drop the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your question doesn't have enough information to specifically tell you what will happen in scenarios 2 and 3.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="20062" LastEditDate="2016-07-01T04:38:12.407" LastActivityDate="2016-07-01T04:38:12.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32713" PostTypeId="2" ParentId="32684" CreationDate="2016-07-01T01:27:19.617" Score="1" Body="&lt;p&gt;First, we need to understand that AVFs are always “active” in the sense that they are always used by a load-balancing algorithm. (However, by setting an AVG weight value below threshold, we may effectively take the AVF out of service. The weight value could be combined with object tracking to bring powerful traffic manipulation options). Next, with respect to redundancy, all AVFs backup each other. For instance, take any AVF: with respect to the other AVFs it is “Active”, and the remaining AVFs are in “Listen” state. If the AVF would fail, other gatewyas will detect the event using Hold timer expiration, and immediately try to take over the failed AVF virtual MAC address. Among the competitors, the AVF with highest weight value would win, and the remaining AVFs will switch back to “Listen” state. At this point, the “winner” will start accepting packets for two virtual MAC addresses: it’s own, and the one it has obtained from the failed AVF. At the same moment, two timers would start: Redirect and Secondary Hold. The Redirect timer determines how long will AVG continue to respond to ARP requests with the virtual MAC of the failed AVF. The Secondary Hold timer sets the amount of time the backup AVF will continue to accept packet for the virtual MAC address taken from the failed AVF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In essence yes we only have one AVG and one AVF designated at one time, I misunderstood your question. But yes I would agree to me it seems like a valid question. If I'm not mistaken a 3rd or 4th member of the group which had lower values assigned would still be 3rd in order and 4th in order in the event of an AVF failure. They are always &quot;active&quot; in a standby capacity also, preemption of a new AVF IS determined by the weight assigned in the configuration. Priority (AVG) weight+timers (AVF election).&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-07-01T01:27:19.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32714" PostTypeId="2" ParentId="32707" CreationDate="2016-07-01T01:48:53.193" Score="1" Body="&lt;p&gt;Packet tracer and GNS3 for simulation is a great idea to start....9tut along with the Cisco forums can also be a good source of helpful info if you are having issues grasping a concept. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can afford to do it I highly recommend building a home lab setup using a pre-fab home lab which you can purchase off of Ebay or the like. Usually you get a few 2821 routers and a couple of 3560 switches to go along with them, including all of the necessary add on cards. This will give you ability to run IOS 15 and get some hands on practice. The going rate is usually about 299 but sometimes you can find one on CL.com etc for less if someone is selling theirs on the cheap. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two biggest things, read the cert guides. Those things have some valuable info if you are just starting out. Secondly, practice...practice and more practice. In my opinion hands on practice is one of the best ways to become proficient with the material along with using the concepts in a functioning environment. CCNA was a tough go, but with effort most people of average intelligence can learn and master the material. The Cisco cert courses have been some of the most valuable sources of info around, I definitely feel like without them I would have never made the jump to admin level and ultimately engineer level positions.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-07-01T01:48:53.193" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32715" PostTypeId="2" ParentId="32688" CreationDate="2016-07-01T01:57:51.897" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;-enable &lt;/li&gt;&#xA;&lt;li&gt;-conf t&lt;/li&gt;&#xA;&lt;li&gt;Enable ip routing if it is available:&lt;/li&gt;&#xA;&lt;li&gt;IP routing (if layer 3 capability is present)&lt;/li&gt;&#xA;&lt;li&gt;end&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;based on your config....Running an extended ping with the destination address of the vlan you are trying to ping  10.1.2.1 or 10.1.4.1 should be successful after that.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-07-01T01:57:51.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32716" PostTypeId="2" ParentId="28634" CreationDate="2016-07-01T02:18:57.693" Score="0" Body="&lt;p&gt;The two concepts are similar in many ways however they differ in a few important details. Vlans will have an IP address associated with them and will also be part of a subnet/IP addressing scheme. IP Subnets communicate at layer 3 through IP datagrams or packets whereas Vlans communicate through trunk links and frames and make use of tagging. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not necessary for members of a VLAN to all share the same IP subnet address and in many cases multiple IP subnets will be part of one Vlan.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-07-01T02:18:57.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32717" PostTypeId="2" ParentId="32691" CreationDate="2016-07-01T02:31:25.757" Score="1" Body="&lt;p&gt;Check the circuit info again to verify everything along with your BGP configuration....Also is this a new issue or did the interface pass traffic until recently and then just cease functioning?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To me this sounds like a routing issue, I agree with Ron. This would explain why it works from one ISP and not another. If it is not configured correctly for this particular ISP most likely a BGP issue the static IP is not going to be reachable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One other consideration is proper rule implementation at the FW..if I understand this right there was a different ISP or something along those lines...or this was a new acquisition, in that case you may need to validate your FW rules to make sure they are ideal to accomodate this new site.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-07-01T02:31:25.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32718" PostTypeId="2" ParentId="32676" CreationDate="2016-07-01T03:13:47.130" Score="1" Body="&lt;p&gt;For starters, you need to split the scopes and other pertinent data at the ASA and at the organizational level. I was reading your description and it sounds like you are going to need to split the scopes, isolate the traffic and IP scope from wired or VLAN 94 to stay on 94, wireless guest traffic should be separated and placed on  Vlan 98 along with making any necessary changes to switch configuration and ASA rules/configuration to reflect the separation of traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as your statement regarding tagging at the switch ports, it will function properly however if you are tagging and running trunks make sure your Native Vlan settings along with allowed Vlans are configured properly on both sides of the link. In situations where I've taken possession of a network environment and the previous engineers weren't strong in certain areas I have seen something as simple as improperly configured trunk links cause an interface to not pass traffic properly.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-07-01T03:13:47.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32719" PostTypeId="2" ParentId="32710" CreationDate="2016-07-01T05:05:19.113" Score="0" Body="&lt;p&gt;With the limited information offered on your environment...Ive seen something similar at one of my previous positions. We had IPsec tunnels setup in a hub and spoke format coming from all of the companies airports with the traffic travelling into the data center first and then travelling into the interior of our network. That is a simple summary...ASR&gt;ASA&gt;5K&gt;checkpoint firewalls for HQ&gt;Cisco 3850 campus switches stack of 8. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That was ours primarily although we had two data centers and all traffic in a hub and spoke setup IPSEC tunnel setup funnels through the data Cisco ASR routers&gt;Core switches&gt;ASA&gt;Checkpoint firewalls&gt;campus level switches etc etc atleast that was our design when I was employed with the airlines =).&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-07-01T05:05:19.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32721" PostTypeId="2" ParentId="32696" CreationDate="2016-07-01T06:37:25.437" Score="1" Body="&lt;p&gt;Cat5 is normally 4-Pair: Each Ethernet conection requires only 2 pair. You can easily run 2 2-pair Ethernet connections through1 4-pair Cat5! It works fine. But if you split an existing CAT5 Cable into a Y cable, then the result is that you're unable to connect to your network and can't get on the Internet.If you really want to do it, get a switch or fix the wireless settings.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-07-01T06:37:25.437" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32722" PostTypeId="1" CreationDate="2016-07-01T06:49:06.670" Score="4" ViewCount="1065" Body="&lt;p&gt;Why lasers for single mode? It’s not about the brightness, for you can get some seriously powerful LEDs. And it’s not about the size of the core, we have lenses for that. So Why is laser light used in single mode step index optical fiber?&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-07-01T07:39:26.543" Title="Why is laser light used in single-mode step index optical fiber?" Tags="|fiber|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32723" PostTypeId="2" ParentId="32722" CreationDate="2016-07-01T06:59:17.813" Score="1" Body="&lt;p&gt;It's known that signal loss is a common problem face optical fibers, which is caused by many reasons, like distance, connectors, bends, etc.&#xA;As for multi-mode fibers used for not long distance transmission, LED light sources can be freed. But for single-mode fibers, which are used for significantly long distance transmission, a laser is required for bright light.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-07-01T06:59:17.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32725" PostTypeId="2" ParentId="32722" CreationDate="2016-07-01T07:39:26.543" Score="3" Body="&lt;p&gt;It doesn't matter whether the fibre is step index or graded index if we want to discuss broadly about sources required in fibre transmission. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need a laser or light source with enough amplified emission to produce coherent light. Because Fiber isn’t perfect, it loses signal with distance, plus more for connectors, bends, etc. If you want to send your signal a long distance, you’re going to want a pretty bright light.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use LED as light source, your light will get attenuated at smaller distances in fibre. A source which has good directionality and a proper choice would be LASERs.&lt;/p&gt;&#xA;" OwnerUserId="24835" LastActivityDate="2016-07-01T07:39:26.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32726" PostTypeId="1" CreationDate="2016-07-01T07:50:45.020" Score="2" ViewCount="1581" Body="&lt;p&gt;We have an ELK Stack running that gathers data and processes it to the point where end users can visualize the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now we're dealing with Syslogs and Netflow, but are experiencing some issues with netflow. We currently have netflow version 5 configured to be sent to a remote server on udp port 2222 and it works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you might know version 5 is quite old and doesn't offer as much as version 9 so we decided to configure our device to send over netflow v9. Nothing comes in!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be causing this? Version 5 works fine, but we can not receive version 9 netflow.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      family inet {&#xA;          output {&#xA;              flow-server **.**.**.** {&#xA;                  port 2222;&#xA;                  version9 {&#xA;                      template {&#xA;                          ELK;&#xA;                      }&#xA;                  }&#xA;              }&#xA;&#xA;&#xA;&#xA;services {&#xA;  flow-monitoring {&#xA;      version9 {&#xA;          template ELK {&#xA;              ipv4-template;&#xA;          }&#xA;      }&#xA;  }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;" OwnerUserId="27559" LastActivityDate="2021-01-31T22:48:02.260" Title="Not receiving netflow v9, v5 works - Juniper SRX" Tags="|juniper|netflow|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32732" PostTypeId="1" AcceptedAnswerId="32827" CreationDate="2016-07-01T08:32:06.173" Score="0" ViewCount="75" Body="&lt;p&gt;Sorry for a dump question. I am able to ping printer in my company with following shell:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping print226&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt; How does router solve this since it doesn't have domain name? Will it work for whole &lt;code&gt;VPN&lt;/code&gt; or just it applies to my &lt;code&gt;physical network&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="23174" LastActivityDate="2016-07-05T11:18:22.590" Title="Ping printer in VPN" Tags="|ipv4|vpn|ping|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32733" PostTypeId="2" ParentId="32707" CreationDate="2016-07-01T09:05:05.757" Score="2" Body="&lt;p&gt;This is pretty straight forward to do, especially starting with a default configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wish to create two networks, you will need to use &lt;strong&gt;VLAN's&lt;/strong&gt;. These will allow you to segment your network into logical sections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have created those two VLAN's, you need configure the ports that will reside on those VLAN's. Your VLAN that will connect to the Internet will connect to a port that connects to your ISP router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To create a VLAN&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)#vlan 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To name the VLAN&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config-vlan)#name &quot;Private Network&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note: VLAN 1 always exists by default and can't be removed. So now you have VLAN 1 and VLAN 2 created&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To assign the ports to the VLAN you can do something like this and also use the range command to apply this to multiple ports. This selects ports 1-16.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)#interface range FastEthernet 0/1-16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then configure those ports to use a specific VLAN in access mode&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config-if-range)#switchport access vlan 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is alot more to do but this hopefully gives you a high level run down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-07-01T09:05:05.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32734" PostTypeId="2" ParentId="12821" CreationDate="2016-07-01T13:45:13.143" Score="2" Body="&lt;p&gt;Yes. If they are under /16 Subnet. For /24 subnet, you need router.&lt;/p&gt;&#xA;" OwnerUserId="27552" LastActivityDate="2016-07-01T13:45:13.143" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32735" PostTypeId="1" CreationDate="2016-07-01T13:49:54.853" Score="5" ViewCount="642" Body="&lt;p&gt;First post, so I apologize if I don't lay things out clearly, or if this is the wrong forum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are a small/regional ISP. We have a customer who has a couple of /24s (not purchased through us), and they would like us to announce these /24s to our upstream providers. However, they do not want to BGP peer with us (cost-savings, configuration, etc...). We've received an LOA from them, giving us permission for this, and we've passed it along upstream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are happy to do this, but the problem is the advertisement is getting blocked further upstream. The larger transit providers appear to be querying the radb for their prefix lists, which is a problem as the radb has the /24s under the customer AS. So, if we try to advertise the /24s with our AS, they are getting dropped by these larger providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are curious as to what other ISPs are doing in situations like this? Do you ask the customer to SWIP the /24 over to the ISP AS? Does the ISP turn up a BGP instance with the customer AS in order to spoof it (seems non-kosher)? Or something else entirely?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We don't have the IP space available to give them a /24, and the customer does not want any type of BGP relationship.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate any response.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Josh&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="27565" LastActivityDate="2020-08-18T02:00:26.923" Title="Advertise downstream customer-owned /24 without BGP-Peering" Tags="|bgp|isp|peering|arin|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32737" PostTypeId="1" AcceptedAnswerId="32740" CreationDate="2016-07-01T13:59:10.527" Score="15" ViewCount="43044" Body="&lt;p&gt;Currently studying for a CCNA Security, I have been taught to never use the native VLAN for security purposes. &lt;a href=&quot;https://supportforums.cisco.com/discussion/10814051/native-vlans-securing-8021q-trunks&quot; rel=&quot;noreferrer&quot;&gt;This old discussion&lt;/a&gt; from Cisco forum states it very clearly:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You should never use the default VLAN either because VLAN hopping is&#xA;  much more easily accomplished from the default VLAN.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, from a practical point-of-view, I am not able to precisely pin-point what actual threat is being addressed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thoughts are the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The attacker being located on the native VLAN, maybe he can directly inject 802.1q packets which will be forwarded without modification by the first switch (as coming from a native VLAN) and upcoming switches will consider these packets as legitimate packets coming from any VLAN chosen by the attacker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would have indeed made VLAN hopping attacks &lt;em&gt;&quot;much more easy&quot;&lt;/em&gt;. However, this does not work since the first switch rightly considers it as abnormal to receive 802.1q packets on an access port and therefore drops such packets.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;An attacker being located on a non-native VLAN manages to turn a switch access port into a trunk one. To send traffic to the native VLAN he will just have to change his IP address (a single command) instead of enabling VLAN on his network interface (four commands), saving three commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I obviously consider this at most as a very marginal gain...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When digging in the history, I thought I read somewhere old recommendations stating that 802.1q injection could require a compatible network card and specific drivers. Such requirements would indeed limit attacker's ability to inject 802.1q packets and make native VLAN exploitation much more practical in the previous scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However this does not seem to be a real limitation nowadays and VLAN configuration commands are a common part of Linux (at least) network configuration commands.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Could we consider this advice of not using the native VLANs to be outdated and kept only for historical and configuration sanity purposes, even-though this practice does not address any particular threat anymore? Or is there a concrete scenario where VLAN hopping indeed becomes much more easy because of the native VLAN being used?&lt;/p&gt;&#xA;" OwnerUserId="27387" LastEditorUserId="453" LastEditDate="2018-05-11T03:11:39.583" LastActivityDate="2024-01-20T17:08:24.030" Title="Why should the native VLAN never be used?" Tags="|vlan|security|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="32738" PostTypeId="2" ParentId="32735" CreationDate="2016-07-01T14:14:40.973" Score="-1" Body="&lt;p&gt;Technically you could simply use AS-Path prepending, als described for example &lt;a href=&quot;http://blog.ipspace.net/2008/02/bgp-essentials-as-path-prepending.html?m=1&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. This allows you to prepend the customers AS without the need to fire up another BGP instance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The moral part of the question is to be answered by you. Except for transferring the prefix I do not see another method other than inserting the customers AS in any way.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-07-01T14:14:40.973" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="32740" PostTypeId="2" ParentId="32737" CreationDate="2016-07-01T14:41:28.620" Score="16" Body="&lt;p&gt;You can and most likely will need to use a native VLAN on your trunk ports, at least on Cisco switches, other vendors do it differently. But what you have to remember that the security risk is more to do with VLAN 1 (default VLAN) being set as a native VLAN.&lt;/p&gt;&#xA;&lt;p&gt;You should change the native VLAN from being VLAN 1 to a new VLAN that you create. The native VLAN is used for a lot of management data such as DTP, VTP and CDP frames and also BPDU’s for spanning tree.&lt;/p&gt;&#xA;&lt;p&gt;When you get a brand new switch, VLAN 1 is the only VLAN that exists, this also means that all ports are members of this VLAN by default.&lt;/p&gt;&#xA;&lt;p&gt;If you are using VLAN 1 as your native VLAN, you have all the ports that you haven't configured to be part of this VLAN. So if an attacker connects to a port that is not used and not configured (because it's not used), he has straight away access to your management VLAN and can read and inject packets that could allow VLAN hopping or capture packets you don't want him/her to see, or worse, SSH into your switches/routers (never allow telnet).&lt;/p&gt;&#xA;&lt;p&gt;The advice is always to not use VLAN 1, so if an attacker or unwanted client connects and ends up on VLAN 1 and there is nothing configured on this VLAN, such as a useable gateway, they are pretty much stuck and can't go anywhere, while you native VLAN is something like VLAN 900 which is less likely to have any port access as it isn't the default VLAN.&lt;/p&gt;&#xA;&lt;p&gt;Alot of engineers do not disable unused ports and using VLAN 1 for important stuff leaves you in a situation where the access is open unless you use something like 802.1x. Engineers/Network admins forget and you have a little security hole that can benefit an attacker. If your VLAN 1 is not used and ports are left as default, it's not such a big deal because it is not used.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="-1" LastEditDate="2024-01-20T17:08:24.030" LastActivityDate="2024-01-20T17:08:24.030" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="32741" PostTypeId="2" ParentId="32697" CreationDate="2016-07-01T14:50:26.030" Score="3" Body="&lt;p&gt;Use the &lt;em&gt;environment&lt;/em&gt; command as a starting point:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;show env all&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The first part of the output should be similar to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FAN 1 is OK&#xA;FAN 2 is OK&#xA;FAN PS-1 is OK&#xA;FAN PS-2 is OK&#xA;SYSTEM TEMPERATURE is OK&#xA;System Temperature Value: 29 Degree Celsius&#xA;System Temperature State: GREEN&#xA;Yellow Threshold : 46 Degree Celsius&#xA;Red Threshold    : 60 Degree Celsius&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this example both chassis fans and both power supply fans are reporting all's normal.  The system temp is good and I have 17 degrees to go before I reach &lt;em&gt;temp warning.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If one fan is hosed it is very likely that system temp increased and the remaining variable-speed fan has picked up the pace to keep the switch cool.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-07-01T14:50:26.030" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32742" PostTypeId="1" AcceptedAnswerId="32748" CreationDate="2016-07-01T16:56:12.407" Score="1" ViewCount="391" Body="&lt;p&gt;Here is what my router is reporting. I set the variance to 100 just to see what is going on. This is using classic configuration and the RD for the two alternate links is 537600. If I multiply the FS (537600 with 2 -variance 2- that should be more than enough for the other two paths to satify the FC and to take part in unequal load balancing) As you can see in the outputs is not happening Why?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4#sh ip eigrp topology all-links | se 10.20.12.0&#xA;P 10.20.12.0/24, 1 successors, FD is 537600, serno 50&#xA;        via 10.20.14.1 (537600/25600), Serial2/2&#xA;        via 10.20.46.6 (1049600/537600), Serial2/3&#xA;        via 10.20.34.3 (1049600/537600), Serial2/1&#xA;&#xA;R4#sh ip route 10.20.12.0&#xA;Routing entry for 10.20.12.0/24&#xA;  Known via &quot;eigrp 100&quot;, distance 90, metric 537600, type internal&#xA;  Redistributing via eigrp 100&#xA;  Last update from 10.20.14.1 on Serial2/2, 00:04:07 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 10.20.14.1, from 10.20.14.1, 00:04:07 ago, via Serial2/2&#xA;      Route metric is 537600, traffic share count is 1&#xA;      Total delay is 21000 microseconds, minimum bandwidth is 1544 Kbit&#xA;      Reliability 255/255, minimum MTU 1500 bytes&#xA;      Loading 1/255, Hops 1&#xA;R4#sh run | s eigrp&#xA;router eigrp 100&#xA; metric weights 0 0 0 1 0 0&#xA; variance 120&#xA; network 10.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1647" LastEditorUserId="8499" LastEditDate="2018-12-25T01:37:15.027" LastActivityDate="2021-06-07T14:49:31.570" Title="Apparently variance is not working for EIGRP ..what am I missing?" Tags="|cisco|routing|cisco-commands|eigrp|load-balancing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32743" PostTypeId="1" AcceptedAnswerId="32747" CreationDate="2016-07-01T17:24:19.963" Score="2" ViewCount="95" Body="&lt;p&gt;I want to block flash in our network. It can of cause be done through group policies on a host level but this will not affect flash installations that are included in products that aren't centrally managed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution most mentioned is to block flash by the content type &lt;code&gt;application/x-shockwave-flash&lt;/code&gt; but this will only work with HTTP traffic as Im not allowed to intercept SSL traffic. Is there a way to block flash without intercepting SSL?&lt;/p&gt;&#xA;" OwnerUserId="1667" LastActivityDate="2016-07-01T18:40:09.493" Title="Is it possible to block flash at the firewall without SSL interception?" Tags="|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32744" PostTypeId="1" CreationDate="2016-07-01T17:35:04.897" Score="0" ViewCount="1178" Body="&lt;p&gt;I have a lift motor that has an app that allows me to move the lift up and down.  The lift creates its on Wi-Fi network with a default gateway of 192.168.4.1&#xA;My existing network is 192.168.1.1, I have a nano station that is not being used and was hoping there was a way to bridge these two networks.&#xA;I have very limited access to change any settings in the router that is made into the lift motor.&#xA;If this is possible it would be great if the nano station could receive a wireless signal from the .1 network and wirelessly send to the .4 network.  If needed I can hardwire the nano station to the .1 network.&#xA;I would prefer not to change my network from .1 to .4, I've contacted the manufacturer of the lift about changing the subnet and they are not being very helpful.&lt;/p&gt;&#xA;" OwnerUserId="27572" LastActivityDate="2018-08-23T19:02:05.870" Title="Connect to wireless network on different subnet" Tags="|wireless|bridge|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32747" PostTypeId="2" ParentId="32743" CreationDate="2016-07-01T18:40:09.493" Score="4" Body="&lt;p&gt;In a word: &lt;em&gt;NO&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you aren't decoding the SSL stream, you have no idea what's in it.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-07-01T18:40:09.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32748" PostTypeId="2" ParentId="32742" CreationDate="2016-07-01T18:59:55.200" Score="1" Body="&lt;p&gt;The &lt;code&gt;variance&lt;/code&gt; command doesn't change the feasibility condition; it changes the minimum metric allowed. Any paths must still meet the feasibility condition before they are considered for balancing with the &lt;code&gt;variance&lt;/code&gt; command. Your reported distance through &lt;code&gt;Serial2/2&lt;/code&gt; is &lt;code&gt;25600&lt;/code&gt;, and only one of your paths meets the feasibility condition. The metrics for paths through &lt;code&gt;Serial2/3&lt;/code&gt; and &lt;code&gt;Serial2/1&lt;/code&gt; are greater than the FD, so they are not feasible successors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, a path must have a feasible successor in order for EIGRP to consider sending traffic over that path. See the portion I have highlighted in the document below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/enhanced-interior-gateway-routing-protocol-eigrp/13677-19.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;How Does Unequal Cost Path Load Balancing (Variance) Work in IGRP and EIGRP?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Network Diagram&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/L6Wvz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L6Wvz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Variance&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;This section provides an example. In the network diagram, there are&#xA;  three ways to get to Network X:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;E-B-A with a metric of 30&lt;/li&gt;&#xA;  &lt;li&gt;E-C-A with a metric of 20&lt;/li&gt;&#xA;  &lt;li&gt;E-D-A with a metric of 45&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Router E chooses the path E-C-A with a metric of 20 because 20 is&#xA;  better than 30 and 45. In order to instruct EIGRP to select the path&#xA;  E-B-A as well, configure variance with a multiplier of 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router eigrp 1&#xA;network x.x.x.x&#xA;variance 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;This configuration increases the minimum metric to 40 (2 * 20 = 40).&#xA;  EIGRP includes all routes that have a metric of less than or equal to&#xA;  40 and satisfy the feasibility condition. In the configuration in this&#xA;  section, EIGRP now uses two paths to get to Network X, E-C-A and&#xA;  E-B-A, because both paths have a metric of under 40. EIGRP does not&#xA;  use path E-D-A because that path has a metric of 45, which is not less&#xA;  than the value of the minimum metric of 40, because of the variance&#xA;  configuration. &lt;strong&gt;&lt;em&gt;Also, the reported distance of neighbor D is 25,&#xA;  which is greater than the feasible distance (FD) of 20 through C. This&#xA;  means that, even if variance is set to 3, the E-D-A path is not&#xA;  selected for load balancing because Router D is not a feasible&#xA;  successor.&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; For more information on variance, refer to &lt;a href=&quot;https://supportforums.cisco.com/docs/DOC-23674&quot; rel=&quot;nofollow noreferrer&quot;&gt;Troubleshooting EIGRP Variance Command&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-01T19:09:50.700" LastActivityDate="2016-07-01T19:09:50.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32749" PostTypeId="2" ParentId="32744" CreationDate="2016-07-01T19:26:07.180" Score="0" Body="&lt;p&gt;Use the Nanostation in Router mode. Connect it to the Lift's WLAN, set the Nanostation's WAN network to use DHCP; the address it gets here is irrelevant. Make sure you enable NAT; since you can't tell the Lift router to reach your 192.168.1.x network through the Nanostation, you need the Nanostation to NAT so the Lift just thinks it's talking to the Nanostation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wire your Nanostation into the .1 network, set its LAN interface to a static address in your .1.x network. On your .1 network's router, create a static route: 192.168.4.1 reachable via [nanostation LAN address]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then your router will take you to the .4 network!&lt;/p&gt;&#xA;" OwnerUserId="27575" LastActivityDate="2016-07-01T19:26:07.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32752" PostTypeId="2" ParentId="19534" CreationDate="2016-07-01T21:34:18.640" Score="3" Body="&lt;p&gt;This is a matter of fairness between 40MHz and 20MHz devices. Assuming transmitter splits power equally between the primary and secondary 20MHz channels, then a 20MHz device will only hear half of the transmitter's power output. This means under equal circumstances, the 40MHz transmitter will have to be closer to the 20MHz receiver than a 20MHz transmitter to cause the same level of interference. &lt;/p&gt;&#xA;" OwnerUserId="27581" LastActivityDate="2016-07-01T21:34:18.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32753" PostTypeId="1" AcceptedAnswerId="32754" CreationDate="2016-07-02T00:59:09.210" Score="1" ViewCount="3417" Body="&lt;p&gt;I have picked up a ZyWall USG 100 and I want to disable the DHCP server on this device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't do this from the Web Console and I can't find the CLI command to accomplish this either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is possible to disable the DHCP server on this device??&lt;/p&gt;&#xA;" OwnerUserId="27583" LastActivityDate="2016-07-02T02:35:23.540" Title="Zywall USG 100 Disable DHCP" Tags="|dhcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32754" PostTypeId="2" ParentId="32753" CreationDate="2016-07-02T01:25:39.863" Score="1" Body="&lt;p&gt;You do this per interface, and you &lt;em&gt;can&lt;/em&gt; disable it in the Web Console. It is an interface service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration -&gt; Network -&gt; Interface to get to the Ethernet Summary Screen. Select an interface, click on the Edit icon. Go to the DHCP Setting section and change it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the &lt;a href=&quot;ftp://ftp.zyxel.com/ZYWALL_USG_100/user_guide/ZYWALL%20USG%20100_2.20.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;ZyWALL USG 100/200 Series User's Guide&lt;/a&gt;, starting on page 296.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K5kPH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K5kPH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-02T01:56:49.277" LastActivityDate="2016-07-02T01:56:49.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32756" PostTypeId="2" ParentId="17749" CreationDate="2016-07-02T03:24:21.060" Score="0" Body="&lt;p&gt;As others ave already indicated to some extent, when you choose to use an access port with a single VLAN and configure it with vlan 24 native vlan. Technically it somewhat of a misnomer to use the term access port, I still use thee term also but it is easier for me to think of it as a native access link. Similar to what occurs with vlan 1 if we were to use it in a production  environment and it was the only VLAN in town, switchports wouldnt tag the frames and the data would be sent to VLAN 1 for handling and the traffic would be untagged. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont know for sure but it makes sense to me logically that when they came up with the concept it made it easier to have the default native vlan (#1) not tag its trafficfor simplification of communication. The true story, I will probably never know. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sending over a link to a site which explains the concept rather thoroughly, it is a site I found a few years ago and it generally has some good info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://rednectar.net/2012/03/11/the-access-vlan-is-dead-long-live-the-native-vlan/&quot; rel=&quot;nofollow&quot;&gt;https://rednectar.net/2012/03/11/the-access-vlan-is-dead-long-live-the-native-vlan/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enjoy!&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-07-02T03:24:21.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32757" PostTypeId="1" CreationDate="2016-07-02T11:39:56.457" Score="0" ViewCount="232" Body="&lt;p&gt;I have a PC with 192.168.1.10. Which must read data from a PLC device with 192.168.1.20. But they are not directly connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PC is connected to a 100.100.100.x LAN network which is connected to 100.100.101.x LAN network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have three routers to make this work. 2 edge router lite and one hirschman firewall router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I can route 192.168.1.x &gt; 100.100.100.x &gt;100.100.101.x &gt;192.168.2.x  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But If I change my 192.168.2.x to 192.168.1.x , I can't  ping the second 192.168.1.x network &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have used a PC to act as a PLC at second 192.168.1.x end &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm doing wrong here? Is it even possible to do this? &lt;/p&gt;&#xA;" OwnerUserId="27588" LastActivityDate="2016-07-02T13:22:01.860" Title="Static route to same network, pls help!" Tags="|routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32758" PostTypeId="2" ParentId="1871" CreationDate="2016-07-02T11:46:51.700" Score="0" Body="&lt;p&gt;There is no direct way to determine the slave's MAC of port1 as both HA cluster member units share identical virtual MACs for each port.&lt;br&gt;&#xA;Disconnecting (or disabling) a port has a 50% chance of triggering a cluster failover, with subsequently dropping some traffic.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To minimize network interruption I'd disable port monitoring for port1 temporarily, in the HA config setup. Then pull one port1 line and observe which switch port signals a link down. This way, traffic will only be dropped for the duration of this action and not for the (longer) period of one or possibly two HA cluster failovers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A different approach would be to observe how much traffic flows across each switch port. The slave's wan port will not carry much traffic so the traffic rate on both switchports should be different by a large extent. &lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-07-02T11:46:51.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32759" PostTypeId="2" ParentId="32757" CreationDate="2016-07-02T13:22:01.860" Score="3" Body="&lt;p&gt;You can't have the same IP range within another portion of your network unless you use Network Address Translation (NAT) to mask the addresses of both sides.  This is a less than ideal solution however.  Within your sphere of administrative control, at all costs keep addressing unique.  That way you don't have to use NAT except at your internet edge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could potentially solve this with a VPN between the endpoints as well.  Basically, I could solutioneer workarounds all day long, but the bottom line is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Without some other mechanism, and relying solely on routing, how would the routers in the middle (or the hosts on either end really) know WHICH 192.168.1.0/24 you were wanting to reach.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2016-07-02T13:22:01.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32761" PostTypeId="1" CreationDate="2016-07-02T14:15:01.743" Score="2" ViewCount="350" Body="&lt;p&gt;we want to provide mobiles and laptops in site B with internet connection using long range antenna, but it is not permitted to put any communication devices (ex. AP) there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- is there any suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- can mobiles and laptops communicate directly with long range antenna (distance ~1 KM)?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/AoP1Z.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AoP1Z.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27590" LastActivityDate="2016-07-02T15:02:06.700" Title="long range antenna" Tags="|wireless|mobile|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32762" PostTypeId="2" ParentId="32761" CreationDate="2016-07-02T14:41:52.220" Score="4" Body="&lt;p&gt;Short answer:  This is not going to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending where you live, there are regulations that specify the transmitter power and antenna type (gain).  This varies with the frequency band you are using (2.4GHz vs 5 GHz).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that WiFi is two-way communication.  Not only does your AP have to have a strong enough signal for your clients to hear it, but your clients also have to have a strong enough signal for the AP to hear them. Even if you have sufficient power and proper antenna for the access point, your mobile clients will almost certainly not.  Laptops and phones simply do not have enough power and high gain antennas to make this work.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-02T14:41:52.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32763" PostTypeId="2" ParentId="32761" CreationDate="2016-07-02T14:56:05.420" Score="3" Body="&lt;p&gt;While it &lt;strong&gt;can&lt;/strong&gt; work using highly directional antennas (which increase both transmission and reception at the AP for devices in the correct spatial region relative to the antenna, compensating for the limited antenna and output of the mobile device while staying in legal limits for EIRP) your &quot;illustration&quot; would appear to show a situation where it's &lt;strong&gt;unlikely to work.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For success, an essentially radio dead coverage area is best, because the antenna gain of a directional antenna also picks up any noise source or competing wi-fi in the coverage area. So it works fairly well for coverage in a literal open field environment, not at all in an urban environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even in a radio-dead coverage area, putting the end use devices inside a building tends to negatively impact coverage in a big way. They are already hampered by a weak signal and a small antenna - adding another layer of interference and signal loss around them tends to make this unviable. Point to point links exterior to the buildings leading to APs in the buildings is the only reliable method - you might find some spots in the remote building where you get coverage, but you can't begin to expect coverage of a whole building.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two APs with sector antennas in normal use serving outside open field areas with reliable operation at ~0.5 Km ranges, and someone I know has a setup with mountain-top sector APs where he's had to turn down to keep them from getting 2+ Km connections - normal use is about 1 Km, but to devices that are not in buildings. These are the exact opposite of urban installs - there is basically nothing there in the WiFi bands except our APs and the end-use devices.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2016-07-02T15:02:06.700" LastActivityDate="2016-07-02T15:02:06.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32768" PostTypeId="2" ParentId="32726" CreationDate="2016-07-02T21:08:45.333" Score="5" Body="&lt;p&gt;You've got two out of the three necessary sections listed, and they look OK. There's a third section needed &quot;forwarding-options&quot; that tells the Juniper whether and how to sample packets to generate flow (something you didn't need for v5). You're also going to need to tell the Juniper which interfaces to monitor flow on. The command to monitor ingress packets will look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces ge-0/0/14 unit 0 family inet sampling input&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I wrote a blog post a while back that goes through setting up NetFlow v9 (technically, J-Flow) on Juniper SRX &lt;a href=&quot;http://www.flowtraq.com/corporate/uncategorized/configuring-j-flow-export-juniper-srx-series-routers/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;, which I think you'll find useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One other thing to mention: I've seen issues in the past where routers won't actually send flow records to multiple sources. If the v5 stream is still active, I'd try turning that off to see if the v9 picks up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Edited to add: it's also always worth spending time checking firewalls and connectivity before doing any kind of serious heavy lifting. You've probably already done that, but it never hurts to bring that up...)&lt;/p&gt;&#xA;" OwnerUserId="82" LastActivityDate="2016-07-02T21:08:45.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32769" PostTypeId="1" AcceptedAnswerId="32771" CreationDate="2016-07-02T21:48:03.220" Score="0" ViewCount="2378" Body="&lt;p&gt;I'm running pfSense 2.2.6-RELEASE and have configured two DynDNS providers: no-ip.biz and nsupdate.info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(I added the latter since no-ip.biz started nagging that I need to log in every 30 days and confirm my account – I'm planning to move to nsupdate.info altogether on the long run.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Dynamic DNS status page, no-ip.biz (for which pfSense has a preset) shows me the current WAN IP in green, indicating everything is OK. The entry for nsupdate.info (Service type: Custom) shows 0.0.0.0 (in red) as the IP address, indicating registration failed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I look up the name in DNS, both come back with the correct IP, indicating both registrations worked – it's just the status info for nsupdate.info that claims something went wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Settings for nsupdate.info are as provided by nsupdate.info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disable: not checked&#xA;Service type: Custom&#xA;Interface to monitor: WAN&#xA;Interface to send update from: WAN&#xA;Verbose logging: not checked&#xA;CURL options: none checked&#xA;Username: (DNS name to update)&#xA;Password: (host secret)&#xA;Update URL: https://ipv4.nsupdate.info/nic/update&#xA;Result Match: good|nochg&#xA;Description: nsupdate.info&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For comparison, these are the settings for No-IP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Disable: not checked&#xA;Service type: No-IP&#xA;Interface to monitor: WAN&#xA;Hostname: (DNS name to update)&#xA;MX: (blank)&#xA;Wildcards: not checked&#xA;Verbose logging: not checked&#xA;Username: (my username)&#xA;Password: (my password)&#xA;Description: (blank)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I do notice that for the Custom provider there is no hostname field, and the Hostname column on the DynDNS status page is blank for the nsupdate.info entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How dows pfSense determine if an update was successful? And why is the successful nsupdate.info registration reported as failed?&lt;/p&gt;&#xA;" OwnerUserId="27598" LastActivityDate="2016-07-02T22:34:49.050" Title="pfSense Web UI not showing Dynamic DNS IP address" Tags="|dns|pfsense|pfsense-2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32770" PostTypeId="1" CreationDate="2016-07-02T21:52:43.190" Score="1" ViewCount="4291" Body="&lt;p&gt;What does an SSL VPN protect you from vs an IPSec VPN and what are the pros and cons to each?&lt;/p&gt;&#xA;" OwnerUserId="27517" LastEditorUserId="8499" LastEditDate="2018-02-16T04:20:35.707" LastActivityDate="2018-02-16T04:20:35.707" Title="SSL VPN vs IPSec, pros and cons" Tags="|vpn|ipsec|sslvpn|" AnswerCount="1" CommentCount="0" ClosedDate="2019-01-18T23:35:03.847" ContentLicense="CC BY-SA 3.0" />
  <row Id="32771" PostTypeId="2" ParentId="32769" CreationDate="2016-07-02T22:34:49.050" Score="0" Body="&lt;p&gt;It turns out I had several issues with my setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The primary error was that the correct &lt;strong&gt;Result Match&lt;/strong&gt; expression is not &lt;code&gt;good|nochg&lt;/code&gt; but &lt;code&gt;good %IP%|nochg %IP%&lt;/code&gt;. The configuration info shown by nsupdate.info is wrong. According to &lt;a href=&quot;https://github.com/nsupdate-info/nsupdate.info/issues/207&quot; rel=&quot;nofollow&quot;&gt;nsupdate.info issue #207&lt;/a&gt;, this has already been fixed in the code, but apparently it hasn't made it to the live service yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For custom DynDNS services, the server's response to the update request is compared to the &lt;strong&gt;Result Match&lt;/strong&gt; expression. pfSense will report success on a match, failure on a mismatch. No DNS lookup is done for verification, potentially leading to false positives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, after I'd registered the new host, I had kept the browser tab with the config data open. Turns out that every time the browser is restarted and the page reloaded, a new secret is generated and pfSense is locked out of the unlock API until the secret is updated in its config. That explained the authentication issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, it seems my public IP has remained stable across two disconnects – I have my pfSense reconnect once every night, but after two days, I still have the same IP. This has masked my update problems, as the address never changed.&lt;/p&gt;&#xA;" OwnerUserId="27598" LastActivityDate="2016-07-02T22:34:49.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32772" PostTypeId="1" AcceptedAnswerId="32773" CreationDate="2016-07-03T02:07:18.593" Score="1" ViewCount="497" Body="&lt;p&gt;I'm trying to let computer from Internet to get access to the external DMZ(Server Mail and Server FTP) so I translated the address of the internet network like :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static 172.16.1.4 209.165.201.1 &#xA;ip nat inside source static 172.16.1.3 209.165.201.2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it doesn't work, i always got :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reply from 200.14.5.1: Destination host unreachable.&#xA;Reply from 200.14.5.1: Destination host unreachable.&#xA;Reply from 200.14.5.1: Destination host unreachable.&#xA;Reply from 200.14.5.1: Destination host unreachable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping statistics for 209.165.201.1:&#xA;    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),&lt;/p&gt;&#xA;" OwnerUserId="27527" LastEditorUserId="8499" LastEditDate="2018-12-25T01:46:22.517" LastActivityDate="2018-12-25T01:46:22.517" Title="Static NAT doesn't work" Tags="|cisco|routing|nat|cisco-commands|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32773" PostTypeId="2" ParentId="32772" CreationDate="2016-07-03T02:19:36.667" Score="1" Body="&lt;p&gt;Your outside interface will block anything destined for your server addresses. The ACL on that interface only specifically allows traffic to hosts &lt;code&gt;199.14.5.1&lt;/code&gt;, &lt;code&gt;199.14.5.10&lt;/code&gt;, and &lt;code&gt;199.14.5.11&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember, an ACL will have an implicit &lt;code&gt;deny all&lt;/code&gt; at the end, so you are denying all other inbound traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-03T02:19:36.667" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32774" PostTypeId="2" ParentId="32772" CreationDate="2016-07-03T02:42:36.997" Score="0" Body="&lt;p&gt;You need to put in a permit any on your standard list and if you need more granular information then use an extended list four specific ports.&lt;/p&gt;&#xA;" OwnerUserId="27515" LastActivityDate="2016-07-03T02:42:36.997" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32775" PostTypeId="1" AcceptedAnswerId="32780" CreationDate="2016-07-03T03:58:56.237" Score="1" ViewCount="116" Body="&lt;p&gt;Assuming 'Network A' is having 2 ISPs which are directly connected to 'Network B', which path will be used to connect to 'Network B'?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network A --&gt; IP Transit A / IP Transit B --&gt; Network B&lt;/p&gt;&#xA;" OwnerUserId="24366" LastActivityDate="2016-07-03T06:46:08.680" Title="Best path in BGP Routing" Tags="|routing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32776" PostTypeId="2" ParentId="30015" CreationDate="2016-07-03T04:35:31.200" Score="0" Body="&lt;p&gt;Actually, the only way to block traffic in cisco ASA is to use the defence center with the SFR module in my case. What i did is:&#xA;1. Downloaded the latest defence center (firepower management center) from the cisco website.&#xA;2.since i am using 5515-x ASA so my ASA would not support ASDM itself to provide the function of DC. &#xA;3. I used my server to host the DC and linked that DC with the SFR module in the ASA. &#xA;4. Now, i can use the DC to block/allow whatever traffic i want. But having said that, i use manual url blocking which can still be achieved without buying the url filtering license. &lt;/p&gt;&#xA;" OwnerUserId="23114" LastActivityDate="2016-07-03T04:35:31.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32777" PostTypeId="1" AcceptedAnswerId="37236" CreationDate="2016-07-03T05:55:41.090" Score="0" ViewCount="21280" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Yy0pJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Yy0pJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;I have fortinet fortigate 40c. It is not a bundle product. We use it to unblock 300 of our websites and rest are all blocked by default. Now, we want to unblock skype. The problem is just specifying skype.com to unblok doesn't help it opening the application. So what options do i have. &#xA;I have  specified skype to open in application server as well  but yet it doesn't work.&lt;a href=&quot;https://i.stack.imgur.com/Eag2x.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Eag2x.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/48lKk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/48lKk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8vXaE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8vXaE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="23114" LastEditDate="2016-07-03T06:57:09.743" LastActivityDate="2018-11-06T15:00:40.773" Title="Unblocking of skype in Fortigate" Tags="|fortigate|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32778" PostTypeId="2" ParentId="32777" CreationDate="2016-07-03T06:09:14.357" Score="1" Body="&lt;p&gt;You need to create an application filter and apply it to your LAN-&gt;WAN IPv4 policy. This is different to a wildcard web filter that you have created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently your default application filter (or your custom one) may be set to block Skype. You can also set up an application filter override, to allow Skype explicitly.&lt;/p&gt;&#xA;" OwnerUserId="27602" LastActivityDate="2016-07-03T06:09:14.357" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32780" PostTypeId="2" ParentId="32775" CreationDate="2016-07-03T06:46:08.680" Score="3" Body="&lt;p&gt;BGP has a long list of checks to determine which path is &quot;best&quot;. The algorithm goes through the list from top to bottom, and stops as soon as a difference is found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find a good description of this list at &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/13753-25.html&quot; rel=&quot;nofollow&quot;&gt;Cisco&lt;/a&gt; and &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos15.1x49-d40/topics/reference/general/routing-ptotocols-address-representation.html&quot; rel=&quot;nofollow&quot;&gt;Juniper&lt;/a&gt; (and probably on many more locations and books), including advise on how to manipulate the path selection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, the tie breakers (in order) will probably be:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Prefer the path with higher local preference. &lt;/li&gt;&#xA;&lt;li&gt;Prefer the path with the shortest autonomous system (AS) path&#xA;value.&lt;/li&gt;&#xA;&lt;li&gt;Prefer the path that was received first (the oldest one). &lt;/li&gt;&#xA;&lt;li&gt;Prefer the path that comes from the BGP router with the lowest&#xA;router ID.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-07-03T06:46:08.680" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32782" PostTypeId="2" ParentId="32777" CreationDate="2016-07-03T10:34:47.730" Score="1" Body="&lt;p&gt;It might well be that it's not the AC blocking Skype but the WF.&lt;br&gt;&#xA;1- Do you have a valid UTM licence? If not, WF will block.&lt;br&gt;&#xA;2- Enable logging on that policy.&lt;br&gt;&#xA;3- Make sure it's the first policy from top down so that it gets hit by traffic.&lt;br&gt;&#xA;4- Disable WF. Disable AC. If Skype now is connecting, enable AC. If that is working, enable WF. If not, check the AC blocking rules, especially the 10 blocking entries.  &lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-07-03T10:34:47.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32783" PostTypeId="1" CreationDate="2016-07-03T10:40:30.023" Score="3" ViewCount="1417" Body="&lt;p&gt;I am experimenting a bit to gain a better understanding of Mininet and Openflow. I have built a topology with n hosts in a line and no switches. Strangely, host 1 and host 2 can ping each other but the remaining hosts can't.&#xA;Could somebody explain why this is and possibly if it is possible to get all nodes to be able to ping their neighbors without introducing switches into the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my current code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python&#xA;from mininet.net import Mininet&#xA;from utils.FloodlightController import FloodlightController&#xA;from mininet.log import setLogLevel&#xA;import os,time&#xA;&#xA;if __name__ == '__main__':&#xA;    #setLogLevel( 'info' )&#xA;    net = Mininet(controller=FloodlightController)&#xA;    #net.addController(&quot;controller1&quot;)&#xA;&#xA;    num_nodes = 8&#xA;    for i in range(1,num_nodes):&#xA;        net.addHost(&quot;h%d&quot;%i)&#xA;    for i in range(2,num_nodes):&#xA;        net.addLink(&quot;h%d&quot;%i, &quot;h%d&quot;%(i-1))&#xA;&#xA;    net.start()&#xA;    net.pingAll()&#xA;    net.stop()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*** Ping: testing ping reachability&#xA;h1 -&amp;gt; h2 X X X X X &#xA;h2 -&amp;gt; h1 X X X X X &#xA;h3 -&amp;gt; X X X X X X &#xA;h4 -&amp;gt; X X X X X X &#xA;h5 -&amp;gt; X X X X X X &#xA;h6 -&amp;gt; X X X X X X &#xA;h7 -&amp;gt; X X X X X X &#xA;*** Results: 95% dropped (2/42 received)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27606" LastEditorUserId="36720" LastEditDate="2019-04-20T18:12:21.610" LastActivityDate="2019-04-20T18:12:21.610" Title="Problem with an n-host, zero-switch topology in mininet" Tags="|sdn|openflow|mininet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="32784" PostTypeId="2" ParentId="32770" CreationDate="2016-07-03T11:02:37.533" Score="1" Body="&lt;p&gt;&lt;strong&gt;Pro IPsec VPN&lt;/strong&gt;:  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;you can create site-to-site VPNs, allowing multiple hosts to access&#xA;a remote network at the same time&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;in this scenario, hosts don't need any additional software to&#xA;participate in the VPN, allowing for arbitrary operating systems as&#xA;long as they are able to network&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;supports client-to-network as well, using a client software&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;encrypted traffic between VPN gateways cannot (at this time) be&lt;br&gt;&#xA;decrypted by third party, without the receiving end noticing&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Contra IPsec VPN&lt;/strong&gt;:&lt;br&gt;&#xA; 5. requires dedicated hardware in each participating network, usually embedded in a router or gateway firewall.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Pro SSLVPN&lt;/strong&gt;:  &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;6&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;uses a standard protocol (HTTPS) which is very rarely blocked in&#xA;public spaces (hotels, free Wifi etc.); IPsec needs ESP, AH&#xA;protocols, or standard UDP on uncommon high ports (500, 4500).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;for limited, predefined access to remote applications, a user only&#xA;needs a browser and no additional software client. This requires on&#xA;the SSLVPN gateway a proxy for each application offered.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Contra SSLVPN&lt;/strong&gt;:  &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;8&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;to support arbitrary applications, hosts need to use a software&#xA;client for SSLVPN tunnel mode&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;hosts can only be part of the VPN if there is a browser or a VPN&#xA;client software available for their OS (figure: printers,&#xA;measurement probes,...)   encryption places an additional CPU load&#xA;on the host (vs. on the VPN gateway for IPsec)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;can be decrypted when intercepted, scanned and re-encrypted (although this will trigger a certificate warning at the client's end).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-07-03T11:02:37.533" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32786" PostTypeId="1" CreationDate="2016-07-03T11:40:53.363" Score="1" ViewCount="108" Body="&lt;p&gt;I am tapping some 10Gb ethernet links at some remote sites (normal passive fibre taps) for some QoS/QoE monitoring.  I don't have any dark fibre options at these sites to send the traffic back to a central monitoring site and I don't want to deploy the monitoring tools remotely.  The amount of actual traffic to send back for analysis is not huge, perhaps 2 or 3 Gb peak.  I can provide a simple Ethernet service to the site but this service does not have the option to disable MAC learning (so that all traffic on ingress would be broadcast).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any solution that doesn't cost a fortune?  (GRE tunnels could work for example but require relatively expensive routers at each end).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there was something that modified the Ethernet frame (replaced with another destination MAC address for example) that would be fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas welcome!&lt;/p&gt;&#xA;" OwnerUserId="27563" LastActivityDate="2016-07-03T11:40:53.363" Title="How to encapsulate tapped traffic to forward over L2/L3 network?" Tags="|ethernet|layer2|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32790" PostTypeId="1" AcceptedAnswerId="32794" CreationDate="2016-07-03T20:13:19.600" Score="0" ViewCount="225" Body="&lt;p&gt;why my external DMZ can always connect to Internet then i want not the DMZ has access to Internet and sub network(Informatique and Administration). What's wrong in my config.&lt;/p&gt;&#xA;" OwnerUserId="27527" LastEditorUserId="27527" LastEditDate="2016-07-04T01:45:38.660" LastActivityDate="2016-07-04T01:45:38.660" Title="Block DMZ to get Access to Internet and LAN" Tags="|nat|acl|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32794" PostTypeId="2" ParentId="32790" CreationDate="2016-07-04T01:30:20.487" Score="1" Body="&lt;p&gt;I'm going to try again, now that I think I understand your requirements better.&lt;br&gt;&#xA;I think you want to allow inbound connections to the DMZ, but deny outbound connections from the DMZ&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended Deny-Outbound&#xA;permit tcp any any established&#xA;permit icmp any any echo-reply&#xA;&#xA;interface fa 0/0&#xA;ip access-group Deny-Outbound in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If this isn't what you want, please help me understand better.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-04T01:30:20.487" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32795" PostTypeId="2" ParentId="32744" CreationDate="2016-07-04T01:33:07.133" Score="1" Body="&lt;p&gt;Thank you for your answer.  I have done the following.&lt;BR&gt;&#xA;Network Tab&lt;br&gt;&#xA;...........&lt;b&gt;Network Role&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Network Mode = Router&lt;/li&gt;&#xA;&lt;li&gt;Configuration Mode = Advanced&lt;br&gt;&#xA;...&lt;b&gt;WAN Network Settings&lt;/b&gt;&lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;WAN Interface = WLAN0&lt;/li&gt;&#xA;&lt;li&gt;WAN IP Address = DHCP&lt;/li&gt;&#xA;&lt;li&gt;NAT = Enable&lt;br&gt;&#xA;...&lt;b&gt;LAN Network Settings&lt;/b&gt;&lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;LAN Interface = LAN0&lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;IP Address = 192.168.1.20&lt;/li&gt;&#xA;&lt;li&gt;Netmask = 255.255.255.0&lt;/li&gt;&#xA;&lt;li&gt;DHCP Server = Disabled&lt;br&gt;&#xA;&lt;b&gt;Edge Router POE Static Route&lt;/b&gt;&#xA;Destination = 192.168.4.0/24&lt;br&gt;&#xA;Next Hop = 192.168.1.20&lt;br&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Not sure if I've completed everything correctly, but the .4 network is secured and I dont know where i can enter the settings to connect the nano station to this network.&#xA;Thanks for your help.&lt;/p&gt;&#xA;" OwnerUserId="27572" LastActivityDate="2016-07-04T01:33:07.133" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32796" PostTypeId="1" CreationDate="2016-07-04T02:34:34.427" Score="0" ViewCount="492" Body="&lt;p&gt;I wish to a add a couple config lines to all the routers and switches in the network. Instead of longing into each device, can we do this at once using any script or tool? Please note that we require an user name and an RSA(a time varying password) token to login into any of these devices.&lt;/p&gt;&#xA;" OwnerUserId="25857" LastActivityDate="2016-09-12T22:23:18.860" Title="How to push same configuration lines on to all the routers and switches using any script/tool?" Tags="|cisco|switch|router|lan|" AnswerCount="2" CommentCount="3" ClosedDate="2019-02-25T00:13:50.690" ContentLicense="CC BY-SA 3.0" />
  <row Id="32797" PostTypeId="2" ParentId="29115" CreationDate="2016-07-04T03:07:58.557" Score="0" Body="&lt;p&gt;If your on Linux you can use minicom&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo apt-get install mincom&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will also need to add your self to the dialout group&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo adduser $USER dialout&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Start minicom as superuser to save config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo minicom -s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For me these options worked:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In minicom:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; A - Serial device: /dev/ttyS0&#xA; E - Bps/Par/Bits: 115200 8N1&#xA; F - Hardware Flow Control : No&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Save setup as dfl. Exit then press enter a few time to get it going. Thats it!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More info here: &lt;a href=&quot;https://help.ubuntu.com/community/SerialConsoleHowto&quot; rel=&quot;nofollow&quot;&gt;https://help.ubuntu.com/community/SerialConsoleHowto&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27617" LastActivityDate="2016-07-04T03:07:58.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32798" PostTypeId="2" ParentId="32796" CreationDate="2016-07-04T04:39:26.763" Score="1" Body="&lt;p&gt;I don't know if this will help, but when I want to add similar lines to various devices, I connect to each device on various tabs in SecureCRT and then at the bottom there's a window that provides a &quot;chat to all tabs&quot; capability. I use that. &lt;/p&gt;&#xA;" OwnerUserId="20062" LastActivityDate="2016-07-04T04:39:26.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32799" PostTypeId="1" AcceptedAnswerId="32826" CreationDate="2016-07-04T09:46:59.653" Score="7" ViewCount="49430" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JQtS2.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JQtS2.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refer to the picture above. I would like to add the word &quot;FREE&quot; for my SSID. How do I do that? I've seen this ssid around my area but I don't know how to implement it on my router.&lt;/p&gt;&#xA;" OwnerUserId="27618" LastActivityDate="2020-11-22T16:00:56.287" Title="How to put special characters on ssid" Tags="|wireless|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32801" PostTypeId="1" AcceptedAnswerId="32914" CreationDate="2016-07-04T11:05:19.297" Score="2" ViewCount="4087" Body="&lt;p&gt;I am experiencing high CPU utilization on a Cisco 3750. After consulting with Cisco TAC, it seemed we get a lot of icmp request that the switch redirects so asked what if I disabled the &quot;ip redirect&quot; but Cisco TAC said that platform does not support it but I did &quot;no ip redirect&quot; on all hsrp interfaces anyways and after reviewing &quot;debug platform cpu-queues icmp-q&quot; output I see huge number of messages like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jun 28 2016 16:06:04: ICMP-Q:Dropped redirect disabled on L3 IF: Local Port Fwding L3If:Vlan52 L2If:TenGigabitEthernet1/1/2 DI:0xB4, LT:7, Vlan:52   SrcGPN:54, SrcGID:54, ACLLogIdx:0x0, MacDA:0000.0c9f.f002, MacSA: 0015.5d3e.1414   IP_SA:37.254.53.28 IP_DA:172.17.100.65 IP_Proto:17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there such a thing that this platform doesn't support &quot;no ip redirect&quot;? Cisco hasn't been able to give me any useful information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;no ip redirect&quot; is being applied to SVIs on the switch and act as a default gateway for the hosts and do static routing for them. &lt;/p&gt;&#xA;" OwnerUserId="539" LastEditorUserId="539" LastEditDate="2016-07-07T09:04:59.563" LastActivityDate="2016-07-07T09:04:59.563" Title="Disable &quot;ip redirect&quot; Cisco 3750" Tags="|cisco|cisco-3750|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32803" PostTypeId="1" AcceptedAnswerId="32810" CreationDate="2016-07-04T12:21:38.797" Score="2" ViewCount="954" Body="&lt;p&gt;I am aware that -p sets the number of probes in a traceroute. I recently did the following traceroute with different values of -p i.e 1 and 3 (the default value). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MLeIv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MLeIv.png&quot; alt=&quot;Traceroute with number of probes equal to 3&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aYwr5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aYwr5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you explain the increase in the number of hops due to change in the number of probes ? Are the * marks due to the requests timing out ?&lt;/p&gt;&#xA;" OwnerUserId="27622" LastEditorUserId="27622" LastEditDate="2016-07-05T09:49:50.247" LastActivityDate="2016-09-03T10:44:27.603" Title="What is the significance of number or probes in traceroute?" Tags="|tcp|traceroute|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32806" PostTypeId="1" CreationDate="2016-07-04T18:17:39.350" Score="2" ViewCount="632" Body="&lt;p&gt;I have 2 3560G switches and im trying to ping the other vlan on it but wont get the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here is my config&lt;/p&gt;&#xA;&#xA;&lt;p&gt;switch #1 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1946 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;ip subnet-zero&#xA;ip routing&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;interface Port-channel1&#xA; no switchport&#xA; ip address 10.10.10.10 255.255.255.0&#xA; standby 1 ip&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface GigabitEthernet0/3&#xA;!&#xA;interface GigabitEthernet0/4&#xA;!&#xA;interface GigabitEthernet0/5&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/6&#xA;!&#xA;interface GigabitEthernet0/7&#xA;!&#xA;interface GigabitEthernet0/8&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/9&#xA;!&#xA;interface GigabitEthernet0/10&#xA;!&#xA;interface GigabitEthernet0/11&#xA;!&#xA;interface GigabitEthernet0/12&#xA;!&#xA;interface GigabitEthernet0/13&#xA;!&#xA;interface GigabitEthernet0/14&#xA;!&#xA;interface GigabitEthernet0/15&#xA;!&#xA;interface GigabitEthernet0/16&#xA;!&#xA;interface GigabitEthernet0/17&#xA;!&#xA;interface GigabitEthernet0/18&#xA;!&#xA;interface GigabitEthernet0/19&#xA;!&#xA;interface GigabitEthernet0/20&#xA;!&#xA;interface GigabitEthernet0/21&#xA;!&#xA;interface GigabitEthernet0/22&#xA;!&#xA;interface GigabitEthernet0/23&#xA;!&#xA;interface GigabitEthernet0/24&#xA;!&#xA;interface GigabitEthernet0/25&#xA;!&#xA;interface GigabitEthernet0/26&#xA;!&#xA;interface GigabitEthernet0/27&#xA;!&#xA;interface GigabitEthernet0/28&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;&#xA;!&#xA;interface Vlan10&#xA; ip address 196.10.10.10 255.255.255.0&#xA; standby 1 ip&#xA;!&#xA;interface Vlan20&#xA; ip address 196.10.20.10 255.255.255.0&#xA; standby 1 ip&#xA;!&#xA;interface Vlan30&#xA; ip address 196.10.30.10 255.255.255.0&#xA; standby 1 ip&#xA;!&#xA;interface Vlan40&#xA; ip address 196.10.40.10 255.255.255.0&#xA; standby 1 ip&#xA;!&#xA;ip classless&#xA;ip http server&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 5 15&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;switch 2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;new#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 2826 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;no service password-encryption&#xA;!&#xA;hostname new&#xA;!&#xA;enable secret 5 $1$xoou$YnuOXQYgUhhL3ouroeqlw1&#xA;enable password pokemon&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;ip subnet-zero&#xA;ip routing&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA; --More--&#xA;03:37:39: %SYS-5-CONFIG_I: Configured from console !        e&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;interface Port-channel1&#xA; no switchport&#xA; ip address 10.10.1.10 255.255.255.0&#xA; standby 1 ip&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA;!&#xA;interface FastEthernet0/25&#xA;!&#xA;interface FastEthernet0/26&#xA;!&#xA;interface FastEthernet0/27&#xA;!&#xA;interface FastEthernet0/28&#xA;!&#xA;interface FastEthernet0/29&#xA;!&#xA;interface FastEthernet0/30&#xA;!&#xA;interface FastEthernet0/31&#xA;!&#xA;interface FastEthernet0/32&#xA;!&#xA;interface FastEthernet0/33&#xA;!&#xA;interface FastEthernet0/34&#xA;!&#xA;interface FastEthernet0/35&#xA;!&#xA;interface FastEthernet0/36&#xA;!&#xA;interface FastEthernet0/37&#xA;!&#xA;interface FastEthernet0/38&#xA;!&#xA;interface FastEthernet0/39&#xA;!&#xA;interface FastEthernet0/40&#xA;!&#xA;interface FastEthernet0/41&#xA;!&#xA;interface FastEthernet0/42&#xA;!&#xA;interface FastEthernet0/43&#xA;!&#xA;interface FastEthernet0/44&#xA;!&#xA;interface FastEthernet0/45&#xA;!&#xA;interface FastEthernet0/46&#xA;!&#xA;interface FastEthernet0/47&#xA;!&#xA;interface FastEthernet0/48&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/3&#xA;!&#xA;interface GigabitEthernet0/4&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan10&#xA; ip address 200.200.1.2 255.255.255.0&#xA; standby ip 172.30.40.10&#xA; standby 1 ip&#xA;!&#xA;interface Vlan20&#xA; ip address 200.200.2.2 255.255.255.0&#xA; standby ip 172.30.50.10&#xA; standby 1 ip&#xA;!&#xA;interface Vlan30&#xA; ip address 200.200.3.2 255.255.255.0&#xA; standby ip 172.30.70.10&#xA; standby 1 ip&#xA;!&#xA;interface Vlan40&#xA; ip address 200.200.4.2 255.255.255.0&#xA; standby ip 172.30.80.10&#xA; standby 1 ip&#xA;!&#xA;ip classless&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA;line vty 0 4&#xA; password pokemon&#xA; login&#xA;line vty 5 15&#xA; password pokemon&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;e.g &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#ping 200.200.1.2 source 196.10.10.10&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 200.200.1.2, timeout is 2 seconds:&#xA;Packet sent with a source address of 196.10.10.10&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27334" LastEditorUserId="8499" LastEditDate="2018-12-25T01:51:02.407" LastActivityDate="2018-12-25T01:51:02.407" Title="SVI Inter-vlan routing" Tags="|cisco|routing|switch|vlan|ping|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32808" PostTypeId="2" ParentId="32806" CreationDate="2016-07-04T18:53:13.287" Score="1" Body="&lt;p&gt;You seem to have multiple problems:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You have port channels defined on each switch, but there are no&#xA;interfaces which are members of the port channels.&lt;/li&gt;&#xA;&lt;li&gt;You don't have any routed links connecting the two switches.&lt;/li&gt;&#xA;&lt;li&gt;You don't have any static routes or routing protocol to share the&#xA;routes on each switch with the other switch.&lt;/li&gt;&#xA;&lt;li&gt;You are trying to use HSRP, but that doesn't work unless you have the&#xA;same networks on both switches.&lt;/li&gt;&#xA;&lt;li&gt;You seem to be trunking the VLANs between the switches, but each&#xA;switch has its ow VLANs which are using networks different than the&#xA;VLANs on the other switch.&lt;/li&gt;&#xA;&lt;li&gt;You have not assigned any switch interfaces to a VLAN other than the&#xA;default VLAN 1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Your question is unclear on what you are trying to do, but I have listed a couple of options for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could try something like this to have two separate routers for the separate networks you have defined on the two switches (completely separate VLANs on the two switches, even though they use the same VLAN numbers):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel1&#xA; description Channel to Switch 2 Po1&#xA; no switchport&#xA; ip address 10.10.10.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/5&#xA; description Link to Switch 2 G0/2&#xA; no switchport&#xA; channel-group 1 mode on&#xA;!&#xA;interface GigabitEthernet0/8&#xA; description Link to Switch 2 G0/4&#xA; no switchport&#xA; channel-group 1 mode on&#xA;!&#xA;interface Vlan10&#xA; ip address 196.10.10.10 255.255.255.0&#xA;!&#xA;interface Vlan20&#xA; ip address 196.10.20.10 255.255.255.0&#xA;!&#xA;interface Vlan30&#xA; ip address 196.10.30.10 255.255.255.0&#xA;!&#xA;interface Vlan40&#xA; ip address 196.10.40.10 255.255.255.0&#xA;!&#xA;router ospf 1&#xA; network 0.0.0.0 255.255.255.255 area 0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel1&#xA; description Channel to Switch 1 Po1&#xA; no switchport&#xA; ip address 10.10.10.2 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/2&#xA; description Link to Switch 1 G0/5&#xA; no switchport&#xA; channel-group 1 mode on&#xA;!&#xA;interface GigabitEthernet0/4&#xA; description Link to Switch 1 G0/8&#xA; no switchport&#xA; channel-group 1 mode on&#xA;!&#xA;interface Vlan10&#xA; ip address 200.200.1.2 255.255.255.0&#xA;!&#xA;interface Vlan20&#xA; ip address 200.200.2.2 255.255.255.0&#xA;!&#xA;interface Vlan30&#xA; ip address 200.200.3.2 255.255.255.0&#xA;!&#xA;interface Vlan40&#xA; ip address 200.200.4.2 255.255.255.0&#xA;!&#xA;router ospf 1&#xA; network 0.0.0.0 255.255.255.255 area 0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could try something like this to have two separate routers for the same networks on both switches (the VLANs on the two switches):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel1&#xA; description Channel to Switch 2 Po1&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/5&#xA; description Link to Switch 2 G0/2&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk    &#xA;!&#xA;interface GigabitEthernet0/8&#xA; description Link to Switch 2 G0/4&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan10&#xA; ip address 196.10.10.10 255.255.255.0&#xA; standby 1 ip 196.10.10.1&#xA; standby 1 priority 110&#xA; standby 1 preempt&#xA;!&#xA;interface Vlan20&#xA; ip address 196.10.20.10 255.255.255.0&#xA; standby 1 ip 196.10.20.1&#xA; standby 1 priority 110&#xA; standby 1 preempt&#xA;!&#xA;interface Vlan30&#xA; ip address 196.10.30.10 255.255.255.0&#xA; standby 1 ip 196.10.30.1&#xA; standby 1 priority 110&#xA; standby 1 preempt&#xA;!&#xA;interface Vlan40&#xA; ip address 196.10.40.10 255.255.255.0&#xA; standby 1 ip 196.10.40.1&#xA; standby 1 priority 110&#xA; standby 1 preempt&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel1&#xA; description Channel to Switch 1 Po1&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/2&#xA; description Link to Switch 1 G0/5&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/4&#xA; description Link to Switch 1 G0/8&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan10&#xA; ip address 196.10.10.11 255.255.255.0&#xA; standby 1 ip 196.10.10.1&#xA; standby 1 priority 100&#xA; standby 1 preempt&#xA;!&#xA;interface Vlan20&#xA; ip address 196.10.20.11 255.255.255.0&#xA; standby 1 ip 196.10.20.1&#xA; standby 1 priority 100&#xA; standby 1 preempt&#xA;!&#xA;interface Vlan30&#xA; ip address 196.10.30.11 255.255.255.0&#xA; standby 1 ip 196.10.30.1&#xA; standby 1 priority 100&#xA; standby 1 preempt&#xA;!&#xA;interface Vlan40&#xA; ip address 196.10.40.11 255.255.255.0&#xA; standby 1 ip 196.10.40.1&#xA; standby 1 priority 100&#xA; standby 1 preempt&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are trying to ping from one network on one switch to a different network on the other switch. The problem is that the switch from which you are trying to ping doesn't know how to get tho the network on the other switch. You need to either put in static routes, or you need to run a routing protocol between the switches. Somehow, both switches need to know about the networks on the other switch, otherwise the traffic gets dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your edit, the first example I gave you should work. I really think you are confusing layer-2 and layer-3. By using trunks between the switches, the VLANs are the same on both switches, and you can get from on VLAN to the other switch via layer-2. What you are missing is that to route between the switches, you need a routed link, and some method for one switch to know to send traffic to the other switch for traffic destined to the network(s) on the other switch. This is a layer-3 problem, not a layer-2 problem.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-04T23:32:36.630" LastActivityDate="2016-07-04T23:32:36.630" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="32809" PostTypeId="1" AcceptedAnswerId="32811" CreationDate="2016-07-04T19:26:44.480" Score="1" ViewCount="83" Body="&lt;p&gt;If two hosts (Host1 and Host2) successfully accomplish a TCP handshake process and have a connection, would a third host (Host3) be able to send messages directly to Host1's address and (ephemeral) port once it knows them, spoofing these messages with Host2's address and port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Host1&lt;/em&gt; (&lt;strong&gt;192.0.2.115:32154&lt;/strong&gt;) &amp;lt;-------------&gt; (&lt;strong&gt;198.51.100.10:7184&lt;/strong&gt;) &lt;em&gt;Host2&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Host3&lt;/em&gt; sends a message directly to &lt;strong&gt;192.0.2.115:32154&lt;/strong&gt;, spoofing it's source port and address to &lt;strong&gt;198.51.100.10:7184&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would this work, or does TCP have some mechanism that avoids it? As TCP sessions are identified by source and destination addresses and ports and they would have been spoofed, I can't see how can this message be known as being bogon.&lt;/p&gt;&#xA;" OwnerUserId="4575" LastEditorUserId="4575" LastEditDate="2016-07-04T20:46:26.080" LastActivityDate="2016-07-05T13:19:30.787" Title="Spoofed message from a third host directly to client address and port in a TCP connection" Tags="|tcp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32810" PostTypeId="2" ParentId="32803" CreationDate="2016-07-04T19:56:56.367" Score="2" Body="&lt;p&gt;Traceroute is normally working over UDP. Using -T option you are using TCP SYN instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look in the traceroute's output you will see that after hop 3 the router there is doing loadbalancing of the traffic. So part of the packets are going one direction, part of them to another. We can imagine that one of the ways out is via ISP1 and the other one is via ISP2. As result hop count is different. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default traceroute is executing 3 queries to every single hop in order to explore every single possible exit on every single router on path. However I can't explain how it is working when TCP is used. In my opinion -q is not applicable for use together with TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least when I tried it was working very very strange:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  [host]# traceroute -T -q 3 8.8.8.8&#xA;traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 40 byte packets&#xA; 1  xe-5-3-2-129.ams-koo-score-2-re0.interoute.net (195.81.166.12)  0.163 ms  0.150 ms  0.146 ms&#xA; 2  ae0-0.ams-koo-score-1-re0.interoute.net (84.233.190.1)  0.232 ms  0.230 ms  0.234 ms&#xA;&#xA; 3  * * *&#xA; 4  * * *&#xA;&#xA;&#xA;  [host]# traceroute -q 3 8.8.8.8&#xA;traceroute to 8.8.8.8 (8.8.8.8), 30 hops max, 40 byte packets&#xA; 1  xe-5-3-2-129.ams-koo-score-2-re0.interoute.net (195.81.166.12)  0.157 ms  0.239 ms  0.233 ms&#xA; 2  ae0-0.ams-koo-score-1-re0.interoute.net (84.233.190.1)  0.187 ms  0.206 ms  0.202 ms&#xA; 3  72.14.217.96 (72.14.217.96)  0.700 ms  0.697 ms  0.706 ms&#xA; 4  209.85.143.251 (209.85.143.251)  1.188 ms  1.258 ms  1.415 ms&#xA; 5  209.85.241.21 (209.85.241.21)  1.345 ms  1.270 ms 216.239.43.146 (216.239.43.146)  2.749 ms&#xA; 6  66.249.95.239 (66.249.95.239)  4.273 ms 216.239.49.39 (216.239.49.39)  5.054 ms 216.239.51.17 (216.239.51.17)  5.191 ms&#xA; 7  209.85.255.51 (209.85.255.51)  4.636 ms  4.627 ms 216.239.56.83 (216.239.56.83)  4.573 ms&#xA; 8  google-public-dns-a.google.com (8.8.8.8)  4.480 ms  4.454 ms  4.449 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2016-07-04T19:56:56.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32811" PostTypeId="2" ParentId="32809" CreationDate="2016-07-04T20:18:53.463" Score="1" Body="&lt;p&gt;For a device to spoof its way into a TCP conversation, it will need to do more than spoof the source address of one of the the hosts in the TCP conversation. It must also be able to know the sequence/acknowledgement numbers, window sizes, ACKs, etc. It would be very difficult to get this to work correctly. For example, you would need TCP on the host being spoofed to not respond to traffic from the other host, otherwise the host to which spoofed traffic is sent will get two ACKs for everything it sends to the host to which it thinks it is connected.&lt;/p&gt;&#xA;&lt;p&gt;Application TCP sessions (sockets) are identified by a concatenation of the ports and IP addresses, but I think the part you are missing is that the TCP on each host communicates directly with the TCP on the peer connection, and TCP buffers data before sending it to the application. The application doesn't get involved with TCP windowing, sequence numbers, ACKs, etc. There are things that TCP does which don't involve the application to which TCP is connected.&lt;/p&gt;&#xA;&lt;p&gt;To get this to work correctly, you would need to have direct control of TCP on both the spoofed host and on the host doing the spoofing.&lt;/p&gt;&#xA;&lt;p&gt;To understand how TCP works, the original source is &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 793, TRANSMISSION CONTROL PROTOCOL&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-07-04T20:18:53.463" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="32812" PostTypeId="1" AcceptedAnswerId="32814" CreationDate="2016-07-04T20:26:48.060" Score="1" ViewCount="579" Body="&lt;p&gt;I want to block the users of sub network to have not access to the server Radius ? I tried one like this but it doesn't work.&lt;/p&gt;&#xA;" OwnerUserId="27527" LastEditorUserId="27527" LastEditDate="2016-07-04T22:59:06.863" LastActivityDate="2016-07-04T22:59:06.863" Title="Apply ACL to block some users to have not access to Radius server?" Tags="|acl|radius|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32814" PostTypeId="2" ParentId="32812" CreationDate="2016-07-04T21:21:36.920" Score="1" Body="&lt;p&gt;You are misunderstanding how RADIUS operates.  When clients connect to the HOME router, the router connects to the RADIUS server to authenticate them.  The clients never connect to the RADIUS server directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As @Ronmaupin suggests, you can block users on that subnet from accessing the router by applying an ACL to the VTY lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 10 deny 192.168.40.0.0.0.0.255&#xA;access-list 10 permit any&#xA;&#xA;line vty 0 4&#xA;access-class 10 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-07-04T21:30:00.987" LastActivityDate="2016-07-04T21:30:00.987" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32816" PostTypeId="1" AcceptedAnswerId="32817" CreationDate="2016-07-04T22:21:14.997" Score="1" ViewCount="12712" Body="&lt;p&gt;I have a existing switch stack with 5 switches in the stack (all of them are 3750). Now, I have to add another switch (3750) to that stack. I turned on the new switch that I got from my company to make sure if there is any unnecessary configurations, and I found out that the the member number of the new switch is 1 (which is default) and the priority is set as 15.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how I am planing to add this switch:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Turn off the power of the new switch&lt;/li&gt;&#xA;&lt;li&gt;connect the stacking cable (according to Cisco documentation)&lt;/li&gt;&#xA;&lt;li&gt;Turn on the power of the new switch&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;By doing this the switch should automatically get the stack number and priority value of 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is: since the new switch has priority value of 15 before adding it to the stack, after adding the switch to the stack following above procedure, can this switch reboot the entire stack and reelect the master switch? If yes, how can I avoid this.&lt;/p&gt;&#xA;" OwnerUserId="25763" LastEditorUserId="8499" LastEditDate="2016-07-04T22:41:51.040" LastActivityDate="2016-07-12T22:13:54.113" Title="Addition of new switch to an existing stack" Tags="|cisco|switch|stacking|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32817" PostTypeId="2" ParentId="32816" CreationDate="2016-07-04T22:41:35.663" Score="0" Body="&lt;p&gt;You should set the switch number and priority before adding it to the stack. You should also define the new switch on the stack before adding it to the stack, and you should verify that it is running the same IOS version as the stack before adding it to the stack. A switch will &lt;em&gt;not&lt;/em&gt; automatically change its priority when added to the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the stack you should have the switch priority set on each the way you want. Don't depend on an election of equal priority members. The best practice is to manually set the switch priorities so that you have a deterministic failover. For instance:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Existing stack:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch 1: priority 15 (master)&#xA;Switch 2: priority 14&#xA;Switch 3: priority 13&#xA;Switch 4: priority 12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;New switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch 5: priority 11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is always a risk when adding something to a device or stack that the device or stack will reboot, but adding an unpowered switch to the stack, then powering it up, should not cause the stack to reboot.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-04T22:41:35.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32818" PostTypeId="1" AcceptedAnswerId="32819" CreationDate="2016-07-04T23:38:55.087" Score="1" ViewCount="128" Body="&lt;p&gt;I just set up a new WS-C2960X-24TD-L, and I can access the switch via Network Assistant without any issues. However, when I plug in the WAP directly to the switch with the included cable, it seems to get no power, and nothing lights up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am fairly new to the Cisco switches and WAPs. Is there something I need to do to get PoE working so that the WAP will turn on?&lt;/p&gt;&#xA;" OwnerUserId="27632" LastEditorUserId="8499" LastEditDate="2016-07-04T23:45:08.097" LastActivityDate="2016-07-04T23:45:08.097" Title="WAP551 connected to WS-C2960X-24TD-L does not turn on, no PoE?" Tags="|access-point|power-over-ethernet|cisco-2960|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32819" PostTypeId="2" ParentId="32818" CreationDate="2016-07-04T23:44:00.747" Score="0" Body="&lt;p&gt;That particular switch model, WS-C2960X-24TD-L, doesn't have PoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-2960-x-series-switches/data_sheet_c78-728232.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Catalyst 2960-X Series Switches Data Sheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OlKCS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OlKCS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will either need a switch which has PoE, or you will need an inline PoE adapter.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-04T23:44:00.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32820" PostTypeId="1" CreationDate="2016-07-05T00:41:41.413" Score="4" ViewCount="945" Body="&lt;p&gt;Networking community,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was hoping someone might be able to provide me with some assistance in configuring one of my routers.  Diagram below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wjlwx.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wjlwx.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current configuration: The PfSense firewall is configured to hand out addresses to the two networks above. The servers and the cluster of routers (There is a static address between the Router R1 and the firewall).  The cluster of routers are all running OSPF. All of the routers communicate flawlessly. All of the routers from R2 beyond are in Area 0, and on R1, port 0/1 is in area 0 as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I initially had OSPFquagga installed on the firewall, but have since removed that, as I do not want OSPF running on the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem:  I am having trouble configuring R1 to take a static route and dynamically propagate that route through the OSPF network. Which would permit the cluster of routers to reach the WAN. I have set up R1 as an ASBR.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I initially had the ip route set to 0.0.0.0 0.0.0.0 interface...next hop, but read that those types of default routes are not propagated by OSPF/IS-IS)&lt;br&gt;&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/16448-default.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/16448-default.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have referenced:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13692-21.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/13692-21.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7039-1.html#t32&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7039-1.html#t32&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/12-4t/iro-12-4t-book/iro-cfg.html#GUID-4AABEB56-2125-488B-B5A4-A5650F3159BB&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_ospf/configuration/12-4t/iro-12-4t-book/iro-cfg.html#GUID-4AABEB56-2125-488B-B5A4-A5650F3159BB&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;here &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configurations are as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    interface GigabitEthernet0/0&#xA; ip address 192.168.30.150 255.255.255.0&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.100.1 255.255.255.0&#xA; ip ospf 10 area 0&#xA; duplex auto&#xA; speed auto&#xA;!         &#xA;router ospf 10&#xA; redistribute static subnets&#xA; network 192.168.100.0 0.0.0.255 area 0&#xA; default-information originate always&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip route 192.168.100.0 255.255.255.0 GigabitEthernet0/0 192.168.30.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I feel like I am close, but would appreciate any suggestions.  If it would be of any use, I can upload PCAP's, OSPF neighbor lists, IP routers, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciation in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;----Update-----&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Issue:&lt;/strong&gt; R1 not propagating static route to other OSPF neighbors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interface GigabitEthernet0/0&#xA; ip address 192.168.30.150 255.255.255.0&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.100.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router ospf 10&#xA; network 192.168.100.0 0.0.0.255 area 0&#xA; default-information originate&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 192.168.30.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;show ip route brief and show ip ospf database&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is 192.168.30.1 to network 0.0.0.0&#xA;&#xA;S*    0.0.0.0/0 [1/0] via 192.168.30.1, GigabitEthernet0/0&#xA;      10.0.0.0/29 is subnetted, 5 subnets&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ospf database&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OSPF Router with ID (192.168.100.5) (Process ID 10)&#xA;&#xA;                Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;10.1.15.1       10.1.15.1       1958        0x800001DF 0x005A29 2&#xA;10.10.10.10     10.10.10.10     400         0x800000BF 0x005E4D 2&#xA;172.10.10.2     172.10.10.2     1453        0x800000DD 0x007EDC 5&#xA;192.168.100.5   192.168.100.5   1329        0x800000B5 0x00E84F 1&#xA;192.168.200.5   192.168.200.5   1963        0x800001E7 0x00412C 4&#xA;&#xA;                Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;10.1.11.6       10.10.10.10     2400        0x8000008F 0x00BEC4&#xA;10.1.12.1       10.10.10.10     1400        0x8000008B 0x001403&#xA;10.1.21.2       10.1.15.1       1958        0x800000CD 0x00E177&#xA;10.1.22.2       192.168.200.5   1963        0x800000CE 0x00B412&#xA;10.1.31.2       192.168.200.5   1963        0x800000CD 0x00898D&#xA;192.168.100.2   172.10.10.2     1639        0x80000001 0x00DB36&#xA;192.168.200.6   192.168.225.254 1480        0x800000CE 0x00323D&#xA;&#xA;                Type-5 AS External Link States&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;0.0.0.0         192.168.100.5   1324        0x80000005 0x00ECE5 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R2&lt;/strong&gt;&#xA;&lt;strong&gt;show ip ospf database&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    OSPF Router with ID (172.10.10.2) (Process ID 10)&#xA;&#xA;                Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;10.1.15.1       10.1.15.1       341         0x800001E0 0x00582A 2&#xA;10.10.10.10     10.10.10.10     775         0x800000BF 0x005E4D 2&#xA;172.10.10.2     172.10.10.2     239         0x800000DE 0x00C568 4&#xA;192.168.100.5   192.168.100.5   1706        0x800000B5 0x00E84F 1&#xA;192.168.200.5   192.168.200.5   328         0x800001E8 0x003F2D 4&#xA;&#xA;&#xA;                Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;10.1.11.6       10.10.10.10     2776        0x8000008F 0x00BEC4&#xA;10.1.12.1       10.10.10.10     1776        0x8000008B 0x001403&#xA;10.1.21.2       10.1.15.1       342         0x800000CE 0x00DF78&#xA;10.1.22.2       192.168.200.5   328         0x800000CF 0x00B213&#xA;10.1.31.2       192.168.200.5   328         0x800000CE 0x00878E&#xA;192.168.100.2   172.10.10.2     2015        0x80000001 0x00DB36&#xA;&#xA;                Type-5 AS External Link States&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;0.0.0.0         192.168.100.5   1703        0x80000005 0x00ECE5 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Updated&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1: Configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 10.1.1.1 255.255.255.255&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 192.168.30.150 255.255.255.0&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; no cdp enable&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.99.5 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router ospf 10&#xA; redistribute static subnets&#xA; passive-interface GigabitEthernet0/0&#xA; network 192.168.99.4 0.0.0.3 area 0&#xA; default-information originate&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 192.168.30.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1: Show Ip ospf database&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;10.1.1.1        10.1.1.1        920         0x80000003 0x00A2CD 1&#xA;172.10.10.2     172.10.10.2     921         0x80000003 0x004FB4 1&#xA;&#xA;                Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;192.168.99.6    172.10.10.2     921         0x80000001 0x009A41&#xA;&#xA;                Type-5 AS External Link States&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;0.0.0.0         10.1.1.1        1041        0x80000001 0x006E2E 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2: Show ip ospf database&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;OSPF Router with ID (172.10.10.2) (Process ID 10)&#xA;&#xA;                Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;10.1.1.1        10.1.1.1        1046        0x80000003 0x00A2CD 1&#xA;172.10.10.2     172.10.10.2     1045        0x80000003 0x004FB4 1&#xA;&#xA;                Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;192.168.99.6    172.10.10.2     1045        0x80000001 0x009A41&#xA;&#xA;                Type-5 AS External Link States&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;0.0.0.0         10.1.1.1        1166        0x80000001 0x006E2E 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1: eth0/0: 192.168.30.150/24&lt;/li&gt;&#xA;&lt;li&gt;R1: eth0/1: 192.168.99.5/29  --&gt; R2&lt;/li&gt;&#xA;&lt;li&gt;R2: eth1/0/1: 192.168.99.6/29&lt;/li&gt;&#xA;&lt;li&gt;R2: eth1/0/2: 10.1.11.6/29  --&gt; R3: 10.1.11.5&lt;/li&gt;&#xA;&lt;li&gt;R2: eth1/0/4: 10.1.21.1/29  --&gt; R4: 10.1.21.2&lt;/li&gt;&#xA;&lt;li&gt;R2: eth1/0/3: 10.1.31.1/29  --&gt; R5: 10.1.31.2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23081" LastEditorUserId="8499" LastEditDate="2018-12-27T02:34:00.890" LastActivityDate="2018-12-27T02:34:00.890" Title="Trouble inserting static route into OSPF ASBR" Tags="|cisco|routing|router|firewall|ospf|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32821" PostTypeId="2" ParentId="32820" CreationDate="2016-07-05T00:58:01.923" Score="3" Body="&lt;p&gt;If I read correctly, you want all the routers to send traffic without a specific route through R1 to the firewall. This is where you would use a default route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0 &amp;lt;firewall lan address&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With that static route in place, you can use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;default-information originate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Only use this command on R1, not the other routers. This command will inject the default route, &lt;code&gt;0.0.0.0 0.0.0.0&lt;/code&gt;, into OSPF as long as the default route exists in the routing table of R1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command you have, &lt;code&gt;default-information originate always&lt;/code&gt; will unconditionally inject the default route into OSPF. This will get the traffic to R1, but unless R1 has a default route, or specific routes for all the routes on the Internet, this really won't do you much good. You can use this command, but you should also have a default route in R1 to tell R1 to send traffic for routes about which it does know to the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the discussion on Chat, your firewall has no way to know where to send traffic destined for any networks behind R1. This is because you have removed OSPF from it. You will either need to set up static routes on the firewall for all the LAN networks, or you will need to re-enable OSPF on the firewall.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-07T19:09:51.993" LastActivityDate="2016-07-07T19:09:51.993" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="32824" PostTypeId="1" AcceptedAnswerId="32825" CreationDate="2016-07-05T08:17:36.457" Score="0" ViewCount="558" Body="&lt;p&gt;I am setting up some monitoring tools for my works network and there are two core switches that I need to be monitoring all the time. I have snmp configured on the switch but when I try to add it as an item on my monitoring tools it will not add it. I can ping the IP address I want to monitor from the server.  The current configuration on the switch (Dell S5000) looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*******#show running-config | find snmp&#xA;snmp-server community &quot;**********&quot; rw,&#xA;snmp-server enable traps bgp,&#xA;snmp-server enable traps snmp authentication coldstart linkdown linkup syslog-re                                                                                                             achable syslog-unreachable,&#xA;snmp-server enable traps vrrp,&#xA;snmp-server enable traps lacp,&#xA;snmp-server enable traps entity,&#xA;snmp-server enable traps stack,&#xA;snmp-server enable traps stp,&#xA;snmp-server enable traps ecfm,&#xA;snmp-server enable traps vlt,&#xA;snmp-server enable traps fips,&#xA;snmp-server enable traps ets,&#xA;snmp-server enable traps xstp,&#xA;snmp-server enable traps isis,&#xA;snmp-server enable traps config,&#xA;snmp-server enable traps pfc,&#xA;snmp-server enable traps envmon cam-utilization fan supply temperature,&#xA;snmp-server enable traps ecmp.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm thinking the problem is I'm not assigning the traps to an interface? The SNMP community string is defo a match. If any of you have any other ideas, i'd greatly appreciate your input.&lt;/p&gt;&#xA;" OwnerUserId="23768" LastEditorUserId="8499" LastEditDate="2016-07-05T08:18:31.520" LastActivityDate="2016-08-04T09:30:50.130" Title="SNMP configuration on dell S5000 switch" Tags="|snmp|switching|monitoring|dell|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32825" PostTypeId="2" ParentId="32824" CreationDate="2016-07-05T09:23:35.063" Score="0" Body="&lt;p&gt;This was resolved after finding a typo in the community string.&lt;/p&gt;&#xA;" OwnerUserId="23768" LastActivityDate="2016-07-05T09:23:35.063" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32826" PostTypeId="2" ParentId="32799" CreationDate="2016-07-05T10:55:29.813" Score="7" Body="&lt;p&gt;Looks like an Emoji, hex code 1F193:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the interface of your router allows it, you can simply copy and paste the above character on the SSID text field. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: the style of the character will appear different depending on the client device displaying the list of Wi-Fi networks. See &lt;a href=&quot;http://apps.timwhitlock.info/emoji/tables/unicode&quot; rel=&quot;noreferrer&quot;&gt;this complete Emoji list&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2016-07-05T10:55:29.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32827" PostTypeId="2" ParentId="32732" CreationDate="2016-07-05T11:18:22.590" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How does router solve this since it doesn't have domain name?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since you're pinging the printer in the LAN, DNS lookup is performed for the local domain.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Will it work for whole VPN or just it applies to my physical network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends on how your VPN is configured, but normally, yes. A VPN allows you to connect to an internal network just like you're physically there. &lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2016-07-05T11:18:22.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32828" PostTypeId="1" AcceptedAnswerId="32844" CreationDate="2016-07-05T11:36:48.773" Score="1" ViewCount="237" Body="&lt;p&gt;As far as I know, NetFlow can collect data from physical interfaces and its subinterfaces, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not from loopback, VLAN, tunnel or any virtual interface.&lt;/p&gt;&#xA;" OwnerUserId="16778" LastEditorUserId="8499" LastEditDate="2016-07-05T16:53:11.120" LastActivityDate="2016-07-05T16:53:11.120" Title="NetFlow working for physical/sub interfaces only?" Tags="|netflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32829" PostTypeId="1" CreationDate="2016-07-05T11:42:19.180" Score="4" ViewCount="325" Body="&lt;p&gt;Good day all!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I encountered a problem while I was running flowvisor In mininet. The same problem occurred &lt;/p&gt;&#xA;&#xA;&lt;p&gt;also when I tried running it on different VM (Ubuntu server 14.04). I was able to install and run flowvisor but when i tried creating a slice 'Blue', it was created successfully but wasn't showing up at the&lt;/p&gt;&#xA;&#xA;&lt;p&gt;run of the command '$fvctl -f /dev/null list-slices'  except the default slice 'fvadmin'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been on this for couple of days now but to no avail. I attach the problem here should incase you have encountered such problem or you have any idea on how to resolve it. Everything is working fine except that am not able to see the successful slices and when i tried to add flowspace to the created slice, it keep saying 'such slice does not exist'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have not connected the flowvisor to remote controllers yet, was trying to solve the &lt;/p&gt;&#xA;&#xA;&lt;p&gt;issue of creating slices and flowspace first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connection between Mininet and FlowVisor is perfect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope to hear from you if there is any solution from your end.&lt;/p&gt;&#xA;" OwnerUserId="27641" LastEditorUserId="8499" LastEditDate="2016-07-05T16:41:26.470" LastActivityDate="2020-12-14T09:06:35.700" Title="FlowVisor Slices" Tags="|sdn|" AnswerCount="1" CommentCount="1" ClosedDate="2020-12-14T13:12:59.037" ContentLicense="CC BY-SA 3.0" />
  <row Id="32832" PostTypeId="1" AcceptedAnswerId="32837" CreationDate="2016-07-05T12:21:59.463" Score="2" ViewCount="216" Body="&lt;pre&gt;&lt;code&gt; A transit network is represented by a graph vertex having both incoming and outgoing edges&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't say that this representation makes sense for me. Can anybody explain why the OSPF algorithm needs this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an exaple  &lt;a href=&quot;https://i.stack.imgur.com/303Kd.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/303Kd.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On top of the above some edges in that graph seem to have different weights for the same link&lt;/p&gt;&#xA;" OwnerUserId="1647" LastActivityDate="2016-07-05T14:29:27.077" Title="OSPF RFC2328: Why is a router connected to a transit network connected with two edges?" Tags="|ospf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32833" PostTypeId="1" AcceptedAnswerId="32836" CreationDate="2016-07-05T12:53:35.427" Score="2" ViewCount="469" Body="&lt;p&gt;Say we have a router that connects to other routers and they connect to lan networks, does that router have a network card for each router it connects with but a single forwarding table for all? or even each network card has its own forwarding table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or a more simple case where a router that connects between two LANs like in the picture below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since we see that each side has a different mac address, I'm led to believe that it has at least two network cards, but wouldn't that mean if we have for example a router that connects hundreds of other routers or networks, does it also have hundreds of network cards?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sO6zt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sO6zt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27643" LastEditorUserId="27643" LastEditDate="2016-07-05T13:10:11.067" LastActivityDate="2016-07-05T13:29:38.713" Title="Does a router that connects to multiple networks, has a network card and forwarding table for each connection?" Tags="|routing|router|network-core|ip-forwarding-table|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32834" PostTypeId="2" ParentId="32833" CreationDate="2016-07-05T12:57:23.100" Score="-1" Body="&lt;p&gt;Single card can have multiple interfaces. In addition to that on a single interface you can use do1q tagging and transport multiple services over 1 physical link. &lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2016-07-05T12:57:23.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32835" PostTypeId="2" ParentId="32809" CreationDate="2016-07-05T13:19:30.787" Score="2" Body="&lt;p&gt;sure, that &quot;works&quot;. To do it reliably you need to know the sequence numbers. Lots of load balancers work this way - sometimes called 'one-armed' operation where one host does the handshake and hands the rest of the flow off to the balanced server and then gets out of the way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;even if you don't know the sequence numbers you can hunt around and find one in window (aka close enough) fairly quickly which is good enough for injecting some data at imprecise locations.. RSTs are especially annoying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An authenticated transport like QUIC, or TLS layered on top of TCP, would prevent bogus third parties from being part of the conversation.&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-07-05T13:19:30.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32836" PostTypeId="2" ParentId="32833" CreationDate="2016-07-05T13:29:38.713" Score="1" Body="&lt;p&gt;A router (or routing instance) will have a single layer-3 forwarding table for all interfaces, not one per NIC.  Except for an aggregation router as used in an ISP (which will not necessarily be Ethernet, so your ideas about NICs probably don't apply), most routers (as opposed to L3 switches) will have only a few or a few tens of IP subnets attached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where you may find very many subnets is with a L3 switch such as in a large data centre, and these may have hundreds of ports (possibly distributed across multiple racks) but will also have dot1q VLAN tags on many ports as mentioned by Viktor.  However in this case the L3 interface is not associated with any physical port, and the MAC address used for each L3 interface will be defined by software.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-07-05T13:29:38.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32837" PostTypeId="2" ParentId="32832" CreationDate="2016-07-05T13:35:54.093" Score="3" Body="&lt;p&gt;It has two edges to represent each direction, and each direction of a generalised SPF could have a different path cost.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-07-05T13:35:54.093" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32838" PostTypeId="1" CreationDate="2016-07-05T14:08:18.180" Score="1" ViewCount="3405" Body="&lt;p&gt;On my SRX 1400 I see maximum sessions here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show security flow session summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is what shows up now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Unicast-sessions: 46795&#xA;Multicast-sessions: 0&#xA;Services-offload-sessions: 0&#xA;Failed-sessions: 931259&#xA;Sessions-in-use: 51465&#xA;  Valid sessions: 46337&#xA;  Pending sessions: 0&#xA;  Invalidated sessions: 128&#xA;  Sessions in other states: 0&#xA;Maximum-sessions: 1048576&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My SRX can handle this number of sessions fine but the rest of my network can NOT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How can I decrease the Maximum-sessions value?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="23611" LastEditorUserId="8499" LastEditDate="2018-12-21T03:33:45.123" LastActivityDate="2018-12-21T03:33:45.123" Title="Juniper SRX Lower Maximum Sessions" Tags="|juniper|juniper-junos|juniper-srx|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32839" PostTypeId="2" ParentId="32832" CreationDate="2016-07-05T14:29:27.077" Score="4" Body="&lt;p&gt;Here is a clarification to marc's answer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;If you have a broadcast segment then you have still have two edges connecting the node to the segment. I can understand two edges on a P2P link but why do you need two edges for representing a connection to the broadcast network &quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order preserve the two vertices model of P2P link without impacting the calculation. Here is the explanation: &quot;The concept behind the DR is that the broadcast link itself is considered a &quot;pseudonode,&quot; or a virtual router. When the SPF tree is calculated, the link appears as a node and the routers attached to the link are attached to that node. The cost from an attached router to the pseudonode is the outgoing cost of that router's interface to the broadcast link, but the cost from the pseudonode to any attached router is 0. This way, the overall path cost is not affected by the pseudonode.&quot; – MiniMe just now   edit   &lt;/p&gt;&#xA;" OwnerUserId="1647" LastActivityDate="2016-07-05T14:29:27.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32841" PostTypeId="1" AcceptedAnswerId="43101" CreationDate="2016-07-05T14:52:00.833" Score="2" ViewCount="5871" Body="&lt;p&gt;I'm having some trouble with STP on our network. I have created a 3 tier network made up of Dell and Cisco switches. The topology is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The core consists of two Dell N4032 10Gbps switches in stacked mode and three Dell Power Connect 5548 switches which are also in stacked mode. The two stacks connect to each other using two SFP+ cables in a LAG using LACP. &#xA;The distribution layer switches are split into three physical rooms in the building. Each room has two Dell N3024 switches in stacked mode. The switches have a 10Gbps RJ45 module on the rear which have two ports each resulting in four 10Gbps ports per stack. I have four CAT 6A cables running from the core 10Gbps to the 10Gbps ports on the distribution switches. I have set these connections as a LAG again using LACP. &#xA;The access layer is made up of Cisco SG300 switches. These switches use two connections in a LAG again using LACP to the distribution switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm having problems with some end devices being able to communicate with other end devices. From the log files on switches the problem seems to relate to STP. I haven't made any changes to STP on any of the switches (which are all using RSTP) so everything is default which from research I have discovered is not optimal. I'm struggling to work out what the best settings to use for STP on our LAGs. I considered disabling STP on the LAGs since our network isn't a loop network but I would like to use STP. But I may be wrong and disabling STP could be fine since the network isn't a loop network. Any input would be great, if needed I can paste configs and log outputs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network diagram:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/wdzuF.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wdzuF.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Core Switch config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Te1/0/13&#xA;channel-group 3 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te1/0/14&#xA;channel-group 3 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te1/0/15&#xA;channel-group 4 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te1/0/16&#xA;channel-group 4 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te1/0/17&#xA;channel-group 5 mode active&#xA;exit              &#xA;!                 &#xA;interface Te1/0/18&#xA;channel-group 5 mode active&#xA;exit              &#xA;!                 &#xA;interface Te1/0/23&#xA;channel-group 2 mode active&#xA;exit              &#xA;!                 &#xA;interface Te1/0/24&#xA;channel-group 1 mode active&#xA;exit              &#xA;!                 &#xA;interface Te1/1/5 &#xA;channel-group 6 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te1/1/6 &#xA;channel-group 6 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te1/1/8 &#xA;channel-group 7 mode active&#xA;exit              &#xA;!                 &#xA;interface Te2/0/13&#xA;channel-group 3 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te2/0/14&#xA;channel-group 3 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te2/0/15&#xA;channel-group 4 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te2/0/16&#xA;channel-group 4 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te2/0/17&#xA;channel-group 5 mode active&#xA;exit              &#xA;!                 &#xA;interface Te2/0/18&#xA;channel-group 5 mode active&#xA;exit              &#xA;!                 &#xA;interface Te2/0/23&#xA;channel-group 1 mode active&#xA;exit              &#xA;!                 &#xA;interface Te2/0/24&#xA;channel-group 2 mode active&#xA;exit              &#xA;!                 &#xA;interface Te2/1/1 &#xA;channel-group 6 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te2/1/2 &#xA;channel-group 6 mode active&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface Te2/1/4 &#xA;channel-group 7 mode active&#xA;exit              &#xA;!                 &#xA;interface port-channel 3&#xA;description &quot;SER Distribution&quot;&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface port-channel 4&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface port-channel 5&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;!                 &#xA;interface port-channel 6&#xA;switchport mode trunk&#xA;switchport access vlan 3&#xA;exit              &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Distribution Switch Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure&#xA;vlan 2-4,99&#xA;exit&#xA;vlan 2&#xA;name &quot;Exhibition&quot;&#xA;exit&#xA;vlan 3&#xA;name &quot;PublicLAN&quot;&#xA;exit&#xA;vlan 4&#xA;name &quot;SPC&quot;&#xA;exit&#xA;vlan 99&#xA;name &quot;Management&quot;&#xA;exit&#xA;snmp-server location &quot;Workshop&quot;&#xA;hostname &quot;Workshop Distribution&quot;&#xA;slot 1/0 2    ! Dell Networking N3024F&#xA;slot 1/1 11   ! Dell 10GBase-T Card&#xA;slot 2/0 2    ! Dell Networking N3024F&#xA;slot 2/1 11   ! Dell 10GBase-T Card&#xA;stack&#xA;member 1 2    ! N3024F&#xA;member 2 2    ! N3024F&#xA;exit&#xA;interface vlan 1&#xA;ip address 10.0.6.46 255.255.0.0&#xA;exit&#xA;&#xA;interface Gi1/0/1&#xA;channel-group 1 mode active&#xA;exit&#xA;!&#xA;interface Gi1/0/2&#xA;speed auto&#xA;channel-group 2 mode active&#xA;exit&#xA;!&#xA;interface Gi1/0/3&#xA;speed auto&#xA;channel-group 3 mode active&#xA;exit              &#xA;!&#xA;interface Gi1/0/4&#xA;speed auto&#xA;channel-group 5 mode active&#xA;exit&#xA;!&#xA;interface Gi1/0/5&#xA;speed auto&#xA;channel-group 6 mode active&#xA;exit&#xA;!&#xA;interface Gi1/0/6&#xA;speed auto&#xA;channel-group 7 mode active&#xA;exit&#xA;!&#xA;interface Gi1/0/7&#xA;channel-group 8 mode active&#xA;exit&#xA;!&#xA;interface Gi1/0/8&#xA;channel-group 9 mode active&#xA;exit              &#xA;!&#xA;interface Gi1/0/9&#xA;speed auto&#xA;channel-group 10 mode active&#xA;exit&#xA;!&#xA;interface Te1/1/1&#xA;channel-group 4 mode active&#xA;exit&#xA;!&#xA;interface Te1/1/2&#xA;channel-group 4 mode active&#xA;exit&#xA;!&#xA;interface Gi2/0/1&#xA;speed auto&#xA;channel-group 1 mode active&#xA;exit&#xA;!&#xA;interface Gi2/0/2&#xA;speed auto&#xA;channel-group 2 mode active&#xA;exit              &#xA;!&#xA;interface Gi2/0/3&#xA;speed auto&#xA;channel-group 3 mode active&#xA;exit&#xA;!&#xA;interface Gi2/0/4&#xA;speed auto&#xA;channel-group 5 mode active&#xA;exit&#xA;!&#xA;interface Gi2/0/5&#xA;speed auto&#xA;channel-group 6 mode active&#xA;exit&#xA;!&#xA;interface Gi2/0/6&#xA;speed auto&#xA;channel-group 7 mode active&#xA;exit&#xA;!&#xA;interface Gi2/0/7&#xA;speed auto        &#xA;channel-group 8 mode active&#xA;exit&#xA;!&#xA;interface Gi2/0/8&#xA;speed auto&#xA;channel-group 9 mode active&#xA;exit&#xA;!&#xA;interface Gi2/0/9&#xA;speed auto 1000&#xA;channel-group 10 mode active&#xA;exit&#xA;!&#xA;interface Gi2/0/11&#xA;speed auto 1000&#xA;exit&#xA;!&#xA;interface Gi2/0/21&#xA;speed auto&#xA;exit&#xA;!&#xA;interface Te2/1/1&#xA;channel-group 4 mode active&#xA;exit&#xA;!&#xA;interface Te2/1/2&#xA;channel-group 4 mode active&#xA;exit&#xA;!&#xA;interface port-channel 1&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 2&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 3&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 4&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 5&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 6&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 7&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 8&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!                 &#xA;interface port-channel 9&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 10&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 11&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 12&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 13&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;!&#xA;interface port-channel 14&#xA;switchport mode trunk&#xA;switchport trunk allowed vlan 1-99&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All the distribution switches have the same config on them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example core config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 1                                      &#xA; ip address 10.0.6.55 255.255.0.0                     &#xA; no ip address dhcp                                   &#xA;!                                                     &#xA;interface vlan 2                                      &#xA; name Exhibition                                      &#xA;!                                                     &#xA;interface vlan 3                                      &#xA; name &quot;Public Lan&quot;                                    &#xA;!                                                     &#xA;interface vlan 5                                      &#xA; name Office                                          &#xA;!                                                     &#xA;  interface gigabitethernet8&#xA; switchport trunk allowed vlan add 2-3&#xA;!&#xA;interface gigabitethernet9&#xA; channel-group 1 mode auto&#xA;!&#xA;interface gigabitethernet10&#xA; channel-group 1 mode auto&#xA;!&#xA;interface Port-channel1&#xA; description Uplink&#xA; spanning-tree disable&#xA; spanning-tree link-type point-to-point&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Example log output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;189&amp;gt; Jul  5 15:32:34 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76551 %% Spanning Tree Topology Change Received: MSTID: 0 Po3&#xA;&amp;lt;189&amp;gt; Jul  5 15:32:32 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76550 %% Spanning Tree Topology Change Received: MSTID: 0 Po3&#xA;&amp;lt;189&amp;gt; Jul  5 15:32:31 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76549 %% Spanning Tree Topology Change Received: MSTID: 0 Po3&#xA;&amp;lt;189&amp;gt; Jul  5 15:32:30 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76548 %% Spanning Tree Topology Change: 0, Unit: 1&#xA;&amp;lt;189&amp;gt; Jul  5 15:32:30 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76547 %% Spanning Tree Topology Change Received: MSTID: 0 Po3&#xA;&amp;lt;189&amp;gt; Jul  5 15:32:28 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76546 %% Spanning Tree Topology Change Received: MSTID: 0 Po3&#xA;&amp;lt;189&amp;gt; Jul  5 15:32:27 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76545 %% Spanning Tree Topology Change Received: MSTID: 0 Po3&#xA;&amp;lt;189&amp;gt; Jul  5 15:32:26 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76544 %% Spanning Tree Topology Change: 0, Unit: 1&#xA;&amp;lt;189&amp;gt; Jul  5 15:32:26 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76543 %% Spanning Tree Topology Change Received: MSTID: 0 Po3&#xA;&amp;lt;189&amp;gt; Jul  5 15:32:24 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76542 %% Spanning Tree Topology Change Received: MSTID: 0 Po3&#xA;&amp;lt;189&amp;gt; Jul  5 15:32:23 10.0.6.40-1 TRAPMGR[994142700]: traputil.c(740) 76541 %% Spanning Tree Topology Change Received: MSTID: 0 Po3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user23673" LastEditorUserId="8499" LastEditDate="2016-10-27T23:54:20.407" LastActivityDate="2017-08-08T22:23:05.070" Title="STP and LAG Problems" Tags="|spanning-tree|ieee-802.1ax|cisco-sg300|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="32842" PostTypeId="2" ParentId="27962" CreationDate="2016-07-05T14:55:08.743" Score="1" Body="&lt;p&gt;To recap:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 2 Switch uses MAC addresses to send stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 3 Switch (with routing capability) or a router use IP Addresses to direct packets.&lt;/p&gt;&#xA;" OwnerDisplayName="user27646" LastActivityDate="2016-07-05T14:55:08.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32843" PostTypeId="2" ParentId="32838" CreationDate="2016-07-05T15:29:28.777" Score="1" Body="&lt;p&gt;You cannot decrease the maximum sessions value directly, but you can use Screen options to limit the maximum number of concurrent sessions per source- or destination IP. In your case I would expect a destination-based limit (see &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos15.1x49-d40/topics/concept/denial-of-service-firewall-destination-based-session-limit-understanding.html&quot; rel=&quot;nofollow&quot;&gt;Juniper&lt;/a&gt; documentation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;security {&#xA; screen {&#xA;  ids-option max-1000-sessions-per-host {&#xA;   limit-session {&#xA;    destination-ip-based 1000;&#xA;   }&#xA;  }&#xA; }&#xA; zones {&#xA;  security-zone untrust {&#xA;   screen max-1000-sessions-per-host;&#xA;  }&#xA; }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it sounds really weird that your network is constrained by the number of sessions it can handle. This is usually only relevant for stateful devices like firewalls and load balancers, that are perfectly capable to drop exceeding traffic on their own. If it is &lt;em&gt;bandwidth&lt;/em&gt; that's the problem, then there are probably better knobs to turn than session limits.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-07-05T15:29:28.777" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32844" PostTypeId="2" ParentId="32828" CreationDate="2016-07-05T16:52:17.460" Score="0" Body="&lt;p&gt;That depends on the device. Some devices will let you collect NetFlow information on certain virtual interfaces, e.g. a Cisco 4K switch can have NetFlow on the port channel, and that is usually preferred over the individual channel member ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, a subinterface &lt;em&gt;is&lt;/em&gt; a virtual interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-05T16:52:17.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32848" PostTypeId="1" CreationDate="2016-07-05T19:04:26.267" Score="2" ViewCount="4122" Body="&lt;p&gt;I have a stack of 3750 switches, which have 5 switches in it. One of the switches (switch 4) in the stack is frozen. The way I can tell is because all the lights on the switch are turned on, and I cannot toggle using the mode button in the switch. Also, when I used the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh switch detail&#xA;Switch#  Role   Mac Address     Priority Version  State&#xA;----------------------------------------------------------&#xA;*1       Master xxxx.xxxx.xxxx     15     0       Ready&#xA; 2       Member xxxx.xxxx.xxxx     14     0       Ready&#xA; 3       Member xxxx.xxxx.xxxx     1      0       Ready&#xA; 4       Member 0000.0000.0000     0      0       Provisioned&#xA; 5       Member xxxx.xxxx.xxxx     1      0       Ready&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The switch that is frozen is saying provisioned. How can I fix this? Can I just go ahead and reload this switch in the stack using #slot 4 reload? Can doing so effect any configs in the master switch?&lt;/p&gt;&#xA;" OwnerUserId="25763" LastEditorUserId="8499" LastEditDate="2018-12-25T01:52:48.713" LastActivityDate="2018-12-25T01:52:48.713" Title="One of a switch in a stack is frozen" Tags="|cisco|switch|cisco-catalyst|stacking|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32849" PostTypeId="1" CreationDate="2016-07-05T19:05:42.013" Score="0" ViewCount="274" Body="&lt;p&gt;I have two MacBook Pros and a Cisco RV110W wireless router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have created a VLAN with all ports untagged and I linked this VLAN to a Wi-Fi with the option &quot;Wireless Isolation with SSID&quot; on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From both MacBooks I can successfully connect to the Wi-Fi (previously created) and if I try to ping between them, they can't see each other, which is something I'm happy with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem occurred when I saw in Finder the name of the other MacBook Pro (this has screen sharing (VNC) enabled), so I clicked on it and then provided the credentials, and I was able to connect to the other MacBook Pro, which I thought was not possible due to the Isolation option I enabled in the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;First Question:&lt;/strong&gt; How is it possible they can see each other, if pinging between them showed me that they can't communicate with one another, and the Wi-Fi VLAN has isolation enabled?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Second Question:&lt;/strong&gt; Is Bonjour enabling the communication between them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Third Question:&lt;/strong&gt; How can I truly isolate both MacBooks using this router?&lt;/p&gt;&#xA;" OwnerUserId="27653" LastActivityDate="2017-06-01T16:55:41.860" Title="Bonjour defeating wireless isolation?" Tags="|vlan|ad-hoc-wireless|private-vlan|cisco-wireless|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32850" PostTypeId="2" ParentId="32848" CreationDate="2016-07-05T19:10:11.403" Score="1" Body="&lt;p&gt;If the switch is truly frozen, you will probably have to power it off and back on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the master thinks the switch is only provisioned, that means that it is provisioned in the configuration, but it cannot actually see the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I doubt you can reload the frozen switch from the CLI.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-05T19:10:11.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32851" PostTypeId="2" ParentId="32699" CreationDate="2016-07-05T21:16:15.047" Score="1" Body="&lt;h1&gt;Solution&lt;/h1&gt;&#xA;&lt;p&gt;Add following in flow record, it won't work with &lt;code&gt;ipfix&lt;/code&gt; but it does work with &lt;code&gt;Netflow-v9&lt;/code&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;collect timestamp sys-uptime first&#xA;collect timestamp sys-uptime last&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Exporter enable &lt;code&gt;Netflow-v9&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-07-05T21:16:15.047" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32852" PostTypeId="2" ParentId="32820" CreationDate="2016-07-05T21:23:34.370" Score="1" Body="&lt;p&gt;Does the firewall have a route back to Router1 for the other subnets in the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When pinging the firewall interface are the failures time-outs or unreachables, if unreachables, what type of unreachables are they?&lt;/p&gt;&#xA;" OwnerUserId="23913" LastActivityDate="2016-07-05T21:23:34.370" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32854" PostTypeId="2" ParentId="32848" CreationDate="2016-07-05T22:02:54.610" Score="2" Body="&lt;p&gt;First, there is a chance that resetting a single switch in the stack will affect the entire stack.  A worst case senario is the whole stack reboots.  So, plan for a stack outage and do the work afterhours if necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Power cycle the frozen switch.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-05T22:02:54.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32855" PostTypeId="2" ParentId="32841" CreationDate="2016-07-05T22:07:29.133" Score="1" Body="&lt;p&gt;Stack mode is not recommended for a pair of core switches as it is a shared control plane / single point of failure and software upgrade will result in core outage.  This is not acceptable design.  The core should aim for better than 99.999% uptime (5m 15.6s / year).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use Dell's VLT instead.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-05T22:07:29.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32856" PostTypeId="2" ParentId="29577" CreationDate="2016-07-05T22:18:18.890" Score="-1" Body="&lt;p&gt;Yes.  You certainly can calculate how many &lt;em&gt;at least&lt;/em&gt; if you know your maximum transmission unit, MTU.  You are speaking of frames which is layer2.  So, simply do the math.  Assuming approximately 1500 bytes for Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;80,480 KB (Filesize) / 1.5 KB (MTU) = 53653.33 frames.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-05T22:18:18.890" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32858" PostTypeId="1" AcceptedAnswerId="32875" CreationDate="2016-07-05T23:12:18.913" Score="14" ViewCount="1515" Body="&lt;p&gt;Given a prefix &lt;code&gt;Y&lt;/code&gt;, it's easy to calculate the corresponding netmask: Put &lt;code&gt;Y&lt;/code&gt; times a set bit, and then fill up &quot;to the right&quot; with zeros until one has 32 bits (IPv4) in total.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Prefix &lt;code&gt;24&lt;/code&gt;, thus netmask &lt;code&gt;11111111 11111111 11111111 00000000&lt;/code&gt; or &lt;code&gt;255.255.255.0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can there be a netmask with a different bit pattern&lt;/strong&gt;, such as&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;00000000 11111111 00000000 11111111&lt;/code&gt; (&lt;code&gt;0.255.0.255&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;00000000 11111111 11111111 11111111&lt;/code&gt; (&lt;code&gt;0.255.255.255&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;11111111 11111111 11111111 00000001&lt;/code&gt; (&lt;code&gt;255.255.255.1&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Specifying a &quot;prefix&quot; obviously wouldn't work for these cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(I'm pretty sure the answer is &quot;NO&quot;, but I'm writing some network code, and this needs to work in all possible cases, so I want to be 101% sure.)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="27657" LastActivityDate="2016-07-06T08:56:07.900" Title="Possible (bit) patterns of a netmask" Tags="|ipv4|ip|ipv6|prefix|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32859" PostTypeId="2" ParentId="32858" CreationDate="2016-07-05T23:23:40.577" Score="6" Body="&lt;p&gt;If you are using prefixes and networks, then the answer is no, the bits need to be contiguous. There are cases where a wildcard mask (inverse of mask) can be used, e.g. Cisco ACLs, and those can be any bit pattern. For instance, you could block traffic from all the odd numbered hosts on a network. This seems to still be taught, but I have not seen it used very often (although I have seen it) in the real world.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-05T23:23:40.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32860" PostTypeId="2" ParentId="32858" CreationDate="2016-07-05T23:24:21.987" Score="4" Body="&lt;p&gt;No. A netmask is a continuous series of ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The others are &quot;wildcard&quot; patterns.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-07-05T23:24:21.987" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32862" PostTypeId="2" ParentId="32858" CreationDate="2016-07-06T00:39:58.370" Score="3" Body="&lt;p&gt;When TCP/IP first came out and got widespread, there were actually a lot of subnets with non-contiguous masks.  But as addresses became scarce, the overhead to the rest of the net to allow global routing of these prefixes rather than forcing everything to be only prefix based; was too much and the global network changed to only supporting prefixes.  There may actually still be legacy networks that use non-contiguous masks internally (many IGPs support this, still).  But, when such a network connects to The Internet, it has a single prefix that covers all of them, that it advertises into BGP.  And, of course, EGP (the predecessor to BGP) only supported Classful addressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know several players with original issue Class A networks that used non-contiguous netmasks internally for one reason or another.  I just don't know if any of them are still doing it.  A lot of them don't even exit any more.  The ARPAnet had an internal netmask of 255.0.0.255 (IIRC).&lt;/p&gt;&#xA;" OwnerUserId="6388" LastActivityDate="2016-07-06T00:39:58.370" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="32869" PostTypeId="1" AcceptedAnswerId="32882" CreationDate="2016-07-06T07:54:13.433" Score="4" ViewCount="2659" Body="&lt;p&gt;I've been working on some multicast protocols and I came across MBGP and I want to know why is it needed. &#xA;The way everyone uses MBGP is that they set up PIM in every routers, and for the inter domain protocol, they use MBGP. &#xA;I don't understand why can'g BGP forward these packets. It's not like multicast packets are different in forwarding than unicast. BGP is capable of forwarding every other packet, why not multicast? Why must we use MBGP?&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="27665" LastActivityDate="2016-07-08T06:42:23.040" Title="Why is MBGP needed?" Tags="|bgp|multicast|pim|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="32871" PostTypeId="2" ParentId="32849" CreationDate="2016-07-06T08:25:08.557" Score="2" Body="&lt;p&gt;I think SSID isolation is not the same as Client Isolation. Some controllers will have both and I believe they perform two different tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With SSID isolation, it simply means that if you have multiple SSID's and clients connected to them, the clients from different SSID's will not be able to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With client isolation ( which is what you want ), clients on the same network will not be able to communicate with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible that the ping not going through is a red herring and is not due to the SSID isolation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can, setup a second SSID and connect each Mac Book to a different SSID and see if you can still connect via VNC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, if you really want to seperate them, I would go with what Ron said and create two seperate VlAN's and block them of with access control entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-07-06T08:25:08.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32872" PostTypeId="1" AcceptedAnswerId="32874" CreationDate="2016-07-06T08:30:42.197" Score="0" ViewCount="125" Body="&lt;p&gt;i have to construct a subnet in cisco packet tracer using this ip that was supposedly given by the IPS:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;79.48.0.0/16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when i try to configurate the routing using RIP, and put for example 79.48.2.0 i get in the RIP network addresses 79.0.0.0 (255.0.0.0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In normal cases, when using for example: 192.168.1.0 it appears correctly, so what it's going on? I'm using a 24 bit mask for 4 subnet &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(79.48.0.0, 79.48.1.0, 79.48.2.0, 79.48.3.0)(all using this mask 255.255.255.0) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and a serial cable (10.0.0.0 255.0.0.0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(here's a example)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/swKua.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/swKua.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27664" LastActivityDate="2016-07-12T02:55:52.253" Title="What is the correct way to construct this subnet" Tags="|cisco|routing|subnet|rip|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="32874" PostTypeId="2" ParentId="32872" CreationDate="2016-07-06T08:45:24.387" Score="3" Body="&lt;p&gt;This is correct, the reason why you are seeing this is because you are using RIPv1 which can only deal with classful addresses and does not support VLSM. The address range you are trying to configure is a Class A address which has a /8 (255.0.0.0) subnet mask and you can't use a /16 mask as it belongs to Class B addresses in a classful process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to use classless addresses and use VLSM so that you can divide your subnet into smaller bits, you need to change the RIP version to RIPv2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To change this, you can do something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA;&#xA;version 2&#xA;&#xA;network 79.48.2.0&#xA;&#xA;no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We also turn off auto-summary so that it doesn't summarize the network into a classful network as you are seeing now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please also remember that RIPv1 is very old and you probably shouldn't be using it. If you must use RIP, make sure it is version 2 as it has many improvements over version 1, and using classless addresses is one of them :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-07-06T08:45:24.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32875" PostTypeId="2" ParentId="32858" CreationDate="2016-07-06T08:56:07.900" Score="12" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc950&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC950&lt;/a&gt; states that&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Since the bits that identify the subnet are specified by a bitmask,&#xA;they need not be adjacent in the address. However, we recommend that&#xA;the subnet bits be contiguous and located as the most significant bits&#xA;of the local address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Most devices follow this recommendation as far as to enforce it. I have only managed to use non-contiguous subnet masks on Linux-only networks back in 2012; the Windows, OSX, Cisco and HP devices I tested didn't handle/allow it.&lt;/p&gt;&#xA;" OwnerUserId="5518" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-07-06T08:56:07.900" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32876" PostTypeId="1" AcceptedAnswerId="32879" CreationDate="2016-07-06T11:15:44.217" Score="1" ViewCount="1539" Body="&lt;p&gt;Just wondering if you could help figure out what im trying to play with.&lt;br&gt;&#xA;So Basically i have a Cisco 3750 Switch which is connected to my modem router.&#xA;created 2 vlan(SALES and HR).&lt;br&gt;&#xA;HOW CAN I GIVE ACCESS TO INTERNET FOR THIS PC's Connected to these vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;here are some config in my switch.&lt;br&gt;&#xA;dsl modem router - 192.168.1.1&lt;br&gt;&#xA;vlan1 (default) - 192.168.1.254 255.255.255.0&lt;br&gt;&#xA;vlan 10 (SALES) - 192.168.10.1 255.255.255.0&lt;br&gt;&#xA;vlan 20 (HR) - 192.168.20.1 255.255.255.0  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;int fa0/1 - connected to modem router&lt;br&gt;&#xA;int range fa0/2-12 - switchport mode access and switchport access vlan 10&lt;br&gt;&#xA;int range fa0/13-24 - switchport mode access and switchport access vlan 20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip default-gateway 192.168.1.1&lt;br&gt;&#xA;ip route 0.0.0.0 0.0.0.0 192.168.1.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am i missing something? hope you can help me out guys, thanks in advance and appreciate it so much.  &lt;/p&gt;&#xA;" OwnerUserId="25808" LastActivityDate="2016-07-06T11:36:26.763" Title="Cisco 3750 VLANS not connecting to internet" Tags="|cisco|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32877" PostTypeId="2" ParentId="32876" CreationDate="2016-07-06T11:25:55.820" Score="0" Body="&lt;p&gt;I think you forgot to create NAT-Rules for the VLANS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you translate your internal IP to your Public IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is on my Router configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside,outside) source static any interface unidirectional&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22401" LastActivityDate="2016-07-06T11:25:55.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32878" PostTypeId="1" CreationDate="2016-07-06T11:32:28.430" Score="0" ViewCount="1361" Body="&lt;p&gt;I have a wireless ADSL router DLink DSL-2730U. Everything works fine except that the wireless network sometimes disappears randomly. When the network disappears I also see a network with SSID DLink_DWR-116 that appears with almost no signal strength. This network only appears when my configured network disappears and I am almost positive that this is not a weak signal from a neighbors router. This symptom is on Ubuntu 16.04 as well as from my Android phone. A Windows 8 laptop almost always fails to connect to the network even when the network is visible.&lt;/p&gt;&#xA;" OwnerUserId="27669" LastActivityDate="2016-07-06T15:59:54.947" Title="Wireless network randomly disappears with router DLink DSL-2730U" Tags="|router|wireless|ieee-802.11|" AnswerCount="2" CommentCount="2" ClosedDate="2016-07-06T17:05:03.770" ContentLicense="CC BY-SA 3.0" />
  <row Id="32879" PostTypeId="2" ParentId="32876" CreationDate="2016-07-06T11:36:26.763" Score="2" Body="&lt;p&gt;I can see you have a default route to your modem/router, but it does not appear you have routing enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Switch(config)#ip routing&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To enable routing. This in turn will allow inter vlan routing and allow data to get out from the other subnets to your DSL Modem/Router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure your client devices have the correct gateways set for the appropiate subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your DSL Modem/Router is not performing NAT already, you need to do what SystemCookie has posted and enable NAT on the Cisco switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-07-06T11:36:26.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32881" PostTypeId="2" ParentId="32878" CreationDate="2016-07-06T13:52:32.553" Score="0" Body="&lt;p&gt;This might be a result of interference with another network which uses the same channel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To remedy this, log in to your router's management page and try to change the channel to something else, preferably 1, 6 or 13 (might not be available in all routers).&lt;/p&gt;&#xA;" OwnerUserId="27673" LastActivityDate="2016-07-06T13:52:32.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32882" PostTypeId="2" ParentId="32869" CreationDate="2016-07-06T15:10:50.540" Score="7" Body="&lt;p&gt;MBGP or Multiprotocol BGP extensions&lt;/p&gt;&#xA;&lt;p&gt;The first BGP specification was published in 1989, well before IPv6 was created and only shortly after multicast was added to IPv4. Even BGP-4 doesn’t support IPv6, multicast or VPNs. Until 1998, that is, when &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2283&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2283&lt;/a&gt; introduced the multiprotocol extensions. These allow BGP to handle routing information for arbitrary &amp;quot;address families&amp;quot;. In practice, an address family is associated with a specific network layer protocol, such as IPv4, IPv6, IPX or AppleTalk. There are also Address Family Identifier (&lt;a href=&quot;http://www.iana.org/assignments/address-family-numbers&quot; rel=&quot;nofollow noreferrer&quot;&gt;AFI&lt;/a&gt;) numbers for tunneling mechanisms such as VPNs and MPLS. A Subsequent Address Family Identifier (SAFI) further specifies unicast versus multicast or more tunneling options.&lt;/p&gt;&#xA;&lt;p&gt;When routers make a BGP connection, they exchange the AFIs and SAFIs they’re prepared to exchange routing information for. If the two routers agree on those, they’ll send UPDATE messages containing the regular path attributes with the prefixes (also known as Network Layer Reachability Information, NLRI) and next hops encoded in an MP_REACH_NLRI attribute. Withdrawn routes are encoded in an MP_UNREACH_NLRI attribute.&lt;/p&gt;&#xA;" OwnerUserId="14080" LastEditorUserId="-1" LastEditDate="2021-10-07T06:47:20.403" LastActivityDate="2016-07-06T15:10:50.540" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32883" PostTypeId="2" ParentId="24211" CreationDate="2016-07-06T15:59:34.290" Score="0" Body="&lt;p&gt;Unless you create a VPN between the sites/companies you will need some edge gateways with STUN/TURN functionality.  Have a look at &lt;a href=&quot;https://webrtc.org/&quot; rel=&quot;nofollow&quot;&gt;WebRTC&lt;/a&gt;.  They have a really nice introductory site with examples and labs.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-06T15:59:34.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32884" PostTypeId="2" ParentId="32878" CreationDate="2016-07-06T15:59:54.947" Score="2" Body="&lt;p&gt;The Wi-Fi receiver on your computer is constantly measuring:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;desired signal strength&lt;/li&gt;&#xA;&lt;li&gt;noise signal strength&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Using tools like LinSSID you can monitor the WiFi performance. In most cases signal and noise will be negative numbers. This is because the measurement of the wireless signal in watts is converted to a logarithmic ratio unit (dBm). &#xA;So if signal power is grater than 1 milliwatt, dBm value will be positive else negative. &#xA;Generally the signal measurement will be between around -10 and -70 dBm, and  the noise between -80 to -100 dBm. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What you can do&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To know if the channel you are using is busy, you can use software like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;LinSSID (or others); &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;that are free tools for Ubuntu Linux and helps you to understand if there is a problem with your wireless network. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Most home wireless routers are set up to change channel automatically (default configuration). Setting a static channel is not a good idea on environments where you cannot control every wireless device.&lt;/li&gt;&#xA;&lt;li&gt;Change source position &lt;/li&gt;&#xA;&lt;li&gt;Increase the radio power (if it's low)&lt;/li&gt;&#xA;&lt;li&gt;Remove obstructions (some kind of objects (i.e metal) can degrade the quality of the signal). Common obstructions are Cabinets or drawers, Mirrors, Glasses, Metal Objects,Thick walls and ceilings, Aquariums&lt;/li&gt;&#xA;&lt;li&gt;(If automatic procedure don't do it) force the channel to change to one is more free&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The most important thing is the signal-to-noise ratio. &#xA;Data corruption and therefore re-transmissions will occur if the received signal is too close to the noise floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: a received signal of -65 dBm can be considered good at location that has a noise floor of -90 dBm (SNR 25 dB) but not so much at a location with a noise floor of -80 dBm (SNR 15 dB). [Cisco Meraki Documentation example]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Generally, a signal with an SNR value of 20 dB or more is recommended for data networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, more distance there is between signal and noise floor better is for your wifi network. &lt;/p&gt;&#xA;" OwnerUserId="25080" LastActivityDate="2016-07-06T15:59:54.947" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32885" PostTypeId="1" CreationDate="2016-07-06T16:47:54.890" Score="1" ViewCount="9222" Body="&lt;p&gt;There is a situation here, I am trying to add a new switch to an exisiting stack and i found out that the switch image in my current stack and the new switch is different. Can i still go ahead and add the switch to the stack?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exisiting Stack: sh version&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch Ports Model              SW Version            SW Image&#xA;------ ----- -----              ----------            ----------&#xA;*    1 52    WS-C3750G-48PS     12.2(55)SE6           C3750-IPBASEK9-M&#xA;     2 52    WS-C3750-48P       12.2(55)SE6           C3750-IPBASEK9-M&#xA;     3 52    WS-C3750-48P       12.2(55)SE6           C3750-IPBASEK9-M&#xA;     4 52    WS-C3750-48P       12.2(55)SE6           C3750-IPBASEK9-M&#xA;     5 52    WS-C3750-48P       12.2(55)SE6           C3750-IPBASEK9-M&#xA;     6 52    WS-C3750-48P       12.2(55)SE6           C3750-IPBASEK9-M&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;New Switch: sh version&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch Ports Model              SW Version            SW Image&#xA;------ ----- -----              ----------            ----------&#xA;*    1 52    WS-C3750-48P       12.2(55)SE10          C3750-IPSERVICESK9-M&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25763" LastEditorUserId="8499" LastEditDate="2018-03-02T18:46:46.317" LastActivityDate="2018-03-02T18:46:46.317" Title="Cisco 3750 switch stack with different IOS images" Tags="|cisco|switch|cisco-catalyst|stacking|cisco-3750|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32887" PostTypeId="2" ParentId="32885" CreationDate="2016-07-06T17:48:37.573" Score="5" Body="&lt;p&gt;You should really set the IOS version to be the same before adding a switch to the stack. Basically, the switches need to have the same stack protocol version, and only switches with the same IOS version are guaranteed to have that. Switches with the same major version numbers &lt;em&gt;probably&lt;/em&gt; have the same stack protocol version, but that is not guaranteed. Having the same IOS version on a switch before adding it to a stack can save you problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a very good document, which contains a full explanation about this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/71925-cat3750-create-switch-stks.html&quot; rel=&quot;noreferrer&quot;&gt;Creation and Management of Catalyst 3750 Switch Stacks&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Software Compatibility&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Software compatibility between the stack members is determined by the&#xA;  Stack Protocol Version number. To view the stack protocol version of&#xA;  your switch stack, you can issue the &lt;strong&gt;show platform stack manager&#xA;  all&lt;/strong&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3750-Stk# show platform stack manager all&#xA;                                               Current&#xA;Switch#  Role      Mac Address     Priority     State&#xA;--------------------------------------------------------&#xA; 1       Slave     0016.4748.dc80     5         Ready&#xA;*2       Master    0016.9d59.db00     1         Ready&#xA;&#xA;!--- part of output elided&#xA;&#xA;&#xA;                 Stack State Machine View&#xA;==============================================================&#xA;&#xA;Switch   Master/   Mac Address          Version    Uptime   Current&#xA;Number   Slave                          (maj.min)            State&#xA;---------------------------------------------------------------------&#xA;1        Slave     0016.4748.dc80          1.11        8724    Ready&#xA;2        Master    0016.9d59.db00          1.11        8803    Ready&#xA;&#xA;!--- rest of output elided&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Switches with the same Cisco IOS software version have the same stack&#xA;  protocol version. Such switches are fully compatible, and all features&#xA;  function properly across the switch stack. Switches with the same&#xA;  Cisco IOS software version as the stack master immediately join the&#xA;  switch stack.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If an incompatibility exists, the fully functional stack members&#xA;  generate a system message that describes the cause of the&#xA;  incompatibility on the specific stack members. The stack master sends&#xA;  the message to all stack members.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Switches with different Cisco IOS software versions likely have&#xA;  different stack protocol versions. Switches with different major&#xA;  version numbers are incompatible and cannot exist in the same switch&#xA;  stack.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3750-Stk# show switch&#xA;                                               Current&#xA;Switch#  Role      Mac Address     Priority     State&#xA;--------------------------------------------------------&#xA; 1       Member    0015.c6f5.6000     1         Version Mismatch&#xA;*2       Master    0015.63f6.b700     15        Ready&#xA; 3       Member    0015.c6c1.3000     5         Ready&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Switches with the same major version number but with a different minor&#xA;  version number as the stack master are considered partially&#xA;  compatible. When connected to a switch stack, a partially compatible&#xA;  switch enters version-mismatch (VM) mode and cannot join the stack as&#xA;  a fully functional member. The software detects the mismatched&#xA;  software and tries to upgrade (or downgrade) the switch in VM mode&#xA;  with the switch stack image or with a tar file image from the switch&#xA;  stack flash memory. The software uses the automatic upgrade&#xA;  (auto-upgrade) and the automatic advise (auto-advise) features.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The auto-upgrade occurs if the software release that runs on the stack&#xA;  master is compatible with the switch in VM mode and the tar file of&#xA;  the current image is available with any of the stack members. If tar&#xA;  file of the current image is not available, the auto-advise feature&#xA;  will recommend that a compatible image be downloaded with the required&#xA;  commands. The auto-upgrade and auto-advise features do not work if the&#xA;  switch master and switch in VM mode run different feature&#xA;  sets/packaging levels (IP services and IP base), but, from Cisco IOS&#xA;  Software Release 12.2(35)SE, auto-upgrade does support upgrades&#xA;  between cryptographic and non-cryptographic images of the same&#xA;  packaging level.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; If the auto upgrade does not work on the switch that shows the version mismatch error, use TFTP to manually upgrade the switch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-06T17:57:06.613" LastActivityDate="2016-07-06T17:57:06.613" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32888" PostTypeId="1" CreationDate="2016-07-06T18:23:39.837" Score="1" ViewCount="419" Body="&lt;p&gt;I have my main network on X0 on the Sonicwall NSA3500 and use a DHCP server on a linux box in my main network.  This subnet is 192.168.20. I have a Wireless Access Point connected to the X3 interface on the Sonicwall.  Can I use the Sonicwall DHCP server for this interface to give IP addresses (different subnet) to the Guest computers or do I need to use the existing linux DHCP server and configure it with multiple NICS?&lt;/p&gt;&#xA;" OwnerUserId="27680" LastActivityDate="2016-07-07T06:06:50.973" Title="Sonicwall Interfaces and DHCP servers" Tags="|dhcp|linux|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32889" PostTypeId="2" ParentId="32885" CreationDate="2016-07-06T19:11:36.880" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/71925-cat3750-create-switch-stks.html#softcomp&quot; rel=&quot;nofollow&quot;&gt;See Creation and Management of Catalyst 3750 Switch Stacks&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Software Compatibility&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches with the same major version number but with a different minor version number as the stack master are considered partially compatible. When connected to a switch stack, a partially compatible switch enters version-mismatch (VM) mode and cannot join the stack as a fully functional member. &lt;strong&gt;The software detects the mismatched software and tries to upgrade (or downgrade) the switch&lt;/strong&gt; in VM mode with the switch stack image or with a tar file image from the switch stack flash memory. The software uses the automatic upgrade (auto-upgrade) and the automatic advise (auto-advise) features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: If the auto upgrade does not work on the switch that shows the version mismatch error, use TFTP to manually upgrade the switch.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-06T19:11:36.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32892" PostTypeId="1" CreationDate="2016-07-06T19:47:51.017" Score="2" ViewCount="848" Body="&lt;p&gt;I am a networking newbie so please go easy on me. I am studying VLANs and for a fictional project, I want to use tag-based VLANs. In the project, there are three layer 3 switches with multiple wireless access points connected to them. I want to use one VLAN ID with tagging for students on the network and another for faculty at a fictional campus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my project I decided to give faculty the VLAN ID of 2, and students the ID of 3. I was wondering how the faculty's and students' workstations know what VLAN it would be on. After a search I found that in the NIC settings, one can enter which VLAN ID to connect to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question would be is what is to prevent a student from putting down the VLAN ID of 2 down to access resources that should only be accessible by faculty? I read about VLAN hopping, but I am not sure how it relates to this scenario. Is there a better way to assign the workstations (laptops primarily) VLAN IDs?&lt;/p&gt;&#xA;" OwnerUserId="27682" LastEditorUserId="8499" LastEditDate="2016-07-07T00:43:39.883" LastActivityDate="2016-07-07T02:45:23.630" Title="How do I properly implement tag-based VLANs?" Tags="|vlan|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32893" PostTypeId="2" ParentId="32892" CreationDate="2016-07-06T19:55:48.820" Score="2" Body="&lt;p&gt;You misunderstand VLAN tags. Ethernet frames can be tagged on trunks. This lets the switches on each end of the trunk link separate the frames on the trunk into the correct VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access connections (where end-devices connect) don't tag frames, and most end-devices don't understand VLAN tags. You can configure access ports to be in a VLAN, but the frames through those ports are not tagged. The frames only get tagged if they must traverse a trunk, and the tags are removed if the frames leave through an access port. Your end-devices should be unaware that they are even on a VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A student should not have access to change the switch configuration to change the VLAN of his access port, so his PC will only be in the VLAN for which the access port is configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your comment about using Wi-Fi, The Wi-Fi clients only know about the SSID to which they connect. Each SSID represents a different network. A WAP is a translating bridge (it translates between ethernet and Wi-Fi). When Wi-Fi frames come into the WAP, and they need to be sent to the wired network, the WAP can be connected to the wired network with a trunk, and each SSID can be assigned to a different VLAN. The reverse happens when frames from the wired network, with VLAN tags, reach the WAP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-06T22:08:43.190" LastActivityDate="2016-07-06T22:08:43.190" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32894" PostTypeId="2" ParentId="32892" CreationDate="2016-07-06T20:08:54.427" Score="2" Body="&lt;p&gt;The assignment of VLAN is done by the network, not by the endpoint.  On a wired LAN (switch) this is configured per port, the default is usually VLAN 1.  On a wireless LAN (AP), this is configured per SSID (per WiFi network it is said).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AP plugs into the switch via a trunk port that carries all VLANs.  This link is called a trunk link.  The frames are said to be tagged to a particular VLAN.  So, the AP may broadcast more than one VLAN.  Maybe teacher VLAN has a password and student vlan does.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-06T20:08:54.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32896" PostTypeId="1" AcceptedAnswerId="32897" CreationDate="2016-07-06T21:58:04.590" Score="0" ViewCount="129" Body="&lt;p&gt;Correct me if I am wrong, but in a LAN, when a packet sent by a computer has a destination located in the Internet, it will send it to the gateway (which is a router only right?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I want to implement a proxy. I was thinking about setting the proxy as a gateway. The proxy will then redirect packets to the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it the good way? If not, what is the other alternative?&lt;/p&gt;&#xA;" OwnerUserId="23817" LastActivityDate="2016-07-06T23:13:56.790" Title="Best way to place a proxy in a network?" Tags="|router|lan|proxy|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32897" PostTypeId="2" ParentId="32896" CreationDate="2016-07-06T22:53:01.440" Score="2" Body="&lt;p&gt;To be more specific, if the packet is not on the connected network, the computer will forward it to the address (next-hop) based on the longest match in the routing table.  For most computers, there is only one route in the table, known as the default route. The next-hop of the default route is usually called the default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The gateway is often a router, but it can be another device such as a firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Proxies are application-specific -- they are application-layer devices.  So you would not configure the proxy as the default gateway.  Instead, you would configure the application to forward packets to the proxy.  Because it is an application-layer device, the proxy can be anywhere in the network, although it is common to put it in a DMZ network.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-07-06T23:13:56.790" LastActivityDate="2016-07-06T23:13:56.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32898" PostTypeId="1" CreationDate="2016-07-06T23:16:18.533" Score="1" ViewCount="122" Body="&lt;p&gt;Windows homelab LAN:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How come arp -d does not work consistently? I run the command and the ARP table is not cleared, yet when I run it again a few moments later it does work but leaves certain machines and not others in its table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, in the ARP table, in the &quot;type&quot; field it will label a certain machine as &quot;dynamic&quot; when it is a static IP--or is dynamic and static used differently here?&#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19051" LastActivityDate="2016-07-12T02:43:48.497" Title="Questions about ARP" Tags="|cisco|switch|mac-address|arp|broadcast|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32901" PostTypeId="2" ParentId="32898" CreationDate="2016-07-06T23:40:21.630" Score="1" Body="&lt;p&gt;You cannot delete the arp cache for a node for which there is an active conversation -- it'll just relearn it instantly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Dynamic&quot; and &quot;static&quot; have to do with the &lt;em&gt;ARP TABLE&lt;/em&gt; itself. A static entry is one you manually added. Dynamic is one learned on the wire.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-07-06T23:40:21.630" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32906" PostTypeId="2" ParentId="32892" CreationDate="2016-07-07T02:32:37.410" Score="2" Body="&lt;p&gt;Elderly equipment was limited (device port or trunk port, never the twain shall meet.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;More recent (by which I do not mean new) equipment is less limited, and can have ports that have both untagged and tagged traffic (from different VLANs) on them. I have 3com (so you know they are not new) switches from both of these flavors, and the older ones are on the shelf.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under the &quot;modern&quot; scheme ports have several settings that govern how they behave - incoming untagged traffic can be assigned to a VLAN, while incoming tagged traffic is left on the VLAN it's on; or incoming untagged traffic can be discarded (which is more similar to an older trunk port setup.) Traffic tagged with a VLAN that's not assigned to the port is dropped in any case. Outgoing traffic from one VLAN can be untagged as it exits the port - any others need to be tagged, or all can be tagged (similar to an older trunk port).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it is uncommon for most end-users to use (or understand) the functionality, &quot;end-user&quot; computers can in fact handle VLAN tagging, and it's folly to assume they cannot (don't expose something to end users in the belief they can't touch it.) I have a 2006 MacBook laptop that's been happily connected to VLAN1 (untagged) and VLAN4 (Tagged) for several months now, since I wanted it to be accessible from both networks. It's easy enough to find the same ability in Windows (I just haven't really used it there.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most &quot;enterprise&quot; WiFi will (or can) assign a SSID to a VLAN. Fancier/newer implementations will (or can) assign a VLAN when a user signs into the RADIUS server (so two users on the same SSID could be assigned to different VLANs depending on their sign-in credentials.) Whether or not you make use of dynamic VLANs, using a RADIUS server (WPA2 enterprise) makes it much harder for &quot;students&quot; to get access to the &quot;faculty&quot; network, and also lets you know which faculty to have a little chat with if they do, since each user has a unique password, rather than &quot;anyone who knows &lt;em&gt;TheSecret123FacultyPa55w0rd&lt;/em&gt; can get on the faculty network.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a normal install, you assign wired end-use ports to one VLAN and untag them (the old-fashioned approach.) APs get ports tagged with the VLANs that the SSIDs are assigned to, or that are the various dynamic VLANs users will be assigned to. Trunks between switches are tagged. &lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2016-07-07T02:45:23.630" LastActivityDate="2016-07-07T02:45:23.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32908" PostTypeId="2" ParentId="32888" CreationDate="2016-07-07T04:49:14.260" Score="1" Body="&lt;p&gt;Because it's a different subnet you can use the DHCP on the Sonicwall - however, you will have to configure the DHCP for the specific scope you're looking for and ensure it's only for that subnet, and be sure that subnet is excluded from your other DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless there's a specific reason to use just that subnet (e.g. wireless intrusion detection/protection, etc), you will be better off using a single DHCP for all of your network, if for no other reason than it's a single place to configure and troubleshoot, and has fewer points of failure. This assumes the AP is intended for internal users (e.g. employees with their laptops or mobile phones). However, if you're using the wireless scope for end-users, customers, the public or anyone you don't particularly trust with the safety of your network, then keeping it on it's own subnet is a very good risk-mitigation and security strategy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the latter case, instructions for configuring DHCP on a Soniwall can be found here: &lt;a href=&quot;http://help.mysonicwall.com/sw/eng/305/ui2/23100/Network/Dynamic_Range_Configuration.htm&quot; rel=&quot;nofollow&quot;&gt;http://help.mysonicwall.com/sw/eng/305/ui2/23100/Network/Dynamic_Range_Configuration.htm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27515" LastEditorUserId="27515" LastEditDate="2016-07-07T06:06:50.973" LastActivityDate="2016-07-07T06:06:50.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32909" PostTypeId="1" AcceptedAnswerId="32910" CreationDate="2016-07-07T06:21:01.800" Score="1" ViewCount="668" Body="&lt;p&gt;&lt;strong&gt;Problem&lt;/strong&gt;&lt;br&gt;&#xA;Socket Connection between 192.168.1.1(Server) and 192.168.1.12(Client) can NOT be established (See Fig. 1).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Tests&lt;/strong&gt;&lt;br&gt;&#xA;Test 1: &quot;Ping&quot;&lt;br&gt;&#xA;&lt;code&gt;ping 192.168.1.2 -S 192.168.1.1&lt;/code&gt; -&gt; Success&lt;br&gt;&#xA;&lt;code&gt;ping 192.168.1.12 -S 192.168.1.11&lt;/code&gt; -&gt; Success&lt;br&gt;&#xA;&lt;code&gt;ping 192.168.1.12 -S 192.168.1.1&lt;/code&gt; -&gt; Fail  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test 2: &quot;Socket Connection&quot;&lt;br&gt;&#xA;Socket Connection between 192.168.1.1(Server) and 192.168.1.2(Client) can be be established.&lt;br&gt;&#xA;Datas have been received and sent successfully.&lt;br&gt;&#xA;Socket Connection between 192.168.1.1(Server) and 192.168.1.12(Client) can NOT be established.&lt;br&gt;&#xA;BeginAccept's callback at SocketSever has NEVER been called.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test 3: &quot;Alternate Endpoint Devices&quot;&lt;br&gt;&#xA;Socket Connection between 192.168.1.1(Server) and 192.168.1.2(Client) can be be established.&lt;br&gt;&#xA;Socket Connection between 192.168.1.1(Server) and 192.168.1.12(Client) can NOT be established.&lt;br&gt;&#xA;Therefore, Both of Endpoint Devices work finely (Actually they are same products)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test 4: &quot;Another network structure&quot;&lt;br&gt;&#xA;On another network structure, all works finely (See Fig. 2).&lt;br&gt;&#xA;However i can not take this solution because i can not put a HUB between Left and Right USB-ETHERNET.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My assumption&lt;/strong&gt;&lt;br&gt;&#xA;This problem caused by that both networks are isolated and can't interact each other.&lt;br&gt;&#xA;If there is any Windows application works like &quot;HUB&quot;, it might resolve this case.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Any suggestions or solutions?&lt;/strong&gt;&lt;br&gt;&#xA;Thank you for helping.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xot1H.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xot1H.png&quot; alt=&quot;Fig. 1&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Xpnyq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xpnyq.png&quot; alt=&quot;Fig. 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27692" LastActivityDate="2016-07-07T06:33:44.717" Title="Network/Socket Connection Issue" Tags="|tcp|dhcp|bridge|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32910" PostTypeId="2" ParentId="32909" CreationDate="2016-07-07T06:33:44.717" Score="1" Body="&lt;p&gt;Setup #1 doesn't work because you have &lt;em&gt;two&lt;/em&gt; networks, and both are 192.168.1.0/24. It works in setup #2 because there's only one network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simplest option -- if you &lt;em&gt;must&lt;/em&gt; persist with Fig. 1 -- is to setup the two USB interfaces as a &quot;bridge&quot;. (Desktop versions of Windows won't act as a router -- connection sharing isn't routing.)&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-07-07T06:33:44.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32912" PostTypeId="1" AcceptedAnswerId="32913" CreationDate="2016-07-07T07:46:57.507" Score="1" ViewCount="2923" Body="&lt;p&gt;I've got a Cisco ASA forwarding syslog messages to a remote server (which is working great). However, after reviewing the logs, I've noticed a &lt;em&gt;lot&lt;/em&gt; of 302013 and 302014 events with one particular destination IP address. I guess that, for whatever reason, many machines are making connections to that host. And while I'm interested in these 302013/302014 messages generally, I'm not interested in traffic to this particular destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example event would look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%ASA-6-302014: Teardown TCP connection 494106862 for outside:198.51.100.83/443 to inside:192.0.2.170/47599 duration 0:00:00 bytes 6754 TCP FINs&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any way to not generate these events given a particular source or destination IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen options for &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/monitor_syslog.html#41942&quot; rel=&quot;nofollow&quot;&gt;disabling messages of a particular type&lt;/a&gt; or &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/monitor_syslog.html#58855&quot; rel=&quot;nofollow&quot;&gt;limiting the rate of a particular message&lt;/a&gt; but nothing specifically for filtering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Yes, I realize that one could possibly(?) filter on the receiving end, however at approximately 2 million messages per hour, it's a lot of noise to be filtering out on that side.&lt;/p&gt;&#xA;" OwnerUserId="27696" LastEditorUserId="27696" LastEditDate="2016-07-07T07:50:39.443" LastActivityDate="2021-09-16T12:22:02.920" Title="Cisco ASA syslog filtering" Tags="|cisco-asa|syslog|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32913" PostTypeId="2" ParentId="32912" CreationDate="2016-07-07T08:59:54.797" Score="1" Body="&lt;p&gt;The ASA can only filter messages by severity, or by log message class, or by individual log message. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, there is no way for the ASA to filter on a specific attribute or value within a particular log message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As was pointed out, this type of filtering is best done on the receiving end. I know you mentioned there is already a performance hit, but there would be the same (if not worse) performance hit on the Firewall, and the Firewall is typically passing traffic beyond just syslog, so would be more risky.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-07-07T08:59:54.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32914" PostTypeId="2" ParentId="32801" CreationDate="2016-07-07T09:02:07.720" Score="2" Body="&lt;p&gt;I got a response from Cisco:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;“Because of hardware limitation, &quot;no ip redirect&quot; does not work in&#xA;  Catalyst 3560 and 3750. If routing is performed on access switch and&#xA;  the next hop of the packet is a host on the same subnet of the ingress&#xA;  layer 3 interface, the frame is still punted to the CPU.”&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And there is also this thread &lt;a href=&quot;https://supportforums.cisco.com/discussion/11410821/flooding-icmp-q-3750-switch&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/11410821/flooding-icmp-q-3750-switch&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="539" LastActivityDate="2016-07-07T09:02:07.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32920" PostTypeId="2" ParentId="32829" CreationDate="2016-07-07T12:26:51.127" Score="0" Body="&lt;p&gt;I had the same problem. However, I have fixed it by changing the permission of the directory I have installed the flowvisor. for instance chmod 777 flowvisor---&gt; in my case. I hope it helps you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BRG&#xA;HG&lt;/p&gt;&#xA;" OwnerUserId="25262" LastActivityDate="2016-07-07T12:26:51.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32921" PostTypeId="1" AcceptedAnswerId="32922" CreationDate="2016-07-07T13:29:55.613" Score="4" ViewCount="1412" Body="&lt;p&gt;I was learning about the process of closing TCP connection and the process differs in many sources I've come across. In official Cisco cert guide (100-105) the process is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1) ACK, FIN ----&amp;gt;&#xA;2)          &amp;lt;---- ACK&#xA;3)          &amp;lt;---- ACK, FIN&#xA;4) ACK      ----&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I just don't see the purpose of ACK in 3) as there is already an acknowledgement in 2). Also, in older Cisco study materials, the process goes without 2) as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On top of that, I have this WireShark capture that made me even more confused:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Xqnoo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xqnoo.png&quot; alt=&quot;Wireshark capture of TCP termination&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically the same thing, what is the extra ACK in packet #38 for? Acknowledgement was already sent in #37. And both also have the same Ack number. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone give me a little insight if all those are possible in certain situations or which one is correct?&lt;/p&gt;&#xA;" OwnerUserId="23777" LastActivityDate="2016-07-07T16:11:00.087" Title="Unnecessary ACK in closing TCP connection" Tags="|tcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32922" PostTypeId="2" ParentId="32921" CreationDate="2016-07-07T13:37:10.200" Score="3" Body="&lt;p&gt;The ACK flag is set when the acknowledgment number is valid.  It is therefore set on all packets in a TCP flow except for the initial SYN packet, so by the time you are sending FINs, all packets will be ACKs.  You don't need to worry abut it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An acknowledgement isn't a one-time thing, subsequent packets will all acknowledge the same data if no more has been received (by the end that sends the ACK).  This works in both directions. &lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-07-07T13:37:10.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32923" PostTypeId="1" AcceptedAnswerId="33282" CreationDate="2016-07-07T15:16:10.267" Score="1" ViewCount="1438" Body="&lt;p&gt;Currently I have set 1:1 NAT to translate 1 public IP to 1 private IP but is there any way to set multiple public IPs to one private IP on NSA 2400? Or I need to set another 1:1 NAT with different private IP and add that IP as secondary to that device from the first NAT?&lt;/p&gt;&#xA;" OwnerUserId="19263" LastActivityDate="2016-07-20T14:02:11.540" Title="SonicWall NSA 2400 and 1:1 NAT with multiple public IPs" Tags="|routing|nat|sonicwall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32924" PostTypeId="2" ParentId="32921" CreationDate="2016-07-07T16:11:00.087" Score="0" Body="&lt;p&gt;The TCP Close sequence is actually:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1)      FIN ----&amp;gt;&#xA;2)          &amp;lt;---- ACK&#xA;3)          &amp;lt;---- FIN&#xA;4)      ACK ----&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just like in the &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/24068/why-do-we-need-a-3-way-handshake-why-not-just-2-way/24072#24072&quot;&gt;TCP Initiating sequence, there are four events happening&lt;/a&gt;. One side indicates they are done sending data with the FIN, the other side acknowledges reception of the FIN. Then when the other side is done sending data (often right after, but it doesn't have to be) it sends its own FIN, and the first side acknowledges it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often, #2 and #3 are combined in the same packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, often the FIN in #1 is also accompanied by an ACK to acknowledge reception of the last received data from the other side. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are seeing this in your packet capture as well:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Xqnoo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Xqnoo.png&quot; alt=&quot;Same packet capture as above&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Packet 38 is the initial FIN&lt;/li&gt;&#xA;&lt;li&gt;Packet 39 is the responding ACK and the other side's FIN&lt;/li&gt;&#xA;&lt;li&gt;Packet 40 is the final ACK. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Notice, packet 39 took care of both steps 2 and 3 in the sequence above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is odd about your capture is the duplicated ACK. Notice the ACK in packet 37 and packet 38 are acknowledging data sent prior using acknowledgement# &lt;code&gt;22951&lt;/code&gt;. Looking at just those 5 packets, I am not sure why this would be. I did see a ~5s delay between packet 37 and 38, and am wondering if that plays into it somehow.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-07-07T16:11:00.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32927" PostTypeId="1" CreationDate="2016-07-07T17:18:15.367" Score="0" ViewCount="1770" Body="&lt;p&gt;This is my first visit into the world of network multicasting on Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand how to change the ethernet port configuration and system routing tables to add multicasting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want setup a designated RHEL 6 Linux system as a router for multicast packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've googled a lot of documentation but other than setting up the ethernet port and routing table (and setting standard IP forwarding)...I don't see anything else to do.  I have handled the IPtables configuration as well.  IP_MULTICAST is set in the kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I need a special routing daemon package and are there any other configuration items that I need to address to make this happen?&lt;/p&gt;&#xA;" OwnerUserId="607" LastActivityDate="2016-07-07T19:04:13.903" Title="Setup Linux Multicasting Router for RHEL 6" Tags="|routing|router|linux|multicast|route-server|" AnswerCount="2" CommentCount="1" ClosedDate="2017-08-14T04:04:59.030" ContentLicense="CC BY-SA 3.0" />
  <row Id="32928" PostTypeId="2" ParentId="32927" CreationDate="2016-07-07T17:32:11.503" Score="1" Body="&lt;p&gt;There is no &quot;ethernet port configuration&quot; necessary, and the &quot;system routing tables&quot; have nothing at all to do with multicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast routing requires multicast routing software (pimd, mrouted, etc.) and a kernel with mroute capabilities. It is a completely different mechanism from IPv4 and IPv6 unicast routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do multicast routing with a linux system. I would not recommend it. Ever. Multicast routing support on linux is abysmal. The software packages for do it are few, nearly abandoned, have worthless documentation, and barely work. Then there's the linux kernel limitations -- the use of a 32bit bitmask limits the number of interfaces to about 28.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-07-07T17:32:11.503" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32930" PostTypeId="2" ParentId="32927" CreationDate="2016-07-07T19:04:13.903" Score="1" Body="&lt;p&gt;@mdpc - There are a lot of discussions/trouble-shooting assistance from within the Linux communities. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See for example this forum &lt;a href=&quot;http://ubuntuforums.org/showthread.php?t=1405360&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ubuntuforums.org/showthread.php?t=1405360&lt;/a&gt;  and your question has been asked before:-&#xA;&lt;a href=&quot;http://markmail.org/message/njv7d2huanz5ibdc#query:+page:1+mid:y3dshxr5hkt3m5y5+state:results&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://markmail.org/message/njv7d2huanz5ibdc#query:+page:1+mid:y3dshxr5hkt3m5y5+state:results&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really want to ask this question at &lt;a href=&quot;https://unix.stackexchange.com/&quot;&gt;https://unix.stackexchange.com/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And read this too: &lt;a href=&quot;http://www.tldp.org/HOWTO/Multicast-HOWTO-3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.tldp.org/HOWTO/Multicast-HOWTO-3.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quite unsure if RedHat servers has a running kernel with your required options enabled. After checking on your .config file, you &quot;may&quot; have to recompile a test kernel for your needs before going production.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My $00.02, I'd go bsd for critical/production servers: &lt;a href=&quot;http://bsdrp.net/documentation/examples/multicast_with_pim-sm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bsdrp.net/documentation/examples/multicast_with_pim-sm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="-1" LastEditDate="2017-04-13T12:37:13.227" LastActivityDate="2016-07-07T19:04:13.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32932" PostTypeId="1" CreationDate="2016-07-07T19:24:08.317" Score="1" ViewCount="1814" Body="&lt;p&gt;We have a Cisco Call Manager installation with 7941/7961 phones, and a Cisco 2811 voice gateway. We're getting phone service from Windstream using their SIP terminating in PRI for our phone system. Before we upgraded our internet and phone services, we were using a regular PRI setup and both caller ID number and name worked. Now we're just getting caller ID number, with no name.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where do I start looking?&lt;/p&gt;&#xA;" OwnerUserId="27706" LastActivityDate="2019-04-25T21:01:50.537" Title="No longer getting caller ID name with Cisco CM" Tags="|cisco|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="32934" PostTypeId="1" CreationDate="2016-07-07T23:21:49.157" Score="3" ViewCount="127" Body="&lt;p&gt;I've been learning Python and since I work in networking I'd like to start writing a few scripts that I can use in my day to day work tasks with switches. &#xA;So my question is this, what network projects have you used python in? What sort of tasks have you written scripts for? &#xA;I'm not asking for source code, I'm interested in what projects people have done to inspire my own coding adventures! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks all!&lt;/p&gt;&#xA;" OwnerDisplayName="user23673" LastActivityDate="2016-07-08T01:49:19.413" Title="Python Network Specific Project Recommendation" Tags="|switch|" AnswerCount="1" CommentCount="3" ClosedDate="2016-07-08T05:08:51.410" ContentLicense="CC BY-SA 3.0" />
  <row Id="32935" PostTypeId="2" ParentId="32934" CreationDate="2016-07-08T01:49:19.413" Score="2" Body="&lt;p&gt;Backing up and copying configs to server. Automate certain config changes to adhere to standards. Scripts to copy run start on all devices at will. Finding various config entries on all devices that may need to be altered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are so many possibilities.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Search github and pastebin and the overflow sites for anything using:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Import netmiko&#xA;Import paramiko&#xA;Import ciscoconfparse &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scripts using any of those libraries will be network related typically and offer up ideas.&lt;/p&gt;&#xA;" OwnerUserId="22424" LastActivityDate="2016-07-08T01:49:19.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32937" PostTypeId="1" CreationDate="2016-07-08T06:36:41.083" Score="1" ViewCount="298" Body="&lt;p&gt;I need to connect my lab L3 switch (3750) to a remote router (interface 192.168.100.1).&#xA;So I was enabled a port on a lab that (through cabling and intermediate switches) goes to the router. &#xA;I checked this port by connecting a PC within 192.168.100.0 network and pinging the router =&gt; Ok it works.&#xA;Problem is if I connect the same port to the switch (on which I have set a switchport access port and an interface vlan on the 192.168.100.0 network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interface goes up/up and down/down continuously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While it's up/up I can see it's a-full/a-1000 and launching several show command on spanning tree I see&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh spanning-tree vlan 2&#xA;&#xA;Spanning tree instance(s) for vlan 2 does not exist.&#xA;&#xA;#sh spanning-tree vlan 2&#xA;&#xA;Spanning tree instance(s) for vlan 2 does not exist.&#xA;&#xA;#sh spanning-tree vlan 2&#xA;&#xA;VLAN0002&#xA;  Spanning tree enabled protocol rstp&#xA;  Root ID    Priority    32770&#xA;             Address     0021.d7c5.9080&#xA;             This bridge is the root&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32770  (priority 32768 sys-id-ext 2)&#xA;             Address     0021.d7c5.9080&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;Gi1/0/22         Desg BLK 4         128.22   P2p&#xA;&#xA;#sh spanning-tree vlan 2&#xA;&#xA;Spanning tree instance(s) for vlan 2 does not exist.&#xA;&#xA;#sh spanning-tree vlan 2&#xA;&#xA;Spanning tree instance(s) for vlan 2 does not exist.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so it seems like a spanning-tree problem...but on the other side the port is configured as access, there are no rings for vlan 2 and portfast is disabled. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to troubleshoot/solve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: configuration for g1/0/22 is simply&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode access&#xA;switchport access vlan 2&#xA;switchport nonegotiate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't have access to the configuration of the other end switch.&#xA;HOWEVER, I changed nothing, the owner of the other end switch also said he changed nothing BUT now it works (!) as expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The port goes in FWD and I can ping the remote router.&#xA;Mystery.&lt;/p&gt;&#xA;" OwnerUserId="27712" LastEditorUserId="27712" LastEditDate="2016-07-13T18:01:13.197" LastActivityDate="2018-11-02T04:00:03.053" Title="Troubles in connecting 2 switches" Tags="|cisco|switch|" AnswerCount="3" CommentCount="3" ClosedDate="2018-11-02T04:05:05.850" ContentLicense="CC BY-SA 3.0" />
  <row Id="32938" PostTypeId="2" ParentId="32869" CreationDate="2016-07-08T06:42:23.040" Score="5" Body="&lt;p&gt;One of the most important thing for Multicast protocol is RPF (Reverse Path Forwarding) - this is the feature which would check and make sure that for a coming multicast packet (sent by a multicast source) there is only one route pointing back to the source and this is route is the best, which means that if a router receives a multicast packet from the same source via different interfaces then this router must use only one interface to accept the traffic from, otherwise the multicast packet received from one interface could be forwarded through another and vice versa, thus creating potential loops and increase of bandwidth usage. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Taking into consideration RPF feature, the standard BGP protocol doesn’t have the ability to perform RPF checking due to its limitations, while MBGP is an extended protocol which besides previously mentioned AFI and SAFI values has the same standard routing table as BGP:&#xA;– Unicast RIB (U-RIB) • This RIB contains the unicast prefixes that was previously used by BGP for IPv4 unicast traffic forwarding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And an additional routing table:&#xA;– Multicast RIB (M-RIB) • This new RIB contains the same type of unicast prefixes contained in the URIB except that the prefixes stored in the M-RIB are used to RPF check arriving multicast traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore this new Multicast RIB can make the multicast protocol working, while standard BGP can’t.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We hope this does make sense and has been useful.&lt;/p&gt;&#xA;" OwnerUserId="14080" LastActivityDate="2016-07-08T06:42:23.040" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32939" PostTypeId="1" AcceptedAnswerId="33120" CreationDate="2016-07-08T08:29:42.833" Score="1" ViewCount="2157" Body="&lt;p&gt;I have set up the ASA as VPN Server (SSL). Everything works great. I can reach every office network and also the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I noticed that on our old network, the configuration was different. When we connected over the old VPN (IPsec), and we browsed the Internet, we didn't use the tunnel to our router. We used the Internet of our Client. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, we didn't appear with the outside IP address from the office router to the Internet, we appeared with our own IP address (from my home). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I googled, but I don't find the correct configuration tutorial. Maybe I'm looking wrong. What I need is &lt;em&gt;Split tunneling&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="8499" LastEditDate="2016-07-08T10:11:16.033" LastActivityDate="2016-07-15T11:21:40.943" Title="Anyconnect doesn't tunnel internet" Tags="|cisco|cisco-asa|vpn|split-tunneling|cisco-anyconnect|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32940" PostTypeId="1" AcceptedAnswerId="32941" CreationDate="2016-07-08T09:41:58.180" Score="1" ViewCount="1434" Body="&lt;p&gt;I have two LAN networks on my server. I tried to bridge them, but the server got attacked post bridging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does bridging open additional ports on the existing connections, and can bridging alter the networking system for other systems connected on the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not a networking guy so I am not sure if this is possible or not.&lt;/p&gt;&#xA;" OwnerUserId="27714" LastEditorUserId="8499" LastEditDate="2016-07-08T10:12:16.553" LastActivityDate="2016-07-08T10:12:16.553" Title="Can bridging two networks in Windows Server 2012 lead to an external attack?" Tags="|bridge|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32941" PostTypeId="2" ParentId="32940" CreationDate="2016-07-08T09:47:52.280" Score="1" Body="&lt;p&gt;You should not bridge links with different network addresses, this can cause problems. Bridging is the same thing as connecting the links on the same VLAN with a switch. Layer-2 traffic is transparently passed through the bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were attacked through one of the links, you had those links anyway. Your attack could come through any link attached to your system.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-08T09:47:52.280" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32946" PostTypeId="1" AcceptedAnswerId="32947" CreationDate="2016-07-08T15:34:55.567" Score="3" ViewCount="456" Body="&lt;p&gt;I'm researching a way to increase the &lt;strong&gt;file transfer rate&lt;/strong&gt; between &lt;strong&gt;one PC and a Server&lt;/strong&gt; that are connected with a &lt;a href=&quot;http://us.dlink.com/products/business-solutions/28-port-gigabit-web-smart-switch-including-4-gigabit-sfp-ports/&quot; rel=&quot;nofollow noreferrer&quot;&gt;D-Link DGS-1210-28 Switch&lt;/a&gt; in my local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading the specs of this switch i found &quot;Link Aggregation&quot; feature. As both the PC and the Server have 2 NICs I thought it would help me. So I googled it hoping it would solve my problem, but instead of helping me, this research only brought me more doubts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Se here is the question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BI22F.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BI22F.png&quot; alt=&quot;Network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If I aggregate both NICs on my server and both NICs on my PC, like the image above, will I double the file transfer rate between the computer A and the Server (200 MB/s file transfer rate)?&lt;/li&gt;&#xA;&lt;li&gt;If the answer is yes, what kind of link aggregation should I use? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="27722" LastActivityDate="2016-07-08T17:58:55.897" Title="Increase transfer rate with Link Agreggation" Tags="|switch|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32947" PostTypeId="2" ParentId="32946" CreationDate="2016-07-08T15:49:11.823" Score="4" Body="&lt;p&gt;Generally speaking, no.  All the aggregaion schemes I know of do not load-balance a single flow.  Whereas you may get 200Mbps capability out from your end-devices by some operating system trickery, unfortunately you will use only one of the bundled links from the switch to each end-device, so will not increase throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had two PCs then the server may be able to get 100Mbps to each, because the flows could each use a different path.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-07-08T15:49:11.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32949" PostTypeId="2" ParentId="32937" CreationDate="2016-07-08T17:26:55.870" Score="0" Body="&lt;p&gt;Try Rapid Per-vlan spanning tree protocol. I suspect that you are using multiple VLANs in your network. RSTP is not for multiple VLANs networks.&#xA;I will edit this when I'd some more research.&lt;/p&gt;&#xA;" OwnerUserId="27726" LastActivityDate="2016-07-08T17:26:55.870" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32950" PostTypeId="2" ParentId="32937" CreationDate="2016-07-08T17:52:16.943" Score="0" Body="&lt;p&gt;Say &lt;code&gt;no switchport&lt;/code&gt; on the 3750 interface.  Put an ip address directly on the interface.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-08T17:52:16.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32951" PostTypeId="2" ParentId="32946" CreationDate="2016-07-08T17:58:55.897" Score="1" Body="&lt;p&gt;The link aggregation group (LAG) type must be supported and match on both the endpoint and the networking device.  NIC teaming is a term that you might google along with the make/model of your respective endpoint NIC cards and or OS version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://technet.microsoft.com/en-us/library/hh831648(v=ws.11).aspx&quot; rel=&quot;nofollow&quot;&gt;Microsoft indicates&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;NIC Teaming, also known as load balancing and failover (LBFO), allows&#xA;  multiple network adapters on a computer to be placed into a team for&#xA;  the following purposes:   &lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Bandwidth aggregation&lt;/strong&gt;   &lt;/li&gt;&#xA;  &lt;li&gt;Traffic failover to prevent connectivity loss    in the event of a network component failure&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-08T17:58:55.897" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32952" PostTypeId="2" ParentId="32057" CreationDate="2016-07-08T18:27:11.393" Score="0" Body="&lt;p&gt;Yes, just plug backup server into each switch.  Obviously, backup server will need 2 NIC's, one for each connection.  That takes care of layer 1 and layer 2 connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get the backup server online you need to setup layer 3, or IP addressing and routing.  DHCP will need to be disabled on the backup server.  You will need to manually address each NIC and add some host routes on the server.  A preferred default gateway and a less preferred default gateway, plus any other routes pointing to respective subnets.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-08T18:27:11.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32953" PostTypeId="2" ParentId="32932" CreationDate="2016-07-08T18:34:08.287" Score="1" Body="&lt;p&gt;With a PRI gateway, you can set it up as MCGP controlled or as an H.323 gateway.  I know that (back a few years ago), MGCP was not supporting passing name and number.  That may be fixed now.  Look at how your PRI gateway is configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a classic (and old) question.  You'll be able to get it working, provided your carrier is delivering it - which they should be (just ask them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-callmanager/44102-cm-call-id-issues.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-callmanager/44102-cm-call-id-issues.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-08T18:34:08.287" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32955" PostTypeId="2" ParentId="30771" CreationDate="2016-07-09T01:13:12.293" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3750-x-series-switches/white_paper_c11-651895.html&quot; rel=&quot;nofollow&quot;&gt;Catalyst SmartInstall for Zero Touch Switch Deployment&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;SmartInstall can enable plug-and-play configuration and image&#xA;  management for zero-touch deployment on new and existing Cisco&#xA;  Catalyst LAN switches and zero-touch replacement of existing switches&#xA;  that need to be replaced in a return materials authorization (RMA)&#xA;  scenario.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/fundamentals/513_n2_1/b_Cisco_Nexus_5000_Series_NX-OS_Fundamentals_Configuration_Guide_Release_513_N21/b_Cisco_Nexus_5000_Series_NX-OS_Fundamentals_Configuration_Guide_Release_5_1_3_N2_1_chapter_01001.html&quot; rel=&quot;nofollow&quot;&gt;Nexus 5000 PowerOn Auto Provisioning&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;PowerOn Auto Provisioning (POAP) automates the process of upgrading&#xA;  software images and installing configuration files on Cisco Nexus&#xA;  switches that are being deployed in the network for the first time.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://AutoInstall&quot; rel=&quot;nofollow&quot;&gt;IOS Routers AutoInstall&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;AutoInstall is supported over Ethernet, Token Ring, and FDDI&#xA;  interfaces for LANs and serial interfaces with High-Level Data Link&#xA;  Control (HDLC) encapsulation or serial interfaces with Frame Relay&#xA;  encapsulation for WANs. If a LAN interface is used, AutoInstall will&#xA;  attempt to acquire an IP address for the attached interface using&#xA;  Dynamic Host Configuration Protocol (DHCP) requests, Bootstrap&#xA;  Protocol (BOOTP) requests, or Reverse Address Resolution Protocol&#xA;  (RARP) requests. If a serial interface with HDLC encapsulation is&#xA;  connected, AutoInstall will attempt to acquire an IP address for the&#xA;  attached interface using Serial Line Address Resolution Protocol&#xA;  (SLARP).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-09T01:13:12.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32956" PostTypeId="2" ParentId="29430" CreationDate="2016-07-09T01:18:33.977" Score="0" Body="&lt;p&gt;You have broadband in your pocket (your 4g LTE Smartphone).  Have a look at &lt;a href=&quot;http://www.pcadvisor.co.uk/how-to/mobile-phone/how-tether-google-android-phone-image-3279408/&quot; rel=&quot;nofollow&quot;&gt;WiFi tethering&lt;/a&gt; - your carrier may or may not charge a fee to enable it.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-09T01:18:33.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32957" PostTypeId="1" AcceptedAnswerId="32988" CreationDate="2016-07-09T01:20:57.160" Score="1" ViewCount="2480" Body="&lt;p&gt;I have attached a network diagram explaining IPTV network  , i have below queries to understand &amp;amp; configure IPTV .&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All ports on edge switches are configured as access ports in VLAN 101.&lt;/li&gt;&#xA;&lt;li&gt;On Core &amp;amp; L-2 switches , configuration is simple (i.e) VLAN , VLAN IP address , Access ports &amp;amp; basic administration configuration.&lt;/li&gt;&#xA;&lt;li&gt;DCM switch is converting analog signal from head end to IP.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Recently added 50 IPTVs as expansion , due to which flickering/latentcy - mainly BW related issue were seen. As a recommendation from vendor , Multicast needs to be enabled.I have tried understanding L-2 Multicast on cisco portal , however unable to understand what needs to configured on Cisco Core &amp;amp; Edge.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What can be the recommendation for implementation for IP/layer-2 Multicast?&lt;/li&gt;&#xA;&lt;li&gt;What is IGMP snooping &amp;amp; IGMP querier?&lt;/li&gt;&#xA;&lt;li&gt;What does &lt;em&gt;ip igmp snooping querier&lt;/em&gt; &amp;amp; &lt;em&gt;ip igmp snooping&lt;/em&gt; command ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nizam&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XU2pE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XU2pE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8498" LastActivityDate="2018-05-27T07:59:10.847" Title="IPTV Cisco configuration for C2960" Tags="|cisco|cisco-catalyst|multicast|broadcast|latency|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32958" PostTypeId="2" ParentId="32649" CreationDate="2016-07-09T04:23:29.210" Score="0" Body="&lt;p&gt;Since ISP A AND ISP B have different cable types, it's clear that you should choose the right fiber type and interface modules provided by ISP B, that is single-mode fiber with single-mode 10G &lt;a href=&quot;http://www.fs.com/c/sfp-plus-transceivers-56&quot; rel=&quot;nofollow&quot;&gt;SFP+ transceivers&lt;/a&gt;, say SFP-10G-LR.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-07-09T04:23:29.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32959" PostTypeId="1" AcceptedAnswerId="32975" CreationDate="2016-07-09T04:42:06.303" Score="3" ViewCount="3604" Body="&lt;p&gt;So, I want to connect 23 Ap's using PoE. The Switch is a 500w 24 port switch. May I use every single port with PoE without causing trouble on the Switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a UniFi switch of 24 ports. I'm going for the 500 watt model, but it would be a great save if the 250 Watt could also work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to switch 23 UniFi AP AC Long Range which can work with PoE at 24v with 0.5amp.&lt;/p&gt;&#xA;" OwnerUserId="27734" LastEditorUserId="27734" LastEditDate="2016-07-09T15:33:42.527" LastActivityDate="2016-07-11T00:50:14.927" Title="How many PoE ports can I use on a switch?" Tags="|switch|switching|access-point|power-over-ethernet|switching-modes|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="32960" PostTypeId="1" CreationDate="2016-07-09T06:47:21.407" Score="0" ViewCount="408" Body="&lt;p&gt;I have a single Juniper switch and a handful of servers. Each server has two NICs plus another NIC for IPMI (management). I would like 1 NIC to be used for public traffic, 1 NIC for private traffic, then IPMI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, each server would be configured as the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Server 1:&#xA;NIC1: XXX.XXX.XXX.2/24 (public)&#xA;NIC2: 10.0.0.2/24 (private)&#xA;IPMI: 192.168.0.2/24 (management)&#xA;Server 2:&#xA;NIC1: XXX.XXX.XXX.3/24 (public)&#xA;NIC2: 10.0.0.3/24 (private)&#xA;IPMI: 192.168.0.3/24 (management)&#xA;etc.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Every NIC on every server would be plugged into the same Juniper switch. Would I need to create 3 VLANs to achieve this? Can a single switch handle all 3 of these without issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also need to setup a VPN (openvpn) on one of the servers so I can access 192.168.0.0/24 for IPMI from anywhere. Can VLANs talk to each other like that (i.e. the VPN is accessible from a public network (VLAN 10) but needs to access RFC1918 subnet in a different VLAN 192.168.0.0/24 (VLAN 12))?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The datacenter is providing me with a single uplink to the switch for public traffic from their core routing devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this make sense. Please point me in the right direction. Assistance is greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Purchasing additional hardware is not possible.&lt;/p&gt;&#xA;" OwnerUserId="27736" LastActivityDate="2016-07-15T10:25:59.660" Title="How would I configure a switch to support 3 networks?" Tags="|switch|vlan|ip|juniper|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32961" PostTypeId="1" CreationDate="2016-07-09T07:10:11.813" Score="0" ViewCount="1046" Body="&lt;p&gt;I'm not a networking guru but I came across the term &amp;quot;VDSL Vectoring&amp;quot; while checking the FritzBox router:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.avm.de/products/fritzbox/fritzbox-7490/details/&quot; rel=&quot;nofollow noreferrer&quot;&gt;FrtizBox 7490 Details&lt;/a&gt;, &lt;a href=&quot;https://en.avm.de/products/fritzbox/fritzbox-7490/technical-data/&quot; rel=&quot;nofollow noreferrer&quot;&gt;FritzBox 7490 Technical Data&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;VDSL vectoring for high speeds&lt;/p&gt;&#xA;&lt;p&gt;With FRITZ!Box, you’re ready for the future: as vectoring is supported, you can reach throughput rates of up to 100 Mbit/s with standard VDSL connections and double your Internet speed without any extra hardware.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;What is VDSL vectoring?&lt;/p&gt;&#xA;" OwnerUserId="19500" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-11T06:45:54.037" Title="What is VDSL vectoring?" Tags="|router|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-14T21:29:57.827" ContentLicense="CC BY-SA 3.0" />
  <row Id="32962" PostTypeId="1" CreationDate="2016-07-09T07:26:55.667" Score="1" ViewCount="35251" Body="&lt;p&gt;I have RouteBOARD RB951G-2HnD, RouterOS 6.34.2 and I am trying to achive a network configuration something like what is depict on the next picture. The picture is from Mikrotik Wiki &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Vlans_on_Mikrotik_environment&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://wiki.mikrotik.com/wiki/Vlans_on_Mikrotik_environment&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/doWb9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/doWb9.png&quot; alt=&quot;Network configuration with three switches and two vlans&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm trying to configure the router same way as SW3 on the picture. Two trunk port and one access port. I tried to configure the router as it is described on the wiki page and the access port is not working correctly. I was trying to find similar problem on the Internet but with no luck.&lt;/p&gt;&#xA;&lt;p&gt;I'm missing something in the configuration. So, here are the steps that I used for configuration. The router have default configuration and I'm trying to configure next:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ether4 (on the picture same as SW3 eth3) and ether5 (on the picture same as SW3 eth4) are trunk ports&lt;/li&gt;&#xA;&lt;li&gt;two vlans id, 100 and 200&lt;/li&gt;&#xA;&lt;li&gt;ether3 (on the picture same as SW3 eth1) is access port for vlan 100&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Steps&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;#Removing parts of default configuration&#xA;/interface ethernet set ether3 master-port=none&#xA;/interface ethernet set ether4 master-port=none&#xA;/interface ethernet set ether5 master-port=none&#xA;&#xA;#Configuration for trunk ports&#xA;/interface bridge add name=bridge-trunk disabled=no&#xA;/interface bridge port add interface=&amp;quot;ether3&amp;quot; bridge=&amp;quot;bridge-trunk&amp;quot; disabled=no&#xA;/interface bridge port add interface=&amp;quot;ether4&amp;quot; bridge=&amp;quot;bridge-trunk&amp;quot; disabled=no&#xA;&#xA;#configuration for the access port&#xA;/interface vlan add name=&amp;quot;bridge-trunk-vlan100&amp;quot; vlan-id=100 interface=bridge-trunk disabled=no&#xA;&#xA;/interface bridge add name=bridge-vlan100 disabled=no&#xA;/interface bridge port add interface=&amp;quot;bridge-trunk-vlan100&amp;quot; bridge=&amp;quot;bridge-vlan100&amp;quot; disabled=no&#xA;/interface bridge port add interface=&amp;quot;ether3&amp;quot; bridge=&amp;quot;bridge-vlan100&amp;quot; disabled=no&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I do these steps and connect my laptop to the ether3, any type of network connection to other network devices is not working. Trunk ports are working properly.&lt;/p&gt;&#xA;&lt;p&gt;Correct me if I'm wrong, if I introduce the router configured this way into existing network, APR tables must refresh itself on other network devices because bridge have it's own MAC address.&lt;/p&gt;&#xA;&lt;p&gt;I would be grateful if you can provide with hints, tutorials or books to read more about a bridging and VLANs.&lt;/p&gt;&#xA;&lt;h2&gt;Update 1&lt;/h2&gt;&#xA;&lt;p&gt;I found a way but I do not know if it is right way by the RouterOS methodology.&lt;/p&gt;&#xA;&lt;p&gt;I added the filter rule for the bridges&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;/interface bridge filter add chain=forward mac-protocol=vlan vlan-id=100 action=accept&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Also, I could run all VLAN traffic through IP Firewall with similar rule.&lt;/p&gt;&#xA;&lt;h2&gt;Update 2&lt;/h2&gt;&#xA;&lt;p&gt;Previous situation was done in a experimental environment on separate RouterBOARD. I wanted to apply this solution on the real device and it did not worked. The device is Cloud Router Switch CRS125-24G-1S. The moment when I add &lt;code&gt;bridge-trunk-vlan100&lt;/code&gt; interface to the &lt;code&gt;bridge-vlan100&lt;/code&gt; bridge, the traffic that is passing through &lt;code&gt;bridge-trunk&lt;/code&gt; is dropped and new connections cannot be established.&lt;/p&gt;&#xA;" OwnerUserId="8777" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-02-14T16:21:55.993" Title="Configurating VLAN access and trunk ports on RouterOS/Mikrotik" Tags="|vlan|bridge|" AnswerCount="1" CommentCount="8" ClosedDate="2017-06-24T17:32:16.843" ContentLicense="CC BY-SA 3.0" />
  <row Id="32963" PostTypeId="2" ParentId="32960" CreationDate="2016-07-09T08:37:17.147" Score="2" Body="&lt;p&gt;Generally speaking about switch configuration.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;With VLANs&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You can configure VLANs as you mentioned, but you will need router to configure routes and firewall between VLANs so that two devices from different VLANs can/cannot communicate. Each VLAN must have DHCP server or you can assign static IP address to each NIC. You did not mentioned if you have rights to configure the router. You could setup a router on one of your servers. This is the way if you want to set rights which two devices can communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you will need to configure the switch so that each port is assign to only one VLAN (access ports) and trunk port to the router.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Without VLANs&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;You can do it without VLANs also, but I do not advise it. &#xA;Switch is Layer2 devices so it does not care about IP addresses. You can assign a IP address as you wish and devices/interfaces that exist on same subnet can communicate. Only devices with public IP could communicate to the Internet, others can communicate only in same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you setup a VPN on one server that have a public IP address and IP address for each subnet, then it can communicate with every other devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem with this solution is broadcast domain. If one device send broadcast request, every other other device will get that broadcast request no matter on which subnet it is. VLANs (and bridges) prevent these things. If a broadcast request is sent on a switch that have VLANs, that request will only be received by interfaces that are member of same VLAN from which broadcast request is sent. &#xA;Read more about it at &lt;a href=&quot;https://serverfault.com/questions/25907/what-are-the-implications-of-having-two-subnets-on-the-same-switch&quot;&gt;https://serverfault.com/questions/25907/what-are-the-implications-of-having-two-subnets-on-the-same-switch&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8777" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2016-07-09T08:37:17.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32964" PostTypeId="2" ParentId="9327" CreationDate="2016-07-09T09:50:46.993" Score="0" Body="&lt;p&gt;You can use different IP address and use Web proxy on Mikrotik. There is the option to redirect all http request through proxy. You can read more at &lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:IP/Proxy&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Manual:IP/Proxy&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8777" LastActivityDate="2016-07-09T09:50:46.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32966" PostTypeId="1" AcceptedAnswerId="32967" CreationDate="2016-07-08T21:59:51.223" Score="2" ViewCount="1250" Body="&lt;p&gt;This may sound like a stupid question, but I noticed there are a lot of unused/reserved fields in many headers of the different TCP/IP layers.&lt;br&gt;&#xA;For example, bits 100 to 103 in the &lt;a href=&quot;https://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP header&lt;/a&gt; are unused and &lt;em&gt;should&lt;/em&gt; be to set 0. There are also the unused padding fields at the end.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are the values in those fields preserved over the network? When a packet is reconstructed every time it traverses the different network nodes, is it possible that one of them does an optimization by skipping or assuming those fields are using the default usual values and sets those fields to 0 for example?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, can two devices send over the network something similar to Morse code hidden in, for example, the reserved fields of ICMP headers or anything similar?&lt;/p&gt;&#xA;" OwnerDisplayName="user27738" LastEditorUserId="8499" LastEditDate="2018-08-09T15:30:11.553" LastActivityDate="2018-08-09T15:30:11.553" Title="Are reserved/unused fields in TCP header preserved over the network?" Tags="|tcp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="32967" PostTypeId="2" ParentId="32966" CreationDate="2016-07-08T22:10:44.037" Score="7" Body="&lt;p&gt;There is no such thing as &quot;the network&quot; which behaves the same everywhere. The network is made of routers which simply forward packets unchanged. Then you have packet filter firewalls which might pass such packets unchanged, might block these if the reserved bits are set or might sanitize the packets by setting the reserved bits to zero. And then you have application level gateways/firewalls which effectively are an endpoint for the TCP connection and which create a new connection consisting of different packets and of course the reserved bits set to a sane value.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;in other words can two devices send over the network something similar to morse code hidden in ,for example, the reserved fields of ICMP headers or anything similar?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are enough side channels how devices can communicate in a hidden way. This can be such reserved bits, timing or size of messages, application layer information like extra spaces or differentiating between upper and lower cases in text based protocols, steganographic techniques etc. Depending on the abilities of the devices of the network such side channel information will pass without changes, might be inadvertently removed or might be explicitly removed.  &lt;/p&gt;&#xA;" OwnerUserId="4063" OwnerDisplayName="Steffen Ullrich" LastActivityDate="2016-07-09T08:04:06.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32968" PostTypeId="1" CreationDate="2016-07-09T13:16:18.417" Score="2" ViewCount="2546" Body="&lt;p&gt;I was studying about CISCO routers and we learned that every router has a LOOPBACK interface. How and when are those interfaces used? We never used it though in our configurations.&lt;/p&gt;&#xA;" OwnerUserId="23730" LastActivityDate="2016-07-13T10:07:29.810" Title="What are the most common scenarios in which the 'loopback interface' on a router is used?" Tags="|cisco|router|interface|testing|loopback|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32969" PostTypeId="2" ParentId="32968" CreationDate="2016-07-09T14:01:17.633" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;...we learned that every router has a LOOPBACK interface.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is not true. Cisco routers &lt;em&gt;can&lt;/em&gt; be configured with loopback interfaces, but they don't have loopback interfaces until you create one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea of a loopback interface is that it is a virtual interface which never goes down due to a physical line or network problem. Loopback interfaces can be used for testing, but they are often used for things like the OSPF router ID. By default, OSPF will select a router ID from the highest IP address on any interface. If you have any loopbacks configured, it will prefer loopback interfaces over real interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Loopbacks are often used as the source address for various services (NTP, TFTP, FTP, SSH, TACACS, domain lookup, etc.). These services would, by default, use the IP address of the interface by which they exit the router. This can cause problems if there are multiple interfaces exiting the router, and one goes down due to a line or external network problem. This could make the router seem like a different device to something working with a service,  e.g. SSH or TACACS, and and spoil a connection. By using an interface which never goes down (loopback), it doesn't matter which physical interface is used. For instance, if you connect to a router that has several path by which you can reach it, and you connect to a physical interface, your connection may get dropped while you make changes to the router, but by connecting to the loopback, if you have any path into the router, your connection will remain up.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-09T14:01:17.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32970" PostTypeId="1" AcceptedAnswerId="37324" CreationDate="2016-07-09T14:05:08.617" Score="7" ViewCount="16062" Body="&lt;p&gt;I keep reading it is 2304 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Maximum_transmission_unit#cite_note-18&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia&lt;/a&gt; states it is 7981 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On my WiFi AP, I can set the RTS threshold with a value of 0-2346 bytes (I guess it's MTU + the MAC/PHY header ?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where does this 7981 bytes come from, and can we have a definite answer on the 802.11 MTU size ? Is it 2304 bytes ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If MTU = 2304 bytes, what is the total frame size of a WPA2 packet (assuming the MTU is fully saturated) ?&lt;/p&gt;&#xA;" OwnerUserId="24434" LastActivityDate="2019-02-20T11:13:37.433" Title="What is the 802.11 MTU?" Tags="|mtu|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32971" PostTypeId="2" ParentId="32959" CreationDate="2016-07-09T15:51:14.643" Score="2" Body="&lt;p&gt;I don't know the exact model you are using, but the specs I read say 48V @.5A.  That's 24 watts (and is more inline with similar APs)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;23 ports @ 24W = 552 Watts.  So, no, you can't power all the devices.  Also don't forget to account for 50-75 watts for the switch itself.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-09T15:51:14.643" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32975" PostTypeId="2" ParentId="32959" CreationDate="2016-07-10T00:47:14.700" Score="2" Body="&lt;p&gt;It rather depends on what is real. 24V 6.5W is not 24V 0.5 A - but I think the latter number is just what the default (passive) POE power brick is, and they are oversized somewhat by default. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;24V 0.5A would be &lt;strong&gt;12W&lt;/strong&gt;. 24 of those would be &lt;strong&gt;288W&lt;/strong&gt; and require the 500W switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;6.5W&lt;/strong&gt; X 24 ports would be &lt;strong&gt;156W&lt;/strong&gt; and the 250W would be fine.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Actual data update&lt;/strong&gt; - not having the time free to muck up my network for this &lt;em&gt;pro bono&lt;/em&gt; question, I checked the POE-Brick input against my Kill-A-Watt, and got a peak actual draw of (drumroll, please) &lt;strong&gt;4 Watts&lt;/strong&gt; (even with the radios blasting away on high power, which is not how I normally run them.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VA is a bit worse at 8, but that's just the poor 120VAC power factor into a lightly-loaded 12 Watt AC/DC power supply. So, whatever inefficency is involved in the power brick and the draw of the radio is 4 watts or less (observed.) Call it 4.499 if you like, or call it 5 - regardless, this would appear to confirm the 6.5W worst case maximum draw as a very reasonable specification. To the original question, this means that 23 or 24 APs would be easily powered from a 250 watt (24V passive) POE switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If 802.3 af/at is something the OP is more comfortable with, the (slightly more expensive) UAP-AC-Pro model is of that 48V POE flavor, but it has a maximum draw spec of 9W, which likely means that a 250W POE switch will not be able to run 23-24 of them, since the Watt rating of POE switches seems to typically include the power needed to run the switch itself.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2016-07-11T00:50:14.927" LastActivityDate="2016-07-11T00:50:14.927" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="32976" PostTypeId="1" AcceptedAnswerId="32977" CreationDate="2016-07-10T01:48:36.137" Score="1" ViewCount="1164" Body="&lt;p&gt;Network topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jPmS8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jPmS8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw a tutorial video which teaches me to build a wireless network like the image above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And he said he used two VLANs:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;One is for APs and controller and management.&lt;/li&gt;&#xA;&lt;li&gt;The other is for clients.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I can understand that APs can talk to controller since they're in the same VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But here comes the problem.&#xA;How can he set the two clients to another VLAN while they communicate via APs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the two clients have no VLAN since they're not directly connected to the switch, are they in the same VLAN as the AP they connect to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, will there be some security issue that hosts and controller are in the same VLAN?&lt;/p&gt;&#xA;" OwnerUserId="27746" LastEditorUserId="8499" LastEditDate="2018-12-25T01:57:38.630" LastActivityDate="2018-12-25T01:57:38.630" Title="How data flow via APs with a controller?" Tags="|cisco|vlan|wireless|ieee-802.11|access-point|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32977" PostTypeId="2" ParentId="32976" CreationDate="2016-07-10T01:57:01.707" Score="2" Body="&lt;p&gt;Typically, with a wireless controller, your WAPs will be in a VLAN specifically to manage the WAPs, and it will not be the same as a user data VLAN. The users on the WAPs will get assigned a user data VLAN by the controller, and the WAPs will tunnel the user data via a CAPWAP tunnel to the controller, which will decapsulate the data and place it on the correct data VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A controller could have multiple user data VLANs, each with its own SSID, with which the WAPs work. Each WAP could advertise all or some of the SSIDs, depending on how the controller configures each WAP. The WAPs get their configurations from the controller; they are not configured individually.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-10T01:57:01.707" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="32978" PostTypeId="1" CreationDate="2016-07-10T02:13:19.590" Score="2" ViewCount="4684" Body="&lt;p&gt;I have L2L tunnels, some on marginal circuits, that frequently go down with a message like: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;%ASA-3-713123: Group = 50.x.x.x, IP = 50.x.x.x, IKE lost contact with remote peer, deleting connection (keepalive type: DPD)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are statically defined tunnels, and usually they come back within a few seconds. These have no secondary peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can find lots of information on how to set the threshold and retry for DPD keep-alives, but very little guidance on when to use and how to determine the best settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tested changing them, and can make the change, and nothing bad happens, but I am unsure if anything good is happening (the up/down bounce while frequent overall, is infrequent on any given tunnels).  Before I start changing a bunch in production I would appreciate a sanity check: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;It seems logical that on marginal circuits (and some of these are, both low quality and occasionally too busy), and notably with no secondary peers, that DPD should go slower (if at all), so I am thinking of changing the retry from 2 seconds (6 total) to 10 (30 total). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There does not seem any benefit in extending the threshold, however.  Is there any reason to adjust the threshold if you adjust the retry time? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;While some documents say you must set these symmetrically, I can see no harm in different values from watching it in debug.  While I do not intend to be different, it takes time to deploy to each router -- is there any issue if for a period of time these are different (but not turned off) at each end? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It appears each tunnel (at each end) needs to be changed individually.  I tried changing DefaultL2LGroup (recognizing we have individual static tunnel groups) and as expected it has no impact on them.  Am I correct there is no way to change the defaults, and you must change each tunnel (and each end)?   &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Environment: Generally these are ASA5505's, a few 5525's and 5515's, with versions ranging from 8.2(5)59 to 9.5(2)6. The circuits on the spokes are generally low speed (cable modems, DSL, etc.) and usually not busy, but occasionally too busy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are about 85 tunnels that need to be changed, so even if this is relatively safe (and appears to be), I'd rather only do this once.  Does it sound like I am on the right track? &lt;/p&gt;&#xA;" OwnerUserId="17082" LastActivityDate="2016-07-10T11:10:57.230" Title="Cisco ASA Dead Peer Detection - Adjustments" Tags="|cisco|ipsec|tunnel|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32979" PostTypeId="2" ParentId="32123" CreationDate="2016-07-10T03:01:40.070" Score="0" Body="&lt;p&gt;You may be up against a distance limitation.  If the old switches were uplinked using 100Base-FX (100Mbps) realize that signal can propagate over 1 mile over FDDI-grade multimode fiber.  Newer gigabit uplinks can propogate 1804 feet (550 m).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are 100Base-FX transceivers for the 3850, so you might need to get those, or upgrade your fiber.  There may also be a way for you to use a long haul gigabit optic paired with mode conditioning patch cords.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-10T03:01:40.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32981" PostTypeId="1" AcceptedAnswerId="32982" CreationDate="2016-07-10T07:33:58.853" Score="2" ViewCount="4464" Body="&lt;p&gt;I have a newly opened from the box Allied Telesis Port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After some configuration, I was locked out due to timed out. I have already setup the Login with correct login and managed to login before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But now I am locked out. Is there a way to hard reset the Allied Telesis switch again?&lt;/p&gt;&#xA;" OwnerUserId="14178" LastEditorUserId="20757" LastEditDate="2017-05-08T02:15:07.883" LastActivityDate="2017-05-08T02:15:07.883" Title="How to hard reset an Allied Telesis x510?" Tags="|switch|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32982" PostTypeId="2" ParentId="32981" CreationDate="2016-07-10T07:44:14.930" Score="1" Body="&lt;p&gt;According to &lt;a href=&quot;https://www.alliedtelesis.com/documents/bootloader-and-startup-feature-overview-and-configuration-guide&quot; rel=&quot;nofollow&quot;&gt;the manual&lt;/a&gt;, you can erase the flash and boot from a clean device:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The next level of security is equivalent to the second one, except&#xA;  that there is no longer any access to the &lt;strong&gt;Skip startup script&lt;/strong&gt;&#xA;  option and to the &lt;strong&gt;Special Boot Options&lt;/strong&gt; section of the bootloader&#xA;  menu, even of the user knows the password.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Instead, there is a new &lt;strong&gt;completely erase flash&lt;/strong&gt; item in the&#xA;  bootloader menu, that now becomes the only option a user has for&#xA;  recovering the switch if the Admin password is lost.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-10T07:44:14.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32983" PostTypeId="1" AcceptedAnswerId="32991" CreationDate="2016-07-10T08:15:56.407" Score="3" ViewCount="385" Body="&lt;p&gt;I'm trying to understand how SLAAC works, but having troubles understanding how the information inside the Router Advertisement is used by a client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Let's say neither the Manager nor the Other Conflig Flags are set and the RA contains 2 addresses (2001:620:200:effe::/64 and fd7f:3fee:abc:effe::/64)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What (global) IP address will the client add to its interface? EUI64 ID generation probably wont work like with the link local address, as the prefix doesn't have to be 64 bit long as far as I know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And what is the address starting with fd7f used for?&lt;/p&gt;&#xA;" OwnerUserId="27751" LastEditorUserId="8499" LastEditDate="2019-01-13T03:41:31.877" LastActivityDate="2019-01-13T03:41:31.877" Title="IPv6 - RA prefixes and flags" Tags="|ip|ipv6|protocol-theory|ip-address|ndp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32985" PostTypeId="2" ParentId="32978" CreationDate="2016-07-10T11:10:57.230" Score="1" Body="&lt;p&gt;Okay here goes:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It seems logical that on marginal circuits (and some of these are, both low quality and occasionally too busy), and notably with no secondary peers, that DPD should go slower (if at all), so I am thinking of changing the retry from 2 seconds (6 total) to 10 (30 total).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think you are on the right track with regards to your settings - I generally stick with 10s for retry timer - if there are no secondary peers, then it doesn't really matter how fast a failure is detected.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;There does not seem any benefit in extending the threshold, however. Is there any reason to adjust the threshold if you adjust the retry time?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No good ones that I can think of.  Perhaps if there isn't a lot of traffic on the link to keep it alive, or it's a ridiculously expensive Satellite link, then you might wind out the threshold a bit.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;While some documents say you must set these symmetrically, I can see no harm in different values from watching it in debug. While I do not intend to be different, it takes time to deploy to each router -- is there any issue if for a period of time these are different (but not turned off) at each end?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;DPD only kicks in when your tunnels are completely idle, so as long as you were using bi-directional mode (the default), then the R-U-THERE/response messages from each node &lt;em&gt;should&lt;/em&gt; also count as traffic on the link and reset the threshold on the far end each time (even if the counters are much longer on one end).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It appears each tunnel (at each end) needs to be changed individually. I tried changing DefaultL2LGroup (recognizing we have individual static tunnel groups) and as expected it has no impact on them. Am I correct there is no way to change the defaults, and you must change each tunnel (and each end)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's been a long time since I've touched an ASA, but I'm pretty sure that each instance of an L2L tunnel has independent settings rather than inheriting them from any of the default groups, so no unfortunately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-07-10T11:10:57.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32986" PostTypeId="1" AcceptedAnswerId="32987" CreationDate="2016-07-10T11:14:12.477" Score="1" ViewCount="1040" Body="&lt;p&gt;I have 2 VLANs and 2 Devices connected to a HP 2620 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both port/interface used is untagged and i have assigned an IP to the VLANs as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 50 - 10.1.50.0/24&#xA;VLAN 60 - 10.1.60.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently , when i put Device A into VLAN 50 and Device B into VLAN 60 , they are unable to ping each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain?&lt;/p&gt;&#xA;" OwnerUserId="14178" LastActivityDate="2016-07-10T12:42:45.583" Title="HP Switch Networking to Ping" Tags="|switch|hp-procurve|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32987" PostTypeId="2" ParentId="32986" CreationDate="2016-07-10T11:21:00.357" Score="1" Body="&lt;p&gt;Of course they can't ping each other, they are on different network, if you want to do that , you need to create son mechanism that do some kind of routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is, without routing, the communication only will be able between PC on the SAME vlan, because vlans divide the space into  broadcast domains, in other words, NETWORKS, one vlan means one NETWORK. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On your question, you have 2 networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create one vlan interface 50 with ip 10.1.50.1/24, and one vlan interface 60 with ip 10.1.60.1/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, one PC on vlan 50, put your gateway on 10.1.50.1, and on the other PC on vlan 60, to 10.1.60.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, ACTIVATE IP routing on switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that, ping should be succefull.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2016-07-10T11:50:15.443" LastActivityDate="2016-07-10T11:50:15.443" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="32988" PostTypeId="2" ParentId="32957" CreationDate="2016-07-10T11:27:22.693" Score="1" Body="&lt;p&gt;When running in multicast mode, you will only need to carry one copy of each channel being watched down to the 2960, rather than one stream per attached TV Set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the total number of channels (worst case: every TV attached to the 2960 is watching a different channel/stream) you may still need to distribute TVs across multiple access switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not clear from your diagram whether VLAN 101 extends up to the Cisco DCM switch or not, but let's assume it does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to designate one of your nodes as an IGMP querier - I would recommend setting this on the VLAN 101 interface of the 4507, as if you expand in future (with more 2960s) it's likely that they'll be attached to this switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IGMP querier listens out for IGMP messages from end devices (such as your TVs) and records which downstream ports are interested in receiving which multicast groups (one per stream/channel).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IGMP-Snooping on the other hand should be enabled in VLAN 101 on each 2960 so that the switch doesn't simply flood all received streams out to all TVs.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-07-10T11:27:22.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32989" PostTypeId="2" ParentId="32986" CreationDate="2016-07-10T12:42:45.583" Score="0" Body="&lt;p&gt;make some thing like IP Routing in cisco to activate routing between vlans&lt;/p&gt;&#xA;" OwnerUserId="27753" LastActivityDate="2016-07-10T12:42:45.583" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="32991" PostTypeId="2" ParentId="32983" CreationDate="2016-07-10T14:22:02.190" Score="3" Body="&lt;p&gt;What Global address will be assigned depends on the OS of the host. By default, Windows and some Linux versions will use Privacy Extensions and random address generation, and that makes the assigned address unpredictable, and it will periodically change. An original SLAAC implementation would use the MAC address. Assuming a 48-bit MAC address, such as used by ethernet, the MAC address will be split in half, &lt;code&gt;fffe&lt;/code&gt; will be inserted in the middle to extend it to 64 bits, and the &lt;code&gt;U/L&lt;/code&gt; bit will be flipped. This method made some people nervous because a particular MAC address could be tracked on different networks. Privacy Extensions and random address generation were introduce. On some OSes, even the Link-local addresses use this.&lt;/p&gt;&#xA;&lt;p&gt;A prefix does not need to be 64-bits, but it will break features of IPv6, including SLAAC, if it is not 64-bits. The two addresses in your example RA are 64-bit prefixes, so that is what the interfaces will use for auto-address assignment.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;fc00::/7&lt;/code&gt; address range is the ULA (Unique Local Address) range, of which the first half (&lt;code&gt;fc00::/8&lt;/code&gt;) is reserved for a global-entity-to-be-named-later to make assignments. The second half (&lt;code&gt;fd00::/8&lt;/code&gt;) can be used for locally assigned addresses, but they mut use a pseudo-random number generator for the 40-bit Global ID. See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4193#section-3.2.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4193, Unique Local IPv6 Unicast Addresses, Section 3.2.1. Locally Assigned Global IDs&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;3.2.1.  Locally Assigned Global IDs&lt;/p&gt;&#xA;&lt;p&gt;Locally assigned Global IDs MUST be generated with a pseudo-random&#xA;algorithm consistent with [RANDOM].  Section 3.2.2 describes a&#xA;suggested algorithm.  It is important that all sites generating Global&#xA;IDs use a functionally similar algorithm to ensure there is a high&#xA;probability of uniqueness.&lt;/p&gt;&#xA;&lt;p&gt;The use of a pseudo-random algorithm to generate Global IDs in the&#xA;locally assigned prefix gives an assurance that any network numbered&#xA;using such a prefix is highly unlikely to have that address space&#xA;clash with any other network that has another locally assigned prefix&#xA;allocated to it.  This is a particularly useful property when&#xA;considering a number of scenarios including networks that merge,&#xA;overlapping VPN address space, or hosts mobile between such networks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-07-10T14:33:21.993" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32992" PostTypeId="2" ParentId="29713" CreationDate="2016-07-10T18:12:19.027" Score="2" Body="&lt;p&gt;You want to share an ISP or Internet connection.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be achieved with a single 12 port layer 3 ethernet switch, provided the Internet handoff is Ethernet, otherwise you will need to front-end the switch with a router to terminate non-Ethernet links.  Then, each tenant requires a router or firewall device as the demarc to their network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have your ISP issue you /28, or 14 global IP addresses.  You might have to pay a little extra for this.  One of those addresses is assigned to the ISP gateway, and that leaves you 13 addresses to hand/assign to your tenants to apply to the outside interface of their routers/firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks it.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-10T18:12:19.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="32993" PostTypeId="1" AcceptedAnswerId="32994" CreationDate="2016-07-10T21:54:13.850" Score="1" ViewCount="108" Body="&lt;p&gt;If I have 4 routers, R1, R2, R3, and R4, and put all of the subnets from R1 and R2 in area 0, and put all of the subnets from R3 and R4 (including the routers) into OSPF area 1, would the ospf areas be shared such that OSPF on router R1 corresponds to OSPF on R2, and same with R3 and R4? And if so, how do you communicate between areas?&lt;/p&gt;&#xA;" OwnerUserId="27759" LastActivityDate="2016-07-12T02:29:55.717" Title="OSPF Areas (OSPFv3 and OSPF)" Tags="|routing|ospf|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="32994" PostTypeId="2" ParentId="32993" CreationDate="2016-07-10T22:08:14.483" Score="1" Body="&lt;p&gt;OSPF is arranged in areas, and all inter-area traffic must pass through the backbone area (Area 0). A router with interface(s) in Area 0 and a different area is an ABR (Area Border Router), through which traffic can pass between areas. You cannot, for example, have a router with one interface in Area 1, and another interface in Area 2 and expect it to pass traffic between those two areas; all inter-area traffic must pass through Area 0. This helps to prevent routing loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OSPF routers in a particular area have a full understanding of all the routes, paths, and routers in that area. An ABR, as a router in a non-backbone area and Area 0, has that knowledge of both areas.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-10T22:08:14.483" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="32998" PostTypeId="1" CreationDate="2016-07-11T08:53:19.400" Score="2" ViewCount="3717" Body="&lt;p&gt;As we know the speed of wireless connection  wifi depends on SNR&#xA;The speed (bitrate) maybe 20,10 or 5 Mbps&#xA;The question is: how is wifi can reduce or increase its bitrate? It use the same carrier (2.4 ghz) ! Is the bitrate changed by manipulate bit duration?&lt;/p&gt;&#xA;" OwnerUserId="27766" LastActivityDate="2016-07-16T19:14:09.623" Title="How wifi change bitrate?" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33002" PostTypeId="1" AcceptedAnswerId="33004" CreationDate="2016-07-11T13:30:11.750" Score="0" ViewCount="60" Body="&lt;p&gt;college student here with a desire to get a job as a network admin/technician later on in life. For me, learning by experience is the most beneficial way for me to learn the ins and outs of a new piece of software/hardware. The only issue (given my shoestring college student budget) is that I really can't gain any hands on experience with SMB/Enterprise grade networking software/hardware because of how expensive most products in this category are. Sure, reading through manuals can be enlightening, but for me nothing ever comes close to actually getting hands on experience tinkering with something. Any suggestions as to how to get more real-world networking skills with this level of software/hardware would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="27773" LastActivityDate="2016-08-10T14:36:59.963" Title="Gaining Experience with SMB/Enterprise Equipment" Tags="|routing|firewall|switching|" AnswerCount="1" CommentCount="3" ClosedDate="2019-03-02T02:17:05.950" ContentLicense="CC BY-SA 3.0" />
  <row Id="33004" PostTypeId="2" ParentId="33002" CreationDate="2016-07-11T13:38:01.453" Score="2" Body="&lt;p&gt;You have pretty much two options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Buy used equipment from Ebay which are dirt cheap. You won't get the latest and the greatest but if you are starting up, this is ideal. Do research on which equipment is best to start your lab. Many people have done great write ups on this. Just google for information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Cheapest option is to use simulators such as PacketTracer and GNS3. GNS3 gives you alot more options as it isn't locked down to a single vendor where as Packet Tracer is specific to Cisco equipment. With GNS3 you can use Cisco, JunOS, ComWare and ExtremeNetworks just to name a few. GNS3 website and forum is a great start to learn more about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies if my answer isn't too in-depth but this section of the site isn't really for questions like yours. This site is more dedicated for enterprise technical questions and not for learning, home setups, etc etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wish you all the best in your pursuit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-07-11T13:38:01.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33005" PostTypeId="1" CreationDate="2016-07-11T15:21:31.850" Score="1" ViewCount="744" Body="&lt;p&gt;Does anyone knows what kind of DDR2 memory goes to DIMM0 slot in Cisco 2911 router? I tried with 512 Mb and 1 Gb with 533, 677, 800 MHz, nothing will work. It say Verification not passed.&lt;/p&gt;&#xA;" OwnerUserId="3481" LastActivityDate="2016-07-11T15:21:31.850" Title="Cisco 2911 RAM memory upgrade" Tags="|cisco-isr|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33006" PostTypeId="1" CreationDate="2016-07-11T15:46:45.607" Score="1" ViewCount="180" Body="&lt;p&gt;Since the destination and source MAC addresses in a frame in a LAN change, how does it know where to finish, as the destination is only the next hop?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if there is a switch, which connects to hosts and another switch, and the 2nd switch connects to other hosts, on the master switch, does it store the MAC address for the 2nd switch in association with the 2nd switch, or the MAC address for the 2nd switch while associating it as the host?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Oza5o.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Oza5o.png&quot; alt=&quot;Image for the question&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27759" LastEditorUserId="8499" LastEditDate="2020-07-18T17:44:17.767" LastActivityDate="2020-07-18T17:44:17.767" Title="Switching and MAC Address representation?" Tags="|switching|mac-address|layer2|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33007" PostTypeId="2" ParentId="33006" CreationDate="2016-07-11T16:11:04.447" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Since the destination and source mac address in a frame in a LAN&#xA;  change, how does it know where to finish, as the destination is only the next hop?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is incorrect. The source and destination MAC addresses in a frame do not change on a LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source and destination MAC addresses in a frame are the real source and destination MAC addresses of the source and destination hosts on a LAN. A switch will read the source address of frames coming into a port, and it will use that information in order to build its MAC address table for which MAC address can be found on which port. It will then deliver the frame to the port for the destination MAC address it finds in its MAC address table. If it can't find the destination MAC address in its MAC address table, it will flood the frame to all other ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be thinking about the frame being stripped from a packet when it crosses a router, and the router needs to create a new frame with new source and destination MAC addresses for the next hop, but switches on a LAN are transparent devices. The only changes made to a frame may be the addition of a VLAN tag when a frame crosses a trunk, or the removal of a VLAN tag when a frame exits an access port.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-11T17:12:14.707" LastActivityDate="2016-07-11T17:12:14.707" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33008" PostTypeId="1" CreationDate="2016-07-11T16:22:54.010" Score="1" ViewCount="167" Body="&lt;p&gt;How do you tag a frame with VLAN header when your device is incapable of   VLAN tagging?&lt;/p&gt;&#xA;" OwnerUserId="27774" LastEditorUserId="8499" LastEditDate="2016-07-11T16:25:07.633" LastActivityDate="2016-07-11T16:27:37.817" Title="VLAN tagging when device unable to tag" Tags="|vlan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33009" PostTypeId="2" ParentId="33008" CreationDate="2016-07-11T16:27:37.817" Score="1" Body="&lt;p&gt;You don't. VLAN tags are used on trunk links in order for the devices (usually switches, sometimes routers or servers) on each end to be able to tell which frames belong to which VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices incapable of understanding VLAN tags should be connected to access ports which do not tag frames. The access port itself is configured for a particular VLAN in the switch, but it will not add VLAN tags to the frames exiting the access port.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-11T16:27:37.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33010" PostTypeId="2" ParentId="30466" CreationDate="2016-07-11T16:36:55.453" Score="0" Body="&lt;p&gt;I never really figured this out but I've moved on from it and chalked it up to the vlan linux package lacking some intelligence that Cisco has. (seeing as how Cisco understood when packets were meant for it and Linux didn't)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to all who took time for this.&lt;/p&gt;&#xA;" OwnerUserId="25427" LastActivityDate="2016-07-11T16:36:55.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33011" PostTypeId="1" AcceptedAnswerId="33012" CreationDate="2016-07-11T16:49:13.437" Score="2" ViewCount="217" Body="&lt;p&gt;since reading about the OSI model, which was created since 1984. My question is has there been any revision on the model. Or did the delegate who design the OSI model made it for everlasting.&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="27776" LastActivityDate="2016-07-11T16:56:00.853" Title="When last was the OSI model layer updated" Tags="|tcp|linux|udp|osi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33012" PostTypeId="2" ParentId="33011" CreationDate="2016-07-11T16:56:00.853" Score="2" Body="&lt;p&gt;The OSI model is &lt;a href=&quot;http://www.iso.org/iso/catalogue_detail.htm?csnumber=20269&quot; rel=&quot;nofollow&quot;&gt;ISO/IEC 7498-1:1994&lt;/a&gt;. It was last updated in 1994, and it had corrections applied in 1996. The seven-layer model itself has not really changed since it was first described, but the document containing it is in its second edition.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-11T16:56:00.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33013" PostTypeId="2" ParentId="33006" CreationDate="2016-07-11T17:06:38.983" Score="0" Body="&lt;p&gt;In response to your 2nd question, the answer is - it depends. If there is VLAN tagging between your two switches, then the L2 header would be modified with one or more VLAN tags on the connection between the two switches (however, this is not to say that any MAC addresses directly associated with the 2960s themselves would be involved in any kind of forwarding decision between the PCs - they wouldn't be).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming VLAN tagging is not being used in your example, then the answer would be no. Each switch would only know that there are multiple MAC addresses learned on each of its interfaces that have the connection to the other switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The top 2960 would have a MAC address table with 4 entries, and those entires would be the PC MAC addresses. One PC MAC on each of those ports, and 2 PC MACs learned via the interface that the bottom 2960 connects to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, the bottom 2960 would also have a MAC address table with 4 entries. One per PC MAC that was directly connected to the switch, and another 2 PC MACs learned via the interconnected interface to the top switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: And for completeness, as Ron pointed out, the L2 header is not modified when the frames are not crossing an L3 boundary.&lt;/p&gt;&#xA;" OwnerUserId="762" LastEditorUserId="762" LastEditDate="2016-07-11T17:29:26.460" LastActivityDate="2016-07-11T17:29:26.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33014" PostTypeId="2" ParentId="30466" CreationDate="2016-07-11T17:32:11.490" Score="0" Body="&lt;p&gt;Trunk links carry multiple VLANs.  Are you running multiple VM's on your server?  If not, why are you trunking to it?  Why trunk to the server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;switchport trunk allowed vlan add 3700&lt;/code&gt; should be deleted - just allow all until you get it working.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-11T17:32:11.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33018" PostTypeId="1" AcceptedAnswerId="33027" CreationDate="2016-07-11T19:34:19.847" Score="1" ViewCount="2816" Body="&lt;p&gt;Has anyone successfully used FTP on a Juniper Device. reading their documentation, the method of using it is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;file copy &amp;lt;source&amp;gt; &amp;lt;destination&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in my case:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;file copy /var/tmp/testdoc ftp://user:pass@hostname/user/home/&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I keep getting the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fetch: ftp://user:*@hostname/user/home/: File unavailable (e.g., file not found, no access)&#xA;error: put-file failed&#xA;error: could not send local copy of file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know the file is available, and it can see it because when i change the file name in the command (put in a non-existent file), it says no such file or directory exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried it the other way around as well (from the server to the rotuer) but I get &lt;code&gt;error: file-fetch failed&lt;/code&gt; instead. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is extremely frustrating as there is no documentation on this error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: The FTP is between the Juniper router and a Linux server.&#xA;I also tried going down to the file name itself:&#xA;&lt;code&gt;file copy /var/tmp/testdoc.txt ftp://user:pass@hostname/user/home/testdoc.txt&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="13422" LastEditorUserId="13422" LastEditDate="2016-07-11T19:38:39.197" LastActivityDate="2016-07-12T05:20:56.427" Title="FTP on Juniper MX series" Tags="|juniper|juniper-junos|tftp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33019" PostTypeId="2" ParentId="33018" CreationDate="2016-07-11T19:51:43.790" Score="1" Body="&lt;p&gt;This is extremely stupid, and not at all explained. When using the FTP command, if one hard codes the server path, IT WILL NOT WORK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, although this makes sense:&#xA;&lt;code&gt;file copy /var/tmp/testdoc ftp://user:pass@hostname/user/home/&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The correct command is:&#xA;&lt;code&gt;file copy /var/tmp/testdoc ftp://user:pass@hostname&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the file will pop-up in that users folder. Extremely stupid.&lt;/p&gt;&#xA;" OwnerUserId="13422" LastActivityDate="2016-07-11T19:51:43.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33020" PostTypeId="2" ParentId="32993" CreationDate="2016-07-12T02:29:55.717" Score="0" Body="&lt;p&gt;I suppose a good analogy is to think of a businesses private network as an OSPF area, and then on the exterior a business will have a DMZ area which allows connections to the world-wide Internet (another area).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, each of your networks can only communicate with the &quot;outside world&quot; from its edge (like the DMZ). That's one reason you're being asked for the topology: how specifically do the parts of your net relate to one another?&lt;/p&gt;&#xA;" OwnerDisplayName="user27646" LastActivityDate="2016-07-12T02:29:55.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33022" PostTypeId="2" ParentId="32898" CreationDate="2016-07-12T02:43:48.497" Score="0" Body="&lt;p&gt;Remember, it's MAC addresses and ARP for comm between workstation and switches and it's IP addresses and routers for comm to remote networks.&lt;/p&gt;&#xA;" OwnerDisplayName="user27646" LastActivityDate="2016-07-12T02:43:48.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33024" PostTypeId="2" ParentId="32872" CreationDate="2016-07-12T02:55:52.253" Score="0" Body="&lt;p&gt;Unless, of course, he is being required to use RIP in a class or something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per subnetting and finding the right CIDR (/xx)...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the 3rd octet for your four subnets, you only need the first two bits to express 0, 1, 2, 3. The value of those two bits is/are 128 + 64 --&gt; 192, thus 10.48.192.0/18. This would leave you 6 bits of the 3rd octet and 8 in the 4th octet to address specific devices (a lot of them, 8K I think).&lt;/p&gt;&#xA;" OwnerDisplayName="user27646" LastActivityDate="2016-07-12T02:55:52.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33027" PostTypeId="2" ParentId="33018" CreationDate="2016-07-12T05:11:40.303" Score="1" Body="&lt;p&gt;Before attempting to copy your file, you should first create the file on the server where it is being copied, set permissions so that it can be overwritten, and specify it in the copy path. Please also check that you have that directory accessible via ftp.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;touch testdoc.txt&#xA;chmod 777 testdoc.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Example permission You may want to be more restrictive)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;file copy /var/tmp/testdoc.txt ftp://user:pass@hostname/user/home/testdoc.txt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can also use ftp in the following way (again following creation and permissions set):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ftp juniperdevice.mynetwork.net&#xA;get /var/tmp/testdoc.txt testdoc.txt&#xA;quit ftp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Additional items to check:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;That your MX device is properly configured for name lookups.&lt;/li&gt;&#xA;&lt;li&gt;That your MX device is configured for FTP &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos15.1/topics/task/configuration/ftp-remote-access-configuring.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/documentation/en_US/junos15.1/topics/task/configuration/ftp-remote-access-configuring.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;That your server is configured for FTP.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Official Documentation:&#xA;&lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos15.1/topics/reference/command-summary/file-copy.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/documentation/en_US/junos15.1/topics/reference/command-summary/file-copy.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14613" LastEditorUserId="509" LastEditDate="2016-07-12T05:20:56.427" LastActivityDate="2016-07-12T05:20:56.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33029" PostTypeId="1" CreationDate="2016-07-12T05:53:42.647" Score="1" ViewCount="830" Body="&lt;p&gt;I am reading Computer Networks by Tanenbaum. It says that there can be three types of services in data link layer. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Unacknowledged Connectionless&lt;/li&gt;&#xA;&lt;li&gt;Acknowledged Connectionless&lt;/li&gt;&#xA;&lt;li&gt;Acknowledged Connection-oriented&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I can understand that it is better to use the first type if the medium is very reliable and the second type if it is the opposite (wireless). But I cannot understand what acknowledged connection-oriented service provides that acknowledged connectionless service cannot. The book says that &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If&#xA;  acknowledged connectionless service were used, it is conceivable that lost acknowledgements could cause a frame to be sent and received several times, wasting bandwidth.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How is it that connection-oriented service does not send or receive a frame multiple times? Acknowledgement can be lost in this case too.&lt;/p&gt;&#xA;" OwnerUserId="25395" LastActivityDate="2018-06-10T12:27:46.313" Title="How does connection-oriented service at data link layer ensure each frame is sent and recieved 'once'?" Tags="|layer2|osi|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33030" PostTypeId="2" ParentId="28321" CreationDate="2016-07-12T06:14:40.940" Score="2" Body="&lt;p&gt;The setup above will not work as-is, because you have the ASA sitting behind the ISP router. In order for the VPN to work in this implementation you must make use of NAT-T (NAT Traversal). This is because ESP is it's own protocol, and the ISP router does not know what to do with it. By using NAT-T you are encapsulating (re-packing essentially) the ESP packets into UDP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: Even though the customer is the only device using NAT, NAT-T will need to be configured on both sides so that is can understand what needs done with the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Enabling NAT-T on an ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname(config)# crypto isakmp nat-traversal 3600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above sets NAT timeout to one hour, this can be reduced if you experience issues.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname(config)# crypto ipsec fragmentation before-encryption&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Enabling NAT-T on SRX:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as the following command is absent from your SRX config, the VPN should come up fine:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no-nat-traversal;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also on the customer's ISP router you have the ports being forwarded to the inside address of the ASA. You should be forwarding the traffic to the outside interface of the ASA.&lt;/p&gt;&#xA;" OwnerUserId="14613" LastEditorUserId="8499" LastEditDate="2016-07-12T13:04:25.080" LastActivityDate="2016-07-12T13:04:25.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33031" PostTypeId="2" ParentId="32961" CreationDate="2016-07-12T06:43:25.010" Score="1" Body="&lt;p&gt;VDSL Vectoring is a method of increasing the speed of a given VDSL2 (G.993.2/FTTC) line so that it can achieve a higher speed than it would otherwise achieve. It does so by using noise cancelling technology to reduce interference from adjacent lines or other services or plant (equipment). Vectoring is defined by the ITU-T standard G.993.5.&#xA;More detailed information:&lt;a href=&quot;http://www.draytek.co.uk/support/guides/kb-what-is-vdsl-vectoring-sra-and-ginp&quot; rel=&quot;nofollow&quot;&gt;http://www.draytek.co.uk/support/guides/kb-what-is-vdsl-vectoring-sra-and-ginp&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-07-12T06:43:25.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33033" PostTypeId="2" ParentId="33029" CreationDate="2016-07-12T13:03:05.777" Score="2" Body="&lt;p&gt;What you are reading about is not at the Data-link layer, it is at the Transport layer. The application (off-topic here) decides what to use. The difference between number 2 and number 3 is that the application must provide the acknowledgements in number 2, but number 3 relies on the transport protocol to do that for the application.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-12T13:03:05.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33034" PostTypeId="1" CreationDate="2016-07-12T13:04:45.190" Score="1" ViewCount="870" Body="&lt;p&gt;I have an Unifi AP which is capable of making multiple wlans. The AP is connected to a tplink smartswitch from which it gets internet access and sees everything in the network. The switch is connected to the gateway server, the AP gets it's ip from there. I'd like to make 2 wlans, one of them has to have access to the current network and the other one would be a &quot;guest&quot; wlan which would have only internet access and would not see the internal network with all the other servers on it. Is it be possible to have one of the guest wlan in a vlan so it wouldn't see the internal network (only internet access), and the leave the other one as it is without setting any vlan for it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="27792" LastActivityDate="2016-07-13T11:43:02.477" Title="VLAN and LAN on the same port" Tags="|vlan|wireless|lan|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33036" PostTypeId="1" AcceptedAnswerId="33037" CreationDate="2016-07-12T13:46:55.883" Score="0" ViewCount="2032" Body="&lt;p&gt;I have Mikrotik router, which has WAN connected at ether1. Now I need to set up NAT to send TCP and UDP on port 25565 to IP 192.168.2.42 and every other port (all protocols) to 192.168.2.41&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my current configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5DOJu.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5DOJu.png&quot; alt=&quot;Mikrotik configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am looking for is to descrease priority of rule #1 and increase priority of rule #2 and #3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I do this? If there are no priorities, what is the correct way of this implementation?&lt;/p&gt;&#xA;" OwnerDisplayName="user16223" LastEditorUserId="8499" LastEditDate="2018-02-14T16:21:36.800" LastActivityDate="2018-02-14T16:21:36.800" Title="Mikrotik NAT rules order" Tags="|nat|" AnswerCount="1" CommentCount="7" ClosedDate="2017-08-09T23:43:32.773" ContentLicense="CC BY-SA 3.0" />
  <row Id="33037" PostTypeId="2" ParentId="33036" CreationDate="2016-07-12T13:58:23.393" Score="0" Body="&lt;p&gt;The rules are tested in order. It appears that drag-and-drop does not work with this, and it seems that you need to delete the rules and recreate them in the correct order.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-12T13:58:23.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33038" PostTypeId="1" AcceptedAnswerId="33039" CreationDate="2016-07-12T14:33:50.100" Score="3" ViewCount="312" Body="&lt;p&gt;I am reading &lt;em&gt;TCP/IP Illustrated&lt;/em&gt; recently, and I am confused about the IP Routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the routing table in that text:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/u2Mkd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u2Mkd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Flags:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;G: The route is to a gateway (router). If this flag is not set, the&#xA;  destination is directly connected.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;H: The route is to a host, that is, the destination is a complete host&#xA;  address. If this flag is not set, the route is to a network, and the&#xA;  destination is a network address: a net ID, or a combination of a net&#xA;  ID and a subnet ID.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The author gives some examples about that, one of them is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Assume the destination address is the host sun, 140.252.13.33. A&#xA;  search is first made for a matching host entry. The two host entries&#xA;  in the table (slip and localhost) don't match, so a search is made&#xA;  through the routing table again for a matching network address. A&#xA;  match is found with the entry 140.252.13.32 (the network IDs and&#xA;  subnet IDs match), so the emd0 interface is used. This is a direct&#xA;  route, so the link-layer address will be the destination address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's what makes me confused. The destination address should be the host sun &lt;code&gt;140.252.13.33&lt;/code&gt;, but as he said, it matches the entry &lt;code&gt;140.252.13.32&lt;/code&gt; (the network IDs and subnet IDs match), and the flag of this entry is &lt;code&gt;U&lt;/code&gt;, no &lt;code&gt;G&lt;/code&gt;, no &lt;code&gt;H&lt;/code&gt;, the packet will directly send to him, so the packet whose destination address is sun (&lt;code&gt;140.252.13.33&lt;/code&gt;) finally be send to &lt;code&gt;140.252.13.32&lt;/code&gt;? That doesn't make sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Sorry for my bad English; I hope you guys could get what I am talking about.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="27796" LastEditorUserId="8499" LastEditDate="2016-07-12T14:45:30.767" LastActivityDate="2016-07-13T13:09:00.547" Title="IP Routing In TCP/IP Illustrated" Tags="|tcp|ip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33039" PostTypeId="2" ParentId="33038" CreationDate="2016-07-12T14:43:08.597" Score="1" Body="&lt;p&gt;The &lt;code&gt;140.252.13.32&lt;/code&gt; routing table entry is a network. If traffic is destined to &lt;code&gt;140.252.13.33&lt;/code&gt;, the routing table will be searched for the longest match to that address. The longest match is &lt;code&gt;140.252.13.32&lt;/code&gt;, so the traffic destined to &lt;code&gt;140.252.13.33&lt;/code&gt; will be sent &lt;code&gt;140.252.13.34&lt;/code&gt;, the gateway to the &lt;code&gt;140.252.13.32&lt;/code&gt; network. The router assumes that &lt;code&gt;140.252.13.34&lt;/code&gt; knows how to get the traffic to &lt;code&gt;140.252.13.33&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-12T14:43:08.597" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33041" PostTypeId="1" AcceptedAnswerId="33368" CreationDate="2016-07-12T19:11:55.850" Score="3" ViewCount="3515" Body="&lt;p&gt;i am playing with the 802.11 header, trying to figure out the encryption type of incoming 0x08(DATA) packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/A6N3j.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/A6N3j.gif&quot; alt=&quot;802.11 Header&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I capture the 0x08 type packet (DATA).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) I find out that a WEP bit is set (2nd byte of Frame Control, 7th BIT). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Now i need to figure out, if this is a WEP encrypted or WPA encrypted packet, how do i find out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;08 42 00 00 FF FF FF FF FF FF 34 7A 60 72 A7 9A 80 86 F2 24 0C 2F 80 A5 C0 01 00 60 59 ED 78 D9 3E D4 59 43 01 00 82 00 80 A5 80 86 F2 24 0C 2F 6C 03 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 27 00 AC 04 01 00 00 0F AC 04 01 00 00 0F AC 02 0C 00 32 04 0C 12 18 60 0B 05 01 00 41 00 00 2D 1A BC 19 1B FF FF 00 01 00 19 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And here are the bits of first 2 bytes of Frame Control:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;0 0 0 0 1 0 0 0 | 0 1 0 0 0 0 1 0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It looks like &lt;strong&gt;WEP&lt;/strong&gt; bit is set both for &lt;strong&gt;WEP&lt;/strong&gt; and &lt;strong&gt;WPA&lt;/strong&gt; packets am i correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any input into this.&lt;/p&gt;&#xA;" OwnerUserId="27803" LastEditorUserId="27803" LastEditDate="2016-07-12T20:07:05.370" LastActivityDate="2018-11-28T08:01:39.680" Title="802.11 how do i find out if packet is encrypted with WEP or WPA" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33044" PostTypeId="2" ParentId="29524" CreationDate="2016-07-12T21:39:23.730" Score="5" Body="&lt;p&gt;No.  Sometimes there is no IP connectivity to the target so a response never arrives, or there may be no TCP protocol stack on the target, or there may be other protocols/services in place to disallow a particular connection.  However, if there is IP connectivity, a TCP protocol stack on both hosts, and a default implementation then yes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Transmission_Control_Protocol&quot; rel=&quot;noreferrer&quot;&gt;Connection establishment&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To establish a connection, TCP uses a three-way handshake. Before a client attempts to connect with a server, the server must first bind to and listen at a port to open it up for connections: this is called a passive open. Once the passive open is established, a client may initiate an active open. To establish a connection, the three-way (or 3-step) handshake occurs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SYN: The active open is performed by the client sending a SYN to the server. The client sets the segment's sequence number to a random value A.&#xA;SYN-ACK: In response, the server replies with a SYN-ACK. The acknowledgment number is set to one more than the received sequence number i.e. A+1, and the sequence number that the server chooses for the packet is another random number, B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ACK: Finally, the client sends an ACK back to the server. The sequence number is set to the received acknowledgement value i.e. A+1, and the acknowledgement number is set to one more than the received sequence number i.e. B+1.&#xA;At this point, both the client and server have received an acknowledgment of the connection. The steps 1, 2 establish the connection parameter (sequence number) for one direction and it is acknowledged. The steps 2, 3 establish the connection parameter (sequence number) for the other direction and it is acknowledged. With these, a full-duplex communication is established.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-12T21:39:23.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33045" PostTypeId="2" ParentId="32885" CreationDate="2016-07-12T22:01:24.297" Score="0" Body="&lt;p&gt;OK Guys, &#xA;   After looking into the answers and help by Ron, this is how i completed the project.&#xA;I console into the new switch that was being added to stack and check the IOS image installed in the switch. Then i checked the IOS image installed in the stack. As the images were different I had to download IOS that matched the stack. I went to cisco.com to get the IOS. For this you will need the credential to login and from there you can browse to pick the desired IOS. After downloading the IOS, i saved it in the TFTP server folder. Then I consoled back into my new switch and formated the flash of the new switch [using command sw#format flash: ] since there was not enough space to save the new IOS. After that, I transferred the IOS from the tftp folder to flash of the new switch using the TFTP server. Once the IOS was in the flash, I went to config mode of the switch and used the command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sw(config)# boot system flash:/c3750-ipbasek9-mz.122-55.SE6.bin &lt;/p&gt;&#xA;&#xA;&lt;p&gt;sw(congig)# do reload&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This rebooted my switch with the new IOS and there was the IOS that matched my IOS with the stack in the new switch.&#xA;I did this on both of my new switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, while i was consoled into my new switch before adding them to the stack, I change their priority to 1. I didnt renumber them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, I went to my stack before adding the new switch and used the command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;stack(config)#switch 7 provision ws-c3750-48p&lt;/p&gt;&#xA;&#xA;&lt;p&gt;stack(config)# do wr&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had my new switches turned off before adding to stack. I installed the switch connected the stack cables to the new switch and stack and tunred on the power. The switch powered on and after a couple of second it became the member of the stack. and there you go all done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways I want to thank Ron for his help on this.&lt;/p&gt;&#xA;" OwnerUserId="25763" LastActivityDate="2016-07-12T22:01:24.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33046" PostTypeId="2" ParentId="32816" CreationDate="2016-07-12T22:13:54.113" Score="1" Body="&lt;p&gt;OK Guys, After looking into the answers and help by Ron, this is how i completed the project. I console into the new switch that was being added to stack and check the IOS image installed in the switch. Then i checked the IOS image installed in the stack. As the images were different I had to download IOS that matched the stack. I went to cisco.com to get the IOS. For this you will need the credential to login and from there you can browse to pick the desired IOS. After downloading the IOS, i saved it in the TFTP server folder. Then I consoled back into my new switch and formated the flash of the new switch [using command sw#format flash: ] since there was not enough space to save the new IOS. After that, I transferred the IOS from the tftp folder to flash of the new switch using the TFTP server. Once the IOS was in the flash, I went to config mode of the switch and used the command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sw(config)# boot system flash:/c3750-ipbasek9-mz.122-55.SE6.bin&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sw(congig)# do reload&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This rebooted my switch with the new IOS and there was the IOS that matched my IOS with the stack in the new switch. I did this on both of my new switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that, while i was consoled into my new switch before adding them to the stack, I change their priority to 1. I didnt renumber them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, I went to my stack before adding the new switch and used the command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;stack(config)#switch 7 provision ws-c3750-48p&lt;/p&gt;&#xA;&#xA;&lt;p&gt;stack(config)# do wr&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had my new switches turned off before adding to stack. I installed the switch connected the stack cables to the new switch and stack and tunred on the power. The switch powered on and after a couple of second it became the member of the stack. and there you go all done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyways I want to thank Ron for his help on this.&lt;/p&gt;&#xA;" OwnerUserId="25763" LastActivityDate="2016-07-12T22:13:54.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33047" PostTypeId="1" CreationDate="2016-07-12T23:08:24.560" Score="2" ViewCount="165" Body="&lt;p&gt;I may be barking up a tree that doesn't exist but I am trying to find out if there is a way to limit a user or group's access to only a specific VRF. This is a 6500 series switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note, I am not trying to control access FROM a VRF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have an ACS server so if it can't be done with access-class or other commands on the switch itself, I'm wondering if it would be possible to limit access to config commands within a specific VRF. As I write this, I don't think this would really be possible as you can configure an interface that's in a specific VRF without specifying the VRF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I'm asking is we are going to connect to our parent company's WAN using a VRF on our core switch. However, they're saying they need access to whatever equipment they will be peering with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not so worried about the show commands. It's more the configuration commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, we'll just have to count on our logging to let us know something's been changed.&lt;/p&gt;&#xA;" OwnerUserId="23610" LastActivityDate="2016-07-29T20:01:10.007" Title="Limit Access to a Specific VRF?" Tags="|aaa|tacacs|vrf|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33048" PostTypeId="1" AcceptedAnswerId="33055" CreationDate="2016-07-13T01:45:45.120" Score="1" ViewCount="3431" Body="&lt;p&gt;I apologize if this is an easy fix, but I just got a used 2960 series S switch and am unable to connect to it through the default gateway. I am using a straight-through, RJ-45 connector ethernet cable with DHCP enabled. I power on the switch and wait till the POST finishes before connecting the ethernet cable, and then wait until the light above the port starts blinking green, afterwards I hold down the mode button until all the lights turn a solid green (to enter into express setup.) When I try to go to the default gateway (10.0.0.1 according to the online documentation) my browser (chrome) says that the site can't be reached. When I type ipconfig into the command line, the line which lists the default gateway is empty. Some of the things I have tried are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Connecting from both Windows 10 and Fedora 23 (with DHCP enabled on both.)&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Connecting from both my laptop and my desktop. &lt;/li&gt;&#xA;&lt;li&gt;Using a different ethernet cable (still RJ-45 straight-through.)&lt;/li&gt;&#xA;&lt;li&gt;Using different ports on the switch (I started with port 1 but have tried several others.)&lt;/li&gt;&#xA;&lt;li&gt;Factory reset the switch by holding down the mode button until the device cycles through POST again. &lt;/li&gt;&#xA;&lt;li&gt;Attempted to SSH into the switch using PUTTY on address 10.0.0.1&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I hope I have given enough information, I am new to networking so if there is anything else I can provide just let me know. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I am using a Lenovo Z400 touch laptop to connect to the switch with a RealTek PCIe Family Controller for the ethernet.&lt;/p&gt;&#xA;" OwnerUserId="27810" LastEditorUserId="27810" LastEditDate="2016-07-14T00:42:39.527" LastActivityDate="2016-07-14T00:42:39.527" Title="Unable to connect to cisco 2960 switch through the default gateway" Tags="|switch|ethernet|cisco-catalyst|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33049" PostTypeId="2" ParentId="22416" CreationDate="2016-07-13T02:28:20.507" Score="0" Body="&lt;p&gt;Solaris 10 and onwards support DAD (RFC 5227) for IPv4 for both static assigned IP addresses and dynamically assigned IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The dhcp daemon (dhcpd) on NetBSD and other platforms (such as Ubuntu) supports RFC 5227.&lt;/p&gt;&#xA;" OwnerUserId="27811" LastActivityDate="2016-07-13T02:28:20.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33050" PostTypeId="2" ParentId="29945" CreationDate="2016-07-13T06:08:12.143" Score="0" Body="&lt;p&gt;you have one more than solution to solve this problem ..one of them code here delete interfaces ge-1/0/44 unit 0 family ethernet-switching vlan..we deleted all vlan on interface after we can add vlan on interface ge-1/0/44...&#xA;as you can see that   set interface ge-1/0/44 unit 0 family ethernet switching vlan member ...(vlan id example 20)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you cant delete vlan before remove existing vlan on interface&lt;/p&gt;&#xA;" OwnerUserId="27813" LastEditorUserId="8499" LastEditDate="2016-07-13T06:28:02.900" LastActivityDate="2016-07-13T06:28:02.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33052" PostTypeId="2" ParentId="20544" CreationDate="2016-07-13T06:41:12.857" Score="-3" Body="&lt;pre&gt;&lt;code&gt;root@host# edit system login&#xA;root@switch# edit user huzeyfe&#xA;root@switch# set class super-user&#xA;root@switch# set authentication plain-text-password&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27813" LastEditorUserId="8499" LastEditDate="2016-07-13T06:41:51.923" LastActivityDate="2016-07-13T06:41:51.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33053" PostTypeId="2" ParentId="29590" CreationDate="2016-07-13T07:31:41.877" Score="2" Body="&lt;p&gt;In NX OS version 6 the following works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username &amp;lt;your username&amp;gt; sshkey ssh-rsa &amp;lt;your rsa key&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You must of course set the access level with, for example for full access&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username &amp;lt;your usernam&amp;gt; role network-admin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-07-13T07:31:41.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33055" PostTypeId="2" ParentId="33048" CreationDate="2016-07-13T09:16:08.913" Score="1" Body="&lt;p&gt;You will need to log on to the switch via console cable (light blue with a serial port on one end and an rj45 on the other end- you can buy USB adaptors for it if you don't have a serial port on your PC/Laptop). In my experience you when you first start a fresh install/config of a device you will have to set SSH access through the line vty transport input telnet/ssh command. You will also need to create and open a VLAN, assign that an IP address then 'noshut' an interface, chuck it in a VLAN. You can connect a cable to that that port and then connect via putty using ssh to the switch using the IP address you assigned the VLAN. Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="23768" LastActivityDate="2016-07-13T09:16:08.913" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33057" PostTypeId="2" ParentId="10870" CreationDate="2016-07-13T09:45:02.900" Score="0" Body="&lt;p&gt;From a optical technician's point, poeple are likely to call those fibers that can be used in Ethernet Network as Ethernet cable, such as UTP cable, Fiber or coax.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But UTP (Unshielded Twisted Pair) cable is the most common kind of copper cable. &lt;/p&gt;&#xA;" OwnerUserId="24835" LastActivityDate="2016-07-13T09:45:02.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33058" PostTypeId="2" ParentId="32968" CreationDate="2016-07-13T09:57:22.867" Score="4" Body="&lt;p&gt;A loopback interface is a virtual (i.e. not physical) interface that &lt;em&gt;never goes down&lt;/em&gt;, unless you disable it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way, if you configure an IP on this loopback interface and add it to your OSPF area (or any other routing protocol), it will always be reachable by whatever available/best path exists, provided that your router is not completely isolated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see several different cases where loopback IPs are better than &quot;physical&quot; IPs :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Administrative access to your device (Telnet, SSH, SNMP, HTTP API, etc.). With loopback IP you do not have to select an IP that may be down.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Sessions between devices (iBGP, targeted LDP, etc.). With loopback interface, if one path goes down the session remains up and just uses another path thanks to your internal routing protocol converging.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Administrative traffic &lt;em&gt;from&lt;/em&gt; the device (Syslog, SNMP traps, sFlow/NetFlow, etc.). When you configure your device to use one of its loopback interface as a source to such services, you are able to filter/arrange such traffic by source IP on the receiving server without risk of it changing on the first topology movement.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In other words, loopback interfaces are a way to have a unique IP to identify or access the device, independent of topology changes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per Router IDs, it is usual to use the IP of the loopback interface for clarity (and most devices do this by default) but it is not mandatory at all.&lt;/p&gt;&#xA;" OwnerUserId="564" LastEditorUserId="564" LastEditDate="2016-07-13T10:07:29.810" LastActivityDate="2016-07-13T10:07:29.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33059" PostTypeId="2" ParentId="33047" CreationDate="2016-07-13T10:33:27.153" Score="2" Body="&lt;p&gt;Since there's no &quot;vrf mode,&quot; I can't see any way to make this happen.  You could use ACS to prevent them from entering config mode -- that would give them access to show commands.  Presumably that's all they need.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-13T10:33:27.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33061" PostTypeId="1" AcceptedAnswerId="33063" CreationDate="2016-07-13T10:40:48.253" Score="6" ViewCount="7343" Body="&lt;p&gt;I'm trying to understand something related to network ports, as it's not quite clear to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, why can't you use the same port number for both incoming and outgoing traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question arose due to some advice on NAT port forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I can tell, IP packet headers contain fields for source address and destination address, which I'd imagine would be all you'd need to know to determine whether the packet was incoming or outgoing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realise this is a simple question. If there are learning resources you could point me to that you think would be useful in building up a deeper understanding of networking from the fundamentals up, I'd appreciate the links, even if there's a lot to learn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="27818" LastActivityDate="2021-01-11T14:48:16.753" Title="Why can't a single port be used for both incoming and outgoing traffic?" Tags="|routing|ip|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33062" PostTypeId="2" ParentId="33061" CreationDate="2016-07-13T11:05:40.750" Score="3" Body="&lt;p&gt;A physical port can and is used for receiving and transmitting unless the port has been specifically configured to half-duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think where you are getting confused is the actual port source and destination which has nothing to do with a physical port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to NAT, the destination and source port number will be different. The destination port number which will sit on a server that provides the service such as port 80 for HTTP. The software will receive many connection requests on this port number and the software will need to distinguish the different processes for each connection that comes in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source port number will be a randomly chosen upper port that is not used for any particular service and this will reside on the client device as they are the source of the connection. This also helps the software to distinguish the various connections that are being made for different clients. Imagine a HTTP server with hundreds of simultanious connections and not to mention the different connections the browser will make on port 80 itself as destination. When the data comes back, it relies on the source port number to tell the software where the data is destined for in the upper layers of the stack model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT uses the source port number to manage the different connections that are being NAT'd. If they all used the same source port, then NAT, using it's table, would not be able to distinguish between the different connections, and know where it needs to forward the data to on the local network.So a source port is mapped to a local IP address that is on the inside of the NAT for as long as the TCP connection is still alive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get a better idea of what is happening and to udnerstand why the source port can't be the same, check out this resource:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.firewall.cx/networking-topics/protocols/tcp/133-tcp-source-destination-ports.html&quot; rel=&quot;nofollow&quot;&gt;http://www.firewall.cx/networking-topics/protocols/tcp/133-tcp-source-destination-ports.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.firewall.cx/networking-topics/network-address-translation-nat/233-nat-overload-part-1.html&quot; rel=&quot;nofollow&quot;&gt;http://www.firewall.cx/networking-topics/network-address-translation-nat/233-nat-overload-part-1.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="27056" LastEditDate="2016-07-13T11:10:46.980" LastActivityDate="2016-07-13T11:10:46.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33063" PostTypeId="2" ParentId="33061" CreationDate="2016-07-13T11:10:42.147" Score="6" Body="&lt;p&gt;You can, and some protocols do (isakmp), but it's not very flexible. There are two drawbacks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You can have only one data stream.  A typical web browser makes several tcp connections to a web server to increase performance.  That's why you often see the text appear before the graphics on a web page. you can't do that with only one stream.&lt;/li&gt;&#xA;&lt;li&gt;It's possible for a host to be both a client and a server at the same time.  If the port numbers are the same, you can't do that either.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Ultimately, using well-known ports for destination and ephemeral ports for source gives the most flexibility.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-13T11:10:42.147" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33065" PostTypeId="2" ParentId="33034" CreationDate="2016-07-13T11:43:02.477" Score="2" Body="&lt;p&gt;Just create a second VLAN for your guest and make sure the uplink ports have the VLAN tagged all the way to your server that is performing the routing/NAT. So tag the new VLAN on the edge port the server is connecting to as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to make sure that your server NIC does understand VLAN tags. If it does not, you will need to get one that does or install a second NIC that will be dealing with the additional VLAN/Subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the edge port where your access point is connecting, make sure that the guest VLAN is tagged and your main VLAN is either tagged or untagged, depending on the configuration on the access point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When creating your WLAN, make sure that you specify which VLAN each WLAN has to use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for Main SSID you can say VLAN1, and your Guest SSID, VLAN2. This will make sure that the connection is placed on the correct VLAN once a client connects to the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the guest subnet, you need to assign a range of IP addresses, with your server being the gateway.&#xA;You will also need to deal with DHCP on this VLAN so you need some kind of DHCP relay-agent on the server but I am not 100% sure how this would be configured on your setup, not knowing all the details. Normally you will confiure this on your switch that has the vlan interface configured, which in this case I believe would be your server. If this server is also a DHCP server, then I think as long as the new DHCP scope has been created, you should be all good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get pfsense to do the routing from your guest VLAN to your WAN interface but do not allow it route to the main VLAN and obviously configure NAT to allow this new subnet to get out to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-07-13T11:43:02.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33067" PostTypeId="2" ParentId="33061" CreationDate="2016-07-13T14:03:36.140" Score="0" Body="&lt;p&gt;In networking, we often speak of physical and logical.  Physical ports are actually pairs of links - 1 send and 1 receive, TX &amp;amp; RX.  Logical ports are defined in software, for example, an &lt;em&gt;IP Stack&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A T1 physical port, for example, is 1.544Mbps - in both directions.  It's actually two links -send and recieve.  Same goes for Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xJIKP.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xJIKP.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-13T14:03:36.140" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33072" PostTypeId="1" CreationDate="2016-07-13T16:33:30.313" Score="1" ViewCount="168" Body="&lt;p&gt;A client I am working with has a 48-port switch with various wired devices connected to it throughout the building they are in. I am trying to determine what method I should use to monitor network bandwidth. The switch itself is not managed so there is no web interface I can look into. Even if there was, I would rather use a piece of software to diagnose network congestion issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my problem. Not all traffic flows through the one server that is present. What is the most efficient method for me to monitor the traffic on the network without slowing things down? If I use a mirror port on the switch (which is Gigabit), wouldn't this total traffic bring down the switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't messed with this level of monitoring before so I am trying to take things slow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to use SoftPerfect's Network Manager to monitor just basic bandwidth usage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client will be expanding to a second office in the next year, so I would like to be able to monitor that network as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should I configure the physical cables so I can get a view of ALL traffic wehther it flows through the server or not? Since the switch desn't send packets not bound for a specific MAC to all ports (like a hub does), how can I see everything that's going on? SNMP? Does SNMP only work if ALL devices are using it? Help me steer the boat correctly :).&lt;/p&gt;&#xA;" OwnerUserId="27830" LastActivityDate="2016-07-15T08:13:16.843" Title="What network topology should I use to monitor traffic?" Tags="|snmp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33075" PostTypeId="1" AcceptedAnswerId="33076" CreationDate="2016-07-13T19:52:31.803" Score="1" ViewCount="1244" Body="&lt;p&gt;I have multiple VLAN on switch but i want to make my switch as &lt;code&gt;root&lt;/code&gt; for &lt;code&gt;vlan200&lt;/code&gt; only and rest will be &lt;code&gt;secondary&lt;/code&gt; but i am confused in following two method&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to set following SW1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 200     - 24576&#xA;vlan 100,300 - 36864&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Should i use following, but in following command how do i tell &lt;code&gt;vlan 100 and 300&lt;/code&gt; use priority &lt;code&gt;36864&lt;/code&gt; ?? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#spanning-tree vlan 200 priority 24576&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Or&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;should I use following?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#spanning-tree vlan 201 root primary&#xA;SW1#spanning-tree vlan 100,300 root secondary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-07-13T21:21:44.827" Title="spanning-tree multiple vlan priority" Tags="|cisco|switch|vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33076" PostTypeId="2" ParentId="33075" CreationDate="2016-07-13T21:21:44.827" Score="3" Body="&lt;p&gt;To achieve the priorities you want, you can do the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#spanning-tree vlan 200 priority 24576&#xA;&#xA;SW1#spanning-tree vlan 100 priority 36864&#xA;&#xA;SW1#spanning-tree vlan 300 priority 36864&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What this will do, is make SW1 the root bridge for vlan 200 providing the current root bridge is above this value or using the default value on 32768.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you are setting vlan 100 and 300, above the default value of 32786, SW1 will become least likely the root bridge for those two vlan's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#spanning-tree vlan 201 root primary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Will make SW1, the root bridge for vlan 201. This command basically sets the lowest priority it needs, to become the root bridge. Remember, the lower the priority, the more likely the switch becomes the root bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#spanning-tree vlan 201 root secondary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will change the switch's priority, just low enough, without becoming the root bridge, in turn making it the root bridge, should the primary root bridge fail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please also keep in mind that all the effects described are dependent on using the default values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-07-13T21:21:44.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33078" PostTypeId="1" AcceptedAnswerId="33153" CreationDate="2016-07-13T22:14:59.200" Score="1" ViewCount="287" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jCr0G.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jCr0G.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;I have a ptp wireless network that spans 20 miles from one location to another. It works great. This is a critical network connection for us. I would like to have a vpn backup in case it should ever go down. How can I make this happen automatically? I use peplink routers and can setup the vpn at that location fine, but if my point to point goes down, how can I fail over to the vpn? Is this obtainable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I just use the same network subnet for both locations. Because I'm using ptp it works fine. I think I would probably need to set the remote location up as a different subnet or put it on a vlan then whether I'm connected either way it would work. The problem comes in when the network ptp goes down. How do I reroute everything through the vpn I would setup? Would it already be connected? If I had them both up wouldnt I get some routing issues?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the office I have a peplink balance one router connected to tplink vlan able swtiches. I use a peplink balance 20 at the remote office and the same switches. The wireless connection is handled by ubiquti rocket m5s with 30db gain dishes. &lt;/p&gt;&#xA;" OwnerUserId="10008" LastEditorUserId="10008" LastEditDate="2016-07-16T17:59:01.697" LastActivityDate="2016-07-16T17:59:01.697" Title="Network failover from PTP Wirless to VPN" Tags="|vpn|failover|point-to-point|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33079" PostTypeId="2" ParentId="32960" CreationDate="2016-07-14T01:05:06.823" Score="0" Body="&lt;p&gt;Please forgive me with the short answer. You need a router for your best solution.&#xA;If you are an open source person, put a 1RU server with 2+ NICs install VyOS.&#xA;Sorry for the short answer but you need additional device for your best to protect yourself from all the blaming from your boss later as they will do. ;) &lt;/p&gt;&#xA;" OwnerUserId="27809" LastActivityDate="2016-07-14T01:05:06.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33082" PostTypeId="1" AcceptedAnswerId="33083" CreationDate="2016-07-14T06:32:59.543" Score="1" ViewCount="79" Body="&lt;p&gt;I've been looking for some examples to configure a subnet, and I've seen that, for example, when you have this IPv4 network for the hosts &lt;code&gt;192.168.0.0/24&lt;/code&gt;, people use this IPv4 network for the serial: &lt;code&gt;10.0.0.0/30&lt;/code&gt;. So, why do they do that? Wouldn't be better to just use the same IPv4 range &lt;code&gt;192.168.X.0/30&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="27664" LastEditorUserId="8499" LastEditDate="2016-07-14T06:43:58.390" LastActivityDate="2016-07-14T06:43:58.390" Title="What IPv4 network is better for serial?" Tags="|routing|ipv4|ip|subnet|internet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33083" PostTypeId="2" ParentId="33082" CreationDate="2016-07-14T06:41:04.670" Score="4" Body="&lt;p&gt;It doesn't matter. There is no better IP address range for any type of interface. It may be that examples use the &lt;code&gt;10.0.0.0/30&lt;/code&gt; network because it is easy to see that it is different and clear that it is a different use.&lt;/p&gt;&#xA;&lt;p&gt;The old-school way of doing point-to-point links was with &lt;code&gt;/30&lt;/code&gt; networks, but that wastes half of the addresses in a network. About 16 years ago, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3021&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3021, Using 31-Bit Prefixes on IPv4 Point-to-Point Links&lt;/a&gt; was released to specifically allow &lt;code&gt;/31&lt;/code&gt; networks for point-to-point links. Some hardware manufacturers never adopted the RFC, and none of the carriers of which I know did.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-07-14T06:41:04.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33084" PostTypeId="2" ParentId="30010" CreationDate="2016-07-14T07:02:07.513" Score="0" Body="&lt;p&gt;Wavelength (colors) used for the transmission are longer than visible light and lie in infrared band. The standard wavelengths are 850nm, 1310nm and 1550nm depending on the type of fiber. While plastic optical fiber (POF) and multimode fiber transmission use shorter wavelengths between 650nm-850nm and 850nm-1310nm, respectively, single mode fiber transmission operates at 1260nm-1675nm. The wavelength range is lower confined by the fiber cut-off wavelength and upper restricted by bending and SiO2 absorption losses&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-07-14T07:02:07.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33089" PostTypeId="1" CreationDate="2016-07-14T16:34:35.273" Score="1" ViewCount="87" Body="&lt;p&gt;We have Cisco router with &lt;code&gt;XFP-10GLR-OC192SR&lt;/code&gt; fiber transceivers and other end we have &lt;code&gt;10GBASE-SR SFP+&lt;/code&gt; does that work to different capability. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short one side &lt;code&gt;LR&lt;/code&gt; and other side &lt;code&gt;SR&lt;/code&gt; fiber port does that work or i should match them?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suggestion: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside datacenter (short distance) should we go with &lt;code&gt;SR&lt;/code&gt; or &lt;code&gt;LR&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2016-07-14T16:40:33.757" LastActivityDate="2016-09-13T10:30:16.313" Title="Two different FS transceivers on point to point link" Tags="|cisco|switch|fiber|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33093" PostTypeId="1" AcceptedAnswerId="33094" CreationDate="2016-07-14T19:18:43.800" Score="1" ViewCount="3604" Body="&lt;p&gt;Would a ping (echo request) to a reachable IP address with a size of 65500 bytes, end-to-end path MTU of 1500 Bytes, and the DF flag not set, work by having the peer responding an ICMP?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;21:05:31.325718 IP (tos 0x0, ttl 128, id 18761, offset 0, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: ICMP echo request, id 1, seq 28, length 1480&#xA;21:05:31.325726 IP (tos 0x0, ttl 128, id 18761, offset 1480, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325729 IP (tos 0x0, ttl 128, id 18761, offset 2960, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325732 IP (tos 0x0, ttl 128, id 18761, offset 4440, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325734 IP (tos 0x0, ttl 128, id 18761, offset 5920, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325736 IP (tos 0x0, ttl 128, id 18761, offset 7400, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325739 IP (tos 0x0, ttl 128, id 18761, offset 8880, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325742 IP (tos 0x0, ttl 128, id 18761, offset 10360, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325743 IP (tos 0x0, ttl 128, id 18761, offset 11840, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325746 IP (tos 0x0, ttl 128, id 18761, offset 13320, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325747 IP (tos 0x0, ttl 128, id 18761, offset 14800, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325750 IP (tos 0x0, ttl 128, id 18761, offset 16280, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325752 IP (tos 0x0, ttl 128, id 18761, offset 17760, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325754 IP (tos 0x0, ttl 128, id 18761, offset 19240, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325756 IP (tos 0x0, ttl 128, id 18761, offset 20720, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325758 IP (tos 0x0, ttl 128, id 18761, offset 22200, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325760 IP (tos 0x0, ttl 128, id 18761, offset 23680, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325762 IP (tos 0x0, ttl 128, id 18761, offset 25160, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325764 IP (tos 0x0, ttl 128, id 18761, offset 26640, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325767 IP (tos 0x0, ttl 128, id 18761, offset 28120, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325769 IP (tos 0x0, ttl 128, id 18761, offset 29600, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325771 IP (tos 0x0, ttl 128, id 18761, offset 31080, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325774 IP (tos 0x0, ttl 128, id 18761, offset 32560, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325776 IP (tos 0x0, ttl 128, id 18761, offset 34040, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325778 IP (tos 0x0, ttl 128, id 18761, offset 35520, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325781 IP (tos 0x0, ttl 128, id 18761, offset 37000, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325786 IP (tos 0x0, ttl 128, id 18761, offset 38480, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325788 IP (tos 0x0, ttl 128, id 18761, offset 39960, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325789 IP (tos 0x0, ttl 128, id 18761, offset 41440, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325791 IP (tos 0x0, ttl 128, id 18761, offset 42920, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325793 IP (tos 0x0, ttl 128, id 18761, offset 44400, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325794 IP (tos 0x0, ttl 128, id 18761, offset 45880, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325796 IP (tos 0x0, ttl 128, id 18761, offset 47360, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325798 IP (tos 0x0, ttl 128, id 18761, offset 48840, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325800 IP (tos 0x0, ttl 128, id 18761, offset 50320, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325801 IP (tos 0x0, ttl 128, id 18761, offset 51800, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325803 IP (tos 0x0, ttl 128, id 18761, offset 53280, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325805 IP (tos 0x0, ttl 128, id 18761, offset 54760, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325807 IP (tos 0x0, ttl 128, id 18761, offset 56240, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325808 IP (tos 0x0, ttl 128, id 18761, offset 57720, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325810 IP (tos 0x0, ttl 128, id 18761, offset 59200, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325812 IP (tos 0x0, ttl 128, id 18761, offset 60680, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325814 IP (tos 0x0, ttl 128, id 18761, offset 62160, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325816 IP (tos 0x0, ttl 128, id 18761, offset 63640, flags [+], proto ICMP (1), length 1500)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;21:05:31.325818 IP (tos 0x0, ttl 128, id 18761, offset 65120, flags [none], proto ICMP (1), length 408)&#xA;    1.1.1.2 &amp;gt; 1.1.1.1: icmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22285" LastEditorUserId="8499" LastEditDate="2018-10-19T08:11:52.920" LastActivityDate="2018-10-19T08:11:52.920" Title="ICMP Fragmentation" Tags="|ping|icmp|fragmentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33094" PostTypeId="2" ParentId="33093" CreationDate="2016-07-14T19:43:06.570" Score="2" Body="&lt;p&gt;A ping with a packet size much larger than the MTU will succeed, but only if fragmentation is allowed, and all the fragments reach the target and can be reassembled into the original ICMP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any packet (ICMP or otherwise) larger than the smallest MTU in the path with the DF bit set will fail to get to the other end.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-14T19:43:06.570" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33097" PostTypeId="1" CreationDate="2016-07-14T21:19:39.267" Score="1" ViewCount="177" Body="&lt;p&gt;What kind of device could solve the following dilemma and how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given: 2 networks A and B with the &lt;strong&gt;same IP range&lt;/strong&gt;: 192.168.252.0 mask 255.255.252.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find: how to translate addresses from one of the networks(A or B) and combine them with the second network to get merged network 192.168.248.0 mask 255.255.248.0 on one patch-cord?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/7tNPE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7tNPE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27860" LastEditorUserId="27860" LastEditDate="2016-07-15T07:15:48.840" LastActivityDate="2016-07-15T09:34:07.660" Title="IP combiner device" Tags="|ipv4|subnet|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33098" PostTypeId="2" ParentId="32796" CreationDate="2016-07-14T21:45:34.927" Score="0" Body="&lt;p&gt;What you want to do is pretty straight forward and there are plenty of good options out there to update the config on multiple devices.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However in your situation this is complicated by having to use a multi factor one time password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a method that allows you to download and upload the config of each device without logging in to each via SSH, perhaps SNMP and tftp/scp then you could download all the config, run a script over  the files to update, then load them back in again.  You would be having to do your own scripting to make that go through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Longer term I would consider setting up an NMS Linux host with MFA login and pre shared keys for SSH to run these kind of scripted config changes.&lt;/p&gt;&#xA;" OwnerUserId="7788" LastActivityDate="2016-07-14T21:45:34.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33099" PostTypeId="2" ParentId="32640" CreationDate="2016-07-14T21:57:26.387" Score="2" Body="&lt;p&gt;Based on what you are trying to do, I would suggest not trying to add multiple IP interfaces on your L2 switch, but rather configure your router so you can route from the server VLAN to VLAN 1 and access the switch on its 192.168.1.1 address.&lt;/p&gt;&#xA;" OwnerUserId="7788" LastActivityDate="2016-07-14T21:57:26.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33100" PostTypeId="1" CreationDate="2016-07-14T23:12:33.640" Score="1" ViewCount="204" Body="&lt;p&gt;While doing a review for one of the customer sites I've noticed a config, where the setup of the switches was:&#xA;Switch 1 - Access VLAN 10 portfast &amp;lt;-&gt; Switch 2 Trunk - Native VLAN 10; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any specific reason for such config, or it's configured in incorrect way? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards! &lt;/p&gt;&#xA;" OwnerUserId="22574" LastActivityDate="2016-08-14T08:58:53.857" Title="Reason for an Access &lt;-&gt; Trunk Uplink between switches" Tags="|switching|layer2|" AnswerCount="1" CommentCount="4" ClosedDate="2017-08-14T21:10:43.523" ContentLicense="CC BY-SA 3.0" />
  <row Id="33101" PostTypeId="2" ParentId="33097" CreationDate="2016-07-14T23:19:07.507" Score="2" Body="&lt;p&gt;This is a common issue when companies merge. The correct answer is to renumber one (or both) networks. However, in the short term, src and/or dst NAT can make each network appear to be a different range. There will have to be intermediary gear as one router cannot have two interfaces with overlapping subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Update: one could use VRF to simulate multiple devices, but that's an &lt;em&gt;Advanced Level&lt;/em&gt; technique.]&lt;/p&gt;&#xA;" OwnerUserId="619" LastEditorUserId="619" LastEditDate="2016-07-15T00:13:46.930" LastActivityDate="2016-07-15T00:13:46.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33107" PostTypeId="2" ParentId="33089" CreationDate="2016-07-15T06:55:27.737" Score="2" Body="&lt;p&gt;SR-based transceiver are designed to work over MMF, and LR-based transceivers are designed to work over SMF. SFP+ MMF is incompatible with SFP+ SMF. And if you want them to work, you should use mode conditioning patch cords on each side. But these cables are often more expensive since they are especially manufactured. So, sometimes it's very important to buy right &lt;a href=&quot;http://www.fs.com/c/fiber-optic-transceivers-9&quot; rel=&quot;nofollow&quot;&gt;transceiver modules&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-07-15T06:55:27.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33108" PostTypeId="2" ParentId="33100" CreationDate="2016-07-15T08:02:10.260" Score="3" Body="&lt;p&gt;Generally that is a bad configuration.  Perhaps someone just tried different things until something worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other option was that they wanted to use the switch with the VLAN 10 access port as some kind of L2 fabric interconnect, but probably not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do this if you are connecting between 2 separate VTP or administrative domains and it makes sense to do that, ie separate VLAN table on each switch.&lt;/p&gt;&#xA;" OwnerUserId="7788" LastActivityDate="2016-07-15T08:02:10.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33109" PostTypeId="2" ParentId="33089" CreationDate="2016-07-15T08:06:41.450" Score="0" Body="&lt;p&gt;What you have isn't right, it may actually link up, but I wouldn't recommend it.  For short distance (less than 300m) inside data center over Multimode optical fiber (MMOF) 10GBASE-SR is what you want.&lt;/p&gt;&#xA;" OwnerUserId="7788" LastActivityDate="2016-07-15T08:06:41.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33110" PostTypeId="2" ParentId="33072" CreationDate="2016-07-15T08:13:16.843" Score="1" Body="&lt;p&gt;Since you do have SNMP you could use any number of SNMP capable NMS.  These however will give you per port statistics.  If you want total traffic you could look at Netflow, again several tools are available for this, both paid and free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to configure a SPAN or monitor port, and push all traffic to a server connected to that which can then analyse the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have steered clear of specific product recommendations on purpose, you can get a lot of good results on those products by searching for some of the above terms.&lt;/p&gt;&#xA;" OwnerUserId="7788" LastActivityDate="2016-07-15T08:13:16.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33111" PostTypeId="2" ParentId="33006" CreationDate="2016-07-15T08:27:21.647" Score="2" Body="&lt;p&gt;To answer the first part of your question:&#xA;The MAC address doesn't change on frames within a LAN, only after passing through an L3 gateway/router where they could be changing Ethernet LAN/ broadcast domain or even changing to some medium other than Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And part two:&#xA;The switches are transparent, but switch one will learn all the MAC addresses for devices connected to switch two are on the port facing that switch and will forward the frames out that port.&lt;/p&gt;&#xA;" OwnerUserId="7788" LastActivityDate="2016-07-15T08:27:21.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33112" PostTypeId="1" AcceptedAnswerId="33121" CreationDate="2016-07-15T08:32:24.517" Score="10" ViewCount="8589" Body="&lt;p&gt;Is the router always broadcasting &quot;I'm here&quot; (say, every period of time) and the computer listens or the router listens and once the computer broadcasts &quot;is there a router here?&quot; It responds?&#xA;It sounds like a silly question but I can't find an answer. Although I do know that when the computer already knows of the existence of the router it makes the first request for an IP address.&lt;/p&gt;&#xA;" OwnerUserId="27875" LastActivityDate="2017-06-23T17:03:25.010" Title="How does the computer detect the router?" Tags="|router|" AnswerCount="7" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33113" PostTypeId="2" ParentId="33112" CreationDate="2016-07-15T09:08:49.600" Score="0" Body="&lt;p&gt;When your PC is turned on, it uses the DHCP protocol to request an IP-address and network settings. Every time a packet is then sent from the computer it will send it to the default gateway of the router. The router is not consistently pinging out 'hello im here' more like the host will direct traffic when it needs to. - Hope this clarifies it. &lt;/p&gt;&#xA;" OwnerUserId="23768" LastActivityDate="2016-07-15T09:08:49.600" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33115" PostTypeId="2" ParentId="33097" CreationDate="2016-07-15T09:34:07.660" Score="0" Body="&lt;p&gt;Just a suggestion, as I don't understand at this level too much but could you not create virtual interfaces on those routers, assign them alternate IP addresses that are not the same and then do some funky IP-routing/NAT-ing to get them to communicate?&lt;/p&gt;&#xA;" OwnerUserId="23768" LastActivityDate="2016-07-15T09:34:07.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33116" PostTypeId="2" ParentId="33112" CreationDate="2016-07-15T09:48:17.137" Score="0" Body="&lt;p&gt;In the &quot;conversation words&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You turn on your Computer and the Computer detects that there is a cable connected to your NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer thinks &quot;NICE! I'm connected to a network - is their a DHCP server online, so I know where I am??&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer sends out DHCP request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router/DHCP Server gets this request and says to the Computer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Hey! You are  and this is your Netmask, your default gateway and other Informations - Welcome to the network!&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MUkcz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MUkcz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This only works if your NIC is configured for DHCP.&lt;/p&gt;&#xA;" OwnerUserId="22401" LastActivityDate="2016-07-15T09:48:17.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33118" PostTypeId="2" ParentId="32960" CreationDate="2016-07-15T10:16:04.110" Score="0" Body="&lt;p&gt;The issue with your current set up is that I don't see how you're going to get at the management or private networks. If the private network is simply a subnet to allow the servers to communicate directly (like a webserver running php querying a database server) then you don't need to route to it, but I imagine that isn't true for your management network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you cannot change your set up you will need to use the public IP range/gateway that is being provided and use it on both your public and IPMI NICs. You could then ask if the provider would only allow access to IPMI from your offices IPs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use the OpenVPN method then you'll need to have NIC on the openVPN IP range to communicate to the other servers IPMI NICs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch can handle 3 vlans. Just create the vlans on the switch and assign access ports on your switch to the vlan that corresponds to the NIC you're plugged in to. For example, if vlan 2 is for management then set one of the ports on the switch to access vlan 2 and plug your servers IPMI port into it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something that has worked for us is connecting a firewall to the provider and then using that to run a site to site tunnel back to us. We can route to over the tunnel to the management ports on the server and can NAT or subnet your public range and assign them to the public NICs on your servers.&lt;/p&gt;&#xA;" OwnerUserId="23560" LastEditorUserId="23560" LastEditDate="2016-07-15T10:25:59.660" LastActivityDate="2016-07-15T10:25:59.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33120" PostTypeId="2" ParentId="32939" CreationDate="2016-07-15T11:08:01.440" Score="1" Body="&lt;p&gt;You can define an ACL and apply the ACL under the group policy using the split tunnel value command. You can then apply the group policy to the tunnel group. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's explained in the documentation here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/119006-configure-anyconnect-00.html#anc13&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/119006-configure-anyconnect-00.html#anc13&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below will tunnel traffic only for the 10.10.0.0/16 network. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list Split standard permit 10.10.0.0 255.255.0.0&#xA;&#xA;group-policy ANYCONNECT-POLICY attributes&#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value Split&#xA;&#xA;tunnel-group ANYCONNECT general-attributes&#xA; default-group-policy ANYCONNECT-POLICY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you open your anyconnect client when connected and click the cog (advanced properties) and click on the route details tab you will see 10.10.0.0/16 as a secured route and 0.0.0.0/0 as an unsecured route.&lt;/p&gt;&#xA;" OwnerUserId="23560" LastEditorUserId="23560" LastEditDate="2016-07-15T11:21:40.943" LastActivityDate="2016-07-15T11:21:40.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33121" PostTypeId="2" ParentId="33112" CreationDate="2016-07-15T12:37:19.110" Score="8" Body="&lt;p&gt;Looking at your question it looks like you're confusing DHCP and routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be clear, they both accomplish different tasks and really have nothing to do with each other. DHCP is a way to dynamically assign IPs to clients. Routing allows you to get from one network to another. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your question.. There are really two ways in which your computer will know there is a router on the network. Either because you have manually assigned an IP address/subnet mask with a default gateway (default gateway being the router), or because the computer has been set to request an IP via DHCP and within the DHCP offer it received from the server it contained a default gateway for the client to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client will not attempt any communication with a router until it has an IP address and default gateway configured (again manually or via dhcp). The computer will then look at its own IP address and subnet mask to determine if the IP address it is trying to communicate with is on its local network. If it is then it will attempt to send the data straight to the device and if it is not then it will look at its configured default gateway (router) and send it there. The router will then send the traffic to the destination because it has a route, or to another router that might know where the destination network exists.&lt;/p&gt;&#xA;" OwnerUserId="23560" LastEditorUserId="23560" LastEditDate="2016-07-16T10:18:57.030" LastActivityDate="2016-07-16T10:18:57.030" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33124" PostTypeId="2" ParentId="33112" CreationDate="2016-07-15T13:55:14.097" Score="2" Body="&lt;p&gt;With IPv4, a computer doesn't really know about a router. A host will have a configured gateway, to which it will send any traffic destined for a different network. The gateway is probably a router, but not necessarily. The gateway is either manually configured, or assigned via DHCP. The host doesn't have a configured gateway until one is either manually or dynamically assigned. That means that it cannot communicate to a different network until one is assigned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, IPv6 has added ND (Neighbor Discovery), and part of ND includes RAs (Router Advertisements). Routers can be configured to advertise their existence, and the local network prefix. This allows IPv6 hosts to configure themselves without DHCP, although there is a version of DHCP for IPv6.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-15T13:55:14.097" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33125" PostTypeId="1" AcceptedAnswerId="33128" CreationDate="2016-07-15T14:49:15.100" Score="1" ViewCount="8188" Body="&lt;p&gt;I'm trying to understand how to properly configure a PBX (Private Branch Exchange). I've stumbled into a few brick walls, and I feel like the answers to these should be obvious, but the Internet has not helped at all. After consulting stackexchange.com/sites, this seemed like the best place to post regarding telephony networking,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, does a PBX require its own power supply? Standalone telephones work in a power outage since they are directly connected to the central office, but in a PBX setup, the telephones are connected to the PBX, which is linked via outside lines to the central office. So, would the PBX/telephones work in an outage, or does it need backup power? If your PBX is Centrex (hosted at the exchange), will the telephone company supply power to your PBX in an outage?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does one actually configure extensions in a PBX? How would one set the system up so if you dial '1010' it rings a specific line somewhere in the building? Since there is no software or computer-interfaces in a PBX, and it is analog, rather than digital, how does the system know which line is which?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, does each outside line need to be paid for individually, or are there trunk leases? If everyone dialed out at once, would some users get &quot;no circuits are available&quot; if you have 50 internal lines but only 25 outside lines? Would you need as many outside lines as inside lines? And I know many organizations have assigned prefixes (they own all the numbers in 555-345-XXXX) where they own all the X numbers. Do you just ask the telephone company to lease an entire prefix, or part of a prefix?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if the PBX loses power, can I just unplug an outside line from the PBX and plug a telephone into it? Is there any reason that wouldn't work? (like if the line is part of a trunk line instead of an individual cable)&lt;/p&gt;&#xA;" OwnerUserId="27721" LastEditorUserId="27721" LastEditDate="2016-07-18T12:56:44.223" LastActivityDate="2017-07-06T19:09:15.667" Title="How are PBX extensions configured and how are outside lines obtained?" Tags="|telephony|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33126" PostTypeId="1" CreationDate="2016-07-15T14:53:52.310" Score="2" ViewCount="2999" Body="&lt;p&gt;Its very weird question but i want some suggestion for you. We have edge router &lt;code&gt;ASR1000&lt;/code&gt; where BGP running and &lt;code&gt;10G&lt;/code&gt; internet connection is terminated. Now i want to configure ACL on router to keep bad traffic outside and only allow specific port. Following scenario. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Internal Public IP]------------[ASR1000]-------------[INTERNET]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now how do i allow my Internal Public IP subnet to access everything on internet. In stateful firewall you can do it because it hold state of connection but Router ACL isn't stateful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do i solve this problem? &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Inside to outside everything allow&lt;/li&gt;&#xA;&lt;li&gt;Outside to inside only specific traffic  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-07-15T15:14:54.713" Title="Router stateful ACL" Tags="|cisco|firewall|acl|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33127" PostTypeId="2" ParentId="33126" CreationDate="2016-07-15T15:08:02.630" Score="3" Body="&lt;p&gt;On IOS/IOS-XE you can use either reflexive ACL's or use stateful inspection with Cisco Context Based Access Control (CBAC) or Zone Based Firewall (ZBF). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ZBF is the current way to do stateful inspection. It works by creating zones and applying the zones to interfaces. Then you create a class-map to identify traffic and use a policy map to inspect the traffic that you identified in the class map. You then create a 'Zone Pair' in which you define a traffic flow (inside to outside) and apply the policy map to that pair. IOS will then perform stateful inspection on that traffic like any other firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Documentation for ZBF on IOS XE is here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_zbf/configuration/xe-3s/sec-data-zbf-xe-book/sec-zone-pol-fw.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_zbf/configuration/xe-3s/sec-data-zbf-xe-book/sec-zone-pol-fw.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23560" LastEditorUserId="23560" LastEditDate="2016-07-15T15:14:54.713" LastActivityDate="2016-07-15T15:14:54.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33128" PostTypeId="2" ParentId="33125" CreationDate="2016-07-15T15:12:12.170" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;First of all, does a PBX require its own power supply?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A PBX does require it's own power, and you must have batteries or a UPS in the event of a power outage.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If your PBX is Centrex (hosted at the exchange), will the telephone&#xA;  company supply power to your PBX in an outage?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most telcos will insist on and install a UPS for any of their equipment which they install on your premises.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How does one actually configure extensions in a PBX?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How a PBX is configured depends on the particular make/model. It can be pretty complex on some systems, and most PBX vendors offer training (for a price).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Since there is no software or computer-interfaces in a PBX and it is&#xA;  analog, rather than digital, how does the system know which line is&#xA;  which?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Many PBXes use software and have computers and network interfaces built in. Also, there are both analog and digital PBXes, as well as VoIP PBXes. Analog and proprietary digital PBXes are circuit switched, so the PBX know which phone is which by the circuit to which it is connected, they same way the telco knows which line is yours.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, does each outside line need to be paid for individually or are&#xA;  there trunk leases?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How circuits are delivered depends on the PBX make/model, and what your local telco offers.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If everyone dialed out at once, would some users get &quot;no circuits are&#xA;  available&quot; if you have 50 internal lines but only 25 outside lines?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you have more users trying to make outside calls than there are outside lines, then you will get some sort of message or tone indicating a problem when trying to dial an outside line.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would you need as many outside lines as inside lines?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are various calculations (Erlang), depending on the business model, to determine the number of outside lines you should have based on the number of users. This is almost never close to one-to-one, but there are exceptions, depending on the type of business.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Do you just ask the telephone company to lease an entire prefix, or&#xA;  part of a prefix?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most telcos will assign/sell you one or more DID (Direct Inward Dial) range of numbers, and these can be much larger than the actual number of outside lines that you have. This can be an entire exchange (expensive), or a small range (e.g. 10 numbers).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Seriously, and I mean this with respect, if you need to ask these questions, you should not be doing this; you should hire a professional to do this for you. This is very easy to get wrong, and your business is on the line (no pun intended).&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-15T15:41:55.057" LastActivityDate="2016-07-15T15:41:55.057" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="33133" PostTypeId="2" ParentId="7619" CreationDate="2016-07-15T18:05:47.430" Score="0" Body="&lt;p&gt;To somewhat &quot;emulate&quot; a VoIP stream, set the -S to 0xC0 the udp payload (-l) to 200 bytes, the offered load (-b) to 200K, and with iperf 2+ set the protocol to UDP via -u on both the client and the server.&lt;/p&gt;&#xA;" OwnerUserId="27884" LastActivityDate="2016-07-15T18:05:47.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33135" PostTypeId="2" ParentId="25857" CreationDate="2016-07-15T18:13:01.553" Score="0" Body="&lt;p&gt;What does the output of the iperf client look like?  Set it to -i 1 and see.  Also, which version are you using? iperf -v will give that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP is a connectionless protocol.   The iperf socket is in blocking mode - though in 2.0.8+ there are timeouts on the write().  When the wire is 100% congested, packets can be dropped between the application and the kernel (per the write timeout), between the kernel and the network interface driver, in the driver itself.  While it may be doable to isolate the exact drop location, doing so takes a bit of inspection.&lt;/p&gt;&#xA;" OwnerUserId="27884" LastActivityDate="2016-07-15T18:13:01.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33138" PostTypeId="2" ParentId="3245" CreationDate="2016-07-15T18:24:39.177" Score="0" Body="&lt;p&gt;It's probably due to multiple processes vs one process.  with iperf 2.0.9 one can test this via -P 2 on the client.  This will fork two threads instead of one. Most modern CPUs have multiple cores so using multiple thread will be able to leverage them. &lt;/p&gt;&#xA;" OwnerUserId="27884" LastActivityDate="2016-07-15T18:24:39.177" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33139" PostTypeId="1" CreationDate="2016-07-15T18:27:16.443" Score="1" ViewCount="2133" Body="&lt;p&gt;I have a scenario where we need to establish multiple IPSEC tunnels between 2 devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the above scenario, ASR has multiple VRFs and we want to create IPSEC tunnel for each VRF and the other end is the same VIP. &#xA;Because of this we are considering to use Certificates instead of PSK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One certificate(Will be using different CN) will be used for each tunnel which will help in identifying which tunnel is from which VRF(Customer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking of VRF aware IPSEC should work in this scenario. But my concern is If ASR public interface does the NATing and what will happen to the Source PORTs(500/4500). &#xA;I understand when there are multiple flows with same source port, NAT will change the Source PORT number and maintain in its table.&#xA;Please help me in confirming/with configs&lt;a href=&quot;https://i.stack.imgur.com/ZpaNy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZpaNy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; If this scenario works or there are any better way to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: F5 load balancer can only look into Layer 3 &amp;amp; 4 headers. I have multiple IPSEC terminators and I need load balalncing. So assuming Source PORT will be different for each tunnel initiated from ASR.&lt;/p&gt;&#xA;" OwnerUserId="27885" LastEditorUserId="27885" LastEditDate="2016-07-15T18:43:11.910" LastActivityDate="2018-02-07T05:10:35.190" Title="Multiple IPSEC tunnels between 2 Cisco Routers" Tags="|nat|ipsec|vrf|cisco-asr|ike|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33140" PostTypeId="2" ParentId="30459" CreationDate="2016-07-15T18:30:14.380" Score="0" Body="&lt;p&gt;Look at the RTT and CWND to get information about actual runtime window size.  Also, use -i 0.1 to get sampled values as these are dynamic. If these values are larger when you're not setting -w, you know the answer, i.e. your -w is too small.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With iperf 2.0.9, -e on the client will give the RTT and CWND (Linux only).  Other ways to get these is using tcpdump and tcptrace.&lt;/p&gt;&#xA;" OwnerUserId="27884" LastActivityDate="2016-07-15T18:30:14.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33141" PostTypeId="1" AcceptedAnswerId="43253" CreationDate="2016-07-15T21:24:54.513" Score="5" ViewCount="6793" Body="&lt;p&gt;This is the first time I am encountering this, and it has me a bit confused as to how to set this up. I think I might need a new router to accomplish this.&#xA;I have a Cisco RV325&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The local ISP has me setup with a Fiber line just installed. I am only familiar with configuring a small business router with a static IP block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configurations I have from my ISP for my static IP's is similar to the below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Customer Layer 3 IP Information&#xA;(WAN BLOCK)&#xA;Link IP Address: 10.10.10.140/30&#xA;Gateway: 10.10.10.141&#xA;Layer 3 IP: 10.10.10.142&#xA;Layer 3 Subnet Mask: 255.255.255.252&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Customer Usable IP Information&#xA;(LAN BLOCK)&#xA;Usable IP Block: 10.10.10.192/29&#xA;Usable IP Ranges: 10.10.10.193-198&#xA;Usable Subnet Mask: 255.255.255.248&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this were a typical ISP transparent bridge setup, I would have no problem setting up this internet connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am confused as to how I would configure a link from router WAN port to switch and then set up my public IP block. I am starting to think it is not possible with the RV325.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would need natting on one of the static IPs. Any suggestion on where to head in the right direction? Do I need to order a better router with more enterprise features?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any push in the right direction would be incredibly helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I can think of is setting up my WAN as a static IP, and then a VLAN with my subnets but then I can't figure out how to have my static IP block routed to my local network. I am just confused, and I haven't looked at routing information like this in ages.&lt;/p&gt;&#xA;" OwnerUserId="27887" LastEditorUserId="27887" LastEditDate="2016-07-15T22:52:59.980" LastActivityDate="2017-08-15T00:38:56.917" Title="/30 transport /29 WAN ISP setup" Tags="|cisco|routing|vlan|nat|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33142" PostTypeId="2" ParentId="32277" CreationDate="2016-07-15T22:37:18.440" Score="0" Body="&lt;p&gt;Another option is to use two TCP streams and run two iperf clients, each on the same subnet, and one iperf server.  The server should provide the SUM information.  Use -B on the client to select a bind IP address which will select the source interface for each stream.   The bind() will in turn look up the source IP (and hence source mac address) though you'll probably want a policy route for this.&lt;/p&gt;&#xA;" OwnerUserId="27884" LastActivityDate="2016-07-15T22:37:18.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33143" PostTypeId="2" ParentId="10891" CreationDate="2016-07-15T22:48:00.693" Score="0" Body="&lt;p&gt;UDP has the downside of over subscription required for a peak avg throughput and there is a cost to dropping packets.  Also, constant oversubscription doesn't allow intermediate buffers to drain - adding to end/end latency.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So one should really test both TCP and UDP and when using UDP have the iperf client offer a load of 99% of end/end link capacity.&lt;/p&gt;&#xA;" OwnerUserId="27884" LastActivityDate="2016-07-15T22:48:00.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33144" PostTypeId="1" AcceptedAnswerId="33786" CreationDate="2016-07-15T23:26:24.390" Score="3" ViewCount="803" Body="&lt;p&gt;Recently I came across an L3 switch configuration that I thought was a bit strange.&#xA;So this question is to understand 1) whether these type of configurations are common practice, and 2) whether you see any issues with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will attempt to describe the scenario from a first person narrative, though I claim no credit/blame for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two separate subnets A and B with identical IPv4 network id (say 130.10.0.0/16). Each network has one L3 switch and uses the same VLAN ID (say 3) for these subnets. For simplicity consider A and B are almost clones of each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two networks must remain separate broadcast domains. There are many IP addresses that are used in both networks. I cannot change IP address of any of the existing nodes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have to route IP traffic from a newly added node with IP address 130.10.10.221 in network A to a newly added node in network B with IP address 130.10.10.222.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My L3 switches do not support NAT and replacing these switches is not an option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only good news so far is that for the new nodes I can chose IP addresses such that they are unique across both A and B. That is 130.10.10.221 exists only in A and 130.10.10.222 exists only in B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I add a new VLAN 10 on both switches and assign one port on each switch to this VLAN.&#xA;Assign 10.1.20.1/24 to vlan 10 routing interface (SVI) of switch A and 10.1.20.2/24 to vlan 10 SVI of switch B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;add ip route 130.10.10.222 255.255.255.255 10.1.20.2 on switch A&lt;br&gt;&#xA;add ip route 130.10.10.221 255.255.255.255 10.1.20.1 on switch B&lt;br&gt;&#xA;enable proxy arp in VLAN 3 on both switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connect the VLAN 10 port on switch A to the VLAN 10 port on switch B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When 130.10.10.221 ARPs for 130.10.10.222 the router responds because it has a route configured for this destination and proxy ARP is enabled. When the packet destined for 130.10.10.222 reaches switch A, as per IP forwarding rules the static route with the 32 bit subnet mask is the most preferred route (trumping the local vlan 3 with 16 bit subnet mask), and therefore the packet gets forwarded onto switch B via VLAN 10. In switch B 130.10.0.0/16 is a &quot;connected&quot; (or direct) route and therefore the packet gets forwarded into B's VLAN 3. The reverse happens for traffic coming from B to A. Both VLAN 3 s remain separate and 130.10.10.221 in VLAN 3 on switch A can make a TCP connection to 130.10.10.222 in VLAN 3 on switch B.   What can possibly go wrong ?&lt;/p&gt;&#xA;" OwnerUserId="27889" LastActivityDate="2016-08-05T16:19:32.487" Title="Routing between identical subnets without using NAT" Tags="|routing|vlan|ipv4|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33145" PostTypeId="2" ParentId="6404" CreationDate="2016-07-16T02:07:25.133" Score="-1" Body="&lt;p&gt;A community name is a plain-text password mechanism that is used to weakly authenticate SNMP queries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/cli/cliguide7/cli_snmp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/ips/7-0/configuration/guide/cli/cliguide7/cli_snmp.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-16T02:07:25.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33146" PostTypeId="2" ParentId="33139" CreationDate="2016-07-16T02:18:46.137" Score="0" Body="&lt;p&gt;VRF's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 types of VPN's are LAN-to-LAN and Remote Access.  Sounds like to want you configure some LAN-to-LAN VPN's.  The VPN head end is sometimes called a VPN concentrator or VPN head end.  You can establish as many VPN tunnels as you want (as are supported by the device) and even have various parameters across them.  This is not unusual.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in your case you only have 2 physical devices, so you need to create multiple logical devices to do what you want.  Another meaning of VRF is VPN Routing and Forwarding which is a key element in Cisco’s MPLS (Multiprotocol Label Switching) VPN technology.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-07-16T17:11:30.403" LastActivityDate="2016-07-16T17:11:30.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33147" PostTypeId="2" ParentId="33125" CreationDate="2016-07-16T02:24:25.790" Score="2" Body="&lt;p&gt;A PBX is typically implemented in organizations that have many users who each require a telephone.  They typically dial one another via 4 digit dialing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a PBX phone user wants to call and order a pizza, they typically dial 9, for example, to obtain an outside line, then dial the public (PSTN) phone number of the pizza place.  A single phone line is required for every concurrent call from the PBX system to the PSTN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, organizations can get analog lines for PSTN access or they can get digital lines if they have enough users/need.  Nowadays SIP is another PSTN offering.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Analog Lines:  Incomings Calls Must All Ring The Same Number, whether assigned to a single phone or multiple phones.  Calling Number can display on PBX handsets after the 1st ring.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;PRI: Incoming calls can ring a particular number.  This is called DID.  Calling name and number can display on the PBX.  This is the bonafide classic PSTN trunk type.  You must get one delivered to your building and you get local numbers with it.  23 calls concurrent max.  Faxing works fine.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;CAS T1: Another type of trunk but with less features than a PRI.  24 concurrent calls max.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;SIP: An IP (vs 'digital') trunk whereby you can get numbers from area codes all over the country ringing in.  Faxing across these can be problematic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-07-16T02:36:33.697" LastActivityDate="2016-07-16T02:36:33.697" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="33148" PostTypeId="2" ParentId="33112" CreationDate="2016-07-16T02:41:47.743" Score="0" Body="&lt;p&gt;The router does not broadcast that it is there as a default gateway.  A DHCP server does respond to a shout out (broadcast) from the endpoint though.  Part of the DHCP response is the IP address of the default gateway (the router).  Most routers have built in DHCP servers which are disabled by default.  Many server/I.T. admins rather use Windows Server DHCP.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-07-16T02:48:38.587" LastActivityDate="2016-07-16T02:48:38.587" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33149" PostTypeId="2" ParentId="33141" CreationDate="2016-07-16T05:14:51.503" Score="3" Body="&lt;p&gt;This is indeed a typical config, and most likely doesn't require you to change your hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On one hand, you have the /30 which will be used on the point to point WAN link between you device and the first IP device on the ISP's side. So you should set your device up with the IP they gave you (.142) and a default route pointing to the ISP's device at .141&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, they are saying they have assigned a /29 block go you. What this means is basically that there is a static route on their side pointing to you WAN IP (.142) for that /29 range such that any traffic for that range is sent to your router. At that point it's up to you to decide how to use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can either route it to another device on your network (a firewall, say) with a static route, or use it on the router itself for handling NAT rules. The range does not need to be associated with any physical interface on the device: the router will be receiving the traffic anyway, due to the ISP's static route, it just needs to know what to do with a packet reaching it with a dest IP in that range: route it further, or process it.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-07-16T05:14:51.503" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33152" PostTypeId="1" AcceptedAnswerId="33159" CreationDate="2016-07-16T16:28:50.097" Score="1" ViewCount="134" Body="&lt;p&gt;I'm setting up a lab environment consisting of an IBM Bladecenter H (equipped with 4-NICs blade servers and 4 Cisco 3012) and 2 3750 as Aggregate switches.&#xA;The blade servers will host VMWare and several VMs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each blade server is connected to the 4 3012 module. Each 3012 module is dual-homed on the aggregate switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I just set all these links as trunks, but I'm having some troubles with STP (which I left as default). I haven't found yet (!) documents providing guidelines for simple network design in such case so I have some questions.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Link between blades and 3012&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So far I've set as trunks. This seems the simplest design. I've read others suggest to split between management ports (to ESX hosts) and traffic ports (trunk) but I think allocating a management VLAN within the trunk is fine. Any drawback?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Link between 3012 and aggregation switches&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These are also set to trunk. Should I focus on specific STP configuration?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Etherchannel&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Should I set any of above links as Etherchannel? If yes between blades and 3012, should I set NIC-bonding on the ESX host?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Aggregation switches&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Given that I have a single link to outside network, and this is connected to only one aggregation switch, this acts as single point of failure. I'm wondering if in this case deploying a couple of aggregation switches is unnecessary effort that actually doesn't provide pros, isn't it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any suggestion or advices.&lt;/p&gt;&#xA;" OwnerUserId="27712" LastActivityDate="2016-07-16T21:27:58.570" Title="Guidelines for network design of bladecenter" Tags="|cisco|spanning-tree|design|etherchannel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33153" PostTypeId="2" ParentId="33078" CreationDate="2016-07-16T17:09:48.373" Score="1" Body="&lt;p&gt;How to implement backup link to switch via Internet VPN.  That is your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like you could nail up a LAN-to-LAN VPN to get connectivity to the remote switch (via a VPN capable networking device).  Then you could bridge across it (IRB, or just bridging?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then the problem is: now you have a layer2 ring, aka loop.  So, you will have to implement Spanning Tree Protocol, STP, to block the less preferred link to the remote switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With STP tuning you could probably achieve failover/failback within 60 seconds or so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a bit of a mess though.  However, if you don't have a choice - do it.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-16T17:09:48.373" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33154" PostTypeId="1" AcceptedAnswerId="33305" CreationDate="2016-07-16T17:24:20.300" Score="3" ViewCount="16000" Body="&lt;p&gt;I have two offices (Victoria at IP 1.2.3.4 and Toronto at IP 5.6.7.8) each with pfSense running Strongswan, and each with an IKEv2 IPSec tunnel back to a Cisco ASA 5512 at IP 9.8.7.6. I recently updated software on the ASA from 9.4.2(11) to 9.4.3(4) without issue. Both tunnels came back up and worked fine for 1 day and 17 hours, but (without any configuration changes on either side) the Victoria tunnel has now stopped passing traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The tunnel is established without a problem, but &lt;code&gt;show ipsec sa&lt;/code&gt; tells me no traffic is passing. Restarting the tunnel does not make a difference.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA1# show ipsec sa peer 1.2.3.4&#xA;peer address: 1.2.3.4&#xA;    Crypto map tag: OUTSIDE_map, seq num: 1, local addr: 9.8.7.6&#xA;&#xA;      access-list OUTSIDE_cryptomap_2 extended permit ip 192.168.242.0 255.255.255.0 192.168.244.0 255.255.255.0 &#xA;      local ident (addr/mask/prot/port): (192.168.242.0/255.255.255.0/0/0)&#xA;      remote ident (addr/mask/prot/port): (192.168.244.0/255.255.255.0/0/0)&#xA;      current_peer: 1.2.3.4&#xA;&#xA;&#xA;      #pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0&#xA;      #pkts decaps: 1428, #pkts decrypt: 1428, #pkts verify: 1428&#xA;      #pkts compressed: 0, #pkts decompressed: 0&#xA;      #pkts not compressed: 0, #pkts comp failed: 0, #pkts decomp failed: 0&#xA;      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0&#xA;      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0&#xA;      #TFC rcvd: 0, #TFC sent: 0&#xA;      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0&#xA;      #send errors: 0, #recv errors: 0&#xA;&#xA;      local crypto endpt.: 9.8.7.6/500, remote crypto endpt.: 1.2.3.4/500&#xA;      path mtu 1500, ipsec overhead 55(36), media mtu 1500&#xA;      PMTU time remaining (sec): 0, DF policy: copy-df&#xA;      ICMP error validation: disabled, TFC packets: disabled&#xA;      current outbound spi: CB3A6309&#xA;      current inbound spi : 5E3D8A13&#xA;&#xA;    inbound esp sas:&#xA;      spi: 0x5E3D8A13 (1581091347)&#xA;         transform: esp-aes-gcm-256 esp-null-hmac no compression &#xA;         in use settings ={L2L, Tunnel, PFS Group 14, IKEv2, }&#xA;         slot: 0, conn_id: 167936, crypto-map: OUTSIDE_map&#xA;         sa timing: remaining key lifetime (sec): 2676&#xA;         IV size: 8 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap: &#xA;          0xFFFFFFFF 0xFFFFFFFF&#xA;    outbound esp sas:&#xA;      spi: 0xCB3A6309 (3409601289)&#xA;         transform: esp-aes-gcm-256 esp-null-hmac no compression &#xA;         in use settings ={L2L, Tunnel, PFS Group 14, IKEv2, }&#xA;         slot: 0, conn_id: 167936, crypto-map: OUTSIDE_map&#xA;         sa timing: remaining key lifetime (sec): 2676&#xA;         IV size: 8 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap: &#xA;          0x00000000 0x00000001&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A packet capture looking for dropped packets gives me this, but doesn't tell me what rule is being applied.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;939: 20:11:44.438591 0023.ab3f.8255 24e9.b315.cddf 0x0800 Length: 89&#xA;      192.168.244.114.51353 &amp;gt; 192.168.242.200.53:  [no cksum] udp 47 [tos 0x10]  (ttl 63, id 8826) Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is some of the relevant configuration; as far as I can see both offices are identical. If anyone has any suggestions as to what could be happening here, I'd appreciate it!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA1# show running-config crypto map&#xA;crypto map OUTSIDE_map 1 match address OUTSIDE_cryptomap_2&#xA;crypto map OUTSIDE_map 1 set pfs group14&#xA;crypto map OUTSIDE_map 1 set peer 1.2.3.4&#xA;crypto map OUTSIDE_map 1 set ikev2 ipsec-proposal AESGCM&#xA;crypto map OUTSIDE_map 1 set security-association lifetime seconds 3600&#xA;crypto map OUTSIDE_map 1 set nat-t-disable&#xA;crypto map OUTSIDE_map 2 match address OUTSIDE_cryptomap_3&#xA;crypto map OUTSIDE_map 2 set pfs group14&#xA;crypto map OUTSIDE_map 2 set peer 5.6.7.8&#xA;crypto map OUTSIDE_map 2 set ikev2 ipsec-proposal AESGCM&#xA;crypto map OUTSIDE_map 2 set security-association lifetime seconds 3600&#xA;crypto map OUTSIDE_map 2 set nat-t-disable&#xA;crypto map OUTSIDE_map interface OUTSIDE&#xA;&#xA;ASA1# show running-config access-list OUTSIDE_cryptomap_2&#xA;access-list OUTSIDE_cryptomap_2 extended permit ip object NOC-network object Victoria-network&#xA;&#xA;ASA1# show running-config access-list OUTSIDE_cryptomap_3&#xA;access-list OUTSIDE_cryptomap_3 extended permit ip object NOC-network object Toronto-network&#xA;&#xA;ASA1# show running-config nat&#xA;nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Victoria-network Victoria-network no-proxy-arp route-lookup&#xA;nat (INSIDE,OUTSIDE) source static NOC-network NOC-network destination static Toronto-network Toronto-network no-proxy-arp route-lookup&#xA;&#xA;ASA1# show running-config tunnel-group &#xA;tunnel-group 1.2.3.4 type ipsec-l2l&#xA;tunnel-group 1.2.3.4 general-attributes&#xA; default-group-policy GroupPolicy_Victoria&#xA;tunnel-group 1.2.3.4 ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;tunnel-group 5.6.7.8 type ipsec-l2l&#xA;tunnel-group 5.6.7.8 general-attributes&#xA; default-group-policy GroupPolicy_Toronto&#xA;tunnel-group 5.6.7.8 ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; isakmp keepalive threshold 15 retry 2&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;&#xA;ASA1# show running-config crypto ikev2&#xA;crypto ikev2 policy 2&#xA; encryption aes-gcm-256&#xA; integrity null&#xA; group 21 24&#xA; prf sha512&#xA; lifetime seconds 28800&#xA;crypto ikev2 policy 3&#xA; encryption aes-256&#xA; integrity sha512&#xA; group 21 24&#xA; prf sha512&#xA; lifetime seconds 28800&#xA;crypto ikev2 enable OUTSIDE&#xA;&#xA;ASA1# show running-config crypto ipsec&#xA;crypto ipsec ikev2 ipsec-proposal AES256-SHA512&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-512&#xA;crypto ipsec ikev2 ipsec-proposal AESGCM&#xA; protocol esp encryption aes-gcm-256&#xA; protocol esp integrity sha-512&#xA;crypto ipsec ikev2 sa-strength-enforcement&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;&#xA;#ASA1 show running-config all sysopt&#xA;no sysopt traffic detailed-statistics&#xA;no sysopt connection timewait&#xA;sysopt connection tcpmss 1380&#xA;sysopt connection tcpmss minimum 0&#xA;sysopt connection permit-vpn&#xA;sysopt connection reclassify-vpn&#xA;no sysopt connection preserve-vpn-flows&#xA;no sysopt radius ignore-secret&#xA;no sysopt noproxyarp OUTSIDE&#xA;no sysopt noproxyarp INSIDE&#xA;no sysopt noproxyarp DMZ1&#xA;no sysopt noproxyarp management&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10827" LastEditorUserId="10827" LastEditDate="2016-07-19T19:39:38.987" LastActivityDate="2018-02-24T01:51:48.713" Title="ASA tunnel up but not passing traffic" Tags="|cisco-asa|firewall|ipsec|tunnel|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="33156" PostTypeId="2" ParentId="32998" CreationDate="2016-07-16T19:14:09.623" Score="3" Body="&lt;p&gt;This is done via Dynamic Rate Shifting (also known as Adaptive Modulation and Coding and other names). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, this allows the WiFi device to adjust its Modulation and Coding Scheme (MCS) according to current RSSI and SNR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Modulation&lt;/strong&gt; refers to how many bits are transmitted per subcarrier. Trying to put it simple, subcarriers are then transmitted over the air as symbols (waveforms). The more complex the modulation scheme, the more bits are transmitted per subcarrier, but also the more sensitive to interference and noise, therefore requires better channel.&#xA;In 802.11g modulations are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;BPSK (1 bit per subcarrier)&lt;/li&gt;&#xA;&lt;li&gt;QPSK (2 bits per subcarrier)&lt;/li&gt;&#xA;&lt;li&gt;16-QAM (4 bits per subcarrier)&lt;/li&gt;&#xA;&lt;li&gt;64-QAM (6 bits per subcarrier)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Coding&lt;/strong&gt; refers to redundant bits added for protecting the information bits. This is expressed as fraction of useful information bits. In 802.11g they are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;1/2 (half of transmitted bits are useful, the other half are redundant)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;2/3&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;3/4&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The last one provides more useful bits within transmission (higher data rate) but &#xA;also less protection and therefore requires better channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To give an idea, in 802.11g using OFDM as transmission mode (the main one), the symbol duration is 4 microseconds, during which are transmitted 48 subcarriers carrying data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best channel condition allows for usage of 64-QAM (highest modulation) and 3/4 coding rate (less protection). This gives:&#xA;6 bits per subcarrier (64-QAM) x 48 subcarriers = 288 bits per symbol,&#xA;3/4 of which are useful data = &lt;em&gt;216 information bits per symbol&lt;/em&gt;.&#xA;These are transmitted in &lt;em&gt;4 microseconds&lt;/em&gt; which gives &lt;strong&gt;54 Mbps&lt;/strong&gt; (highest nominal data rate of 802.11g).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The worst link condition allows for usage of BPSK (strongest modulation) and 1/2 coding rate (more protection). This gives:&#xA;1 bit per subcarrier (BPSK) x 48 subcarriers = 48 bits per symbol,&#xA;1/2 of which are useful data = &lt;em&gt;24 information bits per symbol&lt;/em&gt;. These are transmitted in &lt;em&gt;4 microseconds&lt;/em&gt; which gives &lt;strong&gt;6 Mbps&lt;/strong&gt; (lowest nominal data rate of 802.11g using OFDM)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the middle of these extreme channel conditions, there are several combinations of modulation and coding rate which give different data rates (e.g. BPSK 3/4, ..., QPSK 1/2, ..., 16-QAM 3/4, ...)&lt;/p&gt;&#xA;" OwnerUserId="27712" LastActivityDate="2016-07-16T19:14:09.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33158" PostTypeId="2" ParentId="29629" CreationDate="2016-07-16T19:51:07.910" Score="3" Body="&lt;p&gt;RSTP is mapped to PVST+ VLAN 1 instance, so make sure you have VLAN 1 enabled on any trunks between the RSTP and PVST+ regions for the two to interoperate.  Also, if you have PVST+ regions separated by an RSTP region, the PVST+ BPDUs are transparently forwarded across the RSTP region (so long as the VLANs are trunked), so the RSTP region acts like a shared network interconnecting any PVST+ regions.  &lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-07-16T19:51:07.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33159" PostTypeId="2" ParentId="33152" CreationDate="2016-07-16T21:27:58.570" Score="2" Body="&lt;p&gt;That's how I run most of my VMware systems. The main issue with mixing traffic and management is anything that disrupts that physical interface will also kill your management access. (STP blocking, self-loop err-disable, etc.) The Best Practice(tm) is to keep management on isolated interfaces, and have multiple management interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only place etherchannel is really advisable is between switches. Later version of ESXi can do LACP, but I find it's rarely worth the effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP is a matter of finding something that Works For You(tm). That means you understand how to configure, troubleshoot, and manage it. Otherwise, you'll have no (quick) way to deal with it when it malfunctions. Using the default is sometimes good, but quickly falls apart when you have multi-vendor networks.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-07-16T21:27:58.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33160" PostTypeId="2" ParentId="30520" CreationDate="2016-07-17T00:13:14.080" Score="1" Body="&lt;p&gt;A starting point is that signal strength really isn't the issue, it's the signal-to-noise ratio.  A wi-fi radio is listening to one transmission at a time.  If energy from another transmission comes in it can make the decoding the initial reception more difficult.  The ability to decode is based upon SNR and not the received power. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make it possible for a radio to receive only one signal at a time, wi-fi uses something called collision avoidance (which is much different than wired ethernet's collision detect) so there is only one transmission to an AP's radio (or, more preciesly, a receiver's radio) at a time.   (Note:  APs these days have multiple radios so they can support things like 2.4G and 5G simultaneously and some have more)  The avoidance techniques cause a bottleneck per distributed access to a shared medium, which is roughly 10K transmissions opportunities (TXOPs) per second at a peak.  As more devices come in these TXOPs will be consumed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Optimal avoidance techniques depend upon hearing peer transmissions in order not to clobber them.  For wi-fi, there can be hidden nodes, i.e. two devices can hear the AP but not each other hence the potential to &quot;interfere&quot; with a current reception.  In this case, a transmission can require more TXOPs so the AP can effectively reserve air time for the devices which can't hear one another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there is a performance impact of a sudden surge of devices but it's mostly due to the need to arbitrate for the AP's &quot;ear.&quot;  A way around this is to weaken the signal (cell coverage) and add more APs creating more cells, effectively increasing the number of simultaneous conversations that can be supported by the network.&lt;/p&gt;&#xA;" OwnerUserId="27884" LastEditorUserId="27884" LastEditDate="2016-07-17T00:26:28.267" LastActivityDate="2016-07-17T00:26:28.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33164" PostTypeId="1" CreationDate="2016-07-17T06:24:24.743" Score="1" ViewCount="6435" Body="&lt;p&gt;I am new to Cisco in general and have the following setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GigabitEthernet0/0 contains an IP address that is connected to our provider/BGP drop; GigabitEthernet0/1 contains various IP addresses assigned ending in .1 for the IP prefixes we announce to the Internet; this is also the Interface that all of our devices are plugged into via our switch &amp;lt;--&gt; GigabitEthernet0/1 connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We want our primary IP address on GE0/0 to be on our primary assigned IP network, such as a.b.c.252 while keeping .1 on GE0/1 for a gateway for our local machines/equipment. Currently when traceroutes or the like come into the network, they get responded to with the IP assigned from our uplink to GE0/0. We'd like this instead to be an IP from our own assigned prefix for identification/notification/consistency sake. (We'll keep the IP from our uplink as a secondary IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to assign .252 to GE0/0 and .1 to GE0/1, I get the usual errors about the subnet already existing on another interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I go about doing this? How do I assign IP in A.B.C, such as A.B.C.252 to GE0/0 as the primary IP address while assigning A.B.C.1 to GE0/1 so that clients on the network can use it as a gateway?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, is there a way to allow those on the LAN to use IPs on GE0/0 even though they're plugged into GE0/1, without borking anything too bad? And more to this point even more so, and going a bit off the rails but curious to know if it's possible - if we have three distinct prefixes assigned from RIPE, and wanted to have traceroutes and what-have-you respond with the .1 IP from the beginning of each subnet to the requestor, would this be possible? I am imagining something to do with NAT and matching response with a given source IP for certain ICMP packets (but this wouldn't work for, say, UDP traceroute?). Any ideas there either?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="27905" LastActivityDate="2016-11-14T19:58:00.350" Title="How to use IPs from the same network on two separate Cisco interfaces, and other IP trickery" Tags="|cisco|routing|subnet|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33165" PostTypeId="2" ParentId="33164" CreationDate="2016-07-17T07:20:40.147" Score="3" Body="&lt;p&gt;How do you have this set up at the moment?  Are you using a private range or another of you public subsets on G0/0?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't have the same subnet on different interfaces as it would break routing.  The router wouldn't know which hosts were reachable through each of the interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a couple of workarounds if you want to have your BGP peering on the same network as your public address space:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to create a bridge-group consisting of G0/0 and G0/1.  You can then assign a BVI to the group with your public addresses.  This would give you a single IP interface with traffic from G0/0 and G0/1 L2 forwarded to the IP interface.  Another option would be to connect your BGP connection into the LAN and put your IPs on G0/1 only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This isn't the usual way to peer with a provider.  It would be much better to use separate IP interfaces for the LAN and peering so that policies and ACLs can be applied.  What is your reasoning for wanting it set up like this?  Is it just so your trace routes show your public address?&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-07-17T07:20:40.147" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="33166" PostTypeId="1" AcceptedAnswerId="33968" CreationDate="2016-07-17T09:40:29.410" Score="2" ViewCount="3651" Body="&lt;p&gt;I have cisco ASA 5515-x running version 9.2.  I want to port forward the request on 80 to 9006 which is of my DVR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did this :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network obj-10.10.26.6&#xA;  host 10.10.26.6&#xA;object network obj-203.156.213.173&#xA;  host 203.156.213.173&#xA;object service port-80&#xA;  service tcp source eq 80&#xA;object service port-9006&#xA;  service tcp destination eq 9006&#xA;&#xA;nat (inside,public-IP) source static obj-10.10.26.6 obj-203.156.213.173 service port-80 port-9006&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get this following error when I do port forwarding in the pool IP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pac in public-IP tcp 8.8.8.8 12345 203.156.213.173 9006&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;input-interface: Public-IP&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: Public-IP&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: drop&#xA;&#xA;Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am i doing wrong here? Why am i getting this error: &quot;Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually, 201.135.201.73 is my Public IP and 203.156.213.173 is my pool IP that ISP has given and it is routable to my public ip.&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="619" LastEditDate="2016-07-17T23:40:36.013" LastActivityDate="2016-08-11T15:12:47.047" Title="Regarding the Manual NAT in Cisco ASA" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33167" PostTypeId="2" ParentId="33166" CreationDate="2016-07-17T10:10:34.147" Score="0" Body="&lt;p&gt;If you're using source NAT then the ports should be set to source.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object service port-9006&#xA; service tcp source eq 9006&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Clear the translation table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clear xlate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23560" LastEditorUserId="23560" LastEditDate="2016-07-18T10:39:05.367" LastActivityDate="2016-07-18T10:39:05.367" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33169" PostTypeId="2" ParentId="33164" CreationDate="2016-07-17T14:16:21.277" Score="1" Body="&lt;p&gt;This would be manufacturer depended as it not really standards based, but we do see it implemented, namely in Cisco IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/hot-standby-router-protocol-hsrp/13786-20.html&quot; rel=&quot;nofollow&quot;&gt;Understanding and Configuring the ip unnumbered Command&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ip unnumbered configuration command allows you to enable IP processing on a serial interface without assigning it an explicit IP address. The ip unnumbered interface can &quot;borrow&quot; the IP address of another interface already configured on the router, which conserves network and address space.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-17T14:16:21.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33170" PostTypeId="2" ParentId="20868" CreationDate="2016-07-17T14:21:21.853" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/configuration/guide/scg_2960/swtrafc.html#56161&quot; rel=&quot;nofollow&quot;&gt;Configuring Protected Ports&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some applications require that no traffic be forwarded at Layer 2 between ports on the same switch so that one neighbor does not see the traffic generated by another neighbor. In such an environment, the use of&#xA;protected ports ensures that there is no exchange of unicast, broadcast, or multicast traffic between these ports on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure your Huawei switch has this feature.  It appears to be a layer 2 switch.  I was going to recommend ACL's to achieve it but it likely won't have that if layer 2 only.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-17T14:21:21.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33172" PostTypeId="2" ParentId="33164" CreationDate="2016-07-17T16:38:17.643" Score="0" Body="&lt;p&gt;First, I think you misunderstand how traceroute works. The IP address you see in traceroute is the router address of the interface where a packet enters the router. This is because the TTL of the packet is &lt;code&gt;1&lt;/code&gt; when it enters the interface, and the interface decrements the TTL to &lt;code&gt;0&lt;/code&gt;. When that happens, the router generates an ICMP message and sends it back the way the packet came in. The source address of that message is the interface where the ICMP message is leaving the router (your &lt;code&gt;G0/0&lt;/code&gt; WAN interface). The interface to which the router would send the packet if the TTL was not &lt;code&gt;0&lt;/code&gt; (your &lt;code&gt;G0/1&lt;/code&gt; LAN interface) plays no part in this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router routes between networks, not from an interface in one network to an interface in the same network. The routing table would not work correctly if you had two interfaces in the same network, and that is why routers don't let you assign the same network to two different interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another consideration is that you may want to disable ICMP and traceroute at the router as a security measure. Hackers use this to try to discover you internal network structure. Traceroute is a good tool for use within your own network, but on the Internet, you can get false information. Some ISPs along the path will drop or reroute ICMP and/or traceroute to other paths in order to obfuscate their internal networks.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-17T16:38:17.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33174" PostTypeId="2" ParentId="32335" CreationDate="2016-07-17T16:51:26.337" Score="1" Body="&lt;p&gt;At layer-1 and layer-2, Wi-Fi is used instead of a wired protocol like ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above that, the layer-3 protocol (IPv4, IPv6, etc.) will be the same, as will the layer-4 protocol (TCP, UDP, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Protocols above layer-4 are explicitly off-topic here but they will be the same as used on a wired network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole idea behind the network stack is that each layer in the stack is independent of the other layers in the stack. For instance, IPv4 happily runs on many different layer-2 protocols (ethernet, Wi-Fi, PPP, frame relay, HDLC, etc.), and it doesn't know or care which layer-2 protocol carries it. Layer-2 protocols, such as ethernet and Wi-Fi, can carry any number of layer-3 protocols (IPv4, IPX, IPv6 AppleTalk, etc.), and they don't care which layer-3 protocol they are carrying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as an application is concerned, nothing has changed, because the application is oblivious to the lower-level protocols being used.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-17T16:51:26.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33175" PostTypeId="1" CreationDate="2016-07-17T18:12:55.947" Score="1" ViewCount="1793" Body="&lt;p&gt;Today we are managing two big departments of our University and after a political decision, both departments are joining forces on the IT services. Due to this we are trying to unify our Core Network, but this wasn't easy as it should appear to be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both departments runs a huge routed infrastructure with public IPv4 address and only one of them have NAT for clients. But the issue isn't here. The issue is about our WAN links. They are &quot;broken TCP network&quot; in it's glory :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To illustrate the issue. The WAN static addresses are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Dept#1: 192.0.2.195/26&lt;/li&gt;&#xA;&lt;li&gt;Dept#2: 192.0.2.196/26&lt;/li&gt;&#xA;&lt;li&gt;Common Gateway: 192.0.2.193/26&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So as you can see both WAN links are on the same subnet, and this is an issue because on Dept#1 we have seven /24 routed networks and on Dept#2 we have three /24 routed networks pointing to the respective IP's as next hops on the routing tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since TCP/IP networking does not allow two addresses of the same subnet in a single piece of hardware we cannot use those addresses on the same equipment. Basically we need to put some Layer 3 device to process the routes and after it merge the networks in a unified core.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem here is how to do this. Today we have two pfSense firewalls to do this, but we would prefer to merge those firewalls to put them in HA with both networks, but we're unable to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have some ideas using VRF on our Nexus 3048 Core Switches but I don't know if this a good idea or even if VRF should be used this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the routing tables of both equipment:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dept #1&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% interfaces&#xA;WAN (wan)       -&amp;gt; bce0        -&amp;gt; v4: 192.0.2.195/26&#xA;LAN (lan)       -&amp;gt; bce1        -&amp;gt; v4: 100.64.36.1/24&#xA;&#xA;% netstat -nr&#xA;Routing tables&#xA;&#xA;Internet:&#xA;Destination        Gateway            Flags      Netif Expire&#xA;default            192.0.2.193        UGS        bce0&#xA;10.3.12.0/24       100.64.36.36       UGS        bce1&#xA;127.0.0.1          link#5             UH          lo0&#xA;192.0.2.192/26     link#1             U          bce0&#xA;192.0.2.195        link#1             UHS         lo0&#xA;100.64.36.0/24     link#2             U          bce1&#xA;100.64.36.1        link#2             UHS         lo0&#xA;100.64.37.0/24     100.64.36.36       UGS        bce1&#xA;100.64.40.0/26     100.64.36.36       UGS        bce1&#xA;100.64.40.64/26    100.64.36.36       UGS        bce1&#xA;100.64.40.128/26   100.64.36.36       UGS        bce1&#xA;100.64.40.192/26   100.64.36.36       UGS        bce1&#xA;100.64.136.0/22    100.64.36.36       UGS        bce1&#xA;198.51.100.0/24    100.64.36.35       UGS        bce1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Dept #2&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% interfaces&#xA;WAN (wan)       -&amp;gt; bce0        -&amp;gt; v4: 192.0.2.196/26&#xA;LAN (lan)       -&amp;gt; em0         -&amp;gt; v4: 172.16.0.1/21&#xA;MGMT (opt1)     -&amp;gt; em1         -&amp;gt; v4: 10.7.0.1/24&#xA;SRV (opt2)      -&amp;gt; em1_vlan29  -&amp;gt; v4: 100.64.29.1/24&#xA;VPN (opt3)      -&amp;gt; em1_vlan11  -&amp;gt; v4: 192.168.172.254/24&#xA;LIG (opt4)      -&amp;gt; em0_vlan666 -&amp;gt; v4: 172.26.66.30/27&#xA;&#xA;% netstat -nr&#xA;Routing tables&#xA;&#xA;Internet:&#xA;Destination        Gateway            Flags      Netif Expire&#xA;default            192.0.2.193        UGS        bce0&#xA;10.7.0.0/24        link#3             U           em1&#xA;10.7.0.1           link#3             UHS         lo0&#xA;10.172.16.0/26     link#2             U           em0&#xA;10.172.16.1        link#2             UHS         lo0&#xA;127.0.0.1          link#6             UH          lo0&#xA;192.0.2.192/26     link#1             U          bce0&#xA;192.0.2.196        link#1             UHS         lo0&#xA;100.64.29.0/24     link#8             U      em1_vlan&#xA;100.64.29.1        link#8             UHS         lo0&#xA;100.64.30.0/26     link#2             U           em0&#xA;100.64.30.1        link#2             UHS         lo0&#xA;100.64.30.64/26    link#2             U           em0&#xA;100.64.30.65       link#2             UHS         lo0&#xA;100.64.30.128/26   link#2             U           em0&#xA;100.64.30.129      link#2             UHS         lo0&#xA;100.64.30.192/26   link#2             U           em0&#xA;100.64.30.193      link#2             UHS         lo0&#xA;172.16.0.0/21      link#2             U           em0&#xA;172.16.0.1         link#2             UHS         lo0&#xA;172.26.66.0/27     link#10            U      em0_vlan&#xA;172.26.66.30       link#10            UHS         lo0&#xA;192.168.172.0/24   link#9             U      em1_vlan&#xA;192.168.172.254    link#9             UHS         lo0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So as you can see we've a lot of networks. I changed the public IPv4's for the &lt;code&gt;100.64/10&lt;/code&gt; range and the WAN links to the &lt;code&gt;192.0.2/24&lt;/code&gt; range just to keep it generic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we could just process the WAN links in some device (in the Core Switches for instance) and them use the LAN addresses on a unified firewall the problem would be solved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the last thing, I can speculate how the WAN routing table looks like. It should be something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Routing tables&#xA;&#xA;Internet:&#xA;Destination        Gateway            Flags      Netif Expire&#xA;192.0.2.192/26     link#1             ?          switchport24&#xA;192.0.2.193        link#1             ?          loopback0&#xA;100.64.29.0/24     192.0.2.196        ?          switchport6&#xA;100.64.30.0/24     192.0.2.196        ?          switchport6&#xA;100.64.146.0/24    192.0.2.196        ?          switchport6&#xA;100.64.36.0/23     192.0.2.195        ?          switchport5&#xA;100.64.40.0/24     192.0.2.195        ?          switchport5&#xA;100.64.136.0/22    192.0.2.195        ?          switchport5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this table cannot be changed since we don't have access to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS1: Talking with the guys responsible for the &quot;WAN&quot; architecture would be impossible right now. So we must find out a way without changing anything on the WAN address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS2: Who needs routing protocols when everything is built with static routes... :(&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;: Drawning and long story short.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------------+       +------------------+       &#xA;|                | ----&amp;gt; | Firewall Dept #1 | -----------\&#xA;|                |       | 192.0.2.195/26   |            |&#xA;| Switch         |       +------------------+       +---------------+&#xA;| Layer 2 (WAN)  |                                  | Internal Core |&#xA;| 192.0.2.193/26 |       +------------------+       +---------------+&#xA;|                |       | Firewall Dept #2 |            |&#xA;|                | ----&amp;gt; | 192.0.2.196/26   | -----------/&#xA;+----------------+       +------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What we want:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------------+       + -----------------+&#xA;| Layer 2 (WAN)  |       | Unified Firewall |       +---------------+&#xA;| 192.0.2.193/26 | ----&amp;gt; | 192.0.2.195/26   | ----- | Internal Core |&#xA;|                | ----&amp;gt; | 192.0.2.196/26   |       +---------------+&#xA;+----------------+       +------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Routing Table - They are actually real public IPv4 network. I changed to &lt;code&gt;100.64/10&lt;/code&gt; network to keep it generic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;100.64.29.0/24  gw 192.0.2.196&#xA;100.64.30.0/24  gw 192.0.2.196&#xA;100.64.36.0/23  gw 192.0.2.195&#xA;100.64.40.0/24  gw 192.0.2.195&#xA;100.64.136.0/22 gw 192.0.2.195&#xA;100.64.146.0/24 gw 192.0.2.196&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Issues:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I don't have management of the Layer 2 Switch.&lt;/li&gt;&#xA;&lt;li&gt;Our management start on the firewalls.&lt;/li&gt;&#xA;&lt;li&gt;I can't use one cable from the Layer 2 Switch to bind two IP's on the Firewall due to security policies on the Layer 2 Switch. So both cables must be connected with distinct networks.&lt;/li&gt;&#xA;&lt;li&gt;I &lt;em&gt;can&lt;/em&gt; find use some addresses from our IPv4 pool on the Firewall, but to do this I must preroute before the firewall. I can use the &quot;Internal Core&quot; for this, but I don't know how.&lt;/li&gt;&#xA;&lt;li&gt;Separate routers solves this.&lt;/li&gt;&#xA;&lt;li&gt;We do have a Cisco Nexus 3048 Switch, so we can do some wizardry on this guy. That's why I mentioned VRF on the first place.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10528" LastEditorUserId="10528" LastEditDate="2016-07-17T21:39:24.590" LastActivityDate="2017-08-12T05:37:40.583" Title="How to fix this messed up routing scenario with two IP's from same subnet on distinct WAN's?" Tags="|routing|wan|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33176" PostTypeId="1" AcceptedAnswerId="33178" CreationDate="2016-07-17T19:04:31.460" Score="4" ViewCount="6003" Body="&lt;p&gt;I have 2 Unmanaged &lt;a href=&quot;http://www.dlink.com/uk/en/business-solutions/switching/unmanaged-switches/rackmount/des-1024d-24-port-10-100mbps-desktop-switch&quot; rel=&quot;noreferrer&quot;&gt;switches&lt;/a&gt; (100Mbps) and I want to replace them with one switch like &lt;a href=&quot;http://www.tp-link.com/en/products/details/T1600G-52TS-(TL-SG2452).html&quot; rel=&quot;noreferrer&quot;&gt;this&lt;/a&gt;, which is 1000Mbps but it is managed. The TL-SG2452 is plug &amp;amp; play or I will have to do a setup in order to work?&lt;/p&gt;&#xA;" OwnerUserId="21495" LastActivityDate="2016-07-17T19:09:02.600" Title="Managed switches need setup?" Tags="|switch|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33177" PostTypeId="2" ParentId="33176" CreationDate="2016-07-17T19:08:48.707" Score="4" Body="&lt;p&gt;The basic switching functionality will be there right away. This means normally all ports are enabled and assigned to the same default VLAN (usually 1). Further, usually there is Spanning Tree active by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So long story short: You can use the switch right out of the box, you however have the possibility to add and configure other features (for example VLANs, basic routing, security features, or other things) as required.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-07-17T19:08:48.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33178" PostTypeId="2" ParentId="33176" CreationDate="2016-07-17T19:09:02.600" Score="7" Body="&lt;p&gt;If you just plug it on the network without touching anything on the configuration it should behave just like an unmanaged switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This happens because the stock configuration generally allows this. If the switch have VLAN capabilities it come for example with a predefined VLAN1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But do yourself a favor and at least learn how to connect to it and explore its features. If you like networking you'll be pleased.&lt;/p&gt;&#xA;" OwnerUserId="10528" LastActivityDate="2016-07-17T19:09:02.600" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33180" PostTypeId="2" ParentId="33175" CreationDate="2016-07-17T20:42:31.990" Score="0" Body="&lt;p&gt;Based on the conversation we had in chat, I really don't see the problem. There are many cases where you will have multiple routers with interfaces in the same network. You just connect them via layer-2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JKEdT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JKEdT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 and R2 are the routers for the two departments, and R3 is the router in common. S1 is a layer-2 switch which connects all three routers. You will need to have some way to let each router know about the routes behind the other routers, either statically configured (doesn't scale) or with a common routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is basic networking, it is perfectly acceptable, and it is not at all uncommon.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-17T20:42:31.990" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="33181" PostTypeId="1" AcceptedAnswerId="33382" CreationDate="2016-07-17T21:06:41.680" Score="1" ViewCount="1560" Body="&lt;p&gt;I am tasked to do conditonally advertise a default route using RIP only if a specific IP address is ICMP reachable. (Yes, CCIE study, not a real network design).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My idea was to use the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_pi/configuration/15-mt/iri-15-mt-book/iri-pbr-match-track-object.html&quot; rel=&quot;nofollow&quot;&gt;track object matching&lt;/a&gt; feature to accomplish this task:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show run | s route-map|sla|track|router rip&#xA;track 1 ip sla 1&#xA;router rip&#xA; version 2&#xA; network 150.1.0.0&#xA; network 155.1.0.0&#xA; default-information originate route-map RELIABLE_DEFAULT&#xA; no auto-summary&#xA;ip sla 1&#xA; icmp-echo 155.1.7.7&#xA; frequency 5&#xA;ip sla schedule 1 life forever start-time now&#xA;route-map RELIABLE_DEFAULT permit 10&#xA; match track  1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The track object and SLA is actually working fine and the route-map is registered with the track object:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show ip sla summary &#xA;IPSLAs Latest Operation Summary&#xA;Codes: * active, ^ inactive, ~ pending&#xA;&#xA;ID           Type        Destination       Stats       Return      Last&#xA;                                           (ms)        Code        Run &#xA;-----------------------------------------------------------------------&#xA;*1           icmp-echo   155.1.7.7         RTT=12      OK          0 seconds ago                                                                  &#xA;&#xA;R1#show track 1&#xA;Track 1&#xA;  IP SLA 1 state&#xA;  State is Up&#xA;    2 changes, last change 00:08:55&#xA;  Latest operation return code: OK&#xA;  Latest RTT (millisecs) 12&#xA;  Tracked by:&#xA;    Route Map 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This however does not work (no default route is advertised). Preferred solution is to use a dummy static route like this which is actually working.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip sla 1&#xA; frequency 5&#xA; icmp-echo 155.1.7.7&#xA;ip sla schedule 1 start-time now life forever&#xA;track 1 ip sla 1&#xA;! &#xA;ip route 169.254.0.1 255.255.255.255 Null0 track 1&#xA;!&#xA;ip prefix-list DUMMY_ROUTE seq 5 permit 169.254.0.1/32&#xA;!&#xA;route-map RELIABLE_DEFAULT permit 10&#xA; match ip address prefix-list DUMMY_ROUTE&#xA;! &#xA;router rip&#xA; default-information originate route-map RELIABLE_DEFAULT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand why this solution works, however I do not understand why mine does not. Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2019-01-17T23:20:39.640" Title="Cisco Route-Map Object Tracking for Default-Information" Tags="|cisco|routing|cisco-ios|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33182" PostTypeId="1" CreationDate="2016-07-17T23:12:14.997" Score="4" ViewCount="769" Body="&lt;p&gt;What is the number &amp;quot;802.11&amp;quot; in &amp;quot;IEEE 802.11&amp;quot; representing? I mean, if you break it down, what exactly do &amp;quot;802&amp;quot; and &amp;quot;11&amp;quot; refer to?&lt;/p&gt;&#xA;" OwnerUserId="27918" LastEditorUserId="85981" LastEditDate="2023-01-14T15:05:08.700" LastActivityDate="2023-01-14T15:05:08.700" Title="What does &quot;802.11&quot; in &quot;IEEE 802.11&quot; mean?" Tags="|wireless|ieee-802.11|standardisation|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="33183" PostTypeId="2" ParentId="33182" CreationDate="2016-07-18T00:31:43.873" Score="9" Body="&lt;p&gt;802 is the number for the IEEE LAN/MAN Standards Committee, and 802.11 is the Wireless LAN Working Group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IEEE 802 committee maintains a &lt;a href=&quot;http://www.ieee802.org/&quot; rel=&quot;noreferrer&quot;&gt;web site&lt;/a&gt;, which lists the various current working groups within the committee.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;802.1 Higher Layer LAN Protocols Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.3 Ethernet Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.11 Wireless LAN Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.15 Wireless Personal Area Network (WPAN) Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.16 Broadband Wireless Access Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.18 Radio Regulatory TAG&lt;/li&gt;&#xA;&lt;li&gt;802.19 Wireless Coexistence Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.21 Media Independent Handover Services Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.22 Wireless Regional Area Networks&lt;/li&gt;&#xA;&lt;li&gt;802.24 Vertical Applications TAG&lt;/li&gt;&#xA;&lt;li&gt;802 5G/IMT-2020 Standing Committee&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hibernating:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;802.17 Resilient Packet Ring Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.20 Mobile Broadband Wireless Access (MBWA) Working Group&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Disbanded:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;802.2 Logical Link Control Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.4 Token Bus Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.5 Token Ring Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.6 Metropolitan Area Network Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.7 Broadband TAG&lt;/li&gt;&#xA;&lt;li&gt;802.8 Fiber Optic TAG&lt;/li&gt;&#xA;&lt;li&gt;802.9 Integrated Services LAN Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.10 Security Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.12 Demand Priority Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.14 Cable Modem Working Group&lt;/li&gt;&#xA;&lt;li&gt;802.23 Emergency Services Working Group&lt;/li&gt;&#xA;&lt;li&gt;QOS/FC Executive Committee Study Group&lt;/li&gt;&#xA;&lt;li&gt;ECSG TVWS TV Whitespace study group&lt;/li&gt;&#xA;&lt;li&gt;ES-ECSG Emergency Services Executive Committee Study Group&lt;/li&gt;&#xA;&lt;li&gt;OmniRAN EC Study Group&lt;/li&gt;&#xA;&lt;li&gt;Privacy Recommendation EC Study Group&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-18T00:43:27.967" LastActivityDate="2016-07-18T00:43:27.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33184" PostTypeId="2" ParentId="33112" CreationDate="2016-07-18T02:20:49.610" Score="1" Body="&lt;p&gt;Modern Ethernet controllers have link state detection. They can detect when a link is established to their Ethernet port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The situation is a bit different for IPv4 and IPv6. First the IPv4 scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the Ethernet cable is plugged in the OS detects this through link state detection. If the interface is configured for DHCP then the client will send out a DHCP request. In a typical home/small buisness network the router will run a DHCP server which will assign the client an IP address and also tell the client what subnet mask, default gateway and DNS servers to use. In a larger network the router and the DHCP server may be on different devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If no DHCP server is found the client may keep trying and/or it may assign a local IP using &quot;automatic private IP addressing&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 is a little more complicated. Unlike IPv4 nodes IPv6 nodes always have a link local address which they assign themselves. For Internet access they will need a global scope address and related settings. There are three main posibilities for IPv6 autoconfiguration.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;RAs only. The router sends out advertisements telling clients what prefixes are on the link and what networks the router offers routes to (including a default gateway if applicable). The advertisements are sent to all IPv6 nodes on the link (this is technically classed as a multicast but practically its the closest thing IPv6 has to a broadcast) and inform the clients of the prefix they should be using and the addresses of routers. Clients can send out a request to prompt a RA to be sent sooner than the router would have sent it. Clients construct their own IPv6 addresses based on the prefix. Older systems used a single address based on their MAC address, more modern systems with privacy extensions will use multiple short-lived addresses. Unfortunately RAs do not provide DNS server configuration, so on their own they are inadequate for autoconfiguration of IPv6 only clients.&lt;/li&gt;&#xA;&lt;li&gt;RAs with stateless DHCPv6. Here addressing is handled by RAs as above but DNS server details (and possiblly other less important configuration) is handed out by a DHCP server in response to a client request.&lt;/li&gt;&#xA;&lt;li&gt;Stateful DHCPv6, this works much like DHCP for IPv4.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-07-19T15:49:54.543" LastActivityDate="2016-07-19T15:49:54.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33189" PostTypeId="1" CreationDate="2016-07-18T07:55:46.390" Score="2" ViewCount="603" Body="&lt;p&gt;I am new to networking field can anyone explain why does my firewall gives message below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(snort_decoder) WARNING: TCP urgent pointer exceeds payload length or no payload&lt;/p&gt;&#xA;" OwnerUserId="27912" LastActivityDate="2016-08-18T05:14:12.090" Title="Firewall Signature" Tags="|firewall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33193" PostTypeId="2" ParentId="32344" CreationDate="2016-07-18T10:58:27.770" Score="1" Body="&lt;p&gt;you can set next-hop as dhcp&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set load-balancing wan interface-health pppoe1 nexthop dhcp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27935" LastActivityDate="2016-07-18T10:58:27.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33194" PostTypeId="1" AcceptedAnswerId="33241" CreationDate="2016-07-18T11:34:44.113" Score="0" ViewCount="409" Body="&lt;p&gt;the overview of my situation can be seen here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/r4fRM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/r4fRM.png&quot; alt=&quot;overview&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have multiple overlapping networks here, namely 10.0.0.0/8 and 10.64.5.0/24 and 10.64.95.0/24. I've decided to separate them via NAT - using 192.168.88.0 network. The other NAT (&quot;Red&quot;) works fine and separates another subnet.&#xA;R2 and R3 are Mikrotik routers, their respective configs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 is a SOHO TP-LINK MR3220, which is default GW for the machines in pink (10.0.0.0/8 subnet). It serves as an Internet gateway for them.&#xA;The problem is, I can ping 192.168.88.1 / 2 / 3 (in essence, R2 interface) from &quot;blue&quot; IPs (192.168.40.71), but cannot ping 192.168.40.71 from &quot;pink&quot; machines - the ping is sent to their default GW (10.0.0.1 = TPLink), and the router in turn has static route set - 192.168.40.0 via 10.64.203.88.&#xA;However, the traceroute to 192.168.88.4 (R3 interface) stops at R2 (10.64.203.88).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping 192.168.88.1 from 192.168.40.71 (blue), but not the other way around. Mikrotik labeled R2 can ping 40.71 however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All firewalls are disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect I messed something up in the default GW/static routes, but do not know where.&lt;/p&gt;&#xA;" OwnerUserId="25482" LastEditorUserId="8499" LastEditDate="2018-02-14T16:21:25.543" LastActivityDate="2018-02-14T16:21:25.543" Title="Twin NAT and multiple GWs, routing issue" Tags="|routing|nat|" AnswerCount="1" CommentCount="7" ClosedDate="2017-08-09T23:43:07.967" ContentLicense="CC BY-SA 3.0" />
  <row Id="33195" PostTypeId="1" CreationDate="2016-07-18T12:15:53.597" Score="0" ViewCount="1235" Body="&lt;p&gt;Current network is like - MSP network--&gt; Cisco 4431--&gt; ASA--&gt; N7k--&gt; LAN. &#xA;I'm adding one more router and one more ASA in the network, Do I really need to add L2 switch to connect routers LAN side and FW outside interface to achieve HSRP redundancy?(as I dont have L2 switch), if L2 is mandatory for HSRP as I went through some docs, how the switchport on L2 and Router ports and ASA ports will be configured? on L2 switch - normal switch port on a single VLAN ? and on Router and ASA normal L3 ports ?&lt;/p&gt;&#xA;" OwnerUserId="27936" LastActivityDate="2016-07-21T16:16:32.250" Title="Can I connect the two routers back to back to use HSRP? Please suggest" Tags="|router|cisco-asa|redundancy|hsrp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33197" PostTypeId="1" AcceptedAnswerId="33783" CreationDate="2016-07-18T15:09:30.707" Score="11" ViewCount="2043" Body="&lt;p&gt;I have two old cable modems I used to use with my ISP, they are no longer used because I upgraded my service to include VOIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering what would be involved to create essentially a microcosm of the big cable companies DOCSIS networks, using the modems I have? This is just for experimentation/learning, I wouldn't connect them to my homes cable, I would be completely disconnected in order to avoid interfering with my cable company.&lt;/p&gt;&#xA;" OwnerUserId="27941" LastActivityDate="2016-08-05T13:49:23.013" Title="How to create a DOCSIS network" Tags="|docsis|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33199" PostTypeId="1" AcceptedAnswerId="34993" CreationDate="2016-07-18T15:21:18.237" Score="4" ViewCount="16455" Body="&lt;p&gt;I am using cisco 2901 Router with IOS version 15M. In the configuration of the router I am using lots of static NAT entries. And I need to change these entries when it is requested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And a possible solution for this situation are the configuration files that I saved to the &lt;em&gt;flash0:&lt;/em&gt; of the cisco 2901 router. However, by using configuration files, I can't delete existing NAT entries. But on the other hand, I can create a static NAT entry using these configuration files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, I am looking for a command that will clear all the static NAT entries. Then I will create static NAT entries using these configuration files.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I tried the following commands to clear the NAT entries, but these all are for dynamic NAT entries. Thus, they did not work.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&#xA;    clear ip nat translation *&#xA;    clear ip nat translation forced&#xA;    do clear ip nat translation *&#xA;    do clear ip nat translation forced&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;A possible solution (although it takes too much time): First create a configuration file that does not have any static NAT entry:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;copy running-config flash0:config_0_entry&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then copy this configuration to the &lt;code&gt;startup-config&lt;/code&gt; and reboot. (These two command will wipe out all the static entries.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy flash0:config_0_entry startup-config&#xA;reload &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then after reboot, load your configuration file into the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy flash0:your_config_file running_config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I could use this method, but the reboot takes too much time. I cannot wait that long.&lt;/p&gt;&#xA;" OwnerUserId="20519" LastEditorUserId="20757" LastEditDate="2017-06-14T13:51:50.933" LastActivityDate="2021-01-08T03:05:26.950" Title="How to clear all static NAT entries with just one command?" Tags="|router|nat|cisco-commands|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33202" PostTypeId="1" CreationDate="2016-07-18T15:50:26.907" Score="0" ViewCount="182" Body="&lt;p&gt;I have a new 100mb line at work that has a 80mb(MPLS)/20mb(Internet) split. I just want to confirm my understanding of this. The MPLS connects us to our HQ in London and with the current split that gives us 80mb of bandwidth to our other offices, does this 80mb also provide any bandwidth for internet access or is that 80mb only for access to our other offices?&lt;/p&gt;&#xA;" OwnerUserId="23768" LastActivityDate="2016-07-18T20:48:39.467" Title="Query: Purpose of splitting circuit between MPLS/Internet" Tags="|mpls|isp|" AnswerCount="1" CommentCount="3" ClosedDate="2017-08-14T21:22:30.353" ContentLicense="CC BY-SA 3.0" />
  <row Id="33203" PostTypeId="2" ParentId="33202" CreationDate="2016-07-18T15:56:51.907" Score="1" Body="&lt;p&gt;Depending on the vendor/hardware, technically the provider could set this up either way, so there could be a hard limit of 80 Mbps MPLS/20 Mbps Internet or they could allow the unused bandwidth to be used by the other service.   Contractually, the provider will likely have tied this down in the terms of use and configured the hardware to implement that policy.  If you have read access to the provider’s hardware which implements the policy, then please post the config along with the vendor and hardware model and we can advise on how the provider has implemented this.  Let us know the provider and service you have purchased.  Someone may be able to comment if they use the same service.  I’d also advise you check your provider’s documentation or contact them.  There is no standard implementation for this, so without this info we can only guess.  If I were to take a guess, I would say the provider had set hard limits, so no more than 80 Mbps on the MPLS and 20 Mbps on the Internet as each of the two can incur third-party costs and the provider needs to budget accordingly.   &lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-07-18T20:48:39.467" LastActivityDate="2016-07-18T20:48:39.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33206" PostTypeId="1" AcceptedAnswerId="33209" CreationDate="2016-07-18T17:00:07.110" Score="2" ViewCount="2444" Body="&lt;p&gt;We have nexus 7000, there are multiple vlans&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I am unable to ping from 10.48.32.0/24 to 10.48.42.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is user 10.48.32.54   i am unable to trace its switch port,please advise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is troubleshooting I have tried.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW01# sh ip arp | in 10.48.32.54&#xA;10.48.32.54     00:09:11  8cdc.XXX.471c  Vlan32      &#xA;&#xA;USIDCDISSW01# show  mac address-table | include 471c&#xA;* 32       8cdc.XXX.471c    dynamic   0          F    F  Po201&#xA;&#xA;SW04# show  ip arp | in 471c&#xA;&#xA;SW03# show  ip arp | in 471c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;below is show output of below command where SW04 and SW03 are showing but I am unable to trace switch port of mac 8cdc.XXX.471c&#xA;&#xA;&lt;pre&gt;&lt;code&gt; cdp  neighbors interface Po201 detail ############################&#xA;&#xA;USIDCDISSW01# show  cdp  neighbors interface Po201 detail&#xA;&#xA;----------------------------------------&#xA;&#xA;Device ID:SW03()&#xA;&#xA;System Name: SW03&#xA;&#xA;&#xA;&#xA;Interface address(es):&#xA;&#xA;    IPv4 Address: 10.48.130.55&#xA;&#xA;Platform: N5K-C5596UP, Capabilities: Switch IGMP Filtering Supports-STP-Dispute&#xA;&#xA;Interface: Ethernet2/45, Port ID (outgoing port): Ethernet1/1&#xA;&#xA;Holdtime: 122 sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19899" LastEditorUserId="2142" LastEditDate="2016-07-18T17:11:55.810" LastActivityDate="2016-07-18T17:37:13.807" Title="nexus : unable to trace switch port" Tags="|routing|switching|spanning-tree|cisco-nexus-7k|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33207" PostTypeId="1" AcceptedAnswerId="33208" CreationDate="2016-07-18T17:04:38.517" Score="0" ViewCount="4232" Body="&lt;p&gt;If I have an ACL, when applying it to an interface, I need to say &quot;in&quot; or &quot;out&quot;. Is &quot;in&quot; referring to where the traffic is FROM, or where it is going TO?&lt;/p&gt;&#xA;" OwnerUserId="27759" LastEditorUserId="3675" LastEditDate="2016-07-18T18:12:38.527" LastActivityDate="2019-01-05T15:00:37.693" Title="(Cisco) ACL direction (in/out)?" Tags="|cisco|acl|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33208" PostTypeId="2" ParentId="33207" CreationDate="2016-07-18T17:07:17.310" Score="5" Body="&lt;p&gt;The terms IN and OUT are in reference to the router interface.  So IN means traffic coming into the router from that interface.  OUT means traffic leaving the router interface.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-18T17:07:17.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33209" PostTypeId="2" ParentId="33206" CreationDate="2016-07-18T17:16:56.137" Score="4" Body="&lt;p&gt;Unless the switch itself is generating packets, there will be nothing in the switch's ARP table.  As a layer 2 device, it doesn't need to resolve IP addresses.&#xA;A layer 3 switch only needs to resolve a host address if it is directly connected.  Otherwise, it forwards the packet to the next hop router (which will be in the ARP table).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-18T17:16:56.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33210" PostTypeId="2" ParentId="33206" CreationDate="2016-07-18T17:37:13.807" Score="2" Body="&lt;p&gt;Extending Ron's answer, here is an advice how to trace the user:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find out the user's MAC address. There are multiple ways to do that, but possibly you have an IP Address Management (IPAM) system or you can find it out using the IP address. On the switch or router being the layer 3 gateway of the user's VLAN, try to ping the end PC. It does not matter if it answers or not, the device should however ARP for the MAC address of the user's device, which you can find out using &lt;code&gt;show ip arp | i &amp;lt;IP-Address&amp;gt;&lt;/code&gt;, which should give you the MAC address.&lt;/li&gt;&#xA;&lt;li&gt;The next step is to track the path of this MAC address using the layer 2 forwarding information of each switch. Use &lt;code&gt;show mac address-table | i &amp;lt;MAC-Address&amp;gt;&lt;/code&gt; which will give you the entry in the MAC address table including the outgoing interface of this entry.&lt;/li&gt;&#xA;&lt;li&gt;Find out which switch is connected to this port for example using CDP.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Repeat 2 and 3 until you found the edge port, where the end user is connected to.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-07-18T17:37:13.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33213" PostTypeId="1" CreationDate="2016-07-18T18:45:56.527" Score="1" ViewCount="1215" Body="&lt;p&gt;Recently, I was on a Juniper device, trying to figure out why I was getting a lower bit rate even though I knew I was sending a lot more. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it hit me that Juniper devices show the Layer 3 transmit rate, whereas I was sending at a Layer 2 bit rate. It has been a while since I have encountered this, and I used to be able to do a calculation to estimate the Layer 3 bit rate based on the Layer 2 bit rate using the frame-size (Ethernet, VLAN). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I cant seem to remember how I did that calculation, nor can I find any examples or documentation on the conversion. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone highlight how this calculation is done (preferably with an example)? Lets say a L2 bit rate of 100 Mbps, and a frame size of 70 MB.&lt;/p&gt;&#xA;" OwnerUserId="13422" LastEditorUserId="8499" LastEditDate="2016-07-19T04:59:17.173" LastActivityDate="2016-07-19T04:59:17.173" Title="Calculation accounting for Layer 2 overhead when viewing traffic statistics" Tags="|juniper|layer2|layer3|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33214" PostTypeId="2" ParentId="33213" CreationDate="2016-07-18T18:58:03.973" Score="1" Body="&lt;p&gt;The frame header is 14 octets without a VLAN tag, and 18 octets with a VLAN tag. Inside the frame is your payload (IP packet). There is also a 4-octet FCS at the end of the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you add that all together, you get the frame size (maximum 1518 or 1522 octets, depending on whether or not it is a trunk link).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet has more than just the frame. There is a 7-octet preamble, 1-octet start of frame delimiter, and a 12-octet inter-packet gap between frames. So you add 20 octets to the size of your frame to account for ethernet overhead.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-18T18:58:03.973" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33215" PostTypeId="2" ParentId="32591" CreationDate="2016-07-18T20:09:43.783" Score="2" Body="&lt;p&gt;Since you are dealing with a dynamic cryptomap, traffic must be initiated from your router. Using IP-SLA you could schedule an ICMP operation from your VLAN10 interface to the anyconnect ip range that is scheduled to run in a defined time interval.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP SLA Config Guide:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_4/ip_sla/configuration/guide/hsla_c/hsicmp.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_4/ip_sla/configuration/guide/hsla_c/hsicmp.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know if you need a config example.&lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2016-07-18T20:09:43.783" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33216" PostTypeId="2" ParentId="26707" CreationDate="2016-07-18T21:06:25.543" Score="3" Body="&lt;p&gt;Unfortunately, the command to enable stacking (&quot;stacking enable&quot;) also wipes the config.  This includes all the global config as well as the port configuration.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-07-18T21:06:25.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33217" PostTypeId="1" AcceptedAnswerId="33266" CreationDate="2016-07-18T23:12:19.383" Score="0" ViewCount="41" Body="&lt;p&gt;My program sends requests to a web server once every 3s. The web server is running on a machine on the same private network as the program (they are in the same room).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any guarantee that they would arrive at the web server in 3s intervals?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, would it be close to 3s? Is it normal for, say, 1 in 100 requests to arrive within under 0.5s of each other?&lt;/p&gt;&#xA;" OwnerUserId="27956" LastActivityDate="2016-07-19T23:38:34.930" Title="Is there a guarantee that requests to a web server sent at a certain frequency will arrive at that same frequency?" Tags="|ip|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33218" PostTypeId="2" ParentId="33217" CreationDate="2016-07-19T00:09:05.020" Score="3" Body="&lt;p&gt;The only thing that would cause a delay is congestion on the network, although those delays would be in the milliseconds.  It's possible that congestion will cause packet drops, and the retransmission would  cause noticeable delays. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you are doing other data intensive things on your private network, you are unlikely to notice any delays. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-19T00:09:05.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33219" PostTypeId="2" ParentId="32591" CreationDate="2016-07-19T01:18:49.083" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/112075-dynamic-ipsec-asa-router-ccp.html&quot; rel=&quot;nofollow&quot;&gt;Dynamic IPsec Tunnel Between a Statically Addressed ASA and a Dynamically Addressed Cisco IOS Router that uses CCP Configuration Example&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This configuration enables the PIX Security Appliance to create a dynamic IPsec LAN-to-LAN (L2L) tunnel with a remote VPN router. This router dynamically receive its outside public IP address from its Internet service provider. &lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-19T01:18:49.083" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33220" PostTypeId="2" ParentId="33217" CreationDate="2016-07-19T01:22:57.677" Score="0" Body="&lt;p&gt;Practically speaking probably but not necessarily.  Your Web server is actually an application running on a server, so it's more complicated than just the Ethernet and/or IP networking layer.  The servers CPU/memory utilization may also be a factor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better architecture would be to use Comet, or XHR long polling.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-19T01:22:57.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33221" PostTypeId="2" ParentId="7935" CreationDate="2016-07-19T01:33:27.837" Score="0" Body="&lt;p&gt;The sessions are not timing out.  If you can get in type &lt;code&gt;show session&lt;/code&gt; then &lt;code&gt;disc 0&lt;/code&gt;, or whatever the session number(s) are.  You should be able to configure up to 15 concurrent I think.  I know it's atleast 5 (line vty 0 - 4).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VSh21.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VSh21.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-19T01:33:27.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33222" PostTypeId="2" ParentId="33199" CreationDate="2016-07-19T01:45:53.793" Score="0" Body="&lt;p&gt;To remove old NAT settings on Cisco router you need to &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;1)Clear all old NAT translations &#xA;router#clear ip nat translation *&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;2)Disable old NAT pool settings &#xA;router(config)#no ip nat pool public_access 200.100.10.33 netmask 255.255.255.252&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;3)And finally, disable the translation:&#xA;router(config)#no ip nat inside source list 1 pool public_access overload&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;From this point you can safely configure the new NAT settings.   (in conf mode) , I prefix my (pre-prepared and ready to paste) nat changes with &lt;code&gt;do clear ip nat translation&lt;/code&gt;, I can clear and change them fast enough to avoid the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Paste into notepad and use replace or some other method to aid in bulk updates.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-19T01:45:53.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33223" PostTypeId="2" ParentId="30562" CreationDate="2016-07-19T01:55:37.420" Score="2" Body="&lt;p&gt;&lt;strong&gt;show interface history&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To display histograms of interface utilization, use the showinterfacehistory command in privileged EXEC mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show interface [ type number ] history [ all | 60sec | 60min | 72hour ] [ both | input | output ]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Syntax Description&lt;/p&gt;&#xA;&#xA;&lt;p&gt;type&#xA;(Optional) Interface type.&#xA;number&#xA;(Optional) Port number of the interface.&#xA;all&#xA;(Optional) Specifies the histograms representing the last 60 seconds, the last 60 minutes, and the last 72 hours of interface utilization.&#xA;60sec&#xA;(Optional) Specifies the histograms representing the last 60 seconds of interface utilization.&#xA;60min&#xA;(Optional) Specifies the histograms representing the last 60 minutes of interface utilization.&#xA;72hour&#xA;(Optional) Specifies the histograms representing the last 72 hours of interface utilization.&#xA;both&#xA;(Optional) Specifies both the input histograms and the output histograms.&#xA;input&#xA;(Optional) Specifies the input histograms.&#xA;output&#xA;(Optional) Specifies the output histograms.&#xA;Command Modes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Privileged EXEC (#)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Command History&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Release&#xA;Modification&#xA;12.2(33)XNE&#xA;This command was introduced.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Usage Guidelines&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The showinterfacehistory command displays histograms of interface utilization. The y-axis represents the input or output rate in packets per second, kilobits per second, or megabits per second. Kilobits per second is used when the bandwidth of the interface is less than one gigabit per second. Megabits per second is used for more than one gigabit per second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The x-axis represents time in units of seconds, minutes or hours with the most current time at the left side of the histogram. There are three histograms available: the last 60 seconds, the last 60 minutes, and the last 72 hours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interface counters specified in the history(interface) command are displayed under the x-axis of each histogram. Each counter has a five-character identification as listed in the command. The identification is displayed at the beginning of each counter line. The number in the column indicates that the counter incremented by that amount during the specified interval. When the counter exceeds a single digit, the values are displayed vertically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following example shows the histogram output of interface history:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# show interface gigabitethernet 0/1 history 60min&#xA;&#xA;5689688755455324777665666876546&#xA;      10&#xA;       9    *&#xA;       8   ** **                  *&#xA;       7   *# ##*        ***      #*&#xA;       6  *######        ####* **###*  *&#xA;       5 ########## *#   ############* *&#xA;       4 #############  *#############**&#xA;       3 ############## ###############*&#xA;       2 ###############################&#xA;       1 ###############################&#xA;        0....5....1....1....2....2....3....3....4....4....5....5....6&#xA;                  0    5    0    5    0    5    0    5    0    5    0&#xA;         3333333333333333333333333333331&#xA;   Mlcst 556555555565555555555565535555700000000000000000000000000000&#xA;         22322111111     121221211211&#xA;         57149774766867 133175814422022&#xA;   iDrop 425727636924219265454496840996600000000000000000000000000000&#xA;         GigabitEthernet0/1 input rate(mbits/sec)  (last 60 minutes)&#xA;                 * = maximum   # = average&#xA;5677678656555434767665666866545&#xA;      10&#xA;       9&#xA;       8       *                  *&#xA;       7   ** *#         * *      *&#xA;       6  *#####* *      ##*** ***##*&#xA;       5 *#########***   #####*######* *&#xA;       4 #############* *#############**&#xA;       3 #############**###############*&#xA;       2 ###############################&#xA;       1 ###############################&#xA;        0....5....1....1....2....2....3....3....4....4....5....5....6&#xA;                  0    5    0    5    0    5    0    5    0    5    0&#xA;   Unkno 000000000000000000000000000000000000000000000000000000000000&#xA;   oDrop 000000000000000000000000000000000000000000000000000000000000&#xA;         GigabitEthernet0/1 output rate(mbits/sec)  (last 60 minutes)&#xA;                 * = maximum   # = average&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The input rate histogram shows that the input rate peaked at 9 Mbps and 4 minutes prior to the command execution. During that one-minute interval, there were 35 input multicast packets and 247 input drops. The counter values in the histogram should be read vertically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The output rate histogram shows that the output rate reached 8 Mbps twice; once 7 minutes prior and the second time 26 minutes prior to the command execution. There were no unknown protocol drops and no output drops during the last 60 minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The table below describes the significant fields shown in the display.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Table 2 show interface history Field Descriptions&#xA;Field&#xA;Description&#xA;Mlcst&#xA;Ethernet input multicast.&#xA;iDrop&#xA;Input drops.&#xA;Unkno&#xA;Unknown protocol drops.&#xA;oDrop&#xA;Output drops.&#xA;Related Commands&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Command&#xA;Description&#xA;history (interface)&#xA;Enables an interface to maintain utilization history.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-19T01:55:37.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33224" PostTypeId="2" ParentId="33189" CreationDate="2016-07-19T04:31:42.863" Score="2" Body="&lt;p&gt;Your firewall is telling you it detected a bogus TCP packet.  The reason it reports these is because they might be used by bad guys to try and set up a covert channel.  In this specific case the TCP fault is the use of URG (this is seldom used in TCP in practice, but is sent to tell the receiving TCP to urgently skip ahead to some point), but the point it's being told to skip ahead to is not actually in the subject packet.&lt;/p&gt;&#xA;" OwnerUserId="6388" LastActivityDate="2016-07-19T04:31:42.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33225" PostTypeId="2" ParentId="7935" CreationDate="2016-07-19T05:34:31.907" Score="2" Body="&lt;p&gt;I've seen something similar when there have been duplicate IP addresses in the network.  Check the ARP cache on your PC (if you're on the same network) or router and see if the MAC address changes during the problem.  If it does, track the two MAC addresses down through the switch MAC address tables and configure unique IP addresses&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-07-19T07:18:16.073" LastActivityDate="2016-07-19T07:18:16.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33226" PostTypeId="1" AcceptedAnswerId="33247" CreationDate="2016-07-19T07:33:11.580" Score="0" ViewCount="158" Body="&lt;p&gt;I am a developer and I am trying to setup a network for 10 servers. Based on the following link: &lt;a href=&quot;https://askleo.com/whats_the_difference_between_a_hub_a_switch_and_a_router/&quot; rel=&quot;nofollow&quot;&gt;https://askleo.com/whats_the_difference_between_a_hub_a_switch_and_a_router/&lt;/a&gt;, I understand the following points:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Routers have DHCP function to issue IP address to the servers connected.&lt;/li&gt;&#xA;&lt;li&gt;Switch does not have DHCP function and servers connected to the switch should be assigned with static IP address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In this case, should I buy a router or switch to setup my network? Why/what should I buy to setup my network?&lt;/p&gt;&#xA;" OwnerUserId="27964" LastActivityDate="2016-07-19T22:51:38.517" Title="Switch vs Router in development environment setup" Tags="|switch|router|" AnswerCount="5" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33227" PostTypeId="1" CreationDate="2016-07-19T07:35:21.267" Score="1" ViewCount="171" Body="&lt;p&gt;I have an issue about OSPF. When I try to use &quot;Show ip ospf neighbor&quot; I can not find which router is the DR router or BDR router it always show &quot;Full/-&quot;&#xA;Here is my set up&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/E4Tlq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/E4Tlq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Can someone help me,&#xA;Thank you&lt;/p&gt;&#xA;" OwnerUserId="27963" LastEditorUserId="509" LastEditDate="2016-07-19T08:35:15.447" LastActivityDate="2016-07-19T14:08:54.503" Title="OSPF DR/BDR question" Tags="|cisco|ospf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33229" PostTypeId="2" ParentId="33227" CreationDate="2016-07-19T08:11:12.553" Score="3" Body="&lt;p&gt;It looks like you are using serial interfaces which use OSPF point-to-point network types as there can only be two devices on a serial link.  DRs are only used on multi-access networks to reduce the number of adjacencies.  They are not used on point-to-point networks, so both routers should be fully adjacent with each other .&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-07-19T14:08:54.503" LastActivityDate="2016-07-19T14:08:54.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33230" PostTypeId="2" ParentId="33226" CreationDate="2016-07-19T08:39:14.883" Score="0" Body="&lt;p&gt;If your servers don't need Internet and you will only connect from server to server a switch should be fine, if all your server are in the same subnet eg 192.168.1.0/24.&lt;/p&gt;&#xA;" OwnerUserId="22401" LastActivityDate="2016-07-19T08:39:14.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33231" PostTypeId="2" ParentId="33226" CreationDate="2016-07-19T08:44:50.103" Score="1" Body="&lt;p&gt;The main difference between a switch and a router, which the article fails to mention, is that switches forward at layer 2 and routers at layer 3.  When an Ethernet frame arrives at a switch it uses the destination MAC address to make it's forwarding decision.  A router uses the packet's destination IP address for forwarding.  A switch's forwarding table consists of MAC addresses and outgoing interfaces.  A router's forwarding table consists of IP subsets with next-hop IP addresses and outgoing interfaces.  Switches essentially forward traffic within a subnet, so if a device has an IP address of 192.168.1.5/24 and another device has 192.168.1.10/24 a switch can forward traffic between the two.  If the device wants to talk to a device on another subnet (i.e. 192.168.2.5/24) a router would be required.  To further complicate things L3 switches are available which can forward at L3.  Switches make forwarding decisions at line-rate using specialist ASICs, whereas routers generally use a CPU for forwarding, so they can have variable throughout depending on the current load.  L3 switches forward L3 at line-rate as the logic is implemented in ASICs.  L3 switch usually have a limited feature set compared to a full blown router as they require ASICs for each function.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-07-19T08:44:50.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33233" PostTypeId="2" ParentId="32665" CreationDate="2016-07-19T09:13:22.007" Score="1" Body="&lt;p&gt;The solution is to have one route-map directly on the BGP network route. This is &lt;a href=&quot;http://www.nongnu.org/quagga/docs/quagga.html#BGP-network&quot; rel=&quot;nofollow&quot;&gt;not documented in Quagga docs&lt;/a&gt; (July 2016) but works.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network 10.100.0.1/32 route-map localpref150&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Complete configuration becomes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 65002&#xA;    bgp router-id 10.0.0.1&#xA;    bgp confederation identifier 42xxx&#xA;    bgp confederation peers 65001 65002&#xA;&#xA;    network 10.100.0.1/32 route-map localpref150&#xA;    network 10.100.0.2/32&#xA;&#xA;    neighbor 10.0.0.10 remote-as 65001&#xA;    neighbor 10.0.0.10 route-map only-local-ASes out&#xA;!&#xA;ip as-path access-list only-local-ASes permit ^$&#xA;!&#xA;route-map only-local-ASes permit 10&#xA;match as-path only-local-ASes&#xA;!&#xA;route-map localpref150 permit 10&#xA;set local-preference 150&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27522" LastActivityDate="2016-07-19T09:13:22.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33234" PostTypeId="1" AcceptedAnswerId="33236" CreationDate="2016-07-19T09:50:40.210" Score="1" ViewCount="4375" Body="&lt;p&gt;I've got a few network switches running rather hot. The switches have an average internal temperature of 63°C. I'm aware that this is too hot for a network switches and we are pushing upper management for air con. My question is this, what temperature would you expect to see a switch running at whilst running under load? What would you argue is best practice when it comes to internal switch temperatures? If it helps the switch models are Dell N4032. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks! &lt;/p&gt;&#xA;" OwnerDisplayName="user23673" LastActivityDate="2016-07-19T10:17:41.333" Title="Switch Temperature - How hot it too hot!" Tags="|switch|dell|best-practices|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33236" PostTypeId="2" ParentId="33234" CreationDate="2016-07-19T10:17:41.333" Score="2" Body="&lt;p&gt;It depends on your device, if temperature is high, fans will spin faster and you reduce timelife of your switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think 63°C is slightly high but I have switches working at this temperature (or greater) with no problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need a number, according N4000 manual, front led is triggered when &quot;The thermal sensor’s system temperature threshold of 75°C has been exceeded.&quot; So, you are reaching limit but you still have a security margin.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2016-07-19T10:17:41.333" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33240" PostTypeId="1" AcceptedAnswerId="33307" CreationDate="2016-07-19T11:44:51.310" Score="2" ViewCount="14308" Body="&lt;p&gt;How to debug IP Sec VPN on ASA using SSH?&#xA;I try  &lt;code&gt;debug crypto ipsec&lt;/code&gt; &lt;code&gt;terminal monitor&lt;/code&gt; &lt;code&gt;logging monitor&lt;/code&gt; it asks for completion if i choose debug, all debug info are flooded. How do i view just IPSEC debugs via SSH?&lt;/p&gt;&#xA;" OwnerUserId="27132" LastActivityDate="2016-07-21T03:52:23.707" Title="debug crypto ipsec via ssh" Tags="|cisco-asa|ipsec|ssh|logging|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33241" PostTypeId="2" ParentId="33194" CreationDate="2016-07-19T11:47:21.093" Score="1" Body="&lt;p&gt;R3 does not have a route to 10.0.0.0/8 (pink) via 192.168.88.1.&lt;/p&gt;&#xA;" OwnerUserId="23560" LastActivityDate="2016-07-19T11:47:21.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33242" PostTypeId="1" CreationDate="2016-07-19T12:13:50.593" Score="1" ViewCount="1119" Body="&lt;p&gt;Implementing hosted VoIP with connection of desk handset to Apple Macs. Gbit to desktop Cat5, Aruba 2920 PoE J9836 Layer 3 Switch. Line will be separate 10Mb, separate router too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt; How can the Aruba manage the IP traffic of the Mac and the separate IP of the phone? On one port and one cable? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answers or links to articles greatly appreciated.&#xA;Thanks,&#xA;Simon.&lt;/p&gt;&#xA;" OwnerUserId="27973" LastActivityDate="2016-07-19T15:34:58.117" Title="how to run multiple IP addresses to be allocated off a single Ethernet port. VoIP" Tags="|switch|voip|ip-address|aruba|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33244" PostTypeId="2" ParentId="33242" CreationDate="2016-07-19T12:54:56.687" Score="2" Body="&lt;p&gt;One way to achieve this is to use a tagged VLAN for the phone traffic and a different untagged VLAN for the Mac/PC traffic.  The phone is either manually configured with the VLAN tag for its traffic, or it can learn it through LLDP-MED.  The phone passes the untagged traffic through to the Mac/PC untouched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If 10.1.10.0/24 is the Mac/PC network and 10.1.20.0/24 is the voice network then the config sets up interface 1 for a phone and Mac:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan 10 &lt;br&gt;&#xA;name Macs &lt;br&gt; &#xA;ip address 10.1.10.1 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan 20 &lt;br&gt;&#xA;voice &lt;br&gt;&#xA;name Voice &lt;br&gt;&#xA;ip address 10.1.20.1 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;interface 1 &lt;br&gt;&#xA;untagged vlan 10 &lt;br&gt;&#xA;tagged vlan 20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;voice&quot; option under VLAN 20 allows the switch to signal the voice VLAN to the phone using LLDP-MED&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-07-19T13:00:05.630" LastActivityDate="2016-07-19T13:00:05.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33245" PostTypeId="2" ParentId="33226" CreationDate="2016-07-19T13:30:44.537" Score="1" Body="&lt;p&gt;As a brief side note, Layer 3 switches can function similar to a router and provide DHCP pools same as a router would. Layer 2 switches which I am assuming is what the article is referring to based on what I read, does not have any routing capabilities. The big key difference is what 'qualeboy' stated in his response, ASICS is not available in routers making the forwarding decisions based on next hop IP addresses and other forwarding decisions using CPU interrupts. Of course with CEF involved that helps out with most of it's forwarding decisions but that is a whole different topic. Layer 3 switches will be able to FORWARD the data at wire speed and use routing capabilities, but because of the lack of CPU available it will only have limited features as a quote-on-quote router.&lt;/p&gt;&#xA;" OwnerUserId="27976" LastActivityDate="2016-07-19T13:30:44.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33247" PostTypeId="2" ParentId="33226" CreationDate="2016-07-19T14:24:12.627" Score="3" Body="&lt;p&gt;The first thing you need to understand is that there are two very different classes of device reffered to by the name &quot;router&quot;. They share in common that they forward at the IP layer but the similarity largely ends there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off are the devices used by homes and small buisnesses to connect their networks to the internet. These typically connect two networks, reffered to as the &quot;LAN side&quot; and the &quot;WAN side&quot;. On the WAN side there is typically a single port which may be Ethernet or it may be a port designed for a specific type of internet connection (DSL, CABLE, GPON etc). On the LAN side there is typically a built-in switch to provide multiple ports and a built-in wireless access point to provide wireless access. In addtion to the two-port router fuctionality these devices typically provide network address translation, basic firewalling and a DHCP server. Routing functionality on such devices is typically very minimal, if you are lucky they might support static routes, if you are unlucky all they will be able to do is the routing needed in the specific scenario they were designed for. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there are the devices used for routing in large networks. The main function of these devices is to route between many IP networks. Typically routing protols will be used to distribute routes and one of the key features of such a router is how large a routing table it can handle. Such routers may or may not have features beyond that such as firewalling, network address translation or the ability to bridge multiple ports onto the same L2 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then to further complicate things there are &quot;L3 switches&quot;. These are switches but that also have some IP routing functionality. Usually they do not support NAT.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In this case, should I buy a router or switch to setup my network? Why/what should I buy to setup my network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You don't give many details about what you need out of this network, so lets make some assumptions.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The servers need to be able to communicate with each other.&lt;/li&gt;&#xA;&lt;li&gt;The servers need to be able to make outgoing connections to the Internet.&lt;/li&gt;&#xA;&lt;li&gt;Incoming connections should be very restricted if allowed at all.&lt;/li&gt;&#xA;&lt;li&gt;You have a single Ethernet port and IP address (which may or may not be behind NAT) on an existing network which you intend to use to provide internet access to your dev network.&lt;/li&gt;&#xA;&lt;li&gt;It's a dev network, cost is more important than reliability.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Whatever you do I think you need to buy a switch, most home/small buisness routers only have four ports on the LAN side which is not enough for your 10 servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For servers static IP addressing is generally the way to go so you don't need to worrying about DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For accessing the Internet I see two options.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Use a home/small buisness router to provide routing/NAT/firewalling between your new network and the existing network. If you do this make sure the router you buy uses an Ethernet port on the WAN side.&lt;/li&gt;&#xA;&lt;li&gt;Have one of your servers connected to both your new network and the existing network and have it provide routing/NAT/firewalling.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The second option is more flexible and saves you buying a home/small buisness router but it requires you to know what you are doing with setting up those features on your server OS of choice whereas the home/small buisness router will work out of the box. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-07-19T22:40:36.267" LastActivityDate="2016-07-19T22:40:36.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33248" PostTypeId="1" AcceptedAnswerId="33250" CreationDate="2016-07-19T15:14:40.033" Score="1" ViewCount="48" Body="&lt;p&gt;I'm rather new to networking, so I have a question about setting up IP addresses with their subnets. The IP addresses I am working with are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.135.1 255.255.255.0 - host&lt;/p&gt;&#xA;&#xA;&lt;p&gt;208.184.124.50 255.255.255.252 - router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.42.2 255.255.255.0 - backup router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These IPs are all connected to different ports on my ASA5505. want to know if these addresses would have trouble communicating with each other. I am inclined to think the answer is yes because the second subnet is different from the rest, but I am not sure. Any thoughts/feedback on this would be awesome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="27856" LastEditorUserId="8499" LastEditDate="2018-03-10T04:29:03.787" LastActivityDate="2018-03-10T04:29:03.787" Title="IP address agreement" Tags="|ipv4|ip|subnet|ip-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33250" PostTypeId="2" ParentId="33248" CreationDate="2016-07-19T15:21:36.123" Score="2" Body="&lt;p&gt;You don't mention how the subnets are connected, but if you have a router(s) connecting the subnets, then any subnet should be able to communicate with any other (assuming nothing peculiar is going on).  There is nothing special about IP addresses that make them &quot;troublesome.&quot;  The fact that some subnets are &quot;numerically similar&quot; to others makes no difference to the router.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-19T15:21:36.123" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33251" PostTypeId="2" ParentId="33242" CreationDate="2016-07-19T15:34:58.117" Score="0" Body="&lt;p&gt;If the MAC sits between the phone and the rest of the network, then your MAC has to act like a switch and forward traffic to the phone.  I've never seen software to do that (but then again, I've never really looked either).  You want to be able to prioritize traffic based on QoS markings, so your voice quality doesn't suffer if you do something CPU or network intensive while talking on the phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are going to use separate subnets, then you also need to MAC to understand 802.1q VLAN tagging, and forward VLAN traffic to the right device.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-19T15:34:58.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33253" PostTypeId="1" AcceptedAnswerId="33254" CreationDate="2016-07-19T15:54:14.040" Score="1" ViewCount="75" Body="&lt;p&gt;let's consider a host with a public IP address. The host sends an IP packet with Destination Address set to its own address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the packet physically sent over a link or is it only sent within the host just like it was sent to localhost address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="17087" LastActivityDate="2016-07-19T16:33:03.917" Title="Host sending packet to its own address (non localhost)" Tags="|ip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33254" PostTypeId="2" ParentId="33253" CreationDate="2016-07-19T16:10:00.260" Score="2" Body="&lt;p&gt;If you send to a local interface the traffic will remain local to the host, as if you sent to the loopback, it will not exit the host and route back in.  On a Mac, the routing table shows lo0 as the outgoing interface.  &lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-07-19T16:33:03.917" LastActivityDate="2016-07-19T16:33:03.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33255" PostTypeId="1" AcceptedAnswerId="33267" CreationDate="2016-07-19T19:06:50.970" Score="1" ViewCount="2245" Body="&lt;p&gt;If a Wi-Fi device is design so there will only ever be one on a network, is there any issue with randomly assigning the MAC address from a small pool? Globally there will be duplicates, but never locally. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems either a CID could be used as a prefix or a MA-S small block could be used to prevent conflicts with other devices on the network.&lt;/p&gt;&#xA;" OwnerUserId="27981" LastActivityDate="2017-01-17T17:41:21.917" Title="Is there any issue with a vendor reusing MAC addresses?" Tags="|mac-address|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33256" PostTypeId="1" CreationDate="2016-07-19T19:15:39.020" Score="2" ViewCount="176" Body="&lt;p&gt;Depending on the time, when I open a website and do a traceroute, I notice that website goes to a different path than the usual, and some websites just never open. Why the same network alternate between two very different paths (different ISP/countries) for the same website?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it traffic on one path so it switched to another even if it wasn't reliable?&lt;/p&gt;&#xA;" OwnerUserId="27987" LastEditorUserId="20757" LastEditDate="2016-12-18T18:40:43.593" LastActivityDate="2016-12-18T18:40:43.593" Title="Why do the same websites get routed in two widely different paths?" Tags="|routing|traceroute|packet-path|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33258" PostTypeId="2" ParentId="33256" CreationDate="2016-07-19T19:44:10.187" Score="0" Body="&lt;p&gt;Traceroute can be a useful tool on your network, where you can compare the results to what is expected. On the public Internet, it can give you a completely different path than what actual data may take. Your traffic may pass through multiple ISPs, any or all of which can look for and redirect ICMP and traceroute in order to disguise their internal networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your traceroute may be purposely routed over a backup or other path. It is also possible that there is some load balancing or instability happening with one ISP. You simply cannot know, and your actual web traffic may take a much better path than what you are seeing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-19T19:50:42.363" LastActivityDate="2016-07-19T19:50:42.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33259" PostTypeId="1" CreationDate="2016-07-19T20:21:25.850" Score="0" ViewCount="3393" Body="&lt;p&gt;I need to combine 3 switches in to 1 terminal so i dont have to keep switching my console cable to each switch, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so its something called telnet., there is also something about making a &quot;management vlan&quot; so im supposed this is the vlan ip address i telnet onto.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure how to do this, if someone can explain and show me step by step id extremely appreciate that, thanks.&lt;/p&gt;&#xA;" OwnerUserId="27334" LastActivityDate="2016-07-20T05:12:56.897" Title="Step by Step to get on to Telnet ? Management?" Tags="|vlan|ssh|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33260" PostTypeId="2" ParentId="32319" CreationDate="2016-07-19T21:18:46.017" Score="1" Body="&lt;p&gt;I don't know if you've already done this, but you have to go a step further than just creating the Auth profile. You have to apply that auth profile with an auth policy. To create the auth policy do the following.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Go to Policy / Authorization&#xA;Edit – profiles –standard, select your auth profile &#xA;click Done&#xA;click Save&lt;/p&gt;&#xA;" OwnerUserId="27990" LastEditorUserId="27990" LastEditDate="2016-07-19T21:53:47.970" LastActivityDate="2016-07-19T21:53:47.970" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33261" PostTypeId="2" ParentId="28947" CreationDate="2016-07-19T21:24:58.613" Score="1" Body="&lt;p&gt;A duplicate ip on the network can cause this behavior. If you have 2 machines with different MACs competing for the same IP, ARP will sometime resolve to one MAC and sometimes resolve to the other MAC. The result is unpredictable and incorrect arp resolution.&lt;/p&gt;&#xA;" OwnerUserId="27990" LastEditorUserId="27990" LastEditDate="2016-07-19T21:55:51.500" LastActivityDate="2016-07-19T21:55:51.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33263" PostTypeId="2" ParentId="28032" CreationDate="2016-07-19T21:50:55.767" Score="2" Body="&lt;p&gt;I could be wrong here, but it looks to me like both switches have the same subnets defined. If I'm DUAL I'm going to remove a route I learn from you if I already have that subnet locally connected. &lt;/p&gt;&#xA;" OwnerUserId="27990" LastActivityDate="2016-07-19T21:50:55.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33265" PostTypeId="2" ParentId="33226" CreationDate="2016-07-19T22:51:38.517" Score="1" Body="&lt;p&gt;You definitely need a switch.  Routers generally don't have enough ports, while even inexpensive switches have 12-24 ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your network doesn't connect to anything else, that's all you need.  but if you also want Internet access, or you need to connect to another network, then you also need a router.  If you're connecting to the Internet, hen you also need a firewall, but some routers include this functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all you have is a switch, but you still need DHCP, you can run a DHCP server (daemon) on one of your servers.  That's actually more common than using a router.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-19T22:51:38.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33266" PostTypeId="2" ParentId="33217" CreationDate="2016-07-19T23:38:34.930" Score="1" Body="&lt;p&gt;There are lots of opportunities for things to get delayed both within the client and server machines and in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How much things actually get delayed will depend heavilly on system load. If load is light then delays are likely to be negligable. On the other hand if some resource (client CPU, server CPU, server storage, network bandwidth, server maxclients etc) is saturated then the delays may be much larger and more variable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might want to redesign your client application so that instead of sending a request every 3 seconds it sends a request 3 seconds after the last request completed. This will help avoid piling additional load onto an already overloaded server. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-07-19T23:38:34.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33267" PostTypeId="2" ParentId="33255" CreationDate="2016-07-20T02:20:50.433" Score="2" Body="&lt;p&gt;I think the below link answers your question nicely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.howtogeek.com/228286/how-is-the-uniqueness-of-mac-addresses-enforced/&quot; rel=&quot;nofollow&quot;&gt;http://www.howtogeek.com/228286/how-is-the-uniqueness-of-mac-addresses-enforced/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Question&#xA;SuperUser reader JellicleCat wants to know how the uniqueness of MAC addresses is enforced:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again and again I have read that devices are uniquely identified by their MAC addresses, but how are MAC addresses determined? And do they tell us anything about the devices they represent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is the uniqueness of MAC addresses enforced?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Answer&#xA;SuperUser contributor DavidPostill has the answer for us:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How are MAC Addresses Determined?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vendors are given a range of MAC Addresses that can be assigned to their products by the IEEE (Institute of Electrical and Electronics Engineers). MAC Address are assigned to Vendors in various sized blocks as appropriate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IEEE offers Registration Authority programs or registries which maintain lists of unique identifiers under standards and issue unique identifiers to those wishing to register them. The IEEE Registration Authority assigns unambiguous names to objects in a way which makes the assignment available to interested parties.&#xA;You can go to Vendor/Ethernet/Bluetooth MAC Address Lookup and Search to find the vendor given a particular MAC Address or find a MAC Address Range given to a vendor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices are Uniquely Identified by Their MAC Addresses&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is incorrect. Devices are not uniquely identified by their MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past vendors have intentionally or by mistake assigned the same MAC Address to multiple devices.&#xA;It is possible to change the MAC Address presented by most hardware to the OS, an action often referred to as MAC spoofing:&#xA;MAC spoofing is a technique for changing a factory-assigned Media Access Control (MAC) Address of a network interface on a networked device. The MAC Address is hard-coded on a network interface controller (NIC) and cannot be changed. However, there are tools which can make an operating system believe that the NIC has the MAC Address of a user’s choosing.&#xA;See Also: Are MAC Addresses Unique When Coming Out of the Factory? and MAC Address Recycling?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Duplicate MAC Addresses&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Manufacturers re-use MAC Addresses and they ship cards with duplicate addresses to different parts of the United States or the world so that there is only a very small chance two computers with network cards with the same MAC Address will end up on the same network.&#xA;MAC Addresses are ‘burned’ into the Network Interface Card (NIC) and cannot be changed. See ARP and RARP on how IP addresses are translated into MAC Addresses and vice versa.&#xA;In order for a network device to be able to communicate, the MAC Address it is using must be unique. No other device on that local network subnet can use that MAC Address. If two devices have the same MAC Address (which occurs more often than network administrators would like), neither computer can communicate properly. On an Ethernet LAN, this will cause a high number of collisions. Duplicate MAC Addresses on the same LAN are a problem. Duplicate MAC Addresses separated by one or more routers is not a problem since the two devices won’t see each other and will use the router to communicate.&#xA;Source: Media Access Control&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further Reading&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://standards.ieee.org/faqs/regauth.html&quot; rel=&quot;nofollow&quot;&gt;FAQs: The Registration Authority&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23968" LastEditorUserId="23968" LastEditDate="2016-07-21T15:10:09.330" LastActivityDate="2016-07-21T15:10:09.330" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33268" PostTypeId="2" ParentId="33259" CreationDate="2016-07-20T02:35:22.433" Score="0" Body="&lt;pre&gt;&lt;code&gt;switch&amp;gt; en&#xA;switch# conf t&#xA;switch(config)# username cisco priv 15 password cisco&#xA;switch(config)# int vlan 1&#xA;switch(config-if)# ip addr 192.168.0.200 255.255.255.0&#xA;switch(config-if)# no shut&#xA;switch(config-if)# line vty 0 4&#xA;switch(config-line)# login local&#xA;switch(config-line)# end&#xA;switch()# wr mem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This configures a user to login with, creates a vlan interface to connect to, and then allows telnet to one of the virtual lines (vty). Ignore the management vlan for now, vlan 1 works fine. Plug your ethernet cable into the switch and telnet to 192.168.0.200.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have any questions, everyone here is happy to help, but you should be able to find this stuff in numerous docs online.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-110/45843-configpasswords.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-110/45843-configpasswords.html&lt;/a&gt;&#xA;and&#xA;&lt;a href=&quot;https://supportforums.cisco.com/document/19756/configuring-telnet-console-and-aux-port-passwords&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/document/19756/configuring-telnet-console-and-aux-port-passwords&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23968" LastActivityDate="2016-07-20T02:35:22.433" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33269" PostTypeId="2" ParentId="33259" CreationDate="2016-07-20T02:42:51.420" Score="1" Body="&lt;p&gt;You can use the steps described upside.&#xA;Only some explanation&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#configure terminal&#xA;&#xA;router(config)#username user1 password pass1&#xA;router(config)#username user2 password pass2&#xA;router(config)#line vty 0 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;! Whe you put login local i to line vty 0 4&#xA;! You are refering to all the local users&#xA;! Those that you are declared like !username&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config-line)#login local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-07-20T02:42:51.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33271" PostTypeId="2" ParentId="30458" CreationDate="2016-07-20T04:59:07.203" Score="0" Body="&lt;p&gt;DHCP Snooping is what you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://h20565.www2.hpe.com/hpsc/doc/public/display?sp4ts.oid=50982&amp;amp;docLocale=en_US&amp;amp;docId=emr_na-c02694321&quot; rel=&quot;nofollow noreferrer&quot;&gt;HP ProCurve LAN products software feature matrix&lt;/a&gt; indicates your HP 2510 switch doesn't support it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KdEBT.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KdEBT.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-20T04:59:07.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33272" PostTypeId="2" ParentId="33259" CreationDate="2016-07-20T05:05:18.297" Score="1" Body="&lt;p&gt;Console access into several networking devices is provided via a Terminal Server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/dial-access/asynchronous-connections/200462-Terminal-server-configuration-using-Menu.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configure Terminal Server through Menu Options&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Router configured as Terminal Server with an Async module like HWIC-8A, called octopus cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://static1.squarespace.com/static/52032716e4b0acbade3e044d/t/52897e4de4b0020f1bc902f9/1384742510806/MyLab.JPG&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://static1.squarespace.com/static/52032716e4b0acbade3e044d/t/52897e4de4b0020f1bc902f9/1384742510806/MyLab.JPG&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2017-03-10T09:42:47.153" LastActivityDate="2016-07-20T05:12:56.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33273" PostTypeId="1" CreationDate="2016-07-20T05:12:21.680" Score="3" ViewCount="4567" Body="&lt;p&gt;I am setting up a simulated Cisco Packet Tracer with three &lt;code&gt;Cisco Catalyst 2960&lt;/code&gt; switches &lt;strong&gt;S1&lt;/strong&gt;, &lt;strong&gt;S2&lt;/strong&gt; and &lt;strong&gt;S3&lt;/strong&gt;. &lt;strong&gt;S1&lt;/strong&gt; being the trunk for &lt;strong&gt;S2&lt;/strong&gt; and &lt;strong&gt;S3&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have three(3) interfaces &lt;code&gt;F0/6&lt;/code&gt;, &lt;code&gt;F0/11&lt;/code&gt;, &lt;code&gt;F0/18&lt;/code&gt; that are connected to my switches from three(3) PCs. I could ping from say PC1 to PC4 and and as well as PC3 to PC6 on same VLAN. However, PC2 to PC5 I could not ping and I found out that the interface &lt;code&gt;F0/18&lt;/code&gt; &lt;strong&gt;Operational Mode&lt;/strong&gt; is down but the working one is not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first two F0/11 and F0/6 are connected to PC1, P3, PC4 and PC6 which are all working and have the following information using &lt;code&gt;show interface &amp;lt;interface id&amp;gt; switchport&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name: Fa0/18&#xA;Switchport: Enabled&#xA;Administrative Mode: static access&#xA;Operational Mode: static access&#xA;Administrative Trunking Encapsulation: dot1q&#xA;Operational Trunking Encapsulation: native&#xA;Negotiation of Trunking: Off&#xA;Access Mode VLAN: 20 (Students)&#xA;Trunking Native Mode VLAN: 1 (Default)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the first two again are working. However, &lt;code&gt;F0/18&lt;/code&gt; is not with the following information.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name: Fa0/11&#xA;Switchport: Enabled&#xA;Administrative Mode: static access&#xA;Operational Mode: down&#xA;Administrative Trunking Encapsulation: dot1q&#xA;Operational Trunking Encapsulation: native&#xA;Negotiation of Trunking: Off&#xA;Access Mode VLAN: 10 (Faculty/Staff)&#xA;Trunking Native Mode VLAN: 1 (default)&#xA;.....&amp;lt;output omitted&amp;gt;&#xA;Appliance trust: none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The only difference I see is that the working ones has &lt;strong&gt;Appliance Trust: none&lt;/strong&gt; but the non-working one has none.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also this is an example running-configuration for S2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1248 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname S2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport access vlan 30&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA; switchport access vlan 20&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport trunk native vlan 99&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan1&#xA;no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA;login&#xA;line vty 5 15&#xA;login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What could have gone wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am just a newbie on this one, so please bear with me.&lt;/p&gt;&#xA;" OwnerUserId="27993" LastEditorUserId="27993" LastEditDate="2016-07-20T05:34:47.590" LastActivityDate="2020-01-06T13:44:18.153" Title="Operational mode is down for one link" Tags="|vlan|cisco-catalyst|trunk|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33274" PostTypeId="2" ParentId="28698" CreationDate="2016-07-20T05:20:02.993" Score="0" Body="&lt;p&gt;Both switched and routed ports can be configured as SPAN sources and destinations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_55_se/configuration/guide/3560_scg/swspan.html#40636&quot; rel=&quot;nofollow&quot;&gt;SPAN and RSPAN Concepts and Terminology&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-20T05:20:02.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33275" PostTypeId="1" AcceptedAnswerId="33276" CreationDate="2016-07-20T06:25:29.757" Score="3" ViewCount="1569" Body="&lt;p&gt;We are trying to construct a wireless mesh network. We currently have single band routers that operate on 2.4GHz. We have also succeeded in meshing the two routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have chosen B.A.T.M.A.N Advanced layer 2 mesh protocol. Therefore for mesh devices we do not need IP address to communicate. Currently the router is flashed with OpenWRT and operates on two modes simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Adhoc mode (for mesh) forms the backbone network.&lt;/li&gt;&#xA;&lt;li&gt;AP mode (for allowing non-mesh devices to connect via layer 3) for client network.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;We know this setup with only single band router with single radio will be unusable over the long run since the same radio have to operate on both adhoc and AP mode at the same time causing interrupts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We were looking out for dual radio routers and found a lot of dual band routers, so that 2.4GHz can be used for client networking in AP mode and 5GHz band can be used for mesh backbone in Adhoc mode. Therefore two different channels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we are confused at the moment is, does the simultaneous dual band routers mean they have dual radio (or) they manage using single radio?&lt;/p&gt;&#xA;" OwnerUserId="18842" LastEditorUserId="18842" LastEditDate="2016-07-20T06:48:38.173" LastActivityDate="2016-07-22T08:40:32.890" Title="Does Simultaneous dual band routers mean they have dual radios for each band?" Tags="|wireless|ieee-802.11|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33276" PostTypeId="2" ParentId="33275" CreationDate="2016-07-20T06:40:27.190" Score="4" Body="&lt;p&gt;Yes, dual band routers mean they have dual radio and transmit on a 5 GHz band and a 2.4 GHz band. They operate on two different frequencies and contain at least two radios with accompanying antennas tuned individually to two different wireless frequency bands. One radio signal connects to the 2.4 GHz band, and the other connects to the 5 GHz band. The 2.4 GHz access point uses the 802.11b, 802.11g, and 802.11n frequency bands, while the 5 GHz access point uses the 802.11a frequency band. The primary purpose of dual band routers is to speed up wireless connections, and they do that by supplying separate network bandwidth for different devices.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-07-20T06:40:27.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33277" PostTypeId="1" AcceptedAnswerId="33281" CreationDate="2016-07-20T08:46:18.103" Score="0" ViewCount="928" Body="&lt;p&gt;On this &lt;a href=&quot;http://blog.lithiumblue.com/2007/07/understanding-relationship-between-sip.html&quot; rel=&quot;nofollow&quot;&gt;website&lt;/a&gt;, it says that&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;This shows the source and destination IP addresses of the SIP packet. Note this information will change as the packet passes between&#xA;  SIP proxy servers.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm confused as to why this is so. I'm guessing the IP addresses are replaced by the current and next proxy server's IP addresses from hop-to-hop. Why is there a need to change the SIP packet's IP addresses as it gets forwarded from one end-point to another? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is it not treated as a typical packet where the source and destination IP addresses remain the same, but the routers are the ones doing the routing based on the destination IP address?&lt;/p&gt;&#xA;" OwnerUserId="8424" LastActivityDate="2016-07-20T13:06:58.947" Title="IP Addresses of SIP packets" Tags="|ip|sip|proxy|" AnswerCount="2" CommentCount="1" ClosedDate="2016-07-20T14:59:44.500" ContentLicense="CC BY-SA 3.0" />
  <row Id="33278" PostTypeId="1" AcceptedAnswerId="33311" CreationDate="2016-07-20T08:51:21.410" Score="1" ViewCount="813" Body="&lt;p&gt;I have 3 WAN connections and a remote site with a single WAN address.&#xA;What I'd like to do is monitor the latency towards the remote site using a single machine (Opsview) on our LAN but through all 3 WAN links.&#xA;I know I can tag the packets using DSCP but I wasnt able to determine if it's possible to route the traffic via the Fortigate unit accordingly.&lt;/p&gt;&#xA;" OwnerUserId="27966" LastActivityDate="2016-07-21T05:10:53.217" Title="Fortigate - Routing DSCP tagged packets through different WAN connections" Tags="|routing|fortigate|fortinet|dscp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33279" PostTypeId="2" ParentId="33277" CreationDate="2016-07-20T10:59:06.437" Score="0" Body="&lt;p&gt;Unless there is &lt;strong&gt;NAT&lt;/strong&gt; in the &lt;em&gt;source-destination path&lt;/em&gt; there won't be a change of source or destination adddress in the fields marked as &lt;strong&gt;1&lt;/strong&gt; in the wireshark trace shown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Proxy servers don't modify those fields, only NAT-enabled devices can modify source /destination addresses and ports.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2016-07-20T10:59:06.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33281" PostTypeId="2" ParentId="33277" CreationDate="2016-07-20T13:01:33.073" Score="1" Body="&lt;p&gt;You are correct, the IP addresses will be replaced by the sending and receiving SIP proxy server IP address for that leg of session, although this isn't NAT as they are actually separate IP/UDP sessions.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SIP packets aren't treated any differently by routers, and if a packet needs to be routed between networks it will be forwarded with the source and destination IPs unchanged. SIP proxy servers are not IP routers though.  SIP is just another application layer protocol transported over IP/UDP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a SIP proxy server makes a routing decision it is actually looking at the destination SIP address (5) and not the IP destination address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client opens a UDP session to the first SIP proxy using its IP address as the source and SIP proxy server's IP address as the destination.  The UDP payload is the SIP application layer traffic.  The proxy server makes a SIP routing decision (different to IP routing) and opens a UDP session to the next SIP server and forwards the SIP traffic within that session.  The IP and UDP layers for each leg are unique, but the SIP session end-to-end has the same SIP session ID and therefore is the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The proxy function becomes quite useful when making calls between organisations.  Without the proxy server each organisation would have to have full routing information for each other's address space to make an end-to-end connection.  There will likely be overlap so complicated NATs are required, which would also have to understand the SIP protocol to change any address at the application layer.  With SIP proxy servers sat on the edge of each organisation the internal address space can be hidden.  Clients only have to route to the SIP proxy server to reach any IP within that organisation.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-07-20T13:06:58.947" LastActivityDate="2016-07-20T13:06:58.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33282" PostTypeId="2" ParentId="32923" CreationDate="2016-07-20T14:02:11.540" Score="3" Body="&lt;p&gt;You certainly can do MANY:1 NAT -- that is: have several Public WAN IPs point to 1 internal LAN IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just create Address Objects for each WAN IP and put those &lt;strong&gt;Address Objects&lt;/strong&gt; into an &lt;strong&gt;Address Object Group&lt;/strong&gt;. Then create your NAT (and Firewall) rule using the Address Object GROUP. Inbound Internet traffic destined to any of the Public IPs in the Address Object Group will be NAT'd to the internal IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, for example, if you have 3 ISPs and one internal LAN looking something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;X0: LAN 192.168.1.1&#xA;X1: WAN1 123.56.78.89&#xA;X2: WAN2 65.32.98.2 thru .6&#xA;X3: WAN3 9.50.23.8 and .9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you want to use a Public IP from each ISP: select which IPs and create Address Objects for each (in my example the X1 WAN IP Object will be the only IP for that interface, for X2 and X3 you will need to create Objects for the IPs you want) such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;X1 WAN IP (something like this already exists)&#xA;X2 Public .5  (create this Object = 65.32.98.5)&#xA;X3 WAN IP  (something like this already exists for the .8 IP)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Put all of them into an Address Object Group called: &lt;em&gt;SERVER-16 Public IPs&lt;/em&gt;  (or whatever)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then create an inbound NAT rule that uses that Address Object Group for the Destination, like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Original Source: Any&#xA;Translated Source: Original&#xA;Original Destination: SERVER-16 Public IPs    (your GROUP)&#xA;Translated Destination: SERVER-16 Private IP  (IP of your server on the LAN 192.168.1.16)&#xA;Original Service: HTTP   (or whatever service)&#xA;Translated Service: Original&#xA;Inbound Interface: Any&#xA;Outbound Interface: X0   (the LAN interface)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You will need to create a similar &lt;strong&gt;Firewall rule&lt;/strong&gt; from WAN &gt; LAN using &lt;em&gt;SERVER-16 Public IPs&lt;/em&gt; as the Destination (since it is a NAT rule), the same Service, and Any as the Source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have done this on several SonicWALL devices and it works just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: You could probably set multiple 1:1 inbound NAT rules if you'd prefer, but that just gets messy with many WAN IPs, and when you want to make changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For OUTBOUND &lt;em&gt;return&lt;/em&gt; traffic the SonicWALL will send the data back using the original inbound interface (so if someone connects to the X3 IP it will come back to the user via X3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For OUTBOUND &lt;em&gt;original&lt;/em&gt; traffic -- meaning browsing from SERVER-16 for Updates NTP time updates, etc -- the outbound interface/IP will be determined by the Outbound NAT rules and likely the Load Balancing settings and routes.&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2016-07-20T14:02:11.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33285" PostTypeId="1" CreationDate="2016-07-20T16:45:58.563" Score="0" ViewCount="105" Body="&lt;p&gt;I am new to TCP and trying to wrap my head around it. I understand the basics, e.g. the three-way handshake to establish a connection, followed by application-to-application commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: When does the client indicate to the server which application it wants to communicate with. Let's say a server is listening on port 80 for HTTP connections, and I try to ftp into port 80. Is it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st) Client sends SYN request to server, which responds to with SYN-ACK. Client responds with SYN, connection established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2nd) Client sends &quot;retrieve &lt;a href=&quot;ftp://joe.com/file&quot; rel=&quot;nofollow&quot;&gt;ftp://joe.com/file&lt;/a&gt;&quot; command to server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3rd) Server says &quot;I dont have ftp server application, error.&quot; Connection terminated and error on client side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, is the desired application/protocol somehow communicated prior to the threeway handshake and the establishment of a connection?&lt;/p&gt;&#xA;" OwnerUserId="28005" LastActivityDate="2016-07-20T16:58:50.567" Title="Is application determined before or after TCP handshake?" Tags="|tcp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33286" PostTypeId="2" ParentId="33285" CreationDate="2016-07-20T16:58:50.567" Score="5" Body="&lt;p&gt;There isn't really any signalling of the requested application in TCP.  The application is implied by the destination port number.  A web server would open a listening TCP socket on port 80.  A client wishing to connect to the web server would open a connection to port 80 and then send HTTP commands.  If a misconfigured client connected to port 80 expecting an FTP server it would send FTP commands and these would get passed to the web server application the same, it would be up to the web server application to handle the error and to terminate the connection.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-07-20T16:58:50.567" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33290" PostTypeId="2" ParentId="28135" CreationDate="2016-07-20T18:49:03.037" Score="1" Body="&lt;p&gt;A considerable amount of work has been done on layer-2 routing. I don't know if you have already explored layer-2 mesh networking protocols like &lt;a href=&quot;https://www.open-mesh.org/projects/batman-adv/wiki/Wiki&quot; rel=&quot;nofollow&quot;&gt;B.A.T.M.A.N Advanced&lt;/a&gt;, &lt;a href=&quot;http://bmx6.net/projects/bmx6&quot; rel=&quot;nofollow&quot;&gt;BMX6&lt;/a&gt;, CJDNS (not really layer-2 but tries to redefine certain things at that layer). If not, do explore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also visit &lt;a href=&quot;http://battlemesh.org&quot; rel=&quot;nofollow&quot;&gt;battlemesh_dot_org&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="18842" LastEditorUserId="16930" LastEditDate="2016-07-21T13:39:42.217" LastActivityDate="2016-07-21T13:39:42.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33291" PostTypeId="1" AcceptedAnswerId="33293" CreationDate="2016-07-20T18:59:10.020" Score="4" ViewCount="3187" Body="&lt;p&gt;This one's got me banging my head against a wall... likely a simple answer, but I've tried everything I know.  I heard the internet's a smart place. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have an SG300-28MPP connected to a clients' Catalyst (unsure of model, but it's recent).  Have LAG1 (ports 11-12) set up to pass VLAN 75; works great.  Port 25 on the SG300 is configured as a trunk, with VLANs 72 and 73 tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client's switch is configured with 75 tagged on the LAG, 72 and 73 tagged on the single-link trunk.  No LACP on the LAG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something has changed on my end that causes port 25 to pass no traffic on either VLAN.  (Within the last 24 hours I've been resolving a multicast issue... can't figure out what I may have done there that would affect this.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Config appears below, with unrelated ports and security stuff removed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many thanks for any wisdom you can lend!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;config-file-header&#xA;switch0001&#xA;v1.4.1.3 / R800_NIK_1_4_194_194&#xA;CLI v1.0&#xA;set system mode router &#xA;&#xA;file SSD indicator encrypted&#xA;@&#xA;ssd-control-start &#xA;ssd config &#xA;ssd file passphrase control unrestricted &#xA;no ssd file integrity control &#xA;ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0 &#xA;!&#xA;bridge multicast filtering &#xA;vlan database&#xA;default-vlan vlan 71&#xA;exit&#xA;vlan database&#xA;vlan 1,61,72-75 &#xA;exit&#xA;voice vlan state disabled &#xA;voice vlan oui-table add 0001e3 Siemens_AG_phone________&#xA;voice vlan oui-table add 00036b Cisco_phone_____________&#xA;voice vlan oui-table add 00096e Avaya___________________&#xA;voice vlan oui-table add 000fe2 H3C_Aolynk______________&#xA;voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone&#xA;voice vlan oui-table add 00d01e Pingtel_phone___________&#xA;voice vlan oui-table add 00e075 Polycom/Veritel_phone___&#xA;voice vlan oui-table add 00e0bb 3Com_phone______________&#xA;bonjour interface range vlan 1&#xA;mac access-list extended &quot;Excess Traffic Filter&quot;&#xA;exit&#xA;hostname OR-AV-SW-1-2&#xA;no passwords complexity enable &#xA;username cisco password encrypted 3c0af1ccfaed6250e3fd6106e00561467fb746f3 privilege 15 &#xA;ip telnet server&#xA;!&#xA;interface vlan 1&#xA; no ip address dhcp &#xA;!&#xA;interface vlan 61&#xA; name BGM &#xA;!&#xA;interface vlan 71&#xA; ip address 192.168.1.3 255.255.255.0 &#xA;!&#xA;interface vlan 72&#xA; name Control &#xA; ip address 192.168.10.3 255.255.255.0 &#xA;!&#xA;interface vlan 73&#xA; name Audio &#xA; ip address 192.168.20.3 255.255.255.0 &#xA; bridge multicast mode ipv4-group &#xA; bridge multicast ipv6 mode ip-group &#xA; bridge multicast forward-all add gi27-28 &#xA; ip igmp query-interval 30 &#xA;!&#xA;interface vlan 74&#xA; name Video &#xA; ip address 192.168.30.3 255.255.255.0 &#xA; ip igmp query-interval 30 &#xA;!&#xA;interface vlan 75&#xA; name Presenter &#xA; ip address 192.168.40.3 255.255.255.0 &#xA;!&#xA;// ports 1-10 omitted &#xA;!&#xA;interface gigabitethernet11&#xA; description “WLAN A-1“&#xA; spanning-tree disable &#xA; channel-group 1 mode on &#xA; switchport mode general &#xA; switchport general pvid 4095 &#xA;!&#xA;interface gigabitethernet12&#xA; description “WLAN A-2“&#xA; spanning-tree disable &#xA; channel-group 1 mode on &#xA; switchport mode general &#xA; switchport general pvid 4095 &#xA;!&#xA;// ports 13-24 omitted&#xA;!&#xA;interface gigabitethernet25&#xA; description “WLAN B-C”&#xA; spanning-tree disable &#xA; switchport trunk allowed vlan add 72-73 &#xA;!&#xA;//ports 26-28 omitted&#xA;!&#xA;interface Port-channel1&#xA; description “WLAN A Uplink&quot;&#xA; spanning-tree disable &#xA; switchport mode general &#xA; switchport general allowed vlan add 75 tagged &#xA; switchport general pvid 4095 &#xA;!&#xA;exit&#xA;ip igmp snooping&#xA;ip igmp snooping vlan 73 &#xA;ip igmp snooping vlan 73 immediate-leave &#xA;ip igmp snooping vlan 74 &#xA;ip igmp snooping vlan 74 immediate-leave &#xA;ip igmp snooping vlan 73 static 224.0.0.251 interface gi1,gi3,gi5,gi9,gi25,gi27-28 &#xA;ip igmp snooping vlan 73 static 224.0.1.129 interface gi1,gi3,gi5,gi9,gi25,gi27-28 &#xA;ip igmp snooping vlan 73 static 239.255.255.250 interface gi1,gi3,gi5,gi9,gi25,gi27-28 &#xA;ip igmp snooping vlan 73 static 239.255.255.255 interface gi1,gi3,gi5,gi9,gi25,gi27-28 &#xA;no ip igmp snooping querier &#xA;ip igmp snooping vlan 73 querier version 3 &#xA;ip igmp snooping vlan 73 querier &#xA;ip igmp snooping vlan 74 querier version 3 &#xA;ip igmp snooping vlan 74 querier &#xA;ip default-gateway 192.168.10.1 &#xA;encrypted ip ssh-client key rsa key-pair&#xA;---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----&#xA;Comment: RSA Private Key&#xA;&#xA;***&#xA;&#xA;---- END SSH2 PRIVATE KEY ----&#xA;&#xA;---- BEGIN SSH2 PUBLIC KEY ----&#xA;Comment: RSA Public Key&#xA;&#xA;***&#xA;&#xA;---- END SSH2 PUBLIC KEY ----&#xA;.&#xA;encrypted ip ssh-client key dsa key-pair&#xA;---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----&#xA;Comment: DSA Private Key&#xA;&#xA;***&#xA;&#xA;---- END SSH2 PRIVATE KEY ----&#xA;&#xA;---- BEGIN SSH2 PUBLIC KEY ----&#xA;Comment: DSA Public Key&#xA;&#xA;***&#xA;&#xA;---- END SSH2 PUBLIC KEY ----&#xA;.&#xA;encrypted crypto key import rsa&#xA;---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----&#xA;Comment: RSA Private Key&#xA;&#xA;***&#xA;&#xA;---- END SSH2 PRIVATE KEY ----&#xA;&#xA;---- BEGIN SSH2 PUBLIC KEY ----&#xA;Comment: RSA Public Key&#xA;&#xA;***&#xA;&#xA;---- END SSH2 PUBLIC KEY ----&#xA;.&#xA;encrypted crypto key import dsa&#xA;---- BEGIN SSH2 ENCRYPTED PRIVATE KEY ----&#xA;Comment: DSA Private Key&#xA;&#xA;***&#xA;&#xA;---- END SSH2 PRIVATE KEY ----&#xA;&#xA;---- BEGIN SSH2 PUBLIC KEY ----&#xA;Comment: DSA Public Key&#xA;&#xA;***&#xA;&#xA;---- END SSH2 PUBLIC KEY ----&#xA;.&#xA;encrypted crypto certificate 1 import&#xA;-----BEGIN RSA ENCRYPTED PRIVATE KEY-----&#xA;&#xA;***&#xA;&#xA;-----END RSA PRIVATE KEY-----&#xA;&#xA;-----BEGIN RSA PUBLIC KEY-----&#xA;&#xA;***&#xA;&#xA;-----END RSA PUBLIC KEY-----&#xA;-----BEGIN CERTIFICATE-----&#xA;&#xA;***&#xA;&#xA;-----END CERTIFICATE-----&#xA;.&#xA;encrypted crypto certificate 2 import&#xA;-----BEGIN RSA ENCRYPTED PRIVATE KEY-----&#xA;&#xA;***&#xA;&#xA;-----END RSA PRIVATE KEY-----&#xA;&#xA;-----BEGIN RSA PUBLIC KEY-----&#xA;&#xA;***&#xA;&#xA;-----END RSA PUBLIC KEY-----&#xA;-----BEGIN CERTIFICATE-----&#xA;&#xA;***&#xA;&#xA;-----END CERTIFICATE-----&#xA;.&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="28010" LastEditorUserId="8499" LastEditDate="2016-10-27T23:53:19.523" LastActivityDate="2017-02-12T15:54:21.447" Title="SG300 - no traffic across trunk" Tags="|cisco|vlan|trunk|cisco-sg300|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33292" PostTypeId="2" ParentId="28135" CreationDate="2016-07-20T19:06:55.277" Score="0" Body="&lt;p&gt;Yes.  One such network is called the Internet.  Practically speaking there is no limit to the number of nodes, especially when accounting for IPv6.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-20T19:06:55.277" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33293" PostTypeId="2" ParentId="33291" CreationDate="2016-07-20T19:19:28.860" Score="2" Body="&lt;p&gt;&quot;Port 25 on the SG300 is configured as a trunk, with VLANs 72 and 73 tagged.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This does not make sense to me.  Frames are tagged based on the access port they came from, not by a trunk port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;default-vlan vlan 71&lt;/code&gt; why?  Why did you change this from default of vlan 1?  Put that back / undo that (say default-vlan default).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the physical interfaces that you show us are described as &lt;code&gt;WLAN&lt;/code&gt;.  We need to see the trunk physical interfaces.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-20T19:19:28.860" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33294" PostTypeId="2" ParentId="25365" CreationDate="2016-07-20T19:25:16.093" Score="1" Body="&lt;p&gt;Easy, provided you have access to these networking devices (switches).  Log in and ask it to tell you who it's layer 2 neighbors are.  If Cisco that's &lt;code&gt;show CDP neighbor&lt;/code&gt; and if not it's probably &lt;code&gt;show LLDP neighbor&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding the &lt;code&gt;detail&lt;/code&gt; keyword to the end of that command will tell you the IP address of the networking device it sees.  Telnet/SSH into that device and repeat.  This will give you a layout.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;show arp&lt;/code&gt; and see the mac address of the IP address and then &lt;code&gt;show mac address table&lt;/code&gt; and trace it home.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-20T19:25:16.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33295" PostTypeId="2" ParentId="25365" CreationDate="2016-07-20T20:19:46.050" Score="1" Body="&lt;p&gt;If I understood the question, and it's Cisco, you can use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute mac ip source-ip-addr dest-ip-addr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This requires CDP enabled on all the switches.&#xA;Of course source-ip-addr and dest-ip-addr must belong to the same subnet.&lt;/p&gt;&#xA;" OwnerUserId="27712" LastActivityDate="2016-07-20T20:19:46.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33296" PostTypeId="1" AcceptedAnswerId="33299" CreationDate="2016-07-20T20:36:52.577" Score="1" ViewCount="1869" Body="&lt;p&gt;&lt;strong&gt;OBJECTIVE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The end goal here s to build a python program with Scapy that detects all access points within range of my machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UNDERSTANDING&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand this is normally done by using &lt;a href=&quot;http://www.wi-fiplanet.com/tutorials/article.php/1447501/Understanding-80211-Frame-Types.htm&quot; rel=&quot;nofollow&quot;&gt;802.11 Frame Types&lt;/a&gt;, specifically probe request frames and probe responses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;MISUNDERSTANDING&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I seem to be missing a concept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With scapy I can send out a probe request frame like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;local_mac = 'AA:BA:CA:DA:EA:FA'&#xA;dest_mac = 'AB:BB:CB:DB:EB:FB'&#xA;srp(Dot11(type=0, subtype=4, addr1 = local_mac, addr2 = dest_mac), iface = 'wlan0')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, I need the destination mac address of the access point I have not discovered yet. So, how should I already know the destination mac address before discovering the access point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is this done in other applications that achieve this result -- such as the list of access points that my computer provides for me to possibly connect to?&lt;/p&gt;&#xA;" OwnerUserId="28012" LastActivityDate="2016-07-20T21:04:15.723" Title="Probe Request Frames" Tags="|ieee-802.11|mac-address|packet-analysis|access-point|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33297" PostTypeId="2" ParentId="25583" CreationDate="2016-07-20T20:49:47.407" Score="0" Body="&lt;p&gt;Multiple requests happening at the same time are distinguished by TCP port numbers. This allows the server to keep track of seperate requests. The NAT will ensure that the TCP port numbers seen by the server for simultansious TCP connections are distinct even if the ports used locally by the client machines were the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However TCP connections do not help much in determining whether two requests came from the same machine. Obviously if two requests use the same TCP connection they came from the same machine but it is normal for requests from the same machine to use many different TCP connections. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;User sessions on the web are usually tracked using http cookies. Note though that these are per-browser not per machine. There is no robust way for a website to tell the difference between two different browsers running on the same client machine and two different client machines behind the same NAT.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-07-21T14:27:00.090" LastActivityDate="2016-07-21T14:27:00.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33298" PostTypeId="2" ParentId="33296" CreationDate="2016-07-20T20:57:31.157" Score="0" Body="&lt;p&gt;The way to get the MAC addresses of WAPs is to listen for beacon frames sent by the WAPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is from the link in your question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Beacon frame:&lt;/strong&gt; The access point periodically sends a beacon frame to announce its presence and relay information, such as timestamp,&#xA;  SSID, and other parameters regarding the access point to radio NICs&#xA;  that are within range. Radio NICs continually scan all 802.11 radio&#xA;  channels and listen to beacons as the basis for choosing which access&#xA;  point is best to associate with.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-20T20:57:31.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33299" PostTypeId="2" ParentId="33296" CreationDate="2016-07-20T21:04:15.723" Score="1" Body="&lt;p&gt;You obviously don't know the AP's MAC address, so you want to send it to everybody.  You use the broadcast address FF:FF:FF:FF:FF:FF.  Every device will receive this packet, and APs will respond with a probe response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Listening for beacons is not enough.  Often, SSID's are hidden, so you have to actively probe for them.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-20T21:04:15.723" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33300" PostTypeId="1" AcceptedAnswerId="33417" CreationDate="2016-07-20T21:16:42.703" Score="1" ViewCount="2138" Body="&lt;p&gt;I'm tasked to monitor the connectivity -Health- of a Private APN network,&#xA;our setup is like this: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have SIM cards , each has a static IP address, we are using a 4G Gateway at each remote site. Most of the SIM cards are 4G but some are 3G - I came to know this through the Gateway Status window - I want to know why I am not able to ping any 3G sim card ip address from a 4G one , when all the hardware and configuration are identical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is one private network , why would the type of connection change anything.  Please if you have the knowledge to explain it or if you can point me to the right direction in troubleshooting the issue don't hesitate , also I'm ready to answer any question. &lt;/p&gt;&#xA;" OwnerUserId="28013" LastEditorUserId="1395" LastEditDate="2016-08-01T20:24:49.380" LastActivityDate="2017-08-25T11:58:48.170" Title="In a 3g/4g private APN network, I can't ping all the address's on the network?" Tags="|routing|wireless|wan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33301" PostTypeId="2" ParentId="33300" CreationDate="2016-07-20T22:11:41.093" Score="-1" Body="&lt;p&gt;Private APN sounds like there is no VPN configuration required on your equipment - the provider does that for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an internal and separate provider facing IP address on the 3G gateway?  If so, can you ping the inside facing IP address? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be that ping to the external facing address simply will not work and you may have to access the device via the internal facing address.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-20T22:11:41.093" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33302" PostTypeId="1" AcceptedAnswerId="33303" CreationDate="2016-07-21T01:43:48.480" Score="5" ViewCount="3096" Body="&lt;p&gt;I would like to get some advice on this, because I see it being mentioned repeatedly, but why are VLAN subnets recommended to be /24? What are the downsides to assigning VLAN's a subnet that are smaller such as /25, /26 or anything smaller if you know the number of devices in that VLAN will not exceed a certain amount of hosts in a long period of time? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only reason I can think of is having to readjust all your IPs if your VLAN subnet goes over the allocated amount of hosts. Are there any other cases where doing less than /24 is a bad idea?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: I should have clarified I was referring to /24 in a private IP setting (192.168..., 172.16..., 10....).&lt;/p&gt;&#xA;" OwnerUserId="28015" LastEditorUserId="8499" LastEditDate="2019-01-12T18:58:09.340" LastActivityDate="2023-05-05T11:06:55.930" Title="VLANs and Subnets Smaller than /24?" Tags="|vlan|ip|ipv4|subnet|ip-address|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33303" PostTypeId="2" ParentId="33302" CreationDate="2016-07-21T01:56:48.313" Score="6" Body="&lt;p&gt;VLANs can be many different sizes. The length of the mask you choose depends on how many hosts you have in a network, and how much room for growth you build in. A lot of companies have networks of varying sizes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many people automatically assume &lt;code&gt;/24&lt;/code&gt; because they are lazy, and really don't understand how to use masks which don't end on an octet boundary. Granted, &lt;code&gt;/24&lt;/code&gt; is a pretty convenient size for many user networks, but there are cases where it is overkill, e.g. a site with a server, a couple of printers, and 12 users with no real room for growth. There is also something to be said for consistency, where you can have the exact same configurations for the network devices at multiple sites, and &lt;code&gt;/24&lt;/code&gt; will allow for a pretty large range of site sizes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only real concern is for the number of IPv4 addresses which you have, whether or not you are wasting too many addresses of a limited number. It is often harder to try to steal addresses from networks which are too large than it is to combine addresses into a larger network. Either way, it is no fun.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-21T01:56:48.313" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33305" PostTypeId="2" ParentId="33154" CreationDate="2016-07-21T03:03:16.543" Score="3" Body="&lt;p&gt;Your scenario looks very similar to something you'll see if you have a stale SPI on your ASA that is &quot;trumping&quot; the valid active SPI. The bad news is, if this is the case...you can only correct this by rebooting the ASA itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something you can try is running a packet tracer to simulate traffic and check that you see a &quot;VPN Encrypt Phase&quot; in the output. If you do, but the traffic fails to encrypt then it could be match against a stale SPI that isn't active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use &lt;code&gt;show asp table classify crypto&lt;/code&gt; and look for matches on your encryption domain. You do not want to see multiple matches with the same &lt;code&gt;cs_id&lt;/code&gt;. See this example: (notice how they networks are exactly the same but they have different &lt;code&gt;cs_id&lt;/code&gt; and only one has hitscounts?)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;in  id=0x7fff370d6450, priority=70, domain=ipsec-tunnel-flow, deny=false&#xA;    hits=17302, user_data=0x8e0d6a4, **cs_id=0x7fff36c15af0**, reverse, flags=0x0, protocol=0&#xA;    src ip/id=10.202.140.0, mask=255.255.255.0, port=0, tag=0&#xA;    dst ip/id=10.202.126.0, mask=255.255.255.0, port=0, tag=0, dscp=0x0&#xA;    input_ifc=outside, output_ifc=any&#xA;&#xA;in  id=0x7fff3d48dda0, priority=70, domain=ipsec-tunnel-flow, deny=false&#xA;    hits=0, user_data=0xaaf9b0c, **cs_id=0x7fff38d9d080**, reverse, flags=0x0, protocol=0&#xA;    src ip/id=10.202.140.0, mask=255.255.255.0, port=0, tag=0&#xA;    dst ip/id=10.202.126.0, mask=255.255.255.0, port=0, tag=0, dscp=0x0&#xA;    input_ifc=outside, output_ifc=any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The above example is something I've taken directly from troubleshooting exactly the same problem you are describing in which case a reboot corrected the issue. I also had an issue where the same firewall stopped passing traffic on an active tunnel with encaps and decaps for only a few hosts. Bouncing the tunnel corrected the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These issues only started after upgrading their VPNs to IKEv2. I suspect if you re-key you're tunnels to often on IKEv2 it seems to be very likely you're have issues with SPIs. You may want to try increasing the lifetime of your phase two tunnels since you have it set to 3600 right now (My customer was hitting the default data lifetime on the Phase 2 tunnels every 4 minutes and rekeying, so I set the data lifetime to unlimited)&lt;/p&gt;&#xA;" OwnerUserId="28018" LastEditorUserId="10827" LastEditDate="2016-07-21T22:41:14.977" LastActivityDate="2016-07-21T22:41:14.977" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33306" PostTypeId="2" ParentId="33240" CreationDate="2016-07-21T03:24:35.577" Score="1" Body="&lt;p&gt;Most of the VPN issues you'll want to debug can resolved debugging the IKE portion of the debug. BTW, I'm assuming you mean debugging while SSH'd into the ASA itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;*Depending on your code version&lt;/p&gt;&#xA;&#xA;&lt;p&gt;debug crypto ikev1 1-254 (start with 127, then 254)&#xA;debug crypto ikev2 1-254 (start with 127, then 254)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;debug crypto isakmp 1-254  (start with 127, then 254)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will automatically display the debug output directly to your terminal but only relative to IPsec VPNs. Keep in mind, this output can be VERY verbose if you have active traffic that is constantly flowing trying to bring up a tunnel and can overflow your terminal.&lt;/p&gt;&#xA;" OwnerUserId="28018" LastActivityDate="2016-07-21T03:24:35.577" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33307" PostTypeId="2" ParentId="33240" CreationDate="2016-07-21T03:52:23.707" Score="1" Body="&lt;p&gt;If you want to debug a single L2L VPN connection you can enable the following configuration&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ASA# debug crypto condition peer 1.1.1.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should limit the debugs to only this specific L2L VPN Peer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can confirm the setting with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA# sh crypto debug-condition&#xA;Crypto conditional debug is turned ON&#xA;IKE debug context unmatched flag:  OFF&#xA;IPSec debug context unmatched flag:  OFF&#xA;IKE debug context error flag:  OFF&#xA;IPSec debug context error flag:  OFF&#xA;IKE peer IP address filters:&#xA;1.1.1.1/32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After this you can use the &lt;code&gt;debug crypto isakmp&lt;/code&gt; and &lt;code&gt;debug crypto ipsec&lt;/code&gt; commands&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you are done be sure to remove the above condition we set with the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA# debug crypto condition reset&#xA;Do you want to clear the crypto debug filters? [confirm]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, you might have to change the logging lever for monitor&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;logging monitor debugging&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And during the SSH connection issue the command&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;terminal monitor&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And to disable it enter&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;terminal no monitor&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should be able to disable all debugging with&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;no debug all&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/11794906/how-debug-ssh-session-asa&quot; rel=&quot;nofollow&quot;&gt;- Jouni&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-21T03:52:23.707" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33308" PostTypeId="2" ParentId="33302" CreationDate="2016-07-21T04:01:56.817" Score="-4" Body="&lt;p&gt;It is good practice to use /24 subnets because doing so conforms with the &lt;a href=&quot;https://en.wikipedia.org/wiki/KISS_principle&quot; rel=&quot;nofollow&quot;&gt;KISS Principle&lt;/a&gt;, namely the first host address in the subnet gets &lt;code&gt;.1&lt;/code&gt; and the last host gets &lt;code&gt;.254&lt;/code&gt;.  The broadcast address is &lt;code&gt;.255&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a /27 for example, you might end up with available hosts being &lt;code&gt;.193&lt;/code&gt; - &lt;code&gt;.222&lt;/code&gt; and a broadcast address of &lt;code&gt;.223&lt;/code&gt;.  See the difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network Design should adhere to the KISS principle.  That being said, there are cases where IP address availability is restricted and VLSM is necessary but in 99% of private networks VLSM is not necessary and would be over-engineering.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-21T04:01:56.817" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="33309" PostTypeId="2" ParentId="33195" CreationDate="2016-07-21T04:19:04.777" Score="1" Body="&lt;p&gt;You'll need some kind of L2 switch for the HSRP to work for you in this setup. The switch will give your Routers/ASAs what they need to &quot;share&quot; their Layer 3 address (as Ron Maupin said above). I'm guessing you must have these connections currently setup to run directly from each device to the next with no switch fabric in place? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind, while you'll have redundancy at the hardware level for the routers you won't have redundancy in your switch fabric for the ASAs/Routers if you only add a single L2 switch. If the switch goes down, your hardware redundancy doesn't do much for you. Consider adding two layer 2 switches at some point in parallel (A and B side if you will) Just something to think about, but I'm sure you have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L2 Switch ports - configured with a single VLAN shared for both Routers and the Firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ports on ASA/Routers - Same you would have normally configured them except with your Routers using HSRP, and your ASAs setup for HA like Active/Standby failover.&lt;/p&gt;&#xA;" OwnerUserId="28018" LastActivityDate="2016-07-21T04:19:04.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33310" PostTypeId="2" ParentId="33195" CreationDate="2016-07-21T04:30:49.057" Score="0" Body="&lt;p&gt;&quot;Do I really need to add L2 switch&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No, you already have one - the Nexus.  Simply carve out a few ports into a VLAN for that segment.  If you are really concerned that VLAN's do not effectively segment traffic the 7k has Virtual Device Context functionality whereby you can carve out a 'new' L2 switch.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-21T04:30:49.057" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33311" PostTypeId="2" ParentId="33278" CreationDate="2016-07-21T05:10:53.217" Score="1" Body="&lt;p&gt;You want to configure up policy based routing. In the gui this is found: Router &gt; Static &gt; Policy Routes. You can do this by using TOS rather than DSCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;WAN1:&#xA;Incoming interface: LAN&#xA;Source Address: Opsview Machine IP&#xA;Destination Address: Remote Site WAN IP&#xA;TOS: Assigned Value&#xA;Outgoing Interface: WAN1&#xA;Gateway Address: Next-hop for that WAN.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do the same for the other WAN links changing the appropriate values.&lt;/p&gt;&#xA;" OwnerUserId="11927" LastActivityDate="2016-07-21T05:10:53.217" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33312" PostTypeId="1" AcceptedAnswerId="33313" CreationDate="2016-07-21T06:34:21.243" Score="1" ViewCount="1469" Body="&lt;p&gt;I have an Alcatel Lucent OS6450 and a Cisco 1812 Router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to trunk two VLANS to the Switch. VLAN 210, 300. VLAN 210 should be native VLAN. They all should be trunked to Interface 1/1 and then there should be 3 Access ports for each VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Interface on the router is configured like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet8&#xA; description Trunk to Alcatel&#xA; switchport trunk native vlan 210&#xA; switchport mode trunk&#xA;&#xA;interface Vlan300&#xA; ip address 10.0.110.1 255.255.255.0&#xA;&#xA;interface Vlan210&#xA;     ip address 10.0.100.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the interfaces on the switch &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  vlan   port   type      status&#xA;  210    1/1    default   forwarding&#xA;  210    1/2    default     inactive&#xA;  300    1/1    qtagged   forwarding&#xA;  300    1/3    default     inactive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I connect to port 1/3 with the IP of 10.0.110.11 on the Client and the Gateway 10.0.110.1 I can't even ping the gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not very familiar with Alcatel CLI, using Cisco most of the time but we got the switch for free so ...&lt;/p&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="22401" LastEditDate="2016-07-21T08:18:17.140" LastActivityDate="2016-12-18T21:15:17.570" Title="Alcatel Lucent with Cisco Router" Tags="|cisco|routing|vlan|trunk|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33313" PostTypeId="2" ParentId="33312" CreationDate="2016-07-21T07:57:02.097" Score="1" Body="&lt;p&gt;Port 1/3 is part of VLAN 300. VLAN 300 is 10.0.&lt;strong&gt;110&lt;/strong&gt;.x, not &lt;strong&gt;100&lt;/strong&gt;.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-07-21T07:57:02.097" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33315" PostTypeId="1" CreationDate="2016-07-21T10:31:23.210" Score="2" ViewCount="3608" Body="&lt;p&gt;I've got 2 pfsense boxes taking care of separate networks, with separate gateways.  We've managed to drop a cable between the 2 networks so would now like to join the 2 networks so machines on each lan can ping each other etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've drawn a diagram - can anyone tell me if this will work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many Thanks&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ht5WD.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ht5WD.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28034" LastActivityDate="2022-05-15T15:34:50.537" Title="pfSense join 2 networks" Tags="|routing|router|lan|network-access|pfsense|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33316" PostTypeId="1" AcceptedAnswerId="33317" CreationDate="2016-07-21T10:35:33.710" Score="1" ViewCount="967" Body="&lt;p&gt;Could anyone offer advice on this scenario?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Environment: 2 x ACS 5.6 appliances&#xA;- Primary ACS Appliance (+Log collector)&#xA;- Secondary ACS Appliance &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test process&#xA;1. Simulated network connection failure on Primary appliance&#xA;2. Test switch able to authenticate against Secondary appliance &#xA;3. Able to login to Secondary - Read only, no administration function, unable to view logs as log collector also&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If administration required what is the best option for the secondary appliance?&#xA;- Promote to primary?&#xA;- Request local mode?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="15807" LastActivityDate="2016-11-18T13:47:29.720" Title="What to do when a Primary ACS appliance fails within a Split ACS 5.6 deployment?" Tags="|cisco|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33317" PostTypeId="2" ParentId="33316" CreationDate="2016-07-21T10:45:01.257" Score="1" Body="&lt;p&gt;Ok after some searching I found cisco doc with a scenario reference:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-6/user/guide/acsuserguide/admin_operations.html#75607&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/net_mgmt/cisco_secure_access_control_system/5-6/user/guide/acsuserguide/admin_operations.html#75607&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario covered in failover section&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;ACS 5.6 allows you to configure multiple ACS instances for a deployment scenario. Each deployment can have one primary and multiple secondary ACS servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario: Primary ACS goes down in a Distributed deployment&quot;&lt;/p&gt;&#xA;" OwnerUserId="15807" LastActivityDate="2016-07-21T10:45:01.257" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33318" PostTypeId="2" ParentId="28034" CreationDate="2016-07-21T12:30:28.643" Score="2" Body="&lt;p&gt;In practice. If operator deliver SMS only over GSM network, but not over 3G network and support 3G for data transfer. Some 3G phones connect only by &quot;better&quot; 3G protocol and cant recieve sms quickly. Until it switch to lover protocol because of low signal or no 3G coverage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possible it related with operator network misconfiguration or bug in phone software or both in combination.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-07-21T12:30:28.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33319" PostTypeId="2" ParentId="2836" CreationDate="2016-07-21T13:14:10.723" Score="1" Body="&lt;p&gt;After you enable promiscuous mode in wireshark, don't forget to run wireshark with &lt;code&gt;sudo&lt;/code&gt;.&#xA;When you run wireshark without &lt;code&gt;sudo&lt;/code&gt;, it runs no problem but only shows you packets from/to your computer. To see packets from other computers, you need to run with &lt;code&gt;sudo&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Confirmed with Wireshark 2.0.1 on MacOSX 10.11.5 today.&lt;/p&gt;&#xA;" OwnerUserId="28036" LastActivityDate="2016-07-21T13:14:10.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33320" PostTypeId="2" ParentId="33315" CreationDate="2016-07-21T13:43:30.003" Score="4" Body="&lt;p&gt;Yes it is possible. You can do it by setting up a &lt;code&gt;Static Route&lt;/code&gt; between your two gateways. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the documentation here: &lt;a href=&quot;https://doc.pfsense.org/index.php/Static_Routes&quot; rel=&quot;nofollow&quot;&gt;https://doc.pfsense.org/index.php/Static_Routes&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the same scenario as my network where I had a LAN and a VPN. All I did was create a static route from my VPN subnet to my LAN subnet so they know to communication with each other. (Well, along those lines) Essentially making devices across two different subnets communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which I just saw that was in your diagram. &lt;/p&gt;&#xA;" OwnerUserId="27969" LastActivityDate="2016-07-21T13:43:30.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33323" PostTypeId="1" CreationDate="2016-07-21T16:12:25.953" Score="0" ViewCount="24" Body="&lt;p&gt;I got the following network topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;client--monitor--controller--Internet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Earlier today I had to restart the controller and the client.Now I cannot ping the client from the controller anymore. All the other connections work fine, except this one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IPs are the following: &lt;br&gt;&#xA;client: 10.42.0.88 &lt;br&gt;&#xA;monitor (connection to client): &lt;code&gt;10.42.0.1&lt;/code&gt; (eth1) &lt;br&gt;&#xA;monitor (connection to controller): &lt;code&gt;10.42.1.72&lt;/code&gt; (eth2) &lt;br&gt;&#xA;controller (connection to monitor): &lt;code&gt;10.42.1.1&lt;/code&gt; (eth2) &lt;br&gt;&#xA;controller (connection to internet): &lt;code&gt;172.16.200.27&lt;/code&gt; (eth0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My routing tables are the following: &lt;br&gt;&#xA;Controller:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/NYE7P.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NYE7P.png&quot; alt=&quot;Routing table at controller&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Monitor:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/0y12n.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0y12n.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am at the monitor and ping 10.42.0.88 to reach the client, I would normally assume that the ping gets routed to the monitor and from there to the client.&#xA;The second rule directs the ping to the monitor via eth2. There it gets sent to the client (rule 2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly when I do a &lt;code&gt;traceroute 10.42.0.88&lt;/code&gt;, I get a timeout but the only displayed hop is &lt;code&gt;10.42.1.1&lt;/code&gt; so I assume the problem is in the routing table of the monitor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pinging the controller from the client works without any problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated!&lt;/p&gt;&#xA;" OwnerUserId="28040" LastActivityDate="2016-07-21T16:38:03.757" Title="Unix: using route to define route to a client" Tags="|routing|lan|" AnswerCount="1" CommentCount="1" ClosedDate="2019-03-04T01:28:56.513" ContentLicense="CC BY-SA 3.0" />
  <row Id="33325" PostTypeId="2" ParentId="33323" CreationDate="2016-07-21T16:38:03.757" Score="1" Body="&lt;p&gt;Okay, so after some more trial&amp;amp;error I found the solution.&#xA;At the controller I provided the wrong gateway in the second line. Instead of 0.0.0.0 the gateway has to be &lt;code&gt;10.42.1.72&lt;/code&gt;. From there the packet gets routed correctly.&lt;/p&gt;&#xA;" OwnerUserId="28040" LastActivityDate="2016-07-21T16:38:03.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33326" PostTypeId="2" ParentId="32544" CreationDate="2016-07-21T16:47:26.807" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;And now the real question:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To shape all unclassified egress traffic to fit into 50 Mbps, can I just enter&#xA;  &lt;code&gt;srr-queue bandwidth shape 0 2 0 0&lt;/code&gt; on the interface in question and be done?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It seems like the queue sharing and shaping limits aren't guaranteed, so I might need to shape down to a nominal 45 Mbps on the egress queue if any burst over 50 Mbps is to be avoided. Can I do that by just running &lt;code&gt;srr-queue bandwidth limit 90&lt;/code&gt; combined with the above shaping?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;Short answer: Yes, this is all it takes to do egress shaping.&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Of course, mls qos must be entered, but once that is configured, egress shaping on a port is as simple as:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Adjust the line rate, if necessary (&lt;code&gt;speed 10 100 1000&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Set the bandwidth limit, if necessary (&lt;code&gt;srr-queue bandwidth limit 10-90&lt;/code&gt;, the last argument is the percent of the line rate to limit the bandwidth to)&lt;/li&gt;&#xA;&lt;li&gt;Enter the shaping weight for queue 2 on the interface (&lt;code&gt;srr-queue bandwidth shape 0 x 0 0&lt;/code&gt; where either the bandwidth limit (if applied) or the line rate (if no limit) divided by &lt;code&gt;x&lt;/code&gt; is the bandwidth the traffic is shaped to)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Source:&lt;br&gt;&#xA;Earlier today I took an extra 3560, put an extra computer on each of two ports, and started making configuration changes while copying files back and forth between the two computers, watching the estimated copy rate, and doing some math to confirm the numbers match up.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastEditorUserId="4889" LastEditDate="2016-07-21T17:49:01.427" LastActivityDate="2016-07-21T17:49:01.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33327" PostTypeId="2" ParentId="28192" CreationDate="2016-07-21T17:19:50.740" Score="1" Body="&lt;p&gt;Sorry for the confusion. That tutorial for CMX Mobility Services is not designed to work with Meraki. Go here to get instructions on how to use CMX with Meraki:&#xA;&lt;a href=&quot;http://developers.meraki.com/tagged/Location&quot; rel=&quot;nofollow&quot;&gt;http://developers.meraki.com/tagged/Location&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also there is a demo you can setup in 10 minutes here:&#xA;&lt;a href=&quot;http://developers.meraki.com/shipped&quot; rel=&quot;nofollow&quot;&gt;http://developers.meraki.com/shipped&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&#xA;Colin&lt;/p&gt;&#xA;" OwnerUserId="28045" LastActivityDate="2016-07-21T17:19:50.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33328" PostTypeId="1" CreationDate="2016-07-21T17:45:49.430" Score="1" ViewCount="1289" Body="&lt;p&gt;I have a 3560 Core switch linked to a 2960 Transmittor switch. I made VLAN 10 on the 3560 with ip address 192.168.1.11 and I also made vlan 10 on the 2960 with ip address 192.168.1.12, so they are in the same subnet. I than made an &quot;inside&quot; subinterface on the firewall with ip address 192.168.1.10, but I am unable to ping the firewall subinterface ip from my 3560 switch. I have provided all the configurations for all the devices. Please help!&#xA;Here is my config for the firewall(5520 ASA): &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the configuration for the firewall, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa#  sh run&#xA;: Saved&#xA;:&#xA;: Serial Number: JMX1131L1ZU&#xA;: Hardware:   ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz&#xA;:&#xA;ASA Version 9.1(7)&#xA;!&#xA;hostname ciscoasa&#xA;enable password 8Ry2YjIyt7RRXU24 encrypted&#xA;names&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/0.1&#xA; vlan 5&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.1.10 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/0.2&#xA; vlan 6&#xA; nameif outside&#xA; security-level 0&#xA; ip address 192.168.2.10 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/0.3&#xA; vlan 7&#xA; nameif dmz&#xA; security-level 50&#xA; ip address 192.168.3.10 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/2&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management0/0&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;ftp mode passive&#xA;pager lines 24&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;mtu dmz 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpool policy&#xA;telnet timeout 5&#xA;ssh stricthostkeycheck&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;!&#xA;!&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;Cryptochecksum:6287e0f52613b8763af300eae4849745&#xA;: end&#xA;ciscoasa#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2960 Switch(Transmittor switch)-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Transmittor#sh run&#xA;Building configuration...&#xA;Current configuration : 1913 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;no service password-encryption&#xA;!&#xA;hostname Transmittor&#xA;!&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;vtp mode transparent&#xA;ip subnet-zero&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;vlan 10,20,30,40,112-113&#xA;!&#xA;vlan 210&#xA; name netmon&#xA;!&#xA;vlan 439&#xA; name radio&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface GigabitEthernet0/3&#xA;!&#xA;interface GigabitEthernet0/4&#xA;!&#xA;interface GigabitEthernet0/5&#xA;!&#xA;interface GigabitEthernet0/6&#xA;!&#xA;interface GigabitEthernet0/7&#xA;!&#xA;interface GigabitEthernet0/8&#xA;!&#xA;interface GigabitEthernet0/9&#xA;!&#xA;interface GigabitEthernet0/10&#xA;!&#xA;interface GigabitEthernet0/11&#xA;!&#xA;interface GigabitEthernet0/12&#xA;!&#xA;interface GigabitEthernet0/13&#xA;!&#xA;interface GigabitEthernet0/14&#xA;!&#xA;interface GigabitEthernet0/15&#xA;!&#xA;interface GigabitEthernet0/16&#xA;!&#xA;interface GigabitEthernet0/17&#xA;!&#xA;interface GigabitEthernet0/18&#xA;!&#xA;interface GigabitEthernet0/19&#xA;!&#xA;interface GigabitEthernet0/20&#xA;!&#xA;interface GigabitEthernet0/21&#xA; switchport access vlan 10&#xA; switchport trunk native vlan 99&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/22&#xA; switchport access vlan 10&#xA; switchport trunk native vlan 99&#xA; switchport trunk allowed vlan 10,20,30,40&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/23&#xA;!&#xA;interface GigabitEthernet0/24&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; no ip route-cache&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.1.12 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;interface Vlan20&#xA; ip address 192.168.20.14 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;interface Vlan30&#xA; ip address 192.168.30.14 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;interface Vlan40&#xA; ip address 192.168.40.14 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;ip http server&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; password abc&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Output for 3560 Switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1704 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;ip subnet-zero&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface GigabitEthernet0/3&#xA;!&#xA;interface GigabitEthernet0/4&#xA;!&#xA;interface GigabitEthernet0/5&#xA;!&#xA;interface GigabitEthernet0/6&#xA;!&#xA;interface GigabitEthernet0/7&#xA;!&#xA;interface GigabitEthernet0/8&#xA;!&#xA;interface GigabitEthernet0/9&#xA;!&#xA;interface GigabitEthernet0/10&#xA;!&#xA;interface GigabitEthernet0/11&#xA;!&#xA;interface GigabitEthernet0/12&#xA;!&#xA;interface GigabitEthernet0/13&#xA;!&#xA;interface GigabitEthernet0/14&#xA;!&#xA;interface GigabitEthernet0/15&#xA;!&#xA;interface GigabitEthernet0/16&#xA;!&#xA;interface GigabitEthernet0/17&#xA;!&#xA;interface GigabitEthernet0/18&#xA;!&#xA;interface GigabitEthernet0/19&#xA;!&#xA;interface GigabitEthernet0/20&#xA;!&#xA;interface GigabitEthernet0/21&#xA;!&#xA;interface GigabitEthernet0/22&#xA;!&#xA;interface GigabitEthernet0/23&#xA;!&#xA;interface GigabitEthernet0/24&#xA;!&#xA;interface GigabitEthernet0/25&#xA; switchport access vlan 10&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 99&#xA; switchport trunk allowed vlan 10&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/26&#xA;!&#xA;interface GigabitEthernet0/27&#xA; switchport access vlan 10&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk native vlan 99&#xA; switchport trunk allowed vlan 10&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/28&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.1.11 255.255.255.0&#xA;!&#xA;ip classless&#xA;ip http server&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 5 15&#xA;!&#xA;end&#xA;&#xA;Switch#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27334" LastEditorUserId="7539" LastEditDate="2016-07-25T18:31:36.917" LastActivityDate="2016-07-25T18:31:36.917" Title="Firewall to network connection inside/outside" Tags="|vlan|firewall|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33331" PostTypeId="2" ParentId="32560" CreationDate="2016-07-21T18:48:23.083" Score="0" Body="&lt;p&gt;Get a 802.3at injector which can supply 30Watts over the single cable, then use a POE powered switch in room B to split the signal and power to your two cameras.  The 802.3af cameras will only pull what they need from the 802.3at as they negotiate power demands if they follow the standard.&lt;/p&gt;&#xA;" OwnerUserId="28048" LastActivityDate="2016-07-21T18:48:23.083" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33332" PostTypeId="2" ParentId="33328" CreationDate="2016-07-21T19:31:33.460" Score="1" Body="&lt;p&gt;You need to create subinterfaces on the ASA for each VLAN.  The subintefaces act like VLAN  interface on the switch.  This effectively turns your inside interface into a trunk.  For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gi0/0&#xA;no ip address&#xA;&#xA;interface gi0/0.10&#xA;vlan 10&#xA;nameif VLAN10&#xA;ip address 1.1.1.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-07-21T19:52:36.597" LastActivityDate="2016-07-21T19:52:36.597" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33333" PostTypeId="2" ParentId="33328" CreationDate="2016-07-21T20:26:13.267" Score="0" Body="&lt;p&gt;Since I don't understand your ultimate plan, I will give you a couple of other options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What Ron Trunk is giving you is what you should do if you route between the VLANs on the firewall. You will somehow need to let the router know what routes are behind the firewall. You can either use static routes (doesn't scale) or a routing protocol to tell the router what routes are behind the core switches. You could run OSPF on the the firewall, and the router, and you could inject a default route into OSPF on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have layer-3 core switches, and you want to route between the VLANs on the core switches (may be better than on the firewall or the router), you should enable routing on the layer-3 switches, then set up routed links, not trunks, between the core switches and the firewall. The firewall and the router will then need to know what networks are behind the core switches. You can either use static routes (doesn't scale) or a routing protocol to tell the firewall and router what routes are behind the core switches. You could run OSPF on the core switches, the firewall, and the router, and you could inject a default route into OSPF on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your third option is to route between the VLANs on the router. If you route between the VLANs on the router (probably the least attractive option), you will need to set up the firewall as a transparent firewall so that the VLANs can pass through from the core switches to the router. You would then need to set up the VLANs and addresses on the router in a similar way (subinterfaces) that Ron told you to do for the firewall.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-21T20:46:06.493" LastActivityDate="2016-07-21T20:46:06.493" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33334" PostTypeId="2" ParentId="33291" CreationDate="2016-07-21T21:00:54.923" Score="-1" Body="&lt;p&gt;Make sure native VLANs match, or else the links won't form, even though lights are blinking...&lt;/p&gt;&#xA;" OwnerUserId="28010" LastActivityDate="2016-07-21T21:00:54.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33335" PostTypeId="1" AcceptedAnswerId="33339" CreationDate="2016-07-21T21:01:36.503" Score="2" ViewCount="652" Body="&lt;p&gt;I am wondering how does the devices on a  wireless connection recognize each other between all other devices, for example&#xA;A wifi signal from an access point at 2.4GHz wave on channel 2 would communicate at the frequencey of 2413MHz (I think.. but an example more than an accurate statement)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you have 5 different devices connecting to it how does it recognize each one? I'm not talking about the upper layer attributes like IP and Mac addresses but more on the actual physical layer, google is just giving me blanks and bad answers and wikipedia and other websites don't give me anything technical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the sender sends signals, say 010101010, with the first digits being the address all devices can ignore this except the device with the right address, but what if another devices sends a signal during that send time, they all are at the same frequency so there is no way of finding out who sent that.. so it could actually corrupt the data being transferred, it would be like a room of people just shouting out and all have the same voice?&#xA;(I don't really know how this works)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BUT this is not the case in all current wireless connections, this is what i want to understand, how does this happen? How do they distinguish each other?&#xA;If you have 10 devices sending information all at once and on the same frequency and channel then how does the receiver know who sent what?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main aim is whether you can recognize multiple RFID tags at once at the same time by an RFID reader, for example if 20 people walked at once near an RFID reader it will recognize all of them.. is this possible?&#xA;This is the main thing i want to find out, also i want to know a the general concept of how the standard wireless connections work and the differences between them, that would be cool, this caught too much of my attention.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any refrence or help on this topic would be most appreciated! Almost a week and i still cant figure this out nor found any content on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance&lt;/p&gt;&#xA;" OwnerUserId="28051" LastActivityDate="2016-07-21T23:43:32.040" Title="Distinguishing different devices on wifi/radio frequency connections" Tags="|wireless|architecture|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33337" PostTypeId="1" AcceptedAnswerId="33362" CreationDate="2016-07-21T22:23:38.233" Score="0" ViewCount="895" Body="&lt;p&gt;please accept my apologies for my noviceness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are planning on rebuilding our church in the next few years, so needs a great networking solution. These are my needs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) A staff network for wireless devices, wired computers and an onsite server&#xA;2) A public network with access just to the internet&#xA;3) A third network just to wire the sound desk and to connect an iPad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking of using the provided ISP router (Likely to be BT) - Connect this to a switch which connects to many Ubiquiti access points as well as the office computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Is this possible?&#xA;2) How do I make it so the server and the desk are only accessible by their respective networks?&lt;/p&gt;&#xA;" OwnerUserId="28054" LastEditorUserId="7539" LastEditDate="2016-07-26T15:56:30.487" LastActivityDate="2016-07-26T15:56:30.487" Title="Designing a wireless network in a building" Tags="|routing|wireless|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33338" PostTypeId="2" ParentId="33337" CreationDate="2016-07-21T23:09:23.117" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;2) How do I make it so the server and the desk are only accessible by&#xA;  their respective networks?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You will need a switch that allows VLANs, and access points that are VLAN aware.  A VLAN acts as a &quot;virtual switch&quot; isolating devices from each other.  So you can create a virtual network (wired and wireless) just for the sound desk, and additional separate ones for your server and guest wireless. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-21T23:09:23.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33339" PostTypeId="2" ParentId="33335" CreationDate="2016-07-21T23:43:32.040" Score="1" Body="&lt;p&gt;Based on your comment, I think I understand your confusion. The Wi-Fi medium (radio waves) is a shared medium, and only one device at a time can send, even your PC and WAP must take turns and not send at the same time, which is why advertised Wi-Fi speeds are just so much marketing hype. If multiple devices send at the same time, you have a collision, and a device gets garbled data, which it ignores. Wi-Fi uses CSMA-CA to try to avoid collisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Wi-Fi protocol is set up to fairly share the airwaves with all other devices on the same frequency, even those which are not part of your network. Devices will even bow out and give time to other devices. If you and a neighbor are operating on the same frequency, each of your devices will give time to all the other devices on the same frequency. That is why your network will slow down your neighbor's network, and vice versa. Neither of you owns the public airwaves, and you must share them.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-21T23:43:32.040" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33340" PostTypeId="2" ParentId="33337" CreationDate="2016-07-22T01:21:16.063" Score="1" Body="&lt;p&gt;You will need an Ethernet switch to terminate the links to the Access Points and any other wired IP endpoints.  You will also need a security gateway that provides URL/Content Filtering (no browsing gambling, profane sites, etc.) as well as firewall features.  The public network needs to be child appropriate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A key factor is the required number of AP's.  There are 2 approaches - coverage based or capacity based.  If you are going to have 300 people show up in a church or conference hall with many of them using your WiFi, you need to plan for this.  A capacity based predictive model can guide you.  See Meraki's &lt;a href=&quot;https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/High_Density_Wi-Fi_Deployment_Guide&quot; rel=&quot;nofollow&quot;&gt;High Density Wi-Fi Deployment Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AP's will likely be powered by the network cable but copper only works for 300 feet.  Beyond that you use fiber cable.  They make fiber to copper media converters with PoE+ which might be what you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Contact a &quot;Structured Cabling provider&quot; to get all this cable run and AP's installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-07-22T05:35:42.223" LastActivityDate="2016-07-22T05:35:42.223" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33342" PostTypeId="1" AcceptedAnswerId="33532" CreationDate="2016-07-22T04:20:57.147" Score="2" ViewCount="91" Body="&lt;p&gt;I am trying to play (in GNS3 if that matters) with a very simple topology of three routers connected via hub. The time I am trying to ping from one of the router to another say R1 to R2. The R3 replies with ICMP redirect message causing R1 to re issue the ping request to R2. The loop continues infinitely wrecking havoc on simulated network. The question is why R3 replies to R1 for ICMP message not directed to it (ping is from R1 to R2). &#xA;&lt;a href=&quot;https://i.stack.imgur.com/nfeft.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nfeft.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3 routing table :-    &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3&amp;gt;enable&#xA;Password:&#xA;R3#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       + - replicated route, % - next hop override&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;      10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks&#xA;O        10.1.0.0/16 [110/2] via 192.168.0.1, 00:58:17, FastEthernet1/0&#xA;O        10.2.0.0/16 [110/2] via 192.168.0.2, 00:58:17, FastEthernet1/0&#xA;C        10.3.0.0/16 is directly connected, FastEthernet0/0&#xA;L        10.3.0.1/32 is directly connected, FastEthernet0/0&#xA;C     192.168.0.0/16 is directly connected, FastEthernet1/0&#xA;      192.168.0.0/32 is subnetted, 1 subnets&#xA;L        192.168.0.3 is directly connected, FastEthernet1/0&#xA;R3#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;UPDATE: The problem is not ICMP redirect but the fact that any router will place the ICMP ping packet it cannot handle back to the interface it arrived from flooding the network till TTL expires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update2: replacing hub with switch solves the problem.&lt;/p&gt;&#xA;" OwnerUserId="28060" LastEditorUserId="28060" LastEditDate="2016-07-22T15:13:12.770" LastActivityDate="2016-07-28T02:39:53.673" Title="cisco7200 router responds to icmp messages not addressed to it" Tags="|cisco|routing|icmp|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33344" PostTypeId="1" CreationDate="2016-07-22T06:54:29.893" Score="1" ViewCount="87" Body="&lt;p&gt;The scenario is - I need to send push notification to Apple push server hosted at &lt;strong&gt;gateway.sandbox.push.apple.com&lt;/strong&gt;. This Apple server is load balanced and the destination IP address can be anything in &lt;strong&gt;17.x.x.x&lt;/strong&gt; block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my server which will be requesting Apple server is in secure environment and is behind firewalls. I have got the IP range &lt;strong&gt;17.x.x.x&lt;/strong&gt; unblocked, but DNS resolving is not possible on that server. That server also doesnt have Internet access on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I did was - I pinged the Apple server from another system and got the Apple server's IP address for the moment. Then I mapped that IP address with the DNS name in the hosts file of my Windows server. This worked, but now the IP address can change anytime at the Apple end, and this will break things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do in this scenario?&lt;/p&gt;&#xA;" OwnerUserId="28033" LastActivityDate="2016-10-20T19:00:16.190" Title="Access load-balanced website when DNS lookup is restricted on server" Tags="|firewall|dns|load-balancing|" AnswerCount="1" CommentCount="3" ClosedDate="2016-10-20T19:01:19.303" ContentLicense="CC BY-SA 3.0" />
  <row Id="33345" PostTypeId="2" ParentId="33275" CreationDate="2016-07-22T08:40:32.890" Score="1" Body="&lt;p&gt;As a simultaneous dual band device, a dual band router has two radios, one 2.4 GHz and the other 5 GHz. You have the option of assigning the same wireless network name to both bands, or you can assign a separate name to the 5 GHz band.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-07-22T08:40:32.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33346" PostTypeId="1" AcceptedAnswerId="33349" CreationDate="2016-07-22T09:01:28.500" Score="0" ViewCount="110" Body="&lt;p&gt;It just came across my mind that if I am broadcasting a message in my network, is it my computer, router or another node that decides to replicate the message?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, how does that node how many times to replicate the message?&lt;/p&gt;&#xA;" OwnerUserId="28067" LastEditorUserId="27969" LastEditDate="2016-07-22T13:59:51.703" LastActivityDate="2016-07-22T13:59:51.703" Title="How and what decides how many replicated packets need to be created in broadcast?" Tags="|broadcast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33347" PostTypeId="2" ParentId="33346" CreationDate="2016-07-22T09:09:18.047" Score="1" Body="&lt;p&gt;It doesn't work that way. Broadcast packets are sent to the &lt;em&gt;broadcast address&lt;/em&gt;, which every host on the network should listen to. So there's only one packet, it does not get replicated.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-07-22T09:09:18.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33349" PostTypeId="2" ParentId="33346" CreationDate="2016-07-22T09:22:21.800" Score="5" Body="&lt;p&gt;The PC only sends a single frame with a broadcast MAC address and Broadcast IP address.  Routers don't forward broadcasts, so there is no replication at L3.  Switches do replicate the frame.  They forward it out of all interfaces apart from the one it came in on.  Spanning Tree ensures there are no loops in the L2 topology to ensure the packet does not loop indefinitely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a feature at L3 called directed broadcast, but the packet still isn't replicated at L3.  The destination IP is the broadcast address of a distant subnet.  The packet gets routed to it's destination LAN then exits the router and gets broadcast on that network, with replication at L2 if necessary.  This feature is usually disabled for security reasons.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-07-22T13:43:36.787" LastActivityDate="2016-07-22T13:43:36.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33350" PostTypeId="1" CreationDate="2016-07-22T09:39:45.660" Score="0" ViewCount="36" Body="&lt;p&gt;Not a technical question per se - just wondering if anyone is aware of any software?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone aware of any application/NMS/database etc that will return the hops from A to B through a network if you input all the different devices and links between them? Say I want to find all the routes between two devices - it will show me the different paths I can take (I don't specifically want the shortest path, i want to see everything available).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've scripted something but unfortunately I'm not advanced to prevent loops etc in it, so it's kind of pointless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers&#xA;S&lt;/p&gt;&#xA;" OwnerUserId="5661" LastActivityDate="2016-07-24T07:26:16.527" Title="App/database/NMS - plot hops through network?" Tags="|nms|" AnswerCount="1" CommentCount="2" ClosedDate="2019-03-04T01:14:52.113" ContentLicense="CC BY-SA 3.0" />
  <row Id="33351" PostTypeId="1" CreationDate="2016-07-22T11:11:56.093" Score="0" ViewCount="946" Body="&lt;p&gt;I have 4 nodes, each nodes have 4 ports. I want connect them without switch like a ring. My topology is looks like:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/tOrra.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tOrra.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;The eth2 and eth3 is down. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if I am in node2, I can ping node1, but I can't ping node3;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if I am in node3, I can ping node4, but I can't ping node2;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if I am in node4, I can ping node3, but I can't ping node1;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if I am in node1, I can ping node2, but I can't ping node4;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are my configurations:&#xA;System: CentOS 6.5 Full installation&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use /etc/sysconfig/network-scripts/ifcfg-eth0 to set static ip for port 0 and so on.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;`DEVICE=eth0&#xA;TYPE=Ethernet&#xA;UUID=xxxxxxxxxxxxxxx&#xA;ONBOOT=yes&#xA;NM_CONTROLLED=no&#xA;BOOTPROTO=none&#xA;IPADDR=10.0.0.101&#xA;NETMASK=255.255.255.0&#xA;IPV6INIT=no&#xA;USERCTL=no&#xA;HWADDR=xxxxxxxxxxxx&#xA;IPV4_FAILURE_FATAL=yes&#xA;NAME=&quot;System eth0&quot;`&#xA;&#xA;The IP for node 1 is 10.0.0.101, 10.0.0.102, 10.0.0.103, 10.0.0.104&#xA;       for node 2 is 10.0.0.105, 10.0.0.106, 10.0.0.107, 10.0.0.108&#xA;       for node 3 is 10.0.0.109, 10.0.0.110, 10.0.0.111, 10.0.0.112&#xA;       for node 4 is 10.0.0.113, 10.0.0.114, 10.0.0.115, 10.0.0.116&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And my routing table is like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 eth2&#xA;10.0.0.0        0.0.0.0         255.255.255.0   U     0      0        0 eth3&#xA;169.254.0.0     0.0.0.0         255.255.0.0     U     1004   0        0 eth2&#xA;169.254.0.0     0.0.0.0         255.255.0.0     U     1005   0        0 eth3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And my /etc/sysctl.conf&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;net.ipv4.ip_forward = 1&#xA;&#xA;net.ipv4.conf.default.rp_filter = 2&#xA;net.ipv4.conf.all.rp_filter = 2&#xA;&#xA;net.ipv4.conf.default.accept_source_route = 2&#xA;net.ipv4.conf.all.accept_source_route = 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The error message of ping is &quot;Destination host unreachable&quot;,&lt;/p&gt;&#xA;" OwnerUserId="27997" LastEditorUserId="2142" LastEditDate="2016-07-22T11:43:47.150" LastActivityDate="2016-07-22T22:24:14.883" Title="Multiple NICs, only eth0 can ping" Tags="|routing|arp|ping|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33352" PostTypeId="2" ParentId="33351" CreationDate="2016-07-22T11:49:54.397" Score="6" Body="&lt;p&gt;You have all your interfaces in the same subnet.  That is not going to work.  Your computer can't figure out which interface to use to send to each host because it believes they are reachable from any interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you insist on this configuration, make each link a different subnet.  For the node 1-2 link, use 10.0.1.0/24; for the node 2-3 link, use 10.0.2.0/24; etc. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-22T11:49:54.397" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33353" PostTypeId="2" ParentId="33351" CreationDate="2016-07-22T14:54:42.390" Score="5" Body="&lt;p&gt;If You need all nodes to work in one subnet and one L2 broadcast domain,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;add bridge interface, enable rstp on it, assign IP on bridge interface and add physical interfaces to bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/etc/sysconfig/network-scripts/ifcfg-br0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DEVICE=br0&#xA;TYPE=Bridge&#xA;STP=on&#xA;MACADDR=xxxxxxxxxxxx&#xA;IPADDR=x.x.x.x&#xA;NETMASK=255.255.255.0&#xA;ONBOOT=yes&#xA;BOOTPROTO=static&#xA;USERCTL=no&#xA;NM_CONTROLLED=no&#xA;DELAY=0&#xA;IPV6INIT=yes&#xA;IPV6_AUTOCONF=yes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;/etc/sysconfig/network-scripts/ifcfg-eth0 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DEVICE=eth0&#xA;HWADDR=xxxxxxxxxxxx&#xA;TYPE=Ethernet&#xA;UUID=xxxxxxxxxxxxxxx&#xA;ONBOOT=yes&#xA;NM_CONTROLLED=no&#xA;BOOTPROTO=none&#xA;USERCTL=no&#xA;PEERDNS=yes&#xA;IPV6INIT=no&#xA;BRIDGE=br0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In ring topology RSTP is much better. STP in ring topology can enter in infinite topology rebuilding. RSTP in linux supported as rstpd daemon, but Im not sure it well supported and newer configure in in generic Linux. In Linux kernel based RouterOS, RSTP work perfectly.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="7539" LastEditDate="2016-07-22T22:24:14.883" LastActivityDate="2016-07-22T22:24:14.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33354" PostTypeId="2" ParentId="28975" CreationDate="2016-07-22T15:58:37.333" Score="0" Body="&lt;ol&gt;&#xA;&lt;li&gt;AP can handle multiple SSID and bridge it to different VLANs to separate traffic of SSIDs. And router handle different VLANs with correct rules.&lt;/li&gt;&#xA;&lt;li&gt;AP can make some kind of L2 tunnel to central device (wireless controller or roouter).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Logicaly, this make same result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireles controller usually configure APs for desired SSIDs, frequency, VLANs etc.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-07-22T15:58:37.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33355" PostTypeId="2" ParentId="28975" CreationDate="2016-07-22T16:39:26.913" Score="0" Body="&lt;p&gt;Roaming is the term used to describe a wireless client moving from one AP's coverage area to another.  In WiFi there is layer2 roaming and less commonly layer3 roaming; the roaming decision is left to the client.  It is known that radio resource management plays a huge role in the roaming process.  For example, an AP can be forced to not accept low quality connections which results in forcing the client to look for another.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-22T16:39:26.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33356" PostTypeId="2" ParentId="28864" CreationDate="2016-07-22T16:48:21.457" Score="0" Body="&lt;p&gt;bandwidth or throughput is /  where implied - data is received by destination and frequently implied - data is application data (at least L2 or upper)&#xA;All protocol overhead count there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;transmission rate or bitrate is similar, but data just transmitted but no warranty on receiving by destination. And it not count protocol overhead. It L1 speed. &lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-07-22T16:48:21.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33357" PostTypeId="2" ParentId="33351" CreationDate="2016-07-22T16:49:13.070" Score="-3" Body="&lt;p&gt;You need to enable bridging.  On Cisco devices Integrated Routing and Bridging would be the fix here.  You'll have to check your OS documentation but looks like linux should be able to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://unix.stackexchange.com/questions/86056/why-does-linux-require-moving-ip-from-eth-interface-to-bridge-interface&quot;&gt;https://unix.stackexchange.com/questions/86056/why-does-linux-require-moving-ip-from-eth-interface-to-bridge-interface&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://wiki.linuxfoundation.org/networking/bridge&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.linuxfoundation.org/networking/bridge&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2017-04-13T12:37:13.227" LastActivityDate="2016-07-22T16:49:13.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33358" PostTypeId="2" ParentId="33344" CreationDate="2016-07-22T16:55:07.337" Score="0" Body="&lt;p&gt;Do nothing.  I doubt apple is using round robin DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network Load Balancing (typically a virtual IP address) is superior to other software solutions such as round robin DNS (RRDNS), which distributes workload among multiple servers but does not provide a mechanism for server availability.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-22T16:55:07.337" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33359" PostTypeId="2" ParentId="32544" CreationDate="2016-07-22T17:03:20.993" Score="0" Body="&lt;p&gt;It's pretty easy.  If you have RTP or some LLQ you might need to do nested policy but if not:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any myRate&#xA; match any&#xA;&#xA;policy-map myRatePolicy&#xA; class myRate&#xA;  shape average 50m&#xA;&#xA;interface GigabitEthernet0/1&#xA; service-policy output myRatePolicy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-22T17:03:20.993" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33360" PostTypeId="2" ParentId="32560" CreationDate="2016-07-22T17:21:44.017" Score="5" Body="&lt;p&gt;If 100 Mbit/s is enough for camera to work, You can try &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/5334/4-wire-as-compared-to-8-wire-lan-connections-and-bandwidth-loss-when-splitting&quot;&gt;split single 4-pairs cat5 cable in two 2-pairs links&lt;/a&gt;. It can be done by 2 Ethernet splitter or by proper cable crimping.&#xA;&quot;This adapter brings 4-5-7-8 to the second port's 1-2-3-6. This is, technically, a spec violation, but over short distances, it does work.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;100BASE-TX Ethernet works definitely, but PoE in question, because method B of PoE not work in this case and both can depends on power loss in long cables (method A for 1G Ethernet use all 8 wires to power delivery).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It depends on &lt;a href=&quot;https://en.wikipedia.org/wiki/Power_over_Ethernet#Pinouts&quot; rel=&quot;nofollow noreferrer&quot;&gt;method of PoE injection&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PINS on Switch  10/100 DC on Spares (метод B)   10/100 Mixed DC &amp;amp; Data (метод A)&#xA;Pin 1           Rx+                             Rx+ DC+     &#xA;Pin 2           Rx–                             Rx– DC+ &#xA;Pin 3           Tx+                             Tx+ DC– &#xA;Pin 4           DC+                             not used&#xA;Pin 5           DC+                             not used&#xA;Pin 6           Tx–                             Tx– DC– &#xA;Pin 7           DC–                             not used&#xA;Pin 8           DC–                             not used&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-07-22T17:21:44.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33362" PostTypeId="2" ParentId="33337" CreationDate="2016-07-22T17:53:34.547" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;1) Is this possible?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Generally yes, but I suspect not with simple British Telecommunications router.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2) How do I make it so the server and the desk are only accessible by&#xA;  their respective networks?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;By using managed switch with VLANs and AP that support VLANs. Or by using AP and Wireless controller that tunneling traffic between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cost of solution can differ depends on chosen equipment. But anyway radio planning and cabling planning is required, specially if You planning to use multiple APs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPD. Try to make more specific in project.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. How many AP is necessary?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One AP can work from 10 to 100 meters, depends on AP, Wi-Fi standard (g ,n ,ac), walls, desired speed, AP antennas and other parameters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reinforced concrete make good isolation, so at least 1 AP on floor. One of way is set test AP and try, how far from it phone work acceptable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. How many active users must be served simultaneous?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(active mean do something on network or internet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 2.4 GHz band only 3 channels simultaneous possible. And more 15-20 active users on single channel in single interference area can make problem with performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it problem meet, use low power AP that have less coverage and less interference area, and possible use directional antennas. But then more AP required.&#xA;And/OR use 5 GHz band where more channels can be used (8 - 12 depends on country), if enough client devices support it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, You can try use long range higher power AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Where it must be placed?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There some different solution possible. It somehow like box packaging.&#xA;Some AP can have directional antennas and make far coverage in one direction and short in other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can depend on wiring limitation (maximum 100 meters of twisted pair)&#xA;and on AP choose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;4. What AP you choose?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hard question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ubiquiti UniFi is nice, but requite controller (PC software or &quot;UniFi Cloud Key&quot;). And if one or more switch is used it must be VLAN capable managed switch. And there no directional AP that support multiple SSID (if not do reflash to non native firmware).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mikrotik - any wireless can be controlled AP or work without controller.&#xA;Any router can be wireless controller (limited only by planned load).&#xA;More flexible router, for my taste (but less trivial).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Meraki, Ruckus, Aruba ... - can do anything of above and much more, but several times more expensive. And I lack expertise in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;5. What router to use?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How much traffic must handle the router?&#xA;(In Your case - What planned speed of internet connection plus estimation of inter-VLAN traffic?)&lt;/p&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="7539" LastEditDate="2016-07-23T21:28:21.010" LastActivityDate="2016-07-23T21:28:21.010" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33364" PostTypeId="2" ParentId="29871" CreationDate="2016-07-22T19:37:33.053" Score="0" Body="&lt;p&gt;The SRTP session is between the endpoints.  The gateway is unseen/transparent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In SIP lingo, there is a Session Border Controller, SBC.  A security device that injects itself between endpoints is often called a proxy.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-07-22T20:56:45.923" LastActivityDate="2016-07-22T20:56:45.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33366" PostTypeId="2" ParentId="19387" CreationDate="2016-07-22T21:15:21.190" Score="0" Body="&lt;p&gt;Just upgrade the Master.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/dam/en/us/td/docs/switches/lan/csbms/Sx500/administration_guide/Cisco_500Sx_v1_4_AG.pdf&quot; rel=&quot;nofollow&quot;&gt;Software Auto Synchronization in Stack&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;All the units in the stack must run the same software version&#xA;  (firmware and bootcode). Each unit in a stack automatically downloads&#xA;  firmware and bootcode from the master unit if the firmware and/or boot&#xA;  code that the unit and the master are running is different. The unit&#xA;  automatically reboots itself to run the new version.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-22T21:15:21.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33367" PostTypeId="1" CreationDate="2016-07-22T21:19:52.377" Score="2" ViewCount="77" Body="&lt;p&gt;I have just moved office, to the sam building but about 50m down the corridor. I would like to have internet in my new office, but need to wait 1 month for my ISP to come out and move the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to figure out what i can do in the mean time. In the new office i will require a switch / hub as not all equipment is wifi ready. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can i get some sort of wifi extender with an rj45 on it, that will sit in the new office and connect to the wifi in my old office?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help / suggestions would be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="28077" LastActivityDate="2022-10-19T07:14:12.020" Title="wifi extender with switch" Tags="|switch|ieee-802.11|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33368" PostTypeId="2" ParentId="33041" CreationDate="2016-07-22T21:42:37.383" Score="9" Body="&lt;p&gt;Unfortunately there was no interest in this so i had to find it out myself.&#xA;Here's the answer from a great book.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/h1VP7.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/h1VP7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/mkjkH.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mkjkH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Book: &lt;a href=&quot;https://www.safaribooksonline.com/library/view/80211-wireless-networks/0596100523/ch04.html#&quot; rel=&quot;noreferrer&quot;&gt;https://www.safaribooksonline.com/library/view/80211-wireless-networks/0596100523/ch04.html#&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27803" LastEditorUserId="8499" LastEditDate="2016-07-22T21:43:55.923" LastActivityDate="2016-07-22T21:43:55.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33369" PostTypeId="2" ParentId="33367" CreationDate="2016-07-22T21:46:08.737" Score="1" Body="&lt;p&gt;You are only talking 160 feet or so.  If you can get building management to get you a copper path patched through or dropped above the drop tile ceiling (if you have that) just move your AP.  Otherwise you can use a WiFi bridge without line of sight considering the following.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Concrete and concrete block walls may limit signal penetration to&#xA;  three or four walls. Wood or drywall typically allow for adequate&#xA;  penetration through five or six walls. A thick metal wall reflects&#xA;  signals, resulting in poor penetration. Steel-reinforced concrete&#xA;  flooringwill restrict coverage between floors to perhaps one or two&#xA;  floors.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;source &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/wireless/aironet-antennas-accessories/product_data_sheet09186a008008883b.html&quot; rel=&quot;nofollow&quot;&gt;cisco.com&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility is to use 4G LTE cellular tethering.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-22T21:46:08.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33372" PostTypeId="2" ParentId="33337" CreationDate="2016-07-22T23:47:42.680" Score="1" Body="&lt;p&gt;@aidan beaumont - All the answers provided by the multiple techs on this post are very helpful to your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To your list add a communications rack at least 42 RUs with horizontal/vertical cablemanagement in a secured air-conditioned room. Which is properly grounded by an electrician.&#xA;Two racks are even better, one for your cabling and POE network switches. The other for your servers and other comms equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All your cabling (preferably cat6a shielded) can terminate into the patch panels within the rack and serve your POE wireless access points&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Planning a clean a thorough installation from day 1 sure helps later for when you add growth and locating what is connected to your network. :-)&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-07-22T23:47:42.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33374" PostTypeId="2" ParentId="33342" CreationDate="2016-07-23T00:51:57.343" Score="3" Body="&lt;p&gt;This is expected behaviour. As you were using a hub originally (which sends the packets out all interfaces except the one they were received on), the routers were receiving packets destined for other routers on the same subnet. As a result, these routers were sending redirects to the ping originator telling it &quot;don't send your packets to me, send them directly to the router you're trying to ping.&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you mentioned, using a switch instead of a hub resolves the issue. This is because the switch ensures only the router which the ping is destined for receives the packet. As the other routers on the subnet do not receive these packets, they do not send redirects anymore. &lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-07-23T00:51:57.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33375" PostTypeId="1" AcceptedAnswerId="33376" CreationDate="2016-07-23T01:20:40.187" Score="1" ViewCount="2102" Body="&lt;p&gt;In an abstract way, Software Defined Networking controls the forwarding plane elements remotely for the purpose of determining communication path and other controlling matters. I learned that SDN forwarding plane consists of (programmable) switches which is sometimes denoted by OpenFlow-based switches such as &lt;a href=&quot;http://openvswitch.org&quot; rel=&quot;nofollow&quot;&gt;OpenvSwitch&lt;/a&gt;. However, I've read multiple times that SDN can be used to remotely control &lt;strong&gt;real conventional hardware switches&lt;/strong&gt;!! This really changes everything I've learned so far! Is that really possible?&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2018-07-12T10:08:52.057" Title="Can SDN work with the conventional switches?" Tags="|cisco|routing|switch|router|sdn|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33376" PostTypeId="2" ParentId="33375" CreationDate="2016-07-23T01:54:52.260" Score="2" Body="&lt;p&gt;Good question.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, as I indicated in &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/19321/what-exactly-is-sdn&quot;&gt;What Exactly is SDN?&lt;/a&gt;, if it ain't running the trademarked OpenFlow&amp;#174; protocol, it ain't &lt;em&gt;SDN&lt;/em&gt;, it's &lt;em&gt;SDN Fashioned&lt;/em&gt;.  OpenFlow&amp;#174;'s owner, the ONF, spells out a &lt;a href=&quot;https://www.opennetworking.org/sdn-resources/sdn-definition&quot; rel=&quot;nofollow noreferrer&quot;&gt;Software-Defined Networking (SDN) Definition&lt;/a&gt; which specifies that the OpenFlow® protocol is a &lt;em&gt;foundational element&lt;/em&gt; for building SDN solutions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco, for example, owns and markets an &lt;em&gt;SDN fashioned&lt;/em&gt; solution called &lt;a href=&quot;http://www.cisco.com/c/en/us/solutions/software-defined-networking/sdn-data-center.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Application Centric Infrastructure (ACI)&lt;/a&gt; which they say is better and more feature rich than plain old SDN w/ OpenFlow&amp;#174;.  Cisco also markets a pre-packaged plug&amp;amp;play SDN fashioned product called Cisco Meraki.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VMWare offers an &lt;em&gt;SDN fashioned&lt;/em&gt; product called NSX.  With their solution, the SDN functionality is an overlay.  They basically tunnel/encapsulate another network on top of the existing underlying IP network and Ethernet switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, to answer your question, in order for an Ethernet switch to be controlled by an SDN controller it must speak OpenFlow&amp;#174; or some vendor specific flavor of something similar such as Cisco's &lt;a href=&quot;http://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/application-centric-infrastructure/white-paper-c11-731302.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpFlex&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-07-23T04:14:19.343" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33380" PostTypeId="1" CreationDate="2016-07-23T03:48:28.503" Score="7" ViewCount="2828" Body="&lt;p&gt;I am wondering what could be the use case where a 16-bit ASN is needed over a 32-bit ASN at this times. I guess if the user have some older equipment and software 16-bit may be needed. Can some please advice for better understanding.&lt;/p&gt;&#xA;" OwnerUserId="28083" LastEditorUserId="28083" LastEditDate="2016-07-28T01:49:39.130" LastActivityDate="2019-01-13T02:18:46.923" Title="Should we require a 16-bit ASN?" Tags="|routing|bgp|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33382" PostTypeId="2" ParentId="33181" CreationDate="2016-07-23T07:56:56.983" Score="3" Body="&lt;p&gt;Perhaps the default information originate command is incompatible with IP SLA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You've probably already seen this, but this Cisco forum post talks about using a bogus static route (the same method you used to get it to work). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/document/116336/ospf-reliable-conditional-default-routing&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/document/116336/ospf-reliable-conditional-default-routing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using this method means that the default information originate command is not interfacing with IP SLA directly.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-07-23T07:56:56.983" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="33383" PostTypeId="2" ParentId="33380" CreationDate="2016-07-23T08:58:41.900" Score="8" Body="&lt;p&gt;It's usually incompatibility, not just with your own hardware, but also that of companies you peer with.  I requested an ASN about 3-4 years ago and RIPE provided a 32-bit ASN.  We could peer with our ISPs OK, but free peering at public Internet exchanges didn't always work.  We requested a 16-bit one in the end.  This was a few years ago now, so things may have moved on.  I would still go with the 32-bit, you can request a 16-bit if you have specific problems.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-07-23T09:48:39.100" LastActivityDate="2016-07-23T09:48:39.100" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33384" PostTypeId="2" ParentId="33380" CreationDate="2016-07-23T10:59:37.233" Score="6" Body="&lt;p&gt;If you're planning to do a lot with BGP communities which are used for signalling between your own ASN and your upstream or downstream peers, a 32-bit ASN might be less useful since the second 16 bits for the 32-bit ASN are used for communities in 16-bit ASNs. There's an IETF &lt;a href=&quot;https://tools.ietf.org/id/draft-heitz-idr-large-community.txt&quot; rel=&quot;noreferrer&quot;&gt;draft&lt;/a&gt; which will provide these communities for 32-bit ASNs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're not planning on doing anything with communities outside your own ASN, there's no real drawback in using a 32-bit ASN. Any router nowadays supports it, and if it doesn't, it at least supports the AS23456 transition mechanism.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-07-23T10:59:37.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33387" PostTypeId="1" AcceptedAnswerId="33390" CreationDate="2016-07-23T12:48:08.443" Score="-2" ViewCount="51" Body="&lt;p&gt;I recently bought this EMC server rack, it's got a bunch of hard drive arrays which came with it. How do I use these? Seems a shame to throw them away. Are these just a sort of NAS that I could configure, if so, how? Can they be used as individual drives if I pull them? &lt;a href=&quot;https://i.stack.imgur.com/dAYbF.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dAYbF.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28090" LastActivityDate="2016-07-23T13:09:58.027" Title="Hard drive array usage" Tags="|hardware|rack-layout|" AnswerCount="1" CommentCount="1" ClosedDate="2016-07-23T16:18:19.467" ContentLicense="CC BY-SA 3.0" />
  <row Id="33388" PostTypeId="2" ParentId="33181" CreationDate="2016-07-23T13:04:14.480" Score="-3" Body="&lt;p&gt;I don't know about the exam, but in the real world something like this would be done using &lt;a href=&quot;http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-embedded-event-manager-eem/index.html&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS Embedded Event Manager (EEM)&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See Also &lt;a href=&quot;https://supportforums.cisco.com/discussion/11368256/eem-script-report-routing-table-change&quot; rel=&quot;nofollow&quot;&gt;EEM script to report routing table change&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;event manager applet route-table-monitor&#xA;&#xA; event routing network 0.0.0.0/0 ge 1&#xA;&#xA; action 1.0 syslog msg &quot;Route changed: Type: $_routing_type, Network: $_routing_network, Mask/Prefix: $_routing_mask, Protocol: $_routing_protocol, GW: $_routing_lastgateway, Intf: $_routing_lastinterface&quot; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-23T13:04:14.480" CommentCount="19" ContentLicense="CC BY-SA 3.0" />
  <row Id="33390" PostTypeId="2" ParentId="33387" CreationDate="2016-07-23T13:09:58.027" Score="1" Body="&lt;p&gt;You need a &lt;em&gt;controller&lt;/em&gt; to run these.  Simply look up the model of that chassis and read the documentation.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-23T13:09:58.027" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33391" PostTypeId="1" AcceptedAnswerId="33410" CreationDate="2016-07-23T15:03:08.223" Score="1" ViewCount="5019" Body="&lt;p&gt;I have 3 offices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.2.1.0/24 main1      office&#xA;1.2.2.0/24 secondary2 office&#xA;1.2.3.0/24 secondary3 office&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are three &lt;code&gt;Mikrotik 951Ui-2HnD&lt;/code&gt; (current-firmware: &lt;code&gt;3.18&lt;/code&gt;) in each office:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;main1:      LAN: 1.2.1.1 | WAN: XXX.XXX.XXX.115&#xA;secondary2: LAN: 1.2.2.1 | WAN: XXX.XXX.XXX.112&#xA;secondary3: LAN: 1.2.3.1 | WAN: XXX.XXX.XXX.116&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are no any &lt;code&gt;/ip firewall&lt;/code&gt; rules yet in each mikrotiks.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Main1 mikrotik configuration&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface pptp-server server&#xA;set enabled=yes&#xA;&#xA;/ip address&#xA;add address=1.2.1.1/24 interface=bridge-local network=1.2.1.0&#xA;add address=XXX.XXX.XXX.115/29 interface=ether1-gateway network=XXX.XXX.XXX.112&#xA;&#xA;/ip route&#xA;add distance=1 gateway=XXX.XXX.XXX.113&#xA;add distance=2 dst-address=1.2.2.0/24 gateway=172.16.1.2&#xA;add distance=2 dst-address=1.2.3.0/24 gateway=172.16.1.3&#xA;&#xA;/ppp secret&#xA;add local-address=172.16.1.1 name=secondary3 password=123 profile=pptp-in remote-address=172.16.1.3 service=pptp&#xA;add local-address=172.16.1.1 name=secondary2 password=123 profile=pptp-in remote-address=172.16.1.2 service=pptp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Secondary2 mikrotik configuration&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface pptp-client&#xA;add add-default-route=no allow=mschap1,mschap2 connect-to=XXX.XXX.XXX.115 dial-on-demand=no disabled=no keepalive-timeout=60 max-mru=1450 \&#xA;    max-mtu=1450 mrru=disabled name=pptp-out1 password=123 profile=default-encryption user=secondary2&#xA;&#xA;/ip address&#xA;add address=1.2.2.1/24 interface=bridge-local network=1.2.2.0&#xA;add address=XXX.XXX.XXX.117/29 interface=ether1-gateway network=XXX.XXX.XXX.112&#xA;&#xA;/ip route&#xA;add distance=1 gateway=XXX.XXX.XXX.113&#xA;add distance=1 dst-address=1.2.1.0/24 gateway=172.16.1.1&#xA;add distance=1 dst-address=1.2.3.0/24 gateway=172.16.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Secondary3 mikrotik configuration&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface pptp-client&#xA;add add-default-route=no allow=mschap1,mschap2 connect-to=XXX.XXX.XXX.115 dial-on-demand=no disabled=no keepalive-timeout=60 max-mru=1450 \&#xA;    max-mtu=1450 mrru=disabled name=pptp-out1 password=123 profile=default-encryption user=secondary3&#xA;&#xA;/ip address&#xA;add address=1.2.3.1/24 interface=bridge-local network=1.2.3.0&#xA;add address=XXX.XXX.XXX.116/29 interface=ether1-gateway network=XXX.XXX.XXX.112&#xA;&#xA;/ip route&#xA;add distance=1 gateway=XXX.XXX.XXX.113&#xA;add distance=1 dst-address=1.2.1.0/24 gateway=172.16.1.1&#xA;add distance=1 dst-address=1.2.2.0/24 gateway=172.16.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Secondary2 see's Main1, but not see's secondary3&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[secondary2 ] /ping 1.2.1.1 ... ok&#xA;[secondary2 ] /ping 1.2.3.1 ... timeout&#xA;&#xA;[secondary2 ] /tool traceroute 1.2.3.1&#xA;  # ADDRESS                          LOSS SENT    LAST&#xA;  1 172.16.1.1                         0%    1     2ms&#xA;  2                                  100%    1 timeout&#xA;  ...&#xA;&#xA;[secondary2 ] /ip address print  &#xA;  Flags: X - disabled, I - invalid, D - dynamic &#xA;  #   ADDRESS            NETWORK         INTERFACE                                                                                          &#xA;  0   1.2.2.1/24         1.2.2.0         bridge-local                                                                                       &#xA;  1   XXX.XXX.XXX.117/29   XXX.XXX.XXX.112   ether1-gateway                                                                                     &#xA;  2 D 172.16.1.2/32      172.16.1.1      pptp-out1  &#xA;&#xA;&#xA;[secondary2 ] /ip route print&#xA;  Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, &#xA;  B - blackhole, U - unreachable, P - prohibit &#xA;   #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE&#xA;   0 A S  0.0.0.0/0                          XXX.XXX.XXX.113             1&#xA;   1 A S  1.2.1.0/24                         172.16.1.1                1&#xA;   2 ADC  1.2.2.0/24         1.2.2.1         bridge-local              0&#xA;   3 A S  1.2.3.0/24                         172.16.1.1                1&#xA;   4 ADC  XXX.XXX.XXX.112/29   XXX.XXX.XXX.117   ether1-gateway            0&#xA;   5 ADC  172.16.1.1/32      172.16.1.2      pptp-out1                 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Secondary3 see's Main1, but not see's secondary2&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[secondary3 ] /ping 1.2.1.1 ... ok&#xA;[secondary3 ] /ping 1.2.2.1 ... timeout&#xA;&#xA;[secondary3 ] /tool traceroute 1.2.2.1&#xA;  # ADDRESS                          LOSS SENT    LAST&#xA;  1 172.16.1.1                         0%    1     2ms&#xA;  2                                  100%    1 timeout&#xA;  ...&#xA;&#xA;[secondary3 ] /ip address print  &#xA; Flags: X - disabled, I - invalid, D - dynamic &#xA; #   ADDRESS            NETWORK         INTERFACE                                                                                          &#xA; 0   1.2.3.1/24         1.2.3.0         bridge-local                                                                                       &#xA; 1   XXX.XXX.XXX.116/29   XXX.XXX.XXX.112   ether1-gateway                                                                                     &#xA; 2 D 172.16.1.3/32      172.16.1.1      pptp-out1&#xA;&#xA;&#xA;[secondary3 ] /ip route print&#xA; Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, &#xA; B - blackhole, U - unreachable, P - prohibit &#xA;  #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE&#xA;  0 A S  0.0.0.0/0                          XXX.XXX.XXX.113             1&#xA;  1 A S  1.2.1.0/24                         172.16.1.1                1&#xA;  2 A S  1.2.2.0/24                         172.16.1.1                1&#xA;  3 ADC  1.2.3.0/24         1.2.3.1         bridge-local              0&#xA;  4 ADC  XXX.XXX.XXX.112/29   XXX.XXX.XXX.116   ether1-gateway            0&#xA;  5 ADC  172.16.1.1/32      172.16.1.3      pptp-out1                 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Main1 see's both&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[main1 ] /ping 1.2.2.1 ... ok (mikrotik secondary2)&#xA;[main1 ] /ping 1.2.2.2 ... ok (bd_server secondary2)&#xA;[main1 ] /ping 1.2.3.1 ... ok (mikrotik secondary3)&#xA;[main1 ] /ping 1.2.3.2 ... ok (bd_server secondary3)&#xA;&#xA;[main1 ] /tool traceroute 1.2.3.2&#xA;  # ADDRESS                          LOSS SENT    LAST     AVG    BEST   WORST STD-DEV STATUS                                               &#xA;  1 172.16.1.3                         0%    3   0.6ms     0.7     0.6     0.8     0.1                                                      &#xA;  2 1.2.3.2                            0%    3   0.6ms     0.8     0.6     1.3     0.3&#xA;&#xA;[main1 ] /ip address print&#xA;  Flags: X - disabled, I - invalid, D - dynamic &#xA;  #   ADDRESS            NETWORK         INTERFACE                                                                                          &#xA;  0   1.2.1.1/24         1.2.1.0         bridge-local                                                                                       &#xA;  1   XXX.XXX.XXX.115/29   XXX.XXX.XXX.112   ether1-gateway                                                                                     &#xA;  2 D 172.16.1.1/32      172.16.1.3      &amp;lt;pptp-secondary3&amp;gt;                                                                                      &#xA;  3 D 172.16.1.1/32      172.16.1.2      &amp;lt;pptp-secondary2&amp;gt;   &#xA;&#xA;[main1 ] /ip firewall filter&amp;lt;SAFE&amp;gt; /ip route print&#xA;  Flags: X - disabled, A - active, D - dynamic, C - connect, S - static, r - rip, b - bgp, o - ospf, m - mme, &#xA;  B - blackhole, U - unreachable, P - prohibit &#xA;  #      DST-ADDRESS        PREF-SRC        GATEWAY            DISTANCE&#xA;  0 A S  0.0.0.0/0                          XXX.XXX.XXX.113             1&#xA;  1 ADC  1.2.1.0/24         1.2.1.1         bridge-local                  0&#xA;  2 A S  1.2.2.0/24                         172.16.1.2                    2&#xA;  3 A S  1.2.3.0/24                         172.16.1.3                    2&#xA;  4 ADC  XXX.XXX.XXX.112/29   XXX.XXX.XXX.115   ether1-gateway                0&#xA;  5 ADC  172.16.1.2/32      172.16.1.1      &amp;lt;pptp-secondary2&amp;gt;             0&#xA;  6 ADC  172.16.1.3/32      172.16.1.1      &amp;lt;pptp-secondary3&amp;gt;             0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28091" LastEditorUserId="8499" LastEditDate="2018-02-14T16:21:05.970" LastActivityDate="2018-02-14T16:21:05.970" Title="Why central mikrotik router not routing secondary networks (PPTP VPN)?" Tags="|routing|router|vpn|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-09T23:42:41.357" ContentLicense="CC BY-SA 3.0" />
  <row Id="33393" PostTypeId="1" AcceptedAnswerId="33396" CreationDate="2016-07-23T16:35:02.173" Score="1" ViewCount="1525" Body="&lt;p&gt;I understood that each router maintains an ARP module that stores each client's IP address and associated MAC address. Let's say, there are 512 clients in a router's subnet. When the router gets a datagram from another subnet, it inspects the MAC address in the link layer, and confirms if the datagram's destination lies in it's subnet by checking with the ARP module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is this: How exactly does the packet go to destination host once it reaches the subnet? Is it like this: Router sending that packet to all clients and each client would process that packet only if the MAC address in the packet matches with it's own MAC address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is the case, why should the router maintain an ARP module as in both cases it is broadcasting every packet?&lt;/p&gt;&#xA;" OwnerUserId="28092" LastEditorUserId="8499" LastEditDate="2016-07-23T18:10:02.190" LastActivityDate="2016-07-23T18:10:02.190" Title="How does router find a way to host in its own subnet?" Tags="|router|subnet|mac-address|arp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33395" PostTypeId="2" ParentId="33393" CreationDate="2016-07-23T17:58:40.370" Score="4" Body="&lt;p&gt;You may be confused on a few points:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;when the router gets a datagram from other subnet, it inspects the MAC&#xA;  address in the link layer, and confirms if the datagram's destination&#xA;  lies in it's subnet by checking with the ARP module.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not quite.  A packet received from another interface will  have the MAC address of the router, not the MAC address of the end host (note: there are rare exceptions, but you can ignore that for now). When a router receives a datagram from any subnet, the first thing it does is strip away the layer 2 information and throw it away.  Then it uses the layer 3 information (i.e., IP address) to determine which interface to use, and if the host is directly connected. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If this is the case, why should the router maintain an ARP module as&#xA;  in both cases it is broadcasting every packet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The answer is, obviously, that isn't the case.  The router acts like any other host:  It looks in it's ARP table for the host MAC address, and (in the case of Ethernet) encapsulates the IP packet in an Ethernet frame, with the destination MAC set to the MAC address of the desired host.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-23T17:58:40.370" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33396" PostTypeId="2" ParentId="33393" CreationDate="2016-07-23T17:59:05.603" Score="5" Body="&lt;p&gt;You seem to be confused about a couple of things.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Let's say, there are 512 clients in a router's subnet. when the router&#xA;  gets a datagram from other subnet, it inspects the MAC address in the&#xA;  link layer, and confirms if the datagram's destination lies in it's&#xA;  subnet by checking with the ARP module.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's not how it works. A MAC address is only significant or even seen in the LAN on where the host with that MAC address is. MAC addresses do not cross a router to get to a different LAN. When a router receives a frame with the source and destination MAC addresses, it strips the frame off the packet, losing the original source and destination MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How exactly does the packet go to destination host once it reaches the&#xA;  subnet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When the router has the packet, stripped of the frame containing the source and destination MAC addresses, it will inspect the destination IP address in the packet header, and it will switch the packet to the interface toward the destination. It will then build a new frame for the packet from scratch for the next hop. The next hop may not be ethernet, or any other protocol which uses MAC addresses. If the next hop uses MAC addresses, it will build the frame with its own MAC address for the next ho as the source MAC address, and the MAC address of the destination device (another router or the end host) of the next hop as the destination MAC address.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Router sending that packet to all clients and each client would&#xA;  process that packet only if the MAC address in the packet matches with&#xA;  it's own MAC address? If this is the case, why should the router&#xA;  maintain an ARP module as in both cases it is broadcasting every&#xA;  packet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Any host, even a router, sending a broadcast will send to the broadcast address MAC address, not a specific host MAC address.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Any host (a router is just another host on the LAN) sending an IP packet to another host will compare the masked destination IP address to its own masked source IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If both IP addresses are on the same network, the sending host will inspect its ARP cache to see if it already knows the MAC address associated with the IP address. If it has it in its ARP cache, it will build the frame with that MAC address. If it doesn't have it in its ARP cache, it will send an ARP looking for the MAC address of the destination IP address. If the host with that IP address responds, it will add the MAC address to its ARP cache, and it will use that MAC address to build the frame. If the destination host does not respond, the packet will be dropped, and an error generated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination IP address is on a different network, the sending host will use the MAC address of its configured gateway to build the frame so that the frame containing the packet gets delivered to it configured gateway. It will use its ARP cache or ARP to discover the MAC address of its configured gateway to build the frame.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-23T17:59:05.603" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33397" PostTypeId="1" AcceptedAnswerId="33408" CreationDate="2016-07-23T18:23:04.720" Score="1" ViewCount="8170" Body="&lt;p&gt;Attempting to connect from a PC to an OpenWRT device over Ethernet is giving &quot;no route to host&quot;. I'm working on an OpenWRT port for a new device, so it's possible something isn't configured correctly on that side. What steps can I take to debug this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PC is configured with static IP &lt;code&gt;192.168.1.100&lt;/code&gt; for subnet &lt;code&gt;192.168.1.1/24&lt;/code&gt;, which should match the default OpenWRT settings. When I connect Ethernet, I see LED activity on the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the PC:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ifconfig&#xA;eth2 Link encap:Ethernet HWaddr ec:a8:6b:35:5f:59&#xA;  inet addr:192.168.1.100 Bcast:192.168.1.255 Mask:255.255.255.0&#xA;  inet6 addr: fe80::eea8:6bff:fe35:5f59/64 Scope:Link&#xA;  UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1&#xA;  RX packets:706 errors:0 dropped:0 overruns:0 frame:0&#xA;  TX packets:3094 errors:0 dropped:0 overruns:0 carrier:0&#xA;  collisions:0 txqueuelen:1000&#xA;  RX bytes:241452 (241.4 KB) TX bytes:214343 (214.3 KB)&#xA;&#xA;$ ip route show&#xA;169.254.0.0/16 dev eth2 scope link metric 1000&#xA;192.168.1.0/24 dev eth2 proto kernel scope link src 192.168.1.100 metric 100&#xA;&#xA;$ arp -i eth2&#xA;Address HWtype HWaddress Flags Mask Iface&#xA;192.168.1.96 (incomplete) eth2&#xA;192.168.1.1 (incomplete) eth2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's the &lt;code&gt;(incomplete) HWaddress&lt;/code&gt; about -- does that mean something's wrong with the device's MAC address?&lt;/p&gt;&#xA;" OwnerUserId="27981" LastActivityDate="2016-07-24T00:46:33.677" Title="Debugging &quot;no route to host&quot; over Ethernet" Tags="|ethernet|arp|" AnswerCount="3" CommentCount="4" ClosedDate="2018-11-04T23:46:24.507" ContentLicense="CC BY-SA 3.0" />
  <row Id="33398" PostTypeId="2" ParentId="33397" CreationDate="2016-07-23T18:37:36.680" Score="0" Body="&lt;p&gt;The ICMP message, &quot;no route to host,&quot; means that ARP cannot find the layer-2 address for the destination host. Usually, this means that that the host with that IP address is not online or responding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, instead, you get a timeout, it means that you already have the layer-2 address for the host (in the ARP cache), but the host is not responding. It may not be online, or it may have a firewall blocking whichever protocol you are using, e.g. ICMP for ping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, you seem to have an ARP problem. You could try to use static ARP cache entries for address resolution.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-23T18:37:36.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33399" PostTypeId="1" AcceptedAnswerId="33400" CreationDate="2016-07-23T18:50:43.857" Score="6" ViewCount="2210" Body="&lt;p&gt;When an IPv4 datagram comes to a router for &lt;strong&gt;forwarding&lt;/strong&gt;, does it always update the value of the header checksum field?&lt;/p&gt;&#xA;" OwnerUserId="27896" LastEditorUserId="8499" LastEditDate="2018-03-11T02:00:14.770" LastActivityDate="2024-01-23T17:04:38.350" Title="Must the checksum field of the IPv4 header always be updated?" Tags="|routing|router|ipv4|ip|checksum|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33400" PostTypeId="2" ParentId="33399" CreationDate="2016-07-23T18:58:03.663" Score="11" Body="&lt;p&gt;Since the router changes the IPv4 header (it decrements the TTL), it needs to calculate a new value for the checksum, otherwise subsequent devices receiving the packet will think it is damaged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This only applies to IPv4. IPv6 has eliminated the checksum, instead it relies on protocols above and below it to do any error checking.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-23T18:58:03.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33402" PostTypeId="1" CreationDate="2016-07-23T19:45:42.963" Score="0" ViewCount="259" Body="&lt;p&gt;On a switch running Huawei VRP: What is the safest way to deconfigure a dynamic priority value on a root bridge and then configure a static priority value?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;What's the problem?&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Switch]stp instance 0 priority 20480&#xA;[Switch]stp instance 0 root primary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But I can't do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Switch]stp instance 0 root primary&#xA;[Switch]stp instance 0 priority 20480&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I have to do this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Switch]undo stp instance 0 root&#xA;[Switch]stp instance 0 priority 20480&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the meantime, the bridge has a priority value of 32768.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't assign a priority value because the command is not accepted: &lt;em&gt;Error: Failed to modify priority because the switch is configured as a primary root or secondary root.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, I have three options. None of them are satisfying. 1) Disconnect the bridge from the network and configure it from a terminal. 2) Decrease the priority value on every other bridge below the default value of 32768. 3) Deconfigure and reconfigure as fast as possible and hope for the best.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2016-07-23T20:05:26.250" Title="VRP: Changing a dynamic bridge priority to a static priority value" Tags="|spanning-tree|vrp|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="33403" PostTypeId="2" ParentId="33402" CreationDate="2016-07-23T20:05:26.250" Score="1" Body="&lt;p&gt;When you specify the bridge as a root bridge, you are, in fact, setting the priority -- to a value lower than any other bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't have it both ways:  Either you make the bridge the root and let the switch figure out the best priority value, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;OR, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you want to set a particular priority value, then you can't say it's the root.  It may end up being the root if you set the priority low enough, but that's not guaranteed.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-23T20:05:26.250" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33404" PostTypeId="5" CreationDate="2016-07-23T20:27:58.817" Score="0" Body="&lt;p&gt;&lt;em&gt;Versatile Routing Platform&lt;/em&gt; (VRP) is a network operating system (NOS).&lt;/p&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="3163" LastEditDate="2016-07-23T23:03:07.900" LastActivityDate="2016-07-23T23:03:07.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33405" PostTypeId="4" CreationDate="2016-07-23T20:27:58.817" Score="0" Body="Versatile Routing Platform" OwnerUserId="3163" LastEditorUserId="3163" LastEditDate="2016-07-23T23:03:02.383" LastActivityDate="2016-07-23T23:03:02.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33408" PostTypeId="2" ParentId="33397" CreationDate="2016-07-23T22:37:10.727" Score="2" Body="&lt;p&gt;You asked&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What steps can I take to debug this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You seem to want to access the OpenWRT without going through its console (because you write &quot;should match the default OpenWRT settings&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There can be several causes for your problem.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Your layer 1 may not be OK at all (you say you see LED activity but still)&lt;/li&gt;&#xA;&lt;li&gt;The OpenWRT may have an address you don't expect, or may be looking for a DHCP server on the interface you're connected to&lt;/li&gt;&#xA;&lt;li&gt;The OpenWRT may have a firewall configured&lt;/li&gt;&#xA;&lt;li&gt;There's a bug or incompatibility between your device and OpenWRT&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You have two main options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Debug from the PC. First, connect your PC directly to your OpenWRT with a crossover cable and make sure your port is up (&lt;code&gt;ethtool eth2&lt;/code&gt; should say &lt;code&gt;Link detected: yes&lt;/code&gt;). Start &lt;code&gt;tcpdump -n eth2&lt;/code&gt;. Reboot your OpenWRT. Look at the output to see if it sends anything at all to the network which can help you guess its address. If it sends out packets sourced as 192.168.1.1 but doesn't reply to &lt;code&gt;arping -I eth2 192.168.1.1&lt;/code&gt; then I'd say there's a bug in its Ethernet driver. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use console access to log in and debug from there...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="22874" LastActivityDate="2016-07-23T22:37:10.727" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33409" PostTypeId="2" ParentId="33397" CreationDate="2016-07-24T00:46:33.677" Score="0" Body="&lt;p&gt;&lt;code&gt;arp (incomplete)&lt;/code&gt; mean host still not get reply on arp request and unable to determine MAC address.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-07-24T00:46:33.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33410" PostTypeId="2" ParentId="33391" CreationDate="2016-07-24T01:16:10.693" Score="1" Body="&lt;p&gt;&lt;strong&gt;1. 1.2.0.0/16 is bad address space for LAN, except it really public IP.&lt;/strong&gt; Use private addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2. ping from secondary2 get source IP 172.16.1.2, and secondary3 don't have route to reply (really it reply over default route, whats wrong).&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be fixed in many ways, but simplest for You - add appropriate routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondary2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; /ip route&#xA; add distance=1 gateway=XXX.XXX.XXX.113&#xA; add distance=1 dst-address=1.2.1.0/24 gateway=172.16.1.1&#xA; add distance=1 dst-address=1.2.3.0/24 gateway=172.16.1.1&#xA;&#xA; # missing route&#xA; add distance=1 dst-address=172.16.1.0/24 gateway=172.16.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similar for secindary3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or add preferred-source for routes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondary2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; /ip route&#xA; add distance=1 gateway=XXX.XXX.XXX.113&#xA; add distance=1 dst-address=1.2.1.0/24 gateway=172.16.1.1 preferred-source=1.2.2.1&#xA; add distance=1 dst-address=1.2.3.0/24 gateway=172.16.1.1 preferred-source=1.2.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similar for secindary3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;3. Or just ignore it. It &quot;problem&quot; for routers, not for hosts behind it.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If You need ping for diagnostic, define src-address of LAN router interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ping 1.2.3.1 src-address=1.2.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7539" LastEditorUserId="28091" LastEditDate="2016-07-24T11:45:02.103" LastActivityDate="2016-07-24T11:45:02.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33411" PostTypeId="2" ParentId="27935" CreationDate="2016-07-24T02:26:48.830" Score="0" Body="&lt;p&gt;A router/gateway doing inter-LAN routing needs to have PIM-DM (&quot;Dense Mode&quot;, which assumes that there will be significant clumps of users of the same multicast group and &quot;Cluster-Discovery&quot; seems fitting here).  In the Linux kernel, you will notice that these options don't appear. This is because the protocol itself is handled by a routing application, such as Zebra, mrouted, or pimd. However, you still have to have a good idea of which you're going to use, to select the right options in the kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Re endpoints: You have to tune your radio to hear a program that is transmitted at some specific frequency, in the same way you have to &quot;tune&quot; your kernel to receive packets sent to an specific multicast group. When you do that, it's said that the host has joined that group in the interface you specified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do this using the &lt;code&gt;ip maddr add&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SYNTAX&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip maddr [ add | del ] MULTIADDR dev STRING&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;DESCRIPTION&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It attaches/detaches a static link layer multicast address to listen on the interface. Note that it is impossible to join protocol multicast groups statically. This command only manages link layer addresses.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address LLADDRESS (default)&#xA;    the link layer multicast address. &#xA;dev NAME&#xA;    the device to join/leave this multicast address.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EXAMPLES&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example for a wired connection:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip maddr add ff02::fb dev eth0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example for a wireless connection:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip maddr add 224.0.0.251 dev wlan0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source [&lt;a href=&quot;https://superuser.com/questions/324824/linux-built-in-or-open-source-program-to-join-multicast-group&quot;&gt;Linux built-in or open source program to join multicast group?&lt;/a&gt;]&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2016-07-24T02:32:31.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33415" PostTypeId="2" ParentId="33350" CreationDate="2016-07-24T07:26:16.527" Score="1" Body="&lt;p&gt;Yes, this is &lt;strong&gt;exactly&lt;/strong&gt; what the routing code in a router is doing when you use an SPF routing protocol.  So, for your own network, if you are running an SPF protocol on it, you could run a suitably configured routing daemon on a host that supports it (say Linux).  You need to be very careful that it only listens to the protocol and does not advertise any connectivity, lest you break your entire network (by creating what's poetically called a routing black hole).  Then you can interrogate the link state database in that daemon to see this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are not running an SPF protocol, but rather a DV protocol, then you need a way of extracting the DV data from each and every one of your routers.  It would then have to run something like an SPF algorithm over all that to get what you want.  I don't know of any OTS technology for this, I rolled my own 30 years ago that used a special protocol that ran on our routers to get that DV data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And, finally, if this is &lt;strong&gt;not&lt;/strong&gt; your network, the owners of the network probably consider that information proprietary and getting access to it can involve (gosh) lawyers.&lt;/p&gt;&#xA;" OwnerUserId="6388" LastActivityDate="2016-07-24T07:26:16.527" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33416" PostTypeId="1" AcceptedAnswerId="33622" CreationDate="2016-07-24T07:33:20.490" Score="4" ViewCount="1145" Body="&lt;p&gt;I understand that IANA delegates public IP addresses to five Regional Internet Registries in which ISPs can purchase IPs from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is to stop someone not associated with IANA or any RIR from obtaining and using an IP address themselves (that may or may not have been delegated already)? &lt;/p&gt;&#xA;" OwnerUserId="28100" LastEditorUserId="28100" LastEditDate="2016-07-24T08:53:02.667" LastActivityDate="2016-07-30T17:23:47.970" Title="What prevents someone from obtaining and using a random public IP address?" Tags="|ipv4|ip|ipv6|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33417" PostTypeId="2" ParentId="33300" CreationDate="2016-07-24T07:43:29.017" Score="0" Body="&lt;p&gt;I just found out that the network suppose to be 3G in the contract and that the main router at the costumer HQ site is 3G only , now i need to statically specify the band on each router , however its still a mystery to me why would some SIM cards elevate to 4G while some will lose connectivity if forced to and only work 3G , The gateways them self's by default always prefer 4G , and the ISP Main Service does not mind apparently to route at 4G band between what is suppose to be lower band, and by doing that it creates a separate network.&lt;/p&gt;&#xA;" OwnerUserId="28013" LastActivityDate="2016-07-24T07:43:29.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33418" PostTypeId="2" ParentId="33416" CreationDate="2016-07-24T07:51:55.017" Score="2" Body="&lt;p&gt;Just think about it.  When the IPv4 protocol was originally documented, it specified a 32 bit field for addresses.  As soon as that spec was published (in September of 1981), there were 2^32 (about 4 billion) Internet addresses.  The Internet community needed some way to arbitrate their use, so IANA was created (well actually Jon voluntered, and everyone else said &quot;good, &lt;strong&gt;I&lt;/strong&gt; don't want to do that&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How the space is used in a general way is set by the IETF (carving out the blocks for multicast, for example), but otherwise Jon (as the original IANA) started keeping a list and handing out addresses (originally Class A, B, and C later arbitrary prefixes).  When the net grew and the job became too big for a single central authority, the regional registries came in as an intermediate level.  And later, the job of doing the IANA record keeping was turned over to ICANN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that original set of addresses from 1981 is all there is or ever will be.  That's why we are running out.  The Internet was a much bigger success than anyone in 1981 could have imagined.&lt;/p&gt;&#xA;" OwnerUserId="6388" LastActivityDate="2016-07-24T07:51:55.017" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33419" PostTypeId="1" CreationDate="2016-07-24T08:26:01.233" Score="0" ViewCount="166" Body="&lt;p&gt;Is it possible to implement WPA encrypted wireless network without any predefined secrets like PSK?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example: a coffee shop with WPA-PSK protected network. Everyone who has ever been in the coffee shop knows the passphrase for their network, so they can also capture all the handshakes and use them to decrypt all the traffic, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So could we just remove the redundant PSK? So that handshakes would still be the weak point but all the rest of traffic would still be encrypted?&lt;/p&gt;&#xA;" OwnerUserId="28101" LastActivityDate="2016-07-24T16:24:35.570" Title="Encrypted wireless network without PSK" Tags="|wireless|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33420" PostTypeId="2" ParentId="33416" CreationDate="2016-07-24T08:47:56.930" Score="2" Body="&lt;p&gt;You can use any IP address you want. You most probably can't communicate with anyone outside your network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To ensure proper communication on the internet addresses have to be unique. IANA is the organization in charge of  address assignments. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2016-07-24T08:47:56.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33422" PostTypeId="2" ParentId="9592" CreationDate="2016-07-24T09:41:09.870" Score="1" Body="&lt;p&gt;Media Access Control (MAC) address are the addresses which indicates the physical address from/to you are sending the data. This address is same for all time. For example MAC address of your computer, mobile or any other device is same for all time either you are sending message to Bob or Alice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet protocol (IP) address are different for every node. for example if you are sending message to Bob whose IP is 10.61.1.100. your data will send to Bob through different devices like routers, nodes etc. and every time your destination address will be changed, which will be the address of the next node.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more details I suggest you to read the book &quot;Data communication and Networking by forouzan. &#xA;&lt;a href=&quot;https://hasdiputra.files.wordpress.com/2014/09/data-communication-and-networking-by-behrouz-a-forouzan-4th-edition.pdf&quot; rel=&quot;nofollow&quot;&gt;https://hasdiputra.files.wordpress.com/2014/09/data-communication-and-networking-by-behrouz-a-forouzan-4th-edition.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and one more thing that every time when you change your internet connectivity via modem or any other method you see that your IP address will change every time while your MAC address will be same for all time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I think now your doubt on Logical and physical address is clear now.&lt;/p&gt;&#xA;" OwnerUserId="27257" LastActivityDate="2016-07-24T09:41:09.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33423" PostTypeId="2" ParentId="33416" CreationDate="2016-07-24T10:51:33.237" Score="3" Body="&lt;p&gt;I'm not sure I know what you mean by obtaining an address outside of IANA as there are no means to do this, unless you mean to simply use a public address without it being allocated to you.  If this is what you mean, then you can use any IP address on an internal network if you control the hardware making the routing decisions.  Connecting to the public internet is another matter.  ISPs filter BGP updates with their customers and only allow them to advertise address ranges that they know are allocated to them, so if you cannot advertise the address into BGP then traffic cannot route to you so, so the address would be useless.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-07-24T10:51:33.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33426" PostTypeId="1" AcceptedAnswerId="33484" CreationDate="2016-07-24T12:25:52.363" Score="4" ViewCount="976" Body="&lt;p&gt;I am trying to understand the RTO mechanism. I have read RFC 6298, but it does not specify when the first RTT measurement is made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the following packet exchange&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Client -----Syn-----&gt; Server&lt;/li&gt;&#xA;&lt;li&gt;Client &amp;lt;---Syn+Ack--- Server&lt;/li&gt;&#xA;&lt;li&gt;Client ---Data+Ack--&gt; Server&lt;/li&gt;&#xA;&lt;li&gt;Client &amp;lt;--Data+Ack--- Server&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For the client side, is the first RTT measured after receiving Syn+Ack (#2) or  Data+Ack (#4)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the server side, is it measured after receiving Data+Ack (#3)?&lt;/p&gt;&#xA;" OwnerUserId="23320" LastEditorUserId="8499" LastEditDate="2018-12-26T05:21:26.093" LastActivityDate="2018-12-26T05:21:26.093" Title="For a TCP session, when is the first time an RTT measurement is sampled?" Tags="|tcp|protocol-theory|transport-protocol|layer4|rfc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33428" PostTypeId="1" AcceptedAnswerId="33433" CreationDate="2016-07-24T12:47:44.307" Score="2" ViewCount="614" Body="&lt;p&gt;I would like to know, how the synchonization of &lt;a href=&quot;https://de.wikipedia.org/wiki/Asymmetric_Digital_Subscriber_Line&quot; rel=&quot;nofollow&quot;&gt;ADSL (Asymmetric Digital Subscriber Line)&lt;/a&gt; actually works, something a bridging DSL modem does, for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could only find out very general things about it yet (primarily using &lt;a href=&quot;https://translate.google.de/translate?sl=de&amp;amp;tl=en&amp;amp;js=y&amp;amp;prev=_t&amp;amp;hl=de&amp;amp;ie=UTF-8&amp;amp;u=http%3A%2F%2Fwww.elektronik-kompendium.de%2Fsites%2Fkom%2F0305235.htm&amp;amp;edit-text=&amp;amp;act=url&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt; page), including:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the transmission properties of &lt;a href=&quot;https://en.wikipedia.org/wiki/DSL_modem&quot; rel=&quot;nofollow&quot;&gt;DSL modem&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Digital_subscriber_line_access_multiplexer&quot; rel=&quot;nofollow&quot;&gt;DSLAM&lt;/a&gt; need to be determined using some handshake procedure&lt;/li&gt;&#xA;&lt;li&gt;these parameters include line quality, data rate and latency path (fast/interleaved)&lt;/li&gt;&#xA;&lt;li&gt;the parameters remain until the loss of synchonization (e.g. because of a disconnection or power failure)&lt;/li&gt;&#xA;&lt;li&gt;the process is rather complicated&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But I would really like to get much more specific information, including:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What data is actually transmitted? Is some kind of protocol used you can find a RFC about? Or is it even officially globally standardized from an organization (e.g. IANA/IETF/IEEE)? Is this information publicly available at all? I guess it should not be ISP dependent, because any modem I used in the past was able to synchonize with any ISP.&lt;/li&gt;&#xA;&lt;li&gt;Is it possible for a modem in general to (de)modulate data without any previous synchronization? When the answer is yes, then: If I had a modem that would &lt;i&gt;only&lt;/i&gt; modulate and demodulate data and not synchonize, could I connect it to a normal PC and let the operating system (e.g. Linux) do the synchronization (if it's not part of the kernel, ideally with an open source program)? Regarding data that's transmitted this would of course require answers to questions in the previous block.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am not sure if that's important, but I am using ADSL (yes, ADSL, not ADSL2 or ADSL2+) from the &lt;a href=&quot;https://en.wikipedia.org/wiki/Deutsche_Telekom&quot; rel=&quot;nofollow&quot;&gt;Deutsche Telekom&lt;/a&gt;, the most common German internet service provider.&lt;/p&gt;&#xA;" OwnerUserId="28105" LastActivityDate="2019-12-16T17:50:04.437" Title="How does DSL synchonization actually work?" Tags="|adsl|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33431" PostTypeId="2" ParentId="33419" CreationDate="2016-07-24T15:49:51.003" Score="1" Body="&lt;p&gt;Use WPA(2) Enterprise. This means you will have to install an authentication server using the RADIUS protocol, for example &lt;a href=&quot;http://www.freeradius.org/&quot; rel=&quot;nofollow&quot;&gt;FreeRADIUS&lt;/a&gt;. But each user will then have its own password (or other means of authentication if you want). &#xA;See also &lt;a href=&quot;https://wiki.archlinux.org/index.php/WPA2_Enterprise&quot; rel=&quot;nofollow&quot;&gt;this post&lt;/a&gt; for more information.&lt;/p&gt;&#xA;" OwnerUserId="27606" LastActivityDate="2016-07-24T15:49:51.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33433" PostTypeId="2" ParentId="33428" CreationDate="2016-07-24T16:17:22.573" Score="5" Body="&lt;p&gt;The ITU define the standard for basic ADSL in G.922.1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.itu.int/rec/T-REC-G.992.1/en&quot; rel=&quot;noreferrer&quot;&gt;https://www.itu.int/rec/T-REC-G.992.1/en&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also a USA version defined by ANSI, T1.413&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-07-24T16:27:51.917" LastActivityDate="2016-07-24T16:27:51.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33434" PostTypeId="2" ParentId="33419" CreationDate="2016-07-24T16:24:35.570" Score="1" Body="&lt;p&gt;There are various ways you can have encryption without using a single widely-known PSK, but you'll need some sort of extra step by the users to actually make use of it by getting some form of credentials. I have seen at least two ways to do this :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Provide a username / password (managed in some sort of directory / guest infrastructure such as FreeRadius or Cisco ISE) that you then use with MSCHAPv2 for example. You either pre-generate them and pass them out, or provide a self-sponsorship portal through which they can obtain them autonomously. The main problem is that the necessary settings can be tricky to find and make sense of. IOS makes it easy, Android is already noticeably worse and Windows is not fun at all.&lt;/li&gt;&#xA;&lt;li&gt;Use a proprietary approach such as Aerohive's Private PSK (each user gets their own unique PSK). This is simpler for users as they enter it in their device like they would a PSK at home, however it does tie you to a single vendor, and you still need the user to go through a portal, and possibly provide some rather obscure information (e.g. MAC address).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;On the other hand, I think it's less and less clear that wifi-level encryption on a public/guest network is all that useful since most apps that really need the encryption already provide it at their own level, typically through HTTPS. The era of unencrypted passwords passing over raw POP3 or HTTP for example is (thankfully) nearly past us I think.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-07-24T16:24:35.570" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33437" PostTypeId="2" ParentId="29933" CreationDate="2016-07-24T17:47:39.987" Score="0" Body="&lt;p&gt;You might look at Cisco Anyconnect automatic login vs DirectConnect.  In terms of ASA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/security/adaptive-security-virtual-appliance-asav/datasheet-c78-733399.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Adaptive Security Virtual Appliance (ASAv) Data Sheet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;Adaptive Security Virtual Appliance runs as a virtual machine&lt;/strong&gt; inside a hypervisor in a virtual host (Figure 1). Most of the features that are supported on a physical ASA by Cisco software are supported on the virtual appliance as well, except for clustering and multiple contexts. The virtual appliance supports site-to-site VPN, remote-access VPN, and clientless VPN functionalities as supported by physical ASA devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/asav/quick-start/asav-quick/intro-asav.html#29596&quot; rel=&quot;nofollow&quot;&gt;Cisco Adaptive Security Virtual Appliance (ASAv) Quick Start Guide, 9.5&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must install a smart license on the ASAv. Until you install a license, throughput is limited to 100 Kbps so you can perform preliminary connectivity tests. A smart license is required for regular operation.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-24T17:47:39.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33438" PostTypeId="2" ParentId="28668" CreationDate="2016-07-24T17:48:38.547" Score="1" Body="&lt;p&gt;How many devices need to be connected?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not too, crazy solution to connect network cards directly by patch-cord.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But PTP require ultra low jitter, rather latency time. What with network adapter buffers.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-07-24T17:48:38.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33439" PostTypeId="2" ParentId="20287" CreationDate="2016-07-24T20:03:31.703" Score="1" Body="&lt;p&gt;What you're saying is correct, I can't see any reason it would require a default gateway unless there is something either misconfigured or a bug.  You should not need a default gateway if you are on the same network.  Did you see anything in the ARP cache on your PC or switch before you changed the default gateway?&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-07-24T20:03:31.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33441" PostTypeId="1" CreationDate="2016-07-24T21:31:36.980" Score="2" ViewCount="62" Body="&lt;p&gt;In the context of HPC interconnect networks (Infiniband, OmniPath, ...), I've come across the notion of the &lt;em&gt;N½ value&lt;/em&gt; of the network, which is supposedly some performance number.  What is this number?  I could not find anything related with my search engine mojo ...&lt;/p&gt;&#xA;" OwnerUserId="28113" LastActivityDate="2016-07-24T21:45:36.887" Title="What is the N½ value of a network?" Tags="|bandwidth|speed|performance|topology|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33442" PostTypeId="2" ParentId="33441" CreationDate="2016-07-24T21:39:08.850" Score="1" Body="&lt;p&gt;I think you are seeing the bisection width. An equal bisection is N1/2. You could also have something like N1/3 and N2/3. A bisection of N1/2 implies that there are an equal number of end-devices on each side of the bisection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You bisect a network to look at the bandwidth over-subscription between the two sides. Ideally you want to be able to bisect the network and have a 1:1 ratio between the cumulative access bandwidth on one side with the bandwidth available to get the traffic to the other side. The problem with that is that it can be prohibitively expensive, or even impossible to achieve with the current network topology. The point is that you need to understand the over-subscription in order to take it into account and understand your network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-24T21:45:36.887" LastActivityDate="2016-07-24T21:45:36.887" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33444" PostTypeId="1" AcceptedAnswerId="33445" CreationDate="2016-07-25T00:24:01.120" Score="1" ViewCount="4409" Body="&lt;pre&gt;&lt;code&gt;6509#ping 23.6.1.111 size 500 rep 100&#xA;Type escape sequence to abort.&#xA;Sending 100, 500-byte ICMP Echos to 23.6.1.111, timeout is 2 seconds:&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&#xA;Success rate is 100 percent (100/100), round-trip min/avg/max = 1/2/8 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;looking at the first packet and the last packet&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -X -vv -n -r r.pcap | grep 01:10: |  (head -n1 &amp;amp;&amp;amp; tail -n1)&#xA;reading from file r.pcap, link-type EN10MB (Ethernet)&#xA;01:10:16.847774 IP (tos 0x0, ttl 255, id 6517, offset 0, flags [none], proto ICMP (1), length 500)&#xA;01:10:17.011485 IP (tos 0x0, ttl 64, id 15139, offset 0, flags [none], proto ICMP (1), length 500)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;first frame arrived at 01:10:16.847774&#xA;last frame at 01:10:17.011485&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;&amp;gt;&amp;gt; from datetime import datetime&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&amp;gt;&amp;gt;&amp;gt; d1 = datetime.strptime(&quot;2222-01-01 01:10:16.8477&quot;, &quot;%Y-%m-%d %H:%M:%S.%f&quot;)&#xA;&amp;gt;&amp;gt;&amp;gt; d2 = datetime.strptime(&quot;2222-01-01 01:10:17.0114&quot;, &quot;%Y-%m-%d %H:%M:%S.%f&quot;)&#xA;&amp;gt;&amp;gt;&amp;gt;&#xA;&amp;gt;&amp;gt;&amp;gt; print(d2 - d1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;0:00:00.163700&lt;/p&gt;&#xA;&#xA;&lt;p&gt;seems that Cisco is rounding to 2 in average, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark gets closer to the python output&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/knF8J.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/knF8J.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but what do they mean about 8 ms ?&#xA;the time it took from the first packet to the last packet job process time to finish?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is there any way in wireshark for obtaining this value?&lt;/p&gt;&#xA;" OwnerUserId="22285" LastActivityDate="2016-07-25T00:31:52.847" Title="what do they mean about round-trip max?" Tags="|cisco|wireshark|ping|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33445" PostTypeId="2" ParentId="33444" CreationDate="2016-07-25T00:31:52.847" Score="0" Body="&lt;p&gt;A ping consists of an ICMP echo request from the host where you run the ping command, and it is done when that same host receives an ICMP echo reply from the target host. The time it takes for this to happen is reported as the round-trip time in ms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;round-trip min/avg/max&lt;/code&gt; mean that among all the ping tests, the fastest only took 1 ms, the longest took 8 ms, and the average of all the test times was 2 ms. You may have had multiple tests which took 8 ms, but none took more than 8 ms. Of course, these numbers are rounded to the nearest ms.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-25T00:31:52.847" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="33446" PostTypeId="1" CreationDate="2016-07-25T01:37:09.180" Score="0" ViewCount="687" Body="&lt;p&gt;&lt;strong&gt;Here's the challenge:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be installing 10 TV screens into 10 different locations in my city. These are WiFi-enabled smart TV's that can be controlled via a software called MDC (Multi Display Control). MDC can only connect to screens that are on the same LAN. The problem is that I need to control all of them from a remote location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be able to use the locations WiFi, but will not have access to their router settings. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I've come up with:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not a network engineer, but I have been around computers for a while. This is my potential solution...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe that I will need to create a VPN. The &quot;smart TV's&quot; can connect via WiFi or Ethernet and have basic network settings (IP, Subnet Mask, Router and Proxy Server). I will need some sort of bridge between the screen and the location's router. I think configuring a Raspberry Pi as a VPN client will be the simplest solution.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Each TV will connect to a Raspberry Pi via Ethernet.&lt;/li&gt;&#xA;&lt;li&gt;The Pi's will be connected via WiFi to the location's router.&lt;/li&gt;&#xA;&lt;li&gt;The Pi's will be configured to connect to a VPN.&lt;/li&gt;&#xA;&lt;li&gt;On my end, I would set up the VPN server on my network using OpenVPN.&lt;/li&gt;&#xA;&lt;li&gt;Connect with using MDC to the screens that now show up on my local network.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I've never done something like this before, do you think this could work? Is there an easier solution?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;main limitations&lt;/strong&gt; are very little control over the various location's networks, provided only SSID + PW. Visiting the location to make changes at a later time will be extremely difficult. So, ideally, the VPN is hosted elsewhere and I connect to it with the MDC-host computer. That way, if the VPN server changes, I don't have to reconfigure all the Pi's. I'm on a budget too, so low cost is important.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm &lt;em&gt;sure&lt;/em&gt; that this can be done, but have very little idea about the most effective way to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how to improve my idea? Is there a much better way to accomplish this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your time!&lt;/p&gt;&#xA;" OwnerUserId="28116" LastActivityDate="2016-08-24T18:36:13.480" Title="How can I connect devices on multiple networks to one VPN to control them remotely?" Tags="|vpn|subnet|" AnswerCount="2" CommentCount="2" ClosedDate="2019-02-28T20:51:53.073" ContentLicense="CC BY-SA 3.0" />
  <row Id="33447" PostTypeId="1" AcceptedAnswerId="33448" CreationDate="2016-07-25T02:01:28.793" Score="2" ViewCount="195" Body="&lt;p&gt;How would a host with multiple NICs be presented on its local switch's MAC address table? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are multiple MAC addresses from a single port in the MAC table, how do we know whether that port is connected to a hub or host with multiple NICs?&lt;/p&gt;&#xA;" OwnerUserId="21879" LastEditorUserId="8499" LastEditDate="2018-03-07T19:23:49.527" LastActivityDate="2018-03-07T19:23:49.527" Title="MAC Address Table for multiple NICs" Tags="|switch|switching|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33448" PostTypeId="2" ParentId="33447" CreationDate="2016-07-25T02:09:43.430" Score="4" Body="&lt;p&gt;The MAC address table of a switch is organized by MAC address, not by port. The switch looks at the table to find the MAC address so that it can see which port should be used for traffic destined to that MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch has no idea if other MAC addresses came in on that port, too; that's not the point. The only thing a switch needs to know is to which port it should send traffic destined for that MAC address. It doesn't matter if the device on the other end is another switch, a hub, and end-device, or something else. The switch doesn't care what sort of device is connected to the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some devices can use CDP or LLDP to communicate more information about themselves to the devices to which they are connected. This would need to be supported and enabled on the devices on both ends of a link. For instance, Cisco devices can use CDP, and if it is enabled on your Cisco devices on both ends of a link, you can see what is connected to the other end of the link with the &lt;code&gt;show cdp neighbor&lt;/code&gt; command.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-25T02:09:43.430" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33449" PostTypeId="1" AcceptedAnswerId="33477" CreationDate="2016-07-25T05:34:28.160" Score="2" ViewCount="1910" Body="&lt;p&gt;Am dealing ASA first time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to install aplplication in my server and it needs some ports to be open in firewall.&#xA;so i  need to open tcp,udp,http,https,ssl ports.&#xA;How can i configure this on Cisco ASA 5512?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;am going to place the server inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i have this access list in my firewall&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list broadband extended permit ip X.0.0.0 255.0.0.0 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to update the application from outside.&lt;/p&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="21915" LastEditDate="2016-07-25T11:31:40.860" LastActivityDate="2016-07-25T18:10:51.893" Title="How can i open a group of ports in ASA 5512?" Tags="|cisco|cisco-asa|firewall|security|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33450" PostTypeId="1" CreationDate="2016-07-25T05:57:54.990" Score="0" ViewCount="938" Body="&lt;p&gt;I am behind my router.still file is uploading from my side how it's possible ;I think no one can request me;&lt;/p&gt;&#xA;" OwnerUserId="28120" LastActivityDate="2016-07-25T06:15:36.060" Title="How torrent work behind NAT" Tags="|nat|" AnswerCount="1" CommentCount="0" ClosedDate="2016-07-25T09:08:08.843" ContentLicense="CC BY-SA 3.0" />
  <row Id="33451" PostTypeId="2" ParentId="33450" CreationDate="2016-07-25T06:15:36.060" Score="1" Body="&lt;p&gt;No one can &lt;em&gt;connect&lt;/em&gt; directly to you, without a pinhole (or UPnP creating one.) However that does not mean you cannot connect to other peers who can then request data from you.&lt;/p&gt;&#xA;" OwnerUserId="619" LastActivityDate="2016-07-25T06:15:36.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33453" PostTypeId="1" AcceptedAnswerId="33462" CreationDate="2016-07-25T07:33:44.657" Score="0" ViewCount="185" Body="&lt;p&gt;We use Netflow to control traffic, when i want to resolve the IP addresses from netflow's outside destinations list, i get local google cache server's IP address, never the web sites that users has visited, how do i find out the actual web site that user has visited? &lt;/p&gt;&#xA;" OwnerUserId="27132" LastEditorUserId="8499" LastEditDate="2018-03-19T17:48:59.067" LastActivityDate="2018-03-19T17:48:59.067" Title="resolving IP address to FQDN effectively" Tags="|ip-address|dns|netflow|" AnswerCount="1" CommentCount="0" ClosedDate="2019-01-13T00:23:05.970" ContentLicense="CC BY-SA 3.0" />
  <row Id="33458" PostTypeId="1" AcceptedAnswerId="33459" CreationDate="2016-07-25T07:47:45.033" Score="1" ViewCount="107" Body="&lt;p&gt;I have a small network i use to redistribute internet. Now from what i kniw , routers usually map a network depending on which port its connected to. They work at Layer 3. We have been having an issue whereby we found most of our packets were being dropped...we solved it, it was a faulty switch, Long story short. A colleague has tried suggesting that someone using a software i.e connectify ,was using our gateway address 10.0.0.1 as a static ip therefore creating chaos. We saw the ip logged in the hotspot software we use. Now i dont think this is possible. But can that confuse a switch. if it stores two Mac addresses that point to the same place? &lt;/p&gt;&#xA;" OwnerUserId="25610" LastActivityDate="2016-07-26T09:14:33.110" Title="Static IP affecting my Network" Tags="|switch|router|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33459" PostTypeId="2" ParentId="33458" CreationDate="2016-07-25T08:35:47.060" Score="3" Body="&lt;p&gt;It is not possible for a switch to have a MAC address assigned to more than 1 port. When a MAC address is seen on a new port the switch simply updates its records to show the MAC is on the new port, overriding the old entry. Loops can cause the switch to do this at an excessive rate and is called a mac address flap. Usually switches will log mac address flaps to the buffer/console. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand you correctly then you are saying that your default gateway address is 10.0.0.1 and someone else also assigned their computer 10.0.0.1. That wouldn't confuse a switch as a switch doesn't care what IP you have, a switch works at layer 2 and deals exclusively with MAC addresses. What is more likely is that due to the duplicate IP address, some of your clients were ARPing for 10.0.0.1 and receiving the real routers MAC address and some were receiving the 10.0.0.1 clone MAC address and sending traffic there instead of the router. Any traffic going to the clone would have been dropped. Any traffic going to the router would have been forwarded (assuming its configured correctly). This could give the impression that the switch or router is dropping packets but in reality the switch is just forwarding the traffic to the destination MAC address that the clients requested.&lt;/p&gt;&#xA;" OwnerUserId="23560" LastEditorUserId="23560" LastEditDate="2016-07-26T09:14:33.110" LastActivityDate="2016-07-26T09:14:33.110" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33461" PostTypeId="1" CreationDate="2016-07-25T11:24:18.620" Score="1" ViewCount="131" Body="&lt;p&gt;I am looking for information about how to implement IPV6 L3VPN over MP-BGP IPV6 but i can see only IPV6 L3VPN over MP-BGP IPV4 (dual stack). &#xA;When I implement ipv6 l3vpn over mp-bgp ipv4, I activate address-family vpnv6 under ipv4 neighbor, but I can't see vpnv6 under ipv6 neighbor.&lt;/p&gt;&#xA;" OwnerUserId="28127" LastActivityDate="2024-01-28T17:38:14.077" Title="Can I run IPV6 L3VPN over MP-BGP IPV6?" Tags="|cisco|ipv6|mpls|" AnswerCount="0" CommentCount="3" ClosedDate="2024-01-28T18:19:47.037" ContentLicense="CC BY-SA 3.0" />
  <row Id="33462" PostTypeId="2" ParentId="33453" CreationDate="2016-07-25T11:27:50.437" Score="1" Body="&lt;p&gt;The web site URL is not a network or transport-layer entity.  It is visible only at the application layer and may be encrypted anyway.  Don't forget that a URL can resolve to many IP addresses, and a single IP address may be used for multiple web servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most reliable way to understand what sites are visited is to use a web proxy.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-07-25T11:27:50.437" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33465" PostTypeId="2" ParentId="30517" CreationDate="2016-07-25T15:02:19.747" Score="2" Body="&lt;p&gt;Many switches (smart ones) can do bandwidth limiting on a per-port basis - this is a robust, distributed method of limiting BW from a provider perspective for port-connected clients. Since most switches that have SFPs are also &quot;smart switches&quot; I'd guess it's most common.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've never heard of it as a DHCP function (...and I have a fiber network.) For mobile clients (not fixed to a port) it's often rolled into a captive portal arrangement. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some SDN systems (UniFi, for example) can apply a limit on a per user basis without a captive portal setup, but that's &lt;em&gt;not really the DHCP server doing it&lt;/em&gt; (it might depend on the DHCP server telling the system that client X has connected to port Y, or to wireless SSID Q on AP Z.)&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-07-25T15:02:19.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33466" PostTypeId="1" CreationDate="2016-07-25T15:40:40.517" Score="0" ViewCount="819" Body="&lt;p&gt;If anyone could help me with this basic expect script because it would make my life easier as a networkin engineer.I'm not a good Linux user because i don't use it often but i need to be able to make a basic expect script.You can see underneath my simple example to use only &quot;sh ip int br&quot; command.I would use the same logic to enter in config mode to use other commands but my biggest problem is that i'm not able to login in to my router at all. I would highly appreciate your help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.I've made the script like you can see underneath&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/expect&#xA;&#xA;set username elio&#xA;set password hgkjtjwowq&#xA;set host 172.16.12.254&#xA;&#xA;spawn telnet $host&#xA;expect &quot;login:&quot;&#xA;send &quot;$username\r&quot;&#xA;expect &quot;Password:&quot;&#xA;send &quot;$password\r&quot;&#xA;expect &quot;Nexus1#&quot;&#xA;send &quot;sh ip int br\r&quot;&#xA;expect &quot;Nexus1#&quot;&#xA;send &quot;exi\r&quot;&#xA;expect eof&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;2.I've checked where is my script located&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;elio@mabu-199:~$ whereis expect&#xA;expect: /usr/bin/expect /usr/bin/X11/expect /usr/share/man/man1/expect.1.gz&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;3.You can see when i run the script i receive the following infosl&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;elio@mabu-199:~$ ./testscript.exp&#xA;./testscript.exp: line 8: spawn: command not found&#xA;couldn't read file &quot;login:&quot;: no such file or directory&#xA;./testscript.exp: line 10: send: command not found&#xA;couldn't read file &quot;Password:&quot;: no such file or directory&#xA;./testscript.exp: line 12: send: command not found&#xA;couldn't read file &quot;Nexus1#&quot;: no such file or directory&#xA;./testscript.exp: line 14: send: command not found&#xA;couldn't read file &quot;Nexus1#&quot;: no such file or directory&#xA;./testscript.exp: line 16: send: command not found&#xA;couldn't read file &quot;eof&quot;: no such file or directory&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would appreciate your help .Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="28132" LastEditorUserId="8499" LastEditDate="2016-07-25T15:42:25.407" LastActivityDate="2016-07-25T15:57:28.923" Title="Basic expect script issue" Tags="|routing|" AnswerCount="1" CommentCount="1" ClosedDate="2018-05-27T00:36:57.250" ContentLicense="CC BY-SA 3.0" />
  <row Id="33468" PostTypeId="2" ParentId="33466" CreationDate="2016-07-25T15:57:28.923" Score="1" Body="&lt;p&gt;I guess you need to change the first line of your script, and add -f at the end. Then, it must look like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/expect -f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The -f tells to &quot;Expect&quot; that it will be reading commands from a file, your script.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-07-25T15:57:28.923" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33469" PostTypeId="1" AcceptedAnswerId="33470" CreationDate="2016-07-25T16:45:21.087" Score="3" ViewCount="2152" Body="&lt;p&gt;I would like to understand the difference between overlay networks and VPN? As far as I understand, they are based on virtual connection establishment between endpoints. How do they differ then?&lt;/p&gt;&#xA;" OwnerUserId="19174" LastActivityDate="2016-07-25T18:01:44.697" Title="Overlay Network and VPN" Tags="|cisco|vpn|frame-relay|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33470" PostTypeId="2" ParentId="33469" CreationDate="2016-07-25T16:51:43.657" Score="2" Body="&lt;p&gt;An overlay network may include encryption of payload.  VPN's are a type of overlay network that &lt;em&gt;usually&lt;/em&gt; includes payload encryption.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VPN security model provides: [&lt;a href=&quot;https://en.wikipedia.org/wiki/Virtual_private_network#Security_mechanisms&quot; rel=&quot;nofollow&quot;&gt;Wikipedia&lt;/a&gt;]&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Confidentiality such that even if the network traffic is sniffed at&#xA;  the packet level (see network sniffer and Deep packet inspection), an&#xA;  attacker would only see encrypted data.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Some overlay networks include the term VPN but do not meet the above requirement of the VPN security model.  An example would be 'MPLS VPN'.  That is why you see many MPLS VPN customers apply encryption using their edge gateways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also &lt;a href=&quot;http://www.cisco.com/c/en/us/about/press/internet-protocol-journal/back-issues/table-contents-18/what-is-a-vpn.html&quot; rel=&quot;nofollow&quot;&gt;What Is a VPN? - Part I - The Internet Protocol Journal - Volume 1, No. 1&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The term &quot;VPN,&quot; or Virtual Private Network, has become almost as&#xA;  recklessly used in the networking industry as has &quot;QoS&quot; (Quality of&#xA;  Service) to describe a broad set of problems and &quot;solutions,&quot; when the&#xA;  objectives themselves have not been properly articulated. This&#xA;  confusion has resulted in a situation where the popular trade press,&#xA;  industry pundits, and vendors and consumers of networking technologies&#xA;  alike generally use the term VPN as an offhand reference for a set of&#xA;  different technologies.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/about/press/internet-protocol-journal/back-issues/table-contents-19/what-is-a-vpn.html&quot; rel=&quot;nofollow&quot;&gt;What Is a VPN - Part II - The Internet Protocol Journal - Volume 1, No. 2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So what is a virtual private network? As we have discussed, a VPN can&#xA;  take several forms. A VPN can be between two end systems, or it can be&#xA;  between two or more networks. A VPN can be built using tunnels or&#xA;  encryption (at essentially any layer of the protocol stack), or both,&#xA;  or alternatively constructed using MPLS or one of the “virtual router”&#xA;  methods. A VPN can consist of networks connected to a service&#xA;  provider’s network by leased lines, Frame Relay, or ATM, or a VPN can&#xA;  consist of dialup subscribers connecting to centralized services or&#xA;  other dialup subscribers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-07-25T18:01:44.697" LastActivityDate="2016-07-25T18:01:44.697" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33472" PostTypeId="2" ParentId="30517" CreationDate="2016-07-25T17:00:27.000" Score="1" Body="&lt;p&gt;An Service Provider's last mile connection is actually 2 paths - an uplink and downlink.  A property of some last mile technologies such as aDSL is a difference in bandwidth between the two, in a T1 they are the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP is in total control of the downlink, the download speed.  As for the upload bandwidth, they can control it by shaping or policing traffic passing their edge gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The concept of ingress and egress QoS might point you to some good search results as well.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-07-26T17:17:03.033" LastActivityDate="2016-07-26T17:17:03.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33473" PostTypeId="2" ParentId="29923" CreationDate="2016-07-25T17:42:04.433" Score="0" Body="&lt;p&gt;An SNMP server collects traps from SNMP agents running on managed devices which could be networking devices such as a switch or a server.  Setup typically requires installing a network management server which will have the SNMP server functionality and then configuring the agent to talk to the server.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-25T17:42:04.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33474" PostTypeId="2" ParentId="33446" CreationDate="2016-07-25T17:45:35.310" Score="1" Body="&lt;p&gt;You are going to need to put a VPN gateway at each TV since todays SmartTV's do not have VPN client functionality (as far as I know).  You can roll your own with Raspberry PI, or you can buy very cheap ones that are ready to go.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-25T17:45:35.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33476" PostTypeId="1" AcceptedAnswerId="33504" CreationDate="2016-07-25T17:56:52.220" Score="1" ViewCount="1093" Body="&lt;p&gt;Let's say I have one vlan on one switch and another vlan on another switch (2 EX2200 Juniper). I have a trunk between the two switches on which both vlans are members. What do I need to do to allow the two vlans to communicate in terms of layer 3 stuff? What routing config needs to be done? &lt;/p&gt;&#xA;" OwnerUserId="27412" LastEditorUserId="8499" LastEditDate="2018-12-21T05:04:13.737" LastActivityDate="2018-12-21T05:04:13.737" Title="Ping over Trunk Port Juniper" Tags="|routing|vlan|juniper|layer3|ping|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33477" PostTypeId="2" ParentId="33449" CreationDate="2016-07-25T18:10:51.893" Score="4" Body="&lt;p&gt;You need to configure Access Rules.  Below is an example to get you started.  You need to build yours to suit your needs.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname(config)# access-list outside_access extended permit tcp any object inside-server1 eq www&#xA;hostname(config)# access-group outside_access in interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa96/configuration/firewall/asa-96-firewall-config/access-rules.html#ID-2124-00000004&quot; rel=&quot;nofollow&quot;&gt;CLI Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.6&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Controlling Network Access&lt;/strong&gt;&#xA;Access rules determine which traffic is allowed through the ASA. There are several different layers of rules that work together to implement your access control policy:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Extended access rules (Layer 3+ traffic) assigned to interfaces—You&#xA;can apply separate rule sets (ACLs) in the inbound and outbound&#xA;directions. An extended access rule permits or denies traffic based&#xA;on the source and destination traffic criteria.&lt;/li&gt;&#xA;&lt;li&gt;Extended access rules assigned globally—You can create a single&#xA;global rule set, which serves as your default access control. The&#xA;global rules are applied after interface rules.&lt;/li&gt;&#xA;&lt;li&gt;Management access rules (Layer 3+ traffic)—You can apply a single&#xA;rule set to cover traffic directed at an interface, which would&#xA;typically be management traffic. In the CLI, these are “control&#xA;plane” access groups. For ICMP traffic directed at the device, you&#xA;can alternatively configure ICMP rules.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-25T18:10:51.893" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33478" PostTypeId="2" ParentId="33446" CreationDate="2016-07-25T18:19:13.300" Score="2" Body="&lt;p&gt;Yes it possibly works.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configure OpenVPN in TAP (Ethernet emulation) mode.&lt;/li&gt;&#xA;&lt;li&gt;On Raspbery Pi You need to bridge ethernet and OpenVPN.&lt;/li&gt;&#xA;&lt;li&gt;On OpenVPN server, bridge clents to LAN.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To survive VPN server IP change, on Pi use dns name to connect rather IP.&#xA;Buy domain, or use some free domain (many dynamic dns there, but hard to advice).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(Personally I as Mikrotik consultant, prefer cheap USB powered RB. Prise is comparable to Pi. But Pi more flexible and it Your choose.)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-07-25T18:19:13.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33481" PostTypeId="1" CreationDate="2016-07-25T20:23:34.043" Score="10" ViewCount="3642" Body="&lt;p&gt;Does session in &quot;http session&quot; mean the same as in &quot;session layer&quot; in OSI model?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is a http session a session in the context of &quot;session layer&quot; in OSI model?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is a http session only a pair of request and response, or can it be a sequence of multiple pairs of requests and responses? If latter, when is a http session determined to be ended?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="7894" LastEditorUserId="8499" LastEditDate="2018-02-16T03:53:31.533" LastActivityDate="2019-02-06T05:14:42.580" Title="Does session in &quot;http session&quot; mean the same as in &quot;session layer&quot; in OSI model?" Tags="|osi|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33482" PostTypeId="1" AcceptedAnswerId="33483" CreationDate="2016-07-25T20:52:26.953" Score="3" ViewCount="1048" Body="&lt;p&gt;I understand the higher level of TCAM and how it differs from CAM and also RAM. My question is from the architectural point of view. I've read that TCAM search is really faster than RAM due to the parallelism, so TCAM can search for a content for the entire TCAM in parallel fashion in one clock cycle (which is why it is used in Routers). If this is correct, how is searching in RAM performed so I can compare between them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19174" LastActivityDate="2016-07-25T23:39:02.503" Title="Searching in TCAM vs RAM" Tags="|architecture|memory|cpu|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33483" PostTypeId="2" ParentId="33482" CreationDate="2016-07-25T20:59:56.830" Score="1" Body="&lt;p&gt;The best scenario for a RAM search is that you have the data stored in a hash table, and you spend the cycles to calculate the hash, then you must go to that point in the table and read the value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other RAM storage methods, but a full discussion of data structures and searching methods is beyond the scope of this site.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-25T20:59:56.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33484" PostTypeId="2" ParentId="33426" CreationDate="2016-07-25T21:26:38.727" Score="3" Body="&lt;p&gt;RTT is measured when transmitting segments, so there must be data in the sent packet so SYN and SYNACK can't provide a measurement.&#xA;The RFC says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;(5.1) Every time a packet containing data is sent (including a&#xA;retransmission), if the timer is not running, start it running...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So since in your example the client sends the first data then yes #4 acks it and provides a RTT measurement.  Equally the server RTT measurement is made when #4 is acknowledged, a packet that you haven't shown (#5 perhaps)&lt;/p&gt;&#xA;&lt;p&gt;It's in the first TCP RFC, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793#section-3.7&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 793, TRANSMISSION CONTROL PROTOCOL, Section 3.7 Data Communication&lt;/a&gt; says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;An Example Retransmission Timeout Procedure&lt;/p&gt;&#xA;&lt;p&gt;Measure the elapsed time between sending a data octet with a&#xA;particular sequence number and receiving an acknowledgment that&#xA;covers that sequence number (segments sent do not have to match&#xA;segments received).  This measured elapsed time is the Round Trip&#xA;Time (RTT).  Next compute a Smoothed Round Trip Time (SRTT) as:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;SRTT = ( ALPHA * SRTT ) + ((1-ALPHA) * RTT)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;and based on this, compute the retransmission timeout (RTO) as:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;RTO = min[UBOUND,max[LBOUND,(BETA*SRTT)]]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;where UBOUND is an upper bound on the timeout (e.g., 1 minute),&#xA;LBOUND is a lower bound on the timeout (e.g., 1 second), ALPHA is  a&#xA;smoothing factor (e.g., .8 to .9), and BETA is a delay variance&#xA;factor (e.g., 1.3 to 2.0).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I haven't followed this through the updates so there may be better or more explicit references.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-07-27T13:34:44.967" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33485" PostTypeId="1" CreationDate="2016-07-25T21:34:57.490" Score="0" ViewCount="639" Body="&lt;p&gt;Im trying to get pinging/telnet enabled for a certain port so i can get through from outside to inside or vise versa. Just trying to figure out the configuration to get there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have made my inside network and my outside network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firewall model is Cisco 5520 ASA&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa# sh access-lis&#xA;access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)&#xA;            alert-interval 300&#xA;access-list 101; 4 elements; name hash: 0xe7d586b5&#xA;access-list 101 line 1 extended permit icmp any any echo-reply (hitcnt=0) 0x0309                                                                                        01cd&#xA;access-list 101 line 2 extended permit icmp any any source-quench (hitcnt=0) 0x8                                                                                        bddfde8&#xA;access-list 101 line 3 extended permit icmp any any unreachable (hitcnt=0) 0x89d                                                                                        18f69&#xA;access-list 101 line 4 extended permit icmp any any time-exceeded (hitcnt=0) 0x1                                                                                        2127ce7&#xA;access-list outside_access_in; 5 elements; name hash: 0x6892a938&#xA;access-list outside_access_in line 1 extended permit icmp object outside3560 obj                                                                                        ect inside3560 (hitcnt=0) 0x4f1148e6&#xA;  access-list outside_access_in line 1 extended permit icmp host 192.168.2.21 ho                                                                                        st 192.168.1.11 (hitcnt=0) 0x4f1148e6&#xA;access-list outside_access_in line 2 extended permit icmp object outside3560 obj                                                                                        ect inside3560 object-group ping (hitcnt=0) 0xc892322e&#xA;  access-list outside_access_in line 2 extended permit icmp host 192.168.2.21 ho                                                                                        st 192.168.1.11 echo (hitcnt=0) 0x8d896526&#xA;  access-list outside_access_in line 2 extended permit icmp host 192.168.2.21 ho                                                                                        st 192.168.1.11 echo-reply (hitcnt=0) 0xd3bb9910&#xA;access-list outside_access_in line 3 extended permit icmp object outside23560 ob                                                                                        ject inside35602 object-group ping (hitcnt=0) 0xa79083e6&#xA;  access-list outside_access_in line 3 extended permit icmp host 192.168.2.21 ho                                                                                        st 192.168.1.12 echo (hitcnt=0) 0xca21b676&#xA;  access-list outside_access_in line 3 extended permit icmp host 192.168.2.21 ho                                                                                        st 192.168.1.12 echo-reply (hitcnt=0) 0x5ca247e8&#xA;access-list inside; 1 elements; name hash: 0x45467dcb&#xA;access-list inside line 1 extended permit icmp host 192.168.1.11 host 192.168.2.                                                                                        21 (hitcnt=0) 0x00b26fe3&#xA;access-list outside; 1 elements; name hash: 0x1a47dec4&#xA;access-list outside line 1 extended permit icmp host 192.168.2.21 host 192.168.1                                                                                        .11 (hitcnt=0) 0x4310bc47&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3560 Inside switch: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;L3Switch1#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1542 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;no service password-encryption&#xA;!&#xA;hostname L3Switch1&#xA;!&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;ip subnet-zero&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface GigabitEthernet0/3&#xA;!&#xA;interface GigabitEthernet0/4&#xA;!&#xA;interface GigabitEthernet0/5&#xA;!&#xA;interface GigabitEthernet0/6&#xA;!&#xA;interface GigabitEthernet0/7&#xA;!&#xA;interface GigabitEthernet0/8&#xA;!&#xA;interface GigabitEthernet0/9&#xA;!&#xA;interface GigabitEthernet0/10&#xA;!&#xA;interface GigabitEthernet0/11&#xA;!&#xA;interface GigabitEthernet0/12&#xA;!&#xA;interface GigabitEthernet0/13&#xA;!&#xA;interface GigabitEthernet0/14&#xA;!&#xA;interface GigabitEthernet0/15&#xA;!&#xA;interface GigabitEthernet0/16&#xA;!&#xA;interface GigabitEthernet0/17&#xA;!&#xA;interface GigabitEthernet0/18&#xA;!&#xA;interface GigabitEthernet0/19&#xA;!&#xA;interface GigabitEthernet0/20&#xA;!&#xA;interface GigabitEthernet0/21&#xA;!&#xA;interface GigabitEthernet0/22&#xA;!&#xA;interface GigabitEthernet0/23&#xA;!&#xA;interface GigabitEthernet0/24&#xA;!&#xA;interface GigabitEthernet0/25&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/26&#xA;!&#xA;interface GigabitEthernet0/27&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/28&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.1.11 255.255.255.0&#xA;!&#xA;ip classless&#xA;ip http server&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;end&#xA;&#xA;3560 outside switch:&#xA;&#xA;TransitSw# sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1839 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;no service password-encryption&#xA;!&#xA;hostname TransitSw&#xA;!&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;vtp mode transparent&#xA;ip subnet-zero&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;vlan 10&#xA; name inside-vlan&#xA;!&#xA;vlan 20,30,40,112-113&#xA;!&#xA;vlan 210&#xA; name netmon&#xA;!&#xA;vlan 439&#xA; name radio&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface GigabitEthernet0/3&#xA;!&#xA;interface GigabitEthernet0/4&#xA;!&#xA;interface GigabitEthernet0/5&#xA;!&#xA;interface GigabitEthernet0/6&#xA;!&#xA;interface GigabitEthernet0/7&#xA;!&#xA;interface GigabitEthernet0/8&#xA;!&#xA;interface GigabitEthernet0/9&#xA;!&#xA;interface GigabitEthernet0/10&#xA;!&#xA;interface GigabitEthernet0/11&#xA;!&#xA;interface GigabitEthernet0/12&#xA;!&#xA;interface GigabitEthernet0/13&#xA;!&#xA;interface GigabitEthernet0/14&#xA;!&#xA;interface GigabitEthernet0/15&#xA;!&#xA;interface GigabitEthernet0/16&#xA;!&#xA;interface GigabitEthernet0/17&#xA;!&#xA;interface GigabitEthernet0/18&#xA;!&#xA;interface GigabitEthernet0/19&#xA;!&#xA;interface GigabitEthernet0/20&#xA;!&#xA;interface GigabitEthernet0/21&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/22&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/23&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/24&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; no ip route-cache&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.1.12 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;interface Vlan20&#xA; ip address 192.168.20.14 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;interface Vlan30&#xA; ip address 192.168.30.14 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;interface Vlan40&#xA; ip address 192.168.40.14 255.255.255.0&#xA; no ip route-cache&#xA;!&#xA;ip http server&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2960 Transmittor switch thats also inside:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 3170 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;enable password cisco&#xA;!&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;ip subnet-zero&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 10&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 10&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 10&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport access vlan 10&#xA;!&#xA;interface FastEthernet0/5&#xA; switchport access vlan 10&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport access vlan 20&#xA;!&#xA;interface FastEthernet0/7&#xA; switchport access vlan 20&#xA;!&#xA;interface FastEthernet0/8&#xA; switchport access vlan 20&#xA;!&#xA;interface FastEthernet0/9&#xA; switchport access vlan 20&#xA;!&#xA;interface FastEthernet0/10&#xA; switchport access vlan 20&#xA;!&#xA;interface FastEthernet0/11&#xA; switchport access vlan 30&#xA;!&#xA;interface FastEthernet0/12&#xA; switchport access vlan 30&#xA;!&#xA;interface FastEthernet0/13&#xA; switchport access vlan 30&#xA;!&#xA;interface FastEthernet0/14&#xA; switchport access vlan 30&#xA;!&#xA;interface FastEthernet0/15&#xA; switchport access vlan 30&#xA;!&#xA;interface FastEthernet0/16&#xA; switchport access vlan 40&#xA;!&#xA;interface FastEthernet0/17&#xA; switchport access vlan 40&#xA;!&#xA;interface FastEthernet0/18&#xA; switchport access vlan 40&#xA;!&#xA;interface FastEthernet0/19&#xA; switchport access vlan 40&#xA;!&#xA;interface FastEthernet0/20&#xA; switchport access vlan 40&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA;!&#xA;interface FastEthernet0/25&#xA;!&#xA;interface FastEthernet0/26&#xA;!&#xA;interface FastEthernet0/27&#xA;!&#xA;interface FastEthernet0/28&#xA;!&#xA;interface FastEthernet0/29&#xA;!&#xA;interface FastEthernet0/30&#xA;!&#xA;interface FastEthernet0/31&#xA;!&#xA;interface FastEthernet0/32&#xA;!&#xA;interface FastEthernet0/33&#xA;!&#xA;interface FastEthernet0/34&#xA;!&#xA;interface FastEthernet0/35&#xA;!&#xA;interface FastEthernet0/36&#xA;!&#xA;interface FastEthernet0/37&#xA;!&#xA;interface FastEthernet0/38&#xA;!&#xA;interface FastEthernet0/39&#xA;!&#xA;interface FastEthernet0/40&#xA;!&#xA;interface FastEthernet0/41&#xA;!&#xA;interface FastEthernet0/42&#xA;!&#xA;interface FastEthernet0/43&#xA;!&#xA;interface FastEthernet0/44&#xA;!&#xA;interface FastEthernet0/45&#xA;!&#xA;interface FastEthernet0/46&#xA;!&#xA;interface FastEthernet0/47&#xA;!&#xA;interface FastEthernet0/48&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/3&#xA;!&#xA;interface GigabitEthernet0/4&#xA;!&#xA;interface Vlan1&#xA; ip address 10.0.0.1 255.255.255.0&#xA;!&#xA;interface Vlan10&#xA; ip address 192.168.2.21 255.255.255.0&#xA; standby 1 ip 192.168.10.15&#xA; standby 1 preempt&#xA;!&#xA;interface Vlan20&#xA; ip address 192.168.20.10 255.255.255.0&#xA; standby 1 ip 192.168.20.15&#xA; standby 1 preempt&#xA;!&#xA;interface Vlan30&#xA; ip address 192.168.30.10 255.255.255.0&#xA; standby 1 ip 192.168.30.15&#xA; standby 1 preempt&#xA;!&#xA;interface Vlan40&#xA; ip address 192.168.40.10 255.255.255.0&#xA; standby 1 ip 192.168.40.15&#xA; standby 1 preempt&#xA;!&#xA;interface Vlan99&#xA; ip address 192.168.99.99 255.255.255.0&#xA;!&#xA;ip default-gateway 10.0.0.254&#xA;ip classless&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; password cisco&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;end&#xA;&#xA;TransitSw#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27334" LastEditorUserId="8499" LastEditDate="2016-07-28T14:42:44.180" LastActivityDate="2023-12-22T21:04:15.523" Title="How to go from inside to outside (Firewall related question)" Tags="|firewall|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33487" PostTypeId="1" AcceptedAnswerId="33488" CreationDate="2016-07-25T22:38:19.530" Score="1" ViewCount="157" Body="&lt;p&gt;In an OSPF broadcast configuration, can some host (H1) form an adjacency with another host(H2) that is not DR. For example H1 does not see for some reason the DR advertised by the H2. Does standard mandate forming adjacency with DR only?&lt;/p&gt;&#xA;" OwnerUserId="28060" LastEditorUserId="8499" LastEditDate="2016-07-26T00:59:49.913" LastActivityDate="2016-07-26T00:59:49.913" Title="OSPF broadcast link - forming adjacenices between non-DR hosts" Tags="|routing|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33488" PostTypeId="2" ParentId="33487" CreationDate="2016-07-25T23:07:21.957" Score="2" Body="&lt;p&gt;If by adjacency, you mean a Full adjacency, then on a broadcast or NBMA medium, a router only achieves a Full adjacency with the DR and BDR (of course, the DR and BDR should have a Full adjacency with all the routers). The router will not get past the 2-Way state (bi-directional communication has been established) with any other routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Full adjacency means that two routers have exchanged LSAs, but a router on a broadcast or NBMA medium only exchanges LSAs with the DR and BDR, so it will not form a Full adjacency with any other routers on that medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A broadcast medium implies that every router can see every other router on the medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On NBMA, you need to be careful. You should set it up as a hub and spoke topology, and the DR should be at the hub so that all the other routers can see it (the DR and BDR &lt;em&gt;must&lt;/em&gt; have access to all the other routers). You could also use something like subinterfaces configured as point-to-point links so that there is no DR or BDR.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-25T23:14:58.637" LastActivityDate="2016-07-25T23:14:58.637" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33489" PostTypeId="2" ParentId="33482" CreationDate="2016-07-25T23:13:12.873" Score="2" Body="&lt;p&gt;We are seeing less and less of ASIC's and more and more of general purpose CPU bcs of Moore's Law paired with economics and importantly power consumption.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;TCAM is not the cure all for hardware search lookups. TCAM is power&#xA;  hungry, expensive and takes up quite a bit of silicon space. It would&#xA;  not be unusual for it to be the most expensive component on commodity&#xA;  switches. Many vendors use a blend of BCAM memory, SRAM, NPUs and&#xA;  software algorithms to perform ternary lookups (see MX trio chipset&#xA;  and EzChip NPUs in ASRs, Trie lookups). &lt;a href=&quot;https://www.sdxcentral.com/articles/contributed/sdn-openflow-tcam-need-to-know/2012/07/&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Generally speaking, CAM is often described as the opposite of random&#xA;  access memory (RAM). To retrieve data on RAM, the operating system&#xA;  (OS) must provide the memory address where the data is stored. Data&#xA;  stored on CAM can be accessed by performing a query for the content&#xA;  itself, and the memory retrieves the addresses where that data can be&#xA;  found. Due to its parallel nature, CAM (and by extension TCAM) is much&#xA;  faster than RAM. However, it is not widely used in most electronics&#xA;  because it is expensive to build, consumes a lot of power and&#xA;  generates a high level of heat that must be dissipated.&#xA;  &lt;a href=&quot;http://searchnetworking.techtarget.com/definition/TCAM-ternary-content-addressable-memory&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;RISC vs CISC&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Historically, Cisco networking devices ran Reduced Instruction Set Computing, RISC, processors.  Meanwhile, Intel was selling its x86 Complex Instruction Set Computing, CISC, architecture.  The horsepower appears low but the RISC model packs performance.  Currently, Cisco uses a mixture of MIPS, PowerPC and x86, but it would like to standardize on one architecture, &lt;a href=&quot;http://www.computerworld.com/article/2690819/components-processors/cisco-and-netgear-line-up-behind-new-helix-64bit-arm-chips.html&quot; rel=&quot;nofollow&quot;&gt;said Pradeep Kathail&lt;/a&gt;, a chief software architect at Cisco, speaking at an AppliedMicro press event at ARM TechCon.  At present, classifying a processor as RISC or CISC is almost impossible, because their instructions sets all look similar now with parallel computing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ARM Architecture&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/ARM_Holdings&quot; rel=&quot;nofollow&quot;&gt;ARM Holdings&lt;/a&gt; out of England licenses its super power efficient &lt;a href=&quot;http://www.arm.com/&quot; rel=&quot;nofollow&quot;&gt;ARM&lt;/a&gt; computing architecture to chip/systems on a chip (SoC) manufacturers such as Applied Micro, Broadcom, Cavium, Huawei, Nvidia, AMD, Samsung, and Apple.  In fact, &lt;a href=&quot;https://gigaom.com/2013/04/03/applied-micro-cloud-chip/&quot; rel=&quot;nofollow&quot;&gt;Applied Micro is now selling&lt;/a&gt; the “first chip to contain a software-defined network (SDN) controller on the die that will offer network services such as load balancing and ensuring service-level agreements on the chip. It’s like shoving the networking and computing vision of the Cisco Unified Computing System on a chip.”  Helix, another chip, is sampling now and will &lt;a href=&quot;http://www.computerworld.com/article/2690819/components-processors/cisco-and-netgear-line-up-behind-new-helix-64bit-arm-chips.html&quot; rel=&quot;nofollow&quot;&gt;be in production in 2015&lt;/a&gt;, will have four Helix cores running at 1.2Ghz and support fanless designs (further energy savings), AppliedMicro says.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Details on Cisco networking device computing architecture are difficult to gather.&lt;/li&gt;&#xA;&lt;li&gt;Helix SoC from Applied Micro may be the ISR4000 Gen2?&lt;/li&gt;&#xA;&lt;li&gt;Nexus 9k and 3K products, both based on Broadcom’s Trident silicon.&lt;/li&gt;&#xA;&lt;li&gt;EZChip, out of Israel, purchased Tilera a few months ago.  Back in 2011, Cisco invested millions in Tilera.&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://openvswitch.org/&quot; rel=&quot;nofollow&quot;&gt;http://openvswitch.org/&lt;/a&gt; is open source IOS, basically.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-07-25T23:39:02.503" LastActivityDate="2016-07-25T23:39:02.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33490" PostTypeId="2" ParentId="33481" CreationDate="2016-07-25T23:28:51.453" Score="3" Body="&lt;p&gt;An HTTP session is a type of session layer communication.  &lt;a href=&quot;https://en.wikipedia.org/wiki/OSI_model#Description_of_OSI_layers&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's also the &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_protocol_suite&quot; rel=&quot;nofollow noreferrer&quot;&gt;Internet Protocol Suite&lt;/a&gt; which has categorizes it in the Transport Layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dYoRA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dYoRA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-07-26T16:18:32.457" LastActivityDate="2016-07-26T16:18:32.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33491" PostTypeId="2" ParentId="33481" CreationDate="2016-07-26T02:18:46.303" Score="9" Body="&lt;p&gt;I have to disagree with @ronroyston here. The OSI model is an idealized abstract model, and there are no protocols in use today that follow it.  HTTP was created without regard to the OSI model, so there's no point to trying to make it fit. The TCP model is a little closer, because it lumps everything above transport into &quot;application.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the Wikipedia article says, &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An HTTP session is a sequence of network request-response&#xA;  transactions. An HTTP client initiates a request by establishing a&#xA;  Transmission Control Protocol (TCP) connection to a particular port on&#xA;  a server.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So a HTTP session is created by establishing a TCP connection.  It follows that the session ends when the TCP connection is terminated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, many definitions like this are a bit squishy, so they can mean what you want them to mean.  Just don't get too hung up on figuring out the OSI model.  It's just a model.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-26T02:18:46.303" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33496" PostTypeId="2" ParentId="33485" CreationDate="2016-07-26T09:04:13.510" Score="0" Body="&lt;p&gt;You need NAT to re-write from your outside IP address(es) to your inside addresses.  Then you will also need two rules to allow outside access to your internal target IP address on ICMP and port 23 (Telnet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How exactly you will do this depends on your gateway device.&lt;/p&gt;&#xA;" OwnerUserId="8251" LastActivityDate="2016-07-26T09:04:13.510" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33499" PostTypeId="1" AcceptedAnswerId="33500" CreationDate="2016-07-26T10:40:56.803" Score="1" ViewCount="778" Body="&lt;p&gt;We have a scenario where a customer is having a managed L3VPN installed and would like to run OSPF internally. The issue is that the provider will not allow us to provide and manage the CE device and they will only use BGP as the CE-PE protocol. They've told us that we can run OSPF internally and form a neighbourship between our L3 switch and their managed CE. They will then redistribute the routes into BGP and in turn, advertise those routes to their PE. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That doesn't seem like a valid design to me. That means at each site we'll need to run an instance of OSPF in area 0 and as far as OSPF is concerned every site will be a different autonomous system, right? Due to the BGP in the middle (between managed CE - PE) the routes will be external OSPF routes and we wont be able to connect our area 0's together. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think it will work for now but I imagine it will cause headaches in future if we try to scale or make the solution slightly more complicated. I think if we ever decided to have a backup leased line or VPN tunnel the LSA's would be type 2 and therefor a preferred path than the external routes caused by type 5 LSAs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know OSPF as a CE-PE protocol is valid and would essentially address all the concerns above but I think that option is probably off the table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any caveats/concerns with the solution above? Should we be pushing harder for the provider to run OSPF as the CE-PE protocol?&lt;/p&gt;&#xA;" OwnerUserId="23560" LastEditorUserId="23560" LastEditDate="2016-07-26T10:52:46.133" LastActivityDate="2018-08-11T23:19:30.660" Title="Managed MPLS CE router with BGP and OSPF" Tags="|bgp|ospf|mpls|mpls-vpn|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="33500" PostTypeId="2" ParentId="33499" CreationDate="2016-07-26T11:05:04.577" Score="4" Body="&lt;p&gt;Yes, as you say backup links will cause an issue in the future unless you provider lets you run OPSF CE-PE and sets up some sham links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One workaround would be to use GRE tunnels between sites and run OSPF over the tunnels.  The tunnel endpoints would need to be advertised through BGP.  The OSPF routes would arrive over the tunnel.  This does lower you MTU though, which may cause issues and obviously there is work to configure this from your side.  I would push for the provider to enable OSPF on the PE-CE&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-07-26T11:05:04.577" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33501" PostTypeId="1" AcceptedAnswerId="33554" CreationDate="2016-07-26T11:41:26.327" Score="1" ViewCount="100" Body="&lt;p&gt;I have switched to another ISP because after 2 years of smooth sailing, we started to have upload speed issues and they didn't care. Strangely, the new ISP has the same problem: from time to time, upload speed goes away. When this happens, Speedtest measures 4 ms ping, 8 Mbps down speed and 0.01-0.02 Mbps up speed (or the upload test hangs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This slowdown happens seemingly randomly, several times a day, takes 5 minutes to an hour, then goes away. ISP says they are seeing big packet loss, but they have no idea why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm about 1300 meters away from the base station and when installed, measurements have shown -70 dB signal strength and sustained speeds of 20 Mbps up, 50 Mbps down. (I didn't check signal-to-noise ratio and now I don't have the password for the AP.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AP (Ubiquiti PowerBeam PBE-M2-400) points about 10-15 degrees away from optimal direction because the installer didn't have the right console. The old ISPs antenna (a different Ubiquiti model) pointed the same bad direction for 2 years without a problem. Both ISPs have their base stations on the same water tower.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm starting to suspect that my problem may depend on other users' usage pattern (of the Internet or their microwave, don't know). Not necessarily from even the same ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can this be caused by the wrong antenna direction or the problem is elsewhere?&lt;/p&gt;&#xA;" OwnerUserId="28152" LastActivityDate="2016-10-26T18:54:09.620" Title="Upload speed issues with two ISPs on the same tower" Tags="|wireless|packet-loss|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33502" PostTypeId="1" AcceptedAnswerId="33505" CreationDate="2016-07-26T12:55:57.810" Score="3" ViewCount="2877" Body="&lt;p&gt;My colleague told me today he saw some sort of RJ45 dongle that intended to simulate a &quot;link up&quot; state for the connected interface (for testing purposes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can this be achieved by doing a specific wiring? (i have RJ45 crimping tools)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wLIoS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wLIoS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15827" LastEditorUserId="8499" LastEditDate="2016-07-26T17:15:02.327" LastActivityDate="2016-07-26T17:15:02.327" Title="rj45 - simulate interface &quot;link up&quot; state" Tags="|ethernet|cable|layer1|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33504" PostTypeId="2" ParentId="33476" CreationDate="2016-07-26T14:17:42.753" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos15.1/topics/example/RVIs-qfx-series-example1.html&quot; rel=&quot;nofollow&quot;&gt;Configure an integrated routing and bridging (IRB) interface&lt;/a&gt; on one of the switches.&lt;/p&gt;&#xA;" OwnerUserId="25723" LastActivityDate="2016-07-26T14:17:42.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33505" PostTypeId="2" ParentId="33502" CreationDate="2016-07-26T14:30:00.050" Score="4" Body="&lt;p&gt;I never have tried make that kind of connector manually, but theoretically is possible. You only have to connect RX to TX and TX to RX to create a loop in the RJ45. I know that kind connector usually are use to test E1 cards to auto test it.&lt;/p&gt;&#xA;" OwnerUserId="28155" LastActivityDate="2016-07-26T14:30:00.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33506" PostTypeId="1" AcceptedAnswerId="33507" CreationDate="2016-07-26T14:39:14.440" Score="3" ViewCount="14422" Body="&lt;p&gt;for the third or fourth time in approx two years we have (painfully) noticed some really strange (at least to us) behaviour in our datacenters:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Uplink-interfaces on access-switches which have only one (!) physical uplink (lower end-points of the hierarchy) are going into &lt;strong&gt;err-disable&lt;/strong&gt; state due to &lt;em&gt;Loop-back detected&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;There are no physical (wired) loops.&lt;/strong&gt; How can this be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;RZ2-AS18# show version&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch Ports Model              SW Version            SW Image&#xA;------ ----- -----              ----------            ----------&#xA;*    1 28    WS-C3560G-24TS     12.2(55)SE1           C3560-IPSERVICESK9-M&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;RZ2-AS18# show int des&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gi0/24  up  up  *** Uplink to rz2-cs4 Gi0/24 ***&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;RZ2-AS18# show logging&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Jul 26 11:35:55.328: %ETHCNTR-3-LOOP_BACK_DETECTED: Loop-back detected on GigabitEthernet0/24.&#xA;Jul 26 11:35:55.328: %PM-4-ERR_DISABLE: loopback error detected on Gi0/24, putting Gi0/24 in err-disable state&#xA;Jul 26 11:35:56.611: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/24, changed state to down&#xA;Jul 26 11:35:57.651: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to down&#xA;.Jul 26 12:12:04.173: %LINK-5-CHANGED: Interface GigabitEthernet0/24, changed state to administratively down&#xA;.Jul 26 12:12:06.295: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to down&#xA;.Jul 26 12:12:09.131: %LINK-3-UPDOWN: Interface GigabitEthernet0/24, changed state to up&#xA;.Jul 26 12:12:10.137: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/24, changed state to up&#xA;.Jul 26 12:13:05.117: %SYS-5-CONFIG_I: Configured from console by console&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;rz2-as18# show run int gi 0/24&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/24&#xA; description *** rz2-cs4 Gi0/24 ***&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;General network structure:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ring between core-switches (CS)&lt;/li&gt;&#xA;&lt;li&gt;access-switches connected to core-switches in star-topology&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qZgA1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qZgA1.png&quot; alt=&quot;General network strcture&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas? Thoughts? Thanks in advance!&lt;/p&gt;&#xA;" OwnerDisplayName="user28154" LastEditorDisplayName="user28154" LastEditDate="2016-07-26T14:57:50.050" LastActivityDate="2019-01-18T04:13:38.140" Title="Cisco: err-disabled due to loop - but there are NO redundant physical paths/ wires/ connections" Tags="|cisco|cisco-ios|switching|spanning-tree|loop|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33507" PostTypeId="2" ParentId="33506" CreationDate="2016-07-26T14:45:23.557" Score="6" Body="&lt;p&gt;I think this might be related to a bug. This issue is documented in Cisco bug ID CSCea46385. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To resolve the issue, you need to add the &lt;strong&gt;no keepalive&lt;/strong&gt; command to the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-07-26T14:45:23.557" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33508" PostTypeId="2" ParentId="32319" CreationDate="2016-07-26T14:46:13.327" Score="0" Body="&lt;p&gt;For those still interested in this issue, I had to upgrade the IOS to 12.2(55)SE10. Now it's working with the initial configuration.&lt;/p&gt;&#xA;" OwnerUserId="3484" LastActivityDate="2016-07-26T14:46:13.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33510" PostTypeId="2" ParentId="33502" CreationDate="2016-07-26T15:13:02.187" Score="5" Body="&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/a/33505/15827&quot;&gt;@Roid's theory&lt;/a&gt; did the trick. Here's the proof of concept:&lt;/p&gt;&#xA;&lt;h2&gt;Requirements&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Short ethernet cable (~2 inch)&lt;/li&gt;&#xA;&lt;li&gt;RJ45 connector&lt;/li&gt;&#xA;&lt;li&gt;RJ45 Crimper&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/j6GW9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/j6GW9.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Peel the cable's coating&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Kt0B9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Kt0B9.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Wire RX to TX&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QBCI0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QBCI0.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Crimp it!&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PQD1F.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PQD1F.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Result&lt;/h2&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0rnny.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0rnny.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C6ics.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C6ics.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15827" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-07-26T15:13:02.187" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33511" PostTypeId="2" ParentId="32417" CreationDate="2016-07-26T16:23:42.560" Score="2" Body="&lt;p&gt;Mr.Cebollin,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had the same issue and this is because the E1 Service Provider will not allow it as a restriction to avoid Toll-Fraud. In my case to make it work, I used the highlighted option. Hope this helps.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ephone-dn 5 dual-line&#xA;number XXXX&#xA;**snr calling-number local**&#xA;snr [Mobile Number] delay 10 timeout 24 cfwd-noan 500&#xA;snr ring-stop&#xA;call-forward noan 500 timeout 24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28156" LastEditorUserId="8499" LastEditDate="2016-11-23T20:34:08.060" LastActivityDate="2016-11-23T20:34:08.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33512" PostTypeId="1" AcceptedAnswerId="33515" CreationDate="2016-07-26T18:30:36.000" Score="0" ViewCount="71" Body="&lt;p&gt;Suppose we have three routers R1 R2 and R3 with full mesh connectivity in OSPF broadcast network (LAN). R1 becomes DR. R2 BDR and R3 is forming adjacency with both of them. Now let router r4 be attached but it can only hear and send to R3 only, (because of say network malfunctioning) which sends hello saying his DR is R1 and BDR are r2 but it himself does not assume any of the duties. The questions is will r4 elect r3 as his dr (because according to rfc 9.4 nothing makes him non eligible for dr election algorithm. Assume r3 priority is not zero. Can someone shed a light what would happen according to standard on such situations. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; R1(DR)--R2(BDR)  &#xA;     \      /&#xA;      \    /&#xA;       \  / &#xA;        \/  &#xA;        R3 HELLO=(DR=R1, BDR=R2)&#xA;         |&#xA;         | &#xA;        R4 ELECTED DR - ???&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28060" LastEditorUserId="8499" LastEditDate="2018-12-27T01:13:53.787" LastActivityDate="2018-12-27T01:13:53.787" Title="Dr election in partial lan connectivity" Tags="|routing|router|ospf|protocol-theory|rfc|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="33513" PostTypeId="2" ParentId="33485" CreationDate="2016-07-26T18:49:28.187" Score="0" Body="&lt;p&gt;create objects first:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network outside3560&#xA; host 10.0.0.1&#xA;&#xA;object network inside3560 &#xA; host 10.0.1.1&#xA;&#xA;object-group icmp-type ping&#xA; icmp-object echo&#xA; icmp-object echo-reply&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then the acl:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_access_in extended permit icmp object outside3560 object inside3560 object-group ping&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then apply it to the interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-group outside_access_in global&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27132" LastEditorUserId="8499" LastEditDate="2016-07-27T13:02:24.340" LastActivityDate="2016-07-27T13:02:24.340" CommentCount="16" ContentLicense="CC BY-SA 3.0" />
  <row Id="33515" PostTypeId="2" ParentId="33512" CreationDate="2016-07-26T19:55:34.310" Score="1" Body="&lt;p&gt;REVISED:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure the RFC covers this odd situation, so it would be dependent on the implementation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After further reflection (and  little prodding by @ronmaupin), it seems clear that R4 will never get beyond the 2way state with R3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3 will send hellos to R4 with the RID of the DR and the BDR.  R4 will accept these values and attempt to contact R1 and R2.  Since it can't, it will never load its database, so there will be no OSPF routes in the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is, since R4 can't contact the DR or BDR, will it start a new election?  If it decides that it or R3 is the BDR, it &quot;should&quot; start sending hellos on the AllDRRouters address (224.0.0.6).  But R3 isn't listening, because it already knows who the DR and BDR are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it should stay in the 2way state, thinking it's the DR, but no one else will pay attention to it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-07-27T11:30:09.313" LastActivityDate="2016-07-27T11:30:09.313" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33517" PostTypeId="5" CreationDate="2016-07-26T21:06:03.717" Score="0" Body="" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-26T21:06:03.717" LastActivityDate="2016-07-26T21:06:03.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33518" PostTypeId="4" CreationDate="2016-07-26T21:06:03.717" Score="0" Body="For questions about the OSI layer-2 (data-link layer)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-26T21:06:03.717" LastActivityDate="2016-07-26T21:06:03.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33519" PostTypeId="5" CreationDate="2016-07-26T21:06:44.110" Score="0" Body="" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-26T21:06:44.110" LastActivityDate="2016-07-26T21:06:44.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33520" PostTypeId="4" CreationDate="2016-07-26T21:06:44.110" Score="0" Body="For questions about the OSI layer-3 (network layer)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-26T21:06:44.110" LastActivityDate="2016-07-26T21:06:44.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33524" PostTypeId="1" AcceptedAnswerId="33525" CreationDate="2016-07-26T22:29:35.607" Score="1" ViewCount="16131" Body="&lt;p&gt;So, I have the following network configuration in Packet Tracer.&lt;a href=&quot;https://i.stack.imgur.com/LtTkW.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LtTkW.jpg&quot; alt=&quot;Network configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router is configured with DHCP. The ports on the switches are configured with access mode - for those that belong to the PCs. The unused ports are shut down. The ports between the switches and the ports between the switch and the router are configured as trunk ports. All the PCs that are connected to the S1 that is directly connected to the R1 get the IP addresses from the router. However, the PCs that are connected to the S2 and S3 don't - instead they get the message &quot;DHCP request failed, APIPA being used&quot;. What could be the problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the link for the configurations - &lt;a href=&quot;https://1drv.ms/u/s!AiRtffZ-QpFphY8iof_YGdcuua3KXw&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://1drv.ms/u/s!AiRtffZ-QpFphY8iof_YGdcuua3KXw&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The configurations for R1:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool Head  &#xA; network 10.10.10.0 255.255.255.0  &#xA; default-router 10.10.10.1  &#xA;ip dhcp pool R&amp;amp;D  &#xA; network 10.10.20.0 255.255.255.0  &#xA; default-router 10.10.20.1  &#xA;ip dhcp pool M&amp;amp;S  &#xA; network 10.10.30.0 255.255.255.0  &#xA; default-router 10.10.30.1  &#xA;ip dhcp pool Lab  &#xA; network 10.10.40.0 255.255.255.0  &#xA; default-router 10.10.40.1  &#xA;ip dhcp pool WS  &#xA; network 10.10.50.0 255.255.255.0  &#xA; default-router 10.10.50.1  &#xA;&#xA;no ip cef  &#xA;no ipv6 cef  &#xA;&#xA;spanning-tree mode pvst  &#xA;&#xA;interface FastEthernet0/0  &#xA; no ip address  &#xA; ip nat inside  &#xA; duplex auto  &#xA; speed auto  &#xA;!  &#xA;interface FastEthernet0/0.1  &#xA; encapsulation dot1Q 1 native  &#xA; ip address 10.10.1.1 255.255.255.0  &#xA;!  &#xA;interface FastEthernet0/0.10  &#xA; encapsulation dot1Q 10  &#xA; ip address 10.10.10.1 255.255.255.0  &#xA;!  &#xA;interface FastEthernet0/0.20  &#xA; encapsulation dot1Q 20  &#xA; ip address 10.10.20.1 255.255.255.0  &#xA;!  &#xA;interface FastEthernet0/0.30  &#xA; encapsulation dot1Q 30  &#xA; ip address 10.10.30.1 255.255.255.0  &#xA;!  &#xA;interface FastEthernet0/0.40  &#xA; encapsulation dot1Q 40  &#xA; ip address 10.10.40.1 255.255.255.0  &#xA;!  &#xA;interface FastEthernet0/0.50  &#xA; encapsulation dot1Q 50  &#xA; ip address 10.10.50.1 255.255.255.0  &#xA;!  &#xA;interface FastEthernet0/0.99  &#xA; encapsulation dot1Q 99  &#xA; ip address 10.10.99.1 255.255.255.0  &#xA;!  &#xA;interface FastEthernet0/1  &#xA; ip address 85.143.163.237 255.255.255.0  &#xA; ip nat outside  &#xA; duplex auto  &#xA; speed auto  &#xA;&#xA;interface Vlan1  &#xA; no ip address  &#xA; shutdown  &#xA;&#xA;ip nat inside source list 1 interface FastEthernet0/1 overload  &#xA;ip classless  &#xA;&#xA;ip flow-export version 9  &#xA;&#xA;access-list 1 permit 10.10.0.0 0.0.255.255  &#xA;&#xA;line con 0  &#xA;&#xA;line aux 0  &#xA;&#xA;line vty 0 4  &#xA; login  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The configuration for S1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree mode pvst  &#xA;!  &#xA;interface FastEthernet0/1   &#xA; switchport mode trunk  &#xA;!  &#xA;interface FastEthernet0/2  &#xA; switchport mode trunk  &#xA;!  &#xA;interface FastEthernet0/3  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/4  &#xA; switchport mode trunk  &#xA;!  &#xA;interface FastEthernet0/5  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/6  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/7  &#xA; shutdown   &#xA;!  &#xA;interface FastEthernet0/8  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/9  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/10  &#xA; switchport access vlan 20  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/11   &#xA; switchport access vlan 20  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/12  &#xA; switchport access vlan 20  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/13  &#xA; switchport access vlan 20  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/14  &#xA; switchport access vlan 20  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/15  &#xA; switchport access vlan 10  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/16  &#xA; switchport access vlan 10  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/17  &#xA; switchport access vlan 30  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/18  &#xA; switchport access vlan 30  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/19  &#xA; switchport access vlan 30  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/20  &#xA; switchport access vlan 30  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/21  &#xA; switchport access vlan 20  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/22  &#xA; switchport access vlan 20  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/23  &#xA; switchport access vlan 30  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/24  &#xA; shutdown  &#xA;!  &#xA;interface Vlan1  &#xA; no ip address  &#xA; shutdown  &#xA;!  &#xA;interface Vlan99  &#xA; ip address 10.10.99.10 255.255.255.0  &#xA;!  &#xA;ip default-gateway 10.10.99.1  &#xA;&#xA;line con 0  &#xA;!  &#xA;line vty 0 4  &#xA; login  &#xA;line vty 5 15  &#xA; login  &#xA;!  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The configurations for S2:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree mode pvst  &#xA;!  &#xA;interface FastEthernet0/1  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/2  &#xA; switchport mode trunk  &#xA;!  &#xA;interface FastEthernet0/3  &#xA; switchport mode trunk  &#xA;!  &#xA;interface FastEthernet0/4  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/5  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/6  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/7  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/8  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/9  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/10  &#xA; switchport access vlan 40  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/11  &#xA; switchport access vlan 40  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/12  &#xA; switchport access vlan 40  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/13  &#xA; switchport access vlan 40  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/14  &#xA; switchport access vlan 40  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/15  &#xA; switchport access vlan 40  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/16  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/17  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/18   &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/19  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/20  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/21  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/22  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/23  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/24  &#xA; shutdown  &#xA;!  &#xA;interface Vlan1  &#xA; no ip address  &#xA; shutdown  &#xA;!  &#xA;interface Vlan99  &#xA; ip address 10.10.99.20 255.255.255.0  &#xA;!  &#xA;ip default-gateway 10.10.99.1  &#xA;&#xA;line con 0  &#xA;!  &#xA;line vty 0 4  &#xA; login  &#xA;line vty 5 15  &#xA; login  &#xA;!  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The configurations for S3:&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree mode pvst  &#xA;!  &#xA;interface FastEthernet0/1  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/2  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/3  &#xA;!  &#xA;interface FastEthernet0/4  &#xA;!  &#xA;interface FastEthernet0/5  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/6  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/7  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/8  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/9  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/10  &#xA; switchport access vlan 50  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/11  &#xA; switchport access vlan 50  &#xA; switchport mode access  &#xA; spanning-tree portfast  &#xA;!  &#xA;interface FastEthernet0/12  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/13  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/14  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/15  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/16  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/17  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/18  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/19  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/20   &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/21  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/22  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/23  &#xA; shutdown  &#xA;!  &#xA;interface FastEthernet0/24  &#xA; shutdown  &#xA;!  &#xA;interface Vlan1  &#xA; no ip address  &#xA; shutdown  &#xA;!  &#xA;interface Vlan99  &#xA; ip address 10.10.99.30 255.255.255.0  &#xA;!  &#xA;ip default-gateway 10.10.99.1  &#xA;&#xA;line con 0  &#xA;!  &#xA;line vty 0 4  &#xA; login  &#xA;line vty 5 15  &#xA; login  &#xA;!  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28169" LastEditorUserId="8499" LastEditDate="2016-07-26T23:16:24.457" LastActivityDate="2016-07-28T07:52:58.047" Title="DHCP request failed, APIPA being used" Tags="|cisco|routing|dhcp|packet-tracer|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33525" PostTypeId="2" ParentId="33524" CreationDate="2016-07-26T23:45:57.640" Score="0" Body="&lt;p&gt;Why didn't you configure trunks on S3?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a very good idea to use the &lt;code&gt;description&lt;/code&gt; command on the interfaces to describe where the interface connects. It's not labeled on the drawing, and we are left to guess. For instance, S1 has trunks on &lt;code&gt;F0/1&lt;/code&gt;, &lt;code&gt;F0/2&lt;/code&gt;, and &lt;code&gt;F0/4&lt;/code&gt;, but which connects to S2, and on which S2 interface does it connect? It's a good idea to use the &lt;code&gt;show cdp neighbor&lt;/code&gt; command to double-check that what you label matches the actual connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should also create the VLANs on each switch, and set S1 as the root switch for the VLANs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-26T23:45:57.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33527" PostTypeId="1" AcceptedAnswerId="33529" CreationDate="2016-07-27T04:39:56.593" Score="1" ViewCount="102" Body="&lt;p&gt;I have 5 PCs with public IPs connected to internet, through a switch and a router.&#xA;One of them is used only by me, but today I needed to connect to the internet another PC, so I disconnected my Ethernet cable, put my IP in the new PC, connected the new PC on the switch (in other port), but this PC did not connected to internet. I had to restart it, and it worked, but I don't know if there is another solution which doesn't imply restarting. (I wonder if there is any association between IP and MAC at the switch...)&lt;/p&gt;&#xA;" OwnerUserId="14468" LastActivityDate="2016-07-27T05:29:36.810" Title="PC doesn't connect to internet until restart (MAC-IP association?)" Tags="|ip|mac-address|internet|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33528" PostTypeId="2" ParentId="16753" CreationDate="2016-07-27T04:53:32.417" Score="1" Body="&lt;p&gt;I'd do something along the approach Arima mentioned with the sub int per vlan but for IPs I'd probably use /30 or /31 if I could. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically an underlying P2P. Then I would absolutely run a routing protocol and in this case I'd probably go with eigrp. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then at each remote you would have your various voice, data and misc vlan / subnet that would be specific to that site. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Leverage L3 to the access as much as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's just me anyway. Keep it simple but keep it L3. &lt;/p&gt;&#xA;" OwnerUserId="22424" LastActivityDate="2016-07-27T04:53:32.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33529" PostTypeId="2" ParentId="33527" CreationDate="2016-07-27T04:58:22.860" Score="1" Body="&lt;p&gt;Clear ARP cache &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch expected the IP you used to be mapped to MAC of other machine you originally had IP tied to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clear arp and/or routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rebooting PC after changing IP basically did that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC reboots and the arp binding process kicked off when connected back to switch and the learned the new IP to Mac binding (arp cache)&lt;/p&gt;&#xA;" OwnerUserId="22424" LastActivityDate="2016-07-27T04:58:22.860" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33530" PostTypeId="2" ParentId="33527" CreationDate="2016-07-27T05:29:36.810" Score="1" Body="&lt;p&gt;It's a normal behaviour, The switches has something named MAC tables which indicates where the traffic has to be forwarded. When you move the PC to another port the table keeps forwarding the traffic to the previous port, that is the reason your PC is unreachable a few seconds some times minutes. A easy way to solve the problem is flushing the MAC Table or refresh it. Try to run a ping from the PC with the problem to another PC o Device in your network to force MAC table to be refresh it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;port 1    -&amp;gt;   PC1 (0:92:1c:5b:9d:eb)&#xA;port 2    -&amp;gt;   Nothing connected here&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if you move the PC1 to port 2 of the switch. The switch keeps forwarding the traffic to port 1 because it hasn't refresh the MAC table&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;port 1    -&amp;gt;   Nothing connected here, but the switch believe than PC1 is here&#xA;port 2    -&amp;gt;   PC1 (0:92:1c:5b:9d:eb)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28155" LastActivityDate="2016-07-27T05:29:36.810" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33532" PostTypeId="2" ParentId="33342" CreationDate="2016-07-27T06:41:41.010" Score="0" Body="&lt;p&gt;The issue is that CISCO router assumes that it is sitting behind a switch and not a hub so by default when receiving packet to wrong MAC address it tries to &quot;fix&quot; the situation (assuming switch has wrong port/mac mappings) by replacing the the original SRC MAC with his own and resending the packet (with TTL-1). Of cause in case of hub not only it does not fix the situation it makes it worse because now other routers (at least one in our case) receive messages to wrong MAC, causing &quot;infinite&quot; flooding.&lt;/p&gt;&#xA;" OwnerUserId="28060" LastActivityDate="2016-07-27T06:41:41.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33533" PostTypeId="1" AcceptedAnswerId="33623" CreationDate="2016-07-27T07:15:30.230" Score="2" ViewCount="1402" Body="&lt;p&gt;I know that a user is assigned a routable IP to access internet so I was wondering if user is also assigned with TCP/UDP port too? I mean just like there is a specific IP of the destination server with whom we are connecting to and there is also a TCP/UDP port on that server on which we are connected. On client side we have external IP of the client. Does that client also have a port number? How to check it?&lt;/p&gt;&#xA;" OwnerUserId="28180" LastEditorUserId="2142" LastEditDate="2016-07-27T11:38:40.470" LastActivityDate="2016-07-30T18:01:48.663" Title="Is a unique TCP/UDP port assigned to a user?" Tags="|ipv4|tcp|udp|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33534" PostTypeId="1" CreationDate="2016-07-27T07:39:14.070" Score="0" ViewCount="106" Body="&lt;p&gt;Kindly go through the current scenario and suggest me the best way to design the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current Scenario:-&#xA;From ISP to modem to a Cisco 2900 Router.Then comes a 8 port switch and is then connected to a High Speed Internet Access(HSIA)Gateway.From the HSIA , it is connected Cisco 2900 Switch.It is then distributed to 4 switches via Fibre cable to 4 Cisco 2900 switches.Then around 150+ Access Points are connected to these switches which is responsible for providing internet to the guest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The guests are unable to reach the internet most of the times and it is also seen that the Access Points (AP) are getting restarted themselves.There is no packet loss while connecting to the Modem directly and trying to ping any website.&#xA;The IPs are allocated via DHCP and there is a Access Point Controller for managing the AP. Kindly let me know if any further info required and help me to provide the best solution&lt;/p&gt;&#xA;" OwnerUserId="28178" LastActivityDate="2016-07-28T16:32:56.937" Title="Redesigning Network" Tags="|cisco|vlan|wireless|" AnswerCount="2" CommentCount="11" ClosedDate="2019-03-04T00:30:41.923" ContentLicense="CC BY-SA 3.0" />
  <row Id="33535" PostTypeId="2" ParentId="33533" CreationDate="2016-07-27T07:58:23.163" Score="6" Body="&lt;p&gt;Think of ports as &lt;em&gt;doors&lt;/em&gt;.  Your PC has a lot of doors and the server also. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A web server has the door &lt;em&gt;80&lt;/em&gt; open, so if a PC acting as a client wants to connect to the web server, then:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- The PC opens a random port (door), for example &lt;em&gt;50000&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 - From that port the client PC sends a package of data to web server IP address port (door) 80.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 - If the package is a correct request, then the web server replies from port 80 to client IP address port 50000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4 - If the reply is correct and the communication ends, the client PC closes its port (door) 50000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client starts the communication process to the server, and therefore he chooses a random port in the range known as ephemeral ports (&lt;code&gt;49152-65535&lt;/code&gt;) to connect to the server. The port stays open while there is a data transmission with the server. Whenever the transmission ends, the port is closed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet connections require the use of a public IP address. In IPv4 there are &lt;em&gt;4294967296&lt;/em&gt; (2^32) addresses. Those addresses have been exhausted years ago. So ISPs use &lt;code&gt;NAT&lt;/code&gt; (Network Address Translation) to reduce the number of IP Public addresses on each connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a typical home connection to internet, the devices in the home network use addresses in the range &lt;em&gt;192.168.X.X&lt;/em&gt; because that range is considered &lt;strong&gt;private&lt;/strong&gt; and can be used on &lt;em&gt;every&lt;/em&gt; home or office network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router or modem uses a &lt;strong&gt;single public IP address&lt;/strong&gt; to connect to the external world, so the device has to &lt;strong&gt;translate&lt;/strong&gt; the internal private address to the external one and the ports opened/used inside and outside to avoid confusions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT maps the pair &lt;em&gt;internal address:port&lt;/em&gt; to a &lt;em&gt;external address:different port&lt;/em&gt; and that mapping let it process the replies correctly, avoiding the confusion if two clients coincidentally open the same source port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modem and the NAT process are designed to do this in an automatic way as long as the communication starts from &lt;em&gt;inside&lt;/em&gt; the network to external servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you decide to put, for example, a &lt;em&gt;web server&lt;/em&gt; inside your home network (therefore, on a &lt;em&gt;private IP address&lt;/em&gt;) and you want that the server can be accessed from the external world then you have to &lt;strong&gt;manually configure NAT&lt;/strong&gt; to let it know that incoming connections to port 80 (web server port) must get through the device and go to the internal IP private address of the web server.  &lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-07-27T08:39:33.760" LastActivityDate="2016-07-27T08:39:33.760" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33536" PostTypeId="2" ParentId="33533" CreationDate="2016-07-27T08:24:51.843" Score="0" Body="&lt;p&gt;yes.. both sides use port number&#xA;but don't belong portnumber to users and clients... it's related to apps you work..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP/UDP numbers are actually identifiers for finding responsible app (multiplexing using ports)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;whenever you open an app and want connection and communication with another side that app in client-side (notice: your client can be server-side for some services! i.g. when you share a folder in your win.. you actually open these ports TCP 139, 445&#xA;UDP 137, 138.. waiting for establishing a connection..) randomly assign a number to its port and attach it to your IP (Socket) afterwards that socket talks with server-side which should have well-known port number (telnet 23 , SSH 22 ... )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The dynamic or private ports are those from 49152 through 65535)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;try &quot;netstat -a -n&quot; command and see your current sessions it will help you more to figure out&lt;/p&gt;&#xA;" OwnerUserId="16683" LastActivityDate="2016-07-27T08:24:51.843" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33537" PostTypeId="2" ParentId="33380" CreationDate="2016-07-27T08:49:21.760" Score="0" Body="&lt;p&gt;16-bit ASNs and 32-bit ASNs are interoperable. You do not have to renumber. If you do not plan to expand your network it is sufficient to check that your tools still work when you enter a 32-bit ASN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using the latest equipment and software and your upstream provider supports 32-bit ASNs, apply for a 32-bit ASN. If you are using older equipment and software, apply for a 16-bit ASN.&lt;/p&gt;&#xA;" OwnerUserId="23982" LastActivityDate="2016-07-27T08:49:21.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33538" PostTypeId="1" AcceptedAnswerId="33540" CreationDate="2016-07-27T09:13:25.680" Score="0" ViewCount="102" Body="&lt;p&gt;Here is the situation: &lt;br/&gt; In my company we only use static IP addresses, the address of the router interface on which every machine is connected is 192.168.0.1/16.&lt;br/&gt;Our router support the DPI (Deep Packet Inspection) feature and shows us the ip addresses of all machines connected as well as their traffic. What is confusing me is i have found ip addresses starting by 81.x.x.x and 116.x.x.x on our LAN.&lt;br/&gt;&lt;br/&gt;&lt;strong&gt;How in the world is this possible?? Since the address of the interface LAN is 192.168.0.1/16, i should only see ip addresses looking like this 192.168.x.x, shouldn't i?&lt;/strong&gt; &lt;br/&gt;&lt;br/&gt;The first thing i have noted is those weird ip addresses have a few Kbytes traffic. That's why i have tried to capture packets with Wireshark on every active interface of the router (to gather any information about them). And filtering the display with those addresses, i have found no packets matching them.&lt;br/&gt; Moreover a geolocalisation (using &lt;a href=&quot;https://www.iplocation.net&quot; rel=&quot;nofollow&quot;&gt;this webtool&lt;/a&gt;) of one of the ip address indicates it comes from China (we are located in Africa). Could have our network been hacked? And if so, how could i identify explicitly the hacking and prevent it from happening again?&lt;/p&gt;&#xA;" OwnerUserId="17044" LastEditorUserId="17044" LastEditDate="2016-07-27T10:24:32.933" LastActivityDate="2016-07-27T11:41:47.967" Title="ip addresses not meeting the IP addressing requirements of our company's network" Tags="|router|ip|network-access|" AnswerCount="1" CommentCount="11" ClosedDate="2018-03-19T18:55:40.507" ContentLicense="CC BY-SA 3.0" />
  <row Id="33540" PostTypeId="2" ParentId="33538" CreationDate="2016-07-27T11:41:47.967" Score="2" Body="&lt;p&gt;The best practice is to drop and log any outgoing packets that do not have a valid source address (192.168.0.0/16 in your case). Depending on your equipment, for that log to contain the MAC you may need to put it on your internal interface or turn on verbose logging or something else (see Ron Trunk's comment asking you for router/firewall make and model)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you get hits, then you have a MAC, and you can look for that MAC on your switches.&lt;/p&gt;&#xA;" OwnerUserId="22874" LastActivityDate="2016-07-27T11:41:47.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33541" PostTypeId="1" AcceptedAnswerId="33550" CreationDate="2016-07-27T14:16:39.553" Score="0" ViewCount="124" Body="&lt;p&gt;How can I change a switched port into a routed port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compared to IOS, is there an equivalent of &lt;code&gt;no switchport&lt;/code&gt;? If there is none, is there a workaround?&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2016-07-27T20:44:46.173" Title="VRP: Turn a switched into a routed port" Tags="|vrp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33545" PostTypeId="1" CreationDate="2016-07-27T15:00:20.363" Score="3" ViewCount="100" Body="&lt;p&gt;I have 3 routers that are to be directly connected using a fast Ethernet connection. Sensitive data will need to be communicated via these links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that if this was a serial link then i would be able to use PPP encapsulation process with CHAP. But what are my options for a fast Ethernet connection?&lt;/p&gt;&#xA;" OwnerUserId="25289" LastActivityDate="2017-05-14T07:24:05.753" Title="Communicating sensitive data over fast ethernet connection" Tags="|ethernet|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="33547" PostTypeId="2" ParentId="33541" CreationDate="2016-07-27T15:49:39.670" Score="0" Body="&lt;p&gt;If you are asking how to turn an interface on a switch back to factory defaults, where you can hook up a cable and it will connect to the Native VLAN with no problems or issues, use the &lt;strong&gt;switchport mode access&lt;/strong&gt; command to put the switch port into access mode.  Access mode will negate any configured VLAN assignments and port security setup on it.  To assign the switchport to a VLAN use &lt;strong&gt;switchport access vlan x&lt;/strong&gt; command which of course will assign that port to whatever VLAN you replace with X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are asking about something on a router then the switchport command doesn't really apply as you can't have switchport enabled on a router interface.&lt;/p&gt;&#xA;" OwnerUserId="23422" LastActivityDate="2016-07-27T15:49:39.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33548" PostTypeId="1" AcceptedAnswerId="33549" CreationDate="2016-07-27T18:44:39.440" Score="0" ViewCount="105" Body="&lt;p&gt;When taking about virtualization in computer networks, can we argue that &lt;code&gt;Overlay Network&lt;/code&gt; is the baseline of plenty of virtual networking techniques such as VPN, vLAN, peer-to-peer, and currently SDN? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My point here is that I think the introduction of overlay network concept led to have other types of network virtualization as I stated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to share this argument to see how strong it is. Thank you&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2016-07-27T20:34:25.250" Title="How overlay network has led to the other network virtualization techniques" Tags="|cisco|routing|vlan|vpn|sdn|" AnswerCount="1" CommentCount="1" ClosedDate="2016-07-27T23:15:40.727" ContentLicense="CC BY-SA 3.0" />
  <row Id="33549" PostTypeId="2" ParentId="33548" CreationDate="2016-07-27T20:34:25.250" Score="2" Body="&lt;p&gt;Overlay as in a layer is not new.  IP is layered on top of link layer technologies such as Ethernet.  IP GRE tunneling used to be discouraged because of the overhead, sometimes doubling the bandwidth required to send the same message if the message was small.  With encryption a requirement for some, encrypted tunneling like IPSec VPN's became popular.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days bandwidth is cheap and abundant so we have tons of overlay technologies deployed to fix various needs.  As a result, the number of network engineers with practical knowledge of link layer networking is decreasing - they simply overlay over overlay over overlay.  That's my opinion.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-27T20:34:25.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33550" PostTypeId="2" ParentId="33541" CreationDate="2016-07-27T20:44:46.173" Score="1" Body="&lt;h1&gt;&lt;a href=&quot;http://support.huawei.com/enterprise/docinforeader.action?contentId=DOC1000057408&amp;amp;idPath=7919710%7C21782164%7C21782167%7C16561&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sx300 Series Switches Common Operation Guide&lt;/a&gt;&lt;/h1&gt;&#xA;&lt;p&gt;&lt;strong&gt;6.6  Switching an Interface to Layer 3 Mode&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;h3&gt;Change the working mode of GE1/0/1 from Layer 2 mode to Layer 3 mode.&lt;/h3&gt;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;Quidway&amp;gt; system-view&#xA;[Quidway] interface gigabitethernet 1/0/1&#xA;[Quidway-GigabitEthernet1/0/1] undo portswitch&#xA;[Quidway-GigabitEthernet1/0/1] ip address 10.10.10.10 255.255.255.0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-07-27T20:44:46.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33551" PostTypeId="2" ParentId="22958" CreationDate="2016-07-27T20:52:51.673" Score="0" Body="&lt;p&gt;The AP has a router baked in which can probably hand out it's own addresses (internal DHCP server).  Just create an OUTSIDE VLAN on your switch and plug the outside address of your firewall into it and the AP into it.  If inside users want internal access they can VPN in via your firewall.  That's the easy way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want the AP to talk inside and outside WLAN's (SSID's) that can be done but requires a little more configuration.  You need a trunk link between the AP and switch and between the firewall and switch to carry frames from both WLANs to the firewall.  This will mean configuring your inside firewall port as a trunk as well.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-27T20:52:51.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33552" PostTypeId="2" ParentId="33545" CreationDate="2016-07-27T20:57:46.533" Score="3" Body="&lt;h1&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/IPsec&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPSec&lt;/a&gt;&lt;/h1&gt;&#xA;&lt;p&gt;IPSec Tunnel.  You need to verify that your routers have a security feature set, or VPN capability.  If they do, IPSec VPN is the tried and true method for doing this.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-07-27T20:57:46.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33553" PostTypeId="2" ParentId="33533" CreationDate="2016-07-27T21:07:00.033" Score="0" Body="&lt;h1&gt;&lt;a href=&quot;http://www.tcpipguide.com/free/t_TCPPortsConnectionsandConnectionIdentification-2.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP Ports, Connections and Connection Identification&lt;/a&gt;&lt;/h1&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;h3&gt;Multiple Connection Management&lt;/h3&gt;&#xA;&lt;p&gt;This identification of connections using both client and server&#xA;sockets is what provides the flexibility in allowing multiple&#xA;connections between devices that we take for granted on the Internet.&#xA;For example, busy application server processes (such as Web servers)&#xA;must be able to handle connections from more than one client, or the&#xA;World Wide Web would be pretty much unusable. Since the connection is&#xA;identified using the client's socket as well as the server's, this is&#xA;no problem. At the same time that the Web server maintains the&#xA;connection mentioned just above, it can easily have another connection&#xA;to say, port 2,199 at IP address 219.31.0.44. This is represented by&#xA;the connection identifier:&lt;/p&gt;&#xA;&lt;p&gt;(41.199.222.3:80, 219.31.0.44:2199). In fact, we can have multiple&#xA;connections from the same client to the same server. Each client&#xA;process will be assigned a different ephemeral port number, so even if&#xA;they all try to access the same server process (such as the Web server&#xA;process at 41.199.222.3:80), they will all have a different client&#xA;socket and represent unique connections. This is what lets you make&#xA;several simultaneous requests to the same Web site from your computer.&lt;/p&gt;&#xA;&lt;p&gt;Again, TCP keeps track of each of these connections independently, so&#xA;each connection is unaware of the others. TCP can handle hundreds or&#xA;even thousands of simultaneous connections. The only limit is the&#xA;capacity of the computer running TCP, and the bandwidth of the&#xA;physical connections to it—the more connections running at once, the&#xA;more each one has to share limited resources.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-07-27T21:07:00.033" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33554" PostTypeId="2" ParentId="33501" CreationDate="2016-07-27T21:23:53.073" Score="0" Body="&lt;p&gt;WiFi is a poor choice for ISP last mile connectivity.  Call your cell phone company and get 4G LTE, assuming you can't get a wired connection where you are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cnet.com/news/4g-lte-showdown-how-fast-is-your-carrier/&quot; rel=&quot;nofollow&quot;&gt;http://www.cnet.com/news/4g-lte-showdown-how-fast-is-your-carrier/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-27T21:23:53.073" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33556" PostTypeId="2" ParentId="22940" CreationDate="2016-07-28T01:21:26.347" Score="2" Body="&lt;p&gt;In the modern state of networks and from a wide-area networking perspective, circuit switched links are basically merely last mile circuits.  Such links are often categorized as analog or digital, such as T1's, PRI's, or telephone lines (sometimes called 1FB's by business customers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reality is once the traffic is onto the carriers network, it's all packetized and packet switched.  So, beyond your last mile circuit, there is no nailed up and wasted capacity in your carriers system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You physically can't push more into your carriers system than the last mile link will support.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-28T01:21:26.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33558" PostTypeId="2" ParentId="30780" CreationDate="2016-07-28T02:36:01.140" Score="-1" Body="&lt;h1&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/A-H/cmdref1/d3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco ASA Series Command Reference, A - H Commands&lt;/a&gt;&lt;/h1&gt;&#xA;&lt;h1&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/configuration/general/asa-95-general-config/basic-hostname-pw.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;CLI Book 1: Cisco ASA Series General Operations CLI Configuration Guide, 9.5&lt;/a&gt;&lt;/h1&gt;&#xA;&lt;h3&gt;poll-timer minutes number&lt;/h3&gt;&#xA;&lt;p&gt;The time, in minutes, of the polling cycle used to resolve FQDN network/host objects to IP addresses. FQDN objects are resolved only if they are used in a firewall policy. The timer determines the maximum time between resolutions; the DNS entry's time-to-live (TTL) value is also used to determine when to update to IP address resolution, so individual FQDNs might be resolved more frequently than the polling cycle. The default is 240 (four hours). The range is 1 to 65535 minutes.&lt;/p&gt;&#xA;&lt;h3&gt;dns expire-entry-timer&lt;/h3&gt;&#xA;&lt;p&gt;To remove the IP address of a resolved FQDN after its TTL expires, use the dns expire-entry-timer command in global configuration mode. To remove the timer, use the no form of this command.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;dns expire-entry-timer minutes minutes&#xA;&#xA;no dns expire-entry-timer minutes minutes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Syntax Description&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;minutes minutes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Specifies the timer time in minutes. Valid values range from 1 to 65535 minutes.&lt;/p&gt;&#xA;&lt;p&gt;Defaults&lt;/p&gt;&#xA;&lt;p&gt;By default, the DNS expire-entry-timer value is 1 minute.&lt;/p&gt;&#xA;&lt;p&gt;If none of that works, look at EEM to maybe clear your DNS cache automatically, or something like that to force an update.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-07-28T02:48:14.207" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33559" PostTypeId="2" ParentId="33342" CreationDate="2016-07-28T02:39:53.673" Score="0" Body="&lt;p&gt;R3 can deffinetly handle the packet. R3 has a route to R2 out f1/0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will get ICMP Redirects when a router's next hop for a packet goes out the same interface it was received on.&lt;/p&gt;&#xA;" OwnerUserId="15842" LastActivityDate="2016-07-28T02:39:53.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33560" PostTypeId="2" ParentId="33380" CreationDate="2016-07-28T06:25:09.053" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;A unique ASN (Autonomous System Number) is allocated to each AS for&#xA;  use in BGP (Border Gateway Protocol) routing. In BGP, each routing&#xA;  domain is a single administrative domain and has a unique AS number&#xA;  assigned to it, and is operated within a uniform set of routing&#xA;  policies. It also maintains interdomain routing.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Until 2007, AS numbers were defined as 16-bit integers, which allowed&#xA;  for a maximum of 65536 assignments. RFC 4893 introduced 32-bit AS&#xA;  numbers, which Internet Assigned Numbers Authority (IANA) has begun to&#xA;  allocate to regional Internet registries (RIRs), although this&#xA;  proposed standard has now been replaced by RFC 6793. These numbers are&#xA;  written preferably as simple integers (in a notation sometimes&#xA;  referred to as &quot;asplain&quot;) ranging from 0 to 4,294,967,295, or in the&#xA;  form called &quot;asdot&quot; which looks like x.y, where x and y are 16-bit&#xA;  numbers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://en.wikipedia.org/wiki/Autonomous_system_(Internet)&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Autonomous_system_(Internet)&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26940" LastEditorUserId="8499" LastEditDate="2016-07-29T07:01:28.313" LastActivityDate="2016-07-29T07:01:28.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33561" PostTypeId="1" CreationDate="2016-07-28T06:48:33.530" Score="6" ViewCount="4743" Body="&lt;p&gt;New to networking.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;How does the application layer inform the Internet layer of the destination IP address? Let's say I make a Http request to www.google.com, which the application layer resolves to 8.8.8.8 via DNS. How does this IP address get passed to the Internet layer if data is incapsulated between layers?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How does the application layer of a server know the source IP address of the client in a HTTP request? I understand that the Internet layer of the client adds the source IP address to the IP packet, but how is it appended to incoming HTTP request headers (eg XForwardedFor) Does the Internet layer somehow append the source IP to the application data in the form of HTTP headers? If so, how does the Internet layer even know the protocol the Application layer is using?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="28211" LastEditorUserId="8499" LastEditDate="2018-03-22T15:14:27.833" LastActivityDate="2018-03-22T15:20:37.057" Title="In the TCP/IP model, how does the application layer inform the Internet layer of the destination IP address?" Tags="|ip|tcp|layer3|osi|layer4|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33563" PostTypeId="2" ParentId="33524" CreationDate="2016-07-28T07:52:58.047" Score="0" Body="&lt;p&gt;DHCP request failed, APIPA being used or configured when the the end device are not connected with the DHCP Server but the next device to the end device is UP. Therefore, you needed to ping to from your next device to the DHCP Server / Router then you will troubleshoot it.&lt;/p&gt;&#xA;" OwnerUserId="28212" LastActivityDate="2016-07-28T07:52:58.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33567" PostTypeId="2" ParentId="33561" CreationDate="2016-07-28T09:37:35.840" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;On the client, information flows downward through each layer. I.e. your browser forms a HTTP request and pushes it down to transport layer as application payload with additional information such as transport protocol (TCP) destination port (80) and destination address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Transport layer protocol (TCP) incapsulates application payload to a segment and uses some of the information received from application layer (destination port) to add transport layer header. It than passes the segment down to network layer, together with some additional information, such as destination address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network layer protocol (IP) incapsulates transport layer segment in an IP packet/datagram and uses some of the additional information it received from the transport layer (destination address) to add the IP header. It than pushes it down to link layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link layer protocol (Ethernet) incapsulates network layer datagram in a frame. It than uses some of the data it gets from other protocols (ARP) to populate the link layer protocol header with correct destination address (MAC address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Described process is typically done by OS implementation (such as Unix sockets) and NIC drivers.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Because on the server end the above described procedure is reversed. Application does not only receive the application data from underlying layers, but also some of the additional information, such as source IP address and source port.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Please note that OS TCP/IP implementation and NIC drivers do not alter the application payload. Therefore they do not populate X-Forwarded-For HTTP header with any kind of data. IP address data is passed along the payload. In your case this was done by a Proxy between the client and the server. As the proxy is seen as a source IP address in network layer, proxy ensured the original source IP address is passed to the server in the application data payload.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;As you can see above, TCP/IP layer implementation is not as clean as in ISO/OSI theory - applications do need to be aware of some of the data that in theory should be contained in the lower layers. This is why applications need to be rewritten to support IPv6 (even though this is supposed to be a transparent network layer transport change, that does not affect application layer).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="25723" LastActivityDate="2016-07-28T09:37:35.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33569" PostTypeId="1" CreationDate="2016-07-28T11:50:23.927" Score="1" ViewCount="590" Body="&lt;p&gt;I am using MikroTik RouterBoard and YouTube videos or any other site videos plays very smoothly and fastly while Facebook Videos takes time in playing and also do not load much fast and also does alot of buffering and plays with stop ups so can anyone let me know what could be the problem??? while the facebook browsing is perfect also I am getting quite perfect ping response from facebook..!&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Note :&lt;/strong&gt; I am not using any LoadBalancing besides I am using just one RB750GL and also I am using Google Open DNS..!&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Facebook Ping At PC :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/MahoS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MahoS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Facebook Ping At MikroTik Terminal :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EGCYL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EGCYL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19616" LastEditorUserId="8499" LastEditDate="2018-02-14T16:20:27.920" LastActivityDate="2018-02-14T16:20:27.920" Title="Facebook videos are not playing smoothly and does too much buffering?" Tags="|ping|" AnswerCount="0" CommentCount="3" ClosedDate="2016-07-28T13:36:37.370" ContentLicense="CC BY-SA 3.0" />
  <row Id="33570" PostTypeId="2" ParentId="33561" CreationDate="2016-07-28T12:03:42.440" Score="-1" Body="&lt;p&gt;I think you're not understanding that the DNS query and the HTTP request are different packets and thats whats confusing you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you try to visit www.cool-site.com and you do not know its IP address then DNS happens first. The DNS process follows the whole encapsulation/decapsulation process like any other packet would. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your machine will realise it does not have an IP for www.cool-site.com. Your machine will build a DNS query and send it to the DNS servers you have specified (statically or ones it obtained via DHCP). Assuming the DNS server knows the address it will respond back to you with a DNS response containing the domain name and the IP address. Now the machine knows the IP address it can build a new packet for a HTTP request and put the IP address as the destination IP in the packet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server knows where to respond because in the HTTP request packet there is a source and destination IP within the IP header (like all packets). The server will respond and put its own IP as the source and use the source IP in the previous packet as the destination. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How exactly the packet is built in regards to grabbing the IP that was received from the DNS query and putting that in to a packets destination IP field I'm not clear on. The operating systems network stack obviously handles this but I can't give more information than that because I'm not sure on the whole process. Maybe someone can comment with some extra information.&lt;/p&gt;&#xA;" OwnerUserId="23560" LastActivityDate="2016-07-28T12:03:42.440" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33571" PostTypeId="2" ParentId="33561" CreationDate="2016-07-28T12:33:10.230" Score="-1" Body="&lt;p&gt;Simplified:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The application opens a TCP connection using a socket call.  One of the arguments to this call is a pointer to a socket descriptor structure.  The socket descriptor is partially poulated by the client application (including the server IP address) before the connection is made.  The structure is available to the application and to the IP stack (software) within the OS.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The server also has a socket structure associated with its listening socket.  The IP stack populates the source IP address and port when the connection is established.  The application can read values from the socket structure.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-07-28T12:33:10.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33572" PostTypeId="2" ParentId="33561" CreationDate="2016-07-28T12:36:15.593" Score="6" Body="&lt;p&gt;In addition to the data some metadata must be communicated betwen the application, transport and internet layers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Technically how metadata is communicated between layers is an implementation detail. In practice the application layer nearly always uses some variant of the berkerly sockets API to talk to the transport layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For TCP clients the destination IP and port are specified to the transport layer as part of the &quot;connect&quot; API call. For UDP clients either &quot;connect&quot; can be used to create a psuedo-connnection or the destination IP and port can be specified on a per-packet basis with the &quot;sendto&quot; api call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For TCP servers the application can read the IP and port by using  by calling getpeername after accepting a connection. UDP servers can read the IP and port for each packet by reading packets using the recvfrom API call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately sendto and recvfrom have a design flaw. They only pass the remote address, not the local one which can cause problems for servers on multihomed hosts. The server may send replies from the wrong IP address causing them to be dropped, either by the network or the client. There are newer APIs to deal with this but the details vary between operating systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The transport layer will in turn inform the internet layer of the IP addresses for outgoing packets and the internet layer will inform the transport layer of the IP addresses for incoming packets. Since both the transport and internet layers are typically part of the TCP/IP stack the details of how this is done is an implementation detail inside the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x-forwarded-for is a http header used by http proxies. The proxy will retrieve the client IP address using getpeername, it will then encode it into a http header to pass it on to the next server.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2018-03-22T15:20:37.057" LastActivityDate="2018-03-22T15:20:37.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33574" PostTypeId="1" AcceptedAnswerId="33575" CreationDate="2016-07-28T13:07:02.637" Score="7" ViewCount="14010" Body="&lt;p&gt;This doubt has been bugging me for a while now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Upon reading numerous articles i have found that the client and the server exchange their mss value during the tcp 3 way handshake and the lower of the two values is selected as the mss for the connection.&#xA;Since both client and server are using the same mss value isn't this negotiation?&lt;/p&gt;&#xA;" OwnerUserId="28216" LastActivityDate="2020-10-29T19:39:44.250" Title="Is MSS negotiated or exchanged during the 3 way handshake" Tags="|tcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33575" PostTypeId="2" ParentId="33574" CreationDate="2016-07-28T14:17:20.017" Score="15" Body="&lt;p&gt;It is NOT considered a negotiation, it is a statement of an known maximum, and there is not back and forth.  It can be different bidirectionally. So one TCP flow can have a different MSS each way.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc879&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 879&lt;/a&gt; states:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;HOSTS MUST NOT SEND DATAGRAMS LARGER THAN 576 OCTETS UNLESS THEY HAVE SPECIFIC KNOWLEDGE THAT THE DESTINATION HOST IS PREPARED TO ACCEPT LARGER D&#xA;ATAGRAMS.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;thus:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;THE TCP MAXIMUM SEGMENT SIZE IS THE IP MAXIMUM DATAGRAM SIZE MINUS&#xA;FORTY.&lt;/p&gt;&#xA;&lt;p&gt;The default IP Maximum Datagram Size is 576.&lt;/p&gt;&#xA;&lt;p&gt;The default TCP Maximum Segment Size is 536.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;And continuing:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;TCP provides an option that may be used at the time a connection is established (only) to indicate the maximum size TCP segment that can be accepted on that connection.  This Maximum Segment Size (MSS)    announcement &lt;strong&gt;(often mistakenly called a negotiation)&lt;/strong&gt; is sent from the  data receiver to the data sender and says &amp;quot;I can accept TCP segments up to size X&amp;quot;. The size (X) may be larger or smaller than the default.  The MSS can be used completely independently in each direction of data flow.  &lt;strong&gt;The result may be quite different maximum sizes in the two directions.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You can find a lot more information on MSS in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6691&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6691&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122#page-85&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1122&lt;/a&gt; section 4.2.2.6&lt;/p&gt;&#xA;" OwnerUserId="412" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-07-28T14:17:20.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33580" PostTypeId="1" AcceptedAnswerId="33582" CreationDate="2016-07-28T15:29:24.813" Score="1" ViewCount="77" Body="&lt;p&gt;I'm currently practicing setting up an MPLS VPN using GNS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the topology i have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/G9old.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G9old.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to, on all P and PE  routers enable OSPF routing protocol advertising all inside networks .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From PE1 I have advertised the 10.1.1.0 network and the 192.168.1.0 network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then when i go in to router P1 and bring up the routing table, i can only see the directly interfaces and not the interface which is connected to PE1(10.1.1.2). Why is this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...this then brings me on to my next question, in the routing table of, for example P1. I am seeing that the directly connected interfaces are&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C       2.2.2.2 is directly connected, Loopback0&#xA;     192.168.1.0/30 is subnetted, 2 subnets&#xA;C       192.168.1.0 is directly connected, FastEthernet0/0&#xA;C       192.168.1.4 is directly connected, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is it showing that the directly connected interfaces are 192.168.1.0 and 192.168.1.4, when i have them configured as followed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/0            192.168.1.2     YES NVRAM  up                    up&#xA;FastEthernet0/1            192.168.1.5     YES NVRAM  up                    up&#xA;FastEthernet1/0            unassigned      YES NVRAM  administratively down down&#xA;Serial2/0                  unassigned      YES NVRAM  administratively down down&#xA;Serial2/1                  unassigned      YES NVRAM  administratively down down&#xA;Serial2/2                  unassigned      YES NVRAM  administratively down down&#xA;Serial2/3                  unassigned      YES NVRAM  administratively down down&#xA;Loopback0                  2.2.2.2         YES NVRAM  up                    up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router configurations...&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;P1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;P1#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1352 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname P1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;interface Loopback0&#xA; ip address 2.2.2.2 255.255.255.255&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.1.2 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.1.5 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router ospf 10&#xA; log-adjacency-changes&#xA; network 192.168.1.0 0.0.0.0 area 1&#xA;&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PE1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE1#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1426 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname PE1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 1.1.1.1 255.255.255.255&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.1.1.2 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.1.1 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router ospf 10&#xA; log-adjacency-changes&#xA; network 10.1.1.0 0.0.0.3 area 0&#xA; network 192.168.1.0 0.0.0.3 area 0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;&#xA;control-plane&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="25289" LastEditorUserId="8499" LastEditDate="2018-12-25T02:10:18.150" LastActivityDate="2018-12-25T02:10:18.150" Title="OSPF and addressing problem" Tags="|cisco|routing|ospf|ip-address|gns3|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33581" PostTypeId="2" ParentId="33580" CreationDate="2016-07-28T15:35:04.330" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Can't say for sure without seeing the configuration, but most likely&#xA;P1 and PE1 are not fully adjacent.&lt;/li&gt;&#xA;&lt;li&gt;The routing table doesn't show interfaces, it shows &lt;strong&gt;routes&lt;/strong&gt;. &#xA;It's telling you to get to  the network 192.168.1.0/30, use&#xA;interface Fa0/0.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-28T15:35:04.330" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33582" PostTypeId="2" ParentId="33580" CreationDate="2016-07-28T15:35:19.600" Score="1" Body="&lt;p&gt;For your first question, you are not advertising the &lt;code&gt;10.1.1.0/30&lt;/code&gt; network as you said you are. You need to advertise it, too:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For PE1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 10&#xA; log-adjacency-changes&#xA; network 10.1.1.0 0.0.0.3 area 1&#xA; network 192.168.1.0 0.0.0.3 area 0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For P1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 10&#xA; log-adjacency-changes&#xA; network 192.168.1.0 0.0.0.3 area 0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, you are not running OSPF on P1. P1 will never learn routes advertised by PE1 unless you statically define them on P1, or you run a common routing protocol between P1 and PE1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your second question, the routing table is show the directly connected networks: &lt;code&gt;192.168.1.0/30&lt;/code&gt; and &lt;code&gt;192.168.1.4/30&lt;/code&gt;. Routing tables show the networks. What you have configured on your interfaces are specific addresses within those networks.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-28T16:41:30.077" LastActivityDate="2016-07-28T16:41:30.077" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="33583" PostTypeId="2" ParentId="33534" CreationDate="2016-07-28T16:08:15.090" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Turn down the volume (RF power) on each AP such that the size of each WiFi cell is limited to a single room (as best you can).  This is done via the controller.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set the minimum connection speed/bandwidth up higher to discourage clients from connecting to another rooms AP.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure your power is not oversubscribed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt; Switch&amp;gt; show power inline&#xA; Available:370.0(w)  Used:80.6(w)  Remaining:289.4(w)&#xA;&#xA; Interface Admin  Oper       Power   Device              Class Max&#xA;                             (Watts)&#xA; --------- ------ ---------- ------- ------------------- ----- ----&#xA; Fa0/1     auto   on         6.3     IP Phone 7910       n/a   15.4&#xA; Fa0/2     static off        15.4    n/a                 n/a   15.4&#xA; Fa0/3     auto   on         6.3     IP Phone 7910       n/a   15.4&#xA; Fa0/4     auto   on         6.3     IP Phone 7960       2     15.4&#xA; Fa0/5     static on         15.4    IP Phone 7960       2     15.4&#xA; Fa0/6     static power-deny 10.0    n/a                 n/a   10.0&#xA; Fa0/7     auto   on         6.3     IP Phone 7910       n/a   15.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-28T16:08:15.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33584" PostTypeId="2" ParentId="33534" CreationDate="2016-07-28T16:32:56.937" Score="2" Body="&lt;p&gt;If your access points are continuously rebooting, it either means your switches can't supply enough power, or they can't communicate with the controller -- i.e., you don't have reliable network connectivity.  That could be wiring problems, or perhaps you have your switches daisy-chained and you are oversubscribing uplinks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can look at your interface counters to see if you see errors or drops.  That will give you a hint where to start looking.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-28T16:32:56.937" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33585" PostTypeId="1" CreationDate="2016-07-28T16:37:42.587" Score="1" ViewCount="1438" Body="&lt;p&gt;My naive understanding of how the internet works is as follow :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Physical layer (1)&#xA;Link layer (2) - Inside frames&#xA;IP layer (3) - Inside IPv4 or IPv6 packets&#xA;Transport layer (4) - Inside TCP or UDP&#xA;Application layer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where does L2TP protocol stands? The name suggests it is a layer 2 protocol, but the wiki article says L2TP packets are inside UDP datagrams. This, to me, suggests it is an application protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is L2TP a layer 2 protocol? Is it using another &quot;kind of frame&quot; different thant the common one I am used to? Or is it actually an application protocol contained within &quot;normal&quot; frames, IP packets and UDP datagrams?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="2130" LastActivityDate="2016-07-28T17:36:57.613" Title="Is L2TP really a Layer 2 protocol?" Tags="|layer2|l2tp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33586" PostTypeId="2" ParentId="33585" CreationDate="2016-07-28T16:42:14.047" Score="3" Body="&lt;p&gt;Tunneling protocols like L2TP, GRE, IPSEC and MPLS don't fit well into the OSI model.  L2TP tunnels (encapsulates) L2 frames in UDP so it can be transported over layer 3.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-28T16:42:14.047" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="33587" PostTypeId="2" ParentId="33585" CreationDate="2016-07-28T17:36:57.613" Score="5" Body="&lt;p&gt;Fixed layer count models and tunneling don't match up very well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our stack might look something like.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Appliction data.&lt;/li&gt;&#xA;&lt;li&gt;TCP (inner network)&lt;/li&gt;&#xA;&lt;li&gt;IP (inner network)&lt;/li&gt;&#xA;&lt;li&gt;Ethernet framing (inner network)&lt;/li&gt;&#xA;&lt;li&gt;L2TPv3&lt;/li&gt;&#xA;&lt;li&gt;UDP (outer network)&lt;/li&gt;&#xA;&lt;li&gt;IP (outer network)&lt;/li&gt;&#xA;&lt;li&gt;Ethernet framing (outer network)&lt;/li&gt;&#xA;&lt;li&gt;Ethernet medium access control&lt;/li&gt;&#xA;&lt;li&gt;Ethernet physical&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What layer we regard L2TP as depends on what perspective we are looking from. From the perspective of the &quot;outer&quot; network it looks like an application protocol. From the perfective of the &quot;inner&quot; network it looks like an Ethernet port.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-07-28T17:36:57.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33594" PostTypeId="1" AcceptedAnswerId="34400" CreationDate="2016-07-29T08:18:09.353" Score="1" ViewCount="1721" Body="&lt;p&gt;We've got a problem with our WiFi company network. We bought a Cisco Switch and Wireless LAN Controller (Cisco 2500 WLC) plus eight Access Point (Aironet 2700) to offer clients seamless roaming between APs.&#xA;These APs work like charm (I think it's just because they are from the same vendor), but our network was at first stages built around Mikrotik devices and now we are heading several problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Short about our topology:&#xA;We want two WiFi networks (two SSIDs) so we made two VLANs (20,30).  The traffic from Access Points is packed inside one agregated management VLAN (10). Because of agregated link the WLAN Controller is connected to network using one LAN connection. At this point everything works and everything blinks :) (and inside this Cisco &quot;subnetwork&quot; I am able to ping these Cisco devices each other).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XErDa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XErDa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 15.0&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;service sequence-numbers&#xA;!&#xA;hostname sw-01&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login default group radius local&#xA;aaa authorization console&#xA;aaa authorization exec default group radius local&#xA;aaa accounting exec default start-stop group radius&#xA;aaa accounting connection default start-stop group radius&#xA;aaa accounting system default start-stop group radius&#xA;!&#xA;!&#xA;aaa session-id common&#xA;switch 1 provision ws-c2960s-48ts-l&#xA;!&#xA;ip dhcp pool 172.18.106.0&#xA; description Pool for first WiFi network&#xA; network 172.18.106.0 255.255.254.0&#xA; default-router 172.18.106.19&#xA; dns-server 8.8.8.8&#xA;!&#xA;ip dhcp pool 172.18.113.0&#xA; description Pool for second WiFi network&#xA; network 172.18.113.0 255.255.255.0&#xA; default-router 172.18.113.19&#xA; dns-server 8.8.8.8&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;no spanning-tree vlan 1-4094&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description Connection WLAN Controller switch&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA; description AP connection to WLAN Controller &#xA; switchport access vlan 10&#xA; switchport mode access&#xA; switchport voice vlan 10&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/13&#xA; description Connection WLAN Controller and Mikrotik &#xA; switchport mode trunk&#xA;!&#xA;interface Vlan20&#xA; ip address 172.18.106.10 255.255.254.0&#xA;!&#xA;interface Vlan30&#xA; ip address 172.18.113.10 255.255.255.0&#xA;!&#xA;ip default-gateway 172.18.105.19&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;logging history informational&#xA;logging facility local6&#xA;logging host XX.XX.XX.XX&#xA;!&#xA;snmp-server community public RO&#xA;!&#xA;ntp logging&#xA;ntp server xx.xx.xx.xx&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BUT:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;first problem is the DHCP server. When it is configured on Cisco switch all WiFi clients get their IP with no problems. But when it is configured on Mikrotik the WiFi client gets the IP but when looking into Mikrotik ARP &#xA;tables they have the same MAC address. The MAC address of WLAN Controller. &lt;/li&gt;&#xA;&lt;li&gt;when I try to ping Mikrotik router from Cisco switch it works. When I try to ping Cisco switch from Mikrotik it also works. But when I try to ping Mikrotik from WiFi client the client sends ARP request but is unable to get any reply from Mikrotik at all (all clients have IP address and default gateway set properly). And when I try to ping client from Mikrotik router it also doesn't work but after 2 or 3 minutes it starts work!&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is madness and we had to misconfigure something or some sort of service/protocol does not works properly between Mikrotik and Cisco. Have you ever seen something like this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PARTIAL SOLUTION:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, we found that we had several problems under one roof. And we overcame it by using brute force techniques (very time-consuming...)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;all AP should be connected through Trunk BUT with a native VLAN configured. In our case it is trunk with native VLAN 10.&lt;/li&gt;&#xA;&lt;li&gt;we changed ARP cache timeout on Cisco Switch to 20 sec.&lt;/li&gt;&#xA;&lt;li&gt;we made DHCP server on Mikrotik BUT we also had to configure Cisco Switch as DHCP Relay Agent.&lt;/li&gt;&#xA;&lt;li&gt;the most important thing is that we change AP mode to flexconnect technology, so all APs are autonomous but we lost advanced roaming feature provided by Wireless LAN Controller. Now, all WiFi clients manage their connection, itself. This is very buggy because of bad implementation of roaming in today's WiFi chips.&lt;/li&gt;&#xA;&lt;li&gt;we flashed the WLC to newest version...&lt;/li&gt;&#xA;&lt;li&gt;we turned off VTP prunning on Cisco switch. Maybe this was the main cause of that undefined behavior of ping.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So simple... &lt;/p&gt;&#xA;" OwnerUserId="28233" LastEditorUserId="8499" LastEditDate="2018-02-14T16:19:48.473" LastActivityDate="2018-02-14T16:19:48.473" Title="Mikrotik - Cisco requests not working properly" Tags="|cisco|arp|trunk|" AnswerCount="1" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="33595" PostTypeId="1" AcceptedAnswerId="33724" CreationDate="2016-07-29T09:40:01.250" Score="2" ViewCount="9998" Body="&lt;p&gt;Considering the 5 modes of operation of wireless access points described on &lt;a href=&quot;http://www.ezlan.net/Wireless_Modes.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt;, there a among them:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Mode 2 - Bridge&lt;/strong&gt;.  Most APs can also be configured as a Bridge. In such Configuration the AP can only communicate with another AP that is configured as a Bridge.  This mode is useful to Bridge two LAN segments that are apart, and it is preferred to connect them wirelessly.   Plug one AP Bridge to a Switch on the first LAN, the other AP to a Switch on the second LAN, and they are connected.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Mode 3 -  Client&lt;/strong&gt;.  Few APs can also be configured as Clients.  In such a configuration they act as a &amp;quot;Fancy&amp;quot; regular Wireless card that usually goes on a computer.  Under such configuration The AP can only communicate with Wireless Cable/DSL Router or an AP configured as a Gateway.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Mode 5 - Independent Bridges&lt;/strong&gt;.  These are units that are actually Wireless clients Independent of Drivers (Driverless Wireless Client Cards).  As a result they can be connected to a device that supports Wireless but it is not a regular computer.  They can turn Ethernet equipped like Printers and Game Boxes into Wireless compatible devices. (Linksys WET11, D-Link DWL-810). Plug one of these into a Switch and you can connect few computers with wires to the switch while these computers are Bridged Wirelessly to the main Network.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;When searching for &amp;quot;Client Mode&amp;quot; in the context of APs the information seems unclear. Most times it is described more like &amp;quot;Mode 5&amp;quot; which means it can connect wirelessly to another AP in &amp;quot;Gateway&amp;quot; or &amp;quot;Bridge&amp;quot; mode and on the other end has a wired (Ethernet) connection which can be connected to a single computer or switch. But then what exactly do they mean by &amp;quot;Mode 3&amp;quot;?&lt;/p&gt;&#xA;&lt;p&gt;So what I'm looking for is an even more precise definition of the operation modes if there is one. In particular I would like to know if there really is a formal definition of the Modes 3 and 5 or if it is rather the type and configuration of a given device that makes a difference.&lt;/p&gt;&#xA;" OwnerUserId="13457" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-03T13:45:38.287" Title="What is the difference between &quot;Client Mode&quot; and &quot;Independent Bridge&quot; in an AP?" Tags="|wireless|ethernet|bridge|access-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33600" PostTypeId="1" AcceptedAnswerId="33602" CreationDate="2016-07-29T18:39:05.843" Score="1" ViewCount="183" Body="&lt;p&gt;I'm not sure I'm in the right place, I'm still trying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would it be possible to assign a public IP provided by the entity providing them (&lt;code&gt;RIR&lt;/code&gt;?) to a server/router in another continent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know much about how IP assignation work (how it gets to my router at home for instance), but often, ISPs allow a user to choose the &quot;country&quot; assigned to a failover IP for a dedicated server. I would like to know if it's possible to do it inter-continent, if so, how could I proceed please (which entity to contact first, etc...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance&lt;/p&gt;&#xA;" OwnerUserId="28241" LastEditorUserId="8499" LastEditDate="2020-07-17T00:06:58.973" LastActivityDate="2020-07-17T00:06:58.973" Title="Assign country IP to another continent" Tags="|ip|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33601" PostTypeId="1" CreationDate="2016-07-29T18:40:38.173" Score="3" ViewCount="2113" Body="&lt;p&gt;I am having trouble wrapping my brain around a VRF concept and why two switches are communicating with each other on a particular VLAN when I don't think they should.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;switch1 &amp;amp; switch2 are independent core switches with a port channel between them. However, none of the VLANs that are configured with SVIs in the VRF are configured on the port channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have vlan 920 (L2) configured on switch1 and switch2. I also have SVI vlan920 (L3) configured on both switches. The SVI vlan920 is configured inside VRF extwan as are several others. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;vlan920 on switch1 is 10.146.64.130 &amp;amp; 10.146.64.131 on switch2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I issue a 'ping vrf extwan 10.146.64.131' on switch1, I get a reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I do a 'sh ip arp vrf extwan' on switch1 there's an entry pointing .131 to vlan920 &amp;amp; a MAC address on switch2 that is the same for every SVI on that switch. I assume it represents the MSFC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, there is no physical L3 connection set up yet between the switches and the existing L2 channel does not include these VLANs, how am I getting ARP entries in the VRF for the other switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VRF is connected to a set of ASAs on another SVI (also in the VRF) so maybe it's going through that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility is that these switches are connected to access switches but STP is blocking one of the links on each VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/SnZRv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SnZRv.jpg&quot; alt=&quot;Simplified/Sanitized Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23610" LastEditorUserId="8499" LastEditDate="2018-03-22T15:12:51.243" LastActivityDate="2018-07-20T16:45:25.703" Title="Cisco VRFs and L2 inter-switch communication" Tags="|cisco|routing|switch|layer3|vrf|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33602" PostTypeId="2" ParentId="33600" CreationDate="2016-07-29T18:43:38.053" Score="1" Body="&lt;p&gt;The ISP to which you connect must agree to advertise and route any addressing which you use, regardless of continent. If the ISP owns the address in question, this may be easy, but if the ISP doesn't own the address, you will need to connect to the ISP using BGP, and the ISP will not advertise any prefix longer than &lt;code&gt;/24&lt;/code&gt; for IPv4 or &lt;code&gt;/48&lt;/code&gt; for IPv6.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-29T18:43:38.053" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33603" PostTypeId="2" ParentId="33600" CreationDate="2016-07-29T19:40:00.867" Score="0" Body="&lt;p&gt;No.  But what you can do is get a circuit in country you want to talk from and then from that circuit, you can tunnel/route all the traffic to a different location - any location at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are not in control of the public IP address assignment at all but you are in control of traffic once it gets to that address.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-29T19:40:00.867" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33604" PostTypeId="2" ParentId="33047" CreationDate="2016-07-29T20:01:10.007" Score="1" Body="&lt;p&gt;Just to close this out, I worked with Cisco support to configure ACS to limit their access as much as possible but they did confirm that you cannot limit access to a VRF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also asked them if I could allow access to all commands in a particular mode using Cisco ACS (i.e. everything under config-if) and the answer was no to that one too. The guy said you need to put the start of the command in and wildcard it.&lt;/p&gt;&#xA;" OwnerUserId="23610" LastActivityDate="2016-07-29T20:01:10.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33605" PostTypeId="1" CreationDate="2016-07-29T20:02:06.373" Score="1" ViewCount="280" Body="&lt;p&gt;Trying to go from inside network to outside network, I have a 3560 switch connecting to a 2960 switch which connects to 5520 ASA firewall. I have a Single 3560 switch for my outside network connecting to the firewall.&#xA;When I ping the outside host I dont get response, can someone please help, thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my config for the firewall:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;5520ASA# sh run&#xA;: Saved&#xA;:&#xA;: Serial Number: JMX1131L1ZU&#xA;: Hardware:   ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz&#xA;:&#xA;ASA Version 9.1(7)&#xA;!&#xA;hostname 5520ASA&#xA;domain-name NetworkBell&#xA;enable password 2KFQnbNIdI.2KYOU encrypted&#xA;xlate per-session deny tcp any4 any4&#xA;xlate per-session deny tcp any4 any6&#xA;xlate per-session deny tcp any6 any4&#xA;xlate per-session deny tcp any6 any6&#xA;xlate per-session deny udp any4 any4 eq domain&#xA;xlate per-session deny udp any4 any6 eq domain&#xA;xlate per-session deny udp any6 any4 eq domain&#xA;xlate per-session deny udp any6 any6 eq domain&#xA;names&#xA;!&#xA;interface GigabitEthernet0/0&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.1.10 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1&#xA; nameif outside&#xA; security-level 0&#xA; ip address 192.168.2.20 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/2&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;!&#xA;interface Management0/0&#xA; nameif management&#xA; security-level 100&#xA; ip address 192.168.3.1 255.255.255.0&#xA;!&#xA;ftp mode passive&#xA;dns server-group DefaultDNS&#xA; domain-name NetworkBell&#xA;object network outside3560&#xA; host 192.168.2.21&#xA;object network inside3560&#xA; host 192.168.1.11&#xA;object-group icmp-type ping&#xA; icmp-object echo&#xA; icmp-object echo-reply&#xA;access-list outside_access_in extended permit icmp object outside3560 object inside3560 object-group ping&#xA;access-list inside extended permit icmp host 192.168.1.11 host 192.168.2.21&#xA;access-list outside extended permit icmp host 192.168.2.21 host 192.168.1.11&#xA;pager lines 24&#xA;mtu management 1500&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;access-group inside in interface inside&#xA;access-group outside_access_in global&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL&#xA;http server enable&#xA;http 192.168.160.41 255.255.255.255 management&#xA;http 192.168.3.0 255.255.255.0 management&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpool policy&#xA;telnet timeout 5&#xA;ssh stricthostkeycheck&#xA;ssh 192.168.3.0 255.255.255.0 management&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;dhcpd address 192.168.3.2-192.168.3.254 management&#xA;dhcpd enable management&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;username cisco password 3USUcOPFUiMCO4Jk encrypted&#xA;!&#xA;!&#xA;!&#xA;policy-map global_policy&#xA;!&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;Cryptochecksum:d41d8cd98f00b204e9800998ecf8427e&#xA;: end&#xA;5520ASA#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27334" LastEditorUserId="8499" LastEditDate="2016-08-02T15:56:12.637" LastActivityDate="2016-08-02T15:56:12.637" Title="Trying to go from inside to outside" Tags="|cisco-asa|firewall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33606" PostTypeId="1" AcceptedAnswerId="33607" CreationDate="2016-07-29T21:51:17.710" Score="2" ViewCount="1923" Body="&lt;p&gt;Supposing we have a router (Internet box for example) with 2 switch connected on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a machine A on switch 1 and a machine B on switch 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router wants to transmit a packet to machine A on switch 1. ARP is already resolved, so the packet will contain machine A destination MAC addresse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does a router know which switch to send this packet?&lt;/p&gt;&#xA;" OwnerUserId="23817" LastActivityDate="2016-08-01T03:28:37.853" Title="How does a router know onwhich switch to send a packet?" Tags="|switch|router|mac|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33607" PostTypeId="2" ParentId="33606" CreationDate="2016-07-29T21:54:00.733" Score="0" Body="&lt;p&gt;Each router interface will be in a different network. The router will use the interface for the destination network, so the switch connected to the interface with the destination network will get the frame for the destination host. The router will look in its ARP cache or use ARP for the interface with the destination host.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-07-29T21:54:00.733" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33608" PostTypeId="2" ParentId="33605" CreationDate="2016-07-29T22:27:44.280" Score="2" Body="&lt;p&gt;You have the access list &quot;inside&quot; on both the inside and outside interfaces&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-07-29T22:27:44.280" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33609" PostTypeId="2" ParentId="33601" CreationDate="2016-07-29T22:37:44.943" Score="1" Body="&lt;p&gt;At first I thought this might be working as designed or some artifact of L2 communication I didn't understand. However, I did some deeper digging and found another path between switch1 and switch2 on vlan 920...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that switch1 was learning switch2's SVI MAC address for vlan 920 through another port channel which led to one of the access switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took a look at this access switch and for reasons I don't yet understand, it has STP turned off (no spanning-tree vlan 550, 920, 930, 940) for the VLANs I added for this project. I think this happened automatically as VTP is enabled on this network and the config changed on the same day the vlan.dat file changed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So communication on VAN 920 is going from switch1, to this access switch and then switch2 because STP isn't being blocked on either of the port channels to the access switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll close this question out and will probably post a new question on how this would happen. I haven't found the answer via google yet.&lt;/p&gt;&#xA;" OwnerUserId="23610" LastActivityDate="2016-07-29T22:37:44.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33615" PostTypeId="1" AcceptedAnswerId="33624" CreationDate="2016-07-30T08:53:19.520" Score="7" ViewCount="34639" Body="&lt;p&gt;I feel like the three terms are often used as synonyms but actually all mean something different. I did look at Wikipedia sites but I'm still unsure about the definitions of the three.&lt;/p&gt;&#xA;&lt;p&gt;From my understanding, &lt;strong&gt;routing&lt;/strong&gt; is concerned with finding a path or paths to a destination and deciding where to send an (unknown) packet to/which path to use based on its destination or prefix and not just based on a simple lookup in a table. This is what happens at IP routers (shortest prefix routing).&lt;/p&gt;&#xA;&lt;p&gt;These simple lookups are what I understand as &lt;strong&gt;forwarding&lt;/strong&gt;: The header/label (cf. MPLS)/etc are matched against entries in a flow table (or multiple tables). An exact match tells the switch on which port to output the packet without further computation or decisions to be made. If no match is found, a default action is performed or a separate controller is asked (as in SDN). This can be done faster than routing because of less computation and specialized hardware, correct?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Switching&lt;/strong&gt; seems to be fairly similar to forwarding but with an emphasis on what happens on hardware in the switching fabric after the lookup in a table. This on OSI level 2 (data link) while routing and forwarding are actions on level 3 (network)?&lt;/p&gt;&#xA;&lt;p&gt;What's correct/wrong about these intuitions? Did I miss something of importance? Are there differences between IP routing/forwarding (Google returns the same Wikipedia article)? What about the MAC layer?&lt;/p&gt;&#xA;" OwnerUserId="23061" LastEditorUserId="31800" LastEditDate="2022-11-11T10:04:34.987" LastActivityDate="2022-11-11T10:04:34.987" Title="Difference between routing, forwarding, and switching" Tags="|routing|switching|layer2|osi|layer3|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="33616" PostTypeId="2" ParentId="33615" CreationDate="2016-07-30T10:37:09.083" Score="5" Body="&lt;p&gt;The way I see it, forwarding applies to forwarding at any layer.  A frame/packet/cell arrives at a device, a header address is inspected and that address is looked up in the forwarding table, the forwarding decision is made and the datagram is sent out of that interface on its way.  Routing describes this function when the forwarding decision is made at layer 3, using the IP destination address.  Switching and bridging refer to the forwarding decision being made at layer 2, using the destination MAC address.  I know there is some confusion around this as I have seen layer 3 forwarding referred to as switching when it is carried out on an L3 switch.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-07-30T10:37:09.083" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33619" PostTypeId="2" ParentId="3482" CreationDate="2016-07-30T13:33:29.457" Score="1" Body="&lt;p&gt;And many boxes are far more limited, &lt;em&gt;really&lt;/em&gt; - 255 VLANs picked &lt;strong&gt;from&lt;/strong&gt; 1-4093 (not 4094) is the case on some of my switches. The numerical range is available but the switch can only use 255 individual numbers from it at one time. So far this has never even come close to being a practical problem here.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-07-30T13:33:29.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33620" PostTypeId="1" AcceptedAnswerId="33621" CreationDate="2016-07-30T14:24:09.670" Score="0" ViewCount="38" Body="&lt;p&gt;When i connect to public WiFi at airport, hostel, restaurant i have to signup by fill my information in webpage to granting access to internet (sometime just showing welcome page). so&#xA;What is technique they using in wifi router to signup process?&lt;/p&gt;&#xA;" OwnerUserId="28266" LastActivityDate="2016-07-30T14:33:29.867" Title="Sign up in public wifi" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="1" ClosedDate="2019-03-04T00:22:51.210" ContentLicense="CC BY-SA 3.0" />
  <row Id="33621" PostTypeId="2" ParentId="33620" CreationDate="2016-07-30T14:33:29.867" Score="0" Body="&lt;p&gt;This is known as a captive portal.&lt;/p&gt;&#xA;" OwnerUserId="28267" LastActivityDate="2016-07-30T14:33:29.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33622" PostTypeId="2" ParentId="33416" CreationDate="2016-07-30T15:40:35.353" Score="5" Body="&lt;p&gt;You are about 49% right. There is not much preventing you from using an arbitrary IP address. This can be done like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ifconfig eth0 99.99.99.99 up&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(this appears to be a not actually used, but public address owned by AT&amp;amp;T, so please don't try this at home).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first problem is to &lt;strong&gt;connect your host to the Internet&lt;/strong&gt;. In my home my router provides &lt;code&gt;192.168.178.1&lt;/code&gt; as the gateway to the Internet (the actual address the router of your ISP may vary). You have to send your packets to this address, since there's no other way to the Internet. Unfortunately, this gateway only accepts packets from &lt;code&gt;192.168.178/24&lt;/code&gt;, which &lt;code&gt;99.99.99.99&lt;/code&gt; is not part of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's the first 1% of the problem you might face. With some manual routing table tweaking you may overcome this by persuading your network to send your packets to this gateway anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you overcome this first obstacle, your packets will probably (with some luck) actually reach their final destination and will be processed there. A great share of layer 4 protocols in the Internet are TCP connections, though. They require the famous 3-way-handshake: So after the first &lt;code&gt;SYN&lt;/code&gt; packet reached its destination the target host responds with a &lt;code&gt;SYN|ACK&lt;/code&gt; package and sends it to the sender's address, which is &lt;code&gt;99.99.99.99&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now your packet has to deal with the real 50% challenge: How to find its way home? Unfortunately &lt;strong&gt;you have told no one except yourself that you expect &lt;code&gt;99.99.99.99&lt;/code&gt; to be delivered to your own host&lt;/strong&gt;. And that is the main problem you have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may argue now, &quot;Why can't I tell the Internet that I now have 99.99.99.99 on my computer?&quot;. Well actually, you could. You had to find a way for distributing this information to virtually the whole Internet (or at least all public Internet routers). Fortunately there is a means to do so. That's what we call BGP. It is run by a community of big boys that take care that a few rules are obeyed. This is more or less what we know as &quot;buying and registering official IP addresses&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With some effort you could try and succeed to become one of the big boys and eventually become part of the community that runs the BGP infrastructure. If you managed to do so, you could actually tell the global BGP network to route 99.99.99.99 to your home. If you did so, you would have been expelled pretty quickly from that club, though, I dare to predict.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The short version of your question is it is easy to pretend you own a public IP address, but virtually nobody would take you seriously.&lt;/p&gt;&#xA;" OwnerUserId="28268" LastEditorUserId="8499" LastEditDate="2016-07-30T17:23:47.970" LastActivityDate="2016-07-30T17:23:47.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33623" PostTypeId="2" ParentId="33533" CreationDate="2016-07-30T15:43:13.413" Score="0" Body="&lt;p&gt;Many ISP's assign you an IP Address for Some Period. Most of the time they have one or more DHCP servers, so that every time you connect your modem or corresponding networking device you get a different IP and if they are not using NAT then most probably you will get a Temporary Public IP Address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK, now you have an working IP address and you can start communicating with some Internet Services whether it is a Network Layer Service, Transport Layer Service or Application Layer Service. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Network layer Service you do not need to open a port on your computer. For example when you are pinging a machine from your computer by using ping command then you are actually using the ICMP protocol and more specifically you are using the ICMP Echo Request and In response you will get an ICMP echo Response. &#xA;The Network layer can be also used for some other purposes for example IGMP or other Layer 3 protocols. The most interesting fact about this is that you do not need to have any Port open to work with this protocol. You need only an IP address for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in terms of Transport Layer Service whether it is TCP or UDP you need to open a port to communicate with the service. And in terms of Application layer service that port will work with the socket API that will work with the particular Application. Most of the time it will open a higher value port (&gt;1000) that is called an Ephemeral Port aka short lived port because the port will be closed as long as the transport layer is done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that the Ephemeral port number varies from machine to machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Now the best Part is that ISP does not restrict you using any port number so you can use any short lived port with you connection.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="28269" LastEditorUserId="8499" LastEditDate="2016-07-30T18:01:48.663" LastActivityDate="2016-07-30T18:01:48.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33624" PostTypeId="2" ParentId="33615" CreationDate="2016-07-30T17:53:46.373" Score="11" Body="&lt;p&gt;In general, &lt;strong&gt;forwarding&lt;/strong&gt; refers to a device sending a datagram to the next device in the path to the destination, &lt;strong&gt;switching&lt;/strong&gt; refers to moving a datagram from one interface to another within a device, and &lt;strong&gt;routing&lt;/strong&gt; refers to the process a layer-3 device uses to decide on what to do with a layer-3 packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A host sending data to another host through an ethernet interface will place a frame on the wire. If the next device is a bridge (a switch is a bridge), the bridge will inspect the frame for the source and destination MAC addresses. The bridge will use the source MAC address in its MAC address table so that it knows the host with that MAC address is connected to the interface where the frame entered the bridge. It will also try to look up the destination MAC address in its MAC address table to see to which interface it should &lt;strong&gt;switch&lt;/strong&gt; the frame. If it finds the MAC address in its MAC address table, it will &lt;strong&gt;switch&lt;/strong&gt; the frame to the interface indicated in its MAC address table, otherwise it will &lt;strong&gt;flood&lt;/strong&gt; the frame to all other interfaces, &lt;strong&gt;forwarding&lt;/strong&gt; the frame to the device(s) on the other end(s) of the interface(s) link(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router receiving a frame on an interface will strip the frame from the packet. The router will then try to look up the destination IP address in its &lt;strong&gt;routing&lt;/strong&gt; table. If it doesn't find a match, even a default route, it will drop the packet. If it finds one or more matches, it will &lt;strong&gt;switch&lt;/strong&gt; the packet to the interface of the longest match in the &lt;strong&gt;routing&lt;/strong&gt; table. The router will then prepare a new frame for the packet on the new interface (the link on new interface may or may not use MAC addresses), and the router will &lt;strong&gt;forward&lt;/strong&gt; the new frame containing the original packet over the next hop interface toward its destination. The whole process a router uses is called &lt;strong&gt;routing&lt;/strong&gt;, but within the router, it &lt;strong&gt;switches&lt;/strong&gt; packets before &lt;strong&gt;forwarding&lt;/strong&gt; them to the next hop device.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-07-30T18:14:32.747" LastActivityDate="2016-07-30T18:14:32.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33625" PostTypeId="1" CreationDate="2016-07-30T19:25:25.337" Score="1" ViewCount="179" Body="&lt;p&gt;In SNMP, is the management information base (MIB):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A tree of information handled by an agent.&lt;/li&gt;&#xA;&lt;li&gt;A set of objects definitions stored in a file&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If the correct answer is the second one, how do you call the tree of information handled by an agent? &lt;/p&gt;&#xA;" OwnerUserId="14568" LastActivityDate="2017-02-26T01:35:49.520" Title="snmp - definition of a MIB" Tags="|snmp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33626" PostTypeId="1" CreationDate="2016-07-30T20:21:56.087" Score="1" ViewCount="443" Body="&lt;p&gt;Suppose ABR1 is an ABR which connects Area 1 to Area 0. Area 1 consists of routers connected via point to point links only (advertised by LSA 1). Is this correct that ABR1 will report all of these links as LSA3 with linkid as router address and data as subnet 255.255.255.255? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------Area1-----------|---Area0---|&#xA;| RT1&amp;lt;--p2p--&amp;gt;RT2&amp;lt;--p2p--&amp;gt;ABR1&amp;lt;---&amp;gt;    |&#xA;+--------------------------|-----------|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28060" LastEditorUserId="8499" LastEditDate="2016-07-30T21:14:47.097" LastActivityDate="2016-08-03T15:27:21.947" Title="OSPF Point to Point network ABR advertisements" Tags="|routing|ospf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33627" PostTypeId="2" ParentId="33626" CreationDate="2016-07-30T20:55:49.237" Score="1" Body="&lt;p&gt;All the routers in an area will generate Type-1 LSAs to describe their directly attached links in that area. It doesn't matter if they are point-to-point links are not. Every router in an area will know about every other router and its links in an area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An ABR will convert all the Type-1 LSAs in one area to a Type-3 LSA for the other area to which it is attached. The ABR Router ID will be the advertising router for the Type-3 LSAs which it generates. A Type-3 LSA can contain multiple networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 2328, OSPF Version 2&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When the LSA is describing a network (LS type = 2, 3 or 5), the&#xA;  network's IP address is easily derived by masking the Link State ID&#xA;  with the network/subnet mask contained in the body of the LSA.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you quoted in your comment is actually on page 30, not 31. If you read it carefully, that area is performing a route summary, not to be confused with a summary LSA. You are confusing two different things. A Type-3 LSA is a summary LSA which contains all the networks for the Type-1 and Type-2 LSAs from an area. A summary route is a single, supernet route containing all the routes behind it. A summary route can only be advertised from an ABR in OSPF, but other routing protocols can use summary routes, and only OSPF uses LSAs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, they Type-3 LSA would contain all the individual Type-1 LSAs for all the routes covered by the summary route if the Area was not summarizing the routes, but the Type-1 LSAs themselves would not be leaked into Area 0.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-03T15:27:21.947" LastActivityDate="2016-08-03T15:27:21.947" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="33630" PostTypeId="2" ParentId="33625" CreationDate="2016-07-30T23:04:09.643" Score="1" Body="&lt;p&gt;The simplest definition is that an SNMP MIB is a database containing the managed objects which a device will expose to SNMP via an SNMP agent. The MIB appears, at least externally, to be a tree structure.&lt;/p&gt;&#xA;&lt;p&gt;This is how &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1156&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1156, Management Information Base for Network Management of TCP/IP-based internets&lt;/a&gt; defines it:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Managed objects are accessed via a virtual information store, termed&#xA;the Management Information Base or MIB.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Some people refer to the properties (values) of the managed objects as definitions of those objects. That would seem to be the source of your confusion.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-07-30T23:04:09.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33632" PostTypeId="2" ParentId="33615" CreationDate="2016-07-31T00:05:23.307" Score="5" Body="&lt;ul&gt;&#xA;&lt;li&gt;Routing - &lt;a href=&quot;https://en.wikipedia.org/wiki/Network_packet&quot; rel=&quot;noreferrer&quot;&gt;Packets&lt;/a&gt; are forwarded by a layer 3 gateway, aka router.&lt;/li&gt;&#xA;&lt;li&gt;Switching - &lt;a href=&quot;https://en.wikipedia.org/wiki/Frame_(networking)&quot; rel=&quot;noreferrer&quot;&gt;Frames&lt;/a&gt; are forwarded by a layer 2 switch.&lt;/li&gt;&#xA;&lt;li&gt;Forwarding - &lt;a href=&quot;https://en.wikipedia.org/wiki/Protocol_data_unit&quot; rel=&quot;noreferrer&quot;&gt;Protocol Data Units&lt;/a&gt; are forwarded by a networked / networking device.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-07-31T00:05:23.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33633" PostTypeId="2" ParentId="26422" CreationDate="2016-07-31T04:46:44.250" Score="0" Body="&lt;h1&gt;&lt;a href=&quot;http://www.junosworkbook.com/workbooks/jncia/configuring-rapid-spanning-tree-protocol-rstp&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Rapid Spanning Tree Protocol (RSTP)&lt;/a&gt;&lt;/h1&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The root bridge is the ONLY switch in the layer 2 topology, rather it&#xA;be STP, RSTP or VSTP (VLAN STP) that will forward traffic out on all&#xA;ports. The root bridge however is elected by the lowest priority&#xA;and/or the lowest MAC address.&lt;/p&gt;&#xA;&lt;p&gt;The root bridge however is elected by the lowest priority and/or the&#xA;lowest MAC address.&lt;/p&gt;&#xA;&lt;p&gt;It is best practice to set your root switch as 4096 and the backup&#xA;root switch as 8192.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;show spanning-tree bridge&#xA;show spanning-tree interface brief &#xA;set protocols rstp bridge-priority #&#xA;set interfaces ge-0/0/23.0 family ethernet-switching port-mode trunk native-vlan-id 6 vlan members [allowed vlans]&#xA;show ethernet-switching interface ge-0/0/23 detail&#xA;show ethernet-switching interfaces detail | match Trunk&#xA;show ethernet-switching interfaces detail &amp;lt;interface-name&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-07-31T04:46:44.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33634" PostTypeId="2" ParentId="32639" CreationDate="2016-07-31T05:08:30.710" Score="0" Body="&lt;h2&gt;ASA Port Forwarding&lt;/h2&gt;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/0&#xA; nameif outside&#xA; security-level 0&#xA; ip address 198.51.100.100 255.255.255.0 // Your Global IP&#xA;!&#xA;interface Ethernet0/1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.0.1 255.255.255.0&#xA;!&#xA;&#xA;&#xA;object network inside-subnet&#xA; subnet 192.168.0.0 255.255.255.0&#xA; nat (inside,outside) dynamic interface&#xA;&#xA;object network webserver&#xA; host 192.168.0.100&#xA; nat (inside,outside) static webserver-external-ip service tcp www www&#xA;&#xA;access-list outside_acl_in extended permit tcp any object webserver eq www&#xA;!&#xA;access-group outside_acl_in in interface outside&#xA;&#xA;route outside 0.0.0.0 0.0.0.0 198.51.100.1 //your ISP Gateway&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-07-31T05:08:30.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33638" PostTypeId="1" CreationDate="2016-07-31T11:14:50.880" Score="1" ViewCount="1377" Body="&lt;p&gt;someone told me that there is a solution for setting Quota in New FortiOS (v5.4), but i can't find anything to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i just want to know, is there anyway to set Quota for my local internet users, or not? if there is, then how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you for your time...&lt;/p&gt;&#xA;" OwnerUserId="28279" LastEditorUserId="28279" LastEditDate="2016-08-02T06:40:40.947" LastActivityDate="2017-06-07T11:50:04.030" Title="Is there anyway to set Quota for users in Fortigate?" Tags="|firewall|security|fortigate|fortinet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33643" PostTypeId="2" ParentId="33606" CreationDate="2016-08-01T03:28:37.853" Score="0" Body="&lt;p&gt;Most home routers use a special-case of NAT called PAT. When the packet goes out from your internal machine, the source address is rewritten as you are aware. The source port is also changed, usually to a high number, and the router keeps an address translation table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more relative information:&lt;a href=&quot;https://superuser.com/questions/105838/how-does-router-know-where-to-forward-packet&quot;&gt;https://superuser.com/questions/105838/how-does-router-know-where-to-forward-packet&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26940" LastEditorUserId="-1" LastEditDate="2017-03-20T10:04:42.970" LastActivityDate="2016-08-01T03:28:37.853" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33645" PostTypeId="2" ParentId="32735" CreationDate="2016-08-01T06:52:24.917" Score="3" Body="&lt;p&gt;As waza-ari pointed out, AS Prepend will do the trick. As to whether it's what other ISPs do, I cannot answer that question unfortunately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I labbed up your AS prepend query using the topology below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ziZh6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ziZh6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;AS Prepend Example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1 is advertising 192.168.1.0/24 through BGP.&lt;/li&gt;&#xA;&lt;li&gt;It is prepending 123, 123, 123 to the route.&lt;/li&gt;&#xA;&lt;li&gt;The below output was taken from R2:&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;R2(config-router)#do sh ip bgp BGP table version is 4, local router ID&#xA;  is 10.0.0.2 Status codes: s suppressed, d damped, h history, * valid,&#xA;  best, i - internal,&#xA;                r RIB-failure, S Stale Origin codes: i - IGP, e - EGP, ? - incomplete&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Network          Next Hop            Metric LocPrf Weight Path&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*&gt;  192.168.1.0      10.0.0.1                 0             0 100 123 123 123 i&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So here we see the prepended AS of 123 is shown as the originator of the route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Three Router Example:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To confirm that the AS entries are read from right to left, take a look at this example.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The below output was taken from R3.&lt;/li&gt;&#xA;&lt;li&gt;Note that reading the AS path from right to left we see that AS100 is the originator of the route.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;R3#sh ip bgp&#xA;  BGP table version is 2, local router ID is 10.2.3.3&#xA;  Status codes: s suppressed, d damped, h history, * valid, &gt; best, i - internal,&#xA;               r RIB-failure, S Stale&#xA;  Origin codes: i - IGP, e - EGP, ? - incomplete&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Network          Next Hop            Metric LocPrf Weight Path&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;*&gt; 192.168.1.0/24       10.2.3.2                               0 200 100 i&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-08-01T06:52:24.917" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33648" PostTypeId="1" AcceptedAnswerId="33673" CreationDate="2016-08-01T10:50:15.667" Score="1" ViewCount="3739" Body="&lt;p&gt;I have two LANs&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;LAN 1 - 192.168.250.0/24&lt;/li&gt;&#xA;&lt;li&gt;LAN 2 - 192.168.21.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;There is a way to use static NAT to map an IP like 192.168.21.1 to a IP of LAN1 like 192.168.250.1?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The is critical to access some LAN1 IPs using IPs of LAN2.&#xA;I'm testing using fortigate 30d (LAN1 and LAN2 interfaces).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create IPv4 policy to permit subnet of LAN1 access LAN2 subnet (without NAT option enabled. I don't know how this option works. If its PAT or dynamic NAT or whatever.)&lt;/li&gt;&#xA;&lt;li&gt;Create Virtual IP on the interface LAN1 to use external IP of LAN2 mapped to a IP of LAN1 itself.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Using wireshark I don't see any traffic translated. Am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="6129" LastActivityDate="2016-08-02T07:50:01.680" Title="Internal mapped IP of other LAN segment (fortigate)" Tags="|fortigate|snat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33653" PostTypeId="1" AcceptedAnswerId="33655" CreationDate="2016-08-01T15:50:38.380" Score="2" ViewCount="5125" Body="&lt;p&gt;We have setup &lt;code&gt;OSPF&lt;/code&gt; on router and initial it pick ip address &lt;code&gt;70.xx.xx.33&lt;/code&gt; but later we remove those IPs and reconfigure for new subnet but still &lt;code&gt;OSPF&lt;/code&gt; showing older router ID sometime it's confusing seeing older IP address in Router ID, Is there a way i can tell OSPF re-initialize new ID without reload? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh ip ospf summary-address&#xA;&#xA;            OSPF Router with ID (70.xx.xx.33) (Process ID 1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;EDIT:&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Its Cisco C3850 L3 switch with latest IOS running. &lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2016-08-01T16:06:33.340" LastActivityDate="2016-08-01T16:06:33.340" Title="Change OSPF Router ID without reload" Tags="|cisco|routing|router|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33655" PostTypeId="2" ParentId="33653" CreationDate="2016-08-01T16:02:10.957" Score="3" Body="&lt;p&gt;You didn't say what model router you have, but assuming a Cisco router (from the configuration example you have) can use the &lt;code&gt;clear ip ospf process&lt;/code&gt; command to clear and reload OSPF on a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfospf.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;clear ip ospf&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;To clear redistribution based on the OSPF routing process ID, use the&#xA;  &lt;strong&gt;clear ip ospf&lt;/strong&gt; command in privileged EXEC mode.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;clear ip ospf [&lt;em&gt;pid&lt;/em&gt;] {process | redistribution | counters [neighbor [&lt;em&gt;neighbor-interface&lt;/em&gt;] [&lt;em&gt;neighbor-id&lt;/em&gt;]]}&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Syntax Description&#xA;  - &lt;a href=&quot;https://i.stack.imgur.com/szOSG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/szOSG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;&lt;strong&gt;Usage Guidelines&lt;/strong&gt;&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Use the &lt;em&gt;pid&lt;/em&gt; option to clear only one OSPF process. If the &lt;em&gt;pid&lt;/em&gt;&#xA;  option is not specified, all OSPF processes are cleared.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;&lt;strong&gt;Examples&lt;/strong&gt;&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The following example clears all OSPF processes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clear ip ospf process&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-01T16:02:10.957" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="33658" PostTypeId="1" AcceptedAnswerId="33678" CreationDate="2016-08-01T16:42:41.173" Score="0" ViewCount="1076" Body="&lt;p&gt;I have a Wireless Interface in bridge mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I setup a DHCP Server listening on bridge-local interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, I have an ethernet1 with &lt;code&gt;192.168.1.202.&lt;/code&gt;&#xA;&lt;code&gt;10.1.0.0/24&lt;/code&gt; on &lt;code&gt;bridge-local&lt;/code&gt; itnerface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DHCP Server pool is &lt;code&gt;10.1.0.2.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason the wireless clientes (but also the wired ones) get address from 192.168.1.1 and not from 10.1.0.1.&#xA;Therefore, they get wrong addresses (in 192 pool and not 10.1.0.x pool)&#xA;why?&#xA;More&#xA;details&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[admin@MikroTik] /ip dhcp-server&amp;gt; print&#xA; #   NAME                    INTERFACE                    RELAY           ADDRESS-POOL                    LEASE-TIME ADD-ARP&#xA; 0   default                 bridge-local                                 pool2                           10m       &#xA; 1 I server-local            inside                                       pool2                           10m   &#xA;&#xA;  [admin@MikroTik] /ip address&amp;gt; print&#xA;Flags: X - disabled, I - invalid, D - dynamic &#xA; #   ADDRESS            NETWORK         INTERFACE                                                                           &#xA; 0   ;;; default configuration&#xA;     192.168.88.1/24    192.168.88.0    bridge-local                                                                        &#xA; 1   10.1.0.1/24        10.1.0.0        bridge-local                                                                        &#xA; 2 X 10.1.0.22/24       10.1.0.0        Uffici                                                                              &#xA; 3   192.168.1.202/24   192.168.1.0     outisde (to )isp router  &#xA;&#xA;&#xA;&#xA; [admin@MikroTik] /interface&amp;gt; print&#xA;Flags: D - dynamic, X - disabled, R - running, S - slave &#xA; #     NAME                                TYPE       ACTUAL-MTU L2MTU  MAX-L2MTU MAC-ADDRESS      &#xA; 0     dmz                                 ether            1500  1598       4074 00:0C:42:8D:56:64&#xA; 1   S ether2                              ether            1500  1598       4074 00:0C:42:8D:56:61&#xA; 2   S ether4                              ether            1500  1598       4074 00:0C:42:8D:56:63&#xA; 3   S ether6-master-local                 ether            1500  1598       2028 00:0C:42:8D:56:65&#xA; 4   S ether7-slave-local                  ether            1500  1598       2028 00:0C:42:8D:56:66&#xA; 5   S ether8-slave-local                  ether            1500  1598       2028 00:0C:42:8D:56:67&#xA; 6   S ether9-slave-local                  ether            1500  1598       2028 00:0C:42:8D:56:68&#xA; 7   S ether10-slave-local                 ether            1500  1598       2028 00:0C:42:8D:56:69&#xA; 8  RS inside                              ether            1500  1598       4074 00:0C:42:8D:56:62&#xA; 9  R  outisde (to )isp router             ether            1500  1598       4074 00:0C:42:8D:56:60&#xA;10   S sfp1                                ether            1500  1598       4074 00:0C:42:8D:56:5F&#xA;11  RS Uffici                              wlan             1500  2290            00:0C:42:8D:56:6A&#xA;12  R  bridge-local                        bridge           1500  1598            00:0C:42:8D:56:61&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20947" LastEditorUserId="8499" LastEditDate="2018-02-14T16:19:04.313" LastActivityDate="2018-02-14T16:19:04.313" Title="DHCP Internal Lan Wrong Leases" Tags="|dhcp|" AnswerCount="2" CommentCount="2" ClosedDate="2017-08-09T23:41:38.593" ContentLicense="CC BY-SA 3.0" />
  <row Id="33661" PostTypeId="2" ParentId="33658" CreationDate="2016-08-01T19:43:36.760" Score="-1" Body="&lt;h2&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/DHCP_snooping&quot; rel=&quot;nofollow noreferrer&quot;&gt;DHCP Snooping&lt;/a&gt;&lt;/h2&gt;&#xA;&lt;p&gt;In computer networking, DHCP snooping is a series of techniques applied to improve the security of a DHCP infrastructure.&lt;/p&gt;&#xA;&lt;p&gt;When DHCP servers are allocating IP addresses to the clients on the LAN, DHCP snooping can be configured on LAN switches to allow only clients with specific IP and MAC addresses to have access to the network.&lt;/p&gt;&#xA;&lt;p&gt;DHCP snooping can ensure IP integrity on a Layer 2 switched domain. It works with information from a DHCP server to:&lt;/p&gt;&#xA;&lt;p&gt;Track the physical location of hosts.&#xA;Ensure that hosts only use the IP addresses assigned to them.&#xA;Ensure that only authorized DHCP servers are accessible.&#xA;With DHCP snooping, the information about IP addresses and corresponding MAC addresses is stored in a database on the network switch. Packets from clients that do not match the stored information will be dropped.&lt;/p&gt;&#xA;&lt;p&gt;The DHCP snooping database sometimes is used for other security features such as IP source guard and dynamic ARP inspection, which makes it a central component of LAN access security.&lt;/p&gt;&#xA;&lt;p&gt;DHCP snooping can also prevent attackers from adding their own DHCP servers to the network, causing malfunction of the network and adding further unauthorized components.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-01T19:43:36.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33666" PostTypeId="1" CreationDate="2016-08-02T00:00:56.110" Score="0" ViewCount="155" Body="&lt;p&gt;I have a 3750 manufactured in Feb of 2009, model number ws-3750-48ps-s V07. I'm consoled into it and when I power the switch, it boots (fans RPM) but no console display at all. The POE, stack, and speed lights are all froze green, and the duplex and stat lights are froze orange. I've been reading about these switched failing POST often, which I'm assuming is whats happening. Is there any internal fixes for this? I do not know any previous information as far as config goes or its previous life.&lt;/p&gt;&#xA;" OwnerUserId="28319" LastActivityDate="2017-03-31T10:28:44.990" Title="3750 failed post. Internal fixed?" Tags="|cisco-3750|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33667" PostTypeId="2" ParentId="8016" CreationDate="2016-08-02T00:55:55.530" Score="1" Body="&lt;p&gt;The router needs to generate a certificate that it can use to encrypt the communication. See the Cisco configuration guide chapter on &quot;Implementing Secure Socket Layer&quot; here: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r5-1/security/configuration/guide/b_syssec_cg51xasr9k/b_syssec_cg51xasr9k_chapter_01001.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r5-1/security/configuration/guide/b_syssec_cg51xasr9k/b_syssec_cg51xasr9k_chapter_01001.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28321" LastActivityDate="2016-08-02T00:55:55.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33668" PostTypeId="2" ParentId="8016" CreationDate="2016-08-02T01:52:22.757" Score="0" Body="&lt;h2&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios_xr_sw/iosxr_r4-1/xml/programming/guide/xl41apidoc/xl41noti.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IOS XR XML API Guide, Cisco IOS XR Release 4.1&lt;/a&gt;&lt;/h2&gt;&#xA;&lt;p&gt;The k9sec package is required to use the SSL agent. The configuration is rejected during a commit when the k9sec package is not active on the system. When the k9sec package is deactivated after configuring the SSL agent, the agent is not available.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-02T01:52:22.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33670" PostTypeId="1" AcceptedAnswerId="33674" CreationDate="2016-08-02T04:39:22.470" Score="1" ViewCount="81" Body="&lt;p&gt;How to get Cisco privilege level via SNMP?  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show privilege&#xA;Current privilege level is 15  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which MIB or OID?&lt;/p&gt;&#xA;" OwnerUserId="22692" LastEditorUserId="22692" LastEditDate="2020-02-29T14:27:30.583" LastActivityDate="2020-02-29T14:27:30.583" Title="Cisco Show Privilege via SNMP" Tags="|cisco|security|snmp|" AnswerCount="1" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="33671" PostTypeId="2" ParentId="30015" CreationDate="2016-08-02T05:42:34.850" Score="2" Body="&lt;p&gt;Your question is how to configure the Sourcefire IPS via the Sourfire Management Center to block certain sites.&lt;/p&gt;&#xA;&lt;h1&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/firesight-management-center/117956-technote-sourcefire-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;URL Filtering on a FireSIGHT System Configuration Example&lt;/a&gt;&lt;/h1&gt;&#xA;&lt;h3&gt;Exclusion of a Specific Site from Blocked URL Category&lt;/h3&gt;&#xA;&lt;p&gt;FireSIGHT Management Center does not allow you to have a local rating of URLs that override the default Sourcefire provided category ratings. In order to accomplish this task, you must use an Access Control policy. These instructions describe how to use a URL object in an Access Control rule in order to exclude a specific site from a block category.&#xA;Navigate to Objects &amp;gt; Object Management page.&lt;/p&gt;&#xA;&lt;p&gt;Select Individual Objects for URL, and click the Add URL button. The URL Objects window appears.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/UeCXP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UeCXP.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/AuFAC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AuFAC.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-02T05:42:34.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33672" PostTypeId="2" ParentId="33615" CreationDate="2016-08-02T06:34:47.820" Score="3" Body="&lt;p&gt;The term forwarding is used to describe moving any protocol across the network, and it decides which exit interface to use to send the packet to its next hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing is the process of forwarding packets at L3 of the OSI model.This is  based on knowing where the destination is and to which interface the layer 3 device should send it to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switching is the process of forwarding frames at Layer 2 of the OSI based on the Destination Address.&lt;/p&gt;&#xA;" OwnerUserId="26940" LastActivityDate="2016-08-02T06:34:47.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33673" PostTypeId="2" ParentId="33648" CreationDate="2016-08-02T07:50:01.680" Score="1" Body="&lt;p&gt;What you are planning to do is called &quot;Destination NAT&quot;, and in FortiOS this is done with 'Virtual IPs' (VIPs).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- create a VIP like this&lt;br&gt;&#xA;name: dnat_LAN2_to_LAN1&#xA;external interface: LAN2&lt;br&gt;&#xA;external IP: 192.168.21.10 (for example)&lt;br&gt;&#xA;mapped IP: 192.168.250.23 (for ex.)&lt;br&gt;&#xA;port forwarding: not enabled  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- create a policy with&lt;br&gt;&#xA;source interface: LAN2&lt;br&gt;&#xA;source address: LAN2_subnet&lt;br&gt;&#xA;destination interface: LAN1&lt;br&gt;&#xA;destination address: &lt;strong&gt;dnat_LAN2_to_LAN1&lt;/strong&gt;&lt;br&gt;&#xA;service, schedule: to your liking&lt;br&gt;&#xA;NAT: not enabled  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can now ping 192.168.250.23 on LAN1 using the IP 192.168.21.10 on LAN2.&lt;br&gt;&#xA;If you want to map several IPs:&lt;br&gt;&#xA;- you can create multiple VIPs and put them into a 'VIP group' and use this in a policy, or&lt;br&gt;&#xA;- you can define a range of 'external' addresses which are then mapped 1:1 to the 'mapped-to' range  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note&lt;/strong&gt; that you do not have to translate the LAN1 source addresses to a LAN2 address to completely 'masquerade' it - the VIP will do that automatically, even for traffic originating from LAN1.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-08-02T07:50:01.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33674" PostTypeId="2" ParentId="33670" CreationDate="2016-08-02T09:56:12.387" Score="2" Body="&lt;p&gt;SNMP is not a user, it does not have a privilege level in that way, so you're not able to retrieve this information.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-08-02T09:56:12.387" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33677" PostTypeId="1" AcceptedAnswerId="33682" CreationDate="2016-08-02T11:02:47.123" Score="2" ViewCount="1057" Body="&lt;p&gt;I'm working on configuring a MPLS VPN network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I'm working with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Zufim.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zufim.png&quot; alt=&quot;Network Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From CE1 I would like to be able to ping the loopback address of CE2 and vice versa, which is not yet possible and I do not know where abouts I am going wrong... The steps I have taken so far are as followed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Prerequisites:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;OSPF enabled on P and PE routers advertising inside networks plus loopbacks&lt;/li&gt;&#xA;&lt;li&gt;Enable MPLS on P and PE routers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Steps taken:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;On PE and CE routers I have enabled RIP V2&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On both PE routers I have enabled VRF for the client (Repeating on PE2)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    PE1(config)#ip  vrf  client1&#xA;    PE1(config-vrf)#rd 999:1 &#xA;    PE1(config-vrf)#route-target  export  64999 :1&#xA;    PE1(config-vrf)#route-target  import  64999 :1&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Assigned VRF on both PE routers to the interfaces facing the CE routers&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Set up of basic BGP on both PE routers&#xA;I will list my running configuration for both PE router:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PE1 configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 2176 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname PE1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip vrf client1&#xA; rd 999:1&#xA; route-target export 64999:1&#xA; route-target import 64999:1&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;&#xA;interface Loopback0&#xA; ip address 1.1.1.1 255.255.255.255&#xA;!&#xA;interface FastEthernet0/0&#xA; ip vrf forwarding client1&#xA; ip address 10.1.1.2 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.1.1 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA; mpls label protocol ldp&#xA; mpls ip&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;&#xA;router ospf 10&#xA; log-adjacency-changes&#xA; network 1.1.1.1 0.0.0.0 area 0&#xA; network 192.168.1.0 0.0.0.3 area 0&#xA;!&#xA;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; no auto-summary&#xA; !&#xA; address-family ipv4 vrf client1&#xA;  redistribute bgp 64999 metric 1&#xA;  network 10.0.0.0&#xA;  no auto-summary&#xA;  version 2&#xA; exit-address-family&#xA;!&#xA;router bgp 64999&#xA; no bgp default ipv4-unicast&#xA; bgp log-neighbor-changes&#xA; neighbor 4.4.4.4 remote-as 64999&#xA; neighbor 4.4.4.4 update-source Loopback0&#xA; !&#xA; address-family vpnv4&#xA;  neighbor 4.4.4.4 activate&#xA;  neighbor 4.4.4.4 send-community extended&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf client1&#xA;  redistribute rip metric 1&#xA;  no synchronization&#xA; exit-address-family&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PE2 Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building configuration...&#xA;&#xA;Current configuration : 2145 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname PE2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;&#xA;ip vrf client2&#xA; rd 999:1&#xA; route-target export 64999:1&#xA; route-target import 64999:1&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 4.4.4.4 255.255.255.255&#xA;!&#xA;interface FastEthernet0/0&#xA; ip vrf forwarding client2&#xA; ip address 10.1.1.6 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.1.9 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA; mpls label protocol ldp&#xA; mpls ip&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;&#xA;router ospf 10&#xA; log-adjacency-changes&#xA; network 4.4.4.4 0.0.0.0 area 0&#xA; network 192.168.1.8 0.0.0.3 area 0&#xA;!&#xA;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; no auto-summary&#xA; !&#xA; address-family ipv4 vrf client2&#xA;  redistribute bgp 64999 metric 1&#xA;  no auto-summary&#xA; exit-address-family&#xA;!&#xA;router bgp 64999&#xA; no bgp default ipv4-unicast&#xA; bgp log-neighbor-changes&#xA; neighbor 1.1.1.1 remote-as 64999&#xA; neighbor 1.1.1.1 update-source Loopback0&#xA; !&#xA; address-family vpnv4&#xA;  neighbor 1.1.1.1 activate&#xA;  neighbor 1.1.1.1 send-community extended&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf client2&#xA;  redistribute rip metric 1&#xA;  no synchronization&#xA; exit-address-family&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Configured RIP to use the VRF table for PE1 and PE2.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE1(config)#router  rip&#xA;PE1(config-router)#address-family  ipv4  vrf  client1&#xA;PE1(config-router-af)#version 2&#xA;PE1(config-router-af)#network 10.0.0.0&#xA;PE1(config-router-af)#no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;Redistribution of routes&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RIP routes to BGP&lt;/li&gt;&#xA;&lt;li&gt;BGP routes to RIP&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;After configuration of the above, I have ran the following commands...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CE1&lt;/strong&gt; - can only see connected routes on both CE1 and CE2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     10.0.0.0/30 is subnetted, 2 subnets&#xA;C       10.1.1.8 is directly connected, Loopback0&#xA;C       10.1.1.0 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PE1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE1#show ip route&#xA;Gateway of last resort is not set&#xA;&#xA;     1.0.0.0/32 is subnetted, 1 subnets&#xA;C       1.1.1.1 is directly connected, Loopback0&#xA;     2.0.0.0/32 is subnetted, 1 subnets&#xA;O       2.2.2.2 [110/11] via 192.168.1.2, 01:02:04, FastEthernet0/1&#xA;     3.0.0.0/32 is subnetted, 1 subnets&#xA;O       3.3.3.3 [110/21] via 192.168.1.2, 01:02:04, FastEthernet0/1&#xA;     4.0.0.0/32 is subnetted, 1 subnets&#xA;O       4.4.4.4 [110/31] via 192.168.1.2, 01:02:04, FastEthernet0/1&#xA;     192.168.1.0/30 is subnetted, 3 subnets&#xA;O       192.168.1.8 [110/30] via 192.168.1.2, 01:02:06, FastEthernet0/1&#xA;C       192.168.1.0 is directly connected, FastEthernet0/1&#xA;O       192.168.1.4 [110/20] via 192.168.1.2, 01:02:06, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE1#show ip route vrf client1&#xA;     10.0.0.0/30 is subnetted, 2 subnets&#xA;R       10.1.1.8 [120/1] via 10.1.1.1, 00:00:18, FastEthernet0/0&#xA;C       10.1.1.0 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PE2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE2#show ip route&#xA;&#xA;     1.0.0.0/32 is subnetted, 1 subnets&#xA;O       1.1.1.1 [110/31] via 192.168.1.10, 01:08:58, FastEthernet0/1&#xA;     2.0.0.0/32 is subnetted, 1 subnets&#xA;O       2.2.2.2 [110/21] via 192.168.1.10, 01:09:08, FastEthernet0/1&#xA;     3.0.0.0/32 is subnetted, 1 subnets&#xA;O       3.3.3.3 [110/11] via 192.168.1.10, 01:09:08, FastEthernet0/1&#xA;     4.0.0.0/32 is subnetted, 1 subnets&#xA;C       4.4.4.4 is directly connected, Loopback0&#xA;     192.168.1.0/30 is subnetted, 3 subnets&#xA;C       192.168.1.8 is directly connected, FastEthernet0/1&#xA;O       192.168.1.0 [110/30] via 192.168.1.10, 01:08:59, FastEthernet0/1&#xA;O       192.168.1.4 [110/20] via 192.168.1.10, 01:09:09, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PE2#show ip route vrf client2&#xA;     10.0.0.0/30 is subnetted, 3 subnets&#xA;B       10.1.1.8 [200/1] via 1.1.1.1, 00:55:41&#xA;B       10.1.1.0 [200/0] via 1.1.1.1, 00:55:41&#xA;C       10.1.1.4 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why am I only seeing RIP routes in PE1? and only BGP routes in PE2?&lt;/li&gt;&#xA;&lt;li&gt;Should I be seeing the routes for both BGP and RIP to the CE network from PE1 and 2?&lt;/li&gt;&#xA;&lt;li&gt;What am i missing/doing wrong that is not letting me ping from CE1 to CE2 and vice versa?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Addition running configurations&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CE2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CE2#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1396 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname CE2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 10.1.1.17 255.255.255.252&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.1.1.5 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial2/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial2/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="25289" LastEditorUserId="25289" LastEditDate="2016-08-02T11:41:22.257" LastActivityDate="2016-08-02T19:35:57.507" Title="MPLS VPN network using BGP, RIP and OSPF" Tags="|vpn|bgp|ospf|mpls|rip|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="33678" PostTypeId="2" ParentId="33658" CreationDate="2016-08-02T11:20:41.760" Score="2" Body="&lt;p&gt;The problem was as simple as stupid.&#xA;Another guy carelessly put a DHCP server in another room (without my consensus)!&lt;/p&gt;&#xA;" OwnerUserId="20947" LastEditorUserId="20947" LastEditDate="2016-08-20T13:11:43.333" LastActivityDate="2016-08-20T13:11:43.333" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33680" PostTypeId="1" AcceptedAnswerId="33681" CreationDate="2016-08-02T11:27:20.933" Score="1" ViewCount="7589" Body="&lt;p&gt;I was reading about how STP determines which port to block. I was looking at this url &lt;a href=&quot;https://ciscoiseasy.blogspot.co.uk/2010/10/lesson-20-spanning-tree-protocol.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ciscoiseasy.blogspot.co.uk/2010/10/lesson-20-spanning-tree-protocol.html&lt;/a&gt; explicitly this section&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The following algorithm is used to determine the root port or designated port (in order):&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Prefer the lowest Root Path Cost.&lt;/li&gt;&#xA;  &lt;li&gt;In case of the same Root Path Cost, prefer the lowest Bridge ID of the designated switch (the neighbor that sends BPDUs).&lt;/li&gt;&#xA;  &lt;li&gt;In case of receiving BPDUs on multiple ports from the same designated switch (BPDU sender), prefer the lowest Port ID (known also as port priority) of the sender. That parameter has a default value 128 and is configurable.&lt;/li&gt;&#xA;  &lt;li&gt;In case of all above are did not resolve the problem, prefer the lowest Port ID of the BPDU sender.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The first 3 parts I understand fine. It's the last one that I wanted some clarification on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The website goes on to show and example where the BPDU frame is being sent from a switch (SW3) on interfaces Fa0/3 and Fa0/4 to another switch (SW4).  SW4 chooses it's port Fa0/1 because that port is connected to Fa0/3 and 3 is lower than 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/F2WUk.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/F2WUk.jpg&quot; alt=&quot;Example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question is:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that really as simple as it sounds? A simple calculation on which port number is lower or is there more to it? What would happen if I had Po1 and Fa0/1 and all other factors were the same?&lt;/p&gt;&#xA;" OwnerUserId="139" LastActivityDate="2018-11-10T22:59:45.047" Title="How does STP calculate the lowest port ID" Tags="|spanning-tree|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33681" PostTypeId="2" ParentId="33680" CreationDate="2016-08-02T12:01:29.473" Score="6" Body="&lt;p&gt;If you do &lt;strong&gt;show spanning-tree&lt;/strong&gt;, the port ID is the Nbr element in the Prio.Nbr column.  For this example Gi0/0 is port 1, Gi0/1 is port 2, Po1 is port 65.  You will find that all the interfaces of a type are grouped and the port IDs are ordered within that group.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN0001&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    32769&#xA;             Address     0000.ab15.f500&#xA;             This bridge is the root&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)&#xA;             Address     0000.ab15.f500&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  15  sec&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;Gi0/0               Desg FWD 4         128.1    Shr &#xA;Gi0/1               Desg FWD 4         128.2    Shr &#xA;Gi0/2               Desg FWD 4         128.3    Shr &#xA;Gi0/3               Desg FWD 4         128.4    Shr &#xA;Gi1/0               Desg FWD 4         128.5    Shr &#xA;Gi1/1               Desg FWD 4         128.6    Shr &#xA;Gi1/2               Desg FWD 4         128.7    Shr &#xA;Po1                 Desg LIS 4         128.65   Shr &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-02T12:01:29.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33682" PostTypeId="2" ParentId="33677" CreationDate="2016-08-02T12:51:40.653" Score="1" Body="&lt;p&gt;PE2 is missing &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address-family  ipv4  vrf  client1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;under the RIP configuration&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-02T12:51:40.653" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33683" PostTypeId="2" ParentId="33677" CreationDate="2016-08-02T13:04:26.767" Score="1" Body="&lt;p&gt;PE2 is missing (under RIP address-family ipv4 vrf client2)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 2&#xA;network 10.0.0.0&#xA;no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-08-02T19:35:57.507" LastActivityDate="2016-08-02T19:35:57.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33693" PostTypeId="2" ParentId="23545" CreationDate="2016-08-02T17:29:43.480" Score="1" Body="&lt;p&gt;I recently worked on replacing a bunch of sophos firewalls with pfSense ones. My first impression is that pfSense isn't yet ready to the cloud. As a cloud user, you would expect that you could automate every aspect of your infrastructure and pfSense doesn't help with this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't use userdata to script the instance startup and it lacks ASG integration as well. Also, the configuration is expected to be generated by its GUI only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We managed to automate the instance creation and config.xml generation using ansible ( essentially using a template to generate the XML file ) so this is an advantage compared to Sophos.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe it would be possible (and probably easy) to extend pfSense and add support to autoscaling groups in there - as an external package or plugin or whatever they call it ( that's actually a good idea of a pet project )&lt;/p&gt;&#xA;" OwnerUserId="28344" LastActivityDate="2016-08-02T17:29:43.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33695" PostTypeId="2" ParentId="30740" CreationDate="2016-08-02T19:32:38.400" Score="0" Body="&lt;p&gt;It may not be UDLD but spanning tree.  Once in errdisable, clear that out bu shut down both interfaces, set&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode trunk&#xA;switchport trunk encapsulation dot1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then unshut both interface.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-08-02T19:43:08.370" LastActivityDate="2016-08-02T19:43:08.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33696" PostTypeId="2" ParentId="25636" CreationDate="2016-08-02T19:34:51.540" Score="0" Body="&lt;p&gt;You should configure a full mesh VPN so that spoke to spoke traffic does not have to hairpin the main site.  In other words, configure a VPN between the branch sites.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-02T19:34:51.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33697" PostTypeId="2" ParentId="30740" CreationDate="2016-08-02T19:37:55.847" Score="1" Body="&lt;h1&gt;Solution:&lt;/h1&gt;&#xA;&lt;p&gt;We had two switches.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;[SW1]------10G------[SW2]&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;We upgraded SW1 with latest version and after upgrade UDLD failed between two switch.&lt;/p&gt;&#xA;&lt;p&gt;We disabled UDLD on that port and everything was working file data was flowing on link both direction.&lt;/p&gt;&#xA;&lt;p&gt;Later on &lt;code&gt;SW2&lt;/code&gt; upgrade switch with latest and greatest software fixed all issue and we re-enable UDLD and all good.&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-02T19:37:55.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33699" PostTypeId="1" CreationDate="2016-08-02T20:04:24.417" Score="0" ViewCount="93" Body="&lt;p&gt;Which one do I trust ? :-) &#xA;RFC:&#xA;     Idle state:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;      Initially, the BGP peer FSM is in the Idle state.  Hereafter, the&#xA;      BGP peer FSM will be shortened to BGP FSM.&#xA;&#xA;      In this state, BGP FSM refuses all incoming BGP connections for&#xA;      this peer.  No resources are allocated to the peer.  In response&#xA;      to a ManualStart event (Event 1) or an AutomaticStart event (Event&#xA;      3), the local system:&#xA;&#xA;        - initializes all BGP resources for the peer connection,&#xA;&#xA;        - sets ConnectRetryCounter to zero,&#xA;&#xA;        - starts the ConnectRetryTimer with the initial value,&#xA;&#xA;        - initiates a TCP connection to the other BGP peer,&#xA;&#xA;        - listens for a connection that may be initiated by the remote&#xA;          BGP peer, and&#xA;&#xA;        - changes its state to Connect.&#xA;&#xA;      The ManualStop event (Event 2) and AutomaticStop (Event 8) event&#xA;      are ignored in the Idle state.&#xA;&#xA;&#xA;&#xA;&#xA;Rekhter, et al.             Standards Track                    [Page 53]&#xA;&#xA;RFC 4271                         BGP-4                      January 2006&#xA;&#xA;&#xA;      In response to a ManualStart_with_PassiveTcpEstablishment event&#xA;      (Event 4) or AutomaticStart_with_PassiveTcpEstablishment event&#xA;      (Event 5), the local system:&#xA;&#xA;        - initializes all BGP resources,&#xA;&#xA;        - sets the ConnectRetryCounter to zero,&#xA;&#xA;        - starts the ConnectRetryTimer with the initial value,&#xA;&#xA;        - listens for a connection that may be initiated by the remote&#xA;          peer, and&#xA;&#xA;        **- changes its state to Active.**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Wikipedia &lt;a href=&quot;https://en.wikipedia.org/wiki/Border_Gateway_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Border_Gateway_Protocol&lt;/a&gt; :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/N1aI2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/N1aI2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1647" LastEditorUserId="8499" LastEditDate="2018-12-26T04:14:24.257" LastActivityDate="2018-12-26T04:14:24.257" Title="BGP RFC https://www.ietf.org/rfc/rfc4271.txt says from Idle a node can go to Active. Wikipedia says it can't" Tags="|bgp|protocol-theory|rfc|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="33700" PostTypeId="2" ParentId="33699" CreationDate="2016-08-02T20:11:13.117" Score="2" Body="&lt;p&gt;The RFC is the standard, I would go with that&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-02T20:11:13.117" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33701" PostTypeId="1" CreationDate="2016-08-02T21:28:54.297" Score="1" ViewCount="967" Body="&lt;p&gt;I am looking for some advice to get 2 phones registered in Call manager.  I have 2, only 2 connected that I'm trying to get up and working in my Lab.  CM shows them as never being seen, but I can edit the lines on the phone..  Add, delete, change DN's and so on..&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Under Device -&gt; Phone I have 2 listed both say “none” under status and if I open each one Register says “unknown”&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I can add, update, and delete Directory numbers both of them. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the phones boot up they run thru:&#xA;Configuring VLAN -&gt; Configuring IP -&gt; TFTP  Loading -&gt; Configuring VLAN -&gt; Configuring IP -&gt; Requisition configuration then to a screen that says Cisco Systems and “Your Current Options” is continuously flashing across the bottom of the display&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I can pick up the hand set and get a dial-tone, but when the “your current options” flashes the dial tone stops, it’s like the phone is reset.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;——&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CUCM:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Vers.:   10.5.0.99834-1&lt;/li&gt;&#xA;&lt;li&gt;IP:      192.168.10.5&lt;/li&gt;&#xA;&lt;li&gt;Running in VM Fusion off MacBook Pro&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Phones: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;7960, 7940&lt;/li&gt;&#xA;&lt;li&gt;SIP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Trunk:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SIP&lt;/li&gt;&#xA;&lt;li&gt;Status:  Full Service&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;——&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 2801:    c2801-adventerprisek9-mz.151-4.M10.bin&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 3750:    c3750-ipservicesk9-mz.122-25.SEC2.bin&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Voice portion of the VG Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address 192.168.10.1 192.168.10.30&#xA;ip dhcp excluded-address 192.168.20.1 192.168.20.30&#xA;!&#xA;ip dhcp pool data&#xA; network 192.168.10.0 255.255.255.0&#xA; default-router 192.168.10.1&#xA;!&#xA;ip dhcp pool voice&#xA; network 192.168.20.0 255.255.255.0&#xA; default-router 192.168.20.1&#xA; option 150 ip 192.168.10.5&#xA;!&#xA;!&#xA; - Omitted config &#xA;!&#xA;!&#xA;voice service voip&#xA; ip address trusted list&#xA;  ipv4 192.168.10.0 255.255.255.0&#xA; allow-connections h323 to h323&#xA; allow-connections h323 to sip&#xA; allow-connections sip to h323&#xA; allow-connections sip to sip&#xA; signaling forward unconditional&#xA; h323&#xA; sip&#xA;  min-se 5000 session-expires 5000&#xA;  header-passing&#xA;  registrar server expires max 600 min 60&#xA;!&#xA;voice class codec 1&#xA; codec preference 1 g711ulaw&#xA; codec preference 2 g729r8&#xA; codec preference 3 g729br8&#xA;!&#xA;!&#xA; - Omitted config &#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1.1&#xA; encapsulation dot1Q 1 native&#xA; ip address 192.168.1.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/1.10&#xA; description DATA Sub Int to CM&#xA; encapsulation dot1Q 10&#xA; ip address 192.168.10.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/1.20&#xA; description Voice Sub Int&#xA; encapsulation dot1Q 20&#xA; ip address 192.168.20.1 255.255.255.0&#xA;!&#xA; - Omitted config &#xA;!&#xA;sccp local FastEthernet0/1.10&#xA;sccp ccm 192.168.10.5 identifier 1 version 7.0&#xA;sccp ip precedence 3&#xA;!&#xA;sccp ccm group 1&#xA; associate ccm 1 priority 1&#xA; associate profile 40 register la-lnbch-mtp12&#xA; associate profile 30 register la-lnbch-mtp11&#xA; associate profile 10 register la-lnbch-conf1&#xA; associate profile 20 register la-lnbch-tc1&#xA; keepalive retries 5&#xA; switchover method immediate&#xA; switchback method immediate&#xA; switchback interval 15&#xA;!&#xA;!&#xA; - Omitted config &#xA;!&#xA;!&#xA;sip-ua&#xA; no remote-party-id&#xA; retry invite 10&#xA; registrar ipv4:192.168.10.5:5060 expires 3600&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23631" LastEditorUserId="8499" LastEditDate="2016-08-03T00:18:07.727" LastActivityDate="2018-02-24T19:30:33.607" Title="Unable to register 2 phones in Call Manager - Lab" Tags="|cisco|voice|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33702" PostTypeId="2" ParentId="33666" CreationDate="2016-08-02T21:46:16.623" Score="0" Body="&lt;p&gt;This model of ws-3750-48ps-s isn't covered by Cisco anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3750-series-switches/end_of_life_notice_c51-574778.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3750-series-switches/end_of_life_notice_c51-574778.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could replace it with the still supported 3750x switches as this series is compatible with the old 3750-48 switch stack.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-08-02T21:46:16.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33705" PostTypeId="2" ParentId="25659" CreationDate="2016-08-03T02:38:52.490" Score="0" Body="&lt;p&gt;No.  Router ACL's can turn off / disable unnecessary types of traffic to the point of protocol and port number.  The application / server is the more important element to focus on.  Also remember that security also includes availability of a resource (see &lt;a href=&quot;https://en.wikipedia.org/wiki/Denial-of-service_attack&quot; rel=&quot;nofollow&quot;&gt;DDOS attacks&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a secret to keep do not store it in any format, including ink on paper.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;greater than 80% of all new malware and intrusion attempts are&#xA;  exploiting weaknesses in applications, as opposed to weaknesses in&#xA;  networking components and services.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://en.wikipedia.org/wiki/Next-Generation_Firewall&quot; rel=&quot;nofollow&quot;&gt;Next Generation Firewall&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-03T02:38:52.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33707" PostTypeId="2" ParentId="33701" CreationDate="2016-08-03T02:49:02.940" Score="0" Body="&lt;p&gt;Sounds like a firmware issue.  See &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/cucm/rel_notes/10_5_1/CUCM_BK_CE15D2A0_00_cucm-release-notes-1051/CUCM_BK_CE15D2A0_00_cucm-release-notes-1051_chapter_01.html?bookSearch=true&quot; rel=&quot;nofollow&quot;&gt;Release Notes for Cisco Unified Communications Manager and IM and Presence Service, Release 10.5(1)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cisco IP Phone Firmware Versions The following table lists the latest&#xA;  Cisco IP Phone firmware version supported for Cisco Unified&#xA;  Communications Manager 10.5.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Table 28 Phone Firmware Versions Phone family Firmware release number&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Cisco Unified SIP Phone 3905&lt;/li&gt;&#xA;  &lt;li&gt;9.4(1) Cisco Unified IP Phones 6901 and 6911&lt;/li&gt;&#xA;  &lt;li&gt;9.3(1)SR1 Cisco Unified IP Phones 6921, 6941, 6945, and 6961&lt;/li&gt;&#xA;  &lt;li&gt;9.4(1)SR1 Cisco IP Phone 7800 Series&lt;/li&gt;&#xA;  &lt;li&gt;10.1(1)SR1 Cisco Unified IP Phone 7900 Series&lt;/li&gt;&#xA;  &lt;li&gt;9.3(1)SR4 Cisco Unified Wireless IP Phone 792x Series&lt;/li&gt;&#xA;  &lt;li&gt;1.4(5) Cisco Unified IP Conference Phone 8831&lt;/li&gt;&#xA;  &lt;li&gt;9.3(3) Cisco Unified IP Phones 8941 and 8945&lt;/li&gt;&#xA;  &lt;li&gt;9.4(1)SR1 Cisco Unified IP Phones 8961, 9951, and 9971&lt;/li&gt;&#xA;  &lt;li&gt;9.4(1)SR1&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-03T02:49:02.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33708" PostTypeId="2" ParentId="28438" CreationDate="2016-08-03T02:56:10.427" Score="0" Body="&lt;p&gt;Do not redirect from the ASA.  The simple solution is to have a layer 3 switch whose IP address is the default gateway and can route traffic appropriately.  An ASA is not a router.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-03T02:56:10.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33709" PostTypeId="2" ParentId="33666" CreationDate="2016-08-03T03:25:57.753" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Are you sure you are consoled in properly?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Cisco will replace the switch provided you are the original purchaser under the Limited lifetime warranty.  However, the terms of the LLW state for only 5 years from the end of manufacture date which unfortunately has passed.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/general/warranty/English/LH2DEN__.html&quot; rel=&quot;nofollow&quot;&gt;Duration of Hardware Warranty&lt;/a&gt;: As long as the original End User continues to own or use the Product. In the event of discontinuance of product manufacture, Cisco warranty support is limited to five (5) years from the announcement of discontinuance.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-03T03:25:57.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33710" PostTypeId="2" ParentId="19868" CreationDate="2016-08-03T03:35:40.100" Score="1" Body="&lt;p&gt;You can do this with &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-embedded-event-manager-eem/config_guide_eem_configuration_for_cisco_integrated_services_router_platforms.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco EEM&lt;/a&gt;.  If you had IOS-XE, there is an XML API - but you don't.  EEM should work though.  See &lt;a href=&quot;https://supportforums.cisco.com/discussion/10506581/eem-script-scheduling-can-i-run-script-certain-time&quot; rel=&quot;nofollow noreferrer&quot;&gt;cron timer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cisco IOS Embedded Event Manager (EEM) is a powerful tool integrated&#xA;  with Cisco IOS Software for system management from within the device&#xA;  itself. EEM offers the ability to monitor events and take&#xA;  informational, corrective, or any desired action when the monitored&#xA;  events occur or when a threshold is reached. Capturing the state of&#xA;  the router during such situations can be invaluable in taking&#xA;  immediate recovery actions and gathering information to perform&#xA;  root-cause analysis. Network availability is also improved if&#xA;  automatic recovery actions are performed without the need to fully&#xA;  reboot the routing device. EEM consists of three main components: EEM&#xA;  server, event publisher, and event Subscriber (policies).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fZeLS.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fZeLS.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-03T03:35:40.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33713" PostTypeId="2" ParentId="2583" CreationDate="2016-08-03T05:37:57.797" Score="-1" Body="&lt;h2&gt;&lt;a href=&quot;http://www.techonia.com/5761/mikrotik-eoip-tunnel-in-action&quot; rel=&quot;nofollow noreferrer&quot;&gt;Using EoIP Tunnel to connect private LANs across internet&lt;/a&gt;&lt;/h2&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;EoIP or Ether over IP tunnel is a tunnel protocol &lt;strong&gt;designed by&#xA;Mikrotik&lt;/strong&gt; development team which allows network administrators to&#xA;easily connect private LANs located in different locations separated&#xA;by cities or countries. As long as the Mikrotik routers can ping each&#xA;other, we can create the EoIP tunnel among them.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EbjgU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EbjgU.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-03T05:37:57.797" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33714" PostTypeId="2" ParentId="2583" CreationDate="2016-08-03T06:53:17.683" Score="0" Body="&lt;p&gt;In the scenario above, where plain trunks are in their entirety passed through a RouterOS device without adding or removing tags or doing any selective bridging, you can get away with not configuring individual vlans at all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By just bridging the ethernet ports, RouterOS will forward any tagged frames with the tags intact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This type of configuration is illustrated in the following example in the docs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/File:Vlan-2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://wiki.mikrotik.com/wiki/File:Vlan-2.png&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AS soon as you need to do anything much with the VLANs, it's time to refer to the answer by @Aziraphale and create all of the individual vlan bridges and associated configurationse.&lt;/p&gt;&#xA;" OwnerUserId="1947" LastEditorUserId="1947" LastEditDate="2018-01-11T13:56:03.547" LastActivityDate="2018-01-11T13:56:03.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33715" PostTypeId="1" AcceptedAnswerId="33717" CreationDate="2016-08-03T07:50:59.673" Score="4" ViewCount="240" Body="&lt;p&gt;For a long time we had /24 from our ISP with a static route. Now we would like to have our own routers and do BGP on our own. Our ISP says your block is on our 16 so it may create routing loop. How do generally people solve this. Does it mean customers having /24 from the bigger segment cannot do routing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another question, we have 2 /24 blocks not contiguous. Now, we advertise both on the WAN interface in BGP and having one IP from one /24 on the LAN interface. Now what is the best possible to recommended way to take the traffic in to LAN from the other IP subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="22114" LastEditorUserId="509" LastEditDate="2016-08-03T12:03:02.017" LastActivityDate="2016-08-03T12:03:02.017" Title="/16 and /24 routing from ISP" Tags="|routing|ipv4|ip|isp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33716" PostTypeId="1" CreationDate="2016-08-03T07:54:54.570" Score="1" ViewCount="1147" Body="&lt;p&gt;I forgot my username and password for a Cisco 2500 series switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I recover them?&lt;/p&gt;&#xA;" OwnerUserId="28354" LastEditorUserId="8499" LastEditDate="2016-08-03T15:09:00.667" LastActivityDate="2016-08-03T17:15:42.467" Title="How do I recover the username and password for a Cisco 2500?" Tags="|cisco|switch|router|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33717" PostTypeId="2" ParentId="33715" CreationDate="2016-08-03T08:56:15.630" Score="4" Body="&lt;p&gt;Routing a more specific prefix (the /24 in this case) taken from a larger block normally wouldn't be a problem, since a more specific route will win over a less specific one. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there may be another challenge here, if the /16 is assigned to your current ISP and you're planning to announce the /24 from that /16 via other networks. In that case, those networks must accept that you're announcing a prefix not assigned to you. I can imagine that your ISP will not allow you to do so if you would want to stop using their services (since they own the aggregated prefix from which you're using a /24), but if you remain a customer but decide to connect your network via them and possible another network, there's no technical drawback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possibly you'll need to create valid route objects in a routing database like &lt;a href=&quot;http://whois.ripe.net&quot; rel=&quot;nofollow&quot;&gt;RIPE&lt;/a&gt; or &lt;a href=&quot;http://radb.net&quot; rel=&quot;nofollow&quot;&gt;RADB&lt;/a&gt; (a bit depending on where you're located) so networks will accept your prefix. Your current ISP will most likely need to coorperate to create these objects. As long as you keep the ISP owning the /16 as an upstream network, even networks not accepting your /24 would still be able to reach you via your ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to sum it up I don't think there are any unsolvable technical issues here (unless there are more details I'm not aware of), there may be policise or commercial reasons why your ISP says this is not possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your second question is hard to answer without more details on the current network topology. You may consider asking this in a seperate question and providing some additional details there. &lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-08-03T08:56:15.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33718" PostTypeId="1" CreationDate="2016-08-03T09:55:09.420" Score="2" ViewCount="1300" Body="&lt;p&gt;I've setup a network consisting a &quot;AUTOMAÇÃO-&gt;Automation&quot; lan, &quot;Rede interna-&gt;Internal network&quot; and the WAN (f0/1). Every device is cisco except 200A (fortigate).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everyone on internal network must access internet using PAT but automation should not. On the 200A router side, there is a GRE tunnel to 1905-sec router and clients from which network can access each other.&#xA;So, I need to map an internal IP from &quot;Internal networw&quot; on 1905-sec router to translate that into a internal IP on automation network.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Internal network 1905-sec: 192.168.21.0/24&lt;/li&gt;&#xA;&lt;li&gt;Automation network 1905-sec: 192.168.250.0/24&lt;/li&gt;&#xA;&lt;li&gt;Internal network 200A: 192.168.14.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;f0/1 is outside nat, f0/0 is inside nat. Since I have to map a IP of internal network 192.168.21.1 to be translated into 192.168.250.1 and routed to f1/0 I can't make f0/0 be outside and inside at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I use PAT for normal operating mode and static nat to translate 192.168.21.1 as a global address and 192.168.250.1 as a inside address witout messing with PAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: I did it! I used NVI.&lt;/strong&gt;&#xA;checkout the solution: &lt;a href=&quot;http://www.ciscozine.com/nat-virtual-interface-aka-nvi-what-is-that/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ciscozine.com/nat-virtual-interface-aka-nvi-what-is-that/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fyYix.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fyYix.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6129" LastEditorUserId="6129" LastEditDate="2016-08-04T16:10:54.710" LastActivityDate="2019-05-04T09:03:00.833" Title="use PAT and static nat at the same time as inside and global nat interface" Tags="|cisco|nat|snat|dnat|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33719" PostTypeId="1" AcceptedAnswerId="33792" CreationDate="2016-08-03T11:25:35.970" Score="4" ViewCount="56007" Body="&lt;p&gt;I want to buy a new switch to replace an old one which is unmanaged and I see that there are smart and managed switches.. what it the difference? &lt;/p&gt;&#xA;" OwnerUserId="21495" LastActivityDate="2018-01-26T17:06:17.813" Title="What is the difference between smart vs managed switch?" Tags="|switch|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33720" PostTypeId="2" ParentId="33719" CreationDate="2016-08-03T11:27:25.360" Score="4" Body="&lt;p&gt;&lt;strong&gt;What are the differences in features and application scenarios among various serial switches?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is L2/L3 managed Switch, Smart Switch, Easy Smart Switch and Unmanaged Switch in TP-LINK official website, this article will give a brief account about the features and application scenarios of the respective switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Unmanaged Switch&lt;/strong&gt;&lt;br/&gt;&#xA;You are not able to configure the unmanaged switch because it doesn’t support any configuration interface or options. It is plug-and-play, so you only need to connect your computer or other network devices to the unmanaged switch directly. Therefore, if you do not need any L2 features, but only need to extend the number of Ethernet ports, unmanaged switch is the right switch for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Easy Smart Switch&lt;/strong&gt;&lt;br/&gt;&#xA;You can use Utility or Web interface (Web only for TL-SG1016DE and TL-SG1024DE) to manage easy smart switch and configure basic settings, such as VLAN, QoS and a few L2 features like LAG, IGMP Snooping and Port Mirroring. If there are no advanced applications needed, easy smart switch should be the best choice for you. Normally, easy smart switch will be found in the home, SOHO or small business.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Smart Switch&lt;/strong&gt;&lt;br/&gt;&#xA;Smart switch can be managed by Web interface, Telnet, SSH and SNMP. It supports far more L2 features and better QoS than easy smart switch, additionally, smart switch supports more advanced functions like ACL and Spanning Tree protocol, if you want to support a solution for one small company or colleague with a lower price, the Smart switch is the indispensable device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;L2 Managed Switch&lt;/strong&gt;&lt;br/&gt;&#xA;L2 managed switch has a console port for CLI (Command Line Interface), it has all the managing ways and advanced features that smart switch has, besides, L2 managed switch has abundant VLAN and Multicast features as well as cluster for logical stacking and Network Security features including 802.1X and IP-MAC binding. So you can use L2 managed switch to build a resiliency and availability network or even build up a small ISP Access Network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;L3 Managed Switch&lt;/strong&gt;&lt;br/&gt;&#xA;L2 switch could only work in Layer 2--Data Link Layer of OSI model. But Layer 3 switch has some L3 functions just like a traditional router--static routing, routing protocol like OSPF and ECMP, multicast routing protocol and DHCP relay.&#xA;Compared with a traditional router, L3 switch has lower cost but better performance in packet routing speed because the layer 3 switch routes packets by its hardware--ASIC instead of CPU, once it learned the IP address, it will forward packets by switching performance. It is mainly used in the core layer of a middle sized business network, providing better hardware switching performance in routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;source: &lt;a href=&quot;http://www.tp-link.com/en/faq-839.html&quot; rel=&quot;nofollow&quot;&gt;TP-LINK&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21495" LastActivityDate="2016-08-03T11:27:25.360" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33721" PostTypeId="2" ParentId="22376" CreationDate="2016-08-03T12:52:16.937" Score="0" Body="&lt;p&gt;First an important concept in networking is the product of bandwidth and latency. This determines how many packets need to be &quot;in flight&quot; at once for full utilisation. In general this figure has grown over the years as bandwidth has increased massively while latency has remained roughly the same (pesky speed of light limits)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traditionally TCP only acked continguous received data. I do not know for sure why it was done this was but I would guess simplicity was the driving force.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This left a sender with two options. It could resend a single packet and wait for a response from the receiver or it could resend a bunch of packets and possiblly end up sending duplicates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I expect that in the early internet this was not much of a problem. The bandwidth-delay products were relatively small and waiting a round trip time for each lost packet was probablly not too big a deal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As bandwidth increased this became more of an issue and after experiments in the late 80s and early 90s TCP shared acknowlagements were standardised in RFC2018 in 1996 .&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-08-03T13:11:28.267" LastActivityDate="2016-08-03T13:11:28.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33722" PostTypeId="2" ParentId="18684" CreationDate="2016-08-03T13:21:08.603" Score="5" Body="&lt;p&gt;Have a look @ &lt;a href=&quot;http://blog.ipspace.net/2011/09/ipv6-mplsvpn-6vpe-with-pppoe-and-radius.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://blog.ipspace.net/2011/09/ipv6-mplsvpn-6vpe-with-pppoe-and-radius.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this what you are trying to achieve? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They confirm that: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco-AVPair += &quot;ip:vrf-id=vrf-name&quot;,&#xA;Cisco-AVPair += &quot;ip:ip-unnumbered=Loopback301&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;would only work with IPv4. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to make IPv6 work, you would need the following: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco-avpair += &quot;lcp:interface-config#1=ipv6 unnumbered Loopback 1001&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8109" LastEditorUserId="453" LastEditDate="2017-05-31T04:15:23.217" LastActivityDate="2017-05-31T04:15:23.217" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33723" PostTypeId="2" ParentId="33716" CreationDate="2016-08-03T13:41:16.950" Score="2" Body="&lt;p&gt;Cisco maintains a page with links to the password recovery procedures for a lot of devices:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-121-mainline/6130-index.html&quot; rel=&quot;nofollow&quot;&gt;Password Recovery Procedures&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-03T13:41:16.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33724" PostTypeId="2" ParentId="33595" CreationDate="2016-08-03T13:45:38.287" Score="1" Body="&lt;p&gt;The difference between an independent bridge and a &quot;client AP&quot; is (poorly) explained in mode 5 description: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;These units are wireless driverless clients.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It means that a terminal using an independent bridge does need to have a specific driver to be able to communicate with it (printers, Set-Top-Boxes and such). On the contrary, if you use an AP as a client, you might need to install the AP-specific driver on the computer using it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, most of the time an independent bridge is more useful than an AP made client to connect wire-only devices to a wireless network.&lt;/p&gt;&#xA;" OwnerUserId="28361" LastActivityDate="2016-08-03T13:45:38.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33726" PostTypeId="1" CreationDate="2016-08-03T15:00:49.260" Score="1" ViewCount="10543" Body="&lt;p&gt;We have one cisco &lt;code&gt;Nexus 5548UP&lt;/code&gt; L2 switch running very old software &lt;code&gt;5.0.3&lt;/code&gt; version but recently i got &lt;code&gt;7.0.1&lt;/code&gt; software from someone else (we don't have SmartNet on this switch).&lt;/p&gt;&#xA;&lt;p&gt;is it safe to upgrade from 5.0.3 to 7.0.1? I was trying to find prerequisite but i didn't find any so wonder if some already did in past please share your experience.&lt;/p&gt;&#xA;&lt;h1&gt;UPDATE&lt;/h1&gt;&#xA;&lt;p&gt;after upgrade from 5.0.3 to 5.2.1 (for safety) look like my fan speed bump up from 50% to 60%. here is the &lt;code&gt;show env&lt;/code&gt; output&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;`switch# show environment&#xA;&#xA;&#xA;Fan:&#xA;------------------------------------------------------&#xA;Fan             Model                Hw         Status&#xA;------------------------------------------------------&#xA;Chassis-1       N5548P-FAN           --         ok&#xA;Chassis-2       N5548P-FAN           --         ok&#xA;PS-1            N55-PAC-750W         --         failure&#xA;PS-2            N55-PAC-750W         --         ok&#xA;&#xA;&#xA;Temperature&#xA;-----------------------------------------------------------------&#xA;Module   Sensor     MajorThresh   MinorThres   CurTemp     Status&#xA;                    (Celsius)     (Celsius)    (Celsius)&#xA;-----------------------------------------------------------------&#xA;1        Outlet     60            50           39          ok&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;`&lt;/p&gt;&#xA;&lt;p&gt;fan details&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;switch# sh environment fan detail&#xA;&#xA;&#xA;Fan:&#xA;---------------------------------------------------&#xA;Module  Fan  Airflow        Speed(%)  Speed(RPM)&#xA;             Direction&#xA;---------------------------------------------------&#xA;1       1    Front-to-Back  60        15211&#xA;1       2    Front-to-Back  60        11816&#xA;1       3    Front-to-Back  60        15211&#xA;1       4    Front-to-Back  60        11663&#xA;2       1    Front-to-Back  60        15517&#xA;2       2    Front-to-Back  60        11842&#xA;2       3    Front-to-Back  60        15929&#xA;2       4    Front-to-Back  60        11842&#xA;&#xA;&#xA;Power Supply:&#xA;-----------------------------------&#xA;Module  Airflow        Configured&#xA;        Direction      Speed (%)&#xA;-----------------------------------&#xA;1       Unknown        60&#xA;2       Front-to-Back  60&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-03T20:32:05.577" Title="Cisco Nexus 5548UP upgrade from 5.0.3 to 7.0.1" Tags="|cisco|switch|ethernet|cisco-ios|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33727" PostTypeId="1" AcceptedAnswerId="33728" CreationDate="2016-08-03T15:33:03.087" Score="1" ViewCount="2336" Body="&lt;p&gt;I have a Cisco 1921 Router with an private LAN interface, and a public WAN interface. I also have two VPN tunnels configured, one to another colo location and one to AWS. From the LAN side of this router, I can access our other colo, but can't access anything on the internet through the WAN interface. From the CLI of the router, I can ping public internet addresses, but not from the LAN side. I'm fairly new to Cisco's, can someone help me out with what I'm missing/doing wrong? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is our current config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    cisco-1-c#sho run&#xA;Building configuration...&#xA;&#xA;Current configuration : 5261 bytes&#xA;!&#xA;! Last configuration change at 12:35:42 est Wed Aug 3 2016 by chris&#xA;! NVRAM config last updated at 10:13:38 est Tue Aug 2 2016 by chris&#xA;! NVRAM config last updated at 10:13:38 est Tue Aug 2 2016 by chris&#xA;version 15.2&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname cisco-1-c&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;enable secret 5 $1$M5cQ$CnHaSbm3Y609.UyyO4uQk.&#xA;enable password pqBwmuzM5HwKWUc3&#xA;!&#xA;no aaa new-model&#xA;clock timezone est -4 0&#xA;!&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;no ip dhcp conflict logging&#xA;ip dhcp excluded-address 10.1.9.1 10.1.9.200&#xA;ip dhcp ping packets 10&#xA;ip dhcp ping timeout 100&#xA;!&#xA;ip dhcp pool 365&#xA; network 10.1.9.0 255.255.255.0&#xA; domain-name sidecartechnologies.com&#xA; default-router 10.1.9.1&#xA; dns-server 10.1.11.27 10.1.9.0&#xA; lease infinite&#xA;!&#xA;!&#xA;!&#xA;ip domain name sidecartechnologies.com&#xA;ip name-server 66.28.0.45&#xA;ip name-server 66.28.0.61&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO1921/K9 sn FGL171525QB&#xA;!&#xA;!&#xA;username chris privilege 15 secret 4 jP26tUYnl6KctHh55eUO9/UgebW38DaXI1nRsos92PQ&#xA;username sidecaradmin privilege 15 secret 4 3wDP4cwei1UMG.WnceYEkjK2v8adDxeofNSHSHI3y1M&#xA;username adam privilege 15 password 0 1mxsuck5&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;crypto keyring keyring-vpn-04d0c665-1&#xA;  local-address 38.122.23.162&#xA;  pre-shared-key address 54.210.103.217 key sT_bDVJbXn2vY8onWRFVnR2z5yiAkUu8&#xA;crypto keyring keyring-vpn-04d0c665-0&#xA;  local-address 38.122.23.12&#xA;  pre-shared-key address 52.203.180.41 key dulIUfC0AEgGInhqmB9MtnKZnY5zA8mM&#xA;!&#xA;crypto isakmp policy 10&#xA; hash md5&#xA; authentication pre-share&#xA;!&#xA;crypto isakmp policy 200&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA; lifetime 28800&#xA;!&#xA;crypto isakmp policy 201&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA; lifetime 28800&#xA;crypto isakmp key iGX9sFJHfxQo address 70.34.227.146&#xA;crypto isakmp keepalive 10 10&#xA;crypto isakmp profile isakmp-vpn-04d0c665-0&#xA;   keyring keyring-vpn-04d0c665-0&#xA;   match identity address 52.203.180.41 255.255.255.255&#xA;   local-address 38.122.23.162&#xA;crypto isakmp profile isakmp-vpn-04d0c665-1&#xA;   keyring keyring-vpn-04d0c665-1&#xA;   match identity address 54.210.103.217 255.255.255.255&#xA;   local-address 38.122.23.162&#xA;!&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association replay window-size 128&#xA;!&#xA;crypto ipsec transform-set WCIT esp-des esp-sha-hmac&#xA; mode tunnel&#xA;crypto ipsec transform-set ipsec-prop-vpn-04d0c665-0 esp-aes esp-sha-hmac&#xA; mode tunnel&#xA;crypto ipsec transform-set ipsec-prop-vpn-04d0c665-1 esp-aes esp-sha-hmac&#xA; mode tunnel&#xA;crypto ipsec df-bit clear&#xA;!&#xA;!&#xA;crypto ipsec profile ipsec-vpn-04d0c665-0&#xA; set security-association lifetime seconds 3600&#xA; set transform-set ipsec-prop-vpn-04d0c665-0&#xA; set pfs group2&#xA;!&#xA;crypto ipsec profile ipsec-vpn-04d0c665-1&#xA; set security-association lifetime seconds 3600&#xA; set transform-set ipsec-prop-vpn-04d0c665-1&#xA; set pfs group2&#xA;!&#xA;!&#xA;crypto map WCITVPN 10 ipsec-isakmp&#xA; set peer 70.34.227.146&#xA; set transform-set WCIT&#xA; match address 150&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Tunnel1&#xA; ip address 169.254.44.102 255.255.255.252&#xA; ip virtual-reassembly in&#xA; ip tcp adjust-mss 1387&#xA; tunnel source 38.122.23.162&#xA; tunnel mode ipsec ipv4&#xA; tunnel destination 52.203.180.41&#xA; tunnel protection ipsec profile ipsec-vpn-04d0c665-0&#xA;!&#xA;interface Tunnel2&#xA; ip address 169.254.45.178 255.255.255.252&#xA; ip virtual-reassembly in&#xA; ip tcp adjust-mss 1387&#xA; tunnel source 38.122.23.162&#xA; tunnel mode ipsec ipv4&#xA; tunnel destination 54.210.103.217&#xA; tunnel protection ipsec profile ipsec-vpn-04d0c665-1&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 10.1.9.1 255.255.255.0&#xA; ip nat outside&#xA; ip nat enable&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; no mop enabled&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/0/0&#xA; ip address 38.122.23.162 255.255.255.248&#xA; ip nat inside&#xA; ip nat enable&#xA; ip virtual-reassembly in&#xA; no mop enabled&#xA; crypto map WCITVPN&#xA;!&#xA;router bgp 65000&#xA; bgp log-neighbor-changes&#xA; neighbor 169.254.44.101 remote-as 7224&#xA; neighbor 169.254.44.101 timers 10 30 30&#xA; neighbor 169.254.45.177 remote-as 7224&#xA; neighbor 169.254.45.177 timers 10 30 30&#xA; !&#xA; address-family ipv4&#xA;  network 0.0.0.0&#xA;  neighbor 169.254.44.101 activate&#xA;  neighbor 169.254.44.101 default-originate&#xA;  neighbor 169.254.44.101 soft-reconfiguration inbound&#xA;  neighbor 169.254.45.177 activate&#xA;  neighbor 169.254.45.177 default-originate&#xA;  neighbor 169.254.45.177 soft-reconfiguration inbound&#xA; exit-address-family&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip nat source list 1 interface GigabitEthernet0/0/0 overload&#xA;ip route 0.0.0.0 0.0.0.0 38.122.23.161&#xA;!&#xA;access-list 1 permit 0.0.0.0 255.255.255.0&#xA;access-list 10 permit 10.1.9.0 0.0.0.255&#xA;access-list 150 permit ip 10.1.9.0 0.0.0.255 10.1.11.0 0.0.0.255&#xA;dialer-list 1 protocol ip permit&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line 2&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport input all&#xA; transport output pad telnet rlogin lapb-ta mop udptn v120 ssh&#xA; stopbits 1&#xA;line vty 0 4&#xA; password pqBwmuzM5HwKWUc3&#xA; login local&#xA; transport input ssh&#xA;!&#xA;scheduler allocate 20000 1000&#xA;ntp peer 0.us.pool.ntp.org prefer version 2&#xA;!&#xA;end&#xA;&#xA;cisco-1-c#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is 38.122.23.161 to network 0.0.0.0&#xA;&#xA;S*    0.0.0.0/0 [1/0] via 38.122.23.161&#xA;      10.0.0.0/8 is variably subnetted, 3 subnets, 3 masks&#xA;C        10.1.9.0/24 is directly connected, GigabitEthernet0/0&#xA;L        10.1.9.1/32 is directly connected, GigabitEthernet0/0&#xA;B        10.10.0.0/16 [20/100] via 169.254.45.177, 2d00h&#xA;      38.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;C        38.122.23.160/29 is directly connected, GigabitEthernet0/0/0&#xA;L        38.122.23.162/32 is directly connected, GigabitEthernet0/0/0&#xA;         169.254.0.0/16 is variably subnetted, 2 subnets, 2 masks&#xA;C        169.254.45.176/30 is directly connected, Tunnel2&#xA;L        169.254.45.178/32 is directly connected, Tunnel2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The tracepath from a server on the internal network to a public internet server (google.com in this case)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    [chris@db1-r2-c ~]$ tracepath 74.125.22.139&#xA; 1?: [LOCALHOST]     pmtu 1500&#xA; 1:  cisco-1-c.sidecartechnologies.com (10.1.9.1)           0.558ms&#xA; 1:  cisco-1-c.sidecartechnologies.com (10.1.9.1)           0.486ms&#xA; 2:  no reply&#xA; 3:  no reply&#xA; 4:  no reply&#xA; 5:  no reply&#xA; 6:  no reply&#xA; 7:  no reply&#xA; 8:  no reply&#xA; 9:  no reply&#xA;10:  no reply&#xA;11:  no reply&#xA;12:  no reply&#xA;13:  no reply&#xA;14:  no reply&#xA;15:  no reply&#xA;16:  no reply&#xA;17:  no reply&#xA;18:  no reply&#xA;19:  no reply&#xA;20:  no reply&#xA;21:  no reply&#xA;22:  no reply&#xA;23:  no reply&#xA;24:  no reply&#xA;25:  no reply&#xA;26:  no reply&#xA;27:  no reply&#xA;28:  no reply&#xA;29:  no reply&#xA;30:  no reply&#xA;31:  no reply&#xA;     Too many hops: pmtu 1500&#xA;     Resume: pmtu 1500&#xA;[chris@db1-r2-c ~]$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="28365" LastEditorUserId="8499" LastEditDate="2019-01-04T23:27:38.480" LastActivityDate="2021-01-29T06:11:47.600" Title="Cisco 1921 private LAN can't access internet on WAN interface" Tags="|cisco|routing|router|nat|wan|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33728" PostTypeId="2" ParentId="33727" CreationDate="2016-08-03T15:52:23.353" Score="2" Body="&lt;p&gt;You NAT is incorrect:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list intranet pool external overload&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You don't even have the pool which you are referencing in the NAT statement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list 10 interface GigabitEthernet0/0/0 overload&#xA;!&#xA;access-list 10 permit 10.1.9.0 0.0.0.255&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My example will translate source addresses in the &lt;code&gt;10.1.9.0/24&lt;/code&gt; range which come in the &lt;code&gt;GigabitEthernet0/0&lt;/code&gt; interface and leave through the &lt;code&gt;GigabitEthernet0/0/0&lt;/code&gt; interface. The address on the &lt;code&gt;GigabitEthernet0/0/0&lt;/code&gt; interface will be the one used for the above traffic leaving that interface.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is what should work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; ip address 10.1.9.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; no mop enabled&#xA;!&#xA;interface GigabitEthernet0/0/0&#xA; ip address 38.122.23.162 255.255.255.248&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; no mop enabled&#xA; crypto map WCITVPN&#xA;!&#xA;ip nat inside source list 10 interface GigabitEthernet0/0/0 overload&#xA;!&#xA;access-list 10 permit 10.1.9.0 0.0.0.255&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-03T17:05:22.147" LastActivityDate="2016-08-03T17:05:22.147" CommentCount="27" ContentLicense="CC BY-SA 3.0" />
  <row Id="33729" PostTypeId="2" ParentId="22376" CreationDate="2016-08-03T16:37:29.460" Score="2" Body="&lt;p&gt;For each direction of a conversation, TCP keeps track of the number of bytes sent, and the number of bytes received. This is done using a Sequence number (to track bytes sent) and an Acknowledgement number (to track bytes received).&lt;/p&gt;&#xA;&lt;p&gt;For simplicity, I'll proceed as if the SEQ# and the ACK# are a count of &lt;em&gt;packets&lt;/em&gt; sent (in reality, it is a count of &lt;em&gt;bytes&lt;/em&gt; sent). In addition, we will only keep track of the conversation in one direction, we won't bother ourselves with the conversation in the other direction.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Bob                                 Alice&#xA;Sends packets #1, #2, #3 ---&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Bob sends to Alice packets with SEQ# 1, 2, and 3.... There are three possibilities of how Alice can respond:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If Alice receives each packet, she will respond with ACK#4, saying she has received everything before #4, and is ready for #4 next.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If Alice receives only #1, and nothing else, she will respond with ACK#2, indicating she is ready for #2, and has received everything before. This will prompt Bob to sent #2 and #3 again.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If Alice receives only #1 and #3, and somehow #2 gets lost in transit. Alice still has no choice but to respond with ACK#2. Remember, Alice can only respond with an Acknowledgement number that confirms the packets she has received. If she responded with #4, it would communicate to Bob that #1, #2, and #3 were received, which isn't the case.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;So in both cases prior, Bob receives ACK#2, and Bob has no way of knowing whether &lt;em&gt;just&lt;/em&gt; #2 or #2 &lt;em&gt;and&lt;/em&gt; #3 were lost -- so to play it safe, Bob will resend #2 and #3.&lt;/p&gt;&#xA;&lt;p&gt;That said, in the 3rd case above, when Bob re-sends #2 and #3, but Alice already had #3.. whether she replaces the bytes within packet #3 in her buffer with the newly received #3, or whether she simply ignores the duplicate received #3 is entirely up to the implementation -- and largely the difference will be unnoticeable to the user. The end effect is the same.&lt;/p&gt;&#xA;&lt;HR /&gt;&#xA;&lt;p&gt;Of course, this is simply a factor of there just being two numbers being tracked, A SEQ# stating bytes sent, and an ACK# tracking bytes received. As the OP pointed out, there was a feature added to TCP called Selective Acknowledgement, or &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2018&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP SACK&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;TCP SACK allows the receiver to not just send an ACK# (bytes received), but to also specify a &amp;quot;left edge&amp;quot; and &amp;quot;right edge&amp;quot; of the bytes that were received. Which then indicates to the sender specifically which bytes need to be resent.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-08-03T16:37:29.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33730" PostTypeId="2" ParentId="33727" CreationDate="2016-08-03T16:51:04.843" Score="0" Body="&lt;p&gt;This is a very common configuration.  You could almost copy and paste from Cisco's &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/1700-series-modular-access-routers/71462-rtr-l2l-ipsec-split.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;LAN-to-LAN IPsec Tunnel Between Two Routers Configuration Example&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case you have 3 locations and should nail up a full mesh - where each router has 2 VPN tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Z5yMo.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z5yMo.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-03T16:51:04.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33731" PostTypeId="2" ParentId="33716" CreationDate="2016-08-03T17:15:42.467" Score="2" Body="&lt;h3&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/routers/2500-series-routers/12722-pswdrec-2500.html#topic1&quot; rel=&quot;nofollow&quot;&gt;Password Recovery Procedure for the Cisco 2000, 2500, 3000, 4000, AccessPro, 7000 (RP), AGS, IGS, and STS-10x&lt;/a&gt;&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;h2&gt; Step-by-Step Procedure &lt;/h2&gt; &#xA;   &lt;p&gt;Complete these steps in order to recover a lost or forgotten password:&lt;/p&gt; &#xA;    &#xA;    &lt;li&gt; &lt;p&gt;Attach a terminal or PC with terminal emulation to the console port of the router. &lt;/p&gt; &lt;p&gt;Use these terminal settings: &lt;/p&gt; &#xA;     &lt;ul&gt; &#xA;      &lt;li&gt; &lt;p&gt;9600 baud rate &lt;/p&gt; &lt;/li&gt; &#xA;      &lt;li&gt; &lt;p&gt;No parity &lt;/p&gt; &lt;/li&gt; &#xA;      &lt;li&gt; &lt;p&gt;8 data bits &lt;/p&gt; &lt;/li&gt; &#xA;      &lt;li&gt; &lt;p&gt;1 stop bit &lt;/p&gt; &lt;/li&gt; &#xA;      &lt;li&gt; &lt;p&gt;No flow control &lt;/p&gt; &lt;/li&gt; &#xA;     &lt;/ul&gt; &lt;p&gt;The required console cable specifications are described in the &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/routers/ps332/products_tech_note09186a0080094ce6.shtml&quot; rel=&quot;nofollow&quot;&gt;Cabling Guide for Console and AUX Ports&lt;/a&gt; (Cisco 1000 Series, 2500 Series, and AS5100).&lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;If you can access the router, type &lt;b&gt;show version&lt;/b&gt; at the prompt, and record the configuration register setting. See Example of Password Recovery Procedure in order to view the output of a &lt;b&gt;show version&lt;/b&gt; command.&lt;/p&gt; &lt;p&gt; &lt;b&gt;Note:&amp;nbsp;&lt;/b&gt;The configuration register is usually set to 0x2102 or 0x102. If you can no longer access the router (because of a lost login or TACACS password), you can safely assume that your configuration register is set to 0x2102. &lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Use the power switch in order to turn off the router, and then turn the router back on. &lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Press &lt;b&gt;Break&lt;/b&gt; on the terminal keyboard within 60 seconds of power up in order to put the router into ROMmon. &lt;/p&gt; &lt;p&gt;If the break sequence does not work, refer to &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/routers/ps133/products_tech_note09186a0080174a34.shtml&quot; rel=&quot;nofollow&quot;&gt;Standard Break Key Sequence Combinations During Password Recovery&lt;/a&gt; for other key combinations. &lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;At the prompt, type &lt;b&gt;o&lt;/b&gt;, press &lt;b&gt;ENTER&lt;/b&gt;, and record the current value of the configuration register (usually 0x2102 or 0x102).&lt;/p&gt; &#xA;     &lt;blockquote&gt; &#xA;      &lt;pre&gt;&amp;gt;&lt;b&gt;o&lt;/b&gt;&lt;br&gt;&#xA;&lt;i&gt;&#xA;!--- Shows the configuration register option settings.&#xA;&lt;/i&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration register = &lt;b&gt;0x2102&lt;/b&gt; at last boot&#xA;Bit#    Configuration register option settings: &#xA;15      Diagnostic mode disabled &#xA;&lt;i&gt;&#xA;!--- Output supressed.&#xA;&lt;/i&gt;&#xA;&lt;/pre&gt; &#xA;     &lt;/blockquote&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;o/r 0x2142&lt;/b&gt;, and press &lt;b&gt;ENTER&lt;/b&gt; at the &amp;gt; prompt in order to boot from Flash and bypass the configuration file.&lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;i&lt;/b&gt; at the &amp;gt; prompt, and press &lt;b&gt;ENTER&lt;/b&gt;. &lt;/p&gt; &lt;p&gt;The router reboots, but ignores the saved configuration.&lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;no&lt;/b&gt; after each setup question, or press &lt;b&gt;CTRL + C&lt;/b&gt; in order to skip the initial setup procedure. &lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;enable&lt;/b&gt; at the Router&amp;gt; prompt. &lt;/p&gt; &lt;p&gt;Once the Router# prompt appears, you are in enable mode.&lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;configure memory&lt;/b&gt; or &lt;b&gt;copy startup-config running-config&lt;/b&gt; in order to copy the NVRAM into memory.&lt;/p&gt; &lt;p&gt; &lt;b&gt; Important:&lt;/b&gt; Do &lt;i&gt;not&lt;/i&gt; type &lt;b&gt;copy running-config startup-config&lt;/b&gt; or &lt;b&gt;write memory&lt;/b&gt;. These commands erase your startup configuration.&lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;write terminal&lt;/b&gt; or &lt;b&gt;show running-config&lt;/b&gt;.&lt;/p&gt; &lt;p&gt;The &lt;b&gt;show running-config&lt;/b&gt; and &lt;b&gt;write terminal&lt;/b&gt; commands show the configuration of the router. In this configuration, the &lt;b&gt;shutdown&lt;/b&gt; command appears under each interface, which means all interfaces are currently shutdown. Also, the passwords display either encrypted or unencrypted. &lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;configure terminal&lt;/b&gt;, and make the changes. &lt;/p&gt; &lt;p&gt;The hostname(config)# prompt appears.&lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;enable secret &amp;lt;password&amp;gt;&lt;/b&gt; in order to change the &lt;b&gt;enable secret password&lt;/b&gt;.&lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Issue the &lt;b&gt;no shutdown&lt;/b&gt; command on every interface that is used. If you issue a &lt;b&gt;show ip interface brief&lt;/b&gt; command after you exit configuration mode, every interface that you want to use displays &lt;i&gt;up up&lt;/i&gt;. &lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;config-register 0x2102&lt;/b&gt; (or use the value you recorded in step 4).&lt;/p&gt; &lt;p&gt;This step causes the router to load the Cisco IOS software from the Flash with the configuration from NVRAM at the next reload. &lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Press &lt;b&gt;CTRL + Z&lt;/b&gt; in order to leave the configuration mode. &lt;/p&gt; &lt;p&gt;The hostname# prompt appears.&lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;write memory&lt;/b&gt; or &lt;b&gt;copy running-config startup-config&lt;/b&gt; in order to commit the changes. &lt;/p&gt; &lt;/li&gt; &#xA;    &lt;li&gt; &lt;p&gt;Type &lt;b&gt;Reload&lt;/b&gt; in order to restart the router and force the Cisco IOS software to boot from the Flash.&lt;/p&gt; &lt;/li&gt; &#xA;   &lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-03T17:15:42.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33732" PostTypeId="2" ParentId="33726" CreationDate="2016-08-03T17:53:20.403" Score="0" Body="&lt;p&gt;Looking at the Release Notes usually tells you about supported upgrade paths.  In your case, you don't have a choice.  Basically - try it.  Follow the directions in the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/upgrade/503_N1_1/n5k_upgrade_downgrade_503.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Nexus 5000 Series NX-OS Software Upgrade and Downgrade Guide, Release 5.0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also might look at the following.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5500/sw/release/notes/7x/Nexus5500_Release_Notes_7x.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Nexus 5500 Series Release Notes, Cisco NX-OS Release 7.x&lt;/a&gt;  09/Jun/2016&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5500/sw/release/notes/6_02/Nexus5500_Release_Notes_6_02.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Nexus 5500 Series Release Notes, Cisco NX-OS Release 6.02&lt;/a&gt;  01/Jul/2014&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/m3I8n.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/m3I8n.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KXSpR.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KXSpR.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-03T17:53:20.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33733" PostTypeId="2" ParentId="33726" CreationDate="2016-08-03T19:11:35.813" Score="2" Body="&lt;p&gt;Before proceeding with any upgrade, please ensure you have both the kickstart and the system image file. The kickstart file will set all the variables for you, and the system will check for this on reload. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: The kickstart file needs to match the system image file version. Please do not try to proceed with upgrading without both of these files. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The quickest way to determine if you are able to upgrade this device is by issuing the show install command from the 5548:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show install all impact kickstart bootflash:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example Output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch-1# show install all impact kickstart bootflash:n5000-uk9-kickstart.4.2.1.N1.1.bin&#xA;system bootflash:n5000-uk9.4.2.1.N1.1.bin&#xA;Verifying image bootflash:/n5000-uk9-kickstart.4.2.1.N1.1.bin for boot variable &#xA;&quot;kickstart&quot;.&#xA;[####################] 100% -- SUCCESS&#xA;Verifying image bootflash:/n5000-uk9.4.2.1.N1.1.bin for boot variable &quot;system&quot;.&#xA;[####################] 100% -- SUCCESS&#xA;Verifying image type.&#xA;[###########         ]  50%&#xA;[####################] 100% -- SUCCESS&#xA;Extracting &quot;system&quot; version from image bootflash:/n5000-uk9.4.2.1.N1.1.bin.&#xA;[####################] 100% -- SUCCESS&#xA;Extracting &quot;kickstart&quot; version from image bootflash:/n5000-uk9-kickstart.4.2.1.N1.1.bin.&#xA;[####################] 100% -- SUCCESS&#xA;Extracting &quot;bios&quot; version from image bootflash:/n5000-uk9.4.2.1.N1.1.bin.&#xA;[####################] 100% -- SUCCESS&#xA;Extracting &quot;fex&quot; version from image bootflash:/n5000-uk9.4.2.1.N1.1.bin.&#xA;[####################] 100% -- SUCCESS&#xA;Notifying services about system upgrade.&#xA;[####################] 100% -- SUCCESS&#xA;Compatibility check is done:&#xA;Module  bootable          Impact  Install-type  Reason&#xA;------  --------  --------------  ------------  ------&#xA;  1       yes      disruptive         reset  Reset due to single supervisor&#xA;100       yes      disruptive         reset  Reset due to single supervisor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Images will be upgraded according to following table:&#xA; Module       Image         Running-Version             New-Version  Upg-Required&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  1      system             4.1(3)N1(1)             4.2(1)N1(1)           yes&#xA;  1   kickstart             4.1(3)N1(1)             4.2(1)N1(1)           yes&#xA;  1        bios        v1.3.0(09/08/09)                                    no&#xA;100         fex             4.1(3)N1(1)             4.2(1)N1(1)           yes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please also refer to the official documentation for upgrading from that version:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/upgrade/503_N1_1/n5k_upgrade_downgrade_503.html?referring_site=RE&amp;amp;pos=1&amp;amp;page=http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/upgrade/513_N1_1/n5k_upgrade_downgrade_513.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/upgrade/503_N1_1/n5k_upgrade_downgrade_503.html?referring_site=RE&amp;amp;pos=1&amp;amp;page=http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/upgrade/513_N1_1/n5k_upgrade_downgrade_513.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14613" LastActivityDate="2016-08-03T19:11:35.813" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33735" PostTypeId="2" ParentId="33719" CreationDate="2016-08-03T20:34:39.957" Score="1" Body="&lt;p&gt;Those are marketing terms.  They have no technical meaning based on industry stamdards (IEEE / IETF / OSI).  If you dont know which to purchase or which you need you would benefit from contacting a networking equipment reseller.  Each manufacturer's website usually has a way to search for certified resellers in your area.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-03T20:34:39.957" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33736" PostTypeId="1" CreationDate="2016-08-03T21:06:29.023" Score="0" ViewCount="183" Body="&lt;p&gt;I'm following along with a MPLS problem. I have this topology...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OPCbA.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OPCbA.png&quot; alt=&quot;MPLS Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 is to reach R6 via an MPLS VPN and states that the MPLS cloud is to be configured with OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I want to know is, am i right in saying...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1, R4, R6 and R7 will be the CE routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2, R3 and R5 will be the PE routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When implementing this, the &quot;mpls cloud&quot; as shown in the diagram, will be replaced with a &quot;P&quot; router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="25289" LastActivityDate="2016-08-04T01:18:55.383" Title="Will i replace the MPLS cloud as a &quot;P&quot; router?" Tags="|vpn|mpls|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-14T22:10:26.387" ContentLicense="CC BY-SA 3.0" />
  <row Id="33737" PostTypeId="2" ParentId="33736" CreationDate="2016-08-04T01:18:55.383" Score="1" Body="&lt;p&gt;If you are asking &quot;can I replace the cloud with one P router as a lab exercise?&quot; The answer is yes. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-04T01:18:55.383" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33739" PostTypeId="1" AcceptedAnswerId="33745" CreationDate="2016-08-04T01:39:14.877" Score="1" ViewCount="176" Body="&lt;p&gt;Can 802.11a connect or can bridge to 802.11n? I do search the internet but it doesn't gave me a clear idea. I also searched in this site, but I saw, b to n, or ac to n.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm an amateur in this kind of field. TIA for someone who would like to answer/help! :)&lt;/p&gt;&#xA;" OwnerUserId="28356" LastActivityDate="2016-08-04T07:50:18.420" Title="Can 802.11a connect or can bridge to 802.11n?" Tags="|ieee-802.11|bridge|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33740" PostTypeId="1" CreationDate="2016-08-04T01:39:31.113" Score="0" ViewCount="1134" Body="&lt;p&gt;I'm kind of new to working directly with networking hardware (prior to my current job, the closest I got was logging into a Cisco router and modifying NATs), and have been tasked with automating the initial setup of various hardware. Because most of the hardware is either inaccessible over the network upon first boot, or because they're designed to be used with a wizard rather than just straight inputting commands, I've resorted most of the time to using &lt;code&gt;expect&lt;/code&gt; scripts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is this a typical approach? Or are there other methods people generally use instead, be it scripting, or something completely different?&lt;/strong&gt; If you need a concrete example, let's look at a Cisco 2900 series router.&lt;/p&gt;&#xA;" OwnerUserId="28375" LastActivityDate="2016-10-03T03:52:21.177" Title="Initial configuration of router using script" Tags="|cisco|automation|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33742" PostTypeId="2" ParentId="33740" CreationDate="2016-08-04T02:51:49.203" Score="1" Body="&lt;h3&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/configuration/guide/ffun_c/fcf002.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Chapter: Using AutoInstall and Setup&lt;/a&gt; &amp;lt;-- click me&lt;/h3&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3pgiA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3pgiA.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-04T02:51:49.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33743" PostTypeId="2" ParentId="33739" CreationDate="2016-08-04T02:54:54.610" Score="0" Body="&lt;p&gt;Yes, if it has the WiFi logo on the box.  &lt;a href=&quot;http://www.wi-fi.org&quot; rel=&quot;nofollow&quot;&gt;WiFi Alliance&lt;/a&gt; makes sure devices are backward compatible.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Wi-Fi CERTIFIED n products work with older Wi-Fi devices, including&#xA;  802.11 a/b/g, and Wi-Fi CERTIFIED ac.  Wi-Fi CERTIFIED n products have the very latest generation of security protections, WPA2™ (Wi-Fi&#xA;  Protected Access®), so certified products offer the highest level of&#xA;  protection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-04T02:54:54.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33745" PostTypeId="2" ParentId="33739" CreationDate="2016-08-04T07:50:18.420" Score="1" Body="&lt;p&gt;You'll have to make sure that both APs support 802.11a. 802.11n is a technology supported on both WiFi frequency bands, so it does not indicate which band you are on.&#xA;If AP1 supports only .11a and AP2 only .11b/g/n, it will not work, as both APs will be on different frequency bands. For example, your first research probably lead you to &quot;b to gn&quot; and &quot;ac to an&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consumer-side, the 2.4GHz is represented by 802.11b/g/n, and the 5GHz by 802.11a/n/ac. There is other WiFi standards but it is not relevant to the answer.&lt;/p&gt;&#xA;" OwnerUserId="28361" LastActivityDate="2016-08-04T07:50:18.420" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33747" PostTypeId="1" CreationDate="2016-08-04T12:40:11.407" Score="1" ViewCount="195" Body="&lt;p&gt;I need to squeeze an ethernet cable under a door (as I can't drill a wall, Powerline adapters are out of the question, and Wi-Fi has too much of a packet loss to use here), but it doesn't fit whole. If I remove the coating from a small section and pass the four pairs paralel under the door, would it cause any problems? This is an indoor environment without any more electromagnetic noise than the average household, and I have a cat5e avaliable.&#xA;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="29394" LastActivityDate="2016-08-04T13:29:19.563" Title="Can an Ethernet cable still work properly without the coating, indoors?" Tags="|ethernet|cable|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33748" PostTypeId="2" ParentId="33747" CreationDate="2016-08-04T12:44:22.420" Score="4" Body="&lt;p&gt;yes, this may cause issues.  The wires inside the insulator (what you are calling coating) is twisted to prevent any interference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a network engineer, I have been in situation where everything works fine with a network cable without the insulator.  But I would not recommend having it as it may cause degradation in your network bandwidth. &lt;/p&gt;&#xA;" OwnerUserId="25146" LastActivityDate="2016-08-04T12:44:22.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33749" PostTypeId="1" CreationDate="2016-08-04T13:04:30.593" Score="1" ViewCount="508" Body="&lt;p&gt;I currently manage ~600 devices in remote sites. We use a proprietary software to monitor these devices, and currently configure static IPs for every device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This requires us to have knowledge of what switch it will be plugged into, which is often hard because we aren't on site during installs. also, devices can be moved without our knowledge, and the only way to bring it back online is to have them reconnected to the original switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would there be an issue with allowing the device to get an IP from DHCP and connecting to it via hostname? If this were to work, we wouldn't need knowledge of which switch is closest to the rack we are installing it in, and would prevent us from losing connection if a device is moved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="29393" LastActivityDate="2016-08-05T06:30:30.513" Title="Connecting to remote device via hostname that gets its IP from DHCP" Tags="|ip|dhcp|dns|" AnswerCount="2" CommentCount="1" ClosedDate="2017-08-14T22:31:43.213" ContentLicense="CC BY-SA 3.0" />
  <row Id="33750" PostTypeId="2" ParentId="33747" CreationDate="2016-08-04T13:29:19.563" Score="6" Body="&lt;p&gt;There are flat Ethernet cables. Maybe they'll work for you. Just google for &quot;flat Ethernet cable&quot;.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2016-08-04T13:29:19.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33753" PostTypeId="1" CreationDate="2016-08-04T16:10:40.507" Score="3" ViewCount="148" Body="&lt;p&gt;i am trying to configure QOS for site to site VPN, i want to dedicate 50% of the bandwidth on the physical interface to VPN traffic, then the remaining to internet traffic. the connection to intranet server is very slow and the internet link is 10 mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is the Qos configuration i have presently and it is still very slow.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 112 permit ip any 192.168.0.0 0.0.0.255&#xA;&#xA;class-map match-all test-qos&#xA; match access-group 112&#xA;policy-map qos-pmap&#xA; class test-qos&#xA;  bandwidth percent 50&#xA;interface Tunnel0&#xA; ip address 172.16.60.1 255.255.255.252&#xA;  qos pre-classify&#xA;interface GigabitEthernet0/0&#xA; service-policy output qos-pmap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29399" LastEditorUserId="2142" LastEditDate="2016-08-04T16:12:29.707" LastActivityDate="2016-08-04T21:30:43.990" Title="qos for Cisco VPN" Tags="|cisco|cisco-ios-12|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33754" PostTypeId="2" ParentId="24751" CreationDate="2016-08-04T16:29:29.333" Score="1" Body="&lt;p&gt;To expand on this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;inline power&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Covers from 0 to whatever the maximum output of the port is. For instance, you're using a Brocade ICX7250-24P, it's max output per port is approximately 30 watts. Simply putting the 'inline power' will allow you to plug in anything that supports PoE (15.4 watts) or PoE+. This is typically not a good practice, and it is recommended that you figure out what class of power you need, and assign it to the interface. &lt;/p&gt;&#xA;" OwnerUserId="29401" LastActivityDate="2016-08-04T16:29:29.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33755" PostTypeId="2" ParentId="21078" CreationDate="2016-08-04T16:32:57.253" Score="1" Body="&lt;p&gt;I'm responding because you're asking for alternatives. Have you considered the Brocade VDX 6740 or 6740-T? Both come with a very similar CLI to the Nexus, and are extremely affordable when compared to the N5K, yet way more solid than the N3K. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They also come with the layer 3 capabilities available off the bat. No need for additional licensing or hardware modules for routing.&lt;/p&gt;&#xA;" OwnerUserId="29401" LastActivityDate="2016-08-04T16:32:57.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33756" PostTypeId="2" ParentId="33718" CreationDate="2016-08-04T16:33:42.760" Score="2" Body="&lt;p&gt;I resolved using NAT virtual interface.&#xA;&lt;a href=&quot;http://www.ciscozine.com/nat-virtual-interface-aka-nvi-what-is-that/&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscozine.com/nat-virtual-interface-aka-nvi-what-is-that/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6129" LastActivityDate="2016-08-04T16:33:42.760" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33757" PostTypeId="2" ParentId="14694" CreationDate="2016-08-04T16:50:44.447" Score="-1" Body="&lt;p&gt;Yes A router stops broadcast domain is correct statement. I will give you answer in simple words. First of all broadcast means sending a single packet to all the devices rather than a particular device which to be sent in that net work.The ports in switch are of separate collision and broadcast domain. So whenever a packet is sent, like hub the switch transfers the packet to each and every port which results in network bandwidth efficiency. So between two networks a layer 3 device which is called router is place to stop forwarding the broadcast. Instead it checks the packet, refers the address and send to the concerned device to which it has to be sent. A router forward broadcast domain at certain point when it has no IP address and forward Broadcast to DHCP server in order to get assigned of an IP address. &lt;/p&gt;&#xA;" OwnerUserId="29402" LastActivityDate="2016-08-04T16:50:44.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33758" PostTypeId="1" CreationDate="2016-08-04T17:33:58.687" Score="2" ViewCount="350" Body="&lt;p&gt;This is probably an opinion based question which i know is frowned upon on here but here goes anyway. My question is as the title suggests. I can understand why we need an Ephemeral dynamic port on the client as it would be too complex for a process to deal with having to know what each and every thread was requesting what when receiving incoming packets..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked online but can't find an answer to my question..Why can't we instead of static ports at the server side we instead bind protocols to the service. E.g. Http,Https binded to a web server, SMTP to a mail server etc. So instead of the incoming packet being demultiplexed by the dest port such as 80 for a web service, TCP/ip instead filters on the layer 5 header being Http,FTP, SMTP etc and then forwarding it onto that particular service..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can understand that this maybe an odd question but i like to break things down and see if there were any alternatives before proposing the way it became using static ports..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You for your time :)&lt;/p&gt;&#xA;" OwnerUserId="29403" LastEditorUserId="8499" LastEditDate="2018-10-19T06:11:47.437" LastActivityDate="2018-10-19T15:15:18.887" Title="Why do we need a destination (server side) static TCP/IP Port?" Tags="|tcp|protocol-theory|layer4|transport-protocol|" AnswerCount="4" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33759" PostTypeId="2" ParentId="33758" CreationDate="2016-08-04T17:46:22.250" Score="2" Body="&lt;p&gt;Since HTTP, SMTP, etc are application layer protocols, you would need to decode the protocol first in order to figure out which service is supposed to process it.  You would need to have a decoding process that understands all protocols in order to pass it on to the correct process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everytime a new protocol was developed, you would have to update this decoding function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not saying you couldn't do it that way, but the TCP/IP model make sit easier.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-04T17:46:22.250" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33760" PostTypeId="2" ParentId="33758" CreationDate="2016-08-04T18:02:04.890" Score="1" Body="&lt;p&gt;Layers 1 to 4 comprise the network stack which OS developers have implemented in the OS, but they never actually implemented layers 5 to 7. It is up to the application developers to provide these services in their application. That means there is no standardized way for layer-4 protocols to know what is in any layer above it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 protocols can have addresses, e.g. MAC addresses, and the layer-3 protocols register with layer-2 so that layer-2 knows where to send the payload of the layer-2 frames, e.g. ethernet has the EtherType field in the frame header. Layer-2 protocols don't look in the frame payload to see what it is, and this means that we can use any number of layer-3 protocols with layer-2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-3 protocols have addresses, e.g. IPv4 addresses, and they have the same sort of thing as layer-2 protocols, e.g. IPv4 has the Protocol field in the IPv4 header. Layer-3 protocols don't look in the packet payload to see what it is, and this means that we can use any number of layer-4 protocols with layer-3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-4 protocols have addresses, e.g. TCP ports. Applications register with a layer-4 port, saying that anything that comes to that port goes to it. Layer-4 protocols don't look in the frame payload to see what it is, and this means that we can use any number of applications with layer-4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since there is no defined layer-5 in the OS, layer-4 protocols don't have a standard way for layer-5 protocols to register with them, and there is no field in the layer-4 headers to register a layer-5 protocol. Instead, by consensus, there are well-known ports which some applications use, but that doesn't mean a different application than the one which is well known can't use one of the well-known ports if it is not currently in use. For instance, I could write an application which uses port 80 (well known for web servers). If I run my application, then try to run a web server, the web server will not work on the well-known port because it is already in use.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-04T18:02:04.890" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33762" PostTypeId="1" AcceptedAnswerId="33763" CreationDate="2016-08-04T19:30:40.907" Score="1" ViewCount="4794" Body="&lt;p&gt;What does it mean saying the speed of a switch port (or router port)? In other word, does this mean that switch ports have a default-factory speed limit in some sense?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="28219" LastEditorUserId="8499" LastEditDate="2016-08-04T19:38:42.423" LastActivityDate="2016-08-05T07:18:20.977" Title="Meaning of switch port speed" Tags="|cisco|switch|router|layer1|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33763" PostTypeId="2" ParentId="33762" CreationDate="2016-08-04T19:38:08.233" Score="1" Body="&lt;p&gt;Switch ports normally can pass traffic at 10Mbps, 100Mbps or 1000Mbps. The default is for the switch port to auto-configure its speed based on signaling between the port and the connected device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes auto-speed doesn't work that well and then, if possible, one could manually set the speed of a port (routers, too) with the &quot;speed&quot; or &quot;set speed&quot; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The vast majority of switches do not support speeds over 1000Mbps, there are very high-end (think major ISP or large datacenter equipment) switches that can to 10GbPS or 40GbPS now, too. &lt;/p&gt;&#xA;" OwnerUserId="29406" LastActivityDate="2016-08-04T19:38:08.233" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33764" PostTypeId="2" ParentId="33758" CreationDate="2016-08-04T21:22:02.350" Score="0" Body="&lt;p&gt;For the same reason your postal address is static - so people have an address to reach you at.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-04T21:22:02.350" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33765" PostTypeId="2" ParentId="33753" CreationDate="2016-08-04T21:30:43.990" Score="1" Body="&lt;h3&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfgts.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.2&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;p&gt;GTS Enabled on the Interface Example&#xA;This example shows the configuration of two traffic-shaped interfaces on a router. Ethernet interface 0 is configured to limit User Datagram Protocol (UDP) traffic to 1 Mbps. Ethernet interface 1 is configured to limit all output to 5 Mbps.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit udp any any&#xA;interface Ethernet0&#xA; traffic-shape group 101 1000000 125000 125000&#xA;!&#xA;interface Ethernet1&#xA; traffic-shape rate 5000000 625000 625000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;put your 5mbps policy in your policy map and your 10mbps policy on your physical interface.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-04T21:30:43.990" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33766" PostTypeId="2" ParentId="33749" CreationDate="2016-08-04T21:40:18.320" Score="-2" Body="&lt;p&gt;SNMP server settings are configured on the client(s).  So, if you are using SNMP your server gets messages that way.  If you are not using SNMP, you might try pushing out DHCP option with manager ip address.  Client would need to be configured somehow to get this value though.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-04T21:40:18.320" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33767" PostTypeId="1" CreationDate="2016-08-05T02:21:10.407" Score="1" ViewCount="342" Body="&lt;p&gt;To be more specific. If there are two equal cost paths between two nodes, does the SPF Algorithm give the next hop value for both paths?&lt;/p&gt;&#xA;" OwnerUserId="29411" LastActivityDate="2016-08-06T09:24:30.820" Title="Does the Shortest Path First algorithm (SPF) Algorithm for OSPF and IS-IS generate all shortest paths between nodes, or just one?" Tags="|routing|ospf|is-is|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33772" PostTypeId="1" AcceptedAnswerId="33773" CreationDate="2016-08-05T03:45:53.157" Score="2" ViewCount="1956" Body="&lt;p&gt;What is the essential difference between the &lt;strong&gt;flow tables&lt;/strong&gt; in SDN-based switches and the conventional &lt;strong&gt;routing tables&lt;/strong&gt; in the existing routers? In fact, I understood that the difference is in the routing mechanism so SDN uses flow-based routing mechanism while in the conventional network it is merely packet-based routing. If my understanding is correct, kindly can an expert elaborate this in details?&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2016-08-05T06:00:38.390" Title="Finding the difference between flow tables in SDN and routing tables in traditional network" Tags="|cisco|routing|router|sdn|openflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33773" PostTypeId="2" ParentId="33772" CreationDate="2016-08-05T06:00:38.390" Score="2" Body="&lt;p&gt;First note that all of these technical terms are subject to distortion by Marketing, so sometimes you have to read between the lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The term switch refers to a layer-2 device, so it is forwarding on layer-2 info.  On an Ethernet this would be the 48 bit MAC.  With MPLS it would be the Label.  The term router officially refers to a layer-3 device, so it is forwarding on layer-3 info (the 32/128 bit IPv[46] address, unless you have a very strange network).  That's the primary difference between the terms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How each device actually implements that forwarding is partly controlled by the protocols defined to exchange the relevant data, and the engineering choices made by the device designer, and is mostly opaque to the outside.  So, to get more detail on how a particular product does it's thing, you need to get more detail from the manufacturer than the legal department wants them to divulge, so under NDA (Non-Disclosure Agreement).  Unless the device you care about is just a general purpose computer running Free or Open Source Software, in which case, you look at the source.&lt;/p&gt;&#xA;" OwnerUserId="6388" LastActivityDate="2016-08-05T06:00:38.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33774" PostTypeId="2" ParentId="33767" CreationDate="2016-08-05T06:08:54.433" Score="1" Body="&lt;p&gt;When the algorithm is running, it will see the two equal cost routes, but there is a tie-breaker (the router ID, see &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/9316/&quot;&gt;this question&lt;/a&gt;), so it will choose one as the final result.  Since you can control the router IDs (or indeed the link costs as well), you can force this selection to go either way.&lt;/p&gt;&#xA;" OwnerUserId="6388" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-08-05T06:08:54.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33775" PostTypeId="2" ParentId="33749" CreationDate="2016-08-05T06:30:30.513" Score="3" Body="&lt;p&gt;If your DHCP and DNS servers both implement DDNS (that's Dynamic [updates] to DNS, I know ISC's Open Source servers do this, and I'm sure there are several others), you can have the DHCP server update the DNS each time it gives out a lease.  If you do that right, the name each system wants will be registered in the DNS.  Notice that there are some complications if more than one device wants the same name.  They are usually first come first serve, unless overridden in the server config.&lt;/p&gt;&#xA;" OwnerUserId="6388" LastActivityDate="2016-08-05T06:30:30.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33776" PostTypeId="2" ParentId="33719" CreationDate="2016-08-05T07:02:41.900" Score="2" Body="&lt;p&gt;Managed switches boast of many features and allow full configuration via CLI (command line instructions) and in most cases offer also a web interface to easily configure the most options. They provide the ability to monitor each device on the network as well as limit the amount of bandwidth any device can use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Smart switches enjoy some capabilities that managed one have, but are more limited, cost less than managed switches and cost more than unmanaged ones. They can make an excellent transition solution when the cost of a managed switch cannot be justified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More detailed information:&lt;a href=&quot;http://www.makeuseof.com/answers/difference-unmanaged-smart-managed-switches/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.makeuseof.com/answers/difference-unmanaged-smart-managed-switches/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ehow.com/about_5348701_managed-switch-vs-unmanaged-switch.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ehow.com/about_5348701_managed-switch-vs-unmanaged-switch.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26940" LastEditorUserId="-1" LastEditDate="2018-01-26T17:06:17.813" LastActivityDate="2018-01-26T17:06:17.813" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33778" PostTypeId="1" AcceptedAnswerId="33784" CreationDate="2016-08-05T09:18:42.420" Score="1" ViewCount="9309" Body="&lt;p&gt;I connected a LAN cable from the LAN-1 port to the LAN-2 port owned by the same router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then really weird things happened:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;For 10 - 15 seconds, nothing happened, none of the lights on the&#xA;modem are changed.&lt;/li&gt;&#xA;&lt;li&gt;Lights on the router went crazy, they blink really fast.&lt;/li&gt;&#xA;&lt;li&gt;All computers connected to that router are disconnected.&lt;/li&gt;&#xA;&lt;li&gt;I have to restart the router, or my devices won't connect to it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My question is, what happened? What are the technical details?&lt;/p&gt;&#xA;" OwnerUserId="29415" LastEditorUserId="8499" LastEditDate="2018-12-21T04:08:49.230" LastActivityDate="2021-05-16T18:28:39.230" Title="Connect a LAN cable to LAN1 &amp; LAN2" Tags="|router|lan|layer1|cable|loop|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33779" PostTypeId="2" ParentId="33778" CreationDate="2016-08-05T10:24:48.497" Score="0" Body="&lt;p&gt;Normally moving cable from one LAN port to another should not cause a real issue. However there is a possibility that you have created a layer 2 loop which can result in end hosts isolation. What of a router you are using? Can you please share with us the configuration of the router? It will be great if you share topology in addition to that so we can analyze the full picture. &lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2016-08-05T10:24:48.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33780" PostTypeId="1" AcceptedAnswerId="33782" CreationDate="2016-08-05T10:41:45.590" Score="0" ViewCount="67" Body="&lt;p&gt;If you connect to a website through a wifi network where there are a number of access points with the same ESSID and a different BSSID, would the servers of that website know which AP was used? So, for example, if 2 AP &quot;A&quot; and &quot;B&quot; had the same ESSID and a different BSSID, would the packet transmitted to the server contain the information on whether AP &quot;A&quot; or AP &quot;B&quot; was used? If they don't, what is the latest node where that information can be found?&lt;/p&gt;&#xA;" OwnerUserId="29419" LastEditorUserId="29419" LastEditDate="2016-08-05T11:15:07.560" LastActivityDate="2016-09-12T07:31:33.153" Title="Can servers find out which wifi AP was used to access the network?" Tags="|ieee-802.11|packet-analysis|access-point|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33782" PostTypeId="2" ParentId="33780" CreationDate="2016-08-05T11:36:30.530" Score="1" Body="&lt;p&gt;It depends what is behind those access points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they are all on one flat Ethernet network then only the access points and switches will know where the client is (and the switches will only know which of their own switchports it is behind which may or may not represent a single AP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the are on different VLANs with seperate IP subnets and no NAT then you can work out from the IP address which access point the client is on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are NATs involved things get more complex still.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-08-05T13:49:22.050" LastActivityDate="2016-08-05T13:49:22.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33783" PostTypeId="2" ParentId="33197" CreationDate="2016-08-05T13:49:23.013" Score="8" Body="&lt;p&gt;As already mentioned in comments - DOCSIS cable modems don't talk to each other, they need CMTS for communication &amp;amp; provisioning system to make them work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are serious about playing with DOCSIS and have some money to invest in this you can build working lab these days relatively in-expensively.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;CMTS - search on Ebay or ask refurb hardware sellers, you are looking for something like Arris C3, Cisco uBR 7200-series (note it is not regular 7200, it must be uBR) or Motorola (BSR1000 or 2000, but I never used those).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Provisioning system, which is used to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;issue DHCP leases to CMs &amp;amp; CPEs behind your CMs&lt;/li&gt;&#xA;&lt;li&gt;generate and issue config file to CM&lt;/li&gt;&#xA;&lt;li&gt;provide other services such is time sync&lt;/li&gt;&#xA;&lt;li&gt;commercial ones have lots more bolted on top&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can build it from open source components. At the minimum you need DHCP, TFTP, ToD (Time of Day) and Syslog daemons and &lt;a href=&quot;http://docsis.sourceforge.net/&quot;&gt;this software&lt;/a&gt; to create your DOCSIS config files. Alternatively you could ask one of the vendors for trial (time and/or number of CM limited).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find (not very up-to-date, but still partially valid) list of vendors on &lt;a href=&quot;http://www.docsis.org/node/183&quot;&gt;docsis.org&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At last, but not least... DOCSIS is very popular and DOCSIS admins are very desired... just in case you don't know :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best of luck!&lt;/p&gt;&#xA;" OwnerUserId="3326" LastActivityDate="2016-08-05T13:49:23.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33784" PostTypeId="2" ParentId="33778" CreationDate="2016-08-05T14:12:46.453" Score="5" Body="&lt;p&gt;You didn't actually connect two router ports, you connected two switch ports. The router has a switch module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You created a layer-2 broadcast storm. Broadcast is an essential part of ethernet. When a broadcast comes into a switch port, a switch must send it to all the other ports. When you connected the two switch ports, it created a loop where the broadcast was both going out all the other ports, and coming back into the switch, causing it to need to be sent out all the other ports, and causing it to come back into the switch, forever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This caused the switch module to be completely swamped to the point that other traffic would be dropped or slowed so much that the switch module couldn't be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet headers don't have a TTL field like IP headers do, so there is no way to have the protocol itself break the loop. Layer-3 routing loops can happen, but they are somewhat self-limiting because of the TTL field, but they still cause major disruptions, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-05T14:12:46.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33785" PostTypeId="2" ParentId="24321" CreationDate="2016-08-05T15:33:11.433" Score="0" Body="&lt;p&gt;There are two aspects to speed, data rate (often called bandwidth though that is confusing) and latency. Both can have an impact on the time taken to complete actions (viewing webpagages, typing characters in a remote terminal, downloading files etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data rate is how much traffic the connection can carry per unit of time. Latency is how long it takes a packet of data to get from one end to the other. Normally we measure latency in the form of round trip time since measuring one-way latency is tricky and usually fairly irrelevent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a rule of thumb latency will dominate the performance for actions that only involve a small ammount of data while bandwidth will dominate the performance for actions that involve a large ammount of data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Latency can roughly speaking be divided down into processing delays, queueing delays and cable delays. Cable delays do increase with distance but the delay from the cable that forms your &quot;internet connection&quot; is likely to be small compared to delays further back in the network. Processing delays on some forms of DSL can be significant due to interleaving. Processing also tend to be higher on low-datarate links as often a complete packet must be received byfore it can be forwarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The achiveable data rate depends on the Characteristics of the cable. As a cable gets longer the signal integrity (for a given signal launch power) will get worse and so the achivable data rate will go down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some technologies (notablly modern DSL) are rate-adapative. They will tailor the charateristics of their signal to match the observed performance on the line. Other technologies use fixed modulation parameters and will start dropping large numbers of packets and then fail completely if the signal integrity is too poor.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-05T15:33:11.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33786" PostTypeId="2" ParentId="33144" CreationDate="2016-08-05T16:19:32.487" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What can possibly go wrong ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Lets say you have devices with ip 130.10.10.10 on both networks. Suppose 130.10.10.10 on network A sends a packet to 130.10.10.222.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet is delivered successfuly to 130.10.10.222 on network B which then generates a reply. But the reply is delievered to 130.10.10.10 on network B. Depending on what procotols are in use on the networks that could have &quot;interesting&quot; results.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-05T16:19:32.487" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33790" PostTypeId="2" ParentId="33699" CreationDate="2016-08-05T22:57:36.743" Score="0" Body="&lt;p&gt;Hy MiniMe,&#xA;Good question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general,&#xA;being the RFC the network reference,&#xA;I for sure trust what RFC says.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway RFC  states in page 54 in case of responce to a passive manual/automatic start event, the router start to listen for any incoming request from its peers and put its self in active state skipping the Connect state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This COULD be due to the fact that the &#xA;the router has to perform a PASSIVE connection with the peer, so it waits for an incoming request from the peer skipping the connect  state (in which it  tries to establish the tcp connection).&lt;/p&gt;&#xA;" OwnerUserId="29436" LastEditorUserId="29436" LastEditDate="2016-08-06T21:42:37.377" LastActivityDate="2016-08-06T21:42:37.377" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33791" PostTypeId="1" AcceptedAnswerId="33793" CreationDate="2016-08-06T01:17:00.197" Score="0" ViewCount="40" Body="&lt;p&gt;I was watching network traffic coming over my LAMP server today when I saw this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; Active Internet connections (w/o servers) Proto Recv-Q Send-Q Local&#xA;&amp;gt; Address           Foreign Address               State tcp        0    176&#xA;&amp;gt; raspberrypi:ssh         &amp;gt;MyMachineName&amp;lt;         ESTABLISHED tcp6      &#xA;&amp;gt; raspberrypi:http        protected.hyperfi:57894 SYN_RECV&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Usually this is where the IP shows up under &quot;Foreign Address&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone ever seen this before? What is protected??&lt;/p&gt;&#xA;" OwnerUserId="29438" LastActivityDate="2016-08-08T00:20:58.353" Title="IP address shows up as &quot;Protected&quot;" Tags="|ip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33792" PostTypeId="2" ParentId="33719" CreationDate="2016-08-06T01:40:22.570" Score="7" Body="&lt;p&gt;Terms like &quot;smart switch&quot; and &quot;managed switch&quot; are terms invented by vendors. As such the exact meaning may vary from vendor to vendor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general &quot;managed&quot; switches are aimed at large proffesionally managed networks where people are prepared to pay substantial money for advanced management features and/or perceived reliability. They will typicaly have a serial console port allowing recovery from misconfigurations with minimal downtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the other extreme &quot;unmanaged&quot; switches offer no management capability at all and are dirt cheap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;smart&quot; switches fill a middle ground. They have some management facilities and support VLANS but will often be lacking stuff compared to a conventional managed switch, for example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;They usually lack a serial console port. So if you screw up the configuration too badly or just forget the password your only option is a reset to factory defaults.&lt;/li&gt;&#xA;&lt;li&gt;Some of them have no ability to configure the VLAN for the management interface and may do strange things regarding the management port and VLANS (I've seen reports of some where the management IP can be reached from the native VLAN on any port).&lt;/li&gt;&#xA;&lt;li&gt;Some of them can only be configured by a web interface.&lt;/li&gt;&#xA;&lt;li&gt;Some of them can only be configured with a vendor-provided client application.&lt;/li&gt;&#xA;&lt;li&gt;They are unlikely to support features for automatically pushing configuration to multiple switches in a network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some vendors further divide their smart switches into multiple teirs, for example TP-link have their &quot;websmart/easysmart&quot; line which seem like total crap and their &quot;smart&quot; line which seems fairly decent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before buying any peice of networking gear I would suggest downloading and reading the manual. This will tell you whether it suffers from brain damage like no VLAN setting for the management port and whether it supports the features you need.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-06T01:40:22.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33793" PostTypeId="2" ParentId="33791" CreationDate="2016-08-06T02:08:47.507" Score="2" Body="&lt;p&gt;I would guess you are seeing the start of a reverse dns hostname. I would guess some numpty has set it to something like &lt;code&gt;protected.&amp;lt;companyname&amp;gt;.&amp;lt;tld&amp;gt;&lt;/code&gt; which has then been truncated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming you are using netstat you can use the -n option to show numeric addresses rather than attempting reverse dns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reverse DNS is sometimes useful but can be highly misleading. IP block owners can basically put whatever they like in there.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-08-08T00:20:58.353" LastActivityDate="2016-08-08T00:20:58.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33794" PostTypeId="1" AcceptedAnswerId="33796" CreationDate="2016-08-06T06:26:37.850" Score="1" ViewCount="1825" Body="&lt;p&gt;I have &lt;strong&gt;cisco WS-C3650-48TS&lt;/strong&gt; SW version &lt;strong&gt;03.03.05SE&lt;/strong&gt; as L3, i need to monitor the traffic on a trunk port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How much bandwidth its consuming?&lt;/p&gt;&#xA;" OwnerUserId="21915" LastActivityDate="2016-08-06T11:22:21.460" Title="how can i monitor traffic on particular port in 3650 L3 switch?" Tags="|cisco|switch|snmp|bandwidth|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33795" PostTypeId="2" ParentId="33794" CreationDate="2016-08-06T07:36:53.610" Score="0" Body="&lt;p&gt;In order to have a simple view of statistics in terms of pkt that are traversing your trunk port you can build a ACL with a pkt counter and put a filter on the IP or VLAN you are interested in order to count them&lt;/p&gt;&#xA;" OwnerUserId="29436" LastActivityDate="2016-08-06T07:36:53.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33796" PostTypeId="2" ParentId="33794" CreationDate="2016-08-06T08:31:09.160" Score="3" Body="&lt;p&gt;The show interface command will give you 5 minute input and output bandwidth&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch# show interfaces gigabitethernet3/0/2&#xA;GigabitEthernet3/0/2 is down, line protocol is down (notconnect)&#xA;  Hardware is Gigabit Ethernet, address is 2037.064d.4381 (bia 2037.064d.4381)&#xA;  MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Auto-duplex, Auto-speed, media type is 10/100/1000BaseTX&#xA;  input flow-control is off, output flow-control is unsupported&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;     Received 0 broadcasts (0 multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     0 packets output, 0 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 1 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want to create a graph of the bandwidth, use something like MRTG to set up regular polling of the interface traffic through SNMP.  MRTG will create a nice graph of the data i.e.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lePf0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lePf0.png&quot; alt=&quot;MRTG graph&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To enable PRTG, set up a Read-Only community string on the switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server community &amp;lt;your-community-string&amp;gt; ro&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then configure the device in PRTG using the following settings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP Address/DNS Name: IP address of switch&#xA;Sensor Management: Automatic device identification (standard, recommended)&#xA;&#xA;Credentials for SNMP Devices:&#xA;SNMP Version: 2c&#xA;Community String: &amp;lt;your-community-string&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are other options which allow you to look at the bandwidth of individual traffic flows on a port such as IP accounting and NetFlow, although these do not usually work properly on L3 switches as they rely on traffic being process switched.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-08-06T11:22:21.460" LastActivityDate="2016-08-06T11:22:21.460" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33798" PostTypeId="2" ParentId="32606" CreationDate="2016-08-06T08:56:51.977" Score="1" Body="&lt;p&gt;As I can understand from your typed text, you/customer want to advertise ibgp routes from his MPLS over eBGP.It is possible and you can do this via Inter-as option C solution 2 with controlled redistribution (or PBR to VPN solution).  &lt;/p&gt;&#xA;" OwnerUserId="8007" LastActivityDate="2016-08-06T08:56:51.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33799" PostTypeId="2" ParentId="33767" CreationDate="2016-08-06T09:02:16.897" Score="2" Body="&lt;p&gt;OSPF and ISIS use the maximum-paths command to specify the maximum number of equal cost paths the SPF algorithm will take into account.  By default this is set at 4, so by default up to 4 equal cost paths will be considered to each destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can view the maximum paths for each protocol using the &lt;strong&gt;show ip protocols&lt;/strong&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh ip protocols &#xA;*** IP Routing is NSF aware ***&#xA;&#xA;Routing Protocol is &quot;application&quot;&#xA;  Sending updates every 0 seconds&#xA;  Invalid after 0 seconds, hold down 0, flushed after 0&#xA;  Outgoing update filter list for all interfaces is not set&#xA;  Incoming update filter list for all interfaces is not set&#xA;  Maximum path: 32&#xA;  Routing for Networks:&#xA;  Routing Information Sources:&#xA;    Gateway         Distance      Last Update&#xA;  Distance: (default is 4)&#xA;&#xA;Routing Protocol is &quot;ospf 1&quot;&#xA;  Outgoing update filter list for all interfaces is not set&#xA;  Incoming update filter list for all interfaces is not set&#xA;  Router ID 1.1.1.1&#xA;  Number of areas in this router is 0. 0 normal 0 stub 0 nssa&#xA;  Maximum path: 4&#xA;  Routing for Networks:&#xA;  Routing Information Sources:&#xA;    Gateway         Distance      Last Update&#xA;  Distance: (default is 110)&#xA;&#xA;Routing Protocol is &quot;isis&quot;&#xA;  Outgoing update filter list for all interfaces is not set&#xA;  Incoming update filter list for all interfaces is not set&#xA;  Redistributing: isis&#xA;  Address Summarization:&#xA;    None&#xA;  Maximum path: 4&#xA;  Routing for Networks:&#xA;    GigabitEthernet0/1&#xA;  Routing Information Sources:&#xA;    Gateway         Distance      Last Update&#xA;  Distance: (default is 115)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-08-06T09:24:30.820" LastActivityDate="2016-08-06T09:24:30.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33800" PostTypeId="1" AcceptedAnswerId="33804" CreationDate="2016-08-06T14:32:08.450" Score="3" ViewCount="3347" Body="&lt;p&gt;I am having trouble routing between VRFs using BGP. In my lab there is a hub router with one spoke. I am using MP-BGP to extend VRFs between the two. I want to attach a firewall to the hub with a sub-interface in each VRF. I would like the firewall to run BGP to the hub and be the exchange point between VRFs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems so simple but I cant get it to work due to BGP loop prevention features. If I use iBGP the router drops routes from the firewall stating loop detected via CLUSTER_LIST (despite assigning unique router-ids and cluster-ids per VRF). If I use eBGP the router detects a loop via AS_PATH. I have gotten it to work by redistributing to an IGP and back, but that just seems silly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I reallllly want this to work with BGP between the firewall and the router. Any suggestions? If not, what would be the next best thing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;SPOKE&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;ip vrf red&#xA; rd 1:1&#xA; route-target export 1:1&#xA; route-target import 1:1&#xA;exit&#xA;&#xA;ip vrf blue&#xA; rd 2:2&#xA; route-target export 2:2&#xA; route-target import 2:2&#xA;exit&#xA;&#xA;interface GigabitEthernet1&#xA; description WAN&#xA; ip address 1.1.1.1 255.255.255.0&#xA;!&#xA;&#xA;interface loopback 1&#xA; ip vrf forwarding red&#xA; ip address 10.1.1.1 255.255.255.0&#xA;exit&#xA;&#xA;interface loopback 2&#xA; ip vrf forwarding blue&#xA; ip address 20.1.1.1 255.255.255.0&#xA;exit&#xA;&#xA;l3vpn encapsulation ip MPLS-INT&#xA; transport ipv4 source GigabitEthernet1&#xA;&#xA;route-map region permit 10&#xA; set ip next-hop encapsulate l3vpn MPLS-INT&#xA;&#xA; !&#xA;router bgp 65001&#xA; bgp router-id 1.1.1.1&#xA; bgp log-neighbor-changes&#xA; neighbor 1.1.1.2 remote-as 65001&#xA; neighbor 1.1.1.2 update-source GigabitEthernet1&#xA; !&#xA; address-family ipv4&#xA;  neighbor 1.1.1.2 activate&#xA; exit-address-family&#xA; !&#xA; address-family vpnv4&#xA;  neighbor 1.1.1.2 activate&#xA;  neighbor 1.1.1.2 send-community extended&#xA;  neighbor 1.1.1.2 route-map region in&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf red&#xA;   redistribute connected&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf blue&#xA;  redistribute connected&#xA; exit-address-family&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;HUB&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;ip vrf red&#xA; rd 1:1&#xA; route-target export 1:1&#xA; route-target import 1:1&#xA;exit&#xA;&#xA;ip vrf blue&#xA; rd 2:2&#xA; route-target export 2:2&#xA; route-target import 2:2&#xA;exit&#xA;&#xA;interface GigabitEthernet1&#xA; description WAN&#xA; ip address 1.1.1.2 255.255.255.0&#xA;!&#xA;&#xA;interface GigabitEthernet2.1&#xA; description FW VRF RED&#xA; encapsulation dot1Q 1&#xA; ip vrf forwarding red&#xA; ip address 10.2.2.1 255.255.255.252&#xA;!&#xA;&#xA;interface GigabitEthernet2.2&#xA; description FW VRF BLUE&#xA; encapsulation dot1Q 2&#xA; ip vrf forwarding blue&#xA; ip address 20.2.2.1 255.255.255.252&#xA;!&#xA;&#xA;!&#xA;l3vpn encapsulation ip MPLS-INT&#xA; transport ipv4 source GigabitEthernet1&#xA;&#xA;route-map region permit 10&#xA; set ip next-hop encapsulate l3vpn MPLS-INT&#xA;&#xA; !&#xA;router bgp 65001&#xA; bgp router-id 1.1.1.2&#xA; bgp log-neighbor-changes&#xA; neighbor rr peer-group&#xA; neighbor rr remote-as 65001&#xA; neighbor rr update-source GigabitEthernet1&#xA; neighbor 1.1.1.1 peer-group rr&#xA; !&#xA; address-family ipv4&#xA;  neighbor rr route-reflector-client&#xA;  neighbor 1.1.1.1 activate&#xA; exit-address-family&#xA; !&#xA; address-family vpnv4&#xA;  neighbor 1.1.1.1 activate&#xA;  neighbor rr send-community extended&#xA;  neighbor rr route-reflector-client&#xA;  neighbor rr route-map region in&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf red&#xA;   redistribute connected&#xA;   neighbor 10.2.2.2 remote-as 65001&#xA;   neighbor 10.2.2.2 update-source GigabitEthernet2.1&#xA;   neighbor 10.2.2.2 route-reflector-client&#xA;   neighbor 10.2.2.2 cluster-id 10.2.2.1&#xA;   bgp router-id 10.2.2.1&#xA; exit-address-family&#xA;&#xA; address-family ipv4 vrf blue&#xA;   redistribute connected&#xA;   neighbor 20.2.2.2 remote-as 65001&#xA;   neighbor 20.2.2.2 update-source GigabitEthernet2.2&#xA;   neighbor 20.2.2.2 route-reflector-client&#xA;   neighbor 20.2.2.2 cluster-id 20.2.2.1&#xA;   bgp router-id 20.2.2.1&#xA; exit-address-family&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;&quot;FIREWALL&quot; (really just another router)&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;&#xA;&#xA;interface GigabitEthernet2.1&#xA; description FW VRF RED&#xA; encapsulation dot1Q 1&#xA; ip address 10.2.2.2 255.255.255.252&#xA;!&#xA;&#xA;interface GigabitEthernet2.2&#xA; description FW VRF BLUE&#xA; encapsulation dot1Q 2&#xA; ip address 20.2.2.2 255.255.255.252&#xA;!&#xA;&#xA;router bgp 65001&#xA; neighbor 10.2.2.1 remote-as 65001&#xA; neighbor 10.2.2.1 route-reflector-client&#xA; neighbor 20.2.2.1 remote-as 65001&#xA; neighbor 20.2.2.1 route-reflector-client &#xA;exit&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="29441" LastEditorUserId="29441" LastEditDate="2016-08-06T15:45:46.350" LastActivityDate="2016-08-07T01:48:23.047" Title="BGP and Inter-VRF Routing" Tags="|cisco|bgp|vrf|mpls-vpn|vrf-lite|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33804" PostTypeId="2" ParentId="33800" CreationDate="2016-08-07T00:48:20.307" Score="3" Body="&lt;p&gt;Use the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;neighbor x.x.x.x allowas in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This tells the router not to discard prefixes with its own ASN in the path.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-08-07T01:48:23.047" LastActivityDate="2016-08-07T01:48:23.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33805" PostTypeId="1" AcceptedAnswerId="33830" CreationDate="2016-08-07T01:29:54.273" Score="1" ViewCount="78" Body="&lt;p&gt;This might be a silly question, but I am not really sure about how this works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you form Link Aggregation (or EtherChannel in Cisco terms), the traffic going through that logical port will be load-balanced based on the device setting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in Cisco switches the default will be souｒce mac address based. And you can change that setting in a way that the traffic will be distributed almost equally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, it's fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how about when the load-balance method is src ip and dst ip but the switch is NOT the server's/client's gateway?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if your NW is something like below,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Internet--FW--SW--SW--Servers/Clients&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the Link Aggregation is formed between the SWs but the default gateway is FW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, all SWs do is not routing but switching.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm wondering is whether ip-based load-balancing would properly work if the SWs are not doing routing because Layer 2 switching doesn't really require that devices read IP header as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know what would happen if ip-based load-balacing is configured in the above environment?&lt;/p&gt;&#xA;" OwnerUserId="29449" LastEditorUserId="8499" LastEditDate="2016-08-08T05:14:31.480" LastActivityDate="2016-08-08T05:14:31.480" Title="Link Aggregation and Balancing Methods" Tags="|switching|etherchannel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33807" PostTypeId="2" ParentId="24211" CreationDate="2016-08-07T03:02:29.913" Score="3" Body="&lt;p&gt;If peer &quot;B&quot; sends a request first to start a session then no STUN/TURN is required in your case because the request will be directly forward to peer &quot;A&quot; by DMZ server and it won't be blocked by NAT firewall.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;But if peer &quot;A&quot; wants to start the session and sends the request to peer &quot;B&quot; then request will be blocked because peer &quot;B&quot; is behind the NAT and there is no DMZ server available for peer &quot;B&quot; which can forward incoming request of peer &quot;A&quot; to peer &quot;B&quot;.For this TURN server will be required because it is symmetric NAT.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Learn more how STUN/TURN servers work: &lt;a href=&quot;https://andrewjprokop.wordpress.com/2014/07/21/understanding-webrtc-media-connections-ice-stun-and-turn/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding WEBRTC MEDIA CONNECTIONS — ICE, STUN, AND TURN&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="28180" LastEditorUserId="5807" LastEditDate="2017-03-04T03:50:38.323" LastActivityDate="2017-03-04T03:50:38.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33811" PostTypeId="2" ParentId="19423" CreationDate="2016-08-07T12:55:06.617" Score="0" Body="&lt;p&gt;There may be duplicate IP addresses in the network.  When you clear the arp cache, note down the MAC address in the ARP cache on SW2 which matches SW1's IP address, check you can SSH to SW1.  When it stops working, check the ARP cache again and see if the MAC address for SW1's IP address has changed, if it has then there are duplicate IP addresses in the network.  &lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-07T12:55:06.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33812" PostTypeId="1" AcceptedAnswerId="33817" CreationDate="2016-08-07T12:58:57.180" Score="2" ViewCount="567" Body="&lt;p&gt;Here are the filtering methods:&lt;br&gt;&#xA;1.filter-list&lt;br&gt;&#xA;2.distribute-list/prefix-list&lt;br&gt;&#xA;3.route-map  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco documentation is contradictory and I have come across various posts that contradict each other:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://ieoc.com/forums/p/15319/153796.aspx#153796&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ieoc.com/forums/p/15319/153796.aspx#153796&lt;/a&gt;  &amp;lt;--correct&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://blog.ine.com/2008/01/11/bgp-order-of-preference/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://blog.ine.com/2008/01/11/bgp-order-of-preference/&lt;/a&gt;  &amp;lt;--wrong&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5816-bgpfaq-5816.html#one&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5816-bgpfaq-5816.html#one&lt;/a&gt;&#xA;&amp;lt;--wrong as well , the above link quoted this page&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would like to test this myself but I can not figure out how to do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/o8V7o.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/o8V7o.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3qW5N.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3qW5N.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1647" LastEditorUserId="8499" LastEditDate="2016-08-08T05:20:44.683" LastActivityDate="2016-08-09T11:13:20.120" Title="How can I practically test the order of various BGP route filtering methods?" Tags="|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33813" PostTypeId="1" CreationDate="2016-08-07T15:36:31.460" Score="2" ViewCount="3023" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BprTC.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BprTC.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;I have a pair of Juniper routers each one having drops from ISP. We advertise same IP blocks from both the routers on WAN interface. Now on the Lan side, we have pair of HP core switch running IRF mode. What we would like to do is, &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Confiugre VRRP on the router to have common gateway&lt;/li&gt;&#xA;&lt;li&gt;Configure MCLAG on routers for active-active LAN connections&lt;/li&gt;&#xA;&lt;li&gt;Each router connects to each switch through LACP active-active mode.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now for any incoming traffic, it is active-active, traffic can reach any router and goes to any core switch and works. Question is,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How outgoing traffic from LAN works? IMO, VRRP is active-backup. So if the switch send the outgoing traffic to backup VRRP router since they are active-active link, will it directly go out via that router or it will go out to master VRRP router and go out to Internet?&lt;/li&gt;&#xA;&lt;li&gt;If so is there a way to configure the router to use both the link for outgoing or my understanding about VRRP is wrong and the current model works as active-active or outgoing traffic also?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="22114" LastEditorUserId="22114" LastEditDate="2016-08-07T15:50:52.007" LastActivityDate="2017-05-05T01:33:29.827" Title="MCLag active-active and VRRP" Tags="|routing|hp|ieee-802.1ax|juniper-mx|vrrp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33815" PostTypeId="2" ParentId="33812" CreationDate="2016-08-07T16:14:57.350" Score="0" Body="&lt;p&gt;Use the scientific method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create a filter type chart like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-------------------------&#xA;| X | A | B | C | D | E |&#xA;-------------------------&#xA;| A | X |   |   |   |   |&#xA;-------------------------&#xA;| B | X | X |   |   |   |&#xA;-------------------------&#xA;| C | X | X | X |   |   |&#xA;-------------------------&#xA;| D | X | X | X | X |   |&#xA;-------------------------&#xA;| E | X | X | X | X | X |&#xA;-------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Build a lab using BGP between two routers, and make sure it is&#xA;working and sharing prefixes. That is your control. Save the&#xA;configurations so that you can restore the control.&lt;/li&gt;&#xA;&lt;li&gt;Add &lt;em&gt;one&lt;/em&gt; filter type (A), and observe the results.&lt;/li&gt;&#xA;&lt;li&gt;Add &lt;em&gt;one&lt;/em&gt; more filter type (B), and observe the results. Note which&#xA;appears to have precedence. Mark the chart with the results at the intersection of A and B.&lt;/li&gt;&#xA;&lt;li&gt;Restore your control configuration.&lt;/li&gt;&#xA;&lt;li&gt;Repeat Step 2 (filter type A).&lt;/li&gt;&#xA;&lt;li&gt;Repeat Step 3 with another filter type (C). Mark the chart with the results at the intersection of A and C.&lt;/li&gt;&#xA;&lt;li&gt;Restore your control configuration.&lt;/li&gt;&#xA;&lt;li&gt;Repeat Step 2 (filter type A).&lt;/li&gt;&#xA;&lt;li&gt;Repeat Step 3 with another filter type (D). Mark the chart with the results at the intersection of A and D.&lt;/li&gt;&#xA;&lt;li&gt;Restore your control configuration.&lt;/li&gt;&#xA;&lt;li&gt;Repeat Step 2 (filter type A).&lt;/li&gt;&#xA;&lt;li&gt;Repeat Step 3 with another filter type (E). Mark the chart with the results at the intersection of A and E.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;At this point, you will know how filter type A relates to each of the other filter types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Restore your control configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeat Steps 2 and 3 for filter type B compared to type C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Restore your control configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeat Steps 2 and 3 for filter type B compared to type D.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Restore your control configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeat Steps 2 and 3 for filter type B compared to type E.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Restore your control configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeat Steps 2 and 3 for filter type C compared to type D.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Restore your control configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeat Steps 2 and 3 for filter type C compared to type E.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Restore your control configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeat Steps 2 and 3 for filter type D compared to type E.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the end, you will know which filter types have precedence over the other filter types.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Don't confuse the Distribute List with the Prefix List or Route Map Redistribution.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-07T16:14:57.350" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="33816" PostTypeId="2" ParentId="33813" CreationDate="2016-08-07T16:29:49.813" Score="0" Body="&lt;p&gt;VRRP is active/passive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VRRP works on a LAN between a router and hosts on the LAN, and it advertises virtual IP and MAC addresses to the hosts on the LAN. The routers trade messages on the host LAN to share their priority with the other router(s). The router with the highest priority is the active router on the host LAN. If the other router(s) can't contact the active router on the host LAN, the remaining router with the highest priority will take over. This takes some time, during which traffic will be lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe your switches are layer-3 switches, and by using IRF you can make them look like a single layer-3 switch which can be the gateway for all the user VLANs, obviating the need for VRRP. The links between the virtual layer-3 switch and the routers should be routed links, and a routing protocol will failover much, much, &lt;em&gt;much&lt;/em&gt; faster than VRRP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-07T16:29:49.813" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33817" PostTypeId="2" ParentId="33812" CreationDate="2016-08-07T18:25:00.967" Score="1" Body="&lt;p&gt;I think that the right way to do is to apply all the methods at the same time.&#xA;and to use increasingly larger masks for the input route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of the above methods has a prefix or ACL with stats that can show you the hits. &#xA;So on the contrary instead of applying each method as Ron suggested above I would rather apply all the methods as indicated and change the network mask for let's say 1.1.1.1 from 24 to 16 to 8 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;filter-list&lt;/strong&gt;    --will permit 1.0.0.0/8 (make this route come from another AS and filter it by AS, deny updates from that AS)&lt;br&gt;&#xA;&lt;strong&gt;prefix-list&lt;/strong&gt;    --will permit 1.1.0.0/16&lt;br&gt;&#xA;&lt;strong&gt;route-map&lt;/strong&gt;       --will permit 1.1.1.0/24  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and so on&lt;br&gt;&#xA;So by changing the mask of the same route I should be able to test the above. &#xA;Ron just described an elimination process but does not give a practical method to check the results  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: I tested the above and it worked. Use debugging to see the updates. You will see messages indicating what exactly denied each route! no need for matrix testing as suggested below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; router bgp 200&#xA; bgp log-neighbor-changes&#xA; redistribute connected&#xA; neighbor 10.10.10.1 remote-as 100&#xA; neighbor 10.10.10.1 prefix-list /16 in&#xA; neighbor 10.10.10.1 route-map /24 in&#xA; neighbor 10.10.10.1 filter-list 100 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and the prefix list and filter lists used to test the above &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip as-path access-list 100 deny _300_&#xA;ip as-path access-list 100 permit .*&#xA;&#xA;ip prefix-list /16 seq 5 permit 1.1.0.0/16 le 24&#xA;!&#xA;ip prefix-list /24 seq 5 permit 1.1.1.0/24&#xA;!&#xA;ip prefix-list /8 seq 5 permit 1.0.0.0/8 le 24&#xA;!&#xA;route-map /16 permit 10&#xA; match ip address prefix-list /16&#xA;!&#xA;route-map /24 permit 10&#xA; match ip address prefix-list /24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Use redistribute connected and loopbacks on this topology:&lt;br&gt;&#xA;R3---R1---R2&lt;br&gt;&#xA;(AS300): R3's L0 is 1.0.0.0&lt;br&gt;&#xA;(AS100): R1'2 L0 is 1.1.0.0 and L1 is 1.1.1.0&lt;br&gt;&#xA;use 10.10.10.0 and 10.10.20.0 to interconnect the routers. They will be blocked by the filters&lt;/p&gt;&#xA;" OwnerUserId="1647" LastEditorUserId="1647" LastEditDate="2016-08-09T11:13:20.120" LastActivityDate="2016-08-09T11:13:20.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33822" PostTypeId="1" AcceptedAnswerId="33824" CreationDate="2016-08-07T23:54:34.180" Score="3" ViewCount="520" Body="&lt;p&gt;Can I assign two global unicast address to the same interface, one obtained via stateful addressing (DHCPv6) and the other one via SLAAC (eui-64)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the RFC-4862:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Both stateless address autoconfiguration and DHCPv6 may be used&#xA;  simultaneously.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;But, this means on the same machine, or on the same network?&lt;/p&gt;&#xA;" OwnerUserId="16009" LastEditorUserId="8499" LastEditDate="2018-12-26T05:10:33.687" LastActivityDate="2018-12-26T05:10:33.687" Title="Two IPv6 global unicast addresses on the same interface (stateless and stateful)" Tags="|ipv6|protocol-theory|ip-address|rfc|dhcpv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33823" PostTypeId="1" AcceptedAnswerId="33826" CreationDate="2016-08-08T00:08:13.143" Score="1" ViewCount="446" Body="&lt;p&gt;We studied that the beauty of internet protocol suite layers is that each layer is responsible for a piece of the communication process. These layers provide services to adjacent layers and operate independently (theoretically), so upper layers are not (should not be) affected by lower layers details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when it comes to MTU/MSS I'm a bit confused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The theoretical maximum size of an IP packet is 65535 bytes, however in order to avoid fragmentation, packets are sent with size less than MTU. In this case a L3 field (IP packet size) is dependent on L1/L2 field (MTU).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same applies to MSS (a L4 field) which is actually derived from the MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact that some characteristics of upper layers strongly depend on lower layers details, does this violate the protocol layers indenpendence in some way?&lt;/p&gt;&#xA;" OwnerUserId="27712" LastActivityDate="2016-08-10T05:40:32.917" Title="Do MSS/MTU violate the protocol stack layers independence?" Tags="|tcp|ip|protocol-theory|udp|mtu|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33824" PostTypeId="2" ParentId="33822" CreationDate="2016-08-08T00:10:33.630" Score="3" Body="&lt;p&gt;Theoretically, you can assign any number of IPv6 addresses to a single interface. Practically, each OS has a limit, but the limit is far more than two. Each IPv6 interface will normally have a link-local, and a global address assigned, and you can assign other global or ULA addresses, in the same or different networks via combinations of stateful and stateless configurations.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-08T05:18:17.123" LastActivityDate="2016-08-08T05:18:17.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33825" PostTypeId="1" CreationDate="2016-08-08T00:20:37.467" Score="5" ViewCount="670" Body="&lt;p&gt;With anycast, it would be possible to have the same IP address at multiple locations in the world, without the need of a proxy or VPN that forwards the packets to its final destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you would just use IP spoofing to change the source IP address to for example  6.7.8.9, normally you would not be able to just receive the response packets for this IP address, as the Border Gateway Protocol determines a different path back for the response packet that you normally won't be able to intercept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does anycast do so you can reliably receive IP packets meant for this particular IP address? Since the shortest paths BGP relies on can change, which mechanism ensures that when you send a request at location A that has IP address 6.7.8.9, you will receive the entire response back to location A and you won't receive a response with also a few packets delivered at location B that has IP address 6.7.8.9 and another few packets delivered at location C that also has IP address 6.7.8.9?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For DNS it might not matter, but Anycast is also used by CloudFlare for the content delivery network, which would be HTTP(S) over TCP and not just UDP Packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How about this scenario: Server A and B have the same IP address with anycast. Server B connects to an external server that is very close to server A and very far away from server B, since server A is closer, the response will be routed back to server A, isn't it possible to always route this type of requests back to server B, since server B initiated the connection to the external server? &lt;/p&gt;&#xA;" OwnerUserId="29463" LastEditorUserId="8499" LastEditDate="2020-12-19T20:26:26.610" LastActivityDate="2020-12-19T20:26:26.610" Title="How does anycast ensure reliable delivery of IP packets for the same IP address on different locations?" Tags="|routing|ip|bgp|internet|anycast|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33826" PostTypeId="2" ParentId="33823" CreationDate="2016-08-08T00:29:09.180" Score="5" Body="&lt;p&gt;Protocol layer independence is like political or economic philosophy -- sounds good on paper, but hard to put into practice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To the network layer, fragmentation at lower levels is invisible.  We avoid IP fragmentation because of hardware limitations (takes too much processing to reassemble), not for any protocol reason.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-08T00:29:09.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33827" PostTypeId="2" ParentId="33825" CreationDate="2016-08-08T00:36:21.747" Score="5" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;...which mechanism ensures that when you send a request at location A&#xA;that has IP address 6.7.8.9, you won't receive a response with also a&#xA;few packets delivered at location B that has IP address 6.7.8.9 and&#xA;another few packets delivered at location C that also has IP address&#xA;6.7.8.9?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;That's really the point of anycast. When you send something to an anycast IP address, the routing protocol will route the traffic to the nearest (according to the routing protocol) network for that address. If there is a problem where a link to one of the networks goes down, the traffic will automatically be rerouted to the next nearest site. You, as the sender, don't care which one gets the traffic. That's why it is so useful for things like DNS and NTP.&lt;/p&gt;&#xA;&lt;p&gt;It's not like an individual can just start advertising a network on the public Internet. Someone advertising a network on the public Internet better own that network. If you have a BGP relationship with ISP(s), they will find out if you are advertising a network you don't own, and you will be summarily cut off from BGP peering with the ISP(s).&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Anycast is also used by CloudFlare for the content delivery network,&#xA;which would be HTTP(S) over TCP and not just UDP Packets. If you are&#xA;in middle of uploading some data and the data get scattered over&#xA;different servers, would the only option be retransmitting it and&#xA;hoping it goes to the right server next time or does anycast have an&#xA;option to prevent this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;TCP cannot get scattered over different servers. TCP is a connection-oriented protocol, and it creates a connection. If a link to a server to which you have a connection goes down, you would need to create a new connection to the next server in line. Anycast is nothing more than using the routing protocol to get the traffic to the nearest network with that network address.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;If anycast is used and if the path to server A is the shortest path&#xA;for one fraction of a second and then the path to server B is the&#xA;shortest path for another fraction of a second and then the path to A&#xA;is the shortest again for another fraction of a second, etc. it would&#xA;get scattered over different servers. It takes several seconds before&#xA;it goes to the timeout state and TCP would require several&#xA;retransmissions attempts to be made before it goes to timeout.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;That would be a serious network problem if the routing changes that often, especially on the Internet. BGP will notice flapping, and it will penalize the flapping link, and the link will get dropped from routing updates. You would be hard-pressed to find what you fear in the real world. ISPs take stability very seriously, and they will block partnerships which display instability.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;How about this scenario: Server A and B have the same IP address with&#xA;anycast. Server B connects to an external server that is very close to&#xA;server A and very far away from server B, since server A is closer,&#xA;the response will be routed back to server A, isn't it possible to&#xA;always route this type of requests back to server B, since server B&#xA;initiated the connection to the external server?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You are really trying to make this a lot more complicated than it is. You don't initiate a connection from an anycast address to any old address on the Internet. Anycast addresses are destination addresses. If a host with an anycast address needs to contact a different host on the Internet, it uses a non-anycast address, either with a secondary address on the interface, or, more likely, a different interface. Don't confuse the anycast address with the host itself.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Seriously, there are some very, very smart people who do nothing all day but think about this sort of thing. RFCs must be peer approved before they are released as proposed. If nobody has any real objections, they are promoted to RFCs. The whole world has these under a microscope from the very inception of the idea, through, and after the release of the RFCs. If there really was a flaw in anycast, it would have been discovered, and solutions proposed, years ago.&lt;/p&gt;&#xA;&lt;p&gt;There are multiple RFCs for anycast: &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1546&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1546, Host Anycasting Service&lt;/a&gt; (November 1993), &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4786&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4786, Operation of Anycast Services&lt;/a&gt; (December 2006), and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7094&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7094 , Architectural Considerations of IP Anycast&lt;/a&gt; (January 2014). These RFCs will explain how Anycast works.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2018-11-04T21:06:19.330" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="33828" PostTypeId="1" AcceptedAnswerId="33829" CreationDate="2016-08-08T03:16:59.643" Score="1" ViewCount="49" Body="&lt;p&gt;I am doing research on SDN (Software Defined Networks), I do not understand the&#xA;concepts of this question&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;the load balancer shall have the ability to serve traffic over a static IP address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand the meaning of Load balancing refers to efficiently distributing incoming network traffic across a group of backend servers, also known as a server farm or server pool and the Static IP which IP address, it does not change. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I can't interpret or understand the above question and its concepts in SDN network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone would be able to explain to me?&lt;/p&gt;&#xA;" OwnerUserId="29468" LastEditorUserId="8499" LastEditDate="2016-08-08T03:32:26.343" LastActivityDate="2016-08-08T03:42:00.297" Title="What does the load balancer shall have the ability to serve traffic over a static IP address mean?" Tags="|ip|network-core|sdn|openflow|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33829" PostTypeId="2" ParentId="33828" CreationDate="2016-08-08T03:42:00.297" Score="1" Body="&lt;p&gt;There are applications and appliances which can perform load balancing as you described, but it may be for resources other than servers. The load balancer will have a fixed, known IP address, and that is the address which hosts will use to access a resource on the other side of the load balancer. The requesting host will really have no idea which resource behind the load balancer is actually used. The load balancer will maintain session and state for the the duration of each connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is true, whether or not SDN is used, because the destination of host traffic to and from the resource is a single device with a single IP address. From the perspective of the network, all the hosts are connecting to a single device.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-08T03:42:00.297" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33830" PostTypeId="2" ParentId="33805" CreationDate="2016-08-08T05:12:00.480" Score="0" Body="&lt;p&gt;Many Cisco switches can look at higher layer data, including IP addresses, under certain circumstances, and this is one of them. Other circumstances are for things like DHCP snooping, ACLs (e.g. QoS marking based on IP source/destination addresses and/or source/destination TCP or UDP ports), IGMP snooping, IP Source Guard, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other vendors may, or may not, have similar switch features.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-08T05:12:00.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33831" PostTypeId="1" AcceptedAnswerId="33838" CreationDate="2016-08-08T06:49:02.240" Score="2" ViewCount="17165" Body="&lt;p&gt;Is there a way to detect unmanaged switches that are connected on access ports?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a spanning tree trunking managed network I look at bpdu errors on ports which usually indicate an unmanaged switch as a PC should not sent these.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also look at logs that indicate that a switch is running low on resources as a loops can overload the CPU if it's not detected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know of any other or better ways?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am primarily interested in solutions that work with Cisco and Juniper but a vendor agnostic approach would be also welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am asking as access ports use two vlans (data and voice) and any frames sent through unmanaged switches lose the voice vlan tag which causes problems with the phones.&lt;/p&gt;&#xA;" OwnerUserId="24586" LastEditorUserId="509" LastEditDate="2016-08-08T07:45:00.653" LastActivityDate="2016-08-08T08:14:23.777" Title="How to detect loops created by unmanaged switches?" Tags="|cisco|switch|juniper|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33834" PostTypeId="2" ParentId="28007" CreationDate="2016-08-08T07:43:26.513" Score="2" Body="&lt;p&gt;In circuit switching, resources remain allocated during the full length of a communication, after a circuit is established and until the circuit is terminated and the allocated resources are freed. Resources remain allocated even if no data is flowing on a circuit, hereby wasting link capacity when a circuit does not carry as much traffic as the allocation permits. This is a major issue since frequencies (in FDM) or time slots (in TDM) are available in finite quantity on each link, and establishing a circuit consumes one of these frequencies or slots on each link of the circuit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More detailed information: &lt;a href=&quot;https://web.archive.org/web/20180622193630/http://www.cs.virginia.edu:80/~mngroup/projects/mpls/documents/thesis/node8.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://web.archive.org/web/20180622193630/http://www.cs.virginia.edu:80/~mngroup/projects/mpls/documents/thesis/node8.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="26940" LastEditorUserId="55708" LastEditDate="2019-03-04T20:21:09.257" LastActivityDate="2019-03-04T20:21:09.257" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="33835" PostTypeId="2" ParentId="33831" CreationDate="2016-08-08T07:44:43.277" Score="3" Body="&lt;p&gt;Typically, an unmanaged switch wouldn't send BPDU's, since it won't support spanning-tree. So you can only see your own BPDU's coming back to you on another port then. If you're running spanning-tree, you can use a BPDU guard on Cisco to stop the loop by shutting down the interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA;  spanning-tree bpduguard enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Juniper:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set rstp bpdu-block-on-edge interface ge-0/0/0.0 edge&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another way to monitor and prevent them is by implementing storm control, which can help you to detect and stop broadcast, multicast and unknown unicast floods.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both Cisco and Juniper support this. On Cisco, you can use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA;  storm-control broadcast level 0.01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The level here indicates the percentage of the total interface bandwidth which can be used for broadcast/multicast/unknown unicast traffic. You can then set an action on what happens when this level is exceeded:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;storm-control action shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To shut the port. Or,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;storm-control action trap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To send a SNMP trap (see below for more about this).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Juniper you can use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set ethernet-switching-options storm-control action-shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Juniper, the command is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set ethernet-switching-options storm-control interface xe-0/0/0 bandwidth 1000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The rate is in Kbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to be more proactive, you can consider configuring SNMP traps for spanning-tree and storm control events. Your switches can then send trap messages to a central SNMP trap server when a loop occurs.This SNMP trap server can then send you an alert (via mail, SMS, IRC, or whatever you have in place). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco you can configure SNMP traps like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server enable traps port-security&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Juniper:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set snmp trap-group GROUPNAME link&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-08-08T07:44:43.277" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33838" PostTypeId="2" ParentId="33831" CreationDate="2016-08-08T08:14:23.777" Score="8" Body="&lt;p&gt;&lt;strong&gt;Preventing Unmanaged Switches and Loops:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best solution would be to block unmanaged switches entirely, except those that you explicitly allow. This can be done by enabling bpduguard on access ports, which would disable any port that receives a bpdu packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CISCO: Switch(config-if)#spanning-tree bpduguard enable&#xA;JUNIPER: user@switch# set ethernet-switching-options bpdu-block interface ge-0/0/0.0 shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If there are unmanaged switches on your network that you would like to keep but protect STP and prevent loops you could enable a feature called root guard. This would allow that port to still receive bpdu packets, but it would not forward those that try to alter STP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CISCO: Switch(config-if)# spanning-tree guard root&#xA;JUNIPER: user@switch# set protocols rstp interface ge-0/0/7 no-root-port&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Limit the number of MAC addresses or whitelist MAC addresses on switch ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CISCO: switch(config-if)# switchport port-security maximum 2&#xA;     Switch(config-if)# switchport port-security mac-address 0000.000.000.0000&#xA;&#xA;JUNIPER: user@switch# set interface ge-0/0/1 mac-limit 10&#xA;user@switch# set interface ge–0/0/2 allowed-mac 00:00:00:00:00:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Detecting Unmanaged Switches:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Method 1: View the MAC address table, if you see multiple machines connecting on a single port, that is a pretty good indication that their is a switch connected to that port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Method 2: Look for ports running STP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch# show spanning-tree vlan 1-4094 | inc STP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Method 3: Using Cisco Debug to see which ports are receiving bpdu's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CISCO: Switch# debug spanning-tree bpdu receive&#xA;JUNIPER: user@switch&amp;gt; show spanning-tree statistics interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14613" LastActivityDate="2016-08-08T08:14:23.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33840" PostTypeId="2" ParentId="7836" CreationDate="2016-08-08T10:43:36.460" Score="2" Body="&lt;p&gt;CEF-MIB wasn't added to the cisco MIB until iOS relase 12.2(31)SB so you will need that version or higher before you can alert on CEF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However it doesn't look like CEF-MIB ever made it to the 2600 series platform, at least as of 12.3(6f). I also looked through various iOS images for the 2600 series and could not find CEF-MIB. Needless to say without the needed OIDs present, you will not be able to alert specifically for CEF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MIB Instance Identifiers for CEF:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;cefResourceFailureNotifEnable.0 -i 1&lt;/li&gt;&#xA;&lt;li&gt;cefPeerStateChangeNotifEnable.0 -i 1&lt;/li&gt;&#xA;&lt;li&gt;cefPeerFIBStateChangeNotifEnable.0 -i 1&lt;/li&gt;&#xA;&lt;li&gt;cefInconsistencyNotifEnable.0 -i 1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You can check for CEF instance identifiers with the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# show snmp mib | inc cef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sources:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/sbcefmib.html#wp1072297&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2sb/feature/guide/sbcefmib.html#wp1072297&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find specific MIB information on your device and available images, you can use Cisco's MIB Locator tool to see if CEF-MIB is available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/servlet/index&quot; rel=&quot;nofollow&quot;&gt;http://tools.cisco.com/ITDIT/MIBS/servlet/index&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14613" LastEditorUserId="8499" LastEditDate="2016-08-08T14:00:27.813" LastActivityDate="2016-08-08T14:00:27.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33841" PostTypeId="1" CreationDate="2016-08-08T12:08:23.367" Score="1" ViewCount="1963" Body="&lt;p&gt;I'm currently working with Alcatel OmniSwitch 6250 switches and I was asked to find a blocking method so that an access point can only be plugged on one port of the 24 available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked at the &quot;CLI Reference Guide&quot; and found a &quot;port-security&quot; command that could have done the trick but doesn't match with what I need to achieve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know another method to do what I'm looking for ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S : Why can't I say &quot;Hi&quot; or &quot;Hello&quot; ? It keeps getting erased when I send the message.&lt;/p&gt;&#xA;" OwnerUserId="29481" LastActivityDate="2018-07-26T06:40:27.903" Title="Alcatel OS6250 - How to allow devices on only one port" Tags="|port-security|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33842" PostTypeId="2" ParentId="33841" CreationDate="2016-08-08T12:25:01.310" Score="1" Body="&lt;p&gt;If you are not using any Network Management Systems that can support things like Policies or using 802.1x with a NAC, I think you are only going to be able to use port security and lock it by source MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically what you want to do is, tell the switch that on Port X, only devices with a MAC source of X is allowed to use the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configures a single authorized source MAC addre&#xA;ss for a port that belongs to a specified VLAN.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;port-security slot/port mac mac_address [vlan vlan_i]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You might want to look at the action that is taken when the port detects a MAC address that is not authorized so you can tell the switch to disable the port or simply alert only, so that it can sent a SNMP trap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please be mindful that this isn't 100% secure as any user with technical know-how, will be able to change their MAC address to the one specified and still get access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively what you could also do, if you are using a specific VLAN for the access points, disable any form of DHCP for this VLAN and statically assign the IP addresses to your access points. And if a user does try to get on that particalular port, without DHCP they will be stuck. Unless, of course they are clever enough to know whatIP range to assign themselves, including gateway, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-08-08T12:25:01.310" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33843" PostTypeId="2" ParentId="29933" CreationDate="2016-08-08T12:46:24.500" Score="0" Body="&lt;p&gt;Thanks Ron and JFL. I decided to use a Windows Server instead since it is a test environment.&#xA;First I installed the role &quot;Network Policy and Access Service&quot; and enabled NAT. I then redirect required traffic (HTTPS) to the edge Server in my test environment. I do appreciate your help though. If anyone needs more clarification do let me know.&lt;/p&gt;&#xA;" OwnerUserId="20403" LastActivityDate="2016-08-08T12:46:24.500" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33844" PostTypeId="2" ParentId="20282" CreationDate="2016-08-08T14:43:09.690" Score="2" Body="&lt;p&gt;As others have stated there is not a need to configure any sub-interfaces on the SonicWALL. I am assuming your modem is already in bridge mode since you have a public IP address configured on the SonicWALL Internet facing interface, if this is not so this needs to be done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is nothing you need to do to announce those IPs from the SonicWALL because in bridge mode the SonicWALL is acting as an authoritative device of sort for them with your modem acting as the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing that needs configured is a NAT policy mapping the desired public IP address to desired private IP address. The easiest way to do this is via the public server wizard which can be located on the top right corner of the web interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Step 1: Launch Wizards&#xA;Step 2: Select &quot;Public Server Wizard&quot;&#xA;Step 3: Specify Server Type and what ports you would like forwarded.&#xA;Step 4: Specify the private IP address of the server, and a friendly name to help you identify it in the ruleset.&#xA;Step 5: Specify the Public IP address you would like to use.&#xA;Step 6: Review the summary to ensure everything is correct, and apply your changes!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you need to make changes down the line, you can see your NAT policy under Network &gt; NAT Policies&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should have no operational impact, however with any change you should exercise discretion and play it safe by making the change within a downtime window to minimize any potential user impact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://documents.software.dell.com/sonicos/5.9/administration-guide/wizards/providing-public-access-to-an-internal-server/wizards-public-server-wizard?ParentProduct=850&quot; rel=&quot;nofollow&quot;&gt;http://documents.software.dell.com/sonicos/5.9/administration-guide/wizards/providing-public-access-to-an-internal-server/wizards-public-server-wizard?ParentProduct=850&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14613" LastActivityDate="2016-08-08T14:43:09.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33846" PostTypeId="1" CreationDate="2016-08-08T20:37:47.973" Score="1" ViewCount="1068" Body="&lt;p&gt;Hi guys I am trying to get ping from a inside host to outside host, i have posted my topology below, can someone please provide the correct configuration so i can do this? thank you. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JEWUJ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JEWUJ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27334" LastEditorDisplayName="user36472" LastEditDate="2018-02-14T16:38:11.203" LastActivityDate="2018-02-14T16:38:11.203" Title="Inside to outside firewall ping" Tags="|cisco|cisco-asa|firewall|cisco-commands|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33847" PostTypeId="2" ParentId="33846" CreationDate="2016-08-08T20:55:09.883" Score="3" Body="&lt;p&gt;Rather than configuring an ACL, you could just add ICMP to the default inspection class. I can't remember the exact name, but in global configuration there will be a default policy map called something like default inspection. This default inspection policy calls a class map that includes all the protocols that are inspected by default. You need to add ICMP into that class.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It'll go something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map &amp;lt;policy_name&amp;gt;&#xA;  class-map &amp;lt;class_name&amp;gt;&#xA;    inspect icmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29498" LastActivityDate="2016-08-08T20:55:09.883" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33848" PostTypeId="2" ParentId="33846" CreationDate="2016-08-08T20:57:02.940" Score="0" Body="&lt;p&gt;If I remember correctly:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list &amp;lt;acl_name&amp;gt; extended permit &amp;lt;protocol&amp;gt; &amp;lt;source&amp;gt; &amp;lt;destination&amp;gt; &amp;lt;port&amp;gt;&#xA;&#xA;access-group &amp;lt;acl_name&amp;gt; &amp;lt;inbound/outbound&amp;gt; &amp;lt;interface&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should be able to get the rest by yourself though... Cisco has some good resources you should read up on. Configuration guides and such&lt;/p&gt;&#xA;" OwnerUserId="18743" LastActivityDate="2016-08-08T20:57:02.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33851" PostTypeId="1" AcceptedAnswerId="33852" CreationDate="2016-08-08T22:36:54.643" Score="1" ViewCount="10855" Body="&lt;p&gt;Does following scenario work? We have single mode fiber running between two building, but we have MMF patchcord connected to SPF (SFP-10GBase-SR). &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[SPF]---MMF----[=======SMF======]----MMF---[SPF]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am seeing my interface is flapping but just wanted to make sure it whether it because of mixing fiber mode or something else. &lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2016-08-08T22:51:29.627" LastActivityDate="2019-10-29T20:25:35.357" Title="Fiber cable mixing single mode with multi mode" Tags="|cisco|switch|fiber|cable|layer1|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33852" PostTypeId="2" ParentId="33851" CreationDate="2016-08-08T22:43:02.503" Score="6" Body="&lt;p&gt;Yes, this absolutely is a problem. Don't ever mix different types of cabling. Multimode has a 50 or 62.5 micron core diameter, while single mode fiber typically has a 9 micron core. If you connect two fibers with different core diameters, you'll lose a &lt;em&gt;lot&lt;/em&gt; of the light going through the connector, resulting in a link flapping or being down.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-08-08T22:43:02.503" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33853" PostTypeId="2" ParentId="33851" CreationDate="2016-08-08T23:15:27.493" Score="2" Body="&lt;p&gt;Going from a multimode fiber or a lightsource designed for multimode fiber into single mode fiber will result in a very high loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to replace your patch cords with single mode ones and your transcievers with LR ones.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-08T23:15:27.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33857" PostTypeId="1" AcceptedAnswerId="33858" CreationDate="2016-08-09T02:09:35.273" Score="1" ViewCount="1726" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ikwGQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ikwGQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have above scenario where currently we have only single link with &lt;code&gt;ISP ROUTER1&lt;/code&gt; but soon we are planning to have second link on same BGP router but ISP side it will comes from &lt;code&gt;ISP ROUTER2&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I heard its recommended to configure BGP with loopback source but i don't know how does that fit in DUAL router scenario. This is what we have currently configured in my router. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 30000&#xA; bgp log-neighbor-changes&#xA; network xx.xx.xx.xx mask 255.255.255.0&#xA; timers bgp 10 30&#xA; redistribute static route-map RTBH&#xA; neighbor 66.xx.xx.65 remote-as 10000&#xA; neighbor 66.xx.xx.65 description ***** ISP-ROUTER1 *****&#xA; neighbor 66.xx.xx.65 send-community&#xA; neighbor 66.xx.xx.65 weight 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-08-09T13:26:50.057" Title="BGP Dual link with single ISP two different router" Tags="|cisco|routing|bgp|isp|dual-homed|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33858" PostTypeId="2" ParentId="33857" CreationDate="2016-08-09T02:16:13.167" Score="4" Body="&lt;p&gt;You want to configure iBGP with loopback sources because you will probably have multiple ways for traffic to get into the router, and the loopback never goes down. That means that the router can keep sending and receiving updates. Also, iBGP requires a full mesh, and an interface or link going down could break that unless you have it source from a loopback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With eBGP it is a little different. You normally want to configure eBGP on the connecting interface so that BGP does notice when the link goes down. Also, eBGP can't use a different interface unless you configure &lt;code&gt;ebgp multihop&lt;/code&gt;. Your ISP may not even want you to do that because they don't want BGP updates flowing around inside its network to get to the other router. Likely, your ISP is not configuring that way, and if the interface is down on the ISP router, you couldn't get to it for updates, anyway.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-09T02:16:13.167" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33859" PostTypeId="1" AcceptedAnswerId="33860" CreationDate="2016-08-09T06:06:58.583" Score="3" ViewCount="101" Body="&lt;p&gt;I have the following topology. The notebook computer has to access the internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In what case should R3 (as the core router &amp;amp; default gateway for the internal network) having iBPG configured or having routes redistributed via OSPF to it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or if there are any better solutions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sMubr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sMubr.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10711" LastActivityDate="2016-08-11T14:19:07.533" Title="In what case should the core router having iBPG configured or having routes redistributed via OSPF to it?" Tags="|bgp|ospf|redistribution|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33860" PostTypeId="2" ParentId="33859" CreationDate="2016-08-09T06:29:24.437" Score="5" Body="&lt;p&gt;First, does R3 support BGP and does it have enough RAM to support all the routes on R1 and R2?  If not, then BGP isn't an option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, do R1 and R2 receive a full Internet routing table?  If so, then redistributing several 100k routes into OSPF would not be wise if at all possible.  In this case I'd recommend using iBGP.  On the other hand, if R1 and R2 are only receiving default routes, or a small number of routes, then redistributing into OSPF would be the preferred option and would allow the routing information to reach other OSPF only routers in the internal network so that they can make more informed routing decisions.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-09T06:29:24.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33862" PostTypeId="1" AcceptedAnswerId="33954" CreationDate="2016-08-09T08:33:25.763" Score="2" ViewCount="2109" Body="&lt;p&gt;I've read somewhere that ping requests-responses don't work like a client-server. How?&#xA;We(sender) send a packet of data(ping) and if the server is up, it'll send back a packet. Isn't this a client-server type communication?&lt;/p&gt;&#xA;" OwnerUserId="29508" LastEditorUserId="29508" LastEditDate="2018-11-16T16:11:38.063" LastActivityDate="2018-11-16T16:11:38.063" Title="Why ping is not a client-server type thing?" Tags="|ping|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="33864" PostTypeId="2" ParentId="33862" CreationDate="2016-08-09T09:52:11.217" Score="2" Body="&lt;p&gt;Ping uses ICMP echo messages.&lt;/p&gt;&#xA;&lt;p&gt;Quoting from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc792&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 792&lt;/a&gt;, the specification on ICMP (Internet Control Message Protocol):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ICMP is actually an integral part of IP, and must be implemented by every IP module.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;There's no need to start any service to be started and listen on particular port for ICMP messages.&lt;/p&gt;&#xA;" OwnerUserId="1490" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-08-09T09:52:11.217" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33867" PostTypeId="1" AcceptedAnswerId="33873" CreationDate="2016-08-09T10:53:31.817" Score="1" ViewCount="231" Body="&lt;p&gt;I have this topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GLGMg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GLGMg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only have moon and sun. After the connection was successfully established, I need to generate ESP packets for wireshark capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I generate ESP packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I use IPv4 addresses, it works by sending ping from one host to another, but when I use IPv6, I don't see the same results.&lt;/p&gt;&#xA;" OwnerUserId="29516" LastEditorUserId="8499" LastEditDate="2016-08-09T13:37:10.263" LastActivityDate="2016-09-08T14:10:45.433" Title="How do I generate ESP trafic (IPv6)?" Tags="|ipv4|ipv6|ipsec|wireshark|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="33870" PostTypeId="2" ParentId="33857" CreationDate="2016-08-09T11:21:18.297" Score="0" Body="&lt;p&gt;Method of peering using a loopback interface is useful since it will not bring down the BGP session when there are multiple paths between the BGP peers, which would otherwise result in tearing down the BGP session if the physical interface used for establishing the session goes down. In addition to that, it also allows the routers running BGP with multiple links between them to load balance over the available paths. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://datagram.network/&quot; rel=&quot;nofollow&quot;&gt;http://datagram.network/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T11:21:18.297" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33871" PostTypeId="1" CreationDate="2016-08-09T12:18:35.603" Score="0" ViewCount="485" Body="&lt;p&gt;My Question isn't about any carrier or ISP, as it might sound.&#xA;It's about the technical aspect of internet censorship and needs networking experts to help.&#xA;As you may know, some countries are blocking access to whatsapp calls, but users usually overcome that with a VPN service, but today even with that powerful internet anonymity solution, ISPs and telecom operators are blocking whatsapp calls even when using VPN on your phone. The question is, how are ISPs able to detect that traffic, as it's encrypted, and ban such voip services. Any technical details would be great, thank you experts.&lt;/p&gt;&#xA;" OwnerUserId="29521" LastEditorUserId="29521" LastEditDate="2016-08-09T17:28:20.050" LastActivityDate="2016-08-09T17:28:20.050" Title="Is it possible for ISPs to block part of VPN traffic, like UDP traffic only" Tags="|vpn|voip|isp|telephony|" AnswerCount="1" CommentCount="7" ClosedDate="2016-08-09T13:23:33.290" ContentLicense="CC BY-SA 3.0" />
  <row Id="33872" PostTypeId="2" ParentId="33871" CreationDate="2016-08-09T12:45:36.677" Score="1" Body="&lt;p&gt;There three main types of censorship: &#xA;1. Internet Protocol (IP) address blocking or AS blocking&#xA;2. TLD's blocking&#xA;3. ISP filtring&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although VPN traffic is encapsulated and content invisible for ISP. And there isn't possible to censorship/filter traffic. Some countries may block edge IP address of various VPN providers. The issue could be that phone doesn't send all traffic thru VPN provider and this traffic is filtered.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2016-08-09T14:04:23.740" LastActivityDate="2016-08-09T14:04:23.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33873" PostTypeId="2" ParentId="33867" CreationDate="2016-08-09T12:53:19.080" Score="2" Body="&lt;p&gt;Packet which is sent from and to protected subnets will be encapsulated by strongswan. If traffic is not matching criteria won't be encapsulated.&#xA;Try to generate ping from interface which is included within protected subnet. &#xA;For example from moon gateway: &#xA;ping6 -I eth1 fec2::1&#xA;That should match criteria for your design and packet should be encapsulated.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T12:53:19.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33874" PostTypeId="2" ParentId="33862" CreationDate="2016-08-09T12:59:44.927" Score="0" Body="&lt;p&gt;ICMP is implemented directly on top of IP packets and doesn't use a transport layer (OSI layer 4) like TCP or UDP and is integral part of IP.&#xA;RFC 792 defines ICMP, which provides routing, diagnostic and error functionality for IP. Although ICMP messages are encapsulated within IP datagrams, ICMP processing is considered to be (and is typically implemented as) part of the IP layer.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T12:59:44.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33875" PostTypeId="2" ParentId="33857" CreationDate="2016-08-09T13:02:11.383" Score="0" Body="&lt;p&gt;Sample configuration would be:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Create loopback&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA;ip address 1.1.1.1 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Add update-source statment:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 30000&#xA;neighbor 66.xx.xx.65 update-source Loopback0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="8499" LastEditDate="2016-08-09T13:26:50.057" LastActivityDate="2016-08-09T13:26:50.057" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33876" PostTypeId="1" CreationDate="2016-08-09T13:27:02.897" Score="2" ViewCount="1638" Body="&lt;p&gt;I'm doing some traceroute scans and just realized, that there is an IP-address mismatch. Closer, my public IP-address doesn't match with the next HOP IP-address of my ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, when I scan the public IP-address of my modem, &lt;code&gt;tracert&lt;/code&gt; tells me, that the router with his public IP is one HOP away. Of course, because I'm inside the private network of this router. This as well means, that the &quot;inside&quot; IP-address of my router is &lt;code&gt;192.168.1.1&lt;/code&gt; (for example) and my outside address is the public address of my router (&lt;code&gt;81.81.81.81&lt;/code&gt;, for example). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But here is the question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does it come, that when I traceroute &lt;code&gt;8.8.8.8&lt;/code&gt;, the second hop IP-address, so after my gateway, is a private &lt;code&gt;10.0.0.0/8&lt;/code&gt; address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And what technology is used, that my outside IP is able to route to the private IP of the ISP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doesn't that mean, that my public address faces a private address?&#xA;Here is a tracert output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  1    &amp;lt;1 ms    &amp;lt;1 ms    &amp;lt;1 ms  192.168.1.1&#xA;  2     3 ms     3 ms    11 ms  10.255.195.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29524" LastEditorUserId="8499" LastEditDate="2018-03-10T04:25:51.313" LastActivityDate="2018-03-10T04:25:51.313" Title="Traceroute IP-address mismatch" Tags="|ipv4|ip-address|traceroute|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33877" PostTypeId="1" CreationDate="2016-08-09T13:27:33.143" Score="0" ViewCount="3342" Body="&lt;p&gt;As you know, &quot;&lt;strong&gt;ping -r&lt;/strong&gt;&quot; displays hops (maximum 9 hops) between your computer and destination (as &lt;strong&gt;tracert&lt;/strong&gt; does).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using this command, in many cases, I get &quot;request timeOut&quot; (first pic) while by using simple ping command, I get all the replies (second pic).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note, based on my captures, there is no difference between packets generated by &quot;ping -r&quot; and simple ping commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, why??!!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VYCUw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VYCUw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/P165C.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/P165C.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23302" LastActivityDate="2016-08-09T15:06:26.087" Title="ping -r results are confusing" Tags="|ping|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33878" PostTypeId="2" ParentId="33877" CreationDate="2016-08-09T13:35:21.963" Score="2" Body="&lt;p&gt;ping -r adds RECORD_ROUTE flags in packet which many hosts ignoring this flag.&#xA;Is not recommended tool to check path route. I would use instead traceroute or mtr. And is only supporting up to 9 hops. If destination is farther than 9 hops this will fail. As manual says:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;      -R     Record route. (IPv4 only) Includes the RECORD_ROUTE option in the ECHO_REQUEST packet and displays the route buffer on  returned &#xA;&amp;gt; packets.   Note&#xA;&amp;gt;               that the IP header is only large enough for nine such routes.  Many hosts ignore or discard this option.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T13:35:21.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33880" PostTypeId="2" ParentId="33876" CreationDate="2016-08-09T13:41:47.583" Score="1" Body="&lt;p&gt;Your ISP could have network built based on RFC1918 IP addresses. Then somewhere on the way there is NAT applied to translate IP address.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T13:41:47.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33881" PostTypeId="2" ParentId="33876" CreationDate="2016-08-09T13:43:03.830" Score="1" Body="&lt;p&gt;Apparently, your ISP is using CGN (Carrier-Grade NAT). See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6264&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6264, An Incremental Carrier-Grade NAT (CGN) for IPv6 Transition&lt;/a&gt;. Some ISPs foolishly use RFC 1918 Private Address space for this instead of the IANA reserved address block: &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6598&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6598, IANA-Reserved IPv4 Prefix for Shared Address Space&lt;/a&gt;). This range is &lt;code&gt;100.64.0.0/10&lt;/code&gt;. Most ISPs don't use the range assigned by IANA for this, they just use regular RFC 1918 address space.&lt;/p&gt;&#xA;&lt;p&gt;The RIRs have run out of IPv4 addresses to assign to the ISPs, so the ISPs are turning to CGN to assign non-public IPv4 addresses to residential customers, saving their precious pool of public IP addresses for business customers willing to pay a premium for public IPv4 addresses.&lt;/p&gt;&#xA;&lt;p&gt;From RFC 6598:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;1.  Introduction&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;IPv4 address space is nearly exhausted.  However, ISPs must&#xA;continue to support IPv4 growth until IPv6 is fully deployed.  To&#xA;that end, many ISPs will deploy a Carrier-Grade NAT (CGN) device,&#xA;such as that described in [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6264&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6264&lt;/a&gt;].  Because CGNs are used on&#xA;networks where public address space is expected, and currently&#xA;available private address space causes operational issues when used&#xA;in this context, ISPs require a new IPv4 /10 address block.  This&#xA;address block will be called the &amp;quot;Shared Address Space&amp;quot; and will be&#xA;used to number the interfaces that connect CGN devices to Customer&#xA;Premises Equipment (CPE).&lt;/p&gt;&#xA;&lt;p&gt;Shared Address Space is similar to [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt;] private address&#xA;space in that it is not globally routable address space and can be&#xA;used by multiple pieces of equipment.  However, Shared Address&#xA;Space has limitations in its use that the current [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt;]&#xA;private address space does not have.  In particular, Shared Address&#xA;Space can only be used in Service Provider networks or on routing&#xA;equipment that is able to do address translation across router&#xA;interfaces when the addresses are identical on two different&#xA;interfaces.&lt;/p&gt;&#xA;&lt;p&gt;This document requests the allocation of an IPv4 /10 address block&#xA;to be used as Shared Address Space.  In conversations with many&#xA;ISPs, a /10 is the smallest block that will allow them to deploy&#xA;CGNs on a regional basis without requiring nested CGNs.  For&#xA;instance, as described in [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6598#ref-ISP-SHARED-ADDR&quot; rel=&quot;nofollow noreferrer&quot;&gt;ISP-SHARED-ADDR&lt;/a&gt;], a /10 is&#xA;sufficient to service Points of Presence in the Tokyo area.&lt;/p&gt;&#xA;&lt;p&gt;This document details the allocation of an additional special-use&lt;br /&gt;&#xA;IPv4 address block and updates [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5735&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC5735&lt;/a&gt;].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The RFC also lists some of the problems caused by CGN:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;5.2.  Empirical Data&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The primary motivation for the allocation of Shared Address Space is&#xA;as address space for CGNs; the use and impact of CGNs has been&#xA;previously described in [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6269&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6269&lt;/a&gt;] and [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6598#ref-NAT444-IMPACTS&quot; rel=&quot;nofollow noreferrer&quot;&gt;NAT444-IMPACTS&lt;/a&gt;].  Some&#xA;of the services adversely impacted by CGNs are as follows:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Console gaming -- some games fail when two subscribers using the&#xA;same outside public IPv4 address try to connect to each other.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Video streaming -- performance is impacted when using one of&#xA;several popular video-streaming technologies to deliver multiple&#xA;video streams to users behind particular CPE routers.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Peer-to-peer -- some peer-to-peer applications cannot seed&#xA;content due to the inability to open incoming ports through the&#xA;CGN.  Likewise, some SIP client implementations cannot receive&#xA;incoming calls unless they first initiate outgoing traffic or&#xA;open an incoming port through the CGN using the Port Control&#xA;Protocol (PCP) [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6598#ref-PCP-BASE&quot; rel=&quot;nofollow noreferrer&quot;&gt;PCP-BASE&lt;/a&gt;] or a similar mechanism.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Geo-location -- geo-location systems identify the location of the&#xA;CGN server, not the end host.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Simultaneous logins -- some websites (particularly banking and&#xA;social-networking websites) restrict the number of simultaneous&#xA;logins per outside public IPv4 address.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;6to4 -- 6to4 requires globally reachable addresses and will not&#xA;work in networks that employ addresses with limited topological&#xA;span, such as those employing CGNs.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Based on your comments, I see that you are confused. You think the addressing looks like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.1[LAN-Your Router-WAN]83.79.34.21&amp;lt;--&amp;gt;10.255.195.1[ISP router]Internet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;In reality, it looks something like this:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.1[LAN-Your Router-WAN]10.255.195.2&amp;lt;--&amp;gt;10.255.195.1[ISP router]83.79.34.21&amp;lt;--&amp;gt;Internet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When you go to a web site that reports your public address, it only sees the ISP public address &lt;code&gt;83.79.34.21&lt;/code&gt; since the private addresses assigned to your router cannot be routed on the public Internet. That public address is not on your router, it is on an ISP router. All your traffic gets translated on your router between two private address blocks, and it gets translated again on the ISP router from private to public addresses. That double NAT may cause problems for you, depending on what you try to do.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-08-11T14:35:39.277" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="33883" PostTypeId="2" ParentId="33859" CreationDate="2016-08-09T14:30:20.253" Score="3" Body="&lt;p&gt;If R1 and R2 holds full internet routing table answer is never. &#xA;Only default route should redistributed towards OSPF in some occasions maybe you would need to redistribute certain prefixes into OSPF but you need to have a good reason for that.&#xA;You need to remember that every time a network is deleted or added, an SPF recalculation happen. Dijkstra's algorithm requires lot CPU resources.&#xA;Routes on internet are flapping, appear and disappear. With this number of routes your router would be doing continuously recalculation which would taken all CPU time.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2016-08-11T14:19:07.533" LastActivityDate="2016-08-11T14:19:07.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33884" PostTypeId="2" ParentId="33877" CreationDate="2016-08-09T15:06:26.087" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.networksorcery.com/enp/protocol/ip/option007.htm&quot; rel=&quot;nofollow&quot;&gt;http://www.networksorcery.com/enp/protocol/ip/option007.htm&lt;/a&gt;&#xA;please read this page for find out why look like it has a security issue for the destination to do that for you.&lt;/p&gt;&#xA;" OwnerUserId="29529" LastActivityDate="2016-08-09T15:06:26.087" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33885" PostTypeId="1" CreationDate="2016-08-09T15:21:55.390" Score="1" ViewCount="430" Body="&lt;p&gt;Okay, so we have an older X-Class ESI PBX system, an ESI IVX 128x FSIII [see below for link]. We have an LNC card installed in it, which allows for the use of up to 12 &lt;a href=&quot;http://refurbphoneexchange.com/products/esi-ip-48-key-h-ipfp-phone&quot; rel=&quot;nofollow noreferrer&quot;&gt;LAN-only VoIP phones&lt;/a&gt;. We have an IPSec tunnel between the main site (with the PBX, using a pfSense router, build 2.3.2-RELEASE amd64) and the remote site (with the phone, using a Cisco RV220w router). I'm trying to get the phone and the PBX to talk, and right now they won't. Here's what I've discovered:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The phone works fine when plugged into the same fabric the PBX is connected to, boots up and grabs extension info. The PBX and extension settings &lt;a href=&quot;https://i.stack.imgur.com/c7f5v.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;are viewable here&lt;/a&gt;, but that may be a red herring for now.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The IPSec tunnel is set to allow all connection attempts between the subnets, and I've explicitly forwarded all ports in the range related to the PBX coming thru the tunnel to the private IP for the PBX (2.201). On the remote site's end, I had plugged the phone directly into a router port, and the router saw packets moving on the interface, but wouldn't assign an IP to the phone or acknowledge a device was connected (nothing in the clients list matching the phone's MAC).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I plugged the phone into my PC and ran a pcap with Wireshark. I'm not an expert with Wireshark, but it looks to me like the phone is sending broadcast/unicast packets to destination address Esi_ff:ff:ff (01:30:4d:ff:ff:ff) using the protocol 0x887f, which isn't an EtherType that google seems to have heard of. Packet length is 82 bits, frequency is every couple of seconds, same packet each time.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;IPSec info:&lt;br&gt;&#xA;Local router (pfSense) config:&lt;br&gt;&#xA;Subnet: 192.168.2.0/23&lt;br&gt;&#xA;firewall rules:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;scrub on bge0 all fragment reassemble&#xA;scrub on re0 all fragment reassemble&#xA;scrub on re1 all fragment reassemble&#xA;anchor &quot;relayd/*&quot; all&#xA;anchor &quot;openvpn/*&quot; all&#xA;anchor &quot;ipsec/*&quot; all&#xA;block drop in log quick inet from 169.254.0.0/16 to any label &quot;Block IPv4 link-local&quot;&#xA;block drop in log quick inet from any to 169.254.0.0/16 label &quot;Block IPv4 link-local&quot;&#xA;block drop in log inet all label &quot;Default deny rule IPv4&quot;&#xA;block drop out log inet all label &quot;Default deny rule IPv4&quot;&#xA;block drop log quick inet proto tcp from any port = 0 to any label &quot;Block traffic from port 0&quot;&#xA;block drop log quick inet proto udp from any port = 0 to any label &quot;Block traffic from port 0&quot;&#xA;block drop log quick inet proto tcp from any to any port = 0 label &quot;Block traffic to port 0&quot;&#xA;block drop log quick inet proto udp from any to any port = 0 label &quot;Block traffic to port 0&quot;&#xA;block drop log quick from &amp;lt;snort2c&amp;gt; to any label &quot;Block snort2c hosts&quot;&#xA;block drop log quick from any to &amp;lt;snort2c&amp;gt; label &quot;Block snort2c hosts&quot;&#xA;block drop in log quick proto carp from (self) to any&#xA;pass quick proto carp all no state&#xA;block drop in log quick proto tcp from &amp;lt;sshlockout&amp;gt; to (self) port = ssh label &quot;sshlockout&quot;&#xA;block drop in log quick proto tcp from &amp;lt;webConfiguratorlockout&amp;gt; to (self) port = 8080 label &quot;webConfiguratorlockout&quot;&#xA;block drop in log quick from &amp;lt;virusprot&amp;gt; to any label &quot;virusprot overload table&quot;&#xA;block drop in log quick on bge0 from &amp;lt;bogons&amp;gt; to any label &quot;block bogon IPv4 networks from WAN&quot;&#xA;block drop in log quick on bge0 from &amp;lt;bogonsv6&amp;gt; to any label &quot;block bogon IPv6 networks from WAN&quot;&#xA;block drop in log on ! bge0 inet from %%main_site_upstreamSubnet%% to any&#xA;block drop in log inet from %%main_site%% to any&#xA;block drop in log inet from %%main_site_IPtwo%% to any&#xA;block drop in log on ! re0 inet from 192.168.2.0/23 to any&#xA;block drop in log inet from 192.168.2.20 to any&#xA;block drop in log on ! re1 inet from 10.0.0.0/24 to any&#xA;block drop in log inet from 10.0.0.1 to any&#xA;pass in on lo0 inet all flags S/SA keep state label &quot;pass IPv4 loopback&quot;&#xA;pass out on lo0 inet all flags S/SA keep state label &quot;pass IPv4 loopback&quot;&#xA;pass out inet all flags S/SA keep state allow-opts label &quot;let out anything IPv4 from firewall host itself&quot;&#xA;pass out route-to (bge0 %%main_site_upstream%%) inet from %%main_site%% to ! %%main_site_upstreamSubnet%% flags S/SA keep state allow-opts label &quot;let out anything from firewall host itself&quot;&#xA;pass out route-to (bge0 %%main_site_upstream%%) inet from %%main_site_IPtwo%% to ! %%main_site_upstreamSubnet%% flags S/SA keep state allow-opts label &quot;let out anything from firewall host itself&quot;&#xA;pass out on enc0 all flags S/SA keep state label &quot;IPsec internal host to host&quot;&#xA;pass in quick on re0 proto tcp from any to (re0) port = 8080 flags S/SA keep state label &quot;anti-lockout rule&quot;&#xA;anchor &quot;userrules/*&quot; all&#xA;pass in log quick on enc0 inet proto tcp from 192.168.5.0/24 to any flags S/SA keep state allow-opts label &quot;USER_RULE: warehouse to LAN (IPSec VPN tunnel passthru enable)&quot;&#xA;pass in quick on enc0 inet from 192.168.5.0/24 to 192.168.2.0/23 flags S/SA keep state label &quot;USER_RULE&quot;&#xA;pass in quick on enc0 inet from 192.168.2.0/23 to 192.168.5.0/24 flags S/SA keep state label &quot;USER_RULE&quot;&#xA;pass in log quick on enc0 inet proto tcp from 192.168.2.8 to 192.168.5.0/24 flags S/SA keep state label &quot;USER_RULE: email to warehouse (outgoing) pass all&quot;&#xA;pass in log quick on enc0 inet proto tcp from 192.168.5.0/24 to 192.168.2.3 flags S/SA keep state label &quot;USER_RULE: primary dc incoming&quot;&#xA;pass in log quick on enc0 inet proto tcp from 192.168.2.3 to 192.168.5.0/24 flags S/SA keep state label &quot;USER_RULE: primary dc outgoing&quot;&#xA;pass in log quick on enc0 inet proto tcp from 192.168.2.6 to 192.168.5.0/24 flags S/SA keep state label &quot;USER_RULE: backup dc outgoing&quot;&#xA;pass in log quick on enc0 inet proto tcp from 192.168.5.0/24 to 192.168.2.6 flags S/SA keep state label &quot;USER_RULE: backup dc incoming&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 192.168.2.8 port = ldap flags S/SA keep state label &quot;USER_RULE: NAT email LDAP (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 192.168.2.8 port = smtp flags S/SA keep state label &quot;USER_RULE: NAT email smtp incoming (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 192.168.2.8 port = nntp flags S/SA keep state label &quot;USER_RULE: NAT email nntp incoming (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto udp from any to 192.168.2.8 port = snmp keep state label &quot;USER_RULE: NAT email snmp (udp) incoming (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 192.168.2.8 port = netbios-ns flags S/SA keep state label &quot;USER_RULE: NAT email mpls-in incoming (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 192.168.2.8 port = kerberos-sec flags S/SA keep state label &quot;USER_RULE: NAT email IPsec incoming (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 192.168.2.8 port = sftp flags S/SA keep state label &quot;USER_RULE: NAT email L2TP incoming (look into this) (ipsec t...&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 192.168.2.8 port = https flags S/SA keep state label &quot;USER_RULE: NAT email ActiveSync (TDP/UDP both) (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto udp from any to 192.168.2.8 port = https keep state label &quot;USER_RULE: NAT email ActiveSync (TDP/UDP both) (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 196.168.2.8 port = 6001 flags S/SA keep state label &quot;USER_RULE: NAT email RPC 6001 (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 196.168.2.8 port = 6002 flags S/SA keep state label &quot;USER_RULE: NAT email RPC 6002 (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 196.168.2.8 port = 6003 flags S/SA keep state label &quot;USER_RULE: NAT email RPC 6003 (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 196.168.2.8 port = 6004 flags S/SA keep state label &quot;USER_RULE: NAT email RPC 6004 (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto udp from any to 192.168.2.8 port = ntp keep state label &quot;USER_RULE: NAT email ntp incoming (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 192.168.2.8 port = pop3 flags S/SA keep state label &quot;USER_RULE: NAT email pop3 incoming (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 192.168.2.3 port = domain flags S/SA keep state label &quot;USER_RULE: NAT dns server forward (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto udp from any to 192.168.2.3 port = domain keep state label &quot;USER_RULE: NAT dns server forward (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto tcp from any to 192.168.2.3 port = ldap flags S/SA keep state label &quot;USER_RULE: NAT dns server forward (ipsec tunnel)&quot;&#xA;pass in quick on enc0 inet proto udp from any to 192.168.2.3 port = ldap keep state label &quot;USER_RULE: NAT dns server forward (ipsec tunnel)&quot;&#xA;block drop in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from %%main_site_upstreamSubnet%% to 192.168.2.0/23 port = ms-sql-s flags S/SA label &quot;USER_RULE: drop all sql incoming&quot;&#xA;block drop in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from %%main_site_upstreamSubnet%% to 192.168.2.0/23 port = ncube-lm flags S/SA label &quot;USER_RULE: drop all sql-net incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.10 port = http flags S/SA keep state label &quot;USER_RULE: NAT camera server http incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.12 port = http flags S/SA keep state label &quot;USER_RULE: NAT webserv http incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.8 port = smtp flags S/SA keep state label &quot;USER_RULE: NAT email smtp incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto udp from any to 192.168.2.8 port = ntp keep state label &quot;USER_RULE: NAT email ntp incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.8 port = pop3 flags S/SA keep state label &quot;USER_RULE: NAT email pop3 incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.8 port = nntp flags S/SA keep state label &quot;USER_RULE: NAT email nntp incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto udp from any to 192.168.2.8 port = snmp keep state label &quot;USER_RULE: NAT email snmp (udp) incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.8 port = netbios-ns flags S/SA keep state label &quot;USER_RULE: NAT email mpls-in incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.8 port = kerberos-sec flags S/SA keep state label &quot;USER_RULE: NAT email IPsec incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.8 port = sftp flags S/SA keep state label &quot;USER_RULE: NAT email L2TP incoming (look into this)&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.8 port = https flags S/SA keep state label &quot;USER_RULE: NAT email ActiveSync (TDP/UDP both)&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto udp from any to 192.168.2.8 port = https keep state label &quot;USER_RULE: NAT email ActiveSync (TDP/UDP both)&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.8 port = ldap flags S/SA keep state label &quot;USER_RULE: NAT email LDAP&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 196.168.2.8 port = 6001 flags S/SA keep state label &quot;USER_RULE: NAT email RPC 6001&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 196.168.2.8 port = 6002 flags S/SA keep state label &quot;USER_RULE: NAT email RPC 6002&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 196.168.2.8 port = 6004 flags S/SA keep state label &quot;USER_RULE: NAT email RPC 6004&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 196.168.2.8 port = 6003 flags S/SA keep state label &quot;USER_RULE: NAT email RPC 6003&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto tcp from any to 192.168.2.19 port = 1297 flags S/SA keep state label &quot;USER_RULE: NAT visibar gun incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto udp from any to 192.168.2.19 port = 1297 keep state label &quot;USER_RULE: NAT visibar gun incoming&quot;&#xA;pass in quick on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto icmp from %%remote_site%% to %%main_site%% icmp-type echoreq keep state label &quot;USER_RULE: Easy Rule: Passed from Firewall Log View&quot;&#xA;pass in log quick on re0 inet from any to 192.168.2.201 flags S/SA keep state label &quot;USER_RULE: allow to PBX&quot;&#xA;pass in log quick on re0 inet from any to 192.168.5.0/24 flags S/SA keep state allow-opts label &quot;USER_RULE: warehouse to LAN (IPSec VPN tunnel passthru enable)&quot;&#xA;block drop in quick on re0 inet proto tcp from 192.168.2.0/23 to any port = smtp label &quot;USER_RULE: disallow smtp for subnet&quot;&#xA;block drop in quick on re0 inet proto udp from 192.168.2.0/23 to any port = smtp label &quot;USER_RULE: disallow smtp for subnet&quot;&#xA;pass in quick on re0 inet from 192.168.2.0/23 to any flags S/SA keep state label &quot;USER_RULE: Default allow LAN to any rule&quot;&#xA;pass in log quick on re1 inet proto tcp from any to (self) flags S/SA keep state label &quot;USER_RULE&quot;&#xA;pass out route-to (bge0 %%main_site_upstream%%) inet proto udp from (self) to %%remote_site%% port = isakmp keep state label &quot;IPsec: warehouse - outbound isakmp&quot;&#xA;pass in on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto udp from %%remote_site%% to (self) port = isakmp keep state label &quot;IPsec: warehouse - inbound isakmp&quot;&#xA;pass out route-to (bge0 %%main_site_upstream%%) inet proto udp from (self) to %%remote_site%% port = sae-urn keep state label &quot;IPsec: warehouse - outbound nat-t&quot;&#xA;pass in on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto udp from %%remote_site%% to (self) port = sae-urn keep state label &quot;IPsec: warehouse - inbound nat-t&quot;&#xA;pass out route-to (bge0 %%main_site_upstream%%) inet proto esp from (self) to %%remote_site%% keep state label &quot;IPsec: warehouse - outbound esp proto&quot;&#xA;pass in on bge0 reply-to (bge0 %%main_site_upstream%%) inet proto esp from %%remote_site%% to (self) keep state label &quot;IPsec: warehouse - inbound esp proto&quot;&#xA;anchor &quot;tftp-proxy/*&quot; all&#xA;pass in on re0 proto udp from any to any port = sip keep state&#xA;pass in on re0 proto udp from any to any port 64000:64999 keep state&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NAT rules: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no nat proto carp all&#xA;nat-anchor &quot;natearly/*&quot; all&#xA;nat-anchor &quot;natrules/*&quot; all&#xA;nat on bge0 inet from 127.0.0.0/8 to any port = isakmp -&amp;gt; %%main_site%% static-port&#xA;nat on bge0 inet from 192.168.2.0/23 to any port = isakmp -&amp;gt; %%main_site%% static-port&#xA;nat on bge0 inet from 10.0.0.0/24 to any port = isakmp -&amp;gt; %%main_site%% static-port&#xA;nat on bge0 inet from 127.0.0.0/8 to any -&amp;gt; %%main_site%% port 1024:65535&#xA;nat on bge0 inet from 192.168.2.0/23 to any -&amp;gt; %%main_site%% port 1024:65535&#xA;nat on bge0 inet from 10.0.0.0/24 to any -&amp;gt; %%main_site%% port 1024:65535&#xA;no rdr proto carp all&#xA;rdr-anchor &quot;relayd/*&quot; all&#xA;rdr-anchor &quot;tftp-proxy/*&quot; all&#xA;rdr on bge0 inet proto tcp from any to any port = smtp -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto udp from any to any port = ntp -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto tcp from any to any port = pop3 -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto tcp from any to any port = nntp -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto udp from any to any port = snmp -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto tcp from any to any port = netbios-ns -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto tcp from any to any port = kerberos-sec -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto tcp from any to any port = sftp -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto tcp from any to any port = ldap -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto tcp from any to any port = https -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto udp from any to any port = https -&amp;gt; 192.168.2.8&#xA;rdr on bge0 inet proto tcp from any to %%main_site%% port = 6001 -&amp;gt; 196.168.2.8&#xA;rdr on bge0 inet proto tcp from any to %%main_site%% port = 6002 -&amp;gt; 196.168.2.8&#xA;rdr on bge0 inet proto tcp from any to %%main_site%% port = 6003 -&amp;gt; 196.168.2.8&#xA;rdr on bge0 inet proto tcp from any to %%main_site%% port = 6004 -&amp;gt; 196.168.2.8&#xA;rdr on bge0 inet proto tcp from any to any port = 1297 -&amp;gt; 192.168.2.19&#xA;rdr on bge0 inet proto udp from any to any port = 1297 -&amp;gt; 192.168.2.19&#xA;rdr on bge0 inet proto tcp from any to %%main_site%% port = http -&amp;gt; 192.168.2.12&#xA;rdr on bge0 inet proto tcp from any to %%main_site_IPtwo%% port = http -&amp;gt; 192.168.2.10&#xA;rdr on enc0 inet proto tcp from any to 192.168.2.3 port = domain -&amp;gt; 192.168.2.3&#xA;rdr on enc0 inet proto udp from any to 192.168.2.3 port = domain -&amp;gt; 192.168.2.3&#xA;rdr on enc0 inet proto tcp from any to 192.168.2.3 port = ldap -&amp;gt; 192.168.2.3&#xA;rdr on enc0 inet proto udp from any to 192.168.2.3 port = ldap -&amp;gt; 192.168.2.3&#xA;rdr on re0 inet proto udp from any to ! (re0) port = sip -&amp;gt; 127.0.0.1 port 5060&#xA;rdr-anchor &quot;miniupnpd&quot; all&#xA;binat on bge0 inet from 192.168.2.10 to any -&amp;gt; %%main_site_IPtwo%%&#xA;binat on enc0 inet from 192.168.2.0/23 to 192.168.5.0/24 -&amp;gt; 192.168.2.0/23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Remote site (Cisco) config:&lt;br&gt;&#xA;Subnet: 192.168.5.0/24&lt;br&gt;&#xA;Default allow all outbound, I'm not sure how to export a nice list from an RV220w like the above, but there's not a lot going on with this thing. I'll remote in shortly and try to take some screenshots.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't really know where to go from here, but there has to be a way to make this work, right? I can provide more information as requested. Link to the PBX administrator's manual will be below in a comment since I apparently don't have the reputation yet to post more than 2 links at a time.&lt;/p&gt;&#xA;" OwnerUserId="29528" LastEditorUserId="29528" LastEditDate="2016-08-09T16:07:16.123" LastActivityDate="2018-07-01T07:36:27.267" Title="ESI PBX LAN-only VoIP phone forwarding thru IPSec tunnel - remote router sees packets but not phone, doesn't forward" Tags="|ipsec|voip|pfsense|telephony|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="33887" PostTypeId="1" CreationDate="2016-08-09T17:07:48.003" Score="1" ViewCount="87" Body="&lt;p&gt;So I'm working on setting up a new ip addressing schema for a network. Here is the current plan:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.0.0  -&amp;gt; VLAN 100 -&amp;gt; Server Farm&#xA;10.1.4.0  -&amp;gt; VLAN 104 -&amp;gt; Admin Wired Data&#xA;10.1.8.0  -&amp;gt; VLAN 108 -&amp;gt; Admin Wireless Data&#xA;10.1.12.0 -&amp;gt; VLAN 112 -&amp;gt; Guest Wireless&#xA;&#xA;Routers  -&amp;gt; .1 - .3&#xA;Switches -&amp;gt; .5 - .9&#xA;Printers -&amp;gt; .10 - .14&#xA;Reserved -&amp;gt; .15 - .19&#xA;DHCP     -&amp;gt; .20 - x.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my question is do the switches get the same ip address in each of the subnets to be able to be managed? Or do I just give it an ip address in say the server farm subnet for management abilities? &lt;/p&gt;&#xA;" OwnerUserId="29534" LastEditorUserId="8499" LastEditDate="2018-03-19T17:32:18.480" LastActivityDate="2018-03-19T17:32:18.480" Title="Switch IP Addressing" Tags="|switch|vlan|ipv4|ip|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33888" PostTypeId="2" ParentId="33887" CreationDate="2016-08-09T17:11:40.043" Score="1" Body="&lt;p&gt;If the switch is a layer-2 switch, you only need to give it an address in one of the VLANs. You could give it an address in each of the VLANs, but that has its flaws. You may want a Management VLAN for the switches, WAPs, etc, and restrict access to that VLAN with ACLs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-09T17:11:40.043" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33889" PostTypeId="1" CreationDate="2016-08-09T18:11:57.977" Score="1" ViewCount="1001" Body="&lt;p&gt;I have 2 servers connected with 10G cable between them directly. I need to know that the connection is good and it has indeed 10G throughput. &#xA;I used IPERF to verify the bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the test the bandwidth is &lt;code&gt;1.5-1.7 Gbits/sec&lt;/code&gt;. Does it mean the connection is 10G?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Server A is Windows 8.1 Pro 64bit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Server B is Windows 7 Enterprise 64bit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the output when A (192.168.10.100) is server and B (192.168.10.200) is client:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-----------------------------------------------------------&#xA;Server listening on 5201&#xA;-----------------------------------------------------------&#xA;Accepted connection from 192.168.10.200, port 63772&#xA;[  5] local 192.168.10.100 port 5201 connected to 192.168.10.200 port 63773&#xA;[ ID] Interval           Transfer     Bandwidth&#xA;[  5]   0.00-1.00   sec   170 MBytes  1.42 Gbits/sec&#xA;[  5]   1.00-2.00   sec   217 MBytes  1.82 Gbits/sec&#xA;[  5]   2.00-3.00   sec   217 MBytes  1.82 Gbits/sec&#xA;[  5]   3.00-4.00   sec   214 MBytes  1.80 Gbits/sec&#xA;[  5]   4.00-5.00   sec   217 MBytes  1.82 Gbits/sec&#xA;[  5]   5.00-6.00   sec   207 MBytes  1.74 Gbits/sec&#xA;[  5]   6.00-7.00   sec   199 MBytes  1.67 Gbits/sec&#xA;[  5]   7.00-8.00   sec   206 MBytes  1.73 Gbits/sec&#xA;[  5]   8.00-9.00   sec   192 MBytes  1.61 Gbits/sec&#xA;[  5]   9.00-10.00  sec   209 MBytes  1.75 Gbits/sec&#xA;[  5]  10.00-10.16  sec  30.3 MBytes  1.63 Gbits/sec&#xA;- - - - - - - - - - - - - - - - - - - - - - - - -&#xA;[ ID] Interval           Transfer     Bandwidth&#xA;[  5]   0.00-10.16  sec  0.00 Bytes  0.00 bits/sec                  sender&#xA;[  5]   0.00-10.16  sec  2.03 GBytes  1.72 Gbits/sec                  receiver&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the output when B (192.168.10.200) is server and A (192.168.10.100) is client:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-----------------------------------------------------------&#xA;Server listening on 5201&#xA;-----------------------------------------------------------&#xA;Accepted connection from 192.168.10.100, port 55565&#xA;[  5] local 192.168.10.200 port 5201 connected to 192.168.10.100 port 55566&#xA;[ ID] Interval           Transfer     Bandwidth&#xA;[  5]   0.00-1.00   sec   170 MBytes  1.43 Gbits/sec&#xA;[  5]   1.00-2.00   sec   175 MBytes  1.47 Gbits/sec&#xA;[  5]   2.00-3.00   sec   175 MBytes  1.47 Gbits/sec&#xA;[  5]   3.00-4.00   sec   179 MBytes  1.50 Gbits/sec&#xA;[  5]   4.00-5.00   sec   181 MBytes  1.52 Gbits/sec&#xA;[  5]   5.00-6.00   sec   200 MBytes  1.68 Gbits/sec&#xA;[  5]   6.00-7.00   sec   176 MBytes  1.47 Gbits/sec&#xA;[  5]   7.00-8.00   sec   177 MBytes  1.48 Gbits/sec&#xA;[  5]   8.00-9.00   sec   186 MBytes  1.56 Gbits/sec&#xA;[  5]   9.00-10.00  sec   179 MBytes  1.50 Gbits/sec&#xA;[  5]  10.00-10.04  sec  6.42 MBytes  1.46 Gbits/sec&#xA;- - - - - - - - - - - - - - - - - - - - - - - - -&#xA;[ ID] Interval           Transfer     Bandwidth&#xA;[  5]   0.00-10.04  sec  0.00 Bytes  0.00 bits/sec                  sender&#xA;[  5]   0.00-10.04  sec  1.76 GBytes  1.51 Gbits/sec                  receiver&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15644" LastActivityDate="2016-08-09T18:58:53.987" Title="How to verify that the connection is 10G?" Tags="|bandwidth|throughput|10gbase|iperf|" AnswerCount="1" CommentCount="1" ClosedDate="2016-08-09T19:37:22.350" ContentLicense="CC BY-SA 3.0" />
  <row Id="33890" PostTypeId="2" ParentId="33887" CreationDate="2016-08-09T18:51:18.557" Score="1" Body="&lt;p&gt;A good security practice is to separate management and user data traffic. The management VLAN, which is VLAN 1 by default, should be changed to a separate, distinct VLAN. To communicate remotely with a Cisco switch for management purposes, the switch must have an IP address configured on the management VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=2181837&amp;amp;seqNum=11&quot; rel=&quot;nofollow&quot;&gt;http://www.ciscopress.com/articles/article.asp?p=2181837&amp;amp;seqNum=11&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T18:51:18.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33891" PostTypeId="2" ParentId="33889" CreationDate="2016-08-09T18:58:53.987" Score="1" Body="&lt;p&gt;That could be issue with Window Auto-Tuning which is implemented in windows. &#xA;Due to default settings size of window never will be bigger than 256 KB. &#xA;To switch off Windows Auto-Tuning you need to isse command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;netsh int tcp set global autotuninglevel=disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T18:58:53.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33894" PostTypeId="2" ParentId="29713" CreationDate="2016-08-09T19:19:36.770" Score="0" Body="&lt;p&gt;You can achive that by ususing VLAN with VACL or use protected ports (easiest option). &#xA;Another options is Isolated PVLAN. &lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T19:19:36.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33895" PostTypeId="1" AcceptedAnswerId="33897" CreationDate="2016-08-09T19:29:41.163" Score="1" ViewCount="5604" Body="&lt;p&gt;Is there any option for HP switches to change/modify used ssh ciphers?&#xA;For exmaple in cisco we can issue commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip ssh server algorithm encryption aes256-ctr&#xA;ip ssh server algorithm mac hmac-sha1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I couldn't find anything which would achive same results in HP Procurve documentation.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T20:19:39.487" Title="HP ProCurve switch off weak ciphers - disable SSH CBC Mode Ciphers and RC4" Tags="|security|hp|hp-procurve|ssh|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33896" PostTypeId="2" ParentId="30296" CreationDate="2016-08-09T20:10:32.467" Score="0" Body="&lt;p&gt;There is few options why this could not work:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;missing ssh key on switch&lt;/li&gt;&#xA;&lt;li&gt;missing input at transport&lt;/li&gt;&#xA;&lt;li&gt;time desynchronization&lt;/li&gt;&#xA;&lt;li&gt;invalid access-class at transport&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In this option you can try console and hope for the best, otherwise factory reset.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2016-08-09T20:48:35.050" LastActivityDate="2016-08-09T20:48:35.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33897" PostTypeId="2" ParentId="33895" CreationDate="2016-08-09T20:19:39.487" Score="3" Body="&lt;p&gt;You should be able to set this with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip ssh cipher aes-256-ctr&#xA;ip ssh mac hmac-sha1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You may also have to disable the other algorithms first using the no forms of the commands.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-09T20:19:39.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33899" PostTypeId="2" ParentId="33885" CreationDate="2016-08-09T20:37:41.663" Score="1" Body="&lt;p&gt;01:30:4d:ff:ff:ff seems to be a broadcast destined for ESI PBX. &#xA;Routers doesn't forward broadcast packets between diffrent broadcast domains. &#xA;My guess is that both phone and PBX system needs to be in same broadcast domain.&#xA;Not sure about pfsense but in cisco world you would setup ip helper address.&#xA;other option is OVA.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T20:37:41.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33900" PostTypeId="2" ParentId="26706" CreationDate="2016-08-09T21:08:39.540" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Windows has no built-in support mechanisms for VLANs. There aren't&#xA;  separate physical and VLAN interfaces you can capture from, unless a&#xA;  specialized driver that adds such support is present.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;So whether you see VLAN tags in Wireshark or not will depend on the&#xA;  network adapter you have and on what it and its driver do with VLAN&#xA;  tags.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Most &quot;simple&quot; network adapters (e.g. widely used Realtek RTL 8139) and&#xA;  their drivers will simply pass VLAN tags to the upper layer to handle&#xA;  these. In that case, Wireshark will see VLAN tags and can handle and&#xA;  show them.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Some more sophisticated adapters will handle VLAN tags in the adapter&#xA;  and/or the driver. This includes some Intel adapters and, as far as i&#xA;  know, Broadcom gigabit chipsets (NetXtreme / 57XX based chips).&#xA;  Moreover, it is likely that cards that have specialized drivers will&#xA;  follow this path as well, to prevent interference from the &quot;real&quot;&#xA;  driver.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://wiki.wireshark.org/CaptureSetup/VLAN#Windows&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt;&#xA;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a cisco switches diffrent models needs diffrent config.&#xA;for example at destination interface encapsulation dot1q needs to be added this will allow switch copy vlan tags to output port.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="8499" LastEditDate="2016-08-09T21:10:48.863" LastActivityDate="2016-08-09T21:10:48.863" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33901" PostTypeId="1" CreationDate="2016-08-09T21:23:33.083" Score="1" ViewCount="213" Body="&lt;p&gt;I have made a network and i posted the topology below, i need to ping through the internet to a host inside the network. which will essentially be a VPN and i need help on giving the network &quot;VPN&quot; properties and to make it a VPN and making a tunnel to my PC's ip address, how can i do that?&#xA;I have to get through the firewall as well to get it to ping a host on the inside&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GCEWx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GCEWx.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27334" LastActivityDate="2017-02-08T00:50:56.517" Title="PC IP address through internet to ping VPN host" Tags="|cisco-asa|vpn|firewall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33902" PostTypeId="2" ParentId="33901" CreationDate="2016-08-09T21:33:23.883" Score="1" Body="&lt;p&gt;For ping you need to allow ICMP Type: 0, 8 thru ASA&#xA;Depend of technology used for VPN it could be 500/UDP, 4500/UDP, 5000/UDP, ESP[50], 443/TCP, 1723/GRE[47]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If inside host if based on RFC1918 and need to be accesible from internet than you need add NAT statment as well.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-09T21:33:23.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33904" PostTypeId="1" AcceptedAnswerId="33906" CreationDate="2016-08-09T23:01:06.747" Score="3" ViewCount="659" Body="&lt;p&gt;How is bandwidth managed in an unmanaged network switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose that port 1 is connected to a a very busy server. If suddenly machines connected to ports 2, 3 and 4 decide to send a massive amount of packets (in an extreme scenario: at maximum theoretical throughput) to the server in port 1, how will the switch handle this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the switch perform any sort of flow control, ensuring that each sending port gets a fair share of the available bandwidth to port 1, or will they simply be served in a &quot;first come, first served&quot; manner (obviously, dropping packets as necessary)?&lt;/p&gt;&#xA;" OwnerUserId="29544" LastActivityDate="2016-08-09T23:45:54.583" Title="Switch bandwidth management" Tags="|switch|bandwidth|management|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33905" PostTypeId="1" CreationDate="2016-08-09T23:06:08.477" Score="2" ViewCount="2052" Body="&lt;p&gt;Is there a major difference between stateful firewalls that exist in the traditional networks and those that exist in SDN environment? In other word, do we have some special firewall devices that only work in SDN-based network? &lt;/p&gt;&#xA;" OwnerUserId="28219" LastActivityDate="2018-04-10T08:20:40.870" Title="How firewalls differ between traditional networks and SDN" Tags="|cisco|firewall|sdn|openflow|" AnswerCount="4" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33906" PostTypeId="2" ParentId="33904" CreationDate="2016-08-09T23:14:51.117" Score="2" Body="&lt;p&gt;In your scenario, most ethernet frames will be dropped, and it is up to the upper-layer protocols, e.g. TCP, to handle that. There is a rudimentary ethernet flow control, but it is poorly supported. Switches only have tiny buffers, and a 3:1 bandwidth over-subscription will really cause a 3:1 frame drop rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet (layer-2 frames), and IP (layer-3 packets) will really play no part in this. TCP (layer-4 segments) guarantees delivery by requesting dropped segments be resent and shrinking the TCP windows. UDP, or other connectionless protocols, will need an application to request lost data to be resent.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-09T23:14:51.117" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33907" PostTypeId="2" ParentId="33904" CreationDate="2016-08-09T23:39:44.623" Score="0" Body="&lt;p&gt;You will encounter overruns. Which indicate number of times receiver hardware wasn't able to deliver received  data into a hardware buffer. Usually hardware buffer is is shared with other ports for example ports 1-8 share same buffer and ASIC. In some switches models if ASIC buffer is overload than data is queued to general buffer but this is causing what we calling punting and slows down whole switch as packets need to be processed by CPU.  packets which would not fit into hardware or general buffer will be dropped. But in your scenario wouldn't really be a issue. Issue is when you have more traffic than backplane could handle. &lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2016-08-09T23:45:54.583" LastActivityDate="2016-08-09T23:45:54.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33909" PostTypeId="2" ParentId="33823" CreationDate="2016-08-10T05:40:32.917" Score="2" Body="&lt;p&gt;The OSI network layers model is just that, a &lt;strong&gt;model&lt;/strong&gt;.  Specific instantiations may fit better or worse.  Note also that the TCP/IP protocol suite was designed &lt;em&gt;before&lt;/em&gt; the OSI model and so the match may often be even more tenuous.  But, one of the features of the model is that there are &lt;em&gt;interfaces&lt;/em&gt; between the layers, and when you map TCP/IP onto the OSI model part of the interface between the layers 2 through 4 includes communicating the values that go into the MTU/MSS calculations.  The upper layers don't &lt;em&gt;have&lt;/em&gt; to get this data and can operate without it, but they can operate so much more efficiently if they have it.&lt;/p&gt;&#xA;" OwnerUserId="6388" LastActivityDate="2016-08-10T05:40:32.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33910" PostTypeId="1" CreationDate="2016-08-10T07:05:58.410" Score="6" ViewCount="15297" Body="&lt;p&gt;How can i add a host to an already existing object group in ASA, without over-writing the already existing members ? Please suggest&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;For Example:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Object  group TEST has 2 members, and i want to add one more host (192.168.10.10) to TEST, will the below add the one host or replace the existing 2 hosts with the new host&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA (config)#object-group network TEST&#xA;ASA (config-network)#network-object host 192.168.10.10&#xA;ASA (config-network)# exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29552" LastActivityDate="2017-11-28T16:17:33.117" Title="How can i add a host to an already existing object group in ASA" Tags="|cisco-asa|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33912" PostTypeId="2" ParentId="33910" CreationDate="2016-08-10T07:52:05.270" Score="4" Body="&lt;p&gt;Your example is adding the host to the object-group. This will not remove any existing entries.&#xA;To remove hosts you need to do the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network TEST&#xA; no network-object &amp;lt;object-to-be-removed&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="18743" LastActivityDate="2016-08-10T07:52:05.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33913" PostTypeId="2" ParentId="33910" CreationDate="2016-08-10T08:55:40.463" Score="6" Body="&lt;p&gt;this type of object group is calles &lt;strong&gt;Network Object Group&lt;/strong&gt; ,&#xA;so to create a network group that includes the IP addresses of three administrators for example , enter the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname (config)# object-group network admins  &#xA;hostname (config-protocol)# description Administrator Addresses  &#xA;hostname (config-protocol)# network-object host 10.1.1.4  &#xA;hostname (config-protocol)# network-object host 10.1.1.78  &#xA;hostname (config-protocol)# network-object host 10.1.1.34&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;there is no problem to add any entry to same exiting Object Group ,it won't remove any existing entry &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/objectgroups.html#wp1071777&quot;&gt;Cisco ASA 5500 Series Configuration Guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;by the way &lt;strong&gt;&lt;em&gt;ASDM&lt;/em&gt;&lt;/strong&gt; will be batter in such firewall configuration and will give you better visibility. &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-08-10T08:55:40.463" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33914" PostTypeId="2" ParentId="16223" CreationDate="2016-08-10T09:02:50.347" Score="2" Body="&lt;p&gt;If it's an inbound ACL then it's all right. But if you have applied same list to outbound traffic to interface, then it will result in dropping NTP responses back to your host. Your outbound ACL should look like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended ACL-Out&#xA; permit udp X Y eq 123 host HOST1&#xA; deny ip any any log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29556" LastActivityDate="2016-08-10T09:02:50.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33915" PostTypeId="2" ParentId="16223" CreationDate="2016-08-10T09:57:12.960" Score="2" Body="&lt;p&gt;You can make a reflexive ACL, which will allow the response packet to go through.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit udp hosta hostb eq &amp;lt;port&amp;gt; reflect&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29551" LastActivityDate="2016-08-10T09:57:12.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33918" PostTypeId="1" AcceptedAnswerId="33925" CreationDate="2016-08-10T12:15:42.003" Score="2" ViewCount="226" Body="&lt;pre&gt;&lt;code&gt;interface g0/2&#xA;      service instance 1 ethernet&#xA;        encapsulation dot1q 18&#xA;        rewrite ingres tag pop 1 symmetric&#xA;        bridge-domain 44&#xA;      service instance 2 ethernet&#xA;        encapsulation dot1q 66&#xA;        rewrite ingress tag pop 1 symmetric&#xA;       bridge-domain 44&#xA;    !&#xA;    interface Vlan44&#xA;      ip address 192.168.1.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the above config likely to achieve?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please explain line by line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the vlan 18 tagged traffic comes to this interface,it will be placed in&#xA;service instance 1 .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The vlan18 tag will be popped out&#xA;Now 'bridge-domain 44' will result in looking at the vlan 44 for the destination mac.&#xA;If found ,all OK&#xA;else:&#xA; If the destination is out the other Service Instance, the frame will be placed on Service Instance 2 and a new VLAN tag(tag 66) will be added&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a.Please validate this understanding&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b.Using the above,we are making vlan 18 talk to vlan 66 ? Is that the only objective?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c.How on earth, for 2 different vlan tags(vlan tag 18 and vlan tag 66) be using the same ip address(for routing)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip address 192.168.1.1 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;d.I am also remembering traditional dot1q subinterfacing(router on a stick) method.Using that i could do inter-vlan routing?Why do i need such a complex scenario?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e.If we were to connect a L2 switch to this interface g0/2,and say we have a PC one connected to switch on vlan 18, what would be it's gateway?&#xA;Similarly , i connect another PC two(vlan 66) to switch,what would be the gateway?&#xA;How can i make PC one and PC two talk to each other? &lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="2142" LastEditDate="2016-08-10T13:41:35.910" LastActivityDate="2016-08-10T14:03:23.127" Title="Regarding service instance" Tags="|routing|switch|switching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33919" PostTypeId="1" AcceptedAnswerId="33920" CreationDate="2016-08-10T12:28:12.553" Score="2" ViewCount="2715" Body="&lt;p&gt;I'm trying to get my head around VLAN terms tagged, untagged, and PVID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my understanding so far:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;every port on a switch can be mapped to a particular VLAN.&lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;when a packet (assigned to a VLAN) enters the switch it will leave all other ports which are assigned to the same VLAN as the packet.&lt;/s&gt; &lt;em&gt;(Incorrect, see answer below)&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;When the packet leaves it can either leave &lt;strong&gt;untagged&lt;/strong&gt;, or be &lt;strong&gt;tagged&lt;/strong&gt;, and this is determined per port depending if the port is configured to be &lt;strong&gt;tagged&lt;/strong&gt; for that VLAN, or &lt;strong&gt;untagged&lt;/strong&gt; for that VLAN.&lt;/li&gt;&#xA;&lt;li&gt;If an untagged packet enters the switch on a port, it is automatically tagged with the VLAN which corresponds to the &lt;strong&gt;PVID&lt;/strong&gt; of the port it entered on.&lt;/li&gt;&#xA;&lt;li&gt;&lt;s&gt;If a tagged packet enters the switch on a port, it will continue into the switch with the VLAN it was tagged as.&lt;/s&gt; &lt;em&gt;(Incorrect, see answer below)&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is my last point correct?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I would like to split my netgear FSM726 switch into 2 isolated switches using VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was going to therefore have 2 VLANS with ID 1 and 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the first half of the switch the PVID would be set to 1, and the ports would be set to untagged on VLAN1, with the rest of the ports omitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the second half of the switch the PVID would be set to 2, and the ports would be set to untagged on VLAN2, with the rest of the ports omitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think this would work but &lt;strong&gt;couldn't someone plugged into the first half of the switch send a packet tagged with VLAN ID 2, and therefore have it exit on the second half of the switch&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="29563" LastEditorUserId="29563" LastEditDate="2016-08-10T12:55:25.090" LastActivityDate="2016-12-15T13:37:10.580" Title="Splitting a switch with VLANS. Is it secure?" Tags="|switch|vlan|ethernet|security|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33920" PostTypeId="2" ParentId="33919" CreationDate="2016-08-10T12:47:05.770" Score="5" Body="&lt;p&gt;When a tagged frame (it's Layer 2 we are talking about so we are dealing with frames, not packets) enter the switch, it will be verified against the authorized VLANs for the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the VLAN2 is not authorized on the port, the frame will be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yes, if properly configured, it's secure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that as a best practice, you shouldn't use VLAN1, and by default netgear use VLAN2 as the voice vlan (you can still use it but it may be easier to choose another one)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also the statement &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;when a packet (assigned to a VLAN) enters the switch it will leave&#xA;  all other ports which are assigned to the same VLAN as the packet.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;is incorrect. The switch first determine the destination port (based on the destination mac) and the send the frame out of this port, tagged or untagged depending on the port configuration for this vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(only if this is a broadcast or the switch doesn't know the destination mac address will it be flooded to all ports pertaining to this vlan) &lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-08-10T12:47:05.770" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33925" PostTypeId="2" ParentId="33918" CreationDate="2016-08-10T14:03:23.127" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If the vlan 18 tagged traffic comes to this interface,it will be&#xA;  placed in service instance 1 .&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Correct&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The vlan18 tag will be popped out Now 'bridge-domain 44' will result&#xA;  in looking at the vlan 44 for the destination mac. If found ,all OK&#xA;  else: If the destination is out the other Service Instance, the frame&#xA;  will be placed on Service Instance 2 and a new VLAN tag(tag 66) will&#xA;  be added&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Close.   I confess I'm not 100% sure if the tags need to be explicily translated like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rewrite ingress tag translate 1-to-1 dot1q 66 symmetric&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;rather than the way you have it.  I would have to lab it up to be sure.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;a.Please validate this understanding&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;b.Using the above,we are making vlan 18 talk to vlan 66 ? Is that the&#xA;  only objective?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You also have a layer three interface, 192.168.1.1&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;c.How on earth, for 2 different vlan tags(vlan tag 18 and vlan tag 66)&#xA;  be using the same ip address(for routing)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ip address 192.168.1.1 255.255.255.0&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Since VLANs are layer 2 and IP is layer 3, they operate independently of each other.  VLANs don't know about subnets, and IP doesn't know about VLAN tags.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;d.I am also remembering traditional dot1q subinterfacing(router on a&#xA;  stick) method.Using that i could do inter-vlan routing?Why do i need&#xA;  such a complex scenario?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You are not doing routing.  Even though there are two VLANs, at layer 3 they are the same subnet. If you have devices on different IP subnets on each VLAN, they will not be able to talk to each other.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;e.If we were to connect a L2 switch to this interface g0/2,and say we&#xA;  have a PC one connected to switch on vlan 18, what would be it's&#xA;  gateway? Similarly , i connect another PC two(vlan 66) to switch,what&#xA;  would be the gateway? How can i make PC one and PC two talk to each&#xA;  other?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They would have to be in the same IP subnet, and their gateway would (normally) be 192.168.1.1&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-10T14:03:23.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33927" PostTypeId="1" AcceptedAnswerId="33935" CreationDate="2016-08-10T15:43:29.307" Score="0" ViewCount="799" Body="&lt;p&gt;Hope anyone help me to inform me how can connect  between two branches &amp;amp; what the technology use it and what devices need to pay on this project? ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sincerely, &lt;/p&gt;&#xA;" OwnerUserId="29568" LastActivityDate="2016-08-10T21:28:10.383" Title="Connect between two branches" Tags="|cisco|routing|router|network-core|network-access|" AnswerCount="1" CommentCount="6" ClosedDate="2016-08-10T22:13:19.107" ContentLicense="CC BY-SA 3.0" />
  <row Id="33930" PostTypeId="1" AcceptedAnswerId="33974" CreationDate="2016-08-10T18:47:01.053" Score="1" ViewCount="2002" Body="&lt;p&gt;I'm trying to migrate an ASA 5505 to IKEV2 using &lt;em&gt;migrate l2l&lt;/em&gt; with CLI and get this error: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;ERROR: ipsec policy insertion failed because the maximum proposal limit of 20 was exceeded&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA OS is 9.2.3 and there is currently a site to site VPN tunnel with IKEV1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've straightened out the policies - I believe - but while the IKEV1 tunnel works the V2 doesn't. Here is the configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 9.2(3) &#xA;!&#xA;hostname sollo&#xA;domain-name domain.com&#xA;enable password .XXXXXXXXXXXXX encrypted&#xA;xlate per-session deny tcp any4 any4&#xA;xlate per-session deny tcp any4 any6&#xA;xlate per-session deny tcp any6 any4&#xA;xlate per-session deny tcp any6 any6&#xA;xlate per-session deny udp any4 any4 eq domain&#xA;xlate per-session deny udp any4 any6 eq domain&#xA;xlate per-session deny udp any6 any4 eq domain&#xA;xlate per-session deny udp any6 any6 eq domain&#xA;passwd XXXXXXXXXXXXX encrypted&#xA;names&#xA;ip local pool vpool 192.168.20.10-192.168.20.20 mask 255.255.255.0&#xA;ip local pool mypool 192.168.11.10-192.168.11.20 mask 255.255.255.0&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.100.101.254 255.255.255.0 &#xA; ospf cost 10&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 12.34.56.78 255.255.255.248 &#xA; ospf cost 10&#xA;!&#xA;boot system disk0:/asa923-k8.bin&#xA;boot system disk0:/asa847-31-k8.bin&#xA;ftp mode passive&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring&#xA;dns server-group DefaultDNS&#xA; domain-name domain.com&#xA;object network obj-10.100.101.0&#xA; subnet 10.100.101.0 255.255.255.0&#xA;object network obj-10.100.100.0&#xA; subnet 10.100.100.0 255.255.255.0&#xA;object network obj_any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network NETWORK_OBJ_10.100.101.0_24&#xA; subnet 10.100.101.0 255.255.255.0&#xA;object network NETWORK_OBJ_10.100.200.0_24&#xA; subnet 10.100.200.0 255.255.255.0&#xA;object-group service allowedports tcp&#xA; port-object eq pptp&#xA;access-list tomiddle extended permit ip 10.100.101.0 255.255.255.0 10.100.100.0 255.255.255.0 &#xA;access-list split standard permit 10.100.101.0 255.255.255.0 &#xA;no pager&#xA;logging enable&#xA;logging asdm notifications&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-731-101.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;arp permit-nonconnected&#xA;nat (inside,any) source static obj-10.100.101.0 obj-10.100.101.0 destination static obj-10.100.100.0 obj-10.100.100.0 no-proxy-arp&#xA;!&#xA;object network obj_any&#xA; nat (inside,outside) dynamic interface&#xA;route outside 0.0.0.0 0.0.0.0 64.223.94.1 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL &#xA;aaa authorization command LOCAL &#xA;http server enable&#xA;http 10.100.100.0 255.255.255.0 inside&#xA;http 10.100.101.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec ikev1 transform-set myset esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev2 ipsec-proposal ESP-3DES-SHA-TRANS&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-3DES-MD5&#xA; protocol esp encryption 3des&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-256-MD5-TRANS&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-256-SHA-TRANS&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-192-MD5-TRANS&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-192-SHA-TRANS&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-128-MD5-TRANS&#xA; protocol esp encryption aes&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-128-SHA-TRANS&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-256-MD5&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-256-SHA&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-192-MD5&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-192-SHA&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-128-MD5&#xA; protocol esp encryption aes&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-128-SHA&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal myset&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal DES&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA;protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES192&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1 md5&#xA; crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec security-association pmtu-aging 20&#xA;crypto dynamic-map outside_dyn_map 20 set pfs group5&#xA;crypto dynamic-map outside_dyn_map 20 set ikev1 transform-set myset&#xA;crypto dynamic-map outside_dyn_map 40 set pfs group5&#xA;crypto dynamic-map outside_dyn_map 40 set ikev1 transform-set ESP-3DES-SHA&#xA;crypto map mymap 10 match address tomiddle&#xA;crypto map mymap 10 set peer 87.65.43.21 &#xA;crypto map mymap 10 set ikev1 transform-set myset&#xA;crypto map mymap 10 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES myset&#xA;crypto map mymap 65535 ipsec-isakmp dynamic outside_dyn_map&#xA;crypto map mymap interface outside&#xA;crypto ca trustpool policy&#xA;crypto ikev2 policy 1&#xA; encryption aes-256&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 10&#xA; encryption aes-256&#xA; integrity sha&#xA; group 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 20&#xA; encryption aes&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 30&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 40&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 enable outside&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 am-disable&#xA;crypto ikev1 policy 10&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;ssh stricthostkeycheck&#xA;ssh 10.100.100.0 255.255.255.0 inside&#xA;ssh 10.100.101.0 255.255.255.0 inside&#xA;ssh timeout 60&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 3&#xA;management-access inside&#xA;&#xA;dhcpd address 10.100.101.70-10.100.101.73 inside&#xA;    !&#xA;threat-detection basic-threat&#xA;no threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-idle-timeout none&#xA; vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec &#xA;username phsrx password LFjGdPBp3.PJH2wz encrypted privilege 15&#xA;tunnel-group 87.65.43.21 type ipsec-l2l&#xA;tunnel-group 87.65.43.21 ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect icmp &#xA;  inspect icmp error &#xA; !&#xA;&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;Cryptochecksum:18ae193gervtt3tv3565436j3456eth06ed&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27364" LastEditorUserId="27364" LastEditDate="2016-08-11T14:04:45.603" LastActivityDate="2016-12-09T19:02:09.440" Title="Cisco ASA 5505 ipsec - Can't create IKEV2" Tags="|cisco|vpn|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33932" PostTypeId="2" ParentId="33919" CreationDate="2016-08-10T20:19:05.717" Score="1" Body="&lt;p&gt;For completeness, VLANs can be insecure if attackers deploy VLAN hopping and certain conditions are met (from &lt;a href=&quot;https://en.wikipedia.org/wiki/VLAN_hopping&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/VLAN_hopping&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Switch spoofing&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In a switch spoofing attack, an attacking host&#xA;  imitates a trunking switch by speaking the tagging and trunking&#xA;  protocols (e.g. Multiple VLAN Registration Protocol, IEEE 802.1Q,&#xA;  Dynamic Trunking Protocol) used in maintaining a VLAN. Traffic for&#xA;  multiple VLANs is then accessible to the attacking host.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Mitigation&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Switch spoofing can only be exploited when interfaces&#xA;  are set to negotiate a trunk. To prevent this attack on Cisco IOS, use&#xA;  one of the following methods:&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Ensure that ports are not set to negotiate trunks automatically by disabling DTP:&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;Switch(config-if)# switchport nonegotiate&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;Ensure that ports that are not meant to be trunks are explicitly configured as access ports&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;Switch(config-if)# switchport mode access Double tagging&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In a&#xA;  double tagging attack, an attacking host connected on a 802.1q&#xA;  interface prepends two VLAN tags to packets that it transmits. The&#xA;  packet (which corresponds to the VLAN that the attacker is really a&#xA;  member of) is forwarded without the first tag, because it is the&#xA;  native VLAN. The second (false) tag is then visible to the second&#xA;  switch that the packet encounters. This false VLAN tag indicates that&#xA;  the packet is destined for a target host on a second switch. The&#xA;  packet is then sent to the target host as though it originated on the&#xA;  target VLAN bypassing the network mechanisms that logically isolate&#xA;  VLANs from one another. However, this attack allows to send packets&#xA;  toward the second switch, but possible answers are not forwarded to&#xA;  the attacking host.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Mitigation&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Double Tagging can only be exploited when switches&#xA;  use &quot;Native VLANs&quot;.[2] Ports with a specific access VLAN (the native&#xA;  VLAN) don't apply a VLAN tag when sending frames, allowing the&#xA;  attacker's fake VLAN tag to be read by the next switch.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Double Tagging can be mitigated by either one of the following actions&#xA;  (Incl. IOS example):&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Simply do not put any hosts on VLAN 1 (The default VLAN). i.e., assign&#xA;  an access VLAN other than VLAN 1 to every access port &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;Switch(config-if)# switchport access vlan 2&lt;/code&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Change the native VLAN on&#xA;  all trunk ports to an unused VLAN ID. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;Switch(config-if)# switchport trunk native vlan 999&lt;/code&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Explicit tagging of the native VLAN on all trunk&#xA;  ports. Must be configured on all switches in network autonomy.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;Switch(config)# vlan dot1q tag native&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Example&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;As an example of a&#xA;  double tagging attack, consider a secure web server on a VLAN called&#xA;  VLAN2. Hosts on VLAN2 are allowed access to the web server; hosts from&#xA;  outside VLAN2 are blocked by layer 3 filters. An attacking host on a&#xA;  separate VLAN, called VLAN1(Native), creates a specially formed packet&#xA;  to attack the web server. It places a header tagging the packet as&#xA;  belonging to VLAN2 under the header tagging the packet as belonging to&#xA;  VLAN1. When the packet is sent, the switch sees the default VLAN1&#xA;  header and removes it and forwards the packet. The next switch sees&#xA;  the VLAN2 header and puts the packet in VLAN2. The packet thus arrives&#xA;  at the target server as though it was sent from another host on VLAN2,&#xA;  ignoring any layer 3 filtering that might be in place.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-10T20:19:05.717" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33934" PostTypeId="2" ParentId="33930" CreationDate="2016-08-10T21:24:07.623" Score="0" Body="&lt;p&gt;Each configuration supports a maximum of 20 ISAKMP policies, each with a different set of values. Assign a unique priority to each policy you create. The lower the priority number, the higher the priority. Just simple you cannot have more than 20 ISAKMP policies. You can add additional ISAKMP policies by deleting unsed one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/ike.html&quot; rel=&quot;nofollow&quot;&gt;LINK&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2016-08-10T21:33:11.440" LastActivityDate="2016-08-10T21:33:11.440" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33935" PostTypeId="2" ParentId="33927" CreationDate="2016-08-10T21:28:10.383" Score="0" Body="&lt;p&gt;There is many way you can achive it but most common are:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Site to site Ipsec tunnel over internet&lt;/li&gt;&#xA;  &lt;li&gt;MPLS circut&lt;/li&gt;&#xA;  &lt;li&gt;MetroEthernet&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-10T21:28:10.383" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="33936" PostTypeId="2" ParentId="26764" CreationDate="2016-08-10T21:43:23.253" Score="1" Body="&lt;p&gt;If destination hosts is sending echo replay response and is not recived by sender.&#xA;There could be two common issues:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Packet from intranet network is not allowed to go outside.&lt;/li&gt;&#xA;  &lt;li&gt;NAT statment could be missing if NAT is in use.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-10T21:43:23.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33937" PostTypeId="1" CreationDate="2016-08-10T22:05:23.193" Score="1" ViewCount="304" Body="&lt;p&gt;How does a Stateless firewall or any device using just ACLs allow return traffic if no state is being maintained? If I am using a Cisco router that has ACL configured for Internet traffic, how is the traffic from the internet being allowed back in if it doesn't maintain a state table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="29577" LastActivityDate="2016-08-10T22:10:35.947" Title="Stateless firewalls" Tags="|firewall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33938" PostTypeId="2" ParentId="33937" CreationDate="2016-08-10T22:10:35.947" Score="2" Body="&lt;p&gt;There is need for output and input rules. A stateless firewall filter, also known as an access control list (ACL), does not statefully inspect traffic. Instead, it evaluates packet contents statically and does not keep track of the state of network connections. In contrast, a stateful firewall filter uses connection state information derived from other applications and past communications in the data flow to make dynamic control decisions.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-08-10T22:10:35.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33941" PostTypeId="1" AcceptedAnswerId="33955" CreationDate="2016-08-10T23:38:21.990" Score="2" ViewCount="1363" Body="&lt;p&gt;The routers on a stick are running VRRP on g0/0.10, g0/0.20 and g0/0.30.&lt;br&gt;&#xA;On switches, ports fa0/1-8 are on VLAN 10, fa0/23 and fa0/24 are configured as trunk port, with allowed VLANs 10, 20 and 30.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Show VRRP on HQ2 shows that all VRRP are as master, but on HQ1, they show as init, router are 2900 running IOS 15.1 and switch are 3560 running IOS 12.2,&lt;br&gt;&#xA;I had the router on a stick running on 1 router and 1 switch with no problem and also VRRP running on a single switch with no problem, but there is something I do not understand here!  there is no other config on router and switches.&lt;br&gt;&#xA;address on HQ2 have been change to x.x.x.253. &#xA;config HQ1  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; HQ1&amp;gt;show run&#xA;          ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;HQ1&amp;gt;ena&#xA;Current configuration : 1712 bytes  &#xA;version 15.4  &#xA;hostname HQ1  &#xA;ip cef  &#xA;redundancy  &#xA;interface GigabitEthernet0/0  &#xA; no ip address  &#xA; duplex auto  &#xA; speed auto  &#xA;interface GigabitEthernet0/0.10  &#xA; encapsulation dot1Q 10  &#xA; ip address 192.168.222.254 255.255.255.0  &#xA; vrrp 1 ip 192.168.222.100 &#xA;interface GigabitEthernet0/0.20  &#xA; encapsulation dot1Q 20  &#xA; ip address 192.168.223.254 255.255.255.0  &#xA; vrrp 2 ip 192.168.223.100  &#xA;interface GigabitEthernet0/0.30  &#xA; encapsulation dot1Q 30 native  &#xA; ip address 192.168.224.254 255.255.255.0  &#xA; vrrp 3 ip 192.168.224.100  &#xA;interface GigabitEthernet0/1  &#xA; ip address 200.100.0.14 255.255.255.252  &#xA; duplex auto  &#xA; speed auto  &#xA;interface Serial0/0/0  &#xA; ip address 10.1.1.1 255.255.255.252  &#xA; clock rate 2000000  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configuration on the other router is the same except that address for g0/0.10 .20 and .30 terminate with 253 instead of 254 and of course the address for the serial connection is different. also discover a bad port on the switch so both VRRP are saying master now, so they do not communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oyFig.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oyFig.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HQ1(config-subif)#do show vrrp  &#xA;GigabitEthernet0/0.10 - Group 1  &#xA;  State is Backup  &#xA;  Virtual IP address is 192.168.222.100  &#xA;  Virtual MAC address is 0000.5e00.0101  &#xA;  Advertisement interval is 1.000 sec  &#xA;  Preemption enabled  &#xA;  Priority is 100  &#xA;  Master Router is 192.168.222.253, priority is 150  &#xA;  Master Advertisement interval is 1.000 sec  &#xA;  Master Down interval is 3.609 sec (expires in 3.369 sec)  &#xA;&#xA;GigabitEthernet0/0.20 - Group 2  &#xA;  State is Backup  &#xA;  Virtual IP address is 192.168.223.100  &#xA;  Virtual MAC address is 0000.5e00.0102  &#xA;  Advertisement interval is 1.000 sec  &#xA;  Preemption enabled  &#xA;  Priority is 100  &#xA;  Master Router is 192.168.223.253, priority is 150  &#xA;  Master Advertisement interval is 1.000 sec  &#xA;  Master Down interval is 3.609 sec (expires in 3.153 sec)  &#xA;&#xA;GigabitEthernet0/0.30 - Group 3  &#xA;  State is Master  &#xA;  Virtual IP address is 192.168.224.100  &#xA;  Virtual MAC address is 0000.5e00.0103  &#xA;  Advertisement interval is 1.000 sec  &#xA;  Preemption enabled  &#xA;  Priority is 100  &#xA;  Master Router is 192.168.224.254 (local), priority is 100  &#xA;  Master Advertisement interval is 1.000 sec  &#xA;  Master Down interval is 3.609 sec  &#xA;&#xA;HQ2#show vrrp  &#xA;GigabitEthernet0/0.10 - Group 1  &#xA;  State is Master  &#xA;  Virtual IP address is 192.168.222.100  &#xA;  Virtual MAC address is 0000.5e00.0101  &#xA;  Advertisement interval is 1.000 sec  &#xA;  Preemption enabled  &#xA;  Priority is 150  &#xA;  Master Router is 192.168.222.253 (local), priority is 150  &#xA;  Master Advertisement interval is 1.000 sec  &#xA;  Master Down interval is 3.414 sec  &#xA;&#xA;GigabitEthernet0/0.20 - Group 2  &#xA;  State is Master  &#xA;  Virtual IP address is 192.168.223.100  &#xA;  Virtual MAC address is 0000.5e00.0102  &#xA;  Advertisement interval is 1.000 sec  &#xA;  Preemption enabled  &#xA;  Priority is 150  &#xA;  Master Router is 192.168.223.253 (local), priority is 150  &#xA;  Master Advertisement interval is 1.000 sec  &#xA;  Master Down interval is 3.414 sec  &#xA;&#xA;GigabitEthernet0/0.30 - Group 3  &#xA;  State is Master  &#xA;  Virtual IP address is 192.168.224.100  &#xA;  Virtual MAC address is 0000.5e00.0103  &#xA;  Advertisement interval is 1.000 sec  &#xA;  Preemption enabled  &#xA;  Priority is 150  &#xA;  Master Router is 192.168.224.253 (local), priority is 150  &#xA;  Master Advertisement interval is 1.000 sec  &#xA;  Master Down interval is 3.414 sec  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29538" LastEditorUserId="8499" LastEditDate="2016-08-11T14:31:33.630" LastActivityDate="2016-11-10T21:58:23.877" Title="router on a stick and VRRP on the same router and full redundancy possible?" Tags="|trunk|redundancy|vrrp|" AnswerCount="1" CommentCount="20" ContentLicense="CC BY-SA 3.0" />
  <row Id="33945" PostTypeId="1" AcceptedAnswerId="33976" CreationDate="2016-08-11T07:03:08.537" Score="1" ViewCount="3138" Body="&lt;p&gt;I have some problems with a very simple DHCP snooping configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pVEC6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pVEC6.png&quot; alt=&quot;My topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using a very simple topology using router on a stick. I use VLAN 10 and VLAN 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Clients can get DHCP from my router when dhcp snooping is not enabled on my switch, but when I enable snooping they can no longer get an IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My switch has interface f0/6 and f0/11 as access ports, f0/6 is on vlan 10 and f0/11 is on vlan 20. f0/1 is in trunking mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My switch config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch DHCP snooping is enabled&#xA;DHCP snooping is configured on following VLANs:&#xA;1-100&#xA;Insertion of option 82 is enabled&#xA;Option 82 on untrusted port is not allowed&#xA;Verification of hwaddr field is enabled&#xA;Interface                  Trusted    Rate limit (pps)&#xA;-----------------------    -------    ----------------&#xA;FastEthernet0/1            yes        unlimited       &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have full connectivity when DHCP snooping is not enabled so I'm only asking why it doesn't work when snooping is enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My &quot;show run&quot; config on switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;ip dhcp relay information trust-all&#xA;!&#xA;ip dhcp snooping vlan 1-100&#xA;ip dhcp snooping&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport trunk native vlan 99&#xA; ip dhcp snooping trust&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/11&#xA; switchport access vlan 20&#xA; switchport mode access&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan10&#xA; no ip address&#xA; ip helper-address 192.168.1.1&#xA;!&#xA;interface Vlan20&#xA; no ip address&#xA; ip helper-address 192.168.2.1&#xA;!&#xA;interface Vlan99&#xA; ip address 192.168.99.99 255.255.255.0&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My &quot;show run&quot; config on router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp relay information trust-all&#xA;!&#xA;ip dhcp excluded-address 192.168.1.1&#xA;ip dhcp excluded-address 192.168.2.1&#xA;!&#xA;ip dhcp pool VLAN10&#xA; network 192.168.1.0 255.255.255.0&#xA; default-router 192.168.1.1&#xA;ip dhcp pool VLAN20&#xA; network 192.168.2.0 255.255.255.0&#xA; default-router 192.168.2.1&#xA;!&#xA;interface GigabitEthernet0/0.10&#xA; encapsulation dot1Q 10&#xA; ip address 192.168.1.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/0.20&#xA; encapsulation dot1Q 20&#xA; ip address 192.168.2.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21058" LastEditorUserId="21058" LastEditDate="2016-08-11T08:37:44.537" LastActivityDate="2022-01-09T08:39:39.323" Title="DHCP snooping problem" Tags="|cisco|switch|router|dhcp-snooping|" AnswerCount="4" CommentCount="19" ContentLicense="CC BY-SA 3.0" />
  <row Id="33946" PostTypeId="1" AcceptedAnswerId="33951" CreationDate="2016-08-11T08:14:34.900" Score="1" ViewCount="1175" Body="&lt;p&gt;I set up on an Alcatel OS6960E (via console cable) a VLAN 99 with ip addr 192.168.164.33. My laptop ethernet ip is 192.168.164.29. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I connected my laptop to ethernet port 1/1/1 assigned to VLAN 99 but I can't ping or ssh to 192.168.164.33. What am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The commands I used are: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 99 name &quot;IP management&quot;&#xA;vlan 99 members port 1/1/1 untagged&#xA;ip interface vlan_99_ip address 192.168.164.33&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29584" LastActivityDate="2016-10-10T15:28:31.127" Title="Alcatel OS6860E ethernet ssh" Tags="|switch|ssh|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33951" PostTypeId="2" ParentId="33946" CreationDate="2016-08-11T10:51:12.580" Score="1" Body="&lt;p&gt;To enable or disable the administrative status for an existing VLAN, enter &#xA;vlan&#xA; followed by an existing &#xA;VLAN ID and either &#xA;enable&#xA; or &#xA;disable&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;--&gt; vlan 99 enable&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Give this a go and see if that works. It's worth checking the status of the VLAN interface and make sure it isn't down. I got this from the configuration guide &lt;a href=&quot;http://enterprise.alcatel-lucent.com/assets/documents/os_nt_664_revD1.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt; on page 112.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-08-11T10:51:12.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33953" PostTypeId="2" ParentId="33945" CreationDate="2016-08-11T13:03:19.503" Score="0" Body="&lt;p&gt;When using DHCP snooping, I have often seen that you need to apply the following command to disable the relaying of DHCP option 82 to the DHCP server for it to actually work. Unless, of course, your DHCP server is set up with regards to option 82, which it is not in your case.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip dhcp snooping information option&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3442" LastActivityDate="2016-08-11T13:03:19.503" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33954" PostTypeId="2" ParentId="33862" CreationDate="2016-08-11T13:24:15.700" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;We(sender) send a packet of data(ping) and if the server is up, it'll send back a packet&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is not the definition of client/server, it just means you have bidirectional traffic, which you also have in p2p applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One could argue that strictly speaking the &quot;ping&quot; utility (application?) that you execute,  can be considered to be a &lt;em&gt;client&lt;/em&gt; because it always sends echo requests and then processes the responses it gets. And so the part of the IP stack in the remote device that sends back the echo could be considered a &lt;em&gt;server&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way of looking at it is that every device on an IP network can send echo requests &lt;em&gt;and&lt;/em&gt; respond to them, so from this perspective there are no clients vs servers but all are equal peers, and hence &quot;pinging&quot; (what I assume you mean with the &quot;ping application&quot;) is more of a kind of peer-to-peer functionality.  Which I &lt;em&gt;guess&lt;/em&gt; it what laika and Datagrem.Network are hinting at in their answers, but not explicitly saying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the end IMHO it's more of a semantic than a really technical discussion, and I would even argue that ping is not even an &quot;application&quot; to begin with.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-08-11T13:24:15.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33955" PostTypeId="2" ParentId="33941" CreationDate="2016-08-11T13:30:48.980" Score="1" Body="&lt;p&gt;OK, I found the problem, for some reason erasing the startup-config did not really erased everything, So I went in rommon and reset HQ2 to factory default and it is working.&lt;/p&gt;&#xA;" OwnerUserId="29538" LastActivityDate="2016-08-11T13:30:48.980" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="33957" PostTypeId="1" CreationDate="2016-08-11T13:52:22.603" Score="0" ViewCount="1907" Body="&lt;p&gt;I want to know how to solve the communication with associated wifi devices when AP switch to monitoring mode.&#xA;Because I want to use the monitoring mode without effects the mobile that was associated in that time.&lt;/p&gt;&#xA;" OwnerUserId="25735" LastActivityDate="2016-08-11T14:37:52.320" Title="How do behave the AP during monitoring mode?" Tags="|wireless|monitoring|access-point|" AnswerCount="1" CommentCount="3" ClosedDate="2017-08-14T23:08:21.753" ContentLicense="CC BY-SA 3.0" />
  <row Id="33958" PostTypeId="2" ParentId="33957" CreationDate="2016-08-11T14:09:17.687" Score="4" Body="&lt;p&gt;Monitor Mode provides constant channel scanning with attack detection and forensics (packet capture) capabilities. Capture packets regardless of connected network. No association to AP needed (and no authentication). Because it is not connected to a network, you can't process the Wi-Fi frames. If you switch your AP into monitor mode all clients will be dissociated from this AP.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="8499" LastEditDate="2016-08-11T14:37:52.320" LastActivityDate="2016-08-11T14:37:52.320" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33960" PostTypeId="2" ParentId="33862" CreationDate="2016-08-11T14:18:29.657" Score="1" Body="&lt;p&gt;You seem to be confusing the ubiquitous network request/response concept with the application client/server response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the network layers (OSI layers 1 to 4), everything is a peer-to-peer connection. Peers can query each other, and receive responses from each other. This is not a client/server concept. Each peer at layer-3 could ping the other peer and receive a response. It is a two-way street, and that is peer-to-peer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client/server concept is an application concept. For instance, a web browser can request a web page from a web server, and it gets a web page in response, but a web server cannot request a web page from a web browser. It is a one way street, and that is client/server.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-11T14:18:29.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33962" PostTypeId="2" ParentId="33901" CreationDate="2016-08-11T14:44:42.687" Score="1" Body="&lt;p&gt;Cisco has some really nice documents with configuration examples and step by step guide.&#xA;E.g. this one seems to fit your scenario well:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/119006-configure-anyconnect-00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/119006-configure-anyconnect-00.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It goes through the steps of configuring all that is needed on the ASA, including the Anyconnect package that gets downloaded to the &quot;pc on the internet&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that it also mentions that you may need an additional license on the ASA.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-08-11T14:44:42.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33963" PostTypeId="1" CreationDate="2016-08-11T14:52:56.883" Score="1" ViewCount="595" Body="&lt;p&gt;I have 3 hosts (h1, h2, h3) on my LAN segment and a router with IGMP enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the host h3 wants to join the multicast group (239.0.0.2 say)&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Host h3 will send a membership report to 239.0.0.2&#xA;(correct/incorrect)&lt;/li&gt;&#xA;&lt;li&gt;All other hosts (h1, h2) will suppress their Membership report as they&#xA;are also listening to this group (correct/incorrect)&lt;/li&gt;&#xA;&lt;li&gt;How does the router receive this request which was initiated in part&#xA;1 (because the router is listening ONLY at all router&#xA;address-224.0.0.2)?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="8499" LastEditDate="2016-08-12T02:28:47.123" LastActivityDate="2018-10-30T12:26:49.670" Title="IGMP and Multicast" Tags="|routing|multicast|igmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33968" PostTypeId="2" ParentId="33166" CreationDate="2016-08-11T15:12:47.047" Score="2" Body="&lt;p&gt;Try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no nat (inside,public-IP) source static obj-10.10.26.6 obj-203.156.213.173 service port-80 port-9006&#xA;&#xA;object network obj-10.10.26.6&#xA;  host 10.10.26.6&#xA;  nat (inside,public-IP) static 203.156.213.173 service tcp port-80 port-9006&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(or something similar, I'm doing this from memory).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Or&lt;/strong&gt;, as I'm &lt;em&gt;guessing&lt;/em&gt; that there is another (dynamic) nat statement &lt;em&gt;before&lt;/em&gt; your static nat (but I don't have enough reputation yet to ask you in the comments, duh!), re-arrange the order so that the static comes first.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-08-11T15:12:47.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33971" PostTypeId="2" ParentId="33963" CreationDate="2016-08-11T15:31:59.677" Score="3" Body="&lt;p&gt;How IGMP specifically works depends on the IGMP version in use. Cisco has some documents related to how the different IGMP versions work in general and specifically on Cisco devices. For instance, &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios/solutions_docs/ip_multicast/White_papers/mcst_ovr.html#wp1012495&quot; rel=&quot;nofollow noreferrer&quot;&gt;IP Multicast Technology Overview, Intradomain Multicast Protocols, Internet Group Management Protocol (IGMP)&lt;/a&gt;. The real answers are found in the RFCs:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.ietf.org/rfc/rfc1112.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1112, Host Extensions for IP Multicasting&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2236&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2236, Internet Group Management Protocol, Version 2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3376&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3376, Internet Group Management Protocol, Version 3&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4604&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4604, Using Internet Group Management Protocol Version 3&#xA;(IGMPv3) and Multicast Listener Discovery Protocol Version 2 (MLDv2)&#xA;for Source-Specific Multicast&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Hosts will send IGMP membership reports to the multicast router, and the multicast router will periodically send out multicast membership queries to see if any hosts on the LAN are still interested in the multicast group traffic. Beyond that, it depends on the IGMP version.&lt;/p&gt;&#xA;&lt;p&gt;I'm not sure why you think routers only listen to &lt;code&gt;224.0.0.2&lt;/code&gt;; routers are also just hosts on a LAN, and while they must listen to that multicast group, they also must listen to &lt;code&gt;224.0.0.1&lt;/code&gt;, and any other multicast groups to which you configure them to listen. When you configure multicast routing on a router, part of it is setting up IGMP on the interfaces which will be used.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-08-11T15:31:59.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33972" PostTypeId="1" AcceptedAnswerId="33990" CreationDate="2016-08-11T15:42:08.957" Score="-1" ViewCount="168" Body="&lt;p&gt;Is there a way to view a geographical representation, specifically a map of network malware and intrusion events, within Defense Center?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastEditorUserId="14613" LastEditDate="2016-08-12T00:44:54.057" LastActivityDate="2016-08-12T00:52:46.090" Title="Viewing Geo-Map in Cisco SourceFire FireSight Defense Center" Tags="|cisco-asa|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33973" PostTypeId="1" CreationDate="2016-08-11T16:05:06.600" Score="1" ViewCount="788" Body="&lt;p&gt;For troubleshooting purposes, I need to collect some files from my ERX.(by ftp)&#xA;Below is the content of my directory&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ERX#dir&#xA;&#xA;*** Active/standby file systems are being synchronized. ***&#xA;&#xA;                                                               unshared&#xA;                      file                           size        size&#xA;------------------------------------------------   ---------   ---------&#xA;disk0:running.cnf                                     572514      572514&#xA;disk0:GE-HDE_0_07_21_2016_17_26.dmp                 38489957    38489957&#xA;disk0:GE-HDE_0_08_09_2016_16_41.dmp                 38674861    38674861&#xA;disk0:SRP-40G+_9_SC_08_09_2016_15_48.dmp           270021233   270021233&#xA;disk0:reboot.hty                                      119104      119104&#xA;disk0:srpioahotswap.log                                  336         336&#xA;disk0:system.log                                        1539        1539&#xA;disk0:hostkey2147483649.pub                              709         709&#xA;disk0:erx40_11-2-0.rel                             239432234   239432234&#xA;disk0:srp_stats.tsa                                   777391      777391&#xA;disk0:systemHalta7_210116_142344.tsa                  406816      406816&#xA;disk0:04102013.txt                                     18383       18383&#xA;standby-disk0:SRP-40G+_7_SC_08_09_2016_10_20.dmp      114688      114688&#xA;standby-disk0:SRP-40G+_7_SC_08_09_2016_15_49.dmp   211566592   211566592&#xA;standby-disk0:reboot.hty                               61696       61696&#xA;standby-disk0:srpioahotswap.log                          798         798&#xA;standby-disk0:system.log                                1279        1279&#xA;standby-disk0:systemHalta6_290715_141520.tsa          617924      617924&#xA;standby-disk0:systemHalta6_280516_170017.tsa          658452      658452&#xA;                                                          date           in&#xA;                      file                           (Africa/Douala)     use&#xA;------------------------------------------------   -------------------   ---&#xA;disk0:running.cnf                                  07/25/2012 09:25:20&#xA;disk0:GE-HDE_0_07_21_2016_17_26.dmp                07/21/2016 17:29:40&#xA;disk0:GE-HDE_0_08_09_2016_16_41.dmp                08/09/2016 16:45:32&#xA;disk0:SRP-40G+_9_SC_08_09_2016_15_48.dmp           08/09/2016 16:48:28&#xA;disk0:reboot.hty                                   08/09/2016 16:58:26&#xA;disk0:srpioahotswap.log                            08/09/2016 16:54:42&#xA;disk0:system.log                                   08/09/2016 16:55:24&#xA;disk0:hostkey2147483649.pub                        10/03/2011 05:57:24&#xA;disk0:erx40_11-2-0.rel                             08/27/2010 23:36:02    !&#xA;disk0:srp_stats.tsa                                01/12/2012 16:11:20&#xA;disk0:systemHalta7_210116_142344.tsa               01/21/2016 14:24:20&#xA;disk0:04102013.txt                                 10/04/2013 10:50:32&#xA;standby-disk0:SRP-40G+_7_SC_08_09_2016_10_20.dmp   08/09/2016 11:20:40&#xA;standby-disk0:SRP-40G+_7_SC_08_09_2016_15_49.dmp   08/09/2016 16:49:36&#xA;standby-disk0:reboot.hty                           08/09/2016 16:54:46&#xA;standby-disk0:srpioahotswap.log                    08/09/2016 16:54:48&#xA;standby-disk0:system.log                           01/21/2016 14:24:32&#xA;standby-disk0:systemHalta6_290715_141520.tsa       07/29/2015 14:16:10&#xA;standby-disk0:systemHalta6_280516_170017.tsa       05/28/2016 17:01:08&#xA;ERX#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following outputs might be useful to you as well. &#xA;My interest is the &lt;strong&gt;&lt;em&gt;reboot.hty&lt;/em&gt;&lt;/strong&gt;  file&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ERX#show version&#xA;Juniper Edge Routing Switch ERX-1440&#xA;Copyright (c) 1999-2010 Juniper Networks, Inc.  All rights reserved.&#xA;System Release: erx40_11-2-0.rel&#xA;        Version: 11.2.0 release-0.0 [BuildId 12329]   (July 12, 2010  12:35)&#xA;System running for: 0 days, 0 hours, 31 minutes, 50 seconds&#xA;        (since TUE AUG 09 2016 16:54:00 Africa/Douala)&#xA;&#xA;slot  state      type       admin  spare running release   slot uptime&#xA;---- ------- ------------- ------- ----- ---------------- -------------&#xA;0    online  GE-HDE-8      enabled  ---  erx40_11-2-0.rel 0d00h:28m:25s&#xA;1    online  SERVICEMODULE enabled  ---  erx40_11-2-0.rel 0d00h:27m:27s&#xA;2      ---        ---        ---    ---        ---             ---&#xA;3      ---        ---        ---    ---        ---             ---&#xA;4      ---        ---        ---    ---        ---             ---&#xA;5      ---        ---        ---    ---        ---             ---&#xA;6    standby SRP-40G+      enabled  ---  erx40_11-2-0.rel      ---&#xA;7    online  SRP-40G+      enabled  ---  erx40_11-2-0.rel 0d00h:30m:07s&#xA;8      ---        ---        ---    ---        ---             ---&#xA;9      ---        ---        ---    ---        ---             ---&#xA;10     ---        ---        ---    ---        ---             ---&#xA;11     ---        ---        ---    ---        ---             ---&#xA;12     ---        ---        ---    ---        ---             ---&#xA;13     ---        ---        ---    ---        ---             ---&#xA;&#xA;ERX#&#xA;&#xA;&#xA;&#xA;ERX#sh host&#xA;        Static Host Table&#xA;        -----------------&#xA;   name        ip address     type&#xA;----------   --------------   ----&#xA;Typsoftftp   10.248.192.129   ftp&#xA;&#xA;    NFS Host Table&#xA;    --------------&#xA;name   userid   groupid&#xA;----   ------   -------&#xA;    Clns Host Alias Table&#xA;    ---------------------&#xA;        area     system&#xA;name   address     ID     type&#xA;----   -------   ------   ----&#xA;ERX#&#xA;ERX#&#xA;ERX#ping 10.248.192.129&#xA;Sending 5 ICMP echoes to 10.248.192.129, timeout = 2 sec.&#xA;!!!!!&#xA;Success rate = 100% (5/5), round-trip min/avg/max = 9/10/15 ms&#xA;ERX#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please, how do I proceed?&lt;/p&gt;&#xA;" OwnerUserId="24161" LastActivityDate="2016-08-11T16:15:51.617" Title="How to collect core dump files in Juniper ERX" Tags="|juniper|troubleshooting|juniper-junos|juniper-ex|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="33974" PostTypeId="2" ParentId="33930" CreationDate="2016-08-11T16:13:23.640" Score="0" Body="&lt;p&gt;I've figured it out. After reviewing the configuration and not seeing anything off I entered new keys on both sides of the tunnel and it came up immediately. I had been given some incorrect information.&lt;/p&gt;&#xA;" OwnerUserId="27364" LastActivityDate="2016-08-11T16:13:23.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33975" PostTypeId="2" ParentId="33973" CreationDate="2016-08-11T16:14:43.813" Score="1" Body="&lt;p&gt;You may just push file to ftp server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#copy /reboot.hty ftp://ftpuser:ftppasswd@IP_OF_FTP_SERVER/reboot.hty&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2016-08-11T16:15:51.617" LastActivityDate="2016-08-11T16:15:51.617" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="33976" PostTypeId="2" ParentId="33945" CreationDate="2016-08-11T16:31:10.560" Score="1" Body="&lt;p&gt;This is a limitation with packet tracer it seems. I quickly replicated your set up in PT 7.0 with no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you put a server on a new switchport, put the port on the correct vlan and mark that port as trusted DHCP will work fine. I think if you did this with real kit it would work fine.&lt;/p&gt;&#xA;" OwnerUserId="23560" LastActivityDate="2016-08-11T16:31:10.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33980" PostTypeId="1" CreationDate="2016-08-11T18:14:56.517" Score="0" ViewCount="153" Body="&lt;p&gt;I've been tasked with creating/finding out all of the network IPs for my building composed of 6 different groups that all go through my 4 core switches that I'm responsible for. I don't yet have any access to my network monitoring tools like solar winds, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway to figure out which IPs are where? and when I get an IP, can I figure out the subnet to see how many addresses are in use or are being wasted?&lt;/p&gt;&#xA;" OwnerUserId="29603" LastActivityDate="2017-02-08T01:51:06.780" Title="Network Mapping" Tags="|ipv4|" AnswerCount="2" CommentCount="3" ClosedDate="2019-02-12T00:40:10.703" ContentLicense="CC BY-SA 3.0" />
  <row Id="33981" PostTypeId="2" ParentId="33980" CreationDate="2016-08-11T19:58:54.487" Score="1" Body="&lt;p&gt;If you don't have access to network management tools, then you can do this the manual way using CLI on the network devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ARP cache on the core routers is the key to some of the information you need.  Use the following command on a Cisco router to display the ARP cache.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip arp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will give you a list of the IP addresses of all the devices that have sent an ARP response in the last 4 hours.  You may have to repeat this command over a few days to make sure you catch anything that isn't powered on often.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to track down the location of a device the most you can do is track down the switch port that the device is connected to.  Look at the switch MAC address table.  For a Cisco switch use the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show mac-address table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For each MAC address in the ARP cache, check the MAC address table and look at which interface the MAC address was learned on.  If the outgoing interface points to another switch then you will need to log onto that switch and do the same until you get to an interface that doesn't connect to another switch.  Once you discover the final interface that MAC address was learned on, you have discovered the switch port that the IP address/device is connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at the core switch configuration each interface will have a subnet mask associated.  You can use work out how many addresses are useable in that subnet.  Compare that to the compiled list of ARP entries you have recorded over a period of time and then you can know how many addresses are in use.  The more you check the ARP cache, the more accurate your result will be.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-11T19:58:54.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33984" PostTypeId="1" CreationDate="2016-08-11T21:27:07.520" Score="0" ViewCount="112" Body="&lt;p&gt;I’m building a private cloud for my company and want to get the right advise for network setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This setup is only for infrastructure and not for client access.&#xA;I use: 3 X ESX hosts, 2 HP 1920 48G switches, Storage iSCSI and NFS, 1 firewall with Wan, DMZ, Lan interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the best way to connect the switches for HA ? setup Stuck ?  or Trunk with 2 ports ? on that trunk to set LACP ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The storage has 4 interfaces for iSCSI and 4 for NFS, NFS set as LACP on the storage end – how should I connect cables from the storage to the switches ? in cross or from each controller one cable to each switch with LACP enabled ?&#xA;What are my options for HA with the firewalls Lan interface (network Default gateway) how can it be connected to both switches ? &lt;/p&gt;&#xA;" OwnerUserId="29608" LastEditorUserId="8499" LastEditDate="2016-08-12T00:00:57.550" LastActivityDate="2017-01-09T16:47:18.940" Title="building a private cloud" Tags="|hp|hp-procurve|" AnswerCount="2" CommentCount="3" ClosedDate="2019-02-15T05:36:05.647" ContentLicense="CC BY-SA 3.0" />
  <row Id="33986" PostTypeId="2" ParentId="33980" CreationDate="2016-08-11T21:57:36.210" Score="1" Body="&lt;p&gt;Look through your DHCP server to view bindings and match MAC addresses to IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Qualeboy said, check your mac address table on each switch to see which MAC addresses are forwarded to which port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping the broadcast address for each subnet (assuming this is what you meant by groups?). This will populate the ARP cache with all live hosts from that subnet which you can then map to physical ports using the MAC table as discussed above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative to using the CLI is to download a program such as ZenMap. Install the program on a host attached to the network then run scans of each subnet that you want to discover devices on. This is not a comprehensive solution to finding all devices and security policies on your switches may hinder it's operation, but it can be a quick method for giving a general picture of the network. Better to rely on the cli method if you are making design decisions based on this information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;source: I've just completed this task on a 125 device network.&lt;/p&gt;&#xA;" OwnerUserId="25750" LastActivityDate="2016-08-11T21:57:36.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33988" PostTypeId="1" AcceptedAnswerId="33989" CreationDate="2016-08-11T23:41:38.050" Score="1" ViewCount="62" Body="&lt;p&gt;So in simple scenario, a router needs to maintain a routing table that has at least minimum routing features such as &lt;code&gt;Destination IP&lt;/code&gt;, &lt;code&gt;Next Hub&lt;/code&gt;, and &lt;code&gt;NIC interface&lt;/code&gt;. However, in OpenFlow specification the switch can match the received packet against plenty of features even from L4 such as &lt;code&gt;TCP dest_port&lt;/code&gt; and &lt;code&gt;TCP src_port&lt;/code&gt;, or from L2 such as &lt;code&gt;src_MAC&lt;/code&gt; and &lt;code&gt;dest_MAC&lt;/code&gt;. So why does OpenFlow add features from L4 and L2 in the &lt;a href=&quot;https://openflow.stanford.edu/display/ONL/POX+Wiki#POXWiki-MatchStructure&quot; rel=&quot;nofollow&quot;&gt;matching structure&lt;/a&gt; when we only need L3 information for routing purposes?&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2016-08-12T00:17:57.877" Title="Why OpenFlow allows L4 features to be included in match structure" Tags="|cisco|routing|ethernet|sdn|openflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33989" PostTypeId="2" ParentId="33988" CreationDate="2016-08-12T00:17:57.877" Score="1" Body="&lt;p&gt;Short answer:  because merely routing isn't enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In modern enterprise or service provider networks, there is usually a requirement to treat certain types of traffic differently than others.  For example, real-time traffic such as voice or video often requires a minimum amount of delay.  Other traffic may require a minimum amount of bandwidth.  Certain types of traffic may be directed to load balancers, reverse proxies, or policy enforcement points to be inspected or filtered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One common way to distinguish different types of traffic is by layer 4 information (i.e. port numbers).  That's why it is included in the specification.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-12T00:17:57.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33990" PostTypeId="2" ParentId="33972" CreationDate="2016-08-12T00:52:46.090" Score="2" Body="&lt;p&gt;While there is no actual map for viewing this information you can find it in the following area of the Defense Center web interface. The below pages will allow you to see attacks by continent and or country, as well as the ability to see more information on the types of attacks.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Overview &amp;gt; Dashboards &amp;gt; Summary Dashboard &amp;gt; Geolocation&#xA;&#xA;Overview &amp;gt; Dashboards &amp;gt; Summary Dashboard &amp;gt; Intrusion Events&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If there is not information available on those pages it is because you have not configured any widgets, which can be done via the toolbar midpage by clicking, &quot;add widget.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Resource for Using Dashboards:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/Dashboard.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/firesight/541/user-guide/FireSIGHT-System-UserGuide-v5401/Dashboard.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;General Firesight Documents Index Page:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/security/defense-center/tsd-products-support-configure.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/security/defense-center/tsd-products-support-configure.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14613" LastActivityDate="2016-08-12T00:52:46.090" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="33991" PostTypeId="1" AcceptedAnswerId="33992" CreationDate="2016-08-12T00:59:12.313" Score="1" ViewCount="7510" Body="&lt;p&gt;Sorry in advance for such a noob set of questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that when set with the task of sending a packet to its destination, a computer first checks that the IP address of the destination is on the same network by its mask and IP address. I know that when a computer needs the MAC address, it broadcasts an ARP requests to all nodes on that broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does this work for external networks? For example, let's say that I want to navigate to &lt;a href=&quot;https://google.com&quot; rel=&quot;nofollow&quot;&gt;https://google.com&lt;/a&gt;, and my browser goes through with all the DNS queries and fetches the IP Address. I am guessing because of Ethernet, my computer sends an IP packet with the source as myself and the destination as Google's IP address, then wraps that in a layer 2 frame with the default gateway as the destination MAC. Does the router/default gateway strip the layer 2 frame and send that up to its default gateway over PPPoA (this is my situation), or does it then replace that frame with its own source MAC and the destination MAC as its default gateway?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having trouble finding answers and would really love some help.&lt;/p&gt;&#xA;" OwnerUserId="29613" LastEditorUserId="8499" LastEditDate="2016-08-12T02:27:17.360" LastActivityDate="2023-03-11T00:03:59.577" Title="How do routers traverse packets to their destination?" Tags="|ethernet|ip|mac-address|arp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33992" PostTypeId="2" ParentId="33991" CreationDate="2016-08-12T01:11:02.413" Score="1" Body="&lt;p&gt;Your understanding is pretty close.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a router receives a frame, it does strip off the frame to get to the packet. The router then looks in its routing table to see if it has a route to the destination address. If not, it drops the packet. If so (and a default route works as a last resort), the router switches the packet to its interface of the next hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That hop may, or may not, have a protocol which uses MAC addresses (not all do, PPP doesn't use MAC addresses). In any case, the router builds a new frame, encapsulating the packet for the next hop, and it forwards the new frame out the next hop interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-13T17:55:56.950" LastActivityDate="2016-08-13T17:55:56.950" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="33994" PostTypeId="2" ParentId="33905" CreationDate="2016-08-12T07:21:02.207" Score="0" Body="&lt;p&gt;In terms of functionality they would be roughly equal. The difference is typically in how you deploy them and manage them. The classic approach typically involves a physical machine whereas the SDN approach likely uses a virtual firewall spun up in a VM. It also manages the firewall in a completely programmatic way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some technologies that relate to SDNish data centers, like VXLAN or NSH (Network Services Header) that you might find support for in a firewall focused on SDN while it might not be there, yet, in a classic firewall.&lt;/p&gt;&#xA;" OwnerUserId="672" LastActivityDate="2016-08-12T07:21:02.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33995" PostTypeId="1" CreationDate="2016-08-12T09:12:18.820" Score="0" ViewCount="133" Body="&lt;p&gt;one application on a computer can talk to another application on the same computer using TCP? Explain&lt;/p&gt;&#xA;" OwnerUserId="29623" LastEditorUserId="509" LastEditDate="2016-08-12T09:26:31.333" LastActivityDate="2016-08-12T09:26:31.333" Title="Can application on computer communicate with other application on same computer using TCP?" Tags="|tcp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="33996" PostTypeId="2" ParentId="33995" CreationDate="2016-08-12T09:26:21.147" Score="3" Body="&lt;p&gt;Yes, as long as there are no firewall policies to prevent this there's nothing special about that.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-08-12T09:26:21.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33997" PostTypeId="2" ParentId="10685" CreationDate="2016-08-12T09:36:30.787" Score="0" Body="&lt;p&gt;I install certificates so infrequently that I do this all the time and I never bother trying to restore it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's trivial to just re-do the CSR and request another cert. Most SSL cert providers will give you unlimited re-keys and even if its an EV certificate they'll re-issue the certificate within minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll probably save a lot of time by just starting from the beginning. &lt;/p&gt;&#xA;" OwnerUserId="23560" LastActivityDate="2016-08-12T09:36:30.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33998" PostTypeId="2" ParentId="33984" CreationDate="2016-08-12T10:41:17.273" Score="2" Body="&lt;p&gt;The HP 1920 switches aren't really enterprise level switches and definately do not support 10Gb connectivity. So if you are connecting your hosts to the ISCSI storage where your guests are located, 1Gb/s, even if aggregated, wouldn't give you great performance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 1920's are more aimed for small office environment. Ideally what you would want to do is use switches that can do real stacking and be seen as a single switch for higher availability and then alternate the ports between them with LACP trunks. There is a lot to your question and I agree with Ron. We can only help and suggest improvements. The research and the real work will need to be done by yourself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Send us information on how you are planning to connect everything. Start with what you know and then we can go from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleeoyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-08-12T10:41:17.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="33999" PostTypeId="1" AcceptedAnswerId="34002" CreationDate="2016-08-12T10:59:27.897" Score="1" ViewCount="1785" Body="&lt;p&gt;I recently read about a &lt;a href=&quot;http://www.ft.com/cms/s/0/262793fa-5f87-11e6-ae3f-77baadeb1c93.html#axzz4H761Muwa&quot; rel=&quot;nofollow&quot;&gt;proposal by the military government in Thailand to make tourist SIM-cards &quot;trackable&quot;&lt;/a&gt;. That got me thinking about security when accessing the Internet via a mobile connection using a SIM-card. More specifically, can SIM-cards be linked to the data stream sent/received on the connection? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While normal Internet protocols like HTTP don't have specific support for carrying SIM-card data (I think?), are there other means of linking data to a specific SIM-card?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, does using a VPN service over a mobile internet connection make it as anonymous as using the same VPN service over any other internet connection?&lt;/p&gt;&#xA;" OwnerUserId="10606" LastEditorUserId="10606" LastEditDate="2016-08-12T13:50:30.780" LastActivityDate="2016-08-12T19:02:06.400" Title="Does a VPN service &quot;anonymize&quot; a mobile connection just as much as a landline connection?" Tags="|vpn|security|mobile|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34001" PostTypeId="1" CreationDate="2016-08-12T11:09:54.653" Score="2" ViewCount="210" Body="&lt;p&gt;I use FileZilla FTP client to connect to my equipment in order to get files from there. I tried same process in my ERX, without success.&#xA;Below is a view of my directory&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bras-2.cm#dir&#xA;Please wait...&#xA;&#xA;Active/standby file systems are synchronized.&#xA;&#xA;                                                               unshared&#xA;                      file                           size        size&#xA;------------------------------------------------   ---------   ---------&#xA;disk0:/incoming &amp;lt;DIR&amp;gt;                                  31744&#xA;disk0:/outgoing &amp;lt;DIR&amp;gt;                                  31744&#xA;disk0:running.cnf                                     572514      572514&#xA;disk0:GE-HDE_0_07_21_2016_17_26.dmp                 38489957    38489957&#xA;disk0:GE-HDE_0_08_09_2016_16_41.dmp                 38674861    38674861&#xA;disk0:SRP-40G+_9_SC_08_09_2016_15_48.dmp           270021233   270021233&#xA;disk0:reboot.hty                                      119104      119104&#xA;disk0:srpioahotswap.log                                  336         336&#xA;disk0:system.log                                        1539        1539&#xA;disk0:hostkey2147483649.pub                              709         709&#xA;disk0:erx40_11-2-0.rel                             239432234   239432234&#xA;disk0:srp_stats.tsa                                   777391      777391&#xA;disk0:systemHalta7_210116_142344.tsa                  406816      406816&#xA;disk0:04102013.txt                                     18383       18383&#xA;standby-disk0:SRP-40G+_7_SC_08_09_2016_10_20.dmp      114688      114688&#xA;standby-disk0:SRP-40G+_7_SC_08_09_2016_15_49.dmp   211566592   211566592&#xA;standby-disk0:reboot.hty                               61696       61696&#xA;standby-disk0:srpioahotswap.log                          798         798&#xA;standby-disk0:system.log                                1279        1279&#xA;standby-disk0:systemHalta6_290715_141520.tsa          617924      617924&#xA;standby-disk0:systemHalta6_280516_170017.tsa          658452      658452&#xA;                                                          date           in&#xA;                      file                           (Africa/Douala)     use&#xA;------------------------------------------------   -------------------   ---&#xA;disk0:/incoming &amp;lt;DIR&amp;gt;                              08/11/2016 16:01:50&#xA;disk0:/outgoing &amp;lt;DIR&amp;gt;                              08/11/2016 16:01:50&#xA;disk0:running.cnf                                  07/25/2012 09:25:20&#xA;disk0:GE-HDE_0_07_21_2016_17_26.dmp                07/21/2016 17:29:40&#xA;disk0:GE-HDE_0_08_09_2016_16_41.dmp                08/09/2016 16:45:32&#xA;disk0:SRP-40G+_9_SC_08_09_2016_15_48.dmp           08/09/2016 16:48:28&#xA;disk0:reboot.hty                                   08/09/2016 16:58:26&#xA;disk0:srpioahotswap.log                            08/09/2016 16:54:42&#xA;disk0:system.log                                   08/09/2016 16:55:24&#xA;disk0:hostkey2147483649.pub                        10/03/2011 05:57:24&#xA;disk0:erx40_11-2-0.rel                             08/27/2010 23:36:02    !&#xA;disk0:srp_stats.tsa                                01/12/2012 16:11:20&#xA;disk0:systemHalta7_210116_142344.tsa               01/21/2016 14:24:20&#xA;disk0:04102013.txt                                 10/04/2013 10:50:32&#xA;standby-disk0:SRP-40G+_7_SC_08_09_2016_10_20.dmp   08/09/2016 11:20:40&#xA;standby-disk0:SRP-40G+_7_SC_08_09_2016_15_49.dmp   08/09/2016 16:49:36&#xA;standby-disk0:reboot.hty                           08/09/2016 16:54:46&#xA;standby-disk0:srpioahotswap.log                    08/09/2016 16:54:48&#xA;standby-disk0:system.log                           01/21/2016 14:24:32&#xA;standby-disk0:systemHalta6_290715_141520.tsa       07/29/2015 14:16:10&#xA;standby-disk0:systemHalta6_280516_170017.tsa       05/28/2016 17:01:08&#xA;&#xA;                  Disk capacity&#xA;                  -------------&#xA;                  Capacity      Free      Reserved&#xA;    Device        (bytes)      (bytes)    (bytes)&#xA;--------------   ----------   ---------   --------&#xA;disk0:           1024966656   363801923   68157440&#xA;standby-disk0:   1054900224   528365055   68157440&#xA;bras-2.cm#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using FileZilla, I am able to see just the two sub directories named &quot;&lt;strong&gt;incoming&lt;/strong&gt;&quot; and &quot;&lt;strong&gt;outgoing&lt;/strong&gt;&quot;; the other files (which are my interest) are not available to me. So I had a thought to copy from the disk to the folders I can see, as you can see below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bras-2.cm#copy reboot.hty /incoming/reboot.hty&#xA;% Copy failed&#xA;bras-2.cm#copy reboot.hty /outgoing/reboot.hty&#xA;% Copy failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It might also be useful to know the messages I get on the filezilla ftp client as I connect to my ERX&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Status: Connecting to 41.205.0.117:21...&#xA;Status: Connection established, waiting for welcome message...&#xA;Status: Insecure server, it does not support FTP over TLS.&#xA;Status: Server does not support non-ASCII characters.&#xA;Status: Logged in&#xA;Status: Retrieving directory listing...&#xA;Status: Directory listing of &quot;/&quot; successful&#xA;Status: Retrieving directory listing of &quot;/incoming&quot;...&#xA;Status: Directory listing of &quot;/incoming&quot; successful&#xA;Status: Retrieving directory listing of &quot;/outgoing&quot;...&#xA;Status: Directory listing of &quot;/outgoing&quot; successful&#xA;Status: Creating directory '/files to get'...&#xA;Command:    CWD /&#xA;Response:   250 Changed directory to &quot;/&quot;&#xA;Command:    MKD files to get&#xA;Response:   550 Cannot create file &quot;files to get&quot; or permission problem&#xA;Command:    MKD /files to get&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So my questions are&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why can't I see the other files&lt;/li&gt;&#xA;&lt;li&gt;Why can't I copy to the &quot;incoming&quot; and &quot;outgoing&quot; directories I see&lt;/li&gt;&#xA;&lt;li&gt;Why can't I create a new directory in the disk&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Below is a snapshot of the client once connected to the equipment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K0LBF.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K0LBF.jpg&quot; alt=&quot;Preview on FileZilla FTP client&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24161" LastEditorUserId="24161" LastEditDate="2016-08-12T11:15:08.310" LastActivityDate="2016-08-12T13:41:00.317" Title="Can't copy files within ERX" Tags="|troubleshooting|juniper-junos|juniper-ex|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34002" PostTypeId="2" ParentId="33999" CreationDate="2016-08-12T12:45:16.150" Score="1" Body="&lt;p&gt;Your mobile provider will be able to link your SIM card with your IP address and you data.  This helps with routing, billing, service selection, optimisation, and child-protection.  This is all loggable and whether or not government agancies have access to this data is a matter for local legislation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VPN will be linked to your SIM card but the data streams within the VPN are protected. A VPN will give you the level of security inherent in the end-points and the protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to be paranoid, how much do you trust your browser for instance?  Have you recently checked your certificate store?&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-08-12T12:45:16.150" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34003" PostTypeId="2" ParentId="34001" CreationDate="2016-08-12T12:52:19.247" Score="1" Body="&lt;p&gt;You are getting the &lt;strong&gt;550 Cannot create file &quot;files to get&quot; or permission problem&lt;/strong&gt; which clearly indicates that the account you are using to connect does not have the sufficient permission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at the screenshot, on the right panel you can see the permissions set for both directories. The outgoing directory, you have no permission to write to, this includes the owner, group and other accounts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally on UNIX systems, the outgoing is for read only and incoming is used to write files to the FTP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't see the other files most likely that you are not allowed to list the files, again, a permission problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would investigate if there is another, perhaps a special account that allows you to view all the files. It could also be that this is done by design to protect the system from unintentionally corruption.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ERX system divides its vty resources among Telnet, SSH, and FTP&#xA;  services. Each FTP session requires one vty line, and the FTP service uses&#xA;  the authentication method configured for the vty line. If you configured&#xA;  more than one vty line for Telnet access, the FTP service will use one of&#xA;  those lines. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I would look which VTY line is used for FTP and make sure appropiate permissions have been configured. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But also do not forget that you can copy from the ERX to a host that runs a FTP server so this might give you better access as the ssh/telnet account you are using might have higher priviledges and you have greater control of the FTP server not being on the ERX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="27056" LastEditDate="2016-08-12T13:41:00.317" LastActivityDate="2016-08-12T13:41:00.317" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34004" PostTypeId="2" ParentId="33984" CreationDate="2016-08-12T14:43:11.133" Score="0" Body="&lt;p&gt;Unless you have a specific need for NFS, why bother?  I don't see much NFS in corporate environments myself.  What I do see is iSCSI presentation of LUNs to ESX hosts.  Use four dedicated iSCSI VLANs with one cable from the storage to each, two per switch.  Do the same for each ESX host.  Then use iSCSI multipath to increase bandwidth beyond 1Gbps.  I haven't connected to four iSCSI paths myself but I assume it's possible.  The iSCSI VLANs don't even appear on the switch interlinks.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-08-12T14:43:11.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34006" PostTypeId="1" CreationDate="2016-08-12T15:29:29.667" Score="1" ViewCount="627" Body="&lt;p&gt;I've got one VPN with 2 links going from my SRX to AWS. Both tunnels are bound to an st0. interface with qualified-next-hop:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route 192.168.0.0/23 { &#xA;qualified-next-hop 169.251.233.29 { &#xA;interface st0.4; &#xA;} &#xA;qualified-next-hop 169.254.233.25 { &#xA;interface st0.5; &#xA;} &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My problem is that even when a tunnel associated with an interface is down the interface is showing as up and traffic is attempting to route through it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How can I prevent traffic from routing over a &quot;down&quot; IPSec interface?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="23611" LastActivityDate="2016-12-12T06:56:39.797" Title="Juniper Qualified Next Hop for Ipsec Tunnels" Tags="|juniper|ipsec|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34008" PostTypeId="1" AcceptedAnswerId="34010" CreationDate="2016-08-12T18:33:26.617" Score="2" ViewCount="156" Body="&lt;p&gt;When it is said: &lt;code&gt;Routing table lookup in a line rate&lt;/code&gt;, why is line rate important when the router still needs to perform a linear search in the size of routing table? Is there a relationship between line rate and routing table lookup?&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2016-08-12T18:56:30.873" Title="The meaning of routing table lookup at a line rate" Tags="|cisco|routing|ethernet|ip-forwarding-table|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34009" PostTypeId="2" ParentId="33999" CreationDate="2016-08-12T18:34:40.537" Score="0" Body="&lt;p&gt;Regarding  &quot;super awesome Swedish VPN service providers&quot;. Swedish service provider obey the &lt;a href=&quot;http://www.pts.se/upload/Documents/EN/The_Electronic_Communications_Act_2003_389.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;'Electronic Communications Act 2003 389'&lt;/a&gt;. Sections 5, 6, and 7 under &quot;Processing of traffic data&quot; completely protect your privacy, &lt;strong&gt;but&lt;/strong&gt; go a little further and read section 8&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The provisions of Sections 5 to 7 do not apply&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;&lt;p&gt;&lt;strong&gt;When an authority or a court needs access to such data&lt;/strong&gt; as referred to in Section 5 to resolve disputes.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;For electronic messages that are conveyed or have been dispatched or ordered to or from a particular address in an electronic&#xA;  communications network that is subject to a decision on &lt;strong&gt;secret&#xA;  wire-tapping or secret tele-surveillance&lt;/strong&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;To the extent data as referred to in Section 5 is necessary to &lt;strong&gt;prevent and expose unauthorised use of an electronic communications&lt;/strong&gt;&#xA;  network or an electronic communications service.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In case the authorities order secret wire-tapping, the service provider shall not disclose information about it&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Section 19 An operation shall be conducted so a decision on secret&#xA;  wire-tapping &lt;strong&gt;and secret tele-surveillance can be implemented and so&#xA;  that the implementation is not disclosed&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update 2:&lt;/strong&gt; Regarding &lt;a href=&quot;https://torrentfreak.com/vpn-services-that-take-your-anonymity-seriously-2013-edition-130302/&quot; rel=&quot;nofollow noreferrer&quot;&gt;other highly recommended super anonymous VPN services&lt;/a&gt; (I'll go over only the top two)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BTGuard:&lt;/strong&gt; You only need to take one look at the Privacy Policy to know that there's something shady going on.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Before or at the time of &lt;strong&gt;collecting personal information&lt;/strong&gt;, we will identify the &lt;strong&gt;purposes&lt;/strong&gt; for which information is being collected.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;We will &lt;strong&gt;collect and use of personal information&lt;/strong&gt; solely with the objective of fulfilling those purposes specified by us and for other&#xA;  compatible purposes, unless we obtain the consent of the individual&#xA;  concerned &lt;strong&gt;or as required by law&lt;/strong&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;We will only retain personal information as long as necessary for the &lt;strong&gt;fulfillment of those purposes&lt;/strong&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;We will collect personal information by lawful and fair means &lt;strong&gt;and, where appropriate, with the knowledge or consent of the individual&#xA;  concerned&lt;/strong&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can clearly see the intentionally vague language: &quot;fulfilling those purposes specified by us&quot;, what are those purposes specified by them? Nobody knows. They even clearly say that they'll collect personal information when required by the law. In the last point they even state that they even don't have to inform you about the collection of your personal information unless it's &quot;appropriate&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PrivateInternetAccess:&lt;/strong&gt; This is probably one of the easiest legal language in the business.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You agree to comply with all applicable laws and regulations in&#xA;  connection with use of this service. You must also agree that you nor&#xA;  any other user that you have provided access to will not engage in any&#xA;  of the following activities:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;Uploading, possessing, receiving, transporting, or distributing any copyrighted, trademark, or patented content which you do not own or&#xA;  lack written consent or a license from the copyright owner.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Accessing data, systems or networks including attempts to probe scan or test for vulnerabilities of a system or network or to breach&#xA;  security or authentication measures without written consent from the&#xA;  owner of the system or network.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Accessing the service to violate any laws at the local, state and federal level in the United States of America or the country/territory&#xA;  in which you reside.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you break any of their conduct conditions (mentioned above)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Failure to comply with the present Terms of Service constitutes a&#xA;  material breach of the Agreement, and may result in one or more of&#xA;  these following actions:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Issuance of a warning;&lt;/li&gt;&#xA;  &lt;li&gt;Immediate, temporary, or permanent revocation of access to Privateinternetaccess.com with no refund;&lt;/li&gt;&#xA;  &lt;li&gt;Legal actions against you for reimbursement of any costs incurred via indemnity resulting from a breach;&lt;/li&gt;&#xA;  &lt;li&gt;Independent legal action by Privateinternetaccess.com as a result of a breach; or&lt;/li&gt;&#xA;  &lt;li&gt;&lt;strong&gt;Disclosure of such information to law enforcement authorities&lt;/strong&gt; as deemed reasonably necessary.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From the source :  &lt;strong&gt;&lt;a href=&quot;https://security.stackexchange.com/questions/39788/how-can-you-be-caught-using-private-vpn-when-theres-no-logs-about-who-you-are&quot;&gt;https://security.stackexchange.com/questions/39788/how-can-you-be-caught-using-private-vpn-when-theres-no-logs-about-who-you-are&lt;/a&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this will help you with your doubt.&lt;/p&gt;&#xA;" OwnerUserId="29633" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.953" LastActivityDate="2016-08-12T19:02:06.400" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34010" PostTypeId="2" ParentId="34008" CreationDate="2016-08-12T18:56:30.873" Score="1" Body="&lt;p&gt;First, it is unlikely that a router performs a linear search of a linear routing table. That may have been true by some vendors many years ago, but there are things like TCAM, tree, trie, hash table, etc. that are many orders of magnitude faster than what you describe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A device that can perform at wire-speed (line rate) is the goal. It means your traffic is not slowed. That really requires some sort of hardware acceleration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many switches can switch at, or very near, wire-speed because most switching is done in hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing is more problematic because there are more things involved (QoS, NAT, ACLs, etc.). Pure, simple routing may be able to approach wire-speed, but adding other services can greatly slow the routing. The slower the line rate, the closer a router will come to routing at the line rate. For instance, a modern router with interfaces at 10 Mbps could probably route at, or near, the line rate, but a router with 1 or 10 Gbps interfaces that can run close to the line rate will be very expensive.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-12T18:56:30.873" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34013" PostTypeId="1" CreationDate="2016-08-12T19:23:57.840" Score="3" ViewCount="6148" Body="&lt;p&gt;I have access to a router. I want to know its internet IP address through its ISP. I thought about using ifconfig.me but it won't let me. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#copy http://ifconfig.me/ip flash:ip.txt&#xA;Destination filename [ip.txt]? &#xA;Accessing http://ifconfig.me/ip...&#xA;%Error opening http://ifconfig.me/ip (I/O error)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think I am very close. What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="22375" LastActivityDate="2018-01-11T21:07:47.310" Title="How to find my public IP within IOS?" Tags="|cisco-ios|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34016" PostTypeId="2" ParentId="34013" CreationDate="2016-08-12T20:26:21.047" Score="1" Body="&lt;p&gt;Using ifconfig.im works:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#telnet ifconfig.im 80&#xA;Translating &quot;ifconfig.im&quot;...domain server (8.8.8.8)&#xA;Trying ifconfig.im (178.79.178.153, 80)... Open&#xA;GET // HTTP/1.1&#xA;Host: ifconfig.im&#xA;&#xA;HTTP/1.1 200 OK&#xA;(my IP address follows)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22375" LastEditorUserId="22375" LastEditDate="2017-08-09T00:10:55.677" LastActivityDate="2017-08-09T00:10:55.677" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34019" PostTypeId="1" CreationDate="2016-08-13T02:43:32.730" Score="1" ViewCount="3518" Body="&lt;p&gt;Is TCP Hole Punching similar to UDP hole punching?How it is established between &quot;Peer A&quot; and &quot;Peer B&quot; when both the peers are behind NAT? You can use Peer A and Peer B as example to make it easy to understand.&#xA;UDP and TCP hole punching are the most common methods used by torrent, skype for P2P connection and VoIP when peers are behind some type of NAT. Torrent and skype use UDP hole punching for P2P. I'm aware how UDP hole punching works from here: &lt;a href=&quot;http://www.h-online.com/security/features/How-Skype-Co-get-round-firewalls-747197.html&quot; rel=&quot;nofollow&quot;&gt;http://www.h-online.com/security/features/How-Skype-Co-get-round-firewalls-747197.html&lt;/a&gt; but I find TCP hole punching quite confusing.&lt;/p&gt;&#xA;" OwnerUserId="28180" LastEditorUserId="28180" LastEditDate="2016-08-14T05:16:36.043" LastActivityDate="2019-03-01T05:01:45.393" Title="How TCP hole punching works?" Tags="|nat|tcp|udp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34021" PostTypeId="1" CreationDate="2016-08-13T03:57:22.673" Score="2" ViewCount="726" Body="&lt;p&gt;On this &lt;a href=&quot;http://www.radio-electronics.com/info/antennas/mimo/formats-siso-simo-miso-mimo.php&quot; rel=&quot;nofollow&quot;&gt;article about various MIMO schemes&lt;/a&gt;, SIMO (Single Input Multiple Output, i.e. the ) and MISO (Multiple Input Single Output) are both mentioned as possible combinations where one device has multiple antennas, but the other does not. The only difference the article mentions between the two schemes is that they shift the additional processing burden required for multiple propagation onto different ends of the link - SIMO has the receiver handle this, while MISO has the transmitter do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond additional processing burden, are there any other performance differences between having the transmitter vs. having the receiver as the multipath device? Say I have a transceiver A, which is multipath, and another transceiver B, which is not. Assuming identical output power and sensitivity levels, if I begin transmitting from A to B, will the performance of the link be identical as if I began transmitting from B to A?&lt;/p&gt;&#xA;" OwnerUserId="29641" LastActivityDate="2016-08-13T18:34:01.957" Title="Is there a difference between SIMO and MISO, i.e. does it matter whether the transmitter or receiver is the multipath device?" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34025" PostTypeId="2" ParentId="33991" CreationDate="2016-08-13T10:39:07.517" Score="3" Body="&lt;p&gt;There are a number of steps&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The router performs any nessacery L2 filtering to prevent inadvertant packet duplication. For Ethernet this means comparing the packet's destination MAC address with the MAC address of the incoming Ethernet port on the router.&lt;/li&gt;&#xA;&lt;li&gt;The router strips off the L2 framing and passes the packet into IP routing.&lt;/li&gt;&#xA;&lt;li&gt;The router looks up the destination IP address in it's routing table. Based on this table it determines what interface it should send the packet out of and what the &quot;next hop IP address&quot; is. &lt;/li&gt;&#xA;&lt;li&gt;If the outgoing interface is Ethernet or similar the router uses the ARP table for the interface to resolve the next hop IP address to a MAC address. If there is no entry in the ARP table then the packet will be queued while one is created.&lt;/li&gt;&#xA;&lt;li&gt;The packet is wrapped up in a new L2 frame and sent to the next hop.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The default gateway is just an entry in the routing table that matches as a last resort if no more explicit route is known. Some routers don't have a default gateway set and instead rely on knowing the entire internet routing table.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2019-01-30T17:37:58.973" LastActivityDate="2019-01-30T17:37:58.973" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="34029" PostTypeId="2" ParentId="33822" CreationDate="2016-08-13T16:45:01.483" Score="1" Body="&lt;blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Both stateless address autoconfiguration and DHCPv6 may be used&#xA;simultaneously.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;But, this means on the same machine, or on the same network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It means on the same machine; more specifically, per-interface. As Ron suggested, the standards don't place restrictions here.&lt;/p&gt;&#xA;&lt;p&gt;This leads to a related question on source address selection for outbound traffic. Often, you don't have to pay attention, but there's more in in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5014&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc5014&lt;/a&gt; &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6724#section-5&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc6724, section 5&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4218" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-08-13T16:45:01.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34031" PostTypeId="2" ParentId="34021" CreationDate="2016-08-13T18:34:01.957" Score="2" Body="&lt;p&gt;It is largely dependent on your two locations, available antenna configurations, and application. The article talks about how two antenna can be used at the receiver to circumvent fading in shortwave transmissions. Two antenna at the transmitter may not have the same affect. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another area where this may be important is when dealing with antenna polarization. Example you may have a base station and a moving vehicle. Lets say this vehicle can move in 3 dimensions. In that case you may want a single antenna (isotropic or directional) on the ground while two perpendicular antenna on the vehicle. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;MIMO may also be used due to size restrictions. you may be able to have a large high gain antenna at one station, but only space for two smaller low gain antenna at the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short the performance of the link is dependent on antenna configuration. Maybe read further about antenna diversity. Here may be a starter article &lt;a href=&quot;http://www.eetimes.com/document.asp?doc_id=1273367&quot; rel=&quot;nofollow&quot;&gt;http://www.eetimes.com/document.asp?doc_id=1273367&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One other thing to keep in mind is that two TX antennas means that the signal can travel further and be read by more receivers, whilst two RX antennas means that the receiver may have more range and be able to listen to more stations.&lt;/p&gt;&#xA;" OwnerUserId="29652" LastActivityDate="2016-08-13T18:34:01.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34033" PostTypeId="1" AcceptedAnswerId="34046" CreationDate="2016-08-13T21:41:38.110" Score="2" ViewCount="1716" Body="&lt;p&gt;I inherited a network laid out (very broadly speaking) as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A number of access switches connect to 2 main switches. The Main Switch in the MDF (SW1) connects to the WAN router and is connected to the Main Switch in the IDF (SW2) by 5x Cat6 links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to add redundancy to this network? Running cables is impossible in our current situation but I do have two spare switches. The only real idea i've had is this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Kp3XS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Kp3XS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;A third switch would be added in the IDF where some of the Access Switches would connect to. SW3 would use two of the MDF-IDF Cat6 links to link it to SW1 and would be connected to SW2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are still single points of failure but at least I would halve the number of devices affected by a SW2 failure. It would also allow me to setup some manual MSTP load balancing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main function of the network is really to provide a WAN connection; local service were non existent when I arrived. Thats beginning to change but WAN still remains the focal point. Therefore would it make more sense to use a cable for SW2-WANRouter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thoughts on the matter greatly appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is looking like the next iteration of the topology change and tries to incorporate forward expansion by including the servers I plan to add. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Mj1Yk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Mj1Yk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two switches get added, one into the MDF (SW3) and one into the IDF (SW4).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-3 links from SW1-SW2&#xA;+1 link SW1 - SW4&#xA;+1 link R1 - SW2&#xA;+1 link SW2 - SW4&#xA;2x links each between SW1-SW3 and SW2-SW4&#xA;2x Servers in the IDF, both with 1 link to SW2 and SW4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To get this to work, IVR will have to be configured on SW2 (currently only on SW1) and multiple instances of VRRP added to both SW1 and SW2. I've got a feeling that I'm going to have a few hours of cursing spanning tree with this config!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately all access switches have to be treated as hosts due to there being no option to run extra cable to them.&lt;/p&gt;&#xA;" OwnerUserId="25750" LastEditorUserId="25750" LastEditDate="2016-08-14T09:48:10.633" LastActivityDate="2017-04-11T21:01:42.883" Title="Adding a switch to provide redundancy" Tags="|switch|switching|trunk|redundancy|ieee-802.1ax|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34034" PostTypeId="2" ParentId="19024" CreationDate="2016-08-13T22:19:53.107" Score="-2" Body="&lt;p&gt;Router &gt;&gt;&gt;&gt; ip route 0.0.0.0 0.0.0.0 [interface] &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch &gt;&gt;&gt; ip default gateway is the router ip address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should work&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4DCzq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4DCzq.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29655" LastActivityDate="2016-08-13T22:19:53.107" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34035" PostTypeId="2" ParentId="6396" CreationDate="2016-08-13T22:51:30.620" Score="0" Body="&lt;p&gt;In addition to the data some metadata must be passed between layers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a packet comes in the Internet layer will need to determine if the packet is destined for the local machine and if-so pass it to the appropriate transport layer protocol. When it passes it to the transport layer it will also need to pass the source and destination addresses in addition to the packet contents. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly when a packet goes out the transport layer must tell the internet layer what source and destination addresses to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How exactly this metadata is passed is an implementation detail. From the point of view of other systems on the Internet it doesn't matter if a seperate metadata structure is used or if the transport protocol implementations work with the IP header directly. &lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;One subtle difference between a TCP socket and a UDP socket is that a TCP socket is identified by a four-tuple:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is somewhat misleading, both TCP and UDP sockets can exist both with and without a remote IP/port, though only UDP sockets can pass data without one.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-07-25T11:14:12.120" LastActivityDate="2017-07-25T11:14:12.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34036" PostTypeId="2" ParentId="16663" CreationDate="2016-08-13T23:53:07.483" Score="0" Body="&lt;p&gt;There are basically two approaches to this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One is the firewalling aproach. You create explicit rules to restrict the traffic, for example on a Linux router you would create rules using iptables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other is the reverse path filtering approach discussed in RFC3704. This talks about three filtering modes. Strict, loose and feasible.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Strict mode only accepts packets if their input interface matches the best path for their source address. &lt;/li&gt;&#xA;&lt;li&gt;Feasible mode only accepts packets if their input interface is a feasible path.&lt;/li&gt;&#xA;&lt;li&gt;Loose mode only accepts packets if there is some route available to thier source address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Strict mode is appropriate for tree networks where all routing is symetric and each destination is reachable through exactly one route but it is too strict for use in more complex networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Loose mode is useful for dropping private IP traffic on default-free routers but provides little protection against other spoofing and is pretty useless on systems that are not default-free. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Feasible mode provides somewhat effective filtering for more complex networks while reducing the risk of blocking legitimate traffic. However it is more troublesome to implement. Routers (both hardware and software) are designed to quickly determine if an IP is reachable and if-so what the best path is. Determining whether a path is feasible requires a different sort of table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Systems may use different modes for different interfaces, so interfaces to simple user networks can be in strict mode while core interfaces and links to peers, upstreams and large customers can be in feasible or loose mode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get the impression that support for feasible mode is limited to high end routers. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-13T23:53:07.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34037" PostTypeId="2" ParentId="23715" CreationDate="2016-08-14T01:27:21.390" Score="0" Body="&lt;p&gt;Current reccomendations are that NAT mappings are Endpoint Independent. That is all packets from the same private client IP/port/protocol use the same public client IP and port even if the desinations are different. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However there is no gaurantee that every NAT you find in the wild will do this. Some may do their translations based on the full 4-tuple (known as a &quot;symmetric NAT&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Particuarlly insiduous are symmetric NATs with port-preserving behaviour. Under light load with random source ports on the client the mappings will appear to be endpoint independent. However if multiple clients on different machines use the same source port the true nature of the NAT will become apparent. I belive linux NAT falls into this category though i'm not positive on that.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-14T01:27:21.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34039" PostTypeId="1" AcceptedAnswerId="34042" CreationDate="2016-08-14T03:42:06.873" Score="1" ViewCount="54" Body="&lt;p&gt;I am using VLAN 40 to manage switches, but you have to assign a port to a VLAN for it to come up, is there a way to do this without wasting a port on the switch?&lt;/p&gt;&#xA;" OwnerUserId="29538" LastActivityDate="2016-08-14T05:02:54.827" Title="vlan management without assigning an interface to the vlan" Tags="|vlan|management|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34040" PostTypeId="1" AcceptedAnswerId="34041" CreationDate="2016-08-14T03:46:25.227" Score="3" ViewCount="2780" Body="&lt;p&gt;&lt;code&gt;Equal-cost multi-path (ECMP)&lt;/code&gt; is a routing strategy that gives several benefits such as load balancing (as far as I know it is mostly implemented in routers). Suppose there exists a set of switches, say 100 switches, where we want to apply load balancing among them as much as possible by applying ECMP. Therefore, Can &lt;code&gt;ECMP&lt;/code&gt; serve for switching in Layer 2 in this case? &lt;/p&gt;&#xA;" OwnerUserId="19107" LastEditorUserId="19107" LastEditDate="2016-08-14T03:52:29.617" LastActivityDate="2016-08-14T04:07:52.030" Title="Using ECMP for switching in Layer 2" Tags="|cisco|routing|switch|load-balancing|ecmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34041" PostTypeId="2" ParentId="34040" CreationDate="2016-08-14T04:07:52.030" Score="4" Body="&lt;p&gt;There are two protocols that allow ECMP across L2 networks: Transparent Interconnection of Lots of Links (TRILL) and Shortest-Path Bridging (SPB).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TRILL is implemented by exactly two vendors: Cisco (FabricPath) and Brocade (VCS) however both use proprietary implementations, making them incompatible with each other and the standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SPB was favoured by Nortel (now Avaya), but is also supported on Alcatel Omniswitch platforms along various HP models, and a few others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do some more investigation here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SPB - &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1aq&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/IEEE_802.1aq&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TRILL - &lt;a href=&quot;https://en.wikipedia.org/wiki/TRILL_(computing)&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/TRILL_(computing)&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-08-14T04:07:52.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34042" PostTypeId="2" ParentId="34039" CreationDate="2016-08-14T05:02:54.827" Score="3" Body="&lt;p&gt;Add VLAN 40 as a trunked/tagged VLAN on the uplink port of the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will make it active (since it has an active interface) and allow you to reach it in the first place if you are coming from a remote switch.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-08-14T05:02:54.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34043" PostTypeId="2" ParentId="34033" CreationDate="2016-08-14T05:08:58.670" Score="1" Body="&lt;p&gt;I think you're on the right track adding the extra device to the IDF.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If SW2 ever fails, you could also have a port pre-configured on SW3 so that you could quickly, manually fail patch it across and restore service to access switches 1-5 while SW is replaced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also look at placing another switch in the MDF, connected between SW1, SW3 and the WAN router&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-08-14T05:08:58.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34044" PostTypeId="2" ParentId="34019" CreationDate="2016-08-14T05:14:07.703" Score="2" Body="&lt;p&gt;The only way to establish a connection between two hosts when they are both behind different NATs is to either configure port-forwarding on the NAT devices, or use a third-party server hosted on a public address externally (in which case there is no direct TCP connection between hosts).&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-08-14T05:14:07.703" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34045" PostTypeId="2" ParentId="34006" CreationDate="2016-08-14T05:23:19.890" Score="1" Body="&lt;p&gt;On the SRX, a down tunnel should also take down your st0.x interface as well, in which case your configuration should work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of reasons for this not working: I have seen a few versions of Junos that broke this (early 12.1X44 releases), so a code upgrade may fix this.  I'm using 12.1X46D55 on an SRX240 and it correctly drops the st0.x interface when the tunnel is down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, ensure that you have DPD (dead-peer detection) enabled, so that the box doesn't wait for a re-key interval to know that the far side is down.  AWS supports this by default, so you should be able to fail over in ~30 seconds.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-08-14T05:23:19.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34046" PostTypeId="2" ParentId="34033" CreationDate="2016-08-14T07:05:38.253" Score="3" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dS8Ol.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dS8Ol.png&quot; alt=&quot;Redundancy Suggestion&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you have enough router ports available to do this ?&#xA;You would still have your five trunks between the two buildings, but an outage on SW1 wouldn't bring down the whole LAN anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would need to finetune loadbalancing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally you could maybe add a second uplink from switches 1-5 to SW4, as well as from 6-10 to SW2.&#xA;And maybe an extra portchannel between SW1-SW3 and SW2-SW4 :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xDFyJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xDFyJ.png&quot; alt=&quot;Suggestion 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bottom line : with the same capacity between the two buildings, you only have one single point of (total) failure left : the router.&lt;/p&gt;&#xA;" OwnerUserId="22215" LastActivityDate="2016-08-14T07:05:38.253" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34050" PostTypeId="1" AcceptedAnswerId="34054" CreationDate="2016-08-14T12:54:26.513" Score="18" ViewCount="13764" Body="&lt;p&gt;As far as I understand, PPPoE operates over ethernet, so for PPPoE to be usable you should already be able to send Ethernet frames to your ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At that point, why use PPPoE at all? Why not just run IP directly over that Ethernet-like link, assign an IP via DHCP and be done with it?&lt;/p&gt;&#xA;" OwnerUserId="29663" LastActivityDate="2023-08-04T03:45:37.793" Title="Why use PPPoE and not use IP directly?" Tags="|pppoe|adsl|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34052" PostTypeId="2" ParentId="34050" CreationDate="2016-08-14T15:01:23.327" Score="9" Body="&lt;p&gt;Yes, the &quot;E&quot; in PPPoE stands for ethernet. The PPP stands for Point-to-Point Protocol. PPPoE and PPPoA are often used with DSL. PPP was the original protocol which was allowed by the DSL Forum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PPP provides more options and security for the ISP than does DHCP. For instance, DHCP offers no authentication, but that is built into of PPP. Juniper has a whitepaper about &lt;a href=&quot;http://monsterdark.com/wp-content/uploads/PPPoE-vs-DHCP-Juniper-White-Paper.pdf&quot; rel=&quot;noreferrer&quot;&gt;Understanding PPPoE and DHCP&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The DSL Forum now also allows using IP over Ethernet (IPoE), which is&#xA;  based on DHCP. However, PPP remains the more mature and robust method&#xA;  for providing many broadband services.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-14T15:01:23.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34053" PostTypeId="2" ParentId="34050" CreationDate="2016-08-14T15:12:48.070" Score="10" Body="&lt;p&gt;A few reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly that is just the way it has always been and ISPs are loath to change a working setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly it's possible to create translators between different types of PPP. Just because what your router sees is PPPoE doesn't mean the path all the way back to your ISP is a simple ethernet network. You might have a setup that is PPPoE from your router to your modem, PPPoA from the modem to the DSLAM and L2TP back to your ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thirdly PPP provides identification and authentication. This is important for a few reasons, firstly to allow robust identification of abusive users. Secondly to allow multiple ISPs to operate over the same broadband access network. Thirdly to ensure users who have purchased packages with static IPs get the correct IP.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-14T15:12:48.070" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34054" PostTypeId="2" ParentId="34050" CreationDate="2016-08-14T17:31:56.137" Score="14" Body="&lt;p&gt;Another reason may be that PPPoE is a tunnelling protocol which is useful for security and hiding an ISPs infrastructure.  A tunnel is created between the end user CPE and ISP’s centralised BRAS.  The network in-between is hidden from the user and the user cannot interact with other users directly over the ISP’s distribution network until it reaches the BRAS where policy may be enforced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is also useful where the connection to an end user passes over another service provider’s network before it reaches the contracted ISP.  The tunnel can make it appear as though there is a direct connection to the contracted ISP.  For example, in the UK, BT are regulated by the government and must provide wholesale services to other ISPs.  An ISP will buy a DSL connection to an end user’s home from BT and BT will backhaul the connection to the ISP at a handover point.  The ISP then provides connectivity to the Internet, DNS, email etc.  The PPPoE tunnel hides all of this complexity from the user.  All they see is a single hop to their ISP. &lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-14T17:31:56.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34057" PostTypeId="1" AcceptedAnswerId="34063" CreationDate="2016-08-14T19:05:38.350" Score="1" ViewCount="67" Body="&lt;p&gt;I am looking to see if what I am trying to do is even possible. Is there an antenna powerful enough that I can connect with to regular WiFi networks that are hundreds of meters away. If it is sensitive enough wouldn't it be able to capture and send packets to many meters away? Is it going to be easy to create a channel and communicate normally? Would the connection be too slow or have any downsides such as static noise? &lt;/p&gt;&#xA;" OwnerUserId="29669" LastActivityDate="2016-08-15T05:16:01.740" Title="High Range WiFi receiving antennas" Tags="|wireless|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34059" PostTypeId="1" AcceptedAnswerId="34070" CreationDate="2016-08-14T19:40:14.430" Score="0" ViewCount="684" Body="&lt;p&gt;I'd like to have my Cisco router failover from a primary WAN to a secondary WAN interface when the primary stops routing traffic. Neither WAN is running any routing protocol, these are residential-type WAN connections (ie, DHCP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have any need for maintaining source addresses. In either case the traffic would be NAT'd out whatever the appropriate WAN is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I configure this setup in iOS? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it matters, I have a Cisco 890-series branch router. &#xA;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="13662" LastEditorUserId="13662" LastEditDate="2016-08-14T22:03:30.160" LastActivityDate="2016-08-15T11:46:01.433" Title="Cisco WAN failover without routing" Tags="|cisco|wan|failover|" AnswerCount="2" CommentCount="7" ClosedDate="2016-08-15T14:26:58.283" ContentLicense="CC BY-SA 3.0" />
  <row Id="34061" PostTypeId="2" ParentId="34059" CreationDate="2016-08-14T22:13:57.447" Score="0" Body="&lt;p&gt;The easiest way is probably to use AD to create floating static routes. I assume you are using a default static route. Use one for each WAN connection, and specifically set the AD on each. The lower AD is preferred. When the preferred port is down, the route will be withdrawn from the routing table, and the route with the next lowest AD will be preferred.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 &amp;lt;Interface 1&amp;gt; &amp;lt;PE address 1&amp;gt; 5&#xA;ip route 0.0.0.0 0.0.0.0 &amp;lt;Interface 2&amp;gt; &amp;lt;PE address 2&amp;gt; 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-14T22:24:21.267" LastActivityDate="2016-08-14T22:24:21.267" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="34063" PostTypeId="2" ParentId="34057" CreationDate="2016-08-15T05:16:01.740" Score="2" Body="&lt;p&gt;The most powerful ones that I dealt with first hand that were still impressive were the Ubiquiti Long Range devices. We were able to link from device to WAP from 150m away (I know this isn't the plural &quot;Hundreds of meters&quot;, but perhaps it can give you a starting point and this particular WAP, I actually witnessed holding solid at 200Mbps as opposed to reading a spec and repeating it here).&lt;/p&gt;&#xA;" OwnerUserId="29657" LastActivityDate="2016-08-15T05:16:01.740" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34064" PostTypeId="1" AcceptedAnswerId="34066" CreationDate="2016-08-15T06:18:53.600" Score="2" ViewCount="347" Body="&lt;p&gt;We have a network of multiple client machine connected to a 24 port gigabit 1000Base-T switch in our office, which then connects to a local share server with another gigabit port&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of our new local share server has 10Gbe ports (x2, RJ45).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we were to replace our switch with a 10Gbe one to connect to the new share server, would there be any visible improvement to the client machines still connected on regular gigabit ports?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand, we're not magically improving the gigabit ports capacity but does the 10gbe connection from the switch itself allow for better concurrency of access from the different clients or would that be negligible?&lt;/p&gt;&#xA;" OwnerUserId="28020" LastActivityDate="2016-08-15T08:16:32.723" Title="Would 1000BASE-T clients see benefits if connected to a 10GBase-T server via a 10Gbe switch" Tags="|switch|10gbase|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34065" PostTypeId="2" ParentId="34064" CreationDate="2016-08-15T07:35:29.163" Score="3" Body="&lt;p&gt;It depends on your bandwidth utilization. If your current 1G connections to the server are not fully utilized, then you won't get any benefit from 10G. Although there's nothing bad in 10G, it may be useful in the future. If your current connections are fully loaded, then you will rid of oversubscription by using 10G, which will improve user experience. &lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2016-08-15T07:35:29.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34066" PostTypeId="2" ParentId="34064" CreationDate="2016-08-15T08:16:32.723" Score="3" Body="&lt;p&gt;You would definately see a benefit. You are sharing the 1Gbit link to your server with several clients so your bottleneck would be a the 1Gbit link to your server. Once you have 10Gbit connected, that pipe to your server has increased and you can server those clients much better concurrently. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So imagine two clients downloading files from the shared server at the same time, they would in turn share that 1Gbit uplink to the server which means that both clients would never utilize the full 1Gbit connection as they need to share the 1Gbit uplink. Once you have 10Gbit installed, you will end up with a far greater pipe to accommodate those clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just be careful in regards to other hardware on your server. For example the type of disks you are using could then become the bottleneck if the read/write I/O of the disks isn't sufficient to provide multiple concurrent connections and still expecting everyone to utilize their full 1Gbit connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-08-15T08:16:32.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34067" PostTypeId="1" AcceptedAnswerId="34071" CreationDate="2016-08-15T08:28:10.213" Score="1" ViewCount="119" Body="&lt;p&gt;In PIM sparse mode, there is a Rendezvous Point.For any receiver, to join the (S,G) group,the last hop router waits until it receives the native multicast stream. Once it receives the native multicast stream, it starts sending Join message for the (S,G) group using RPF interfaces.&#xA;On all other remaining interfaces, it will send the Prune message to stop receiving the stream&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1: Why at all do we need the Rendezvous point? What advantage is it providing?&#xA;Explain in laymen terms(if possible, a real life example)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2: What is the Source IP and Destination IP of the native multicast packet?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2016-08-15T08:46:34.947" LastActivityDate="2016-08-15T11:47:43.497" Title="Regarding PIM sparse mode" Tags="|cisco|ip|multicast|pim|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34070" PostTypeId="2" ParentId="34059" CreationDate="2016-08-15T11:46:01.433" Score="1" Body="&lt;p&gt;if your IOS has IPSLA you should be able to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;create a ping object for each router (ping something out on the WAN)&lt;/li&gt;&#xA;&lt;li&gt;use HSRP on the LAN interfaces&lt;/li&gt;&#xA;&lt;li&gt;devices use HSRP address as default gateway&lt;/li&gt;&#xA;&lt;li&gt;track the ping object to alter HSRP priority appropriately&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-08-15T11:46:01.433" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="34071" PostTypeId="2" ParentId="34067" CreationDate="2016-08-15T11:47:43.497" Score="3" Body="&lt;p&gt;If you look at the difference between PIM Dense Mode and Sparse Mode, that will give you the answer to why the RP is required.  In Dense Mode, multicast traffic is flooded from the source across any PIM Dense Mode enabled links.  This allows it to eventually reach multicast receivers registered to IGMP queriers. Dense Mode will then prune off PIM links that don't require that multicast group.  So, traffic is essentially flooded across the network to the receivers and then unused links are pruned to create a tree from source to receiver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sparse Mode uses an RP, which is a predefined router on the network that the source and receivers will built a multicast tree to, and traffic can then be send from source to receivers via the RP. The sources send their traffic into the network and the multicast routers build a path to the RP.  When receivers register for a group with their IGMP querier (usually their default gateway), that router also builds a path to the RP.  Traffic can now flow from source to receiver without being flooded out of every link.  Once this path has been formed the receiver's gateway will request a direct path from the source and eventually forwarding will move over to this path, which may bypass the RP.  So the RP serves two purposes, to allow IGMP queriers to discover and build trees from the multicast source, and this allows multicast to be forwarded without flooding the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source IP of a multicast packet is the sender's unicast IP address.  The destination IP is the multicast group address.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-15T11:47:43.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34072" PostTypeId="2" ParentId="32231" CreationDate="2016-08-15T12:31:30.733" Score="2" Body="&lt;p&gt;TCPs reliability comes at a price in several areas.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Compexity: a UDP only stack is simpler than a TCP one. &lt;/li&gt;&#xA;&lt;li&gt;Startup time: A UDP protocol can send a request and get a response in one round trip. A TCP protocol needs to go through the TCP connection setup process first which means a second round trip.&lt;/li&gt;&#xA;&lt;li&gt;Head of line blocking: If a TCP packet is lost all subsequent packets will be held in the network stack and unavailable to the application until the lost packet is resent. &lt;/li&gt;&#xA;&lt;li&gt;Server resource use, all that buffering and connection state tracking takes memory and CPU. &lt;/li&gt;&#xA;&lt;li&gt;Extra network chatter, UDP can deliver a small request and response in two packets. TCP is likely to send substantially more.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Taking some practical examples:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TFTP uses UDP because of point 1, it was designed to be implemented in very limited environments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DNS uses UDP because of points 2,4 and 5. The small request and response doesn't justify the resource use of TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Low latency realtime stuff like games, VOIP etc uses UDP because of point 3. Having the whole stream be delayed by a retransmission can be worse than having a packet not arrive at all (though this is somewhat mitigated by TCP fast retransmission).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-15T12:31:30.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34079" PostTypeId="1" CreationDate="2016-08-15T19:37:33.557" Score="1" ViewCount="107" Body="&lt;p&gt;We use zmap to port scan remote devices within our network. The devices have a &quot;WAN&quot; port which is basically where the public IP is configured. Then the other ports are on the natted/inside private network. Since we are scanning the public IP which sits on the &quot;outside&quot; interface, is it possible for the scan to pick up a port-forwarded service listening on an inside interface? For instance, I scan the outside interface for something listening on UDP port 67. If the remote user has port 67 forwarded to an internal DHCP server, should I expect my scan to pick that up as an &quot;open&quot; port, even though its technically not on the outside interface? &lt;/p&gt;&#xA;" OwnerUserId="15098" LastActivityDate="2016-08-24T08:54:18.180" Title="Interpreting port scan results with a remote NAT device" Tags="|nat|tcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34080" PostTypeId="1" AcceptedAnswerId="34363" CreationDate="2016-08-15T19:56:54.083" Score="0" ViewCount="69" Body="&lt;p&gt;Theoretical question. If using WPA2 Enterprise authentication and radius, would there be adverse effects from say, 300 devices authenticating with the same network account?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;John, Sam, and Mark use the account User1 to connect to the WLAN. So do 297 other employees. Does this create an overhead issue or cause a flaky connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not asking about monitoring issues, just connectivity. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="28310" LastActivityDate="2016-08-25T17:36:30.490" Title="Overhead from using one network account" Tags="|ieee-802.11|authentication|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="34081" PostTypeId="2" ParentId="34079" CreationDate="2016-08-15T20:28:58.620" Score="1" Body="&lt;p&gt;Yes, you should see it as open, if the port on the WAN side is natted to the internal network and the internal server can route back out the nat device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a normal FW where nat is setup for internal traffic connection out through the FW the ports will not be open, only for the external device connected to.&lt;/p&gt;&#xA;" OwnerUserId="3782" LastEditorUserId="3782" LastEditDate="2016-08-24T08:54:18.180" LastActivityDate="2016-08-24T08:54:18.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34082" PostTypeId="1" CreationDate="2016-08-15T22:59:56.843" Score="1" ViewCount="108" Body="&lt;p&gt;Here is an image of a 1x64 fiber optic splitter/combiner:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ejvS4.jpg&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming these are plastic/polymer fibers. A very similar box (&lt;a href=&quot;http://www.ebay.co.uk/itm/SC-UPC-1x32-Fiber-Optic-Splitter-PLC-Splitter-Module-SM-1M-Please-see-Options-/141150409820?hash=item20dd38545c:g:ao0AAOSwr81UOap3&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ebay.co.uk/itm/SC-UPC-1x32-Fiber-Optic-Splitter-PLC-Splitter-Module-SM-1M-Please-see-Options-/141150409820?hash=item20dd38545c:g:ao0AAOSwr81UOap3&lt;/a&gt;) permits 300mW of max optical power. Does this power rating seem reasonable and why?&lt;/p&gt;&#xA;" OwnerUserId="29690" LastEditorUserId="8499" LastEditDate="2019-01-03T02:11:49.613" LastActivityDate="2019-01-03T02:11:49.613" Title="Need an estimate of the max power density" Tags="|layer1|fiber|optics|optical|passive-optical-network|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 4.0" />
  <row Id="34083" PostTypeId="2" ParentId="34082" CreationDate="2016-08-16T02:29:32.843" Score="1" Body="&lt;p&gt;If the manufacturer claims 300 mW power output, then why would you think the power rating is not reasonable? Unlike the mass market for UTP cables, where you see all kinds of crap sold, optical splitters have a very small, contained market, and getting a bad reputation in that marketplace will spell doom.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-16T02:29:32.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34084" PostTypeId="1" AcceptedAnswerId="34085" CreationDate="2016-08-16T02:42:19.493" Score="1" ViewCount="78" Body="&lt;p&gt;Do I have this right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Z2gkT.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Z2gkT.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not shown is the Wireless Bridge is aimed at an outdoor WAP across the yard, which is connected to a router, WAN, etc.  I just want to see if I have it right on the receiving end w.r.t. powering the devices.  I guess I've never &quot;joined&quot; two PoE devices without a switch before but it seemed feasible.  Or do I need a switch?&lt;/p&gt;&#xA;" OwnerUserId="2781" LastActivityDate="2016-08-16T02:57:37.897" Title="PoE wireless bridge to PoE WAP?" Tags="|lan|power-over-ethernet|" AnswerCount="1" CommentCount="6" ClosedDate="2016-08-16T04:26:23.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="34085" PostTypeId="2" ParentId="34084" CreationDate="2016-08-16T02:57:37.897" Score="1" Body="&lt;p&gt;Yup, just plug the &quot;LAN&quot; ports of the injector bricks together, leaving the &quot;POE&quot; ports connected to the respective equipment. Should work fine, it does on my network.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-08-16T02:57:37.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34086" PostTypeId="1" AcceptedAnswerId="34388" CreationDate="2016-08-16T05:21:14.967" Score="2" ViewCount="10061" Body="&lt;p&gt;Really confused regarding source NAT and Destination NAT in Cisco ASA. &#xA;I have a NVR in IP 10.10.20.20 and locally it is opened via &lt;a href=&quot;http://10.10.20.20&quot; rel=&quot;nofollow&quot;&gt;http://10.10.20.20&lt;/a&gt;.&#xA;Remotely, i want this to be accessed via my public IP 201.202.203.204:8080.&#xA;So what i understand is, i have to port forward this port in this public ip.&#xA;Is it not destination nat?&#xA;What i use here is auto NAT:&#xA;Object network obj-10.10.20.20 &#xA;host 10.10.20.20&#xA;nat(inside,outside) static interface service tcp 80 8080&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And with Manual NAT:&#xA;We create objects. &#xA;Object network obj-10.10.20.20&#xA;host 10.10.20.20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;similarly, for ports:&#xA;object service port-80&#xA;service tcp source eq 80&lt;/p&gt;&#xA;&#xA;&lt;p&gt;object service port-8080&#xA;service tcp source eq 8080&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, NAT command would be like:&#xA;nat(inside,outside) source static obj-10.10.20.20 interface service port-80 port-8080&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And access rule would be:&#xA;access-list access-list-name extended permit tcp any host 10.10.20.20 eq http &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it not that port-8080 should have been the destination port? After all, we are opening the ports 8080 for remote users. &#xA;Please clearify when it becomes source port and when it becomes the destination port.&#xA;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="23114" LastEditDate="2016-08-16T05:26:19.773" LastActivityDate="2016-08-26T13:26:31.630" Title="Source and Destination NAT in cisco ASA" Tags="|cisco-asa|nat|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34087" PostTypeId="1" AcceptedAnswerId="34088" CreationDate="2016-08-16T08:17:38.773" Score="1" ViewCount="3817" Body="&lt;p&gt;this is going to sound really dumb, but I've forgotten how to connect and manage a switch if the console interface is serial and the other end is an RJ45. The switch I'm working on is a Brocade FWS 648G 48 port switch and it has a serial port as it's console interface and the RJ45 goes in my laptop - obviously this doesnt create a COM port  ( Do i need some kind of converter to USB? ) Anyway, usually on older laptops I remember using hyper terminal but they took this away on windows 10. Just a question really on how any of you manage a switch like this ( im used to cisco where the console port is the rj45 jack and the serial end has a serial to usb adapter on and use putty). Again apologies for the dumb question, thanks in advance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an image to show what I mean - &lt;a href=&quot;https://i.stack.imgur.com/A3mEC.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/A3mEC.jpg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23768" LastEditorUserId="23768" LastEditDate="2016-08-16T09:00:40.940" LastActivityDate="2016-08-16T09:00:40.940" Title="Serial to RJ45 connection to Brocade FWS 648S 48port Switch" Tags="|switch|management|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34088" PostTypeId="2" ParentId="34087" CreationDate="2016-08-16T08:28:30.757" Score="1" Body="&lt;p&gt;Normally the DB9 serial end goes to a switch and then another serial connector to your laptop. If your laptop doesn't have a serial connector, you need to use something like a USB-Serial adapter where it will have a male DB9 connection that will link with the cable connected to your switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UFor5.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UFor5.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes newer models will allow you to use a RJ45 connectors to the switch with a serial connection going to your laptop which seems what you have, so you might be using the wrong cable if your Brocade switch does not have a console port that is RJ45. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just be careful because each vendor seem to do their own cables and even though they look the same, the pinouts might be completely different. For example, I have an extreme networks cable and a HP cable that do not work together, but a cable to the Cisco switches seems to work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In regards to Hyper-Terminal, this can still be found floating around the Internet. But most people will use free clients such as Putty or Tera Term which can do serial, telnet, ssh, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="27056" LastEditDate="2016-08-16T08:33:53.513" LastActivityDate="2016-08-16T08:33:53.513" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34089" PostTypeId="1" CreationDate="2016-08-16T09:48:24.920" Score="1" ViewCount="116" Body="&lt;p&gt;I'm referring to the following article, where it mentions &quot;The MAC layer header can be maintained if the router is bridging the network layer protocol. However, regular bridging still terminates the VLAN header.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand the router terminating the vlan header, but i don't understand why a bridge would do the same..?&#xA;What is the possible reason for a bridge to terminate a vlan header, after all, bridging/switching is to contain the packets to a single broadcast domain (vlan domain). can someone shed the light on what exactly is&#xA;meant by &quot; However, regular bridging still terminates the VLAN&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/integrated-routing-bridging-irb/17054-741-10.html&quot; rel=&quot;nofollow&quot;&gt;Understanding and Configuring VLAN Routing and Bridging on a Router Using the IRB Feature&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29694" LastEditorUserId="8499" LastEditDate="2018-02-09T02:48:35.900" LastActivityDate="2018-02-09T12:30:48.540" Title="why does bridge terminate vlan header" Tags="|switching|bridging|irb|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34091" PostTypeId="1" CreationDate="2016-08-16T12:35:36.283" Score="2" ViewCount="1772" Body="&lt;p&gt;Please forgive VLAN noobishness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to segregate traffic on a network using VLANs. I want all users to be able to receive and transmit to the internet, so I have a VLAN for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have three other VLANs which should only see ports on the same VLAN, plus the internet VLAN. As far as I can see I need to use an asymmetric VLAN arrangement for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I seem to be having is that some devices will not see any packets leaving a port that are tagged, while others do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, I'd like to set more than one VLAN to be untagged for certain ports, but not all of my switches support this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had assumed that the tag would be ignored by any device not looking for tagged frames, but it seems that some just ignore the tagged frames completely, while processing untagged frames normally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I just going to have to fork out for switches that support multiple untagged VLANs exiting a port?&lt;/p&gt;&#xA;" OwnerUserId="29696" LastActivityDate="2016-11-14T17:57:53.183" Title="Asymmetric VLAN Issue" Tags="|vlan|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34092" PostTypeId="2" ParentId="34089" CreationDate="2016-08-16T13:49:22.027" Score="1" Body="&lt;p&gt;Historically, bridging on a router assumed no VLAN trunks, so VLAN tags were not read/processed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IRB was an improvement over &quot;regular&quot; bridging, and added the capability of understanding VLAN tags. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-16T13:49:22.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34093" PostTypeId="2" ParentId="34089" CreationDate="2016-08-16T13:52:43.713" Score="1" Body="&lt;p&gt;End devices as PCs, tablets, servers don't recognize &lt;em&gt;VLAN headers&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch is the device that injects the &lt;em&gt;VLAN header&lt;/em&gt; on the standard Ethernet frame using 802.1Q.  From that moment the Ethernet frame is &lt;strong&gt;not standard&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the frame moves between switches there are no problems because switches can identify &lt;em&gt;VLAN headers&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the frame is going out of the network to the destination device, then the switch must eliminate the &lt;em&gt;VLAN header&lt;/em&gt;, to re-establish the &lt;em&gt;standardness&lt;/em&gt; of the frame. That is what the author of the article was trying to explain.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2016-08-16T13:52:43.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34096" PostTypeId="2" ParentId="34091" CreationDate="2016-08-16T14:35:03.923" Score="0" Body="&lt;p&gt;Normally, you only tag on trunk ports between networks devices (switch-to-switch or switch-to-router). Most hosts don't understand VLAN tags, so access ports don't get tagged, and you only use one untagged VLAN on an access port. Some servers can understand VLAN tags, and they can be configured to use a trunk port. As @RonTrunk pointed out, you need a router (a layer-3 switch has a router built into it, so as @SleepyMan pointed out, you could use one of those) to route between VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches switch on one LAN. VLANs create virtual switches, one for each VLAN. Routers route between networks (VLANs).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-16T14:35:03.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34097" PostTypeId="2" ParentId="34091" CreationDate="2016-08-16T15:53:28.123" Score="4" Body="&lt;p&gt;There is a solution that does exactly what you are asking for, but its implementation depends on the vendor. &lt;a href=&quot;http://www.cisco.com/c/en/us/tech/lan-switching/private-vlans-pvlans-promiscuous-isolated-community/index.html&quot; rel=&quot;nofollow&quot;&gt;Cisco calls it Private VLANs or PVLANs&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PVLANs provide layer 2 isolation between ports within the same broadcast domain. There are three types of PVLAN ports:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Promiscuous&lt;/strong&gt; A promiscuous port can communicate with all interfaces, including the isolated and community ports within a PVLAN.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Isolated&lt;/strong&gt; An isolated port has complete Layer 2 separation from the other ports within the same PVLAN, but not from the promiscuous ports. PVLANs block all traffic to isolated ports except traffic from promiscuous ports. Traffic from isolated port is forwarded only to promiscuous ports.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Community&lt;/strong&gt; Community ports communicate among themselves and with their promiscuous ports. These interfaces are separated at Layer 2 from all other interfaces in other communities or isolated ports within their PVLAN.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In your case, you would configure 3 communities and one promiscuous port.&lt;/p&gt;&#xA;" OwnerUserId="25723" LastActivityDate="2016-08-16T15:53:28.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34098" PostTypeId="1" CreationDate="2016-08-16T16:58:08.423" Score="1" ViewCount="124" Body="&lt;p&gt;So, in theory, if I connected to a network using, say, 30 ethernet cables from the same PC, wouldn't the upload speeds go up exponentially, because it would split the data over all the ethernet connections and send them to the router separately (sorry if this is absolutely bizarre. I'm in no way a network engineer and know nothing about network engineering)&lt;/p&gt;&#xA;" OwnerUserId="29703" LastEditorUserId="8499" LastEditDate="2018-12-20T21:16:05.013" LastActivityDate="2018-12-20T21:16:05.013" Title="Would multiple connections to a network make the connection faster?" Tags="|ethernet|bandwidth|port-channel|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34099" PostTypeId="2" ParentId="34098" CreationDate="2016-08-16T17:10:43.827" Score="5" Body="&lt;p&gt;In most instances for hosts, no. Each interface is generally a separate network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some hosts (usually servers) can use multiple (generally a maximum of eight) connections bonded together as a single virtual link, but there are some ways in which this could actually degrade performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you divide all the packets in a single network flow across multiple links, you can increase lost packets and packets delivered out of order. This can cause performance problems, and it may cause some things, e.g. real-time applications like VoIP, serious problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you assign a single flow to a single link, and you have multiple flows, then you can see increased bandwidth overall, but each flow will still be limited to the speed of a single link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the network switch vendor, this is called Link Aggregation (LAG) or etherchannel. This is commonly used between switches, or from servers to switches. This is controlled by algorithms which decide which flow gets assigned to which link. The algorithms generally work best if the number of links is a power of two, e.g. two, four, or eight.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also must think about what happens later in the network. If your host has four 1 Gb links to the switch, but the switch has a single 1 Gb link toward your destination, then you have oversubscribed your bandwidth, and you can lose a lot of packets because the switch is dropping three out of four frames you are sending.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-16T17:10:43.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34103" PostTypeId="2" ParentId="34086" CreationDate="2016-08-16T20:34:07.420" Score="1" Body="&lt;p&gt;Those  definitions are taken from junos book&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Destination NAT enables the translation of one destination address to another, a destination address and port to another destination address and port, or a group of destination addresses to another group of equal size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source NAT is the translation of source IP addresses and TCP/UDP ports in the headers of IP flows. It is most commonly used for the translation of private IP address space to public globally routable address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Br&lt;/p&gt;&#xA;" OwnerUserId="29635" LastActivityDate="2016-08-16T20:34:07.420" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34105" PostTypeId="1" AcceptedAnswerId="34106" CreationDate="2016-08-16T22:02:20.677" Score="1" ViewCount="91" Body="&lt;p&gt;Suppose there is one host and one web server, such that the host wants to get pages using the TCP protocol (assuming the network does not apply ECMP or MPLS, also ignoring the delay or any other barriers), I want to understand the behavior of ACK message transmission via the following example:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;After the handshaking, there is a communication route between those&#xA;end-points (say this route goes through 5 intermediate routers). If&#xA;the server sends packets, does the host uses the same route to&#xA;return the ACKs, or it SHOULD create a different route?&lt;/li&gt;&#xA;&lt;li&gt;In case if the host uses the same route, what if the server change&#xA;the route, does the host also follows the new route for returning&#xA;ACKs?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I am new in networking so I appreciate any explanation. &lt;/p&gt;&#xA;" OwnerUserId="19107" LastEditorUserId="8499" LastEditDate="2016-08-17T00:34:26.963" LastActivityDate="2016-08-17T00:34:26.963" Title="Understanding the behavior of ACK message transmission" Tags="|cisco|routing|tcp|switching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34106" PostTypeId="2" ParentId="34105" CreationDate="2016-08-16T22:13:20.000" Score="0" Body="&lt;p&gt;How TCP gets routed on the network is up to IP. TCP doesn't care about any of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is completely possible that you could have asymmetric routing (outgoing and incoming traffic take different paths). This is not an uncommon situation. Routing can also change during the course of a TCP session. TCP (and any upper-layer protocol) is completely oblivious to this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should look up about the separation of the network layers. There are several models about this, but understand that these are just models, and the real world can be different. The OSI model is pretty ubiquitous.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-16T22:23:27.243" LastActivityDate="2016-08-16T22:23:27.243" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34107" PostTypeId="1" AcceptedAnswerId="34298" CreationDate="2016-08-16T22:58:10.460" Score="1" ViewCount="1744" Body="&lt;p&gt;I'm trying to setup an IPsec VPN tunnel between a Debian Jessie system running strongSwan and an SRX. The end goal is to use the Debian host as a reverse-proxy for hosts behind the SRX, which I assume will require a split-tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Debian host is &lt;code&gt;debian.example.com/1.2.3.4&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SRX is at &lt;code&gt;srx.example.com&lt;/code&gt; and has a dynamically assigned IP which I've replaced with &lt;code&gt;5.6.7.8&lt;/code&gt; below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both sides seem to think the SA is up, but I am unable to ping anything in the &lt;code&gt;192.168.1.0/24&lt;/code&gt; subnet from the Debian host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@srx# run show security ike security-associations&#xA;Index   State  Initiator cookie  Responder cookie  Mode           Remote Address&#xA;3981725 UP     b1cbd62070dd2779  f49d3bd11b69a018  IKEv2          1.2.3.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debian:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ipsec status srx.example.com&#xA;Security Associations (1 up, 0 connecting):&#xA;srx.example.com[1]: ESTABLISHED 32 minutes ago, 1.2.3.4[debian.example.com]...5.6.7.8[srx.example.com]&#xA;srx.example.com{1}:  INSTALLED, TUNNEL, ESP SPIs: ca2f0887_i 516e8cf8_o&#xA;srx.example.com{1}:   192.168.2.0/24 === 192.168.1.0/24&#xA;# ip -s xfrm policy list src 192.168.2.0/24&#xA;src 192.168.2.0/24 dst 192.168.1.0/24 uid 0&#xA;        dir out action allow index 2593 priority 2883 ptype main share any flag  (0x00000000)&#xA;        lifetime config:&#xA;          limit: soft (INF)(bytes), hard (INF)(bytes)&#xA;          limit: soft (INF)(packets), hard (INF)(packets)&#xA;          expire add: soft 0(sec), hard 0(sec)&#xA;          expire use: soft 0(sec), hard 0(sec)&#xA;        lifetime current:&#xA;          0(bytes), 0(packets)&#xA;          add 2016-08-16 18:14:21 use -&#xA;        tmpl src 1.2.3.4 dst 5.6.7.8&#xA;                proto esp spi 0x00000000(0) reqid 1(0x00000001) mode tunnel&#xA;                level required share any&#xA;                enc-mask ffffffff auth-mask ffffffff comp-mask ffffffff&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SRX config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    interface-range interfaces-trust {&#xA;        member fe-0/0/0;&#xA;        member fe-0/0/1;&#xA;        member fe-0/0/2;&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan-trust;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    fe-0/0/7 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                dhcp {&#xA;                    update-server;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    st0 {&#xA;        unit 0 {&#xA;            family inet;&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 100 {&#xA;            family inet {&#xA;                address 192.168.1.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;security {&#xA;    ike {&#xA;        proposal ike-vpn-proposal {&#xA;            authentication-method pre-shared-keys;&#xA;            dh-group group24;&#xA;            authentication-algorithm sha-256;&#xA;            encryption-algorithm aes-128-cbc;&#xA;        }&#xA;        policy ike-vpn-policy {&#xA;            mode aggressive;&#xA;            proposals ike-vpn-proposal;&#xA;            pre-shared-key ascii-text &quot;$9$KJiWxdaJDkqf7-qfQzAtNdb&quot;; ## SECRET-DATA&#xA;        }&#xA;        gateway vpn-local-gw {&#xA;            ike-policy ike-vpn-policy;&#xA;            address 1.2.3.4;&#xA;            local-identity hostname srx.example.com;&#xA;            remote-identity hostname debian.example.com;&#xA;            external-interface fe-0/0/7.0;&#xA;            version v2-only;&#xA;        }&#xA;    }&#xA;    ipsec {&#xA;        proposal ipsec-vpn-proposal {&#xA;            protocol esp;&#xA;            authentication-algorithm hmac-sha-256-128;&#xA;            encryption-algorithm aes-128-cbc;&#xA;        }&#xA;        policy ipsec-vpn-policy {&#xA;            perfect-forward-secrecy {&#xA;                keys group24;&#xA;            }&#xA;            proposals ipsec-vpn-proposal;&#xA;        }&#xA;        vpn vpn {&#xA;            bind-interface st0.0;&#xA;            ike {&#xA;                gateway vpn-local-gw;&#xA;                proxy-identity {&#xA;                    local 192.168.1.0/24;&#xA;                    remote 192.168.2.0/24;&#xA;                }&#xA;                ipsec-policy ipsec-vpn-policy;&#xA;            }&#xA;            establish-tunnels immediately;&#xA;        }&#xA;    }&#xA;    policies {&#xA;        from-zone trust to-zone untrust {&#xA;            policy trust-to-untrust {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone untrust to-zone trust {&#xA;            policy untrust-to-trust {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    deny;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    zones {&#xA;        security-zone trust {&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                vlan.100;&#xA;            }&#xA;        }&#xA;        security-zone untrust {&#xA;            screen untrust-screen;&#xA;            interfaces {&#xA;                fe-0/0/7.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            dhcp;&#xA;                            ike;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;        security-zone vpn {&#xA;            interfaces {&#xA;                st0.0;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;vlans {&#xA;    vlan-trust {&#xA;        vlan-id 100;&#xA;        l3-interface vlan.100;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debian strongSwan config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ipsec.conf - strongSwan IPsec configuration file&#xA;&#xA;config setup&#xA;&#xA;# Add connections here.&#xA;conn srx.example.com&#xA;    auto=start&#xA;    keyexchange=ikev2&#xA;    authby=secret&#xA;    ike=aes128-sha256-modp2048s256&#xA;    ikelifetime=3h&#xA;    esp=aes128-sha256&#xA;    leftid=@debian.example.com&#xA;    rightid=@srx.example.com&#xA;    left=1.2.3.4&#xA;    right=srx.example.com&#xA;    leftsubnet=192.168.2.0/24&#xA;    rightsubnet=192.168.1.0/24&#xA;&#xA;include /var/lib/strongswan/ipsec.conf.inc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I may be missing the routes to make things work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@srx&amp;gt; show security flow session destination-prefix 192.168.1.0&#xA;Total sessions: 0&#xA;&#xA;root@dravis&amp;gt; show route table inet.0 brief&#xA;&#xA;inet.0: 5 destinations, 5 routes (5 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;0.0.0.0/0          *[Access-internal/12] 22:20:39&#xA;                    &amp;gt; to 5.6.7.1 via fe-0/0/7.0&#xA;5.6.7.0/24         *[Direct/0] 10w3d 12:43:15&#xA;                    &amp;gt; via fe-0/0/7.0&#xA;5.6.7.8/32         *[Local/0] 10w3d 12:43:15&#xA;                      Local via fe-0/0/7.0&#xA;192.168.1.0/24     *[Direct/0] 4w6d 13:21:42&#xA;                    &amp;gt; via vlan.100&#xA;192.168.1.1/32     *[Local/0] 10w3d 12:43:40&#xA;                      Local via vlan.100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debian:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ netstat -nr&#xA;Kernel IP routing table&#xA;Destination     Gateway         Genmask         Flags   MSS Window  irtt Iface&#xA;0.0.0.0         1.2.3.1         0.0.0.0         UG        0 0          0 eth0&#xA;10.10.0.0       0.0.0.0         255.255.0.0     U         0 0          0 eth0&#xA;1.2.3.0         0.0.0.0         255.255.255.0   U         0 0          0 eth0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29711" LastEditorUserId="29711" LastEditDate="2016-08-23T10:31:33.027" LastActivityDate="2016-08-23T21:27:25.803" Title="SRX Point-To-Site IPsec VPN Setup" Tags="|ipsec|linux|juniper-srx|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34108" PostTypeId="1" AcceptedAnswerId="34109" CreationDate="2016-08-17T02:56:18.833" Score="1" ViewCount="166" Body="&lt;p&gt;Head office is using real routers and switches and The redundancy btw HQ1 and HQ2 works.&lt;br&gt;&#xA;The rest of the network is inside GNS3, for now there is no connections between real routes and GNS3 (I will work on that later).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But inside GNS3 I have a complete lab with head office talking to the two sites (PBA,PBB,BPC, P2 and P3 simulate the internet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want head office (they will also have PC and IP phone) to also talk to the real internet, and I am a bit puzzle about that because if a tunnel exist btw the routers (HQ1/HQ2) and the two sites, I beleive all the traffic will go there, how can I gain internet access when it is not for the sites?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can use an interface on HQ1/HQ2 with probably an ACL? but a better solution would be to add a default route from the simulate internet to the real internet (ACL, default route?).&lt;br&gt;&#xA;I know this way beyond CCNA level, but this is for a project and I am having fun.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gyp4Z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gyp4Z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29538" LastEditorUserId="29538" LastEditDate="2016-08-17T03:07:39.173" LastActivityDate="2016-08-17T03:47:03.777" Title="BGP VPN created, how do I give access to internet" Tags="|bgp|internet|tunnel|redundancy|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34109" PostTypeId="2" ParentId="34108" CreationDate="2016-08-17T03:47:03.777" Score="3" Body="&lt;p&gt;There are a few different ways to achieve what you are after. In my experience the easiest way to do this is to use vlans between the Service Provider &quot;PE&quot; router and the Customer &quot;CE&quot; router. One VLAN would connect into the MPLS l3vpn (vrf) and the second VLAN would connect to an internet VRF/or default routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quite often I have found that a customer will have a large firewall appliance either at their head office or sitting in a datacenter. I would configure the headend router/firewall (CE) on the PE connection as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN x -&gt; Connects to l3vpn cust-a-l3vpn on the PE -&gt; advertises and recieves routes via ospf/bgp/rip/static (pick your flavor). Headend router advertises a default route into the l3vpn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN y -&gt; Connects to default routing table on the PE -&gt; Could have BGP configured if needed, otherwise static default is sufficient. Redistribute this route to the l3vpn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The l3vpn sites would learn that they can get to the internet via the headend router through means of the advertised default route. The head end router would essentially be a &quot;router on a stick&quot; for traffic coming from the l3vpn to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another popular option is to give internet access to each l3vpn site individually through use of two vlans. Each site would have a default route as above and would not advertise it into the l3vpn. The l3vpn would then only be used for private site to site traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How you design and implement it is based on whatever requirements there are in the particular situation. (Redundancy, cost, available equipment, traffic volumes, etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;~H&lt;/p&gt;&#xA;" OwnerUserId="11927" LastActivityDate="2016-08-17T03:47:03.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34110" PostTypeId="1" AcceptedAnswerId="34111" CreationDate="2016-08-17T05:59:07.823" Score="7" ViewCount="89077" Body="&lt;p&gt;I was looking some routers and I noticed that in some of them there is a distinction between WAN and LAN ports? The WAN ports is to connect an access point and LAN ports to connect a switch or a PC?&lt;/p&gt;&#xA;" OwnerUserId="21495" LastEditorUserId="8499" LastEditDate="2020-02-04T17:52:20.077" LastActivityDate="2020-02-04T17:52:20.077" Title="What is the difference between WAN and LAN ports?" Tags="|router|interface|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34111" PostTypeId="2" ParentId="34110" CreationDate="2016-08-17T06:19:05.043" Score="7" Body="&lt;p&gt;Consumer grade routers generally have this distinction, although some enterprise SOHO routers also have this distinction.  WAN stands for Wide Area Network and this is the network that connects your router to your service provider.  The WAN port usually connects to a DSL modem, cable modem or fibre media converter.  LAN stands for Local Area Network and this is the network that connects the devices within your home/business to the router.  The LAN port or ports usually connect to PCs, printers etc.  LAN ports can also connect to wireless APs to allow laptops, smartphones, tablets etc to connect to the LAN.  The router then routes between the LAN and WAN network, applying NAT and firewall policy in the process.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-17T06:19:05.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34114" PostTypeId="1" CreationDate="2016-08-17T09:33:02.467" Score="-1" ViewCount="77" Body="&lt;p&gt;I see this tutorial, &lt;a href=&quot;http://djinnsour.com/2015/08/23/adding-a-public-ip-address-to-a-system-behind-pfsense-using-nat-11/&quot; rel=&quot;nofollow&quot;&gt;http://djinnsour.com/2015/08/23/adding-a-public-ip-address-to-a-system-behind-pfsense-using-nat-11/&lt;/a&gt;. Author of this blog say, add external ip to this network, so what is the public ip ( whatismyip ) of that machine?&lt;/p&gt;&#xA;" OwnerUserId="25143" LastActivityDate="2016-10-16T10:29:54.687" Title="can you explain for me more detail this tutorial, please?" Tags="|ip|pfsense|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34115" PostTypeId="2" ParentId="34114" CreationDate="2016-08-17T09:50:39.840" Score="1" Body="&lt;p&gt;Referring to that tutorial, the external IP address (routable) would be the 222.222.222.x range address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anything within 192.168.x.x will be a private range which can only be used internally as per RFC1918 hence why you would use NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you on your quest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SleepyMan&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-08-17T09:50:39.840" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34116" PostTypeId="1" AcceptedAnswerId="34122" CreationDate="2016-08-17T10:50:19.840" Score="2" ViewCount="488" Body="&lt;p&gt;I am currently learning about IP multicast. I am confused what support mechanism it needs for it to be used. For e.g support from OS , Network cards etc ..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per my understanding, IP multicast is supported when at least one of the network cards installed on the machine which desired to use IP multicast supports it. Also the routers on which the multicast traffic expected should support or enable the IP multIcasting&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, if there are many network cards installed on the machine and none of the network cards support multicast , can we say that IP multicast is not supported by the platform ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How operating system involved in terms of  IP multicast support ? I mean to say, even if a network card supports IP multicast, does an OS have to support the IP multicast as well ? &lt;/p&gt;&#xA;" OwnerUserId="29724" LastEditorUserId="29724" LastEditDate="2016-08-17T11:28:58.427" LastActivityDate="2016-08-17T15:37:33.097" Title="IP multicast support" Tags="|ip|multicast|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34117" PostTypeId="1" AcceptedAnswerId="34125" CreationDate="2016-08-17T11:19:30.663" Score="52" ViewCount="250539" Body="&lt;p&gt;As the title suggests, Does a longer Ethernet cable slow your connection down?&lt;/p&gt;&#xA;" OwnerUserId="29719" LastEditorUserId="29719" LastEditDate="2016-08-25T14:11:00.313" LastActivityDate="2020-08-27T08:19:23.750" Title="Does having a longer Ethernet cable slow your connection?" Tags="|ethernet|cable|layer1|" AnswerCount="14" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="34118" PostTypeId="2" ParentId="34117" CreationDate="2016-08-17T11:26:36.463" Score="43" Body="&lt;p&gt;No, it will not slow down a connection, but you need to be aware of the maximum length of a copper connection which is 100 meters. This needs to include the length of your patching cable from the host to the data point and also patch frame to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when using &lt;a href=&quot;http://en.wikipedia.org/wiki/Category_6_cable&quot;&gt;Cat 6&lt;/a&gt; with a 10 Gbit/s interface, you can only use up to 55 meters and would need to use &lt;a href=&quot;https://en.wikipedia.org/wiki/Category_6_cable#Category_6A&quot;&gt;Cat 6A&lt;/a&gt; to achieve 100 meters for this type of transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you are going above the specified maximum cable length, you will start to see problems not just relating to speed, but also to loss due to the nature of electrical current running through the cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 100 meters only applies to a single run without any intermediary network device such as a switch. If you have a switch in between, you can obviously extend this from port to port which the maximum would apply to for each cable run from device to device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using fibre connectivity, you can extend the range based on what type of fibre and light which is beyond the scope of your question.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="3232" LastEditDate="2016-08-20T09:04:31.730" LastActivityDate="2016-08-20T09:04:31.730" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="34119" PostTypeId="2" ParentId="33093" CreationDate="2016-08-17T12:32:11.723" Score="0" Body="&lt;p&gt;there is an imposed limit of 65468 by one of our firewalls to prevent ping of death: en.wikipedia.org/wiki/Ping_of_death Most end hosts should have no problem with dealing with this, but older hosts/unpatched ones could potential end up having IP stack overflow and crashing the box. This is not due to ICMP protocol itself; This is due to the re-assembled packet exceeding the max IP size of 65535&lt;/p&gt;&#xA;" OwnerUserId="22285" LastActivityDate="2016-08-17T12:32:11.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34120" PostTypeId="2" ParentId="439" CreationDate="2016-08-17T13:48:29.240" Score="0" Body="&lt;p&gt;Below link can be helpful for you :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/12577221/snmp-polling-optical-budget-dbm&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/12577221/snmp-polling-optical-budget-dbm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29727" LastActivityDate="2016-08-17T13:48:29.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34122" PostTypeId="2" ParentId="34116" CreationDate="2016-08-17T15:37:33.097" Score="1" Body="&lt;p&gt;Every host supports multicast, and every host already subscribes to the link-local All-Hosts multicast address (&lt;code&gt;224.0.0.1&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast is not up to the NIC, it is up to an application which want to listen to one or more multicast groups. Multicast is selective, and when you run an application which subscribes to a multicast group, then your network stack will listen for traffic with the destination address of that multicast group, and it will pass that traffic up to the subscribing application.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-17T15:37:33.097" CommentCount="17" ContentLicense="CC BY-SA 3.0" />
  <row Id="34123" PostTypeId="2" ParentId="34117" CreationDate="2016-08-17T16:01:48.173" Score="19" Body="&lt;p&gt;Sort of, to a very tiny extent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The longer your cable, the higher &lt;em&gt;latency&lt;/em&gt; you experience - gamers call this &quot;ping&quot; time. However, the effect is about one nanosecond per foot of cable, which is unlikely to be noticeable in most cases. Especially as a single ethernet cable is limited to 100m.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This matters for high-frequency trading and occasionally for &lt;a href=&quot;http://www.ibiblio.org/harris/500milemail.html&quot;&gt;email&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't, of itself, affect the throughput or &quot;bandwidth&quot; of your cable.&lt;/p&gt;&#xA;" OwnerUserId="23860" LastActivityDate="2016-08-17T16:01:48.173" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34124" PostTypeId="2" ParentId="34117" CreationDate="2016-08-17T16:06:18.627" Score="2" Body="&lt;p&gt;The &lt;a href=&quot;https://electronics.stackexchange.com/questions/45492/speed-of-electricity-signal-propagation-through-copper-for-communications-del&quot;&gt;electrical signal propagation time&lt;/a&gt; for a 100&amp;nbsp;m maximum length Ethernet cable is only about half a microsecond. This is far less than the amount of time needed for your router, etc. to do their jobs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This only begins to be relevant when looking at much larger distances: For example, from your computer to the server for a game you're playing; however that number is entirely in the hands of your ISP/its partners and the physical locations of you and the server itself. &lt;/p&gt;&#xA;" OwnerUserId="2383" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:08.917" LastActivityDate="2016-08-20T04:32:22.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34125" PostTypeId="2" ParentId="34117" CreationDate="2016-08-17T16:40:07.757" Score="10" Body="&lt;p&gt;The electric signal will be slowed down by a minimal amount (afterall it travels at 2/3 light speed, more exactly at 0.64c, the &lt;a href=&quot;https://en.wikipedia.org/wiki/Velocity_factor&quot; rel=&quot;nofollow noreferrer&quot;&gt;velocity factor&lt;/a&gt;), how much time does light take to travel for 100 meters?&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;timeTaken  = 100/(299792458*0.64) = 0.00000052 seconds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So it just takes an extra 0.00052 milliseconds which is just 520 CPU cycles (on a 1 Ghz CPU).&lt;/p&gt;&#xA;&lt;p&gt;However the longer the cable the weaker the signal becomes, once the signal is weak enough it will starts to lose bits of information because of interferences, each time a bit is lost, something in the network layer sees that a checksum/parity check fails, and ask for that packet again.&lt;/p&gt;&#xA;&lt;p&gt;Asking for a new packet will take a very long time.&lt;/p&gt;&#xA;&lt;p&gt;So as long as signal is strong in the cable, &lt;strong&gt;the slowdown would be minimal&lt;/strong&gt; (it is greater than I expected anyway).&lt;/p&gt;&#xA;&lt;p&gt;Once you start losing information because cable too long, &lt;strong&gt;the slowdown would greatly increase&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Also note that certain communications protocols are timed, so if the cable is too long it may not even be usable because it would go out of sync (that's a by-design issue)&lt;/p&gt;&#xA;" OwnerUserId="29733" LastEditorUserId="36720" LastEditDate="2020-08-27T08:19:23.750" LastActivityDate="2020-08-27T08:19:23.750" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="34126" PostTypeId="2" ParentId="34117" CreationDate="2016-08-17T17:13:09.820" Score="35" Body="&lt;p&gt;For all practical purposes, there will be no effect on the speed of your connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will be a very insignificant amount of delay due to long cables.  This won't affect the maximum speed of your connection, but it would cause some latency. pjc50 points out that it's about a nanosecond for every foot of cable length, which is a good rule of thumb used by many engineers when developing systems which are very dependent on latencies on those timescales.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In reality, you will never notice a difference. A &quot;fast&quot; ping time on the Internet is 10&amp;nbsp;ms, which is 10,000,000&amp;nbsp;ns. Adding even a few hundred feet of cable isn't going to have a noticeable effect at that point. In fact, nearly every step of the way involves delays which are more extreme than those seen from signal propagation. For example, most consumer grade routers will wait for the last byte of an incoming packet to be received and check it for errors before sending the first byte of the packet on its way. This delay will be on the order of 5,000&amp;nbsp;ns! Given that the maximum length of cable you can run (per the Ethernet spec) is 300&amp;nbsp;ft, the cable length could never cause more than 300&amp;nbsp;ns of delay due to the cable!&lt;/p&gt;&#xA;" OwnerUserId="13295" LastEditorUserId="13295" LastEditDate="2016-08-20T16:09:20.567" LastActivityDate="2016-08-20T16:09:20.567" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34130" PostTypeId="2" ParentId="34117" CreationDate="2016-08-17T20:37:19.880" Score="3" Body="&lt;p&gt;The standard is 100m (~333.33 ft; 1m = 3 1/3 ft) before attenuation makes the signal unusable, but the direct answer to your question is yes, a long cable can slow your connection. Attenuation is caused by the internal resistance of the copper which humans perceive as lag/slow down of network connectivity. If the cable is under 100m, the slow down is relatively unnoticeable. It can cause issues if you're coming close to that 100m mark though. And keep in mind that the 100m length is measured from the point the cable plugs into the port on your computer to the point it plugs into a device that regenerates the signal, like a switch or a router. (I've personally had to change out a cable to a printer because the ~97m length caused sporadic communication.)&lt;/p&gt;&#xA;" OwnerUserId="29741" LastActivityDate="2016-08-17T20:37:19.880" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34131" PostTypeId="1" AcceptedAnswerId="34151" CreationDate="2016-08-17T21:39:09.350" Score="1" ViewCount="1573" Body="&lt;p&gt;We're building a new core for our University and one thing that bugs me is the iSCSI network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We already considered Jumbo Frames and Flow Control on the iSCSI ports, but one thing remains for debate, and it's the QoS Feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our new core consist of two Cisco Nexus 3048. There will be two different iSCSI VLAN's for MPIO, one VLAN will be in the first switch and the other one on the the second. The Jumbo Frames and Flow Control seems trivial, but QoS does not appear to be simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was unable to find any guidelines for iSCSI on the Nexus 3048 models. There are a lot of information for the 5000 and 7000 series but many features are missing on the 3000 series, like the QoS traffic match with the iSCSI protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing that I'm unsure is about CoS (Class of Service) Classification. Is this a requirement requirement? I don't know where iSCSI should be placed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&#xA;V.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT with Answers:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;A couple of design questions: - Are you mixing iSCSI and other data&#xA;in this cluster (I assume you will user VPC)? - Are you mixing iSCSI&#xA;and other data in the same port with tagged frames?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Data is mixed on the switch. VM's Network and Access will reach the&#xA;  core. But the iSCSI traffic has dedicated ports with larger MTU in&#xA;  mind and specific VLANs with untagged data, complete Layer 2&#xA;  segregation. VPC will not be used for iSCSI since we're deploying&#xA;  MPIO, so there's no need. The storage is connected via SFP+ on the&#xA;  10GbE port and the hypervisor hosts on the downlink GbE ports. There's&#xA;  5 hypervisor hosts in total, each one with two cards, one for each&#xA;  switch. VPC is only used in the VM's Network and the access uplink.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;What is the actual issue you are experiencing? Is this a performance problem? Generally, it is not advised to have your ISCSI network on the same hardware that will provide connectivity to the rest of your network. You should really be using a dedicated switch (2 for redundency) for your ISCSI network and segrate that from the normal user data.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We don't have any issues at this moment since this core is not in&#xA;  production, we just want to make it right before putting it on&#xA;  production. I'm aware that separate fabrics should be deployed for SAN&#xA;  traffic. With cheaper and common switches this is true and we rolled&#xA;  iSCSI this way on older equipment. But this switch is a unified fabric&#xA;  model, so it's developed to have mixed SAN and LAN traffic on the same&#xA;  box. The model we choose, the Nexus 3048 is capable of delivering&#xA;  extremely low latency and lossless iSCSI and here is where we need to&#xA;  configure it properly to make everything work as expected.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Thanks for the questions guys. Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="10528" LastEditorUserId="10528" LastEditDate="2016-08-18T16:14:45.730" LastActivityDate="2016-08-18T16:14:45.730" Title="QoS (802.1p) for iSCSI Traffic on Cisco Nexus 3048" Tags="|cisco|qos|cisco-nx-os|cos|iscsi|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34132" PostTypeId="1" AcceptedAnswerId="34133" CreationDate="2016-08-17T22:37:54.497" Score="2" ViewCount="3180" Body="&lt;p&gt;I know what ospf is, but what purpose does it have in th efollowing scenario: an autonomous system has a single router which connects (through access switches) to hosts. The router also connects to another router which acts as the egr, connecting us to another as. The backbone area is the coonnection between the two routers. Is ospf just in use to inform the egr of the routes that the other router knows to hosts in the as?&lt;/p&gt;&#xA;" OwnerUserId="27412" LastActivityDate="2017-10-28T09:03:12.163" Title="What is the purpose of ospf?" Tags="|routing|ospf|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34133" PostTypeId="2" ParentId="34132" CreationDate="2016-08-18T00:45:55.680" Score="4" Body="&lt;p&gt;Yes, that is the purpose of any routing protocol, including OSPF:  to allow routers to exchange information about networks they can forward (route) to.   In a simple scenario like you describe, static routing would also be an option.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-18T00:45:55.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34134" PostTypeId="2" ParentId="34132" CreationDate="2016-08-18T01:23:15.110" Score="1" Body="&lt;p&gt;In the scenario you describe OSPF is the wrong tool and should not be used at all as is would be a waste of resources (CPU cycles/power/administration).  You would configure a simple static route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you insisted on using OSPF in your scenario, all it would do is collect unnecessary details of the far end system (or AS as you call it).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-18T01:23:15.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34135" PostTypeId="1" CreationDate="2016-08-18T02:24:01.487" Score="0" ViewCount="144" Body="&lt;p&gt;First of all I am so sorry that this question might be so rudimentary to ask here but I need to know it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am connecting my laptop in many wi-fi networks every day while roaming. So my IPv4 is in DHCP mode thus takes a different IP address in a different network. But now I have to edit my network scripts (CentOS7, eth-0) and set a fixed IP address there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;( The reason I want to do this is because I want to set up a hadoopmulti node cluster. Home machine will be the master node and two CentOS7 Vmware will be data nodes. So I need to setup 3 IP addresses on 3 machines and talk between them via SSH. )&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is Can I set up my IP address as static one? Then if I roam into a new network what's going to happen? Do I have to change the IP address again if it(the staic IP that I set) does not fall in the range of that network's DHCP IP range?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please clarify this to me if you please and also if some one know how to do this basic kind of network setup better please also do advise and suggestions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks and regards&lt;/p&gt;&#xA;" OwnerUserId="29752" LastActivityDate="2016-08-18T04:15:48.683" Title="How to setup an static IP in a machine that is DHCP enabled and roaming between different networks?" Tags="|ethernet|dhcp|ieee-802.11|lan|" AnswerCount="1" CommentCount="2" ClosedDate="2016-08-18T04:45:43.077" ContentLicense="CC BY-SA 3.0" />
  <row Id="34136" PostTypeId="2" ParentId="34132" CreationDate="2016-08-18T03:10:01.270" Score="2" Body="&lt;p&gt;Pretty much--assuming you are not using BGP and just have a default route to the other AS, you still have to tell your gateway router (let's call it RTA) how to get to your hosts (which are connected to, shall we say, RTB), and RTB needs to know how to get back to RTA as well or your hosts' traffic won't get very far. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course all this could technically be accomplished with static routes in both directions, if it will never be more complicated than this.  In this scenario you'd want to ask yourself if you will ever grow or need redundancy added in;  most will eventually want to do one of these, so designing your network with the robustness that OSPF and BGP provide may be a good idea at the outset--it is not pretty going back and teasing out myriad static routes later.&lt;/p&gt;&#xA;" OwnerUserId="29748" LastActivityDate="2016-08-18T03:10:01.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34137" PostTypeId="2" ParentId="34135" CreationDate="2016-08-18T04:15:48.683" Score="3" Body="&lt;p&gt;If you only need the IP to be fixed on one network, than the simplest approach is to make a static DHCP reservation on the DHCP server for that network specifically. That way your machine stays in DHCP mode all the time, but will always get the same address when it connects to that specific network.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-08-18T04:15:48.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34138" PostTypeId="2" ParentId="34117" CreationDate="2016-08-18T05:18:27.807" Score="8" Body="&lt;p&gt;I believe it can, but not in the way most people are thinking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most are thinking of the extra propagation delay through the cable itself. This is valid, but as people have already pointed out, so small that it's essentially always irrelevant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is another possibility though. Ethernet cables come in a few different varieties: cat 5, cat 5e and cat 6 are currently in (reasonably) wide use. Cat 5 doesn't officially support gigabit Ethernet, but with a short (e.g., 1 or 2 meter) cat 5 cable that's in good physical condition, you can often get a seemingly reliable gigabit connection anyway&lt;sup&gt;1&lt;/sup&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a longer cable, however, you could get enough signal deterioration that a gigabit connection was no longer possible. In this case, I believe you'd normally be a 100 megabit connection instead. In this case, you wouldn't just gain some irrelevant amount of latency--rather, you'd have lost a substantial amount of bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This wouldn't have any effect on an Internet connection unless you happen to be one of the fortunate few with more than 100 MB/s bandwidth. Access to local resources could be affected much more drastically though.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;All of these use identical-looking RJ-45 connectors; the difference between cat 5 and cat 5e cable usually isn't obvious except by looking at the printing on the wiring to see which it says.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="29755" LastActivityDate="2016-08-18T05:18:27.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34139" PostTypeId="1" AcceptedAnswerId="34145" CreationDate="2016-08-18T06:41:43.117" Score="2" ViewCount="433" Body="&lt;p&gt;I am currently working on making &lt;a href=&quot;https://github.com/shivrai/TCP-IP-Regression-TestSuite&quot; rel=&quot;nofollow&quot;&gt;test scripts&lt;/a&gt; for regression testing of FreeBSD's TCP/IP stack using Google's packetdrill. However, there is a slight problem which I am having involving sequence numbers. This is a small segment from one of the test scripts which verifies whether Early Retransmit works properly -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;// Three way handshake&#xA;0.100 &amp;lt; S 0:0(0) win 32792 &amp;lt;mss 1460,sackOK,nop,nop,nop,wscale 7&amp;gt;&#xA;0.100 &amp;gt; S. 0:0(0) ack 1 &amp;lt;...&amp;gt;&#xA;0.200 &amp;lt; . 1:1(0) ack 1 win 257&#xA;0.200 accept(3, ..., ...) = 4&#xA;&#xA;// Our application writes 2920 bytes &#xA;0.200 write(4, ..., 2920) = 2920&#xA;0.200 &amp;gt; P. 1:2921(2920) ack 1&#xA;0.300 &amp;lt; .  1:1(0) ack 1 win 257 &amp;lt;sack 1461:2921,nop,nop&amp;gt;&#xA;0.325 &amp;gt; .  1:1461(1460) ack 1  // delayed Early Retransmit at RTT/4 = 25ms&#xA;0.425 &amp;lt; .  1:1(0) ack 2921 win 257&#xA;&#xA;0.500 close(4) = 0&#xA;0.500 &amp;gt; F. 2921:2921(0) ack 1&#xA;0.600 &amp;lt; F. 1:1(0) ack 2922 win 257&#xA;0.601 &amp;gt; .  2922:2922(0) ack 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although the test is easy to understand, but what I am not able to figure out is that why along with &lt;strong&gt;PUSH&lt;/strong&gt; are we again sending an acknowledgement number 1, because while in the three-way handshake, the other side already did send an &lt;strong&gt;ACK&lt;/strong&gt; starting with sequence number 1.&#xA;Shouldn't this be the correct line -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.200 &amp;gt; P. 1:2921(2920) ack 2&#xA;0.300 &amp;lt; .  2:2(0) ack 1 win 257 &amp;lt;sack 1461:2921,nop,nop&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It can also be seen that at &lt;em&gt;0.425 seconds&lt;/em&gt; the other side again sends an &lt;strong&gt;ACK&lt;/strong&gt; with the same sequence number of 1:1. &lt;br&gt;&#xA;The full test script can be found &lt;a href=&quot;https://github.com/google/packetdrill/blob/master/gtests/net/packetdrill/tests/linux/early_retransmit/er-delayed-2pkt-sack.pkt&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. &lt;br&gt;&#xA;I could have posted the question in the packetdrill's mailing list, but I think this is a problem with my fundamentals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a quick reference ~ &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The starting decimals denote absolute timings in seconds. &lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;&amp;lt;&lt;/code&gt; and &lt;code&gt;&amp;gt;&lt;/code&gt; denote direction of packets, &lt;code&gt;&amp;lt;&lt;/code&gt; for receiving and &lt;code&gt;&amp;gt;&lt;/code&gt; for injecting. &lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;S&lt;/strong&gt; denotes &lt;strong&gt;SYN&lt;/strong&gt; &lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;P&lt;/strong&gt; denotes &lt;strong&gt;PUSH&lt;/strong&gt; &lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;F&lt;/strong&gt; denotes &lt;strong&gt;FIN&lt;/strong&gt; &lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;.&lt;/strong&gt; denotes &lt;strong&gt;ACK&lt;/strong&gt; &lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;sack&lt;/strong&gt; denotes Selective Acknowledgement. &lt;br&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;accept()&lt;/code&gt;, &lt;code&gt;close()&lt;/code&gt; and &lt;code&gt;write()&lt;/code&gt; are the appropriate system calls.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29756" LastActivityDate="2016-12-16T07:39:57.223" Title="Redundant acknowledgement numbers in TCP stream" Tags="|tcp|packet-analysis|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34140" PostTypeId="2" ParentId="34107" CreationDate="2016-08-18T07:18:51.943" Score="1" Body="&lt;p&gt;On the SRX you have no security policy configured between the vpn zone (which is where your tunnel interface st0.0 resides) and the trust zone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add the following and you should be up and running:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security policies from-zone vpn to-zone trust policy vpn-to-trust match source-address any&#xA;set security policies from-zone vpn to-zone trust policy vpn-to-trust match destination-address any&#xA;set security policies from-zone vpn to-zone trust policy vpn-to-trust match application any&#xA;set security policies from-zone vpn to-zone trust policy vpn-to-trust then permit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-08-18T07:18:51.943" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34141" PostTypeId="2" ParentId="34110" CreationDate="2016-08-18T07:49:11.007" Score="5" Body="&lt;p&gt;A LAN is typically something completely within your own premises (your organization's campus, or building, or office suite, or your home), so it's something you build and own yourself, all the way down to the physical cabling. In contrast, a WAN is something that connects between geographically separated locations, so you generally have to lease access to lines or data transmission services from telecommunications carriers to create your WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of the shorter distances needed for on-premises networks, and because of the focus on connecting PCs and servers, LANs tend to be built on Ethernet and other 802.3-family (and 802.11-family) physical layers and data links. 1000BASE-T, 1000BASE-SX, 1000BASE-LX, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because off-premises network links usually need to go longer distances and work over the telecommunication carriers' existing infrastructure, they tend to use physical and data-link standards that are more common in the telecom industry. Then again, for your convenience, telecom carriers usually hand off to you using an 802.3-family link, even if what they're using behind the scenes is, say, OC-3 and SONET/SDH.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of the technical hurdles associated with moving lots of data long distances reliably, WAN links tend to be lower bandwidth and higher latency than LAN links. Also, because you're usually paying a separate telecom carrier for the service, to keep costs down, most organizations try to limit (or at least not go crazy with) how much data they move over WAN links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The differences between LANs and WANs tend to be at the physical and data-link layers. At the network layer (Layer 3 in the old-but-still-helpful-for-some-discussions OSI layering model), most people use IP (Internet Protocol) nowadays. Because it all uses IP, applications that use IP don't have to know what physical and data-link layers are in use, so anything you can do on a LAN you can potentially do on a WAN as well, if you have high enough bandwidth and low enough latency for whatever it is you're trying to do, and as long as you haven't blocked it at your firewall (or via the accidentally firewall-like properties of a NAT).&lt;/p&gt;&#xA;" OwnerUserId="29763" LastActivityDate="2016-08-18T07:49:11.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34145" PostTypeId="2" ParentId="34139" CreationDate="2016-08-18T09:27:26.957" Score="4" Body="&lt;p&gt;Quick answer is that after the the ack number is sent the first time, it is always sent. It always reflects the next expected sequence number, so unless &lt;strong&gt;new data segments&lt;/strong&gt; arrive, it will be repeated. In other words, if the stack sends a packet that acks incoming byte &lt;em&gt;n&lt;/em&gt;, and for some reason sends a new packet before there has been more incoming data to ack, then the stack will ack byte &lt;em&gt;n&lt;/em&gt; once again.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;why along with PUSH are we again sending an acknowledgement number 1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As for the ack being 1 instead of 2, that is because the ack is data byte count instead of packet count, and while one side is sending 2920 bytes it doesn't seem that the other side is sending any data. A SYN, a PSH and a FIN will count for one byte, and hence a SYN-ACK or a FIN-ACK will count for one byte too. Since there is only one SYN at the beginning, the ACK number will correspond to the 1-based index of the next byte that is expected. In other words &lt;code&gt;ack 1&lt;/code&gt; means &quot;I'm waiting for your first byte of data&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a good explanation over at &lt;a href=&quot;http://packetlife.net/blog/2010/jun/7/understanding-tcp-sequence-acknowledgment-numbers/&quot; rel=&quot;nofollow noreferrer&quot;&gt;packetlife.net&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="22874" LastEditorUserId="22874" LastEditDate="2016-12-16T07:39:57.223" LastActivityDate="2016-12-16T07:39:57.223" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34148" PostTypeId="1" AcceptedAnswerId="34149" CreationDate="2016-08-18T11:39:52.820" Score="1" ViewCount="297" Body="&lt;p&gt;Suppose a network stack receives an incoming message:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ethernet sees that EtherType is IPv4 so the payload is forwarded to the IPv4 handler&lt;/li&gt;&#xA;&lt;li&gt;IPv4 sees that the IP protocol number is ICMP so the message is passed to an ICMP handler&lt;/li&gt;&#xA;&lt;li&gt;ICMP type is &lt;em&gt;Echo-Request&lt;/em&gt; so an &lt;em&gt;Echo-Reply&lt;/em&gt; packet is created and send down to the IP handler&lt;/li&gt;&#xA;&lt;li&gt;IP sends it down to Ethernet&lt;/li&gt;&#xA;&lt;li&gt;However, at this point we need to know the destination MAC address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How is the destination MAC determined?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is it found by inspecting the ethernet header of the original request? &lt;/li&gt;&#xA;&lt;li&gt;Or is it found using ARP? (Searched in ARP cache and ARP request sent if not in cache.)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I used ICMP request as just one example of an incoming request packet. The same question could be asked for handling i.e. a TCP-SYN packet.&lt;/p&gt;&#xA;" OwnerUserId="15769" LastEditorUserId="15769" LastEditDate="2016-08-18T11:51:34.477" LastActivityDate="2016-08-18T11:51:34.477" Title="How do protocol stacks determine the destination mac of reply packets?" Tags="|arp|layer2|layer3|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34149" PostTypeId="2" ParentId="34148" CreationDate="2016-08-18T11:50:12.733" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it found by inspecting the ethernet header of the original request?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. Routing is not always symmetric, so the request may have come from a different router then the one we need to send the reply to.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Or is it found using ARP? (Searched in ARP cache and potential ARP&#xA;  request required)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. First L3 will look up the destination IP in the routing table to determine the IP address of the next hop, then L2 will look up the next hop in the ARP table (and send out an ARP request if not found in the table).&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-08-18T11:50:12.733" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34150" PostTypeId="2" ParentId="34110" CreationDate="2016-08-18T12:48:03.883" Score="0" Body="&lt;p&gt;Typical home/small buisness routers are designed to connect a single local network LAN to a larger network (usually but not nessacerally the internet) usually with NAT (though NAT can be disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The LAN ports connect to your local network (whether wired or wireless), the WAN port connects to your internet connection. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-18T12:48:03.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34151" PostTypeId="2" ParentId="34131" CreationDate="2016-08-18T13:26:11.907" Score="2" Body="&lt;p&gt;If the clasification isn't available on the switch model, then you need to look at something like ACL-based QoS classification (Layers 2, 3, and 4) so that you can mark what traffic, by IP address range for example and tell the hardware how you want to prioritise the traffic with mappings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CoS is for traffic that is layer 2 only. If you need to prioritise traffic that is going to get routed, then you would use DSCP which is layer 3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So CoS will put the marking on an Ethernet frame header and DSCP would do it within the space on a IP header. If the traffic is getting routed, the Ethernet frame get's stripped so you would loose your CoS marking and would rely on DSCP within the IP header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NVdtb.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NVdtb.gif&quot; alt=&quot;CoS and DSCP Marking on Ethernet Frame Header and IP Header&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You achieve more granuality with DSCP compared to CoS as you can set more options because of the difference in bit size since CoS uses only 3 bits to set markings while DSCP uses 6 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, I would advise you seperate your ISCSI network from your core infrastrucure and then you wouldn't even need to worry about QoS.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-08-18T13:26:11.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34154" PostTypeId="2" ParentId="34117" CreationDate="2016-08-18T20:00:17.940" Score="0" Body="&lt;p&gt;As a specialist in this line, I advice YES it does!&#xA;But it is too little to affect you unless you had extended it too much. It also considers the quality of your cable line, connections, and others. But all of these are too minimal to get noticed. If you are talking of below 20 meters for a home, please do not bother to ask. These factors are for 100 meters and above. That is the reason why we have optical line.&lt;/p&gt;&#xA;" OwnerUserId="29798" LastActivityDate="2016-08-18T20:00:17.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34156" PostTypeId="1" AcceptedAnswerId="34160" CreationDate="2016-08-18T21:56:20.167" Score="2" ViewCount="223" Body="&lt;p&gt;When planning an IPv6 strategy is it possible to have link-local only addresses within the core transit network (sort of analogous to a BGP-free MPLS core)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not why not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes are there any disadvantages to using this model; maybe the potential of making troubleshooting a little more difficult, such a traceroutes not working?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there similar deployment models that should be considered (such as a ULA core)?&lt;/p&gt;&#xA;" OwnerUserId="5034" LastActivityDate="2016-08-18T23:44:34.817" Title="IPv6 link-local only core network" Tags="|ipv6|ip-link-local|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34157" PostTypeId="2" ParentId="20138" CreationDate="2016-08-18T22:16:04.770" Score="1" Body="&lt;p&gt;The Cisco 2960 switch is a L3 capable switch. Today switches are usually no longer confined to L2 and the router/switch delineation is blurred from the traditional definitions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are missing the &lt;code&gt;ip routing&lt;/code&gt; command from your config. If you add this command you will find that the VLAN SVIs can route directly between each other on the switch. More information on this feature can be found here: &#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41860-howto-L3-intervlanrouting.html&quot; rel=&quot;nofollow&quot;&gt;Configure InterVLAN Routing on Layer 3 Switches&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I do not see any routing configuration or default gateway configured on your switch whatsoever, so I doubt that the switch itself could reach any remote network assistance. I suspect that proxy-arp is what is being used here and the major classes are what is 'choosing' the VLAN.&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13718-5.html&quot; rel=&quot;nofollow&quot;&gt;Proxy ARP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5034" LastEditorUserId="5034" LastEditDate="2016-08-18T22:22:04.067" LastActivityDate="2016-08-18T22:22:04.067" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34159" PostTypeId="2" ParentId="34156" CreationDate="2016-08-18T23:22:25.017" Score="0" Body="&lt;p&gt;In theory is possible to use link-local IPv6 as gateway address, but IPv6 link-local accessible only from local subnet (it nonroutable), so then how to access equipment for management over IPv6 form other subnets?&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-08-18T23:22:25.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34160" PostTypeId="2" ParentId="34156" CreationDate="2016-08-18T23:44:34.817" Score="6" Body="&lt;p&gt;It is certainly possible and has been done. Usually each device gets a global loopback address for example for iBGP sessions and remote management.&lt;/p&gt;&#xA;&lt;p&gt;Take a look at &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7404&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7404&lt;/a&gt;, it describes exactly what you ask.&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-08-18T23:44:34.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34165" PostTypeId="1" AcceptedAnswerId="34167" CreationDate="2016-08-19T03:08:37.960" Score="2" ViewCount="5378" Body="&lt;p&gt;All these terms are quite related but I couldn't understand when to use which. I often hear that some networks have low bandwidth and high ping rate for online gaming. I thought they might be inversely proportional but that's not the case. When someone introduces &quot;high ping and low ping&quot; it becomes more confusing. What are they?&lt;/p&gt;&#xA;" OwnerUserId="28180" LastActivityDate="2016-08-19T09:15:32.743" Title="What's the difference among bandwidth, ping, ping rate and latency?" Tags="|bandwidth|ping|latency|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34166" PostTypeId="2" ParentId="34165" CreationDate="2016-08-19T06:45:40.410" Score="2" Body="&lt;p&gt;Ping or ping rate, the name of the network diagnostic tool, used to test whether traffic can get through or not. Having a low ping is always desirable because lower latency provides smoother gameplay by allowing faster updates of game data. For more:&lt;a href=&quot;https://en.wikipedia.org/wiki/Ping_(video_gaming)&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Ping_(video_gaming)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Latency is the amount of time, it takes a packet to travel from source to destination, which is normally expressed in  milliseconds. While bandwidth is normally expressed in bits per second. It's the amount of data that can be transferred during a second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, bandwidth is a measure of capacity. Latency is a measure of delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you’re downloading huge files, you probably care more about bandwidth than latency. If you’re trying to watch high-definition video, both are equally important. If you’re playing an online game, latency may be far more important than bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="24835" LastActivityDate="2016-08-19T06:45:40.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34167" PostTypeId="2" ParentId="34165" CreationDate="2016-08-19T06:47:06.960" Score="3" Body="&lt;p&gt;Ping is a utility to test network connectivity. It uses ICMP echo request/reply to do this. The originating host sends an ICMP echo request, and the receiving host sends an ICMP echo reply. There are several messages which may be returned:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The target host could reply, and you have a successful ping.&lt;/li&gt;&#xA;&lt;li&gt;If a certain time period passes before receiving a message, you get a&#xA;timeout. This is caused by the host on a different network not&#xA;replying (firewall, target down, unidirectional routing, etc.) during&#xA;the allotted time period.&lt;/li&gt;&#xA;&lt;li&gt;You could get a destination unreachable message, meaning that the&#xA;layer-3 address could not be resolved to the layer-2 address. This&#xA;implies that either the host is on the same network, and it did not&#xA;respond to ARP, or if the host is on a different network, the&#xA;configured gateway for your host is down or misconfigured.&lt;/li&gt;&#xA;&lt;li&gt;You could get a network unreachable message, meaning the host is on a&#xA;different network, and a router in the path has no route to the&#xA;network for the target host.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Most ping programs run the ping several times, and they return a round-trip ICMP network latency. The Ping program usually gives you the number of packets sent, received, lost, and the loss percent, along with the lowest, highest, and average ping latency. Unfortunately, this is often confused with a real network latency, but the two may not be related on a network with multiple hops, especially the Internet where ICMP is often delayed or rerouted, unlike other traffic. ICMP is not the protocol used for most data communications, and the latency returned by ping may not reflect any other application latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bandwidth is only indirectly related to latency. The bandwidth on an unloaded network has nothing at all to do with the latency. The real network latency is due mostly to network congestion, and bandwidth plays the largest part in that for busy networks. Latency reflect the aggregation of distance latency, and the latency added by network devices in the path. The largest component of the latency is by the network devices, due to congestion on the network, and a busy connection causes congestion.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-19T09:15:32.743" LastActivityDate="2016-08-19T09:15:32.743" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="34168" PostTypeId="1" AcceptedAnswerId="34169" CreationDate="2016-08-19T06:55:32.133" Score="1" ViewCount="421" Body="&lt;p&gt;I'm trying to set up this configuration for testing purposes, but it's not working at all and I don't know why:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cISFO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cISFO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that R3 is not receiving any learned route from bgp neigbors&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The config:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router R1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 192.168.35.209 255.255.255.240&#xA; speed 100&#xA; full-duplex&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.34.10 255.255.255.128&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router bgp 35&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; redistribute connected&#xA; neighbor 192.168.34.3 remote-as 33&#xA; neighbor 192.168.35.210 remote-as 35&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router R2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interface GigabitEthernet0/0&#xA;     ip address 192.168.35.225 255.255.255.240&#xA;     duplex full&#xA;     speed 100&#xA;    !&#xA;    interface GigabitEthernet0/1&#xA;     ip address 192.168.35.210 255.255.255.240&#xA;     duplex full&#xA;     speed 100&#xA;    !&#xA;    router bgp 35&#xA;     bgp log-neighbor-changes&#xA;     redistribute connected&#xA;     neighbor 192.168.35.209 remote-as 35&#xA;     neighbor 192.168.35.226 remote-as 35&#xA;     no auto-summary&#xA;    !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router R3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 192.168.35.241 255.255.255.240&#xA; speed 100&#xA; full-duplex&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.35.226 255.255.255.240&#xA; speed 100&#xA; full-duplex&#xA;!&#xA;router ospf 1&#xA; no compatible rfc1583&#xA; log-adjacency-changes&#xA; network 0.0.0.0 255.255.255.255 area 0&#xA;!&#xA;router bgp 35&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; redistribute connected&#xA; neighbor 192.168.35.225 remote-as 35&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I said before, R3 is not receiving routes from BGP neigbors, for example, the route to &lt;code&gt;192.168.34.0/25&lt;/code&gt; from &lt;code&gt;F0/1&lt;/code&gt; of R1.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER3#sh ip bgp&#xA;BGP table version is 14, local router ID is 192.168.35.241&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*&amp;gt;i192.168.35.208/28&#xA;                    192.168.35.225           0    100      0 ?&#xA;*&amp;gt; 192.168.35.224/28&#xA;                    0.0.0.0                  0         32768 ?&#xA;* i                 192.168.35.225           0    100      0 ?&#xA;*&amp;gt; 192.168.35.240/28&#xA;                    0.0.0.0                  0         32768 ?&#xA;ROUTER_OP1.3#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, R2 and R1 are receiving all routes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER1#sh ip bgp&#xA;BGP table version is 292, local router ID is 1.1.35.1&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*&amp;gt; 10.194.0.0/20    192.168.34.3                           0 33 i&#xA;*&amp;gt; 10.197.48.0/20   192.168.34.3                           0 33 i&#xA;*&amp;gt; 172.31.48.0/24   192.168.34.3                           0 33 i&#xA;*&amp;gt; 172.31.49.0/24   192.168.34.3                           0 33 i&#xA;*&amp;gt; 192.168.34.0/25  0.0.0.0                  0         32768 ?&#xA;* i192.168.35.208/28&#xA;                    192.168.35.210           0    100      0 ?&#xA;*&amp;gt;                  0.0.0.0                  0         32768 ?&#xA;*&amp;gt;i192.168.35.224/28&#xA;                    192.168.35.210           0    100      0 ?&#xA;ROUTER1#&#xA;&#xA;ROUTER2#sh ip bgp&#xA;BGP table version is 343, local router ID is 1.1.35.2&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale, m multipath, b backup-path, x best-externa&#xA;l&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*&amp;gt;i10.194.0.0/20    192.168.34.3             0    100      0 33 i&#xA;*&amp;gt;i10.197.48.0/20   192.168.34.3             0    100      0 33 i&#xA;*&amp;gt;i172.31.48.0/24   192.168.34.3             0    100      0 33 i&#xA;*&amp;gt;i172.31.49.0/24   192.168.34.3             0    100      0 33 i&#xA;*&amp;gt;i192.168.34.0/25  192.168.35.209           0    100      0 ?&#xA;*&amp;gt; 192.168.35.208/28&#xA;                    0.0.0.0                  0         32768 ?&#xA;* i                 192.168.35.209           0    100      0 ?&#xA;* i192.168.35.224/28&#xA;                    192.168.35.226           0    100      0 ?&#xA;*&amp;gt;                  0.0.0.0                  0         32768 ?&#xA;*&amp;gt;i192.168.35.240/28&#xA;                    192.168.35.226           0    100      0 ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you need additional info, please ask for more&lt;/p&gt;&#xA;" OwnerUserId="19546" LastEditorUserId="8499" LastEditDate="2018-12-25T02:17:43.833" LastActivityDate="2018-12-25T02:17:43.833" Title="Problem with ibgp configuration" Tags="|cisco|routing|router|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34169" PostTypeId="2" ParentId="34168" CreationDate="2016-08-19T07:05:35.453" Score="1" Body="&lt;p&gt;The rule for iBGP is that an iBGP peer cannot advertise iBGP routes learned from another iBGP peer. That means that each iBGP peer must be in a full mesh with every other iBGP peer, or you must use a mitigation, e.g. route reflectors or confederations. This is a loop prevention mechanism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3 can only learn eBGP routes from R1 because R2 cannot pass on iBGP routes originated by R1 to R3. R3 would also need to directly peer with R1, and that usually involves an IGP. Alternatively, you could configure R2 as a route reflector.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-19T07:05:35.453" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34171" PostTypeId="1" AcceptedAnswerId="34172" CreationDate="2016-08-19T08:11:58.663" Score="4" ViewCount="1052" Body="&lt;p&gt;I need to find a single subnet range to cover 10,000 IP addresses (hosts), given the IPv6 Address &lt;code&gt;2405:1300:c5c1:322::/108&lt;/code&gt; (for example)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware of how to do subnet in IPv4 but cannot grasp the concept of subnetting in IPv6. Any help or resources would much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="29812" LastEditorUserId="8499" LastEditDate="2018-03-12T00:27:19.333" LastActivityDate="2018-03-12T00:27:19.333" Title="Finding Subnet Ranges of IPv6" Tags="|ip|subnet|ipv6|internet|ip-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34172" PostTypeId="2" ParentId="34171" CreationDate="2016-08-19T08:24:10.950" Score="9" Body="&lt;p&gt;Basically, with IPv6, most subnets will just be /64. Using subnets of other sizes, with a couple of exceptions, will break features of IPv6. See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5375&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 5375, IPv6 Unicast Address Assignment Considerations&lt;/a&gt;, especially &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5375#section-3&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section 3. Subnet Prefix Considerations&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Using a subnet prefix length other than a /64 will break many features&#xA;of IPv6, including Neighbor Discovery (ND), Secure Neighbor Discovery&#xA;(SEND) [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3971&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC3971&lt;/a&gt;], privacy extensions [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4941&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4941&lt;/a&gt;], parts of Mobile IPv6&#xA;[&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4866&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4866&lt;/a&gt;], Protocol Independent Multicast - Sparse Mode (PIM-SM) with&#xA;Embedded-RP [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3956&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC3956&lt;/a&gt;], and Site Multihoming by IPv6 Intermediation&#xA;(SHIM6) [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5375#ref-SHIM6&quot; rel=&quot;nofollow noreferrer&quot;&gt;SHIM6&lt;/a&gt;], among others.  A number of other features currently&#xA;in development, or being proposed, also rely on /64 subnet prefixes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The exceptions to this include loopback addresses (&lt;code&gt;/128&lt;/code&gt;) and point-to-point links (&lt;code&gt;/127&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;There are other RFCs which discuss this, including &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7421&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7421, Analysis of the 64-bit Boundary in IPv6 Addressing&lt;/a&gt;, particularly &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7421#section-4&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section 4. Effects of Varying the Interface Identifier Length&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This section of the document analyzes the impact and effects of&#xA;varying the length of an IPv6 unicast IID by reducing it to less than&#xA;64 bits.&lt;/p&gt;&#xA;&lt;p&gt;4.1.  Interaction with IPv6 Specifications&lt;/p&gt;&#xA;&lt;p&gt;The precise 64-bit length of the IID is widely mentioned in numerous&#xA;RFCs describing various aspects of IPv6.  It is not straightforward to&#xA;distinguish cases where this has normative impact or affects&#xA;interoperability.  This section aims to identify specifications that&#xA;contain an explicit reference to the 64-bit length.  Regardless of&#xA;implementation issues, the RFCs themselves would all need to be&#xA;updated if the 64-bit rule was changed, even if the updates were&#xA;small, which would involve considerable time and effort.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr /&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;In any case, if you want to use other subnet sizes, the subnet concept is &lt;em&gt;exactly&lt;/em&gt; the same for IPv4 and IPv6. The only real difference is obvious: IPv4 addresses are 32 bits, and IPv6 addresses are 128 bits. The recommendation for IPv6 is that you use nibble boundaries, but that is not a requirement. If you need a subnet with 10,000 hosts, then you figure out the next larger power of 2 which can hold that many hosts (&lt;code&gt;14&lt;/code&gt;, in this case, which gives you 16,384 hosts). Subtract &lt;code&gt;14&lt;/code&gt; bits from &lt;code&gt;128&lt;/code&gt;, and you get &lt;code&gt;/114&lt;/code&gt;. One other difference between IPv4 and IPv6 is that you do not need to subtract two from the number of hosts in the subnet since there is no broadcast in IPv6, you can use the all-zeroes and all-ones addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-08-19T08:47:56.600" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34173" PostTypeId="1" AcceptedAnswerId="34175" CreationDate="2016-08-19T09:52:48.450" Score="1" ViewCount="2283" Body="&lt;p&gt;I am trying to setup a separate private network for a rented office in our building. I think i have succeeded in setting up two private LAN networks using port based VLAN's (&lt;code&gt;192.168.10.0/24&lt;/code&gt; and &lt;code&gt;192.168.20.0/24&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the access points are required to be setup using management software on a computer I want to manage each access point from the control station without being able to communicate with the &lt;code&gt;192.168.20.0/24&lt;/code&gt; network, is this possible? If not, what would be a way to have to private LAN's that cannot communicate with each other but would allow me to manage all access points. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HajHR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HajHR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Updated network:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/AtsaQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AtsaQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29814" LastEditorUserId="29814" LastEditDate="2016-08-19T14:01:40.327" LastActivityDate="2016-08-19T14:01:40.327" Title="Manage access point in a different subnet" Tags="|vlan|management|access-point|private-vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34174" PostTypeId="1" CreationDate="2016-08-19T09:58:50.280" Score="1" ViewCount="90" Body="&lt;p&gt;I pinged all hosts in my network. Only my PC and my phone are connected to my network. Therefore I received three addresses, not two. This weird one is &lt;code&gt;192.168.1.1&lt;/code&gt;. It isn't neither my PC nor my phone so anyone knows what it is? &lt;/p&gt;&#xA;" OwnerUserId="29817" LastEditorUserId="8499" LastEditDate="2020-07-17T00:22:05.933" LastActivityDate="2020-07-17T00:22:05.933" Title="Weird address in my network" Tags="|ip|ip-address|lan|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34175" PostTypeId="2" ParentId="34173" CreationDate="2016-08-19T10:02:30.950" Score="0" Body="&lt;p&gt;One of your WAPs is in the &lt;code&gt;192.168.20.0/24&lt;/code&gt; network on an unmanaged switch. That presents a problem if the controller is not allowed to access that network. What you really want to do is set up each WAP with a trunk. You want to trunk a management VLAN to the WAPs, along with the user VLANs for the WAPs. Unfortunately, you can't trunk with an unmanaged switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ideal way is to create a management VLAN, and have the WAPs and the controller all connected to that VLAN. You also trunk whichever user VLANs you want the WAPs to advertise through SSIDs. You will need to replace the unmanaged switch with one that can do VLANs. This will also make the management of the WAPs more secure, and you can use the management VLAN to manage the switches, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-19T10:55:36.163" LastActivityDate="2016-08-19T10:55:36.163" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34176" PostTypeId="2" ParentId="34174" CreationDate="2016-08-19T10:05:00.107" Score="2" Body="&lt;p&gt;That is probably the router (gateway) address. The router is also a host on your LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-19T10:05:00.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34177" PostTypeId="2" ParentId="34174" CreationDate="2016-08-19T10:06:01.507" Score="1" Body="&lt;p&gt;It's very hard to help you with such little information. That IP address could be anything. This being a private address on your network and also ending with .1 would indicate that this is your gateway. So it could be your router. One thing you could try to do is use a tool such as NMAP with Zenmap gui (for convenience) and scan the IP address to get more information about the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try going to that IP address as well in your browser and see whether it is running a web service that will be tell you what it is.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-08-19T10:06:01.507" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34179" PostTypeId="1" AcceptedAnswerId="34184" CreationDate="2016-08-19T11:18:23.043" Score="2" ViewCount="850" Body="&lt;p&gt;In the command completion there is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  active               Remove inactive route from forwarding table&#xA;  [...]&#xA;  install              Install route into forwarding table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can create static routes with or without them and it seems to make no difference. They still get redistributed. What are the practical implications of enabling those options?&lt;/p&gt;&#xA;" OwnerUserId="103" LastActivityDate="2016-10-18T16:08:34.907" Title="What do the instal and active options do when adding a static route in JunOS?" Tags="|routing|juniper|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34180" PostTypeId="1" CreationDate="2016-08-19T11:29:38.160" Score="1" ViewCount="779" Body="&lt;p&gt;I configured the switch for two VLANs, as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Projects-3560-(config)#int vlan11&#xA;&#xA;Projects-3560-(config-if)#ip address 10.110.1.1 255.255.255.0&#xA;&#xA;Projects-3560-(config)#int vlan10&#xA;&#xA;Projects-3560-(config-if)#ip address 10.110.0.1 255.255.0.0&#xA;% 10.110.0.0 overlaps with Vlan11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am getting the above error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want a specific IP address to be used in vlan10, which is &lt;code&gt;10.110.0.180&lt;/code&gt;. Also, I should not change the vlan11 gateway and subnet mask, as it is used by other applications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can any  one help?&lt;/p&gt;&#xA;" OwnerUserId="29822" LastEditorUserId="8499" LastEditDate="2018-12-25T02:18:45.580" LastActivityDate="2018-12-25T02:18:45.580" Title="Required VLAN overlapping allowed?" Tags="|cisco|vlan|subnet|cisco-commands|interface|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34181" PostTypeId="2" ParentId="34180" CreationDate="2016-08-19T11:34:53.347" Score="1" Body="&lt;p&gt;You cannot have networks with overlapping addresses. A router needing to route between the two networks could not determine which network to use. Routing must be deterministic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need a host with an address of &lt;code&gt;10.110.0.180&lt;/code&gt; on VLAN 10, then you could use the &lt;code&gt;10.110.0.0/24&lt;/code&gt; network for VLAN 10 instead of the &lt;code&gt;10.110.0.0/16&lt;/code&gt; network. Change the mask on VLAN 10 to &lt;code&gt;255.255.255.0&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-19T11:40:55.743" LastActivityDate="2016-08-19T11:40:55.743" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="34182" PostTypeId="1" AcceptedAnswerId="35293" CreationDate="2016-08-19T12:28:13.587" Score="1" ViewCount="886" Body="&lt;p&gt;I have this iBGP session established between a Cisco ASR9K and a Cisco 7600 router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the ASR9K device, 'show tcp detail pcb all' displays 'MSS 1240, peer MSS 9152, min MSS 1240, max MSS 1240' for this specific iBGP connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is the actual TCP MSS value the ASR9K is using for that connection? Is it 1240 or 9152?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See more outputs below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASR9K#show tcp detail pcb all&#xA;(...snip...)&#xA;Datagrams (in bytes): MSS 1240, peer MSS 9152, min MSS 1240, max MSS 1240&#xA;&#xA;7600#show ip bgp neighbors X.X.X.X | i Dat&#xA;Datagrams (max data segment is 1240 bytes):&#xA;&#xA;7600#show tcp&#xA;(...snip...)&#xA;Datagrams (max data segment is 1240 bytes):&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-09-27T13:29:12.063" Title="Which is the actual TCP MSS for this iBGP connection on ASR9K running IOS-XR?" Tags="|cisco|tcp|bgp|troubleshooting|cisco-ios-xr|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="34183" PostTypeId="2" ParentId="34117" CreationDate="2016-08-19T13:42:42.610" Score="3" Body="&lt;p&gt;In theory, yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://en.wikipedia.org/wiki/Shannon%E2%80%93Hartley_theorem&quot; rel=&quot;nofollow&quot;&gt;Shannon-Hartley theorem&lt;/a&gt;, maximum achievable capacity of a channel with additive white Gaussian noise is [1].&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[1] bandwidth * log(1 + SNR)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Long runs of cable decrease both its bandwidth (as high frequencies are dispersed) and SNR (as signal amplitude decreases).&lt;/p&gt;&#xA;" OwnerUserId="29825" LastActivityDate="2016-08-19T13:42:42.610" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34184" PostTypeId="2" ParentId="34179" CreationDate="2016-08-19T14:34:47.257" Score="2" Body="&lt;p&gt;&lt;strong&gt;INSTALL&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Configure whether Junos OS installs all static routes into the&#xA;  forwarding table. Even if you configure a route so it is not installed&#xA;  in the forwarding table, the route is still eligible to be exported&#xA;  from the routing table to other protocols.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ACTIVE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Determine whether static, aggregate, or generated routes are removed&#xA;  from the routing and forwarding tables when they become inactive.&#xA;  Static routes are only removed from the routing table if the next hop&#xA;  becomes unreachable. This can occur if the local or neighbor interface&#xA;  goes down. Routes that have been configured to remain continually&#xA;  installed in the routing and forwarding tables are marked with reject&#xA;  next hops when they are inactive&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This information has been taken from the juniper techlibrary site. Links provided below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junos14.1/topics/reference/configuration-statement/active-edit-routing-options.html&quot; rel=&quot;nofollow&quot;&gt;Active Option&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.juniper.net/techpubs/en_US/junos14.1/topics/reference/configuration-statement/install-edit-routing-options.html&quot; rel=&quot;nofollow&quot;&gt;Install Option&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-08-19T14:34:47.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34185" PostTypeId="1" CreationDate="2016-08-19T14:41:49.350" Score="1" ViewCount="343" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zCq6x.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zCq6x.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My knowledge of Cisco is very basic and I´m having this error constantly. I have to reboot every time, and it does not seem right. How can I solve it at once?? What I know of this device is that it has set up a VPN account and other Internet whenever I get the error Internet connection is cut, but not the VPN.&lt;/p&gt;&#xA;" OwnerUserId="26957" LastEditorUserId="8499" LastEditDate="2018-03-13T14:21:43.260" LastActivityDate="2018-03-13T14:21:43.260" Title="Cisco 1800 series: sys-2-chunkexpanfail: error every time" Tags="|cisco|router|troubleshooting|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34186" PostTypeId="2" ParentId="34185" CreationDate="2016-08-19T15:05:55.807" Score="5" Body="&lt;p&gt;If you are on release &lt;strong&gt;12.4(15)T12 | 12.4(24)T2&lt;/strong&gt; then this could be related to a Cisco bug &lt;em&gt;CSCtg26917&lt;/em&gt; with more details on it &lt;a href=&quot;https://quickview.cloudapps.cisco.com/quickview/bug/CSCtg26917&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Symptom:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Chunk manager consume almost all memory. We found the issue is related&#xA;  to NAT&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Conditions:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The memory hold by chunk manager increased quickly while NAT translate&#xA;  increased rapidly.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you are using NAT and are on this version of IOS, it would be adviseable for you to do an upgrade of the firmware.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="27056" LastEditDate="2016-08-19T15:15:54.840" LastActivityDate="2016-08-19T15:15:54.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34187" PostTypeId="2" ParentId="34180" CreationDate="2016-08-19T15:30:47.530" Score="0" Body="&lt;p&gt;It is because the interface configuration mode wants a real IP address with the subnet mask. Something like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Projects-3560-(config-if)#ip address 10.110.0.&lt;strong&gt;1&lt;/strong&gt; 255.255.&lt;strong&gt;255&lt;/strong&gt;.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't assign a network subnet to an interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Josh&lt;/p&gt;&#xA;" OwnerUserId="5653" LastActivityDate="2016-08-19T15:30:47.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34188" PostTypeId="2" ParentId="28703" CreationDate="2016-08-19T17:49:14.517" Score="1" Body="&lt;p&gt;For Internet access you will need a new nat rule on the asa, something like &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Nat (vlan_11, outside) ...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For the vpn to work you need to add the 10.0.11.0 subnet to the cryptomap_outside acl, and also to the crypto acl on the vpn peer .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies for the brief answer, typing this on my phone. Will be glad to expand later if needed. &lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-08-19T17:49:14.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34189" PostTypeId="1" AcceptedAnswerId="34191" CreationDate="2016-08-19T11:23:32.247" Score="13" ViewCount="41839" Body="&lt;p&gt;What is reason to pad payload to mininum 46bytes, to form a ethernet frame of 64 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following says min would be 41 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/14526139/what-is-the-minimum-packet-size-for-tcp-over-ipv4&quot;&gt;https://stackoverflow.com/questions/14526139/what-is-the-minimum-packet-size-for-tcp-over-ipv4&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could not connect the dots, can any one explain this.&lt;/p&gt;&#xA;" OwnerUserId="29931" OwnerDisplayName="Vasu" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2022-09-21T08:25:31.533" Title="Minimum ethernet frame is 64 bytes, Why the payload must be padded to at least 46 bytes" Tags="|ethernet|layer1|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34190" PostTypeId="2" ParentId="34189" CreationDate="2016-08-19T11:37:36.903" Score="4" Body="&lt;p&gt;The &lt;a href=&quot;https://stackoverflow.com/q/14526139/410847&quot;&gt;question&lt;/a&gt; does &lt;em&gt;not&lt;/em&gt; specify the &lt;em&gt;transport medium&lt;/em&gt;. IPv4 can be used with almost anything including serial ports for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet frames have a minimum size, which also depend on speed: 10/100 MBit has 64 byte minimum, while gigabit has 512 byte minimum. This transport layer cannot send smaller packets and thus needs padding.&lt;/p&gt;&#xA;" OwnerDisplayName="Turbo J" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2016-08-19T11:37:36.903" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34191" PostTypeId="2" ParentId="34189" CreationDate="2016-08-19T11:56:59.890" Score="22" Body="&lt;p&gt;The entire frame has to be at least 64 bytes. This is not just the payload, this includes the headers and the frame check sequence. The FCS takes up 4 bytes at the end. An Ethernet header consists of two 6 byte MAC addresses plus a 2 byte type field, 14 bytes in total. 64-4-14 = 46. IPv4 packets have an additional header of at least 20 bytes on top of the Ethernet header, making the minimum payload size 26 bytes. TCP and UDP add more headers on top of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another thing to note is that the size of a minimum length frame on the wire is actually larger than 64 bytes - there is an 8 byte preamble/start of frame delimiter and a 12 byte interframe gap that get attached to every packet, making a 64 byte packet take up 64+8+12 = 84 bytes on the wire.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 41 byte answer on the other question is only considering TCP and IP headers.  If you send a TCP packet with 0 data bytes, it will have 40 bytes of headers; it's not possible to make a valid TCP packet smaller than this.  But if you try to send this packet, it will get zero padded out to 46 bytes before the Ethernet FCS is attached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason this was originally done with Ethernet was to ensure a minimum frame length on the wire so that collisions could be reliably detected by all devices over the specified maximum cable length. This is required because early incarnations of 10M Ethernet used a shared coaxial medium and connected devices had to be able to detect when two of them tried to transmit on the shared medium at the same time. Slightly less ancient 10M and 100M Ethernet networks over twisted pair that were built with hubs instead of switches also needed to be able to detect collisions. However, most modern Ethernet networks are switched and do not use a shared medium, so this is no longer strictly necessary, but it's still part of the spec for compatibility reasons. Frames shorter than 64 bytes are called runt frames, and if you see runt frames in a network that usually indicates some sort of configuration or hardware issue.&lt;/p&gt;&#xA;" OwnerUserId="20021" OwnerDisplayName="alex.forencich" LastEditorUserId="20021" LastEditDate="2018-12-07T19:56:59.623" LastActivityDate="2018-12-07T19:56:59.623" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="34192" PostTypeId="2" ParentId="34189" CreationDate="2016-08-19T19:49:06.537" Score="4" Body="&lt;p&gt;In the original ethernet specification, 64 bytes would fill the cable from end-to-end, allowing collisions to be detected by all hosts. The original ethernet standard also specified 14 bytes for the header, and 4 bytes for the frame check sequence. That is 18 bytes. subtract 18 from 64, and you get 46 as the minimum payload. Since then, you can add a four byte VLAN tag. So, with the VLAN tag, the minimum payload size is 42. Without the VLAN tag, the minimum payload size remains 46.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-19T19:49:06.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34193" PostTypeId="2" ParentId="34117" CreationDate="2016-08-19T21:00:22.383" Score="2" Body="&lt;p&gt;There are two issues to consider, latency and signal integrity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Latency is directly proportional to cable length. However, assuming we are talking about twisted pair Ethernet cables insidea a building the latency will be negligable compared to delays in equipment and in the long distance connections that make up the internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other issue is signal integrity, if it gets too bad then the link will start dropping significant numbers of packets. TCP thinks dropped packets mean congestion and will drop it's speed accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your cable is in-spec and your devices are in-spec and your distance is in-spec then packet loss should be negligable. However there is a lot of out of spec hardware out there, so I would be wary about operating right at the limit of the distance specification.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-19T21:00:22.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34194" PostTypeId="1" AcceptedAnswerId="34195" CreationDate="2016-08-19T22:28:13.083" Score="1" ViewCount="3956" Body="&lt;p&gt;I've built a scenario in Packet Tracer that I am looking at implementing but having issues with pinging from a PC through a L3 switch. From the switch, I can ping every IP address in the environment but any device connected to inside of the switch cannot ping outside the switch. I have done this before and am perplexed by this. Not sure if it's Packet Tracer or me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aNo6J.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aNo6J.jpg&quot; alt=&quot;Layout&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the switch config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HM_SW1#sh run&#xA;Building configuration...&#xA;Current configuration : 1823 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname HM_SW1&#xA;!&#xA;ip dhcp excluded-address 192.168.1.1&#xA;ip dhcp excluded-address 192.168.1.50&#xA;!&#xA;ip dhcp pool 192&#xA;network 192.168.1.0 255.255.255.0&#xA;default-router 192.168.1.1&#xA;dns-server 10.10.0.40&#xA;!&#xA;ip routing&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA;switchport access vlan 192&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;switchport access vlan 100&#xA;!&#xA;interface FastEthernet0/11&#xA;switchport access vlan 10&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA;switchport access vlan 192&#xA;!&#xA;interface GigabitEthernet0/1&#xA;no switchport&#xA;ip address 10.255.255.2 255.255.255.252&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA;no ip address&#xA;!&#xA;interface Vlan10&#xA;mac-address 0005.5ec9.1601&#xA;ip address 10.10.0.1 255.255.255.0&#xA;!&#xA;interface Vlan100&#xA;mac-address 0005.5ec9.1602&#xA;ip address 10.100.0.1 255.255.255.0&#xA;!&#xA;interface Vlan192&#xA;mac-address 0005.5ec9.1603&#xA;ip address 192.168.1.1 255.255.255.0&#xA;!&#xA;ip default-gateway 10.255.255.1&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 10.255.255.1&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA;login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="29838" LastEditorUserId="8499" LastEditDate="2018-12-25T02:19:51.730" LastActivityDate="2018-12-25T02:19:51.730" Title="Can't ping through L3 switch" Tags="|cisco|routing|ping|layer3|packet-tracer|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34195" PostTypeId="2" ParentId="34194" CreationDate="2016-08-19T22:45:53.667" Score="1" Body="&lt;p&gt;What are the router configurations? How do they know about the networks behind the layer-3 switch? Ping is a two-way application, and the routers must be able to return traffic to the networks behind the switch, and if they don't know where the networks are, the traffic will be dropped. You either need to configure static routes on all the routers for those networks, or you need to run a routing protocol to share the route to those networks.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-19T22:45:53.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34196" PostTypeId="1" AcceptedAnswerId="34197" CreationDate="2016-08-19T22:57:17.720" Score="3" ViewCount="5183" Body="&lt;p&gt;I am aware that IEEE 802.3 specifies a half duplex mode for gigabit Ethernet that includes things like carrier extension to prevent the collision domain from shrinking due to the higher data rate...but has this half duplex mode ever actually been used before? It seems like many NICs do not even support it. And I am also not aware of any gigabit hubs, only 10/100 hubs.&lt;/p&gt;&#xA;" OwnerUserId="20021" LastActivityDate="2016-08-19T23:23:54.290" Title="Has half duplex gigabit Ethernet ever been used?" Tags="|ethernet|layer1|half-duplex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34197" PostTypeId="2" ParentId="34196" CreationDate="2016-08-19T23:23:54.290" Score="1" Body="&lt;p&gt;All the NICs actually support half-duplex since autonegotiation is a requirement for 1000BASE-T; you just can't manually configure it. As far as I know, there are no hubs for 1000BASE-T, which is where half-duplex would be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There was a strong movement not to include half-duplex in the 1000BASE-T standard, but it was left in to support hubs. However, half-duplex was left out of the 10GBASE-T standard.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-19T23:23:54.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34198" PostTypeId="1" AcceptedAnswerId="34201" CreationDate="2016-08-19T23:57:24.627" Score="1" ViewCount="460" Body="&lt;p&gt;I have two routers (layer 3 switches to be honest: ex4200 and ex2200). I have zeroized both of them before starting this config. I have set up ge-0/0/12 on one as unit 0 family inet address 10.0.0.1/24 and 10.0.0.2/24 on the other and connected them. I set up ospf on both devices as follows: set protocols ospf area 0.0.0.0 interface ge-0/0/12. run show ospf neighbor tells me that I have a Full state, so the routers have paired. Next, I want to export some routes from one device to the other, but none of the routes I have on either device are being exported. Have I skipped some step?&lt;/p&gt;&#xA;" OwnerUserId="27412" LastActivityDate="2016-08-20T01:16:33.830" Title="OSPF Routes not exporting" Tags="|ospf|juniper|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34199" PostTypeId="2" ParentId="24050" CreationDate="2016-08-20T00:54:06.290" Score="1" Body="&lt;p&gt;I don't have much experience with ubiquiti switches but normally you wouldn't add static routes for networks that are directly connected interfaces. What I think you are looking for is a default route that will send all traffic to a router that is connected to the internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried looking for a configuration example but couldn't find one. Basically, you would create a static route for 0.0.0.0/0 and point that to 192.168.4.254. From the routing table you provided, it looks like the 0.0.0.0/0 route is being sent out eth1 and that may not be correct.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.0.0.0/0 -&amp;gt; 192.168.4.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The 192.168.4.254 device will then need static routes back to your switch with a configuration like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.10.254.0/24 -&amp;gt; 192.168.4.1&#xA;10.1.1.0/24 -&amp;gt;192.168.4.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let me know if that works!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Josh&lt;/p&gt;&#xA;" OwnerUserId="5653" LastEditorUserId="5653" LastEditDate="2016-08-20T02:20:30.333" LastActivityDate="2016-08-20T02:20:30.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34200" PostTypeId="2" ParentId="26191" CreationDate="2016-08-20T01:07:42.817" Score="1" Body="&lt;p&gt;&lt;em&gt;Access Lists&lt;/em&gt; specify particular traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Policy-Based Routing&lt;/em&gt; is a feature for overriding the routing table / forwarding mechanism for all traffic matching an access list.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of key points:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You specify PBR on the incoming interface.&lt;/li&gt;&#xA;&lt;li&gt;Packets that are generated by the router (such as &lt;code&gt;ping&lt;/code&gt;) are not&#xA;normally policy-routed.&lt;/li&gt;&#xA;&lt;li&gt;Logical &lt;code&gt;and / or&lt;/code&gt; concepts including subnet masking and &lt;a href=&quot;https://en.wikipedia.org/wiki/Wildcard_mask&quot; rel=&quot;nofollow noreferrer&quot;&gt;wildcard masking&lt;/a&gt; are applicable.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;see cisco.com: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Policy-Based Routing&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2017-02-16T06:10:59.833" LastActivityDate="2017-02-16T06:10:59.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34201" PostTypeId="2" ParentId="34198" CreationDate="2016-08-20T01:16:33.830" Score="2" Body="&lt;p&gt;OSPF Feature Guide for EX4600 Switches &amp;gt; &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos16.1/topics/concept/ospf-routing-overview.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Juniper OSPF Overview&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;CLI Quick Configuration&lt;/h2&gt;&#xA;&lt;p&gt;To quickly configure an OSPF interface on a broadcast or point-to-point network and to allow the inbound OSPF into the interfaces that are active, copy the following commands, paste them into a text file, remove any line breaks, change any details necessary to match your network configuration, copy and paste the commands into the CLI at the [edit] hierarchy level, and then enter commit from configuration mode.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces ge-0/2/0 unit 0 family inet address 10.0.0.1&#xA;set protocols ospf area 0.0.0.1 interface ge-0/2/0&#xA;set security zones security-zone Trust host-inbound-traffic protocols all&#xA;set security zones security-zone Trust host-inbound-traffic system-services all&#xA;set groups global security policies default-policy permit-all&#xA;set security zones security-zone Trust interfaces ge-0/2/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-20T01:16:33.830" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34202" PostTypeId="2" ParentId="34117" CreationDate="2016-08-20T01:26:40.560" Score="2" Body="&lt;p&gt;Yes.  However, &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;it is not called an Ethernet cable *&lt;/li&gt;&#xA;&lt;li&gt;it is not a connection, it's a transmission&lt;/li&gt;&#xA;&lt;li&gt;humans will not perceive delay introduced by cable length alone&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;*If you are speaking of a local area network you are probably referring to Category 5 or 6 cable.  If you are speaking of a wide area link you are probably referring to single mode fiber optic cable.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-08-20T01:33:49.263" LastActivityDate="2016-08-20T01:33:49.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34211" PostTypeId="1" AcceptedAnswerId="34212" CreationDate="2016-08-20T16:02:46.190" Score="4" ViewCount="1571" Body="&lt;p&gt;What are the differences in performance for IPv4 and IPv6? Is there much of a difference in speed? and what are some of the methods that could be used to test this?&lt;/p&gt;&#xA;" OwnerUserId="25289" LastEditorUserId="8499" LastEditDate="2018-03-12T00:36:18.313" LastActivityDate="2018-03-12T00:36:18.313" Title="IPv4 vs IPv6 performance" Tags="|ipv4|ip|ipv6|performance|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34212" PostTypeId="2" ParentId="34211" CreationDate="2016-08-20T17:29:43.740" Score="8" Body="&lt;p&gt;Based on real-world Internet measurements by large companies, IPv6 has a slight edge in performance. This may be due to several reasons, such as the simplified packet header, or it may be due to other factors which have nothing to do with the protocol itself, such as more lightly loaded DNS servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as testing it yourself, it would be the same way you test anything else. Set up whatever applications you want to test, use each with each protocol, and perform measurements. There are far too many different applications which use both protocols to give you detailed tests, and each person has different ideas about what results to observe, and what they mean.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-20T17:29:43.740" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34214" PostTypeId="1" AcceptedAnswerId="34215" CreationDate="2016-08-20T20:26:21.550" Score="1" ViewCount="269" Body="&lt;p&gt;We have ASR1006 Router and we are running ACL on it to allow specific&#xA;port to specific server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question is there any ACL performance impact on individual IP vs full&#xA;subnet. like following example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;we have 202.100.100.0/24 subnet now i want to use first 200 IPs for&#xA;web server port 80 remaining 55 (whatever) mail service port 25.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now how do i tell ACL to isolate them or subnet them? Other option i&#xA;have i create individual ACL for each IP like following but question&#xA;is does it impact on router performance?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 102 permit tcp any host 202.100.100.1 eq www&#xA;access-list 102 permit tcp any host 202.100.100.2 eq www&#xA;access-list 102 permit tcp any host 202.100.100.3 eq www&#xA;access-list 102 permit tcp any host 202.100.100.4 eq www&#xA;...&#xA;...&#xA;access-list 102 permit tcp any host 202.100.100.201 eq smtp&#xA;access-list 102 permit tcp any host 202.100.100.202 eq smtp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is there any performance impact on individual ACL vs /24 full subnet? &lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-08-20T21:45:16.900" Title="Cisco ACL performance question?" Tags="|cisco|firewall|acl|performance|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34215" PostTypeId="2" ParentId="34214" CreationDate="2016-08-20T21:45:16.900" Score="2" Body="&lt;p&gt;You always can use wildcards to create your access list, i think with that, you will reduce the matching process of the router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ACL of your example will result like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; access-list 102 permit tcp any 202.100.100.0 0.0.0.127 eq www&#xA; access-list 102 permit tcp any 202.100.100.128 0.0.0.63 eq www&#xA; access-list 102 permit tcp any 202.100.100.192 0.0.0.7 eq www&#xA; access-list 102 permit tcp any 202.100.100.200 0.0.0.31 eq smtp&#xA; access-list 102 permit tcp any 202.100.100.232 0.0.0.15 eq smtp&#xA; access-list 102 permit tcp any 202.100.100.248 0.0.0.7 eq smtp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-08-20T21:45:16.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34216" PostTypeId="1" AcceptedAnswerId="34217" CreationDate="2016-08-20T22:06:42.097" Score="1" ViewCount="1024" Body="&lt;p&gt;As far as I understand, BGP synchronization is a feature now disabled by default. It only allows iBGP routes to be selected as best (and hence further advertised to other neighbors) if there is a matching IGP route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a router (R1) running both BGP (in AS100) and EIGRP. The Router is route reflector in AS100 and connected to another router (R8) which in turn is connected to R10 in AS54. R8 learns a route from R10 (112.0.0.0/8), which it advertises further to R1. These external routers are not redistributed into EIGRP, hence are not available at R1 through other means than BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh run | s eigrp|bgp&#xA;router eigrp 100&#xA; network 155.1.0.0&#xA; redistribute connected route-map ONLY_LOOPBACK&#xA;router bgp 100&#xA; ! sync is enabled&#xA; synchronization&#xA; bgp log-neighbor-changes&#xA; network 150.1.1.1 mask 255.255.255.255&#xA; ! R8 neighbor&#xA; neighbor 155.1.58.8 remote-as 100&#xA; neighbor 155.1.58.8 route-reflector-client&#xA; ! R4 neighbor&#xA; neighbor 155.1.146.4 remote-as 100&#xA; neighbor 155.1.146.4 route-reflector-client&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 does not have an IGP route to 112.0.0.0/8 (EIGRP) and does not run any other routing protocol:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh ip eigrp topo 112.0.0.0/8&#xA;EIGRP-IPv4 Topology Entry for AS(100)/ID(150.1.1.1)&#xA;%Entry 112.0.0.0/8 not in topology table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BGP also marks both possible paths to 112.0.0.0/8 as not synchronized:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1# sh ip bgp 112.0.0.1&#xA;BGP routing table entry for 112.0.0.0/8, version 2&#xA;Paths: (2 available, best #2, table default)&#xA;  Advertised to update-groups:&#xA;     1         &#xA;  Refresh Epoch 1&#xA;  54 50 60, (Received from a RR-client)&#xA;    155.1.58.8 (metric 3328) from 155.1.58.8 (150.1.8.8)&#xA;      Origin IGP, metric 0, localpref 100, valid, internal, not synchronized&#xA;      rx pathid: 0, tx pathid: 0&#xA;  Refresh Epoch 1&#xA;  54 50 60, (Received from a RR-client)&#xA;    155.1.67.7 (metric 3072) from 155.1.67.7 (150.1.7.7)&#xA;      Origin IGP, metric 0, localpref 100, valid, internal, not synchronized, best&#xA;      rx pathid: 0, tx pathid: 0x0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;According to my knowledge, both of them are internal routes (received from an iBGP peer) and both are not synchronized. Hence they should not be considered as candidate for best path and R1 should not advertise that path any further.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as seen before, it has still selected path #2 as best and advertises the path further to other RR-clients, for example to R4:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4#sh ip bgp 112.0.0.0&#xA;BGP routing table entry for 112.0.0.0/8, version 0&#xA;Paths: (1 available, no best path)&#xA;  Not advertised to any peer&#xA;  Refresh Epoch 2&#xA;  54 50 60&#xA;    155.1.67.7 (inaccessible) from 155.1.146.1 (150.1.1.1)&#xA;      Origin IGP, metric 0, localpref 100, valid, internal, not synchronized&#xA;      Originator: 150.1.7.7, Cluster list: 150.1.1.1&#xA;      rx pathid: 0, tx pathid: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is advertised from R1 (150.1.1.1 / 155.1.146.1). At R4, the route is considered as not synchronized and accordingly there is no best path. But why is it advertised by R1 in the first place? Why does R1 select a best path when both available paths are not synchronized?&lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="8499" LastEditDate="2019-01-05T00:05:54.067" LastActivityDate="2019-01-05T00:05:54.067" Title="Cisco BGP synchronization not taking effect" Tags="|cisco|routing|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34217" PostTypeId="2" ParentId="34216" CreationDate="2016-08-20T22:21:19.960" Score="1" Body="&lt;p&gt;I think you misunderstand BGP synchronization. BGP synchronization means that a BGP router will not advertise a prefix to an eBGP peer until all routers in your AS know about the route via an IGP. In other words, eBGP will not advertise a route to an eBGP peer unless the route exists in its routing table via an IGP. Cisco has many documents to explain BGP. For instance, &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5816-bgpfaq-5816.html#nineteen&quot; rel=&quot;nofollow&quot;&gt;BGP: Frequently Asked Questions&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q. What is synchronization, and how does it influence BGP routes&#xA;  installed in the IP routing table?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A. If your AS passes traffic from another AS to a third AS, BGP should&#xA;  not advertise a route before all routers in your AS learn about the&#xA;  route via IGP. BGP waits until IGP propagates the route within the AS&#xA;  and then advertises it to external peers. A BGP router with&#xA;  synchronization enabled does not install iBGP learned routes into its&#xA;  routing table if it is not able to validate those routes in its IGP.&#xA;  Issue the &lt;strong&gt;no synchronization&lt;/strong&gt; command under &lt;strong&gt;router bgp&lt;/strong&gt; in order&#xA;  to disable synchronization. This prevents BGP from validating iBGP&#xA;  routes in IGP. Refer to &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk365/technologies_tech_note09186a00800c95bb.shtml#synch&quot; rel=&quot;nofollow&quot;&gt;BGP Case Studies: Synchronization&lt;/a&gt; for a&#xA;  more detailed explanation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is a rule in iBGP that an iBGP peer cannot advertise any prefixes learned via iBGP. That has nothing to do with BGP synchronization. That means that your iBGP peers must have a full mesh (via an IGP, or with direct connections between all BGP peers), or you must use a mitigation (route reflectors or confederations).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-20T22:21:19.960" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34219" PostTypeId="1" CreationDate="2016-08-20T23:53:03.717" Score="2" ViewCount="11522" Body="&lt;p&gt;In my topology, I have connected spirent - traffic generator to MRV switch ( L1 switch) and then connected to CISCO switch. I am seeing some input errors on this interface. What does it mean? Does it mean that some packets are bad from spirent MRV switch. here is the show command of the interface gi 0/13.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my topology, spirent is connected to MRV switch ( L1 switch).&#xA;MRV switch interface gi 0/13 is connected to the CISCO switch interface gi 0/14.&#xA;I don't see any errors on the gi 0/14 of the cisco switch. However, I see the errors on the gi 0/13 ,which is the interface coming from MRV. Does it mean that CISCO switch is telling that there is some problem in the MRV switch?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  1557336 input errors, 1557204 CRC, 0 frame, 0 overrun, 0 ignored&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My quesion is what the above error indicates to me.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; c3560g_1&amp;gt;sh interfaces gi 0/13    &#xA;    GigabitEthernet0/13 is up, line protocol is up (connected) &#xA;      Hardware is Gigabit Ethernet, address is 0013.c4d0.570d (bia 0013.c4d0.570d)&#xA;      Description: -- MRV, 1.1.19 --&#xA;      MTU 1500 bytes, BW 1000000 Kbit, DLY 10 usec, &#xA;         reliability 255/255, txload 1/255, rxload 1/255&#xA;      Encapsulation ARPA, loopback not set&#xA;      Keepalive set (10 sec)&#xA;      Full-duplex, 1000Mb/s, media type is 10/100/1000BaseTX&#xA;      input flow-control is off, output flow-control is unsupported &#xA;      ARP type: ARPA, ARP Timeout 04:00:00&#xA;      Last input never, output 00:00:01, output hang never&#xA;      Last clearing of &quot;show interface&quot; counters never&#xA;      Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;      Queueing strategy: fifo&#xA;      Output queue: 0/40 (size/max)&#xA;      5 minute input rate 0 bits/sec, 0 packets/sec&#xA;      5 minute output rate 1000 bits/sec, 2 packets/sec&#xA;         80971440 packets input, 125278495288 bytes, 0 no buffer&#xA;         Received 0 broadcasts (0 multicasts)&#xA;         132 runts, 0 giants, 0 throttles&#xA;         1557336 input errors, 1557204 CRC, 0 frame, 0 overrun, 0 ignored&#xA;         0 watchdog, 0 multicast, 0 pause input&#xA;         0 input packets with dribble condition detected&#xA;         24289474 packets output, 36669631614 bytes, 0 underruns&#xA;         0 output errors, 0 collisions, 5 interface resets&#xA;         0 babbles, 0 late collision, 0 deferred&#xA;         0 lost carrier, 0 no carrier, 0 PAUSE output&#xA;         0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13278" LastEditorUserId="8499" LastEditDate="2018-12-25T02:22:08.983" LastActivityDate="2018-12-25T02:22:08.983" Title="what are input errors on the CISCO switch?" Tags="|cisco|switch|cisco-catalyst|interface|statistics|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34220" PostTypeId="2" ParentId="34219" CreationDate="2016-08-20T23:58:39.770" Score="1" Body="&lt;p&gt;If you look closely, you have 1557204 CRC errors, and 132 runts, for a total of 1557336 input errors. You may have a layer-1 problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The runts are frames which are too small, and the CRC errors mean that the frames didn't match what the FCS says they should be. This is a sign of corrupt frames coming into the interface. This can be caused by several things, but it is likely a layer-1 problem. You should &lt;em&gt;always&lt;/em&gt; start troubleshooting at layer-1.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-20T23:58:39.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34223" PostTypeId="1" CreationDate="2016-08-21T10:34:51.603" Score="2" ViewCount="974" Body="&lt;p&gt;We have the following access list on our router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit ip 10.16.43.0 0.0.0.255 172.50.0.0 0.0.127.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Traffic from our router flows through our Cisco ASA. I have been told that I need to create an access list on the ASA that is the reverse of the access list on our router above, I created the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 extended permit ip 172.50.0.0 255.255.128.0 10.16.43.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But that I have been told that's incorrect. Can someone let me know what it should be?&lt;/p&gt;&#xA;" OwnerUserId="21461" LastEditorUserId="453" LastEditDate="2017-09-16T06:26:06.713" LastActivityDate="2018-02-13T09:59:04.150" Title="Cisco Network ACL on ASA" Tags="|router|cisco-asa|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34224" PostTypeId="2" ParentId="34223" CreationDate="2016-08-21T12:12:59.503" Score="1" Body="&lt;p&gt;You are allowing 172.50.0.0/17 full access to 10.16.43.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that was your intention then this is all good&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure why you should do the reverse? &lt;/p&gt;&#xA;" OwnerUserId="18743" LastActivityDate="2016-08-21T12:12:59.503" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34227" PostTypeId="1" AcceptedAnswerId="34230" CreationDate="2016-08-21T14:17:31.397" Score="1" ViewCount="80" Body="&lt;p&gt;Is Access-group the old command of the Access-list for old routers? or they're just complete each other because when I do an Access-list I need to go to the port and use Access-group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or they are just separated commands complete each others?&lt;/p&gt;&#xA;" OwnerUserId="23760" LastActivityDate="2016-08-21T15:06:10.917" Title="Access-list is it the same command of Access-group?" Tags="|network-core|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34228" PostTypeId="1" AcceptedAnswerId="34311" CreationDate="2016-08-21T14:39:39.857" Score="1" ViewCount="457" Body="&lt;p&gt;Does the CRS 1000v support KVM service containers? I opened a case with Cisco Partner Helpline, and according to the BU the answer is yes. However the router seems to disagree:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show virtual-service &#xA;Virtual Service Global State and Virtualization Limits:&#xA;...&#xA;Machine types supported   : LXC&#xA;Machine types disabled    : KVM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And when I try to activate a KVM OVA that I installed it generates this log message:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%VMAN-3-GENERAL_FAILURE: F0: vman:  Virtual Service[SCDemoVM]::Activate::Internal error::Machine type 'kvm' is not supported&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router version is 16.03.01 (Denali).&lt;/p&gt;&#xA;" OwnerUserId="29877" LastActivityDate="2016-08-24T02:34:01.290" Title="KVM Service Container on CRS 1000v?" Tags="|cisco|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34230" PostTypeId="2" ParentId="34227" CreationDate="2016-08-21T15:06:10.917" Score="5" Body="&lt;p&gt;Proceeding from the assumption that you are talking about Cisco gear, it is basically as you said, they complete each other. Neither an access-list nor an access-group on its own will have any effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, you configure an access-list first, which contains the rules permitting or denying the traffic. You can match on things like source and destination address, layer 4 protocol and layer 4 port information (source and destination port as applicable). You however cannot specify where this policy should be applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is where the access-group comes in. Using the access-group, you can apply a previously defined access-list to an interface and further configure the direction of traffic that should be filtered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the following example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 100 permit tcp 10.0.0.0 0.0.0.255 host 192.168.178.2 eq 443&#xA;interface GigabitEthernet 0/0&#xA;  ip access-group 100 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that each access-list has an implicit deny ip any any at the end, which means that every traffic not permitted explicitly before will be dropped. To change that behaviour, you can put the following line at the end of the access-list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 100 permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This applies the access list to Interface Gi 0/0 in the inbound direction, which means that the traffic is filtered when it enters the router using the specified interface.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-08-21T15:06:10.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34231" PostTypeId="1" AcceptedAnswerId="34232" CreationDate="2016-08-21T17:04:30.990" Score="1" ViewCount="112" Body="&lt;p&gt;Could you please explain why when sending EIGR updates only delay of incomig interfaces are summarized and delay of outgoing interfaces is not considered. Please see picture below:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/wkULB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wkULB.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19524" LastEditorUserId="8499" LastEditDate="2019-01-04T22:42:00.580" LastActivityDate="2019-01-04T22:42:00.580" Title="EIGRP delay summarization?" Tags="|cisco|routing|eigrp|igp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34232" PostTypeId="2" ParentId="34231" CreationDate="2016-08-21T17:58:34.207" Score="2" Body="&lt;p&gt;What your drawing has is one, or both, of the routers overriding the interface delay. Under normal circumstances, the delay of a link is exactly the same on both ends. One of the routers may be doing that on purpose to influence routing. Changing the delay is a common way to influence routing. The other way would be to manually change the bandwidth, but that could affect things like QoS. Changing the delay is a safer way to influence the routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason is that you would be double counting the delay for a link. If, for example, the default delay for the link is 100, and R2 added the outgoing delay, of 100 and R1 added the incoming delay of 100, the link delay would be counted as 200, but it is really only 100.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-21T17:58:34.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34236" PostTypeId="1" CreationDate="2016-08-21T18:52:31.260" Score="1" ViewCount="1480" Body="&lt;p&gt;What cable connects routers to communicate ?&#xA;I am using Packet Tracer Simulator, and I connected 2 routers using a DTE connector. After doing this, I am unable to ping between the 2 routers. Is using a DTE cable the best for connecting routers?&lt;/p&gt;&#xA;" OwnerUserId="29881" LastEditorUserId="8499" LastEditDate="2018-12-25T02:24:15.197" LastActivityDate="2018-12-25T02:24:15.197" Title="how to connect 2 routers to communicate?" Tags="|cisco|router|layer1|packet-tracer|interface|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34237" PostTypeId="2" ParentId="34236" CreationDate="2016-08-21T18:59:07.783" Score="1" Body="&lt;p&gt;You must be using a serial connection. A serial connection needs the host on one end to be a DTE (Data Terminal Equipment), and the host on the other end to be a DCE (Data Communications Equipment). A DTE talks to a DCE. The router configured as DCE is the one where you set the clock rate and other interface parameters.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-21T18:59:07.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34242" PostTypeId="1" CreationDate="2016-08-22T07:34:49.810" Score="2" ViewCount="459" Body="&lt;p&gt;i have configured netflow in my router but my router is overheaded.&#xA;So i decided to configure sampled netflow and sampling rate of 1 out of 100 packets may reduce the export if Netflow data by as musch as 50 percent.So you know its not suitable for security monitoring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know whats background in &quot;multiply by the sampling rate to calculate actual traffic stats&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whats your recommendation ?  is there any solution on collector?&lt;/p&gt;&#xA;" OwnerUserId="9946" LastEditorUserId="9946" LastEditDate="2016-08-22T08:05:33.393" LastActivityDate="2016-08-23T13:58:47.400" Title="Sampled Netflow" Tags="|security|monitoring|netflow|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34243" PostTypeId="1" AcceptedAnswerId="34254" CreationDate="2016-08-22T07:46:23.840" Score="1" ViewCount="758" Body="&lt;p&gt;I am about to plan a Core Switch for a customer, who has only access switches connected to each other. I'd like to connect every core switch with two fiber connections to each of the two HPE 5130. I read somewhere, that you can only cross-connect if the switches support distributed trunking. The 5130 apparently does not support this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This seems a little odd and if I had to guess, pretty much every full stack supports this. But before we buy the Core components I'd like to make absolutely sure that we can have the access switches cross connected on both 5130 switches&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone here who can tell me with absolute certainty that this will not be a problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot in advance&lt;/p&gt;&#xA;" OwnerUserId="18743" LastEditorUserId="18743" LastEditDate="2016-08-22T11:56:47.590" LastActivityDate="2016-08-22T12:34:52.903" Title="Distributed Trunking with HPE 5130?" Tags="|switch|hp|trunk|etherchannel|stacking|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34244" PostTypeId="1" CreationDate="2016-08-22T07:47:54.500" Score="2" ViewCount="759" Body="&lt;p&gt;Below is my architecture&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/CYzcK.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CYzcK.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I have a 2 MX240 routers terminating diverse path circuits from 2 ISPs. Now, I would like to configure multipath BGP confiugration. If One ISP goes down totally on both routers, traffic will go out through other ISP connection. Is it possible to have such configuration in Juniper routers and any pointers on it would be helpful.  &lt;/p&gt;&#xA;" OwnerUserId="22114" LastActivityDate="2016-08-27T18:40:19.487" Title="BGP multihoming and Multipath configuration" Tags="|bgp|redundant-routes|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34245" PostTypeId="2" ParentId="34242" CreationDate="2016-08-22T07:51:17.917" Score="2" Body="&lt;p&gt;Most of the DDOS appliance can get input of sampling rate and multiply the values and should be able to detect volume attacks easily. So you don't need to worry about sampling. Most of the ISPs/DDOS protection providers uses sampled netflow for DDOS detection purpose. 1:100 is ok to have on DDOS perspective. It depends on what kind of collector you use. &lt;/p&gt;&#xA;" OwnerUserId="22114" LastActivityDate="2016-08-22T07:51:17.917" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34246" PostTypeId="1" AcceptedAnswerId="34273" CreationDate="2016-08-22T07:55:44.967" Score="1" ViewCount="1809" Body="&lt;p&gt;I enabled SNMP and Traps on a cisco router and I used &lt;code&gt;snmp-server enable traps cpu threshold&lt;/code&gt; command in configuration mode.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured &lt;strong&gt;LinkUp-Down&lt;/strong&gt; Traps with &lt;code&gt;snmp-server enable traps snmp linkup linkdown&lt;/code&gt; and this is send traps to 172.16.98.28/24 host and after enable &lt;strong&gt;cpu threshold&lt;/strong&gt;, no traps send to 172.16.98.28/24 host.&lt;br&gt;&#xA;What's wrong?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Device: c3640 IOS 12.4&lt;/p&gt;&#xA;" OwnerUserId="22692" LastEditorUserId="22692" LastEditDate="2016-08-22T18:34:55.693" LastActivityDate="2016-08-23T06:01:07.740" Title="Cisco CPU utilization threshold violation traps" Tags="|cisco|snmp|cpu|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="34249" PostTypeId="2" ParentId="34117" CreationDate="2016-08-22T10:00:45.713" Score="0" Body="&lt;p&gt;Long cables will increase your latency since the signal has longer to go. This shouldn't matter much in your case since the signal propagates near the speed of light, the extra 10 meters will be imperceptible compared to the many miles to whatever server you are accessing. There will be some loss of signal over extremely long runs which will reduce bandwidth but shouldn't be significant over 20 meters, 100 meters is the point where you have to start worrying about the length of the run.&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-08-22T10:00:45.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34252" PostTypeId="1" CreationDate="2016-08-22T11:00:13.610" Score="0" ViewCount="68" Body="&lt;p&gt;Is the signal-to-interference-and-noise-ratio (SINR) always lower than the received power (P_r)? I mean, can I suppose that the SINR&#xA;&#xA;&lt;p&gt;Thank you so much for your help, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards&lt;/p&gt;&#xA;" OwnerUserId="29905" LastActivityDate="2016-09-21T13:16:34.243" Title="SINR vs received power" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34254" PostTypeId="2" ParentId="34243" CreationDate="2016-08-22T12:29:51.767" Score="2" Body="&lt;p&gt;5130s are Comware based devices and support IRF (Intelligent Resilient Framework) stacking.  This is a front-plane stacking technology, so you do not need to buy additional modules to support the stacking.  You can stack up to 9 devices using the 10Gbps optics in the front panel SFP+ ports.  I would recommend you don't go above 4 devices in a stack as there is the possibility for larger stacks to perform poorly.  I'd also recommend using a ring topology for the stack.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the devices are stacked you can aggregate ports across chassis using the standard Bridge-Aggregation (L2) and Route-Aggregation (L3) commands.  Configuring link-aggregation across chassis is the same as configuring link-aggregation on an unstacked single switch, apart from the interfaces are prefixed with the chassis number, so GigEthernet port 4 on chassis 2 becomes G2/0/4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yes, you can configure a link-aggregation group across devices and I have done this a number of times with 5130s.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-08-22T12:34:52.903" LastActivityDate="2016-08-22T12:34:52.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34255" PostTypeId="2" ParentId="34252" CreationDate="2016-08-22T12:40:22.590" Score="1" Body="&lt;p&gt;SINR and received power are in different units, so it doesn't make sense to say one is less than the other.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-22T12:40:22.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34257" PostTypeId="2" ParentId="29997" CreationDate="2016-08-22T16:42:57.807" Score="1" Body="&lt;p&gt;Link-local addresses are defined by the prefix FE80:/10, but in practice FE80:/64 is used as defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#section-2.5.6&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Link-Local addresses have the following format:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|   10     |&#xA;|  bits    |         54 bits         |          64 bits           |&#xA;+----------+-------------------------+----------------------------+&#xA;|1111111010|           0             |       interface ID         |&#xA;+----------+-------------------------+----------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As you can see, the network ID part (the first half, &amp;quot;X:X:X:X&amp;quot;) is fixed, only the interface ID (the last 64 bits) can be modified.&lt;/p&gt;&#xA;&lt;p&gt;You can find more information in this related question: &lt;a href=&quot;https://networkengineering.stackexchange.com/q/130/27387&quot;&gt;Why is fe80::/10 reserved for link local addresses when fe80::/64 is actually used?&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27387" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-08-22T16:42:57.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34258" PostTypeId="1" AcceptedAnswerId="34260" CreationDate="2016-08-22T17:12:29.623" Score="1" ViewCount="1900" Body="&lt;p&gt;Brief description: I have two juniper switches, an EX2200 and an EX4200. They are connected physically and OSPF is in the Full state, so they each see their neighbor, but they are not seeing the routes of their neighbors. In other words, the lsdb is empty of their neighbor's routes. Can anyone see any issue with my setup? I have a pc connected to the ex2200 as part of a vlan, so the route to the vlan l3 interface would be exported to the ex4200 if everything was done correctly, right?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Last changed: 2015-02-12 16:02:25 UTC&#xA;version 12.3R9.4;&#xA;system {&#xA;    host-name top;&#xA;    root-authentication {&#xA;        encrypted-password &quot;$1$obtezp63$ymdQGDYSYDxbkqCV7Yf5t/&quot;; ## SECRET-DATA&#xA;    }&#xA;    services {&#xA;        dhcp {&#xA;            traceoptions {&#xA;                file dhcp_logfile;&#xA;                level all;&#xA;                flag all;&#xA;            }&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any notice;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands any;&#xA;        }&#xA;    }&#xA;}&#xA;chassis {&#xA;    auto-image-upgrade;&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members left;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members left;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members left;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members left;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/4 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members right;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/5 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members right;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/6 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members right;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/7 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members right;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/8 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/9 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/10 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/11 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/12 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.0.0.2/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/13 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/14 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/15 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/16 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/17 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/18 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/19 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/20 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/21 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/22 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 12.0.0.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/23 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/25 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/26 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/27 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/28 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/29 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/30 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/31 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/32 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/33 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/34 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/35 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/36 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/37 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/38 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/39 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/40 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/41 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/42 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/43 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/44 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/45 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/46 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/47 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    me0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                dhcp {&#xA;                    vendor-id Juniper-ex2200-48p-4g;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 0;&#xA;        unit 111 {&#xA;            family inet {&#xA;                address 192.168.1.1/24;&#xA;            }&#xA;        }&#xA;        unit 222 {&#xA;            family inet {&#xA;                address 192.168.2.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    router-id 10.0.0.2;&#xA;}&#xA;protocols {&#xA;    ospf {&#xA;        area 0.0.0.0 {&#xA;            interface ge-0/0/12.0 {&#xA;                authentication {&#xA;                    md5 1 key &quot;$9$vUs8xd24Zk.5bs.5QFAtM8X&quot;; ## SECRET-DATA&#xA;                }&#xA;            }&#xA;            interface ge-0/0/0.0;&#xA;        }&#xA;    }&#xA;    igmp-snooping {&#xA;        vlan all;&#xA;    }&#xA;    rstp;&#xA;    lldp {&#xA;        interface all;&#xA;    }&#xA;    lldp-med {&#xA;        interface all;&#xA;    }&#xA;}&#xA;ethernet-switching-options {&#xA;    storm-control {&#xA;        interface all;&#xA;    }&#xA;}&#xA;vlans {&#xA;    default {&#xA;        l3-interface vlan.0;&#xA;    }&#xA;    left {&#xA;        vlan-id 111;&#xA;        l3-interface vlan.111;&#xA;    }&#xA;    right {&#xA;        vlan-id 222;&#xA;        l3-interface vlan.222;&#xA;    }&#xA;}&#xA;poe {&#xA;    interface all;&#xA;}&#xA;Last changed: 2015-04-10 01:07:45 UTC&#xA;version 13.2X51-D35.3;&#xA;system {&#xA;    host-name bottom;&#xA;    root-authentication {&#xA;        encrypted-password &quot;$1$dl.RvnLA$eJVUlArlIR1mau08boxqv0&quot;; ## SECRET-DATA&#xA;    }&#xA;    syslog {&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any notice;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands any;&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members left;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/4 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                port-mode access;&#xA;                vlan {&#xA;                    members right;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/5 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/6 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/7 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/8 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/9 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/10 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/11 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/12 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.0.0.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/13 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/14 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/15 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/16 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/17 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/18 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/19 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/20 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/21 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/22 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/23 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    xe-0/1/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    xe-0/1/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    xe-0/1/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/1/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    em1 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 192.168.1.145/24;&#xA;                address 10.0.19.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    em2 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.0.20.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    em3 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.0.21.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 111 {&#xA;            family inet {&#xA;                address 192.168.1.234/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    router-id 10.0.0.1;&#xA;}&#xA;protocols {&#xA;    ospf {&#xA;        area 0.0.0.0 {&#xA;            interface ge-0/0/12.0 {&#xA;                authentication {&#xA;                    md5 1 key &quot;$9$bwY4ZHqfn/tUj/tuOcSwYg&quot;; ## SECRET-DATA&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    igmp-snooping {&#xA;        vlan all;&#xA;    }&#xA;    rstp;&#xA;    lldp {&#xA;        interface all;&#xA;    }&#xA;    lldp-med {&#xA;        interface all;&#xA;    }&#xA;}&#xA;ethernet-switching-options {&#xA;    storm-control {&#xA;        interface all;&#xA;    }&#xA;}&#xA;vlans {&#xA;    left {&#xA;        vlan-id 111;&#xA;        l3-interface vlan.111;&#xA;    }&#xA;    right {&#xA;        vlan-id 222;&#xA;    }&#xA;}&#xA;poe {&#xA;    interface all;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27412" LastActivityDate="2016-08-22T17:53:50.300" Title="OSPF setup between EX2200 and EX4200" Tags="|ospf|juniper|juniper-ex|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34259" PostTypeId="1" AcceptedAnswerId="37698" CreationDate="2016-08-22T17:31:34.170" Score="1" ViewCount="1051" Body="&lt;p&gt;I have fortigate 300C firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have create the web-filter policy for one department, I have added only websites which are allowed (around 1200 websites) rest all I want to block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But somehow filter is not working, proxy websites and other websites like fantacycricket, viu.com, etc are still opening. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On last line of filter I have added * wildcard -&gt; block. Still it is not working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me out. &lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2020-12-25T08:45:51.013" Title="Fortigate 300C : Web-Filter not working" Tags="|firewall|fortigate|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34260" PostTypeId="2" ParentId="34258" CreationDate="2016-08-22T17:53:50.300" Score="4" Body="&lt;p&gt;You don't have any layer-3 interfaces in area 0 other than the link between the two switches, so you don't have any routes to exchange between them. You need to add the layer-3 interfaces you wish to advertise under the [ protocol ospf ] stanza, preferably as &quot;passive&quot; interface (so you can't inadvertently form adjacencies on those interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols ospf area 0.0.0.0 interface vlan.111 passive&#xA;set protocols ospf area 0.0.0.0 interface vlan.222 passive&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another possibility is to use an export policy to inject (all) directly connected routes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols ospf export export_direct&#xA;set policy-options policy-statement export_direct from protocol direct&#xA;set policy-options policy-statement export_direct then accept&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-08-22T17:53:50.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34264" PostTypeId="1" CreationDate="2016-08-22T20:06:41.503" Score="5" ViewCount="1156" Body="&lt;p&gt;Is there a way to monitor conditions (as with ipsla etc) in a switch (or specific to a given port channel) and trigger the removal/shutdown of a member from within a port-channel?  Example - after x% errors, remove the interface from service/throw an alert.  Thank you in advance for your feedback!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2019-07-04T00:26:01.070" Title="Triggered removal of members of a port-channel?" Tags="|cisco|port-channel|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34267" PostTypeId="1" CreationDate="2016-08-22T22:42:05.853" Score="2" ViewCount="185" Body="&lt;p&gt;I'm still new to networking and have a question or problem I need to solve, but I'm not sure how to move forward. I need to stop PC0 from Vlan10 from talking to PC5 in Vlan30, but he must be able to still talk to PC4 which is also in Vlan30. How many ACLs do I need?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what commands do I add to them. I know standard ACLs, and I worked with extended, but like I said, I'm still new and not sure how to block one PC and not the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JVf9t.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JVf9t.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29922" LastEditorUserId="8499" LastEditDate="2018-12-25T02:25:31.950" LastActivityDate="2018-12-25T02:25:31.950" Title="Simple ACL question" Tags="|cisco|router|cisco-commands|packet-tracer|acl|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34268" PostTypeId="2" ParentId="34267" CreationDate="2016-08-22T22:46:12.830" Score="1" Body="&lt;p&gt;You can do this with a single extended ACL because it has both a source and destination address. You can use the host keyword on both addresses since you only want to block one host from reaching another host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended TEST&#xA; deny ip host &amp;lt;PC0 address&amp;gt; host &amp;lt;PC5 address&amp;gt;&#xA; permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In general, standard ACLs should be placed as close to the destination as possible, in order to not block too much, and extended ACLs should be placed as close to the source as possible, in order to keep the router from needlessly routing traffic which will be dropped.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-22T22:46:12.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34271" PostTypeId="2" ParentId="32172" CreationDate="2016-08-23T03:45:28.430" Score="1" Body="&lt;p&gt;DHCP (Server) options typically include default gateway and DNS server at a minimum.  The default gateway option should specify the router/gateway IP address for the subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically, each VLAN carries traffic for a unique subnet and a layer3 device does inter-VLAN routing.  To forward/direct DHCP request from a subnet to a DHCP server on a different subnet, you need to configure that to happen.  In Cisco IOS, it is called an &lt;code&gt;ip helper address&lt;/code&gt; and is applied to the layer3 interface for the VLAN(s) that the DHCP server(subnet) is not on.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-23T03:45:28.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34272" PostTypeId="2" ParentId="34264" CreationDate="2016-08-23T04:47:55.077" Score="1" Body="&lt;p&gt;+1 @BrianWinningJr. also, use LACP (Port Channel Active) to ensure that the link is up end-to-end.  This will automatically remove failed links and return them to service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful if you opt to automate this that you don't end up removing all ports from a port channel!&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-08-23T04:47:55.077" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34273" PostTypeId="2" ParentId="34246" CreationDate="2016-08-23T05:53:02.840" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Step 1 :&lt;/strong&gt; &lt;code&gt;snmp-server enable traps cpu threshold&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Step 2 :&lt;/strong&gt; &lt;code&gt;process cpu threshold type total rising 80 interval 5&lt;/code&gt;  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In &lt;strong&gt;Step 1&lt;/strong&gt; i'm enabled &lt;strong&gt;CPU Threshold Trap&lt;/strong&gt; and in &lt;strong&gt;Step 2&lt;/strong&gt; i'm enabled &lt;strong&gt;CPU Threshold&lt;/strong&gt; for each 5 second if CPU percent is 80.&lt;/p&gt;&#xA;" OwnerUserId="22692" LastEditorUserId="22692" LastEditDate="2016-08-23T06:01:07.740" LastActivityDate="2016-08-23T06:01:07.740" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34274" PostTypeId="1" AcceptedAnswerId="34278" CreationDate="2016-08-23T07:09:01.300" Score="2" ViewCount="908" Body="&lt;p&gt;Is there a metric/specification that shows flexibility/elasticity of a utp cable? I have to install a utp cable and it will have to go around some sharp corners. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what little experience I have with patch cables some seem to be more flexible than others.  What should I pay attention to when choosing the cable?&lt;/p&gt;&#xA;" OwnerUserId="29930" LastEditorUserId="8499" LastEditDate="2018-03-20T23:46:17.737" LastActivityDate="2018-03-20T23:46:17.737" Title="Flexibility of a UTP cable" Tags="|ethernet|layer1|cable|power-over-ethernet|utp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34276" PostTypeId="1" AcceptedAnswerId="34487" CreationDate="2016-08-23T09:49:07.503" Score="2" ViewCount="3488" Body="&lt;p&gt;There is one thing I do not understand in this IEEE 80211ac MU-MIMO specification and it concerns the way an Access Point can safely acquire a channel via the RTS/CTS mechanism before sending multiple frames to Stations.&lt;/p&gt;&#xA;&lt;h3&gt;Example network&lt;/h3&gt;&#xA;&lt;p&gt;Consider the following IEEE 80211ac wireless network in Infrastructure mode:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/86gfJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/86gfJ.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Now, the AP wants to send data and it will use MU-MIMO in order to send 2 packets:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One to STA1&lt;/li&gt;&#xA;&lt;li&gt;One to STA2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Acquiring channel&lt;/h2&gt;&#xA;&lt;p&gt;AP should acquire the channel so how does it do that?&lt;/p&gt;&#xA;&lt;h3&gt;Option 1&lt;/h3&gt;&#xA;&lt;p&gt;RTS/CTS base:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;AP send a RTS to STA1&lt;/li&gt;&#xA;&lt;li&gt;STA2 will hear the RTS and keeps quiet&lt;/li&gt;&#xA;&lt;li&gt;STA1 sends CTS.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Seems fine, but the problem is that nobody notified the stations in range with STA2 which might start sending stuff while STA2 should listen for incoming frames.&lt;/p&gt;&#xA;&lt;h3&gt;Option 2&lt;/h3&gt;&#xA;&lt;p&gt;A global RTS is sent? And everybody responds with a CTS? Seems strange as AP needs to poll in sequences for CTS responses as it does with ACK frames...&lt;/p&gt;&#xA;&lt;p&gt;It is very confusing. Can you explain me how AP acquires the channel?&lt;/p&gt;&#xA;" OwnerUserId="29934" LastEditorUserId="36720" LastEditDate="2021-07-02T17:59:36.387" LastActivityDate="2021-07-02T17:59:36.387" Title="How does an AP acquire a channel via RTS/CTS in IEEE802.11ac?" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="34277" PostTypeId="2" ParentId="34264" CreationDate="2016-08-23T11:24:51.243" Score="0" Body="&lt;p&gt;One problem with removing interfaces from a channel is that it is a link, and you suddenly have multiple links between the two devices: the channel and the interface removed from the channel. Then you have have STP deciding which link is blocking, and which link is forwarding, and you may not want what STP decides (the failing link is the one forwarding).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can certainly get alerts on interface/link problems via SNMP or some other alert mechanism that you have set up.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-23T12:59:15.687" LastActivityDate="2016-08-23T12:59:15.687" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34278" PostTypeId="2" ParentId="34274" CreationDate="2016-08-23T11:52:43.067" Score="2" Body="&lt;p&gt;Patch cables use stranded wire. This makes them more flexible, but performance is less than solid-core conductors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Horizontal cables use solid-core wire, which makes them less flexible, but performance is better. These cables are not meant to be moved much after installation because repeated movement can break the solid wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solid-core horizontal cable can be run for up to 90 meters, and the stranded patch cables on each end can total up to 10 meters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UTP, in general, has an unloaded minimum bend radius of 4 times the cable diameter, which is about .25&quot;, so the minimum bend radius is about 1&quot; with no tension.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also a maximum pulling tension when installing cables:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The maximum pulling tension for 4-pair, 24 AWG horizontal UTP cables&#xA;  should not exceed 110 N (25 lbf) to avoid stretching the conductors&#xA;  during installation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Exceeding the bend radius or pulling tension can ruin a cable, and it will not pass the required test suite once it is installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ANSI/TIA/EIA maintains the standards for cabling, especially the &lt;em&gt;ANSI/TIA/EIA 568 Commercial Building Telecommunications Cabling Standard&lt;/em&gt; and &lt;em&gt;ANSI/TIA/EIA 569 Commercial Building Standard for Telecommunications Pathways and Spaces&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you have the experience and proper tools, including a (very expensive) cable tester that can run the full test suite for the cable category which you are installing, you really are better off hiring a professional to do the installation.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-23T11:52:43.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34279" PostTypeId="1" CreationDate="2016-08-23T13:05:35.640" Score="0" ViewCount="39" Body="&lt;p&gt;We have a Honeywell control board that has an Ethernet controller.  We have assigned a static IP address as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP:  10.2.112.12&#xA;Mask:  255.255.254.0&#xA;GW:  10.2.112.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The gateway is a Cisco router.  Periodically, the device will become unreachable from outside the subnet it's on.  After running a Wireshark capture, I see that, during the night, the device went from asking for ARP requests to get the MAC address of 10.2.112.2 to asking for the MAC address of 10.2.112.4 (which is our Cisco ASA firewall).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have reached out to the vendor of the board and they insist it's an issue with our network.  I still think it's their board, but does anyone have any ideas what might be configured on our network to cause this behavior?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Scott&lt;/p&gt;&#xA;" OwnerUserId="29938" LastActivityDate="2016-08-25T20:37:24.150" Title="Cisco gateway and firewall changing addresses?" Tags="|cisco|cisco-asa|arp|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34282" PostTypeId="2" ParentId="34242" CreationDate="2016-08-23T13:58:47.400" Score="4" Body="&lt;p&gt;Typically, the approach is indeed just &quot;multiply the observed octet/packet sample counts by 100&quot; (or 1000, or whatever) and that does pretty well for getting overall traffic volumes roughly correct. It gets packet count almost exactly right, because it's sampling every 100 packets. It gets octet count more or less right because ordinarily the bytes-per-packet ratio is pretty steady.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For individual sessions, however, accuracy varies a lot: long-running high volume sessions like streaming video or large downloads? Does pretty well for the same reasons as above. Very short sessions like ICMP or DNS? It can overestimate them by quite a lot, and many of them are missed entirely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main issues that have been identified with sampled flow are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Short flows get individually lost&lt;/li&gt;&#xA;&lt;li&gt;Large flows can no longer be accurately ranked by volume&lt;/li&gt;&#xA;&lt;li&gt;Flows get created less often&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Of those, the only thing that really affects DDoS detection in most environments is the last one, since it can incur a delay. Sampled flow is just fine for determining &quot;am I under attack&quot; when that attack is a large portion of your traffic because it does get the overall volume roughly right even if individual flows are lost entirely. If the attack on a given host is not a large portion of your overall traffic, though, you'll run into both delay and accuracy issues. And if you're looking to identify sources, you're going to have a still harder time of it. (But since so many of these attacks use spoofed sources, I doubt that's an issue for you.) Also, if you're using this NetFlow stream for anything else, you'll need to be aware that the accuracy of the &quot;civilian&quot; traffic counts will be reduced (appear to be smaller than it is) during an attack, as a side effect of all the one-packet flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other thing that sampling affects is the session count itself, which is nearly always undercounted, and can affect the ability to detect low-volume/high-session-count attacks on the protocol. I can't answer for SiLK, since I don't know it as well and can't find it in the documentation, but I do know that FlowTraq (with which I'm far more familiar) uses some a priori knowledge of the effect of sampling on session count to reconstruct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most collectors will do the statistical reconstruction, with the caveat that your router has to actually provide the sampling rate (make sure your router follows the spec for reporting sampling rate and method). Again, I'm more familiar with FlowTraq than with SiLK, but I know SiLK is at least aware of sampling rate. What I don't know is how SiLK handles it, and skimming their documentation didn't enlighten me. I would recommend doing a large file transfer of known size and looking at the flow records SiLK stores: if it has the order of magnitude right, then it's reconstructing. If it's not reconstructing (or your router isn't providing the rate), then in a pinch, you can always divide your detection thresholds by 100 or 1000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(If you're interested in getting into the mathematics of sampled NetFlow, by the way, Hamed Haddadi has a couple papers on the topic)&lt;/p&gt;&#xA;" OwnerUserId="82" LastActivityDate="2016-08-23T13:58:47.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34283" PostTypeId="1" AcceptedAnswerId="34284" CreationDate="2016-08-23T14:17:05.807" Score="1" ViewCount="53" Body="&lt;p&gt;I was told in a previous answer to use &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended TEST&#xA; deny ip host &amp;lt;PC0 address&amp;gt; host &amp;lt;PC5 address&amp;gt;&#xA; permit ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, whats the command to set it on the router interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like you would usually use &lt;code&gt;ip access-group 101 out&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="29922" LastEditorUserId="8499" LastEditDate="2018-12-25T02:27:50.787" LastActivityDate="2018-12-25T02:27:50.787" Title="How do i set this ACL on the router" Tags="|cisco|router|cisco-commands|acl|interface|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34284" PostTypeId="2" ParentId="34283" CreationDate="2016-08-23T14:24:37.930" Score="1" Body="&lt;p&gt;I'm not sure I understand your question, but you seem to have the answer in your question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-group 101 out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Although, with extended access lists like 101, you should put them as close to the source as possible, so you normally would put that on the inbound interface, rather than the outbound interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-group 101 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same would hold true for a named ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-group TEST in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Put a standard ACL on the outbound interface as close to the destination as possible (the interface to the destination), and an extended ACL as close to the source as possible (the interface from the source). This will keep a standard ACL from blocking too much traffic, and an extended ACL has both a source and destination, so it will keep the routers from routing traffic that will be dropped anyway.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-23T14:57:45.703" LastActivityDate="2016-08-23T14:57:45.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34285" PostTypeId="1" AcceptedAnswerId="34286" CreationDate="2016-08-23T14:40:28.817" Score="1" ViewCount="946" Body="&lt;p&gt;I've consulted the spec &lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow&quot;&gt;https://www.ietf.org/rfc/rfc2328.txt&lt;/a&gt; and have googled to the end of the internet but I'm confused on OSPF Point-To-Point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Link State ID: 4.4.4.4&#xA;  Advertising Router: 4.4.4.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And then in my Router-LSA Update I have the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; (Link ID) Neighboring Router ID: 2.2.2.2&#xA; (Link Data) Router Interface address: 10.0.1.1&#xA; Number of TOS metrics: 0&#xA; TOS 0 Metrics: 64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know this means that OSPF Router 4.4.4.4 has a point-to-point connection to 2.2.2.2 via the interface 10.0.1.1  However, my question is as follows:  Does the 10.0.1.1. interface reside on the 4.4.4.4 router or the 2.2.2.2 router?&lt;/p&gt;&#xA;" OwnerUserId="27000" LastEditorUserId="8499" LastEditDate="2019-01-04T23:27:04.293" LastActivityDate="2019-01-04T23:27:04.293" Title="OSPF Point-To-Point Question" Tags="|routing|ospf|protocol-theory|rfc|point-to-point|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34286" PostTypeId="2" ParentId="34285" CreationDate="2016-08-23T14:56:18.473" Score="3" Body="&lt;p&gt;What you are seeing is the neighbor Router ID and interface IP address. This is explained in the RFC on pages 12 and 13, particularly the point-to-point link of figure 1a:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;                                              **FROM**&#xA;&#xA;                                       *      |RT1|RT2|&#xA;            +---+Ia    +---+           *   ------------&#xA;            |RT1|------|RT2|           T   RT1|   | X |&#xA;            +---+    Ib+---+           O   RT2| X |   |&#xA;                                       *    Ia|   | X |&#xA;                                       *    Ib| X |   |&#xA;&#xA;                 Physical point-to-point networks&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A router will know its own interface IP addresses, but it needs to know the interface IP address of its neighbor. If it knows the interface IP address of its neighbor, then it knows which interface to use to reach that neighbor.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-23T14:56:18.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34287" PostTypeId="2" ParentId="34285" CreationDate="2016-08-23T15:05:47.083" Score="0" Body="&lt;p&gt;This is the IP address on router 4.4.4.4, the advertising router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With OSPF P2P links, you should see two links for each P2P adjacent router within the router LSA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first link is of link type P2P with a Link ID of the other router's router ID (2.2.2.2) and Link Data should be the IP address of the advertising router on the adjacent subnet (10.0.1.1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also see a second link, which is a Stub Network link to the subnet on the adjacent interface.  This will have a link ID of the network (not sure but could be 10.0.1.0 in this case) and Link Data will contain the subnet mask (255.255.255.0?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is all in the RFC 2328 page 129&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may seem confusing as you would expect the IP address to be that of the adjacent router.  This information is not needed when calculating the SPF as OSPF only needs to see a connection to the other router and any onward networks reachable by that router.  When the router needs to actually forward a packet to an adjacent router it uses the neighbor IP address's associated MAC address to forward the packet onwards.  This IP address can be seen using show ip ospf neighbor on a Cisco router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set this up in the lab:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1:&#xA;&#xA;interface GigabitEthernet0/0&#xA; ip address 10.0.1.1 255.255.255.252&#xA; ip ospf network point-to-point&#xA;&#xA; router ospf 1&#xA;  router-id 4.4.4.4&#xA;  network 10.0.0.0 0.255.255.255 area 0&#xA;&#xA;&#xA;R2:&#xA;&#xA;interface GigabitEthernet0/1&#xA; ip address 10.0.1.2 255.255.255.252&#xA; ip ospf network point-to-point&#xA;&#xA;router ospf 1&#xA; router-id 2.2.2.2&#xA; network 10.0.0.0 0.255.255.255 area 0&#xA;&#xA;&#xA;R1#sh ip ospf data router self-originate &#xA;&#xA;            OSPF Router with ID (4.4.4.4) (Process ID 1)&#xA;&#xA;        Router Link States (Area 0)&#xA;&#xA;  LS age: 66&#xA;  Options: (No TOS-capability, DC)&#xA;  LS Type: Router Links&#xA;  Link State ID: 4.4.4.4&#xA;  Advertising Router: 4.4.4.4&#xA;  LS Seq Number: 80000004&#xA;  Checksum: 0x865D&#xA;  Length: 48&#xA;  Number of Links: 2&#xA;&#xA;    Link connected to: another Router (point-to-point)&#xA;     (Link ID) Neighboring Router ID: 2.2.2.2&#xA;     (Link Data) Router Interface address: 10.0.1.1&#xA;      Number of MTID metrics: 0&#xA;       TOS 0 Metrics: 1&#xA;&#xA;    Link connected to: a Stub Network&#xA;     (Link ID) Network/subnet number: 10.0.1.0&#xA;     (Link Data) Network Mask: 255.255.255.252&#xA;      Number of MTID metrics: 0&#xA;       TOS 0 Metrics: 1&#xA;&#xA;&#xA;R2#sh ip ospf data router self-originate &#xA;&#xA;            OSPF Router with ID (2.2.2.2) (Process ID 1)&#xA;&#xA;        Router Link States (Area 0)&#xA;&#xA;  LS age: 105&#xA;  Options: (No TOS-capability, DC)&#xA;  LS Type: Router Links&#xA;  Link State ID: 2.2.2.2&#xA;  Advertising Router: 2.2.2.2&#xA;  LS Seq Number: 80000004&#xA;  Checksum: 0x7179&#xA;  Length: 48&#xA;  Number of Links: 2&#xA;&#xA;    Link connected to: another Router (point-to-point)&#xA;     (Link ID) Neighboring Router ID: 4.4.4.4&#xA;     (Link Data) Router Interface address: 10.0.1.2&#xA;      Number of MTID metrics: 0&#xA;       TOS 0 Metrics: 1&#xA;&#xA;    Link connected to: a Stub Network&#xA;     (Link ID) Network/subnet number: 10.0.1.0&#xA;     (Link Data) Network Mask: 255.255.255.252&#xA;      Number of MTID metrics: 0&#xA;       TOS 0 Metrics: 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-08-23T18:33:52.547" LastActivityDate="2016-08-23T18:33:52.547" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34292" PostTypeId="1" AcceptedAnswerId="34302" CreationDate="2016-08-23T16:45:46.897" Score="0" ViewCount="554" Body="&lt;p&gt;We are running offline network analysis by capturing packets to files and analyzing afterwards with automated system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our Wireshark @ Ubunty command line looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wireshark -k -i eth0  -y EN10MB -b duration:900 -b filesize:1024 -n -w /home/mss2/Capture/packets/ubuntlive1mb -f 'ip and (net X.X.X.X/22)'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A week ago traffic increased twice in volume so we have drive space issues.&#xA;As a temporarily solution we are deleting every second file as this will not affect overall stats (percentages of traffic types) that bad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder is there the way to tell wireshark (or maybe other program?) to capture not all by every second packet?&lt;/p&gt;&#xA;" OwnerUserId="29787" LastActivityDate="2016-08-23T23:09:11.507" Title="How to capture to file every second packet?" Tags="|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34294" PostTypeId="2" ParentId="29798" CreationDate="2016-08-23T18:43:24.883" Score="2" Body="&lt;p&gt;You can combine a maximum of 4 x 10500 switches in an IRF cluster.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-08-23T18:43:24.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34295" PostTypeId="1" AcceptedAnswerId="34460" CreationDate="2016-08-23T19:45:08.077" Score="0" ViewCount="538" Body="&lt;p&gt;I've site-to-site VPN connection between an ASA and multiple Cisco routers.&#xA;The identity certificates need to be renewed from time to time at the CA site and I didn't have problem until now.&#xA;I'm unable to import the renewed certificates with 3 of my devices:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterA(config)#crypto ca import Trustpoint_A certificate &#xA;&#xA;Enter the base 64 encoded certificate.&#xA;End with a blank line or the word &quot;quit&quot; on a line by itself&#xA;&#xA;...&#xA;&amp;lt;renewed certificate&amp;gt;&#xA;....&#xA;&#xA;% Failed to parse or verify imported certificate&#xA;&#xA;RouterA(config)#&#xA;Aug 23 13:09:37.994: Read 960 bytes as CA certificate: &#xA;...&#xA;&amp;lt;hexa&amp;gt;&#xA;...&#xA;Aug 23 13:09:38.102: E /users/michaelr/unpack/tk-003.commit/src/obj-4k/../cert-c/source/certobj.c(715) : Error #722h&#xA;Aug 23 13:09:38.106: CRYPTO_PKI: can not set ca cert object (0x722)&#xA;Aug 23 13:09:38.106: CRYPTO_PKI: status = 65535: failed to get key usage from cert&#xA;Aug 23 13:09:38.106: CRYPTO_PKI: status = 65535: failed to verify or insert the cert into storage&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All 3 devices are Cisco 1841 with the following IOS:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;c1841-advipservicesk9-mz.124-3i.bin   x2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;c1841-advipservicesk9-mz.124-19b.bin&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I did 2 renewals with Cisco 1941 and 2821 without problems (also today).&#xA;A few months before I did successful certification renewals on 3 other Cisco 1841&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;c1841-advipservicesk9-mz.124-13f.bin&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;c1841-adventerprisek9-mz.124-15.T13.bin&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;c1841-advipservicesk9-mz.124-15.T6.bin&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I didn't find any abnormality in the configurations. I use quite the same setup everywhere. Do you have any idea what should I look for? Any useful debug or something to check? I don't have a clue now...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="16778" LastActivityDate="2016-08-29T12:03:02.630" Title="IPSEC VPN - Failed identity certification renewal" Tags="|vpn|ipsec|certification|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="34296" PostTypeId="1" CreationDate="2016-08-23T20:10:58.157" Score="4" ViewCount="323" Body="&lt;p&gt;I'm trying to identify teredo packets on a network, and I'm getting conflicting information on whether or not the Teredo relay machine, which sends the actual ipv6 encapsulated traffic, listens on port 3544. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RFC4380 doesn't seem to have any concrete information on if the teredo relay machine listens on a specific port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However this paper by symantec, says that the relay can use any udp port&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;The standard port on which the Teredo servers listen is UDP port 3544. Both clients and relays can use any UDP port for their Teredo service, so their UDP service port could be ephemeral.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From here on page 9, &lt;a href=&quot;https://www.symantec.com/avcenter/reference/Teredo_Security.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.symantec.com/avcenter/reference/Teredo_Security.pdf&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And later says that to properly identify teredo packets, I would have to attempt to parse all udp packets as teredo to be sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, on Microsoft's website on teredo, &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/bb968770(v=vs.85).aspx&quot; rel=&quot;nofollow&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/desktop/bb968770(v=vs.85).aspx&lt;/a&gt;&#xA;It says that the Teredo Relay listens on port 3544.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that's the case, then I could just attempt to parse packets with port 3544 as teredo, and that would be much less processing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what is the case? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="29951" LastActivityDate="2018-01-16T15:16:53.027" Title="Identifying teredo packets and teredo relay port" Tags="|routing|ipv4|ip|tunnel|ipv6-transition|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34298" PostTypeId="2" ParentId="34107" CreationDate="2016-08-23T21:27:25.803" Score="1" Body="&lt;p&gt;The final step was the routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routing-options {&#xA;    static {&#xA;        route 192.168.2.0/24 next-hop st0.0;&#xA;    }&#xA;}&#xA;security {&#xA;    policies {&#xA;        from-zone vpn to-zone trust {&#xA;            policy vpn-to-trust {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone trust to-zone vpn {&#xA;            policy trust-to-vpn {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Debian:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ip addr add 192.168.2.2/24 dev eth0&#xA;# ip route add to 192.168.1.0/24 via 192.168.2.2 src 192.168.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29711" LastActivityDate="2016-08-23T21:27:25.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34299" PostTypeId="1" CreationDate="2016-08-23T22:04:28.873" Score="3" ViewCount="653" Body="&lt;p&gt;The TCPv4 specification (RFC 793) &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793#page-69&quot; rel=&quot;nofollow noreferrer&quot;&gt;classifies a received segment as unacceptable&lt;/a&gt; if it has zero length, a sequence number equal to &lt;code&gt;RCV.NXT&lt;/code&gt;+&lt;code&gt;RCV.WND&lt;/code&gt; while the receive window is not zero (second row in the table).&lt;/p&gt;&#xA;&lt;p&gt;This essentially means that the segment will be discarded, other than possibly sending an &lt;code&gt;ACK&lt;/code&gt;. No &lt;code&gt;ACK&lt;/code&gt; processing or send window update will be done.&lt;/p&gt;&#xA;&lt;p&gt;What is the justification of this?&lt;/p&gt;&#xA;&lt;p&gt;Consider this scenario:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Host A sends all possible data segments to host B, just exhausting the  receive window of B.&lt;/li&gt;&#xA;&lt;li&gt;Host A shortly also sends an empty segment, e.g. a window update or acknowledgement of received data. This segment has sequence number equal to the right edge of the receive window of host B (&lt;code&gt;RCV.NXT&lt;/code&gt;+&lt;code&gt;RCV.WND&lt;/code&gt;), since it was set to the latest &lt;code&gt;SND.NXT&lt;/code&gt; of host A.&lt;/li&gt;&#xA;&lt;li&gt;The mentioned data packets are lost in the network or delayed, and host B receives the empty segment first.&lt;/li&gt;&#xA;&lt;li&gt;Host B will classify the empty segment as not acceptable, and drop it, ignoring any acknowledgement or window update.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;This seems to be particularly problematic, because the receiver will typically &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793#page-72&quot; rel=&quot;nofollow noreferrer&quot;&gt;ignore seemingly older window updates&lt;/a&gt; based on the combination of sequence number and acknowledgement number. But just those window updates that won't get filtered out (highest sequence number) would be dropped even earlier due to segments not being considered acceptable.&lt;/p&gt;&#xA;&lt;p&gt;Is there some part that I am not understanding correctly? Is this scenario really possible?&lt;/p&gt;&#xA;" OwnerUserId="29954" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2022-04-25T20:33:26.680" Title="Why is an empty TCP segment at right edge of receive window not acceptable?" Tags="|tcp|protocol-theory|transport-protocol|layer4|rfc|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="34300" PostTypeId="1" AcceptedAnswerId="34301" CreationDate="2016-08-23T22:05:37.500" Score="1" ViewCount="1049" Body="&lt;p&gt;I am currently in a setup where I connect to the internet using wired internet. I directly plug in an ethernet wire from the ISP. They have provided me an internal LAN IP address which in turn is mapped to a static external IP address using NAT. The setup is like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Laptop -&gt; Ethernet Port(Internal IP) -&gt; ISP Gateway -&gt; External IP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to access services such as WAMP, RDP, VNC on my Win 10 laptop from the internet but am unable to do so using the external IP. But I am able to access everything when I am using the internal IP of my network. I did a traceroute of connections both to and fro from my machine. The results are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Tracing route to google.com [216.58.196.110] over a maximum of 30 hops:&#xA;&#xA;  1     1 ms     1 ms    &amp;lt;1 ms  172.16.161.129   &#xA;  2     *        1 ms     1 ms  node-103-249-5-97.alliancebroadband.in [103.249.5.97]   &#xA;  3     2 ms     2 ms     2 ms  aes-static-017.50.144.59.airtel.in [59.144.50.17]   &#xA;  4    36 ms    35 ms    35 ms  182.79.243.18   &#xA;  5    35 ms    36 ms    35 ms  72.14.242.178   &#xA;  6    36 ms    37 ms    35 ms  216.239.56.32   &#xA;  7    36 ms    36 ms    35 ms  216.239.40.45   &#xA;  8    36 ms    36 ms    36 ms  maa03s19-in-f110.1e100.net [216.58.196.110]&#xA;&#xA;Trace complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Reverse trace:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute to 45.249.69.90 (45.249.69.90), 30 hops max, 60 byte packets&#xA;&#xA;&#xA;1               *   *   *               &#xA;2   core22.hetzner.de   213.239.229.133 de  0.238 ms    0.260 ms     &#xA;    core21.hetzner.de   213.239.229.129 de  0.212 ms                &#xA;3   core4.hetzner.de    213.239.245.14  de  4.857 ms         &#xA;    core1.hetzner.de    213.239.245.218 de  4.863 ms     &#xA;    core1.hetzner.de    213.239.245.177 de  4.861 ms    &#xA;4   dx1.in.airtel.com   80.81.194.250   de  20.908 ms   20.913 ms   20.912 ms               &#xA;5               *   *   *           &#xA;6   aes-static-018.50.144.59.airtel.in  59.144.50.18    in  160.893 ms  159.746 ms  161.467 ms              &#xA;7   node-103-249-5-133.alliancebroadband.in 103.249.5.133   in  159.026 ms  159.177 ms  159.407 ms&#xA;8               *   *   *&#xA;9               *   *   *&#xA;10              *   *   *&#xA;No reply for 3 hops. Assuming we reached firewall.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am confused by the fact that the last node of my ISP is different for both cases. &lt;strong&gt;103.249.5.97&lt;/strong&gt; for outgoing and &lt;strong&gt;103.249.5.133&lt;/strong&gt; for incoming. Is that normal?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, 3rd party remote desktop services such as &lt;strong&gt;teamviewer&lt;/strong&gt; or &lt;strong&gt;webex&lt;/strong&gt; are working fine. How does this work then?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help how I get this to work will be much appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Windows Firewall is disabled at my end.&lt;/p&gt;&#xA;" OwnerUserId="29955" LastActivityDate="2016-08-23T22:18:38.243" Title="Can't access my PC using external IP" Tags="|nat|ip|network-access|" AnswerCount="1" CommentCount="0" ClosedDate="2019-02-28T20:56:30.553" ContentLicense="CC BY-SA 3.0" />
  <row Id="34301" PostTypeId="2" ParentId="34300" CreationDate="2016-08-23T22:18:38.243" Score="1" Body="&lt;p&gt;The first hop, &lt;code&gt;172.16.161.129&lt;/code&gt;, belongs to your ISP (based on what you have written), and that is an RFC 1918 private IPv4 address. That means your ISP is using CGN. You need to forward the specific ports on the NAT, but the NAT belongs to the ISP, so you can't do that, and the ISP will not do it for you since those ports would only work for you, and none of the other customers using that IPv4 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as having different addresses, asymmetric routing is common. Traffic can come back a different way than it went out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is your business, you need to pay your ISP for a public, usually static, IPv4 address if you want to be able to get to your network from the public Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-23T22:18:38.243" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34302" PostTypeId="2" ParentId="34292" CreationDate="2016-08-23T23:09:11.507" Score="2" Body="&lt;p&gt;While this does not skip alternate packets, it will help with capture size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the &lt;code&gt;-s&lt;/code&gt; option will allow you to only capture the first part of the packet. For example &lt;code&gt;-s 84&lt;/code&gt; should give you all the headers down to TCP. If you're not troubleshooting down in to the application the that should be enough. You could do &lt;code&gt;-s 128&lt;/code&gt; to capture the first part of the application headers of you like too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information go to wiki.wireshark.org/SnapLen&lt;/p&gt;&#xA;" OwnerUserId="5870" LastActivityDate="2016-08-23T23:09:11.507" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34304" PostTypeId="2" ParentId="22650" CreationDate="2016-08-24T01:03:50.660" Score="4" Body="&lt;p&gt;First off the OSI model is a theoretical model, it doesn't nessacerally exactly match up with reality. Also generally layer models only show layers that actually add or remove something from the packet.&lt;/p&gt;&#xA;&lt;p&gt;The following answer omits some minor details. Also some details may vary between operating systems, I have the most experiance with linux, some stuff may be different on other operating systems.&lt;/p&gt;&#xA;&lt;p&gt;This answer also focuses on the basic set-up, many modern network controllers have &amp;quot;offload&amp;quot; features where features that were traditionally the responsibility of the OS kernel are taken over by the network controller.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;The network controller is logically divided into two parts, the &amp;quot;MAC&amp;quot; and the &amp;quot;PHY&amp;quot;. In some cases MAC and PHY may be integrated into the same chip.&lt;/p&gt;&#xA;&lt;p&gt;The PHY does the following.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Converting between the wire-level encoding and a stream of binary data units.&lt;/li&gt;&#xA;&lt;li&gt;Detecting when the line is busy (for half-duplex physical layers).&lt;/li&gt;&#xA;&lt;li&gt;Detecting the start and of incoming frames.&lt;/li&gt;&#xA;&lt;li&gt;Generating special wire-level encodings for the start and end of frames.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The MAC does the following.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Translating between data streams at wire-rate and frames in a buffer that the OS can read/write.&lt;/li&gt;&#xA;&lt;li&gt;Generating/checking/stripping the preamble and FCS.&lt;/li&gt;&#xA;&lt;li&gt;Notifying the OS through interrupts when incoming frames have been delivered to the buffer.&lt;/li&gt;&#xA;&lt;li&gt;Implementing Medium access control if needed.&lt;/li&gt;&#xA;&lt;li&gt;Fitering incoming frames by destination MAC address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The Kernel implements the following.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Talking to the MAC (using a driver module).&lt;/li&gt;&#xA;&lt;li&gt;Building and interpreting Ethernet frames (minus the preamble and FCS).&lt;/li&gt;&#xA;&lt;li&gt;Implementing ARP (or ND for IPv6) to translate between IP and MAC addresses.&lt;/li&gt;&#xA;&lt;li&gt;Implementing building and interpretation of IP packets.&lt;/li&gt;&#xA;&lt;li&gt;Forwarding packets to the correct interface based on a routing table.&lt;/li&gt;&#xA;&lt;li&gt;Packet filtering, NAT etc.&lt;/li&gt;&#xA;&lt;li&gt;Major transport protocols like TCP and UDP.&lt;/li&gt;&#xA;&lt;li&gt;Some parts of ICMP.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Daemons and tools running outside the kernel but considered to be part of the OS implement.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DHCP&lt;/li&gt;&#xA;&lt;li&gt;DNS cache (if used).&lt;/li&gt;&#xA;&lt;li&gt;Diagnostics like ping and traceroute.&lt;/li&gt;&#xA;&lt;li&gt;Configuration of kernel features.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Libraries loaded by the application are generally used to implement stuff that runs on top of TCP/UDP including:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SSL/TLS&lt;/li&gt;&#xA;&lt;li&gt;DNS&lt;/li&gt;&#xA;&lt;li&gt;HTTP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2021-06-18T16:24:25.640" LastActivityDate="2021-06-18T16:24:25.640" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="34305" PostTypeId="2" ParentId="30231" CreationDate="2016-08-24T01:17:50.877" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How does this mechanism work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The firewall inspects packets and uses the information in their headers (and sometimes their payloads) to keep track of connections. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This information can be used to allow only incoming packets that relate to an existing connection. It can also be used for network address translation to hide a large numper of clients behind a single public IP.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I only receive data once I have requested it? In what way is it tied to the connection I have made?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IP addresses and port numbers primerally. Sometimes application payloads may also be inspected/translated (for example this is needed to make active mode FTP work).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would it not be possible to keep this &quot;path&quot; open until either server is closed? Meaning that a server/client/whoever can send me data constantly?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes you can typically keep the path open as long as you want. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is this mechanism used in online gaming? Or is it a TCP-specific feature?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The mecahnism works equally well for TCP and UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is tricky though is setting up a connection where both devices are behind such a firewall/nat. There are tricks that can be used but they don't always work depending on the exact behaviour of the translation mechanism.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-24T01:17:50.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34306" PostTypeId="1" CreationDate="2016-08-24T01:31:35.310" Score="10" ViewCount="27560" Body="&lt;p&gt;Can a single-mode single optical fiber support full-duplex communication, or does it have to be two fibers, one for each direction?&lt;/p&gt;&#xA;" OwnerUserId="29957" LastEditorUserId="8499" LastEditDate="2018-03-09T22:57:37.143" LastActivityDate="2022-11-18T21:57:03.107" Title="Can a single optical fiber support full-duplex communication?" Tags="|fiber|layer1|cable|duplex|optical|" AnswerCount="6" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34307" PostTypeId="2" ParentId="34306" CreationDate="2016-08-24T01:36:03.217" Score="11" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can a single optical fiber support full-duplex communication?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. There are &quot;BX&quot; standards, e.g. 100BASE-BX, which use different wavelengths for send and receive. The transmit wavelength on one end needs to be the receive wavelength on the other end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, &lt;a href=&quot;https://www.cisco.com/c/en/us/products/collateral/interfaces-modules/gigabit-ethernet-gbic-sfp-modules/product_data_sheet0900aecd8033f885.html&quot; rel=&quot;noreferrer&quot;&gt;Cisco has these transceivers&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;1000BASE-BX10-D and 1000BASE-BX10-U SFP for Single-Fiber Bidirectional Applications&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The 1000BASE-BX-D and 1000BASE-BX-U SFPs, compatible with the IEEE&#xA;  802.3ah 1000BASE-BX10-D and 1000BASE-BX10-U standards, operate on a single strand of standard SMF.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A 1000BASE-BX10-D device is always connected to a 1000BASE-BX10-U&#xA;  device with a single strand of standard SMF with an operating&#xA;  transmission range up to 10 km.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The communication over a single strand of fiber is achieved by&#xA;  separating the transmission wavelength of the two devices as depicted&#xA;  in Figure 2: 1000BASE-BX10-D transmits a 1490-nm channel and receives&#xA;  a 1310-nm signal, whereas 1000BASE-BX10-U transmits at a 1310-nm&#xA;  wavelength and receives a 1490-nm signal. As shown, the presence of a&#xA;  wavelength-division multiplexing (WDM) splitter integrated into the&#xA;  SFP to split the 1310-nm and 1490-nm light paths.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Figure 4.&lt;/strong&gt;      Bidirectional Transmission of a Single Strand of SMF&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/enyhI.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/enyhI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-08-24T01:40:50.403" LastActivityDate="2016-08-24T01:40:50.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34309" PostTypeId="2" ParentId="34296" CreationDate="2016-08-24T02:05:09.240" Score="1" Body="&lt;p&gt;The thing you have to understand about Teredo is it's NOT a traditional client-server protocol. It's a NAT traversal based protocol. Relays have more in common with clients than they do with servers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Servers have to have an address and port on the IPv4 internet that is at least reasonablly stable since it will be included in client configuration. Using a well-known port makes configuring clients easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clients and relays on the other hand may be behind IPv4 NATs. It is best if a client or relay uses a random port due to the existance of &quot;port-preservative&quot; NATs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know if that help page is simply wrong or if MS made the boneheaded descision to make their teredo relays use a fixed port.  Even if they did you can't rely on all teredo traffic using that port. Some teredo traffic will go directly between two clients without every hitting a relay. Some relays will be behind NATs. Many relays will not be running MS implementations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to reliablly monitor teredo traffic I see two options.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Inspect every UDP packet for signs of teredo.&lt;/li&gt;&#xA;&lt;li&gt;Monitor for connections to teredo servers (which most likely will use the well-known port) and save the local ports. You can then monitor those local ports for teredo data traffic.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-24T02:05:09.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34310" PostTypeId="2" ParentId="6076" CreationDate="2016-08-24T02:07:50.427" Score="1" Body="&lt;p&gt;Cisco UCS is basically simply compute gear (memory, I/O, storage).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UCS will not replace Ethernet switches as there is always going to be a need for a box to physically plug the compute gear into.  Ethernet is not going away, even though they are trying to rename it to 'Fabric'.  Fabric is marketing, Ethernet is IEEE standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VMWare NSX is simply an overlay networking technology.  NSX traffic is tunneled across the underlying IP (layer3) network.  So is OTV, and many other fancy new acronyms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue with Data Center being the future is at some point the rest of y'all are going to realize, ...wait a minute, why do I want to worry about all this, and you will purchase utility compute from a trusted mega compute player - Google, AWS, OpenShift online, Azure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Learn software, how to create it, how to automate mundane tasks.  There's a future in Web development (lots of meat left on the Microsoft corpse).  Follow the mega vendors and most importantly the Standards bodies (IETF, ONF, W3C, etc).  You absolutely must become skilled in IP,JavaScript,HTML,CSS,and SQL + NoSQL databases.  I can't speak to Python as I have no interest in it at this time.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-08-24T02:13:35.593" LastActivityDate="2016-08-24T02:13:35.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34311" PostTypeId="2" ParentId="34228" CreationDate="2016-08-24T02:34:01.290" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Make sure that you have nested virtualization enabled in your&#xA;  hypervisor. VMWare calls this VHV or Virtual Hardware-Assisted&#xA;  Virtualization and your CPU also has to support it. Other hypervisors&#xA;  call it different things. You also need to make sure that you have&#xA;  support for unsigned 3rd party KVM applications configured on the CSR.&#xA;  That would be the signing-level command under virtual-service.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Finally, this is only available in IOS-XE 3.17 or later.   While&#xA;  support for KVM inside of the CSR is supported, it isn't always a good&#xA;  idea for actual deployment. You're running a virtual machine inside of&#xA;  a virtual machine so performance is going to suffer. However, it does&#xA;  make a great development sandbox for getting things working. You can&#xA;  find more info in DevNet at &lt;a href=&quot;https://developer.cisco.com/site/kvm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://developer.cisco.com/site/kvm&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://communities.cisco.com/thread/71023?start=0&amp;amp;tstart=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;SOURCE&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Linux, yes, but the only interface with the system is via IOSd.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Because IOSd is running as a discrete process it has protected memory&#xA;  that is isolated from crashes in other processes and failures in other&#xA;  components in the system.&lt;/p&gt;&#xA;  &#xA;  &lt;h3&gt;Problem: Can I run my App inside a Router ?&lt;/h3&gt;&#xA;  &#xA;  &lt;h3&gt;Solution: Yes !&lt;/h3&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;From IOS XE3.17 onwards&lt;/li&gt;&#xA;  &lt;li&gt;Option to enable unsigned containers&lt;/li&gt;&#xA;  &lt;li&gt;Any 3rd party KVM&lt;/li&gt;&#xA;  &lt;li&gt;Libvirt based format / YAML manifest file&lt;/li&gt;&#xA;  &lt;li&gt;Requires 4GB+ dedicated RAM&lt;/li&gt;&#xA;  &lt;li&gt;ASR1000, ISR4000, &lt;strong&gt;CSR1000&lt;/strong&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;virtual-service install name myapp package flash:myapp.ova show&#xA;  virtual-service list show virtual-service detail name myapp&#xA;  virtual-service connect name myapp aux|console&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8WtyJ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8WtyJ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/dam/global/hr_hr/events/2016/cisco-connect/pdf/Cisco_IOS_XE_Routers_-_ASR_1000_and_ISR_4000_-_The_Evolution_of_Converged_Network_Edge_Architectures_-_Jaromir_Pila_Cisco.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;SOURCE&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-24T02:34:01.290" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34312" PostTypeId="2" ParentId="34306" CreationDate="2016-08-24T02:43:39.840" Score="2" Body="&lt;p&gt;Yes, if you have the right hardware.&lt;/p&gt;&#xA;&lt;p&gt;Normally a seperate strand of fiber is used for each direction. This keeps the transcievers simple and allows the same transcievers to be used for both ends of the connection.&lt;/p&gt;&#xA;&lt;p&gt;However you can now buy transcievers that allow full-duplex communication on a single fiber. These are known as &amp;quot;bidi&amp;quot; transcievers. They work by using two different wavelengths with splitter prisms inside the transcievers. You need to use an &amp;quot;upstream&amp;quot; transciever at one end of the fiber and a &amp;quot;downstream&amp;quot; transciever at the other.&lt;/p&gt;&#xA;&lt;p&gt;For 1Gbps there was a standard for bidi transcievers, 1000BASE-BX10. I cannot find any evidence of a standard for 10 gigabit bidi optics despite some vendors selling their products as &amp;quot;10GBASE-BX&amp;quot; or &amp;quot;10GBASE-BR&amp;quot;. So I would treat any 10 gigabit bidi transcievers as propietary.&lt;/p&gt;&#xA;&lt;p&gt;Coming back to this post in 2022, it seems even 100G bidi is now becoming a thing, again tey don;t seem to be bothering with formal standards though.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2022-11-18T21:57:03.107" LastActivityDate="2022-11-18T21:57:03.107" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="34314" PostTypeId="2" ParentId="9387" CreationDate="2016-08-24T03:34:12.320" Score="1" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Home network: if my router is IPv6 ready, will it translate to IPv4 for devices that don't understand IPv6?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It is likely that for the forseeable future your ISP will put some mechanism in place to allow IPv4-only clients on your network to access resources on the IPv4 internet. As the IPv4 crisis bites deeper ISPs will increasingly turn to mechanisms that allow them to provide you with access to resources on the IPv4 internet without giving you a dedicated public IPv4 address. Eventually I would expect such mechanisms to be phased out but likely not for a long time.&lt;/p&gt;&#xA;&lt;p&gt;There are at least five options available to the ISP for doing this.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Assign you a private V4 IP and run a conventional V4 NAT at the ISP level.&lt;/li&gt;&#xA;&lt;li&gt;Use &amp;quot;ds-lite&amp;quot; which tunnels IPv4 packets over IPv6 to a special NAT at the ISP.&lt;/li&gt;&#xA;&lt;li&gt;Use &amp;quot;464XLAT&amp;quot; where your router performs a stateless NAT46 and then the ISP performs stateful NAT64.&lt;/li&gt;&#xA;&lt;li&gt;Use &amp;quot;map-e&amp;quot;, in this system each client is assigned an IP address with a restricted set of ports. The client's router performs NAT using the restricted port set and then tunnels the packets over IPv6 to a special device at the ISP. Traffic returning to the client is encapsulated in IPv6 and then sent to the relavent client based on IP and port.&lt;/li&gt;&#xA;&lt;li&gt;Use &amp;quot;map-t&amp;quot;, similar to MAP-e the client gets a restricted port set, but rather than being encapsulated the traffic is translated to IPv6 for it's journey over the ISPs access network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Your router may need replacement or a firmware upgrade to support the latter four options.&lt;/p&gt;&#xA;&lt;p&gt;The advantage of the latter two options is that the ISPs equipment is &amp;quot;mostly stateless&amp;quot;, meaning that asymmetric routing and re-routes won't break things.&lt;/p&gt;&#xA;&lt;p&gt;It is unlikely at IPv4-only clients on your network will be able to access IPv6 only resources on the internet.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Can these home devices still use IPv4 when the rest of the home network is IPv4?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Both IPv4 and IPv6 can run together on the home network.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;For sites that are still IPv4 only, will my computer or router switch automatically?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;If your computer has both IPv4 and IPv6 addresses (see above comments about IPv4-only devices) then it will be able to access both IPv4 and IPv6 servers. If it gets both IPv4 and IPv6 addresses from DNS then it will typically try IPv6 first, then fall back to IPv4 if that fails.&lt;/p&gt;&#xA;&lt;p&gt;If your ISP implements NAT64/DNS64 then your computer will be able to access IPv4-only servers via the NAT64 using the DNS records synthisised by the NAT64.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When I open whatismyip.com, I see an IPv4 address. I believe I can ask my provider to change to IPv6, but I guess that will disable large parts of the internet for me - will it? Can I still send mail, will DNS work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You should not be asking your provider to &amp;quot;change to IPv6&amp;quot;. You should be asking them to supply IPv6 in addition to IPv4.&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;what is my IP&amp;quot; type sites can be misleading because they typically only show one address. You should use a site like test-ipv6.com&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When my provider changes to IPv6, will I still have an IPv4 address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It is likely that at some point your provider will start charging extra for public IPv4 addresses.&lt;/p&gt;&#xA;&lt;p&gt;It is likely that for the forseeable future your ISP will provide some mechanism for accessing resources on the IPv4 internet. As mentioned above that may be traditional v4 NAT or it may be an IPv6 based mecahnism like NAT64 or DS-lite.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Does this have consequenses for TLS certificates?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Not really. TLS certificates are based around hostnames not IP addresses.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;With IPv6 NAT is obsolete I understand.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Well IPv6 NAT exists but it's strongly discouraged.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Will this mean my wifi enabled tv is directly accessible from the outside? I guess the router firewall is still working, but now we can use a direct address from the outside?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It is possible to do an &amp;quot;outgoing connections only&amp;quot; firewall for IPv6. What any given router actually does is down to the router vendor. Some may well default to wide-open.&lt;/p&gt;&#xA;&lt;p&gt;Note that because IPv6 addresses are typically big and sparse scanning attacks are largely impractical in IPv6.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I don't live in Latin America and don't use Azure. But what if I go to Brasil right now. Will I notice it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Probablly not honestly, at least as a tourist. Mobile networks and public wifi tend to involve being behind a NAT you don't control anyway.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Is there an easy way to test what works and what not without messing up the home network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It depends what exactly you want to test. There are sites like test-ipv6.com which can check your IPv6 connectivity.&lt;/p&gt;&#xA;&lt;p&gt;If you want to check what would work in an IPv6-only world then your best bet would probablly be a VM of some sort. Of course you need to get IPv6 working on your networ before you can do that.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2022-12-09T16:15:07.320" LastActivityDate="2022-12-09T16:15:07.320" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="34315" PostTypeId="1" CreationDate="2016-08-24T06:52:23.427" Score="0" ViewCount="53" Body="&lt;p&gt;I recently had an issue where my network lost the majority of its HTTP connectivity. I couldn't access a single HTTP based site. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could ping addresses across the internet, messaging apps like whatsapp were functioning and other none HTTP apps were also functioning. Access to google (and its subsidiaries like YouTube and Gmail), and Facebook were also unaffected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first I thought it was a DNS issue but ruled this out with nslookup. Then I thought it was our firewall, but when bypassing all LAN devices and directly connecting to our modem the issue persisted. At this point I wanted to check with the ISP whether it was an issue upstream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tech support then told me that they had experienced this problem before and it was actually an issue with the TCP buffer on our modem. They told me the buffer max level was set too high and too many sessions had maxed it out. They reduced the buffer size and after a reboot, connectivity was back to normal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I dont understand is why I was able to access some websites that used HTTPS but not others, and none that used HTTP. Surely a maxed out buffer would impact on all TCP based traffic? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is solved now but, for my own understanding, I want to know why the solution worked.&lt;/p&gt;&#xA;" OwnerUserId="25750" LastEditorUserId="8499" LastEditDate="2018-02-16T03:57:09.107" LastActivityDate="2018-02-16T03:57:09.107" Title="Why would a maxed out TCP buffer allow some HTTP and not others" Tags="|tcp|" AnswerCount="1" CommentCount="4" ClosedDate="2016-08-24T13:52:17.510" ContentLicense="CC BY-SA 3.0" />
  <row Id="34317" PostTypeId="2" ParentId="34306" CreationDate="2016-08-24T07:59:46.237" Score="2" Body="&lt;p&gt;Single strand fiber transmission use a single strand of glass (optical fiber) to send data in both directions, namely bidirectional (BiDi) transmission. In recent years, the mainstream single strand fiber transmission technology is based on two wavelengths traveling in opposite directions (also called TW BiDi transmission). This technology is achieved via wavelength division multiplexing (WDM) couplers, also known as diplexers, which combine and separate data transmitted over a single fiber based on the wavelengths of the light. Generally, this WDM coupler is integrated into a standard interface optical transceiver module. You can read more details here: &lt;a href=&quot;http://www.fs.com/blog/single-strand-fiber-solution-is-it-right-for-you.html&quot; rel=&quot;nofollow&quot;&gt;http://www.fs.com/blog/single-strand-fiber-solution-is-it-right-for-you.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24890" LastActivityDate="2016-08-24T07:59:46.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34324" PostTypeId="2" ParentId="3482" CreationDate="2016-08-24T10:10:26.037" Score="2" Body="&lt;p&gt;Total Vlan tagging is 4 bytes.&#xA;Here TPI (Tagging Protocol Identifier ) is of 2 bytes(16 bits)&#xA;and TCI (Tagging Control Information ) is of 2 bytes (16 bits)&#xA;In TCI, we have PCP(Priority Code Point)=&gt; 3 bits&#xA;                DEI(Drop Eligible Indicator) = &gt; 1 bit&#xA;             and VID(Vlan Identifier) =&gt;12 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 power 12 is 4096. &#xA;that is the reason vlan numbers are 4096 (including all reserved vlans)&lt;/p&gt;&#xA;" OwnerUserId="29966" LastActivityDate="2016-08-24T10:10:26.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34325" PostTypeId="1" AcceptedAnswerId="34328" CreationDate="2016-08-24T12:37:54.637" Score="1" ViewCount="2485" Body="&lt;p&gt;I have written tcp client-server, server will read a socket, and client will written packets to that socket.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mtu : 1500, packets will be fragmented if size exceds mtu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Case 1:&#xA;         When i did write packet size 1456, 1457,1458,1459,14560 from        client, recived the same size packets in server side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Case 2:&#xA;When i did write packet size 1461 from client, recived the same size packet, but this should be two packets (pkt-1 size :1460 +  pkt-2 size :1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Got a bit confused while dealing with fragmentations, can any one clarify this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit : sock = socket(AF_INET, SOCK_STREAM, 0); &amp;lt;== socket being used.&lt;/p&gt;&#xA;" OwnerUserId="29931" LastEditorUserId="29931" LastEditDate="2016-08-25T06:16:34.173" LastActivityDate="2016-08-25T08:54:12.690" Title="TCP Client-Server with mtu is set, Issue with fragmented packets" Tags="|ethernet|network-core|linux|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34326" PostTypeId="2" ParentId="29366" CreationDate="2016-08-24T12:48:12.387" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;it is true to say that only when finished transmitting, the propagation begins?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, the signal starts propagating as soon as transmission starts but the propagation takes time.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now, B want to transmit some frame. How B knows that A is transmitting? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The receiver in B will be active and will detect the signal coming from A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately with pure CSMA there is a time window when A has started transmitting but B is not aware of it. If B starts transmitting during this window you have a collision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet gets arround this by using collision detection (Hence CSMA/CD). If a collision is detected then both transmitters back off for a random period before trying again. Reliable detection of collisions is ensured by the following measures.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Setting a minimum packet size and hence a minimum transmission time.&lt;/li&gt;&#xA;&lt;li&gt;Setting a maximum size of the collision domain and hence a maximum propagation delay.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Wifi uses different techniques as direct collision detection is not feasible in the wireless environment.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-24T12:48:12.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34327" PostTypeId="2" ParentId="34315" CreationDate="2016-08-24T13:09:29.353" Score="3" Body="&lt;p&gt;that's just a pseudo-science answer from support meant to make you feel good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modem likely has a bug, perhaps doing connection tracking for port 80, and leaked a bunch of resources over time. The reboot cleared it up.&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-08-24T13:09:29.353" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34328" PostTypeId="2" ParentId="34325" CreationDate="2016-08-24T13:40:00.963" Score="4" Body="&lt;p&gt;You are confusing MTU and MSS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MTU 1500 is related to ethernet, so it includes the IP and TCP headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both have a minimum size of 20, so the MSS (maximum segment size) for TCP is in this case 1500 - 20 - 20 = 1460.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that both the IP header and the tcp header can have a size greater than 20, when using options, and so you may still encounter fragmentation with message shorter than 1460 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally your packet may traverse other networks that have a different MTU. A VPN will also add a header that will further reduce the effective MSS.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-08-24T13:40:00.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34331" PostTypeId="1" CreationDate="2016-08-24T14:20:12.063" Score="2" ViewCount="1857" Body="&lt;p&gt;&lt;strong&gt;Backstory&lt;/strong&gt;: I have a site to site VPN from my ASA with 9.x firmware to a remote ASA with 8.2 firmware (NOT managed by me). We got the tunnel up and running quite a while ago, I ended up having to specifically add an ACL for ICMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;Problem&lt;/strong&gt;: The other end provides AnyConnect SSL VPN connectivity and users connecting to the SSL VPN need access to my end of the site to site VPN, so I added to the existing subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;Error&lt;/strong&gt;:Running packet tracer from 10.10.10.5 destination: 192.168.99.5&#xA;I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VPN: Type -&#xA;VPN&#xA;Subtype -&#xA;encrypt&#xA;Action -&#xA;DROP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;RESULT: The packet is dropped&#xA;INFO: (acl-drop) Flow is denied by configured rule&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Networking info&lt;/strong&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;My site=10.10.10.0/24&lt;/li&gt;&#xA;&lt;li&gt;Other site=10.1.0.0/16&lt;/li&gt;&#xA;&lt;li&gt;SSL VPN=192.168.99.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;changes that I've made&lt;/strong&gt; (added):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list VPN_ACCESS extended permit icmp 10.10.10.0 255.255.255.0 192.168.99.0 255.255.255.0&#xA;access-list VPN_ACCESS extended permit ip 10.10.10.0 255.255.255.0 192.168.99.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And based upon this rule:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside,outside) source static LocalLAN LocalLAN destination static DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also added added:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network DM_INLINE_NETWORK_3 network-object object REMOTESSLVPN&#xA;&#xA;object network REMOTESSLVPN  subnet 192.168.99.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;......&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, am I crazy, or shouldn't that work? What could I be missing? I recall that the initial setup between the sub 8.2 and the &gt;8.3 firmware was a lot of trouble, but this should be simple. Does anyone have any insight?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;Here's the detailed packet trace from cli:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config)# packet-tracer input inside tcp 10.10.10.0 80 192.168.99.0 $&#xA;&#xA;Phase: 1&#xA;Type: ROUTE-LOOKUP&#xA;Subtype: input&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;in   0.0.0.0         0.0.0.0         outside&#xA;&#xA;Phase: 2&#xA;Type: UN-NAT&#xA;Subtype: static&#xA;Result: ALLOW&#xA;Config:&#xA;nat (inside,outside) source static LocalLAN LocalLAN destination static &amp;gt; &amp;gt; DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3&#xA;Additional Information:&#xA;NAT divert to egress interface outside&#xA;Untranslate 192.168.99.0/80 to 192.168.99.0/80&#xA;&#xA;Result:&#xA;input-interface: inside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: outside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: drop&#xA;Drop-reason: (sp-security-failed) Slowpath security checks failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29969" LastEditorUserId="8499" LastEditDate="2016-08-25T15:38:23.630" LastActivityDate="2017-09-22T02:52:33.373" Title="ASA5505: Add remote AnyConnect subnet routing over site-to-site VPN // mixed ASA 8.4 .8.2 firmware" Tags="|routing|vpn|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="34332" PostTypeId="1" CreationDate="2016-08-24T14:28:38.443" Score="2" ViewCount="643" Body="&lt;p&gt;how is packet capturing on the ASA firewall different or similar to setting up a syslog server for the capture. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to capture interesting traffic on the  FW and store them for analysis during troubleshooting, currently the buffer size allows me to log only 3 hours of capture, so, we went ahead and set-up a syslog server, it has a lot of noise and more over i can't see any meaningful information like packet drops and 3 way tcp handshakes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;would sending the captures from the ASA to a tftp server, protects the format a as is shows up on the ASA FW and thus can be more useful ?&lt;/p&gt;&#xA;" OwnerUserId="29970" LastEditorUserId="509" LastEditDate="2016-08-24T14:30:40.970" LastActivityDate="2016-08-24T15:02:34.060" Title="Packet capture on a Cisco ASA" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34334" PostTypeId="1" AcceptedAnswerId="34345" CreationDate="2016-08-24T14:54:36.460" Score="1" ViewCount="656" Body="&lt;p&gt;Does anyone know what internal criteria various routers use to sense when their WAN connection has gone down when configured for VRRP, in order to then decide to switch over from the master to the backup router? I have some thirdhand reports that Fortigate devices simply use the presence or absence of an internal route to a specific external subnet or host (e.g. 4.2.2.1). This to me seems wrong - because the route could still exist on the master, but the actual connectivity is not there, which would mean that the master would not fail over to the backup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Curious if anyone knows the internal implementation details of various routers (e.g. FG, Cisco).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Forgive me if this has already been answered, or if my question doesn't quite make sense. I'm kind of a network n00b.&lt;/p&gt;&#xA;" OwnerUserId="22417" LastActivityDate="2016-08-25T10:53:23.303" Title="What criteria do routers use to sense a WAN outage when using VRRP?" Tags="|cisco|vrrp|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="34335" PostTypeId="2" ParentId="34332" CreationDate="2016-08-24T15:02:16.743" Score="2" Body="&lt;p&gt;You could set a port in monitor mode (I.E. set it as a span port) then use an external device to capture and analyse traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;extract from &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa80/command/reference/cmd_ref/s8.html#wp1411559&quot; rel=&quot;nofollow&quot;&gt;Cisco Security Appliance Command Reference, Version 8.0&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;switchport monitor&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For models with a built-in switch, such as the ASA 5505 adaptive&#xA;  security appliance, use the switchport monitor command in interface&#xA;  configuration mode to enable SPAN, also known as switch port&#xA;  monitoring. The port for which you enter this command (called the&#xA;  destination port) receives a copy of every packet transmitted or&#xA;  received on the specified source port. The SPAN feature lets you&#xA;  attach a sniffer to the destination port so you can monitor traffic.&#xA;  You can specify multiple source ports by entering this command&#xA;  multiple times. You can only enable SPAN for one destination port. To&#xA;  disable monitoring of a source port, use the no form of this command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;switchport monitor source_port [tx | rx | both]&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;no switchport monitor source_port [tx | rx | both] Syntax Description&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;source_port   &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Specifies the port you want to monitor. You can specify any Ethernet&#xA;  port as well as the Internal-Data0/1 backplane port that passes&#xA;  traffic between VLAN interfaces. Because the Internal-Data0/1 port is&#xA;  a Gigabit Ethernet port, you might overload the Fast Ethernet&#xA;  destination port with traffic. Monitor the port Internal-Data0/1 with&#xA;  caution.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;tx    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;(Optional) Specifies that only transmitted traffic is monitored.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;rx    &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;(Optional) Specifies that only received traffic is monitored.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;both  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;(Optional) Specifies that both transmitted and received traffic is&#xA;  monitored. both is the default. Defaults&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The default type of traffic to monitor is both.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-08-24T15:02:16.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34336" PostTypeId="2" ParentId="34332" CreationDate="2016-08-24T15:02:34.060" Score="4" Body="&lt;p&gt;The packet capture feature stores data in pcap format, which can be read by Wireshark and other analysis tools.  So, yes, that would probably be more useful for packet analysis than syslog messages.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-24T15:02:34.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34337" PostTypeId="2" ParentId="32172" CreationDate="2016-08-24T15:30:29.927" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Just wondering if the DHCP traffic is supposed to work in Scenario 1 as it works in Scenario 2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, the hub should be transparent as far as DHCP is concerned so assuming the ports in both scenarios are in the same vlan, the behaviour should be exactly the same (assuming test machine is the only device connected to the hub).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you see different behaviour in scenario 1 and 2 and you want us to help to explain why, you will need to answer our questions for more information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[edit: moved follow-up questions to comments]&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-08-24T16:16:19.373" LastActivityDate="2016-08-24T16:16:19.373" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34340" PostTypeId="1" AcceptedAnswerId="34352" CreationDate="2016-08-24T19:29:39.417" Score="0" ViewCount="56" Body="&lt;p&gt;For the purposes of this question, there are two ways to watch a video on a site like YouTube. One, you can watch the site in your browser. Two, you can download the video with an app like &lt;a href=&quot;https://rg3.github.io/youtube-dl/&quot; rel=&quot;nofollow&quot;&gt;youtube_download&lt;/a&gt;. If you do the former, it takes twenty minutes to watch a twenty minute video in the browser (using network resources the whole time, I assume). If you do the latter, it takes a few seconds to download the video over the network (using more resources over less time?) and you watch offline.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: For each approach, what are the network resources that are used and can you describe the different network costs (i.e. not financial, which vary by region) that are involved in each approach. Which approach is more or less expensive in terms of network resources and why?&lt;/p&gt;&#xA;" OwnerUserId="29975" LastActivityDate="2016-08-25T10:05:02.767" Title="downloading over network vs watching online" Tags="|internet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34342" PostTypeId="1" AcceptedAnswerId="34375" CreationDate="2016-08-24T22:39:16.487" Score="1" ViewCount="2058" Body="&lt;p&gt;I have an ASA that I take care of remotely. On this device, there are about 6 IPSec tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of them work as expected. Recently I had to create one for the new office. I am having problems with this one. I can't figure out where the problem lies.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA isn't decrypting packets arriving from the far end of the tunnel.   In our environment, we use Fortigate and Cisco firewalls. Most of the tunnels we have are between these two vendors and they all work, except this one!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Info:&#xA;Toronto = Fortigate (192.168.185 network)&#xA;London = ASA 9.x  (10.101.0.0 network)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I ping from Toronto to London it will fail. If I put  a capture on the VPN interface to London I see the packets egressing. So they are being sent out onto the tunnel.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I ping from London to Toronto, it will too fail. But, in Toronto if I do a capture on the host that I am pinging I can see the pings:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes 17:48:47.938568 IP 10.101.0.199 &amp;gt; 192.168.185.120: ICMP echo request, id 51263, seq 36, length 64 17:48:47.938595 IP&#xA;192.168.185.120 &amp;gt; 10.101.0.199: ICMP echo reply, id 51263, seq 36, length 64&#xA;&#xA;But on the London host we don't see these replies.&#xA;&#xA;&#xA;On the ASA it indicates that it is encrypting outbound packets but not inbound:&#xA;&#xA;LON-NET-FW01(config)# show cry ipsec sa peer 2x.1x.2x.13x&#xA;peer address: 2x.1x.2x.13x&#xA;    Crypto map tag: crypto-outside, seq num: 5, local addr: 8x.1x.4x.9x&#xA;&#xA;      access-list TUN-LONGS-TORQQ extended permit ip 10.101.0.0 255.255.255.0 192.168.185.0 255.255.255.0&#xA;      local ident (addr/mask/prot/port): (10.101.0.0/255.255.255.0/0/0)&#xA;      remote ident (addr/mask/prot/port): (192.168.185.0/255.255.255.0/0/0)&#xA;&#xA;      #pkts encaps: 1072, #pkts encrypt: 1072, #pkts digest: 1072&#xA;      #pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0&#xA;      #pkts compressed: 0, #pkts decompressed: 0&#xA;      #pkts not compressed: 1072, #pkts comp failed: 0, #pkts decomp failed: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;===snip===   (both networks are listed but only one shown here for length)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Some bits of the config:&#xA;&#xA;object-group network DHX-QQ-NETWORKS&#xA; network-object 10.180.0.0 255.255.252.0&#xA; network-object 192.168.185.0 255.255.255.0&#xA;&#xA;&#xA;LON-NET-FW01(config)# show run nat | inc QQ&#xA;nat (inside,outside) source static LONGS-101NET LONGS-101NET destination static DHX-QQ-NETWORKS DHX-QQ-NETWORKS route-lookup&#xA;&#xA;show nat:&#xA;&#xA;10 (inside) to (outside) source static LONGS-101NET LONGS-101NET  destination static DHX-QQ-NETWORKS DHX-QQ-NETWORKS route-lookup&#xA;    translate_hits = 410, untranslate_hits = 410&#xA;&#xA;run-access-list:&#xA;&#xA;access-list TUN-LONGS-TORQQ remark Tunnel to TOR Service and Desktop networks&#xA;access-list TUN-LONGS-TORQQ extended permit ip object-group LONGS-101NET object-group DHX-QQ-NETWORKS&#xA;&#xA;LON-NET-FW01(config)# show access-list TUN-LONGS-TORQQ&#xA;access-list TUN-LONGS-TORQQ; 2 elements; name hash: 0xfa13240a&#xA;access-list TUN-LONGS-TORQQ line 1 remark VPN to TOR SRV and Desktop networks&#xA;access-list TUN-LONGS-TORQQ line 2 extended permit ip object-group LONGS-101NET object-group DHX-QQ-NETWORKS (hitcnt=7) 0x8d68f010&#xA;  access-list TUN-LONGS-TORQQ line 2 extended permit ip 10.101.0.0 255.255.255.0 10.180.0.0 255.255.252.0 (hitcnt=3) 0x4a18a364&#xA;  access-list TUN-LONGS-TORQQ line 2 extended permit ip 10.101.0.0 255.255.255.0 192.168.185.0 255.255.255.0 (hitcnt=15) 0xd9e13e75&#xA;&#xA;&#xA;&#xA;&#xA;crytomap:&#xA;crypto map crypto-outside 5 match address TUN-LONGS-TORQQ&#xA;crypto map crypto-outside 5 set pfs&#xA;crypto map crypto-outside 5 set peer 2x.1x.2x.1x&#xA;crypto map crypto-outside 5 set ikev1 transform-set ESP-3DES-SHA&#xA;crypto map crypto-outside 5 set reverse-route&#xA;&#xA;&#xA;LON-NET-FW01(config)# show run tunnel-group 2x.1x.2x.1x&#xA;tunnel-group 2x.1x.2x.1x type ipsec-l2l&#xA;tunnel-group 2x.1x.2x.1x ipec-attributes&#xA;  ikev1 pre-shared-key *********&#xA;&#xA;&#xA;&#xA;Routing table:&#xA;&#xA;LON-NET-FW01(config)# show route&#xA;&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, + - replicated route&#xA;Gateway of last resort is 8x.1x.4x.8x to network 0.0.0.0&#xA;&#xA;S*       0.0.0.0 0.0.0.0 [1/0] via 8x.1x.4x.8x, outside&#xA;D EX     10.3.0.0 255.255.0.0&#xA;           [170/25605376] via 172.16.101.2, 02:15:21, transit&#xA;S        10.3.2.0 255.255.255.0 [1/0] via 8x.1x.4x.8x, outside&#xA;S        10.10.10.0 255.255.255.0 [1/0] via 10.101.0.2, inside&#xA;C        10.45.16.0 255.255.255.0 is directly connected, lync_dmz&#xA;L        10.45.16.1 255.255.255.255 is directly connected, lync_dmz&#xA;C        10.101.0.0 255.255.255.0 is directly connected, inside&#xA;L        10.101.0.1 255.255.255.255 is directly connected, inside&#xA;S        10.112.0.0 255.240.0.0 [250/0] via 8x.1x.4x.8x, outside&#xA;D        10.112.0.0 255.255.255.0&#xA;           [90/25608448] via 172.16.101.2, 02:15:22, transit&#xA;D EX     10.113.0.0 255.255.255.0&#xA;           [170/25603072] via 172.16.101.2, 02:15:21, transit&#xA;D EX     10.114.0.0 255.255.255.0&#xA;           [170/25605376] via 172.16.101.2, 02:15:21, transit&#xA;D EX     10.115.0.0 255.255.255.0&#xA;           [170/25605376] via 172.16.101.2, 02:15:22, transit&#xA;D EX     10.116.0.0 255.255.255.0&#xA;           [170/25605376] via 172.16.101.2, 02:15:22, transit&#xA;D EX     10.117.0.0 255.255.255.0&#xA;           [170/25603072] via 172.16.101.2, 02:15:22, transit&#xA;S        10.118.0.0 255.255.0.0 [1/0] via 8x.1x.4x.8x, outside&#xA;S        10.118.0.0 255.255.255.0 [250/0] via 8x.1x.4x.8x, outside&#xA;S        10.180.0.0 255.255.252.0 [1/0] via 8x.1x.4x.8x, outside&#xA;S        10.230.4.0 255.255.255.0 [1/0] via 8x.1x.4x.8x, outside&#xA;S        10.255.255.1 255.255.255.255 [1/0] via 8x.1x.4x.8x, outside&#xA;C        85.133.42.88 255.255.255.248 is directly connected, outside&#xA;L        85.133.42.92 255.255.255.255 is directly connected, outside&#xA;S        172.16.5.0 255.255.255.0 [1/0] via 8x.1x.4x.8x, outside&#xA;D EX     172.16.11.0 255.255.255.0&#xA;           [170/25602816] via 172.16.101.2, 02:15:24, transit&#xA;D EX     172.16.12.0 255.255.255.0&#xA;           [170/25613056] via 172.16.101.2, 02:15:23, transit&#xA;D        172.16.21.0 255.255.255.0&#xA;           [90/25607936] via 172.16.101.2, 02:15:24, transit&#xA;C        172.16.101.0 255.255.255.128 is directly connected, transit&#xA;L        172.16.101.1 255.255.255.255 is directly connected, transit&#xA;C        172.16.101.128 255.255.255.128 is directly connected, dmz&#xA;L        172.16.101.129 255.255.255.255 is directly connected, dmz&#xA;D        172.16.112.0 255.255.255.128&#xA;           [90/25608192] via 172.16.101.2, 02:15:23, transit&#xA;S        172.16.118.0 255.255.255.0 [1/0] via 8x.1x.4x.8x, outside&#xA;D        172.19.101.1 255.255.255.255&#xA;           [90/130816] via 172.16.101.2, 02:15:24, transit&#xA;D        172.19.112.1 255.255.255.255&#xA;           [90/25735936] via 172.16.101.2, 02:15:23, transit&#xA;D EX     172.19.113.1 255.255.255.255&#xA;           [170/25730816] via 172.16.101.2, 02:15:22, transit&#xA;D EX     172.19.114.1 255.255.255.255&#xA;           [170/25730816] via 172.16.101.2, 02:15:22, transit&#xA;D EX     172.19.115.1 255.255.255.255&#xA;           [170/25730816] via 172.16.101.2, 02:15:22, transit&#xA;D EX     172.19.116.1 255.255.255.255&#xA;           [170/25730816] via 172.16.101.2, 02:15:22, transit&#xA;D EX     172.19.117.1 255.255.255.255&#xA;           [170/25730816] via 172.16.101.2, 02:15:22, transit&#xA;S        192.168.2.0 255.255.255.0 [1/0] via 8x.1x.4x.8x, outside&#xA;D EX     192.168.5.0 255.255.255.0&#xA;           [170/25603072] via 172.16.101.2, 02:15:22, transit&#xA;D EX     192.168.7.0 255.255.255.0&#xA;           [170/25605376] via 172.16.101.2, 02:15:22, transit&#xA;D EX     192.168.9.0 255.255.255.0&#xA;           [170/25605376] via 172.16.101.2, 02:15:22, transit&#xA;S        192.168.130.0 255.255.255.0 [1/0] via 8x.1x.4x.8x, outside&#xA;S        192.168.170.0 255.255.255.0 [1/0] via 8x.1x.4x.8x, outside&#xA;S        192.168.185.0 255.255.255.0 [1/0] via 8x.1x.4x.8x, outside&#xA;&#xA;I have configured 5 or 6 other tunnels on this device,  most to foritnet devices, and they all work as expected:&#xA;&#xA;&#xA;LON-NET-FW01(config)# show cry ipsec sa | inc access-list&#xA;      access-list TUN-LONQCS-LONGS extended permit ip 10.101.0.0 255.255.0.0 10.118.0.0 255.255.0.0&#xA;      access-list TUN-LONDON-LOSANGELES extended permit ip 10.101.0.0 255.255.255.0 172.16.5.0 255.255.255.0&#xA;      access-list TUN-LONDON-LOSANGELES-CoreNet extended permit ip 10.101.0.0 255.255.255.0 192.168.130.0 255.255.255.0&#xA;      access-list TUN-LONDON-VAN01 extended permit ip 10.101.0.0 255.255.255.0 192.168.170.0 255.255.255.0&#xA;      access-list TUN-LONGS-TORQQ extended permit ip 10.101.0.0 255.255.255.0 192.168.185.0 255.255.255.0&#xA;      access-list TUN-LONGS-TORQQ extended permit ip 10.101.0.0 255.255.255.0 10.180.0.0 255.255.252.0&#xA;      access-list TUN-LONGS-LON extended permit ip 10.101.0.0 255.255.0.0 10.112.0.0 255.255.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29977" LastEditorUserId="453" LastEditDate="2017-09-22T06:24:20.987" LastActivityDate="2018-08-18T21:00:01.337" Title="Packets are not being de-capsulated on the ASA end of a VPN" Tags="|cisco|cisco-asa|vpn|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="34345" PostTypeId="2" ParentId="34334" CreationDate="2016-08-25T03:05:37.413" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp_fhrp/configuration/xe-3s/fhp-xe-3s-book/fhp-vrrp.html#GUID-25707FA6-F3D5-4726-9E03-62112630F329&quot; rel=&quot;nofollow noreferrer&quot;&gt;First Hop Redundancy Protocols Configuration Guide, Cisco IOS XE Release 3S&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;h2&gt;VRRP Object Tracking&lt;/h2&gt;&#xA;&lt;p&gt;Object tracking is an independent process that manages creating, monitoring, and removing tracked objects such as the&#xA;state of the line protocol of an interface. Clients such as the Hot&#xA;Standby Router Protocol (HSRP), Gateway Load Balancing Protocol&#xA;(GLBP), and VRRP register their interest with specific tracked objects&#xA;and act when the state of an object changes.&lt;/p&gt;&#xA;&lt;p&gt;Each tracked object is identified by a unique number that is specified&#xA;on the tracking CLI. Client processes such as VRRP use this number to&#xA;track a specific object.&lt;/p&gt;&#xA;&lt;p&gt;The tracking process periodically polls the tracked objects and notes&#xA;any change of value. The changes in the tracked object are&#xA;communicated to interested client processes, either immediately or&#xA;after a specified delay. The object values are reported as either up&#xA;or down.&lt;/p&gt;&#xA;&lt;p&gt;VRRP object tracking gives VRRP access to all the objects available&#xA;through the tracking process. The tracking process allows you to track&#xA;individual objects such as a the state of an interface line protocol,&#xA;state of an IP route, or the reachability of a route.&lt;/p&gt;&#xA;&lt;p&gt;VRRP provides an interface to the tracking process. Each VRRP group&#xA;can track multiple objects that may affect the priority of the VRRP&#xA;device. You specify the object number to be tracked and VRRP is&#xA;notified of any change to the object. &lt;strong&gt;VRRP increments (or&#xA;decrements) the priority of the virtual device based on the state of&#xA;the object being tracked&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;h2&gt;How VRRP Object Tracking Affects the Priority of a Device&lt;/h2&gt;&#xA;&lt;p&gt;The priority of a device can change dynamically if it has been&#xA;configured for object tracking and the object that is being tracked&#xA;goes down. The tracking process periodically polls the tracked objects&#xA;and notes any change of value. The changes in the tracked object are&#xA;communicated to VRRP, either immediately or after a specified delay.&#xA;The object values are reported as either up or down. Examples of&#xA;objects that can be tracked are the line protocol state of an&#xA;interface or the reachability of an IP route. If the specified object&#xA;goes down, the VRRP priority is reduced. The VRRP device with the&#xA;higher priority can now become the virtual device master if it has the&#xA;vrrp preempt command configured. See the “VRRP Object Tracking”&#xA;section for more information on object tracking.&lt;/p&gt;&#xA;&lt;h2&gt;VRRP Advertisements&lt;/h2&gt;&#xA;&lt;p&gt;The virtual router master sends VRRP advertisements to&#xA;other VRRP routers in the same group. The&#xA;advertisements communicate the priority and state of the virtual&#xA;router master. The VRRP advertisements are encapsulated in IP packets&#xA;and sent to the IP Version 4 multicast address assigned to the VRRP&#xA;group. &lt;strong&gt;The advertisements are sent every second by default&lt;/strong&gt;; the&#xA;interval is configurable.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Although the VRRP protocol as per RFC 3768 does not support millisecond timers, Cisco routers allow you to configure millisecond&#xA;timers&lt;/strong&gt;. You need to manually configure the millisecond timer values&#xA;on both the primary and the backup routers. The master advertisement&#xA;value displayed in the show vrrp command output on the backup routers&#xA;is always 1 second because the packets on the backup routers do not&#xA;accept millisecond values.&lt;/p&gt;&#xA;&lt;p&gt;You must use millisecond timers where absolutely necessary and with&#xA;careful consideration and testing. Millisecond values work only under&#xA;favorable circumstances, and you must be aware that the use of the&#xA;millisecond timer values restricts VRRP operation to Cisco devices&#xA;only.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-08-25T03:05:37.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34346" PostTypeId="2" ParentId="24787" CreationDate="2016-08-25T03:38:59.077" Score="0" Body="&lt;p&gt;For data center deployments, I like &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos15.1x49/topics/concept/security-layer2-transparent-mode-chassis-cluster-understanding.html&quot; rel=&quot;nofollow&quot;&gt;Layer 2 Transparent Mode Chassis Clusters&lt;/a&gt; as layer2 adjacency is required for vMotion, for example.  You can then do your layer 3 stuff on the ASR's but allow east west (server-to-server) traffic to bypass them all together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=S:KB17946&amp;amp;actp=search&quot; rel=&quot;nofollow&quot;&gt;ISSU appears to be supported&lt;/a&gt; so you won't bring down the data center when rolling out new software to the SRX's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your ASR's can provide VPN and NAT.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-25T03:38:59.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34347" PostTypeId="2" ParentId="34325" CreationDate="2016-08-25T07:48:12.180" Score="2" Body="&lt;p&gt;When you use a TCP socket, as the name &quot;SOCK_STREAM&quot; indicates you are not writing individual packets to the socket, but a data stream, and the way TCP handles this is transparent to you.&#xA;So if you write 1461 (or 1,000,000 for that matter) bytes to the stream, at the other end you will be able to read 1461 (or 1,000,000) bytes. TCP automagically takes care of chopping the stream op in segments (this is where the MSS comes into play), retransmitting lost segments, re-ordering segments that are received out-of-order etc. If you do a packet capture (e.g using tcpdump or wireshark) then you will see (part of) that, but to your process using the socket it is all invisible.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-08-25T08:54:12.690" LastActivityDate="2016-08-25T08:54:12.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34349" PostTypeId="1" CreationDate="2016-08-25T09:20:48.760" Score="1" ViewCount="81" Body="&lt;p&gt;ISP &amp;lt;-&gt; ROUTER_A &amp;lt;-&gt; ROUTER_B&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER_A LAN: 192.168.5.1&#xA;ROUTER_B WAN: 192.168.5.215&#xA;ROUTER_B LAN: 192.168.16.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to get from ROUTER_A to ROUTER_B LAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What routing I need to update in which router to get there? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnets are all /24. &lt;/p&gt;&#xA;" OwnerUserId="29983" LastEditorUserId="29983" LastEditDate="2016-08-29T05:24:24.617" LastActivityDate="2016-09-05T08:28:21.533" Title="static routing to an interface, that is only reachable from inside the network" Tags="|routing|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34352" PostTypeId="2" ParentId="34340" CreationDate="2016-08-25T10:05:02.767" Score="2" Body="&lt;p&gt;It's a trade-off made by the provider;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say that this potential server is connected to the Internet with a 100 Mbps link.&#xA;Now, if you were to download the video, which is 100 seconds long, and each second is 1 Mb of video data, it would take 1 second to download the whole thing. But, during that time you either consume all the bandwidth available, or you can't download it with &quot;maximum speed&quot;. Aka. you'll consume lots of bandwidth for a short period of time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you on the other hand stream it, you can at the most watch 1 Mb of video every second. Therefore, the server only has to provide that amount of data, plus some extra for buffering, for you to be able to watch it live. Therefore, ignoring a lot of real world problems, say that you need 2 Mbps to get a reliable live stream, then 50 people can watch the same video at the same time with the same available resources. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Net result is the same, you get your video just as fast, but for the provider it's much more manageable to throttle connections so that the video buffers &quot;fast enough&quot; since you get a much smoother load on your network. YouTube and others probably do this on a quite grand scale so that they buffer fast enough for you to be content, but slow enough so that they can serve as many users simultaneously as possible.&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-08-25T10:05:02.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34355" PostTypeId="2" ParentId="1205" CreationDate="2016-08-25T10:46:56.317" Score="2" Body="&lt;p&gt;The solution is somewhere else in the configuration tree and quite hard to find in my opinion. You can disable bpdu-block on a specific port even while &lt;code&gt;bpdu-block-on-edge&lt;/code&gt; is enabled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set ethernet-switching-options bpdu-block interface &amp;lt;interface&amp;gt; disable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="59" LastActivityDate="2016-08-25T10:46:56.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34357" PostTypeId="2" ParentId="34334" CreationDate="2016-08-25T10:53:23.303" Score="1" Body="&lt;p&gt;You're right in stating that in FortiOS the &lt;code&gt;vrdst&lt;/code&gt; option does not actively ping the target address but decides whether an active route to this destination exists or not. In a second stage, you configure a 'health monitor' on e.g. the WAN interface which can use ICMP, UDP or TCP pings to determine the accessability of an external target host. If this monitor fails, the route to the ping target is removed and VRRP is failing over.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you think about it there are more reasons why a particular route is removed - manual deletion, dynamic routing protocols, physical link failure etc. The two-stage setup provides status monitoring without having to rely on 'ping' access (which may be blocked for security reasons).&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-08-25T10:53:23.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34360" PostTypeId="5" CreationDate="2016-08-25T14:56:37.507" Score="0" Body="&lt;p&gt;IEEE 802.11 is a set of media access control (MAC) and physical layer (PHY) specifications for implementing wireless local area network (WLAN) computer communication in the 900 MHz and 2.4, 3.6, 5, and 60 GHz frequency bands. They are created and maintained by the Institute of Electrical and Electronics Engineers (IEEE) LAN/MAN Standards Committee (IEEE 802).&lt;/p&gt;&#xA;" OwnerUserId="-1" LastEditorUserId="8499" LastEditDate="2016-11-29T17:56:28.447" LastActivityDate="2016-11-29T17:56:28.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34361" PostTypeId="4" CreationDate="2016-08-25T14:56:37.507" Score="0" Body="For questions about the IEEE 802.11 series of protocols, also known as Wi-Fi. This tag should be used when asking about enterprise or corporate Wi-Fi networking questions. Questions about home wireless networks are off topic. " OwnerUserId="28361" LastEditorUserId="8499" LastEditDate="2016-11-29T17:56:28.447" LastActivityDate="2016-11-29T17:56:28.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34362" PostTypeId="2" ParentId="19103" CreationDate="2016-08-25T15:31:09.303" Score="0" Body="&lt;p&gt;Additionally to Cliff Alligood answer: the coordination function is independent of the way the state of the channel is detected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IEEE 802.11-2012 Annex E.1 defines that Energy Detection is to be used only in certain operating classes, presently 13, 14 &amp;amp; 15, which include channels 131 to 138 (in the 3GHz range). &lt;/p&gt;&#xA;" OwnerUserId="28361" LastActivityDate="2016-08-25T15:31:09.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34363" PostTypeId="2" ParentId="34080" CreationDate="2016-08-25T17:36:30.490" Score="-1" Body="&lt;p&gt;Switched to PSK, no disconnections anymore.&lt;/p&gt;&#xA;" OwnerUserId="28310" LastActivityDate="2016-08-25T17:36:30.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34364" PostTypeId="1" CreationDate="2016-08-25T17:41:51.823" Score="0" ViewCount="2273" Body="&lt;p&gt;Like many others I can see how to display ports that have no traffic flowing through them and go through and disable them but we have hundreds of cisco switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I like the idea of being able to see ports that have not seen activity in the last 6 weeks like I found here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show int | i proto.*notconnect|proto.&lt;em&gt;administratively down|Last in.&lt;/em&gt; [6-9]w|Last in.*&#xA;[0-9][0-9]w|[0-9]y|disabled|Last input never, output never, output hang never&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but I have not been able to make this work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;sh int count | i 0 + 0 + 0 works quiet well for identifying the ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Found here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/653/how-can-i-see-which-switchports-are-not-in-use&quot;&gt;How can I see which switchports are not in use?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to maybe use like port security or anything to turn ports off that have not see traffic for 90 days?&lt;/p&gt;&#xA;" OwnerUserId="29996" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-08-25T19:13:37.517" Title="Is there a way to automatically have unused ports disable?" Tags="|cisco|cisco-catalyst|troubleshooting|ssh|port-security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34365" PostTypeId="2" ParentId="34364" CreationDate="2016-08-25T19:13:37.517" Score="1" Body="&lt;p&gt;15.1T introduced &lt;code&gt;show interface history&lt;/code&gt;.  This might work for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ports go into &lt;code&gt;down&lt;/code&gt; state for both &lt;code&gt;status&lt;/code&gt; and &lt;code&gt;protocol&lt;/code&gt; by default when no endpoint NIC is connected (link down).  You could syslog these events to a server and roll some script to correlate down vs up dates per port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco EEM could be utilized to automatically disable a port once it goes down, but I don't think this would be a good idea as it would be difficult to administer/manage.  Look at 802.1X Port-Based Authentication if security is the concern.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-08-25T19:13:37.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34367" PostTypeId="2" ParentId="34279" CreationDate="2016-08-25T20:37:24.150" Score="2" Body="&lt;p&gt;I suspect what happens is that the board sometimes tries to connect to something on the Internet, so it sends this to the router but the router sends an icmp redirect, instructing the board to send this traffic directly to the asa. You can use &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;debug ip icmp&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;On the router to confirm, and/or configure&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;no ip redirects&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;on the router's interface towards the board, to prevent this from happening. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13714-43.html&quot; rel=&quot;nofollow&quot;&gt;When are icmp redirects sent&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-08-25T20:37:24.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34369" PostTypeId="1" CreationDate="2016-08-25T22:04:05.533" Score="1" ViewCount="1199" Body="&lt;p&gt;I want to plug and unplug two ethernet cables from a little test script.  I thought a &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B009LEJJM6&quot; rel=&quot;nofollow&quot;&gt;fancy managed&lt;/a&gt; switch would have this capability but it turns out to only allow me to create VLANs and optionally tag certain ports with those VLAD IDs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I looking for a a &lt;code&gt;layer 1&lt;/code&gt;/&lt;code&gt;physical&lt;/code&gt; switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://thenetworksherpa.com/what-is-a-physical-layer-switch/&quot; rel=&quot;nofollow&quot;&gt;http://thenetworksherpa.com/what-is-a-physical-layer-switch/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.digital-loggers.com/lpc.html&quot; rel=&quot;nofollow&quot;&gt;http://www.digital-loggers.com/lpc.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15812" LastActivityDate="2022-12-02T12:17:01.463" Title="How can I programmatically, physically connect ethernet ports?" Tags="|switch|ethernet|layer1|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34370" PostTypeId="2" ParentId="34369" CreationDate="2016-08-25T22:35:35.610" Score="1" Body="&lt;p&gt;By &quot;plug and unplug&quot; could you mean &quot;administratively disable&quot; and then &quot;enable&quot; a port on a switch? A switch, or switched hub, has at least Layer 2 capabilities by definition. All managed switches I've ever used have the ability to disable and enable switch ports. I've never used a TP-LINK device, however. Try a Cisco; you don't need the expensive versions to get the control it appears you want. My experience with Cisco switches is they are less prone to malfunction than most of the available network equipment and are highly customizable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;Layer 1 Switch&quot; to which you link is more like what the author of that page describes it: a &quot;software-controlled patch panel&quot;. If that is really what you want to accomplish, those MRV devices are in a completely other league than the Layer 2 switch you linked as far as price is concerned (many thousands of dollars).&lt;/p&gt;&#xA;" OwnerUserId="16741" LastEditorUserId="16741" LastEditDate="2016-08-25T22:46:09.847" LastActivityDate="2016-08-25T22:46:09.847" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34375" PostTypeId="2" ParentId="34342" CreationDate="2016-08-26T03:00:39.163" Score="1" Body="&lt;p&gt;I would say the London side of the tunnel is fine because it is encrypting packets. However, the ASA may be set to not bypass interface ACLs for VPN traffic. You will know this if &lt;code&gt;no sysopt connection permit-vpn&lt;/code&gt; is specified in the running configuration. You can fix this by either negating this command or allowing the vpn traffic though the inbound ACL on the outside interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the firewalls are different vendors it makes things a little more complicated. I would suspect that the traffic from the Fortigate destined for London is being NAT'd to the outside interface or the phase 2 ACL doesn't match 100% between sites. If you you are getting recv errors on the phase 2 ipsec sa then this may be the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have much experience with Fortigates but I did some research and your policies should look something like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config vpn ipsec phase1&#xA;&#xA;edit “asa”&#xA;        set interface &quot;?&quot;&#xA;        set ?&#xA;        set proposal ?&#xA;        set remote-gw x.x.x.x&#xA;        set psksecret ENC *******&#xA;    next&#xA;config vpn ipsec phase2&#xA;    edit “asa 191.168.185.0/24&quot;&#xA;        set phase1name “asa”&#xA;        set proposal 3des-md5&#xA;        set dhgrp 2&#xA;        set dst-subnet 10.101.0.0 255.255.255.0&#xA;        set keylifeseconds ?&#xA;        set src-subnet 192.168.185.0 255.255.255.0&#xA;    next&#xA;    edit “asa 10.180.0.0/24&quot;&#xA;        set phase1name “asa”&#xA;        set proposal 3des-md5&#xA;        set dhgrp 2&#xA;        set dst-subnet 10.101.0.0 255.255.255.0&#xA;        set keylifeseconds ?&#xA;        set src-subnet 10.180.0.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the firewall policies for the tunnel, make sure &lt;code&gt;set natoutbound enable&lt;/code&gt; is not in the configuration. Otherwise it will NAT the VPN traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Josh&lt;/p&gt;&#xA;" OwnerUserId="5653" LastActivityDate="2016-08-26T03:00:39.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34376" PostTypeId="2" ParentId="34306" CreationDate="2016-08-26T04:05:40.563" Score="6" Body="&lt;p&gt;A full duplex or Bidirection communication meaning that it can support both stations transmitting and receiving simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To accomplish this, a single optical fiber with WDM technology is required for optical tommunication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;WDM stands for wavelength division multiplex. This multiplex method uses both 1310 nm and 1550 nm wavelengths.Two devices are used for connection via a single optical fiber just as seen in the picture. Device A transmits data at 1310 nm on the TX channel and device B receives data at the same wavelength on the RX channel. When the roles are reversed, 1550 nm is used in the other direction. Connection is therefore only possible between device A and device B. The devices are available as a set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vh0e5.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vh0e5.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that Cisco 1000BASE-BX10-D and 1000BASE-BX10-U SFP is availble for Single-Fiber Bidirectional Applications. &lt;/p&gt;&#xA;" OwnerUserId="24835" LastActivityDate="2016-08-26T04:05:40.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34381" PostTypeId="2" ParentId="34369" CreationDate="2016-08-26T10:34:49.003" Score="3" Body="&lt;p&gt;If you need to electrically disconnect a port via command line (doing electrically the same thing as physically removing the cable from the port) you'll need a Layer 1 switch, which is a very expensive device (since it can connect any port to any other port). If you only need to stop the port communicating, then you might be able to do it with a cheaper managed switch by issuing interface disable/enable commands. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on what you're doing, you could also manufacture a device that does it, for example by putting 8 Mosfets between the pins of two outlets, and then trigger those with the I/O of a Raspberry Pi. This won't satisfy the requirements for Ethernet when it comes to shielding and frequency attenuation, but for test purposes it might work. If you're only using FastEthernet, then you can get away with only doing it on 2 pairs of the cable as well. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-08-26T10:34:49.003" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34384" PostTypeId="2" ParentId="20683" CreationDate="2016-08-26T11:50:20.830" Score="0" Body="&lt;p&gt;You can use a splitter (you can even buy these abominations for both 2 FastEthernet links in one 4 pair cable, or FastEthernet and POTS) at both ends of the permanent link of the run but you'll get a lot of crosstalk depending on the cable type used for the run and how long it is. I've never seen an application where these splitters work as advertised, usually you get so much errors when both are in use that it renders one link unusable.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a side note, any particular reason for why you just can't install a switch at the far end of the link?&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-08-26T11:50:20.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34387" PostTypeId="1" CreationDate="2016-08-26T13:03:41.707" Score="0" ViewCount="1057" Body="&lt;p&gt;Below is the config. The port redirection is working, but the range of the ports and other ports permitted in the access-list are not opening:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network TEST_PUBLIC_IP&#xA;&#xA;host 10.10.10.10&#xA;&#xA;object-group service PROD_101 tcp&#xA;port-object eq 8443&#xA;port-object eq 922&#xA;port-object eq ssh&#xA;port-object eq https&#xA;port-object range 8000 8200&#xA;&#xA;object network TEST_PRIVATE_IP&#xA;&#xA;host 1.1.1.1.&#xA;nat (PRODUCTION,OUTSIDE) static TEST_PUBLIC_IP service tcp 8085 www&#xA;&#xA;access-list Outside_IN extended permit tcp any object TEST_PRIVATE_IP object-group PROD_101&#xA;&#xA;access-group Outside_IN in interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30017" LastEditorUserId="20757" LastEditDate="2017-01-30T08:51:21.073" LastActivityDate="2017-01-30T08:51:21.073" Title="How to configure port to port forwarding on ASA 5512-X?" Tags="|cisco|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34388" PostTypeId="2" ParentId="34086" CreationDate="2016-08-26T13:26:31.630" Score="3" Body="&lt;p&gt;When you configure a static PAT rule with (inside,outside), this actually creates a persistent connection in your NAT table that is bidirectional between the two specified interfaces. You can see this with &lt;code&gt;show xlate&lt;/code&gt;. This makes it so you don't need to create two NAT rules for a static PAT rule. With one rule handling inbound traffic to the outside interface and the other handling inbound traffic to the inside interface. You can create a unidirectional static NAT rule by adding the &lt;code&gt;unidirectional&lt;/code&gt; statement at the end of you NAT statement to override this behavior. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the ASA 8.3+ NAT syntax, we use all real IP addresses and ports. I just think of it as the NAT translation happens &lt;em&gt;before&lt;/em&gt; your inbound ACL is applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Josh&lt;/p&gt;&#xA;" OwnerUserId="5653" LastActivityDate="2016-08-26T13:26:31.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34391" PostTypeId="1" AcceptedAnswerId="34395" CreationDate="2016-08-26T15:58:19.093" Score="1" ViewCount="261" Body="&lt;p&gt;Can someone freaking explain this to me? It's driving me NUTS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current running config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpdn-group 1&#xA; ! Default PPTP VPDN group&#xA; accept-dialin&#xA;  protocol pptp&#xA;  virtual-template 2&#xA; l2tp tunnel timeout no-session 15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Super Cool!&lt;/strong&gt; Except that last command doesn't EXIST!&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2901_easton(config-vpdn)#l2tp ?&#xA;% Unrecognized command&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the &quot;?&quot; for the entire thing...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2901_easton(config-vpdn)#?&#xA;VPDN group configuration commands:&#xA;  accept-dialin...................VPDN accept-dialin group configuration&#xA;  default.........................Set a command to its defaults&#xA;  description.....................Description for this VPDN group&#xA;  dsl-line-info-forwarding........Forward DSL Line Info attributes&#xA;  exit............................Exit from VPDN group configuration mode   force-local-chap..............Force a CHAP challenge to be instigated locally&#xA;  ip..............................IP settings for tunnel&#xA;  lcp.............................LCP specific commands&#xA;  local...........................Local information&#xA;  no..............................Negate a command or set its defaults&#xA;  pptp ...........................PPTP specific commands&#xA;  redirect........................Call redirection options&#xA;  request-dialout.................VPDN request-dialout group configuration&#xA;  session-limit...................Maximum sessions allowed for this group&#xA;  source..........................Configuration source for this vpdn-group&#xA;  source-ip.......................Set source IP address for this vpdn-group&#xA;  terminate-from..................Terminate tunnel from remote peer&#xA;  vpn.............................VPN ID/VRF name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thoughts anyone?? I would REALLY like to increase the timeout on this darn dial-in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA;With Ron's help I applied the l2tp command to a VPDN template then applied the template to the VPDN group. Looks like this now. I am wondering which timeout it will use, the template, or the directly configured one that I can't touch. The template I configured with &quot;never&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpdn-group 1&#xA; ! Default PPTP VPDN group&#xA; accept-dialin&#xA;  protocol pptp&#xA;  virtual-template 2&#xA; source vpdn-template 2&#xA; l2tp tunnel timeout no-session 15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, a question came up about licenses... here is my show license.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2901_easton#show license&#xA;Index 1 Feature: ipbasek9&#xA;        Period left: Life time&#xA;        License Type: Permanent&#xA;        License State: Active, In Use&#xA;        License Count: Non-Counted&#xA;        License Priority: Medium&#xA;Index 2 Feature: securityk9&#xA;        Period left: Life time&#xA;        License Type: Permanent&#xA;        License State: Active, In Use&#xA;        License Count: Non-Counted&#xA;        License Priority: Medium&#xA;Index 3 Feature: uck9&#xA;        Period left: Not Activated&#xA;        Period Used: 0  minute  0  second&#xA;        License Type: EvalRightToUse&#xA;        License State: Not in Use, EULA not accepted&#xA;        License Count: Non-Counted&#xA;        License Priority: None&#xA;Index 4 Feature: datak9&#xA;        Period left: Not Activated&#xA;        Period Used: 0  minute  0  second&#xA;        License Type: EvalRightToUse&#xA;        License State: Not in Use, EULA not accepted&#xA;        License Count: Non-Counted&#xA;        License Priority: None&#xA;Index 5 Feature: gatekeeper&#xA;        Period left: Not Activated&#xA;        Period Used: 0  minute  0  second&#xA;        License Type: EvalRightToUse&#xA;        License State: Not in Use, EULA not accepted&#xA;        License Count: Non-Counted&#xA;        License Priority: None&#xA;Index 6 Feature: SSL_VPN&#xA;        Period left: 8  weeks 3  days&#xA;        Period Used: 5  minutes 44 seconds&#xA;        License Type: EvalRightToUse&#xA;        License State: Active, Not in Use, EULA accepted&#xA;        License Count: 0/0  (In-use/Violation)&#xA;        License Priority: Low&#xA;Index 7 Feature: ios-ips-update&#xA;        Period left: Not Activated&#xA;        Period Used: 0  minute  0  second&#xA;        License Type: EvalRightToUse&#xA;        License State: Not in Use, EULA not accepted&#xA;        License Count: Non-Counted&#xA;        License Priority: None&#xA;Index 8 Feature: SNASw&#xA;        Period left: Not Activated&#xA;        Period Used: 0  minute  0  second&#xA;        License Type: EvalRightToUse&#xA;        License State: Not in Use, EULA not accepted&#xA;        License Count: Non-Counted&#xA;        License Priority: None&#xA;Index 9 Feature: hseck9&#xA;Index 10 Feature: cme-srst&#xA;        Period left: Not Activated&#xA;        Period Used: 0  minute  0  second&#xA;        License Type: EvalRightToUse&#xA;        License State: Not in Use, EULA not accepted&#xA;        License Count: 0/0  (In-use/Violation)&#xA;        License Priority: None&#xA;Index 11 Feature: WAAS_Express&#xA;        Period left: Not Activated&#xA;        Period Used: 0  minute  0  second&#xA;        License Type: EvalRightToUse&#xA;        License State: Not in Use, EULA not accepted&#xA;        License Count: Non-Counted&#xA;        License Priority: None&#xA;Index 12 Feature: UCVideo&#xA;        Period left: Not Activated&#xA;        Period Used: 0  minute  0  second&#xA;        License Type: EvalRightToUse&#xA;        License State: Not in Use, EULA not accepted&#xA;        License Count: Non-Counted&#xA;        License Priority: None&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21964" LastEditorUserId="21964" LastEditDate="2016-08-26T17:40:01.077" LastActivityDate="2016-08-29T19:11:32.817" Title="Command is in running config, but doesn't exist?" Tags="|cisco|vpn|cli|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="34394" PostTypeId="2" ParentId="34387" CreationDate="2016-08-26T17:12:54.500" Score="2" Body="&lt;p&gt;With the ASA code 8.3+, you need to specify the real IP address &lt;em&gt;and&lt;/em&gt; the real port in the inbound outside access list. Based on the configuration you provided, if you add:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group service PROD_101 tcp&#xA;port-object eq www&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It should fix your problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Working configuration for the other ports&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object service TCP-SOURCE-22 &#xA; service tcp source eq 22 &#xA;&#xA;nat (PRODUCTION,OUTSIDE) source static TEST_PRIVATE_IP TEST_PUBLIC_IP service TCP-SOURCE-22 TCP-SOURCE-22 &#xA;&#xA;object service TCP-SOURCE-8000_8200 &#xA; service tcp source range 8000 8200 &#xA;&#xA;nat (PRODUCTION,OUTSIDE) source static TEST_PRIVATE_IP TEST_PUBLIC_IP service TCP-SOURCE-8000_8200 TCP-SOURCE-8000_8200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5653" LastEditorUserId="5653" LastEditDate="2016-09-01T12:13:44.843" LastActivityDate="2016-09-01T12:13:44.843" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34395" PostTypeId="2" ParentId="34391" CreationDate="2016-08-26T17:32:53.683" Score="3" Body="&lt;p&gt;EDIT: Short Answer is that PPTP protocol was selected and the l2tp options for the timeout were unavailable in this context. Changing the protocol to l2tp under the vpdn-group allows you to remove and configure the l2tp settings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have enough rep to comment so I will post an answer here... I have a similar configuration and I am able to edit the session timeout under the vpdn group. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;uc520(config-vpdn)#?&#xA;VPDN group configuration commands:&#xA;  accept-dialin             VPDN accept-dialin group configuration&#xA;  default                   Set a command to its defaults&#xA;  description               Description for this VPDN group&#xA;  dsl-line-info-forwarding  Forward DSL Line Info attributes&#xA;  exit                      Exit from VPDN group configuration mode&#xA;  force-local-chap          Force a CHAP challenge to be instigated locally&#xA;  ip                        IP settings for tunnel&#xA;  l2tp                      L2TP specific commands&#xA;  lcp                       LCP specific commands&#xA;  local                     Local information&#xA;  no                        Negate a command or set its defaults&#xA;  redirect                  Call redirection options&#xA;  relay                     Relay options configuration&#xA;  request-dialout           VPDN request-dialout group configuration&#xA;  scalability               Scalability testing configuration&#xA;  session-limit             Maximum sessions allowed for this group&#xA;  source                    Configuration source for this vpdn-group&#xA;  source-ip                 Set source IP address for this vpdn-group&#xA;  terminate-from            Terminate tunnel from remote peer&#xA;  vpn                       VPN ID/VRF name&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am running IOS version &lt;strong&gt;Version 15.1(4)M6&lt;/strong&gt; which is a few maintenance releases newer than the one you are using. I would try updating it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Here is the VPDN configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VPDN Configuration&#xA;vpdn enable&#xA;!&#xA;vpdn-group L2TP&#xA; ! Default L2TP VPDN group&#xA; accept-dialin&#xA;  protocol l2tp&#xA;  virtual-template 1&#xA; no l2tp tunnel authentication&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IOS Image:&#xA;uc500-advipservicesk9-mz.151-4.M6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This configuration is on a UC520 so the licensing is user based. It doesn't show anything related to features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at that, you may be able to remove the command by changing the protocol, removing it, and then changing the protocol back. Then you could try this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;pptp tunnel echo [time_out]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I didn't realize you were using PPTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Josh&lt;/p&gt;&#xA;" OwnerUserId="5653" LastEditorUserId="5653" LastEditDate="2016-08-29T19:11:32.817" LastActivityDate="2016-08-29T19:11:32.817" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34396" PostTypeId="2" ParentId="23761" CreationDate="2016-08-26T18:02:23.180" Score="0" Body="&lt;p&gt;You can &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Get universal time over NTP&lt;/li&gt;&#xA;&lt;li&gt;Look up the devices IP address (if implementing on the client remember to get the public IP from a server on the Internet rather than using a local private IP) in a geolocation database to get a TZ ID.&lt;/li&gt;&#xA;&lt;li&gt;Look up the TZ ID in the TZ database to get the rules for that timezone.&lt;/li&gt;&#xA;&lt;li&gt;Convert those times to local time.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However there are some problems with this approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first is that network boundries don't always line up with political or timezone boundries. This is especailly a concern in countries like the US and Canada that have multiple timezones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second is that implementing this process locally on an OS-less embedded device which presumablly has limited memory will be difficult. The geoip and TZ databases are not exactly small.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third is that geoip and TZ databases both need to be updated regularlly and can lag behind reality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your embedded devices talk to some kind of server i'd look at implementing things server side where the large and volalite databases are less of a burden.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I would suggest only using geolocation data to set an initial default. This avoids systems unintentially jumping timezones for no obvious reason.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-26T18:02:23.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34397" PostTypeId="2" ParentId="32595" CreationDate="2016-08-26T18:12:59.227" Score="3" Body="&lt;p&gt;Just an update.&#xA;Verizon was able to collaborate on load balancing the 3xT1 and the 4xT1 using BGP. All is working as intended so far. Thanks all.&lt;/p&gt;&#xA;" OwnerUserId="21964" LastActivityDate="2016-08-26T18:12:59.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34400" PostTypeId="2" ParentId="33594" CreationDate="2016-08-26T21:17:09.253" Score="1" Body="&lt;p&gt;I would run your APs in local mode and make sure you are trunking to the controller. Then put the ports that your APs are plugged into as access ports for vlan 10. This should get your roaming working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your controller, configure two interfaces with vlan ids for 20 and 30 (Controller &gt; Interfaces). Then on your SSIDs assign the interfaces that your just created. (WLAN &gt; [wlan_name] &gt; Interface/Interface Group(G)).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When APs are in local mode, they tunnel all client traffic back to the controller to make a routing decision. This way you don't need to trunk to each AP and the roaming will be controlled by the controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I seen in your partial solution that you have to configure DHCP relay on the 2960S switch. I thought this was strange because the switch is a layer 2 device and DHCP broadcasts should work without it. That is unless the trunk isn't correct to the Mikrotik.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this setup in a few places where wireless is critical and it works very well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Josh&lt;/p&gt;&#xA;" OwnerUserId="5653" LastActivityDate="2016-08-26T21:17:09.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34402" PostTypeId="2" ParentId="10663" CreationDate="2016-08-27T04:47:25.817" Score="2" Body="&lt;p&gt;Essentially, you need to associate an SNMP context with a particular VRF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco configuration guide - &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/12-4t/snmp-12-4t-book/nm-snmp-vpn-context.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/snmp/configuration/12-4t/snmp-12-4t-book/nm-snmp-vpn-context.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# snmp-server context context1 // create a context named context1&#xA;Router(config)# ip vrf BLUE // enters VRF configuration mode&#xA;Router(config-vrf)#context context1 //Associates an SNMP context with a particular VRF&#xA;Router(config-vrf)# end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: In Cisco IOS Release 15.0(1)M and later releases, the &lt;strong&gt;context&lt;/strong&gt; command is replaced by the &lt;strong&gt;snmp context&lt;/strong&gt; command. See the Network Management Command Reference for more information.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# snmp-server user customer1 group1 v3 // Configures a new user to an SNMP group&#xA;Router(config)# snmp-server group group1 v3 context context1 // associate a group with a context&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note: Users and groups only exist in SNMPv3 and groups should exist prior to adding users to them.&lt;/p&gt;&#xA;" OwnerUserId="13244" LastEditorUserId="13244" LastEditDate="2016-08-28T06:55:39.333" LastActivityDate="2016-08-28T06:55:39.333" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34403" PostTypeId="1" AcceptedAnswerId="34409" CreationDate="2016-08-27T05:05:13.613" Score="2" ViewCount="2434" Body="&lt;p&gt;First of all, I am not a network engineer, and my knowledge of physical network installations is quite limited ( I am a programmer ) , so please excuse me if my question is too trivial / naive / unbearably stupid or @ the wrong place .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to install some new network connections in our r&amp;amp;d lab , and I want them to be flexible, but I will be using existing piping ( conduits ) that were originally made for electricity , and therefor in series ..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefor , I want to install as many ( flexible ) points as I can, without having too many cables or complicating the network typology and without the network to be too big or having to change / add switches .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is - I know it is not &quot; standard &quot; or &quot; best - practice &quot; , but would something like this diagram work ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/G3G0p.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G3G0p.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, if I connect a device to the &lt;code&gt;A1&lt;/code&gt; , than &lt;code&gt;B1&lt;/code&gt; can not be used .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if I connect a Device to &lt;code&gt;C1&lt;/code&gt; ( endpoint )  , than &lt;code&gt;A1&lt;/code&gt; and &lt;code&gt;B1&lt;/code&gt; need to be manually &quot; bridged &quot; with a cable ( I know it is probably the wrong word when talking about networks  ) .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vCRbl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vCRbl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So My question is basically about the connection between &lt;code&gt;A1&lt;/code&gt; and &lt;code&gt;B1&lt;/code&gt; to serve &lt;code&gt;C1&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1 - Even though my intuition say yes - would something like this even work ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2 - What would the external &quot; bridging cable &quot; need to be : a patch cable ? normal straight / crossover ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3 - what problems should I expect ( if any )  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q4 - Even though the example diagram is simplified to show only 1 &quot;bridge&quot; , I would need / want to use more than one on my line , but of course, by design, only one endpoint . Would that be the same ( series ) or can complicate things ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;[ EDIT 1 ]&lt;/strong&gt; - After Comments&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to try and be more clear , here is another diagram .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The inwall conduit already exists , and they connect two areas / room / floors .&#xA;They were prepared for electricity, and therefor they are chained . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can not add more conduits nor can I run 2 cables in one without breaking walls or doing major makeover of the place .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ORCun.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ORCun.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have the possibility to use the one cable either in room &lt;code&gt;X&lt;/code&gt; &lt;strong&gt;OR&lt;/strong&gt; in room &lt;code&gt;Y&lt;/code&gt; by &quot;patching&quot; or &quot;bridging&quot; the two sockets in room &lt;code&gt;X&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="30030" LastEditorUserId="30030" LastEditDate="2016-08-27T11:51:13.033" LastActivityDate="2018-10-06T00:07:18.783" Title="serial Connecting two network wall sockets" Tags="|ethernet|lan|cable|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34404" PostTypeId="1" AcceptedAnswerId="34428" CreationDate="2016-08-27T05:13:49.300" Score="0" ViewCount="4650" Body="&lt;p&gt;I am trying to set up my old FortiGate 100A as a simple router for a small office network. My ISP's incoming PPPoE connection runs on VLAN 100 and I can't seem to get it going on a WAN port of the FortiGate. I have created a VLAN sub-interface under one of the WAN ports and got it authenticating and getting an IP address from the ISP, but I can't seem to get it passing traffic from the internal interfaces through that sub-interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried setting a static route, but as i understand it, I shouldn't have to do that, because the gateway is retrieved from the ISP when it connects. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am pretty new to the whole &quot;real&quot; router scene so I might have missed an obvious step I don't know about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need any more information, let me know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="30031" LastEditorUserId="15678" LastEditDate="2019-03-02T14:27:43.823" LastActivityDate="2019-03-02T14:27:43.823" Title="FortiGate 100A with VLAN on WAN port" Tags="|vlan|wan|isp|fortigate|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="34406" PostTypeId="1" CreationDate="2016-08-27T08:25:11.197" Score="2" ViewCount="627" Body="&lt;p&gt;When we have multiple ISPs terminating on the router with full BGP routing tables, is there a guarantee that an incoming packet takes the same ISP for out going? How the BGP route selection process works when we have multiple ISPs? When we have multiple ISPs, it is still 1 routing and 1 forwarding tables? How the routes aer maintained in routing and forwarding table separately when we have multiple ISPs? Any pointers to BGP route selection process with multihoming would be helpful...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="22114" LastEditorUserId="22114" LastEditDate="2016-08-28T05:36:34.673" LastActivityDate="2016-08-28T05:36:34.673" Title="BGP Multihoming and full routing tables" Tags="|routing|bgp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34407" PostTypeId="2" ParentId="34406" CreationDate="2016-08-27T09:34:49.587" Score="4" Body="&lt;p&gt;Routing is not gauranteed to be symetric. Indeed it often isn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RIB will contain information about routes from both ISPs, the &quot;best&quot; route to each destination will then be selected and installed in the FIB. What exactly &quot;Best&quot; means will depend on configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More-specific (longer prefix) routes always win over less-specific (shorter prefix) ones.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-08-27T09:34:49.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34409" PostTypeId="2" ParentId="34403" CreationDate="2016-08-27T14:34:08.210" Score="2" Body="&lt;p&gt;You configuration will definitely work it is just a matter of how well it will work. With the addition of multiple patch cables and wall runs, you want to make sure the total cable length from the switch to the host is well under 100m. Depending on the switch, you probably want to make sure the wiring through to the client is all &quot;straight through&quot; and not cross over. This will help in troubleshooting layer 1 issues, but if the switch is newer then it probably have auto-MDIX that will auto detect the receive and send pins and switch them accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My other concern is the exposed patch cable between A1 and B1. If this is in a public area then it may be better to put that behind the wall plate to reduce the chance of tampering. Also If I were to see a wall jack plugged into another wall jack, I would immediately think a switch loop was present because normally all of the horizontal wiring runs back to a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than the above considerations it should work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Josh&lt;/p&gt;&#xA;" OwnerUserId="5653" LastActivityDate="2016-08-27T14:34:08.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34415" PostTypeId="2" ParentId="34244" CreationDate="2016-08-27T18:40:19.487" Score="2" Body="&lt;p&gt;BGP multipath is for load balancing, not fail-over. In your topology, a basic (default) BGP configuration will already fail-over to one of the ISP2 links if both ISP1 links are down. If you'd also like to load balance between both ISP1 links (or both ISP2) links, by all means also configure BGP multipath. But it has nothing to do with fail-over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might find this helpful: &lt;a href=&quot;https://www.juniper.net/documentation/en_US/junos15.1/topics/concept/bgp-multipath-understanding.html&quot; rel=&quot;nofollow&quot;&gt;https://www.juniper.net/documentation/en_US/junos15.1/topics/concept/bgp-multipath-understanding.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30040" LastActivityDate="2016-08-27T18:40:19.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34416" PostTypeId="2" ParentId="32735" CreationDate="2016-08-27T18:59:45.860" Score="0" Body="&lt;p&gt;An RADB entry with one of the IRRs should reflect the actual routing policy in-use. These policies are important  used to enforce filtering that keeps others from announcing your routes (accidentally or maliciously). Your (customer's) routing policy differs from its registration. Your customer should probably fix that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also try to make your routing &lt;em&gt;appear&lt;/em&gt; to reflect already in place policy, as some others have suggested. Whether that's appropriate is left for you to decide. &lt;/p&gt;&#xA;" OwnerUserId="30040" LastEditorUserId="30040" LastEditDate="2016-08-30T04:20:26.443" LastActivityDate="2016-08-30T04:20:26.443" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34417" PostTypeId="2" ParentId="34331" CreationDate="2016-08-27T20:45:02.683" Score="2" Body="&lt;p&gt;On the ASA running the version 8.2 code, there are a few potential issues. The first is the SSL VPN could be setup for split tunneling and they would need to add your subnet in the split tunnel list. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second is the SSL VPN connects to the outside interface as well as your site to site VPN. They will need to permit hair pinning on the outside interface by issuing this command on the remote ASA &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;same-security-traffic permit intra-interface&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third is the NAT exemption. They may need to do something like this on the remote ASA &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;static (outside,outside) 192.168.99.0 192.168.99.0 netmask 255.255.255.0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this doesn't work I would verify the remote end's crypto ACL and make sure the SSL VPN subnet is specified and that routing to the SSL VPN subnet is added to your router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Josh&lt;/p&gt;&#xA;" OwnerUserId="5653" LastActivityDate="2016-08-27T20:45:02.683" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34425" PostTypeId="1" AcceptedAnswerId="34446" CreationDate="2016-08-28T09:36:15.010" Score="14" ViewCount="30212" Body="&lt;p&gt;I know that a crossover cable should be used to directly connect devices of the same type and patch cable is used to connect devices of different types.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I never understood why is it so exactly? Why does such design has been chosen? Does the device used together with a patch cable always perform crossover?&lt;/p&gt;&#xA;" OwnerUserId="15586" LastEditorUserId="8499" LastEditDate="2018-12-21T04:10:27.730" LastActivityDate="2022-02-02T17:05:37.337" Title="Why do I need a crossover cable to connect devices of the same type?" Tags="|ethernet|layer1|cable|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34427" PostTypeId="1" AcceptedAnswerId="34435" CreationDate="2016-08-28T09:44:48.363" Score="1" ViewCount="968" Body="&lt;p&gt;Really hoping you can help me shed some light on some serious issues I've been experiencing on our production network. I'll give a quick background and explain the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Background:&lt;/strong&gt;&#xA;Our network consists of mainly 2960 &amp;amp; 3750 Cisco switches last year we experienced a complete network outage when a new switch stack was added with VTP server made enabled and a new VLAN added which propagated and wiped our all other VLANS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The outcome was to change the VTP mode on all switches to transparent, problem solved... or so we thought.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Friday Last Week:&lt;/strong&gt;&#xA;I setup two new stacks (Ensuring both had VTP mode set to transparent) then we had a vendor add an additional VLAN onto their managed switch (Which connects our internal switches) to allow traffic from a new site. As soon as we opened the trunk port, 2 of our floors lost connectivity. I quickly logged on and found not only my new switch stack but 3 completely separate other stacks had their VTP mode set to server and it had propagated VLAN's again!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&#xA;Has anyone seen this behaviour before? I'm certain all switch stacks were set to transparent so I'm gob smacked as well as freaking out as to how this could have happened again... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any insight would be greatly appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&#xA;D&lt;/p&gt;&#xA;" OwnerUserId="29672" LastEditorUserId="8499" LastEditDate="2018-03-18T19:19:52.023" LastActivityDate="2018-03-18T19:19:52.023" Title="VTP Mode Automatically Changing to Server" Tags="|cisco|switch|switching|cisco-catalyst|vtp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34428" PostTypeId="2" ParentId="34404" CreationDate="2016-08-28T10:03:12.837" Score="1" Body="&lt;p&gt;For traffic to pass from the internet to the LAN you need a couple of preliminaries to allow this:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- create an address object &quot;myLAN&quot; for the addresses used for your LAN hosts, like e.g. &quot;192.168.123.0/24&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- then create a policy:&lt;br&gt;&#xA;source interface: internal&lt;br&gt;&#xA;source address: myLAN&lt;br&gt;&#xA;destination interface: &lt;strong&gt;yourVLAN_IF&lt;/strong&gt;&lt;br&gt;&#xA;destination address: ALL&lt;br&gt;&#xA;&lt;strong&gt;check the &quot;NAT&quot; option&lt;/strong&gt;!  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are not using the WAN port but the virtual VLAN interface created on it.&lt;br&gt;&#xA;The NAT option is essential as the private source addresses of outbound traffic are replaced by the public address of the VLAN interface so that it can be routed back to your FGT.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routing is essential as well:&lt;br&gt;&#xA;3- create a default route&lt;br&gt;&#xA;find the menu option to create a static route (this is firmware version dependent). Create a route '0.0.0.0/0' pointing to interface &quot;yourVLAN_IF&quot;, no gateway. The gatewway address has already be set because you checked that option in the interface setup (this is a PPPoE option).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're right in assuming that the FGT has automatically created a route to the VLAN interface, look it up in 'Routing monitor'.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-08-28T10:03:12.837" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34431" PostTypeId="2" ParentId="34425" CreationDate="2016-08-28T10:32:23.153" Score="7" Body="&lt;p&gt;This fact is applied only to the devices that don't have an &lt;strong&gt;&lt;em&gt;auto sensing mechanism&lt;/em&gt;&lt;/strong&gt;, which can detect the direction of the transmitted traffic on each pin of the 8 RJ pins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When connecting same type of network devices together (switch to switch, router to router or PC to PC ), we need to use cross-over cables so that the emitting pair from one device goes to the receiving pair of the other device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nowadays, most devices are smart enough to understand the direction of the traffic and handle it whatever the type of cable.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="28361" LastEditDate="2016-08-28T16:44:04.663" LastActivityDate="2016-08-28T16:44:04.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34435" PostTypeId="2" ParentId="34427" CreationDate="2016-08-28T17:31:03.137" Score="1" Body="&lt;p&gt;It sounds like someone removed the domain name and password on the switches in question. This leaves them with no VTP set, just like a new switch, which will auto-configure VTP from VTP advertisements it sees, even from new switches added. The VTP domain name is also carried in DTP messages. A best practice is to use the &lt;code&gt;set switchport mode trunk&lt;/code&gt; and &lt;code&gt;switchport nonegotiate&lt;/code&gt; commands to disable DTP on the trunk links and unconditionally trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should set the domain name, password, and Transparent mode, and insist that all new or replacement switches be set that way prior to connecting to your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another Cisco best practice it to only use a VLAN on one access switch, rather than have VLANs across multiple switches. This will prevent many STP problems. It used to be, &quot;switch where you can, route where you must,&quot; but that is now obsolete. It is now a layer-3 world, and almost nothing requires hosts to be on the same layer-2 broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, switches in Client mode could have done that to you, too. It is not only Server mode switches which can override the VLAN database (see highlighted text):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Add a Switch to the VTP Domain&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;A recently added switch can cause problems in the network. It can be a&#xA;  switch that was previously used in the lab, and a good VTP domain name&#xA;  was entered. &lt;strong&gt;&lt;em&gt;The switch was configured as a VTP client and was&#xA;  connected to the rest of the network.&lt;/em&gt;&lt;/strong&gt; Then, you brought the trunk&#xA;  link up to the rest of the network. In just a few seconds, the whole&#xA;  network can go down.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If the configuration revision number of the switch that you inserted&#xA;  is higher than the configuration revision number of the VTP domain, it&#xA;  propagates its VLAN database through the VTP domain.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;&lt;em&gt;This occurs whether the switch is a VTP client or a VTP server. A VTP client can erase VLAN information on a VTP server.&lt;/em&gt;&lt;/strong&gt; You can tell&#xA;  this has occurred when many of the ports in your network go into the&#xA;  Inactive state but continue to assign to a nonexistent VLAN.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-08-28T17:31:03.137" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34436" PostTypeId="2" ParentId="5595" CreationDate="2016-08-28T18:55:59.750" Score="1" Body="&lt;p&gt;Difference b/w Path vector and Distance vector . . .&#xA;BGP is using the &lt;strong&gt;&lt;em&gt;Path-vector Protocol&lt;/em&gt;&lt;/strong&gt; means that BGP using the valid and Best path selection . BGP select the &lt;strong&gt;&lt;em&gt;best path and the valid path&lt;/em&gt;&lt;/strong&gt; . In the whole process bgp wants to readability to its destination  . BGP see the &lt;strong&gt;&lt;em&gt;whole&lt;/em&gt;&lt;/strong&gt; path from &lt;em&gt;source to destination&lt;/em&gt; . And this the one of reason that BGP is the slowest convergence time protocol in all protocols . &#xA;On other hand &lt;strong&gt;Distance vector protocol&lt;/strong&gt; is simply follow the &lt;strong&gt;next-hop&lt;/strong&gt; . It (Distance vector ) do not care of the whole path from &lt;strong&gt;Source to Destination&lt;/strong&gt; . It only think about the next hop and dont care about the whole best path . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks &lt;/p&gt;&#xA;" OwnerUserId="30057" LastActivityDate="2016-08-28T18:55:59.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34438" PostTypeId="1" AcceptedAnswerId="34441" CreationDate="2016-08-28T22:49:12.460" Score="1" ViewCount="256" Body="&lt;p&gt;Consider the network with the following trivial topology, which is a subset of a real network:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ewuMN.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ewuMN.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Server A is on VLAN 1, physically connected to port 1 on the switch.&#xA;Server B is on VLAN 2, physically connected to port 8 on the switch.&#xA;There is also an uplink/trunk port connected to port 4 on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration of the switch is given in the screenshot below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4YdTA.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4YdTA.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Server A is given PVID 1, but is also a member of tagged VLAN ID 2 (2T). Thus it should allow egress and ingress of frames tagged with VLAN ID 2 on physical port 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Server B is given PVID 2, which should tag all frames with VLAN ID 2 on ingress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this in mind I'm expecting server B to be able to ping server A. But this is not the case, server B cannot reach server A. Traffic on port 4 with tagged VLAN ID 2 also cannot reach server B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is what is it with this configuration that prevents the switch from passing along tagged VLAN ID 2 traffic to port 1? Is it my misunderstanding of how VLAN works? If so, what is wrong with my understanding, and what is the correct setup?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It did occur to me that port 8 is only a member of VLAN ID 2, and traffic tagged with VLAN ID 1 (as in the ICMP echo reply which it is waiting for) would not pass through, making the connection unidirectional. But even after tagging port 8 with VLAN ID 1 (making it 1T,2U) there was no difference. Server B still couldn't ping server A.&lt;/p&gt;&#xA;" OwnerUserId="30056" LastActivityDate="2016-08-29T00:56:34.250" Title="What prevents tagged frames from being forwarded on a VLAN?" Tags="|cisco|vlan|ethernet|cisco-small-business|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34441" PostTypeId="2" ParentId="34438" CreationDate="2016-08-29T00:56:34.250" Score="2" Body="&lt;p&gt;You need to understand the difference between tagged and untagged frames.  Tagged frames use the 802.1q frame format, which is different than &quot;standard&quot; ethernet.  Other than switches, few devices understand 802.1q format.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When server B sends a frame on VLAN2, it sends it as a standard Ethernet (i.e. untagged) frame.  But because you have configured port 1 to tag VLAN 2, the frame will exit port 1 in 802.1q format.  Server A doesn't understand that format and ignores the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A port can have only one untagged VLAN, but many tagged VLANs.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-29T00:56:34.250" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34443" PostTypeId="1" AcceptedAnswerId="34445" CreationDate="2016-08-29T02:37:12.167" Score="0" ViewCount="114" Body="&lt;p&gt;So I want to be able to host many FTP servers off port &lt;code&gt;21&lt;/code&gt; all from one IP address. Here's the setup:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If the person connects with &lt;code&gt;ftp1.example.com&lt;/code&gt; the internal server&#xA;address is &lt;code&gt;10.0.0.1&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;If the person connects with &lt;code&gt;ftp2.example.com&lt;/code&gt; the internal server address&#xA;is &lt;code&gt;10.0.0.2&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;etc...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But the &lt;code&gt;ftp1.eample.com&lt;/code&gt; and &lt;code&gt;ftp2.example.com&lt;/code&gt; both point to the same external IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the ways of going about this?&lt;/p&gt;&#xA;" OwnerUserId="30064" LastEditorUserId="8499" LastEditDate="2016-08-29T02:49:10.267" LastActivityDate="2016-08-29T11:25:27.833" Title="I'm a student. Question, is this routing possible? If so how?" Tags="|routing|ipv4|nat|" AnswerCount="3" CommentCount="3" ClosedDate="2019-02-28T03:24:10.857" ContentLicense="CC BY-SA 3.0" />
  <row Id="34444" PostTypeId="2" ParentId="34425" CreationDate="2016-08-29T03:34:50.673" Score="4" Body="&lt;p&gt;According to your answer, I think first you should have a basic understanding of the Crossover cable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Crossover cables, as the name implies, are the cables with the Tx and Rx lines crossed. While the other type of the ethernet cable is straight-through cable that has the pin assignments on each end of the cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, as we use two PCs (same devices), straight cable will connect TX to TX and RX to RX of two computers, so the devices wouldn't be able to communicate. That's why you need a crossover cable. A crossover cable redirect the output of one RJ-45 port into the input of the other RJ-45 port.&lt;/p&gt;&#xA;" OwnerUserId="24835" LastActivityDate="2016-08-29T03:34:50.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34445" PostTypeId="2" ParentId="34443" CreationDate="2016-08-29T04:58:12.737" Score="1" Body="&lt;p&gt;This is a common scenario. It is not a question of routing, it is a question of name resolution.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether you host your own domains or use a third party, DNS records would need to resolve the domain name to an IP address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common approach would be - an A record (also known as a host record) links a domain to the physical IP address of a computer hosting that domain's services.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A CNAME (Alias) record points to an A (Host) record. You can create multiple CNAME records and point them to an A record. The most common CNAME records are the subdomains www and ftp.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this approach, you can host several services on one machine, using a single IP address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the ftp servers resided on separate devices sporting RFC1918 addresses, a reverse proxy could act as a gateway and take requests from the Internet and forwarding them to servers on the internal network.&lt;/p&gt;&#xA;" OwnerUserId="13244" LastEditorUserId="13244" LastEditDate="2016-08-29T07:18:35.517" LastActivityDate="2016-08-29T07:18:35.517" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34446" PostTypeId="2" ParentId="34425" CreationDate="2016-08-29T06:24:23.780" Score="18" Body="&lt;p&gt;&lt;em&gt;When&lt;/em&gt; you need crossover cables is often explained, but &lt;em&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#why_crossover&quot; rel=&quot;noreferrer&quot;&gt;why&lt;/a&gt;&lt;/em&gt; is seldom explained.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has to do with the copper (often referred to as Ethernet) wire itself. In copper wiring, there are &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#twisted_pair&quot; rel=&quot;noreferrer&quot;&gt;four pairs of two wires (eight total wires)&lt;/a&gt;. The pairs are numbered 1-4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The entire copper cable is full duplex, which means data can be sent and received at the same time. But individually, each pair of wires is dedicated to &lt;em&gt;only&lt;/em&gt; send or &lt;em&gt;only&lt;/em&gt; receive, and some pairs are not used at all. The specifics differ with each specific standard, but for the sake of the rest of this write up, we will be discussing 100BASE-TX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;100BASE-TX uses two of the four pairs (the other two are unused). One pair of wires are used for transmission, and the other pair is used for receiving.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#pc_pc&quot; rel=&quot;noreferrer&quot;&gt;PC to PC&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Specifically, a PC using 100BASE-TX wil transmit over wire pair #2 (TX) and receive over wire pair #3 (RX). The NIC in this setup that this PC is using is referred to as a Media Dependent Interface (MDI) NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if we have two computers connected directly to each other. And they both try to transmit on wire pair #2, their signals will collide. Moreover, nothing will be sent on wire pair #3 and therefore neither computer will be able to receive anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the cables in the wires are crossed so that on one PC, the signal sent on Pair 2 from the first PC arrives on the second PC on Pair 3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xE4dE.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xE4dE.png&quot; alt=&quot;PC to PC&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both PC's are still using the MDI NIC, which means they are both sending on what they believe are Pair 2. But the individual wires are crossed so that what is sent on Pair 2 arrives on the other PC on Pair 3.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#pc_switch_pc&quot; rel=&quot;noreferrer&quot;&gt;PC to Switch to PC&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;But what of a Switch, then? How do they fit in to the mix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches are designed to be &quot;in between&quot; two PC's communicating. Therefore, &lt;strong&gt;switches are created with an innate crossing of the wires&lt;/strong&gt;. This is accomplished by switches using the MDI-X standard, which is the opposite of the MDI standard. The MDI-X NICs send on pair3, and receive on pair2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pLs3i.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pLs3i.png&quot; alt=&quot;PC to Switch to PC&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice we don't need the cable to cross the wires for us. What the PC sends on its TX wire is received by the switch on its RX wire, when then transmits on its TX wire and is then received by the other PC's RX wire. Therefore, when a Switch is connected to a PC, it can simply use a straight through cable (one that doesn't introduce an additional crossing of the wires).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;&lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#pc_switch_switch_pc&quot; rel=&quot;noreferrer&quot;&gt;PC to Switch to Switch to PC&lt;/a&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;What then happens if we have two switches in the mix? They each &quot;cross&quot; the wire once, therefore two PC's connected through to switches would have the switch's crossing effect negated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless of course, we introduce another pair crossing in between the switches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cS0D2.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cS0D2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the image above, we can see ...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The PC connection to the Switch does &lt;em&gt;not&lt;/em&gt; require a crossover cable&lt;/li&gt;&#xA;&lt;li&gt;The Switch connection to the other Switch &lt;em&gt;does&lt;/em&gt; require a crosover cable&lt;/li&gt;&#xA;&lt;li&gt;The Switch's connection to the other PC does &lt;em&gt;not&lt;/em&gt; require a cross over cable&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Notice how in the diagram, with all the crossing, the path from one PC's TX wire to the other PC's RX wire is maintained. Anytime something is sent on a TX pair, it is always received by an RX pair, all the way through the communication.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-08-29T06:24:23.780" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34447" PostTypeId="2" ParentId="34443" CreationDate="2016-08-29T06:46:16.060" Score="5" Body="&lt;p&gt;The functionality you describe is that of a &lt;em&gt;reverse proxy&lt;/em&gt; which is relatively common for HTTP, but was not possible for FTP until &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7151&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7151&lt;/a&gt; introduced the HOST command. So in your scenario, an RFC 7151 compatible FTP client can connect to the public IP address, send a HOST command indicating the name of the server it wants to connect to, and based on that info the reverse proxy running on the public ip address can then connect to the correct internal server.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-08-29T06:46:16.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34448" PostTypeId="2" ParentId="34349" CreationDate="2016-08-29T07:00:16.740" Score="2" Body="&lt;p&gt;If you only need to get to 192.168.16.0/24 from router A itself then as @Datagram.Network wrote the only route needed is on A, for 192.168.16.0 with B's WAN interface as gateway, so on A (in Cisco router syntax):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 192.168.16.0 255.255.255.0 192.168.5.215 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However if you actually meant that LAN_B needs to have connectivity to the WAN/Internet, then (in addition to the above) B would need a default route with A as next hop, so on B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.5.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that if the WAN is the public Internet then A would also need to do NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I was assuming A already had a default route to the ISP, which I should not have assumed, so @Gadeliow's answer is correct in that A also needs &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 &amp;lt;ISP-address&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But again, the default routes on A and B are &lt;em&gt;not&lt;/em&gt; needed when the requirement is to only have connectivity between A and the-LAN-behind-B.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-09-05T08:28:21.533" LastActivityDate="2016-09-05T08:28:21.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34449" PostTypeId="1" AcceptedAnswerId="34450" CreationDate="2016-08-29T07:13:17.863" Score="1" ViewCount="937" Body="&lt;p&gt;I'm running a script, that checks the configuration changes between the saved and running config.&#xA;I have noticed, that the hash that goes after  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto pki certificate chain TP-self-signed-34586112&#xA;certificate self-signed 01&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Has changed after a reboot.&#xA;Is it normal? Why does the hash change after a reboot?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="22574" LastActivityDate="2016-08-29T07:21:14.270" Title="Self-signed certificate change on Cisco3750" Tags="|cisco|security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34450" PostTypeId="2" ParentId="34449" CreationDate="2016-08-29T07:21:14.270" Score="2" Body="&lt;p&gt;Yes this is normal. On a Cisco device, a self-signed certificate is not persistent by default. In other words on every reboot it generates a new keypair and a new certificate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To configure a persistent certificate see &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srpkissc.html&quot; rel=&quot;nofollow&quot;&gt;Persistent Self-Signed Certificates&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-08-29T07:21:14.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34452" PostTypeId="1" AcceptedAnswerId="59744" CreationDate="2016-08-29T08:49:28.557" Score="2" ViewCount="2210" Body="&lt;p&gt;This is sample of a traceroute to google.com:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TraceRoute from Network-Tools.com to 216.58.194.46 [google.com]&#xA;Hop (ms)    (ms)    (ms)             IP Address Host name&#xA;1     0       0       0          206.123.64.233   -  &#xA;2     Timed out       Timed out       Timed out               -  &#xA;3     1       1       1          4.68.70.166     google-level3-3x10g.dallas.level3.net  &#xA;4     1       1       1          108.170.240.129      -  &#xA;5     1       1       1          209.85.242.53    -  &#xA;6     1       1       1          216.58.194.46   dfw25s12-in-f14.1e100.net  &#xA;&#xA;Trace complete&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It should be many &lt;strong&gt;layer 2 network device&lt;/strong&gt; from our source to destination, that is not visible but They  have an important impact on the result; these layer 2 of the network devices have many roles, including security issue like &lt;strong&gt;Span&lt;/strong&gt;, &lt;strong&gt;Tap&lt;/strong&gt;, &lt;strong&gt;deep packet inspection&lt;/strong&gt; or any other security usage or just a &lt;strong&gt;layer 2 switche&lt;/strong&gt;. You can see some hop counts in the traceroute results, but there are certainly many L2 devices in the middle and I am looking for theory or practical way to find an answer to this question. &lt;/p&gt;&#xA;" OwnerUserId="30070" LastEditorUserId="30070" LastEditDate="2019-06-11T10:58:58.863" LastActivityDate="2019-06-11T13:16:26.997" Title="How can we identify layer two device in a network or what are those device effects on a frame" Tags="|routing|switch|security|layer2|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="34453" PostTypeId="2" ParentId="34452" CreationDate="2016-08-29T09:53:43.203" Score="6" Body="&lt;p&gt;Traceroute is a Layer3 technology, aka. by it's very design it'll never show anything else than the routers in path to the specific host. Traceroute works by sending packets with decreasing TTL, thus making every router in the path respond with a message say that the TTL value has been exceeded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches live in L2, so they have no concept about what's in the frames containing the traceroute packets, they just forward them appropriately so that they reach the correct next hop router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPS:es are usually also designed so that they sit out of band, and only extract packets that they don't like. As such, they will never respond with anything to a host sending the packets, they just drop the packets if they match a specific filter rule. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastEditorUserId="36720" LastEditDate="2019-06-11T06:22:52.387" LastActivityDate="2019-06-11T06:22:52.387" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="34454" PostTypeId="1" CreationDate="2016-08-29T10:14:00.903" Score="3" ViewCount="1779" Body="&lt;p&gt;I hope you can help me with this problem...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm have installed 2 Juniper Switch EX3300 for my DC, the link from coreswitch to Switch no 1 (using FO) is fine...they working normally, but from switch no 1 to no 2 is not working. the connection between core switch no 1 and no 2 is using 10GE SFP+ SR.&#xA;I've already try to switch from 1 slot to another slot (there's 4 slot sfp), either than the SFP. Can anyone please help me...&lt;/p&gt;&#xA;" OwnerUserId="30072" LastEditorUserId="22692" LastEditDate="2016-08-31T13:50:19.970" LastActivityDate="2021-12-08T14:21:21.743" Title="SFP+ on Juniper EX3300" Tags="|switch|juniper|sfp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34456" PostTypeId="2" ParentId="34443" CreationDate="2016-08-29T11:25:27.833" Score="0" Body="&lt;p&gt;You can do this by using of different tcp ports. you should configure your router with port forwarding like below:&#xA; ftp1.example.com:3000   ----&gt; 10.0.0.1&#xA; ftp2.example.com:3001   ----&gt; 10.0.0.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have cisco router you can use of NAT Outside.&#xA;If you have DSL modem router you should find the port forwarding section and create those rules.&lt;/p&gt;&#xA;" OwnerUserId="30073" LastActivityDate="2016-08-29T11:25:27.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34459" PostTypeId="2" ParentId="34454" CreationDate="2016-08-29T11:43:47.773" Score="-1" Body="&lt;p&gt;The 10G SFPs needs to be Juniper compatible. &#xA;Check if the SFP are registred by the switch with the &quot;show chassis hardware&quot; command.&#xA;If they are compatible, you need to eliminate any potential hardware issues with the 10G SFPs or damage to the optical cable/ODF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a fiber optical cable, make a loop in each SFP and see if there is link.&#xA;If not, then you have a problem with one of the SFPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using a ODF, make a loop in one end and see if there is link.&#xA;If not, then you have a problem with the optical cable/ODF.&lt;/p&gt;&#xA;" OwnerUserId="13421" LastActivityDate="2016-08-29T11:43:47.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34460" PostTypeId="2" ParentId="34295" CreationDate="2016-08-29T12:03:02.630" Score="0" Body="&lt;p&gt;@hertitu: I didn't see any differences between the faulty and the working certs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally we have performed an IOS upgrade ( to c1841-advsecurityk9-mz.124-15.T17.bin ) and this solved our problem. &lt;/p&gt;&#xA;" OwnerUserId="16778" LastActivityDate="2016-08-29T12:03:02.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34464" PostTypeId="2" ParentId="32172" CreationDate="2016-08-29T14:19:12.877" Score="2" Body="&lt;p&gt;Posting your configuration would be quite helpful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most likely you need to enable inter-vlan routing and create an SVI for both VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once they have a layer 3 interface to route through you should be able to talk between VLANs just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not familiar with that particular switch, but for most IOS devices inter-vlan routing is enabled by default and all you will need to do is create the SVIs (for both 192.168.1.X and 192.168.2.X)&lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2016-08-29T14:19:12.877" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34465" PostTypeId="1" AcceptedAnswerId="34608" CreationDate="2016-08-29T14:26:44.407" Score="2" ViewCount="89" Body="&lt;p&gt;We've been trying to set up a network of WiFi access points at our organization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current set-up is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 access points connected to a network controller via a switch.&#xA;The APs have radios enabled for 2.4GHz and 5GHz frequencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The access points are HP 525-WW devices. The controller is an HP 850.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, whenever we connect another AP to the switch, with an enabled and configured radio, the whole network dies, including both WiFi and wired connections to the controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The access points all reboot, start initialising, then flash the LED indicating an error with the radio, and after a few seconds start initialising again, then indicate radio error, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the new AP is disconnected, everything goes back to normal after a few seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not a network engineer, just a system administrator, so I'm not overly familiar with network engineering. We've been trying to resolve this issue for days, but have been unable to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can provide any extra information if needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 1: On further testing, adding a new AP works when connected directly to a switch, but fails as described when connected via a PoE adapter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2: Device models - Switch: HP-2530-8G-PoEP; Adapter: Powerdsine 3001G&lt;/p&gt;&#xA;" OwnerUserId="30081" LastEditorUserId="30081" LastEditDate="2016-08-30T08:52:23.770" LastActivityDate="2016-09-04T16:31:53.197" Title="Internet connection dies when new AP is connected" Tags="|wireless|hp|access-point|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="34466" PostTypeId="1" AcceptedAnswerId="34475" CreationDate="2016-08-29T14:28:54.903" Score="13" ViewCount="5862" Body="&lt;p&gt;In exploring how my local openVPN virtual interface &lt;code&gt;utun0&lt;/code&gt; works, I came across the following data, and I don't know how to make sense of it. (I'm on a Mac)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ netstat -nr&#xA;Routing tables&#xA;&#xA;Internet:&#xA;Destination        Gateway            Flags        Refs      Use   Netif Expire&#xA;0/1                10.8.0.5           UGSc           61        0   utun0&#xA;default            192.168.7.254      UGSc            7        0     en0&#xA;10.8.0.1/32        10.8.0.5           UGSc            1        0   utun0&#xA;10.8.0.5           10.8.0.6           UHr           110       12   utun0&#xA;54.242.164.191/32  192.168.7.254      UGSc            2        0     en0&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It looks like &quot;0/1&quot; is CIDR notation. Is that correct? If so, I have follow up questions. From my understanding, an interface is chosen according to which subnet(s) match the destination ip. With 0/1, only ip addresses whose first bit is 0 would match -- which means only ip address &gt;= 128.0.0.0 would match. Is that true? I could believe that except then I get this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ip route get 8.8.8.8&#xA;8.8.8.8 via 10.8.0.5 dev utun0  src 10.8.0.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So now I'm really confused what &quot;0/1&quot; means and why that route trumps the default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;0/1 would actually mean anything &amp;lt; 128.0.0.0, however, I still get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ip route get 198.41.208.137&#xA;198.41.208.137 via 10.8.0.5 dev utun0  src 10.8.0.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So ip addresses both greater and lesser than 128.0.0.0 go through the router. How? Why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do see a 128/1 as well:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ netstat -nr&#xA;Routing tables&#xA;&#xA;Internet:&#xA;Destination        Gateway            Flags        Refs      Use   Netif Expire&#xA;0/1                10.8.0.5           UGSc           63        0   utun0&#xA;default            192.168.7.254      UGSc            5        0     en0&#xA;...&#xA;128.0/1            10.8.0.5           UGSc           42        0   utun0&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So @Teun Vink seems to be correct.&lt;/p&gt;&#xA;" OwnerUserId="30082" LastEditorUserId="30082" LastEditDate="2016-08-29T19:15:46.220" LastActivityDate="2020-06-08T03:06:53.030" Title="netstat -nr returning &quot;0/1&quot; -- what does that mean?" Tags="|routing|vpn|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34467" PostTypeId="2" ParentId="34349" CreationDate="2016-08-29T14:47:33.387" Score="0" Body="&lt;p&gt;it is all about &lt;strong&gt;&lt;em&gt;ROUTE&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;REVERSE ROUTE&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3bCW7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3bCW7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@ &lt;strong&gt;&lt;em&gt;router A&lt;/em&gt;&lt;/strong&gt;   &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;you should be able to ping ISP and ROUTER B  &lt;/li&gt;&#xA;&lt;li&gt;you need default route to access ISP resources in form of&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;&lt;code&gt;ip route 0.0.0.0  0.0.0.0 X.X.X.X&amp;lt;isp ip&amp;gt;&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;you must has route to reach network behind router B&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;&lt;code&gt;ip route 192.168.16.0 255.255.255.0 192.168.5.215&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;@ &lt;strong&gt;&lt;em&gt;router B&lt;/em&gt;&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;you should be able to ping  ROUTER A&lt;/li&gt;&#xA;&lt;li&gt;you need  default route to access what is behind Router A in form of&lt;br&gt;&#xA;&lt;strong&gt;&lt;em&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.5.1&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-08-29T14:47:33.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34470" PostTypeId="1" AcceptedAnswerId="34471" CreationDate="2016-08-29T16:40:17.937" Score="1" ViewCount="350" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oI4rC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oI4rC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;Assume we have 2 switches connected back to back with 2 links as shown below:&#xA;Please see the attached image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In traditional STP environment,one link will be blocked to avoid Layer2 loops.&#xA;So Etherchannel comes to rescue.Etherchannel is used to avail maximum bandwidth  and avoid STP loops.This is because STP treats etherchannel as a single port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1: I have seen a discussion saying only 1 BPDU per etherchannel is sent. This BPDU represents the link from the bundle whichever comes UP first. Is this understanding correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:How does this prevent loop? I mean, what actual change results in loop avoidance.I know that this is logically like a single link. But what is actually happening at hardware level that prevents loops?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3: Etherchannel uses hashing and XOR to choose the link which is used to forward traffic at given time.So, at the end of the day ONLY ONE LINK IS USED AT ANY GIVEN TIME(same thing happens in STP also, though witha little delay)...so how does it actually make use of the bandwidth of all links? For sure, all links cannot be used SIMULTANEOUSLY&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q4: Moving to the advanced etherchannel( i mean vPC) where the uplinks go to 2 different devices.&#xA;I know that VPC secondary replicates the BPDUs of the VPC primary. What i intend to understand is how this is avoiding layer 2 loops. The downstream switch(having the traditional etherchannel) will send only 1 BPDU. However, the upstream Primary and upStream Secondary both will send the same BPDU--is that correct? How will this avoid loop?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2016-08-29T17:21:47.290" LastActivityDate="2016-08-29T17:58:14.440" Title="Etherchannel Basics" Tags="|lan|switching|spanning-tree|etherchannel|vpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34471" PostTypeId="2" ParentId="34470" CreationDate="2016-08-29T17:58:14.440" Score="2" Body="&lt;p&gt;Q1:  The primary device in the VPC pair is the only device in the VPC pair that can send, receive or respond to BPDUs.  As such the secondary device will only forward them along to their destination.  So whichever device is primary will handle the BPDU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:  I have no idea, but will research and see if I can find anything about what happens at the hardware level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3:  Not quite accurate.  All of the ports in an etherchannel are used when sending and receiving data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;EtherChannel aggregates the traffic across all the available active ports in the channel. The port is selected using a Cisco-proprietary hash algorithm, based on source or destination MAC addresses, IP addresses or TCP and UDP port numbers. The hash function gives a number between 0 and 7, and the following table shows how the 8 numbers are distributed among the 2 to 8 physical ports. In the hypothesis of real random hash algorithm, 2, 4 or 8 ports configurations lead to fair load-balancing, whereas other configurations lead to unfair load-balancing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;number of ports |  load balancing ratio&lt;/p&gt;&#xA;&#xA;&lt;p&gt;8   1:1:1:1:1:1:1:1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7   2:1:1:1:1:1:1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6   2:2:1:1:1:1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5   2:2:2:1:1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4   2:2:2:2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3   3:3:2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2   4:4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Wikipedia-&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, the hash is generated and then that hash (0-7) determines which port it goes through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other ways to load-balance a port channel (src-mac, dst-mac, src-ip, dst-ip, etc...etc...)  Which one will work best depends upon your exact setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q4:  In a VPC only the primary device can send or process BPDUs.  Any that are received by the secondary device are forwarded to the primary device for analysis and response.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that helped answer your questions.  The &lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2016-08-29T17:58:14.440" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34473" PostTypeId="2" ParentId="34454" CreationDate="2016-08-29T18:54:47.637" Score="0" Body="&lt;p&gt;If I understood well switch number 2 is also connected to the coreswitch, right? If so maybe you have a spanning tree loop and the connection between those two EX3300 is being blocked.&lt;br&gt;&#xA;&lt;a href=&quot;https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB22774&amp;amp;actp=search&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; is a good guide from Juniper to troubleshoot spanning tree protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also use the command &lt;code&gt;show interfaces diagnostics optics xe-x/y/z&lt;/code&gt; in each switch and check the &lt;code&gt;Receiver signal average optical power&lt;/code&gt; for the interfaces that connect switch number 1 to switch number 2.&lt;/p&gt;&#xA;" OwnerUserId="22515" LastActivityDate="2016-08-29T18:54:47.637" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34474" PostTypeId="2" ParentId="34466" CreationDate="2016-08-29T18:57:49.227" Score="2" Body="&lt;p&gt;The first bit is for the netmask not for the address, this route mean all IP starting from 0.0.0.0 with netmask 128.0.0.0 &#xA;so  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Network:   0.0.0.0/1            0 0000000.00000000.00000000.00000000&#xA;HostMin:   0.0.0.1              0 0000000.00000000.00000000.00000001&#xA;HostMax:   127.255.255.254      0 1111111.11111111.11111111.11111110&#xA;&#xA;Network:   128.0.0.0/1          1 0000000.00000000.00000000.00000000&#xA;HostMin:   128.0.0.1            1 0000000.00000000.00000000.00000001&#xA;HostMax:   255.255.255.254      1 1111111.11111111.11111111.11111110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the routing daemon take the biggest netmask it knows to select the best route. So whenever you have a default route, you always have another route with biggest netmask using 2 net with /1 netmask&lt;/p&gt;&#xA;" OwnerUserId="30090" LastEditorUserId="30090" LastEditDate="2020-06-08T03:06:53.030" LastActivityDate="2020-06-08T03:06:53.030" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="34475" PostTypeId="2" ParentId="34466" CreationDate="2016-08-29T19:00:42.753" Score="15" Body="&lt;p&gt;Some VPNs push the default gateway (a /0 netmask) as two /1 networks: 0/1 and 128/1. Since a more specific route always wins, this forces traffic to be routed via the VPN instead of over the default gateway.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-08-29T19:00:42.753" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34476" PostTypeId="2" ParentId="30770" CreationDate="2016-08-29T19:56:15.203" Score="4" Body="&lt;p&gt;Junos Olive is an unofficial and unsupported image/version that was developed by Juniper for development purposes.&lt;br&gt;&#xA;As for the vMX, it's &quot;a full-featured, virtualized MX Series 3D Universal Edge Router&quot; (quote from Juniper). It's an official and supported product that allows the usage of a virtualized MX router in a cloud/virtual network environment. As such, all the features/commands that are available for a physical MX router are available in vMX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Junos Olive was never built to be a fully working version while vMX was. If you need some of the missing features from Olive (or a more updated version of Junos), vMX is a good solution (but you'll need an hypervisor to install it). Otherwise Olive should be good enough.&lt;/p&gt;&#xA;" OwnerUserId="22515" LastActivityDate="2016-08-29T19:56:15.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34482" PostTypeId="2" ParentId="1067" CreationDate="2016-08-30T09:16:25.500" Score="0" Body="&lt;p&gt;OpenVPN has a spoke layout, so all communication would need to route through the main server. Tinc-VPN can do routing between different sites.&#xA;You can read this blog:&#xA;&lt;a href=&quot;http://www.allsundry.com/2011/04/10/tinc-better-than-openvpn/&quot; rel=&quot;nofollow&quot;&gt;http://www.allsundry.com/2011/04/10/tinc-better-than-openvpn/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30101" LastActivityDate="2016-08-30T09:16:25.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34483" PostTypeId="1" CreationDate="2016-08-30T11:02:04.557" Score="1" ViewCount="1459" Body="&lt;p&gt;I've got quagga running on Slackware 14.2, kernel 4.4.7, (quagga-1.0.20160315 build from sources). Quagga fails to update route when path dissappears.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, that route is wrong and it was previously created by quagga:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;94.246.185.0/24 via 94.246.185.42 dev eth3.2224  proto zebra  metric 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As I understand, quagga has information about correct path, but ignores it because there's already route in kernel table...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bgp# show ip bgp 94.74.72.0/24&#xA;BGP routing table entry for 94.74.72.0/24&#xA;Paths: (2 available, best #2, table Default-IP-Routing-Table)&#xA;  Not advertised to any peer&#xA;  12741 1299 7713 45470 45470 50935&#xA;    213.17.213.97 from 213.17.213.97 (83.238.252.171)&#xA;      Origin IGP, localpref 100, valid, external&#xA;      Community: 1299:37000 12741:21000 12741:21041&#xA;      Last update: Tue Aug 30 11:28:22 2016&#xA;&#xA;  9002 7713 45470 45470 50935&#xA;    87.245.245.89 from 87.245.245.89 (87.245.225.167)&#xA;      Origin IGP, localpref 100, valid, external, best&#xA;      Community: 9002:9002 9002:64789&#xA;      Last update: Tue Aug 30 11:27:55 201&#xA;&#xA;bgp# show ip route 94.74.72.0/24&#xA;Routing entry for 94.74.72.0/24&#xA;  Known via &quot;bgp&quot;, distance 20, metric 0, vrf 0&#xA;  Last update 01:22:43 ago&#xA;    87.245.245.89, via eth3.585&#xA;&#xA;Routing entry for 94.74.72.0/24&#xA;  Known via &quot;kernel&quot;, distance 0, metric 0, vrf 0, best, fib&#xA;  * 94.246.185.42, via eth3.2224&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this may be a bug in quagga or error in my configuration?&lt;/p&gt;&#xA;" OwnerUserId="28126" LastActivityDate="2018-05-03T02:31:27.380" Title="BGP quagga not deleting old routes" Tags="|bgp|quagga|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="34487" PostTypeId="2" ParentId="34276" CreationDate="2016-08-30T13:02:47.313" Score="2" Body="&lt;p&gt;I'll be trying an answer here, but it is a difficult subject.&lt;/p&gt;&#xA;&lt;p&gt;First I think we should note that 802.11ac traffic is not necessarily in MU-MIMO, as your title might suggest. Today this technology is still under test at the WiFi Alliance and there is &lt;a href=&quot;https://wikidevi.com/wiki/MU-MIMO&quot; rel=&quot;nofollow noreferrer&quot;&gt;no client device&lt;/a&gt; that implement it. Also, in 802.11ac, MU-MIMO is used only in a downlink context, thus it is really named DL-MU-MIMO.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Channel sounding and beamforming&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The AP sounds the channel the same way it does in SU-MIMO, using Null Data Packets sounding PPDUs (NDP for short).&lt;/p&gt;&#xA;&lt;p&gt;As &lt;a href=&quot;http://standards.ieee.org/about/get/802/802.11.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE Std 802.11ac-2013, 22.3.11&lt;/a&gt; says it, the AP uses DL-MU-MIMO beamforming to perform the transmission using different subsets of the same space-time streams:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;With SU-MIMO beamforming all space-time streams in the transmitted signal are intended for reception at a single STA.&lt;/p&gt;&#xA;&lt;p&gt;With DL-MU-MIMO beamforming, disjoint subsets of the space-time streams are intended for reception at different STAs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As in SU-MIMO beamforming, DL-MU-MIMO beamforming uses a steering matrix determined by beamformees feedback matrices that are sent to the beamformer (usually the AP). The feedback matrix consist in a local mesure of the channel using &amp;quot;training symbols&amp;quot; previously transmitted by the beamformer. The beamformee sends it in a compressed state to the beamformer, which continues the process by sending a &amp;quot;Beamforming Report Poll&amp;quot; to the next beamformee.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kp7fJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kp7fJ.png&quot; alt=&quot;802.11ac: A Survival Guide, Matthew S.Gast, O'Reilly ed.&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The steering matrix then provides the informations used to create the space-time streams in a way that it suppress crosstalk between participating beamformees. And the beamformee recreates its feedback matrix on each NDP sounding PPDU received.&lt;/p&gt;&#xA;&lt;p&gt;Once that is done:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The AP can create up to four A-MPDUs, each carrying MPDUs destined for an associated MU-capable STA. The AP then transmits the A-MPDUs simultaneously in separate space-time streams such that each recipient STA is able to demodulate the space-time streams carrying its A-MPDU.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Channel acquisition&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;There is no relation between MU-MIMO and RTS/CTS. The acquisition of the channel works the same way.&lt;/p&gt;&#xA;&lt;p&gt;In theory, the AP uses contention windows and if it fails and leads to retries, it uses RTS/CTS to secure the channel transmission as a way to ensure that all frames will be transmitted this time. In a practical context, the implementation is dependent of the chipset and might differ from the theory.&lt;/p&gt;&#xA;&lt;p&gt;Regardless and concerning your question, RTS/CTS is not station-dependent. &lt;em&gt;When the AP wants to transmit a frame over the full 80MHz of its channel, it sends a Non-HT (meaning a 802.11a) duplicated RTS frame across all four 20MHz channels, indicating that it would like to acquire the whole channel.&lt;/em&gt; Then, receivers of the RTS (every STA in the channels) do their own Clear Channel Assessments and, for each free channel, send CTS frames. Then the AP is able to take a decision based on the results.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vPE8Z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vPE8Z.png&quot; alt=&quot;802.11ac: A Survival Guide, Matthew S.Gast, O'Reilly ed.&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;In our context, that would mean both stations would send CTS frames. Then, the regular dynamic bandwidth process would be used to determinate the best bandwith available. If one of the stations cannot send any CTS frames (on any of the 4 20MHz channels), for example because of some interferences on the whole 80MHz bandwidth, the AP would defer its transmission until the channel is newly free (or it might change channel if a real-time auto channel selection mechanism is implemented, allowing the transmission to be carried on). In the end the dynamic bandwidth process will select the best bandwith by taking in account all CTS frames received, but the transmission decision stays implementation-dependent.&lt;/p&gt;&#xA;&lt;p&gt;One last note: in the case of your network, there would likely be near to no point in using DL-MU-MIMO as your stations are almost out of range. MU-MIMO would be best used at low-range, eventually mid-range.&lt;/p&gt;&#xA;&lt;p&gt;Sources:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;a href=&quot;http://standards.ieee.org/about/get/802/802.11.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE Std 802.11ac-2013&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The pictures and some sentences are directly taken from &lt;em&gt;802.11ac: A Survival Guide, Matthew S.Gast, O'Reilly ed.&lt;/em&gt;. I invite you to buy it as it really better than the standard to understand how .11ac works.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="28361" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-05-09T09:11:41.747" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="34488" PostTypeId="2" ParentId="27985" CreationDate="2016-08-30T13:32:15.440" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;Download the license pack file that you received from Cisco &amp;lt;&lt;strong&gt;&lt;em&gt;L-DCNM-L-N5K-K9=&lt;/em&gt;&lt;/strong&gt;&gt; into a directory on the server system.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Copy the license file into INSTALL_DIR/dcnm/licenses directory. On a&#xA;  Microsoft Windows system, the default INSTALL_DIR value is C:\Program&#xA;  Files\Ciscoystems.Add License File.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;You can view the existing Cisco DCNM licenses.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Start the License Wizard by choosing Admin &gt; License&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Adding Cisco DCNM Licenses&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Step 1 Start the License Wizard by choosing Admin &gt; License.&lt;br&gt;&#xA;  Step 2 Click on the Server License File tab.&lt;br&gt;&#xA;  Step 3 Click Add License File.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Assigning Licenses   &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Step 1 Start the License Wizard by choosing Admin &gt; License.&lt;br&gt;&#xA;  Step 2 From the table, select the switch that you want to assign the license to&lt;br&gt;&#xA;  Step 3 Click Assign License.  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;also you can make use of this link &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/6_x/dcnm/installation/published/install/licensing_DCNM.html#35007&quot; rel=&quot;nofollow&quot;&gt;Installing and Managing Licenses for Cisco Data Center Network Manager&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-08-30T13:32:15.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34490" PostTypeId="1" AcceptedAnswerId="34491" CreationDate="2016-08-30T14:37:00.043" Score="3" ViewCount="14383" Body="&lt;p&gt;I just happened to buy a lot of CAT6a STP cable and shielded CAT6a RJ45 keystone modules for wall outlets. I understand it was completely unnecessary to buy this kind of stuff, but it is too late...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an 1 Gbps modem (actually combined modem and router) and 1Gbps integrated ethernet in the motherboards of the PCs and who knows what in the smart TVs. The modem plug does not have grounding. How can I ground the shielding of the STP cable? Is it necessary to ground it?&lt;/p&gt;&#xA;" OwnerUserId="30114" LastEditorUserId="8499" LastEditDate="2016-08-30T14:39:09.433" LastActivityDate="2016-08-30T15:07:36.897" Title="How to ground STP cable?" Tags="|cabling|layer1|" AnswerCount="1" CommentCount="4" ClosedDate="2016-08-30T15:15:27.120" ContentLicense="CC BY-SA 3.0" />
  <row Id="34491" PostTypeId="2" ParentId="34490" CreationDate="2016-08-30T15:07:36.897" Score="3" Body="&lt;p&gt;sure ,there is no necessary to ground it ,it can work just like normal UTP ,by the way There are a number of reasons you don't use shielded cable in the home environments  ,Technically it should be grounded at one point (the patch panel) using a copper bus bar that attaches to vertically buried 6 foot long copper rod via at least a 6 gauge cable, isolated from the electrical system ground.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Don't use the ground pins in the outlets. You will likely cause a&#xA;  grounding  loop which will give you more noise (and possibly a 'ground&#xA;  short' which can cause a fire) than running unshielded cable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-08-30T15:07:36.897" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34493" PostTypeId="1" AcceptedAnswerId="43085" CreationDate="2016-08-30T15:42:22.493" Score="1" ViewCount="2468" Body="&lt;p&gt;What is the exact difference between these two values in RSTP and what values it can hold. How is the switch's behavior changes as these values are changed.&lt;/p&gt;&#xA;" OwnerUserId="24153" LastActivityDate="2017-08-08T08:07:41.743" Title="What is the difference between message age and maximum age in STP" Tags="|ethernet|spanning-tree|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34494" PostTypeId="2" ParentId="21151" CreationDate="2016-08-30T16:04:31.053" Score="2" Body="&lt;p&gt;This type of parameter can be set on both type of devices. The difference is that most of the time, if it is set on a station, it will only affect this particular station, while if it is set on the AP, it will affect every connected station.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, certain parameters, like Greenfield, can be set on a station and will impact the whole network if the AP is set to allow it (Greenfield was a technology designed to improve speed on 802.11n networks, but it also prevents non-greenfield stations to listen to the traffic).&lt;/p&gt;&#xA;" OwnerUserId="28361" LastActivityDate="2016-08-30T16:04:31.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34495" PostTypeId="2" ParentId="9389" CreationDate="2016-08-30T16:46:40.337" Score="-1" Body="&lt;p&gt;I had the same problem. The answer that said to connect the main ethernet to the phone, and connect the phone &quot;PC&quot; port to your non-PoE switch and distribute to the rest of your PCs worked for me, thanks!&lt;/p&gt;&#xA;" OwnerUserId="30118" LastActivityDate="2016-08-30T16:46:40.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34497" PostTypeId="1" AcceptedAnswerId="34498" CreationDate="2016-08-30T17:14:29.217" Score="1" ViewCount="3025" Body="&lt;p&gt;I have seen quite a few discussions regarding MPLS stating things like:&#xA;MPLS combines the performance and capabilities of Layer 2 (data link layer) switching with the proven scalability of Layer 3 (network layer) routing.&#xA;Additionally, i have also heard technical discussions around switching vs routing.&#xA;They say switching is faster than routing.I have the below questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1: Is switching actually faster than routing? If so, how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:Hardware is faster than software.Is that true ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3:I know that derivations of CEF,Fast switching are made using above concepts.&#xA;How does this actually fit in ? I read the differences b/w CEF,Fast Switching and Process Switching, but i could not get a clear cut picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q4: How is MPLS taking advantage of the switching vs routing speeds?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="8499" LastEditDate="2018-12-21T04:47:10.790" LastActivityDate="2018-12-21T04:47:10.790" Title="Switching vs Routing" Tags="|routing|switching|layer2|layer3|cef|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34498" PostTypeId="2" ParentId="34497" CreationDate="2016-08-30T17:44:25.817" Score="3" Body="&lt;p&gt;Don't equate marketing literature with technical discussions :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me answer your second question first:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware is faster than software, in practically all cases.  When we say &quot;hardware,&quot; we mean devices that are purposely designed to forward packets as fast as possible. The usual limitation is the physical properties of the integrated circuit technology.  Software, on the other hand, uses a general purpose processor that has to perform several operations in order to forward a packet (read data, move it to another part of memory, perform some calculations, move it again, etc).  This is generally significantly slower that hardware-based systems.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switching vs. routing debate is largely moot in modern networks.  Once upon a time, routers did their forwarding in software, but modern enterprise routers use  hardware and software in combination to forward packets at line rate - that is, as fast as they are received. So essentially, there is no difference between routing and switching.  That is one reason you will see the term &quot;layer 3 switches&quot; used.  It's partly a marketing effort to make them &quot;sound&quot; faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions about CEF, fast, and process switching have been asked and answered here already, so I won't repeat them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So your last question assumes there is a major difference between routing and switching -- but as you can see, there isn't any longer.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-08-30T17:44:25.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34500" PostTypeId="1" AcceptedAnswerId="43273" CreationDate="2016-08-30T19:41:05.077" Score="1" ViewCount="197" Body="&lt;p&gt;We've recently applied a new modification to our network config.&#xA;Separating two SSIDs into a guest \ corporate split config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;All of the VLAN and DHCP scopes are functioning in the way it was designed but we're having problems with wireless performance and latency.&lt;/strong&gt; *The wired network is unaffected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, Wireshark is showing a pile of the following entries:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--TCP Dup ACK&#xA;--TCP ACKed unseen segment&#xA;--TCP Previous segment not captured&#xA;--TCP Retransmission&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Pings from wireless devices run in a repeatable procession to LAN and WAN addresses alike:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Reply from *.*.*.* time=3ms&#xA;Reply from *.*.*.* time=2ms&#xA;Reply from *.*.*.* time=3000ms&#xA;no response&#xA;Rinse and Repeat&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TrendNet WAP -- TEW-753DAP CONFIG&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Uplink port &amp;gt; Cisco GigabitEthernet1/0/22 (Trunk)&#xA;Spanning Tree Disabled on Trunk Uplink and WAP Uplink interfaces&#xA;--SSID 1 = VLAN100 | Devices connected to SSID1 retreive DHCP from a Sonicwall scope assigned to VLAN100&#xA;--SSID 2 = VLAN200 | Devices connected to SSID2 retreive DHCP from a Sonicwall scope assigned to VLAN200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The traffic from these SSID VLANs is isolated from one another to keep LAN and WAN traffic separated.&#xA;*VLAN100's gateway defaults to a secondary failover WAN.&#xA;*VLAN200's gateway defaults to the corporate WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*VLAN200 is able to communicate directly with non-tagged (wired) corporate traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CISCO 2960s Config&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ws-c2960s-24ps-l&#xA;!&#xA;!&#xA;ip domain-name *******&#xA;vtp mode transparent&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;vlan 2&#xA; name VoIP&#xA;vlan 10&#xA; name management&#xA;!&#xA;vlan 100&#xA; name Guest-WVLAN&#xA;!&#xA;vlan 200&#xA; name Corporate-WVLAN&#xA;!&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description (EdgeDevice)&#xA; switchport mode access&#xA; switchport voice vlan 2&#xA; spanning-tree portfast&#xA; spanning-tree bpduguard enable&#xA;&#xA;***********SAME INTERFACE CONFIG 1/0/1 -- 1/0/20***********&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/21&#xA; description (TRUNK ENABLED)&#xA; switchport mode trunk&#xA; shutdown&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/22&#xA; description (Uplink - TRUNK to WAP)&#xA; switchport mode trunk&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/23&#xA; description (TRUNK ENABLED)&#xA; switchport mode trunk&#xA; shutdown&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/24&#xA; description (Uplink - Trunk to Core Switch)&#xA; switchport mode trunk&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/25&#xA; description (Fiber - TRUNK ENABLED)&#xA; switchport mode trunk&#xA; shutdown&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/26&#xA; description (Fiber - TRUNK ENABLED)&#xA; switchport mode trunk&#xA; shutdown&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/27&#xA; description (Fiber - TRUNK ENABLED)&#xA; switchport mode trunk&#xA; shutdown&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/28&#xA; description (Fiber - TRUNK ENABLED)&#xA; switchport mode trunk&#xA; shutdown&#xA;!&#xA;!&#xA;interface Vlan1&#xA; ip address *.*.*.* 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; no ip address&#xA;!&#xA;interface Vlan10&#xA; ip address *.*.*.* 255.255.255.0&#xA;!&#xA;interface Vlan100&#xA; ip address *.*.*.* 255.255.255.0&#xA;!&#xA;interface Vlan200&#xA; ip address *.*.*.* 255.255.255.0&#xA;!&#xA;ip default-gateway *.*.*.*&#xA;!&#xA;!&#xA;logging trap debugging&#xA;logging host *.*.*.*&#xA;!&#xA;!&#xA;ntp server *.*.*.*&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30124" LastActivityDate="2017-08-15T13:12:04.310" Title="Cisco VLAN configurations with WAP - Poor performance" Tags="|cisco|vlan|spanning-tree|latency|trunk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34501" PostTypeId="2" ParentId="34500" CreationDate="2016-08-30T20:35:10.470" Score="2" Body="&lt;p&gt;The 2960s is an access switch with very limited L3 capabilities  and you really want the Layer 3 vlan interfaces (SVIs) on a better performing Layer 3 switch acting as your core where you can implement ACLs on the L3 SVIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After removing all the wireless SVIs in your 2960 switch modify the trunk interface to your wap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This part to your WAP needs a slight modification:-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;interface GigabitEthernet1/0/22&#xA; description (Uplink - TRUNK to WAP)&#xA; switchport mode trunk&#xA; switchport trunk native vlan ??&#xA; switch port trunk allowed vlan 100,200&#xA; spanning-tree portfast trunk&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not too sure how the trendnet is communicating with the switch over the trunk interface but this support page mentions it's administration is by default over PVID 1:-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.trendnet.com/support/view_faq_question.asp?ToDo=view&amp;amp;questId=2874&amp;amp;catId=695&amp;amp;iframe=true&quot; rel=&quot;nofollow&quot;&gt;http://www.trendnet.com/support/view_faq_question.asp?ToDo=view&amp;amp;questId=2874&amp;amp;catId=695&amp;amp;iframe=true&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not too sure how you've configured your WAPs to broadcast on the channels and how many you have deployed but you could post your infrastructure here for everyone to help.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2016-08-30T20:35:10.470" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34503" PostTypeId="2" ParentId="34497" CreationDate="2016-08-31T03:12:49.330" Score="3" Body="&lt;p&gt;Since you have so many questions, I will explain the first one in details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, you should understand that routers have two main functions:&#xA;Forwarding pkt to destination (IP address)&#xA;Running routing protocol&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router refers to a device that generally performs its operations by software. While the main role of a switch is to transfer packet as fast as possible based on IP address, especially for the layer 3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Layer 3 switch, does it per hardware. It's usually and depending on the environment that you are. There are carrier grade routers that route packets using hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, routers provides features that are considered 'premium' in switches such as NAT, Firewall, BGP, VPN, MPLS, VPLS,... These things are really difficult to implement in hardware and that's why the carrier grade routers that implement these protocols are so expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum up, the case of use of a Switch and a router are different, although they are the same at a theoretical point of view. &lt;/p&gt;&#xA;" OwnerUserId="24835" LastActivityDate="2016-08-31T03:12:49.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34505" PostTypeId="1" CreationDate="2016-08-31T07:28:39.700" Score="0" ViewCount="1341" Body="&lt;p&gt;I'm going to buy a firewall.For the first step i must calculate my network throughput in Kpps.&#xA;I'm using Mikrotik routerOs. Mikrotik has bandwidth test that it shows traffic in Kbps.&#xA;How do I find my network throughput in Kpps?&lt;/p&gt;&#xA;" OwnerUserId="3985" LastEditorUserId="8499" LastEditDate="2018-02-14T16:18:11.930" LastActivityDate="2018-02-14T16:18:11.930" Title="How to calculate throughput in Kpps?" Tags="|router|firewall|bandwidth|throughput|" AnswerCount="1" CommentCount="0" ClosedDate="2016-12-21T00:23:32.130" ContentLicense="CC BY-SA 3.0" />
  <row Id="34507" PostTypeId="2" ParentId="34505" CreationDate="2016-08-31T08:10:55.273" Score="4" Body="&lt;p&gt;The bandwidth test will not help you properly determine your firewall needs, as it is only testing how much available bandwidth you have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Graphing either through RouterOS or through a third party system should be used to measure the actual amount of traffic being used over time. When purchasing a firewall you will want to determine all the metrics in making your decision, and how your use of features will change your baseline.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Graphing can be setup by navigating to your device in your web browser /graphs &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets per seconds is displayed in RouterOS as (P/s). This can also be viewed on a live basis under &quot;interfaces&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:Tools/Graphing&quot; rel=&quot;nofollow&quot;&gt;http://wiki.mikrotik.com/wiki/Manual:Tools/Graphing&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="14613" LastActivityDate="2016-08-31T08:10:55.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34508" PostTypeId="1" CreationDate="2016-08-31T08:55:39.493" Score="0" ViewCount="916" Body="&lt;p&gt;I have been planning to set up a wireless network in my room. But due to old cables installation. I couldn't do it. So I thought of an idea of combining two rj11 port into one rj45 port. Is it possible? If its yes, how would be the connection speed? I think the old cable installation most probably cat3. Thank you&lt;/p&gt;&#xA;" OwnerDisplayName="user30138" LastEditorUserId="8499" LastEditDate="2016-08-31T13:55:42.577" LastActivityDate="2017-12-25T08:47:50.710" Title="Can two 4P4C rj11 socket turned into one rj45 socket?" Tags="|cabling|cable|layer1|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34510" PostTypeId="2" ParentId="34508" CreationDate="2016-08-31T12:23:05.967" Score="0" Body="&lt;p&gt;For ethernet, you need at least 2 pairs of copper wires. Either one of your cables should have that, so you shouldn't need to use two cables. If your cable is indeed cat3, it should support 10BASE-T Ethernet, which would give you 10 MB/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to try, you'll need the rj45 connectors and a crimping tool. Then connect both ends using the four wires on the pins 1, 2, 3 and 6 (the numbers should be printed on the rj45 connector or on the manual for that) and you are ready to try it out.&lt;/p&gt;&#xA;" OwnerUserId="23741" LastActivityDate="2016-08-31T12:23:05.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34511" PostTypeId="1" CreationDate="2016-08-31T17:57:32.663" Score="1" ViewCount="716" Body="&lt;p&gt;We are seeing TCP connections sporadically fail to establish, when a bandwidth limiter is placed on the network regardless of whether the limit is being hit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are links to some packet captures which demonstrate this, when connecting to an arbitrary TCP service. One capture shows a working connection and the other a failed connection. There are also two of a failed connection, taken from client and server side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The service seems irrelevant here - we've tried connecting to different TCP services on the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The captures show the server sending a RST to the client, after it has received the ACK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is causing the server to send the RST, in the failed example?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PCAP links are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Working: &lt;a href=&quot;http://phil.lavin.me.uk/downloads/pcaps/working.pcap&quot; rel=&quot;nofollow&quot;&gt;http://phil.lavin.me.uk/downloads/pcaps/working.pcap&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Failed: &lt;a href=&quot;http://phil.lavin.me.uk/downloads/pcaps/failed.pcap&quot; rel=&quot;nofollow&quot;&gt;http://phil.lavin.me.uk/downloads/pcaps/failed.pcap&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;By request, here is a pcap taken on both client and server during a single failed connection:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Client: &lt;a href=&quot;http://phil.lavin.me.uk/downloads/pcaps/client.pcap&quot; rel=&quot;nofollow&quot;&gt;http://phil.lavin.me.uk/downloads/pcaps/client.pcap&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;Server: &lt;a href=&quot;http://phil.lavin.me.uk/downloads/pcaps/server.pcap&quot; rel=&quot;nofollow&quot;&gt;http://phil.lavin.me.uk/downloads/pcaps/server.pcap&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="30148" LastEditorUserId="30148" LastEditDate="2016-09-02T16:51:55.527" LastActivityDate="2016-09-02T16:51:55.527" Title="TCP: RST after ACK when limiter is in place" Tags="|tcp|" AnswerCount="0" CommentCount="10" ClosedDate="2020-12-21T18:29:35.637" ContentLicense="CC BY-SA 3.0" />
  <row Id="34512" PostTypeId="1" AcceptedAnswerId="34520" CreationDate="2016-08-31T19:40:07.033" Score="3" ViewCount="6728" Body="&lt;p&gt;I have never had to use hairpinning in the past and so far, reading &lt;a href=&quot;https://en.m.wikipedia.org/wiki/Hairpinning&quot; rel=&quot;nofollow&quot;&gt;its description on Wikipedia&lt;/a&gt;, I don't see many use cases for this technology, apart from some requests from selected users inside the network who would like to use some P2P application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the common, practical use cases for hairpinning?&lt;/p&gt;&#xA;" OwnerUserId="15586" LastActivityDate="2016-09-01T10:10:12.823" Title="How is harpinning (NAT loopback) used in practice?" Tags="|nat|loopback|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34513" PostTypeId="1" CreationDate="2016-08-31T19:56:31.703" Score="2" ViewCount="183" Body="&lt;pre&gt;&lt;code&gt;show int | i proto.*notconnect|proto.administratively down|Last in. [6-9]w|Last in.* [0-9][0-9]w|[0-9]y|disabled|Last input never, output never, output hang never&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to find out what ports we can disconnect. There are a lot of ports showing &quot;not connected&quot; with no activity but we have hundreds of switches and my boss is too afraid to pull cords unless were 100% sure its not in use. If anyone knows a great way I would love to hear it. I have been using sh int count | in 0 + 0 + 0 but I think that is just current packets in and out?&lt;/p&gt;&#xA;" OwnerUserId="29996" LastEditorUserId="8499" LastEditDate="2016-08-31T19:57:19.853" LastActivityDate="2017-10-27T03:00:21.293" Title="Can someone tell me how to make this show cmd work? (want to see what ports we can disconnect)" Tags="|cisco|cisco-commands|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34514" PostTypeId="2" ParentId="34513" CreationDate="2016-08-31T20:15:26.533" Score="0" Body="&lt;p&gt;Currently I'm using a PHP Script which polls the status of all ports + some extra infos like mac connected, etc. from all our cisco switches via snmp and saves this data into a mysql database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With some extra info from some arp tables you can get a great overview which port was in use by a certain end-device at a certain date / time and when a port was up the last time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe you could think of a similar solution for your company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution mentioned in the comment above is also a simple way to do the job if you need a quick solution.&lt;/p&gt;&#xA;" OwnerUserId="30152" LastActivityDate="2016-08-31T20:15:26.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34515" PostTypeId="1" CreationDate="2016-08-31T20:23:46.557" Score="1" ViewCount="434" Body="&lt;p&gt;I need to frequently bulk change administrator passwords as well as local admin users for over 30 SonicWALLS throughout my organization. Is there an easy way to do this either via GMS or the CLI?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other thought was maybe an LDAP server for users, and keeping the SonicWALL administrator password for each SonicWALL extremely limited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts?&lt;/p&gt;&#xA;" OwnerUserId="29920" LastActivityDate="2018-05-25T00:44:08.597" Title="How do I bulk change admin user passwords on my SonicWALL?" Tags="|sonicwall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34517" PostTypeId="1" AcceptedAnswerId="34519" CreationDate="2016-09-01T01:50:13.043" Score="1" ViewCount="5229" Body="&lt;p&gt;I am trying to prevent a Cisco 2911 router's IP address from appearing in an inbound traceroute. I have configured the line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip unreachables&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on the Internet-facing interface, and while this successfully prevents a response to a traceroute probe when the destination is the router itself, it does NOT prevent the router from showing up in a traceroute to hosts behind the router. I am desiring to prevent the router from showing up not only in the typical, standard ICMP traceroutes but also 'tcptraceroute' and anything else that would completely trace the route into the network and to the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am vaguely aware of some kind of access list configuration whereby one would block the ICMP unreachables (and others) and then apply it to the interface, with perhaps trusted hosts added as exceptions. If this is indeed the way to do this, how would I configure my Cisco?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone implemented something similar to this and, if so, how? If not, how would you propose to do this?&lt;/p&gt;&#xA;" OwnerUserId="27905" LastActivityDate="2017-01-11T10:38:34.993" Title="Preventing a Cisco router from appearing in a traceroute" Tags="|cisco|cisco-ios|security|traceroute|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34518" PostTypeId="2" ParentId="34515" CreationDate="2016-09-01T03:17:53.770" Score="1" Body="&lt;p&gt;Take the language that you prefer and write some script, eg, python, and install dependencies needed for ssh or telnet connections, this is your choice.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Firts at all you need to put the  sequences of commands on the exactly way as you will do it  manually. Begin from nothing, connection entablishment, authentication and then the pass change steps.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Test it&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If works, then create some kind of array were you can put all your IP address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Once you get that, write your new PASS into the code, create a repetitive structure, a loop, and put your code into it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then execute it&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17709" LastEditorUserId="17709" LastEditDate="2016-09-01T03:24:58.300" LastActivityDate="2016-09-01T03:24:58.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34519" PostTypeId="2" ParentId="34517" CreationDate="2016-09-01T05:11:52.143" Score="3" Body="&lt;p&gt;You don't block the icmp unreachables - which are sent by your router - but the inbound packets sent by the traceroute or other tool, that have a TTL (time to live) of 1.&#xA;See e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Guide to Harden Cisco IOS Devices&lt;/a&gt; - look for the section &quot;&#xA;Filter on TTL Value&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: corrected url&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: note that in that Cisco document the example filters everything with a TTL &amp;lt; 6. This way you also prevent the next 4 hops in your network to appear in the traceroute without having to add an ACL to those routers as well (assuming all traffic passes through the router you are configuring). Also note that the number 6 is just an arbitrary example, you should use a value based on the diameter of your network (maximum number of hops a packet might traverse within your network). An added benefit of this is that traceroute will still work within your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: Please note that as Brendan notes in the comments, some protocols like BGP, IGMP, ... may require you to make exemptions in the ACL as they use low TTL values.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-09-05T07:33:01.127" LastActivityDate="2016-09-05T07:33:01.127" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34520" PostTypeId="2" ParentId="34512" CreationDate="2016-09-01T07:06:56.450" Score="3" Body="&lt;p&gt;Nat loopback is useful when you have some DNS issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine that you host your own email server inside the network. You need to access it when you are in the office and when you are outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your mail client is configured to access it with the name &lt;code&gt;mail.example.com.&lt;/code&gt;&lt;br&gt;&#xA;If you don't use split DNS, for whatever reason, this name will always be resolved to the public IP address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without NAT loopback this server will not be accessible from the internal network because you try to access an internal ressource from an internal interface trough an external interface.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-09-01T07:06:56.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34521" PostTypeId="1" CreationDate="2016-09-01T07:17:46.013" Score="1" ViewCount="266" Body="&lt;p&gt;Let's suppose I am in the middle of the desert or some kind of jungle, and I have no 2G/GSM Signal. I would like to know if there is any civilian technology (that is or maybe isn't available to the general public) that would allow to have signal in this particular situation? Like some kind of portative cell tower?&lt;/p&gt;&#xA;" OwnerUserId="30162" LastEditorUserId="59085" LastEditDate="2019-11-10T04:27:23.050" LastActivityDate="2019-11-10T04:30:58.470" Title="For 2G/GSM networks, are there &quot;portable&quot; cell towers?" Tags="|mobile|gsm|" AnswerCount="3" CommentCount="9" ContentLicense="CC BY-SA 4.0" />
  <row Id="34522" PostTypeId="2" ParentId="34521" CreationDate="2016-09-01T07:47:43.257" Score="2" Body="&lt;p&gt;What you might be able to use is a kind of portable &lt;strong&gt;femtocell&lt;/strong&gt; but as &lt;a href=&quot;https://en.wikipedia.org/wiki/Femtocell&quot; rel=&quot;nofollow&quot;&gt;wikipedia&lt;/a&gt; explains this requires an internet connection so this would probably not help in your desert or jungle scenario (it's more targeted at e.g. basement offices). Theoretically I suppose you could hook it up to a satellite based internet connection, but you would also need to power both the femtocell and the satellite setup so you'd need big batteries or a generator, making it less portable. If this would work at all, as I can imagine that the lag on the satellite link might cause issues.&#xA;And if you're going to use satellite technology anyway then why not simply use a &lt;a href=&quot;https://en.wikipedia.org/wiki/Satellite_phone&quot; rel=&quot;nofollow&quot;&gt;satellite phone&lt;/a&gt; in the first place...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW this is purely theoretical, I do not have practical experience in this field so am curious to see any comment or other answers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: slightly off-topic as it's slightly larger in scope but perhaps still an interesting read is &lt;a href=&quot;http://www.cnet.com/news/phones-at-burning-man-can-you-hear-me-now/&quot; rel=&quot;nofollow&quot;&gt;this article about cellular service at Burning Man&lt;/a&gt; (an event in the Nevada desert) and the &lt;a href=&quot;http://openbts.sourceforge.net/FieldTest/&quot; rel=&quot;nofollow&quot;&gt;technical details&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-09-01T12:38:04.593" LastActivityDate="2016-09-01T12:38:04.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34524" PostTypeId="2" ParentId="34521" CreationDate="2016-09-01T09:13:36.287" Score="1" Body="&lt;p&gt;There are two sides to this technical and legal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the technical side the main question is how portable does it need to be? If a system mounted in the back of a SUV or pickup is acceptable then it's certainly doable. Man-portable may be tricker. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would need a mobile base station and something to power it. If you want to talk to the outside world you would need some kind of uplink (sattelite or possiblly short range microwave). If you want to receive incoming calls on your regular phone number then you would need a roaming agreement with your regular phone provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hardware to run a base station is available off the shelf. See for example &lt;a href=&quot;http://www.rangenetworks.com/products/&quot; rel=&quot;nofollow&quot;&gt;http://www.rangenetworks.com/products/&lt;/a&gt; . The software is available as open source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there is the legal side. Mobile phones operate on specific channels within specific bands. To operate legally is likely to require specific authorisation from your country's radio regulator and/or an existing cellular operator. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is some overlap between the 900 MHz US ham band and the cellular bands used in europe but I don't know if this overlap is sufficient to allow running a functional network. &lt;a href=&quot;http://n9xlc.blogspot.co.uk/2010/10/ham-radio-cellphone-network.html&quot; rel=&quot;nofollow&quot;&gt;http://n9xlc.blogspot.co.uk/2010/10/ham-radio-cellphone-network.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-01T09:13:36.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34525" PostTypeId="1" AcceptedAnswerId="34528" CreationDate="2016-09-01T09:51:21.610" Score="1" ViewCount="1335" Body="&lt;p&gt;Say I have the following Network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.1.0.0/23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first host of that network would be &lt;code&gt;10.10.0.1&lt;/code&gt; and the last host of the network would be &lt;code&gt;10.1.1.254&lt;/code&gt;.&#xA;The Network ID would be &lt;code&gt;10.1.0.0&lt;/code&gt; and the Broadcast would be &lt;code&gt;10.1.1.255&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now imagine I would subnet this network further into two &lt;code&gt;/24&lt;/code&gt; networks:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first network would reach from &lt;code&gt;10.1.0.0&lt;/code&gt;-&lt;code&gt;10.1.0.255&lt;/code&gt; and the second network would reach from &lt;code&gt;10.1.1.0&lt;/code&gt;-&lt;code&gt;10.1.1.255&lt;/code&gt;. So far so good. Yet, both of these /24 networks would still be part of that one larger &lt;code&gt;/23&lt;/code&gt; network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, both of these networks are subnets from the larger, &lt;code&gt;/23&lt;/code&gt; network. However, there inside this network is now a host ID and a broadcast, and I learned that these cannot be assigned to hosts, even though they would obviously be valid host addresses for the /23 network:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Network ID) = &lt;code&gt;10.1.1.0&lt;/code&gt; &#xA;(Broadcast) = &lt;code&gt;10.1.0.255&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How are such matters resolved? Does that mean that once a network is subnetted, it's not advisable to assign hosts to the original network at all?&#xA;Or am I having some kind of brainfart?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take for example the following configuration of hosts on a local link:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Host 1:&lt;/strong&gt;&#xA;IP: &lt;code&gt;10.1.0.1&lt;/code&gt;&#xA;SNM: &lt;code&gt;255.255.254.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Host 2:&lt;/strong&gt;&#xA;IP: &lt;code&gt;10.1.1.200&lt;/code&gt; SNM: &lt;code&gt;255.255.255.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my understanding, host 1 would still be able to reach host 2 (f.e. via ping), because host 2 is still in the same subnet as host 1. However, host 2 wouldn't be able to ping host 1 because the logical AND operation on the SNM would tell him to send these packets to the default gateway. As there is no default gateway configured. the ping fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if the configuration is like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Host 1:&lt;/strong&gt;&#xA;IP: &lt;code&gt;10.1.1.0&lt;/code&gt;&#xA;SNM: &lt;code&gt;255.255.254.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Host 2:&lt;/strong&gt;&#xA;IP: &lt;code&gt;10.1.1.200&lt;/code&gt; SNM: &lt;code&gt;255.255.255.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Host 1 would have a valid IP config for his own &lt;code&gt;/23&lt;/code&gt; net, but since he got assigned the network-ID of the smaller &lt;code&gt;/24&lt;/code&gt; net, would he still be able to ping host 2?&lt;/p&gt;&#xA;" OwnerUserId="15706" LastActivityDate="2016-09-01T11:26:51.240" Title="Subnetting: Network ID and Broadcast" Tags="|ip|subnet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34526" PostTypeId="2" ParentId="34512" CreationDate="2016-09-01T10:10:12.823" Score="1" Body="&lt;p&gt;There are two different situations to consider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One is where two hosts behind the same nat try to use STUN or similar to set up a peer to peer connection. This is useful for peer to peer applications. Esepecially in a double NAT secnario or where the NAT has multiple public IPs (many peer to peer applications.will try to connect using private IPs if two clients have the same public IP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other is when you have servers on your lan that you want to access from both inside and outside. You want to access these servers from both inside and outside. If your NAT allows the port forwards to loop back then you can just use the public IP everywhere. If it doesn't then you need to mess arround with split DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that some implementations may support one of these scenarios but not the other.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-01T10:10:12.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34527" PostTypeId="1" AcceptedAnswerId="34532" CreationDate="2016-09-01T10:28:14.497" Score="2" ViewCount="242" Body="&lt;p&gt;My question is : This subinterface has a Qos policy settings its speed to 800000 (800kbps)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i have an offered rate of only 19000 bps, why is there a drop rate of drop rate 3000 bps ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Service-policy output: MY_QOS_POLICY&#xA;    Class-map: class-default (match-any)  &#xA;      744825 packets, 268874044 bytes&#xA;      30 second offered rate 19000 bps, drop rate 3000 bps&#xA;      Match: any &#xA;      Queueing&#xA;      queue limit 64 packets&#xA;      (queue depth/total drops/no-buffer drops) 0/0/0&#xA;      (pkts output/bytes output) 719286/245460560&#xA;      shape (average) cir 800000, bc 3200, be 3200&#xA;      target shape rate 800000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8109" LastEditorUserId="19787" LastEditDate="2016-10-11T19:50:30.167" LastActivityDate="2016-10-11T19:50:30.167" Title="Qos Packet drops" Tags="|cisco|qos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34528" PostTypeId="2" ParentId="34525" CreationDate="2016-09-01T11:26:51.240" Score="3" Body="&lt;p&gt;I think your confusion starts here:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Yet, both of these /24 networks would still be part of that one larger&#xA;  /23 network.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no longer a /23 network, because you have divided it into two /24s.  You can summarize the two /24s as a /23, but the /23 subnet no longer exists as a subnet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, you don't have some hosts with a /23 mask, and others with a /24 mask.  All your hosts will be on one or the other of the /24s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have also discovered a (small) drawback to subnetting:  as you divide networks into smaller and smaller subnets, you lose space to network and broadcast addresses.  If you take a /24 and divide it into /30's, you will lose half of the available address space.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-01T11:26:51.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34529" PostTypeId="2" ParentId="34517" CreationDate="2016-09-01T11:45:51.233" Score="1" Body="&lt;p&gt;You will need to block the ICMP &quot;time-exceeded&quot; messages in order to keep the router from showing up in traceroute output.&lt;/p&gt;&#xA;" OwnerUserId="30169" LastActivityDate="2016-09-01T11:45:51.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34530" PostTypeId="1" AcceptedAnswerId="34545" CreationDate="2016-09-01T12:31:54.963" Score="1" ViewCount="1399" Body="&lt;p&gt;In one of our plants, we've got an issue with the SFP, where we are not able connect two 2960s via a Fiber Link.&#xA;My question is: are there any configation options, that can prevent the link to go up? (except media-type RJ-45) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="22574" LastActivityDate="2016-09-02T03:01:28.087" Title="SFP Modules Troubleshooting" Tags="|cisco|sfp|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="34532" PostTypeId="2" ParentId="34527" CreationDate="2016-09-01T12:49:43.610" Score="6" Body="&lt;p&gt;Note that the offered rate is a 30-second average. If your traffic is bursty then you may very well have had a very short burst of over 800000 bps (causing the shaper to kick in) and very little traffic the rest of the 30 seconds.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-01T12:49:43.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34533" PostTypeId="1" AcceptedAnswerId="34637" CreationDate="2016-09-01T13:58:25.793" Score="2" ViewCount="526" Body="&lt;p&gt;Is it possible to delete flow matching a certain cookie number using Pox controller for OpenFlow?&#xA;I tried something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;def delete_flow(dpid,cookie):&#xA;   msg = of.ofp_flow_mod()&#xA;   msg.match=of.ofp_match()&#xA;&#xA;   msg.match.cookie=cookie&#xA;   msg.match.cookie_mask=0xffffffff&#xA;&#xA;   msg.command=of.OFPFC_DELETE&#xA;   msg.flags = of.OFPFF_SEND_FLOW_REM    &#xA;&#xA;   sw = switches[dpid]&#xA;   if sw.connection is None: return&#xA;   sw.connection.send(msg)&#xA;   log.info(&quot;Flow %i deleted from sw %i&quot; %(cookie,dpid))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it looks like all flows are removed from all switches.&lt;/p&gt;&#xA;" OwnerUserId="29570" LastActivityDate="2016-09-05T22:30:13.160" Title="Delete flow by cookie match in Pox?" Tags="|sdn|openflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34534" PostTypeId="1" AcceptedAnswerId="43307" CreationDate="2016-09-01T14:08:41.657" Score="1" ViewCount="2557" Body="&lt;p&gt;Related to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/8286/authenticate-ssh-key-via-cisco-acs-tacacs&quot;&gt;Authenticate ssh key via Cisco ACS (TACACS+)&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given a working ssh public key config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip ssh pubkey-chain&#xA; username admin&#xA;  key-string&#xA;   &amp;lt;ssh-pub-key&amp;gt;&#xA;  exit&#xA; exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have only been able to provide authorization for the above with an additional &lt;code&gt;username&lt;/code&gt; entry:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username admin privilege 15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nice to discover that you can leave off the &lt;code&gt;secret&lt;/code&gt; part, but is there a way to have the cisco query the radius for the privilege level? and/or combine the authorization into the &lt;code&gt;pubkey-chain&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="30170" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-08-16T15:36:04.207" Title="cisco ssh key authorization level via radius" Tags="|cisco-ios|ssh|radius|aaa|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34536" PostTypeId="1" AcceptedAnswerId="34537" CreationDate="2016-09-01T17:51:10.323" Score="1" ViewCount="273" Body="&lt;p&gt;Hello to all of you experts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry if this is a dumb question (I usually don't ask those, but I'm human), but I haven't a clue of what's wrong in this environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wish to permit all my VLANs to &lt;strong&gt;just&lt;/strong&gt; comunicate with &lt;strong&gt;VLAN 1&lt;/strong&gt; &lt;strong&gt;&lt;em&gt;and&lt;/em&gt;&lt;/strong&gt; the &lt;strong&gt;internet&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;All internal traffic is inside 192.168.0.0/16 range like:&#xA;. VLAN 1: 192.168.1.0/24 (ip addr 192.168.1.1)&#xA;. VLAN 2: 192.168.2.0/24 (ip addr 192.168.2.1)&#xA;. VLAN 3: 192.168.3.0/24 (ip addr 192.168.3.1)&#xA;&#xA;This is the only routing-activated layer3 switch on campus &#xA;and is the default gateway for everybody&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, I created the &quot;&lt;strong&gt;acl_default&lt;/strong&gt;&quot; and applied it at the &lt;strong&gt;&lt;em&gt;inbound&lt;/em&gt;&lt;/strong&gt; of every VLAN (except VLAN 1, obviously)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended &quot;acl_default&quot;&#xA;   10 permit ip 192.168.0.0 0.0.255.255 192.168.1.0 0.0.0.255&#xA;   900 deny ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255 &#xA;   950 permit ip 0.0.0.0 255.255.255.255 0.0.0.0 255.255.255.255 &#xA;   exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It works...&lt;strong&gt;but&lt;/strong&gt;, &lt;em&gt;every morning&lt;/em&gt;, &lt;em&gt;all&lt;/em&gt; the users in the VLANs (not VLAN 1) cannot communicate with &lt;em&gt;some&lt;/em&gt; servers on VLAN 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I traceroute to a server from VLAN 120 (192.168.120.0/24), I see a loop:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute to 192.168.1.69 ,&#xA;          1 hop min, 30 hops max, 5 sec. timeout, 3 probes&#xA; 1 192.168.120.1        1 ms      1 ms      1 ms&#xA; 2 192.168.120.1        0 ms      1 ms *&#xA; 3 192.168.120.1        1 ms      1 ms      1 ms&#xA; 4 192.168.120.1        1 ms      1 ms *&#xA; 5 192.168.120.1        1 ms      1 ms      1 ms&#xA; 6 192.168.120.1        1 ms      1 ms *&#xA; 7 192.168.120.1        1 ms      1 ms      1 ms&#xA; 8 192.168.120.1        1 ms      1 ms *&#xA; 9 192.168.120.1        0 ms      2 ms      0 ms&#xA;10 192.168.120.1        1 ms      1 ms *&#xA;11 192.168.120.1        1 ms      1 ms      1 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But...If I go to server_69 and ping back the 120_gateway, everything starts to work!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;That's why only certain servers can't be reached&lt;/em&gt;&lt;/strong&gt; in the morning: The ones that don't communicate very often with the other-than-vlan1 subnets.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Chassis info: HP Procurve 5400Rzl2 Software: KB.15.17.0003&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all in advance&#xA;(even if just for reading this long post)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rui&lt;/p&gt;&#xA;" OwnerUserId="30172" LastEditorUserId="30172" LastEditDate="2016-09-01T18:15:09.170" LastActivityDate="2016-09-02T11:27:38.107" Title="HP 5400Rzl2 strange ACL behaviour" Tags="|routing|switch|acl|hp-procurve|layer3|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34537" PostTypeId="2" ParentId="34536" CreationDate="2016-09-01T19:32:58.300" Score="2" Body="&lt;p&gt;I'm not sure that's a loop. I'm not really sure what that is. The ACL looks fine so you probably want to talk to HP about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a case similar to this where a procurve based L3 switch would not manage its arp table properly. I think it was on the same software branch as you too. Called HP and 5 minutes later it was confirmed as a known issue and due to be fixed in next release.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you check the release notes for the next firmware version does it mention anything about ARP being fixed? Or is it listed as a known issue in the current firmware release notes (firmware release you're running now). The next morning it happens, try clearing the arp table/cache with clear arp. Try to ping from vlan 120 to a server again and see if it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the firmware versions are free from HP (at least on the lower end models). We were looking at the 5400 to use at the core and ended up going with a Comware based HP switch instead and its been solid. Procurve is great (we have customers using a lot of them at the access layer) but I've seen odd issues like this crop up, especially on the newer firmware versions.&lt;/p&gt;&#xA;" OwnerUserId="23560" LastActivityDate="2016-09-01T19:32:58.300" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34538" PostTypeId="2" ParentId="34534" CreationDate="2016-09-01T19:43:34.867" Score="1" Body="&lt;p&gt;If the radius server supports cisco av-pair attributes then you can configure it to push:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;cisco-avpair =shell:priv-lvl=15&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Note that this requires authorization to be enabled in addition to authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Src: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security-vpn/remote-authentication-dial-user-service-radius/13860-PRIV.html&quot; rel=&quot;nofollow&quot;&gt;How to Assign Privilege Levels with TACACS+ and RADIUS&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-01T19:43:34.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34539" PostTypeId="1" AcceptedAnswerId="34540" CreationDate="2016-09-01T19:43:53.680" Score="2" ViewCount="158" Body="&lt;p&gt;Could you please advise on following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have two Cisco 3570x switches in a stack (switches have no Stack Power).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What will be the behavior if:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Master switch will be powered off. Will Slave reboot by itself?&lt;/li&gt;&#xA;&lt;li&gt;Slave switch will be powered off. Will it affect Master in any ways?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="19524" LastEditorUserId="8499" LastEditDate="2018-03-07T19:40:29.343" LastActivityDate="2021-01-24T12:11:25.130" Title="Cisco 3570x stack behaviour" Tags="|cisco|switch|cisco-catalyst|layer2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34540" PostTypeId="2" ParentId="34539" CreationDate="2016-09-01T19:48:18.180" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Master switch will be powered off. Will Slave reboot by itself?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When the master is powered off, the switch with the next highest priority will take over as the master switch. There is no rebooting involved.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Slave switch will be powered off. Will it affect Master in any ways?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. It is like a chassis switch losing a port line card. You will lose the ports of the non-master switch, but it doesn't affect anything else.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-01T19:48:18.180" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34541" PostTypeId="1" AcceptedAnswerId="34547" CreationDate="2016-09-01T21:16:28.117" Score="2" ViewCount="957" Body="&lt;p&gt;I'm trying to set up chassis cluster on Juniper SRX300 (Junos 15.1X49-D45).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I wasn't able to find any documentation on this matter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to run the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set chassis cluster cluster-id 0 node 0[1] reboot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on both nodes, but after the reboot cluster is not enabled:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root&amp;gt; show chassis cluster status&#xA;error: Chassis cluster is not enabled.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is the anything else I should do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any special license required?&lt;/p&gt;&#xA;" OwnerUserId="29742" LastEditorUserId="8499" LastEditDate="2016-09-01T21:25:07.047" LastActivityDate="2016-09-02T06:22:05.770" Title="Juniper SRX300 cluster" Tags="|firewall|juniper|juniper-junos|juniper-srx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34542" PostTypeId="1" AcceptedAnswerId="34543" CreationDate="2016-09-01T21:45:37.933" Score="1" ViewCount="178" Body="&lt;p&gt;Cisco 2921 with IOS 15.2(3)T1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My ISP has provided a DSL connection (Dialer0 via PPPoATM on EHWIC) and a 3G SIM (Dialer2 via Sierra Wireless box over PPPoE). The 3G is for failover. The ISP supplies me with a /29 IP range and this is routed over DSL directly or the 3G connection using L2TP (Virtual-PPP 1) during failover.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The failover works using and IP SLA and tracking. Using ICMP requests to ISP gateway (which is statically routed from the DSL interface) it tracks reachability and successfully fails over all routing and NAT to the L2TP via 3G when the DSL fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question: I'd like to be able to ping and connect to the router at both its IP addresses (DSL and L2TP) at all times, however when the routing switches, replies and connections only work at the active address because there is no route for the other interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like I need a way of creating a route for each interface to allow replies to connection attempts while the other interface has the default route attached. I've investigated policy based routing but my experience in this area is limited and so any help greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overview:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dialer0 via PPPoATM (Primary) (IP A/32)&lt;br&gt;&#xA;Dialer2 via PPPoE (3G Backup) (IP B/32)&lt;br&gt;&#xA;Virtual-PPP 1 via L2TP via Dialer2 (3G LT2P) (IP C/32)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP Supplies IP D/29 which is NATted by the router. They route IP D via DSL or L2TP depending on their reachability tests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip route 0.0.0.0 0.0.0.0 D0 10 track 10&lt;br&gt;&#xA;ip route 0.0.0.0 0.0.0.0 Virtual-PPP 20&lt;br&gt;&#xA;ip route (DSL gateway) 255.255.255.255 D0&lt;br&gt;&#xA;ip route (L2TP gateway) 255.255.255.255 D2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all in advance!&lt;/p&gt;&#xA;" OwnerUserId="30176" LastActivityDate="2016-09-01T22:18:56.537" Title="&gt;Interface specific routing on Cisco IOS for failover IPs" Tags="|routing|cisco-ios|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34543" PostTypeId="2" ParentId="34542" CreationDate="2016-09-01T22:18:56.537" Score="1" Body="&lt;p&gt;Indeed this can be done using policy based routing, e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 1 permit &amp;lt;ip A&amp;gt;&#xA;access-list 2 permit &amp;lt;ip C&amp;gt;&#xA;&#xA;route-map PBRmap permit 10 &#xA;    match ip address 1 &#xA;    set interface dialer0&#xA;&#xA;route-map PBRmap permit 20 &#xA;    match ip address 2&#xA;    set interface virtual-ppp1&#xA;&#xA;ip local policy route-map PBRmap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-01T22:18:56.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34545" PostTypeId="2" ParentId="34530" CreationDate="2016-09-02T03:01:28.087" Score="2" Body="&lt;p&gt;As far as I am concerned, the most common SFP problems are Poor performance, No connectivity and Corrupted software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;For the first one&lt;/strong&gt;, the possible cause of this problem include that cabling distance is exceeded or port statistics show excessive frame check sequence (FCS), late-collision, or alignment errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resolution:&#xA;Reduce the cable length to within the recommended distances. See your SFP module documentation for cabling guidelines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;For the comnectivity issue&lt;/strong&gt;, maybe you have used the incorrect ot bad cable, or STP (Shielded Twisted Pair) checking for possible loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resolution:&#xA;Verify the pinouts are correct for the proper application of cables. Replace the cable with a tested good cable. Wait 30 seconds for the port LED to turn green.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;For the third issue—corrupted software&lt;/strong&gt;, this include three situation including the port is placed in error-disabled state after SFP is inserted, device does not recognize the SFP module, and excessive errors found in port statistics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Resolution:&#xA;Remove the SFP module from the switch and replace it with a Cisco-approved module. Use the irrdisable recovery cause GBIC-invalid global configuration command to verify the port status, and enter a time interval to recover from the error-disable state. The best advice is to use the Cisco original SFP or 100% Cisco compatible SFP (If you decide to use a third-party SFP, please ensure that your supplier is assured) that is adapted to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this might help you!&lt;/p&gt;&#xA;" OwnerUserId="24835" LastActivityDate="2016-09-02T03:01:28.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34547" PostTypeId="2" ParentId="34541" CreationDate="2016-09-02T06:22:05.770" Score="2" Body="&lt;p&gt;You can find full documentation &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos15.1x49-d40/information-products/pathway-pages/security/security-chassis-cluster-library.pdf&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You're on the right track, but cluster-id should be greater than 0. From the documentation:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Setting a cluster ID to 0 is equivalent to disabling a cluster. A&#xA;  cluster ID greater than 15 can only be set when the fabric and control&#xA;  link interfaces are connected back-to-back.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that you need to connect the two SRX300 devices on port ge-0/0/1 (for the control link). In the factory default configuration, this interface is already configured and part of a security zone; you need to remove all configuration relating to this interface before the chassis cluster will form.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-09-02T06:22:05.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34549" PostTypeId="1" AcceptedAnswerId="34574" CreationDate="2016-09-02T07:59:06.413" Score="3" ViewCount="192" Body="&lt;p&gt;I am using polycom HDX 7000 series VC. We used to call HQ  using the IP of their VC but now HQ wants the call setup to be done using phone number. I checked the docs for it and it says, it can be done. Can anyone help me with the configuration part of it?&#xA;Do i need to work around the gatekeeper settings?&#xA;Is it even possible?&lt;/p&gt;&#xA;" OwnerUserId="23114" LastActivityDate="2016-09-03T12:33:44.057" Title="Regarding polycom call setup using ISDN" Tags="|video|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34550" PostTypeId="2" ParentId="34536" CreationDate="2016-09-02T10:45:36.210" Score="2" Body="&lt;p&gt;Got it!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a &lt;strong&gt;software bug&lt;/strong&gt; on &lt;strong&gt;releases prior to KB.15.17.0008&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the &lt;a href=&quot;http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=c04784415&quot; rel=&quot;nofollow&quot;&gt;Release Notes&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;CR_0000174881&lt;/strong&gt;, &lt;strong&gt;CR_0000176140&lt;/strong&gt; The switch does not initiate an ARP request to the next hop&#xA;  IPv4 address for routed IPv4 traffic entering a VLAN that has a Routed Access List (RACL) &lt;em&gt;(....)&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;As a result, the IPv4 routed traffic does not reach its destination because the switch &#xA;      does not create an ARP entry in the switch ARP Table for the next hop IPv4 address,&#xA;      &lt;em&gt;(....)&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The issue may be intermittent because there could be other sources trying to reach the same next hop IPv4 address which will result in creating an ARP entry. Due to the ARP age-out time of 20 minutes, the issue may reoccur after 20 minutes. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And they give an example just like mine:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For example, if the routed IPv4 traffic also enters the switch via a VLAN that does&#xA;      not have RACL or if you ping it from the affected switch. Pinging from the switch to the&#xA;      unreachable IPv4 destination address temporarily resolves the reachability issue; however, &#xA;      it may reoccur after the APR age-out expire or after invoking the CLI command clear arp.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Dispite I could have started by checking the software releases before posting this question, I wasn't sure that it wasn't some mistake of mine on the ACL implementation. It's always Something could have slipped-by unnoticed. Like it did to everyone using it for 5 software releases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I leave it here in case someone else runs into this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you to @Mark for letting me know that I was doing the things right. His 2nd opinion led me to the next step: look for software releases. If I didn't find anything on it, I would open a case on HP (HPE division).&lt;/p&gt;&#xA;" OwnerUserId="30172" LastEditorUserId="30172" LastEditDate="2016-09-02T11:27:38.107" LastActivityDate="2016-09-02T11:27:38.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34552" PostTypeId="2" ParentId="28438" CreationDate="2016-09-02T13:19:29.860" Score="2" Body="&lt;p&gt;I see 2 possible solutions (apart from adding a router/l3 switch behind the ASA as Roy suggests in his answer):&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure a route on the ASA (as RonMaupin suggested). However, if the Meraki is on the inside of the ASA then  this will require two more things in addition:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;configure &lt;code&gt;same-security-traffic permit intra-interface&lt;/code&gt; on the ASA, since the traffic will be entering and exiting the inside interface.&lt;/li&gt;&#xA;&lt;li&gt;on the Meraki add a static route to the inside network, with the ASA as next hop. Otherwise you have asymmetric routing, the ASA will not see the return traffic and so TCP will not work (which could also be solved by some funky stuff on the ASA but it's ugly).&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Put the Meraki on a DMZ of the ASA&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-02T13:19:29.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34553" PostTypeId="1" AcceptedAnswerId="37695" CreationDate="2016-09-02T13:28:37.953" Score="1" ViewCount="170" Body="&lt;p&gt;We have just received a device with 10Gig BaseT ports (for copper cable with RJ45 endings) that needs to be connected to a Cisco Nexus 5548. This switch only has SFP+ ports and we're connecting them right now using a couple 1Gbps SFP. We really would like to use the 10Gig connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I googled 10Gig Media converters and found some brands but i have doubts regarding stability and compatibility. The final scenerio would be like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Nexus 5k]--[10G SFP+]---Optical Fiber Jumper---[Media converter]--Cat 6a--[DataDomain]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone out there have a similar combination of equipment? How has it worked for you?&lt;/p&gt;&#xA;" OwnerUserId="30154" LastEditorUserId="8499" LastEditDate="2018-03-20T23:29:20.243" LastActivityDate="2018-03-20T23:29:20.243" Title="What is your experience using 3rd-Party 10Gig Media Converters with Cisco equipment?" Tags="|layer1|cable|10gbase|utp|media-conversion|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34555" PostTypeId="1" CreationDate="2016-09-02T15:23:28.083" Score="1" ViewCount="312" Body="&lt;p&gt;With my current ISP, I have a static IP address for the server to be able to access it from anywhere in the world. Now I'm changing ISPs - should I ask a new ISP for new static IP address, or can I reuse the current one?&lt;/p&gt;&#xA;" OwnerUserId="30188" LastEditorUserId="8499" LastEditDate="2016-09-02T15:45:17.387" LastActivityDate="2016-09-02T15:45:17.387" Title="When changing ISPs, do I have to order a new static IP address?" Tags="|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34556" PostTypeId="2" ParentId="34555" CreationDate="2016-09-02T15:25:27.117" Score="3" Body="&lt;p&gt;You will not be able to reuse the current one, it will be part of your current ISP address range, and will not be portable to your new ISP&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-09-02T15:25:27.117" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34557" PostTypeId="2" ParentId="34555" CreationDate="2016-09-02T15:43:11.830" Score="0" Body="&lt;p&gt;Unless you have your own provider-independent block of addresses, you will not be able to take your addresses with you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP will not advertise prefixes longer than &lt;code&gt;/24&lt;/code&gt; for IPv4 or &lt;code&gt;/48&lt;/code&gt; for IPv6. That means if your block of addresses is smaller than those, the IP addresses are assigned to the ISP, not to you. A new ISP cannot advertise your address block if it belongs to your former ISP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-02T15:43:11.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34558" PostTypeId="2" ParentId="19645" CreationDate="2016-09-02T15:44:40.460" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My idea right now is to have a specific NAT-router set up in the network and then do policy based routing on the core routers. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As long as you can set up a rule based on the combination of source (private) and destination (outside your network) that overrides normal routing and sends packets to the NAT box this should work fine as a means of bringing outgoing traffic to the NAT box. Incoming traffic can be brought to the NAT box by normal IP routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having only a single NAT box is a calculated risk. It makes the NAT box a single point of failure but it also means that re-routes won't break established sessions.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-02T15:44:40.460" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="34559" PostTypeId="2" ParentId="34553" CreationDate="2016-09-02T16:23:27.467" Score="1" Body="&lt;p&gt;Third party SFPs can be hit or miss.  Make sure to check the compatibility matrix that cisco has.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the module is an unsupported module then it will not work right off the bat.  There is a command to enable them, but a warning will pop up stating that Cisco doesn't recommend it and that they can't guarantee performance.  Also, if you choose to enable the Third Party modules via that command Cisco reserves the right to stop troubleshooting, if memory serves.&lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2016-09-02T16:23:27.467" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34562" PostTypeId="1" CreationDate="2016-09-02T18:08:25.747" Score="5" ViewCount="481" Body="&lt;p&gt;Our backup links have always utilized a GRE tunnel based VPN to a hub. Recently we installed a second hub and migrated the primary links to GRE tunnel based VPN with EIGRP to handle routing between the two. Last week the ISP went down and the primary VPN goes down, fine, but every 30-40 minutes the backup VPN would stop passing traffic. When this occurred I noticed the following.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;debug ip packet would show the outside ACL blocking GRE packets. Why? These should be within an IPSec packet and that's what gets allowed, why is the inner GRE being blocked?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Aug 26 14:43:54: IP: s=&amp;lt;vpn-gw1&amp;gt; (FastEthernet1), d=192.168.0.2, len 108, access denied, proto=47&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At the same time, the inspection map was generating a session for the NAT-T VPN. Why? router-generated UDP inspection is not even configured.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Session 84295484 (192.168.0.2:4500)=&amp;gt;(&amp;lt;vpn-gw1&amp;gt;:4500) udp SIS_OPEN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Clearing this session clear ip inspect session 84294584 would immediately restore traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note we don't care for spoke-to-spoke traffic so we don't have that function in our DMVPN config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Branch config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;no service pad&#xA;service timestamps debug datetime localtime&#xA;service timestamps log datetime localtime&#xA;service password-encryption&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;logging buffered 4096&#xA;!&#xA;no aaa new-model&#xA;!&#xA;dot11 syslog&#xA;no ip source-route&#xA;!&#xA;ip cef&#xA;no ip dhcp use vrf connected&#xA;ip dhcp excluded-address 192.168.159.100 192.168.159.126&#xA;ip dhcp excluded-address 192.168.159.1 192.168.159.49&#xA;ip dhcp excluded-address 192.168.179.1 192.168.179.49&#xA;!&#xA;ip dhcp pool pool1&#xA;network 192.168.159.0 255.255.255.128&#xA;default-router 192.168.159.1&#xA;dns-server 192.168.2.10 192.168.2.12&#xA;!&#xA;ip dhcp pool pool2&#xA;network 192.168.179.0 255.255.255.128&#xA;default-router 192.168.179.1&#xA;dns-server 8.8.8.8 8.8.4.4&#xA;!&#xA;no ip bootp server&#xA;no ip domain lookup&#xA;ip inspect name guest cuseeme&#xA;ip inspect name guest ftp&#xA;ip inspect name guest h323&#xA;ip inspect name guest icmp router-traffic&#xA;ip inspect name guest netshow&#xA;ip inspect name guest rcmd&#xA;ip inspect name guest realaudio&#xA;ip inspect name guest rtsp&#xA;ip inspect name guest esmtp&#xA;ip inspect name guest sqlnet&#xA;ip inspect name guest streamworks&#xA;ip inspect name guest tftp&#xA;ip inspect name guest udp&#xA;ip inspect name guest vdolive&#xA;ip inspect name guest tcp router-traffic&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;vtp mode transparent&#xA;!&#xA;crypto isakmp policy 10&#xA;encr aes&#xA;authentication pre-share&#xA;group 2&#xA;crypto isakmp key &amp;lt;key&amp;gt; address 0.0.0.0 0.0.0.0&#xA;crypto isakmp keepalive 20&#xA;!&#xA;crypto ipsec transform-set aes128sha esp-aes esp-sha-hmac&#xA;mode transport&#xA;!&#xA;crypto ipsec profile vpn&#xA;set security-association lifetime seconds 28800&#xA;set transform-set aes128sha&#xA;!&#xA;archive&#xA;log config&#xA;hidekeys&#xA;!&#xA;vlan 99&#xA;name guest&#xA;!&#xA;ip ssh version 2&#xA;!&#xA;track 1 rtr 1&#xA;delay down 30 up 30&#xA;!&#xA;interface Tunnel0&#xA;ip address 192.168.101.159 255.255.255.0&#xA;no ip redirects&#xA;ip mtu 1400&#xA;ip nhrp map 192.168.101.1 &amp;lt;vpn-gw1&amp;gt;&#xA;ip nhrp network-id 100000&#xA;ip nhrp holdtime 300&#xA;ip nhrp nhs 192.168.101.1&#xA;ip tcp adjust-mss 1360&#xA;delay 1050&#xA;tunnel source FastEthernet1&#xA;tunnel destination &amp;lt;vpn-gw1&amp;gt;&#xA;tunnel key 100000&#xA;tunnel route-via FastEthernet1 mandatory&#xA;tunnel protection ipsec profile vpn&#xA;!&#xA;interface Tunnel1&#xA;ip address 192.168.103.159 255.255.255.0&#xA;no ip redirects&#xA;ip mtu 1400&#xA;ip nhrp map 192.168.103.1 &amp;lt;vpn-gw2&amp;gt;&#xA;ip nhrp network-id 300000&#xA;ip nhrp holdtime 300&#xA;ip nhrp nhs 192.168.103.1&#xA;ip tcp adjust-mss 1360&#xA;delay 1000&#xA;tunnel source FastEthernet0&#xA;tunnel destination &amp;lt;vpn-gw2&amp;gt;&#xA;tunnel key 300000&#xA;tunnel route-via FastEthernet0 mandatory&#xA;tunnel protection ipsec profile vpn&#xA;!&#xA;interface FastEthernet0&#xA;description ISP&#xA;ip address &amp;lt;public-ip&amp;gt; 255.255.255.248&#xA;ip access-group 101 in&#xA;ip nat outside&#xA;ip inspect guest out&#xA;ip virtual-reassembly&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet1&#xA;description Backup&#xA;ip address 192.168.0.2 255.255.255.0&#xA;ip access-group 101 in&#xA;ip nat outside&#xA;ip inspect guest out&#xA;ip virtual-reassembly&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet2&#xA;!&#xA;interface FastEthernet3&#xA;!&#xA;interface FastEthernet4&#xA;!&#xA;interface FastEthernet5&#xA;!&#xA;interface FastEthernet6&#xA;!&#xA;interface FastEthernet7&#xA;!&#xA;interface FastEthernet8&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet9&#xA;switchport access vlan 99&#xA;!&#xA;interface Vlan1&#xA;ip address 192.168.159.1 255.255.255.128&#xA;ip access-group 100 in&#xA;ip directed-broadcast&#xA;ip nat inside&#xA;ip virtual-reassembly&#xA;!&#xA;interface Vlan99&#xA;ip address 192.168.179.1 255.255.255.0&#xA;ip access-group 102 in&#xA;ip nat inside&#xA;ip virtual-reassembly&#xA;!&#xA;interface Async1&#xA;no ip address&#xA;encapsulation slip&#xA;!&#xA;router eigrp 1&#xA;passive-interface Vlan1&#xA;passive-interface Vlan99&#xA;network 192.168.0.0 0.0.255.255&#xA;distance eigrp 130 170&#xA;no auto-summary&#xA;eigrp stub connected&#xA;!&#xA;ip local policy route-map sla&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 &amp;lt;isp-gw&amp;gt; 180 track 1&#xA;ip route 0.0.0.0 0.0.0.0 192.168.0.1 200&#xA;ip route &amp;lt;vpn-gw1&amp;gt; 255.255.255.255 192.168.0.1&#xA;ip route &amp;lt;vpn-gw2&amp;gt; 255.255.255.255 &amp;lt;isp-gw&amp;gt;&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip nat inside source list nat1 interface FastEthernet0 overload&#xA;ip nat inside source list nat2 interface FastEthernet1 overload&#xA;!&#xA;ip access-list extended nat1&#xA;permit ip 192.168.179.0 0.0.0.255 any&#xA;ip access-list extended nat2&#xA;permit ip 192.168.159.0 0.0.0.127 192.168.0.0 0.0.0.255&#xA;permit ip 192.168.179.0 0.0.0.255 any&#xA;ip access-list extended sla&#xA;permit icmp any host &amp;lt;vpn-gw2&amp;gt; echo&#xA;!&#xA;ip sla 1&#xA;icmp-echo &amp;lt;vpn-gw2&amp;gt; source-interface FastEthernet0&#xA;frequency 30&#xA;ip sla schedule 1 life forever start-time now&#xA;access-list 100 permit udp any eq bootpc any eq bootps&#xA;access-list 100 permit ip any &amp;lt;private-networks&amp;gt;&#xA;access-list 101 permit icmp any any unreachable&#xA;access-list 101 permit icmp any any source-quench&#xA;access-list 101 permit icmp any any echo&#xA;access-list 101 permit icmp any any time-exceeded&#xA;access-list 101 permit esp &amp;lt;hq-public-subnet&amp;gt; 0.0.0.31 any&#xA;access-list 101 permit udp &amp;lt;hq-public-subnet&amp;gt; 0.0.0.31 any eq isakmp&#xA;access-list 101 permit udp &amp;lt;hq-public-subnet&amp;gt; 0.0.0.31 any eq non500-isakmp&#xA;access-list 101 permit tcp &amp;lt;hq-public-subnet&amp;gt; 0.0.0.31 any eq 22&#xA;access-list 102 deny ip any &amp;lt;private-networks&amp;gt;&#xA;access-list 102 deny ip any 10.0.0.0 0.255.255.255&#xA;access-list 102 permit ip any 192.168.179.0 0.0.0.127&#xA;access-list 102 deny ip any 172.16.0.0 0.15.255.255&#xA;access-list 102 deny ip any 192.168.0.0 0.0.255.255&#xA;access-list 102 permit ip any any&#xA;no cdp run&#xA;!&#xA;route-map sla permit 10&#xA;match ip address sla&#xA;set ip next-hop &amp;lt;isp-gw&amp;gt;&#xA;set interface Null0&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA;logging synchronous&#xA;login local&#xA;line vty 0 4&#xA;exec-timeout 20 0&#xA;logging synchronous&#xA;login local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;vpn-gw1 config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel0&#xA;ip address 192.168.101.1 255.255.255.0&#xA;no ip redirects&#xA;ip mtu 1400&#xA;ip nat enable&#xA;ip nhrp map multicast dynamic&#xA;ip nhrp network-id 100000&#xA;ip nhrp holdtime 300&#xA;ip virtual-reassembly in&#xA;ip tcp adjust-mss 1360&#xA;delay 1050&#xA;tunnel source GigabitEthernet0/0&#xA;tunnel mode gre multipoint&#xA;tunnel key 100000&#xA;tunnel protection ipsec profile vpn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;vpn-gw2 config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Tunnel1&#xA;ip address 192.168.103.1 255.255.255.0&#xA;no ip redirects&#xA;ip mtu 1400&#xA;ip nat enable&#xA;ip nhrp map multicast dynamic&#xA;ip nhrp network-id 300000&#xA;ip nhrp holdtime 300&#xA;ip virtual-reassembly in&#xA;ip tcp adjust-mss 1360&#xA;delay 1000&#xA;tunnel source GigabitEthernet0/0&#xA;tunnel mode gre multipoint&#xA;tunnel key 300000&#xA;tunnel protection ipsec profile vpn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30193" LastEditorUserId="30193" LastEditDate="2016-09-02T20:11:25.870" LastActivityDate="2016-09-02T20:11:25.870" Title="Dual-Hub DMVPN Outage" Tags="|cisco|vpn|eigrp|tunnel|" AnswerCount="0" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34564" PostTypeId="1" CreationDate="2016-09-02T19:50:02.327" Score="1" ViewCount="9501" Body="&lt;p&gt;What is the Cisco 3550 default password? &#xA;I lose the password due some power outage while I was programming.&#xA;I did reboot, and try the recovery password but doesnt work.&lt;/p&gt;&#xA;" OwnerUserId="30194" LastEditorUserId="8499" LastEditDate="2018-12-25T02:29:21.270" LastActivityDate="2022-09-26T05:01:25.130" Title="Switch 3550 password default password" Tags="|cisco|switch|cisco-catalyst|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34565" PostTypeId="2" ParentId="34564" CreationDate="2016-09-02T19:54:09.287" Score="1" Body="&lt;p&gt;There is no default password. Somebody didn't save the configuration after the last password change. You do a password recovery: &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-121-mainline/6130-index.html&quot; rel=&quot;nofollow&quot;&gt;Password Recovery Procedures&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, for the Catalyst 3550: &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/switches/catalyst-2950-series-switches/12040-pswdrec-2900xl.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Catalyst Fixed Configuration Layer 2 and Layer 3 Switches&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-02T19:54:09.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34569" PostTypeId="1" CreationDate="2016-09-03T04:01:21.353" Score="2" ViewCount="523" Body="&lt;p&gt;Kind of an odd question, I know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to replace the source IP address in outbound ICMP &quot;Time Exceeded&quot; packets on a Cisco 2911 router? I have multiple IPs bound to the primary interface, as well as IPs on the secondary interface that act as gateway IPs for the local network that the router also responds to on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'd like to do is replace the source IP address in outbound ICMP &quot;Time Exceeded&quot; packets so that, when a traceroute is conducted, the IP address I wish to appear to the Internet as (a secondary interface's IP address) is shown. For instance, when a traceroute is done to any machine on our network, the IP 1.2.3.4 is shown as one of the hops as that's the primary GigabitEthernet0/0 interface's IP address. I would like 2.3.4.5 to show instead (an IP assigned to GigabitEthernet0/1 and reachable from the Internet). The only way I can think of doing this is to alter the IP address in the outbound packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does Cisco have this functionality? Is it possible to alter that IP in transit, for a particular type of packet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance!&lt;/p&gt;&#xA;" OwnerUserId="27905" LastActivityDate="2018-07-27T23:01:40.363" Title="Replacing the source IP address in outbound ICMP &quot;Time Exceeded&quot; packets on Cisco routers" Tags="|cisco|firewall|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34570" PostTypeId="1" CreationDate="2016-09-03T09:28:16.417" Score="2" ViewCount="1088" Body="&lt;p&gt;base on following results from route-views &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-----------------------------------------------------------------------------------------------------------------------------------------------------------------------&#xA;&#xA;route-views&amp;gt;sh ip bgp 2.22.0.1 bestpath&#xA;BGP routing table entry for 2.22.0.0/22, version 68416201&#xA;Paths: (39 available, best #35, table default)&#xA;Not advertised to any peer&#xA;Refresh Epoch 1&#xA;393406 1299&#xA;162.243.188.2 from 162.243.188.2 (162.243.188.2)&#xA;Origin IGP, localpref 100, valid, external, best&#xA;Community: 1299:1000 1299:30000 1299:30200&#xA;rx pathid: 0, tx pathid: 0x0&#xA;&#xA;&#xA;route-views&amp;gt;trace 2.22.0.1 &#xA;Type escape sequence to abort.&#xA;Tracing the route to 2.22.0.1&#xA;VRF info: (vrf in name/id, vrf out name/id)&#xA;1 vl-51.uonet1-gw.uoregon.edu (128.223.51.2) [AS 3582] 50 msec 1 msec 48 msec&#xA;2 2.bundle-ether10.uonet10-gw.uoregon.edu (128.223.2.10) [AS 3582] 51 msec 49 msec 50 msec&#xA;3 eugn-car1-gw.nero.net (207.98.68.177) [AS 3701] 1 msec 1 msec 1 msec&#xA;4 eugn-core1-gw.nero.net (207.98.64.161) [AS 3701] 1 msec 51 msec 68 msec&#xA;5 te-4-4.car1.Sacramento1.Level3.net (4.53.200.1) [AS 3356] 49 msec 51 msec 49 msec&#xA;6 sjo-b21-link.telia.net (213.248.98.29) [AS 1299] 49 msec 52 msec 49 msec&#xA;7 nyk-bb2-link.telia.net (213.155.133.238) [AS 1299] 167 msec&#xA;nyk-bb2-link.telia.net (80.91.245.97) [AS 1299] 99 msec&#xA;nyk-bb2-link.telia.net (80.91.254.176) [AS 1299] 102 msec&#xA;8 kbn-bb4-link.telia.net (213.155.134.53) [AS 1299] 199 msec&#xA;kbn-bb4-link.telia.net (62.115.118.199) [AS 1299] 195 msec&#xA;kbn-bb4-link.telia.net (213.248.82.102) [AS 1299] 249 msec&#xA;9 s-bb3-link.telia.net (62.115.139.61) [AS 1299] 201 msec&#xA;s-bb4-link.telia.net (62.115.120.59) [AS 1299] 206 msec 245 msec&#xA;&#xA;-----------------------------------------------------------------------------------------------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as you can see ,  the &quot;show ip bgp &quot; display that the AS number before destination AS is 393406 , but when we trace the same prefix ,the result dispaly AS=3356 before destination ASN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="30208" LastEditorUserId="509" LastEditDate="2016-09-03T09:43:00.503" LastActivityDate="2016-12-02T14:14:15.773" Title="different between &quot;show ip bgp&quot; command and traceroute" Tags="|bgp|traceroute|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34572" PostTypeId="2" ParentId="34570" CreationDate="2016-09-03T12:22:29.947" Score="0" Body="&lt;p&gt;I'm not quite sure what you're asking, but I'll try anyway. I believe you got the output confused, and the commands shown in the question are inconsistent as it is apparently from two separate routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;COMMANDS ON ROUTER #1 - appeared to be IP 162.243.188.2: The first output you show us shows two AS numbers: AS393406 which is the AS of the IP 162.243.188.2 (which is shown in the output), and AS1299 which is the network that is announcing 2.22.0.1 (also AS34164 announces it, but it's less specific as 34164 is announcing it within a /13 but 1299 is announcing it within a /22).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;COMMANDS ON ROUTER #2 - appeared to be @ University of Oregon: The second output shows what appears to be a traceroute from a DIFFERENT router than the first. This time it's at the University of Oregon on AS3582. It then travels down the Internet, until it reaches AS1299.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question you asked was why AS3356 shows up before AS1299 in the traceroute, because the first output showed AS393406 before AS1299. That is not true. The two numbers shown were the starting AS - servicing 162.243.188.2 on AS393406 - and the destination AS, AS1299 servicing 2.22.0.1. The AS3356 you see in the traceroute is the last AS your packet hops through before reaching the destination network's (Akamai) AS at AS1299.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SO, I THINK what happened is you confused the output. That first output of two AS numbers were showing the beginning and the end ASes in the route. Also, you apparently had two separate routers issuing the commands as one appeared to be on Digital Ocean and the other at University of Oregon.&lt;/p&gt;&#xA;" OwnerUserId="27905" LastActivityDate="2016-09-03T12:22:29.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34573" PostTypeId="2" ParentId="34570" CreationDate="2016-09-03T12:23:44.047" Score="2" Body="&lt;p&gt;This is due to the fact that route-views servers use multi-hop BGP for peering eg: there may be a lot of ASs that are bypassed between the location of the route-views server you are connected to and the peer.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also (in the case of Zebra) does not install routes into the forwarding table of the machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;traceroute&lt;/code&gt; command you are running would simply use the machine's IP stack and follow the entire AS-Path to the destination as you see in your trace.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check the &lt;strong&gt;Implementation&lt;/strong&gt; section on the front page of &lt;a href=&quot;http://routeviews.org&quot; rel=&quot;nofollow&quot;&gt;http://routeviews.org&lt;/a&gt; and the examples linked beneath it.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-09-03T12:23:44.047" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34574" PostTypeId="2" ParentId="34549" CreationDate="2016-09-03T12:33:44.057" Score="2" Body="&lt;p&gt;For a HDX7K I'm pretty sure you need an ISDN module to make this work, but once you've connected it, and enabled ISDN (as per the instructions in the Admin Guide) you will be given the option of the call-type on the dial window (H.323, SIP or ISDN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems nuts that anyone would want to go &lt;strong&gt;back&lt;/strong&gt; to ISDN - are you sure they don't just want you to dial via E.164 over IP via your gatekeeper?&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-09-03T12:33:44.057" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34575" PostTypeId="1" CreationDate="2016-09-03T12:34:03.033" Score="0" ViewCount="466" Body="&lt;p&gt;I have a Nortel Baystack 5510-48T (firmware says Avaya, but hardware says Nortel Networks). I currently have three different VLANs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN1 - management VLAN and also a VLAN, connected to a Cisco providing Internet access on a gigabit drop, that has all my Internet-facing NICs plugged into; is physically connected into VLAN2 so that LAN IPs can access its management telnet/web service;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN2 - internal network LAN (10.0.0.x);&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN3 - Connected to a secondary gigabit drop, has VPN device plugged into it as VPN is on another IP block/circuit, with the VPN device also having a ethernet cable plugged from it into the VLAN2 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I physically have the management network physically plugged into via an ethernet cable the LAN so that I can access it from the LAN (and by way of VPN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to do is make it to where the management port, port #1, is on its own VLAN (the management VLAN) but also is a member of the LAN VLAN (VLAN #2). It currently has a LAN IP address (10.0.0.254) and, again, is physically connected to the a LAN VLAN (VLAN #2) port. Is there a way to have a single port be a member of two VLANs? I know I could set it to where my management network is also the same as the LAN VLAN (VLAN #2), but I'm sure there must be some way to have a single port belong to more than one VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do? I have full CLI access and am not afraid to use it.&lt;/p&gt;&#xA;" OwnerUserId="27905" LastActivityDate="2018-01-28T01:51:17.280" Title="Sharing a single port with 2 VLANs on a Baystack 5510" Tags="|switch|vlan|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34576" PostTypeId="1" CreationDate="2016-09-03T12:42:14.153" Score="2" ViewCount="314" Body="&lt;p&gt;I am trying for basic operations on IOS-XR (Cisco) using Netconf.This includes initially setting up a netconf connection as below:&#xA;&lt;strong&gt;ssh [hostname] -p 830 -s netconf&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As soon as, the connection is successsful,the router returns something as shown below(hello)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=”1.0″ encoding=”UTF-8″?&amp;gt;&amp;lt;hello&amp;gt;&amp;lt;capabilities&amp;gt;&#xA;&amp;lt;capability&amp;gt;urn:ietf:params:netconf:base:1.0&amp;lt;/capability&amp;gt;&#xA;&amp;lt;capability&amp;gt;urn:ietf:params:netconf:capability:writeable-running:1.0&amp;lt;/capability&amp;gt;&#xA;&amp;lt;capability&amp;gt;urn:ietf:params:netconf:capability:startup:1.0&amp;lt;/capability&amp;gt;&#xA;&amp;lt;capability&amp;gt;urn:ietf:params:netconf:capability:url:1.0&amp;lt;/capability&amp;gt;&#xA;&amp;lt;capability&amp;gt;urn:cisco:params:netconf:capability:notification:1.0&amp;lt;/capability&amp;gt;&#xA;&amp;lt;/capabilities&amp;gt;&amp;lt;session-id&amp;gt;1731357996&amp;lt;/session-id&amp;gt;&amp;lt;/hello&amp;gt;]]&amp;gt;]]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then i send back a hello to the router as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=”1.0″ encoding=”UTF-8″?&amp;gt;&#xA;&amp;lt;hello&amp;gt;&#xA;&amp;lt;capabilities&amp;gt;&#xA;    &amp;lt;capability&amp;gt;urn:ietf:params:netconf:base:1.0&amp;lt;/capability&amp;gt;&#xA;&amp;lt;/capabilities&amp;gt;&#xA;&amp;lt;/hello&amp;gt;]]&amp;gt;]]&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Howver, after this there is no response and if i try to do more operations,the connection gets closed.Can you confirm as to where am i going wrong/why is this happening?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="2142" LastEditDate="2016-10-08T14:51:21.723" LastActivityDate="2016-10-09T09:31:06.917" Title="Regarding NETCONF" Tags="|management|sdn|netconf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34581" PostTypeId="1" AcceptedAnswerId="34640" CreationDate="2016-09-03T19:19:12.517" Score="4" ViewCount="4507" Body="&lt;p&gt;I'm trying to export routes from &lt;em&gt;VRF.inet.0&lt;/em&gt; to &lt;em&gt;inet.0&lt;/em&gt; using rib-groups. Routes are placed into VRF.inet.0 from another PE by MP-BGP (family inet-vpn) session. That's rib group configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rib-groups {&#xA;  VRF-GRT {&#xA;    export-rib VRF.inet.0;&#xA;    import-rib [ VRF.inet.0 inet.0 ];&#xA;  }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I apply rib-group into routing-instances protocols bgp configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VRF {&#xA;    instance-type vrf;&#xA;    interface em0.0;&#xA;    route-distinguisher 200:99;&#xA;    vrf-target target:200:99;&#xA;    vrf-table-label;&#xA;    protocols {&#xA;        bgp {&#xA;            family inet {&#xA;                unicast {&#xA;                    rib-group VRF-GRT;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this is not work for me. I have no VRF routes into inet.0. Is that a right way to accomplish this task?&lt;/p&gt;&#xA;" OwnerUserId="30216" LastEditorUserId="1392" LastEditDate="2016-09-06T01:16:17.020" LastActivityDate="2016-09-06T02:45:31.683" Title="Juniper route leak from VRF to global RT using rib-groups" Tags="|juniper|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34587" PostTypeId="1" AcceptedAnswerId="34589" CreationDate="2016-09-03T22:36:19.253" Score="13" ViewCount="9408" Body="&lt;p&gt;When assigning an IP address to an interface, why do I need to specify a subnet mask? I understand the purpose of subnet masks in a routing table for example (to specify a range of IP addresses as destination). But why is it necessary on an interface? What uses it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why is it specified on the interface if it is already specified in the routing table?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="2130" LastEditorUserId="8499" LastEditDate="2018-03-11T02:02:53.873" LastActivityDate="2019-05-20T05:34:50.383" Title="Why do I need to specify a subnet mask on interface?" Tags="|ipv4|ip|subnet|ip-address|interface|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34588" PostTypeId="2" ParentId="34587" CreationDate="2016-09-04T00:21:27.660" Score="0" Body="&lt;p&gt;When you're using that interface to connect to another IP address, the subnet mask for an interface defines what addresses are &quot;on this LAN&quot;  (or local) vs. what addresses are &quot;out there&quot;, via a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By way of example, if you're on a computer with an interface with an IP address of 100.100.99.5 , with a subnet mask of &quot;/24&quot; (or 255.255.255.0) , that mask says that &quot;to find hosts with 100.100.99.0-255, ask the ARP table, because they're on my lan&quot; ... for all other addresses (so, outside of the mask), you should send the packets to the host designated in my routing table (the router), or the default route.&lt;/p&gt;&#xA;" OwnerUserId="30221" LastActivityDate="2016-09-04T00:21:27.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34589" PostTypeId="2" ParentId="34587" CreationDate="2016-09-04T00:22:01.073" Score="10" Body="&lt;p&gt;The router uses the IP address and mask configured on an interface to determine what network is attached to that interface. That network and mask then become part of the routing table as a directly connected network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three ways a router learns about networks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Directly connected networks&lt;/li&gt;&#xA;&lt;li&gt;Statically configured networks&lt;/li&gt;&#xA;&lt;li&gt;Networks learned through a routing protocol&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A host will use the mask to determine if a destination address is on the same network as the host. If it is on a different network, the host must send the traffic, at layer-2, to the configured gateway instead of directly to the destination.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-04T00:22:01.073" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="34591" PostTypeId="1" AcceptedAnswerId="34594" CreationDate="2016-09-04T04:37:42.917" Score="2" ViewCount="761" Body="&lt;p&gt;I am not sure if this is the correct community, please let me know if I got it wrong. I am new to PoE. I've inherited a network where in one office there is a PoE wireless access point. This device is connected on the other side to a PoE switch (in the data room) that is about an 80' Category-6 run away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this particular office, I need to hardwire two devices above and beyond the existing PoE WAP. One of those two additional devices is an IP phone (which I want to power via POE), while the other is a computer workstation. I think I should be able to run an ethernet cable from the IP phone to the workstation, if need be, which could cut down the cable requirements from 3 to 2. However, both of those are still POE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I just bite the bullet and run new network cables back to the data room 80' away, or is there a way to &quot;split&quot; the one network cable in this office into three cables, two of which need to be connected to my new hardwired POE devices and the third back into the existing PoE WAP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recognize the problem here may be power transmission/continuity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, if need be, I can run the IP Phone with a regular data cable (no PoE) because I have a DC power adapter for it. I do, however, prefer to run it PoE. I have to run the AP via POE since there is no power in the vicinity of the WAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any insights/advice is greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="30227" LastEditorUserId="8499" LastEditDate="2016-09-04T05:52:31.097" LastActivityDate="2016-09-05T11:19:32.210" Title="Splitting WAP PoE connection for IP phone and laptop" Tags="|cabling|cable|power-over-ethernet|layer1|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34593" PostTypeId="2" ParentId="34591" CreationDate="2016-09-04T05:20:29.747" Score="0" Body="&lt;p&gt;I would buy an inexpensive POE switch, connect it to the 85ft CAT6 run, then connect both the AP and PoE phone to it. The Cisco SG200 is a decent choice. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI - This will add complexity to your setup. The proper way would be to just run another cable from the closet. &lt;/p&gt;&#xA;" OwnerUserId="956" LastActivityDate="2016-09-04T05:20:29.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34594" PostTypeId="2" ParentId="34591" CreationDate="2016-09-04T05:52:13.533" Score="1" Body="&lt;p&gt;Splitting a 4-pair UTP cable is completely non-standard, especially with PoE. You will never get a split cable to pass the category suite for that cable category (in your case, Category 6). If you want to run gigabit ethernet over the UTP cable, you will need all four pairs to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The correct way to do this is to run a minimum of two UTP cables to each faceplate. Your WAP is probably going to be in the ceiling or on a wall, and it should have its own dedicated cable, in its own cable pathway.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-04T05:52:13.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34595" PostTypeId="2" ParentId="34587" CreationDate="2016-09-04T09:53:24.723" Score="11" Body="&lt;p&gt;Super simple answer...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It tells the computer what range of addresses it can talk to before sending the traffic to the gateway to decide where it goes next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The traffic in that range never goes to the gateway. Only traffic not in that range because the computer can't &quot;talk&quot; to anyone but the gateway outside its subnet range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Little more details...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your computer is 192.168.1.10 255.255.255.0 it can talk to 192.168.1.1 - 192.168.1.255 without use of the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the subnet was 255.255.0.0 the computer could talk to 192.168.1.1 - 192.168.255.255 without a gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fyi... gateway is a router or layer 3 device like a switch or firewall that will also have a range it can talk to before sending traffic to its own gateway or 'next hop'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope the simple nature of this helps. &lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-04T09:53:24.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34596" PostTypeId="2" ParentId="34575" CreationDate="2016-09-04T10:18:08.343" Score="1" Body="&lt;p&gt;Vlans by design can not talk to each other without a layer 3 device like a router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A port can have one untagged vlan and many tagged vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Untagged on a port means any traffic sent without a vlan tag like a computer will become that vlan number inside the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tagged means the port will handle the traffic that comes in with a vlan tag number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example... port 48 is untagged vlan 10 and tagged vlan 20 and 30&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you plug a regular computer into that port and don't tag any traffic the traffic will be vlan 10 &quot;inside&quot; the switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you plug a switch into that port instead and send some untagged traffic and tagged traffic of 20, 30 and 40 it will handle all of it except it will disgaurd traffic with a tag of 40 because it's not tagged for 40.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice I have not mentioned ip addresses. These switch ports don't care about ip addresses. They are layer 2. That's controlled by your network card information until your network card has to send traffic to the gateway to be routed (meaning the computer needs to talk to an address outside its own subnet range)&lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-04T10:18:08.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34600" PostTypeId="1" CreationDate="2016-09-04T12:59:44.020" Score="1" ViewCount="994" Body="&lt;p&gt;What is the best method for the limiting speed of internet access for hosts in our colocation. We have a full rack which will be connected to the internet at 200/200 Mbps. We have our colo equipment as well as various customer VPS and colocated equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We haven't decided whether we will be using a layer3 switch or a router to perform this traffic management. We would like to use a layer 3 switch, but if it has to be done by a router / firewall that is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of customers will have dedicated bandwidth. Of the 200/200 we have access to, one customer will be allocated 50/50Mbps 1:1 and another will be allocated 20/20Mbps 1:1. Of the remaining 130Mbps, 100/100 Mbps will be a minimum rate to our own equipment as demand requires, yet we would like to share the whole 130Mbps with a couple of low usage VPS's that we host for customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the customers with a dedicated 1:1 bandwidth allocation, what is the best way of limiting their bandwidth access without causing too many issues to their daily usage. They will be using this allocation for daily browsing, cloud app access, potentially voice etc.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Traffic shaping? Pros &amp;amp; Cons&lt;/li&gt;&#xA;&lt;li&gt;Rate limiting? Pros &amp;amp; Cons&lt;/li&gt;&#xA;&lt;li&gt;Any other common methods?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What is the best way of dealing with the remaining 130Mbps as mentioned, so we give our equipment &amp;amp; services a minimum committed rate, along with the ability to share this remaining bandwidth with customers / users that do not have a dedicated amount of bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Traffic shaping? Pros &amp;amp; Cons&lt;/li&gt;&#xA;&lt;li&gt;CIR (Committed information Rate)&lt;/li&gt;&#xA;&lt;li&gt;Rate Limiting? Pros &amp;amp; Cons&lt;/li&gt;&#xA;&lt;li&gt;any other methods?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Many thanks in advance....&lt;/p&gt;&#xA;" OwnerUserId="30222" LastActivityDate="2016-11-04T13:48:06.573" Title="Best method for rate limiting ingress &amp; egress traffic hosts in colocation" Tags="|routing|qos|layer3|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34601" PostTypeId="2" ParentId="16655" CreationDate="2016-09-04T13:08:34.133" Score="0" Body="&lt;pre&gt;&lt;code&gt;/ip firewall mangle&#xA;add chain=prerouting action=mark-connection new-connection-mark=conn-download passthrough=yes protocol=tcp dst-port=80 connection-bytes=1000000-0 comment=&quot;CONN-DOWNLOAD&quot;&#xA;add chain=prerouting action=mark-packet new-packet-mark=download-packet passthrough=no connection-mark=conn-download&#xA;add chain=prerouting action=mark-connection new-connection-mark=conn-browsing passthrough=yes protocol=tcp dst-port=80 connection-bytes=0-1000000 comment=&quot;CONN-BROWSING&quot;&#xA;add chain=prerouting action=mark-packet new-packet-mark=browsing-packet passthrough=no connection-mark=conn-browsing&#xA;&#xA;&#xA;/queue tree&#xA;add name=&quot;paket browsing&quot; parent=global-in packet-mark=browsing-packet limit-at=0 queue=default priority=1 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s&#xA;add name=&quot;paket download&quot; parent=global-in packet-mark=download-packet limit-at=0 queue=default priority=8 max-limit=0 burst-limit=0 burst-threshold=0 burst-time=0s &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30240" LastEditorUserId="509" LastEditDate="2016-09-04T13:11:22.663" LastActivityDate="2016-09-04T13:11:22.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34602" PostTypeId="1" AcceptedAnswerId="34607" CreationDate="2016-09-04T15:06:45.310" Score="1" ViewCount="739" Body="&lt;p&gt;I came across one UNIX ping command as such : &#xA;&lt;code&gt;$for i in {1..30}; do ping -m $i -c 1 www.website.com; done&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the meaning of &lt;code&gt;-m&lt;/code&gt; here? I have searched online and the only information I could find is that &lt;code&gt;-m&lt;/code&gt; stands for &quot;mark&quot; and according to &lt;a href=&quot;http://man7.org/linux/man-pages/man8/ping.8.html&quot; rel=&quot;nofollow&quot;&gt;this&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;use mark to tag the packets going out. This is useful for variety of&#xA;  reasons within the kernel such as using policy routing to select&#xA;  specific outbound processing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I do not understand the explanation. I suspect that the command is trying to simulate something similar to &lt;code&gt;traceroute&lt;/code&gt;. Can someone explain it in a more understandable way?&lt;/p&gt;&#xA;" OwnerUserId="30243" LastActivityDate="2016-09-05T01:08:34.083" Title="what does &quot;-m&quot; mean in UNIX ping command" Tags="|linux|ping|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34603" PostTypeId="1" AcceptedAnswerId="34604" CreationDate="2016-09-04T15:27:12.427" Score="3" ViewCount="992" Body="&lt;p&gt;In TCP/IP communication, we know that when a sender sends a packet containing some data, the receiver has to return an ACK packet. Does this ACK packet has to carry the same payload that the receiver got or it is just turning on ACK flag in the header and the next serial number?&lt;/p&gt;&#xA;" OwnerUserId="28219" LastActivityDate="2016-09-04T15:35:46.717" Title="TCP acknowledgment payload" Tags="|cisco|routing|tcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34604" PostTypeId="2" ParentId="34603" CreationDate="2016-09-04T15:35:46.717" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;it is just turning on ACK flag in the header and the next serial number&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Repeating the payload would just lead to unnecessary duplicating of data that has to be carried across the network. The Acknowledgement number itself is sufficient to tell the initial sender exactly what bits of data have been received.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-09-04T15:35:46.717" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34605" PostTypeId="2" ParentId="32565" CreationDate="2016-09-04T15:39:00.340" Score="2" Body="&lt;p&gt;This looks like comeware like in 3com or some HP branded (1900s and the enterprise 5000s)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason some people disable STP is to use it as an edge port. The reason for an edge port ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using standard STP with the fast computers of today a computer can boot and request DHCP before STP converges and allows the port to communicate. When this happens a computer doesn't get an ip address and it can't communicate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some other info:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rapid spanning tree helps some of this issue by converging faster. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco portfast will let the port come up first then check for loops. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Disabling STP per port turns it off completely off course. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I personally leave spanning tree on as often as possible. I've seen people plug loops in places you'd never guess! &lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-04T15:39:00.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34606" PostTypeId="2" ParentId="32841" CreationDate="2016-09-04T16:06:45.903" Score="0" Body="&lt;p&gt;There isn't enough info to properly answer but here are a couple things. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing I'd change is having access commands on a trunk port. Remove the switchport access vlan 3 command if you want them to be trunks. (Note... the encapsulation command doesn't work on all cisco switches. If it fails that's ok.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NO Switchport access vlan 3 &#xA;Switchport trunk encapsulation dot1q&#xA;Switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, you've chosen to allow certain vlans. Make them match on both ends. Make sure vlan 1 can get from switch to switch for things like bpdu's for spanning tree. You have allowed vlan 1-99 on one switch and vlan 2-3 on others. I can't tell if those are linked together but vlan 1 isn't allowed and they are 'pruned' diffrently at each end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without the full configurations it's tough to tell but make sure vlan 1 isn't  untagged on your up links attached to cisco switches. I've seen that issue several times. To explain:  Cisco trunk ports tag all allowed vlans unless a native vlan (untagged) is identified. Some vendors untag vlan 1 or untag by having a pvid 1 or people tend to program vlan 1 untagged Without thinking about it. Easy mistake. &lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-04T16:06:45.903" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34607" PostTypeId="2" ParentId="34602" CreationDate="2016-09-04T16:24:41.450" Score="2" Body="&lt;p&gt;It allows you to &quot;mark&quot; the a packet with a 32 bit value that you can later find with 'mark match'. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example '$for i in {1..30}; do ping -m $i -c 1 www.website.com; done' they are doing a ping to www.website.com and marking the ping packet with the value given to i. -c 1 means count 1 or ping once. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference is &lt;a href=&quot;http://andys.org.uk/bits/2010/01/27/iptables-fun-with-mark/&quot; rel=&quot;nofollow&quot;&gt;HERE&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30235" LastEditorUserId="30235" LastEditDate="2016-09-05T01:08:34.083" LastActivityDate="2016-09-05T01:08:34.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34608" PostTypeId="2" ParentId="34465" CreationDate="2016-09-04T16:31:53.197" Score="0" Body="&lt;p&gt;Your symptoms point to an overloaded power supply on the switch. PoE switches, especially low-end models, can usually only handle a few PoE devices. There should be some power commands in the switch to show you the power status, and allow you to enable/disable PoE on the ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Per your comment, it was a power problem, and disabling PoE on the switch solved the problem.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-04T16:31:53.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34609" PostTypeId="2" ParentId="34534" CreationDate="2016-09-04T18:42:23.050" Score="0" Body="&lt;p&gt;Here's a great link for Windows 2012r2 and cisco. I know it's not great to just supply a link but it's so helpful I wanted to share. If I could do a comment instead I would. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.freeccnaworkbook.com/blog/ccna-security/cisco-ios-radius-authentication-with-windows-server-2012-nps&quot; rel=&quot;nofollow&quot;&gt;Link for server 2012r2 and Cisco &lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-04T18:42:23.050" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34610" PostTypeId="2" ParentId="34591" CreationDate="2016-09-05T06:13:27.670" Score="0" Body="&lt;p&gt;I would run at least 1 (2 preferable for future use or if your phone doesn't have a computer port on the bottom) cat 6e from your current switch to the phone and computer location. It will offer consistency and and will offer features you need to set it up properly like vlans, voice options, etc.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If you try splitting pairs you may be able to get a 100mb connections but you will chance burning up the POE (power).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you put another switch at the cable that is there now you will add a failure point to a WAP that probably services several users. That's not a deal breaker though. Also, you would most likely need a switch capable of vlans so you can run your data vlan, phone vlan and any vlans you have for wireless SSIDs. If you don't mind getting a quality switch and programming and securing it properly this could be an option. If your really only adding 1 phone and 1 computer this adds complexity and confusion. If this is a good area to extend your network this could be your opprutunity to do it right.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Running a cable to a currently available switch port programmed as a trunk port or access port with voice features is the &quot;normal&quot; and &quot;clean&quot; method for the situation you've described. Set up the vlans on that port and you should be good to go. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I hope this helps. If you need any otter info let me know. &lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-05T06:13:27.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34611" PostTypeId="1" AcceptedAnswerId="35536" CreationDate="2016-09-05T06:56:04.333" Score="1" ViewCount="136" Body="&lt;p&gt;I store many IP-Addresses in a database. Is there any common notation for a group of IP-Addresses and subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I dither between these notations:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;*.*.*.160/29&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;?.?.?.160/29&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;...160/29&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;x.x.x.160/29&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;0.0.0.160/29&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15619" LastActivityDate="2016-10-05T17:57:52.327" Title="What is the common notation of multiple subnets" Tags="|subnet|ipv6|ip-address|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34612" PostTypeId="2" ParentId="34564" CreationDate="2016-09-05T07:28:09.933" Score="0" Body="&lt;p&gt;People sometimes set these up wroth password of cisco or Cisco but there is no out of box default... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st option start guessing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2nd option... If you have a copy of the config and the password is encrypted with type 5 or 7 enter at &lt;a href=&quot;https://www.ifm.net.nz/cookbooks/cisco-ios-enable-secret-password-cracker.html&quot; rel=&quot;nofollow&quot;&gt;this website&lt;/a&gt; to get the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3rd option is follow the password recovery procedure given by Cisco. Follow it stop by step. I'll put it below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4th option. If you don't care what's on the switch this may be the way to go from the start. I'll add steps below the recovery&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Password recovery &lt;a href=&quot;https://supportforums.cisco.com/discussion/11756896/cisco-switch-29603560-password-recovery-and-factory-default-mode-button&quot; rel=&quot;nofollow&quot;&gt;my Refrences&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;After connecting your console cable (9600,8,none, 1) with putty or hyper terminal and test it's &quot;talking&quot; unplug it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hold down the mode button and plug switch power in. Release the Mode button after approximately 15 seconds when the SYST LED turns solid green. When you release the Mode button, the SYST LED blinks green.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the prompt Issue the following commands. Each one followed by enter key.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flash_init&#xA;&#xA;load_helper&#xA;&#xA;dir flash: &#xA;&#xA;rename flash:config.text flash:config.old&#xA;&#xA;boot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(System will reboot and you have a blank config)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Enter n for initial setup &#xA;&#xA;enable&#xA;&#xA; rename flash:config.old flash:config.text&#xA;&#xA;copy flash:config.text system:running config&#xA;&#xA;config terminal&#xA;&#xA;enable password Cisco (use your password)&#xA;&#xA;enable secret Cisco1  (use your secret)&#xA;&#xA;line vty 0 15&#xA;&#xA;    password Cisco2  (use your telnet password)&#xA;&#xA;    login&#xA;&#xA;line con 0&#xA;&#xA;    password Cisco3  (use your console password)&#xA;&#xA;exit&#xA;&#xA;exit &#xA;&#xA;Write mem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Done with recovery.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to factory reset there are two things that need deleted. Startup config and the vlan database. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issue these commands and answer no to saving anything. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;delete flash:vlan.dat&#xA;&#xA;Write erase&#xA;&#xA;Reload&#xA;&#xA;No to any save questions&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch will be ready at reboot.&lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-05T07:28:09.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34614" PostTypeId="2" ParentId="34569" CreationDate="2016-09-05T08:09:51.370" Score="1" Body="&lt;p&gt;Don't do it - see my comment. ;-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you really really must, I &lt;em&gt;think&lt;/em&gt; this is possible by using a combination of PBR and NAT, i.e. a variation on &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/6505-nat-on-stick.html&quot; rel=&quot;nofollow&quot;&gt;NAT on a stick&lt;/a&gt; but with a local policy (cfr &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfpbr.html&quot; rel=&quot;nofollow&quot;&gt;Policy Based Routing&lt;/a&gt;) since the unreachables are locally generated.&#xA;As you said it is an odd question so forgive me for not being 100% sure this will work, please consider this just as food for thought/experimentation.&#xA;One particular thing I'm not sure of is where to put the &quot;nat inside&quot; and &quot;nat outside&quot;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;inside on the WAN interface, outside on the loopback&lt;/li&gt;&#xA;&lt;li&gt;inside on the loopback, outside on the WAN&lt;/li&gt;&#xA;&lt;li&gt;inside on one loopback, outside on another loopback (requiring 2 clauses in the PBR routemap, one to move from WAN to first loopback, second to move from first loopback to other loopback).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-05T08:09:51.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34615" PostTypeId="2" ParentId="23590" CreationDate="2016-09-05T08:45:24.150" Score="1" Body="&lt;p&gt;Most likely your router or isp is blocking them. Your device may not block icmp outgoing but if it blocks incoming it can stop your ping. &lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-05T08:45:24.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34617" PostTypeId="2" ParentId="24751" CreationDate="2016-09-05T09:16:10.343" Score="2" Body="&lt;p&gt;Here is the brocade documentation. &lt;a href=&quot;http://www.brocade.com/content/html/en/administration-guide/FI_08030_ADMIN/GUID-B427DDA2-C8F4-40F7-A100-9A8E7DC55156.html&quot; rel=&quot;nofollow&quot;&gt;Brocade doc&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ports will follow 802.3af and at standards on brocade when the inline power command is used . These standards will monitor and adjust power as necessary based on its capability and based on the end device requirements. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quote from reference ...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Increased electrical power - POE Plus nearly doubles the amount of electrical power available to powered devices, to 25.5 watts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Compatible with 802.3af POE - POE Plus switches and injectors will recognise 802.3af powered devices and enable POE to them as normal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;POE Plus powered devices can also be connected to 802.3af POE switches or injectors, and are supposed to restrict how much power they use accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Smart power budgeting - 802.3at includes scope for power sources and powered devices to communicate with each other to negotiate an allowance of electrical power.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refrence for POE power classes and versions &lt;a href=&quot;http://www.veracityglobal.com/resources/articles-and-white-papers/poe-explained-part-1.aspx&quot; rel=&quot;nofollow&quot;&gt;POE multipart white paper&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-05T09:16:10.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34618" PostTypeId="1" AcceptedAnswerId="34653" CreationDate="2016-09-05T09:16:42.523" Score="2" ViewCount="645" Body="&lt;p&gt;I would like to know if it's possible to prevent some BGP prefixes from entering the RIB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm receiving full internet routes from 2 ISPs, and I'm getting duplicate paths in BGP table, but only the best goes to the RIB.&#xA;However, my routers have a limitation on the number of routes allowed in the RIB, and I would like to prevent some BGP routes from entering the RIB (more specifically, the ones that are tied, so that the router just uses the default route).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know all kind of filtering can be done to prevent routes from entering the BGP table, but is it possible to use route-maps to do what I want? Where would I apply them? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="30260" LastActivityDate="2016-09-06T12:51:31.333" Title="Prevent some BGP prefixes from entering the RIB" Tags="|bgp|bgp-ipv6|route-filter|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34620" PostTypeId="2" ParentId="34611" CreationDate="2016-09-05T10:03:21.847" Score="0" Body="&lt;p&gt;Zeroes should be the preferred way, consider the default route of 0.0.0.0/0 which matches every single subnet. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-09-05T10:03:21.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34621" PostTypeId="2" ParentId="34618" CreationDate="2016-09-05T10:08:07.770" Score="1" Body="&lt;p&gt;You may filter same way as you would filter bogon networks with prefix lists.&#xA;For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list rfc1918 deny 10.0.0.0/8 le 32&#xA;&#xA;router bgp xxx&#xA; neighbor x.x.x.x prefix-list rfc1918 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But routers with full BGP feeds should avoid default routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other ways to filter incoming prefixes is to use distribute lists with access-lists.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="8499" LastEditDate="2016-09-05T17:11:27.077" LastActivityDate="2016-09-05T17:11:27.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34622" PostTypeId="2" ParentId="34611" CreationDate="2016-09-05T10:09:03.797" Score="0" Body="&lt;p&gt;In all my days I've never seen anyone want to do this but if you really must have a technically correct description you need to use a mask, not CIDR notation and for all /29 nets I guess that would be &quot;network 0.0.0.160 mask 0.0.0.248&quot;&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-09-05T10:09:03.797" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34623" PostTypeId="2" ParentId="34591" CreationDate="2016-09-05T11:19:32.210" Score="0" Body="&lt;p&gt;Some IP phones also have a passthrough port. If this is the case, you can connect the IP phone to the switch so it gets PoE and then daisy chain the PC off the phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two possible problems:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.If the phone develops a fault, the PC's LAN connection may be affected &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.If you need to run the phone / PC in separate VLANs, this is more problematic (but generally still achievable)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise, it depends on your environment and the amount of time / effort / cost you're willing to invest. The 100% best answer is to run additional cables back to the comms rack. This will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the past I have split a CAT5 cable to connect two devices (you need a send and receive pair per connection) and this will work up to 100Mb/s although it needs some creative cabling. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regardless, if you need to connect 3 devices this is not an option. If you've got to run one cable, you might as well run 2 (or three, or more) to give you more flexibility later on.&lt;/p&gt;&#xA;" OwnerUserId="30262" LastActivityDate="2016-09-05T11:19:32.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34624" PostTypeId="2" ParentId="17504" CreationDate="2016-09-05T12:34:21.353" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I know that 192.168.0.0/16 are adresses reserved for private networks. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What about 192.169.0.0/16 addresses &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Those are regular public IPv4 addreseses allocated to various networks. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;and other.. in 192.0.0.0/8. Are they routable in the &quot;Internet&quot; or are they also private?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most of the block is regular public IPs but there are a number of special things in there. Special allocations are documented at &lt;a href=&quot;http://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.0.0.0/24 is reserved for IETF protocol assignments. &#xA;  192.0.0.0/29 is reserved for clients of ds-lite 464xlat and similar&#xA;  192.0.0.8/32 is reserved as a dummy address for 4rd&#xA;  192.0.0.9/32 is an anycast address for &quot;port control protcol&quot; &#xA;  192.0.0.170/32 and 192.0.0.171/32 are used for DNS64 discovery&#xA;192.0.2.0/24 is reserved for documentation, examples etc&#xA;192.31.196.0/24 is used for &quot;AS112 Redirection Using DNAME&quot;&#xA;192.52.193.0/24 is used for &quot;Automatic Multicast Tunneling&quot;&#xA;192.88.99.0/24 is used as an anycast prefix for 6to4 relays&#xA;192.168.0.0/16 is private use&#xA;192.175.48.0/24 is Direct Delegation AS112 Service&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2018-02-18T01:13:02.253" LastActivityDate="2018-02-18T01:13:02.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34625" PostTypeId="2" ParentId="34600" CreationDate="2016-09-05T13:07:18.453" Score="2" Body="&lt;p&gt;For the dedicated chunks, simple rate limiting (which may even be available on a layer 2 switch - several of mine can do that) is typical - the customer can do, or not do, what they want to manage their use of their chunk to use it most effectively. If they are not themselves oversubscribing it, they may not need to do much.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For shared and/or over-subscribed BW, I find a traffic shaping scheme that divides the available BW among the users of that BW (with or without priority levels, as appropriate) works better than simple limiting, since 1 user gets (almost) all there is, gets their stuff, gets out of the way - while a rate limit for all users means the network is slow all the time, even if it's mostly idle - and users with large data to move are on there much longer. I do that in a router, but since a layer 3 switch IS a router, some may have that sort of thing built in.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-09-05T13:07:18.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34627" PostTypeId="1" AcceptedAnswerId="34636" CreationDate="2016-09-05T14:24:51.033" Score="2" ViewCount="1322" Body="&lt;p&gt;Is there any specific advantage that VLSM or FLSM has over the other when it comes to route summarization? I was of the opinion that neither had an advantage over the other when it came to route summarization, but I just wanted to confirm. &#xA;It's easier for us (humans) to do subnetting via FLSM but a router doesn't care does it?&lt;/p&gt;&#xA;" OwnerUserId="30265" LastActivityDate="2016-09-05T21:06:56.903" Title="Difference in VLSM and FLSM in Rute Summarisation" Tags="|subnet|route-summarization|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34628" PostTypeId="1" AcceptedAnswerId="34631" CreationDate="2016-09-05T15:04:58.987" Score="3" ViewCount="1485" Body="&lt;p&gt;Is it easier to find subnet overlaps in VLSM and FLSM. I really don't see the difference. The algorithm to find overlaps in VLSM and FLSM is not different right? &#xA;Both of them involve finding the broadcast addresses and checking if they are different/same?&lt;/p&gt;&#xA;" OwnerUserId="30265" LastEditorUserId="30265" LastEditDate="2016-09-05T18:26:10.307" LastActivityDate="2016-09-05T18:26:10.307" Title="Subnet Overlap for VLSM and FLSM" Tags="|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34629" PostTypeId="2" ParentId="34611" CreationDate="2016-09-05T16:11:39.697" Score="1" Body="&lt;p&gt;I know of no standard. In documentation, when possible, I would replace by letters:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;x.y.z.160/29&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;followed by something like &quot;where x.y.z is the network of each branch office&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In ACLs I would possibly use a netmask with holes, such as 0.0.0.160 netmask 0.0.0.248, but I would not expect it to be understood even by an &quot;expert&quot; firewall administrator, and I'm not sure that Cisco ACLs still support this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think your other possibilities are harder to understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your network architecture should be explained to non-experts and it cannot be represented in x.y.z.160/29 notation, I submit that it is a problem more in the architecture than in the possibilities of the standardized nomenclature.&lt;/p&gt;&#xA;" OwnerUserId="22874" LastActivityDate="2016-09-05T16:11:39.697" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34630" PostTypeId="1" CreationDate="2016-09-05T17:21:40.163" Score="2" ViewCount="1028" Body="&lt;p&gt;I have a question about hole punching. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A-Client&#xA;B-Client&#xA;S-Rendezvous server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both A and B connects to S. S learns the random NAT ports of clients. Then sends the IP/Port info to clients. Clients have each others IP/Port info from now on. Client A send a packet to B with a new port because NAT uses a new port if the destination is different. Than client B's NAT device receives the packet and drops it. So client B doesn't know the port of A which A uses to communicate with B, not the rendezvous server. Than B sends a packet to A's port that A used to communicate with server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Won't A's NAT device drop the connection because A used this port for a different destination ?&lt;/p&gt;&#xA;" OwnerUserId="30268" LastEditorUserId="93477" LastEditDate="2024-02-12T05:01:50.947" LastActivityDate="2024-02-12T05:01:50.947" Title="Is NAT hole punching feasible, when the external source port of NAT changed for different destination?" Tags="|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="34631" PostTypeId="2" ParentId="34628" CreationDate="2016-09-05T17:34:20.527" Score="0" Body="&lt;p&gt;There is no possibility of an overlap with FLSM. There can only be an overlap with VLSM. To that end, it will be much easier to &quot;find&quot; an overlap in FLSM, since there never is one. Whereas &quot;finding&quot; a overlap in VLSM will involve some binary math.  Let me explain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR /&gt;&#xA;FLSM, or &lt;em&gt;fixed&lt;/em&gt;-length subnet mask implies every mask is the same across multiple subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, breaking up a Class C network (aka, /24) into FLSM sub-networks of /27 would yield ONLY these results:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;x.x.x.0/27&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.32/27&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.64/27&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.96/27&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.128/27&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.160/27&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.192/27&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.224/27&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These are the only 8 possible /27's within a /24. Every NetID listed above represents a subnetwork that includes addresses of the NetID itself, and the following 31 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no such thing as a x.x.x.150/27 address, the NetID and mask do not pair, so there is no way to have a /27 range represent 150-181 (and would therefore introduce an overlap possibility).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, &lt;strong&gt;in FLSM, there is no possibility of an overlap&lt;/strong&gt; if you are using NetID's and Masks that pair properly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR /&gt;&#xA;VLSM, or &lt;em&gt;variable&lt;/em&gt;-length subnet mask implies every mask is not necessarily the same across multiple subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, there are countless ways to break up a /24 into multiple subnetworks, one of which might be...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;x.x.x.0/27&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.32/28&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.48/29&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.56/29&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.60/30&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.64/27&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.96/28&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.112/28&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.128/26&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.192/28&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.208/28&lt;/li&gt;&#xA;&lt;li&gt;x.x.x.224/27&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To find overlaps, you would have to calculate the IP range for each subnet, and ensure that no IP addresses are &quot;counted&quot; twice. That involves doing the &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/3675&quot;&gt;traditional subnetting&lt;/a&gt; math.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the masks differ for each subnetwork, &lt;strong&gt;in VLSM, there is absolutely a possibility that an overlap exists&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR /&gt;&#xA;To close, I pose the question to you. Every NetworkID and SubnetMask above pair properly, which is to say they represent a valid subnetwork and subnet mask combination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As we learned, with properly paired FLSM, there is no overlap. With properly paired VLSM, there &lt;em&gt;might&lt;/em&gt; be an overlap. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the Ssb-network list above, there &lt;em&gt;is&lt;/em&gt; an overlap in the VLSM range above. Can you find which it is? How easy was it, comparatively?&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-09-05T17:34:20.527" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34635" PostTypeId="1" CreationDate="2016-09-05T21:01:17.827" Score="1" ViewCount="534" Body="&lt;p&gt;I know an old course I had on the network that the army (at least the French army) does not use the OSI model.&#xA;This is a 4-layer model (my memory, I'm not sure) and not seven layers as the OSI model.&#xA;Someone has this information?&#xA;thank you&lt;/p&gt;&#xA;" OwnerDisplayName="user30273" LastActivityDate="2016-09-07T08:41:01.167" Title="Army not use OSI model" Tags="|osi|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34636" PostTypeId="2" ParentId="34627" CreationDate="2016-09-05T21:06:56.903" Score="2" Body="&lt;p&gt;Danis, you have the right idea. To answer the question what is the diffrence ...  FLSM can be thought of like address summarization that can't be taken apart. FLSM can be efficient at routing because it doesn't even need the whole IP to do its routing but it is an inefficient use of ip addresses since it reserves the whole block for 1 subnet only. The FLSM is usually a string of binary digits shown over the subnet number, telling the router which parts of the subnet number to look at. A binary &quot;1&quot; over a particular digit in the subnet number says &quot;Pay attention to this digit.&quot; A &quot;0&quot; says &quot;Ignore this digit.&quot; Allowing it to not focus on the whole IP are. Reference click &lt;a href=&quot;http://searchnetworking.techtarget.com/definition/fixed-length-subnet-mask&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLSM summerization is efficient also when you do route summarization by combining subnet, but allows the addresses to be broken into classless (not forced to class A, B or C) subnets.&lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-05T21:06:56.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34637" PostTypeId="2" ParentId="34533" CreationDate="2016-09-05T22:30:13.160" Score="1" Body="&lt;p&gt;No. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the &lt;a href=&quot;https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-spec-v1.0.0.pdf&quot; rel=&quot;nofollow&quot;&gt;OpenFlow 1.0 specification&lt;/a&gt; (since you are using POX, I can assume that is the version you are using.) the cookie field is only used to identify a flow retrieved via flow stats or expired.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The cookie field is an opaque data value that is set by the controller. It is not used in any matching functions, and thus does not need to reside in hardware.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you want to delete or modify using the cookie you need to use OpenFlow 1.1 or later.From the &lt;a href=&quot;http://archive.openflow.org/documents/openflow-spec-v1.1.0.pdf&quot; rel=&quot;nofollow&quot;&gt;OF 1.1 specification&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Modify and delete commands can also be filtered by cookie value, if the cookie_mask field contains&#xA;  a value other than 0. This constraint is that the bits specified by the cookie_mask in both the&#xA;  cookie field of the flow mod and a flow’s cookie value must be equal. In other words, (flow.cookie &amp;amp;&#xA;  flow mod.cookie mask) == (flow mod.cookie &amp;amp; flow mod.cookie mask).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="30276" LastActivityDate="2016-09-05T22:30:13.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34638" PostTypeId="1" AcceptedAnswerId="34796" CreationDate="2016-09-06T00:28:24.773" Score="0" ViewCount="1210" Body="&lt;p&gt;What are the reasons for using only contiguous addresses in subnets? Will something malfunction if we use dis contiguous IP addresses? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware that RIP and IGRP will auto-summarize which results in confusing/incomplete entries in the routers routing tables. I am just curious if there are any additional reason?&lt;/p&gt;&#xA;" OwnerUserId="30265" LastActivityDate="2016-09-11T22:13:56.413" Title="Discontiguous Addresses in IP Subnets" Tags="|ipv4|ip|subnet|eigrp|rip|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="34640" PostTypeId="2" ParentId="34581" CreationDate="2016-09-06T02:40:30.110" Score="2" Body="&lt;p&gt;This is actually not possible using rib-groups - if you're receiving the routes from another PE, then the NRLI will be carried as type &lt;code&gt;inet-vpn&lt;/code&gt; instead of &lt;code&gt;inet-unicast&lt;/code&gt; which you need in order to be installed in &lt;code&gt;inet.0&lt;/code&gt; (even though they are ultimately installed as &lt;code&gt;inet-unicast&lt;/code&gt; in the &lt;code&gt;VRF.inet.0&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To achieve the same functionality, you might need to come at it from a different angle:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;On the far-end PE (the one that learnt the route in the first place) leak the route (using rib-groups) into inet.0 on the far-end PE.&lt;/li&gt;&#xA;&lt;li&gt;Make sure your BGP link from the far-end PE and the near-end PE is configured for both &lt;code&gt;inet-vpn&lt;/code&gt; and &lt;code&gt;inet-unicast&lt;/code&gt; - this will carry the route from the far-end PE to the near-end PE and it will be installed into inet.0&lt;/li&gt;&#xA;&lt;li&gt;Allow next-hop resolution for inet.0 to consult your VRF as well: &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set routing-options resolution rib inet.0 resolution-ribs  [ &#xA;VRF.inet.0 inet.0 ]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously this solution has a few drawbacks, but it is probably the simplest way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another solution would be to configure logical-tunnel interfaces between your VRF and inet.0 on the near-end PE, form an adjacency and export the route via BGP.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="1392" LastEditDate="2016-09-06T02:45:31.683" LastActivityDate="2016-09-06T02:45:31.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34641" PostTypeId="1" AcceptedAnswerId="35567" CreationDate="2016-09-06T02:43:20.167" Score="1" ViewCount="161" Body="&lt;p&gt;I am working with a customer with atleast 2 private data centers.  They have no terminal servers providing console access to their networking gear (switches and routers and firewalls).  They have built a network management sub-network on top of the underlying data network.  They have shut down both data centers for several hours twice already and lose management access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am wrong in thinking this is a major problem?  Shouldn't every data center have out of band access to their gear?  I am thinking they should have a 4G LTE and/or analog line w modem into terminal servers (for example, Cisco routers with async network modules and octa cables into each devices console port).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other proper means of out of band management for networking gear than a terminal server with octa cable into each device?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-07T02:13:07.460" Title="Value of Terminal Server in a Data Center" Tags="|management|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34643" PostTypeId="1" CreationDate="2016-09-06T02:59:04.630" Score="1" ViewCount="852" Body="&lt;p&gt;I am trying to allocate 256 IP addresses to &lt;code&gt;Subnet1&lt;/code&gt;, 128 IP addresses to &lt;code&gt;Subnet2&lt;/code&gt; and 128 addresses to &lt;code&gt;Subnet3&lt;/code&gt; using the IP address 120.130.10.0/23&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have setup in GNS3 is a router connected to 3 ethernet switches, and each of these ethernet switches have a VPC connected for testing purposes. &lt;a href=&quot;https://i.stack.imgur.com/CnMlh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/CnMlh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I think should be done is assign 120.130.10.1-120.130.11.2 to &lt;code&gt;Subnet1&lt;/code&gt;, 120.130.11.3-120.130.11.130 to &lt;code&gt;Subnet2&lt;/code&gt; and then since there isn't 128 IP's left, I should create a new network space 120.130.12.0/24 to allocate 120.130.12.1-120.130.12.128 to &lt;code&gt;Subnet3&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm assuming that what I've said above works ? (beginner network knowledge)&#xA;But I run into an issue when I'm trying to apply this to GNS3 because I can't assign two subnets to 120.130.10.0/3 because I get the error &lt;code&gt;&quot;120.130.10.0 overlaps with FastEthernet0/1&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I would like to know how to fix this problem when it comes to configuring the routers, or any other problems you can see with my logic as I'm new and any help will be appreciated&lt;/p&gt;&#xA;" OwnerUserId="30278" LastActivityDate="2017-06-04T07:27:08.583" Title="/23 IP Space Allocation in GNS3" Tags="|ip|subnet|gns3|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34644" PostTypeId="2" ParentId="34641" CreationDate="2016-09-06T03:09:15.757" Score="2" Body="&lt;p&gt;Many devices have management ports (usually Ethernet) that can be used for out of band management, similar to a terminal server.  You also have to consider access to other equipment like servers, storage, etc.  But your main point remains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine a lot depends on whether there are staff at the data center and/or how long it takes someone to get there if there were a problem.  Dialup modems or LTE have risks, and it's up to the customer to decide if the risks and expense outweigh the benefits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say that if the data center was far away, having out of band management would be important for maintaining system availability.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-06T03:09:15.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34645" PostTypeId="2" ParentId="34643" CreationDate="2016-09-06T03:14:14.367" Score="1" Body="&lt;p&gt;You cannot assign IP addresses to the subnets the way you describe. The number of addresses in a subnet must be a power of two, and that includes the unusable-for-hosts network and broadcast addresses. If you must have 256 hosts in one subnet, you will need to use a &lt;code&gt;/23&lt;/code&gt; network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you cannot have overlapping subnets configured in a router, as you have discovered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;This answer&lt;/a&gt; will give you the basics on how to subnet correctly. You need to convert the addresses and masks to binary to do it correctly, and you will see how it works. In binary, it becomes obvious.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-09-06T03:14:14.367" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34646" PostTypeId="2" ParentId="34630" CreationDate="2016-09-06T05:51:22.080" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Client A sends a packet to B with a new port because NAT uses a new port if the destination is different.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Client A will use new port for different destination only if client A is using SYMMETRIC NAT which is the biggest problem in VOIP communication. Symmetric NAT not only translates your internal IP but also translates your port each time you connect to new destination. Rendezvous server S doesn't know that Client A has changed its port for contacting Client B.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Then B sends a packet to A's port that A used to communicate with server.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When client B sends a packet to A, that will be useless because B doesn't know that A has changed its port and the port which client B has taken from the Rendezvous server is obviously closed.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Won't A's NAT device drop the connection because A used this port for a different destination?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Exactly client A will block that traffic from B because client B has sent packet to that port of A which was meant to be opened for rendezvous server and that port is now closed. Even if that port is open it will still not accept the packets from B because that port is only open for rendezvous server. Anything from outside will be discarded.&#xA;That's why symmetric NAT is always a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;If either of the client was not using symmetric NAT then simply client A sends a &quot;UDP packet&quot; to that IP:port of B which was taken by A from the Rendezvous server earlier. Ultimately this packet will be blocked too by B because B didn't request anything from A but A still thinks that its packet has reached to B because packet was sent over UDP.&#xA;Then B will send a packet to A on that IP:Port on which A was listening to rendezvous server. But this time A has to accept the packet from B because A thinks that this a response of that request which A has sent to B earlier. Then A will send a packet to B again and B will accept it as a response. Connection is established. This is called UDP hole punching.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;But how the communication will be established in the case of symmetric NAT?&lt;/strong&gt;&#xA;The standard solution is using the TURN server which stands for traversal utility over relay NAT. Turn server will act as a middle-men between both the clients and it won't be affected even If either or both the clients are behind symmetric NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gl3GK.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gl3GK.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of TURN server clients can also use DMZ and Port forwarding. Using either of them will redirect every request and response directly to the host behind NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why can't you use STUN server?&lt;/strong&gt;&#xA;Unfortunately, even STUN server fails to initialize session if one or both clients are behind Symmetric NAT.&lt;/p&gt;&#xA;" OwnerUserId="28180" LastEditorUserId="28180" LastEditDate="2016-09-06T12:11:12.533" LastActivityDate="2016-09-06T12:11:12.533" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34647" PostTypeId="1" AcceptedAnswerId="34650" CreationDate="2016-09-06T06:30:45.927" Score="2" ViewCount="387" Body="&lt;p&gt;Is there any privilege using trunk mode over access mode when only one vlan is allowed on the trunk port?an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#switchport mode access vlan 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&amp;amp;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#switchport mode trunk&#xA;#switchport trunk allowed vlan 2 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="23982" LastEditorUserId="8499" LastEditDate="2017-02-13T17:45:23.007" LastActivityDate="2017-02-13T17:45:23.007" Title="switchport mode" Tags="|cisco|switch|vlan|switching|" AnswerCount="7" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34648" PostTypeId="1" CreationDate="2016-09-06T06:52:28.677" Score="0" ViewCount="210" Body="&lt;p&gt;Can anybody help me how to identify if there is any IP conflict within my network using &lt;strong&gt;Cisco LMS&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="30281" LastEditorUserId="22692" LastEditDate="2016-09-06T13:52:00.830" LastActivityDate="2017-10-31T21:51:40.230" Title="How to detect IP conflict using cisco LMS?" Tags="|cisco|ip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34649" PostTypeId="2" ParentId="34647" CreationDate="2016-09-06T07:02:19.833" Score="2" Body="&lt;p&gt;The difference is that in the latter scenario, frames will be sent over the link with a 802.1q tag with vlan ID 2, and only frames tagged in the same way will be permitted on ingress. In other words the other side of the link needs be configured the same way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you also configure the port to have vlan 2 as the native vlan, which is never tagged (unless you use a different trunking protocol like ISL). So in that scenario the behaviour is exactly the same.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-06T07:02:19.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34650" PostTypeId="2" ParentId="34647" CreationDate="2016-09-06T07:52:22.960" Score="3" Body="&lt;p&gt;Provide both sides of the link are configured the same way, both method will work.&lt;br&gt;&#xA; But networks evolve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If latter you want to add more vlans on the link, and it's configured as access, you will have to convert it to trunk and this will cause a service interruption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If configured as trunk, you will only need to allow the new vlan, without disrupting service, so it will be easier.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-09-06T07:52:22.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34651" PostTypeId="2" ParentId="34647" CreationDate="2016-09-06T08:13:44.540" Score="3" Body="&lt;p&gt;the difference is that ;if you use &lt;strong&gt;&lt;em&gt;trunk mode&lt;/em&gt;&lt;/strong&gt; ,&lt;code&gt;VLANs 1 and 1002 through 1005 are reserved VLANs and cannot be removed from any trunk link&lt;/code&gt; , automatically the native vlan will pass through the link with the allowed vlans . so you will get &lt;strong&gt;&lt;em&gt;OTHER&lt;/em&gt;&lt;/strong&gt; vlan on the trunk . but when you use access mode you made sure that &lt;strong&gt;&lt;em&gt;only one&lt;/em&gt;&lt;/strong&gt; vlan will pass through the link. please make use of &lt;a href=&quot;https://supportforums.cisco.com/document/11836/how-define-vlans-allowed-trunk-lin&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="17452" LastEditDate="2016-09-06T09:28:01.050" LastActivityDate="2016-09-06T09:28:01.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34652" PostTypeId="2" ParentId="34648" CreationDate="2016-09-06T09:26:52.487" Score="2" Body="&lt;p&gt;Generally an IP address conflict is logged. Do &quot;show log&quot;. You will see something like &lt;strong&gt;&lt;em&gt;&lt;code&gt;Duplicate address 10.25.32.15 on Vlan25 sourced by 0011.2233.4455 and there will be another message with the other mac address&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt;. so easly you can log those message in your LMS server. as you know LMS has a day 1 syslog support out of the box. Means as soon as LMS is installed, it is ready to serve you as a Syslog Server. Though it may not have so many features like other dedicated syslog Server, but it has important syslog related features, being syslog is among one of the hundreds of things LMS does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All you have to do to make syslog work is to &lt;strong&gt;&lt;em&gt;&lt;code&gt;Subscribe Syslog Collector on the server from Admin &amp;gt; Collection Settings &amp;gt; Syslog and configure device to send syslog to LMS Server&lt;/code&gt;&lt;/em&gt;&lt;/strong&gt;. Then all you have to do is to Generate Syslog Report from LMS GUI.&#xA;othere methodes to define the ip conflict can be found in &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13563/identifying-an-ip-address-conflict-through-a-cisco-switch&quot;&gt;this link&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17452" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-09-06T09:26:52.487" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34653" PostTypeId="2" ParentId="34618" CreationDate="2016-09-06T09:52:30.930" Score="1" Body="&lt;p&gt;I found what I was looking for.&#xA;It is possible to filter BGP routes from entering the RIB. You just have to use the &lt;em&gt;table-map&lt;/em&gt; command to filter using a route-map.&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-3s/irg-xe-3s-book/bgp-selective_route_download.pdf&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/iproute_bgp/configuration/xe-3s/irg-xe-3s-book/bgp-selective_route_download.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks anyway.&lt;/p&gt;&#xA;" OwnerUserId="30260" LastActivityDate="2016-09-06T09:52:30.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34654" PostTypeId="1" AcceptedAnswerId="34656" CreationDate="2016-09-06T10:28:35.247" Score="2" ViewCount="339" Body="&lt;p&gt;I was learning about the differences between TCP and UDP and I came across this rather inexplicable information on &lt;a href=&quot;https://en.wikibooks.org/wiki/Communication_Networks/TCP_and_UDP_Protocols&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; page. It says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Most users think of TCP and IP as a tightly knit pair, but TCP can be, and frequently is, used with other transport protocols.&lt;/p&gt;&#xA;&lt;p&gt;For example, TCP or parts of it are used in the File Transfer Protocol (FTP) and the Simple Mail Transfer Protocol (SMTP), both of which do not use IP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="30284" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-09-06T14:51:36.517" Title="Why do FTP and SMTP not use IP?" Tags="|tcp|ip|transport-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34656" PostTypeId="2" ParentId="34654" CreationDate="2016-09-06T11:46:54.197" Score="14" Body="&lt;p&gt;TCP and UDP are layer 4 (transport) protocols.  They &lt;strong&gt;always&lt;/strong&gt; use IP as the layer 3 (network) protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The text you quote is just plain wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may notice that the page you reference was marked for cleanup.  That should indicate that you should be suspicious of the accuracy.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-06T11:46:54.197" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34657" PostTypeId="2" ParentId="34647" CreationDate="2016-09-06T12:11:06.223" Score="0" Body="&lt;p&gt;The only privilege you get if using a trunk port is multiple VLAN tagging is allowed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using trunk ports where an access port can do the job can create security issues and it will also slow down the network, as all broadcast from allowed VLAN will be forwarded to all the trunk ports by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It all depends on the purpose of device connected to the port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose, if the device acting as a Network attached Storage server then it should be connected to a trunk port. Otherwise clients from multiple VLAN won't be able to access the required storage.&lt;/p&gt;&#xA;" OwnerUserId="30015" LastEditorUserId="30015" LastEditDate="2016-09-07T17:47:15.503" LastActivityDate="2016-09-07T17:47:15.503" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34661" PostTypeId="2" ParentId="6268" CreationDate="2016-09-06T12:54:05.643" Score="3" Body="&lt;p&gt;There might be a couple of solutions for you:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Buy more public IP from your ISP. This way, you can dedicate each public IP to each of your services provide web access.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Having all 443 traffic forwarded to a proxy. My working place uses nginx so I would suggest that. Offload the SSL cert at the proxy, read the content of the header to determine the service and forward that traffic to the corresponding server. An F5 LTM module is also perfect for the job. But it is a bit costly. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30293" LastActivityDate="2016-09-06T12:54:05.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34663" PostTypeId="1" CreationDate="2016-09-06T13:15:23.727" Score="4" ViewCount="1634" Body="&lt;p&gt;I have set the username **** privilege 5 secret **** &amp;amp; applied aaa via console. now unable to access switch through console.&#xA; After entering enable showing authentication error. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;can someone help me to resolve the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;config for console:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username cisco privilege 5 secret cisco &#xA;line vty 0 4 login local &#xA;end &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;config for aaa &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model &#xA;aaa authentication login default group tacacs+ local &#xA;aaa authentication enable default group tacacs+ enable &#xA;aaa authorization commands 1 default group tacacs+ local &#xA;aaa authorization commands 15 default group tacacs+ local &#xA;aaa accounting exec default start-stop group tacacs+ &#xA;aaa accounting commands 1 default start-stop group tacacs+ &#xA;aaa accounting commands 15 default start-stop group tacacs+ &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;aaa accounting network default start-stop group tacacs+&lt;/p&gt;&#xA;" OwnerUserId="30297" LastEditorUserId="2142" LastEditDate="2016-09-06T14:14:40.117" LastActivityDate="2016-09-06T15:03:05.023" Title="Authentication error" Tags="|aaa|cisco-3750|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="34667" PostTypeId="2" ParentId="34647" CreationDate="2016-09-06T14:07:32.893" Score="2" Body="&lt;p&gt;If you only have one VLAN traversing the link then you should follow best practices and use &lt;strong&gt;switchport mode access&lt;/strong&gt;.  Allowing VLAN 1 and 1002-1005 across the trunk provides a potential security issue as VLAN 1 carries a lot of system data for Cisco.  Not to mention that all traffice coming from the other end (assuming the other end is a server or client) will not belong to a VLAN and that can cause further issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try to stick to a more restrictive strategy.  If I don't need for multiple VLANs to traverse a link, I always set it up as an access port.  &lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2016-09-06T14:07:32.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34668" PostTypeId="2" ParentId="34647" CreationDate="2016-09-06T14:17:24.353" Score="1" Body="&lt;p&gt;As others have point out, you can tag frames on a trunk with the VLAN, and most end devices don't understand VLAN tags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a couple of things that also come into play on a Cisco switch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the recommended global &lt;code&gt;spanning-tree  portfast  default&lt;/code&gt; and &lt;code&gt;spanning-tree  portfast  bpduguard  default&lt;/code&gt; commands only affect access ports. You must specifically use the &lt;code&gt;trunk&lt;/code&gt; keyword to affect trunks, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-09-06T14:41:24.890" LastActivityDate="2016-09-06T14:41:24.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34670" PostTypeId="2" ParentId="34663" CreationDate="2016-09-06T15:03:05.023" Score="2" Body="&lt;p&gt;After reviewing your configuration it appears that you applied &lt;strong&gt;login local&lt;/strong&gt; only the VTY lines and not the console port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you no longer have access to the device you will need to initate a password recovery for the device following the instructions listed &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-2950-series-switches/12040-pswdrec-2900xl.html&quot; rel=&quot;nofollow&quot; title=&quot;here&quot;&gt;here&lt;/a&gt;.  This will allow you to log into the device and make changes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will then need to add the following configurations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;line con 0&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;login local&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once that has been added you should be able to login via the console port using a locally created account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two more small pieces of advice:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Don't use Cisco as your username.  Always create a unique username for your organization.  This adds a small layer of obscurity to your security posture.&lt;/li&gt;&#xA;&lt;li&gt;Don't forget to perform a &lt;strong&gt;copy run start&lt;/strong&gt; after you apply &lt;strong&gt;login local&lt;/strong&gt; to your console port.  You don't want to reboot later on and realize that you can no longer console in.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2016-09-06T15:03:05.023" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34672" PostTypeId="1" AcceptedAnswerId="34673" CreationDate="2016-09-06T19:45:55.593" Score="2" ViewCount="1242" Body="&lt;p&gt;We are in the process of planning to phase out a Sonicwall tz205 in our office.  i am hoping to replace it with a CISCO ASA 5516 specifically.  We have three networks in house the main production network (LAN and Wireless) on one interface, a public wifi VLAN on a sub-interface on the same interface as the main network. and VOIP phones on a second interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first question is if the ASA is capable of being a DHCP server for a sub interface (public WIFI), and the Phone networks?  I have been unable to find any documentation answering this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second is the ASA 5516 capable of routing traffic between the phone network and the production network?&lt;/p&gt;&#xA;" OwnerUserId="30308" LastActivityDate="2021-01-23T09:34:26.997" Title="can a cisco ASA be configured as a DHCP server for a VLAN on a subinterface? and route packets between VLANs?" Tags="|routing|cisco-asa|dhcp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34673" PostTypeId="2" ParentId="34672" CreationDate="2016-09-06T19:57:32.160" Score="3" Body="&lt;p&gt;Yes, your ASA can act as a DHCP server, but the thing to remember is that this is not the primary purpose of the ASA and as such it doesn't perform it as well as a dedicated DHCP server.  It can perform it well enough for your clients though.  I am uncertain about the VOIPs as the documentation deals specifically with Cisco VOIPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/dhcp.html&quot; rel=&quot;nofollow&quot;&gt;link&lt;/a&gt; is Cisco's guide to configuring DHCP on the 5500 ASA.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally speaking, I am not overly fond of how you are describing your new network.  Typically I like to recommend that all of your devices connect to a switch and then that switch connect to your router (which I imagine is your edge router.)&lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2016-09-06T19:57:32.160" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="34674" PostTypeId="1" CreationDate="2016-09-06T20:34:53.563" Score="1" ViewCount="1343" Body="&lt;p&gt;We were running &lt;code&gt;Cisco ASR 1006&lt;/code&gt; on single &lt;code&gt;RP2/ESP&lt;/code&gt; since long time but today two purchased secondary (standby) &lt;code&gt;RP2/ESP&lt;/code&gt; for redendency. Now question is how do i upgrade IOS on secondary RP2? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am confused with ISSU method, I thought ASR1006 is hardware redundant so it doesn't need ISSU, so we individually upgrade &lt;code&gt;R0&lt;/code&gt; and &lt;code&gt;R1&lt;/code&gt; without any ISSU, i may be wrong. can someone explain how does ISSU process work and how i can use it to upgrade ASR1006? &lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2016-09-06T20:34:53.563" Title="ASR1006 IOS upgrade with ISSU" Tags="|cisco|cisco-ios|cisco-asr|" AnswerCount="0" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="34675" PostTypeId="2" ParentId="34643" CreationDate="2016-09-06T21:24:09.847" Score="0" Body="&lt;p&gt;You need to change the IP addressing scheme you have to suite the needs of the network more efficiently, and you cannot use over-lapping subnets this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As others describe, you can’t use the whole amount of addresses as one (beginning) is reserved for the subnet/network number and the last is reserved for the layer three broadcast address. (192.168.0.255/24 for example). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network Number: 192.168.0.0/24&#xA;Broadcast Address: 192.168.0.255/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;== 254 host addressses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also remember that if you require a gateway then the L3 device will also require a host address as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest you re-subnet this network taking into account how many subnets you need and how many hosts you need in each as well as taking into account future growth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also try using a subnet calculator like &lt;a href=&quot;http://www.subnet-calculator.com/&quot; rel=&quot;nofollow&quot;&gt;http://www.subnet-calculator.com/&lt;/a&gt; if you’re struggling calculating the binaries. &lt;/p&gt;&#xA;" OwnerUserId="2190" LastActivityDate="2016-09-06T21:24:09.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34676" PostTypeId="1" CreationDate="2016-09-07T01:03:30.437" Score="1" ViewCount="1465" Body="&lt;p&gt;I am new to Cisco ASA and ASDM. Struggling with difference from IOS devices. Network layout is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;AWS VPC -- IPsec tunnel -- ASA-5505 -- LAN&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;IPsec tunnel is up.&lt;/li&gt;&#xA;&lt;li&gt;AWS can reach LAN connected devices. &lt;/li&gt;&#xA;&lt;li&gt;LAN connected devices can reach the internet.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However I have these two problems:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;LAN interface of ASA cannot ping to Internet.&lt;/li&gt;&#xA;&lt;li&gt;SLA monitoring isn't working. (Maybe related to point 1?)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Below I have inserted most of my running-config(and route table). I removed the crypto config and I have hid some octets of WAN addresses with xxx. Hopefully there is enough configuration here to be helpful in troubleshooting. If some additional information would be helpful please ask. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Sorry, there was probably a better way to format the running-config below.) &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa# show running-config  &#xA;: Saved  &#xA;:  &#xA;ASA Version 9.1(2)8  &#xA;!  &#xA;interface Ethernet0/0  &#xA; switchport access vlan 2  &#xA;!  &#xA;interface Ethernet0/1  &#xA;!  &#xA;interface Ethernet0/2  &#xA;!  &#xA;interface Ethernet0/3  &#xA;!  &#xA;interface Ethernet0/4  &#xA;!  &#xA;interface Ethernet0/5  &#xA;!  &#xA;interface Ethernet0/6  &#xA;!  &#xA;interface Ethernet0/7  &#xA;!  &#xA;interface Vlan1  &#xA; nameif inside  &#xA; security-level 100  &#xA; ip address 192.168.0.1 255.255.255.0  &#xA;!  &#xA;interface Vlan2  &#xA; nameif outside  &#xA; security-level 0  &#xA; ip address xxx.152.29.xxx 255.255.255.240  &#xA;!  &#xA;ftp mode passive  &#xA;object network inside-subnet-1  &#xA; subnet 192.168.0.0 255.255.255.0  &#xA;object network AWS-inside-subnet  &#xA; subnet 172.19.254.128 255.255.255.128  &#xA;object network NETWORK_OBJ_192.168.0.0_24  &#xA; subnet 192.168.0.0 255.255.255.0  &#xA;object-group protocol DM_INLINE_PROTOCOL_1  &#xA; protocol-object ip  &#xA; protocol-object icmp  &#xA;access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 192.168.0.0 255.255.255.0 object AWS-inside-subnet  &#xA;pager lines 24  &#xA;logging enable  &#xA;logging asdm informational  &#xA;mtu outside 1500  &#xA;mtu inside 1500  &#xA;no failover  &#xA;icmp unreachable rate-limit 1 burst-size 1  &#xA;no asdm history enable  &#xA;arp timeout 14400  &#xA;no arp permit-nonconnected  &#xA;nat (inside,outside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static AWS-inside-subnet AWS-inside-subnet  &#xA;!  &#xA;object network inside-subnet-1  &#xA; nat (inside,outside) dynamic interface  &#xA;route outside 0.0.0.0 0.0.0.0 xxx.152.29.xxx 1  &#xA;&#xA;http server enable  &#xA;http 192.168.0.0 255.255.255.0 inside  &#xA;no snmp-server location  &#xA;no snmp-server contact  &#xA;&#xA;sla monitor 1  &#xA; type echo protocol ipIcmpEcho 172.19.254.129 interface outside  &#xA; frequency 30  &#xA;sla monitor schedule 1 life forever start-time now  &#xA;!  &#xA;ssh 192.168.0.0 255.255.255.0 inside  &#xA;ssh timeout 20  &#xA;ssh key-exchange group dh-group1-sha1  &#xA;console timeout 0  &#xA;!  &#xA;!  &#xA;class-map inspection_default  &#xA; match default-inspection-traffic  &#xA;!  &#xA;!  &#xA;policy-map type inspect dns preset_dns_map  &#xA; parameters  &#xA;  message-length maximum client auto  &#xA;  message-length maximum 512  &#xA;policy-map global_policy  &#xA; class inspection_default  &#xA;  inspect dns preset_dns_map  &#xA;  inspect ftp  &#xA;  inspect h323 h225  &#xA;  inspect h323 ras  &#xA;  inspect rsh  &#xA;  inspect rtsp  &#xA;  inspect esmtp  &#xA;  inspect sqlnet  &#xA;  inspect skinny  &#xA;  inspect sunrpc  &#xA;  inspect xdmcp  &#xA;  inspect sip  &#xA;  inspect netbios  &#xA;  inspect tftp  &#xA;  inspect ip-options  &#xA;  inspect icmp  &#xA;!   &#xA;: end  &#xA;ciscoasa# show route  &#xA;&#xA;Gateway of last resort is xxx.152.29.xxx to network 0.0.0.0  &#xA;&#xA;C    xxx.152.29.xxx 255.255.255.240 is directly connected, outside  &#xA;C    192.168.0.0 255.255.255.0 is directly connected, inside  &#xA;S*   0.0.0.0 0.0.0.0 [1/0] via xxx.152.29.xxx, outside  &#xA;ciscoasa#  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15982" LastEditorUserId="2142" LastEditDate="2016-09-07T01:06:50.673" LastActivityDate="2018-03-03T01:17:56.310" Title="Cisco ASA-5505 - Can ping the Internet from LAN connected devices, however I cannot ping from the LAN interface to the Internet" Tags="|routing|cisco-asa|ipsec|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34677" PostTypeId="1" AcceptedAnswerId="34678" CreationDate="2016-09-07T01:26:24.000" Score="1" ViewCount="631" Body="&lt;p&gt;Is an Ethernet Packet sent to all the hosts on a network, and then all of them discard the packet except the right host to which the packet was sent to?&#xA;&lt;a href=&quot;http://www.laneye.com/network/how-network-works/mac-address-and-ip-address-relationship.htm&quot; rel=&quot;nofollow&quot;&gt;This&lt;/a&gt; page here says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Local networks like an Ethernet network sends all traffic to all computers that sits on the same network bus.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Does this mean that anyone can intercept information meant for anyone else by just feigning to be the right receiver?&lt;/p&gt;&#xA;" OwnerUserId="30284" LastActivityDate="2016-09-07T23:39:04.857" Title="Is an Ethernet Packet sent to all the hosts on a network?" Tags="|ethernet|mac-address|packet-path|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34678" PostTypeId="2" ParentId="34677" CreationDate="2016-09-07T01:47:52.223" Score="5" Body="&lt;p&gt;The answer depends on the type of Ethernet network you have.  In modern, switched networks, the switch forwards packets only to the destination host, based on the MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In (much) older networks that use Ethernet hubs, packets are received by all hosts.  Since every host receives the packet, that means only one host can transmit at a time -- a big disadvantage over switched networks.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Moreover, switched Ethernet networks are full duplex, meaning hosts can receive and transmit at the same time.  Hub-based networks are half-duplex, meaning hosts can receive or transmit, but not at the same time.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-09-07T04:01:41.970" LastActivityDate="2016-09-07T04:01:41.970" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="34680" PostTypeId="2" ParentId="34635" CreationDate="2016-09-07T08:41:01.167" Score="3" Body="&lt;p&gt;Almost certainly, your course was talking about the &lt;strong&gt;TCP/IP model&lt;/strong&gt;. This is the model commonly used in networking, and aggregates some of the layers of the ISO/OSI model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/FOfAU.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FOfAU.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2016-09-07T08:41:01.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34682" PostTypeId="1" CreationDate="2016-09-07T10:26:56.550" Score="3" ViewCount="2248" Body="&lt;p&gt;Is there any way to resolve an external IP address to a MAC address without access to the specific LAN? In other words, is it possible to obtain a MAC address for any given public IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my understanding, ARP will only work if you're directly connected to the LAN in which the target IP's host is also connected. Is it possible to tunnel those requests (for example to an ISP's router)?&lt;/p&gt;&#xA;" OwnerUserId="30319" LastActivityDate="2016-09-07T10:42:34.500" Title="Obtaining MAC address of an external IP" Tags="|mac-address|tunnel|ip-address|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34683" PostTypeId="2" ParentId="34682" CreationDate="2016-09-07T10:42:34.500" Score="3" Body="&lt;p&gt;No, there's no way of knowing and at a network level there's no point knowing.  The MAC adddress belongs in layer-2.  Obviously if you are responsible for the equipment, you may want to enter the details in a CMDB, in which case there is probably an application that can get that information.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-09-07T10:42:34.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34684" PostTypeId="1" AcceptedAnswerId="34691" CreationDate="2016-09-07T10:53:08.297" Score="1" ViewCount="56" Body="&lt;p&gt;We sell internet BW to small businesses, Because of how caching &amp;amp; peering services are configured our customers can only benefit from our local GGC and akamai node, with speed and performance only if it they use our DNS service. But despite multiple requests our clients use global google DNS services (8.8.8.8) or their own internal DNS servers and then complain about not getting decent speed or high latency. We keep telling them but it's not making any difference. One of the things we did to some of our clients who are connected through Mikrotik CCR routers is NAT their DNS requesting. Doesn't matter whatever DNS server they are using, we NAT the DNS requests to use our own DNS Servers. So far, in the last month or so, we haven't had any problems. We want to do the same thing Cisco switches/routers, Any idea how to do this?&lt;/p&gt;&#xA;" OwnerUserId="5178" LastActivityDate="2016-09-08T12:44:15.187" Title="DNS natting on Cisco 6502e IOS 12.2" Tags="|cisco|nat|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34685" PostTypeId="2" ParentId="11094" CreationDate="2016-09-07T11:41:24.783" Score="0" Body="&lt;p&gt;Computers do not work with individual bits. On virtually all current computers the smallest addressable unit of memory is the 8-bit byte. Our higher level communications protocols also assume bytes as their basic unit of data. Similarly the internal busses in computers don't move data one bit at a time but in groups of 8, 16, 32, 64 or more bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When desinging a serial comunications protocol the protocol designer must decide which bit to send first. The actual choice is largely arbitary, it makes no real differentce to implementation complexity because the bits in a byte don't really have a natural order.  &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-07T11:41:24.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34687" PostTypeId="2" ParentId="29785" CreationDate="2016-09-07T11:59:46.843" Score="1" Body="&lt;p&gt;It depends what devices the communication passes through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets consider a network. A real network will have more hops but this shows all the important elements. All connections in the network we are considering are ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client&amp;lt;--&gt;Ethernet switch&amp;lt;--&gt;NAT&amp;lt;--&gt;IP router&amp;lt;--&gt;server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now lets say the client goes to set up a TCP connection to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client builds a packet. It's source MAC is set to it's own MAC address. It's destination MAC is set to the MAC of the relavent port on the NAT box. It's source IP is set to the clients private IP. It's destination IP is set to the IP of the server. It's source port is set to the port the client is bound to (which is usually selected randomly). It's destination port is set to the port for the desired service on the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ethernet switch simply passes the frame on. It doesn't change any addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NAT strips off the Ethernet headers. It then modifies the IP headers changes the source IP address to it's public IP. It may also change the source port to disambiguate connections from different clients. The destination IP and port remain unchanged. A mapping table entry is created so that reverse translation can be performed. New Ethernet headers are then built with the source MAC being the MAC of the relavent port on the NAT box and the destination MAC being the MAC of the relavent port on the IP router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IP router strips off the Ethernet headers and again builds new ones so the packet can be sent to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet arrives at the server, a reply is generated and a similar process proceeds to get the packet back to the client. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-07T11:59:46.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34688" PostTypeId="1" AcceptedAnswerId="34689" CreationDate="2016-09-07T12:37:53.790" Score="1" ViewCount="844" Body="&lt;p&gt;Say that we have a router with the follwing forwarding table&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--------------------------------------------------&#xA;| Destination       | Next hop        | Flags    |&#xA;--------------------------------------------------&#xA;| 177.121.128.0/18  | 73.0.45.1       | G        |&#xA;| 0.0.0.0/0         | 73.0.65.1       | UG       |&#xA;--------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Say also that the router receives packets with the destination address &lt;code&gt;177.121.128.2&lt;/code&gt;. In that case, what would happen to the packet? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the targeted ip-block is down (as the &lt;code&gt;U&lt;/code&gt; flag is absent from &lt;code&gt;77.121.128.0/18&lt;/code&gt;) will the router drop the packet or will the router send it to the default next hop router &lt;code&gt;73.0.65.1&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="30324" LastEditorUserId="30324" LastEditDate="2016-09-07T14:21:39.730" LastActivityDate="2016-09-07T15:02:51.473" Title="Determining next hop adress in packet forwarding by forwarding table (IPv4)" Tags="|ipv4|ip-forwarding-table|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34689" PostTypeId="2" ParentId="34688" CreationDate="2016-09-07T12:54:17.493" Score="1" Body="&lt;p&gt;In my experience with Cisco devices if it knows that the first gateway is unreachable (which it appears to know since it doesn't have the U flag), then it will move to the next entry on the list that provides the best match for the destination which is the quad zero.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;***The routing table says that anything destined for 77.121.128.0/18 will be sent to 73.0.45.1.  Packets destined for all other IP address will follow the quad zero rule; that is they will be sent to 73.0.65.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such any packets destined for 177.121.128.2 will be sent to 73.0.65.1; in accordance with the rules in the routing table.***&lt;/p&gt;&#xA;" OwnerUserId="14403" LastEditorUserId="14403" LastEditDate="2016-09-07T15:02:51.473" LastActivityDate="2016-09-07T15:02:51.473" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34690" PostTypeId="2" ParentId="34688" CreationDate="2016-09-07T13:16:45.553" Score="1" Body="&lt;p&gt;In general a router should always use the best (longest-match) route available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not familiar with the output format you quote, so not sure if that router considers the /18 route as available. In that case it will try forwarding the packet to 73.0.45.1 which probably means it gets dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Real world example: a static route with the next-hop on an ethernet interface but the next-hop is down; the router doesn't &quot;know&quot; this so it still considers the route as active but packets get dropped because it cannot arp the next-hop).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the absence of the U flag means &quot;do not use this route&quot;, i.e. the router knows the route is not available, then I expect it to use the default route instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Real world example: a static route with the next-hop on a serial interface but the next-hop is down; the router &quot;knows&quot; this because the serial interface is down so it removes the route from the routing table and traffic follows the default route).&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-07T13:16:45.553" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="34691" PostTypeId="2" ParentId="34684" CreationDate="2016-09-07T14:16:33.763" Score="1" Body="&lt;p&gt;Perhaps something like this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/12214771/destination-nat-inside-outside-dns-traffic&quot; rel=&quot;nofollow&quot;&gt;https://supportforums.cisco.com/discussion/12214771/destination-nat-inside-outside-dns-traffic&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, as someone has mentioned, if I was your customer, I would leave. Altering customers' traffic without their consent is big no-no. Beside, you're selling Internet BW. If they're using other DNS, that would mean they generate more traffic and they have to pay more isn't it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, good luck.&lt;/p&gt;&#xA;" OwnerUserId="30293" LastActivityDate="2016-09-07T14:16:33.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34693" PostTypeId="1" CreationDate="2016-09-07T15:14:53.397" Score="2" ViewCount="9056" Body="&lt;p&gt;I have created L2 vlan &amp;amp; SVI's on core switch. but it shows status UP, Line protocol DOWN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan11                x.x.x.x      YES manual up                    down&#xA;Vlan21                x.x.x.x      YES manual up                    down&#xA;Vlan31                x.x.x.x      YES manual up                    down&#xA;Vlan91                x.x.x.x      YES manual up                    down&lt;/p&gt;&#xA;" OwnerUserId="30297" LastActivityDate="2016-09-07T15:17:47.073" Title="vlan line protocol up/down" Tags="|vlan|cisco-3750|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34694" PostTypeId="2" ParentId="34693" CreationDate="2016-09-07T15:17:47.073" Score="5" Body="&lt;p&gt;In order for a VLAN interface to be up, the VLAN needs to be configured on a access port (Directly connected hosts) or the VLAN needs to be allowed over a trunk. Mind you that the interface or trunk need to be up for the VLAN interfaces to come up&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can configure access ports assigned to those VLAN's and use the command &lt;strong&gt;no keepalive&lt;/strong&gt; command to bring those ports up, without having something actually connected to the physical port&lt;/p&gt;&#xA;" OwnerUserId="30328" LastActivityDate="2016-09-07T15:17:47.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34701" PostTypeId="2" ParentId="29785" CreationDate="2016-09-07T17:31:50.853" Score="0" Body="&lt;p&gt;If the packet goes through switches, nothing is changed.&#xA;If the packet goes through a router, the Source MAC address is changed hop by hop (A hop is a layer 3 device)&lt;/p&gt;&#xA;" OwnerUserId="30328" LastActivityDate="2016-09-07T17:31:50.853" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34702" PostTypeId="1" AcceptedAnswerId="34712" CreationDate="2016-09-07T18:09:06.657" Score="2" ViewCount="434" Body="&lt;p&gt;According to OSI reference model layers communicate with lower layer to transmit information on to other network. So they add header and tail for data and pass it on to lower layer and finally passed to other computer over wire or wireless. Switch is for communication between link layers and router for network layer. What is the use of them when 2 networking layers can't communicate directly and need to pass to lower layer.&lt;/p&gt;&#xA;" OwnerUserId="24916" LastActivityDate="2016-09-11T02:32:15.920" Title="What is purpose of router?" Tags="|router|network-core|osi|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34703" PostTypeId="2" ParentId="34702" CreationDate="2016-09-07T18:16:36.667" Score="0" Body="&lt;p&gt;Traffic in different IP networks/VLAN's (Layer 2 - MAC) cannot communicate with each other. For communication between IP networks/VLAN's you need a Router (Layer 3 - IP). &lt;/p&gt;&#xA;" OwnerUserId="30328" LastActivityDate="2016-09-07T18:16:36.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34704" PostTypeId="2" ParentId="34702" CreationDate="2016-09-07T18:17:16.370" Score="0" Body="&lt;p&gt;Layers communicate with their corresponding layer logically.   That means the transport layer adds information that the receiver's transport layer understands.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your statement  &quot;Switch is for communication between link layers and router for network layer.&quot; is a mischaracterization of their functions.  See if &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6380/osi-model-and-networking-protocols-relationship&quot;&gt;this question&lt;/a&gt; helps you.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-09-07T18:17:16.370" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34705" PostTypeId="2" ParentId="30770" CreationDate="2016-09-07T19:02:02.453" Score="-1" Body="&lt;p&gt;If you use GNS3 network simulator to run vMX: Use versions 14.1R4.8 (or older). Starting with 15.1, vMX was split into two VMs and no longer works with GNS3.&lt;/p&gt;&#xA;" OwnerUserId="30331" LastEditorUserId="30331" LastEditDate="2016-09-07T20:44:58.780" LastActivityDate="2016-09-07T20:44:58.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34706" PostTypeId="2" ParentId="34647" CreationDate="2016-09-07T19:15:15.273" Score="0" Body="&lt;p&gt;IF you only need 1 vlan on that link, a trunk is not necessary.&lt;/p&gt;&#xA;" OwnerUserId="30328" LastActivityDate="2016-09-07T19:15:15.273" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34707" PostTypeId="1" CreationDate="2016-09-07T19:22:27.653" Score="-2" ViewCount="287" Body="&lt;p&gt;Can anyone read this network diagram? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand what a VLAN is. The information provided for the diagram is listed below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;To demonstrate a real-world model of how you might use VLANs, I created a fictional zoned-network. In Figure 5-17, I isolated incoming Internet traffic and created internal data center security zones.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nNvrr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nNvrr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30332" LastActivityDate="2016-09-08T08:07:15.497" Title="Can anyone read this network diagram?" Tags="|network-access|" AnswerCount="1" CommentCount="2" ClosedDate="2017-08-15T01:57:05.637" ContentLicense="CC BY-SA 3.0" />
  <row Id="34709" PostTypeId="2" ParentId="34702" CreationDate="2016-09-07T23:28:40.383" Score="0" Body="&lt;p&gt;Encapsulation is a term often associated with the layers - a datagram is &lt;em&gt;encapsulated&lt;/em&gt; then handed to the &lt;em&gt;lower&lt;/em&gt; layer.  A routers function is to route &lt;em&gt;packets&lt;/em&gt;.  A switches function is to switch &lt;em&gt;frames&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-09-11T02:32:15.920" LastActivityDate="2016-09-11T02:32:15.920" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34710" PostTypeId="2" ParentId="34677" CreationDate="2016-09-07T23:39:04.857" Score="0" Body="&lt;p&gt;If the destination link layer address (MAC Address) is not known to the switch then it is forwarded out all ports and gets to every connected host.  Once a host responds, the switch remembers where that host is (which port) and forwards frames addressed to that particular host (MAC Address) only out of that particular port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, a switches MAC address table can become overloaded in which case the switch reverts to hub like behavior, forwarding each frame out of every port.  See &lt;a href=&quot;https://en.wikipedia.org/wiki/MAC_flooding&quot; rel=&quot;nofollow&quot;&gt;MAC Flooding&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-07T23:39:04.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34712" PostTypeId="2" ParentId="34702" CreationDate="2016-09-07T23:56:55.527" Score="1" Body="&lt;p&gt;Each layer of the OSI model serves a unique purpose with the end goal of host to host communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/osi-model/#osi-layer-1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Layer 1&lt;/a&gt; is responsible for moving bits (&lt;code&gt;1&lt;/code&gt;s and &lt;code&gt;0&lt;/code&gt;s) across a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/osi-model/#osi-layer-2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Layer 2&lt;/a&gt; is responsible for communication &lt;em&gt;within&lt;/em&gt; networks. L2 uses addressing known as MAC addresses for this purpose. A MAC address is essentially the address of a particular NIC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/osi-model/#osi-layer-3&quot; rel=&quot;nofollow noreferrer&quot;&gt;Layer 3&lt;/a&gt; is responsible for communication &lt;em&gt;between&lt;/em&gt; networks. L3 uses addressing known as IP addresses for this purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fundamentally, your question is not &quot;what is the purpose of Routers&quot;, but &quot;what is the purpose of &lt;em&gt;networks&lt;/em&gt;&quot;, if you understand why &lt;em&gt;the&lt;/em&gt; Internet is divided up into multiple networks, then you will understand why you need a device that facilitates communication between those networks (aka, the router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider your mailing address. It will look something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;432 Park Avenue&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Imagine a postal employee having to deliver a letter to your address. It would be impossible for the local postal employee to know every residential unit in the city. BUT, its far more feasible for the postal employee to know every &lt;em&gt;street&lt;/em&gt; in the city. The postal employee will find the street you live on, and from there count out the residences until they get to 432. That is how they will find your specific house.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this analogy, the street is like a network (Park Avenue), it is a grouping of houses that a single postal employee can know the location of. One street can exist next to many other streets, and as long as each street is uniquely named, they can be found by your postal employee.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The building number (432) is like a MAC address, it is the specific house/building within a street. Other streets may have the same building number, but within a particular street there can only be unique house numbers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your mailman doesn't need to know every house on every street, they just need to know every street. Once the street is found, they can track down the exact location based upon the house number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internet is the same way. Instead of forcing a Router to know every location of every host in the whole world, Router's are only concerned with knowing the location of every &lt;em&gt;network&lt;/em&gt;. Once the packet is routed to the proper Router (aka, the proper street), the packet delivery process can look up the appropriate MAC address (aka, the proper house) to deliver the packet to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in the end, a &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/key-players/#router&quot; rel=&quot;nofollow noreferrer&quot;&gt;Router&lt;/a&gt; exists to know the location of every &lt;em&gt;network&lt;/em&gt;, and to move packets from Router to Router until the final Router in the path is found. When that happens, &lt;em&gt;that&lt;/em&gt; Router will look up the specific MAC address to get the packet to its intended destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information on how a Router does its job (and therefore, the job the router serves) check out this article that discusses how a &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-router/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Router moves packets through a network.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OP asked this question in comments:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;only bits come out of the physical layer for transmission. So does Router convert them back to packets upon receiving bits as input?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The answer is &quot;eventually yes&quot;. Each layer adds to the original data what it needs to add in order to accomplish its purpose:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Layer 3 (the Router) will add an IP header which would include a Source and Destination IP address&lt;/li&gt;&#xA;&lt;li&gt;Layer 2 (the NIC on the Router) would add an Ethernet header which would include a Source and Destination MAC address&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Layer 2 would then convert the resulting frame into &lt;code&gt;1&lt;/code&gt;s and &lt;code&gt;0&lt;/code&gt;s and send them to Layer 1 to be sent across the wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The process can be seen in this animation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Y6OBY.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y6OBY.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2016-09-08T06:34:26.253" LastActivityDate="2016-09-08T06:34:26.253" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34713" PostTypeId="1" AcceptedAnswerId="34715" CreationDate="2016-09-08T00:09:17.643" Score="1" ViewCount="1009" Body="&lt;p&gt;Let's say we have 3 switches in a logical triangle, each switch connected to the other two. This provides an opportunity for a loop when multicast or broadcast traffic is traveling here. STP is used to prevent this, deciding on a root bridge which eliminates the redundant path. Problem is, as I see it, one of the possibly shorter paths (given the situation) is cut off. Is this just the way STP works, or is the path blocked only for certain types of offending traffic like multicast or broadcast?&lt;/p&gt;&#xA;" OwnerUserId="27412" LastEditorUserId="8499" LastEditDate="2018-03-19T05:37:40.717" LastActivityDate="2018-03-19T05:37:40.717" Title="Is STP used to prevent all traffic looping or just broadcast and multicast?" Tags="|spanning-tree|layer2|multicast|broadcast|loop|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34714" PostTypeId="2" ParentId="34713" CreationDate="2016-09-08T02:11:36.730" Score="0" Body="&lt;p&gt;It's just the way STP works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are alternatives that can avoid these problems but they come with issues of their own. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-08T02:11:36.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34715" PostTypeId="2" ParentId="34713" CreationDate="2016-09-08T02:16:54.713" Score="3" Body="&lt;p&gt;Actually, STP figures out the least-cost (shortest), loop-free path to the root switch. This is the path used for all traffic not directly attached to the switch. STP uses BPDUs to figure this out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With your scenario, three switches connected in a triangle, both of the non-root switches will have directly connected links to the root switch, and each link will be the lowest cost to the root switch from each switch. If one of the links is faster than the other, any traffic from the link between the non-root switches will use the switch with the faster link to the root switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-09-08T02:31:04.863" LastActivityDate="2016-09-08T02:31:04.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34718" PostTypeId="2" ParentId="34676" CreationDate="2016-09-08T07:30:10.427" Score="1" Body="&lt;p&gt;To get the IP SLA to work, change your crypto ACL from:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 192.168.0.0 255.255.255.0 object AWS-inside-subnet  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 any4 object AWS-inside-subnet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And, of course, do the same (in reverse) at the remote peer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way the IP SLA (which is sourced from the ASA's outside ip address) also gets tunnelled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;src: &lt;a href=&quot;http://www.tunnelsup.com/troubleshooting-vpn-between-cisco-asa-and-amazon-aws&quot; rel=&quot;nofollow&quot;&gt;http://www.tunnelsup.com/troubleshooting-vpn-between-cisco-asa-and-amazon-aws&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: note that if there is any traffic between AWS and the Internet, the suggested config change may break things as it may cause that traffic to traverse the tunnel now (depending on how the other side is configured).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit2: this should also make a regular ping work, if you source it from the outside interface. To be honest I'm not sure if a ping from the inside interface can ever work - it might if you enable &lt;code&gt;management-access inside&lt;/code&gt;. That should at least allow you to ping the inside interface from AWS.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-09-08T07:39:54.947" LastActivityDate="2016-09-08T07:39:54.947" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34719" PostTypeId="2" ParentId="34707" CreationDate="2016-09-08T08:07:15.497" Score="2" Body="&lt;p&gt;To answer the only question you ask: I can read most of it. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Externally Facing Security Zones&#xA;Data Center&#xA;Public Access&#xA;SSL VPN&#xA;VPN Concentrator&#xA;Edge switch&#xA;Private DB vlan&#xA;L2 Aggregation&#xA;IPS on Trunk&#xA;Core L3 Switch&#xA;email&#xA;Application Servers&#xA;Corporate Office&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the links are labeled with &lt;code&gt;vlan &amp;lt;number&amp;gt;&lt;/code&gt; where the number differs per color.&#xA;Unfortunately the text in the green box is too small to read at this resolution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the more interesting question would be: what does the author mean with &quot;isolated&quot; and &quot;security zones&quot;. It looks like all vlans are connected to the core L3 switch, so if that switch routes between all these vlans then there is only isolation at L2 and so this use of vlans does not offer any security at all. If the L3 switch does not route between all vlans, then the non-routed vlans are indeed isolated but then they also don't have connectivity.&#xA;The only way this diagram would make sense (talking about security) is if the L3 Switch would be replaced with a firewall IMHO.&#xA;The Core L3 switch could be e.g. a Cisco 6500 with an ASA module but then I would expect it to be labeled as &lt;code&gt;core switch with firewall module&lt;/code&gt; to make that clear.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-08T08:07:15.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34720" PostTypeId="2" ParentId="34576" CreationDate="2016-09-08T10:05:12.557" Score="3" Body="&lt;p&gt;XR probably wants NETCONF 1.1. If you enable debugging you might find something like this in your log:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:Sep  8 09:47:27.513 : netconf[1120]: ERR: NC: Error, Capability urn:ietf:params:netconf:base:1.1 not found&#xA;RP/0/RSP0/CPU0:Sep  8 09:47:27.513 : netconf[1120]: ERR: NC: Hello message validation failed&#xA;RP/0/RSP0/CPU0:Sep  8 09:47:27.514 : netconf[1120]: ERR: NC: Callback handling decoded data returned error: 'Netconf server' detected the 'warning' condition 'NC_ERRCODE_REQ_INVALID'&#xA;RP/0/RSP0/CPU0:Sep  8 09:47:27.514 : netconf[1120]: ERR: NC: Decoding of incoming NETCONF data failed: 'Netconf server' detected the 'warning' condition 'NC_ERRCODE_REQ_INVALID'&#xA;RP/0/RSP0/CPU0:Sep  8 09:47:27.514 : netconf[1120]: ERR: NC: Failed to handle SSH IPC message: 'Netconf server' detected the 'warning' condition 'NC_ERRCODE_REQ_INVALID', msg:166df16c, session:200fe198&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So put 1.1 support in your hello (I'm also qualifying hello with a namespace):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;hello xmlns=&quot;urn:ietf:params:xml:ns:netconf:base:1.0&quot;&amp;gt;&#xA;    &amp;lt;capabilities&amp;gt;&#xA;        &amp;lt;capability&amp;gt;urn:ietf:params:netconf:base:1.0&amp;lt;/capability&amp;gt;&#xA;        &amp;lt;capability&amp;gt;urn:ietf:params:netconf:base:1.1&amp;lt;/capability&amp;gt;&#xA;    &amp;lt;/capabilities&amp;gt;&#xA;&amp;lt;/hello&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would however advise you to use a library for talking NETCONF, like ncclient for Python. The framing format (ending messages with &lt;code&gt;]]&amp;gt;]]&amp;gt;&lt;/code&gt;) used in NETCONF 1.0 is deprecated and a new chunked framing mechanism is introduced in 1.1. You need to know the length of the message so it's much easier using a lib than doing it manually.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, looking at the capabilities announced by your XR device you appear to be running a rather old version. 6.0 is available and offers a quite decent set of YANG modules, see &lt;a href=&quot;http://plajjan.github.io/Cisco-IOS-XR-6-0-and-YANG/&quot; rel=&quot;nofollow&quot;&gt;http://plajjan.github.io/Cisco-IOS-XR-6-0-and-YANG/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="672" LastEditorUserId="672" LastEditDate="2016-10-09T09:31:06.917" LastActivityDate="2016-10-09T09:31:06.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34722" PostTypeId="1" AcceptedAnswerId="34730" CreationDate="2016-09-08T10:40:36.017" Score="1" ViewCount="136" Body="&lt;p&gt;If I have a device which acts only as a wireless client, do I have to set and abide a regulatory domain? Is this related only to the scanning process, or when else would this matter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="30346" LastEditorUserId="30346" LastEditDate="2016-09-08T10:53:33.707" LastActivityDate="2016-09-08T13:49:52.727" Title="As a wireless client is the regulatory domain relevant?" Tags="|wireless|ieee-802.11|standardisation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34723" PostTypeId="1" CreationDate="2016-09-08T11:46:21.113" Score="0" ViewCount="776" Body="&lt;p&gt;I just installed a new Wifi and was testing the speeds on my computers, a Mac Book Air and a PC. Surprisingly, the Mac gives me a much higher speed in seedtest.net! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can this be possible?&lt;/p&gt;&#xA;" OwnerUserId="30348" LastActivityDate="2017-03-15T08:59:25.820" Title="Same Wifi network but different speed on two computers?" Tags="|ieee-802.11|network-access|" AnswerCount="2" CommentCount="1" ClosedDate="2017-08-15T01:55:24.057" ContentLicense="CC BY-SA 3.0" />
  <row Id="34724" PostTypeId="2" ParentId="34723" CreationDate="2016-09-08T12:13:43.770" Score="2" Body="&lt;p&gt;The speed (data rate) of your wireless connection is negotiated between the access point and the individual client, based primarily on signal to noise ratio (SNR).  It can be (and often is) different for different devices on the same access point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The factors that affect SNR are distance from the access point, obstructions, antenna orientation, and transmitter power, to name a few. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-08T12:13:43.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34725" PostTypeId="2" ParentId="32654" CreationDate="2016-09-08T12:17:45.727" Score="2" Body="&lt;p&gt;You need to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Set up DHCP-Relay on switch 2 with your server (switch 1) IP address and reference each VLAN interface (eg: &lt;code&gt;vlan.x&lt;/code&gt;) that you wish to relay for&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure you have a dedicated scope configured on switch 1 for each VLAN you will be serving and ensure that the gateway for each matches the appropriate &lt;code&gt;vlan.x&lt;/code&gt; interface on switch 2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-09-08T12:17:45.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34727" PostTypeId="2" ParentId="34684" CreationDate="2016-09-08T12:44:15.187" Score="1" Body="&lt;p&gt;How about giving them a demo? &quot;Look how slow this is... now I change the DNS on this PC to xx.x.x.x and I download the same content again, look how fast it is now&quot;.&#xA;That, or raise your prices with 2% and give a 2% discount to those who use your DNS. Or a free T-shirt. Whatever works.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-08T12:44:15.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34730" PostTypeId="2" ParentId="34722" CreationDate="2016-09-08T13:49:52.727" Score="1" Body="&lt;p&gt;Yes, absolutely. Wi-Fi is a bidirectional layer-1/2 protocol, and every Wi-Fi device must both transmit and receive. It is not like a regular radio or television receiver that passively receives a signal.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-08T13:49:52.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34731" PostTypeId="1" AcceptedAnswerId="34732" CreationDate="2016-09-08T14:18:56.370" Score="3" ViewCount="285" Body="&lt;p&gt;Is this command disruptive or just a logical exercise of existing configuration?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test etherchannel load-balance int po3 &amp;lt;some mac here&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Platform is 6500 series, running IOS.  Thank you!&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2016-09-08T14:23:40.680" Title="Is test etherchannel load-balance disruptive?" Tags="|cisco|cisco-ios|etherchannel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34732" PostTypeId="2" ParentId="34731" CreationDate="2016-09-08T14:23:40.680" Score="2" Body="&lt;p&gt;Not so far as I am aware.  All it does is simulate sending data and seeing which interface would actually be carrying the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Granted this is to the best of my knowledge and I might be incorrect.&lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2016-09-08T14:23:40.680" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34737" PostTypeId="1" CreationDate="2016-09-08T21:31:51.107" Score="0" ViewCount="359" Body="&lt;p&gt;Choosing a device-icon in a logical network diagram can be based on two things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Configuration on the device&lt;/li&gt;&#xA;&lt;li&gt;Possible functionality on the device&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Lets use a switch with layer-3 functionality as an example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switch is configured to only switch data you could use the following Visio stencil from Cisco which depicts a &quot;clean&quot; layer-2 switch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aQOi7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aQOi7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But even though the switch is only configured to only switch data, it is possible to route data because of the layer-3 functionality - so you could also choose to use the following Visio stencil from Cisco which depicts a switch with layer-3 functionality:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/osuLX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/osuLX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is option 1 or 2 correct?&lt;/p&gt;&#xA;" OwnerUserId="3200" LastActivityDate="2016-09-08T21:34:22.273" Title="Correct device-icon in network diagram based on configuration or functionality on device" Tags="|cisco|switch|" AnswerCount="1" CommentCount="1" ClosedDate="2016-09-09T01:10:57.287" ContentLicense="CC BY-SA 3.0" />
  <row Id="34738" PostTypeId="2" ParentId="34737" CreationDate="2016-09-08T21:34:22.273" Score="1" Body="&lt;p&gt;Short answer:  Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either works, it just requires that everyone in your organization know what is what.  Some places will use how it is programmed for a logical topology and what it actually is in the physical topology.&lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2016-09-08T21:34:22.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34746" PostTypeId="1" CreationDate="2016-09-09T09:19:30.677" Score="0" ViewCount="230" Body="&lt;p&gt;Curious to know an application that uses hardware time-stamping presented in network cards. If you know any app uses this please list down here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw people writing application through UDP sockets to use these timestamps. But, is there any application (like databases, web page, anything) that is actually using these timestamps in real time?&lt;/p&gt;&#xA;" OwnerUserId="29931" LastEditorUserId="42290" LastEditDate="2017-12-13T09:24:45.463" LastActivityDate="2017-12-13T09:24:45.463" Title="linux network card packet timestamping" Tags="|ethernet|linux|network-core|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-15T02:12:54.297" ContentLicense="CC BY-SA 3.0" />
  <row Id="34749" PostTypeId="1" AcceptedAnswerId="40427" CreationDate="2016-09-09T10:29:43.483" Score="2" ViewCount="11271" Body="&lt;p&gt;I Have two Juniper ACX 2200 Series Routers connected back to back and One Router running latest OS, But other is running Old OS, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to copy Latest OS from One Junos to another Junos Router,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I enabled FTP On both Routers&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit system services ftp]&#xA;set rate-limit 2&#xA;set connection-limit 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And Used The Command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ikar@hostname&amp;gt; file copy ftp://ikar:ikar123@172.22.36.113/var/tmp/jinstall-ppc-15.1X54-D36.2-domestic.tgz /var/tmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And I got the Below Error&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fetch: ftp://ikar:*@172.22.36.113/var/tmp/jinstall-ppc-15.1X54-D36.2-domestic.tgz: File unavailable (e.g., file not found, no access)&#xA;error: file-fetch failed&#xA;error: could not fetch local copy of file&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;User : ikar has Super-user privilages.&lt;/p&gt;&#xA;" OwnerUserId="6118" LastEditorUserId="8499" LastEditDate="2016-09-09T15:10:01.117" LastActivityDate="2017-05-14T02:33:23.860" Title="FTP File copy command in Juniper showing [error: file-fetch failed error: could not fetch local copy of file]?" Tags="|juniper-junos|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34752" PostTypeId="2" ParentId="34746" CreationDate="2016-09-09T11:42:48.387" Score="2" Body="&lt;p&gt;Some specialist network cards provide timestamping.  The vendor will supply a driver so that network packet capture applications can access and store these timestamps.  No normal business application looks at them, just as no normal business application considers any IP data or packet metadata.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-09-09T11:42:48.387" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34753" PostTypeId="2" ParentId="34713" CreationDate="2016-09-09T12:29:45.393" Score="-1" Body="&lt;p&gt;STP would block(discard) all traffic not just broadcast or multicast traffic on the blocked(alternate) port.  &lt;/p&gt;&#xA;" OwnerUserId="19217" LastActivityDate="2016-09-09T12:29:45.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34754" PostTypeId="1" AcceptedAnswerId="34759" CreationDate="2016-09-09T13:07:21.770" Score="4" ViewCount="12154" Body="&lt;p&gt;Is it possible that there is one MAC address associated to more interfaces in the switch MAC table? If not, what is the behaviour when frame with known MAC comes from a different interface?&lt;/p&gt;&#xA;" OwnerUserId="30374" LastActivityDate="2016-09-13T03:01:41.137" Title="Same MAC on different interfaces" Tags="|switch|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34758" PostTypeId="2" ParentId="34749" CreationDate="2016-09-09T14:03:50.443" Score="0" Body="&lt;p&gt;try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ikar@hostname&amp;gt; file copy ftp://ikar@172.22.36.113/var/tmp/jinstall-ppc-15.1X54-D36.2-domestic.tgz /var/tmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll be prompted for password, put in the password and you should be good to go&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Source: &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos15.1/topics/reference/command-summary/file-copy.html#jd0e160&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/documentation/en_US/junos15.1/topics/reference/command-summary/file-copy.html#jd0e160&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="30293" LastEditorUserId="8499" LastEditDate="2016-09-09T14:56:28.827" LastActivityDate="2016-09-09T14:56:28.827" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34759" PostTypeId="2" ParentId="34754" CreationDate="2016-09-09T14:16:42.347" Score="4" Body="&lt;p&gt;When a switch receives a frame from an interface, it creates an entry in the mac-address table with the source mac and interface.  If the source mac is known, it will update the table with the new interface.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-09T14:16:42.347" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34760" PostTypeId="1" AcceptedAnswerId="34767" CreationDate="2016-09-09T14:31:38.050" Score="2" ViewCount="1857" Body="&lt;p&gt;I have topology with two hubs and about 10 spokes running DMVPN(2 clouds) and OSPF over it. &lt;br&gt;&#xA;Like this:&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/nir1K.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nir1K.png&quot; alt=&quot;DMVPN + OSPF&quot;&gt;&lt;/a&gt;&#xA;If 1gb/s link between main offices fail, traffic  will flow through one of spokes, that mostly have slow internet connection.&#xA;How can I prevent this? Has OSPF something like stub router in EIGRP?&lt;/p&gt;&#xA;" OwnerUserId="30367" LastActivityDate="2016-09-09T17:34:10.087" Title="DMVPN + OSPF prevent traffic to flow through spoke" Tags="|cisco|ospf|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34761" PostTypeId="2" ParentId="34760" CreationDate="2016-09-09T15:43:02.547" Score="-2" Body="&lt;p&gt;Spoke to Spoke connectivity is created dynamically on demand with DMVPN (as in &lt;em&gt;Dynamic&lt;/em&gt; Multipoint VPN).  A 1Gbps link between the two DMVPN hubs does not affect this functionality.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;h2&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_dmvpn/configuration/xe-3s/sec-conn-dmvpn-xe-3s-book/sec-conn-dmvpn-dmvpn.html#GUID-D3F6653D-1A1D-4DB3-A7C3-3D74DE251A1D&quot; rel=&quot;nofollow noreferrer&quot;&gt;Benefits of Dynamic Multipoint VPN&lt;/a&gt;&lt;/h2&gt;&#xA;&lt;h3&gt;Hub Router Configuration Reduction&lt;/h3&gt;&#xA;&lt;p&gt;For each spoke router, there is a separate block of configuration&#xA;lines on the hub router that define the crypto map characteristics,&#xA;the crypto access list, and the GRE tunnel interface. This feature&#xA;allows users to configure a single mGRE tunnel interface, a single&#xA;IPsec profile, and no crypto access lists on the hub router to handle&#xA;all spoke routers. Thus, the size of the configuration on the hub&#xA;router remains constant even if spoke routers are added to the&#xA;network.&lt;/p&gt;&#xA;&lt;p&gt;DMVPN architecture can group many spokes into a single multipoint GRE&#xA;interface, removing the need for a distinct physical or logical&#xA;interface for each spoke in a native IPsec installation.&lt;/p&gt;&#xA;&lt;h3&gt;Automatic IPsec Encryption Initiation&lt;/h3&gt;&#xA;&lt;p&gt;GRE has the peer source and destination address configured or resolved&#xA;with NHRP. Thus, this feature allows IPsec to be immediately triggered&#xA;for the point-to-point GRE tunneling or when the GRE peer address is&#xA;resolved via NHRP for the multipoint GRE tunnel.&lt;/p&gt;&#xA;&lt;h3&gt;Support for Dynamically Addressed Spoke Routers&lt;/h3&gt;&#xA;&lt;p&gt;When using point-to-point GRE and IPsec hub-and-spoke VPN networks,&#xA;the physical interface IP address of the spoke routers must be known&#xA;when configuring the hub router because the IP address must be&#xA;configured as the GRE tunnel destination address. This feature allows&#xA;spoke routers to have dynamic physical interface IP addresses (common&#xA;for cable and DSL connections). When the spoke router comes online, it&#xA;will send registration packets to the hub router: within these&#xA;registration packets is the current physical interface IP address of&#xA;this spoke.&lt;/p&gt;&#xA;&lt;h3&gt;Dynamic Creation for Spoke-to-Spoke Tunnels&lt;/h3&gt;&#xA;&lt;p&gt;This feature eliminates the need for spoke-to-spoke configuration for&#xA;direct tunnels. When a spoke router wants to transmit a packet to&#xA;another spoke router, it can now use NHRP to dynamically determine the&#xA;required destination address of the target spoke router. (The hub&#xA;router acts as the NHRP server, handling the request for the source&#xA;spoke router.) The two spoke routers dynamically create an IPsec&#xA;tunnel between them so data can be directly transferred.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-09-09T15:43:02.547" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34762" PostTypeId="2" ParentId="34754" CreationDate="2016-09-09T16:24:32.457" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible that there is one MAC address associated to more interfaces in the switch MAC table? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. A MAC address is an address of a unique NIC on the network, and each MAC address will only appear once in a switch's MAC address table. If a there are more than one NICs on the same LAN that share the same MAC address, it will cause all sorts of communication issues.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If not, what is the behavior when frame with known MAC comes from a different interface?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The Switch will not store the same MAC address on multiple ports. It will simply update its MAC address table with the location of the most recent frame arriving with the duplicate MAC address.  If both hosts are transmitting constantly, that will cause the MAC address entry to bounce between the two switch ports (known as &lt;em&gt;MAC flapping&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the receiving side, the hosts will never get all the frames that are intended for them. Its like being in one conversation but only receiving every other word (and someone else receiving the remaining words).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Duplicate MAC addresses on the same L2 network causes both hosts to have communication issues. However, duplicate MAC addresses on different L2 networks (aka, separated by a router) will work just fine.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-09-09T16:24:32.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34764" PostTypeId="2" ParentId="34754" CreationDate="2016-09-09T16:57:24.483" Score="2" Body="&lt;p&gt;Yes it is possible via MAC spoofing.  If you are seeing the same MAC address on multiple ports then it is possible that someone is in your network doing some not nice things.&lt;/p&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2016-09-09T16:57:24.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34765" PostTypeId="1" AcceptedAnswerId="34768" CreationDate="2016-09-09T16:59:16.917" Score="12" ViewCount="7712" Body="&lt;p&gt;I learnt that in ARP Protocol, to send a packet from one machine to another machine we need to know the MAC Address of the destination machine but since the destination has already been assigned a unique IP Address then isn't sending MAC Address redundant ?&lt;br&gt;&lt;br&gt;&lt;strong&gt;Note-&lt;/strong&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I understand in TCP/IP there are various layers and among those is Data link layer whose its primary function is to check if the machines MAC Address matches the packets destination MAC Address.&lt;br&gt;But since the packet already contains the Destination IP Address so why can't we send the packet further to the Network Layer to match the packets destination IP address with the machines IP address without making this check at the data link layer with MAC address.&lt;br&gt;Please do not mark this question as dublicate because I've read previous Q&amp;amp;A on this topic but nothing explains the reason why this check isn't made at the network layer instead of data link layer.&#xA;&lt;br&gt;Kindly explain. Thank you.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="21881" LastEditorUserId="8499" LastEditDate="2018-03-09T22:55:59.067" LastActivityDate="2021-05-04T07:22:06.670" Title="Why do we need MAC Address if we can uniquely identify each machine with an IP Address" Tags="|ip|mac-address|lan|arp|ip-address|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34766" PostTypeId="2" ParentId="34765" CreationDate="2016-09-09T17:07:02.840" Score="4" Body="&lt;p&gt;IP addresses are like your hair cut.  It typically doesn't change often, but when it does you can be completely unrecognizable.  The MAC address is like your fingerprint.  You may not look the same, but your fingerprint never changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC addresses allow us to do several things.  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;They allow us to identify the manufacturer of an item.&lt;/li&gt;&#xA;&lt;li&gt;They provide an unchanging (essentially) identification for an item.&lt;/li&gt;&#xA;&lt;li&gt;It allows for less hardware intensive packet transfer in LANs.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="14403" LastActivityDate="2016-09-09T17:07:02.840" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="34767" PostTypeId="2" ParentId="34760" CreationDate="2016-09-09T17:22:38.487" Score="1" Body="&lt;p&gt;The short answer is: no, you can't (with OSPF), at least not in a nice way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In OSPF the whole DMVPN network within the DMVPN cloud (that is, at least the tunnel interface needs to be in the same area (area 0 in your case), just because your mGRE interface on the hub routers cannot be in different areas. This is the reason why stub areas (there are no stub routers in OSPF) won't help you out. By design you cannot filter LSAs within one area. Further you need to learn the routes of both main offices down at the spokes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Technically you could place an ACL outbound on the tunnel interfaces of the hubs, denying the traffic of the remote main office. At least in this case the traffic is not sent through the hubs, possibly tearing down their Internet connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My suggestion: do not run OSPF on top of DMVPN unless you &lt;em&gt;really have&lt;/em&gt; to do so. Any distance vector protocol such as EIGRP (and yes, even RIP) would be better. You could also consider running BGP (with the hubs running as route reflector), giving you great flexibility.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I strongly agree with Ron and Zack in the comments of your question. Ideally you would add a redundant connection between both head offices.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="3875" LastEditDate="2016-09-09T17:34:10.087" LastActivityDate="2016-09-09T17:34:10.087" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34768" PostTypeId="2" ParentId="34765" CreationDate="2016-09-09T18:18:03.537" Score="9" Body="&lt;p&gt;Don't confuse the network layers. Each layer has a specific purpose. Also, don't assume that there is only one protocol for each layer. Layer-2 has many protocols, some of which use MAC addresses, and some which don't. Of those that use MAC addresses, some use 48-bit MAC addresses, and some use 64-bit MAC addresses. There are also multiple layer-3 protocols. IPv4, the most used, but not the only, layer-3 protocol, uses 32-bit addresses, but it is being replaced with IPv6, which uses 128-bit addresses. You don't want to replace or upgrade all your layer-2 devices each time you want to run a different layer-3 protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC addresses are layer-2 addresses, and they are used to deliver layer-2 frames on a LAN. Switches are layer-2 devices, and they use MAC addresses to create a table of which host is connected to which switch interface. A switch will look at the source MAC address to build its MAC address table, and it will look at the destination MAC address, look it up in its MAC address table, and deliver the frame to the correct port. Absent a destination address in its MAC address table, the switch needs to flood the frame our every other interface, and that is pretty inefficient and wasteful of bandwidth on all the other interfaces. Switches do not look inside the frame to inspect the IP address. This allows layer-2 and switches to carry any layer-3 protocol (IPv4, IPX, IPv6, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addresses are layer-3 addresses, and they are only looked at by layer-3 devices, e.g. routers. A router receiving a layer-2 frame will strip the frame from the layer-3 packet, and it will look up the IP address in its routing table to see to which interface the packet should be switched. The router will build a new layer-2 frame for the new LAN connected to the destination interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 (MAC address, etc.) is for devices connected to the same layer-2 domain, and layer-3 (IP address, etc.) allows you to send data to other layer-2 domains.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-09-09T19:08:51.537" LastActivityDate="2016-09-09T19:08:51.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34770" PostTypeId="2" ParentId="34765" CreationDate="2016-09-09T23:10:10.260" Score="16" Body="&lt;p&gt;There is a historical reason for this, as @ronmaupin alludes to.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In small networks, you don't need a layer 3 protocol.  All the devices are directly addressable, so layer 2 addresses work fine.  As networks got bigger and became interconnected, there was a need to know how to get from one network to another.  That is the function of routing, which is done at layer 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP was not the only (or even the most popular) L3 protocol, and Ethernet was not the only layer 2 protocol. That is why there are layers.   You can isolate the function of one from the other.  It made developing network software easier because you didn't have to have a special version for every type of network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer 3 function doesn't know or care whether you use Ethernet, token ring, PPP, or a dozen other obsolete network protocols.   Similarly, the layer 2 protocol doesn't care if you're using IP, IPX, or something else. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The price you pay for layering is that you have to &quot;map&quot; between a 32 bit IP address and a 48 bit MAC address (for Ethernet).  That is the purpose of the ARP protocol - to map between layer 2 and layer 3.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-09T23:10:10.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34771" PostTypeId="1" CreationDate="2016-09-10T00:01:54.663" Score="2" ViewCount="52" Body="&lt;p&gt;I work at a corporation and we have engineer's who test &quot;in home&quot; settings which requires a wireless router.  Such testing doesn't need to extend beyond the desk of the user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently we keep track of what channels we assign using a wiki and table.  However, I realized a few months ago that we never update the table beyond initial entries, so when people move (which is often) the list becomes outdated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal of the table was to avoid saturating any specific channel.  So I thought couldn't we just use uniform random numbers to assign channels?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking at the channels we use, 2.4G and 5.0G.  After seeing that certain channels overlap on 2.4 (but not on 5.0G).  I thought for 2.4G it would be best to either use the half overlap channels (1, 3, 5, 7, 9, 11)... or the non overlap channels of 1, 6, 11.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We work in multi storied buildings, so there might be bleed over from inbetween floors.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of the demand for multiple wireless routers on any given floor (due to testing) results in unavoidable channel overlap. To mitigate any one channel from becoming too overlapped/saturated, I thought random assignment would result in uniform distribution of channels with about equal saturation for each channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thoughts?&lt;/p&gt;&#xA;" OwnerUserId="30394" LastEditorUserId="8499" LastEditDate="2018-11-22T23:13:44.707" LastActivityDate="2018-11-22T23:13:44.707" Title="Question on using random channels for wireless networks" Tags="|wireless|ieee-802.11|access-point|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34772" PostTypeId="2" ParentId="34771" CreationDate="2016-09-10T00:16:26.343" Score="2" Body="&lt;p&gt;What you really need to do is to get a wireless site survey completed. This will give you the required WAP quantity, placement, frequency, etc., and identify problems like radio shadows and outside interference. The survey can take into account the locations where you do testing (outside interference), and assign a particular frequency to use for the testing in a particular location. The survey is also three-dimensional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Randomly assigning frequencies to your WAPs is never, ever a good idea.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-10T00:16:26.343" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34774" PostTypeId="1" AcceptedAnswerId="34776" CreationDate="2016-09-10T08:00:06.127" Score="0" ViewCount="1180" Body="&lt;p&gt;I am using MikroTik HotSpot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In our company's portal, We have a link like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;a href=&quot;itms-services://?action=download-manifest&amp;amp;url=https://www.test.com/testapp.plist&quot;&amp;gt;Download Test App&amp;lt;/a&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When our iOS users have the Internet, there is no problem to download the iOS test app.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When they are in our HotSpot zone (Before authentication, Without the Internet), they should download the test app too, But they can't.&#xA;The popup message &quot;Can not connect to test.com&quot; error occurred on their iOS device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've opened &lt;strong&gt;*.test.com&lt;/strong&gt; and &lt;strong&gt;*.apple.com&lt;/strong&gt; in my Walled Garden list without success.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've although captured the traffic using Fiddler but there are no URLs exept those above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know about &lt;strong&gt;itms-services&lt;/strong&gt; protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to open something in the Walled Garden to allow users to download the test app?&#xA;&lt;br&gt;Or is there any way to open other protocols (like itms-services) in the Walled Garden list?&lt;/p&gt;&#xA;" OwnerUserId="16172" LastEditorUserId="8499" LastEditDate="2018-02-14T16:17:54.263" LastActivityDate="2018-02-14T16:17:54.263" Title="MikroTik HotSpot Walled Garden: iOS ITMS-Services Protocol" Tags="|wireless|" AnswerCount="1" CommentCount="1" ClosedDate="2016-09-10T17:44:08.790" ContentLicense="CC BY-SA 3.0" />
  <row Id="34775" PostTypeId="1" AcceptedAnswerId="34880" CreationDate="2016-09-10T09:32:32.133" Score="1" ViewCount="570" Body="&lt;p&gt;I would like to combine private and public addressing to PPPoE clients from a Cisco BRAS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you think is possible to do it using the same virtual template?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I define &lt;code&gt;ip nat inside&lt;/code&gt; in the PPPoE enabled interface and an access-list that will match only the addresses  want, would this impact clients with public IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sure that using different templates would work, but I would like to try using the same VLAN and not to separate some clients in a different VLAN.&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="8499" LastEditDate="2016-09-10T17:32:41.733" LastActivityDate="2016-09-13T20:12:06.977" Title="Cisco 7609 BRAS, mix NAT and public IP addressing for PPPoE clients" Tags="|cisco|router|nat|pppoe|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34776" PostTypeId="2" ParentId="34774" CreationDate="2016-09-10T11:19:50.367" Score="1" Body="&lt;p&gt;On a client who has internet access, download your app, and simultaneously, run the tool/torch tool to see all connections on wlan interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will be able to see protocol, port, destination if the &quot;itms-service&quot; thing. Then, add a firewall or walled-garden(ip) rule according to that traffic and you should be okay.&lt;/p&gt;&#xA;" OwnerUserId="20569" LastActivityDate="2016-09-10T11:19:50.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34778" PostTypeId="1" AcceptedAnswerId="35257" CreationDate="2016-09-10T17:11:46.660" Score="0" ViewCount="108" Body="&lt;p&gt;Is there a delay for openflow rules added with &lt;code&gt;ovs-vsctl&lt;/code&gt; tool? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am successfully limiting the traffic of a specific interface with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ovs-vsctl set interface s0-eth1 ingress_policing_rate=128&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, it takes some 5 seconds until I see any effect. I monitor host h1 (connected to s0-eth1) with &lt;code&gt;ifstat&lt;/code&gt; while performing a SYN flood attack from other hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using mininet version 2.2.1 with Open vSwitch version 2.5.0 and OpenFlow 1.4.&lt;/p&gt;&#xA;" OwnerUserId="30192" LastEditorUserId="30192" LastEditDate="2016-09-10T17:43:02.773" LastActivityDate="2016-09-26T17:11:55.013" Title="OpenFlow takes some seconds to apply rule" Tags="|openflow|mininet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34780" PostTypeId="2" ParentId="33029" CreationDate="2016-09-10T18:21:12.623" Score="1" Body="&lt;p&gt;I have read that an acknowledgement is sent to the previous node when the packet is received at the node(current) &amp;amp; only after that the next packet is transmitted..... therefore the acknowledgement ensures the reliable data transfer&lt;/p&gt;&#xA;" OwnerUserId="30408" LastActivityDate="2016-09-10T18:21:12.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34783" PostTypeId="1" AcceptedAnswerId="34792" CreationDate="2016-09-11T01:02:48.460" Score="1" ViewCount="481" Body="&lt;p&gt;I currently setting up my home network with a Dell PowerEdge R300 running pfSense as my router and a Cisco Catalyst 3560G switch. In the end I want to have two separate networks, one that is connected to the internet with a LAN, and another that consists of only LAN for pen-testing and various other things that I want to have completely cut off from the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this achievable through VLANS or other pfSense configurations? Would the VLAN be configured in pfSense, on my switch, or both?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is not achievable through VLANS, what would be the best method? I would prefer not to run a second routing machine but I will if I have to.&lt;/p&gt;&#xA;" OwnerUserId="30228" LastActivityDate="2016-09-12T05:19:06.127" Title="Is it possible to create an offline VLAN?" Tags="|routing|switch|vlan|pfsense-2|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34785" PostTypeId="2" ParentId="34783" CreationDate="2016-09-11T02:44:28.217" Score="0" Body="&lt;p&gt;Yes this is achievable with VLANs.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine you would want penetration tester to sit in the less secure / outsize zone.  So, plug the Internet link, pen testing server/service, and Dell server into an 'outside' VLAN on the switch.  Plug your computers and Dell into the 'inside' VLAN on the switch.  Make the Dell the layer 3 gateway for both inside endpoints.  No routing on the switch, the Dell is the layer 3 gateway and firewall which has 2 interfaces (whether physical or logical).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-11T02:44:28.217" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34786" PostTypeId="2" ParentId="33945" CreationDate="2016-09-11T03:07:36.687" Score="0" Body="&lt;p&gt;Look at the router.  The debug below tells you if it is receiving DHCP requests. [source &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/27470-100.html#tshootunabletoobtain&quot; rel=&quot;nofollow&quot;&gt;Cisco&lt;/a&gt;]&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In global configuration mode, enter the following access-list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 100 permit ip host 0.0.0.0 host 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;In exec mode, enter the following debug command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;debug ip packet detail 100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Sample output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#debug ip packet detail 100&#xA;IP packet debugging is on (detailed) for access list 100&#xA;Router#&#xA;00:16:46: IP: s=0.0.0.0 (Ethernet4/0), d=255.255.255.255, len 604, rcvd 2&#xA;00:16:46: UDP src=68, dst=67&#xA;00:16:46: IP: s=0.0.0.0 (Ethernet4/0), d=255.255.255.255, len 604, rcvd 2&#xA;00:16:46: UDP src=68, dst=67&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-11T03:07:36.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34787" PostTypeId="2" ParentId="10548" CreationDate="2016-09-11T03:22:17.837" Score="0" Body="&lt;p&gt;My company has converted over to the Microsoft Lync digital telephone system. This voice traffic existing on the same LAN as our data traffic, it was important during implementation that voice traffic be given higher priority than any of the other packet types. Each switch and router in our network had to be adjusted accordingly. One unexpected issue we ran into was large print jobs. If someone kicked off a large print job, we had QoS set wrong on these print jobs and it would cause latency. This was intermittent and hard to track down. Once it was found and we adjusted QoS, we haven't had any other issues.&lt;/p&gt;&#xA;" OwnerUserId="30415" LastActivityDate="2016-09-11T03:22:17.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34790" PostTypeId="1" AcceptedAnswerId="34793" CreationDate="2016-09-11T05:21:28.237" Score="1" ViewCount="69" Body="&lt;p&gt;How do you convert a network address such as 192.168.8.5 to a subnet address or get the default subnet mask for it? im very confused!&lt;/p&gt;&#xA;" OwnerUserId="30416" LastActivityDate="2016-09-11T08:50:35.417" Title="Network to Subnet conversion" Tags="|ip|subnet|" AnswerCount="1" CommentCount="0" ClosedDate="2016-09-11T13:02:48.090" ContentLicense="CC BY-SA 3.0" />
  <row Id="34791" PostTypeId="2" ParentId="23436" CreationDate="2016-09-11T05:50:02.813" Score="1" Body="&lt;p&gt;Try this:&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network My-LAN&#xA; network-object 10.10.10.0 255.255.255.0&#xA;!&#xA;access-list My-ACL extended permit tcp any object-group My-LAN eq smtp&#xA;!&#xA;access-group My-ACL in interface My-Interfacename&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you dont need to add this, i just want to share how to add the &quot;interfacename&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0.90&#xA; vlan 90&#xA; nameif My-Interfacename&#xA; security-level 60&#xA; ip address 10.10.10.1 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21768" LastEditorUserId="509" LastEditDate="2016-09-11T06:50:33.603" LastActivityDate="2016-09-11T06:50:33.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34792" PostTypeId="2" ParentId="34783" CreationDate="2016-09-11T07:04:46.213" Score="2" Body="&lt;p&gt;Yes this is achievable with VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just create 2 vlans on the switch, in the first you put the inside interface of your  pfSense router/firewall and all devices that need Internet access, in the other you put all devices that you want to be cut off. As long as you do not add a router to that second vlan, the devices in that vlan will only be able to communicate with each other.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-09-12T05:19:06.127" LastActivityDate="2016-09-12T05:19:06.127" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="34793" PostTypeId="2" ParentId="34790" CreationDate="2016-09-11T08:50:35.417" Score="1" Body="&lt;p&gt;In the past classful subnets were used.  See &lt;a href=&quot;https://en.m.wikipedia.org/wiki/Classful_network&quot; rel=&quot;nofollow&quot;&gt;https://en.m.wikipedia.org/wiki/Classful_network&lt;/a&gt; for more information.  If you convert the address 192.168.8.5 to binary, it starts with 110, so it is a class C network.  Class C networks use a 24 bit subnet mask, i.e. 255.255.255.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nowadays, classful networks are no longer used as the masks are inflexible and lead to a lot of wasted IPv4 addresses. We need to preserve IPv4 addresses by sizing networks appropriately.  CIDR replaced classful networks and allows the designer to allocate any size subnet mask to a network.  The only way to determine the subnet mask nowadays is to look at the design documents or check what mask has been entered on the interface configuration.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-09-11T08:50:35.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34796" PostTypeId="2" ParentId="34638" CreationDate="2016-09-11T22:13:56.413" Score="0" Body="&lt;p&gt;Hey I got the answer for this. If we include discontinuous IP addresses in a subnet, there is a chance that destination address will not be a part of the network address in the forwarding table. So it may cause a packet to be forwarded to the wrong output port.&lt;/p&gt;&#xA;" OwnerUserId="30265" LastActivityDate="2016-09-11T22:13:56.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34797" PostTypeId="1" CreationDate="2016-09-11T23:22:00.080" Score="1" ViewCount="2157" Body="&lt;p&gt;I'm studying for the CCNA and this PDF talks about knowing straight-though and crossover and where they should be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do Ethernet types T568A and T568B still matter in networking today?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was always under the impression that devices just auto knew. &lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="8499" LastEditDate="2016-12-07T22:25:13.273" LastActivityDate="2016-12-07T22:25:13.273" Title="Do straight-though and crossover still have any play in today's business" Tags="|ethernet|cabling|cable|layer1|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34801" PostTypeId="2" ParentId="33905" CreationDate="2016-09-12T01:17:51.950" Score="0" Body="&lt;p&gt;In traditional networking, there are stateful firewalls and next-generation firewalls.  NGFWs perform deeper inspection compared to stateful firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either of these types of firewalls can be implemented in an SDN fashion.  The difference with SDN is that the firewall processing is done at the virtual NIC, whereas in traditional networking the firewall processing is done at the physical NIC(s) of the firewall(s).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you think about virtual machines, and a feature such as VMWare's VMotion in an SDN solution, not only would the virtual machine move but the virtual firewall on the vNIC would follow it (as you move it).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-12T01:17:51.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34802" PostTypeId="2" ParentId="34797" CreationDate="2016-09-12T01:55:07.213" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/34425/why-do-i-need-a-crossover-cable-to-connect-devices-of-the-same-type/34446#34446&quot;&gt;Crossover vs Straight-through&lt;/a&gt; was a bigger deal in the 100BASE-TX days. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gigabit Ethernet, or 1000BASE-T, requires the use of &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#auto_mdix&quot; rel=&quot;nofollow noreferrer&quot;&gt;Auto-MDX&lt;/a&gt;, which automatically determine which pairs the opposite side is using for TX/RX and adjusts their side to accommodate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if your deployment is largely using Fast Ethernet, then Crossover vs Straight-through is more significant in your environment. If you've moved on to Gigabit ethernet and Fiber, then the distinction is less significant.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-09-12T01:55:07.213" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34803" PostTypeId="2" ParentId="25780" CreationDate="2016-09-12T04:31:33.113" Score="0" Body="&lt;p&gt;In my experience, I generally will use one port as an outflow and another port as the collector in promiscuous mode....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I work in a full juniper environment now and their equipment has some abilities CIsco does not, like being able to PCAP right off of a switch and read the wireshark. Cisco may have something similar but I dont recall knowing of such as thing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We use it all of the time to assist in troubleshooting on out Juniper ex 4300-4600 and SRX3600 devices. &lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-12T04:31:33.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34805" PostTypeId="2" ParentId="29945" CreationDate="2016-09-12T04:44:15.703" Score="0" Body="&lt;p&gt;I always use a commit-check when im doing any sort of commit operation it will help in these situations. That is just quick advice I am also fairly new to being a Juniper Network engineer most of my previous experience was heavy Cisco/Aruba/checkpoint/palo.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you haven't started reading it already....make sure you put it at the top of your list &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.juniper.net/assets/us/en/local/pdf/study-guide/study-guide-jncia.pdf&quot; rel=&quot;nofollow&quot;&gt;https://www.juniper.net/assets/us/en/local/pdf/study-guide/study-guide-jncia.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the JNCIA manual, free on Juniper's site and contains a wealth of great information you will need to be successful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best,&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-12T04:44:15.703" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34807" PostTypeId="1" CreationDate="2016-09-12T05:45:51.087" Score="0" ViewCount="2365" Body="&lt;p&gt;I have an issue with option 43 , the AP's (cisco )are learning  option 43 when  cisco switch is configured as the  DHCP server but AP's are ignoring the option 43 when infoblox is configured as the  DHCP server. do any one  have came across similar issue !&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="30428" LastActivityDate="2017-09-14T05:09:30.073" Title="Cisco AP's ignoring option 43 offered via infoblox as the dhcp server" Tags="|dhcp|capwap|cisco-wlc|" AnswerCount="1" CommentCount="3" ClosedDate="2018-06-27T14:58:14.790" ContentLicense="CC BY-SA 3.0" />
  <row Id="34808" PostTypeId="2" ParentId="32937" CreationDate="2016-09-12T05:46:21.770" Score="0" Body="&lt;p&gt;I would recommend PVST, also the reason that it is going up and down is obvious...portfast, you have a misconfiguration that is causing flapping. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alsoo as they have indicated above, no switchport command applied to the interface would be correct. I would have just applied something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface gi1/0/22&#xA;  switchport access vlan 2&#xA;  switchport mode access&#xA;  spanning tree portfast &#xA;  spanning tree bpduguard enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, here is a helpful reference from the Cisco site which is a comprehensive resource for the 3750 series along with most other major campus level switching products.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/5234-5.html?referring_site=RE&amp;amp;pos=3&amp;amp;page=http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4000/8-2glx/configuration/guide/stp_enha.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/5234-5.html?referring_site=RE&amp;amp;pos=3&amp;amp;page=http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4000/8-2glx/configuration/guide/stp_enha.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This article from Cisco is great for understanding all of the fine details of STP, troubleshooting it and configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10556-16.html?referring_site=RE&amp;amp;pos=2&amp;amp;page=http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/5234-5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10556-16.html?referring_site=RE&amp;amp;pos=2&amp;amp;page=http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/5234-5.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="266" LastEditDate="2018-08-04T01:32:09.283" LastActivityDate="2018-08-04T01:32:09.283" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="34810" PostTypeId="2" ParentId="1196" CreationDate="2016-09-12T05:58:01.673" Score="-1" Body="&lt;pre&gt;&lt;code&gt;#show mac address-table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will show stored MAC addresses in the switch mac address table, these could be statically assigned by the administrator or user. Or they may be dynamically learned by passing traffic through interfaces.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="8499" LastEditDate="2016-09-13T12:23:50.543" LastActivityDate="2016-09-13T12:23:50.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34811" PostTypeId="1" CreationDate="2016-09-12T06:07:41.320" Score="3" ViewCount="1342" Body="&lt;p&gt;Ive been tasked with writing the SOP along with implementing the above task of upgrading our core/aggregation and ISP routers in my environment.&lt;/p&gt;&#xA;&lt;p&gt;We're currently running 11.4R7 and after speaking with our Juniper rep he has advised 13.3R9 would be the best choice.&lt;/p&gt;&#xA;&lt;p&gt;I have gathered the necessary firmware along with whitepapers and procedures. This will be my first go round with a Juniper upgrade so I am as expected slightly nervous. Im fairly new to Juniper but have years of experience in Cisco environments.&lt;/p&gt;&#xA;&lt;p&gt;Those of you who have experience in this, what can I expect as far as turn over time per device? Any gotchas you have seen or experience that are worth sharing? Ive read the upgrade guide all 350 pages along with many other things.&lt;/p&gt;&#xA;&lt;p&gt;Those of you who have done this before what was your methodology for proceeding through the process start to finish?&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance,&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="27523" LastEditDate="2022-08-23T17:49:51.283" LastActivityDate="2022-08-23T17:49:51.283" Title="Juniper firmware upgrade MX80/480 and 960 junos 11.4R7&gt;&gt;&gt;13.3R9" Tags="|juniper|juniper-junos|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="34812" PostTypeId="2" ParentId="23987" CreationDate="2016-09-12T06:34:18.847" Score="0" Body="&lt;p&gt;DCE=ISP&#xA;DTE=customer side&lt;/p&gt;&#xA;&#xA;&lt;p&gt;they operate off of different standards which are not commonly used in many environments anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting the bandwidth and clockrate for this type of setup is necessary and must match on both sides of the link if im not mistaken. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;X25 and HDLC are common for this type of setup...the 192.168.0.0 represents the network link of the serial connection between the two routers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;.1 and .2 are equal to the last octet in the 192.168.0.x network (class c) and are on the same subnet. Both of these are private IP addresses not routable on the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;S0/0/0/0 refers to serial links in routers in Cisco hardware, Serial links are commonly used for connections to ISP at network boundaries or to WAN links of an ISP.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-12T06:34:18.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34813" PostTypeId="2" ParentId="83" CreationDate="2016-09-12T06:51:44.937" Score="1" Body="&lt;p&gt;commit | compare &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I always use this to see the prior versus the new config, also using commit confirm 1 or other arbitrary value can save you from mistakes and rollback when the value expires if necessary. For example the 1 after confirm is 1 minute..after that if not confirmed it will rollback the changes made.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c-tsmith@COSMO_CORPDC_EX45_00# commit | ?&lt;br&gt;&#xA;Possible completions:&#xA;  count                Count occurrences&#xA;  display              Show additional kinds of information&#xA;  except               Show only text that does not match a pattern&#xA;  find                 Search for first occurrence of pattern&#xA;  hold                 Hold text without exiting the --More-- prompt&#xA;  last                 Display end of output only&#xA;  match                Show only text that matches a pattern&#xA;  no-more              Don't paginate output&#xA;  request              Make system-level requests&#xA;  resolve              Resolve IP addresses&#xA;  save                 Save output text to file&#xA;  trim                 Trim specified number of columns from start of line&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an example from one of our switches without the output for comparison.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-12T06:51:44.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34815" PostTypeId="2" ParentId="3529" CreationDate="2016-09-12T07:02:44.707" Score="0" Body="&lt;p&gt;Monitor traffic off interfaces with protocol, sends this to a pcap file like with wireshark, generally on the var/log directory.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;monitor traffic interface ge-0/0/0&#xA;monitor interface ge-0/0/0&#xA;monitor traffic interface ge-0/2/3 matching &quot;proto 89&quot; write-file ospf.cap - matches proto 89 and writes it in ospf.cap&#xA;show security flow session ... options&#xA;&#xA;#set system syslog file messages any info – to save all log messages to file “messages”&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to show al log messages-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show log messages | match LOGIN | match “Mar 16”&#xA;file list detail /var/log = ls –al (to see permitions, etc.)&#xA;clear log messages  - to clear the contents of the messages file&#xA;&#xA;monitor start       messages  - live monitoring of messages file&#xA;monitor list&#xA;monitor stop – to stop all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more detailed information about a process, under the process level:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#set traceoptions file filenamefil world-readable&#xA;#set traceoptions flag all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="8499" LastEditDate="2016-09-12T14:11:23.207" LastActivityDate="2016-09-12T14:11:23.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34816" PostTypeId="2" ParentId="3232" CreationDate="2016-09-12T07:08:29.650" Score="0" Body="&lt;p&gt;The 15.1 + versions of Junos use the version 9+ version of freeBSD or upgraded version of freeBSD...it provides a lot of new features although it will change the file structure when implemented complete backups are necessary because data loss is possible. &lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-12T07:08:29.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34817" PostTypeId="2" ParentId="30499" CreationDate="2016-09-12T07:18:45.093" Score="1" Body="&lt;p&gt;This is more about forming layer 2 boundaries for frames and segmenting your traffic than security, it does help to some degree because without layer 3 ip routing the traffic from each vlan only knows about vlans allowed on trunks connected to that host...trunks carry multiple vlans and connect layer 2 environments with the ability to allow specific vlans on each trunk or allow all (  bad idea). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a layer three Virtual routed interface is added to a vlan then it can be connected to other layer three vlans spanning subnet and network boundaries. This of course requires a router or layer three switch along with a routing protocol to dictate the rules of traffic flow connectivity etc.....&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-12T07:18:45.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34818" PostTypeId="2" ParentId="22256" CreationDate="2016-09-12T07:26:56.643" Score="0" Body="&lt;p&gt;Using most modern APs and WLCs you can make use of the 2.4 and 5 ghz spectrums G,N and AC band standards...there is no need to create two separate environments. We have 4 or 5 guest wifi SSIDs in our environment although use AP numbers in the thousands and 6 WLC controllers. ALso through MIMO its possible to use multiple vlans and environments without dividing the physical equipment, it is divided on the logical level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The APs and WLC software know when they have different SSIDs that interference needs to be avoided and will adjust accordingly. just create a different group for your guest APs and their SSID and implement more restrictive policies on that group to avoid problems. Think access rights QOS etc....&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-12T07:26:56.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34819" PostTypeId="2" ParentId="33780" CreationDate="2016-09-12T07:31:33.153" Score="0" Body="&lt;p&gt;Using the WLC, this is something that can easily be figured out through IP and MAC address logging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would hope that you would have multiple VLAns in that type of environment or at least three in a small one, like MGMT, corp and guest at the very least....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In that scenario you would have three logical IP blocks and this would provide you a lot of advantages from traffic flow to security.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-12T07:31:33.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34820" PostTypeId="2" ParentId="30476" CreationDate="2016-09-12T07:40:17.173" Score="0" Body="&lt;p&gt;Simple formula....find your number of hosts then subtract 2...first address in the subnet=network ID, last IP is the broadcast address used for communication out of the network to other networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two IPs are not valid for assignment to devices on the subnet.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-12T07:40:17.173" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34822" PostTypeId="2" ParentId="33910" CreationDate="2016-09-12T08:01:56.830" Score="0" Body="&lt;p&gt;Java 7 version 45 and 63 worked for me with asdm, lower your java security setting to medium and whitelist the ip/hostname of the ASA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;specify object group then add the network object-host followed by the IP desired.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two links cover just about any issue you could have...good luck!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.gomjabbar.com/2011/08/06/cisco-asa-device-management-%E2%80%93-debugging-asdm/#sthash.1JEplDUI.dpbs&quot; rel=&quot;nofollow&quot;&gt;http://www.gomjabbar.com/2011/08/06/cisco-asa-device-management-%E2%80%93-debugging-asdm/#sthash.1JEplDUI.dpbs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.winsysadminblog.com/2016/01/log-asdm-cisco-asa-get-unable-launch-device-manager-error/&quot; rel=&quot;nofollow&quot;&gt;http://www.winsysadminblog.com/2016/01/log-asdm-cisco-asa-get-unable-launch-device-manager-error/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-12T08:01:56.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34825" PostTypeId="2" ParentId="30399" CreationDate="2016-09-12T09:12:55.800" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If the Ubiquiti USG is NATing the outbound traffic, then why do I need&#xA;  to add a static route to the upstream router that includes the&#xA;  172.27.2.0/24 subnet, isn't this out of context?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think you're 100% correct, and that the problem is not on the upstream router but on the USG. There is a big &quot;If&quot; at the start of your question; it sounds like the USG is not really doing NAT. Personally I don't know this specific product but it seems extremely likely that just adding a static route is not enough, i.e. it is not by default doing NAT for anything arriving on its &quot;inside&quot; interface, probably only for the directly connected subnet. So you will have to somehow tell it to do NAT for 172.27.0.0/16 as well. &lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-12T09:12:55.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34827" PostTypeId="1" AcceptedAnswerId="34860" CreationDate="2016-09-12T11:43:38.177" Score="1" ViewCount="697" Body="&lt;p&gt;if I copy a config from a tftp server to running config of an IOS (various =&gt; v12 device which currently has nothing in nvram, the banner part of the config is not included in the new running config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas how to achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;banner config example (tried both):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;banner exec ^C&#xA;text&#xA;^c&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or (where &quot;-&quot; = deliminator)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;banner exec -&#xA;text&#xA;-&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1316" LastEditorUserId="1316" LastEditDate="2016-09-12T14:33:24.763" LastActivityDate="2016-09-13T13:16:57.443" Title="cisco: configure (login|exec|motd) banner via copy" Tags="|cisco|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34829" PostTypeId="1" AcceptedAnswerId="34832" CreationDate="2016-09-12T13:19:22.347" Score="0" ViewCount="1780" Body="&lt;p&gt;I was doing some reading on the algorithms used in link state vs. distance vector routing protocols.  I understand that Dijkstra's algorithm is used in link state routing, and I can see why this would be so.  But I've also read that the Bellman-Ford algorithm is more useful for distance vector routing because it can work with negative edge weights?  I'm confused by this.  How can you have a negative edge weight in a real network?  My understanding is that the edge weight corresponds to the estimated time it takes for a packet to make its way between one router and the next.  How can this value be negative?&lt;/p&gt;&#xA;" OwnerUserId="29704" LastActivityDate="2016-09-12T14:50:55.883" Title="How does the Bellman-Ford algorithm apply to real networks?" Tags="|routing|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34830" PostTypeId="2" ParentId="34829" CreationDate="2016-09-12T13:36:37.073" Score="2" Body="&lt;p&gt;I think you're misreading/misinterpreting the article. It doesn't say BF is better for routing &lt;strong&gt;because&lt;/strong&gt; it works with negative weights, that's just a feature of the mathematical algorithm.  As you point out, in &quot;real life,&quot; negative weights don't exist.  But neither do imaginary numbers, yet you can do math with them. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-12T13:36:37.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34831" PostTypeId="1" AcceptedAnswerId="43282" CreationDate="2016-09-12T14:22:08.877" Score="1" ViewCount="738" Body="&lt;p&gt;I have inherited some Cisco Aironet 1042 fat APs and a network design of a flat, single VLAN (10). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To offer multiple SSIDs, the Cisco insists on a VLAN for each SSID. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By placing the interfaces against a bridge group, I am able to offer network access across all three SSIDs when the AP is connected to a simple port on Cisco the LAN configured as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport access vlan 10&#xA;switchport mode access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or on HP ProCurve configured as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;untagged&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I have one AP (rather, one location- it occurs on any AP plugged there) that is connected behind two switches that refuses to pass traffic - UNLESS I have a dumb switch in front of it. All other APs that connect to a switch have had no issues- including one that is connected behind another switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes me think that the dumb switch is stripping VLAN identification off of it? Does that push it to VLAN 1 as the default? I don't see how that'd work given that the AP works just fine behind the dumb switch but not on the switch proper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how to get this AP behind two switches working without the dumb switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AP is plugged to a switch plugged to another switch and the connection between the switches is an untagged uplink.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my config. Thoughts?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;T-0060#show running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 4101 bytes&#xA;!&#xA;! Last configuration change at 11:26:47 EDT Sun Aug 14 2016 by newlifeadmin&#xA;! NVRAM config last updated at 11:21:11 EDT Sun Aug 14 2016&#xA;! NVRAM config last updated at 11:21:11 EDT Sun Aug 14 2016&#xA;version 15.3&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname T-0060&#xA;!&#xA;!&#xA;logging rate-limit console 9&#xA;enable secret 5 #SECRET#&#xA;!&#xA;no aaa new-model&#xA;clock timezone EST -5 0&#xA;clock summer-time EDT recurring&#xA;no ip source-route&#xA;no ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;dot11 syslog&#xA;!&#xA;dot11 ssid RN Faculty&#xA;   vlan 10&#xA;   authentication open&#xA;   authentication key-management wpa&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 #SECRET#&#xA;!&#xA;dot11 ssid RN Guest&#xA;   vlan 30&#xA;   authentication open&#xA;   authentication key-management wpa&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 #SECRET#&#xA;!&#xA;dot11 ssid RN Students&#xA;   vlan 20&#xA;   authentication open&#xA;   authentication key-management wpa&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 #SECRET#&#xA;!&#xA;!&#xA;!&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;username #SECRET# password 7 #SECRET#&#xA;username #SECRET# privilege 15 password 7 #SECRET#&#xA;username #SECRET# privilege 15 password 7 #SECRET#&#xA;!&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption vlan 10 mode ciphers aes-ccm tkip&#xA; !&#xA; encryption vlan 20 mode ciphers aes-ccm tkip&#xA; !&#xA; encryption vlan 30 mode ciphers aes-ccm tkip&#xA; !&#xA; ssid RN Faculty&#xA; !&#xA; ssid RN Guest&#xA; !&#xA; ssid RN Students&#xA; !&#xA; antenna gain 0&#xA; mbssid&#xA; station-role root&#xA;!&#xA;interface Dot11Radio0.10&#xA; encapsulation dot1Q 10 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.20&#xA; encapsulation dot1Q 20&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio0.30&#xA; encapsulation dot1Q 30&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption vlan 20 mode ciphers aes-ccm tkip&#xA; !&#xA; encryption vlan 10 mode ciphers aes-ccm tkip&#xA; !&#xA; encryption vlan 30 mode ciphers aes-ccm tkip&#xA; !&#xA; ssid RN Faculty&#xA; !&#xA; ssid RN Guest&#xA; !&#xA; ssid RN Students&#xA; !&#xA; antenna gain 0&#xA; peakdetect&#xA; dfs band 3 block&#xA; mbssid&#xA; channel dfs&#xA; station-role root&#xA;!&#xA;interface Dot11Radio1.10&#xA; encapsulation dot1Q 10 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1.20&#xA; encapsulation dot1Q 20&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface Dot11Radio1.30&#xA; encapsulation dot1Q 30&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 spanning-disabled&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; bridge-group 1&#xA; bridge-group 1 spanning-disabled&#xA; no bridge-group 1 source-learning&#xA;!&#xA;interface BVI1&#xA; mac-address ccef.484c.bab0&#xA; ip address 192.168.1.60 255.255.255.0&#xA;!&#xA;ip default-gateway 192.168.1.254&#xA;ip forward-protocol nd&#xA;ip http server&#xA;no ip http secure-server&#xA;ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag&#xA;!&#xA;!&#xA;bridge 1 route ip&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; login local&#xA;line vty 0 4&#xA; login local&#xA; transport input all&#xA;!&#xA;end&#xA;&#xA;T-0060#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14269" LastActivityDate="2017-08-15T16:43:34.643" Title="Cisco Aironet 1042 Multiple SSID Single VLAN Trunking issue" Tags="|cisco|vlan|access-point|hp-procurve|aironet|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34832" PostTypeId="2" ParentId="34829" CreationDate="2016-09-12T14:50:55.883" Score="3" Body="&lt;p&gt;Negative edge weights are indeed not very useful in routing applications of the algorithm. Being able to handle negative weights is one property in which Bellman-Ford differs from Dijkstra, but it is not the reason it is preferred in Distance Vector algorithms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running Dijkstra's algorithm requires full knowledge of all edges and weights in the network. Unlike link state routing algorithms, distance vector algorithms do not construct such a full network map.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means Dijkstra's algorithm cannot be used in distance vector algorithms. (Distributed) Bellman-Ford works without the full network view and thus can be used in distance vector algorithms.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2016-09-12T14:50:55.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34833" PostTypeId="2" ParentId="34827" CreationDate="2016-09-12T16:12:01.520" Score="-3" Body="&lt;p&gt;try specifying the boot image boot, e.g. &lt;code&gt;system bootflash:n5000.bin&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config t&#xA;banner exec #&#xA;********&#xA;* test *&#xA;********&#xA;#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/configuration/guide/ffun_c/fcf004.html#wp1001226&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Terminal Banners&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Banners can be customized with the use of banner tokens. Tokens are keywords in the form $(token) that, when used in a banner message, display the currently configured value of the token argument (for example, the router host name, domain name, or IP address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oafUu.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oafUu.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-09-12T23:12:04.257" LastActivityDate="2016-09-12T23:12:04.257" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34834" PostTypeId="2" ParentId="30499" CreationDate="2016-09-12T16:24:36.990" Score="-1" Body="&lt;p&gt;None.  Security vulnerabilities are unaffected by layer 3 hops; they are usually embedded in applications.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-12T16:24:36.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34835" PostTypeId="2" ParentId="1196" CreationDate="2016-09-12T16:31:23.813" Score="0" Body="&lt;p&gt;Q. how can I test to know if there is layer 2 connectivity&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A. Configure LLDP and/or show interface&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-12T16:31:23.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34836" PostTypeId="2" ParentId="596" CreationDate="2016-09-12T17:08:32.610" Score="1" Body="&lt;p&gt;Quickly?  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Telnet or SSH into the Cisco switch.&lt;/li&gt;&#xA;&lt;li&gt;Type &lt;code&gt;terminal monitor&lt;/code&gt;; press enter.&lt;/li&gt;&#xA;&lt;li&gt;Unplug the cable or shut NIC via the&#xA;OS from the endpoint in question&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;00:00:47: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/1, changed state to down&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note, if you are connecting to the switch from the endpoint you are unplugging you will not get the syslog message because you will have cut connectivity.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-12T17:08:32.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34842" PostTypeId="2" ParentId="30499" CreationDate="2016-09-12T23:12:58.810" Score="0" Body="&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices on the same L2 domain can be vulnerable to each other. ARP spoofing, Mac spoofing or MAC flooding techniques can be used to intercept traffic. Protocols other than IP may be running and not as well protected as IP. Some software firewalls default to trusting devices on the local subnet. Some switches have features to mitigate these issues but they are bolted on as afterthoughts, in some cases you may find your switches have protection features for IPv4 but no corresponding features for IPv6. It is also difficult to firewall between devices on the same L2 domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Splitting up the L2 domain allows you to reduce your exposure to L2 weaknesses and allow you to put firewalls in place to control communications between different parts of your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could do this splitting by building physically seperate networks but that is expensive and error-prone. VLANs with tagged trunks allow you to realise much of the security benefit of seperate networks without the high costs.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-12T23:12:58.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34844" PostTypeId="2" ParentId="29147" CreationDate="2016-09-13T02:23:51.827" Score="0" Body="&lt;p&gt;0.0.0.0 is great for egresss and GateWay of last resort, however you can only imagine the bad things that could ensue when any traffic was allowed to pass through the FW looking for its &quot;path&quot; kind of defeats the purpose of the device.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-13T02:23:51.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34845" PostTypeId="2" ParentId="29307" CreationDate="2016-09-13T02:29:00.767" Score="0" Body="&lt;p&gt;The buffer can only hold so much before it fills up and dumps the logs to replace them with newer versions. Depending on the RE version and the amount of RM/hard drive/flash drive size you can store different amounts with some tinkering. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are you trying to determine by examining the logs if I might ask?&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-13T02:29:00.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34847" PostTypeId="2" ParentId="30144" CreationDate="2016-09-13T02:44:09.617" Score="-1" Body="&lt;p&gt;Have you thought about configuring PIM on the devices....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;such as &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols pim rib-group inet RPF_RIB&#xA;set protocols pim rp static address IP-OF-RP&#xA;set protocols pim interface OUTSIDE&#xA;set protocols pim interface INSIDE&#xA;set security zones security-zone OUTSIDE host-inbound-traffic protocols pim&#xA;set security zones security-zone INSIDE interfaces INTERFACE host-inbound-traffic protocols pim&#xA;&#xA;set protocols igmp interface INTERFACE-OUTSIDE version 2&#xA;set protocols igmp interface INTERFACE_INSIDE version 2&#xA;set security zones security-zone OUTSIDE host-inbound-traffic protocols igmp&#xA;set security zones security-zone INSIDE interfaces INTERFACE host-inbound-traffic protocols igmp&#xA;set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST match source-address 224.0.0.0/4&#xA;set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST match destination-address any&#xA;set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST match application junos-udp-any&#xA;set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST then permit&#xA;set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST then log session-init&#xA;set security policies from-zone OUTSIDE to-zone INSIDE policy IN_MULTICAST then log session-close&#xA;set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST match source-address any&#xA;set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST match destination-address 224.0.0.0/4&#xA;set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST match application junos-udp-any&#xA;set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST then permit&#xA;set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST then log session-init&#xA;set security policies from-zone INSIDE to-zone OUTSIDE policy OUT_MULTICAST then log session-close&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Or something similar modeled to your environment. Just a thought and it is a secure way of Achieving your goal.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="509" LastEditDate="2016-09-13T05:09:12.997" LastActivityDate="2016-09-13T05:09:12.997" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34849" PostTypeId="2" ParentId="34754" CreationDate="2016-09-13T03:01:41.137" Score="2" Body="&lt;p&gt;Ive seen this before on some of the cisco 3750 switches I managed when I worked for one of the major airlines....in one of the IDfs the terminal would indicate a MAC which was a duplicate on multiple interfaces....this could be a few things, bad STP, interface issues, misconfiguration....it goes on. When you see it you get the old flappy flappy....its almost like a loop in a netowrk segment just not as disastrous...It will definitely cause your data traffic to flow incorrectly and give you unnecessary latency. &lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-13T03:01:41.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34850" PostTypeId="2" ParentId="20651" CreationDate="2016-09-13T03:03:47.143" Score="0" Body="&lt;p&gt;Switchport mode trunk&#xA;switchport trunk encapsulation dot1q&#xA;no ip address&#xA;specify native vlan&#xA;Allowed vlans &quot; &quot; &#xA;switchport no negotiate&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you configure both sides of the trunk in this fashion your problems will most likely go away...they call it vlan trunking protocol for a reason ;)&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-13T03:03:47.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34851" PostTypeId="2" ParentId="7395" CreationDate="2016-09-13T03:09:27.813" Score="0" Body="&lt;p&gt;The &quot;active management VLans are the ones currently being utilized....you can open the pipe full blast and allow all vlans across a trunk...I wouldnt recommend it, however this is what that configuration says. Also it looks like 99 is your native vlan, which essentially means it sends the frames in an almost untagged fashion but not quite....gi1/1 seems to not be participating in STP for some reason, without seeing the show Spanning-tree command your guess is as good as mine. just make sure when you use trunked links...you specify, encapsulation native vlan, and allowed vlans on the trunk along with the fact that it is a trunk.....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-13T03:09:27.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34852" PostTypeId="2" ParentId="7949" CreationDate="2016-09-13T03:11:40.630" Score="1" Body="&lt;p&gt;It can be removed, although I would recommend specifying a native vlan and an encapsulation protocol on both sides of the link to keep it proper and error free!&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-13T03:11:40.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34854" PostTypeId="2" ParentId="20464" CreationDate="2016-09-13T03:21:50.370" Score="1" Body="&lt;p&gt;Fing, Angry IP, netstat and arp -a are good starters...and depending on whether you have access to the infrastructure you can check the dhcp scope and issuance...along with CDP or LLDP on the networking equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fing though its good!&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-13T03:21:50.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34855" PostTypeId="2" ParentId="9841" CreationDate="2016-09-13T03:45:02.107" Score="2" Body="&lt;p&gt;Assign an IP to the management interface &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch(config)# interface ethernet 2/1&#xA;&#xA;switch(config-if)# no switchport&#xA;&#xA;switch(config-if)# ip address 192.0.2.1/8&#xA;&#xA;switch(config-if)# copy running-config startup-config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line vty 0 4&#xA;&#xA;Router(config-line)#privilege level 15&#xA;&#xA;Router(config-line)#login local&#xA;&#xA;Router(config-line)#transport input telnet ssh&#xA;&#xA;Router(config-line)#exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and make sure you generate an RSA key otherwise SSH is not secure it is just telnet =p generate RSA then specify the length of the key 1024 or 2048 are good&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto key generate rsa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How many bits in the modulus 1024 2048&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CustomerRouter(config)#exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;currently you have no routing occuring, you have layer two, with a management IP on your Vlan, you would need to configure a RVI or routing protocol to get things happening, as you see there is nothing in the connfig on interface 0/1&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorDisplayName="user2084" LastEditDate="2016-09-13T07:13:03.850" LastActivityDate="2016-09-13T07:13:03.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34856" PostTypeId="2" ParentId="3781" CreationDate="2016-09-13T04:02:02.090" Score="0" Body="&lt;p&gt;Link state advertisements form the basis of this type of protocol. without them and their hello and dead timers there would be no way to assure the topology and links were still active. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link state protocols depend on these, whereas EIGRP and other distance vector protocols depend more upon the path of data and path cost determined by bandwidth availability, latency etc. They also do not have regular &quot;updates&quot; updates are sent when necessary such as when a link is found to be inactive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With OSPF and LSAs whole updates of the topology table are sent regularly, they depend on similar items, such as distance and bandwidth but they are calculated differently due to the algorithm used in OSPF. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I prefer EIGRP but that is not an option in non Cisco land, its just a more efficient and simpler protocol to configure IMO. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I live in an all Juniper world, so eIGRP is a thing of the past, OSPF and the different type of LSA advertisements are a necessity to know.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-13T04:02:02.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34857" PostTypeId="2" ParentId="6894" CreationDate="2016-09-13T04:25:15.803" Score="0" Body="&lt;p&gt;Captive portal or splash page, we use them all over in the property I work in....Gaming property in Las Vegas with multiple guest free and pay wifi SSIDs.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-13T04:25:15.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34858" PostTypeId="2" ParentId="6894" CreationDate="2016-09-13T07:41:10.943" Score="1" Body="&lt;p&gt;On Cisco this is called &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_auth/configuration/15-mt/sec-usr-auth-15-mt-book/sec-fwall-https-prxy.html&quot; rel=&quot;nofollow&quot;&gt;Authentication Proxy&lt;/a&gt;, &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wireless/5500-series-wireless-controllers/113151-web-auth-proxy-00.html&quot; rel=&quot;nofollow&quot;&gt;Web Authentication Proxy&lt;/a&gt;, or &lt;a href=&quot;https://supportforums.cisco.com/document/56421/asa-cut-through-authentication-proxy-configuration-and-examples&quot; rel=&quot;nofollow&quot;&gt;Cut-Through Authentication&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-13T07:41:10.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34859" PostTypeId="1" CreationDate="2016-09-13T11:17:12.163" Score="3" ViewCount="361" Body="&lt;p&gt;We recently switched from a business-class cable connection (100/20) to a symmetrical (100/100) fiber one. This serves a front office, a media department, and several client computers on any given day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While on the former service we up/downloaded many multi-gig media files from client and graphics computers, with no problems except what you'd expect when several people are competing for limited bandwidth. It all worked, it just slowed down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But with this new service we get periods where (the supplier says) we &quot;saturate&quot; the connection and all connectivity ends for everyone. What is really going on here? I would guess most traffic is 'web-based' in that it's mediated through ports 80/443, with some FTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And some of the file transfers do proceed at amazing speeds -- the remote ends can easily keep up with our puny 100Mb/s, where in the past it was rare to see any given connection exceed 30Mb/s. It's just that when three or more of these up/down transfers are going on, it eventually, to put it crudely, 'clogs the pipes'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what's really going on? Why would a faster service with a more dedicated channel be susceptible to this sort of degradation? I've always thought of TCP as somewhat self-balancing in that multiple connections would degrade together, that one or two connections couldn't 'hog' the bandwidth. Is that wrong?&lt;/p&gt;&#xA;" OwnerUserId="15883" LastActivityDate="2019-06-28T15:59:56.397" Title="What are the implications of 'saturating' a broadband connection?" Tags="|tcp|bandwidth|fiber|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="34860" PostTypeId="2" ParentId="34827" CreationDate="2016-09-13T13:16:57.443" Score="2" Body="&lt;p&gt;The banner copied successfully when posted at the end of the config to be copied. &#xA;I used a standard ascii deliminator (not as seen in the actual running-config &quot;^C&quot;) and added &quot;end&quot; right after the ending deliminator. This worked.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2016-09-13T13:16:57.443" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34863" PostTypeId="1" AcceptedAnswerId="34938" CreationDate="2016-09-13T14:10:56.717" Score="3" ViewCount="2527" Body="&lt;p&gt;I have a ws-C2960XR-24ps-I switch with 2 slots for power supply's but only 1 power supply inserted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the switch is always logging an event : &quot;%PLATFORM_ENV-1-FRU_PS_ACCESS: FRU Power Supply is not responding&quot;. When I try to disable it by running&#xA;&lt;a href=&quot;https://i.stack.imgur.com/PnEC0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PnEC0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get &quot;power supply is not present&quot; in response. Is there a way to disable that slot so it stops sending these log messages that there is a missing power supply?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Q171b.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q171b.png&quot; alt=&quot;sh env cmd&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want the specific log to stop without keeping it from logging any issues with the slot that is in use.&lt;/p&gt;&#xA;" OwnerUserId="14372" LastEditorUserId="14372" LastEditDate="2016-09-13T14:16:44.220" LastActivityDate="2016-09-15T09:32:30.077" Title="Disable empty power slot on Cisco 2960xr" Tags="|cisco|cisco-commands|cli|cisco-2960|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34865" PostTypeId="2" ParentId="34859" CreationDate="2016-09-13T15:30:50.083" Score="2" Body="&lt;p&gt;A cable network would only allow a few large 30mb downloads whereas a 100mb fiber never decreases unless its a shared bandwidth line. It seems much more likely your managed service provider isn't giving true 100mb. A speed test may say you have 100mb down but that doesn't mean your throughput is equivalent. For example, cable service providers will have everyone saying they have 100mb down the street but in reality, if your neighbor is using alot, your speed(throughput) will decrease. This is not the case with true fiber. &lt;/p&gt;&#xA;" OwnerUserId="30456" LastActivityDate="2016-09-13T15:30:50.083" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34866" PostTypeId="2" ParentId="22640" CreationDate="2016-09-13T17:19:35.253" Score="1" Body="&lt;p&gt;Single Fiber, Single Wavelength,CWDM Transceivers have been commercially available for years, some with built-in Micro-OTDR Fast Fiber Fault Finder technology, but so far only for 1 Gbps to 3 Gbps applications.&lt;/p&gt;&#xA;" OwnerUserId="30458" LastEditorUserId="8499" LastEditDate="2016-09-13T17:28:27.177" LastActivityDate="2016-09-13T17:28:27.177" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34867" PostTypeId="2" ParentId="34306" CreationDate="2016-09-13T17:26:18.680" Score="1" Body="&lt;p&gt;Yes.  Single Fiber, Single Wavelength, CWDM SFP Transceivers, some with Micro-OTDR Fast Fiber Fault Finder technology, have been commercially available for years.&lt;/p&gt;&#xA;" OwnerUserId="30458" LastEditorUserId="8499" LastEditDate="2016-09-13T17:28:46.003" LastActivityDate="2016-09-13T17:28:46.003" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34868" PostTypeId="1" CreationDate="2016-09-13T17:33:25.540" Score="0" ViewCount="617" Body="&lt;p&gt;Trying to troubleshoot low internet speed. We are paying for 200mb download speed. Our setup is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Users computer(1GB) -&gt; Phone(100mb switch port) -&gt; Access switch(100mb) -&gt; Core Switch(1GB) -&gt; Firewall(1GB) -&gt; WAN switch(100mb) -&gt; WAN modem(1GB switch port)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Users are only able to get max ~40mb internet speeds. I know we will never get close to 200mb since there are so many devices that are capped at 100mb but is ~40mb realistic? I checked the duplexes and they are all correct and have no issues. I checked the firewall for any bandwidth throttling and there are no rules for this. Can you guys think of what could be causing such low internet speed? Also want to note if I connect a laptop(1GB) to the WAN modem, it gets ~190mb speed, which would imply there is nothing wrong with the modem. Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a diagram of the network:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NB5o8.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NB5o8.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22550" LastEditorUserId="22550" LastEditDate="2016-09-13T18:06:29.017" LastActivityDate="2017-09-09T03:04:46.623" Title="Internet throttling speeds in LAN network" Tags="|internet|network-core|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="34871" PostTypeId="1" CreationDate="2016-09-13T18:43:15.640" Score="3" ViewCount="330" Body="&lt;p&gt;I am working on a project to allow ICMP through the firewall  from the outside interface to an inside interface. &#xA;I have configured the firewall to inspect icmp and allowed icmp through access-list for the subnets and hosts then bound it to the outside and inside interfaces and still can't get through. I have two computers connected directly to the firewall outside and inside ports.&#xA; Here is the config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Int Eth0/1&#xA;!&#xA;Int Eth0/2&#xA;switchport access vlan 2&#xA;&#xA;interface Vlan1&#xA;nameif inside&#xA;security-level 100&#xA;ip address 192.168.5.12 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA;name if outside&#xA;security-level 50&#xA;ip address 192.168.6.1 255.255.255.0&#xA;!&#xA;access-list ALLOW_ICMP extended permit icmp any any echo-reply&#xA;&#xA;access-group ALLOW_ICMP in interface outside&#xA;access-group ALLOW_ICMP out interface outside &#xA;access-group ALLOW_ICMP in interface inside &#xA;access-group ALLOW _ICMP  out interface inside&#xA;&#xA;policy-map global_policy &#xA;class inspection_default&#xA;inspect icmp &#xA;inspect icmp error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30459" LastEditorUserId="8499" LastEditDate="2016-09-13T18:47:56.710" LastActivityDate="2016-09-14T18:09:02.690" Title="Cisco ASA 5505 ver 8.2 Firewall" Tags="|cisco-asa|firewall|troubleshooting|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34872" PostTypeId="1" CreationDate="2016-09-13T19:51:14.853" Score="5" ViewCount="4242" Body="&lt;p&gt;In IP header , Only the destination ip address and source ip address is indicated . How does a traveling packet know the network section of destination ip address in CIDR notation ? Thanks&lt;/p&gt;&#xA;" OwnerUserId="30461" LastEditorUserId="8499" LastEditDate="2020-07-17T00:10:02.817" LastActivityDate="2020-07-17T00:10:02.817" Title="Which part of IP header indicate net mask?" Tags="|routing|ip|protocol-theory|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34873" PostTypeId="2" ParentId="34871" CreationDate="2016-09-13T19:52:51.983" Score="0" Body="&lt;p&gt;You should allow echo request from outside. In current ACL you are allowing only returning traffic(reply).&lt;/p&gt;&#xA;" OwnerUserId="29580" LastActivityDate="2016-09-13T19:52:51.983" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34874" PostTypeId="2" ParentId="34872" CreationDate="2016-09-13T19:58:21.073" Score="2" Body="&lt;p&gt;The traveling packet doesn't need to know net mask of subnet. Netmask is something that used on host itself, so it can calculate its subnet range. If the incoming packet's ip address will be in subnet range of current host, then it will accept it. Otherwise drop action will be aplied. &lt;/p&gt;&#xA;" OwnerUserId="29580" LastActivityDate="2016-09-13T19:58:21.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34875" PostTypeId="2" ParentId="34872" CreationDate="2016-09-13T19:58:29.817" Score="3" Body="&lt;p&gt;There is no mask in the packet. A packet has specific source and destination host addresses. A host address is a &lt;code&gt;/32&lt;/code&gt; network, which means that no part of the address is masked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A mask is only relevant to routing, not the actual packets. A router will look up the network best match to the destination address, and the masks are for the networks in the routing tables of the routers to be applied against the network addresses in the routing tables.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-13T19:58:29.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34876" PostTypeId="1" AcceptedAnswerId="34881" CreationDate="2016-09-13T19:59:03.137" Score="2" ViewCount="761" Body="&lt;p&gt;Testing in a lab...I have a VLAN directly attached to a &lt;strong&gt;Cisco ASA 5520&lt;/strong&gt; that contains host machines who use IPs from a public address space,  &lt;strong&gt;11.11.11.0/26&lt;/strong&gt; for example. The ASA has two interfaces this dmz interface containing the hosts on the &lt;strong&gt;11.11.11.0/26&lt;/strong&gt; and an outside interface containing a /30 peering point to an ASR running BGP etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to configure the ASA to allow connectivity to and from this 11.11.11.0/26 without having to put in NAT statements since both interfaces are two different security-levels?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;dmz security-level 50 (11.11.11.1/26)&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;outside security-level 0 (11.11.11.65/30) to ASR&lt;/strong&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Thanks for everyones help in advance!&lt;/p&gt;&#xA;" OwnerUserId="3528" LastActivityDate="2016-09-13T20:16:18.037" Title="Cisco ASA allow no-nat public subnets" Tags="|cisco-asa|nat|arin|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34878" PostTypeId="2" ParentId="34871" CreationDate="2016-09-13T20:03:32.353" Score="2" Body="&lt;p&gt;Your access list allow only echo-reply, but not requests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also Cisco ASA is statefull firewall, so you don't need your access list applied on every interface, only on outside interface. When icmp inspection is enabled, return traffic for session is allowed by default.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list ALLOW_ICMP extended permit icmp any any echo&#xA;access-group ALLOW_ICMP in interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30367" LastActivityDate="2016-09-13T20:03:32.353" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34879" PostTypeId="2" ParentId="34868" CreationDate="2016-09-13T20:07:19.817" Score="1" Body="&lt;p&gt;The first issue you have is the WAN switch. You will need to upgrade to 1gbps switch in order to fully utilize the connection from your ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also switch the design around and have it go modem -&gt; firewall -&gt; switch. That way things will be managed on the endpoints in not in the middle. &lt;/p&gt;&#xA;" OwnerUserId="30462" LastActivityDate="2016-09-13T20:07:19.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34880" PostTypeId="2" ParentId="34775" CreationDate="2016-09-13T20:12:06.977" Score="2" Body="&lt;p&gt;From NAT perspective you wont have problems, as long as your are using correct access-lists. So for example, permit only private ip range in acl and use this acl in ip nat inside source list (private range acl) pool blabla overload. NAT  will be created only for those packets that match acl. Public ip addresses will use normal routing.&lt;/p&gt;&#xA;" OwnerUserId="29580" LastActivityDate="2016-09-13T20:12:06.977" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34881" PostTypeId="2" ParentId="34876" CreationDate="2016-09-13T20:16:18.037" Score="1" Body="&lt;p&gt;Disable nat-control. Apply permit acl to outside interface.&lt;/p&gt;&#xA;" OwnerUserId="29580" LastActivityDate="2016-09-13T20:16:18.037" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34884" PostTypeId="2" ParentId="22640" CreationDate="2016-09-14T01:12:47.307" Score="2" Body="&lt;p&gt;They're called BiDi optical transceivers.  &lt;a href=&quot;http://connect.physicsworld.com/sfp-plus-10gsrlrmlrerzrcwdmdwdmbidi-transceivers/2003609.article&quot; rel=&quot;nofollow noreferrer&quot;&gt;I see some&lt;/a&gt; 1270nm / 1330nm Bi-Directional 40km Single Mode but I don't see any 1510nm.&lt;/p&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/transceiver-modules/data_sheet_c78-455693.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco SFP-10G-BX40D-I and SFP-10G-BX40U-I (for 40Km Single-Fiber Bidirectional Applications)&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pRm7A.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pRm7A.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The Cisco SFP-10G-BX40D-I and SFP-10G-BX40U-I SFPs operate on a single strand of standard SMF.&lt;/p&gt;&#xA;&lt;p&gt;A SFP-10G-BX40D-I device is always connected to a SFP-10G-BX40U-I device with a single strand of standard SMF with an operating transmission range up to 40 km.&lt;/p&gt;&#xA;&lt;p&gt;The communication over a single strand of fiber is achieved by separating the transmission wavelength of the two devices. SFP-10G-BX40D-I transmits a 1330-nm channel and receives a 1270-nm signal. The SFP-10G-BX40U-I transmits at a 1270-nm wavelength and receives a 1330-nm signal.&lt;/p&gt;&#xA;&lt;p&gt;The SFP-10G-BX40D-I and SFP-10G-BX40U-I SFPs support digital optical monitoring (DOM) functions according to the industry-standard SFF-8472 multisource agreement (MSA). This feature gives the end user the ability to monitor real-time parameters of the SFP, such as optical output power, optical input power, temperature, laser bias current, and transceiver supply voltage.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-09-14T01:12:47.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34885" PostTypeId="1" AcceptedAnswerId="34888" CreationDate="2016-09-14T01:12:55.790" Score="1" ViewCount="3088" Body="&lt;p&gt;assume want to send a packet from H1 to H3 and we have a network like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**H1**&#xA;A:a&#xA;|&#xA;|&#xA;N&#xA;**B1** E --- E:e **R1** F:f--- C:c**H3**&#xA;S&#xA;|&#xA;|&#xA;B:b&#xA;**H2**&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How will ARP table look for these nodes in the network ?&#xA;i know how ARP works and how the tables are filled but not sure how to think when there is bridges?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if we had a network like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;H1&lt;/strong&gt; A:a --- C:c &lt;strong&gt;R1&lt;/strong&gt; D:d --- B:b &lt;strong&gt;H2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then then the tables would look like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;H1 table =&gt; ip:C mac:c&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 table =&gt; ip:A mac:a and ip:B mac:b&lt;/p&gt;&#xA;&#xA;&lt;p&gt;H2 table =&gt; ip:D mac:d&lt;/p&gt;&#xA;" OwnerUserId="30468" LastEditorUserId="8499" LastEditDate="2018-03-11T01:50:01.197" LastActivityDate="2018-03-11T01:50:01.197" Title="how are bridges handled in ARP?" Tags="|ipv4|ip|mac-address|arp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34886" PostTypeId="1" CreationDate="2016-09-14T01:44:55.427" Score="2" ViewCount="294" Body="&lt;p&gt;just wanted to ask what measures I'll have to do regarding on my problem on CoreSwitch 6509.&#xA;I have 12 vlans on layer 3 switch which has 48 ports, 4 ports per vlan and I have a backbone on vlan 10 and also used spanning tree mode.&#xA;my question is that how will other vlans can connect with vlan 10 with has already connected to my ISP. your answers would be very much appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="30469" LastActivityDate="2019-05-03T20:02:00.353" Title="Cisco CoreSwitch 6509 Vlan connection problems" Tags="|cisco|switch|vlan|cisco-catalyst|troubleshooting|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34887" PostTypeId="1" AcceptedAnswerId="34890" CreationDate="2016-09-14T01:53:22.873" Score="1" ViewCount="843" Body="&lt;p&gt;Assume we have a ethernet link with an MTU of 1300 bytes, while an application want to send 5200 bytes of data. How many fragments do we transmitted ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i would say 5, to send 5200 bytes over a link with an MTU of 1300 bytes then we need 4 fragments, 5200/1300=4 but we have the additonal overhead, IPv4 header is 20 bytes, while the UDP header is 8 bytes therefore we will have 5 fragments in total.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am i thinking right here ?&lt;/p&gt;&#xA;" OwnerUserId="30468" LastEditorUserId="8499" LastEditDate="2019-01-12T23:00:56.420" LastActivityDate="2019-01-12T23:00:56.420" Title="UDP and fragmentation calculation" Tags="|ip|ipv4|udp|mtu|fragmentation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34888" PostTypeId="2" ParentId="34885" CreationDate="2016-09-14T02:00:39.077" Score="1" Body="&lt;p&gt;A transparent bridge, e.g. ethernet switch, has no effect on ARP. A translating bridge, e.g. ethernet/token ring bridge, may change a MAC address between canonical and non-canonical or have some other effect, based on what it is bridging.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-14T02:00:39.077" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="34889" PostTypeId="2" ParentId="34886" CreationDate="2016-09-14T02:03:01.883" Score="1" Body="&lt;p&gt;The layer-3 switch, assuming you have routing enabled with not blocking ACLs, will route between the VLANs. VLANs give you a complete layer-2 separation, and you must route traffic between VLANs if you need traffic from one VLAN to another.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-14T02:03:01.883" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34890" PostTypeId="2" ParentId="34887" CreationDate="2016-09-14T02:18:43.800" Score="2" Body="&lt;p&gt;You seem to be confusing fragments and packets. Fragmentation is a layer-3 function, but UDP is at layer-4. Fragmentation happens when the MTU changes size (shrinks) in the path. Routers may fragment a packet if it is larger than the MTU of the next link to which is must send the packet. What you have doesn't say anything like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What your question should be asking is how many packets will be used to send the data using IPv4, and that would be five packets.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-14T02:18:43.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34891" PostTypeId="1" AcceptedAnswerId="34896" CreationDate="2016-09-14T03:16:46.547" Score="2" ViewCount="22119" Body="&lt;p&gt;Suppose I'm using Wireshark to monitor a broadcast storm. I want to find out the exact instant of time when the capture buffer runs out of memory. How do I monitor this and obtain the exact time moment when Wireshark capture buffer runs out of memory?&lt;/p&gt;&#xA;" OwnerUserId="30265" LastActivityDate="2016-09-14T10:35:38.620" Title="Wireshark Broadcast Storm" Tags="|wireshark|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34892" PostTypeId="1" CreationDate="2016-09-14T04:34:58.597" Score="2" ViewCount="750" Body="&lt;p&gt;I have a CISCO 1941 with 2 external IP addresses assigned to one interface&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; description $ETH-WAN$&#xA; ip address X.X.X.X2 255.255.255.240 secondary&#xA; ip address X.X.X.X1 255.255.255.240&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have various port translations on the primary IP. The secondary IP statically translates to a server with IP 192.168.19.17. This works fine for a couple hours and then ceases working.&#xA;Issuing the following fixes the problem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#no ip nat inside source static 192.168.129.17 X.X.X.X2&#xA;router(config)#ip nat inside source static 192.168.129.17 X.X.X.X2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea? When it stops working, issuing traceroute X.X.X.X2 stops at X.X.X.X1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it something wrong with my configuration (see below)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I debug it?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#sh run&#xA;(...)&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description $ETH-LAN$&#xA; ip address 192.168.129.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA; no mop enabled&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description $ETH-WAN$&#xA; ip address X.X.X.X2 255.255.255.240 secondary&#xA; ip address X.X.X.X1 255.255.255.240&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Virtual-Template1 type tunnel&#xA; ip unnumbered GigabitEthernet0/1&#xA; ip mtu 1300&#xA; tunnel mode ipsec ipv4&#xA; tunnel protection ipsec profile CiscoCP_Profile1&#xA;!&#xA;ip local pool SDM_POOL_1 192.168.129.200 192.168.129.254&#xA;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip dns server&#xA;ip nat inside source list 1 interface GigabitEthernet0/1 overload&#xA;ip nat inside source route-map SDM_RMAP_1 interface GigabitEthernet0/1 overload&#xA;ip nat inside source static tcp 192.168.129.13 500 X.X.X.X1 500 extendable&#xA;ip nat inside source static udp 192.168.129.13 500 X.X.X.X1 500 extendable&#xA;ip nat inside source static tcp 192.168.129.13 548 X.X.X.X1 548 extendable&#xA;ip nat inside source static udp 192.168.129.13 548 X.X.X.X1 548 extendable&#xA;ip nat inside source static tcp 192.168.129.13 1701 X.X.X.X1 1701 extendable&#xA;ip nat inside source static udp 192.168.129.13 1701 X.X.X.X1 1701 extendable&#xA;ip nat inside source static tcp 192.168.129.13 1723 X.X.X.X1 1723 extendable&#xA;ip nat inside source static udp 192.168.129.13 1723 X.X.X.X1 1723 extendable&#xA;ip nat inside source static tcp 192.168.129.13 3283 X.X.X.X1 3283 extendable&#xA;ip nat inside source static udp 192.168.129.13 3283 X.X.X.X1 3283 extendable&#xA;ip nat inside source static tcp 192.168.129.22 3389 X.X.X.X1 3389 extendable&#xA;ip nat inside source static tcp 192.168.129.13 4500 X.X.X.X1 4500 extendable&#xA;ip nat inside source static udp 192.168.129.13 4500 X.X.X.X1 4500 extendable&#xA;ip nat inside source static tcp 192.168.129.13 5900 X.X.X.X1 5900 extendable&#xA;ip nat inside source static udp 192.168.129.13 5900 X.X.X.X1 5900 extendable&#xA;ip nat inside source static 192.168.129.17 X.X.X.X2&#xA;ip route 0.0.0.0 0.0.0.0 X.X.X.gateway 254&#xA;ip route 172.17.0.0 255.255.0.0 192.168.129.9&#xA;!&#xA;access-list 1 permit 192.168.129.0 0.0.0.255&#xA;access-list 1 permit 46.182.204.0 0.0.0.255&#xA;access-list 100 permit ip 192.168.128.0 0.0.15.255 any&#xA;access-list 100 permit ip 172.17.0.0 0.0.0.255 any&#xA;access-list 101 remark CCP_ACL Category=4&#xA;access-list 101 remark IPSec Rule&#xA;access-list 101 permit ip 192.168.129.0 0.0.0.255 192.168.130.0 0.0.0.255&#xA;access-list 102 remark CCP_ACL Category=2&#xA;access-list 102 permit ip 192.168.129.0 0.0.0.255 any&#xA;!&#xA;!&#xA;!&#xA;!&#xA;route-map SDM_RMAP_1 permit 1&#xA; match ip address 102&#xA;!&#xA;(...)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30470" LastActivityDate="2018-06-08T03:13:05.150" Title="NAT translation ceases working after couple hours" Tags="|cisco|nat|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34896" PostTypeId="2" ParentId="34891" CreationDate="2016-09-14T09:19:24.627" Score="1" Body="&lt;p&gt;If you are capturing to memory only and stopping when the buffer runs out, then in the case of a broadcast storm the last frame time will be when the buffer ran out of memory.  I'm not sure why you'd want to do this instead of capturing to disk.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-09-14T09:19:24.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34899" PostTypeId="2" ParentId="34891" CreationDate="2016-09-14T10:35:38.620" Score="1" Body="&lt;p&gt;first of all lets clear something&lt;br&gt;&#xA; 1. memory here means what??&lt;br&gt;&#xA;   a. it should mean interface buffer&lt;br&gt;&#xA; 2. which interface ?&lt;br&gt;&#xA;   a. it can be your interface or any active device interface (switch for example)&lt;br&gt;&#xA;if you need to monitor broadcast ,&lt;strong&gt;&lt;em&gt;there will be two ways&lt;/em&gt;&lt;/strong&gt; .the &lt;strong&gt;&lt;em&gt;first&lt;/em&gt;&lt;/strong&gt; is to monitor your PC interface itself which may be not efficient cause you may suffer from any malware attack cause your interface to be congested . the &lt;strong&gt;&lt;em&gt;second&lt;/em&gt;&lt;/strong&gt; is to configure you active device (the switch ) to spin copy of traffic to the port where you are connected to then try to monitor via wireshark . &#xA;any way if you decided to use any of them you must get this before.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;&lt;em&gt;Broadcast&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;  Any packet destined for all stations on a network segment is&#xA;  considered broadcast traffic. Broadcast addresses are usually used by&#xA;  ARP, DHCP, and other protocols that do some sort of discovery.&lt;br&gt;&#xA;  &lt;strong&gt;&lt;em&gt;for Ethernet (and other 802.x networks)&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;  Ethernet has designated the&#xA;  all-ones address (ff:ff:ff:ff:ff:ff) for broadcast traffic; this is&#xA;  used for other 802.x networks as well.&lt;br&gt;&#xA;      &lt;strong&gt;&lt;em&gt;for IPv4&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;  Similarly, the all-ones IP&#xA;  address (255.255.255.255) is broadcast. If the host portion of an IP&#xA;  address is all ones (e.g. if the address is 192.168.0.255 and the&#xA;  netmask is 255.255.255.0), that address is also a broadcast address.&#xA;  The broadcast IP address in the early days were 0.0.0.0, but was a&#xA;  long time ago, and zeroes are no longer used in the wildcard section&#xA;  of broadcast addresses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;so you easily can monitor the traffic destine to ff:ff:ff:ff:ff:ff or 192.168.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;other way is capture all the traffic came through your interface and then sort it by traffic size and this way is more proper to un-managed network. &#xA;&lt;code&gt;here you may need to setup the proper filter to capture this broadcast&lt;/code&gt;. &#xA;Adding onto the capabilities of Wireshark to find top broadcasters (or multicast packets which can also affect network activity) the following can be done:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set up a new &quot;capture filter&quot; as such:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Filter Name: Broadcast and Multicast&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Filter String: broadcast and multicast&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Select the &quot;Show the capture options&quot; toolbar button.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Select the &quot;Capture Filter&quot; button and double click on the &quot;Broadcast and Multicast&quot; filter.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Select &quot;Start&quot; and then go into &quot;Statistics&quot;, &quot;Conversations&quot; and select the &quot;IPv4&quot; tab.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Finally, sort the list by bytes and attempt to find the culprit when stuff happens.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-09-14T10:35:38.620" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34901" PostTypeId="2" ParentId="34892" CreationDate="2016-09-14T11:55:21.837" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;If you have no reasons to use secondary IP of X.X.X.X2 rather than as a natted IP for 192.168.129.17 (192.168.129.17 -&gt; X.X.X.X2), then you don't need to configure it as secondary IP on WAN interface (G0/1).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;As long as there is a free public IP reserved for your network (here is .X2), you can use it directly in your NAT statement without needing it to be &quot;up&quot; and &quot;pingable&quot; at first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, the following configuration is enough for 192.168.129.17 to be natted to .X2 when accessing the Internet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;interface GigabitEthernet0/1&#xA; description $ETH-WAN$&#xA;  ip address X.X.X.X1 255.255.255.240&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex auto&#xA; speed auto&#xA;&#xA;ip nat inside source static 192.168.129.17 X.X.X.X2&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;One thing I noticed is that the iP of 192.168.129.17 is in subnet 192.168.129.0/24 covered in access-list 1 and 102, and this subnet is natted to G0/1 (IP of .X1), while you want the IP 192.168.129.17 to be natted to IP .X2. And this It would cause confusion.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can redesign your ACLs and explicitly exclude IP 192.168.129.17 to be involved in NAT statement to .X1.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;To debug your NAT packets, simply apply &quot;debug ip nat&quot; command on global mode.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30321" LastActivityDate="2016-09-14T11:55:21.837" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="34904" PostTypeId="2" ParentId="5400" CreationDate="2016-09-14T13:52:28.103" Score="-1" Body="&lt;p&gt;I do not think I saw anyone mention it, another piece of good knowledge to have   are the two commands: commit confirm overwrite and commit confirm merge. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two commands help with similar things the main difference being that&lt;br&gt;&#xA;the commit confirm merge copies content from another configuration that contains data you want to integrate to your current candidate configuration. I generally copy it from notepad++ Or copy it out of the configuration with the copy button in secureCRT. This command does not overwrite any of your current configuration. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Commit confirm overwrite does as it sounds and overwrites the current configuration with the new configuration. A rollback would be necessary to revert from this operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, when committing any new  configuration data, its always good practice to use the commit check command prior to confirming.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="27523" LastEditDate="2016-09-14T13:58:06.493" LastActivityDate="2016-09-14T13:58:06.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34907" PostTypeId="1" CreationDate="2016-09-14T14:39:41.510" Score="1" ViewCount="397" Body="&lt;p&gt;Digital signal consists of many sine waves.&#xA;Now the signal with waves of frequencies 1Mhz to 5Mhz has bandwidth of 5-1 = 4Mhz. Now the fundamental period of this signal is decided by lowest frequency that is 1Mhz. So one cycle sends 2 bits let's say, therefore 2 bits are transmitted in 1/1Mhz = 1 μs. Hence 1 bit in 0.5μs. Hence bitrate is 2Mbps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I increase bandwidth, from 4 to 8Mhz, for the same, does the spectrum still vary from 1Mhz to 1 + 8 = 9Mhz ? because this way by doubling bandwidth and using same lowest frequency, data rate will be same. Unless i increase bandwidth as well as increase minimum frequency.&#xA;also by doubling bandwidth is it that the range also shifts towards right?&#xA;eg for bandwidth 4mhz, spectrum was 1 to 5, for 8mhz bandwidth spectrum becomes 2 to 10 or how does it work? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please explain. I'm a beginner in this and currently going through William stalling's data and computer communication book which states bandwidth increases with data rate and vice-versa where as I feel it's just lowest frequency of bandwidth thats increasing the bitrate or data rate.&lt;/p&gt;&#xA;" OwnerUserId="30485" LastEditorUserId="2142" LastEditDate="2016-09-14T15:27:30.277" LastActivityDate="2016-09-14T15:30:46.640" Title="what is bandwidth and its relation with bitrate?" Tags="|bandwidth|data|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34908" PostTypeId="1" AcceptedAnswerId="34914" CreationDate="2016-09-14T15:03:07.050" Score="0" ViewCount="309" Body="&lt;p&gt;I am wiring a department in an enterprise environment with cat6 cabling. My server room will be in a separate room from the patch panel . All the wiring will be terminated at a patch panel at the other side of the building.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to keep the switch in the server room but I do not want to run every port back to the patch panel. Is there a way to run all the signals from the patch panel to the server room. The only thing I can think of is a fiber channel but then I need a device in the patch panel room and it defeats the purpose. From some feedback it appears to run a remote switch at the patch panel and uplink it to a switch in the server room with a dedicated high speed drop. I would like to eliminate and equipment in the patch panel room but cannot find any other work around. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="16226" LastEditorUserId="16226" LastEditDate="2016-09-15T19:10:15.330" LastActivityDate="2016-09-15T19:10:15.330" Title="Seperating patch panel and switch in different rooms" Tags="|patch-panel|" AnswerCount="1" CommentCount="9" ClosedDate="2016-09-14T19:39:47.347" ContentLicense="CC BY-SA 3.0" />
  <row Id="34909" PostTypeId="1" AcceptedAnswerId="71507" CreationDate="2016-09-14T15:13:01.473" Score="1" ViewCount="3111" Body="&lt;p&gt;We have Cisco ASA VPN &lt;code&gt;IPSec&lt;/code&gt; with Sonicwall but we are seeing randomly after 8 hours or sometime 10 hours. I am unable to trace issue so just wonder is there a simple setting to renegotiate tunnel automatically or something like that? We want to keep this tunnel IP for ever, what could be wrong? &lt;/p&gt;&#xA;&#xA;&lt;h1&gt;UPDATED config&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto map external_map 100 match address VPN-ACL&#xA;crypto map external_map 100 set pfs&#xA;crypto map external_map 100 set peer 201.x.xx.xx 96.xx.xx.xx&#xA;crypto map external_map 100 set ikev2 ipsec-proposal ESP-AES128-SHA&#xA;crypto map external_map 65535 ipsec-isakmp dynamic external_dynamic_map&#xA;crypto map external_map interface external&#xA;crypto ikev2 policy 10&#xA; encryption aes&#xA; integrity sha&#xA; group 2&#xA; prf sha&#xA; lifetime seconds 28800&#xA;&#xA;tunnel-group 201.xx.xx.xx type ipsec-l2l&#xA;tunnel-group 201.xx.xx.xx ipsec-attributes&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Logs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2016-09-12 10:36:43 Local4.Warning  172.6.xx.xx fw01 %ASA-4-750003: Local:xx.xx.xxx.xxx:500 Remote:xx.xx.xx.xx:500 Username:Unknown IKEv2 Negotiation aborted due to ERROR: The peer's KE payload contained the wrong DH group&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;Command Output:&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IKEv2 SAs:&#xA;&#xA;Session-id:12204, Status:UP-ACTIVE, IKE count:1, CHILD count:1&#xA;&#xA;Tunnel-id                 Local                Remote     Status         Role&#xA;992958129     3x.xx.xx.xx/500     172.6.xx.xx/500      READY    RESPONDER&#xA;      Encr: AES-CBC, keysize: 128, Hash: SHA96, DH Grp:2, Auth sign: PSK, Auth verify: PSK&#xA;      Life/Active Time: 28800/22805 sec&#xA;Child sa: local selector  172.16.xx.0/0 - 172.16.xx.255/65535&#xA;          remote selector 192.168.xx.0/0 - 192.168.xx.255/65535&#xA;          ESP spi in/out: 0x1f9328de/0xa58a697d&#xA;&#xA;&#xA;fw0# sh crypto ipsec sa peer 172.6.xx.xx&#xA;peer address: 172.6.xx.xx&#xA;    Crypto map tag: external_map, seq num: 100, local addr: 3x.xx.xx.xx&#xA;&#xA;      access-list VPN-ACL extended permit ip 172.16.xx.0 255.255.255.0 192.168.xx.0 255.255.255.0&#xA;      local ident (addr/mask/prot/port): (172.16.xx.0/255.255.255.0/0/0)&#xA;      remote ident (addr/mask/prot/port): (192.168.xx.0/255.255.255.0/0/0)&#xA;      current_peer: 172.6.xx.xx&#xA;&#xA;&#xA;      #pkts encaps: 1300384, #pkts encrypt: 1300384, #pkts digest: 1300384&#xA;      #pkts decaps: 1571043, #pkts decrypt: 1571043, #pkts verify: 1571043&#xA;      #pkts compressed: 0, #pkts decompressed: 0&#xA;     #pkts not compressed: 1300384, #pkts comp failed: 0, #pkts decomp failed: 0&#xA;      #pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0&#xA;      #PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0&#xA;      #TFC rcvd: 0, #TFC sent: 0&#xA;      #Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0&#xA;      #send errors: 0, #recv errors: 0&#xA;&#xA;      local crypto endpt.: 3x.xx.xx.xx/500, remote crypto endpt.: 172.6.xx.xx/500&#xA;      path mtu 1500, ipsec overhead 74(44), media mtu 1500&#xA;      PMTU time remaining (sec): 0, DF policy: copy-df&#xA;      ICMP error validation: disabled, TFC packets: disabled&#xA;      current outbound spi: A58A697D&#xA;      current inbound spi : 1F9328DE&#xA;&#xA;    inbound esp sas:&#xA;      spi: 0x1F9328DE (529737950)&#xA;         transform: esp-aes esp-sha-hmac no compression&#xA;         in use settings ={L2L, Tunnel, PFS Group 2, IKEv2, }&#xA;         slot: 0, conn_id: 113205248, crypto-map: external_map&#xA;         sa timing: remaining key lifetime (kB/sec): (3881171/62699)&#xA;         IV size: 16 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap:&#xA;          0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF&#xA;          0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF&#xA;          0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF&#xA;          0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF&#xA;          0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF&#xA;          0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF&#xA;          0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF&#xA;          0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF 0xFFFFFFFF&#xA;    outbound esp sas:&#xA;      spi: 0xA58A697D (2777311613)&#xA;         transform: esp-aes esp-sha-hmac no compression&#xA;         in use settings ={L2L, Tunnel, PFS Group 2, IKEv2, }&#xA;         slot: 0, conn_id: 113205248, crypto-map: external_map&#xA;         sa timing: remaining key lifetime (kB/sec): (3687630/62699)&#xA;         IV size: 16 bytes&#xA;         replay detection support: Y&#xA;         Anti replay bitmap:&#xA;          0x00000000 0x00000000 0x00000000 0x00000001&#xA;          0x00000000 0x00000000 0x00000000 0x00000000&#xA;          0x00000000 0x00000000 0x00000000 0x00000000&#xA;          0x00000000 0x00000000 0x00000000 0x00000000&#xA;          0x00000000 0x00000000 0x00000000 0x00000000&#xA;          0x00000000 0x00000000 0x00000000 0x00000000&#xA;          0x00000000 0x00000000 0x00000000 0x00000000&#xA;          0x00000000 0x00000000 0x00000000 0x00000000&#xA;&#xA;satus&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2016-09-15T14:15:52.343" LastActivityDate="2022-12-31T20:05:37.910" Title="Cisco ASA VPN disconnecting regularly random time" Tags="|cisco|vpn|network-access|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34910" PostTypeId="2" ParentId="34907" CreationDate="2016-09-14T15:30:46.640" Score="1" Body="&lt;p&gt;Bandwidth increases as a result of using higher modulation frequencies, not the other way around.  Bandwidth is a function of the modulation frequency.  So if that is constant, so is your bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-14T15:30:46.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34912" PostTypeId="1" AcceptedAnswerId="34927" CreationDate="2016-09-14T16:11:40.063" Score="2" ViewCount="58" Body="&lt;p&gt;I was watching a video talking about EIGRP protocol and got confused in the network part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The part of the topology was:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 e0/1, with IP of 10.1.12.1/24&#xA;connected on&#xA;R2 e0/0, with IP of 10.1.12.2/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when configuring the EIGRP, the network inserted was 10.1.1.0, I couldn't understand why is that, shouldn't it be 10.1.12.0?&lt;/p&gt;&#xA;" OwnerUserId="30305" LastActivityDate="2016-09-14T22:26:50.287" Title="How to use network correctly on router protocols?" Tags="|switch|router|eigrp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34914" PostTypeId="2" ParentId="34908" CreationDate="2016-09-14T17:20:44.123" Score="1" Body="&lt;p&gt;I would trunk vlan's to another switch in the basement .You can use two Cisco switches to accomplish this relatively easy. &lt;/p&gt;&#xA;" OwnerUserId="30459" LastActivityDate="2016-09-14T17:20:44.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34915" PostTypeId="1" AcceptedAnswerId="34923" CreationDate="2016-09-14T17:48:18.727" Score="4" ViewCount="979" Body="&lt;p&gt;I have a customer using Vyatta vRouters (Brocade vRouters).  They have deployed 2 separate vRouters for redundancy, each with it's own ISP connection.  The ISP's are not the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does Vyatta have something like Cisco IOS's IP SLA tracking, whereby I can automatically failover and failback my ISP connection (even though my link light / physical/logical NIC never goes link down)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone configure this before?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-14T20:47:41.863" Title="Vyatta - Redundant ISP Connections?" Tags="|brocade|redundant-routes|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34919" PostTypeId="2" ParentId="34886" CreationDate="2016-09-14T19:46:32.297" Score="1" Body="&lt;p&gt;You need to configure intervlan routing. On your 65xx configure interface vlan 10 and 20. Give them appropirate ip addresses. Vlan10 will have ip address from backbone subnet. For example, vlan 10 - 10.10.10.0/24 subnet, vlan 20 - 10.10.20.0/24. Set a default route towards backbone. If backbone router has 10.10.10.1, then set ip route 0.0.0.0 0.0.0.0 10.10.10.1. Also you need to set route to vlan20 on your backbone router. So if your 6509 interface vlan10 ip address is 10.10.10.254, then set ip route 10.10.20.0/24 10&#xA;10.10.254 on your backbone router. If you want to connect to internet from vlan20, in that case you will meed to configure NAT on one of your devices.&lt;/p&gt;&#xA;" OwnerUserId="29580" LastActivityDate="2016-09-14T19:46:32.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34922" PostTypeId="1" AcceptedAnswerId="34950" CreationDate="2016-09-14T20:45:34.537" Score="4" ViewCount="739" Body="&lt;p&gt;Just wondering whether you require both server serving the content and client are to be on a linux kernel with mptcp enabled? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read through some articles and they seem to be using a token/connection ID which I presume regular TCP doesn't do. So if that's the case then both server/client need to be on MPTCP isn't it? Or Have I missed something? &lt;/p&gt;&#xA;" OwnerUserId="22175" LastActivityDate="2020-03-04T13:14:27.903" Title="For multipath TCP do you require mptcp on both client and server?" Tags="|tcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34923" PostTypeId="2" ParentId="34915" CreationDate="2016-09-14T20:47:41.863" Score="3" Body="&lt;p&gt;Disclaimer : I'm not familiar with current version of Vyatta, since I used it when it was still open source, prior to buyover by  Brocade, and I now use VyOs (the open source fork), but I guess this didn't change much...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for Vyatta 6.5 and VyOs, the answer is yes, there's a feature called &quot;Wan load balancing&quot; that monitor an external IP address, using ICMP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a example :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; vyatta@R1# show load‐balancing&#xA;   wan {  &#xA;     interface‐health eth0 {  &#xA;       failure‐count 5  &#xA;       nexthop 12.34.56.1  &#xA;       test 10 {  &#xA;         target 11.22.33.44&#xA;         type ping&#xA;       }  &#xA;       test 20 {  &#xA;         target 55.66.77.88  &#xA;         type ping }&#xA;     }&#xA;     interface‐health eth1 {  &#xA;       failure‐count 4&#xA;       nexthop 98.76.54.1&#xA;       test 10 {&#xA;         target 99.88.77.66&#xA;         type ping }&#xA;       test 20 {&#xA;         target 55.44.33.22&#xA;         type ping&#xA;       }&#xA;     }&#xA;     rule 10 {&#xA;       inbound‐interface eth3&#xA;       interface eth0 {&#xA;       }&#xA;       interface eth1 {&#xA;       }&#xA;     }&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-09-14T20:47:41.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34927" PostTypeId="2" ParentId="34912" CreationDate="2016-09-14T22:26:50.287" Score="1" Body="&lt;p&gt;Alright remember that when you connect two router interfaces like that way then the network between the two routers is a separate network and has nothing to do with your LAN on each side. So let's assume the following&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 is site one and has LAN network 192.168.100.0/24&#xA;R2 is site two and has LAN network 192.168.200.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to connect the two you will want to connect the routers as well so you n need a new network for it. Usually it is a network with /30 so you only have 2 usable IP's and not wasting any IP space. But this video obviously wasn't too detailed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for routers as an example you create 10.12.1.0/24 and configure it the way you have shown. Now the routes you will advertise are your R1 and R2 LAN networks. These networks have nothing to do with the IP scheme you have assigned the two router interfaces. Obviously the default gateway on the inside interfaces of your routers will be within the LAN network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it makes sense.&lt;/p&gt;&#xA;" OwnerUserId="30472" LastActivityDate="2016-09-14T22:26:50.287" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34929" PostTypeId="1" CreationDate="2016-09-15T02:31:43.110" Score="1" ViewCount="134" Body="&lt;p&gt;I would like to know if it is possible to ping a computer on a different network using ipv6. If I am understanding it correctly then IPV6 was created for each device to have its unique ip address. Following that logic even on my local area network each device must have a unique ipv6 address that could be reached from anywhere. Am i wrong? Thank you!&lt;/p&gt;&#xA;" OwnerUserId="30501" LastActivityDate="2016-09-15T07:08:10.167" Title="Pinging computer on a different network" Tags="|ipv6|ping|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34930" PostTypeId="1" CreationDate="2016-09-15T02:47:39.417" Score="0" ViewCount="42" Body="&lt;p&gt;I am responsible for a project conducting a major code upgrade on our core/aggregation and distribution layer switches along with our ISP routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We run all Juniper Routers and switches minus a few stray Arista switches used for aggregation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ive already done most of the keg work, and research on the actual processes involved in this but my question is this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I cut over to my secondary routing engine on the MX80s which will be our first portion of the project, should I expect to see any sort of packet loss or service interruption? I am aware that making the secondary RE is supposed to avert this, however this will be my first major upgrade in a large production environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-15T04:04:38.927" Title="What are some steps you would consider when conducting a major code upgrade to Juniper equipment in a production environment?" Tags="|juniper|juniper-junos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34931" PostTypeId="2" ParentId="16383" CreationDate="2016-09-15T03:22:04.833" Score="0" Body="&lt;p&gt;congestion at the network nodes&lt;/p&gt;&#xA;" OwnerUserId="30502" LastActivityDate="2016-09-15T03:22:04.833" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34932" PostTypeId="2" ParentId="34930" CreationDate="2016-09-15T04:04:38.927" Score="1" Body="&lt;p&gt;Ty,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;check out ISSU options on the code version you have on the MX's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/requirements/issu-system-requirements.html&quot; rel=&quot;nofollow&quot;&gt;http://www.juniper.net/documentation/en_US/junos14.2/topics/reference/requirements/issu-system-requirements.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30503" LastActivityDate="2016-09-15T04:04:38.927" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34933" PostTypeId="1" AcceptedAnswerId="34934" CreationDate="2016-09-15T05:08:38.500" Score="7" ViewCount="7240" Body="&lt;p&gt;I am fairly new to Juniper as an engineer and I have been doing some reading lately concerning IRB versus vlans. I have noticed we use them in most configurations throughout our environment, IRB that is. Can anyone share some of the advantages associated with both of these? From my understanding VLAN is generally used more with our EX series equipment due to it being layer 2, I do however see it on some router configurations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When would one use one over another or both in the same configuration for that matter?&lt;/p&gt;&#xA;" OwnerUserId="27523" LastEditorUserId="8499" LastEditDate="2018-02-09T02:47:18.877" LastActivityDate="2018-02-09T02:47:18.877" Title="IRB versus VLAN usage" Tags="|vlan|irb|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34934" PostTypeId="2" ParentId="34933" CreationDate="2016-09-15T06:58:52.777" Score="7" Body="&lt;p&gt;I suspect that you probably have a mix of First Generation (EX2200, EX3200, EX3300, EX4200, EX4500, EX4550) and Second Generation (EX2300, EX3400, EX4300, EX4600, QFX5100) hardware in your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First generation platforms assign L3-interfaces to vlans using &lt;code&gt;vlan.x&lt;/code&gt;, whereas the newer platforms (much like the MX-series) use the Juniper's ELS (Enhanced Layer-2 Switching) configuration style which use the &lt;code&gt;irb.x&lt;/code&gt; interface for assigning L3 to a VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Functionally they are identical, but you don't necessarily choose one over the other, merely use the style supported by the platform you are configuring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper have a complete breakdown of all the configuration differences between traditional EX-style and ELS-style here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos13.2/topics/task/configuration/getting-started-els.html#jd0e564&quot; rel=&quot;noreferrer&quot;&gt;http://www.juniper.net/techpubs/en_US/junos13.2/topics/task/configuration/getting-started-els.html#jd0e564&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-09-15T06:58:52.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34935" PostTypeId="2" ParentId="34929" CreationDate="2016-09-15T07:08:10.167" Score="5" Body="&lt;p&gt;If both computers have a global  IPv6 addresses(from the 2000::/3 prefix), IPv6 routing is correct and nothing blocks traffic (e.g. a firewall or a router access list) this ist true. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same is true for IPv4 networks using only public IPv4 addresses. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2016-09-15T07:08:10.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34938" PostTypeId="2" ParentId="34863" CreationDate="2016-09-15T09:32:30.077" Score="4" Body="&lt;p&gt;I suspect that this log message is not caused by the absence of the PSU but by an IOS bug (e.g. &lt;a href=&quot;https://tools.cisco.com/bugsearch/bug/CSCuv53498&quot; rel=&quot;nofollow&quot;&gt;CSCuv53498&lt;/a&gt; but there are more), so upgrading it may get rid of the messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, configure the following to just hide the syslog messages:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging discriminator FOO msg-body drops FRU Power Supply is not responding&#xA;logging buffered discriminator FOO&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(replace &quot;buffered&quot; with other type of logging as required)&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-15T09:32:30.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34939" PostTypeId="1" AcceptedAnswerId="34942" CreationDate="2016-09-15T10:20:22.110" Score="1" ViewCount="78" Body="&lt;p&gt;Our company has been assigned a block of IPs by APNIC. We did not have ASN though since we plan to use all IPs for our servers collocated in our current hosting provider. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Is is common for a hosting provider (ISP) to accept our IPs in their network? and if so, what do they or we have to do to have the IPs assigned to their network? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a little networking knowledge. Please share a link or a book if the answer is too long to share here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P/s: we need our own IPs since our company is providing email marketing service, thus we want our reputation is exclusive.&lt;/p&gt;&#xA;" OwnerUserId="30511" LastActivityDate="2016-09-15T12:22:16.580" Title="How to manage IP blocks assigned to organisation by regional internet registry" Tags="|ip|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34940" PostTypeId="2" ParentId="24708" CreationDate="2016-09-15T10:27:54.990" Score="1" Body="&lt;p&gt;This is late but finally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have now found the answer to it. It’s a weird situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had opened a ticket with Fortinet’s TAC for the printer query which I have posted and he just enabled NAT on the WI-FI interface on which the printer is connected and the issue was resolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this with another client of mine, I faced the same situation this time with an NAS storage device. And voila I had to enable NAT on the interface to which the NAS box was connected to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason any such device like printers, NAS etc. don’t seem to respond to communication from another subnet on the same fortigate and NAT solves the problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same setup works fine if it was a PC in place of the printer. &lt;/p&gt;&#xA;" OwnerUserId="15569" LastActivityDate="2016-09-15T10:27:54.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34941" PostTypeId="2" ParentId="34939" CreationDate="2016-09-15T11:40:44.650" Score="0" Body="&lt;p&gt;You can do this, but you will need to get your own ASN.  Then you will advertise your IP block to the hosting provider.  Usually this is done via BGP, but it is up to your ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure ISP can help you set this up.  They do this kind of thing all day long.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-15T11:40:44.650" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34942" PostTypeId="2" ParentId="34939" CreationDate="2016-09-15T11:55:35.630" Score="2" Body="&lt;p&gt;It all depends on what the ISP is willing to do for you, but technically it's possible. Either by adding your IP-space to their ASN and announcing it that way to the rest of the internet, or by setting up a BGP session with your equipment, accepting the IP-space from your ASN, which can be either public or private.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-09-15T11:55:35.630" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34944" PostTypeId="1" CreationDate="2016-09-15T12:30:50.420" Score="0" ViewCount="1108" Body="&lt;p&gt;I have two Cisco switches connected with two trunk links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the first switch spanning tree is switched off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the second switch, MST is turned on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ports configuration is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/2&#xA;switchport trunk allowed vlan 2-4&#xA;switchport trunk encapsulation dot1q&#xA;switchport trunk native vlan 4&#xA;switchport mode trunk&#xA;!&#xA;interface Ethernet0/3&#xA;switchport trunk allowed vlan 2-4&#xA;switchport trunk encapsulation dot1q&#xA;switchport trunk native vlan 4&#xA;switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(the configuration is the same on both switches)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I expect switch #2 to block one of the trunk ports: however, both of them are in FORWARDING.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dumped traffic between two switches and I saw no BPDUs are send back to switch #2. Switch #1 receives them but instead of sending them back to switch #2 does nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I change native vlan to 1 (and allow it on trunk link), everything works correctly and one of the ports is being blocked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why it happens?&lt;/p&gt;&#xA;" OwnerUserId="30513" LastEditorUserId="30513" LastEditDate="2016-09-15T12:38:04.957" LastActivityDate="2016-09-15T15:49:29.020" Title="Switch is not sending BPDUs back in native VLAN (different from vlan 1)" Tags="|cisco|vlan|spanning-tree|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34946" PostTypeId="1" AcceptedAnswerId="35912" CreationDate="2016-09-15T13:14:26.150" Score="1" ViewCount="1254" Body="&lt;p&gt;I have two Nexus 5548s in our data center. They have only servers and storage connected to them. Some interfaces are configured for native fiber channel while the rest are still Ethernet. Since there will only be servers and storage connected, I'd like to get alerts if an interface status changes (goes from up to down or vice versa). I was able to successfully configure some alerts using  the &quot;callhome&quot; configuration using some of the default alert groups. For example, I configured the alert-group Environmental to email when it got a message-level 3. If I disconnect one of the power supplies (simulating power failure), it sends me an email. But I can't find how to configure an email for interface status change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated and thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="30515" LastActivityDate="2016-10-19T14:55:22.303" Title="Email alert if interface status changes" Tags="|cisco|cisco-nx-os|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34948" PostTypeId="1" CreationDate="2016-09-15T11:13:51.640" Score="10" ViewCount="4431" Body="&lt;p&gt;I am trying to increase bandwidth for particular hosts by using lacp on a Cisco Catalyst 4500 switch.&#xA;However, it seems that I will always end up with the same flow (src/dst mac, ip, and port) being completely switched over one interface, no matter what &lt;code&gt;port-channel load-balance&lt;/code&gt; option I choose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is there no such thing as a &lt;code&gt;round robin&lt;/code&gt; option for this? (It seems that some older models had this option)&lt;/p&gt;&#xA;" OwnerUserId="4065" OwnerDisplayName="Hagen von Eitzen" LastActivityDate="2021-08-01T12:02:47.220" Title="Why is there no &quot;round robin&quot; option for lacp (at least on my switches)?" Tags="|cisco|load-balancing|ieee-802.1ax|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34949" PostTypeId="2" ParentId="34948" CreationDate="2016-09-15T12:43:40.660" Score="7" Body="&lt;p&gt;From my understanding, LACP always requires that packets in a particular network &quot;conversation&quot; (a TCP session or a UDP stream between the same source and destination ports) traverse a single LACP path, in order to guarantee delivery order.  LACP chooses a path based on a hashing algorithm.  In Linux, the hashing algorithms are those described in the &lt;code&gt;bonding&lt;/code&gt; driver's &lt;code&gt;xmit_hash_policy&lt;/code&gt; setting:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;layer2&lt;/code&gt; - meaning the hash consists of the source and destination layer 2 (MAC) addresses;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;layer2+3&lt;/code&gt; - meaning the hash consists of the &lt;code&gt;layer2&lt;/code&gt; information, plus the source and destination layer 3 (IP) addresses;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;layer3+4&lt;/code&gt; - meaning the hash consists of the layer 3 (IP) addresses plus whatever layer 4 addressing information is available (e.g. TCP or UDP source and destination port numbers, if the packets are not fragmented).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Cisco has a number of additional options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server and switch do not need to use the same hashing algorithm; all that is required is that the packets for a particular conversation choose the same path as long as that path is available.&lt;/p&gt;&#xA;" OwnerDisplayName="J Earls" LastActivityDate="2016-09-15T12:43:40.660" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34950" PostTypeId="2" ParentId="34922" CreationDate="2016-09-15T14:38:46.310" Score="6" Body="&lt;p&gt;Yes, both - client and server - need to support MPTCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you said, MPTCP changes the wire format of TCP by adding new TCP options.&lt;/p&gt;&#xA;" OwnerUserId="30516" LastActivityDate="2016-09-15T14:38:46.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34951" PostTypeId="2" ParentId="34948" CreationDate="2016-09-15T14:54:38.513" Score="2" Body="&lt;p&gt;LACP controls the aggregation of links, it doesn't control switching.  The selection of a particular member of a bundle is via an algortithm decided upon and implemented by each switch vendor.  It has to be something that can be programmed into hardware in order to operate at wire speeds relatively cheaply, and a hash of various fields of an Ethernet frame is suitable for this.  To perform round-robin the ingress hardware would need to know all about the bundle members and keep state about previous frames switched.  That problem is an order of magnitude more complex.   I don't know of any switches that perform round-robin across a LAG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Linux and ESX etc can perform round-robin in software, that's fairly straightforward in comparison since the entire interface selection process is already in software.  Also notice that typically servers have a higher transmit requirement than receive and so for many applications the increased bandwidth that round-robin achieves is only required server-to-switch.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-09-15T14:54:38.513" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34953" PostTypeId="2" ParentId="34946" CreationDate="2016-09-15T15:07:53.747" Score="1" Body="&lt;p&gt;You can use eem - embeded event manager. Here is nx-os configuration guide: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/system_management/configuration/guide/sm_nx_os_cg/sm_12eem.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/5_x/nx-os/system_management/configuration/guide/sm_nx_os_cg/sm_12eem.html&lt;/a&gt;. First example shows how to send emails. With eem you can capture interface state changes and trigger events. Also nexus switches support pure python. You can write a python script which catches the int up down logs and sends notifications&lt;/p&gt;&#xA;" OwnerUserId="29580" LastActivityDate="2016-09-15T15:07:53.747" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="34954" PostTypeId="2" ParentId="34944" CreationDate="2016-09-15T15:49:29.020" Score="2" Body="&lt;p&gt;MST works as a common spanning tree(CST). This means that MST doesn't generate sperate bpdu for each vlan. Only PVST(+) can generate bpdu per vlan. MST will send and accept bpdu  over Vlan1 when you connect MST to none-mst domain. So in your case you have to allow vlan 1.&lt;/p&gt;&#xA;" OwnerUserId="29580" LastActivityDate="2016-09-15T15:49:29.020" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="34957" PostTypeId="1" CreationDate="2016-09-15T20:03:22.327" Score="2" ViewCount="759" Body="&lt;p&gt;I have three ESXi hosts (Host A, B &amp;amp; C) all connected to a centralized Dell switch in trunk mode.  Each using vSwitches (not dvSwitches).  They are all configured for VLAN ID: All (4095).  This works great, I effectively have 1 network between all the hosts. One of the hosts has a pfSense gateway VM (Host A).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I would like to take 1 of the hosts (Host C), and additionally connect it using another NIC to an HP 5900AF-48G-4XG-2QSFP+ Switch, using VLAN 5 (because I need regular physical RJ45 access to the network). I configured a set of ports on the HP to VLAN 5.  But I cannot seem to configure the port properly on the HP switch.  &lt;strong&gt;Effectively my question is, for this type of HP switch, should the port be configured in trunk mode?&lt;/strong&gt;  I have it in Trunk mode on VLAN 5.  However, if the ESXi host NIC is connected to the HP switch, it causes the VMs on that host (Host C) to not be able to talk to hosts (B &amp;amp; A) over the Dell switch.&lt;/p&gt;&#xA;" OwnerUserId="28096" LastActivityDate="2017-05-29T20:09:58.760" Title="HP 5900 Switch to ESXi vSwitch , how do you configure the HP port?" Tags="|vlan|hp|trunk|vmware|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34961" PostTypeId="1" AcceptedAnswerId="59222" CreationDate="2016-09-15T22:57:03.400" Score="3" ViewCount="5273" Body="&lt;p&gt;&lt;a href=&quot;https://ask.wireshark.org/questions/7664/wont-capture-packets-that-i-know-are-there&quot; rel=&quot;nofollow&quot;&gt;This discussion&lt;/a&gt; reveals that Wireshark may not capture every packet on a network. In that case, the reason pertains to TCP data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am specifically interested in seeing (extremely bulky) GVSP data. As I understand it, this is based on UDP. I would have thought that even if Wireshark had no filter available for GVSP data, it would at least offer me the UDP data. But I don't see any data at all, despite being absolutely it is transmitted. Why not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my situation, I have a PLC triggering a camera regularly, which duly sends its images via GVSP to a host on an isolated network. Also, the PLC sends a UDP packet per trigger event down another isolated network to the same host. On that host, I run Wireshark, I capture on both channels simultaneously, and I see (1) visual evidence of the camera images arriving, (2) Wireshark evidence of the regular UDP packets, and (3) GVCP data from the camera. But the GVSP data is missing. What do I need to do to see this data?&lt;/p&gt;&#xA;" OwnerUserId="30529" LastActivityDate="2019-05-17T11:49:27.687" Title="Why does Wireshark not show all traffic (especially GVSP data)" Tags="|wireshark|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34962" PostTypeId="1" AcceptedAnswerId="34984" CreationDate="2016-09-16T00:33:27.737" Score="0" ViewCount="101" Body="&lt;h2&gt;Scenario:&lt;/h2&gt;&#xA;&lt;p&gt;Assume no Internet connection for the sake of this question, the scenario is basic - 5 offices connected by an MPLS WAN.  The customer is handed a Fast Ethernet (100Mbps) circuit at each location.  Each branch has 3 subnets / VLANs and wants automatic routing such that if branch x adds a new subnet, the other branches will automatically learn the subnet/route.&lt;/p&gt;&#xA;&lt;h3&gt;First Question:&lt;/h3&gt;&#xA;&lt;p&gt;Is BGP required on the customers networking devices?  If so, why.&lt;/p&gt;&#xA;&lt;h3&gt;Second Question:&lt;/h3&gt;&#xA;&lt;p&gt;Assume the customer has deployed DMVPN with OSPF over that.  Is BGP required on the customers networking devices?  If so, why.&lt;/p&gt;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-03-21T01:06:00.447" Title="Use of BGP by Enterprise / Medium Businesses with Layer 3 MPLS WAN" Tags="|bgp|layer3|mpls|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34963" PostTypeId="1" AcceptedAnswerId="34964" CreationDate="2016-09-16T06:35:04.463" Score="2" ViewCount="230" Body="&lt;p&gt;I am a lil confused:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I got one switch with two VLANs (X, Y) and one trunk port (for X, Y). The trunk port is connected to a router with subinterfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN X has IP address range 192.168.X.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN Y has IP address range 192.168.Y.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router got the first IP address in both networks. That means it knows a route to X and Y.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I now send a packet from X to Y, the router will receive it and forward it. (?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason to use a router is becaue of NAT to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nearly everything is connected to the internet. That means I always need to filter traffic on the router that connects the switches. (?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any setup connected to the internet, which doesn't need to be filtered by ACL or VRT? Is it possible to use NAT without routig internally? Did I miss something?&lt;/p&gt;&#xA;" OwnerUserId="30532" LastActivityDate="2016-09-16T19:41:57.373" Title="Do VLANs always end up in a router and need to be blocked?" Tags="|router|vlan|nat|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34964" PostTypeId="2" ParentId="34963" CreationDate="2016-09-16T08:18:48.537" Score="5" Body="&lt;p&gt;That's a lot of questions so let's try to take them one by one.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If I now send a packet from X to Y, the router will receive it and&#xA;  forward it. (?)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, that is what a router does, it forwards packets from one layer-2 (L2) network to another.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The reason to use a router is becaue of NAT to the internet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. The primary reason to use a router is to forward packets. Additionally it can, but certainly doesn't always, perform additional operations on the packets such as address or port translation (NAT/PAT) or encryption (VPN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could just as well have public ip addresses on your vlan X so in that case, no NAT is required for it to connect to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, as @RonTrunk mentions, if you do use private IP addresses then the NAT can also be done elsewhere, e.g. on a firewall between the router and the Internet.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Nearly everything is connected to the internet. That means I always&#xA;  need to filter traffic on the router that connects the switches. (?)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends how secure you want to be (and how paranoid you are, or to look at it from another angle, how severe the impact would be of a security breach), and how well your hosts are secured.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any setup connected to the internet, which doesn't need to be&#xA;  filtered by ACL or VRT?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Sure, most home routers will typically do NAT but have no explicit ACLs.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to use NAT without routig internally? Did I miss something?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Assuming that you mean that vlan X and Y both need access to the Internet (with NAT) but X is not allowed to communicate with Y (and vice versa) then you cannot &quot;disable&quot; the routing between X and Y so the simplest solution would be to use an ACL to filter that traffic. &lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-09-16T11:30:28.817" LastActivityDate="2016-09-16T11:30:28.817" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34966" PostTypeId="1" CreationDate="2016-09-16T09:57:52.227" Score="1" ViewCount="270" Body="&lt;p&gt;My pc sends many arp requests to the router over WiFi .. why is that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/B1tAg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/B1tAg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, why does the router send ARP requests to the whole net from time to time?&lt;/p&gt;&#xA;" OwnerUserId="30538" LastActivityDate="2016-09-16T10:50:06.027" Title="My pc sends many ARP requests to router over wifi" Tags="|arp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34968" PostTypeId="2" ParentId="34966" CreationDate="2016-09-16T10:50:06.027" Score="1" Body="&lt;p&gt;Based on the timestamps, it looks like the device 192.168.1.13 has an ARP cache timer of 10 seconds. So after 10 seconds it flushes the entry from the ARP cache, and (if there is traffic to be sent) it sends a new ARP request.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-16T10:50:06.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34972" PostTypeId="1" CreationDate="2016-09-16T12:44:25.357" Score="3" ViewCount="210" Body="&lt;p&gt;I manage a wireless network of 50 Aironet 1130AG access points spread across 8 Catalyst switches. This ran very smoothly until I had to employ VLAN tagging. There is now the passwordless Default (1) and a new VLAN (300) with WPA2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch ports across the switches are set to trunk mode except the gateway port where the VLAN 300 router resides.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this maneuver, the whole network slowed down to a crawl. I lack experience with managing VLANs, so I am hoping someone could give me some advice in what might have caused this hit to performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-- AP Config --&lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.4&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname SSH-WL01&#xA;!&#xA;enable secret 5 ****&#xA;!&#xA;no aaa new-model&#xA;no ip igmp snooping&#xA;ip domain name SSH&#xA;!&#xA;!&#xA;no dot11 igmp snooping-helper&#xA;dot11 vlan-name Otrum vlan 300&#xA;dot11 vlan-name default vlan 1&#xA;!&#xA;dot11 ssid OpenNet&#xA;   vlan 1&#xA;   authentication open&#xA;   guest-mode&#xA;   mbssid guest-mode&#xA;   infrastructure-ssid optional&#xA;!&#xA;dot11 ssid otrum&#xA;   vlan 300&#xA;   authentication open&#xA;   authentication key-management wpa version 2&#xA;   mbssid guest-mode&#xA;   wpa-psk ascii 7 ****&#xA;!&#xA;dot11 network-map&#xA;power inline negotiation prestandard source&#xA;!&#xA;!&#xA;username admin privilege 15 secret 5 ****&#xA;!&#xA;bridge irb&#xA;!&#xA;!&#xA;interface Dot11Radio0&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption vlan 300 mode ciphers aes-ccm tkip&#xA; !&#xA; ssid OpenNet&#xA; !&#xA; ssid otrum&#xA; !&#xA; mbssid&#xA; station-role root&#xA;!&#xA;interface Dot11Radio0.1&#xA; encapsulation dot1Q 1 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA; bridge-group 1 spanning-disabled&#xA;!&#xA;interface Dot11Radio0.300&#xA; encapsulation dot1Q 300&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA; bridge-group 1 spanning-disabled&#xA;!&#xA;interface Dot11Radio1&#xA; no ip address&#xA; no ip route-cache&#xA; !&#xA; encryption vlan 300 mode ciphers aes-ccm tkip&#xA; !&#xA; ssid OpenNet&#xA; !&#xA; ssid otrum&#xA; !&#xA; no dfs band block&#xA; mbssid&#xA; speed  basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 basic-54.0&#xA; channel dfs&#xA; station-role root&#xA;!&#xA;interface Dot11Radio1.1&#xA; encapsulation dot1Q 1 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA; bridge-group 1 spanning-disabled&#xA;!&#xA;interface Dot11Radio1.300&#xA; encapsulation dot1Q 300&#xA; no ip route-cache&#xA; bridge-group 1&#xA; bridge-group 1 subscriber-loop-control&#xA; bridge-group 1 block-unknown-source&#xA; no bridge-group 1 source-learning&#xA; no bridge-group 1 unicast-flooding&#xA; bridge-group 1 spanning-disabled&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA; no ip route-cache&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0.1&#xA; encapsulation dot1Q 1 native&#xA; no ip route-cache&#xA; bridge-group 1&#xA; no bridge-group 1 source-learning&#xA; bridge-group 1 spanning-disabled&#xA;!&#xA;interface FastEthernet0.300&#xA; encapsulation dot1Q 300&#xA; no ip route-cache&#xA; bridge-group 255&#xA; no bridge-group 255 source-learning&#xA; bridge-group 255 spanning-disabled&#xA;!&#xA;interface BVI1&#xA; ip address 172.16.0.1 255.255.0.0&#xA; no ip route-cache&#xA;!&#xA;ip default-gateway 172.16.254.254&#xA;ip http server&#xA;no ip http secure-server&#xA;ip http help-path http://www.cisco.com/warp/public/779/smbiz/prodconfig/help/eag&#xA;snmp-server community SSH RO&#xA;snmp-server location Badehuset&#xA;bridge 1 route ip&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; login local&#xA;!&#xA;&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-- Switch Config -- &lt;p&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname ssh-sw01&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 ****&#xA;enable password ****&#xA;!&#xA;username admin privilege 15 secret 5 ****&#xA;no aaa new-model&#xA;system mtu routing 1500&#xA;ip subnet-zero&#xA;!&#xA;!&#xA;ip domain-name ssh.local&#xA;cluster enable Cluster1 0&#xA;!&#xA;!&#xA;crypto pki trustpoint TP-self-signed-4237220096&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-4237220096&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-4237220096&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/5&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/7&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/8&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/9&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/10&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/11&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/12&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/13&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/14&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/15&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/16&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/17&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/18&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/19&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/20&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/21&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/22&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/23&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport access vlan 300&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/1&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan1&#xA; ip address 172.16.1.1 255.255.0.0&#xA; no ip route-cache&#xA;!&#xA;interface Vlan10&#xA; ip address 172.17.1.1 255.255.0.0&#xA; no ip route-cache&#xA;!&#xA;interface Vlan300&#xA; ip address 172.19.1.1 255.255.0.0&#xA; no ip route-cache&#xA;!&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;snmp-server community public RO&#xA;snmp-server community public@es0 RO&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; password ****&#xA; login local&#xA; transport input ssh&#xA;line vty 5 15&#xA; password ****&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30542" LastEditorUserId="30542" LastEditDate="2016-09-16T15:19:36.147" LastActivityDate="2018-01-12T12:51:01.040" Title="Cisco Aironet performance took a big hit with VLAN" Tags="|cisco|vlan|performance|aironet|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="34974" PostTypeId="1" CreationDate="2016-09-16T15:55:00.767" Score="0" ViewCount="632" Body="&lt;p&gt;I am working on a network that has fibre connection terminated to the 3850 fibre switch. I want to connect 2960 to this 3850 switch. I want to use the SFP port to link them up together. Please how do i go about it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="30547" LastActivityDate="2016-09-22T09:21:50.917" Title="Connecting Cisco Ctalyst 3850 Fibre switch to Cisco Catalyst 2960" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34978" PostTypeId="1" CreationDate="2016-09-16T17:15:26.313" Score="0" ViewCount="42" Body="&lt;p&gt;If the question title doesn't make sense, please forgive me, I'm not a networking person.  I will try to describe what I mean:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you view your available networks on your computer, some are your service and some belong to others/neighbors.  Theoretically you could connect to your neighbors' if you had a deal with/trusted them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One could imagine ways to make this beneficial for both you and your neighbor.  You could make a few extra bucks by someone else using your service, and this person could avoid signing contracts and dealing with ISP's.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the usefulness is only as good as your relationship with your neighbor.  One wouldn't want to engage in something with a bad neighbor, much less a perfect stranger.  What if they hack you or give you a virus?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering if this is necessarily the case.  Is there any way to make WAP's secure?  What if both owner has set up the WAP to use a CJDNS NAT gateway?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's possible that I've confused some concepts here, so please feel free to be blunt with your answers.  Thanks for reading.&lt;/p&gt;&#xA;" OwnerUserId="22885" LastActivityDate="2016-09-18T22:53:58.397" Title="Is it possible for secure third-party peering at wireless access points?" Tags="|wireless|security|access-point|ad-hoc-wireless|peering|" AnswerCount="1" CommentCount="6" ClosedDate="2016-09-18T22:57:54.320" ContentLicense="CC BY-SA 3.0" />
  <row Id="34979" PostTypeId="1" AcceptedAnswerId="35010" CreationDate="2016-09-16T18:56:49.530" Score="3" ViewCount="977" Body="&lt;p&gt;Hey I'm kinda new to networking. Forgive the basic nature of the doubt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches, when they receive frames to an unknown destination, broadcast the frame to find the correct destination. Meanwhile routers use routing protocols like RIP, OSPF etc. to find the correct destination. My doubt is why can't switches also use some sort of protocol similar to RIP but at level 2 to find the MAC addresses of all the devices? We can avoid the unicast flooding which take away a lot of the bandwidth right?&lt;/p&gt;&#xA;" OwnerUserId="30265" LastActivityDate="2016-09-18T09:03:28.190" Title="Switch vs Router" Tags="|switch|layer2|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34980" PostTypeId="2" ParentId="34979" CreationDate="2016-09-16T19:01:37.633" Score="0" Body="&lt;p&gt;Unicast flooding happens less than you may think. It only takes a single frame from a host for the switch to learn the port where the host is connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing about switches is that they are fairly simple, transparent devices which have changes made all the time. Hosts come and go all the time as they are turned on or off. Sometimes a host may be connected to a different port. Routing protocols work best with a fairly stable environment, and that doesn't exist for switches.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-16T19:01:37.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34982" PostTypeId="2" ParentId="34979" CreationDate="2016-09-16T19:18:35.367" Score="0" Body="&lt;p&gt;IP addressing is intended to be designed/configured by administrators, allowing for route summarization which facilitates efficient routing.  IP addresses are not meant to be universally unique identifiers (UUID's) whereas MAC addresses are.  &lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-16T19:18:35.367" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="34983" PostTypeId="1" CreationDate="2016-09-16T19:22:19.443" Score="1" ViewCount="30" Body="&lt;p&gt;I have a question. I have an HPE V1910 48 Gig Switch. I am looking to combine 2 ports on the switch so that I can get a 2 Gig Ethernet connection to my PC. I can not figure out how to do this. can someone please help?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks, &lt;/p&gt;&#xA;" OwnerUserId="30553" LastActivityDate="2016-10-17T09:52:11.747" Title="HPE V1910 48 Gig Port Question" Tags="|vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34984" PostTypeId="2" ParentId="34962" CreationDate="2016-09-16T19:25:37.073" Score="1" Body="&lt;p&gt;#1  BGP is required only if the provider offers no other dynamic routing protocol.  In this case, your BGP peering is confined to your VRF within the providers cloud and can accept/pass private subnets to your remote sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;#2 No.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-16T19:25:37.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34985" PostTypeId="2" ParentId="34963" CreationDate="2016-09-16T19:41:57.373" Score="0" Body="&lt;p&gt;NAT is required for a privately addressed endpoint to communicate with an Internet connected endpoint.  Firewalls are typically deployed at Internet connection points to limit the scope of incoming traffic.  A router, sometimes called a layer 3 gateway, enables endpoints on different subnetworks to talk to one another.  Typically, a single subnet exists per VLAN.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-16T19:41:57.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34986" PostTypeId="2" ParentId="19470" CreationDate="2016-09-16T19:53:55.240" Score="2" Body="&lt;p&gt;Most, if not all, ISPs today, especially cable ones will provide service to a specific MAC address only. So if you decide to purchase your own gateway (e.g. modem+router+wifi) to avoid paying the ISP a monthly renting fee, you MUST call them and let them know that you have a new device with a new MAC.  &lt;/p&gt;&#xA;" OwnerUserId="30554" LastActivityDate="2016-09-16T19:53:55.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34987" PostTypeId="1" CreationDate="2016-09-16T19:59:08.860" Score="2" ViewCount="696" Body="&lt;p&gt;I'm looking to be notified of interface state changes on my Arista switches without my manual polling of the logs. For example, tailing var/log/messages, I might see something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;un 29 19:10:48 switch-min2203 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet33 (server-min2239 p3p2), changed state to up&#xA;Jun 29 19:11:23 switch-min2203 Ebra: %LINEPROTO-5-UPDOWN: Line protocol on Interface Ethernet33(server-min2239 p3p2), changed state to down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd like to be emailed or alerted via Slack if say an interface changes state on one of the Arista switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am uncertain how best to go about alerting on these sometimes sub-second changes. Has anyone attempted this with Graylog? Or monitoring the transition counter on the interface and alerting if it's change X many times since the last poll?&lt;/p&gt;&#xA;" OwnerUserId="30555" LastEditorUserId="8499" LastEditDate="2018-03-12T17:02:01.040" LastActivityDate="2018-04-11T18:40:39.127" Title="Arista switches- Email alert if interface status changes" Tags="|switch|monitoring|interface|arista|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="34988" PostTypeId="2" ParentId="34987" CreationDate="2016-09-16T20:24:17.620" Score="0" Body="&lt;p&gt;We use Solarwinds in our environment for this Ron, but I'm not sure how sensitive it is I will look when i return from lunch. Im fairly sure it posseses  what you are looking for as we run a large amount of arista switches for aggregation along with our Juniper environment.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-16T20:24:17.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34990" PostTypeId="2" ParentId="34972" CreationDate="2016-09-16T20:39:25.903" Score="2" Body="&lt;p&gt;Have you considered placing your wlc in a different location instead of off of the router in the router. From most of my experience with environments I've worked in we have always placed are wireless LAN controllers off of switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spaced evenly throughout your network environment comma it would make much more sense from a traffic flow standpoint. It seems to me that if you are running a wlc behind a router that is also responsible for your whole networks routing that could cause a bottleneck?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I havent used a router in between the wlc and layer 3 switch stack in any environment most wireless lan controllers function fine at layer 2 with a vlan ip.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-16T20:39:25.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34991" PostTypeId="1" AcceptedAnswerId="34992" CreationDate="2016-09-16T21:30:10.913" Score="4" ViewCount="317" Body="&lt;p&gt;Good day all,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I am monitoring a large network and do not have physical access to the devices and want to find out what port a device is on. What are some techniques I can use to help accomplish this goal?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way I can think of is to obtain a trace route from the source machine to a destination ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then use this to find the router that the device is using to leave the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Log into the router and run the command sh ip arp | include [ip address of host]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once I have the mac address, I will log into the on that LAN switch and type sh mac-address-table | include [mac address of host]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe this should point me to the right direction of what port the host is using. I might have some issue if the the interface is setup as a port-channel. If that is the case I may need to run sh int port-channel (correct me if I am wrong).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am wrong in any of my steps please correct me, but are their any commands I am missing when trying to trace down the interface a host is on? &lt;/p&gt;&#xA;" OwnerUserId="30558" LastActivityDate="2016-09-16T21:49:02.060" Title="How would I track down what port a device is on remotely?" Tags="|cisco-commands|network-discovery|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34992" PostTypeId="2" ParentId="34991" CreationDate="2016-09-16T21:49:02.060" Score="4" Body="&lt;p&gt;This is exactly the process I would use in most circumstances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have CDP (Cisco Discovery Protocol) enabled on all your switches though, you can save a LOT of time by running Cisco's MAC Traceroute function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;traceroute mac ip &amp;lt;&amp;lt;gateway ip&amp;gt;&amp;gt; &amp;lt;&amp;lt;host ip&amp;gt;&amp;gt; detail&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;&amp;lt;&amp;lt;gateway ip&amp;gt;&amp;gt;&amp;gt;&lt;/code&gt; is the gateway address of the subnet the device you are trying to trace (or any other valid IP within that subnet).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0ffnet-LAB1#traceroute mac ip 172.16.0.1 172.16.0.188 detail&#xA;Translating IP to mac .....&#xA;172.16.0.1 =&amp;gt; 00a0.6125.af0b&#xA;172.16.0.188 =&amp;gt; 0029.8856.0f60&#xA;&#xA;Source not directly connected, tracing source .....&#xA;Source 00a0.6125.af0b found on 0ffnet-LAB1[WS-C3550-48] (172.16.0.1)&#xA;1 0ffnet-LAB1 / WS-C3550-48 / 172.16.0.1 :&#xA;Fa0/27 [auto, auto] =&amp;gt; Fa0/3 [auto, auto]&#xA;2 0ffnet-LAB2 / WS-C3550-48 / 172.16.0.2 :&#xA;Fa0/1 [auto, auto] =&amp;gt; Fa0/2 [auto, auto]&#xA;Destination 0029.8856.0f60 found on 0ffnet-LAB2[WS-C3550-48] (172.16.0.2)&#xA;Layer 2 trace completed.&#xA;0ffnet-LAB1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you need to do this on a regular basis (e.g.: you're the network administrator), then there are tools which can automate this process by collecting the MAC tables regularly from your devices and store them in a database e.g.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://netdbtracking.sourceforge.net&quot; rel=&quot;nofollow&quot;&gt;http://netdbtracking.sourceforge.net&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can easily do something similar with SNMP and a bit of coding experience.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-09-16T21:49:02.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="34993" PostTypeId="2" ParentId="33199" CreationDate="2016-09-17T04:51:46.063" Score="0" Body="&lt;p&gt;Create your config file that has no NAT entries, upload to your router, remove config.text, change the new config file name to config.text, then run a &quot;configure memory&quot; command to load the config.text file into the running config.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2016-09-17T04:51:46.063" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="34994" PostTypeId="2" ParentId="34983" CreationDate="2016-09-17T08:56:54.467" Score="2" Body="&lt;p&gt;this switch is Comware based, so you would need to set up a Bridge-Aggregation Group.  This is the same as a Cisco L2 port channel.  Your PC will need to support link-aggregation and preferably LACP.  This link provides some info on setting it up: &lt;a href=&quot;http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=mmr_kc-0117330&quot; rel=&quot;nofollow&quot;&gt;http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=mmr_kc-0117330&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-09-17T08:56:54.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="34997" PostTypeId="1" AcceptedAnswerId="35002" CreationDate="2016-09-17T10:05:05.073" Score="2" ViewCount="2332" Body="&lt;p&gt;Is there any way I can capture the router IP or MAC addresses along the path of a ping packet using Wireshark tool?&lt;/p&gt;&#xA;" OwnerUserId="30265" LastActivityDate="2016-09-17T16:13:01.327" Title="Wireshark to capture router MAC's" Tags="|router|mac-address|wireshark|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35001" PostTypeId="1" CreationDate="2016-09-17T14:16:48.050" Score="0" ViewCount="1449" Body="&lt;p&gt;Please how can I use Cisco ASA 5505 to permit some specific users to access the internet .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I want to allow  5 users to access the internet and block the others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best Regards&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please see below the configuration,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ciscoasa# sh&#xA;ciscoasa# sho&#xA;ciscoasa# show ru&#xA;ciscoasa# show running-config&#xA;: Saved&#xA;:&#xA;ASA Version 8.3(1)&#xA;!&#xA;hostname ciscoasa&#xA;enable password 8Ry2YjIyt7RRXU24 encrypted&#xA;passwd 2KFQnbNIdI.2KYOU encrypted&#xA;names&#xA;!&#xA;interface Vlan1&#xA; description LAN&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.1.1 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; description INTERNET&#xA; nameif outside&#xA; security-level 0&#xA; ip address dhcp setroute&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30573" LastEditorUserId="2142" LastEditDate="2016-09-17T18:58:52.390" LastActivityDate="2016-09-20T05:21:24.693" Title="how can I use Cisco ASA 5505 to permit some specific users to access the internet" Tags="|cisco-c5500|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35002" PostTypeId="2" ParentId="34997" CreationDate="2016-09-17T16:13:01.327" Score="2" Body="&lt;p&gt;You can only capture addresses in the headers of the network stack:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Layer-2 source and destination addresses. The source address will be&#xA;the address of the host on your LAN which originated the frame in your LAN. The destination address will be your address. Layer-2 addresses, e.g. MAC addresses, are only relevant or seen in the LAN where the hosts are.&lt;/li&gt;&#xA;&lt;li&gt;Layer-3 source and destination addresses. The source address will be&#xA;the address of the host which originated the packet (or the address&#xA;of a NAT device for the originating host). The destination address will be your address.&lt;/li&gt;&#xA;&lt;li&gt;Layer-4 source and destination addresses. The source address will be&#xA;the port used by the originating host (or the port used by the NAT&#xA;device of the originating host). The destination address will be the port on your host.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The addresses of the devices in the path are not captured along the way.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-17T16:13:01.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35003" PostTypeId="1" AcceptedAnswerId="35004" CreationDate="2016-09-18T00:58:52.090" Score="1" ViewCount="57" Body="&lt;p&gt;How is the http interface enabled on this switch? What are the cli commands?&lt;/p&gt;&#xA;" OwnerUserId="22298" LastActivityDate="2016-09-18T04:36:43.013" Title="Extreme 670-48x.10 web interface" Tags="|switch|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35004" PostTypeId="2" ParentId="35003" CreationDate="2016-09-18T04:36:43.013" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://documentation.extremenetworks.com/exos/downloads/EXOS_User_Guide_21_1.pdf&quot; rel=&quot;nofollow&quot;&gt;http://documentation.extremenetworks.com/exos/downloads/EXOS_User_Guide_21_1.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Page 706. You should at least make an effort to research before posting something like that here.&lt;/p&gt;&#xA;" OwnerUserId="30293" LastActivityDate="2016-09-18T04:36:43.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35006" PostTypeId="1" CreationDate="2016-09-18T05:39:53.367" Score="3" ViewCount="298" Body="&lt;p&gt;I'm looking for a compatible RG45 10Gb line card with Cisco catalyst WS-C4507R+E/WS-X45-SUP7-E&#xA;Unfortunately I was unable to find any useful information in data sheets.&#xA;Can anyone help me? I'm really confused.&#xA;If possible please leave a valid link.&lt;/p&gt;&#xA;" OwnerUserId="30580" LastEditorUserId="8499" LastEditDate="2017-12-28T08:05:11.883" LastActivityDate="2017-12-28T08:05:11.883" Title="Cisco catalyst 45xx series compatibility with RG45 10Gb" Tags="|cisco|switch|10gbase|cisco-4500|line-card|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35007" PostTypeId="2" ParentId="35006" CreationDate="2016-09-18T06:50:09.750" Score="1" Body="&lt;p&gt;From a quick glance at &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/interfaces-modules/catalyst-4500-series-line-cards/product_data_sheet0900aecd802109ea.html&quot; rel=&quot;nofollow&quot;&gt;this data sheet&lt;/a&gt;, table 1 seem to indicate that your chassis and SUP support all line cards except the 24Gbps 47xx series.&#xA;So I may have missed one or two but it seems all these are supported:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WS-X4148-RJ&#xA;WS-X4248-RJ45V&#xA;WS-X4506-GB-T&#xA;WS-X4548-GB-RJ45&#xA;WS-X4548-GB-RJ45V&#xA;WS-X4548-RJ45V+&#xA;WS-X4748-RJ45-E&#xA;WS-X4748-RJ45V+E&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In addition there are line cards with SFP ports that can be used with RJ45 SFPs, from the WS-X4448-GB-SFP up to the WS-X4748-SFP-E.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said all that, I strongly advise you to double check with your Cisco Partner/Reseller before ordering. Or in case you are considering buying from another source, make sure to get a money-back guarantee as there are sometimes corner case scenarios (like card X is supported but requires IOS version Y, and you already have another line card Z that is no longer supported in version Y).&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-18T06:50:09.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35009" PostTypeId="2" ParentId="35001" CreationDate="2016-09-18T07:38:38.870" Score="4" Body="&lt;p&gt;I can think of a few possible strategies to achieve the desired result of allowing 5 users Internet access and blocking all others:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure static IP addresses on the PCs of the 5 users or configure the DHCP server with IP address reservations for those 5 (based on their MAC address, always assign them the same IP address). Then on the ASA you can simply put an ACL on the inside interface allowing only traffic from those 5 ip addresses.&#xA;Note that this is the most basic solution, but:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This allows the 5 &lt;em&gt;PCs&lt;/em&gt; access, not the 5 &lt;em&gt;users&lt;/em&gt;. So user6 can still access the Internet from user5's PC.&lt;/li&gt;&#xA;&lt;li&gt;It is subject to IP spoofing, i.e. when user6 sees that user5's PC is powered off, user6 can configure user5's IP address on his PC and hence get Internet access.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Physically separate the users' PCs in 2 different (V)LANs. E.g. if your current setup has all users connected to a switch (or set of switches) connected to Eth0/1, then unplug those 5 users and plug them into ports Eth0/2-6 and configure those as vlan 3, configure an &lt;code&gt;interface vlan3&lt;/code&gt; etc., put a blocking ACL in vlan1 and a permissive ACL on vlan3.&#xA;Note that&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;this is still device based, not user based, i.e. this still allows user6 to use user5's PC to access the Internet&lt;/li&gt;&#xA;&lt;li&gt;there are some physical restrictions&lt;/li&gt;&#xA;&lt;li&gt;user6 may potentially unplug user5's cable and plug it into his PC to get Internet access&lt;/li&gt;&#xA;&lt;li&gt;you'll need a new IP subnet and DHCP range (for which the ASA can either be the DHCP server, or DHCP relay to your current DHCP server).&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Almost the same as #2 but instead of physically separating them, logically separate them on your existing LAN switch(es), i.e. create a new vlan3 on your LAN switch(es), assign the 5 allowed users' ports to that vlan, configure the link between ASA and switch as trunk (and then same as in #2, configure a vlan3 interface and ACL). Same caveats as in #2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure &lt;a href=&quot;https://supportforums.cisco.com/document/56421/asa-cut-through-authentication-proxy-configuration-and-examples&quot; rel=&quot;nofollow&quot;&gt;Cut-Through Authentication&lt;/a&gt; which requires users to enter a username and password before they can access the Internet, so in your case you would only create accounts for the 5 allowed users. Note that this is now user-based, not PC-based. So allowed users can log in from any PC in the network or connect to any switchport, prohibited users cannot access the internet no matter where they are (as long as the 5 users keep their credentials secret).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa84/configuration/guide/asa_84_cli_config/access_idfw.html&quot; rel=&quot;nofollow&quot;&gt;Identity Firewall&lt;/a&gt; which integrates with Active Directory, so users no longer have to authenticate to the firewall explicitly as in #4 but this happens transparently, and you create ACLs based on AD usernames.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3650/software/release/3se/security/configuration_guide/b_sec_3se_3650_cg/b_sec_3se_3650_cg_chapter_01111.html&quot; rel=&quot;nofollow&quot;&gt;802.1x on your LAN switch(es)&lt;/a&gt;, if they support it, and then you get a whole range of additional options, e.g. you can have the switch dynamically change the vlan on the port the user connects to (and then combine that with #3 above) or dynamically create ACLs on the &lt;em&gt;switch&lt;/em&gt;.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-18T07:38:38.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35010" PostTypeId="2" ParentId="34979" CreationDate="2016-09-18T09:03:28.190" Score="3" Body="&lt;p&gt;As mentioned in my comments on Ron Royston's answer, I assume you mean &quot;why can't switches also use some sort of protocol &lt;em&gt;to populate their mac-address-table&lt;/em&gt;&quot;. If that is not what you meant then disregard the rest of this answer.&#xA;If that is what you meant then I think this is a great question!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, if you really meant &quot;why &lt;strong&gt;can't&lt;/strong&gt; switches use...&quot; then I think the answer is, theoretically they &lt;em&gt;could&lt;/em&gt; - or at least off the top of my head I can't think of a reason why they could not. You could invent a L2 protocol that allows switches to query the device connected to a port to get the device's MAC address, or a list of MAC addresses reachable through that device (in case it is another switch). This could perhaps even remove the need for STP. Of course this are just my initial thoughts and real experts (which I don't consider myself to be) may have already given this much more thought and may have found specific reasons why this would not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if your question (or next question) is &quot;why &lt;strong&gt;don't&lt;/strong&gt; switches use...&quot; then I can think of a few reasons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ethernet existed before Ethernet switches were invented. Implementing a new protocol would mean no backward compatibility or in other words, you would have to upgrade firmware or hardware on &lt;em&gt;all&lt;/em&gt; the devices on your network to implement this new protocol.&lt;/li&gt;&#xA;&lt;li&gt;Time-to-market and competition may have been important (business driven rather than technical) considerations when the first switches were introduced. &lt;/li&gt;&#xA;&lt;li&gt;CPU power in early switches may not have been enough to run such a protocol, or switches would have required more expensive CPUs.&lt;/li&gt;&#xA;&lt;li&gt;the &lt;a href=&quot;https://en.wikipedia.org/wiki/KISS_principle&quot; rel=&quot;nofollow&quot;&gt;KISS principle&lt;/a&gt;. Such a new protocol would be much more complex than the current mac learning method.&lt;/li&gt;&#xA;&lt;li&gt;as Ron Maupin mentions in his answer, in a network hosts may frequently connect/disconnect or roam (consider your phone connecting to different wifi APs when you walk around, so the LAN switches will see its mac address on different ports all the time), so this could generate a high amount of overhead (in terms of bandwidth used by the protocol, and CPU load on the switches to process the changes).&lt;/li&gt;&#xA;&lt;li&gt;as Ron Maupin also mentions in his answer, unicast flooding happens (much) less than you may think. There are very few network connected devices that do not (or rarely) transmit frames on the network, and as soon as a device transmits a single frame, the switch learns its mac address. I want to add to that that many (most?) OS will send &lt;a href=&quot;https://wiki.wireshark.org/Gratuitous_ARP&quot; rel=&quot;nofollow&quot;&gt;Gratuitous ARP&lt;/a&gt; packets causing the switch to learn the MAC as soon as the link comes up. Also, in the unlikely (but possible) scenario where a device does not transmit any frames, a &lt;em&gt;managed&lt;/em&gt; switch typically offers you the possibility to configure a static entry in the mac-address-table (e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/lanswitch/command/reference/lsw_book/lsw_m1.html#wp1143110&quot; rel=&quot;nofollow&quot;&gt;using mac-address-table static ...&lt;/a&gt; on a Cisco Catalyst switch.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-18T09:03:28.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35012" PostTypeId="1" AcceptedAnswerId="35020" CreationDate="2016-09-18T13:38:15.347" Score="1" ViewCount="1953" Body="&lt;p&gt;So I'm studying networking using the &lt;strong&gt;Head First Networking&lt;/strong&gt; book. I was reading about CAT-5 cable and the RJ-45 connector. The book says that the &lt;em&gt;green&lt;/em&gt; pair receives data and the &lt;em&gt;orange&lt;/em&gt; pair transmits data. It also says that if you want to connect the RJ-45 connector then make sure both the ends of the cable uses same standard &lt;em&gt;i.e.&lt;/em&gt; either 568A or 568B. But then I imagine it should also depend on the devices which use the cable. Like suppose if a device uses 568A and the cable uses 568B (ofcourse on both ends), then won't the purpose of the &lt;em&gt;green&lt;/em&gt; and &lt;em&gt;orange&lt;/em&gt; wire change. Won't the orange then be receiving and the green be transmitting?&lt;/p&gt;&#xA;" OwnerUserId="30588" LastEditorUserId="8499" LastEditDate="2018-03-20T23:17:57.533" LastActivityDate="2018-03-20T23:17:57.533" Title="Does the 568A vs 568B standard affect the transmitting and receiving wires on the CAT-5 cable?" Tags="|layer1|cabling|cable|utp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35013" PostTypeId="1" AcceptedAnswerId="35026" CreationDate="2016-09-18T15:15:44.807" Score="2" ViewCount="119" Body="&lt;p&gt;I have a theoretical question. Imagine we have a person Bob that is hosting a website on IP X and port Y. Bob advertises his website on the TOR network so that nobody can find out his original IP (assuming that the messages cannot be traced of course).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: What would happen if I did a HTTP request to IP X on port Y without using TOR. Would I be able to access the website normally or is there some special encryption / authentication being done to prevent people from outside TOR to access the website?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="22051" LastEditorUserId="8499" LastEditDate="2018-02-16T03:56:31.127" LastActivityDate="2018-02-16T03:56:31.127" Title="Can I access a TOR website without TOR" Tags="|security|" AnswerCount="2" CommentCount="1" ClosedDate="2018-02-16T03:52:44.927" ContentLicense="CC BY-SA 3.0" />
  <row Id="35014" PostTypeId="2" ParentId="35013" CreationDate="2016-09-18T16:27:27.513" Score="0" Body="&lt;p&gt;No. It's bound to localhost. Through Tor your basically connecting to it like a VPN. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;From the configuration window, you’ll need to set the “Server DNS Entry” box to &gt;“localhost” to bind Savant to localhost. This ensures your website is only &gt;accessible from your local computer, so people can’t access it over the normal &gt;Web and see you’re hosting the hidden service Tor site.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.makeuseof.com/tag/create-hidden-service-tor-site-set-anonymous-website-server/&quot; rel=&quot;nofollow&quot;&gt;how to create a tor hidden service&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16612" LastActivityDate="2016-09-18T16:27:27.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35016" PostTypeId="1" AcceptedAnswerId="35021" CreationDate="2016-09-18T16:37:08.640" Score="5" ViewCount="10618" Body="&lt;p&gt;So what exactly is the difference between Frame, Packet and Payload?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen people use these terms interchangeably but what is the actual difference?&lt;/p&gt;&#xA;" OwnerUserId="30589" LastActivityDate="2016-09-18T18:57:56.843" Title="What's the difference between Frame, Packet and Payload?" Tags="|terminology|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35017" PostTypeId="2" ParentId="34185" CreationDate="2016-09-18T16:39:21.623" Score="-1" Body="&lt;h3&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/1801-integrated-services-router-isr/product_data_sheet0900aecd8028a95f.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco 1800 Series Integrated Services Routers Fixed Configuration Models&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The default memory of 32 MB Flash and 128 MB DRAM is sufficient to&#xA;support complex configurations and help ensure operation for an&#xA;extended period. Memory is expandable to support maximum of 128 MB&#xA;Flash and 384 MB DRAM, offering additional investment protection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://www.cisco.com/web/partners/downloads/765/tools/quickreference/routerperformance.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Portable Product Sheets – Routing Performance&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/svMl2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/svMl2.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-09-18T16:39:21.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35018" PostTypeId="2" ParentId="35016" CreationDate="2016-09-18T16:52:50.400" Score="0" Body="&lt;p&gt;A frame is a layer 2 datagram.  A packet is a layer 3 datagram.  A payload is the data being transported by a layer2 and/or layer3 datagram minus any layer2 or layer3 overhead such as bits being used to encapsulate the payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An analogy might be a train where the whole train is a packet, made up of the engine and caboose (hehe I just said caboose).  then there might be one or more train cars being frames.  The payload is the stuff being transported by the train.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;search for osi network layer model for more detail.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-18T16:52:50.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35019" PostTypeId="2" ParentId="35012" CreationDate="2016-09-18T17:03:02.903" Score="0" Body="&lt;p&gt;First, the RJ-45 is not the connector used for networking. Many people call it that, but the real term is 8P8C.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are connecting two devices which are unalike, e.g. host-to-switch, you should use a straight-through cable (both ends are wired the same). It used to be that you had to have a crossover cable to connect two like devices, e.g. switch-to-switch or host-to-host, but most modern devices can auto-adjust, and you can use a straight-through cable to connect them.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-18T17:03:02.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35020" PostTypeId="2" ParentId="35012" CreationDate="2016-09-18T18:41:17.470" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The book says that the green pair receives data and the orange pair transmits data. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This isn't entirely true. The Green pair and the Orange pair provide two separate channels. Data can traverse either wire-pair, so long as data in one direction is traversing one wire-pair, and data in the other direction is traversing on the other wire-pair. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What determines what wire-pair is used comes down to the specification of the Network Interface Card (NIC).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, a picture of the 568a and 568b wiring specifications:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Qjg2O.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qjg2O.png&quot; alt=&quot;Practical Networking .net&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two types of NIC standards, Media Independent Interface (MDI) and Media Independent Interface Crossover (MDI-X).&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A NIC using the MDI standard will Transmit on pin-pair 2 and Receive on pin-pair 3&lt;/li&gt;&#xA;&lt;li&gt;A NIC using the MDI-X standard will Transmit on pin-pair 3 and Receive on pin-pair 2  (the opposite of MDI)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Notice, that &lt;em&gt;both&lt;/em&gt; NIC specification are able to Transmit and Receive on the Green and Orange wire-pair. Remember, the NIC doesn't care what color the wire is, it is simply applying voltage or reading voltage on a particular pin pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way, PCs, Routers, and L3+ devices typically use the MDI specification. And Switches, Hubs, and L2- devices typically use the MDI-X specification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which means when a PC is connected to a switch, the PC's Transmit channel which starts at pin-pair 2 can be connect straight through to a Switch's Receive channel which arrives at pin-pair 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pLs3i.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pLs3i.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, if you had a PC connected directly to another PC (or router, or other L3+ device), you would have to &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/ethernet-wiring/#why_crossover&quot; rel=&quot;nofollow noreferrer&quot;&gt;cross the channels on the wire&lt;/a&gt; so that what the first PC transmits on pin-pair 2 would arrive and be received on the other PC on pin-pair 3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xE4dE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xE4dE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read about that in more depth in &lt;a href=&quot;https://networkengineering.stackexchange.com/a/34446/3675&quot;&gt;this thread&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in the end, remember that the &lt;em&gt;device&lt;/em&gt; does &lt;em&gt;NOT&lt;/em&gt; use T568b or T568a, the &lt;em&gt;device&lt;/em&gt; simply transmits or receives on pin-pair 2 or 3 depending on whether the NIC is subscribing to the MDI or MDI-X specification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;wire&lt;/em&gt; in between the two devices has two termination points (two ends), and those ends have 8 wires, grouped into 4 pairs, and are placed in an order that is governed by T568a or T568b -- hopefully to properly introduce a crossing of the pairs on the wire (crossover cable) or to ensure there is no crossing of the pairs on the wire (straight through cable). &lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-10-03T14:47:33.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35021" PostTypeId="2" ParentId="35016" CreationDate="2016-09-18T18:48:49.700" Score="6" Body="&lt;p&gt;A &lt;strong&gt;Frame&lt;/strong&gt; is a combination of the L2 header and the Data being carried&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;Packet&lt;/strong&gt; is a combination of the L3 header and the Data being carried.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In either case, the &lt;em&gt;Data being carried&lt;/em&gt; is the &lt;em&gt;payload&lt;/em&gt; of the Frame/Packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This animation will help illustrate the differences:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Y6OBY.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y6OBY.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;sup&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/osi-model/&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;source&lt;/em&gt;&lt;/a&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At any point in the animation, the &lt;code&gt;DATA&lt;/code&gt; is the Payload for the respective layer (Segment, Packet, Frame).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within the Payload of the Segment is the application data put together by the application layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within the Payload of the Packet is the L4 header (TCP, in the animation's case), as well as the application data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within the Payload of the Frame is the L3 header (IP, in the animation's case), the L4 header (TCP), as well as the application data&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-09-18T18:48:49.700" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35022" PostTypeId="2" ParentId="35016" CreationDate="2016-09-18T18:57:56.843" Score="1" Body="&lt;p&gt;The term &quot;frame&quot; is used when referring to communications between the Media Access Control (MAC) layer header and trailer. Communications between devices use frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &quot;packet&quot; is contained within the frame. For TCP/IP, this would include the TCP header information thru the MAC trailer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;payload&quot; is the data area of the frame, which contains the information that is being sent or received. Size of the payload can invoke packet fragmentation, which splits the packets into several smaller and more manageable packets.&lt;/p&gt;&#xA;" OwnerUserId="30591" LastActivityDate="2016-09-18T18:57:56.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35023" PostTypeId="1" CreationDate="2016-09-18T19:06:16.043" Score="1" ViewCount="2689" Body="&lt;p&gt;My question is: if a switch can only have one global default-gateway, does that mean that he can be managed remotely (out side of the LAN) by only one interface VLAN IP address, and if so, why isn't there a default-gateway in every VLAN interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it isn't a very technical question, but if someone could explain it, it would help me clear things up in my head.&lt;/p&gt;&#xA;" OwnerUserId="30250" LastEditorUserId="8499" LastEditDate="2016-09-18T19:18:58.167" LastActivityDate="2017-03-18T01:04:29.380" Title="Layer-2 switch global default-gateway" Tags="|switch|vlan|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35024" PostTypeId="2" ParentId="34672" CreationDate="2016-09-18T19:06:44.293" Score="1" Body="&lt;p&gt;You can do DHCP and Routing from vlan to vlan with an ASA5516. It's a little more complex with the rules and it doesn't do sub-interfaces like router on a stick. It's more like an SVI (switched virtual interface) of a layer 3 switch. An SVI is a fancy way of saying create a vlan, set the ip address of that vlan interface on the ASA or switch and use it as the gateway. Traffic is seperated on each port by vlan tags similar to the sub-interface idea (on a router the encapsulation dot1q command on a sub-interface is identifying the vlan tag to look for).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This below is beyond answering your question and I apologize if I'm butting in. Just trying to offer some advice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you plan to get an ASA5516 with firepower do your research. Its a complex venture. I just installed one for a school with 1500 people. Each feature requires a license/subscription. You'll need anyconnect vpn licenses if you want more than the 2 it comes with. If you want historical data you MUST have a VMWARE esxi server to load the Cisco created VM. No other virtual environment works. (Some have manipulated virtual box but I don't trust that in production personally). You use seperate rules to direct traffic to the firepower module. It's a VERY expensive and complex device for a 75 person business. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i may make a suggestion, I personally suggest put some money into a router or a decent layer 3 switch to take the load off the sonic wall to start. An HP2930 (labeled Aruba now) may even do the job (no cisco routing protocols but most small business are static routes anyway). It extremely easy to program. I think the Cisco 2960x switch is now offering similar routing as well (you could check) Let the sonic wall manage in and out traffic only. For the money of that ASA you could put a layer 3 switch and route at each closet (and then buy a used car...lol) but it sounds like that's not necessary with 75 users and under 250 devices (I'm guessing). One layer 3 device should suffice. It would be your mixed core and distribution layer. You would plug your servers, wifi controller, phone system, etc... in it if you can. Your backbone devices basically. It would be a good start. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not always brand partial but for non-network engineer types or I.T. folks that don't have the opportunity to get good with cmd line because they are so busy now days, the HPs enterprise grade procurve switches have a Web gui that's hard to beat. The 2920s now called 2930s have proven themselves in my opinion very well especially for the price. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit... I also agree with the comment above. If you can move dhcp to a windows server that will give you more control and more insight. If your AD server isn't a dedicated AD server you may run it from there. If you have an inside DNS server that could be a good place as well since your network ip helpers go there already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fixitrod&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://h17007.www1.hpe.com/us/en/networking/products/switches/switch-selector.aspx&quot; rel=&quot;nofollow&quot;&gt;HP Switch Selector&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www8.hp.com/us/en/products/networking-switches/product-detail.html?oid=1008995294&quot; rel=&quot;nofollow&quot;&gt;HP Aruba 2930f switch Datasheet&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30235" LastEditorUserId="30235" LastEditDate="2016-09-18T19:11:56.823" LastActivityDate="2016-09-18T19:11:56.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35025" PostTypeId="2" ParentId="35023" CreationDate="2016-09-18T19:17:05.117" Score="2" Body="&lt;p&gt;A switch only needs a single management address. That address is like a host connected to a VLAN (most hosts only have one address), and that host needs an address and a default gateway. Why would you think this host needs multiple addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We live in a layer-3 world, and you should be able to get to the switch management address from any network which you allow in your router(s) (all by default). Yes, you must go through a router to get to the switch management address if you are starting from a different network, but that doesn't really matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also place ACLs between networks in your router(s) to restrict access between VLANs. This lets you create a management VLAN for your network infrastructure devices, like switches, WAPs, etc., and you can restrict access to this VLAN to certain people. Security should be layered: first restrict any access to the management of the devices, then use AAA to manage the devices.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-18T19:17:05.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35026" PostTypeId="2" ParentId="35013" CreationDate="2016-09-18T19:57:07.380" Score="2" Body="&lt;p&gt;This all had to do with how well the person running the site has it secured. Generally you would want to run a site bind only to localhost.  The environment should firewall it from making outbound or inbound connections except over tor.  This is to mitigate any kind of attacks either network or application level - if the server is compromised it shouldn't be able to be dialed directly or dial home directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this is only to protect the server, and does not necessarily keep the client unknown and secure. There are plenty of gateway services like &lt;a href=&quot;http://onion.to&quot; rel=&quot;nofollow&quot;&gt;http://onion.to&lt;/a&gt; available to let a  layperson use tor sites. much of today's ransomware depends on such services.&lt;/p&gt;&#xA;" OwnerUserId="657" LastEditorUserId="657" LastEditDate="2016-09-18T21:25:09.817" LastActivityDate="2016-09-18T21:25:09.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35029" PostTypeId="2" ParentId="35023" CreationDate="2016-09-18T20:47:00.747" Score="1" Body="&lt;p&gt;A layer 2 switch doesn't use the global gateway for routing any traffic. It's only used when you use the switch to ping something or telnet into it, things like that. Since it's layer two it doesn't really care about ip addresses in the routing since. The ip address of the switch, subnet and global gateway are just like your computers address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With traffic fromm other devices it uses the arp request and Mac address table. A computers requests it's own gateway if it tries to talk out side of its own subnet. The layer 2 switch doesn't do any of that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as multiple vlans talking to the switches ip addresses, it works just like your computer. You can use diffrent subnets to get to diffrent subnets if there is a router. If you do not have a router I found that only vlan 1 works switch to switches with a 2950. Switches that let you change the management vlan can choose which vlan is that &quot;primary&quot; usable network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This question did intrigue me and I thought it might help others to do some tests and show the results so I came to the above conclusion by testing it. I took my virtual setup and tested this because I had more than one way it could work in mind. My findings were a little diffrent than I expected when no router is used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test 1 I used two older Cisco 2950s. I set up vlan 1 and vlan two. I set vlan 1 192.168.10.1 and 10.2 on second switch. I set vlan 2 192.168.20.1 and 20.2. I plugged a pc into a vlan 1 and 2 port on each switch so the vlans would go up up on both switches. I tried this experiment with a single trunk cable between them and also tried with two cables on access ports. One cable carried vlan 1 and one cable carried vlan 2. Results were the same either way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result 1.. from the switch I could ping both of &quot;my&quot; addresses. I could ping the remote vlan 1 address but not vlan 2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test 2  With the same setup I thought if I set a global gateway address of 192.168.20.50 it would force vlan 2 to be the usable subnet. Remember, I do not actually have a router in this test. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result 2. The switch still pinged vlan 1 local and remote. It did not ping the remote vlan 2. So, by putting a global gateway as vlan 2 it did not change how the switch reacted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test 3 I introduced a router and 3 subnets. I had 192.160.10.50, 20.50 and 30.50. On the switch I connected to I had 192.168.10.1, 20.1, 20.2. Global gateway was not set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result 3 From the switch I could ping all 3 router address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test 4 I disabled vlan interface 3 on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result 4 I could no longer ping 192.168.30.50 on the switch since it didn't have a directly connected interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test 5 I disabled vlan 1 to see if vlan 2 could still ping with no vlan 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result 5 Ping on vlan two to 192.168.20.50 worked fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Test 6 I enabled vlan 1 and added a default gateway of 192.168.20.50 (vlan 2s gateway) I left interface vlan 3 disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result 6 The switches was able to ping 193.168.30.50 ( a subnet not currently up on the switch) with no issue. Even though the default gateway was on vlan 2s address I can still ping any viable address the router can get too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's enough for now. If you get a chance to get the network simulator packet tracer it's great for testing things. Some people share it on www.4shared.com packet tracer 6.1 you get it free when going to a Cisco class.&lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-18T20:47:00.747" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35031" PostTypeId="2" ParentId="35023" CreationDate="2016-09-18T22:39:25.020" Score="0" Body="&lt;p&gt;If a switch has 3 subnets and the global gateway points to a router that has routes to all 3 subnets from whatever network your management computer is on then you can manage the switch with any of the addresses on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason is when you point to the gateway with that one address the router will look at the data and route it properly, as long as it has an interface with the proper subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think i understand why your asking thing. If a computer had a gateway address from a diffrent subnet it wouldn't work. &lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-18T22:39:25.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35032" PostTypeId="2" ParentId="35012" CreationDate="2016-09-18T22:43:08.727" Score="0" Body="&lt;p&gt;Transmit on one end is receive on the other. You can't really call one color transmit and the other receive. I think that's what your asking. &lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-18T22:43:08.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35033" PostTypeId="2" ParentId="34978" CreationDate="2016-09-18T22:53:58.397" Score="1" Body="&lt;p&gt;If your home wap has vlan capability you can create two SSID's. Assign each SSID to a vlan. Then, assign ACLS (access control lists) to allow them to get to the Internet but block them from your addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some home WAPs also have guest mode and features that don't let computers talk to other computers on the same network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To add... you can get a robust firmware for alot of home style WAPS like &lt;a href=&quot;http://www.dd-wrt.com/site/index&quot; rel=&quot;nofollow&quot;&gt;these --&gt; click&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-18T22:53:58.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35034" PostTypeId="2" ParentId="34972" CreationDate="2016-09-18T23:38:54.853" Score="0" Body="&lt;p&gt;You should have radio .1 and vlan 1 in bridge-group 1. Build bridge-group 2 and put the radio.300 and sub interface for vlan 300 in it. Here's a document on [bridge-groups][&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See if that helps. Otherwise start with the basics. Channel overlap, power levels are the first step (rf or physical layer of wifi).&lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2016-09-18T23:38:54.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35035" PostTypeId="2" ParentId="34961" CreationDate="2016-09-18T23:59:01.513" Score="1" Body="&lt;p&gt;If you are the computer that is the receiver of the traffic you want too capture (which is what it sounds like you are) maybe its there and a proper filter will help. I've read that GVSP can show as UDP. Here are some wireshark filters for GVSP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.wireshark.org/docs/dfref/g/gvsp.html&quot; rel=&quot;nofollow&quot;&gt;GVSP Wireshark filters&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you know your setup correctly first make sure firewalls are off. There may be Features on your nic that need changed.  In windows you can go under device manager, networking devices and right click your nic. Go to properties and see what features are enabled or disabled. A common one that needs disabled is TCP Chimney that blocks winpcap after handshakes. &#xA;&lt;a href=&quot;https://wiki.wireshark.org/CaptureSetup/Offloading#TCP_Chimney&quot; rel=&quot;nofollow&quot;&gt;Refrence is here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can run this to turn it off under a command prompt/terminal window.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;netsh int ip set chimney disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30235" LastEditorUserId="30235" LastEditDate="2016-09-19T00:13:19.747" LastActivityDate="2016-09-19T00:13:19.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35038" PostTypeId="1" AcceptedAnswerId="35039" CreationDate="2016-09-19T01:29:58.553" Score="2" ViewCount="8237" Body="&lt;p&gt;I have a network with 2 routers.&#xA;Router 0 is a DHCP server and Router 1 I assume should be a relay agent. The routing protocol I use is EIGRP.&lt;/p&gt;&#xA;&lt;p&gt;The problem is that PC in vlan 15 and vlan 20 cannot get the ip addresses from the dhcp server. I found out that we can configure ip-helper on the switch but it didn't work either. sh ip route command shows that it can see all networks. I have configured dhcp pools for vlans 15 and 20.&lt;/p&gt;&#xA;&lt;p&gt;I think I missed some information about vlans or something. Can somebody point me where the problem is?&lt;/p&gt;&#xA;&lt;p&gt;Here is my topology:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GT9hg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GT9hg.png&quot; alt=&quot;Network Topology&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here are some of the configurations that I've used in my topology:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Switch0&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;en &#xA;conf t&#xA;int fa 0/1&#xA;switchport access vlan 5&#xA;!&#xA;int fa 0/2&#xA;switchport access vlan 10&#xA;!&#xA;int gig 0/1&#xA;switchport mode trunk&#xA;!&#xA;int range fa 0/3 - 24&#xA;switchport access vlan 99&#xA;!&#xA;int gig 0/2 &#xA;switchport access vlan 99&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Router&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;en&#xA;conf t&#xA;int gig 0/1&#xA;no shut&#xA;!&#xA;int gig 0/1.5&#xA;encapsulation dot1q 5 &#xA;ip address 195.165.85.62 255.255.255.224&#xA;!&#xA;int gig 0/1.10&#xA;encapsulation dot1q 10&#xA;ip address 195.165.85.94 255.255.255.224&#xA;!&#xA;exit&#xA;!&#xA;ip dhcp pool vlan5&#xA;network 195.165.85.32 255.255.255.224&#xA;default-router 195.165.85.62&#xA;!&#xA;ip dhcp pool vlan10&#xA;network 195.165.85.64 255.255.255.224&#xA;default-router 195.165.85.94&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;Router 1 'show-running config'&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA;ip address 195.165.85.30 255.255.255.252&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA;no ip address&#xA;ip helper-address 195.165.85.29&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface GigabitEthernet0/1.15&#xA;encapsulation dot1Q 15&#xA;ip address 195.165.85.126 255.255.255.224&#xA;!&#xA;interface GigabitEthernet0/1.20&#xA;encapsulation dot1Q 20&#xA;ip address 195.165.85.158 255.255.255.224&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30597" LastEditorUserId="74491" LastEditDate="2021-03-17T07:26:48.427" LastActivityDate="2021-03-17T07:27:54.160" Title="How to configure DHCP Relay Agent with multiple VLANs?" Tags="|cisco|vlan|dhcp|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="35039" PostTypeId="2" ParentId="35038" CreationDate="2016-09-19T01:41:36.950" Score="2" Body="&lt;p&gt;Configuring a DHCP relay on Cisco routers is pretty simple. You use the &lt;code&gt;ip helper-address &amp;lt;DHCP server address&amp;gt;&lt;/code&gt; command on the layer-3 interface. The address for the helper address must be reachable from the router on which the helper address is configured, e.g. the Router0 interface toward Router1.&lt;/p&gt;&#xA;&lt;p&gt;You are putting the helper address on the physical interface for which there are no VLANs. You need to put the helper address on the individual subinterfaces (each subinterface could use a different DHCP server).&lt;/p&gt;&#xA;&lt;p&gt;Your DHCP server must have a scope for each of the networks for which it is the DHCP server.&lt;/p&gt;&#xA;&lt;p&gt;By the way, never use a picture for text in your question. Just copy the text and paste it into your question, highlight the text, and use the Pre-formatted Text button: &lt;code&gt;{}&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Your Router0 needs scopes for VLANs 15 and 20:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool vlan15&#xA; network 195.165.85.96 255.255.255.224&#xA; default-router 195.165.85.126&#xA;&#xA;ip dhcp pool vlan20&#xA; network 195.165.85.128 255.255.255.224&#xA; default-router 195.165.85.158&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Router1 needs helper addresses on the interfaces:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1.15&#xA; encapsulation dot1Q 15&#xA; ip address 195.165.85.126 255.255.255.224&#xA; ip helper-address 195.165.85.29&#xA;&#xA;interface GigabitEthernet0/1.20&#xA; encapsulation dot1Q 20&#xA; ip address 195.165.85.158 255.255.255.224&#xA; ip helper-address 195.165.85.29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;You also need to make sure that Router0 can ping the G0/1.15 and G0/1.20 interfaces in Router1.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="74491" LastEditDate="2021-03-17T07:27:54.160" LastActivityDate="2021-03-17T07:27:54.160" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="35046" PostTypeId="1" CreationDate="2016-09-19T14:07:42.630" Score="0" ViewCount="124" Body="&lt;p&gt;I'm trying to bridge 2 networks&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;one using SonicWall NSA240 (192.168.100.1)&lt;/li&gt;&#xA;&lt;li&gt;one using Cisco 1940 (192.168.129.1)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Both are working as DHCP servers on their networks.&#xA;I want to access machines on the 129-network from the 100-network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I plugged the 129-network into X4 on the Sonic Wall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;X4 interface is configured with a static IP (192.168.129.29) and I added a route:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;source: X0 subnet (lan)&#xA;destination: X4 subnet (192.168.129.0/255.255.255.0)&#xA;service: any&#xA;gateway: what should I use here? 192.168.129.1 (which is the cisco address)?&#xA;interface: X3&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't work, I can't ping any 129 adresses from the 100-network. What did I miss?&lt;/p&gt;&#xA;" OwnerUserId="30470" LastActivityDate="2017-06-16T17:59:03.980" Title="sonic wall - bridge 2 lans" Tags="|cisco|sonicwall|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35048" PostTypeId="2" ParentId="35046" CreationDate="2016-09-19T14:14:54.353" Score="2" Body="&lt;p&gt;You should not need to add a route on the Sonicwall, as it already has a connected route when you give it an ip address in that subnet. (Edit: well maybe you do, I have no idea how a Sonicwall works but generically speaking if it acts as a router, you shouldn't).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you do need is to make sure that the 192.168.129.x network can reach the 192.168.100.x network. So you should either:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;add a static route on each host in 192.168.129.x, for 192.168.100.0/24 with 192.168.129.29 as next-hop&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;add a static route on the cisco, for 192.168.100.0/24 with 192.168.129.29 as next-hop&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;reconfigure your dhcp to give out 192.168.129.29 as default gateway (but then obviously all Internet access will go through the Sonicwall as well so you no longer use the Cisco).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Edit: And as Ron pointed out, you mis-used the term 'bridging', you connected the 2 LANs using a firewall/router, so you are routing between them, you'r not bridging them.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-19T14:14:54.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35049" PostTypeId="1" AcceptedAnswerId="35052" CreationDate="2016-09-19T15:47:30.850" Score="2" ViewCount="1355" Body="&lt;p&gt;Dataflows on the internet are often depicted as going from one host via at least two border routers to another host. In these illustrations, the hosts are equipped with and make use of the full internet protocol stack, while the routers are just depicted as having and using the networking protocols and IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am not mistaken, BGP is an application layer protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am wondering how the BGP communication happens between routers if they just access part of or even just have part of the protocol stack?&lt;/p&gt;&#xA;" OwnerUserId="30613" LastEditorUserId="2142" LastEditDate="2016-09-19T17:38:49.800" LastActivityDate="2016-09-19T17:38:49.800" Title="Which layers of the protocol stack does a border router access for which purpose?" Tags="|routing|ip|bgp|osi|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35051" PostTypeId="2" ParentId="35049" CreationDate="2016-09-19T15:54:44.893" Score="-1" Body="&lt;p&gt;BGP is a routing protocol which should be under Network Layer (if you're using OSI model) or Internet Layer (if you're using TCP/IP model). It is not an appication layer protocol.&lt;/p&gt;&#xA;" OwnerUserId="30293" LastActivityDate="2016-09-19T15:54:44.893" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35052" PostTypeId="2" ParentId="35049" CreationDate="2016-09-19T16:18:22.817" Score="1" Body="&lt;p&gt;There is a lot of confusion regarding what part of the OSI model is in use here.  Let me see if I can help:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that the OSI model is just a model.  It doesn't represent anything in actual use.  The TCP/IP model is a better fit for protocols in use on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The statement &quot;routers are just depicted as having and using the networking protocols and IP&quot; is an oversimplification -- and that's where some of the confusion comes from.  Router software has the full stack in order to run routing protocols like BGP as well as management functions (telnet, SSH, snmp, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is BGP a network protocol or an application protocol?  The BGP process that runs on a router  talks to BGP processes on other routers.  BGP makes use of TCP/IP to facilitate that communication.  It establishes sessions between peers and has its own messaging format and syntax.  In that sense, BGP is an application that runs on a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP's purpose is to populate the forwarding table of the router.  When the router makes a forwarding decision for an IP packet, it looks in the table for the next hop address, adds the layer 2 header, and transmits it out an interface.  That process only involves layers 1-3.  So if you're talking about how routers route, that's all you need to discuss -- and that's probably where the confusion comes from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In summary, the forwarding of packets involves layers 1-3.  the information used to forward packets comes from many sources -- one of which could be the BGP application running on the router.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-19T16:18:22.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35057" PostTypeId="1" AcceptedAnswerId="35058" CreationDate="2016-09-19T18:29:33.167" Score="1" ViewCount="753" Body="&lt;p&gt;I have a very basic question. How does a switch port learn a MAC address? In this scenario say a host is not trying to communicate with any one. It is just plugged in the switch port. Does the host send its MAC address to the switch port, or does the switch pull the MAC address information to the switch port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My case is, a client plugs into a switch port, but no MAC address is being learned in the switch port. What could be the possible reason?&lt;/p&gt;&#xA;" OwnerUserId="25763" LastEditorUserId="8499" LastEditDate="2018-03-09T22:54:09.050" LastActivityDate="2018-03-09T22:54:09.050" Title="How does a switchport learn a MAC address" Tags="|switch|switching|mac-address|switchport|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35058" PostTypeId="2" ParentId="35057" CreationDate="2016-09-19T18:34:45.700" Score="6" Body="&lt;p&gt;A switch will learn a MAC address as soon as a frame enters the switch. It looks at the source address on the frame and adds to, or updates, its MAC address table with the interface where the frame entered the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you connect a host to a switch port, and the host sends no frames, the switch will not learn the host's MAC address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-19T18:34:45.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35059" PostTypeId="2" ParentId="32441" CreationDate="2016-09-19T18:37:01.073" Score="2" Body="&lt;p&gt;I found the issue, it has to do with the device itself, specifically an Meraki MR42 AP. When the 802.03at Meraki APs first powers up, it does so in 802.03af mode, thus limiting the power it can draw. Then later in the boot sequence it tries to request more power to be delivered, and for some reason the HP switches does not understand to give it the full 33 watts it needs. The solution is to force the port to allocate power based on a configured value instead of what's negotiated over LLDP. The Meraki documentation shows you how to do it through the GUI, which in my book isn't that useful. Instead, the following commands does the exact thing but for several ports at once.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface [port_range] poe-value 33&#xA;interface [port_range] poe-allocate-by value&#xA;interface [port_range] power-over-ethernet critical&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first command sets the &quot;value&quot; for the port to 33W, maximum under the IEEE 802.03at standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second command forces the port to forget about LLDP and just give the device connected to the port whatever it chooses to consume, instead of limiting it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third command is probably not necessary, all it should do is to list the port as &quot;critical&quot;, aka. tell the switch to shut something else down if it experiences shortage of available PoE power, but I left it in as Cisco Meraki specifically listed it in their fix. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most amusing thing is that the APs doesn't actually draw any more power after this, at least when they are on standby with no connected clients, but they probably operate better at higher loads, and you get rid of that annoying error in the Meraki dashboard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://documentation.meraki.com/MR/Monitoring_and_Reporting/MR34_Operates_in_Low_Power_Mode_on_HP_ProCurve_Switch&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://documentation.meraki.com/MR/Monitoring_and_Reporting/MR34_Operates_in_Low_Power_Mode_on_HP_ProCurve_Switch&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22463" LastEditorUserId="22463" LastEditDate="2020-04-17T11:28:37.387" LastActivityDate="2020-04-17T11:28:37.387" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="35061" PostTypeId="1" AcceptedAnswerId="35062" CreationDate="2016-09-19T19:23:53.050" Score="2" ViewCount="12332" Body="&lt;p&gt;i am trying to configure the switch to have both telnet and ssh. &lt;br /&gt; from what i understand the &quot;login local&quot; command will tell the switch to ask for the user name and password i've configured using &lt;/p&gt;&#xA;&#xA;&lt;p&gt;username {name} secret {password}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;from what i've learned about vty if no password is configured in (config-line)#&#xA;mode (in vty) &lt;br /&gt;i will get an error &lt;/p&gt;&#xA;&#xA;&lt;p&gt;so my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;will i get an error if i am using  &quot;login local&quot; + username &amp;amp; secret &lt;b&gt; without a configured vty password&lt;/b&gt;?&lt;/li&gt;&#xA;&lt;li&gt;assuming i've set vty to &quot;login local&quot;, i've given it a vty line password and&#xA;i gave the switch a username &amp;amp; secret with &quot;&lt;i&gt; username {name} secret {password} &lt;/i&gt; &quot; when i &lt;b&gt;telnet&lt;/b&gt; will it ask me for the vty line password or the username &amp;amp; secret?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;so basiclly the subject is &quot;does the login local command in the vty lines set all (in telnet and ssh) login requirments to be the username &amp;amp; secret and if so do i need to  give the vty line a password in order for it to work.&lt;/p&gt;&#xA;" OwnerUserId="30250" LastActivityDate="2021-02-10T14:10:00.903" Title="is a vty password requierd if i have login local set with a username and a password" Tags="|cisco|switch|ssh|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35062" PostTypeId="2" ParentId="35061" CreationDate="2016-09-19T20:42:08.617" Score="1" Body="&lt;pre&gt;&lt;code&gt;line vty 0 4&#xA;  login&#xA;  password vtypw&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;login&lt;/code&gt; command tells the Router to authenticate all incoming virtual terminal sessions (telnet, ssh, etc) via the password set &lt;em&gt;within&lt;/em&gt; &lt;code&gt;line vty 0 4&lt;/code&gt;. In the case above, it means use &lt;code&gt;vtypw&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username teddy password teddybear&#xA;&#xA;line vty 0 4&#xA;  login local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;login local&lt;/code&gt; command tells the Router to authenticate all incoming virtual terminal sessions via the local username database -- aka, users created using the &lt;code&gt;username XXX password YYY&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &lt;code&gt;login local&lt;/code&gt; skips the checking and validating against the VTY password set within &lt;code&gt;line vty 0 4&lt;/code&gt;.  Therefore, &lt;strong&gt;you do &lt;em&gt;not&lt;/em&gt; need a &lt;code&gt;password&lt;/code&gt; within &lt;code&gt;line vty 0 4&lt;/code&gt; if you have &lt;code&gt;login local&lt;/code&gt; set&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;will i get an error if i am using &quot;login local&quot; + username &amp;amp; secret without a configured vty password?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, no errors. I just tested it in GNS3.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;assuming i've set vty to &quot;login local&quot;, i've given it a vty line password and i gave the switch a username &amp;amp; secret with &quot; username {name} secret {password} &quot; when i telnet will it ask me for the vty line password or the username &amp;amp; secret?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It will ask you for a username and expect the one from the local username database. Using the vty line password will not allow you access to the device.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-09-19T20:42:08.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35064" PostTypeId="1" AcceptedAnswerId="36111" CreationDate="2016-09-19T21:24:09.603" Score="1" ViewCount="513" Body="&lt;p&gt;I have a really weird issue with a certain model of Cisco switches. The industrial IE2000 models come with a SD card slot, which can be used to store the configuration or boot from. I had 5 of these switches to commission and they are in a quite industrial setting so I figured I'd configure one of them at my desk, copy the config to the SD card, swap the SD card and do the changes needed for the next switch and swap the SD card, etc. etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did exactly that, resulting in 5 SD cards with identical configurations except for the hostname and IP addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I went to install the SD cards and copying the config from SD-card to the onboard flash, everything worked just as expected, except the SFP ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ports all complained about Low TX Power Alarm (they were fitted with GLC-FE-100LX modules), and correctly, the TX power was low on every fiber port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I couldn't find anything wrong with the config or the modules, so I did a factory reset, and typed in the config manually this time. And then it worked. Every single time, in 5 identical switches with almost identical configs. I even compared the config I had on the SD cards to the one I typed in, and I can't find a single difference between them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anybody else ever seen anything like this? Is there some command that has to be issued to make the fiber modules actually send signal out? Or some command that disables that? The modules could detect signal coming from the far end switch, and I verified the measurements in the switch with an optical power meter. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-10-27T04:40:22.130" Title="Cisco - Configuration disabling TX on SFP port?" Tags="|cisco|cisco-ios|cisco-commands|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35071" PostTypeId="2" ParentId="34219" CreationDate="2016-09-20T04:36:56.670" Score="1" Body="&lt;p&gt;Frame check sequence errors, and packets which if your MTU is at the standard of 1514 when using the standard for ethernet on Cisco equipment are missing pieces of them. As mentioned above it is usually due to a layer one physical error. Do you get them on any other devices connected to this device? do you only get them on gi 0/13? check the cable, and do a check on the port itself. Check for duplex mismatch on the port, do a hardware diag on the actual port and trace out the physical path of where the error is and where it terminates to see if it repeats itself....if no errors are present elsewhere, it points to duplex mismatch or bad cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seeing as you have a L1 switch connected to it, that could very well be a duplex issue. check the other side of the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck in your hunt!&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-20T04:36:56.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35072" PostTypeId="2" ParentId="35057" CreationDate="2016-09-20T05:01:50.907" Score="2" Body="&lt;p&gt;The switch learns MAC entries when frames enter through the various interfaces. When making decisions on where the frame goes when the switch receives future frames it refers to the CAM table to do so, when it looks at the table and sees a mac entry matching a port, it then forwards the frames out of that port.If no entry is found a multicast packet or FF-FF-FF-FF is sent out basically saying, I do not know where this MAC address resides, this packet is forwarded out of all interfaces except the receiving port. When a response is received it records this data along with the data of which port it received it on. This data is then entered into the CAM table for future use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps!&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-20T05:01:50.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35073" PostTypeId="2" ParentId="9811" CreationDate="2016-09-20T05:07:16.000" Score="1" Body="&lt;p&gt;MAC addresses are used in layer 2 and layer 3 of the OSI model in order to assist with frame and packet forwarding. First the MAC address is received showing where it needs to go and the layer 3 IP address. This is done at the Frame and IP layer. Once the frame MAC is accounted for and the layer 3 IP is located the layer 3 device forwards the frame to the appropriate IP address which will continue the process if routes exist and the layer 3 protocol is correct. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best,&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-20T05:07:16.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35074" PostTypeId="2" ParentId="35001" CreationDate="2016-09-20T05:21:24.693" Score="0" Body="&lt;p&gt;I would either use:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A. Dot1X MAC authentication to allow them out to the specific resources.&#xA;b. A network object created on the ASA which included the IP addresses statically assigned or given reservations through a dhcp pool and the desired port numbers along with the direction of travel.&#xA;c. A NAT rule making one IP from many (PAT) inserting the dynamic or static IP addresses into one NAT pool and then using this IP address to allow access on port 80 and 443 to the internet.Lastly specify the direction of the rule, inside to outside is what you are looking for in this situation from what I'm reading.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the link to a very good and descriptive articleon Cisco's site involving PAT (port address translation and NAT). It just depends how you want it set, but you have many options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/118996-config-asa-00.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/118996-config-asa-00.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best,&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-20T05:21:24.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35075" PostTypeId="1" AcceptedAnswerId="35077" CreationDate="2016-09-20T05:27:57.483" Score="1" ViewCount="303" Body="&lt;p&gt;What is the default speed of a Fast Ethernet Interface of Cisco 2900 Switch that was just reset to default settings using write erase?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm asking because my Wireshark capture of ARP packets gives a much reduced speed of 1914 KB.&lt;/p&gt;&#xA;" OwnerUserId="30265" LastEditorUserId="8499" LastEditDate="2016-09-20T05:48:29.183" LastActivityDate="2016-09-20T05:50:22.183" Title="Cisco 2900 Default Fast Ethernet Port Speed" Tags="|cisco|switch|wireshark|speed|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35076" PostTypeId="2" ParentId="25604" CreationDate="2016-09-20T05:37:47.423" Score="0" Body="&lt;p&gt;Using the DHCP server or known bindings you can find it, I have done this in Windows server before, it is not common but it is possible. ARP is locally based and just a binding between an IP and MAC address tying them together to facilitate traffic flow past the boundaries of layer 3 network boundaries.....This is where routers come in. MAC addresses are only important getting the frame/packet to the router, at that point it is then forwarded again based on the MAC/IP combination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ANgry IP scanner would tell you, and you could locally perform an arp -a...routers use this to map MAC addresses when they are not known at a layer three boundary in order to assist with route forwarding for packets. this information is then stored in the arp cache of the device.MAC addresses exist per LAN, routers connect LAN boundaries at layer 3, hence tying the two together.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-20T05:37:47.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35077" PostTypeId="2" ParentId="35075" CreationDate="2016-09-20T05:43:44.083" Score="3" Body="&lt;p&gt;The default speed and duplex of a Cisco 29xx fast ethernet switch interface which was reset to default settings would be Auto.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP frames are really no way to measure an interface speed. An ARP request receives an ARP reply. You cannot measure the interface speed from that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One problem could be that one side of the link is set to Auto, but the other side is set to a fixed speed and/or duplex. That will cause serious problems on the link, and it could look like your link speed is very slow. You will get a lot of interface errors and that will cause re-transmissions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See this &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/17053-46.html#auto_neg_valid&quot; rel=&quot;nofollow&quot;&gt;Cisco table&lt;/a&gt; for the combinations which can cause duplex mismatches.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-20T05:43:44.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35078" PostTypeId="2" ParentId="19856" CreationDate="2016-09-20T05:44:16.437" Score="0" Body="&lt;p&gt;Simple explanation those pings are being sent through multicast which is FF-FF-FF-FF in your first scenario. the router doesn't always know the mac to IP mapping and sends out a gratuitous arp...when it receives a response it isnt going to tell you about every multicast host that received the message and dropped it or didnt reply because it didnt match When you ping a single host you are getting a single MAC to IP binding and it can be filed in an ARP table.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-20T05:44:16.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35079" PostTypeId="2" ParentId="35075" CreationDate="2016-09-20T05:50:22.183" Score="0" Body="&lt;p&gt;Speed is set to auto when out of the box, If I recall correctly Those you generally get a combination of 24 or 48 10/100/1000 ports along with either one or two 1 GB or 10 GB SFP slots which I would use ass trunk ports. &#xA;Those are the &quot;max speeds hardware rating wise&quot; as far as the bandwidth you pass through interfaces....that has a lot of  factors including network environment number of hosts, protocol, bandwidth of the links connecting the ports with downstream and upstream devices....you get the point. Hardware ratings are one thing true throughout another. &lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-20T05:50:22.183" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35081" PostTypeId="2" ParentId="3116" CreationDate="2016-09-20T06:24:45.480" Score="0" Body="&lt;p&gt;Is  port 24 a trunk or acccess port? General protocol is to use 24 as the trunk link on a 24 port switch and allow all or any necessary vlans to traverse the link. This in itself would create multiple mac address entries. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should prove your theory that i=this is a false positive...do a show cdp neighbors....or lldp neighbor then see what the the output is, it might just be different.Also show interface trunk on gi 0/24 , or show interfaces switchport which is going to tell you a lot more data such as the vlans in use on the ports in question.&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-20T06:24:45.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35082" PostTypeId="2" ParentId="34974" CreationDate="2016-09-20T06:38:24.997" Score="3" Body="&lt;p&gt;Any time I have have configured a link such as this in smaller networks using these two pieces of equipment I trunk the link that is the fiber link containing the SFP on both ends, define encapsulation and native vlans and then define allowed vlans on the trunk. I know iit isnt always a standard, it depends on what IOS version and platform etc...but I also define no negotiate on the trunk port to avoid encapsulation issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This shouldnt be a problem with a 2960 though I believe they only are capable of dot1Q.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best,&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-09-20T06:38:24.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35085" PostTypeId="1" CreationDate="2016-09-20T09:52:38.427" Score="1" ViewCount="4031" Body="&lt;p&gt;Any bullet points that are most imp points when it comes differences between these three tunnellings VXLAN/NVGRE/GENEVE in networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Found some notes here, anything that you may like to add would be great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msandbu.wordpress.com/2015/12/03/software-defined-networking-difference-between-vxlan-and-nvgre/&quot; rel=&quot;nofollow&quot;&gt;https://msandbu.wordpress.com/2015/12/03/software-defined-networking-difference-between-vxlan-and-nvgre/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29931" LastActivityDate="2016-09-20T09:52:38.427" Title="Tunnelling difference over VXLAN vs NVGRE vs GENEVE" Tags="|linux|network-core|tunnel|gre|vxlan|" AnswerCount="0" CommentCount="0" ClosedDate="2019-02-23T22:28:34.267" ContentLicense="CC BY-SA 3.0" />
  <row Id="35087" PostTypeId="1" AcceptedAnswerId="35095" CreationDate="2016-09-20T11:57:59.457" Score="0" ViewCount="556" Body="&lt;p&gt;We have 3 ISP connections (BGP based) coming to our redundant pair of MX routers. These routers connect to a WAN Switch and goes to Firewall and goes to core switch cluster. Now I would like to know what is the best practice to handle ISPs in terms of VLANs in the lan side. Is it better to have 3 different Vlans or trunk all ISPs in one VLAN in the wan switch and core switch? How do generally companies handle different routed ISP connections in Lan side? Do they separate them using L2 vlan tags or never mind about it?&lt;/p&gt;&#xA;" OwnerUserId="22114" LastActivityDate="2016-09-20T20:48:55.470" Title="Multiple ISPs and VLANs segregation" Tags="|router|vlan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35088" PostTypeId="2" ParentId="29883" CreationDate="2016-09-20T12:11:27.270" Score="2" Body="&lt;p&gt;When providers lay fiber they don't just lay one fiber. Over land and on short underwater hops they lay a large bundle because fiber is cheap. Transoceanic fibers need integrated optical amplifiers which reduces the practical fiber count. Your long distance link will run mostly over existing infrastructure with possiblly a small ammount of new fiber for the final connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are various levels at which you can buy into the fiber infrastructure depending on your bandwidth/latency/jitter requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can buy a dedicated fiber path, this is often known as &quot;dark fiber&quot; because the customer typically supplies the equipment to &quot;light&quot; the fiber. This is most common on shorter links where the cost of the fiber is relatively small and so the costs of WDM or electronic muxing are not justified. Those with very high bandwidth needs may also buy dark fiber to run their own WDM system over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can buy a wavelength in a WDM system. This is a common option for high bandwdith links over long distances. The provider will generally operate the specialist WDM transcivers and if needed optical amplifiers and use a non-wdm fiber for the final link to the customer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can buy a line that is muxed electronically. This is common for relatively slow (sub 10Gbps) links. There are various systems for doing this including ATM, PDH, SONET, MPLS etc. Some systems only allow fixed bandwidths while others allow for a burstable service. The final link to the customer may be either copper or fiber depending on bandwidth requirements and what is available locally.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-07-11T14:28:52.887" LastActivityDate="2017-07-11T14:28:52.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35090" PostTypeId="1" CreationDate="2016-09-20T13:15:19.843" Score="8" ViewCount="287" Body="&lt;p&gt;I am a business owner with multiple BT Buisness Broadband lines. We have two sets of VOIP lines and two sets of PC's, each with there own switch board. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem that we have is that our lines go down frequently and we want to create a simple solution for both managing the internet routing and for monitoring the internet connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My idea is to use a PC in the cabinet to control a managed switch which in turn routes the internet connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My questions are; is this setup possible? and is there a better way?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is our current setup and our new setup idea:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WJycz.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WJycz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My secondary goal is to monitor the four internet connections from the 'Cabinet PC'. I want to record the internet download/upload speeds and the date, time, and length of any downtime. Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="30639" LastActivityDate="2018-04-14T13:55:58.910" Title="Upgrading our Network to Managed Switch with Internet Routing" Tags="|routing|vlan|ethernet|internet|network-core|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35093" PostTypeId="1" CreationDate="2016-09-20T20:14:34.520" Score="2" ViewCount="258" Body="&lt;p&gt;we've expanded our business to a nearby building with its own network and i am trying to join the two so that the workstations can see each other, but they continue to use their own internet access. Here is the layout:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NETWORK 1 (aka N1): 192.168.1.*/16 =&gt; Switch: CISCO SG200-28P (192.168.1.10/16) =&gt; Firewall: WATCHGUARD T30 (192.168.1.1/16 / DHCP server .100-.200) =&gt; INTERNET&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NETWORK 2 (aka N2): 192.168.30.*/24 =&gt; Switch: DLINK DGS1210-28P (192.168.30.20/24) =&gt; Firewall: FORTINET 60C (192.168.30.1/24 / DHCP server .110-.254) =&gt; INTERNET&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point, i have run a cat6 cable from one switch to the other. When i connect my laptop to N1, i get a DHCP response/IP address from the server on N2. I can then connect to N2, but still can't see N1 even though i am connected directly to that switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i give my laptop a static IP address on the N1 network, it functions normally and i can see all the nodes on N1, but nothing on N2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conversely, connecting directly into N2 gives me access to N2 nodes, but no access to N1. As stated above, i have changed the netmask on the switch and router (and my laptop) of N2 to be /16, but when i go to change it on the router of N1, i get a &quot;IP address is in same subnet as the others.&quot; even though no other interface is on any 192.168 subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i am hoping to achieve is that a computer on N1 can talk to any computer on N2 (i am currently not concerned about vice-versa), but each node on the respective networks use their respective routers/gateway to the internet and DHCP addressing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be very much appreciated. Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&#xA;Quick network diagram w/ device models. Pretty straightforward, really:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/wE8gY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wE8gY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30647" LastEditorUserId="30647" LastEditDate="2016-09-20T22:12:21.320" LastActivityDate="2017-07-18T19:03:38.317" Title="Join internal networks" Tags="|routing|bridge|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35094" PostTypeId="2" ParentId="35093" CreationDate="2016-09-20T20:31:42.277" Score="1" Body="&lt;p&gt;Without more information, I can only give you general ideas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, never just connect two networks together via a layer-2 switch unless you set up a specific VLAN for this. You don't want to bridge separate layer-2 domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next you will need to let each router know about the networks on the router, and how to get to it. This will be on a separate interface, either logical or physical. Routers learn about networks in three ways: directly connected network, statically configured network, or by a shared routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply connecting a cable between the two networks is probably going to lead to big problems for the users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you provide the information I asked for in the comment, we can give you more specifics on how to achieve what you want.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-20T20:31:42.277" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="35095" PostTypeId="2" ParentId="35087" CreationDate="2016-09-20T20:48:55.470" Score="3" Body="&lt;p&gt;From my perspective, in keeping with the KISS principle you should only seek to differentiate those ISP services into your network as far as the devices that need to know the difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, if you are using the ISPs interchangeably for generic Internet access, keep it simple on the internal network and just have a default route to the firewall, and let it (or the router beyond it) sort out how to split traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If on the other hand you are using the different ISPs for different traffic types, you may need to &quot;extend&quot; some notion of that differentiation into the internal network through routing, tagging, NAT-ing or whatever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So getting back to your original question, only create 3 different VLANs if you have a good reason to. Otherwise you're just complicating things without a corresponding benefit.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-09-20T20:48:55.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35097" PostTypeId="2" ParentId="35061" CreationDate="2016-09-20T23:46:53.940" Score="2" Body="&lt;p&gt;Eddie's answer is 100% correct. I just want to add that you can also use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfathen.html#wp1001032&quot; rel=&quot;nofollow&quot;&gt;this technique:&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# username teddy password teddybear    &#xA;Router(config)# aaa new-model&#xA;Router(config)# aaa authentication login default local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-09-20T23:46:53.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35098" PostTypeId="2" ParentId="35090" CreationDate="2016-09-20T23:59:29.497" Score="2" Body="&lt;p&gt;Load balancing across the 4 BT-hubs can't easily be done from a switch, as Stuggi says, You will need an internal router and the managed switch should have all gigabit capable ports. (I'm guessing you have BT Infinity circuits for VoIP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are routers that can load balance 4 WAN lines with a single LAN link to the central managed switch in your drawing. The central switch should also be able to provide VLAN management &amp;amp; basic routing so that only traffic destined for the internet reaches the load balancer.&#xA;You will end up with a point to point routed connection from the load balancer to each of the five connected devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are essentially amalgamating four small independent LANs into one, so you will also need to address these items before you start; Planning the IP addressing across the whole network &amp;amp; replacing the DHCP provided by the BT hubs with a single source.&#xA;if the VoIP call quality starts to suffer with all devices on one LAN, you may have to move VoIP into a dedicated VLAN, possibly with QoS enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internet monitoring features you want will require the BT hubs to send all events to a central log server database which can then be accessed via network management software. This software will have to be configured to interpret the messages that the hubs create.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, 'Managed switch' is very much in the 'you get what you pay for' category.&lt;/p&gt;&#xA;" OwnerUserId="26992" LastEditorUserId="8499" LastEditDate="2016-09-21T00:03:44.170" LastActivityDate="2016-09-21T00:03:44.170" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35101" PostTypeId="1" CreationDate="2016-09-21T07:17:05.213" Score="1" ViewCount="888" Body="&lt;p&gt;Since I have upgrade my switch, I have been experiencing issues with port forwarding on my pfSense gateway. I have done some researching on google, but didn't come to any conclusive results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Background:&#xA;My old network configuration was ISP &gt; pfSense &gt; Dell PowerConnect 2016 Switch &gt; Client. This switch was 10/100 Mb, unmanaged plug and play.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My new configuration is ISP &gt; pfSense &gt; Cisco Catalyst 3560G &gt; Client. To my understanding this switch has layer three functionality that I am not using. I do not have any VLANS running other than the default VLAN 1. (As far as I know) I do not have ip routing enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In both configurations, pfSense is running pureNAT and I have followed many tutorials on setting up port forwarding assuming I was messing it up somehow (I did reinstall pfSense onto a new HDD).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since these changes have been made, I have been unable to successfully setup SSH, http, as well as other things. I have run a port scan on my external IP and the ports that I am forwarding in pfSense read as open. However, when I attempt to SSH into the machine that the SSH port is being forwarded to, the connection eventually times out. I have tested SSH locally and there are no issues. Just to be sure, I tested this on multiple machines and VMs with the same results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I am new to managed/layer 3 switches, I am looking for someone to guide in in the right direction to figure out why I am incurring this issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;no service password-encryption&#xA;!&#xA;hostname Main-Switch&#xA;!&#xA;enable secret 5 ####################&#xA;enable password ########&#xA;!&#xA;no aaa new-model&#xA;ip subnet-zero&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface GigabitEthernet0/3&#xA;!&#xA;interface GigabitEthernet0/4&#xA;!&#xA;interface GigabitEthernet0/5&#xA;!&#xA;interface GigabitEthernet0/6&#xA;!&#xA;interface GigabitEthernet0/7&#xA;!&#xA;interface GigabitEthernet0/8&#xA;!&#xA;interface GigabitEthernet0/9&#xA;!&#xA;interface GigabitEthernet0/10&#xA;!&#xA;interface GigabitEthernet0/11&#xA;!&#xA;interface GigabitEthernet0/12&#xA;!&#xA;interface GigabitEthernet0/13&#xA;!&#xA;interface GigabitEthernet0/14&#xA;!&#xA;interface GigabitEthernet0/15&#xA;!&#xA;interface GigabitEthernet0/16&#xA;!&#xA;interface GigabitEthernet0/17&#xA;!&#xA;interface GigabitEthernet0/18&#xA;!&#xA;interface GigabitEthernet0/19&#xA;!&#xA;interface GigabitEthernet0/20&#xA;!&#xA;interface GigabitEthernet0/21&#xA;!&#xA;interface GigabitEthernet0/22&#xA;!&#xA;interface GigabitEthernet0/23&#xA;!&#xA;interface GigabitEthernet0/24&#xA;!&#xA;interface GigabitEthernet0/25&#xA;!&#xA;interface GigabitEthernet0/26&#xA;!&#xA;interface GigabitEthernet0/27&#xA;!&#xA;interface GigabitEthernet0/28&#xA;!&#xA;interface GigabitEthernet0/29&#xA;!&#xA;interface GigabitEthernet0/30&#xA;!&#xA;interface GigabitEthernet0/31&#xA;!&#xA;interface GigabitEthernet0/32&#xA;!&#xA;interface GigabitEthernet0/33&#xA;!&#xA;interface GigabitEthernet0/34&#xA;!&#xA;interface GigabitEthernet0/35&#xA;!&#xA;interface GigabitEthernet0/36&#xA;!&#xA;interface GigabitEthernet0/37&#xA;!&#xA;interface GigabitEthernet0/38&#xA;!&#xA;interface GigabitEthernet0/39&#xA;!&#xA;interface GigabitEthernet0/40&#xA;!&#xA;interface GigabitEthernet0/41&#xA;!&#xA;interface GigabitEthernet0/42&#xA;!&#xA;interface GigabitEthernet0/43&#xA;!&#xA;interface GigabitEthernet0/44&#xA;!&#xA;interface GigabitEthernet0/45&#xA;!&#xA;interface GigabitEthernet0/46&#xA;!&#xA;interface GigabitEthernet0/47&#xA;!&#xA;interface GigabitEthernet0/48&#xA;!&#xA;interface GigabitEthernet0/49&#xA;!&#xA;interface GigabitEthernet0/50&#xA;!&#xA;interface GigabitEthernet0/51&#xA;!&#xA;interface GigabitEthernet0/52&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;ip classless&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA;line vty 0 4&#xA; password #########&#xA; no login&#xA;line vty 5 15&#xA; password #########&#xA; no login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30228" LastEditorUserId="30228" LastEditDate="2016-09-23T05:07:07.920" LastActivityDate="2016-09-23T05:07:07.920" Title="Issues with port forwarding with Layer 3 switch" Tags="|nat|cisco-ios|cisco-catalyst|ssh|pfsense-2|" AnswerCount="0" CommentCount="7" ClosedDate="2019-02-23T22:20:37.777" ContentLicense="CC BY-SA 3.0" />
  <row Id="35103" PostTypeId="1" AcceptedAnswerId="44531" CreationDate="2016-09-21T09:01:24.007" Score="1" ViewCount="265" Body="&lt;p&gt;I've tried to find an explanation online that just simply tells me how inverse ARP is configured, and I can't seem to find a straight answer for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's use the below diagram as an example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9byRO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9byRO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, I've configured this as an MP frame relay all in the subnet. Now I could quite easily link all of these together by creating static maps. That's not the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'd really like to know is what configuration needs to take place in order for inverse ARP to work between the routers? My guess would be to place routes on the frame relay switch from one DLCI to an outgoing interface, but how does the frame relay switch know where the DLCI is coming from? Does it need to still be mapped somewhere else, so there's communication between the routers and frame relay switch? Otherwise it just seems like a free for all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated, as I'd really like clarity on this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="23950" LastActivityDate="2017-09-27T14:53:38.387" Title="How is inverse ARP configured in frame relay?" Tags="|cisco|wan|frame-relay|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35104" PostTypeId="1" CreationDate="2016-09-21T09:58:14.880" Score="1" ViewCount="49" Body="&lt;p&gt;I had newly bought a D-link 1210 28 port switch, and I need to configure something. I can bind a particular mac id and IP address to a specific IP, but in my case I need to bind 2 IP of 2 different networks and a mac to a specific port on my switch. Kindly suggest me a solution, or else an alternative method for doing the same.. Thanks in advance...&lt;/p&gt;&#xA;" OwnerUserId="19024" LastEditorUserId="2142" LastEditDate="2016-09-22T18:28:38.030" LastActivityDate="2016-09-22T18:28:38.030" Title="Binding mac and 2 IP addresses using IMBP" Tags="|vlan|" AnswerCount="0" CommentCount="4" ClosedDate="2019-02-23T22:21:31.343" ContentLicense="CC BY-SA 3.0" />
  <row Id="35105" PostTypeId="2" ParentId="35093" CreationDate="2016-09-21T11:38:24.337" Score="1" Body="&lt;p&gt;Here is a high level answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will connect your two firewalls together (hopefully, you have vacant ports.  If not, you will need to buy additional routers).  The firewalls will forward traffic from one network to the other and vice versa.  The link between the firewalls will have its own IP subnet (192.168.100.0/24, for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, you will configure static routes on the firewalls so that each firewall knows how to reach to other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, you will configure the firewall policy to allow traffic to flow from one network to the other.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-21T11:38:24.337" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35107" PostTypeId="1" CreationDate="2016-09-21T12:18:23.147" Score="2" ViewCount="1132" Body="&lt;p&gt;I am trying to experiment with a Cisco ISR 1841 and have configured NAT on the device. The intention is to simulate it being a broadband router. I understand that this is not the best performing router around and has a max throughput of 40Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With scenario (A) I have configured classic inside/outside NAT with zone-based firewall. Overall the throughput drops to about 30Mbps when trying to speed test traffic from one end to the other through the router. Not to bad considering the age of the router but with this setup I think that CEF switching is still working. The issue with this setup is it does not officially support hair pinning when trying to port forward.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With scenario (B) I have configured the same as above except it is using NVI instead of inside/outside classic NAT. Doing the same speed test, the performance tanks to between 8Mbps and 10Mbps with the CPU usage going near 100%. Almost 50% of that going to the process switching process even though CEF is still enabled. The process in question is called &lt;code&gt;&quot;IP Input&quot;&lt;/code&gt; when using &lt;code&gt;&quot;sh proc cpu sorted&quot;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have read similar stories for newer Cisco ISR devices like the 1900 and 2900 series routers. Is it just a fact that NVI based NAT cannot make use of CEF switching or is there some special configuration that needs to be done? Or is NVI in hardware only supported on the obscenely big router models?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My NVI example&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0.1&#xA; description outside&#xA; encapsulation dot1Q 1 native&#xA; ip address 10.10.10.1 255.255.255.248&#xA; ip nat enable&#xA; ip virtual-reassembly in&#xA; zone-member security outside&#xA;&#xA;&#xA;interface FastEthernet0/1.1&#xA; encapsulation dot1Q 1 native&#xA; ip address 192.168.0.1 255.255.255.0&#xA; ip nat enable&#xA; ip virtual-reassembly in&#xA; zone-member security inside&#xA;&#xA;&#xA;ip nat source list nat-access interface FastEthernet0/0.1 overload&#xA;&#xA;ip access-list extended nat-access&#xA; permit ip 192.168.2.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sh cef int f0/0.1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/0.1 is up (if_number 5)&#xA;  Corresponding hwidb fast_if_number 5&#xA;  Corresponding hwidb firstsw-&amp;gt;if_number 2&#xA;  ICMP redirects are always sent&#xA;  Per packet load-sharing is disabled&#xA;  IP unicast RPF check is disabled&#xA;  Input features: Stateful Inspection, Virtual Fragment Reassembly, IPSec input classification, Virtual Fragment Reassembly After IPSec Decryption&#xA;  Output features: Post-routing NAT NVI Output, Stateful Inspection, IPSec output classification, CCE Post NAT Classification, Firewall (firewall component), IPSec: to crypto engine, Post-encryption output features&#xA;  IP policy routing is disabled&#xA;  Hardware idb is FastEthernet0/0&#xA;  Fast switching type 1, interface type 18&#xA;  IP CEF switching enabled&#xA;  IP CEF switching turbo vector&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IOS Version: (C1841-ADVENTERPRISEK9-M), Version 15.1(4)M10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(EDIT) edited with iOS version and cef interface output&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="30655" LastEditorUserId="30655" LastEditDate="2016-09-21T13:58:37.310" LastActivityDate="2016-09-21T13:58:37.310" Title="NVI based NAT on Cisco ISR terrible performance" Tags="|cisco|cisco-ios|cisco-isr|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35109" PostTypeId="1" AcceptedAnswerId="35113" CreationDate="2016-09-21T14:54:27.707" Score="5" ViewCount="5256" Body="&lt;p&gt;Ok, I have read up about this 16K limit for the MAC address table, or better known as the CAM table, on certain switches. Lets say I have 14 different edge switches with that 16K limit, and I have VLAN 200 set up across all of these same switches, would I expect to see the tables &quot;sync&quot; across all of the switches for that VLAN? For example, if one switch fills up with 10K mac addresses, would I expect to see these same MAC addresses in the CAM table across all switches in that VLAN? Could this be something that differs by configuration and/or vendor implementation? &lt;/p&gt;&#xA;" OwnerUserId="15098" LastEditorUserId="8499" LastEditDate="2018-12-11T01:17:17.780" LastActivityDate="2019-04-14T12:23:11.783" Title="Does a switch MAC address table sync across all switches in the same VLAN?" Tags="|switch|vlan|switching|mac-address|broadcast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35111" PostTypeId="2" ParentId="10857" CreationDate="2016-09-21T14:57:41.707" Score="0" Body="&lt;p&gt;I work for CloudFlare, I'd like to share some of the knowledge I've developed about mitigating DDOS attacks over the last few months I've been here.&lt;/p&gt;&#xA;&lt;p&gt;Firstly; a lot of people resort to network level measures to mitigate application layer DDOS attacks. Before diving to BGP Blackholing, consider whether it's something rate limiting or application layer protection could deal with. That said; it's now very cheap to launch very large capacity DDOS attacks (given how many &lt;a href=&quot;http://www.pcworld.com/article/2013109/report-open-dns-resolvers-increasingly-abused-to-amplify-ddos-attacks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Open DNS Recursors&lt;/a&gt; are around, and how they can amplify attacks).&lt;/p&gt;&#xA;&lt;p&gt;As Elliot described in his answer, using BGP Communities to blackhole traffic can work well if your network is small; this mechanism is documented in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3882&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3882&lt;/a&gt;. However, like us, if you instead you wish to absorb the attack traffic instead of blackhole (i.e. you want to collect &lt;a href=&quot;https://blog.cloudflare.com/a-winter-of-400gbps-weekend-ddos-attacks/&quot; rel=&quot;nofollow noreferrer&quot;&gt;DDOS attack data&lt;/a&gt;), then beware of collateral damage whereby intermediary network providers end up being congested. You can mitigate the collateral damage by peering directly with the ISPs of the networks who are launching the attacks. By doing so you have the shortest path from attacker to destination. Additionally you can implement an &lt;a href=&quot;https://blog.cloudflare.com/a-brief-anycast-primer/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Anycast network&lt;/a&gt; design, this will effectively mean one IP address hits multiple datacenters (depending on whichever is closest).&lt;/p&gt;&#xA;&lt;p&gt;Obviously it's not possible for every company to have the infrastructure to do Anycast and peering; that's why businesses are increasingly turning to cloud services to remove the bad traffic before it reaches their datacenters. Naturally CloudFlare is one such service.&lt;/p&gt;&#xA;" OwnerUserId="30659" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-09-21T14:57:41.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35113" PostTypeId="2" ParentId="35109" CreationDate="2016-09-21T15:21:44.047" Score="6" Body="&lt;p&gt;Synchronizing MAC address tables across switches doesn't make any sense. Each switch maintains its own MAC address table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, suppose you have Switch 1 and Switch 2 connected together of their ports 24, and MAC address &lt;code&gt;0123.4567.89ab&lt;/code&gt; comes into Switch 1 port 5. On switch 1, the MAC address table would reflect that MAC address &lt;code&gt;0123.4567.89ab&lt;/code&gt; is connected to port 5. If any frames from the host with that MAC address find their way to Switch 2, the MAC address table of Switch 2 will have MAC address &lt;code&gt;0123.4567.89ab&lt;/code&gt; coming into port 24. If no frames from MAC address &lt;code&gt;0123.4567.89ab&lt;/code&gt; get sent to Switch 2, then Switch 2 will not have &lt;code&gt;0123.4567.89ab&lt;/code&gt; in its MAC address table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you synchronize MAC address table across those two switches, then how would you propose to resolve the port conflict where &lt;code&gt;0123.4567.89ab&lt;/code&gt; is on port 5 of one switch, but it is on port 24 of the other switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The closest thing you could have is with switch stacks, where multiple switches are connected in a stack, and the stack looks like a single switch. You configure the stack, not the individual switches, and things like STP and MAC address tables are done as if the stack was a single switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-09-21T15:30:29.383" LastActivityDate="2016-09-21T15:30:29.383" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35114" PostTypeId="2" ParentId="33825" CreationDate="2016-09-21T15:26:23.317" Score="3" Body="&lt;p&gt;Ron did an absolutely wonderful job of explaining some of the concepts here. This post mentioned the fact that CloudFlare use Anycast, I work for CloudFlare so I'd like to explain how it works reliably.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly it's important to remember that network traffic is re-routed reasonably infrequently and if it happens in your region, it will likely happen when you aren't even awake. As a protocol TCP is quite resilient, so you won't see any ill-effects as a result of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP cannot be scattered, as a protocol that simply won't work. TCP is an ACK-based protocol; this means that TCP packets are acknowledged by sending back a packet with an acknowledgement bit set. The TCP Header may then contain a Acknowledgment number (of 32 bits in length) which effectively acts as an acknowledgment receipt of all the previous bytes; if this is inaccurate then a connection close may be sent from the server to the client. In TCP, when the RST flag in a TCP header is set. A TCP Reset effectively leads to the connection being immediately killed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a TCP connection was scattered and re-routed mid-communication; the new server would not understand the ACK being sent to it with the request and would effectively close the connection to the client. The client would then be able to re-attempt the request which would then be completed by the new server they would be routed to through BGP.&lt;/p&gt;&#xA;" OwnerUserId="30659" LastActivityDate="2016-09-21T15:26:23.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35115" PostTypeId="1" CreationDate="2016-09-21T16:08:40.867" Score="1" ViewCount="493" Body="&lt;p&gt;I have a question: Let's say I take antenna with 27 dBm TX Power, but the signal level at the RX is less than -97dBm (that's bad isn't it?). Is it ok to put some antenna gain (as example: 27dBi)? Then I get like -60dBm RX signal level.&lt;/p&gt;&#xA;" OwnerUserId="30665" LastActivityDate="2016-09-21T16:08:40.867" Title="Antenna gain and TX Power" Tags="|wireless|ieee-802.11|" AnswerCount="0" CommentCount="5" ClosedDate="2019-02-23T22:25:35.103" ContentLicense="CC BY-SA 3.0" />
  <row Id="35116" PostTypeId="1" CreationDate="2016-09-21T16:43:30.837" Score="2" ViewCount="249" Body="&lt;p&gt;If I have 15 switches on the same VLAN and each switch has an upper limit on mac-addresses of 16k, and one of them is reaching that upper limit of 16k, what would be the best approach to mitigate this problem? My understanding is that once the switch hits that mark, it will start cycling through removing the oldest mac-addresses first to make room for the new. The problem with this is that drives up CPU, and the switch then spends more time managing its mac-table than forwarding traffic to it intended destination, leading to connection problems for the users connected to that switch. Whats the best way to deal with this aside from getting a new switch that supports more mac's?&lt;/p&gt;&#xA;" OwnerUserId="15098" LastActivityDate="2017-12-07T16:58:13.203" Title="How to best mitigate a switch mac-address limitation" Tags="|switch|vlan|mac-address|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35117" PostTypeId="2" ParentId="35109" CreationDate="2016-09-21T17:35:33.930" Score="2" Body="&lt;p&gt;Switches don't normally&lt;sup&gt;1&lt;/sup&gt; sync MAC tables, they independently build them based on the Source MAC addresses and ingress ports of frames they see.&lt;/p&gt;&#xA;&lt;p&gt;However pretty much all devices send out broadcast (or effectively broadcast) packets first (DHCP, ARP etc). When a broadcast packet is sent from a MAC address that packet will be processed by every switch in the VLAN and hence it's MAC address will be recorded by every switch in the VLAN.&lt;/p&gt;&#xA;&lt;p&gt;So under normal circumstances you would expect all the switches on a VLAN to have pretty much the same list of MAC addresses in their switching table for that VLAN. Obviously the ports associated with those MAC addresses will be different.&lt;/p&gt;&#xA;&lt;p&gt;&lt;sup&gt;1&lt;/sup&gt; There are exceptions to this, some protocols for virtual Ethernet networks explicitly advertise the location of MAC addresses. &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-ietf-bess-evpn-overlay-04&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://datatracker.ietf.org/doc/html/draft-ietf-bess-evpn-overlay-04&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2018-03-08T21:32:46.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35118" PostTypeId="1" CreationDate="2016-09-21T17:42:49.203" Score="1" ViewCount="84" Body="&lt;p&gt;I organize sport events and to do that I need to create a network very time I go to a sport hall. Due to the sport type, I can not use 2.4 Ghz (this frequency causes issues with the scoring system), so I actually use cables and switch to connect a small server (with hosts the software that manages the sport event) and 10/15 clients placed in different points (one for each competition area). &#xA;To do that I already have switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm looking for a solution to remove cables (which are very time expensive to be placed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot use pure 5Ghz wireless because computer which are actually used have just 2.4Ghz network adapter or, in some cases, they have just an ethernet port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I'm looking for a way to place a central access point to bring wifi signal to every competition area (removing the necessity of long wires) and then place here a small switch, connected to a sort of wifi receiver, so I can still use cables to connect switch to the laptops on every competition area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought about a central wireless router/AP with a repeater on each competition area (like that &lt;a href=&quot;https://www.amazon.it/gp/product/B00KXULGJQ/ref=s9_simh_gw_g147_i2_r?pf_rd_m=A11IL2PNWYJU7H&amp;amp;pf_rd_s=&amp;amp;pf_rd_r=C2VBRXEBDTWAEK8EHY5F&amp;amp;pf_rd_t=36701&amp;amp;pf_rd_p=6127e987-ce6a-47ca-bd15-51701a16b93c&amp;amp;pf_rd_i=desktop&quot; rel=&quot;nofollow&quot;&gt;https://www.amazon.it/gp/product/B00KXULGJQ/ref=s9_simh_gw_g147_i2_r?pf_rd_m=A11IL2PNWYJU7H&amp;amp;pf_rd_s=&amp;amp;pf_rd_r=C2VBRXEBDTWAEK8EHY5F&amp;amp;pf_rd_t=36701&amp;amp;pf_rd_p=6127e987-ce6a-47ca-bd15-51701a16b93c&amp;amp;pf_rd_i=desktop&lt;/a&gt;), using the ethernet port plugged into the switch. But I think that on something like that I cannot disable wireless repeater, so I will get a lot of repeated wifi SSID with bad results (and a lot of electromagnetic pollution, which is bad for the scoring system)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you suggest me a better way to get this result? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Andrea &lt;/p&gt;&#xA;" OwnerUserId="30667" LastActivityDate="2016-09-21T17:42:49.203" Title="Best way to avoid cables" Tags="|ethernet|ieee-802.11|" AnswerCount="0" CommentCount="5" ClosedDate="2019-02-23T22:24:08.393" ContentLicense="CC BY-SA 3.0" />
  <row Id="35119" PostTypeId="1" AcceptedAnswerId="35122" CreationDate="2016-09-21T18:05:46.037" Score="1" ViewCount="198" Body="&lt;p&gt;We have multiple access points around and individual departments choose their own SSIDs for these APs. The signals overlap significantly, and all users know the passwords to all of them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've seen lots of talk about seamless roaming with wifi networks using the same SSID/password - but I failed to find anything on using different APs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the 802.11 protocol allow for seamless roaming amongst the same network (all APs have the same gateway)? In other words, can the APs 'hand-over', so to speak, without dropping the connection?&lt;/p&gt;&#xA;" OwnerUserId="30358" LastActivityDate="2016-09-21T18:51:15.703" Title="Is it possible to do seamless roaming with APs that have different SSIDS?" Tags="|ieee-802.11|access-point|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35120" PostTypeId="2" ParentId="6309" CreationDate="2016-09-21T18:17:53.087" Score="1" Body="&lt;p&gt;In the old days a LAN was a network built for local communication within a relatively small area (such as a building or maybe a campus), it used technologies like Ethernet, Token ring and so-on. Since local links could be fast and cheap simplicity was a priority over link efficiency. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A WAN was a network built to connect systems over a large area, generally by interconnecting a number of LANs using point to point circuits rented from a telco. Scalability and efficient usage of links were priorities over simplicitly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the lines have got much blurrier over the years. The move from CSMA/CD to full duplex point to point links removed the distance restrictions from Ethernet. WDM allows links to be electrically independent while travelling over the same fiber. Various protocols have been introduced that encapsulate ethernet packets to carry them over a wider network. It is now practical to build networks that look like a single ethernet network despite spanning large geographical areas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the other direction the much larger number of users in a building/campus and increasing security concerns has meant that a single flat network on a building/campus is less practical than it used to be. Technologies like VLAN have been introduced to split them up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So while geography still has an impact on network design the distinction between &quot;LAN&quot; and &quot;WAN&quot; is nowhere near as hard-edged as it used to be.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-04-10T15:53:29.923" LastActivityDate="2017-04-10T15:53:29.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35122" PostTypeId="2" ParentId="35119" CreationDate="2016-09-21T18:30:32.337" Score="1" Body="&lt;p&gt;The decision of how and when to roam is completely up to the client.  But if the client can't find another AP with the same SSID, it will begin searching for another BSSID that it can connect to. The client will have to negotiate a new DHCP lease.  That will certainly not be &quot;seamless.&quot;  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-09-21T18:51:15.703" LastActivityDate="2016-09-21T18:51:15.703" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35124" PostTypeId="2" ParentId="32329" CreationDate="2016-09-21T20:21:45.307" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Now, nobody does that&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That statement is not true. Some admins do it, some don't. There are pros and cons to such a setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pros:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can move stuff arround without reconfiguring the switchports.&lt;/li&gt;&#xA;&lt;li&gt;If you use ICMP redirects you can arrange for the bulk of data traffic to pass directly between hosts without hitting a router.&lt;/li&gt;&#xA;&lt;li&gt;One machine can have IPs on multiple subnets without requiring multiple NICs  on the same machine or VLAN support on the end machine (afaict the latter is no problem on Linux but more of an issue on Windows).&lt;/li&gt;&#xA;&lt;li&gt;You save VLAN IDs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Cons.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;More broadcast traffic.&lt;/li&gt;&#xA;&lt;li&gt;If there is a firewall in the L3 routing then people may think the hosts are isolated when they are not really.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-05-17T14:26:09.780" LastActivityDate="2017-05-17T14:26:09.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35129" PostTypeId="1" AcceptedAnswerId="35142" CreationDate="2016-09-22T04:59:51.600" Score="1" ViewCount="4094" Body="&lt;p&gt;I know this might sound like a very amateur and stupid question but I don't understand the concepts of these protocols in the OSI model. Are they just code that gets invoked? Also where does this code reside? Is it put on every server machine that needs to conform to the protocol when you are designing the network?&lt;/p&gt;&#xA;&lt;p&gt;I am reading a book and it states that:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;For starters, the abstract objects that make up the layers of a network system are called protocols.&lt;/p&gt;&#xA;&lt;p&gt;Each protocol defines two different interfaces. First, it defines a service interface to the other objects on the same computer that want to use its communication services.&lt;/p&gt;&#xA;&lt;p&gt;An implementation of the HTTP protocol could support an operation to fetch a page of hypertext from a remote server.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So in the case of an HTTP protocol when a user hits enter after entering a URL on their browser, some code for the HTTP protocol which is stored on some server machine is being run?&lt;/p&gt;&#xA;" OwnerUserId="30675" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-09-22T19:01:36.333" Title="Where does the code for the OSI layer protocols exist?" Tags="|protocol-theory|osi|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35131" PostTypeId="1" CreationDate="2016-09-22T07:43:31.747" Score="0" ViewCount="3528" Body="&lt;p&gt;What is the practical use of it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just pinging the target from whatever interfaces and then getting the reply can already ensure the target is up. So, why do we have to specify the source IP Address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="30680" LastActivityDate="2016-09-22T19:55:45.200" Title="Why ping with source address?" Tags="|ping|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35133" PostTypeId="1" CreationDate="2016-09-22T08:47:28.490" Score="0" ViewCount="112" Body="&lt;p&gt;We have device that works with 10 Mb. Some of the customers have 100 Mb, so our device causes problems. To change our device to support 100 Mb is going to take time and cost a lot, so is there any adapter from 100 Mb (or higher) to 10 Mb?&lt;/p&gt;&#xA;" OwnerUserId="30682" LastEditorUserId="8499" LastEditDate="2016-09-23T14:23:24.213" LastActivityDate="2016-09-23T14:23:24.213" Title="Ethernet adapter 100 to 10" Tags="|ethernet|speed|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35135" PostTypeId="2" ParentId="35129" CreationDate="2016-09-22T09:59:38.810" Score="1" Body="&lt;p&gt;The OSI layer model is a theoretical model used to describe the way that communication among systems had to be handled. A real life communication model is, for example, TCP/IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP is layer 3 and TCP/UDP are layer 4 protocols. Lower layers are managed by WLAN and Ethernet in real life LANs nowadays.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Windows has these layers as software embedded inside the Operating System that can be accessed through Winsock.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Linux it is part of the kernel. You can check the source code of it &lt;a href=&quot;http://lxr.linux.no/linux+v2.6.37/net/ipv4/tcp_ipv4.c&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTTP is a server-client protocol. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The HTTP client code is inside the web browser. You can check the source code of Firefox 48 &lt;a href=&quot;https://archive.mozilla.org/pub/firefox/releases/48.0/source/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Examples of HTTP servers are Microsoft IIS and Apache. &lt;a href=&quot;https://github.com/apache/httpd&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; is the source code of Apache.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the user hits enter after entering a URL on his browser( &lt;code&gt;www.google.com&lt;/code&gt; for example), then it sends a connection request to the HTTP server. The request goes through the lower layers and then through Internet until it gets to the HTTP server in google. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This HTTP server responds with data that goes through the internet until it gets to the web browser of the user.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-09-22T14:04:26.327" LastActivityDate="2016-09-22T14:04:26.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35137" PostTypeId="2" ParentId="35133" CreationDate="2016-09-22T10:24:38.173" Score="2" Body="&lt;p&gt;It rather depends on what exactly the &quot;problems&quot; are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the problem is that the customers port doesn't support 10 Mbps (uncommon right now but may well get more common in the future) then a simple Ethernet switch will do the trick. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand if the problem is that there is too much broadcast (or effectively broadcast) traffic for a 10Mbps device to cope then inserting another switch isn't going to help. You will need something that can allow the legitimat traffic to your device through while filtering out the unwanted broadcasts. Often a &quot;home router&quot; works well in this role with it's &quot;lan side&quot; facting your device and it's &quot;wan side&quot; facing the noisy network. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-22T10:24:38.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35139" PostTypeId="2" ParentId="35131" CreationDate="2016-09-22T10:36:51.543" Score="8" Body="&lt;p&gt;The biggest reason is that the return path from the destination back to you may depend on the source address. Often you want to test the network path in both directions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore things like policy routing, ingress filtering, firewalls, NAT etc may behave differently depending on the source address.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-22T10:36:51.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35140" PostTypeId="2" ParentId="2800" CreationDate="2016-09-22T10:41:07.470" Score="0" Body="&lt;p&gt;run cable between building terminations straight thru.&#xA;From patch panel to device cross tx rx on one side .&#xA;then you can see what your doing&lt;/p&gt;&#xA;" OwnerUserId="30685" LastActivityDate="2016-09-22T10:41:07.470" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35141" PostTypeId="2" ParentId="34811" CreationDate="2016-09-22T11:14:50.513" Score="2" Body="&lt;p&gt;I have been doing a lots of Junos Upgrade on MX960 and few even bigger stuff like PTX5k or T4k&#xA;here is short instruction about MX960&#xA;&lt;a href=&quot;http://ipexptobe.blogspot.com/2016/09/junos-upgrade.html&quot; rel=&quot;nofollow&quot;&gt;http://ipexptobe.blogspot.com/2016/09/junos-upgrade.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe this will be usefull&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers,&#xA;Patrick&lt;/p&gt;&#xA;" OwnerUserId="30686" LastActivityDate="2016-09-22T11:14:50.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35142" PostTypeId="2" ParentId="35129" CreationDate="2016-09-22T12:27:45.947" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am reading a book and it states&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If I were in a snarkier mood, I'd tell you to burn the book.  I'm sure you can find other sources that can explain this more clearly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better (and simpler) definition in this context is that a protocol is a set of procedures and objects used for communicating between devices. You might think of it as a specialized language for communication.  Each layer uses a specific protocol to talk to the corresponding layer on the other device. For example, IP is the protocol used by the network layer on one device to talk to the network layer on another device.  Note that this layer to layer communication is logical.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I don't understand the concepts of these protocols in the OSI model.&#xA;  Are they just code that gets invoked?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Forgetting for a moment that no one actually uses the OSI model, yes the protocols are implemented in code.  They are a set of communications functions and data objects.  &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13364/osi-model-and-physical-location-of-the-layers&quot;&gt;This question and answer&lt;/a&gt; might help you better understand.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it put on every server machine that needs to conform to the&#xA;  protocol when you are designing the network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In the case of the TCP/IP model, every device that uses IP has the protocol stack.  That includes PCs, servers, routers, etc.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-09-22T12:47:30.670" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35145" PostTypeId="1" CreationDate="2016-09-22T15:00:14.610" Score="2" ViewCount="202" Body="&lt;p&gt;What affects a point-to-point antenna? Mountains, other wires, etc? Why do you need to build towers for antennae?&lt;/p&gt;&#xA;" OwnerUserId="30665" LastEditorUserId="28361" LastEditDate="2016-09-23T13:23:19.193" LastActivityDate="2016-09-23T14:10:23.560" Title="Why do you need a tower for an antenna?" Tags="|wireless|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35147" PostTypeId="1" AcceptedAnswerId="35177" CreationDate="2016-09-22T15:14:53.417" Score="1" ViewCount="7567" Body="&lt;p&gt;In our infrastructure we have no WSUS installed so when microsoft pushes new updates all our computers start excessive downloads, we use pfsense and as I am new to it, I need an advise how can I limit the download bandwidth from the certain hosts having only hostnames of the update servers from here&#xA;&lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc708605(v=ws.10).aspx&quot; rel=&quot;nofollow&quot;&gt;https://technet.microsoft.com/en-us/library/cc708605(v=ws.10).aspx&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19133" LastActivityDate="2024-03-11T16:28:01.207" Title="Limit the bandwidth for microsoft windows updates with pfsense" Tags="|pfsense-2|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="35148" PostTypeId="2" ParentId="35145" CreationDate="2016-09-22T15:15:42.607" Score="2" Body="&lt;p&gt;You have tagged this with &lt;code&gt;802.11&lt;/code&gt;, but you don't normally find towers associated with Wi-Fi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, many things can block radio waves, and higher frequencies are more affected. Water is a big problem, and trees are full of water. Also, concrete and steel effectively block high frequency radio. Antennae are put on towers to try to get over many obstacles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The higher the antenna, the longer the effective range. Not only do you get higher than many obstacles, but radio waves spread out over distance, and there will be more power left for a longer period of time/distance with more vertical distance above the earth. At ground level, half the radio power goes into the earth immediately. The higher you get, the longer the radio waves can go before going into the earth.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-22T15:15:42.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35149" PostTypeId="2" ParentId="20485" CreationDate="2016-09-22T15:30:05.857" Score="1" Body="&lt;p&gt;This is usually related to buffering. The delay through a buffer depends on how full that buffer is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a simple buffer when there is little traffic the buffer is empty. Packets get through quickly. When there is more traffic than the outgoing interface can handle the buffer fills up. When the buffer is full it starts dropping packets, typically it drops newly arrives packets, a behavious known as &quot;tail drop&quot;. When the sender sees packet loss it backs off the speed slightly, the sender then gradually increases the speed again until it once again sees lost packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result of this is that the buffer immediately prior to the bottleneck ends up nearly full while other buffers end up nearly empty. I would guess that the buffer that is causing your problems is on the ISP side where the traffic passes from fixed line to wireless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what can be done? There are a couple of things the ISP can do in principle.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The ISP can make the buffer smaller.&lt;/li&gt;&#xA;&lt;li&gt;The ISP can implement mechanisms like random early drop or explicit congestion notififcation which inform senders of congestion in a manner less brutal than &quot;tail drop&quot;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In practice though their equipment may not offer the options needed or they may be unwilling to make changes for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option is to introduce an artifical bottleneck yourself that is slightly slower than your connection to your ISP. This means giving up some bandwidth and only works well if your bandwdith to your ISP is consistent but it can provide a means to take control of the buffering.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-22T15:30:05.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35151" PostTypeId="2" ParentId="35145" CreationDate="2016-09-22T15:50:06.837" Score="1" Body="&lt;p&gt;You need tower to increase coverage within area. Antenna located on tall tower would have much better coverage. Each object in line of sight between antenna and client would affect signal in few possible ways, listed below: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Reflection&#xA;A wireless signal is just radio waves. Just like light, it can bounce off of certain surfaces. Metal, for one, is a highly reflective material. This is a common occurrence for offices since they are generally in complex and intricately designed structures. If a large amount of reflection occurs, signals can be weakened and also cause interference at the receiver.&lt;/li&gt;&#xA;&lt;li&gt;Refraction&#xA;Refraction is the bending of a wave when it enters a medium where the speed is different. For example, glass or water can refract waves. This can play into consideration when you’re carefully placing APs. Different media have different refractive indexes. It’s important to track possible refraction when designing your wireless network because if a signal changes direction in traveling from sender to receiver, this can cause lower data rates, high retries and lead to an overall lessening of capacity.&lt;/li&gt;&#xA;&lt;li&gt;Diffraction&#xA;This is when waves encounter an obstacle and travel around it — the wave’s direction and intensity both change. In fact, diffraction can even be more pronounced or introduce a shadow zone depending on the size and shape of the obstacle. Hills are known to cause diffraction to wireless signals.&lt;/li&gt;&#xA;&lt;li&gt;Scattering&#xA;While this phenomena is similar to refraction, it’s more unpredictable. Dust, humidity, unevenness and other qualities in a material can cause a signal to scatter in all directions. This can have a significant impact on signal integrity and strength. Chain-link fences and even smog are notorious for scattering RF signals.&lt;/li&gt;&#xA;&lt;li&gt;Absorption&#xA;This is one of the most common reactions we see wireless signal have to materials. Basically, a material is converting the signal’s energy into heat. This occurs largely due to the molecules in the medium being unable to move fast enough to “keep up” with the RF waves that are trying to pass through it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.mirazon.com/5-phenomena-that-impact-wi-fi-signal/&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2016-09-22T16:28:15.353" LastActivityDate="2016-09-22T16:28:15.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35152" PostTypeId="2" ParentId="35147" CreationDate="2016-09-22T15:54:45.703" Score="1" Body="&lt;p&gt;With traffic shaper you can limit bandwidth to destination IP's.&lt;/p&gt;&#xA;&lt;p&gt;List of domains used by windows update, but you need to resolve those IP's yourself as they change time to time.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;http://windowsupdate.microsoft.com&#xA;http://*.windowsupdate.microsoft.com&#xA;https://*.windowsupdate.microsoft.com&#xA;http://*.update.microsoft.com&#xA;https://*.update.microsoft.com&#xA;http://*.windowsupdate.com&#xA;http://download.windowsupdate.com&#xA;http://download.microsoft.com&#xA;http://*.download.windowsupdate.com&#xA;http://wustat.windows.com&#xA;http://ntservicepack.microsoft.com&#xA;http://stats.microsoft.com&#xA;https://stats.microsoft.com&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;There's a Microsoft page with the URLs:&lt;/p&gt;&#xA;&lt;p&gt;&amp;quot;Configure WSUS - Connect to Microsoft domains on the internet&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus#211-configure-your-firewall-to-allow-your-first-wsus-server-to-connect-to-microsoft-domains-on-the-internet&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://learn.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="620" LastEditDate="2024-03-11T16:28:01.207" LastActivityDate="2024-03-11T16:28:01.207" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="35155" PostTypeId="2" ParentId="35133" CreationDate="2016-09-22T16:26:01.020" Score="0" Body="&lt;p&gt;No such device exists, as to my knowledge.&#xA;To be honest auto negotiation should work fine. It was standardised as part of fast Ethernet but is  backward compatible with 10base-T.&#xA;If auto negotiation doesn't work why not setup port where device is plugged to 10Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise you can use 10/100 switch between both devices.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-09-22T16:26:01.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35156" PostTypeId="2" ParentId="35145" CreationDate="2016-09-22T18:28:25.433" Score="0" Body="&lt;p&gt;It's a matter of physics really.  WiFi antenna's come in different flavors, each having unique characteristics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Line of sight&lt;/strong&gt; is said to be required for WiFi bridging where a directional antennae are typically deployed.  That's why these are often mounted high up above the tree line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of omni coverage antennae often found in access points, Cisco's, for example, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/antenna/installation/guide/ant5195r.pdf&quot; rel=&quot;nofollow&quot;&gt;Aironet 9.5-dBi Patch Antenna Installation Guide&lt;/a&gt; tells us about WiFi signal degradation through various materials.  Mounting the AP &lt;em&gt;too high&lt;/em&gt; up has a negative impact on signal quality.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The density of the materials used in a building’s construction&#xA;  determines the number of walls the signal must pass through and still&#xA;  maintain adequate coverage. Consider the following before choosing the&#xA;  location in which to install your antenna:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;– Paper and vinyl walls have very little affect on signal    penetration.&lt;/li&gt;&#xA;  &lt;li&gt;– Solid and pre-cast concrete walls limit signal penetration to one    or two walls without degrading coverage.&lt;/li&gt;&#xA;  &lt;li&gt;– Concrete and wood block walls limit signal penetration to three or    four walls.&lt;/li&gt;&#xA;  &lt;li&gt;– A signal can penetrate five or six walls constructed of drywall or    wood.&lt;/li&gt;&#xA;  &lt;li&gt;– A thick metal wall causes signals to reflect, causing poor    penetration.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-09-22T18:33:39.463" LastActivityDate="2016-09-22T18:33:39.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35158" PostTypeId="2" ParentId="35129" CreationDate="2016-09-22T19:01:36.333" Score="0" Body="&lt;p&gt;The &lt;a href=&quot;https://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow&quot;&gt;Open Systems Interconnection&lt;/a&gt; (OSI) reference model defines a hierarchical conceptual computer networking/communications architecture that is, by and large, obsolete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_protocol_suite&quot; rel=&quot;nofollow&quot;&gt;Internet Protocol suite&lt;/a&gt;, originally developed by the U.S. Dept. of Defense (DARPA Agency), is the dominant and de facto standard computer networking model in use today.  The &lt;a href=&quot;https://www.ietf.org/&quot; rel=&quot;nofollow&quot;&gt;Internet Engineering Task Force&lt;/a&gt;, IETF, is the authoritative body of the Internet Protocol suite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The World Wide Web (web browsers / websites) adhere to protocol specifications published by the &lt;a href=&quot;https://www.w3.org/standards/webdesign/htmlcss&quot; rel=&quot;nofollow&quot;&gt;W3C&lt;/a&gt;, namely HTML and CSS, and by &lt;a href=&quot;http://www.ecma-international.org/publications/index.html&quot; rel=&quot;nofollow&quot;&gt;ECMA International&lt;/a&gt; (often simply called JavaScript).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The physical wired and wireless standards fall under the &lt;a href=&quot;https://www.ieee.org/index.html&quot; rel=&quot;nofollow&quot;&gt;Institute of Electrical and Electronics Engineers&lt;/a&gt;, IEEE.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-22T19:01:36.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35159" PostTypeId="1" AcceptedAnswerId="35163" CreationDate="2016-09-22T19:15:56.580" Score="3" ViewCount="5082" Body="&lt;p&gt;Our telephone company has recently set us up a new ADSL connection.&#xA;It consists of a PPP link over ATM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The connection comes with a public /30 subnet that we can use to our liking.&#xA;We used one of the IP addresses for standard NAT, and one of the addresses for remote router access (ports 22 and 443) and port forwarding to a server (ports 4000-5000).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also uses a public /30 subnet for the PPP link, one IP for each endpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand why:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A /30 subnet is used for the two public IP addresses. Couldn't they just route our two IP addresses over our PPP link as isolated addresses that don't belong to any subnet? If my understanding is correct, this would allow them to effectively double the amount the number of &quot;address couples&quot; they can sell.&lt;/li&gt;&#xA;&lt;li&gt;A public subnet is used for the PPP link. Why is this the case? Since these IP addresses aren't publicly routed anyway, but only used by the two routers for the PPP link, isn't this a waste of the public address space?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="30698" LastEditorUserId="30698" LastEditDate="2017-02-21T16:37:07.010" LastActivityDate="2017-02-21T16:37:07.010" Title="Why are /30 subnet used for PPP connections?" Tags="|ipv4|subnet|adsl|ppp|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35160" PostTypeId="2" ParentId="35159" CreationDate="2016-09-22T19:51:06.780" Score="-4" Body="&lt;p&gt;The public IP addresses issued by the ISP's enable customer to have Internet routing, for example Skype or gaming - types of communication where endpoints need to communicate directly with one another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The /30 preserves public IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-09-22T21:22:34.157" LastActivityDate="2016-09-22T21:22:34.157" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="35161" PostTypeId="2" ParentId="35131" CreationDate="2016-09-22T19:55:45.200" Score="-1" Body="&lt;p&gt;Testing network reachability is the purpose behind sourcing a ping off of a specific network.  From a router's CLI, a simple ping uses the interface facing the packet destination as the source address.  An extended ping offers the ability to source the ping from a different connected interface (subnet), for example, the privately addressed LAN side subnet.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-22T19:55:45.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35162" PostTypeId="1" CreationDate="2016-09-22T20:23:45.173" Score="0" ViewCount="1801" Body="&lt;p&gt;I need to measure certain statistics, such as latency, packet delay, and jitter. Would it be possible to measure these statistics between 2 nodes by sniffing traffic on both ends and then comparing times between when the packets were captured? BTW It is likely the two nodes won't be able to see each other, but they could later down the road.&lt;/p&gt;&#xA;" OwnerUserId="30699" LastActivityDate="2018-03-18T04:06:20.607" Title="Measure latency and other statistics by comparing PCAPs" Tags="|latency|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35163" PostTypeId="2" ParentId="35159" CreationDate="2016-09-22T20:56:19.110" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;A /30 subnet is used for the two public IP addresses. Couldn't they&#xA;  just route our two IP addresses over our PPP link as isolated&#xA;  addresses that don't belong to any subnet? If my understanding is&#xA;  correct, this would allow them to effectively amount the number of&#xA;  &quot;address couples&quot; they can sell.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Well the way I see it is that they route 4 public IP addresses to you, and you decide whether to use them as one /30 subnet or as two /31 subnets or as 4 individual (/32) IP addresses - or even a combination of one /31 and two /32.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words if your ISP says they're routing the 10.0.0.0/30 &lt;em&gt;subnet&lt;/em&gt; to you then they actually mean that they're routing the  &lt;em&gt;ip address range&lt;/em&gt; 10.0.0.0-10.0.0.3 to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: adding an example to (hopefully) clarify further for those that do not understand.&#xA;Assume this scenario:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISProuter (a.b.c.1) ----- (a.b.c.2) MyRouter&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ISProuter has a route for x.y.z.4/30 with next-hop a.b.c.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then on MyRouter I have roughly 4 options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I configure x.y.z.5 on one of my interfaces, with a /30 subnet mask. In that case I can only use x.y.z.6 on another device (since .4 and .7 are the network and broadcast addresses in this scenario)&lt;/li&gt;&#xA;&lt;li&gt;I configure 4 loopback interfaces with x.y.z.4, x.y.z.5, x.y.z.6 and x.y.z.7, each with a /32 subnet mask&lt;/li&gt;&#xA;&lt;li&gt;I use x.y.z.4/31 and x.y.z.6/31 on 2 point-to-point links.&lt;/li&gt;&#xA;&lt;li&gt;I route x.y.z.4/30 to another router, and on that router I have again the same 4 options.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Note: there are also combinations possible, e.g. I could use x.y.z.4/32 on a loopback, route x.y.x.5/32 to another router, and use x.y.z.6/31 on a p2p link.&#xA;And depending on the features available on MyRouter (which could also be a load balancer, or a firewall, or...) the addresses could also be used without actually configuring them on an interface, but the result would be very similar to using them as /32's on a loopback.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A public subnet is used for the PPP link. Why is this the case? Since&#xA;  these IP addresses aren't publicly routed anyway, but only used by the&#xA;  two routers for the PPP link, isn't this a waste of the public address&#xA;  space?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You would need to ask the ISP, we can only guess. I guess most ISPs consider it best practice to use public IP addresses for public links. Private IP address might break stuff like PMTUD as ICMP from the 2 PPP endpoints would probably get dropped in a lot of places. But as @RonMaupin mentioned, they could have used a public /31 instead to save some address space.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-09-23T07:37:53.067" LastActivityDate="2016-09-23T07:37:53.067" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="35165" PostTypeId="2" ParentId="35162" CreationDate="2016-09-22T22:40:15.230" Score="1" Body="&lt;p&gt;You can't measure these statistics by sniffing traffic because most of packets would normally pass thru OSI layer 7 and response could be delayed due to application responding slowly and many other factors.&lt;/p&gt;&#xA;&lt;p&gt;As Ron mentioned you can use &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/ipsla/command/reference/sla_book/sla_02.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;IP SLA&lt;/a&gt; and draw graphs for example in Cacti or nProbe, NTOP could be as well used to collect jitter statistics. Netflow would be good source of information. For very simple measurments you can use tools like mtr.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-09-22T22:40:15.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35166" PostTypeId="1" AcceptedAnswerId="35167" CreationDate="2016-09-23T03:00:56.490" Score="2" ViewCount="152" Body="&lt;p&gt;I am trying to understand congestion control, specially in contrast to flow control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I understand so far: in flow control, the receiver advertises windows for the packet sequence numbers, so the sender knows how fast to send data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In congestion control, the sender stops sending data when the sequence number of its ACKs lags behind the sequence number it will use for sending packets: &quot;If I don't get ACKs, packets must be dropping, and that can be a problem in the network, so I should slowdown&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this view (roughly) correct? Does it depend on the TCP sender not being malicious? Because what if the sender does not slow down when the network is overloaded? It could steal bandwidth from other clients couldn't it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="29957" LastActivityDate="2017-03-22T08:44:10.673" Title="Is TCP congestion control vulnerable to malicious clients?" Tags="|tcp|ip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35167" PostTypeId="2" ParentId="35166" CreationDate="2016-09-23T05:01:43.097" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does it depend on the TCP sender not being malicious?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes it does. Your understanding is spot on.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It could steal bandwidth from other clients couldn't it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes it could. It would be a a form of Denial of Service (DoS) attack.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-09-23T05:01:43.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35168" PostTypeId="1" CreationDate="2016-09-23T06:33:44.183" Score="0" ViewCount="860" Body="&lt;p&gt;I am newbie here and also for IPv6 network.&#xA;I have one debian installed server which is able to send IPv6 traffic.&#xA;Now in my local network, ISP not supporting IPv6 traffic. I want to configure tunnel or VPN or NAT 64 using my server to pass IPv6 traffic over IPv4 from my local IPv4 only network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am very eager to learn this out. Please help me if any solution for such configuration.&lt;/p&gt;&#xA;" OwnerUserId="15624" LastActivityDate="2017-09-02T01:24:06.630" Title="Configure tunnel between IPv6 enabled server and local IPv4 network" Tags="|vpn|nat|ipv6|tunnel|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35169" PostTypeId="1" CreationDate="2016-09-23T09:10:07.083" Score="2" ViewCount="307" Body="&lt;p&gt;I have a Cisco 877 router, running IOS Version 12.4(24)T3, with 4 Ethernet ports and multiple external IP address attached to the internet connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I usually just nat the external addresses to internal ones but I have to install a Juniper Firewall for a third party which must connect directly to the web as the external ip needs to be configured on the wan interface of the firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is can I bind/bridge a single external IP to one of the Ethernet ports on the router so the firewall thinks its connected directly to the internet ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    show version &#xA;Cisco IOS Software, C870 Software (C870-ADVIPSERVICESK9-M), Version 12.4(24)T3, RELEASE SOFTWARE (fc2) Technical Support: cisco.com/techsupport Copyright (c) 1986-2010 by Cisco Systems, Inc. Compiled Tue 23-Mar-10 18:21 by prod_rel_team &#xA;&#xA;ROM: System Bootstrap, Version 12.3(8r)YI4, RELEASE SOFTWARE richadsl &#xA;uptime is 6 weeks, 1 day, 12 hours, 1 minute System returned to ROM by power-on System image file is &quot;flash:c870-advipservicesk9-mz.124-24.T3.bin&quot;&#xA;Cisco 877 (MPC8272) processor (revision 0x200) with 118784K/12288K bytes of memo ry. &#xA;Processor board ID FHK1123161T MPC8272 CPU Rev: Part Number 0xC, Mask Number 0x10 4 FastEthernet interfaces 1 ATM interface 128K bytes of non-volatile configuration memory. &#xA;28672K bytes of processor board System flash (Intel Strataflash)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30711" LastEditorUserId="2142" LastEditDate="2016-09-23T13:16:52.043" LastActivityDate="2017-10-19T15:03:11.487" Title="Bind IP To Port" Tags="|cisco|router|bridge|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35170" PostTypeId="2" ParentId="792" CreationDate="2016-09-23T09:59:48.543" Score="0" Body="&lt;p&gt;The main difference between HSRP &amp;amp; VRRP is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HSRP:&#xA;*It support IPv6.&#xA;*It uses virtual ip as a gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VRRP:&#xA;*It doesn't support IPv6.&#xA;*It uses real physical IP as a gateway.&lt;/p&gt;&#xA;" OwnerUserId="30712" LastActivityDate="2016-09-23T09:59:48.543" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35171" PostTypeId="2" ParentId="34117" CreationDate="2016-09-23T10:00:29.200" Score="-1" Body="&lt;p&gt;According to my own experience, it is a laughably misleading opinion. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, it will hurt the latency since the longer distance, but not bandwidth. Supposing you are comparing the internet speed of using the 10m fiber and 20m fiber, you will find that electrical signals travel through an ethernet cable at the speed of light, or 299,792,458 meters per second. That means that it takes about 0.00000003 seconds for the signal to travel through your 10m cable, and 0.00000006 seconds to travel through your 20m cable. You cannot notice the difference here. Not mention if you compare to many miles to whatever server you are accessing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, longer distance transmission indeed have signal loss and noise issue, which might have an impact on the internet speed.&lt;/p&gt;&#xA;" OwnerUserId="24835" LastActivityDate="2016-09-23T10:00:29.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35175" PostTypeId="2" ParentId="35169" CreationDate="2016-09-23T13:55:22.417" Score="1" Body="&lt;p&gt;You may wan to have a look at &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/integrated-routing-bridging-irb/17054-741-10.html&quot; rel=&quot;nofollow&quot;&gt;Integrated Routing and Bridging (IRB)&lt;/a&gt; but I'm not sure if (a) you can configure the LAN interfaces on a 877 separately and (b) if your existing NAT would still work (as you would need to move it to the BVI interface). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A possible alternative exists if the 3rd party can configure the Juniper to have a private IP address (from the range you currently use on the inside) as primary ip address on its WAN interface, and the public IP address as a secondary address (or loopback address, or whatever works). In that case you just add a static host route on your router like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 200.201.202.203 255.255.255.255 192.168.1.66&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;where 192.168.1.66 is the (private) primary ip address of the Juniper and 200.201.202.203 is the (public) secondary ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only other solution I can think of is the most common one, using a dedicated public /30 subnet from which you assign one ip address to the Juniper and one to your router.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-23T13:55:22.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35176" PostTypeId="2" ParentId="35145" CreationDate="2016-09-23T14:10:23.560" Score="3" Body="&lt;p&gt;Dirt, mostly. Trees are also bad, being essentially vertical accumulations of water, and water being bad news for 2.4 and 5 GHz (and several licensed bands as well) propagation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One aspect not mentioned so far is the &lt;a href=&quot;https://en.wikipedia.org/wiki/Fresnel_zone&quot; rel=&quot;nofollow&quot;&gt;Fresnel Zone&lt;/a&gt;, a roughly cigar-shaped area between antennas which means that you can have &quot;line of sight&quot; between two antennas and still get a lousy connection (or even no connection) due to excessive intrusion into that zone of radio-dense objects (commonly trees, dirt, and the more-or-less-equivalent to piles of trees and dirt things we call buildings.) Towers allow the elevation of radios to the point where an adequate amount of the Fresnel Zone is clear.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-09-23T14:10:23.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35177" PostTypeId="2" ParentId="35147" CreationDate="2016-09-23T14:26:24.313" Score="1" Body="&lt;p&gt;If the rest of your pfSense setup plays well with it, setting up your pfSense  so that squid can cache the updates really speeds things up, while limiting the WAN traffic. This may require more resources than many people seem to allocate to a pfSense install, and it spent quite a while being broken from 2.15 or so forward (I don't know if it's actually fixed for sure in the current release, it partly depends on what other things you are doing with pfSense, IIRC.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, set up a separate squid box, tuned to handle the rather portly things that are system updates, as opposed to the typical default tuning for smaller things that leaves updates out of the cache. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the third hand, setting up a local WSUS might be the most sensible approach for your location, if it's ONLY windows updates that are the issue. Otherwise all those hosts &lt;strong&gt;are&lt;/strong&gt; going to move all that traffic eventually, while having that set up will limit your WAN traffic to pulling down one copy.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-09-23T14:26:24.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35178" PostTypeId="1" AcceptedAnswerId="35179" CreationDate="2016-09-23T15:10:25.073" Score="1" ViewCount="3891" Body="&lt;p&gt;I am using cisco packet tracer 7.0. I am supposed to set isis as the routing protocol. But when try to do this in config mode, the router does not identify the command &quot;router isis&quot;. &#xA;When I enter router ? the following is shown:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Router(config)#router ?&#xA;&#xA;  bgp    Border Gateway Protocol (BGP)&#xA;&#xA;  eigrp  Enhanced Interior Gateway Routing Protocol (EIGRP)&#xA;&#xA;  ospf   Open Shortest Path First (OSPF)&#xA;&#xA;  rip    Routing Information Protocol (RIP)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is no isis here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me?&lt;/p&gt;&#xA;" OwnerUserId="30721" LastEditorUserId="509" LastEditDate="2016-09-23T19:08:03.270" LastActivityDate="2020-04-18T11:39:12.973" Title="How to enable isis in packettracer" Tags="|packet-tracer|is-is|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35179" PostTypeId="2" ParentId="35178" CreationDate="2016-09-23T15:15:23.507" Score="1" Body="&lt;p&gt;Try to issue command #ip router isis&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: &#xA;Cisco Packet Tracer doesn't support ISIS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Packet Tracer Supported Protocols:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Application •   FTP , SMTP, POP3, HTTP, TFTP, Telnet, SSH, DNS, DHCP,&#xA;NTP, SNMP, AAA, ISR VOIP, SCCP config and calls ISR&#xA;command support, Call Manager Express&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transport • TCP and UDP, TCP Nagle Algorithm &amp;amp; IP Fragmentation,&#xA;RTP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network •   BGP, IPv4, ICMP, ARP, IPv6, ICMPv6, IPSec, RIPv1/&#xA;v2/ng, Multi-Area OSPF, EIGRP, Static Routing, Route&#xA;Redistribution, Multilayer Switching, L3 QoS, NAT, CBAL&#xA;, Zone-based policy firewall and Intrusion Protection&#xA;System on the ISR, GRE VPN, IPSec VPN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network Access/&#xA;Interface&#xA;•   Ethernet (802.3), 802.11, HDLC, Frame Relay, PPP, PPPoE,&#xA;STP, RSTP, VTP, DTP, CDP, 802.1q, PAgP, L2 QoS, SLARP,&#xA;Simple WEP, WPA, EAP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/dam/en_us/training-events/netacad/course_catalog/docs/Cisco_PacketTracer_DS.pdf&quot; rel=&quot;nofollow&quot;&gt;source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2016-09-23T15:27:30.933" LastActivityDate="2016-09-23T15:27:30.933" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35181" PostTypeId="1" CreationDate="2016-09-23T18:35:20.233" Score="3" ViewCount="12739" Body="&lt;p&gt;What is the difference between PAP and MSCHAPv2 authentication?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looking at picking a RADIUS protocol for authentication with Microsoft NPS and trying to understand to pros / cons for PAP and MSCHAPv2.&lt;/p&gt;&#xA;" OwnerUserId="30725" LastActivityDate="2016-09-23T21:59:48.903" Title="RADIUS PAP vs MSCHAPv2" Tags="|radius|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35182" PostTypeId="2" ParentId="35181" CreationDate="2016-09-23T18:41:55.243" Score="1" Body="&lt;p&gt;PAP uses a two-way handshake for authentication, CHAP uses a three-way handshake for authentication, and MS-CHAPv2 adds mutual authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How you actually configure these depends on your router model, which you have not detailed in your question.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-23T18:41:55.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35183" PostTypeId="1" CreationDate="2016-09-23T19:34:26.110" Score="2" ViewCount="1169" Body="&lt;p&gt;I need to NAT the source address of the traffic from my local LAN going out of the ASA firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HGLXt.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HGLXt.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the diagram above, my outside interface IP on the ASA firewall is set at 192.168.12.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;q1) Am i able to set NAT on this outside interface to use another range of IP (e.g. 10.10.10.1)  as its source when routing traffic from the local LAN to Router 0 (10.10.10.2) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;q2) if the above is achievable,  how does Router 0 know how to send to the ASA firewall ?&#xA;Does it means that the ASA firewall will reply to ARP request for 10.10.10.1 even though its physical interface is set to 192.168.12.2 ?&#xA;Does it also means that I have to turn on PROXY-ARP on the ASA firewall outside interface in order for the setup to work ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;Noob&lt;/p&gt;&#xA;" OwnerUserId="16635" LastActivityDate="2021-07-30T20:05:15.403" Title="using NAT with a difference IP/range from the outside interface + proxy ARP" Tags="|cisco|nat|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35184" PostTypeId="2" ParentId="35183" CreationDate="2016-09-23T20:11:05.827" Score="1" Body="&lt;p&gt;You are changing the source address on the IP packets. Router0 will not ARP for an address in the range you are translating to because it knows it has no direct connection to that network. ARP only works for directly connected networks.&lt;/p&gt;&#xA;&lt;p&gt;What you need to do is to let Router0 and Router1 know to go to &lt;code&gt;192.168.12.2&lt;/code&gt; for any destination addresses in your translation range.&lt;/p&gt;&#xA;&lt;p&gt;This is routing 101. A router gets routes into its routing table from three different ways: directly connected networks, statically configured routes, and/or a routing protocol.&lt;/p&gt;&#xA;&lt;p&gt;Since your proposed network is not directly connected to either Router0 or Router1, you will need to either statically configure a route for it in those routers, or you will need to run a routing protocols with those routers and the ASA, and have the ASA tell those routers that it has your translation network via &lt;code&gt;192.168.12.2&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;You also need to somehow let the ASA know what networks are behind each of the other routers.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Based on the comments below, others think you are going to have the Router0 address in a different network than the Router1 and ASA addresses to which it connects. You can't do that unless the switch is a layer-3 switch and it routes between the interface to which Router0 connects and a VLAN to which Router1 and the ASA connect.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-09-23T21:35:55.960" CommentCount="25" ContentLicense="CC BY-SA 3.0" />
  <row Id="35185" PostTypeId="2" ParentId="35181" CreationDate="2016-09-23T21:59:48.903" Score="1" Body="&lt;p&gt;PAP sends the password to the RADIUS server (encrypted on the wire by the Radius protocol, but it is still decrypted on the server), MSCHAPv2 does not, it uses a challenge/response mechanism.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-23T21:59:48.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35187" PostTypeId="1" CreationDate="2016-09-24T01:17:41.753" Score="0" ViewCount="242" Body="&lt;p&gt;For instance, if switch A has hosts with mask /25 and switch B has hosts with /26. Will a ping from Host A to host B be successful?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does the situation change if:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Both switches are connected to a router and a default gateway is provided to all hosts.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The subnets are of different classes altogether (/10 and /25)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="30735" LastEditDate="2016-09-24T04:29:48.860" LastActivityDate="2016-09-24T16:19:03.293" Title="IP connectivity between hosts with differing subnet masks?" Tags="|switch|subnet|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35188" PostTypeId="2" ParentId="35187" CreationDate="2016-09-24T01:22:06.620" Score="0" Body="&lt;p&gt;&lt;strong&gt;Answer to your original question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If two switches are a part of different subnets, will they exchange&#xA;  messages if directly connected?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Switches don't look beyond the layer-2 frame to the layer-3 addresses to make decisions on where to switch frames, so the switches play no part in your scenarios, other than to switch frames to the ports where the destination layer-2 addresses are connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to look at is how the hosts are configured. A host will compare its network with the network of the destination address to see if they are the same. If they are in the same network, according to the mask configured on the interface, the host will ARP for the destination layer-2 address, or get it from its ARP cache. If the destination address is on a different network, the host will send the packet to its configured gateway.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Answer to your new question (&lt;em&gt;please, do not change your question after you have answers to the original question&lt;/em&gt;):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IP connectivity between hosts with differing subnet masks?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If one of the networks is contained within the other network, there are two possible answers:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If both host addresses fall within the range of the smaller network, then&#xA;there will be no problem communicating from either host to the&#xA;other. A ping from one host to the other will succeed.&lt;/li&gt;&#xA;&lt;li&gt;If one of the host addresses is not within the smaller network, then the host&#xA;from the larger network can send something to the host in the&#xA;smaller network, but the host in the smaller network will send&#xA;anything destined for the host in the larger network to its&#xA;configured gateway because it knows that it is in another network.&#xA;By default, a ping from one host to another will fail because the host in the smaller network will send a ping request or ping reply to its configured gateway, but a router&#xA;may possibly be configured to send an ICMP redirect to tell the host in the smaller network to send it directly to the other host.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you have hosts in two completely separate networks, any packets destined from one host to the other will be sent to the configured gateway of the sending host.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-09-24T16:19:03.293" LastActivityDate="2016-09-24T16:19:03.293" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35189" PostTypeId="2" ParentId="35187" CreationDate="2016-09-24T02:35:36.530" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;For instance, if switch A has hosts with mask /25 and switch B has hosts with /26. Will a ping from Host A to host B be successful?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That depends. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally each host will check the desintation address for it's packets against the &quot;network&quot; defined by it's IP and mask. If they are within that network they get sent &quot;directly&quot;, otherwise they do to the default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if host A is within what host B thinks is it's network and host B is within what host A thinks is it's network the ping will succeed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further complicating matters some operating systems will try and send packets directly if no default gateway is configured or the default gateway is set to the clients own IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IF a router is introduced and packets are sent to it it may router the packets between the hosts. If the router knowns the hosts are on the same network it may may also issue ICMP redirects to tell the clients they can talk directly.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-24T02:35:36.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35190" PostTypeId="1" AcceptedAnswerId="35198" CreationDate="2016-09-24T05:30:03.833" Score="0" ViewCount="1093" Body="&lt;p&gt;I have blocked in my router DHCP for all wired channels and even put the range for the one left, the wireless one, from .60 to .65 and put static IPs for the devices I want to allow to connect. Now theres a wired device that always gets an IP with .53 without DHCP being active. How is that possible? How can I block this unwanted device from getting an IP?&lt;/p&gt;&#xA;" OwnerUserId="30737" LastActivityDate="2016-09-24T12:26:59.120" Title="Device getting IP without DHCP" Tags="|ip|dhcp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35195" PostTypeId="2" ParentId="35190" CreationDate="2016-09-24T08:47:49.840" Score="0" Body="&lt;p&gt;Is this a Windows or linux box when yes, than the easiest and quickest way is to run wireshark on the device and filter the output to DHCP and there you can see that wo has assinged this IP to the device.&lt;/p&gt;&#xA;" OwnerUserId="21768" LastActivityDate="2016-09-24T08:47:49.840" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35196" PostTypeId="1" AcceptedAnswerId="35199" CreationDate="2016-09-24T11:39:00.757" Score="0" ViewCount="893" Body="&lt;p&gt;Hey I just started to learn &lt;code&gt;Networking&lt;/code&gt; and I have some problems understanding the &lt;code&gt;DNS&lt;/code&gt; and &lt;code&gt;DHCP&lt;/code&gt;. I tried many books but they defined it a total technical language and I can't understand them. So can anyone please explain me those terms in &lt;strong&gt;easy languages&lt;/strong&gt; and in &lt;strong&gt;easy terms&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="30750" LastActivityDate="2016-09-24T15:25:08.553" Title="Can anyone please explain me DNS and DHCP in easy languguage" Tags="|dhcp|dns|" AnswerCount="1" CommentCount="1" ClosedDate="2016-09-24T12:23:08.237" ContentLicense="CC BY-SA 3.0" />
  <row Id="35198" PostTypeId="2" ParentId="35190" CreationDate="2016-09-24T12:26:59.120" Score="1" Body="&lt;p&gt;A few obvious possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the host has a statically configured IP address, thus not needing DHCP&lt;/li&gt;&#xA;&lt;li&gt;the host has an old DHCP lease which is still being used&lt;/li&gt;&#xA;&lt;li&gt;there is another DHCP server in your network providing the host with a DHCP lease&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;One thing to keep in mind: refusing DHCP requests from specific hosts does in no way block them from accessing the network.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-09-24T12:26:59.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35199" PostTypeId="2" ParentId="35196" CreationDate="2016-09-24T12:28:26.783" Score="0" Body="&lt;p&gt;&lt;strong&gt;DNS&lt;/strong&gt; is used for access to websites using an easy address like &lt;code&gt;http://google.com&lt;/code&gt; instead of technical address &lt;code&gt;http://74.125.224.72&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xRlTG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xRlTG.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you enter to &lt;code&gt;http://google.com&lt;/code&gt; your computer first check its own &lt;strong&gt;DNS cache&lt;/strong&gt; to looking for the ip (If you have entered before it would be here).  If the ip cannot be found, the request is sent to the &lt;strong&gt;local DNS server&lt;/strong&gt;. If it still cannot be found then the request is sent to the &lt;strong&gt;Domain Root Server&lt;/strong&gt;. Finally the ip is sent to the host and saved in the cache for future requests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A graphic example:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/geFbm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/geFbm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DHCP&lt;/strong&gt; is a protocol used by the router to assign automatic the private ip address to each device in a network. There is 3 ways to assign ip addresses automatic to the hosts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;Manual Assignment&lt;/strong&gt;: The admin manually configure the ip addresses for the client in the DHCP server. When one host ask for one IP address, the server check the MAC address from the host y assigns the ip configured by the admin.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Automatic Assignment&lt;/strong&gt;: The first time that one host is connected, the DHCP server assign an ip randomly.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Dynamic Assignment&lt;/strong&gt;: The DHCP server assign an ip address temporarily. When the time is over the request has to be renovated.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is not a technical definition but I think it can help you to have a global idea.&lt;/p&gt;&#xA;" OwnerUserId="30752" LastEditorUserId="30752" LastEditDate="2016-09-24T15:25:08.553" LastActivityDate="2016-09-24T15:25:08.553" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35201" PostTypeId="2" ParentId="23942" CreationDate="2016-09-24T13:55:36.507" Score="-1" Body="&lt;p&gt;i think the firewall block the DHCP, disable your firewall. and maybe you have active packet filter in router.&lt;/p&gt;&#xA;" OwnerUserId="30755" LastActivityDate="2016-09-24T13:55:36.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35205" PostTypeId="1" CreationDate="2016-09-24T17:21:44.940" Score="1" ViewCount="4137" Body="&lt;p&gt;If a switch has a VLAN, and we delete the VLAN by the &lt;code&gt;no vlan&lt;/code&gt; command, then we reboot the switch, we again see the VLAN. How do we permanently delete this VLAN  with commands?&lt;/p&gt;&#xA;" OwnerUserId="30758" LastEditorUserId="8499" LastEditDate="2016-09-24T17:29:04.103" LastActivityDate="2017-08-21T23:24:06.757" Title="How do I permanently delete a VLAN?" Tags="|vlan|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35206" PostTypeId="2" ParentId="35205" CreationDate="2016-09-24T17:39:29.570" Score="2" Body="&lt;p&gt;You have not provided us with the switch model and configuration. If you provide that information, we can help you determine why the VLAN gets added to your switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a Cisco switch, there are several possibilities for why the removed VLAN reappears. You need to make sure that no interfaces (physical or virtual) are configured to use the VLAN, and if you are using VTP, that could be allowing the VLAN, and you would need to use pruning after making sure that no interface use the VLAN. If you are seeing the VLAN with the &lt;code&gt;show vlan&lt;/code&gt; command, it could be that a trunk is allowing the VLAN, and you can limit that on your trunks with the &lt;code&gt;switchport trunk allowed vlan&lt;/code&gt; command (manual pruning).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-24T17:39:29.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35207" PostTypeId="2" ParentId="35205" CreationDate="2016-09-24T17:48:26.190" Score="-3" Body="&lt;p&gt;vlan.dat is stored in the flash not nvram.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch#delete flash:vlan.dat&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30760" LastEditorUserId="8499" LastEditDate="2016-09-24T17:50:18.643" LastActivityDate="2016-09-24T17:50:18.643" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35208" PostTypeId="1" CreationDate="2016-09-24T17:59:02.470" Score="0" ViewCount="2994" Body="&lt;p&gt;Is a bridge a half or full duplex device?&lt;/p&gt;&#xA;" OwnerUserId="30759" LastEditorUserId="8499" LastEditDate="2016-09-24T18:10:41.457" LastActivityDate="2016-10-27T00:14:17.453" Title="Is a bridge a half or full duplex device?" Tags="|cisco|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35209" PostTypeId="2" ParentId="35208" CreationDate="2016-09-24T18:10:09.527" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is a bridge a half or full duplex device?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That depends on how the interfaces are configured and used. On a bridge (or a switch, which is a type of bridge), each interface is its own collision domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is only one device connected to the interface, and that device supports full duplex, then the bridge can run that interface in full duplex if the single device does because there are no possibilities for collisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are multiple device connected to that one interface, then there may be collisions, so the bridge interface must run in half duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside the bridge itself, there are no collisions, so frames can travel between the different ports simultaneously. In one sense, that may be called full duplex, but each bridge interface has its duplex set independently of how the other interfaces are set. Some could be full duplex, and some could be half duplex.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-24T18:10:09.527" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35212" PostTypeId="1" AcceptedAnswerId="35219" CreationDate="2016-09-25T00:54:01.720" Score="1" ViewCount="1139" Body="&lt;p&gt;I have two machines with IP1 and IP2 addresses. Is it possible to measure the round trip time for the packets to travel between these two machines from a machine with a different IP address?&lt;/p&gt;&#xA;" OwnerUserId="22239" LastActivityDate="2016-09-25T09:19:00.540" Title="Can we measure Round trip time between two machines without using either of them?" Tags="|ping|traceroute|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35215" PostTypeId="2" ParentId="35212" CreationDate="2016-09-25T02:02:47.807" Score="-1" Body="&lt;p&gt;maybe by port monitoring through their switch and capturing ping/icmp traffic between them! tracking the icmp packets and measuring RTT!!&lt;/p&gt;&#xA;" OwnerUserId="29715" LastActivityDate="2016-09-25T02:02:47.807" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35216" PostTypeId="1" AcceptedAnswerId="35217" CreationDate="2016-09-25T05:03:13.153" Score="1" ViewCount="73" Body="&lt;p&gt;In one of the Cisco docs, I read:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The FabricPath Layer 2 gateway switch will automatically propagate&#xA;  Topology Change Notifications (TCNs) on all its CE (Classical&#xA;  Ethernet) interfaces. The Layer 2 IS-IS messages will carry TCNs&#xA;  across the FabricPath network if proper STP configuration is made on&#xA;  the different switches.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why do the TCNs need to be carried across the Fabric path network?&#xA;Is the writer trying to convey that there are two separate STP domains&#xA;connected via the Fabric path network?&lt;/li&gt;&#xA;&lt;li&gt;Do I need to know the underlying details of ISIS to understand&#xA;fabric path? I mean, I just want to know enough to drive the car but&#xA;not intend to know the working of the car engine.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="8499" LastEditDate="2016-09-25T05:46:18.580" LastActivityDate="2016-09-25T05:46:18.580" Title="Regarding Fabric Path" Tags="|cisco|switching|layer2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35217" PostTypeId="2" ParentId="35216" CreationDate="2016-09-25T05:44:27.513" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Why do the TCNs need to be carried across the Fabric path network?&#xA;  Is the writer trying to convey that there are two separate STP domains&#xA;  connected via the Fabric path network?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because this creates a single, large layer-2 topology, the writer is conveying the fact that classical ethernet interfaces use TCNs, so FabricPath is backward compatible and can use switches that do not directly support it. FabricPath can connect multiple, separate STP domains in a single layer-2 domain. See &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/datacenter/sw/5_x/nx-os/fabricpath/configuration/guide/fp_interfaces.html#wp1671833&quot; rel=&quot;nofollow noreferrer&quot;&gt;FabricPath Interfaces&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xlKVR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xlKVR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;Do I need to know the underlying details of ISIS to understand&#xA;  fabric path? I mean, I just want to know enough to drive the car but&#xA;  not intend to know the working of the car engine.&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You would be shielded from many of the IS-IS details, but if you want a job as a network engineer in a data center, you should really understand how things work at a low level. If your car breaks down, you can rent one while you get a mechanic to repairs yours, but if your business is losing millions of dollars each minute your data center is down, that isn't practical; you need to be able to mitigate the damage immediately. IS-IS is an industry standard routing protocol that any network engineer should have some exposure to, anyway.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-25T05:44:27.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35218" PostTypeId="2" ParentId="32692" CreationDate="2016-09-25T07:55:29.513" Score="2" Body="&lt;p&gt;1 step: Create Address group by clicking on policy&amp;amp;Objects. Expand the objects and select address when select address you can create address group by giving name like blocked users.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Step: create address in same panel by selecting create new give username, select type from drop down IP range, Select subnet range/ IP range like 192.168.0.100-192.168.0.100 this an example. You give you user IP address as same way.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;3 Step: add users to blocked users group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4 step. Go to security profiles select web filtering on the right hand side top corner you will see add button with symbol + and select what types of website you need to allow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;5 step select application control select the categories social media to block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6 step select add signature you will get popup in that popup there will be search box type facebook you get all facebook related signatures select all of them and click on use selected signatures. Has same type youtube and do the same process as facebook.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;7 step: go to policy and objects create policy for incoming outgoing.&lt;/p&gt;&#xA;" OwnerUserId="30770" LastActivityDate="2016-09-25T07:55:29.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35219" PostTypeId="2" ParentId="35212" CreationDate="2016-09-25T09:19:00.540" Score="1" Body="&lt;p&gt;&lt;strong&gt;&lt;em&gt;no you can't&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Round-trip time (RTT), also called round-trip delay, is the time required for a signal pulse or packet to travel from a specific source &lt;strong&gt;&lt;em&gt;(IP1)&lt;/em&gt;&lt;/strong&gt; to a specific destination &lt;strong&gt;&lt;em&gt;(IP2)&lt;/em&gt;&lt;/strong&gt; and back again. In this context, the source is the computer initiating the signal and the destination is a remote computer or system that receives the signal and re transmits it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;user can determine the RTT to and from an IP (Internet Protocol) address by pinging that address. The result depends on various factors including The nature of the transmission medium (copper, optical fiber ) so you can't ignore it  &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-09-25T09:19:00.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35220" PostTypeId="1" AcceptedAnswerId="35233" CreationDate="2016-09-25T10:39:24.540" Score="1" ViewCount="2567" Body="&lt;p&gt;Hello I have don't really know the &lt;code&gt;TCP AIMD&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried many Google search results put all of them were in &lt;b&gt;technical language&lt;/b&gt; and is hard for me as &lt;b&gt;newbi&lt;/B&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So can someone please explain me the &lt;code&gt;TCP AIMD&lt;/code&gt; in a &lt;i&gt;&lt;b&gt;easy language&lt;/i&gt;&lt;/b&gt;???&lt;/p&gt;&#xA;" OwnerUserId="30750" LastActivityDate="2016-09-25T20:35:19.630" Title="Please describe the `AIMD` please?" Tags="|tcp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35221" PostTypeId="1" AcceptedAnswerId="35226" CreationDate="2016-09-25T11:07:48.267" Score="1" ViewCount="241" Body="&lt;p&gt;Which component (the traffic processor, the CPU or some other component) of a switch/router is responsible for packet classification/DPI? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, where along the data path is this operation performed (Is it in the input interface/ingress buffer or the input packet memory or some other place)?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dlDDC.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dlDDC.jpg&quot; alt=&quot;Data Path of a Switch&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30265" LastEditorUserId="8499" LastEditDate="2018-12-27T02:41:38.580" LastActivityDate="2018-12-27T02:41:38.580" Title="Deep Packet Inspection" Tags="|firewall|packet-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35222" PostTypeId="1" AcceptedAnswerId="35234" CreationDate="2016-09-25T12:46:42.987" Score="2" ViewCount="5302" Body="&lt;p&gt;Again a basic question. Switches communicate information to each other regarding VLANs using VTP, so each switch is aware of the VLANs. It's MAC address table is as one of the follows.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/BGnVz.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BGnVz.jpg&quot; alt=&quot;VLAN Table&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, why is VLAN tag required, since the frame's source MAC doesn't change, and a lookup can anyways be performed in the other switche's VLAN table?&lt;/p&gt;&#xA;" OwnerUserId="30265" LastActivityDate="2016-09-25T22:35:29.390" Title="Why is VLAN tagging required?" Tags="|vlan|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35223" PostTypeId="2" ParentId="35222" CreationDate="2016-09-25T13:03:07.100" Score="2" Body="&lt;p&gt;Switches don't exchange MAC address information through VTP or any other protocol.  The only way a switch can learn the destination port and VLAN of a MAC address is by recording the source MAC address and VLAN of inbound frames.  For VLAN trunks, tagging is required to show which VLAN the frame and source MAC address belong to.  VTP's purpose is to automate the creation of VLANs on a switch.  With VTP, once a VLAN is created on a VTP server, the clients (and any other servers) will have that VLAN created in their databases, with the same VLAN ID and name as the VTP server.  VTP doesn't contain any port VLAN information or MAC address tables.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-09-25T13:03:07.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35224" PostTypeId="1" CreationDate="2016-09-25T14:57:58.550" Score="1" ViewCount="3361" Body="&lt;p&gt;I have a bunch of internal computers, accessing a specific DNS server (internal Server).  I'd like to setup some redundancy, in the event that DNS Server goes down, and quickly set routes, at the router level to forward any traffic destined for the DNS Server (10.0.1.2) to (8.8.8.8) at the router level.  Is that possible?  I'm using Watchguard, but i'm not necessarily looking for a router specific answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client sends a DNS request to &lt;code&gt;10.0.1.2&lt;/code&gt;  The router, see's this, and re-routes to &lt;code&gt;8.8.8.8&lt;/code&gt; instead of &lt;code&gt;10.0.1.2&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="30773" LastEditorUserId="509" LastEditDate="2017-01-24T06:07:47.423" LastActivityDate="2020-12-19T16:18:23.160" Title="Can I route internal DNS requests to another server?`" Tags="|routing|router|dns|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35226" PostTypeId="2" ParentId="35221" CreationDate="2016-09-25T16:32:35.453" Score="2" Body="&lt;p&gt;Mostly, that would be done by a dedicated appliance, such as a next-generation firewall. Some vendors implement this as an optional service in software on routers, e.g. Cisco's NBAR2, performed using the router's CPU. The service is very CPU intensive, and the performance/throughput of a router running something like this is severely impacted, which is why you normally do this on a dedicated appliance.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-25T16:32:35.453" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35227" PostTypeId="2" ParentId="35224" CreationDate="2016-09-25T16:41:27.570" Score="0" Body="&lt;p&gt;If you want to translate a network address, that is called NAT. Most people use source translation with NAT, but you could also use destination translation. This can be done with some vendors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A problem with what you describe would be if the host making a DNS request is on the same network as the DNS server, then the traffic will never go through a router, so it will never be translated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, when using NAT, you will either always be translating, or you will need to manually configure it when there is a problem with a primary DNS server. A better method is to assign multiple DNS servers in the hosts, and most host OSes allow this. It can be done manually on each host, or through DHCP if that is how the hosts are addressed.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-25T16:41:27.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35228" PostTypeId="1" AcceptedAnswerId="35266" CreationDate="2016-09-25T16:50:49.733" Score="2" ViewCount="2068" Body="&lt;p&gt;I'm setting up BFD on BGP between ASR1k and ASR9k.&#xA;On 1k #show bfd neighbors details dosn't produce any output. Seems like BFD is not running. &#xA;CPU Proccess running on 1k: &#xA;BFD HW EVENT,  BFD IPV6 ADDR,  BFD Session creation BFD HA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are using double tagging on sub-interface and vrf. &#xA;any toughts what I'm missing? As per cisco configuration that should be easy to switch bfd on. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Please see below configuration:&#xA;router bgp 66000&#xA; bgp router-id 10.10.10.1&#xA; bgp log-neighbor-changes&#xA; timers bgp 10 30&#xA; !&#xA; address-family ipv4 vrf 1001&#xA;  redistribute connected&#xA;  redistribute static&#xA;  neighbor x.x.x.0 remote-as 65000&#xA;  neighbor x.x.x.0 ttl-security hops 2&#xA;  neighbor x.x.x.0 fall-over bfd multi-hop&#xA;  neighbor x.x.x.0 activate&#xA;  neighbor x.x.x.0 soft-reconfiguration inbound&#xA;  neighbor y.y.y.0 remote-as 65000&#xA;  neighbor y.y.y.0 ttl-security hops 2&#xA;  neighbor y.y.y.0 fall-over bfd single-hop&#xA;  neighbor y.y.y.0 activate&#xA;  neighbor y.y.y.0 soft-reconfiguration inbound&#xA;  maximum-paths 2&#xA;  default-information originate&#xA; exit-address-family&#xA; !&#xA;&#xA;ASR1K1#sh run int gi0/0/0.3999&#xA;interface GigabitEthernet0/0/0.3999&#xA; description Ethernet Primary WAN&#xA; encapsulation dot1Q 3999 second-dot1q 1&#xA; vrf forwarding 1001&#xA; ip address x.x.x.1 255.255.255.254&#xA; bfd interval 500 min_rx 100 multiplier 3&#xA;end&#xA;&#xA;ASR1K1#sh run int Gi0/0/1.3999&#xA;Building configuration...&#xA;&#xA;Current configuration : 267 bytes&#xA;!&#xA;interface GigabitEthernet0/0/1.3999&#xA; description Ethernet Secondary WAN&#xA; encapsulation dot1Q 3999 second-dot1q 1&#xA; vrf forwarding 1001&#xA; ip address y.y.y.1 255.255.255.254&#xA; bfd interval 500 min_rx 100 multiplier 3&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Command show bfd neighbors deosn't show anything.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASR1K1#sh bfd neighbors vrf 1001 details &#xA;ASR1K1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ASR9k show bfd session destination x.x.x. detail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-------------------------------------ASR9k-1----------------------------------&#xA;RP/0/RSP0/CPU0:ASR9k1#sh bfd session destination x.x.x.1 detail &#xA;Sun Sep 25 17:34:50.176 BST&#xA;&#xA;Location: 0/2/CPU0&#xA;Dest: x.x.x.1&#xA;Src: x.x.x.0&#xA;VRF Name/ID: 1001/0x60000008&#xA; State: DOWN for 0d:5h:32m:3s, number of times UP: 0&#xA; Session type: SW/V4/MH&#xA;Received parameters:&#xA; Version: 0, desired tx interval: 0 us, required rx interval: 0 us&#xA; Multiplier: 0, diag: None&#xA; My discr: 0, your discr: 0, H/D/F/P/C/A: 0/0/0/0/0/0&#xA;Transmitted parameters:&#xA; Version: 1, desired tx interval: 2 s, required rx interval: 2 s&#xA; Multiplier: 3, diag: None&#xA; My discr: 25523, your discr: 0, state DOWN, D/F/P/C/A: 0/0/0/1/0&#xA;Timer Values:&#xA; Local negotiated async tx interval: 2 s&#xA; Remote negotiated async tx interval: 2 s&#xA;async detection time: 0 us&#xA;Local Stats:&#xA; Intervals between async packets:&#xA;   Tx: Number of intervals=100, min=1665 ms, max=1998 ms, avg=1853 ms&#xA;       Last packet transmitted 338 ms ago&#xA;   Rx: Number of intervals=0, min=0 s, max=0 s, avg=0 s&#xA;       Last packet received 0 s ago&#xA;MP download state: BFD_MP_DOWNLOAD_ACK&#xA;State change time: Sep 25 12:02:46.886&#xA;Session owner information:&#xA;                            Desired               Adjusted&#xA;  Client               Interval   Multiplier Interval   Multiplier&#xA;  -------------------- --------------------- ---------------------&#xA;  bgp-default          500 ms     3          2 s        3         &#xA;  bgp-default          500 ms     3          2 s        3      &#xA;&#xA;-------------------------------------ASR9k-2----------------------------------      &#xA;&#xA;RP/0/RSP0/CPU0:ASR9k2#sh bfd session destination y.y.y.1 detail &#xA;Sun Sep 25 17:34:05.477 BST&#xA;I/f: GigabitEthernet0/3/0/0.3999, Location: 0/3/CPU0&#xA;Dest: y.y.y.1&#xA;Src: y.y.y.0&#xA; State: DOWN for 2d:1h:34m:36s, number of times UP: 0&#xA; Session type: PR/V4/SH&#xA;Received parameters:&#xA; Version: 0, desired tx interval: 0 us, required rx interval: 0 us&#xA; Required echo rx interval: 0 us, multiplier: 0, diag: None&#xA; My discr: 0, your discr: 0, H/D/F/P/C/A: 0/0/0/0/0/0&#xA;Transmitted parameters:&#xA; Version: 1, desired tx interval: 2 s, required rx interval: 2 s&#xA; Required echo rx interval: 1 ms, multiplier: 3, diag: None&#xA; My discr: 456472645, your discr: 0, state DOWN, D/F/P/C/A: 0/0/0/1/0&#xA;Timer Values:&#xA; Local negotiated async tx interval: 2 s&#xA; Remote negotiated async tx interval: 2 s&#xA; Desired echo tx interval: 500 ms, local negotiated echo tx interval: 0 us&#xA; Echo detection time: 0 us, async detection time: 0 us&#xA;Local Stats:&#xA; Intervals between async packets:&#xA;   Tx: Number of intervals=100, min=1664 ms, max=2 s, avg=1846 ms&#xA;       Last packet transmitted 1811 ms ago&#xA;   Rx: Number of intervals=0, min=0 s, max=0 s, avg=0 s&#xA;       Last packet received 0 s ago&#xA; Intervals between echo packets:&#xA;   Tx: Number of intervals=0, min=0 s, max=0 s, avg=0 s&#xA;       Last packet transmitted 0 s ago&#xA;   Rx: Number of intervals=0, min=0 s, max=0 s, avg=0 s&#xA;       Last packet received 0 s ago&#xA; Latency of echo packets (time between tx and rx):&#xA;   Number of packets: 0, min=0 us, max=0 us, avg=0 us&#xA;Session owner information:&#xA;                            Desired               Adjusted&#xA;  Client               Interval   Multiplier Interval   Multiplier&#xA;  -------------------- --------------------- ---------------------&#xA;  bgp-default          500 ms     3          2 s        3         &#xA;  bgp-default          500 ms     3          2 s        3         &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2016-09-25T17:03:22.077" LastActivityDate="2016-09-26T22:25:03.927" Title="BFD on BGP at ASR 1k" Tags="|bgp|cisco-asr|bfd|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="35229" PostTypeId="2" ParentId="35222" CreationDate="2016-09-25T16:53:30.667" Score="2" Body="&lt;p&gt;The Source or Destination MAC address does &lt;em&gt;not&lt;/em&gt; have to be unique across different VLANs. Therefore, you can not create a correlation between the MAC address of the frame and the VLAN the frame should be in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take First Hop Redundancy Protocols (HSRP/VRRP), for example. You could have a pair of L3 switches doing HSRP/VRRP for five different VLANs. If each VLAN uses the same VRRP ID# then each VRRP Gateway IP address will share the same MAC address (00-00-5E-00-01-&amp;lt;&lt;em&gt;ID#&lt;/em&gt;&gt;). You would then have the exact same MAC address in five different VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real reason you need VLAN Tagging is to distinguish VLAN traffic on a port where multiple VLANs can exist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans/#access_port&quot; rel=&quot;nofollow noreferrer&quot;&gt;access port&lt;/a&gt; is a port which carries traffic for only one VLAN. A &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans/#trunk_port&quot; rel=&quot;nofollow noreferrer&quot;&gt;Trunk port&lt;/a&gt; is a port which carries traffic for multiple VLANs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Trunk ports, all the frames are still carried across the wire in the form of &lt;code&gt;1&lt;/code&gt;s and &lt;code&gt;0&lt;/code&gt;s.  Something has to exist in order for the sending switch to indicate to the receiving switch which &lt;code&gt;1&lt;/code&gt;s and &lt;code&gt;0&lt;/code&gt;s belong to which VLAN. That &lt;em&gt;something&lt;/em&gt; is a &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans/#tagged-untagged&quot; rel=&quot;nofollow noreferrer&quot;&gt;VLAN Tag&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VLAN Tag will be added whenever a frame is crossing a trunk port and removed when the other switch receives the frame. It will look like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HhgNl.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HhgNl.gif&quot; alt=&quot;VLAN Tags being added and removed on Trunk Ports&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read more about VLANs and how they work in &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt;, and how to configure them on Cisco switches in &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/configuring-vlans/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-09-25T16:53:30.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35233" PostTypeId="2" ParentId="35220" CreationDate="2016-09-25T20:35:19.630" Score="1" Body="&lt;p&gt;AIMD Stands for Additive Increase and Multiplicative Decrease.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Now Increase and Decrease of what?... Ans: Congestion Window size (CWND)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let me take a step back and shed some light on few prerequisites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever, a sender has to send some traffic over the network without creating congestion and without worry of re-transmitting, it should see two things:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. Client Receive Window size (RWS)&#xA;2. Congestion Window Size (CWND)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For faster transfer, a sender generally doesn't send a single packet and waits for the client to ack it and then send the next packet (Stop-And-Wait).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To figure out how many packets can be sent in burst without waiting for their acknowledgement, Sender uses &lt;code&gt;Receive window Size (RWS)&lt;/code&gt;advertised by receiver in tcp-handshake. On the other hand, Sender detects congestion in the network by the number of re-transmission and decrements this number, which we call CWND i.e. &lt;code&gt;Congestion windows size&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a congestion is detected by the sender, it definitely needs to slow down and hence reduce the size of its CWND. Congestion in the network is unpredictable so after reducing the CWND, there is a fair amount of chance that congestion in the network decreases and the sender can increase CWND.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For these reasons, sender starts with a low value of CWND and with every successful transmission it &lt;code&gt;additively increases&lt;/code&gt; CWND e.g. 1,2,3,4... hoping that congestion won't occur. When the packets start getting dropped, it &lt;code&gt;reduces CWND multiplicatively&lt;/code&gt;. This makes sure that for next transmission, possibility of congestion is pretty less and overall congestion in the network is sustainable.&lt;/p&gt;&#xA;" OwnerUserId="30781" LastActivityDate="2016-09-25T20:35:19.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35234" PostTypeId="2" ParentId="35222" CreationDate="2016-09-25T22:35:29.390" Score="1" Body="&lt;p&gt;U can understand this better if you consider the data path of a frame in a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose Switch A has 24 ports(can be any number), this switch is has been configured to have 3 vlans, namely &#xA;vlan 10 for ports 0-10&#xA;vlan 20 for port 11-20&#xA;and the default vlan - vlan 1 for ports 21-24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if this switch receives a frame destined for port 11 (vlan 20), but the frame does not have a vlan tag.&#xA;The switch will assume it to be a part of the default vlan and look up in the part its L2DA table for the default Vlan.&#xA;Ofcourse it wouldn't find an entry for port 11 in the table (because entry for port 11 is in the part L2DA table reserved for vlan 20)&#xA;Now as the switch coudn't find the required MAC address in its table, it ll do what switches do best ! BROADCAST&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But remember vlans do not receive broadcast messages. &#xA;So the frame never reaches its destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short, for correct delivery, Switch needs to look in the correct portion of its L2DA table and for that we need vlan tags.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helps.   &lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2016-09-25T22:35:29.390" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="35236" PostTypeId="1" AcceptedAnswerId="35237" CreationDate="2016-09-26T05:08:35.947" Score="0" ViewCount="149" Body="&lt;p&gt;I have a problem in understanding the network address when calculating it from an IPv4 address and the subnet mask.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP Address:       192.168.10.131  | 11000000.10101000.00001010.10000011    &#xA;&#xA;Subnet Mask:      255.255.255.192 | 11111111.11111111.11111111.11000000  &#xA;&#xA;Network Address:  192.168.10.128  | 11000000.10101000.00001010.10000000  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Theoretically, we know that all 1s in the subnet mask identify the network portion while 0s identify the host portion, but here I can guess that the network address is 192.168.10 portion ( all 1s) but WHY 131 is NOT included in the network portion as it also has 1s in it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the subnet mask was &lt;code&gt;255.255.255.0 | 11111111.11111111.11111111.00000000&lt;/code&gt;then it would be straightforward because there is no 1s in the last octet so it would have been classified as a host portion, but in the above subnet mask, it is confusing as it has 1 in the last octet as well. Please help. Thanks a lot!  &lt;/p&gt;&#xA;" OwnerUserId="30494" LastActivityDate="2016-09-26T06:01:53.823" Title="Confusion in calculating the network address (Tricky One)" Tags="|subnet|ip-address|" AnswerCount="1" CommentCount="0" ClosedDate="2016-09-26T13:53:12.727" ContentLicense="CC BY-SA 3.0" />
  <row Id="35237" PostTypeId="2" ParentId="35236" CreationDate="2016-09-26T05:24:42.470" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;WHY 131 is NOT included in the network portion as it also has 1s in it.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The first two bits of the fourth octet in the &quot;IP Address&quot; (highlighted with * below) &lt;strong&gt;are&lt;/strong&gt; included in the network portion. This is because the first two bits of the fourth octet in the &quot;Subnet Mask&quot; (highlighted with ! below) dictates this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                                               **&#xA;IP Address:       192.168.10.131  | 11000000.10101000.00001010.10000011    &#xA;&#xA;                                                               !!&#xA;Subnet Mask:      255.255.255.192 | 11111111.11111111.11111111.11000000  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In other words, the subnet mask determines how many bits are network bits. Because the subnet mask takes the two most significant bits from the fourth octet (128 + 64), we get a subnet mask with its fourth octet set to 192.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the host address uses the two least significant bits (1 + 2), we get 3. When that 3 is added to the last octet of the network address (128 + 3), we get 131.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, in case you're interested I've written &lt;a href=&quot;http://www.oznetnerd.com/2013/08/31/subnetting-made-easy-index/&quot; rel=&quot;nofollow&quot;&gt;quite a few blog posts&lt;/a&gt; on subnetting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDITING&lt;/strong&gt; to respond to your comment - &quot;You basically told me how to calculate subnet mask (128 + 64) = 192, but the question was why 131 is a host address?&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The host address is found simply by adding the host bits to the subnet bits when the two are in the same octet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take another look at the example you gave:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                                                 HHHHHH&#xA;IP Address:       192.168.10.131  | 11000000.10101000.00001010.10000011    &#xA;                                                               SS&#xA;Subnet Mask:      255.255.255.192 | 11111111.11111111.11111111.11000000  &#xA;                                                               NN&#xA;Network Address:  192.168.10.128  | 11000000.10101000.00001010.10000000  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The 'S' bits represent bits which have been 'reserved' as Subnet mask bits.&lt;/li&gt;&#xA;&lt;li&gt;The 'N' bits represent the Network address bits.&lt;/li&gt;&#xA;&lt;li&gt;The 'H' bits represent the Host bits.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Notice how the &quot;IP Address&quot; section's first two bits are identical to the &quot;Network Address'&quot; first two bits. This is how we know that the Host address resides in that Network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find the host's IP address we add all of the Host bits together - 128 + 2 + 1 = 131.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As mentioned above, I have explained this in great detail on my blog. &lt;a href=&quot;http://www.oznetnerd.com/2016/03/27/subnetting-made-easy-part-6/&quot; rel=&quot;nofollow&quot;&gt;This post&lt;/a&gt; is most relevant to your question.&lt;/p&gt;&#xA;" OwnerUserId="129" LastEditorUserId="129" LastEditDate="2016-09-26T06:01:53.823" LastActivityDate="2016-09-26T06:01:53.823" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35239" PostTypeId="1" CreationDate="2016-09-26T07:14:27.293" Score="0" ViewCount="218" Body="&lt;p&gt;I have a LAN with about 120 PCs, in the last 2 weeks I am facing a problem, the network sometimes go very slow and sometimes the users cannot reach the internet ( the router will be unreachable) and I have to restart the router and the switches, So I am starting using wireshark, Is this traffic in the picture normal? If No, what is thealt text solution?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yFJnl.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yFJnl.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30786" LastActivityDate="2016-09-26T11:46:11.010" Title="MDNS protocol is normal?" Tags="|lan|" AnswerCount="1" CommentCount="0" ClosedDate="2017-08-15T04:02:24.427" ContentLicense="CC BY-SA 3.0" />
  <row Id="35241" PostTypeId="2" ParentId="35239" CreationDate="2016-09-26T07:56:38.533" Score="1" Body="&lt;p&gt;mDNS is used (amongst others) by Apple's &lt;a href=&quot;https://en.wikipedia.org/wiki/Bonjour_(software)&quot; rel=&quot;nofollow&quot;&gt;Bonjour service&lt;/a&gt;, so if 192.168.0.28, .89 and .240 are Apple devices this is normal, if they are Windows devices running Apple software (e.g. iTunes) this is also normal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Multicast_DNS&quot; rel=&quot;nofollow&quot;&gt;The wikipedia article about mDNS&lt;/a&gt; also mentions other zeroconf implementations use mDNS, such as &lt;a href=&quot;https://en.wikipedia.org/wiki/Avahi_(software)&quot; rel=&quot;nofollow&quot;&gt;Avahi&lt;/a&gt; in Linux.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this answers your question &quot;is mDNS normal?&quot;; if you would like help troubleshooting the actual problem I suggest you post a separate question for that, with more details about the network (make and model of the network devices, their configuration, a topology drawing) and more details about the problem.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-09-26T11:46:11.010" LastActivityDate="2016-09-26T11:46:11.010" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35243" PostTypeId="1" CreationDate="2016-09-26T10:27:08.140" Score="2" ViewCount="883" Body="&lt;p&gt;I use paramiko from (www.paramiko.org) to automate logging into Cisco devices and then checking logs, interface stats, anything i want really. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When i log into a device i am into a Management VRF. I don't have internet access. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If i want to test something for a customer, i need to do something like &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping vrf CUSTOMER_A 8.8.8.8 source Vlan 250&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What i would like to do is make use of python to do things like &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;wget &lt;br&gt;&lt;br&gt;&#xA;  speedtest-cli from GitHub &lt;br&gt;&lt;br&gt;&#xA;  basically emulate being on the customers end device &lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, so far i have been unable to get close.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has any fellow networkers ever tried something like this ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A&lt;/p&gt;&#xA;" OwnerUserId="8109" LastEditorUserId="509" LastEditDate="2016-09-26T10:40:19.510" LastActivityDate="2016-10-28T01:02:00.803" Title="Running programs on a Cisco device" Tags="|cisco|" AnswerCount="3" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="35244" PostTypeId="1" AcceptedAnswerId="35247" CreationDate="2016-09-26T11:42:19.493" Score="2" ViewCount="3371" Body="&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/ypTKi.png&quot; alt=&quot;networking question&quot;&gt;&#xA;above i have two L3 switches. &#xA;ESW1 has vlan 10 and 20&#xA;ESW2 has vlan 10 and 30 (the same ten)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when i configure OSPF on both ESW1 and ESW2 it doesn't neighbor.&#xA;I want OSPF to advertise vlan 20 to ESW2 and vlan 30 to ESW1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did create a SVI for Vlan 20 on ESW2 and 30 on ESW3 so they could talk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to know if its possible to have OSPF advertising the unique Vlans to each other in area 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ESW1 Config &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1 &#xA;no ip address &#xA;shutdown &#xA;! &#xA;interface Vlan10 &#xA;ip address 10.10.10.254 255.255.255.0 &#xA;ip ospf network point-to-point &#xA;! &#xA;interface Vlan20&#xA; ip address 10.10.20.254 255.255.255.0 &#xA;! &#xA;router ospf 1 &#xA;log-adjacency-changes &#xA;network 10.10.20.0 0.0.0.255 area 0 &#xA;! &#xA;ip forward-protocol nd &#xA;! &#xA;! &#xA;no ip http server &#xA;no ip http secure-server &#xA;! &#xA;no cdp log mismatch duplex &#xA;! &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ESW 2 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! &#xA;interface Vlan1 &#xA;no ip address &#xA;shutdown &#xA;! &#xA;interface Vlan10 &#xA;ip address 10.10.10.253 255.255.255.0 &#xA;ip ospf network point-to-point &#xA;! &#xA;interface Vlan30 &#xA;ip address 10.10.30.254 255.255.255.0 &#xA;! &#xA;router ospf 1 &#xA;log-adjacency-changes &#xA;network 10.10.30.0 0.0.0.255 area 0 &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30789" LastEditorUserId="2142" LastEditDate="2016-09-26T13:04:19.783" LastActivityDate="2016-09-26T22:59:36.500" Title="OSPF question over dot1q trunk" Tags="|routing|ospf|switching|" AnswerCount="3" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="35245" PostTypeId="2" ParentId="35228" CreationDate="2016-09-26T12:04:55.507" Score="1" Body="&lt;p&gt;if BFD Session Not Coming Up, may you follow the next steps to overcome this issue:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Was the session created by the application?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Use the &quot;show bfd all session&quot; command to see if the session has been created. If the session is not visible using the bfd show command, check that the adjacency for which the BFD session is being created exists in the application.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can you ping the destination address for which the BFD session is to&#xA;be created?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The BFD session will only be created by an application for which the application adjacency/neighbour exists.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Has BFD been configured on both sides?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Has BFD been configured with correct destination address?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Using non-default IP addresses with BFD requires special attention. The source IP address being used for BFD sessions can be verified with &quot;show bfd all session detail&quot; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;also you can find useful troubleshooting steps in this link &lt;a href=&quot;https://supportforums.cisco.com/document/144626/bfd-support-cisco-asr9000#bfd-session-going-down&quot; rel=&quot;nofollow&quot;&gt;support&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-09-26T12:04:55.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35246" PostTypeId="2" ParentId="35244" CreationDate="2016-09-26T12:10:19.947" Score="0" Body="&lt;p&gt;the &lt;strong&gt;dot1q trunk&lt;/strong&gt; is &lt;strong&gt;L2&lt;/strong&gt; , so you should configure &lt;strong&gt;&lt;em&gt;L3 link&lt;/em&gt;&lt;/strong&gt; between the 2 switches.&#xA;you may need to configure &lt;strong&gt;&lt;em&gt;link aggregation&lt;/em&gt;&lt;/strong&gt; between the two switches then assign IPs in &lt;strong&gt;&lt;em&gt;same range&lt;/em&gt;&lt;/strong&gt; for the two switches and then try the &lt;strong&gt;&lt;em&gt;OSPF&lt;/em&gt;&lt;/strong&gt;  configurations.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-09-26T12:10:19.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35247" PostTypeId="2" ParentId="35244" CreationDate="2016-09-26T13:02:59.623" Score="3" Body="&lt;p&gt;You need to include VLAN 10 in your OSPF configuration.  You have only specified that OSPF uses the interfaces on VLANs 20 and 30.  OSPF needs a common subnet in order to create adjacencies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can add the network statement&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network 10.10.10.0 0.0.0.255 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to your OSPF config on both routers&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-26T13:02:59.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35249" PostTypeId="1" CreationDate="2016-09-26T14:19:40.837" Score="0" ViewCount="995" Body="&lt;p&gt;My camera IP is in range of 192.168.x.x and I'm using IP in the range of 10.x.x.x  series DHCP. When I assign my PC a static IP 10.x.x.x and additional &lt;strong&gt;ip 192.168.x.x&lt;/strong&gt;  I am able to ping my camera ip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I ping my camera without adding my secondary IP?&lt;/p&gt;&#xA;" OwnerUserId="30795" LastEditorUserId="8499" LastEditDate="2018-12-21T05:21:41.610" LastActivityDate="2018-12-21T05:21:41.610" Title="Unable to ping 192.168.x.x series" Tags="|router|dhcp|ping|route-server|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35250" PostTypeId="2" ParentId="35249" CreationDate="2016-09-26T14:27:02.210" Score="1" Body="&lt;p&gt;your 10.x.x.x gateway should be able to reach the range of the camera ip, so that your pc could reach it . make sure that your GW could reach the range of the camera &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-09-26T14:27:02.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35251" PostTypeId="1" AcceptedAnswerId="35253" CreationDate="2016-09-26T14:31:52.830" Score="1" ViewCount="109" Body="&lt;p&gt;I am trying to better understand how routing works in practice. &#xA;Which sources of information (can) go into the forwarding decision that a router makes? I have learned that BGP Updates from neighboring routers are just one source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(My question relates to this answer in a previous thread: &lt;a href=&quot;https://networkengineering.stackexchange.com/a/35052/30613&quot;&gt;https://networkengineering.stackexchange.com/a/35052/30613&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="30613" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-09-26T15:06:44.060" Title="Which sources of information are used to forward packets?" Tags="|routing|bgp|ip-forwarding-table|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35253" PostTypeId="2" ParentId="35251" CreationDate="2016-09-26T15:04:31.960" Score="0" Body="&lt;p&gt;A routing table gets routes in three ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Directly connected networks&lt;/li&gt;&#xA;&lt;li&gt;Statically configured routes&lt;/li&gt;&#xA;&lt;li&gt;Routing protocols (RIP, EIGRP, IS-IS, OSPF, BGP, etc.)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It is possible that the routing process could receive multiple routes to the same destination from separate sources. The routing process must decide which of the possible routes to a destination to use. &lt;strong&gt;The first thing it looks at is the length of the mask, and the route to a destination with the longest mask wins.&lt;/strong&gt; If there are still multiple routes of the same length, it needs a tie-breaker. Cisco call this AD (Administrative Distance), which is really how trusted the source of the route is. For instance, a directly connected network is the most trusted, and it will be used. There are tables, e.g. &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/15986-admin-distance.html#topic1&quot; rel=&quot;nofollow noreferrer&quot;&gt;What Is Administrative Distance?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Select the Best Path&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Administrative distance is the first criterion that a router uses to determine which routing protocol to use if two protocols provide route&#xA;  information for the same destination. Administrative distance is a&#xA;  measure of the trustworthiness of the source of the routing&#xA;  information. Administrative distance has only local significance, and&#xA;  is not advertised in routing updates.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; The smaller the administrative distance value, the more reliable the protocol. For example, if a router receives a route to a&#xA;  certain network from both Open Shortest Path First (OSPF) (default&#xA;  administrative distance - 110) and Interior Gateway Routing Protocol&#xA;  (IGRP) (default administrative distance - 100), the router chooses&#xA;  IGRP because IGRP is more reliable. This means the router adds the&#xA;  IGRP version of the route to the routing table.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If you lose the source of the IGRP-derived information (for example,&#xA;  due to a power shutdown), the software uses the OSPF-derived&#xA;  information until the IGRP-derived information reappears.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Default Distance Value Table&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;This table lists the administrative distance default values of the protocols that Cisco supports:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RWyLM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RWyLM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;If the administrative distance is 255, the router does not believe the source of that route and does not install the route in the routing&#xA;  table.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="2142" LastEditDate="2016-09-26T15:06:44.060" LastActivityDate="2016-09-26T15:06:44.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35255" PostTypeId="1" AcceptedAnswerId="35258" CreationDate="2016-09-26T16:22:02.097" Score="0" ViewCount="773" Body="&lt;p&gt;A printer was sent out to a location with a static IP from its previous location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Printer 123 was on subnet 192.168.5.0/24 in Branch A with a static IP of 192.168.5.5. Printer 123 was sent to branch B with a different network 172.16.4.0/24, BUT the static IP from branch A was never removed from Printer 123. Now it is sitting in Branch B with a static IP from its old network. How can I access the web interface to change it to DHCP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Proposed solution:&#xA;If I place the switch port that the printer is connected to on its own vlan and place the vlan IP on its same network but a 192.168.5.0/30 (4 IP's 2 usable)just enough to cover the printer's static IP so it can be accessed, would that cause any issues with the routing tables? There is already a route that points traffic to 192.168.5.0/24 out a particular interface. The majority of the traffic (95%) from this branch forwards to branch A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would my solution work? is there an easier way? Apparently restoring to default does not work, then again I do not have an IT guy out there to ensure it actually is being restored to default settings.&lt;/p&gt;&#xA;" OwnerUserId="14372" LastActivityDate="2016-09-26T17:32:30.180" Title="access printer with static IP in a different network" Tags="|routing|subnet|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35256" PostTypeId="2" ParentId="35255" CreationDate="2016-09-26T16:25:59.810" Score="0" Body="&lt;p&gt;You can use 802.1Q (QinQ) tunnelling to reach your printer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can find example: &lt;a href=&quot;https://networklessons.com/switching/802-1q-tunneling-q-q-configuration-example/&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2016-09-26T16:25:59.810" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35257" PostTypeId="2" ParentId="34778" CreationDate="2016-09-26T17:11:55.013" Score="2" Body="&lt;p&gt;Ingress policing on OVS is not implemented using OpenFlow, but is implemented as a &lt;a href=&quot;https://en.wikipedia.org/wiki/Token_bucket&quot; rel=&quot;nofollow&quot;&gt;Token Bucket&lt;/a&gt;, according to the &lt;a href=&quot;http://openvswitch.org/ovs-vswitchd.conf.db.5.pdf&quot; rel=&quot;nofollow&quot;&gt;OVS manual&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;The size of the bucket corresponds to ingress_policing_burst. Initially the bucket is full.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Whenever a packet is received, its size (converted to tokens) is compared to the number&#xA;  of tokens currently in the bucket. If the required number of tokens are available, they are&#xA;  removed and the packet is forwarded. Otherwise, the packet is dropped.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Whenever it is not full, the bucket is refilled with tokens at the rate specified by&#xA;  ingress_policing_rate.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That said, considering the Token bucket starts full and its size equal to the limit you are imposing, then, depending on the network activity, it might take some time to have the bucket nearly empty and start dropping packets. &lt;/p&gt;&#xA;" OwnerUserId="30276" LastActivityDate="2016-09-26T17:11:55.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35258" PostTypeId="2" ParentId="35255" CreationDate="2016-09-26T17:32:30.180" Score="4" Body="&lt;p&gt;Solution 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IF it is ok for branch B to loose access to 192.168.5.0/24 temporarily, then on the branch B router's LAN interface  configure a secondary ip address 192.168.5.X (this needs to be the gateway configured on the printer!). Then configure a static /32 route for 19.168.5.5 on all hops between you and branch B, pointing to branch B (or have the router at B inject a /32 into your routing protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of using a secondary address you could also create a new vlan interface as you said, and put the printer in that vlan, but it cannot be a /30 (unless the printer's gateway happens to be .6 which seems very unlikely) so you probably just want the full /24 and make sure it is not redistributed in your routing protocol, and then inject a /32 again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solution 2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use vnc, rdp etc. to remotely control a PC in branch B. Configure a secondary ip address 192.168.5.x on its nic. Then access the printer GUI from there.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-26T17:32:30.180" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35259" PostTypeId="1" AcceptedAnswerId="35270" CreationDate="2016-09-26T18:34:10.530" Score="0" ViewCount="2613" Body="&lt;p&gt;Since the TCP header doesn't indicate the length of the packet, how does the underlying IP layer in the transmitter know the length of a TCP packet, and in the receiver, how does the TCP layer know the length of the received packet? Does TCP exchange such information with IP as additional information?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although TCP is a streaming protocol, the data is sent in segments whose length could be any value between 1 and the maximum segment size. IP needs to know this length information for encapsulation. Should TCP tell IP the length? In the receiver, the length information is abandoned after IP deencapsulation. Does IP pass it to TCP (length=total length-IP header length)?&lt;/p&gt;&#xA;" OwnerUserId="30801" LastEditorUserId="775" LastEditDate="2016-09-26T19:37:31.107" LastActivityDate="2016-09-26T23:43:24.187" Title="About TCP packet length" Tags="|tcp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35264" PostTypeId="2" ParentId="2173" CreationDate="2016-09-26T21:14:53.113" Score="1" Body="&lt;p&gt;Since newer FortiOS versions have been released, there is also a way to view open ports on the Web Interface:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Activate the Local In Policy view via &lt;em&gt;System &gt; Config &gt; Features&lt;/em&gt;, Toggle on &lt;em&gt;Local In Policy&lt;/em&gt; in the Show More menu.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Go to &lt;em&gt;Policy &amp;amp; Objects &gt; Local In&lt;/em&gt;  and there you have a overview of the active listening ports.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="30816" LastActivityDate="2016-09-26T21:14:53.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35266" PostTypeId="2" ParentId="35228" CreationDate="2016-09-26T22:25:03.927" Score="2" Body="&lt;h3&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/asr9000/software/asr9k_r3-9/interfaces/configuration/guide/hc39asr9kbook/hc39bifw.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Bidirectional Forwarding Detection on the Cisco ASR 9000 Series Router&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;p&gt;&lt;strong&gt;Restrictions for Configuring BFD&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The following restrictions apply to BFD:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If you are using BFD with uRPF on a particular interface, then you need to use the &lt;code&gt;echo disable&lt;/code&gt; command to disable echo mode on that interface; otherwise, echo packets are rejected. You can disable echo mode for the entire router, or for an individual interface.&lt;/li&gt;&#xA;&lt;li&gt;Only the static, OSPF, and IS-IS applications are supported on BFD over bundle VLANs.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-09-26T22:25:03.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35267" PostTypeId="2" ParentId="2173" CreationDate="2016-09-26T22:33:09.890" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://docs.fortinet.com/uploaded/files/1880/FortinetOpenPorts.pdf&quot; rel=&quot;nofollow&quot;&gt;Ports used by Fortinet&lt;/a&gt; was released May 9, 2014&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Destination • Port Protocol(s) • Application(s) • Function(s)&#xA;&#xA;&#xA;21 TCP FTP • Log and Report uploads from FortiAnalyzer&#xA;• Anti-defacement backup and restoration (FTP). Listening on&#xA;FortiWeb&#xA;• FTP configuration backup from FortiWeb to other device&#xA;22 TCP SSH • SSH Command line based management:&#xA;• From Admin Workstation to Fortinet Device&#xA;22 TCP FTP over SSH • Log and Report uploads:&#xA;• To and from FortiCloud&#xA;• To and from FortiAnalyzer&#xA;• Anti-defacement backup and restoration (SSH/SCP) from FortiWeb&#xA;to other device&#xA;• SFTP configuration backup from FortiWeb to other device&#xA;23 TCP Telnet • Telnet Command line based management from Admin Workstation&#xA;to Fortinet devices&#xA;• HA (FGCP) between HA FortiGates&#xA;25 TCP SMTP • Alert Emails&#xA;• From FortiAnalyzer to SMTP Mail Server&#xA;• From FortiGate to SMTP Mail Server&#xA;• From FortiWeb to SMTP Mail Server&#xA;• Encrypted Virus Samples auto submitted to FortiGuard&#xA;49 TCP TACACS+ • TACACS+ from FortiAnalyzer&#xA;53 UDP DNS • DNS Lookups&#xA;• To DNS Servers&#xA;• To FortiGuard&#xA;4&#xA;4&#xA;53 UDP Fortinet Queries • FortiGuard Server List requests to FortiGuard&#xA;• AntiSpam or Web Filtering rating lookup queries to FortiGuard&#xA;• URL/AS rating lookup queries to FortiGuard&#xA;• Real-time Black List(RBL) lookup requests to RBL services&#xA;67 UDP DHCP • DHCP to and from FortiGate&#xA;68 UDP DHCP Relay • DHCP Relay to and from FortiGate&#xA;69 UDP TFTP • TFTP for backups, restoration, and firmware updates from FortiWeb&#xA;to other device&#xA;80 TCP • Default unsecure Web-based Management of Fortinet Device&#xA;• Admin Workstation to FortiAnalyzer&#xA;• Admin Workstation to FortiAuthenticator&#xA;• Admin Workstation to FortiGate&#xA;• Admin Workstation to FortiManager&#xA;• Admin Workstation to FortiWeb&#xA;80 TCP HTTP • Proxied HTTP traffic from FortiGate&#xA;80 TCP HTTP • Fortinet Device Registration to FortiGuard&#xA;• AV update requests from FortiClient to FortiManager&#xA;• Server health checks from FortiWeb to other device&#xA;• Predefined HTTP service. Only occurs if the service is used by a&#xA;policy, listening on FortiWeb&#xA;80 TCP Simple Certificate Enrollment&#xA;Protocol (SCEP)&#xA;• Issuing and revocation of digital certificates&#xA;• Listening on FortiAuthenticator&#xA;88 TCP Kerboros • Account Authentication traffic from FortiAuthenticator to Active&#xA;Directory Controllers&#xA;123 UDP NTP • Time Synchronization from Fortinet Device to NTP Server&#xA;135 TCP Client/Server (WMI, SEL) • FortiAuthenticator to Active Directory Controllers&#xA;137 UDP • Win Share to and from FortiAnalyzer (Not supported in FAZ v5.0/5.2)&#xA;• Anti-defacement backup and restoration (Windows-style share) from&#xA;FortiWeb to other device.&#xA;138 UDP • Win Share to and from FortiAnalyzer (Not supported in FAZ v5.0/5.2)&#xA;• Anti-defacement backup and restoration (Windows-style share) from&#xA;FortiWeb to other device.&#xA;5&#xA;5&#xA;139 TCP/UDP NetBIOS • Win Share to and from FortiAnalyzer (Not supported in FAZ v5.0/5.2)&#xA;• Anti-defacement backup and restoration (Windows-style share) from&#xA;FortiWeb to other device.&#xA;161 UDP Simple Network Management&#xA;Protocol (SNMP)&#xA;• SNMP Poll&#xA;• FortiManager to FortiGate&#xA;• Listening on FortiAuthenticator&#xA;• Listening on FortiWeb&#xA;162 UDP Simple Network Management&#xA;Protocol (SNMP) Traps&#xA;• To SysLog server&#xA;• To FortiAnalyzer&#xA;• To FortiManager&#xA;389 TCP/UDP LDAP • LDAP Lookups, Authentication Requests and Report queries&#xA;• PKI Authentication&#xA;• To Active Directory Domain Controllers&#xA;• To FortiAuthenticator&#xA;• To LDAP Server&#xA;443 TCP HTTPS • Default Secure Web-based Management of Fortinet Device&#xA;• Admin Workstation to Fortinet Device&#xA;• Firmware and Signature Downloads from FortiGuard&#xA;• FGD SMS to FortiGuard&#xA;• FC FTM to FortiGuard&#xA;• FC Licensing to FortiGuard&#xA;• Policy Override Auth to FortiGuard&#xA;• AntiVirus/IPS updates to FortiGuard&#xA;• URL/AS update requests to FortiGuard&#xA;• Remote Vulnerability Scan updates to FortiGuard&#xA;• Device Registration requests to FortiGuard&#xA;• Server health checks from FortiWeb to other devices&#xA;• Proxied HTTPS traffic from FortiGate to Proxy Server&#xA;• FSSO Portal and Widget traffic&#xA;6&#xA;6&#xA;443 TCP Representational state transfer&#xA;(REST) API / HTTP&#xA;• Listening on FortiAnalyzer&#xA;445 TCP Microsoft-DS Active Directory,&#xA;Windows shares&#xA;• Domain Controller Polling&#xA;• FortiAuthenticator to Active Directory Domain Controller&#xA;• Listening on FortiAnalyzer&#xA;• NTLM authentication queries.&#xA;• Anti-defacement backup and restoration (Windows-style share)&#xA;from FortiWeb to other device.&#xA;500 UDP IPsec • Secure SNMP over IPsec connection&#xA;• FortiGate to FortiAnalyzer&#xA;514 TCP/UDP Syslog messages OFTP • Device Registration&#xA;• From FortiManager to FortiAnalyzer&#xA;• From FortiGate to FortiAnalyzer&#xA;• Quarantined files to FortiAnalyzer&#xA;• Logs and Reports&#xA;• To SysLog server&#xA;• To FortiAnalyzer&#xA;• To FortiCloud&#xA;• To FortiManager&#xA;• OFTP for file submission and statistics exchange&#xA;• Between FortiGate and FortiSandbox (FortiCloud)&#xA;520 UDP Routing Information Protocol (RIP) • Listening on FortiGate&#xA;541 TCP • Device Registration • Central Management from FortiManager&#xA;• SSL Management Tunnel to FortiCloud&#xA;636 TCP Lightweight Directory Access&#xA;Protocol over TLS/SSL (LDAPS)&#xA;• Encrypted LDAP authentication traffic from&#xA;• Fortinet Devices to Active Directory Domain Controllers&#xA;• Fortinet Devices to LDAP servers (including FortiAuthenticator)&#xA;703 TCP FGCP L2 • HA Heartbeat between HA FortiGates&#xA;1000 TCP • Policy Override Keepalive listening on FortiGate&#xA;(Closed by default, but can be enabled)&#xA;7&#xA;7&#xA;1003 TCP • Policy Override Keepalive listening on FortiGate&#xA;(Closed by default, but can be enabled)&#xA;1812 TCP RADIUS • RADIUS Authentication Requests&#xA;• To FortiAuthenticator&#xA;• To RADIUS Server&#xA;1813 UDP RADIUS • RADIUS Accounting to FortiAuthenticator&#xA;2049 TCP NFS • Network File System listening on FortiAnalyzer (Not supported in&#xA;FAZ v5.0/5.2)&#xA;2302 TCP • HTTP or HTTPS administrative access to web-based manager's CLI&#xA;dashboard widget(v3.0 MR5 only)&#xA;• Listening on FortiAnalyzer&#xA;• Listening on FortiGate&#xA;2560 TCP Online Certificate Status Protocol&#xA;(OCSP)&#xA;• Obtaining the revocation status of an X.509 digital certificate,&#xA;listening on FortiAuthenticator&#xA;3000 TCP • Log aggregation listening on FortiAnalyzer&#xA;(Log aggregation server support requires model FortiAnalyzer&#xA;800 or greater)&#xA;3306 TCP • Remote MySQL database connection listening on FortiAnalyzer&#xA;3784 UDP BFD • Listening on FortiGate&#xA;4500 UDP IPsec • Secure SNMP over IPsec connection&#xA;• FortiGate to FortiAnalyzer&#xA;• FortiGate to FortiManager&#xA;5199 TCP • HA Heartbeat or synchronization listening on FortiManager&#xA;6055 UDP • HA heartbeat. Layer 2 multicast.&#xA;• From FortiWeb to other device&#xA;• Listening on FortiWeb&#xA;6056 UDP • HA configuration synchronization. Layer 2 multicast.&#xA;• From FortiWeb to other device&#xA;• Listening on FortiWeb&#xA;8&#xA;8&#xA;8000 TCP FSSO • Windows Active Directory Collector Agent for Fortinet Single Sign-On&#xA;• From Active Directory Collector to FortiGate&#xA;• From FortiAuthenticator to FortiGate&#xA;• From FortiGate to FortAuthenticator&#xA;8001 TCP SSO Mobiltity Agent • This port is used to pass userid and IP address information from&#xA;FortiClient to FortiAuthenticator.&#xA;(This functionality is not necessary for the completion of phase 1)&#xA;8002 TCP/UDP FSSO • UDP (for plain traffic), or TCP (for encrypted traffic)&#xA;• FortiAuthenticator listening for traffic - Hierarchical FSSO Info from&#xA;Tier Supplier&#xA;8003 TCP FSSO • FortiAuthenticator listening for traffic from DS/TS Agents with FSSO&#xA;Login information&#xA;8008 TCP • User authentication for policy override of HTTP traffic listening on&#xA;FortiGate&#xA;8009 TCP • FortiClient Portal listening on FortiGate 1000A, 3600A, and 5005FA2&#xA;only&#xA;8010 TCP • User authentication for policy override of HTTPS traffic from&#xA;FortiClient to FortiGate&#xA;(This port and IP address must be load balanced between all four&#xA;FortiGate 1500Ds)&#xA;8333 TCP • Configuration replication.&#xA;• From FortiWeb to other device&#xA;• Listening on FortiWeb&#xA;8888 UDP • Application and Signature updates requests, FortiGuard AntiSpam or&#xA;Web Filtering rating lookup requests and URL/AS Rating requests&#xA;• FortiClient to FortiGuard&#xA;• FortiGate to FortiGuard&#xA;• FortiClient to FortiManager&#xA;• FortiGate to FortiManager&#xA;• FortiGuard Server List&#xA;• FortiClient to FortiGuard&#xA;• FortiGate to FortiGuard&#xA;9&#xA;9&#xA;8890 TCP • A/V, IPS signature, AntiSpam and Web Filtering update requests&#xA;• FortiGate to FortiManager&#xA;• FortiManger to FortiGuard&#xA;8890 ETH Layer&#xA;2&#xA;• Between FortiGate and FortiManager for FortiGuard Updates&#xA;8900 TCP • VPN Settings distribution to authenticated FortiClient installations&#xA;• FortiClient to FortiGate&#xA;9443 UDP • AV/IPS Push&#xA;• FortiGuard to FortiGate&#xA;• FortiGuard to FortiManager&#xA;• FortiManager to FortiGate&#xA;10443 TCP • Connection to SSL-VPN Portals, listening on FortiGate&#xA;10151 TCP • Contract validation from FortiGate to FortiCloud&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-26T22:33:09.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35268" PostTypeId="2" ParentId="35249" CreationDate="2016-09-26T22:40:55.503" Score="0" Body="&lt;p&gt;Enable DHCP on your camera....&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-26T22:40:55.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35269" PostTypeId="2" ParentId="35244" CreationDate="2016-09-26T22:47:38.297" Score="0" Body="&lt;p&gt;OSPF does not advertise VLAN information.  Cisco's VTP does.  OSPF does not form peering sessions like BGP does, it establishes &lt;em&gt;neighbor relationships&lt;/em&gt;; the time to live &lt;a href=&quot;http://www.freesoft.org/CIE/RFC/1583/100.htm&quot; rel=&quot;nofollow&quot;&gt;(TTL) value of OSPF packets is 1&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To get your OSPF processes to establish a neighbor relationship, each layer 3 switch (aka router) needs to share a layer2 (Ethernet) link and IP subnet.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-09-26T22:59:36.500" LastActivityDate="2016-09-26T22:59:36.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35270" PostTypeId="2" ParentId="35259" CreationDate="2016-09-26T23:43:24.187" Score="2" Body="&lt;p&gt;In general communication standards only discuss stuff that is visible to other hosts on the network. API standards usually only discuss the interface between the OS and applications. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is clearly nessacery to pass some metadata (size, addresses etc) between the &quot;transport&quot; and &quot;internet&quot; layers but how exactly this is done is an implementation detail.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-26T23:43:24.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35271" PostTypeId="2" ParentId="22289" CreationDate="2016-09-27T01:06:18.647" Score="0" Body="&lt;p&gt;JMeter runs on a standalone machine, separate from the application server you are testing (see &lt;a href=&quot;http://wiki.apache.org/jmeter/JMeterFAQ&quot; rel=&quot;nofollow&quot;&gt;The JMeter FAQ&lt;/a&gt;).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Network Bandwidth Downlink&quot; site:wiki.apache.org - did not match any documents on a Google site search so it seems like you are seeing/using a custom GUI implementation / input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The JMeter GUI would run on a 3rd machine.  So, from the perspective of the GUI, &lt;em&gt;Network Bandwidth Downlink&lt;/em&gt; would seem to represent the JMeterEngine NIC ingress traffic and &lt;em&gt;Network Bandwidth Uplink&lt;/em&gt; would seem to represent the JMeterEngine NIC egress traffic.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-09-27T01:06:18.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35272" PostTypeId="2" ParentId="17845" CreationDate="2016-09-27T01:12:05.240" Score="0" Body="&lt;p&gt;BGP is the standard way to exchange routes between autonomous systems.&lt;/p&gt;&#xA;&lt;p&gt;If you have only a single link to the internet then you have no real reason to dynamically exchange routes with your ISP. They can point a static route in your direction, you point you default gateway to them and that is the end of it.&lt;/p&gt;&#xA;&lt;p&gt;If you are multihomed either to multiple PoPs of the same ISP or to multiple ISPs you want to dynamically advertise your prefix to your ISPs. The reason for this is if one ISP link goes down you want your traffic to be rerouted.&lt;/p&gt;&#xA;&lt;p&gt;If you are multihomed to different ISPs then you may also want to consider receiving routes over BGP. Sometimes ISPs lose routes to parts of the internet, if you are just using default gateways you won't see this whereas if you are importing full tables the traffic should just shift over. On the other hand importing full tables may overwhelm older/cheaper routers.&lt;/p&gt;&#xA;&lt;p&gt;If you are getting into peering relationships then you will certainly need to talk BGP to find out what prefixes a peer is prepared to take traffic for.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2020-12-31T15:46:50.533" LastActivityDate="2020-12-31T15:46:50.533" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="35279" PostTypeId="1" CreationDate="2016-09-27T06:07:37.200" Score="-1" ViewCount="48" Body="&lt;p&gt;My ISP has filtered some websites and i can't access them by my web browser . But i can ping that websites . How could be this happen ?&lt;/p&gt;&#xA;" OwnerUserId="30461" LastActivityDate="2016-09-27T06:21:17.920" Title="Why the filtered website is pinged?" Tags="|ping|route-filter|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35280" PostTypeId="2" ParentId="35279" CreationDate="2016-09-27T06:21:17.920" Score="1" Body="&lt;p&gt;Ping uses ICMP whereas web browsing uses HTTP (TCP port 80) and HTTPS (TCP port 443). It sounds like the two TCP ports have been blocked but ICMP has not.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-09-27T06:21:17.920" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35281" PostTypeId="2" ParentId="35249" CreationDate="2016-09-27T06:29:54.590" Score="2" Body="&lt;p&gt;First, devices with different IPs do not belong in the same network. 10.0.0.0/8 does not cover 192.168.0.0/16. The reason adding the second IP works is because the devices are on the same L2 network, but it's very mickey mouse.  So you have the following options;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Change the IP on your camera to something in the 10.x.x.x range that's within the subnet you're currently using. Easiest way to accomplish this is to do as Ron says and enable DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) You add a second network to your nearest router/gateway, in the 192.168.0.0/16 to suit you camera, and make it shuffle packets between both networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My suggestion is that you try option 1, preferably DHCP first. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-09-27T06:29:54.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35282" PostTypeId="1" CreationDate="2016-09-27T07:14:48.233" Score="6" ViewCount="639" Body="&lt;p&gt;This is a capture of a TCP session when I was downloading the 10Mb file from an FTP server. The server has an ICW of 10x MSS, so this means that the server can initially send 10 segments without receiving an ACK from the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dw5o7.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dw5o7.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being said that, every two segments have been ACKed in real-time, and the server has sent all the 10 segments to the client that has already ACKed all the segments. Now, the server waited from 15:40:31:864 to 15:40:31:901 for more than 50ms until it begins sending new segments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder, why the server has paused sending more segments, although all the segments have already been ACKed? I know that it waited for the RTO value, but why would the server do this when all the ACKs have received?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your answer. However, I need some elaboration here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DHstv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DHstv.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above is the RTT for the stream, and as you can see the average RTT for the first part (until SEQ# 2600000) is around 30ms. So, initially at the server side, the cwin has been populated and filled in with 10 segments ready to be sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presumably:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first two packets have already been sent from the server at -&gt; 15:40:31.842 and has been received at the client (on which I'm capturing) at -&gt; 15:40:31.862 at the same moment, client sent one delayed ACK to the server at -&gt; 15:40:31.862 and presumably received by the server at -&gt; 15:40:31.882&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this time, the cwin will be sliding, getting rid of the old two segments, and making a room for two new segments to be sent to the client, the two new segments will be ready to be sent unless the cwin or the rwin of the client is exhausted which is not in our case, or the server is waiting for an ACK, which is also not valid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the server had 10 segments, sent 8, got an ACK for the first 2, slid the cwin to the right, got two new segments. Now cwin has 10 segments to go again, non-stoppable. My question is, why the server paused its transmission at this stage?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can take a look at the below tcptrace for the first part of the stream:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ws7Dz.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ws7Dz.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The slope is relaxed (not steep), and you can see that every around 50ms there is a pause for no reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the middle part of the connection:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6xNU0.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6xNU0.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The slope is much steeper without those gaps in between, and no pauses. Taking into consideration that the RTT is the same for both parts, and you can confirm this with the RTT graph&lt;/p&gt;&#xA;" OwnerUserId="30813" LastEditorUserId="42290" LastEditDate="2017-12-13T11:56:35.407" LastActivityDate="2021-08-20T15:43:35.667" Title="TCP Flow-control questions that drives me mad" Tags="|tcp|wireshark|tcpdump|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35283" PostTypeId="2" ParentId="33638" CreationDate="2016-09-27T08:57:22.563" Score="2" Body="&lt;p&gt;You can set a quota via the web filter profile. The quota can be configured per category, and the category action need to be set to either &lt;code&gt;Monitor / Warning / Authenticate&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The quota can be a traffic or time restriction, and is on a per user basis. For further information please refer to the FortiOS Handbook, the chapter name is:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Configuring FortiGuard Category Quotas&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2TGRN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2TGRN.png&quot; alt=&quot;FortiGuard Quota Rules&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30816" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-10-10T08:06:21.247" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35285" PostTypeId="1" AcceptedAnswerId="35288" CreationDate="2016-09-27T11:04:15.083" Score="0" ViewCount="67" Body="&lt;p&gt;I've read this &lt;code&gt;SDN&lt;/code&gt; &lt;a href=&quot;http://www.netsec.ethz.ch/publications/papers/fleet-hotsdn-2014.pdf&quot; rel=&quot;nofollow&quot;&gt;paper&lt;/a&gt; that mainly discusses:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Malicious administrator problem, where a network administrator&#xA;  misconfigures a correctly functioning controller in a way that&#xA;  adversely affects network performance.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Kindly, can someone explain what is &lt;code&gt;network configuration&lt;/code&gt;? Are firewalls and IDSs examples of such network configuration?&lt;/p&gt;&#xA;" OwnerUserId="19174" LastEditorUserId="29562" LastEditDate="2016-09-27T13:40:58.113" LastActivityDate="2016-09-27T13:40:58.113" Title="The actual definition of network configuration" Tags="|network-core|sdn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35286" PostTypeId="2" ParentId="35282" CreationDate="2016-09-27T11:12:19.303" Score="3" Body="&lt;p&gt;Assuming this is a client-side capture, you need to take into account that there is a round-trip delay between your client and server, so these timestamps show when the client sent/received packets, not when the server received/sent them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. if client sends an ACK at T=0ms, it arrives at the server at T=50ms, suppose that even if the server responds in less than 1ms the response is sent at T=50ms and it arrives at the client at e.g. T=110ms (since the delay may not be constant and can also vary per direction). So in your client side capture you would see ACK at T=0ms and next data at T=110ms, but that doesn't mean the server waited 110ms to respond. It simply means that the total time of (transmission of ACK + processing on server + transmission of data) = 110ms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to know for sure, you would need to capture on the server (preferably at the same time as a capture on the client). Without a server-side capture we can only guess, but it seems quite likely that you have a delay of &lt;em&gt;around&lt;/em&gt; 20ms between your client and your server, and hence a RTT (round-trip time) of &lt;em&gt;around&lt;/em&gt; 40ms (but again, the delay can be different for each packet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: the above values of 20/40ms were based on the timestamps you mentioned, 15:40:31:864 to 15:40:31:901 (which is actually only 37ms), but really you need to look at the first ACK (sent at 15:40:31.862, frame 33) and the data packet in frame 47, received at 15:40:31.922 so the RTT there was 60ms.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;Edit after Update 1 &amp;amp; 2&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As already mentioned in the comments, I don't think that the server send 8 segments and then paused, I think it sent 10 segments (frames 31-32,34-35,37-38,40-41,43-44), then it paused until it received frame 33 ( the ACK to the first 2 segments); after it received this ACK it then sent frame 47 &amp;amp; 48 etc. Again this is an assumption and a server-side capture would be required to confirm, but this seems quite normal expected behaviour to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for what happens later on in the connection, without looking at actual captures it seems reasonable to assume that because of &lt;a href=&quot;https://en.wikipedia.org/wiki/TCP_congestion_control#Slow_start&quot; rel=&quot;nofollow&quot;&gt;TCP Slow Start&lt;/a&gt;, the cwin will increase in size,  so the server can send more segments before waiting for an ACK, and at some point the cwin is large enough for the server to keep sending data without waiting for ACKs (as long as the ACKs keep being received at a relatively steady rate).&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-09-29T07:58:21.967" LastActivityDate="2016-09-29T07:58:21.967" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35288" PostTypeId="2" ParentId="35285" CreationDate="2016-09-27T11:49:34.850" Score="2" Body="&lt;p&gt;Basically (simplified) an SDN controller allows an administrator to configure various settings on network devices (which may include switches, routers, firewalls, ... anything that has an appropriate northbound API/protocol that the controller can use).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So &lt;code&gt;network configuration&lt;/code&gt; seems to refer to the sum of all these settings, as defined by the administrator. In other words 'network configuration' can consist of vlan names and numbers, port settings, forwarding rules and drop rules, etc.etc. What exactly &lt;em&gt;is&lt;/em&gt; or &lt;em&gt;is not&lt;/em&gt; part of the configuration depends on the actual controller being used, and what the API or SDN protocol (e.g. openflow) of the network devices supports.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-09-27T11:49:34.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35293" PostTypeId="2" ParentId="34182" CreationDate="2016-09-27T13:29:12.063" Score="1" Body="&lt;p&gt;I have found an answer for this question:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; I would like to know how I must interpret the &quot;show tcp detail pcb&quot; and specifically the following line (IOS XR device): &#xA;&amp;gt; &#xA;&amp;gt; Datagrams (in bytes): MSS 1460, peer MSS 1460, min MSS 1946, max MSS 1946 &#xA;&amp;gt; &#xA;&amp;gt; Is the IOS XR device using MSS 1460 or MSS 1946. &#xA;&#xA;Its using 1460. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.gossamer-threads.com/lists/cisco/nsp/186322#186322&quot; rel=&quot;nofollow&quot;&gt;http://www.gossamer-threads.com/lists/cisco/nsp/186322#186322&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, according my output (MSS 1240, peer MSS 9152, min MSS 1240, max MSS 1240), the ASR9K is limiting its outgoing TCP segments to 'MSS 1240'.&lt;/p&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-09-27T13:29:12.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35294" PostTypeId="1" CreationDate="2016-09-27T15:30:30.280" Score="1" ViewCount="1655" Body="&lt;p&gt;I know a layer 2 switch floods the frame out asking who has a certain mac address. My question is how does it know what mac address to ask for in the first place?&#xA;Scenario: A brand new switch is implemented. 5 Hosts a re connected. Host A sends a message to Host B. How does A know what the mac address is of Host B in the first place? &lt;/p&gt;&#xA;" OwnerUserId="30824" LastEditorUserId="8499" LastEditDate="2020-02-09T04:36:41.187" LastActivityDate="2020-02-09T04:36:41.187" Title="Layer 2 Switch Mac Address" Tags="|switch|switching|mac|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35295" PostTypeId="2" ParentId="35294" CreationDate="2016-09-27T15:53:17.277" Score="2" Body="&lt;p&gt;ARP (Address Resolution Protocol) is used by a source host to resolve the layer-3 address of a destination host to that host's layer-2 address. An ARP request is broadcast on layer-2, asking, &quot;Who has this layer-3 address?&quot; The host with that layer-3 address will unicast back to the requesting host with its layer-2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hosts populate an ARP cache with layer-3 addresses which have been resolved to layer-2 addresses so that ARP is only used the first time a host wants to send something to another host. Entries in a host's ARP cache have a timeout, and they will be eventually be flushed if there is no activity for that entry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch only floods an unknown unicast, and switches don't ask who has a certain MAC address. A switch will maintain a MAC address table, which relates a particular MAC address to a switch interface. A switch builds or updates this table every time a frame enters a switch interface. The switch will look at the layer-2 source address on a frame entering an interface, and it will add to, or update, its MAC address table with that address and interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch will also look in its MAC address table for the layer-2 destination address in the frame to find to which interface the frame should be switched. Only if the switch doesn't find the destination address in its MAC address table does it flood the frame to all other interfaces. Entries in a switch MAC address table have a timeout, and they will eventually be flushed if there is no activity for the MAC address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-27T15:53:17.277" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35300" PostTypeId="1" CreationDate="2016-09-27T19:13:44.103" Score="3" ViewCount="4809" Body="&lt;p&gt;I always have trouble understanding what creates what i know every hub is a collision. my guess is 1 broadcast 2 collision. &lt;a href=&quot;https://i.stack.imgur.com/L5ici.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/L5ici.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29922" LastActivityDate="2016-11-28T15:01:31.080" Title="How many collision and broadcast domains are in the diagram" Tags="|ethernet|" AnswerCount="3" CommentCount="6" ClosedDate="2019-02-18T01:16:11.653" ContentLicense="CC BY-SA 3.0" />
  <row Id="35302" PostTypeId="2" ParentId="35243" CreationDate="2016-09-27T19:58:16.580" Score="1" Body="&lt;p&gt;On a Cisco Nexus device - depending on the model and the NXOS version it runs -  you can get access to a bash shell, a Linux container and/or a Python interpreter (with possibility to import pure python modules).&lt;/p&gt;&#xA;&lt;p&gt;E.g. for NXOS 7.x on the nexus3000:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;About Bash&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;In addition to the NX-OS CLI, Cisco Nexus 3000 Series&#xA;devices support access to the Bourne-Again SHell (Bash). Bash&#xA;interprets commands that you enter or commands that are read from a&#xA;shell script. Using Bash enables access to the underlying Linux system&#xA;on the device and to manage the system.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;And&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;About the Guest Shell&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;In addition to the NX-OS CLI and Bash access on&#xA;the underlying Linux environment, the Cisco Nexus 3000 Series devices&#xA;support access to a decoupled execution space running within a Linux&#xA;Container (LXC) called the “Guest Shell”.&lt;/p&gt;&#xA;&lt;p&gt;From within the Guest Shell the network-admin has the following&#xA;capabilities:&lt;/p&gt;&#xA;&lt;p&gt;Access to the network over Linux network interfaces.&lt;br /&gt;&#xA;Access to Cisco Nexus 3000 bootflash.&lt;br /&gt;&#xA;Access to Cisco Nexus 3000 volatile tmpfs.&lt;br /&gt;&#xA;Access to Cisco Nexus 3000 CLI.&lt;br /&gt;&#xA;Access to Cisco NX-API REST.&lt;br /&gt;&#xA;The ability to install and run python scripts.&lt;br /&gt;&#xA;The ability to install and run 32-bit and 64-bit Linux applications&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/programmability/7_x/b_Cisco_Nexus_3000_Series_NX-OS_Programmability_Guide_7x.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Nexus 3000 Series NX-OS Programmability Guide, Release 7.x&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-09-27T19:58:16.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35304" PostTypeId="2" ParentId="35300" CreationDate="2016-09-27T20:44:20.963" Score="3" Body="&lt;p&gt;If the switches are vlan capable, there is one broadcast domain per vlan (if the vlans are trunked between the 2 switches , otherwise one broadcast domain per vlan per switch.&#xA;If not vlan capable,  there is one single broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the collision domain, the topology is very poorly drawn but I assume that each set of 3 computers is connected to a different port of the hub or switch above it. In that case I count 6 collision domains:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;CD1: Port 1 of the top switch, the hub connected to it and everything connected to that hub &lt;/li&gt;&#xA;&lt;li&gt;CD2: Port 2 of the top switch, the hub connected to it and everything connected to that hub&lt;/li&gt;&#xA;&lt;li&gt;CD3: The link between the two switches   &lt;/li&gt;&#xA;&lt;li&gt;CD4, CD5, CD6: Each port of the right-hand-side switch that has a host connected to it is a separate collision domain.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Edit1: reading &lt;a href=&quot;https://en.m.wikipedia.org/wiki/Collision_domain&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia's definition&lt;/a&gt; it seems that I had a slightly different view on what a collision domain is, so if you go by wikipedia then items 3-6 in my list above are only collision domains if those ports are operating in half duplex mode. If they are in full duplex  then only items 1&amp;amp;2 are collision domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit2: to further clarify, my initial thought (before edit1) can be visualised like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KfCrs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KfCrs.png&quot; alt=&quot;topology1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you consider the wikipedia definition of collision domain and if you assume that the switchports that are not connected to a hub, are operating in full duplex, then it becomes this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yaUpe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yaUpe.png&quot; alt=&quot;topology2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-09-29T12:24:27.853" LastActivityDate="2016-09-29T12:24:27.853" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35306" PostTypeId="2" ParentId="30041" CreationDate="2016-09-27T21:18:15.353" Score="1" Body="&lt;p&gt;One possible soloution is network namespaces (basically the linux equivilent of what router vendors call VRFs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each network namespace is logically a seperate instance of the network stack. so if you put the two network interfaces in seperate network namespaces then they will only be able to communicate via the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to be able to monitor/inject in the main network namespaces then you can leave the physical interfaces in the main network namespace and connect them to secondary network namespaces through bridges and veth devices.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-09-27T21:18:15.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35307" PostTypeId="2" ParentId="35243" CreationDate="2016-09-27T23:02:44.367" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/dial-access/asynchronous-connections/10340-ttcp.html&quot; rel=&quot;nofollow&quot;&gt;TTCP&lt;/a&gt; should suit your needs. The good news is that it's built into the OS so you don't need to download any scripts or applications on the router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use it between two routers or even a router and a PC. Further to this, you have the choice of running TTCP, iperf, jperf, etc on the PC side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note though that TTCP on a router is process switched so it has the potential use 100% of the CPU's resources.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-09-27T23:02:44.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35311" PostTypeId="1" CreationDate="2016-09-28T07:32:24.753" Score="0" ViewCount="65" Body="&lt;p&gt;Just wanted to ask some questions regarding on our project.&#xA;I have a layer 3 switch having vlan10 - 120, 4 ports per vlan and assigned class C IP's, however due to lack of IP addresses it can only accommodate up to vlan70 so I decided to use class A IP's on vlan80-120 but it's not working, need your help guys on how to make this thing work. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="30469" LastActivityDate="2016-09-28T14:17:10.697" Title="Need some suggestions" Tags="|switch|ipv4|nat|internet|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35312" PostTypeId="1" AcceptedAnswerId="45789" CreationDate="2016-09-28T08:38:26.000" Score="2" ViewCount="6428" Body="&lt;p&gt;Today a customer contacted me because he has upgraded his MacBook to MacOS X Sierra and since then, when trying to access a switch via SSH he got the message&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Unable to negotiate with 10.XX.XX.XX port 22: no matching key exchange&#xA;  method found. Their offer: diffie-hellman-group1-sha1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The switch is a &lt;code&gt;Cisco 2960S&lt;/code&gt; running &lt;code&gt;IOS 12.2(55)SE7&lt;/code&gt;  (C2960S-UNIVERSALK9-M)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I looked at the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_55_se/command/reference/2960_cr.html&quot; rel=&quot;nofollow&quot;&gt;command reference guide&lt;/a&gt; for this version,  but was unable to find any command to configure SSH ciphers. (we can only configure SSH version 1 / 2 or both)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible with this version?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Yes I'm aware that he should use RSA key authentication, and upgrade the IOS version, I recommended it but this will need some testing and change management.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-11-16T15:37:59.867" Title="Configure SSH cipher on Cisco IOS 12.2(55)SE7" Tags="|ssh|cisco-ios-12|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35313" PostTypeId="1" AcceptedAnswerId="40008" CreationDate="2016-09-28T09:00:57.150" Score="1" ViewCount="1560" Body="&lt;p&gt;I've been trying to configure dynamic subscriber management on MX104 and pretty much succeeded too. The problem I am facing now is, the MX is listening for and responding to PADI but as soon as it sends PADS, it also sends PADT, thereby terminating the connection and there is no errors in pppoe statistics. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the complete configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 13.3R1.8;&#xA;dynamic-profiles {&#xA;    LE-profile {&#xA;        interfaces {&#xA;            pp0 {&#xA;                unit &quot;$junos-interface-unit&quot; {&#xA;                    ppp-options {&#xA;                        pap;&#xA;                    }&#xA;                    pppoe-options {&#xA;                        underlying-interface &quot;$junos-underlying-interface&quot;;&#xA;                        server;&#xA;                    }&#xA;                    keepalives interval 30;&#xA;                    family inet {&#xA;                        filter {&#xA;                            input &quot;$junos-input-filter&quot;;&#xA;                            output &quot;$junos-output-filter&quot;;&#xA;                        }&#xA;                        unnumbered-address lo0.0;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;system {&#xA;    root-authentication {&#xA;        encrypted-password &quot;*********************&quot;; ## SECRET-D     ATA&#xA;    }&#xA;    syslog {&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any notice;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands any;&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        vlan-tagging;&#xA;        unit 800 {&#xA;            encapsulation ppp-over-ether;&#xA;            vlan-id 800;&#xA;            pppoe-underlying-options {&#xA;                dynamic-profile LE-profile;&#xA;            }&#xA;        }&#xA;        unit 900 {&#xA;            encapsulation ppp-over-ether;&#xA;            vlan-id 900;&#xA;            pppoe-underlying-options {&#xA;                dynamic-profile LE-profile;&#xA;            }&#xA;        }&#xA;    }&#xA;    fxp0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.10.10.10/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    lo0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 90.90.90.1/32;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;firewall {&#xA;    family inet {&#xA;        filter MONTHLY_4096_OUT {&#xA;            interface-specific;&#xA;            term 1 {&#xA;                then {&#xA;                    policer MONTHLY_4096_POLICER;&#xA;                    accept;&#xA;                }&#xA;            }&#xA;        }&#xA;        filter MONTHLY_4096_IN {&#xA;            interface-specific;&#xA;            term 1 {&#xA;                then {&#xA;                    policer MONTHLY_256K_POLICER;&#xA;                    accept;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    policer MONTHLY_4096_POLICER {&#xA;        if-exceeding {&#xA;            bandwidth-limit 4m;&#xA;            burst-size-limit 100k;&#xA;        }&#xA;        then discard;&#xA;    }&#xA;    policer MONTHLY_256K_POLICER {&#xA;        if-exceeding {&#xA;            bandwidth-limit 1m;&#xA;            burst-size-limit 128k;&#xA;        }&#xA;        then discard;&#xA;    }&#xA;}&#xA;access {&#xA;    radius-server {&#xA;        10.10.10.111 {&#xA;            secret &quot;*******************&quot;; ## SECRET-DATA&#xA;            source-address 10.10.10.10;&#xA;        }&#xA;    }&#xA;    profile RAD {&#xA;        accounting-order radius;&#xA;        authentication-order radius;&#xA;        radius {&#xA;            authentication-server 10.10.10.111;&#xA;            accounting-server 10.10.10.111;&#xA;            options {&#xA;                nas-identifier 10.10.10.10;&#xA;            }&#xA;        }&#xA;    }&#xA;    address-assignment {&#xA;        pool VJ-POOL {&#xA;            family inet {&#xA;                network 10.170.0.0/15;&#xA;                range 1 {&#xA;                    low 10.170.0.10;&#xA;                    high 10.171.255.252;&#xA;                }&#xA;                dhcp-attributes {&#xA;                    maximum-lease-time 86400;&#xA;                    name-server {&#xA;                        8.8.8.8;&#xA;                    }&#xA;                    router {&#xA;                        10.170.0.1;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vjI9F.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vjI9F.png&quot; alt=&quot;PPPoE Statistics from MX104&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30266" LastEditorUserId="16930" LastEditDate="2016-09-28T09:04:57.773" LastActivityDate="2017-03-28T14:01:54.910" Title="Help needed with PPPoE interface on Juniper MX104" Tags="|ipv4|juniper|pppoe|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35314" PostTypeId="2" ParentId="35300" CreationDate="2016-09-28T10:23:45.273" Score="-1" Body="&lt;p&gt;regarding to &lt;strong&gt;&lt;em&gt;HUB&lt;/em&gt;&lt;/strong&gt;, all the devices attached to the hub are in  &lt;strong&gt;&lt;em&gt;one BC domain&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;one collision domain&lt;/em&gt;&lt;/strong&gt;.regarding to the &lt;strong&gt;&lt;em&gt;switch&lt;/em&gt;&lt;/strong&gt;, each &lt;strong&gt;&lt;em&gt;port&lt;/em&gt;&lt;/strong&gt; is &lt;strong&gt;&lt;em&gt;collision domain&lt;/em&gt;&lt;/strong&gt; and each &lt;strong&gt;&lt;em&gt;VLAN&lt;/em&gt;&lt;/strong&gt; is a &lt;strong&gt;&lt;em&gt;BC domain&lt;/em&gt;&lt;/strong&gt;.SO&#xA;as shown &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5IXln.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5IXln.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;we have 4 collision domains, but the number of the BC domains is very depend. for example if sw1 and sw2 run same vlan on all ports so all this network run in single BC domain.&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-09-28T10:23:45.273" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35315" PostTypeId="2" ParentId="35311" CreationDate="2016-09-28T11:31:32.120" Score="-1" Body="&lt;p&gt;Ok so I'll go and assume you mean you are not able to access the one subnet from the other. Since I don't know what switch you are using I'll only be able to guess the following: &lt;strong&gt;You have no routing enabled&lt;/strong&gt; ..?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco you will need to add &lt;code&gt;SVIs&lt;/code&gt; in those &lt;code&gt;VLANs&lt;/code&gt;and assign them an IP-Address. After that you will need to activate routing with &lt;code&gt;ip route&lt;/code&gt; and you're golden.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not much more we can help here without some proper infos&lt;/p&gt;&#xA;" OwnerUserId="18743" LastActivityDate="2016-09-28T11:31:32.120" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35318" PostTypeId="1" AcceptedAnswerId="35328" CreationDate="2016-09-28T13:48:46.743" Score="1" ViewCount="349" Body="&lt;p&gt;A small school has 37 pcs and each staff member has a mobile phone (wifi). This calls for roughly 60 devices, connected over wifi. Only the server (planned for file sharing and backups only) will be connected by cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering &quot;logical units&quot;, 15pcs are used in the lab (these Win7 laptops may travel over the school, so in this case VLANs can be a restricting factor), 7 in the office, 15 in classrooms. All APs will be connected to a L2 switch and the switch will be connected to a failover/balancing device, in turn connected to 3 internet lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/42ymy.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/42ymy.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server (Windows Server 2012) will be managing routing, if necessary (one NIC)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logical units/devices priority &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Office&lt;/li&gt;&#xA;&lt;li&gt;Classrooms and lab&lt;/li&gt;&#xA;&lt;li&gt;Mobile phones&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Content priority&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;email&lt;/li&gt;&#xA;&lt;li&gt;browsing&lt;/li&gt;&#xA;&lt;li&gt;video playback&lt;/li&gt;&#xA;&lt;li&gt;downloading - cloud sync&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Security&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only 3 computers in the office hold sensitive data and may require additional &quot;protection&quot;. (this is the only point I would see using VLANs as a stronger solution)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this scenario, would you recommend using VLANs or it may be overkill? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe it would be easier to setup one unique pool of IP 192.168.1.x (fixed for computers, dynamic for mobile devices and apply QoS and filtering on IP groups); this would make things easier when laptops travel in the school&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do you think?&lt;/p&gt;&#xA;" OwnerUserId="30189" LastActivityDate="2016-09-28T22:27:22.853" Title="37 computers + 25 mobile phones - Is VLAN implementation recommended?" Tags="|vlan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35320" PostTypeId="1" AcceptedAnswerId="35322" CreationDate="2016-09-28T13:39:47.877" Score="11" ViewCount="1872" Body="&lt;p&gt;I'm looking for some post-event advice so this event doesn't happen again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a network core of two Cisco 4500x switches, configured for VSS redundancy. From those, we have iSCSI devices, our HP bladecenter for our vSphere, plus aggregated links to our user access switches, and a pair of 4948e switches for copper devices in our server room. Off the 4948es we have a pair of 2960 switches for two ISP links, and a pair of ASA as firewalls. Pretty decent redundancy, except for a lot of the devices that connect to the 4948e only have single NICs - only so much we can do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're preparing to replace our current user access switches (old Extremes) with Meraki. We're also implementing Meraki APs to replace our current Arubas. Part of the wireless project involves making some new VLANs and subnets, for AP management and guest wireless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We had two defined VLANs (20 and 40) on the 4500x that were not used anywhere - confirmed that the subnets were empty, no ports using them, etc. I went into the 4500x and issued &quot;&lt;code&gt;no interface vlan 20&lt;/code&gt;&quot;, and then rebuilt it with the subnet I wanted. I then added it to the two 10Gb ports that are connected to the Meraki &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;switchport trunk allowed &amp;lt;previous list plus two VLANs above plus existing wireless VLAN&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed that the 20 and 40 VLANs were shutdown, so I issued &lt;code&gt;no shutdown&lt;/code&gt; on them. I lost access to the Merakis at that point, so I realized I hadn't added the VLANs to the port channel interface for that link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Half of our environment became unreachable at this point&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our Internet link went extremely flakey. Our Avaya VoIP phones couldn't dial in or out. We have a couple of copper-connected iSCSI devices that became unavailable - no outage for anything user-facing, but our backups and mail archive became impacted. I went into the server room, and disconnected the Merakis from the 4500x (unplugged both 10Gb fiber ports) in case I had somehow created a loop - no change. I admit to simply staring at this for a while at that point. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I pulled up Orion and noted that one of our external switches (the Cat2960) and one of our ASA pair were down as well. Apparent that we had some sort of partial LAN connectivity loss, but the ASA pair are also connected with crossover to each other, and their uplinks didn't go down, so they didn't failover to what our internal devices could reach. I shut down the &quot;down&quot; ASA and the internet became reachable again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I called TAC, and after a couple of hours of wresting with the tech who kept nitpicking every port config for each downed host I was showing him on the 4500x, I logged into one of our 4948e switches and showed how it couldn't ping things that were directly connected and up - one of our Windows-based copper iSCSI devices, an iLO interface on our bladecenter, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;He had looked over the logs and didn't find anything, but at this point he said &quot;Looks like a spanning-tree bug even if I don't see that in the logs&quot;, so we rebooted the 4948e and all of its directly-connected hosts came right back up - including the Avaya cabinet, so our phones started working again. We still had problems in the 4500x fiber-connected devices - dead paths, since it was all redundant. He wanted to power-cycle it ungracefully, but this has all of our 10 Gbit iSCSI, and that would have made our vSphere environment (essentially all of our servers) have a bad week. I talked him into doing a graceful redundancy switchover, which took care of the remaining problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR : I made a fairly innocuous change to our core, and caused a hideous problem. Did I make a config mistake that should have been predicted to cause this - eg, if I had no-shutdown the VLANs first and added them to the portchannel and then the ports, would this have been avoided? The Cisco tech didn't say that; he said, with uptimes over a year and old IOS versions, situations like this aren't surprising. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;4500x: Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch&#xA;  Software (cat4500e-UNIVERSALK9-M), Version 03.04.05.SG RELEASE&#xA;  SOFTWARE (fc1) ROM: 15.0(1r)SG10&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;4948e: Cisco IOS Software, Catalyst 4500 L3 Switch Software&#xA;  (cat4500e-IPBASEK9-M), Version 15.0(2)SG10, RELEASE SOFTWARE (fc1)&#xA;  ROM: 12.2(44r)SG11&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2119" OwnerDisplayName="mfinni" LastEditorUserId="8499" LastEditDate="2018-03-18T19:17:47.287" LastActivityDate="2018-03-18T19:17:47.287" Title="How did I break (half of) my network?" Tags="|cisco|switch|switching|cisco-catalyst|spanning-tree|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35321" PostTypeId="2" ParentId="35311" CreationDate="2016-09-28T14:17:10.697" Score="2" Body="&lt;p&gt;You need to use NAT to translate the private IP addresses to public addresses in order to route traffic from private addressing to the public Internet. You will need to set aside some public address space to be used for the public side of the NAT. Unfortunately, it is unlikely that you will be able to use NAT on a switch; you will probably need to use a router for that.&lt;/p&gt;&#xA;&lt;p&gt;As something of an ISP, you really should not use RFC 1918 address space for your private addressing. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6598&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6598, IANA-Reserved IPv4 Prefix for Shared Address Space&lt;/a&gt;, allocates the &lt;code&gt;100.64.0.0/10&lt;/code&gt; address block for ISPs to use as shared address space in order to not conflict with the RFC 1918 address space used by the customers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-09-28T14:17:10.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35322" PostTypeId="2" ParentId="35320" CreationDate="2016-09-28T14:45:08.000" Score="5" Body="&lt;p&gt;It sounds like you created a broadcast storm, and the only way to stop it is to power down the switches. Having lived through this several times, we have adopted some best practices recommended by Cisco:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You should only have a VLAN extend to a single access switch. You can&#xA;have as many VLANs as you like on an access switch, but the VLANs on&#xA;any access switch should not be trunked to any other access switch,&#xA;only to the distribution switch. Enforce this by manually disabling&#xA;all other VLANs on a trunk with the &lt;code&gt;switchport trunk allowed vlan&lt;/code&gt;&#xA;command.&lt;/li&gt;&#xA;&lt;li&gt;A distribution switch should not have any access interfaces on it,&#xA;only distribution trunk interfaces.&lt;/li&gt;&#xA;&lt;li&gt;Do not use VTP (set all switches to &lt;code&gt;transparent&lt;/code&gt; mode).&lt;/li&gt;&#xA;&lt;li&gt;Your access interfaces should have &lt;code&gt;portfast&lt;/code&gt; and &lt;code&gt;bpduguard&lt;/code&gt;&#xA;enabled. You can enable those globally for all your access&#xA;interfaces, and your trunk interfaces will remain unaffected. If you&#xA;accidentally connect a switch to an access interface, this will cause&#xA;the interface to go into &lt;code&gt;err-diable&lt;/code&gt; and prevent STP loops.&lt;/li&gt;&#xA;&lt;li&gt;Do not connect an access switch to another access switch. Only&#xA;connect access switches to distribution switches, and only on trunk&#xA;interfaces.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;These best practices will prevent almost all STP problems, and isolate any problems which do happen to a single access switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-09-28T14:56:37.417" LastActivityDate="2016-09-28T14:56:37.417" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="35325" PostTypeId="1" CreationDate="2016-09-28T17:23:39.877" Score="0" ViewCount="79" Body="&lt;p&gt;I have router enabling fixed MAC's to connect to internet. All devices are connected by LAN to the router. Problem I'm having is that i don't want to allow another device connect through one using ad hoc network with allowed internet sharing. Is there a way to monitor this? and Can I identify whether there was more than one device connected through 1 MAC from router logs? &#xA;(I have access only to the router).&#xA;Edit: ad hoc is NAT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="30854" LastEditorUserId="30854" LastEditDate="2016-09-28T17:58:52.637" LastActivityDate="2016-09-28T17:58:52.637" Title="Monitoring IBSS (ad hoc) networks" Tags="|router|lan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35326" PostTypeId="2" ParentId="35325" CreationDate="2016-09-28T17:45:39.690" Score="1" Body="&lt;p&gt;It depends.  Most likely, the device doing the sharing is acting as a router.  That is, the ad-hoc network will be one subnet and the LAN connection another.  In that case, the MAC address of the packets will always be the sharing PC.  Depending on the way the sharing PC is set up, it may also be performing NAT, so the source IP address also will be that of the PC.  That will make it difficult to tell the difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the sharing PC acts as a bridge, then you will see the original MAC addresses, and you can filter on that.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-28T17:45:39.690" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35328" PostTypeId="2" ParentId="35318" CreationDate="2016-09-28T17:59:39.973" Score="1" Body="&lt;p&gt;Segmenting your network into VLANs serves two main purposes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Creating VLANs reduces the size of your layer 2 failure domains.  If your network covers several buildings/ classrooms, etc, you can reduce the effects of failures by segmenting your network according to location (e.g., one vlan per access switch).  If you have spanning tree or similar problems, separate VLANs will restrict the problem to only part of your network, instead of taking down the entire thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Creating VLANs also allows you to apply QoS or security policies to certain kinds of traffic, certain locations, or certain devices, or any combination.  You can, for example, create a VLAN for students and one for teachers.  The teacher VLAN may have access to servers or devices that students don't.  You can restrict access by applying access control lists to the VLAN interfaces.  NOTE: if you are not going to use access control lists, then separating students and teachers has very little practical benefit.  In other words &lt;em&gt;VLANs by themselves offer no security improvement&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in your case, it may make sense to segment students and teachers (and servers), and use access lists to restrict access to the servers.  You will need a way to identify teachers by which switchport they're plugged into, or by separate SSIDs for wireless.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-28T17:59:39.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35331" PostTypeId="2" ParentId="35300" CreationDate="2016-09-28T18:30:07.447" Score="-1" Body="&lt;p&gt;3 collision domains for 1st switch and &quot;n-1&quot; collision domains(It will share one collision domain of first switch) for &quot;n&quot; connections of 2nd switch AND all the devices are in a single broadcast domain.&lt;/p&gt;&#xA;" OwnerUserId="26934" LastActivityDate="2016-09-28T18:30:07.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35337" PostTypeId="2" ParentId="35318" CreationDate="2016-09-28T22:27:22.853" Score="0" Body="&lt;p&gt;The decision to use VLANs is a preference based on what you have for users, equipment, security, number of devices, data access, etc. As well as your available resources to support it. In this case your network is small enough that it can remain as one flat network with no vlan. An advantage to this is the lower cost due to not requiring the use of routers. You can get away with just layer 2 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For security you could use one vlan for staff and one for students. However this will require a layer 3 switch at some point to handle internal routing. It will allow for breaking up the network into two different broadcast domains, however, if say the student network went down, it could go down for all students, so what does it buy you?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My personal experience would have me doing a single network here with a radius server for network authentication. Provide security on the servers through credential authentication. Firewall the internet connection into the school network. Keep it simple and easy to maintain.&lt;/p&gt;&#xA;" OwnerUserId="30863" LastActivityDate="2016-09-28T22:27:22.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35338" PostTypeId="1" AcceptedAnswerId="35339" CreationDate="2016-09-28T22:57:27.823" Score="1" ViewCount="1445" Body="&lt;p&gt;I am aware of management VRF where inband port and OOB port on router can be part of and support SSH access to the router from both management port and network port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case inband port(network port) cant be used for data plane forwarding as it is part of management VRF. How can I configure a network port in cisco NEXUS where it allows SSH access and also support Data plane forwarding ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         (mgmt-port)ROUTER-01(network port) ========== (ROUTER-02) ====&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So in the above topology i want to SSH into ROUTER-01 via network port instead of management port.&lt;/p&gt;&#xA;" OwnerUserId="30865" LastEditorUserId="8499" LastEditDate="2016-09-29T01:24:51.300" LastActivityDate="2016-09-29T07:02:14.027" Title="SSH access to router via inband and OOB ports" Tags="|cisco|cisco-commands|ssh|cisco-nexus|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35339" PostTypeId="2" ParentId="35338" CreationDate="2016-09-29T01:34:08.973" Score="1" Body="&lt;p&gt;You didn't specify the model or NX-OS version, but you should be able to SSH into an inband ethernet interface which has been configured for layer-3 and addressed. You will find the following in the Cisco documentation for 5K, 7K, and 9K Nexus switches, e.g. &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/switches/datacenter/sw/4_1/nx-os/security/configuration/guide/sec_nx-os-cfg/sec_ssh.html&quot; rel=&quot;nofollow&quot;&gt;Cisco Nexus 7000 Series NX-OS Security Configuration Guide&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Prerequisites for SSH&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;SSH and Telnet have the following prerequisites:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;You have configured IP on a Layer 3 interface, out-of-band on the    mgmt 0 interface, or inband on an Ethernet interface.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-29T01:34:08.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35342" PostTypeId="1" AcceptedAnswerId="35352" CreationDate="2016-09-29T05:03:13.977" Score="2" ViewCount="210" Body="&lt;p&gt;I am interested in deploying a hotspot that can cover a distance of 1kM. Some of the engineers that I have discussed with said that even if I get an Access Point that can cover that distance, that most laptops and smart phones cannot send signal back to the AP because of their short transmitting range which he said is maximum of 300m.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know if this is true. If it is, what is the cause of this limitation, and how do I overcome it in real world?   &lt;/p&gt;&#xA;" OwnerUserId="30191" LastEditorUserId="8499" LastEditDate="2016-09-29T16:14:16.957" LastActivityDate="2016-09-29T16:40:35.610" Title="Wi-Fi network adapter maximum transmitter range" Tags="|wireless|ieee-802.11|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35346" PostTypeId="1" AcceptedAnswerId="35348" CreationDate="2016-09-29T09:58:07.060" Score="1" ViewCount="4797" Body="&lt;p&gt;I have found some information about switch MAC table here: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13012/how-does-a-switch-learn-a-switch-table&quot;&gt;How does a switch learn a switch table?&lt;/a&gt; . There is explained how switch learns MAC addresses but what happens when I manipulate cables? What happens when I disconnect one cable? What happens when I disconnect one cable and I will connect it to another port?  &lt;/p&gt;&#xA;" OwnerUserId="30875" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-09-29T10:34:07.097" Title="What happens with MAC table in switch when I disconnect some device?" Tags="|switch|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35348" PostTypeId="2" ParentId="35346" CreationDate="2016-09-29T10:34:07.097" Score="2" Body="&lt;p&gt;The entry in the switch mac table has a timestamp and all records have a lifetime. (300 seconds is a common value but it can be another value, and it may be configurable, depending on the switch vendor / model / software version).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when you disconnect a device, the entry will be removed after some times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally some switches will immediately remove all entries listing a port if this port goes down. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch will keep a single entry for a given mac address, and if needed update it. So if you move a device from one port to another, when the device will sent a frame, the switch will update the mac table with the new port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Things become more complex when you have many switches interconnected.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-09-29T10:34:07.097" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35349" PostTypeId="2" ParentId="35342" CreationDate="2016-09-29T11:55:29.990" Score="2" Body="&lt;p&gt;That is true; Wi-Fi is a bi-directional protocol, and devices are both senders and receivers, not at all like commercial radio or television where you have a powerful transmitter and a lot receivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way you can cover that type distance is with a directional antenna, basically a point-to-point link. The &lt;a href=&quot;http://www.air802.com/fcc-rules-and-regulations.html&quot; rel=&quot;nofollow&quot;&gt;governmental authorities limit transmitter power and antenna gain&lt;/a&gt;. The frequencies used by Wi-Fi are open for everybody to use, and if everybody could just send Wi-Fi that sort of distance, it would be useless because everybody would interfere with everybody else. The Wi-Fi protocol must share the frequency, and devices must yield and give other devices on the same frequency time on the air. That is built into the protocol. You don't own the airwaves, they belong to everybody.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-09-29T16:39:25.567" LastActivityDate="2016-09-29T16:39:25.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35350" PostTypeId="1" AcceptedAnswerId="37339" CreationDate="2016-09-29T12:34:50.060" Score="1" ViewCount="1302" Body="&lt;p&gt;I am trying to monitor an SRX (345) chassis cluster, via SNMP. The JUNOS documentation suggests that doing &lt;code&gt;snmpwalk&lt;/code&gt; over &lt;code&gt;jnxContentsDescr&lt;/code&gt; on the primary node should return details about all nodes. In my case, it does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;user@server:~# snmpwalk -v 2c -c 'XXXX' 172.18.1.145 jnxContentsDescr&#xA;JUNIPER-MIB::jnxContentsDescr.1.1.0.0 = STRING: node0 midplane&#xA;JUNIPER-MIB::jnxContentsDescr.2.1.0.0 = STRING: node0 PEM 0&#xA;JUNIPER-MIB::jnxContentsDescr.4.1.0.0 = STRING: node0 SRX340 Chassis fan 0&#xA;JUNIPER-MIB::jnxContentsDescr.7.1.0.0 = STRING: node0 FPC: FPC @ 0/*/*&#xA;JUNIPER-MIB::jnxContentsDescr.8.1.1.0 = STRING: node0 PIC: 8xGE,8xGE SFP Base PIC @ 0/0/*&#xA;JUNIPER-MIB::jnxContentsDescr.9.1.0.0 = STRING: node0 Routing Engine&#xA;JUNIPER-MIB::jnxContentsDescr.9.1.1.0 = STRING: node0 USB Hub&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also seem to be missing metrics on things like node1 cpu usage and temperature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something here regarding how to monitor the second node of a cluster?&lt;/p&gt;&#xA;" OwnerUserId="30148" LastActivityDate="2016-12-15T15:16:36.957" Title="SNMP on Juniper SRX Chassis Cluster does not show node1" Tags="|snmp|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35351" PostTypeId="2" ParentId="35320" CreationDate="2016-09-29T12:47:17.903" Score="3" Body="&lt;p&gt;In addition to Ron Maupin's excellent advice above, I also found several posts on Cisco's forum about a potential big mistake I made in the process. I added the VLANs to the physical port interfaces first, not the port-channel interface that they were members of. The latter is the proper way to do it, and I may have caused the problem.&lt;/p&gt;&#xA;" OwnerUserId="2119" LastActivityDate="2016-09-29T12:47:17.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35352" PostTypeId="2" ParentId="35342" CreationDate="2016-09-29T13:50:31.407" Score="1" Body="&lt;p&gt;There are two main limitations with Wi-Fi on phones and laptops.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Low transmitter power.  Because these devices are battery powered,&#xA;they necessarily limit the transmitter power.  You wouldn't want to&#xA;buy a cell phone that had to be recharged every 2 hours, would you?&lt;/li&gt;&#xA;&lt;li&gt;Low (or even negative) antenna gain.  The antennas in phones are a&#xA;compromise between performance and size.  The antenna has to fit&#xA;into the case of the phone or laptop, so it can't be as efficient as&#xA;an access point that has a larger, external antenna.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Ultimately, there's little you can do to improve the client signal.  You will have to move the access point closer to them.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-09-29T13:50:31.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35353" PostTypeId="2" ParentId="35342" CreationDate="2016-09-29T16:28:38.177" Score="2" Body="&lt;p&gt;It's MOSTLY true, but there are exceptions, primarily in largely radio-dead rural environments, and with the application of high-gain sector antennas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A high gain antenna concentrates the radiated radio power (within local legal limits, of course) to a particular physical area, and also has the same amplifying effect on a signal originating from that particular physical area, even if the antenna radiating that signal is a standard low-gain omni-directional antenna.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This only works in relatively radio-dead (but tree-free) rural areas because the antenna will also pick up any competing noise source in its &quot;beam.&quot; I emphasize this point since many people jump to the conclusion that it can be applied anywhere, and that's not even close to true. I have personally tested my system (16 dB 2.4 GHz sector) and got acceptable performance to 435 meters before I ran out of test range, going to an ordinary (crummy) wifi antenna in a laptop, and wifi in a cell phone. My actual production application for this system is more in the 200m range, feeding athletic fields and backstopped by a hill with no houses or transmitters on it. An online acquaintance has a ski-area setup with mountaintop sectors that typically operates to normal hand-held devices at 1-km ranges - but I reiterate that this only works because it's the only thing in the area operating on those frequencies, and there are no trees to stop them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, in the real world, if you want wi-fi over whatever you mean by a &quot;1km distance&quot; (a 2km circle, a 1 km square, etc.) you build a backhaul (preferably fiber, or via point-to-point links on frequencies you will NOT be using for WiFi) and you hang a large number of access points which are serving a much more reasonable radius each, such as 100m (in a clear field) or 30m in urban environments. Or you skip wi-fi entirely and head into 3G/4G cell-phone data schemes.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2016-09-29T16:40:35.610" LastActivityDate="2016-09-29T16:40:35.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35356" PostTypeId="1" CreationDate="2016-09-29T20:30:54.277" Score="0" ViewCount="4899" Body="&lt;p&gt;I have an education client that has students accessing the popular game League of Legends and they have requested that we block it on the network. They have some level of BYOD, we are primarily doing their networking support so the plan would be to block their access to the servers (not too concerned about any local play or one player.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are currently using a Dell SonicWALL for their firewall/content filter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked around StackExchange, Google, reddit, and LoL's website, maybe I'm missing something, does anyone know the IP addresses or domains of the game servers? Any other way to block internet access to the game?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for reading.&lt;/p&gt;&#xA;" OwnerUserId="29920" LastActivityDate="2016-10-30T18:59:56.410" Title="How do I block league of legends" Tags="|firewall|sonicwall|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35358" PostTypeId="2" ParentId="35356" CreationDate="2016-09-29T20:51:58.653" Score="0" Body="&lt;p&gt;With a UTM box, like fortigate or even SonicWall, it's possible to block this type of content and other illegal stuff as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don´t know the SonicWall capabilities but in fortigate we can block applications, like LoL, by their signatures. Can SonicWall do something like this?&lt;/p&gt;&#xA;" OwnerUserId="30887" LastEditorUserId="8499" LastEditDate="2016-09-29T22:45:42.433" LastActivityDate="2016-09-29T22:45:42.433" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35366" PostTypeId="1" CreationDate="2016-09-30T09:20:23.067" Score="3" ViewCount="3106" Body="&lt;p&gt;I have a cisco ASA I want to connect to a TACACS server for command level authorization (write and read-only access). This actually works quite good. Further, I have a local fallback user configured with privilege level 15. I can login with this user, but I can issue no command, the ASA sends the request to the TACACS server which for sure does not know the username.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa-server TACACS protocol tacacs+&#xA;aaa-server TACACS (interface-oob) host xx.xx.xx.xx&#xA; timeout 5&#xA; key *****&#xA;aaa-server TACACS (interface-oob) host xx.xx.xx.xx&#xA; timeout 5&#xA; key *****&#xA;!&#xA;aaa authentication serial console LOCAL &#xA;aaa authentication enable console LOCAL &#xA;aaa authentication ssh console TACACS LOCAL&#xA;aaa authentication http console TACACS LOCAL&#xA;aaa authorization command TACACS LOCAL&#xA;aaa authorization exec authentication-server auto-enable&#xA;!&#xA;username fallbackadm password xxxxxxxxx encrypted privilege 15&#xA;username fallbackadm attributes&#xA; group-lock value NOACCESS&#xA; service-type admin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In Cisco IOS I would just swap both parameters of the aaa authorization command line, but that does not work on ASA, LOCAL has to be last one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I achieve a local fallback user, which can be used to login and work on the CLI even when TACACS server is reachable?&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2023-12-14T06:00:18.320" Title="Local Fallback Command Authorization on Cisco ASA when TACACS Server is Reachable" Tags="|cisco|cisco-asa|tacacs|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35373" PostTypeId="1" AcceptedAnswerId="35379" CreationDate="2016-09-30T13:18:38.423" Score="1" ViewCount="2934" Body="&lt;p&gt;What flags are available in an IPv6 RA and how are their various combinations interpreted by Windows, Linux and BSD?&lt;/p&gt;&#xA;" OwnerUserId="3972" LastActivityDate="2016-09-30T15:58:22.927" Title="IPv6 RA flags and various combinations" Tags="|router|ipv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35376" PostTypeId="1" AcceptedAnswerId="35383" CreationDate="2016-09-30T14:15:48.753" Score="4" ViewCount="21704" Body="&lt;p&gt;Many people often suggest you to use &lt;code&gt;ping&lt;/code&gt; command to find out your network latency. But it is false and a myth you often find in articles on Internet.&#xA;ICMP ping was never designed to find out latency because it is given very low priority for routing and ICMP packets may be routed over completely different path from what your TCP/UDP packets are being sent. &#xA;The routes which are chosen for sending ICMP packets can be longer and highly occupied with other traffic and thus they can never give you true result.&#xA;ICMP &lt;code&gt;ping&lt;/code&gt; was designed for checking connectivity with a server. I want to find the latency of TCP/UDP route. Is it possible?&lt;/p&gt;&#xA;" OwnerUserId="28180" LastActivityDate="2016-09-30T18:01:22.770" Title="How to find out TCP/UDP latency of your network?" Tags="|tcp|udp|latency|icmp|" AnswerCount="2" CommentCount="4" ClosedDate="2021-01-06T00:04:20.250" ContentLicense="CC BY-SA 3.0" />
  <row Id="35379" PostTypeId="2" ParentId="35373" CreationDate="2016-09-30T15:44:07.000" Score="1" Body="&lt;p&gt;I think you are referring to the M and the O flags in the router advertisement. How host OSes interpret these flags is off-topic here. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861#section-4.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4861, Neighbor Discovery for IP version 6 (IPv6), Section 4.2. Router Advertisement Message Format&lt;/a&gt; details the Router Advertisement Message format, including the RA flags:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;4.2.  Router Advertisement Message Format&lt;/p&gt;&#xA;&lt;p&gt;Routers send out Router Advertisement messages periodically, or in&#xA;response to Router Solicitations.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  0                   1                   2                   3&#xA;  0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; |     Type      |     Code      |          Checksum             |&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; | Cur Hop Limit |M|O|  Reserved |       Router Lifetime         |&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; |                         Reachable Time                        |&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; |                          Retrans Timer                        |&#xA; +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA; |   Options ...&#xA; +-+-+-+-+-+-+-+-+-+-+-+-&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;IP Fields:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  Source Address&#xA;                 MUST be the link-local address assigned to the&#xA;                 interface from which this message is sent.&#xA;&#xA;&#xA;  Destination Address&#xA;                 Typically the Source Address of an invoking Router&#xA;                 Solicitation or the all-nodes multicast address.&#xA;&#xA;  Hop Limit      255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;ICMP Fields:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  Type           134&#xA;&#xA;  Code           0&#xA;&#xA;  Checksum       The ICMP checksum.  See [ICMPv6].&#xA;&#xA;  Cur Hop Limit  8-bit unsigned integer.  The default value that&#xA;                 should be placed in the Hop Count field of the IP&#xA;                 header for outgoing IP packets.  A value of zero&#xA;                 means unspecified (by this router).&#xA;&#xA;  M              1-bit &amp;quot;Managed address configuration&amp;quot; flag.  When&#xA;                 set, it indicates that addresses are available via&#xA;                 Dynamic Host Configuration Protocol [DHCPv6].&#xA;&#xA;                 If the M flag is set, the O flag is redundant and&#xA;                 can be ignored because DHCPv6 will return all&#xA;                 available configuration information.&#xA;&#xA;  O              1-bit &amp;quot;Other configuration&amp;quot; flag.  When set, it&#xA;                 indicates that other configuration information is&#xA;                 available via DHCPv6.  Examples of such information&#xA;                 are DNS-related information or information on other&#xA;                 servers within the network.&#xA;&#xA;    Note: If neither M nor O flags are set, this indicates that no&#xA;    information is available via DHCPv6.&#xA;&#xA;  Reserved       A 6-bit unused field.  It MUST be initialized to&#xA;                 zero by the sender and MUST be ignored by the&#xA;                 receiver.&#xA;&#xA;  Router Lifetime&#xA;                 16-bit unsigned integer.  The lifetime associated&#xA;                 with the default router in units of seconds.  The&#xA;                 field can contain values up to 65535 and receivers&#xA;                 should handle any value, while the sending rules in&#xA;                 Section 6 limit the lifetime to 9000 seconds.  A&#xA;                 Lifetime of 0 indicates that the router is not a&#xA;                 default router and SHOULD NOT appear on the default&#xA;                 router list.  The Router Lifetime applies only to&#xA;                 the router's usefulness as a default router; it&#xA;                 does not apply to information contained in other&#xA;                 message fields or options.  Options that need time&#xA;                 limits for their information include their own&#xA;                 lifetime fields.&#xA;&#xA;  Reachable Time 32-bit unsigned integer.  The time, in&#xA;                 milliseconds, that a node assumes a neighbor is&#xA;                 reachable after having received a reachability&#xA;                 confirmation.  Used by the Neighbor Unreachability&#xA;                 Detection algorithm (see Section 7.3).  A value of&#xA;                 zero means unspecified (by this router).&#xA;&#xA;  Retrans Timer  32-bit unsigned integer.  The time, in&#xA;                 milliseconds, between retransmitted Neighbor&#xA;                 Solicitation messages.  Used by address resolution&#xA;                 and the Neighbor Unreachability Detection algorithm&#xA;                 (see Sections 7.2 and 7.3).  A value of zero means&#xA;                 unspecified (by this router).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Possible options:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  Source link-layer address&#xA;                 The link-layer address of the interface from which&#xA;                 the Router Advertisement is sent.  Only used on&#xA;                 link layers that have addresses.  A router MAY omit&#xA;                 this option in order to enable inbound load sharing&#xA;                 across multiple link-layer addresses.&#xA;&#xA;  MTU            SHOULD be sent on links that have a variable MTU&#xA;                 (as specified in the document that describes how to&#xA;                 run IP over the particular link type).  MAY be sent&#xA;                 on other links.&#xA;&#xA;  Prefix Information&#xA;                 These options specify the prefixes that are on-link&#xA;                 and/or are used for stateless address&#xA;                 autoconfiguration.  A router SHOULD include all its&#xA;                 on-link prefixes (except the link-local prefix) so&#xA;                 that multihomed hosts have complete prefix&#xA;                 information about on-link destinations for the&#xA;                 links to which they attach.  If complete&#xA;                 information is lacking, a host with multiple&#xA;                 interfaces may not be able to choose the correct&#xA;                 outgoing interface when sending traffic to its&#xA;                 neighbors.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;There are also a couple of flags (L and A) in the Prefix Information option as detailed in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861#section-4.6.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Section 4.6.2 Prefix Information&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;4.6.2.  Prefix Information&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   0                   1                   2                   3&#xA;   0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;  |     Type      |    Length     | Prefix Length |L|A| Reserved1 |&#xA;  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;  |                         Valid Lifetime                        |&#xA;  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;  |                       Preferred Lifetime                      |&#xA;  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;  |                           Reserved2                           |&#xA;  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;  |                                                               |&#xA;  +                                                               +&#xA;  |                                                               |&#xA;  +                            Prefix                             +&#xA;  |                                                               |&#xA;  +                                                               +&#xA;  |                                                               |&#xA;  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Fields:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;  Type           3&#xA;&#xA;  Length         4&#xA;&#xA;  Prefix Length  8-bit unsigned integer.  The number of leading bits&#xA;                 in the Prefix that are valid.  The value ranges&#xA;                 from 0 to 128.  The prefix length field provides&#xA;                 necessary information for on-link determination&#xA;                 (when combined with the L flag in the prefix&#xA;                 information option).  It also assists with address&#xA;                 autoconfiguration as specified in [ADDRCONF], for&#xA;                 which there may be more restrictions on the prefix&#xA;                 length.&#xA;&#xA;  L              1-bit on-link flag.  When set, indicates that this&#xA;                 prefix can be used for on-link determination.  When&#xA;                 not set the advertisement makes no statement about&#xA;                 on-link or off-link properties of the prefix.  In&#xA;                 other words, if the L flag is not set a host MUST&#xA;                 NOT conclude that an address derived from the&#xA;                 prefix is off-link.  That is, it MUST NOT update a&#xA;                 previous indication that the address is on-link.&#xA;&#xA;  A              1-bit autonomous address-configuration flag.  When&#xA;                 set indicates that this prefix can be used for&#xA;                 stateless address configuration as specified in&#xA;                 [ADDRCONF].&#xA;&#xA;  Reserved1      6-bit unused field.  It MUST be initialized to zero&#xA;                 by the sender and MUST be ignored by the receiver.&#xA;&#xA;  Valid Lifetime&#xA;                 32-bit unsigned integer.  The length of time in&#xA;                 seconds (relative to the time the packet is sent)&#xA;                 that the prefix is valid for the purpose of on-link&#xA;                 determination.  A value of all one bits&#xA;                 (0xffffffff) represents infinity.  The Valid&#xA;                 Lifetime is also used by [ADDRCONF].&#xA;&#xA;  Preferred Lifetime&#xA;                 32-bit unsigned integer.  The length of time in&#xA;                 seconds (relative to the time the packet is sent)&#xA;                 that addresses generated from the prefix via&#xA;                 stateless address autoconfiguration remain&#xA;                 preferred [ADDRCONF].  A value of all one bits&#xA;                 (0xffffffff) represents infinity.  See [ADDRCONF].&#xA;&#xA;                 Note that the value of this field MUST NOT exceed&#xA;                 the Valid Lifetime field to avoid preferring&#xA;                 addresses that are no longer valid.&#xA;&#xA;  Reserved2      This field is unused.  It MUST be initialized to&#xA;                 zero by the sender and MUST be ignored by the&#xA;                 receiver.&#xA;&#xA;  Prefix         An IP address or a prefix of an IP address.  The&#xA;                 Prefix Length field contains the number of valid&#xA;                 leading bits in the prefix.  The bits in the prefix&#xA;                 after the prefix length are reserved and MUST be&#xA;                 initialized to zero by the sender and ignored by&#xA;                 the receiver.  A router SHOULD NOT send a prefix&#xA;                 option for the link-local prefix and a host SHOULD&#xA;                 ignore such a prefix option.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Description&#xA;The Prefix Information option provide hosts with&#xA;on-link prefixes and prefixes for Address&#xA;Autoconfiguration.  The Prefix Information option&#xA;appears in Router Advertisement packets and MUST be&#xA;silently ignored for other messages.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-09-30T15:58:22.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35382" PostTypeId="2" ParentId="35376" CreationDate="2016-09-30T16:59:12.157" Score="3" Body="&lt;p&gt;in practice your concerns are not generally a significant factor. but here's a way to confirm:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sudo nmap --packet-trace -p 80 hostname&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SENT (0.4506s) [..]&#xA;RCVD (0.4990s) [..]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;that shows you 49ms of latency between the syn and the syn ack. Of course that includes CPU time on the client and server but that's rather unavoidable when doing active measurements.&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-09-30T16:59:12.157" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35383" PostTypeId="2" ParentId="35376" CreationDate="2016-09-30T17:11:12.233" Score="3" Body="&lt;p&gt;If you're asking if you can measure latency using TCP or UDP packets, the answer is a qualified yes.  There is software you can install on servers that will generate TCP/UDP flows, and you can measure the latency from that.  If you have newer Cisco routers, you can use a feature called IP SLA where the routers will generate traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All these assume you can install software on the target server, or you have access to the routers.  The advantage of Ping is that no additional software is needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also capture live traffic with Wireshark or something similar and analyze the packet flows to calculate latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All the caveats that @ronmaupin mentions still hold true -- latency continuously varies as traffic conditions change.  Unless the servers you use are dedicated for this purpose, their changing load can influence your results.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-09-30T18:01:22.770" LastActivityDate="2016-09-30T18:01:22.770" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35384" PostTypeId="2" ParentId="35356" CreationDate="2016-09-30T17:59:47.423" Score="2" Body="&lt;p&gt;That is pretty standard in most firewall nowadays. The feature you are looking for is &quot;App control&quot; and it's a licensed feature in your Sonicwall Firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I confirm you that you can block &quot;league of legends&quot; packets. Take a look at Sonicwall live demo &lt;a href=&quot;http://livedemo.sonicwall.com/ES/&quot; rel=&quot;nofollow&quot;&gt;http://livedemo.sonicwall.com/ES/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2016-09-30T17:59:47.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35385" PostTypeId="1" AcceptedAnswerId="35386" CreationDate="2016-09-30T18:33:59.393" Score="1" ViewCount="1726" Body="&lt;p&gt;I am trying to figure out the configuration required to vlan tag with vlan 201 all traffic coming from one port and send it out another to the ONT for CenturyLink. I have a Cisco 3750e that I am using, and I am trying to put that infront of a running DDWRT that doesn't support vlan tagging on the wan interface for vlans above 15. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I want to use the 3750e to tag all the traffic so the switch just does the PPPoE authentication for the internet connection and traffic tagging is handled by the 3750e. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, I have two ports setup on vlan 201 with one set as a native trunk (planning to plug that one into the ONT feed from the outside) and the other to go to the modem setup as an access port. I haven't tested this yet, but does this sound right?&lt;/p&gt;&#xA;" OwnerUserId="30910" LastActivityDate="2016-11-29T23:30:45.250" Title="How to VLAN tag all traffic from one port before it goes out another" Tags="|cisco|vlan|cisco-3750|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35386" PostTypeId="2" ParentId="35385" CreationDate="2016-09-30T18:56:03.123" Score="0" Body="&lt;p&gt;VLAN tags are used to mark which ethernet frames belong to which VLAN on a trunk link, usually between switches. Setting an access port to VLAN 201 does not add VLAN tags to the frames because most end-devices do not understand VLAN tags in an ethernet frame. By setting a native VLAN on a trunk, you are saying that that particular VLAN will not have a VLAN tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All you need to do to tag frames is to set the interface to trunk. For any VLAN which you want tagged, do not set that VLAN to native. Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/1/1&#xA; description Trunk to CenturyLink&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan &amp;lt;VLAN Range&amp;gt;&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-09-30T18:56:03.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35387" PostTypeId="1" AcceptedAnswerId="35390" CreationDate="2016-09-30T19:21:47.923" Score="1" ViewCount="96" Body="&lt;p&gt;I am fairly familiar with VoIP and I have my own VoIP PBX, and my provider is Twilio (for Voice) and CallCentric (for Fax). But How do providers like Twilio work exactly?  More specifically:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How do VoIP providers get DIDs?&lt;/li&gt;&#xA;&lt;li&gt;When I use my Cell Phone to call my DID on my VoIP SP, how does the cell phone provider know how to route the call to the correct DID?&lt;/li&gt;&#xA;&lt;li&gt;Is there a way to also look up the route that the DID should go to? Is it like a DNS Server?&lt;/li&gt;&#xA;&lt;li&gt;How can I tell who owns a DID?  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16248" LastEditorUserId="8499" LastEditDate="2019-01-04T22:41:01.603" LastActivityDate="2019-01-04T22:41:01.603" Title="VoIP Provider and Phone Number Routing Questions" Tags="|routing|voip|sip|service-provider|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35390" PostTypeId="2" ParentId="35387" CreationDate="2016-09-30T19:53:04.943" Score="1" Body="&lt;p&gt;DIDs are assigned by the telcos which own them. A VoIP provider buys a block of DIDs from the telcos it uses where its VoIP network interfaces with the POTS network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your cell call travels from the cellular network to the POTS network, where it gets routed to the interface with your VoIP provider. POTS call routing is basically the same as it has been for a hundred years, and the subject of POTS routing is far too large to be discussed here, but it basically sets up a single circuit between two points; the cellular network and the VoIP network, in your case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would need access to the POTS providers' databases to figure out who owns a DID range.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-09-30T21:52:29.860" LastActivityDate="2016-09-30T21:52:29.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35393" PostTypeId="1" AcceptedAnswerId="35411" CreationDate="2016-09-30T20:51:22.260" Score="1" ViewCount="1145" Body="&lt;p&gt;Is it possible to supply internet up to 5km-10km using wifi ? If yes how ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Me and my friend want to get Internet in our Village. Our current options are 1. Mobile internet(not cost effective at all) 2. Local Broadband provider (which is over 5km away so it's practically not suitable to use cable in this long distance moreover it's rural area)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is why we need something to broadcast internet up to 5km-10km wirelessly. Googled but not getting anything specific or maybe my knowledge of networking is too poor to understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please HELP!&lt;/p&gt;&#xA;" OwnerUserId="30911" LastActivityDate="2016-10-05T15:58:00.930" Title="Long distance wifi internet" Tags="|ieee-802.11|internet|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35395" PostTypeId="1" CreationDate="2016-09-30T22:03:33.483" Score="2" ViewCount="2042" Body="&lt;p&gt;Has anyone configured Active FTP in Meraki? If so, will you please assist me with how to configure it on an MX100?&lt;/p&gt;&#xA;" OwnerUserId="30917" LastEditorUserId="8499" LastEditDate="2019-01-02T22:29:28.743" LastActivityDate="2019-01-02T22:29:28.743" Title="Active FTP in Meraki" Tags="|firewall|nat|meraki|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35396" PostTypeId="2" ParentId="35395" CreationDate="2016-09-30T23:02:56.647" Score="2" Body="&lt;p&gt;Cisco maintains documentation for this type of thing. It takes about 2 seconds to locate the specific document on how to do this. &lt;a href=&quot;https://documentation.meraki.com/MX-Z/NAT_and_Port_Forwarding/Active_and_Passive_FTP_Overview_and_Configuration&quot; rel=&quot;nofollow noreferrer&quot;&gt;Active and Passive FTP Overview and Configuration&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Active FTP Overview&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;An active FTP session involves the following steps:  &lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;The client sends the PORT command to an FTP server. The source port&#xA;  is a random, high-numbered port. The destination port is 21.&lt;/li&gt;&#xA;  &lt;li&gt;The server responds with an ACK.&lt;/li&gt;&#xA;  &lt;li&gt;The server initiates a connection to the client with source port 20&#xA;  and the destination port specified in the client’s PORT command.&lt;/li&gt;&#xA;  &lt;li&gt;The client sends an ACK to the server.  The FTP session has now been&#xA;  established.   Client firewalls are often configured to block incoming connections. This causes step 3 of the above process to fail,&#xA;  as shown below: &lt;a href=&quot;https://i.stack.imgur.com/as5fr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/as5fr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;h2&gt;MX Configuration for Active FTP&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Configuration for active FTP on an MX appliance is a simple process.&#xA;  Firewall rules must be constructed to allow inbound connections on&#xA;  port 21 and 20. Additional information about constructing firewall&#xA;  rules can be found here, and the following example below details a 1:1&#xA;  NAT rule that allows inbound connections to an internal FTP server.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/t2JmR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/t2JmR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;By default, MX appliances allow all outbound connections, so no&#xA;  additional firewall configuration is necessary. The following diagram&#xA;  outlines the flow of active FTP traffic, and where the MX comes into&#xA;  play: &lt;a href=&quot;https://i.stack.imgur.com/jzujy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jzujy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-09-30T23:21:43.897" LastActivityDate="2016-09-30T23:21:43.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35398" PostTypeId="1" CreationDate="2016-10-01T03:39:22.000" Score="0" ViewCount="64" Body="&lt;p&gt;I have 2 branches and I would like to connect them together through the internet they are in 2 different cities so how this work and what protocols should I use?  &lt;/p&gt;&#xA;" OwnerUserId="23760" LastActivityDate="2016-10-02T12:15:38.513" Title="How to connect 2 routers through the internet?" Tags="|network-access|" AnswerCount="2" CommentCount="5" ClosedDate="2019-02-23T00:20:44.533" ContentLicense="CC BY-SA 3.0" />
  <row Id="35399" PostTypeId="1" CreationDate="2016-10-01T07:08:15.317" Score="1" ViewCount="722" Body="&lt;p&gt;I'm using NAT Hairpin on a 1841 cisco router, I would like to open a range of ports 5555 - 5574 tcp and 2326 - 2485. All I've been able to find is command for using NAT (inside) / (outside). Anyone have any suggestions when you NAT Hairpin feature? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="30922" LastActivityDate="2019-04-20T15:03:05.637" Title="IP NAT Enable - Port Forwarding Range" Tags="|cisco|nat|loopback|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35400" PostTypeId="1" CreationDate="2016-10-01T08:07:06.180" Score="-1" ViewCount="768" Body="&lt;p&gt;i`m trying to connect multiple subnets to one web server but these subnets should not be able to connect to each other.i cant make any changes on these subnets. I just have a lan cable from each subnet and my server.&#xA;tnx&lt;/p&gt;&#xA;" OwnerUserId="30925" LastActivityDate="2021-02-10T18:05:15.580" Title="how to make multiple subnet able to use one resource without being able to connect to each other in any way" Tags="|router|vlan|subnet|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="35402" PostTypeId="1" AcceptedAnswerId="35408" CreationDate="2016-10-01T10:15:08.620" Score="0" ViewCount="1574" Body="&lt;p&gt;That's what I do .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1、open &lt;code&gt;tcpdump&lt;/code&gt; command &lt;code&gt;sudo tcpdump  -i lo0 tcp port 20009&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2、start a sample server &lt;code&gt;nc -l 20009&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3、connect 20009 port &lt;code&gt;telnet localhost 20009&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4、&lt;code&gt;tcpdump&lt;/code&gt; command got :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;○ → sudo tcpdump  -i lo0 tcp port 20009&#xA;Password:&#xA;tcpdump: verbose output suppressed, use -v or -vv for full protocol decode&#xA;listening on lo0, link-type NULL (BSD loopback), capture size 262144 bytes&#xA;17:38:42.778304 IP6 localhost.58951 &amp;gt; localhost.20009: Flags [S], seq 4206287588, win 65535, options [mss 16324,nop,wscale 5,nop,nop,TS val 461712269 ecr 0,sackOK,eol], length 0&#xA;17:38:42.778341 IP6 localhost.20009 &amp;gt; localhost.58951: Flags [R.], seq 0, ack 4206287589, win 0, length 0&#xA;17:38:42.778536 IP localhost.58952 &amp;gt; localhost.20009: Flags [S], seq 2745154881, win 65535, options [mss 16344,nop,wscale 5,nop,nop,TS val 461712269 ecr 0,sackOK,eol], length 0&#xA;17:38:42.778614 IP localhost.20009 &amp;gt; localhost.58952: Flags [S.], seq 3385478755, ack 2745154882, win 65535, options [mss 16344,nop,wscale 5,nop,nop,TS val 461712269 ecr 461712269,sackOK,eol], length 0&#xA;17:38:42.778629 IP localhost.58952 &amp;gt; localhost.20009: Flags [.], ack 1, win 12759, options [nop,nop,TS val 461712269 ecr 461712269], length 0&#xA;17:38:42.778643 IP localhost.20009 &amp;gt; localhost.58952: Flags [.], ack 1, win 12759, options [nop,nop,TS val 461712269 ecr 461712269], length 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;why the client(localhost.58952) don't send back the &lt;code&gt;ack&lt;/code&gt;(value 1) to server (localhost.20009) in the third step ?&lt;/p&gt;&#xA;" OwnerUserId="30918" LastEditorUserId="30918" LastEditDate="2016-10-02T03:00:32.090" LastActivityDate="2016-10-02T03:00:32.090" Title="why I didn't get three way handshake by tcpdump command?" Tags="|tcp|tcpdump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35404" PostTypeId="2" ParentId="35399" CreationDate="2016-10-01T11:15:18.800" Score="1" Body="&lt;p&gt;You need to use ACLs which would stop all traffic that isn't defined in the ACL rules. If you have only &lt;code&gt;nat(inside,outside)&lt;/code&gt; that will allow all traffic out and and block all traffic in. There are some specially crafted packets that might get around this but most likely to be done by an ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at this doc &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security/ios-firewall/23602-confaccesslists.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit tcp any 10.10.10.10 range 5555 5574&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't have a router to experiment on right now but will try to pull a config segment if you can't get it going.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is another resource similar to your question.&#xA;&lt;a href=&quot;https://supportforums.cisco.com/discussion/11593786/nat-udp-port-range-forwarding-howto&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://supportforums.cisco.com/discussion/11593786/nat-udp-port-range-forwarding-howto&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="6278" LastEditorUserId="453" LastEditDate="2018-03-26T07:17:53.533" LastActivityDate="2018-03-26T07:17:53.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35406" PostTypeId="2" ParentId="35398" CreationDate="2016-10-01T15:36:21.923" Score="1" Body="&lt;p&gt;There are plenty of ways to connect a router to another router trough a cloud, if you say you'd like to interconnect them trough internet I am assuming you want a LAN-to-LAN connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this, an IPSEC VPN is my best choice since it gives you security and privacy over a public cloud as the internet but to do that you will need a Public IP address bought on both sides of your routers&lt;/p&gt;&#xA;" OwnerUserId="30930" LastActivityDate="2016-10-01T15:36:21.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35408" PostTypeId="2" ParentId="35402" CreationDate="2016-10-01T19:14:38.877" Score="3" Body="&lt;p&gt;Your system has defined localhost as both ::1 (ipv6) and 127.0.0.1 (ipv4), so telnet first tries ipv6 and if this fails it tries ipv4.   The first packet is a SYN to ::1 but because no process is listening on that address and port, the system responds with a RST (packet 2). Packet 3 is then the SYN to 127.0.0.1 and packet 4 is the SYN+ACK etc.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-01T19:14:38.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35411" PostTypeId="2" ParentId="35393" CreationDate="2016-10-01T21:42:05.860" Score="2" Body="&lt;p&gt;If you have line of sight then it should be possible to set up a wireless link over a few kilometers. You would want high gain antennas on both ends, you could either (ab)use wi-fi gear or look for gear designed for the purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Getting the antennas as high off the ground as possible is nearly always a good idea to ensure you get the line of sight path and to reduce the impact of ground reflections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be aware that simply slapping high gain antennas on wifi gear may exceed effective radiated power limitations in radio regulations. If you care about being legal you would need to check your local laws and quite probablly turn down the transmit power. Having the high gain antennas still helps even with reduced transmit power because high gain antennas help both transmission and reception.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to connect devices wirelessly at the endpoint you would use a seperate wifi network with an omnidirectional anntena for that.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-10-05T11:22:59.663" LastActivityDate="2016-10-05T11:22:59.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35413" PostTypeId="1" AcceptedAnswerId="35414" CreationDate="2016-10-02T01:46:07.997" Score="1" ViewCount="742" Body="&lt;p&gt;I read in different place on the internet, on research papers and books the term &quot;Multiservice IP Network&quot; or &quot;Multiservice Network&quot; or even &quot;Multiservice Traffic&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the meaning of these different expressions, especially the first ones ?&lt;/p&gt;&#xA;" OwnerUserId="30939" LastActivityDate="2016-10-02T01:58:29.853" Title="What is Multiservice IP Network" Tags="|internet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35414" PostTypeId="2" ParentId="35413" CreationDate="2016-10-02T01:58:29.853" Score="1" Body="&lt;p&gt;Multiservice networks have mixture of different traffic types (e.g. various data, VoIP, video, etc.) converged on the same network, and the network can properly support the various applications requiring the disparate traffic. This typically requires a very good set of QoS policies that are implemented consistently across the entire network. The first two terms you list are interchangeable, while the last term describes the diversity of network traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-02T01:58:29.853" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35416" PostTypeId="1" CreationDate="2016-10-02T04:53:39.187" Score="1" ViewCount="122" Body="&lt;p&gt;I am new to setting up a full network, so I am setting up a testing lab in my home. What I have running is the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Two servers that both run vmware esxi where I have server 2012 r2&#xA;installed on both.&lt;/li&gt;&#xA;&lt;li&gt;I have 2 switches one is a xtreme summit x250e and the other is a&#xA;dell powerconnect 5424. It is just two switches I had laying around.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, I am trying to get both severs connected to my domain and be able to talk to each other on different subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I have one server on &lt;code&gt;192.168.20.1/24&lt;/code&gt;, and the other is on &lt;code&gt;192.168.30.1/24&lt;/code&gt;. The xtreme switch one has 2 vlans, the default with all ports untagged, and another vlan for my dhcp ports from the server. This seems to work fine as it is, assigning IP addresses to the clients just fine using &lt;code&gt;192.168.20.1/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other server and dell switch are on &lt;code&gt;192.168.30.1/24&lt;/code&gt;. I just cant seem to get the two to communicate with each other. I know I need to connect the switches together and that is where I am stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this is how I have it setup now &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I start with my modem that is connected to my pfsense firewall with a lan IP of 192.168.20.1&#xA;From my pfsense firewall I am going into the xtreme switch with a default gateway of 192.168.20.2 this is then connected to the server 2012 r2 running dchp and this is working &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then have another server 2012 r2 that is connected to the Dell switch with default gateway 192.168.30.2 I need to get this added to the domain and talk to the first server &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If any could help me out it would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a diagram with what I am trying to do again I am new to setting anything like this up before so Please tell me if I am all wrong with the setup as I am trying to learn how to do this Dont mind my diagram I did it in paint &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jrwky.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jrwky.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30940" LastEditorUserId="30940" LastEditDate="2016-10-03T15:50:04.067" LastActivityDate="2016-10-03T15:50:04.067" Title="Need some help with switches" Tags="|switch|router|vlan|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="35419" PostTypeId="2" ParentId="11098" CreationDate="2016-10-02T09:49:15.817" Score="0" Body="&lt;p&gt;IP is the common ground that ties the Internet together. IP can run on top of many different underlying network technologies and many different higher level protocols can run on top of IP. Parts of the Internet certainly do run on top of ATM networks. Ethernet is becoming the dominent technology but it's by no means the only technology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being &quot;on the Internet&quot; means being able to reach all or at least the vast majority of other hosts &quot;on the Internet&quot;. That means interconnecting with other networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two main types of relationship, peering and transit (and also various intermediate possibilities).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a transit relationship, a customer pays a provider to deliver traffic to and from the &quot;Internet in general&quot;. The provider will almost certainly charge the customer for this service. It will almost certainly run over a private link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a peering relationship, two networks interconnect so that each network and it's customers can talk to the other nework and it's customers. The agreement may be &quot;settlement free&quot; or it may be paid depending on the relative negotiating positions of the two proviers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the top of the pile are transit free providers (sometimes called &quot;teir 1&quot;, but the traditional definition of &quot;teir 1&quot; required settlement free peering while it's possible to become transit free using paid peering). These all peer with each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. It is exactly because IP is the common ground that the process of upgrading from IPv4 to IPv6 is so painful. Essentially there are now two seperate Internets, the IPv4 internet and the IPv6 internet. They run on top of the same infrastructure and there are some limited transition mechanisms but they are essentially seperate networks.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-10-02T09:49:15.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35420" PostTypeId="1" CreationDate="2016-10-02T10:12:17.407" Score="1" ViewCount="77" Body="&lt;p&gt;Allow me to elaborate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It recently struck me that, if you want to visit a machine, you need to know its IP address. Fair enough. But if it was behind a router, then you will have to have the router properly configured to forward your packet to the target machine, which can be accomplished by using a port number, again, fair enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it begs a slightly more complicated question, what if your target machine is behind 2 or more tiers of routers? How does that work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure it works, since machines like that can browse internet without any problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help? Please?&lt;/p&gt;&#xA;" OwnerUserId="30947" LastActivityDate="2017-01-22T23:37:21.287" Title="How does a server send your machine packets, which is behind 2 tiers of routers?" Tags="|router|tcp|ip|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35421" PostTypeId="2" ParentId="35420" CreationDate="2016-10-02T12:00:36.050" Score="0" Body="&lt;p&gt;Thats a good question! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is your situation if im not wrong:&#xA;(Router A)[10.10.10.1][Gig0/1]-----------[10.10.10.2][Gig0/1](Router B)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you add another Router (Router C) to the equation, you end up with this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Router A)[10.10.10.1][Gig0/1]-----------[10.10.10.2][Gig0/1](Router B)[Gig0/2][10.20.20.1]---------(Router C)[Gig0/2][10.20.20.2]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now lets add the servers:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Server 1)[20.10.10.1][Gig0/2]----[Gig0/2][20.10.10.2](Router A)[10.10.10.1][Gig0/1]-----------[Gig0/1][10.10.10.2](Router B)[10.20.20.1][Gig0/2]---------[Gig0/2][10.20.20.2](Router C)[Gig0/1][30.10.10.2]-----[Gig0/1][30.10.10.1](Server 2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If (Server 2) wants to send a packet to (Server 1) then (Router C) will have to know what to do with that. Routers have IP tables, which they populate with routing protocols (you can read more about them:RIP, OSPF, BGP.. others), in this case one of those protocols will be in charge of letting each router know which network is connected to who. In this example Router C will know that in orther to get to the 20.10.10.0/24 network it has to send that traffic to Router B and that is how Internet works! (basic example) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope I explained myself&lt;/p&gt;&#xA;" OwnerUserId="20753" LastActivityDate="2016-10-02T12:00:36.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35422" PostTypeId="2" ParentId="35416" CreationDate="2016-10-02T12:07:20.693" Score="2" Body="&lt;p&gt;Connect both switches and assign a different IP range to those interfaces, lets say 10.10.10.1/24 to Switch A and 10.10.10.2/24 to Switch B, then you will need:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A routing protocol to communicate between both access layers&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Or&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configure both default gateways with the IP of the interface facing the other Switch, that way if Switch A receives a packet with a destination IP that is not directly connected it will be sent to Switch B&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Or&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Configure an static IP route on both switches pointing toward each others&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;On the other hand you could use only one switch and forget about the rest (as @hertitu suggested below) but since this is a lab environment I suppose you want to get your hands dirty and learn by doing so.&lt;/p&gt;&#xA;" OwnerUserId="20753" LastEditorUserId="20753" LastEditDate="2016-10-03T10:38:08.970" LastActivityDate="2016-10-03T10:38:08.970" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35423" PostTypeId="2" ParentId="35398" CreationDate="2016-10-02T12:15:38.513" Score="0" Body="&lt;p&gt;I know you asked about connecting them via Internet, but since I cant comment yet I will have to ask you here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Have you considered asking your ISP for a Leased Line? Its a layer 2 connection from Office A to Office B, latency will be very low and it does the job pretty well.&lt;/p&gt;&#xA;" OwnerUserId="20753" LastActivityDate="2016-10-02T12:15:38.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35424" PostTypeId="1" CreationDate="2016-10-02T12:33:22.673" Score="3" ViewCount="282" Body="&lt;p&gt;We have created a network as shown in the topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nTLnY.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nTLnY.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is for subnets/networks in LAN_SW to tagged and the tagged networks to be recognized by routers, CPE, PE CORE_P, REMOTE_PE, REMOTE_CPE and finally placed in the routing table of REMOTE_LAN_SW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tagged ip prefix-list 7.7.7.7/32 with tag 100 in LAND_SW. However, as you will see in show commands, the tag isn't being picked by eigrp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you please take a look at the configuration and show commands and let me know where I might be going wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CORE_P:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/0&#xA; description TO PE&#xA; ip address 10.0.0.4 255.255.255.0&#xA; mpls ip&#xA;!&#xA;interface Ethernet0/2&#xA; description TO RR&#xA; ip address 10.2.0.4 255.255.255.0&#xA; mpls ip&#xA;!&#xA;interface Ethernet1/1&#xA; description TO REMOTE PE&#xA; ip address 10.1.0.4 255.255.255.0&#xA; mpls ip&#xA;!&#xA;router ospf 1&#xA;!&#xA;router ospf 100&#xA; network 10.0.0.0 0.255.255.255 area 0&#xA;!&#xA;CORE_P#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     3.0.0.0/32 is subnetted, 1 subnets&#xA;O       3.3.3.3 [110/11] via 10.0.0.3, 1d22h, Ethernet0/0&#xA;     4.0.0.0/32 is subnetted, 1 subnets&#xA;O       4.4.4.4 [110/11] via 10.2.0.9, 1d22h, Ethernet0/2&#xA;     5.0.0.0/32 is subnetted, 1 subnets&#xA;O       5.5.5.5 [110/11] via 10.1.0.5, 1d22h, Ethernet1/1&#xA;     10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks&#xA;C       10.0.0.0/24 is directly connected, Ethernet0/0&#xA;L       10.0.0.4/32 is directly connected, Ethernet0/0&#xA;C       10.1.0.0/24 is directly connected, Ethernet1/1&#xA;L       10.1.0.4/32 is directly connected, Ethernet1/1&#xA;C       10.2.0.0/24 is directly connected, Ethernet0/2&#xA;L       10.2.0.4/32 is directly connected, Ethernet0/2&#xA;CORE_P#show ip eigrp topology&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;CPE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 2.2.2.2 255.255.255.255&#xA;!&#xA;interface Ethernet0/0&#xA; description connected to lan_sw&#xA; ip address 192.168.0.2 255.255.255.0&#xA;!&#xA;interface Ethernet0/1&#xA; description connected to PE&#xA; ip address 100.65.0.2 255.255.255.252&#xA;!&#xA;router eigrp 100&#xA; network 192.0.0.0 0.255.255.255&#xA; redistribute bgp 65000 metric 100000 100 255 1 1500 route-map BGP_TO_EIGRP&#xA; eigrp router-id 2.2.2.2&#xA;!&#xA;router bgp 65000&#xA; bgp router-id 2.2.2.2&#xA; bgp log-neighbor-changes&#xA; timers bgp 10 30&#xA; neighbor 100.65.0.1 remote-as 3549&#xA;!&#xA; address-family ipv4&#xA;  network 2.2.2.2 mask 255.255.255.255&#xA;  redistribute eigrp 100 route-map EIGRP_TO_BGP&#xA;  neighbor 100.65.0.1 activate&#xA;  neighbor 100.65.0.1 send-community both&#xA;  neighbor 100.65.0.1 soft-reconfiguration inbound&#xA;  exit-address-family&#xA;!&#xA;route-map BGP_TO_EIGRP permit 5&#xA; set tag 10&#xA;!&#xA;route-map EIGRP_TO_BGP deny 5&#xA; match tag 10&#xA;!&#xA;route-map EIGRP_TO_BGP permit 10&#xA; match tag 100&#xA; set community 65000:100 65000:999&#xA;!&#xA;route-map EIGRP_TO_BGP permit 20&#xA; match tag 200&#xA; set community 65000:200&#xA;!&#xA;CPE#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     1.0.0.0/32 is subnetted, 1 subnets&#xA;D EX    1.1.1.1 [170/2585600] via 192.168.0.1, 1d19h, Ethernet0/0&#xA;     2.0.0.0/32 is subnetted, 1 subnets&#xA;C       2.2.2.2 is directly connected, Loopback0&#xA;     6.0.0.0/32 is subnetted, 1 subnets&#xA;B       6.6.6.6 [20/0] via 100.65.0.1, 1d19h&#xA;     9.0.0.0/32 is subnetted, 1 subnets&#xA;D EX    9.9.9.9 [170/2585600] via 192.168.0.1, 1d19h, Ethernet0/0&#xA;     10.0.0.0/30 is subnetted, 1 subnets&#xA;D EX    10.0.40.0 [170/2585600] via 192.168.0.1, 1d19h, Ethernet0/0&#xA;     50.0.0.0/32 is subnetted, 1 subnets&#xA;B       50.50.50.50 [20/0] via 100.65.0.1, 1d19h&#xA;     100.0.0.0/8 is variably subnetted, 3 subnets, 2 masks&#xA;C       100.65.0.0/30 is directly connected, Ethernet0/1&#xA;L       100.65.0.2/32 is directly connected, Ethernet0/1&#xA;B       100.100.100.100/32 [20/0] via 100.65.0.1, 1d19h&#xA;     192.168.0.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C       192.168.0.0/24 is directly connected, Ethernet0/0&#xA;L       192.168.0.2/32 is directly connected, Ethernet0/0&#xA;CPE#show ip eigrp topology&#xA;EIGRP-IPv4 Topology Table for AS(100)/ID(2.2.2.2)&#xA;Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,&#xA;       r - reply Status, s - sia Status&#xA;P 50.50.50.50/32, 1 successors, FD is 51200, tag is 10&#xA;        via Redistributed (51200/0)&#xA;P 100.100.100.100/32, 1 successors, FD is 51200, tag is 10&#xA;        via Redistributed (51200/0)&#xA;P 192.168.0.0/24, 1 successors, FD is 281600&#xA;        via Connected, Ethernet0/0&#xA;P 10.0.40.0/30, 1 successors, FD is 2585600, tag is 100&#xA;       via 192.168.0.1 (2585600/2560000), Ethernet0/0&#xA;P 2.2.2.2/32, 1 successors, FD is 51200, tag is 10&#xA;       via Redistributed (51200/0)&#xA;P 6.6.6.6/32, 1 successors, FD is 51200, tag is 10&#xA;       via Redistributed (51200/0)&#xA;P 1.1.1.1/32, 1 successors, FD is 2585600, tag is 100&#xA;       via 192.168.0.1 (2585600/2560000), Ethernet0/0&#xA;P 9.9.9.9/32, 1 successors, FD is 2585600, tag is 100&#xA;       via 192.168.0.1 (2585600/2560000), Ethernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;LAN_SW:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 1.1.1.1 255.255.255.255&#xA;!&#xA;interface Loopback999&#xA; ip address 9.9.9.9 255.255.255.255&#xA;!&#xA;interface Ethernet0/0&#xA; description connected to CPE&#xA; no switchport&#xA; ip address 192.168.0.1 255.255.255.0&#xA; duplex auto&#xA;!&#xA;interface Ethernet0/2&#xA; description connected to REMOTE_LAN_SW&#xA; no switchport&#xA; ip address 10.0.40.1 255.255.255.252&#xA; duplex auto&#xA;!&#xA;router eigrp 100&#xA; network 10.9.1.32 0.0.0.31&#xA; network 192.168.0.0&#xA; redistribute connected metric 1000 0 255 1 1500 route-map TAG&#xA; redistribute bgp 500 metric 1000 0 255 1 1500 route-map BGP-TO-EIGRP&#xA;!&#xA;router bgp 500&#xA; bgp router-id 9.9.9.9&#xA; bgp log-neighbor-changes&#xA; neighbor 10.0.40.2 remote-as 600&#xA;!&#xA; address-family ipv4&#xA;  redistribute connected&#xA;  redistribute eigrp 100 route-map EIGRP-TO-BGP&#xA;  neighbor 10.0.40.2 activate&#xA;  neighbor 10.0.40.2 soft-reconfiguration inbound&#xA;  exit-address-family&#xA;!&#xA;ip prefix-list TAG seq 5 permit 7.7.7.7/32&#xA;!&#xA;route-map EIGRP-TO-BGP permit 10&#xA;!&#xA;route-map BGP-TO-EIGRP permit 10&#xA; match ip address prefix-list TAG&#xA; set tag 555&#xA;!&#xA;route-map TAG permit 10&#xA; set tag 100&#xA;!&#xA;LAN_SW#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     1.0.0.0/32 is subnetted, 1 subnets&#xA;C       1.1.1.1 is directly connected, Loopback0&#xA;     2.0.0.0/32 is subnetted, 1 subnets&#xA;D EX    2.2.2.2 [170/307200] via 192.168.0.2, 1d19h, Ethernet0/0&#xA;     6.0.0.0/32 is subnetted, 1 subnets&#xA;B       6.6.6.6 [20/307200] via 10.0.40.2, 1d19h&#xA;     9.0.0.0/32 is subnetted, 1 subnets&#xA;C       9.9.9.9 is directly connected, Loopback999&#xA;     10.0.0.0/8 is variably subnetted, 3 subnets, 3 masks&#xA;C       10.0.40.0/30 is directly connected, Ethernet0/2&#xA;L       10.0.40.1/32 is directly connected, Ethernet0/2&#xA;B       10.9.1.0/27 [20/0] via 10.0.40.2, 1d19h&#xA;     50.0.0.0/32 is subnetted, 1 subnets&#xA;B       50.50.50.50 [20/0] via 10.0.40.2, 1d19h&#xA;     100.0.0.0/32 is subnetted, 1 subnets&#xA;B       100.100.100.100 [20/307200] via 10.0.40.2, 1d19h&#xA;     192.168.0.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C       192.168.0.0/24 is directly connected, Ethernet0/0&#xA;L       192.168.0.1/32 is directly connected, Ethernet0/0&#xA;LAN_SW#show ip eigrp topology&#xA;EIGRP-IPv4 Topology Table for AS(100)/ID(9.9.9.9)&#xA;Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,&#xA;       r - reply Status, s - sia Status&#xA;P 50.50.50.50/32, 0 successors, FD is Inaccessible, tag is 10&#xA;        via 192.168.0.2 (307200/51200), Ethernet0/0&#xA;P 100.100.100.100/32, 0 successors, FD is Inaccessible, tag is 10&#xA;        via 192.168.0.2 (307200/51200), Ethernet0/0&#xA;P 192.168.0.0/24, 1 successors, FD is 281600&#xA;        via Connected, Ethernet0/0&#xA;P 10.0.40.0/30, 1 successors, FD is 281600, tag is 100&#xA;        via Rconnected (2560000/0)&#xA;P 2.2.2.2/32, 1 successors, FD is 307200, tag is 10&#xA;        via 192.168.0.2 (307200/51200), Ethernet0/0&#xA;P 6.6.6.6/32, 0 successors, FD is Inaccessible, tag is 10&#xA;        via 192.168.0.2 (307200/51200), Ethernet0/0&#xA;P 1.1.1.1/32, 1 successors, FD is 128256, tag is 100&#xA;        via Rconnected (2560000/0)&#xA;P 9.9.9.9/32, 1 successors, FD is 128256, tag is 100&#xA;        via Rconnected (2560000/0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;PE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 3.3.3.3 255.255.255.255&#xA; ip ospf 100 area 0&#xA;!&#xA;interface Ethernet0/0&#xA; description connected to core_p&#xA; ip address 10.0.0.3 255.255.255.0&#xA; mpls ip&#xA;!&#xA;interface Ethernet0/1&#xA; description connected to cpe&#xA; ip vrf forwarding JM_CORP&#xA; ip address 100.65.0.1 255.255.255.252&#xA;!&#xA;router ospf 100&#xA; network 3.3.3.3 0.0.0.0 area 0&#xA; network 10.0.0.0 0.255.255.255 area 0&#xA;!&#xA;router bgp 3549&#xA; bgp router-id 3.3.3.3&#xA; bgp log-neighbor-changes&#xA; timers bgp 10 30&#xA; neighbor 4.4.4.4 remote-as 3549&#xA; neighbor 4.4.4.4 update-source Loopback0&#xA;!&#xA; address-family ipv4&#xA;  network 3.3.3.3 mask 255.255.255.255&#xA;  redistribute connected&#xA;  neighbor 4.4.4.4 activate&#xA;  neighbor 4.4.4.4 send-community both&#xA;  neighbor 4.4.4.4 next-hop-self&#xA;  exit-address-family&#xA;!&#xA; address-family vpnv4&#xA;  neighbor 4.4.4.4 activate&#xA;  neighbor 4.4.4.4 send-community both&#xA;  neighbor 4.4.4.4 next-hop-self&#xA;  exit-address-family&#xA;!&#xA; address-family ipv4 vrf JM_CORP&#xA;  neighbor 100.65.0.2 remote-as 65000&#xA;  neighbor 100.65.0.2 activate&#xA;  neighbor 100.65.0.2 send-community both&#xA;  neighbor 100.65.0.2 as-override&#xA;  neighbor 100.65.0.2 soft-reconfiguration inbound&#xA;  neighbor 100.65.0.2 route-map BGP_POLICY_IN in&#xA;  exit-address-family&#xA;!&#xA;ip community-list standard REGIONAL_LP_100 permit 65000:100&#xA;ip community-list standard REGIONAL_LP_200 permit 65000:200&#xA;ip community-list standard REGIONAL_LP_300 permit 65000:300&#xA;!&#xA;route-map BGP_POLICY_IN permit 10&#xA; match community REGIONAL_LP_100&#xA; set local-preference 333&#xA;!&#xA;route-map BGP_POLICY_IN permit 20&#xA; match community REGIONAL_LP_200&#xA; set local-preference 200&#xA;!&#xA;route-map BGP_POLICY_IN permit 30&#xA; match community REGIONAL_LP_300&#xA; set local-preference 300&#xA;!&#xA;route-map BGP_POLICY_IN permit 40&#xA;!&#xA;PE#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     3.0.0.0/32 is subnetted, 1 subnets&#xA;C       3.3.3.3 is directly connected, Loopback0&#xA;     4.0.0.0/32 is subnetted, 1 subnets&#xA;O       4.4.4.4 [110/21] via 10.0.0.4, 1d22h, Ethernet0/0&#xA;     5.0.0.0/32 is subnetted, 1 subnets&#xA;O       5.5.5.5 [110/21] via 10.0.0.4, 1d22h, Ethernet0/0&#xA;     10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks&#xA;C       10.0.0.0/24 is directly connected, Ethernet0/0&#xA;L       10.0.0.3/32 is directly connected, Ethernet0/0&#xA;O       10.1.0.0/24 [110/20] via 10.0.0.4, 1d22h, Ethernet0/0&#xA;O       10.2.0.0/24 [110/20] via 10.0.0.4, 1d22h, Ethernet0/0&#xA;PE#show ip eigrp topology&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;REMOTE_CPE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 6.6.6.6 255.255.255.255&#xA;!&#xA;interface Ethernet0/0&#xA; description connected to remote_lan_swith&#xA; ip address 10.9.1.11 255.255.255.224&#xA;!&#xA;interface Ethernet0/1&#xA; description connected to remote_pe&#xA; ip address 100.65.1.2 255.255.255.252&#xA;!&#xA;router eigrp 100&#xA; network 10.9.1.0 0.0.0.31&#xA; network 192.0.0.0 0.255.255.255&#xA; redistribute bgp 65000 metric 100000 100 255 1 1500 route-map BGP_TO_EIGRP&#xA; eigrp router-id 6.6.6.6&#xA;!&#xA;router bgp 65000&#xA; bgp router-id 6.6.6.6&#xA; bgp log-neighbor-changes&#xA; timers bgp 10 30&#xA; neighbor 100.65.1.1 remote-as 3549&#xA;!&#xA; address-family ipv4&#xA;  network 6.6.6.6 mask 255.255.255.255&#xA;  redistribute eigrp 100 route-map EIGRP_TO_BGP&#xA;  neighbor 100.65.1.1 activate&#xA;  neighbor 100.65.1.1 send-community both&#xA;  neighbor 100.65.1.1 soft-reconfiguration inbound&#xA;  exit-address-family&#xA;!&#xA;route-map BGP_TO_EIGRP permit 5&#xA; set tag 10&#xA;!&#xA;route-map EIGRP_TO_BGP deny 5&#xA; match tag 10&#xA;!&#xA;route-map EIGRP_TO_BGP permit 10&#xA; match tag 100&#xA; set community 65000:100&#xA;!&#xA;route-map EIGRP_TO_BGP permit 20&#xA; match tag 200&#xA; set community 65000:200&#xA;!&#xA;REMOTE_CPE#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     1.0.0.0/32 is subnetted, 1 subnets&#xA;B       1.1.1.1 [20/0] via 100.65.1.1, 1d19h&#xA;     2.0.0.0/32 is subnetted, 1 subnets&#xA;B       2.2.2.2 [20/0] via 100.65.1.1, 1d19h&#xA;     6.0.0.0/32 is subnetted, 1 subnets&#xA;C       6.6.6.6 is directly connected, Loopback0&#xA;     9.0.0.0/32 is subnetted, 1 subnets&#xA;B       9.9.9.9 [20/0] via 100.65.1.1, 1d19h&#xA;     10.0.0.0/8 is variably subnetted, 3 subnets, 3 masks&#xA;D EX    10.0.40.0/30 [170/307200] via 10.9.1.1, 1d19h, Ethernet0/0&#xA;C       10.9.1.0/27 is directly connected, Ethernet0/0&#xA;L       10.9.1.11/32 is directly connected, Ethernet0/0&#xA;     50.0.0.0/32 is subnetted, 1 subnets&#xA;D EX    50.50.50.50 [170/409600] via 10.9.1.1, 1d21h, Ethernet0/0&#xA;     100.0.0.0/8 is variably subnetted, 3 subnets, 2 masks&#xA;C       100.65.1.0/30 is directly connected, Ethernet0/1&#xA;L       100.65.1.2/32 is directly connected, Ethernet0/1&#xA;B       100.100.100.100/32 [20/0] via 100.65.1.1, 1d22h&#xA;REMOTE_CPE#show ip eigrp topology&#xA;EIGRP-IPv4 Topology Table for AS(100)/ID(6.6.6.6)&#xA;Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,&#xA;       r - reply Status, s - sia Status&#xA;P 10.9.1.0/27, 1 successors, FD is 281600&#xA;        via Connected, Ethernet0/0&#xA;P 50.50.50.50/32, 1 successors, FD is 409600, tag is 200&#xA;        via 10.9.1.1 (409600/128256), Ethernet0/0&#xA;P 100.100.100.100/32, 1 successors, FD is 51200, tag is 10&#xA;        via Redistributed (51200/0)&#xA;P 10.0.40.0/30, 1 successors, FD is 307200, tag is 200&#xA;        via 10.9.1.1 (307200/281600), Ethernet0/0&#xA;P 2.2.2.2/32, 1 successors, FD is 51200, tag is 10&#xA;        via Redistributed (51200/0)&#xA;P 6.6.6.6/32, 1 successors, FD is 51200, tag is 10&#xA;        via Redistributed (51200/0)&#xA;P 1.1.1.1/32, 1 successors, FD is 51200, tag is 10&#xA;        via Redistributed (51200/0)&#xA;P 9.9.9.9/32, 1 successors, FD is 51200, tag is 10&#xA;        via Redistributed (51200/0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;REMOTE_LAN_SWITCH:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 50.50.50.50 255.255.255.255&#xA;!&#xA;interface Ethernet0/0&#xA; description connected remote_cpe&#xA; no switchport&#xA; ip address 10.9.1.1 255.255.255.224&#xA; duplex auto&#xA;!&#xA;interface Ethernet0/2&#xA; description connected to LAN_sw&#xA; no switchport&#xA; ip address 10.0.40.2 255.255.255.252&#xA; duplex auto&#xA;!&#xA;router eigrp 100&#xA; network 10.9.1.0 0.0.0.31&#xA; network 192.0.0.0 0.255.255.255&#xA; redistribute connected route-map TAG&#xA;!&#xA;router bgp 600&#xA; bgp router-id 50.50.50.50&#xA; bgp log-neighbor-changes&#xA; neighbor 10.0.40.1 remote-as 500&#xA;!&#xA; address-family ipv4&#xA;  redistribute connected&#xA;  redistribute eigrp 100 route-map EIGRP-TO-BGP&#xA;  neighbor 10.0.40.1 activate&#xA;  exit-address-family&#xA;!&#xA;route-map EIGRP-TO-BGP permit 10&#xA;!&#xA;route-map BGP-TO-EIGRP permit 10&#xA;!&#xA;route-map TAG permit 10&#xA;set tag 200&#xA;!&#xA;REMOTE_LAN_SWITCH#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     1.0.0.0/32 is subnetted, 1 subnets&#xA;B       1.1.1.1 [20/0] via 10.0.40.1, 1d19h&#xA;     2.0.0.0/32 is subnetted, 1 subnets&#xA;B       2.2.2.2 [20/307200] via 10.0.40.1, 1d19h&#xA;     6.0.0.0/32 is subnetted, 1 subnets&#xA;D EX    6.6.6.6 [170/307200] via 10.9.1.11, 1d19h, Ethernet0/0&#xA;     9.0.0.0/32 is subnetted, 1 subnets&#xA;B       9.9.9.9 [20/0] via 10.0.40.1, 1d19h&#xA;     10.0.0.0/8 is variably subnetted, 4 subnets, 3 masks&#xA;C       10.0.40.0/30 is directly connected, Ethernet0/2&#xA;L       10.0.40.2/32 is directly connected, Ethernet0/2&#xA;C       10.9.1.0/27 is directly connected, Ethernet0/0&#xA;L       10.9.1.1/32 is directly connected, Ethernet0/0&#xA;     50.0.0.0/32 is subnetted, 1 subnets&#xA;C       50.50.50.50 is directly connected, Loopback0&#xA;     100.0.0.0/32 is subnetted, 1 subnets&#xA;D EX    100.100.100.100 [170/307200] via 10.9.1.11, 1d19h, Ethernet0/0&#xA;B       192.168.0.0/24 [20/0] via 10.0.40.1, 1d19h&#xA;REMOTE_LAN_SWITCH#show ip eigrp topology&#xA;EIGRP-IPv4 Topology Table for AS(100)/ID(50.50.50.50)&#xA;Codes: P - Passive, A - Active, U - Update, Q - Query, R - Reply,&#xA;       r - reply Status, s - sia Status&#xA;P 10.9.1.0/27, 1 successors, FD is 281600&#xA;        via Connected, Ethernet0/0&#xA;P 50.50.50.50/32, 1 successors, FD is 128256, tag is 200&#xA;        via Rconnected (128256/0)&#xA;P 100.100.100.100/32, 1 successors, FD is 307200, tag is 10&#xA;        via 10.9.1.11 (307200/51200), Ethernet0/0&#xA;P 10.0.40.0/30, 1 successors, FD is 281600, tag is 200&#xA;        via Rconnected (281600/0)&#xA;P 2.2.2.2/32, 0 successors, FD is Inaccessible, tag is 10&#xA;        via 10.9.1.11 (307200/51200), Ethernet0/0&#xA;P 6.6.6.6/32, 1 successors, FD is 307200, tag is 10&#xA;        via 10.9.1.11 (307200/51200), Ethernet0/0&#xA;P 1.1.1.1/32, 0 successors, FD is Inaccessible, tag is 10&#xA;        via 10.9.1.11 (307200/51200), Ethernet0/0&#xA;P 9.9.9.9/32, 0 successors, FD is Inaccessible, tag is 10&#xA;        via 10.9.1.11 (307200/51200), Ethernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;REMOTE_PE:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 5.5.5.5 255.255.255.255&#xA; ip ospf 100 area 0&#xA;!&#xA;interface Ethernet0/1&#xA; description connected to remote_cpe&#xA; ip vrf forwarding JM_CORP&#xA; ip address 100.65.1.1 255.255.255.252&#xA;!&#xA;router ospf 100&#xA; network 5.5.5.5 0.0.0.0 area 0&#xA; network 10.0.0.0 0.255.255.255 area 0&#xA;!&#xA;router bgp 3549&#xA; bgp router-id 5.5.5.5&#xA; bgp log-neighbor-changes&#xA; timers bgp 10 30&#xA; neighbor 4.4.4.4 remote-as 3549&#xA; neighbor 4.4.4.4 update-source Loopback0&#xA;!&#xA; address-family ipv4&#xA;  network 5.5.5.5 mask 255.255.255.255&#xA;  redistribute connected&#xA;  neighbor 4.4.4.4 activate&#xA;  neighbor 4.4.4.4 send-community both&#xA;  neighbor 4.4.4.4 next-hop-self&#xA;  exit-address-family&#xA;!&#xA; address-family vpnv4&#xA;  neighbor 4.4.4.4 activate&#xA;  neighbor 4.4.4.4 send-community both&#xA;  neighbor 4.4.4.4 next-hop-self&#xA;  exit-address-family&#xA;!&#xA; address-family ipv4 vrf JM_CORP&#xA;  redistribute static&#xA;  neighbor 100.65.1.2 remote-as 65000&#xA;  neighbor 100.65.1.2 activate&#xA;  neighbor 100.65.1.2 send-community both&#xA;  neighbor 100.65.1.2 as-override&#xA;  neighbor 100.65.1.2 soft-reconfiguration inbound&#xA;  neighbor 100.65.1.2 route-map BGP_POLICY_IN in&#xA;  exit-address-family&#xA;!&#xA;ip route vrf JM_CORP 100.100.100.100 255.255.255.255 Null0&#xA;!&#xA;route-map BGP_POLICY_IN permit 10&#xA; match community REGIONAL_LP_100&#xA; set local-preference 100&#xA;!&#xA;route-map BGP_POLICY_IN permit 20&#xA; match community REGIONAL_LP_200&#xA; set local-preference 200&#xA;!&#xA;route-map BGP_POLICY_IN permit 30&#xA; match community REGIONAL_LP_300&#xA; set local-preference 300&#xA;!&#xA;route-map BGP_POLICY_IN permit 40&#xA;!&#xA;REMOTE_PE#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     3.0.0.0/32 is subnetted, 1 subnets&#xA;O       3.3.3.3 [110/21] via 10.1.0.4, 1d22h, Ethernet1/1&#xA;     4.0.0.0/32 is subnetted, 1 subnets&#xA;O       4.4.4.4 [110/21] via 10.1.0.4, 1d22h, Ethernet1/1&#xA;     5.0.0.0/32 is subnetted, 1 subnets&#xA;C       5.5.5.5 is directly connected, Loopback0&#xA;     10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks&#xA;O       10.0.0.0/24 [110/20] via 10.1.0.4, 1d22h, Ethernet1/1&#xA;C       10.1.0.0/24 is directly connected, Ethernet1/1&#xA;L       10.1.0.5/32 is directly connected, Ethernet1/1&#xA;O       10.2.0.0/24 [110/20] via 10.1.0.4, 1d22h, Ethernet1/1&#xA;REMOTE_PE#show ip eigrp topology&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;RR:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA; ip address 4.4.4.4 255.255.255.255&#xA;!&#xA;interface Ethernet0/2&#xA; description connected to CORE_P&#xA; ip address 10.2.0.9 255.255.255.0&#xA;!&#xA;router ospf 100&#xA; network 4.4.4.4 0.0.0.0 area 0&#xA; network 10.0.0.0 0.255.255.255 area 0&#xA;!&#xA;router bgp 3549&#xA; bgp router-id 4.4.4.4&#xA; bgp log-neighbor-changes&#xA; neighbor 3.3.3.3 remote-as 3549&#xA; neighbor 3.3.3.3 update-source Loopback0&#xA; neighbor 5.5.5.5 remote-as 3549&#xA; neighbor 5.5.5.5 update-source Loopback0&#xA;!&#xA; address-family ipv4&#xA;  neighbor 3.3.3.3 activate&#xA;  neighbor 3.3.3.3 send-community both&#xA;  neighbor 3.3.3.3 route-reflector-client&#xA;  neighbor 5.5.5.5 activate&#xA;  neighbor 5.5.5.5 send-community both&#xA;  neighbor 5.5.5.5 route-reflector-client&#xA;  exit-address-family&#xA;!&#xA; address-family vpnv4&#xA;  neighbor 3.3.3.3 activate&#xA;  neighbor 3.3.3.3 send-community both&#xA;  neighbor 3.3.3.3 route-reflector-client&#xA;  neighbor 5.5.5.5 activate&#xA;  neighbor 5.5.5.5 send-community both&#xA;  neighbor 5.5.5.5 route-reflector-client&#xA;  exit-address-family&#xA;!&#xA;RR#show ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;       a - application route&#xA;       + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     3.0.0.0/32 is subnetted, 1 subnets&#xA;O       3.3.3.3 [110/21] via 10.2.0.4, 1d22h, Ethernet0/2&#xA;     4.0.0.0/32 is subnetted, 1 subnets&#xA;C       4.4.4.4 is directly connected, Loopback0&#xA;     5.0.0.0/32 is subnetted, 1 subnets&#xA;O       5.5.5.5 [110/21] via 10.2.0.4, 1d22h, Ethernet0/2&#xA;     10.0.0.0/8 is variably subnetted, 4 subnets, 2 masks&#xA;O       10.0.0.0/24 [110/20] via 10.2.0.4, 1d22h, Ethernet0/2&#xA;O       10.1.0.0/24 [110/20] via 10.2.0.4, 1d22h, Ethernet0/2&#xA;C       10.2.0.0/24 is directly connected, Ethernet0/2&#xA;L       10.2.0.9/32 is directly connected, Ethernet0/2&#xA;RR#show ip eigrp topology&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="21461" LastEditorUserId="8499" LastEditDate="2018-12-25T02:37:48.397" LastActivityDate="2018-12-25T02:37:48.397" Title="Cisco Route Tagging Question" Tags="|cisco|routing|router|cisco-ios|packet-tracer|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="35425" PostTypeId="2" ParentId="30015" CreationDate="2016-10-02T12:56:02.680" Score="0" Body="&lt;p&gt;With the ASA5515 you need the SFR module to be on 6.X in order to manage it with ASDM. Currently it shows as being on 5.3 so you'll have to upgrade it to use ASDM for management. Otherwise you need to use FireSIGHT Management Center to manage the SFR module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you are able to manage the SFR you can block those sites by Web Application type (requires CONTROL license which comes with the SFR module) or you can block by URL (requires the URL license).&lt;/p&gt;&#xA;" OwnerUserId="17637" LastActivityDate="2016-10-02T12:56:02.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35427" PostTypeId="2" ParentId="35420" CreationDate="2016-10-02T15:41:31.717" Score="1" Body="&lt;p&gt;Router learn about routes in three ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Directly connected networks&lt;/li&gt;&#xA;&lt;li&gt;Manually configured static routes&lt;/li&gt;&#xA;&lt;li&gt;Dynamically through routing protocols&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A router, receiving a packet on an interface will look at the destination address of the packet (as Ron Trunk pointed out, ports have nothing to do with the routing decisions), and it will look in its routing table to see if it knows how to forward the packet toward its destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router doesn't find any sort of match in its routing table, it will discard the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router finds a match, even if it is only a default route, it will forward the packet out the new interface toward its destination. The interface towards the packet destination can be connected to another router, and the new router will repeat what the first router did. This router lookup and forward goes on until the packet gets to the network where the destination host is.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-02T15:41:31.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35430" PostTypeId="2" ParentId="11098" CreationDate="2016-10-02T19:36:06.357" Score="0" Body="&lt;p&gt;Nodes reachable via a &lt;a href=&quot;https://www.iana.org/numbers&quot; rel=&quot;nofollow noreferrer&quot;&gt;global IP address&lt;/a&gt; are on the Internet.&lt;/p&gt;&#xA;&lt;p&gt;Internet Protocol (IP) is short for the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;DoD Standard Internet Protocol&lt;/a&gt;, RFC 791.  The IANA assigns global IP addresses.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Note: being on the Web and being on the Internet are two different concepts.&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-10-02T19:43:11.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35431" PostTypeId="1" CreationDate="2016-10-02T19:49:34.273" Score="2" ViewCount="4932" Body="&lt;p&gt;How can I have a single /24 private IP address space that spans two locations across a VPN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;aka VPLS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a /24: 192.168.100.0/24 that has workstations and servers on it. Servers are .5 through .30, workstations are .50-.254.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Currently, all this is at a single physical location. &lt;/li&gt;&#xA;&lt;li&gt;The servers are all VMWare instances on a single VMWare host. &lt;/li&gt;&#xA;&lt;li&gt;We currently use Sonicwall NSA 3600 and similar models&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We need to move the servers to a data center (to reclaim the office space, etc), and, for a number of reasons, need to keep the networking as is. (There is extensive configuration at app server and client level giving specific rights to specific IP address, blocking access by IP, and putting different types of users in different IP address blocks.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I have done VPN configs in the past, we always had a different subnet at each location. This would break many layers of app setup, so we are looking to avoid it. We need the same subnet (192.168.100.0/24) to span two locations, and for the servers to see the clients properly (e.g. the client IP is represented to the server as it is now, when everything is in one physical location).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have heard that MPLS and/or L2 servers from a telco may be able to solve for this, but I do not know exactly how. We would prefer to implement this in our own networking gear (to give us flexibility RE location, e.g. not to be completely dependant on telco), but need to understand the options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note:&#xA;- We understand that L2 bridging is not ideal from some perspectives&#xA;- It is, however, the right thing for this application&#xA;- We know about using NAT to route a &quot;local&quot; address across to another subnet. No need to explain that. This thread is &quot;how to span a /24 subnet across two location&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a) Can this be done at all?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b) We know that telco has services like this. We want to know: Can we do it in our own gear? (We currently use the Sonicwall NSA 3600, but will migrate off if we need to. What do we need to have, spec wise, in gear to do that?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c) Suggested &quot;closest options&quot; to this? (e.g. if our dream of VPLS in our own gear is not possible, is there another option between that and telco VPLS that solves in this way?)&lt;/p&gt;&#xA;" OwnerUserId="21883" LastEditorUserId="21883" LastEditDate="2016-10-02T20:39:44.557" LastActivityDate="2016-10-04T05:06:01.597" Title="VPN Networking: How to span a /24 subnet across two locations?" Tags="|vpn|mpls|l2vpn|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35432" PostTypeId="2" ParentId="35431" CreationDate="2016-10-02T20:36:17.703" Score="0" Body="&lt;p&gt;Of course it's possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Openvpn in bridge mode with Linux boxes as the terminations is one soloution. There are probabll more enterprisy ones too.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-10-02T20:36:17.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35433" PostTypeId="2" ParentId="35431" CreationDate="2016-10-02T20:36:56.307" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;a) Can this be done at all?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it can.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;b) Can we do it in our own gear? (We currently use the Sonicwall NSA&#xA;  3600, but will migrate off if we need to. What do we need to have,&#xA;  spec wise, in gear to do that?)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, you can do this with your firewalls; they support layer-2 tunneling.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;c) Suggested &quot;closest options&quot; to this?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what you mean by this question. You can do what you want with your existing equipment, and there are many other options to do this, but product or resource recommendations are explicitly off-topic here.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Of note is that you want flexibility, but you have painted yourselves into a corner by specifically using IP addresses, removing all your flexibility. Your applications should be using domain names rather than specific server IP addresses. If you correct that problem, you will regain your flexibility. This is the point in time which you should bite the bullet and fix things to the way they should be.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-02T20:53:49.563" LastActivityDate="2016-10-02T20:53:49.563" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35435" PostTypeId="2" ParentId="35400" CreationDate="2016-10-02T23:03:09.207" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;i`m trying to connect multiple subnets to one web server but these subnets should not be able to connect to each other.i cant make any changes on these subnets. I just have a lan cable from each subnet and my server. tnx&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The obvious solution to this would be a multihomed server. The server has a NIC on each subnet and responds to requests from all of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However your clarifications in comments show that this solution won't work in your specific case. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;actually its not a server. its a stand alone dvr.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ok. So presumablly it only has one network port and can only have one IP address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So we will need some sort of box to go between the dvr and the networks. This answer explores the possibility of using a linux box for that role. In general linux boxes are often an economical solution for complex network tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's fairly easy to put a substantial number of NICs in a linux box. For example the ASUS P9D-M micro ATX motherboard has two onboard Intel NICs and four expansion slots suitable for quad NICs giving a total of up to 18 ports. If you need more than that then I would suggest using a managed switch as a port multiplier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the subnets are non-overlapping then it's easy enough. The linux box gets a network port for each network and one for the DVR. DNAT is used to forward connections to the DVR. Firewall rules would be set up to allow all of the networks to communicate with the DVR but not with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since iptables NAT is connection based it can happily handle translating multiple original destinations to the same translated destination.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;some subnets have same ip range&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This makes life trickier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a multihomed linux box provided the linux box has a different IP on each interface you can use policy routing based on the source IP to deal with multiple interfaces in overlapping subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately in my testing (on linux 3.14) it appears that policy routing selects which routing table to use before the NAT machinery performs it's reverse translation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To workaround this we need to pass the traffic through the network stack twice. The first time through the NAT machinery will do it's thing. The second time through policy routing will do it's thing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the second time through the stack we need to stop the traffic hitting the NAT machinary again and confusing it. We can achieve this through the NOTRACK target in the PREROUTING chain of the raw table&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;What follows is a worked example demonstrating the concepts described in the post above. It is a cleaned up version of some tests I did to prove that the concepts actually worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example all the network roles are played by network namespaces. Obviously in a real scenario most of those would be physical boxes (&quot;bounce&quot; would still likely be a network namespace). The roles of the network namespaces are.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;client1&quot; and &quot;client2&quot;, two clients on different networks but with the same IP address.&lt;/li&gt;&#xA;&lt;li&gt;&quot;server&quot; the box that performs DNAT and policy routing&lt;/li&gt;&#xA;&lt;li&gt;&quot;natted&quot; the box with a single interface and IP address behind the DNAT (i.e. your DVR)&lt;/li&gt;&#xA;&lt;li&gt;&quot;bounce&quot;, the &quot;bounce box&quot; to work arround the issue with policy routing and DNAT.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that this example has no firewalling, in a practical implementation you would want to add that.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip netns add server&#xA;ip netns add client1&#xA;ip netns add client2&#xA;ip netns exec&#xA;ip netns exec server ip addr list&#xA;ip link add veth1client type veth peer name veth1server &#xA;ip link set veth1client netns client1&#xA;ip link set veth1server netns server&#xA;ip netns exec server ip addr add 10.0.0.1/24 dev veth1server&#xA;ip netns exec server ip link set veth1server up&#xA;ip netns exec client1 ip addr add 10.0.0.2/24 dev veth1client&#xA;ip link add veth2client type veth peer name veth2server &#xA;ip link set veth2client netns client2&#xA;ip link set veth2server netns server&#xA;ip netns exec server ip addr add 10.0.0.3/24 dev veth2server&#xA;ip netns exec client2 ip addr add 10.0.0.2/24 dev veth2client&#xA;ip netns exec client2 ip link set veth2client up&#xA;ip netns exec server ip link set veth2server up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This first block of commands sets up the client and server network namespaces and establishes links between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At this point client1 can ping the server (on 10.0.0.1) but client2 fails to ping the server (on 10.0.0.3), we have a routing conflict and it seems that client1's route wins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To fix this lets add some policy routing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cp /etc/iproute2/rt_tables /etc/netns/server/iproute2/rt_tables&#xA;echo $'1\tclient1' &amp;gt;&amp;gt;  /etc/netns/server/iproute2/rt_tables&#xA;echo $'2\tclient2' &amp;gt;&amp;gt;  /etc/netns/server/iproute2/rt_tables&#xA;ip netns exec server ip rule add from 10.0.0.1 lookup client1&#xA;ip netns exec server ip rule add from 10.0.0.3 lookup client2&#xA;ip netns exec server ip route add 10.0.0.0/24 dev veth1server table client1&#xA;ip netns exec server ip route add 10.0.0.0/24 dev veth2server table client2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now client1 can ping the server on 10.0.0.1 and client2 can ping the server on 10.0.0.3 despite the fact that the two clients share the same IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's cool and all but our aim was to get the clients to talk to a single-homed box behind our multi-homed server. Lets add the single homed box, enable IP forwarding and set up NAT.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip netns add natted&#xA;ip link add vethnserver type veth peer name vethnnatted&#xA;ip link set vethnserver netns server&#xA;ip link set vethnnatted netns natted&#xA;ip netns exec server ip link set vethnserver up&#xA;ip netns exec server ip addr add 10.0.1.2/24 dev vethnserver&#xA;ip netns exec natted ip link set vethnnatted up&#xA;ip netns exec natted ip addr add 10.0.1.1/24 dev vethnnatted&#xA;ip netns exec server iptables -A PREROUTING -t nat -d 10.0.0.1 -j DNAT --to-destination 10.0.1.1&#xA;ip netns exec server iptables -A PREROUTING -t nat -d 10.0.0.3 -j DNAT --to-destination 10.0.1.1&#xA;ip netns exec server sh -c 'echo 1 &amp;gt; /proc/sys/net/ipv4/ip_forward'&#xA;ip netns exec natted ip route add default via 10.0.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately due to the policy routing/DNAT issue described above only one of the clients works. To workaround this we add the &quot;bounce box&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip netns add bounce&#xA;ip link add vethbserver type veth peer name vethbbounce&#xA;ip link set vethbserver netns server&#xA;ip link set vethbbounce netns bounce&#xA;ip netns exec bounce sh -c 'echo 1 &amp;gt; /proc/sys/net/ipv4/ip_forward'&#xA;ip netns exec server ip link set vethbserver up&#xA;ip netns exec server ip addr add 10.0.2.1/24 dev vethbserver &#xA;ip netns exec bounce ip link set vethbbounce up&#xA;ip netns exec bounce ip addr add 10.0.2.2/24 dev vethbbounce&#xA;ip netns exec bounce ip route add default via 10.0.2.1&#xA;echo $'250\tbounce' &amp;gt;&amp;gt;  /etc/netns/server/iproute2/rt_tables&#xA;ip netns exec server ip rule add from 10.0.1.1 lookup bounce&#xA;ip netns exec server ip route add 10.0.0.0/24 via 10.0.2.2 table bounce&#xA;ip netns exec iptables -t raw -I PREROUTING -i vethbserver -j NOTRACK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and finally lets check it actually works, not just for pings but for http.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip netns exec natted python -m SimpleHTTPServer &amp;amp;&#xA;sleep 1&#xA;ip netns exec client1 wget 10.0.0.1:8000&#xA;ip netns exec client2 wget 10.0.0.3:8000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-01-16T17:19:46.813" LastActivityDate="2017-01-16T17:19:46.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35436" PostTypeId="1" AcceptedAnswerId="35438" CreationDate="2016-10-02T23:28:05.943" Score="1" ViewCount="5542" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/T7BLr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/T7BLr.jpg&quot; alt=&quot;diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a simplified version of my network diagram. How do I make both network speak to each other? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm confused because earlier I used routers and switches, and I connected them using OSPF or EIGRP. Now, I've tried to set up EIGRP on the layer 3 switch and then on the router but I still can't ping from one network to another. I just can't understand the concept of layer 3 switches in conjunction with vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are my switches' configurations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fa0/1&#xA; switchport access vlan 35&#xA;!&#xA;int fa0/2&#xA; switchport access vlan 40&#xA;!&#xA;int fa0/3&#xA; switchport access vlan 45&#xA;!&#xA;int fa0/4&#xA; switchport access vlan 50&#xA;!&#xA;int gig0/1&#xA; switchport trunk encapsulation dot1q &#xA; switchport mode trunk&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fa0/1&#xA; switchport access vlan 45&#xA;!&#xA;int fa0/2&#xA; switchport access vlan 55&#xA;!&#xA;int fa0/3&#xA; switchport access vlan 40&#xA;!&#xA;int fa0/4&#xA; switchport access vlan 60&#xA;!&#xA;int gig0/1&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;int vlan 35&#xA; ip address 10.100.50.17 255.255.255.240&#xA;!&#xA;int vlan 40&#xA; ip address 10.100.50.33 255.255.255.240&#xA;!&#xA;int vlan 45&#xA; ip address 10.100.50.49 255.255.255.240&#xA;!&#xA;int vlan 50&#xA; ip address 10.100.50.65 255.255.255.240&#xA;!&#xA;int vlan 55&#xA; ip address 10.100.50.81 255.255.255.240&#xA;!&#xA;int vlan 60&#xA; ip address 10.100.50.97 255.255.255.240&#xA;!&#xA;exit&#xA;!&#xA;ip dhcp pool vlan35&#xA;network 10.100.50.16 255.255.255.240&#xA;default-router 10.100.50.17&#xA;!&#xA;ip dhcp pool vlan40&#xA;network 10.100.50.32 255.255.255.240&#xA;default-router 10.100.50.33&#xA;!&#xA;ip dhcp pool vlan45&#xA;network 10.100.50.48 255.255.255.240&#xA;default-router 10.100.50.49&#xA;!&#xA;ip dhcp pool vlan50&#xA;network 10.100.50.64 255.255.255.240&#xA;default-router 10.100.50.65&#xA;!&#xA;ip dhcp pool vlan55&#xA;network 10.100.50.80 255.255.255.240&#xA;default-router 10.100.50.81&#xA;!&#xA;ip dhcp pool vlan60&#xA;network 10.100.50.96 255.255.255.240&#xA;default-router 10.100.50.97&#xA;!&#xA;exit&#xA;!&#xA;end&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The same thing is configured on another network which has 192.168.85.xx network address. I can ping from one VLAN to another inside one network but I can't do it between two networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also wonder if I have to write the ip routing command  on interface of the switch which is directly connected with the router.&lt;/p&gt;&#xA;" OwnerUserId="30597" LastEditorUserId="8499" LastEditDate="2018-03-21T00:48:49.030" LastActivityDate="2018-03-21T00:48:49.030" Title="How to connect different networks based on vlans using layer 3 switches and router?" Tags="|cisco|routing|layer3|packet-tracer|eigrp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35437" PostTypeId="2" ParentId="35424" CreationDate="2016-10-02T23:40:31.593" Score="1" Body="&lt;p&gt;You have some problems:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You are tagging &lt;code&gt;10.0.40.0/30&lt;/code&gt; with &lt;code&gt;100&lt;/code&gt; on LAN_SW, but there is no&#xA;&lt;code&gt;7.7.7.7/32&lt;/code&gt; anywhere, so you will never tag that route&lt;/li&gt;&#xA;&lt;li&gt;You are rewriting the tag for &lt;code&gt;10.0.40.0/30&lt;/code&gt; with &lt;code&gt;200&lt;/code&gt; on&#xA;REMOTE_LAN_SWITCH&lt;/li&gt;&#xA;&lt;li&gt;The tag &lt;code&gt;100&lt;/code&gt; on &lt;code&gt;10.0.40.0/30&lt;/code&gt; goes from LAN_SW to CPE, but you do not run EIGRP between CPE and PE, so &lt;code&gt;10.0.40.0/30&lt;/code&gt; with the tag &lt;code&gt;100&lt;/code&gt; gets dropped between those routers, and you seem to want to redistribute from EIGRP to BGP on CPE, but you have BGP problems between CPE and PE, putting the routes from CPE into a VRF that goes nowhere, so &lt;code&gt;10.0.40.0/30&lt;/code&gt; never goes to PE&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You need to take it one router at a time, and make sure that you are advertising the routes you think you should between the two routers on a link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-02T23:40:31.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35438" PostTypeId="2" ParentId="35436" CreationDate="2016-10-02T23:53:52.400" Score="0" Body="&lt;p&gt;Unless you enable routing on a layer-3 switch, it is only doing layer-2 switching, not anything with layer-3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do you suppose that the networks on one side know where to send traffic destined for the networks on the other side? Routers, including layer-3 switches, need to know where to send traffic, otherwise the traffic gets dropped. Routers get routers three ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Directly connected networks&lt;/li&gt;&#xA;&lt;li&gt;Statically configured routes&lt;/li&gt;&#xA;&lt;li&gt;Dynamically learned routes from routing protocols&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You either need to manually configure routes, or you need to run a routing protocols between the layer-3 devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real way to do it is to configure IP routing on all the layer-3 switches, and configure the links between the layer-3 switches and the router to be routed links, not trunks. Then you run a common routing protocol on all the layer-3 devices.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-02T23:53:52.400" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35440" PostTypeId="1" AcceptedAnswerId="35508" CreationDate="2016-10-03T04:42:24.400" Score="4" ViewCount="952" Body="&lt;p&gt;The requirements are&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Hundreds of sites.&lt;/li&gt;&#xA;&lt;li&gt;Each has a router and firewall and a switch stack.&lt;/li&gt;&#xA;&lt;li&gt;Layer 3 MPLS WAN with BGP to provider VRF.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;BGP as an IGP?&lt;/h2&gt;&#xA;&lt;h3&gt;iBGP&lt;/h3&gt;&#xA;&lt;p&gt;Would you distribute a public ASN across all branch sites and use iBGP to route inter-branch packets?  Route reflector(s); MED based routing?&lt;/p&gt;&#xA;&lt;h3&gt;eBGP&lt;/h3&gt;&#xA;&lt;p&gt;Would you assign a private ASN per branch?&lt;/p&gt;&#xA;&lt;h2&gt;... or Don't Use BGP?&lt;/h2&gt;&#xA;&lt;h3&gt;DMVPN&lt;/h3&gt;&#xA;&lt;p&gt;DMVPN (minus encryption?) to hide/abstract away the BGP, allowing use of IGP for all inter-site routing?&lt;/p&gt;&#xA;&lt;h3&gt;Best Design?&lt;/h3&gt;&#xA;&lt;p&gt;Anyone think eBGP or iBGP is preferable?  I find DMVPN attractive because&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;My routing is separated from their routing.&lt;/li&gt;&#xA;&lt;li&gt;We're able to use a faster converging Interior Gateway Protocol.&lt;/li&gt;&#xA;&lt;li&gt;We're not using Border Gateway Protocol as an IGP.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;however lean towards iBGP because it fits the use case and adds no GRE overhead.  What is the best way to route traffic given this topology?&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2019-01-04T23:18:49.860" Title="Can I Use BGP as an IGP - Multisite w Redundant Layer 3 MPLS WANs" Tags="|routing|bgp|layer3|mpls|mpls-vpn|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35441" PostTypeId="1" AcceptedAnswerId="35443" CreationDate="2016-10-03T07:16:22.767" Score="0" ViewCount="1009" Body="&lt;p&gt;I have very specific problem, one of our company website is not opening on any browser, but I am able to open that in other computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What exactly the issue is, I am using following IP Address&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.100.88&#xA;255.255.255.0&#xA;192.168.100.1&#xA;&#xA;DNS 8.8.8.8&#xA;Pref DNS is blank&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I use this IP, the specific website is not opening, but when I go to the LAN setting and make the IP settings automatic, then the website is opening perfectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anybody please suggest whats the issue with using the IP address above?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought there is a conflict with other computers so I changing multiple IPs but no luck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="30967" LastEditorUserId="30967" LastEditDate="2016-10-03T07:24:50.587" LastActivityDate="2016-10-03T07:53:28.797" Title="Specific website is not opening on LAN" Tags="|ethernet|internet|" AnswerCount="1" CommentCount="0" ClosedDate="2016-10-03T14:04:39.503" ContentLicense="CC BY-SA 3.0" />
  <row Id="35443" PostTypeId="2" ParentId="35441" CreationDate="2016-10-03T07:53:28.797" Score="1" Body="&lt;p&gt;To answer the question precisely we would need to know the web site address and the result of DNS resolution test toward this name (using nslookup on Windows or dig on Linux / Mac OS)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This may due to a split DNS scheme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This scenario could explain your issue:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Let's say the web site is &lt;code&gt;www.mycompany.com&lt;/code&gt; and the public IP address of this website is &lt;code&gt;198.51.100.17&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the internal network the IP address of the server is a private one, for example &lt;code&gt;172.16.0.8&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There's a NAT rule that will translate traffic destined to &lt;code&gt;198.51.100.17&lt;/code&gt; port 80 (HTTP) or 443 (HTTPS) to &lt;code&gt;172.16.0.8&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This is the setup, now what's happening?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When inside the network you will use your internal DNS resolver, and when resolving &lt;code&gt;www.mycompany.com&lt;/code&gt; the DNS server will respond &lt;code&gt;172.16.0.8&lt;/code&gt;. This address is of reachable and everything is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when you manually set your DNS server to google one, &lt;code&gt;8.8.8.8&lt;/code&gt;, and you ask for &lt;code&gt;www.mycompany.com&lt;/code&gt;, you will get &lt;code&gt;198.51.100.17&lt;/code&gt; and not &lt;code&gt;172.16.0.8&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So your browser will try to reach the &lt;strong&gt;external&lt;/strong&gt; IP address of your company router from the &lt;strong&gt;internal&lt;/strong&gt; interface. Since the NAT rule apply only to traffic coming on the external interface, this fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you set your computer to DHCP (I suppose this is what you mean by &quot;make the IP settings automatic&quot;), then you receive the correct, I.E. internal, DNS server address and it works as intended.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-10-03T07:53:28.797" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35444" PostTypeId="1" CreationDate="2016-10-03T08:05:23.220" Score="1" ViewCount="31" Body="&lt;p&gt;here we are have 2 UCS server B series, with 7 hosts distributed as 5 hosts on the first UCS and 2 hosts on the other UCS. 1 year ago we move our exchange servers to be hosted on one host of the 7. our exchange solution is consisted of two CAS servers which visualized by one IP address and one MAC address . recently this virtual IP is not pingable and this problem binding till we move the exchange servers from host to other. any advice could help &lt;/p&gt;&#xA;&#xA;&lt;p&gt;also i not that when i move the CASs from host to other and Virual Ip start respond it give the next result from the FIs itself&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;64 bytes from 10.3.252.185: icmp_seq=1 ttl=127 time=0.313 ms&#xA;64 bytes from 10.3.252.185: icmp_seq=1 ttl=127 time=0.511 ms (DUP!)&#xA;64 bytes from 10.3.252.185: icmp_seq=2 ttl=127 time=0.263 ms&#xA;64 bytes from 10.3.252.185: icmp_seq=2 ttl=127 time=0.369 ms (DUP!)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30876" LastEditorUserId="30876" LastEditDate="2016-10-03T09:40:10.213" LastActivityDate="2016-10-03T09:40:10.213" Title="problem with exchange server hosted on UCS server" Tags="|cisco|" AnswerCount="0" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="35445" PostTypeId="1" AcceptedAnswerId="35562" CreationDate="2016-10-03T08:41:26.400" Score="1" ViewCount="166" Body="&lt;p&gt;I was trying to understand one the research paper form IEEE, on Bidirectional Visible Light Communication, but I am unable to understand one of its Block diagram. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sharing his block diagram, please some one help me to understand it . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LASde.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LASde.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30973" LastActivityDate="2016-10-08T03:33:37.617" Title="Bi Directional Visible Light Communication" Tags="|passive-optical-network|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35446" PostTypeId="1" CreationDate="2016-10-03T10:02:54.290" Score="2" ViewCount="2839" Body="&lt;p&gt;My question is, in which cases is the Fast Recovery activarted ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like we have done a Fast Retransmit does it mean that Fast Recovery must be used as well ? For example, we lose a segment and send it by fast retransmit... is it necessary to do fast recovery ?&lt;/p&gt;&#xA;" OwnerUserId="30468" LastActivityDate="2016-11-02T15:17:17.460" Title="If we have Fast Retransmit does it mean we have Fast Recovery?" Tags="|tcp|congestion|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35448" PostTypeId="2" ParentId="35446" CreationDate="2016-10-03T14:34:56.697" Score="2" Body="&lt;p&gt;You should understand that there are a variety of TCP congestion control schemes, and &amp;quot;Reno&amp;quot; and &amp;quot;NewReno&amp;quot; are the ones which implement fast retransmit, but others do not because it is not a requirement to use a particular congestion control scheme. Notice the use of the word, &amp;quot;SHOULD,&amp;quot; in the RFC, which means that this is not a requirement.&lt;/p&gt;&#xA;&lt;p&gt;Fast recovery is used with with fast retransmit. &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2581&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2581, TCP Congestion Control&lt;/a&gt; explains this in the third paragraph of Section 3.2:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;3.2 Fast Retransmit/Fast Recovery&lt;/p&gt;&#xA;&lt;p&gt;A TCP receiver SHOULD send an immediate duplicate ACK when an&#xA;out-of-order segment arrives.  The purpose of this ACK is to inform&#xA;the sender that a segment was received out-of-order and which sequence&#xA;number is expected.  From the sender's perspective, duplicate ACKs can&#xA;be caused by a number of network problems.  First, they can be caused&#xA;by dropped segments.  In this case, all segments after the dropped&#xA;segment will trigger duplicate ACKs.  Second, duplicate ACKs can be&#xA;caused by the re-ordering of data segments by the network (not a rare&#xA;event along some network paths [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2581#ref-Pax97&quot; rel=&quot;nofollow noreferrer&quot;&gt;Pax97&lt;/a&gt;]).  Finally, duplicate ACKs&#xA;can be caused by replication of ACK or data segments by the network.&#xA;In addition, a TCP receiver SHOULD send an immediate ACK when the&#xA;incoming segment fills in all or part of a gap in the sequence space.&#xA;This will generate more timely information for a sender recovering&#xA;from a loss through a retransmission timeout, a fast retransmit, or an&#xA;experimental loss recovery algorithm, such as NewReno [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2581#ref-FH98&quot; rel=&quot;nofollow noreferrer&quot;&gt;FH98&lt;/a&gt;].&lt;/p&gt;&#xA;&lt;p&gt;The TCP sender SHOULD use the &amp;quot;fast retransmit&amp;quot; algorithm to detect&#xA;and repair loss, based on incoming duplicate ACKs.  The fast&#xA;retransmit algorithm uses the arrival of 3 duplicate ACKs (4 identical&#xA;ACKs without the arrival of any other intervening packets) as an&#xA;indication that a segment has been lost.  After receiving 3 duplicate&#xA;ACKs, TCP performs a retransmission of what appears to be the missing&#xA;segment, without waiting for the retransmission timer to expire.&lt;/p&gt;&#xA;&lt;p&gt;After the fast retransmit algorithm sends what appears to be the&#xA;missing segment, the &amp;quot;fast recovery&amp;quot; algorithm governs the&#xA;transmission of new data until a non-duplicate ACK arrives.  The&#xA;reason for not performing slow start is that the receipt of the&#xA;duplicate ACKs not only indicates that a segment has been lost, but&#xA;also that segments are most likely leaving the network (although a&#xA;massive segment duplication by the network can invalidate this&#xA;conclusion).  In other words, since the receiver can only generate a&#xA;duplicate ACK when a segment has arrived, that segment has left the&#xA;network and is in the receiver's buffer, so we know it is no longer&#xA;consuming network resources.  Furthermore, since the ACK &amp;quot;clock&amp;quot;&#xA;[&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2581#ref-Jac88&quot; rel=&quot;nofollow noreferrer&quot;&gt;Jac88&lt;/a&gt;] is preserved, the TCP sender can continue to transmit new&#xA;segments (although transmission must continue using a reduced cwnd).&lt;/p&gt;&#xA;&lt;p&gt;The fast retransmit and fast recovery algorithms are usually&#xA;implemented together as follows.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When the third duplicate ACK is received, set ssthresh to no more&#xA;than the value given in equation 3.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Retransmit the lost segment and set cwnd to ssthresh plus 3*SMSS.&#xA;This artificially &amp;quot;inflates&amp;quot; the congestion window by the number&#xA;of segments (three) that have left the network and which the&#xA;receiver has buffered.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For each additional duplicate ACK received, increment cwnd by&#xA;SMSS.  This artificially inflates the congestion window in order&#xA;to reflect the additional segment that has left the network.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Transmit a segment, if allowed by the new value of cwnd and the&#xA;receiver's advertised window.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When the next ACK arrives that acknowledges new data, set cwnd to&#xA;ssthresh (the value set in step 1).  This is termed &amp;quot;deflating&amp;quot;&#xA;the window.&lt;/p&gt;&#xA;&lt;p&gt;This ACK should be the acknowledgment elicited by the&#xA;retransmission from step 1, one RTT after the retransmission&#xA;(though it may arrive sooner in the presence of significant out-&#xA;of-order delivery of data segments at the receiver).&#xA;Additionally, this ACK should acknowledge all the intermediate&#xA;segments sent between the lost segment and the receipt of the&#xA;third duplicate ACK, if none of these were lost.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Note: This algorithm is known to generally not recover very&#xA;efficiently from multiple losses in a single flight of packets&#xA;[&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2581#ref-FF96&quot; rel=&quot;nofollow noreferrer&quot;&gt;FF96&lt;/a&gt;].  One proposed set of modifications to address this&#xA;problem can be found in [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2581#ref-FH98&quot; rel=&quot;nofollow noreferrer&quot;&gt;FH98&lt;/a&gt;].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-10-03T14:34:56.697" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35451" PostTypeId="1" AcceptedAnswerId="35452" CreationDate="2016-10-03T17:48:09.220" Score="5" ViewCount="3066" Body="&lt;p&gt;LAN border routers often use PPPoE protocol to communicate with ISPs and to access the Internet through ADSL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/ir910/software/release/1_0/configuration/guide/ir910scg/swpppoe.pdf&quot; rel=&quot;noreferrer&quot;&gt;This link&lt;/a&gt; provides an example of output of &lt;code&gt;ifconfig&lt;/code&gt; about an interface using PPPoE (page 3):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Link encap:Point-to-Point Protocol&#xA;inet addr:10.100.11.16 P-t-P:10.100.11.10 Mask:255.255.255.255&#xA;UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1&#xA;RX packets:10 errors:0 dropped:0 overruns:0 frame:0&#xA;TX packets:10 errors:0 dropped:0 overruns:0 carrier:0&#xA;collisions:0 txqueuelen:3&#xA;RX bytes:125 (125.0 B) TX bytes:113 (113.0 B)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If PPPoE is used to transmit PPP frames inside Ethernet frames, ARP should be allowed like in a normal Ethernet connection. Am I wrong? Looking at the flags, why is ARP here explicitly not used? &lt;/p&gt;&#xA;" OwnerUserId="4528" LastActivityDate="2016-10-03T20:15:48.637" Title="PPPoE interface doesn't use ARP" Tags="|router|ethernet|internet|pppoe|adsl|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35452" PostTypeId="2" ParentId="35451" CreationDate="2016-10-03T18:04:37.313" Score="7" Body="&lt;p&gt;PPP doesn't use MAC addresses or ARP the way ethernet does, so no, there will not be ARP in PPP, but there may be ARP in the ethernet which carries the PPP frames. You will not see anything ethernet-related in the PPP. What you are looking at is the PPP, not the ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP (Address &lt;em&gt;Resolution&lt;/em&gt; Protocol) is used by some layer-2 protocols, e.g. ethernet, to &lt;em&gt;resolve&lt;/em&gt; a layer-3 address to a layer-2 address. Your layer-3 address is on the PPP, which doesn't use MAC addresses (not all layer-2 protocols do). Since PPP doesn't have layer-2 addresses the way you are thinking, it doesn't use ARP. PPP is Point-to-Point Protocol. There are only two possible hosts on the link, so it has no need of things like MAC addresses, and it doesn't need to resolve a layer-3 address into a layer-2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the ethernet carrying PPP has no layer-3 address, then there is nothing to resolve, so there will be no ARP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-03T20:15:48.637" LastActivityDate="2016-10-03T20:15:48.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35453" PostTypeId="2" ParentId="32806" CreationDate="2016-10-03T18:29:41.953" Score="0" Body="&lt;p&gt;Ideally, only have one IP subnet per VLAN.  So, undo the overlapping VLANs or re-IP address the overlapping subnets.  Either way would work.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-03T18:29:41.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35454" PostTypeId="1" CreationDate="2016-10-03T19:58:36.273" Score="1" ViewCount="99" Body="&lt;p&gt;Problem: any sleeping computer on a gigabit network causes all multicast traffic to drop to 10Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solution: provide customers with &lt;em&gt;managed&lt;/em&gt; gigabit switches and train them to configure the switches manually. Not an ideal solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I discovered today another workaround… the cause is 802.3x flow-control. Disabling flow-control fixes the problem: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo ifconfig en0 -mediaopt flow-control&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However this means that every device on every customers network would need to turn off auto negotiation, then manually turn flow-control off.  Turning off auto-negotiation is a very bad idea.  Not a workable solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One example: I notice that on my dumb, old gigabit switch, &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;sleeping machine has flow control ON , link light ON, 1000Mbps light is off&lt;/li&gt;&#xA;&lt;li&gt;sleeping machine has flow control OFF, link light ON, 1000Mbps light is lit.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My question is: Is there any RFC/protocol which would allow traffic to ignore flow-control. (Probably not)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any RFC/protocol/hack to discover whether a sleeping device on a network uses flow-control… (Maybe?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any RFC/protocol/hack to discover what is the auto-negotiated speed of each device on its immediate switch (albeit dumb switch)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would at least allow my software to warn a user &lt;em&gt;why&lt;/em&gt; their multicast performance is 10Mbps.&lt;/p&gt;&#xA;" OwnerUserId="30984" LastEditorUserId="8499" LastEditDate="2018-12-26T05:03:04.000" LastActivityDate="2018-12-26T05:03:04.000" Title="sleeping computer on gigabit ethernet kills multicast performance" Tags="|ethernet|rfc|standardisation|autonegotiation|ieee-802.3x|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35455" PostTypeId="2" ParentId="35454" CreationDate="2016-10-03T20:08:13.967" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is: Is there any RFC/protocol which would allow traffic to&#xA;  ignore flow-control. (Probably not)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ethernet is not controlled by the IETF RFCs, it is from the IEEE 802.3 committee. Many devices do ignore ethernet flow control; it is poorly supported, and it is not required. Even among network devices which do support it, you must often enable it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any RFC/protocol/hack to discover whether a sleeping device&#xA;  on a network uses flow-control… (Maybe?)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Sleeping devices don't tell you anything; you must first wake them. Hosts are off-topic here. There will be no RFC because the IETF doesn't deal with ethernet standards, and I know of no such protocol from the IEEE.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any RFC/protocol/hack to discover what is the auto-negotiated&#xA;  speed of each device on its immediate switch (albeit dumb switch)?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If a switch or the host supports SNMP, then you could use SNMP to discover such things, but that is unlikely for a dumb switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-03T20:08:13.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35457" PostTypeId="1" AcceptedAnswerId="35458" CreationDate="2016-10-03T21:23:11.050" Score="1" ViewCount="641" Body="&lt;p&gt;I have three service group, &lt;code&gt;WWW, SMTP and FTP&lt;/code&gt;. I wanted to isolate using &lt;code&gt;wildcard&lt;/code&gt; mask and divide them in logical subnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: We have 192.168.100.0/24 subnet, In short i want to give 50% IPs to WWW and 25% - SMTP and rest 25% FTP &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;www - 128 host&#xA;smtp - 64 host&#xA;ftp - 64 host &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;UPDATE&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;My ACL will be like this. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit tcp any 192.168.100.0 0.0.0.127 eq www&#xA;access-list 101 permit tcp any 192.168.100.128 0.0.0.63 eq smtp&#xA;access-list 101 permit tcp any 192.168.100.192 0.0.0.63 eq ftp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But i want to use &lt;code&gt;object-group&lt;/code&gt; and there you can't use wildcard so how do i adjust above mask in object-group with subnetmask?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is following is correct in respect of &lt;code&gt;wildcard&lt;/code&gt; masking?`&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network WWW-ACL&#xA;   192.168.100.0 255.255.255.128&#xA;object-group network SMTP-ACL&#xA;   192.168.100.128 255.255.255.192&#xA;object-group network FTP-ACL&#xA;   192.168.100.191 255.255.255.192 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Define them in ACL&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit tcp any object-group WWW-ACL eq www&#xA;access-list 101 permit tcp any object-group SMTP-ACL eq www&#xA;access-list 101 permit tcp any object-group FTP-ACL eq www&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2016-10-03T22:17:51.683" LastActivityDate="2016-10-03T22:20:47.763" Title="Cisco ACL reverse wildcard vs object-group" Tags="|cisco|firewall|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35458" PostTypeId="2" ParentId="35457" CreationDate="2016-10-03T21:33:20.050" Score="1" Body="&lt;p&gt;A wildcard mask is just the inverse (change the &lt;code&gt;0&lt;/code&gt; bits to &lt;code&gt;1&lt;/code&gt;, and vice versa) of a regular mask:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Wildcard mask &lt;code&gt;0.0.0.127&lt;/code&gt; is regular mask &lt;code&gt;255.255.255.128&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Wildcard mask &lt;code&gt;0.0.0.63&lt;/code&gt; is regular mask &lt;code&gt;255.255.255.192&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I think you want is object groups like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object-group network WWW-ACL&#xA;   192.168.100.0 255.255.255.128&#xA;object-group network SMTP-ACL&#xA;   192.168.100.128 255.255.255.192&#xA;object-group network FTP-ACL&#xA;   192.168.100.192 255.255.255.192 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-03T22:20:47.763" LastActivityDate="2016-10-03T22:20:47.763" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="35459" PostTypeId="1" AcceptedAnswerId="35460" CreationDate="2016-10-03T22:55:11.927" Score="1" ViewCount="329" Body="&lt;p&gt;Ok, so I have to admit I am not an expert in how Juniper networked devices work, so this entire issue might be why I am having issues understanding something I am seeing on a pair of clustered SRX210H's.&lt;/p&gt;&#xA;&lt;p&gt;So, when I SSH to one of these clustered Juniper devices, I am presented with a standard BSD/Unix prompt.  If I run the &lt;strong&gt;&lt;code&gt;ifconfig&lt;/code&gt;&lt;/strong&gt; command, I get a long list of interfaces, and the last two interfaces are as follows:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;fab1:   encaps: ether; framing: ether&#xA;        flags=0x3/0xc000 &amp;lt;PRESENT|RUNNING&amp;gt;&#xA;        curr media: i802 80:71:1f:b9:27:70&#xA;fab1.0: flags=0xc000 &amp;lt;UP|MULTICAST&amp;gt;&#xA;        inet mtu 8996 local=30.18.0.200 dest=30.18.0.0/24 bcast=30.18.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;a little farther up the interface list, i also so a &lt;strong&gt;fab0&lt;/strong&gt; interface&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;fab0:   encaps: ether; framing: ether&#xA;        flags=0x3/0xc000 &amp;lt;PRESENT|RUNNING&amp;gt;&#xA;        curr media: i802 80:71:1f:b9:17:b0&#xA;fab0.0: flags=0xc000 &amp;lt;UP|MULTICAST&amp;gt;&#xA;        inet mtu 8996 local=30.17.0.200 dest=30.17.0.0/24 bcast=30.17.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I lookup 30.17.0.200, i get the following:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://30.17.0.200.ipaddress.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://30.17.0.200.ipaddress.com/&lt;/a&gt;&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;IP Address: 30.17.0.200&#xA;Organization:   DoD Network Information Center&#xA;ISP/Hosting:    DoD Network Information Center&#xA;Updated:    10/01/2016 09:34 AM&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When I dig a little deeper, I find a reference to a juniper KB article titled&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB21d499&amp;amp;actp=search&quot; rel=&quot;nofollow noreferrer&quot;&gt;Why does the 'show interface terse' command display fabric interface IP addresses with 30.0.0.0/8 addresses?&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Which has the following info&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;SUMMARY&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;This article describes the issue of the 'show interface terse' command displaying fabric interface IP addresses with 30.0.0.0/8 addresses.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;SYMPTOMS&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;p&gt;Fabric interface IP addresses are system-determined and not configurable. The following is a excerpt of the output of  'show interface terse' :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;fab0 up up &#xA;fab0.0 up up inet 30.17.0.200/24 &#xA;fab1 up down&#xA;fab1.0 up down inet 30.18.0.200/24 &#xA;fxp0 up down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;strong&gt;SOLUTION&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This is expected behavior of the system.&lt;/li&gt;&#xA;&lt;li&gt;These addresses are used only for the internal communication of the cluster.&lt;/li&gt;&#xA;&lt;li&gt;No routes are installed for the fab0 subnets; it will not affect any transit&#xA;traffic.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;If, for whatever reason, a fabric interface was accidentally plugged into a production segment, the fabric traffic would still not be routed out, as it would not get processed at layer 2.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;PURPOSE:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Implementation&lt;/p&gt;&#xA;&lt;p&gt;That being said, why exactly is the expected behavior?   Why would Juniper decide to use public IP addresses owned by the DoD Network Information Center to preform this function for clustered networked devices?   My primary concern is this, earlier this year the DoD publically disclosed security backdoors in Juniper products.   I would not find this to be too odd if it were any other organization, but the fact that the DoD was invloved in calling out Juniper on having backdoors in their products.   See the following URL for more info on the backdoor that was exposed earlier in 2016.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://motherboard.vice.com/read/department-of-defense-nudges-contractors-to-patch-juniper-backdoor&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://motherboard.vice.com/read/department-of-defense-nudges-contractors-to-patch-juniper-backdoor&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Can anyone explain what the purpose of using public IP address space owned by the DoD on Juniper equipment is?   Why wouldn't they just use a point to point private ip address range for communications between two clustered devices?   I would like a technical explanation if at all possible (not sure if a non-technical explanation even exists considering the question being asked).   Any Juniper experts care to chime in?&lt;/p&gt;&#xA;&lt;p&gt;I should mention that when I look at the packet counters for both interfaces, there is a lot of outgoing packet traffic, absolutely 0 incoming packet traffic on the fab0.0 and fab1.0 interfaces.   If it were being used for just failover/clustering, wouldn't there be both incoming and outgoing packets?&lt;/p&gt;&#xA;&lt;p&gt;Another question is why in the KB article from Juniper do they refer the public IP address range as being 30.0.0.0/8 when the line from the config they show in the example clearly shows that the network is using a /24 (254 hosts)?&lt;/p&gt;&#xA;" OwnerUserId="4994" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2019-01-12T20:40:54.030" Title="Clustered Juniper devices using public DoD IP addresses for communication?" Tags="|ip|ipv4|juniper|interface|failover|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35460" PostTypeId="2" ParentId="35459" CreationDate="2016-10-03T23:12:13.740" Score="2" Body="&lt;p&gt;I'm not a Juniper expert, but other vendors have done something similar for heartbeats (Hey! I'm still alive!), or other reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is no technical reason why that specific address range was chosen. The traffic sourced from those interfaces will not be sent out on the network to be routed anywhere else. It doesn't really matter what addresses are used, except that it could be confusing if it happened to match anything else on your network, and what was chosen is extremely unlikely to be used anywhere else. The DoD started the Internet, and it owns multiple &lt;code&gt;/8&lt;/code&gt; ranges, many of which are not actually used on the public Internet, and some people use these &quot;dark&quot; network addresses for their own internal use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The public address range is &lt;code&gt;30.0.0.0/8&lt;/code&gt;. Any network, including the &lt;code&gt;/24&lt;/code&gt; ranges, starting with &lt;code&gt;30.&lt;/code&gt; are part of the larger public network. That is subnetting (chopping a larger network into smaller networks).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-03T23:17:27.733" LastActivityDate="2016-10-03T23:17:27.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35462" PostTypeId="2" ParentId="35440" CreationDate="2016-10-04T01:14:38.767" Score="2" Body="&lt;p&gt;All I can do is explain how a pretty successful large network does it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of the hundreds to thousands of end-sites on an MPLS VPN is in the same private BGP AS, so site-to-site traffic is switched directly by the carrier MPLS cloud. The data centers each have their own private BGP ASes. So, the WAN is a mixture of iBGP and eBGP. Each end-site and data center runs its own separate IGP, injecting the default and specific routes from the MPLS cloud(s), although the standard defines only one, each site's IGP is independent from all the other sites'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some end-sites have one WAN circuit, and some sites have two WAN circuits. Of the sites with two WAN circuits, some have both circuits on one carrier (required to terminate at separate carrier POPs), and some have one circuit on each of two different carriers. Obviously, the data centers have large-pipe connections to all the carriers, but the end-site circuits are right-sized for the traffic to/from the particular site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each end-site gets a default route to the MPLS cloud, and a few specific prefixes from the data centers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was arrived at after many years of various arrangements. Using an IGP across the WAN for hundreds to thousands of sites just proved too problematic (actually slowing IGP convergence to a crawl), and forcing traffic to a central site, even if the traffic was site-to-site added too much latency.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-04T01:20:01.693" LastActivityDate="2016-10-04T01:20:01.693" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35463" PostTypeId="1" CreationDate="2016-10-04T02:13:08.390" Score="1" ViewCount="1020" Body="&lt;p&gt;JunOS version: 12.3R11.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper EX switch with 2 VLANs:&lt;br&gt;&#xA;&lt;strong&gt;vlan 0&lt;/strong&gt;: IPv4: 10.0.0.6/20&lt;br&gt;&#xA;This vlan is used for private IP space  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;vlan 1&lt;/strong&gt;: IPv4: X.X.X.254/24&lt;br&gt;&#xA;IPv6: XXXX:XXXX:X:XXX::ffff/64&lt;br&gt;&#xA;This vlan is used for public IP space&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices connected to the switch can ping the gateway of my assigned IPv6 block (XXXX:XXXX:X:XXX::1), they can ping each other, and they can ping the XXXX:XXXX:X:XXX::ffff address assigned to the public vlan however they can't ping anything outside the LAN (ex. Google 2001:4860:4860::8888). IPv4 works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a static route for 0.0.0.0/0 next-hop 10.0.0.1 but that is the only static route configured. Do I need to add a static route for ::/0 too? What would be the next-hop?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated - I am learning this as I go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT: additional info&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;pings gateway okay&lt;/em&gt;&lt;br&gt;&#xA;user@host:RE:0% ping6 xxxx:xxxx:x:xxx::1&lt;br&gt;&#xA;PING6(56=40+8+8 bytes) xxxx:xxxx:x:xxx::ffff --&gt; xxxx:xxxx:x:xxx::1&lt;br&gt;&#xA;16 bytes from xxxx:xxxx:x:xxx::1, icmp_seq=0 hlim=64 time=6.213 ms&lt;br&gt;&#xA;16 bytes from xxxx:xxxx:x:xxx::1, icmp_seq=1 hlim=64 time=6.516 ms&lt;br&gt;&#xA;16 bytes from xxxx:xxxx:x:xxx::1, icmp_seq=2 hlim=64 time=1.684 ms&lt;br&gt;&#xA;16 bytes from xxxx:xxxx:x:xxx::1, icmp_seq=3 hlim=64 time=1.720 ms  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;fails outside LAN&lt;/em&gt;&lt;br&gt;&#xA;user@host:RE:0% ping6 2001:4860:4860::8888&lt;br&gt;&#xA;PING6(56=40+8+8 bytes) xxxx:xxxx:x:xxx::ffff --&gt; 2001:4860:4860::8888&lt;br&gt;&#xA;ping6: sendmsg: No route to host&lt;br&gt;&#xA;ping6: wrote 2001:4860:4860::8888 16 chars, ret=-1&lt;br&gt;&#xA;ping6: sendmsg: No route to host&lt;br&gt;&#xA;ping6: wrote 2001:4860:4860::8888 16 chars, ret=-1&lt;br&gt;&#xA;ping6: sendmsg: No route to host&lt;br&gt;&#xA;ping6: wrote 2001:4860:4860::8888 16 chars, ret=-1  &lt;/p&gt;&#xA;" OwnerUserId="27736" LastEditorUserId="27736" LastEditDate="2016-10-04T02:21:20.727" LastActivityDate="2016-10-04T03:20:32.343" Title="Juniper EX IPv6 outside LAN isn't working" Tags="|routing|vlan|ipv6|juniper|lan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35464" PostTypeId="2" ParentId="35463" CreationDate="2016-10-04T02:26:25.763" Score="2" Body="&lt;p&gt;IPv6, like IPv4, routing needs to have a route to the destination, even if it is only a default route, otherwise the traffic gets dropped by the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing works the same for any IP version: the router looks at the destination IP address, and it tries to find a match in its routing table. Absent such a match, the traffic is dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You either need a default route from your ISP, or you need to manually configure a route to &lt;code&gt;::/0&lt;/code&gt; with a next hop as your ISP's IPv6 interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, your ISP should assign you a &lt;code&gt;/48&lt;/code&gt; for your site, and you should set up IPv6 prefix delegation to assign your individual networks on your LAN. Some ISPs will only assign a &lt;code&gt;/56&lt;/code&gt;, or, more rarely, a &lt;code&gt;/60&lt;/code&gt;. The ISPs will not advertise any prefix longer than a &lt;code&gt;/48&lt;/code&gt;, so that the addresses will belong to your ISP, but you can easily get a &lt;code&gt;/48&lt;/code&gt; from your RIR. If you get provider-independent addressing from your RIR, you may need to use BGP with your ISP, or negotiate for the ISP to advertise your IPv6 network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-04T03:20:32.343" LastActivityDate="2016-10-04T03:20:32.343" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35466" PostTypeId="1" AcceptedAnswerId="35467" CreationDate="2016-10-04T04:01:53.013" Score="2" ViewCount="149" Body="&lt;p&gt;If I setup a 2x 1Gig ports with link aggregation, will I get 2Gigs bandwidth or less? how less?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thank you&lt;/p&gt;&#xA;" OwnerUserId="30993" LastEditorUserId="8499" LastEditDate="2018-12-20T21:20:35.403" LastActivityDate="2018-12-20T21:20:35.403" Title="Does link aggregation uses the full bandwidth?" Tags="|bandwidth|port-channel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35467" PostTypeId="2" ParentId="35466" CreationDate="2016-10-04T04:07:38.710" Score="3" Body="&lt;p&gt;That depends. If it is done correctly, each flow would get a maximum of 1 Gbps, but with multiple flows, you will be able to use the full 2 Gbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some people, on some equipment, can, and will, configure round-robin balancing, but that leads to problems like out-of-order packet delivery, which can completely kill real-time applications, and it can actually degrade your performance to less than 1 Gbps per flow..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Correctly done, you use a hash algorithm to determine which flow gets which member interface. This will limit a single flow to a percentage (possibly 100% on a lightly used link) of a single link in the channel. This will average out to using the whole 2 Gbps of the channel with multiple flows.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-04T04:07:38.710" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35469" PostTypeId="2" ParentId="35431" CreationDate="2016-10-04T05:06:01.597" Score="2" Body="&lt;h2&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/integrated-routing-bridging-irb/17054-741-10.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding and Configuring VLAN Routing and Bridging on a Router Using the IRB Feature&lt;/a&gt;&lt;/h2&gt;&#xA;&lt;h3&gt;Background Information&lt;/h3&gt;&#xA;&lt;p&gt;In order for a VLAN to span a router, the router must be capable of forwarding frames from one interface to another, while maintaining the VLAN header. If the router is configured for routing a Layer 3 (network layer) protocol, it will terminate the VLAN and MAC layers at the interface a frame arrives on. The MAC layer header can be maintained if the router is bridging the network layer protocol. However, regular bridging still terminates the VLAN header.&lt;/p&gt;&#xA;&lt;p&gt;Using the IRB feature in Cisco IOS® Release 11.2 or greater, a router can be configured for routing and bridging the same network layer protocol on the same interface. This allows the VLAN header to be maintained on a frame while it transits a router from one interface to another. IRB provides the ability to route between a bridged domain and a routed domain with Bridge Group Virtual Interface (BVI). The BVI is a virtual interface within the router that acts like a normal routed interface that does not support bridging, but represents the comparable bridge group to routed interfaces within the router. The interface number of the BVI is the number of the bridge group that the virtual interface represents. The number is the link between the BVI and the bridge group.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-10-04T05:06:01.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35470" PostTypeId="1" CreationDate="2016-10-04T05:33:03.617" Score="1" ViewCount="1569" Body="&lt;p&gt;On my work network, when I go to my DHCP server, then open DHCP &gt; domain_name &gt; IPv4 &gt; Address Leases, I found that 192.168.160.7 is assigned to a iPad device (connected via Wifi).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I use command prompt and type &quot;arp -a&quot; I found that 192.168.160.7 is mapped to a MAC address which is a desktop computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is this possible? How do I know which device really has that IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance!&lt;/p&gt;&#xA;" OwnerUserId="30994" LastActivityDate="2017-12-31T14:05:02.117" Title="ARP and DHCP same address to different device?" Tags="|dhcp|arp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35471" PostTypeId="1" CreationDate="2016-10-04T08:09:31.843" Score="0" ViewCount="158" Body="&lt;p&gt;I have a task to do research on network traffic analysis in cloud systems, but I'am not really sure what exactly means network traffic. Can you please explain it bit more. Thank you&lt;/p&gt;&#xA;" OwnerUserId="30995" LastActivityDate="2016-10-04T11:31:30.423" Title="Network traffic" Tags="|monitoring|" AnswerCount="4" CommentCount="1" ClosedDate="2016-10-04T13:44:57.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="35472" PostTypeId="2" ParentId="35471" CreationDate="2016-10-04T08:20:02.397" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Network traffic refers to the amount of data moving across a network at a given point of time. Network data is mostly encapsulated in network packets, which provide the load in the network. Network traffic is the main component for network traffic measurement, network traffic control and simulation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a basic definition of network traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your question is too wide to answer without any more technical details on exactly the purpose of the analysis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you need to know the type of traffic that is being transmitted, such as what protocol is being used, where the traffic flows to, ie destination or perhaps the source of the traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or are you being asked to monitor the consumption of bandwidth such as the throughput?&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2016-10-04T08:20:02.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35473" PostTypeId="2" ParentId="35470" CreationDate="2016-10-04T08:26:32.050" Score="1" Body="&lt;p&gt;It is possible your PC has an old ARP entry in the table. If the PC did not perform an ARP request for this IP address recently, while the IP was assigned to a new device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you ping the address, your ARP table should update with the new MAC address after the original ARP entry has expired due the aging timer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is of course, providing you do not have an IP conflict and the desktop has a static IP address assigned while the DHCP gave out the same IP address to another device.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="27056" LastEditDate="2016-10-06T08:05:15.003" LastActivityDate="2016-10-06T08:05:15.003" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35475" PostTypeId="1" CreationDate="2016-10-04T08:44:43.803" Score="3" ViewCount="8310" Body="&lt;p&gt;How can I give an IP address to a vlan interface on a Cisco 1900series router?&lt;/p&gt;&#xA;&lt;p&gt;as request from my customers :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Routerlintas#&lt;/p&gt;&#xA;&lt;p&gt;interface Vlan10&lt;br /&gt;&#xA;ip address 10.10.12.77 255.255.255.252&lt;/p&gt;&#xA;&lt;p&gt;interface FastEthernet0/0/0&lt;br /&gt;&#xA;description LAN KartuKu&lt;br /&gt;&#xA;switchport access vlan 10&lt;br /&gt;&#xA;no ip address&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I have successfully made vlan 10 with the command:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Routerlintas#vlan database&lt;br /&gt;&#xA;R(vlan)#vlan 10 name TO-NETWORK-VLAN-10&lt;br /&gt;&#xA;R(vlan)#exit&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and the problem is:&lt;br /&gt;&#xA;I can't go into interface vlan 10.&lt;/p&gt;&#xA;&lt;p&gt;I must give ip address in vlan 10&#xA;and command  &lt;code&gt;#interface vlan 10&lt;/code&gt;  is not working.&lt;/p&gt;&#xA;" OwnerUserId="30997" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-10-23T02:09:33.120" Title="How to make Vlan in cisco Router 1900" Tags="|cisco|router|vlan|ip|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35476" PostTypeId="1" CreationDate="2016-10-04T08:45:38.870" Score="1" ViewCount="51" Body="&lt;p&gt;I've installed Ubuntu 16.04.1-server on a HP server. &#xA;I have iLo access, and can connect via built in terminal. (this is the way i installed the OS).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the installation, I've assigned the ip 172.16.93.119/24 to the machine. It's connected to a network where the gateway is 172.16.93.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I do ifconfig, and route -n i get:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Su5nQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Su5nQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, when i try to ping the gateway, or any other ip in network, i get &quot;Desitnation Host Unreachable&quot;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ei06v.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ei06v.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've spent more time then i'd love to admit on this, and i'm stuck.&lt;/p&gt;&#xA;" OwnerUserId="30998" LastActivityDate="2016-10-04T11:26:27.683" Title="Can't get the route to work. Need help" Tags="|routing|" AnswerCount="1" CommentCount="7" ClosedDate="2016-10-04T13:44:23.563" ContentLicense="CC BY-SA 3.0" />
  <row Id="35477" PostTypeId="1" AcceptedAnswerId="35481" CreationDate="2016-10-04T09:13:59.693" Score="2" ViewCount="69" Body="&lt;p&gt;When a new hosts joins a network and broadcasts to find a DHCP server every host on the netowkr knows of the new hosts and its' request. Does every host also know of the final ACK packet, that acknowledges the assigning of an IP address?&lt;/p&gt;&#xA;" OwnerUserId="30999" LastActivityDate="2016-10-04T11:02:40.737" Title="DHCP does every host know of ongoing requests?" Tags="|dhcp|network-core|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35478" PostTypeId="2" ParentId="35471" CreationDate="2016-10-04T10:06:07.140" Score="2" Body="&lt;p&gt;Network traffic is a very generic word , so shortly if you want to dig this field you need to understand two main things.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;NETWORKING&lt;/em&gt;&lt;/strong&gt; is &lt;strong&gt;&lt;em&gt;ADDRESSING&lt;/em&gt;&lt;/strong&gt; &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;this address may be L2 address(mac for example) or L3 address (IPV4 for example) and this address could be source or destination.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;strong&gt;&lt;em&gt;Traffic&lt;/em&gt;&lt;/strong&gt; is &lt;strong&gt;&lt;em&gt;parameters&lt;/em&gt;&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;this parameters could be protocols &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;transition protocol &lt;em&gt;TCP&lt;/em&gt; or &lt;em&gt;UDP&lt;/em&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;application protocol &lt;em&gt;http&lt;/em&gt; or &lt;em&gt;https&lt;/em&gt;&#xA;and so on&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;this traffic also could be treated by quality of service (QOS)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so simply if PC_1 make traffic to PC_2 (ping for example) and you could obtain the information of &#xA;&lt;strong&gt;&lt;em&gt;source mac , source IP , destination mac , destination IP , this traffic is UDP or TCP , this traffic QOS is best effort for example&lt;/em&gt;&lt;/strong&gt; you successfully made network analyses  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;but lets say cloud network analyses not simply as this example it could include more information like application type and number of sessions payload of each session and so on  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you want to see demo of network analyses obtained from real data center may you access &lt;a href=&quot;http://oriondemo.solarwinds.com/Orion/Login.aspx?ReturnUrl=%2F&quot; rel=&quot;nofollow&quot;&gt;ORION live demo&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-10-04T10:06:07.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35479" PostTypeId="1" CreationDate="2016-10-04T10:34:32.193" Score="3" ViewCount="1450" Body="&lt;p&gt;I am in the process of rolling out &lt;strong&gt;&lt;em&gt;solarwinds&lt;/em&gt;&lt;/strong&gt; for visibility of QoS performance using &lt;strong&gt;&lt;em&gt;netflow&lt;/em&gt;&lt;/strong&gt; and &lt;strong&gt;&lt;em&gt;CBQOS&lt;/em&gt;&lt;/strong&gt; to show &lt;strong&gt;&lt;em&gt;QoS&lt;/em&gt;&lt;/strong&gt; class usage. One thing I am unsure of is what type of monitoring is available on L2 edge switches. We have a QoS policy configured and can see port / buffer drops via CLI using &lt;code&gt;&quot;Switch#sh mls qos int gi1/0/1 statistics&quot;&lt;/code&gt; but what I would like to do is extract this port data to Solarwinds via SNMP so its visible to all. Is there a specific MIB available which would provide this functionality? More specifically I would like to see output queue drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="31001" LastEditorUserId="17452" LastEditDate="2016-10-04T13:40:51.440" LastActivityDate="2017-06-02T00:03:52.667" Title="Extract QoS Buffer Drops via SNMP" Tags="|snmp|qos|monitoring|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35480" PostTypeId="2" ParentId="35475" CreationDate="2016-10-04T10:53:48.040" Score="1" Body="&lt;p&gt;&lt;code&gt;interface vlan&lt;/code&gt; is used on layer-3 switches, not 'real' routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It depends on what your customer wants to achieve exactly and how the link between the router and the rest of the network is configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they they gave you this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan10&#xA; ip address 10.10.12.77 255.255.255.252&#xA;&#xA;interface FastEthernet0/0/0&#xA; description LAN KartuKu&#xA; switchport access vlan 10&#xA; no ip address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then this implies that the port to which the router connects, is an access port in vlan 10, so you could simply configure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0&#xA; ip address 10.10.12.77 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If, however, they require multiple interfaces of the router to be in vlan10 (in other words, they expect the router to behave like a L3 switch) then you may need to configure &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/integrated-routing-bridging-irb/17054-741-10.html&quot; rel=&quot;nofollow&quot;&gt;IRB&lt;/a&gt;, so for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0&#xA; bridge-group 1&#xA;&#xA;interface Ethernet1&#xA; bridge-group 1&#xA;&#xA;interface BVI1&#xA; ip address 10.10.12.77 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-04T10:53:48.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35481" PostTypeId="2" ParentId="35477" CreationDate="2016-10-04T10:54:11.400" Score="2" Body="&lt;p&gt;The DHCP RFC, &lt;a href=&quot;https://www.ietf.org/rfc/rfc2131.txt&quot; rel=&quot;nofollow&quot;&gt;RFC2131&lt;/a&gt;  says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Normally, DHCP servers and BOOTP relay agents attempt to deliver&lt;br&gt;&#xA;  DHCPOFFER, DHCPACK and DHCPNAK messages directly to the client using&lt;br&gt;&#xA;  unicast delivery.&lt;br&gt;&#xA;  [...]&lt;br&gt;&#xA;   A client that cannot receive unicast IP datagrams until its protocol&#xA;     software has been configured with an IP address SHOULD set the&#xA;     BROADCAST bit in the 'flags' field to 1 in any DHCPDISCOVER or&#xA;     DHCPREQUEST messages that client sends.  The BROADCAST bit will&#xA;     provide a hint to the DHCP server and BOOTP relay agent to broadcast&#xA;     any messages to the client on the client's subnet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So in normal operation, the DHCPACK message will be unicast (I.E. Layer2 unicast), directed to the client MAC Address.&lt;br&gt;&#xA;In a modern, switched, environnement, the other hosts will not see the final ACK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an old network that still use hubs, all network interface card in the layer 2 network will still see the related frames, but are not supposed to process them, so they will not transmit them to the operating system unless set in promiscuous mode.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-10-04T10:54:11.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35482" PostTypeId="2" ParentId="35477" CreationDate="2016-10-04T11:02:40.737" Score="2" Body="&lt;p&gt;Every host sees the DHCPACK but they don't really have anything to do with it, as they know they are not the ones requesting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also be aware that not all DHCPOFFER are broadcast, it depends on the BROADCAST bit in the 'flags' field, see RFC2131 &lt;a href=&quot;https://www.ietf.org/rfc/rfc2131.txt&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A client that cannot receive unicast IP datagrams until its protocol&#xA;     software has been configured with an IP address SHOULD set the&#xA;     BROADCAST bit in the 'flags' field to 1 in any DHCPDISCOVER or&#xA;     DHCPREQUEST messages that client sends.  The BROADCAST bit will&#xA;     provide a hint to the DHCP server and BOOTP relay agent to broadcast&#xA;     any messages to the client on the client's subnet.  A client that can&#xA;     receive unicast IP datagrams before its protocol software has been&#xA;     configured SHOULD clear the BROADCAST bit to 0.  The BOOTP&#xA;     clarifications document discusses the ramifications of the use of the&#xA;     BROADCAST bit [21].&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A server or relay agent sending or relaying a DHCP message directly&#xA;     to a DHCP client (i.e., not to a relay agent specified in the&#xA;     'giaddr' field) SHOULD examine the BROADCAST bit in the 'flags'&#xA;     field.  If this bit is set to 1, the DHCP message SHOULD be sent as&#xA;     an IP broadcast using an IP broadcast address (preferably 0xffffffff)&#xA;     as the IP destination address and the link-layer broadcast address as&#xA;     the link-layer destination address.  If the BROADCAST bit is cleared&#xA;     to 0, the message SHOULD be sent as an IP unicast to the IP address&#xA;     specified in the 'yiaddr' field and the link-layer address specified&#xA;     in the 'chaddr' field.  If unicasting is not possible, the message&#xA;     MAY be sent as an IP broadcast using an IP broadcast address&#xA;     (preferably 0xffffffff) as the IP destination address and the link-&#xA;     layer broadcast address as the link-layer destination address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Edit:JFL answered while I was tipping this&lt;/p&gt;&#xA;" OwnerUserId="20753" LastActivityDate="2016-10-04T11:02:40.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35483" PostTypeId="2" ParentId="35471" CreationDate="2016-10-04T11:13:07.683" Score="1" Body="&lt;p&gt;It seems opinions on this vary, but FWIW here is mine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network traffic is simply the data sent between devices on a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefor, traffic analysis can mean a lot of things. Compare it with real-life road traffic. Traffic analysis there could mean to measure average speed or top speed, distance between vehicles, size/color/type of cars/buses/trucks, amount of people inside the vehicles, count how many vehicles are passing by per minute (or how many 20th century white convertibles pass) etc. etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly you can analyse the traffic on a network to check how many bytes are transmitted, how much (average) delay there is, how much of the traffic is using a certain protocol (IPv4 vs IPv6, TCP vs UDP vs other, etc.) and lots, lots more.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-04T11:13:07.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35484" PostTypeId="2" ParentId="35475" CreationDate="2016-10-04T11:14:08.590" Score="2" Body="&lt;p&gt;if your router host small LAN switches modules.which is could be configured from  the router itself and it is separate logical device with its own configuration.so&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;They are logical L3 interfaces so called (SVI = switched virtual interfaces) they provide layer 3 services (a gateway) to corresponding L2 Vlan.the L2 vlan can be associated to one or multiple switch ports of the module and they are configured like in an IOS LAN switch.&lt;/li&gt;&#xA;&lt;li&gt;Vlan interfaces are a form of logical interfaces like loopbacks but: an SVI vlan 10 can be up/up &#xA;only if at least one switch port is up and associated to vlan 10 (including trunk ports and actually&#xA;the correct definition is at least one port in Spanning tree state forwarding). Note: this is true &#xA;for real switches it can be false for these modules on routers (the internal trunk between router &#xA;and module can be enough to make the L3 SVI to stay up)&lt;/li&gt;&#xA;&lt;li&gt;First of all the corresponding L2 object Vlan has to be created, it is likely that you should use &#xA;vlan database context as you did&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;router# vlan database&lt;br&gt;&#xA;      router(vlan)# vlan 10&lt;br&gt;&#xA;      router(vlan)# name test10&lt;br&gt;&#xA;      router(vlan)#apply&lt;br&gt;&#xA;      router(vlan)#exit&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;apply or exit are needed to have the new vlan created&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then you need to configure the interface vlan and enable it, as next&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;router#config t&lt;br&gt;&#xA;  router(config)#interface vlan 10&lt;br&gt;&#xA;  router(config)#ip address 10.10.10.1 255.255.255.0&lt;br&gt;&#xA;  &lt;strong&gt;&lt;em&gt;you need to enable with no shut&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;  router(config)#no shut&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;then associate the interface you want to this vlan&lt;/em&gt;&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;also make use of &lt;a href=&quot;https://supportforums.cisco.com/discussion/10828491/vlans-router&quot; rel=&quot;nofollow&quot;&gt;this link&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2016-10-04T11:14:08.590" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35485" PostTypeId="2" ParentId="35476" CreationDate="2016-10-04T11:26:27.683" Score="0" Body="&lt;p&gt;I would try this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ping 172.16.93.119 from the server&lt;/li&gt;&#xA;&lt;li&gt;Traceroute from the server and from hosts to see where the issue is&lt;/li&gt;&#xA;&lt;li&gt;Use a different IP, sometimes LL providers use interface Vlans to test p2p connectivity and might leave those IP there by mistake&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20753" LastActivityDate="2016-10-04T11:26:27.683" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35486" PostTypeId="2" ParentId="35471" CreationDate="2016-10-04T11:31:30.423" Score="1" Body="&lt;p&gt;Network traffic analysis is the process of recording, reviewing and analyzing network traffic for the purpose of performance, security and/or general network operations and management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the process of using manual and automated techniques to review granular-level detail and statistics within network traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.techopedia.com/definition/29976/network-traffic-analysis&quot; rel=&quot;nofollow&quot;&gt;please refer to this page&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30876" LastActivityDate="2016-10-04T11:31:30.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35487" PostTypeId="2" ParentId="35479" CreationDate="2016-10-04T11:33:03.340" Score="0" Body="&lt;p&gt;According to the &lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/MainServlet&quot; rel=&quot;nofollow&quot;&gt;Cisco MIB locator&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/MainServlet?ReleaseSel=2904&amp;amp;PlatformSel=362&amp;amp;fsSel=852&quot; rel=&quot;nofollow&quot;&gt;For 3560 using 12.2(58)SE2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/MainServlet?ReleaseSel=2904&amp;amp;PlatformSel=371&amp;amp;fsSel=748&quot; rel=&quot;nofollow&quot;&gt;For 3750 using 12.2(58)SE2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/MainServlet?ReleaseSel=4158&amp;amp;PlatformSel=354&amp;amp;fsSel=1410&quot; rel=&quot;nofollow&quot;&gt;For 2960s using 15.2(2)E&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://tools.cisco.com/ITDIT/MIBS/MainServlet?ReleaseSel=4158&amp;amp;PlatformSel=357&amp;amp;fsSel=1410&quot; rel=&quot;nofollow&quot;&gt;For 2960x using 15.2(2)E&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/simple-network-management-protocol-snmp/119031-technote-router-00.html&quot; rel=&quot;nofollow&quot;&gt;Cisco technote&lt;/a&gt; can also help you&lt;/p&gt;&#xA;" OwnerUserId="20753" LastEditorUserId="20753" LastEditDate="2016-10-04T12:12:13.553" LastActivityDate="2016-10-04T12:12:13.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35490" PostTypeId="1" AcceptedAnswerId="35493" CreationDate="2016-10-04T13:38:55.423" Score="2" ViewCount="932" Body="&lt;p&gt;I'm trying to make a trunk between a Cisco ASA 5505 with the IP Service licence and a Cisco Catalyst 3750G.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are my current config's:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet0/1&#xA;  switchport trunk allowed vlan 101-119&#xA;  switchport trunk native vlan 101&#xA;  switchport mode trunk&#xA;!&#xA;interface Vlan110&#xA;  no nameif&#xA;  no security-level&#xA;  ip address 172.16.110.1 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/1&#xA;  switchport trunk encapsulation dot1q&#xA;  switchport trunk native vlan 101&#xA;  switchport trunk allowed vlan 101-119&#xA;  switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA;  switchport access vlan 110&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm connected with my PC to the Gig1/0/2 with the IP &lt;code&gt;172.16.110.3&lt;/code&gt; trying to ping &lt;code&gt;172.16.110.1&lt;/code&gt;. The mac address of my PC is in the mac address table from the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone help me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please be indulgent with me, I'm a dev.&lt;/p&gt;&#xA;" OwnerUserId="24187" LastEditorUserId="24187" LastEditDate="2016-10-04T14:02:26.883" LastActivityDate="2016-10-04T14:02:43.973" Title="Problem with trunk between Cisco ASA 5505 and Catalyst 3750G" Tags="|cisco|cisco-asa|cisco-ios|cisco-catalyst|trunk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35492" PostTypeId="1" CreationDate="2016-10-04T13:54:24.853" Score="1" ViewCount="16062" Body="&lt;pre&gt;&lt;code&gt;r-tx-server-1#show arp&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  10.199.0.12             0   Incomplete      ARPA&#xA;Internet  10.199.0.53             0   Incomplete      ARPA&#xA;Internet  10.20.251.30            0   Incomplete      ARPA&#xA;Internet  10.20.254.200           0   Incomplete      ARPA&#xA;Internet  10.20.254.202           0   Incomplete      ARPA&#xA;Internet  10.21.1.21              0   Incomplete      ARPA&#xA;Internet  10.23.1.54              0   Incomplete      ARPA&#xA;Internet  10.23.1.58              0   Incomplete      ARPA&#xA;Internet  10.23.1.99              0   Incomplete      ARPA&#xA;Internet  10.23.100.11            0   Incomplete      ARPA&#xA;Internet  10.34.1.192             0   Incomplete      ARPA&#xA;Internet  10.34.1.20              0   Incomplete      ARPA&#xA;Internet  10.34.1.73              0   Incomplete      ARPA&#xA;Internet  10.39.0.115             0   Incomplete      ARPA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For example Ping &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r-tx-server-1#ping 10.39.0.115&#xA;&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 10.39.0.115, timeout is 2 seconds:&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am confused why it's ARPA &lt;code&gt;Incomplete&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="31006" LastEditorUserId="8499" LastEditDate="2018-03-07T20:30:43.050" LastActivityDate="2018-03-07T20:30:43.050" Title="Why does it show ARPA incomplete?" Tags="|cisco|vlan|arp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35493" PostTypeId="2" ParentId="35490" CreationDate="2016-10-04T14:02:43.973" Score="3" Body="&lt;p&gt;On the ASA, each L3 interface needs to have a name and a security level. In addition ping (ICMP) is blocked by default, so you need to explicitly permit it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan110&#xA;  nameif inside&#xA;  security-level 100&#xA;&#xA;icmp permit any inside &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-04T14:02:43.973" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35494" PostTypeId="2" ParentId="35492" CreationDate="2016-10-04T14:29:50.507" Score="2" Body="&lt;p&gt;On a Cisco device, the &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr/command/ipaddr-cr-book/ipaddr-r1.html#wp1285440920&quot; rel=&quot;nofollow&quot;&gt;&lt;code&gt;show arp&lt;/code&gt;&lt;/a&gt; command produces an &lt;code&gt;incomplete&lt;/code&gt; hardware address when the device sends or sees an ARP request, but does not see a reply with the MAC address:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An incomplete ARP entry is learned through an ARP request but has not&#xA;  yet been completed with the MAC address of the external host.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;An ARP request was sent for that address, but the host with that address is not up and running on the LAN, so there is no reply. The ARP entry will eventually time out unless there are more ARP requests for that IP address before the time has expired.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-04T18:49:21.597" LastActivityDate="2016-10-04T18:49:21.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35499" PostTypeId="1" CreationDate="2016-10-04T15:48:26.367" Score="2" ViewCount="1030" Body="&lt;pre&gt;&lt;code&gt; 6509 Server-VSS Switch Rack GG 10.36.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I checked &lt;code&gt;show mac-address-table interface port-channel 133&lt;/code&gt;&#xA;shows duplicate mac address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;* 2301  0050.5617.07a0   dynamic  Yes        175   Po133&#xA;* 2301  0050.5617.07a0   dynamic  Yes         45   Po133&#xA;* 2301  0050.5617.07a2   dynamic  Yes         40   Po133&#xA;* 2301  0050.5617.07a2   dynamic  Yes        215   Po133&#xA;* 2301  0050.5617.1000   dynamic  Yes         10   Po133&#xA;* 2301  0050.5617.1000   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.1002   dynamic  Yes         10   Po133&#xA;* 2301  0050.5617.1002   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.1540   dynamic  Yes         50   Po133&#xA;* 2301  0050.5617.1540   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.1542   dynamic  Yes         50   Po133&#xA;* 2301  0050.5617.1542   dynamic  Yes         75   Po133&#xA;* 2301  0050.5617.1cc0   dynamic  Yes         10   Po133&#xA;* 2301  0050.5617.1cc0   dynamic  Yes        210   Po133&#xA;* 2301  0050.5617.1cc2   dynamic  Yes          5   Po133&#xA;* 2301  0050.5617.1cc2   dynamic  Yes        215   Po133&#xA;* 2301  0050.5617.2660   dynamic  Yes         55   Po133&#xA;* 2301  0050.5617.2660   dynamic  Yes         75   Po133&#xA;* 2301  0050.5617.2662   dynamic  Yes         55   Po133&#xA;* 2301  0050.5617.2662   dynamic  Yes         75   Po133&#xA;* 2301  0050.5617.2820   dynamic  Yes          5   Po133&#xA;* 2301  0050.5617.2820   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.2822   dynamic  Yes          5   Po133&#xA;* 2301  0050.5617.2822   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.37e0   dynamic  Yes         45   Po133&#xA;* 2301  0050.5617.37e0   dynamic  Yes        210   Po133&#xA;* 2301  0050.5617.37e2   dynamic  Yes         45   Po133&#xA;* 2301  0050.5617.37e2   dynamic  Yes        185   Po133&#xA;* 2301  0050.5617.3cc0   dynamic  Yes         40   Po133&#xA;* 2301  0050.5617.3cc0   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.3cc2   dynamic  Yes         40   Po133&#xA;* 2301  0050.5617.3cc2   dynamic  Yes         75   Po133&#xA;* 2301  0050.5617.3f40   dynamic  Yes         50   Po133&#xA;* 2301  0050.5617.3f40   dynamic  Yes         75   Po133&#xA;* 2301  0050.5617.4320   dynamic  Yes         25   Po133&#xA;* 2301  0050.5617.4320   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.4322   dynamic  Yes         45   Po133&#xA;* 2301  0050.5617.4322   dynamic  Yes         75   Po133&#xA;* 2301  0050.5617.43a0   dynamic  Yes         25   Po133&#xA;* 2301  0050.5617.43a0   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.43a2   dynamic  Yes         20   Po133&#xA;* 2301  0050.5617.43a2   dynamic  Yes         75   Po133&#xA;* 2301  0050.5617.44e0   dynamic  Yes         30   Po133&#xA;* 2301  0050.5617.44e0   dynamic  Yes        215   Po133&#xA;* 2301  0050.5617.44e2   dynamic  Yes         25   Po133&#xA;* 2301  0050.5617.44e2   dynamic  Yes        215   Po133&#xA;* 2301  0050.5617.4780   dynamic  Yes         55   Po133&#xA;* 2301  0050.5617.4780   dynamic  Yes        215   Po133&#xA;* 2301  0050.5617.4782   dynamic  Yes         55   Po133&#xA;* 2301  0050.5617.4782   dynamic  Yes        210   Po133&#xA;* 2301  0050.5617.4ca0   dynamic  Yes         55   Po133&#xA;* 2301  0050.5617.4ca0   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.4ca2   dynamic  Yes         55   Po133&#xA;* 2301  0050.5617.4ca2   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.51e0   dynamic  Yes         35   Po133&#xA;* 2301  0050.5617.51e0   dynamic  Yes         75   Po133&#xA;* 2301  0050.5617.51e2   dynamic  Yes         35   Po133&#xA;* 2301  0050.5617.51e2   dynamic  Yes         75   Po133&#xA;* 2301  0050.5617.5260   dynamic  Yes          0   Po133&#xA;* 2301  0050.5617.5260   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.5262   dynamic  Yes          0   Po133&#xA;* 2301  0050.5617.5262   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.5880   dynamic  Yes         15   Po133&#xA;* 2301  0050.5617.5880   dynamic  Yes        215   Po133&#xA;* 2301  0050.5617.5882   dynamic  Yes         20   Po133&#xA;* 2301  0050.5617.5882   dynamic  Yes        180   Po133&#xA;* 2301  0050.5617.5a60   dynamic  Yes         20   Po133&#xA;* 2301  0050.5617.5a60   dynamic  Yes        130   Po133&#xA;* 2301  0050.5617.5a62   dynamic  Yes         20   Po133&#xA;* 2301  0050.5617.5a62   dynamic  Yes        130   Po133&#xA;r-tx-server-1#show interfaces status | inc 2301&#xA;Gi1/2/11     *** MediaSite Vide notconnect   2301         full   auto 10/100/1000BaseT&#xA;Gi1/3/9      *** Culinary Video notconnect   2301         full   auto 10/100/1000BaseT&#xA;Gi1/3/28     *** Culinary Video notconnect   2301         full   auto 10/100/1000BaseT&#xA;Gi1/4/1      *** MEDIALX - E291 notconnect   2301         full   auto 10/100/1000BaseT&#xA;Gi1/4/3      *** FACULTYWEB - E notconnect   2301         full   auto 10/100/1000BaseT&#xA;Gi1/4/17     ***FACULTYWEB - S3 notconnect   2301         full   auto 10/100/1000BaseT&#xA;Gi2/2/13     ** EMSDVCS1  **    connected    2301       a-full a-1000 10/100/1000BaseT&#xA;Gi2/2/14     ** EMSDVCS2  **    connected    2301       a-full a-1000 10/100/1000BaseT&#xA;Gi2/2/15     ** EMSDVCS3  **    connected    2301       a-full a-1000 10/100/1000BaseT&#xA;Gi2/2/16     ** EMSIISSQL **    connected    2301       a-full a-1000 10/100/1000BaseT&#xA;Gi2/2/17     ** EMSDVCS4  **    connected    2301       a-full a-1000 10/100/1000BaseT&#xA;Gi2/2/18     ** EMSDVCS5  **    connected    2301       a-full a-1000 10/100/1000BaseT&#xA;Gi2/2/21     *** ICHAIN ***     notconnect   2301         auto   auto 10/100/1000BaseT&#xA;r-tx-server-1#show arp | inc Incomplete&#xA;Internet  10.21.1.21              0   Incomplete      ARPA&#xA;Internet  10.23.1.58              0   Incomplete      ARPA&#xA;Internet  10.20.254.200           0   Incomplete      ARPA&#xA;Internet  10.23.1.54              0   Incomplete      ARPA&#xA;Internet  10.20.254.202           0   Incomplete      ARPA&#xA;Internet  10.33.3.21              0   Incomplete      ARPA&#xA;Internet  10.34.1.20              0   Incomplete      ARPA&#xA;Internet  10.41.0.29              0   Incomplete      ARPA&#xA;Internet  198.150.241.240         0   Incomplete      ARPA&#xA;Internet  10.35.1.116             0   Incomplete      ARPA&#xA;Internet  10.39.0.115             0   Incomplete      ARPA&#xA;Internet  10.23.100.11            0   Incomplete      ARPA&#xA;Internet  10.199.0.12             0   Incomplete      ARPA&#xA;Internet  10.39.0.202             0   Incomplete      ARPA&#xA;Internet  10.199.0.53             0   Incomplete      ARPA&#xA;Internet  10.20.251.30            0   Incomplete      ARPA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is why are the IP addresses incomplete?&lt;/p&gt;&#xA;" OwnerUserId="31006" LastEditorUserId="8499" LastEditDate="2016-10-04T18:46:32.457" LastActivityDate="2017-08-31T05:11:43.233" Title="Why does it show duplicate mac addresses in same VLAN?" Tags="|vlan|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35501" PostTypeId="1" CreationDate="2016-10-04T16:08:37.137" Score="2" ViewCount="2056" Body="&lt;p&gt;I was looking at a previous question about this where a command was given to look for all ports that had not been used in 6 weeks.  I ran the command but it doesn't give the port names just the line in the output that has the last input.  I'm not a regular expression person so is there someone who can change this to show the port names as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Command:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show int | i proto.*notconnect|proto.*administratively down|Last in.* [6-9]w|Last in.* [0-9][0-9]w|[0-9]y|disabled|Last input never, output never, output hang never&#xA;&#xA;Output:&#xA;  Last input never, output 7w5d, output hang never&#xA;  Last input never, output 7w5d, output hang never&#xA;  Last input never, output 17w1d, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output 21w6d, output hang never&#xA;  Last input never, output 21w3d, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output 7w1d, output hang never&#xA;  Last input never, output 7w5d, output hang never&#xA;  Last input never, output 8w4d, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output never, output hang never&#xA;  Last input never, output never, output hang never&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31009" LastEditorUserId="8499" LastEditDate="2018-12-25T02:42:13.923" LastActivityDate="2018-12-25T02:42:13.923" Title="Command for showing unused ports over time on Cisco switches" Tags="|cisco|switch|cisco-catalyst|cisco-commands|interface|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35502" PostTypeId="1" AcceptedAnswerId="35506" CreationDate="2016-10-04T16:25:28.550" Score="1" ViewCount="526" Body="&lt;p&gt;I believe that our AP's are being affected by DFS but need a way to &quot;prove&quot; this issue before getting any kind of change enacted. Using Wireshark, is there anyway that I can watch the network traffic for signs that the AP or associated clients are being affected by DFS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm curious to know if there's some combination of Wireshark display filters that might help with this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="19446" LastActivityDate="2017-08-31T00:10:57.130" Title="Confirm DFS issues using Monitor Mode + Wireshark" Tags="|wireless|wireshark|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35505" PostTypeId="2" ParentId="35501" CreationDate="2016-10-04T16:41:39.107" Score="1" Body="&lt;p&gt;You are only going to get the specific line of the output for a filter, and that line doesn't include the interface. You would just need to run the command without the filters to include the interface, and that will include all the lines for all the interfaces, which is what you seem to want to eliminate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be able to use the &lt;code&gt;show interfaces counters&lt;/code&gt; command. This command will show the statistics per interface since the last time the counters were cleared:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch1#show interfaces counters&#xA;&#xA;Port                InOctets   InUcastPkts   InMcastPkts   InBcastPkts&#xA;Gi1/0/1           2067013697      20374822        209358          9989&#xA;Gi1/0/2                    0             0             0             0&#xA;Gi1/0/3                    0             0             0             0&#xA;Gi1/0/4           1655040672       5855659           611         77829&#xA;Gi1/0/5                    0             0             0             0&#xA;Gi1/0/6             17864697         51741         15659            48&#xA;Gi1/0/7            605795797       2338136             0          1464&#xA;Gi1/0/8             62153075        312522         80188            22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-04T16:41:39.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35506" PostTypeId="2" ParentId="35502" CreationDate="2016-10-04T16:51:57.597" Score="1" Body="&lt;p&gt;Your WLC should be able to provide this information, or you may need to hire a company to use equipment to check on this for you. You could try to look in the WAPs to see if there are any of those channels which are being skipped, but you are really going to need to know what you are doing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DFS is something that will happen in the hardware. You could only see anything in a capture if a WAP was using a DFS channel with associations, and it detected a radar signal, then it broadcasts an 802.11h channel-switch announcement. That is not something it constantly does, so the timing of the capture is important.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-04T16:51:57.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35508" PostTypeId="2" ParentId="35440" CreationDate="2016-10-04T19:20:52.420" Score="1" Body="&lt;p&gt;In large-scale or &quot;warehouse-scale&quot; data centers, &lt;a href=&quot;https://datatracker.ietf.org/doc/rfc7938/?include_text=1&quot; rel=&quot;nofollow&quot;&gt;IETF concensus&lt;/a&gt; &quot;proposes the use of an EBGP-only design&quot; with a unique ASN for every top of rack (ToR) Ethernet switch rather than using either TRILL (their own layer 2 standard) or M-LAG (VPN, VPS, VCS, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Granted a Layer 3 MPLS is not identical to Ethernet, given the millisecond triggered eBGP reconvergence for link down events, I see added value in a standardized approach.  Therefore eBGP, or BGP w Private ASN's, is the best design (because the IETF informs us so).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Experimentation and extensive testing have shown that External BGP (EBGP) [RFC4271] is well suited as a stand-alone routing protocol for these types of data center applications.  This is in contrast with more traditional DC designs, which may use simple tree topologies and rely on extending Layer 2 (L2) domains across multiple network devices.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;They go onto provide an example ASN scheme.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;5.2.1.  EBGP Configuration Guidelines and Example ASN Scheme&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The diagram below illustrates an example of an ASN allocation scheme.&#xA;    The following is a list of guidelines that can be used:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;EBGP single-hop sessions are established over direct point-to-&#xA;   point links interconnecting the network nodes, no multi-hop or&#xA;   loopback sessions are used, even in the case of multiple links&#xA;   between the same pair of nodes.&lt;/li&gt;&#xA;  &lt;li&gt;Private Use ASNs from the range 64512-65534 are used to avoid ASN&#xA;    conflicts.&lt;/li&gt;&#xA;  &lt;li&gt;A single ASN is allocated to all of the Clos topology's Tier 1&#xA;    devices.&lt;/li&gt;&#xA;  &lt;li&gt;A unique ASN is allocated to each set of Tier 2 devices in the&#xA;    same cluster.&lt;/li&gt;&#xA;  &lt;li&gt;A unique ASN is allocated to every Tier 3 device (e.g., ToR) in&#xA;    this topology.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-04T19:20:52.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35510" PostTypeId="1" AcceptedAnswerId="35706" CreationDate="2016-10-04T20:35:14.830" Score="1" ViewCount="266" Body="&lt;p&gt;I have a 1xN PLC fiber optic splitter which works like this:&#xA;The optical power of the incoming signal is P; the power in each outgoing cable is P/N.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to use the splitter as a combiner. &#xA;If the incoming power on each incoming fiber now is P, does this mean the outgoing cable will carry optical power P*N?&lt;/p&gt;&#xA;" OwnerUserId="29690" LastEditorUserId="29690" LastEditDate="2016-10-05T13:46:08.573" LastActivityDate="2016-10-11T22:02:54.613" Title="Power at the terminals of a PLC fiber optic splitter" Tags="|fiber|optics|optical|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35511" PostTypeId="1" AcceptedAnswerId="35512" CreationDate="2016-10-04T22:54:04.840" Score="1" ViewCount="61" Body="&lt;p&gt;what is the origin of the bandwidth, we get on internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;suppose we get 10 Mbps link at home and we get it from some ISP but from where ISP gets that and on and on?&lt;/p&gt;&#xA;" OwnerUserId="15475" LastActivityDate="2016-10-05T20:30:42.567" Title="i am wondering about internet bandwidth" Tags="|internet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35512" PostTypeId="2" ParentId="35511" CreationDate="2016-10-04T23:04:28.223" Score="1" Body="&lt;p&gt;You many be under the incorrect impression that there is a single Internet. The Internet is really just a collection of ISPs connecting their networks together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each link on the Internet has its own bandwidth. The link between you and your ISP has a particular bandwidth, independent of anything else. Your ISP has links to other ISPs, and those links each have their own bandwidths, independent of any other links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your ISP should strive to strike a balance between the total bandwidth it offers to its customers and the bandwidth it has with its peers. This balance will not be a 1:1 ratio; it is very likely that your ISP has much more bandwidth to its customers than it does to other ISPs. This is called an oversubscription, and it works because not all its customers are using all their bandwidth at the same time. There are formulae which may be used to calculate the proper oversubscription ratio. Really bad ISPs can be too far oversubscribed, and their customers can suffer from network congestion.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-04T23:04:28.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35513" PostTypeId="1" AcceptedAnswerId="35514" CreationDate="2016-10-05T02:57:44.967" Score="1" ViewCount="120" Body="&lt;p&gt;I am having issues with a Cisco 1921 when it comes to access lists and vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have my vlan configured and interface with IP as well as the access group assigned to the vlan interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1.600&#xA;description Systems&#xA;encapsulation dot1Q 600&#xA;ip address 10.10.6.1 255.255.255.0&#xA;ip access-group VLAN600 out&#xA;ip helper-address 192.168.160.3&#xA;ip nat inside&#xA;ip virtual-reassembly in&#xA;!&#xA;&#xA;ip access-list extended VLAN600&#xA;deny   ip 10.10.6.0 0.0.0.255 192.168.160.0 0.0.0.255&#xA;permit ip 10.10.6.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can't access the 192.168.160.x network from the 10.10.6.x network, which is good, but I can see the 10.10.6.1 gateway IP and ping it etc from the 192.168.160.x.subnet. How do I ensure that is blocked as well and not seen?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, how would I go about allowing certain machines on the vlan 1 (192.168.160.x subnet) access to a certain machine on the vlan600 (10.10.6.x subnet) by mac address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried &quot;access-list 700 permit 0000.0000.0000 FFFF.FFFF.FFFF&quot; without success, obviously with the correct MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone has some insight, that would be great. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="8029" LastActivityDate="2016-10-05T03:04:33.153" Title="Cisco Prevent Access to VLANS but Allow Some Machines by MAC" Tags="|cisco|router|vlan|network-access|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35514" PostTypeId="2" ParentId="35513" CreationDate="2016-10-05T03:04:33.153" Score="0" Body="&lt;p&gt;You problem is that you are confusing &lt;code&gt;in&lt;/code&gt; and &lt;code&gt;out&lt;/code&gt;. The direction is from the router's perspective, so your access list, outbound from the router to VLAN 600 is denying anything from VLAN 600 out to VLAN 600 in an address range not on VLAN 600.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should normally place extended access lists inbound and as close to the source as possible. If you want to prevent addresses on VLAN 600 from contacting addresses in another range, you should place the access list inbound on the VLAN 600 interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One problem you are going to face with allowing addresses in a different range to access addresses on VLAN 600 is that most things are bi-directional, so something from the other addresses could send something to VLAN 600, but it could never get a reply.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-05T03:04:33.153" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="35515" PostTypeId="1" AcceptedAnswerId="35517" CreationDate="2016-10-05T05:45:05.587" Score="1" ViewCount="9477" Body="&lt;p&gt;MSS are calculated as MSS = MTU - IP header length - TCP header length.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One example is MSS=1500-20-20=1460 in Ethernet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This calculation neglects the options in TCP and IP headers, which lead to variable header length.&lt;br&gt;&#xA; To my understanding, when TCP assembles segments, it is aware of the options in TCP header and it can truncate the data to the &quot;right&quot; size to satisfy MSS as it considers IP header for 20 bytes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, TCP has no knowledge of IP options as it is on top of IP layer, then how can it assemble segments correctly?&lt;br&gt;&#xA;For example, a TCP segment has 1460 bytes, and IP decides some options are needed, which makes its header longer than 20 bytes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In such situation, does IP need to split the TCP segment to satisfy MTU (which seems to lower the efficiency of transmission as the second packet may have only few bytes in its payload)?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any negotiation between TCP and IP in implementation to avoid such split in IP?&lt;/p&gt;&#xA;" OwnerUserId="30801" LastEditorUserId="16930" LastEditDate="2016-10-05T06:07:36.460" LastActivityDate="2016-10-05T12:47:43.783" Title="TCP segment length and TCP/IP header options" Tags="|tcp|mtu|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35517" PostTypeId="2" ParentId="35515" CreationDate="2016-10-05T06:43:54.770" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6691&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6691&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When calculating the value to put in the TCP MSS option, the MTU&lt;br /&gt;&#xA;value SHOULD be decreased by only the size of the fixed IP and TCP&lt;br /&gt;&#xA;headers and SHOULD NOT be decreased to account for any possible IP or&#xA;TCP options; conversely, &lt;strong&gt;the sender MUST reduce the TCP data length&lt;br /&gt;&#xA;to account for any IP or TCP options&lt;/strong&gt; that it is including in the&lt;br /&gt;&#xA;packets that it sends.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;(emphasis mine)&lt;/p&gt;&#xA;&lt;p&gt;So the problem is avoided.&lt;/p&gt;&#xA;&lt;p&gt;Edit : as pointed out by &lt;a href=&quot;https://networkengineering.stackexchange.com/users/29562/hertitu&quot;&gt;hertitu&lt;/a&gt; the cited RFC is not an Internet Standards Track, so let's check &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1122&lt;/a&gt; which is an Internet Standard.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The maximum size of a segment that TCP really sends, the&#xA;&amp;quot;effective send MSS,&amp;quot; MUST be the smaller of the send MSS&#xA;(which reflects the available reassembly buffer size at the&#xA;remote host) and the largest size permitted by the IP layer:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;           Eff.snd.MSS =&#xA;&#xA;              min(SendMSS+20, MMS_S) - TCPhdrsize - IPoptionsize&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;where:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;        *    SendMSS is the MSS value received from the remote host,&#xA;             or the default 536 if no MSS option is received.&#xA;&#xA;        *    MMS_S is the maximum size for a transport-layer message&#xA;             that TCP may send.&#xA;&#xA;        *    TCPhdrsize is the size of the TCP header; this is&#xA;             normally 20, but may be larger if TCP options are to be&#xA;             sent.&#xA;&#xA;        *    IPoptionsize is the size of any IP options that TCP&#xA;             will pass to the IP layer with the current message.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;As you can see the MSS &lt;strong&gt;must&lt;/strong&gt; take into account both the IP option size and the TCP options.&lt;/p&gt;&#xA;&lt;p&gt;Concerning :&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;However, TCP has no knowledge of IP options as it is on top of IP&#xA;layer, then how can it assemble segments correctly?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;TCP is responsible for passing the IP options requested by the application to the IP layer, so it can compute what will be the IP option size.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-10-05T12:47:43.783" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35518" PostTypeId="1" AcceptedAnswerId="35520" CreationDate="2016-10-05T07:28:05.797" Score="0" ViewCount="40" Body="&lt;p&gt;I am currently using &lt;code&gt;ngrep&lt;/code&gt; or &lt;code&gt;tcpdump&lt;/code&gt;in conjunction to &lt;code&gt;grep&lt;/code&gt; to display destinations and sources of all incoming and outgoing packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would you suggest a better way to achieve this?&lt;/p&gt;&#xA;" OwnerUserId="31023" LastActivityDate="2016-10-05T09:12:52.887" Title="Which terminal based tool can I use to display only the source and destination IPs of all packets" Tags="|tcpdump|" AnswerCount="1" CommentCount="1" ClosedDate="2016-10-05T13:19:34.307" ContentLicense="CC BY-SA 3.0" />
  <row Id="35519" PostTypeId="1" AcceptedAnswerId="35543" CreationDate="2016-10-05T08:58:54.853" Score="1" ViewCount="381" Body="&lt;p&gt;Improved my calculation - based on the comments. However,I don't get the correct results yet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to find out the maximum number of stub LSA routes I can pass from one device to another without fragmentation when the MTU size is 9000. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here was my calculation but looks like it isn't correct.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Every OSPF -Link State Update Packet will have Ethernet header of 14 bytes&lt;/li&gt;&#xA;&lt;li&gt;Every OSPF -Link State Update packet will have IPv4 header of 20 bytes&lt;/li&gt;&#xA;&lt;li&gt;Every OSPF OSPF -Link State Update will have OSPF packet header of 24 bytes.&lt;/li&gt;&#xA;&lt;li&gt;Number of LSA messages - 4 bytes&lt;/li&gt;&#xA;&lt;li&gt;LSA header is of 20 bytes.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, my calculation says - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;9000 = 14 + 20 + 24 + 4 + 20 ( number of LSA )&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Therefore number of LSA supported for 9000 MTU is 446 routes approx.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I don't see this in the real case. What am I missing in this relation?&#xA;Here is how the packet looks which is getting fragmented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/seyz1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/seyz1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13278" OwnerDisplayName="dexterous_stranger" LastEditorUserId="13278" LastEditDate="2016-10-05T22:05:27.257" LastActivityDate="2016-10-05T22:16:26.097" Title="What is the mathematical relation between MTU size and the number of LSA supported in OSPF?" Tags="|routing|mtu|ospf|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35520" PostTypeId="2" ParentId="35518" CreationDate="2016-10-05T09:12:52.887" Score="2" Body="&lt;p&gt;The very popular capture tool &lt;a href=&quot;https://www.wireshark.org&quot; rel=&quot;nofollow&quot;&gt;Wireshark&lt;/a&gt; includes a CLI tool named &lt;code&gt;tshark&lt;/code&gt; which can do what you want:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo tshark -T fields -e ip.addr&#xA;Capturing on eth1&#xA;10.48.169.25,10.48.37.151&#xA;10.48.37.151,10.48.169.25&#xA;10.48.37.197,10.48.37.151&#xA;10.55.131.167,10.48.37.151&#xA;10.55.131.167,10.48.37.151&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See the &lt;a href=&quot;https://www.wireshark.org/docs/man-pages/tshark.html&quot; rel=&quot;nofollow&quot;&gt;man page for tshark&lt;/a&gt; for more options, e.g. to replace the comma with something else:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo tshark -T fields -e ip.addr -E aggregator=&quot;-&quot;&#xA;Capturing on eth1&#xA;10.55.131.167-10.48.37.151&#xA;10.55.131.167-10.48.37.151&#xA;10.48.37.141-10.48.37.151&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that this displays the source and destination ip address, in that order. Since you wrote &lt;code&gt;to display destinations and sources&lt;/code&gt; I'm not sure if you want them in that order instead, I'm not sure if that is possible. If you also want source/destination &lt;em&gt;ports&lt;/em&gt; then you may need to tweak the &lt;code&gt;-e&lt;/code&gt; argument a bit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that I'm in no way &lt;em&gt;recommending&lt;/em&gt; to use tshark, for all I know it could eat your data; I'm just stating that it has the options you are looking for ;-)&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-05T09:12:52.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35522" PostTypeId="1" AcceptedAnswerId="35523" CreationDate="2016-10-05T09:20:09.497" Score="1" ViewCount="64" Body="&lt;p&gt;In weighted round robin (weighted fair queuing) scheduling, suppose I have 3 queues (weights):- A (4), B (3) and C (2). I have packets of equal lengths on the 3 queues. Now will the packet output order be &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) AABABCABC (found in online sources: &lt;a href=&quot;http://kb.linuxvirtualserver.org/wiki/Weighted_Round-Robin_Scheduling&quot; rel=&quot;nofollow&quot;&gt;http://kb.linuxvirtualserver.org/wiki/Weighted_Round-Robin_Scheduling&lt;/a&gt;)&#xA;or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) will it be ABCABCABA&#xA;or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) will it be AAAABBBCC&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it doesn't really affect the throughput per port or anything, just out of curiosity I'm asking. Found different versions in different online sources.&lt;/p&gt;&#xA;" OwnerUserId="30265" LastActivityDate="2016-10-05T09:59:02.893" Title="LSA Weighted Fair Queuing Algorithm" Tags="|switch|qos|congestion|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35523" PostTypeId="2" ParentId="35522" CreationDate="2016-10-05T09:59:02.893" Score="2" Body="&lt;p&gt;In Cisco IOS:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The order of removal from the fair queues is determined by the virtual&#xA;  time of the delivery of the last bit of each arriving packet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;src: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/qos/configuration/guide/fqos_c/qcfconmg.html#wp1001092&quot; rel=&quot;nofollow&quot;&gt;Cisco IOS Quality of Service Solutions Configuration Guide, Release 12.2&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-05T09:59:02.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35524" PostTypeId="1" AcceptedAnswerId="35525" CreationDate="2016-10-05T10:10:57.277" Score="1" ViewCount="1309" Body="&lt;p&gt;It might be a silly question, however, why are the computer systems in the X.200 model, OSI, called &lt;strong&gt;open systems&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that I've read that &lt;strong&gt;open system&lt;/strong&gt; is defined as &quot;&lt;em&gt;the representation within the reference model of those aspects of a real open system that are pertinent to OSI&lt;/em&gt;&quot; and the &lt;strong&gt;real open system&lt;/strong&gt; is defined as &quot;&lt;em&gt;A real system which complies with the requirements of OSI standards in its&#xA;communication with other real systems.&lt;/em&gt;&quot; in the X.200 specification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="31024" LastEditorUserId="31024" LastEditDate="2016-10-05T10:17:54.467" LastActivityDate="2016-10-05T14:36:22.040" Title="Why are the computer systems in the OSI model called &quot;open systems&quot;?" Tags="|osi|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35525" PostTypeId="2" ParentId="35524" CreationDate="2016-10-05T10:44:17.980" Score="2" Body="&lt;p&gt;I would assume that this is because the O in OSI stand for &quot;Open&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Networking is about communication between many different kind of devices.&lt;br&gt;&#xA;Using the word &quot;computer&quot; would be misleading, because the OSI model can be applied not only to computers, but to any kind of devices that is able to communicate over the network (routers, manageable swicths, automates, sensors, industrial machines...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So they had to choose a term to describe &lt;em&gt;any&lt;/em&gt; device using the model. The &quot;system&quot; word fit and is vague enough to cover all cases, and so to describe a system compliant to Open System Interconnection, the use &quot;Open system&quot; (which is shorter and more practical that &quot;OSI compliant system&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;only a guess tough, I don't think you'll get an authoritative answer from anyone else than the authors.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-10-05T10:44:17.980" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35527" PostTypeId="1" AcceptedAnswerId="35529" CreationDate="2016-10-05T14:21:57.773" Score="1" ViewCount="237" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IJWCN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IJWCN.png&quot; alt=&quot;OSPF With Different area Network and redistribution with rip network  &quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hi &lt;/p&gt;&#xA;&#xA;&lt;p&gt;how the routers in ospf network will discover the borders routers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;when i try to see the border routers with the show ip ospf border command &lt;/p&gt;&#xA;&#xA;&lt;p&gt;i get :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in Area 0 - R2 discover : all border routers in the network ( R3 - R5 - R8 - R12 )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in Area 1 -  R4 discover : R3 - R5 - R12&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in Area 2 -  R6 discover : R5 - R8 - R12&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in Area 3 -  R9 discover : R8 - R12&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my question is why all areas know border R12 ?&#xA;how the routers discover the border router ?&lt;/p&gt;&#xA;" OwnerUserId="31029" LastEditorUserId="8499" LastEditDate="2019-01-05T00:44:01.210" LastActivityDate="2019-02-05T13:09:14.370" Title="OSPF Border Router Discovery" Tags="|cisco|routing|ospf|rip|redistribution|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35528" PostTypeId="2" ParentId="35524" CreationDate="2016-10-05T14:36:22.040" Score="2" Body="&lt;p&gt;They are connected using open protocols as opposed to proprietary protocols (open as per open source).  Back in the day, each vendor had their own interconnect technology, such as IBM's SNA and DEC's DECNet phase IV.  OSI was designed to replace that proprietary technology with one that different systems could use.  In the event it was seen as too network-provider-centric and the pragmatism of IP ensured that IP became pre-eminent.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-10-05T14:36:22.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35529" PostTypeId="2" ParentId="35527" CreationDate="2016-10-05T14:38:21.490" Score="3" Body="&lt;p&gt;There is no specific discovery for border routers. You need to understand more about OSPF and the LSAs which it advertises.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every router in an area knows the complete topology of the area in which it resides, so every router knows by the LSAs it receives which routers in its area are border routers, and which routers are not border routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All OSPF routers generate Type 1 and/or Type 2 LSAs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ABRs generate Type 3 and 4 LSAs. In OSPF, all the ABRs are connected to Area 0, so Area 0 knows about all the ABRs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASBRs generate Type 5 LSAs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By looking at the received LSAs an OSPF router can tell which are border routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A more in-depth discussion of OSPF and the LSAs is too broad for this site. If you learn more about this, you can ask more specific questions.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-05T14:38:21.490" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35530" PostTypeId="2" ParentId="35527" CreationDate="2016-10-05T14:39:14.857" Score="2" Body="&lt;p&gt;R12 is an ASBR.  It's the only one flooding Type 5 LSAs.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-10-05T14:39:14.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35531" PostTypeId="2" ParentId="35393" CreationDate="2016-10-05T15:58:00.930" Score="2" Body="&lt;p&gt;If I understand correctly, you want to connect WiFi devices in your village to the Internet, but the closest reasonable-cost Internet access point is over 5 km away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One possible approach:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(1) Set up each WiFi access point in your village in &quot;&lt;a href=&quot;http://en.wikipedia.org/wiki/wireless_mesh_network&quot; rel=&quot;nofollow&quot;&gt;wireless mesh network&lt;/a&gt; mode&quot;, so each WiFi device talks to the closest access point, which relays packets to the next WiFi access point, and so on.&#xA;(This is the first step toward &lt;a href=&quot;http://en.wikipedia.org/wiki/Municipal_Wi-Fi)&quot; rel=&quot;nofollow&quot;&gt;Municipal Wi-Fi&lt;/a&gt; and &lt;a href=&quot;http://en.wikipedia.org/wiki/Wireless_community_network&quot; rel=&quot;nofollow&quot;&gt;Wireless community network&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2) Install some &lt;a href=&quot;http://en.wikipedia.org/wiki/backhaul_(telecommunications)&quot; rel=&quot;nofollow&quot;&gt;backhaul&lt;/a&gt; point-to-point link from your Internet access point over the 5km to some convenient convenient Point (POP) in or near your village.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my part of the world, common backhaul options for carrying broadband Internet data include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;small wire mesh dishes ones on top of roof pointed at the nearest tower of a few &quot;&lt;a href=&quot;http://en.wikipedia.org/wiki/wireless_cable&quot; rel=&quot;nofollow&quot;&gt;wireless cable&lt;/a&gt;&quot; internet service providers (&quot;&lt;a href=&quot;http://en.wikipedia.org/wiki/fixed_wireless&quot; rel=&quot;nofollow&quot;&gt;fixed wireless&lt;/a&gt;&quot;).&lt;/li&gt;&#xA;&lt;li&gt;big shrouded solid microwave radio-relay dishes on tall towers owned by the telephone company every 30 or 40 miles&lt;/li&gt;&#xA;&lt;li&gt;coax cable (&lt;a href=&quot;http://en.wikipedia.org/wiki/cable_Internet_access&quot; rel=&quot;nofollow&quot;&gt;cable Internet access&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;telephone wires (&lt;a href=&quot;http://en.wikipedia.org/wiki/digital_subscriber_line&quot; rel=&quot;nofollow&quot;&gt;digital subscriber line&lt;/a&gt;)&lt;/li&gt;&#xA;&lt;li&gt;fiber optic cables&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I hear that other backhaul options for carrying broadband Internet data a few kilometers include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/broadband_over_power_lines&quot; rel=&quot;nofollow&quot;&gt;broadband over power lines&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;free-space optical communication such as &lt;a href=&quot;http://en.wikipedia.org/wiki/RONJA&quot; rel=&quot;nofollow&quot;&gt;RONJA&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/Long-range_Wi-Fi&quot; rel=&quot;nofollow&quot;&gt;long-range Wi-Fi&lt;/a&gt; (point-to-point)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://en.wikipedia.org/wiki/WiMAX&quot; rel=&quot;nofollow&quot;&gt;WiMAX&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(3) Connect the wireless mesh to the point-to-point link, with a short &quot;Ethernet cable&quot; between your Point and the nearest WiFi access point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would any of the approaches used by &lt;a href=&quot;http://en.wikipedia.org/wiki/South_African_wireless_community_networks&quot; rel=&quot;nofollow&quot;&gt;South African wireless community networks&lt;/a&gt; or the &lt;a href=&quot;https://web.archive.org/web/20140208194853/http://www.seattlewireless.net/HardwareComparison&quot; rel=&quot;nofollow&quot;&gt;Seattle Wireless Community Wireless Network&lt;/a&gt; work for you?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With everything else held equal, the more focused (or &quot;directional&quot;) a radio antenna is, the longer the distance one can communicate with it.&#xA;So antennas designed to communicate in all directions (&quot;omnidirectional&quot;, &quot;broadcast&quot;) generally communicate over very short distances.&#xA;When people want to communicate over long distances with radio, we are forced to use very directional antennas and point-to-point communications, and we spend a lot of time aiming one antenna at the other antenna to get the best signal.&lt;/p&gt;&#xA;" OwnerUserId="15864" LastActivityDate="2016-10-05T15:58:00.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35532" PostTypeId="1" AcceptedAnswerId="35533" CreationDate="2016-10-05T16:20:22.277" Score="1" ViewCount="893" Body="&lt;p&gt;I have three HP Procruve switches and have been trying to find out which switchport my computer is connected to. I issued the following command on each switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show mac-address my_mac_address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the results of the command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 1:&#xA;Address Table: my_mac_address&#xA;Port: 28&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 2:&#xA;Address Table: my_mac_address&#xA;Port: 11&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 3:&#xA;Address Table: my_mac_address&#xA;Port: 47&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I tell which switch port is the correct one?&lt;/p&gt;&#xA;" OwnerUserId="31032" LastActivityDate="2016-10-06T12:51:23.507" Title="Computer mac address appearing on more than one switch" Tags="|mac-address|hp-procurve|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35533" PostTypeId="2" ParentId="35532" CreationDate="2016-10-05T16:28:25.987" Score="5" Body="&lt;p&gt;2 of those 3 ports are ports that connect to another switch. If you don't know which ones, I don't know HP command syntax but there is probably a command like &lt;code&gt;show mac port xx&lt;/code&gt;, if that show multiple mac addresses then it is (most likely) an inter-switch link; if it has only one then it is your PC. &#xA;There can be variations e.g.  if your pc connects to a phone and the phone to a switch then you may see 2 mac addresses, phone and pc.  &lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-05T16:28:25.987" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35534" PostTypeId="1" CreationDate="2016-10-05T17:29:34.780" Score="1" ViewCount="138" Body="&lt;p&gt;&lt;strong&gt;The Current Setup&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a number of machines spread across 13 /24 subnets. Presently we have a fairly dumb router that allows the routing of traffic between these subnets. This is not a firewall and it does not track state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Desired Setup&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We wish to replace the router with firewalls (a pair of Juniper SRX 345s in a VC). This isn't a particularly easy process as once you start tracking state, you have idle connections timing out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The applications aren't set up to deal with this and, this, migration to these new firewalls needs to be gradual. We cannot just rip out the routers and assign their IPs to the firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The Problem&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take the scenario when machine A (10.20.9.118/24) has been migrated to the new firewalls. Its gateway has been changed to point at the new firewall. Machine B (10.20.12.221/24) has not been migrated - its gateway still points at the old router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this scenario, traffic from A to B goes via the new firewall but the return traffic goes via the old router. The new firewall does not see any return traffic and thus drops the state, assuming it is invalid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Proposed Solutions&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add a static route for machine A, on machine B, via the new firewall. This works fine, except it's a nightmare to maintain as this would need to be done on every machine that communicates with those machines which have been migrated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add a static route for machine A on the old router, via the new firewall. This poses a problem because the route will (usually) send the return traffic into the firewall on a different interface than it came out of. As I understand it, Juniper SRX devices track firewall states in zones (which are a set of interfaces) and return traffic will not match a state (and thus will not pass) unless it comes into the same zone. We have 1 zone per subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Presumably people have implemented firewalls into existing networks before. What's the solution here?&lt;/p&gt;&#xA;" OwnerUserId="30148" LastActivityDate="2016-12-05T09:44:44.523" Title="Phased implementation of a new firewall" Tags="|routing|firewall|juniper|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="35536" PostTypeId="2" ParentId="34611" CreationDate="2016-10-05T17:52:42.927" Score="0" Body="&lt;p&gt;You should not need the subnet mask if you are storing endpoint IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Networks are said to be super netted when grouped together.  So you would not x out the left (network) side of the address, you would x out the right side, i.e., 10.12.x.x/24.  Each x represents 8 bits of address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv4 endpoints are configured with a subnet mask that specifies how many of its 32 address bits represents network addressing vs host numbering.  Each network has a network address (all 0's) and a broadcast address (all 1's).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network address is synonymous to the subnet, e.g., the 10.1 network (10.1.0.0/16).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-10-05T17:57:52.327" LastActivityDate="2016-10-05T17:57:52.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35537" PostTypeId="2" ParentId="32041" CreationDate="2016-10-05T18:01:17.860" Score="1" Body="&lt;p&gt;According to my expert analysis, it appears that the default gateway address is miconfigured on the DHCP server.  That's why the phones cannot register.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-05T18:01:17.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35538" PostTypeId="1" AcceptedAnswerId="35541" CreationDate="2016-10-05T18:01:44.430" Score="1" ViewCount="69" Body="&lt;p&gt;I have a 7206VXR that I need to have 2 ports gigE for WAN (2 ISPs) and to upgrade from the 4 100M ports to 3 gig ports for LAN. I have an NPE-G1 installed currently. Is it possible to &lt;em&gt;add&lt;/em&gt; an NPE-G2 port and to be able to route between ports on both cards concurrently? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="31037" LastEditorUserId="8499" LastEditDate="2018-12-25T02:46:00.030" LastActivityDate="2018-12-25T02:46:00.030" Title="C7206VXR Can I run an NPE-G1 and NPE-G2 card concurrently to get more GigE ports?" Tags="|cisco|routing|router|cisco-7200|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35539" PostTypeId="1" AcceptedAnswerId="35544" CreationDate="2016-10-05T18:03:15.463" Score="2" ViewCount="1029" Body="&lt;p&gt;I am still a beginner to subnetting, so please forgive the basic nature of the doubt. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a network is subdivided into a subnet, won't the network broadcast address be the same as the last subnet's broadcast address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, in the subnet 192.168.10.240/28, the broadcast address is 192.168.10.255. This is the same as the broadcast address of the whole network with network ID 192.168.10.0. Please help me understand this.&lt;/p&gt;&#xA;" OwnerUserId="30265" LastActivityDate="2016-10-06T22:59:33.730" Title="Network Broadcast Address overlap with Subnet Broadcast Address" Tags="|subnet|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35541" PostTypeId="2" ParentId="35538" CreationDate="2016-10-05T19:49:48.720" Score="0" Body="&lt;p&gt;No. The Cisco 7206VXR only has a single NPE (Network Processing Engine) slot. You can choose to have one or the other.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-05T19:49:48.720" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35542" PostTypeId="2" ParentId="35511" CreationDate="2016-10-05T20:17:33.430" Score="0" Body="&lt;p&gt;There are two main types of connection between ISPs (and few in between variants).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A peering link is a link between two ISPs to allow the (direct and indirect)  customers of one ISP to communicate with the (direct and indirect) customers of the other ISP. Depending on the relative market power of the ISPs there may or may not be payment involved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A transit link is a link where one (usually larger) ISP provides another (usually smaller) ISP with connectivity to the internet in general.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good ISP will try to keep their internal links and their peering and transit links to other providers uncongested most of the time. A bad ISP may not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the top of the pile are transit free ISPs. These ISPs buy no transit and rely entirely on peering. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-10-05T20:30:42.567" LastActivityDate="2016-10-05T20:30:42.567" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35543" PostTypeId="2" ParentId="35519" CreationDate="2016-10-05T21:54:35.237" Score="1" Body="&lt;p&gt;The ethernet frame isn't counted in the MTU. It appears your MTU is 8100 octets, based on what is in your question. Your Router LSAs, as depicted in your question, are actually a minimum of 36 octets, but they are variably-sized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Link State Update packet header is actually 28 octets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0                   1                   2                   3&#xA;    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |   Version #   |       4       |         Packet length         |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                          Router ID                            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                           Area ID                             |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |           Checksum            |             AuType            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                       Authentication                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                       Authentication                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                            # LSAs                             |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                                                               |&#xA;   +-                                                            +-+&#xA;   |                             LSAs                              |&#xA;   +-                                                            +-+&#xA;   |                              ...                              |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;LSAs are different sizes, depending on the LSA type:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router LSAs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0                   1                   2                   3&#xA;    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |            LS age             |     Options   |       1       |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                        Link State ID                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                     Advertising Router                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                     LS sequence number                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |         LS checksum           |             length            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |    0    |V|E|B|        0      |            # links            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                          Link ID                              |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                         Link Data                             |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |     Type      |     # TOS     |            metric             |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                              ...                              |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |      TOS      |        0      |          TOS  metric          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                          Link ID                              |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                         Link Data                             |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                              ...                              |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Network LSAs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0                   1                   2                   3&#xA;    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |            LS age             |      Options  |      2        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                        Link State ID                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                     Advertising Router                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                     LS sequence number                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |         LS checksum           |             length            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                         Network Mask                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                        Attached Router                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                              ...                              |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Summary LSAs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0                   1                   2                   3&#xA;    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |            LS age             |     Options   |    3 or 4     |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                        Link State ID                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                     Advertising Router                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                     LS sequence number                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |         LS checksum           |             length            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                         Network Mask                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |      0        |                  metric                       |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |     TOS       |                TOS  metric                    |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                              ...                              |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;AS external LSAs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    0                   1                   2                   3&#xA;    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |            LS age             |     Options   |      5        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                        Link State ID                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                     Advertising Router                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                     LS sequence number                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |         LS checksum           |             length            |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                         Network Mask                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |E|     0       |                  metric                       |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                      Forwarding address                       |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                      External Route Tag                       |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |E|    TOS      |                TOS  metric                    |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                      Forwarding address                       |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                      External Route Tag                       |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                              ...                              |&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All this is detailed in Appendix A of &lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow&quot;&gt;RFC 2328, OSPF Version 2&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-05T22:16:26.097" LastActivityDate="2016-10-05T22:16:26.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35544" PostTypeId="2" ParentId="35539" CreationDate="2016-10-05T23:10:57.690" Score="6" Body="&lt;p&gt;When you divide a network into smaller subnets, you no longer have the original network. Cut a piece of cake in half and you have two pieces of cake. The whole cake no longer exists. So it makes no sense to talk about the original network broadcast address. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-10-05T23:10:57.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35546" PostTypeId="2" ParentId="35532" CreationDate="2016-10-06T04:39:59.163" Score="0" Body="&lt;p&gt;If you now the mac addresses of your switches you can issue the command &lt;code&gt;show mac switchmacaddress&lt;/code&gt; to determine which port that switch is on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A response with the same port you received with  &lt;code&gt;show mac-address my_mac_address&lt;/code&gt; indicates that you can rule that port out as a switch connecting port rather than your port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After ruling out the switch connections the one remaining for &lt;code&gt;show mac-address my_mac_address&lt;/code&gt; is your port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you only know the IP addresses of the switches you could disconnect and reconnect the cable from your system and check the logs with &lt;code&gt;log switchipaddress&lt;/code&gt; and look for port &lt;em&gt;yourport&lt;/em&gt; is now offline followed by port &lt;em&gt;yourport&lt;/em&gt; is now online. Assuming that no one else is running around disconnecting and reconnecting patch cables this should identify your port as being on that switch as none of the switch connecting cables should have gone offline.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sources:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.jorink.nl/2013/09/hp-procurve-cli-commands-cheatsheet/&quot; rel=&quot;nofollow&quot;&gt;http://www.jorink.nl/2013/09/hp-procurve-cli-commands-cheatsheet/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://whp-hou9.cold.extweb.hp.com/pub/networking/software/3500-5400-6200-ELRG-0207-K_12_XX-Book.pdf&quot; rel=&quot;nofollow&quot;&gt;http://whp-hou9.cold.extweb.hp.com/pub/networking/software/3500-5400-6200-ELRG-0207-K_12_XX-Book.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22462" LastEditorUserId="22462" LastEditDate="2016-10-06T12:51:23.507" LastActivityDate="2016-10-06T12:51:23.507" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35547" PostTypeId="1" CreationDate="2016-10-06T04:43:19.210" Score="1" ViewCount="261" Body="&lt;p&gt;Newbie question ... I know that Amazon VLANs (aka: VPCs) are non-transitive.  However, I was hoping someone could explain why a packet from a peered VLAN cannot access an internet gateway in another.   Also, apparently using a v-router to &quot;hop&quot; traffic from one VLAN to the other somehow makes the packets transitive.  Why?   Any light you could shed on this would be much appreciated.  Thanks a bunch for your time and help.  -- Lisa&lt;/p&gt;&#xA;" OwnerUserId="31043" LastEditorUserId="509" LastEditDate="2017-08-03T05:00:33.333" LastActivityDate="2018-07-29T14:00:39.137" Title="Why are Amazon virtual private clouds non-transitive?" Tags="|routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35548" PostTypeId="1" AcceptedAnswerId="35553" CreationDate="2016-10-06T06:44:01.223" Score="1" ViewCount="113" Body="&lt;p&gt;I've a DHCP server configured on Cisco 1602. Everything is working fine but after a client leaves the network it's IP address is still visible in &quot;sho ip dhcp binding&quot;.&#xA;Is there a way for DHCP server to remove the unused IPs from the database? For example a ping test once in a while or something like this. Or the only way is to decrease the lease time?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sho run | se dhcp&#xA;ip dhcp excluded-address 10.0.0.1 10.0.0.154&#xA;ip dhcp excluded-address 10.0.0.158 10.0.0.254&#xA;ip dhcp pool 1&#xA;   network 10.0.0.0 255.255.255.0&#xA;   default-router 10.0.0.1&#xA;   dns-server 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16778" LastActivityDate="2016-10-06T08:40:07.700" Title="Cisco DHCP server - maintain bindings" Tags="|dhcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35549" PostTypeId="2" ParentId="35548" CreationDate="2016-10-06T06:59:44.170" Score="1" Body="&lt;p&gt;Add the &quot;lease 1&quot; command to your dhcp pool. This will delete the IP address after 1 day if it's not used and no clients has send a renewal.&lt;/p&gt;&#xA;" OwnerUserId="21768" LastActivityDate="2016-10-06T06:59:44.170" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35551" PostTypeId="2" ParentId="35534" CreationDate="2016-10-06T08:05:04.747" Score="2" Body="&lt;p&gt;As mentioned in the comments, I think there should be no problem if you create a single zone on your FW for the &quot;old network&quot;, i.e. like this (for simplicity I've only shown 2 subnets/vlans):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/56vGV.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/56vGV.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then when you migrate one subnet to the firewall it becomes like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/J7Wdf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/J7Wdf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see any asymmetric routing here (traffic enters and leaves the correct FW interfaces); is there any other problem here?&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-06T08:05:04.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35552" PostTypeId="1" AcceptedAnswerId="35554" CreationDate="2016-10-06T08:38:14.263" Score="1" ViewCount="8675" Body="&lt;p&gt;What is the use case of the &lt;code&gt;Switch(config-if)# switchport port-security mac-address sticky 0000.1111.1111&lt;/code&gt; command?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By definition, a &lt;em&gt;sticky&lt;/em&gt; address is a learned &lt;em&gt;secure&lt;/em&gt; address that is added to the running configuration. By definition, a &lt;em&gt;configured&lt;/em&gt; address is a &lt;em&gt;secure&lt;/em&gt; address that is statically configured via &lt;code&gt;Switch(config-if)# switchport port-security mac-address 0000.2222.2222&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By manually adding a sticky address, I've added a configured address. The command seems to me redundant and contradictory to the concept of a sticky MAC address.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Even the &lt;code&gt;debug port-security&lt;/code&gt; entries in the system log call a sticky a configured address. After having issued &lt;code&gt;Switch# clear port-security sticky address 0000.1111.1111&lt;/code&gt;, there are entries such as &lt;code&gt;PSECURE: Deleting secure MAC address 0000.1111.1111 on port&lt;/code&gt; and &lt;code&gt;PSECURE: Address is sticky on port&lt;/code&gt; and &lt;code&gt;PSECURE: Delete configured address: 0000.1111.1111 from subblock&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastEditorUserId="3163" LastEditDate="2016-10-06T08:52:55.990" LastActivityDate="2016-10-06T09:09:35.903" Title="Configuring a sticky MAC address on IOS" Tags="|cisco-ios|port-security|command|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35553" PostTypeId="2" ParentId="35548" CreationDate="2016-10-06T08:40:07.700" Score="2" Body="&lt;p&gt;Theoretically, &lt;em&gt;if&lt;/em&gt; the IOS version on your device supports EEM, you could write an EEM script that pings the IP addresses and releases them if there is no response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However this would be much more complex, and I think it might cause duplicate IP scenarios in some corner cases where the router reclaims an address and the device still thinks its lease is valid.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, yes I think it is (theoretically) possible but I don't see why this would be better than setting a very short lease time, so unless I'm missing the point it's not worth the trouble.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-06T08:40:07.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35554" PostTypeId="2" ParentId="35552" CreationDate="2016-10-06T08:57:12.743" Score="1" Body="&lt;p&gt;While you &lt;em&gt;can&lt;/em&gt; manually configure a sticky address, it is not usually used that way (and in fact Cisco recommends against it):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You can configure MAC addresses to be sticky. These can be dynamically&#xA;  learned or manually configured, stored in the address table, and added&#xA;  to the running configuration. If these addresses are saved in the&#xA;  configuration file, the interface does not need to dynamically relearn&#xA;  them when the switch restarts. &lt;strong&gt;Although sticky secure addresses can be&#xA;  manually configured, it is not recommended&lt;/strong&gt;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can configure an interface to convert the dynamic MAC addresses to&#xA;  sticky secure MAC addresses and to add them to the running&#xA;  configuration by enabling sticky learning. To enable sticky learning,&#xA;  enter the switchport port-security mac-address sticky command. When&#xA;  you enter this command, the interface converts all the dynamic secure&#xA;  MAC addresses, including those that were dynamically learned before&#xA;  sticky learning was enabled, to sticky secure MAC addresses. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;(source: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/20ewa/configuration/guide/conf/port_sec.html&quot; rel=&quot;nofollow&quot;&gt;Catalyst 4500 Series Switch Cisco IOS Software Configuration Guide, 12.2(20)EWA&lt;/a&gt; - emphasis is mine)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In other words, when you want to manually configure a MAC address on a port, you use &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport port-security mac-address nnnn.nnnn.nnnn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but when you want the switch to automatically learn the first MAC seen on a port and remember that (even if there is no traffic seen from that MAC for a long time), then you use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport port-security mac-address sticky&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and after the swich learns a MAC address, you will see that it has automatically added:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport port-security mac-address sticky nnnn.nnnn.nnnn&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-10-06T09:09:35.903" LastActivityDate="2016-10-06T09:09:35.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35555" PostTypeId="1" CreationDate="2016-10-06T09:14:14.833" Score="0" ViewCount="1392" Body="&lt;p&gt;Is there a way to change the MAC address of VLAN interfaces (switched virtual interfaces) on IOS? I would like to configure the MAC address of a Catalyst switch. Because all VLAN interfaces derive their MAC addresses from the base MAC (&lt;code&gt;show version | include Base&lt;/code&gt;) and the &lt;code&gt;Switch(config-if)# mac-address&lt;/code&gt; command is missing in the context of a VLAN interface, I cannot get the desired configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm open to any workaround, no matter how obscure.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2016-10-06T10:07:52.510" Title="Spoof MAC address of VLAN interface on IOS" Tags="|cisco-ios|mac-address|cisco-catalyst|virtual|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35556" PostTypeId="2" ParentId="35555" CreationDate="2016-10-06T10:07:52.510" Score="3" Body="&lt;p&gt;A quick google search turns up the doc &quot;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6000-series-switches/41263-catmac-41263.html&quot; rel=&quot;nofollow&quot;&gt;Supported Platforms for Unique MAC Address Configuration on VLAN or L3 Interfaces for Catalyst Switches&lt;/a&gt;&quot; which learns us that both the default behaviour as well as the potential to change the MAC address, are very different depending on the switch model (and in some cases, depending on the IOS version).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, look up your model there but I think it is safe to assume that if &lt;code&gt;Switch(config-if)# mac-address&lt;/code&gt; does not work, changing the MAC address is not supported on that platform.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Potential workaround&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;If &quot;standby mac-address&quot; is supported on your platform, you can configure HSRP with a virtual IP address linked to a virtual MAC.&#xA;In other words if you currently have&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 2&#xA;  ip address 10.0.0.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you can change this to e.g. :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 2&#xA;  ip address 10.0.0.254 255.255.255.0&#xA;  standby 1 mac-address 1234.dead.beef&#xA;  standby 1 ip 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where 10.0.0.254 is a previously unused address. Since I'm not sure of the reason for your request, it may or may not be important to note that an ARP request for 10.0.0.254 will still reveal the switch's BIA (burnt-in address) so if you're doing this e.g. to avoid fingerprinting, it may not be optimal.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-06T10:07:52.510" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35558" PostTypeId="2" ParentId="35547" CreationDate="2016-10-06T12:49:26.620" Score="1" Body="&lt;p&gt;This sounds like normal VLAN behavior, although AMAZON private clouds are off-topic here. Traffic on a VLAN (layer-2 domain) cannot get to another VLAN unless it goes through a layer-3 device, e.g. router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't confuse the network layers. Layer-2 addresses, e.g. MAC addresses, are used in layer-2 frames to get traffic from one device to another device on the same LAN (or VLAN). Layer-3 addresses, e.g. IP addresses, are used to route layer-3 packets between LANs. Bridges, including switches, switch frames on a LAN. Routers route packets between LANs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-06T17:24:02.527" LastActivityDate="2016-10-06T17:24:02.527" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35562" PostTypeId="2" ParentId="35445" CreationDate="2016-10-06T13:48:28.400" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/f9Nms.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f9Nms.jpg&quot; alt=&quot;diagram of bidirectional network architecture combining the visible light communication access network and the time-wavelength-division-multiplexed passive optical network.&quot;&gt;&lt;/a&gt;&#xA;&quot;Proposed bidirectional network architecture combining the [visible light communication] VLC access network and the [time-wavelength-division-multiplexed passive optical network] TWDM-PON. Central office (CO); gateway (GW); mobile unit (MU); modulator (MOD), photodiode (PD).&quot;&#xA;( &lt;a href=&quot;https://i.stack.imgur.com/LASde.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;bigger image&lt;/a&gt; )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(From the abstract of the paper by Chi-Wai Chow et. al. &quot;Network Architecture of Bidirectional Visible Light Communication and Passive Optical Network&quot; at &lt;a href=&quot;http://dx.doi.org/10.1109/JPHOT.2016.2566340&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://dx.doi.org/10.1109/JPHOT.2016.2566340&lt;/a&gt; ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this diagram, packets of data flow in two directions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Some packets of data are generated by a mobile unit and flow through the system and end up as &quot;binary data&quot; in the lower-left corner of the CO box.&lt;/li&gt;&#xA;&lt;li&gt;Some packets of data (possibly generated by a web server) enters this system as &quot;binary data&quot; in the upper-left corner of the CO box; those packets flow through the system and eventually end up at a mobile unit.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As usual, the arrows indicate the direction of information flow.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Each solid black lines indicates where data flows in the form of pulses of electrical energy -- probably along a twisted pair of copper wires.&lt;/li&gt;&#xA;&lt;li&gt;Each solid thin blue line indicates a single optical fiber where data flows in the form of pulses of light -- probably invisible infrared light.&lt;/li&gt;&#xA;&lt;li&gt;The thick blue arrows and thick purple arrows indicate data flows in the form of visible light through open air (&quot;&lt;a href=&quot;http://en.wikipedia.org/wiki/free-space_optical_communication&quot; rel=&quot;nofollow noreferrer&quot;&gt;free space optical communication&lt;/a&gt;&quot;).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;left diagram&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The diagram on the left half shows a standard &lt;a href=&quot;http://en.wikipedia.org/wiki/wavelength-division_multiplexing&quot; rel=&quot;nofollow noreferrer&quot;&gt;wavelength-division multiplexing&lt;/a&gt; communication system that bidirectionally sends data between a central office (CO) to several gateways (GW) over many kilometers of single-mode fiber (SMF).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;details:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets of data (in the form of electrical impulses) flow in one direction along the copper wire going into each &lt;a href=&quot;http://en.wikipedia.org/wiki/electro-absorption_modulator&quot; rel=&quot;nofollow noreferrer&quot;&gt;Electro-absorption modulator&lt;/a&gt; or &lt;a href=&quot;http://en.wikipedia.org/wiki/electro-optic_modulator&quot; rel=&quot;nofollow noreferrer&quot;&gt;electro-optic modulators&lt;/a&gt;, each one modulating the light of a different-colored laser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logically the same data (in the form of pulses of light) flows in one direction from the modulator to the multiplexer, and from the multiplexer to the &lt;a href=&quot;http://en.wikipedia.org/wiki/optical_circulator&quot; rel=&quot;nofollow noreferrer&quot;&gt;optical circulator&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The optical circulator at the central office guides those locally-generated photons out to the kilometers of fiber to the gateways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Meanwhile the same optical circulator at the central office guides incoming packets of data from the gateways to the photodiode (PD).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets of data flow in both directions through the same single-mode fiber, which is 20 kilometers to 40 kilometers long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The photodiode at the central office converts data from the remote gateways (still in the form of pulses of light) to an electrical signal for further decoding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(The two yellow boxes containing white text on gray background give more details showing that the central office encodes the data digitally using &lt;a href=&quot;http://en.wikipedia.org/wiki/orthogonal_frequency-division_multiplexing&quot; rel=&quot;nofollow noreferrer&quot;&gt;orthogonal frequency-division multiplexing (OFDM)&lt;/a&gt; before sending it to a modulator, and the data received from the remote gateways is also decoded using OFDM).&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;right diagram&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;The diagram on the right half gives more details about a typical one of the gateways from the left half of the diagram, and also how that one gateway communicates bidirectionally with multiple mobile units.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;details:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm mystified by the TOF box.&#xA;From the context I'm guessing it's a frequency-selective optical bandpass filter tuned to the color of one particular laser at the central office, so this particular gateway can ignore the messages from all the other lasers at the central office and all the other lasers at other gateways, messages that (simultaneously) go though the same optical fiber.&#xA;What does TOF mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets of data (in the form of pulses of laser light) from the central office come into the optical circulator of the gateway,&#xA;which guides them into the photodiode (PD).&#xA;The packet of data from the photodiode (now in the form of pulses of electrical energy) are decoded, then re-encoded into some visible light communication (VLC) protocol.&#xA;The packet of data is sent to a (ceiling light?) LED that shines down on a bunch of mobile units (illustrated by the blue arrows).&#xA;Each mobile unit has its own photodiode that receives packets of data from the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets of data generated by a mobile unit (MU) are sent to the the LED on the mobile unit, which converts them to pulses of visible light, represented by the purple arrows.&#xA;That light shines up on the photodiode (PD) of the gateway.&#xA;The gateway decodes that visible light into electrical pulses, then uses&#xA;a single electro-optic modulator to convert the packet of data from the mobile unit into the form of pulses of light from the continuous-wave laser (CW).&#xA;Data only travels one direction along the fiber from the gateway's modulator to the gateway's optical-circulator.&#xA;The optical circulator at the gateway routes the data from the mobile units out the optical fiber towards the central office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two main (only?) ways to send data are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Alternate between turning the power on and off to the LED, laser, or other oscillator. (&quot;direct modulation&quot;)&lt;/li&gt;&#xA;&lt;li&gt;Leave the LED, laser, or other oscillator running continuously (&quot;continuous wave&quot;), and alternate between blocking that signal from the outside world and letting (some of) that signal out. (&quot;external modulation&quot;)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;With currently available technology,&#xA;the lowest-cost way to transmit &quot;low-speed&quot; data through free space or through fiber optics is direct modulation -- simply turn the electrical power going into the LED or laser on and off.&#xA;(I hear that &lt;a href=&quot;http://scanlime.org/2011/04/spdif-digital-audio-on-a-microcontroller/&quot; rel=&quot;nofollow noreferrer&quot;&gt;transmitting 3 Mbit/s by turning on and off a red LED&lt;/a&gt;, as with &lt;a href=&quot;http://en.wikipedia.org/wiki/TOSLINK&quot; rel=&quot;nofollow noreferrer&quot;&gt;TOSLINK&lt;/a&gt;, is relatively easy).&#xA;Laser diodes can be turned on and off a little faster than LEDs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With currently available technology,&#xA;the lowest-cost (?) way to transmit &quot;high-speed&quot; data through fiber optics at more than a gigabit/s -- faster than a LED or a laser can be turned on and off -- is to generate a constant beam of photons with a CW laser, then modulate how much of that beam gets through using some kind of &lt;a href=&quot;http://en.wikipedia.org/wiki/optical_modulator&quot; rel=&quot;nofollow noreferrer&quot;&gt;optical modulator&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15864" LastEditorUserId="15864" LastEditDate="2016-10-08T03:33:37.617" LastActivityDate="2016-10-08T03:33:37.617" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35567" PostTypeId="2" ParentId="34641" CreationDate="2016-10-06T16:43:50.157" Score="2" Body="&lt;p&gt;I agree with @Ron-Trunk. Out of Band management is essentially an insurance policy for when things go terribly wrong so ultimately, I see this as a math question. First you have to determine the &quot;cost&quot; of having the datacenter down due to a network disruption. Then you need to calculate the cost of having/getting staff onsite vs. paying for OOB access. I spent 14 years as an onsite tech in a data center before my company decided OOB access and another tech that was 2 hours away was cheaper than me. &lt;/p&gt;&#xA;" OwnerUserId="31059" LastActivityDate="2016-10-06T16:43:50.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35569" PostTypeId="1" AcceptedAnswerId="35575" CreationDate="2016-10-06T17:12:48.007" Score="2" ViewCount="2939" Body="&lt;p&gt;When are overlapping fragments created and why? Is there any legitimate scenario in which they are used or are they just used by attackers, like in the teardrop attack? And how is receiver suppose to reassemble such fragments (since there is more than one way to do that)?&lt;/p&gt;&#xA;" OwnerUserId="31062" LastEditorUserId="31062" LastEditDate="2016-10-06T17:21:26.500" LastActivityDate="2018-09-16T07:56:08.783" Title="IPv4 fragmentation - overlapping fragments" Tags="|ipv4|fragmentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35573" PostTypeId="1" AcceptedAnswerId="37453" CreationDate="2016-10-06T20:10:43.827" Score="2" ViewCount="1204" Body="&lt;p&gt;I have a switch that is not receiving BPDU Hellos properly and I have not been able to pin point the problem. Switch 1 puts all ports for vlan4 into desg mode and claims it is the root for vlan4 (the root is upstream), while switch 2 knows the root is upstream on port Gi0/24, so it places that port as root and Gi017 as desg. Running debug spanning-tree events shows that each side sends BPDU's to the other but they do not arrive. So i have no idea why switch 1 will not realize it is not root for vlan4. The only way I can get this switch to not think it is root is to put the interface on both ends of the trunk as access and set the access vlan to 4. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch1 Interface 0/24 is configured as follows:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/24&#xA; switchport trunk allowed vlan 1,4&#xA; switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Swtich2 Interface G0/17 is configured as follows:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/17  &#xA; switchport trunk allowed vlan 1,4&#xA; switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Show Spanning-tree results&lt;/strong&gt;&#xA;&lt;strong&gt;Switch1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN0001&#xA;  Spanning tree enabled protocol rstp&#xA;  Root ID    Priority    16385&#xA;             Address     4055.39cc.6780&#xA;             Cost        12&#xA;             Port        24 (GigabitEthernet0/24)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)&#xA;             Address     0021.1b59.ae80&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  300 sec&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;Gi0/24              Root FWD 4         128.24   P2p Peer(STP)&#xA;&#xA;VLAN0004&#xA;  Spanning tree enabled protocol rstp&#xA;  Root ID    Priority    61444&#xA;             Address     0021.1b59.ae80&#xA;             This bridge is the root&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    61444  (priority 61440 sys-id-ext 4)&#xA;             Address     0021.1b59.ae80&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  300 sec&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;Gi0/18              Desg FWD 4         128.18   P2p&#xA;Gi0/24              Desg FWD 4         128.24   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN0001&#xA;  Spanning tree enabled protocol rstp&#xA;  Root ID    Priority    16385&#xA;             Address     4055.39cc.6780&#xA;             Cost        4&#xA;             Port        24 (GigabitEthernet0/24)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32769  (priority 32768 sys-id-ext 1)&#xA;             Address     0021.1b59.cb00&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;Gi0/10           Desg FWD 4         128.10   Edge P2p &#xA;Gi0/11           Desg FWD 4         128.11   Edge P2p &#xA;Gi0/12           Desg FWD 4         128.12   Edge P2p &#xA;Gi0/13           Desg FWD 4         128.13   Edge P2p&#xA;Gi0/14           Desg FWD 19        128.14   Edge P2p &#xA;Gi0/15           Desg FWD 19        128.15   Edge P2p &#xA;Gi0/16           Desg FWD 19        128.16   Edge P2p&#xA;Gi0/17           Desg FWD 4         128.17   P2p Peer(STP)&#xA;Gi0/18           Desg FWD 4         128.18   Edge P2p &#xA;Gi0/19           Desg FWD 19        128.19   Edge P2p &#xA;Gi0/20           Desg FWD 19        128.20   Edge P2p &#xA;Gi0/24           Root FWD 4         128.24   P2p &#xA;&#xA;&#xA;VLAN0004&#xA;  Spanning tree enabled protocol rstp&#xA;&#xA;  Root ID    Priority    16388&#xA;             Address     4055.39cc.6780&#xA;             Cost        4&#xA;             Port        24 (GigabitEthernet0/24)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32772  (priority 32768 sys-id-ext 4)&#xA;             Address     0021.1b59.cb00&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time 300&#xA;&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;Gi0/17           Desg FWD 4         128.17   P2p &#xA;Gi0/24           Root FWD 4         128.24   P2p &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Other Information about the trunk...&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Show Interface Trunk&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Port        Mode             Encapsulation  Status        Native vlan&#xA;Gi0/24      on               802.1q         trunking      1&#xA;&#xA;Port        Vlans allowed on trunk&#xA;Gi0/24      1,4&#xA;Port        Vlans allowed and active in management domain&#xA;Gi0/24      1,4&#xA;Port        Vlans in spanning tree forwarding state and not pruned&#xA;Gi0/24      1,4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Port        Mode         Encapsulation  Status        Native vlan&#xA;Gi0/17      on           802.1q         trunking      1&#xA;Gi0/24      on           802.1q         trunking      1&#xA;Port        Vlans allowed on trunk&#xA;Gi0/17      1,4&#xA;Gi0/24      1-4094&#xA;Port        Vlans allowed and active in management domain&#xA;Gi0/17      1,4&#xA;Gi0/24      1-4,10,100-101,600&#xA;Port        Vlans in spanning tree forwarding state and not pruned&#xA;Gi0/17      1,4&#xA;Gi0/24      1-4,100-101&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Show CDP NE&#xA;Switch1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch1#sh cdp ne&#xA;&#xA;Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge&#xA;                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone,&#xA;                  D - Remote, C - CVTA, M - Two-port Mac Relay&#xA;&#xA;Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID&#xA;Switch2          Gig 0/24          140              S I   WS-C2960G Gig 0/17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch2#sh cdp ne&#xA;&#xA;Capability Codes: R - Router, T - Trans Bridge, B - Source Route Bridge&#xA;                  S - Switch, H - Host, I - IGMP, r - Repeater, P - Phone&#xA;&#xA;Device ID        Local Intrfce     Holdtme    Capability  Platform  Port ID&#xA;Switch.domain.lcl&#xA;                 Gig 0/17          159           S I      WS-C2960G Gig 0/24&#xA;root-3750        Gig 0/24          164          R S I     WS-C3750X Gig 2/0/20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch1 Configuration file&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   Current configuration : 2834 bytes&#xA;!&#xA;! Last configuration change at 15:14:14 EST Thu Oct 6 2016&#xA;! NVRAM config last updated at 10:45:43 EST Thu Oct 6 2016&#xA;!&#xA;&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;clock timezone EST -5&#xA;system mtu routing 1500&#xA;udld enable&#xA;&#xA;!&#xA;!&#xA;ip domain-lookup source-interface GigabitEthernet0/24&#xA;ip domain-name .......&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree logging&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;&#xA;!&#xA;ip tftp source-interface Vlan1&#xA;!&#xA;!&#xA;interface GigabitEthernet0/1&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/2&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/3&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/4&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/5&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/6&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/7&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/8&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/9&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/10&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/11&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/12&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/13&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/14&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/15&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/16&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/17&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/18&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/19&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/20&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/21&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/22&#xA; switchport access vlan 4&#xA;!&#xA;interface GigabitEthernet0/23&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/24&#xA;description Trunk to switch2 &#xA;switchport trunk allowed vlan 1,4&#xA; switchport mode trunk&#xA;!&#xA;interface Vlan1&#xA; ip address dhcp&#xA;!&#xA;interface Vlan4&#xA; ip address xxx.xxx.xxx.x xxx.xxx.xxx.x&#xA;!&#xA;ip default-gateway xxx.xxx.x.x&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;line con 0&#xA; exec-timeout 40 0&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;monitor session 61 source vlan 4&#xA;&#xA;ntp clock-period ..........&#xA;ntp server ........&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch2 Configuration file&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Current configuration : 5278 bytes&#xA;!&#xA;! Last configuration change at 16:12:50 EDT Thu Oct 6 2016 by &#xA;! NVRAM config last updated at 15:37:44 EDT Thu Oct 6 2016 by &#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime&#xA;service timestamps log datetime&#xA;service password-encryption&#xA;!&#xA;hostname Switch2&#xA;!&#xA;enable secret ..&#xA;!&#xA;username ..&#xA;username ..&#xA;aaa new-model&#xA;aaa authentication login .. group radius local&#xA;aaa authentication login .. group radius local&#xA;aaa authentication enable default group radius enable&#xA;aaa authorization console&#xA;aaa authorization exec ... group radius local &#xA;aaa authorization exec ... group radius local &#xA;!&#xA;aaa session-id common&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring&#xA;system mtu routing 1500&#xA;udld enable&#xA;ip subnet-zero&#xA;!&#xA;no ip domain-lookup&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;!&#xA;spanning-tree mode rapid-pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;interface GigabitEthernet0/1&#xA; switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/2    &#xA; switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/3&#xA;switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/4&#xA;switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/5&#xA;switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/6&#xA;switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/7&#xA;switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/8&#xA; switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/9&#xA;switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/10&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/11&#xA;switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/12&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/13&#xA;switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/14&#xA;switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/15&#xA;switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/16&#xA;switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/17&#xA; description Trunk to Switch1             &#xA; switchport trunk allowed vlan 1,4&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/18&#xA;switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/19&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/20&#xA;switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/21&#xA;switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/22&#xA;switchport access vlan 3&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/23&#xA; switchport mode trunk&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet0/24&#xA;switchport mode trunk&#xA; spanning-tree portfast&#xA;!&#xA;interface Vlan1&#xA; ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.x&#xA; no ip route-cache&#xA;!         &#xA;interface Vlan4&#xA; no ip address&#xA; no ip route-cache&#xA;!&#xA;interface Vlan11&#xA; ip address xxx.xxx.xxx.xxx xxx.xxx.xxx.x&#xA; no ip route-cache&#xA;!&#xA;interface Vlan66&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA;!&#xA;ip default-gateway xx.x.x.x&#xA;no ip http server&#xA;ip radius source-interface Vlan1 &#xA;snmp-server community xxxxxxxxx XX&#xA;radius-server host xxx.xxx.xx.x auth-port .......&#xA;radius-server source-ports ..........&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 5 0&#xA; password .......&#xA; authorization exec ....&#xA; logging synchronous&#xA; login authentication .....&#xA;line vty 0 4&#xA; exec-timeout 14 59&#xA; password 7 ......&#xA; authorization exec ......&#xA; logging synchronous&#xA; login authentication ....&#xA; length 0&#xA; history size 40&#xA;line vty 5 15&#xA; exec-timeout 14 59&#xA; password .......&#xA; authorization exec.....&#xA; logging synchronous&#xA; login authentication.....&#xA; length 0&#xA; history size 40&#xA;!&#xA;!&#xA;&#xA;ntp clock-period ......&#xA;ntp server ......&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Root-2750 Switch&lt;/strong&gt; This Bridge is root for ALL vlans.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime localtime&#xA;service timestamps log datetime localtime&#xA;service password-encryption&#xA;service sequence-numbers&#xA;!&#xA;hostname Root-3750&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 &#xA;!&#xA;!&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login .. group radius local&#xA;aaa authentication login.. group radius local&#xA;aaa authentication enable default group radius enable&#xA;aaa authorization console&#xA;aaa authorization exec ..group radius local&#xA;aaa authorization exec .. group radius local&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring&#xA;switch 1 provision ws-c3750x-24&#xA;switch 2 provision ws-c3750x-24&#xA;system mtu routing 1500&#xA;ip routing&#xA;ip dhcp excluded-address ...&#xA;ip dhcp excluded-address ...&#xA;!&#xA;ip dhcp pool Phones&#xA;   network ....&#xA;   default-router ....&#xA;   domain-name ...&#xA;   dns-server ...&#xA;   option 160 ascii .......&#xA;!&#xA;!&#xA;ip name-server ....&#xA;ip name-server ...&#xA;!&#xA;track 1 ip sla 1 reachability&#xA;!&#xA;track 2 ip sla 2 reachability&#xA;!&#xA;track 10 list boolean or&#xA; object 1&#xA; object 2&#xA;!&#xA;mls qos map cos-dscp 0 8 16 26 32 46 48 56&#xA;mls qos srr-queue input bandwidth 90 10&#xA;mls qos srr-queue input threshold 1 8 16&#xA;mls qos srr-queue input threshold 2 34 66&#xA;mls qos srr-queue input buffers 67 33&#xA;mls qos srr-queue input cos-map queue 1 threshold 2 1&#xA;mls qos srr-queue input cos-map queue 1 threshold 3 0&#xA;mls qos srr-queue input cos-map queue 2 threshold 1 2&#xA;mls qos srr-queue input cos-map queue 2 threshold 2 4 6 7&#xA;mls qos srr-queue input cos-map queue 2 threshold 3 3 5&#xA;mls qos srr-queue input dscp-map queue 1 threshold 2 9 10 11 12 13 14 15&#xA;mls qos srr-queue input dscp-map queue 1 threshold 3 0 1 2 3 4 5 6 7&#xA;mls qos srr-queue input dscp-map queue 1 threshold 3 32&#xA;mls qos srr-queue input dscp-map queue 2 threshold 1 16 17 18 19 20 21 22 23&#xA;mls qos srr-queue input dscp-map queue 2 threshold 2 33 34 35 36 37 38 39 48&#xA;mls qos srr-queue input dscp-map queue 2 threshold 2 49 50 51 52 53 54 55 56&#xA;mls qos srr-queue input dscp-map queue 2 threshold 2 57 58 59 60 61 62 63&#xA;mls qos srr-queue input dscp-map queue 2 threshold 3 24 25 26 27 28 29 30 31&#xA;mls qos srr-queue input dscp-map queue 2 threshold 3 40 41 42 43 44 45 46 47&#xA;mls qos srr-queue output cos-map queue 1 threshold 3 5&#xA;mls qos srr-queue output cos-map queue 2 threshold 3 3 6 7&#xA;mls qos srr-queue output cos-map queue 3 threshold 3 2 4&#xA;mls qos srr-queue output cos-map queue 4 threshold 2 1&#xA;mls qos srr-queue output cos-map queue 4 threshold 3 0&#xA;mls qos srr-queue output dscp-map queue 1 threshold 3 40 41 42 43 44 45 46 47&#xA;mls qos srr-queue output dscp-map queue 2 threshold 3 24 25 26 27 28 29 30 31&#xA;mls qos srr-queue output dscp-map queue 2 threshold 3 48 49 50 51 52 53 54 55&#xA;mls qos srr-queue output dscp-map queue 2 threshold 3 56 57 58 59 60 61 62 63&#xA;mls qos srr-queue output dscp-map queue 3 threshold 3 16 17 18 19 20 21 22 23&#xA;mls qos srr-queue output dscp-map queue 3 threshold 3 32 33 34 35 36 37 38 39&#xA;mls qos srr-queue output dscp-map queue 4 threshold 1 8&#xA;mls qos srr-queue output dscp-map queue 4 threshold 2 9 10 11 12 13 14 15&#xA;mls qos srr-queue output dscp-map queue 4 threshold 3 0 1 2 3 4 5 6 7&#xA;mls qos queue-set output 1 threshold 1 138 138 92 138&#xA;mls qos queue-set output 1 threshold 2 138 138 92 400&#xA;mls qos queue-set output 1 threshold 3 36 77 100 318&#xA;mls qos queue-set output 1 threshold 4 20 50 67 400&#xA;mls qos queue-set output 2 threshold 1 149 149 100 149&#xA;mls qos queue-set output 2 threshold 2 118 118 100 235&#xA;mls qos queue-set output 2 threshold 3 41 68 100 272&#xA;mls qos queue-set output 2 threshold 4 42 72 100 242&#xA;mls qos queue-set output 1 buffers 10 10 26 54&#xA;mls qos queue-set output 2 buffers 16 6 17 61&#xA;mls qos&#xA;!&#xA;crypto pki .............&#xA; enrollment selfsigned&#xA; ..............&#xA;.............&#xA;...............&#xA;!&#xA;!&#xA;crypto pki certificate chain,,,,,,,,,,,,,&#xA; certificate s,,,,,,,,,,,&#xA;  ,,,,,,,,,,,&#xA;,,,,,,,,,,,,,,,,,,,,,,&#xA;,,,,,,,,,,,,,&#xA;,,,,,,,,,,,,,,,,,,,,,,,,,,,&#xA;,,,,,,,,,,,,,,,,,,,,,,&#xA;,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,&#xA;  quit&#xA;!&#xA;spanning-tree mode rapid-pvst&#xA;spanning-tree extend system-id&#xA;spanning-tree vlan 1-4094 priority 16384&#xA;!&#xA;!&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;ip ssh time-out,,,,&#xA;ip ssh ve,,,,,,&#xA;lldp run&#xA;!&#xA;!&#xA;!&#xA;interface Port-channel1&#xA;!&#xA;interface Port-channel2&#xA;!&#xA;interface Port-channel3&#xA;!&#xA;interface Port-channel4&#xA;!&#xA;interface Port-channel5&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA; no ip route-cache cef&#xA; no ip route-cache&#xA; no ip mroute-cache&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description ..&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; description ..&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA; description...&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA; description&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/5&#xA; description&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/6&#xA; description &#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/7&#xA; description &#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/8&#xA; description &#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/9&#xA; description &#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/10&#xA; description&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/11&#xA; description&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/12&#xA; description &#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/13&#xA; description &#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/14&#xA; description &#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/15&#xA; description &#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/16&#xA; description &#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/17&#xA; description to &#xA; switchport access vlan 2&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/18&#xA; description &#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/19&#xA; description &#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/20&#xA; description &#xA; switchport access vlan 2&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface GigabitEthernet1/0/21&#xA; description OPEN&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/22&#xA; description OPEN&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet1/1/1&#xA; description Trunk 2 a switch&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 1-599,601-4094&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/1/2&#xA; description Trunk to a switch&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 1-599,601-4094&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/1/3&#xA; description Trunk to a switch&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 1-599,601-4094&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/1/4&#xA; description &#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet2/0/20&#xA; description Switch2&#xA; switchport trunk allowed vlan 1-599,601-4094&#xA; spanning-tree portfast&#xA;&#xA;!&#xA;interface GigabitEthernet2/0/24&#xA; description &#xA; switchport access vlan 600&#xA; switchport mode access&#xA; load-interval 30&#xA;!&#xA;!&#xA;interface Vlan1&#xA; ip address ..&#xA;!&#xA;interface Vlan2&#xA; description&#xA; ip address ..&#xA;!&#xA;interface Vlan3&#xA; ip address ...&#xA;!&#xA;interface Vlan4&#xA; ip address ..&#xA; ip helper-address ...&#xA;!&#xA;interface Vlan100&#xA; ip address ..&#xA;!&#xA;interface Vlan101&#xA; ip address ..&#xA;!&#xA;interface Vlan600&#xA; ip address ....&#xA; ip summary-address eigrp ..&#xA;!&#xA;!&#xA;router eigrp 100&#xA; network .&#xA; network..&#xA; network .....&#xA; network .&#xA; network ..&#xA;!&#xA;ip classless&#xA;ip route&#xA;ip route.&#xA;ip route ..&#xA;ip route ..&#xA;ip route .....&#xA;ip route ..&#xA;ip route ..&#xA;ip route ..&#xA;ip route ..&#xA;ip route ..&#xA;ip route ..&#xA;ip route...&#xA;ip route ...&#xA;!&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;ip access-list standard ..&#xA; permit ..&#xA; permit ..&#xA; permit ...&#xA; permit ...&#xA;!&#xA;ip access-list extended .....&#xA; permit ip host ..... any&#xA;ip access-list extended ..&#xA; permit ip host ...any&#xA; permit ip host .. any&#xA; permit ip host .......any&#xA; permit ip host ....... any&#xA; permit ip host ..... any&#xA; permit ip host ...... any&#xA; permit ip host ........ any&#xA; permit ip host .... any&#xA; permit ip host ...... any&#xA; permit ip host ...... any&#xA; permit ip host ...... any&#xA; permit ip host ........ any&#xA; permit ip host ........ any&#xA; permit ip host .. any&#xA; permit ip host .. any&#xA;!&#xA;ip radius source-interface Vlan1&#xA;ip sla 1&#xA; dns w...&#xA; frequency 10&#xA;ip sla schedule 1 life forever start-time now&#xA;ip sla 2&#xA; icmp-echo 4.2.2.1&#xA; frequency 10&#xA;ip sla schedule 2 life forever start-time now&#xA;ip sla enable reaction-alerts&#xA;route-map TEST permit 5&#xA; match ip address TEST&#xA; set ip next-hop ..&#xA;!&#xA;route-map .. permit 5&#xA; match ip address ..&#xA; set ip next-hop ...&#xA;!&#xA;route-map ...permit 10&#xA; match ip address ..&#xA;&#xA;!&#xA;snmp-server community read4netmon RO&#xA;radius-server host ... auth-port . acct-port ...key..&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 5 0&#xA; password ..&#xA; authorization exec ..&#xA; logging synchronous&#xA; login authentication ..&#xA;line vty 0 4&#xA; session-timeout 4  output&#xA; exec-timeout 4 59&#xA; password ..&#xA; authorization exec ..&#xA; logging synchronous&#xA; login authentication..&#xA; transport input ssh&#xA;line vty 5 15&#xA; session-timeout 4  output&#xA; exec-timeout 4 59&#xA; password ...&#xA; authorization exec ..&#xA; logging synchronous&#xA; login authentication ..&#xA; length 0&#xA; transport input ssh&#xA;!&#xA;ntp clock-period 36027768&#xA;ntp server ..........&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Root-3750 Trunk ports &amp;amp; Show cdp ne&#xA;&lt;a href=&quot;https://i.stack.imgur.com/iHvCf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iHvCf.png&quot; alt=&quot;Root Switch CP NE&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Root-3750#sh int trunk&#xA;&#xA;Port        Mode             Encapsulation  Status        Native vlan&#xA;Gi1/1/1     on               802.1q         trunking      1&#xA;Gi1/1/2     on               802.1q         trunking      1&#xA;Gi1/1/3     on               802.1q         trunking      1&#xA;Gi2/0/20    auto             n-802.1q       trunking      1&#xA;&#xA;Port        Vlans allowed on trunk&#xA;Gi1/1/1     1-599,601-4094&#xA;Gi1/1/2     1-599,601-4094&#xA;Gi1/1/3     1-599,601-4094&#xA;Gi2/0/20    1-599,601-4094&#xA;&#xA;Port        Vlans allowed and active in management domain&#xA;Gi1/1/1     1-4,10,100-101&#xA;Gi1/1/2     1-4,10,100-101&#xA;Gi1/1/3     1-4,10,100-101&#xA;Gi2/0/20    1-4,10,100-101&#xA;&#xA;Port        Vlans in spanning tree forwarding state and not pruned&#xA;Gi1/1/1     1,4,100&#xA;Gi1/1/2     1,4,100&#xA;Gi1/1/3     1,100&#xA;Gi2/0/20    1,3-4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14372" LastEditorUserId="2142" LastEditDate="2016-10-07T16:04:44.447" LastActivityDate="2017-03-20T18:34:42.010" Title="Bridge is always root for a vlan" Tags="|cisco|spanning-tree|cisco-2960|ieee-802.1w|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="35574" PostTypeId="2" ParentId="35539" CreationDate="2016-10-06T21:21:18.800" Score="0" Body="&lt;p&gt;If it's a class C /28 then you get 16 networks. Each network has a network address, a range of useable hosts, and one broadcast. It usually has one gateway too, usually the first usable address. The first network would be .0 and the range .1-.14 with the broadcast .15. Then net two is .16, range .17-.30, and the broadcast (.31) is always one less than the next network, which is .32 because /28 is nets divided by 16s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network Masks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A network mask helps you know which portion of the address identifies the network and which portion of the address identifies the node. Class A, B, and C networks have default masks, also known as natural masks, as shown here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Class A: 255.0.0.0&#xA;Class B: 255.255.0.0&#xA;Class C: 255.255.255.0&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13788-3.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13788-3.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31070" LastEditorUserId="31070" LastEditDate="2016-10-06T22:59:33.730" LastActivityDate="2016-10-06T22:59:33.730" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="35575" PostTypeId="2" ParentId="35569" CreationDate="2016-10-06T21:39:00.777" Score="3" Body="&lt;p&gt;Overlapping fragments shouldn't occur for &quot;normal&quot; traffic. They are usually a sign of someone trying to circumvent some security system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are right that there are different ways to reassemble them. Different implementations behave differently, which is why the attack can be used to circumvent firewalls and make those different systems &quot;see&quot; different things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way to do that without overlapping fragments is by sending a TCP packet with a TTL that is too low to reach the destination host, but which is high enough to pass the firewall. The firewall will see the packet, but the destination host won't. If the firewall is naive in its implementation it will cache what it saw. Then if you retransmit the same TCP packet but with different data the firewall will think it's a normal retransmit and not examine the packet again, but for the host it will be the first time it receives that TCP data and it will use the second version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many ways to mislead firewalls. Overlapping fragments is one of them. A good firewall should detect such behaviour and block the session.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-10-06T21:39:00.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35579" PostTypeId="2" ParentId="34641" CreationDate="2016-10-07T02:13:07.460" Score="0" Body="&lt;p&gt;The out-of-band management / direct connect type links to the physical box should be used because it removes administrator connectivity to the infrastructure from the list of potential problems and tasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SSH accessible VPN and terminal server with public IP addresses from either the wired or LTE interfaces.  iLOM/Embedded Server Management interfaces could be covered along with the networking boxes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's long been the tradition that when the power goes out, the phones (and data centers) still work; most 4GLTE cell towers have some timeframe of backup power. &lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-07T02:13:07.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35582" PostTypeId="1" AcceptedAnswerId="35583" CreationDate="2016-10-07T06:41:12.837" Score="2" ViewCount="2409" Body="&lt;p&gt;I'm configuring a Cisco ASA 5505. I try to configure a AnyConnect VPN. It works for the outside GAN. I have access to that, I can &lt;code&gt;ping&lt;/code&gt; it also, but I cannot ping/access anything that is in my LAN. Can someone help me?&lt;/p&gt;&#xA;&lt;p&gt;Here is my configuration&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;:&#xA;: Serial Number: JMX1737Z0E5&#xA;: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz&#xA;:&#xA;ASA Version 9.2(1)&#xA;!&#xA;hostname au-asa-1&#xA;names&#xA;ip local pool Pool 172.16.200.1-172.16.200.254 mask 255.255.255.0&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 101&#xA;!&#xA;interface Ethernet0/1&#xA; switchport trunk allowed vlan 101-119&#xA; switchport trunk native vlan 101&#xA; switchport mode trunk&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan101&#xA; nameif outside&#xA; security-level 0&#xA; ip address 10.0.0.2 255.255.255.252&#xA;!&#xA;interface Vlan110&#xA; nameif inside&#xA; security-level 100&#xA; ip address 172.16.110.1 255.255.255.0&#xA;!&#xA;interface Vlan111&#xA; nameif users&#xA; security-level 100&#xA; ip address 172.16.101.1 255.255.255.0&#xA;!&#xA;ftp mode passive&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network obj_any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network NETWORK_OBJ_172.16.200.0_24&#xA; subnet 172.16.200.0 255.255.255.0&#xA;object network global-inside-network&#xA; subnet 172.16.0.0 255.255.0.0&#xA;object network vpn&#xA; subnet 172.16.200.0 255.255.255.0&#xA;object-group protocol TCPUDP&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group service DM_INLINE_SERVICE_1&#xA; service-object tcp-udp destination eq domain&#xA; service-object tcp destination eq www&#xA; service-object tcp destination eq https&#xA;access-list global_access extended permit icmp any4 any4 log&#xA;access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any&#xA;access-list 101 extended permit icmp any any echo-reply&#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;mtu users 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;icmp permit any inside&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (any,outside) source dynamic any interface&#xA;access-group inside_access_in in interface inside&#xA;access-group global_access global&#xA;route outside 0.0.0.0 0.0.0.0 10.0.0.1 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL&#xA;http server enable&#xA;http 10.0.0.0 255.255.0.0 outside&#xA;http 172.16.0.0 255.255.0.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpoint ASDM_TrustPoint0&#xA; enrollment self&#xA; subject-name CN=au-asa-1&#xA; keypair sl&#xA; crl configure&#xA;crypto ca trustpoint SelfSigner&#xA; enrollment terminal&#xA; subject-name CN=au-asa-1&#xA; crl configure&#xA;crypto ca trustpool policy&#xA;crypto ca certificate chain ASDM_TrustPoint0&#xA; certificate 024ad854&#xA;    308202d4 308201bc a0030201 02020402 4ad85430 0d06092a 864886f7 0d010105&#xA;    0500302c 3111300f 06035504 03130861 752d6173 612d3131 17301506 092a8648&#xA;    86f70d01 09021608 61752d61 73612d31 301e170d 31353032 31303036 31323234&#xA;    5a170d32 35303230 37303631 3232345a 302c3111 300f0603 55040313 0861752d&#xA;    6173612d 31311730 1506092a 864886f7 0d010902 16086175 2d617361 2d313082&#xA;    0122300d 06092a86 4886f70d 01010105 00038201 0f003082 010a0282 010100cd&#xA;    f1ab81e4 7cb566c3 664046dd f48813e4 f40944e2 167e0452 996fcced aade43ff&#xA;    079e0fd1 e4c07e5a 4a1af380 d80ecbea cb2e47ce 3270afd5 844f0b8a 91fa0aa9&#xA;    fdd95149 bd6d125d 4befcfd8 888518e5 26211577 02763e31 b99e8e1e d71199c3&#xA;    afacc9ea cd58e99d cc804f9a bbc41292 029ec2dd 403a975a b89f703c 81739d9c&#xA;    9f976e73 1b6a18de c3e82270 fa2263b6 468cf531 d088703b 1ffe1bc4 1859905a&#xA;    aafdfb27 4d17e6ec f2f43124 4c51ae24 56912008 aad2adf9 77daeb09 2be910d9&#xA;    8a06328a 351b8abb d16e899b a214425a 92417d31 b508d3ba c3be2ed0 bba2d8a3&#xA;    5148e6e8 3b9bd298 e899a367 40f0d5b3 0b4828f2 50ac5644 e2fd0c98 4bf70d02&#xA;    03010001 300d0609 2a864886 f70d0101 05050003 82010100 811b8fdc dc811692&#xA;    b3e6b1d1 0205d4b7 2be92c49 7aaa0bbc aae1537d 8add52aa a59a8310 25936e0e&#xA;    0ebe9500 ba234db8 c98c90e6 7a2cb931 bd4a7f7f d50a10c0 9e133f85 6f3656b3&#xA;    6360ba34 6be06ca8 ab14900e a422b303 4c374372 c1c96ae7 4ecae664 d9d6fbef&#xA;    b67ee3f6 cb8118b4 5e1ac05d 27955876 c7e8dd15 67a26c6d b3eb3291 5b10df3c&#xA;    01a03f7c 366053a2 4fc7acc4 c85cd242 5398bea6 06970019 abaee8df 69a88023&#xA;    7c487858 2e303069 fa98088c 9df54910 c9dcdef7 5f81dcb8 b14ff27c 89db190f&#xA;    91cfdd2a f4aa0bda 592fb4ac 32b57fc5 a827c886 3951feff 1ff74c6c 47268ba4&#xA;    e1049a00 e4826509 c8aba2f1 feec0e35 62828991 15475abb&#xA;  quit&#xA;telnet timeout 5&#xA;no ssh stricthostkeycheck&#xA;ssh 10.0.0.0 255.255.0.0 outside&#xA;ssh 172.16.0.0 255.255.0.0 inside&#xA;ssh timeout 15&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA; &#xA;dhcpd auto_config outside&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;ssl trust-point ASDM_TrustPoint0 outside&#xA;webvpn&#xA; enable outside&#xA; anyconnect image disk0:/anyconnect-macosx-i386-2.5.2014-k9.pkg 1&#xA; anyconnect enable&#xA; tunnel-group-list enable&#xA;group-policy GroupPolicy_au-vpn internal&#xA;group-policy GroupPolicy_au-vpn attributes&#xA; wins-server none&#xA; dns-server value 8.8.8.8&#xA; vpn-tunnel-protocol ssl-client&#xA; default-domain none&#xA;username ***** password ************* encrypted&#xA;tunnel-group au-vpn type remote-access&#xA;tunnel-group au-vpn general-attributes&#xA; address-pool Pool&#xA; default-group-policy GroupPolicy_au-vpn&#xA; nat-assigned-to-public-ip inside&#xA;tunnel-group au-vpn webvpn-attributes&#xA; group-alias au-vpn enable&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect skinny&#xA;  inspect sunrpc&#xA;  inspect xdmcp&#xA;  inspect sip&#xA;  inspect netbios&#xA;  inspect tftp&#xA;  inspect ip-options&#xA;  inspect icmp&#xA;  inspect icmp error&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;Cryptochecksum:990aef84171010a071adbd5d207cb479&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Be indulgent with me, I'm a dev.&lt;/p&gt;&#xA;&lt;h2&gt;Update&lt;/h2&gt;&#xA;&lt;p&gt;@hertitu worked. Now I can &lt;code&gt;ping&lt;/code&gt; inside. But another problem appear. I cannot ping outside anymore.&lt;/p&gt;&#xA;" OwnerUserId="24187" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-12-21T05:19:20.640" Title="Cannot ping LAN via VPN" Tags="|cisco|cisco-asa|vpn|firewall|ping|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35583" PostTypeId="2" ParentId="35582" CreationDate="2016-10-07T07:35:16.853" Score="3" Body="&lt;p&gt;You currently have this NAT configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (any,outside) source dynamic any interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which matches the traffic between the Anyconnect client (which is on the outside!) and the inside.&#xA;Therefor you need &lt;em&gt;NAT Exemption&lt;/em&gt;, i.e. a NAT rule saying that al traffic from inside to the VPN should not be translated, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside,outside) 1 source static any any destination static NETWORK_OBJ_172.16.200.0_24 NETWORK_OBJ_172.16.200.0_24&#xA;nat (users,outside) 1 source static any any destination static NETWORK_OBJ_172.16.200.0_24 NETWORK_OBJ_172.16.200.0_24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that the &quot;1&quot; will cause this rule to be matched before all other NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: as discussed in comments/chat, for the Internet access to also work, you need to modify the above 2 rules and replace &quot;any&quot; with &quot;global-inside-network&quot; :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (inside,outside) 1 source static global-inside-network global-inside-network destination static NETWORK_OBJ_172.16.200.0_24 NETWORK_OBJ_172.16.200.0_24&#xA;nat (users,outside) 1 source static global-inside-network global-inside-network destination static NETWORK_OBJ_172.16.200.0_24 NETWORK_OBJ_172.16.200.0_24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-10-07T10:49:05.100" LastActivityDate="2016-10-07T10:49:05.100" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35586" PostTypeId="1" CreationDate="2016-10-07T09:36:56.280" Score="0" ViewCount="1544" Body="&lt;p&gt;I have a basic confusion about how port forwarding works with DHCP assigned IP addresses.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I set up port forwarding on a raspberry pi using its internal IP address and then set up dyndns so that the routers external IP address doesn't need to be known, if I unplug the pi for a while and reconnect it, will it be given a new IP with dhcp so that the port forwarding I just did no longer works?&lt;br&gt;&#xA; If this is a problem can I set up port forwarding with a Mac address rather than device IP address?&lt;/p&gt;&#xA;" OwnerUserId="22344" LastEditorUserId="16930" LastEditDate="2016-10-07T10:04:24.980" LastActivityDate="2016-10-07T10:04:24.980" Title="Port forwarding and dynamic IP address" Tags="|dhcp|ip-forwarding-table|" AnswerCount="1" CommentCount="3" ClosedDate="2018-03-10T04:31:09.910" ContentLicense="CC BY-SA 3.0" />
  <row Id="35587" PostTypeId="2" ParentId="35586" CreationDate="2016-10-07T10:03:08.173" Score="1" Body="&lt;p&gt;This is a common case with dynamic IP address. Some equipment allow to create a NAT rule based on the interface rather than the IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way to configure this depends on the router. On linux based router this is commonly referred as &lt;code&gt;masquerade&lt;/code&gt; or &lt;code&gt;ip masquerade&lt;/code&gt; and the word masquerade is used in place of the IP address in the nat configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Raspberry PI is off-topic on this Stack Exchange site, but if you need more info you may find answers on the &lt;a href=&quot;https://raspberrypi.stackexchange.com/&quot;&gt;Raspeberry PI Stack Exchange&lt;/a&gt;  site&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2017-04-13T12:56:29.263" LastActivityDate="2016-10-07T10:03:08.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35588" PostTypeId="1" CreationDate="2016-10-07T10:21:22.673" Score="1" ViewCount="10783" Body="&lt;p&gt;I've just started using wireshark. I click the blue shark fin, then 10 seconds later click the red stop button. The bar along the bottom of the window says &quot;Packets 47 - Displayed 0&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't work out how to actually display packet information. I've tried saving to a file (when I open the file in a text editor I can see bytes of data). I open the file in wireshark, and I still can't see any information about packets - the &quot;No. Time Source Destination etc&quot; columns are all empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions?&lt;/p&gt;&#xA;" OwnerUserId="31085" LastEditorUserId="31085" LastEditDate="2016-10-07T16:18:26.920" LastActivityDate="2016-10-07T16:18:26.920" Title="How do I get wireshark to actually display packets" Tags="|wireshark|" AnswerCount="1" CommentCount="3" ClosedDate="2016-10-07T13:55:31.127" ContentLicense="CC BY-SA 3.0" />
  <row Id="35590" PostTypeId="5" CreationDate="2016-10-07T12:19:38.710" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2016-10-07T12:19:38.710" LastActivityDate="2016-10-07T12:19:38.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35591" PostTypeId="4" CreationDate="2016-10-07T12:19:38.710" Score="0" Body="For questions concerning creating, implementing, or troubleshooting Netconf-based  (RFC 6241) configuration tools." OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-10-07T12:40:43.093" LastActivityDate="2016-10-07T12:40:43.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35592" PostTypeId="2" ParentId="35588" CreationDate="2016-10-07T13:45:51.397" Score="3" Body="&lt;p&gt;There's several thinks that can cause Wireshark to not display packets&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most obvious are :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;capture filter : there's a filter for what wireshark will capture and retain. (seems it's not the case here since you do have something in the pcap file)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;display filter , as commented by hertitu&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But it can also be&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;incompatible hardware or driver : it has been reported that wireshark doesn't work correctly with some network interface card or drivers&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;security software on the host : it has also been reported that windows firewall or some security agents block some traffic before WS handel them&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;capturing encrypted Wifi data (WEP / WPA(2)) : if you capture data over a Wireless interface, Wireshark will see the bit flow but cannot decrypt it and will not display anything.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you are on a wired interface you could try booting on a USB stick with a live linux install and perform a tcpdump on the interface to see if you have better results.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-10-07T13:45:51.397" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35598" PostTypeId="2" ParentId="25121" CreationDate="2016-10-07T16:08:18.393" Score="1" Body="&lt;p&gt;Unfortunately 10GBASE-T was more power hungry than 1000BASE-T. As a result of this SFP+ manufacturers were not initially able to offer a 10GBASE-T option. This has left an awkward situation with regards to 10 gigabit interoperability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However it seems things are starting to change. 10GBASE-T SFP+ transcievers are starting to appear albiet with a 30m distance limitation. Prolabs claim to have a cisco compatible 10GBASE-T SFP+ but their website gives no indication of price.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-10-07T16:08:18.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35600" PostTypeId="1" AcceptedAnswerId="77452" CreationDate="2016-10-07T18:16:10.920" Score="1" ViewCount="7394" Body="&lt;p&gt;We have 10G fiber running since 1 year but today I have migrate that same link to ASR1006 and I am seeing following error, what could be the problem?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Oct  7 17:29:48.211: %IOSXE_SPA-6-UPDOWN: Interface TenGigabitEthernet1/1/0, link down due to remote fault&#xA;Oct  7 17:29:48.424: %IOSXE_SPA-6-UPDOWN: Interface TenGigabitEthernet1/1/0, link down due to local fault&#xA;Oct  7 17:29:48.623: %IOSXE_SPA-6-UPDOWN: Interface TenGigabitEthernet1/1/0, link down due to local fault&#xA;Oct  7 17:29:48.642: %IOSXE_SPA-6-UPDOWN: Interface TenGigabitEthernet1/1/0, link down due to remote fault&#xA;Oct  7 17:29:48.863: %IOSXE_SPA-6-UPDOWN: Interface TenGigabitEthernet1/1/0, link down due to remote fault&#xA;Oct  7 17:29:48.943: %IOSXE_SPA-6-UPDOWN: Interface TenGigabitEthernet1/1/0, link down due to remote fault&#xA;Oct  7 17:29:50.204: %LINK-3-UPDOWN: Interface TenGigabitEthernet1/1/0, changed state to down&#xA;Oct  7 17:29:50.208: %LINK-3-UPDOWN: SIP1/1: Interface TenGigabitEthernet1/1/0, changed state to down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SPA status looks good&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show hw-module subslot all oir&#xA;Module        Model                Operational Status&#xA;------------- -------------------- ------------------------&#xA;subslot 0/0   SPA-1X10GE-L-V2      ok&#xA;subslot 0/3   SPA-1X10GE-L-V2      ok&#xA;subslot 1/0   SPA-1X10GE-L-V2      ok&#xA;subslot 1/1   SPA-1X10GE-L-V2      ok&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interface output&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh int te1/1/0&#xA;TenGigabitEthernet1/1/0 is down, line protocol is down&#xA;  Hardware is SPA-1X10GE-L-V2, address is f4cf.e2ed.8750 (bia f4cf.e2ed.8750)&#xA;  Description: &#xA;  Internet address is 69.25.205.158/30&#xA;  MTU 1500 bytes, BW 10000000 Kbit/sec, DLY 10 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not supported&#xA;  Full Duplex, 10000Mbps, link type is force-up, media type is 10GBase-LR&#xA;  output flow-control is on, input flow-control is on&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input never, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     0 packets input, 0 bytes, 0 no buffer&#xA;     Received 0 broadcasts (0 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 packets output, 0 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 11 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;UPDATE&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;This is very interesting, same fiber I moved back to C3850 switch and it works! but if I moved back to ASR1006 it didn't work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if I connect ASR1006 same fiber port to C3850 back to back (1 meter distance) and assign random IP to test ping and it work! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SPF model is &lt;code&gt;Cisco XFP-10GLR-OC192SR&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be the issue? &lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="22463" LastEditDate="2020-04-05T08:29:28.583" LastActivityDate="2021-12-29T16:06:56.660" Title="ASR1006 Link Down Due to Remote Fault" Tags="|cisco|router|fiber|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 4.0" />
  <row Id="35601" PostTypeId="1" AcceptedAnswerId="35603" CreationDate="2016-10-07T18:38:28.113" Score="1" ViewCount="100" Body="&lt;p&gt;We gave every user a static local IP address, bound them with their MAC addresses, and provided them access to different resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, a user has spoofed their MAC address to connect using another IP address, causing a conflict. This person is also hogging on the resources allotted to the legitimate user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I gave the legitimate user a new IP address, but after a few hours its all the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I retrieve info about the person and identify them?&lt;/p&gt;&#xA;" OwnerUserId="31101" LastEditorUserId="8499" LastEditDate="2016-10-07T18:44:36.027" LastActivityDate="2016-10-07T18:44:36.027" Title="What info can be retrieved about a host from its IP address?" Tags="|ip|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35603" PostTypeId="2" ParentId="35601" CreationDate="2016-10-07T18:42:45.583" Score="0" Body="&lt;p&gt;There is no identifying information in an IP packet, except the source and destination IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your switch models, you may be able to look in the switch MAC address tables to identify the switch interface to which the user is connected. You will want the legitimate user to disconnect from the network while you do this, otherwise you will get constantly changing MAC address tables.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-07T18:42:45.583" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35609" PostTypeId="2" ParentId="33841" CreationDate="2016-10-07T23:00:17.543" Score="0" Body="&lt;p&gt;Another option is to ensure it's only plugged into one particular port is to make the port drop when it sees a BPDU coming from the attached host.  You would enable this on all the ports that shouldn't have the access point attached.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In cisco terms, this feature is called &lt;code&gt;bpduguard&lt;/code&gt;and the port will go into an err-disabled state when a bpdu is seen.  You can set it such that the port will auto re-enable after a specified time and if the device is no longer attached the port will become operational again.  &lt;code&gt;errdisable recovery interval &amp;lt;seconds&amp;gt;&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for Alcatel, I'm not too familiar with them but a quick search turns up the following similar code: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;qos no user-port filter user-port shutdown bpdu&#xA;policy port group UserPorts 1/10-24&#xA;qos apply&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You would not set this on the port the access point is plugged into. &lt;/p&gt;&#xA;" OwnerUserId="599" LastActivityDate="2016-10-07T23:00:17.543" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35611" PostTypeId="1" CreationDate="2016-10-08T01:14:11.307" Score="0" ViewCount="7099" Body="&lt;p&gt;When is &quot;PLMN not allowed&quot; error code seen in LTE? I know its seen when the device tries a location registration in a PLMN in which its barred. But how can it even send the attach request to it in the first place?&lt;/p&gt;&#xA;" OwnerUserId="31108" LastActivityDate="2019-01-03T09:01:45.363" Title="When is &quot;PLMN not allowed&quot; error code seen in LTE?" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35615" PostTypeId="1" AcceptedAnswerId="35617" CreationDate="2016-10-08T14:26:07.563" Score="1" ViewCount="1350" Body="&lt;p&gt;i would like to ask how can i copy running-config from my switch to linux, and a ready configurations (with changed values) back to switch but i dont want to use any ftp server or any other method with IP address. I am connected with device via console cable, the device is &quot;clean&quot; and i am using minicom with configurable connection.&lt;br&gt;&#xA;Please correct me if I'm wrong, but when i want send already ready configurations can I use the cp command, where gives a target / dev / ttyS0 ? Do replace the Clean configurations?&#xA;And does will it work now with the new configuration? &lt;/p&gt;&#xA;" OwnerUserId="31115" LastActivityDate="2021-01-24T11:43:23.760" Title="How to copy running-config on the cisco switch" Tags="|cisco|switch|linux|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35617" PostTypeId="2" ParentId="35615" CreationDate="2016-10-08T14:35:03.893" Score="0" Body="&lt;p&gt;If you want to transfer the file, then you need to use an IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could always just use the &lt;code&gt;show running-configuration&lt;/code&gt; command, and copy what is in your terminal to a file. Many terminal applications have a capture feature, or you could just copy-and-paste.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-08T14:35:03.893" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="35618" PostTypeId="1" AcceptedAnswerId="35619" CreationDate="2016-10-08T15:41:31.200" Score="2" ViewCount="4695" Body="&lt;p&gt;I would like to ask about the relation between&#xA;802.11 and Ethernet L2 Link layer. &#xA;Are they dependent of each other? &#xA;Or can they be seen as &#xA;independent L2 link layers (with only similarities in their&#xA;headers)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When capturing packets in Linux in non-monitor mode&#xA;on a interface the packets will be displayed as &quot;fake&quot;&#xA;ethernet frames. In monitor mode the &quot;real&quot; frames &#xA;look quite different. This is quite confusing.&#xA;My guessing is that the two link layers are actually &#xA;totally independent.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In particular I wonder how a packet that comes in &#xA;on a ethernet interface and goes out on a 802.11 interface&#xA;transforms when the host is configured as a linux router:&#xA;For instance is there a one-one mapping between the &#xA;ethernet 802.1Q  vlan tags? Or are there even automatic &#xA;encapsulation mechanisms in the standard (and therefore&#xA;the two link layers being coupled to each other) ... etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the relation of 802.11ad (60Ghz) to ethernet similar &#xA;as that of the other 802.11 standard to ethernet?&#xA;// Greetings Konrad&lt;/p&gt;&#xA;" OwnerUserId="31118" LastEditorUserId="8499" LastEditDate="2018-12-12T03:11:30.843" LastActivityDate="2018-12-12T03:11:30.843" Title="Relation between Ethernet and 802.11 headers" Tags="|vlan|ethernet|wireless|ieee-802.11|layer2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35619" PostTypeId="2" ParentId="35618" CreationDate="2016-10-08T15:57:55.657" Score="5" Body="&lt;p&gt;Ethernet (IEEE 802.3) and Wi-Fi (IEEE 802.11) are two completely separate layer-1/2 protocols, with different layer-2 frames. Each IEEE LAN type (ethernet, token-ring, FDDI, Wi-Fi, etc.) has it own frame format.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the packets are encapsulated by the frames, the packets can easily be transferred from one LAN type to another by discarding and building new frames. Routers do this as a matter of course; every frame coming into a router is stripped and discarded, the packet is switched to a new interface, and a new frame is built for the new interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With bridges, it is a little different. A bridge that has multiple LAN types needs to be a translating bridge to translate between the different frame types. Unlike transparent bridges, e.g. ethernet switches, translating bridges must strip the frames, but the frame information may need to be preserved in order to build a new new frame for the new LAN type. For instance, ethernet/token-ring bridges need to change the MAC addresses to/from ethernet and token-ring's canonical format. A WAP is really just a translating bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wi-Fi doesn't really have VLANs the way ethernet does. Normally, VLANs translate to SSIDs. There is/was a proposed standard to add VLANs to point-to-point Wi-Fi links in order to trunk wirelessly between two ethernet switches, but I have never seen it implemented, and I don't think there is much support for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11ad is just another Wi-Fi standard, the way ethernet has many different standards, e.g. 802.3z (gigabit ethernet).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-08T15:57:55.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35620" PostTypeId="1" AcceptedAnswerId="35636" CreationDate="2016-10-08T18:09:56.563" Score="1" ViewCount="52" Body="&lt;p&gt;I am configuring L2L VPN between two sites through the internet.&#xA;Site 1:&#xA;I have ASA with ADSL connection and dynamic I&lt;code&gt;dlls5szltldu&lt;/code&gt;p &#xA;Site 2: &#xA;I have ASA also with two internet lines ,leased line with static IP and ADSL line with dynamic IP .&#xA;I have configured the VPN and it is up and running only when I configure default &lt;code&gt;t7z&lt;/code&gt;route through the lease line ,but if I configured the default route through the ADSL the VPN will go down &#xA;I have on both ASA version 9.4 and PBR is there but i am not sure if PBR can resolve that .&lt;/p&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="1906" LastEditDate="2016-10-12T09:04:00.500" LastActivityDate="2016-10-12T09:04:00.500" Title="Site to site VPN with dynamic xzlland static" Tags="|vpn|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="35622" PostTypeId="1" AcceptedAnswerId="35623" CreationDate="2016-10-08T19:22:11.183" Score="4" ViewCount="4367" Body="&lt;p&gt;I have some issue to configure the router in Packet Tracer 7.&#xA;I have a router with a specific subnet, which is 192.168.1.128/27 .&#xA;My first problem is, how can I configure two (or more) ethernet interfaces to the same network, like at the home routers has. So, the router address is the same in both ports, the subnet is the same, ect. (The default settings enables to connect two (or more) different subnets) I tried to set the same ip addres both of the ports, but in that case it says &quot;Overlaps with FastEthernet0/0&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also how can I set the ethernet interface is WAN connection not LAN connection? Because I want to connect routers together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE this program uses cisco routers, so maybe if you know how you can set via command line, it will be the same here too.&lt;/p&gt;&#xA;" OwnerUserId="31121" LastEditorUserId="31121" LastEditDate="2019-06-21T14:15:44.973" LastActivityDate="2019-06-21T14:15:44.973" Title="Configure ethernet ports on a router in packet tracer 7" Tags="|cisco|router|cisco-commands|packet-tracer|interface|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="35623" PostTypeId="2" ParentId="35622" CreationDate="2016-10-08T20:45:11.033" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My first problem is, how can I configure two (or more) ethernet&#xA;  interfaces to the same network, like at the home routers has.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Routers route between networks, so each router interface needs to be in a different network. Don't be confused by what you think is a home router. The home router has separate networks on the router interfaces, but you are probably meaning a switch module in a home router. You need a switch or a switch module in a router for that, but those are not router interfaces.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also how can I set the ethernet interface is WAN connection not LAN&#xA;  connection? Because I want to connect routers together.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;For a router, there really is no real distinction between WAN and LAN. Some interfaces, e.g. serial interfaces, are more likely to be used for WAN connections, while some router interfaces, e.g. ethernet, are more likely to be used for LAN connections, but you could use just about any type of router interface for either connection type. There are no commands that say, &quot;This is a WAN interface.&quot; You can connect two routers together with like interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-08T20:45:11.033" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35625" PostTypeId="1" CreationDate="2016-10-09T01:25:39.357" Score="6" ViewCount="12415" Body="&lt;p&gt;I am currently doing an internship and I hear the IT Director referring to a router port as a NIC. I can't remember exactly what he said. Also, in my Networking+ book it states that each dynamic routing protocols are tied to individual NICs, not the entire router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is, is there multiple NICs in a router?&lt;/p&gt;&#xA;" OwnerUserId="31125" LastEditorUserId="31125" LastEditDate="2016-10-09T01:57:19.193" LastActivityDate="2019-05-20T16:06:38.803" Title="Does a router have multiple nics?" Tags="|router|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35627" PostTypeId="2" ParentId="35625" CreationDate="2016-10-09T02:29:23.670" Score="8" Body="&lt;p&gt;There are multiple network interfaces in a router. Routers route between networks, so there must be at least two, often more, network interfaces in a router. Sometimes, the network interfaces are logical, and you can't really call a logical interface a NIC.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-09T02:29:23.670" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35628" PostTypeId="1" CreationDate="2016-10-09T05:05:44.987" Score="0" ViewCount="342" Body="&lt;p&gt;Why does data link layer have sub layer but other layers don't have sub layer.&lt;/p&gt;&#xA;" OwnerUserId="30856" LastActivityDate="2016-10-10T01:54:48.550" Title="What is the difference between data link layer and sub data link layer" Tags="|layer2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35629" PostTypeId="1" AcceptedAnswerId="44958" CreationDate="2016-10-09T08:53:37.857" Score="0" ViewCount="550" Body="&lt;p&gt;Let's say that C is TCP client and S is TCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;C sent a TCP segment to S containing bytes 10, 11, 12 ... 20 (seq = 10). Segment reached S (it is not lost along the way). Is it possible that S send eg. ack 15, and that he drops all other bytes (15, 16, 17, 18, 19, 20), so that C must send another segment this time seq = 15. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In another words, is a &quot;segment split&quot; possible: that server accepts first part of bytes of one segment and drop the second part (due to eg. full buffer or something like that), and later take the second part of bytes from next segment? Or are segments always accepted completely?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that window size should prevent that type of situations: during the three way handshake, server will send his window size and client will not send segment that is greather than that. Server will later update his window size and client would continue to respect that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what about this: during three way handshake, server sends his window size eg 65000. By the time this client sends his segment, another client starts three way handshake and sends something big to server which gets server window size smaller. The second client gets notified about that, but the first don't. The first may send a segment which would fit into old window size but not the new one. So what happens then?&lt;/p&gt;&#xA;" OwnerUserId="31062" LastEditorUserId="8499" LastEditDate="2017-07-16T03:51:58.177" LastActivityDate="2018-09-06T05:56:48.543" Title="TCP - ack and retransmissions - Is this scenario possible?" Tags="|tcp|layer4|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35630" PostTypeId="1" AcceptedAnswerId="35631" CreationDate="2016-10-09T08:56:10.390" Score="0" ViewCount="59" Body="&lt;p&gt;Yesterday I've ordered a new switch for my PC-setup at home, because the old one was only a 100Mbit-switch and we got a 200Mbit internet-line this week.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(&quot;D-Link 8 Port Gigabit Unmanaged Metal Desktop Switch (DGS-108)&quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I was about to connect it, I repeatedly received electric shocks. When I touched the metal casing of the switch, the LAN cables, and anything grounded at the same time. Like the PC casing, or the radiator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That happened even when the power-line of the switch wasn't plugged in yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I decided to ground the casing of the switch. But when I did so, and connected it to the radiator using a thick grounding cable from the hardware store, I noticed flying sparks when I connected it. And so I decided to measure the current.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first I couldn't find any readings, and went on with the installation.&#xA;But when the electric shocks wouldn't stop, I decided to make one final measurement, that was when I measured 112V AC, at about 2.5mA.&#xA;(I live in Germany, where the power lines in homes usually have between 220V and 230V).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have ordered a new switch from Amazon, but I suspect that there is some stray electric (compensating) current going through the shielding of my LAN cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this something I should be worried about? Or can I just leave the casing of the switch grounded/connected to the radiator, and ignore it?&lt;/p&gt;&#xA;" OwnerUserId="31127" LastActivityDate="2016-10-09T10:35:38.417" Title="There's a 112V voltage (AC) between my 8-port switch and the radiator in the room. Is this problematic?" Tags="|switch|lan|" AnswerCount="1" CommentCount="1" ClosedDate="2016-10-09T18:12:29.230" ContentLicense="CC BY-SA 3.0" />
  <row Id="35631" PostTypeId="2" ParentId="35630" CreationDate="2016-10-09T10:35:38.417" Score="0" Body="&lt;p&gt;The voltage per-se isn't a problem, it's quite normal for class 2 devices to have a voltage on the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is a problem is the &quot;touch current&quot;. That is the current that flows when someone touches both the case of the appliance and an earthed metal object. I'm not 100% sure what the limit for touch current on regular portable appliance is but I think it's arround 0.25mA, your measurement of 2.5ma is ten times that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Return the device as faulty.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-10-09T10:35:38.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35633" PostTypeId="1" AcceptedAnswerId="35634" CreationDate="2016-10-09T14:12:45.777" Score="0" ViewCount="5664" Body="&lt;p&gt;I need to find Unmanaged Switch on the network.&lt;br&gt;&#xA;How to do this? Which Application?&lt;/p&gt;&#xA;" OwnerUserId="22692" LastActivityDate="2016-10-09T15:18:33.213" Title="Finding Unmanaged Switches on the LAN" Tags="|switch|monitoring|" AnswerCount="1" CommentCount="0" ClosedDate="2016-10-09T18:10:06.787" ContentLicense="CC BY-SA 3.0" />
  <row Id="35634" PostTypeId="2" ParentId="35633" CreationDate="2016-10-09T15:18:33.213" Score="1" Body="&lt;p&gt;Unmanaged switches have no IP address, but you could start by looking at the MAC tables on your managed switches and find inconsistencies. A managed switch will learn the MAC of the device attached to it. Find the MAC that doesn't belong to a known IP, that's probably the MAC on the unmanaged switch.&lt;/p&gt;&#xA;" OwnerUserId="24029" LastActivityDate="2016-10-09T15:18:33.213" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35636" PostTypeId="2" ParentId="35620" CreationDate="2016-10-09T19:01:12.923" Score="2" Body="&lt;p&gt;Let me recap what you are trying to achieve. On site A you got two ISPs. One Uplink is used for Internet traffic (A) and the other Uplink (B) should only be used for Site2Site VPNs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are trying to establish a Site2Site VPN from B to a site that has no static ip address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One could argue that you could just add a /32 Host Route on B to ensure this is working but since you have a Dynamic Peer this wont work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend using Security Context feature on ASA. Depending on your model and license you can segment your firewall into multiple logical firewalls. Since you would have a different routing table for your VPN context you would not have any problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me know which model you are using and if this was an option for you. &lt;/p&gt;&#xA;" OwnerUserId="19610" LastActivityDate="2016-10-09T19:01:12.923" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35638" PostTypeId="1" AcceptedAnswerId="35640" CreationDate="2016-10-09T20:57:12.223" Score="2" ViewCount="7227" Body="&lt;p&gt;I'm stuck with configuring L3 sw + L2 sw + dhcp server. My scheme is:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bgosP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bgosP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't take ip addresses to computers in different VLAN's.&#xA;I have two dhcp pools:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aTywX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aTywX.png&quot; alt=&quot;enter image description dwhere&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration on L3 switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;spanning-tree mode pvst&#xA;interface FastEthernet0/1&#xA;switchport trunk allowed vlan 10&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;&#xA;interface FastEthernet0/2&#xA;switchport trunk allowed vlan 20&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;&#xA;interface FastEthernet0/3&#xA;switchport access vlan 30&#xA;switchport mode access&#xA;&#xA;interface Vlan1&#xA;no ip address&#xA;shutdown&#xA;&#xA;interface Vlan10&#xA;mac-address 00d0.ba4b.a601&#xA;ip address 192.168.10.1 255.255.255.0&#xA;ip helper-address 192.168.1.1&#xA;&#xA;interface Vlan20&#xA;mac-address 00d0.ba4b.a602&#xA;ip address 192.168.20.1 255.255.255.0&#xA;ip helper-address 192.168.1.1&#xA;&#xA;interface Vlan30&#xA;mac-address 00d0.ba4b.a603&#xA;ip address 192.168.30.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;L2 switches with almost similar conf, just different vlan's:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree mode pvst&#xA;&#xA;interface FastEthernet0/1&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;&#xA;interface FastEthernet0/2&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;DHCP server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static ip: 192.168.1.1&#xA;gateway: 192.168.30.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what i did wrong? What should i do for properly work ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2:07:&#xA;I've changed VLAN1 and up this interface, plus set another dhcp ip,so now on my L3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA; ip address 1.1.1.1 255.255.255.0&#xA; ip helper-address 1.1.1.5&#xA;!&#xA;interface Vlan10&#xA; mac-address 00d0.ba4b.a601&#xA; ip address 192.168.10.1 255.255.255.0&#xA; ip helper-address 1.1.1.5&#xA;!&#xA;interface Vlan20&#xA; mac-address 00d0.ba4b.a602&#xA; ip address 192.168.20.1 255.255.255.0&#xA; ip helper-address 1.1.1.5&#xA;!&#xA;interface Vlan30&#xA; mac-address 00d0.ba4b.a603&#xA; ip address 192.168.30.1 255.255.255.0&#xA; ip helper-address 1.1.1.5&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;DHCP server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 1.1.1.5&#xA;Gateway: 1.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it still doesn't work. And i don;t know how to don't set mac-address,i think it was by packet tracker automatically.&#xA;Should i up VLAN1's svi on L2 switches?&lt;/p&gt;&#xA;" OwnerUserId="31136" LastEditorUserId="31136" LastEditDate="2016-10-09T23:22:02.343" LastActivityDate="2019-10-25T17:05:05.430" Title="How can i configure L3 switch and DHCP server?" Tags="|cisco|switch|packet-tracer|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35640" PostTypeId="2" ParentId="35638" CreationDate="2016-10-09T21:38:31.227" Score="1" Body="&lt;p&gt;Your DHCP server address is not in the network where it is connected. It will never use an address in a different network for its gateway. The gateway is, by definition, in the same network as the host, and it is used by the host to get to addresses not in its network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You either need to change the DHCP server's address, or you need to change the network to match the DHCP server's network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, there is no reason to specifically set the MAC address on any VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you have the DHCP server connected to VLAN 30 on &lt;code&gt;F0/3&lt;/code&gt;, you can change the DHCP servers address to &lt;code&gt;192.168.30.2&lt;/code&gt; with a gateway of &lt;code&gt;192.168.30.1&lt;/code&gt;. Then just change the helper addresses to &lt;code&gt;192.168.30.2&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-09T23:17:52.080" LastActivityDate="2016-10-09T23:17:52.080" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35644" PostTypeId="2" ParentId="35625" CreationDate="2016-10-10T01:20:15.330" Score="8" Body="&lt;p&gt;A &quot;NIC&quot; is a &quot;network interface card&quot; (or, often these days, &quot;network interface controller&quot;). It's set of chips (these days, single chip) which implements the technology for the network interface. An &quot;ethernet controller&quot; will take a short queue of packets and implement DMAing them from RAM, framing the packets (adding the source address and ethernet CRC). A modern ethernet controller will also be able to do some Network and Transport layer functions so that the CPU can handle packets more efficiently -- these &quot;offload&quot; functions include calculating checksums and packetising TCP segments. The controller might also implement the more physical aspects of the ethernet protocol, such as Base-T's autonegotiation, or it might leave this to another chip we call a &quot;PHY&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;ethernet contoller&quot; for a switch takes this to extremes, implementing the entire &quot;transparent ethernet bridging&quot; forwarding plane between 4 to 16 ports. Recent controllers will handle most of the ethernet bridging control plane too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In almost all modern router designs the router ports attach to one or more switch ethernet controllers, typically a Broadcom Trident- or Tomahawk-series controller. That controller might implement the router's forwarding plane, or it might simply handle port fan-out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, back in the IT Director's day routers would have a single ethernet port attached to a single ethernet network interface card, there might be four of these cards assembled with some routing logic to make a &quot;line card&quot;. The &quot;line card&quot; would attach to the router's backplane.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today even a low-end server NIC will happily present 4 gigabit ethernet ports. A switch or router might present 16 ports from the one ethernet controller. So your IT Director really should starting saying &quot;port&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But before you go accuse your Director living in the past, consider that the job of a IT Director doesn't allow much time for the details of the technology; that's surprisingly low on the list of things they'd most like to know. So as much as they are being wrong in their terminology, bringing it to their attention in anything other than an aside, is to be wrong from the point of view of &lt;em&gt;their&lt;/em&gt; expertise -- management. They have things to do with their time which are much more significant. I'd go no further than &quot;just so you're not embarrassed in a presentation, they call them 'ports' these days&quot;.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastEditorUserId="25444" LastEditDate="2016-10-10T01:27:11.660" LastActivityDate="2016-10-10T01:27:11.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35645" PostTypeId="2" ParentId="35628" CreationDate="2016-10-10T01:47:48.803" Score="2" Body="&lt;p&gt;The concept of &quot;layers&quot; is an aid to thinking about networking, about where network functions are best implemented. It's not a hard-and-fast set of requirements: the ISO and IETF family of protocols even have different notions of how many layers there are, and which functions belong in each layer. The implementation of a modern ethernet controller breaks layering really hard, but the concept of layers is still use in thinking about what that controller is doing. Remember that it is just a &quot;model&quot;, an abstract and simplifing description of the real world as an aid to thought.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's generally held that link layers need a &quot;sublayer&quot; to implement the near-but-not-really-electrical nitty gritty: detecting the start and end of packets, detecting media availability, manipulating the bit arrangements so that DC bias to be held within bounds, detecting and correcting errors, some sorts of encryption. And between this nitty gritty and the link layer proper we often want some signalling channel: the SONET overhead, the Ethernet autonegotiation and OAM. A lot of the determination of if a function is in the link layer or sublayer depends &lt;em&gt;how&lt;/em&gt; we implement the feature. So the definition of sublayer functions gets extremely wobbly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same is true for other layers as well. Rather than call these &quot;sublayers&quot; they are usually called &quot;&lt;em&gt;x&lt;/em&gt;.5&quot; layers. So ATM, MPLS and some tunnels are &quot;Layer 2.5&quot; as they present a link layer service implemented using network-layer services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: &quot;near-but-not-really-electrical nitty gritty&quot; might be better described as &quot;electrical concerns addressed by the link layer plus computing functions needed to establish the link later, implemented out-of-band&quot;.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastEditorUserId="25444" LastEditDate="2016-10-10T01:54:48.550" LastActivityDate="2016-10-10T01:54:48.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35646" PostTypeId="2" ParentId="35625" CreationDate="2016-10-10T03:46:16.473" Score="0" Body="&lt;p&gt;IMHO it is not necessary to bind physical network port and routing. You may successfully route between VLANs and have NO L3 ports at all (just trunk and access ports). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dynamic protocols are not tied to anything. They use &quot;interface&quot; to control dynamic routing announcement and for many other things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes you can use any computer with multiple NICs as a router. I think you mis-understood your IT Director. I do NOT think it will be proper use of the term NIC for the router. I think you have to use &quot;interface&quot; or may be &quot;network port&quot; word.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck. &lt;/p&gt;&#xA;" OwnerUserId="31145" LastActivityDate="2016-10-10T03:46:16.473" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35647" PostTypeId="2" ParentId="16748" CreationDate="2016-10-10T03:52:02.943" Score="1" Body="&lt;p&gt;If 2 hosts have gigabit interfaces and connected both to the same gigabit switch and both ports belong to the same VLAN then it will be gigabit connection. Traffic through 100M router will be 100M&lt;/p&gt;&#xA;" OwnerUserId="31145" LastActivityDate="2016-10-10T03:52:02.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35648" PostTypeId="2" ParentId="35629" CreationDate="2016-10-10T04:14:13.617" Score="0" Body="&lt;p&gt;segments &lt;em&gt;may&lt;/em&gt; arrive to the destination in the different order  due to f.e. asymmetric routing. Some segments may be lost and have to be re-transmitted. Server will NOT accept part of the segment- just whole segment or nothing. If the host loose the segment due to buffer overflow then it informs the source by sending ICMP message and TCP window will be reset back to start- they call it &quot;slow start&quot;. &lt;/p&gt;&#xA;" OwnerUserId="31145" LastActivityDate="2016-10-10T04:14:13.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35650" PostTypeId="1" CreationDate="2016-10-10T05:49:06.357" Score="0" ViewCount="65" Body="&lt;p&gt;&lt;strong&gt;Following scenario&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-----------+              +-----------+&#xA;| Network A |--- Router ---| Network B |&#xA;+-----------+              +-----------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a client in 'Network A' wants to connect to 'Network B' it needs the IP of the router as default gateway to acquire the MAC of the router via ARP. (?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the client in 'Network B' answers the request (of client in 'Network A') it doesn't need a default gateway because the MAC of the router is in the request packet. (?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are this two statements correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you, nodna&lt;/p&gt;&#xA;" OwnerUserId="30532" LastActivityDate="2016-10-10T09:28:45.830" Title="Standard Gateway (Passive Network Partner)" Tags="|routing|subnet|mac-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35651" PostTypeId="1" AcceptedAnswerId="35653" CreationDate="2016-10-10T06:40:59.130" Score="3" ViewCount="1098" Body="&lt;p&gt;I created an SSH tunnel and using it as SOCKSv5 proxy on Firefox. I checked &lt;code&gt;whatismyipaddress.com&lt;/code&gt; and some other sites, they could not detect a proxy on my computer and shows my location on the server's country. However, I couldn't access to some sites...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could the ISP track my traffic and block my access to a site while I am using SSH tunnel? If yes, how could they detect the traffic over an encrypted SSH connection? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: If I login to my server and use &lt;code&gt;wget&lt;/code&gt;, I am able to download the &lt;code&gt;html&lt;/code&gt; content of the websites.&lt;/p&gt;&#xA;" OwnerUserId="18816" LastEditorUserId="18816" LastEditDate="2016-10-10T15:02:30.050" LastActivityDate="2016-10-10T15:02:30.050" Title="Could accessed sites over an SSH tunnel be tracked by ISP?" Tags="|isp|tunnel|ssh|proxy|" AnswerCount="1" CommentCount="5" ClosedDate="2016-10-10T15:03:07.900" ContentLicense="CC BY-SA 3.0" />
  <row Id="35652" PostTypeId="1" AcceptedAnswerId="35657" CreationDate="2016-10-10T07:31:02.553" Score="1" ViewCount="518" Body="&lt;p&gt;I have a Cisco 2960-X switch and a Cisco SG-300 switch. I created VLANs on 2960-X switch (e.g. VLAN 10 with ports 1-5 and VLAN 20 with ports 6-10) and allow &lt;strong&gt;DHCP for each VLAN&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, &lt;strong&gt;laptop 10.10.1.2 and laptop 10.10.2.2 can ping each other successfully&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I connect SG-300 into a port of VLAN 20. VLAN 20 assigns it an IP address 10.10.2.3 by DHCP. &lt;/li&gt;&#xA;&lt;li&gt;I connect a third laptop into one port of SG-300 switch. It got an IP address 10.10.2.4 automatically (I did not do any configure on SG-300, a new switch)&lt;/li&gt;&#xA;&lt;li&gt;laptop 10.10.2.4 can ping 10.10.1.2 successfully.&lt;/li&gt;&#xA;&lt;li&gt;laptop 10.10.1.2 can ping 10.10.2.3, but cannot ping 10.10.2.4, which is behind SG-300 switch.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Hence, to make &lt;strong&gt;10.10.1.2 ping 10.10.2.4 each other&lt;/strong&gt; successfully, &lt;strong&gt;how to configure SG-300 switch&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ADiw5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ADiw5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22125" LastActivityDate="2021-01-11T10:03:05.560" Title="Ping issue: connect a switch into another switch's vlan port" Tags="|cisco|routing|switch|ping|ip-forwarding-table|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35653" PostTypeId="2" ParentId="35651" CreationDate="2016-10-10T08:54:57.960" Score="5" Body="&lt;p&gt;The DNS is issued by default from your local host, not from the proxy, when using SOCKS (probably because SOCKS4 didn't support other way).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure you have checked the checkbox &quot;Remote DNS&quot; in the Proxy configuration of the Firefox:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3OcAK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3OcAK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31147" LastActivityDate="2016-10-10T08:54:57.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35654" PostTypeId="1" AcceptedAnswerId="35656" CreationDate="2016-10-10T09:08:39.427" Score="1" ViewCount="3078" Body="&lt;p&gt;I'm trying to configure the VPN on a Cisco ASA 5510. I can connect to it without any problem and I can ping my switch (&lt;code&gt;172.16.1.2/24&lt;/code&gt;) but I can't &lt;code&gt;ping&lt;/code&gt; the gateway (&lt;code&gt;172.16.1.1/24&lt;/code&gt;) nor the Google public DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my config :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA Version 9.1(1)&#xA;!&#xA;hostname ciscoasa&#xA;names&#xA;ip local pool VPN-POOL 172.16.50.1-172.16.50.10 mask 255.255.255.0&#xA;!&#xA;interface Ethernet0/0&#xA;    speed 100&#xA;    duplex full&#xA;    nameif outside&#xA;    security-level 0&#xA;    ip address x.x.x.x 255.255.255.252&#xA;!&#xA;interface Ethernet0/1&#xA;    channel-group 1 mode active&#xA;    no nameif&#xA;    no security-level&#xA;    no ip address&#xA;!&#xA;interface Ethernet0/2&#xA;    channel-group 1 mode active&#xA;    no nameif&#xA;    no security-level&#xA;    no ip address&#xA;!&#xA;interface Ethernet0/3&#xA;    shutdown&#xA;    no nameif&#xA;    no security-level&#xA;    no ip address&#xA;!&#xA;interface Management0/0&#xA;    management-only&#xA;    shutdown&#xA;    no nameif&#xA;    no security-level&#xA;    no ip address&#xA;!&#xA;interface Port-channel1&#xA;    nameif inside&#xA;    security-level 100&#xA;    ip address 172.16.1.1 255.255.255.0&#xA;!&#xA;ftp mode passive&#xA;object network obj-anyconnect&#xA;    subnet 172.16.50.0 255.255.255.0&#xA;object network inside-global&#xA;    subnet 172.16.0.0 255.255.0.0&#xA;object-group network DM_INLINE_NETWORK_1&#xA;    network-object 172.16.1.0 255.255.255.0&#xA;    network-object object obj-anyconnect&#xA;object-group service DM_INLINE_SERVICE_1&#xA;    service-object icmp&#xA;    service-object tcp-udp destination eq domain&#xA;    service-object tcp-udp destination eq www&#xA;    service-object tcp destination eq https&#xA;access-list global_access extended permit icmp any4 any4&#xA;access-list Any standard permit 172.16.1.0 255.255.255.0&#xA;access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any&#xA;access-list inside_access_in extended permit ip object obj-anyconnect object inside-global&#xA;pager lines 24&#xA;logging asdm informational&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (inside,outside) source static inside-global inside-global destination static obj-anyconnect obj-anyconnect&#xA;nat (any,outside) source dynamic any interface&#xA;access-group inside_access_in in interface inside&#xA;access-group global_access global&#xA;!&#xA;router ospf 1&#xA;    network 172.16.1.0 255.255.255.0 area 0&#xA;    area 0&#xA;    log-adj-changes&#xA;!&#xA;route outside 0.0.0.0 0.0.0.0 160.98.6.25 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL&#xA;aaa local authentication attempts max-fail 16&#xA;http server enable&#xA;http 160.98.0.0 255.255.0.0 outside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpoint SelfsignedCert&#xA;    enrollment self&#xA;    subject-name CN=ciscoasa&#xA;    keypair SSLCert&#xA;    crl configure&#xA;crypto ca trustpool policy&#xA;crypto ca certificate chain SelfsignedCert&#xA;    certificate 82afec57&#xA;        308202d4 308201bc a0030201 02020482 afec5730 0d06092a 864886f7 0d010105&#xA;        0500302c 3111300f 06035504 03130863 6973636f 61736131 17301506 092a8648&#xA;        86f70d01 09021608 63697363 6f617361 301e170d 31363130 30363131 31373334&#xA;        5a170d32 36313030 34313131 3733345a 302c3111 300f0603 55040313 08636973&#xA;        636f6173 61311730 1506092a 864886f7 0d010902 16086369 73636f61 73613082&#xA;        0122300d 06092a86 4886f70d 01010105 00038201 0f003082 010a0282 010100bc&#xA;        e91e00f4 aeb6b1e5 4e579492 4abd0d6d 94bb8809 807f7fe8 e85a3771 89a92128&#xA;        43a942e5 b23f843e 0dd0a7e6 8bd74737 8c4caa21 6e13b306 25399f58 ba389a67&#xA;        b4c92552 883a6b1a d4a3066a ad42ef39 d0912086 08fcd1a4 f06ba6c6 c7f20343&#xA;        88eb339a 9dac789c b3bc4576 d99cc520 280dd608 30010f91 9f883861 373996ac&#xA;        a0ab2024 2cbb20d1 f53d0092 ac854d01 a9726e79 2624aab9 11b41d42 639e250f&#xA;        3703b0f8 8f1269b7 029fefad 539bb7c2 298a7753 36fd6af4 d2d7c93f caecb446&#xA;        aef2c298 a9fae6cd b7acac65 2b9afa0c ec181f42 0de75545 325b959f c46a3085&#xA;        4f53844f 6bad59f3 93a7ad96 0ec572a7 506f4477 5dc173c8 9229ba09 f0e5b702&#xA;        03010001 300d0609 2a864886 f70d0101 05050003 82010100 7a933c83 d10399f6&#xA;        7a390c7d a425551d 78dc604f e8cfdd7c 61b3be05 0376059f a5a02960 07d63f1f&#xA;        f4bc98c6 b62aa170 c8e164da e559256e 8be5a831 38fbbacb f2785f33 8aeb2707&#xA;        a7d42227 253e6fa1 196ee003 46ec604e 43a21de8 8d86c5ca cb1b3498 1f535123&#xA;        d22339da 42c3b08f d2a99abb 4de02a70 1ccca085 dbf3c124 3ffb2fd5 b70fe04a&#xA;        fea0718c b37e35a3 9c73320c 882ddf42 46127071 3db606aa 53c63483 2de07373&#xA;        7d0c7070 52d56e23 37bd0487 1c8391c4 c75a2006 ee5ccb44 e638d9d2 21879e36&#xA;        af699fb2 e8b73fd3 6bedec3f eb4518f5 cddcc27f 132b67bb 8ec133a5 cc0fce6f&#xA;        4ead7b54 af1bc6fb e2ec4665 2002c8a0 c716ade1 e5f8fece&#xA;    quit&#xA;telnet timeout 5&#xA;ssh 160.98.0.0 255.255.0.0 outside&#xA;ssh timeout 5&#xA;console timeout 0&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;ssl trust-point SelfsignedCert outside&#xA;webvpn&#xA;    enable outside&#xA;    anyconnect image disk0:/anyconnect-macosx-i386-3.1.04066-k9.pkg 1&#xA;    anyconnect enable&#xA;    tunnel-group-list enable&#xA;group-policy GroupPolicy_employer internal&#xA;group-policy GroupPolicy_employer attributes&#xA;    wins-server none&#xA;    dns-server value 8.8.8.8&#xA;    vpn-tunnel-protocol ssl-client&#xA;    default-domain none&#xA;username user password xxxx encrypted&#xA;tunnel-group employer type remote-access&#xA;tunnel-group employer general-attributes&#xA;    address-pool VPN-POOL&#xA;    default-group-policy GroupPolicy_employer&#xA;tunnel-group employer webvpn-attributes&#xA;    group-alias employer enable&#xA;!&#xA;class-map inspection_default&#xA;    match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA;    parameters&#xA;        message-length maximum client auto&#xA;        message-length maximum 512&#xA;policy-map global_policy&#xA;    class inspection_default&#xA;        inspect dns preset_dns_map&#xA;        inspect ftp&#xA;        inspect h323 h225&#xA;        inspect h323 ras&#xA;        inspect rsh&#xA;        inspect rtsp&#xA;        inspect esmtp&#xA;        inspect sqlnet&#xA;        inspect skinny&#xA;        inspect sunrpc&#xA;        inspect xdmcp&#xA;        inspect sip&#xA;        inspect netbios&#xA;        inspect tftp&#xA;        inspect ip-options&#xA;!&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;Cryptochecksum:fb98abef6a3811bb0306150b705b9fc1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31148" LastEditorUserId="24187" LastEditDate="2016-10-10T09:27:05.837" LastActivityDate="2020-07-22T02:38:23.973" Title="Ping LAN via Anyconnect VPN" Tags="|cisco|cisco-asa|vpn|cisco-anyconnect|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35655" PostTypeId="2" ParentId="35650" CreationDate="2016-10-10T09:23:18.513" Score="1" Body="&lt;p&gt;The first statement is correct. Every device in a network needs to know the &lt;code&gt;default gateway&lt;/code&gt; IP address in order to be able to send packets to another network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second one isn't true, because when the device in network B inspects the IP layer, it finds that the &lt;code&gt;source IP adddress&lt;/code&gt; belongs to &lt;em&gt;network A&lt;/em&gt;. So it will try to send the reply through its own &lt;code&gt;default gateway&lt;/code&gt; and if it doesn't know the default gateway IP, it will discard the packet.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2016-10-10T09:28:45.830" LastActivityDate="2016-10-10T09:28:45.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35656" PostTypeId="2" ParentId="35654" CreationDate="2016-10-10T09:32:57.847" Score="3" Body="&lt;p&gt;1) To allow traffic from the Anyconnect client (which is on the outside) to go to the Internet (also outside) you need to enable:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;same-security-traffic permit intra-interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is also known as &lt;em&gt;Hairpinning&lt;/em&gt; since the traffic makes a U-turn at the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cfr. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/vpnsysop.html?bookSearch=true#wp1042114&quot; rel=&quot;nofollow&quot;&gt;Permitting Intra-Interface Traffic (Hairpinning)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;2) To allow the ping to the inside interface to work from the outside, you need:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;management-access inside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that this will also enable other forms of to-the-box traffic (SNMP, SSH, etc.) over the tunnel.&#xA;See &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/access_management.html&quot; rel=&quot;nofollow&quot;&gt;Enabling Management Access&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;3) To make ping work through the ASA you may also need&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map global_policy&#xA;    class inspection_default&#xA;        inspect icmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;4) To make ping work TO the ASA inside interface, you may also need&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;icmp permit obj-anyconnect inside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-10-10T10:23:59.563" LastActivityDate="2016-10-10T10:23:59.563" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35657" PostTypeId="2" ParentId="35652" CreationDate="2016-10-10T09:48:55.877" Score="3" Body="&lt;p&gt;(copying from the comments as it was confirmed to be the solution)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If 10.10.2.4 can ping 10.10.1.2 successfully then L2 and L3 connectivity appear to be ok and so 10.10.1.2 should also be able to ping 10.10.2.4. If not, then the most likely explanation is that a host-based firewall on 10.10.2.4 is dropping the pings.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-10T09:48:55.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35662" PostTypeId="1" AcceptedAnswerId="35664" CreationDate="2016-10-10T14:31:04.623" Score="1" ViewCount="242" Body="&lt;p&gt;Q1: I have read that in layer 2, if any of the links of a portchannel goes down,the cost of the portchannel is recalculated. Does that apply to L3 portchannel also?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, assume I am running OSPF in a port channel environment, and one of the links of the portchannel goes down, will the SPF be recomputed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2: Why at all the cost recalculation take place in layer 2 portchannel when the link goes down? I mean, STP treats the entire port channel as a single link, so why the reconvergence happens?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="8499" LastEditDate="2019-01-05T01:37:52.507" LastActivityDate="2019-01-05T01:37:52.507" Title="L3 Etherchannel cost calculation" Tags="|routing|ip|ipv4|ospf|etherchannel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35663" PostTypeId="2" ParentId="33946" CreationDate="2016-10-10T15:12:19.427" Score="2" Body="&lt;p&gt;You missed the &lt;code&gt;vlan NNN&lt;/code&gt; statement at the end of the last line. Your &lt;code&gt;vlan_99_ip&lt;/code&gt; is the mnemonic name of the L3 switch interface. It can't be assigned to the vlan 99 automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You config should be like this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 99 name &quot;IP management&quot;&#xA;vlan 99 members port 1/1/1 untagged&#xA;ip interface vlan_99_ip address 192.168.164.33 mask 255.255.255.0 vlan 99 admin enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BTW, the command &lt;code&gt;show ip interface&lt;/code&gt; show you which vlan your interface is bound to. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-&amp;gt; show ip interface&#xA;Total 4 interfaces&#xA;        Name            IP Address     Subnet Mask   Status Forward  Device&#xA;--------------------+---------------+---------------+------+-------+--------&#xA;HJHJH                0.0.0.0         0.0.0.0           DOWN      NO unbound&#xA;Loopback             127.0.0.1       255.0.0.0           UP      NO Loopback&#xA;MGMT                 10.0.0.101      255.255.255.0     DOWN      NO vlan 200&#xA;VLAN-355             192.168.1.15    255.255.255.0       UP     YES vlan 355&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31158" LastEditorUserId="8499" LastEditDate="2016-10-10T15:28:31.127" LastActivityDate="2016-10-10T15:28:31.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35664" PostTypeId="2" ParentId="35662" CreationDate="2016-10-10T15:26:26.253" Score="1" Body="&lt;p&gt;You didn't tag this with a vendor, but you use the Cisco term, &quot;portchannel,&quot; so I assume you mean this as a Cisco question.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q1: I have read that in layer 2, if any of the links of a portchannel&#xA;  goes down,the cost of the portchannel is recalculated. Does that apply&#xA;  to L3 portchannel also?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, the link gets a new layer-3 cost if the routing protocol dynamically calculates this. For instance RIP would not change the metric, but OSPF would change the metric.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If so, assume I am running OSPF in a port channel environment, and one&#xA;  of the links of the portchannel goes down, will the SPF be recomputed?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, OSPF will change the metric and the routers in an area would all rerun the SPF algorithm.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q2: Why at all the cost recalculation take place in layer 2&#xA;  portchannel when the link goes down? I mean, STP treats the entire port&#xA;  channel as a single link, so why the reconvergence happens?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It does this because that link may no longer be the preferred link; the bandwidth of the link has changed.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-10T15:26:26.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35666" PostTypeId="1" AcceptedAnswerId="35667" CreationDate="2016-10-10T17:00:44.810" Score="1" ViewCount="260" Body="&lt;p&gt;I've been tasked with upgrading our network and could use some input. We have 2 networks coming in currently to a single C7206VXR. We are now adding a second 7206 and wish to use it properly to better balance our traffic and add some much-needed redundancy. We have a distribution layer consisting now of 5 Dell PowerConnect 5224s, which are replacing 100M C3500s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each 7206 has a PNE-G1 w/3 gigE ports, plus 2x PA-GE GigE and 2x 100M Ethernet cards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;General idea:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[net1]     [net2]&#xA;   |         |        &amp;lt;- NPE-G1 port&#xA;[7206] &amp;lt;-&amp;gt; [7206]&#xA;   |         |        &amp;lt;- PA-GE port&#xA;[sw1 ]       |&#xA; [sw2 ] &amp;lt;----+&#xA;  [sw3 ]&#xA;   [sw4 ]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Should I connect each incoming network to a separate 7206, then cross-connect the 2 7206s? If so, should I advertise the routes between the two dynamically or by using static routes?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;At the distribution layer I am placing 2 switches in each of our 2 cabinets. How should I connect the 2 7206s? I initially though about designating a network to each switch, but should I instead just cascade all the switches and connect each 7206 to a different switch?  OR, since I have 5 gigE ports on the routers, should I connect all the switches directly to the routers?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My goal is to use each of the components as efficiently as possible.&lt;/p&gt;&#xA;" OwnerUserId="31037" LastEditorUserId="8499" LastEditDate="2018-12-25T02:47:16.413" LastActivityDate="2018-12-25T02:47:16.413" Title="Deploying a balanced, redundant network with 2 WAN networks" Tags="|cisco|routing|design|cisco-7200|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35667" PostTypeId="2" ParentId="35666" CreationDate="2016-10-10T17:24:38.780" Score="1" Body="&lt;p&gt;Since you can stack the four switches to look like a single switch, that would be a good thing to do. It greatly simplifies things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably should connect the two WAN routers to each other, then you can run a routing protocol between them, and it can route traffic from one to the other without needing to go through a user VLAN and the switch(es). With default routes, you want the primary router to have a lower AD than the other on the default route. Run a routing protocol between them, and configure HSRP or VRRP on the VLANs with tracking of the WAN link for failover to the other router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connect each WAN router to a different switch in the stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connect the access switches with a connection to each of two separate switches in the stack, and you can channel the links together. This is much, much faster to converge in a failover situation; it doesn't need to wait for STP to converge.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-10T18:44:40.103" LastActivityDate="2016-10-10T18:44:40.103" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35668" PostTypeId="1" CreationDate="2016-10-10T18:14:27.987" Score="1" ViewCount="57" Body="&lt;p&gt;We use VoIP phones in our company.&#xA;Some people calls and each one connected to first free operator, and each people calls us once a week, we need one more option to make better experience for our customers: for example John calls us and connected to Mary and they talk then John gives Mary some information about himself and Mary advise him. So when john calls us again, we need a system that identify him and switch his call to Mary automatically! so second calls and third calls always connected to a familiar operators, and this helps customers to have better experience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it possible? How should i do this? and what we need?&lt;/p&gt;&#xA;" OwnerUserId="31162" LastActivityDate="2016-10-11T05:59:10.483" Title="Smart switching calls in a company phone calls" Tags="|switch|switching|voip|telephony|cisco-7900-ip-phones|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35669" PostTypeId="2" ParentId="35573" CreationDate="2016-10-10T19:59:05.597" Score="0" Body="&lt;p&gt;I see some good suggestions already that you should follow plus I have some other observations for both good practice and what I think is causing the real issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondary Issues:&#xA;1. I see you are using both DTP and VTP on switch 1 and VTP on the other switches. You should hard code your trunk mode on all switch-to-switch links and turn off DTP negotiation with the no-negotiation command. Note:  Only after you do manual pruning (switchport trunk allowed vlan xxx) should you stop VTP changes and pruning by changing the VTP mode to transparent. I do not see any VTP configs in your show run output so I am going to assume you are running VTP version 2. &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;I would hard code the trunk encapsulation mode to dot1q even though your show interface trunk output shows that they are all running dot1q.  If the platform and version of IOS you are running only uses dot1q encapsulation and will not take the &quot;switchport trunk encapsulation dot1q&quot; command on the trunk interfaces then ignore this.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Primary issue:&#xA;When I look at your spanning tree output for switch 1 and switch 2 they show different versions of spanning tree protocol running for VLAN 1 and VLAN 4 on the same link connecting them together.  That is not right.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the Spanning-tree output on Switch 1 you see,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN0001&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;Gi0/24           Desg FWD 4         128.17   P2p Peer(STP)&#xA;&#xA;VLAN0004&#xA;Gi0/18           Desg FWD 4         128.18   P2p&#xA;Gi0/24           Desg FWD 4         128.17   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and from the spanning-tree output on Switch 2 you see,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN0001&#xA;Interface        Role Sts Cost      Prio.Nbr Type&#xA;Gi0/17           Desg FWD 4         128.17   P2p Peer(STP)&#xA;&#xA;VLAN0004&#xA;Gi0/17           Desg FWD 4         128.17   P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you see the spanning-tree type is P2P, it means it is running rapid per vlan spanning tree protocol or in the case of Switch 2 PVST (though the output of show spanning-tree is different from what I would expect).  When you see &quot;P2p Peer(STP)&quot; it means that it has fallen back to common spanning-tree protocol (aka 1 STP instance for all VLANs running on VLAN 1). I think that you have mixed your configurations and your show spanning-tree output - meaning that the show output was taken after you made changes to the running config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before doing anything I would do a &quot;show interface status&quot; and see if switch 1 or switch 2 has err-disabled one of the VLANs on the trunk port. This is just out of curiosity and to pinpoint the real cause of your problem. Flap the port (shut/no shut) if you see it is err-disabled on a vlan basis. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would fix this by doing each of the following steps in turn and check if it fixes the issue.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Change the spanning-tree mode on Switch 1 to Per-Vlan rapid spanning tree mode to match what you have on Switch 2,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;spanning-tree mode rapid-pvst&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Flap the link on both sides connecting Switch 1 and Switch 2 using shut and then no shut on their respective interfaces.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;And if that does not fix the issue, reload Switch 1.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I hope that fixes the issue. &lt;/p&gt;&#xA;" OwnerUserId="13357" LastActivityDate="2016-10-10T19:59:05.597" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35670" PostTypeId="2" ParentId="35668" CreationDate="2016-10-11T05:59:10.483" Score="2" Body="&lt;p&gt;Typically in order to handle this type of scenario, you need to add an ACD (Automatic Call Distribution) component to your telephony solution, and tie it into your CRM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea is that your CRM tool contains information that will allow the routing to be performed, such as whether a given caller has a primary assigned service rep, or simply who handled that caller's last call. The caller is usually identified by their phone number, and you might have an initial voice server step where you get more information (customer number or whatever) to help with the identification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a call comes in, the ACD will query the CRM for this info and based on the reply will instruct the telephony solution to route the call to the appropriate operator.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you can now buy all of this stuff in a SaaS/Cloud approach which is both independent of the brand of VoIP platform you are using, and much easier to setup than it once was. If you don't have a full CRM platform, it is often possible to use something more basic (essentially, a spreadsheet with customer name, phone number and preferred operator) to feed the ACD, but you don't get all the benefits then.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-10-11T05:59:10.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35672" PostTypeId="2" ParentId="2192" CreationDate="2016-10-11T08:38:20.417" Score="0" Body="&lt;p&gt;One could use a stack of switches to mitigate this issue of expiring MAC address entry in the second switch.&lt;/p&gt;&#xA;" OwnerUserId="31171" LastActivityDate="2016-10-11T08:38:20.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35676" PostTypeId="1" CreationDate="2016-10-11T11:32:28.230" Score="0" ViewCount="2531" Body="&lt;p&gt;I need to configure the trunk ports of the switch to tag all untagged frames with native VID.Configuring native vlan &quot;Cisco way&quot; is a solution. So I am looking for a way to configure native vlan on trunk ports of D-link DGS-3100 switches?&lt;/p&gt;&#xA;" OwnerUserId="31176" LastActivityDate="2016-10-11T12:04:10.497" Title="Native vlan on D-link switches" Tags="|switch|vlan|switching|trunk|" AnswerCount="1" CommentCount="1" ClosedDate="2016-10-11T14:27:19.523" ContentLicense="CC BY-SA 3.0" />
  <row Id="35677" PostTypeId="2" ParentId="35676" CreationDate="2016-10-11T12:04:10.497" Score="1" Body="&lt;p&gt;I don't have experience with D-Link Switches (actually the research I made to answer you question confort me in my postion to never ever buy those stuff for any serious network...) but from the documentation (found &lt;a href=&quot;http://www.dlink.com/uk/en/support/product/dgs-3100-series-managed-l2-stackable-gigabit-switches&quot; rel=&quot;nofollow&quot;&gt;here&lt;/a&gt;) , you should be able to set several vlan as tagged for a specific port and another one as untagged.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;you create VLAN 10 and set it as tagged for port 4&lt;/li&gt;&#xA;&lt;li&gt;you create VLAN 20 and set it as tagged for port 4&lt;/li&gt;&#xA;&lt;li&gt;you create VLAN 30 and sit it as untagged for port 4  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In command line :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;create vlan VLAN_10 tag 10&lt;br&gt;&#xA;    create vlan VLAN_20 tag 20&lt;br&gt;&#xA;    create vlan VLAN_30 tag 30&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;config vlan vlanid 10 add tagged 4&lt;br&gt;&#xA;    config vlan vlanid 20 add tagged 4&lt;br&gt;&#xA;    config vlan vlanid 30 add untagged 4&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In this configuration the port 4 will behave as a trunk port with native VLAN 30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that it's unclear if the port PVID will be set correctly with this configuration, there's PVID configuration command only within GVRP, so ???&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that D-Link use the term &lt;code&gt;trunk&lt;/code&gt; for both Link Aggregation and VLAN trunking which could be confusing.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-10-11T12:04:10.497" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35680" PostTypeId="1" AcceptedAnswerId="36457" CreationDate="2016-10-11T13:18:11.140" Score="0" ViewCount="263" Body="&lt;p&gt;This is my first time here. So, apologies if I get something wrong. I am trying to draw an inter-DC topology for which I want to use a Cisco icon for datacentre. Until now my search has been futile and I haven't found anything useful. So, I want to ask you if an icon for a datacentre exists at all. I would like to use this for my picture. Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="31183" LastActivityDate="2017-08-08T07:48:12.957" Title="Cisco Icon for a datacenter?" Tags="|cisco|topology|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35681" PostTypeId="2" ParentId="35680" CreationDate="2016-10-11T13:32:31.683" Score="1" Body="&lt;p&gt;Currently, there is no single icon that depicts a data center. However, there is an abundance of icons depicting elements of a data center. Just to name a few: FC storage; FDDI ring; FC disk subsystem; &#xA;file server; storage router; storage server. &lt;a href=&quot;http://www.cisco.com/c/en/us/about/brand-center/network-topology-icons.html&quot; rel=&quot;nofollow&quot;&gt;Here&lt;/a&gt; you can download them in various formats.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2016-10-11T13:32:31.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35684" PostTypeId="1" AcceptedAnswerId="35686" CreationDate="2016-10-11T13:53:21.757" Score="2" ViewCount="1844" Body="&lt;p&gt;This is a question I've seen mixed answers for online, so I'll try to clearly explain what I'm having trouble understanding. With RIP, you have your router and you explicitly tell it your directly connected networks like such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network [network address of the network linking the two routers]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, from what I understand, OSPF does not do this. Instead, you configure your interfaces for OSPF like such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network [address of Serial 0 (for example)] [wildcard address] area [X]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question therefore is: &lt;strong&gt;If you're configuring interfaces rather than networks, how does OSPF come to understand the network between two routers?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I do have a theory as to why, but I'm not sure. I'm thinking that because your Serial 0 (for example) and another routers Serial 1 (for example) will have the same subnet mask, the wildcard address tells OSPF that these are on the same network. I'm not sure if this is correct, but I'd love some clarification on this if possible.&lt;/p&gt;&#xA;" OwnerUserId="31184" LastActivityDate="2016-10-23T03:13:48.513" Title="How does OSPF understand its directly connected networks if you're configuring interfaces?" Tags="|cisco|routing|ospf|rip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35686" PostTypeId="2" ParentId="35684" CreationDate="2016-10-11T14:06:07.093" Score="4" Body="&lt;p&gt;In OSPF the network statement is used to configure which interface will participate in the OSPF process (I.E on which interface to send and listen for Hello packets)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is done by comparing the value of the network statements (in ospf configuration) versus the network configured on all of the routers interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network configured in ospf doesn't have to be an exact match to the network configured on the interface. The latter can be a subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;interface 1 :  10.0.0.254/24  &lt;/li&gt;&#xA;  &lt;li&gt;interface 2 : 10.0.1.254.24  &lt;/li&gt;&#xA;  &lt;li&gt;inteface 3 : 10.0.2.254/24  &lt;/li&gt;&#xA;  &lt;li&gt;ospf : network 10.0.0.0/23&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With this configuration, interface 1 &amp;amp; 2 will participate in OSPF process, and not interface 3. This is because 10.0.0.0/24 and 10.0.1.0/24 are subnets of 10.0.0.0/23.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If later I want to add interface 3 in OSPF I can either add a second network statement...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;ospf : network 10.0.0.0/23&lt;/li&gt;&#xA;  &lt;li&gt;ospf : network 10.0.2.0/24&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;...or enlarge the first one :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;ospf : network 10.0.0.0/22&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(You can also use a very large mask in the ospf configuration and exclude some interfaces manually)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So OSPF will send HELLO packets on all interfaces with IP addresses that match the OSPF network statements, it will also respond to HELLO packets received on those interfaces. It will ignore HELLO packets on other interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the same time the OSPF network is used to configure the area in which the interface will be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you want all 3 interfaces to be in area 0 you will use :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;ospf : network 10.0.0.0/22 area 0&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you want to have interface 1 &amp;amp; 2 in area 0 and interface 3 in area 1 you have :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;&lt;p&gt;ospf : network 10.0.0.0/23 area 0&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;ospf : network 10.0.2.0/24 area 1&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2016-10-11T14:12:39.510" LastActivityDate="2016-10-11T14:12:39.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35687" PostTypeId="1" AcceptedAnswerId="35718" CreationDate="2016-10-11T14:50:29.507" Score="4" ViewCount="1218" Body="&lt;p&gt;I currently have a cisco 1841 router configured to authenticate users against a Windows NPS server. The strange thing is that when using local authentication the VPN connects first time every time. I then move the authentication from local to radius but then I am unable to login to the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When looking at the security logs on the Windows NPS server I can clearly see that the router is querying the server and that the server responds back saying the login is valid but the router never finishes the VPN login with radius.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I change &lt;code&gt;ppp authentication ms-chap-v2 remote-access&lt;/code&gt; for &lt;code&gt;ppp authentication ms-chap-v2&lt;/code&gt; then it will use local usernames and work fine.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;!&#xA;aaa group server radius radius-servers&#xA; server-private &amp;lt;ommitted ip&amp;gt; key 7 &amp;lt;ommitted secret&amp;gt;&#xA;!&#xA;aaa authentication login default local&#xA;aaa authentication ppp remote-access group radius-servers&#xA;!&#xA;vpdn enable&#xA;!&#xA;vpdn-group L2TP&#xA; ! Default L2TP VPDN group&#xA; accept-dialin&#xA;  protocol l2tp&#xA;  virtual-template 1&#xA; lcp renegotiation always&#xA; no l2tp tunnel authentication&#xA;!&#xA;!&#xA; crypto isakmp policy 1&#xA; encr aes 256&#xA; authentication pre-share&#xA; group 2&#xA; lifetime 3600&#xA;crypto isakmp key &amp;lt;omitted secret&amp;gt; address 0.0.0.0 0.0.0.0&#xA;crypto isakmp keepalive 3600&#xA;!&#xA;!&#xA;crypto ipsec transform-set remote-access-set esp-aes 256 esp-sha-hmac &#xA; mode transport&#xA;!&#xA;crypto dynamic-map remote-access-map 10&#xA; set transform-set remote-access-set &#xA;!&#xA;!&#xA;crypto map dynmap 65535 ipsec-isakmp dynamic remote-access-map &#xA;!&#xA;interface Virtual-Template1&#xA; ip unnumbered FastEthernet0/0.1&#xA; peer default ip address pool remote-access-pool&#xA; ppp mtu adaptive&#xA; ppp authentication ms-chap-v2 remote-access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;L2TP Debug:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Oct 12 06:49:23.270: L2TP       _____:________: I SCCRQ, flg TLS, ver 2, len 69&#xA;*Oct 12 06:49:23.270: L2TP       _____:________:  IETF v2:&#xA;*Oct 12 06:49:23.270: L2TP       _____:________:   Protocol Version  1, Revision 0&#xA;*Oct 12 06:49:23.274: L2TP       _____:________:   Framing Cap       both(0x3)&#xA;*Oct 12 06:49:23.274: L2TP       _____:________:   Hostname           &quot;thanatos...&quot;&#xA;*Oct 12 06:49:23.274: L2TP       _____:________:   Assigned Tunnel I 0x00000079 (121)&#xA;*Oct 12 06:49:23.274: L2TP       _____:________:   Rx Window Size    4&#xA;*Oct 12 06:49:23.274: L2TP       _____:________:  &#xA;*Oct 12 06:49:23.274: L2X  tnl   08023:________: Create logical tunnel&#xA;*Oct 12 06:49:23.274: L2TP tnl   08023:________: Create tunnel&#xA;*Oct 12 06:49:23.274: L2TP tnl   08023:________:     version set to V2&#xA;*Oct 12 06:49:23.274: L2TP tnl   08023:________:     remote ip set to &amp;lt;remote IP&amp;gt;&#xA;*Oct 12 06:49:23.274: L2TP tnl   08023:________:     local ip set to &amp;lt;external IP&amp;gt;&#xA;*Oct 12 06:49:23.274: L2TP tnl   08023:00007D8D: FSM-CC ev Rx-SCCRQ&#xA;*Oct 12 06:49:23.274: L2TP tnl   08023:00007D8D: FSM-CC    Idle-&amp;gt;Proc-SCCRQ&#xA;*Oct 12 06:49:23.274: L2TP tnl   08023:00007D8D: FSM-CC do Rx-SCCRQ&#xA;*Oct 12 06:49:23.278: L2X        _____:________: Tunnel author started for thanatos&#xA;*Oct 12 06:49:23.282: L2X        _____:________: Tunnel author found&#xA;*Oct 12 06:49:23.282: L2TP tnl   08023:00007D8D: Author reply, data source: &quot;L2TP&quot;&#xA;*Oct 12 06:49:23.282: L2X        _____:________: class [AAA author, group &quot;L2TP&quot;]&#xA;*Oct 12 06:49:23.282: L2X        _____:________:   created&#xA;*Oct 12 06:49:23.282: L2X        _____:________: class [AAA author, group &quot;L2TP&quot;]&#xA;*Oct 12 06:49:23.282: L2X        _____:________:   App locked 0-&amp;gt;1&#xA;*Oct 12 06:49:23.282: L2X        _____:________: class [AAA author, group &quot;L2TP&quot;]&#xA;*Oct 12 06:49:23.282: L2X        _____:________:   Protocol locked 0-&amp;gt;1&#xA;*Oct 12 06:49:23.282: L2TP tnl   08023:00007D8D:     class name AAA author, group &quot;L2TP&quot;&#xA;*Oct 12 06:49:23.282: L2X        _____:________: class [AAA author, group &quot;L2TP&quot;]&#xA;*Oct 12 06:49:23.282: L2X        _____:________:   App unlocked 1-&amp;gt;0&#xA;*Oct 12 06:49:23.282: L2TP tnl   08023:00007D8D:     peer cap async set&#xA;*Oct 12 06:49:23.282: L2TP tnl   08023:00007D8D:     peer cap sync set&#xA;*Oct 12 06:49:23.282: L2TP tnl   08023:00007D8D: FSM-CC ev SCCRQ-OK&#xA;*Oct 12 06:49:23.282: L2TP tnl   08023:00007D8D: FSM-CC    Proc-SCCRQ-&amp;gt;Wt-SCCCN&#xA;*Oct 12 06:49:23.282: L2TP tnl   08023:00007D8D: FSM-CC do Tx-SCCRP&#xA;*Oct 12 06:49:23.282: L2X        _____:________: l2x_open_socket: is called&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D: Open sock &amp;lt;external IP&amp;gt;:1701-&amp;gt;&amp;lt;remote IP&amp;gt;:52700&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D: FSM-CC ev Sock-Ready&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D: FSM-CC    in Wt-SCCCN&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D: FSM-CC do Ignore-Sock-Up&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D: O SCCRP to thanatos tnl 121&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D:  IETF v2:&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D:   Protocol Version  1, Revision 0&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D:   Framing Cap       none(0x0)&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D:   Firmware Ver      0x1130&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D:   Hostname           &quot;rtr1&quot;&#xA;*Oct 12 06:49:23.286: L2TP tnl   08023:00007D8D:   Vendor Name       &#xA;*Oct 12 06:49:23.290: L2TP tnl   08023:00007D8D:      &quot;Cisco Systems, Inc.&quot;&#xA;*Oct 12 06:49:23.290: L2TP tnl   08023:00007D8D:   Assigned Tunnel I 0x00007D8D (32141)&#xA;*Oct 12 06:49:23.290: L2TP tnl   08023:00007D8D:   Rx Window Size    1024&#xA;*Oct 12 06:49:23.290: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:23.342: L2TP tnl   08023:00007D8D: Drain unsentQ, cur/max resendQ sz 0/4, unsentQ 0&#xA;*Oct 12 06:49:23.342: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:23.342: L2TP tnl   08023:00007D8D: I SCCCN, flg TLS, ver 2, len 20&#xA;*Oct 12 06:49:23.342: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:23.342: L2TP tnl   08023:00007D8D: FSM-CC ev Rx-SCCCN&#xA;*Oct 12 06:49:23.342: L2TP tnl   08023:00007D8D: FSM-CC    Wt-SCCCN-&amp;gt;Proc-SCCCN&#xA;*Oct 12 06:49:23.342: L2TP tnl   08023:00007D8D: FSM-CC do Rx-SCCCN&#xA;*Oct 12 06:49:23.342: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:23.342: L2TP tnl   08023:00007D8D: O ZLB ACK to thanatos tnl 121&#xA;*Oct 12 06:49:23.342: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:23.346: L2TP tnl   08023:00007D8D: FSM-CC ev SCCCN-OK&#xA;*Oct 12 06:49:23.346: L2TP tnl   08023:00007D8D: FSM-CC    Proc-SCCCN-&amp;gt;established&#xA;*Oct 12 06:49:23.346: L2TP tnl   08023:00007D8D: FSM-CC do Established&#xA;*Oct 12 06:49:23.346: L2TP tnl   08023:00007D8D: Control channel up&#xA;*Oct 12 06:49:23.346: L2TP tnl   08023:00007D8D:   &amp;lt;external IP&amp;gt;&amp;lt;-&amp;gt;&amp;lt;remote IP&amp;gt;&#xA;*Oct 12 06:49:23.346: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:23.346: L2TP tnl   08023:00007D8D: I ICRQ, flg TLS, ver 2, len 38&#xA;*Oct 12 06:49:23.346: L2TP tnl   08023:00007D8D:  IETF v2:&#xA;*Oct 12 06:49:23.346: L2TP tnl   08023:00007D8D:   Assigned Call ID  0x00000E8B (3723)&#xA;*Oct 12 06:49:23.346: L2TP tnl   08023:00007D8D:   Serial Number     1&#xA;*Oct 12 06:49:23.350: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:23.350: L2X  _____:_____:________: Create logical session&#xA;*Oct 12 06:49:23.350: L2TP _____:_____:________: Create session&#xA;*Oct 12 06:49:23.350: L2TP _____:_____:________:   Using ICRQ FSM&#xA;*Oct 12 06:49:23.350: L2TP _____:_____:________: FSM-Sn ev created&#xA;*Oct 12 06:49:23.350: L2TP _____:_____:________: FSM-Sn    Init-&amp;gt;Idle&#xA;*Oct 12 06:49:23.350: L2TP _____:_____:________: FSM-Sn do none&#xA;*Oct 12 06:49:23.350: L2TP _____:_____:________:     remote ip set to &amp;lt;remote IP&amp;gt;&#xA;*Oct 12 06:49:23.350: L2TP _____:_____:________:     local ip set to &amp;lt;external IP&amp;gt;&#xA;*Oct 12 06:49:23.350: L2TP tnl   08023:00007D8D: FSM-CC ev Session-Conn&#xA;*Oct 12 06:49:23.350: L2TP tnl   08023:00007D8D: FSM-CC    in established&#xA;*Oct 12 06:49:23.350: L2TP tnl   08023:00007D8D: FSM-CC do Session-Conn-Est&#xA;*Oct 12 06:49:23.350: L2TP tnl   08023:00007D8D:   Session count now 1&#xA;*Oct 12 06:49:23.350: L2TP _____:08023:00008D28: FSM-Sn ev CC-Up&#xA;*Oct 12 06:49:23.350: L2TP _____:08023:00008D28: FSM-Sn    in Idle&#xA;*Oct 12 06:49:23.350: L2TP _____:08023:00008D28: FSM-Sn do CC-Up-Ignore0-1&#xA;*Oct 12 06:49:23.350: L2TP _____:08023:00008D28: Session attached&#xA;*Oct 12 06:49:23.350: L2TP _____:08023:00008D28: FSM-Sn ev Rx-ICRQ&#xA;*Oct 12 06:49:23.350: L2TP _____:08023:00008D28: FSM-Sn    Idle-&amp;gt;Proc-ICRQ&#xA;*Oct 12 06:49:23.350: L2TP _____:08023:00008D28: FSM-Sn do Rx-ICRQ&#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28:   Chose application VPDN&#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28:   App type set to VPDN&#xA;*Oct 12 06:49:23.354: L2TP tnl   08023:00007D8D:   VPDN Session count now 1&#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28: VPDN: process AVPs&#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28: Set HA epoch to 0&#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28: Local AC is now UP&#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28: Remote AC is now UP&#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28:  &#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28: APP&amp;lt;-L2TP: Incoming&#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28:            sock 00000000&#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28:            serv 00008022&#xA;*Oct 12 06:49:23.354: L2TP _____:08023:00008D28:  &#xA;*Oct 12 06:49:23.358: L2TP _____:08023:00008D28: L2TUN: add sock 00001022&#xA;*Oct 12 06:49:23.358: L2TP _____:08023:00008D28:  &#xA;*Oct 12 06:49:23.358: L2TP _____:08023:00008D28: APP-&amp;gt;L2TP: Accept [6],&#xA;*Oct 12 06:49:23.358: L2TP _____:08023:00008D28:            sock 00001022&#xA;*Oct 12 06:49:23.358: L2TP _____:08023:00008D28:            serv 00008022&#xA;*Oct 12 06:49:23.358: L2TP _____:08023:00008D28:            data 68660C28[136]&#xA;*Oct 12 06:49:23.358: L2TP _____:08023:00008D28:            replied on new socket&#xA;*Oct 12 06:49:23.362: L2TP _____:08023:00008D28:  &#xA;*Oct 12 06:49:23.362: L2TP _____:08023:00008D28:   App type set to VPDN&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28:   UDP checksum ignore is enabled&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28:   Sequencing default tx disabled&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28:   Sequencing default rx disabled&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28:   Framing set to sync&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28:   Bearer set to none&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28: no cookies enabled&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28: FSM-Sn ev ICRQ-OK&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28: FSM-Sn    Proc-ICRQ-&amp;gt;Wt-Tx-ICRP&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28: FSM-Sn do Tx-ICRP-Local-Check&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28: FSM-Sn ev Local-Cont&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28: FSM-Sn    Wt-Tx-ICRP-&amp;gt;Wt-Rx-ICCN&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28: FSM-Sn do Tx-ICRP&#xA;*Oct 12 06:49:23.362: L2X        _____:________: l2x_open_socket: is called&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28: Open sock &amp;lt;external IP&amp;gt;:1701-&amp;gt;&amp;lt;remote IP&amp;gt;:52700&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28: FSM-Sn ev Sock-Ready&#xA;*Oct 12 06:49:23.362: L2TP 00023:08023:00008D28: FSM-Sn    in Wt-Rx-ICCN&#xA;*Oct 12 06:49:23.366: L2TP 00023:08023:00008D28: FSM-Sn do Ignore-Sock-Up&#xA;*Oct 12 06:49:23.366: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:23.366: L2TP 00023:08023:00008D28: O ICRP to thanatos 121/3723&#xA;*Oct 12 06:49:23.366: L2TP 00023:08023:00008D28:  IETF v2:&#xA;*Oct 12 06:49:23.366: L2TP 00023:08023:00008D28:   Assigned Call ID  0x00008D28 (36136)&#xA;*Oct 12 06:49:23.366: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:23.370: L2TP 00023:08023:00008D28: APP-&amp;gt;L2TP: Setup dataplane [15],&#xA;*Oct 12 06:49:23.370: L2TP 00023:08023:00008D28:            sock 00001022&#xA;*Oct 12 06:49:23.370: L2TP 00023:08023:00008D28:            serv 00008022&#xA;*Oct 12 06:49:23.370: L2TP 00023:08023:00008D28:            data 684D0DCC[20]&#xA;*Oct 12 06:49:23.370: L2TP 00023:08023:00008D28:            replied on same socket&#xA;*Oct 12 06:49:23.370: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:23.370: L2TP 00023:08023:00008D28: FSM-Sn ev DP-Setup&#xA;*Oct 12 06:49:23.370: L2TP 00023:08023:00008D28: FSM-Sn    in Wt-Rx-ICCN&#xA;*Oct 12 06:49:23.370: L2TP 00023:08023:00008D28: FSM-Sn do Ignore-DP-Setup&#xA;*Oct 12 06:49:23.422: L2TP tnl   08023:00007D8D: Drain unsentQ, cur/max resendQ sz 0/4, unsentQ 0&#xA;*Oct 12 06:49:23.422: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:23.422: L2TP 00023:08023:00008D28: I ICCN, flg TLS, ver 2, len 40&#xA;*Oct 12 06:49:23.422: L2TP 00023:08023:00008D28:  IETF v2:&#xA;*Oct 12 06:49:23.422: L2TP 00023:08023:00008D28:   Framing Type      both(3)&#xA;*Oct 12 06:49:23.422: L2TP 00023:08023:00008D28:   Connect Speed     1000000&#xA;*Oct 12 06:49:23.422: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:23.422: L2TP 00023:08023:00008D28: O ZLB ACK to thanatos 121/3723&#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28: FSM-Sn ev Rx-ICCN&#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28: FSM-Sn    Wt-Rx-ICCN-&amp;gt;Proc-ICCN&#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28: FSM-Sn do Rx-ICCN&#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28:   MTU is 65535&#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28: Session data plane UP&#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28: VPDN: process AVPs&#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28: APP&amp;lt;-L2TP: Connected&#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28:            sock 00001022&#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28:            serv 00008022&#xA;*Oct 12 06:49:23.426: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:23.430: L2TP 00023:08023:00008D28: FSM-Sn ev ICCN-OK&#xA;*Oct 12 06:49:23.430: L2TP 00023:08023:00008D28: FSM-Sn    Proc-ICCN-&amp;gt;established&#xA;*Oct 12 06:49:23.430: L2TP 00023:08023:00008D28: FSM-Sn do Established&#xA;*Oct 12 06:49:23.430: L2TP 00023:08023:00008D28: Session up&#xA;*Oct 12 06:49:23.430: L2TP 00023:08023:00008D28:   &amp;lt;external IP&amp;gt;&amp;lt;-&amp;gt;&amp;lt;remote IP&amp;gt;&#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28: APP-&amp;gt;L2TP: Session updated [12],&#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:            sock 00001022&#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:            serv 00008022&#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:            data 684874F8[98]&#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:            replied on same socket&#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:   App type set to VPDN&#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:   Sequencing default tx disabled&#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:   Sequencing default rx disabled&#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:   Framing set to sync&#xA;*Oct 12 06:49:26.582: L2TP 00023:08023:00008D28:   Bearer set to none&#xA;*Oct 12 06:49:26.586: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.586: L2TP 00023:08023:00008D28: APP&amp;lt;-L2TP: Dataplane up&#xA;*Oct 12 06:49:26.586: L2TP 00023:08023:00008D28:            sock 00001022&#xA;*Oct 12 06:49:26.586: L2TP 00023:08023:00008D28:            serv 00008022&#xA;*Oct 12 06:49:26.586: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.586: L2TP 00023:08023:00008D28: FSM-Sn ev DP-Up&#xA;*Oct 12 06:49:26.586: L2TP 00023:08023:00008D28: FSM-Sn    in established&#xA;*Oct 12 06:49:26.590: L2TP 00023:08023:00008D28: FSM-Sn do Ignore-DP-UP&#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28: APP-&amp;gt;L2TP: Session updated [12],&#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:            sock 00001022&#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:            serv 00008022&#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:            data 68488A7C[111]&#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:            replied on same socket&#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:   App type set to VPDN&#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:   Sequencing default tx disabled&#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:   Sequencing default rx disabled&#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:   Framing set to sync&#xA;*Oct 12 06:49:26.594: L2TP 00023:08023:00008D28:   Bearer set to none&#xA;*Oct 12 06:49:26.598: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.598: L2TP 00023:08023:00008D28: APP-&amp;gt;L2TP: Session updated [12],&#xA;*Oct 12 06:49:26.598: L2TP 00023:08023:00008D28:            sock 00001022&#xA;*Oct 12 06:49:26.598: L2TP 00023:08023:00008D28:            serv 00008022&#xA;*Oct 12 06:49:26.598: L2TP 00023:08023:00008D28:            data 683515A8[66]&#xA;*Oct 12 06:49:26.598: L2TP 00023:08023:00008D28:            replied on same socket&#xA;*Oct 12 06:49:26.598: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.598: L2TP 00023:08023:00008D28:   App type set to VPDN&#xA;*Oct 12 06:49:26.598: L2TP 00023:08023:00008D28:   Sequencing default tx disabled&#xA;*Oct 12 06:49:26.602: L2TP 00023:08023:00008D28:   Sequencing default rx disabled&#xA;*Oct 12 06:49:26.602: L2TP 00023:08023:00008D28:   Framing set to sync&#xA;*Oct 12 06:49:26.602: L2TP 00023:08023:00008D28:   Bearer set to none&#xA;*Oct 12 06:49:26.654: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.654: L2TP 00023:08023:00008D28: APP-&amp;gt;L2TP: local circuit status [21],&#xA;*Oct 12 06:49:26.654: L2TP 00023:08023:00008D28:            sock 00001022&#xA;*Oct 12 06:49:26.654: L2TP 00023:08023:00008D28:            serv 00008022&#xA;*Oct 12 06:49:26.654: L2TP 00023:08023:00008D28:            data 684C65C8[41]&#xA;*Oct 12 06:49:26.654: L2TP 00023:08023:00008D28:            replied on same socket&#xA;*Oct 12 06:49:26.654: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.682: L2TP 00023:08023:00008D28: I CDN, flg TLS, ver 2, len 42&#xA;*Oct 12 06:49:26.682: L2TP 00023:08023:00008D28:  IETF v2:&#xA;*Oct 12 06:49:26.682: L2TP 00023:08023:00008D28:   Result Code       &#xA;*Oct 12 06:49:26.682: L2TP 00023:08023:00008D28:     Reserved(768)&#xA;*Oct 12 06:49:26.682: L2TP 00023:08023:00008D28:     Error code&#xA;*Oct 12 06:49:26.682: L2TP 00023:08023:00008D28:       No error(0)&#xA;*Oct 12 06:49:26.682: L2TP 00023:08023:00008D28:     Optional msg&#xA;*Oct 12 06:49:26.682: L2TP 00023:08023:00008D28:        &quot;&amp;lt;00&amp;gt;&amp;lt;03&amp;gt;&amp;lt;00&amp;gt;&amp;lt;00&amp;gt;&quot;&#xA;*Oct 12 06:49:26.682: L2TP 00023:08023:00008D28:   Assigned Call ID  0x00000E8B (3723)&#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28: O ZLB ACK to thanatos 121/3723&#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28: FSM-Sn ev Rx-CDN&#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28: FSM-Sn    established-&amp;gt;Idle&#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28: FSM-Sn do Rx-CDN&#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28: VPDN: process AVPs&#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28: Shutting down session&#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28:   Result Code&#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28:     Reserved (0)&#xA;*Oct 12 06:49:26.686: L2TP 00023:08023:00008D28:   Error Code&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28:     No error (0)&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28:   Vendor Error&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28:     None (0)&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28: FSM-Sn ev Shut&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28: FSM-Sn    Idle-&amp;gt;Dead&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28: FSM-Sn do Destroy&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28: APP&amp;lt;-L2TP: Disconnect&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28:            sock 00001022&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28:            serv 00008022&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28:  &#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28: Session down&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28:   &amp;lt;external IP&amp;gt;&amp;lt;-&amp;gt;&amp;lt;remote IP&amp;gt;&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28: Destroying session&#xA;*Oct 12 06:49:26.690: L2TP 00023:08023:00008D28: Request teardown data plane&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D: FSM-CC ev Session-Disc&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D: FSM-CC    in established&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D: FSM-CC do Session-Disc-Est&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D:   Session count now 0&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D:   VPDN Session count now 0&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D: FSM-CC ev No-Users&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D: FSM-CC    established-&amp;gt;Est-No-User&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D: FSM-CC do No-Users&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D: No more cc users, shutdown (likely) in 10 secs&#xA;*Oct 12 06:49:26.694: L2TP 00023:_____:________: Session detached&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D: StopCCN: skip authen, no nonce yet&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D: I StopCCN, flg TLS, ver 2, len 42&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D:  IETF v2:&#xA;*Oct 12 06:49:26.694: L2TP tnl   08023:00007D8D:   Result Code       &#xA;*Oct 12 06:49:26.698: L2TP tnl   08023:00007D8D:     No error(256)&#xA;*Oct 12 06:49:26.698: L2TP tnl   08023:00007D8D:     Error code&#xA;*Oct 12 06:49:26.698: L2TP tnl   08023:00007D8D:       No error(0)&#xA;*Oct 12 06:49:26.698: L2TP tnl   08023:00007D8D:     Optional msg&#xA;*Oct 12 06:49:26.698: L2TP tnl   08023:00007D8D:        &quot;&amp;lt;00&amp;gt;&amp;lt;03&amp;gt;&amp;lt;00&amp;gt;&amp;lt;00&amp;gt;&quot;&#xA;*Oct 12 06:49:26.698: L2TP tnl   08023:00007D8D:   Assigned Tunnel I 0x00000079 (121)&#xA;*Oct 12 06:49:26.698: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:26.698: L2TP tnl   08023:00007D8D: O ZLB ACK to thanatos tnl 121&#xA;*Oct 12 06:49:26.698: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: FSM-CC ev Rx-StopCCN&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: FSM-CC    in Est-No-User&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: FSM-CC do Rx-StopCCN&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: Shutting down tunnel&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D:   Result Code&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D:     No error&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D:   Error Code&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D:     No error&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D:   Vendor Error&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D:     None&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D:  &#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: FSM-CC ev Shut-Now&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: FSM-CC    Est-No-User-&amp;gt;Wt-STOPACK&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: FSM-CC do Shutnow&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: FSM-CC ev Shut-Comp&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: FSM-CC    Wt-STOPACK-&amp;gt;Dead&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: FSM-CC do Shutdown-Completed&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D: Control channel down&#xA;*Oct 12 06:49:26.702: L2TP tnl   08023:00007D8D:   &amp;lt;external IP&amp;gt;&amp;lt;-&amp;gt;&amp;lt;remote IP&amp;gt;&#xA;*Oct 12 06:49:26.706: L2TP tnl   08023:00007D8D: Destroying tunnel&#xA;*Oct 12 06:49:26.706: L2TP: Removing per-cc stats db entry, tun-id 32141&#xA;*Oct 12 06:49:26.706: L2X  tnl   08023:________: Destroying logical tunnel&#xA;*Oct 12 06:49:26.706: L2X        _____:________: class [AAA author, group &quot;L2TP&quot;]&#xA;*Oct 12 06:49:26.706: L2X        _____:________:   Protocol unlocked 1-&amp;gt;0&#xA;*Oct 12 06:49:26.706: L2X        _____:________: class[AAA author, group &quot;L2TP&quot;]&#xA;*Oct 12 06:49:26.706: L2X        _____:________:   no more locks&#xA;*Oct 12 06:49:26.706: L2X        _____:________: class [AAA author, group &quot;L2TP&quot;]&#xA;*Oct 12 06:49:26.706: L2X        _____:________:   deleted&#xA;*Oct 12 06:49:26.714: L2X  00023:_____:________:  &#xA;*Oct 12 06:49:26.714: L2X  00023:_____:________: APP-&amp;gt;L2TP: Destroy [11],&#xA;*Oct 12 06:49:26.714: L2X  00023:_____:________:            sock 00001022&#xA;*Oct 12 06:49:26.714: L2X  00023:_____:________:            serv 00008022&#xA;*Oct 12 06:49:26.714: L2X  00023:_____:________:            data 684889D4[277]&#xA;*Oct 12 06:49:26.714: L2X  00023:_____:________:            replied on same socket&#xA;*Oct 12 06:49:26.714: L2X  00023:_____:________:  &#xA;*Oct 12 06:49:26.714: L2X  00023:_____:________: L2TUN: remove sock 00001022&#xA;*Oct 12 06:49:26.714: L2X  00023:_____:________: Destroying logical session&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30655" LastEditorUserId="30655" LastEditDate="2016-10-12T07:26:35.613" LastActivityDate="2016-11-11T16:10:24.607" Title="Cisco ISR L2TP VPN local vs radius authentication problem" Tags="|cisco|vpn|radius|cisco-isr|l2tp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35688" PostTypeId="1" AcceptedAnswerId="37219" CreationDate="2016-10-11T15:37:38.633" Score="3" ViewCount="13015" Body="&lt;p&gt;I have a computer1 connected to ip phone which is connected to an HP J9625A switch like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;switch &amp;lt;-&gt; ip_phone &amp;lt;-&gt; computer1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;l have been continuously receiving snmp traps close to 10000 traps with the following traps on computer2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;port 4 is now off-line&#xA;&#xA;port 4 is Blocked By STP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I noticed in the snmp trap event screen that there were no &quot;port 4 is now on-line&quot; entry. Testing the connection from the switch port 4 to the ip phone with a cable tester indicates that a problem exists with the connection. Yet I do not understand why STP would block this port.&lt;/p&gt;&#xA;" OwnerUserId="31032" LastActivityDate="2016-12-10T19:51:03.537" Title="Edge port continuously switching between Port-offline and blocked by STP" Tags="|switch|snmp|spanning-tree|hp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35691" PostTypeId="1" AcceptedAnswerId="35693" CreationDate="2016-10-11T15:53:12.893" Score="2" ViewCount="3088" Body="&lt;p&gt;My question might be broad but I was watching a Youtube video and thus I want to ask the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it true that a gateway may change the &lt;code&gt;source MAC address&lt;/code&gt; of some packets passing through it to another MAC address? If so, why and in what cases this occur?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="28219" LastActivityDate="2016-10-13T14:34:09.797" Title="Gateway changing source MAC address in packet headers" Tags="|cisco|routing|mac-address|switching|network-core|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35692" PostTypeId="1" CreationDate="2016-10-11T15:58:02.117" Score="1" ViewCount="590" Body="&lt;p&gt;I have a bunch of Cisco AIR AP 1602e, which I have configured. These are dual-band a/b/g/n access points. Sometimes my users do expirience lags and spikes, even the associations start to break (for some of the users). This WLAN is deployed in a large office buildings, occupied by a number of organizations, and a scan from a FreeBSD machine reveals more than 18 (!) SSIDs on 2.4 GHz, without taking into account my own SSIDs. In the same time carrier busy test for 2.4 Ghz show busy rates for a set of channels where 17% is the minimum, and the maximum sometimes can go up to 71% (!). The 5 GHz range isn't that overcrowded (5-15% at the CBT), but still, spikes happen: sometimes once a week, sometimes less frequently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What is the best strategy to mitigate this&lt;/strong&gt; ? You should take into the considerations the following measures I attempted:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;all of the APs are standalone ones, WDS is configured and running.&lt;/li&gt;&#xA;&lt;li&gt;all of the APs are equipped wuth 2/4 dBm omnidirectional dipole antennas.&lt;/li&gt;&#xA;&lt;li&gt;Cisco 1602e APs are capable of the CleanAir functionality, but only with wireless controller, which I don't have.&lt;/li&gt;&#xA;&lt;li&gt;all of the APs are running the latest Cisco IOS. This doesn't seem to affect the spikes in any way&lt;/li&gt;&#xA;&lt;li&gt;I disabled the 802.11b rates entirely, leaving only a, g and n rates. I don't have the statistics for this as of yet (does it affect sipes or not).&lt;/li&gt;&#xA;&lt;li&gt;seems like some of the low-end crappy adapters, like D-Link or even (shame ! but some of the users happen to use this so-called equipment) TP-Link do not handle well AES/CCKM cipher rotation scheme, so I have to create them a separate legacy WPA/TKIP SSID, at least the last couple of days I didn't hear any complaints.&lt;/li&gt;&#xA;&lt;li&gt;I did tamper with transmit power, I have set the transmit power at its maximum, and at it's minimum, - this didn't affect spikes in any noticeable way. At this times all of the APs are running at their minimum transmit power.&lt;/li&gt;&#xA;&lt;li&gt;I disabled the 2.4 GHz band for all of the SSIDs that dual-band modern clients are sitting in, but for this moment I didn't have the statistics yet. I am aware about the band-select feature, but event when it's enabled lot of clients prefer the 2.4 Ghz band (for some reason that is unknown to me).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="10496" LastEditorUserId="10496" LastEditDate="2019-02-22T14:32:08.883" LastActivityDate="2019-02-22T14:32:08.883" Title="wifi access points in a noisy environment" Tags="|cisco|wireless|ieee-802.11|aironet|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="35693" PostTypeId="2" ParentId="35691" CreationDate="2016-10-11T15:58:16.370" Score="2" Body="&lt;p&gt;A gateway (router) does not change the MAC addresses, it discards them. MAC addresses are layer-2 addresses. A router will strip and discard the layer-2 frame. It then performs a lookup on the layer-3 address on the packet, switches it to a new interface, and builds a new frame for the new interface network type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not all layer-2 protocols use MAC addresses, some use 48-bit MAC addresses, and some use 64-bit MAC addresses. The new frame will be for the network type of the new interface, and it may not have a MAC address at all. If it does, then the new source and destination MAC addresses will be for the new link, not the old link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-11T15:58:16.370" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35694" PostTypeId="2" ParentId="35692" CreationDate="2016-10-11T16:17:37.247" Score="2" Body="&lt;p&gt;It sounds like you've done all the right things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Move to 5 GHz where clients allow&lt;/li&gt;&#xA;&lt;li&gt;Disable slow speeds&lt;/li&gt;&#xA;&lt;li&gt;Limit xmit power&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The basic problem is you're working in a crowded RF environment and there's not a lot you can do. It's rush hour on the freeway, and no matter how powerful a car you have, you can only go as fast as the flow of traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Until you can upgrade the rest of your clients to use 5 GHz, you may be doing as well as you can.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-10-11T16:17:37.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35695" PostTypeId="2" ParentId="35691" CreationDate="2016-10-11T16:21:02.393" Score="3" Body="&lt;p&gt;An easy explanation would be like&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;IP Address is End - to - End.&#xA; Mac Address is Hop - to - Hop.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your layer 2 details are valid and useful only in your network, so the gateway changes the mac address in the layer 2 header.&#xA;The Layer 3 header or the IP header will have IP addresses(Source and Destination) which will not be changed unless NATing is involved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this will help our query&lt;/p&gt;&#xA;" OwnerUserId="31188" LastEditorUserId="31188" LastEditDate="2016-10-13T14:34:09.797" LastActivityDate="2016-10-13T14:34:09.797" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35696" PostTypeId="1" AcceptedAnswerId="37839" CreationDate="2016-10-11T16:37:47.393" Score="2" ViewCount="439" Body="&lt;p&gt;Can anyone doublecheck my basic Cisco QoS configuration. I've got a small remote site connected via AT&amp;amp;T 20Mb line that communicates over an IPSec tunnel. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-any QoS-Voice&#xA; match ip dscp ef&#xA; match ip dscp cs5&#xA; match ip dscp cs3&#xA; match ip dscp af41&#xA;&#xA;policy-map high-priority&#xA; class Qos-Voice&#xA;  priority percent 25 5000&#xA; class class-default&#xA;  fair-queue&#xA;&#xA;interface Tunnel1&#xA; description Tunnel 2 IR&#xA; bandwidth 20000&#xA; ip address x.x.x.x x.x.x.x&#xA;&#xA;interface FastEthernet0/0&#xA; description PX Corporate&#xA; bandwidth 100000&#xA; ip address x.x.x.x x.x.x.x&#xA; service-policy output high-priority&#xA;&#xA;interface FastEthernet0/1&#xA; description ATT WAN&#xA; bandwidth 100000&#xA; ip address x.x.x.x x.x.x.x&#xA; service-policy output high-priority&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I do a &lt;code&gt;show policy-map interface f0/0&lt;/code&gt;, I can see packets being hit from those classes but I'm still seeing a lot of jitter on my system so I'm thinking I've got something wrong. The other side of this tunnel is an exact duplicate. There is a Cisco router that plugs into a switch and it is configured exactly the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches operating as the Core layer are layer 3 Enterasys switches that are prioritizing the traffic at layer 2.&lt;/p&gt;&#xA;" OwnerUserId="31189" LastEditorUserId="31189" LastEditDate="2016-10-12T00:31:20.303" LastActivityDate="2017-01-06T19:54:06.623" Title="Cisco QoS Confirmation" Tags="|cisco|qos|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35697" PostTypeId="2" ParentId="29524" CreationDate="2016-10-11T16:44:26.523" Score="0" Body="&lt;p&gt;A TCP Segment send with SYN flag set can be replied with TCP Segment with RST flag set. This can happen if the server is not listening to that particular destination port mentioned in the TCP segment with SYN flag set. This means the connection is aborted from the server side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this will help.&lt;/p&gt;&#xA;" OwnerUserId="31188" LastActivityDate="2016-10-11T16:44:26.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35698" PostTypeId="2" ParentId="35696" CreationDate="2016-10-11T16:51:29.850" Score="3" Body="&lt;p&gt;QoS needs to be comprehensive. You should mark traffic as close to the source as possible, e.g. on the access switches, so that you can treat the traffic for as long as possible on your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't see where you are shaping traffic on the WAN circuit, nor are you queuing on the tunnel. Since your WAN interface does not have 100 Mb service, you really need to shape the interface to the 20 Mb service that you do have. You are using a percent for the priority queue, but your are using the percent from the 100 Mb starting point, not the 20 Mb reality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is unlikely that you need to queue on your inside interface because it is so much faster than the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably want different queues for the traffic which isn't &lt;code&gt;EF&lt;/code&gt; (&lt;code&gt;CS5&lt;/code&gt;, &lt;code&gt;CS3&lt;/code&gt;, &lt;code&gt;AF41&lt;/code&gt;) VoIP traffic. If you lump larger packet sizes in the queue for VoIP then you will degrade the VoIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can configure and run IP SLA to get real numbers for thing like jitter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably have a real bottleneck on your distribution switches since they are connecting to the router via a 100 Mb interface. If you don't queue there, you are causing problems. You really need to look at your bandwidth oversubscription ratio on your network, and you need to queue where that happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;QoS needs to be comprehensive. You should mark traffic as close to the source as possible, e.g. on the access switches, so that you can treat the traffic for as long as possible on your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing to think about is that you need to take into account the packet sizes. With a lot of very small packets for VoIP, you need to adjust the bandwidth to a percentage of the bandwidth. You probably want to start around 85%, but you can adjust it later, after you test it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have below should be for a Fast Ethernet WAN circuit that is really 20 Mb. Taking 85% of that gives you 17 Mb. That gives you 15% for the packet overhead. You can adjust the percentages and queue sizes, but I assume this is an ISR router, so I put realistic queues sizes for that type of router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!***** QoS - Class Maps for Queuing Policy *****&#xA;class-map match-any QoS-Voice&#xA;  match ip dscp cs4 cs5 ef&#xA;class-map match-any QoS-Video&#xA;  match ip dscp af41 af42 af43&#xA;class-map match-any QoS-Control&#xA;  match ip dscp  cs3 af31 af32 af33 cs6 cs7&#xA;class-map match-any QoS-Medium&#xA;  match ip dscp cs2 af21 af22 af23&#xA;class-map match-any QoS-Low&#xA; match ip dscp cs1 af11 af12 af13&#xA;!&#xA;!***** QoS - Queuing Policy *****&#xA;policy-map QoS-Tunnel-Out&#xA; description 20 Mb Tunnel&#xA;  class QoS-Voice&#xA;    priority percent 20&#xA;    police cir percent 20 conform-action transmit exceed-action drop&#xA;  class QoS-Video&#xA;    bandwidth remaining percent 15&#xA;    police cir percent 15 conform-action transmit exceed-action drop&#xA;  class QoS-Control&#xA;    bandwidth remaining percent 5&#xA;    random-detect dscp-based&#xA;    random-detect dscp 24 38 39&#xA;    random-detect dscp 26 31 39&#xA;    random-detect dscp 28 24 39&#xA;    random-detect dscp 30 16 31&#xA;    random-detect dscp 48 38 39&#xA;    random-detect dscp 56 38 39&#xA;  class QoS-Medium&#xA;    bandwidth remaining percent 5&#xA;    random-detect dscp-based&#xA;    random-detect dscp 16 33 34&#xA;    random-detect dscp 18 33 34&#xA;    random-detect dscp 20 28 34&#xA;    random-detect dscp 22 21 28&#xA;  class QoS-Low&#xA;    bandwidth remaining percent 5&#xA;    random-detect dscp-based&#xA;    random-detect dscp 8 8 13&#xA;    random-detect dscp 10 20 21&#xA;    random-detect dscp 12 17 21&#xA;    random-detect dscp 14 13 21&#xA;  class class-default&#xA;    bandwidth remaining percent 50&#xA;    random-detect dscp-based&#xA;    random-detect dscp default 59 79&#xA;!&#xA;!***** QoS - Generic Traffic Shaping *****&#xA;policy-map QoS-Shaping-Out&#xA; description Shape WAN FE to 20 Mb&#xA;  class class-default&#xA;    shape average 17000000 68000&#xA;    service-policy QoS-Tunnel-Out&#xA;!&#xA;interface Tunnel1&#xA; description Tunnel 2 IR&#xA; bandwidth 17000&#xA; ip address x.x.x.x x.x.x.x&#xA; service-policy output QoS-Tunnel-Out&#xA;!&#xA;interface FastEthernet0/0&#xA; description PX Corporate&#xA; ip address x.x.x.x x.x.x.x&#xA;!&#xA;interface FastEthernet0/1&#xA; description ATT WAN&#xA; bandwidth 100000&#xA; ip address x.x.x.x x.x.x.x&#xA; service-policy output QoS-Shaping-Out&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You should really set up marking on the access switches. The above configuration assumes that most traffic will be &lt;code&gt;BE&lt;/code&gt;. You only want to mark traffic which will be treated differently, either higher or lower priority. It would be good to mark bulk-type traffic, e.g. server backup traffic, to a lower priority.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco switches, by default, remark all incoming traffic to &lt;code&gt;BE&lt;/code&gt; (default), unless you specifically configure trust on the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have 48 1 Gb ports coming into a switch, and the switch only has a 1 Gb uplink to the distribution, you are oversubscribed by more than twice the recommendation of 20:1. Also, if you have a bunch of access switches coming into the distribution at 1 Gb, but the link to the WAN router is only 100 Mb, you really must queue there, too, otherwise you are just messing up your QoS. You will get a lot of congestion, and that will cause a lot of jitter.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-11T19:22:32.550" LastActivityDate="2016-10-11T19:22:32.550" CommentCount="18" ContentLicense="CC BY-SA 3.0" />
  <row Id="35701" PostTypeId="2" ParentId="29645" CreationDate="2016-10-11T17:26:56.017" Score="2" Body="&lt;p&gt;You probably will want to look into port-security sticky (dynamically learns the MAC) then configure aging to age out old MAC Addresses on each interface. You wont be able to have port security configured and at the same time allow a MAC to move from interface to interface without problems. As stated above, it defeats the purpose of port-security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For each interface you can configure it to dynamically learn the mac with:   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switchport port-security mac-address sticky&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can set how many MAC Address's you want each interface to learn:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  switchport port-security maximum ?&#xA;  &amp;lt;1-8192&amp;gt;  Maximum addresses&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then for each interface set the aging timers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  switchport port-security aging ?&#xA;      static  Enable aging for configured secure addresses&#xA;      time    Port-security aging time&#xA;      type    Port-security aging type&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you set your aging parameters you have several options, you can have it based on time, or type, or statically set:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport port-security Aging time ?&#xA;  &amp;lt;1-1440&amp;gt;  Aging time in minutes. Enter a value between 1 and 1440&#xA;&#xA;switchport port-security Aging type ?&#xA;  absolute    Absolute aging (default)&#xA;  inactivity  Aging based on inactivity time period&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Like Ron says in his response, you will want to have port-security to dynamically learn (sticky) the MAC addresses, possible set a max amount to learn on each interface, and configure the aging parameters to what best suits you.&lt;/p&gt;&#xA;" OwnerUserId="14372" LastActivityDate="2016-10-11T17:26:56.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35702" PostTypeId="2" ParentId="35688" CreationDate="2016-10-11T18:07:03.363" Score="1" Body="&lt;p&gt;There are two possibilities:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A)&lt;/strong&gt; Because the cable tester indicates a problem, the port is flapping all the time causing the switch so send traps en masse. Have a look at the port's uptime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;B)&lt;/strong&gt; By definition an edge port has no other bridges attached to it. But the phone has a switch built in and therefore counts as a bridge. There may be a software feature that is triggered whenever more than one MAC address is learned on the edge port.&lt;/p&gt;&#xA;" OwnerUserId="3163" LastActivityDate="2016-10-11T18:07:03.363" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35706" PostTypeId="2" ParentId="35510" CreationDate="2016-10-11T22:02:54.613" Score="3" Body="&lt;p&gt;Here is an answer I found at the web site of a fiber optics manufacturer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A common  question  we  receive  is  whether  a  50/50  beamsplitter  can  be  used  in  reverse,  to  combine  the&#xA;signals  from  two  sources,  thereby  combining  their  output  powers.  Unfortunately  beamsplitters  are  reciprocal  in  nature,  meaning  that  they&#xA;perform the same operation in both directions. Since the light from the input port on a polarization maintaining splitter will be split 50/50 into&#xA;the two output ports, light sent back along either one of those ports will also be split 50/50. In a one by two splitter the other 50 percent is&#xA;simply  lost  inside  the  coupler  housing.  In  order  to  combine  signals  with  low  losses  the  two  input  signals  must  somehow  be  different:  for&#xA;instance light of two different wavelengths or light of two different polarizations can be efficiently combined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And also this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wavelength Division Multiplexers (WDMs), also known as wavelength combiners or splitters, are used to combine or separate signals. We offer 2-wavelength WDMs for visible/NIR or IR wavelengths, 3-wavelength WDMs, and polarization-maintaining WDMs. Infrared multiplexers are an ideal solution for combining pump and signal powers or for combining or separating telecom signals. Visible/NIR wavelength WDMs are commonly used for multi-color displays, sensors, and microscopy. &lt;/p&gt;&#xA;" OwnerUserId="29690" LastActivityDate="2016-10-11T22:02:54.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35707" PostTypeId="2" ParentId="35680" CreationDate="2016-10-11T22:35:39.523" Score="0" Body="&lt;p&gt;I agree with user2964971's post, but thought I'd also mention &lt;a href=&quot;http://www.visiocafe.com/&quot; rel=&quot;nofollow&quot;&gt;Visio Cafe&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="129" LastActivityDate="2016-10-11T22:35:39.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35708" PostTypeId="1" AcceptedAnswerId="36100" CreationDate="2016-10-12T04:07:35.913" Score="3" ViewCount="135" Body="&lt;p&gt;Lately we have been getting bandwidth hogging when any user attempts to download updates / youtube / anything large files. The rest of the network is clogged. We have a fibre 20meg line in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;20meg Fibre -&gt; SRX 220 -&gt; Powerconnect 6248 -&gt; Patch Panel -&gt; Users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have COS setup on our SRX220 firewall to prioritise traffic to certain server IP addresses in and out to the cloud.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches are 2x powerconnect 6248 and are not stacked. They both have RSTP configured on them, and are pretty much default as the rest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Server is 2012 R2 Essentials Running DNS / DHCP / AD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure on which layer to continue to address this problem. Should I be setting COS on the switches too? I would think the switches would be managing the traffic on their own be default..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this thing is really tricky to pinpoint, but are there any clues / logs to look at / potential settings that might be controlling this hogging that I can at least rule out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="31025" LastActivityDate="2017-01-24T21:29:31.853" Title="Bandwidth hogging on managed switched network 17 users" Tags="|firewall|juniper-srx|dell|powerconnect|cos|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35713" PostTypeId="2" ParentId="25291" CreationDate="2016-10-12T12:03:11.527" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I would like to do a similar test but in a wireless environment.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Look at  &lt;a href=&quot;https://befinitiv.wordpress.com/wifibroadcast-analog-like-transmission-of-live-video-data/&quot; rel=&quot;nofollow&quot;&gt;Wifibroadcast&lt;/a&gt; (Linux, some Android support) which does exactly that. Short summary: it uses a pair of wifi adapters, one in injection mode, the other in monitor mode, and transmits data using raw wifi frames. This is an unidirectional connection. While originally conceived as a method to transmit low latency video feed, it can of course be used for all kind of data.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any hardware constraint (ie: the Wi-Fi card) that might undermine such effort?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. There are adapters that work better, and adapters that work less well, if at all. Some adapters in raw mode cannot contain high throughput, some adapters need to have their firmware modified. Some adapters work in 2.4GHz band and some in 5GHz and some in both.&lt;/p&gt;&#xA;" OwnerUserId="31215" LastActivityDate="2016-10-12T12:03:11.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35714" PostTypeId="2" ParentId="32777" CreationDate="2016-10-12T13:28:21.107" Score="1" Body="&lt;p&gt;I had the same problem on a Fortigate 90D: Skype chat works, but not calls.  I investigated a bit and I found the culprit: webfilter... and firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Explanation with an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 IPV4 policies for 2 types of users (let's call them LAN and GUEST).  Both policies are using the SAME webfilter.  The only difference is: LAN policy only has a few ports open, while GUEST policy has ALL ports open.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logs are telling me that on BOTH policies, Skype is blocked by the webfilter.  After reading Skype documentation, i know that if Skype is blocked on standard ports (80 or 443), it will use a random port to connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;For the users under my LAN policy, Skype is blocked by the webfilter, then use another random port.  And the random port not being allowed in my LAN policy --&gt; Skype calls are not working.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For the users under the GUEST policy, Skype is also blocked by the webfilter, then use another random port.  All ports being open in my GUEST policy: CALLS ARE WORKING !&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My only option if I don't want to open all ports on my LAN policy in order for random Skype ports to work is to AUTHORIZE ALL WEBSITES IN THE WEBFILTER.  Then apply, wait a few seconds, boom: Skype calls are working !  If I block pornography websites -&gt; Skype is not working.  If I block &quot;Security Risk&quot; category --&gt; not working !  Even worse than that: putting the categories on &quot;monitor&quot; also seems to block skype calls !  You must select AUTHORIZE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conclusion: Skype calls are blocked by the webfilter.&#xA;Only solution:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Allow skype to connect on standard ports by authorizing all websites in the webfilter, since it looks like skype is blocked in multiple web categories.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you don't want to allow those categories in the webfilter, skype will be blocked on standard ports and will use a RANDOM port to connect, so you must open ALL ports in your policy (since it's impossible to guess which one will be used) in order for the Skype to work.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Third option, but it didn't work for me: you can specify a custom port in Skype connection options, then eventually authorize it in your policies.  I tried it, but Skype was still using random ports.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="31218" LastEditorUserId="31218" LastEditDate="2016-10-12T13:56:50.050" LastActivityDate="2016-10-12T13:56:50.050" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35715" PostTypeId="1" AcceptedAnswerId="35862" CreationDate="2016-10-12T13:28:41.200" Score="1" ViewCount="909" Body="&lt;p&gt;Recently I replaced a defect Desktop switch with a cisco SG-200-8 switch. After I replaced the old switch everything seemed to work fine. Now the employees have trouble using the scanner through TWAIN. After some hours I figured out that using an unmanaged switch the scanning process works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then scanned some pages and captured the network traffic. There are no malformed frames so I don't see any reason why the switch should drop the frames. Can somebody make sense out of this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;// After many checks I now can specify the problem further. The SYN Packet that is send from the client to the printer is dropped by the switch. Anyway Etherlike does not display any dropped frames. The Packet looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Oyk62.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Oyk62.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;// As I wasn't able to make any sense from this behavior I think this might be a bug in the firmware. In the release of one firmware update a similar bug is patched that is related to printing. This is not exactly my problem but it aims broadly in the right direction. I will report back if this fixed it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;// After two firmware updates the problem is solved.&lt;/p&gt;&#xA;" OwnerUserId="1667" LastEditorUserId="1667" LastEditDate="2016-10-18T11:29:45.203" LastActivityDate="2016-10-18T11:32:40.020" Title="What can cause a Layer 2 Switch to drop frames that aren't malformed?" Tags="|cisco|switch|layer2|" AnswerCount="1" CommentCount="24" ContentLicense="CC BY-SA 3.0" />
  <row Id="35716" PostTypeId="1" AcceptedAnswerId="35719" CreationDate="2016-10-12T14:48:30.943" Score="2" ViewCount="10969" Body="&lt;p&gt;I've got a pfSense box which is acting as DHCP/DNS for one LAN, which all office computers and servers connect to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a modem which cannot be put into bridge mode for several reasons and cannot be swapped out for another bridgeable modem as we use certain services from the ISP that only function with their (rather crappy) modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can, however assign a PC on the Modem's LAN to be a DMZ, which I've done, selecting the pfSense box as DMZ, no other devices other than this are on the Modem's LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue I face is this: I can't port forward from the pfSense box to any other computer/server on the pfSense LAN. I confirmed that the Modem's DMZ is working as I connected a server directly to the Modem's LAN and was able to access services from our public IP. Also, we used to use a Windows server for DHCP and Routing and Remote Access, which included a &lt;strong&gt;very&lt;/strong&gt; basic port forward function which did work. The only thing we've changed is the installation of the pfSense box as the Windows server died.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I port forward using pfSense under these conditions.&lt;/p&gt;&#xA;" OwnerUserId="31219" LastEditorUserId="31219" LastEditDate="2016-10-12T16:18:01.460" LastActivityDate="2017-08-08T22:58:23.370" Title="Port Forwarding on unavoidable Double-NAT pfSense" Tags="|lan|pfsense|" AnswerCount="1" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="35718" PostTypeId="2" ParentId="35687" CreationDate="2016-10-12T15:30:11.777" Score="2" Body="&lt;p&gt;I found the problem. I did not think this would be it so I overlooked it multiple times but after trying it, it worked. I feel so silly now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the virtual template 1 I changed&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ppp authentication ms-chap-v2 remote-access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ppp authentication ms-chap ms-chap-v2 remote-access&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VPN connects and all is working.&lt;/p&gt;&#xA;" OwnerUserId="30655" LastActivityDate="2016-10-12T15:30:11.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35719" PostTypeId="2" ParentId="35716" CreationDate="2016-10-12T15:41:22.080" Score="0" Body="&lt;p&gt;I think you really just need to disable NAT on the pfSense router/firewall. You simply don't need to use NAT to route or use the firewall. You can use the firewall to disallow users from accessing the ISP services, and you get the boot services that work on pfSense. This should solve the double-NAT port forwarding problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://doc.pfsense.org/index.php/Outbound_NAT#Disable_NAT&quot; rel=&quot;nofollow&quot;&gt;pfSense documentation&lt;/a&gt; tell you how to disable the firewall:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;Disable NAT&lt;/h1&gt;&#xA;  &#xA;  &lt;hr&gt;&#xA;  &#xA;  &lt;p&gt;To completely disable NAT to have a routing-only firewall, do the&#xA;  following.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;pfSense 2.2 And Later&lt;/h2&gt;&#xA;  &#xA;  &lt;hr&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Navigate to Firewall &gt; NAT on the Outbound tab&lt;/li&gt;&#xA;  &lt;li&gt;Select Disable Outbound NAT rule generation (No Outbound NAT rules)&lt;/li&gt;&#xA;  &lt;li&gt;Click Save&lt;/li&gt;&#xA;  &lt;li&gt;Apply changes&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;h2&gt;Prior Versions&lt;/h2&gt;&#xA;  &#xA;  &lt;hr&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Navigate to Firewall &gt; NAT on the Outbound tab&lt;/li&gt;&#xA;  &lt;li&gt;Select Manual Outbound NAT rule generation (Advanced Outbound NAT&#xA;  (AON))&lt;/li&gt;&#xA;  &lt;li&gt;Click Save&lt;/li&gt;&#xA;  &lt;li&gt;Delete all rules from the list on the page&lt;/li&gt;&#xA;  &lt;li&gt;Click Apply changes&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;NAT may be performed on some interfaces and not others by configuring&#xA;  Outbound NAT rules accordingly.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Details may be found in &lt;a href=&quot;http://pfsense.org/book&quot; rel=&quot;nofollow&quot;&gt;the pfSense book&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-12T15:41:22.080" CommentCount="16" ContentLicense="CC BY-SA 3.0" />
  <row Id="35721" PostTypeId="1" AcceptedAnswerId="35722" CreationDate="2016-10-12T17:02:46.517" Score="1" ViewCount="104" Body="&lt;p&gt;I'm a beginner with networking, specifically linux networking, I have a question that I'll split into 2 parts :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If I have an &lt;em&gt;x&lt;/em&gt; number of hops inside the same subnet ( namely 192.168.1.x ) and my goal is to have the &lt;em&gt;#y&lt;/em&gt; port open for both UDP and TCP, I have to open ports / manage the NAT on all the routing devices or just the first and last device of interest ?&lt;/li&gt;&#xA;&lt;li&gt;what if I have the same problem about keeping ports opened but the modem is on one subnet ( 192.168.1.x ) and the device is on a different subnet ( 192.168.2.x ) ? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm using anything from linux 2.6 to 4.x on this devices .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help .&lt;/p&gt;&#xA;" OwnerUserId="31223" LastActivityDate="2016-10-12T17:10:13.297" Title="How the hops and the subnets are influencing NATs and ports ?" Tags="|tcp|nat|subnet|udp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35722" PostTypeId="2" ParentId="35721" CreationDate="2016-10-12T17:10:13.297" Score="0" Body="&lt;p&gt;You don't have hops within the same network (subnet). A hop is between networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addresses are layer-3, and TCP/UDP ports are layer-4 addresses. Your subnet is all going to be on the same layer-2 domain, and layer-2 doesn't look at layer-3 or layer-4 addresses. By default, routers (layer-3) don't look at ports (layer-4). NAT messes that up, and that is where port forwarding comes in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You only need to forward ports on devices doing NAT.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-12T17:10:13.297" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35724" PostTypeId="1" CreationDate="2016-10-12T18:13:49.580" Score="0" ViewCount="82" Body="&lt;p&gt;We want to implement ipv6 on our network as we begin to offer our customers dual stack.&#xA;We offer dedicated servers and we wish to give a /64 with each server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In one vlan, we wish to have 255 x /64&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other way to do it on a Juniper MX router, instead of describing each gateway (255 gateways) in the configuration?&lt;/p&gt;&#xA;" OwnerUserId="31036" LastActivityDate="2016-10-12T21:45:06.733" Title="IPv6 create many gateways" Tags="|ipv6|juniper|ipv6-transition|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="35726" PostTypeId="1" CreationDate="2016-10-12T20:38:03.330" Score="1" ViewCount="1273" Body="&lt;p&gt;So I downloaded Cisco Anyconnect to my Nexus 5x phone. Attempted to connect to my SSLVPN and it fails. I get the below information from debugging. This is the first time I've ever tried to set up an SSLVPN and would love to learn more, I have purchased a book however it doesn't cover setting SSL VPNs up on a router so I may need to purchase another or read more white pages. I'm unsure what the debugging information is telling me or if the issue is related to attempting to connect from my phone. I will attempt to install and test from a laptop later. The router is a CISCO1921/K9. Any information would be great, I have great interest in VPN technologies and would love to learn more.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#debug webvpn&#xA;WebVPN debugging is on&#xA;Router#show log&#xA;Oct 12 20:18:01.509: WV: sslvpn process rcvd context queue event&#xA;Oct 12 20:18:01.509: WV: sslvpn process rcvd context queue event&#xA;Oct 12 20:18:01.521: WV: sslvpn process rcvd context queue event&#xA;Oct 12 20:18:01.521: WV: Entering APPL with Context: 0x328661D0, &#xA;      Data buffer(buffer: 0x2C6F83F8, data: 0xE94D758, len: 0, &#xA;      offset: 0, domain: 0)&#xA;Oct 12 20:18:01.521: WV: Fragmented App data - buffered&#xA;Oct 12 20:18:01.521: WV: Entering APPL with Context: 0x328661D0, &#xA;      Data buffer(buffer: 0x2C6F8418, data: 0xF773E58, len: 1099, &#xA;      offset: 0, domain: 0)&#xA;Oct 12 20:18:01.521: WV: http request: / with no cookie&#xA;Oct 12 20:18:01.521: WV: validated_tp :  cert_username :  matched_ctx : &#xA;Oct 12 20:18:01.521: WV: failed to get sslvpn appinfo from opssl&#xA;&#xA;Oct 12 20:18:01.521: WV: Error: Failed to get vw_ctx&#xA;Oct 12 20:18:01.521: WV: Appl. processing Failed : 2&#xA;&#xA;*********************************************************************************&#xA;Router#show run | s webvpn&#xA;webvpn gateway GatewayName&#xA; hostname GatewayName&#xA; ip address x.x.x.x port 443  &#xA; http-redirect port 80&#xA; ssl encryption aes128-sha1 aes256-sha1&#xA; ssl trustpoint TP-self-signed-3721036327&#xA; inservice&#xA; !&#xA;webvpn context GatewayName&#xA; title &quot;Secure Access: Unauthorized users prohibited&quot;&#xA; !&#xA; acl &quot;webvpn-acl&quot;&#xA;   permit ip 10.x.x.x 255.255.255.224 10.x.x.x 255.255.255.224&#xA; login-message &quot;Please enter your login credentials&quot;&#xA; aaa authentication domain domain.com&#xA; gateway GatewayName domain domain.com&#xA; max-users 3&#xA; !&#xA; ssl authenticate verify all&#xA; !&#xA; url-list &quot;MyPages&quot;&#xA;   heading &quot;MyPages&quot;&#xA;   url-text &quot;companyweb&quot; url-value &quot;http://companyweb.local&quot;&#xA; inservice&#xA; !&#xA; policy group PolicyGroupName&#xA;   functions svc-enabled&#xA;   banner &quot;Login Successful&quot;&#xA;   timeout idle 600&#xA;   filter tunnel webvpn-acl&#xA;   svc address-pool &quot;SSLVPN&quot; netmask 255.255.255.224&#xA;   svc keep-client-installed&#xA;   svc rekey method new-tunnel&#xA;   svc split include 10.x.x.x 255.255.255.224&#xA;   url-list &quot;MyPages&quot;&#xA;   hide-url-bar&#xA; default-group-policy PolicyGroupName&#xA;Router#show run | i pool&#xA;ip local pool SSLVPN 10.x.x.x 10.x.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23913" LastActivityDate="2017-08-09T15:06:54.633" Title="Issues configuring SSLVPN on Cisco Router" Tags="|router|vpn|sslvpn|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35727" PostTypeId="1" CreationDate="2016-10-12T21:02:51.053" Score="1" ViewCount="114" Body="&lt;p&gt;They are many places place firewalls, what are the most important places to set up a firewall. I know that its really important to set up a firewall at the router that leads the traffic from the outside into the private network, should we add some more firewalls in the private network or is it enough with one?&lt;/p&gt;&#xA;" OwnerUserId="30468" LastActivityDate="2016-10-12T21:52:42.560" Title="best practices for placeing firewalls?" Tags="|firewall|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35728" PostTypeId="2" ParentId="35727" CreationDate="2016-10-12T21:07:53.860" Score="1" Body="&lt;p&gt;It really depends. If you have any network which should be protected from any other network at your site, then you can use a firewall. For instance, many companies isolate labs from the other networks by placing a firewall to protect the production network from the lab network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-12T21:07:53.860" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35729" PostTypeId="2" ParentId="34483" CreationDate="2016-10-12T21:22:56.670" Score="0" Body="&lt;p&gt;If you do &lt;code&gt;ip route show 94.74.72.0/24&lt;/code&gt; from command line (&lt;em&gt;linux shell&lt;/em&gt;) and tell us what protocol it says there. If it's zebra something is weird. Check if there is more kernel routes that shouldn't be there. &lt;code&gt;sh ip route summary&lt;/code&gt; from within quagga.&lt;/p&gt;&#xA;" OwnerUserId="31226" LastActivityDate="2016-10-12T21:22:56.670" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35730" PostTypeId="2" ParentId="35727" CreationDate="2016-10-12T21:34:08.203" Score="0" Body="&lt;p&gt;External firewall like you mentioned is a must. If you have internet facing services such as website that you host from within your company servers or a DNS server etc then you create a DMZ. Which means there is a firewall between Internet connection and your Internet facing servers and then another firewall to protect your internal network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also you should ideally enable host based firewalls like the windows firewall as security threats are not only external but internal as well.&lt;/p&gt;&#xA;" OwnerUserId="30472" LastActivityDate="2016-10-12T21:34:08.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35731" PostTypeId="2" ParentId="35724" CreationDate="2016-10-12T21:45:06.733" Score="1" Body="&lt;p&gt;A different setup would probably make more sense for IPv6. Putting multiple /64s on one layer-2 domain isn't very useful. Just one /64 has 2^64 addresses. You could let each server pick addresses from a subset of the /64 for example. If the /64 is for example &lt;code&gt;2001:db8:aa:bb::/64&lt;/code&gt; then server 1 could use every address between &lt;code&gt;2001:db8:aa:bb:0001:0000:0000:0000/64&lt;/code&gt; and &lt;code&gt;2001:db8:aa:bb:0001:ffff:ffff:ffff/64&lt;/code&gt;, etc. That way you could fit 65536 servers on a subnet with 16 million addresses per server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that's still pretty much IPv4-thinking. What would probably be much more useful to your customers is if you provide a routed subnet per server so that they can more easily run things like docker and virtual machines inside their server. I would recommend at least a /56 per server. If you combine this with the addressing suggestion above you could route the prefix to the ::1 address of each server. So for server 1 above you could for example set static route &lt;code&gt;2001:db8:ff00:0100::/56&lt;/code&gt; to &lt;code&gt;2001:db8:aa:bb:1::1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you are really using IPv6: provide plenty addresses on the LAN and give a block of subnets to each customer for virtualisation etc. Much cleaner and more useful to your customers than messing with multiple /64s on one LAN.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-10-12T21:45:06.733" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35732" PostTypeId="2" ParentId="35727" CreationDate="2016-10-12T21:52:42.560" Score="0" Body="&lt;p&gt;It mostly depends on the architecture of the network. For example, if it's 3-legged, one right in front of the external router, one in front of DMZ, and one for private network.&lt;/p&gt;&#xA;" OwnerUserId="25436" LastActivityDate="2016-10-12T21:52:42.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35739" PostTypeId="1" AcceptedAnswerId="35745" CreationDate="2016-10-13T08:03:06.767" Score="1" ViewCount="71" Body="&lt;p&gt;We have three of them, but one is messing around. As soon as you download a bigger file, he loses connection. I can't ping the AP (from another PC connected via LAN), and the PC connected via Wi-Fi can't ping anything (ping 8.8.8.8). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I started to check when this happens. I ping 500 times 8.8.8.8 and download a file. As soon is the download starts, 8.8.8.8 isn't reachable, and also the AP isn't. When the download aborts, everything works again. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tested the same with the other APs, but they don't have this issue. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The APs are connected to the same switch. I also checked if there is an IP error, like another one is using the same IP address as the AP, but no, he is the only one. Interesting thing is, that the &quot;broken&quot; AP shows only 100 Mb Ethernet Connection, while the other are showing 1 Gb.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know where to start looking. Maybe it's hardware failure?&lt;/p&gt;&#xA;" OwnerUserId="22401" LastEditorUserId="8499" LastEditDate="2016-10-13T11:44:25.670" LastActivityDate="2016-10-13T11:44:25.670" Title="Cisco AIRONET 700 loses connection while downloading" Tags="|cisco|troubleshooting|aironet|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35740" PostTypeId="2" ParentId="35726" CreationDate="2016-10-13T08:29:30.087" Score="2" Body="&lt;p&gt;I haven't done this since Anyconnect 2.x and IOS 12.4T so things may have changed, but one of the things I remember is that you need to upload an Anyconnect package (pkg file) to the router. Not sure how it works for Android, since there is no pkg for that platform - it may be sufficient to install e.g. the Windows or Linux version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also &quot;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200533-AnyConnect-Configure-Basic-SSLVPN-for-I.html&quot; rel=&quot;nofollow&quot;&gt;AnyConnect: Configure Basic SSLVPN for IOS Router Headend With the Use of CLI&lt;/a&gt;&quot; which shows that you may also be missing a VTI interface (cfr. steps 2 &amp;amp; 7 (and step 9 to link the VTI to the Context).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Step 1. Confirm License is Enabled&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 2. Upload and Install AnyConnect Secure Mobility Client Package&#xA;  on Router&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 3. Enable the http Server on the Router&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 4. Generate RSA Keypair and Self-Signed Certificate&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 5. Configure Local VPN User Accounts&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 6. Define Address Pool and Split Tunnel Access List to be Used by&#xA;  Clients&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 7. Configure the Virtual-Template Interface (VTI)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 8. Configure WebVPN Gateway&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 9. Configure WebVPN Context and Group Policy&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Step 10 (Optional). Configure a Client Profile&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-13T08:29:30.087" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35743" PostTypeId="1" AcceptedAnswerId="35744" CreationDate="2016-10-13T10:48:06.667" Score="4" ViewCount="16176" Body="&lt;p&gt;Say I just connected my computer to the internet through a home/office LAN network. I then proceed to ping google.com. Of course, the DNS converts google.com to the destination IP address, but how is the destination MAC address known? Please  explain how the packet reaches Google's server and how does the response find its way back.&lt;/p&gt;&#xA;" OwnerUserId="30909" LastEditorUserId="8499" LastEditDate="2019-01-05T04:06:33.430" LastActivityDate="2019-01-05T04:06:33.430" Title="What does a switch do when the destination MAC address is unknown?" Tags="|routing|ipv4|ipv6|mac-address|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35744" PostTypeId="2" ParentId="35743" CreationDate="2016-10-13T10:59:49.070" Score="10" Body="&lt;p&gt;I think you are confused. The destination MAC address for any destination not on your LAN is the MAC address of the gateway configured in your source host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC addresses are layer-2 addresses, and they are only relevant, or even used, on your layer-2 LAN. Layer-3 addresses, e.g. IPv4 or IPv6 addresses, are used to communicate with a host on another LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP (Address Resolution Protocol) is used to resolve a layer-3 address to a layer-2 address in order to communication on a LAN. A host will maintain an ARP cache, but if there is no entry in the cache for the layer-3 address, the host will send an ARP request with that layer-3 address to find the corresponding layer-2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP request: &quot;&lt;em&gt;Who has the layer-2 address for this layer-3 address?&lt;/em&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP reply: &quot;&lt;em&gt;I do, and this is the layer-2 address for that layer-3 address.&lt;/em&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination layer-3 address is on a different layer-3 network, the host will use the layer-2 address of its configured gateway, and it will use ARP if it does not already have the layer-2 address of the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets are layer-3 datagrams, and they do not contain layer-2 addresses, which are contained in the layer-2 frames that encapsulate layer-3 packets. Packets are routed by layer-3 devices called routers. Routers strip off the layer-2 frames from the layer-3 packets before routing the packets, and they will build new layer-2 frames for the next leg of the packets' journey. A complete discussion of routing is far too large and broad to be discussed here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your title is actually a different question. Switches do not get involved at layer-3 at all, so they do not use ARP. Switches maintain MAC address tables to relate a switch interface to a MAC address. Every time a frame comes into a switch interface, the switch will update or create a MAC address table entry of the source MAC address and the interface on which it arrived. The switch will use this MAC address table to look up the destination MAC address to see if it has a destination interface for the frame. If not, it floods the frame to all other interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-13T11:24:29.013" LastActivityDate="2016-10-13T11:24:29.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35745" PostTypeId="2" ParentId="35739" CreationDate="2016-10-13T11:38:42.983" Score="0" Body="&lt;p&gt;That sounds like a layer-1 problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to check the interfaces on both ends of the links to make sure they are set to Auto/Auto, and you need to test the cable. A 1000BASE-T connection will fall back to 100BASE-TX if the interfaces cannot use all four pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should always start trouble shooting at layer-1. When you rule that out, move on to layer-2, etc.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-13T11:38:42.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35750" PostTypeId="1" AcceptedAnswerId="35763" CreationDate="2016-10-13T18:18:02.350" Score="10" ViewCount="48670" Body="&lt;p&gt;As long as I know RADIUS is a type of authentication protocol, where for example if someone wants to use a switch, it first of all needs to enter his/her credentials, and properly authenticate himself/herself to the RADIUS server in order to gain access to the switch. And it provides capabilities such as authentication, authorization, and accounting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, what exactly is 802.1X Port-Based Authentication? Doesn't it also use RADIUS as it's underlying authentication mechanism? What are their differences? And if we can somehow compare them, which one is more secure?&lt;/p&gt;&#xA;" OwnerDisplayName="user2066" LastActivityDate="2016-10-14T09:54:32.570" Title="What's the difference between RADIUS and 802.1X Port-Based Authentication?" Tags="|security|radius|port-security|ieee-802.1x|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35753" PostTypeId="2" ParentId="35750" CreationDate="2016-10-13T19:54:05.967" Score="2" Body="&lt;p&gt;RADIUS stands for Remote Authentication Dial-In User Service and was develop to authenticate, authorize and account (AAA) Dail-In users. Today it's often used as a centralized authentication server for the management interface for all kinds of networking devices. Another common use is 802.1X 802.1X is an IEEE standard used in wired and wireless LANs to authenticate clients. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll have a client (called supplicant) an authenticator (a switch or access point) and an authentication server, which is a RADIUS sever. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2016-10-13T19:54:05.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35754" PostTypeId="1" CreationDate="2016-10-13T20:23:16.487" Score="2" ViewCount="920" Body="&lt;p&gt;Basically, we have 2 distribution-layer switches on separate sides of our campus, but they're both connected to the same core-layer switch. We don't have any kind of access to the core-layer switch, and it would take a long time to get the people above us to approve any changes we might propose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The connections between our switches and the core switch are access ports, which means the normal Cisco configuration for setting up RSPAN is not available since it requires trunking VLANs over the connection, something we're not able to do without access to the core switch. Our switches have an SVI set up for the VLAN that carries the traffic to the core switch, and we have a default route setup to point to the core switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our goal is to setup only one sniffer on either switch instead of having to do separate sniffers for each switch. Is that possible with our setup? I thought about setting the default route on one of the switches to the SVI of the other switch, but after more thought, it doesn't seem like that would send the traffic to the switch with the sniffer on it and might even interrupt service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are indeed access ports. We have SVIs set up on the distro switches (172.16.x.1/29 where x is the VLAN). I don't really know how the core switch is setup, so I don't know if we're just doing layer 2 or layer 3. Here is an example from one of our switches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;interface FastEthernet0/1&#xA; switchport mode access&#xA; switchport access vlan 20&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;interface vlan 20&#xA; ip address 172.16.20.1 255.255.255.240&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 172.16.20.2&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31255" LastEditorUserId="31255" LastEditDate="2016-10-13T22:57:54.400" LastActivityDate="2018-06-06T11:45:37.920" Title="Is it possible to replicate RSPAN features without trunk ports?" Tags="|cisco|switch|vlan|mirror|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="35756" PostTypeId="2" ParentId="35754" CreationDate="2016-10-14T01:08:58.773" Score="1" Body="&lt;p&gt;It doesn't matter what layer-3 routing you put on your switch, SPAN and RSPAN only work at layer-2, not on layer-3 interfaces, e.g. your SVIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The obvious solution is to change the access ports to trunk ports, and only allow the single VLAN which you currently have as the access VLAN on the trunk ports, and make that VLAN the native (non-tagged) VLAN. You should disable DTP by using the &lt;code&gt;switchport nonegotiate&lt;/code&gt; command on your trunks so that DTP negotiation is disabled. This is like having an access port on a trunk. You say you can't do that because you don't control the core switch, and that really makes your question off-topic here because questions about networks which you do not control are explicitly off-topic here. I don't really see the need to change the core switch to use a trunk as I have described, unless this is really layer-3, not layer-2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the real problem will be trying to send a lot of SPAN traffic over a single 100 Mb interface toward the core switch will cause real problems with the rest of the network.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;One option available on some switch models is ERSPAN, which was only available on a very few device models (65xx, ASR1xxx, Nexus), but Cisco recently released newer code versions for &lt;em&gt;some&lt;/em&gt; 3xxx and 4xxx switch models. Without a specific model, I can't say for sure if your particular switches support this new code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ERSPAN will encapsulate SPAN into a GRE tunnel so that the SPAN traffic may be routed via layer-3, which is not possible with SPAN or RSPAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/lanswitch/configuration/xe-3s/lanswitch-xe-3s-book/lnsw-conf-erspan.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Chapter: Configuring ERSPAN&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;ERSPAN Overview&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;The Cisco ERSPAN feature allows you to monitor traffic on one or more&#xA;  ports or more VLANs, and send the monitored traffic to one or more&#xA;  destination ports. ERSPAN sends traffic to a network analyzer such as&#xA;  a Switch Probe device or other Remote Monitoring (RMON) probe. ERSPAN&#xA;  supports source ports, source VLANs, and destination ports on&#xA;  different routers, which provides remote monitoring of multiple&#xA;  routers across a network (see the figure below).&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;On a Cisco ASR 1000 Series Router, ERSPAN supports encapsulated&#xA;  packets of up to 9180 bytes. The default ERSPAN maximum transmission&#xA;  unit (MTU) size is 1500 bytes. If the ERSPAN payload length, which&#xA;  comprises the encapsulated IPv4 header, generic routing encapsulation&#xA;  (GRE) header, ERSPAN header, and the original packet, exceeds the&#xA;  ERSPAN MTU size, the replicated packet is truncated to the default&#xA;  ERSPAN MTU size.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ERSPAN consists of an ERSPAN source session, routable ERSPAN GRE&#xA;  encapsulated traffic, and an ERSPAN destination session.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can configure an ERSPAN source session, an ERSPAN destination&#xA;  session, or both on a Cisco ASR 1000 Series Router. A device that has&#xA;  only an ERSPAN source session configured is called an ERSPAN source&#xA;  device, and a device that has only an ERSPAN destination session&#xA;  configured is called an ERSPAN termination device. A Cisco ASR 1000&#xA;  Series Router can act as both an ERSPAN source device and an ERSPAN&#xA;  termination device. You can terminate an ERSPAN session with a&#xA;  destination session on the same Cisco ASR 1000 Series Router.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;An ERSPAN source session is defined by the following parameters:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;A session ID&lt;/li&gt;&#xA;  &lt;li&gt;List of source ports or source VLANs to be monitored by the session&lt;/li&gt;&#xA;  &lt;li&gt;The destination and origin IP addresses, which are used as the    destination and source IP addresses of the GRE envelope for the&lt;br&gt;&#xA;  captured traffic, respectively&lt;/li&gt;&#xA;  &lt;li&gt;ERSPAN flow ID&lt;/li&gt;&#xA;  &lt;li&gt;Optional attributes, such as, IP type of service (TOS) and IP Time to    Live (TTL), related to the GRE envelope&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;An ERSPAN destination session is defined by the following:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Session ID&lt;/li&gt;&#xA;  &lt;li&gt;Destination ports&lt;/li&gt;&#xA;  &lt;li&gt;Source IP address, which is the same as the destination IP address of    the corresponding source session&lt;/li&gt;&#xA;  &lt;li&gt;ERSPAN flow ID, which is used to match the destination session with    the source session&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;ERSPAN source sessions do not copy ERSPAN GRE-encapsulated traffic&#xA;  from source ports. Each ERSPAN source session can have either ports or&#xA;  VLANs as sources, but not both.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The ERSPAN source sessions copy traffic from the source ports or&#xA;  source VLANs and forwards the traffic using routable GRE-encapsulated&#xA;  packets to the ERSPAN destination session. The ERSPAN destination&#xA;  session switches the traffic to the destination ports.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Figure 1. ERSPAN Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ukTQT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ukTQT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Monitored Traffic&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For a source port or a source VLAN, the ERSPAN can monitor the&#xA;  ingress, egress, or both ingress and egress traffic. By default,&#xA;  ERSPAN monitors all traffic, including multicast and Bridge Protocol&#xA;  Data Unit (BPDU) frames.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-14T02:22:10.010" LastActivityDate="2016-10-14T02:22:10.010" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35757" PostTypeId="1" CreationDate="2016-10-14T01:21:14.063" Score="1" ViewCount="1672" Body="&lt;p&gt;I am sure this is a common question but would like to know the best practices.  I have a pair of Juniper routers connecting to a IRFed HP 10k core switch. My HP core runs stp and we are tyring to extend the L2 of HP core to router as well, for that we would need to enable the rstp on the Juniper mx routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does RSTP and STP on core works well or do we need to move to rstp on the core as well?&lt;/p&gt;&#xA;" OwnerUserId="22114" LastActivityDate="2017-04-09T03:39:03.567" Title="RSTP Vs STP Vs MSTP" Tags="|spanning-tree|ieee-802.1w|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35762" PostTypeId="1" AcceptedAnswerId="35797" CreationDate="2016-10-14T09:30:34.903" Score="2" ViewCount="1326" Body="&lt;p&gt;I have a question about QoS with multiple classes. In our switch with IOS-XE we use five classes to define QoS. Class 1 is a priority class so configured “priority level 1”. The remaining bandwidth of the link must be divided over the four remaining classes. This is done by the command “bandwidth remaining ratio 4” in class 2 to 5. This works OK. But what I want is also to shape the traffic in class 2 to 25% of the link speed. So I want the remaining bandwidth evenly divided over class 2 to 5 but make sure class 2 doesn’t use more than 25% of the link speed. I tried to use a child-policy map in class 2 that shaped the traffic to a quarter of the link speed but got the following error when I tried to configure the child policy-map: “Unsupported hierarchical policy.. Two level queuing policies are not supported!!”&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are my wishes possible to configure in IOS-XE?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map testqos&#xA;  class q1&#xA;    priority level 1&#xA;  class q2&#xA;    bandwidth remaining ratio 4&#xA;  class q3&#xA;    bandwidth remaining ratio 4&#xA;  class q4&#xA;    bandwidth remaining ratio 4&#xA;  class q5&#xA;    bandwidth remaining ratio 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31269" LastEditorUserId="509" LastEditDate="2016-10-16T09:54:09.990" LastActivityDate="2016-10-18T13:45:26.297" Title="Use bandwidth and shape concurrent" Tags="|cisco|qos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35763" PostTypeId="2" ParentId="35750" CreationDate="2016-10-14T09:54:32.570" Score="10" Body="&lt;p&gt;That's a lot of questions, so let's take them one by one.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;What exactly is 802.1X Port-Based Authentication?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.1X&quot; rel=&quot;noreferrer&quot;&gt;Wikipedia&lt;/a&gt; :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IEEE 802.1X is an IEEE Standard for port-based Network Access Control&#xA;  (PNAC). It is part of the IEEE 802.1 group of networking protocols. It&#xA;  provides an authentication mechanism to devices wishing to attach to a&#xA;  LAN or WLAN.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In other words, it is a mechanism used in (mostly) switches and wireless access-points to allow or block devices to access the &lt;em&gt;network&lt;/em&gt; (or granularly allow access to parts of it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example if you have a network port in a meeting room, you can enable 802.1x on the switchport and configure it in such a way that when an employee connects she has access to the entire network but if a guest connects (with a temporary password) he can only reach the Internet and if a passer-by is tempted to try his luck, he cannot access anything at all.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Doesn't it also use RADIUS as it's underlying authentication mechanism?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Yes and no. 802.1x uses &lt;a href=&quot;https://en.wikipedia.org/wiki/Extensible_Authentication_Protocol&quot; rel=&quot;noreferrer&quot;&gt;Extensible Authentication Protocol (EAP)&lt;/a&gt;, and the wikipedia article about 802.1x has &lt;a href=&quot;https://en.wikipedia.org/wiki/File:802.1X_wired_protocols.png&quot; rel=&quot;noreferrer&quot;&gt;this nice drawing&lt;/a&gt; that shows that for &lt;em&gt;wired&lt;/em&gt; 802.1x:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;EAP over LAN (EAPoL) is used between the Supplicant (software on your laptop) and the Authenticator (switch)&lt;/li&gt;&#xA;&lt;li&gt;EAP is then usually tunnelled over Radius between the Authenticator and the Authentication Server, but it can also be done over &lt;a href=&quot;https://en.wikipedia.org/wiki/Diameter_(protocol)&quot; rel=&quot;noreferrer&quot;&gt;Diameter&lt;/a&gt; (the successor to Radius)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For &lt;em&gt;wireless&lt;/em&gt; it is similar in the sense that there is also no Radius between the supplicant and the authenticator, only between the authenticator and the auth server (to tunnel the EAP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the &lt;em&gt;Extensible&lt;/em&gt; in EAP's name is very true, there are dozens of EAP protocols that you can choose from, some will use passwords, others certificates or both, etc. etc.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;What are their differences?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Well, it's a bit like comparing apples and oranges.&#xA;Dot1x is not really a protocol but more a framework in which protocols like EAPoL and Radius are used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simplified (maybe over-simplified?) you could say:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Radius is typically used as a 'simple' authentication method to control who can login to a router (or other device), or who can connect using a VPN client. Sometimes also for authorization, e.g. to determine the privilege-level when you log in to a router, or to push a dynamic access-list for a vpn user.&lt;/li&gt;&#xA;&lt;li&gt;Dot1x is typically used to control access to switchports and wifi.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h3&gt;And if we can somehow compare them, which one is more secure?&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;I don't believe (but anyone please correct me) that there are scenarios where you can choose between one or the other. It may make miore sense to compare Radius and EAP, to some extent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some things to consider:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;EAP is end-to-end while Radius is only used between the Authenticator and the Authentication Server and so you need to make sure that the part between the client and the Authenticator is also secured; e.g. use SSH instead of telnet to log in to your router.&lt;/li&gt;&#xA;&lt;li&gt;similarly some (but not all) EAP methods can be used for &lt;em&gt;mutual&lt;/em&gt; authentication (between the supplicant and the authentication server!), in the Radius case it depends again on what protocol is used between client and authenticator.&lt;/li&gt;&#xA;&lt;li&gt;EAP is as secure as the EAP method you select (e.g. LEAP or EAP-MD5 are weak)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-14T09:54:32.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35766" PostTypeId="1" AcceptedAnswerId="35769" CreationDate="2016-10-14T14:07:50.353" Score="1" ViewCount="5583" Body="&lt;p&gt;I have seen plenty of scenarios where private ASN's are used in a BGP setup and the same for public ASN's - my question is how (or rather is it possible) does BGP work across a network topology that employs both private and public ASN's?&lt;/p&gt;&#xA;" OwnerUserId="31274" LastEditorUserId="8499" LastEditDate="2019-01-05T00:15:18.367" LastActivityDate="2019-01-05T00:15:18.367" Title="Peering between a private and public ASN (BGP)" Tags="|routing|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35767" PostTypeId="2" ParentId="9537" CreationDate="2016-10-14T14:14:44.783" Score="1" Body="&lt;p&gt;You can fix the DRAM issue heating up the DRAM module using a simple heating gun. Just fixed 1 switch using this method.&#xA;The issue involves the welding points of the DRAM modules, so you don't need to replace them.&lt;/p&gt;&#xA;" OwnerUserId="31276" LastActivityDate="2016-10-14T14:14:44.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35769" PostTypeId="2" ParentId="35766" CreationDate="2016-10-14T15:21:55.297" Score="1" Body="&lt;p&gt;ASNs are not like IP addresses, they are more like router hops. Each BGP speaker only needs to worry about the next hop. If the router knows how to get to the next AS, then it can, whether the ASN of the next router is public or private.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Private AS numbers are artificial. They are no different than a public AS number, and routers don't have an inherent knowledge that any number is public or private. A router only knows what AS numbers its eBGP neighbors connect with because that must be configured in the router. It is only the advertised prefixes which are dynamic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-14T15:21:55.297" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35770" PostTypeId="1" AcceptedAnswerId="35772" CreationDate="2016-10-14T15:27:45.937" Score="0" ViewCount="60" Body="&lt;p&gt;This may seem obvious but after searching can't find an answer. I have built many smaller networks using static IP addresses where the default gateway is the router going to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to add a private network that has no internet access and add things like backup NAS. In a simple scenario, say two servers and a workstation add a new switch, connect the NAS and the second NIC in the servers/workstation and just assign a unique (for our network) class C 192.168.0.0/16 (255.255.0.0) IP address/subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bit that confuses me is what to do about the default gateway, as no gateway as such is required. Do we need a router even though that network is only internal? If not how do I set this parameter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="31278" LastActivityDate="2021-01-11T07:17:40.883" Title="Adding a private network - basic question" Tags="|routing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35772" PostTypeId="2" ParentId="35770" CreationDate="2016-10-14T15:58:54.920" Score="3" Body="&lt;p&gt;The configuration you want is fine, there will be no default gateway on that subnet, so for instance on a Windows host or Linux GUI that field would be left blank in the network setup.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-10-14T15:58:54.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35774" PostTypeId="2" ParentId="35611" CreationDate="2016-10-14T16:59:13.793" Score="1" Body="&lt;p&gt;The Attach-Request PDU is encapsulated in the rrcConnectionSetupComplete message. Also in the rrcConnectionSetupComplete message is a field called selectedPLMN-Identity, whose value refers to a PLMN chosen from the plmn-IdentityList from SIB1. The Attach-Request PDU contains information from which to derive the PLMN of the SIM the mobile is using. So the mobile is telling the base station the PLMN it wants to use, and the PLMN of its SIM. Based on those two pieces of information, higher layer entities can determine whether to reject w/ the &quot;PLMN not allowed&quot; message. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer how a mobile can send the attach request, the answer to that is simply how the attach procedure works. There is no unique identifying information transmitted by the mobile user until the RRCConnectionSetupComplete message. &lt;/p&gt;&#xA;" OwnerUserId="24944" LastActivityDate="2016-10-14T16:59:13.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35775" PostTypeId="1" AcceptedAnswerId="35777" CreationDate="2016-10-14T17:06:04.360" Score="4" ViewCount="4531" Body="&lt;p&gt;I am still new to VLANs and the concept, so please bear with me...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a core switch to handle all of our traffic, then other switches are connected to the core switch from different areas of the building. I'd like to use VLANs for different areas, but it includes devices that cannot add a VLAN tag to the packets (i.e. printers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I set the Uplink Port (usually Ports 1&amp;amp;2) to be TAGGED VLANs for all the VLANs I need, can I set certain ports goign to devices to be UNTAGGED, and have the traffic route through the correct VLAN?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Core Switch  ==========Switch 01&#xA;VID 1,10,20,...        P1/2 - TAGGED VLAN 1,10,20,...&#xA;                       P5   - UNTAGGED VLAN 10 &amp;lt;== Will this get tagged when it leaves?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4371" LastEditorUserId="4371" LastEditDate="2016-10-14T17:28:10.650" LastActivityDate="2016-10-14T17:28:10.650" Title="Untagged VLAN to Tagged VLAN" Tags="|vlan|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35776" PostTypeId="2" ParentId="35775" CreationDate="2016-10-14T17:15:37.537" Score="2" Body="&lt;p&gt;You should tag frames on trunks between switches. Most end-devices don't understand VLAN tags. Some servers do, but, again, you tag the frames only on a trunk to such servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access interfaces don't tag frames. The reason to tag frames is so that a trunk with frames from multiple VLANs can distinguish which frames belong to which VLANs. Access ports only have one VLAN, so there is no reason to tag frames on an access interface. You only set the VLAN for the access interfaces, but do not tag frames for those interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-14T17:15:37.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35777" PostTypeId="2" ParentId="35775" CreationDate="2016-10-14T17:25:34.647" Score="6" Body="&lt;p&gt;Short answer:  Yes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tagged and untagged frames are different formats.  The switch will convert from one to the other as necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you set a port to &quot;Untagged VLAN 10&quot; (switchport access vlan 10 in Cisco-speak), a frame entering that port is associated with VLAN 10.  If the frame is forward out a port that is tagged, the frame is converted to 802.1q format, which includes a VLAN tag.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The process also happens the other way: a frame received on a trunk port with a VID of 10 will be forwarded out the untagged port as a &quot;regular&quot; Ethernet frame.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-10-14T17:25:34.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35779" PostTypeId="2" ParentId="23447" CreationDate="2016-10-14T19:16:41.470" Score="1" Body="&lt;p&gt;For thoses having the vlan membership bug on modern browsers and not willing to use and outdated browser, here's a little trick :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Open the switch web admin panel&lt;/li&gt;&#xA;&lt;li&gt;Open the developer console&lt;/li&gt;&#xA;&lt;li&gt;Paste IXML.serialize = function(d) { return d?d.outerHTML:null; } in the console to overwrite their buggy function&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The VLAN membership/LAG membership pages should be working now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best,&#xA;Thomas&lt;/p&gt;&#xA;" OwnerUserId="31285" LastActivityDate="2016-10-14T19:16:41.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35780" PostTypeId="1" AcceptedAnswerId="35781" CreationDate="2016-10-14T19:54:32.173" Score="1" ViewCount="30" Body="&lt;p&gt;So basically, as long as there would be a spare but constant stream of packets, which could only serve a role of securing the claimed MAC address on the switch, wouldn't the ARP spoofing be impossible to perform? How would it backfire?&lt;/p&gt;&#xA;" OwnerUserId="6296" LastActivityDate="2016-10-14T20:28:39.370" Title="Would be ARP spoofing attack prevented/limited if switch wouldn't allow for too fast mac address changes on a single port?" Tags="|arp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35781" PostTypeId="2" ParentId="35780" CreationDate="2016-10-14T20:28:39.370" Score="0" Body="&lt;p&gt;A single switch port can have many MAC addresses using it at the same time. For instance, a switch to switch connection could have all the MAC addresses connected to the the other switch coming into the port. The port doesn't change MAC addresses because the MAC address table is arranged by MAC address, not port - the MAC addresses are not assigned to ports, but the ports are assigned to MAC addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-14T20:28:39.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35782" PostTypeId="1" AcceptedAnswerId="35901" CreationDate="2016-10-14T20:34:41.743" Score="1" ViewCount="1086" Body="&lt;p&gt;EX4200 switch has a firewall filter applied to input of trunk port.&#xA;Intent is to rate-limit (police) input bandwidth per VLAN id.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the 'show firewall' command points out that policing is taking place only for the filter last &quot;catch all&quot; term (so named ACCEPT_OTHER_VLANS). Traffic from VLAN115 is actually being policed at the 2Mbps limit of the ACCEPT_OTHER_VLANS term.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration looks fine to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this specific hardware/software, can anyone spot&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a configuration mistake?&lt;/li&gt;&#xA;&lt;li&gt;an unsupported feature?&lt;/li&gt;&#xA;&lt;li&gt;a known defect?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Please advise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware: EX4200-24F&lt;/p&gt;&#xA;&#xA;&lt;p&gt;JunOS: 12.3R4.6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration is: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set firewall policer RATE_LIMIT_2M_T if-exceeding bandwidth-limit 2m&#xA;set firewall policer RATE_LIMIT_2M_T if-exceeding burst-size-limit 6250000&#xA;set firewall policer RATE_LIMIT_2M_T then discard&#xA;set firewall policer RATE_LIMIT_30M_T if-exceeding bandwidth-limit 30m&#xA;set firewall policer RATE_LIMIT_30M_T if-exceeding burst-size-limit 6250000&#xA;set firewall policer RATE_LIMIT_30M_T then discard&#xA;set firewall policer RATE_LIMIT_20M_T if-exceeding bandwidth-limit 20m&#xA;set firewall policer RATE_LIMIT_20M_T if-exceeding burst-size-limit 6250000&#xA;set firewall policer RATE_LIMIT_20M_T then discard&#xA;&#xA;set vlans vlan115 vlan-id 115&#xA;set vlans vlan123 vlan-id 123&#xA;&#xA;set firewall family ethernet-switching filter RATE_LIMIT_VLANS term RATE_LIMIT_VLAN123 from vlan vlan123&#xA;set firewall family ethernet-switching filter RATE_LIMIT_VLANS term RATE_LIMIT_VLAN123 then policer RATE_LIMIT_30M_T&#xA;set firewall family ethernet-switching filter RATE_LIMIT_VLANS term RATE_LIMIT_VLAN115 from vlan vlan115&#xA;set firewall family ethernet-switching filter RATE_LIMIT_VLANS term RATE_LIMIT_VLAN115 then policer RATE_LIMIT_20M_T&#xA;set firewall family ethernet-switching filter RATE_LIMIT_VLANS term ACCEPT_OTHER_VLANS then policer RATE_LIMIT_2M_T&#xA;&#xA;set interfaces xe-0/1/0 mtu 9216&#xA;set interfaces xe-0/1/0 unit 0 family ethernet-switching port-mode trunk&#xA;set interfaces xe-0/1/0 unit 0 family ethernet-switching vlan members vlan115&#xA;set interfaces xe-0/1/0 unit 0 family ethernet-switching vlan members vlan123&#xA;set interfaces xe-0/1/0 unit 0 family ethernet-switching filter input RATE_LIMIT_VLANS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Result is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@ex4200&amp;gt; show firewall filter RATE_LIMIT_VLANS&#xA;&#xA;Filter: RATE_LIMIT_VLANS&#xA;Policers:&#xA;Name                                                Bytes                Packets&#xA;RATE_LIMIT_20M_T-RATE_LIMIT_VLAN115                                          0&#xA;RATE_LIMIT_2M_T-ACCEPT_OTHER_VLANS                                    28283836&#xA;RATE_LIMIT_30M_T-RATE_LIMIT_VLAN123                                          0&#xA;&#xA;{master:0}&#xA;user@ex4200&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="498" LastActivityDate="2016-10-19T10:38:26.850" Title="Juniper EX4200 firewall filter applied to trunk port not matching specific VLAN" Tags="|vlan|juniper|troubleshooting|juniper-junos|juniper-ex|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35783" PostTypeId="1" CreationDate="2016-10-14T21:59:06.763" Score="0" ViewCount="490" Body="&lt;p&gt;I've got two routers, A and B. A gets some routes over BGP over a VPN connection, and has a leg on 10.0.0.0/24. It also can access the whole 10.0.0.0/16 via its default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B is on 192.168.0.0/24. It can access 192.168.0.0/16 via its default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a router between A and B that I don't control (ie I can't peer with it). I can't use multicast traffic between A and B. I could potentially use a GRE tunnel between A and B to get multicast across, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A to have a route to 192.168.0.0/16&lt;/li&gt;&#xA;&lt;li&gt;B to have a route to 10.0.0.0/16 + the routes A got off the VPN connection&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How could I set this up?&lt;/li&gt;&#xA;&lt;li&gt;Could I use eBGP, iBGP or OSPF?&lt;/li&gt;&#xA;&lt;li&gt;Can I use OSPF at all when there's that router in the middle and I can't do multicast?&lt;/li&gt;&#xA;&lt;li&gt;If using OSPF was possible, should I use multiple areas? Is it necessary (as I need to do route summarization)?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the curious, the routers are on Amazon on a VPC each, and the VPCs are joined with a peering connection.&lt;/p&gt;&#xA;" OwnerUserId="31290" LastEditorUserId="8499" LastEditDate="2019-01-05T00:07:23.467" LastActivityDate="2023-02-15T18:34:22.467" Title="IGP between 2 routers with an uncooperative router in the middle" Tags="|routing|bgp|ospf|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35784" PostTypeId="2" ParentId="35783" CreationDate="2016-10-15T00:28:57.343" Score="0" Body="&lt;p&gt;First, you don't normally configure a default &lt;em&gt;gateway&lt;/em&gt; for a router; the router could &lt;em&gt;be&lt;/em&gt; a default gateway for end-hosts. You could configure a default &lt;em&gt;route&lt;/em&gt; for a router, but that route is &lt;code&gt;0.0.0.0/0&lt;/code&gt;, not something like &lt;code&gt;10.0.0.0/16&lt;/code&gt;. You could configure a &lt;em&gt;static&lt;/em&gt; route for &lt;code&gt;10.0.0.0/16&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As waza-ari points out, you could use a GRE tunnel to peer the routers with OSPF if it is a broadcast medium, or you could configure the interface for OSPF as a non-broadcast medium, but you would need a static route to reach the interface of the corresponding router. Also, eBGP could be used with multihop, or iBGP could be used, but you need a static route to reach the corresponding interface of the other router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-15T00:28:57.343" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35794" PostTypeId="1" AcceptedAnswerId="36031" CreationDate="2016-10-15T18:00:07.497" Score="2" ViewCount="859" Body="&lt;p&gt;I am trying to make a C2811 (yes, with switching ports, thank you very much) join a VTP domain. This fails with the syslog message &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VTP LOG RUNTIME: DRAM failed for domain&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is rare, but google does turn up nothing for that. Checked the VTP version (2), password and domain name (yes did make a mistake with that, at first) but the C2811 downgrades from client to transparent the moment I set the domain name. The previous mentioned message is preceded by: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VTP LOG RUNTIME: Subset packet received, domain = [DELETED], rev = 43, seq = 1, length = 612&#xA;%SW_VLAN-6-VTP_MODE_CHANGE: VLAN manager changing device mode from CLIENT to TRANSPARENT.&#xA;VTP LOG RUNTIME: VTP mode changed to Transparent.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The C2811 does have a limit of max 36 vlans, but the number to be passed through VTP is 25. Another switch joined the domain nicely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DRAM message let me to check memory, but that didn't reveal anything either:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh mem sum&#xA;                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)&#xA;Processor   4813DE60   118235552    44749540    73486012    69242144    68504536&#xA;      I/O   3F200000    14680064     7002632     7677432     7262336     7610556&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am at a loss, anybody know something how to solve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Added for @hertitu :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco IOS Software, 2800 Software (C2800NM-ADVIPSERVICESK9-M), Version 12.4(24)T, RELEASE SOFTWARE (fc1)    &#xA;&#xA;c2811# sh vtp stat  &#xA;VTP Version : 2  &#xA;Configuration Revision : 0  &#xA;Maximum VLANs supported locally : 36  &#xA;Number of existing VLANs : 5  &#xA;VTP Operating Mode : Transparent  &#xA;VTP Domain Name : MYCOMPANY  &#xA;VTP Pruning Mode : Disabled  &#xA;VTP V2 Mode : Enabled  &#xA;VTP Traps Generation : Disabled &#xA;MD5 digest : 0xC3 0x66 0xAA 0x9A 0x4C 0x6C 0x22 0x97&#xA;Configuration last modified by 192.168.160.254 at 10-14-16 07:03:14 &#xA;c2811#  &#xA;&#xA;c3750# sh vtp stat  &#xA;VTP Version : 2  &#xA;Configuration Revision : 43  &#xA;Maximum VLANs supported locally : 1005  &#xA;Number of existing VLANs : 25  &#xA;VTP Operating Mode : Server  &#xA;VTP Domain Name : MYCOMPANY  &#xA;VTP Pruning Mode : Disabled  &#xA;VTP V2 Mode : Enabled  &#xA;VTP Traps Generation : Disabled  &#xA;MD5 digest : 0xC2 0x15 0x21 0xDF 0x96 0xA9 0xD9 0xAC  &#xA;Configuration last modified by 192.168.160.1 at 10-14-16 12:03:57 –  &#xA;Local updater ID is 192.168.160.1 on interface Vl1 (lowest numbered     VLAN interface found)  &#xA;c3750#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another clue: router that I claimed joined the domain nicely (a WS-C3650-24TS/(CAT3K_CAA-UNIVERSALK9-M), Version 03.03.05SE) did indeed join -same revision number and sh vl brief matches-, but gives a MD5 mismatch: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;`c3650#sh vtp status  &#xA;VTP Version capable             : 1 to 3&#xA;VTP version running             : 2&#xA;VTP Domain Name                 : MYCOMPANY&#xA;VTP Pruning Mode                : Disabled&#xA;VTP Traps Generation            : Disabled&#xA;Device ID                       : 0035.1aa8.cb80&#xA;Configuration last modified by 192.168.160.1 at 10-14-16 12:03:57&#xA;&#xA;Feature VLAN:&#xA;--------------&#xA;VTP Operating Mode                : Client&#xA;Maximum VLANs supported locally   : 1005&#xA;Number of existing VLANs          : 25&#xA;Configuration Revision            : 43&#xA;MD5 digest                        : 0xA2 0x76 0x9C 0xF7 0x0A 0x1A 0x0D 0xBF &#xA;                                    0x13 0xEE 0x4A 0x25 0x59 0x9F 0xF0 0xA7 &#xA;*** MD5 digest checksum mismatch on trunk: Gi1/0/24 ***&#xA;c3650#`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31307" LastEditorUserId="31307" LastEditDate="2016-10-18T18:37:10.090" LastActivityDate="2016-10-24T10:38:32.377" Title="switch joining vtp domain fails with unknown error" Tags="|cisco|vtp|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35797" PostTypeId="2" ParentId="35762" CreationDate="2016-10-15T19:26:27.397" Score="0" Body="&lt;p&gt;If you want class q2 to use up to, but no more than, 25% of the link speed, you need to use policing. Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  class q2&#xA;    bandwidth percent 25&#xA;    police cir percent 25 conform-action transmit exceed-action drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can create a shaping policy for the physical interface that calls your policy map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!***** QoS - Generic Traffic Shaping *****&#xA;policy-map testshaping&#xA; description Physical Interface Shaping&#xA;  class class-default&#xA;    shape average &amp;lt;SHAPE RATE&amp;gt; &amp;lt;SHAPE BC&amp;gt;&#xA;    service-policy testqos&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You probably want to shape to a percentage of your actual link rate if your WAN bandwidth is a sub-rate of the interface speed. For instance, if your interface is a 1 Gb interface, but your WAN bandwidth is only 10 Mb, you probably want to shape to something like 95% of the 10 Mb (shape rate = &lt;code&gt;9500000&lt;/code&gt;, shape BC = &lt;code&gt;38000&lt;/code&gt;) to account for protocol overhead. If you use a real-time protocol like VoIP that has a lot of very small packets, you will want to decrease the percentage. You don't need to do that for a full-rate WAN bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apply the shaping policy to the physical interface instead of your original policy map. The shaping policy calls your original policy map.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-18T13:45:26.297" LastActivityDate="2016-10-18T13:45:26.297" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="35804" PostTypeId="1" AcceptedAnswerId="35811" CreationDate="2016-10-16T14:56:07.267" Score="2" ViewCount="1739" Body="&lt;p&gt;I have some doubts over physical and logical address system. I am reading Fourouzan TCP/IP protocol suite.By reading first chapter what I understood is that to communicate between two different networks the logical address communicate with each other .They are provided by ISP. So are they always unique with the router in my home..?? I mean if I apply for an Internet connection does my router have unique IP or logical address ..?? or is it that there is a more centralized system of my area which has a unique IP which in turn again distributes IP to router in my home..??? And since I do not come to know about physical address of source how does the source IP will determine that exactly who is my destination logical address .since my computer will get assigned with new IP everytime I login in a particular network .I am pretty confused about how it works..??? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="27399" LastActivityDate="2017-03-15T23:30:11.043" Title="How does Logical Address works?" Tags="|routing|ip-address|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35806" PostTypeId="1" AcceptedAnswerId="35807" CreationDate="2016-10-16T15:39:21.710" Score="1" ViewCount="923" Body="&lt;p&gt;Consider a scenario where I have two border routers one peering with ISP A and the other peering with ISP B. Let say I receive full tables from both ISP A&amp;amp;B.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internally we run OSPF and my question is how do I make sure that outgoing packages are routed to the correct border router in the first place? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the best path to a certain prefix is via ISP A packages should always be directed to B1 and not B2 to avoid the extra hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/V1c28.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V1c28.png&quot; alt=&quot;Network diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16331" LastActivityDate="2016-10-16T17:31:12.027" Title="Load balance between two edge routers using OSPF" Tags="|routing|bgp|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35807" PostTypeId="2" ParentId="35806" CreationDate="2016-10-16T17:31:12.027" Score="1" Body="&lt;p&gt;The issue here is that in order for the internal routers to know which of the border routers they should route to, you would need to redistribute full Internet routing tables into OSPF which isn't going to be possible.  OSPF isn't designed to handle and cannot support the 600,000+ external routes required.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would normally have the two border routers advertise a default route into OSPF and accept that 1/2 of the traffic will need to pass across the iBGP link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a compromise, if you know there are some specific prefixes that would be better routed via one of the border routers you could redistribute BGP into OSPF using a route-map and prefix-lists so that only a small number of specific prefixes are redistributed into OSPF.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-10-16T17:31:12.027" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35810" PostTypeId="1" CreationDate="2016-10-16T18:41:34.967" Score="1" ViewCount="284" Body="&lt;p&gt;Somebody knows why NSSA external routes filtering on ABR is so unuseful on JunOS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I want to filter all routes coming from NSSA area 0.0.0.3 except &quot;10.0.0.0/8 orlonger&quot; routes. To do that I must enter those commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set protocols ospf area 0.0.0.3 nssa area-range 128.0.0.0/1 restrict&#xA;set protocols ospf area 0.0.0.3 nssa area-range 64.0.0.0/2 restrict&#xA;set protocols ospf area 0.0.0.3 nssa area-range 32.0.0.0/3 restrict&#xA;set protocols ospf area 0.0.0.3 nssa area-range 16.0.0.0/4 restrict&#xA;set protocols ospf area 0.0.0.3 nssa area-range 0.0.0.0/5 restrict&#xA;set protocols ospf area 0.0.0.3 nssa area-range 12.0.0.0/6 restrict&#xA;set protocols ospf area 0.0.0.3 nssa area-range 8.0.0.0/7 restrict&#xA;set protocols ospf area 0.0.0.3 nssa area-range 11.0.0.0/8 restrict&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Maybe someone knows a more straightforward way to accomplish this task on JunOS?&lt;/p&gt;&#xA;" OwnerUserId="30216" LastActivityDate="2016-10-16T18:41:34.967" Title="Juniper filter OSPF type-7 routes on ABR" Tags="|juniper|juniper-junos|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35811" PostTypeId="2" ParentId="35804" CreationDate="2016-10-16T19:33:57.053" Score="1" Body="&lt;p&gt;In your business, you may have multiple networks. You may have a single site with multiple VLANs, and each VLAN has a different network, or you may have multiple sites, and each site has a different network, possibly multiple networks, per site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The physical addresses are usually MAC addresses burned into the NICs of the hosts connected to the networks. Layer-2 uses those addresses to deliver frames from one host to another host on the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The logical addresses are assigned to layer-3, usually through DHCP, but there are other methods, too. The logical addresses on one network will all be in the same network. Hosts will use the layer-3 addresses to communicate with hosts on a different network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A host sending something out will look at the layer-3 address of the destination, and it will compare that to its own layer-3 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if the addresses are on the same network, the host will create a frame with the destination layer-2 address of the destination host, and the frame will be sent directly to the destination host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination host is on a different network, the host will create the frame with the layer-2 address of its configured gateway, and the frame will be sent directly to the gateway. The gateway then must find a path to the network where the destination host is, using the layer-3 address, and the gateway will forward the packet toward the destination network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-2 (physical) addresses on the frames the host sends will not survive from one network to the next. The layer-2 addresses are in the frame headers, and a layer-3 device (gateway/router) will strip the frame from the packet and discard it in order to get to the layer-3 (logical) packet with the layer-3 addresses. The router will build a new frame for the new interface toward the destination network to which it forwards the packet. This may happen several time before the packet reaches the destination network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-16T19:33:57.053" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35814" PostTypeId="1" AcceptedAnswerId="35815" CreationDate="2016-10-16T22:38:24.423" Score="2" ViewCount="927" Body="&lt;p&gt;I would like to query a LLDP enabled switch / router for information about current FW, Manufacturer, etc... But I am not directly connected to the switch, but through an Access Layer Switch  or a Wireless AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would I be able to get this information using LLDP, even though there are multiple physical layer hops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Information I am looking for:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Inventory - Hardware Revision TLV (OUI = 00-12-BB, Subtype = 5) &#xA;Inventory - Firmware Revision TLV (OUI = 00-12-BB, Subtype = 6) &#xA;Inventory - Software Revision TLV (OUI = 00-12-BB, Subtype = 7) &#xA;Inventory - Serial Number TLV (OUI = 00-12-BB, Subtype = 8) &#xA;Inventory - Manufacturer Name TLV (OUI = 00-12-BB, Subtype = 9) &#xA;Inventory - Model Name TLV (OUI = 00-12-BB, Subtype = 10) &#xA;Inventory - Asset ID TLV (OUI = 00-12-BB, Subtype = 11) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31327" LastEditorUserId="8499" LastEditDate="2017-12-28T07:56:22.227" LastActivityDate="2017-12-28T07:56:22.227" Title="Does LLDP support traversing through multiple switches?" Tags="|switch|router|lldp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35815" PostTypeId="2" ParentId="35814" CreationDate="2016-10-16T22:41:08.140" Score="1" Body="&lt;p&gt;No. LLDP is a link protocol. Like the other link protocols, it only exists on the link, and it will not be forwarded to another link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, LLDP is to tell you that information for other devices on the link. That fails if the information is forwarded to a different link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-16T22:41:08.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35821" PostTypeId="2" ParentId="2962" CreationDate="2016-10-17T05:01:10.060" Score="-2" Body="&lt;p&gt;The minimum ethernet frame is based on the Ethernet Slot Time, which is 512 bit lengths (64 Bytes) for 10M ethernet. After subtracting 18 bytes for the ethernet header and CRC, you get 46 bytes of payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet Slot Time was specified so CSMA/CD would correctly function. One must be sure that the minimum frame size does not exceed the longest possible length of cable; if it did deterministic collision detection would be impossible. After collision detection at the maximum length of cable, you need the collision detection signal to return to the sender. &lt;/p&gt;&#xA;" OwnerUserId="31335" LastActivityDate="2016-10-17T05:01:10.060" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35824" PostTypeId="1" AcceptedAnswerId="35844" CreationDate="2016-10-17T13:46:39.390" Score="0" ViewCount="127" Body="&lt;p&gt;kindly help me How can I monitor &quot;Web Activity&quot; of standalone users/clients on WiFi/LAN without restricting them?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;=&gt; Requirements:-&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(1)   Just want to monitor &quot;The visited websites, HTTP, HTTPs, FTP, FTPs &amp;amp; Web Downloads&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2).  Users/clients should be in standalone or workstation means no &quot;Active Directory &amp;amp; no user authentication&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(3).  Users should have Admin rights on their Systems/Devices&#xA;      (e.g., Just like when we allowed someone to share our WiFi internet for their mobile devices or LAN internet for their laptops.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(4).   Avoid any type of installations on user/client end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(5).  Users can be on Windows, Mac, Linux &amp;amp; on &quot;Any Mobile Device i.e, tablet or smart phone&quot;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;=&gt; Internet Provisioning:-&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(1)   LAN internet (with DHCP scheme) is provided by &quot;Cisco ASA 5510&quot; through Cisco switches catalyst 2970/2960.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(2).  WiFi internet (with DHCP scheme) is provided by Huawei PTCL modem/router.&lt;/p&gt;&#xA;" OwnerUserId="31343" LastEditorUserId="31343" LastEditDate="2016-10-17T14:47:12.680" LastActivityDate="2016-10-17T22:15:07.877" Title="How to monitor &quot;Web Activity&quot; of standalone users/clients on WiFi/LAN without restricting them?" Tags="|switch|cisco-asa|ieee-802.11|lan|internet|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35826" PostTypeId="2" ParentId="24536" CreationDate="2016-10-17T16:40:15.330" Score="0" Body="&lt;p&gt;First off, you shouldn't need to place your modem in &quot;bridged mode&quot; or even mess with it, as Comcast keeps this under lock anyway. From the router enter the configuration example that Ron placed above. So for example, the Gi0/0 should be your &lt;strong&gt;outside interface&lt;/strong&gt; it is the ISP/Internet facing interface- i.e., Comcast -  and your &lt;strong&gt;Internal interface&lt;/strong&gt; is Gi0/1 the commands are no different except the descriptions and &quot;IP Nat overload&quot; if you are doing PAT as Comcast only gives you 1 IP address so using 1 to 1 maybe more helpful to you. interface command - after you created a DHCP &amp;amp; NAT Pool according to your public IP addressing scheme. Good luck Brother!&lt;/p&gt;&#xA;" OwnerUserId="31345" LastActivityDate="2016-10-17T16:40:15.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35829" PostTypeId="1" AcceptedAnswerId="35837" CreationDate="2016-10-17T17:10:54.627" Score="1" ViewCount="308" Body="&lt;p&gt;When talking about ports, sometimes I read articles that state &lt;code&gt;TCP port&lt;/code&gt; while others just say &lt;code&gt;port&lt;/code&gt;. Are there some features that make TCP port different from other ports in the &lt;code&gt;OS&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="19107" LastEditorUserId="8499" LastEditDate="2018-11-04T19:32:28.253" LastActivityDate="2018-11-04T19:32:28.253" Title="The meaning of TCP port in the network context" Tags="|tcp|protocol-theory|udp|layer4|transport-protocol|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35830" PostTypeId="1" AcceptedAnswerId="35928" CreationDate="2016-10-17T17:14:59.493" Score="1" ViewCount="4959" Body="&lt;p&gt;We've received an OLT ma5608T and an ONT hg8245H for a short period of time - we want to see if Huawei is better than Zhone.&#xA;We don't have a full documentation for this OLT because we're not a partner of Huawei.&#xA;My question is: is it possible to configure ONT services without accessing the ONT directly? On Zhone MXK OLT you'd do something like this in order to configure a PPPoE client on an ONT:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cpe rg wan modify &amp;lt;SLOT&amp;gt;/&amp;lt;PORT&amp;gt;/&amp;lt;ONT&amp;gt; vlan &amp;lt;VLAN_ID&amp;gt; pppoe-usr-id &amp;lt;PPP_USER&amp;gt; pppoe-password &amp;lt;PPP_PASSWORD&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately we can't find a corresponding command on Huawei ma5608T. Is it somewhere in the &lt;code&gt;service-port&lt;/code&gt; command? So far we've came up with this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;service-port 0 vlan &amp;lt;VLAN_ID&amp;gt; gpon 0/1/0 ont 0 gemport 1 multi-service user-encap pppoe&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But where should we configure a pppoe user and password used for authentication? &lt;/p&gt;&#xA;" OwnerUserId="31346" LastActivityDate="2018-11-01T12:30:28.900" Title="Configuring PPPoE client through OMCI on Huawei ma5608T" Tags="|pppoe|ppp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35831" PostTypeId="2" ParentId="35829" CreationDate="2016-10-17T17:15:07.637" Score="3" Body="&lt;p&gt;A port is really just a layer-4 address, the same way an IP address is a layer-3 address, or a MAC address is a layer-2 address. There are other layer-4 protocols than TCP. Some, like UDP, use ports, and some use something else, or nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When referring to ports, you need to distinguish which layer-4 protocol that you mean. A TCP port number is not the same as a UDP port number. In some cases it may be obvious. For instance, HTTP uses TCP for its transport, so in that context, a port would mean a TCP port.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-17T17:15:07.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35832" PostTypeId="2" ParentId="35814" CreationDate="2016-10-17T17:26:14.500" Score="-1" Body="&lt;p&gt;Media Endpoint Discovery that is an enhancement of LLDP, known as LLDP-MED, may help you doing that.&lt;/p&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-17T17:26:14.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35834" PostTypeId="1" AcceptedAnswerId="35841" CreationDate="2016-10-17T18:08:31.467" Score="0" ViewCount="1777" Body="&lt;p&gt;I've been tasked with assigning IPV6 addresses to be split into data centers in several different cities, in several different countries in several different continents. Part of the instructions is to use a &quot;2-6-6-2&quot; solution for allocating these IPs (even if there is a better solution I have no choice but to do this), meaning that I'm not splitting on the nibble boundary. My question is, how do I display this as an IPV6 address? I'm aware that splitting on the nibble boundary gives me 0-F to work with for each digit, but how does it work for not splitting on the nibble boundary? How do I represent 6 bits in one digit? I've looked online and all I can find are examples for splitting on the nibble boundary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that made sense.&lt;/p&gt;&#xA;" OwnerUserId="31347" LastEditorUserId="8499" LastEditDate="2017-12-28T07:52:48.037" LastActivityDate="2017-12-28T07:52:48.037" Title="How to split an IPV6 nibble?" Tags="|subnet|ipv6|" AnswerCount="2" CommentCount="3" ClosedDate="2017-12-28T07:51:47.587" ContentLicense="CC BY-SA 3.0" />
  <row Id="35835" PostTypeId="2" ParentId="10022" CreationDate="2016-10-17T18:11:49.107" Score="0" Body="&lt;p&gt;I ping and send packets from an IPv4 address to an IPv6 address by allocating an IPv4 /24 for NAT64 and doing that translation on my NAT64 router which is between the two networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use TAYGA on my dual stack NAT64 router to do the translation and on one of the NAT64 router interfaces it has only an IPv4 address and on the other interface it has only an IPv6 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TAYGA has the capability to set manual &quot;mappings&quot; between IPv4 and IPv6 addresses as well as dynamically assign IPv4 addresses for temporary mappings and it works both ways, from IPv4 -&gt; IPv6 and from IPv6 -&gt; IPv4.&lt;/p&gt;&#xA;" OwnerUserId="31348" LastActivityDate="2016-10-17T18:11:49.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35836" PostTypeId="2" ParentId="35834" CreationDate="2016-10-17T18:13:30.490" Score="0" Body="&lt;p&gt;You don't represent six bits in one digit. Each digit is four bits. What you do is use the CIDR notation. For example, there are ranges of IPv6 addresses for special functions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;fe80::/10 for Link-Local&lt;/li&gt;&#xA;&lt;li&gt;fc00::/7 for ULA&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It is all binary, just like IPv4 where you have addressing that does not map to the octet boundaries.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-17T18:13:30.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35837" PostTypeId="2" ParentId="35829" CreationDate="2016-10-17T18:44:47.617" Score="0" Body="&lt;p&gt;TCP and UDP are two protocols that operate in the layer 4 (transport) of the OSI/DOD Model, however tcp might use different port number for different type of service, for example if you are sending a mail, tcp will use smtp tcp port 25, if you send large file without messaging system like mail, tcp will use ftp tcp port 20/21&lt;/p&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-17T18:44:47.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35839" PostTypeId="1" AcceptedAnswerId="35840" CreationDate="2016-10-17T19:33:47.447" Score="1" ViewCount="2106" Body="&lt;p&gt;I understand that each port of a legacy switch can be connected to a device via ethernet cable. Thus, it is possible that one port can have multiple devices? This is because in SDN, this thing is possible since you can program it but I don't know if it is applicable in traditional networks.&lt;/p&gt;&#xA;" OwnerUserId="28219" LastActivityDate="2016-10-21T02:34:56.333" Title="Switch port with multiple devices" Tags="|cisco|switch|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35840" PostTypeId="2" ParentId="35839" CreationDate="2016-10-17T19:46:33.637" Score="0" Body="&lt;p&gt;I'm not sure that I understand your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could have a hub or another switch connected to a switch port, and the traffic from many devices could come through a single switch port, especially if the switch is a root bridge.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-17T19:46:33.637" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35841" PostTypeId="2" ParentId="35834" CreationDate="2016-10-17T21:41:25.423" Score="3" Body="&lt;p&gt;You have to count in binary for prefix lengths to make sense. With a 2-6-6-2 solution I assume you're talking about the 16 bits between /48 and /64, basically the bits that an end-site has to create subnets from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say that you have &lt;code&gt;2001:db8:1234::/48&lt;/code&gt; for your end-site. That gives you subnets &lt;code&gt;2001:db8:1234:0000::/64&lt;/code&gt; to &lt;code&gt;2001:db8:1234:ffff::/64&lt;/code&gt; to work with. Each hexadecimal character represents 4 bits, and as you say the schema you have been handed doesn't align with the hexadecimal characters (basically a natural 4-4-4-4 split).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, back to binary. Just looking at the 16 bits between the /48 and a /64 gives us:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0000 0000 0000 0000  =  ..:0000::/64&#xA;1111 1111 1111 1111  =  ..:ffff::/64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now organise them in the 2-6-6-2 split you describe. Let's write every combination of the first two bits. Of course the hexadecimal notation is still based on groups of 4 bits. I'll give you the first and last address of each value of the first two bits:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 000000 000000 00  =  0000 0000 0000 0000  =  ..:0000::/50&#xA;00 111111 111111 11  =  0011 1111 1111 1111  =  ..:3fff::/50&#xA;&#xA;01 000000 000000 00  =  0100 0000 0000 0000  =  ..:4000::/50&#xA;01 111111 111111 11  =  0111 1111 1111 1111  =  ..:7fff::/50&#xA;&#xA;10 000000 000000 00  =  1000 0000 0000 0000  =  ..:8000::/50&#xA;10 111111 111111 11  =  1011 1111 1111 1111  =  ..:bfff::/50&#xA;&#xA;11 000000 000000 00  =  1100 0000 0000 0000  =  ..:c000::/50&#xA;11 111111 111111 11  =  1111 1111 1111 1111  =  ..:ffff::/50&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's take the first one: &lt;code&gt;:0000:&lt;/code&gt; to &lt;code&gt;:3fff:&lt;/code&gt;. I'm going to give you some examples of the second field (6 bits):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00 000000 000000 00  =  0000 0000 0000 0000  =  ..:0000::/56&#xA;00 000000 111111 11  =  0000 0000 1111 1111  =  ..:00ff::/56&#xA;&#xA;00 000001 000000 00  =  0000 0001 0000 0000  =  ..:0100::/56&#xA;00 000001 111111 11  =  0000 0001 1111 1111  =  ..:01ff::/56&#xA;&#xA;00 000010 000000 00  =  0000 0010 0000 0000  =  ..:0200::/56&#xA;00 000010 111111 11  =  0000 0010 1111 1111  =  ..:02ff::/56&#xA;&#xA;etc, let's take some in the middle:&#xA;&#xA;00 010001 000000 00  =  0001 0001 0000 0000  =  ..:1100::/56&#xA;00 010001 111111 11  =  0001 0001 1111 1111  =  ..:11ff::/56&#xA;...&#xA;00 100001 000000 00  =  0010 0001 0000 0000  =  ..:2100::/56&#xA;00 100001 111111 11  =  0010 0001 1111 1111  =  ..:21ff::/56&#xA;&#xA;etc, to the last ones:&#xA;&#xA;00 111101 000000 00  =  0011 1101 0000 0000  =  ..:3d00::/56&#xA;00 111101 111111 11  =  0011 1101 1111 1111  =  ..:3dff::/56&#xA;&#xA;00 111110 000000 00  =  0011 1101 0000 0000  =  ..:3e00::/56&#xA;00 111110 111111 11  =  0011 1101 1111 1111  =  ..:3eff::/56&#xA;&#xA;00 111111 000000 00  =  0011 1101 0000 0000  =  ..:3f00::/56&#xA;00 111111 111111 11  =  0011 1101 1111 1111  =  ..:3fff::/56&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you do the same for the other bits in the address. It requires a lot more thinking than when you divide on nibble boundaries, but in binary it doesn't matter where you put the boundary. It's just the &quot;human&quot; notation in hexadecimal that gets harder to read/interpret.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-10-17T21:41:25.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35842" PostTypeId="2" ParentId="33256" CreationDate="2016-10-17T22:04:22.357" Score="1" Body="&lt;p&gt;Professional grade websites are typically served via a content delivery network, CDN, whereby the files/data are served from several mirrored servers across the globe.  Your request to that URL/website address resolves to the server (IP address) closest to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't physically move, you should be hitting the same IP address (resources) every time / every day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible that your network provider is jacked up.  For example, I've been to a large corporation where my Internet was routed out 3000 miles away from me and across time zones.  As a result, lots of Web application layer stuff breaks such as default Map views, calendar invite times (timezone issues), etc.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-17T22:04:22.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35844" PostTypeId="2" ParentId="35824" CreationDate="2016-10-17T22:15:07.877" Score="0" Body="&lt;p&gt;According to your requirements, probably the only way of monitoring web (HTTP[S], FTP[S] activity is using proxy server in transparent mode.&#xA;You can redirect necessary traffic to the proxy using &lt;strong&gt;WCCP&lt;/strong&gt; protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example &lt;strong&gt;Squid&lt;/strong&gt;, &lt;strong&gt;Cisco WSA&lt;/strong&gt; and others can be transparent to the user queries.&#xA;Therefore, your proxy will be discovered immediately with SSL encrypted traffic, as proxy acts as legal Man-in-the-middle. It should decrypt traffic to talk to server on behalf of client and to talk to client on behalf of server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going into details of HTTPS handshake, proxy server should send the certificate to the client, as it's necessary to generate symmetric session keys. Proxy typically uses its own certificate authority (CA) to generate such certificate on the fly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the browser immediately fires the red warning because it doesn't trust it.&#xA;To avoid these warning this CA certificate is often send to the users machines by means of Windows ActiveDirectory GPO, but your requirements No(2) and (4) doesn't allow to conseal this proxy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMHO, you can either &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;monitor only notencrypted traffic&lt;/li&gt;&#xA;&lt;li&gt;force users to use your proxy by ADs GPO&lt;/li&gt;&#xA;&lt;li&gt;let them know that there is an intercepting proxy on the network and send them the CA certificate to trust it. They don't like this option I suppose )&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="31158" LastActivityDate="2016-10-17T22:15:07.877" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35846" PostTypeId="2" ParentId="20762" CreationDate="2016-10-17T22:24:47.513" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://wiki.mikrotik.com/wiki/Manual:RouterOS_features&quot; rel=&quot;nofollow noreferrer&quot;&gt;MicroTik supports BGP&lt;/a&gt;.  Redirecting &lt;em&gt;inbound&lt;/em&gt; traffic may require you to run BGP.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2017-02-23T17:46:08.047" LastActivityDate="2017-02-23T17:46:08.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35849" PostTypeId="1" AcceptedAnswerId="35865" CreationDate="2016-10-18T01:25:03.623" Score="1" ViewCount="2360" Body="&lt;p&gt;I need to determine which header fields in IP, TCP and ICMP packets will never (at least, in 99% of cases, excluding perhaps a bizarre overly-aggressive firewall) be altered by a firewall or NAT/gateway device, including both stateful and stateless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, I have observed that certain headers will be manipulated by the firewall/NAT device, such as the window size, or the presence of the PSH and URG flags. I believe even the 'data offset' ('doff' name in the TCP header struct) was affected at some point as well. How common are these manipulations for firewalls and NAT devices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Those that I know shouldn't ever be changed, at least that I've observed and am looking for confirmation from the community here, are the TCP sequence ID#, the IP ID, the ICMP type, ICMP code, ICMP id/sequence # (when in ECHO), and I'd imagine the ICMP data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I incorrect in thinking the TCP window size is manipulated by some firewall/NAT? What about the IP TTL? Would this be manipulated by a border device before reaching its destination?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other information about what headers are manipulated and what ever are not is much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="27905" LastEditorUserId="8499" LastEditDate="2017-12-28T08:02:09.807" LastActivityDate="2017-12-28T08:02:09.807" Title="What header fields in IP, TCP and ICMP packets do NOT get altered in general by firewalls and NAT/gateways, both state-ful and not?" Tags="|tcp|firewall|ip|icmp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35850" PostTypeId="2" ParentId="35849" CreationDate="2016-10-18T01:46:37.363" Score="0" Body="&lt;p&gt;Much of what you ask depends on the way a device is configured, and there is not a single answer to your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPv4, a router will, by default, only change the TTL and Header Checksum fields, unless a packet needs to be fragmented. Fragmentation will change other fields, e.g. Fragment Offset. IPv6 does away with the Header Checksum and fragmentation, so a router will change the Hop Limit field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firewalls do not need to NAT, nor does NAT need to happen on a firewall. There are different types of firewalls. If you route on your firewall, then the router part of the firewall will change the same fields as a router. Many firewalls are transparent firewalls. You could have a firewall that proxies TCP, but that is not universal. In such a case, the firewall ends up as the TCP endpoint for both ends of the desired TCP connection. What gets changed in such a situation depends on the vendor and configuration. Something like this could happen on a server load balancer, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT changes the source or destination IP addresses and/or port numbers, depending on how you have NAT configured. There are various ways of using NAT, and what gets changed depends on the NAT method. Changing anything in the packet header requires the Header Checksum field to be recalculated.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-18T01:46:37.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35852" PostTypeId="2" ParentId="35794" CreationDate="2016-10-18T05:06:40.323" Score="0" Body="&lt;p&gt;While you claim to have checked the VTP passwords, the 2811 and the 3750 have the same VTP domain name, but they are clearly configured with different VTP passwords.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2811: &lt;code&gt;MD5 digest : 0xC3 0x66 0xAA 0x9A 0x4C 0x6C 0x22 0x97&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;3750: &lt;code&gt;MD5 digest : 0xC2 0x15 0x21 0xDF 0x96 0xA9 0xD9 0xAC&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The passwords must match for VTP to work correctly. You can verify this by the &lt;code&gt;show vtp password&lt;/code&gt; command. It could be as simple as having a space at the end of the password entered on one device.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The current Cisco best practices are to only have a VLAN on a single access switch. You can have as many VLANs as you like on an access switch, just don't trunk those VLANs to other access switches. Don't connect access switches to each other, only to a distribution switch. Disable VTP by setting all the switches to &lt;code&gt;vtp mode transparent&lt;/code&gt;, and limit the VLANs allowed across the trunks to the VLANs which are actually used on each switch with the &lt;code&gt;switchport trunk allowed vlan&lt;/code&gt; command, along with the &lt;code&gt;switchport trunk&lt;/code&gt; and &lt;code&gt;switchport nonegotiate&lt;/code&gt; commands to unconditionally trunk. Also use the global &lt;code&gt;spanning-tree portfast default&lt;/code&gt; and &lt;code&gt;spanning-tree portfast bpduguard default&lt;/code&gt; commands so that any switch connections to an access port will &lt;code&gt;err-disable&lt;/code&gt; the access port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doing this will eliminate almost all STP problems, and it will limit any that do happen to a single access switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-18T05:06:40.323" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="35853" PostTypeId="1" CreationDate="2016-10-18T06:10:57.197" Score="2" ViewCount="208" Body="&lt;p&gt;Okay, a bypass switch works at L1, and when an inline appliance like an IPS or firewall is connected to the bypass switch, the bypass switch simply grabs all traffic coming in an either side and redirects it through the inline appliance. There is no encap / decap of packets passing through the bypass switch, since it's L1 and does not recognize those high level headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, what happens when the inline appliance fails and the bypass switch engages Bypass Mode? Do the packets passing through it have their destination IP or MAC changed to reflect the bypassing of the inline appliance? Or could it be that no changes to the destination MAC and IP takes place because the IPS and firewall ACT as L1 devices even though they actively analyze and process the higher level headers?&lt;/p&gt;&#xA;" OwnerUserId="31354" LastActivityDate="2017-01-17T11:40:58.987" Title="If a bypass switch is an L1 device, what happens when bypass mode is enabled?" Tags="|layer2|layer3|layer1|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="35857" PostTypeId="1" AcceptedAnswerId="35863" CreationDate="2016-10-18T08:33:30.490" Score="2" ViewCount="8851" Body="&lt;p&gt;I created user under local users. Now I need to disable the user connecting through VPN for a while only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Platform is ASA 5512 with ASDM 7.6.&lt;/p&gt;&#xA;" OwnerUserId="21915" LastEditorUserId="286" LastEditDate="2016-10-18T10:02:21.277" LastActivityDate="2016-10-18T11:38:36.077" Title="How can I disable temporarily Cisco AnyConnect user from ASDM?" Tags="|cisco|cisco-asa|vpn|firewall|cisco-anyconnect|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35858" PostTypeId="1" AcceptedAnswerId="36008" CreationDate="2016-10-18T08:45:07.520" Score="3" ViewCount="748" Body="&lt;p&gt;In the STP Bridge ID (BID), the original, two-byte priority field was split into a four-bit configurable priority and twelve-bit System ID Extension (SIE) to represent the VLAN. Therefore, the priority is effectively &lt;code&gt;configured priority&lt;/code&gt; + &lt;code&gt;VLAN ID&lt;/code&gt;.&lt;br&gt;&#xA;E.g. in Cisco IOS with default settings, those will be 32768 and 1, respectively, and the priority will display as &lt;code&gt;32769&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it seems the split is effectively just a reduction in the priority bits, plus a handy place to stash the VLAN ID.&lt;br&gt;&#xA;But in some sense, the SIE affects the real priority value. So is there any situation in which it actually has to be taken into account, in root bridge elections, designated port tiebreakers, etc.?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems like it wouldn't in PVST, because any comparison will be within the same VLAN, so the SIE will always be the same. But what about in MST or other variations of the standard? Will there ever be a BID comparison in which the SIE makes a difference?&lt;/p&gt;&#xA;" OwnerUserId="23971" LastActivityDate="2016-10-27T02:14:43.690" Title="Does the System ID Extension ever affect root bridge election?" Tags="|spanning-tree|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35859" PostTypeId="1" AcceptedAnswerId="36098" CreationDate="2016-10-18T10:41:46.847" Score="1" ViewCount="384" Body="&lt;p&gt;Can someone please let me know if the prefix &lt;code&gt;ip prefix-list emea seq 30 permit 10.9.1.0/24 ge 25&lt;/code&gt; will include 10.9.1.0/24 network, or just 10.9.1.0./25, 10.9.1.0./26 etc if they existed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="21461" LastEditorUserId="509" LastEditDate="2016-10-18T11:47:06.090" LastActivityDate="2016-10-26T20:01:32.880" Title="Cisco IP Prefix List Question" Tags="|cisco|routing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35860" PostTypeId="1" AcceptedAnswerId="35861" CreationDate="2016-10-18T11:12:09.810" Score="1" ViewCount="19438" Body="&lt;p&gt;I try to accept ACL on L3 switch inteface. I've created standard ACL via:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-L3(config)#access-list 1 permit host 1.1.1.2&#xA;SW-L3(config)#access-list 1 permit host 1.1.1.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then i tried to execute this, but there's no such command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-L3(config)#int fa0/5&#xA;SW-L3(config-if)#ip access-group &#xA;                 ^&#xA;% Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(I use packet tracker 7 if it's important)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, what i'm doing wrong? Is it possible to deal with ACL on L3 switches?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;#&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I'm stuck with ACL again. My scheme is:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/bPkWE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bPkWE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L3 &lt;code&gt;sh run&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA;ip address 192.168.10.1 255.255.255.0&#xA;interface Vlan10&#xA;mac-address 00d0.bca6.0e03&#xA;no ip address&#xA;interface Vlan111&#xA;mac-address 00d0.bca6.0e01&#xA;ip address 1.1.1.1 255.255.255.0&#xA;interface Vlan222&#xA;mac-address 00d0.bca6.0e02&#xA;ip address 2.2.2.1 255.255.255.0&#xA;ip classless&#xA;ip flow-export version 9&#xA;access-list 1 permit host 2.2.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'd like to have access to server only from '2.2.2.2'. I have ACL :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 1 permit host 2.2.2.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on int fa0/5 IN. But it doesn't work.&#xA;pkt file is &lt;a href=&quot;https://drive.google.com/open?id=0B10D5qhZfuIocUtieXVBTGhlamc&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31136" LastEditorUserId="8499" LastEditDate="2018-03-21T01:10:03.460" LastActivityDate="2018-03-21T01:10:03.460" Title="How can I apply an ACL to interface on a Layer 3 switch?" Tags="|cisco|switch|layer3|acl|packet-tracer|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35861" PostTypeId="2" ParentId="35860" CreationDate="2016-10-18T11:20:44.430" Score="2" Body="&lt;p&gt;By default, interfaces on Cicso L3 switches are layer 2, so you would have to apply the ACLto the SVI (VLAN interface).  In order to make the interface a layer 3 interface use the command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no switchport&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;I can't tell which interface is Fa0/5, but I also notice you haven't applied the ACL to any interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you want to use a standard ACL, you can apply ACL 1 on VLAN outbound:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface VLAN 1&#xA;ip access-group 1 out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A better way is to use an extended ACL on the inbound interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 100 permit ip host 192.168.10.2  host 2.2.2.2&#xA;interface VLAN 1&#xA;ip access-group 100 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-10-18T20:08:46.347" LastActivityDate="2016-10-18T20:08:46.347" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="35862" PostTypeId="2" ParentId="35715" CreationDate="2016-10-18T11:32:40.020" Score="1" Body="&lt;p&gt;The Problem could be solved by doing a firmware update. After the update the scanning process works fine now.&lt;/p&gt;&#xA;" OwnerUserId="1667" LastActivityDate="2016-10-18T11:32:40.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35863" PostTypeId="2" ParentId="35857" CreationDate="2016-10-18T11:38:36.077" Score="4" Body="&lt;h2&gt;From ASDM:&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Choose Configuration &gt; Remote Access VPN &gt; AAA/Local Users &gt; Local Users.&lt;/li&gt;&#xA;&lt;li&gt;Select the user you want to configure and click Edit.&lt;/li&gt;&#xA;&lt;li&gt;In the left-hand pane, click VPN Policy.&lt;/li&gt;&#xA;&lt;li&gt;Specify the number of simultaneous logins by the user as 0 (zero).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h2&gt;From the CLI:&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username mydisableduser attributes&#xA; vpn-simultaneous-logins 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-18T11:38:36.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35864" PostTypeId="2" ParentId="35859" CreationDate="2016-10-18T12:42:34.423" Score="4" Body="&lt;p&gt;The &lt;code&gt;ge 25&lt;/code&gt; suffix basically requires the prefix length to be 25 or higher (ge = greater than or equal). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, the entry could be rephrased to: permit any network which is inside the network 10.9.1.0/24 and has a prefix length of 25 or higher. This would include 10.9.1.0/25, 10.9.1.0/26 as you have indicated (up to /32 as the &lt;code&gt;le n&lt;/code&gt; attribute is omitted) but not 10.9.1.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would however also include things like 10.9.1.128/25 or 10.9.1.200/30, as all those networks are within the 10.9.1.0/24 network having a subnet mask greater than or equal to 25.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example would be &lt;code&gt;prefix-list emea seq 30 permit 10.9.1.0/24 ge 25 le 25&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would exactly match the following two prefixes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.9.1.0/25 and 10.9.1.128/25&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the logic now is: permit any networks within the 10.9.1.0/24 range which prefix length is greater than or equal 25 &lt;strong&gt;and&lt;/strong&gt; lower than or equal 25, in other words, exactly 25.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="3875" LastEditDate="2016-10-18T13:42:12.423" LastActivityDate="2016-10-18T13:42:12.423" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35865" PostTypeId="2" ParentId="35849" CreationDate="2016-10-18T13:29:33.803" Score="1" Body="&lt;p&gt;You are probably developing the new way of hidden tunneling )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to the fields of IP, TCP, ICMP headers - you can't be absolutely sure that they will be untouched traveling the network. It mostly depends of source and destination network topology, security measures and network equipment or software.&#xA;Even, the direction of traffic matters. It much differs when traffic flows for ex. from home network to your VDS server or from corporate PC to google server behind load balancer etc..&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;IP destination address&lt;/strong&gt; as well as &lt;strong&gt;TCP/UDP destination port&lt;/strong&gt; are likely untouched unless destination is behind the NAT or load balancer&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;TCP SEQ|ACK&lt;/strong&gt; can be sometimes altered by some firewalls (Cisco ASA randomizes them to prevent session hijacking and other attacks)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Data offset&lt;/strong&gt; is likely untouched unless traffic flows through sofisticated firewall&lt;/li&gt;&#xA;&lt;li&gt;Most of ICMP types and codes are blocked by typical firewall except &lt;code&gt;Echo request|reply&lt;/code&gt;, &lt;code&gt;destination unreachable&lt;/code&gt; and &lt;code&gt;TTL expired in transit&lt;/code&gt; useful for traceroute &lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Payload of ICMP echo&lt;/strong&gt; and SEQ are likely untouched.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Payload of TCP&lt;/strong&gt; is typically untouched by firewall excepting some tricky cases (ALG gateways which modifies FTP, SIP etc, or HTTP/FTP proxies). But most of ports are blocked by corporate firewalls and others forwarded to proxies.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;TCP flags&lt;/strong&gt; are typically untouched but TCP session follows some rules (handshake etc), so firewall (stateful) watches them and drops invalid or unrelated packets&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;DF bit&lt;/strong&gt; in IPv4 packet is typically untouched, probably other fields such as length and offset, but the packet should be of right size to be passed through&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;QoS bits&lt;/strong&gt; can be modified or completely zeroed traveling the public network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Well, your question is the reverse-engineering research in a way. Appreciate you share your experience afterward.&lt;/p&gt;&#xA;" OwnerUserId="31158" LastEditorUserId="8499" LastEditDate="2017-12-28T08:00:36.197" LastActivityDate="2017-12-28T08:00:36.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35866" PostTypeId="2" ParentId="35006" CreationDate="2016-10-18T14:14:48.307" Score="2" Body="&lt;p&gt;I know that with the &lt;code&gt;WS-C4507R+E&lt;/code&gt; supervisor, you can use the &lt;code&gt;WS-X4712-SFP+E Catalyst 4500 E-Series 12-Port 10GbE (SFP+)&lt;/code&gt; line card. The SFP+ slots can use either 1 Gb SFP or 10 Gb SFP+ transceivers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a caveat: the ASICs on the line card each control three ports, and the ASICs can only handle 12 Gb each. This gives you four ASICs per the 12 ports on the line card, and that will give you the full slot bandwidth. You could use one 10 Gb and two 1 Gb ports for each of the three ports per ASIC for a full line rate. If you use three 10 Gb ports on the ASIC, you will drop some traffic if the traffic on the ASIC exceeds 12 Gb.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-16T15:50:09.753" LastActivityDate="2017-01-16T15:50:09.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35868" PostTypeId="1" AcceptedAnswerId="35894" CreationDate="2016-10-18T16:10:40.303" Score="0" ViewCount="1539" Body="&lt;p&gt;The gist of this question is in the title: what could cause TCP to retransmit only the end of a (fully acknowledged) segment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a TCP conversation between two hosts: a SSH server (172.16.6.249, physical machine) and a SSH client, executing the command &quot;ssh-keyscan&quot; (192.168.0.18, virtual machine). This capture was done on the network interface of 192.168.0.18.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;No.     Time        Source                Destination           Protocol Length Info&#xA;  1 0.000000    192.168.0.18          172.16.6.249          TCP      74     46180 &amp;gt; 22 [SYN] Seq=0 Win=28200 Len=0 MSS=1410 SACK_PERM=1 TSval=173592928 TSecr=0 WS=128&#xA;  2 0.001274    172.16.6.249          192.168.0.18          TCP      74     22 &amp;gt; 46180 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1460 SACK_PERM=1 TSval=3139755418 TSecr=173592928 WS=128&#xA;  3 0.001309    192.168.0.18          172.16.6.249          TCP      66     46180 &amp;gt; 22 [ACK] Seq=1 Ack=1 Win=28288 Len=0 TSval=173592929 TSecr=3139755418&#xA;  4 0.010710    172.16.6.249          192.168.0.18          TCP      109    22 &amp;gt; 46180 [PSH, ACK] Seq=1 Ack=1 Win=29056 Len=43 TSval=3139755421 TSecr=173592929&#xA;  5 0.010741    192.168.0.18          172.16.6.249          TCP      66     46180 &amp;gt; 22 [ACK] Seq=1 Ack=44 Win=28288 Len=0 TSval=173592931 TSecr=3139755421&#xA;  6 0.010886    192.168.0.18          172.16.6.249          TCP      91     46180 &amp;gt; 22 [PSH, ACK] Seq=1 Ack=44 Win=28288 Len=25 TSval=173592931 TSecr=3139755421&#xA;  7 0.010965    192.168.0.18          172.16.6.249          TCP      1464   46180 &amp;gt; 22 [ACK] Seq=26 Ack=44 Win=28288 Len=1398 TSval=173592931 TSecr=3139755421&#xA;  8 0.011950    172.16.6.249          192.168.0.18          TCP      66     22 &amp;gt; 46180 [ACK] Seq=44 Ack=26 Win=29056 Len=0 TSval=3139755421 TSecr=173592931&#xA;  9 0.011959    192.168.0.18          172.16.6.249          TCP      284    46180 &amp;gt; 22 [PSH, ACK] Seq=1424 Ack=44 Win=28288 Len=218 TSval=173592931 TSecr=3139755421&#xA; 10 0.012227    172.16.6.249          192.168.0.18          TCP      66     22 &amp;gt; 46180 [ACK] Seq=44 Ack=1424 Win=31872 Len=0 TSval=3139755421 TSecr=173592931&#xA; 11 0.033124    172.16.6.249          192.168.0.18          TCP      1714   22 &amp;gt; 46180 [PSH, ACK] Seq=44 Ack=1424 Win=31872 Len=1648 TSval=3139755421 TSecr=173592931&#xA; 12 0.033153    192.168.0.18          172.16.6.249          TCP      66     46180 &amp;gt; 22 [ACK] Seq=1642 Ack=1692 Win=31616 Len=0 TSval=173592937 TSecr=3139755421&#xA; 13 0.033173    172.16.6.249          192.168.0.18          TCP      316    [TCP Retransmission] 22 &amp;gt; 46180 [PSH, ACK] Seq=1442 Ack=1642 Win=34688 Len=250 TSval=3139755424 TSecr=173592931&#xA; 14 0.033184    192.168.0.18          172.16.6.249          TCP      78     [TCP Dup ACK 12#1] 46180 &amp;gt; 22 [ACK] Seq=1642 Ack=1692 Win=31616 Len=0 TSval=173592937 TSecr=3139755424 SLE=1442 SRE=1692&#xA; 15 0.035635    192.168.0.18          172.16.6.249          TCP      114    46180 &amp;gt; 22 [PSH, ACK] Seq=1642 Ack=1692 Win=31616 Len=48 TSval=173592937 TSecr=3139755424&#xA; 16 0.047742    172.16.6.249          192.168.0.18          TCP      690    22 &amp;gt; 46180 [PSH, ACK] Seq=1692 Ack=1690 Win=34688 Len=624 TSval=3139755430 TSecr=173592937&#xA; 17 0.047869    192.168.0.18          172.16.6.249          TCP      66     46180 &amp;gt; 22 [FIN, ACK] Seq=1690 Ack=2316 Win=34304 Len=0 TSval=173592940 TSecr=3139755430&#xA; 18 0.049738    172.16.6.249          192.168.0.18          TCP      66     22 &amp;gt; 46180 [FIN, ACK] Seq=2316 Ack=1691 Win=34688 Len=0 TSval=3139755430 TSecr=173592940&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't understand the frames 13 and 14. 172.16.6.249 already sent a segment with sequence number 44 + length 1648 = 1692 (frame 11), to which 192.168.0.18 answered &lt;em&gt;only&lt;/em&gt; with an ACK 1692 (frame 12).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could make 172.16.6.249 send again the end of the segment (frame 13)? I have checked the segment payload and it does match the last 250 bytes of the payload in frame 11.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also assume the selective acknowledgement of these last 250 bytes in frame 14 is the result of the client being confused by receiving the same data twice, but maybe I am missing something here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I unfortunately don't have the corresponding capture on 172.16.6.249, as I am investigating network issues that are hard to reproduce.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hosts are physically very close, with only one (Linux) router between them and one physical switch, but there is some SDN going on (Linux bridges + VXLAN). This however should be transparent to the endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I be looking at next?&lt;/p&gt;&#xA;" OwnerUserId="31367" LastActivityDate="2016-10-19T10:17:49.833" Title="What could cause TCP to retransmit only the end of a (fully acknowledged) segment?" Tags="|tcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35870" PostTypeId="1" AcceptedAnswerId="35873" CreationDate="2016-10-18T17:33:41.170" Score="1" ViewCount="783" Body="&lt;p&gt;As a network administrator, assume I want to check IP/MAC binding of a certain device in my network to check if the binding has been changed or not (Since my network does not have DHCP server and static IP configuration is used). Which one I should use and what is the difference: &lt;code&gt;ICMP&lt;/code&gt; or &lt;code&gt;PING&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="31371" LastEditorUserId="31371" LastEditDate="2016-10-18T17:59:08.093" LastActivityDate="2016-10-19T00:47:19.767" Title="Checking the binding of IP/MAC addresses for a device" Tags="|cisco|routing|switch|icmp|mac|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35871" PostTypeId="1" CreationDate="2016-10-18T18:20:43.967" Score="1" ViewCount="2806" Body="&lt;p&gt;Why does HSRP shows both sides are active HSRP? Could you please give me details answer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**Vlan111 - Group 6**&#xA;  State is Active&#xA;    5 state changes, last state change 2w4d&#xA;  Virtual IP address is 10.101.59.1&#xA;  Active virtual MAC address is 0000.0c07.ac06 (MAC In Use)&#xA;    Local virtual MAC address is 0000.0c07.ac06 (v1 default)&#xA;  Hello time 3 sec, hold time 10 sec&#xA;    Next hello sent in 0.272 secs&#xA;  Preemption enabled, delay min 30 secs&#xA;  Active router is local&#xA;  Standby router is unknown&#xA;  Priority 100 (default 100)&#xA;  Group name is &quot;hsrp-Vl111-6&quot; (default)&#xA;&#xA;**r-ca-103-1#show run interface vlan 111**&#xA;Building configuration...&#xA;&#xA;Current configuration : 433 bytes&#xA;!&#xA;interface Vlan111&#xA; vrf forwarding 901_general&#xA; ip address 10.101.59.2 255.255.255.0&#xA; ip access-group Student-Access in&#xA; ip helper-address 10.39.0.119&#xA; ip helper-address 10.180.1.20&#xA; ip helper-address 10.180.1.21&#xA; ip helper-address 10.180.1.23&#xA; ip helper-address 10.180.1.24&#xA; no ip redirects&#xA; no ip unreachables&#xA; ip directed-broadcast 101&#xA; ip pim sparse-dense-mode&#xA; standby 6 ip 10.101.59.1&#xA; standby 6 preempt delay minimum 30&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second router :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r-ca-103-2#show standby vlan 111&#xA;Vlan111 - Group 6&#xA;  State is Active&#xA;    5 state changes, last state change 2w4d&#xA;  Virtual IP address is 10.101.59.1&#xA;  Active virtual MAC address is 0000.0c07.ac06 (MAC In Use)&#xA;    Local virtual MAC address is 0000.0c07.ac06 (v1 default)&#xA;  Hello time 3 sec, hold time 10 sec&#xA;    Next hello sent in 0.576 secs&#xA;  Preemption enabled, delay min 30 secs&#xA;  Active router is local&#xA;  Standby router is unknown&#xA;  Priority 100 (default 100)&#xA;  Group name is &quot;hsrp-Vl111-6&quot; (default)&#xA;&#xA;r-ca-103-2#show run interface vlan 111&#xA;Building configuration...&#xA;&#xA;Current configuration : 315 bytes&#xA;!&#xA;interface Vlan111&#xA; vrf forwarding 901_general&#xA; ip address 10.101.59.3 255.255.255.0&#xA; ip access-group Student-Access in&#xA; ip helper-address 10.39.0.119&#xA; ip directed-broadcast 101&#xA; ip pim sparse-dense-mode&#xA; standby 1 priority 150&#xA; standby 1 preempt&#xA; standby 6 ip 10.101.59.1&#xA; standby 6 preempt delay minimum 30&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31103" LastEditorUserId="8499" LastEditDate="2018-12-25T02:51:30.873" LastActivityDate="2018-12-25T02:51:30.873" Title="HSRP Issue Both sides are active ( Layer 3 4300 X serires)" Tags="|cisco|switch|layer3|hsrp|fhrp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35872" PostTypeId="2" ParentId="35871" CreationDate="2016-10-18T18:41:13.573" Score="1" Body="&lt;p&gt;Your two devices cannot communicate over that VLAN, so they cannot exchange HSRP messages on that VLAN. Each comes up thinking it is the active router. One will remain the active router, and one will become the standby router when they fight it out with the messages between them on the VLAN. Make sure that you can get from one to the other over Vlan111.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should really have a deterministic way for this to happen. That means you should specifically set the priorities. To avoid problems, you should set the highest priority on the one with the lowest bridge priority. You want the root bridge to be the HSRP router in order to avoid a poor layer-2 path.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-18T18:41:13.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35873" PostTypeId="2" ParentId="35870" CreationDate="2016-10-18T18:48:18.760" Score="0" Body="&lt;p&gt;I'm not sure what you mean by binding if you are not using DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to look at the layer-3 to layer-2 resolution, you use ARP (Address &lt;em&gt;Resolution&lt;/em&gt; Protocol) to &lt;em&gt;resolve&lt;/em&gt; the layer-3 address to the layer-2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP only works on the layer-2 domain. Layer-2 addresses, e.g. MAC addresses, are only relevant, or even seen, on the layer-2 LAN of the host. For example, you cannot get the layer-2 address of a host on a different layer-2 LAN (other side of a router hop).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;FYI, ping uses ICMP echo request and echo reply.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-18T20:26:16.587" LastActivityDate="2016-10-18T20:26:16.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35874" PostTypeId="1" AcceptedAnswerId="35875" CreationDate="2016-10-18T19:48:14.377" Score="1" ViewCount="1060" Body="&lt;p&gt;I want to implement a Network Access Control ( NAC ) infrastructure in my LAN.&#xA;My topology is something like: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC -&gt; ( Untagged Port - PVID 100 - Non 802.1x capable smart switch ) -&gt; ( Hybrid port - 802.1x Dynamic VLAN capable managed switch ) -&gt; PacketFence&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, PCs and other devices aren´t connected directly to the 802.1x Dynamic VLAN capable switch ( HP 1920G ) but to a smart switch ( TP-Link TL-1016DE ). This switch tag frames coming into the untagged port with VLAN ID 100 and send them tagged to the 1920.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: a tagged frame could be subject of 802.1x authentication and dynamic VLAN assigment by the 1920? or that just work for untagged frames?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Manuel&lt;/p&gt;&#xA;" OwnerUserId="31373" LastActivityDate="2016-10-18T21:01:54.213" Title="802.1x authentication and dynamic VLAN assignment of VLAN tagged frames" Tags="|vlan|switching|network-access|ieee-802.1x|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35875" PostTypeId="2" ParentId="35874" CreationDate="2016-10-18T20:34:17.630" Score="0" Body="&lt;p&gt;Unfortunately, 802.1X uses link-local frames. An 802.1D compliant bridge (switch) does not forward these types of frames (multicast OUI 01:80:C2). You should not be able to do 802.1X authentication across an intervening bridge or switch, so what you propose should not be possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, you need to run 802.1X on the access ports of the access switch. Switches should be configured to trust on switch-to-switch links.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-18T21:01:54.213" LastActivityDate="2016-10-18T21:01:54.213" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35876" PostTypeId="1" CreationDate="2016-10-18T21:13:42.623" Score="0" ViewCount="46" Body="&lt;p&gt;I have two networks and for each one I use a PC. These network should remain separate because one is an internal network that must be protected and another is the Internet. How can I access these networks with only one PC and to be sure that my intranet is fully protected from the Internet threats ?&lt;/p&gt;&#xA;" OwnerUserId="30883" LastActivityDate="2016-10-19T08:27:41.087" Title="How to connect one monitor at two different networks?" Tags="|internet|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35880" PostTypeId="1" CreationDate="2016-10-18T22:11:40.180" Score="0" ViewCount="871" Body="&lt;p&gt;Having 2 pfsense FWs in a large populated area with 3 VLANs, (students + teachers + admins), I set up limiters in the firewall rules to avoid the connection speed limits to be reached (30Mb up/dwn)&#xA;This seams to work nicely on tests I've been running on devices of the 3 vlans, for whom I created firewall alliases to.&#xA;Surprisingly, it still occurs that, as before I set those rules up, I notice wan traffic being on the max of the Internet connection, with no such lan traffic.&#xA;So, what I am looking for is the reason why the wan traffic differs from the sum of my LANs.&#xA;The 2 graphs shows both of my FWs, the problem can occur on one like on the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any ideas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pierre &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/e8Z7h.jpg&quot; alt=&quot;enter image description here&quot;&gt;&#xA;&lt;img src=&quot;https://i.stack.imgur.com/JnxLp.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="31380" LastEditorUserId="31380" LastEditDate="2016-10-19T04:35:44.930" LastActivityDate="2018-04-26T21:01:44.973" Title="Pfsense wan traffic differs from lan" Tags="|pfsense|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35881" PostTypeId="1" AcceptedAnswerId="35882" CreationDate="2016-10-18T23:14:37.340" Score="1" ViewCount="565" Body="&lt;p&gt;we have the following scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MPLS_WAN_provider1 connects to our edge router1 via eBGP&lt;br&gt;&#xA;MPLS_WAN_provider2 connects to our edge router2 via eBGP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both edge routers are to connect to our LAN. We need to decide on a routing protocol, between our LAN and both edge routers, that will support rerouting should one of the MPLS circuits go down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are considering either OSPF or iBGP, can both do the failover re-routing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are the advantages of one routing protocol over the other?&lt;/p&gt;&#xA;" OwnerUserId="3846" LastEditorUserId="8499" LastEditDate="2019-01-04T22:41:17.847" LastActivityDate="2019-01-04T22:41:17.847" Title="dual homing WAN circuits BGP" Tags="|routing|bgp|ospf|dual-homed|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="35882" PostTypeId="2" ParentId="35881" CreationDate="2016-10-18T23:43:03.440" Score="2" Body="&lt;p&gt;You probably want to run iBGP between your WAN routers, but make sure you have a direct link between the WAN routers. There are failure scenarios where not having the direct link can cause prefixes to be blackholed, especially if you run iBGP to other routers on the LAN..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use either iBGP or OSPF for you LAN routers, but iBGP requires a full mesh or a mitigation (route reflectors or confederations). That is because an iBGP speaker cannot advertise an iBGP learned prefix to another iBGP speaker. This is often not appropriate because it can limit your LAN topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can run OSPF without the full mesh limitation of iBGP, and you could use a single or multiple areas, whichever is most appropriate for your site.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-18T23:43:03.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35883" PostTypeId="2" ParentId="35870" CreationDate="2016-10-19T00:47:19.767" Score="0" Body="&lt;p&gt;ICMP is a protocol used to report problems or issues with IP packets (or datagrams) on a network.&#xA;The most popular use of ICMP is to send ping packets to test the network connectivity of remote hosts. &#xA;The network device generates an echo request packet that is sent to the destination device. &#xA;Upon receiving the echo request, the destination device generates an echo reply. However the term binding is used when you have a DHCP server.&lt;/p&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-19T00:47:19.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35884" PostTypeId="2" ParentId="35876" CreationDate="2016-10-19T01:04:54.137" Score="0" Body="&lt;p&gt;accessing your 2 networks with only one PC it ok, but if you want to fully Protect your intranet, I suggest to use a KVM, this will give you the impression of using a single monitor.&lt;/p&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-19T01:04:54.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35886" PostTypeId="2" ParentId="35871" CreationDate="2016-10-19T01:21:34.483" Score="0" Body="&lt;p&gt;In this situation, you don't actually have load balancing, both routers are set with a priority of 100, you should set a higher priority like 110 to the one you would like to become the active router.&lt;/p&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-19T01:21:34.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35888" PostTypeId="2" ParentId="35436" CreationDate="2016-10-19T02:19:47.763" Score="0" Body="&lt;p&gt;Each VLAN is a network, Basically according to your diagram you have 9 networks, with a Router you don't need to do routing with a layer-3 switch, However maybe you don't have 9 ports on your router for your 9 networks, in this situation, you can use a technique called router on a stick by creating virtual port for each vlan, here is an example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on the router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface Fa0/1&#xA;ip address 192.168.10.1 255.255.255.240&#xA;interface Fa0/1.2&#xA;encapsulation dot1q 2&#xA;ip address 192.168.1.65 255.255.255.192&#xA;interface Fa0/1.10&#xA;encapsulation dot1q 10&#xA;ip address 192.168.1.129 255.255.255.224&lt;/p&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-19T02:19:47.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35890" PostTypeId="1" CreationDate="2016-10-19T06:35:51.830" Score="1" ViewCount="343" Body="&lt;p&gt;What is FL-CME and  FL-SRST in router  with access point user?&lt;/p&gt;&#xA;" OwnerUserId="31388" LastActivityDate="2017-11-14T08:00:47.407" Title="What is FL-CME and FL-SRST in router with aceess point user?" Tags="|wireless|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35891" PostTypeId="1" CreationDate="2016-10-19T06:59:50.923" Score="1" ViewCount="289" Body="&lt;p&gt;I work on software development for routers. So, I am aware of QoS in routers, where we can do scheduling and policing of the traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, one question is still in my mind, is how does the ISP track how much data is downloaded by a subscriber, since there are so many subscribers, and they all will be connected with customer edge routers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, once they reach their maximum limit of usage in terms of data download, how their internet speed is reduced. Like, do they enqueue into a queue of a router, which has lower priority. But, that will not restrict the lower speed always. Do they put an egress interface, whose port speed is less?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am asking this for a normal use case where ISP will be running IS-IS or OSPF protocol as IGP and BGP to connect to other ISP. &lt;/p&gt;&#xA;" OwnerUserId="13278" LastEditorUserId="1392" LastEditDate="2016-10-19T09:45:23.547" LastActivityDate="2018-02-28T12:20:05.553" Title="How ISP track the individual subscriber data download and falling back to lower mbps?" Tags="|qos|bandwidth|isp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35892" PostTypeId="2" ParentId="35876" CreationDate="2016-10-19T08:27:41.087" Score="1" Body="&lt;p&gt;I assume you want to access both networks directly at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a professional environment you would use VLANS, which gives you the ability to access multiple networks directly from a single network card and thus system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cheap/SOHO option would be to use two network cards.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In both cases you would place very strict rules on the configuration of said system: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1) No routing/(P)NATing/VPN/tunnels or other funny stuff&#xA;2) A correctly configured firewall&#xA;3) An up to date OS with a strict updating policy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31307" LastActivityDate="2016-10-19T08:27:41.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35893" PostTypeId="2" ParentId="35891" CreationDate="2016-10-19T09:52:03.030" Score="4" Body="&lt;p&gt;So, there are a few different methods that can be used to achieve this, but I'll stick to the ones I am familiar with.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a PPPoE(oA) environment (e.g.: xDSL), each subscriber is tracked via a dedicated logical interface on the router, which keeps track of bytes in/bytes out and can have policers applied individually depending on usage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In environments using IPoE (e.g.: users are tracked via DHCP), similar rules apply - logical subscriber interfaces are created in response to DHCP transactions (e.g.: a logical interface is created per IP address), and then filters are applied to these when these interfaces exceed bandwidth quotas.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In more simplistic environments, I have also seen bandwidth tracked using NetFlow/SFlow and then dedicated policers applied based on IP Address, however these generally don't scale particularly well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of these methods require routers that support hierarchical queueing mechanisms - e.g.: they are able to queue per subscriber (IP Address), rather than just per sub interface (VLAN) or physical interface.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-10-19T09:52:03.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35894" PostTypeId="2" ParentId="35868" CreationDate="2016-10-19T09:55:28.657" Score="2" Body="&lt;p&gt;I think your capture is scooped due to some form of TCP segmenation offload on your host.  I doubt that the packets appeared on the wire as shown.  Notice that frame 11 has a reported length of 1714 octets, too long for most Ethernet LANs.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-10-19T09:55:28.657" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35896" PostTypeId="2" ParentId="35880" CreationDate="2016-10-19T10:05:50.677" Score="0" Body="&lt;p&gt;It is possible you are being DDoSed - an external entity is sending as much traffic as they can towards your public IP (thus filling your 30Mbps link), but this is not being passed through to your LAN segment, because it is hidden behind a NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is interesting though is that during this time that your LAN interface outbound is pretty consistent at 2Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It would be good to see a capture of this traffic to work out what is going on in more detail.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-10-19T10:05:50.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35898" PostTypeId="2" ParentId="35858" CreationDate="2016-10-19T10:12:31.367" Score="3" Body="&lt;p&gt;In short, No - in MSTP, RSTP and STP the bridge priority is fixed to the configured value (e.g.: no additional VLAN-ID is added).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is primarily because none of the IEEE-based standards acknowledge VLANs - all BPDUs are sent untagged - in the case of MSTP, MSTIs are linked to common VLAN groups, but are not influenced by the configuration of VLANs on underlying interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you have surmised - in PVST, the VLAN-ID should be identical between nodes, so the priority will always be weighted towards the lowest configured bridge priority.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-10-19T10:12:31.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35899" PostTypeId="2" ParentId="35868" CreationDate="2016-10-19T10:17:49.833" Score="-1" Body="&lt;p&gt;The most likely scenario is that Frame 11 was not received by 192.168.0.18 correctly, either due to fragmentation (as eluded to by @Benoit Faucon), or general packet loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the problem is consistent (e.g.: it always happens when you execute ssh-keyscan) I would see if you can get a similar capture from the remote host and compare it's point-of-view.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-10-19T10:17:49.833" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35900" PostTypeId="2" ParentId="35853" CreationDate="2016-10-19T10:24:26.210" Score="2" Body="&lt;p&gt;If you have an appliance that works with the help of a bypass switch, then it MUST be operating in transparent mode - e.g.: it won't care what IP or even MAC traffic is destined for.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traffic will be destined for a device &lt;em&gt;past&lt;/em&gt; it (destination MAC will be an upstream router), and the bypass switch is merely used as a way of providing fail-over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To prove this point - you should be able to remove the bypass switch and have traffic simply pass through your (IPS or whatever) device on it's way to whatever destination it was originally sent to, with MAC and IP address preserved.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-10-19T10:24:26.210" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35901" PostTypeId="2" ParentId="35782" CreationDate="2016-10-19T10:38:26.850" Score="2" Body="&lt;p&gt;This appears to be a defect - I just recreated a similar environment on an EX42000-VC running 15.1R3.6.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;family ethernet-switching {&#xA;    filter LIMIT-VLANS {&#xA;        term VID10 {&#xA;            from {&#xA;                vlan v10;&#xA;            }&#xA;            then {&#xA;                count VID10;&#xA;                policer LIMIT-256K;&#xA;        }&#xA;        term ALL-ELSE {&#xA;            then policer LIMIT-1M;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this version of code, I was able to get the vlan classifier to work (my VID10 counter was incrementing), but I could not get the policer to kick in, even though I was exceeding the bandwidth limit by a factor of 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be honest, I've had nothing but grief with EX4200 firewall filters over the years - what commits and what ultimately gets applied/works are two very different things!&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-10-19T10:38:26.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35902" PostTypeId="2" ParentId="35794" CreationDate="2016-10-19T11:05:37.987" Score="0" Body="&lt;p&gt;As Ron mentioned, the MD5 hash &lt;strong&gt;must&lt;/strong&gt; match in order for a VTP domain to synchronise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from the Domain name and the password, you will also need to ensure that the VLAN &lt;strong&gt;names&lt;/strong&gt; match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh vtp status&#xA;...&#xA;MD5 digest                        : 0x3B 0xF7 0xB3 0x53 0xC6 0x77 0x21 0x42&#xA;                                 0xC2 0x47 0x29 0x56 0x52 0xEE 0xEF 0xC9&#xA;&#xA;Switch#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;Switch(config)#vlan 100&#xA;Switch(config-vlan)#name NetworkEngineering&#xA;Switch(config-vlan)#^Z&#xA;*Mar  1 00:06:19.970: %SYS-5-CONFIG_I: Configured from console by console&#xA;Switch#sh vtp status&#xA;...&#xA;MD5 digest                        : 0x0E 0xAC 0xC2 0x81 0xF0 0xFB 0xB9 0xC4&#xA;                                0xC7 0xFC 0x76 0x9A 0x93 0xE8 0xD3 0x11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-10-19T11:05:37.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35903" PostTypeId="1" AcceptedAnswerId="43304" CreationDate="2016-10-19T11:07:21.847" Score="1" ViewCount="5679" Body="&lt;p&gt;Our Junipers will not accept my ssh keys when I provide them from my favorite Windows client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a FreeBSD machine, I would restart sshd with the -d flag and just watch the output to discover why the keys were not palatable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I do something similar on JunOS?&lt;/p&gt;&#xA;" OwnerUserId="30170" LastActivityDate="2017-08-16T15:27:26.510" Title="JunOS ssh debugging" Tags="|juniper|juniper-junos|ssh|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35904" PostTypeId="2" ParentId="35890" CreationDate="2016-10-19T11:08:24.730" Score="1" Body="&lt;p&gt;For Cisco routers, those are VoIP configurations. CME is Communications Manager Express, and SRST is Survivable Remote Site Telephony. Neither of these has anything specific to do with 802.11 Wi-Fi.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-19T11:08:24.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35905" PostTypeId="2" ParentId="35903" CreationDate="2016-10-19T11:29:59.627" Score="2" Body="&lt;p&gt;Unfortunately there are no traceoptions for SSH that I'm aware of.  If you have access to a *nix machine with your SSH keys loaded, you could try connecting with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh -vvv user@router&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and see which keys are offered and which identities are matched.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using PuTTY, then right-click on the window title and select &lt;strong&gt;Event Log&lt;/strong&gt; to get similar output.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-10-19T11:29:59.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35906" PostTypeId="2" ParentId="35830" CreationDate="2016-10-19T11:38:55.627" Score="0" Body="&lt;p&gt;After few days of asking on many different question boards and forums, I've found out that it's practically impossible to achieve this on Huawei. You need to use tr069 or directly access an ONT either by HTTP or SSH/Telnet. Also there's an application called iManager U2000. But still... there's absolutely no way of configuring a PPPoE client on hg8245H by using OMCI.&lt;/p&gt;&#xA;" OwnerUserId="31346" LastActivityDate="2016-10-19T11:38:55.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35908" PostTypeId="1" AcceptedAnswerId="35910" CreationDate="2016-10-19T12:42:59.847" Score="14" ViewCount="6029" Body="&lt;p&gt;I am a little confused by the following 2 RFCs relating to IPv6:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://tools.ietf.org/search/rfc4862&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4862&lt;/a&gt; (IPv6 Stateless Address Autoconfiguration)&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7084&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7084&lt;/a&gt; (IPv6 CE Router Requirements)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;RFC 4862 states:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The autoconfiguration process specified in this document applies only to hosts and not routers.  Since host autoconfiguration uses information advertised by routers, routers will need to be configured by some other means.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;RFC 7084 lists one of its WAN-Side Configuration requirements for address assignment as:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;WAA-1:   The IPv6 CE router MUST support Stateless Address&#xA;Autoconfiguration (SLAAC) [RFC4862].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Is there a contradiction here?&lt;/p&gt;&#xA;&lt;p&gt;Should a router be able to autoconfigure an IPv6 address for its WAN interface?&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Why does RFC 4862 say&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Since host autoconfiguration uses information advertised by routers, routers will need to be configured by some other means.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;If I am using a router to connect my LAN to an ISP for example, isn't there a router in the ISP's network which is talking to my router?&lt;/p&gt;&#xA;&lt;p&gt;I would have thought it was perfectly reasonable to have 2 (or more) routers chained together. In which case, why not use SLAAC on the second router's WAN interface?&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Maybe the issue comes down to the artificial distinction between hosts and routers? From RFC 4862:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;node -  a device that implements IP.&lt;/p&gt;&#xA;&lt;p&gt;router -  a node that forwards IP packets not explicitly addressed to itself.&lt;/p&gt;&#xA;&lt;p&gt;host -  any node that is not a router.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;But can't a host (i.e. a machine that is hosting servers or applications) also have a routing table, and function as a router? And we are effectively chaining 2 routers together again.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;: some extra information I later discovered ...&lt;/p&gt;&#xA;&lt;p&gt;The Linux kernel handles SLAAC, and it follows RFC 4862 closely. Right down to the distinction between hosts and routers. See the kernel documentation on &lt;a href=&quot;https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;ip-sysctl&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;HOST behaviour is assumed. Which means Router Solicitations will be sent, and Router Advertisements will used for address autoconfiguration.&lt;/li&gt;&#xA;&lt;li&gt;Only if &lt;em&gt;forwarding&lt;/em&gt; is enabled (&lt;code&gt;/proc/sys/net/ipv6/conf/all/forwarding&lt;/code&gt;), the device is considered to be a &lt;em&gt;ROUTER&lt;/em&gt;. Which means no Router Solicitations will be sent, and Router Advertisements will be ignored.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Turns out this distinction goes way back, pre-IPv6. See the parameter &lt;code&gt;/proc/sys/net/ipv4/ip_forward&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;This variable is special, its change resets all configuration&#xA;parameters to their default state (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1122&lt;/a&gt; for hosts, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1812&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1812&lt;/a&gt; for&#xA;routers)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="31396" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2020-01-11T17:47:18.903" Title="Should a router use SLAAC for IPv6 address assignment?" Tags="|router|dhcp|ipv6|rfc|dhcpv6|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35909" PostTypeId="2" ParentId="35908" CreationDate="2016-10-19T13:13:25.477" Score="7" Body="&lt;p&gt;RFC 4862 really describes routers within a single administrative control. RFC 7084 clarifies how customer routers should behave. This gives an ISP some freedom in how it supports IPv6 to its customers.&lt;/p&gt;&#xA;&lt;p&gt;To the PE router, the CE router &lt;em&gt;is&lt;/em&gt; a host. From the perspective of a LAN (layer-2 domain, including the link from PE to CE), a router really is just another host on the network. In most cases, the WAN link addresses will be defined statically, via DHCP, or via PPP, not actually using SLAAC.&lt;/p&gt;&#xA;&lt;p&gt;I think you missed the part in RFC 7084 that precedes what you quoted:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;WAN-side requirements:&lt;/p&gt;&#xA;&lt;p&gt;W-1:  When the router is attached to the WAN interface link, it&#xA;MUST&#xA;act as an IPv6 host for the purposes of stateless [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4862&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC4862&lt;/a&gt;] or&#xA;stateful [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3315&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC3315&lt;/a&gt;] interface address assignment.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-10-19T13:13:25.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35910" PostTypeId="2" ParentId="35908" CreationDate="2016-10-19T13:18:57.093" Score="10" Body="&lt;p&gt;In RFC 7084, it also states:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;W-1:  When the router is attached to the WAN interface link, it MUST&#xA;act as an IPv6 host for the purposes of stateless [RFC4862] or&#xA;stateful [RFC3315] interface address assignment.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So in short, yes - a router should be able to autoconfigure an IPv6 address for its WAN interface.&lt;/p&gt;&#xA;&lt;p&gt;In reality though, most ISPs implement DHCPv6 and DHCPv6-PD (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3633&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC3633&lt;/a&gt;) for downstream address allocation, along with prefix delegation.&lt;/p&gt;&#xA;&lt;p&gt;This ensures that your router not only receives an address on it's WAN interface, but that it also receives a prefix it can use on it's internal LAN interface as well.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-10-19T13:18:57.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35911" PostTypeId="1" CreationDate="2016-10-19T14:53:18.090" Score="1" ViewCount="697" Body="&lt;p&gt;I am used to the term &lt;strong&gt;ICMP Ping Packet Loss&lt;/strong&gt; but recently, I came across this other term &lt;strong&gt;UDP Jitter Packet loss&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will like to know the difference between the two, and of what importance it is to monitor one or the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="24161" LastActivityDate="2017-05-18T00:10:50.100" Title="Types of packet loss" Tags="|udp|icmp|packet-loss|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35912" PostTypeId="2" ParentId="34946" CreationDate="2016-10-19T14:55:22.303" Score="0" Body="&lt;p&gt;In the end, I had to have someone write a python script that sends an email. In the python script, I can specify the contents of the email. I then use EEM to specify the syslog pattern I want it to trigger on and use &quot;action 1 cli local command &quot;file_name.py&quot;&quot; to call the python script. This solution works on NX-OS 7.3(1)N1(1).&lt;/p&gt;&#xA;" OwnerUserId="30515" LastActivityDate="2016-10-19T14:55:22.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35913" PostTypeId="2" ParentId="35911" CreationDate="2016-10-19T15:02:56.497" Score="1" Body="&lt;p&gt;It depends on what protocols your applications use. Any protocol can have packet loss, and some packet loss is on purpose, e.g. RED randomly drops packets from queues to prevent TCP global synchronization (a bad thing). Also, when using QoS, you may want to police certain protocols over a certain bandwidth, and this drops traffic in excess of a specified bandwidth. A lot of loss occurs due to congestion, usually due to bandwidth over-subscription. It can also occur due to network attacks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jitter is different than packet loss. Jitter is a variation in the delay of packet delivery. It is important to minimize jitter in real-time protocols. For instance, VoIP can withstand a fair amount of delay, but even when you have a low delay, variations in the delay can cause big problems.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-19T15:02:56.497" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35918" PostTypeId="2" ParentId="35908" CreationDate="2016-10-19T17:03:06.207" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does RFC 4862 say &quot;Since host autoconfiguration uses information advertised by routers, routers will need to be configured by some other means.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The people who wrote that document (and it's predecessor RFC 2462 ) almost certainly had a worldview that there were two types of devices. &quot;hosts&quot; that were numerous and a burden to manage and &quot;routers&quot; that were managed by competent network admins.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the early 2000s we had the rise of always-on DSL/cable connections and also a rise in the number of people who had more than one computer at home that could make use of an internet connection. Since many ISPs would only give out one IP address to a customer (at least without charging extra) we saw a massive rise in the use of &quot;home routers&quot; with NAT to hide multiple computers behind such a connection. The NAT allowed the &quot;home router&quot; to hide it's true nature from the ISP, as far as the ISP was concerned the &quot;home router&quot; was just like a host. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such usage was at first only &quot;tolerated&quot; by ISPs but eventually they decided it wasn't such a bad thing after all and started actually giving/selling the &quot;home routers&quot; to their customers. As a result we ended up with a huge number of these devices sitting in homes and small buisnesses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is only relatively recently that the IETF has started to properly explore how &quot;home routers&quot; and the ISPs that serve them should behave in the context of IPv6. The answer being that the &quot;WAN side&quot; interface should bahave much like a host while the &quot;LAN side&quot; interfaces should behave like a regular router. Since there is no NAT there is the need for some additional details to handle supplying addresses for the LAN side.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Regarding the Linux kernel it does indeed by default ignore RAs when routing is enabled, but this behaviour can be overridden if needed.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-03-18T02:54:34.490" LastActivityDate="2017-03-18T02:54:34.490" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35919" PostTypeId="2" ParentId="35911" CreationDate="2016-10-19T19:23:18.343" Score="1" Body="&lt;p&gt;Jitter and Packet Loss are indeed two unrelated network metrics, and &quot;Jitter Packet Loss&quot; has no meaning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, &quot;UDP Jitter Packet Loss&quot; does mean something, when taken in the context of a Cisco IP SLA &quot;UDP Jitter&quot; operation, which among other things can measure per-direction packet loss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having per-direction measurements is very useful, beyond that it's hard to say which is more &quot;precise&quot; : packet loss, like throughput, is not a directly measurable quantity, so you are approximating. You take a set of packets sent over a period of time, and count those that didn't make it, but there can be any number of reasons why that set of packets is not fully representative of the total traffic : QoS is being applied, the interval between two packets in the set is very high...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any event, having some means of measuring packet loss is a good thing, and typically an IP SLA operation will have been setup in a more &quot;relevant&quot; way than some random ping.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-10-19T19:23:18.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35923" PostTypeId="1" CreationDate="2016-10-19T23:07:10.360" Score="3" ViewCount="7805" Body="&lt;p&gt;If I have two switches connected redundantly and both are capable of using STP, RSTP, or MSTP, how quickly can an alternate route be detected and normal communication resume if the main route is disconnected?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a theoretical limit to the three protocols and what are some practical delays that add to it?&lt;/p&gt;&#xA;" OwnerUserId="31411" LastActivityDate="2016-12-19T04:15:52.123" Title="How fast can STP, RSTP, and MSTP find a new route?" Tags="|switch|spanning-tree|redundancy|redundant-routes|ieee-802.1w|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35924" PostTypeId="1" AcceptedAnswerId="35927" CreationDate="2016-10-19T23:26:12.127" Score="3" ViewCount="18172" Body="&lt;p&gt;I have an IP address &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;12.23.34.22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to find the network prefix for this IP Address.&#xA;For that I need to find the subnet mask and then count the number of contiguous 1s to get the network prefix. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can we calculate the subnet mask &lt;code&gt;(255.x.x.x)&lt;/code&gt; for this given IP ?&lt;/p&gt;&#xA;" OwnerUserId="31412" LastEditorUserId="8499" LastEditDate="2018-03-10T04:31:33.603" LastActivityDate="2018-10-20T04:36:09.057" Title="Calculate subnet mask from IP Address" Tags="|ipv4|ip|subnet|ip-address|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35925" PostTypeId="2" ParentId="35923" CreationDate="2016-10-20T00:51:13.413" Score="0" Body="&lt;p&gt;RSTP is going to be much faster than STP during failover. STP is going to have a failover time between 30-50 seconds. STP Timer = Max Age 20sec. Forward Delay 15 sec. maximum delay in STP = 20 + 15 + 15 = 50 sec.  (Bridge Protocol Data Units) BPDUs are sent to all the switches to notify that there is a change and in STP this is done by the root switch. The root switch is selected by lowest priority or lowest MAC address. The problem with this is that if something fails far away from the root switch then the convergence will be very slow. In RSTP, all the switches are allowed to send BPDUs and are able to converge faster. In STP, BPDUs are RELAYED by the switches but in RSTP are sent every hello time(2s by default).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my networking class in college, the equation they gave us for network failover time in stp was:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failover = failure_detection + failure_recovery;&#xA;failure_detection = Max_Age_Timer(20s default)&#xA;failure_recovery = Fwd_dly(listening state 15s default) + Fwd_dly(learning state 15s default).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;============================================================&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network failover time in RSTP:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failover = failure_detection + failure_recovery;&#xA;failure_detection = 3 x Hello_Timer(2s default) = 6s&#xA;failure_recovery = Fwd_dly(fast_learning(&amp;lt;&amp;lt;1))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not too sure about MSTP but i hope this helps somewhat&lt;/p&gt;&#xA;" OwnerUserId="31414" LastActivityDate="2016-10-20T00:51:13.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35926" PostTypeId="2" ParentId="35923" CreationDate="2016-10-20T01:03:38.443" Score="2" Body="&lt;p&gt;Realistically, it depends on the size of the current spanning tree and how it is disrupted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an RSTP or MSTP environment, if an interface goes hard down (eg: it's disconnected or otherwise shut down), then the topology change will trigger immediately - between only two switches, a new tree should establish in less than a second and forwarding will recommence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is break not caused by link down (eg: configuration change, intermediate device failure etc), then RSTP and MSTP will wait for 3x Hello Interval (3x2 (default) = 6 seconds by default) before re-converging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP on the other hand is a lot slower because it has a slightly different state machine - it will wait 10x Hello Interval (20 seconds) for a BPDU timeout, and then sits in listening State for another 15 seconds, followed by the learning state for another 15 seconds, giving you somewhere around 50 seconds to converge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bear in mind though that these figures are for a single switch - if you have a large network diameter, downstream switches may start detecting failure at slightly later times, meaning they will start this process later and ultimately add more time to a complete topology re-convergence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Added to this is when you're using protocols like VSTP/PVST/PVST+ the switch needs to do this re-convergence for every VLAN, which if there are a lot can be quite taxing on the CPU thus slowing down the r-econvergence further.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-10-20T01:03:38.443" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35927" PostTypeId="2" ParentId="35924" CreationDate="2016-10-20T01:05:31.230" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How can we calculate the subnet mask &lt;code&gt;(255.x.x.x)&lt;/code&gt; for this given IP ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can't. To find the prefix, you need the address and mask, or the address and prefix length.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the answers to &lt;a href=&quot;https://networkengineering.stackexchange.com/q/7106/8499&quot;&gt;this question&lt;/a&gt; on how to calculate everything.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-10-20T04:36:09.057" LastActivityDate="2018-10-20T04:36:09.057" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="35928" PostTypeId="2" ParentId="35830" CreationDate="2016-10-20T03:42:31.713" Score="2" Body="&lt;p&gt;I work for Huawei and I have configured PPPoE, both client and server, recently for an AR200 router, to be honest with you, I don't know how much of a difference exist between my equipment and yours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To configure the PPPoE client on AR200 you need the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Configure a Dialer-rule allowing IP&lt;/li&gt;&#xA;&lt;li&gt;Configure a Dialer interface&lt;/li&gt;&#xA;&lt;li&gt;Configure dialer queue-length on dialer interface&lt;/li&gt;&#xA;&lt;li&gt;Configure dialer idle time on dialer interface&lt;/li&gt;&#xA;&lt;li&gt;Configure dialer user name on dialer interface&lt;/li&gt;&#xA;&lt;li&gt;Configure dialer group on dialer interface, this must match dialer rule name.&lt;/li&gt;&#xA;&lt;li&gt;Bind dialer interface to physical interface&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For PPP authentication, you use the dialer interface to configure either PAP or CHAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps you a bit, currently I have not the configuration code on me; but if you need them just ask&lt;/p&gt;&#xA;" OwnerUserId="30930" LastActivityDate="2016-10-20T03:42:31.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35930" PostTypeId="1" CreationDate="2016-10-20T05:38:44.100" Score="1" ViewCount="4000" Body="&lt;p&gt;I cannot get &lt;code&gt;arping&lt;/code&gt; to run if I give a MAC address.&#xA;If I use IP address, it works fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know what the problem is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arping -i &amp;lt;ifname&amp;gt; xx:xx:xx:xx:xx:xx&#xA;arping: Unable to get the IPv4 address of interface &amp;lt;ifname&amp;gt;:&#xA;arping: libnet_get_ipaddr4(): ioctl(): Cannot assign requested address&#xA;arping: Use -S to specify address manually.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;arping -i brlan xx:xx:xx:xx:xx:xx&#xA;arping: libnet_init(LIBNET_LINK, brlan): libnet_check_iface() ioctl: No such device&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31416" LastEditorUserId="31416" LastEditDate="2019-01-09T19:33:29.993" LastActivityDate="2019-01-09T20:34:44.283" Title="arping with mac address fails" Tags="|ping|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="35934" PostTypeId="1" AcceptedAnswerId="35936" CreationDate="2016-10-20T09:28:29.687" Score="1" ViewCount="1633" Body="&lt;p&gt;The OID I am polling at the moment is cefcModuleOperStatus 1.3.6.1.4.1.9.9.117.1.2.1.1.2. When I poll a Nexus 7k switch I am getting a result: 2,2. I am guessing this means OK and OK. The thing is I don't know what other outputs there are for this OID and what there values might mean. I am guessing I'm correct in assuming that the values 2,2 mean OK, OK because I logged on to the switch and saw that both power modules were in OK state &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why are OID's so opaque?! I can't find any decent documentation which gives a full thorough explanation of what each non intuitively named OID might mean and how to interpret the results. So frustrating!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway does anybody know if this is indeed the correct OID to poll? and if so are you aware of the possible out puts and what the nemerical values returned might translate to eg. 0 = absent, 1 = failed, 2 = OK? &lt;/p&gt;&#xA;" OwnerUserId="8804" LastActivityDate="2016-10-20T11:52:22.597" Title="Looking to confirm correct OID to poll for Nexus power module operational status and the meaning of results" Tags="|snmp|cisco-nexus-7k|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35936" PostTypeId="2" ParentId="35934" CreationDate="2016-10-20T11:38:33.347" Score="1" Body="&lt;p&gt;Cisco's &lt;a href=&quot;http://snmp.cloudapps.cisco.com/Support/SNMP/do/BrowseOID.do?local=en&quot; rel=&quot;nofollow&quot;&gt;SNMP Object Navigator&lt;/a&gt; is a great resource to answer most of these questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entering your OID gives the following, so indeed 2 = OK :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Object  cefcModuleOperStatus&#xA;OID     1.3.6.1.4.1.9.9.117.1.2.1.1.2&#xA;Type    ModuleOperType &#xA;&#xA;        1:unknown&#xA;        2:ok&#xA;        3:disabled&#xA;        4:okButDiagFailed&#xA;        5:boot&#xA;        6:selfTest&#xA;        7:failed&#xA;        8:missing&#xA;        9:mismatchWithParent&#xA;        10:mismatchConfig&#xA;        11:diagFailed&#xA;        12:dormant&#xA;        13:outOfServiceAdmin&#xA;        14:outOfServiceEnvTemp&#xA;        15:poweredDown&#xA;        16:poweredUp&#xA;        17:powerDenied&#xA;        18:powerCycled&#xA;        19:okButPowerOverWarning&#xA;        20:okButPowerOverCritical&#xA;        21:syncInProgress&#xA;        22:upgrading&#xA;        23:okButAuthFailed&#xA;        24:mdr&#xA;        25:fwMismatchFound&#xA;        26:fwDownloadSuccess&#xA;        27:fwDownloadFailure&#xA;&#xA;Permission  read-only&#xA;Status      current&#xA;MIB         CISCO-ENTITY-FRU-CONTROL-MIB &#xA;Description This object shows the module's operational state.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Edit: you could also have a look at &lt;a href=&quot;http://snmp.cloudapps.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=1.3.6.1.4.1.9.9.117.1.1&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&amp;amp;submitClicked=true&quot; rel=&quot;nofollow&quot;&gt;cefcFRUPower&lt;/a&gt; and everything below it, for more info about the po&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-10-20T11:52:22.597" LastActivityDate="2016-10-20T11:52:22.597" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35937" PostTypeId="1" AcceptedAnswerId="35938" CreationDate="2016-10-20T11:55:11.900" Score="1" ViewCount="1823" Body="&lt;p&gt;Please, I need to know if the IP  IP 192.169.0.135 can be used... as a local/private or public host?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are different rules to local/private ips?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="31425" LastEditorUserId="2142" LastEditDate="2016-10-20T12:41:13.103" LastActivityDate="2017-09-18T13:54:05.403" Title="Is the IP address 192.169.0.135 valid for local/private or public host?" Tags="|ipv4|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35938" PostTypeId="2" ParentId="35937" CreationDate="2016-10-20T12:11:22.157" Score="5" Body="&lt;p&gt;192.169.0.135 is a valid public address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several tools on the web that allow you to look up addresses to find out to whom they're assigned.  For example, a WHOIS search returns:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP owner info (Whois): &quot;192.169.0.135&quot;&#xA;&#xA;&#xA;&#xA;#&#xA;# ARIN WHOIS data and services are subject to the Terms of Use&#xA;# available at: https://www.arin.net/whois_tou.html&#xA;#&#xA;# If you see inaccuracies in the results, please report at&#xA;# https://www.arin.net/public/whoisinaccuracy/index.xhtml&#xA;#&#xA;&#xA;&#xA;#&#xA;# The following results may also be obtained via:&#xA;# https://whois.arin.net/rest/nets;q=192.169.0.135?showDetails=true&amp;amp;showARIN=false&amp;amp;showNonArinTopLevelNet=false&amp;amp;ext=netref2&#xA;#&#xA;&#xA;NetRange:       192.169.0.0 - 192.169.1.255&#xA;CIDR:           192.169.0.0/23&#xA;NetName:        PSG169&#xA;NetHandle:      NET-192-169-0-0-1&#xA;Parent:         NET192 (NET-192-0-0-0-0)&#xA;NetType:        Direct Assignment&#xA;OriginAS:       &#xA;Organization:   RGnet, LLC (RGNETI-1)&#xA;RegDate:        2005-04-12&#xA;Updated:        2014-03-28&#xA;Ref:            https://whois.arin.net/rest/net/NET-192-169-0-0-1&#xA;&#xA;&#xA;OrgName:        RGnet, LLC&#xA;OrgId:          RGNETI-1&#xA;Address:        5147 Crystal Spring&#xA;City:           Bainbridge Island&#xA;StateProv:      WA&#xA;PostalCode:     98110&#xA;Country:        US&#xA;RegDate:        1990-10-01&#xA;Updated:        2011-09-24&#xA;Ref:            https://whois.arin.net/rest/org/RGNETI-1&#xA;&#xA;&#xA;OrgAbuseHandle: RB366-ARIN&#xA;OrgAbuseName:   Bush, Randy &#xA;OrgAbusePhone:  +1-206-780-0431 &#xA;OrgAbuseEmail:  randy@psg.com&#xA;OrgAbuseRef:    https://whois.arin.net/rest/poc/RB366-ARIN&#xA;&#xA;OrgTechHandle: RB366-ARIN&#xA;OrgTechName:   Bush, Randy &#xA;OrgTechPhone:  +1-206-780-0431 &#xA;OrgTechEmail:  randy@psg.com&#xA;OrgTechRef:    https://whois.arin.net/rest/poc/RB366-ARIN&#xA;&#xA;RTechHandle: RB366-ARIN&#xA;RTechName:   Bush, Randy &#xA;RTechPhone:  +1-206-780-0431 &#xA;RTechEmail:  randy@psg.com&#xA;RTechRef:    https://whois.arin.net/rest/poc/RB366-ARIN&#xA;&#xA;&#xA;#&#xA;# ARIN WHOIS data and services are subject to the Terms of Use&#xA;# available at: https://www.arin.net/whois_tou.html&#xA;#&#xA;# If you see inaccuracies in the results, please report at&#xA;# https://www.arin.net/public/whoisinaccuracy/index.xhtml&#xA;#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-10-20T12:11:22.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35939" PostTypeId="1" AcceptedAnswerId="36550" CreationDate="2016-10-20T12:17:04.033" Score="1" ViewCount="148" Body="&lt;p&gt;Zones in IEC 61300‐3‐35 are defined as shown on this picture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ET4RG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ET4RG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the optical signal is transmitted by the Zone A - Core.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Light is transmitted and retained in the “CORE” of the optical fiber&#xA;  by total internal reflection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I do not understand, why there is any limit imposed on defects in Zone D (Contact zone) at all - can it by any means have any real impact on the signal transmission? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like on this picture of a very dirty old &amp;amp; scratched connector, but no defects within zones A+B and still working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5ig8z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5ig8z.png&quot; alt=&quot;Really bad connector&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The limit is defined as &lt;code&gt;Defects - none &amp;gt; 10μm&lt;/code&gt;. Or may be that no defects in Zone A+B means that the picture is not taken properly (there seems to be some noise in background)&lt;/p&gt;&#xA;" OwnerUserId="24262" LastEditorUserId="24262" LastEditDate="2016-10-21T07:38:56.300" LastActivityDate="2016-11-15T21:21:22.950" Title="What is the purpose of defect limit in Zone D in criteria for MM‐PC Connectors (IEC 61300‐3‐35)" Tags="|fiber|optics|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35941" PostTypeId="1" CreationDate="2016-10-20T13:39:43.063" Score="0" ViewCount="57" Body="&lt;p&gt;If I run the command &lt;strong&gt;sh ip int bri | inc down&lt;/strong&gt;, I can filter to see which ports are down or admin down. Some interfaces may still have configuration on them but I am curious to know if there is a way to see which ports are defaulted without having to do a &lt;strong&gt;sh run&lt;/strong&gt; for each interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example is there a way I can filter which interfaces have this default configuration?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh run int GigabitEthernet1/1 &#xA;Building configuration...&#xA;&#xA;Current configuration : 61 bytes&#xA;!&#xA;interface GigabitEthernet1/1&#xA;no ip address&#xA;shutdown&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30558" LastActivityDate="2016-10-24T05:27:14.187" Title="Is there a way to filter and find a defaulted interface?" Tags="|cisco-commands|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35942" PostTypeId="2" ParentId="35937" CreationDate="2016-10-20T15:00:06.570" Score="2" Body="&lt;p&gt;Private IP ranges:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.0.0.0 - 10.255.255.255 /8&lt;br&gt;&#xA;172.16.0.0 - 172.31.255.255 /12&lt;br&gt;&#xA;192.168.0.0 - 192.168.255.255 /16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.169.0.135 does not fall in those specified ranges so most likely it is a Public IP&lt;/p&gt;&#xA;" OwnerUserId="31414" LastEditorUserId="31414" LastEditDate="2017-09-18T13:54:05.403" LastActivityDate="2017-09-18T13:54:05.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35943" PostTypeId="1" CreationDate="2016-10-20T15:09:07.403" Score="1" ViewCount="105" Body="&lt;p&gt;Is it possible to isolate a computer on a network such that it can be accessed remotely by contractors, but not have access to any of the other machines on the network in any way? I understand it would always have access to the gateway at the least, but can it be isolated from other machines? I know I can secure the gateway sufficiently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could this be done with a software only solution? Would I need a physical firewall device? Could it be accomplished via subnets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to avoid a second ISP connection. I know that is a viable, but clunky, option. Thanks very much for any help you can provide.&lt;/p&gt;&#xA;" OwnerUserId="31431" LastActivityDate="2016-10-21T00:36:12.053" Title="Isolating a workstation on a network for remote access by contractors" Tags="|vpn|firewall|subnet|security|network-access|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="35944" PostTypeId="2" ParentId="35930" CreationDate="2016-10-20T15:09:22.127" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;In order for arping to be able to send an ICMP echo request (what it does when pinging MAC addresses) it needs to put in a source address in that IP packet. The error message says that the &lt;code&gt;&amp;lt;ifname&amp;gt;&lt;/code&gt; interface has no IP address. Your options are to give it one, or do what it says and use -S.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;libnet (and therefore arping) thinks that the interface &lt;code&gt;brlan&lt;/code&gt; doesn't exist. Are you sure that it does? (run &lt;code&gt;ip l l&lt;/code&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If the interface in (1) has an address, or you &lt;em&gt;do&lt;/em&gt; have an interface called &lt;code&gt;brlan&lt;/code&gt;, then file a bug with how to reproduce at &lt;a href=&quot;https://github.com/ThomasHabets/arping/issues&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/ThomasHabets/arping/issues&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31430" LastEditorUserId="31416" LastEditDate="2019-01-09T20:34:44.283" LastActivityDate="2019-01-09T20:34:44.283" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="35945" PostTypeId="2" ParentId="35943" CreationDate="2016-10-20T16:57:48.943" Score="1" Body="&lt;p&gt;One common way is to put that PC on its own VLAN.  Then you can apply access lists on the VLAN interface to control what resources the computer can access.  A firewall is not necessary.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-10-20T16:57:48.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35952" PostTypeId="2" ParentId="35943" CreationDate="2016-10-21T00:36:12.053" Score="0" Body="&lt;p&gt;Absolutely.  Simply assign the workstation's switchport to the outside VLAN.  It will need a public IP address.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-21T00:36:12.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35953" PostTypeId="2" ParentId="35924" CreationDate="2016-10-21T01:50:29.343" Score="4" Body="&lt;p&gt;A subnet mask is a 32 bit value that allows the device that's receiving ip packets to distinguish the network ID portion of the IP address from the host ID portion of the IP address, so without a subnet mask that can be represented in form of a 32 value like (&lt;code&gt;255.0.0.0&lt;/code&gt;) or slash-notation (&lt;code&gt;/8&lt;/code&gt;) it is impossible to identify the network prefix of an IP address.&lt;/p&gt;&#xA;" OwnerUserId="31313" LastEditorUserId="8499" LastEditDate="2018-10-17T20:17:20.600" LastActivityDate="2018-10-17T20:17:20.600" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="35954" PostTypeId="2" ParentId="35839" CreationDate="2016-10-21T02:28:48.483" Score="0" Body="&lt;p&gt;If you want to add multiple devices to your network, I suggest to use Switch instead of HUB, switches have been invented to resolve many problems caused by HUB like &quot;&lt;strong&gt;one single big collision domain, one big broadcast domain, speed/duplex limitation and so on&lt;/strong&gt;&quot;. even with Switch sometimes it is necessary to create &lt;strong&gt;smaller broadcast domain&lt;/strong&gt; wich is good for network performance by using vlan. so avoid using hub in your network if you can afford switch. &lt;/p&gt;&#xA;" OwnerUserId="31313" LastEditorUserId="31313" LastEditDate="2016-10-21T02:34:56.333" LastActivityDate="2016-10-21T02:34:56.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35956" PostTypeId="1" AcceptedAnswerId="36641" CreationDate="2016-10-21T05:57:42.457" Score="2" ViewCount="121" Body="&lt;p&gt;Just wondering if you have two ends mptcp enabled, and say client has 2 interfaces eth0 and eth1 if I understand correctly how mptcp works (depending on routing table) it will create 2 different subflows to server. If so can client send SYN on say eth0, and get a SYN-ACK on eth1 from server? &lt;/p&gt;&#xA;" OwnerUserId="22175" LastEditorUserId="8499" LastEditDate="2017-07-16T03:47:35.473" LastActivityDate="2017-07-16T03:47:35.473" Title="Can a multipath TCP connection use 2 different subflows for packet exchange?" Tags="|tcp|layer4|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35957" PostTypeId="2" ParentId="35956" CreationDate="2016-10-21T06:11:30.957" Score="2" Body="&lt;p&gt;No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the SYN, the client does not provide any information about its other ip addresses, so the server only knows the ip address that was used as source of the SYN and so it can only respond to that ip address. &lt;a href=&quot;https://en.m.wikipedia.org/wiki/Multipath_TCP&quot; rel=&quot;nofollow&quot;&gt;Wikipedia has a nice article&lt;/a&gt; about how this works including this &lt;a href=&quot;https://en.m.wikipedia.org/wiki/File:MPTCP-session-en.png&quot; rel=&quot;nofollow&quot;&gt;visual representation.&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-10-21T06:11:30.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35958" PostTypeId="1" AcceptedAnswerId="35966" CreationDate="2016-10-21T10:41:38.913" Score="19" ViewCount="40489" Body="&lt;p&gt;I recently got to know that IP segment &lt;code&gt;100.64.0.0/10&lt;/code&gt; has been reserved by IANA for 'Shared Address Space'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: Can I use the IP Segment &lt;code&gt;100.64.0.0/10&lt;/code&gt; as a private range in my network (like the way we are using &lt;code&gt;10.0.0.0/8&lt;/code&gt;)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If yes, then do I need to upgrade my network appliances (like firewall or router) before using this, or can I use it as it is?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If no, then why not, and for what purposes this is segment reserved?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If possible, please share some document (or BCP) explaining (or talking about) this segment.&lt;/p&gt;&#xA;" OwnerUserId="31456" LastEditorUserId="8499" LastEditDate="2018-12-21T22:12:10.583" LastActivityDate="2023-07-07T15:32:00.853" Title="IPv4 Segment 100.64.0.0/10" Tags="|ip|ipv4|nat|ip-address|rfc|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35959" PostTypeId="2" ParentId="24749" CreationDate="2016-10-21T11:09:42.503" Score="12" Body="&lt;p&gt;Link-local addresses are used for communication between two hosts (which are on the same link) when no other IP address is specified.&lt;/p&gt;&#xA;&lt;p&gt;In simple words, at the time of booting up, the OS tries to configure an address on its interface through various methods like:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Manual configuration&lt;/li&gt;&#xA;&lt;li&gt;DHCP (DHCPv4 or DHCPv6)&lt;/li&gt;&#xA;&lt;li&gt;SLAAC (Stateless Autoconfiguration) -- Unique to IPv6&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;And if the OS isn't able to configure an address on the interface through any of the automatic methods, then it configures an address on the interface from the link-local pool.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;169.254.0.0/16 -- Link-local address pool in IPv4 address space&lt;/li&gt;&#xA;&lt;li&gt;fe80::/10 -- Link-local address pool in IPv6 address space&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;In IPv4, every interface usually has only a single address whereas in IPv6, multiple addresses on a single interface are the norm (like link-local, global addresses on an interface).&lt;/p&gt;&#xA;&lt;p&gt;Because of the limitation of having one address per interface in IPv4, you may not have seen an address of range 169.254.0.0/16 on an interface.&lt;/p&gt;&#xA;" OwnerUserId="31456" LastEditorUserId="43734" LastEditDate="2023-12-13T01:43:59.063" LastActivityDate="2023-12-13T01:43:59.063" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="35960" PostTypeId="2" ParentId="35924" CreationDate="2016-10-21T11:53:31.033" Score="0" Body="&lt;p&gt;I think you need to know if it's classful or not. if it's classful then you can use the default subnet mask of class A which is &lt;code&gt;255.0.0.0&lt;/code&gt; and so the network address will be &lt;code&gt;12.0.0.0&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="31458" LastEditorUserId="8499" LastEditDate="2018-10-17T20:17:48.493" LastActivityDate="2018-10-17T20:17:48.493" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="35961" PostTypeId="2" ParentId="35958" CreationDate="2016-10-21T12:18:59.227" Score="8" Body="&lt;p&gt;That block of addresses is reserved for service providers to be able to do NAT in such a way that it doesn't conflict with the normal private address space. If you start using it as private space then you're potentially creating a conflict again, so no: don't use this as private space.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-10-21T12:18:59.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35963" PostTypeId="1" AcceptedAnswerId="35968" CreationDate="2016-10-21T13:40:37.200" Score="1" ViewCount="1925" Body="&lt;p&gt;I have a device connected to an ethernet switch, and my PCs NIC is connected to that switch as well. The device is sending multicast messages to &lt;code&gt;239.255.255.251&lt;/code&gt; to which I am able to listen. My computer's IP address is &lt;code&gt;192.168.1.50&lt;/code&gt;, and the netmask is &lt;code&gt;255.0.0.0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shouldn't this not work?&lt;/p&gt;&#xA;" OwnerUserId="31460" LastEditorUserId="8499" LastEditDate="2018-03-19T16:20:15.000" LastActivityDate="2018-03-19T16:20:15.000" Title="Do subnet masks hinder the ability to listen to a UDP multicast?" Tags="|ipv4|ip|subnet|multicast|udp|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="35964" PostTypeId="1" AcceptedAnswerId="35983" CreationDate="2016-10-21T13:53:34.817" Score="0" ViewCount="162" Body="&lt;p&gt;This question may be a bit off-topic for this forum, but I am hoping there are enough experts to take a stab at it anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My office is in a rural-ish location - I can only get DSL at 3 Mbps from Verizon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Town-wide fiber is years off at best.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My ATT iPhone can get 3 bars of LTE with 50 Mbps up/down speeds at a point 800 feet from my office (but still on the same property which I own). &lt;em&gt;Edit: only a single bar of 4G available in the office.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: What options do I have for receiving that signal, and then repeating/amplifying it, and then getting it back to my office either via wireless repeater, or a buried fiber cable, or very long Cat5/6 cable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I be trying to forward the LTE signal with an LTE booster (which I don't think will work), or should I grab the LTE signal, plug it into an ethernet router/switch, and send it back to my office via either wireless antennas or a buried fiber cable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I an open to spending a few thousand $$ to get this working, but I'd like to figure out what options I have and the best way to proceed.&lt;/p&gt;&#xA;" OwnerUserId="30557" LastEditorUserId="8499" LastEditDate="2016-10-21T15:29:42.380" LastActivityDate="2016-10-22T03:33:13.447" Title="Extending LTE internet from remote location to building on same property" Tags="|routing|wireless|fiber|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="35965" PostTypeId="2" ParentId="24749" CreationDate="2016-10-21T14:18:39.330" Score="3" Body="&lt;p&gt;Link-Local addresses are required for the operation IPv6, but not for IPv4. Microsoft, among others, has developed the APIPA (Automatic Private IP Addressing) standard using IPv4 Link-Local addressing, but it is not mandatory or supported by all OSes. I also have seen people misuse IPv4 Link-Local addresses by manually assigning and subnetting them, and that is against &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3927&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3927, Dynamic Configuration of IPv4 Link-Local Addresses&lt;/a&gt;, which &lt;em&gt;is&lt;/em&gt; a standard.&lt;/p&gt;&#xA;&lt;p&gt;Please read &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3927&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3927, Dynamic Configuration of IPv4 Link-Local Addresses&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Introduction&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;As the Internet Protocol continues to grow in popularity, it&#xA;becomes increasingly valuable to be able to use familiar IP tools&#xA;such as FTP not only for global communication, but for local&#xA;communication as well.  For example, two people with laptop&#xA;computers supporting IEEE 802.11 Wireless LANs [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3927#ref-802.11&quot; rel=&quot;nofollow noreferrer&quot;&gt;802.11&lt;/a&gt;] may meet and wish to exchange files. It is desirable for these people to be able to use IP application&#xA;software without the inconvenience of having to manually configure&#xA;static IP addresses or set up a DHCP server [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2131&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC2131&lt;/a&gt;].&lt;/p&gt;&#xA;&lt;p&gt;This document describes a method by which a host may automatically&#xA;configure an interface with an IPv4 address in the 169.254/16 prefix&#xA;that is valid for Link-Local communication on that interface.  This&#xA;is especially valuable in environments where no other configuration&#xA;mechanism is available.  The IPv4 prefix 169.254/16 is registered&#xA;with the IANA for this purpose.  Allocation of IPv6 Link-Local&#xA;addresses is described in &amp;quot;IPv6 Stateless Address Autoconfiguration&amp;quot;&#xA;[&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2462&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC2462&lt;/a&gt;].&lt;/p&gt;&#xA;&lt;p&gt;Link-Local communication using IPv4 Link-Local addresses is only&#xA;suitable for communication with other devices connected to the same&#xA;physical (or logical) link.  Link-Local communication using IPv4&#xA;Link-Local addresses is not suitable for communication with devices&#xA;not directly connected to the same physical (or logical) link.&lt;/p&gt;&#xA;&lt;p&gt;Microsoft Windows 98 (and later) and Mac OS 8.5 (and later) already&#xA;support this capability.  This document standardizes usage,&#xA;prescribing rules for how IPv4 Link-Local addresses are to be treated&#xA;by hosts and routers.  In particular, it describes how routers are to&#xA;behave when receiving packets with IPv4 Link-Local addresses in the&#xA;source or destination address.  With respect to hosts, it discusses&#xA;claiming and defending addresses, maintaining Link-Local and routable&#xA;IPv4 addresses on the same interface, and multi-homing issues.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;When IPv6 was developed, many things were built into it that had been optional, add-on features of IPv4. Link-Local addressing was one of them. Every IPv6 interface is going to get a Link-Local address so that a device can at least communicate on the local link, and, as a built-in feature, many things, e.g. routing protocols, use it for communications on the local link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-10-21T14:18:39.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35966" PostTypeId="2" ParentId="35958" CreationDate="2016-10-21T14:29:57.920" Score="19" Body="&lt;p&gt;The &lt;code&gt;100.64.0.0/10&lt;/code&gt; address block is &lt;strong&gt;not&lt;/strong&gt; &lt;em&gt;private&lt;/em&gt; address space; it is &lt;em&gt;shared&lt;/em&gt; address space. This is spelled out in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6598&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6598, IANA-Reserved IPv4 Prefix for Shared Address Space&lt;/a&gt; (I highlighted the relevant verbiage):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Introduction&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;IPv4 address space is nearly exhausted.  However, ISPs must&#xA;continue to support IPv4 growth until IPv6 is fully deployed.  To&#xA;that end, many ISPs will deploy a Carrier-Grade NAT (CGN) device,&#xA;such as that described in [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6264&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6264&lt;/a&gt;].  Because CGNs are used on&#xA;networks where public address space is expected, and currently&#xA;available private address space causes operational issues when used&#xA;in this context, ISPs require a new IPv4 /10 address block.  This&#xA;address block will be called the &amp;quot;Shared Address Space&amp;quot; and will be&#xA;used to number the interfaces that connect CGN devices to Customer&#xA;Premises Equipment (CPE).&lt;/p&gt;&#xA;&lt;p&gt;Shared Address Space is similar to [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt;] private address space&#xA;in that it is not globally routable address space and can be used&#xA;by multiple pieces of equipment.  &lt;em&gt;&lt;strong&gt;However, Shared Address Space has&#xA;limitations in its use that the current [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt;] private address&#xA;space does not have.  In particular, Shared Address Space can only&#xA;be used in Service Provider networks or on routing equipment that&#xA;is able to do address translation across router interfaces when the&#xA;addresses are identical on two different interfaces.&lt;/strong&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;This document requests the allocation of an IPv4 /10 address block&#xA;to be used as Shared Address Space.  In conversations with many&#xA;ISPs, a /10 is the smallest block that will allow them to deploy&#xA;CGNs on a regional basis without requiring nested CGNs.  For&#xA;instance, as described in [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6598#ref-ISP-SHARED-ADDR&quot; rel=&quot;nofollow noreferrer&quot;&gt;ISP-SHARED-ADDR&lt;/a&gt;], a /10 is sufficient to&#xA;service Points of Presence in the Tokyo area.&lt;/p&gt;&#xA;&lt;p&gt;This document details the allocation of an additional special-use&#xA;IPv4 address block and updates [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5735&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC5735&lt;/a&gt;].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-10-21T15:09:38.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35967" PostTypeId="2" ParentId="35963" CreationDate="2016-10-21T14:37:37.143" Score="0" Body="&lt;p&gt;Muticast, like broadcast, is limited to the LAN on which it originated. It is bounded at layer-3 (routers). Multicast routing was developed to overcome this, but a router must support and have multicast routing enabled in order to route multicast traffic. Multicast routing is not the same as unicast routing. Your host's unicast address and mask have nothing to do with multicast. An application must subscribe to a multicast group in order to receive multicasts. A host can use IGMP to inform a multicast enabled router that it wants to receive multicasts for a group from a remote source, and some switches can listen to the IGMP messages in order to only send the multicasts to particular switch ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A full explanation of multicast is beyond the scope of this site.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-21T14:37:37.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35968" PostTypeId="2" ParentId="35963" CreationDate="2016-10-21T14:49:01.523" Score="1" Body="&lt;p&gt;No, this should not not work, it should work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone in the layer 2 broadcast domain will be able to receive any multicast message sent in that domain. Unless you use vlans, anything attached to the switch can listen for all multicast groups. Routers do not forward multicast traffic, unless specifically configured to do so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnet masks only tell your computer which IP addresses are in its local subnet, and which addresses are not. They have no role to play in multicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the ethernet layer, the multicast group is mapped to a multicast MAC address. Switches will send traffic destined to a multicast MAC address to all ports (unless specifically configured no to do so).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To find the multicast MAC for your multicast group, first convert the IP address to binary:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;239.255.255.251 = 11101111.11111111.11111111.11111011&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first 25 bits of a multicast MAC are always &lt;code&gt;00000001:00000000:01011110:0&lt;/code&gt;. This means they range from &lt;code&gt;01:00:5E:00:00:00&lt;/code&gt; to &lt;code&gt;01:00:5E:7F:FF:FF&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To construct the multicast MAC, append the last 23 bits of the IP to the fixed first 25 bits of all multicast MACs. In this case, we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;00000001:00000000:01011110:01111111:11111111:11111011&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;01:00:5E:7F:FF:FB&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may have noticed it is not possible to do the reverse mapping. All multicast IPs start with the 4 bits &lt;code&gt;1110&lt;/code&gt;, leaving 28 bits for 2^28 different multicast addresses. Since there is only room for 23 bits in the multicast MAC address, such a MAC corresponds to a group of 32 multicast IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2016-10-21T14:49:01.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35970" PostTypeId="2" ParentId="26797" CreationDate="2016-10-21T16:50:31.167" Score="1" Body="&lt;p&gt;The problem with multicast is that it requires routers to keep a lot of additional state. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each &quot;multicast group&quot; for which traffic passes through a router must be tracked in the routers memory along with a list of what ports the router should forward traffic from that multicast group to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most ISPs consider that too much of a burden. So while global-scope multicast addresses do exist they are only likely to work over specialist networks that explicitly support them, not over the internet in general.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-10-21T16:50:31.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35971" PostTypeId="1" AcceptedAnswerId="35975" CreationDate="2016-10-21T17:20:09.387" Score="1" ViewCount="159" Body="&lt;p&gt;The main purpose of VLAN is to isolate computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Supposing we have two VLANs (VLAN 500 &amp;amp; VLAN 600). The first VLAN has the range 192.168.0.0/24 and the other one has 10.0.0.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any interest of using VLANs on the switch in this case? As a good configuration of the router will, indeed, perform the isolation.&lt;/p&gt;&#xA;" OwnerUserId="23817" LastActivityDate="2016-10-25T03:49:41.627" Title="Usefulness of VLAN whith different network subnets?" Tags="|router|vlan|subnet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35972" PostTypeId="2" ParentId="35971" CreationDate="2016-10-21T17:36:13.900" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The main purpose of VLAN is to isolate computers&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is incorrect. VLANs are to create separate layer-2 broadcast domains on switches, where, by default, the entire switch would be in a single layer-2 broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A layer-3 device (router) is required to move traffic between the layer-2 VLANs, just as if the VLANs were separate LANs connected to different router interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to restrict traffic between VLANs on a router using ACLs or firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We live in a layer-3 world. It used to be, &quot;Switch where you can, route where you must,&quot; but that concept is no longer true.  Routers, including layer-3 switches, can easily have virtual interfaces for the VLANs, and that is very inexpensive, compared to physical router interfaces to isolate layer-2 broadcast domains, and network security is much, much more important than it used to be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 protocols just haven't kept up with reality. In particular, STP, even RSTP, can be problematic. There are replacements, e.g. TRILL, that strive to eliminate the need for STP, but they are currently limited to data centers, and most are not inter-operable or are proprietary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has some best practices around layer-2 designs, including restricting each VLAN to a single access switch and using routing, rather than having VLANs spread across many access switches. The recommended best practices will virtually eliminate STP problems, e.g. broadcast storms, which can cripple a large network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-21T17:36:13.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35975" PostTypeId="2" ParentId="35971" CreationDate="2016-10-21T18:09:20.237" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;The main purpose of VLAN is to isolate computers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The point of VLANS is to allow you to seperate your physical and logical network structures.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any interest of using VLANs on the switch in this case? As a good configuration of the router will, indeed, perform the isolation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are three scenarios to consider.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The machines are all on the same Ethernet network without VLANs. In this case the machines are not isolated even if they are in different subnets. IPv4 unicast traffic between different subnets will by default pass through the router where it can be filtered but broadcasts to 255.255.255.255 and IPv6 link-local traffic will pass directly between the machines. Furthermore if someone does want to send IPv4 unicast traffic bypassing the router they just need to add a second IP address to their NIC.&lt;/li&gt;&#xA;&lt;li&gt;The machines are on two physically seperate Ethernet networks connected to different ports on the router. In this case the router can reliablly control communication between the two groups of computers but maintaining two or more physically seperate networks is a PITA (and it's very likely that sooner or later some numpty will interconnect them).&lt;/li&gt;&#xA;&lt;li&gt;The machines are on seperate VLANs on the same physical Ethernet network. This gives you the best of both worlds. The router keeps control of communication between the two groups of computers but you only have to maintain a single physical infrastructure.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-10-23T21:29:26.477" LastActivityDate="2016-10-23T21:29:26.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35978" PostTypeId="2" ParentId="33302" CreationDate="2016-10-21T18:28:04.410" Score="3" Body="&lt;p&gt;In network addressing there is a tradeoff between ease-of-use and efficient utilisation of addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Putting subnets on octet boundries makes it much easier for humans to see what is going on. Especially in IPv4 where addresses are typically expressed in decimal dotted-quad.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand putting networks on octet boundries can waste a lot of addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In public IPv4 space nowadays you generally have to be frugal, unless you are lucky enough to have a legacy allocation that massively exceeds your needs (e.g. MIT).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some very large companies (e.g. Comcast) also need to be frugal in private IPv4 space but for most of us 10.0.0.0/8 is vast enough that we really don't need to worry about efficient allocation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IPv6 there is genereally no need to be frugal at all, it's normal to give every subnet a /64 &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-10-21T18:28:04.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35981" PostTypeId="2" ParentId="18330" CreationDate="2016-10-22T00:35:36.300" Score="3" Body="&lt;p&gt;For ISSU on Cisco NX-OS to work you need run LACP configured as &quot;SLOW&quot; and you still detect any issues with the port-channel!&lt;/p&gt;&#xA;" OwnerUserId="31475" LastActivityDate="2016-10-22T00:35:36.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35982" PostTypeId="2" ParentId="28136" CreationDate="2016-10-22T03:10:26.483" Score="1" Body="&lt;p&gt;This is a job for BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You want a single public AS.  You will use BGP and each ISP facing router eBGP peers with the ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.apnic.net/get-ip/faqs/asn#when-should-an-as-be-created&quot; rel=&quot;nofollow&quot;&gt;APNIC When should an AS be created?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An AS needs to be created if a network connects to more than one AS with different routing policies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some common examples of Autonomous Systems are networks connected to two or more upstream service providers or exchange points and networks peering locally at exchange points.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-22T03:10:26.483" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35983" PostTypeId="2" ParentId="35964" CreationDate="2016-10-22T03:33:13.447" Score="2" Body="&lt;p&gt;You'll need line of sight to wirelessly &lt;em&gt;bridge&lt;/em&gt; your LTE connection from the good spot to your office.  You need power and a NEMA enclosure to house your 4g LTE router.  You may be able to WiFi bridge with the same router or you may need a dedicated WiFi bridge in that NEMA enclosure as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the office, you need a 2nd WiFi bridge to talk to the good spot / NEMA enclosure.  This bridge should be a dual mode device that supports bridging and AP modes simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;http://www.cisco.com/c/en/us/support/routers/810-integrated-services-routers-isr/model.html&quot; rel=&quot;nofollow&quot;&gt;Cisco's 801&lt;/a&gt;, for example.  Find a Cisco reseller in your area or contact me if you need help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll probably have to spend a couple of grand to get the initial setup going, then you'll need to pay AT&amp;amp;T for the monthly 4G LTE service.  The WiFi bridges and office AP is a 1 time cost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can WiFi bridge many many miles with line of sight, so bridging distance won't be an issue assuming line of sight.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-22T03:33:13.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35985" PostTypeId="5" CreationDate="2016-10-22T06:52:01.853" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2016-10-22T06:52:01.853" LastActivityDate="2016-10-22T06:52:01.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35986" PostTypeId="4" CreationDate="2016-10-22T06:52:01.853" Score="0" Body="For questions about Meraki, a Cisco cloud based network equipment provider for wireless, routing, and security." OwnerUserId="21915" LastEditorUserId="8499" LastEditDate="2016-10-22T16:35:15.370" LastActivityDate="2016-10-22T16:35:15.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35990" PostTypeId="2" ParentId="13288" CreationDate="2016-10-22T10:53:09.660" Score="0" Body="&lt;p&gt;Basicaly what you are looking for is an Ethernet VPN soloution. This can then be connected to the wireless access points at both sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've successfully used openvpn on linux for this myself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One possible wrinkle with such a setup is that you normally only get one DHCP server and therefore one default gateway. This means that all your external traffic ends up routing through one site. That may or may not be desirable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want seperate DHCP and default gateways on each site I belive it should be possible to achive this with some ebtables filtering but I haven't actually tried such a setup myself.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-10-22T10:53:09.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35995" PostTypeId="1" CreationDate="2016-10-22T18:30:23.913" Score="2" ViewCount="987" Body="&lt;p&gt;Router does not send Broadcast packet. that means it does not support broadcasting. but while sending packet from computer a to computer b which is not in the same network , computer a gets the mac address of default router through arp packets. and then router will send arp packets that it broadcast packets to know computer b's mac address. in this case how come router broadcast packets???&#xA;please reply as early as possibel&lt;/p&gt;&#xA;" OwnerUserId="31499" LastActivityDate="2019-06-10T08:10:19.833" Title="Broadcasting and ARP packet" Tags="|routing|broadcast|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="35996" PostTypeId="2" ParentId="35995" CreationDate="2016-10-22T18:54:50.533" Score="2" Body="&lt;p&gt;I think you are confusing the fact that a router will not &lt;em&gt;forward&lt;/em&gt; broadcasts with the need for a router to &lt;em&gt;use&lt;/em&gt; broadcasts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If PC A and PC B are in different networks with a router in between, and PC A is sending something to PC B:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;PC A will use ARP to discover the MAC address of the default gateway,&#xA;the router.&lt;/li&gt;&#xA;&lt;li&gt;PC A will create frames for the packets to PC B using the router's&#xA;MAC address.&lt;/li&gt;&#xA;&lt;li&gt;PC A will send frames containing the packets destined for PC B to the&#xA;router's MAC address.&lt;/li&gt;&#xA;&lt;li&gt;The router will strip off the frames, which contain the MAC&#xA;addresses, to get to the packets.&lt;/li&gt;&#xA;&lt;li&gt;The router will look at the layer-3 addresses in the packets to&#xA;determine to which interface it should send the packets.&lt;/li&gt;&#xA;&lt;li&gt;The router will use ARP to determine PC B's MAC address on the next&#xA;network.&lt;/li&gt;&#xA;&lt;li&gt;The router will build new frames for the packets using PC B's MAC&#xA;address.&lt;/li&gt;&#xA;&lt;li&gt;The router will send the frames to PC B on the next network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-22T18:54:50.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="35997" PostTypeId="1" AcceptedAnswerId="35998" CreationDate="2016-10-22T20:29:34.990" Score="1" ViewCount="1655" Body="&lt;p&gt;I wonder why I can ping 192.168.3.50 /27 and 192.168.3.70 /27 from 192.168.3.100 /24. Is is not supposed to be impossible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3H7xD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3H7xD.png&quot; alt=&quot;Problem to understand subnets&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for your help.&lt;/p&gt;&#xA;" OwnerUserId="14468" LastEditorUserId="8499" LastEditDate="2018-12-25T02:53:40.070" LastActivityDate="2018-12-25T02:53:40.070" Title="Why I can ping these subnets from a different subnet?" Tags="|cisco|subnet|switching|arp|packet-tracer|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="35998" PostTypeId="2" ParentId="35997" CreationDate="2016-10-22T20:38:36.533" Score="1" Body="&lt;p&gt;The host with the &lt;code&gt;/24&lt;/code&gt; address thinks that all the other hosts are on the same network, so it will happily send out a ping on the layer-2 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a response to be sent back, the hosts need to believe that the requesting host is on the same network, otherwise the hosts will try to send a response to their configured gateways. There is something wrong in the configuration of the two hosts which do respond. Unfortunately, host configurations are off-topic here. The masks may be incorrectly configured, or, as I have seen in a few hosts, they do not have a gateway configured so they do respond. You need to figure out what is wrong with the configurations on those two hosts.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-22T20:38:36.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36005" PostTypeId="2" ParentId="35997" CreationDate="2016-10-23T01:15:15.573" Score="0" Body="&lt;p&gt;you are using tree different network:&#xA;192.168.3.32&#xA;192.168.3.64&#xA;192.168.3.0&#xA;there is no way that a ping from one network can reach another network without a configured layer 3 device, probably your switch is a layer 3 switch configured with inter-Vlan routing. &lt;/p&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-23T01:15:15.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36006" PostTypeId="2" ParentId="35995" CreationDate="2016-10-23T01:51:28.093" Score="0" Body="&lt;p&gt;Actually, router doesn't forward broadcast by default, when a router receive a frame with a destination mac address ff:ff:ff:ff:ff:ff wich is a broadcast.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;the router will compare the destination ip address to its routing&#xA;table,&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;if the router find the corresponding network on its routing table,&lt;/li&gt;&#xA;&lt;li&gt;it will send its mac address as a destination mac address to the&#xA;sending host,&lt;/li&gt;&#xA;&lt;li&gt;the sending host will send the frame to the router,&lt;/li&gt;&#xA;&lt;li&gt;the router will use arp to request the the destination mac address&#xA;of the pc on the other side of the network and send the frame.&lt;/li&gt;&#xA;&lt;/ol&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-23T01:51:28.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36007" PostTypeId="2" ParentId="35475" CreationDate="2016-10-23T02:09:33.120" Score="0" Body="&lt;p&gt;vlan is about creating logical network with switch, you cannot create vlan with router; however, you can use a technique called router on a stick to route packet between vlans&lt;/p&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-23T02:09:33.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36008" PostTypeId="2" ParentId="35858" CreationDate="2016-10-23T02:59:23.507" Score="6" Body="&lt;p&gt;Benjamin Dales answer is certainly correct for switches running standards based spanning tree. For switches using per VLAN STP however: yes, it can very well make a difference. Granted, under rather specific circumstances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you said, the bridge-id is basically made up of three parts: &lt;code&gt;(priority + system id extension).mac-address&lt;/code&gt;, where the MAC address is just appended. The lowest bridge IDs wins the root bridge election. That being said, it is obvious that the priority must be the same on all routers in order for the extended system ID to actually make a difference. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose a network just consisting of two switches. SW1 has a MAC address of 1 (just going to short that up here, suppose those were actually 48bit MAC addresses), SW2 has the MAC address 2. Both use the default priority (32768).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When running only PVSTP (no matter if rapid or not), the VLAN ID of that instance is used as extended system ID. In that case (for the sake of that example we're running in VLAN 1), the bridge IDs would be&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1: 32769.1   (32768 + 1).MAC&#xA;SW2: 32769.2   (32768 + 1).MAC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Obviously SW1 will become root. Suppose now, SW2 was changed to MST mode and SW1 is still running RSTP. MSTP is fully backwards compatible to other spanning tree protocols. With MSTP, the extended system is becomes the MST instance number, as it would make no sense to use the VLAN here. Many VLANs can be mapped to a single instance. Just enabling MSTP without any configuration will create the MST instance &lt;strong&gt;0&lt;/strong&gt; (!) and map all VLANs to it. Now the bridge IDs would look as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1: 32769.1   (32768 + 1).MAC&#xA;SW2: 32768.2   (32768 + 0).MAC&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, SW2 will be the winner of the election process, and it wins due to the lower extended system id. Hence the answer to your question is: yes, it could possibly affect root bridge election. The lowest possible VLAN number is 1, and the default MST instance is 0, resulting in the MST switch always winning root election with default settings. Also please have a look at Benjamins comment about spanning interoperability. I am currently not sure about the behavior (on BPDU sending level) when MSTP and PVSTP+ have to work together. I will add detailed information later, I have to try that in lab and inspect the BPDUs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you think about that for a minute, that makes perfect sense. MST + RPVSTP interoperability requires the root bridge to be within the MST domain. Sure you can manually tweak the priority, in which case you messed that up yourself. By default however, the switch in the MST domain will be selected as root bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TL;DR and Summary:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all switches are running (R)PVSTP or all switches are running MSTP, then no, it will not affect root bridge election. &lt;strong&gt;In a mixed environment, it certainly can.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One note, though: this discussion is certainly true for Cisco switches (more general, switches supporting per VLAN spanning tree), but not necessarily for other switches.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastEditorUserId="3875" LastEditDate="2016-10-27T02:14:43.690" LastActivityDate="2016-10-27T02:14:43.690" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36009" PostTypeId="2" ParentId="35684" CreationDate="2016-10-23T03:13:48.513" Score="0" Body="&lt;p&gt;For OSPFv2 there is no interface command, the command you provided is a network command for OSFP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPFv2 is pretty much configured the same way as RIPv2; however, OSPFv2 is a classless/link-state Routing Protocol which explain why you have to specify the Network and (Subnet mask or Wilcard) and Area, the network command will tell OSPF to send hello packets to all directly connected interface containing an IP address of that network.&lt;/p&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-23T03:13:48.513" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36013" PostTypeId="2" ParentId="13288" CreationDate="2016-10-23T08:33:42.213" Score="0" Body="&lt;p&gt;That's a feature called L3 Roaming if I remember correctly. Most enterprise Wifi solutions support it, and it works by tunneling traffic from the WAPs (wireless access points) to a central controller, where they are egressed into the network. That way users are always connected to the same L2 network regardless of which AP they are connected to. Enterprises use this feature to simplify management and improve security (firewall rules are for example easier to maintain if the client IPs always are within a certain subnet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How the solution implements it differs quite a lot. Cisco Meraki for example uses a VPN concentrator VM that terminates VPN tunnels from the WAPs and egresses traffic. As Meraki utilizes a cloud-based controller, it doesn't matter if the WAPs are inside your network or outside it. Some other brands use physical controllers that tunnel traffic through your own L3 network and egresses it traffic from WAPs on a dedicated interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do note that this is not a plug for Meraki, it's just the solution I'm most familiar with myself. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-10-23T08:33:42.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36014" PostTypeId="2" ParentId="35625" CreationDate="2016-10-23T09:01:46.810" Score="1" Body="&lt;p&gt;This is mostly a terminology question, so here's my 2 cents.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Purpose-built routers do not have NICs, they have physical ports/interfaces, which can be used for many different applications, and internal (logical/virtual) interfaces that can be defined in software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Servers and VMs however have NICs, they are what connects the server/VM to a switch/router.&lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-10-23T09:01:46.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36016" PostTypeId="2" ParentId="13288" CreationDate="2016-10-23T13:55:41.470" Score="0" Body="&lt;p&gt;Any router that can build L2 VPN between them solve this problem.&#xA;Better to be able to filter L2 traffic to solve problems with unnecssary broadcast/multicast flood and add flexibility.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Personally I prefer Mikrotik router, bit it not the only solution.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;PS.&#xA;If You ask this question, building and maintaining this configuration require some effort.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2016-10-23T13:55:41.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36017" PostTypeId="1" AcceptedAnswerId="36024" CreationDate="2016-10-23T15:30:03.687" Score="1" ViewCount="656" Body="&lt;p&gt;If a network has a throughput bottleneck, does it matter whether the slow link comes before or after?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;For example:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/a70Y9.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/a70Y9.png&quot; alt=&quot;example&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c wants to send something to h.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the bottleneck is on h's side. What throughput speed will the red arrow have? 200 or 100?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is about throughput only. Meaning we neglect the router's buffer and processing &lt;em&gt;(little queuing delay, processing delay and also transmission delay)&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="31518" LastActivityDate="2017-10-17T19:24:19.347" Title="Does the direction of a throughput bottleneck matter?" Tags="|speed|throughput|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36020" PostTypeId="2" ParentId="35743" CreationDate="2016-10-23T21:04:39.650" Score="2" Body="&lt;p&gt;When a switch doesn't have the destination mac address in its mac address table, it floods the frame to all other port except the receiving port. However, if the sending host doesn't have the destination mac address,it will use ARP (Address Resolution Protocol) to resolve or obtain the destination mac address, if the destination host is located in another network like internet, the sending host will use the mac address of the router as the destination mac address and the router will forward the packet and the last router will use ARP to deliver the frame to the destination host.&lt;/p&gt;&#xA;" OwnerUserId="31313" LastActivityDate="2016-10-23T21:04:39.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36024" PostTypeId="2" ParentId="36017" CreationDate="2016-10-24T00:34:54.947" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If a network has a throughput bottleneck, does it matter whether the slow link comes before or after?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No it doesn't, Only matters when destination is &lt;strong&gt;before&lt;/strong&gt; or &lt;strong&gt;after&lt;/strong&gt; that bottleneck link.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What throughput speed will the red arrow have? 200 or 100?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes it will be bottle necked at 100mbps. So bottleneck throughput speed would be of the lowest throughput link between &lt;strong&gt;h&lt;/strong&gt; and &lt;strong&gt;c&lt;/strong&gt;. So this bottleneck throughput will be applicable when the packet is sent from h to c also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="31465" LastActivityDate="2016-10-24T00:34:54.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36025" PostTypeId="1" AcceptedAnswerId="36026" CreationDate="2016-10-24T00:58:07.560" Score="1" ViewCount="203" Body="&lt;p&gt;Theory says that there shouldn't be any ICMP error messages for ICMP messages. When sending ICMP echo requests in traceroute, doesn't this break this rule?&lt;/p&gt;&#xA;" OwnerUserId="30828" LastActivityDate="2016-10-24T01:12:24.413" Title="Is using traceroute with ICMP echo messages valid?" Tags="|icmp|traceroute|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36026" PostTypeId="2" ParentId="36025" CreationDate="2016-10-24T01:12:24.413" Score="0" Body="&lt;p&gt;The theory you mention was never a standard. In fact, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1393&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1393, Traceroute Using an IP Option&lt;/a&gt; created a Traceroute option. This RFC has now been moved to Historic status  by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6814#section-2.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6814, Formally Deprecating Some IPv4 Options, Section 2.3.  Traceroute&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;2.3.  Traceroute&lt;/p&gt;&#xA;&lt;p&gt;The Traceroute option is defined in [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1393&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1393&lt;/a&gt;].  The Traceroute&#xA;option is defined as Experimental; it was never widely deployed on&#xA;the public Internet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;A Traceroute tool is still part of most OSes, but it is often misused. It is really only useful on a network that you control, and you know what the results &lt;em&gt;should&lt;/em&gt; be. Using it on public Internet is really a fool's game because many ISPs will purposely reroute the packets and/or set them to lower priority, and your result will not reflect what happens to your other protocols.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-10-24T01:12:24.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36029" PostTypeId="2" ParentId="35941" CreationDate="2016-10-24T04:32:29.403" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;For example is there a way I can filter which interfaces have this default configuration?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Found a rather different solution for this, you need to have &lt;strong&gt;pcregrep&lt;/strong&gt; installed on linux server from where you are doing ssh to the router, Run the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ssh &quot;Username&quot;@&quot;IP of the router&quot; &quot;sh run&quot; | pcregrep -M  'interface.*\n.*no ip address.*\n.*shutdown.*\n.*!'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would work with &lt;strong&gt;default interface&lt;/strong&gt; configuration provided by you i.e.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh run int GigabitEthernet1/1 &#xA;Building configuration...&#xA;&#xA;Current configuration : 61 bytes&#xA;!&#xA;interface GigabitEthernet1/1&#xA;no ip address&#xA;shutdown&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Any other configuration(if different from this) of default configuration like variations in IOS-XR, IOS-XE or a Switch can be put in instead of the current lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="31465" LastEditorUserId="31465" LastEditDate="2016-10-24T05:27:14.187" LastActivityDate="2016-10-24T05:27:14.187" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="36031" PostTypeId="2" ParentId="35794" CreationDate="2016-10-24T10:38:32.377" Score="1" Body="&lt;p&gt;Ok, got the cause cornered, I think. It looks like an IOS version problem: making the 2811 vtp server and any switch vtp client works as expected. The other way round never works. Conclusion: vtp versions are not upwards compatible. Since the goal was primarily to move all local routing decisions to the switches to relieve the router load, making the router server will not solve the problem. So I made the router &quot;stupid&quot; (not vlan aware) by removing all vtp settings and the vlan.dat and got an actual performance increase. This gives me another problem of setting the local acls on the switches and the remote (vpn/internet) on the router, but that is something for another question. All people who helped: thanks.&lt;/p&gt;&#xA;" OwnerUserId="31307" LastActivityDate="2016-10-24T10:38:32.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36034" PostTypeId="1" AcceptedAnswerId="36037" CreationDate="2016-10-24T13:51:14.503" Score="1" ViewCount="290" Body="&lt;p&gt;I installed &lt;a href=&quot;http://www.deksoftware.com/dna/download.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;DEKSI Network Administrator Demo&lt;/a&gt; and when it is &lt;em&gt;Creating Map&lt;/em&gt;, in &lt;strong&gt;Step 3 of 4. Searching and selecting hosts for placing on the map&lt;/strong&gt;, it found &lt;em&gt;IP address and Mac&lt;/em&gt; perfectly, but it also found &lt;em&gt;Network adapter's manufacturer, DNS Name, and Host type&lt;/em&gt;.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xVTbY.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xVTbY.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I need a method for getting the &lt;strong&gt;Network adapter's manufacturer, DNS Name&lt;/strong&gt; and &lt;strong&gt;Host type&lt;/strong&gt; from ICMP or ARP.&lt;/p&gt;&#xA;" OwnerUserId="22692" LastEditorUserId="8499" LastEditDate="2016-10-24T22:26:15.950" LastActivityDate="2016-10-26T19:05:27.520" Title="More Information from ICMP &amp; ARP" Tags="|arp|monitoring|icmp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36035" PostTypeId="2" ParentId="30596" CreationDate="2016-10-24T14:06:30.863" Score="10" Body="&lt;p&gt;Each fills a different purpose, and all three may be part of an overall solution. Let's start with the oldest concept first.&lt;/p&gt;&#xA;&lt;p&gt;Subnets are the IP world's way of determining what devices are &amp;quot;assumed to be on-link&amp;quot;. Devices within the same subnet will send unicast traffic directly to each other by default, while devices in different subnets will send unicast traffic via a router by default.&lt;/p&gt;&#xA;&lt;p&gt;You could put each subnet on a separate physical network. This forces traffic to go via the router, which can act as a firewall. That works fine if your isolation domains match up with your physical network layout, but gets to be a PITA if they don't.&lt;/p&gt;&#xA;&lt;p&gt;You can have multiple subnets on the same &amp;quot;link&amp;quot;, but doing so does not provide a high degree of isolation between the devices. IPv4 unicast traffic  between different subnets will by default flow via your router where it can be filtered, but broadcasts, IPv6 link local traffic, and non-IP protocols will flow directly between the hosts. IPv6 global unicast traffic may or may not flow via the router, depending on how the hosts are configured. Furthermore, if someone wants to bypass the router, they can trivially do so by adding an extra IP address to their NIC.&lt;/p&gt;&#xA;&lt;p&gt;VLANs take an Ethernet network and split it up into multiple separate Virtual Ethernet networks. This lets you ensure that traffic goes via the router without constraining your physical network layout.&lt;/p&gt;&#xA;&lt;p&gt;VRFs let you build multiple virtual routers in one box. They are a relatively recent idea, and are mostly useful in large complex networks. Essentially, while VLANs let you build multiple independent virtual Ethernet networks on the same infrastructure, VRFs (used in conjunction with an appropriate virtual link layer such as VLANs or MPLS) let you build multiple independent IP networks on the same infrastructure. Some examples of where they might be useful:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If you are running a multi-tenant datacenter scenario, each customer may have their own (possibly overlapping) set of subnets and want different routing and filtering rules.&lt;/li&gt;&#xA;&lt;li&gt;In a large network you may want to route between subnets/VLANs in the same security domain locally while sending cross security domain traffic to a central firewall.&lt;/li&gt;&#xA;&lt;li&gt;If you are doing DDOS scrubbing you may want to separate unscrubbed traffic from scrubbed traffic.&lt;/li&gt;&#xA;&lt;li&gt;If you have multiple classes of customer, you may want to apply different routing rules to their traffic. For example, you could route &amp;quot;economy&amp;quot; traffic on the cheapest path, while routing &amp;quot;premium&amp;quot; traffic on the fastest path.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="31800" LastEditDate="2022-10-13T20:33:45.493" LastActivityDate="2022-10-13T20:33:45.493" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="36036" PostTypeId="1" CreationDate="2016-10-24T14:10:24.407" Score="2" ViewCount="1957" Body="&lt;p&gt;I want to establish a VPN tunnel with AWS using IPSec (Vyatta).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is something that I was not able to figure out: How do I make it work without having to configure a static IP for the customer gateway? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the client to establish the connection because the public IP of the client could change due to using ADSL/VDSL access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try to configure the VPN, I get the following warning regarding the fact that the local address was not configured: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Warning: Local address MY_PUBLIC_IP specified for peer &quot;AWS_PUBLIC_IP&quot;&#xA;is not configured on any of the ipsec-interfaces and is not the&#xA;clustering address.  IPsec must be re-started after address&#xA;has been configured.&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31543" LastEditorDisplayName="user36472" LastEditDate="2018-04-20T05:44:47.413" LastActivityDate="2018-11-16T09:03:15.667" Title="How to make IPSec VPN tunnel to work from behind NAT on ADSL?" Tags="|vpn|adsl|vyatta|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36037" PostTypeId="2" ParentId="36034" CreationDate="2016-10-24T14:15:51.060" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Now I need a method for getting Network adapter's manufacturer, DNS&#xA;  Name and Host type from ICMP or ARP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is not possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP (Address Resolution Protocol) will get the layer-2 address (MAC) for a layer-3 address (IPv4). An ARP request will be broadcast to all devices on a layer-2 network. The request asks who has the layer-2 address for this layer-3 address. An ARP reply will be sent by the owner of the layer-3 address. It will say I have that layer-3 address, and this is the layer-2 address. There is no information of the type that you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ICMP is a layer-3 protocol, and it will be used for messages at layer-3:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Echo Request and Echo Reply - Ping&lt;/li&gt;&#xA;&lt;li&gt;Destination Unreachable&lt;/li&gt;&#xA;&lt;li&gt;Redirect&lt;/li&gt;&#xA;&lt;li&gt;Router Advertisement&lt;/li&gt;&#xA;&lt;li&gt;Router Solicitation&lt;/li&gt;&#xA;&lt;li&gt;Time Exceeded&lt;/li&gt;&#xA;&lt;li&gt;Parameter Problem&lt;/li&gt;&#xA;&lt;li&gt;Timestamp&lt;/li&gt;&#xA;&lt;li&gt;Timestamp Reply&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some of the ICMP messages have sub-information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to resort to other methods to get the information you are seeking.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-24T14:15:51.060" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36038" PostTypeId="2" ParentId="36017" CreationDate="2016-10-24T14:40:00.773" Score="0" Body="&lt;p&gt;If C sends packets as fast as he can both links will be filled, but only half the packets will reach H, the other half will be dropped by the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand if C runs a protocol like TCP then his TCP/IP stack will estimate the availble bandwidth for the full path and the data rate through the two links will be very similar. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-10-24T14:40:00.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36039" PostTypeId="2" ParentId="36036" CreationDate="2016-10-24T15:43:27.173" Score="1" Body="&lt;p&gt;If the client's gatewayd evice has the option for DDNS, you can assign a DDNS domain name to it. That way, you don't have to worry about IP changing because the domain name is constant.&lt;/p&gt;&#xA;" OwnerUserId="30293" LastActivityDate="2016-10-24T15:43:27.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36043" PostTypeId="2" ParentId="35958" CreationDate="2016-10-24T22:07:39.917" Score="8" Body="&lt;p&gt;Officially RFC 6598 says&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Devices MUST be capable of performing address translation when&#xA;     identical Shared Address Space ranges are used on two different&#xA;     interfaces.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most NAT implementations are not capable of handing that case at least not witout extra hacks (on linux for example I belive that to implement NAT with overlapping internal and external space you would need to NAT the traffic twice in two different network namespaces).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are of course free to ignore that paragraph and use the addresses anyway. RFCs are not laws. Using &quot;shared address space&quot; for your internal networks is certainly a lesser evil than using squat space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do choose to ignore it and your ISP changes your connection to CGN then there is the risk of an addressing conflicts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So like many things it comes down to a risk assessment. How badly do you need extra private address space? how likely is it that your internet connection will be put behind a CGN in the future? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are thinking about using this block because you are short of regular private addresses it's probably time for a long hard look at your IP addressing policies. Do you really have millions of devices on your internal networks? Are you wasting IPs with oversized allocations? isn't it time you thought about IPv6?&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2018-01-25T15:59:35.430" LastActivityDate="2018-01-25T15:59:35.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36044" PostTypeId="2" ParentId="19452" CreationDate="2016-10-24T23:38:35.167" Score="1" Body="&lt;p&gt;I would guess that the NAT is deliberately changing the source IP for ICMP errors coming from the network behind the NAT to reduce the chance of them being dropped by ingress filtering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not know the specifics of the NAT device you are using and hence I do not know if this behaviour is configurable.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-10-24T23:38:35.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36046" PostTypeId="2" ParentId="35208" CreationDate="2016-10-25T01:30:52.197" Score="-1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;While the wired Ethernet side can be full-duplex, the radio side is&#xA;  not.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/22950-br-ts-22950.html&quot; rel=&quot;nofollow&quot;&gt;Troubleshoot Common Problems with Wireless Bridged Networks, cisco.com&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 802.11 family consists of a series of half-duplex over-the-air modulation techniques that use the same basic protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.11&quot; rel=&quot;nofollow&quot;&gt;IEEE 802.11 WikiPedia&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-10-27T00:14:17.453" LastActivityDate="2016-10-27T00:14:17.453" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36047" PostTypeId="2" ParentId="35971" CreationDate="2016-10-25T03:49:41.627" Score="0" Body="&lt;p&gt;A VLAN limits the scope of BUM traffic and isolates failure domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VLAN defines the scope of an Ethernet which may exist on any number of ports on a single or multiple switches.  It is possible for multiple subnets to communicate over a single VLAN but you usually see a single subnet per VLAN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If on a shared VLAN, secondary IP addresses can be added by end users to switch subnets.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-25T03:49:41.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36048" PostTypeId="1" CreationDate="2016-10-25T06:42:02.133" Score="1" ViewCount="82" Body="&lt;p&gt;I have to two Offices sharing  6 Megabytes internet link - the Main office has 4 Megabyte and the small office has 2 Megabytes but the users in the small office travel a lot and most of the time they are not in the office and I would like to configure on Pfense in such a way that if there are not users in the small office their allocated bandwidth will be used by in the main office &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the users in the small office their 2 Megabytes will be switch back to them &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this feasible and how can configure it on Pfsense ?&lt;/p&gt;&#xA;" OwnerUserId="31556" LastActivityDate="2016-10-25T15:11:13.553" Title="How to configuring bandwidth switching on Pfsense" Tags="|switching|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36053" PostTypeId="1" CreationDate="2016-10-25T12:52:59.800" Score="1" ViewCount="645" Body="&lt;p&gt;I have one physical interface (X0) on my sonicwall NSA 3600 with 4 different virtual interfaces (X0:V120, X0:V121, X0:V130, X0:V140) for the different SSID's broadcasted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I Would like Vlan X0:v140 to only have access to a single website (pupil platform).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've created an adress group which contains all the IP-adresses that server uses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GXHm0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GXHm0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I create an access rule to allow outgoing traffic or an access rule to block outgoing traffic there is no problem, all traffic passes or is blocked, but when I create an access rule to allow traffic to the specific ip-adresses of the pupils platform all traffic is blocked, even the website which shouldn't be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2mvAZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2mvAZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to help me out to overcome this problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a million!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Korneel Vanloocke&lt;/p&gt;&#xA;" OwnerUserId="31567" LastEditorUserId="31567" LastEditDate="2016-11-08T09:10:53.283" LastActivityDate="2018-01-14T16:57:38.620" Title="Sonicwall NSA 3600 - allow vlan access to one website" Tags="|sonicwall|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36054" PostTypeId="1" CreationDate="2016-10-25T14:17:29.813" Score="1" ViewCount="110" Body="&lt;p&gt;Bitrates supported by switches, routers and network cards are often 10 MBit/s, 100 MBit/s or 1GBit/s. Newer developments promise up to 10 GBit/s. I do not see a reason why powers of 10 should have a certain meaning here, unlike powers of 2 in memory storage increase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do bitrates increase in that pattern?&lt;/p&gt;&#xA;" OwnerUserId="31570" LastActivityDate="2016-10-25T14:37:24.030" Title="Why do bitrates increase in powers of 10?" Tags="|bandwidth|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36056" PostTypeId="2" ParentId="36054" CreationDate="2016-10-25T14:37:11.467" Score="0" Body="&lt;p&gt;This may look that way, but in reality there's more. For instance have a look at the SFP page on Wikipedia. There you'll see listed speeds from 1 GB, 2.5GB, 10 GB, 25 GB. And the next will be 40 GB, 100 GB and even 400 GB. &lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2016-10-25T14:37:11.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36057" PostTypeId="2" ParentId="36054" CreationDate="2016-10-25T14:37:24.030" Score="1" Body="&lt;p&gt;You are incorrect; bitrates don't always increase by 10 times. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Memory storage increases by powers of two because it is addressed with binary (base 2) addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Increasing ethernet speeds by a power of 10 has been a convenient goal, but there is now 40 Gb ethernet and 100 Gb ethernet. Also, Wi-Fi speeds have not been anything like a linear 10 times increase: &lt;code&gt;802.11&lt;/code&gt; was 2 Mb, &lt;code&gt;802.11a&lt;/code&gt; was 54 Mb, &lt;code&gt;802.11b&lt;/code&gt; was 11 Mb, &lt;code&gt;802.11g&lt;/code&gt; was 54 Mb, &lt;code&gt;802.11n&lt;/code&gt; was 150 Mb per stream, etc.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-25T14:37:24.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36059" PostTypeId="1" AcceptedAnswerId="36066" CreationDate="2016-10-25T15:53:44.380" Score="2" ViewCount="917" Body="&lt;p&gt;i created a Mac-ACL on a unch of 2960X Switches to limit user access to the internet-gateway only.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mac access-list extended PROTECTED&#xA; permit any host ffff.ffff.ffff 0x800 0x0&#xA; permit any host ffff.ffff.ffff 0x806 0x0&#xA; permit any host ffff.ffff.ffff 0x86DD 0x0&#xA; permit any host dead.beef.cafe 0x800 0x0&#xA; permit any host dead.beef.cafe 0x806 0x0&#xA; permit any host dead.beef.cafe 0x86DD 0x0&#xA;deny   any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&quot;dead.beef.cafe&quot; is a Fortinet Firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using &quot;switchport protected&quot; alone was't an option because this feature is limited to one switch only. &#xA;The concept of private VLANs wasn't present to me when this solution was implemented.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/2&#xA;  description Room X&#xA;  switchport access vlan 101&#xA;  switchport voice vlan 102&#xA;  switchport mode access&#xA;  switchport port-security maximum 3 vlan access&#xA;  switchport port-security&#xA;  switchport port-security violation protect&#xA;  mac access-group PROTECTED in&#xA;  no lldp transmit&#xA;  spanning-tree portfast&#xA;  spanning-tree bpduguard enable&#xA; end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Today an issue occured with this config.&#xA;All edge-ports are configured with BPDUGUARD to errdisable the ports when a STP Packet is received.&#xA;The Mac-ACL acts before BPDUGUARD. So, in the situation when a loop happens between 2 switchports, the ACL is filtering BPDUs and BPDUGUARD has no effect any more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately i wasn't quite familar with the concept of isolated private VLANs when we implemented this network. Meanwhile i see that segmenting the network with private VLANs were a better Solution than using the Mac-ACL.&#xA;I'd like to avoid redesigning the whole network just to solve this loop issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions how to solve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&#xA;Andreas&lt;/p&gt;&#xA;" OwnerUserId="31569" LastActivityDate="2016-10-25T21:22:39.640" Title="Cisco Layer2 ACL and STP" Tags="|cisco|switch|security|spanning-tree|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36060" PostTypeId="1" AcceptedAnswerId="36084" CreationDate="2016-10-25T16:01:12.550" Score="0" ViewCount="1494" Body="&lt;p&gt;I came across a new term in TCP &lt;code&gt;ACK aggregation&lt;/code&gt; which is a bit new to me. I tried finding a good resource online that precisely explains this concept in a clear but unfortunately all of them are very dense and complex. Kindly, can someone explain how and why ACK aggregation exists?&lt;/p&gt;&#xA;" OwnerUserId="31371" LastActivityDate="2016-10-26T12:31:24.310" Title="The difference between simple ACK and ACK aggregation improvement in TCP" Tags="|cisco|tcp|packet-analysis|congestion|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36061" PostTypeId="2" ParentId="20762" CreationDate="2016-10-25T19:45:15.770" Score="1" Body="&lt;p&gt;There may be a way to acheive this by exploiting the following BGP next hop rule:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From RFC 4271, 5.1.3 NEXT_HOP:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When sending a message to an external peer, X, and the peer is&#xA;           one IP hop away from the speaker:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;- If the route being announced was learned from an internal&#xA;             peer or is locally originated, the BGP speaker can use an&#xA;             interface address of the internal peer router (or the&#xA;             internal router) through which the announced network is&#xA;             reachable for the speaker for the NEXT_HOP attribute,&#xA;             provided that peer X shares a common subnet with this&#xA;             address.  This is a form of &quot;third party&quot; NEXT_HOP attribute.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Could you try this:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Remove the OSPF adjacency between Cisco and Mikrotik on network 192.168.2.0/30&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Create the OSPF adjacency between the Cisco and Mikrotik routers across the shared network 198.51.100.0/29&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure that the routes the Cisco router is learning via OSPF have a next hop of 198.51.100.5&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Clear the BGP sessions.  The Cisco router should now advertise routes to internal subnets with a BGP NEXT_HOP of 198.51.100.5&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This article shows an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/26634-bgp-toc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/26634-bgp-toc.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BGP Next Hop (Multiaccess Networks)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Plt5W.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Plt5W.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This example shows how the next hop behaves on a multiaccess network such as Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume that RTC and RTD in AS300 run OSPF. RTC runs BGP with RTA. RTC can reach network 180.20.0.0 via 170.10.20.3. When RTC sends a BGP update to RTA with regard to 180.20.0.0, RTC uses as next hop 170.10.20.3. RTC does not use its own IP address, 170.10.20.2. RTC uses this address because the network between RTA, RTC, and RTD is a multiaccess network. The RTA use of RTD as a next hop to reach 180.20.0.0 is more sensible than the extra hop via RTC.&#xA;Note: RTC advertises 180.20.0.0 to RTA with a next hop 170.10.20.3.&#xA;If the common medium to RTA, RTC, and RTD is not multiaccess, but NBMA, further complications occur.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-10-25T19:45:15.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36063" PostTypeId="1" AcceptedAnswerId="36065" CreationDate="2016-10-25T20:34:10.730" Score="1" ViewCount="453" Body="&lt;p&gt;When configuring a Micro-BFD session on a LAG, is it preferred/recommended to still also tie BFD to the OSPF adjacency that is established over that interface?  I would think not as the BFD session for OSPF would be hashed over a single link, during a failure of that link in the bundle the OSPF adjacency would go down, but LAG would stay up (assuming other measures such as min-links is not met).  Is it preferred recommended to only configure BFD tied to LAG and allow that failure to trigger the OSPF process? &lt;/p&gt;&#xA;" OwnerUserId="20816" LastEditorUserId="8499" LastEditDate="2016-10-25T21:03:40.690" LastActivityDate="2016-10-25T21:03:40.690" Title="Micro-BFD LAG and OSPF" Tags="|ospf|ieee-802.1ax|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36065" PostTypeId="2" ParentId="36063" CreationDate="2016-10-25T20:56:49.770" Score="0" Body="&lt;p&gt;Failover of a LAG connection means that the traffic would failover to the link(s) still up. It is much, much faster than STP failover. It is even faster than routing protocol failover.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your BFD and OSPF session would remain up if there is at least one link of the LAG still up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't confuse the LAG interface, which OSPF and BFD use, with the individual interfaces of the LAG links. As long as the LAG interface is still up, and it will be if even one of the LAG links is still up, then OSPF will continue to run on the interface. The LAG interface decides which link a flow will use, and it will shift flows to remaining links when any link goes down. This is invisible to the flow. This happens very, very fast, and there is no way that OSPF would miss enough Hellos to decide the neighbor is down.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-25T21:02:23.880" LastActivityDate="2016-10-25T21:02:23.880" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36066" PostTypeId="2" ParentId="36059" CreationDate="2016-10-25T21:22:39.640" Score="1" Body="&lt;p&gt;You should never block the OUI (&lt;code&gt;01-80-C2&lt;/code&gt;) for the layer-2, link-local protocols. That OUI is set aside for the link-layer protocols like LLDP, BPDUs, 802.1X etc. It is a multicast OUI, and bridges (including switches) that follow the IEEE 802.1D (Spanning Tree) standard will never send those frames to another interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using PVST, then the BPDUs use a different MAC address: &lt;code&gt;01:00:0C:CC:CC:CD&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-25T21:22:39.640" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36068" PostTypeId="1" AcceptedAnswerId="36069" CreationDate="2016-10-25T23:19:26.487" Score="1" ViewCount="564" Body="&lt;p&gt;If not, how will it determine which subnet to send the packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean the port forwarding table , instead of the arp routing table.&lt;/p&gt;&#xA;" OwnerUserId="31583" LastActivityDate="2016-10-26T07:56:45.493" Title="If I connect a switch to the port of another switch, will it cause the forwarding table of the upper switch to be constantly updated?" Tags="|switch|ethernet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36069" PostTypeId="2" ParentId="36068" CreationDate="2016-10-25T23:30:46.460" Score="1" Body="&lt;p&gt;Switches do not have forwarding tables, nor do switches have any concept of subnets. Switches also do not have ARP tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You seem to be confusing routers with switches. Switches operate at layer-2, and routers at layer-3. A subnet is a layer-3 construct, and ARP resolves a layer-3 address into a layer-2 address. Switches do not remove the layer-2 frame, the way routers do, to even see the layer-3 packet addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch builds and updates its MAC address table each time a frame enters an interface. A MAC address table is per switch. It makes no sense for one switch to update another switch's MAC address table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch uses the MAC address table to figure out to which switch interface to send a frame. If the frame's MAC address is not in the switch MAC address table, the frame will be flooded to all the switch interfaces other than the one where it entered the switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-25T23:50:37.220" LastActivityDate="2016-10-25T23:50:37.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36072" PostTypeId="2" ParentId="36068" CreationDate="2016-10-26T07:56:45.493" Score="0" Body="&lt;p&gt;you will need to elaborate more exxactly what you want. I don't think you understand the difference between:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;port forwarding table&quot;: A router/fw can maintain something like this. It would forward packets incoming on port IPA/PortX to port IPB/PortY.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Forwarding Table: As Ron put it, see below. Just MAC Address mapping&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP Table: Maps IP to MAC Address so that a switch know if something with destination IP A comes in it maps it to MAC Address B, which it then checks in it's mac address table/forwarding table and forwards it out the mapped interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The upper switch will learn the MAC Address of the connected switch, and that will be in the Forwardin/MAC Address Table.&lt;/p&gt;&#xA;" OwnerUserId="1316" LastActivityDate="2016-10-26T07:56:45.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36073" PostTypeId="1" CreationDate="2016-10-26T08:51:59.757" Score="1" ViewCount="3196" Body="&lt;p&gt;Am using open source OSPF software from ospf.org and running ospf daemon in host PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If router has interfaces in multiple area, then its an Area Border Router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to detect the router is ASBR in OSPF ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the Network Planner explicitly tell the router would be an ASBR router,while configuring the network.&lt;/p&gt;&#xA;" OwnerUserId="22270" LastActivityDate="2016-10-26T12:09:45.143" Title="Is there a way to detect whether router is ASBR in OSPF?" Tags="|routing|bgp|ospf|layer3|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36074" PostTypeId="2" ParentId="36073" CreationDate="2016-10-26T09:03:35.980" Score="3" Body="&lt;p&gt;If you look at the type 1 Router LSA for an ABR or ASBR it will have the E flag set if it is an ASBR and the B flag set if it is an ABR&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RFC 2328 A.4.2 page 206&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bit E&#xA;    When set, the router is an AS boundary router (E is for&#xA;    external).&#xA;&#xA;bit B&#xA;    When set, the router is an area border router (B is for border).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To configure an ASBR use the redistribute command within the OSPF configuration and the Router will become an ASBR&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-10-26T09:03:35.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36081" PostTypeId="2" ParentId="36073" CreationDate="2016-10-26T12:09:45.143" Score="0" Body="&lt;p&gt;ASBR router means that your router or PC has interface in another routing domain/protocol apart from OSPF and you are advertising that network to OSPF domain. &lt;/p&gt;&#xA;" OwnerUserId="29580" LastActivityDate="2016-10-26T12:09:45.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36084" PostTypeId="2" ParentId="36060" CreationDate="2016-10-26T12:31:11.940" Score="2" Body="&lt;p&gt;There is a mechanism that is called TCP delayed acknowledgment. It is used to improve network performance. You can find more info in google. Here is wiki page: &lt;a href=&quot;https://en.wikipedia.org/wiki/TCP_delayed_acknowledgment&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/TCP_delayed_acknowledgment&lt;/a&gt;&#xA;Also it might be interesting to read about Nagle's algorithm. It is used to improve network performance where application uses small packet sizes( like telnet). It aggregates packets to MTU size and sends them all in one.&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/Nagle%27s_algorithm&quot; rel=&quot;nofollow&quot;&gt;https://en.wikipedia.org/wiki/Nagle%27s_algorithm&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29580" LastActivityDate="2016-10-26T12:31:11.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36085" PostTypeId="2" ParentId="36060" CreationDate="2016-10-26T12:31:24.310" Score="0" Body="&lt;p&gt;It's not a term I've come across, perhaps you could provide the reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However most acks are aggregated for example during a steady-state data transfer, say a large file going in one direction.  In this case a receiver acks every two segments that it receives, not each one.  So say segments with (next) sequence numbers 5000 and 6000 arrive.  The receiver does not send an ack for 5000 but does send one for 6000.  This ack implicitly also acks 5000.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-10-26T12:31:24.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36090" PostTypeId="1" AcceptedAnswerId="59797" CreationDate="2016-10-26T18:21:45.813" Score="2" ViewCount="1803" Body="&lt;p&gt;We will get a &lt;code&gt;/24&lt;/code&gt; public IP address range, and I have to seperate it into few departments.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my plan is to split the &lt;code&gt;/24&lt;/code&gt; network into several &lt;code&gt;/27&lt;/code&gt; networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to use a Cisco SG300-10SFP to create VLANs with &lt;code&gt;/27&lt;/code&gt; networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I still need a router in before that SG300 to connect all VLAN gateways with the &lt;code&gt;/24&lt;/code&gt; gateways, or are that SG300 such fancy devices who can manage it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I never worked with that SG300 so far, a friend suggested them and said they have L3 support.&lt;/p&gt;&#xA;" OwnerUserId="31608" LastEditorUserId="8499" LastEditDate="2016-10-27T23:51:15.210" LastActivityDate="2019-06-12T19:19:47.840" Title="Cisco SG300 as core switch, Router needed for separated vlans?" Tags="|cisco|routing|vlan|cisco-sg300|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36091" PostTypeId="2" ParentId="36090" CreationDate="2016-10-26T18:28:07.640" Score="3" Body="&lt;p&gt;According to the &lt;a href=&quot;https://www.cisco.com/c/en/us/products/collateral/switches/small-business-smart-switches/data_sheet_c78-610061.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco 300 Series Managed Switches Data Sheet&lt;/a&gt;, the SG300 switches can do IPv4 routing:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/H5Sh1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H5Sh1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will probably need to configure this on your switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will definitely need a firewall between your switch and the WAN in order to protect your network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-26T18:33:50.647" LastActivityDate="2016-10-26T18:33:50.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36092" PostTypeId="2" ParentId="30044" CreationDate="2016-10-26T18:29:32.967" Score="1" Body="&lt;p&gt;If you want to paste in the config in the hierarchical format, you can use &quot;load override terminal&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The paste is relative to your current location in the hierarchy, so make sure you go to the top with &quot;top&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refer here for official info:  &lt;a href=&quot;https://www.juniper.net/documentation/en_US/junos16.1/topics/task/configuration/junos-software-configuration-file-loading.html&quot; rel=&quot;nofollow&quot;&gt;https://www.juniper.net/documentation/en_US/junos16.1/topics/task/configuration/junos-software-configuration-file-loading.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-10-26T18:29:32.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36094" PostTypeId="2" ParentId="33501" CreationDate="2016-10-26T18:54:09.620" Score="2" Body="&lt;p&gt;First thing I would suggest, assuming this ISP manages the AP installed at your location, is get them out there to align the AP properly.  At 15 degree offset you will be pointed off the water tower by 339m at a distance of 1,300m from the tower.  The signal may be weak and susceptible to slight interference.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-10-26T18:54:09.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36095" PostTypeId="2" ParentId="36034" CreationDate="2016-10-26T19:05:27.520" Score="2" Body="&lt;p&gt;You could potentially get the manufacturer of the NIC from the ARP table, but you need to take the MAC address from the ARP mapping and do a lookup using a 3rd party source to determine the Organizationally Unique Identifier (the first six hex digits of the MAC).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For DNS name you can do a reverse lookup on the IP address from the ARP table using nslookup or something similar.  This is assuming there is a pointer record for the IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what you mean by Host Type.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-10-26T19:05:27.520" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36096" PostTypeId="2" ParentId="35958" CreationDate="2016-10-26T19:11:46.823" Score="2" Body="&lt;p&gt;Technically you can use that space in your network, it is just another IP subnet, but you can't advertise this network out to the public internet and any internal devices using these IPs should have a source NAT applied before that traffic enters the internet.  I wouldn't recommend duplicating a public subnet though.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-10-26T19:11:46.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36097" PostTypeId="2" ParentId="35963" CreationDate="2016-10-26T19:32:46.110" Score="1" Body="&lt;p&gt;To add on to Gerben's response, there is an Individual/Group bit in the MAC address that the switch reads to see if the MAC is unicast or broadcast/multicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is the least significant bit (furthest to the right) of the first byte:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;00000001&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 = broadcast/multicast&#xA;0 = unicast&lt;/p&gt;&#xA;" OwnerUserId="31609" LastEditorUserId="31609" LastEditDate="2017-07-06T16:17:23.083" LastActivityDate="2017-07-06T16:17:23.083" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36098" PostTypeId="2" ParentId="35859" CreationDate="2016-10-26T19:48:40.340" Score="0" Body="&lt;p&gt;You can use two statements to allow /24 and greater&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;prefix-list emea seq 30 permit 10.9.1.0/24&#xA;prefix-list emea seq 31 permit 10.9.1.0/24 ge 25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31609" LastEditorUserId="8499" LastEditDate="2016-10-26T20:01:32.880" LastActivityDate="2016-10-26T20:01:32.880" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36100" PostTypeId="2" ParentId="35708" CreationDate="2016-10-26T20:19:34.617" Score="2" Body="&lt;p&gt;QoS mechanisms only come into effect when there is congestion on the link.  If you have a 20M circuit but connected to a 1G interface, your device will never recognize the congestion because the traffic never reaches 1G.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to implement inbound policing and outbound traffic shaping at your CIR (commited information rate) of your circuit, which would be 20M.  Then your device will recognize that it is becoming congested at 20M and will start using the QoS mechanisms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ron is correct about inbound traffic from the internet being hard to control, but if you police the traffic, the packet loss will cause TCP protocol to back off and hopefully not overwhelm your circuit from one traffic flow.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-10-26T20:19:34.617" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36102" PostTypeId="2" ParentId="35501" CreationDate="2016-10-26T20:29:32.620" Score="-1" Body="&lt;p&gt;If you add &lt;strike&gt;&quot;|interface&quot;&lt;/strike&gt;  to that very long string it should also grab the interface names.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastEditorUserId="31609" LastEditDate="2016-10-26T21:55:48.240" LastActivityDate="2016-10-26T21:55:48.240" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36103" PostTypeId="2" ParentId="29962" CreationDate="2016-10-26T21:15:43.113" Score="-1" Body="&lt;p&gt;If you are trying to get a better understanding on NAT fundamentals. It would beneficial to watch a few introductory videos. Here is a great video to help get you started. &lt;a href=&quot;https://www.youtube.com/watch?v=711xYxaRPwM&quot; rel=&quot;nofollow&quot;&gt;https://www.youtube.com/watch?v=711xYxaRPwM&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30625" LastActivityDate="2016-10-26T21:15:43.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36104" PostTypeId="1" CreationDate="2016-10-26T21:41:39.980" Score="1" ViewCount="509" Body="&lt;p&gt;I have a simple network with two switches redundantly connected to each other and several computers on each switch talking back and forth across the two switches. The switches support RSTP/MSTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to be able to simulate a link loss between the two switches by disconnecting the active link and benchmark what the actual delay is until RSTP establishes a new topology and frame forwarding resumes but I'm not sure how to go about doing this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried measuring the Tx and Rx differential voltage to see if I can see a gap when no frames are being forwarded but it's exceptionally hard to trigger on such an event. Anyone have any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, the complexity of my network will grow quickly and I'm just trying to establish a good benchmark method from the start.&lt;/p&gt;&#xA;" OwnerUserId="31411" LastActivityDate="2016-10-27T15:32:00.813" Title="How do I physically measure the re-convergence delay while RSTP determines the new topology after link loss?" Tags="|switch|ieee-802.1w|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36105" PostTypeId="1" AcceptedAnswerId="36106" CreationDate="2016-10-27T00:53:32.647" Score="3" ViewCount="2829" Body="&lt;p&gt;I have officially made the dumbest mistake ever.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My switch is a Catalyst 2960 Series, configured this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 10052 bytes&#xA;!&#xA;! Last configuration change at 19:15:28 UTC Wed Oct 26 2016 by admin&#xA;! NVRAM config last updated at 19:18:01 UTC Wed Oct 26 2016 by admin&#xA;!&#xA;version 15.0&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Core&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 $1$kCJR$njs2VC4DsqlF/vQT7X75y1&#xA;!&#xA;username admin privilege 15 secret 5 $1$bJaZ$xtF0cZGkkH5IWeOOc9hWN1&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication login default local&#xA;aaa authorization exec default local if-authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;switch 1 provision ws-c2960x-48fps-l&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with a username admin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I connect to this switch via SSH, as I have no physical presence to it, and I was trying to lower the privilege level from 15 to 1 of a user account called admin in it. So, I went ahead and issued a &lt;code&gt;no username admin&lt;/code&gt; command, then I did a &lt;code&gt;username admin privilege 1 password Mypassword&lt;/code&gt; command, which is the same password when it was in level 15. Stupidly enough, I thought it was cool now, and I logged out. When I tried to login again, I got &lt;code&gt;access denied&lt;/code&gt;, when using admin and Mypassword as credentials.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My aim was to lower the user privilege and have an enable password, which I did before this whole mess.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I even didn't do a save in order to restart and not have been stuck in this situation, but even with a restart I am still locked out!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can I do to gain access back and telnet is not enabled? I tried using the web console but it is very limited.&lt;/p&gt;&#xA;" OwnerUserId="21193" LastEditorUserId="8499" LastEditDate="2018-12-20T02:04:50.427" LastActivityDate="2018-12-20T02:04:50.427" Title="Locked myself out of my Cisco switch" Tags="|cisco|switch|cisco-catalyst|security|cisco-commands|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36106" PostTypeId="2" ParentId="36105" CreationDate="2016-10-27T01:00:37.717" Score="9" Body="&lt;p&gt;If you didn't save the configuration, you could just restart the switch, but you will need physical access to the switch. You may be able to get someone at the site to restart the switch for you. Simply unpluuging it, waiting a few minutes, then plugging it back in should work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, Cisco maintains a &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ios-nx-os-software/ios-software-releases-121-mainline/6130-index.html&quot;&gt;Password Recovery Procedures&lt;/a&gt; web page with links to the various device recovery procedures, but you are going to need physical access to the switch to perform the recovery procedures. &lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-27T01:07:01.533" LastActivityDate="2016-10-27T01:07:01.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36108" PostTypeId="2" ParentId="36104" CreationDate="2016-10-27T03:03:29.803" Score="1" Body="&lt;p&gt;Ping from an endpoint off switch A to an endpoint off switch B.  In windows OS you can say &lt;code&gt;ping 1.2.3.4 -t&lt;/code&gt; so the ping keeps going until you stop it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the ping is going, unplug and/or shut the primary uplink and count the number of seconds until the pings begin responding again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;note that you might get different results depending on failure type (admin interface shutdown, unplug cable, physically cut cable, etc)&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-27T03:03:29.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36109" PostTypeId="2" ParentId="30596" CreationDate="2016-10-27T03:14:45.250" Score="2" Body="&lt;ul&gt;&#xA;&lt;li&gt;VLAN's are said to isolate broadcast and failure domains.&lt;/li&gt;&#xA;&lt;li&gt;A single subnet is typically configured per VLAN and sets the IP (layer3) addressing.&lt;/li&gt;&#xA;&lt;li&gt;VRF separates route tables on the same device.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-27T03:14:45.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36111" PostTypeId="2" ParentId="35064" CreationDate="2016-10-27T04:40:22.130" Score="0" Body="&lt;p&gt;I managed to fix this, I just reset the configuration of the device and typed in the configuration manually, which worked. It seems as the problem was that the SD-card contained a configuration from another (identical) switch, where no SFP modules were inserted at the time of configuration. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2016-10-27T04:40:22.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36114" PostTypeId="1" AcceptedAnswerId="36153" CreationDate="2016-10-27T07:10:57.527" Score="1" ViewCount="6507" Body="&lt;p&gt;My setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I receive from my ISP a &lt;code&gt;/24&lt;/code&gt; public IP subnet (e.g: &lt;code&gt;20.20.20.0/24&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of our departments want to have full control over their public IPs, so I split it up to several &lt;code&gt;/27&lt;/code&gt; subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the beginning I wanted to set up 3 VLANs:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;VLAN 100: &lt;code&gt;20.20.20.32/27&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;VLAN 200: &lt;code&gt;20.20.20.128/27&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;VLAN 5 (WAN connect): &lt;code&gt;20.20.20.0/30&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The Gateway of the switch is &lt;code&gt;20.20.20.1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured a static route on the SG300-28 (is in L3 mode):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0.0.0.0/0&lt;/code&gt; over &lt;code&gt;20.20.20.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clients in the VLAN 100 or the VLAN 200 can't reach the ISP Gateway or the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I put the client in the VLAN 5 he can of course connect to the GW and the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am to blind to see the mistake, so I count on you guys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cisco Packet Tracer Example: &lt;a href=&quot;http://files.fuerst.it/sg300.pkt&quot; rel=&quot;nofollow&quot; title=&quot;PKT File&quot;&gt;PKT File&lt;/a&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Config: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config-file-header&#xA;switche5bce7&#xA;v1.4.5.02 / R800_NIK_1_4_194_194&#xA;CLI v1.0&#xA;set system mode router &#xA;&#xA;file SSD indicator encrypted&#xA;@&#xA;ssd-control-start &#xA;ssd config &#xA;ssd file passphrase control unrestricted &#xA;no ssd file integrity control &#xA;ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0 &#xA;!&#xA;vlan database&#xA;vlan 5,10,100,200 &#xA;exit&#xA;voice vlan oui-table add 0001e3 Siemens_AG_phone________&#xA;voice vlan oui-table add 00036b Cisco_phone_____________&#xA;voice vlan oui-table add 00096e Avaya___________________&#xA;voice vlan oui-table add 000fe2 H3C_Aolynk______________&#xA;voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone&#xA;voice vlan oui-table add 00d01e Pingtel_phone___________&#xA;voice vlan oui-table add 00e075 Polycom/Veritel_phone___&#xA;voice vlan oui-table add 00e0bb 3Com_phone______________&#xA;ip dhcp server &#xA;ip dhcp pool network Pool_5&#xA;address low 20.20.20.6 high 20.20.20.10 255.255.255.224 &#xA;default-router 20.20.20.5&#xA;dns-server 8.8.8.8&#xA;exit&#xA;ip dhcp pool network Pool_100&#xA;address low 20.20.20.34 high 20.20.20.62 255.255.255.224 &#xA;default-router 20.20.20.33&#xA;dns-server 8.8.8.8&#xA;exit&#xA;ip dhcp pool network Pool_200&#xA;address low 20.20.20.130 high 20.20.20.158 255.255.255.224 &#xA;default-router 20.20.20.129&#xA;dns-server 8.8.8.8&#xA;exit&#xA;bonjour interface range vlan 1&#xA;ip access-list extended VLAN_100-IN&#xA;permit ip any any ace-priority 1&#xA;exit&#xA;ip access-list extended VLAN_1-IN&#xA;permit ip any any ace-priority 1&#xA;exit&#xA;hostname switche5bce7&#xA;line console&#xA;no autobaud&#xA;exit&#xA;no passwords complexity enable &#xA;username cisco password encrypted d033e22ae348aeb5660fc2140aec35850c4da997 privilege 15 &#xA;ip ssh server&#xA;ip ssh-client server authentication &#xA;ip telnet server&#xA;!&#xA;interface vlan 1&#xA; no ip address dhcp &#xA; service-acl input VLAN_1-IN default-action permit-any &#xA;!&#xA;interface vlan 5&#xA; name WAN &#xA;!&#xA;interface vlan 10&#xA; name MGMT &#xA; ip address 10.10.10.10 255.255.255.0 &#xA;!&#xA;interface vlan 100&#xA; name VLAN_100 &#xA; ip address 20.20.20.33 255.255.255.224 &#xA; service-acl input VLAN_100-IN default-action permit-any &#xA;!&#xA;interface vlan 200&#xA; name VLAN_200 &#xA; ip address 20.20.20.129 255.255.255.224 &#xA;!&#xA;interface gigabitethernet1&#xA; ip address 20.20.20.2 255.255.255.252 &#xA;!&#xA;interface gigabitethernet2&#xA; switchport mode access &#xA; switchport access vlan 5 &#xA;!&#xA;interface gigabitethernet3&#xA; switchport mode access &#xA;!&#xA;interface gigabitethernet4&#xA; switchport mode access &#xA;!&#xA;interface gigabitethernet5&#xA; switchport mode access &#xA;!&#xA;interface gigabitethernet10&#xA; service-acl input VLAN_100-IN &#xA; switchport mode access &#xA; switchport access vlan 100 &#xA;!&#xA;interface gigabitethernet20&#xA; switchport mode access &#xA; switchport access vlan 200 &#xA;!&#xA;interface gigabitethernet25&#xA; switchport mode access &#xA; switchport access vlan 10 &#xA;!&#xA;interface gigabitethernet26&#xA; switchport mode access &#xA; switchport access vlan 10 &#xA;!&#xA;exit&#xA;ip default-gateway 20.20.20.1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31608" LastEditorUserId="8499" LastEditDate="2016-10-27T23:49:30.220" LastActivityDate="2016-10-28T09:34:42.647" Title="Routing on SG300 with VLANs" Tags="|cisco|routing|cisco-sg300|" AnswerCount="2" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="36121" PostTypeId="1" CreationDate="2016-10-27T13:38:33.653" Score="0" ViewCount="24" Body="&lt;p&gt;After configuring a network, how can I test that my routers are configured correctly with the minimal number of pings?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an appropriate traversal for finding this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example problem:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/d2kBj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/d2kBj.png&quot; alt=&quot;Example problem&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31637" LastActivityDate="2016-10-27T13:59:41.810" Title="How do I find the minimal number of pings to test a network's route table?" Tags="|ping|" AnswerCount="1" CommentCount="1" ClosedDate="2016-10-27T14:12:42.857" ContentLicense="CC BY-SA 3.0" />
  <row Id="36122" PostTypeId="1" CreationDate="2016-10-27T13:50:16.550" Score="3" ViewCount="1190" Body="&lt;p&gt;I am on a L3 switch C3750 IOS 12.2 and I want to log in the buffer (or just to the syslog server) all severity 5 messages and just the ACL Blocked level 6 messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to do this ? I've found that we can set the severity of acl log messages in the acl entries, but it's on ASA, not on my platform, even with extended acl.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And I can't permit all 6 messages to be logged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&lt;/p&gt;&#xA;" OwnerUserId="24395" LastActivityDate="2017-11-22T11:23:44.267" Title="Syslog severity level to 5 + ACL BLOCKED log" Tags="|acl|cisco-ios-12|logging|cisco-3750|syslog|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="36123" PostTypeId="2" ParentId="36121" CreationDate="2016-10-27T13:59:41.810" Score="2" Body="&lt;p&gt;From Host 1 you can ping to Host 3, Host 5, and Host 6.  This way a ping will traverse all of your subnets.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-10-27T13:59:41.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36124" PostTypeId="2" ParentId="36122" CreationDate="2016-10-27T14:43:49.337" Score="0" Body="&lt;p&gt;You can set the logging level. If you set the logging level to 6, it will log all level 6 messages. See &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/routers/access/wireless/software/guide/SysMsgLogging.html&quot; rel=&quot;nofollow&quot;&gt;System Message Logging&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging trap &amp;lt;level&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You need software to read the syslog which can give you only the level 6 messages in which you are interested.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-27T14:43:49.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36125" PostTypeId="2" ParentId="36104" CreationDate="2016-10-27T15:32:00.813" Score="2" Body="&lt;p&gt;I think you could do this using a SPAN port.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Since your switches are redundantly connected, determine which of the two links is the Alternate.&lt;/li&gt;&#xA;&lt;li&gt;Set up a SPAN session using the Alternate port as a source and the option &quot;encapsulation replicate&quot;&lt;/li&gt;&#xA;&lt;li&gt;Connect the SPAN destination to your laptop running Wireshark and start a capture&lt;/li&gt;&#xA;&lt;li&gt;Disconnect the active link causing the Alternate port to become active&lt;/li&gt;&#xA;&lt;li&gt;Check the delta time for when the downstream switch sends a BPDU with the Agreement bit set signaling that Sync is complete&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Documentation from Cisco: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146.html#converge2&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/24062-146.html#converge2&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-10-27T15:32:00.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36126" PostTypeId="1" AcceptedAnswerId="36127" CreationDate="2016-10-27T15:53:51.143" Score="4" ViewCount="2822" Body="&lt;p&gt;I am using a MAC access list on this switch, so I go about it by first creating the MAC access list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#conf t&#xA;#mac access-list extended aclname&#xA;# permit host XXXX.XXXX.XXXX any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, I tie this list to all/one port:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#conf t&#xA;#interface gigabit 1/0/Y&#xA;# mac access-group aclname in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, any traffic coming towards port Y gets checked against the MAC access list,  to check if the source is allowed to enter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then i do a &lt;code&gt;#clear mac address-table dynamic&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have done this to many site offices, but there is this particular site which has about 80+ devices that is driving me crazy, this site has a larger number of devices than the rest sites. So everytime i add a mac, another device gets disconnected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess my question is: Is there any limitation on this access list? How many? How do you propose I overcome this?&lt;/p&gt;&#xA;" OwnerUserId="21193" LastEditorUserId="8499" LastEditDate="2020-01-10T09:36:31.480" LastActivityDate="2021-06-19T22:16:29.030" Title="Cisco Catalyst 2960 X MAC access list" Tags="|cisco|switch|mac-address|cisco-catalyst|security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36127" PostTypeId="2" ParentId="36126" CreationDate="2016-10-27T16:12:33.897" Score="3" Body="&lt;p&gt;It sounds like you are running out of the limited TCAM space. You could change the SDM. If you are not using this as a layer-3 switch with routing, you could use the &lt;code&gt;sdm prefer access&lt;/code&gt; command to increase the TCAM space for ACLs. This command requires you to reload the switch for it to take effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This seems like a lot of work for little to no gain. It is very simple to spoof or change a MAC address in a host. Trying to restrict access based on MAC addresses is a fool's game. Anyone could waltz in there and clone a MAC address for his device to connect to your network. There are much better ways to do this. See &lt;a href=&quot;https://networkengineering.stackexchange.com/q/22247/8499&quot;&gt;this question&lt;/a&gt;, its comments, and its answers. There are also other question and answer on this site if you search.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-10-27T21:43:40.057" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36137" PostTypeId="2" ParentId="36114" CreationDate="2016-10-27T20:58:07.310" Score="0" Body="&lt;p&gt;You have a few problems:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VLAN 5 isn't needed.&lt;/li&gt;&#xA;&lt;li&gt;VLAN 10 should be handled with a loopback.&lt;/li&gt;&#xA;&lt;li&gt;VLAN 100 is referencing an ACL which doesn't exist.&lt;/li&gt;&#xA;&lt;li&gt;There is no default route for the VLANs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Try adding this configuration into your switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no interface vlan 5&#xA;!&#xA;no interface vlan 10&#xA;!&#xA;vlan database&#xA; no vlan 5&#xA; no vlan 10&#xA;exit&#xA;!&#xA;no ip dhcp pool network Pool_5&#xA;!&#xA;interface loopback 1&#xA; name MGMT &#xA; ip address 10.10.10.10 255.255.255.0 &#xA;!&#xA;interface vlan 100&#xA; no service-acl input VLAN_100-IN default-action permit-any &#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 20.20.20.1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-27T20:58:07.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36138" PostTypeId="1" CreationDate="2016-10-28T00:01:20.853" Score="1" ViewCount="410" Body="&lt;p&gt;I understand that switches learn from incoming traffic and thus builds its switching table. Does that also apply for routers? If so, how routing table can avoid increasing the routing table size since this is an automatic process? Maybe cache algorithm!! I don't know .. Kindly, can an expert enlighten us about that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you. &lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2021-01-10T13:32:42.933" Title="How to Control Routing Table from exceeding its size theoretically or practically" Tags="|cisco|routing|switch|router|switching|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36139" PostTypeId="2" ParentId="36138" CreationDate="2016-10-28T00:25:21.860" Score="2" Body="&lt;p&gt;This depends on the router model and software. Some routers will just stop adding to the routing table, some will throw an exception and log the problem, and some just crash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RAM is so cheap that modern routers are really only challenged by the full Internet routing table, which is huge. If you are designing a network, and you know that you will be requesting the full Internet routing table (fairly rare), you specify a router with the CPU and RAM to handle it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-28T00:25:21.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36141" PostTypeId="2" ParentId="35243" CreationDate="2016-10-28T00:46:42.443" Score="1" Body="&lt;p&gt;You can automate those tasks with &lt;a href=&quot;https://supportforums.cisco.com/document/117596/cisco-eem-basic-overview-and-sample-configurations&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's EEM&lt;/a&gt; using &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/2923/traffic-generation-from-cisco-ios-device-to-prove-wan-circuit&quot;&gt;ttcp&lt;/a&gt; and have the results emailed to you - hourly, daily, weekly, whatever.  This might be easiest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/assets/global/DK/seminarer/pdfs/cisco_virtual_update_fog_computing_iox_update.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;You can also spin up a linux VM on many newer Cisco boxes.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you'd rather do it from a remote machine, Python could certainly be used or even Microsoft &lt;code&gt;sendkeys&lt;/code&gt; class.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://stackoverflow.com/questions/3586106/perform-commands-over-ssh-with-python&quot;&gt;Python examples here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://technet.microsoft.com/en-us/library/ee156592.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sendkeys example here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2016-10-28T01:02:00.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36144" PostTypeId="2" ParentId="36090" CreationDate="2016-10-28T01:09:21.303" Score="0" Body="&lt;p&gt;Do the inter-VLAN routing on the switch because the performance is much better vs a router on a stick topology (where the inter-VLAN routing is done on the router via Ethernet subinterfaces on a trunk).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-10-28T01:09:21.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36145" PostTypeId="2" ParentId="36138" CreationDate="2016-10-28T01:10:45.077" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I understand that switches learn from incoming traffic and thus builds its switching table. Does that also apply for routers?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, routers only learn routes when they are &lt;strong&gt;advertised&lt;/strong&gt; to them by other routers, by different routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If so, how routing table can avoid increasing the routing table size since this is an automatic process?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Now though this is a semi-automatic process i.e. Once you have started running a protocol you are accepting all the routes being advertised by the peer router. So you can have certain methods by which you can limit number of routes and they mostly rotate around route-map:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;apply route-map(is a filter which you can apply between you and your peer) to accept only limited number of prefixes.&lt;/li&gt;&#xA;&lt;li&gt;apply route-map to accept only shorter prefixes and reject longer prefixes i.e. If you give /22 to your customer and you apply a route-map to accept no longer than /23 routes. You will have a maximum of 3 prefixes coming from that customer. A /22 and two /23.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now as Ron said if you are planning to get internet routing table you need good CPU and RAM(greater than 4GB) because the routes are ever increasing on the internet and no you cannot apply caching mechanism because you are not asking for routes or routes are not constantly getting advertised by your peers( that you can monitor them and cache them) they are sent in updates(which maybe far and few and in large time intervals) by peers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="31465" LastEditorUserId="31465" LastEditDate="2016-10-28T10:32:42.770" LastActivityDate="2016-10-28T10:32:42.770" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36152" PostTypeId="1" AcceptedAnswerId="36157" CreationDate="2016-10-28T09:29:37.383" Score="1" ViewCount="331" Body="&lt;p&gt;Heyho,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got a problem after ASA Update to 9.1 with the authentication on the ASA web portal with RSA Token.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before the we were on ASA 8.4 and everything was fine. A new token was assigned to a co-worker. Then on first logon her had only to insert username (AD) and the passcode from his token. He then was prompted to enter a new PIN and to verify this PIN. After that he had to enter the PIN + next token code to finish authentication. Everything was fine and he was ready to use the clientless VPN via the ASA web portal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the update to 9.1 (important due to serious security issues) when I want to make the initial authentication for a new co-worker, he enters the username + passcode, then gets prompted for the new PIN, &lt;strong&gt;BUT&lt;/strong&gt; Top of the login window is written: &quot;Enter a new PIN between 4 and 8 alphanumeric characters:&quot; and below there are not the two lines for the new PIN, but again the prompt for username + passcode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I'm not able to do the inital authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did a lot of research the last two days, but did not find anything which describs my problem. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also in addition I am fairly new to the asa web portal thing. A former co-worker configured it years ago and I only had to do the token assignment and everything was fine until the update to 9.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Had maybe someone encountered such a problem and could give me a hint?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need some information, just tell me what and I'll try to provide them.&lt;/p&gt;&#xA;" OwnerUserId="30068" LastActivityDate="2016-10-28T12:21:36.583" Title="Cisco ASA web portal clientless VPN login issues via RSA token authentication" Tags="|cisco|cisco-asa|sslvpn|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36153" PostTypeId="2" ParentId="36114" CreationDate="2016-10-28T09:34:42.647" Score="1" Body="&lt;p&gt;It doesn't work because of a limitation of the SG300. &lt;br&gt;&#xA;The SG300 doesn't have routed ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set up a clean SG300 config but it was not possible to reach the ISP Gateway: &lt;br&gt;&#xA;Config of SG300:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config-file-header&#xA;switche5bce7&#xA;v1.4.5.02 / R800_NIK_1_4_194_194&#xA;CLI v1.0&#xA;set system mode router &#xA;&#xA;file SSD indicator encrypted&#xA;@&#xA;ssd-control-start &#xA;ssd config &#xA;ssd file passphrase control unrestricted &#xA;no ssd file integrity control &#xA;ssd-control-end cb0a3fdb1f3a1af4e4430033719968c0 &#xA;!&#xA;vlan database&#xA;vlan 100,200 &#xA;exit&#xA;voice vlan oui-table add 0001e3 Siemens_AG_phone________&#xA;voice vlan oui-table add 00036b Cisco_phone_____________&#xA;voice vlan oui-table add 00096e Avaya___________________&#xA;voice vlan oui-table add 000fe2 H3C_Aolynk______________&#xA;voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone&#xA;voice vlan oui-table add 00d01e Pingtel_phone___________&#xA;voice vlan oui-table add 00e075 Polycom/Veritel_phone___&#xA;voice vlan oui-table add 00e0bb 3Com_phone______________&#xA;bonjour interface range vlan 1&#xA;hostname switche5bce7&#xA;no passwords complexity enable &#xA;username cisco password encrypted d033e22ae348aeb5660fc2140aec35850c4da997 privilege 15 &#xA;!&#xA;interface vlan 100&#xA; name &quot;VLAN100&quot; &#xA; ip address 20.20.20.33 255.255.255.224 &#xA;!&#xA;interface vlan 200&#xA; name &quot;VLAN200&quot; &#xA; ip address 20.20.20.129 255.255.255.224 &#xA;!&#xA;interface gigabitethernet1&#xA; ip address 20.20.20.2 255.255.255.252 &#xA;!&#xA;interface gigabitethernet10&#xA; switchport mode access &#xA; switchport access vlan 100 &#xA;!&#xA;interface gigabitethernet20&#xA; switchport mode access &#xA; switchport access vlan 200 &#xA;!&#xA;exit&#xA;ip default-gateway 20.20.20.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Afterwards I set up a Catalyst 3750 Switch with the same VLANs and config and I was able to issue &lt;code&gt;no switchport&lt;/code&gt; on &lt;code&gt;Interface Gigabit1/0/1&lt;/code&gt;. &lt;br&gt;&#xA;&lt;br&gt;&#xA;Now I can reach the ISP Gateway how it should be. &lt;br&gt;&#xA;Config of 3750: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 3535 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;switch 1 provision ws-c3750x-24p&#xA;system mtu routing 1500&#xA;ip routing&#xA;!&#xA;!&#xA;!         &#xA;!&#xA;crypto pki trustpoint TP-self-signed-2617031040&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-2617031040&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-2617031040&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;!&#xA;!&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA; no ip route-cache cef&#xA; no ip route-cache&#xA; no ip mroute-cache&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; no switchport&#xA; ip address 20.20.20.2 255.255.255.252&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA;!&#xA;interface GigabitEthernet1/0/5&#xA;!&#xA;interface GigabitEthernet1/0/6&#xA;!&#xA;interface GigabitEthernet1/0/7&#xA;!&#xA;interface GigabitEthernet1/0/8&#xA;!&#xA;interface GigabitEthernet1/0/9&#xA;!&#xA;interface GigabitEthernet1/0/10&#xA; switchport access vlan 100&#xA; switchport mode access&#xA;!         &#xA;interface GigabitEthernet1/0/11&#xA;!&#xA;interface GigabitEthernet1/0/12&#xA;!&#xA;interface GigabitEthernet1/0/13&#xA;!&#xA;interface GigabitEthernet1/0/14&#xA;!&#xA;interface GigabitEthernet1/0/15&#xA;!&#xA;interface GigabitEthernet1/0/16&#xA;!&#xA;interface GigabitEthernet1/0/17&#xA;!&#xA;interface GigabitEthernet1/0/18&#xA;!&#xA;interface GigabitEthernet1/0/19&#xA;!&#xA;interface GigabitEthernet1/0/20&#xA;!&#xA;interface GigabitEthernet1/0/21&#xA;!&#xA;interface GigabitEthernet1/0/22&#xA;!&#xA;interface GigabitEthernet1/0/23&#xA;!&#xA;interface GigabitEthernet1/0/24&#xA;!&#xA;interface GigabitEthernet1/1/1&#xA;!&#xA;interface GigabitEthernet1/1/2&#xA;!&#xA;interface GigabitEthernet1/1/3&#xA;!&#xA;interface GigabitEthernet1/1/4&#xA;!&#xA;interface TenGigabitEthernet1/1/1&#xA;!&#xA;interface TenGigabitEthernet1/1/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan100&#xA; ip address 20.20.20.33 255.255.255.224&#xA;!         &#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 20.20.20.1&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;ip sla enable reaction-alerts&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31608" LastActivityDate="2016-10-28T09:34:42.647" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="36154" PostTypeId="1" AcceptedAnswerId="36155" CreationDate="2016-10-28T10:52:18.277" Score="1" ViewCount="265" Body="&lt;p&gt;R1 and R2 are the same network.&#xA;But when you send a check to the ICMP Ping output &quot;Time exceeded&quot; error and, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interface Serial0/0/0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;command produces the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Serial0/0/0 is up, line protocol is up (looped)&#xA;Hardware is GT96K Serial&#xA;Internet address is 210.220.61.2/30&#xA;  MTU 1500 bytes, BW 1544 Kbit/sec, DLY 20000 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation HDLC, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Last input 00:00:07, output 00:00:07, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters 01:11:55&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     675 packets input, 48741 bytes, 0 no buffer&#xA;     Received 335 broadcasts (0 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;     675 packets output, 48741 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 2 interface resets&#xA;     3 unknown protocol drops&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;     0 carrier transitions&#xA;     DCD=up  DSR=up  DTR=up  RTS=up  CTS=up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I solve this phenomenon?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;----additional----&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh diag&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;command produces the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; WIC Slot 0:&#xA;        Serial 2T (12in1)&#xA;        Hardware revision 1.0           Board revision B0&#xA;        Serial number     36966334      Part number    800-03181-03&#xA;        Version Identifier     V01      FRU Part Number     WIC-2T&#xA;        Test history      0x0           RMA number     00-00-00&#xA;        Connector type    PCI&#xA;        EEPROM format version 1&#xA;        EEPROM contents (hex):&#xA;          0x20: 01 12 01 00 02 34 0F BE 50 0C 6D 03 00 00 00 00&#xA;          0x30: 58 00 00 00 09 09 06 00 FF FF FF FF FF FF FF FF&#xA;&#xA;&amp;gt;(config)# card ?&#xA;% Unrecognized command&#xA;(config)# controller ?&#xA;% Unrecognized command&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;sh run&lt;/code&gt; command produces the following output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building configuration...&#xA;Current configuration : 1095 bytes&#xA;! No configuration change since last restart&#xA;version 15.1&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname ISP-R&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;no aaa new-model&#xA;!&#xA;dot11 syslog&#xA;ip source-route&#xA;!&#xA;no ip cef&#xA;!&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;voice-card 0&#xA;!&#xA;crypto pki token default removal timeout 0&#xA;!&#xA;license udi pid CISCO2811 sn FHK1109F3K3&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 210.220.61.10 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 195.35.37.254 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 210.220.61.2 255.255.255.252&#xA; no fair-queue&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 210.220.61.6 255.255.255.252&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server &#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;mgcp profile default&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; speed 115200&#xA;line aux 0&#xA;line vty 0 4&#xA; login&#xA; transport input all&#xA;!&#xA;scheduler allocate 20000 1000&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31384" LastEditorUserId="8499" LastEditDate="2016-10-29T17:02:50.700" LastActivityDate="2016-10-29T17:02:50.700" Title="Time exceeded ICMP in Serial Interface [Cisco Router 2811]" Tags="|cisco|troubleshooting|ping|cisco-commands|icmp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36155" PostTypeId="2" ParentId="36154" CreationDate="2016-10-28T11:29:54.763" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Serial0/0/0 is up, line protocol is up (looped)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You interface is looped and hence when you ping the IP 210.220.61.1 on the other end you are stuck in the loop and hence TTL(hop count) gets expired, therefore the messge&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Time exceeded ICMP in Serial Interface&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="31465" LastActivityDate="2016-10-28T11:29:54.763" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="36156" PostTypeId="2" ParentId="36154" CreationDate="2016-10-28T11:41:43.887" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Serial x is up, line protocol is up (looped)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A loop exists in the circuit. The sequence number in the keepalive&#xA;  packet changes to a random number when a loop is initially detected.&#xA;  If the same random number is returned over the link, a loop exists.&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;&lt;p&gt;Use the show running-config privileged exec command to look for any loopback interface configuration command entries.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;If you find a loopback interface configuration command entry, use the no loopback interface configuration command to remove the loop.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;If you do not find the loopback interface configuration command, examine the CSU/DSU to determine whether they are configured in manual&#xA;  loopback mode. If they are, disable manual loopback.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Reset the CSU or DSU, and inspect the line status. If the line protocol comes up, no other action is needed.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;If the CSU or DSU is not configured in manual loopback mode, contact the leased-line or other carrier service for line&#xA;  troubleshooting assistance.&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is an excerpt from the following Cisco document:  &lt;a href=&quot;http://www.cisco.com/en/US/docs/internetworking/troubleshooting/guide/tr1915.html&quot; rel=&quot;nofollow&quot;&gt;http://www.cisco.com/en/US/docs/internetworking/troubleshooting/guide/tr1915.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-10-28T11:41:43.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36157" PostTypeId="2" ParentId="36152" CreationDate="2016-10-28T12:17:07.040" Score="2" Body="&lt;p&gt;You are hitting the following bug:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://bst.cloudapps.cisco.com/bugsearch/bug/CSCva87160&quot; rel=&quot;nofollow&quot;&gt;CSCva87160    OTP authentication is not working for clientless ssl vpn&lt;/a&gt; &#xA;(Cisco login required)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to stay on 9.1, you can go to 9.1(7.11), otherwise you have a choice of fixed releases:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;9.1(7.11)&#xA;9.2(4.17)&#xA;9.4(3.12)&#xA;9.5(3.2)&#xA;9.6(2.1)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But note that since this is a relatively recent bugfix, not all of the above versions are available yet at this time.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastEditorUserId="29562" LastEditDate="2016-10-28T12:21:36.583" LastActivityDate="2016-10-28T12:21:36.583" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36158" PostTypeId="1" AcceptedAnswerId="36159" CreationDate="2016-10-28T13:43:46.523" Score="2" ViewCount="3926" Body="&lt;p&gt;We have an &lt;code&gt;ASR1000&lt;/code&gt;, and I have the following ACL, but yesterday someone hit us with big DDoS attack, and I found it was a &lt;code&gt;DNS amplification&lt;/code&gt; attack. so all source port for &lt;code&gt;53&lt;/code&gt;, and it was definitely a fragmentation attack. See the following NetFlow data. I saw the router blocked some of the data, but some data sneaked in. In short it hit the internal servers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: Why didn't the ACL stop this attack? How does the ACL handle fragmented packets here? The first packet contains port info, but the following fragmentaed packtes are &lt;code&gt;L3&lt;/code&gt;, so how does a firewall handle them. We have &lt;code&gt;deny any any&lt;/code&gt; in end, too.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Netflow&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Top 10 Src Port ordered by bps:&#xA;Date first seen          Duration Proto          Src Port    Flows(%)     Packets(%)       Bytes(%)         pps      bps   bpp&#xA;2016-10-26 10:06:42.898  1207.930 any                   0    64619(49.0)   68.6 M(49.8)   86.7 G(57.2)    56826  574.5 M  1263&#xA;2016-10-26 10:06:42.754  1420.227 any                  53    46718(35.4)   47.1 M(34.2)   61.8 G(40.7)    33153  348.2 M  1313&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ACL&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended FOO-ACL&#xA; permit udp any gt 1023 object-group VOIP-NET range 12000 13000&#xA; permit udp any gt 1023 object-group SIP-NET eq 5060 &#xA; permit udp object-group GOOGLE-DNS any&#xA; permit tcp host any eq bgp host X.X.X.X&#xA; permit icmp any object-group ICMP-NET echo-reply&#xA; permit icmp any object-group ICMP-NET net-unreachable&#xA; permit icmp any object-group ICMP-NET host-unreachable&#xA; permit icmp any object-group ICMP-NET port-unreachable&#xA; permit icmp any object-group ICMP-NET ttl-exceeded&#xA; deny   ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2018-12-20T03:50:45.003" LastActivityDate="2018-12-20T03:50:45.003" Title="How does a Cisco ACL handle fragments" Tags="|cisco|security|cisco-commands|acl|fragmentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36159" PostTypeId="2" ParentId="36158" CreationDate="2016-10-28T14:18:49.527" Score="5" Body="&lt;p&gt;You are not denying &lt;code&gt;fragments&lt;/code&gt;. Cisco has an &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/8014-acl-wp.html&quot;&gt;Access Control Lists and IP Fragments&lt;/a&gt; document that specifically deals with this problem.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;ACLs and Fragmented Packets&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;ACLs have a &lt;strong&gt;fragments&lt;/strong&gt; keyword that enables specialized fragmented&#xA;  packet-handling behavior. In general, noninitial fragments that match&#xA;  the Layer 3 statements (protocol, source address, and destination&#xA;  address)—irrespective of the Layer 4 information in an ACL—are&#xA;  affected by the &lt;strong&gt;permit&lt;/strong&gt; or &lt;strong&gt;deny&lt;/strong&gt; statement of the matched entry.&#xA;  Note that the use of the &lt;strong&gt;fragments&lt;/strong&gt; keyword can force ACLs to&#xA;  either deny or permit noninitial fragments with more granularity.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Filtering fragments adds an additional layer of protection against a&#xA;  denial-of-service (DoS) attack that uses only noninitial fragments&#xA;  (such as FO &gt; 0). The use of a &lt;strong&gt;deny&lt;/strong&gt; statement for noninitial&#xA;  fragments at the beginning of the ACL denies all noninitial fragments&#xA;  from accessing the router. Under rare circumstances, a valid session&#xA;  might require fragmentation and therefore be filtered if a &lt;strong&gt;deny&#xA;  fragment&lt;/strong&gt; statement exists in the ACL. Conditions that might lead to&#xA;  fragmentation include the use of digital certificates for ISAKMP&#xA;  authentication and the use of IPSec NAT Traversal.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For example, consider the partial ACL shown here.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 110 deny tcp any Internet routable subnet fragments&#xA;access-list 110 deny udp any Internet routable subnet fragments&#xA;access-list 110 deny icmp any Internet routable subnet fragments&#xA;&amp;lt;rest of ACL&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Adding these entries to the beginning of an ACL denies any noninitial&#xA;  fragment access to the network, while nonfragmented packets or initial&#xA;  fragments pass to the next lines of the ACL unaffected by the &lt;strong&gt;deny&#xA;  fragment&lt;/strong&gt; statements. The previous ACL snippet also facilitates&#xA;  classification of the attack since each protocol—UDP, TCP, and&#xA;  ICMP—increments separate counters in the ACL.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Since many attacks rely on flooding with fragmented packets, filtering&#xA;  incoming fragments to the internal network provides an added measure&#xA;  of protection and helps ensure that an attack cannot inject fragments&#xA;  by simply matching layer 3 rules in the transit ACL.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Refer to &lt;a href=&quot;http://www.cisco.com/en/US/tech/tk827/tk369/technologies_white_paper09186a00800949b8.shtml&quot;&gt;Access Control Lists and IP Fragments&lt;/a&gt; for a detailed&#xA;  discussion of the options.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-28T14:18:49.527" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="36160" PostTypeId="1" AcceptedAnswerId="36161" CreationDate="2016-10-28T14:44:03.617" Score="1" ViewCount="2432" Body="&lt;p&gt;Here is my topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dQQQ1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dQQQ1.png&quot; alt=&quot;topology picture&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to get a DHCP IP address for a Windows XP client, but when I do the &lt;code&gt;ipconfig /renew&lt;/code&gt; command, it said, &lt;code&gt;can not use the rpc server and failed to get an ip address from dhcp server&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please check my topology and configurations: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;R&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Router#sh run&#xA;    Building configuration...&#xA;&#xA;    Current configuration : 1091 bytes&#xA;    !&#xA;    ! Last configuration change at 14:17:26 UTC Fri Oct 28 2016&#xA;    !&#xA;    version 15.4&#xA;    service timestamps debug datetime msec&#xA;    service timestamps log datetime msec&#xA;    no service password-encryption&#xA;    !&#xA;    hostname Router&#xA;    !&#xA;    boot-start-marker&#xA;    boot-end-marker&#xA;    !&#xA;    aqm-register-fnf&#xA;    !&#xA;    !&#xA;    no aaa new-model&#xA;    mmi polling-interval 60&#xA;    no mmi auto-configure&#xA;    no mmi pvc&#xA;    mmi snmp-timeout 180&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;&#xA;&#xA;    !&#xA;    ip dhcp excluded-address 1.1.1.254&#xA;    ip dhcp excluded-address 1.1.1.1 1.1.1.10&#xA;    !&#xA;    ip dhcp pool A&#xA;    network 1.1.1.0 255.255.255.0&#xA;    default-router 1.1.1.254&#xA;    dns-server 168.126.63.1&#xA;    lease 0 8&#xA;    !&#xA;    !&#xA;    !&#xA;    ip cef&#xA;    no ipv6 cef&#xA;    !&#xA;    multilink bundle-name authenticated&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;    redundancy&#xA;&#xA;    !&#xA;    interface Ethernet0/0&#xA;    ip address 1.1.2.2 255.255.255.0&#xA;    !&#xA;    interface Ethernet0/1&#xA;     no ip address&#xA;    shutdown&#xA;    !&#xA;    interface Ethernet0/2&#xA;    no ip address&#xA;    shutdown&#xA;    !&#xA;    interface Ethernet0/3&#xA;    no ip address&#xA;    shutdown&#xA;    !&#xA;    ip forward-protocol nd&#xA;    !&#xA;    !&#xA;    no ip http server&#xA;    no ip http secure-server&#xA;&#xA;    control-plane&#xA;&#xA;    line con 0&#xA;    logging synchronous&#xA;    line aux 0&#xA;    line vty 0 4&#xA;     login&#xA;    transport input none&#xA;    !&#xA;    !&#xA;    end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Router#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 2327 bytes&#xA;!&#xA;! Last configuration change at 12:59:47 UTC Fri Oct 28 2016&#xA;!&#xA;version 15.4&#xA;service config&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;aqm-register-fnf&#xA;!&#xA;!&#xA;no aaa new-model&#xA;mmi polling-interval 60&#xA;no mmi auto-configure&#xA;no mmi pvc&#xA;mmi snmp-timeout 180&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;&#xA;&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Ethernet0/0&#xA; ip address 1.1.1.254 255.255.255.0&#xA; ip helper-address 1.1.2.2&#xA;!&#xA;interface Ethernet0/1&#xA; ip address 1.1.2.1 255.255.255.0&#xA;!&#xA;interface Ethernet0/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet0/3&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet1/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet1/1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet1/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet1/3&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet2/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet2/1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet2/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet2/3&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet3/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet3/1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet3/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet3/3&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet4/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet4/1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet4/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet4/3&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet5/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet5/1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet5/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet5/3&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet6/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet6/1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet6/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet6/3&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet7/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet7/1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet7/2&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Ethernet7/3&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; logging synchronous&#xA;line aux 0&#xA;line vty 0 4&#xA; login&#xA; transport input none&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Another question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I put the DHCP server's &lt;code&gt;default-router&lt;/code&gt; address as &lt;code&gt;1.1.1.254&lt;/code&gt;, but when do we need this default router address and &lt;code&gt;dns-server&lt;/code&gt; address?&lt;/p&gt;&#xA;" OwnerUserId="31661" LastEditorUserId="8499" LastEditDate="2018-12-25T02:56:57.847" LastActivityDate="2018-12-25T02:56:57.847" Title="Two router DHCP server setup" Tags="|cisco|routing|dhcp|packet-tracer|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36161" PostTypeId="2" ParentId="36160" CreationDate="2016-10-28T15:17:38.840" Score="1" Body="&lt;p&gt;From what I can see in your configuration of R, it doesn't have a route to the &lt;code&gt;1.1.1.0/24&lt;/code&gt; network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really shouldn't use the &lt;code&gt;default-router&lt;/code&gt; command, but if you do, it needs to be a network that R knows about. That would be the directly attached network, and the &lt;code&gt;default-router&lt;/code&gt; should be &lt;code&gt;1.1.2.1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better option would be to either use a static route to the &lt;code&gt;1.1.1.0/24&lt;/code&gt; network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 1.1.1.0 255.255.255.0 1.1.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or put in a default route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 1.1.2.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or run a routing protocol between the two routers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-28T15:17:38.840" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="36163" PostTypeId="2" ParentId="2533" CreationDate="2016-10-28T19:42:06.793" Score="0" Body="&lt;p&gt;On Nexus devices you can issue&#xA;show access-list summary &#xA;or &#xA;show ip access-list summary&lt;/p&gt;&#xA;" OwnerUserId="31666" LastActivityDate="2016-10-28T19:42:06.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36170" PostTypeId="1" CreationDate="2016-10-29T20:29:05.310" Score="1" ViewCount="3142" Body="&lt;p&gt;So long story short. We setup our network YEARS ago, when we were a small company of only 10 people. Now, we are pushing 100 employees, and my network has outgrown itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Originally, I setup the IP Range: &lt;code&gt;192.168.16.x/24&lt;/code&gt;, Mask &lt;code&gt;255.255.255.0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is, I don't want to change the subnet, as changing our security infrastructure to a new subnet is a nightmare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: can I add &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.10.x/24 Subnet 255.255.255.0&lt;/li&gt;&#xA;&lt;li&gt;192.168.20.x/24 Subnet 255.255.255.0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;to my IP range if I have layer-3 HP switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 4 switches: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;HPE 1920-24G Switch&lt;/li&gt;&#xA;&lt;li&gt;HP 1920-48G&lt;/li&gt;&#xA;&lt;li&gt;HP V1910-48G&lt;/li&gt;&#xA;&lt;li&gt;HP V1910-48G&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If I make a switch my gateway (&lt;code&gt;192.168.16.106&lt;/code&gt;), and set a static route on my firewall to send all &lt;code&gt;192.168.10.0/24&lt;/code&gt; to that switch, then wouldn't the layer-3 switch just route the traffic for me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know this is not a fix, but I'm not going to have the time or resources to fix this problem until late next year, and I need a band-aid for now.&lt;/p&gt;&#xA;" OwnerUserId="31675" LastEditorUserId="8499" LastEditDate="2019-01-12T20:26:57.350" LastActivityDate="2019-01-12T20:26:57.350" Title="Help setting up multiple IP ranges on same subnet" Tags="|ip|ipv4|subnet|layer3|hp-procurve|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36171" PostTypeId="2" ParentId="36170" CreationDate="2016-10-29T22:18:55.133" Score="3" Body="&lt;p&gt;There are a couple of things you could do:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Change the network mask to expand the address range. For example,&#xA;change the mask length to &lt;code&gt;/23&lt;/code&gt; to double , or &lt;code&gt;/22&lt;/code&gt; to quadruple,&#xA;the number of network addresses. This is really less than ideal.&lt;/li&gt;&#xA;&lt;li&gt;Add VLANs. Each VLAN could have a separate network. If all your switches are layer-3 switches, you should be using those for LAN routing. You have not detailed your topology, but there are a few ways you could do this.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;No matter what, you are going to need to change your security to take into account the new address range. The firewall is going to need to know all the new addressing so that it will not discard traffic to or from networks that it doesn't know. If it is performing NAT, it will need to know to NAT those source addresses, too.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If I make a switch my gateway (&lt;code&gt;192.168.16.106&lt;/code&gt;), and set a static&#xA;  route on my firewall to send all &lt;code&gt;192.168.10.0/24&lt;/code&gt; to that switch,&#xA;  then wouldn't the layer-3 switch just route the traffic for me?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your proposed gateway (&lt;code&gt;192.168.16.106&lt;/code&gt;) is not on the same network (&lt;code&gt;192.168.10.0/24&lt;/code&gt;) as the hosts which will use it. Your host gateway needs to be set in the same network as the host is. The host gateway is used to send traffic destined to a different network because the host doesn't know how to get to the different network. How do you send traffic destined for a different network to a gateway on a different network if you don't know how to get to the different network in the first place?&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-10-30T02:33:20.823" LastActivityDate="2016-10-30T02:33:20.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36172" PostTypeId="1" AcceptedAnswerId="36977" CreationDate="2016-10-29T23:26:30.163" Score="4" ViewCount="2573" Body="&lt;p&gt;I have a weird problem: I have a layer 2 network that does not pass STP BPDUs and cannot be configured to do so. I would like to establish multiple redundant connections to this network from my all-Cisco network, but if I do, I create a network loop. What would you recommend as an alternative to RSTP for Cisco switches that can shut down ports to block loops, but bring those ports up automatically if the primary goes down? Thanks! &lt;/p&gt;&#xA;" OwnerUserId="17050" LastActivityDate="2016-12-02T19:04:13.990" Title="Block L2 Loops without STP?" Tags="|cisco|spanning-tree|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36173" PostTypeId="2" ParentId="36172" CreationDate="2016-10-29T23:33:48.127" Score="0" Body="&lt;p&gt;That is what spanning tree does. There are various flavors of STP, and there are some alternatives, e.g. TRILL, but most are proprietary. It is probable that your layer-2 network that does not support spanning tree will not support one of the alternatives, either.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-29T23:33:48.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36174" PostTypeId="2" ParentId="36172" CreationDate="2016-10-30T00:00:37.463" Score="0" Body="&lt;p&gt;If it supports LAG you can combine the redundant links into port-channels that are viewed as a single link.  However, both of those links would have to connect to the same Cisco switch unless you are running VSS or Nexus vPC.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-10-30T00:00:37.463" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36178" PostTypeId="2" ParentId="36090" CreationDate="2016-10-30T07:55:53.993" Score="1" Body="&lt;p&gt;I've seen it previously in an environment which worked fairly well, multiple SG300 switches, routing done at the L3 switch layer of the SG300 and then a Cisco ASA 55xx firewall on the edge of the network facing the redundant ISP connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are not the fastest or most efficient thing out there however some of the functionality that a router would perform can be pushed up to the ASA, the SG300 does have the limitation of not being able to run dynamic routing protocols if I'm not mistaken. Static routing or RIP are the only options in that scenario, can it be done yes...depending on the environment and amount of users. The question comes to mind whenever I hear something like this.... can it be done? Yes, however should it be done? &lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-10-30T07:55:53.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36188" PostTypeId="2" ParentId="34454" CreationDate="2016-10-31T00:58:59.753" Score="4" Body="&lt;p&gt;Out of the box, the EX3300 has the last two SFP ports in Virtual-Chassis mode (ge-0/1/2 and ge-0/1/3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;request virtual-chassis vc-port delete pic-slot 1 port 2&#xA;request virtual-chassis vc-port delete pic-slot 1 port 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to turn them back to standard Ethernet interfaces.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-10-31T00:58:59.753" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36190" PostTypeId="1" AcceptedAnswerId="36218" CreationDate="2016-10-31T07:30:22.513" Score="0" ViewCount="170" Body="&lt;p&gt;Is the the &lt;strong&gt;Unknown Unicast Flooding Attack&lt;/strong&gt; still exists in &lt;strong&gt;Software Defined Networking&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, how it was eliminated ? &lt;/p&gt;&#xA;" OwnerUserId="3672" LastActivityDate="2016-11-01T02:04:15.073" Title="Unknown Unicast Flooding Attack in Software Defined Networking" Tags="|sdn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36193" PostTypeId="1" AcceptedAnswerId="36195" CreationDate="2016-10-31T12:59:46.690" Score="2" ViewCount="3048" Body="&lt;p&gt;&lt;em&gt;Firstly sorry if this question has already been asked.&lt;/em&gt;&lt;br&gt;&#xA;While playing with traceroute, I came across something really strange...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;traceroute to 185.75.143.25 gives:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA; - 10.214.255.254&#xA; - 10.255.255.254&#xA; - 194.199.227.254&#xA; - &lt;strong&gt;10.230.12.197&lt;/strong&gt;&#xA; - 193.51.182.190&#xA; - 193.51.177.18&#xA; - 193.51.177.16&#xA; - 193.51.177.217&#xA; - 193.51.177.144&#xA; - 195.42.144.43&#xA; - 185.39.168.1&#xA; - 185.39.168.70&#xA; - 185.39.168.21&#xA; - 185.39.168.17&#xA; - 185.75.143.25&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first two private addresses are the routers of my university.&#xA;But what about the fourth adress : &lt;strong&gt;10.230.12.197&lt;/strong&gt;&lt;br&gt;&#xA;I thought that private adresses can't be routed, so what is this adress doing here?&lt;/p&gt;&#xA;" OwnerUserId="31705" LastEditorUserId="31705" LastEditDate="2016-10-31T14:46:43.907" LastActivityDate="2021-01-11T07:47:27.047" Title="Private IP inside internet?" Tags="|routing|ipv4|internet|traceroute|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36194" PostTypeId="2" ParentId="36193" CreationDate="2016-10-31T13:29:46.323" Score="1" Body="&lt;p&gt;Private (RFC 1918) IP address can be routed, but not over the public Internet.  Similarly, public addresses can exist on &quot;private&quot; networks.  And that is the case here:  You don't hit the Internet until the 11th hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:  As @SanderSteffan points out, there can be links with private addresses on links within public networks.  When the TTL expires, the device with a private address sends a ttl-expired message with the private source address.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-10-31T23:10:57.293" LastActivityDate="2016-10-31T23:10:57.293" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36195" PostTypeId="2" ParentId="36193" CreationDate="2016-10-31T13:35:57.487" Score="8" Body="&lt;p&gt;Traceroute deliberately sends packets with low time-to-live values to make the routers between you and your destination send back ICMP TTL exceeded messages. The traceroute output is basically the list of source IP addresses sending these TTL exceeded messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the output tells you the 4th router has sent you a message from a private IP address. This is not a problem, your packets can be routed over links using private IP addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers typically forward packets sent by others, but in this case, the router itself generates a packet to send back to you. The router has to decide which source address to send the packet from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are no rules on which source address to select. A common default is to use the IP address of the router's outgoing interface on which the packet will be sent. In this example, that tells us that the link between the third and fourth router uses private addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet with source address 10.230.12.197 is routed to your computer. It is not possible for you to reply to this device using that address, but it is also not necessary for you to be able to send traffic to this router directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The administrator of the router with 10.230.12.197 could/should configure it to use an internet-routable address as the source. This would make the traceroute output cleaner and more meaningful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that in this case it might be possible for you to reach this specific router directly if it is part of the internal network of your organisation.&#xA;If it is not inside your organisation, there should be a firewall preventing packets coming from the internet with private source addresses, but a private source address could work if no such filtering is being done.&lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2016-10-31T13:42:17.210" LastActivityDate="2016-10-31T13:42:17.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36196" PostTypeId="1" CreationDate="2016-10-31T13:51:32.817" Score="1" ViewCount="1028" Body="&lt;p&gt;I would like to know:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) What is the smallest routable subnet size in IPv6 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Can a /128 address be routed in a IPv6 network?&lt;/p&gt;&#xA;" OwnerUserId="31709" LastActivityDate="2016-11-01T01:20:38.957" Title="Subnet and routing on IPv6" Tags="|routing|subnet|ipv6|network-core|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36197" PostTypeId="2" ParentId="36196" CreationDate="2016-10-31T14:27:24.230" Score="4" Body="&lt;p&gt;Routing works the same in IPv6 as IPv4, so yes, a /128 address can be routed.&lt;br /&gt;&#xA;However, you should not create subnets with prefixes longer than /64**.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7421&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7421&lt;/a&gt; explains why.&lt;/p&gt;&#xA;&lt;p&gt;** The exception is point to point links using a /127, as described in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6164&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6164&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-10-31T14:27:24.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36198" PostTypeId="2" ParentId="36193" CreationDate="2016-10-31T15:26:48.063" Score="-1" Body="&lt;p&gt;The traceroute command give you all the hop(routers,nodes ect) that your packet travel from you to your destination.&lt;/p&gt;&#xA;" OwnerUserId="31687" LastActivityDate="2016-10-31T15:26:48.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36200" PostTypeId="1" AcceptedAnswerId="36220" CreationDate="2016-10-31T15:52:46.117" Score="4" ViewCount="5422" Body="&lt;p&gt;I had to determine UDP performance over multi-hop network , I used MAC Air over gigabit ethernet ( Thunderbolt). As is customary, TCP was tested and the gig over link was saturated ~900mbps, but surprise when I test UDP it got capped off at 650mbps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I connected two nodes (PC's ) directly without switch. Both the nodes indicated they were working at PHY rate 1000mbps&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Node A &amp;lt; -------- &gt; Node B &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Node A ( MAC Book) Node B ( MAC Air) --- UDP throughput was 650 mbps TCP 944&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Node A ( MAC Book) Node B ( Win 7) --- UDP throughput was 600 mbps TCP 900&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Please note I only consider UDP throughput with (0-1% PL), I adjusted the bandwidth from -b {1000,900,650}, I achieve the sweetness of 1% PL at 650. It did not make any sense, how can TCP usurp UDP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then from 2nd choice I use UDP with 4 streams the UDP throughput improved to 944mbps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question(s) are :- &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I understand in TCP the streams will improve tolerance to 2% PL and it will saturate the links with individual stream contributing to saturation. What does iperf UDP streams do? I read the --help but it is not clear. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In case of individual nodes what can I do on my Apple, such that it allocates more UDP buffer (if at all it is a buffer issue). The link is 1Gig , and forget the multihop, even when it has a direct link with the client ( where there is no link sharing , supposedly no reason for dropped packets, or huge latencies, should have been able to over subscribe the link) &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xti5k.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xti5k.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31710" LastEditorUserId="453" LastEditDate="2017-09-15T02:58:26.827" LastActivityDate="2018-04-30T16:26:42.063" Title="IPERF TCP vs UDP" Tags="|udp|mac|iperf|layer4|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="36201" PostTypeId="1" AcceptedAnswerId="36202" CreationDate="2016-10-31T17:50:06.993" Score="1" ViewCount="36" Body="&lt;p&gt;Are LJ6C suitable for cat6 cabling / is there a different version for cat6 cabling ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm aware that you cant easily use an RJ45 cat5e jack for cat6 cable as the cable for cat6 is thicker, is this the case also for LJ6C outlets ? &lt;/p&gt;&#xA;" OwnerUserId="19472" LastEditorUserId="8499" LastEditDate="2016-10-31T17:57:49.543" LastActivityDate="2016-10-31T17:57:49.543" Title="Are LJ6C outlets suitable for cat6 cabling or only cat5e / is there a different version for cat6 cabling?" Tags="|cabling|layer1|standardisation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36202" PostTypeId="2" ParentId="36201" CreationDate="2016-10-31T17:57:20.797" Score="1" Body="&lt;p&gt;For a cabling system to be certified at any category, you must use the same category for all the components in the system. Using Category-6 cabling with Category-5e parts is a waste of money since the cabling system can only be certified for Category-5e.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be able to find a manufacturer for these part in Category-6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, it is not an RJ-45 connector used in the cabling, it is an 8P8C connector.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-10-31T17:57:20.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36203" PostTypeId="2" ParentId="36138" CreationDate="2016-10-31T17:58:50.800" Score="1" Body="&lt;p&gt;I personally don't know if a way to do this, but with BGP hundreds of thousands of routes potentially get sent to routers with 2gb of RAM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tier 3 Routers would most likely get overloaded and crash, when sent over 1 million routes with potentially TB of data transferring through. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I therefore assume because there is no implementation in place to prevent overload crash that it applies to a switch as well.&lt;/p&gt;&#xA;" OwnerUserId="15099" LastActivityDate="2016-10-31T17:58:50.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36205" PostTypeId="1" CreationDate="2016-10-31T18:22:25.570" Score="3" ViewCount="1505" Body="&lt;p&gt;Question is not a duplicate of &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/24068/why-do-we-need-a-3-way-handshake-why-not-just-2-way&quot;&gt;this link&lt;/a&gt;. As that asks why we need a 3 way hand shake and I know why! my question is why cannot the ACK packet be accommodated by the following protocol packet(PSH ACK).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get why is there a need of an handshake, but do we need the ACK in the end from the initater? Lets take an example of an http query which was followed by a TCP handshake.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CLIENT:23434 SN 0 -----&amp;gt; SERVER:80 -- SYN&#xA;CLIENT:23434 &amp;lt;----- SERVER:80 SN 0, AN 1 -- SYN ACK&#xA;CLIENT:23434 SN 1 AN 1 -----&amp;gt; SERVER:80 -- ACK&#xA;CLIENT:23434 SN 1 AN 1 -----&amp;gt; SERVER:80 -- PSH ACK(HTTP GET)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now if there was to be a protocol(data) packet followed by the ACK of three way handshake with the same sequence number and acknowledgement number, Why have the ACK packet why not use the protocol packet only to synchronize?&lt;/p&gt;&#xA;" OwnerUserId="31465" LastEditorUserId="8499" LastEditDate="2017-07-16T03:46:05.587" LastActivityDate="2017-07-16T03:46:05.587" Title="Why is there a need of an ACK from initiater in a TCP connection?" Tags="|tcp|layer4|" AnswerCount="3" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="36209" PostTypeId="1" AcceptedAnswerId="36216" CreationDate="2016-10-31T19:30:55.743" Score="1" ViewCount="736" Body="&lt;p&gt;&lt;a href=&quot;http://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&quot; rel=&quot;nofollow&quot;&gt;IANA defines IP protocol number 114 as &quot;any 0-hop protocol&quot;&lt;/a&gt;. What is that?&lt;/p&gt;&#xA;" OwnerUserId="31716" LastActivityDate="2016-11-01T00:56:31.847" Title="What is IP protocol number 114 &quot;any 0-hop protocol&quot;?" Tags="|ip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36211" PostTypeId="2" ParentId="36205" CreationDate="2016-10-31T20:21:56.547" Score="4" Body="&lt;p&gt;Great question.  I agree that this is not a duplicate of the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal of the three-way handshake is to &lt;strong&gt;establish a bidirectional communication channel&lt;/strong&gt;. The communication that happens &lt;em&gt;within&lt;/em&gt; that channel is outside the scope of TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes, a connection is established for the Client to send something to the Server. Other times a connection is established for the Server to send something to the Client. TCP must account for both of these cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Re-quoting your communication illustration for simplicity and adding line numbers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#1   SN 0 -----&amp;gt; SERVER:80 -- SYN&#xA;#2   &amp;lt;----- SERVER:80 SN 0, AN 1 -- SYN ACK&#xA;#3   SN 1 AN 1 -----&amp;gt; SERVER:80 -- ACK&#xA;#4   SN 1 AN 1 -----&amp;gt; SERVER:80 -- PSH ACK(HTTP GET)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;If&lt;/em&gt;&lt;/strong&gt; the protocol using TCP behaves like HTTP, where the first data transmission after the connection establishes is the &lt;em&gt;Client sending data to the Server&lt;/em&gt;, then you're right to say the lone ACK (line #3) seems superfluous. The packet immediate following (line #4) would suffice tell the Server that the Client received their ISN (from line #2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;However&lt;/em&gt;&lt;/strong&gt; not all protocols behave like HTTP -- some protocols mean for the &lt;em&gt;Server to send the data&lt;/em&gt; immediately after the connection establishes. In those cases, the server &lt;em&gt;must&lt;/em&gt; wait for the client to send the empty acknowledgement packet before it comes to acquire positive confirmation that the bidirectional communication channel is successfully established and data transfer can begin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is more rare in the Internet, but it does exist. Offhand, I can think of Passive FTP, where the client initiates the data connection (aka, sends the initial SYN) but the purpose of the connection is for the server to send the initial data packet -- which starts as soon as the data connection is established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP can not behave one way for certain protocols and another way for other protocols. Hence, the empty acknowledgement must be sent so that both scenarios are accounted for.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2016-11-01T01:52:06.537" LastActivityDate="2016-11-01T01:52:06.537" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36212" PostTypeId="1" CreationDate="2016-10-31T20:38:28.107" Score="3" ViewCount="5333" Body="&lt;p&gt;A &lt;a href=&quot;http://www.ine.com/resources/ntp-authentication.htm&quot; rel=&quot;nofollow&quot;&gt;typical Authenticated NTP configuration&lt;/a&gt; looks like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NTP Server&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)# ntp master&#xA;R1(config)# ntp authentication-key 22 md5 SECRET-NTP-KEY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NTP Client:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)# ntp authenticate&#xA;R2(config)# ntp authentication-key 22 md5 SECRET-NTP-KEY&#xA;R2(config)# ntp trusted-key 22&#xA;R2(config)# ntp server 12.0.0.1 key 22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm confused about the individual purposes of each command in the Client configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does &lt;strong&gt;&lt;code&gt;ntp authenticate&lt;/code&gt;&lt;/strong&gt; do different from &lt;strong&gt;&lt;code&gt;ntp trusted-key 22&lt;/code&gt;&lt;/strong&gt;? In what cases would I have one command applied but not the other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand &lt;strong&gt;&lt;code&gt;ntp authenticate&lt;/code&gt;&lt;/strong&gt; turns on NTP authentication, and &lt;strong&gt;&lt;code&gt;ntp authentcation-key ## ...&lt;/code&gt;&lt;/strong&gt; configures a specific authentication key. Then &lt;strong&gt;&lt;code&gt;ntp server x.x.x.x key ##&lt;/code&gt;&lt;/strong&gt; associates a particular key to a particular NTP Server. But why would it be necessary to then add an additional command to indicate you trust a particular authentication key (&lt;strong&gt;&lt;code&gt;ntp trusted-key ...&lt;/code&gt;&lt;/strong&gt;)?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wouldn't simply having the key configured be sufficient to indicate that it is trusted?&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="3675" LastEditDate="2016-10-31T23:35:46.293" LastActivityDate="2019-08-08T02:02:40.320" Title="How do these NTP authentication commands differ from one another?" Tags="|cisco|cisco-ios|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36214" PostTypeId="2" ParentId="36212" CreationDate="2016-10-31T20:45:47.337" Score="3" Body="&lt;p&gt;With NTP, authentication is controlled by the requester. An NTP server cannot force authentication on NTP clients; it is happy to send out unauthenticated NTP to clients. A client must request NTP authentication, and it will reject unauthenticated NTP if it has requested authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ntp master&lt;/code&gt; command tells a device to be the master clock when an NTP source is not available. This is an oft misunderstood command that is rarely necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ntp authentication-key&lt;/code&gt; command merely sets up what the authentication key is. Notice that you set up the key on the server. If that command required authentication, then the NTP server would also require the authentication of its NTP server (NTP is layered).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ntp authenticate&lt;/code&gt; command says that the NTP client will require authentication from its NTP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ntp trusted-key&lt;/code&gt; command tells the client which of the configured keys to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ntp server&lt;/code&gt; command tells the client which NTP server to use.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit based on your comments:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I originally answered your question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What does &lt;code&gt;ntp authenticate&lt;/code&gt; do different from &lt;code&gt;ntp trusted-key 22&lt;/code&gt;?&#xA;  In what cases would I have one command applied but not the other?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;but that doesn't seem to really be your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are going to configure multiple NTP servers with different authentication keys, it will probably look something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NTP Server 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#ntp source Loopback1&#xA;R1(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NTP Server 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)#ntp source Loopback1&#xA;R2(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NTP Server 3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3(config)#ntp source Loopback1&#xA;R3(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NTP Client:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4(config)#ntp authenticate&#xA;R4(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY-1&#xA;R4(config)#ntp authentication-key 2 md5 SECRET-NTP-KEY-2&#xA;R4(config)#ntp authentication-key 3 md5 SECRET-NTP-KEY-3&#xA;R4(config)#ntp server 10.11.12.1 key 1&#xA;R4(config)#ntp server 10.11.12.2 key 2&#xA;R4(config)#ntp server 10.11.12.3 key 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you are going to configure multiple NTP servers with the same authentication keys, it will probably look something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NTP Server 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#ntp source Loopback1&#xA;R1(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NTP Server 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)#ntp source Loopback1&#xA;R2(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NTP Server 3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3(config)#ntp source Loopback1&#xA;R3(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;NTP Client:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4(config)#ntp source Loopback1&#xA;R4(config)#ntp authenticate&#xA;R4(config)#ntp authentication-key 1 md5 SECRET-NTP-KEY&#xA;R4(config)#ntp trusted-key 1&#xA;R4(config)#ntp server 10.11.12.1&#xA;R4(config)#ntp server 10.11.12.2&#xA;R4(config)#ntp server 10.11.12.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Having the NTP source based on the loopback is a good idea. If one link goes down, NTP can still be updated if the traffic can get to and from the server via a different path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ntp trusted-key &amp;lt;key number&lt;/code&gt; command will be used for commands on which you don't use the optional &lt;code&gt;key &amp;lt;key number&amp;gt;&lt;/code&gt; for any of the &lt;code&gt;ntp server &amp;lt;server address&amp;gt; or&lt;/code&gt;ntp peer ` commands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ntp source &amp;lt;interface&amp;gt;&lt;/code&gt; command will be used for commands on which you don't use the optional &lt;code&gt;source &amp;lt;interface&amp;gt;&lt;/code&gt; for any of the &lt;code&gt;ntp server &amp;lt;server address&amp;gt; or&lt;/code&gt;ntp peer ` commands.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NTP configuration from lab tests (not performed by me, but by a group which tests all network hardware/software features) for routers with IOS 15.x that passed (the password and addresses were changed for protection):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ntp authentication-key 1 md5 123456789 7&#xA;ntp authenticate&#xA;ntp trusted-key 1&#xA;ntp source Loopback0&#xA;ntp update-calendar&#xA;ntp server 10.11.12.13&#xA;ntp server 10.12.13.14 prefer&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice that the optional &lt;code&gt;key &amp;lt;key number&amp;gt;&lt;/code&gt; is not used on the &lt;code&gt;ntp server &amp;lt;server address&amp;gt;&lt;/code&gt; commands because the servers are configured with the same authentication key.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-03T17:41:29.627" LastActivityDate="2016-11-03T17:41:29.627" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="36215" PostTypeId="2" ParentId="36205" CreationDate="2016-10-31T20:55:03.963" Score="2" Body="&lt;p&gt;It sounds like you're asking why, if the client sends data first, the client cannot combine the bare handshake ack with that data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I think it can - it just generally doesn't do so. Operating system APIs are the typical reason.. a socket won't normally accept data to be write()n when it isn't in the established state and the kernel, upon seeing syn/ack, isn't going to wait to see if userspace sends along some data before sending the ack. (as the kernel doesn't know which end of this bidi connection is going to write first - and the other end can't write until it gets the completed handshake).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a system did send data on the 3rd part of the handshake at this point, against such tradition, they might very well find they had interop problems in doing so.. so there is a disincentive in trying to push the envelope.&lt;/p&gt;&#xA;" OwnerUserId="12178" LastActivityDate="2016-10-31T20:55:03.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36216" PostTypeId="2" ParentId="36209" CreationDate="2016-11-01T00:56:31.847" Score="3" Body="&lt;p&gt;A zero-hop protocol is one which is designed not to be forwarded by a router. This protocol could be expected to set IP.TTL to 1 (the router won't drop the packet just because IP.PROTOCOL=114). These protocols used to be commonplace in the era before internets (DEC LAT,etc). But the advantages of a protocol &lt;em&gt;able&lt;/em&gt; to be globally routed are just too great for zero-hop protocols to be of much modern interest (even if in some deployments you might choose to limit the packets to one subnet). You can see IANA felt the same, calling out all zero-hop protocols, not just a particular one.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastActivityDate="2016-11-01T00:56:31.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36217" PostTypeId="2" ParentId="36196" CreationDate="2016-11-01T01:09:01.143" Score="3" Body="&lt;p&gt;A IPv6 /128 is a host route, exactly like a IPv4 /32.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A /127 is a point-to-point route, exactly like a /31. In the IP allocation database we'd usually allocate a /127 as the only network in an unadvertised /124 block, for textual representation reasons (point to point links then always end in 0 or 1, rather than requiring engineers to do binary math to work out which address goes on the interface nearer the core).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All other subnets must be /64. You must not use a /64 on a point-to-point link, as that allows a DoS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as subnet address planning goes, subnet 0 is has a special textual representation and should be reserved for control-plane addresses of networking equipment. It is useful to reserve the lower 12 bits of the subnet addressing for a copy of the VLAN ID, as that gives a rapid and simple addressing plan for most subnets. The 13th bit obviously is 0 for VID-derived  subnets and subnet 0; and 1 for others.  Depending on your network you could use the highest subnetwork bits as a site identifier, allowing easy site address aggregation, and more effective area design (preventing flaps of non-backbone networks being propagated to other sites.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Not seeking to be an answer, my comment got too long, vote up Ron's answer.)&lt;/p&gt;&#xA;" OwnerUserId="25444" LastEditorUserId="25444" LastEditDate="2016-11-01T01:20:38.957" LastActivityDate="2016-11-01T01:20:38.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36218" PostTypeId="2" ParentId="36190" CreationDate="2016-11-01T01:43:55.400" Score="2" Body="&lt;p&gt;The short answer is, it is software defined :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's unpack your question. An Unknown Unicast in a transparently bridged network is one who's destination MAC address isn't known. In transparent bridging we flood that out all interfaces. That address will reach the MAC address of interest (assuming it exists) and when that computer responds we'll see that MAC address in the source address of a ethernet frame and can record the port it was seen on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Importantly, that Unknown Unicast MAC address requires a entry in the TCAM of the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An Unknown Unicast Attack is when we send so many never-before-seen MAC addresses that the Unknown Unicast portion of the TCAM of the switch is filled with these rubbish addresses, and as the TCAM ages out the real MAC addresses then those real MAC addresses are fighting against the odds to be reinstated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can of course take measures against this in a switch. For example, by preferring established MAC address entries in the TCAM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if we are using SDN to implement transparent ethernet bridging then the problem remains. The controller still has a table of MAC addresses, and we are filling the OpenFlow-switch with lots of rubbish (match, action) rules. Furthermore the OpenFlow traffic from the switch to the controller and the rate of change of (match, action) rules might begin to be an issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But we don't have to use SDN to implement transparent ethernet bridging. We could implement something which has the &lt;em&gt;same effect&lt;/em&gt; without using the &lt;em&gt;same mechanism&lt;/em&gt;. As a really simple example, the provisioning system could configure the SDN controller with the location of every MAC address. Then there is no Unknown Unicast processing at all, as all Unknown Unicasts are invalid and can be dropped immediately.  Or we could do away with MAC addresses altogether, and simply configure the lower bytes of the IP address into the MAC address of the ethernet interfaces. The SDN controller application would then essentially route, with no ARP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or to take a wide area problem, if we are providing a metro ethernet service then we can simply encapsulate the received packet at the A-end client-facing interface, use our own MAC addressing to deliver it across our network to the B-end client-facing interface, and transmit the packet. Not looking into the customer's MAC addressing at all.  You can see that this approach could also be used within data centre networking, and there are a variety of &quot;tunnelling&quot; schemes. Such tunnels mean that whatever the host claims as its MAC addressing is irrelevant, the network uses its own addressing which the host can't influence. So an unknown unicast attack is moot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, an important practical consideration is that the SDN controller can scoff at ISO layering. If someone is having a go at an attack, and that attack can be detected from the upper layers (eg, by an intrusion detection system) then the OpenFlow Controller can be told  block that class of flows from ever being switched. It's these &quot;whole of network synergies&quot; which make SDN much more interesting than simply reimplementing transparent ethernet bridging. To date the synergy of interest has been datacentre provisioning, but there's obviously lots of untapped scope in internet networks.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastEditorUserId="25444" LastEditDate="2016-11-01T02:04:15.073" LastActivityDate="2016-11-01T02:04:15.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36219" PostTypeId="2" ParentId="36172" CreationDate="2016-11-01T02:16:01.560" Score="2" Body="&lt;p&gt;These boxes are obviously bad news. So what you want to do is to place a private link-layer around those boxes. Cisco gives you two tunnelling options on their switching devices: Q-in-Q or TRILL (there's even more possibilities on their IP/MPLS devices). Q-in-Q is probably easier for you to get your head around. Configure Q-in-Q to transport all the client-port BPDUs transparently. Then it looks to your A/V gear like they are neighbours on the same hub. They can happily chat their bastardised protocols between the two of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you get that working, simply implement a protected service for the network-side VLAN (aka &quot;s-tag&quot;), in your usual fashion (which I think was STP and interface costs, but you could also use LAGs or whatever).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can grow Q-in-Q into a proper multi-client subnet, should you have more than two of these nightmare boxes. You might also need to do that to get an Internet service into the client-side VLAN.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastEditorUserId="25444" LastEditDate="2016-11-01T02:40:27.000" LastActivityDate="2016-11-01T02:40:27.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36220" PostTypeId="2" ParentId="36200" CreationDate="2016-11-01T03:02:08.477" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What does iperf UDP streams do&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;iperf will attempt to send UDP packets to reach the rate given in &lt;code&gt;--bandwidth&lt;/code&gt;. If that parameter is missing, it will attempt to achieve the rate of the transmitting interface.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;what can i do on my Apple&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can measure both computers' resource use, as there's a bottleneck. CPU is the most likely bottleneck, given that parallel transfers have superior performance. See the &lt;code&gt;--single_udp&lt;/code&gt; parameter for a easy way to determine single core versus multicore performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you've chosen really odd platforms. I've no idea what the per-packet overhead of what the MacBook Air's Thunderbolt-attached gigabit ethernet dongle might be compared with PCIe. So you are going to have to do a lot of the investigation of potential bottlenecks yourself.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastActivityDate="2016-11-01T03:02:08.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36222" PostTypeId="1" CreationDate="2016-11-01T07:31:11.900" Score="2" ViewCount="614" Body="&lt;p&gt;How can I setup a layer2 failover configuration?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Network setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The distance between Site A and Site B is 2 km. Both sites are connected via a wireless link. As a backup line, we also have a layer2 fiber link between these two sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Primarily I want to transfer all traffic on the wireless link only, and do not use fiber link at all, if the wireless link is working well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to activate the fiber link automatically, but only if the wireless link is down. And when the wireless link is restored, automatically deactivate fiber link port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ether-port A (wireless) needs to continuously ping the other side, and if no there is no ping reply, then activate Ether-port B(Fiber), so all traffic routes without any interference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Ether-port A(wireless) ping gets a reply, cut off PortB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you ask why not to use fiber always when fiber is better then wireless: I  my ISP charges per GB for data traffic. So it is expensive when wireless link is running.&lt;/p&gt;&#xA;" OwnerUserId="31729" LastEditorUserId="20757" LastEditDate="2017-05-08T02:15:02.067" LastActivityDate="2017-05-08T02:15:02.067" Title="Layer 2 Failover" Tags="|wireless|network-core|layer2|fiber|failover|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="36225" PostTypeId="2" ParentId="36222" CreationDate="2016-11-01T11:54:23.310" Score="2" Body="&lt;p&gt;If you have any kind of Layer 3 equipment in that setup, you should be able to easily do this by having both being routes to your destination, with A having a lower metric than B. This would cause all traffic to exit via A, only using B when A is down.&lt;/p&gt;&#xA;" OwnerUserId="17048" LastActivityDate="2016-11-01T11:54:23.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36226" PostTypeId="2" ParentId="36205" CreationDate="2016-11-01T12:28:34.640" Score="1" Body="&lt;p&gt;Yes , There is a need of empty ack to acknowledge the syn sent from other end &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(closed) A &amp;lt;syn&amp;gt;----------&amp;gt; B (listen) &#xA;(syn-sent) A &amp;lt;------------&amp;lt;syn&amp;gt;&amp;lt;ack&amp;gt; B (listen) &#xA;(established) A               B (syn-sent)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As after these steps B is waiting for an ACK from A for the SYN, to reach a Connection established state. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the interesting case you discussed here is the possibility of minimizing the next step &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  (established) A &amp;lt;ack&amp;gt;-----------&amp;gt; B (syn-sent)&#xA;  (established) A [data&amp;gt;]&amp;lt;ack&amp;gt;-----------&amp;gt; B (established)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; (established) A [&amp;lt;data&amp;gt;]&amp;lt;ack&amp;gt;-----------&amp;gt; B (syn-sent)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But as seems to , B is in non established state it don't seems to entertain the payload &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In RFC 793 ( section 3.4.  Establishing a connection )&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Several examples of connection initiation follow.  Although these&#xA;  examples do not show connection synchronization using data-carrying&#xA;  segments, this is perfectly legitimate, so long as the receiving TCP&#xA;  doesn't deliver the data to the user until it is clear the data is&#xA;  valid &lt;strong&gt;(i.e., the data must be buffered at the receiver until the&#xA;  connection reaches the ESTABLISHED state)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so from rfc it seems &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;4   SN 1 AN 1 -----&amp;gt; SERVER:80 -- PSH ACK(HTTP GET)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;will be buffered and will be delivered to the application only after an empty ack following it&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your solution may work for a implementation called &lt;strong&gt;delayed ack&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="31453" LastActivityDate="2016-11-01T12:28:34.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36227" PostTypeId="1" CreationDate="2016-11-01T13:07:13.703" Score="1" ViewCount="116" Body="&lt;p&gt;Is there a way to check if a public IPv4 address/Subnet was obtained through illegitimate means by a webhost?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, can outright IPv4 hijacking last for years or only for minutes/hours?&lt;/p&gt;&#xA;" OwnerUserId="31740" LastEditorUserId="8499" LastEditDate="2018-03-11T01:48:16.920" LastActivityDate="2018-03-11T01:48:16.920" Title="Auditing IPv4 Space" Tags="|ipv4|ip|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36228" PostTypeId="2" ParentId="36227" CreationDate="2016-11-01T14:46:27.317" Score="0" Body="&lt;p&gt;You can do a search at ARIN to see who the registered owner is for an IP &lt;a href=&quot;http://whois.arin.net/ui/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://whois.arin.net/ui/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for hijacking, I assume you mean that someone just picks a public IP at random and starts advertising it for their own purposes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If their local ISP is accepting any advertisements and not filtering them, the bad routes could potentially get propagated until they are filtered at some point.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-11-01T14:46:27.317" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36229" PostTypeId="1" AcceptedAnswerId="36232" CreationDate="2016-11-01T14:51:00.893" Score="3" ViewCount="995" Body="&lt;p&gt;I'm studying about 802.1X port based authentication and RADIUS, and I came across the terms of NAC (Network Admission Control) and NAP (Network Access Protection). As long as I know NAC tries to unify some endpoint security stuff (virus scanners, IDS, etc) with authentication. So how does it enhance 802.1X? Does it provide policies or something so that one can use virus scanners or IDS with 802.1X?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think NAP is more or less the same thing as NAC, but it is Windows variant. Does it provide any additional functionality?&lt;/p&gt;&#xA;" OwnerUserId="31578" LastActivityDate="2016-11-02T00:39:46.877" Title="How does NAC or NAP enhance 802.1X?" Tags="|authentication|port-security|ieee-802.1x|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36230" PostTypeId="2" ParentId="36227" CreationDate="2016-11-01T14:56:26.003" Score="2" Body="&lt;p&gt;To be able to advertise a network, you must have the cooperation of the ISP(s) to which you connect. Most will require you to own the network(s) in question, and they will refuse to advertise networks if you can't prove you own them. If problems are caused by an incorrect route to a network, an ISP will work rapidly to correct the problem because other ISPs to which it connects may cut it off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Someone using a network that belongs to someone else is only hurting himself because he can't get to the legitimate network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on you question about checking from a web host (client), I think you need to be more concerned about a DNS problem.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-01T14:56:26.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36232" PostTypeId="2" ParentId="36229" CreationDate="2016-11-01T15:28:19.553" Score="4" Body="&lt;p&gt;802.1X does perform either a computer or a user authentication to allow the network access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAC is a generic term designing any form of Network Access Control.&#xA;Then 802.1X is one kind of NAC. I consider 802.1X to be the standard of NAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beware here of the abbreviation collision around NAC which stands for Network Access Control and Network Admission Control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network Admission Control (origin Cisco) and Network Access Protection (origin Microsoft) are also two commercial NAC (Network Access Control)&#xA;going further than the standard 802.1X. They verify that the connecting&#xA;operating system is in a correct state (through the checksum of some&#xA;components), and that the endpoint anti-virus is on and up to date.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAC (Network Admission Control), the Cisco version is more network aware and less Windows addict. Unfortunatly this software solution stopped being supported by Cisco in 2011.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAP (Network Access Protection), the Microsoft solution is more Windows aware and less network adapted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my own short experience, these 2 software solutions might be easily deceived as long as you get the control of the endpoint PC (Windows, MacOS X, Linux…). You can easily install an endpoint yes-agent replacing&#xA;the editor one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I advise to stick to the 802... standards, which have their limitations and defaults, but with no hidden features which advantage the&#xA;attackers.&lt;/p&gt;&#xA;" OwnerUserId="13986" LastEditorUserId="13986" LastEditDate="2016-11-02T00:39:46.877" LastActivityDate="2016-11-02T00:39:46.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36234" PostTypeId="2" ParentId="30041" CreationDate="2016-11-01T18:21:10.137" Score="0" Body="&lt;p&gt;I think you can NAT the 192.168.2.1 to a different address on the firewall device and send traffic to that IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eg NAT 192.168.2.1 to 10.1.1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Send traffic to 10.1.1.1 so that the firewall would unnat the IP to the 192.168.1.1 and send it to the client on the other interface.&lt;/p&gt;&#xA;" OwnerUserId="31745" LastActivityDate="2016-11-01T18:21:10.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36236" PostTypeId="1" AcceptedAnswerId="36240" CreationDate="2016-11-01T19:54:23.310" Score="1" ViewCount="165" Body="&lt;p&gt;I would like to learn how is VLAN management in 802.1X port based authentication. Are there something specific in 802.1X about VLANs? Because VLAN is also part of Layer 2.&lt;/p&gt;&#xA;" OwnerUserId="31578" LastActivityDate="2016-11-01T23:53:21.860" Title="VLAN management in 802.1X" Tags="|vlan|ieee-802.1x|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36239" PostTypeId="1" CreationDate="2016-11-01T23:33:41.917" Score="1" ViewCount="130" Body="&lt;p&gt;Please Help !!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my topology&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4agfi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4agfi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have successfully configured vlans and svi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping all devices from vlan2 to vlan 3 but for vlan 5, i can only ping &#xA;the svi.&#xA;RB1 can ping RB2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my running config of L3 switch &quot;Distribution&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Distribution(config)#do sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1540 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Distribution&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 5&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport access vlan 5&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan2&#xA; description Utilisateurs&#xA; ip address 172.16.2.1 255.255.255.0&#xA;!&#xA;interface Vlan3&#xA; description Dirigeants&#xA; ip address 172.16.3.1 255.255.255.0&#xA;!&#xA;interface Vlan4&#xA; description Serveurs&#xA; ip address 172.16.4.1 255.255.255.0&#xA;!&#xA;interface Vlan5&#xA; description Coeur&#xA; ip address 172.16.5.1 255.255.255.0&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;Distribution(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;FAI1 Configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1114 bytes&#xA;!&#xA;version 12.3&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname RB1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;ip subnet-zero&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 172.16.5.2 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/1&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/2&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/3&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip classless&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;FAI 2 Configurations&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1114 bytes&#xA;!&#xA;version 12.3&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname RB2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;ip subnet-zero&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 172.16.5.3 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/1&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/2&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/3&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip classless&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31754" LastEditorUserId="8499" LastEditDate="2016-11-02T00:12:29.150" LastActivityDate="2017-04-30T01:31:17.317" Title="Vlan on l3 switch" Tags="|cisco|switch|router|vlan|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="36240" PostTypeId="2" ParentId="36236" CreationDate="2016-11-01T23:53:21.860" Score="3" Body="&lt;p&gt;Yes, you can configure your RADIUS server to specify the VLAN for the user.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Specifying an Authorized VLAN in the RADIUS Server Database The&#xA;  Internet Engineering Task Force (IETF) draft standard specifies a&#xA;  method for communicating vendor-specific information between the&#xA;  device and the RADIUS server by using the vendor-specific attribute&#xA;  (attribute 26). Vendor-specific attributes (VSAs) allow vendors to&#xA;  support their own extended attributes not suitable for general use.&#xA;  The Cisco RADIUS implementation supports one vendor-specific option by&#xA;  using the format recommended in the specification.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You must assign the following vendor-specific tunnel attributes in the&#xA;  RADIUS server database. The RADIUS server must return these attributes&#xA;  to the device: [64] Tunnel-Type = VLAN [65] Tunnel-Medium-Type = 802&#xA;  [81] Tunnel-Private-Group-ID = VLAN name or VLAN ID Attribute [64]&#xA;  must contain the value “VLAN” (type 13). Attribute [65] must contain&#xA;  the value “802” (type 6). Attribute [81] specifies the VLAN name or&#xA;  VLAN ID assigned to the IEEE 802.1X-authenticated user.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-11-01T23:53:21.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36245" PostTypeId="1" AcceptedAnswerId="36346" CreationDate="2016-11-02T09:09:27.527" Score="1" ViewCount="6201" Body="&lt;p&gt;If I set a &lt;code&gt;bandwidth&lt;/code&gt; parameter to Cisco Catalyst family switch port like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;s1#sh run int Fa0/4 | i band&#xA; bandwidth 15000&#xA;s1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;..then &lt;code&gt;ifHighSpeed&lt;/code&gt; no longer returns the physical port speed, but instead the &lt;code&gt;bandwidth&lt;/code&gt; value:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ snmpwalk -v 2c -c public s1 ifHighSpeed.5&#xA;IF-MIB::ifHighSpeed.5 = Gauge32: 15&#xA;$&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to return physical port speed over SNMP even if &lt;code&gt;bandwidth&lt;/code&gt; is specified? I tried with &lt;code&gt;portAdminSpeed&lt;/code&gt;(&lt;code&gt;.1.3.6.1.4.1.9.5.1.4.1.1.9&lt;/code&gt;), but SNMP agent in my switch does not know about that.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2016-11-08T01:13:13.307" Title="return physical port speed of Cisco switch over SNMP" Tags="|cisco|snmp|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36246" PostTypeId="1" CreationDate="2016-11-02T12:48:48.790" Score="0" ViewCount="636" Body="&lt;p&gt;I am trying to assign addresses in the given topology but I am having overlapping problems whenever I try to assign addresses to the routers interfaces. I have included the table of sub netting I performed for the network. I am supposed to have one pc on each switch and assign it an address and gateway. Would any body be able to help me in relation to assigning addresses to each pc? Many thanks and I would be very grateful of any help&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MmSCy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MmSCy.png&quot; alt=&quot;My Network&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/yCxca.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yCxca.png&quot; alt=&quot;MyTable&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31766" LastActivityDate="2016-11-02T13:01:00.897" Title="VLSM host ip address assigning" Tags="|cisco|" AnswerCount="1" CommentCount="1" ClosedDate="2016-11-02T14:39:36.817" ContentLicense="CC BY-SA 3.0" />
  <row Id="36247" PostTypeId="1" AcceptedAnswerId="36263" CreationDate="2016-11-02T12:58:37.660" Score="0" ViewCount="809" Body="&lt;p&gt;The maximum MTU I can set is between 9000 an 10,000 for a Ethernet interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following message for high values&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ifconfig eth0 mtu 10000&#xA;SIOCSIFMTU: Invalid argument&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What is the origin of this limitation and how can I find the limit value without using bruteforce?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="31023" LastActivityDate="2016-11-03T01:15:13.870" Title="What does limit a MTU set for an interface?" Tags="|router|linux|mtu|packet-loss|netflow|" AnswerCount="1" CommentCount="4" ClosedDate="2016-11-03T01:26:35.950" ContentLicense="CC BY-SA 3.0" />
  <row Id="36248" PostTypeId="2" ParentId="36246" CreationDate="2016-11-02T13:01:00.897" Score="1" Body="&lt;p&gt;For Net A you are using a /22, but the chart shows each network is a /24.  A /22 would actually look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network id:  172.20.0.0&#xA;1st host:  172.20.0.1&#xA;last host:  172.20.3.254&#xA;broadcast:  172.20.3.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What you listed is actually four different subnets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172.20.0.0/24&#xA;172.20.1.0/24&#xA;172.20.2.0/24&#xA;172.20.3.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You have a similar issue with Net B /23.  Actual /23 network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network id:  172.20.4.0&#xA;1st host:  172.20.4.1&#xA;last host:  172.20.5.254&#xA;broadcast:  172.20.5.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For your /30 networks everything is correct except the broadcast addresses.  Actual broadcasts:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;172.20.7.0/30  =  172.20.7.3&#xA;172.20.7.4/30 = 172.20.7.7&#xA;172.20.7.8/30 = 172.20.7.11&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-11-02T13:01:00.897" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36251" PostTypeId="1" AcceptedAnswerId="36253" CreationDate="2016-11-02T14:16:22.193" Score="1" ViewCount="1866" Body="&lt;p&gt;I am new to ASA firewall. I have ASA 5520 firewall (hardware) I want my clients in my Local network to gain internet access through the firewall. So it should be like this:&#xA;ISP to Billion modem to Firewall (hardware) to Switch to client.&lt;/p&gt;&#xA;" OwnerUserId="31768" LastActivityDate="2018-06-13T16:26:58.020" Title="Internet access through ASA firewall" Tags="|cisco-asa|firewall|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36253" PostTypeId="2" ParentId="36251" CreationDate="2016-11-02T16:33:11.573" Score="1" Body="&lt;p&gt;though your question is really vague I think you should do source NAT for internet access for your clients (aka MASQUERADE)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;imagine your client network 192.168.1.0 with a subnet mask of 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you should config this with CLI (supposing you have configured everthing else such as interfaces and security-levels etc) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network myclients&#xA; subnet 192.168.1.0 255.255.255.0 &#xA; nat (inside,outside) dynamic interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;reference :&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/configuration/guide/config/nat_objects.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa83/configuration/guide/config/nat_objects.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31771" LastActivityDate="2016-11-02T16:33:11.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36254" PostTypeId="1" AcceptedAnswerId="36256" CreationDate="2016-11-02T17:36:41.293" Score="1" ViewCount="61" Body="&lt;p&gt;Do routers usually support static or dynamic filters or both? This probably is a vendor specific question, but what is in usual the case  for routers? If they support only static packet filtering, why is this actually the case?&lt;/p&gt;&#xA;" OwnerUserId="31578" LastActivityDate="2016-11-02T17:45:30.823" Title="What type of packet filters do usually routers support?" Tags="|router|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36255" PostTypeId="2" ParentId="36254" CreationDate="2016-11-02T17:44:26.217" Score="0" Body="&lt;p&gt;This really is vendor specific, and it depends on what you mean by traffic filters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most business-grade routers support some form of static access lists. Some have cloud-based support to get filter changes. Reflexive access lists, firewall features, NAT support, etc. may depend on both the vendor and the license level, and could be considered dynamic filters, allowing inbound traffic only for established outbound connections.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-02T17:44:26.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36256" PostTypeId="2" ParentId="36254" CreationDate="2016-11-02T17:45:30.823" Score="3" Body="&lt;p&gt;Cisco routers support a type of dynamic access list called a reflexive access list.  It observes outbound traffic and will automatically add an entry to the inbound access-list permitting the return traffic.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What Is a Reflexive Access List? Reflexive access lists are similar in&#xA;  many ways to other access lists. Reflexive access lists contain&#xA;  condition statements (entries) that define criteria for permitting IP&#xA;  packets. These entries are evaluated in order, and when a match&#xA;  occurs, no more entries are evaluated.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;However, reflexive access lists have significant differences from&#xA;  other types of access lists. Reflexive access lists contain only&#xA;  temporary entries; these entries are automatically created when a new&#xA;  IP session begins (for example, with an outbound packet), and the&#xA;  entries are removed when the session ends. Reflexive access lists are&#xA;  not themselves applied directly to an interface, but are “nested”&#xA;  within an extended named IP access list that is applied to the&#xA;  interface. (For more information about this, see the section&#xA;  “Reflexive Access Lists Configuration Task List” later in this&#xA;  chapter.) Also, reflexive access lists do not have the usual implicit&#xA;  “deny all traffic” statement at the end of the list, because of the&#xA;  nesting.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfreflx.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfreflx.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-11-02T17:45:30.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36259" PostTypeId="1" CreationDate="2016-11-02T20:34:23.563" Score="1" ViewCount="636" Body="&lt;p&gt;New to VLANs and need help. Based on the simple drawing included, how do I set up the 1510 switch to not only route between the 2 VLANs but also get non VLAN 10 traffic sent to the firewall GW?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/w5Sqw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/w5Sqw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31773" LastActivityDate="2016-11-04T12:29:43.153" Title="Multi VLAN Routing" Tags="|routing|vlan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36261" PostTypeId="2" ParentId="36259" CreationDate="2016-11-03T00:07:19.793" Score="2" Body="&lt;ul&gt;&#xA;&lt;li&gt;Create a new VLAN for the link between the Firewall and the 1510.  For example, make it 10.16.125.0/24.  The FW can be 10.16.125.2.&lt;/li&gt;&#xA;&lt;li&gt;Configure a VLAN interface for each VLAN on the 1510 and give it an IP address in the VLAN.  For example,&#xA;interface VLAN 10 might be 10.16.124.1.  The new VLAN can be 10.16.125.1&lt;/li&gt;&#xA;&lt;li&gt;Create a static route on the 1510 for 0.0.0.0/0 with the next hop 10.16.125.2.&lt;/li&gt;&#xA;&lt;li&gt;Create a static route on your firewall on the inside (trusted) interface for 10.16.0.0/16 with the next hop 10.16.125.1&lt;/li&gt;&#xA;&lt;li&gt;All the ports connected to the vlan 10 switches will be configured in VLAN 10; The port to the other switch will be on vlan 20&lt;/li&gt;&#xA;&lt;li&gt;Devices on each VLAN will use the vlan interface you have configured&#xA;as their default gateway&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-11-04T12:29:43.153" LastActivityDate="2016-11-04T12:29:43.153" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36263" PostTypeId="2" ParentId="36247" CreationDate="2016-11-03T01:15:13.870" Score="1" Body="&lt;p&gt;9k is the standard for &quot;jumbo frames&quot; on host interfaces, switches must support higher numbers to allow for vlans and other extra header info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco 9216&#xA;Force10 12K&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has a lot to do with the back-plane buffer size, some ISP's support 9K globally (&lt;a href=&quot;https://he.net/ip_transit.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hurricane Electric&lt;/a&gt;).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a host you should never exceed 9K. You must control all systems end to end or you'll spend more time trying to figure out what packet fits.  This is why SANs are typically 9K, it fits a NTFS block nicely AND you control all devices and switches (SAN, HBA and Switch), cutting down on the number of trips to move your data.&lt;/p&gt;&#xA;" OwnerUserId="18909" LastActivityDate="2016-11-03T01:15:13.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36265" PostTypeId="1" CreationDate="2016-11-03T03:18:25.213" Score="0" ViewCount="904" Body="&lt;p&gt;I'm trying to setup an IPsec vpn to AWS from an SRX 110 and am having some trouble getting it to work. I've download the config file and my tunnels seem to be up, but I can't seem to ping anything in AWS.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show security ipsec security-associations                                                      &#xA;  Total active tunnels: 2&#xA;  ID    Algorithm       SPI      Life:sec/kb  Mon lsys Port  Gateway   &#xA;  &amp;lt;131073 ESP:aes-cbc-128/sha1 9e84c351 3427/ unlim - root 500 52.55.170.166   &#xA;  &amp;gt;131073 ESP:aes-cbc-128/sha1 62e0325 3427/ unlim - root 500 52.55.170.166   &#xA;  &amp;lt;131074 ESP:aes-cbc-128/sha1 2128ae3d 3431/ unlim - root 500 52.207.67.71    &#xA;  &amp;gt;131074 ESP:aes-cbc-128/sha1 3d29fbfe 3431/ unlim - root 500 52.207.67.71  &#xA;&#xA;show security ike security-associations                                                        &#xA;Index   State  Initiator cookie  Responder cookie  Mode           Remote Address   &#xA;6550418 UP     81a741b305932303  5cded1ed9120865f  Main           52.207.67.71    &#xA;6550417 UP     028df2e8bf768421  0f0010a4a0fe461a  Main           52.55.170.166   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on the aws side, I see this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VPN Tunnel  IP Address     Status   Status Last Changed     Details&#xA;Tunnel 1    52.55.170.166   DOWN    2016-11-02 23:04 UTC-4  IPSEC IS UP&#xA;Tunnel 2    52.207.67.71    DOWN    2016-11-02 23:04 UTC-4  IPSEC IS UP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think I don't have something configured in my zones correctly but am not sure, I have two zones that are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;zone1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name: Internal&#xA;Type: Security&#xA;Interface: vlan.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Zone2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name: Internet&#xA;Type: Security&#xA;Interfaces: fe-0/0/0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when I ran my config, it created two more zones as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name: trust&#xA;Type: Security&#xA;Protocals: bgp&#xA;interfaces: st0.1,st0.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this one:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name: untrust&#xA;Type: Security&#xA;Services: ike&#xA;Interfaces: blank&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;how come the tunnels seem to be up but I can't seem to ping anything inside the vpc? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, I'm very new to this as well.....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;------------------EDIT----------------&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the aws side, its now showing this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VPN Tunnel  IP Address  Status  Status Last Changed     Details&#xA;Tunnel 1    52.55.170.166   UP  2016-11-02 23:04 UTC-4  1 &#xA;Tunnel 2    52.207.67.71    UP  2016-11-02 23:04 UTC-4  1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;what my current config looks like now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;system {&#xA;    host-name RonakLab;&#xA;    time-zone EST;&#xA;    root-authentication {&#xA;        encrypted-password &quot;xxxxxxxxx&quot;; ## SECRET-DATA&#xA;    }&#xA;    name-server {&#xA;        208.67.222.222;&#xA;        208.67.220.220;&#xA;    }&#xA;    name-resolution {&#xA;        no-resolve-on-input;&#xA;    }&#xA;    services {&#xA;        ssh;&#xA;        telnet;&#xA;        web-management {&#xA;            http {&#xA;                interface vlan.1;&#xA;            }&#xA;            https {&#xA;                system-generated-certificate;&#xA;                interface vlan.1;&#xA;            }&#xA;            session {&#xA;                idle-timeout 60;&#xA;            }&#xA;        }&#xA;        dhcp {&#xA;            pool 192.168.2.0/24 {&#xA;                address-range low 192.168.2.1 high 192.168.2.254;&#xA;                router {&#xA;                    192.168.2.1;&#xA;                }&#xA;            }&#xA;            propagate-settings fe-0/0/0;&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        archive size 100k files 3;&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any critical;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands error;&#xA;        }&#xA;    }&#xA;    max-configurations-on-flash 5;&#xA;    max-configuration-rollbacks 5;&#xA;    license {&#xA;        autoupdate {&#xA;            url https://ae1.juniper.net/junos/key_retrieval;&#xA;        }&#xA;    }&#xA;    ntp {&#xA;        server us.ntp.pool.org;&#xA;    }&#xA;}&#xA;interfaces {&#xA;    fe-0/0/0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                dhcp;&#xA;            }&#xA;        }&#xA;    }&#xA;    fe-0/0/1 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    fe-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching {&#xA;                vlan {&#xA;                    members vlan1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    st0 {&#xA;        unit 1 {&#xA;            family inet {&#xA;                mtu 1436;&#xA;                address 169.254.47.18/30;&#xA;            }&#xA;        }&#xA;        unit 2 {&#xA;            family inet {&#xA;                mtu 1436;&#xA;                address 169.254.45.38/30;&#xA;            }&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 1 {&#xA;            family inet {&#xA;                address 192.168.2.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;protocols {&#xA;    stp;&#xA;}&#xA;security {&#xA;    ike {&#xA;        proposal ike-prop-vpn-f7584996-1 {&#xA;            authentication-method pre-shared-keys;&#xA;            dh-group group2;&#xA;            authentication-algorithm sha1;&#xA;            encryption-algorithm aes-128-cbc;&#xA;            lifetime-seconds 28800;&#xA;        }&#xA;        proposal ike-prop-vpn-f7584996-2 {&#xA;            authentication-method pre-shared-keys;&#xA;            dh-group group2;&#xA;            authentication-algorithm sha1;&#xA;            encryption-algorithm aes-128-cbc;&#xA;            lifetime-seconds 28800;&#xA;        }&#xA;        policy ike-pol-vpn-f7584996-1 {&#xA;            mode main;&#xA;            proposals ike-prop-vpn-f7584996-1;&#xA;            pre-shared-key ascii-text &quot;xxxxxxx&quot;; ## SECRET-DATA&#xA;        }&#xA;        policy ike-pol-vpn-f7584996-2 {&#xA;            mode main;&#xA;            proposals ike-prop-vpn-f7584996-2;&#xA;            pre-shared-key ascii-text &quot;xxxxxx&quot;; ## SECRET-DATA&#xA;        }&#xA;        gateway gw-vpn-f7584996-1 {&#xA;            ike-policy ike-pol-vpn-f7584996-1;&#xA;            address 52.45.108.91;&#xA;            dead-peer-detection;&#xA;            no-nat-traversal;&#xA;            external-interface fe-0/0/0.0;&#xA;        }&#xA;        gateway gw-vpn-f7584996-2 {&#xA;            ike-policy ike-pol-vpn-f7584996-2;&#xA;            address 52.54.120.173;&#xA;            dead-peer-detection;&#xA;            no-nat-traversal;&#xA;            external-interface fe-0/0/0.0;&#xA;        }&#xA;    }&#xA;    ipsec {&#xA;        proposal ipsec-prop-vpn-f7584996-1 {&#xA;            protocol esp;&#xA;            authentication-algorithm hmac-sha1-96;&#xA;            encryption-algorithm aes-128-cbc;&#xA;            lifetime-seconds 3600;&#xA;        }&#xA;        proposal ipsec-prop-vpn-f7584996-2 {&#xA;            protocol esp;&#xA;            authentication-algorithm hmac-sha1-96;&#xA;            encryption-algorithm aes-128-cbc;&#xA;            lifetime-seconds 3600;&#xA;        }&#xA;        policy ipsec-pol-vpn-f7584996-1 {&#xA;            perfect-forward-secrecy {&#xA;                keys group2;&#xA;            }&#xA;            proposals ipsec-prop-vpn-f7584996-1;&#xA;        }&#xA;        policy ipsec-pol-vpn-f7584996-2 {&#xA;            perfect-forward-secrecy {&#xA;                keys group2;&#xA;            }&#xA;            proposals ipsec-prop-vpn-f7584996-2;&#xA;        }&#xA;        vpn vpn-f7584996-1 {&#xA;            bind-interface st0.1;&#xA;            df-bit clear;&#xA;            vpn-monitor {&#xA;                source-interface st0.1;&#xA;                destination-ip 169.254.47.17;&#xA;            }&#xA;            ike {&#xA;                gateway gw-vpn-f7584996-1;&#xA;                ipsec-policy ipsec-pol-vpn-f7584996-1;&#xA;            }&#xA;        }&#xA;        vpn vpn-f7584996-2 {&#xA;            bind-interface st0.2;&#xA;            df-bit clear;&#xA;            vpn-monitor {&#xA;                source-interface st0.2;&#xA;                destination-ip 169.254.45.37;&#xA;            }&#xA;            ike {&#xA;                gateway gw-vpn-f7584996-2;&#xA;                ipsec-policy ipsec-pol-vpn-f7584996-2;&#xA;            }&#xA;        }&#xA;    }&#xA;    flow {&#xA;        tcp-mss {&#xA;            ipsec-vpn {&#xA;                mss 1387;&#xA;            }&#xA;        }&#xA;    }&#xA;    screen {&#xA;        ids-option untrust-screen {&#xA;            icmp {&#xA;                ping-death;&#xA;            }&#xA;            ip {&#xA;                source-route-option;&#xA;                tear-drop;&#xA;            }&#xA;            tcp {&#xA;                syn-flood {&#xA;                    alarm-threshold 1024;&#xA;                    attack-threshold 200;&#xA;                    source-threshold 1024;&#xA;                    destination-threshold 2048;&#xA;                    timeout 20;&#xA;                }&#xA;                land;&#xA;            }&#xA;        }&#xA;    }&#xA;    nat {&#xA;        source {&#xA;            rule-set nsw_srcnat {&#xA;                from zone Internal;&#xA;                to zone Internet;&#xA;                rule nsw-src-interface {&#xA;                    match {&#xA;                        source-address 0.0.0.0/0;&#xA;                        destination-address 0.0.0.0/0;&#xA;                    }&#xA;                    then {&#xA;                        source-nat {&#xA;                            interface;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    policies {&#xA;        from-zone Internal to-zone Internet {&#xA;            policy All_Internal_Internet {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone Internal to-zone aws {&#xA;            policy TO-aws {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone aws to-zone Internal {&#xA;            policy FROM-aws {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    zones {&#xA;        security-zone Internal {&#xA;            interfaces {&#xA;                vlan.1 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            ping;&#xA;                            dhcp;&#xA;                            http;&#xA;                            https;&#xA;                            ssh;&#xA;                            telnet;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;        security-zone Internet {&#xA;            interfaces {&#xA;                fe-0/0/0.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            dhcp;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;        security-zone aws {&#xA;            host-inbound-traffic {&#xA;                protocols {&#xA;                    bgp;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                st0.1;&#xA;                st0.2;&#xA;            }&#xA;        }&#xA;        security-zone untrust {&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    ike;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;vlans {&#xA;    vlan1 {&#xA;        vlan-id 3;&#xA;        l3-interface vlan.1;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14587" LastEditorUserId="14587" LastEditDate="2016-11-08T02:44:26.543" LastActivityDate="2018-06-01T09:34:26.187" Title="setting up aws vpn with srx110" Tags="|vpn|juniper|ipsec|juniper-junos|juniper-srx|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="36266" PostTypeId="2" ParentId="36259" CreationDate="2016-11-03T04:22:28.243" Score="3" Body="&lt;p&gt;You can achieve this by doing the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create a interface vlan of vlan 10 on DGS-1510 and give it an IP in the range 10.16.122.xxx/24, Assign this IP as gateway of all the hosts in VLAN 10.&lt;/li&gt;&#xA;&lt;li&gt;Create a interface vlan of vlan 20 on DGS-1510 and give it an IP address in range 10.16.123.xxx/24, Assign this IP as gateway of all the hosts in VLAN 20.&lt;/li&gt;&#xA;&lt;li&gt;Give a default route on DGS-1510 with next-hop address 10.16.122.13.&lt;/li&gt;&#xA;&lt;li&gt;Give static route on firewall of 10.16.123.0/24 next-hop address 10.16.122.xxx(whatever IP you have put on DGS-1510 on interface VLAN 10).&lt;/li&gt;&#xA;&lt;li&gt;I take you have L2 domain of VLAN 10 and VLAN 20 configured already, You just have to put ports connected to hosts of VLANs in their respective VLANs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="31465" LastEditorUserId="31465" LastEditDate="2016-11-04T08:02:31.853" LastActivityDate="2016-11-04T08:02:31.853" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36267" PostTypeId="1" CreationDate="2016-11-03T05:46:45.947" Score="2" ViewCount="607" Body="&lt;p&gt;Greeting's, this is my first attempt at network connectivity and hence would truly appreciate if community at large can review and guide me through it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have one main office with 7 branch offices. We don't plan to expand over 12-15 branch offices (even if we do, I feel my following assumptions and design should stand). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We plan to have P2P VPN lines between offices. I have proposed that we use 172.16/12 subnet. With 172.16.x.x for HQ and 172.17.x.x and so on for each branch. We will never have over 500 PC's per branch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are as of now 6 departments and I have proposed 172.16.1.x and so on for each department which will stay consistent over the branches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have (for whatever) reason L3 switches all around and each switch may hold computers of 2 or more departments. Hence to segregate I've proposed VLANs which will be (VLAN IDs) consistent between switches (I am unsure of this part). Hence, if sales computers are in VLAN2 on switch 2. Other switches (switch 3 for example) will have VLAN2 holding subnet and PC dedicated to sales. I've attached a diagram for better explanation.&#xA;I want to know if it's possible for inter VLAN communication based on the diagram I've attached and of course the changes recommend based on our needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am certain of having made mistakes with trunking. Please do guide me through it. Will the firewall be able to see IP's of endpoint with trunking on uplinks and L3 switch. Also all the switches in the diagram are L3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7RF7f.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7RF7f.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanking you all in anticipation! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My requirements are for L3VPN as per one of the answers. Thank you again. Just to confirm and reiterate since this is critical and my job hangs on getting it right - &#xA;As someone suggested - I am planning to shift to 10/8 subnet for better expendability.&#xA;Hence:&#xA;1.  HQ will have 10.1.0.0 subnet&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Branches will start with 10.2.0.0 series.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There will be further subdivision of IP ranges using VLANs per department. This will be consistent throughout the organization&#xA;A.  Sales will be allocated 10.1.1.0 in HQ.&#xA;B.  10.2.1.0 in branch 1 and 10.3.1.0 in branch 3 – so on and so forth.&#xA;Network device topology will remain consistency throughout branches:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;ISP CPE - Firewall - L3 Core swtich - L3 (working in L2 mode) switches - Endpoints.&#xA;Physical topology between branches will be -&lt;/li&gt;&#xA;&lt;li&gt;Endpoints - L2 Switches - L3 Core switch - firewall - ISP CPE - L3VPN - ISP CPE - Firewall - L3 Core swtich - L3 (working in L2 mode) switches - Endpoints.&#xA;Topology with IP addresses for illustration will be: &#xA;Endpoints (10.1.1.5) - L2 Switches (10.1.5.2) - L3 Core switch (10.1.1.1) - firewall (10.1.1.250 - question - should this be on same subnet or is it better to have firewall IP as 10.1.0.250) - ISP CPE - L3VPN - ISP CPE - Firewall (10.2.1.250) - L3 Core swtich (10.2.1.1)- L3 (working in L2 mode) switches (10.1.5.2) - Endpoints (10.2.1.5)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Questions: &#xA;1.  Is this optimum with respect to security (VLAN segregation for each departments), manageability, bandwidth (broadcast domains and compromised endpoint quarantine)?&#xA;2.  Will a machine on different VLAN and IP subnet (10.1.2.5) communicate with machine at HQ (10.1.1.5) and with 10.2.2.5 (at branch)? I reckon that within the same office (HQ/Branch) machines won't communicate. However, they will between branches of same department (10.1.1.5 with 10.2.1.5).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very very much to everyone who has reviewed and assisted me with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second diagram &#xA;&lt;a href=&quot;https://i.stack.imgur.com/8DK1f.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8DK1f.png&quot; alt=&quot;machine to machine between branch and HQ with IPs&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31781" LastEditorUserId="31781" LastEditDate="2016-11-04T06:35:55.633" LastActivityDate="2016-11-04T07:01:40.747" Title="Review of network connectivity diagram" Tags="|routing|vlan|ipv4|lan|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36270" PostTypeId="2" ParentId="36267" CreationDate="2016-11-03T11:16:42.727" Score="2" Body="&lt;p&gt;So here are a few points I would suggest:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Create virtual interface of each VLAN on the firewall itself, and use it as gateway for each host in the VLAN.&lt;/li&gt;&#xA;&lt;li&gt;Try to get redundancy on the core switch, If stacking available please choose that.&lt;/li&gt;&#xA;&lt;li&gt;Use different VLAN for servers and again put its virtual interface on firewall itself(use that interface IP as gateway for servers), In this way you will have a DMZ for servers.&lt;/li&gt;&#xA;&lt;li&gt;Have a switch placed in the servers area as well, Do not connect them directly to the core switch.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We will never have over 500 PC's per branch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;never&lt;/strong&gt; is a very strong word(avoid it) companies grow, networks grow. You &lt;strong&gt;never&lt;/strong&gt; know when you will need new hardware for growing user base.&lt;/li&gt;&#xA;&lt;li&gt;You will have to &lt;strong&gt;trunk&lt;/strong&gt; the ports between switches({department and core} and {server switch and core}) and also between the L3 core and firewall.&lt;/li&gt;&#xA;&lt;li&gt;Ports connected to hosts/servers are to be put in access vlan mode unless needed otherwise.&lt;/li&gt;&#xA;&lt;li&gt;Yes inter-vlan traffic will go through firewall(you can apply policies what to allow and what not) in this topology.&lt;/li&gt;&#xA;&lt;li&gt;Yes firewall will be directly able to see MACs of end hosts in this topology.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&#xA;You can also have L3 as the gateway of each VLAN rather than firewall, I am writing some cons and pros of having firewall as gateway(and vice versa): &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Cons&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Each host arp will come to firewall, you will have to see arp-cache size on firewall.&lt;/li&gt;&#xA;&lt;li&gt;For inter-vlan routing you have to make policy on firewall(blessing in disguise).&lt;/li&gt;&#xA;&lt;li&gt;SLAAC might not be available for IPv6 in firewall.&lt;/li&gt;&#xA;&lt;li&gt;If firewall goes down, Inter-vlan traffic will also stop.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Pros&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Lesser configuration overhead.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can have DMZs configured(allow/disallow different traffic from internet/intranet).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;More control over inter-vlan traffic.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Switching faster than routing, Packets will be switched to firewall.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Firewall will see all the hosts.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 2(after question was updated):&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your diagram shows something else(than what you have explained). Anyways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;From Diagram&lt;/strong&gt;: Do not use the management IP of switches from same VLAN as that clients! Use a separate network.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;L2 Switches (10.1.5.2)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;L2 switches at both ends have same management IP, don't do that. Assign different management IP range(I take this is a typo).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;firewall (10.1.1.250 - question - should this be on same subnet or is it better to have firewall IP as 10.1.0.250)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Do not use the same network, its of no use. Use a point to point network(a /30) between L3 and firewall, Since in any case gateway of your VLANs will be the L3 so why complicate things(if you are going to use this topology i.e.)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Is this optimum with respect to security (VLAN segregation for each departments), manageability, bandwidth (broadcast domains and compromised endpoint quarantine)? &lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes seems like so till now(will update if something comes in my mind).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;Will a machine on different VLAN and IP subnet (10.1.2.5) communicate with machine at HQ (10.1.1.5) and with 10.2.2.5 (at branch)? &lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As you said you are using L3VPN(routes are advertised via bgp mostly from one end router to another), So for example 10.1.0.0/8 from HQ is advertised to all the other branches via L3VPN and 10.2.0.0/8 from a branch to HQ, they will be able to communicate. So in essence, depending on how much routes your ISP lets you advertise. You can achieve this easily if the HQ office has routes of branch office and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I reckon that within the same office (HQ/Branch) machines won't communicate. However, they will between branches of same department (10.1.1.5 with 10.2.1.5).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is this something you think, or something you want. Because this won't happen by default. Its rather reverse of what you think(presuming) The local VLANs will be able to talk via inter-vlan(via L3) routing(since you have configured GWs of each VLAN on L3 itself). Also for different offices(HQ/branch) departments to talk you will need L3VPN routes transported(as explained above, job of ISP), though you can also achieve this with NAT(config overhead).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps!&lt;/p&gt;&#xA;" OwnerUserId="31465" LastEditorUserId="31465" LastEditDate="2016-11-04T07:01:40.747" LastActivityDate="2016-11-04T07:01:40.747" CommentCount="27" ContentLicense="CC BY-SA 3.0" />
  <row Id="36272" PostTypeId="2" ParentId="36267" CreationDate="2016-11-03T11:45:53.333" Score="2" Body="&lt;p&gt;There are many ways to do this.  Here are a few observations:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It's generally a good idea to push layer 3 as close to the end users&#xA;as possible.  Since you have layer 3 switches everywhere, this is&#xA;easy for you to do.&lt;/li&gt;&#xA;&lt;li&gt;You should consider creating a routing hierarchy, with the branch&#xA;switch terminating the local VLANs, and the core switch terminating&#xA;the branch links.&lt;/li&gt;&#xA;&lt;li&gt;While it's fine to put each department on a separate VLAN, unless you&#xA;plan to restrict access between departments, there's no real value.&lt;/li&gt;&#xA;&lt;li&gt;It's more important to insure that there are no layer 2 links&#xA;connecting your branch offices.  Everything should be L3.  I don't&#xA;see a need to use trunking anywhere.&lt;/li&gt;&#xA;&lt;li&gt;Place your servers on their own VLAN for design consistency and also&#xA;since that's the most likely place to enforce policy.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-03T11:45:53.333" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="36285" PostTypeId="1" AcceptedAnswerId="36298" CreationDate="2016-11-04T08:52:39.883" Score="1" ViewCount="422" Body="&lt;p&gt;Say for example my system's private ip is 192.168.75.5 and I want to open a website whose public ip is also 192.168.75.5. Now, if I type the ip on my browser and hit enter my local system would show up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How will the browser come to know that I want to open the website with the public ip 192.168.75.5 instead of the local system.&lt;/p&gt;&#xA;" OwnerUserId="31815" LastActivityDate="2016-11-04T21:37:29.637" Title="How does the browser differentiate between a public and a private ip?" Tags="|ipv4|ip|" AnswerCount="4" CommentCount="1" ClosedDate="2019-02-20T03:07:36.000" ContentLicense="CC BY-SA 3.0" />
  <row Id="36286" PostTypeId="2" ParentId="36285" CreationDate="2016-11-04T09:18:52.330" Score="4" Body="&lt;p&gt;You cannot have a public adress looking like 192.168.X.X as they are not routed on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read this &lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc958825.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;article&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31817" LastActivityDate="2016-11-04T09:18:52.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36289" PostTypeId="2" ParentId="36285" CreationDate="2016-11-04T12:26:58.493" Score="4" Body="&lt;p&gt;Browsers, and almost all other applications, don't know (or care) if the address is public or private.  To a browser, the computer and network just presents a stream of data -- that's what the meaning of layers is all about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the network layer, IP addresses are all the same -- the idea of public and private has no meaning to computers.  Fundamentally, either the address is on the local network, or it isn't -- and needs to be routed.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-04T12:26:58.493" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36290" PostTypeId="2" ParentId="36285" CreationDate="2016-11-04T13:43:18.973" Score="3" Body="&lt;p&gt;It seems your question is actually about duplicate IP addressing.  If your system has the same IP address as a remote system, it will always choose itself because it believes that it owns that IP address and will never consider a remote system as having that IP. &lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-11-04T13:43:18.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36293" PostTypeId="1" AcceptedAnswerId="36345" CreationDate="2016-11-04T16:15:52.820" Score="1" ViewCount="2415" Body="&lt;p&gt;We have a chain of switches configured for vlan 13, let's call them switch1, switch2 and switch3&#xA;No, somewhere on this chain the arp requests get lost. I can run tcpdump on these switches. Running just &lt;code&gt;sudo tcpdump -n host 192.168.42.1&lt;/code&gt; shows that switch1 and switch2 get the arp requests but switch3 doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to further isolate the problem to see if the problem is switch2 or switch3. Can I tell tcpdump to only listen for outgoing arp requests on one specific interface? I tried with &lt;code&gt;sudo tcpdump -e -i et6&lt;/code&gt; but I don't see the arp requests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;here's the port config of the three switches. The layout (syntax &lt;code&gt;incoming_port#switch#outgoing_port&lt;/code&gt;):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;fw1 - 6#switch1#45 - 45#switch2#51 - fiber - 41#switch3 - fw2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! switch 1: incoming&#xA;&#xA;interface Ethernet6&#xA;   switchport access vlan 13&#xA;   spanning-tree portfast&#xA;&#xA;! switch 1: outgoing&#xA;&#xA;interface Ethernet45&#xA;   channel-group 60 mode active&#xA;&#xA;interface Port-Channel60&#xA;   switchport trunk allowed vlan 1-3,5-4094&#xA;   switchport mode trunk&#xA;   mlag 16&#xA;&#xA;! switch 2: incoming&#xA;&#xA;interface Ethernet45&#xA;   switchport mode trunk&#xA;   channel-group 60 mode active&#xA;!&#xA;&#xA;interface Port-Channel60&#xA;   switchport trunk allowed vlan 1-3,5-4094&#xA;   switchport mode trunk&#xA;!&#xA;&#xA;! switch 2: outgoing&#xA;&#xA;interface Ethernet51&#xA;   mtu 9000&#xA;   switchport access vlan 8&#xA;   switchport trunk allowed vlan 2-3,5-14,101-110,112-120&#xA;   switchport mode trunk&#xA;!&#xA;&#xA;! switch 3: incoming&#xA;&#xA;interface Ethernet51&#xA;   mtu 9000&#xA;   switchport access vlan 8&#xA;   switchport trunk allowed vlan 2-3,5-14,101-110,112-120&#xA;   switchport mode trunk&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31824" LastEditorUserId="31824" LastEditDate="2016-11-07T07:27:32.050" LastActivityDate="2016-11-07T07:27:32.050" Title="debugging arp requests over vlan" Tags="|arp|interface|tcpdump|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="36294" PostTypeId="1" AcceptedAnswerId="36310" CreationDate="2016-11-04T16:34:24.720" Score="1" ViewCount="537" Body="&lt;p&gt;I'm running a pair of 5596Ts as a vPC pair. These make up the core in our DC, all L3 is handled here (daughter card installed), all subnet gateways live here, using HSRP across them all. Our current licensing is lan base. I have a project which requires the use of PBR, so I need to upgrade to N55_LAN1K9 licensing, which we have purchased for both switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I cannot seem to get an answer on, is will I need to reload after I install the licensing? It seems that I can enable PBR (and other features) without dropping traffic or needing/causing a reload, but I can't find a definitive answer anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read through the licensing docs from Cisco but again I didn't see anything clearly stating yes or no. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/Licensing.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/Licensing.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a similar note, can I safely assume that all features can be added without dropping traffic or otherwise impacting performance?&lt;/p&gt;&#xA;" OwnerUserId="1068" LastActivityDate="2016-11-05T09:37:25.420" Title="applying licensing to Nexus 5k" Tags="|cisco-nexus-5k|cisco-nexus|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36298" PostTypeId="2" ParentId="36285" CreationDate="2016-11-04T21:37:29.637" Score="1" Body="&lt;p&gt;The best way to reach your locally hosted server is using the 127.0.0.1 IP address (localhost loopback). The best way to check the status of an externally hosted server is to navigate to that pages domain name or IP address directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP Addresses are defined by the Internet Assigned Numbers Authority (IANA). Your ISP can sell you addresses which they have acquired through their local internet registry. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inside of a company or home network, it does not make sense to purchase an IP address for every single device that connects to the internet. Instead, the private network uses a special set of IP addresses for their internal use, and then &lt;strong&gt;net address translation&lt;/strong&gt; takes place, so that all of the internal private IP addresses share the same external public IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are three sets of private IP Addresses you can use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 10.0.0.0        -   10.255.255.255  (10/8 prefix)&#xA; 172.16.0.0      -   172.31.255.255  (172.16/12 prefix)&#xA; 192.168.0.0     -   192.168.255.255 (192.168/16 prefix)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this way, you can use the 192.168.1.1/24 network for your home network, and your neighbor can also use the 192.168.1.1/24 network, but when you communicate with eachother, it is your public IP addresses which are the actual communication endpoints. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that being said, 192.168.75.5 will never be a public IP address. Also, the browser does not determine whether an IP is &quot;Inside&quot; or &quot;Outside&quot; your network, this takes place at a lower level, when the the TCP/IP protocol determines whether the network ID on the packet matches the network ID on the local segment, or if it has to be forwarded up to the default gateway.&lt;/p&gt;&#xA;" OwnerUserId="31831" LastActivityDate="2016-11-04T21:37:29.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36299" PostTypeId="1" AcceptedAnswerId="36300" CreationDate="2016-11-04T21:39:12.117" Score="0" ViewCount="229" Body="&lt;p&gt;I'm using &lt;strong&gt;openvpn&lt;/strong&gt; to connect to a network through a &lt;strong&gt;VPN&lt;/strong&gt; and I use a &lt;strong&gt;ovpn&lt;/strong&gt; file which is the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dev tap&#xA;persist-tun&#xA;persist-key&#xA;cipher AES-128-CBC&#xA;auth SHA1&#xA;tls-client&#xA;client&#xA;resolv-retry infinite&#xA;remote smthvpn06.somedomain.com 1194 udp&#xA;lport 0&#xA;auth-user-pass&#xA;ns-cert-type server&#xA;&#xA;&amp;lt;ca&amp;gt;&#xA;-----BEGIN CERTIFICATE-----&#xA;MIIEmzCCA4OgAwIBAgIBADANBgkqhkiG9w0BAQsFADCBkDELMAkGA1UEBhMCVVMx&#xA;             ....&#xA;QGWNykAXUSbqJM2NpIKi+6iyc+NNtijYMCjMPQeqvw==&#xA;-----END CERTIFICATE-----&#xA;&amp;lt;/ca&amp;gt;&#xA;&amp;lt;cert&amp;gt;&#xA;-----BEGIN CERTIFICATE-----&#xA;Eh0CPLYgWyRMWwc/8/rhrlNtrsJ2H8U1IhhJcwFgbJ+4/klCAUhcdwWKgKF8sfgr&#xA;&#xA;MI6nkXW5lAHRjNBmpY2jrtH3d2XXgGrVIV52iNmhPeCOWwxqIlcROuCydxJy&#xA;/7edS1Y3&#xA;-----END CERTIFICATE-----&#xA;&amp;lt;/cert&amp;gt;&#xA;&amp;lt;key&amp;gt;&#xA;-----BEGIN PRIVATE KEY-----&#xA;MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDgn65ZGarhcM8A&#xA;&#xA;mT3KHe9+mhHCBCP3Cfm1NeEm&#xA;-----END PRIVATE KEY-----&#xA;&amp;lt;/key&amp;gt;&#xA;&amp;lt;tls-auth&amp;gt;&#xA;#&#xA;# 2048 bit OpenVPN static key   &#xA;#&#xA;-----BEGIN OpenVPN Static key V1-----&#xA;7af112a9ad39a604b3c4d90c707888e7&#xA;&#xA;-----END OpenVPN Static key V1-----&#xA;&amp;lt;/tls-auth&amp;gt;&#xA; key-direction 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I know the network to which I can connect with the VPN have several IPV6 interfaces. And I would like to connect to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem:&lt;/strong&gt; I don't know neither the IPV6 addresses of those hosts, neither the &lt;strong&gt;IPV6&lt;/strong&gt; address of the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, any hint to find it out would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks a lot.&lt;/p&gt;&#xA;" OwnerUserId="31830" LastActivityDate="2016-11-05T00:38:30.727" Title="Openvpn and IPV6: how to configure it without knowing the server's IPV6 address" Tags="|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36300" PostTypeId="2" ParentId="36299" CreationDate="2016-11-04T21:49:08.733" Score="0" Body="&lt;pre&gt;&lt;code&gt;nslookup -q=aaaa smthvpn-6.somedomain.com &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In a windows environment this will return the IPV6 Address associated with the domain name given.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;nslookup&lt;/strong&gt; is used to query name servers for their DNS Records. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nslookup [-option] [name | -] [server]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-q is the querytype option:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-querytype=value or -q=value&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The query tpe command changes the type of information your query retrieves. If you're running the command in a Windows environment the query types are listed here: &lt;a href=&quot;https://technet.microsoft.com/en-us/library/bb490738.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://technet.microsoft.com/en-us/library/bb490738.aspx&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using the aaaa option queries the target server for the ipv6 address associated with the specified DNS record.&lt;/p&gt;&#xA;" OwnerUserId="31831" LastEditorUserId="31831" LastEditDate="2016-11-05T00:38:30.727" LastActivityDate="2016-11-05T00:38:30.727" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36301" PostTypeId="2" ParentId="36265" CreationDate="2016-11-04T22:49:06.873" Score="0" Body="&lt;p&gt;Did you propagate the route table on AWS? If not, go to the VPC, Route Table go to the route table for your VPC then under route propagate hit edit and mark as YES. The VPN is up because both peers established phase 1 and phase 2, I think your problem is that when you send traffic from your Juniper device to AWS, the AWS device will reply back, but the AWS doesn't know that IP needs to traverse through the VPN tunnel. You can also do this test; create a linux instance on AWS and run tcpdump. With tcpdump, you should be able to see the traffic coming from your branch.&lt;/p&gt;&#xA;" OwnerUserId="31833" LastActivityDate="2016-11-04T22:49:06.873" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36303" PostTypeId="1" AcceptedAnswerId="36316" CreationDate="2016-11-05T00:53:52.817" Score="1" ViewCount="145" Body="&lt;p&gt;I was wondering if my switch that doesn't have MAC addresses assigned to any of its customer ports can even pareticipate in spanning tree protocol negotiations?&lt;/p&gt;&#xA;" OwnerUserId="3422" LastEditorUserId="3422" LastEditDate="2016-11-05T00:59:45.987" LastActivityDate="2016-11-05T14:37:27.503" Title="can a switch participate in STP without MAC?" Tags="|mac-address|switching|spanning-tree|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36304" PostTypeId="2" ParentId="6938" CreationDate="2016-11-05T01:08:41.440" Score="0" Body="&lt;p&gt;Channel 3 may or may not interfere with 1 &amp;amp; 6, it depends on where the other nodes are. If your AP is in the same room and close there will be no interference because signal strength will be high enough. In that case using 1 6 11 will cause sharing / pauses. If one person is on ch3 then throughput is increased and no pauses. In a crowded 1 6 11 there is waiting to transmit. But not for the person switched  to ch3. If you could plan everybody's channel then using inbetween channels could be more efficient. However on very dense schemes.this idea may break down. It depends on signal strengths. &lt;/p&gt;&#xA;" OwnerUserId="31836" LastActivityDate="2016-11-05T01:08:41.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36305" PostTypeId="1" AcceptedAnswerId="36314" CreationDate="2016-11-05T02:41:58.223" Score="1" ViewCount="737" Body="&lt;p&gt;I am currently taking a networking course and am bombarded with information which is different from 100's of sources and want to get some things straight.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last 3 layers of the OSI mode (Network, Data link, and physical) run on every single host in a network. Let's say in a network there is a network switch (with 4 computers attached to that network switch using Ethernet) and that network switch is finally connected to a router. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If a computer connected to that network switch wants to send data to the Internet (via the router), the computer will first encapsulate the data into a frame since it knows that it is attached to a switch and switches can only forward frames (correct?). So this computer will only use protocols in the Data Link layers (and not the network and physical layer right?).&lt;/li&gt;&#xA;&lt;li&gt;Then the switch will forward the frame to the router (where the data link protocol's on the router will unpack the frame) and then the network protocol's on the router will route the packet using the IP address? Now since the computer that sent the frame was attached to a switch is there an IP address in the frame sent to by the computer? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="30675" LastActivityDate="2016-11-05T11:24:10.790" Title="Does every application use the layers of the OSI model?" Tags="|ip|osi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36306" PostTypeId="2" ParentId="36245" CreationDate="2016-11-05T06:12:16.963" Score="0" Body="&lt;p&gt;If you need speed information of Interfaces, you can test &lt;code&gt;ifSpeed&lt;/code&gt;(OID:&lt;code&gt;.1.3.6.1.2.1.2.2.1.5&lt;/code&gt;, &lt;strong&gt;FROM RFC1213-MIB, IF-MIB&lt;/strong&gt;). It's worked for me.&lt;/p&gt;&#xA;" OwnerUserId="22692" LastActivityDate="2016-11-05T06:12:16.963" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36308" PostTypeId="1" AcceptedAnswerId="36312" CreationDate="2016-11-05T09:08:33.887" Score="1" ViewCount="741" Body="&lt;p&gt;In my understanding, the net-id, subnet-id and host-id of a host IP address are &lt;em&gt;portions&lt;/em&gt; of it, indicating which bits in its binary notation they corresponds to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From them we can evaluate the network address and subnet address, which instead are &lt;em&gt;IP addresses&lt;/em&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The converse is not true, unless you specify the subnet mask or CIDR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this way it does not make sense to specify the subnet-id with a single decimal number, f.i.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in 46.179.50.44/13 the subnet-id is the 5 most significant bits of the second byte, but if I specify the subnet address 46.176.0.0 without the CIDR or subnet mask I can't get the subnet-id. &quot;176&quot; does not specifies the subnet-id as 46.176.0.0/13 and 46.176.0.0/15 have the same &quot;176&quot; but different subnet-id's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that correct? I see that in some textbooks the terms are used    interchangeably.&lt;/p&gt;&#xA;" OwnerUserId="31841" LastActivityDate="2016-11-05T10:50:39.617" Title="Clarification on the definition of net/subnet-id and network/subnet address" Tags="|ipv4|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="36310" PostTypeId="2" ParentId="36294" CreationDate="2016-11-05T09:37:25.420" Score="3" Body="&lt;p&gt;No, you do not need to reboot the switch!&lt;/p&gt;&#xA;" OwnerUserId="2819" LastActivityDate="2016-11-05T09:37:25.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36312" PostTypeId="2" ParentId="36308" CreationDate="2016-11-05T10:50:39.617" Score="2" Body="&lt;p&gt;Subnet ids are a feature of classful addressing, which was obsolete before you were born. In classless address (CIDR) the subnet mask divides the network and host ids. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also remember that IP addresses are simply 32 bit binary numbers. The dotted decimal notation is just to make it easier for humans to read. The dots have no significance. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-05T10:50:39.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36314" PostTypeId="2" ParentId="36305" CreationDate="2016-11-05T11:24:10.790" Score="1" Body="&lt;p&gt;First, remember that the OSI model is just a conceptual model.  It doesn't represent any software actually in use.  The TCP/IP model is closer to what computers actually use, but it too is just a model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All hosts have all the layers in whatever model you're using.  Computers generate data from applications and that data is encapsulated in lower layers until it is sent out on the wire.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If a computer connected to that network switch wants to send data to&#xA;  the Internet (via the router), the computer will first encapsulate the&#xA;  data into a frame since it knows that it is attached to a switch and&#xA;  switches can only forward frames (correct?). So this computer will&#xA;  only use protocols in the Data Link layers (and not the network and&#xA;  physical layer right?).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. The computer has no idea what it's connected to.  As I said, computers generate data from applications and that data is encapsulated in lower layers until it is sent on the wire (or radio if wireless).  This will happen regardless of whatever device is on the other end. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Then the switch will forward the frame to the router (where the data&#xA;  link protocol's on the router will unpack the frame) and then the&#xA;  network protocols on the router will route the packet using the IP&#xA;  address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This part is essentially correct.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Now since the computer that sent the frame was attached to a switch is&#xA;  there an IP address in the frame sent to by the computer?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Assuming TCP/IP, the frame has encapsulated the network and upper layers.  So the IP address is in the IP packet which is encapsulated inside the data-link layer (Ethernet).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-05T11:24:10.790" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36315" PostTypeId="1" CreationDate="2016-11-05T13:42:05.877" Score="1" ViewCount="1623" Body="&lt;p&gt;I'm trying to configure two Site to Site VPNs from one Cisco ASA 5585x to two separate FWs with different ISPs. I found that multiple peer IP addresses can be configured under ASDM, Configuration &gt; Site-to-Site VPN &gt; Advanced &gt; Crypto Maps... Editing crypto map and adding a secondary IP address. These peers need to be configured with matching crypto map and isakmp setting to the tunnel to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will this work?&lt;/p&gt;&#xA;" OwnerUserId="31839" LastEditorUserId="8499" LastEditDate="2016-11-05T14:53:24.137" LastActivityDate="2018-04-30T10:26:38.640" Title="Configuring redundancy Site to Site VPNs with different ISPs" Tags="|cisco-asa|redundancy|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36316" PostTypeId="2" ParentId="36303" CreationDate="2016-11-05T14:37:27.503" Score="1" Body="&lt;p&gt;Switches don't normally have MAC addresses assigned to the access ports because switches are transparent devices. The switch itself has one or more MAC addresses internally that it will use for things like STP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is a layer-3 switch, and you can change an access port into a router port, then the switch supervisor will assign a MAC address to the port.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-05T14:37:27.503" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36319" PostTypeId="2" ParentId="33813" CreationDate="2016-11-05T17:50:41.860" Score="1" Body="&lt;p&gt;It looks like it is possible to configure VRRP as active/active when used with MC-LAG.  See this document: &#xA;&lt;a href=&quot;https://www.juniper.net/techpubs/en_US/release-independent/nce/information-products/pathway-pages/nce/nce-145-mc-lag-ex-core-campus.pdf#page8&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.juniper.net/techpubs/en_US/release-independent/nce/information-products/pathway-pages/nce/nce-145-mc-lag-ex-core-campus.pdf#page8&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-11-05T17:50:41.860" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36320" PostTypeId="1" AcceptedAnswerId="36322" CreationDate="2016-11-05T17:52:13.960" Score="0" ViewCount="3829" Body="&lt;p&gt;I have some doubt in the problem which follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose a host with IP address 19.121.202.123 wants to send a packet to all the hosts in the same network. Then, what destination address should it use?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I think it should be 19.255.255.255, but I am not getting the meaning of &quot;same network&quot; here? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help?&lt;/p&gt;&#xA;" OwnerUserId="31370" LastEditorUserId="8499" LastEditDate="2016-11-05T18:06:45.407" LastActivityDate="2016-11-05T18:08:08.580" Title="What is the Destination Address?" Tags="|ipv4|subnet|broadcast|" AnswerCount="1" CommentCount="2" ClosedDate="2016-11-05T18:20:10.650" ContentLicense="CC BY-SA 3.0" />
  <row Id="36322" PostTypeId="2" ParentId="36320" CreationDate="2016-11-05T18:02:14.647" Score="1" Body="&lt;p&gt;See &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;this answer&lt;/a&gt;, and understand that you need both an address and mask to determine the network, then the broadcast address is the last address in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mask the address with the mask (logical &lt;code&gt;AND&lt;/code&gt;) to get the network, and you set all the host bits to &lt;code&gt;1&lt;/code&gt; to get the broadcast address. You need to convert the address and mask to binary, do your calculations, the convert it back to decimal. Not everything will line up nicely with the decimal points in a text representation of an IPv4 address, and not doing it in binary will cause you problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network is any address with the same networks bits. Any combinations of host bits with the same network bits are in the same network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-11-05T18:08:08.580" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36323" PostTypeId="2" ParentId="2940" CreationDate="2016-11-05T20:20:58.713" Score="1" Body="&lt;p&gt;Generally such kind of incidents are prevented before they create a conflict. &lt;br&gt;&#xA;Gratuitous ARP helps the host to determine if another host is already using a particular IP address. Sending host is not expecting the reply, implying that the given address is not being used by another host. If a reply is received an error message &quot;Duplicate IP address... &quot; is displayed. This is a warning signal for mis-configuration. This don't provide any reaction scheme to deal with the issue.&lt;br&gt;&lt;br&gt;&#xA;DHCP servers generally perform Address Conflict Detection (ACD) [RFC5227] to avoid such conflicts. It comprise of ARP probe and ARP announcement packets. &lt;strong&gt;ARP probe&lt;/strong&gt; is a special kind of ARP packet in which Sender's Protocol Address field is set to 0. This is done to avoid cache pollution. On the other hand &lt;strong&gt;ARP announcement&lt;/strong&gt; is similar to ARP probe, but has Sender's Protocol Address and Target Protocol Address fields filled. It is used to announce sender's intention to use corresponding IP address.&lt;br&gt;&#xA;When a new interface link is established, three ARP probe packets are send prior to waiting for a random time (range 0-1). While these probes are being send the node might receive &lt;em&gt;ARP requests&lt;/em&gt; OR &lt;em&gt;replies&lt;/em&gt;. A &lt;strong&gt;reply&lt;/strong&gt; indicates the the presence of another node using the given IP address. A &lt;strong&gt;request&lt;/strong&gt; containing the same IP address in it's target protocol address field implies that another node is trying to acquire the same IP address. In both the cases an error message is displayed and alternative IP address is pursued. &lt;em&gt;This is recommended behavior when addresses are being assigned by DHCP&lt;/em&gt;. If sending node don't discover any conflict then it can claim the IP address that filled the Sender's Protocol Address. &lt;/p&gt;&#xA;" OwnerUserId="31720" LastActivityDate="2016-11-05T20:20:58.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36324" PostTypeId="1" AcceptedAnswerId="36328" CreationDate="2016-11-05T20:36:54.197" Score="1" ViewCount="1681" Body="&lt;p&gt;I would like to learn how can loops occur in static routing? Plus if someone can give some example scenarios I would be glad.&lt;/p&gt;&#xA;" OwnerUserId="31578" LastActivityDate="2016-11-05T21:45:41.980" Title="How can loops occur in static routing?" Tags="|routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36328" PostTypeId="2" ParentId="36324" CreationDate="2016-11-05T21:45:41.980" Score="4" Body="&lt;p&gt;The most trivial example is when router A has a static route (for a certain network) that has router B as next hop, and router B has a static route (for the same network) with router A as next hop, then you have a loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So router A:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface serial0&#xA;  description Link to router B&#xA;  ip address 10.0.0.1 255.255.255.252&#xA;&#xA;ip route 192.168.0.0 255.255.0.0 10.0.0.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And router B:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface serial0&#xA;  description Link to router A&#xA;  ip address 10.0.0.2 255.255.255.252&#xA;&#xA;ip route 192.168.0.0 255.255.0.0 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, when either A or B receives a packets destined for 192.168.x.x the packet will loop between A and B until the TTL expires.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-11-05T21:45:41.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36329" PostTypeId="2" ParentId="36315" CreationDate="2016-11-05T21:54:08.797" Score="2" Body="&lt;p&gt;Yes this will work if you use IKEv1. IKEv2 with multiple peers in the same crypto map entry is currently not supported on ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this scenario will &lt;em&gt;not&lt;/em&gt; create 2 simultaneous tunnels. The ASA will attempt to set up a tunnel to the primary peer, and if that fails, will try to set up a tunnel to the secondary peer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that the remote ASAs will have to do RRI (reverse route injection) to make sure that the return traffic flows through the ASA with the active tunnel.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-11-05T21:54:08.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36331" PostTypeId="1" CreationDate="2016-11-06T02:19:39.653" Score="1" ViewCount="645" Body="&lt;p&gt;I know ICMP uses IP datagrams to reply to echo requests but what is above that?&lt;/p&gt;&#xA;" OwnerUserId="31859" LastEditorUserId="8499" LastEditDate="2018-10-20T04:18:23.493" LastActivityDate="2018-10-20T20:55:15.287" Title="What high level (above IP) protocol is used to return a response to an ICMP echo request?" Tags="|ip|protocol-theory|icmp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36332" PostTypeId="2" ParentId="36331" CreationDate="2016-11-06T02:26:28.913" Score="1" Body="&lt;p&gt;ICMP is actually part of IP. There is no protocol above IP that responds to an ICMP Echo Request. ICMP itself, as part of IP, responds with the ICMP Echo Reply. From &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc792&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 792 INTERNET CONTROL MESSAGE PROTOCOL&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ICMP, uses the basic support of IP as if it were a higher level&#xA;protocol, however, ICMP is actually an integral part of IP, and must&#xA;be implemented by every IP module.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-11-06T02:32:26.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36333" PostTypeId="1" CreationDate="2016-11-06T05:14:37.400" Score="1" ViewCount="779" Body="&lt;p&gt;I am trying to understand SNMP protocol. I have clear understanding how &lt;code&gt;SNMP&lt;/code&gt; works on network level. &#xA;We can send UDP request to device, but on this device &lt;code&gt;snmpd&lt;/code&gt; should listen for incoming requests. &#xA;But I cannot understand MIB &amp;amp; OID. &#xA;I understand that MIB is tree structured database that contains hierarchy of different objects with unique IDs (OID). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ixGY5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ixGY5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I cannot understand following.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is MIB unique to device ? As far as I understand to get you own branch/node in &lt;code&gt;MIB&lt;/code&gt; tree as a vendor, you have to send request to specific organization. This is like DNS system. But again the question is, does specific device contain only specific mib part that is related to this device ?&lt;/li&gt;&#xA;&lt;li&gt;But as I've read snmp device contains full database MIB, so why this is required, if device can respond only to specific OID ? What happens when SNMP request is sent to device but there no such information available on the device ?&lt;/li&gt;&#xA;&lt;li&gt;How MIB is maintained ? As I understand if we have full copy of current MIB(defined by standard), MIB itself like a directories structure. So mib objects are modified directly in .mib file or .mib file is just pointer and structure representation and data store somewhere else ?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would be grateful for any inforamtion that will help me to understand this.&lt;/p&gt;&#xA;" OwnerUserId="31860" LastActivityDate="2016-11-07T12:24:52.293" Title="SNMP protocol MIBs &amp; OIDs" Tags="|snmp|udp|monitoring|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36336" PostTypeId="1" AcceptedAnswerId="36337" CreationDate="2016-11-06T15:25:23.100" Score="1" ViewCount="130" Body="&lt;p&gt;Im using a Cisco Asa 5505 but I don't think it has anything to do with the my issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 VLAN:s on my ASA Inside(192.168.1.) and DMZ(10.10.0.). In my DMZ I have one host that is used as a PPTP/VPN client, its basically connected to a VPN 24/7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue im having is that I can't connect directly from the &lt;strong&gt;inside&lt;/strong&gt; network to the host while it is connected to a VPN connection? (if the host is not connected to VPN it works)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I use a jumpserver that resides in the DMZ zone, this works and I can connect from inside-&gt;jumpserver-&gt;VPN client server, while it's connected to a vpn connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I want to be able to connect to the host while its connected to VPN without using the jumpserver first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible? if so how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And why can only hosts that resides on the same subnet connect to the host while it's connected to VPN?&lt;/p&gt;&#xA;" OwnerUserId="31866" LastActivityDate="2016-11-06T17:40:06.650" Title="Outbound VPN connection from DMZ, without using jumpserver" Tags="|cisco-asa|vpn|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36337" PostTypeId="2" ParentId="36336" CreationDate="2016-11-06T17:40:06.650" Score="2" Body="&lt;p&gt;This is probably because the vpn client routes everything except the local subnet, over the tunnel. To solve this you either need to configure the vpn head end to do split tunneling, or configure the asa to do NAT from inside to dmz.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-11-06T17:40:06.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36338" PostTypeId="2" ParentId="36245" CreationDate="2016-11-07T00:23:39.813" Score="0" Body="&lt;p&gt;The physical port speed is signified by the interface type name.  In your case, &lt;code&gt;int Fa0/4&lt;/code&gt; means &lt;code&gt;interface FastEthernet 0/4&lt;/code&gt;.  Fast Ethernet means 100Mbps. However, a subrate Ethernet port can be achieved with the &lt;code&gt;speed&lt;/code&gt; command.  The hardware speed (full or subrate) is often called the &lt;em&gt;port speed&lt;/em&gt;.  The &lt;em&gt;circuit&lt;/em&gt; speed can be configured with traffic shaping or policing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that's 2 distinct keys terms, port speed and circuit speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try &lt;a href=&quot;https://www.ietf.org/rfc/rfc3273.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;mediaIndependentInputSpeed&lt;/a&gt; or &lt;a href=&quot;ftp://ftp.cisco.com/pub/mibs/v2/CISCO-IF-EXTENSION-MIB.my&quot; rel=&quot;nofollow noreferrer&quot;&gt;CISCO-IF-EXTENSION-MIB&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-11-08T01:13:13.307" LastActivityDate="2016-11-08T01:13:13.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36339" PostTypeId="2" ParentId="36331" CreationDate="2016-11-07T00:42:51.710" Score="1" Body="&lt;p&gt;ICMP is a protocol itself.  See &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;INTERNET CONTROL MESSAGE PROTOCOL&lt;/a&gt;.  There is no higher level protocol required.  For example, in Cisco IOS, some ICMP access lists look like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 102 permit icmp any any echo-reply&#xA;access-list 100 permit icmp 192.168.1.0 0.0.0.255 any echo&#xA;access-list 100 permit icmp any 192.168.1.0 0.0.0.255 echo-reply&#xA;access-list 100 deny icmp 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255 time-exceeded&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice port numbers are not specified because there are none.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-07T00:42:51.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36340" PostTypeId="1" AcceptedAnswerId="36343" CreationDate="2016-11-07T02:33:00.163" Score="1" ViewCount="621" Body="&lt;p&gt;I have an ASA I set up for a non profit org which is not passing traffic. Packet tracer gives me mixed results depending on where the traffic is coming from, the two results are that the traffic is being dropped by an ACL and the other that it is a NAT issue. Im sure its something obvious that im missing. I can get to certain sites like youtube and google drive but not others such as dropbox or gmail. They stream live to youtube without issues as well. Im inclining towards it being a problem with traffic getting back in from the outside interface to the inside interface. Here is the current config. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;:&#xA;ASA Version 8.0(3)&#xA;!&#xA;hostname ASANAME&#xA;domain-name abcd.org&#xA;enable password xxxxxxxxxxxxxxxxxxx encrypted&#xA;names&#xA;name 172.20.10.1 ASANAME&#xA;!&#xA;interface Vlan1&#xA; nameif dmz&#xA; security-level 50&#xA; ip address 10.10.10.1 255.255.255.0&#xA;!&#xA;interface Vlan10&#xA; description to INSIDE VLAN&#xA; nameif INSIDE&#xA; security-level 100&#xA; ip address ASANAME 255.255.255.0&#xA;!&#xA;interface Vlan100&#xA; description to OUTSIDE interface&#xA; nameif OUTSIDE&#xA; security-level 0&#xA; ip address dhcp setroute&#xA;!&#xA;interface Ethernet0/0&#xA; description physical connection to Cablemodem&#xA; switchport access vlan 100&#xA;!&#xA;interface Ethernet0/1&#xA; description TRON_NET&#xA; switchport access vlan 10&#xA;!&#xA;interface Ethernet0/2&#xA; description WF&#xA; switchport access vlan 10&#xA;!&#xA;interface Ethernet0/3&#xA; description PR&#xA; switchport access vlan 10&#xA;!&#xA;interface Ethernet0/4&#xA; switchport access vlan 10&#xA;!&#xA;interface Ethernet0/5&#xA; switchport access vlan 10&#xA;!&#xA;interface Ethernet0/6&#xA; switchport access vlan 10&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;passwd Vy9tC77pJs8BycTr encrypted&#xA;banner motd&#xA;banner motd +-+&#xA;banner motd | |&#xA;banner motd | *** Unauthorized Use or Access Prohibited *** |&#xA;banner motd | |&#xA;banner motd | For Authorized Official Use Only |&#xA;banner motd | You must have explicit permission to access or |&#xA;banner motd | configure this device. All activities performed |&#xA;banner motd | on this device may be logged, and violations of |&#xA;banner motd | this policy may result in disciplinary action, and |&#xA;banner motd | may be reported to law enforcement authorities. |&#xA;banner motd | |&#xA;banner motd | There is no right to privacy on this device. |&#xA;banner motd | |&#xA;banner motd +-+&#xA;banner motd&#xA;ftp mode passive&#xA;clock timezone EDT -5&#xA;clock summer-time EDT recurring&#xA;dns domain-lookup INSIDE&#xA;dns domain-lookup OUTSIDE&#xA;dns server-group DefaultDNS&#xA; name-server 75.75.75.75&#xA; name-server 8.8.8.8&#xA; domain-name lldm.org&#xA;object-group icmp-type DefaultICMP&#xA; description Default ICMP Types permitted&#xA; icmp-object echo-reply&#xA; icmp-object unreachable&#xA; icmp-object time-exceeded&#xA;object-group service DM_INLINE_TCP_1 tcp&#xA; port-object eq ssh&#xA; port-object eq telnet&#xA;object-group service DropBox tcp&#xA; port-object eq 17500&#xA; port-object eq 17600&#xA; port-object eq 17603&#xA; port-object eq www&#xA; port-object eq https&#xA;object-group service RTMP_Streaming tcp&#xA; description Used to stream to youtube&#xA; port-object eq 1935&#xA; port-object eq www&#xA; port-object eq https&#xA;object-group service TeamViewer&#xA; service-object tcp-udp eq www&#xA; service-object tcp eq 5938&#xA; service-object tcp eq www&#xA;object-group protocol TCPUDP&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group service DM_INLINE_SERVICE_1&#xA; service-object tcp-udp eq www&#xA; service-object tcp eq www&#xA; service-object tcp eq https&#xA; service-object tcp eq domain&#xA; service-object udp eq domain&#xA;object-group service DM_INLINE_SERVICE_2&#xA; service-object ip&#xA; service-object tcp-udp eq domain&#xA; service-object tcp-udp eq www&#xA; service-object tcp eq https&#xA;access-list ACL_INSIDE_OUT extended permit ip any any log&#xA;access-list ACL_INSIDE_OUT extended permit udp any any log&#xA;access-list ACL_INSIDE_OUT extended permit tcp any any log&#xA;access-list ACL_INSIDE_OUT extended permit tcp any any eq https log&#xA;access-list ACL_INSIDE_OUT extended permit tcp any any eq domain log&#xA;access-list ACL_INSIDE_OUT extended permit icmp any any echo&#xA;access-list ACL_INSIDE_OUT extended permit tcp any any eq www log&#xA;access-list ACL_INSIDE_IN extended permit ip any any log&#xA;access-list ACL_OUTSIDE_OUT extended permit ip any any log&#xA;access-list ACL_OUTSIDE_OUT extended permit udp any any log&#xA;access-list ACL_OUTSIDE_OUT extended permit tcp any any log&#xA;access-list ACL_OUTSIDE_OUT extended permit tcp any any eq www log&#xA;access-list ACL_OUTSIDE_OUT extended permit tcp any any eq https log&#xA;access-list ACL_OUTSIDE_OUT extended permit tcp any any eq domain log&#xA;access-list ACL_OUTSIDE_OUT extended permit icmp any any echo&#xA;access-list ACL_OUTSIDE_IN extended permit ip any any log&#xA;access-list ACL_OUTSIDE_IN extended permit udp any any log&#xA;access-list ACL_OUTSIDE_IN extended permit tcp any any log&#xA;access-list ACL_OUTSIDE_IN extended deny tcp any any object-group DM_INLINE_TCP_1 log warnings inactive&#xA;access-list OUTSIDE_ACL extended permit object-group TCPUDP any any eq domain&#xA;access-list OUTSIDE_ACL extended permit tcp any any object-group RTMP_Streaming&#xA;access-list OUTSIDE_ACL extended permit object-group TeamViewer any any&#xA;access-list OUTSIDE_ACL extended permit tcp any any object-group DropBox&#xA;access-list OUTSIDE_ACL extended permit ip 172.20.10.0 255.255.255.0 any log&#xA;access-list OUTSIDE_ACL extended permit ip any 172.20.10.0 255.255.255.0 log&#xA;access-list OUTSIDE_ACL extended permit tcp 172.20.10.0 255.255.255.0 any log&#xA;access-list OUTSIDE_ACL extended permit tcp any 172.20.10.0 255.255.255.0 log&#xA;access-list OUTSIDE_ACL extended permit udp any 172.20.10.0 255.255.255.0 log&#xA;access-list OUTSIDE_ACL extended permit udp 172.20.10.0 255.255.255.0 any log&#xA;access-list INSIDE_nat_outbound extended permit object-group DM_INLINE_SERVICE_1 172.20.10.0 255.255.255.0 any&#xA;access-list INSIDE_nat_outbound extended permit object-group DM_INLINE_SERVICE_2 any 172.20.10.0 255.255.255.0&#xA;access-list INSIDE_access_in extended permit ip any any&#xA;pager lines 24&#xA;logging enable&#xA;logging timestamp&#xA;logging monitor informational&#xA;logging buffered informational&#xA;logging history warnings&#xA;logging asdm informational&#xA;mtu INSIDE 1500&#xA;mtu OUTSIDE 1500&#xA;mtu dmz 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-603.bin&#xA;asdm history enable&#xA;arp timeout 14400&#xA;global (OUTSIDE) 1 interface&#xA;nat (INSIDE) 1 172.20.10.0 255.255.255.0&#xA;access-group INSIDE_access_in in interface INSIDE&#xA;access-group OUTSIDE_ACL in interface OUTSIDE&#xA;route OUTSIDE 0.0.0.0 0.0.0.0 LANCASA 1&#xA;route INSIDE 172.168.20.0 255.255.255.0 LANCASA 1&#xA;route INSIDE 192.168.1.0 255.255.255.0 LANCASA 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout uauth 0:05:00 absolute&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;aaa authentication ssh console LOCAL&#xA;aaa authentication http console LOCAL&#xA;aaa authentication serial console LOCAL&#xA;aaa authentication telnet console LOCAL&#xA;aaa authentication enable console LOCAL&#xA;http server enable&#xA;http xxxxxxxxxxxxxx 255.255.255.255 OUTSIDE&#xA;http xxxxxxxxxxxxxx 255.255.255.0 INSIDE&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;telnet timeout 5&#xA;ssh xxxxxxx xxxxxxx INSIDE&#xA;ssh xxxxxxx xxxxxxxx OUTSIDE&#xA;ssh timeout 59&#xA;ssh version 2&#xA;console timeout 0&#xA;dhcpd dns 208.67.222.222 208.67.220.220&#xA;dhcpd lease 691200&#xA;dhcpd domain abcd.ORG&#xA;!&#xA;dhcpd address 172.20.10.100-172.20.10.131 INSIDE&#xA;dhcpd dns 75.75.75.75 75.75.76.76 interface INSIDE&#xA;dhcpd lease 1048575 interface INSIDE&#xA;dhcpd domain abcd.org interface INSIDE&#xA;dhcpd enable INSIDE&#xA;!&#xA;&#xA;no threat-detection basic-threat&#xA;threat-detection statistics&#xA;username xxxxxx password xxxxxxxxxxxxxxxxxxxx encrypted privilege 15&#xA;!&#xA;!&#xA;prompt hostname context&#xA;Cryptochecksum:xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14372" LastEditorDisplayName="user36472" LastEditDate="2018-02-14T16:37:59.627" LastActivityDate="2018-02-14T16:37:59.627" Title="ASA wont pass all traffic" Tags="|cisco-asa|nat|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36343" PostTypeId="2" ParentId="36340" CreationDate="2016-11-07T03:43:51.287" Score="1" Body="&lt;p&gt;So I started spinning in circles which brought me to the route table...For some reason I had 2 default routes and one static which had a mistyped network and pointed to a routable address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first route outlined in red is set via the host name of the ASA which is the default gateway for my Inside network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second route outlined in red is a default to the host name of the asa, which is a private IP not routable. So whenever I would hit certain IP's most of the time it was probably hitting that route which would send that traffic back to the INSIDE interface and never get anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed that my ACL on the INSIDE network was getting alot of hits on its incoming ACL entries but nothing on the OUTSIDE ACL, that sort of tipped me off. Everything is working now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3Ggq1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3Ggq1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14372" LastActivityDate="2016-11-07T03:43:51.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36345" PostTypeId="2" ParentId="36293" CreationDate="2016-11-07T06:30:51.623" Score="2" Body="&lt;p&gt;I was able to solve the problem. The issue was indeed on the outgoing port as suggested in the comments above. Whatever it's worth a few findings along the way of solving this problem:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;first understand the network topology. Nobody can help you before you did that exercise yourself. You cannot ask for punctual help if you don't understand the big picture first&lt;/li&gt;&#xA;&lt;li&gt;no, there doesn't seem a way to see if an arp packet is sent to a specific interface&lt;/li&gt;&#xA;&lt;li&gt;on some switches tcpdump didn't show the arp packages. &lt;a href=&quot;https://eos.arista.com/forum/tcpdump-doesnt-show-traffic/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This thread&lt;/a&gt; explains that only packets show up that go through the cpu of the switch. This is the case if the packets originate from the switch or are destined for the switch or the advanced tracking is turned on (which was probably my case as the switches where it did show up are running on version 4.15.x of Aristas EOS and the ones which didn't show the arp packages were running 4.12.x)&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;for debugging vlans it's helpful to set up vlan interfaces along the way. In my case the Arista switch supports setting up an endpoint with an ip address like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan13&#xA;  ip address 192.168.42.17/24&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;doing this lets you do e.g. &lt;code&gt;arping 192.168.42.2 -I vlan13&lt;/code&gt; or simply &lt;code&gt;ping 192.168.42.2&lt;/code&gt; (the switch knows that this IP address is configured on vlan 13 and sends the pings over this vlan)&lt;/p&gt;&#xA;" OwnerUserId="31824" LastEditorUserId="31824" LastEditDate="2016-11-07T06:36:27.747" LastActivityDate="2016-11-07T06:36:27.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36346" PostTypeId="2" ParentId="36245" CreationDate="2016-11-07T08:10:20.743" Score="3" Body="&lt;p&gt;So I've just tried this on an older 3750 (&lt;code&gt;12.2(52)SE&lt;/code&gt;) and here's what I get - given the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet1/0/1&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 1,5,500&#xA; switchport mode trunk&#xA; bandwidth 5000&#xA; spanning-tree link-type point-to-point&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;SNMP gives back the bandwidth value for the &lt;code&gt;ifSpeed&lt;/code&gt; OID (bps):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IF-MIB::ifSpeed.10001 = Gauge32: 5000000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and a value of &lt;code&gt;5&lt;/code&gt; for the &lt;code&gt;ifHighSpeed&lt;/code&gt; (Mbps):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IF-MIB::ifHighSpeed.10001 = Gauge32: 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, knowing that the &lt;code&gt;ifIndex&lt;/code&gt; for &lt;code&gt;fa1/0/1&lt;/code&gt; is &lt;code&gt;10001&lt;/code&gt; on this switch, I walked the entire MIB grepping for that index number, and there isn't a single relevant OID that gives a return value of &lt;code&gt;100000000&lt;/code&gt; or &lt;code&gt;100&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, long story short, it doesn't look like it is possible to return the physical link speed when the &lt;code&gt;bandwidth&lt;/code&gt; parameter is set.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-11-07T08:10:20.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36349" PostTypeId="2" ParentId="36265" CreationDate="2016-11-07T09:43:05.443" Score="1" Body="&lt;p&gt;From your output, it looks like there are a couple of things wrong:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The &lt;code&gt;st0.0&lt;/code&gt; and &lt;code&gt;st0.1&lt;/code&gt; interfaces are what you connect to AWS over, however they are currently located in a zone &lt;code&gt;trust&lt;/code&gt; which has no security policies bound to it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;To resolve these, I would recommend the following changes (as a starting point):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rename security zones security-zone trust to AWS&#xA;set security policy from-zone Internal to-zone AWS policy TO-AWS match source-address any&#xA;set security policy from-zone Internal to-zone AWS policy TO-AWS match destination-address any&#xA;set security policy from-zone Internal to-zone AWS policy TO-AWS match application any&#xA;set security policy from-zone Internal to-zone AWS policy TO-AWS then permit&#xA;set security policy from-zone AWS to-zone Internal policy FROM-AWS match source-address any&#xA;set security policy from-zone AWS to-zone Internal policy FROM-AWS match destination-address any&#xA;set security policy from-zone AWS to-zone Internal policy FROM-AWS match application any&#xA;set security policy from-zone AWS to-zone Internal policy FROM-AWS then permit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;In your appended output, BGP is up, but you don't appear to be receiving any routes from AWS.  I'm not sure that you want to be sending a default route into AWS either.  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I would start with something simpler like just advertising the attached &lt;code&gt;vlan.1&lt;/code&gt; prefix:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set policy-options policy-statement DIRECT term DIRECT-INTERFACES from protocol direct&#xA;set policy-options policy-statement DIRECT term DIRECT-INTERFACES from interface vlan.1&#xA;set policy-options policy-statement DIRECT term DIRECT-INTERFACES then accept&#xA;set policy-options policy-statement DIRECT term REJECT then reject&#xA;delete protocols bgp group ebgp neighbor 169.254.44.65 export EXPORT-DEFAULT&#xA;delete protocols bgp group ebgp neighbor 169.254.47.145 export EXPORT-DEFAULT&#xA;set protocols bgp group ebgp neighbor 169.254.44.65 export DIRECT&#xA;set protocols bgp group ebgp neighbor 169.254.47.145 export DIRECT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;After that, you'll need to make sure you're propagating routes from your VPC within AWS (so that you receive them via BGP) - the rough process for this is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In the navigation pane, choose &lt;code&gt;Route Tables&lt;/code&gt;, and then select the route table (usually the main route table for the VPC).&lt;/li&gt;&#xA;&lt;li&gt;Click on the &lt;code&gt;Route Propagation&lt;/code&gt; tab in the &lt;code&gt;Details&lt;/code&gt; pane, click &lt;code&gt;Edit&lt;/code&gt;, pick the gateway and then &lt;code&gt;Save&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-11-07T09:43:05.443" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="36351" PostTypeId="2" ParentId="36333" CreationDate="2016-11-07T12:24:52.293" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;A device (or its SNMP Agent to be precise) can contain whatever objects it likes. Since many (networked) devices often share common objects (for instance related to the Ethernet interface) they make use of common defined objects, as found in common MIBs. For any unique device features it's not uncommon to have an enterprise MIB which defines only the objects specific to the unique device features. &lt;/li&gt;&#xA;&lt;li&gt;Any object not represented in the Agent will cause the Agent to return an error code (to the likes of OID does not exist).&lt;/li&gt;&#xA;&lt;li&gt;The MIB is mainly the definition of the OID and syntax of the objects as they can be addressed in the SNMP Agent. It is the Agent that retains the the objects values, usually through the use of callbacks into the rest of the software system.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2016-11-07T12:24:52.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36360" PostTypeId="1" CreationDate="2016-11-07T16:21:42.810" Score="2" ViewCount="1803" Body="&lt;p&gt;In a switched Ethernet network is there a use-case for having VLAN tags for frames that have a multicast MAC as destination address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot find a use-case because:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs are generally used for limiting the broadcast domain and for security, both of which can be achieved using multicast frames when there is a switch in the network which knows which multicast MAC address is reachable on which all ports.&lt;/p&gt;&#xA;" OwnerUserId="17704" LastEditorUserId="8499" LastEditDate="2016-11-07T22:31:12.840" LastActivityDate="2016-11-07T22:31:12.840" Title="Is a VLAN relevant for multicast frames?" Tags="|switch|vlan|ethernet|multicast|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36361" PostTypeId="2" ParentId="36360" CreationDate="2016-11-07T16:26:28.140" Score="1" Body="&lt;p&gt;Yes, they are relevant.  Multicast frames are layer 2 constructs, so they are still bound by the layer 2 domain.  You still need a router to forward multicast frames to another L2 domain.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-07T16:26:28.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36362" PostTypeId="2" ParentId="36360" CreationDate="2016-11-07T16:26:53.643" Score="1" Body="&lt;p&gt;Multicast is a form of broadcast at layer-2, and it is limited, just like broadcast, to a layer-2 domain (VLAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN tags are used on trunk interfaces so that the traffic for each VLAN can be distinguished from traffic for other VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast traffic on one VLAN will be confined to that VLAN, and any multicast traffic on a trunk will be tagged for the VLAN (except if it is on a native VLAN).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-07T16:26:53.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36364" PostTypeId="1" AcceptedAnswerId="36367" CreationDate="2016-11-07T17:15:00.083" Score="4" ViewCount="4695" Body="&lt;p&gt;I need to confirm my understanding of IPSEC phase 1. As per my understanding in the capture below, the first 2 messages are agreeing on the parameters, the next 2 are key exchange the final 2 is authenticating each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BeoQR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BeoQR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you at the packet 77, we see the field &quot;Key Exchange Data&quot;. Is is the actual DH key that is being exchanged?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase 1 seems to be a bit complicated to me. Can someone explain the phase 1 process by referencing the capture above. This is my configuration for your reference. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configs:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#show running-config | section crypto|isakmp|access-list&#xA;crypto isakmp policy 10&#xA; encr aes 192&#xA; hash sha384&#xA; authentication pre-share&#xA; group 5&#xA;crypto isakmp key cisco address 12.1.1.2&#xA;crypto ipsec transform-set ESP_AES_192_SHA1 esp-aes 192 esp-sha-hmac&#xA; mode tunnel&#xA;crypto map MAP1 local-address Loopback1&#xA;crypto map MAP1 10 ipsec-isakmp&#xA; set peer 12.1.1.2&#xA; set transform-set ESP_AES_192_SHA1&#xA; match address R1-R2&#xA;ip access-list extended R1-R2&#xA; permit ip 15.1.1.0 0.0.0.255 23.1.1.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#show running-config | section crypto|isakmp|access-list&#xA;crypto isakmp policy 10&#xA; encr aes 192&#xA; hash sha384&#xA; authentication pre-share&#xA; group 5&#xA;crypto isakmp key cisco address 1.1.1.1&#xA;crypto ipsec transform-set ESP_AES_192_SHA1 esp-aes 192 esp-sha-hmac&#xA; mode tunnel&#xA;crypto map MAP1 10 ipsec-isakmp&#xA; set peer 1.1.1.1&#xA; set transform-set ESP_AES_192_SHA1&#xA; match address R2-R1&#xA;ip access-list extended R2-R1&#xA; permit ip 23.1.1.0 0.0.0.255 15.1.1.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31597" LastEditorUserId="31597" LastEditDate="2016-11-07T17:20:00.247" LastActivityDate="2016-11-08T10:06:47.027" Title="ISAKMP packet captures" Tags="|ipsec|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36365" PostTypeId="1" AcceptedAnswerId="36527" CreationDate="2016-11-07T17:31:44.333" Score="3" ViewCount="4511" Body="&lt;p&gt;I want to divide my network into smaller segments.&lt;BR&gt;&#xA;I want to use our HPE FF 5700-40XG-2QSFP+ switch as the router.&#xA;It runs comware 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 101 for servers, using 10.101.0.0/16, interface ip 10.101.1.100&lt;BR&gt;&#xA;VLAN 102 for building A, using 10.102.0.0/16 interface ip 10.102.1.100&lt;BR&gt;&#xA;...&lt;BR&gt;&#xA;VLAN 105 for building D, using 10.105.0.0/16 interface ip 10.105.1.100&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment all VLANs can talk to each other.&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want:&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 102 to have access to VLAN 101&lt;BR&gt;&#xA;VLAN 103 to have access to VLAN 101&lt;BR&gt;&#xA;...&lt;BR&gt;&#xA;VLAN 105 to have access to VLAN 101&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I want to make sure they can not reach each other.&lt;BR&gt;&#xA;So no traffic from VLAN 102 to VLAN 103 or VLAN 104 etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to try this, but failed:&lt;BR&gt;&#xA;- create a VPN instance for each VLAN, so it will have its own routing table&lt;BR&gt;&#xA;- for each VPN instance: create a route between the VPN instance and the VPN instance of VLAN 101&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried doing it with policy based routing and ACL's but I was also not able to figure that out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe that's not the way to go, or maybe I'm not doing it right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Who can help me figure this out? It seems so basic..&lt;/p&gt;&#xA;" OwnerUserId="31900" LastEditorUserId="36720" LastEditDate="2020-01-02T13:56:53.970" LastActivityDate="2020-01-02T13:56:53.970" Title="hpe 5700 (comware 7) vlan routing" Tags="|routing|vlan|vpn|acl|hp-comware|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36367" PostTypeId="2" ParentId="36364" CreationDate="2016-11-07T18:42:09.147" Score="1" Body="&lt;p&gt;You posted a capture of an IKEv1 Main Mode negotiation. In this negotiation there are 6 messages, or 3 pairs of back-and-forth exchanges.&lt;/p&gt;&#xA;&lt;p&gt;The first exchange is the negotiation of the ISAKMP Policy Suite. The second exchange is the negotiation of &lt;a href=&quot;http://www.practicalnetworking.net/series/cryptography/diffie-hellman/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Diffie-Hellman&lt;/a&gt;. The third exchange is validating each peer has the proper authentication data (typically &lt;a href=&quot;http://www.practicalnetworking.net/series/cryptography/authentication/#psk&quot; rel=&quot;nofollow noreferrer&quot;&gt;pre-shared-keys&lt;/a&gt;, but can also be certificates).&lt;/p&gt;&#xA;&lt;p&gt;This is all goverened by RFC 2409, which explains a &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2409#section-5.4&quot; rel=&quot;nofollow noreferrer&quot;&gt;IKEv1 Main Mode exchange with Pre-Shared-Key authentication&lt;/a&gt; looks like this:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;Initiator                  Responder&#xA;----------                 -----------&#xA;HDR, SA             --&amp;gt;&#xA;                    &amp;lt;--    HDR, SA&#xA;&#xA;HDR, KE, Ni         --&amp;gt;&#xA;                    &amp;lt;--    HDR, KE, Nr&#xA;&#xA;HDR*, IDii, HASH_I  --&amp;gt;&#xA;                    &amp;lt;--    HDR*, IDir, HASH_R&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;h3&gt;Exchange 1&lt;/h3&gt;&#xA;&lt;p&gt;In the first exchange, the SA payload is what the peers use to suggest ISAKMP Policies (as the initiator), and to confirm the selected policy (as the responder).&lt;/p&gt;&#xA;&lt;h3&gt;Exchange 2&lt;/h3&gt;&#xA;&lt;p&gt;In the second exchange, there are two payloads: &lt;code&gt;KE&lt;/code&gt; and either &lt;code&gt;Ni&lt;/code&gt; or &lt;code&gt;Nr&lt;/code&gt; (i=initiator, r=responder).&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;KE&lt;/code&gt; value, which you have highlighted in your picture is the Diffie-Hellman Public key. Each party has their own, and this is where it is shared. In &lt;a href=&quot;http://www.practicalnetworking.net/series/cryptography/diffie-hellman/#dh-image&quot; rel=&quot;nofollow noreferrer&quot;&gt;this DH Illustration&lt;/a&gt;, this would be Alice and Bob sharing their values of &lt;code&gt;2&lt;/code&gt; and &lt;code&gt;9&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;This value will be combined with a Private value that each party generated (and never shared). The final result will be the Shared Secret, which is the final goal of the Diffie-Hellman exchange. The Shared Secret will then be used to derive Session Keys -- specifically, a &lt;a href=&quot;http://www.practicalnetworking.net/series/cryptography/symmetric-encryption/&quot; rel=&quot;nofollow noreferrer&quot;&gt;symmetric encryption key&lt;/a&gt; and an &lt;a href=&quot;http://www.practicalnetworking.net/series/cryptography/message-integrity/&quot; rel=&quot;nofollow noreferrer&quot;&gt;HMAC key&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Anyone eavesdropping will not be able to put together the final value because they don't have access to either of the private values that both parties generated.&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;Ni&lt;/code&gt; or &lt;code&gt;Nr&lt;/code&gt; values are what is known as a &lt;em&gt;Nonce&lt;/em&gt;. This is simply a random number generated by the Initiator and Responder that is used in &lt;a href=&quot;https://networkengineering.stackexchange.com/a/13473/3675&quot;&gt;generating keying material&lt;/a&gt;. The term &amp;quot;Nonce&amp;quot; sort-of stands for Number used Once (N+Once = nonce).&lt;/p&gt;&#xA;&lt;h3&gt;Exchange 3&lt;/h3&gt;&#xA;&lt;p&gt;In the final exchange, the &lt;code&gt;IDi&lt;/code&gt; and &lt;code&gt;HASH_&lt;/code&gt; values correlate to an &lt;strong&gt;Identity Method&lt;/strong&gt; and an &lt;strong&gt;Identity Hash&lt;/strong&gt;.  The &lt;code&gt;r&lt;/code&gt; and &lt;code&gt;i&lt;/code&gt; at the end of either of these payloads indicates the one sent by the Responder (&lt;code&gt;r&lt;/code&gt;) or sent by the Initiator (&lt;code&gt;i&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;These values are used to validate each Peer's identity. The way this is done with pre-shared-keys I've explained in &lt;a href=&quot;https://networkengineering.stackexchange.com/a/13473/3675&quot;&gt;another answer&lt;/a&gt;, but the crux of it is here:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;There are two items that are use to validate to each Peer that they both have the same PSK:  the &lt;strong&gt;Identity Method&lt;/strong&gt; and the &lt;strong&gt;Identity Hash&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;VPN Peers can choose to identify themselves by various methods; most commonly, peers will simply use their source IP address.  But they have the option to use a FQDN or Hostname.  Each of these, along with the correlating value for the chosen method, are what make up the Identity Method.  So for example, if I had the IP 5.5.5.5, and I wanted to use my IP address to identify myself, my &lt;strong&gt;ID Method&lt;/strong&gt; would effectively be &lt;strong&gt;[IP Address, 5.5.5.5]&lt;/strong&gt;.  &lt;em&gt;(Note:  BOTH values make up the entire ID Method)&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;The ID Method is then combined (using a PRF) with the Seed value we discussed earlier (SKEYID), and a few other values, to create the &lt;strong&gt;Identity Hash&lt;/strong&gt;.   Recall, that what went into creating SKEYID in the first place was the Pre-Shared-Key.&lt;/p&gt;&#xA;&lt;p&gt;The ID Method and ID Hash are then sent across the wire, and the other party attempts to re-create the ID Hash using the same formula.  If the receiver is able to re-create the same ID Hash, it proves to the receiver that the sender must have had the correct pre-shared-key.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;hr&gt;&#xA;&lt;p&gt;&lt;em&gt;&lt;strong&gt;TLDR&lt;/strong&gt;&lt;/em&gt; - The value you highlighted is the DH Public Key, which is the public value that will be combined by either party with a Private value (which is never shared) to created a DH Shared Secret (which is never shared).&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-11-07T18:42:09.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36368" PostTypeId="2" ParentId="36365" CreationDate="2016-11-07T21:16:14.473" Score="3" Body="&lt;p&gt;I believe you are over-complicating things. A VPN Instance in the HPE Comware world is essentially a VRF in the Cisco world... and you don't need a VRF to keep a few VLANs from talking to each other. Neither do you need Policy Routing. ACLs should work just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find the relevant HPE documentation here : &lt;a href=&quot;http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04565674&amp;amp;DocLang=en&amp;amp;docLocale=en_US&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=emr_na-c04565674&amp;amp;DocLang=en&amp;amp;docLocale=en_US&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, you would create an IPv4 advanced ACL and add two rules to it, one allowing traffic to VLAN 101, and the other denying everything else, and then apply it outbound on the vlan interfaces for vlans 102 to 105.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2016-11-07T21:16:14.473" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36369" PostTypeId="1" AcceptedAnswerId="36397" CreationDate="2016-11-07T23:11:33.827" Score="1" ViewCount="5846" Body="&lt;p&gt;I am trying to backup my configuration on a Juniper m120 OS version 10.1R1.8. I would prefer not to use the archival server configuration because a custom application will kick off backup and not the router itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My user's login class is &quot;super-user&quot; and therefore should have all permission bits set including &quot;secret&quot; unless I have misunderstood something.&#xA;&lt;a href=&quot;https://www.juniper.net/techpubs/software/junos-es/junos-es93/junos-es-admin-guide/login-classes.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.juniper.net/techpubs/software/junos-es/junos-es93/junos-es-admin-guide/login-classes.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;show configuration&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt;edit&#xA;#save my-config&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In either case, the root and user account passwords are encrypted in the output. What should I do? I appreciate your help!&lt;/p&gt;&#xA;" OwnerUserId="31911" LastActivityDate="2016-11-08T21:57:43.290" Title="Decrypt passwords in JunOS show configuration" Tags="|router|juniper|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36370" PostTypeId="2" ParentId="30296" CreationDate="2016-11-08T01:02:38.770" Score="1" Body="&lt;p&gt;You have not enabled telnet or ssh access to the vty ports.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#ip domain-name mydomain.com&#xA;R1(config)#username admin Password cisco&#xA;R1(config)#crypto key generate rsa&#xA;R1(config)#ip ssh version 2&#xA;R1(config)#ip ssh time-out 50&#xA;R1(config)#ip ssh authentication-retries 4&#xA;&#xA;R1(config)#line vty 0 4&#xA;R1(config-line)#transport input ssh telnet&#xA;R1(config-line)#password cisco&#xA;R1(config-line)#login &#xA;R1(config-line)#logging synchronous &#xA;R1(config-line)#exec-timeout 40&#xA;R1(config-line)#exit &#xA;R1(config)#wr mem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-08T01:02:38.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36371" PostTypeId="2" ParentId="36364" CreationDate="2016-11-08T01:07:12.060" Score="-1" Body="&lt;p&gt;I don't think you need a packet capture to see the negotiation.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;https://supportforums.cisco.com/document/12013476/crypto-map-based-ipsec-vpn-fundamentals-negotiation-and-configuration#Debugging&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Support Forums&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To narrow down debugging to one peer conditional debugging should be&#xA;  used.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;On IOS this is done by performing:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;debug crypto condition peer ipv4 ....&lt;/code&gt; Two major component can be&#xA;  debugged&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;debug crypto isakmp&lt;/code&gt; - information specific to ISAKMP exchange. This&#xA;  will contain information about main mode and quick mode negotiation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;code&gt;debug crypto ipsec&lt;/code&gt; - some phase 2 specific information can be found&#xA;  here.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-08T01:07:12.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36374" PostTypeId="1" AcceptedAnswerId="36384" CreationDate="2016-11-08T08:32:58.287" Score="1" ViewCount="237" Body="&lt;p&gt;Could you please advise with some ideas on how to setup a Switching lab in a production enviroment without harming the Production ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically I need 3 Cisco Switches where I can try some labs but they need to be connected to a production upstram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas ?&lt;/p&gt;&#xA;" OwnerUserId="29630" LastEditorUserId="8499" LastEditDate="2020-01-10T09:08:27.623" LastActivityDate="2020-01-10T09:08:27.623" Title="Cisco Switching Lab" Tags="|cisco|switch|switching|cisco-catalyst|lab|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36376" PostTypeId="2" ParentId="36364" CreationDate="2016-11-08T10:06:47.027" Score="1" Body="&lt;p&gt;Exchange 1 in the main mode is where the initiator suggests(M 1) the policy and the responder confirms with the selected one (M 2). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So messages 3 and 4 is (This is where I was confused) the exchange of the DH public keys (Highlighted part of my capture). These public keys are derived independently on both ends using the private value (exponent) that has never been shared between the peers. Combining this private value with the public key received at each end, mathematically both peers reach to derive the same shared secret key. The shared secret key is then used to further derive the session keys, that is the encryption and the HMAC key. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for taking the time to explain this Eddie. &lt;/p&gt;&#xA;" OwnerUserId="31597" LastActivityDate="2016-11-08T10:06:47.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36377" PostTypeId="1" AcceptedAnswerId="36383" CreationDate="2016-11-08T11:02:29.310" Score="1" ViewCount="996" Body="&lt;p&gt;I've a Cisco 3925 and it's not quite clear why an &quot;1000BASE-SX SFP&quot; entry is visible in the inventory. Is it only visible when the SX SFP is in use? (I've no chance to modify it.)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NAME: &quot;CISCO3925-CHASSIS&quot;, DESCR: &quot;CISCO3925-CHASSIS&quot;&#xA;PID: CISCO3925-CHASSIS , VID: V02&#xA;&#xA;NAME: &quot;Cisco Services Performance Engine 100 for Cisco 3900 ISR on Slot 0&quot;, DESCR: &quot;Cisco Services Performance Engine 100 for Cisco 3900 ISR&quot;&#xA;PID: C3900-SPE100/K9   , VID: V01&#xA;&#xA;**NAME: &quot;1000BASE-SX SFP&quot;, DESCR: &quot;1000BASE-SX SFP&quot;&#xA;PID: GLC-SX-MMD        , VID: 001**&#xA;&#xA;NAME: &quot;C3900 AC Power Supply 1&quot;, DESCR: &quot;C3900 AC Power Supply 1&quot;&#xA;PID: PWR-3900-AC       , VID: V02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gi0/0   &amp;lt;&amp;lt; RJ45&#xA;Gi0/1   &amp;lt;&amp;lt; Combo port using RJ45&#xA;Gi0/2   &amp;lt;&amp;lt; Combo port using SX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16778" LastEditorUserId="8499" LastEditDate="2018-12-25T02:58:26.580" LastActivityDate="2018-12-25T02:58:26.580" Title="How &quot;show inventory&quot; displays SX SFP?" Tags="|cisco|router|interface|hardware|transceiver|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36380" PostTypeId="1" AcceptedAnswerId="36382" CreationDate="2016-11-08T12:42:16.323" Score="2" ViewCount="669" Body="&lt;p&gt;I am trying to restore Cisco catalyst 4503E switch. When I turn on it I enter rommon mode? How to restore or fix this problem ? Unfortunately, I haven't a flash card. &#xA;Here is my screeenshots:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6I7uv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6I7uv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29533" LastActivityDate="2018-08-20T20:28:56.980" Title="How to upgrade or flash IOS on Cisco 4503E without flash?" Tags="|cisco|cisco-ios|cisco-catalyst|" AnswerCount="1" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36381" PostTypeId="1" CreationDate="2016-11-08T13:11:00.547" Score="0" ViewCount="1885" Body="&lt;p&gt;I have doubt regarding the swicthes of network.I want to know the power usage of the switches by changing the active number of ports. If I change the egress traffic ports(like port2 port3 etc.,)by taking the ingress port constant port1.Is this approach consume more power? or If I connect two or more sources and passing the traffic from ports 1-2 and ports 3-4 etc., will consume more power? Can you please explain this behaviour?&lt;/p&gt;&#xA;" OwnerUserId="31922" LastActivityDate="2017-07-06T18:30:16.770" Title="Power usage of ports of the Switch" Tags="|lan|cisco-catalyst|switching|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="36382" PostTypeId="2" ParentId="36380" CreationDate="2016-11-08T13:31:22.697" Score="3" Body="&lt;p&gt;A quick google search finds this:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-4000-series-switches/24061-149.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Recover a Cisco IOS Catalyst 4500/4000 Series Switch from a Corrupt or Missing Image or in Rommon Mode&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To summarise:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) First check if there is an image present in the (built-in) bootflash:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rommon &amp;gt;dir bootflash:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If there is, then try to boot it like this (obviously, replacing &quot;cat4000-is-mz.121-11b.EW&quot; with the name of the image you found using the &quot;dir&quot; command above):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rommon &amp;gt;boot bootflash:cat4000-is-mz.121-11b.EW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) If there is no image on the bootflash or it doesn't boot, then you will need to connect the management port of the SUP to a TFTP server, put a valid image on the TFTP server and use this procedure to boot from TFTP (and again, replace the ip addresses and image name to suit your setup of course):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; rommon &amp;gt;unset boot&#xA; rommon &amp;gt;set interface fa1 14.18.2.234 255.255.255.0&#xA; rommon &amp;gt;set ip route default 14.18.2.21&#xA; rommon &amp;gt;boot tftp://172.18.125.3/cat4000-is-mz.121-11b.EW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-11-08T13:31:22.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36383" PostTypeId="2" ParentId="36377" CreationDate="2016-11-08T13:52:44.373" Score="2" Body="&lt;p&gt;If you have an SFP module inserted, you will see the specific type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can choose to specifically use the inserted SFP, or choose to use the built-in copper connector, with the &lt;code&gt;media-type&lt;/code&gt; interface command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; media-type sfp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; media-type rj45&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-08T13:52:44.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36384" PostTypeId="2" ParentId="36374" CreationDate="2016-11-08T13:57:18.673" Score="0" Body="&lt;p&gt;Typically, companies will separate a lab from the production network using a firewall. The lab will be connected to the outside interface of the firewall. This lets someone on the production network access the lab, but the lab can only access what you specifically allow in the firewall on the production network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-08T13:57:18.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36386" PostTypeId="2" ParentId="36381" CreationDate="2016-11-08T15:00:03.767" Score="1" Body="&lt;p&gt;If you want to see power consumption of PoE, you can use &quot;show power inline&quot; command which will display power usage per port, plus total power and available power.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-11-08T15:00:03.767" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36389" PostTypeId="1" AcceptedAnswerId="36391" CreationDate="2016-11-08T17:52:07.573" Score="1" ViewCount="1889" Body="&lt;p&gt;We have a setup with 4 total sites all connected back to one, 2 via fiber and one via a wireless link.  The link with the wireless bridge also needs a vlan (269) from our main site, so we set it up as a trunk instead of a link.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;               4507-2&#xA;                 ^&#xA;                 |&#xA;WAN -&amp;gt; Sonicwall -&amp;gt; 4507 -&amp;gt; 3560&#xA;                 |&#xA;                 v&#xA;               4507-3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cannot ping from 3560 to Sonicwall or external.&#xA;Can ping from 3560 to all 4507 switches.&#xA;Can ping from Firewall to 3560.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4507 Configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/1&#xA; description *SONICWALL*&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; switchport nonegotiate&#xA; spanning-tree portfast&#xA;&#xA;interface GigabitEthernet2/46&#xA; description **Trunk to 3560**&#xA; switchport trunk allowed vlan 269,300&#xA; switchport mode trunk&#xA;&#xA;interface Vlan100&#xA; ip address 10.1.100.1 255.255.252.0&#xA; ip helper-address 10.1.104.10&#xA;&#xA;interface Vlan269&#xA; no ip address&#xA; shutdown&#xA;&#xA;interface Vlan300&#xA; ip address 172.20.20.9 255.255.255.252&#xA;&#xA;ip default-gateway 10.1.100.254&#xA;ip route 0.0.0.0 0.0.0.0 10.1.100.254&#xA;ip route 10.4.100.0 255.255.252.0 172.20.20.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3560 Configuration&#xA;    ip routing&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/24&#xA; description Trunk to 4507&#xA; switchport trunk encapsulation dot1q&#xA; switchport trunk allowed vlan 269,300&#xA; switchport mode trunk&#xA;&#xA;interface Vlan100&#xA; ip address 10.4.100.1 255.255.252.0&#xA; ip helper-address 10.1.104.10&#xA;&#xA;interface Vlan300&#xA; ip address 172.20.20.10 255.255.255.252&#xA;&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 172.20.20.9&#xA;ip route 10.1.100.0 255.255.252.0 172.20.20.9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4507 routes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;4507#sh ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 10.1.100.254 to network 0.0.0.0&#xA;&#xA;S    192.168.110.0/24 [1/0] via 10.1.104.180&#xA;     172.20.0.0/30 is subnetted, 3 subnets&#xA;C       172.20.20.8 is directly connected, Vlan300&#xA;     10.0.0.0/22 is subnetted, 20 subnets&#xA;S       10.4.100.0 [1/0] via 172.20.20.10&#xA;C       10.1.100.0 is directly connected, Vlan100&#xA;S*   0.0.0.0/0 [1/0] via 10.1.100.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3560 routes&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3560#sh ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 172.20.20.9 to network 0.0.0.0&#xA;&#xA;     172.20.0.0/30 is subnetted, 1 subnets&#xA;C       172.20.20.8 is directly connected, Vlan300&#xA;     10.0.0.0/22 is subnetted, 10 subnets&#xA;C       10.4.100.0 is directly connected, Vlan100&#xA;S       10.1.100.0 [1/0] via 172.20.20.9&#xA;S*   0.0.0.0/0 [1/0] via 172.20.20.9&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sonicwall also has a route for 10.4.100.0/22 to go to 10.4.100.1&lt;/p&gt;&#xA;" OwnerUserId="31908" LastActivityDate="2016-11-08T18:16:26.323" Title="Routing issues, can ping core switch but not firewall" Tags="|routing|switch|cisco-catalyst|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36391" PostTypeId="2" ParentId="36389" CreationDate="2016-11-08T18:07:17.760" Score="0" Body="&lt;p&gt;It looks like your problem may be the firewall route.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Sonicwall also has a route for 10.4.100.0/22 to go to 10.4.100.1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You need the firewall route to go to the next hop, &lt;code&gt;10.1.100.1&lt;/code&gt;, not to an address on the route itself. You are telling the firewall how to get to that network, and the address of the next hop for the network cannot be on the network itself because the firewall doesn't know how to get to the network where the next hop is, so the firewall cannot send anything to the next hop.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;My two cents, based on experience:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would actually have a routed link between the firewall and the layer-3 switch, rather than a VLAN, and run a routing protocol between all the layer-3 devices. Static routes just don't scale.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure the switch interfaces as layer-3 interfaces, and address them as point-to-point interfaces with &lt;code&gt;/30&lt;/code&gt; or &lt;code&gt;/31&lt;/code&gt; networks. You are using &lt;code&gt;/30&lt;/code&gt; networks on the SVI for the VLANs, but you can run into some problems with delayed detection of link problems using SVIs, and you don't have that if you address on the physical interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the 4507, instead of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/1&#xA; description *SONICWALL*&#xA; switchport access vlan 100&#xA; switchport mode access&#xA; switchport nonegotiate&#xA; spanning-tree portfast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Use something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/1&#xA; description *SONICWALL*&#xA; no switchport&#xA; ip address 172.20.20.13 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, understand that by extending layer-2 VLANs to a remote location, you increase the chances of a layer-2 problem, and the problem will affect two sites instead of one. There is almost nothing today that requires have two hosts on the same layer-2 domain. We live in a layer-3 world, and routing works well. I don't see any advantage to extending the VLAN to a remote location, but I do see some disadvantages to doing it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-08T18:16:26.323" LastActivityDate="2016-11-08T18:16:26.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36392" PostTypeId="1" CreationDate="2016-11-08T18:11:36.097" Score="1" ViewCount="486" Body="&lt;p&gt;I have the following topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 Edge Routers - each connecting to a different ISP via eBGP advertising the same PI space&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP running between the routers and switches for reachability.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the inside interface on both edge routers, I have &lt;code&gt;&quot;ip nat inside&quot;&lt;/code&gt; and on the ISP uplink interfaces, I have &lt;code&gt;&quot;ip nat outside&quot;&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I then have the following nat statements on both edge routers:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat pool POOLNAME x.x.x.54 x.x.x.70 netmask 255.255.255.128&#xA;ip nat inside source list 31 pool POOLNAME overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can see the nat translations on both edge routers from the respective subnet configured in access-list 31 however the traffic is not actually passing to the outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am also redistributing a default route from BGP into EIGRP on both edge routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE&lt;/strong&gt; - when I remove router2 from the equation, the traffic starts to pass via router1 perfectly fine again or if I connect ISP2 into router1, NAT'ing works as expected and passes traffic properly as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would be the reason for this and how can I fix so that both edge routers are NAT'ing properly to the outside?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="864" LastEditorUserId="8499" LastEditDate="2019-01-05T00:06:34.617" LastActivityDate="2019-01-05T00:06:34.617" Title="Dual router, Dual ISP NAT Issue" Tags="|cisco|routing|nat|bgp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36393" PostTypeId="2" ParentId="36392" CreationDate="2016-11-08T18:23:59.867" Score="1" Body="&lt;p&gt;The translation table on each router is independent from the translation table on the other router. It sounds like you have an asymmetric routing problem. You need the link between the routers to be outside interfaces so that return traffic coming into Router 1 for translation on Router 2 will pass through a Router 2 outside interface. Router 2 will not attempt to translate return traffic unless it passes through an outside interface on Router 2, and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your comments, you may be able to set up an interface, either virtual or physical, to the other router through your network. Set the interface as an outside interface, and create static routes to all the other router's outside interfaces through that interface. That will give the route an AD of &lt;code&gt;1&lt;/code&gt;, and it should be preferred over any inside routes to those interfaces on the other router. You could also run iBGP across that interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-08T18:59:04.650" LastActivityDate="2016-11-08T18:59:04.650" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36394" PostTypeId="1" CreationDate="2016-11-08T18:56:52.297" Score="1" ViewCount="249" Body="&lt;p&gt;Okay the issue i'm having at the moment is i've got a server stack connected to a switch. The switch is then connected to a router. That switch/router combo has been used and tested numerous times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now this router connects to another router via a BGP peer which then connects into the wider area network, sharing 200 or so BGP routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So R1 which is connected to my server stack can ping all the way through the network to any address it wishes to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However the server stack behind it cannot ping out. It can ping the local router interface, and the router interface connecting R1 to R2...but heres the strange part, it cannot ping the connection on R2. So to clarify it can ping 25.231.34.106 which is R1 g0/0 but cannot ping 25.231.34.105 which is R2 g0/0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also cannot ping further into the WAN. This is really throwing me at the moment and i'm convinced the config is correct. Below is some excerpts.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 65001  &#xA; network 25.141.156.0 mask 255.255.252.0  &#xA; neighbor 25.231.34.105 remote-as 65677  &#xA; neighbor 25.231.34.105 filter-list 150 out&#xA;&#xA;as-path access-list permit ^$&#xA;&#xA;ip route 0.0.0.0 0.0.0.0 25.231.34.105  &#xA;ip route 25.141.156.0 255.255.252.0 25.141.156.6 - Note .6 is the switch vlan.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To clarify, R1 has a full BGP routing table so connectivity from R1 to R2 is fine, it's just allowing my server stack and clients out through R1 that's the issue! I've used this config before and it has worked so i'm struggling to see what's causing this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice or guidance?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Current configuration : 15583 bytes&#xA;&#xA;version 15.1&#xA;no service pad&#xA;service tcp-keepalives-in&#xA;service tcp-keepalives-out&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec localtime show-timezone&#xA;service password-encryption&#xA;no service password-recovery&#xA;!&#xA;hostname Router1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no logging console&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;clock timezone GMT 0 0&#xA;!&#xA;no ipv6 cef&#xA;no ip source-route&#xA;no ip gratuitous-arps&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip bootp server&#xA;no ip domain lookup&#xA;ip domain name example.net&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip ssh version 2&#xA;ip scp server enable&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; duplex full&#xA; speed 100&#xA; no mop enabled&#xA;!&#xA;interface GigabitEthernet0/0.10&#xA; encapsulation dot1Q 10&#xA; ip address 8.2.156.1 255.255.255.248&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA;!&#xA;interface GigabitEthernet0/0.20&#xA; encapsulation dot1Q 20&#xA; ip address 8.2.156.98 255.255.255.192&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA;!&#xA;interface GigabitEthernet0/0.70&#xA; encapsulation dot1Q 70&#xA; ip address 8.2.156.9 255.255.255.248&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA;!&#xA;interface GigabitEthernet0/0.80&#xA; encapsulation dot1Q 80&#xA; ip address 8.2.156.22 255.255.255.248 secondary&#xA; ip address 8.2.156.18 255.255.255.248&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA;!&#xA;interface GigabitEthernet0/0.210&#xA; encapsulation dot1Q 210&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA;!&#xA;interface GigabitEthernet0/0.301&#xA; encapsulation dot1Q 301&#xA; ip address 8.2.157.129 255.255.255.240&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip mtu 1400&#xA; ip tcp adjust-mss 1360&#xA; duplex auto&#xA; speed auto&#xA; no mop enabled&#xA;!&#xA;interface GigabitEthernet0/0/0&#xA; no ip address&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; duplex auto&#xA; speed auto&#xA; no mop enabled&#xA;!&#xA;interface GigabitEthernet0/1/0&#xA; ip address 77.5.34.106 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip tcp adjust-mss 1300&#xA; duplex full&#xA; speed 100&#xA; media-type sfp&#xA; no cdp enable&#xA; no mop enabled&#xA;!&#xA;interface GigabitEthernet0/1/0&#xA; ip address 77.5.34.106 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip tcp adjust-mss 1300&#xA; duplex full&#xA; speed 100&#xA; media-type sfp&#xA; no cdp enable&#xA; no mop enabled&#xA;!&#xA;router bgp 64729&#xA; bgp log-neighbor-changes&#xA; network 8.2.156.0 mask 255.255.252.0&#xA; neighbor 77.5.34.105 remote-as 64613&#xA; neighbor 77.5.34.105 filter-list 150 out&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;ip as-path access-list 150 permit ^$&#xA;no ip http server&#xA;ip http access-class 80&#xA;ip http authentication aaa&#xA;ip http secure-server&#xA;ip http secure-port 8443&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 77.5.34.105&#xA;ip route 8.2.156.0 255.255.252.0 8.2.156.6&#xA;ip tacacs source-interface GigabitEthernet0/0.20&#xA;!&#xA;&#xA;access-list 8 permit 8.2.157.9&#xA;access-list 8 permit 8.2.157.10&#xA;access-list 8 permit 25.146.194.24&#xA;access-list 8 permit 8.2.157.128 0.0.0.15&#xA;access-list 8 deny   any log&#xA;access-list 80 permit 8.2.157.9&#xA;access-list 80 permit 8.2.157.10&#xA;access-list 80 permit 8.2.157.25&#xA;access-list 80 permit 8.2.156.130&#xA;access-list 80 permit 25.144.90.13&#xA;access-list 80 permit 25.144.90.12&#xA;access-list 80 permit 25.144.90.51&#xA;access-list 80 permit 25.144.90.50&#xA;access-list 80 permit 25.144.85.32 0.0.0.31&#xA;access-list 80 permit 25.144.101.32 0.0.0.31&#xA;access-list 80 permit 25.144.92.32 0.0.0.31&#xA;access-list 80 permit 25.149.202.128 0.0.0.127&#xA;access-list 80 permit 25.144.108.32 0.0.0.31&#xA;access-list 80 permit 25.149.181.128 0.0.0.127&#xA;access-list 80 deny   any log&#xA;access-list 110 permit tcp host 8.2.157.9 any eq 22&#xA;access-list 110 permit tcp host 8.2.157.10 any eq 22&#xA;access-list 110 permit tcp host 8.2.157.25 any eq 22&#xA;access-list 110 permit tcp host 8.2.156.130 any eq 22&#xA;access-list 110 permit tcp 8.2.157.128 0.0.0.15 any eq 22&#xA;access-list 110 permit tcp host 25.146.194.24 any eq 22&#xA;access-list 110 permit tcp 25.144.85.32 0.0.0.31 any eq 22&#xA;access-list 110 permit tcp 25.144.101.32 0.0.0.31 any eq 22&#xA;access-list 110 permit tcp 25.144.92.32 0.0.0.31 any eq 22&#xA;access-list 110 permit tcp 25.149.202.128 0.0.0.127 any eq 22&#xA;access-list 110 permit tcp 25.144.108.32 0.0.0.31 any eq 22&#xA;access-list 110 permit tcp 25.149.181.128 0.0.0.127 any eq 22&#xA;access-list 110 permit tcp host 25.144.90.12 any eq 22&#xA;access-list 110 permit tcp host 25.144.90.13 any eq 22&#xA;access-list 110 permit tcp host 25.144.90.50 any eq 22&#xA;access-list 110 permit tcp host 25.144.90.51 any eq 22&#xA;access-list 110 deny   ip any any log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eUsun.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eUsun.jpg&quot; alt=&quot;BGP Fault&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31929" LastEditorUserId="8499" LastEditDate="2019-01-04T21:53:27.787" LastActivityDate="2019-01-04T21:53:27.787" Title="BGP Routes - Cisco" Tags="|cisco|routing|bgp|" AnswerCount="1" CommentCount="19" ContentLicense="CC BY-SA 3.0" />
  <row Id="36397" PostTypeId="2" ParentId="36369" CreationDate="2016-11-08T21:57:43.290" Score="5" Body="&lt;p&gt;The string shown in the &lt;code&gt;password&lt;/code&gt; field of user and root accounts in the Junos configuration is not the password encrypted, but a salted MD5 hash of the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A hash by nature is a one-way function - in other words, there is no functional way to take a hash and convert it back to the original password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you log into the box, the password you enter is run through the same hashing algorithm (with the salt for that user account applied) and the results are compared - if they match, then Junos knows that the password you entered must be the same as the one that generated the hash that is stored in the configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the &lt;code&gt;secret&lt;/code&gt; permission bit in Junos: this allows you to view sections of the configuration that contain these hashes - if you do not have the &lt;code&gt;secret&lt;/code&gt; permission bit set, you will not see any of them - it does not show the original passwords.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure why you need to see the password in plaintext format even if you are backing up configuration?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you restore a backed up configuration to the box, the hash will remain the same and your password will continue to work.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-11-08T21:57:43.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36398" PostTypeId="1" CreationDate="2016-11-08T23:16:02.153" Score="1" ViewCount="414" Body="&lt;p&gt;In Cisco switches/routers or any other vendor, why the management interface is always a vlan IP interface and why not just fa 0/1 or fa 0/2 ip interface. What's the reason behind vlan ip interface for management purpose?&lt;/p&gt;&#xA;" OwnerUserId="13278" LastActivityDate="2016-11-08T23:51:39.890" Title="Why management interface is always vlan interface and not just physical interface?" Tags="|cisco|switch|vlan|management|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36399" PostTypeId="2" ParentId="36398" CreationDate="2016-11-08T23:39:11.100" Score="2" Body="&lt;p&gt;This depends on the model of device.  Some of them have dedicated physical management interfaces.  Others just use a vlan SVI interface.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-11-08T23:39:11.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36400" PostTypeId="2" ParentId="36394" CreationDate="2016-11-08T23:44:02.453" Score="2" Body="&lt;p&gt;You have some real problems, and it seems to stem from a misunderstanding of how BGP works. Putting a network statement in BGP doesn't guarantee that the prefix will be advertised to neighbors. The exact network must exist in the local routing table before BGP will advertise it. It looks like you are trying to advertise an aggregate address without doing it correctly. If you use the aggregate address command, only one of the networks encompassed by the aggregate address need exist in the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have a layer-2 connection to SW1, so you cannot simply point a route to the management address of SW1 for networks which are not on the same network as SW1. SW1 would need to be a layer-3 switch, and then you would only have a single routed link between R1 ans SW1. You would also need to either have a static default route on SW1 or run a routing protocol between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should not be using static routes for any directly connected networks. That can confuse the router. Also, you cannot have the next hop for a network to be on the network for which you are establishing the route. That doesn't work, and it doesn't make any sense. You should remove the static route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip route 25.141.156.0 255.255.252.0 25.141.156.6&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You have multiple network interfaces toward SW1 as VLANs. Those routes will exist in your local routing table.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA; ip address 25.141.156.1 255.255.255.224&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1.10&#xA; encapsulation dot1Q 10&#xA; ip address 25.141.156.98 255.255.255.224&#xA;!&#xA;interface FastEthernet0/1.20&#xA; encapsulation dot1Q 20&#xA; ip address 25.141.157.1 255.255.255.240&#xA;!&#xA;interface FastEthernet0/1.30&#xA; encapsulation dot1Q 30&#xA; ip address 25.141.157.140 255.255.255.192&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could have separate network statements in your BGP router configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 65001&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; network 25.141.156.0 mask 255.255.255.224&#xA; network 25.141.156.96 mask 255.255.252.224&#xA; network 25.141.157.0 mask 255.255.252.240&#xA; network 25.141.157.128 mask 255.255.252.192&#xA; neighbor 25.231.34.105 remote-as 65002&#xA; neighbor 25.231.34.105 filter-list 150 out&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You could use the &lt;code&gt;redistribute connected&lt;/code&gt; statement in your BGP router configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 65001&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; redistribute connected&#xA; neighbor 25.231.34.105 remote-as 65002&#xA; neighbor 25.231.34.105 filter-list 150 out&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you are bound and determined to only have one network statement, then you need to use the &lt;code&gt;aggregate-address&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 65001&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; aggregate-address 25.141.156.0 255.255.252.0&#xA; neighbor 25.231.34.105 remote-as 65002&#xA; neighbor 25.231.34.105 filter-list 150 out&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you want it to only advertise the single prefix, then use the &lt;code&gt;summary-only&lt;/code&gt; option:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 65001&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; aggregate-address 25.141.156.0 255.255.252.0 summary-only&#xA; neighbor 25.231.34.105 remote-as 65002&#xA; neighbor 25.231.34.105 filter-list 150 out&#xA; no auto-summary&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You really need access to R2 to see what the routing table is as you make these changes. As it stands, I don't believe that R2 has routes back to the networks on the other side of R1, so your pings from those networks &lt;em&gt;should&lt;/em&gt; fail to R2.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-09T00:28:51.853" LastActivityDate="2016-11-09T00:28:51.853" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="36401" PostTypeId="2" ParentId="36398" CreationDate="2016-11-08T23:51:39.890" Score="0" Body="&lt;p&gt;Also, besides what John K. wrote, if the switch can do layer-3, you &lt;em&gt;can&lt;/em&gt; use a routed interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA; no switchport&#xA; ip address 10.11.12.13 255.255.255.252&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you are running layer-2 to a router, then the only network you have between the switch and the rest of the network is either an address on one of the VLANs between the router and switch, or, as John K. says, some Cisco switches have a physical management interface that must be connected to somewhere else on the network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-08T23:51:39.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36402" PostTypeId="2" ParentId="34013" CreationDate="2016-11-09T01:53:02.913" Score="2" Body="&lt;p&gt;Very simple method:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;more &lt;a href=&quot;http://ifconfig.me/ip/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ifconfig.me/ip/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or if you don't have DNS lookup configured:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;more &lt;a href=&quot;http://153.121.72.212/ip/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://153.121.72.212/ip/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31939" LastActivityDate="2016-11-09T01:53:02.913" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36403" PostTypeId="1" AcceptedAnswerId="36507" CreationDate="2016-11-09T08:57:58.870" Score="1" ViewCount="644" Body="&lt;p&gt;I'm studying Private VLAN on C3560 Cisco Switch hardware. When i enter the &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-vlan)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It doesn't contain the &lt;code&gt;private-vlan&lt;/code&gt; command in the list of available commands. I turned the VTP mode to Transparent, VTP version = 1. VLAN 500 is created and active. IOS = 12.2(55)SE5. I followed this document in practiced [Catalyst 3560 Switch Software Configuration Guide, Release 12.2(55)SE]&#xA;Still don't know why. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/IRC3y.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IRC3y.png&quot; alt=&quot;ScreenShoot&quot;&gt;&lt;/a&gt;&#xA;The version is here.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/E5WKl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/E5WKl.png&quot; alt=&quot;Show version&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can i get through this situation? Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="25694" LastEditorUserId="25694" LastEditDate="2016-11-10T01:13:23.690" LastActivityDate="2016-11-13T06:28:33.983" Title="No Private VLAN commands Cisco C3560 switch" Tags="|cisco-catalyst|private-vlan|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="36404" PostTypeId="1" AcceptedAnswerId="36409" CreationDate="2016-11-09T09:14:27.040" Score="3" ViewCount="1229" Body="&lt;p&gt;I understand that the older versions of Cisco IOS implemented the MCQ and the newer one's implement HQF. Could some explain what is the difference between MQC and HQF? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you. &lt;/p&gt;&#xA;" OwnerUserId="31943" LastActivityDate="2016-11-09T12:25:42.043" Title="QoS - Difference between MQC and HQF" Tags="|qos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36409" PostTypeId="2" ParentId="36404" CreationDate="2016-11-09T12:25:42.043" Score="3" Body="&lt;p&gt;&lt;strong&gt;MQC&lt;/strong&gt; (Modular QoS CLI) is the CLI structure that allows you to enable QoS features in Cisco routers (see the &lt;a href=&quot;http://www.cisco.com/en/US/docs/ios/12_2/qos/configuration/guide/qcfmdcli.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;manual&lt;/a&gt;). It uses the following three steps to configure QoS:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Define a traffic class with the class-map command.&lt;/li&gt;&#xA;&lt;li&gt;Create a traffic policy by associating the traffic class with one or more QoS features (using the policy-map command).&lt;/li&gt;&#xA;&lt;li&gt;Attach the traffic policy to the interface with the service-policy command.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;HQC&lt;/strong&gt; (Hierarchical Queuing Framework) is an evolution of MQC that is introduced in IOS 12.4(20)T, that adds the following functionality (from the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/quality-of-service-qos/white_paper_c11-481499.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;white paper&lt;/a&gt;):&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The ability to provide multiple levels of packet scheduling&lt;/li&gt;&#xA;&lt;li&gt;The ability to support integrated class-based shaping and queuing&lt;/li&gt;&#xA;&lt;li&gt;The ability to apply fair queuing and drop policies on a per-class basis&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-11-09T12:25:42.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36410" PostTypeId="1" AcceptedAnswerId="36411" CreationDate="2016-11-09T12:33:38.700" Score="1" ViewCount="225" Body="&lt;p&gt;i have the network topology in the diagram below. i was given the Internal address block of 100.1.0.0 for assigning IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gHEIN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gHEIN.png&quot; alt=&quot;Topology Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 1&#xA;has a public ip address to the ISP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;router 2&#xA;i assigned it the network 100.1.7.0/24 which allows enough space for the 204 hosts&lt;/p&gt;&#xA;&#xA;&lt;p&gt;router 3&#xA;i assigned it the network 100.1.8.0/26 which allows enough space for the 50 hosts&lt;/p&gt;&#xA;&#xA;&lt;p&gt;router 4&#xA;connected to r1 and frame relay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;router 6&#xA;i assigned it the 4 networks 100.1.6.0/26, 100.1.6.64/26, 100.1.6.128/64, 100.1.6.192/64 which allows enough space for the 4 * 44 hosts networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;router 5&#xA;i assigned it the 6 networks 100.1.0.0/24, 100.1.1.0/24, 100.1.2.0/24 - 100.1.5.0/24 which allows enough space for the 6 * 210 hosts networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my question is what ip addresses should i assign the serial ports of r1 - r2, r1 - r3, r1 - r4, etc. &#xA;should i use another network(100.1.9.0) or use up free addresses in lets say the 100.1.8.0 block like 100.1.8.64/30, 100.1.8.68/30, 100.1.8.72/30 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what is good practice in this situation as i will be summarize the addresses for smaller routing tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the routing protocol i will be using will be OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 will be implementing Nat.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="31952" LastActivityDate="2016-11-09T12:45:04.300" Title="Best internal(private) ip addressing practices for serial connections (IPv4)" Tags="|best-practices|frame-relay|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36411" PostTypeId="2" ParentId="36410" CreationDate="2016-11-09T12:45:04.300" Score="2" Body="&lt;p&gt;For point-to-point links, use a maximum size of /30.  Depending on your model of router, it may support a subnet size of /31 which would be even better.  Carve these small subnets out of your unused space.  You can reserve a /24 network and use it only for p2p links, then take your smaller /30 /31 subnets from this space.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-11-09T12:45:04.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36419" PostTypeId="1" CreationDate="2016-11-09T17:13:15.707" Score="7" ViewCount="524" Body="&lt;p&gt;I'm presently teaching a networking class, and the various texts that I've cobbled together all discuss Mobile IP.  I always try to give real-world examples of how protocols are utilized, but the problem is: I'm not sure who / what actually uses Mobile IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than a handful of papers that have studied Mobile IPv6, virtually everything I see that discusses Mobile IP seems to be about a decade old.  So my question is: is/was Mobile IP actually implemented in anything, and what is it being used for now?&lt;/p&gt;&#xA;" OwnerUserId="31959" LastActivityDate="2017-03-23T16:58:06.110" Title="Who Actually Utilizes Mobile IP?" Tags="|ip|mobile|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36421" PostTypeId="1" CreationDate="2016-11-09T18:04:35.867" Score="1" ViewCount="395" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5B0Vu.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5B0Vu.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;I was reading about how a packet is send from one host to another. I am confused about entries that will be made in layer-3 switch routing table. Does it contain the entries for layer two switches or does it contain the entries for all the hosts (A,B,C,D ... etc). &lt;/p&gt;&#xA;" OwnerUserId="31961" LastEditorUserId="8499" LastEditDate="2018-12-21T04:59:32.940" LastActivityDate="2021-01-11T08:29:52.033" Title="Packet transfer from one host to another" Tags="|routing|switch|subnet|internet|layer3|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36422" PostTypeId="2" ParentId="36421" CreationDate="2016-11-09T18:17:40.930" Score="1" Body="&lt;p&gt;A routing table will have entries for the directly connected networks, any static routes you have configured, and any routes learned through routing protocols that you may be running to exchange routes with other routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routing table entries for each network will include the interface to which traffic destined for that network should be sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on you drawing: You could have three routes for the directly connected networks. You probably have a statically configured default route for the Internet, or you may be running BGP with the ISP router to which your layer-3 switch connects, in which case, you may have other routes learned from the ISP router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-09T18:23:48.087" LastActivityDate="2016-11-09T18:23:48.087" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36423" PostTypeId="1" CreationDate="2016-11-09T18:26:33.947" Score="1" ViewCount="401" Body="&lt;p&gt;It's very strange issue, on openstack cluster we have &lt;code&gt;VxLAN&lt;/code&gt; between network and compute node and its using &lt;code&gt;1450&lt;/code&gt; MTU (1500-50) because of encap header. Because of it some of my application not working properly. I am planning to increase MTU (jumbo) &lt;code&gt;9000&lt;/code&gt; on all my openstack cluster node so question is in that case do i need to increase MTU on all my physical cisco switches? We don't want to do that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just wanted to know increase host MTU size required network switch MTU size to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference question i have posted: &lt;a href=&quot;https://unix.stackexchange.com/questions/322011/multiple-puppetmaster-behind-load-balancer/322126#322126&quot;&gt;https://unix.stackexchange.com/questions/322011/multiple-puppetmaster-behind-load-balancer/322126#322126&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2017-04-13T12:37:13.227" LastActivityDate="2016-11-09T18:34:17.233" Title="Change MTU without infrastructure change" Tags="|cisco|network-core|mtu|vxlan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36424" PostTypeId="2" ParentId="36423" CreationDate="2016-11-09T18:31:19.387" Score="3" Body="&lt;p&gt;You haven't described the network very well, but if your switches are not set to use jumbo frames, any jumbo frames reaching a switch will be dropped as a giant.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Jumbo frames are not really standardized. You need to make sure that all the devices through which the jumbo frames pass can handle the maximum MTU of any frames passing through those devices.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-09T18:31:19.387" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="36427" PostTypeId="1" AcceptedAnswerId="36433" CreationDate="2016-11-10T02:12:39.527" Score="2" ViewCount="701" Body="&lt;p&gt;Topology of the network:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/z34JE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/z34JE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1 and R2 are iBGP &#xA;R3 and R4 are iBGP&#xA;&#xA;R1 - R3 eBGP&#xA;R2 - R4 eBGP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want R1 to direct the traffic for R2 to go through R3, R4 then to R2 and then back the same way in reverse.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried manipulating LOCAL_PREFERENCE on R3/R4 but when I check the &lt;code&gt;ip bgp&lt;/code&gt; there is still only one route to R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All routers are &lt;code&gt;next-hop-self&lt;/code&gt; to their iBGP neighbor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output config &lt;code&gt;show ip bgp 10.2.0.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output for R1 is &#xA;&lt;code&gt;Local 2.2.2.2 from 2.2.2.2 Origin IGP, localpref 100, valid, internal, best&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Output on R3 with the inclusion of locpref is:&#xA;&lt;code&gt;4.4.4.4 from 4.4.4.4 Origin IGP, localpref 200, valid, internal, best&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="15099" LastActivityDate="2016-11-10T11:15:37.430" Title="BGP route traffic from iBGP over eBGP instead" Tags="|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36431" PostTypeId="1" AcceptedAnswerId="36437" CreationDate="2016-11-10T09:57:48.817" Score="1" ViewCount="297" Body="&lt;p&gt;We use Cisco Catalyst 3850 Switch (with Cisco One Foundation) as aggregation Switch for multiple Lines and connect it to a ISR 4451 for routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we search for a solution to use the Interfaces of the Cisco Catalyst as Interfaces of the ISR. I heard that should be possible to use the interfaces as virtual interfaces on the ISR. Anybody knows about this task and can give me some links for documentation? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main task is that we want to use BGP for one Connection on the catalyst. Maybe we can add this line directly to the ISR but we want do the aggregation on the catalyst and the routing on the ISR, is this possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the following Picture you can see the given infrastructure. There is a stack with two Cat3850 und each has a fibrelink to the ISR. Each Carrier is connected to a Interface on one of the catalyst and has a route to the isr. For example the Carrier 1 is connected to catalyst Gi1/0/1 and Carrier 2 to catalyst Gi2/0/1 each Port is a routed port with a IP Address as transfer Net and routed a IP Range to the ISR. Is there a possibility to address the Gi1/0/1 from the ISR as something like a virtual device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xGKNd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xGKNd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20772" LastEditorUserId="8499" LastEditDate="2020-01-12T00:34:52.660" LastActivityDate="2020-01-12T00:34:52.660" Title="Is it possible to use a interface of Catalyst on a ISR" Tags="|cisco|switch|router|cisco-catalyst|cisco-isr|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36433" PostTypeId="2" ParentId="36427" CreationDate="2016-11-10T11:15:37.430" Score="4" Body="&lt;p&gt;By default R1 will drop the route to R2 received form R3 because the AS path contains R1's AS.  On cisco you can use allowas-in to stop this default behaviour though I've never done this myself and I guess you could get yourself in a right pickle if you were to implement it wrong. &lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-11-10T11:15:37.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36435" PostTypeId="1" AcceptedAnswerId="36438" CreationDate="2016-11-10T14:27:39.097" Score="1" ViewCount="851" Body="&lt;p&gt;In &lt;em&gt;Halabi - Chapter 6&lt;/em&gt; it states that, &quot;&lt;em&gt;External BGP neighbors have a restriction in that they must be physically connected, adjacent to one another.&lt;/em&gt;&quot; &#xA;There are tuning knobs that lets us override this restriction. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why is it required for them to be directly connected in normal scenarios? What is the rationale behind this requirement?&lt;/p&gt;&#xA;" OwnerUserId="8617" LastEditorUserId="8499" LastEditDate="2019-01-04T20:13:36.437" LastActivityDate="2021-11-20T17:41:32.687" Title="Why do eBGP neighbors need to be physically connected to each other" Tags="|routing|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36437" PostTypeId="2" ParentId="36431" CreationDate="2016-11-10T14:46:36.563" Score="2" Body="&lt;p&gt;No, the switches cannot be configured as part of the ISR. The switch stack can be configured as if it were a single switch, but the switch stack and the ISR are going to be two separate network devices, and each is configured separately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure why you would ever do it the way your drawing depicts. By connecting your switches directly to the ISPs, you are leaving them vulnerable to attack from the Internet. The ISR has NIM slots for modules you use to connect to the WAN. That is what you should be using for ISP connections.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your comments, this is an example of the router-on-a-stick method of connecting to a switch trunk:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0/0&#xA; no ip address&#xA; no shutdown&#xA;&#xA;interface GigabitEthernet0/0/0.10&#xA; description Subinterface for VLAN 10&#xA; encapsulation dot1Q 10&#xA; ip address 10.0.10.1 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;&#xA;interface GigabitEthernet0/0/0.20&#xA; description Subinterface for VLAN 20&#xA; encapsulation dot1Q 20&#xA; ip address 10.0.20.1 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;&#xA;interface GigabitEthernet0/0/0.30&#xA; description Subinterface for VLAN 30&#xA; encapsulation dot1Q 30&#xA; ip address 10.0.30.1 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If these are separate customers, and you do not want them to be able to get to each others' networks, you will need to create ACLs to block that. For instance, if your LAN interface has an IP address of &lt;code&gt;10.11.12.13&lt;/code&gt;, you could have an ACL that only allows a customer's traffic to get to that network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list 10&#xA; permit any 10.11.12.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You apply the access list inbound on all the customer sub interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-10T16:25:52.943" LastActivityDate="2016-11-10T16:25:52.943" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36438" PostTypeId="2" ParentId="36435" CreationDate="2016-11-10T14:52:40.557" Score="5" Body="&lt;p&gt;It is because you don't have any routes from the other AS in order for eBGP to be able to find a different interface. You will be given the directly connected interface, but the router would need to be manually configured to find a different interface in the router of the other AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your router and the router in the other AS must share a directly connected network. That network will automatically be in the routing tables of each of those two routers. Each of the routers has no other routes into the opposite AS. If you want to use loopbacks for eBGP, you would need to manually create static routes in each of the routers which point to the next hop. The routers already know how to find the next hop, so it is much easier to just use that for the neighbor relationship.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-10T15:08:26.897" LastActivityDate="2016-11-10T15:08:26.897" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36440" PostTypeId="1" AcceptedAnswerId="36490" CreationDate="2016-11-10T15:46:01.803" Score="0" ViewCount="109" Body="&lt;p&gt;Note: &#xA;These are Operating System deployment tools&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;WDS - Windows Deployment Services (Not the WiFi WDS)&lt;/li&gt;&#xA;&lt;li&gt;FOG - &lt;a href=&quot;https://fogproject.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://fogproject.org/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What &lt;strong&gt;&quot;protocols/ capability/ feature/ technical specs&quot;&lt;/strong&gt; become relevant and are leveraged in a  &lt;strong&gt;Switch or Networking equipment&lt;/strong&gt; in order to &lt;strong&gt;ensure efficient WDS / FOG multicast based image deployments&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every higher layer application depends on some lower layer capabilities. Hence, applications choose to use TCP or UDP based on their design parameters. In this vein, I'd like to know what becomes relevant in networking arena in the above application. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://serverfault.com/questions/791961/can-fog-and-or-wds-do-multicast-over-an-ordinary-unmanaged-gigabit-switch-or-d/792246&quot;&gt;Can FOG and/ or WDS do multicast over an ordinary unmanaged Gigabit Switch? or does it need hardware with specific multicast features?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://arstechnica.com/civis/viewtopic.php?f=10&amp;amp;t=673120&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://arstechnica.com/civis/viewtopic.php?f=10&amp;amp;t=673120&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17163" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2017-07-10T14:38:25.787" Title="What protocols in a Switch/ Network Equipment come into play, to ensure efficient Multicast support for WDS/ FOG image deployments?" Tags="|switch|multicast|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36443" PostTypeId="2" ParentId="32329" CreationDate="2016-11-10T19:43:17.400" Score="1" Body="&lt;p&gt;I just wanted to give a real world example of why you might want 2 subnets on one VLAN/LAN:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have some offices that want non-NAT public addresses and some that want private IP addresses (10.x).  By running 2 subnets on 1 VLAN, the users can plug a switch into the office's single ethernet port and have some devices privately IP'd and some publicly IP'd.  This saves the admins time and wiring costs of having to run multiple connections to each office or switch links between VLANs anytime there is a change wanted by the end user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Peter Green gave a good summary of some other pros and cons that I agree with.  &lt;/p&gt;&#xA;" OwnerUserId="31992" LastActivityDate="2016-11-10T19:43:17.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36445" PostTypeId="1" AcceptedAnswerId="36446" CreationDate="2016-11-10T20:33:29.087" Score="1" ViewCount="68" Body="&lt;p&gt;I know that OSPF uses router IDs, for example in LSDB. But, why doesn't RIP use router IDs for anything?&lt;/p&gt;&#xA;" OwnerUserId="31578" LastEditorUserId="8499" LastEditDate="2019-01-05T01:30:51.480" LastActivityDate="2019-01-05T01:30:51.480" Title="Why RIP doesn't use the router IDs?" Tags="|routing|router|ospf|rip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36446" PostTypeId="2" ParentId="36445" CreationDate="2016-11-10T20:39:56.317" Score="1" Body="&lt;p&gt;An OSPF router needs to get a full understanding of the whole area, including routers to which it is not directly connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RIP only knows about the directly connected routers. To RIP, the router IP addresses of the other routers give it everything it needs to know about the other routers. A RIP router will know on which interface a router is connected to it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-10T20:39:56.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36450" PostTypeId="1" AcceptedAnswerId="39204" CreationDate="2016-11-11T02:59:21.960" Score="12" ViewCount="33691" Body="&lt;p&gt;Am streaming UDP over wifi (5ghz) - approx 1.5k/packet... trying to stream to ~10 devices simultaneously, with extremely low latency..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand Wifi, it can never true multicast, as each device holds a '1:1&quot; relationship with the AP, and then receives the same packet... then the next device connects and gets the same packet.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;there are multiple types of router/APs -  &quot;3x3&quot; and &quot;4x4&quot;, some with MIMO, etc. what should I use as criterion for choice of AP?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;can I TRULY multicast over wifi to iOS devices? Is my theory correct? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;is there a way to multicast instead of treating each packet/client as a unicast?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="21094" LastEditorUserId="8499" LastEditDate="2018-03-19T21:02:40.433" LastActivityDate="2018-03-19T21:02:40.433" Title="Can I truly multicast over WIFI?" Tags="|wireless|ieee-802.11|multicast|streaming|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="36451" PostTypeId="1" AcceptedAnswerId="36456" CreationDate="2016-11-11T03:39:44.710" Score="5" ViewCount="16070" Body="&lt;p&gt;I'm doing a quite simple network setup (hopefully):   a file server and a Wi-Fi/AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AP which I've got is a biz-grade AP, much more robust, but it is without a built-in router (so no standard DHCP server builtin)...  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does have a 'hotspot' mode, which (when activated) hands out DHCP over Wi-Fi, and routes them to the gateway port (essentially a walled-off guest Wi-Fi network running on the same AP, not allowing access to the LAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My hypothesis is this...&#xA;I think I can make my network like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set server - static IP  10.0.1.254, on a 10.0.1.0/24 network. Its gateway would be 10.0.1.100 (the AP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set AP - static IP - - 10.0.1.100, on  10.0.1.0/24 network. It's gateway IP would be 10.0.1.254 (e.g. the server). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set AP &quot;hotspot&quot; to serve out DHCP for WIFI clients, effectively sending that traffic to its gateway (10.0.1.254).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AP would enable the hotspot network, thereby handing out DHCP to Wi-Fi clients, and passing all service directly to the 'gateway' (the server), and the server would in turn pass all service directly to the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*I also don't need this network to connect to the web - it's a closed network designed to accomplish a single specific task...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this possible? Will the server actually talk to the AP in this manner?&#xA;Do I &lt;em&gt;HAVE TO&lt;/em&gt; have a router just to make this work?&lt;/p&gt;&#xA;" OwnerUserId="21094" LastEditorUserId="8499" LastEditDate="2016-11-11T03:52:04.560" LastActivityDate="2016-11-11T04:11:57.217" Title="Can I create a network without a router?" Tags="|router|ip|ieee-802.11|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36452" PostTypeId="2" ParentId="36451" CreationDate="2016-11-11T03:44:14.997" Score="0" Body="&lt;p&gt;Routers route traffic between networks. If you only have one network, you don't need a router. A gateway is usually a router because it is used for traffic where the layer-3 destination is on a different network. If you only have one network, it doesn't matter to what address the gateway is set.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-11T03:44:14.997" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36453" PostTypeId="2" ParentId="36451" CreationDate="2016-11-11T03:49:19.107" Score="0" Body="&lt;h3&gt;can i create a network without a router?&lt;/h3&gt;&#xA;&lt;h3&gt;Yes.  The basic component of a network is a link-layer device that several endpoints connect to, for example an Ethernet switch or a WiFi access point.  Once the endpoints are connected, they can communicate with one another over the network.&lt;/h3&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-11-11T03:49:19.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36454" PostTypeId="2" ParentId="35400" CreationDate="2016-11-11T04:00:10.743" Score="1" Body="&lt;p&gt;Sure.  Simply plug each cable into a multi-port Ethernet card on the Web server, or, into an Ethernet switch or bridge if your server has only 1 NIC.  Configure the Web server with an IP address corresponding to the subnet on each cable if using a multiport NIC card.  If using a switch or bridge and single server NIC, configure a secondary, tertiary, and quaternary IP addresses on the single NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: in case of a single server NIC, an endpoint in subnet A could be configured with a secondary IP address in Subnet B and in that case it could communicate with devices on subnet B, so if security is a huge concern, you'll need a layer3 switch to assign a unique subnet for the server then use access lists to disallow inter-subnet (inter-vlan) routing.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-11T04:00:10.743" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36456" PostTypeId="2" ParentId="36451" CreationDate="2016-11-11T04:11:57.217" Score="3" Body="&lt;p&gt;&lt;strong&gt;Yes, surely you can create a network without using routers&lt;/strong&gt;.&lt;br&gt;&#xA;Routers are used to filter and forward packets from one network to another network. The network you will create will only be able to communicate with the nodes that are inter-connected with each other via the &lt;em&gt;Layer-2 Switch&lt;/em&gt;.&lt;br&gt;&#xA;Default gateway is used whenever a packet is not destined for the current sub-net you are in (which means the destination IP of the packet exists on a different sub-network). If the packet belongs to the same sub-network you are in, then routers won't be required to deliver the packet. You can consider this. Suppose you want to send a package (like a greeting card, a gift, or something else) to someone. If the person lives in the same building (or even the same city), then you can directly deliver the package to that person. If the person is living very far away and don't know exactly how you can each the person, then you will be taking help of some company that provides courier service (like FedEx).&lt;br&gt;&#xA;You can find the IP addresses, that belongs to your sub-net by using &lt;strong&gt;ipconfig&lt;/strong&gt; or &lt;strong&gt;ifconfig&lt;/strong&gt; (for Windows or Linux respectively). It shows you IP address and the sub-net mask, which can be used to find the range.&lt;br&gt;&#xA;The image below shows a typical network that can be created just by using Layer 2 devices (no routers). It is made using Cisco Packet Tracer software.&lt;br&gt;&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/pfB92.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pfB92.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31720" LastActivityDate="2016-11-11T04:11:57.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36457" PostTypeId="2" ParentId="35680" CreationDate="2016-11-11T04:22:24.777" Score="1" Body="&lt;p&gt;Network diagrams typically consist of both a physical topology view and a logical topology view.  So, for your physical topology view, use the manufacturer's chassis icons along with rack icons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the logical topology, you can use fuzzy wires (for Ethernet), clouds (for like services / subnets), etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data Center's are beginning to use compute/network orchestration systems such as OpenStack which may include SDN (where the virtual networking function such as a vFirewall or vRouter follows a vm when dragged / dropped around the physical boxes) so signifying that in a diagram requires some creativity.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-11T04:22:24.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36458" PostTypeId="1" AcceptedAnswerId="36459" CreationDate="2016-11-11T04:41:44.503" Score="1" ViewCount="218" Body="&lt;p&gt;I have created an access-list on my router.&#xA;I denied one network, then permitted any.&#xA;Denied network cannot ping my network. It is OK.&#xA;But I also cannot ping that network. Why?&#xA;Who can explain me?&#xA;There is no access-list on that network.&lt;/p&gt;&#xA;" OwnerUserId="23552" LastEditorUserId="8499" LastEditDate="2018-12-21T05:17:09.783" LastActivityDate="2018-12-21T05:17:09.783" Title="I can't ping denied network" Tags="|router|ping|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36459" PostTypeId="2" ParentId="36458" CreationDate="2016-11-11T04:52:33.893" Score="0" Body="&lt;p&gt;That is because ping is bi-directional, and hosts on the network cannot reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead of a standard access list (outbound from the router to your network), if you use an extended access list, you can deny only an ICMP Echo Request request (inbound to the router from the network you want to restrict). That should allow an ICMP Echo Reply back to your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 101 permit icmp any &amp;lt;your network address&amp;gt; &amp;lt;your network mask&amp;gt; echo-reply&#xA;access-list 101 deny icmp any &amp;lt;your network address&amp;gt; &amp;lt;your network mask&amp;gt; echo&#xA;access-list 101 permit ip any any&#xA;&#xA;interface g0/1      !*** the interface for the restricted network ***&#xA; ip access-group 101 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-11T05:07:54.377" LastActivityDate="2016-11-11T05:07:54.377" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36463" PostTypeId="1" AcceptedAnswerId="36466" CreationDate="2016-11-11T09:01:32.090" Score="1" ViewCount="424" Body="&lt;p&gt;if i have an organization and say i need about 25 Networks and 500 Hosts , well i'm going to use IPsubnet with CIDR To configure my ip addresses , what is the point of using NAT here ? , is it even possible to use NAT while i do have separate Subnet masks ?&lt;/p&gt;&#xA;" OwnerUserId="32003" LastActivityDate="2022-12-19T13:43:17.010" Title="Is it possible to use NAT with IP Subnetting?" Tags="|ip|nat|subnet|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36465" PostTypeId="2" ParentId="36463" CreationDate="2016-11-11T09:36:58.517" Score="1" Body="&lt;p&gt;There are various reasons for using NAT but the big one is to allow you to use private IP addresess on your internal network while using a smaller number of public IPs (maybe only one) to talk to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether or not your internal network is carved up into subnets is orthogonal to whether you use NAT at the gateway between your network and other networks.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-11T09:36:58.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36466" PostTypeId="2" ParentId="36463" CreationDate="2016-11-11T09:37:46.563" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it even possible to use NAT while i do have separate Subnet masks ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;-&gt; Yes. As long as you have a route to the host in difference subnet, it's possible. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the point of using NAT here ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;NAT is used to hide the real IP of the host that connect to the outside, this is secure purpose of NAT.&#xA;Another benefit of using NAT is saving the global IPv4 Address and providing a lot of internal IP address without any extra cost.&lt;/p&gt;&#xA;" OwnerUserId="25694" LastActivityDate="2016-11-11T09:37:46.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36468" PostTypeId="2" ParentId="6720" CreationDate="2016-11-11T10:25:07.010" Score="1" Body="&lt;p&gt;Most nat implementations can't handle overlapping address ranges on the inside and outside. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One workaround for this is to pass the traffic through two NATs. The first NAT converts the traffic to a subnet that doesn't overlap with anything and then the second NAT converts it to the new desired source.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can do this in one physical box by using multiple instances of the IP stack. Vendors of expensive routers call these &quot;vrfs&quot;, linux calls them &quot;network namespaces&quot;.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-11T10:25:07.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36472" PostTypeId="2" ParentId="36463" CreationDate="2016-11-11T13:50:43.443" Score="0" Body="&lt;p&gt;From a purely networking point of view, if you have the available subnets you can just go ahead and use a normal IP addressing scheme.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However for network security purposes, NAT is recommended. It will also save on address space if their is room for network expansion in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bear in mind any servers/clients that need to be accessed externally will have to be put in some sort of DMZ or assigned a specific public address, as opposed to using PAT(NAT Overload, most commonly used).&lt;/p&gt;&#xA;" OwnerUserId="31929" LastActivityDate="2016-11-11T13:50:43.443" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36483" PostTypeId="1" CreationDate="2016-11-11T21:24:26.867" Score="0" ViewCount="5665" Body="&lt;p&gt;I have a modem which has an embedded router inside, I was led to believe by sources on the internet that each network terminal has its own MAC address. By typing the default gateway IP I managed to find only one MAC address. Can anyone share any information and shed some light on this problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also used the arp -a command to list the MAC addresses in my cache and found many static addresses having an IP starting with 224. Not sure what this represents, I also would like to add that I am very new to the networking field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eCKgQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eCKgQ.png&quot; alt=&quot;arp -a command&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additional Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does WiFi also have its own MAC address? &lt;/li&gt;&#xA;&lt;li&gt;Does WiFi have its own broadcast domain?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="32016" LastActivityDate="2016-11-12T14:36:12.193" Title="List all MAC Addresses of Router" Tags="|router|ip|mac-address|" AnswerCount="1" CommentCount="4" ClosedDate="2018-03-03T00:24:55.283" ContentLicense="CC BY-SA 3.0" />
  <row Id="36484" PostTypeId="1" AcceptedAnswerId="36486" CreationDate="2016-11-11T22:06:51.260" Score="1" ViewCount="271" Body="&lt;p&gt;We are currently hosting our website onsite and are maxing out the up and down speeds of the 50/5 mbps bandwidth provided by our ISP. They can not offer us a higher bandwidth connection but they can offer us a second connection at the same bandwith.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to load balance those two connections for a reasonable cost/setup? I understand that no single user will gain the benefit of both connections but would different external users see a benefit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are looking at this router as a possible solution &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B00DGH08OC&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.amazon.com/Cisco-Systems-Gigabit-Router-RV320K9NA/dp/B00DGH08OC&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="32018" LastActivityDate="2017-06-10T02:56:32.670" Title="Is dual WAN load balancing possible for traffic to/from a webserver" Tags="|load-balancer|load-balancing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36486" PostTypeId="2" ParentId="36484" CreationDate="2016-11-11T22:52:49.160" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;the 50/5 mbps bandwidth provided by our ISP. They can not offer us a higher bandwidth connection but they can offer us a second connection at the same bandwith.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;With a traffic ratio like that i'm guessing you are talking about a &quot;broadband&quot; connection, likely cable though possiblly VDSL. Be aware that broadband connections are contended. So even if you can balance the traffic you may or may not get the speedup you desire.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to load balance those two connections for a reasonable cost/setup?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. There are three scenarios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best case is if your ISP is highly cooperative. You can have a single pool of IP addresses with the ISP load balancing on their end and your router load balancing on your end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your ISP doesn't explicity cooperate but also isn't too careful about ingress filtering you may be able to treat the IPs are one pool on your end even though the ISP is not and load-balance all outgoing traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your ISP doesn't cooperate and is doing careful ingress filtering then you will need to route traffic to the correct ISP based on it's source address. This can be done using policy routing. You can then give your webserver IP addresses from both blocks and use a DNS round robin to load balance them,&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-11T22:52:49.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36488" PostTypeId="1" AcceptedAnswerId="36567" CreationDate="2016-11-12T01:00:27.820" Score="1" ViewCount="371" Body="&lt;p&gt;TLDR; routed port on vPC switch 1 needs to be accessible from vPC switch 2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our data center has a pair of Nexus 5596T with L3 card being used as the core. These are vPC pair, HSRP members, all vlan SVIs live here. All vlans are in a VRF. All routes are static at this location, since it's basically a quad 0 to one side and an RFC-1918 to another side. I have the vPC heartbeat on mgmt0 in its own VRF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpc domain 1&#xA;  system-priority 5000&#xA;  peer-keepalive destination 172.31.255.1&#xA;  delay restore 150&#xA;  peer-gateway&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is an etherchannel group between the two for the peer link:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface port-channel1&#xA;  description N5K Peer Link&#xA;  switchport mode trunk&#xA;  spanning-tree port type network&#xA;  vpc peer-link&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I had a need to add a routed port to one of the 5k's, which I placed in the VRF as so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int eth1/6&#xA;vrf member VRF-name&#xA;no switchport&#xA;ip addr 1.1.1.1/30&#xA;no shut&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am capable of pinging the remote device (1.1.1.2) from the VRF on the switch hosting the routed port (5k-1), however from 5k-2 I am not able to ping and 1.1.1.1 doesn't appear in the routing table due to the static routing config. I don't see a clear way to add the route to 5k-2 other than simply pointing it to a local IP on 5k-1 such as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 1.1.1.0/30 [IP on 5k-1]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I missing here? Because we are vPC to L2 switches and servers, I might end up with traffic to 1.1.1.2 getting black-holed depending on which switch receives that traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!Command: show running-config&#xA;!Time: Sat Nov 12 13:34:07 2016&#xA;&#xA;version 7.1(3)N1(2)&#xA;hostname Sac_N5596-1&#xA;&#xA;no feature telnet&#xA;cfs eth distribute&#xA;feature pim&#xA;feature eigrp&#xA;feature pbr&#xA;feature udld&#xA;feature interface-vlan&#xA;feature hsrp&#xA;feature lacp&#xA;feature dhcp&#xA;feature vpc&#xA;feature lldp&#xA;feature vtp&#xA;feature fex&#xA;&#xA;logging level feature-mgr 0&#xA;&#xA;ssh key rsa 2048&#xA;no ip domain-lookup&#xA;ip access-list SDWAN&#xA;  10 permit ip any 10.9.0.0/16&#xA;ip access-list SNMP-ACL&#xA;  1 permit ip 10.254.225.140/32 any&#xA;class-map type qos match-all class-iscsi&#xA;  match cos 4&#xA;class-map type queuing class-iscsi&#xA;  match qos-group 3&#xA;policy-map type qos policy-qos&#xA;  class class-iscsi&#xA;    set qos-group 3&#xA;policy-map type queuing policy-queuing&#xA;  class type queuing class-fcoe&#xA;    bandwidth percent 0&#xA;  class type queuing class-iscsi&#xA;    bandwidth percent 95&#xA;  class type queuing class-default&#xA;    bandwidth percent 5&#xA;class-map type network-qos class-iscsi&#xA;  match qos-group 3&#xA;policy-map type network-qos jumbo&#xA;  class type network-qos class-default&#xA;    mtu 9216&#xA;    multicast-optimize&#xA;policy-map type network-qos policy-nq&#xA;  class type network-qos class-iscsi&#xA;    mtu 9216&#xA;    pause no-drop&#xA;system qos&#xA;  service-policy type network-qos jumbo&#xA;vtp mode transparent&#xA;vtp domain SAC&#xA;&#xA;ntp peer 10.254.1.254 use-vrf internal&#xA;ntp server 63.145.169.3 use-vrf internal&#xA;ntp server 69.36.224.15 use-vrf internal&#xA;ntp source-interface Vlan1&#xA;&#xA;vlan 1&#xA;vlan 30&#xA;  name UC-DEVICES&#xA;vlan 100&#xA;  name TBD_Removed_100&#xA;vlan 105&#xA;  name iDRAC_MGMT&#xA;vlan 110&#xA;  name User_10&#xA;vlan 160&#xA;  name SERVER&#xA;vlan 170&#xA;  name Database&#xA;vlan 171&#xA;  name Application&#xA;vlan 172&#xA;  name Web&#xA;vlan 200&#xA;  name iSCSI&#xA;vlan 205&#xA;  name TBD_Removed_205&#xA;vlan 225&#xA;  name BACKUPS&#xA;vlan 250&#xA;  name DMZ&#xA;vlan 350&#xA;  name LB-DMZ&#xA;vlan 360&#xA;  name LB-SERVER&#xA;vlan 370&#xA;  name LB-DataBase&#xA;vlan 371&#xA;  name LB-Application&#xA;vlan 372&#xA;  name LB-Web&#xA;vlan 800&#xA;  name Network_Endpoints&#xA;vlan 900&#xA;  name MPLS&#xA;vlan 998&#xA;  name Dummy-VLAN&#xA;spanning-tree vlan 1-998 priority 24576&#xA;route-map SDWAN permit 10&#xA;  match ip address SDWAN&#xA;  set ip next-hop verify-availability 1.1.1.1&#xA;service dhcp&#xA;ip dhcp relay&#xA;vrf context internal&#xA;  ip route 0.0.0.0/0 10.254.1.1&#xA;  ip route 10.0.0.0/12 10.99.99.1&#xA;  ip route 10.5.0.0/16 10.254.1.1&#xA;  ip route 10.16.0.0/16 10.254.1.1&#xA;  ip route 10.17.0.0/16 10.254.1.1&#xA;  ip route 10.249.0.0/16 10.99.99.1&#xA;  ip route 10.254.254.0/24 10.254.1.1&#xA;  ip route 172.16.60.0/24 10.254.1.20&#xA;  ip route 192.4.1.0/24 10.99.99.1&#xA;  ip route 192.168.0.0/16 10.99.99.1&#xA;  ip route 192.168.5.0/24 10.254.1.1&#xA;  ip route 192.168.13.0/24 10.254.1.1&#xA;  ip route 192.168.195.0/24 10.99.99.1&#xA;  ip route 192.168.250.0/24 10.99.99.1&#xA;vrf context management&#xA;vpc domain 1&#xA;  system-priority 5000&#xA;  peer-keepalive destination 172.31.255.2&#xA;  delay restore 150&#xA;&#xA;&#xA;interface Vlan1&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.1.253/24&#xA;  hsrp version 2&#xA;  hsrp 1&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.1.2&#xA;&#xA;interface Vlan30&#xA;  description UC Devices VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.30.253/24&#xA;  hsrp version 2&#xA;  hsrp 30&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.30.1&#xA;&#xA;interface Vlan105&#xA;  description iDRAC/MGMT&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.5.253/24&#xA;  hsrp version 2&#xA;  hsrp 105&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.5.1&#xA;  ip dhcp relay address 10.254.60.50&#xA;&#xA;interface Vlan110&#xA;  description User Vlan&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.10.253/24&#xA;  hsrp version 2&#xA;  hsrp 110&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.10.1&#xA;  ip dhcp relay address 10.254.60.50&#xA;&#xA;interface Vlan160&#xA;  description Server VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.60.253/24&#xA;  hsrp version 2&#xA;  hsrp 160&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.60.1&#xA;&#xA;interface Vlan170&#xA;  description DataBase&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.170.253/24&#xA;  hsrp version 2&#xA;  hsrp 170&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.170.1&#xA;&#xA;interface Vlan171&#xA;  description Application&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.171.253/24&#xA;  hsrp version 2&#xA;  hsrp 171&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.171.1&#xA;&#xA;interface Vlan172&#xA;  description Web&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.172.253/24&#xA;  hsrp version 2&#xA;  hsrp 172&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.172.1&#xA;&#xA;interface Vlan200&#xA;  description iSCSI Traffic&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.100.253/24&#xA;  hsrp version 2&#xA;  hsrp 200&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.100.1&#xA;&#xA;interface Vlan225&#xA;  description Backup Solution vLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.225.253/24&#xA;  hsrp version 2&#xA;  hsrp 225&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.225.1&#xA;&#xA;interface Vlan360&#xA;  description Load Balancer Servers VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 172.16.60.253/24&#xA;  hsrp version 2&#xA;  hsrp 360&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 172.16.60.1&#xA;&#xA;interface Vlan370&#xA;  description Load Balancer DataBase VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 172.16.170.253/24&#xA;  hsrp version 2&#xA;  hsrp 370&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 172.16.170.1&#xA;&#xA;interface Vlan371&#xA;  description Load Balancer Application VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 172.16.171.253/24&#xA;  hsrp version 2&#xA;  hsrp 371&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 172.16.171.1&#xA;&#xA;interface Vlan372&#xA;  description Load Balancer Web VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 172.16.172.253/24&#xA;  hsrp version 2&#xA;  hsrp 372&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 172.16.172.1&#xA;&#xA;interface Vlan800&#xA;  description Network_Endpoints&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.0.253/24&#xA;  hsrp version 2&#xA;  hsrp 800&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.0.1&#xA;&#xA;interface Vlan900&#xA;  description MPLS&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.99.99.253/24&#xA;  hsrp version 2&#xA;  hsrp 900&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.99.99.2&#xA;&#xA;interface port-channel1&#xA;  description Nexus to Nexus&#xA;  switchport mode trunk&#xA;  spanning-tree port type network&#xA;  vpc peer-link&#xA;&#xA;interface port-channel5&#xA;  description Trunk to DevStation_3750X&#xA;  switchport mode trunk&#xA;  speed 10000&#xA;&#xA;interface port-channel20&#xA;  description To 3850 Stack&#xA;  switchport mode trunk&#xA;  vpc 20&#xA;&#xA;interface Ethernet1/1&#xA;  description Firewall LAN Handoff - Primary&#xA;&#xA;interface Ethernet1/2&#xA;  description Uplink to MPLS router - Primary&#xA;  switchport access vlan 900&#xA;&#xA;interface Ethernet1/3&#xA;  description Firewall DMZ&#xA;  switchport access vlan 250&#xA;&#xA;interface Ethernet1/4&#xA;  description Uplink to SilverPeak&#xA;  switchport access vlan 800&#xA;  spanning-tree port type edge&#xA;&#xA;interface Ethernet1/5&#xA;  description SilverPeak Web Mgmt&#xA;  switchport access vlan 160&#xA;  spanning-tree port type edge&#xA;&#xA;interface Ethernet1/6&#xA;  description SilverPeak LAN0&#xA;  no switchport&#xA;  vrf member internal&#xA;  ip address 1.1.1.1/30&#xA;&#xA;&#xA;interface Ethernet1/29&#xA;  description N5K Peer Link&#xA;  switchport mode trunk&#xA;  channel-group 1 mode active&#xA;&#xA;interface Ethernet1/30&#xA;  description N5K Peer Link&#xA;  switchport mode trunk&#xA;  channel-group 1 mode active&#xA;&#xA;interface Ethernet1/31&#xA;  description N5K Peer Link&#xA;  switchport mode trunk&#xA;  channel-group 1 mode active&#xA;&#xA;interface Ethernet1/32&#xA;  description N5K Peer Link&#xA;  switchport mode trunk&#xA;  channel-group 1 mode active&#xA;&#xA;&#xA;interface mgmt0&#xA;  vrf member management&#xA;  ip address 172.31.255.1/30&#xA;clock timezone PST -8 0&#xA;clock summer-time PDT 2 Sun Mar 02:00 1 Sun Nov 02:00 60&#xA;line console&#xA;line vty&#xA;boot kickstart bootflash:/n5000-uk9-kickstart.7.1.3.N1.2.bin&#xA;boot system bootflash:/n5000-uk9.7.1.3.N1.2.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nexus 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!Command: show running-config&#xA;!Time: Sat Nov 12 13:34:32 2016&#xA;&#xA;version 7.1(3)N1(2)&#xA;hostname Sac_N5596-2&#xA;&#xA;no feature telnet&#xA;cfs eth distribute&#xA;feature pim&#xA;feature eigrp&#xA;feature pbr&#xA;feature udld&#xA;feature interface-vlan&#xA;feature hsrp&#xA;feature lacp&#xA;feature dhcp&#xA;feature vpc&#xA;feature lldp&#xA;feature vtp&#xA;feature fex&#xA;&#xA;&#xA;no ip domain-lookup&#xA;ip access-list SDWAN&#xA;  10 permit ip any 10.9.0.0/16&#xA;ip access-list SNMP-ACL&#xA;  1 permit ip 10.254.225.140/32 any&#xA;class-map type qos match-all class-iscsi&#xA;  match cos 4&#xA;class-map type queuing class-iscsi&#xA;  match qos-group 3&#xA;policy-map type qos policy-qos&#xA;  class class-iscsi&#xA;    set qos-group 3&#xA;policy-map type queuing policy-queuing&#xA;  class type queuing class-fcoe&#xA;    bandwidth percent 0&#xA;  class type queuing class-iscsi&#xA;    bandwidth percent 95&#xA;  class type queuing class-default&#xA;    bandwidth percent 5&#xA;class-map type network-qos class-iscsi&#xA;  match qos-group 3&#xA;policy-map type network-qos jumbo&#xA;  class type network-qos class-default&#xA;    mtu 9216&#xA;    multicast-optimize&#xA;policy-map type network-qos policy-nq&#xA;  class type network-qos class-iscsi&#xA;    mtu 9216&#xA;    pause no-drop&#xA;system qos&#xA;  service-policy type network-qos jumbo&#xA;vtp mode transparent&#xA;vtp domain SAC&#xA;&#xA;ntp peer 10.254.2.253&#xA;ntp server 63.145.169.3&#xA;ntp server 69.36.224.15&#xA;ntp source-interface Vlan1&#xA;&#xA;vlan 1&#xA;vlan 30&#xA;  name UC-DEVICES&#xA;vlan 100&#xA;  name TBD_Removed_100&#xA;vlan 105&#xA;  name iDRAC_MGMT&#xA;vlan 110&#xA;  name User_10&#xA;vlan 160&#xA;  name SERVER&#xA;vlan 170&#xA;  name DATABASE&#xA;vlan 171&#xA;  name Application&#xA;vlan 172&#xA;  name Web&#xA;vlan 200&#xA;  name iSCSI&#xA;vlan 205&#xA;  name TBD_Removed_205&#xA;vlan 225&#xA;  name BACKUPS&#xA;vlan 250&#xA;  name DMZ&#xA;vlan 350&#xA;  name LB-DMZ&#xA;vlan 360&#xA;  name LB-SERVER&#xA;vlan 370&#xA;  name LB-DataBase&#xA;vlan 371&#xA;  name LB-Application&#xA;vlan 372&#xA;  name LB-Web&#xA;vlan 800&#xA;  name Network_Endpoints&#xA;vlan 900&#xA;  name MPLS&#xA;vlan 998&#xA;  name Dummy-VLAN&#xA;spanning-tree vlan 1-998 priority 28672&#xA;route-map SDWAN permit 10&#xA;  match ip address SDWAN&#xA;&#xA;service dhcp&#xA;ip dhcp relay&#xA;vrf context internal&#xA;  ip route 0.0.0.0/0 10.254.1.1&#xA;  ip route 10.0.0.0/12 10.99.99.1&#xA;  ip route 10.5.0.0/16 10.254.1.1&#xA;  ip route 10.16.0.0/16 10.254.1.1&#xA;  ip route 10.17.0.0/16 10.254.1.1&#xA;  ip route 10.249.0.0/16 10.99.99.1&#xA;  ip route 10.254.254.0/24 10.254.1.1&#xA;  ip route 172.16.60.0/24 10.254.1.20&#xA;  ip route 192.168.0.0/16 10.99.99.1&#xA;  ip route 192.168.5.0/24 10.254.1.1&#xA;  ip route 192.168.13.0/24 10.254.1.1&#xA;  ip route 192.168.195.0/24 10.99.99.1&#xA;  ip route 192.168.250.0/24 10.99.99.1&#xA;  ip route 192.254.1.0/24 10.99.99.1&#xA;vrf context management&#xA;vpc domain 1&#xA;  system-priority 5000&#xA;  peer-keepalive destination 172.31.255.1&#xA;  delay restore 150&#xA;  peer-gateway&#xA;&#xA;&#xA;interface Vlan1&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.1.254/24&#xA;  hsrp version 2&#xA;  hsrp 1&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.254.1.2&#xA;&#xA;interface Vlan30&#xA;  description UC Devices VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.30.254/24&#xA;  hsrp version 2&#xA;  hsrp 30&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.254.30.1&#xA;&#xA;interface Vlan105&#xA;  description iDRAC/MGMT&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.5.254/24&#xA;  hsrp version 2&#xA;  hsrp 105&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.254.5.1&#xA;  ip dhcp relay address 10.254.60.50&#xA;&#xA;interface Vlan110&#xA;  description User Vlan&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.10.254/24&#xA;  hsrp version 2&#xA;  hsrp 110&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.254.10.1&#xA;  ip dhcp relay address 10.254.60.50&#xA;&#xA;interface Vlan160&#xA;  description Server VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.60.254/24&#xA;  hsrp version 2&#xA;  hsrp 160&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.254.60.1&#xA;&#xA;interface Vlan170&#xA;  description DataBase&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.170.254/24&#xA;  hsrp version 2&#xA;  hsrp 170&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.254.170.1&#xA;&#xA;interface Vlan171&#xA;  description Application&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.171.254/24&#xA;  hsrp version 2&#xA;  hsrp 171&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.254.171.1&#xA;&#xA;interface Vlan172&#xA;  description Web&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.172.254/24&#xA;  hsrp version 2&#xA;  hsrp 172&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.254.172.1&#xA;&#xA;interface Vlan200&#xA;  description iSCSI Traffic&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.100.254/24&#xA;  hsrp version 2&#xA;  hsrp 200&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.254.100.1&#xA;&#xA;interface Vlan225&#xA;  description Backup Solution vLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.225.254/24&#xA;  hsrp version 2&#xA;  hsrp 225&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.254.225.1&#xA;&#xA;interface Vlan360&#xA;  description Load Balancer Servers VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 172.16.60.254/24&#xA;  hsrp version 2&#xA;  hsrp 360&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 172.16.60.1&#xA;&#xA;interface Vlan370&#xA;  description Load Balancer DataBase VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 172.16.170.254/24&#xA;  hsrp version 2&#xA;  hsrp 370&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 172.16.170.1&#xA;&#xA;interface Vlan371&#xA;  description Load Balancer Application VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 172.16.171.254/24&#xA;  hsrp version 2&#xA;  hsrp 371&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 172.16.171.1&#xA;&#xA;interface Vlan372&#xA;  description Load Balancer Web VLAN&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 172.16.172.254/24&#xA;  hsrp version 2&#xA;  hsrp 372&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 172.16.172.1&#xA;&#xA;interface Vlan800&#xA;  description Network_Endpoints&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.254.0.254/24&#xA;  hsrp version 2&#xA;  hsrp 800&#xA;    preempt delay minimum 240&#xA;    priority 150&#xA;    timers 1 3&#xA;    ip 10.254.0.1&#xA;&#xA;interface Vlan900&#xA;  description MPLS&#xA;  no shutdown&#xA;  vrf member internal&#xA;  no ip redirects&#xA;  ip address 10.99.99.254/24&#xA;  hsrp version 2&#xA;  hsrp 900&#xA;    preempt delay minimum 240&#xA;    priority 130&#xA;    timers 1 3&#xA;    ip 10.99.99.2&#xA;&#xA;interface port-channel1&#xA;  description N5K Peer Link&#xA;  switchport mode trunk&#xA;  spanning-tree port type network&#xA;  vpc peer-link&#xA;&#xA;&#xA;interface Ethernet1/29&#xA;  description N5K Peer Link&#xA;  switchport mode trunk&#xA;  channel-group 1 mode active&#xA;&#xA;interface Ethernet1/30&#xA;  description N5K Peer Link&#xA;  switchport mode trunk&#xA;  channel-group 1 mode active&#xA;&#xA;interface Ethernet1/31&#xA;  description N5K Peer Link&#xA;  switchport mode trunk&#xA;  channel-group 1 mode active&#xA;&#xA;interface Ethernet1/32&#xA;  description N5K Peer Link&#xA;  switchport mode trunk&#xA;  channel-group 1 mode active&#xA;&#xA;&#xA;interface mgmt0&#xA;  vrf member management&#xA;  ip address 172.31.255.2/30&#xA;clock timezone PST -8 0&#xA;clock summer-time PDT 2 Sun Mar 02:00 1 Sun Nov 02:00 60&#xA;line console&#xA;line vty&#xA;boot kickstart bootflash:/n5000-uk9-kickstart.7.1.3.N1.2.bin&#xA;boot system bootflash:/n5000-uk9.7.1.3.N1.2.bin&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1068" LastEditorUserId="509" LastEditDate="2016-11-12T23:41:54.143" LastActivityDate="2016-12-16T18:56:29.370" Title="add local route to vPC member" Tags="|cisco|routing|cisco-nexus-5k|cisco-nx-os|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="36490" PostTypeId="2" ParentId="36440" CreationDate="2016-11-12T03:42:07.130" Score="0" Body="&lt;p&gt;Here's what was posted by &lt;a href=&quot;https://forums.servethehome.com/index.php?members/aero.7525/&quot; rel=&quot;nofollow noreferrer&quot;&gt;aero&lt;/a&gt; as a &lt;a href=&quot;https://forums.servethehome.com/index.php?threads/what-to-look-for-in-a-switch-network-equipment-to-ensure-multicast-support-for-wds-fog-image-depl.12004/#post-113874&quot; rel=&quot;nofollow noreferrer&quot;&gt;reply&lt;/a&gt; and makes sense: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BLOCKQUOTE&gt;&#xA;You don't need a special or managed switch. However, it would be &lt;strong&gt;preferable for your switch to support &lt;a href=&quot;https://en.wikipedia.org/wiki/IGMP_snooping&quot; rel=&quot;nofollow noreferrer&quot;&gt;IGMP Snooping&lt;/a&gt;&lt;/strong&gt;. That will &lt;strong&gt;prevent the multicast traffic from being transmitted on every port&lt;/strong&gt;. Instead, it will &lt;strong&gt;only be delivered to ports where there is a listener&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are running an &lt;strong&gt;access point in the same vlan you're trying to use multicast&lt;/strong&gt;, and &lt;strong&gt;don't have an IGMP snooping capable switch&lt;/strong&gt;, you WILL &lt;strong&gt;completely congest your wifi frequencies. It will completely cripple your wireless network when you try to use multicast&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, if you are trying to do this over a &lt;strong&gt;routed network&lt;/strong&gt; (rather than all hosts in the same vlan), then you will need a &lt;strong&gt;router that supports the &lt;a href=&quot;https://en.wikipedia.org/wiki/Protocol_Independent_Multicast&quot; rel=&quot;nofollow noreferrer&quot;&gt;PIM protocol&lt;/a&gt;&lt;/strong&gt;.&#xA;&lt;/BLOCKQUOTE&gt;&lt;/p&gt;&#xA;" OwnerUserId="17163" LastActivityDate="2016-11-12T03:42:07.130" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36492" PostTypeId="2" ParentId="30233" CreationDate="2016-11-12T06:01:36.393" Score="0" Body="&lt;p&gt;You could get a Linux instance at a cloud provider such as Amazon that does have a static IP address on it and use it as your hub and run OpenNHRP on the instance.&lt;/p&gt;&#xA;" OwnerUserId="15834" LastActivityDate="2016-11-12T06:01:36.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36494" PostTypeId="1" CreationDate="2016-11-12T08:57:54.240" Score="3" ViewCount="1001" Body="&lt;p&gt;My office has about 150 systems to be connected to a network. Based on the budget and availability of devices in my city I have the option of a HPE or Cisco 48 port Gigabit switch. But now when I interconnect the switches using the standard ports the inter switch bandwidth will be 1 Gigabit. So if more than 2 of my systems from 2 different switches transfer data between each other, the 1 Gigabit bandwidth is shared, hence the inter-computer communication is slow. Could someone suggest methods by which I can speed up the communication between the switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most recommended model that I have come across is to use the SFP+ port on the switch with a transceiver capable of 10 Gigabit and connect all the switches to a 8 port 10 Gigabit switch. This appears to be expensive and I am unable to get further information on this setup. Is this the best model?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a better model or a different model that is more cost effective?&lt;/p&gt;&#xA;" OwnerUserId="32029" LastActivityDate="2016-11-21T15:01:12.107" Title="Interconnecting Gigabit Switches with Maximum Bandwidth" Tags="|switching|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36495" PostTypeId="2" ParentId="36494" CreationDate="2016-11-12T10:00:10.227" Score="2" Body="&lt;p&gt;Normally you want your interconnection ports to be faster than your access ports to avoid one user filling the network. So if you have 1G access ports you most likely want 10 gigabit inter switch interconnects with a 10G core switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately there are two different common types of ports used for 10G and the two cannot easily be connected to each other. The types are SFP+ and 10GBASE-T.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SFP+ was designed as a slot for fiber transceivers but for short links it is also possible to directly connect two SFP+ slots with a direct attach cable. There are two relevant types of SFP+ transceivers for a single-site greenfield deployment, SR and LR. Both operate over a pair of fibers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SR is for multimode. On good quality multimode cable it should be good for 400m on OM4 (less on lower grades). The downside of multimode is it tends not to be very future proof. Each increase in speed results in a significant reduction in operating distance for a given fiber type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LR is for single mode fiber. It's good for 10km and single mode fiber. Single mode fiber tends to be far more future proof than multimode. Downside is that the installation tolerances are less forgiving and the transcievers are more expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10GBASE-T is a physical layer for twisted pair copper (ideally cat6a but for shorter runs cat6 should also work). Twisted pair is a lot cheaper than transcievers and fiber or SFP+ direct attach cables. Downside is it's relatively power hungry, the range is relatively limited, there is less choice of devices, the 10GBase-T versions of devices are often more expensive than the SFP+ versions and it will likely leave no headroom for upgrading to faster speeds on the same cabling later.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AIUI the big names like to make you pay through the nose for 10G. Some of them also try to bully you into buying their overpriced transcievers. AIUI if you want economical 10G gear Netgear are apparently a good choice. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With some switches it is possible to aggregate ports but it's less than ideal, especially if the number of data streams is small. I would push for 10G over aggregated 1G even if it costs a bit more.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-11-14T17:40:49.707" LastActivityDate="2016-11-14T17:40:49.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36496" PostTypeId="2" ParentId="36494" CreationDate="2016-11-12T10:01:44.733" Score="1" Body="&lt;p&gt;Typical use cases seldom consume all available bandwidth at each port and, therefore, aggregated bandwidth on your uplinks will probably use less than 1Gb unless you're pushing lots of packets.  This is called &lt;strong&gt;oversubscription&lt;/strong&gt; which is an expected design element.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have access switches in a data center with a couple of hundred web server VMs connected to each and all their uplink traffic fits over two pairs of 2x1Gb bonded (etherchannel) ports.  That's a 200:4 or 50:1 rough oversubscription.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really need to understand your expected traffic patterns to determine if oversubscription will work (and at what ratio) or not.  Etherchannel can combine eight 1Gb links to make an 8Gb pipe, so consider that as a cheaper alternative to 10Gb.&lt;/p&gt;&#xA;" OwnerUserId="630" LastActivityDate="2016-11-12T10:01:44.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36497" PostTypeId="2" ParentId="32347" CreationDate="2016-11-12T11:08:14.427" Score="2" Body="&lt;p&gt;&quot;theory 2&quot; is how switches normally operate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;theory 1&quot; would be an optimisation hack. I know the BGP EVPN guys are doing local arp/nd interception to reduce BUM traffic. I have no idea if anyone is doing it in a plain Ethernet environment.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-11-13T11:14:45.153" LastActivityDate="2016-11-13T11:14:45.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36498" PostTypeId="2" ParentId="36483" CreationDate="2016-11-12T13:08:17.623" Score="2" Body="&lt;p&gt;First of all to clarify, every device which is connected to a Layer-2 network using an interface such as an Ethernet Interface, WiFi Adapter (802.11a/b/g/n/ac) has its own MAC address. On top of this it can have multiple Layer-3 addresses (IP Addresses) for its MAC addresses. For ordinary PCs and wireless devices it is normally 1 IP assigned to 1 MAC address for their connected adapters (Ethernet or WiFi).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off 224.x.x.x is used for MultiCast addresses. To learn more about these &lt;a href=&quot;http://www.firewall.cx/networking-topics/general-networking/108-multicast-ip-list.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; is a starting point. The packets destined to these IPs will actually reach multiple recipients who are members of the multicast group represented by the IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now back to the list of MAC addresses. Your PC learns the MAC addresses of other systems in its broadcast domain when it tries to communicate with them using their IP addresses. This learning process is done using the &quot;Address Resolution Protocol&quot;. &lt;a href=&quot;https://www.youtube.com/watch?v=1jncvd6JDoc&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; is a nice video showing how ARP works. The dynamic entries in your shown output are learned via &quot;ARP&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for getting to know the MAC addresses of everything in your broadcast domain. Your ARP table will only show cached entries of MAC address to IP Address mappings which your device has recently learned usin ARP. The ARP Cache is constantly updated as you try to reach more and more IPs in your broadcast domain. You can try pinging different IPs in your subnet (broadcast domain) and after each new address you ping, check your 'arp -a' output. You will see new MAC addresses pop up for addresses which actually exist and are alive in your network and 'incomplete' entries for IPs which did not reply to your ARP queries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this has helped.&lt;/p&gt;&#xA;" OwnerUserId="24379" LastActivityDate="2016-11-12T13:08:17.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36501" PostTypeId="1" AcceptedAnswerId="36502" CreationDate="2016-11-12T15:33:04.500" Score="1" ViewCount="2213" Body="&lt;p&gt;I have the topology below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/c982E.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/c982E.png&quot; alt=&quot;topology diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the network &lt;code&gt;10.11.9.0/24&lt;/code&gt; (Area 3), I want to allow only traffic to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I go about this as I was thinking denying traffic to all my network and allow it for everything else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the commands I entered in R2, but they do not seem to work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 100 deny ip any 10.111.0.0 0.0.240.255&#xA;access-list 100 permit ip any any&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip access-group 100 out&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These commands don't seem to work, but could it because of another reason like OSPF?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I be allowing everything to the ISP and denying everything else? How would I go about this?&lt;/p&gt;&#xA;" OwnerUserId="31952" LastEditorUserId="8499" LastEditDate="2016-11-12T16:51:41.840" LastActivityDate="2016-11-12T16:51:41.840" Title="ACL permit and deny to default gateway OSPF routing" Tags="|cisco|routing|cisco-ios|ospf|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36502" PostTypeId="2" ParentId="36501" CreationDate="2016-11-12T16:00:21.067" Score="2" Body="&lt;p&gt;As applied, your ACL is denying any IP traffic destined to &lt;code&gt;10.111.0.0 0.0.240.255&lt;/code&gt; &lt;em&gt;into&lt;/em&gt; Area 3. From what you described, I thought you wanted to deny traffic &lt;em&gt;leaving&lt;/em&gt; Area 3, not &lt;em&gt;entering&lt;/em&gt; it. The &lt;code&gt;in&lt;/code&gt; and &lt;code&gt;out&lt;/code&gt; keywords on the &lt;code&gt;ip access-group&lt;/code&gt; command are from the perspective of the router, not the network or area, so the &lt;code&gt;out&lt;/code&gt; that you use means anything outbound on the Area 3 interface (&lt;em&gt;into&lt;/em&gt; Area 3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are probably trying to overthink the wildcard mask, which seems to be incorrect based on your question. It will not deny traffic to hosts in any other area. You probably just want something like &lt;code&gt;0.0.255.255&lt;/code&gt;, meaning you will deny traffic to any host in the &lt;code&gt;10.111.0.0/16&lt;/code&gt; address range. It doesn't affect hosts in Area 3 from sending traffic to any host in Area 3. You can't do that from the router because the hosts in Area 3 are connected to a switch, and the traffic will pass directly from host to host, not through the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You probably want something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 10 deny ip any 10.111.0.0 0.0.255.255&#xA;access-list 10 permit ip any any&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip access-group 10 in&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-12T16:10:30.143" LastActivityDate="2016-11-12T16:10:30.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36504" PostTypeId="1" AcceptedAnswerId="36505" CreationDate="2016-11-13T00:18:39.523" Score="0" ViewCount="1302" Body="&lt;p&gt;I am confused on whether UDP and TCP work together, or are they completely separate protocols. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, UDP is used to allow multiplexing of different services on the same machine. So, essentially, for example, when I make a request to YouTube.com (from Chrome application, let's say running on port 10). First, my packet will be created with IP address (and different headers), and a TCP connection would be make to the YouTube server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, when the server responds back, it will send the data to the source machine (that made the request) at the port (10). Is this when the UDP protocol is used? So, if I have another application like Netflix streaming on my computer (running on port 11), then UDP knows that there is a stream on port 10 and port 11 and it will multiplex this data coming in from the Internet to the specific ports of the application that is running on my machine?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am having a hard time understanding whether UDP is used in every TCP/IP connection since every application essentially runs on the port on the computer. So, would the UDP protocol know of all of these applications running at whichever port on the specific machine and multiplex data at this port?&lt;/p&gt;&#xA;" OwnerUserId="30675" LastEditorUserId="8499" LastEditDate="2018-12-13T15:33:33.050" LastActivityDate="2018-12-13T15:33:33.050" Title="Is UDP used in every TCP/IP connection?" Tags="|tcp|udp|osi|layer4|transport-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36505" PostTypeId="2" ParentId="36504" CreationDate="2016-11-13T00:31:34.327" Score="7" Body="&lt;p&gt;UDP and TCP are completely separate Transport Layer (Layer 4 in the OSI model) protocols. There are also other layer-4 protocols, but TCP and UDP are the most commonly used. UDP was first, and it is a connectionless, unreliable, fire-and-forget protocol. TCP was added later to provide connections and reliability to layer 4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-4 protocols have their own addresses, called ports. UDP port 10 is not the same thing as TCP port 10. Applications register with TCP or UDP to use their ports. Only one application can use a per-protocol port at any given time, but if you have two different applications, one could use UDP port 10 at the same time as another uses TCP port 10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP is only used by applications which want to use UDP, and TCP is only used by applications which want to use TCP. Some applications will use both protocols, and some applications use neither. Neither protocol is required by IPv4 or IPv6.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-13T00:38:17.737" LastActivityDate="2016-11-13T00:38:17.737" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36506" PostTypeId="1" CreationDate="2016-11-13T05:39:42.350" Score="1" ViewCount="247" Body="&lt;p&gt;I'm using Wireshark to capture traffic on my 2.4G wifi network.  I'm set to promiscuous mode, but I only see traffic to or from me, or broadcast or multicast traffic.  Unless I'm remembering incorrectly, when I've dont this before I was able to see all traffic on the wireless lan, but now i can't.  I used to not use WEP or WPA so I'm not sure if that was why I was able to view all traffic.  Should I be able to see all traffic on the wireless lan?  Or since it's a wireless net work does all traffic have to go through the AP so it never gets to me unless its addressed to me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="32040" LastEditorUserId="8499" LastEditDate="2018-03-19T21:01:36.433" LastActivityDate="2019-06-10T15:08:42.237" Title="Why can't i see wireless traffic not addressed to my wireless interface with wireshark" Tags="|wireless|ieee-802.11|wireshark|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36507" PostTypeId="2" ParentId="36403" CreationDate="2016-11-13T06:28:33.983" Score="2" Body="&lt;p&gt;Thank you guys, my switch is running LANBASE license, just found out and let you know. At least I should have an ipbase license to run private-vlan feature. Topic should be closed now. Thanks again.&lt;/p&gt;&#xA;" OwnerUserId="25694" LastActivityDate="2016-11-13T06:28:33.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36509" PostTypeId="2" ParentId="5700" CreationDate="2016-11-13T10:51:16.770" Score="1" Body="&lt;p&gt;Traceroute relies on sending out probes with controlled TTL and monitoring the ICMP time exceeded errors that come back. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The probes can be any protocol. Windows uses ICMP echo packets by default. Most unix-like systems uses UDP packets by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If our networks were as simple as the designers of the internet envisaged there would be no need to have options for changing the protocol used in traceroute but in reality we have firewalls, NATs, traffic prioritisation systems etc. Using the same protocol (and possibly the same port number) for your trace as the protocol the application will actually use increases the chance that the results of your traceroute will be representative of the network your application will see.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-13T10:51:16.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36510" PostTypeId="2" ParentId="23769" CreationDate="2016-11-13T11:31:58.973" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What prevents computer C from answering an ARP request coming from the computer A?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If computer A sends an ARP request for computer C's IP address then computer C will answer it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether computer A will send such a request depends on how things are configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally computer A will look up computer C's IP address in it's routing table. Based on this table it will determine that the &quot;next hop IP address&quot; is the IP of it's default gateway. It will then look up the default gateways IP address in it's ARP table and if needed send an ARP request for the default gateway. In this process computer A never ARPs for computer Cs IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However there are several scenarios in which computer A may make an ARP request for computer C. For example&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The administrator of computer A manually adds a routing table entry telling it that computer C is on-link.&lt;/li&gt;&#xA;&lt;li&gt;The default gateway sends an ICMP redirect on seeing the first packet from A to C and A accepts it.&lt;/li&gt;&#xA;&lt;li&gt;Computer A has no default gateway configured. In this case some operating systems will ARP for all addresses.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-13T11:31:58.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36511" PostTypeId="1" AcceptedAnswerId="36513" CreationDate="2016-11-13T13:06:22.867" Score="1" ViewCount="1871" Body="&lt;p&gt;From the cisco docs i have:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;vPC and HSRP/VRRP Object Tracking&#xA;As Figure 67 suggests, it’s important not to use HSRP/VRRP link tracking in a vPC configuration.&#xA;Assume HSRP/VRRP object tracking is configured on both vPC peer devices and L3 uplink failure occurs on&#xA;switch 7K2. This event triggers the HSRP/VRPP object tracking and the resulting SVI with associated HSRP/VRRP&#xA;configuration is set to DOWN state. So everytime 7K2 receives a frame destined to HSRP/VRRP vMAC, it bridges&#xA;this frame over vPC peer-link because the other vPC peer device is able to process this frame (as SVI with&#xA;associated HSRP/VRRP configuration is still in UP state).&#xA;Using vPC with HSRP/VRRP object tracking may leads to traffic blackholing in case object tracking is triggered: the&#xA;reason is that vPC systems will not forward a packet back on a vPC once it has crossed the peer-link (because of&#xA;the vPC loop avoidance rule), except in the case of a remote vPC member port failure.&#xA;&quot;&#xA;Refer the attached image:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RBxgv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RBxgv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1: Why would the resulting SVI with associated HSRP/VRRP configuration is set to DOWN state if the uplink goes down? From what i know, we can only change the hsrp priority if tracking is triggered?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:I am unable to understand, why the traffic blackholing occurs? Assume, there is a PC in vlan 100 at access layer and it wants to ping the far end router (the uplink router), i guess the traffic can still reach this router(via the vpc peer link, then 7k1 and then far end router)...will there be an issue in return traffic? )(I know the vpc loop avoidance rule which says that traffic received on a peer link will not be sent to any member port--but i don't undertsand how that applies here)?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2019-01-10T09:16:25.367" Title="Regarding traffic blackholing in case of vpc and hsrp" Tags="|hsrp|vpc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36512" PostTypeId="2" ParentId="36506" CreationDate="2016-11-13T15:44:59.910" Score="2" Body="&lt;p&gt;You don't mention the operating system or wireless adapter, but many adapter drivers do not actually go into promiscuous mode.  Some treat the adapter as an Ethernet interface.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-13T15:44:59.910" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36513" PostTypeId="2" ParentId="36511" CreationDate="2016-11-13T16:02:15.327" Score="2" Body="&lt;p&gt;I'll answer Q2 first:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose a PC in VLAN 100 sends a packet to a PC in VLAN 200.  Let's say the packet takes the VPC link to 7K2.  Since the active SVI is on 7K1, the packet is forwarded across the peer link to 7K1.  7K1 would want to forward it to the right-hand access switch, but it can't because of the loop avoidance rule.  So the packet gets dropped.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-13T16:02:15.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36516" PostTypeId="1" CreationDate="2016-11-13T18:11:44.903" Score="2" ViewCount="90" Body="&lt;p&gt;So I have a WIFI/client application which has some specific issues, in that several devices need to absolute priority.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fortunately, i'm able to prevent MOST devices from joining the network, but I need to be able to further prioritize traffic, in order to avoid interference for the main priority app.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;are there particular methods in Wifi APs which would allow me to set a QOS level for particular MAC IDs, prevent lower priority devices from having any preference, etc?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;is there a particular class or series of AP which I should be considering to gain higher control over the network?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Currently we're running both 2.4 and 5ghz, are running on some ENgenius and Ruckus devices.  However, I' wondering if there are different classes of APs which offer more 'under the hood' management?&lt;/p&gt;&#xA;" OwnerUserId="21094" LastActivityDate="2020-01-07T15:45:16.880" Title="Is there a way to prioritize/manage WIFI traffic (in the WIFI realm)?" Tags="|vpn|ieee-802.11|qos|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="36517" PostTypeId="1" AcceptedAnswerId="36518" CreationDate="2016-11-13T18:25:12.773" Score="4" ViewCount="5238" Body="&lt;p&gt;Following this &lt;a href=&quot;https://networkengineering.stackexchange.com/q/6938/28180&quot;&gt;excellent post&lt;/a&gt;, doesn't it mean that if all your neighbours are using &lt;strong&gt;5GHz&lt;/strong&gt; band, your wifi network will face interference just like the case with &lt;strong&gt;2.4GHz&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 2.4GHz band, &lt;strong&gt;1,6&lt;/strong&gt; &lt;em&gt;and&lt;/em&gt; &lt;strong&gt;11&lt;/strong&gt; are the recommended channels and are safe to use. Isn't this applied to 5GHz also?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to physics, &lt;strong&gt;&lt;em&gt;high&lt;/strong&gt; frequency waves overlap each other &lt;strong&gt;lesser&lt;/strong&gt; than low frequency and therefore produce less &lt;strong&gt;noise&lt;/strong&gt;. But waves with &lt;strong&gt;similar&lt;/strong&gt; frequency produce &lt;strong&gt;interference&lt;/strong&gt; independent of their magnitude&lt;/em&gt;. It means that even 5GHz band will suffer just like 2.4GHz does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another noticeable thing is, in networking we use &lt;strong&gt;band&lt;/strong&gt; and not a particular frequency but even in the case of band your waves is going to be collapsed with your neighbour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, people use dual band wifi routers so in this case overlapping will be much higher than individual bands. Do channels 1, 6 and 11 work in this case?&lt;/p&gt;&#xA;" OwnerUserId="28180" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-11-14T03:43:57.003" Title="Isn't 5Ghz band affected with channel overlapping?" Tags="|wireless|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36518" PostTypeId="2" ParentId="36517" CreationDate="2016-11-13T19:00:54.577" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;For 2.5GHz band, 1,6 and 11 are the recommended channels and are safe&#xA;  to use. Isn't this applied to 5GHz also?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No.  In the 2.5 GHz band, the channel spacing is 5 MHz.  That's why you can only use 1,6, and 11.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the 5 GHz band, the channels are spaced farther apart - 20MHz, so you can use adjacent channels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that under new FCC rules (in the U.S., of course), some channels are designated for wider bandwidth, to accommodate 802.11n and 802.11ac. In that case, there are fewer channels available.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Today, people use dual band wifi routers so in this case overlapping&#xA;  will be much higher than individual bands. Do 1,6&amp;amp;11 channels work&#xA;  even for this case?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A dual band router just means it has radios that operate in both the 2.5 GHz and 5 GHz band,  Some can do either/or, while others can use both radios at the same time (meaning it can have clients on either band).   This doesn't affect the channel spacing requirements.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-13T19:00:54.577" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="36519" PostTypeId="1" CreationDate="2016-11-13T20:13:55.953" Score="1" ViewCount="205" Body="&lt;p&gt;I'm currently have a bit of an issue setting up a network infrastructure that I need help with. My network infrastructure is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                                              ____ ____________&#xA;                                                             |    |10.4.0.0/24&#xA;             _________________                     __________|Sys1|____________&#xA;            |                 |                    | 10.0.8.1|____|10.8.0.0/24&#xA;            |      Main       |                    |          ____ ____________&#xA;vpn_clients_|  Network router |_system_connections_|_________|    |10.4.1.0/24  &#xA;10.0.4.0/22 |                 |   10.0.8.0/22      | 10.0.8.2|Sys2|____________&#xA;            |                 |                    |         |____|10.8.1.0/24 &#xA;            |_________________|                    |&#xA;                                                   |_________ ...&#xA;                                                    10.0.8.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would like anyone in the 10.0.4.0/22 or even 10.0.8.0/22 network to access any of the 10.4.x.y or 10.8.a.b networks, but prevent communications between downstream equipment (eg. 10.8.1.3 talking to 10.4.0.2)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that a possibility within OSPF? If so, I'd appreciate if someone could show me the ropes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers!&lt;/p&gt;&#xA;" OwnerUserId="32049" LastActivityDate="2018-06-08T18:53:42.850" Title="OSPF (Quagga) complex network setup query" Tags="|ospf|quagga|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36520" PostTypeId="2" ParentId="36517" CreationDate="2016-11-13T22:40:08.173" Score="6" Body="&lt;p&gt;As Ron already noted, the channel spacing is wider, and furthermore, there are many more 5-GHz band channels available in most countries (particularly for a DFS certified device.) Look here and scroll down far enough to find the 5 GHz channel chart...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_WLAN_channels&quot; rel=&quot;noreferrer&quot;&gt;https://en.wikipedia.org/wiki/List_of_WLAN_channels&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, a distinct benefit (yes, it's a benefit) of the 5 GHz band is that it penetrates building materials poorly compared to 2.4 GHz. This greatly reduces interference from neighbors, or from your own company's multiple access points. It does make quality installations have more access points (since the end-user device should have a clear line of sight to the AP for best performance), but they interfere less with each other than APs on the 2.4 band.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-11-13T22:40:08.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36521" PostTypeId="2" ParentId="36494" CreationDate="2016-11-13T23:00:38.847" Score="2" Body="&lt;p&gt;Simplest and cheapest approach (other than not worrying about it at all) is to figure that you have 150 devices, so you need 4 48 port switches, but you don't need 42 of those ports for devices, so you exploit Link Aggregation Control Protocol (LACP) to run multiple cables between switches (without creating loops.) You need a switch that supports it, but most do these days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More moderately expensive is to skip the 10gig switch and just cable between your 4 switches with 10 Gig from their SFP+ ports. Depending on layout and availability of SFP+ ports you can either use one switch as a star for the rest, or just put them in line. That's only one step &quot;worse&quot; than a 10 gig switch and only for traffic between the &quot;end-most&quot; switches. The model where you have a (probably 4 SFP+) switch with at least 3 SFP+ ports to act as a star is &quot;as good&quot; as a central switch for traffic between the leaves, and better for traffic from the hub to any leaf.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WEYnd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WEYnd.png&quot; alt=&quot;sketch of switch configs&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the LACP sketched, I put more links between the two switches in the middle. Each end link uses 10 ports (5 on each switch) and the central link uses 14 (7 on each switch) for a total of 34, leaving you with 8 free ports (as sketched - this is entirely configurable.) &lt;strong&gt;Edit, add:&lt;/strong&gt; &lt;em&gt;Moving this up from the comments&lt;/em&gt; - if you take the simple rightmost sketch and add 2 more SFP+ to loop from the end-most switches to each other, with RSTP (or STP, or...) to block the ports when everything is functional, you will have 75% of the network working when any one switch goes out - of course, if it's the one connected to the (fileserver, router, etc) you will still need to repatch or replace to be functional again. If all are in one rack, that's rather quick - if they are in 4 different rooms, it's harder.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2016-11-21T15:01:12.107" LastActivityDate="2016-11-21T15:01:12.107" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="36522" PostTypeId="2" ParentId="36374" CreationDate="2016-11-13T23:03:00.623" Score="0" Body="&lt;p&gt;I got 4 2950 and 1 3560 on Ebay for less than 200€. I connected the 2950s as square and in the middle I have the 3560,connected to every other switch. With this topology I can simulate any configuration of STP, RSTP, MSTP, etc. &lt;/p&gt;&#xA;" OwnerUserId="23824" LastActivityDate="2016-11-13T23:03:00.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36524" PostTypeId="1" AcceptedAnswerId="36531" CreationDate="2016-11-14T06:07:58.143" Score="7" ViewCount="13584" Body="&lt;p&gt;Here is what the network looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Network A is 192.168.116.X , subnet 255.255.255.0 &#xA;Network B is 12.32.8.X , subnet 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are no routers present in either of the network schemes. All routing is done through unmanaged switches and hubs. Both networks are peer-to-peer and do not rely on DHCP. All machines have static IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need any machine on Network B to be able to reach any node on Network A&lt;/p&gt;&#xA;" OwnerUserId="32055" LastActivityDate="2016-11-14T16:47:38.017" Title="&quot;Bridge” two subnets together?" Tags="|routing|router|subnet|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="36525" PostTypeId="1" AcceptedAnswerId="36526" CreationDate="2016-11-14T06:46:49.777" Score="3" ViewCount="3745" Body="&lt;p&gt;Say I have two servers (droplets in case of DigitalOcean). I want to run a load balancer infornt of the two. So should I spawn a new droplet for the load balancer? If so, how can I utilize the third server for any other purpose as it does only load balancing which couldn't be that resource intensive right?&lt;/p&gt;&#xA;" OwnerDisplayName="user32057" LastActivityDate="2016-11-14T10:34:22.533" Title="Where do you place a load balancer?" Tags="|load-balancer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36526" PostTypeId="2" ParentId="36525" CreationDate="2016-11-14T10:34:22.533" Score="7" Body="&lt;p&gt;Generally your load balancer needs to in a position where it has the ability to terminate connections to your public IPs (assuming you are load-balancing a public-facing site).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your servers can then be hosted using private IP addresses, reachable directly only from the load-balancer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your load-balancer should definitely be a completely independent system (droplet in your case) - there are a number of reasons for this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;While straight load-balancing is not particularly processor intensive, if you opt to perform things like SSL offload, caching, URL re-writing/filtering at your load-balancer, you may find this does have a significant load as your traffic levels scale.&lt;/li&gt;&#xA;&lt;li&gt;Load-balancers act as a fail-over mechanism too, so if one of your back-end servers needs maintenance, you can remove it from the pool, or reboot it without affecting overall availability - if that same droplet hosts the load-balancer and you reboot it, your whole site will become unavailable (unless you have HA load-balancers and can fail between them seamlessly)&lt;/li&gt;&#xA;&lt;li&gt;Separate components can be easily swapped out in future without too much inter-dependency&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-11-14T10:34:22.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36527" PostTypeId="2" ParentId="36365" CreationDate="2016-11-14T11:09:35.627" Score="3" Body="&lt;p&gt;Thanks guys, I was able to figure it out using your help.&#xA;&lt;BR&gt;&lt;BR&gt;&#xA;These are the commands that I use per VLAN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;acl number 3102 name &quot;traffic rules VLAN 102&quot; match-order config&#xA;rule permit ip source 10.102.0.0 0.0.255.255 destination 10.101.0.0 0.0.255.255&#xA;rule permit ip source 10.101.0.0 0.0.255.255 destination 10.102.0.0 0.0.255.255&#xA;rule deny ip&#xA;int vlan 102&#xA;ip address 10.102.1.100 16&#xA;packet-filter 3102 outbound&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I added an explicit &quot;rule deny ip&quot; just to be sure that everything else will be blocked.&lt;BR&gt;&#xA;&lt;BR&gt;&#xA;The HP documentation reads: By default, the packet filter permits packets that do not match any ACL rule to pass. You can set the packet filtering default action to deny by using this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;packet-filter default deny&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I should also say that I don't create an ACL for VLAN 101, so that from this VLAN's point of view, all traffic will be allowed between this VLAN and all the others.&lt;BR&gt;&#xA;&lt;BR&gt;&#xA;This means that I also have to create an ACL for each VLAN that I want to be isolated from all the others. Here's an example for VLAN 6:&#xA;&lt;BR&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;acl number 3006 name &quot;traffic rules VLAN 6&quot; match-order config&#xA;rule deny ip&#xA;int vlan 6&#xA;ip address 10.6.1.100 16&#xA;packet-filter 3006 outbound&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I realize that communication would not be possible if I didn't add an interface on the switch for this VLAN.&lt;BR&gt;&#xA;&lt;BR&gt;&#xA;Anyway, thanks a lot to all you guys for showing me the way!&lt;/p&gt;&#xA;" OwnerUserId="31900" LastActivityDate="2016-11-14T11:09:35.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36529" PostTypeId="2" ParentId="36524" CreationDate="2016-11-14T12:58:37.907" Score="-2" Body="&lt;p&gt;Since all being static: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13718-5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Proxy ARP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2016-11-14T12:58:37.907" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36530" PostTypeId="2" ParentId="36519" CreationDate="2016-11-14T13:18:56.040" Score="0" Body="&lt;p&gt;You would probably like to use netfilter for that. Using iptables utility you can easily restrict or allow communication in the way you described. It's irrelevant of how you perform routing. If OSPF was the choice for sake of access control only, you can replace it with static routing. &lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2016-11-14T13:18:56.040" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36531" PostTypeId="2" ParentId="36524" CreationDate="2016-11-14T13:56:32.667" Score="6" Body="&lt;p&gt;You have two layer 3 domains, but no layer three devices.  That's a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can bridge the networks together, but bridging happens at layer 2.  It does not change the fact that you have two IP subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see only three real possibilities, in descending preference.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Buy a router to route between the subnets.&lt;/li&gt;&#xA;&lt;li&gt;Readdress one or both of the subnets to a common IP subnet.&lt;/li&gt;&#xA;&lt;li&gt;Configure secondary addresses on both devices for a common subnet.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Maybe other readers have more ideas.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-14T13:56:32.667" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36532" PostTypeId="2" ParentId="36524" CreationDate="2016-11-14T14:11:53.700" Score="2" Body="&lt;p&gt;Add a secondary IP address to each NIC card.  The primary being in 192.168.116.X and the secondary being in 12.32.8.X.  Or, the other way around - it does not matter which one is secondary as long as each NIC has an address on both subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You do not need a second NIC card.  This secondary IP address is added/configured in software.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-14T14:11:53.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36535" PostTypeId="1" AcceptedAnswerId="36538" CreationDate="2016-11-14T18:51:07.940" Score="1" ViewCount="185" Body="&lt;p&gt;Based on SDN, data plane's main function is to store and forward packets based on controller's instructions (in the form of flow rules). While I was reading &lt;a href=&quot;https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-switch-v1.5.1.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenFlow Specification v5.1&lt;/a&gt;, I came across to &lt;strong&gt;Set-field&lt;/strong&gt; Action set which can modify the packet header. My question is: Can OpenFlow-based Switch go further than just forwarding to modify the packet header such as changing the IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2016-11-14T22:46:45.910" Title="Openflow-based Switch Action set" Tags="|cisco|ip|sdn|openflow|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36536" PostTypeId="2" ParentId="131" CreationDate="2016-11-14T19:51:37.373" Score="1" Body="&lt;p&gt;Doped fiber amplifier (The typical representative: EDFA)&#xA;Erbium-doped fiber amplifier (EDFA) is the most widely used fiber-optic amplifiers, mainly made of Erbium-doped fiber (EDF), pump light source, optical couplers, optical isolators, optical filters and other components. Among them, a trace impurity in the form of a trivalent erbium ion is inserted into the optical fiber’s silica core to alter its optical properties and permit signal amplification.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WorkingPrinciple&#xA;The working principle of the EDFA is to use the pump light sources, which most often has a wavelength around 980 nm and sometimes around 1450 nm, excites the erbium ions (Er3+) into the 4I13/2 state (in the case of 980-nm pumping via 4I11/2), from where they can amplify light in the 1.5-μm wavelength region via stimulated emission back to the ground-state manifold 4I15/2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Advantages &amp;amp; Disadvantages of EDFA&#xA;Advantages&#xA;•   EDFA has high pump power utilization (&gt;50%)&#xA;•   Directly and simultaneously amplify a wide wavelength band (&gt;80nm) in the 1550nm region, with a relatively flat gain&#xA;•   Flatness can be improved by gain-flattening optical filters&#xA;•   Gain in excess of 50 dB&#xA;•   Low noise figure suitable for long haul applications&#xA;Disadvantages&#xA;•   Size of EDFA is not small&#xA;•   It can not be integrated with other semiconductor deviecs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiber Raman amplifier (FRA)&#xA;Fiber Raman Amplifier (FRA) is also a relatively mature optical amplifier. In a FRA, the optical signal is amplified due to stimulated Raman scattering (SRS). In general, FRA can is divided into lumped type called LRA and distributed type called DRA. The fiber gain media of the former is generally within 10 km. In addition, it requires on higher pump power, generally in a few to a dozen watts that can produce 40 dB or even over gains. It is mainly used to amplify the optical signal band of which EDFA cannot satisfy. The fiber gain media of DRA is usually longer than LRA, generally for dozens of kilometers while pump source power is down to hundreds of megawatts. It is mainly used in DWDM communication system, auxiliarying EDFA to improve the performance of the system, inhibiting nonlinear effect, reducing the incidence of signal power, improving the signal to noise ratio and amplifing online.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Working Principle&#xA;The principle of FRA is based on the Stimulated Raman Scattering (SRS) effect. The gain medium is undoped optical fiber. Power is transferred to the optical signal by a nonlinear optical process known as the Raman effect. An incident photon excites an electron to the virtual state and the stimulated emission occurs when the electron de-excites down to the vibrational state of glass molecule. The Stokes shift corresponding to the eigen-energy of a phonon is approximately 13.2 THz for all optical fibers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Advantages &amp;amp; Disadvantages of FRA&#xA;Advantages&#xA;•   Variable wavelength amplification possible&#xA;•   Compatible with installed SM fiber&#xA;•   Can be used to extend EDFAs&#xA;•   Can result in a lower average power over a span, good for lower crosstalk&#xA;•   Very broadband operation may be possible&#xA;Disadvantages&#xA;•   High pump power requirements, high pump power lasers have only recently arrived&#xA;•   Sophisticated gain control needed&#xA;•   Noise is also an issue&lt;/p&gt;&#xA;" OwnerUserId="32070" LastActivityDate="2016-11-14T19:51:37.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36537" PostTypeId="2" ParentId="36419" CreationDate="2016-11-14T20:13:49.447" Score="3" Body="&lt;p&gt;I'd love to be corrected, but I believe that MobileIP was stillborn.  There's a paper &lt;a href=&quot;http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.572.8593&amp;amp;rep=rep1&amp;amp;type=pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; from a researcher at Rutgers that summarizes the situation.  The problem it was trying to solve - splitting the use of an IPv4 address as an endpoint identifier and a routing label - became less important once the (mobile) community embraced IPv6.&lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2016-11-14T20:13:49.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36538" PostTypeId="2" ParentId="36535" CreationDate="2016-11-14T22:46:45.910" Score="1" Body="&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be more precise, the openflow protocol defines the set-field action, but it depends on the switch implementation whether or not it supports this, and which fields can be modified if it does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus/openflow/b_openflow_agent_nxos_n3kn9k/b_openflow_native_agent_nxos_7x_chapter_01.html&quot; rel=&quot;nofollow&quot;&gt;this doc&lt;/a&gt; mentions that the openflow agent on Cisco NXOS switches support (among others) following actions: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Rewrite source MAC address (SMAC) Supported for the Ethertype values    0x0800 or 0x86DD (IP) only &lt;/li&gt;&#xA;  &lt;li&gt;Rewrite destination MAC address (DMAC)    Supported for the Ethertype values 0x0800 or 0x86DD (IP) only &lt;/li&gt;&#xA;  &lt;li&gt;Rewrite VLAN ID Supported for the Ethertype values 0x0800 or 0x86DD (IP) only&lt;/li&gt;&#xA;  &lt;li&gt;Strip VLAN (Supported for the Ethertype values 0x0800 or 0x86DD (IP)    only)&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;Note      Rewrite DMAC and Rewrite SMAC actions must be specified&#xA;  together.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-11-14T22:46:45.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36540" PostTypeId="1" CreationDate="2016-11-15T06:01:36.437" Score="1" ViewCount="722" Body="&lt;p&gt;How can I verify tht QoS is working for voice traffic? I also have voice server IP address. Can I also know what the session source/dest/port number info?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map match-all avaya&#xA;match access-group name avaya-ef&#xA;match packet length max 100&#xA;&#xA;class-map match-all voice-ip&#xA;match ip precedence 5&#xA;&#xA;!&#xA;policy-map qos-in&#xA;class avaya&#xA;set ip precedence 5&#xA;&#xA;policy-map qos-out&#xA;class voice-ip&#xA;set ip dscp ef&#xA;&#xA;interface GigabitEthernet0/0&#xA;description To LAN&#xA;ip address 172.16.3.1 255.255.255.0&#xA;no ip proxy-arp&#xA;ip accounting output-packets&#xA;duplex full&#xA;speed 100&#xA;no cdp enable&#xA;no mop enabled&#xA;service-policy input qos-in&#xA;service-policy output qos-out&#xA;&#xA;ip access-list extended avaya-ef&#xA;permit ip any any dscp ef&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32076" LastEditorUserId="8499" LastEditDate="2016-11-15T13:15:19.920" LastActivityDate="2017-05-21T22:28:41.970" Title="How to verify Voice QoS dscp and IP predecence traffic session?" Tags="|routing|switch|switching|troubleshooting|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36541" PostTypeId="1" CreationDate="2016-11-15T10:36:00.113" Score="1" ViewCount="404" Body="&lt;p&gt;i'm new here and i have little experience in Cisco Collaboration environment. Now i just want to know the difference between BE6k Restricted and Unrestricted deployment ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="31955" LastActivityDate="2016-11-19T01:14:26.930" Title="BE6k Restricted and Unrestricted" Tags="|cisco|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36542" PostTypeId="2" ParentId="36540" CreationDate="2016-11-15T11:27:35.753" Score="3" Body="&lt;p&gt;To see actual traffic for each class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show policy-map interface gi0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In order to see actual traffic passing through the interface you'll need some kind of network sniffer with combination of port mirroring.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2016-11-15T11:27:35.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36550" PostTypeId="2" ParentId="35939" CreationDate="2016-11-15T21:21:22.950" Score="2" Body="&lt;p&gt;Not all defects are negative. Any protruding defect, or loose contaminant particle, can prevent contact (holding the connector faces apart), scratch the mating connector, or in the case of a loose particle (such as one created by scratching the mating connector) scratch the core.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-11-15T21:21:22.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36551" PostTypeId="1" AcceptedAnswerId="36566" CreationDate="2016-11-15T22:28:00.260" Score="4" ViewCount="1062" Body="&lt;p&gt;I was rushing to help a friend out today who was trying to get a 3750 attached to a 1841 behind a cable modem. He called me at the last minute and figured it would be simple considering his needs were so basic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1841 is the router, connecting to cable modem. Setup a couple of vlan subinterfaces on the 1841 as well as dhcp pools. Attached the 3750 to the router with a trunk link and passed the vlans.  Associated the vlans to ports and did some basic static routes. I was rushed, under a time crunch to get my daughter and well ran into a problem reaching internet from PC. Panicking about my time and not seeing clearly to troubleshoot or figure it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basics are that PC was getting IP from the 1841 via DHCP.  PC could ping vlan subinterface gateway, 192.168.1.1.  PC could ping the Fa0/0 IP. Which is an external IP.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router &lt;strong&gt;could&lt;/strong&gt; ping internet 8.8.8.8 with a basic &quot;ping 8.8.8.8&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router &lt;strong&gt;could NOT&lt;/strong&gt; ping internet when I sourced from VLAN 100 subinterface (192.168.1.1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure what I'm missing but I'm missing something.  So much for 20 years of experience sometimes. Thought this would be the easiest network deployment I've done in 15 years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fact I couldn't ping internet from the internal subinterface bugs me. Issue on the PC seems secondary to the fact I couldn't get the local subinterface to work either.  So its got to just be something on the 1841 at a minimum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config of the 1841:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FT-ROUTER#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 2394 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname FT-ROUTER&#xA;!&#xA;boot-start-marker&#xA;boot system flash c1841-ipbasek9-mz.124-20.T.bin&#xA;boot-end-marker&#xA;!&#xA;logging message-counter syslog&#xA;!&#xA;no aaa new-model&#xA;ip source-route&#xA;!&#xA;ip dhcp excluded-address 192.168.3.1 192.168.3.5&#xA;ip dhcp excluded-address 192.168.2.1 192.168.2.5&#xA;ip dhcp excluded-address 192.168.1.1 192.168.1.5&#xA;!         &#xA;ip dhcp pool MAINDATA&#xA;   network 192.168.1.0 255.255.255.0&#xA;   default-router 192.168.1.1 &#xA;   dns-server 68.105.28.16 68.105.29.16 &#xA;!&#xA;ip dhcp pool PUBLICWIFI&#xA;   network 192.168.2.0 255.255.255.0&#xA;   default-router 192.168.2.1 &#xA;   dns-server 68.105.28.16 68.105.29.16 &#xA;!&#xA;ip dhcp pool SECURITY&#xA;   network 192.168.3.0 255.255.255.0&#xA;   default-router 192.168.3.1 &#xA;   dns-server 68.105.28.16 68.105.29.16 &#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;&#xA;interface FastEthernet0/0&#xA; ip address 98.190.71.2 255.255.255.240&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1.100&#xA; description FT-MAIN-DATA&#xA; encapsulation dot1Q 100&#xA; ip address 192.168.1.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;interface FastEthernet0/1.200&#xA; description FT-PUBLIC-WIRELESS&#xA; encapsulation dot1Q 200&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;interface FastEthernet0/1.300&#xA; encapsulation dot1Q 300&#xA; ip address 192.168.3.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;&#xA;!&#xA;ip default-gateway 98.190.71.1&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 98.190.71.1&#xA;!&#xA;ip nat inside source list 10 interface FastEthernet0/0 overload&#xA;!&#xA;access-list 10 permit 192.168.1.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is a basic diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3UQ7e.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3UQ7e.jpg&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any glaring omissions or thoughts?  I am going to go back out and try to help him tomorrow. Trying to get my thoughts right tonight.&lt;/p&gt;&#xA;" OwnerUserId="22424" LastActivityDate="2016-11-16T22:12:07.613" Title="Cisco 3750 switch to Cisco 1841 router to Cable Modem?" Tags="|cisco|routing|network-core|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36552" PostTypeId="2" ParentId="36551" CreationDate="2016-11-15T22:40:53.740" Score="3" Body="&lt;p&gt;You forgot the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat outside &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the external interface Fa 0/0&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-15T22:40:53.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36555" PostTypeId="1" AcceptedAnswerId="36556" CreationDate="2016-11-16T04:38:41.027" Score="2" ViewCount="10514" Body="&lt;p&gt;Start with 192.168.67.0/24 and split it into 4 equal networks, what is the third usable IP address of the 3rd subnet? how do you solve this?&lt;/p&gt;&#xA;" OwnerUserId="32099" LastActivityDate="2016-11-16T05:41:37.553" Title="Start with 192.168.67.0/24 and split it into 4 equal networks, what is the third usable IP address of the 3rd subnet? how do you solve this?" Tags="|cisco|ipv4|ip|subnet|ipv6|" AnswerCount="1" CommentCount="0" ClosedDate="2016-11-16T12:56:14.770" ContentLicense="CC BY-SA 3.0" />
  <row Id="36556" PostTypeId="2" ParentId="36555" CreationDate="2016-11-16T05:41:37.553" Score="8" Body="&lt;p&gt;Well let's see if i still remember this.&#xA;/24 gives you 8 (32-24) bits to play around with.&#xA;You need 4 networks, so it will take 2 bits to represent them (00 01 10 11)&#xA;So your network part will be 26 (24+2) and four networks will be :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.67.0/26   (last octet in binary 00'00 0000)&#xA;192.168.67.64/26  (last octet in binary 01'00 0000)&#xA;192.168.67.128/26 (last octet in binary 10'00 0000)&#xA;192.168.67.192/26 (last octet in binary 11'00 0000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see your third subnet is &lt;strong&gt;192.168.67.128/26&lt;/strong&gt; first IP represents subnet so it's not usable, first usable IP is 192.168.67.129, second is 192.168.67.130, and &lt;em&gt;drumroll&lt;/em&gt; third &lt;strong&gt;&lt;em&gt;192.168.67.131&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Did i just do your homework?&lt;/p&gt;&#xA;" OwnerUserId="32101" LastActivityDate="2016-11-16T05:41:37.553" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36558" PostTypeId="2" ParentId="10493" CreationDate="2016-11-16T09:03:57.493" Score="0" Body="&lt;p&gt;you need to install security license which by default doesnt come in c1900 series router . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;kindly follow the below link for the steps to install security license&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://ciscofortinet.blogspot.com/b/post-preview?token=rN4WblgBAAA.Uj_fR39ZSsOppiI829wRgKWKcss2ChKJyHD2yFELMuIS8CfPZdyBw6t1iw4tUucukmXONM3JxfYLY6n1hdqejw.WAz_-RdNg4ODJunVu8dqFA&amp;amp;postId=347623917146879627&amp;amp;type=POST&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://ciscofortinet.blogspot.com/b/post-preview?token=rN4WblgBAAA.Uj_fR39ZSsOppiI829wRgKWKcss2ChKJyHD2yFELMuIS8CfPZdyBw6t1iw4tUucukmXONM3JxfYLY6n1hdqejw.WAz_-RdNg4ODJunVu8dqFA&amp;amp;postId=347623917146879627&amp;amp;type=POST&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32103" LastActivityDate="2016-11-16T09:03:57.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36560" PostTypeId="2" ParentId="34987" CreationDate="2016-11-16T13:03:47.837" Score="1" Body="&lt;p&gt;You &lt;em&gt;could&lt;/em&gt; use an event-handler for this I guess, but the easier way to do this is by using a syslog analyser, XMPP client and/or snmptrapd daemon which handles these messages sent from the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two downsides on the event-handler approach:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Arista switches seem to lack the &lt;code&gt;mail&lt;/code&gt; command, so you would need&#xA;to install a custom script to send an email (but hey, it's Linux,&#xA;it's not that hard to install a small python script which allows you&#xA;to send an email)&lt;/li&gt;&#xA;&lt;li&gt;event-handlers on interface changes are linked to specific interfaces, so if you want to monitor interface changes for all&#xA;interfaces, you'd need a lot of handlers.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;But something like this should do the trick:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;event-handler test&#xA;   trigger on-intf Ethernet1 operstatus&#xA;   action bash /path/to/my/mailscript&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-11-16T13:03:47.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36561" PostTypeId="2" ParentId="32571" CreationDate="2016-11-16T14:12:02.560" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is a valid public IP address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;An address that has been allocated by IANA or a RIR to a network for use on the public internet.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why don't I have A valid public IP address and how did I get an invalid one?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most mobile networks don't give out public IPv4 addresses to their users. Instead they run NAT at the ISP level.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is my Geo location off by over 40 miles on this my IP address ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IP geolocation is not an exact science. It usually gets the country right but anything beyond that is highly dubious.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2600:1010:b00b:ecde:3862:7548:5dad:a45a&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a public address but it's an IPv6 one, many sites still haven't caught up with ipv6.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;169.254.30.247 &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a link-local address, packets to/from this address are non-routable. The normal convention with IPv4 is only to use link local addresses when there is no other address assigned to an interface. I'm not sure why your phone has picked this up, maybe a secondary network interface (wifi?) or something.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;10.232.222.212&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is a private IP address, it is routable within your provider's network but not on the Internet in general. There will be a network address translator at your provider which will share a pool of public IP addresses between customers.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the location services always find my exact location&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Android's location services do not rely on IP geolocation. They use a combination of data sources including GPS (if enabled), cell tower IDs and wifi access points in the vicinity. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-16T14:12:02.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36562" PostTypeId="1" AcceptedAnswerId="42879" CreationDate="2016-11-16T14:51:14.077" Score="3" ViewCount="6021" Body="&lt;p&gt;I have inherited a rather weird setup at work, although my forte is servers and cloud, I have to look into network matters as well due to lack of resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This setup has 2 x Fortigate 100Ds (FG1, FG2) and 2 x Cisco 2960X switches (SW1, SW2) will be added as expansion because Fortigates ran out of free switch ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology is as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(VLAN A, B) FG1 &amp;lt;== HA1 Port (Trunks VLANs A, B) ==&amp;gt; FG2 (VLAN A, B)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hosts on FG1's switch ports are able to access to hosts on FG2's switch ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All switch ports are in access mode, no trunk. Only trunk is on HA1 port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;New topology will be like this:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   FG1 &amp;lt;== TRUNK ==&amp;gt; FG2  &#xA;   ||                ||&#xA;   ||                ||&#xA;  TRUNK             TRUNK&#xA;   ||                ||&#xA;   ||                ||&#xA;   SW1 &amp;lt;== TRUNK ==&amp;gt; SW2&#xA;    |                 |&#xA;    |                 |&#xA;  HOSTS             HOSTS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Target is to stop using switch ports on both Fortigates, so all of them will be moved to these 48 port switches, if any of the Fortigate is down, we need all of the hosts in same VLANs to be able to access to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if FG2 is down, topology will be reduced to this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   FG1   &#xA;   ||               &#xA;   ||               &#xA;  TRUNK             &#xA;   ||                &#xA;   ||                &#xA;   SW1 &amp;lt;== TRUNK ==&amp;gt; SW2&#xA;    |                 |&#xA;    |                 |&#xA;  HOSTS             HOSTS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How might I be able to do this without causing a loop?&lt;/p&gt;&#xA;" OwnerDisplayName="user29422" LastActivityDate="2017-07-31T01:45:54.900" Title="How to prevent loop while trunking Fortigate and Cisco L2 Switches" Tags="|cisco|spanning-tree|layer2|fortigate|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36564" PostTypeId="1" AcceptedAnswerId="36565" CreationDate="2016-11-16T15:43:28.663" Score="1" ViewCount="9840" Body="&lt;p&gt;I have  a simple question about a network (I am new to this concept so please correct me if I am wrong).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a simple network as shown (GNS3):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network have 3VLANS (VLAN10 = DesignTeam, VLAN30 = EngTeam and VLAN20=Storage). What I would like is for Vlan30 to be accessed by VLAN10 &amp;amp; VLAN30. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have done some research and I do few things here i.e use router on a stick method but I want to do this via multi-layer switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/G4vzU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G4vzU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I have done:&#xA;&lt;strong&gt;First&lt;/strong&gt; created Vlans&#xA;&lt;strong&gt;Second&lt;/strong&gt; assigned port to my VLAN's:&#xA;VLAN10 = f1/3&#xA;VLAN30 = f1/0&#xA;VLAN20 = f1/4&#xA;&lt;strong&gt;Third&lt;/strong&gt; &#xA;Assign ports to VLAN's:&#xA;&lt;code&gt;MainSwitch#conf t&#xA;     MainSwitch(config)#interface fastEthernet 1/4&#xA;     MainSwitch(config-if)#switchport access vlan 10&#xA;     MainSwitch(config-if)#switchport access vlan 30&#xA;&lt;/code&gt;&#xA;and then if I run show vlan-switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I get different output each time (some port gets assigned to wrong VLAN's) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I doing anything wrong, anything I shod read further?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;if I do: &lt;code&gt;show ip int br&lt;/code&gt; i get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vlan10                     192.168.10.1    YES manual up                    up      &#xA;Vlan20                     192.168.20.1    YES manual up                    up      &#xA;Vlan30                     192.168.30.1    YES manual up                    up &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I did &lt;code&gt;show lan-switch&lt;/code&gt; and I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1    default                          active    Fa1/1, Fa1/2, Fa1/5, Fa1/6&#xA;                                            Fa1/7, Fa1/8, Fa1/9, Fa1/10&#xA;&#xA;10   DesignTeam                       active    Fa1/3&#xA;20   Storage                          active    Fa1/4&#xA;30   EngTeam                          active    Fa1/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I access fa1/3 and do switch port access vlan10 then I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1    default                          active    Fa1/1, Fa1/2, Fa1/5, Fa1/6&#xA;                                        Fa1/7, Fa1/8, Fa1/9, Fa1/10&#xA;&#xA;10   DesignTeam                       active    Fa1/3 Fa1/4&#xA;20   Storage                          active    &#xA;30   EngTeam                          active    Fa1/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see the storage port moved to VLAN10 &#xA;This is what I want (VLAN 10 &amp;amp; 30 have access to 20):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1    default                          active    Fa1/1, Fa1/2, Fa1/5, Fa1/6&#xA;                                        Fa1/7, Fa1/8, Fa1/9, Fa1/10&#xA;&#xA;10   DesignTeam                       active    Fa1/3 Fa1/4&#xA;20   Storage                          active    Fa1/4&#xA;30   EngTeam                          active    Fa1/0 Fa1/4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I still doing anything wrong?&lt;/p&gt;&#xA;" OwnerUserId="24268" LastEditorUserId="24268" LastEditDate="2016-11-17T11:01:24.367" LastActivityDate="2021-01-27T16:41:14.533" Title="How to assign multiple VLANS to a port?" Tags="|vlan|gns3|private-vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36565" PostTypeId="2" ParentId="36564" CreationDate="2016-11-16T16:27:05.223" Score="2" Body="&lt;p&gt;I think you're assigning ports the wrong way.  You have to specify each port before you enter the vlan command.  Something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MainSwitch(config)#interface fastEthernet 1/4&#xA;MainSwitch(config-if)#switchport access vlan 20&#xA;MainSwitch(config)#interface fastEthernet 1/3&#xA;MainSwitch(config-if)#switchport access vlan 10&#xA;MainSwitch(config)#interface fastEthernet 1/0&#xA;MainSwitch(config-if)#switchport access vlan 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you need to assign an IP address to each VLAN interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MainSwitch(config)#interface vlan 10&#xA;MainSwitch(config-if)#ip address 1.2.3.4 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Etc.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-16T16:27:05.223" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36566" PostTypeId="2" ParentId="36551" CreationDate="2016-11-16T16:36:06.573" Score="3" Body="&lt;p&gt;In addition to the missing &lt;code&gt;ip nat outside&lt;/code&gt; command suggested by Ron Trunk, you are only allowing NAT Overload on VLAN 100.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to allow NAT Overload and allow Internet access on VLAN 200 and VLAN 300 you will need to adjust your ACL to include those additional subnets.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Original Code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 10 permit 192.168.1.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Recommend changing to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 10 permit 192.168.1.0 0.0.0.255&#xA;access-list 10 permit 192.168.2.0 0.0.0.255&#xA;access-list 10 permit 192.168.3.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;To answer your second question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is a regular Static PAT statement.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static tcp 192.168.3.50 8080 98.190.71.2 8080 extendable&#xA;ip nat inside source static tcp 192.168.3.51 8081 98.190.71.2 8081 extendable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These may also be needed for UDP traffic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static udp 192.168.3.50 8080 98.190.71.2 8080 extendable&#xA;ip nat inside source static udp 192.168.3.51 8081 98.190.71.2 8081 extendable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2016-11-16T22:12:07.613" LastActivityDate="2016-11-16T22:12:07.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36567" PostTypeId="2" ParentId="36488" CreationDate="2016-11-16T18:06:28.423" Score="1" Body="&lt;p&gt;resolution was to &lt;code&gt;ip route 1.1.1.0/30 [IP on 5k-1]&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1068" LastActivityDate="2016-11-16T18:06:28.423" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36568" PostTypeId="2" ParentId="10516" CreationDate="2016-11-16T18:39:12.920" Score="0" Body="&lt;p&gt;When a host goes to send a packet it first looks in it's routing table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the routing table it determines what interface to send the packet out on and the &quot;next hop IP address&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You haven't said what the subnet masks are on your host, lets assume they are both 255.255.255.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally when sys1 tries to send a packet to sys2 it looks up the IP in it's routing table and decides to send it to it's default gateway. It then looks up the default gateway in it's ARP table (and makes an ARP request if needed). It doesn't try to do an arp request for sys2's IP address because it considers it to be out of network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least on linux this behaviour can be overridden with explicit routing table entries. I don't know about other systems.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-16T18:39:12.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36569" PostTypeId="1" CreationDate="2016-11-16T18:53:31.010" Score="2" ViewCount="2143" Body="&lt;p&gt;I have a fortigate 90b(?) running 5.4.  wan1 is set to a publically accessible address. Our internal network is 192.168.100.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can connect via ipsec and I can access the gateway, which is the fortigate, at 192.168.100.1, when connected, but I can't traverse the internal network or the internet through the gateway.  I gave up on split tunneling until I can figure things out.  The VPN is setup as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   edit &quot;IPSEC_Cisco&quot;&#xA;        set type dynamic&#xA;        set interface &quot;wan1&quot;&#xA;        set mode aggressive&#xA;        set peertype one&#xA;        set mode-cfg enable&#xA;        set proposal aes256-md5 aes256-sha1&#xA;        set dhgrp 2&#xA;        set wizard-type dialup-cisco&#xA;        set xauthtype auto&#xA;        set authusrgrp &quot;vpnUsers&quot;&#xA;        set peerid &quot;linux&quot;&#xA;        set ipv4-start-ip 192.168.100.170&#xA;        set ipv4-end-ip 192.168.100.180&#xA;        set ipv4-netmask 255.255.255.0&#xA;        set dns-mode auto&#xA;        set ipv4-split-include &quot;all&quot;&#xA;        set psksecret ENC [key]&#xA;    next&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Phase 2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config vpn ipsec phase2-interface&#xA;    edit &quot;IPSEC_Cisco&quot;&#xA;        set phase1name &quot;IPSEC_Cisco&quot;&#xA;        set proposal aes256-md5 aes256-sha1&#xA;        set pfs disable&#xA;        set keepalive enable&#xA;    next&#xA;&#xA;&#xA;config firewall policy&#xA;    edit 17&#xA;        set name &quot;IPSEC_Cisco_Internet&quot;&#xA;        set uuid e8bc5412-ab3d-51e6-db87-ba2ff7d3aea2&#xA;        set srcintf &quot;IPSEC_Cisco&quot;&#xA;        set dstintf &quot;wan1&quot;&#xA;        set srcaddr &quot;all&quot;&#xA;        set dstaddr &quot;all&quot;&#xA;        set action accept&#xA;        set schedule &quot;always&quot;&#xA;        set service &quot;ALL&quot;&#xA;        set nat enable&#xA;    next&#xA;    edit 18&#xA;        set name &quot;IPSEC_CISCO_internal&quot;&#xA;        set uuid bbe449ee-ac0b-51e6-de02-0ec32669842e&#xA;        set srcintf &quot;IPSEC_Cisco&quot;&#xA;        set dstintf &quot;internal&quot;&#xA;        set srcaddr &quot;all&quot;&#xA;        set dstaddr &quot;all&quot;&#xA;        set action accept&#xA;        set schedule &quot;always&quot;&#xA;        set service &quot;ALL&quot;&#xA;        set nat enable&#xA;    next&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried everything I know of, which isn't much.  Any insight appreciated.&lt;/p&gt;&#xA;" OwnerUserId="32114" LastEditorUserId="8499" LastEditDate="2016-11-16T19:52:25.767" LastActivityDate="2018-04-12T21:51:14.917" Title="Connecting to fortigate 5.4 with vpnc (ipsec)" Tags="|ipsec|fortigate|fortinet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36570" PostTypeId="2" ParentId="36551" CreationDate="2016-11-16T20:24:18.203" Score="0" Body="&lt;p&gt;Got it working!  Thank you both.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas on how I can allow in a couple of ports mapped to internal addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently security cameras need ports 8080 allowed in to 192.168.3.50&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And 8081 allowed into 192.168.3.51&lt;/p&gt;&#xA;" OwnerUserId="22424" LastActivityDate="2016-11-16T20:24:18.203" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36572" PostTypeId="1" CreationDate="2016-11-16T20:44:35.803" Score="1" ViewCount="1116" Body="&lt;p&gt;Having problems configuring an 1841 to allow outside access in mapping some ports to internal addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Need to allow the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;External IP: port 8080 to 192.168.3.50&#xA;External IP: port 8081 to 192.168.3.51&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config of the 1841:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FT-ROUTER#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 2394 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname FT-ROUTER&#xA;!&#xA;boot-start-marker&#xA;boot system flash c1841-ipbasek9-mz.124-20.T.bin&#xA;boot-end-marker&#xA;!&#xA;logging message-counter syslog&#xA;!&#xA;no aaa new-model&#xA;ip source-route&#xA;!&#xA;ip dhcp excluded-address 192.168.3.1 192.168.3.5&#xA;ip dhcp excluded-address 192.168.2.1 192.168.2.5&#xA;ip dhcp excluded-address 192.168.1.1 192.168.1.5&#xA;!         &#xA;ip dhcp pool MAINDATA&#xA;   network 192.168.1.0 255.255.255.0&#xA;   default-router 192.168.1.1 &#xA;   dns-server 68.105.28.16 68.105.29.16 &#xA;!&#xA;ip dhcp pool PUBLICWIFI&#xA;   network 192.168.2.0 255.255.255.0&#xA;   default-router 192.168.2.1 &#xA;   dns-server 68.105.28.16 68.105.29.16 &#xA;!&#xA;ip dhcp pool SECURITY&#xA;   network 192.168.3.0 255.255.255.0&#xA;   default-router 192.168.3.1 &#xA;   dns-server 68.105.28.16 68.105.29.16 &#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;&#xA;interface FastEthernet0/0&#xA; ip address 98.190.71.2 255.255.255.240&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1.100&#xA; description FT-MAIN-DATA&#xA; encapsulation dot1Q 100&#xA; ip address 192.168.1.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;interface FastEthernet0/1.200&#xA; description FT-PUBLIC-WIRELESS&#xA; encapsulation dot1Q 200&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;interface FastEthernet0/1.300&#xA; encapsulation dot1Q 300&#xA; ip address 192.168.3.1 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;&#xA;!&#xA;ip default-gateway 98.190.71.1&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 98.190.71.1&#xA;!&#xA;ip nat inside source list 10 interface FastEthernet0/0 overload&#xA;!&#xA;access-list 10 permit 192.168.1.0 0.0.0.255&#xA;access-list 10 permit 192.168.2.0 0.0.0.255&#xA;access-list 10 permit 192.168.3.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is a basic diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3UQ7e.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3UQ7e.jpg&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22424" LastActivityDate="2021-01-11T07:05:16.570" Title="Allow port 8080 in on Cisco 1841" Tags="|cisco|routing|router|firewall|cisco-ios|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36573" PostTypeId="2" ParentId="36572" CreationDate="2016-11-16T22:04:30.350" Score="2" Body="&lt;p&gt;Below is a regular Static PAT statement.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static tcp 192.168.3.50 8080 98.190.71.2 8080 extendable&#xA;ip nat inside source static tcp 192.168.3.51 8081 98.190.71.2 8081 extendable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This may be needed for UDP traffic.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static udp 192.168.3.50 8080 98.190.71.2 8080 extendable&#xA;ip nat inside source static udp 192.168.3.51 8081 98.190.71.2 8081 extendable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2016-11-16T22:04:30.350" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36574" PostTypeId="2" ParentId="12701" CreationDate="2016-11-16T22:07:16.340" Score="0" Body="&lt;p&gt;You can not do this by GUI, it can be done only by CLI:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;config system virtual-switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit internal&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config port&#xA;&#xA;  edit internal3&#xA;    set status down&#xA;  next&#xA;&#xA;  edit internal4&#xA;     set status down&#xA;  next&#xA;&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;end&lt;/p&gt;&#xA;&#xA;&lt;p&gt;end&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course internal-switch-mode must be set to interface first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wlodek W.  &lt;/p&gt;&#xA;" OwnerUserId="32116" LastActivityDate="2016-11-16T22:07:16.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36576" PostTypeId="1" AcceptedAnswerId="36691" CreationDate="2016-11-16T22:35:54.017" Score="1" ViewCount="3260" Body="&lt;p&gt;I am very confused with some equipment at work (video encoders). They have 6 Ethernet ports: 2 for management and 4 for data. But the data ports are labelled like 2 for data input and 2 for data output. I wonder why they should be different, if an Ethernet port trasmit and receive at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is un except from the manual:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;The unit has four Ethernet ports - two for data input, and&#xA;two for data output and will respond to ARPs, pings and&#xA;other low-level Ethernet traffic. The ports are accessible&#xA;via RJ-45 connectors on the rear panel of the chassis.&#xA;These are labeled Ge 1, Ge 2, Ge 3 and Ge 4. Ge 1 and&#xA;Ge 2 are used for data input, while Ge 3 and Ge 4 are&#xA;data output.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help in advance.&lt;/p&gt;&#xA;" OwnerUserId="14468" LastActivityDate="2016-11-22T18:46:04.690" Title="Can a Ethernet port be a data input or data output port?" Tags="|ethernet|video|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36577" PostTypeId="1" AcceptedAnswerId="36600" CreationDate="2016-11-16T23:55:11.617" Score="1" ViewCount="4228" Body="&lt;p&gt;Can anybody explain about the main difference in OpenvSwitch(&lt;a href=&quot;http://www.openvswitch.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.openvswitch.org/&lt;/a&gt;) and Openswitch(&lt;a href=&quot;http://openswitch.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://openswitch.net/&lt;/a&gt;). Both of them are open source.&lt;/p&gt;&#xA;" OwnerUserId="23142" LastActivityDate="2016-11-17T21:09:48.397" Title="What is the difference in OpenVSwitch and openswitch?" Tags="|sdn|openflow|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36578" PostTypeId="1" AcceptedAnswerId="36583" CreationDate="2016-11-17T02:00:40.437" Score="7" ViewCount="2993" Body="&lt;p&gt;I am studying up on IPv6 and part of the talk was about how the machines generate or can have multiple IPv6 addresses for internal use and external use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this mean that there is no longer a &quot;public&quot; IP address that all the machines inside a network will use? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The video guide also mentioned that the point of the &quot;privacy&quot; IPv6 was to keep people from accessing the machine directly. Do firewalls no longer exist or was this just a poorly worded explanation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was the CBT IPv6 video series. &lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="8499" LastEditDate="2018-03-12T00:28:52.217" LastActivityDate="2018-03-12T00:28:52.217" Title="IPv6 and online privacy and security" Tags="|routing|ip|nat|ipv6|security|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36579" PostTypeId="2" ParentId="36578" CreationDate="2016-11-17T02:47:55.973" Score="4" Body="&lt;p&gt;For the most part, IPv6 hosts will be assigned Global IPv6 addresses, There are far more of those than can even be imagined for the foreseeable future. All the hosts in in the world can have public IPv6 addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One major weakness of IPv4 is that there are not nearly enough IPv4 addresses to assign a unique IPv4 address to every host, and that was one of the IP design foundations. To forestall the IPv4 address shortage until IPv6 becomes ubiquitous, NAT was created, but NAT is a kludge that breaks the IP end-to-end paradigm, and it causes problems for some things. IPv6 restores the end-to-end paradigm by providing enough IPv6 addresses that every host can have a unique IPv6 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, there will still be firewalls. IPv6 can use firewalls just like IPv4 can. There is no change that prevents that. Firewalls block or allow traffic as the firewall rules have been configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be confusing NAT with firewalls, but the two really have nothing to do with each other. In many cases, a firewall is a convenient place to configure NAT and routing, but neither of those require a firewall. Firewalls are what secure your network, and firewalls run perfectly fine without NAT. In many companies, there are lots of firewalls which do not have NAT configured. Also, there are many places NAT is used which are not on a firewall. All NAT does is to replace either the source or destination, or both, IPv4 addresses in packets with different IPv4 addresses. That is particularly useful if all you have are private IPv4 addresses, and you need to connect to the public Internet, but that is not how IPv4 was originally designed, and it is the shortage of IPv4 addresses which forced NAT on us.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While there are RFCs covering IPv4 NAT, the RFC for IPv6 NAT is classified Experimental, and there may never be a Standard RFC for IPv6 NAT; it simply isn't needed, and the Experimental RFC for IPv6 NAT breaks some things in IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are IPv6 ULA (Unique Local Addresses). These addresses can never connect to the public Internet. These are kind of like IPv4 Private addresses, but there are some rules around ULA. The first half of the address block is reserved for a global authority to assign them. The second half of the address block can be used by anyone, but there are 40 bits immediately after the ULA prefix that must be randomly chosen; you can't simply start with &lt;code&gt;0&lt;/code&gt; then increment for each network. The idea is that you end up with a globally unique set of network addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="645" LastEditDate="2016-11-17T06:23:56.850" LastActivityDate="2016-11-17T06:23:56.850" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36582" PostTypeId="1" CreationDate="2016-11-17T05:28:00.400" Score="2" ViewCount="1870" Body="&lt;p&gt;I am a first year Netacad student and I am having an issue with a word problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The requirements for my network are as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be using packet tracer to design and simulate the network.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;3 offices in 3 cities.  &lt;/li&gt;&#xA;&lt;li&gt;5 Vlans per city. Each Allowing for 250 users.  &lt;/li&gt;&#xA;&lt;li&gt;DHCP for end point management.  &lt;/li&gt;&#xA;&lt;li&gt;Each user should be able to reach other users.  &lt;/li&gt;&#xA;&lt;li&gt;Only one IPv4 address per city. Using PAT will be necessary.  &lt;/li&gt;&#xA;&lt;li&gt;Use layer 2 security on switches for end user connections.  &lt;/li&gt;&#xA;&lt;li&gt;OSPF for internal routing.  &lt;/li&gt;&#xA;&lt;li&gt;All users need unrestricted access to internet.  &lt;/li&gt;&#xA;&lt;li&gt;All devices in company should be managed by one device using SSH.  &lt;/li&gt;&#xA;&lt;li&gt;Include 3 web servers (websites).  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I am having trouble imagining how the topology should look. I am very much able to do the configurations but I would greatly help if someone could help me imagine how the topology might look. Each company has to connect to their own ISP through serial, and each ISP connected by serial as well.&lt;/p&gt;&#xA;" OwnerUserId="32123" LastEditorUserId="453" LastEditDate="2017-05-19T19:47:20.523" LastActivityDate="2017-05-19T19:47:20.523" Title="Need Help Drawing Topology in Packet Tracer" Tags="|cisco|packet-tracer|topology|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36583" PostTypeId="2" ParentId="36578" CreationDate="2016-11-17T05:48:07.613" Score="13" Body="&lt;p&gt;Let's look at a live example. This being from my Linux workstation. (And for simplicity I actually omitted a couple of addresses.) I'll explain each of the addresses in turn:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;$ ip a s dev br0&#xA;3: br0: &amp;lt;BROADCAST,MULTICAST,UP,LOWER_UP&amp;gt; mtu 1500 qdisc noqueue state UP group default qlen 1000&#xA;    link/ether fc:aa:14:25:f1:f1 brd ff:ff:ff:ff:ff:ff&#xA;    inet 172.25.50.17/24 brd 172.25.50.255 scope global br0&#xA;       valid_lft forever preferred_lft forever&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here is your ordinary RFC 1918 address.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    inet6 2001:db8:8301:424c:71a2:70f2:6b1d:a9af/64 scope global temporary deprecated dynamic &#xA;       valid_lft 2120sec preferred_lft 0sec&#xA;    inet6 2001:db8:8301:424c:3caa:9ce6:65ef:1f15/64 scope global temporary deprecated dynamic &#xA;       valid_lft 2120sec preferred_lft 0sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Next we get to global IPv6 addresses. These are routable on the public Internet, and subject to firewall rules, bidirectional communication is possible. That means that anyone (with IPv6) can initiate a connection to this system. Because NAT is not in use, the connection is direct, without any need for port forwarding hackery. But a host or network firewall may still prohibit the connection.&lt;/p&gt;&#xA;&lt;p&gt;But these IPv6 addresses are also &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4941&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4941&lt;/a&gt; privacy addresses. These addresses are created at configurable intervals, and then the previous privacy address is &lt;em&gt;deprecated&lt;/em&gt;. Once an address is deprecated it is no longer used for &lt;em&gt;new&lt;/em&gt; outgoing connections. After another configurable interval, the deprecated address is automatically removed from the interface, and no communication is possible at all.&lt;/p&gt;&#xA;&lt;p&gt;Privacy addresses are meant to protect the privacy of the end host, especially as it moves from one network to another. SLAAC addresses configured using modified EUI-64 always have the same last 64 bits, regardless of what network they connect to, so a host (such as a laptop) could be tracked as it moved across networks by correlating these. Privacy addresses eliminate this problem.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    inet6 2001:db8:8301:424c:8e6e:e3b8:ce7e:aff8/64 scope global mngtmpaddr noprefixroute dynamic &#xA;       valid_lft 2120sec preferred_lft 2120sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This is a fun one. It's also a global address, but it's an &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7217&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 7217&lt;/a&gt; &lt;em&gt;stable&lt;/em&gt; privacy address. These are not simply random, as with RFC 4941 addresses, but generated using a PRNG fed a secret key combined with host-specific information and the assigned IPv6 prefix. They are still unpredictable, but once created, they remain the same for any given IPv6 prefix.&lt;/p&gt;&#xA;&lt;p&gt;Ordinary privacy addresses have the problem that a host using them has no fixed address at which it can be reached when it is on a given network. So incoming connections are impossible. This wasn't really the &lt;em&gt;point&lt;/em&gt;, but more of a side effect (RFC 4941 section 2.4 discusses this in detail.). If you &lt;em&gt;want&lt;/em&gt; incoming connections, but still want privacy when the host moves around, then stable privacy addresses come to the rescue. The host will get a different interface identifier when it moves to another network, but when it goes back to its original network, it will get the same interface identifier it had previously.&lt;/p&gt;&#xA;&lt;p&gt;So, on this system, outgoing connections use the RFC 4941 privacy addresses, which are rotated at intervals, while incoming connections use the stable privacy address, which is published in the global DNS.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    inet6 fda8:75f3:eca7:0:3caa:9ce6:65ef:1f15/64 scope global temporary deprecated dynamic &#xA;       valid_lft 442822sec preferred_lft 0sec&#xA;    inet6 fda8:75f3:eca7:0:d05b:6572:c01c:107/64 scope global temporary deprecated dynamic &#xA;       valid_lft 357022sec preferred_lft 0sec&#xA;    inet6 fda8:75f3:eca7:0:81e4:b3f8:bb92:5fa5/64 scope global temporary deprecated dynamic &#xA;       valid_lft 271224sec preferred_lft 0sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here we have unique local addresses, as defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4193&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4193&lt;/a&gt;. These are routable across subnets, and even across wide area networks, but they are not allowed on the public Internet. This makes them usable as private addresses for any network from the smallest home network to the largest global enterprises.&lt;/p&gt;&#xA;&lt;p&gt;A ULA prefix is always a /48 within fd00::/8 (technically fc00::/7 but the other half is meant to be assigned by IANA) and is meant to be constructed by an algorithm given in RFC 4193, but can be done randomly. It must not be assigned from zero or in any other pattern. If a /48 is not large enough, or two companies merge and need to connect their networks, multiple /48s can be used and the appropriate routes created. The 2^40 space of possible subnets is 256 times the number of possible IPv4 addresses, making collisions extremely unlikely if the ULA prefix is generated properly.&lt;/p&gt;&#xA;&lt;p&gt;The three addresses shown above are deprecated RFC 4941 privacy addresses.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    inet6 fda8:75f3:eca7:0:71a2:70f2:6b1d:a9af/64 scope global temporary dynamic &#xA;       valid_lft 528621sec preferred_lft 9621sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here is the currently valid RFC 4941 privacy address.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    inet6 fda8:75f3:eca7:0:3014:2169:37ba:ebd1/64 scope global mngtmpaddr noprefixroute &#xA;       valid_lft forever preferred_lft forever&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here is a unique local address which is also an RFC 7217 stable privacy address. You can see that its interface identifier is different from the interface identifier of the global stable privacy address.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    inet6 fda8:75f3:eca7::2e4/128 scope global &#xA;       valid_lft forever preferred_lft forever&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And this unique local address was assigned via DHCPv6.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    inet6 fe80::6ef0:f0b6:9b0d:26c6/64 scope link &#xA;       valid_lft forever preferred_lft forever&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Finally, this is a link-local address. It is not routable, and can be reached only on the same layer 2 network. Because this host is using RFC 7217 stable privacy addresses, it too is a stable privacy address.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;On this network, this host can be reached globally at a stable address which also leaks no information about the host's MAC address. It can also be reached via its unique local address by other hosts in several networks on the site to and from which these addresses are routed. And all of these addresses might be used simultaneously.&lt;/p&gt;&#xA;" OwnerUserId="645" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-11-17T05:56:37.777" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36584" PostTypeId="2" ParentId="36576" CreationDate="2016-11-17T06:13:18.307" Score="2" Body="&lt;p&gt;I'm no video coding expert, but what I assume it the case is that these encoders have dedicated ports for receiving the video stream and dedicated ports for sending the encoded stream. On the first set of ports you connect recording devices (e.g. IP based security cameras), on the second set you connect the network which needs to receive the encoded streams. The encoder sends and receives on all interfaces of course, the ports just have a different function, a bit like the difference between a LAN and a WAN port on a consumer grade network.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-11-17T06:13:18.307" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36587" PostTypeId="1" AcceptedAnswerId="36594" CreationDate="2016-11-17T09:47:56.530" Score="4" ViewCount="1519" Body="&lt;p&gt;If &lt;code&gt;wifi&lt;/code&gt;/&lt;code&gt;wlan&lt;/code&gt; is broadcast medium, can we tap the wifi traffic by just placing our &lt;code&gt;wlan0&lt;/code&gt; into &lt;code&gt;promiscuous&lt;/code&gt; mode?. In this way, can we get the source ip and destination ip of the traffic generated by other laptops with or without connecting to &lt;code&gt;AP&lt;/code&gt;? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;Wifi&lt;/code&gt; is not a broadcast medium, why it is not? I mean, the &lt;code&gt;router&lt;/code&gt; or &lt;code&gt;laptop&lt;/code&gt; sending/receiving the singles into/from free space. I answered to &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/24265/capturing-and-sending-802-11-frames-packets/24266#24266&quot;&gt;this question&lt;/a&gt;: that software is showing only &lt;code&gt;beacons&lt;/code&gt; I think!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How wifi works internally and detects the collision?&lt;/p&gt;&#xA;" OwnerUserId="17153" LastEditorDisplayName="user36472" LastEditDate="2019-02-19T08:24:26.210" LastActivityDate="2019-02-19T08:24:26.210" Title="Is Wifi a broadcast medium?" Tags="|wireless|ieee-802.11|tap|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="36588" PostTypeId="2" ParentId="36582" CreationDate="2016-11-17T10:00:57.830" Score="2" Body="&lt;p&gt;Ok, I think there are two variants to look into this, the problematic part where it divides is when you mentioned OSPF should be used for &lt;strong&gt;internal&lt;/strong&gt; routing. If you want to reach other destination through ISP &lt;em&gt;and&lt;/em&gt; use OSPF between sites the ISP routers needs to be part of your OSPF topology, so they would propagate all the networks with OSPF through the whole topology. This picture shows it.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Hgli0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Hgli0.png&quot; alt=&quot;All routers are part of OSPF topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice the orange region is also on links between offices, so they are part of OSPF. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem here is, that this wouldn't be really possible in real life. You can't manage ISP network, so the solution here is to create &lt;em&gt;GRE Tunnels&lt;/em&gt; between every office. That way, the OSPF would use Tunnel interfaces, and from logical part of network it will look like the routers Office A, Office B, Office C are directly connected and can establish neighbours in OSPF through these Tunnel interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For PAT, I guess you also ment one IPv4 address per OFFICE, not per city. It makes much more sense, that means you will make PAT on every Office router and ISP network uses public addresses to connect between cities. You should also use some dynamic routing / static routing in ISP network, to make sure every ISP router can reach public address of office router ( if you go with the way of GRE tunnels. Having ISP routers part of OSPF topology loose the purpose of PAT, because they can directly see on the inside networks).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within one office, users in different VLANs will be reachable by inter-VLAN routing (either on L3 switch or router-on-stick solution with subinterfaces). If they want to reach other site directly and you are using PAT, there needs to be GRE tunnel between sites allowing direct L3 connection. I guess you don't want to create rules in PAT for every user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to sum it up, I think the best solution here is to do GRE tunnels between sites and do OSPF on these interfaces to manage internal network. For external network (ISP) use again OSPF or EIGRP, whatever works for you.&lt;/p&gt;&#xA;" OwnerUserId="16890" LastActivityDate="2016-11-17T10:00:57.830" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36591" PostTypeId="1" AcceptedAnswerId="36597" CreationDate="2016-11-17T11:42:52.813" Score="2" ViewCount="211" Body="&lt;p&gt;My company currently has MPLS and DIA coming from one provider. The firewall allowing all the sites connected to break out onto the DIA is hosted in the MPLS cloud. Now we are upgrading our DIA, but will be using a different ISP. We will keep the MPLS network intact but we are moving the DIA off the MPLS into the Head Office itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Picture attached to make things a bit clearer. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/RXzyz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RXzyz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;So what I am trying to show here is that remote sites previously routed through the MPLS firewall but now all traffic should be routed to the head office routers which then break out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want is for all traffic to remain routed the same for now but want to be able to test the new routing schematic. It was suggested that another VLAN be created on the MPLS routers which all points to the head office router and then that router points to the new firewall. I am not certain that default gateways can be set per-vlan? I would think a whole vrf would be necessary? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the question really is; is there a way I can test the new routes while maintaining current connectivity?&lt;/p&gt;&#xA;" OwnerUserId="32135" LastActivityDate="2016-11-17T17:25:11.883" Title="Suggestions; changing enterprise ISP + current MPLS routing" Tags="|cisco|routing|firewall|mpls|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36593" PostTypeId="2" ParentId="14697" CreationDate="2016-11-17T13:35:00.993" Score="0" Body="&lt;p&gt;I came across exactly the same problem after upgrading to 1.4.5.02. The ACS logs were showing error&quot;13037 Shell Profile Privilege Level not configured correctly&quot;. After a long struggle we manage to fix it by setting the &quot;Maximum privilege level&quot; on the ACS shell Profile to 15. Initially we did not have this set it was not in use, we only had the &quot;Default Privilege level&quot; set to 15. It looks like this firmware version is buggy, it's looking at the wrong attribute.&lt;/p&gt;&#xA;" OwnerUserId="32139" LastActivityDate="2016-11-17T13:35:00.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36594" PostTypeId="2" ParentId="36587" CreationDate="2016-11-17T13:42:46.850" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If wifi/wlan is broadcast medium, can we tap the wifi traffic by just&#xA;  placing our wlan0 into promiscuous mode?.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it is a broadcast medium, in the sense that only one transmitter can be on at a time, and yes, you can sniff Wi-Fi traffic.  The one thing to be aware of is that many Wi-Fi adapter drivers, especially for Windows, can not switch to promiscuous mode.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How wifi works internally and detects the collision?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Wi-Fi uses CSMA/CA, which is different than Ethernet.  It attemps to avoid collisions from happening. &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/10715/why-does-wlan-use-collision-avoidance-and-not-collison-detection&quot;&gt;This question&lt;/a&gt; explains in more detail.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-11-21T12:12:53.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36597" PostTypeId="2" ParentId="36591" CreationDate="2016-11-17T17:25:11.883" Score="1" Body="&lt;p&gt;It is never possible to test a routing change until it has been implemented so the direct answer to your direct question is &quot;no&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that's not really helpful.  More generally, consider why you want to test it and what you really mean by that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally a business wants to test that a new service works.  And then wants post-implementation testing to gain confidence that the new service works for all users in the final state or in several intermediate states, with a roll-back plan if it doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you can test the DIA service with isolated Internet clients at the head office or using client-specific rules on a proxy or whatever is suitable for your particular configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then make whatever change you have planned, and ensure that you have a plan to test that change, and a plan to roll-back wiothion a defined window if necessary.  Note that if your current ISP actually makes that routing change, then you will need to make sure the roll-back plan includes the ISP and is agreed by the ISP.  It may be possible to devise an implementation method that does not involve the ISP directly during your change window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that implementation may have to be big-bang for all your sites (unless you want to start tinkering with different vrfs), but that doesn't mean that all Intenet destinations have to be rolled over at the same time, some key routes might be retained on the old DIA initially.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately it's about business risk and you need to manage it appropriately.  If there's not much risk then you don't need much testing.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-11-17T17:25:11.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36599" PostTypeId="2" ParentId="20265" CreationDate="2016-11-17T18:25:03.927" Score="5" Body="&lt;p&gt;I did just the opposite as eficker, I removed npcap that was installed during the installation of zenmap because I already had winpcap installed for wireshark.  Once npcap was removed, zenmap stopped reporting the issue with eth0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the issue appears to be a confilct between npcap and winpcap.  If you have both installed, it gives you this error.&lt;/p&gt;&#xA;" OwnerUserId="32148" LastActivityDate="2016-11-17T18:25:03.927" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36600" PostTypeId="2" ParentId="36577" CreationDate="2016-11-17T21:09:48.397" Score="1" Body="&lt;p&gt;Good question.  The 5 second, and facetious answer is that OpenSwitch needs real wires and ports whereas OpenVswitch doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In more detail: OpenSwitch is switching software that you ultimately deploy onto a physical switch.  Think of it as the equivalent of IOS or CatOS or JunOS.  It's going to be controlling some real hardware ports.  OpenVSwitch, on the other hand, is switching software that you deploy on a virtualized or cloud layer.  There are no hardware ports on this switch: its representation is entirely in software.  For example, when you have two virtual machines running on a compute hosts, talking to one another, their traffic will be crossing a virtual switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In even more detail: OpenSwitch expects to use &lt;a href=&quot;http://onie.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ONIE&lt;/a&gt; hardware whereas OpenvSwitch only cares that you have some virtualization plumbing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a lot of work going into SDN and virtualized switching right now.  For example, imagine that you could control the ONIE device by software based on workloads and conditions.  This is your SDN play.  In another domain: how do you get the best possible performance out of a software vswitch when it's running in an environment where the host CPU has to service a bunch of competing tasks?  It's a very interesting area.&lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2016-11-17T21:09:48.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36602" PostTypeId="2" ParentId="22247" CreationDate="2016-11-17T21:23:49.570" Score="0" Body="&lt;p&gt;This is somewhat orthogonal to the OP's intent, but I have found that being very restrictive on wired ports while at the same time creating and opening up a guest wifi AP eliminates all the casual accidents (e.g. a visitor plugging in) and at the same time makes the company environment more welcoming to visitors.  So you get two benefits for the price of one, or, putting it another way, you can deliver a benefit to your management while getting a security benefit as a side effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My other observation is that attackers are very smart, and the work/payoff reward calculation is tilting against direct intrusion over the network and in favor of just leaving a USB stick on a desk and waiting for someone to find it and plug it into their (legitimate, on the authorized LAN) PC.  Yikes.&lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2016-11-17T21:23:49.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36603" PostTypeId="1" AcceptedAnswerId="36604" CreationDate="2016-11-17T22:29:20.650" Score="2" ViewCount="23026" Body="&lt;p&gt;When doing &lt;code&gt;sh log&lt;/code&gt;, I can see there is a monitor logging configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that console logging is send to the physical console port, and that buffer logging is sent to the memory of the Switch/Router, and trap logging is sent to a Syslog server. Where is the data going if logging Monitor is configured??&lt;/p&gt;&#xA;" OwnerUserId="30328" LastEditorUserId="8499" LastEditDate="2018-03-07T20:10:11.270" LastActivityDate="2018-03-07T20:10:11.270" Title="What does Monitor Logging do in Cisco IOS?" Tags="|cisco|cisco-ios|logging|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36604" PostTypeId="2" ParentId="36603" CreationDate="2016-11-17T23:43:54.710" Score="1" Body="&lt;p&gt;If you mean the &lt;code&gt;terminal monitor&lt;/code&gt; command, that will send debug and system messages to the current terminal session. If you are connected to the device via a VTY line, you need to use this command to see those because it may look like you are connected the the CON line, but you are not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco maintains extensive documentation that is just a search away:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/command/reference/ffun_r/frf003.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IOS Configuration Fundamentals Command Reference, Release 12.2:&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;terminal monitor&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;To display &lt;strong&gt;debug&lt;/strong&gt; command output and system error messages for the&#xA;  current terminal and session, use the &lt;strong&gt;terminal monitor&lt;/strong&gt; EXEC&#xA;  command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;terminal monitor&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Syntax Description&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;This command has no arguments or keywords.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Defaults&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Disabled&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Command Modes&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;EXEC&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Command History&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Rk6gI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Rk6gI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Usage Guidelines&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Remember that all terminal parameter-setting commands are set locally&#xA;  and do not remain in effect after a session is ended.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Examples&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;In the following example the system is configured to display &lt;strong&gt;debug&lt;/strong&gt;&#xA;  command output and error messages during the current terminal session:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# terminal monitor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;logging montor&lt;/code&gt; command will enable terminal line (monitor) logging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios/netmgmt/command/reference/nm_book/nm_09.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IOS Network Management Command Reference&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;logging monitor&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;To enable system message logging to the terminal lines (monitor&#xA;  connections), use the &lt;strong&gt;logging monitor&lt;/strong&gt; command in global&#xA;  configuration mode. To disable logging to terminal lines other than&#xA;  the console line, use the &lt;strong&gt;no&lt;/strong&gt; form of this command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging monitor [discriminator discr-name] [severity-level]&#xA;&#xA;no logging monitor&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;h2&gt;Syntax Description&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/iTI6Z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iTI6Z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Command Default&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The logging monitor function is disabled.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Command Modes&lt;/h2&gt;&#xA;  &#xA;  &lt;h2&gt;Global configuration (config)&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Command History&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cHRcE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cHRcE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Usage Guidelines&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Specifying a severity-level causes messages both at that level and at&#xA;  numerically lower levels to be displayed to the monitor. Table 32&#xA;  shows a list of levels and corresponding syslog definitions.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Table 32 Error Message Logging Priorities and Corresponding Syslog&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Definitions&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/umNbW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/umNbW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Examples&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The following example shows how to specify that messages at levels 3&#xA;  (errors), 2 (critical), 1 (alerts), and 0 (emergencies) be logged to&#xA;  monitor connections:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# logging monitor 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The following example shows how to use a discriminator named monitor1&#xA;  to filter critical messages, meaning that messages at levels 0, 1, and&#xA;  2 are filtered:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# logging monitor discriminator monitor1 critical&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;h2&gt;Related Commands&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/24RvW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/24RvW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-17T23:59:44.440" LastActivityDate="2016-11-17T23:59:44.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36605" PostTypeId="1" AcceptedAnswerId="36609" CreationDate="2016-11-18T00:08:05.660" Score="8" ViewCount="19012" Body="&lt;p&gt;I am a quite a beginner in network engineering so please be nice. I am not sure I understand how ARP protocol works in some situation. For example, if we have following problem: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP cache is empty&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;host1 (source) --&gt; router1 (default)&lt;/li&gt;&#xA;&lt;li&gt;router1 (decision)  -- &gt; router2 &lt;/li&gt;&#xA;&lt;li&gt;router2 (decision)  --&gt; host2 (destination)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is ARP used in 1. , 2. or 3. or in all? Is ARP used between routers or only host and routers? And what if some router (like router1) is default for some host, is then ARP used?&lt;/p&gt;&#xA;" OwnerUserId="32151" LastActivityDate="2021-09-13T19:00:49.017" Title="When exactly is ARP protocol is used" Tags="|router|arp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36606" PostTypeId="2" ParentId="36605" CreationDate="2016-11-18T00:15:26.120" Score="2" Body="&lt;p&gt;You really don't supply enough information to be able to answer the questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP is use by &lt;em&gt;some&lt;/em&gt; layer-2 protocols to resolve the layer-2 address from the layer-3 address. Not all layer-2 protocols use ARP. For example, a host that needs to contact another host (a router is just another host to layer-2) on ethernet will use ARP, but a host that needs to connect to another host using PPP will not use ARP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, for instance, your two routers are connected via PPP (this is not uncommon), ARP will not be used for the second case, but if the two routers are connected via ethernet, then ARP will be used.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-18T00:22:10.000" LastActivityDate="2016-11-18T00:22:10.000" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="36607" PostTypeId="1" CreationDate="2016-11-18T01:46:16.277" Score="3" ViewCount="833" Body="&lt;p&gt;I'm a bit of a newbie when it comes to networking, so excuse my ignorance for asking this.&#xA;I did try to post this on the Cisco support forums, but kept getting told it was spam haha, so I hope this is the appropriate place to post&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially we have 2 separate networks, one for our VoIP system, running off VLAN100 (As it was originally configured to host both voice and data) that contains all of our handsets, and the router for the dedicated VoIP internet connection. One of the switches in this network is a Cisco Catalyst 2960-X Series. We are getting a new CCTV camera that is PoE, and want to hook it up to our other network that is dedicated for data. It contains all the workstations, servers, and separate router for a dedicated data internet connection. But the switches on this network don't have PoE.&#xA;My question is, is there a way of separating 2 ports on the Cisco switch so that the PoE CCTV camera can connect to it for power, and then another connection going to the data network switch, so it essentially becomes part of the data network, without any interference from the VoIP network that is connected to all the other ports on the switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone would be able to let me know if this is doable or not, and if so, I'd love to know what exactly has to be setup for this to happen.&#xA;I'm new to networking, I've only ever programmed this Cisco switch once for some minor adjustments, but I'm not sure what even to search to get this setup, so I'm a bit stuck.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought that maybe having the separate VLAN's would work, but would prefer to have 2 ports working totally independent of the rest of the ports on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any help!! I hope this makes sense haha&lt;/p&gt;&#xA;" OwnerUserId="32154" LastEditorUserId="8499" LastEditDate="2018-03-13T14:26:43.193" LastActivityDate="2018-03-13T14:26:43.193" Title="Isolating ports on a Cisco Catalyst 2960-X Switch" Tags="|cisco|switch|cisco-catalyst|power-over-ethernet|switchport|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36608" PostTypeId="2" ParentId="36607" CreationDate="2016-11-18T02:03:04.823" Score="1" Body="&lt;p&gt;You only need one switch interface, and you can only use the one switch interface for one interface in your camera. You could use an inline power injector if the switch interface you want to use for the camera doesn't have PoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should really separate your standard data from any real-time data (VoIP, video, etc.) by using VLANs. VoIP, especially, can suffer if you mix the two on the same VLAN. It then becomes much easier to apply QoS to the traffic because you can simply base the marking on the VLAN. I would think you want a data VLAN, a VoIP VLAN, and a video VLAN. VoIP definitely needs priority queues, and video would benefit from separate priority queues, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-18T02:03:04.823" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36609" PostTypeId="2" ParentId="36605" CreationDate="2016-11-18T03:45:09.207" Score="9" Body="&lt;p&gt;Address Resolution Protocol (ARP) is used to resolve an &lt;strong&gt;IPv4 address&lt;/strong&gt; (32 bit Logical Address) to the physical address (48 bit MAC Address). Network Applications at the Application Layer use IPv4 Address to communicate with another device. But at the &lt;strong&gt;Datalink layer&lt;/strong&gt;, the addressing is &lt;strong&gt;MAC address&lt;/strong&gt; (48 bit Physical Address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How it works&lt;/strong&gt;&lt;br&gt;&#xA;Step 1: If a source device want to communicate with another device, source device checks its Address Resolution Protocol (ARP) cache to find if it already has a resolved MAC Address of the destination device. If it is there, it will use that MAC Address for communication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 2: If ARP resolution is not there in local cache, the source machine will generate an Address Resolution Protocol (ARP) request message, it puts its own data link layer address as the Sender Hardware Address and its own IPv4 Address as the Sender Protocol Address. It fills the destination IPv4 Address as the Target Protocol Address. The Target Hardware Address will be left blank, since the machine is trying to find that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 3: The source broadcast the Address Resolution Protocol (ARP) request message to the local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 4: The message is received by each device on the LAN since it is a broadcast. Each device compare the Target Protocol Address (IPv4 Address of the machine to which the source is trying to communicate) with its own Protocol Address (IPv4 Address). Those who do not match will drop the packet without any action.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 5: When the targeted device checks the Target Protocol Address, it will find a match and will generate an Address Resolution Protocol (ARP) reply message. It takes the Sender Hardware Address and the Sender Protocol Address fields from the Address Resolution Protocol (ARP) request message and uses these values for the Targeted Hardware Address and Targeted Protocol Address of the reply message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 6: The destination device will update its Address Resolution Protocol (ARP) cache, since it need to contact the sender machine soon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 7: Destination device send the Address Resolution Protocol (ARP) reply message and it will NOT be a broadcast, but a unicast in order to save network resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 8: The source machine will process the Address Resolution Protocol (ARP) reply from destination, it stores the Sender Hardware Address as the layer 2 address of the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 9: The source machine will update its Address Resolution Protocol (ARP) cache with the Sender Hardware Address and Sender Protocol Address it received from the Address Resolution Protocol (ARP) reply message.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Machines at local network can't communicate if they don't know the MAC Address of each other. Neither &lt;strong&gt;Internal IP Address&lt;/strong&gt; can be used for that. If a router wants to communicate with its client or with the other router then it must know the MAC Address of its client and the other router as well.&lt;/p&gt;&#xA;" OwnerUserId="28180" LastEditorUserId="28180" LastEditDate="2016-11-18T04:18:00.780" LastActivityDate="2016-11-18T04:18:00.780" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36610" PostTypeId="2" ParentId="22247" CreationDate="2016-11-18T05:26:34.957" Score="3" Body="&lt;p&gt;No because MAC addresses are easily spoofed.  802.1x is the proper tool for the job.  With 802.1x, one of the connections methods could be, when you connect (whether wireless or wired), you are sent to a captive portal (aka splash page) via your browser where you can accept the terms of use, optionally enter a required password, etc.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-11-18T15:59:53.770" LastActivityDate="2016-11-18T15:59:53.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36611" PostTypeId="2" ParentId="36569" CreationDate="2016-11-18T07:56:24.160" Score="2" Body="&lt;p&gt;There's 2 things I notice:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1- You assign IP addresses to the VPN clients in the same range as for internal (LAN) hosts. When a client dials in the FGT (90&lt;strong&gt;D&lt;/strong&gt;) automatically creates a host route to this client. In your case, there are now 2 routes to the same subnet: one ad-hoc route to the client and one 'connected' route to the LAN. This shouldn't be the case.&lt;br&gt;&#xA;When a client pings a host on the LAN the LAN host replies to a 'local' address. That is, it doesn't need to reply to the router (your FGT) but tries to find the client on the LAN, without success. Local addressing always has precedence over routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, assign an unused address space to your VPN clients, like 172.16.172.[10-100].  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2- You don't have to apply NAT in policy 18 (tunnel -&gt; LAN) regardless of the client addresses used. As mentioned above the FGT will insert a matching route when you connect. You would only need to NAT if there was no route back.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-11-18T07:56:24.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36615" PostTypeId="2" ParentId="36541" CreationDate="2016-11-18T17:25:41.650" Score="1" Body="&lt;p&gt;These are export restricted versus unrestricted. If they're going to be operating in countries that have U.S. export restrictions placed against them, you'd have to use the restricted option. If you're only operating in the U.S., unrestricted is fine.&lt;/p&gt;&#xA;" OwnerUserId="1286" LastActivityDate="2016-11-18T17:25:41.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36617" PostTypeId="1" CreationDate="2016-11-18T20:21:49.267" Score="2" ViewCount="1293" Body="&lt;p&gt;This is my first post into Cisco Forum, however I'm used to check it for every question or problem I have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm putting back in production a Cisco 4507R-E switch with two supervisors, and what I need si to enable all SFP ports of 1Gbit by giving up the four ten gigabit ports, which I don't need anymore for the new purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read that to accomplish that i need to issue the next command on the global config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hw-module uplink select gigabitethernet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But the switch do no recognise the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MAT_SW1_PT2(config)#hw-module ?&#xA;  module  Specify a linecard slot for the hw-module command&#xA;  slot    Specify a linecard slot for the hw-module command&#xA;&#xA;MAT_SW1_PT2(config)#hw-module&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is my running-config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;MAT_SW1_PT2#sh module&#xA;Chassis Type : WS-C4507R-E&#xA;&#xA;Power consumed by backplane : 40 Watts&#xA;&#xA;Mod Ports Card Type                              Model              Serial No.&#xA;---+-----+--------------------------------------+------------------+-----------&#xA; 1    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  JAE14041TI2&#xA; 2    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  JAE14041TDM&#xA; 3     6  Sup II+10GE 10GE (X2), 1000BaseX (SFP) WS-X4013+10GE      JAE1345NFR6&#xA; 4     6  Sup II+10GE 10GE (X2), 1000BaseX (SFP) WS-X4013+10GE      JAE1342LA4P&#xA; 5    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  JAE14041TH1&#xA; 6    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  JAE14310J4A&#xA; 7    48  10/100/1000BaseT (RJ45)V, Cisco/IEEE   WS-X4548-GB-RJ45V  JAE151702VS&#xA;&#xA; M MAC addresses                    Hw  Fw           Sw               Status&#xA;--+--------------------------------+---+------------+----------------+---------&#xA; 1 8843.e16c.6410 to 8843.e16c.643f 4.1                               Ok&#xA; 2 8843.e16c.5ff0 to 8843.e16c.601f 4.1                               Ok&#xA; 3 8843.e141.6740 to 8843.e141.6745 1.8 12.2(31r)SGA 12.2(31)SGA8     Ok&#xA; 4 8843.e141.6746 to 8843.e141.674b 1.8 12.2(31r)SGA 12.2(31)SGA8     Ok&#xA; 5 8843.e16a.a9e0 to 8843.e16a.aa0f 4.1                               Ok&#xA; 6 d0d0.fd3c.80c0 to d0d0.fd3c.80ef 5.0                               Ok&#xA; 7 e05f.b9d0.40e0 to e05f.b9d0.410f 5.1                               Ok&#xA;&#xA;Mod  Redundancy role     Operating mode      Redundancy status&#xA;----+-------------------+-------------------+----------------------------------&#xA; 3   Active Supervisor   SSO                 Active&#xA; 4   Standby Supervisor  SSO                 Standby hot&#xA;&#xA; MAT_SW1_PT2#sh running-config&#xA;&#xA;....&#xA; redundancy&#xA; main-cpu&#xA;  auto-sync standard&#xA; mode sso&#xA;no file verify auto&#xA;&#xA;....&#xA;&#xA;&#xA;MAT_SW1_PT2#sh ver&#xA;Cisco IOS Software, Catalyst 4500 L3 Switch Software (cat4500-IPBASE-M), Version 12.2(31)SGA8, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2008 by Cisco Systems, Inc.&#xA;Compiled Tue 29-Jul-08 12:23 by tinhuang&#xA;Image text-base: 0x10000000, data-base: 0x114B25F4&#xA;&#xA;ROM: 12.2(31r)SGA4&#xA;Pod Revision 16, Force Revision 34, Tie Revision 32&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas?? Could be due old firmware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!!&lt;/p&gt;&#xA;" OwnerUserId="19546" LastActivityDate="2017-08-17T23:30:30.767" Title="Want to disable TenGbE to enable 1GbE Gbics in Cisco 4500" Tags="|cisco|cisco-4500|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36619" PostTypeId="2" ParentId="29459" CreationDate="2016-11-19T01:10:23.780" Score="1" Body="&lt;p&gt;Authenticate one another then scramble the communications crossing that link, i.e., use IPSec.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Internet Protocol Security (IPsec) is a protocol suite for secure&#xA;Internet Protocol (IP) communications that works by authenticating and&#xA;encrypting each IP packet of a communication session. IPsec includes&#xA;protocols for establishing mutual authentication between agents at the&#xA;beginning of the session and negotiation of cryptographic keys to be&#xA;used during the session.&lt;/p&gt;&#xA;&lt;p&gt;IPsec can be used in protecting data flows&#xA;between a pair of hosts (host-to-host), between a pair of security&#xA;gateways (network-to-network), or between a security gateway and a&#xA;host (network-to-host). Internet Protocol security (IPsec) uses&#xA;cryptographic security services to protect communications over&#xA;Internet Protocol (IP) networks. IPsec supports network-level peer&#xA;authentication, data origin authentication, data integrity, data&#xA;confidentiality (encryption), and replay protection.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/IPsec&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-11-19T01:10:23.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36620" PostTypeId="2" ParentId="36541" CreationDate="2016-11-19T01:14:26.930" Score="0" Body="&lt;p&gt;Encryption.  It is illegal to export encryption technologies to some countries, so Cisco makes one without encryption.  With Cisco, the top level part number usually denotes this.  /K8 is unrestricted and /K9 means it includes encryption capabilities.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-19T01:14:26.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36621" PostTypeId="2" ParentId="35890" CreationDate="2016-11-19T01:34:56.927" Score="0" Body="&lt;p&gt;They are feature licenses, thus the &quot;FL-&quot;.  It means your router is licensed to run the telephone system functionality within your Cisco OS, called IOS.  Your router is a PBX, an IP-PBX, ...among many other things.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-19T01:34:56.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36622" PostTypeId="2" ParentId="36603" CreationDate="2016-11-19T01:47:19.677" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Minimum level of severity required for a log message to be sent to a&#xA;  monitor terminal (not the console).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/command/reference/ffun_r/frf013.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IOS Configuration Fundamentals Command Reference&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router# show controllers vip 4 logging&#xA;&#xA; Syslog logging: enabled&#xA;      Console logging: disabled&#xA;      Monitor logging: level debugging, 266 messages logged.&#xA;      Trap logging: level informational, 266 messages logged.&#xA;      Logging to 192.180.2.238&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/1yhuE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1yhuE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-19T01:47:19.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36624" PostTypeId="1" AcceptedAnswerId="36625" CreationDate="2016-11-19T12:44:54.063" Score="1" ViewCount="34" Body="&lt;p&gt;From my point of view, all Wireless networks are cabled to something, Router/VLAN or subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am trying to build a local network system that is distributed wirelessly, For example one Router in Region-A(100 meters distance) can connect to another Router in Region-B(100 meters distance) to form a single network system, in a way that all devices connected to this network can share data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know someone might say that the routers need some physical contact/access in order to form that single network system but i've heard that Facebook is doing it! Facebook is distributing it's data connection using planes and i assumes the planes are not wired to anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please correct me if am wrong.&lt;/p&gt;&#xA;" OwnerUserId="30390" LastEditorUserId="30390" LastEditDate="2016-11-19T13:17:48.697" LastActivityDate="2016-11-19T13:20:27.840" Title="Wi-fi clustering without cables" Tags="|vlan|ieee-802.11|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="36625" PostTypeId="2" ParentId="36624" CreationDate="2016-11-19T13:20:27.840" Score="0" Body="&lt;p&gt;You can do this several ways. Probably the easiest is to get a wireless bridge and use directional antennae on both your WAP and wireless bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For such a short distance, It may be better just to extend the network with fiber.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-19T13:20:27.840" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36626" PostTypeId="1" AcceptedAnswerId="36631" CreationDate="2016-11-19T14:42:46.610" Score="2" ViewCount="76" Body="&lt;p&gt;Wifi routers have a limit on the number of clients that can connect,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming i have many routers and i connect them  together via wireless bridge, then i connect one single long-range antenna that can spread the network over a mile or so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will this allow me to handle more clients?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please correct me if am wrong&lt;/p&gt;&#xA;" OwnerUserId="30390" LastActivityDate="2016-12-19T20:19:43.327" Title="Multiple routers with one long range antenna" Tags="|router|vlan|ieee-802.11|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="36630" PostTypeId="1" AcceptedAnswerId="36632" CreationDate="2016-11-19T19:48:27.663" Score="2" ViewCount="680" Body="&lt;p&gt;Can a single optic fibre installation transmit multiple connections,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, There are two networks, each network sends and receives data to or from. My question is can both the two networks be transmitted through a wired optic fibre? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please correct me if am wrong&lt;/p&gt;&#xA;" OwnerUserId="30390" LastActivityDate="2022-05-19T06:09:27.777" Title="Can one optical fibre transmit multiple networks" Tags="|optics|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36631" PostTypeId="2" ParentId="36626" CreationDate="2016-11-19T19:55:48.850" Score="1" Body="&lt;p&gt;I wanted to cover a large network area with a single Wi Fi connection,But Like Ron Maupin mentioned in the comments above, All i need to do is set up the network in different areas then i connect them using point-to-point antennas via the routers, then split the connections from each router to a bunch of WAPs.&lt;/p&gt;&#xA;" OwnerUserId="30390" LastActivityDate="2016-11-19T19:55:48.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36632" PostTypeId="2" ParentId="36630" CreationDate="2016-11-19T20:03:26.460" Score="1" Body="&lt;p&gt;I think you don't really understand what you are asking. A fiber is a layer-1 link and it will transmit network traffic. It doesn't matter the what the source or destination addresses are on the layer-3 packets; the fiber neither knows or cares what network traffic it carries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What matters is that you use routers. Routers route traffic between networks. You terminate the fiber with a router on each end, and use a routing protocol between the routers to share routes between the routers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-19T20:03:26.460" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36633" PostTypeId="1" AcceptedAnswerId="36634" CreationDate="2016-11-19T22:19:04.433" Score="2" ViewCount="66" Body="&lt;p&gt;(Let me know if you think this question fits the EE site better.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm on a Wi-Fi network using my laptop, and someone else is nearby on a laptop, also using the Wi-Fi, how do our respective devices separate out the signals and know which is intended for whom?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my device, there would be signals coming out from the wireless router for both me and for other person, and it has to sort those out. Likewise, there would be signals coming from the other person's device and intended for the router, which my computer would also want to ignore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does the adapter tell which is which? Why don't these signals interfere with one another if multiple devices are in proximity to one another? How is it possible to have more than two devices (one router, one user) using Wi-Fi in the same area?&lt;/p&gt;&#xA;" OwnerUserId="12126" LastEditorUserId="8499" LastEditDate="2018-11-04T18:49:03.913" LastActivityDate="2018-11-04T18:49:03.913" Title="How does a wireless adapter know which signals are intended for it, rather than another nearby device?" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36634" PostTypeId="2" ParentId="36633" CreationDate="2016-11-19T22:27:13.963" Score="3" Body="&lt;p&gt;Wi-Fi is both a layer-1 (the radio waves) and a layer-2 set of protocols. Each layer-2 frame has layer-2 source and destination addresses (MAC addresses, in the case of Wi-Fi), and the layer-2 addresses tell each host which frames are for that host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how many layer-2 protocols work. For instance, ethernet was also originally designed for a shared medium, and an ethernet switch will still send frames for which is doesn't know a destination interface to all the switch interfaces, and each host will ignore frames not destined for it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-19T22:27:13.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36636" PostTypeId="2" ParentId="20887" CreationDate="2016-11-20T05:25:53.143" Score="1" Body="&lt;p&gt;If you are monitoring 150 routers, I would recommend implementing a network monitoring tool like Solarwinds or Nagios. Solarwinds is a commercial product with a free trail and Nagios is an Open Source solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both will allow you to setup &lt;a href=&quot;http://www.solarwinds.com/topics/snmp-monitoring&quot; rel=&quot;nofollow noreferrer&quot;&gt;SNMP monitoring&lt;/a&gt;, provide a graphical monitoring interface and allow you to configure notifications when a node goes down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.nagios.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Nagios&lt;/a&gt;&#xA;&lt;a href=&quot;http://www.solarwinds.com/network-performance-monitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;Solarwinds&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16882" LastActivityDate="2016-11-20T05:25:53.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36638" PostTypeId="2" ParentId="20887" CreationDate="2016-11-20T05:38:27.623" Score="0" Body="&lt;p&gt;By using monitoring tool solarwind you will be able to get the BGP session status. And the reachability of that site, and lot more.&lt;/p&gt;&#xA;" OwnerUserId="19899" LastActivityDate="2016-11-20T05:38:27.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36639" PostTypeId="1" AcceptedAnswerId="36646" CreationDate="2016-11-20T06:22:42.843" Score="1" ViewCount="234" Body="&lt;p&gt;In one of the articles i read the following regarding Bridge assurance:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;When enabled, BDPU’s are sent out all ports including the backup and alternate for each Hello Period. How this feature works is that it monitors the receipt of BPDUs on point to point links. If it does not hear a reply it changes the port state to an inconsistent state. This prevents any frames forwarding and a loop is avoided. The same is true of UDLD aggressive mode where a port err-disables.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q: When bridge assurance is enabled on a port, does that mean that it will start sending out BPDUs(irrespective of it's STP state)? If Bridge Assurance is enabled on a BLOCKED port, will the Blocked port also start sending BPDUs? If so, why?&#xA;From what i know, the BPDUs are sent out ONLY from Designated ports once the STP is converged.&#xA;Please correct me if i am wrong.&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2016-11-20T12:50:23.367" LastActivityDate="2016-11-20T16:26:25.263" Title="Regarding Bridge Assurance feature" Tags="|spanning-tree|loop|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36641" PostTypeId="2" ParentId="35956" CreationDate="2016-11-20T11:01:31.320" Score="1" Body="&lt;p&gt;The client decides when to create subflows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each subflow has a seperate three-way handshake. When the client sends a syn from an IP address it expects to get the syn-ack sent back to that same IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the subflows have been established data packets can be sent on different subflows as dictated by network performance and local policy (for example the client may consider different connections to have different costs).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-20T11:01:31.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36642" PostTypeId="1" CreationDate="2016-11-20T13:10:30.883" Score="4" ViewCount="738" Body="&lt;p&gt;What exactly happens when switch receives the frame with given EtherType? Does it analyze it at all or only looks if the TPID is present? &lt;/p&gt;&#xA;" OwnerUserId="32191" LastEditorUserId="8499" LastEditDate="2020-07-18T17:50:33.887" LastActivityDate="2020-07-18T17:50:33.887" Title="How does the switch analyse the EtherType field in Ethernet frame?" Tags="|ethernet|switching|layer2|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="36645" PostTypeId="2" ParentId="36617" CreationDate="2016-11-20T16:03:43.507" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;But now, the half of 1Gbit optics remain inactive, and on the other&#xA;  hand, i cannot force TenGigabit interfaces, work at 1000 Mbps full&#xA;  duplex.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Based on you comment, I think I see what you mean. You can have a total of four supervisor interfaces. With a single supervisor card, those are all on the single card, but with dual supervisor cards, you split the total of four active interfaces between the two supervisor cards: the first two interfaces on each card are active, but the last two interfaces on each card are inactive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is because a supervisor card can only handle four interfaces, and only one supervisor at a time is active. It doesn't matter if the interfaces are used as SFP (1 Gbps) or SFP+ (10 Gbps); that is just the way it is. The idea is that you use the four interfaces as uplinks, and when you have dual supervisors, you want the uplinks split between the cards for failover.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-20T16:03:43.507" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36646" PostTypeId="2" ParentId="36639" CreationDate="2016-11-20T16:26:25.263" Score="1" Body="&lt;p&gt;BPDUs are sent out all STP ports. This is because you need to detect a topology change. If the topology changes at a distant switch, the current designated or root ports may need to start blocking, and a blocking interface may need to change to a designated or root port. A switch cannot detect this on a port where it is not sending or receiving BPDUs. STP is dynamic, and it needs to detect and respond to topology changes, even from the other side of a large STP domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice, you really don't want to design a large or complex STP domain, but people do, and STP needs to be able to deal with that.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-20T16:26:25.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36647" PostTypeId="2" ParentId="36642" CreationDate="2016-11-20T16:31:15.597" Score="2" Body="&lt;p&gt;Switches are transparent devices, and they simply don't care about the payload of a frame. A switch is only concerned with the source and destination MAC addresses, and a VLAN tag if the frame happens to use a trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch will use the source MAC address to build or update its MAC address table, and it will use the destination MAC address to figure out to which interface it should forward the frame by searching for the destination MAC address in its MAC address table.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-12-04T14:52:31.097" LastActivityDate="2018-12-04T14:52:31.097" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="36649" PostTypeId="2" ParentId="17614" CreationDate="2016-11-20T17:13:13.520" Score="5" Body="&lt;p&gt;We have been running 802.11k (and 802.11v) on our campus network (~9200 AP's) for close to a year.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are using a controller based Wi-Fi infrastructure (Aruba Networks). Our wired network infrastructure is Cisco. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We did have to disable the advertisement of 802.11k &quot;Quiet IE&quot;s to prevent some compatibility issues with older clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While we have CDP and LLDP enabled on our wired infrastructure, they are not necessary. Everything is handled by the wireless controller(s).&lt;/p&gt;&#xA;" OwnerUserId="18922" LastActivityDate="2016-11-20T17:13:13.520" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36652" PostTypeId="1" CreationDate="2016-11-20T23:32:08.363" Score="1" ViewCount="882" Body="&lt;p&gt;When the total output drops continuously increments, why is it that the output queue never fills up? It always stays on 0.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last clearing of &quot;show interface&quot; counters never&lt;br&gt;&#xA;Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 3339540580&lt;br&gt;&#xA;Queueing strategy: fifo&lt;br&gt;&#xA;Output queue: 0/40 (size/max) &lt;/p&gt;&#xA;" OwnerUserId="6188" LastActivityDate="2016-11-21T00:02:15.827" Title="show interface - total output drops vs output queue" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36653" PostTypeId="2" ParentId="36652" CreationDate="2016-11-21T00:02:15.827" Score="1" Body="&lt;p&gt;Output drops is a cumulative total.  Output queue is a snapshot in time - it may be that at the exact moment you run the command, traffic was not queued, therefore it shows as zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the interface type and queueing configuration, it may be just a single large-sized packet, or burst of packets causing the drop (so you'd have to be very quick to catch it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Duplex issues can also cause output drops (if this is an Ethernet interface) - and these will not be reflected in the output queue.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-11-21T00:02:15.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36655" PostTypeId="2" ParentId="10297" CreationDate="2016-11-21T04:38:33.140" Score="0" Body="&lt;p&gt;CovaraC:&#xA;MPLS is a switching  (S) protocol it's not MPLR (R) Routing, it doesn't know about subnets in 2 3 routers away, it only knows about the connected interface. It also doesn't know which path is the best one to X subnets. MPLS just put a lable for any outgoing packet to any route, it doesn't care if this packet is going out to the best route or not, routing protocols will decide which path is the best. After routing protocols  (OSPF, EIGRP, ISIS, ...) decide which interface and next hop is the best, MPLS will insert one lable for that next hop. Why ? so that next router doesn't need to open the packet and see what is inside for layer 3 ip once mpls knows all lables and next hopes, this is the main purpose of MPLS , reducing CPU and Memory usage. Second is that, when a lable is inserted in low layer before layer 3 , you can put any info and subnets even ipv6 in layer 3, routers with MPLS don't care what is there. they know lables now.&lt;/p&gt;&#xA;" OwnerUserId="32204" LastActivityDate="2016-11-21T04:38:33.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36656" PostTypeId="1" CreationDate="2016-11-21T07:28:05.767" Score="1" ViewCount="3900" Body="&lt;p&gt;I am trying to create 2 vlans- 10 and 20 where 10 is for user and 20 is for DMZ. vlan 30 created is to link between vlans 10 and 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now I'm only able to ping user from vlan to their switch and not to the opposite switch below are my config. Any help is much appreciated!&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EPSjr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EPSjr.jpg&quot; alt=&quot;2 l3 switch topo&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 10&#xA;name user&#xA;&#xA;vlan 20&#xA;name dmz&#xA;&#xA;vlan 30&#xA;name link&#xA;&#xA;interface Vlan10&#xA; ip address 10.100.20.1 255.255.255.0&#xA;&#xA;interface Vlan30&#xA; ip address 192.168.30.1 255.255.255.252&#xA;&#xA;ip route 155.140.254.0 255.255.255.0 192.168.30.2 &#xA;&#xA;&#xA;interface FastEthernet0/1&#xA;&#xA;switchport access vlan 10&#xA;&#xA;switchport mode access&#xA;&#xA;&#xA;interface FastEthernet0/2&#xA;&#xA;switchport trunk allowed vlan 30&#xA;&#xA;switchport trunk encapsulation dot1q&#xA;&#xA;switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 10&#xA;name user&#xA;&#xA;vlan 20&#xA;name dmz&#xA;&#xA;vlan 30&#xA;name link&#xA;&#xA;interface Vlan20&#xA; ip address 155.140.254.1 255.255.255.0&#xA;&#xA;interface Vlan30&#xA; ip address 192.168.30.2 255.255.255.252&#xA;&#xA;&#xA;interface FastEthernet0/1&#xA;&#xA;switchport access vlan 20&#xA;&#xA;switchport mode access&#xA;&#xA;&#xA;interface FastEthernet0/2&#xA;&#xA;switchport trunk allowed vlan 30&#xA;&#xA;switchport trunk encapsulation dot1q&#xA;&#xA;switchport mode trunk&#xA;&#xA;&#xA;&#xA;ip route 10.100.20.0 255.255.255.0 192.168.30.1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My IP Route for switch 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     10.0.0.0/24 is subnetted, 1 subnets    &#xA;C       10.100.20.0 is directly connected, Vlan10    &#xA;     155.140.0.0/24 is subnetted, 1 subnets    &#xA;S       155.140.254.0 [1/0] via 192.168.30.2    &#xA;     192.168.30.0/30 is subnetted, 1 subnets    &#xA;C       192.168.30.0 is directly connected, Vlan30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;switch 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     10.0.0.0/24 is subnetted, 1 subnets    &#xA;S       10.100.20.0 [1/0] via 192.168.30.1    &#xA;     155.140.0.0/24 is subnetted, 1 subnets    &#xA;C       155.140.254.0 is directly connected, Vlan20    &#xA;     192.168.30.0/30 is subnetted, 1 subnets    &#xA;C       192.168.30.0 is directly connected, Vlan30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have configured both with ip routing. Are my routes correct?&lt;/p&gt;&#xA;" OwnerUserId="32206" LastEditorUserId="8499" LastEditDate="2018-03-21T00:54:04.030" LastActivityDate="2018-03-21T00:54:04.030" Title="Configuring 2 layer 3 switch with VLAN" Tags="|cisco|switch|vlan|cisco-catalyst|layer3|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36658" PostTypeId="2" ParentId="36656" CreationDate="2016-11-21T07:49:08.663" Score="1" Body="&lt;p&gt;Your setup with a routed link between the switches should work fine, but you need to check two more points:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure you have enabled &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/inter-vlan-routing/41860-howto-L3-intervlanrouting.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;interVLAN routing&lt;/a&gt; on both switches:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;switch(config)# ip routing&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure you have set a default gateway on each PC (10.100.20.1 for PC2, 155.140.254.1 for PC3).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can check whether your switches are routing properly by checking the routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch# show ip route&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The routing table on both switches must include routes to the 10.100.20.0, 192.168.30.0, and 155.140.254.0 networks.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-11-21T07:49:08.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36661" PostTypeId="1" AcceptedAnswerId="36663" CreationDate="2016-11-21T13:56:54.520" Score="1" ViewCount="1095" Body="&lt;p&gt;Please validate my understanding for the following points with regard to broadcast address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.Broadcast address is relative to a network, so every n/w will have it's own broadcast adress(I can obtain the broadcast address, by replacing all the n/w bits to 1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.When the destination IP address is a broadcast address,the router will send out the packet(by replicating it) out of all available interfaces. That means, if a router has interface f0/1 , f0/2 and f0/3 --then 3 packets will be sent out(each being sent out of one of the interfaces)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.A frame with destination layer 2 broadcast address ( FF:FF:FF:FF:FF:FF) is sent to all the devices in the SAME LAN&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2016-11-21T14:04:14.770" LastActivityDate="2016-11-21T16:00:33.487" Title="Understanding Broadcast address" Tags="|layer2|broadcast|layer3|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36662" PostTypeId="1" AcceptedAnswerId="36670" CreationDate="2016-11-21T14:21:57.953" Score="8" ViewCount="20637" Body="&lt;p&gt;In the &lt;a href=&quot;https://en.wikipedia.org/wiki/Open_Shortest_Path_First&quot; rel=&quot;nofollow noreferrer&quot;&gt;Open Shortest Path First&lt;/a&gt; routing algorithm, the information about connected links is &amp;quot;flooded&amp;quot; throughout the network.&lt;/p&gt;&#xA;&lt;p&gt;How is flooding different from broadcasting?&lt;/p&gt;&#xA;" OwnerUserId="32213" LastEditorUserId="43734" LastEditDate="2023-12-03T13:49:35.053" LastActivityDate="2023-12-03T13:49:35.053" Title="What is the difference between broadcasting and flooding?" Tags="|routing|router|ospf|broadcast|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="36663" PostTypeId="2" ParentId="36661" CreationDate="2016-11-21T14:23:58.100" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I can obtain the broadcast address, by replacing all the n/w bits to&#xA;  1)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Actually you set the host bits to 1, not the network bits. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your other points are OK. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-21T14:23:58.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36666" PostTypeId="2" ParentId="36656" CreationDate="2016-11-21T15:39:58.097" Score="0" Body="&lt;p&gt;If you are routing on your layer-3 switches, I would advise that you not use a VLAN as a point-to-point link between the switches. Treat these as a pair of routers:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no interface Vlan30&#xA;!&#xA;interface FastEthernet0/2&#xA; no switchport&#xA; ip address 192.168.30.1 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no interface Vlan30&#xA;!&#xA;interface FastEthernet0/2&#xA; no switchport&#xA; ip address 192.168.30.2 255.255.255.252&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-21T15:39:58.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36667" PostTypeId="2" ParentId="36661" CreationDate="2016-11-21T15:51:08.163" Score="2" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;1.Broadcast address is relative to a network, so every n/w will have it's own broadcast adress(I can obtain the broadcast address, by&#xA;replacing all the n/w bits to 1)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Not quite, for any given subnet, the Broadcast Address is found by taking a hosts IP address, and seting any bit positions which hold a '0' in the subnet mask to '1'.&lt;/p&gt;&#xA;&lt;p&gt;For example, the broadcast address of  192.168.1.1/24 is 192.168.1.255 because the subnet mask defines the host bits as the last octect, and if they are all changed to 1 in binary, the end result is 11111111 or 255.&lt;/p&gt;&#xA;&lt;p&gt;Since a &amp;quot;Network&amp;quot; may refer to an autonomous system larger than a subnet, the beginning of your question might be better phrased as as a &amp;quot;A Broadcast Address is relative to the subnet on which it originates...&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;Source:&#xA;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc919&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc919&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;2.When the destination IP address is a broadcast address,the router will send out the packet(by replicating it) out of all available&#xA;interfaces. That means, if a router has interface f0/1 , f0/2 and f0/3&#xA;--then 3 packets will be sent out(each being sent out of one of the interfaces)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Not exactly, you're describing how an IP packet is forwarded out physical interfaces, but without describing the IP Adresses of those interfaces, there is not enough information to determine how a broadcast packet would be forwarded.&lt;/p&gt;&#xA;&lt;p&gt;For example, the router may have different subnets available to it on each one of those fast ethernet interfaces, and each subnet has it's own broadcast domain.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;3.A frame with destination layer 2 broadcast address ( FF:FF:FF:FF:FF:FF) is sent to all the devices in the SAME LAN&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;That is correct, and it is worth noting that this is how an ARP request works. If an IP Address needs to be resolved into a MAC address, a broadcast is sent out to all the hosts requesting a reply from the host which has the correct IP address. The host responds in the affirmative with it's MAC address, and in that way the IP is resolved to the MAC.&lt;/p&gt;&#xA;" OwnerUserId="31831" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-11-21T16:00:33.487" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36668" PostTypeId="1" AcceptedAnswerId="36724" CreationDate="2016-11-21T15:53:21.370" Score="3" ViewCount="199" Body="&lt;p&gt;Is it possible to use a bare metal switch circuit switching its ports to emulate a reconfigurable PHY level switching between input ports?&lt;BR&gt;&#xA;Is doing so needs advanced operating systems or just using Open Network linux is sufficient?&lt;BR&gt;&#xA;Is there a less wasteful way for doing this with another hardware of comparable price and performance(48*10G+4*40G)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;BR&gt;&#xA;as stated in comments I need the ability of dynamically change the connections between in ports and out ports. actually i want to send bundles of output ports to some transponders and then some MUXes and then send this WDM outputs to different directions. The role of switch is not adding regeneration as TPXs do 3R regenration. its role is adding reconfigurablity. here is a demonstration of what i am thinking of:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dZx3O.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dZx3O.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32215" LastEditorUserId="1420" LastEditDate="2016-11-25T16:48:48.550" LastActivityDate="2016-11-25T16:48:48.550" Title="Can i use a bare metal switch as a PHY layer switch?" Tags="|switch|switching|layer1|" AnswerCount="2" CommentCount="8" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36669" PostTypeId="1" AcceptedAnswerId="36672" CreationDate="2016-11-21T15:56:34.857" Score="2" ViewCount="208" Body="&lt;p&gt;in this topology, when I change MAC address on attacker NIC to PC2s MAC, where is running webserver, then ex. icmp attacker -&gt; PC1, so in switch CAM is on Fa0/3 same MAC as on Fa0/2 I think so...? Now, when PC1 open browser and send HTTP GET, the frame will get on both, Attacker and PC2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attacker and PC2 have same MAC, when PC1 communicates, switch will send frame to both interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/O7opL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/O7opL.png&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="19815" LastEditorUserId="19815" LastEditDate="2016-11-21T16:38:35.963" LastActivityDate="2016-11-21T16:38:35.963" Title="MAC Spoof frame delivery" Tags="|switch|ethernet|mac|topology|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36670" PostTypeId="2" ParentId="36662" CreationDate="2016-11-21T15:57:48.267" Score="12" Body="&lt;p&gt;Broadcasting is a term that is used on a broadcast domain, which is bounded by layer-3 (routers). Broadcasts are sent to a special broadcast address, both for layer-2 and layer-3. A broadcast cannot cross a layer-3 device, and every host in a broadcast domain must be interrupted and inspect a broadcast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flooding is used by a switch at layer-2 to send unknown unicast frames to all other interfaces. If a frame is not destined for a host which receives it, the host will ignore it and not be interrupted. This, too, is limited to a broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flooding in OSPF (layer-3) means that the routes get delivered to every OSPF router in an area. It really has nothing to do with a broadcast. OSPF doesn't use broadcasts to send routes, it uses unicast or multicast to connect with its neighbors. Each OSPF router needs to have a full understanding of all the routers and routes in its area, and it tells all its neighbors about all its local routes, and any routes it hears about from other neighbors. (OSPF routers are unrepentant gossips.)&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-21T15:57:48.267" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36671" PostTypeId="1" CreationDate="2016-11-21T16:01:42.707" Score="1" ViewCount="1058" Body="&lt;p&gt;In our office we have Verizon (ISP) and an OpenBSD. Now We want to add a second ISP (Comcast) using a Cisco RV320/325 Dual Wan Router. So, my question is regarding the communication between Cisco Dual Wan Router and OpenBSD. Does any one have experience with that type of setups? If so, can you shed a little light in order to understand what do I need to do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate in advance any reply, and also let me know if you need further info about this setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simple Network Topology&#xA;&lt;a href=&quot;https://i.stack.imgur.com/iA4zM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/iA4zM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32216" LastEditorUserId="16930" LastEditDate="2017-09-20T06:16:49.243" LastActivityDate="2018-07-17T21:34:35.600" Title="Dual WAN with Cisco RV320/325 and openbsd" Tags="|cisco|wan|" AnswerCount="3" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36672" PostTypeId="2" ParentId="36669" CreationDate="2016-11-21T16:18:19.207" Score="1" Body="&lt;p&gt;MAC address spoofing is more about network disruption than about stealing information.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch can only have a single MAC address table entry for each MAC address. The attacker will not get every frame destined for its attack target. As frames come into the switch from both the attacker and the target, the MAC address table will flap. Some frames will go to the attacker, and some will go to the original target. Some switches will recognize the flapping, and you can mitigate it.  &lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-21T16:18:19.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36673" PostTypeId="1" AcceptedAnswerId="36689" CreationDate="2016-11-21T16:58:20.220" Score="1" ViewCount="161" Body="&lt;p&gt;I'm trying to figure out how to determine the routes acceptable by a certain AS network by reading its export/import attributes. It may work in some networks that has these headers but some other networks simpley lack this information. lets take AS11559 for instance i use the whois command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;whois -h whois.radb.net -p 43 AS11559&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%  No entries found for the selected source(s).&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but when i use a web tool like Hurricane Electric's bgp search( found here: &lt;a href=&quot;http://bgp.he.net/AS11559#&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bgp.he.net/AS11559#&lt;/a&gt; ) i can see that in the peer list it find these:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Rank    Description     IPv6    Peer &#xA;1   Sprint United States        AS1239&#xA;2   Verizon Business/UUnet United States        AS701&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so two questions comes in mind:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why some ASN networks do not contain IRR records?&lt;/li&gt;&#xA;&lt;li&gt;How do Hurricane electric manage to retreive this data?&lt;/li&gt;&#xA;&lt;li&gt;Is there a better(and native, not scraping) way to retrieve the routing topology of an AS network?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Many thanks in advance :)&lt;/p&gt;&#xA;" OwnerUserId="32221" LastActivityDate="2016-11-22T04:22:15.617" Title="Retreving the inbound/outbound routes of AS Network" Tags="|bgp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36676" PostTypeId="2" ParentId="36671" CreationDate="2016-11-21T18:33:51.110" Score="0" Body="&lt;p&gt;Because you are configuring your Cisco appliance with two WAN interfaces, you are first going to choose if the secondary connection you are adding is going to be for load balancing or for a failover (Cisco refers to this is Smart Link Backup). Once you have determined the purpose of the link, you may also configure the Network Service Detection, Protocol Binding, Service Management (port forwarding), and the bandwidth of your new WAN link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have configured the Cisco RV320, you will have to configure your OpenBSD firewall to correctly manage the new traffic that will be present on your network. How you configure the Firewall will depend on what services are running on it (NAT, IP Filtering, Layer 7 Firewall, etc.) and what you are trying to accomplish. &lt;/p&gt;&#xA;" OwnerUserId="31831" LastEditorUserId="31831" LastEditDate="2016-11-21T18:48:01.573" LastActivityDate="2016-11-21T18:48:01.573" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36678" PostTypeId="1" AcceptedAnswerId="36686" CreationDate="2016-11-21T19:04:48.093" Score="3" ViewCount="1520" Body="&lt;p&gt;I'm using a SSL VPN (F5's 'big-ip edge client') to access a client's network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed that addresses that relate to its network are routed through the VPN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foobar@mac:~$ traceroute subdomain.client.xxx&#xA;traceroute to subdomain.client.xxx (10.254.193.78), 64 hops max, 52 byte packets&#xA; 1  10.248.5.15 (10.248.5.15)  78.741 ms  78.458 ms  78.295 ms&#xA; 2  10.248.5.11 (10.248.5.11)  85.875 ms  78.786 ms  78.515 ms&#xA; 3  10.248.4.5 (10.248.4.5)  78.976 ms  79.368 ms  81.728 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;While addresses that aren't on their network aren't routed through the VPN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;foobar@mac:~$ traceroute google.com&#xA;traceroute to google.com (172.217.17.46), 64 hops max, 52 byte packets&#xA; 1  192.168.1.1 (192.168.1.1)  0.613 ms  0.326 ms  0.281 ms&#xA; 2  x.qwest.net (207.109.x.x)  194.434 ms  178.721 ms  60.471 ms&#xA; 3  x.inet.qwest.net (207.109.y.y)  40.290 ms  20.537 ms  20.901 ms&#xA; 4  cer-edge-17.inet.qwest.net (67.14.8.90)  30.016 ms  29.993 ms  31.269 ms&#xA; 5  216.111.90.126 (216.111.90.126)  103.049 ms  104.267 ms  101.551 ms&#xA; 6  209.85.244.1 (209.85.244.1)  30.493 ms&#xA;    209.85.143.148 (209.85.143.148)  30.415 ms&#xA;    209.85.143.188 (209.85.143.188)  30.039 ms&#xA; 7  72.14.237.130 (72.14.237.130)  30.311 ms&#xA;    209.85.241.47 (209.85.241.47)  30.380 ms  30.432 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In comparison, I've used Juniper's VPN at another client.  There, all traffic was routed via the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this (split routing?) a property of a SSL VPN, or just how the client has configured it?&lt;/p&gt;&#xA;" OwnerUserId="25347" LastEditorUserId="25347" LastEditDate="2016-11-21T20:33:03.990" LastActivityDate="2016-11-22T21:32:38.723" Title="Does all IP traffic go throught a SSL VPN?" Tags="|vpn|sslvpn|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36680" PostTypeId="2" ParentId="36678" CreationDate="2016-11-21T20:34:35.867" Score="3" Body="&lt;p&gt;To answer your question: it depends on how the SSL VPN profile is configured.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot speak specifically to F5's client or Juniper but typically you can send all traffic or partial traffic through the VPN.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The SSL Client software may be able to tell you what &quot;networks&quot; or &quot;subnets&quot; are entering the tunnel.  Cisco's AnyConnect Secure Mobility Client will specifically list the networks it includes into the tunnel.  &quot;Non-Secure Routes&quot; are routes not included in the tunnel while &quot;Secured Routes&quot; are networks included in the tunnel.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suggest looking into &lt;code&gt;Split-Tunnel&lt;/code&gt; or &lt;code&gt;Full Tunnel&lt;/code&gt; VPNs for more details.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2016-11-21T20:34:35.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36681" PostTypeId="2" ParentId="36678" CreationDate="2016-11-21T20:35:50.227" Score="2" Body="&lt;p&gt;A VPN just sets up a logical network interface, and traffic can be, or not, forwarded through it as a network designer sees fit, just as it can through any other router interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't confuse VPN client software, which is really off-topic here. Some host software prevents split tunneling as a security measure.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-22T01:59:50.403" LastActivityDate="2016-11-22T01:59:50.403" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36685" PostTypeId="2" ParentId="36656" CreationDate="2016-11-21T22:16:19.327" Score="0" Body="&lt;p&gt;Ron, the routes on your switches look fine. As RobinG said: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Make sure you have set a default gateway on each PC (10.100.20.1 for&#xA;  PC2, 155.140.254.1 for PC3).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I think that is likely the issue.&lt;/p&gt;&#xA;" OwnerUserId="23968" LastActivityDate="2016-11-21T22:16:19.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36686" PostTypeId="2" ParentId="36678" CreationDate="2016-11-21T22:58:57.177" Score="5" Body="&lt;p&gt;This is a feature that most VPN platforms have. It's called 'split-tunneling'.&#xA;And this is up to the VPN administrator. Some decide to send all traffic through the VPN tunnel and others don't. &lt;/p&gt;&#xA;" OwnerUserId="32233" LastActivityDate="2016-11-21T22:58:57.177" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36689" PostTypeId="2" ParentId="36673" CreationDate="2016-11-22T04:22:15.617" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why some ASN networks do not contain IRR records&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because they don't connect with a provider which requires IRR to configure the import filters on their BGP connections.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How do Hurricane electric manage to retreive this data?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's not the same data. IRR converts ASN to routing policy. That application just needs ASN to text, so can use the ASN allocation records at ARIN, APNIC, etc.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a better (and native, not scraping) way to retrieve the routing topology of an AS network?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no way to discover a ISP's complete topology using any source. The bounding constraints for the exterior-visible topology may be listed in IRR. But there is no requirement to do so beyond mutual agreement of interconnecting parties (aka &quot;convenience&quot;). Private route databases are commonplace.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastActivityDate="2016-11-22T04:22:15.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36690" PostTypeId="2" ParentId="36668" CreationDate="2016-11-22T04:46:52.227" Score="0" Body="&lt;p&gt;A &quot;PHY layer switch&quot; isn't possible. For a start, what's the framing of the traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps you are thinking of a SFP-based regenerator. For example, this &lt;a href=&quot;https://ghipsystems.com/cms/en/network-units/modular-conv/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ghip CONV 2004&lt;/a&gt;. They can be thought of as connecting the two SFP's GMII interfaces back-to-back. As such they have no understanding of the framing (although the CONV2004 is an advanced unit, and so has a electrical tap of the GMII which examines the symbols on the interconnection to do error reporting, and for that reporting it needs to know what the symbols mean, and thus if the traffic is ethernet/SONET/SDH/TV/etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or perhaps you are thinking of the similar devices available for interception applications, with an SFP's GMII interfaced to another SFP's GMII, and a tap of that GMII bus running to two additional SFPs to transmitting copies of the east-west and west-east received traffic. Although even these devices are increasingly using ethernet switching, to allow typical ethernet features on the links to the interception host, such as autonegotiation. Other than for 1000Base-T, these devices aren't very popular as a optical 50:50 splitter is more economic, assuming sufficient optical budget is available. Even for 1000Base-T the wide availability of 4 port switches with a &quot;port copy&quot;/&quot;span&quot;/&quot;intercept&quot; feature gives strong competition to a GMII-based device.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastActivityDate="2016-11-22T04:46:52.227" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36691" PostTypeId="2" ParentId="36576" CreationDate="2016-11-22T05:12:42.807" Score="1" Body="&lt;p&gt;What you have isn't a generic networking device. It's basically a MPEG encoder chip with networking wrapped around it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To reduce jitter to the minimum there is likely one ethernet bus on the ingress side of the encoder chip and another ethernet bus on the egress side of the encoder chip. The management ports run to ethernet ports on the supervising CPU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may not even be able to arc up a TCP link on the input and output ports. A lot of studio video codecs only support the expected packets on the input (such as UDP containing MJPEG images) and only generate the encoded packets on the output (such as UDP containing MPEG-2). To allow IP to work they'll bridge the ethernet bus into the supervisory CPU so that the CPU can generate ARP and so on.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastActivityDate="2016-11-22T05:12:42.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36692" PostTypeId="1" AcceptedAnswerId="36693" CreationDate="2016-11-22T05:46:00.127" Score="0" ViewCount="107" Body="&lt;p&gt;My ISP provides me with an ethernet cable which I connect to my TP-Link router to set up my home network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have assigned a static local IP of 192.168.0.110 to my computer which i wish to make public.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the problem is that my router WAN IP is different from my public IP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lYagc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lYagc.png&quot; alt=&quot;public IP&quot;&gt;&lt;/a&gt; &#xA;&lt;a href=&quot;https://i.stack.imgur.com/d1fwj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/d1fwj.png&quot; alt=&quot;WAN IP&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so of course port forwarding does not work (It does work locally though)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect that there is another router involved which belongs to my ISP and that's why I can't do it. Here are some more screenshots:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute google.com&#xA;traceroute to google.com (216.58.199.142), 30 hops max, 60 byte packets&#xA; 1  192.168.0.1 (192.168.0.1)  1.729 ms  2.158 ms  2.158 ms&#xA; 2  103.51.153.118 (103.51.153.118)  5.662 ms  5.666 ms  5.661 ms&#xA; 3  103.207.10.145 (103.207.10.145)  13.786 ms  13.878 ms  13.882 ms&#xA; 4  * * *&#xA; 5  72.14.196.213 (72.14.196.213)  18.940 ms  18.950 ms  27.285 ms&#xA; 6  209.85.142.228 (209.85.142.228)  27.300 ms  18.450 ms  14.992 ms&#xA; 7  64.233.174.160 (64.233.174.160)  14.160 ms  14.177 ms  14.150 ms&#xA; 8  216.239.48.29 (216.239.48.29)  13.478 ms  13.499 ms  13.487 ms&#xA; 9  bom07s01-in-f14.1e100.net (216.58.199.142)  13.458 ms  13.685 ms  13.649 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the following shows nmap on immediate hop:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nmap 103.51.153.118&#xA;&#xA;Starting Nmap 7.01 ( https://nmap.org ) at 2016-11-22 10:35 IST&#xA;Nmap scan report for 103.51.153.118&#xA;Host is up (0.0073s latency).&#xA;Not shown: 997 closed ports&#xA;PORT     STATE SERVICE&#xA;23/tcp   open  telnet&#xA;2000/tcp open  cisco-sccp&#xA;8291/tcp open  unknown&#xA;&#xA;Nmap done: 1 IP address (1 host up) scanned in 16.01 seconds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16012" LastActivityDate="2016-11-22T07:21:55.203" Title="Making my computer public" Tags="|router|isp|" AnswerCount="1" CommentCount="2" ClosedDate="2016-11-22T15:50:42.720" ContentLicense="CC BY-SA 3.0" />
  <row Id="36693" PostTypeId="2" ParentId="36692" CreationDate="2016-11-22T07:21:55.203" Score="0" Body="&lt;p&gt;You are correct, you're ISP is using an additional box to NAT your connection. They are doing this to conserve IPv4 addresses, and it's called &lt;a href=&quot;https://www.apnic.net/community/ipv6-program/about-cgn&quot; rel=&quot;nofollow noreferrer&quot;&gt;Carrier Grade NAT (CGN)&lt;/a&gt;. This makes it impossible for you to use port-forwards unless your ISP also configures them on their CGN-box (which they will probably refuse to do).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CGN should only be used as a transition mechanism in combination with IPv6. With IPv6 you can have as many public IPs in your network as you need. If your provider is currently not giving you IPv6 addresses, then you should definitely complain about being behind CGN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside: the IP range that you ISP (Syscon?) is using to NAT your connection (172.171.0.0/16) is indeed a public IP range, but one that does not belong to them and is &lt;a href=&quot;http://bgp.he.net/net/172.171.0.0/16&quot; rel=&quot;nofollow noreferrer&quot;&gt;in use by AOL&lt;/a&gt;. If you're having trouble gaming or making Skype calls to the US, that is probably why.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2016-11-22T07:21:55.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36694" PostTypeId="1" AcceptedAnswerId="36721" CreationDate="2016-11-22T09:47:29.263" Score="1" ViewCount="205" Body="&lt;p&gt;The cable is plugged on a Zyxel VES1724-56 DSLAM. It is a VDSL cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eJOHZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/eJOHZ.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HdJPH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/HdJPH.jpg&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24434" LastEditorUserId="8499" LastEditDate="2018-03-20T23:51:53.210" LastActivityDate="2018-03-20T23:51:53.210" Title="What is the name of this cable?" Tags="|layer1|cable|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36696" PostTypeId="2" ParentId="36694" CreationDate="2016-11-22T10:44:14.453" Score="2" Body="&lt;p&gt;The connector is a Centronics 50 like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vUS6N.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vUS6N.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to look for a cable for 25 pairs male with centronics / amphenol connector like &lt;a href=&quot;http://www.l-com.com/ethernet-category-3-25-pair-trunk-cables-male-to-male-90-degree-connectors&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; or &lt;a href=&quot;http://www.sandman.com/25pair.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;:&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2016-11-22T10:44:14.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36701" PostTypeId="2" ParentId="36576" CreationDate="2016-11-22T18:46:04.690" Score="0" Body="&lt;p&gt;Likely this is done for user interface reasons. While it's physically, and logically possible to send and receive on any interface, you may gain some convenience by &lt;em&gt;telling&lt;/em&gt; the end user which ports to use rather than letting them decide. For non-networking people this is easier than forcing them to reconfigure the software just because someone wants to move around the plugs and a sender is now a receiver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a networking perspective, this sounds easy. But from a programmatic perspective, you have to bind a specific conversation to a specific interface and a specific port (regardless of whether they are on the same physical layer 2 or layer 3 network). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also since real-time en/de-coding requires strict real-time processing, the software may optimize communication on an interface for real-time encoding or decoding (possibly both, but you can theoretically always gain some performance by optimizing for a single use). Even the OS could optimize each interface for a specific purpose (Google for real-time operating systems). A really high-end system could even optimize the hardware for a specific purpose.&lt;/p&gt;&#xA;" OwnerUserId="32246" LastActivityDate="2016-11-22T18:46:04.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36703" PostTypeId="1" AcceptedAnswerId="36708" CreationDate="2016-11-22T19:38:58.620" Score="2" ViewCount="529" Body="&lt;p&gt;I setup an unlicensed (BYOD) CSR1000v on AWS per the steps I outlined on &lt;a href=&quot;https://rack.pub/guides/csr1000v-on-aws-ec2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Deploying Cisco CSR1000v on an AWS EC2 Instance&lt;/a&gt;.  I configured the REST api per Cisco CSR 1000v Series Cloud Services Router Software Configuration Guide's &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/configuration/csr1000Vswcfg/RESTAPI.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Support for Management Using the REST API&lt;/a&gt; chapter.  The REST api is up/up per the show command.  &lt;code&gt;user cisco password cisco priv level 15&lt;/code&gt; is also configured.  Lastly, I opened the AWS firewall up to allow everything and can both ping my CSR1000v and can view it via my Web browser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is that I cannot get the REST api connection started.  It just times out.  Debug shows nothing.  Using CURL, and pasting in the example directly from Cisco IOS XE REST API Management Reference Guide's Introducing the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/restapi/restapi/RESTAPIintro.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;IOS XE REST API&lt;/a&gt; chapter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;curl -v -X POST https://&amp;lt;my address&amp;gt;/api/v1/auth/token-services -H &quot;Accept:application/json&quot; -u &quot;cisco:cisco&quot; -d &quot;&quot; --insecure -3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="8499" LastEditDate="2018-02-16T03:52:20.720" LastActivityDate="2018-02-16T03:52:20.720" Title="REST API on CSR1000v (Amazon EC2 Hosted)" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36705" PostTypeId="2" ParentId="36694" CreationDate="2016-11-22T20:02:47.410" Score="1" Body="&lt;p&gt;This is variously called an Amphenol, a Telco 50-way connector, and sometimes (rarely) a Centronics.  In the kinds of places where you find DSLAMs like this unit -- communication service providers-- the term &quot;Amphenol&quot; is what I've heard most.  Basically it is a very convenient form factor for aggregating connections.  In this case, the DSLAM is going to be aggregating multiple connections from end user premises (houses, apartments etc) and so instead of plugging in dozens of individual lines they are aggregated into the Amphenol and connected.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Amphenol was the standard connector used in telcos for aggregating DS1s.  At higher densities other connectors are used, such as coax for DS3.  These days fiber is also used a lot, for even higher densities.&lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2016-11-22T20:02:47.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36706" PostTypeId="1" AcceptedAnswerId="36788" CreationDate="2016-11-22T20:22:13.763" Score="0" ViewCount="1828" Body="&lt;p&gt;I'm trying to see effectiveness of port security on &lt;strong&gt;Cisco&lt;/strong&gt; switches using simulations in &lt;strong&gt;Packet Tracer&lt;/strong&gt;.but first I need to run some &lt;strong&gt;Mac flooding address&lt;/strong&gt; attacks on switches in Packet Tracer. Can anyone tell me how can I simulate this attack in Packet Tracer? &lt;/p&gt;&#xA;" OwnerUserId="20937" LastActivityDate="2022-07-04T14:26:12.113" Title="How to simulate Mac flooding attack in Cisco Packet Tracer?" Tags="|cisco|switch|mac-address|packet-tracer|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36708" PostTypeId="2" ParentId="36703" CreationDate="2016-11-22T21:13:19.413" Score="1" Body="&lt;p&gt;Cisco CSR 1000v Series Cloud Services Router Software Configuration Guide's &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/csr1000/software/configuration/csr1000Vswcfg/csroverview.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco CSR 1000v Series Cloud Services Router Overview&lt;/a&gt; chapter says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Cisco CSR 1000v Amazon Machine Image (AMI) does not support&#xA;  management of the router using the REST API.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;We'll, isn't that nice...&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-22T21:13:19.413" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36709" PostTypeId="2" ParentId="36678" CreationDate="2016-11-22T21:32:38.723" Score="0" Body="&lt;p&gt;It's called split tunneling, is configurable, and should be enabled.  There is no [good] sense in routing Internet bound traffic through a centralized location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, I'm beginning to believe that network-device based VPN's (and firewalls) make no sense at all.  ...y'all heard it here first!&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-22T21:32:38.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36714" PostTypeId="1" AcceptedAnswerId="36718" CreationDate="2016-11-23T05:16:25.863" Score="0" ViewCount="369" Body="&lt;p&gt;I have just installed a layer 2 circuit running from A location to Z location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 firewalls with routing capabilities on both end and layer 2 functionality. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a server on the Z location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know how I can configure both devices to allow routing between the location so other subnets can access the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I configure a static route from the A location to the private IP address of the server? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or do I need to do some sort of router on the stick configuration with VLANs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is much appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="32264" LastActivityDate="2016-12-13T01:13:07.063" Title="Routing over a layer 2 service" Tags="|cisco|routing|firewall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36716" PostTypeId="1" AcceptedAnswerId="36719" CreationDate="2016-11-23T08:00:39.807" Score="2" ViewCount="367" Body="&lt;p&gt;Is it possible to edit the prefix list through netconf in juniper router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using new version of juniper router.&lt;/p&gt;&#xA;" OwnerUserId="3576" LastActivityDate="2016-11-23T10:40:51.707" Title="is it possible edit prefix list using netconf" Tags="|juniper-junos|netconf|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36718" PostTypeId="2" ParentId="36714" CreationDate="2016-11-23T10:31:14.833" Score="1" Body="&lt;p&gt;N.B: See my comment about more details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all devices support static routes then yes, that is one way you can achieve this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if we assign the IP subnet 192.168.0.0/30 for the new layer 2 link between Firewall A and Firewall Z, the interface on FWA facing FWZ can be assigned IP address 192.168.0.1/30 and the interface on FWZ facing FWA can be assigned IP address 192.168.0.2/30.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If FWZ has a second interface in the same subnet as the server (let’s say its 192.168.1.0/24, the FWZ interface is 192.168.1.254 and the server is 192.168.1.10); then on FWA you can configure a static route that points to 192.168.1.0/24 with the next hop address as 192.168.0.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are connecting to the server from a subnet behind FWA (let’s say FWA has an interface in a LAN range at Location A which is 192.168.2.0/24), then you will also need a static route on FWZ that points to the subnet 192.168.2.0/24 via the next hop gateway address of 192.168.0.1. This is so that return traffic from subnet can route back to that LAN behind FWA.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2016-11-23T10:31:14.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36719" PostTypeId="2" ParentId="36716" CreationDate="2016-11-23T10:40:51.707" Score="1" Body="&lt;p&gt;N.B: Please see my comments above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the Junos documentation (&lt;a href=&quot;https://www.juniper.net/documentation/en_US/junos13.3/topics/reference/tag-summary/netconf-junos-xml-protocol-load-configuration.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.juniper.net/documentation/en_US/junos13.3/topics/reference/tag-summary/netconf-junos-xml-protocol-load-configuration.html&lt;/a&gt;) you can use the &lt;code&gt;&amp;lt;configuration-set&amp;gt;&lt;/code&gt; RPC to pass standard CLI configuration statements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for your question of &quot;Is it possible to edit the prefix list through NETCONF in juniper router&quot; the answer is &quot;yes&quot; but I expect that was not quite what you were looking for. I expect you wanted to know if there was a specific RPC for this. I don't know the answer to that question. Look through the Junos YANG modules, they have a very high coverage rate (can't find exact figure right now but it's something like 90% of the CLI via the XML RPC).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Junos stores configuration in its internal back-end database. When a new CLI configuration option is added the database is edited to support this, then an XML RPC in implemented, then finally the CLI command is added. Most CLI commands are translated to the XML RPC internally when working on the CLI and then formatted into the backend config database, so unless you are doing something quite unusual there is a very high chance this is covered by the XML RPC without using the &lt;code&gt;&amp;lt;configuration-set&amp;gt;&lt;/code&gt; call, because XML RPCs are reated to underpin the CLI command.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2016-11-23T10:40:51.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36720" PostTypeId="1" AcceptedAnswerId="36722" CreationDate="2016-11-23T11:10:05.307" Score="1" ViewCount="816" Body="&lt;p&gt;Good day everyone!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am developing a network application that is extremely time sensitive and having an intermediary server is not an option. Therefore, I decided to  implement a udp hole punching algorithm. To simplify, I explain my problem using two points. Let's say A sends something to B. As far as I understand, when A sends something to B, A doesn't not have a lot of choice of which port to use (for sending). OS allocates that port automatically. B however can see port from which A send a packet. Now B tries to send a packet back on that port so that A can read it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an issues/questions that I ran into:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When trying to use a netcat(for testing) on point A listening to port that was used to send packets I get a message that the port is busy. Am i listening to the wrong port? I thought that UDP protocol is connection less and multiple program can use same port at the same time. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is there a way (c#) to see the port that my application is using to send a packet?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The following &quot;diagram&quot; shows a more detailed portion of what I am trying to implement&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A ---------&gt; R ------------&gt; C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When UDP packet recieved on point C it can see the external port of the router at point R. That is where C send a udp packet. Upon receiving a packet the router sends it to A. My problem is how to read that packet on A? Thank you for help&lt;/p&gt;&#xA;" OwnerUserId="30504" LastActivityDate="2016-11-23T12:11:28.383" Title="UDP hole punching. How to listen to a port that is busy?" Tags="|udp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36721" PostTypeId="2" ParentId="36694" CreationDate="2016-11-23T11:40:02.750" Score="1" Body="&lt;p&gt;I can't find a good authoritative source, but as per your picture, we also use in our ADSL and VDSL DSLAMs/MSANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is an RJ21 connector, sometimes also called an RJ21X connector.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.eurovoice.co.uk/index.php/martin-s-blog/53-rj11-rj14-rj21x-rj45-431a&quot; rel=&quot;nofollow noreferrer&quot;&gt;This page&lt;/a&gt; has the more accurate picture I can find. That is how we often use them, pack to a patch panel to break out into RJ11 ports (for testing in the LAB) or back to krone blocks in a live PoP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://ftp.ipsyn.net/pub/mirrrs/cabling/rj21x.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;This page&lt;/a&gt; has a wiring guide.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2016-11-23T11:40:02.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36722" PostTypeId="2" ParentId="36720" CreationDate="2016-11-23T12:11:28.383" Score="1" Body="&lt;p&gt;By default, establishing a Socket connection in your code will chose an arbitrary ephemeral source port (1024-65535), however this can be overridden:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DNS for example uses UDP and both source AND destination port 53 for transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your other questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;UDP is connectionless, but don't confuse this with multiple applications being able to bind to the same socket - if a packet comes in on a specific port, then it can only be delivered to a single application (The exception being applications such as Wireshark which don't specifically bind to a port, but apply a special filter to an interface that copies all traffic sent to it.)  In your case, your application and netcat cannot both bind to the same port.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When s is a Socket, you can pull this information from LocalEndPoint.&lt;br&gt;&#xA;&lt;code&gt;Console.WriteLine (&quot;&quot;I am connected on port number &quot; + ((IPEndPoint)s.LocalEndPoint).Port.ToString ());&#xA;&lt;/code&gt;&#xA;More information here: &lt;a href=&quot;https://msdn.microsoft.com/en-us/library/system.net.sockets.socket.localendpoint(v=vs.110).aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/system.net.sockets.socket.localendpoint(v=vs.110).aspx&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;This is an inherent issue with NAT (Network Address Translation) - the only way to get around it is to specifically configure R to port-forward your traffic back to A.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-11-23T12:11:28.383" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36723" PostTypeId="1" AcceptedAnswerId="36741" CreationDate="2016-11-23T12:20:56.170" Score="1" ViewCount="129" Body="&lt;p&gt;I want to know at which layer is a network cryptor used. What are the features of routers used for encrypted packets?&lt;/p&gt;&#xA;" OwnerUserId="30883" LastActivityDate="2016-11-24T06:52:28.517" Title="How does a network cryptor work?" Tags="|routing|layer2|layer3|layer1|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36724" PostTypeId="2" ParentId="36668" CreationDate="2016-11-23T15:38:35.157" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I need the ability of dynamically change the connections between in&#xA;  ports and out ports.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is what a layer-1 switch does. You cannot convert a layer-2 switch into a layer-1 switch. A layer-1 switch lets you physically connect different ports through configuration. A layer-2 switch simply doesn't have that hardware. Yes, there is a large price difference, but you will need to get the correct equipment for the requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several manufacturers that make layer-1 switches. Unfortunately, product or resource recommendations are explicitly off-topic here. You could try asking for one that meets your specific needs on our sister site, &lt;a href=&quot;https://hardwarerecs.stackexchange.com/&quot;&gt;Hardware Recommendations SE&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-23T15:38:35.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36726" PostTypeId="2" ParentId="36671" CreationDate="2016-11-23T15:59:40.083" Score="1" Body="&lt;p&gt;Ok, for those who are looking for a straight solution without bothering with OpenBSD configuration and avoid handling custom NATTING based on TWO (2) different ISP. I found out that Cisco RV325 has already a place to handle NATTING. That way I was able to setup successfully Verizon and Comcast without messing up with OpenBSD configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open this &lt;a href=&quot;http://sbkb.cisco.com/CiscoSB/ukp.aspx?vw=1&amp;amp;docid=f6916a7709cb43d38d74bd6ef3e8d0a2_Configure_One_toOne_Network_Address_Translation__NAT__on_RV3.xml&amp;amp;pid=2&amp;amp;respid=0&amp;amp;snid=12&amp;amp;dispid=0&amp;amp;cpage=search&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; for more info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7jnSR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7jnSR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32216" LastActivityDate="2016-11-23T15:59:40.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36728" PostTypeId="2" ParentId="35420" CreationDate="2016-11-23T22:03:45.333" Score="0" Body="&lt;p&gt;Based on your mention of ports I will assume that when you say &quot;router&quot; you actually mean &quot;NAT box&quot;. In the home and small buisness markets boxes that come configured by default as NAT boxes are sold as &quot;routers&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you have your client machine and you have two NAT boxes between your client machine and the Internet. Your client wants to retrive a web page from a server on the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens is.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Your client sends the intital packet with it's interface IP (most likely a private IP) as source IP, a random source port and the destination IP and port of the server. It sends the packet to it's default gateway which points at the inside interface of the Inner NAT box.&lt;/li&gt;&#xA;&lt;li&gt;The packet hits the Inner NAT box. This changes the source IP to it's outer address (likely another private address) and possiblly changes the source Port. It then creates an entry it's NAT mapping table and forwards the packet to it's default gateway which points at the Outer NAT box.&lt;/li&gt;&#xA;&lt;li&gt;The packet hits the Outer NAT box. This changes the source IP to it's outer address (this time a public address) and possiblly changes the source Port. It then creates an entry it's NAT mapping table and forwards the packet to it's default gateway which points at a router at the ISP.&lt;/li&gt;&#xA;&lt;li&gt;The ISPs deliver the packet through their (non NAT) routers to the server. This routing may depend on statically configured routes, routing protocols or some combination of both.&lt;/li&gt;&#xA;&lt;li&gt;The server receives the packet and crafts a reply, in the reply the source IP/port is swapped with the destination IP/port. So the destination now points back at the outer NAT box.&lt;/li&gt;&#xA;&lt;li&gt;The ISPs deliver the packet through their (non NAT) routers to the outer NAT box. This routing may depend on statically configured routes, routing protocols or some combination of both.&lt;/li&gt;&#xA;&lt;li&gt;The outer NAT box looks up the packet's IPs and Ports in it's NAT mapping table and performs a reverse translation. The destination now points at the inner NAT box and the packet is sent there.&lt;/li&gt;&#xA;&lt;li&gt;The inner NAT box looks up the packet's IPs and Ports in it's NAT mapping tables and performs a reverse translation. The destination now points at the client and the packet is sent there.&lt;/li&gt;&#xA;&lt;li&gt;The client receives the reply and communication continues back and forth.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you wanted to run a server behind two NAT boxes you would have to manually configure port forwarding rules in both NAT boxes so the outer NAT box would point the traffic at the inner NAT box, then the inner NAT box would point it at the client.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-23T22:03:45.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36729" PostTypeId="1" CreationDate="2016-11-23T23:04:54.350" Score="1" ViewCount="551" Body="&lt;p&gt;Good day all, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;this is my first question here, be gentle in judgement&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Background:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At university, we are covering Network Routing Protocols. Having possibly found 2 issues with current routing protocols, I believe I have a improved solution for routing information to be acquired.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since DNS server's purpose is to store &quot;names&quot; which correspond to server IP's, thus resolving the DNS name to an IP, how are IP's resolved to their   specific node/device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;More Info:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We take for granted the fact that the IP 8.8.8.8 will reach Google's DNS server, but how is this actually routed. What routing information will my node/laptop contain for it to be able to send a TCP/ICMP packet to 8.8.8.8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does the gateway (my router) determine this, does my exchange/DSLam determine this or the ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;In my case, my Linux distro routes all traffic to the lowest route which is my router. The router will route all traffic to the exchange, from there going to the ISP, from here, how does it reach 8.8.8.8&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;TL;DR&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How does a packet specified by an IP 8.8.8.8 get routed to the device with the corresponding IP, and how are those &quot;routers&quot; routing information acquired?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="32270" LastEditorUserId="8499" LastEditDate="2019-01-12T23:07:00.040" LastActivityDate="2021-01-10T12:53:15.283" Title="How are packets routed based on IP and how are those routes acquired?" Tags="|routing|router|ip|ipv4|dns|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36730" PostTypeId="2" ParentId="36729" CreationDate="2016-11-23T23:25:11.803" Score="4" Body="&lt;p&gt;Routers learn about routes in three ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Directly connected networks&lt;/li&gt;&#xA;&lt;li&gt;Manually configured static routes&lt;/li&gt;&#xA;&lt;li&gt;Dynamically through routing protocols&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A router, receiving a packet on an interface will look at the destination address of the packet, and it will look in its routing table to see if it knows how to forward the packet toward its destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router doesn't find any sort of match in its routing table, it will discard the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the router finds a match, even if it is only a default route, it will forward the packet out the new interface toward its destination. The interface towards the packet destination can be connected to another router, and the new router will repeat what the first router did. This router lookup and forward goes on until the packet gets to the network where the destination host is.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-23T23:25:11.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36731" PostTypeId="2" ParentId="35871" CreationDate="2016-11-23T23:49:14.557" Score="0" Body="&lt;p&gt;It appears that the two routers are not able to exchange HSRP Hello packets. I would verify that the two switches have a working Layer 2 connection for vlan111. You can see that the two routers haven't learned of each other by the fact that neither lists the other router as a member of the standby group. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for your Preemption issue, it appears that the standby configuration of &quot;r-ca-103-2&quot; is incorrect. You might try changing &#xA;  &quot;standby 1 priority 150&quot; to &quot;standby 6 priority 150&quot; and &#xA;  &quot;standby 1 preempt&quot; to &quot;standby 6 preempt&quot;&lt;/p&gt;&#xA;" OwnerUserId="32259" LastActivityDate="2016-11-23T23:49:14.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36732" PostTypeId="2" ParentId="36729" CreationDate="2016-11-24T00:00:46.993" Score="2" Body="&lt;p&gt;Google advertise routes to the network block 8.8.8.0/24 over BGP to other networks they connect to. These networks will pass on these route advertisement subject to commercial policies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Typically a network will have three main types of interconnection. Transit providers who sell them service. Transit customers who buy service from them and peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A route recieved from a customer will generally be passed on to customers, providers and peers.&#xA;A route received from a provider or peer will normally only be passed on to customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routes will only generally be passed on if they are considered the best route to a prefix. What exactly &quot;best&quot; means is dependent on local policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Networks making up the Internet are represented by &quot;AS Numbers&quot;. With each AS the route passes through different networks an &quot;AS Path&quot; is built up. This is used to block loops and also in the absense of local rules to the contary is used to dermine the best path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to actually forwarding the packets longer prefixes win over shorter ones (so a route to 8.8.8.0/24 would win over one to 8.8.0.0/16 )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the &quot;edge&quot; parts of your ISPs network the packet will likely be carried by default routes towards your ISPs core. There is little reason to import the complete internet routing table on such devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Within your ISP's core (or for very small ISPs possiblly an upstream provider) there will be routers with a massive routing table covering the whole Internet built up from the routes they have received from other networks. Right now the routing table for the IPv4 Internet has about half a million routes. This table will route the traffic towards Google.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the packet reaches google they will need to route it internally towards one fo theier DNS servers (8.8.8.8 is NOT a single machine). Some operators use a specific internal routing protocol for this, some use BGP internally as well as externally, some may use manual routes. I'm not sure what google does.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-24T00:00:46.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36733" PostTypeId="1" CreationDate="2016-11-24T00:07:42.227" Score="1" ViewCount="636" Body="&lt;p&gt;I am testing two differents lan and I am tring to sniff traffic with Mitm attack using simple Linux shell command like arpspoof and whireshark to sniff the packets. In the first lan I can sniff without problem while in the second lan, using the same techniques, in whireshark I can see that is detected the use of the same ip for two differents MAC and I cannot see http protocol layer packets. Why in the first lan there are no duplicated ip? I thought maybe the switch arp table contains more than one entry with the same ip instead of containing only the modified row.&lt;/p&gt;&#xA;" OwnerUserId="32271" LastActivityDate="2017-06-22T06:45:49.883" Title="Arp spoofing and ip detection" Tags="|lan|arp|wireshark|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36734" PostTypeId="2" ParentId="36733" CreationDate="2016-11-24T00:15:40.100" Score="3" Body="&lt;p&gt;Switches don't have ARP tables, nor do they care about IP addresses. A switch will have a MAC address table that has a MAC address and the switch interface where the MAC address came in as the source MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch MAC address table contains a single entry for each MAC address. When you spoof a MAC address, it messes with the switch MAC address table, causing the interface for the MAC address entry in the table to keep changing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC address spoofing is really about network disruption, rather than information theft. Multiple hosts claiming the same MAC address will cause the switch MAC address table to constantly change; some frames will go to one host, and some frames to another host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you use ARP spoofing, you are really spoofing the ARP cache in a host. The host with an incorrect MAC address for an IP address will send traffic for that IP address to that MAC address, and no other. This only works on a single LAN. If you are doing this across LANs, then you have a different problem: MAC addresses are only valid on the LAN where they exist, and any traffic destined for a different LAN gets sent to the MAC address of the host's configured gateway. You could spoof that, but then nothing from any host with the spoofed gateway MAC address will ever get off the LAN to another LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-24T00:23:59.867" LastActivityDate="2016-11-24T00:23:59.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36735" PostTypeId="1" CreationDate="2016-11-24T05:14:56.153" Score="0" ViewCount="210" Body="&lt;p&gt;I have leased many internet links from many ISP with the requirement: &quot;do not route my traffic to  Asia-America Gateway (AAG) Cable System&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I check that the ISPs are compliant with my requirement?&lt;/p&gt;&#xA;" OwnerUserId="32276" LastActivityDate="2016-11-24T06:42:01.990" Title="How do I know my network traffic go through Asia-America Gateway (AAG) Cable System?" Tags="|routing|internet|wan|isp|" AnswerCount="2" CommentCount="1" ClosedDate="2019-02-18T01:37:48.293" ContentLicense="CC BY-SA 3.0" />
  <row Id="36737" PostTypeId="2" ParentId="36735" CreationDate="2016-11-24T06:09:14.040" Score="0" Body="&lt;p&gt;You need to trace your route, and find the providers of the IPs that are shown.&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2016-11-24T06:09:14.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36738" PostTypeId="1" CreationDate="2016-11-24T06:21:01.267" Score="1" ViewCount="300" Body="&lt;p&gt;If two router are connected through a serial link, they form neighborship even if they belong from different network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured 1st router with IP 10.1.1.1/8 and 2nd with 10.1.1.2/16 and they formed neighborship.&#xA;Why it happened so??&lt;/p&gt;&#xA;" OwnerUserId="32278" LastActivityDate="2016-11-24T16:54:59.610" Title="OSPF behavior on serial link, why neighborship formed even if interfaces belog from different network?" Tags="|router|ospf|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36739" PostTypeId="2" ParentId="36735" CreationDate="2016-11-24T06:42:01.990" Score="4" Body="&lt;p&gt;There is no way of knowing this for certain.  A cable system in and of itself is a Layer 1 connection and does not report any information about itself (even to a traceroute).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be able to infer connectivity from the name resolution of hops along your traceroute, but you could never prove this (there may be multiple cable systems between the two end cities) without intimate knowledge of your service provider's network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take for example the following traceroute - it crosses 3 continents (AU, US, UK):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;traceroute to www.fluent.co.uk (185.17.180.72), 64 hops max, 52 byte packets&#xA;1  172.16.10.254 (172.16.10.254)  3.108 ms  2.145 ms  2.026 ms&#xA;2  lo0.bras2.bne3.on.ii.net (150.101.32.110)  24.534 ms  24.116 ms  24.078 ms&#xA;3  po10.bras2.bne3.on.ii.net (150.101.35.84)  24.251 ms  24.306 ms  24.967 ms&#xA;4  ae19.cr1.bne4.on.ii.net (150.101.40.132)  197.765 ms  196.924 ms  196.227 ms&#xA;5  ae6.br1.syd7.on.ii.net (150.101.33.76)  40.401 ms  41.589 ms  41.875 ms&#xA;6  te0-2-0-3.br2.sjc2.on.ii.net (203.16.213.158)  196.590 ms  197.375 ms  198.419 ms&#xA;7  sjo-b21-link.telia.net (62.115.51.153)  199.575 ms  196.472 ms&#xA;   sjo-b21-link.telia.net (62.115.33.97)  198.420 ms&#xA;8  palo-b1-link.telia.net (80.91.253.2)  201.334 ms&#xA;   palo-b1-link.telia.net (62.115.118.214)  220.833 ms&#xA;   palo-b1-link.telia.net (80.91.253.0)  196.249 ms&#xA;9  tata-ic-309366-palo-b1.c.telia.net (213.248.75.182)  219.374 ms  217.245 ms  396.226 ms&#xA;10  if-ae-5-2.tcore2.sqn-san-jose.as6453.net (64.86.21.1)  614.560 ms  743.459 ms  614.462 ms&#xA;11  if-ae-1-2.tcore1.sqn-san-jose.as6453.net (63.243.205.1)  603.368 ms *  363.054 ms&#xA;12  if-ae-12-2.tcore1.nto-new-york.as6453.net (63.243.128.28)  374.578 ms  359.758 ms  362.822 ms&#xA;13  if-ae-7-2.tcore1.n0v-new-york.as6453.net (63.243.128.26)  355.214 ms  644.454 ms  354.952 ms&#xA;14  if-ae-5-2.thar1.njy-newark.as6453.net (66.198.70.81)  568.368 ms  361.586 ms  363.128 ms&#xA;15  if-ae-8-2.tcore1.ldn-london.as6453.net (66.198.70.174)  615.816 ms  355.035 ms  354.734 ms&#xA;16  if-ae-28-2.thar1.ly9-london.as6453.net (80.231.60.110)  646.951 ms  420.924 ms  362.560 ms&#xA;17  195.219.92.81 (195.219.92.81)  362.177 ms  363.939 ms  368.033 ms&#xA;18  te1-50-157.core-rs3.vt.nimbushosting.co.uk (80.249.107.162)  500.054 ms  613.970 ms  614.357 ms&#xA;19  holding-stenning.nh-serv.co.uk (185.17.180.72)  614.420 ms  613.925 ms  614.419 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From hop 5 to hop 6 I can infer that I crossed from Sydney to San Jose based on the DNS name associated with the router interface and the latency spike, but I have no guide as to whether I went direct via the Southern Cross Cable Network (SCCN) system, or via Guam over PPC1 and then AAG.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if these are Internet links, traffic may cross AAG to get to you regardless (upstream provider may use AAG), so I'm not sure how you or your provider(s) could possibly enforce this requirement.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-11-24T06:42:01.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36740" PostTypeId="1" AcceptedAnswerId="36743" CreationDate="2016-11-24T06:51:13.887" Score="1" ViewCount="42" Body="&lt;p&gt;for tunneling Mac packets, ethernet switches need source mac address?&#xA;if yes or no, why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="32280" LastActivityDate="2016-11-24T07:23:42.677" Title="do ethernet switches required to source mac address in tunneling for mac packet?" Tags="|ethernet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36741" PostTypeId="2" ParentId="36723" CreationDate="2016-11-24T06:52:28.517" Score="3" Body="&lt;p&gt;Encryption can be deployed at almost all layers of the networking stack - some examples to research would include:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Layer 1/Physical Layer: Optical encryption&lt;/li&gt;&#xA;&lt;li&gt;Layer 2/Logical-Link Layer: MACSec, 802.1x, WPA&lt;/li&gt;&#xA;&lt;li&gt;Layer 3/Network Layer: IPSEC, L2TP&lt;/li&gt;&#xA;&lt;li&gt;Layer 7/Application Layer: TLS&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For a router, you would most likely need one that supports IPSEC&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-11-24T06:52:28.517" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36742" PostTypeId="2" ParentId="36738" CreationDate="2016-11-24T07:17:34.857" Score="3" Body="&lt;p&gt;10.1.1.0/16 is a subnet of 10.1.1.0/8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of your routers are in the network 10.1.1.0/16 so it is normal that they form a neighbor relationship.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should fix your addressing.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-11-24T07:17:34.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36743" PostTypeId="2" ParentId="36740" CreationDate="2016-11-24T07:23:42.677" Score="3" Body="&lt;p&gt;Ethernet switches use the source MAC address of an Ethernet frame to populate their forwarding table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a switch is powered up for the first time, it's forwarding table is empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it receives a frame sourced from MAC A on Port 1 destined for MAC B, it will not know where to send it, so will flood it to all ports except port 1 (assuming single VLAN across all ports).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will then update the forwarding table and map MAC A to Port 1.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, whenever a frame is received destined to MAC A, it will be simply sent out Port 1 and not all other interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As more traffic is sent through the switch, the forwarding table will start to be populated such that all hosts in the LAN will become known and less and less flooding will occur.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-11-24T07:23:42.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36744" PostTypeId="1" CreationDate="2016-11-24T08:17:58.333" Score="3" ViewCount="925" Body="&lt;p&gt;Recently I was told that we leave WDS off ,whenever we can, where I work. It was explained to me that a broadcast storm is created when a routers' broadcast gets back to itself, perpetuates itself and eventually floods the port. If WDS has the potential to create a broadcast storm, does that mean that the switches at our towers have a bridge that is allowing the broadcast to get back to the clients router? What would be allowing the broadcast to get back and is it purely user error?&lt;/p&gt;&#xA;" OwnerUserId="32284" LastEditorUserId="32284" LastEditDate="2016-11-27T20:57:35.277" LastActivityDate="2018-09-19T13:01:01.613" Title="What is WDS and how can it cause a broadcast storm?" Tags="|switch|bridge|broadcast|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36745" PostTypeId="2" ParentId="36738" CreationDate="2016-11-24T10:15:54.463" Score="1" Body="&lt;p&gt;OSPF hellos do not use the subnet address, they use multicast so they will be received by each router.  I guess this should be off-topic since it's not an entreprise networking question.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-11-24T10:15:54.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36752" PostTypeId="2" ParentId="36744" CreationDate="2016-11-24T16:01:34.673" Score="2" Body="&lt;p&gt;WDS is by design intended for forward frames between the edge stations, repeater nodes and the base station (the thing that is connected to the wired Ethernet).  It's not clear from your question whether what you call your core router is a WDS base station: if it is, it really ought not to be.  Two reasons.  If a frame is initiated from one WDS node, it is supposed to be forwarded to all the others.  I believe (don't have the standard to hand) that it is not supposed to forward frames that it has already sent, to prevent loops.  Broadcasts are one example where failure to do this can get out of hand very quickly.  Now imagine that the WDS base station is also your &quot;core&quot; switch.  Now it is spamming the wired network with frames too!  That is bad.  A better model would be to take steps to isolate your wired and wireless networks.  This diminishes the scope for problems if a device goes nuts and --even more important-- gives you a place where you can ascribe security policies.  Wireless is a common attack path and plugging it straight into your lan without filtering and policy is trouble waiting to happen.&lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2016-11-24T16:01:34.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36753" PostTypeId="1" AcceptedAnswerId="36754" CreationDate="2016-11-24T16:45:43.303" Score="1" ViewCount="54" Body="&lt;p&gt;As a Mandatory attribute I wondered if this attribute is interoperable? I've looked around on the internet and can't seem to find an answer&lt;/p&gt;&#xA;" OwnerUserId="15099" LastActivityDate="2016-11-24T16:49:05.380" Title="Is AS-PATH attribute supported by all vendors and routers?" Tags="|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36754" PostTypeId="2" ParentId="36753" CreationDate="2016-11-24T16:49:05.380" Score="1" Body="&lt;p&gt;Yes, it is mandatory, and required for loop prevention.  Any vendor implementing BGP will implement this attribute.  I have never seen a BGP implementation without this attribute.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-11-24T16:49:05.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36755" PostTypeId="2" ParentId="36738" CreationDate="2016-11-24T16:54:59.610" Score="1" Body="&lt;p&gt;OSPF does not require neighbors to be on the same IP network if the network type is point-to-point.  An adjacency will form even if the interfaces are unnumbered.  In this case, they are both on the 10.1/16 network though.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-11-24T16:54:59.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36757" PostTypeId="1" AcceptedAnswerId="36759" CreationDate="2016-11-24T17:44:04.967" Score="2" ViewCount="96" Body="&lt;p&gt;In a BGP environment where Community is being utilised I read thay BT offers a service in where it can prevent customer routes being advertised to certain peers (EUROPE, ASIA....).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wondered, why would you want to do this as a Customer AND as a SP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a Customer in UK why would I not want my route to be advertised to Asia?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it due to the fact that I might only want it to be local to the UK? Or on SP side would it cost additional resources to make this route visible to BGP neighbours in Asia?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just don't get why you would want to prevent routes from being advertised.&lt;/p&gt;&#xA;" OwnerUserId="15099" LastActivityDate="2016-11-24T19:15:24.677" Title="Why would you want to prevent customer routes being advertised to certain peers?" Tags="|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36758" PostTypeId="2" ParentId="23317" CreationDate="2016-11-24T18:51:12.297" Score="1" Body="&lt;p&gt;A better way to write this algorithm in my opinion is like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EstimatedRTT = (1-α)*EstimatedRTT_prev + α*SampleRTT&#xA;DevRTT = (1-β)*DevRTT_prev + β*|SampleRTT - EstimatedRTT|&#xA;timeout = EstimatedRTT + 4*DevRTT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This probably answers your second question. Note that it needs to be calculated in this order because the values calculated in the previous formula is used in the next.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way it takes RTT samples is by using a timer to meassure the time it takes for a packet to be sent and the acknowledgment for that particular packet to be received again. This means it can take a new sample every RTT. By using the timestamp TCP option, it is also possible to use every ack as a sample.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://tools.ietf.org/rfc/rfc6298.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tools.ietf.org/rfc/rfc6298.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; addressed issue raised in comment&lt;/p&gt;&#xA;" OwnerUserId="32287" LastEditorUserId="-1" LastEditDate="2018-12-10T23:05:58.230" LastActivityDate="2018-12-10T23:05:58.230" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="36759" PostTypeId="2" ParentId="36757" CreationDate="2016-11-24T19:15:24.677" Score="2" Body="&lt;p&gt;If you had multiple peerings with an ISP you may choose to advertise specific prefixes marked with the NO_EXPORT community as well as advertising an aggregate route.  The specific prefixes would provide more detail for the ISP to route to those prefixes, providing a more efficient path and better fault tolerance.  Outside of your upstream ISP those routes are less useful and it is best practice to aggregate, so they would not be advertise upstream to other ISPs, only the aggregate prefix would get advertised.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a reason specific for not advertising to a geographic region, security would be one.  You may have a VPN server that should only be accessed from the UK.  You could mark that prefix with a community so that other countries have no routing information to reach that network.  It's pretty easy to circumvent though.  DDOS would be another reason.  If you were being attacked by a botnet in a certain region it may be beneficial to stop advertising your prefixes to that region.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-11-24T19:15:24.677" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36761" PostTypeId="1" AcceptedAnswerId="36820" CreationDate="2016-11-24T20:06:39.530" Score="0" ViewCount="1289" Body="&lt;p&gt;I am trying to capture the GTP-C packet, I am using Scapy  to generate GTP-C Packet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I could not find any good tutorial related to &quot;How to use Scapy?&quot;&lt;/p&gt;&#xA;" OwnerUserId="31061" LastActivityDate="2016-11-27T04:15:30.670" Title="How to capture GTP-C Traffic using mininet?" Tags="|network-core|sdn|" AnswerCount="1" CommentCount="2" ClosedDate="2016-11-27T04:17:47.897" ContentLicense="CC BY-SA 3.0" />
  <row Id="36763" PostTypeId="1" AcceptedAnswerId="36777" CreationDate="2016-11-24T20:11:06.777" Score="1" ViewCount="740" Body="&lt;p&gt;So i have 5 nodes A,B,C,D,E. A client, E server, rest are routers, and i would like to measure end to end delay between A and E. The only solution i can come up with is taking a time stamp in A, putting it in header, taking another time stamp at E when it recieves the packet and substract the client time stamp from server's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any more scientific way that i am not aware of?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can sum processing delay+4*tranmission delay but i need to compute it, can't use theoretical work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance. I also see there is no delay related tag, interesting.&lt;/p&gt;&#xA;" OwnerUserId="32295" LastActivityDate="2021-01-11T06:46:52.367" Title="How to practically measure end to end delay" Tags="|routing|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36764" PostTypeId="2" ParentId="36763" CreationDate="2016-11-24T20:19:25.500" Score="0" Body="&lt;p&gt;Not sure if IP SLA applies, from what I've read it is used to measure network performance, could solve your issue&lt;/p&gt;&#xA;" OwnerUserId="15099" LastActivityDate="2016-11-24T20:19:25.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36766" PostTypeId="1" AcceptedAnswerId="36768" CreationDate="2016-11-24T20:56:38.453" Score="2" ViewCount="655" Body="&lt;p&gt;I am developing a TCP implementation and could not find a clarification to this in the relevant RFCs (793, 1122, 5681, 6298). When the retransmission timer expires, the first segment which has once been sent but has not yet been acknowledged is retransmitted, and CWND is set to one segment. Then slow-start is supposed to be used, which will increase CWND by one segment for each new ACK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is whether the other already sent segments are effectively re-queued for transmission as if they had never been sent. Particularly, suppose an ACK is received which increases CWND sufficiently to allow sending one of the remaining already-sent segments, but does not acknowledge it. Should such a segment be transmitted now, or only upon the next expiration of the retransmission timer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The following segments are sent for the first time (represented by their sequence numbers): 1000, 2000, 3000, 4000. Both CWND (congestion window) and SND_WND (receiver window) were large enough for these segments to be sent.&lt;/li&gt;&#xA;&lt;li&gt;The retransmission timer expires before any ACK is received. Segment 1000 is retransmitted. Slow-start begins and hence CWND is reduced to 1000 (=MSS).&lt;/li&gt;&#xA;&lt;li&gt;An ACK num 2000 is received, acknowledging the first but not any other segments. CWND is increased to 2000 as per the slow-start algorithm.&lt;/li&gt;&#xA;&lt;li&gt;At this point, the CWND permits transmission of segments 2000 and 3000. &lt;strong&gt;Are segments 2000 and 3000 transmitted now, or would it take another expiration of the retransmission timer to transmit segment 2000?&lt;/strong&gt; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29954" LastEditorUserId="8499" LastEditDate="2018-12-27T01:24:31.970" LastActivityDate="2018-12-27T01:24:31.970" Title="Should all sent segments be requeued after a TCP retransmission timeout expires?" Tags="|tcp|protocol-theory|transport-protocol|layer4|rfc|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36768" PostTypeId="2" ParentId="36766" CreationDate="2016-11-24T22:48:21.670" Score="3" Body="&lt;p&gt;According to RFC 793, TCP uses a retransmission timer per segment in its retransmission queue. That means segment 2000 in your example will only be retransmit when its own retransmission timer expires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When ACK num 2000 is received, the CWND allows for 2000 outstanding bytes. But at this point, there are 3000 bytes outstanding, so nothing extra is sent. TCP waits for the respective retransmission timers before resending segments 2000, 3000 and 4000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in your example scenario, four segments are sent at once, meaning their respective retransmission timers will expire at (almost exactly) the same time. That would result in the retransmission of segments 2000 and 3000 immediately after retransmitting segment 1000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To clearly answer the question, RFC 793's TCP will &lt;strong&gt;&lt;em&gt;not&lt;/em&gt;&lt;/strong&gt; &quot;wait for another expiration of &lt;em&gt;the&lt;/em&gt; retransmission timer&quot; because there is no such thing as &quot;&lt;em&gt;the&lt;/em&gt; retransmission timer&quot;. TCP will wait for the expiration of any of the currently active retransmission timers to retransmit the corresponding segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In reality, TCP has evolved since 1981.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, Fast Retransmit (RFC 2581/5681) is an exception to the above rule. After receiving three duplicate acks indicating the out-of-order reception of a segment, fast retransmit will kick in retransmitting a segment before its retransmission timer expires.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP is byte-stream oriented, and the retransmission queue holding previously sent segments is only one of many ways to implement retransmissions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A TCP implementation might as well do without such a queue and generate a new segment starting from the first unacknowledged byte in the buffer. No specification requires this to be the exact copy of a previously sent segment. It could have a different size or contain a partially overlapping part of the bytestream.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Introducing features like selective acknowledgments further complicates things. &lt;/p&gt;&#xA;" OwnerUserId="189" LastEditorUserId="189" LastEditDate="2017-03-18T21:50:45.660" LastActivityDate="2017-03-18T21:50:45.660" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36769" PostTypeId="2" ParentId="28206" CreationDate="2016-11-25T01:25:01.157" Score="2" Body="&lt;p&gt;To answer your first question, Yes someone with a wireless sniffer will be able to find your &quot;hidden&quot; SSID by examining probe requests from clients that are already configured to connect to that SSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Implementing 802.1x can provide the security you are looking for IF it is configured correctly. At the very least you will want to configure your clients to verify the RADIUS server's TLS certificate and server name to prevent the attack  you are concerned about (I believe it's referred to as an &quot;evil-twin&quot; attack).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Implementing 802.1x is not easy. It requires setting up, configuring, and maintaining a RADIUS server as well as TLS Certificates. It will require end user education and training. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without understanding more about your infrastructure and risk profile that's the best answer I can give.&lt;/p&gt;&#xA;" OwnerUserId="18922" LastActivityDate="2016-11-25T01:25:01.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36770" PostTypeId="1" AcceptedAnswerId="36771" CreationDate="2016-11-25T05:13:05.510" Score="1" ViewCount="2661" Body="&lt;p&gt;Is data transmission different between Wired and Wireless network? In other word, when talking about TCP/IP, does it mean that TCP/IP stack is not suited for wireless networks?&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2016-11-25T05:22:33.493" Title="Difference of data transmission between wired and wireless networks" Tags="|cisco|wireless|tcp|network-core|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36771" PostTypeId="2" ParentId="36770" CreationDate="2016-11-25T05:22:33.493" Score="0" Body="&lt;p&gt;IP is a layer-3 protocol, and TCP is a layer-4 protocol. Your wired or wireless networks are a combination on layer-1 and layer-2 protocols. IP doesn't care in the least what layer-1/2 protocols carry it. IP has been run on barbed wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In modern times, ethernet is the most common wired layer-1/2 protocol, and Wi-Fi is the most common wireless protocol. Wi-Fi runs on a half-duplex medium (radio waves), but ethernet originally did, too, and it still can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both ethernet and Wi-Fi have pros and cons, but IP and TCP simply don't know or care which carries them.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-25T05:22:33.493" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36772" PostTypeId="1" CreationDate="2016-11-25T06:00:19.490" Score="1" ViewCount="261" Body="&lt;p&gt;I have been reading about Software-Defined Networking (SDN) for a while. I have a question: Is SDN made only for wired networks capability? I wonder if SDN can be utilized in wireless networks.&lt;/p&gt;&#xA;" OwnerUserId="32299" LastActivityDate="2017-07-11T02:58:17.687" Title="SDN for wireless network" Tags="|cisco|wireless|osi|sdn|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36774" PostTypeId="2" ParentId="36763" CreationDate="2016-11-25T07:54:27.240" Score="0" Body="&lt;p&gt;You can use &lt;code&gt;ping&lt;/code&gt; to measure round-trip times. Under the assumption that the network delays in both direction are symmetric, you can divide by two, possibly after subtracting estimated processing delays. For asymmetric-delay networks, this will not work and there is no way to measure just one trip using the network only (without an external clock synchronization system). See &lt;a href=&quot;https://cs.stackexchange.com/a/605/4213&quot;&gt;this great answer&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think there is a standard tool to measure round-trip times other than &lt;code&gt;ping&lt;/code&gt;. Of course it is possible to do so with other protocols instead of ICMP which &lt;code&gt;ping&lt;/code&gt; uses (like TCP), but you will have trouble finding tools to do so.&lt;/p&gt;&#xA;" OwnerUserId="29954" LastEditorUserId="-1" LastEditDate="2017-04-13T12:48:37.203" LastActivityDate="2016-11-25T07:54:27.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36775" PostTypeId="1" AcceptedAnswerId="36778" CreationDate="2016-11-25T08:39:25.967" Score="0" ViewCount="3460" Body="&lt;p&gt;In theory, can a subnet mask have zeros between ones (e.g. &lt;code&gt;255.255.0.248&lt;/code&gt;) or it need to be strictly 1's followed by 0's?&lt;/p&gt;&#xA;&lt;p&gt;As stated in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc950&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 950&lt;/a&gt;, there is only an &amp;quot;example&amp;quot; to interpret an IP as &lt;code&gt;&amp;lt;network-number&amp;gt;&amp;lt;subnet-number&amp;gt;&amp;lt;host-number&amp;gt;&lt;/code&gt; (see 2.1). And in the pseudo-code given in 2.2:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;IF bitwise_and(dg.ip_dest, my_ip_mask)&#xA;                               = bitwise_and(my_ip_addr, my_ip_mask)&#xA;         THEN&#xA;             send_dg_locally(dg, dg.ip_dest)&#xA;         ELSE&#xA;             send_dg_locally(dg,&#xA;                    gateway_to(bitwise_and(dg.ip_dest, my_ip_mask)))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This seems to work with both cases as well.&lt;/p&gt;&#xA;&lt;p&gt;My NE teacher says masks like &lt;code&gt;255.255.0.248&lt;/code&gt; &amp;quot;are correct but not used commonly&amp;quot;. So I'm asking here after digging around Internet with null result.&lt;/p&gt;&#xA;" OwnerUserId="32304" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2018-12-27T01:40:07.447" Title="Can a subnet mask contain zeros between ones?" Tags="|ip|ipv4|subnet|protocol-theory|rfc|" AnswerCount="2" CommentCount="0" ClosedDate="2016-11-28T04:09:56.920" ContentLicense="CC BY-SA 3.0" />
  <row Id="36776" PostTypeId="1" AcceptedAnswerId="36780" CreationDate="2016-11-25T09:48:53.717" Score="2" ViewCount="186" Body="&lt;p&gt;When will a packet be tagged/untagged with a VLAN tag in these cases:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;On a Cisco switch&lt;/li&gt;&#xA;&lt;li&gt;On a &lt;code&gt;8021q&lt;/code&gt; subinterface in Linux (for example, &lt;code&gt;eth0.10&lt;/code&gt;)  &lt;/li&gt;&#xA;&lt;li&gt;On VMWare ESXi (with VLAN ID in VMNetwork setting)  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And what is the VLAN broadcast behavior on a linux bridge?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider this model: I have a Linux machine with interface &lt;code&gt;eth0&lt;/code&gt; (physically) connected to an access port on VLAN 10 on a Cisco switch. On the Linux machine I configured interface &lt;code&gt;eth0.10&lt;/code&gt; to connect to Linux bridge &lt;code&gt;br0&lt;/code&gt; with a VLAN 10 IP address. So when a machine on VLAN 10 sends a packet to that Linux machine, how the packet will go and will it reach others machines connected to &lt;code&gt;br0&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="32305" LastEditorUserId="8499" LastEditDate="2016-11-25T16:59:38.700" LastActivityDate="2016-11-25T16:59:38.700" Title="Different between VLAN broadcast behavior on a Cisco switch and a Linux bridge" Tags="|cisco|vlan|linux|bridge|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36777" PostTypeId="2" ParentId="36763" CreationDate="2016-11-25T09:58:05.777" Score="2" Body="&lt;p&gt;The most accurate way that I can think of to measure round-trip network time between two TCP/IP endpoints is to capture network traffic using taps on the network interfaces of each, and use a large unidirectional TCP data transfer.  This will show you the time taken for each endpoint to ack data and will also give you the round time to ack across the network. Take one from the other and you get a figure that is order-of-magnitude accurate to the resolution of the capture device and any tap delay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other non-IP protocols will probably have similar techniques available if TCP/IP is not your bag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Measuring one-way delay is harder becuse you need to get very accurate time synchonisation between the timing devices at each end.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-11-25T09:58:05.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36778" PostTypeId="2" ParentId="36775" CreationDate="2016-11-25T11:00:36.993" Score="4" Body="&lt;p&gt;For a network, the mask needs to be contiguous.  Some vendors allow you to specify a prefix length instead of a mask.  The prefix length denotes the number of leftmost bits set to 1 in the mask, so a prefix length of 24 denotes a mask of 255.255.255.0.  Prefix lengths are contiguous and there is no way to specify a non-contiguous mask.  Some routing protocols such as BGP use prefix length (and not mask) within the updates, so there is no way to even advertise a non-contiguous mask with BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wildcard masks used in ACLs are similar to inverse subnet masks.  Their job is to show which bits of an address are relevant.  It is perfectly OK to use non-contiguous bits in a wildcard masks.  Wildcard masks are not subnet masks though and cannot be used when specifying a network on an interface configuration&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, see &lt;a href=&quot;https://superuser.com/questions/979915/are-subnets-always-contiguous-1s&quot;&gt;https://superuser.com/questions/979915/are-subnets-always-contiguous-1s&lt;/a&gt; for more answers&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorUserId="-1" LastEditDate="2017-03-20T10:18:02.413" LastActivityDate="2016-11-25T11:46:51.770" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36779" PostTypeId="2" ParentId="36772" CreationDate="2016-11-25T13:31:29.603" Score="1" Body="&lt;p&gt;Enterprise wireless networks that use &quot;dumb&quot; access points and a centralized controller are actually a very good example of Software Defined Networking.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-25T13:31:29.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36780" PostTypeId="2" ParentId="36776" CreationDate="2016-11-25T14:06:57.547" Score="1" Body="&lt;p&gt;Since the frames will originate from the switchport of the cisco switch and it is set to access, it will never be tagged. Summary of the flow below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Machine on VLAN 10 (untagged) -&gt; cisco ingress port (untagged) -&gt; cisco egress port (untagged) -&gt; Linux machine eth0 (untagged)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eth0.10 will never see any packets as there are no tags in place. Since you bridged eth0.10 to br0, br0 will not see packets as well. You will see packets on br0 if eth0 was bridged directly to br0.&lt;/p&gt;&#xA;" OwnerUserId="5330" LastActivityDate="2016-11-25T14:06:57.547" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36783" PostTypeId="2" ParentId="20762" CreationDate="2016-11-25T15:04:35.977" Score="0" Body="&lt;p&gt;Create a vrrp address for the cisco and mikrotik and make that the default gateway from the core switch. Set the mikrotik as the higher priority member. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mikrotik should have a default route received from the cisco router and a from &quot;my network&quot;, preferring &quot;my network&quot; as the preferential route. This can be via OSPF or statically assigned. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have an IP SLA probe either from the microtik or cisco to check the upstream connectivity to &quot;my network&quot;. If there is a problem upstream, reduce the vrrp priority on the mikrotik router so traffic will head out via the cisco instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the setup, you will have redundundancy and you would not have any issues with incoming traffic via the cisco assuming you are natting incoming traffic on the cisco. Incoming and outgoing traffic will be taking different paths.&lt;/p&gt;&#xA;" OwnerUserId="5330" LastActivityDate="2016-11-25T15:04:35.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36784" PostTypeId="2" ParentId="36766" CreationDate="2016-11-25T15:32:03.927" Score="1" Body="&lt;p&gt;In your example 2000 and 3000 are transmitted &quot;now&quot;.  The retransmission timer is only there to signal the possiblity of lost packets, you've &quot;been there done that&quot; once you've started retransmission.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastEditorUserId="27644" LastEditDate="2016-11-25T15:50:17.400" LastActivityDate="2016-11-25T15:50:17.400" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36786" PostTypeId="1" CreationDate="2016-11-25T18:42:01.010" Score="0" ViewCount="1217" Body="&lt;p&gt;Description:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an Admin Network which primarly which provides services for admin data (Company) Service Vlan 1-100 &amp;amp; IP telephony services (Two Vlan 200 &amp;amp; 250). This network is now upgraded in terms on capacity &amp;amp; IP Telephony (from analog to telephony) due to this current voice vlan 200 which is in /24 subnet (200 users) need to switched to new &amp;amp; bigger subnet (New Voice Vlan 250). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Users connected to New Voice Vlan should be on DHCP &amp;amp; PC connected on Phone should work on default serices vlan port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issue:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can we configure two Voice vlans on cisco switch? &lt;/li&gt;&#xA;&lt;li&gt;To work in IP Phone Plus PC setup , Do the Phone should have static IP configuration?&lt;/li&gt;&#xA;&lt;li&gt;Do ASA firewall is stopping DORA process ? However AVAYA server is on&#xA;LAN.&lt;/li&gt;&#xA;&lt;li&gt;I tried replacing voice vlan VLAN 200 to VLAN 250 on interface&#xA;, all users (Phone , PC) connected that port are registering in&#xA;default vlan ie VLAN 1 . I have configured that same port with VLAN&#xA;250 as access VLAN , Phone is able to get IP configuration but PC is&#xA;not working ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UOSYS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UOSYS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8498" LastActivityDate="2016-11-25T23:15:45.893" Title="DHCP not working in Voice Vlan" Tags="|cisco|switch|vlan|dhcp|voice|" AnswerCount="1" CommentCount="4" ClosedDate="2018-08-20T04:20:54.720" ContentLicense="CC BY-SA 3.0" />
  <row Id="36788" PostTypeId="2" ParentId="36706" CreationDate="2016-11-25T19:08:18.547" Score="0" Body="&lt;p&gt;As I have searched allot for this so I put it hear maybe it can save time for others like me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have understood that &lt;strong&gt;hosts&lt;/strong&gt; in &lt;strong&gt;Packet Tracer&lt;/strong&gt; are not really configurable to do much works so I can't install packages or run special codes on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead I decided to use &lt;strong&gt;GNS3&lt;/strong&gt; which i can have my own configured &lt;strong&gt;VMs&lt;/strong&gt; on hosts and so I can run my desired attack scripts for simulation.&#xA;There are lots of tutorials on how to create your own VMs in GNS3.&lt;/p&gt;&#xA;" OwnerUserId="20937" LastEditorUserId="20937" LastEditDate="2016-11-25T19:21:09.417" LastActivityDate="2016-11-25T19:21:09.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36789" PostTypeId="1" AcceptedAnswerId="36848" CreationDate="2016-11-25T20:43:48.123" Score="1" ViewCount="747" Body="&lt;p&gt;I would like to reproduce the RIP-infinite loop count problem using quagga.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I try to manually set the distance to a route manually but quagga ignores my commands. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;r1(config-router)# distance 100 192.168.3.0/24&#xA;r1(config-router)# do show ip route rip&#xA;Codes: K - kernel route, C - connected, S - static, R - RIP,&#xA;       O - OSPF, I - IS-IS, B - BGP, A - Babel,&#xA;       &amp;gt; - selected route, * - FIB route&#xA;&#xA;R&amp;gt;* 192.168.2.0/24 [10/2] via 192.168.100.2, eth2, 00:00:22&#xA;R&amp;gt;* 192.168.3.0/24 [10/3] via 192.168.100.2, eth2, 00:00:22&#xA;R&amp;gt;* 192.168.102.0/24 [10/2] via 192.168.100.2, eth2, 00:00:22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas why the distance has no effect?&lt;/p&gt;&#xA;" OwnerUserId="32321" LastActivityDate="2016-11-27T23:23:46.323" Title="Change RIP distance in quagga" Tags="|router|rip|quagga|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36792" PostTypeId="2" ParentId="36786" CreationDate="2016-11-25T23:15:45.893" Score="1" Body="&lt;p&gt;With the port set to &#xA;switchport mode access&#xA;and &#xA;switchport access vlan 250&#xA;your PC should grab the correct DHCP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, you should be able to have 2 voice VLANs.  &lt;a href=&quot;https://supportforums.cisco.com/discussion/10211171/multiple-voice-vlans-call-manager&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://supportforums.cisco.com/discussion/10211171/multiple-voice-vlans-call-manager&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA is not blocking DORA unless your DHCP server is off of your LAN somewhere, but I'm guessing you are serving DHCP from the Avaya.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ensure dhcp-helper on your Access Switch (2960) is setup.  It should be since you have two VLANs already.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And...Ensure that you have added the new DHCP scope on your DHCP server.  &lt;/p&gt;&#xA;" OwnerUserId="32328" LastActivityDate="2016-11-25T23:15:45.893" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36794" PostTypeId="2" ParentId="35963" CreationDate="2016-11-25T23:32:46.320" Score="0" Body="&lt;p&gt;If you are using something like Wireshark and with your network adapter in promiscuous mode, you can see any layer 2 traffic on the LAN.  However your computer will not be able to communicate directly to that subnet. &lt;/p&gt;&#xA;" OwnerUserId="32328" LastActivityDate="2016-11-25T23:32:46.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36795" PostTypeId="1" AcceptedAnswerId="36796" CreationDate="2016-11-26T02:13:09.487" Score="0" ViewCount="115" Body="&lt;p&gt;If dialup works over POTS just like a phone call, how was it possible for many people to dial the same number/connect to the same place at once? How didn't they get a busy tone?&lt;/p&gt;&#xA;" OwnerUserId="32330" LastActivityDate="2016-11-26T02:59:07.767" Title="How could many connect to the same server in dialup internet?" Tags="|internet|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="36796" PostTypeId="2" ParentId="36795" CreationDate="2016-11-26T02:59:07.767" Score="2" Body="&lt;p&gt;Essentially because the dial up server has more than one POTS circuit associated with it.  By contrast, a residential line has one circuit, so when A calls B who is on the phone, the circuit is already tied up.  The dial up server would not have one phone line (circuit) but many, aggregated into an entity known as a trunk.  Different size trunks are possible depending on anticipated traffic patterns.  Of course, if you get it wrong, it's still possible for a trunk to fill up, and give you the busy signal.&lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2016-11-26T02:59:07.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36797" PostTypeId="2" ParentId="28957" CreationDate="2016-11-26T03:22:53.673" Score="1" Body="&lt;p&gt;I look at this reductively.  A base station is a giant radio receiver and transmitter serving a geographic area (cell).  Connected to the base station and maybe considered part of it is the access networking piece, some software on some server-style unit that converts to IP and gets the traffic into/out of the carriers network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a fixed basic cost of transmitting even if no one is there: think of a radio tower in a rural location at night, say.  When the first phone attaches, the base station has work to do to get them hooked up to the network.  And then (depending on where you put the boundary) work to convert radio signaling from the phone to IP.  The more phones, the more work. The more work, the more energy used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, given that the amount of work induced by one phone is very much smaller than the work required to power the tower, you might say that effectively the energy requirements are independent of the number of phones attached, but a very accurate accounting would definitely show a difference.&lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2016-11-26T03:22:53.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36798" PostTypeId="1" CreationDate="2016-11-26T05:13:32.953" Score="0" ViewCount="3316" Body="&lt;p&gt;I was interested in installing VMware Tools on a Cisco vWLC (version 8.3.102). Is there anyway to access a Linux shell on the appliance, or would I have to do something hacky like mount the vmdk on another machine?&lt;/p&gt;&#xA;" OwnerUserId="32332" LastActivityDate="2023-12-22T22:03:25.560" Title="Install VMware Tools on Cisco Virtual Wireless LAN Controller" Tags="|wlc|vmware|cisco-wlc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36804" PostTypeId="1" AcceptedAnswerId="36805" CreationDate="2016-11-26T16:28:09.923" Score="1" ViewCount="514" Body="&lt;p&gt;I was going through this Cisco Documentation - &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html#anc2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Resolve IP Fragmentation, MTU, MSS, and PMTUD Issues with GRE and IPSEC&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a confusion with example 3. Screenshot below. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sNrK8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sNrK8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand, with the total of the header size would be 44 (New IP Header (20) + GRE Header (4) + Original IP Header (20)). As the example 3 mentions, a router in between the path has an MTU of 1400 bytes. So that leaves 1400 - 44 = 1356 bytes for the TCP Payload. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the example shows &quot;1352 bytes&quot;, that is 4 short of a minimum MTU along the path of 1400 bytes. The remaining data of 104 bytes has been carried over to the next fragment. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is the first packet not a complete 1400 bytes rather 1396 bytes (1352 + 44) and have 100 bytes of the TCP payload added on to the next fragment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks. &lt;/p&gt;&#xA;" OwnerUserId="32285" LastEditorUserId="8499" LastEditDate="2016-11-26T16:51:28.540" LastActivityDate="2016-11-26T17:55:29.100" Title="Fragmenting a Tunnel Packet" Tags="|ipv4|fragmentation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36805" PostTypeId="2" ParentId="36804" CreationDate="2016-11-26T16:49:47.730" Score="0" Body="&lt;p&gt;You are forgetting the fact that the data must be fragmented on an eight-octet (64-bit) boundary. If you take the 1400-octet MTU and subtract the 44-octet header, that leaves 1356 octets for the data, but 1356 is not evenly divisible by eight: &lt;code&gt;1356 / 8 = 169.5&lt;/code&gt;, but &lt;code&gt;169 x 8 = 1352&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791, INTERNET PROTOCOL&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;To fragment a long internet datagram, an internet protocol module (for&#xA;example, in a gateway), creates two new internet datagrams and copies&#xA;the contents of the internet header fields from the long datagram into&#xA;both new internet headers.  The data of the long datagram is divided&#xA;into two portions on a 8 octet (64 bit) boundary (the second portion&#xA;might not be an integral multiple of 8 octets, but the first must be).&#xA;Call the number of 8 octet blocks in the first portion NFB (for Number&#xA;of Fragment Blocks).  The first portion of the data is placed in the&#xA;first new internet datagram, and the total length field is set to the&#xA;length of the first datagram.  The more-fragments flag is set to one.&#xA;The second portion of the data is placed in the second new internet&#xA;datagram, and the total length field is set to the length of the&#xA;second datagram.  The more-fragments flag carries the same value as&#xA;the long datagram.  The fragment offset field of the second new&#xA;internet datagram is set to the value of that field in the long&#xA;datagram plus NFB.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-11-26T17:55:29.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36811" PostTypeId="1" AcceptedAnswerId="36812" CreationDate="2016-11-26T23:15:34.640" Score="1" ViewCount="1341" Body="&lt;p&gt;Suppose we have a switch we two hosts in VLAN 10 and VLAN 20.&#xA;Now if the two hosts try to ping each other using layer 2 connectivity then the ping will not be successful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;consider when H1 (VLAN 10) pings H2 (VLAN 20):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if we add a router in the scene, the switch will broadcast the received traffic. The traffic will go the router, and the router will use the L3 forwarding table and send the packet back to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch will now send the packet to the host in VLAN 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we take a Wireshark capture at H1, we get VLAN tag 10, and if we take a Wireshark capture at H2, obviously the VLAN tag is 20.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So where exactly in this data path does the addition of the new tag take place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume we are not using SVIs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Topology is something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       R1&#xA;        |&#xA;        S1&#xA;      /    \&#xA;    H1     H2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="8499" LastEditDate="2016-11-27T00:09:52.487" LastActivityDate="2016-11-27T00:23:22.233" Title="Where does the vlan tag change in the data path?" Tags="|switch|vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36812" PostTypeId="2" ParentId="36811" CreationDate="2016-11-26T23:34:40.533" Score="2" Body="&lt;p&gt;There are a few things wrong with what you wrote.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you capture at the hosts, there will not be a VLAN tag on the frame. VLAN tags are used on trunks where there are multiple VLANs so that the network devices can tell which frames belong to which VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch does not broadcast unless the frame is a broadcast frame. A switch will have a MAC address table that has the MAC addresses from the frames' source addresses, and from which switch interfaces the source addresses were seen coming into the switch. The switch will look up a frame destination MAC address in the MAC address table and send the frame to the corresponding interface. If the switch doesn't find the destination MAC address in the table, it will flood the frame to all other switch interfaces in the same broadcast domain (VLAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A host will compare the destination IP address to the hosts's IP address and mask to see if it is in the same network. If the destination MAC address is in the same network, it will use ARP to discover the the destination host's MAC address, and use that as the destination MAC address for the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination host's IP address is in a different network, the host will use the MAC address of the configured gateway as the destination MAC address for the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the connection between the switch and the router is a trunk, both the switch and the router will tag any frames for non-native VLANs. The switch will not include a VLAN tag on the access ports.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router will have separate logical interfaces, on the same physical interface, for each VLAN. For a Cisco router, it looks something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; description Physical Interface&#xA; no shutdown&#xA;!&#xA;interface GigabitEthernet0/0.10&#xA; description VLAN 10 Interface&#xA; encapsulation dot1Q 10&#xA; ip address 10.10.10.1 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;!&#xA;interface GigabitEthernet0/0.20&#xA; description VLAN 20 Interface&#xA; encapsulation dot1Q 20&#xA; ip address 10.20.20.1 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;encapsulation&lt;/code&gt; command on the interface will direct incoming frames on the physical interface to the correct logical interface, and it will add the VLAN tag to any frame exiting the logical interface outbound through the physical interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router will strip off and discard the layer-2 frame to get to the layer-3 packet. After switching the packet to the new interface, a router needs to build a new frame for the new interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The VLAN tag added to the frame by the switch on the trunk to the router will be lost when the frame is stripped. The router will add a tag for the new VLAN when it builds the new frame for the new interface. That is where the VLAN tag is changed.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-27T00:23:22.233" LastActivityDate="2016-11-27T00:23:22.233" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="36813" PostTypeId="1" CreationDate="2016-11-27T00:20:22.910" Score="2" ViewCount="58" Body="&lt;p&gt;And if it is possible are there any companies that are building these type of switches ? Are they/would they be much more expensive than a regular switch which has a more 'standard' processor and is programmed using software and then the program is loaded into the memory or flash, etc. ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would big companies like Cisco or Huawei be interested in building such switches? Would the prices cover the design costs ?&lt;/p&gt;&#xA;" OwnerUserId="23730" LastEditorUserId="23730" LastEditDate="2016-11-27T00:34:02.470" LastActivityDate="2016-12-27T16:41:22.897" Title="Is it possible to design a network switch that could work only with combinational or sequential logic circuits without a software?" Tags="|cisco|switch|ethernet|switching|hardware|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36814" PostTypeId="2" ParentId="36813" CreationDate="2016-11-27T00:31:31.410" Score="1" Body="&lt;p&gt;Modern layer-2 switches perform almost all switching in hardware. This facilitate wire-speed switching. Switching in software will slow down switching. Switches use software for added features.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inconsistently, your last paragraph asks about routers. Routers do some things in hardware, but they use software because they need to support different interfaces and protocols. This, for example, allows a router to be upgraded to support both IPv4 and IPv6. Business-grade routers often have modular hardware, and you can get some very diverse hardware combinations. This really needs software support&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-27T01:08:24.880" LastActivityDate="2016-11-27T01:08:24.880" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="36816" PostTypeId="1" CreationDate="2016-11-27T01:57:30.310" Score="1" ViewCount="1300" Body="&lt;p&gt;I have a small dedicated wifi network setup specifically to carry a multicast multimedia package.. no other use (no web or other data on this network, due to the arrangement)..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue I've found is that clients are not receiving a true multicast transmission - they're actually receiving unicast from the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some APs have options to &quot;convert Multicast to Unicast&quot;, as supposedly it raises the QoS of the packet to a faster delivery.when I turn this off, the packet delay is FAR higher for any device/all devices...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, as I need to deliver the multicast to more clients (dozens), i need it to truly multicast (ie., 1 RF transmission transmitting the entire packet to dozens of clients).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My clients are listening for the multicast port, but i need the AP to actually multicast/broadcast the packet..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can this be accomplished?&#xA;I've looked at various 'open source' options  (OpenWRT etc), but am unsure how to actually configure APs to accomplish this.&lt;/p&gt;&#xA;" OwnerUserId="21094" LastEditorUserId="8499" LastEditDate="2018-03-19T21:00:32.967" LastActivityDate="2018-03-19T21:00:32.967" Title="Can I truly multicast over Wifi AP" Tags="|wireless|ieee-802.11|qos|multicast|" AnswerCount="1" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="36817" PostTypeId="1" CreationDate="2016-11-27T02:28:52.783" Score="1" ViewCount="424" Body="&lt;p&gt;I am not sure if this is the right site for asking but I learned about Non Return to Zero encodings and the Manchester encodings at the Networking class and those types of encodings are used in networking often.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I did not understand why is NRZ encoding called this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the wikipedia page about this encoding type I did not find any mention to the naming convention. &lt;a href=&quot;https://en.wikipedia.org/wiki/Non-return-to-zero&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Non-return-to-zero&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23730" LastEditorUserId="8499" LastEditDate="2016-11-27T02:56:05.587" LastActivityDate="2016-12-27T05:42:13.553" Title="Why is Non-Return-to-Zero encoding called this way?" Tags="|ethernet|osi|layer1|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36818" PostTypeId="2" ParentId="36817" CreationDate="2016-11-27T02:41:04.397" Score="1" Body="&lt;p&gt;The encoding is used by the Physical Layer, not the Network Layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, NRZ,and its variants, are binary (two level) encoding, and there is no zero, or neutral, level. This is in contrast to RZ, e.g. Bipolar, where you have both positive, negative, and neutral (zero) levels.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-27T02:45:35.883" LastActivityDate="2016-11-27T02:45:35.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36819" PostTypeId="2" ParentId="36816" CreationDate="2016-11-27T03:42:43.457" Score="1" Body="&lt;p&gt;Unfortunately, you really aren't going to get what you want with today's Wi-Fi implementations. Multicast over Wi-Fi performance is pretty abysmal, today, but there are things in the future which hope to change this situation. Multicast over Wi-Fi will use the lowest available speed for multicast. The original way to overcome this is to convert multicast to unicast at the WAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.thinkmind.org/download.php?articleid=innov_2012_1_30_60038&quot; rel=&quot;nofollow noreferrer&quot;&gt;A Scheme Improving Performance of IEEE 802.11 Multicast Protocol&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In multicast, a single sender transmits data packet to multiple&#xA;  recipients at the same time. The multicast is an efficient way to&#xA;  transmit data packets to multiple stations that need them. However,&#xA;  unlike unicast, there is no feedback process, i.e., sending ACK, and&#xA;  therefore it does not guarantee reliability. On the other hand,&#xA;  assuring maximum reliability to multiple recipients causes multicast&#xA;  data to be transmitted at the lowest data transmission speed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is now the 802.11aa standard, but it will take some time before both WAPs and hosts are compliant with the standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.sigcomm.org/sites/default/files/ccr/papers/2014/January/2567561-2567567.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;A First Implementation and Evaluation of the IEEE 802.11aa Group Addressed Transmission Service&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The IEEE 802.11aa Task Group has recently standardized a set of&#xA;  mechanisms to efficiently support video multicasting, namely, the&#xA;  Group Addressed Transmission Service (GATS). In this article, we&#xA;  report the implementation of these mechanisms over commodity hardware,&#xA;  which we make publicly available, and conduct a study to assess their&#xA;  performance under a variety of real-life scenarios. To the best of our&#xA;  knowledge, this is the first experimental assessment of GATS, which is&#xA;  performed along three axes: we report their complexity in terms of&#xA;  lines of code, their effectiveness when delivering video traffic, and&#xA;  their efficiency when utilizing wireless resources. Our results&#xA;  provide key insights on the resulting trade-offs when using each&#xA;  mechanism, and paves the way for new enhancements to deliver video&#xA;  over 802.11 Wireless LANs.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-27T03:42:43.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36820" PostTypeId="2" ParentId="36761" CreationDate="2016-11-27T04:15:30.670" Score="0" Body="&lt;p&gt;How to Generate GTP packet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STEP1: &#xA;Download gtp.py (&lt;a href=&quot;https://github.com/cisco-system-traffic-generator/trex-core/blob/master/scripts/external_libs/scapy-2.3.1/python3/scapy/contrib/gtp.py&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/cisco-system-traffic-generator/trex-core/blob/master/scripts/external_libs/scapy-2.3.1/python3/scapy/contrib/gtp.py&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;run this program on linux terminal with command: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;sudo python gtp.py&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Above and below both commands both are same just telling how to give path for program.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sudo python &quot;(path to the program)&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STEP2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;data = ('32 ff 00 58 00 00 00 01 28 db 00 00 45 00 00 54 00 00 40 00 40 00 5e a5 ca 0b 28 9e c0 a8 28 b2 08 00 be e7 00 00 28 7b 04 11 20 4b f4 3d 0d 00 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25 26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35 36 37')&lt;/p&gt;&#xA;&#xA;&lt;p&gt;data_list = data.split(&quot; &quot;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;data_s = ''.join(data_list).decode('hex')&lt;/p&gt;&#xA;&#xA;&lt;p&gt;sendp(Ether()/IP(dst=&quot;1.1.1.1&quot;, proto=17, len=124)/UDP(sport=2152,dport=2152,len=104)/GTPHeader(teid=2807)/GTPCreatePDPContextRequest()/Raw(load=data_s))&lt;/p&gt;&#xA;" OwnerUserId="31061" LastActivityDate="2016-11-27T04:15:30.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36823" PostTypeId="1" AcceptedAnswerId="36824" CreationDate="2016-11-27T10:58:02.207" Score="1" ViewCount="259" Body="&lt;p&gt;In an envrionment where there is no packet switching, say a simple hub that repeats the signal from a port to all other ports, or a splitter, how come a packet can be sniffed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I mean, if the packet's destination MAC is set to a specific NIC, how can it be listened by another host whose MAC is not the destination?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory, shouldn't it be dropped at the physical layer instead of passing it through upper layers if the destination MAC doesn't match?&lt;/p&gt;&#xA;" OwnerUserId="31613" LastEditorUserId="31613" LastEditDate="2016-11-27T11:03:39.517" LastActivityDate="2016-11-27T12:44:46.487" Title="How can OSI model allow packet sniffing pass through layer 1?" Tags="|routing|packet-analysis|osi|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36824" PostTypeId="2" ParentId="36823" CreationDate="2016-11-27T12:44:46.487" Score="3" Body="&lt;p&gt;Packet capture programs require the NIC to be set to &quot;promiscuous mode,&quot; where the NIC will accept any packet regardless of the MAC address. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-27T12:44:46.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36826" PostTypeId="1" AcceptedAnswerId="45720" CreationDate="2016-11-27T13:26:19.353" Score="1" ViewCount="1309" Body="&lt;p&gt;In order to understand different VPN technologies I tried to write down how a single HTTP packet could look like using each implementation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SSH VPN  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HTTP | TCP | IP | Ethernet ||| SSH | TCP | IP | Ethernet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OpenVPN bridged mode  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HTTP | TCP | IP | Ethernet ||| OpenVPN | TLS | TCP | IP | Ethernet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OpenVPN routed mode  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HTTP | TCP | IP ||| OpenVPN | TLS | TCP | IP | Ethernet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IPSec tunnel mode  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HTTP | TCP | IP ||| IPSec Auth Header | IP | Ethernet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;PPTP  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HTTP | TCP | IP | PPP ||| GRE | IP | Ethernet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;L2TP  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HTTP | TCP | IP | PPP ||| L2TP | UDP | IP | Ethernet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is based on information from different sources and I'd like to ask three questions:&lt;br&gt;&#xA;1) Are the diagrams correct?&lt;br&gt;&#xA;2) Are PPP and Ethernet interchangeable?&lt;br&gt;&#xA;3) Is OpenVPN 'TCP over TCP' as implied by the diagrams above?&lt;/p&gt;&#xA;" OwnerDisplayName="user32354" LastActivityDate="2017-11-13T22:30:50.353" Title="VPN Packet structure in different VPN implementations" Tags="|vpn|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36827" PostTypeId="1" AcceptedAnswerId="36830" CreationDate="2016-11-27T14:05:11.893" Score="3" ViewCount="5960" Body="&lt;p&gt;I already searched for answer to this, but I have seen so many different answers to this..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does patch cable mean all UTP Cat5e, Cat6 etc? Or is it something else?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for any help.  &lt;/p&gt;&#xA;" OwnerUserId="32355" LastEditorUserId="8499" LastEditDate="2016-11-27T16:49:05.690" LastActivityDate="2016-11-27T17:32:50.367" Title="Difference between patch cable and UTP" Tags="|cabling|cable|layer1|utp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36828" PostTypeId="1" AcceptedAnswerId="36831" CreationDate="2016-11-27T14:05:45.760" Score="3" ViewCount="10233" Body="&lt;p&gt;Like I specify in the title, I want to know that one fiber can be used to transmit and receive signals. Whether it can or not, why?&lt;/p&gt;&#xA;" OwnerUserId="32356" LastEditorUserId="8499" LastEditDate="2016-11-27T16:59:01.097" LastActivityDate="2020-09-21T20:46:16.293" Title="Can one fiber be used to transmit and receive signals?" Tags="|fiber|cable|layer1|" AnswerCount="4" CommentCount="0" ClosedDate="2020-09-21T20:56:05.560" ContentLicense="CC BY-SA 3.0" />
  <row Id="36830" PostTypeId="2" ParentId="36827" CreationDate="2016-11-27T14:34:07.843" Score="6" Body="&lt;p&gt;Yes, a patch cable will conform to one of the CAT standards.  A CAT5e patch cable will use CAT5e cable, terminated with RJ45 connectors.  The cable will be tested and will conform to the CAT5e standard.  A CAT6 patch cable will conform to the CAT6 standard etc.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-11-27T14:34:07.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36831" PostTypeId="2" ParentId="36828" CreationDate="2016-11-27T14:45:35.080" Score="5" Body="&lt;p&gt;Normally, you would use a separate fibre for transmit and receive, so two fibres for bi-directional transmission.  You can purchase BiDi transceivers, which allow you to use a single fibre for both transit and receive.  These transceivers use Wave Division Multiplexing and modulate the transmit and receive onto different wavelengths so that they do not interfere which each-other.  An example of this would be Cisco SFP-10G-BXD-I or SFP-10G-BXU-I transceivers, which both allow for 10GBASE over a single strand of fibre.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-11-27T14:45:35.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36832" PostTypeId="1" CreationDate="2016-11-27T16:39:30.480" Score="3" ViewCount="154" Body="&lt;p&gt;As I understand it Service Providers used to use BGPs local preference for manipulating outbound traffic and AS Path for manipulating inbound traffic before they used communities.&#xA;As the internet grew, Service Providers started to use Communities that allowed customers and peers to use community values to manipulate their routing policy (which included adjusting AS path using community values). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What were the limitations of manipulating inbound traffic using just AS Path?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What extra things can communities do to manipulate inbound traffic flow that cannot be done with AS path alone?&lt;/p&gt;&#xA;" OwnerUserId="32357" LastEditorUserId="8499" LastEditDate="2019-01-04T20:26:37.203" LastActivityDate="2019-01-04T20:26:37.203" Title="Service Provider inbound routing problems before using communities" Tags="|routing|bgp|isp|service-provider|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36834" PostTypeId="2" ParentId="36827" CreationDate="2016-11-27T17:03:50.620" Score="1" Body="&lt;p&gt;I'm not a cabling expert, but I've always heard &quot;patch cable&quot; refer to a relatively short cable from a wall port or patch panel (hence the name) to the end device such as a PC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cat 5E, Cat 6, Cat 6A, refer to different standards for cables defined in TIA/EIA specifications. All support transmission over twisted-pair copper up to 100 meters (much longer than any patch cable). The difference between the standards has to do with protection against crosstalk and support for higher speeds (e.g., Cat 6 supports 10 gigabit Ethernet up to 100 meters while Cat 5 and 5E do not).&lt;/p&gt;&#xA;" OwnerUserId="2688" LastActivityDate="2016-11-27T17:03:50.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36835" PostTypeId="2" ParentId="36832" CreationDate="2016-11-27T17:17:22.140" Score="4" Body="&lt;p&gt;The problem of manipulating paths in BGP is that your peer ASes are free to ignore what your AS wants. There are many steps to deciding which routes are preferred in BGP. You can try to influence your peer ASes with MED, but that doesn't mean your peer ASes will pay any attention to MED. Communities are the same. You need the cooperation of your peer ASes to use communities to influence routing. If you use AS_PATH to tack on a bunch of ASes, you neighbors will usually pay attention to that, and they will mostly send traffic for those prefixes to the inbound path that you are trying to set up as the inbound path, but any local preference you peer ASes use can override AS_PATH.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand, influencing your own AS routing is fairly simple. There are a few different things you can use to manipulate which path your traffic takes as the outbound path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really need to be careful about asymmetric routing when trying to influence paths, and you need to secure the cooperation of your peer ASes.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-27T17:17:22.140" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36836" PostTypeId="2" ParentId="36827" CreationDate="2016-11-27T17:21:30.343" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does patch cable mean all UTP Cat5e, Cat6 etc?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The answer to that is that it depends on what your equipment needs. The answer is not an unequivocal Yes or No.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A patch cable can be either UTP copper, fiber, or something else, depending on the cable infrastructure used. For instance, a Category-6 cable cannot be used when the equipment to which you are trying to connect has fiber transceivers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-27T17:32:50.367" LastActivityDate="2016-11-27T17:32:50.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36837" PostTypeId="1" CreationDate="2016-11-27T19:50:16.247" Score="1" ViewCount="1093" Body="&lt;p&gt;I built a simple WLAN containing two routers used as APs. They are connected to each other with a switch. (Those two routers has different manufacturer) I simulated a seamless roaming between the routers with a notebook. I wanted to sniff all traffic on the switch with &lt;em&gt;wireshark&lt;/em&gt; concentrating on those packets which sent between the two routers while roaming. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I expect that somehow the new AP &lt;strong&gt;must&lt;/strong&gt; inform the old one the station has roamed successfully and I suspect it must be done with packets sent through the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really wanted to know:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How It's done in practise? &lt;/li&gt;&#xA;&lt;li&gt;How such a packet look alike?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I tried sniffing on the switch but could not recognize that/those packet(s) (filtering source address set to new AP's ip and destination address set to old AP ip address in the caught frames). Seems like nothing is sent from one router to another, which I find impossible...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read a CISCO networking book about this topic, but It only contains a recommendation about this process, and It says implementation depends on the manufacturer. But what if the APs made by different manufacturer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate any help.&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="32361" LastEditorUserId="8499" LastEditDate="2016-11-27T19:52:11.510" LastActivityDate="2017-10-24T05:27:14.523" Title="Sniffing packets while roaming in WLAN" Tags="|switch|router|wireless|wireshark|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36838" PostTypeId="2" ParentId="36837" CreationDate="2016-11-27T20:00:44.597" Score="1" Body="&lt;p&gt;If you have the WAPs in the same network, then it is actually pretty simple because it happens at layer-2. The MAC address is just seen at another switch interface, and the switch MAC address table is updated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-3 roaming (from one network to another) is more complex, and that is where it really depends on the vendor. Some vendors can do this with Fat-WAPS that tunnel between them, and others use LWAPS with WLCs and tunnels. You can search for CAPWAP, the protocol most used to tunnel, but there are proprietary protocols, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-27T20:00:44.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36839" PostTypeId="1" CreationDate="2016-11-27T20:23:55.917" Score="1" ViewCount="751" Body="&lt;p&gt;I am trying to understand the usage of bridge group command.Please refer the following config(on switch ASR9k):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;l2vpn&#xA;&#xA;!&#xA;&#xA;bridge group TEST1&#xA;&#xA; bridge-domain BD1&#xA;&#xA;  interface Bundle-Ether1.500&#xA;&#xA;  interface Bundle-Ether2.500&#xA;&#xA; bridge-domain BD2&#xA;&#xA;  interface Bundle-Ether1.600&#xA;&#xA;  interface Bundle-Ether2.600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The configs for subinterfaces are as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Bundle-Ether1.500 l2transport&#xA;&#xA;encapsulation dot1q 500&#xA;&#xA;rewrite ingress tag pop 1 symmetric&#xA;&#xA; interface Bundle-Ether2.500 l2transport&#xA;&#xA;    encapsulation dot1q 500&#xA;&#xA;    rewrite ingress tag pop 1 symmetric&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similarly for 600(only the dot1q tag would be 600)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a router connected to the above ASR9k switch on the other end that has the IP addresses as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Bundle-Ether1.500&#xA;&#xA;ipv4 address &amp;lt;ipv4 address&amp;gt;&#xA;&#xA;interface Bundle-Ether2.500&#xA;&#xA;ipv4 address &amp;lt;ipv4 address&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similary for X.600 part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1:What exactly is the bridge group part used for?What if i remove it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:I understand that any frame coming to the switch with a tag of 500, will be put onto interface Bundle-Ether1.500 and also onto interface Bundle-Ether2.500.&#xA;This tag will be stripped(at ingress ) and pushed back at egress(when the frame exits these interfaces(because of symmetric command). Is that correct understanding?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3:Bridge-domains represent ONE broadcast domain.So all the interfaces under one bridge domain are part of SAME broadcast domain? &#xA;As for above, the Bundle-Ether1.500 and Bundle-Ether2.500 are part of SAME broadcast domain BD1. Is that CORRECT understanding?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q4:Why at all do we need to group these Bridge-domains? What advantage am i getting?Why are we tying all the Bridge-domains under a single bridge group?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q5:What role is l2vpn command playing in above?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2016-11-28T04:44:21.763" LastActivityDate="2016-11-28T04:44:21.763" Title="Regarding Bridge domain and L2 vpn" Tags="|layer2|bridge|layer3|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36841" PostTypeId="2" ParentId="36828" CreationDate="2016-11-27T21:51:41.970" Score="1" Body="&lt;p&gt;A Passive Optical Network (PON) is used by a lot of Fiber to the Home (FTTH) Internet Service Providers (ISP) to provide network access over a single fiber to multiple end points (homes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a &lt;a href=&quot;https://en.wikipedia.org/wiki/Passive_optical_network&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; to the Wikipedia Page on PON's.&lt;/p&gt;&#xA;" OwnerUserId="18922" LastActivityDate="2016-11-27T21:51:41.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36843" PostTypeId="1" CreationDate="2016-11-27T22:26:59.327" Score="10" ViewCount="24897" Body="&lt;p&gt;I recently found out that ZigBee devices have MAC addresses.&lt;/p&gt;&#xA;&lt;p&gt;ZigBee is more related to Bluetooth from what I know rather than Ethernet or Wi-Fi. Do Bluetooth devices such as phones, headphones, wireless speakers, televisions have MAC addresses also? If yes, are those MAC addresses from the same MAC address pool that the Internet Network Interfaces receive? Are the MAC address for these devices assigned by the same organization which assigns MAC addresses for Network cards?&lt;/p&gt;&#xA;&lt;p&gt;If a phone or other device like a television has more devices that can receive MAC addresses do they have a different MAC for each device? For example a SMART TV that has a RJ-45 port, has a WI-FI antenna for connecting to the internet and has a Bluetooth antenna to connect headphone or do file transfer do each of those interfaces have a different MAC?&lt;/p&gt;&#xA;&lt;p&gt;How can the MAC address of a Bluetooth device be found?&lt;/p&gt;&#xA;&lt;p&gt;Can Bluetooth Protocol be considered as running at level 3 of the OSI stack? (instead of the internet protocol)&lt;/p&gt;&#xA;&lt;p&gt;From what I know the Ethernet protocol runs at level 2 (the data link level). If those other devices have a MAC that means that MAC is not in any way associated with the Ethernet or internet protocols and is completely independent.&lt;/p&gt;&#xA;&lt;p&gt;Can the internet protocol run over some other layer that DOES NOT require any kind of MAC?&lt;/p&gt;&#xA;" OwnerUserId="23730" LastEditorUserId="82899" LastEditDate="2022-03-04T13:16:31.320" LastActivityDate="2022-03-04T13:16:31.320" Title="Do Bluetooth Devices have MAC address with the same specification as the MAC addresses of the Ethernet and Wi-Fi Network cards?" Tags="|ethernet|internet|mac-address|osi|mac|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="36844" PostTypeId="1" CreationDate="2016-11-27T22:38:31.773" Score="1" ViewCount="102" Body="&lt;p&gt;I recently found out that lots of different types of devices have a MAC address not just ethernet devices. I was thinking that it is possible for Internet protocol to run over many other types of technologies besides ethernet layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there scenarios where other technologies besides ethernet are more practical or efficient or reccomended to use for communication of INTERNET protocol (like connecting through the internet) ?&lt;/p&gt;&#xA;" OwnerUserId="23730" LastActivityDate="2016-11-27T23:52:01.480" Title="What are the most common technologies that the IPv4 or IPv6 run on top of BESIDES the ethernet protocol?" Tags="|ethernet|internet|mac-address|osi|mac|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36845" PostTypeId="2" ParentId="23354" CreationDate="2016-11-27T22:44:14.177" Score="4" Body="&lt;p&gt;Andrew,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bonjour relies on IP Multicast, so there are two possible issues:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The router (the switch appears to be acting as a router) is not configured to forward multicast traffic between the wired and wireless networks. If you enable multicast, be sure to enable igmp snooping on the switch as well, or you will be flooding the multicast traffic out all of the wired switch ports in that network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A lot of enterprise wireless Access Points are configured by default to not transmit multicast traffic out to the air because it can consume valuable airtime and degrade the performance of the wireless network. It is possible to enable multicast if needed, but be aware multicast traffic is transmitted at the lowest data rate the wireless network is configured to support. Some enterprise AP's can be configured to optimize Multicast traffic by converting it to Unicast, check your documentation.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Even then it still might not work. Apple never designed Airplay to work across different subnets. However, it still may be possible to get it to work. Most enterprise wireless vendors have &quot;special&quot; support for Bonjour (or it's official name: Multicast Domain Name Service - MDNS). I believe Ruckus does have support for this, again you will have to consult your documentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Neil&lt;/p&gt;&#xA;" OwnerUserId="18922" LastEditorUserId="18922" LastEditDate="2016-11-27T22:50:16.953" LastActivityDate="2016-11-27T22:50:16.953" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36846" PostTypeId="2" ParentId="36843" CreationDate="2016-11-27T22:53:17.887" Score="4" Body="&lt;p&gt;Bluetooth devices are assigned addresses similarly to Ethernet - an organizationally unique identifier (OUI) of 3 bytes followed by another 3 bytes assigned by the vendor.  The Bluetooth address of a given device is almost certainly independent of an Ethernet MAC address.  Bluetooth OUI lookup tools can be found on Google. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each device on a Bluetooth network has its own HW address (just like Ethernet).  The Bluetooth specification actually lays out both L1 and L2 and, like Ethernet, allows for multiple upper-layer protocols to be mapped (ex: audio streaming, serial, etc) as well as capability negotiation, etc.  Bluetooth ends up defining a number of upper-layer protocol functions as well (device naming / discovery, for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To your final question - yes, IP can run over media types that don't use MAC addresses.  In the context of WAN connections, for example, there is no notion of MAC addressing in point-to-point connections.  Similarly in multipoint connections (ATM, FR, etc) there is a direct mapping from IP address to DLCI/PVC.  There are similar accommodations in technologies like IPoWDM.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-11-27T22:53:17.887" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36847" PostTypeId="2" ParentId="36844" CreationDate="2016-11-27T23:00:05.207" Score="3" Body="&lt;p&gt;As mentioned in your question about Bluetooth, IP can run over a wide range of underlying transport technologies - many of which are quite dissimilar to Ethernet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a bunch of easy legacy examples - mapping Ethernet across point-to-point links via PPP or HDLC doesn't require a notion of MAC addressing.  Similarly on multi-point media types like ATM, Frame Relay or X.25 there are mechanisms to directly map IP adjacencies over PVC / DLCI.  In modern terms technologies like IPoWDM allow for a given IP adjacency to be mapped directly to a WDM lambda.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, yes, there are absolutely situations where the above transports have been more practical on a legacy basis and are arguably superior for certain roles on an ongoing basis (mostly IPoWDM).  Ethernet has become overwhelmingly common but it is by no means universal.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-11-27T23:00:05.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36848" PostTypeId="2" ParentId="36789" CreationDate="2016-11-27T23:23:46.323" Score="1" Body="&lt;p&gt;There are a couple of things going on here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) The maximum metric/hop count in RIP (v1 and v2) is 15.  Trying to set a metric of 100 isn't going to get you very far in general.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) The &quot;distance&quot; command is administrative distance.  This controls the relative priority of routes received in different routing protocols and has literally nothing to do with the infinite count problem within RIP. You'd use this command if, for example, you wanted to manage the behavior such that if 192.168.3.0/24 is received in RIP and OSPF that you'd prefer the RIP version.  In general it's not a great idea to ever play with this value on any router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to see high metric values reaching infinity try redistributing from static (or another routing protocol) and setting a metric at that point to something close to 15.  So - for example - if you redistribute a static route with a metric of 14 you should see the route make it to one adjacent router but not to one further.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-11-27T23:23:46.323" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="36849" PostTypeId="2" ParentId="36844" CreationDate="2016-11-27T23:52:01.480" Score="2" Body="&lt;p&gt;In addition to the examples given by @mxrx,  probably the most common one in use today is Wi-Fi, 802.11.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-11-27T23:52:01.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36852" PostTypeId="2" ParentId="36839" CreationDate="2016-11-28T03:44:59.390" Score="3" Body="&lt;p&gt;So there's likely a whole lot of other things going on with this configuration so the amount of depth that can be provided is going to be limited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your questions specifically-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A1: (from CCO) The Bridge Group (BG) is a non-functional configuration hierarchy that ties several BDs together in part of the same functional group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you remove it you'll delete everything that's contained within it (...which is to say the two BD's in your example).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A2: There's more configuration below your sample but you can think of the Bundle-Ether interfaces as being roughly analogous to PortChannel interfaces in IOS/NXOS.  You're creating subinterfaces within each bundle corresponding to VLAN ID's 500 and 600.  When you send packets back out these interfaces a corresponding 802.1q VLAN ID will be applied. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A3: Yes - each bridge-domain is its own broadcast domain.  Put another way a broadcast coming in Bundle-Ether1.500 will (solely) be flooded out Bundle-Ether2.500.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A4: We can't say why you have these Bridge-Domains because we don't know what you're trying to accomplish.  If the goal is separately tying together VLAN's 500 and 600 that exist on separate switches connected to Bundle-Ether1 and Bundle-Ether2 then the configuration makes sense.  That said, the configuration of the second ASR is kind of bizarre as it hooks up to VLAN500 at two points with different IP's.  This doesn't serve any obvious purpose that I can see. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A5: L2VPN is the global stanza where the various L2 cross-connect functions (...like BD's, etc) are defined. &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-11-28T03:44:59.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36853" PostTypeId="2" ParentId="36775" CreationDate="2016-11-28T04:06:39.517" Score="1" Body="&lt;p&gt;Yes.  This can be done and does work on a number of Cisco platforms.  It is specifically applicable in access control situations (traffic filters, route distribution control, etc).  It is &lt;strong&gt;not&lt;/strong&gt; supported for interface addressing.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, it's not very readable and - in my experience, is usually a way to save a few lines of ACL and is a classic example of how &lt;a href=&quot;http://ubiquity.acm.org/article.cfm?id=1513451&quot; rel=&quot;nofollow noreferrer&quot;&gt;preoptimization is the root of all evil&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-11-28T04:06:39.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36857" PostTypeId="1" AcceptedAnswerId="36859" CreationDate="2016-11-28T11:59:33.807" Score="1" ViewCount="1255" Body="&lt;p&gt;&lt;strong&gt;Short question&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can we run Serial, HDbaseT and POE through a patch panel ? The patch panel will also be serving the data network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Long question (with more background info)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ive got a patch panel going into an office for a data network, in addition to the data network we also have some HDbaseT baluns (HD video over cat6), serial commands (for controlling AV kit via a control system) and some POE devices (such as access point and door entry panel. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of the above devices run over cat6, and in the case of the serial get put into an rj45 to rs232 convertor. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that we cant run all of this through a network switch, but can we run this through a patch panel?  &lt;/p&gt;&#xA;" OwnerUserId="19472" LastEditorUserId="8499" LastEditDate="2016-11-28T13:31:29.943" LastActivityDate="2016-11-28T15:02:36.173" Title="Can you run serial, POE and HDbaseT through a patch panel?" Tags="|cabling|layer1|patch-panel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36859" PostTypeId="2" ParentId="36857" CreationDate="2016-11-28T13:35:15.903" Score="1" Body="&lt;p&gt;Yes. A patch panel is really just part of your cable plant, and it is merely the termination point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were smart, you would have different patch panels for different functions, but you could do it all on one patch panel if you carefully mark what each connection is. You have three different, incompatible functions, and you really don't want to accidentally connect cabling for one function to a source for a different function.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-28T13:35:15.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36860" PostTypeId="2" ParentId="32676" CreationDate="2016-11-28T14:54:58.410" Score="1" Body="&lt;p&gt;With your static IP config and ability to access the internet, that excludes allowing the VLAN on your uplink Trunks/Port Channels:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;switchport trunk allowed vlan xx,94,98 (or whichever VLANs you've chosen)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thought is you need to tell the switch that is routing your VLANs where to send DHCP traffic.  Here is one of my Nexus VLAN configs.  Take note of the last two lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan900&#xA;  description ####    blah VLAN    ####&#xA;  no shutdown&#xA;  no ip redirects&#xA;  ip address 10.135.0.3/21&#xA;  hsrp 1&#xA;    name VLAN900-HSRP&#xA;    preempt&#xA;    priority 110&#xA;    ip 10.135.0.1&#xA;    track 1 decrement 50&#xA;  ip dhcp relay address 10.130.8.151&#xA;  ip dhcp relay address 10.130.8.150&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32328" LastActivityDate="2016-11-28T14:54:58.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36861" PostTypeId="2" ParentId="36857" CreationDate="2016-11-28T15:02:36.173" Score="2" Body="&lt;p&gt;Agree with Ron.  It's all copper connections.  Ensure you stay within recommendations for length.  HDbase-T is the same as Ethernet (328'), but serial is limited. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is some good info here.&#xA;&lt;a href=&quot;http://www.tldp.org/HOWTO/Remote-Serial-Console-HOWTO/serial-distance.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.tldp.org/HOWTO/Remote-Serial-Console-HOWTO/serial-distance.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, with a 16 port DECServer I'm able to push 9600 to medical lab equipment that's over 100' away quite reliably.&lt;/p&gt;&#xA;" OwnerUserId="32328" LastActivityDate="2016-11-28T15:02:36.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36862" PostTypeId="1" AcceptedAnswerId="36991" CreationDate="2016-11-28T17:41:05.240" Score="1" ViewCount="737" Body="&lt;p&gt;Sometimes gigabit port starts blinking amber light and when i do &lt;code&gt;sh int count err&lt;/code&gt; i can see how &quot;RCV err&quot; growth.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW-Floor-2#show int gig 2/0/27 counters err&#xA;&#xA;Port        Align-Err     FCS-Err    Xmit-Err     Rcv-Err  UnderSize  OutDiscards&#xA;Gi2/0/27            0           1           0       10134          0            0&#xA;&#xA;Port      Single-Col  Multi-Col   Late-Col  Excess-Col  Carri-Sen      Runts     Giants&#xA;Gi2/0/27           0          0          0           0          0          0          0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And sometimes interface shuts down and goes up automatically on other side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here my logs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;W-Floor-2#sh log&#xA;Syslog logging: enabled (0 messages dropped, 1 messages rate-limited, 0 flushes, 0 overruns, xml disabled, filtering disabled)&#xA;&#xA;No Active Message Discriminator.&#xA;&#xA;&#xA;&#xA;No Inactive Message Discriminator.&#xA;&#xA;&#xA;    Console logging: level debugging, 95104 messages logged, xml disabled,&#xA;                     filtering disabled&#xA;    Monitor logging: level debugging, 329 messages logged, xml disabled,&#xA;                     filtering disabled&#xA;    Buffer logging:  level debugging, 95104 messages logged, xml disabled,&#xA;                    filtering disabled&#xA;    Exception Logging: size (4096 bytes)&#xA;    Count and timestamp logging messages: disabled&#xA;    File logging: disabled&#xA;    Persistent logging: disabled&#xA;&#xA;No active filter modules.&#xA;&#xA;    Trap logging: level informational, 92800 message lines logged&#xA;        Logging Source-Interface:       VRF Name:&#xA;&#xA;Log Buffer (4096 bytes):&#xA;.0 dBm. (SW-Floor-2-3)&#xA;Nov 28 21:20:34: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low warning; Operating value: -18.9 dBm, Threshold value: -17.0 dBm.&#xA;Nov 28 21:24:13: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.3 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-2)&#xA;Nov 28 21:24:15: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.3 dBm, Threshold value: -19.0 dBm.&#xA;Nov 28 21:28:13: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet3/0/51, changed state to down&#xA;Nov 28 21:28:42: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet3/0/51, changed state to up&#xA;Nov 28 21:30:34: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low alarm; Operating value: -19.8 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-3)&#xA;Nov 28 21:30:36: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low alarm; Operating value: -19.8 dBm, Threshold value: -19.0 dBm.&#xA;Nov 28 21:32:40: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet2/0/8, changed state to down&#xA;Nov 28 21:32:41: %LINK-3-UPDOWN: Interface GigabitEthernet2/0/8, changed state to down&#xA;Nov 28 21:34:15: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.5 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-2)&#xA;Nov 28 21:34:17: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.5 dBm, Threshold value: -19.0 dBm.&#xA;Nov 28 21:40:37: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low alarm; Operating value: -19.4 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-3)&#xA;Nov 28 21:40:39: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low alarm; Operating value: -19.4 dBm, Threshold value: -19.0 dBm.&#xA;Nov 28 21:44:17: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.8 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-2)&#xA;Nov 28 21:44:19: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.8 dBm, Threshold value: -19.0 dBm.&#xA;Nov 28 21:47:54: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet3/0/3, changed state to down&#xA;Nov 28 21:47:55: %LINK-3-UPDOWN: Interface GigabitEthernet3/0/3, changed state to down&#xA;Nov 28 21:47:58: %LINK-3-UPDOWN: Interface GigabitEthernet3/0/3, changed state to up&#xA;Nov 28 21:47:59: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet3/0/3, changed state to up&#xA;Nov 28 21:50:39: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low alarm; Operating value: -20.0 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-3)&#xA;Nov 28 21:50:41: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low alarm; Operating value: -20.0 dBm, Threshold value: -19.0 dBm.&#xA;Nov 28 21:54:19: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.4 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-2)&#xA;Nov 28 21:54:21: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.4 dBm, Threshold value: -19.0 dBm.&#xA;Nov 28 22:00:41: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low alarm; Operating value: -20.0 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-3)&#xA;Nov 28 22:00:43: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low alarm; Operating value: -20.0 dBm, Threshold value: -19.0 dBm.&#xA;Nov 28 22:04:21: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.6 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-2)&#xA;Nov 28 22:04:23: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.6 dBm, Threshold value: -19.0 dBm.&#xA;Nov 28 22:10:43: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low alarm; Operating value: -19.4 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-3)&#xA;Nov 28 22:10:45: %SFF8472-5-THRESHOLD_VIOLATION: Gi3/0/51: Rx power low alarm; Operating value: -19.4 dBm, Threshold value: -19.0 dBm.&#xA;Nov 28 22:14:23: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.8 dBm, Threshold value: -19.0 dBm. (SW-Floor-2-2)&#xA;Nov 28 22:14:25: %SFF8472-5-THRESHOLD_VIOLATION: Gi2/0/27: Rx power low alarm; Operating value: -19.8 dBm, Threshold value: -19.0 dBm.&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;SW-Floor-2#show controllers ethernet-controller gig 1/0/27&#xA;&#xA;     Transmit GigabitEthernet1/0/27           Receive&#xA;   3079381646 Bytes                       1150071762 Bytes&#xA;    169736103 Unicast frames               157574604 Unicast frames&#xA;      3325069 Multicast frames                513275 Multicast frames&#xA;       939914 Broadcast frames                258543 Broadcast frames&#xA;            0 Too old frames               313695412 Unicast bytes&#xA;            0 Deferred frames               79832894 Multicast bytes&#xA;            0 MTU exceeded frames           29254751 Broadcast bytes&#xA;            0 1 collision frames                   0 Alignment errors&#xA;            0 2 collision frames                  82 FCS errors&#xA;            0 3 collision frames                   0 Oversize frames&#xA;            0 4 collision frames                   0 Undersize frames&#xA;            0 5 collision frames                  19 Collision fragments&#xA;            0 6 collision frames&#xA;            0 7 collision frames               24108 Minimum size frames&#xA;            0 8 collision frames            54768642 65 to 127 byte frames&#xA;            0 9 collision frames            50404995 128 to 255 byte frames&#xA;            0 10 collision frames            5592659 256 to 511 byte frames&#xA;            0 11 collision frames            3267416 512 to 1023 byte frames&#xA;            0 12 collision frames           44348443 1024 to 1518 byte frames&#xA;            0 13 collision frames                  0 Overrun frames&#xA;            0 14 collision frames                  0 Pause frames&#xA;            0 15 collision frames&#xA;            0 Excessive collisions             89236 Symbol error frames&#xA;            0 Late collisions                    251 Invalid frames, too large&#xA;            0 VLAN discard frames              29197 Valid frames, too large&#xA;            0 Excess defer frames                 48 Invalid frames, too small&#xA;       114355 64 byte frames                       0 Valid frames, too small&#xA;     46406323 127 byte frames&#xA;     48216664 255 byte frames                      0 Too old frames&#xA;      5748932 511 byte frames                      0 Valid oversize frames&#xA;      3592061 1023 byte frames                     0 System FCS error frames&#xA;     69828220 1518 byte frames                     0 RxPortFifoFull drop frame&#xA;        94531 Too large frames&#xA;            0 Good (1 coll) frames&#xA;            0 Good (&amp;gt;1 coll) frames&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I checked duplexes on both sides and its set full-duplex. I changed patch cords, changed SFP modules and problem still occuring. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry for my english.&lt;/p&gt;&#xA;" OwnerUserId="32384" LastEditorUserId="8499" LastEditDate="2018-08-09T00:31:19.593" LastActivityDate="2018-08-09T06:09:42.533" Title="RCV Err increases and port blinks amber" Tags="|switch|layer1|cable|fiber|cabling|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36863" PostTypeId="1" CreationDate="2016-11-28T17:47:33.423" Score="2" ViewCount="1975" Body="&lt;p&gt;I am trying to find out how i can display the up time/down time on Avaya switch ports&lt;/p&gt;&#xA;" OwnerUserId="32385" LastEditorDisplayName="user36472" LastEditDate="2019-02-25T11:53:37.477" LastActivityDate="2019-02-25T11:53:37.477" Title="What is the Avaya command to find out how long a port has been down for?" Tags="|switch|command|downtime|avaya|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36866" PostTypeId="2" ParentId="36863" CreationDate="2016-11-28T19:54:55.193" Score="3" Body="&lt;p&gt;I don't know how to show it in the CLI, it's not in the output of &lt;code&gt;show interfaces verbose&lt;/code&gt; or &lt;code&gt;show port-statistics&lt;/code&gt; afaik...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option could be to query it using SNMP. Avaya supports the IF-MIB, and the ifTable entries contain an &lt;code&gt;ifLastChange&lt;/code&gt; value (.1.3.6.1.2.1.2.2.1.9):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The value of sysUpTime at the time the interface entered its current&#xA;  operational state.  If the current state was entered prior to the last&#xA;  re-initialization of the local network management subsystem, then this&#xA;  object contains a zero value.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Note that this value is in &quot;ticks&quot;, or 1/100ths of a second.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2016-11-28T19:54:55.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36868" PostTypeId="2" ParentId="17030" CreationDate="2016-11-29T02:11:05.573" Score="4" Body="&lt;p&gt;Think of Morse Code.  The signal is the sound, pulse, or light.  The message is en&lt;em&gt;code&lt;/em&gt;d using the &quot;dits&quot; and &quot;dahs&quot;, for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7cicx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7cicx.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-29T02:11:05.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36869" PostTypeId="1" CreationDate="2016-11-29T03:18:17.197" Score="0" ViewCount="164" Body="&lt;p&gt;Over (Software defined network) what will happen when unknown Ethernet hits the first switch, using 4 OF switch and 8 host.  &lt;/p&gt;&#xA;" OwnerUserId="32397" LastEditorUserId="8499" LastEditDate="2016-11-29T03:19:40.853" LastActivityDate="2018-07-23T12:47:44.567" Title="Software defined system" Tags="|ethernet|packet-analysis|sdn|openflow|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36871" PostTypeId="1" CreationDate="2016-11-29T05:08:54.990" Score="2" ViewCount="2294" Body="&lt;p&gt;Need help here&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site B&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TZ105 &#xA;x0 Lan 192.168.162.1&#xA;X1 WAN 64.x.x.x&#xA;X2 LAN 10.0.3.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Site A&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TZ300&#xA;X0 LAN 10.0.1.1&#xA;X1 WAN 69.x.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;VPN tunnel set up as VPN SITE TO SITE and is Green&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Site A I can ping &lt;code&gt;10.0.3.1&lt;/code&gt;&#xA;From Site B I can ping &lt;code&gt;10.0.1.1&lt;/code&gt; and everything else on this network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Site A, I can only ping &lt;code&gt;10.0.3.1&lt;/code&gt;. Although I cannot access a single service, VMConsole, or anything else on the 10.0.3.0 network. I understand that firewall needs to be able to allow for ping on 10.0.3.0 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SITE B&#xA;Secondly, I'm going to be connecting up a VOIP/SIP network onto this router for Site B. Do I need to create a VLAN for the Phones? Do I need to create a VLAN for the 10.0.3.0 network?&lt;/p&gt;&#xA;" OwnerUserId="32401" LastEditorUserId="52517" LastEditDate="2019-09-17T11:22:50.827" LastActivityDate="2024-01-24T20:00:55.137" Title="Sonicwall TZ105 Site to Site VPN Created can ping gateways but can't ping network from other site" Tags="|routing|firewall|ping|sonicwall|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="36879" PostTypeId="1" CreationDate="2016-11-29T11:46:49.210" Score="2" ViewCount="86" Body="&lt;p&gt;Is there any way to load balance certain types of inbound traffic for one or multiple Service Providers. For example can VoIP and video be directed to come from a specific service provider while other data comes from both? Can this be done with communities?&lt;/p&gt;&#xA;" OwnerUserId="32357" LastEditorUserId="8499" LastEditDate="2016-11-29T18:34:13.090" LastActivityDate="2017-09-26T02:42:06.190" Title="Directing traffic with Multihomed Connections to Service Provider" Tags="|routing|bgp|isp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36881" PostTypeId="1" AcceptedAnswerId="36883" CreationDate="2016-11-29T12:28:45.380" Score="1" ViewCount="130" Body="&lt;p&gt;I am migrating our NMS and I need to assign a new different IP address to the server I am migrating to. One concern I have is that I want to make sure that all nodes I am monitoring are set up to send syslog and SNMP traps to the new address, I could just add config to point the nodes at the new syslog and trap destination but am cocerned that I can't send syslog and SNMP traps to two different addresses concurrently. Can't seem to find any documentation to back this up?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd like to configure nodes to send to two different addresses then when I have successfully cutover I can remove references to the old address I am migrating from.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I send syslog and traps to two different location sconcurrently?&lt;/p&gt;&#xA;" OwnerUserId="8804" LastActivityDate="2016-11-29T13:36:45.537" Title="Is it possible to send syslog and SNMP traps to two different addresses concurrently?" Tags="|cisco|snmp|syslog|nms|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36883" PostTypeId="2" ParentId="36881" CreationDate="2016-11-29T13:36:45.537" Score="2" Body="&lt;p&gt;Yes, you can with Cisco gear at least (and probably also with most other vendors).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For syslog:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logging 10.1.1.1&#xA;logging 10.1.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For SNMP traps:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server host 10.1.1.1 version 2c @str!ng&#xA;snmp-server host 10.1.1.2 version 2c @str!ng&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-11-29T13:36:45.537" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36886" PostTypeId="2" ParentId="36871" CreationDate="2016-11-29T14:39:45.733" Score="0" Body="&lt;p&gt;Check to make sure you put the remote network into both sides go to VPN-&gt;Configure-&gt; Newtwork  and make sure you have the correct networks selected and that they have the whole network range not just the gateway address object. For what I expect you are doing I would setup the local networks to Firewalled Subnets on both, and note what you have for the REMOTE network name. Then go to Firewall-&gt; Address Objects-&gt; Select Custom radio button. This will show you your remote networks and look for the remote network name, and make sure its a Range not a host and that it has the correct range. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You technically don't have to create a VLAN. Depending on the number of phones and how important quality is you can get by with just plugging the phones in. I have a small office (4 Phones and 5 pcs) that I have all on the same subnet no fancy VLAN and no issues. I only use VLAN if I only have one network cable run to each desk. IE passing through the phones to the computers. If I have the cable already ran(or the time to do so myself) A central PoE switch will save you lots of headache in the future. &lt;/p&gt;&#xA;" OwnerUserId="32414" LastActivityDate="2016-11-29T14:39:45.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36888" PostTypeId="2" ParentId="36879" CreationDate="2016-11-29T15:36:03.933" Score="1" Body="&lt;p&gt;You really don't have much to say about the path incoming traffic takes in the Internet, and you need the cooperation of the peer ASes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your communities mean nothing to any other AS unless you have an agreement with that AS for what they mean. This becomes exponentially more complex if you are trying to do this with multiple peer ASes because you need to convince one AS to not send some of your traffic to your AS, but to a completely different AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you only have one other peer AS, you can probably negotiate with it to use MED, but that is not something you can use with multiple ASes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A typical way to do this is to advertise your prefixes with your AS tacked on multiple times in the AS_PATH toward the least preferred AS. This &lt;em&gt;usually&lt;/em&gt; works because your prefixes will be advertised with a longer AS_PATH by your least preferred peer AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also simply not advertise prefixes out some peer AS connections, but this doesn't really give you a failover option.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-29T15:36:03.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36889" PostTypeId="2" ParentId="36879" CreationDate="2016-11-29T15:38:48.767" Score="0" Body="&lt;p&gt;You can't route based on layer 7 application using only BGP.  BGP features will only allow you to tweak the actual prefix advertisements/preference, not anything at layer 7.  For active application inspection and policy routing you would need an external service provider to act as a reverse proxy for your public subnet.  Then you would build a GRE tunnel from each of your ISP connections to this provider and they forward you the traffic down these tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't heard of anyone offering this type of application load balancing service, but it doesn't seem unrealistic since there are security services that operate in this same manner in order to &quot;scrub&quot; malicious traffic before sending it to your site.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-11-29T15:38:48.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36891" PostTypeId="2" ParentId="34508" CreationDate="2016-11-29T16:10:36.623" Score="0" Body="&lt;p&gt;I spoke with Rob Ryan one time.  He had Ascend Communications and has a small ranch near here.  He told me that Ethernet is pretty resilient and you can get away with a lot, including violating the distance rule (ethernet between the house and the ranch office is way beyond the maximum distance...). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm curious if you try two different cables, due to 2 pairs not being in the same cable so we don't have to worry about crosstalk between the pairs.  Pin it out so TX and RX are on different cables.  Depending on length and other EMI, you might be able to get higher speed, maybe even Gigabit.  In a pinch, I'd give it a go if you can't pull in a length of Cat-6.&lt;/p&gt;&#xA;" OwnerUserId="32328" LastActivityDate="2016-11-29T16:10:36.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36893" PostTypeId="1" CreationDate="2016-11-29T16:51:32.483" Score="1" ViewCount="950" Body="&lt;p&gt;When implementing QOS in openvSwitch there is an option in Conﬁguration for linux-htb QoS : &lt;strong&gt;other_conﬁg : priority&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The description for this option in the ovs documentation is :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;other_conﬁg : priority:optional string, containing an integer, in&#xA;  range 0 to 4,294,967,295 A queue with a smaller priority will receive&#xA;  all the excess bandwidth that it can use before a queue with a larger&#xA;  value receivesany.Speciﬁc priority values are unimportant; only&#xA;  relative ordering matters. Defaults to 0 if unspeciﬁed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My understanding is this is an option for implementing Priority Queueing. Is this correct ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if so, what does the bellow line means exactly ? :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Speciﬁc priority values are unimportant; only relative ordering&#xA;  matters &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Any help woud be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you .&lt;/p&gt;&#xA;" OwnerUserId="24929" LastEditorUserId="24929" LastEditDate="2016-12-03T07:47:48.497" LastActivityDate="2018-04-23T23:14:56.537" Title="Priority queueing in openvswitch" Tags="|sdn|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36895" PostTypeId="5" CreationDate="2016-11-29T17:38:56.497" Score="0" Body="&lt;p&gt;Cisco IOS Embedded Event Manager (EEM) is a powerful and flexible subsystem that provides real-time network event detection and onboard automation. It gives you the ability to adapt the behavior of your network devices to align with your business needs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T17:38:56.497" LastActivityDate="2016-11-29T17:38:56.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36896" PostTypeId="4" CreationDate="2016-11-29T17:38:56.497" Score="0" Body="For questions about Cisco Embedded Event Manager." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T17:38:56.497" LastActivityDate="2016-11-29T17:38:56.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36897" PostTypeId="1" AcceptedAnswerId="39026" CreationDate="2016-11-29T17:48:08.843" Score="2" ViewCount="93" Body="&lt;p&gt;I'm new to SonicWALL and Site to Site VPN Configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a sonic wall tz400 and have our local workstations configured to receive public IPs in the 167.x.x.x/24 range. The question is if the SonicWall can be configured to do a site to site VPN attached to the same network as the workstations and route traffic from these workstations to the destination network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The destination private network is in the 10.x.x.x/24 range with a public IP for their VPN concentrator of 209.x.x.x/24. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way that I conceptually see this working is to  use the WAN X1 port on the SonicWALL, initially configure the workstations  with static routes for the destination 10. network to use the Static 167.x.x.x address on the SonicWALL WAN port.&lt;/p&gt;&#xA;" OwnerUserId="32421" LastActivityDate="2017-08-17T07:28:27.247" Title="Sonicwall tz400 - is the proposed architecture for a site to site VPN possible?" Tags="|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36898" PostTypeId="5" CreationDate="2016-11-29T17:49:24.087" Score="0" Body="&lt;p&gt;Occasionally a gateway or destination host will communicate with a source host, for example, to report an error in datagram processing.  For such purposes this protocol, the Internet Control Message Protocol (ICMP), is used.  ICMP, uses the basic support of IP as if it were a higher level protocol, however, ICMP is actually an integral part of IP, and must be implemented by every IP module.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T17:49:24.087" LastActivityDate="2016-11-29T17:49:24.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36899" PostTypeId="4" CreationDate="2016-11-29T17:49:24.087" Score="0" Body="For questions about the Internet Control Message protocol." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T17:49:24.087" LastActivityDate="2016-11-29T17:49:24.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36900" PostTypeId="5" CreationDate="2016-11-29T18:00:48.137" Score="0" Body="&lt;p&gt;The Multiple Spanning Tree Protocol (MSTP), originally defined in IEEE 802.1s and later merged into IEEE 802.1Q-2005, defines an extension to RSTP to further develop the usefulness of virtual LANs (VLANs). This Multiple Spanning Tree Protocol configures a separate Spanning Tree for each VLAN group and blocks all but one of the possible alternate paths within each Spanning Tree.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:00:48.137" LastActivityDate="2016-11-29T18:00:48.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36901" PostTypeId="4" CreationDate="2016-11-29T18:00:48.137" Score="0" Body="For questions about MST (Multiple Spanning Tree Protocol)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:00:48.137" LastActivityDate="2016-11-29T18:00:48.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36902" PostTypeId="5" CreationDate="2016-11-29T18:04:47.153" Score="0" Body="&lt;p&gt;IEEE 802.1X is an IEEE Standard for port-based Network Access Control (PNAC). It provides an authentication mechanism to devices wishing to attach to a LAN or WLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IEEE 802.1X defines the encapsulation of the Extensible Authentication Protocol (EAP) over IEEE 802, which is known as &quot;EAP over LAN&quot; or EAPOL. EAPOL was originally designed for IEEE 802.3 Ethernet in 802.1X-2001, but was clarified to suit other IEEE 802 LAN technologies such as IEEE 802.11 wireless and Fiber Distributed Data Interface (ISO 9314-2) in 802.1X-2004. The EAPOL protocol was also modified for use with IEEE 802.1AE (“MACsec”) and IEEE 802.1AR (Secure Device Identity, DevID) in 802.1X-2010 to support service identification and optional point to point encryption over the local LAN segment.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:04:47.153" LastActivityDate="2016-11-29T18:04:47.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36903" PostTypeId="4" CreationDate="2016-11-29T18:04:47.153" Score="0" Body="For questions about the 802.1X protocol for port-based network access control." OwnerUserId="8499" LastEditorUserId="33" LastEditDate="2017-03-05T20:40:09.733" LastActivityDate="2017-03-05T20:40:09.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36904" PostTypeId="5" CreationDate="2016-11-29T18:16:27.027" Score="0" Body="&lt;p&gt;IGMP is used by hosts to inform multicast routers that the hosts want to join or drop specific multicast groups. It is also used by multicast routers to query hosts to determine if any are still members of specific multicast groups.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:16:27.027" LastActivityDate="2016-11-29T18:16:27.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36905" PostTypeId="4" CreationDate="2016-11-29T18:16:27.027" Score="0" Body="For questions about IGMP (Internet Group Management Protocol), a protocol used for communications between IPv4 hosts and multicast routers to establish and maintain host multicast group membership." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:16:27.027" LastActivityDate="2016-11-29T18:16:27.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36906" PostTypeId="5" CreationDate="2016-11-29T18:19:23.720" Score="0" Body="&lt;p&gt;An interior gateway protocol (IGP) is a type of protocol used for exchanging routing information between gateways (commonly routers) within an autonomous system (for example, a system of corporate local area networks).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:19:23.720" LastActivityDate="2016-11-29T18:19:23.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36907" PostTypeId="4" CreationDate="2016-11-29T18:19:23.720" Score="0" Body="For questions about IGPs (Interior Gateway Protocols), which are routing protocols used within an AS (Autonomous System)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:19:23.720" LastActivityDate="2016-11-29T18:19:23.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36909" PostTypeId="5" CreationDate="2016-11-29T18:30:15.443" Score="0" Body="" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:30:15.443" LastActivityDate="2016-11-29T18:30:15.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36910" PostTypeId="4" CreationDate="2016-11-29T18:30:15.443" Score="0" Body="For questions about transitioning from Internet Protocol version 4 (IPv4) to Internet Protocol version 6 (IPv6); IPv6 is the successor Internet Protocol to IPv4." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:30:15.443" LastActivityDate="2016-11-29T18:30:15.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36911" PostTypeId="1" AcceptedAnswerId="36951" CreationDate="2016-11-29T18:35:35.473" Score="1" ViewCount="139" Body="&lt;p&gt;I'm a small MSP trying to start a logging solution for my clients via a cloud-based log server SaaS provider. I'm not understanding, however, based on any of the instructions I've read from the various products I've tested how to actually accomplish the task. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got SonicWALLs, Dell switches, Juniper switches, etc. that I need to send logs from on a daily basis. I see that they have a spot for your syslog server in the GUI (although I'm trying to learn/accomplish this via CLI) however I'm not receiving any logs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some type of file that needs to be edited in the switch itself? I noticed on one of the switches there was a syslog file. &lt;/p&gt;&#xA;" OwnerUserId="24029" LastActivityDate="2017-08-29T13:57:11.920" Title="How do I send syslogs from a UTM/switch to a cloud-hosted log server?" Tags="|juniper|sonicwall|logging|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36912" PostTypeId="5" CreationDate="2016-11-29T18:41:55.173" Score="0" Body="&lt;p&gt;IS-IS is an IGP (Interior Gateway Protocol) designed for large networks, and it was standardized by the ISO for the OSI reference model. IS-IS is frequently used as an IGP by telephone companies and ISPs with large networks.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:41:55.173" LastActivityDate="2016-11-29T18:41:55.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36913" PostTypeId="4" CreationDate="2016-11-29T18:41:55.173" Score="0" Body="For questions about the Intermediate System to Intermediate System (IS-IS) routing protocol." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:41:55.173" LastActivityDate="2016-11-29T18:41:55.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36914" PostTypeId="5" CreationDate="2016-11-29T18:51:52.637" Score="0" Body="&lt;p&gt;Link Aggregation Control Protocol is defined by IEEE 802.1AX. Within the IEEE specification, LACP provides a method to control the bundling of several physical ports together to form a single logical channel. LACP allows a network device to negotiate an automatic bundling of links by sending LACP packets to the peer (directly connected device that also implements LACP).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:51:52.637" LastActivityDate="2016-11-29T18:51:52.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36915" PostTypeId="4" CreationDate="2016-11-29T18:51:52.637" Score="0" Body="For questions about Link Aggregation Control Protocol (LACP); IEEE 802.1AX." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T18:51:52.637" LastActivityDate="2016-11-29T18:51:52.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36917" PostTypeId="5" CreationDate="2016-11-29T19:21:48.607" Score="0" Body="&lt;p&gt;NetFlow was initially implemented by Cisco, and described in an &quot;informational&quot; document that was not on the standards track: RFC 3954 – Cisco Systems NetFlow Services Export Version 9. The NetFlow protocol itself has been superseded by Internet Protocol Flow Information eXport (IPFIX). Based on the NetFlow Version 9 implementation, IPFIX is on the IETF standards track with RFC 5101 (obsoleted by RFC 7011), RFC 5102 (obsoleted by RFC 7012). Other vendors have proprietary protocols to do the same type of function.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T19:21:48.607" LastActivityDate="2016-11-29T19:21:48.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36918" PostTypeId="4" CreationDate="2016-11-29T19:21:48.607" Score="0" Body="For question about the NetFlow protocol." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T19:21:48.607" LastActivityDate="2016-11-29T19:21:48.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36919" PostTypeId="5" CreationDate="2016-11-29T20:37:21.253" Score="0" Body="&lt;p&gt;Multicast is a method of network communication where traffic is sent to a group of hosts that have subscribed to a multicast group. This is in contrast to unicast (traffic is sent to a single host) or broadcast (traffic is sent to all hosts). Multicast can happen at OSI layer-2, layer-3 or both.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T20:37:21.253" LastActivityDate="2016-11-29T20:37:21.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36920" PostTypeId="4" CreationDate="2016-11-29T20:37:21.253" Score="0" Body="For questions about multicast communications and protocols." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T20:37:21.253" LastActivityDate="2016-11-29T20:37:21.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36921" PostTypeId="5" CreationDate="2016-11-29T20:43:08.373" Score="0" Body="&lt;p&gt;Oversubscription describe a network condition where the aggregate network bandwidth on part of the network exceeds the bandwidth available to get to another part of the network. For instance, a switch with 48 1 Gbps access ports and a single 1 Gbps uplink channel has an oversubscription ratio of 48:1.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T20:43:08.373" LastActivityDate="2016-11-29T20:43:08.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36922" PostTypeId="4" CreationDate="2016-11-29T20:43:08.373" Score="0" Body="For questions about network bandwidth oversubscription." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T20:43:08.373" LastActivityDate="2016-11-29T20:43:08.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36923" PostTypeId="1" CreationDate="2016-11-29T20:51:00.660" Score="1" ViewCount="9941" Body="&lt;p&gt;This must be insanely simple, but I get errors every time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a very basic setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX 300&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ge-0/0/0&lt;/code&gt; = untrust&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ge-0/0/1&lt;/code&gt; though &lt;code&gt;ge-0/0/5&lt;/code&gt; = trust&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ge-0/0/0&lt;/code&gt; and &lt;code&gt;0/0/4&lt;/code&gt; are in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an access point that can host several SSIDs with a VLAN assigned to each SSID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to create a VLAN with an assigned DHCP server for unsecured guest Internet only access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, this VLAN can be assigned to &lt;code&gt;ge-0/0/4&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have rolled back all of my changes thus far.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to include as much relevant information as I could.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@HSRX300# show interfaces&#xA;        ge-0/0/0 {&#xA;            unit 0 {&#xA;                family inet {&#xA;                    address xxx.xxx.xxx.xxx/xx;&#xA;                    address xxx.xxx.xxx.xxx/xx;&#xA;                }&#xA;            }&#xA;        }&#xA;        ge-0/0/1 {&#xA;            unit 0 {&#xA;                family inet {&#xA;                    address 192.168.1.1/24;&#xA;                }&#xA;            }&#xA;        }&#xA;        ge-0/0/2 {&#xA;            unit 0 {&#xA;                family inet {&#xA;                    address 192.168.2.1/24;&#xA;                }&#xA;            }&#xA;        }&#xA;        ge-0/0/3 {&#xA;            unit 0 {&#xA;                family inet {&#xA;                    address 192.168.3.1/24;&#xA;                }&#xA;            }&#xA;        }&#xA;        ge-0/0/4 {&#xA;            unit 0 {&#xA;                family inet {&#xA;                    address 192.168.4.1/24;&#xA;                }&#xA;            }&#xA;        }&#xA;        ge-0/0/5 {&#xA;            unit 0 {&#xA;                family inet {&#xA;                    address 192.168.5.1/24;&#xA;                }&#xA;            }&#xA;        }&#xA;        ge-0/0/6 {&#xA;            unit 0;&#xA;        }&#xA;        ge-0/0/7 {&#xA;            unit 0;&#xA;        }&#xA;        st0 {&#xA;            unit 1 {&#xA;                family inet {&#xA;                    mtu 1436;&#xA;                    address xxx.xxx.xxx.xxx/xx;&#xA;                }&#xA;            }&#xA;            unit 2 {&#xA;                family inet {&#xA;                    mtu 1436;&#xA;                    address xxx.xxx.xxx.xxx/xx;&#xA;                }&#xA;            }&#xA;        }&#xA;&#xA;&#xA;        root@HSRX300# show protocols&#xA;        l2-learning {&#xA;            global-mode switching;&#xA;        }&#xA;&#xA;    root@HSRX300# show security zones&#xA;    security-zone trust {&#xA;        address-book {&#xA;            address Some-Server xxx.xxx.xxx.xxx/xx;&#xA;            address Some-Server-II xxx.xxx.xxx.xxx/xx;&#xA;        }&#xA;        host-inbound-traffic {&#xA;            system-services {&#xA;                all;&#xA;            }&#xA;            protocols {&#xA;                all;&#xA;                bgp;&#xA;            }&#xA;        }&#xA;        interfaces {&#xA;            ge-0/0/1.0;&#xA;            ge-0/0/2.0;&#xA;            ge-0/0/3.0;&#xA;            ge-0/0/4.0;&#xA;            ge-0/0/5.0;&#xA;            st0.1;&#xA;            st0.2;&#xA;        }&#xA;    }&#xA;    security-zone untrust {&#xA;        screen untrust-screen;&#xA;        host-inbound-traffic {&#xA;            system-services {&#xA;                ike;&#xA;            }&#xA;        }&#xA;        interfaces {&#xA;            ge-0/0/0.0 {&#xA;                host-inbound-traffic {&#xA;                    system-services {&#xA;                        dhcp;&#xA;                        tftp;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32424" LastEditorUserId="8499" LastEditDate="2016-11-29T20:57:38.847" LastActivityDate="2016-12-01T10:19:34.950" Title="Configure VLANs on Juniper SRX - cannot figure it out" Tags="|vlan|juniper|srx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36924" PostTypeId="5" CreationDate="2016-11-29T21:21:09.220" Score="0" Body="&lt;p&gt;Route summarization, also called route aggregation, is a method of minimizing the number of routing tables in an IP (Internet Protocol) network. It works by consolidating selected multiple routes into a single route advertisement, in contrast to flat routing in which every routing table contains a unique entry for each route.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T21:21:09.220" LastActivityDate="2016-11-29T21:21:09.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36925" PostTypeId="4" CreationDate="2016-11-29T21:21:09.220" Score="0" Body="For questions about route summarization, a method for collapsing multiple routes into a single route which covers all the collapsed routes." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T21:21:09.220" LastActivityDate="2016-11-29T21:21:09.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36926" PostTypeId="5" CreationDate="2016-11-29T21:39:54.700" Score="0" Body="&lt;p&gt;Unidirectional Link Detection (UDLD) is a data link layer protocol from Cisco Systems to monitor the physical configuration of the cables and detect unidirectional links. UDLD complements the Spanning Tree Protocol which is used to eliminate switching loops.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T21:39:54.700" LastActivityDate="2016-11-29T21:39:54.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36927" PostTypeId="4" CreationDate="2016-11-29T21:39:54.700" Score="0" Body="For questions about the Unidirectional Link Detection protocol." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T21:39:54.700" LastActivityDate="2016-11-29T21:39:54.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36928" PostTypeId="5" CreationDate="2016-11-29T21:46:40.857" Score="0" Body="&lt;p&gt;Terminal Access Controller Access-Control System refers to a family of related protocols handling remote authentication and related services for networked access control through a centralized server. The original TACACS protocol, which dates back to 1984, was used for communicating with an authentication server, common in older UNIX networks; it spawned related protocols:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Extended TACACS (XTACACS) is a proprietary extension to TACACS introduced by Cisco Systems in 1990 without backwards compatibility to the original protocol. TACACS and XTACACS both allow a remote access server to communicate with an authentication server in order to determine if the user has access to the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Terminal Access Controller Access-Control System Plus (TACACS+) is a protocol developed by Cisco and released as an open standard beginning in 1993. Although derived from TACACS, TACACS+ is a separate protocol that handles authentication, authorization, and accounting (AAA) services. TACACS+ and other flexible AAA protocols have largely replaced their predecessors.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T21:46:40.857" LastActivityDate="2016-11-29T21:46:40.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36929" PostTypeId="4" CreationDate="2016-11-29T21:46:40.857" Score="0" Body="For questions about Terminal Access Controller Access-Control System (TACACS) and its variants (XTACACS, and TACACS+)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T21:46:40.857" LastActivityDate="2016-11-29T21:46:40.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36930" PostTypeId="5" CreationDate="2016-11-29T21:51:49.207" Score="0" Body="&lt;p&gt;TFTP is a simple protocol to transfer files, and therefore was named&#xA;the Trivial File Transfer Protocol or TFTP.  It has been implemented&#xA;on top of the Internet User Datagram protocol (UDP or Datagram)&#xA;so it may be used to move files between machines on different&#xA;networks implementing UDP.  (This should not exclude the possibility&#xA;of implementing TFTP on top of other datagram protocols.)  It is&#xA;designed to be small and easy to implement.  Therefore, it lacks most&#xA;of the features of a regular FTP.  The only thing it can do is read&#xA;and write files (or mail) from/to a remote server.  It cannot list&#xA;directories, and currently has no provisions for user authentication.&#xA;In common with other Internet protocols, it passes 8 bit bytes of&#xA;data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Three modes of transfer are currently supported: netascii (This is&#xA;ascii as defined in &quot;USA Standard Code for Information Interchange&quot;&#xA;with the modifications specified in &quot;Telnet Protocol&#xA;Specification&quot;.)  Note that it is 8 bit ascii.  The term&#xA;&quot;netascii&quot; will be used throughout this document to mean this&#xA;particular version of ascii.); octet (This replaces the &quot;binary&quot; mode&#xA;of previous versions of this document.) raw 8 bit bytes; mail,&#xA;netascii characters sent to a user rather than a file.  (The mail&#xA;mode is obsolete and should not be implemented or used.)  Additional&#xA;modes can be defined by pairs of cooperating hosts.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T21:51:49.207" LastActivityDate="2016-11-29T21:51:49.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36931" PostTypeId="4" CreationDate="2016-11-29T21:51:49.207" Score="0" Body="For questions about Trivial File Transfer Protocol (TFTP), a network protocol for transferring files between hosts." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T21:51:49.207" LastActivityDate="2016-11-29T21:51:49.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36932" PostTypeId="5" CreationDate="2016-11-29T21:59:37.973" Score="0" Body="&lt;p&gt;A tunnel in a network is a logical link that encapsulates packets as the payload of another network protocol (or even the same). This allows the encapsulated protocol(s) to be hidden from the network through which the encapsulating packets travel. For example, IPv6 packets can be encapsulated inside IPv4 packets in order to travel across an IPv4-only network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original packets may optionally be encrypted. In this case, the tunnel is often called a Virtual Private Network (VPN).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="36720" LastEditDate="2020-05-16T11:43:01.477" LastActivityDate="2020-05-16T11:43:01.477" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="36933" PostTypeId="4" CreationDate="2016-11-29T21:59:37.973" Score="0" Body="For questions about network tunnels." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T21:59:37.973" LastActivityDate="2016-11-29T21:59:37.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36934" PostTypeId="5" CreationDate="2016-11-29T22:04:44.757" Score="0" Body="&lt;p&gt;A trunk is a single link across which multiple VLAN traffic is transported. The layer-2 frames need some information in order to distinguish which frames belong to which VLANs. This is accomplished with VLAN tags (IEEE 802.1Q).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T22:04:44.757" LastActivityDate="2016-11-29T22:04:44.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36935" PostTypeId="4" CreationDate="2016-11-29T22:04:44.757" Score="0" Body="For questions about trunks, layer-2 links across which traffic for multiple VLANs travel." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T22:04:44.757" LastActivityDate="2016-11-29T22:04:44.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36936" PostTypeId="1" CreationDate="2016-11-29T22:04:50.213" Score="1" ViewCount="1616" Body="&lt;p&gt;Finding out how many devices are connected to a single switchport is easy on a non-stacked Cisco network switch with a &lt;code&gt;sh mac add ta&lt;/code&gt; or &lt;code&gt;sh mac add int fa/gi/eth&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In our enterprise we have many large stacks of 3750 series switches. Is there a command or other ways to discover which specific switchports have multiple devices connected?&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="8499" LastEditDate="2016-11-30T02:37:24.463" LastActivityDate="2016-11-30T03:06:09.777" Title="Single out switchports with multiple MAC addreses" Tags="|cisco-ios|mac-address|switchport|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36937" PostTypeId="2" ParentId="36936" CreationDate="2016-11-29T22:18:33.963" Score="0" Body="&lt;p&gt;There isn't any difference between a stack of 3750 switches and a single 3750 switch. The &lt;code&gt;show mac-address-table&lt;/code&gt; command still works on switch stacks the same way it works on stand-alone switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750/software/release/12-2_55_se/commmand/reference/3750cr/cli2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Catalyst 3750 Command Reference&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;show mac address-table&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;Use the &lt;strong&gt;show mac address-table&lt;/strong&gt; user EXEC command to display a&#xA;  specific MAC address table static and dynamic entry or the MAC address&#xA;  table static and dynamic entries on a specific interface or VLAN.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;show mac address-table [ | { begin | exclude | include } &lt;em&gt;expression&lt;/em&gt; ]&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;  Syntax Description&lt;/h2&gt;&#xA;  &#xA;  &lt;h2&gt;&lt;a href=&quot;https://i.stack.imgur.com/2FsUs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2FsUs.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;   Command Modes&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;User EXEC&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;  Command History&lt;/h2&gt;&#xA;  &#xA;  &lt;h2&gt;&lt;a href=&quot;https://i.stack.imgur.com/QjEOZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QjEOZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;   Usage Guidelines&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Expressions are case sensitive. For example, if you enter &lt;strong&gt;| exclude&#xA;  output&lt;/strong&gt;, the lines that contain output do not appear, but the lines&#xA;  that contain Output appear.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Examples&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;This is an example of output from the show mac address-table command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch&amp;gt; show mac address-table&#xA;Mac Address Table&#xA;------------------------------------------&#xA;Vlan Mac Address Type Ports&#xA;---- ----------- ---- -----&#xA;All 0000.0000.0001 STATIC CPU&#xA;All 0000.0000.0002 STATIC CPU&#xA;All 0000.0000.0003 STATIC CPU&#xA;All 0000.0000.0009 STATIC CPU&#xA;All 0000.0000.0012 STATIC CPU&#xA;All 0180.c200.000b STATIC CPU&#xA;All 0180.c200.000c STATIC CPU&#xA;All 0180.c200.000d STATIC CPU&#xA;All 0180.c200.000e STATIC CPU&#xA;All 0180.c200.000f STATIC CPU&#xA;All 0180.c200.0010 STATIC CPU&#xA;1 0030.9441.6327 DYNAMIC Gi6/0/4&#xA;Total Mac Addresses for this criterion: 12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-11-29T22:18:33.963" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="36938" PostTypeId="5" CreationDate="2016-11-29T22:26:04.960" Score="0" Body="&lt;p&gt;A Wide Area Network is a network that extends over a large geographical distance. WANs often use communications protocols that are different than those commonly found in Local Area Networks (LANs), although this is not a requirement.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T22:26:04.960" LastActivityDate="2016-11-29T22:26:04.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36939" PostTypeId="4" CreationDate="2016-11-29T22:26:04.960" Score="0" Body="For questions about Wide Area Networks (WANs)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-29T22:26:04.960" LastActivityDate="2016-11-29T22:26:04.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36944" PostTypeId="2" ParentId="36936" CreationDate="2016-11-30T03:06:09.777" Score="2" Body="&lt;p&gt;So &lt;em&gt;purely&lt;/em&gt; from an IOS/NXOS CLI it's going to be kind of painful.  Simply running &quot;show mac address-table dynamic | count &quot; will show the number of times a given interface shows up in the list.  Running this for each interface will give you the info you want (...this is the painful part).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the platform supports scripting (ex: the Python interpreter in NXOS) then it would be fairly straightforward to iterate through the dynamic MAC listing and iterating a hash of counters based on the interface name.  At that point you'd simply iterate through the dictionary and print values greater than 1.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly you could pull the output of the &quot;sh mac dynamic&quot; and run it through a fairly trivial script on a local laptop.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-11-30T03:06:09.777" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36945" PostTypeId="1" CreationDate="2016-11-30T03:38:21.723" Score="2" ViewCount="665" Body="&lt;h1&gt;Background&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Our shop consists of approximately 10~12 Cisco IP phones which then connect to their respective workstations. Each phone is connected to the only switch in the shop which is a Cisco 2950 if my memory serves me correctly. This 2950 is connected to a Cisco 2811 which holds the configuration for all the phones.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;The Problem&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Phone calls will consistently drop throughout the day. The main phone rings, and if it's not picked up within 5 rings the other office phones ring. It is when the phone call is picked up from these other phones that the call is dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can post the routers config if necessary but it's rather long. If someone wants to tell me what would help out of the config I can paste that.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Problem Update&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;These are the steps to reproduce the issue. &lt;strong&gt;Phone A&lt;/strong&gt; dials main line at office and the call is answered and established. &lt;strong&gt;Phone B&lt;/strong&gt; dials main line at office, after 3 rings the call is &lt;em&gt;huntstopped&lt;/em&gt; to the other phones. When the call from &lt;strong&gt;Phone B&lt;/strong&gt; is picked up the call drops on the &lt;strong&gt;Cisco 7960 phone&lt;/strong&gt; but on &lt;strong&gt;Phone B&lt;/strong&gt; the call keeps ringing until the line begins ringing again and &lt;em&gt;huntstopped&lt;/em&gt; to the phones and this cycles until &lt;strong&gt;Phone B&lt;/strong&gt; hangs up.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 21515 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Duanes2811&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 ***&#xA;enable password ***&#xA;!&#xA;no aaa new-model&#xA;!&#xA;resource policy&#xA;!&#xA;clock timezone GMT -8&#xA;clock summer-time GMT recurring&#xA;!&#xA;ip cef&#xA;no ip dhcp use vrf connected&#xA;ip dhcp excluded-address 10.10.10.1 10.10.10.10&#xA;!&#xA;ip dhcp pool phone&#xA;   network 10.10.10.0 255.255.255.0&#xA;   default-router 10.10.10.1&#xA;   option 150 ip 10.10.10.1&#xA;!&#xA;ip ftp username chad&#xA;ip ftp password ***&#xA;ip name-server 64.2.21.107&#xA;ip name-server 64.2.21.213&#xA;!&#xA;voice-card 0&#xA; no dspfarm&#xA;!&#xA;voice service voip&#xA; allow-connections h323 to h323&#xA; allow-connections h323 to sip&#xA; allow-connections sip to h323&#xA; allow-connections sip to sip&#xA; supplementary-service h450.12&#xA; h323&#xA; sip&#xA;  registrar server expires max 3600 min 3600&#xA;!&#xA;voice class codec 1&#xA; codec preference 1 g711ulaw&#xA;!&#xA;voice translation-rule 9&#xA; rule 1 /^911$/ /911/&#xA; rule 2 /^9\(.*\)/ /\1/&#xA;!&#xA;username admin privilege 15 secret 5 ****************&#xA;!&#xA;class-map match-all L3-to-L2_VoIP-Cntrl&#xA; match ip dscp af31&#xA;class-map match-all L3-to-L2_VoIP-RTP&#xA; match ip dscp ef&#xA;class-map match-all SIP&#xA; match protocol sip&#xA;class-map match-all RTP&#xA; match protocol rtp&#xA;!&#xA;policy-map EthOut&#xA; class RTP&#xA;policy-map output-L3-to-L2&#xA; class L3-to-L2_VoIP-RTP&#xA;  set cos 5&#xA; class L3-to-L2_VoIP-Cntrl&#xA;  set cos 3&#xA;!&#xA;interface Loopback0&#xA; ip address 10.1.10.2 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; description ** DHCP Client mode **&#xA; ip address dhcp&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Service-Engine0/0&#xA; ip unnumbered Loopback0&#xA; service-module ip address 10.1.10.1 255.255.255.0&#xA; service-module ip default-gateway 10.1.10.2&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; no ip mroute-cache&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1.1&#xA; description ** Data VLAN **&#xA; encapsulation dot1Q 1 native&#xA; ip address 192.168.1.2 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;interface FastEthernet0/1.2&#xA; description ** Voice VLAN **&#xA; encapsulation dot1Q 2&#xA; ip address 10.10.10.1 255.255.255.0&#xA; service-policy output output-L3-to-L2&#xA;!&#xA;ip route 10.1.10.1 255.255.255.255 Service-Engine0/0&#xA;!&#xA;ip http server&#xA;ip http authentication local&#xA;no ip http secure-server&#xA;ip http path flash:&#xA;ip nat inside source list 1 interface FastEthernet0/0 overload&#xA;!&#xA;access-list 1 remark SDM_ACL Category=2&#xA;access-list 1 permit 192.168.10.0 0.0.0.255&#xA;!&#xA;tftp-server flash:P0030702T023.loads&#xA;tftp-server flash:P0030702T023.sb2&#xA;tftp-server flash:P0030702T023.sbn&#xA;tftp-server flash:P0030702T023.bin&#xA;tftp-server flash:CP7902080001SCCP051117A.sbin&#xA;tftp-server flash:Analog1.raw&#xA;tftp-server flash:Analog2.raw&#xA;tftp-server flash:AreYouThere.raw&#xA;tftp-server flash:AreYouThereF.raw&#xA;tftp-server flash:Bass.raw&#xA;tftp-server flash:CallBack.raw&#xA;tftp-server flash:Chime.raw&#xA;tftp-server flash:Classic1.raw&#xA;tftp-server flash:Classic2.raw&#xA;tftp-server flash:ClockShop.raw&#xA;tftp-server flash:DistinctiveRingList.xml&#xA;tftp-server flash:Drums1.raw&#xA;tftp-server flash:Drums2.raw&#xA;tftp-server flash:FilmScore.raw&#xA;tftp-server flash:HarpSynth.raw&#xA;tftp-server flash:Jamaica.raw&#xA;tftp-server flash:KotoEffect.raw&#xA;tftp-server flash:MusicBox.raw&#xA;tftp-server flash:Piano1.raw&#xA;tftp-server flash:Piano2.raw&#xA;tftp-server flash:Pop.raw&#xA;tftp-server flash:Ring1.raw&#xA;tftp-server flash:Ring2.raw&#xA;tftp-server flash:Ring3.raw&#xA;tftp-server flash:Ring4.raw&#xA;tftp-server flash:Ring5.raw&#xA;tftp-server flash:Ring6.raw&#xA;tftp-server flash:Ring7.raw&#xA;tftp-server flash:RingList.xml&#xA;tftp-server flash:Sax1.raw&#xA;tftp-server flash:Sax2.raw&#xA;tftp-server flash:Vibe.raw&#xA;tftp-server flash:Pulse1.raw&#xA;!&#xA;control-plane&#xA;!&#xA;voice-port 0/0/0&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/1&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/2&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/3&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/1/0&#xA; auto-cut-through&#xA; operation 4-wire&#xA; type 5&#xA; signal immediate&#xA; description Overhead Paging Port 0&#xA;!&#xA;voice-port 0/1/1&#xA; auto-cut-through&#xA; operation 4-wire&#xA; type 5&#xA; signal immediate&#xA; description Overhead Paging Port 1&#xA;!&#xA;dial-peer cor custom&#xA; name internal&#xA; name local&#xA; name domestic&#xA; name international&#xA; name 900&#xA; name 976&#xA;!&#xA;dial-peer cor list call-internal&#xA; member internal&#xA;!&#xA;dial-peer cor list call-local&#xA; member local&#xA;!&#xA;dial-peer cor list call-domestic&#xA; member domestic&#xA;!&#xA;dial-peer cor list call-international&#xA; member international&#xA;!&#xA;dial-peer cor list call-900&#xA; member 900&#xA;!&#xA;dial-peer cor list call-976&#xA; member 976&#xA;!&#xA;dial-peer cor list user-internal&#xA; member internal&#xA;!&#xA;dial-peer cor list user-local&#xA; member internal&#xA; member local&#xA;!&#xA;dial-peer cor list user-domestic&#xA; member internal&#xA; member local&#xA; member domestic&#xA;!&#xA;dial-peer cor list user-international&#xA; member internal&#xA; member local&#xA; member domestic&#xA; member international&#xA;!&#xA;dial-peer cor list user900-internal&#xA; member internal&#xA; member 900&#xA; member 976&#xA;!&#xA;dial-peer cor list user900-local&#xA; member internal&#xA; member local&#xA; member 900&#xA; member 976&#xA;!&#xA;dial-peer cor list user900-domestic&#xA; member internal&#xA; member local&#xA; member domestic&#xA; member 900&#xA; member 976&#xA;!&#xA;dial-peer cor list user900-international&#xA; member internal&#xA; member local&#xA; member domestic&#xA; member international&#xA; member 900&#xA; member 976&#xA;!&#xA;dial-peer voice 1 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/0&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 2 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/1&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 3 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/2&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 4 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/3&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 5 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/0&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 6 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/0&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 7 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/0&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 8 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/0&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 9 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/0&#xA; prefix 011&#xA;!&#xA;dial-peer voice 10 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/0&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 11 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/0&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 12 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/1&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 13 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/1&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 14 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/1&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 15 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/1&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 16 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/1&#xA; prefix 011&#xA;!&#xA;dial-peer voice 17 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/1&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 18 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/1&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 19 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/2&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 20 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/2&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 21 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/2&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 22 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/2&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 23 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/2&#xA; prefix 011&#xA;!&#xA;dial-peer voice 24 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/2&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 25 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/2&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 26 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/3&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 27 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/3&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 28 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/3&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 29 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/3&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 30 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/3&#xA; prefix 011&#xA;!&#xA;dial-peer voice 31 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/3&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 32 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/3&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 33 voip&#xA; description ** cue voicemail pilot number **&#xA; translation-profile outgoing PSTN_CallForwarding&#xA; destination-pattern 6000&#xA; session protocol sipv2&#xA; session target ipv4:10.1.10.1&#xA; dtmf-relay sip-notify&#xA; codec g711ulaw&#xA; no vad&#xA;!&#xA;dial-peer voice 34 voip&#xA; description ** cue auto attendant number **&#xA; translation-profile outgoing PSTN_CallForwarding&#xA; destination-pattern 6001&#xA; session protocol sipv2&#xA; session target ipv4:10.1.10.1&#xA; dtmf-relay sip-notify&#xA; codec g711ulaw&#xA; no vad&#xA;!&#xA;dial-peer voice 40 pots&#xA; description E&amp;amp;M port 0 to overhead&#xA; destination-pattern 4000&#xA; port 0/1/0&#xA;!&#xA;telephony-service&#xA; load 7960-7940 P0030702T023&#xA; load 7902 CP7902080001SCCP051117A&#xA; max-ephones 36&#xA; max-dn 108&#xA; ip source-address 10.10.10.1 port 2000&#xA; calling-number initiator&#xA; system message **&#xA; time-zone 5&#xA; voicemail 6000&#xA; max-conferences 2 gain -6&#xA; call-forward pattern .T&#xA; call-forward system redirecting-expanded&#xA; moh MOH_LO.WAV&#xA; multicast moh 239.1.1.1 port 2000&#xA; web admin system name cisco secret 5 **&#xA; dn-webedit&#xA; time-webedit&#xA; transfer-system full-consult dss&#xA; transfer-pattern 9.T&#xA;!&#xA;ephone-template  1&#xA; softkeys idle  Redial Dnd Newcall Cfwdall Pickup&#xA; softkeys seized  Redial Endcall Cfwdall Pickup&#xA; softkeys alerting  Callback Endcall&#xA; softkeys connected  Hold Trnsfer Endcall Confrn Park&#xA;!&#xA;ephone-template  2&#xA; softkeys idle  Redial Dnd Newcall Pickup&#xA; softkeys seized  Redial Endcall Pickup&#xA; softkeys alerting  Callback Endcall&#xA; softkeys connected  Hold Trnsfer Endcall Confrn Park&#xA;!&#xA;ephone-dn  1  dual-line&#xA; number 2001&#xA; label 2001&#xA; description ek&#xA; name ek&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  2  dual-line&#xA; number 2002&#xA; label 2002&#xA; description kk&#xA; name kk&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user900-international&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  3  dual-line&#xA; number 2003&#xA; label 2003&#xA; description Sarah Wall&#xA; name Sarah Wall&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  4  dual-line&#xA; number 2000&#xA; label 2000&#xA; description Receptionist&#xA; name Receptionist&#xA; call-forward noan 2100 timeout 8&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  5  dual-line&#xA; number 2001&#xA; label 2001&#xA; description ek&#xA; name ek&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  6  dual-line&#xA; number 2002&#xA; label 2002&#xA; description kk&#xA; name kk&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  7  dual-line&#xA; number 2003&#xA; label 2003&#xA; description sw&#xA; name sw&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  8  dual-line&#xA; number 2004&#xA; label 2004&#xA; description am&#xA; name am&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user-international&#xA; huntstop channel&#xA;!&#xA;ephone-dn  9  dual-line&#xA; number 2005&#xA; label 2005&#xA; description hj&#xA; name hj&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  10  dual-line&#xA; number 2006&#xA; label 2006&#xA; description mm&#xA; name mm&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  11  dual-line&#xA; number 2007&#xA; label 2007&#xA; description da&#xA; name da&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  12  dual-line&#xA; number 2008&#xA; label 2008&#xA; description ba&#xA; name ba&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  13  dual-line&#xA; number 2009&#xA; label 2009&#xA; description tc&#xA; name tc&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  14  dual-line&#xA; number 2010&#xA; label 2010&#xA; description eo&#xA; name eo&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  15  dual-line&#xA; number 2011&#xA; label 2011&#xA; description td&#xA; name td&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  16&#xA; number 8000....&#xA; mwi on&#xA;!&#xA;ephone-dn  17&#xA; number 8001....&#xA; mwi off&#xA;!&#xA;ephone-dn  18&#xA; number 1000&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;ephone-dn  19&#xA; number 1001&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;ephone-dn  20&#xA; number 1002&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;ephone-dn  21&#xA; number 1003&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;ephone-dn  22  dual-line&#xA; number 2000&#xA; label 2000&#xA; description r&#xA; name r&#xA; preference 1&#xA; call-forward busy 2100&#xA; call-forward noan 2100 timeout 8&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  23  dual-line&#xA; number 2004&#xA; label 2004&#xA; description am&#xA; name am&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  24  dual-line&#xA; number 2100&#xA; label Main&#xA; call-forward noan 5000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  25  dual-line&#xA; number 2100&#xA; label Main&#xA; description MainLine Rollover2&#xA; preference 1&#xA; call-forward busy 5000&#xA; call-forward noan 5000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  26&#xA; number 5000&#xA; label GeneralVM&#xA; description GeneralVM&#xA; name GeneralVM&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 3&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  27  dual-line&#xA; number 2011&#xA; label 2011&#xA; description td&#xA; name td&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  28  dual-line&#xA; number 2009&#xA; label 2009&#xA; description test line&#xA; preference 1&#xA;!&#xA;ephone-dn  29  dual-line&#xA; number 2012&#xA; label 2012&#xA; description New User&#xA; name New User&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 12&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  30  dual-line&#xA; number 2006&#xA; label 2006&#xA; description mm&#xA; name mm&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  31  dual-line&#xA; number 2008&#xA; label 2008&#xA; description ba&#xA; name ba&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  32  dual-line&#xA; number 2005&#xA; label 2005&#xA; description hj&#xA; name hj&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;ephone-dn  33  dual-line&#xA; number 2013&#xA; label 2013&#xA; description kg&#xA; name kg&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;ephone  1&#xA; device-security-mode none&#xA; mac-address 0013.608F.98F3&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:4 2:22 3:24 4:25&#xA; button  5m26&#xA;!&#xA;ephone  2&#xA; device-security-mode none&#xA; mac-address 0007.8599.2E3F&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:8 2:23 3:24 4:25&#xA; button  5m26&#xA;!&#xA;ephone  3&#xA; device-security-mode none&#xA; mac-address 0013.C4AA.C42A&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:5 2:1 3:24 4:25&#xA; button  5m26&#xA;!&#xA;ephone  4&#xA; device-security-mode none&#xA; mac-address 0013.6039.8BFA&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:6 2:2 3:24 4:25&#xA; button  5m26&#xA;!&#xA;ephone  5&#xA; device-security-mode none&#xA; mac-address 0017.E013.41A9&#xA; ephone-template 1&#xA; username &quot;swall&quot;&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:7 2:3 3:24 4:25&#xA; button  5m26&#xA;!&#xA;ephone  6&#xA; device-security-mode none&#xA; mac-address 0017.E013.412F&#xA; ephone-template 2&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:10 2:30 3:24 4:25&#xA; button  5m26&#xA;!&#xA;ephone  7&#xA; device-security-mode none&#xA; mac-address 0015.62EA.6944&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:9 2:32 3:24 4:25&#xA; button  5m26&#xA;!&#xA;ephone  8&#xA; device-security-mode none&#xA; mac-address 0013.601C.1A23&#xA; ephone-template 2&#xA; type 7960&#xA; button  1:11&#xA;!&#xA;ephone  9&#xA; device-security-mode none&#xA; mac-address 0015.621B.2A9B&#xA; ephone-template 2&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:12 2:31 3:24 4:25&#xA; button  5m26&#xA;!&#xA;ephone  10&#xA; device-security-mode none&#xA; mac-address 0013.1AFF.302E&#xA; ephone-template 2&#xA; type 7960&#xA; button  1:13 2:28&#xA;!&#xA;ephone  11&#xA; device-security-mode none&#xA; mac-address 0015.62B5.FAE2&#xA; ephone-template 2&#xA; type 7960&#xA; button  1:14&#xA;!&#xA;ephone  12&#xA; device-security-mode none&#xA; mac-address 0017.955B.0A32&#xA; ephone-template 1&#xA; username &quot;jcoffinberry&quot;&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:15 2:27 3:24 4:25&#xA; button  5m26&#xA;!&#xA;ephone  13&#xA; device-security-mode none&#xA; mac-address 0017.E013.2BFC&#xA; ephone-template 2&#xA; username &quot;newuser&quot;&#xA; button  1:29&#xA;!&#xA;ephone  14&#xA; device-security-mode none&#xA; mac-address 000F.341F.FE6A&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:15 2:27 3:24 4:25&#xA; button  5m26&#xA;!&#xA;ephone  15&#xA; device-security-mode none&#xA; mac-address 0014.A981.86F5&#xA; speed-dial 1 4000 label &quot;Overhead Page&quot;&#xA; type 7960&#xA; button  1:33&#xA;!&#xA;alias exec cue service-module service-engine 0/0 session&#xA;!&#xA;line con 0&#xA; password ***&#xA; login&#xA;line aux 0&#xA;line 194&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport input all&#xA; transport output pad telnet rlogin lapb-ta mop udptn v120 ssh&#xA;line vty 0 4&#xA; password ***&#xA; login&#xA;!&#xA;scheduler allocate 20000 1000&#xA;ntp clock-period 17180231&#xA;ntp master&#xA;ntp server 64.2.21.49&#xA;ntp server 64.2.21.107&#xA;!&#xA;webvpn context Default_context&#xA; ssl authenticate verify all&#xA; !&#xA; no inservice&#xA;!&#xA;end    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2584" LastEditorUserId="2584" LastEditDate="2016-12-02T02:03:45.973" LastActivityDate="2017-05-31T09:41:58.807" Title="How do I diagnose a VoIP issue on a Cisco 2811?" Tags="|cisco|voip|cisco-2960|cisco-7900-ip-phones|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="36946" PostTypeId="2" ParentId="34513" CreationDate="2016-11-30T03:41:05.717" Score="1" Body="&lt;p&gt;We have monitoring in place via an snmp based nms from which we can run reports on what hasn't/has been used over a time period.&#xA;If a port hasn't been used in over 3 months, then we reclaim it for someone else to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your commands as shown in your post actually works ok on a 3750.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess not removing the cabling but disabling the unused ports may be an option in the interim.&#xA;Then only re-enable as per client request.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="4565" LastEditDate="2016-11-30T03:51:20.347" LastActivityDate="2016-11-30T03:51:20.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36947" PostTypeId="2" ParentId="36945" CreationDate="2016-11-30T04:06:15.613" Score="0" Body="&lt;p&gt;It sounds like a codec mismatch error to me.  Ensure that all phones use the g.711 codec and that the voicemail system and voice gateway ports do as well.  That should fix it.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-30T04:06:15.613" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36948" PostTypeId="2" ParentId="36893" CreationDate="2016-11-30T04:08:23.673" Score="1" Body="&lt;p&gt;It means that in a given interval all traffic assigned a lower value will be transmitted before traffic assigned a higher value.  If in that interval the amount of traffic assigned the lower value exhausts the available buffer then the traffic assigned higher values will be dropped.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit to Add: Yes, this is absolutely a form of priority queueing.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-11-30T04:08:23.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36949" PostTypeId="2" ParentId="36911" CreationDate="2016-11-30T04:15:18.973" Score="1" Body="&lt;p&gt;Configure the level of syslog's you want for the events you want logged.  Then configure the syslog server address - either a static public IP or a FQDN.  Then configure the security/firewall on your private/shared cloud system to allow syslog packets to reach the logging server.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-11-30T04:15:18.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36950" PostTypeId="1" AcceptedAnswerId="37116" CreationDate="2016-11-30T05:35:14.497" Score="1" ViewCount="96" Body="&lt;p&gt;From what i understand, both focus on replacing the traditionally implemented proprietary hardware services such as firewalls , NAT ,etc and try to implement it in software. So how do the two differ from each other  &lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2018-05-15T23:43:25.760" Title="How is Service chaining different from network functions virtualization?" Tags="|sdn|virtual|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36951" PostTypeId="2" ParentId="36911" CreationDate="2016-11-30T07:58:40.090" Score="3" Body="&lt;p&gt;You may be running into the fact that some firewalls only allow syslog to be sent from them via their management interface (and not directly out the port facing towards your SaaS/logging provider).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from that, syslog will be sent to a remote server via UDP port 514 by default - ensure that this is allowed outbound from your firewall for all your internal switch IP addresses (again you may need to confirm that your switch is sending from the IP address you think it is - particularly if it is also and L3 switch).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using a SaaS provider, they may require that you send to a specific (non-default) syslog port too so that they can separate your flows from those of other customers, so check with them on this too.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="1392" LastEditDate="2016-12-01T10:14:02.690" LastActivityDate="2016-12-01T10:14:02.690" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36952" PostTypeId="1" CreationDate="2016-11-30T08:23:40.080" Score="0" ViewCount="94" Body="&lt;p&gt;How can I scan all network computers have ip static or dynamic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've checked ip from all network but I don't how can check the dhcp settings.&#xA;It's possible this without access to the aserver?&lt;/p&gt;&#xA;" OwnerUserId="32436" LastActivityDate="2016-11-30T17:22:54.653" Title="Network dhcp discovering" Tags="|dhcp|" AnswerCount="2" CommentCount="3" ClosedDate="2018-08-09T00:18:09.200" ContentLicense="CC BY-SA 3.0" />
  <row Id="36954" PostTypeId="2" ParentId="36923" CreationDate="2016-11-30T12:14:12.427" Score="1" Body="&lt;p&gt;Okay, from the top:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I would &lt;em&gt;highly&lt;/em&gt; recommend you upgrade code to &lt;code&gt;15.1X49-D60.7&lt;/code&gt; before you get started.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You'll need to enable switching mode globally on the box (this will require a restart but save it until you've added all the config):&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set protocols l2-learning global-mode switching&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Next, create your VLAN - let's assume VLAN-ID 4 and a matching irb (routed) interface to go with it.  We'll also put the irb interface into the trust security zone so that the host-inbound configuration applies to it:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set vlans WLAN-HOME vlan-id 4&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set vlans WLAN-HOME l3-interface irb.4&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set interfaces irb unit 4 family inet address 192.168.4.1/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set security zones security-zone trust interface irb.4&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;Now, delete your current interface &lt;code&gt;ge-0/0/4&lt;/code&gt;, remove it from the trust security zone and re-create it as a switching interface in the new VLAN.  &lt;strong&gt;NOTE: This assumes that your AP is expecting VLAN 4 to be tagged towards it - you may lose access to the management interface unless you also add a native-vlan-id to this port, which will require another separate VLAN:&lt;/strong&gt; &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;delete interfaces ge-0/0/4&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;delete security zones security-zone trust interface ge-0/0/4.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set interfaces ge-0/0/4 unit 0 family ethernet-switching interface-mode trunk&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set interfaces ge-0/0/4 unit 0 family ethernet-switching vlan members WLAN-HOME&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;5&quot;&gt;&#xA;&lt;li&gt;Set up a DHCP scope for your new subnet and configure it to serve addresses on irb.4:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set system services dhcp-local-server group jdhcp-group interface irb.4&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set access address-assignment pool WLAN-HOME-POOL family inet network 192.168.4.0/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set access address-assignment pool WLAN-HOME-POOL family inet range junosRange low 192.168.4.10&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set access address-assignment pool WLAN-HOME-POOL family inet range junosRange high 192.168.4.80&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set access address-assignment pool WLAN-HOME-POOL family inet dhcp-attributes router 192.168.4.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set access address-assignment pool WLAN-HOME-POOL family inet dhcp-attributes maximum-lease-time 3600&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;set access address-assignment pool WLAN-HOME-POOL family inet dhcp-attributes name-server 192.168.1.10&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;6&quot;&gt;&#xA;&lt;li&gt;Done.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="1392" LastEditDate="2016-12-01T10:19:34.950" LastActivityDate="2016-12-01T10:19:34.950" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36956" PostTypeId="2" ParentId="30089" CreationDate="2016-11-30T13:11:28.887" Score="1" Body="&lt;p&gt;My bet would be on a poor connection. Crosstalk can sometimes be an issue with Ethernet but I very much doubt it would be a big problem on a link as short as 1m unless you have untwisted a crazy ammount of wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The things I would check.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Make sure your materials are in-order. Is your cable proper copper or crappy CCA? Are your plugs designed for the type of cable you are fitting them to? I've learnt the hard way that using plugs designed for solid core cable on stranded core cable will result in very unreliable connections.&lt;/li&gt;&#xA;&lt;li&gt;Make sure the pins are being pushed in correctly, they should sit straight and just below the surface of the connector. If they are sticking out and/or sitting at an angle then the connector has failed to crimp properly.&lt;/li&gt;&#xA;&lt;li&gt;Make sure the cores are pushed fully home in the plug before crimping. Sometimes you have to pull the cable out and re-trim it if the cores don't want to site nicely.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-11-30T13:11:28.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36957" PostTypeId="1" AcceptedAnswerId="36958" CreationDate="2016-11-30T13:22:53.557" Score="2" ViewCount="1577" Body="&lt;p&gt;Recently I was troubleshooting a firewall issue on one of my servers and noticed that there was a LOT of ICMP redirect traffic being rejected (as it should be).  But this got me thinking why I was getting this these redirect messages to begin with.  After some investigation, I found that our central switch is sending them out because it feels that traffic for our branch office and the Internet should be routed by the firewall and not itself.  Our network is laid out as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;              Switch 1        Switch 2&#xA;Server ----- Cisco 3560 ---- Cisco 3560 ---- Firewall ---- Internet/Branch Office VPN&#xA;             No Routing      IP Routing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The firewall is connected directly to the Cisco switch on one port and the traffic from the servers comes to the switch from a different port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 2 does a lot of inter-VLAN routing for us which is why it is the current default gateway for all devices on our network.  It would be possible to set up static routes to the various VLANs on the servers/workstations/devices/etc and route all other traffic directly to the firewall but this seems like a lot of work, a hassle whenever a new network is added, etc.  Also, from what I've read, the redirect messages should only be sent out if the switch has to forward the packets back out the same port that they arrived on to get to the proper destination (which is not the situation in my case) so I'm not sure why I get the redirects.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, first, are there performance/security issues with routing to the firewall instead of the &quot;router&quot;?  Second, why am I getting ICMP redirects?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 2 config (secure info removed and port list limited to just the two we're interested in):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log datetime&#xA;service password-encryption&#xA;service sequence-numbers&#xA;!&#xA;hostname Switch2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;aaa new-model&#xA;!&#xA;aaa session-id common&#xA;clock timezone EST -5&#xA;system mtu routing 1500&#xA;ip routing&#xA;ip domain-name caymanport.com&#xA;ip name-server 172.16.112.6&#xA;ip name-server 172.16.112.23&#xA;ip name-server 172.16.112.9&#xA;!&#xA;spanning-tree mode pvst&#xA;no spanning-tree optimize bpdu transmission&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;interface FastEthernet0/43&#xA; description fw-gcm eth1/8 (VL16-INETGUEST)&#xA; switchport access vlan 16&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface FastEthernet0/44&#xA; description fw-gcm eth1/1 (VL01)&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/46&#xA; description fw-gcm eth1/6 (VL06-Guest)&#xA; switchport access vlan 6&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;!&#xA;interface FastEthernet0/47&#xA; description fw-gcm eth1/7 (VL10-DMZ)&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/2&#xA; description BillingSwitch MM-F&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA; srr-queue bandwidth share 10 10 60 20&#xA; srr-queue bandwidth shape 10 0 0 0&#xA; queue-set 2&#xA; mls qos trust cos&#xA; auto qos voip trust&#xA; macro description cisco-switch&#xA; spanning-tree link-type point-to-point&#xA;!&#xA;interface Vlan1&#xA; ip address 172.16.112.1 255.255.240.0&#xA;!&#xA;interface Vlan2&#xA; ip address 172.16.129.5 255.255.255.0&#xA;!&#xA;interface Vlan3&#xA; ip address 172.16.130.5 255.255.255.0&#xA;!&#xA;interface Vlan4&#xA; ip address 172.16.140.1 255.255.255.0&#xA;!&#xA;interface Vlan5&#xA; ip address 172.16.150.1 255.255.255.0&#xA;!&#xA;interface Vlan6&#xA; no ip address&#xA;!&#xA;interface Vlan7&#xA; ip address 172.16.170.1 255.255.255.0&#xA;!&#xA;interface Vlan8&#xA; ip address 172.16.180.1 255.255.255.0&#xA;!&#xA;interface Vlan11&#xA; ip address 172.16.161.1 255.255.255.0&#xA;!&#xA;interface Vlan12&#xA; no ip address&#xA;!&#xA;interface Vlan15&#xA; ip address 172.16.240.1 255.255.255.0&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 172.16.112.254&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch 2 routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 172.16.112.254 to network 0.0.0.0&#xA;&#xA;     172.16.0.0/16 is variably subnetted, 9 subnets, 2 masks&#xA;C       172.16.180.0/24 is directly connected, Vlan8&#xA;C       172.16.170.0/24 is directly connected, Vlan7&#xA;C       172.16.161.0/24 is directly connected, Vlan11&#xA;C       172.16.150.0/24 is directly connected, Vlan5&#xA;C       172.16.140.0/24 is directly connected, Vlan4&#xA;C       172.16.129.0/24 is directly connected, Vlan2&#xA;C       172.16.130.0/24 is directly connected, Vlan3&#xA;C       172.16.240.0/24 is directly connected, Vlan15&#xA;C       172.16.112.0/20 is directly connected, Vlan1&#xA;S*   0.0.0.0/0 [1/0] via 172.16.112.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Firewall routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flags: A:active, ?:loose, C:connect, H:host, S:static, ~:internal, R:rip, O:ospf, B:bgp,&#xA;       Oi:ospf intra-area, Oo:ospf inter-area, O1:ospf ext-type-1, O2:ospf ext-type-2, E:ecmp&#xA;&#xA;&#xA;VIRTUAL ROUTER: default (id 1)&#xA;  ==========&#xA;destination                                 nexthop                                 metric flags      age   interface          next-AS&#xA;0.0.0.0/0                                   162.211.139.1                           10     A S              ethernet1/3&#xA;74.222.73.100/30                            74.222.73.102                           0      A C              ethernet1/8&#xA;74.222.73.102/32                            0.0.0.0                                 0      A H&#xA;77.222.73.100/30                            77.222.73.101                           10     A S              ethernet1/8&#xA;162.211.139.0/29                            162.211.139.2                           0      A C              ethernet1/3&#xA;162.211.139.2/32                            0.0.0.0                                 0      A H&#xA;172.16.10.0/24                              172.16.10.0                             10     A S              tunnel.3&#xA;172.16.11.1/32                              0.0.0.0                                 0      A H&#xA;172.16.100.0/24                             172.16.100.10                           10     A S              tunnel.4&#xA;172.16.112.0/20                             172.16.112.1                            10       S              ethernet1/1&#xA;172.16.112.0/20                             172.16.112.254                          0      A C              ethernet1/1&#xA;172.16.112.254/32                           0.0.0.0                                 0      A H&#xA;172.16.129.0/24                             172.16.129.254                          0      A C              ethernet1/1.2&#xA;172.16.129.254/32                           0.0.0.0                                 0      A H&#xA;172.16.130.0/24                             172.16.130.254                          0      A C              ethernet1/1.3&#xA;172.16.130.254/32                           0.0.0.0                                 0      A H&#xA;172.16.140.0/24                             172.16.140.254                          0      A C              ethernet1/1.4&#xA;172.16.140.254/32                           0.0.0.0                                 0      A H&#xA;172.16.150.0/24                             172.16.150.254                          0      A C              ethernet1/1.5&#xA;172.16.150.254/32                           0.0.0.0                                 0      A H&#xA;172.16.160.0/24                             172.16.160.254                          0      A C              ethernet1/6&#xA;172.16.160.254/32                           0.0.0.0                                 0      A H&#xA;172.16.170.0/24                             172.16.170.254                          0      A C              ethernet1/1.7&#xA;172.16.170.254/32                           0.0.0.0                                 0      A H&#xA;172.16.180.0/24                             172.16.180.254                          0      A C              ethernet1/1.8&#xA;172.16.180.254/32                           0.0.0.0                                 0      A H&#xA;172.16.190.0/24                             172.16.190.254                          0      A C              ethernet1/1.9&#xA;172.16.190.254/32                           0.0.0.0                                 0      A H&#xA;172.16.200.0/24                             172.16.200.254                          0      A C              ethernet1/7.10&#xA;172.16.200.254/32                           0.0.0.0                                 0      A H&#xA;192.168.1.0/24                              192.168.1.1                             10     A S              tunnel.2&#xA;192.168.10.0/24                             192.168.1.1                             10     A S              tunnel.2&#xA;192.168.40.0/24                             192.168.1.1                             10     A S              tunnel.2&#xA;192.168.50.0/24                             192.168.1.1                             10     A S              tunnel.2&#xA;192.168.70.0/24                             192.168.1.1                             10     A S              tunnel.2&#xA;total routes shown: 35&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32441" LastEditorUserId="32441" LastEditDate="2016-11-30T16:39:10.657" LastActivityDate="2016-11-30T16:39:10.657" Title="Default Gateway Best Practice" Tags="|cisco|routing|icmp|best-practices|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36958" PostTypeId="2" ParentId="36957" CreationDate="2016-11-30T13:44:59.420" Score="5" Body="&lt;p&gt;A very quick (and therefore incomplete) answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming all of the inside stuff is on the same subnet the ICMP messages are switch2 saying &quot;I don't need to be involved in this, talk to the firewall directly&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've usually done for these situations is set up a transit subnet between the inside router (switch2) and the firewall so that switch2 can route to something that's not on the internal subnet. It also gives you a choke point where you can monitor and control traffic leaving your internal network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wouldn't recommend static routes on servers in this situation.  It's just a pain to manage and adds unneeded complication.&lt;/p&gt;&#xA;" OwnerUserId="165" LastActivityDate="2016-11-30T13:44:59.420" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36959" PostTypeId="1" CreationDate="2016-11-30T14:15:46.433" Score="1" ViewCount="77" Body="&lt;p&gt;Let us assume Host A wants to contact Host B. Does it send the packet addressing (IP address of the Host B) and MAC address of router, or does it use ARP to send to the MAC address of the Host B?&lt;/p&gt;&#xA;" OwnerUserId="32442" LastEditorUserId="8499" LastEditDate="2016-11-30T15:34:48.387" LastActivityDate="2016-11-30T16:01:32.890" Title="How do computers connected to a Wi-Fi network communicate within the same network?" Tags="|ip|ieee-802.11|mac-address|arp|packet-analysis|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36960" PostTypeId="2" ParentId="36959" CreationDate="2016-11-30T14:46:32.507" Score="1" Body="&lt;p&gt;It works the same way as it would if you were using ethernet on a switch. If a host wants to send something to another host on the same network, it will send it to the MAC address of the destination host. If the destination host is on a different network, the host will send it to the MAC address of its configured gateway.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your comment, it seems you need to step back and understand the functions of the network devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers route packets between different networks, so traffic is only sent to a router if it needs to get to a different network. If the source and destination hosts are on different networks, the traffic will be routed between the networks by a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bridges, including switches and WAPs, switch frames on the same network. If the source and destination hosts are on the same network, the traffic will not go through a router. The traffic may be switched by a bridge (switch, WAP, etc.).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-11-30T15:30:31.143" LastActivityDate="2016-11-30T15:30:31.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36965" PostTypeId="1" CreationDate="2016-11-30T15:53:43.830" Score="4" ViewCount="234" Body="&lt;p&gt;Wireless Sensor Network (WSN) and Ad hoc Network differ in one important factor: Infrastructure-based vs Infrastructure-less. In WSN, network is managed by a base station such as these antenna around us that receive our data and phone calls. However, I don't understand how Ad hoc is really managed (At least I don't see its application in my daily life). Can someone explain how Ad hoc is managed? Special type of base station maybe!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="32299" LastActivityDate="2017-11-08T05:59:49.393" Title="WSN vs Ad hoc in real practice" Tags="|cisco|routing|wireless|network-core|ad-hoc-wireless|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36967" PostTypeId="2" ParentId="36952" CreationDate="2016-11-30T16:01:22.183" Score="-2" Body="&lt;p&gt;You can always try an IP directed broadcast, e.g. in a 10.0.0.0/24 network it would be the last IP address of the network 10.0.0.255.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All hosts responding to ICMP will answer and the ones not in your DHCP server's IP range obviously have a static IP address assigned. &lt;/p&gt;&#xA;" OwnerUserId="32438" LastActivityDate="2016-11-30T16:01:22.183" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36969" PostTypeId="2" ParentId="36239" CreationDate="2016-11-30T16:15:38.187" Score="2" Body="&lt;p&gt;Make sure you issue the &lt;code&gt;ip routing&lt;/code&gt; command in EXEC mode &lt;code&gt;(conf t)&lt;/code&gt; of your L3 distribution switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The rest of your config seems to be valid.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also when you ping from the router you can try to force your ping from the right interface by issuing the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RB1# ping 172.16.5.3 source interface fa0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you can check that the subnet is correctly allocated to the right interface by issuing the following command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RB1# ip route 172.16.5.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It should say something like &quot;directly connected through Fa0/0&quot;.&lt;/p&gt;&#xA;" OwnerUserId="32438" LastActivityDate="2016-11-30T16:15:38.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36972" PostTypeId="2" ParentId="36952" CreationDate="2016-11-30T17:22:54.653" Score="2" Body="&lt;p&gt;Best way would be to check the DHCP server. If you don't have access sniff your network traffic using tcpdump / wireshark for some time (filter only DHCP traffic, otherwise you'll end up with lots of unnecessary data).  From this data you should get a pretty good list of DHCP clients in your network. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2016-11-30T17:22:54.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36977" PostTypeId="2" ParentId="36172" CreationDate="2016-12-01T05:20:21.187" Score="3" Body="&lt;p&gt;If you're unable to use  Spanning Tree Protocol (STP), I would recommend looking into Dynamic ARP Inspection (DAI).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you set the DAI rate limit of ARP packets to the absolute lowest your network environment will support, it should cause a port with a layer 2 loop to go into an err-disable state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/dynarp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding and Configuring Dynamic ARP Inspection&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16882" LastEditorUserId="16882" LastEditDate="2016-12-02T19:04:13.990" LastActivityDate="2016-12-02T19:04:13.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36979" PostTypeId="1" AcceptedAnswerId="42311" CreationDate="2016-12-01T07:07:19.047" Score="3" ViewCount="1198" Body="&lt;p&gt;A general rule of thumb for a 3x3 MIMO system antenna orientation is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Keep the center antenna upright at 90 degrees &lt;/li&gt;&#xA;&lt;li&gt;Keep the outward&#xA;antennas leaned outwards at 45 degrees&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I was wondering what could be a general rule of thumb antenna orientation for a 4x4 MIMO system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand no orientation is the 'best' and it depends on the channel environment, client antenna polarization, etc. but I needed a generic answer.&lt;/p&gt;&#xA;" OwnerUserId="4270" LastEditorUserId="4270" LastEditDate="2018-06-03T21:56:01.200" LastActivityDate="2018-06-03T21:56:01.200" Title="Antenna orientation on a 4x4 MIMO capable access point" Tags="|wireless|ieee-802.11|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="36980" PostTypeId="1" AcceptedAnswerId="36982" CreationDate="2016-12-01T07:54:44.237" Score="1" ViewCount="647" Body="&lt;p&gt;We're looking to implement DID calling. Our local provider has indicated they can provide this via a SIP trunk, but cannot provide an E1. We also don't think they can provide an E1-over-SIP (where they convert a TDM signal to SIP on their end).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For various unrelated (non-technical) reasons, we cannot connect a SIP trunk to our PBX, only an E1/T1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question: Do solutions exist that would allow us to convert a straight SIP trunk to a TDM E1 for connection to our PBX? What are some examples?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PBX is a Meridian Option 11C, if that matters.&lt;/p&gt;&#xA;" OwnerUserId="32457" LastActivityDate="2016-12-01T09:49:51.217" Title="Converting SIP to TDM?" Tags="|telephony|voice|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36981" PostTypeId="2" ParentId="24352" CreationDate="2016-12-01T08:28:28.563" Score="1" Body="&lt;p&gt;Finally solved! i don't know why but an other interface was set in DHCP mode (not allowed in here, only static addresses can go to the WAN), i disabled this interface and things got back to normal. Thank you everyone for your answers&lt;/p&gt;&#xA;" OwnerUserId="17044" LastActivityDate="2016-12-01T08:28:28.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36982" PostTypeId="2" ParentId="36980" CreationDate="2016-12-01T09:49:51.217" Score="4" Body="&lt;p&gt;Yes, this is certainly possible.  You can install a E1/PRI VWIC in a Cisco router and the Cisco router can act as a gateway between TDM and SIP.  There are of course solutions by other vendors.  This is a fairly broad subject, so you will need to read up on it, but it is defiantly possible.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-12-01T09:49:51.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36984" PostTypeId="1" AcceptedAnswerId="37006" CreationDate="2016-12-01T10:50:21.497" Score="0" ViewCount="249" Body="&lt;p&gt;Here is a picture of a an xDSL deployment : &#xA;&lt;img src=&quot;https://upload.wikimedia.org/wikipedia/commons/thumb/d/d5/XDSL_Connectivity_Diagram_en.svg/440px-XDSL_Connectivity_Diagram_en.svg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The BRAS is the termination for PPP sessions. The customer modem establishes a session with the BRAS, gets authenticated and can then access the ISP's network and Internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly, it is at the BRAS that the PPPoE and PPP headers will be stripped off the packet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Are those headers added to packets coming from the Internet to the client before getting pushed to the DSLAM - modem, or are they only one way? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) If they are added both ways, how does the BRAS know which session it is? Is it based on the client IP? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Do BRAS keep a session table, like a firewall would for an ACL or NAT for packet returns? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, I just want to know if the BRAS adds PPP/PPPoE headers, and doesn't just strip them off packets. &lt;/p&gt;&#xA;" OwnerUserId="24434" LastActivityDate="2017-07-30T05:59:31.750" Title="PPP sessions on packet return?" Tags="|pppoe|ppp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36985" PostTypeId="1" AcceptedAnswerId="36986" CreationDate="2016-12-01T13:07:06.217" Score="1" ViewCount="81" Body="&lt;p&gt;I need to send a packet to more than one reciever (lets say 30). Assume I don't care that some of them do not receive it now (Application Layer will handle this). Now my solution is to use multicast, such that I send one time and each device in the multicast group receives one time(or tries to).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Question is : Does the router forward the IP packet when it receives it? I could not find the answer to this on the Internet. The thing is all devices (senders/recievers in the multicast group) are connected to the same router, hence they are in the same network. The trick however is that a sender could be on the far right (geographically) of the network and one reciever could be on the far left. So it would make much sense if the router forwards it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how does the router handle this?&lt;/p&gt;&#xA;" OwnerUserId="32463" LastEditorUserId="8499" LastEditDate="2018-03-19T21:00:08.660" LastActivityDate="2018-03-19T21:00:08.660" Title="Recieving a packet multiple times in a wireless LAN Network using multicast" Tags="|router|wireless|ieee-802.11|multicast|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36986" PostTypeId="2" ParentId="36985" CreationDate="2016-12-01T13:35:31.250" Score="2" Body="&lt;p&gt;Depending on how the access point is configured, it can forward multicast packets.  Since they are a broadcast at layer 2, the access point will broadcast the packet at the slowest mandatory rate. That may impact your network performance.  Note that the access point may or may not have a router built into it.  Most commercial devices do not.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-01T13:35:31.250" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36987" PostTypeId="1" AcceptedAnswerId="37003" CreationDate="2016-12-01T13:59:46.713" Score="1" ViewCount="1819" Body="&lt;p&gt;I wonder if L3 CISCO switch can also perform NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my proyect, I have 5 subnets that I need to route (and also provide internet access), and it is said to me that routers with many interfaces are expensive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a better (cost-effective) solution?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="14468" LastEditorUserId="8499" LastEditDate="2018-12-22T02:01:29.597" LastActivityDate="2018-12-22T02:01:29.597" Title="NAT in L3 CISCO switches?" Tags="|cisco|switch|nat|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36989" PostTypeId="1" AcceptedAnswerId="40310" CreationDate="2016-12-01T14:56:09.027" Score="1" ViewCount="3112" Body="&lt;p&gt;could you explain how the BFD Echo packet is forwarded between the neighbors?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RouterA -------------- RouterB&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The echo packet's source IP is RouterA and destination IP is also RouterA. So when RouterB receives the packet it will forward it back to RouterA (using only CEF).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if there is a switch between RouterA and RouterB?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RouterA--------Switch--------RouterB&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I know the echo packet uses RouterA as source MAC and RouterA as destination MAC.&#xA;In this case the switch would send the packet back to RouterA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where am I wrong?&lt;/p&gt;&#xA;" OwnerUserId="16778" LastActivityDate="2017-04-09T10:56:22.167" Title="BFD Echo packet" Tags="|bfd|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36990" PostTypeId="2" ParentId="36987" CreationDate="2016-12-01T14:56:45.860" Score="2" Body="&lt;p&gt;As far as I know, only Cisco 6K series switches can do NAT. Cisco claims that you need hardware to do NAT, and the hardware is not included in Cisco switches. The 6K switches are EoS, but there are replacements, and I'm not sure any of those can do NAT. I do know that none of the 2K, 3K, or 4K switches can do NAT.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-01T20:22:44.847" LastActivityDate="2016-12-01T20:22:44.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="36991" PostTypeId="2" ParentId="36862" CreationDate="2016-12-01T15:13:49.043" Score="1" Body="&lt;p&gt;You don't have enough power. If you have replaced the SFPs and patch cords, you need to try different horizontal fibers. You may have bad fiber terminations on the fiber patch panel. I would get a cable vendor in there to run some tests on the fiber and correct any problem found. They will have the proper test equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Always start troubleshooting at layer-1.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-01T15:13:49.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36992" PostTypeId="2" ParentId="36989" CreationDate="2016-12-01T15:24:02.003" Score="0" Body="&lt;p&gt;BFD operates on top of layer-3 and layer-2, so it is not concerned with IP or MAC addressing. In fact, a layer-2 protocol, e.g. PPP, between the routers may not use MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a router sends BFD, including BFD Echo, to another router, it will use the layer-2 and layer-3 addresses of the other router as the destination layer-2 and layer-3 destination addresses of the frame and packet, respectively, but that really has nothing to do with BFD itself, which, in theory, is independent of the layer-2 and layer-3 protocols used to carry it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When Router A sends BFD to Router B, it will use Router B's layer-2 address (possibly a MAC address) as the destination layer-2 address, and it will use Router B's IP address as the destination IP address. When Router B sends BFD to Router A, it will use Router A's layer-2 address (possibly a MAC address) as the destination layer-2 address, and it will use Router A's IP address as the destination IP address. It doesn't matter if the BFD sent is a Control or Echo packet. The underlying layer-2 and layer-3 protocols need to use the layer-2 and layer-3 destination addresses of the target router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, when a host with a web browser sends a request to a web server, the web server replies with the destination address of the requesting host, not its own address. BFD is the same way; it is the payload of the layer-3 protocol, which is the payload of the layer-2 protocol.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-01T15:24:02.003" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36993" PostTypeId="1" AcceptedAnswerId="37419" CreationDate="2016-12-01T15:27:31.360" Score="1" ViewCount="450" Body="&lt;p&gt;I'd like to know what happens if the RTS frame will be transfered by two devices (which cannot hear one another) in the same time. So it's like a classical hidden terminal problem - A and C are not able to see each other and want to transmit to B. I know that RTS/CTS reduces the collision problem so is it one possibility when the collision will appear?&lt;/p&gt;&#xA;" OwnerUserId="32468" LastActivityDate="2016-12-19T04:53:51.467" Title="RTS/CTS simultenous transmission of RTS frame" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36994" PostTypeId="2" ParentId="1438" CreationDate="2016-12-01T16:55:53.550" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;asa(config)# crypto key generate rsa general-keys modulus 2048&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have user accounts already then configure below two line 2-3.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;asa(config)# username ash password ash privi 15&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;asa(config)# enable password cisco123&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To Allow Access from inside network &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;asa(config)# ssh 0.0.0.0 0.0.0.0 inside&lt;/code&gt;   (To Allow anyone from inside)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To Allow Access from outside network &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;asa(config)# ssh 0.0.0.0 0.0.0.0 outside&lt;/code&gt;   (To Allow anyone from Outside)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the system should know where your useraccounts are:&#xA;For lookup in Local Database&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;asa(config)# aaa authentication ssh console LOCAL&lt;/code&gt;   ------   Case sensitive (&lt;code&gt;LOCAL&lt;/code&gt; must be in capital, not &lt;code&gt;Local&lt;/code&gt; or &lt;code&gt;local&lt;/code&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;code&gt;asa(config)# ssh version 2&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="32470" LastEditorUserId="8499" LastEditDate="2016-12-01T17:02:50.083" LastActivityDate="2016-12-01T17:02:50.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="36997" PostTypeId="2" ParentId="36979" CreationDate="2016-12-01T19:10:32.133" Score="1" Body="&lt;p&gt;All antennas should be upright to maintain correct polarization.  Putting antennas at a 45 angle makes them less efficient and helps no one.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-01T19:10:32.133" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="36998" PostTypeId="1" AcceptedAnswerId="36999" CreationDate="2016-12-01T19:26:53.830" Score="1" ViewCount="102" Body="&lt;p&gt;I currently have multiple servers which are all on their own separate networks (each server on a different network talking to other devices). I want to implement a common central data server which will store database backups for the SQL instances on the servers. My plan right now is to add a router to the network architecture which will allow the servers to communicate with the Central data server. In the past these servers were all on the same network which caused communication problems, so they were separated. This leads to my question: If the now &quot;isolated&quot; server networks are connected to the same router and all communicate with a central data storage unit, will this keep them &quot;isolated&quot; or will it effectively be putting all the devices back on the same network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For context, since they were networked in the past, they're all on the same subnet. The servers all communicate to field devices such as PLC's and HMI's and exist in a manufacturing environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="32475" LastActivityDate="2016-12-01T22:47:13.097" Title="If multiple PC's are communicating to a server via a router, is the individual PC network traffic isolated to the respective PC's network?" Tags="|routing|router|ip|network-access|packet-path|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="36999" PostTypeId="2" ParentId="36998" CreationDate="2016-12-01T19:38:23.920" Score="1" Body="&lt;p&gt;Routers route between networks. Each router interface is a separate network. Each router interface needs to be a different network (subnet), otherwise you will need to set up some sort of NAT for each network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I doubt you would consider your PC  to be on the same networks as Google, even though your PC contacts Google by a router connection. So, yes, your servers will be on different networks, even if those networks are connected with a router.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;It really sounds like you need to implement QoS. Without QoS, your server backup traffic will have the same priority as production traffic, and that can cause production problems. QoS is all about fairness, as you define it, and the need to separate your servers onto different networks really means you should probably redesign the network and implement a good set of QoS policies. Providing enough bandwidth, taking into account things like bandwidth oversubscription ratios, and properly sharing it, you could have a lot of servers on the same network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-01T22:47:13.097" LastActivityDate="2016-12-01T22:47:13.097" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37003" PostTypeId="2" ParentId="36987" CreationDate="2016-12-01T21:00:40.407" Score="0" Body="&lt;p&gt;Since we're talking about Cisco, there are some switches that can do NAT but all of them are really not cheap, even by Cisco standards. Better and definalely cheaper solution is to do it like most of people are doing - get a switch and a router (or some of the Cisco ISR routers that have integrated switch in them). Besides it's cheaper, you will have much more features at your disposal.&lt;/p&gt;&#xA;" OwnerUserId="2358" LastActivityDate="2016-12-01T21:00:40.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37006" PostTypeId="2" ParentId="36984" CreationDate="2016-12-02T01:19:32.990" Score="2" Body="&lt;p&gt;Yes - the BRAS is both stripping the PPP[oE] frame (...and some L2/L3 underlay information, depending on the design in use) off of frames coming from the subscriber device and is adding both the PPP[oE] header and associated L2/L3 mapping information to get packets from the Internet back to the subscriber.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Part of the process of the subscriber device logging in to the BRAS is establishing a mapping between the subscriber's assigned IP and the necessary underlay information required to get inbound packets encapsulated and on their way to the edge.  This is, in fact, a session table and it's one of the reasons why BRAS are fairly specialized devices (read: lots of state + high traffic volume).&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-02T01:19:32.990" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37009" PostTypeId="1" AcceptedAnswerId="37015" CreationDate="2016-12-02T17:26:38.790" Score="1" ViewCount="7391" Body="&lt;p&gt;Let me start by putting my issue into one sentence:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have a Catalyst 4507 and I can't log onto it using RADIUS even though the configuration is the same as a Catalyst 3850 which is working and testing RADIUS using the IOS-XE tests in the 4507 is successful. What could be the problem?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I successfully configured a Catalyst 3850 to use a Windows Server 2008 R2 NPS server for RADIUS. I mostly replicated that configuration on a Catalyst 4507 (adjusted for platform differences) and when I run &lt;code&gt;test aaa group&lt;/code&gt; on the 4507, the test succeeds. When I try to actually log on to the 4507 with an account that needs RADIUS to authenticate, it fails. It looks like the failure on logon is a timeout contacting the RADIUS server, but I can't figure out why the authentication request would work differently between the test and the actual logon.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's some config, test, and output:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Config&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show ver&#xA;Cisco IOS Software, IOS-XE Software, Catalyst 4500 L3 Switch  Software&#xA; (cat4500es8-UNIVERSALK9-M), Version 03.08.02.E RELEASE SOFTWARE (fc2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Management Interface (from which RADIUS requests must be sent):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface FastEthernet1&#xA; vrf forwarding mgmtVrf&#xA; ip address yy.yy.yy.yy 255.255.255.0&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;AAA Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show run aaa&#xA;!&#xA;aaa authentication login default local group radius&#xA;aaa authorization exec default local group radius&#xA;aaa accounting exec default start-stop group radius&#xA;aaa accounting delay-start&#xA;username XXXX privilege 15 secret 5 XXXX&#xA;!&#xA;!&#xA;radius server NPSSERVER&#xA; address ipv4 xx.xx.xx.xx auth-port 1645 acct-port 1646&#xA; key 7 XXXX&#xA;!&#xA;!&#xA;aaa group server radius RADIUSGROUP&#xA; server name NPSSERVER&#xA; ip vrf forwarding mgmtVrf&#xA; ip radius source-interface FastEthernet1&#xA;!&#xA;!&#xA;aaa new-model&#xA;aaa session-id common&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h2&gt;Tests&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Cleared counters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show aaa servers&#xA;&#xA;RADIUS: id 1, priority 1, host xx.xx.xx.xx, auth-port 1645, acct-port 1646&#xA; State: current UP, duration 2157s, previous duration 0s&#xA; Dead: total time 0s, count 13&#xA; Quarantined: No&#xA; Authen: request 0, timeouts 0, failover 0, retransmission 0&#xA;         Response: accept 0, reject 0, challenge 0&#xA;         Response: unexpected 0, server error 0, incorrect 0, time 0ms&#xA;         Transaction: success 0, failure 0&#xA;         Throttled: transaction 0, timeout 0, failure 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;RADIUS Test and Counters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#test aaa group RADIUSGROUP username@domain.com XXXXXX new-code&#xA;&#xA;User successfully authenticated&#xA;&#xA;USER ATTRIBUTES&#xA;&#xA;service-type         0   7 [NAS Prompt]&#xA;priv-lvl             0   15 (0xF)&#xA;&#xA;#show aaa servers&#xA;&#xA;RADIUS: id 1, priority 1, host xx.xx.xx.xx, auth-port 1645, acct-port 1646&#xA; State: current UP, duration 2278s, previous duration 0s&#xA; Dead: total time 0s, count 13&#xA; Quarantined: No&#xA; Authen: request 1, timeouts 0, failover 0, retransmission 0&#xA;         Response: accept 1, reject 0, challenge 0&#xA;         Response: unexpected 0, server error 0, incorrect 0, time 4ms&#xA;         Transaction: success 1, failure 0&#xA;         Throttled: transaction 0, timeout 0, failure 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Login Attempt and Counters:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;login as: username@domain.com&#xA;Using keyboard-interactive authentication.&#xA;Password:&#xA;Access denied&#xA;&#xA;&#xA;#show aaa servers&#xA;&#xA;RADIUS: id 1, priority 1, host xx.xx.xx.xx, auth-port 1645, acct-port 1646&#xA; State: current UP, duration 2436s, previous duration 0s&#xA; Dead: total time 0s, count 13&#xA; Quarantined: No&#xA; Authen: request 5, timeouts 4, failover 0, retransmission 3&#xA;         Response: accept 1, reject 0, challenge 0&#xA;         Response: unexpected 0, server error 0, incorrect 0, time 4ms&#xA;         Transaction: success 1, failure 1&#xA;         Throttled: transaction 0, timeout 0, failure 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here's the output from &lt;code&gt;debug aaa authentication&lt;/code&gt; during a failed logon attempt:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Dec  2 19:35:48.817: AAA/BIND(00000041): Bind i/f&#xA;*Dec  2 19:35:48.817: AAA/AUTHEN/LOGIN (00000041): Pick method list 'default'&#xA;*Dec  2 19:36:02.322: %RADIUS-4-RADIUS_DEAD: RADIUS server x.x.x.x:1645,1646 is not responding.&#xA;*Dec  2 19:36:02.322: %RADIUS-4-RADIUS_ALIVE: RADIUS server x.x.x.x:1645,1646 is being marked alive.&#xA;*Dec  2 19:36:14.379: AAA/AUTHEN/LOGIN (00000041): Pick method list 'default'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The logs on the NPS servers are pretty difficult to read, but I'm pretty sure they show success when I log on from the working switch, success when I test from the 4507, and no connection at all when I attempt to log on to the 4507.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Mostly) Complete config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 15.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;service password-encryption&#xA;service compress-config&#xA;!&#xA;hostname REDACTED&#xA;!&#xA;boot-start-marker&#xA;boot system flash bootflash:cat4500es8-universalk9.SPA.03.08.02.E.152-4.E2.bin&#xA;boot-end-marker&#xA;!&#xA;!&#xA;vrf definition mgmtVrf&#xA; !&#xA; address-family ipv4&#xA; exit-address-family&#xA; !&#xA; address-family ipv6&#xA; exit-address-family&#xA;!&#xA;enable secret 5 REDACTED&#xA;!&#xA;username REDACTED privilege 15 secret 5 REDACTED&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa group server radius RADIUSGROUP&#xA; server name RADIUSSERVER&#xA; ip vrf forwarding mgmtVrf&#xA; ip radius source-interface FastEthernet1&#xA;!&#xA;aaa authentication login default local group radius&#xA;aaa authorization exec default local group radius &#xA;aaa accounting delay-start&#xA;aaa accounting exec default start-stop group radius&#xA;!&#xA;!&#xA;aaa session-id common&#xA;clock timezone UTC -5 0&#xA;clock summer-time EDT recurring&#xA;!&#xA;!&#xA;udld enable&#xA;!&#xA;!&#xA;ip domain-name domain.com&#xA;ip name-server REDACTED&#xA;ip name-server REDACTED&#xA;!&#xA;!&#xA;power redundancy-mode redundant&#xA;!&#xA;spanning-tree mode rapid-pvst&#xA;spanning-tree extend system-id&#xA;spanning-tree uplinkfast&#xA;spanning-tree backbonefast&#xA;!&#xA;redundancy&#xA; mode sso&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;! ******* Port-channel interfaces redacted&#xA;!&#xA;interface FastEthernet1&#xA; vrf forwarding mgmtVrf&#xA; ip address x.x.x.x 255.255.255.0&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;! ******** Line card interfaces redacted&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan10&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED &#xA; no ip redirects&#xA;!&#xA;interface Vlan11&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED&#xA; no ip redirects&#xA;!&#xA;interface Vlan20&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED&#xA; no ip redirects&#xA;!&#xA;interface Vlan23&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED&#xA; no ip redirects&#xA;!&#xA;interface Vlan24&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED&#xA; no ip redirects&#xA;!&#xA;interface Vlan28&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED&#xA; no ip redirects&#xA;!&#xA;interface Vlan29&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED&#xA; no ip redirects&#xA;!&#xA;interface Vlan30&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED&#xA; no ip redirects&#xA;!&#xA;interface Vlan40&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED&#xA; no ip redirects&#xA;!&#xA;interface Vlan60&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED&#xA; no ip redirects&#xA;!&#xA;interface Vlan100&#xA; description REDACTED&#xA; ip address REDACTED&#xA; ip helper-address REDACTED&#xA; no ip redirects&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 REDACTED&#xA;ip route vrf mgmtVrf 0.0.0.0 0.0.0.0 REDACTED&#xA;ip ssh version 2&#xA;!&#xA;ip access-list extended snmp-access&#xA; permit ip host REDACTED any&#xA;!&#xA;ip radius source-interface FastEthernet1 &#xA;!&#xA;snmp-server community public RO&#xA;snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart&#xA;snmp-server enable traps tty&#xA;snmp-server enable traps cpu threshold&#xA;snmp-server enable traps fru-ctrl&#xA;snmp-server enable traps entity&#xA;snmp-server enable traps flash insertion removal&#xA;snmp-server enable traps vlancreate&#xA;snmp-server enable traps vlandelete&#xA;snmp-server enable traps envmon fan shutdown supply temperature status&#xA;snmp-server enable traps port-security&#xA;snmp-server enable traps config&#xA;snmp-server enable traps syslog&#xA;snmp-server enable traps vlan-membership&#xA;!&#xA;!&#xA;radius server RADIUSSERVER&#xA; address ipv4 REDACTED auth-port 1645 acct-port 1646&#xA; key 7 REDACTED&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; exec-timeout 15 0&#xA;line vty 5 15&#xA;!&#xA;ntp server REDACTED&#xA;ntp server REDACTED&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4889" LastEditorUserId="4889" LastEditDate="2016-12-02T19:43:30.580" LastActivityDate="2016-12-02T20:39:21.523" Title="RADIUS test works but actual logon fails" Tags="|cisco-catalyst|radius|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="37010" PostTypeId="1" CreationDate="2016-12-02T17:42:39.850" Score="1" ViewCount="1882" Body="&lt;p&gt;I have a network that resembles this&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CUSTOMER - BT - SPRINT&#xA;           BT - CISCO&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;customer loopback 192.168.10.1&#xA;customer loopback1 192.168.1.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;BT loopback 192.168.50.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;CISCO loopback 192.168.100.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;SPRINT loopback 192.168.150.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;customer is connected to BT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BT is connected to SPRINT and CISCO&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using Community values and I want to block the advertisement of &lt;code&gt;192.168.1.1/24&lt;/code&gt; to SPRINT but allow it to appear in Cisco&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was my failed attempt:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CUSTOMER:&#xA;ip prefix-list ROUTE 192.168.1.0/24&#xA;neighbor 2.2.2.2 (bt) route-map BLOCKSPRINT out&#xA;neighbor 2.2.2.2 send-community&#xA;&#xA;route-map BLOCKSPRINT p 10&#xA;match ip add prefix-list ROUTE&#xA;set community 500:500&#xA;route-map BLOCKSPRINT p 20&#xA;&#xA;BT&#xA;ip prefix-list CISCO 192.168.150.0/24&#xA;ip community-list 1 500:500 &#xA;neighbor 1.1.1.1 Peer-CUST in&#xA;neighbor 1.1.1.1 send-communities&#xA;neighbor 3.3.3.3 send-communities&#xA;&#xA;route-map Peer-CUST p 10&#xA;match ip add prefix-list CISCO&#xA;match community 1&#xA;set community no-advertise&#xA;route-map Peer-CUST p 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The address still shows up on the SPRINT router.&lt;/p&gt;&#xA;" OwnerUserId="15099" LastEditorUserId="8499" LastEditDate="2019-01-05T00:09:18.017" LastActivityDate="2019-01-05T00:09:18.017" Title="block route being advertised to SP" Tags="|routing|bgp|isp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37011" PostTypeId="2" ParentId="37010" CreationDate="2016-12-02T18:18:32.330" Score="1" Body="&lt;p&gt;You have BT sending the route to Sprint with the &lt;code&gt;no-advertise&lt;/code&gt; community so that the Sprint router will not advertise it. BT needs to filter the prefix to Sprint. Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;neighbor 3.3.3.3 distribute-list 1 out &#xA;!&#xA;access-list 1 deny 192.168.1.1 0.0.0.255&#xA;access-list 1 permit any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;neighbor 3.3.3.3 route-map BLOCKSPRINT out &#xA;!&#xA;access-list 1 deny 192.168.1.1 0.0.0.255&#xA;access-list 1 permit any&#xA;!&#xA;route-map BLOCKSPRINT permit 10 &#xA; match ip address 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-02T18:18:32.330" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37012" PostTypeId="1" AcceptedAnswerId="37013" CreationDate="2016-12-02T18:54:07.637" Score="3" ViewCount="2465" Body="&lt;p&gt;I have read that encapsulation takes place down the layers while decapsulation takes place up the layers. In essence, the encapsulation starts at Application layer all the way upto Physical layer.&#xA;Assume we have a sender A and receiver B.Sender A wants to http to a server B.&#xA;So for the encapsulation down the layers on A side we would have,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Application(http)-Presentation-Session-Transport(TCP port 80)-Network(IP address of A)-Data link(Mac)-Physical(Bits 0 and 1).&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From above, we can say that PDU(Protocol data unit) of upper layer(say Network Layer) becomes the data of the lower layer(say Data link layer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially,(Data+control Info )of Network layer &lt;strong&gt;=&lt;/strong&gt;( Data ) of data link layer&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now coming to the receiver side B(decapsulation process)&#xA;Step 1: The Physical layer header is stripped off&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 2: The data link layer header is stripped off&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 3: The network layer header is stripped off and so on&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1: is the above understanding correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2: I am getting confused as to why data link layer info is stripped off first? I mean, when we do ARP, we first look at IP address(layer 3) and request for mac address(layer 2 info).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that there is a value called Ethertype, that tells what upper layer protocol is being used(e.g mpls or IPv4 or IPv6) ?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="8499" LastEditDate="2016-12-02T23:09:30.200" LastActivityDate="2018-07-09T05:37:39.293" Title="Encapsulation and decapsulation basics for OSI layer" Tags="|layer2|osi|layer3|layer1|layer4|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37013" PostTypeId="2" ParentId="37012" CreationDate="2016-12-02T19:16:34.913" Score="3" Body="&lt;p&gt;You seem to have the general idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, there really is no Physical Layer header. The Physical Layer simply takes what the Data-Link Layer gives it, and it encodes the Data-Link frame (encoding) for the interface and places that on the &quot;wire&quot; (signalling), or it performs the opposite when receiving data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When layer-3 sends a packet to layer-2, layer-2 needs to encapsulate that with a layer-2 header. Part of the layer-2 header may include a MAC address for layer-2 protocols that use MAC addresses (not all do, and of those that do, some use 48-bit MAC addresses, and some use 64-bit MAC addresses).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to put a destination MAC address in the layer-2 frame, the destination layer-3 address must be &lt;em&gt;resolved&lt;/em&gt; to a layer-2 address. Layer-2 needs the destination layer-2 MAC address in order to build the layer-2 frame to encapsulate the layer-3 packet. That is where ARP (Address &lt;em&gt;Resolution&lt;/em&gt; Protocol) comes in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP has to do with data leaving the host, not coming into the host where the headers are stripped. Depending on the network stack implementation, as a layer-2 frame come into a host, the MAC address may get saved in the host's ARP cache as the frame is stripped from the packet. Layer-2 will inspect the layer-2 frame to determine to which layer-3 protocol in the network stack the frame payload (layer-3 packet) should be sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ethertype field is a field in ethernet frame headers. Other layer-2 protocols have other ways of doing this. Remember, ethernet may be the most used layer-2 protocol, but it is not the only layer-2 protocol, and each have their own frame headers. Layer-3 protocols can have the the same type of thing. For instance, IPv4 has the Protocol field, and IPv6 has the Next Header field, to tell layer-3 to which layer-4 protocol the payload of the layer-3 packet should be sent.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-02T19:23:09.803" LastActivityDate="2016-12-02T19:23:09.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37015" PostTypeId="2" ParentId="37009" CreationDate="2016-12-02T20:39:21.523" Score="3" Body="&lt;p&gt;The mistake/oversight in my config is here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication login default local group radius&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Using the &lt;code&gt;radius&lt;/code&gt; keyword at the end instead of the explicit name of the RADIUS group defined elsewhere means the AAA system does not correctly use that RADIUS group. The correct AAA configuration command is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication login default local group RADIUSGROUPNAME&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Where &lt;code&gt;RADIUSGROUPNAME&lt;/code&gt; matches with the keyword chosen in the first line of the following configuration commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa group server radius RADIUSGROUPNAME&#xA; server name NPSSERVER&#xA; ip vrf forwarding mgmtVrf&#xA; ip radius source-interface FastEthernet1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason why the test was successful is because I was specifying the RADIUS group name in the test, like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#test aaa group RADIUSGROUPNAME username@domain.com XXXXXX new-code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running the test as follows would fail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#test aaa group radius username@domain.com XXXXXX new-code&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4889" LastActivityDate="2016-12-02T20:39:21.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37017" PostTypeId="5" CreationDate="2016-12-02T23:14:39.057" Score="0" Body="&lt;p&gt;The OSI layer-4 is the transport layer, which is used by applications to transfer data from one application to another application. It includes multiple protocols, such as UDP, TCP, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This layer is the highest layer in the OSI model that is on-topic for Network Engineering.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-02T23:14:39.057" LastActivityDate="2016-12-02T23:14:39.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37018" PostTypeId="4" CreationDate="2016-12-02T23:14:39.057" Score="0" Body="For questions about OSI Layer 4 (transport layer)." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-02T23:14:39.057" LastActivityDate="2016-12-02T23:14:39.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37020" PostTypeId="2" ParentId="37010" CreationDate="2016-12-03T05:20:49.997" Score="1" Body="&lt;p&gt;So a couple of points to this-&lt;/p&gt;&#xA;&lt;p&gt;1.) NO_ADVERTISE is intended to prevent a given BGP speaker from propagating the route &lt;strong&gt;any&lt;/strong&gt; further.  So in this case adding this attribute to given route advertised to a peer will actually prevent the route from being pushed to the remainder of the carrier's network.  You might want to consider NO_EXPORT, which is intended to restrict the propagation of a given prefix beyond a confederation (or an entire AS if confederations aren't in use).  See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1997&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1997&lt;/a&gt; for details on the behaviors of communities in general and well-known communities in particular.&lt;/p&gt;&#xA;&lt;p&gt;2.) The well-known communities don't -have- to be honored but, in general, they are by default in most implementations (..unless you choose to explicitly strip these values).  They tend to be all-or-nothing in nature, though - so, for example, signify that a given route can't propagate past the immediate peer router or past the peer router's ASN.  In this case putting NO_EXPORT on a route would prevent BT from advertising to Cisco &lt;em&gt;or&lt;/em&gt; Sprint, but would allow it to be present throughout any other routers inside the BT ASN.&lt;/p&gt;&#xA;&lt;p&gt;3.) In this case the owners of the BT and Customer routers would have to agree upon a community value and its special meaning if you want the route to be selectively advertised (or not specifically not advertised) to a given upstream peer.  Your carrier might also append communities indicating whether a given route is from one of their other direct customers or from an upstream transit (this is a handy way to pare down table sizes).  Apart from the well-known values mentioned above everything else is potentially up for grabs and, also as mentioned, there's no standard guarantee (beyond what's negotiated with the carrier) of what behavior corresponds to what community.  There's also no assurance that any carrier will preserve appended communities as prefixes cross their network.&lt;/p&gt;&#xA;&lt;p&gt;So let's take a fairly simple example.  On the BT router (let's call it ASN2856) we'll set up a filter on each of its peers to CUSTOMER (which we'll call ASN65400), Sprint (ASN1239) and Cisco (ASN109) such that only routes with xxx:ASN will be permitted.  As such, if we put 65400:109 on the route but &lt;strong&gt;not&lt;/strong&gt; 65400:1239 then the route will be allowed to Cisco but not Sprint.  If &lt;strong&gt;both&lt;/strong&gt; 65400:1239 &lt;strong&gt;and&lt;/strong&gt; 65400:109 are appended to a prefix the route will go to both.  If neither, then the route will stay inside ASN2856.&lt;/p&gt;&#xA;&lt;p&gt;So on BT we'd have something like&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip community-list to-cisco permit .*:109&#xA;ip community-list to-sprint permit .*:1239&#xA;ip community-list to-customer permit .*:65400&#xA;&#xA;route-map CISCO-PEER-OUT permit 10&#xA;   match community to-cisco&#xA;   set community none&#xA;route-map CISCO-PEER-OUT deny 20&#xA;&#xA;route-map SPRINT-PEER-OUT permit 10&#xA;  match community to-sprint&#xA;  set community none&#xA;route-map SPRINT-PEER-OUT deny 20&#xA;&#xA;route-map CUSTOMER-PEER-OUT permit 10&#xA;  match community to-customer&#xA;  set community none&#xA;route-map CUSTOMER-PEER-OUT deny 20&#xA;&#xA;! Start the BGP section&#xA;&#xA;neighbor 1.1.1.1 send-communities&#xA;neighbor 1.1.1.1 remote-as 109&#xA;neighbor 1.1.1.1 route-map CISCO-PEER-OUT out&#xA;&#xA;neighbor 2.2.2.2 send-communities&#xA;neighbor 2.2.2.2 remote-as 1239&#xA;neighbor 2.2.2.2 route-map SPRINT-PEER-OUT out&#xA;&#xA;neighbor 3.3.3.3 send-communities&#xA;neighbor 3.3.3.3 remote-as 65400&#xA;neighbor 3.3.3.3 route-map CUSTOMER-PEER-OUT out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;On the CUSTOMER router you'd have something like this&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;ip prefix-list ROUTES-FOR-CISCO permit 192.168.1.0/24&#xA;&#xA;route-map MARK-ROUTE permit 10&#xA;   match ip address prefix-list ROUTES-FOR-CISCO&#xA;   set community 65400:109&#xA;route-map MARK-ROUTE permit 20&#xA;   match any&#xA;   set community 65400:109 65400:1239&#xA;&#xA;!BGP section&#xA;&#xA;neighbor 3.3.3.4 remote-as 2856&#xA;neighbor 3.3.3.4 send-community&#xA;neighbor 3.3.3.4 route-map MARK-ROUTE out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;This would set the prefix 192.168.1.0/24 with a community of 65400:109, which would allow the route to be sent &lt;strong&gt;only&lt;/strong&gt; to ASN109.  All other routes would have both 65400:109 and 65400:1239 - which would allow said routes to go to either carrier.  On the BT router I've also set it to clear all communities on routes sent to peers - so, for example, the CISCO peer wouldn't see the 65400:109 community you included.&lt;/p&gt;&#xA;&lt;p&gt;In practice the communities probably wouldn't be structured quite like this, of course, but this should hopefully give you a taste of what's possible.&lt;/p&gt;&#xA;&lt;p&gt;Hope this helps-&lt;/p&gt;&#xA;" OwnerUserId="1172" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-12-03T05:20:49.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37021" PostTypeId="1" AcceptedAnswerId="37023" CreationDate="2016-12-03T05:57:03.980" Score="2" ViewCount="1149" Body="&lt;p&gt;Let’s say I have two networking devices (either L2 switches, L3 switches, or routers), and the two devices have two ethernet connections between them: port 1 to port 1, and port 2 to port 2. If one of the connections is broken, I want the traffic to fail over with the lowest possible latency (less than 1ms) to the other connection. What method of failover would result in the lowest possible latency failover? A layer 2 protocol like RSTP, a layer 3 protocol like OSPF with hello timers tuned waaaay down, or something else?&lt;/p&gt;&#xA;" OwnerUserId="17050" LastEditorUserId="8499" LastEditDate="2018-03-07T20:16:01.170" LastActivityDate="2018-03-07T20:16:01.170" Title="Lowest Possible Failover Latency" Tags="|cisco|layer2|layer3|failover|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37022" PostTypeId="2" ParentId="37021" CreationDate="2016-12-03T06:01:13.837" Score="2" Body="&lt;p&gt;STP, including RSTP will fail over the slowest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing protocols come in second place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By far, the fastest failover is a port channel. As long as even one link in a port channel is up, the port channel remains up. Port channels can either be layer-2 or layer-3 port channels, but the net effect is the same.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-03T06:01:13.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37023" PostTypeId="2" ParentId="37021" CreationDate="2016-12-03T06:38:05.223" Score="3" Body="&lt;p&gt;Failover time is going to be dictated by two chief factors:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) Time to detection - How quickly the connected systems can determine a link has failed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) Time to convergence - Once the failure is detected how quickly traffic can be redirected to a working path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Honestly the first item (failure detection) is harder to get right and ends up adding the most time to the process.  Loss of physical link is clearly an easy indicator but it's important to remember that this may only be seen in one direction (ex: one strand of fiber fails, but not the other) and that any kind of intervening repeater may actually mask the behavior. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To address this the best mechanisms tend to use some kind of lightweight echo mechanism - constant OAM traffic of some sort moving back and forth between connected peers to validate that data is actually passing.  Synchronous communication links tend to incorporate this into the basic protocol pretty effectively (SONET being a great example) but we've had to graft technologies on to accommodate higher-level protocols - either in the form of protocol hellos/keep-alives (as found in routing protocols) or, more recently, with lightweight protocols like bidirectional forwarding detection (BFD), which was mentioned in a recent question.  The idea with bfd is the use of a common keepalive mechanism (again - very lightweight) operating at a high frequency (usually in the low hundreds of milliseconds), often with hardware assist.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second part (reconvergence) has a lot of other issues associated but its difficulty tends to be directly proportionate to the width of the network.  For example - reconverging connectivity between two switches or routers with a pair of redundant links is trivial.  Finding an alternate path on a complex international network with thousands of network devices?  A whole other ballgame.  This, incidentally, is where SONET's gold-standard of 50ms comes from - as APS calls for each node to have an alternate path already hot and ready to receive failed traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - to answer the question... The &lt;strong&gt;best&lt;/strong&gt; possible case is one where a link fails quickly and completely (i.e. someone snips a cable).  This delivers immediate results to both connected devices and, in practice, you're not going to see a whole lot of difference between removing one of a pair of equal-cost routes from an L3 forwarding table versus updating the hash tables in an L2 port channel.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said - if you're running an L2 port channel without a protocol to detect a link failure and one link happens to go unidirectional then you might well hit a situation where some portion of traffic is silently dropped on an &lt;strong&gt;indefinite&lt;/strong&gt; basis (i.e. no recovery).  If you're relying on LACP or UDLD to pick up this condition then it may take ones- or tens- of seconds to detect (depending on how the protocols are configured).  A stock configuration of OSPF is going to take 40 seconds (4 consecutive losses of a 10 second keepalive) to mark a link as failed.  A vanilla BGP connection on some implementations could easily be 3+ minutes.  If you add BFD to any of these protocols (LACP / OSPF / BGP) then detection time could be as quick as ~150-200 milliseconds but in actual practice is probably more like 300ms in the real world.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is 1ms consistently possible under all conditions on common hardware?  Probably not, unless you've got hardware capable of reliably sending, receiving and processing OA&amp;amp;M traffic at double-digit nanosecond precision (and there is a whole rat's nest of issues keeping such mechanisms stable).  The real question tends to be figuring out the convergence speed that makes the most sense given the protocols running over the link.  For standard Ethernet and IP getting in the &amp;lt; 250-300 ms range (from actual failure to full recovery) for &lt;em&gt;any&lt;/em&gt; circumstances (with low double digits under common circumstances) has proven more than sufficient. &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-03T06:38:05.223" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37025" PostTypeId="1" CreationDate="2016-12-03T12:37:15.963" Score="2" ViewCount="5221" Body="&lt;p&gt;I'm getting a little confused in understanding the differences in IPSec in IPv4 and IPv6...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are the principles of IPsec the same in v6, but instead of it being optional it is now mandatory for it to be included? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is IPSec &quot;built in&quot; to v6 or does it need to be included through the extension headers? (Authentication header + Encapsulation Security Payload)&lt;/p&gt;&#xA;" OwnerUserId="25289" LastEditorUserId="8499" LastEditDate="2018-03-12T00:27:45.637" LastActivityDate="2018-09-11T05:40:35.563" Title="IPSec in IPv4 and IPv6" Tags="|ipv4|ip|ipv6|ipsec|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37027" PostTypeId="2" ParentId="37025" CreationDate="2016-12-03T17:57:37.963" Score="2" Body="&lt;p&gt;IPsec was originally planned as part of the next-generation IP (IPv6), but security quickly became very important, and IPsec was designed as the Internet security protocol for both IPv4 and IPv6 (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1825&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1825, Security Architecture for the Internet Protocol&lt;/a&gt;, later obsoleted by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2401&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2401, Security Architecture for the Internet Protocol&lt;/a&gt;, later obsoleted by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4301&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4301, Security Architecture for the Internet Protocol&lt;/a&gt;). Since IPv4 was already defined, IPsec is basically bolted on (IPSec packets are payload), but IPv6 was still being defined, and IPsec is a integral part of IPv6. From the beginning, IPv6 has had the AH and ESP extension headers, something not really possible with IPv4.&lt;/p&gt;&#xA;&lt;p&gt;It took longer than originally planned for IPv6 to start being used, and nodes began to use IPsec in applications for IPv4. The way applications use IPsec with IPv4 (simply as payload for IPv4 or IPv6 packets, or as tunnels where the entire packet is encrypted as payload of the encapsulating packet) can also be used with IPv6; it is really network protocol independent.&lt;/p&gt;&#xA;&lt;p&gt;As IPv6 came along, the way IPsec is implemented has not really changed, and the implementation using extension headers hasn't really materialized. One exception is OSPFv3. As IPv6 overtakes IPv4, we may see the way IPsec (or its descendants) used move to IPv6 packet headers, or it may remain implemented as it is today.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-12-03T17:57:37.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37031" PostTypeId="1" AcceptedAnswerId="37035" CreationDate="2016-12-03T22:25:24.830" Score="1" ViewCount="771" Body="&lt;p&gt;We have a number of branch offices consisting of one or more 2960 series switches and a 55xx series firewall. The switches are usually stacked, and have at least IP Base feature sets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most offices, the switches are setup to route, with VLAN interfaces that act as default gateways for the local VLANs. The ASA then has a separate IP address on the inside interface connected to the switches, and packets are routed from the VLAN interfaces on the switches to the inside interface. From there, it’s either NAT out to the internet, or site-to-site VPN back to one of the main sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are about to setup a new branch office, with the same 2960 &amp;amp; ASA setup, and I wanted to get some advice on recommended setups.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Should we stick with what we have now? I like having the switches&#xA;take some of the routing load, particularly for local destinations,&#xA;however this setup seems a little messy, and the separate IP address&#xA;on the inside interface requires workarounds for certain things&#xA;(such as NAT).&lt;/li&gt;&#xA;&lt;li&gt;Should we have the ASA handle routing, setup use a&#xA;trunk link from the switches to the ASA, then sub-interfaces on the&#xA;inside interface of the ASA for each VLAN (I believe we can also&#xA;setup Etherchannel for this setup as per&#xA;&lt;a href=&quot;http://www.amirmontazeri.com/?p=18&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.amirmontazeri.com/?p=18&lt;/a&gt;).&lt;/li&gt;&#xA;&lt;li&gt;Finally, is it possible to&#xA;trunk the VLANs to the ASA, have the inside interface as switched&#xA;port, and have routing handled on the ASA by VLAN interfaces? I’m&#xA;sure I’ve seen this example in early CCNA-S security days, however&#xA;I’m not sure if it’s still possible/current/recommended.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for the response and your insightful feedback. The points about letting the switch handle local routing makes sense, are something I'd thought about a bit already, and would be good to maintain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two follow-up questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, we have various VLANs defined locally for user, server, management, printers, corporate and guest WiFi, etc. If we did keep the existing option with the L3 switches handling routing, and the firewall acting as a next routing hop, what network segment would we assign the IP address of the inside interface on the firewall (and in turn this next routing hop)? Would it be best to subnet one of the existing network segments/VLANs (say, the manegement network, as a /24 subnet this doesn't need 254 addresses), and create a new segment for the firewall IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second of all, if we did stick with the switches handling routing, would there be any way to have an etherchannel setup from the switches to the firewall? From the firewall side, we can configure L3 etherchannel, however can I have the firewall side of that L3 (inside interface of the firewall, the next routing hop), with the other end L2, configured as a trunk with whatever VLANs I wanted to allow external to the network? I should also add, the switches will be stacked.&lt;/p&gt;&#xA;" OwnerUserId="32521" LastEditorUserId="8499" LastEditDate="2016-12-04T18:49:42.380" LastActivityDate="2016-12-04T22:29:27.693" Title="Branch Office Config with ASA and L3 Switch" Tags="|routing|cisco-asa|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37032" PostTypeId="1" AcceptedAnswerId="37034" CreationDate="2016-12-03T22:36:09.657" Score="1" ViewCount="274" Body="&lt;p&gt;So here's my understanding of ARP spoofing. I'm malicious, and I want you to think I'm the gateway. So when you ask &quot;if you're the gateway, please reply with your MAC&quot;, I reply, &quot;I'm the gateway, here's my MAC&quot;. Right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I don't get is, why can't the gateway just block those replies? Because the gateway knows that it is the gateway. Which means other computers aren't the gateway. Which means if someone else says they're the gateway, they must be lying. So why would the gateway forward their lies?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So two questions. First, if this isn't a thing, why isn't this a thing? Second, if this is a thing, why isn't it widespread? Because I know ARP spoofing works on most home/small business routers, at least. &lt;/p&gt;&#xA;" OwnerUserId="32200" LastActivityDate="2016-12-03T23:40:20.903" Title="Why can't the gateway block fake ARP replies?" Tags="|lan|arp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37033" PostTypeId="2" ParentId="37032" CreationDate="2016-12-03T23:18:38.747" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So when you ask &quot;if you're the gateway, please reply with your MAC&quot;, I reply, &quot;I'm the gateway, here's my MAC&quot;. Right? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Correct.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;So why would the gateway forward their lies?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It does not. ARP traffic stays within a broadcast domain, so it won't pass the gateway, it's all switched, not routed.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Second, if this is a thing, why isn't it widespread?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what makes you think it's not (and I'm also not sure if it is or is not), but the main reason is that to do ARP spoofing, you need to be in the same layer 2 broadcast domain, which makes it hard(er) to do remotely.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2016-12-03T23:18:38.747" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37034" PostTypeId="2" ParentId="37032" CreationDate="2016-12-03T23:22:04.010" Score="2" Body="&lt;p&gt;First off - it's certainly a thing.  ARP was never intended to be a secure protocol and is utterly distributed in operation.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The gateway in a given subnet isn't special - it's just another host with an IP address and an associated MAC.  Barring any special functional/security measures, the L2 environment is going to flood every ARP request to every host in the broadcast domain and, in turn, is going to also flood any ARP responses - which, unfortunately, could include a spoof. In short, the gateway is just another host answering ARP queries and has nothing to do with their distribution or validation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why isn't this more common?  The first reason is that competing ARP responses are going to end up causing end hosts to just lose connectivity as often as cleanly hijacking the gateway.  It's basically a duplicate IP, after all.  The second reason is that, well, it isn't &lt;em&gt;that&lt;/em&gt; uncommon as an accidental misconfiguration but it tends to be so blindingly obvious as to be not all that terribly effective as anything other than an annoyance.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT (to answer question in comments about hosts losing connectivity):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So let's say the gateway is at 192.168.1.1 with a MAC of aaaa.bbbb.cccc.  Under normal circumstances whenever a host ARP's for its gateway it will send a message saying &quot;Who has 192.168.1.1, tell xxx&quot; and the router responds with &quot;192.168.1.1 is at aaaa.bbbb.cccc&quot;.  When an ARP &lt;em&gt;spoof&lt;/em&gt; occurs the same request (&quot;who has 192.168.1.1, tell xxx&quot;) will be met with &lt;strong&gt;two&lt;/strong&gt; responses - one being the correct one (aaaa.bbbb.cccc) and the other being the spoof (say dddd.eeee.ffff).  For the hosts listening for this information they'll take the first response they see and in practice it's the luck of the draw which response (fake or real) shows up in what order and, as such, it's pretty likely that the various hosts on the subnet are going to be churning their ARP tables between the real and fake gateways.  This is going to manifest as inconsistent connectivity problems (ARP changes aren't instantaneous on the end hosts) as well as a slew of log messages about duplicate IP's on the subnet.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastEditorUserId="1172" LastEditDate="2016-12-03T23:40:20.903" LastActivityDate="2016-12-03T23:40:20.903" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37035" PostTypeId="2" ParentId="37031" CreationDate="2016-12-03T23:30:37.943" Score="1" Body="&lt;p&gt;This question is kind of opinion-based, but I'll take a crack-&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) The design you have is fine.  Unless there's some kind of compelling functional problem I wouldn't change it just for the sake of changing it.  If anything I tend to see folks moving &lt;em&gt;from&lt;/em&gt; the design you're asking about &lt;em&gt;to&lt;/em&gt; what you have now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) In general I tend to think it makes a lot of sense to the let the switches handle any kind of local routing.  It has a bunch of advantages - better performance for local traffic, separation of configuration/fault domains (FW issue doesn't cause everything to die, local issues within a subnet don't hit the firewall) and the ability to add additional firewalls/gateways to provide redundancy/traffic controls without changing end-host configurations or local site policies. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.) It's possible to trunk the VLAN's directly to the firewall but I don't think it's a better design.  You're trading the determinism, scalability and clean fault tolerance of an L3 design for one where you'll need to engineer all of this at L2.  Along similar lines you &lt;strong&gt;can&lt;/strong&gt; run a aggregated link (i.e. etherchannel) into the ASA but with those 2960's you'll end up with all of the connectivity run through a single switch.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-03T23:30:37.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37036" PostTypeId="1" AcceptedAnswerId="39490" CreationDate="2016-12-04T01:31:16.710" Score="3" ViewCount="1016" Body="&lt;p&gt;Networking community,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;:&lt;br&gt;&#xA;How do you disable IGMP-snooping on virtual nic macvtap?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Background:&lt;/strong&gt;&#xA;We have noticed that Juniper vSRX 15.1X49-D60 (Running on Ubuntu 16.04LTS Server KVM) is constantly reforming the neighbor relationships (~ ever 40 seconds) when connected to *any physical router (Juniper or Cisco).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have narrowed this down to fact that 'igmp-snooping' needs to be disabled on the virtual nic &quot;macvtap.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our temporary work-around for this is to set the virtual interfaces to 'promiscuous' mode, however this is not preferable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To diagnose this issue, we have three instances of virtual SRX running on Ubuntu 16.04 KVM with a p2p connection to a physical Cisco SRX240 and Cisco 3750G (configured for routing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Attached is a log-adjacency from the Cisco router and a pcap from the virtual srx.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all in advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/U5pAI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/U5pAI.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KT6MU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KT6MU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23081" LastEditorUserId="8499" LastEditDate="2018-03-19T15:47:29.807" LastActivityDate="2018-03-19T15:47:29.807" Title="How do you disable IGMP-snooping on virtual nic macvtap" Tags="|juniper|multicast|juniper-srx|virtual|igmp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37038" PostTypeId="2" ParentId="37036" CreationDate="2016-12-04T03:26:42.207" Score="4" Body="&lt;p&gt;This is actually a known issue and there are a couple of ways to fix it.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best one is actually to edit the XML definition for the libvirt network and add &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;trustGuestRxFilters=yes&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;to the opening network definition stanza.  The default is &quot;no&quot; - which, unfortunately, breaks both IPv6 and multicast for IPv4.  This is actually laid out in a &lt;a href=&quot;https://bugzilla.redhat.com/show_bug.cgi?id=1035253#c15&quot; rel=&quot;nofollow noreferrer&quot;&gt;RedHat Bug Report&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a good &lt;a href=&quot;https://libvirt.org/formatnetwork.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;reference&lt;/a&gt; on the format that even includes the description.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other option is instead of setting promiscuous mode (which brings with it other issues) you can set the macvtap interface to support multicast with the command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip link set dev macvtap*n* allmulticast on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some folks have scripted this such that all the &lt;em&gt;macvtap&lt;/em&gt; interfaces are set as such during initial setup and some integrate at other points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps-&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-04T03:26:42.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37039" PostTypeId="1" CreationDate="2016-12-04T03:28:16.840" Score="3" ViewCount="650" Body="&lt;p&gt;We've been having an issue at the office with our Cisco CME. Here's the situation.&lt;br /&gt;&#xA;Phone A (outside line) dials into the main line and after ~three rings the call is huntstopped to four other phones. Phone X answers the incoming call from Phone A and communication can commence, no problems. We will call this the &amp;quot;ORIGINAL CALL&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Then&lt;/em&gt; Phone B (outside line) dials into the main line and again after ~three rings the call is hunstopped to four other phones. Phone Y tries to answer the incoming call from Phone B but the call is dropped on Phone Y whereas on Phone B the call continues to ring. The phone call from Phone B is actually left in limbo and so long as the ORIGINAL CALL is still in session, the connection to Phone B can never be established and Phone B must terminate their call.&lt;/p&gt;&#xA;&lt;p&gt;Why is it that when Phone Y or any phone for that matter tries to answer the phone call from Phone B, the call is never connected?&lt;/p&gt;&#xA;&lt;p&gt;Please see the router config below for reference. I thought perhaps this had something to do with the &lt;code&gt;huntstop channel&lt;/code&gt; but that is wrong. Maybe this has something to do with the call pickup configuration but I'm not quite sure.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 22166 bytes&#xA;!&#xA;! Last configuration change at 19:05:14 PST Sat Dec 3 2016&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Cisco2811&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 SOMESUPERSECRETHASH&#xA;enable password THISISTHEENABLEPASSWORD&#xA;!&#xA;no aaa new-model&#xA;!&#xA;resource policy&#xA;!&#xA;clock timezone PST -8&#xA;clock summer-time PST recurring&#xA;!&#xA;!&#xA;ip cef&#xA;no ip dhcp use vrf connected&#xA;ip dhcp excluded-address 10.10.10.1 10.10.10.10&#xA;!&#xA;ip dhcp pool phone&#xA;   network 10.10.10.0 255.255.255.0&#xA;   default-router 10.10.10.1&#xA;   option 150 ip 10.10.10.1&#xA;!&#xA;!&#xA;ip ftp username supersecretusername&#xA;ip ftp password supersecretpassword&#xA;no ip domain lookup&#xA;ip domain name Cisco2811&#xA;ip name-server 64.2.21.107&#xA;ip name-server 64.2.21.213&#xA;ip ssh time-out 30&#xA;ip ssh version 2&#xA;!&#xA;!&#xA;!&#xA;voice-card 0&#xA; no dspfarm&#xA;!&#xA;!&#xA;!&#xA;voice service voip&#xA; allow-connections h323 to h323&#xA; allow-connections h323 to sip&#xA; allow-connections sip to h323&#xA; allow-connections sip to sip&#xA; supplementary-service h450.12&#xA; h323&#xA; sip&#xA;  registrar server expires max 3600 min 3600&#xA;!&#xA;!&#xA;voice class codec 1&#xA; codec preference 1 g711ulaw&#xA;!&#xA;!&#xA;voice register global&#xA; max-dn 144&#xA; max-pool 36&#xA;!&#xA;!&#xA;voice translation-rule 9&#xA; rule 1 /^911$/ /911/&#xA; rule 2 /^9\(.*\)/ /\1/&#xA;!&#xA;!&#xA;username admin privilege 15 secret 5 supersecret&#xA;!&#xA;!&#xA;class-map match-all L3-to-L2_VoIP-Cntrl&#xA; match ip dscp af31&#xA;class-map match-all L3-to-L2_VoIP-RTP&#xA; match ip dscp ef&#xA;class-map match-all SIP&#xA; match protocol sip&#xA;class-map match-all RTP&#xA; match protocol rtp&#xA;!&#xA;!&#xA;policy-map EthOut&#xA; class RTP&#xA;policy-map output-L3-to-L2&#xA; class L3-to-L2_VoIP-RTP&#xA;  set cos 5&#xA; class L3-to-L2_VoIP-Cntrl&#xA;  set cos 3&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 10.1.10.2 255.255.255.0&#xA;!&#xA;interface FastEthernet0/0&#xA; description ** DHCP Client mode **&#xA; ip address dhcp&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Service-Engine0/0&#xA; ip unnumbered Loopback0&#xA; service-module ip address 10.1.10.1 255.255.255.0&#xA; service-module ip default-gateway 10.1.10.2&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; no ip mroute-cache&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1.1&#xA; description ** Data VLAN **&#xA; encapsulation dot1Q 1 native&#xA; ip address 192.168.1.2 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA;!&#xA;interface FastEthernet0/1.2&#xA; description ** Voice VLAN **&#xA; encapsulation dot1Q 2&#xA; ip address 10.10.10.1 255.255.255.0&#xA; service-policy output output-L3-to-L2&#xA;!&#xA;ip route 10.1.10.1 255.255.255.255 Service-Engine0/0&#xA;!&#xA;!&#xA;ip http server&#xA;ip http authentication local&#xA;no ip http secure-server&#xA;ip http path flash:&#xA;ip nat inside source list 1 interface FastEthernet0/0 overload&#xA;!&#xA;access-list 1 remark SDM_ACL Category=2&#xA;access-list 1 permit 192.168.10.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;tftp-server flash:P0030702T023.loads&#xA;tftp-server flash:P0030702T023.sb2&#xA;tftp-server flash:P0030702T023.sbn&#xA;tftp-server flash:P0030702T023.bin&#xA;tftp-server flash:CP7902080001SCCP051117A.sbin&#xA;tftp-server flash:Analog1.raw&#xA;tftp-server flash:Analog2.raw&#xA;! the rest of the sounds truncated&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;voice-port 0/0/0&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/1&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/2&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/0/3&#xA; connection plar opx 2000&#xA; caller-id enable&#xA;!&#xA;voice-port 0/1/0&#xA; auto-cut-through&#xA; operation 4-wire&#xA; type 5&#xA; signal immediate&#xA; description Overhead Paging Port 0&#xA;!&#xA;voice-port 0/1/1&#xA; auto-cut-through&#xA; operation 4-wire&#xA; type 5&#xA; signal immediate&#xA; description Overhead Paging Port 1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;dial-peer cor custom&#xA; name internal&#xA; name local&#xA; name domestic&#xA; name international&#xA; name 900&#xA; name 976&#xA;!&#xA;!&#xA;dial-peer cor list call-internal&#xA; member internal&#xA;!&#xA;dial-peer cor list call-local&#xA; member local&#xA;!&#xA;dial-peer cor list call-domestic&#xA; member domestic&#xA;!&#xA;dial-peer cor list call-international&#xA; member international&#xA;!&#xA;dial-peer cor list call-900&#xA; member 900&#xA;!&#xA;dial-peer cor list call-976&#xA; member 976&#xA;!&#xA;dial-peer cor list user-internal&#xA; member internal&#xA;!&#xA;dial-peer cor list user-local&#xA; member internal&#xA; member local&#xA;!&#xA;dial-peer cor list user-domestic&#xA; member internal&#xA; member local&#xA; member domestic&#xA;!&#xA;dial-peer cor list user-international&#xA; member internal&#xA; member local&#xA; member domestic&#xA; member international&#xA;!&#xA;dial-peer cor list user900-internal&#xA; member internal&#xA; member 900&#xA; member 976&#xA;!&#xA;dial-peer cor list user900-local&#xA; member internal&#xA; member local&#xA; member 900&#xA; member 976&#xA;!&#xA;dial-peer cor list user900-domestic&#xA; member internal&#xA; member local&#xA; member domestic&#xA; member 900&#xA; member 976&#xA;!&#xA;dial-peer cor list user900-international&#xA; member internal&#xA; member local&#xA; member domestic&#xA; member international&#xA; member 900&#xA; member 976&#xA;!&#xA;!&#xA;dial-peer voice 1 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/0&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 2 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/1&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 3 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/2&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 4 pots&#xA; description ** FXO Incoming call **&#xA; incoming called-number .&#xA; direct-inward-dial&#xA; port 0/0/3&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 5 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/0&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 6 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/0&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 7 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/0&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 8 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/0&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 9 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/0&#xA; prefix 011&#xA;!&#xA;dial-peer voice 10 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/0&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 11 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/0&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 12 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/1&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 13 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/1&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 14 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/1&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 15 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/1&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 16 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/1&#xA; prefix 011&#xA;!&#xA;dial-peer voice 17 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/1&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 18 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/1&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 19 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/2&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 20 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/2&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 21 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/2&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 22 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/2&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 23 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/2&#xA; prefix 011&#xA;!&#xA;dial-peer voice 24 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/2&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 25 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/2&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 26 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 911&#xA; port 0/0/3&#xA; forward-digits all&#xA;!&#xA;dial-peer voice 27 pots&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9911&#xA; port 0/0/3&#xA; forward-digits 3&#xA;!&#xA;dial-peer voice 28 pots&#xA; corlist outgoing call-local&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9[2-9]......&#xA; port 0/0/3&#xA; forward-digits 7&#xA;!&#xA;dial-peer voice 29 pots&#xA; corlist outgoing call-domestic&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91..........&#xA; port 0/0/3&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 30 pots&#xA; corlist outgoing call-international&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 9011T&#xA; port 0/0/3&#xA; prefix 011&#xA;!&#xA;dial-peer voice 31 pots&#xA; corlist outgoing call-900&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91900.......&#xA; port 0/0/3&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 32 pots&#xA; corlist outgoing call-976&#xA; description ** FXO pots dial-peer **&#xA; destination-pattern 91976.......&#xA; port 0/0/3&#xA; forward-digits 11&#xA;!&#xA;dial-peer voice 33 voip&#xA; description ** cue voicemail pilot number **&#xA; translation-profile outgoing PSTN_CallForwarding&#xA; destination-pattern 6000&#xA; session protocol sipv2&#xA; session target ipv4:10.1.10.1&#xA; dtmf-relay sip-notify&#xA; codec g711ulaw&#xA; no vad&#xA;!&#xA;dial-peer voice 34 voip&#xA; description ** cue auto attendant number **&#xA; translation-profile outgoing PSTN_CallForwarding&#xA; destination-pattern 6001&#xA; session protocol sipv2&#xA; session target ipv4:10.1.10.1&#xA; dtmf-relay sip-notify&#xA; codec g711ulaw&#xA; no vad&#xA;!&#xA;dial-peer voice 40 pots&#xA; description E&amp;amp;M port 0 to overhead&#xA; destination-pattern 4000&#xA; port 0/1/0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;telephony-service&#xA; load 7960-7940 P0030702T023&#xA; load 7902 CP7902080001SCCP051117A&#xA; max-ephones 36&#xA; max-dn 108&#xA; ip source-address 10.10.10.1 port 2000&#xA; calling-number initiator&#xA; system message SuperSystem!&#xA; time-zone 5&#xA; voicemail 6000&#xA; max-conferences 2 gain -6&#xA; call-forward pattern .T&#xA; call-forward system redirecting-expanded&#xA; moh MOH_LO.WAV&#xA; multicast moh 239.1.1.1 port 2000&#xA; web admin system name cisco secret 5 supersecrethash&#xA; dn-webedit&#xA; time-webedit&#xA; transfer-system full-consult dss&#xA; transfer-pattern 9.T&#xA; create cnf-files version-stamp 7960 Jun 24 2014 17:45:12&#xA;!&#xA;!&#xA;ephone-template  1&#xA; softkeys idle  Redial Dnd Newcall Cfwdall Pickup&#xA; softkeys seized  Redial Endcall Cfwdall Pickup&#xA; softkeys alerting  Callback Endcall&#xA; softkeys connected  Hold Trnsfer Endcall Confrn Park&#xA;!&#xA;!&#xA;ephone-template  2&#xA; softkeys idle  Redial Dnd Newcall Pickup&#xA; softkeys seized  Redial Endcall Pickup&#xA; softkeys alerting  Callback Endcall&#xA; softkeys connected  Hold Trnsfer Endcall Confrn Park&#xA;!&#xA;!&#xA;ephone-dn  1  dual-line&#xA; number 2001&#xA; label 2001&#xA; description EphoneDn1&#xA; name EphoneDn1&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  2  dual-line&#xA; number 2002&#xA; label 2002&#xA; description EphoneDn2&#xA; name EphoneDn2&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user900-international&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  3  dual-line&#xA; number 2003&#xA; label 2003&#xA; description EphoneDn3&#xA; name EphoneDn3&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  4  dual-line&#xA; number 2000&#xA; label 2000&#xA; description Receptionist&#xA; name Receptionist&#xA; call-forward noan 2100 timeout 8&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  5  dual-line&#xA; number 2001&#xA; label 2001&#xA; description EphoneDn5&#xA; name EphoneDn5&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  6  dual-line&#xA; number 2002&#xA; label 2002&#xA; description EphoneDn6&#xA; name EphoneDn6&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  7  dual-line&#xA; number 2003&#xA; label 2003&#xA; description Estimator 2&#xA; name Estimator 2&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  8  dual-line&#xA; number 2004&#xA; label 2004&#xA; description Parts Dept&#xA; name Parts Dept&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user-international&#xA; huntstop channel&#xA;!&#xA;!&#xA;ephone-dn  9  dual-line&#xA; number 2005&#xA; label 2005&#xA; description EphoneDn9&#xA; name EphoneDn9&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  10  dual-line&#xA; number 2006&#xA; label 2006&#xA; description EphoneDn10&#xA; name EphoneDn10&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  11  dual-line&#xA; number 2007&#xA; label 2007&#xA; description Delivery Area&#xA; name Delivery Area&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  12  dual-line&#xA; number 2008&#xA; label 2008&#xA; description Estimator 1&#xA; name Estimator 1&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  13  dual-line&#xA; number 2009&#xA; label 2009&#xA; description Time Clock&#xA; name Time Clock&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  14  dual-line&#xA; number 2010&#xA; label 2010&#xA; description Empty Office&#xA; name Empty Office&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 15&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  15  dual-line&#xA; number 2011&#xA; label 2011&#xA; description EphoneDn15&#xA; name EphoneDn15&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  16&#xA; number 8000....&#xA; mwi on&#xA;!&#xA;!&#xA;ephone-dn  17&#xA; number 8001....&#xA; mwi off&#xA;!&#xA;!&#xA;ephone-dn  18&#xA; number 1000&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;!&#xA;ephone-dn  19&#xA; number 1001&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;!&#xA;ephone-dn  20&#xA; number 1002&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;!&#xA;ephone-dn  21&#xA; number 1003&#xA; park-slot timeout 30 limit 4 notify 2000 only transfer 2000 retry 15 limit 2&#xA;!&#xA;!&#xA;ephone-dn  22  dual-line&#xA; number 2000&#xA; label 2000&#xA; description Receptionist-Line2&#xA; name Receptionist-Line2&#xA; preference 1&#xA; call-forward busy 2100&#xA; call-forward noan 2100 timeout 8&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  23  dual-line&#xA; number 2004&#xA; label 2004&#xA; description EphoneDn23&#xA; name EphoneDn23&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  24  dual-line&#xA; number 2100&#xA; label Main&#xA; description MainLine Rollover1&#xA; call-forward noan 5000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  25  dual-line&#xA; number 2100&#xA; label Main&#xA; description MainLine Rollover2&#xA; preference 1&#xA; call-forward busy 5000&#xA; call-forward noan 5000 timeout 16&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  26&#xA; number 5000&#xA; label GeneralVM&#xA; description GeneralVM&#xA; name GeneralVM&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 3&#xA; corlist incoming user900-international&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  27  dual-line&#xA; number 2011&#xA; label 2011&#xA; description EphoneDn27&#xA; name EphoneDn27&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 10&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  28  dual-line&#xA; number 2009&#xA; label 2009&#xA; description test line&#xA; preference 1&#xA;!&#xA;!&#xA;ephone-dn  29  dual-line&#xA; number 2012&#xA; label 2012&#xA; description EphoneDn29&#xA; name EphoneDn29&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 12&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  30  dual-line&#xA; number 2006&#xA; label 2006&#xA; description EphoneDn30&#xA; name EphoneDn30&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  31  dual-line&#xA; number 2008&#xA; label 2008&#xA; description Estimator 1&#xA; name Estimator 1&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  32  dual-line&#xA; number 2005&#xA; label 2005&#xA; description EphoneDn32&#xA; name EphoneDn32&#xA; preference 1&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 16&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; no huntstop&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  33  dual-line&#xA; number 2013&#xA; label 2013&#xA; description EphoneDn33&#xA; name EphoneDn33&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone-dn  34  dual-line&#xA; number 2012&#xA; label 2012&#xA; description EphoneDn34&#xA; name EphoneDn34&#xA; call-forward busy 6000&#xA; call-forward noan 6000 timeout 24&#xA; corlist incoming user900-international&#xA; huntstop channel&#xA; hold-alert 30 originator&#xA;!&#xA;!&#xA;ephone  1&#xA; device-security-mode none&#xA; mac-address 0013.608F.98F3&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:4 2:22 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  2&#xA; device-security-mode none&#xA; mac-address 0007.8599.2E3F&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:8 2:23 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  3&#xA; device-security-mode none&#xA; mac-address 0013.C4AA.C42A&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:5 2:1 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  4&#xA; device-security-mode none&#xA; mac-address 0013.6039.8BFA&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:6 2:2 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  5&#xA; device-security-mode none&#xA; mac-address 0017.E013.41A9&#xA; ephone-template 1&#xA; username &amp;quot;swall&amp;quot;&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:7 2:3 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  6&#xA; device-security-mode none&#xA; mac-address 0017.E013.412F&#xA; ephone-template 2&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:10 2:30 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  7&#xA; device-security-mode none&#xA; mac-address 0015.62EA.6944&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:9 2:32 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  8&#xA; device-security-mode none&#xA; mac-address 0013.601C.1A23&#xA; ephone-template 2&#xA; type 7960&#xA; button  1:11&#xA;!&#xA;!&#xA;!&#xA;ephone  9&#xA; device-security-mode none&#xA; mac-address 0015.621B.2A9B&#xA; ephone-template 2&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:12 2:31 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  10&#xA; device-security-mode none&#xA; mac-address 0013.1AFF.302E&#xA; ephone-template 2&#xA; type 7960&#xA; button  1:13 2:28&#xA;!&#xA;!&#xA;!&#xA;ephone  11&#xA; device-security-mode none&#xA; mac-address 0015.62B5.FAE2&#xA; ephone-template 2&#xA; type 7960&#xA; button  1:14&#xA;!&#xA;!&#xA;!&#xA;ephone  12&#xA; device-security-mode none&#xA; mac-address 0017.955B.0A32&#xA; ephone-template 1&#xA; username &amp;quot;jcoffinberry&amp;quot;&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:15 2:27 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  13&#xA; device-security-mode none&#xA; mac-address 0017.E013.2BFC&#xA; ephone-template 1&#xA; username &amp;quot;AJ&amp;quot;&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; button  1:29 2:34 3:24 4:25&#xA; button  5:26&#xA;!&#xA;!&#xA;!&#xA;ephone  14&#xA; device-security-mode none&#xA; mac-address 000F.341F.FE6A&#xA; ephone-template 1&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:15 2:27 3:24 4:25&#xA; button  5m26&#xA;!&#xA;!&#xA;!&#xA;ephone  15&#xA; device-security-mode none&#xA; mac-address 0014.A981.86F5&#xA; speed-dial 1 4000 label &amp;quot;Overhead Page&amp;quot;&#xA; type 7960&#xA; button  1:33 2:24 3:25 4:26&#xA;!&#xA;!&#xA;alias exec cue service-module service-engine 0/0 session&#xA;!&#xA;line con 0&#xA; password consolepassword&#xA; login&#xA;line aux 0&#xA;line 194&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport input all&#xA; transport output pad telnet rlogin lapb-ta mop udptn v120 ssh&#xA;line vty 0 4&#xA; password vtypassword&#xA; login local&#xA; transport input ssh&#xA; transport output telnet&#xA;line vty 5 15&#xA; login&#xA; transport input telnet&#xA; transport output telnet&#xA;!&#xA;scheduler allocate 20000 1000&#xA;ntp clock-period 17180231&#xA;ntp master&#xA;ntp server 64.2.21.49&#xA;ntp server 64.2.21.107&#xA;!&#xA;webvpn context Default_context&#xA; ssl authenticate verify all&#xA; !&#xA; no inservice&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;A &lt;code&gt;debug voip ccapi inout&lt;/code&gt; log has been placed on &lt;a href=&quot;http://pastebin.com/guqD6PAz&quot; rel=&quot;nofollow noreferrer&quot;&gt;pastebin&lt;/a&gt;.&lt;br /&gt;&#xA;Furthermore if the call from Phone B is never picked up the call continues to ring and ring on phone B while after about 8 rings on all the 7960 phones the call is huntstopped. If the phone is never answered the call is disconnected (cause code 16) and the call is never forwarded to voicemail for &lt;code&gt;noan&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;h2&gt;Another scenario&lt;/h2&gt;&#xA;&lt;p&gt;Take the situation described in the beginning. If phone b is stuck in limbo &lt;em&gt;still&lt;/em&gt; and phone a terminates the call &lt;em&gt;phone b&lt;/em&gt; is &lt;strong&gt;still&lt;/strong&gt; stuck in limbo. And an attempt to answer that call from phone b when it's huntstopped to the other phones is still fruitless.&lt;/p&gt;&#xA;" OwnerUserId="2584" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2016-12-08T03:53:22.610" Title="Call is disconnected after huntstopped to another phone" Tags="|cisco|voip|telephony|cisco-voip|cisco-7900-ip-phones|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37047" PostTypeId="1" AcceptedAnswerId="37049" CreationDate="2016-12-04T18:23:04.967" Score="4" ViewCount="13917" Body="&lt;p&gt;Framing is done in Data-Link layer. We give physical addresses there. Destination address, source address and MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If two PCs in different networks, we try to sent data from one another, we specify the IP address of the destination PC in the Network layer for each packet. What do we do in Data-Link layer? What about the physical address? Whose addresses are they? How come the sender PC for another network knows the MAC address of receiver PC?&lt;/p&gt;&#xA;" OwnerUserId="32537" LastEditorUserId="8499" LastEditDate="2019-01-12T22:49:15.147" LastActivityDate="2019-01-12T22:49:36.683" Title="Mac address and IP address in physical addressing in Data-Link layer" Tags="|ip|mac-address|ip-address|layer2|layer3|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37049" PostTypeId="2" ParentId="37047" CreationDate="2016-12-04T19:02:44.470" Score="4" Body="&lt;p&gt;The MAC addresses are the physical addresses for protocols that use MAC addresses, e.g. ethernet. The source and destination MAC addresses are used in the Data-Link frame header for protocols that use MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP (both IPv4 and IPv6) addresses are Network Layer addresses that are used in the Network Layer packet header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a layer-3 packet is being sent, it must be encapsulated by a layer-2 frame. If the layer-2 protocol uses MAC addresses, it uses something like ARP (Address &lt;em&gt;Resolution&lt;/em&gt; Protocol) to &lt;em&gt;resolve&lt;/em&gt; the layer-3 address to a layer-2 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the destination host is on the same network as the source host, then the source host will use ARP to get the destination layer-2 address. If the destination host is on a different network, the source host will use ARP to get the layer-2 address of its configured gateway. The layer-2 frame will be addressed with the destination layer-2 address of either the destination host (same network) or the source host's configured gateway (different network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP basically sends a LAN broadcast asking every host on the LAN, &quot;&lt;em&gt;Who has the layer-2 address for this layer-3 address?&lt;/em&gt;&quot; The host with the layer-3 address will reply with its layer-2 address. The host asking this will then save the layer-3 to layer-2 resolution in an ARP cache so that it doesn't need to ask the next time. Entries in the ARP cache will eventually time out and be purged. They can also change based on traffic the host sees.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How come the sender PC for another network knows the MAC address of&#xA;  receiver PC?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A layer-2 (MAC) address is only relevant, or even seen, in the local LAN, so a PC on another network does &lt;em&gt;not&lt;/em&gt; know, or even care, what the MAC address of a host on another network is. A host sending to a host in a different LAN uses the MAC address of its configured gateway. The gateway strips the layer-2 frame off the layer-3 packet to forward the layer-3 packet toward its destination network, and the router will build a new layer-2 frame for the next interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2019-01-12T22:49:36.683" LastActivityDate="2019-01-12T22:49:36.683" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="37050" PostTypeId="2" ParentId="37047" CreationDate="2016-12-04T22:20:09.303" Score="0" Body="&lt;p&gt;The two addressing systems are independent of one another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet Protocol, including it's addressing, is implemented as a software &lt;em&gt;stack&lt;/em&gt; that must be installed on the endpoint in order for it to work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet functionality, and it's addressing, is implemented via firmware/drivers which must be installed for it to work.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-04T22:20:09.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37052" PostTypeId="2" ParentId="37031" CreationDate="2016-12-04T22:29:27.693" Score="0" Body="&lt;p&gt;Since you don't have a router (on-a-stick), you can't implement ASA transparent mode.  If you perform inter-vlan routing on the stack itself, you can't inject the firewall between vlan's, however you get better inter-vlan routing performance in terms of packets-per-second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring the firewall in routed mode and setting it as the default gateway for each vlan/subnet allows you best visibility/control over inter-vlan routing.  Plug it into the stack twice, uplinking to separate switches and bond those link together, configure them as a dot1q trunk, and define your subinterfaces on the PIX/ASA.  That's probably the best way to do it.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-04T22:29:27.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37056" PostTypeId="2" ParentId="25138" CreationDate="2016-12-05T03:54:39.817" Score="1" Body="&lt;p&gt;Routers are comes on  layer 3 which is the network layer that layer having some specialized protocol to connect each other(rip, ospf, and bgp.. Etc) , isp network has own hierarchy model, all isp are connected together with some policies though your packet gets encapsulate  network layer header it I'll deliver on the correct layer 3.again it's  de capsules sends packet to data link layer and finally its delivers to the destination host using Mac address.. &lt;img src=&quot;https://i.stack.imgur.com/aKTMf.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="32544" LastActivityDate="2016-12-05T03:54:39.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37057" PostTypeId="1" CreationDate="2016-12-05T08:40:27.950" Score="1" ViewCount="424" Body="&lt;p&gt;Juniper supports partitioning of a physical device such as a router into multiple logical systems. Each of these systems could have their independent routing/switching tables depending on the logical system type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is where exactly (in the actual implemented network) would an administrator need to configure a logical system? In other words, what are the factors that trigger the creation of logical system in an actual network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any links to provide an insight into the same would also be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Any idea what terminology is used by Cisco for providing logical systems?&lt;/p&gt;&#xA;" OwnerUserId="32546" LastActivityDate="2021-09-07T09:14:05.037" Title="Why logical systems?" Tags="|router|juniper|juniper-srx|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37058" PostTypeId="1" AcceptedAnswerId="37060" CreationDate="2016-12-05T08:57:22.603" Score="5" ViewCount="595" Body="&lt;p&gt;I have heard a lot about packets in networking. What do they look like? How are they transmitted through a medium like air? &lt;/p&gt;&#xA;" OwnerUserId="32548" LastEditorUserId="1519" LastEditDate="2016-12-08T04:11:35.273" LastActivityDate="2016-12-08T17:10:32.410" Title="What do packets look like?" Tags="|network-core|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37059" PostTypeId="1" CreationDate="2016-12-05T08:58:41.550" Score="0" ViewCount="160" Body="&lt;p&gt;I am looking for a lightweight reliable protocol utilizing Ethernet jumbo frames (for instance up to 9 KBytes).&#xA;One side will be implemented on an FPGA without a CPU core (so simplicity needed) and the other side on a NAS by software. Sophisticated packet routing functionality is not necessary, since it is supposed to be used in an embedded application for high-bandwidth data streaming with a very limited number of nodes.&#xA;I could find the Reliable UDP Protocol by googling, but did not like the fact that it still has the full IP-Header&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards...   &lt;/p&gt;&#xA;" OwnerUserId="32547" LastActivityDate="2016-12-06T03:49:01.530" Title="Looking for a lightweight reliable protocol directly built upon Ethernet utilizing jumbo frames?" Tags="|ethernet|ip|tcp|udp|" AnswerCount="1" CommentCount="5" ClosedDate="2017-07-09T20:04:14.197" ContentLicense="CC BY-SA 3.0" />
  <row Id="37060" PostTypeId="2" ParentId="37058" CreationDate="2016-12-05T09:29:30.070" Score="13" Body="&lt;p&gt;To transmit data you need a media (copper or optical fiber, for example) and each media has its own set of features than make it usable for data transmission.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example &lt;em&gt;copper&lt;/em&gt; is a good electrical transmitter and it's cheap (compared to other elements as &lt;em&gt;silver&lt;/em&gt; or &lt;em&gt;gold&lt;/em&gt;). Then, the best way to use it is to shape it as a cable and transmit electricity through it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, suppose you need to transmit a &lt;em&gt;jpeg&lt;/em&gt; image. The telecommunication protocols divide the whole file in chunks that can be transmitted and verified easily so the transmission is reliable. Those chunks are &lt;strong&gt;packets&lt;/strong&gt;, and inside you will find a &lt;em&gt;stream of bits&lt;/em&gt;. Each bit can be represented as a change in voltage of a electrical current.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is a simplification of bits traveling the cable:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/96OdJ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/96OdJ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we use antennas as wifi or mobile (GPRS, 3G, 4G) we use &lt;strong&gt;electromagnetic waves&lt;/strong&gt;. All around us there are electromagnetic waves (most of them are invisible, but there are other waves that we can see: the light is formed of electromagnetic waves, and the different colors that our eyes can perceive are different frequencies of the waves. Check the following chart):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aT7Ez.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aT7Ez.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the trick is to choose a range of frequencies and use waves in that range, that is invisble to the human eye. Electromagnetic waves don't depend on air, they can travel on vacuum allowing us to communicate with spaceships, satellites, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qqevq.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qqevq.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do they look?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember how in the copper cable a bit 1 was a high voltage and a bit 0 was a low voltage?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In electromagnetic waves we don't have voltages but we can play with frequencies. A bit 1 can be a frequency and a bit 0 can be a lower frequency than that of the former.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, sending packets through electromagnetic waves could look like this (this is an oversimplified example):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/V80nr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/V80nr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="2584" LastEditDate="2016-12-08T17:10:32.410" LastActivityDate="2016-12-08T17:10:32.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37061" PostTypeId="2" ParentId="37057" CreationDate="2016-12-05T10:10:33.957" Score="1" Body="&lt;p&gt;It can be routing and management separation. &#xA;Administrator can make isolation network for guest.&#xA;Logical router apply to different rule for each team with routing level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco have SDR(Secure Domain Router).&#xA;But its required IOS-XR &#xA;VRF is work with IOS.&lt;/p&gt;&#xA;" OwnerUserId="32460" LastActivityDate="2016-12-05T10:10:33.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37062" PostTypeId="2" ParentId="37057" CreationDate="2016-12-05T10:11:48.463" Score="3" Body="&lt;p&gt;Logical systems are generally used in the lab as a way of doing realistic network testing on a single or smaller number of physical devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, I have seen Logical Systems used in production in the following ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In SRX Firewalls as a way of providing multi-tenancy - each tenant is given a logical system which they can log in to and run their own security policies against their own zones without affecting other tenants (something that you cannot enforce easily with virtual-routers)&lt;/li&gt;&#xA;&lt;li&gt;In MX routers where a P/PE node is actually divided into a P and PE logical system when the PoP is first built, and then the roles are separated out into dedicated hardware as the node grows in a very hitless manner&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-12-05T10:11:48.463" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37063" PostTypeId="1" AcceptedAnswerId="37064" CreationDate="2016-12-05T11:06:33.047" Score="1" ViewCount="2216" Body="&lt;p&gt;On a Juniper MX router I've got 2 interfaces that I need to bridge together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interface A has QinQ configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan-tags outer 0x8100.1 inner 0x8100.600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Interfaces B has QinQ configured&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan-tags outer 0x8100.336 inner 0x8100.600&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These are bridge together:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;domain-type bridge;&#xA;interface A;&#xA;interface B;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I keep both outer VLAN tags the same. Then I can send traffic through the bridge domain. How would I do it when I have 2 different outer VLAN tags?&lt;/p&gt;&#xA;" OwnerUserId="20112" LastActivityDate="2016-12-05T11:48:48.753" Title="Bridge two QinQ interfaces on a juniper router" Tags="|layer2|bridge|qinq|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37064" PostTypeId="2" ParentId="37063" CreationDate="2016-12-05T11:48:48.753" Score="2" Body="&lt;p&gt;One way you could do this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the following two interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    ge-1/0/1 {&#xA;        flexible-vlan-tagging;&#xA;        encapsulation flexible-ethernet-services;&#xA;        unit 1 {&#xA;            encapsulation vlan-bridge;&#xA;            vlan-tags outer 1 inner 600;&#xA;        }&#xA;    }&#xA;    ge-1/0/2 {&#xA;        flexible-vlan-tagging;&#xA;        encapsulation flexible-ethernet-services;&#xA;        unit 1 {&#xA;            encapsulation vlan-bridge;&#xA;            vlan-tags outer 336 inner 600;&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then normalise at your bridge-domain by specifying vlan-id &quot;none&quot;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bridge-domains {&#xA;    QT {&#xA;        vlan-id none;&#xA;        interface ge-1/0/1.1;&#xA;        interface ge-1/0/2.1;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll then see when you look at your interfaces that the MX will pop both tags on ingress, and then push two new ones to match the egress interface eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Logical interface ge-1/0/1.1 (Index 345) (SNMP ifIndex 538)&#xA; Flags: Device-Down SNMP-Traps 0x0&#xA; VLAN-Tag [ 0x8100.1 0x8100.600 ] In(pop-pop) Out(push-push 0x8100.1 0x8100.600) &amp;lt;--&#xA; Encapsulation: VLAN-Bridge&#xA; Input packets : 0&#xA; Output packets: 0&#xA; Protocol bridge, MTU: 1522&#xA;  Flags: Is-Primary&#xA;&#xA;Logical interface ge-1/0/2.1 (Index 346) (SNMP ifIndex 542)&#xA;  Flags: Device-Down SNMP-Traps 0x0&#xA;  VLAN-Tag [ 0x8100.336 0x8100.600 ] In(pop-pop) Out(push-push 0x8100.336 0x8100.600) &amp;lt;--&#xA;  Encapsulation: VLAN-Bridge&#xA;  Input packets : 0 &#xA;  Output packets: 0&#xA;  Protocol bridge, MTU: 1522&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2016-12-05T11:48:48.753" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37065" PostTypeId="1" AcceptedAnswerId="37067" CreationDate="2016-12-05T12:48:38.210" Score="1" ViewCount="1062" Body="&lt;p&gt;I'm having a discussion with an ISP whether or not we should receive traffic from &lt;code&gt;100.64.0.0/10&lt;/code&gt; on our firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way I see it we should only receive traffic from their NAT device and not directly from the shared address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RFC states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Shared Address Space is IPv4 address space designated for Service&#xA;     Provider use with the purpose of facilitating CGN deployment.  Also,&#xA;     Shared Address Space can be used as additional non-globally routable&#xA;     space on routing equipment that is able to do address translation&#xA;     across router interfaces when the addresses are identical on two&#xA;     different interfaces.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Devices MUST be capable of performing address translation when&#xA;     identical Shared Address Space ranges are used on two different&#xA;     interfaces.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Packets with Shared Address Space source or destination addresses&#xA;     MUST NOT be forwarded across Service Provider boundaries.  Service&#xA;     Providers MUST filter such packets on ingress links.  One exception&#xA;     to this paragraph's proscription is in the case of business&#xA;     relationships, such as hosted CGN services.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I read the above as that the shared address space should only be used between the customers CPE and the ISPs NAT device and therefore should never reach my firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an image of the topology (simplified)&#xA;&lt;a href=&quot;https://i.stack.imgur.com/evBgb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/evBgb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I misunderstanding the RFC or is the ISP?&lt;/p&gt;&#xA;" OwnerUserId="8084" LastEditorUserId="8084" LastEditDate="2016-12-05T12:58:20.080" LastActivityDate="2016-12-05T14:33:10.427" Title="Understanding RFC6598 (CGN)" Tags="|rfc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37066" PostTypeId="1" CreationDate="2016-12-05T14:26:40.253" Score="2" ViewCount="1198" Body="&lt;p&gt;Can someone please help me:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KaczK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KaczK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cloud 5 is configured with a loopback adapter on my PC with ip 10.84.104.254.&#xA;R1 F0/1: 10.84.104.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i am able to ping R1 F0/1 from outside, as well as I can ping and do all the functionalities from R1 F0/0 to internal network. But when I am trying to ping R2 F0/0 (192.168.12.2) from outside, its not reachable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess the communication is not taking place between the fastethernet port f0/0 &amp;amp; f0/1 on router R1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please suggest:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 10.84.104.254 to network 0.0.0.0&#xA;&#xA;C    192.168.12.0/24 is directly connected, FastEthernet0/0&#xA;     192.168.14.0/32 is subnetted, 1 subnets&#xA;O       192.168.14.5 [110/41] via 192.168.12.2, 00:12:56, FastEthernet0/0&#xA;O    192.168.45.0/24 [110/40] via 192.168.12.2, 00:12:56, FastEthernet0/0&#xA;O    192.168.24.0/24 [110/11121] via 192.168.12.2, 00:12:56, FastEthernet0/0&#xA;     10.0.0.0/24 is subnetted, 1 subnets&#xA;C       10.84.104.0 is directly connected, FastEthernet0/1&#xA;O    192.168.23.0/24 [110/20] via 192.168.12.2, 00:12:57, FastEthernet0/0&#xA;O    192.168.34.0/24 [110/30] via 192.168.12.2, 00:12:57, FastEthernet0/0&#xA;S*   0.0.0.0/0 [1/0] via 10.84.104.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router Configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    hostname R1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip multicast-routing&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.12.1 255.255.255.0&#xA; ip pim dense-mode&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 10.84.104.1 255.255.255.0&#xA; ip pim sparse-mode&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial1/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; network 0.0.0.0 255.255.255.255 area 0&#xA; default-information originate&#xA;!&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 10.84.104.254&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Second Router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    hostname R2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip multicast-routing&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Tunnel0&#xA; ip address 192.168.24.2 255.255.255.0&#xA; ip pim dense-mode&#xA; tunnel source FastEthernet0/1&#xA; tunnel destination 192.168.34.4&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.12.2 255.255.255.0&#xA; ip pim dense-mode&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.23.2 255.255.255.0&#xA; ip pim dense-mode&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial1/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; passive-interface Tunnel0&#xA; network 0.0.0.0 255.255.255.255 area 0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27698" LastEditorUserId="27698" LastEditDate="2016-12-05T16:56:42.070" LastActivityDate="2019-04-25T09:01:00.293" Title="Problem in routing the network in GNS3" Tags="|routing|gns3|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37067" PostTypeId="2" ParentId="37065" CreationDate="2016-12-05T14:33:10.427" Score="1" Body="&lt;p&gt;I don't really follow your argument. From your network perspective, the Shared Address is your public address. Your outside address (usually on your firewall) will be in the Shared Address space, then you can use NAT to translate your inside addresses to the Shared Address (your outside address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the ISP has two customers within its Shared Address space, then those two customers may directly communicate using their outside (Shared Address) addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, an ISP is using the Share Address space as its inside network, and you are connecting to its inside network as your outside network.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As far as I know, ISPs are only using Shared Address space for residential customers, saving the pools of public addresses for their business customers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-05T14:33:10.427" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37068" PostTypeId="2" ParentId="37066" CreationDate="2016-12-05T15:04:12.280" Score="1" Body="&lt;p&gt;On R1, you have a routing mess. Mixing multiple routing protocols and static routes can lead to problems unless you really know what you are doing. AD (Administrative Distance) will prefer the static routes. Since you are only running OSPF on R2, then you should stick with that, except for a default route, which you should inject onto OSPF. Your OSPF network statement are really incorrect, but the last one (&lt;code&gt;network 0.0.0.0 255.255.255.255 area 0&lt;/code&gt;) will include every interface, so it is the only one you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;R1 corrections:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no router eigrp 1&#xA;!&#xA;router ospf 1&#xA; no network 10.84.0.0 0.0.0.0 area 0&#xA; no network 192.168.10.0 0.0.0.0 area 0&#xA; default-information originate&#xA;!&#xA;no ip route 0.0.0.0 0.0.0.0 192.168.12.2&#xA;no ip route 10.84.104.0 255.255.255.0 192.168.12.0&#xA;no ip route 10.84.104.0 255.255.255.0 192.168.12.2&#xA;ip route 0.0.0.0 0.0.0.0 10.84.104.254&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-05T15:04:12.280" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="37070" PostTypeId="1" AcceptedAnswerId="37072" CreationDate="2016-12-05T15:53:34.580" Score="3" ViewCount="666" Body="&lt;p&gt;I have two questions that both assume an attacker who has my MAC address:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Suppose an attacker connects to the Internet before me, spoofing my MAC. I then connect and tell people to connect to my EUI-64 address. Will the attacker get my packets? Will the attacker be able to do illegal stuff pretending to be me?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Suppose I connect first and then the attacker connects, spoofing my MAC. I am communicating with people using my EUI-64 address. Will the attacker be able to get my packets, if he gets himself assigned my EUI-64 address? Will the attacker be able to do illegal stuff pretending to be me?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I guess what I'm asking, is, EUI-64 depends on MAC addresses being unique. But since it's possible to spoof MACs, how can IPv6 address have any sort of uniqueness assumption at all? And if addresses aren't unique, how can routing possibly work?&lt;/p&gt;&#xA;" OwnerUserId="32200" LastEditorUserId="8499" LastEditDate="2018-03-09T21:10:31.187" LastActivityDate="2018-03-09T21:10:31.187" Title="MAC Spoofing and EUI-64" Tags="|routing|ipv6|mac-address|ip-address|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37072" PostTypeId="2" ParentId="37070" CreationDate="2016-12-05T16:05:55.177" Score="4" Body="&lt;p&gt;First, MAC addresses really have nothing to do with the Internet. MAC addresses are layer-2 addresses, only seen on a LAN. Layer-2 frames are stripped off at a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC address spoofing is more about LAN disruption than anything. LAN switches build MAC address tables in order to deliver a frame for a particular MAC address to the correct switch interface. A switch will modify its table every time a frame comes into the switch. What happens with MAC address spoofing is that the MAC address table will constantly be changing to the spoofed interface, then back to the real interface as each host sends traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When an IPv6 address is assigned to a host, the host must see if that address is already used on the LAN. If the address is already used, the host must pick a different address. In reality, most OSes use Privacy Extensions or Random Addressing, so SLAAC with EUI-64 addressing is pretty rare. In any case, a host trying to spoof your IPv6 (layer-3) address would need to be on your network because the network portion of the address would be different if that host is on a different network. Traffic destined to your network will not be sent to a different network.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit for your comment about different ISPs:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You seem to be confusing layer-2 and layer-3 addresses. The host portion of a layer-3 address can be the same on any other network. That is true for both IPv4 and IPv6. It is the network portion that must be unique on the Internet. You will have a unique network address, and any traffic destined to your network will only be sent to your network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-05T16:11:23.620" LastActivityDate="2016-12-05T16:11:23.620" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="37074" PostTypeId="1" CreationDate="2016-12-05T17:16:44.463" Score="1" ViewCount="565" Body="&lt;p&gt;In token ring topology, if a host needs to send data, it grabs the token and sends data. Once it receives it again it frees the token.&#xA;This is what I know about token ring&#xA;Is token is held by host, while data transmits through the ring or data frame is appended to the token and passed?&#xA;some websites explain as host holds the token and data passes as frame and once data received by sender , sender frees the token if it completes, but some websites and my lecturer explain that data frame is appended with the token and passed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How the ring topology works with token?&#xA;How token looks like?&lt;/p&gt;&#xA;" OwnerUserId="32537" LastEditorUserId="8499" LastEditDate="2016-12-05T19:11:11.600" LastActivityDate="2017-06-04T01:27:05.120" Title="Token ring topology and token passing concepts" Tags="|lan|layer2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37075" PostTypeId="2" ParentId="37074" CreationDate="2016-12-05T17:27:21.857" Score="1" Body="&lt;p&gt;It starts out with an empty token being circulated. The empty token has a priority, and a station must have an equal or higher priority to use the empty token. A host wanting to send something seizes the empty token. Then it sends a frame, and the frame header has an Access Control field with a token in it. The receiving host will change the token back to &lt;code&gt;0&lt;/code&gt;. When the frame circles all the way around to the host sending the frame, the sender will see that the token is &lt;code&gt;0&lt;/code&gt;, and it will remove the frame data and send the empty token back around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The token is part of the frame. It can be seen conceptually that the host holds the token, but the token is really part of the frame header for a data frame.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-05T18:00:46.120" LastActivityDate="2016-12-05T18:00:46.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37076" PostTypeId="1" AcceptedAnswerId="37077" CreationDate="2016-12-05T20:16:38.123" Score="4" ViewCount="2041" Body="&lt;p&gt;By convention, each device on the LAN under IPv6 gets a /64 subnet, right? That's an obscene number of addresses per device! Why not make the addresses shorter, say, 72 bits, then each device would get 256 addresses in its subnet, which would save several bytes per packet during transmission (which is a Good Thing). Why the need for such insanely long addresses?&lt;/p&gt;&#xA;" OwnerUserId="32200" LastEditorUserId="8499" LastEditDate="2018-03-12T00:41:06.360" LastActivityDate="2018-03-12T00:41:06.360" Title="Why are IPv6 addresses so long?" Tags="|ip|subnet|ipv6|ip-address|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37077" PostTypeId="2" ParentId="37076" CreationDate="2016-12-05T20:41:42.847" Score="11" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;By convention, each device on the LAN under IPv6 gets a /64 subnet,&#xA;  right?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No. Each &lt;em&gt;network&lt;/em&gt; is almost always a &lt;code&gt;/64&lt;/code&gt; network. Each &lt;em&gt;host&lt;/em&gt; still gets one or more addresses on the network, but I don't know of any OS that will handle more than a few dozen addresses for an interface on a LAN.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why the need for such insanely long addresses?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is so that we don't get in the same position as we are with IPv4. IPv4 ran out of addresses a long time ago, but it was extended by breaking the IP end-to-end premise with kludges like NAT. IPv6 has enough addresses that we should not get into the same position for the foreseeable future, and it restores the IP foundation of end-to-end connectivity because each device can have a unique IP address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-05T20:41:42.847" CommentCount="15" ContentLicense="CC BY-SA 3.0" />
  <row Id="37078" PostTypeId="1" CreationDate="2016-12-05T21:39:37.537" Score="1" ViewCount="102" Body="&lt;p&gt;I will ask my question through an example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a school with 2 campuses with the network address of the school to be 135.135.0.0/26 (host range: 135.135.0.1 - 135.135.0.62). Suppose I will subnet in order to give each campus its own hosts. So campus 1 will be for example 135.135.0.5 and campus 2 will have 135.135.50. Can I now repeat the subnet process for 135.135.0.5 and 135.135.0.50, separately, in order to get more hosts out of it in order for example to distribute them for computers in each campuses or printers or any other device?&lt;/p&gt;&#xA;" OwnerUserId="32560" LastActivityDate="2016-12-05T22:12:41.110" Title="Can I subnet a host coming from a network address?" Tags="|ipv4|subnet|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37079" PostTypeId="2" ParentId="37078" CreationDate="2016-12-05T21:51:07.267" Score="3" Body="&lt;p&gt;Your questions is a bit vague....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you have a /26 you indeed have 62 host IP addresses. If you want to split that subnet evenly between 2 sites you need to further subnet it to 2 x /27 subnets, in which each have 30 (IP) host addresses per Campus.&lt;/p&gt;&#xA;" OwnerUserId="30328" LastActivityDate="2016-12-05T21:51:07.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37080" PostTypeId="2" ParentId="3013" CreationDate="2016-12-05T22:05:17.133" Score="0" Body="&lt;p&gt;VPN router is a pretty broad noun to describe networking hardware. When I think of a &quot;VPN router&quot; it could be a firewall, which is used for routing traffic from the internet or WAN connections. Small business class equipment like the Cisco RV042 are not apples to apples when compared to something like a Cisco ASR. &#xA;Whitepapers and manuals are your best friend when you want to understand a products capabilities.....Thorough understanding of the theory behind what makes those concepts work is another piece of the puzzle.&#xA;Time to hit the books id say =).&lt;/p&gt;&#xA;" OwnerUserId="27523" LastActivityDate="2016-12-05T22:05:17.133" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37081" PostTypeId="2" ParentId="37078" CreationDate="2016-12-05T22:12:41.110" Score="1" Body="&lt;p&gt;Implementing different subnets will separate your networks from each other thus the two campuses won't be able to communicate with each other unless there is a router between them. Sub-netting would not give you extra IP addresses if you still want them to communicate. But if this is not your concern yes you can divid your network using the 135.135.0.0/26 range ip addresses you have. You can use 135.135.0.0/27 which gives you 135.135.0.1-30 host addresses for network A and 135.135.0.32/27 which gives you 135.135.0.33-62 host addresses in network B. If you need 3 network you can continue the same pattern. For instance, 135.135.0.0/28 - 135.135.0.16/28 and leave the second part (network B) unchanged as 135.135.0.32/27.&lt;/p&gt;&#xA;" OwnerUserId="17257" LastActivityDate="2016-12-05T22:12:41.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37082" PostTypeId="1" AcceptedAnswerId="37084" CreationDate="2016-12-05T23:18:14.350" Score="1" ViewCount="3491" Body="&lt;p&gt;When I configure SNMP on IOS I use this syntax:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server group [group] v3 priv&#xA;snmp-server user [user] [group] v3 auth sha [blah] priv aes 128 [blah] access [ACL]&#xA;&#xA;ip access-list standard [ACL]&#xA; permit 192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've tried to configure the same on a Nexus device. I notice there is no &lt;code&gt;'snmp-server group'&lt;/code&gt; command but I can specify a group &lt;em&gt;after&lt;/em&gt; when adding a user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm a bit confused on the differences between the two OS's.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The syntax to add SNMP user on NX-OS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server user [user] auth sha [blah] priv aes-128 [blah]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One thing different here is I can't specify an access-list associated with a group. Why is that? Thanks.&lt;/p&gt;&#xA;" OwnerUserId="19081" LastActivityDate="2016-12-07T06:05:47.813" Title="Differences between SNMP on NX-OS and IOS" Tags="|snmp|cisco-nx-os|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37084" PostTypeId="2" ParentId="37082" CreationDate="2016-12-06T03:14:59.980" Score="2" Body="&lt;p&gt;The ACL does work but is handled in a second line - so:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;snmp-server user [user] auth ...&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(as above)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and &lt;em&gt;then&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;snmp user [user] {use-ipv4acl | use-ipv6acl} [aclname]&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This syntax can also be used with a standard v1/v2/v2c community.  The above should be fine for 6.2 on the 7K and any 7.0(3) iteration on the 9K.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure how to answer your other question - as you write, the group is now configured on the same line as the v3 user and so forth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: For reference - &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus7000/sw/system-management/guide/b_Cisco_Nexus_7000_Series_NX-OS_System_Management_Configuration_Guide/b_Cisco_Nexus_7000_Series_NX-OS_System_Management_Configuration_Guide_chapter_01111.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Nexus 7000 / NXOS 6.2 System Configuration Guide&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastEditorUserId="1172" LastEditDate="2016-12-07T06:05:47.813" LastActivityDate="2016-12-07T06:05:47.813" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37085" PostTypeId="2" ParentId="37076" CreationDate="2016-12-06T03:27:46.517" Score="2" Body="&lt;p&gt;In addition to the other answer, I would direct people who don't understand how IPv6 addresses get assigned to homes/small businesses etc to read this: &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6177&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc6177&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I also thought of another benefit of having /64 site subnets: it makes port scanning impossible given just the network prefix. With IPv4, port scanning is a serious problem, as we saw with worms like Mirai etc (UPnP). With IPv6, your probability of guessing a private address (the 64 bit suffix) is 2^(-64), i.e. 0 (if they're using randomly generated addresses, which they would be if they care about this kind of security). Shorter addresses, like 64+48 (minimum to identify from MAC), would only give 48 bits of protection for random guessing, really 48-3*8 because there are only a few OSI values.&lt;/p&gt;&#xA;" OwnerUserId="32200" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-12-06T03:59:01.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37086" PostTypeId="1" AcceptedAnswerId="37088" CreationDate="2016-12-06T03:41:09.257" Score="2" ViewCount="4648" Body="&lt;p&gt;EUI-64 IPv6 addresses are generated from MAC addresses by taking the network prefix (64 bits) and appending the first half of the MAC address, then &lt;code&gt;FF:FE&lt;/code&gt;, then the second half of the MAC. Is there a reason for the &lt;code&gt;FF:FE&lt;/code&gt;? Other than 64+64=128.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I didn't mention in the above that some bits in the prefix, specifically the &quot;global&quot; identifier and the &quot;unique&quot; identifier, get flipped.&lt;/p&gt;&#xA;" OwnerUserId="32200" LastActivityDate="2017-12-28T07:40:21.327" Title="Why the FF:FE in EUI-64?" Tags="|ipv6|mac-address|ip-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37087" PostTypeId="2" ParentId="37059" CreationDate="2016-12-06T03:49:01.530" Score="2" Body="&lt;p&gt;OK - so a few points based on the comments:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) By definition Ethernet is not routed but rather switched, bridged or repeated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) As mentioned, protocol reliability implies the ability to retransmit lost and errored frames without the interaction of a higher-layer protocol.  This means that the sender and receiver will need to maintain some kind of state to track packet sequence and likely some amount of flow control to adjust based on buffering.  This also means you'd need semantics for session establishment and teardown - which means timers.  This is &lt;strong&gt;much&lt;/strong&gt; heavier in actual practice than UDP/IP.  It's also worth noting that there are lightweight/embedded IP+UDP stacks that would prevent you from having to reinvent the wheel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.) Take a look at the RoCE family of protocols - super low latency and supports your requirements.  Interestingly version 1 of the standard runs over raw Ethernet and supports jumbo frames.  Whether it hits your requirements for reliability is another question.  IMO the &lt;strong&gt;more&lt;/strong&gt; interesting point is that ROCEv2 has similarly excellent latency characteristics but runs over UDP (and is well-supported by a number of NIC and switch vendors).  It's worth noting that part of the operation of the RoCE protocols requires lossless Ethernet facilities.  Minimally this includes PFC but the spec also calls out some of the other DCB specs.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-06T03:49:01.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37088" PostTypeId="2" ParentId="37086" CreationDate="2016-12-06T03:58:12.163" Score="5" Body="&lt;p&gt;0xFFFE was chosen by the IEEE as a reserved value to reflect the fact that a given address is in the &lt;em&gt;modified&lt;/em&gt; EUI-64 format.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's important to note that the first and second half of a MAC address actually have significance - the first being the organizationally unique identifier (OUI) that identifies the NIC manufacturer/class and the second being a number assigned by said manufacturer.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - we have [8-byte prefix]+[3-byte OUI]+[FF-FE, 2 bytes]+[3-byte assigned NIC value] = 16 bytes, 128 bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/document/100566/understanding-ipv6-eui-64-bit-address&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; is a good reference explaining the above.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastEditorUserId="8499" LastEditDate="2017-12-28T07:40:21.327" LastActivityDate="2017-12-28T07:40:21.327" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37089" PostTypeId="1" AcceptedAnswerId="37150" CreationDate="2016-12-06T06:47:17.323" Score="1" ViewCount="4878" Body="&lt;p&gt;I want to make a lab experiment to measure the firewall (&lt;strong&gt;a hardware&lt;/strong&gt;) latency. This firewall can do &lt;strong&gt;Deep Packet Inspection (DPI) on some industrial protocols&lt;/strong&gt; (you can consider as TCP payload inspection). Hence, I want to measure the firewall's latency when inspecting the payload.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume I have a sender PC and a receiver PC. The firewall is &lt;strong&gt;connected in between&lt;/strong&gt;. I can build a packet generator on the sender, and use wireshark installed on each PC to confirm whether the packet pass the firewall or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence, what is the effective way to measure the latency (&lt;strong&gt;e.g. xxx ms delay on average by comparing without firewall)&lt;/strong&gt; that the firewall inspects the packets? (such as existing software)&lt;/p&gt;&#xA;" OwnerUserId="22125" LastEditorUserId="22125" LastEditDate="2016-12-08T08:00:51.753" LastActivityDate="2016-12-08T19:34:10.577" Title="How to measure the firewall latency?" Tags="|firewall|latency|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37092" PostTypeId="1" CreationDate="2016-12-06T10:20:02.437" Score="1" ViewCount="159" Body="&lt;p&gt;I want to build a gns3 site-to-site IPsec VPN between two CISCO routers. My question is, do I have to configure the clients behind each router in a specific way so that they will be aware of the tunnel? From what I understood in a site-to-site VPN I don't have to install any software on the end-devices, correct ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adam &lt;/p&gt;&#xA;" OwnerUserId="24620" LastActivityDate="2016-12-06T15:25:10.353" Title="CISCO IPsec site-to-site client configuration" Tags="|ipsec|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37093" PostTypeId="2" ParentId="37092" CreationDate="2016-12-06T10:43:09.550" Score="2" Body="&lt;p&gt;Yes that is correct, you do not need any software on the devices that communicate through the tunnel.&#xA;Of course you need to make sure your routing is ok but that is usually not done on the hosts.&#xA;And you may need to consider that a tunnel potentially decreases the path MTU, see e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this doc&lt;/a&gt; for an extensive explanation and potential issues.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-12-06T10:43:09.550" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37096" PostTypeId="1" CreationDate="2016-12-06T14:35:36.473" Score="2" ViewCount="2923" Body="&lt;p&gt;I tried to disable auto-negotiation in my Juniper ACX-2200 , but it says&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;edit#set interfaces ge-0/1/0 gigaether-options no-auto-negotiation&#xA;&#xA;raki@# commit &#xA;[edit interfaces ge-0/1/0]&#xA;'gigether-options'&#xA;Autonegotiation shouldnt be disabled for Fiber media type&#xA;error: configuration check-out failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The Documentation says I need to manually set the speed and duplex,&#xA;I did set duplex to full deplex and speed to 1g both the sides, but it still gives me same error.&lt;/p&gt;&#xA;" OwnerUserId="6118" LastActivityDate="2016-12-06T14:35:36.473" Title="Why auto negotiation cannot be disabled on Fiber Port" Tags="|juniper|autonegotiation|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37098" PostTypeId="2" ParentId="37092" CreationDate="2016-12-06T15:25:10.353" Score="2" Body="&lt;p&gt;Your site-to-site tunnel will be transparent to the client devices. When the traffic hits each router from the 'inside' clients, it will be tagged as 'interesting traffic' against an access list and sent through the tunnel. There is no software or configuration requirements on the hosts. This is a great use case for two locations that do not have a direct leased line but need to share resources between each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information, see Cisco's configuration guide &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15501" LastActivityDate="2016-12-06T15:25:10.353" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37099" PostTypeId="2" ParentId="37089" CreationDate="2016-12-06T16:08:42.503" Score="2" Body="&lt;p&gt;You could use a tool like iperf to measure throughput and latency on each node with different inspection/filtering features turned on the firewall. This will show how the firewall features affect throughput/latency. See more at &lt;a href=&quot;https://iperf.fr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;iperf's website&lt;/a&gt; Keep in mind that there will be other factors like the cabling and each node's resources that can effect these numbers. You might also look into logging/debug features of the firewall to see if there is any information from there you can look into.&lt;/p&gt;&#xA;" OwnerUserId="15501" LastActivityDate="2016-12-06T16:08:42.503" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37103" PostTypeId="1" AcceptedAnswerId="37114" CreationDate="2016-12-06T17:41:49.430" Score="1" ViewCount="141" Body="&lt;p&gt;&lt;code&gt;virtual-service connect csr_mgmt console&lt;/code&gt; brings up a login prompt.  Anyone know the credentials?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is I am trying to use the REST API which first requires you to authenticate for a token.  cURL works fine but I would prefer to use a browser and our friends at Cisco failed to set the CORS header ‘&lt;code&gt;Access-Control-Allow-Origin&lt;/code&gt;’.  I was hoping to get at the NGINX within the service container (VM) running on IOS-XE and set that...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, disabling CORS on the browser for dev/testing does not work, and the fetch api ain't fully baked (with &lt;code&gt;no-cors&lt;/code&gt;) yet either.  Setting up a host file (so I can spoof the ip address to be a URL on the same origin/domain) don't work either.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="8499" LastEditDate="2018-02-16T03:51:53.440" LastActivityDate="2018-02-16T03:51:53.440" Title="Cisco IOS-XE CORS Issue - Username for csr_mgmt Virtual Service" Tags="|cisco|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37104" PostTypeId="2" ParentId="37039" CreationDate="2016-12-06T17:56:50.707" Score="1" Body="&lt;p&gt;&lt;code&gt;huntstop channel&lt;/code&gt; is missing from x2002.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-06T17:56:50.707" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="37107" PostTypeId="1" AcceptedAnswerId="37108" CreationDate="2016-12-06T20:21:29.953" Score="3" ViewCount="414" Body="&lt;p&gt;I'm not entirely sure if this question has been asked before, so apologies if it has.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm studying computer science at university and I've had two modules: Data Communication and Networking; Artificial Intelligence.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In networking we've been learning about routing and connecting routers together in order to transfer data (mainly discussing different types of protocols).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In AI, we used the A* Search as a path finding algorithm from a start node to a goal node in a graph with walls and traps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main question is: &lt;strong&gt;Is it possible for A* Search to be used in routing?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that you would need to identify a form of cost between network nodes and find a suitable heuristic to do so. I'm more interested to know if something like that could work, and if not, then how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="32258" LastActivityDate="2016-12-06T21:23:15.530" Title="A * search algorithm in networking" Tags="|routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37108" PostTypeId="2" ParentId="37107" CreationDate="2016-12-06T20:25:43.080" Score="2" Body="&lt;p&gt;A * is an extension of the Dijkstra algorithm that used by some routing protocols, e.g. OSPF and IS-IS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is certainly possible to create a new routing protocol that uses A *, but it would really need to add something new to find any acceptance.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In networking, routing is handled by routers. A node will know if the destination node is on a different network. If it is, then the node sends the traffic to its configured gateway (router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router has a routing table where it looks up the destination address to find the next interface to which the traffic should be sent. The routing table may be implemented as a memory structure (lookup table, tree, trie, etc.) or in hardware (CAM, TCAM, etc.).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interesting part is how a routing table is populated. Routers learn about routes three ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Directly connected networks&lt;/li&gt;&#xA;&lt;li&gt;Statically configured routes&lt;/li&gt;&#xA;&lt;li&gt;Routing protocols&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;A routing protocol is where the algorithms are used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It really is not in the best interest of the network for a node to determine which path its traffic should take.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-06T21:23:15.530" LastActivityDate="2016-12-06T21:23:15.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37111" PostTypeId="1" CreationDate="2016-12-06T22:35:14.543" Score="2" ViewCount="181" Body="&lt;p&gt;What I want to do may be pretty simple but I'm not very experienced with networking. I'll use pictures to explain, this is my current setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tMUKC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tMUKC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to extend my network so that I can add more devices, but because of the physical disposition of my devices I can only do so in the port used by device B of my current setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ggADf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ggADf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I have services running on device B and I need to persist its LAN IP, which I suppose I can easily do by just forwarding the used ports from the newly added router to the device's new LAN IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first question regarding this setup is &lt;strong&gt;is my above statement correct&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My second question is &lt;strong&gt;How can devices from the outer (first) network access devices on the inner network&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If device A tries to connect to device D for example, wouldn't looking up 192.168.1.5 fail because the outer router doesn't have such an address?&lt;/p&gt;&#xA;" OwnerUserId="32583" LastActivityDate="2016-12-08T20:01:16.057" Title="Restructure my network without breaking connections" Tags="|lan|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37112" PostTypeId="2" ParentId="37111" CreationDate="2016-12-06T22:49:47.730" Score="2" Body="&lt;p&gt;The second router can not have the same IP addresses (same subset) for both host and the other router. What you need is to replace the second router with a switch and your problem will be solved.&lt;/p&gt;&#xA;" OwnerUserId="17257" LastActivityDate="2016-12-06T22:49:47.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37114" PostTypeId="2" ParentId="37103" CreationDate="2016-12-07T00:36:48.287" Score="0" Body="&lt;p&gt;...when the scalpel fails, pick up the axe and hack!  &lt;a href=&quot;http://pointdeveloper.com/how-to-bypass-cors-errors-on-chrome-and-firefox-for-testing/&quot; rel=&quot;nofollow noreferrer&quot;&gt;CORS Bypass plugins&lt;/a&gt;; Yes...!  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good lord, that was a multiday journey through the innerds of XHR and Fetch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LFdJW.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LFdJW.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-07T00:36:48.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37116" PostTypeId="2" ParentId="36950" CreationDate="2016-12-07T02:57:55.410" Score="1" Body="&lt;p&gt;They are quite different. What I'm about to write is in high level terms: Google and ETSI can help you with details.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;NFV takes traditional appliances like packet inspection devices, session border controllers and so on and virtualizes them.  The earliest NFV implementations did just that- slap the unit on a VM and be done.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But: that's not much of a gain.  The real promise of NFV is that you can spin up a function on demand, scale it up and down according to need, and generally be much more cloudy than traditional service providers have been.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now imagine that you have got to that state, so that you can, say spin up a call control core, or a application server, or a firewall in minutes not months.  Now you can do &lt;strong&gt;service chaining&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In service chaining, you create new products by stringing together functions delivered by NFV.  There are some subtleties here best explained by an example.  Lets say you (as a service provider) want to sell some new phone product to the government?  Ok, you'll need some call control, and a telephony app server.  And a firewall or packet inspection engine.  With function chaining you string the firewall and the call control/app server together so that the product is defined as the chain of all those things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The subtlety is that SFC can happen at the IP layer (&quot;send traffic to the firewall, then the call control&quot;). Or it can be a logical construct used by a product designer.  Or it can be inherent to the elements being strung together (eg an IMS core using filter criteria to send calls to app servers).&lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2016-12-07T02:57:55.410" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37117" PostTypeId="2" ParentId="36828" CreationDate="2016-12-07T04:03:37.593" Score="1" Body="&lt;p&gt;Can one fiber be used to transmit and receive signals?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, one fiber can be used to transmit and receive signals. Have you heard of the WDM technology? This technology can multiplexe a number of optical carrier signals onto a single optical fiber by using different wavelengths of laser light. There are two common types of the WDM technology—CWDM and DWDM. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's take CWDM as an example, a typical 8-channel CWDM system offers 8 times the amount of bandwidth that can be achieved using a SONET/SDH system, for a given transmission line speed and using the same optical fibers. For more, please have a look at this &lt;a href=&quot;http://www.fs.com/blog/introduction-to-cwdm-technology-and-its-application.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;blog&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For you own network, you can use the CWDM/DWDM optical transceivers, or BiDi transceiver. &lt;/p&gt;&#xA;" OwnerUserId="24835" LastActivityDate="2016-12-07T04:03:37.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37118" PostTypeId="2" ParentId="37111" CreationDate="2016-12-07T06:17:25.960" Score="2" Body="&lt;p&gt;In your case, &lt;a href=&quot;https://networkengineering.stackexchange.com/users/17257/babak&quot;&gt;Babak&lt;/a&gt; is right, but didn't fully explain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you sure you want a router for that operation? Have you considered using a switch instead?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, a router is designed to route between disparate networks. It's designed so that you can take network &lt;code&gt;a&lt;/code&gt; and access it from network &lt;code&gt;b&lt;/code&gt;, and vice-a-versa. The problem you are going to have is that the typical home routers use NAT (Network Address Translation) to allow multiple devices to use the router to connect through one &lt;em&gt;public&lt;/em&gt; IP. The public IP for router 2 is going to be &lt;code&gt;192.168.1.3&lt;/code&gt;. This means that you cannot have any &lt;code&gt;192.168.1.x&lt;/code&gt; devices inside that network (assuming you used the default subnet mask of &lt;code&gt;255.255.255.0&lt;/code&gt; for a class-C network everywhere, which is highly likely). So in this case, you have two options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Disable NAT. Not all home routers support this, but you can change the network for the inner devices to &lt;code&gt;192.168.2.0/24&lt;/code&gt; for example, or change the outside network (since &lt;code&gt;192.168.1.3&lt;/code&gt; is your service host) to the &lt;code&gt;192.168.2.0/24&lt;/code&gt; network and make the inside network &lt;code&gt;192.168.1.0/24&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Use a switch. I &lt;em&gt;highly&lt;/em&gt; recommend this option. If you get a cheap switch (or use the switch ports on your router instead of the WAN/Internet port) you can extend your network &lt;em&gt;seamlessly&lt;/em&gt;. The router at that point will only be performing switching operations, which allows you to not have to change IP schemes at all (and give router 2 an IP that is not &lt;code&gt;192.168.1.3&lt;/code&gt;). Basically, your router (assuming it's a SOHO router) should have one port and then a group of ports, usually separated by a small amount (1/4 to 1/2 inch). Plug everything into the group, nothing into the single. There is &lt;em&gt;almost always&lt;/em&gt; no configuration required on the router to do this. Plug-and-play (in Windows 98/ME/2000/NT we called it &quot;plug-and-pray&quot;, but I digress). DHCP will pass through the switch (if you use DHCP), and everyone can see each other as if there was nothing in the way. If it's a commercial grade router, then depending on modules installed (I.e. none of my Cisco routers have switch port modules) you &lt;em&gt;may&lt;/em&gt; still have switch port modules on it (based on your diagram I think you do) but you may have to enable them. (A lot of routers, Cisco especially, come with all ports disabled, switches usually don't have this default.) It is also worth noting that if you are using the switch ports on your second router and not the router itself, you should consider (actually, you should just do it) disabling DHCP to avoid conflicts on the second router.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Personally, I would go for option 2. There's no need to segregate your networks like that (unless you want an additional firewall to device B, but you probably don't need it).&lt;/p&gt;&#xA;" OwnerUserId="32591" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-12-07T19:22:08.140" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37119" PostTypeId="1" AcceptedAnswerId="37142" CreationDate="2016-12-07T07:07:28.117" Score="1" ViewCount="22936" Body="&lt;p&gt;Today i was trying to configure port forwarding in one of my client's office. They wanted me to forward ports like 5000 and 6000. I was given the GUI access of the cisco router 2900 series. I could not see any options for NAT or ACL there. I doubt we can't forward ports from that particular router. Help me if there is any way we can do that via CLI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My private ip is 172.16.32.250 and my private is 5.6.7.8. When someone does 5.6.7.8:5000 from their browser outside the office, i want them to have the interface of my biometric devices. I want TCP 5000 to be opened/forwarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it not called port forwarding? Please help me understand this concept better.&#xA; Please help&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="23114" LastEditDate="2016-12-13T05:04:23.337" LastActivityDate="2021-01-24T11:25:50.510" Title="Port forwarding in cisco router" Tags="|cisco|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37120" PostTypeId="1" AcceptedAnswerId="37126" CreationDate="2016-12-07T08:39:00.900" Score="1" ViewCount="3761" Body="&lt;p&gt;I have two Cisco &lt;strong&gt;layer 3&lt;/strong&gt; switches. In switch 1, I created two vlans, 10.10.1.0/24 and 10.10.2.0/24. The connection is shown in the figure.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;PC 1 and PC 2 have static IP address (10.10.1.5 and 10.10.2.5)&lt;/li&gt;&#xA;&lt;li&gt;switch 2 is connected to switch 1 through vlan 2&lt;/li&gt;&#xA;&lt;li&gt;DHCP pool is &lt;strong&gt;not&lt;/strong&gt; activated in both switch 1 and 2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To let PC 1 and PC 2 communicate with each other (for example, use ping to verify), I should configure &lt;strong&gt;static route&lt;/strong&gt; in switches, right? How to configure this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EfjzO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EfjzO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="22125" LastEditorUserId="8499" LastEditDate="2018-03-21T00:46:50.067" LastActivityDate="2021-01-10T11:44:38.470" Title="How to configure static routing between two layer 3 switches?" Tags="|routing|switch|vlan|layer3|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37121" PostTypeId="1" AcceptedAnswerId="37125" CreationDate="2016-12-07T09:02:25.203" Score="1" ViewCount="802" Body="&lt;p&gt;I need to connect a 8 interfaces server to a HP J9854A 2530-24G-PoE+-2SFP+ Switch with LACP. Several VLANS are involved. It seems from this link: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=c04777712&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=c04777712&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in &quot;Table 12 Trunk configuration protocols&quot; that I have to use static LACP because I am in this case : &quot;You want an LACP trunk group to operate in a  LAN other than the default VLAN and GVRP is disabled.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the correct configuration for this on the switch?&#xA;Thanks a lot for your help.&lt;/p&gt;&#xA;" OwnerUserId="32552" LastActivityDate="2016-12-07T10:12:24.363" Title="LACP static on HP Switch with multiple VLAN" Tags="|switch|hp-procurve|ieee-802.1ax|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37125" PostTypeId="2" ParentId="37121" CreationDate="2016-12-07T10:12:24.363" Score="1" Body="&lt;p&gt;I created a trunk with LACP option and tagged VLANS on the trunks.&lt;/p&gt;&#xA;" OwnerUserId="32552" LastActivityDate="2016-12-07T10:12:24.363" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37126" PostTypeId="2" ParentId="37120" CreationDate="2016-12-07T10:32:52.753" Score="4" Body="&lt;p&gt;Looking at your setup, you don't need any static routing as PC2 is on a network which has it's default gateway on Switch 1. As both networks are terminated on Switch1, Switch 1 knows about both networks, so can route between them. You just need to ensure the default gateway for PC1 is 10.10.1.1 and for PC2, 10.10.2.1. Ensure VLAN 2 is trunked to Switch 2 and PC2 switchport is an access port on VLAN 2. Make sure PC2 can ping its default geteway, then you should be OK&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-12-07T10:32:52.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37127" PostTypeId="2" ParentId="37120" CreationDate="2016-12-07T11:22:54.373" Score="2" Body="&lt;p&gt;I agree with you Karl, and if you allow me, I would like to mention that in some switches (i.e Cisco) you need to activate the layer 3 capability. Otherwise, you will be able to create all the VLAN interfaces, but they won't be able to talk to each other. &lt;/p&gt;&#xA;" OwnerUserId="32602" LastActivityDate="2016-12-07T11:22:54.373" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37130" PostTypeId="1" AcceptedAnswerId="37131" CreationDate="2016-12-07T14:36:39.173" Score="2" ViewCount="8272" Body="&lt;p&gt;I am new to hardware side of networking, my overall purpose is to introduce VLAN to a LAN network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do this I have connected my router/pfsense to main-switch (my switch:HP1920-48G JG927A) and main-switch is connected to other switchs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When this was purchased the previous worker configured some password (I think) and now no one knows what the password is in our company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I heard I can reset the password by holding a reset button but this switch have no buttons? does this means I can never reset login credentials for this switch? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone advice please?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/XjWCF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XjWCF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="24268" LastEditorUserId="24268" LastEditDate="2016-12-08T16:06:58.053" LastActivityDate="2016-12-08T16:06:58.053" Title="Reset HP switch login credentials" Tags="|switch|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37131" PostTypeId="2" ParentId="37130" CreationDate="2016-12-07T14:58:42.467" Score="3" Body="&lt;p&gt;This device is a Comware based switch, so the front panel reset buttons are not available.  To reset the password you will need to connect a console cable (38400/8/N/1), reboot the switch, then press Ctrl + B during boot up (similar to Cisco ROMMON).  You will then have an option to boot the switch without a configuration, which will also have no password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See this guide for further details:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=mmr_sf-EN_US000005130&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://h20564.www2.hpe.com/hpsc/doc/public/display?docId=mmr_sf-EN_US000005130&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastEditorDisplayName="user27899" LastEditDate="2016-12-07T15:04:14.940" LastActivityDate="2016-12-07T15:04:14.940" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37133" PostTypeId="1" AcceptedAnswerId="37134" CreationDate="2016-12-07T15:55:17.690" Score="2" ViewCount="159" Body="&lt;p&gt;There are so many twisted pair cables around, which are claiming to be a certain &lt;a href=&quot;https://en.wikipedia.org/wiki/ISO/IEC_11801&quot; rel=&quot;nofollow noreferrer&quot;&gt;class/category&lt;/a&gt;, e.g. CAT6. &#xA;How can verify the CAT type number? &#xA;Cutting them is maybe not the most practical solution. &lt;/p&gt;&#xA;" OwnerUserId="19340" LastEditorUserId="8499" LastEditDate="2018-03-10T00:19:06.967" LastActivityDate="2018-03-10T00:19:06.967" Title="How to verify CAT type?" Tags="|layer1|cable|cabling|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37134" PostTypeId="2" ParentId="37133" CreationDate="2016-12-07T16:01:57.753" Score="6" Body="&lt;p&gt;The cable category should be printed on the cable sheath.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just having cable rated at a particular category doesn't mean the cable plant is actually rated at that category. All the components of the cable system must be rated for that category. Also, installation is very important. Even experienced installers have problems with Category-6 cabling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to tell if a particular installation meets a category is to test the cables with an expensive tester that performs all the tests in the test suite for a category. When a cable plant is installed, the installers should test each cable, fix any problems, and provide a complete report to you.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-07T16:01:57.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37135" PostTypeId="1" AcceptedAnswerId="37261" CreationDate="2016-12-07T16:18:51.477" Score="2" ViewCount="4324" Body="&lt;p&gt;We are using a 48 port 3com baseline switch and recently ports have started dropping, completely shutting off(no connection light) and have switched to another open port and moved on our merry way. &#xA;   So now we are getting more and more ports dropping. I have run the diagnostics and the ports that have failed either have unknown or short test results. The ones that tested short was without a cable and with a cable. Is this a sign that the switch is failing, is there something I'm not doing right in my test. BTW I am not a network engineer just a hobbyist that understands enough that I've become IT manager at a small business. &lt;/p&gt;&#xA;" OwnerUserId="32611" LastActivityDate="2016-12-12T20:09:28.613" Title="How to determine if a port is physically(hardware) bad" Tags="|switch|hardware|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37136" PostTypeId="1" AcceptedAnswerId="37485" CreationDate="2016-12-07T17:15:26.443" Score="4" ViewCount="4802" Body="&lt;p&gt;Does anyone know if there's an equivalent of sh ip bgp X.X.X.X bestpath (from Cisco) in Quagga? I cannot find it in the documentation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="32563" LastActivityDate="2018-04-09T07:20:05.877" Title="Is there any way to display the best bgp route in Quagga?" Tags="|bgp|quagga|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37137" PostTypeId="2" ParentId="34797" CreationDate="2016-12-07T19:14:15.947" Score="1" Body="&lt;p&gt;It depends what kit you are using. You need to worry about straight through VS crossover if neither end supports auto-mdix.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experiance:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All gigabit gear i've seen supports auto-mdix.&lt;/li&gt;&#xA;&lt;li&gt;Most 100 megabit NICs do not support auto-mdix, an exception is the LAN951x series (which is used in a number of well-known SBCs).&lt;/li&gt;&#xA;&lt;li&gt;Every 100 megabit unmanaged switch I've seen supports auto-mdix. &lt;/li&gt;&#xA;&lt;li&gt;Ports on managed networks may not support auto-mdix. Whether this is because the equipment doesn't support it or the admins disabled it (maybe trying to make it harder for users to accidently create loops) I do not know.&lt;/li&gt;&#xA;&lt;li&gt;I've never seen 10 megabit gear that supports auto-mdix.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-12-07T19:14:15.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37142" PostTypeId="2" ParentId="37119" CreationDate="2016-12-07T21:47:55.020" Score="3" Body="&lt;p&gt;You can absolutely do Network Address Translation on the 2900.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a public document here: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/long-reach-ethernet-lre-digital-subscriber-line-xdsl/asymmetric-digital-subscriber-line-adsl/12905-827spat.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/long-reach-ethernet-lre-digital-subscriber-line-xdsl/asymmetric-digital-subscriber-line-adsl/12905-827spat.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not certain what you would be doing with forwarding 5000 and 6000 into the network, but I suppose that's their business.  However it might be helpful if we knew what they are trying to accomplish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've never used the GUI to configure a IOS router.  I suggest using the CLI.  The command: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router #sh ip int br&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;will list your interfaces and help you determine that is inside vs outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit your inside interface, adding the line ip nat inside&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router #conf t&#xA;router (config)#int gi0/1&#xA;router (config-if)#ip nat inside&#xA;router (config-if)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do the same with your outside interface but make sure you tell the router this is the outside NAT interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router (config-if)#int gi0/0&#xA;router (config-if)#ip nat outside&#xA;router (config-if)#end&#xA;router (config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tell the router what you want to NAT with an access list&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router (config)#ip nat inside source list 101 interface gi0/0 overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Build the access list.  An extended access list is required if you want to specify the port.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router (config)#ip access-list extended 101 &#xA;router (config-ext-nacl)#permit tcp any eq 6000 host 1.2.3.4 eq 6000  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll use 1.2.3.4 as the public IP the server on the internet side of the router.  Make sure you identify what the IP reaching out to the biometric device is...  I put &quot;any&quot; in the above example, but it's just an example.  I prefer not to use &quot;any&quot; if at all possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If TCP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router #permit tcp host 172.16.32.250 eq 5000 host 1.2.3.4 eq 5000&#xA;router #permit tcp host 172.16.32.250 eq 6000 host 1.2.3.4 eq 6000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If UDP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router #permit udp host 172.16.32.250 eq 5000 host 1.2.3.4 eq 5000&#xA;router #permit udp host 172.16.32.250 eq 6000 host 1.2.3.4 eq 6000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;END OF EDIT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After the Permit, you can specify the protocol (TCP, UDP, ICMP, ESP, etc) or everything with IP.  You can use host and an IP or IP address + subnet mask.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router (config-if)#end&#xA;router #copy run start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32328" LastEditorUserId="32328" LastEditDate="2016-12-12T15:45:43.730" LastActivityDate="2016-12-12T15:45:43.730" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="37143" PostTypeId="2" ParentId="34797" CreationDate="2016-12-07T22:21:08.617" Score="3" Body="&lt;p&gt;I've come across Cisco router ports not supporting auto-MDX and recently a printer directly connected to a newer laptop with gigabit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understanding 568A vs B is important in other ways.  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;A facility will generally standardize on one or the other and punch patch panels and wall jacks to match this standard throughout the facility or campus.  All of our locations are 568A.  As a medical facility, there is still 100 and 10Mbit equipment.  If we varied, we would have mixed results.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Understanding the pairs and what they do will help you troubleshooting Layer 1 issues.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In some standards, all 4 pairs are used.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When learning you might come across older equipment to lab things up and practice.  This is where you may come across Fast Ethernet equipment that is detailed by Peter and Eddie above.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Patch Cables don't matter - They are not 568A or 568B.  Sure the colors may lie that way, but they are just a patch cable and as long as the pairs line up to Ethernet standard, you are fine.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32328" LastActivityDate="2016-12-07T22:21:08.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37147" PostTypeId="1" CreationDate="2016-12-08T04:35:58.253" Score="1" ViewCount="297" Body="&lt;pre&gt;&lt;code&gt;Cisco#show mls cef maximum-routes&#xA;FIB TCAM maximum routes :&#xA;=======================&#xA;Current :-&#xA;-------&#xA; IPv4                - 1000k &#xA; MPLS                - 8k (default)&#xA; IPv6 + IP Multicast - 8k (default)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to know the maximum forwarding-table routes supported in Juniper MX960.&#xA;What's the command ?&#xA;Thanks&lt;/p&gt;&#xA;" OwnerUserId="32629" LastEditorUserId="8499" LastEditDate="2016-12-08T04:37:44.193" LastActivityDate="2017-04-07T20:58:53.750" Title="mls cef maximum-routes" Tags="|juniper|cef|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37150" PostTypeId="2" ParentId="37089" CreationDate="2016-12-08T09:49:10.470" Score="2" Body="&lt;p&gt;I don't know your full circumstances, but if an accurate figure for device latency really mattered to me then I would hire specialised equipment for this task.  I'm in the UK and there are specialist suppliers who hire out network analysis equipment like this.  You will need a device that can take your payload and generate TCP sessions.  I haven't done this for a while so I don't know who sells what any more.  I used to use Wandel and Goltermann and Smartbits but it was a long time ago.  I also never needed to use real payload myself, but you obviously do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative would be to use a couple of network taps and a packet broker that can apply hardware time-stamps before handing to a simple Wireshark PC.  If the required accuracy is no better than about 100 microseconds, you could even just use two taps and a properly-configured PC with Wireshark.  You will have to ensure that NIC interrupts are not coalesced and there may be other settings to optimise.  Using Wireshark you just match packets across the two captures, and take the time difference.  You can export the capture files to a spreadsheet to match them.  You will need to try to assess what the precision you acheive.  &lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-12-08T09:49:10.470" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37151" PostTypeId="1" CreationDate="2016-12-08T10:35:52.443" Score="0" ViewCount="56" Body="&lt;p&gt;I am learning AODV and if this routing accidentally gives same IP address to two nodes, then how do I send data to this IP address?&lt;/p&gt;&#xA;" OwnerUserId="32632" LastActivityDate="2016-12-08T13:13:39.053" Title="AODV routing accidentally gives two nodes the same IP address" Tags="|routing|wireless|ad-hoc-wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37152" PostTypeId="1" CreationDate="2016-12-08T11:10:16.923" Score="1" ViewCount="163" Body="&lt;p&gt;We are planning to put a Juniper QFX 5200 series switch which has 40G QSFP+ ports in front of the firewall which has QSFP+ 40G ports. They should work well with the 3800 Firewall's QSFP+ 40G port right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually my question is general. Irrespective device types and vendor, 40G QSFP+ will work across the devices right? So this will work without breakout cables and give 40G bandwidth on each link?&lt;/p&gt;&#xA;" OwnerUserId="22114" LastActivityDate="2016-12-12T22:04:57.077" Title="Fortigate 3800 and Juniper QFX 5200 40G connectivity" Tags="|juniper|fortigate|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37155" PostTypeId="2" ParentId="37151" CreationDate="2016-12-08T13:13:39.053" Score="1" Body="&lt;p&gt;Routing protocols, including AODV, do not assign IP addresses.  That is handled by other means (DHCP for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two hosts with the same IP address is an error condition, so that should not happen under normal circumstances.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-08T13:13:39.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37159" PostTypeId="1" AcceptedAnswerId="37263" CreationDate="2016-12-08T15:30:03.660" Score="0" ViewCount="445" Body="&lt;p&gt;I made this topology in GNS3 :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/u6Vpl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u6Vpl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cleared the switches MAC tables. In this way, when PC1 sends an ARP request to know who has the IP 192.168.1.20 (PC2 IP), the request is broadcast through all ports of switch1 and also switch2. I used wireshark to verify this and I saw the ARP request reaching PC3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7kb7s.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7kb7s.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the ARP table of PC3 is empty. Why doesn't it add a new entry for PC1 in his table ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NaO8G.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NaO8G.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this an expected behavior?&lt;/p&gt;&#xA;" OwnerUserId="32641" LastEditorUserId="36720" LastEditDate="2023-06-29T16:40:18.180" LastActivityDate="2023-06-29T16:40:18.180" Title="Should a PC populate its ARP table when a frame is not destined to it?" Tags="|arp|gns3|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="37160" PostTypeId="2" ParentId="37159" CreationDate="2016-12-08T15:33:34.767" Score="2" Body="&lt;p&gt;ARP replies are unicast, so the switch doesn't forward it to PC 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gratuitous ARPs are broadcast so all nodes can hear it.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-08T15:33:34.767" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="37166" PostTypeId="2" ParentId="37147" CreationDate="2016-12-08T19:20:53.077" Score="2" Body="&lt;p&gt;There is no equivalent command in the JunOS CLI that I'm aware of however it's going to be based on the MPC you are using for the forwarding table.  I don't know that Juniper ever gives actual hard limits but I may be able to find the &quot;soft&quot; numbers if you tell me which MPCs you are using.  &lt;/p&gt;&#xA;" OwnerUserId="17172" LastActivityDate="2016-12-08T19:20:53.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37167" PostTypeId="1" AcceptedAnswerId="37168" CreationDate="2016-12-08T19:29:19.050" Score="2" ViewCount="369" Body="&lt;p&gt;This should be simple but I'm missing something. Setting up an ASA 5505 to replace an old Netgear router. Same external IP address and gateway. I'm not getting access to the internet from the inside. What am I missing? Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result of the command: &quot;show running-config&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;: &#xA;: Serial Number: XXXXXXXXXXXX&#xA;: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz&#xA;:&#xA;ASA Version 9.2(4)13 &#xA;!&#xA;hostname dommy&#xA;domain-name XXXXXXXX.com&#xA;enable password XXXXXXXXXXXXXX/m encrypted&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.0.1 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 2XX.198.XXX.250 255.255.255.248 &#xA;!&#xA;ftp mode passive&#xA;dns server-group DefaultDNS&#xA; domain-name XXXXXXXX.com&#xA;object network obj_any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network 2XX.198.XXX.249&#xA; host 2XX.198.XXX.249&#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;!&#xA;object network obj_any&#xA; nat (inside,outside) dynamic interface&#xA;!&#xA;nat (inside,outside) after-auto source dynamic any interface&#xA;route inside 0.0.0.0 0.0.0.0 2XX.198.XXX.249 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;http server enable&#xA;http 192.168.0.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpool policy&#xA;telnet timeout 5&#xA;no ssh stricthostkeycheck&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;&#xA;dhcpd address 192.168.0.20-192.168.0.50 inside&#xA;dhcpd dns 8.8.8.8 8.8.4.4 interface inside&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;Cryptochecksum:56564d7342353trg628041c21f71f2965&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27364" LastEditorUserId="8499" LastEditDate="2016-12-08T19:29:36.853" LastActivityDate="2016-12-09T13:49:24.060" Title="ASA5505 - no outside access" Tags="|cisco-asa|cisco-c5500|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37168" PostTypeId="2" ParentId="37167" CreationDate="2016-12-08T19:31:43.990" Score="2" Body="&lt;pre&gt;&lt;code&gt;route inside 0.0.0.0 0.0.0.0 2XX.198.XXX.249 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe you want this to say &lt;code&gt;route outside&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-08T19:31:43.990" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37170" PostTypeId="2" ParentId="37089" CreationDate="2016-12-08T19:34:10.577" Score="2" Body="&lt;p&gt;I think the easiest way to test &lt;em&gt;real-world&lt;/em&gt; latency of your firewall would be to add a second NIC to your sender PC that connects to the external subnet of the firewall, making it the receiver PC as well (you could use physical NICs or VLANs depending on your setup).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Start Wireshark and capture the traffic on both NICs, then start your communication tests. You can easily see the time difference between the sent and received packets b/c both are based on the same clock.&lt;/p&gt;&#xA;" OwnerUserId="32648" LastActivityDate="2016-12-08T19:34:10.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37171" PostTypeId="1" CreationDate="2016-12-08T19:40:25.370" Score="3" ViewCount="136" Body="&lt;p&gt;Seems like a rudimentary question, but I'd like to use an &quot;old&quot; HP Procurve 2610 10/100 switch to provide POE connectivity to a new batch of ~25 deskphones.  It appears as though a generic bandwidth requirement is about 100 kbps for each phone/line.  Thus, it seems like I should only require ~ 2.5 mbps for all my deskphones to make calls concurrently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any reason to think about using a gigabit POE switch for voice connectivity or should I expect the following solution to work well for such a small office?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/a6PgH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/a6PgH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-12-09T15:29:19.587" Title="Is a 10/100 switch sufficient for Voice?" Tags="|switching|power-over-ethernet|voice|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37172" PostTypeId="2" ParentId="37171" CreationDate="2016-12-08T19:45:12.213" Score="6" Body="&lt;p&gt;If only phones are connected to the switch, you should be fine.  If you also have PCs connected in tandem (switch&amp;lt;-&gt;phone&amp;lt;-&gt;PC), then you need to worry about QoS capabilities on the switch.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-08T19:45:12.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37173" PostTypeId="2" ParentId="37111" CreationDate="2016-12-08T20:01:16.057" Score="0" Body="&lt;p&gt;&lt;strong&gt;TLDR:&lt;/strong&gt; keep it simple and use a switch as Babak and EBrown have already suggested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using a SOHO router as a switch by disabling the DHCP service should work, however, might cause headaches later if it gets accidentally reset (not entirely unlikely if it's not on a UPS). You could end up with conflicting gateway IP, overlapping DHCP scopes, subnet with no internet connection, etc. These are not trivial to diagnose if you don't know what to look for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, leaving the second DHCP server enabled on purpose might work for business class devices, however, it's probably not possible here b/c SOHO routers typically assign themselves as the gateway (and sometimes as the DNS server) without any option to change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Save yourself future headaches with a small investment in a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should have been a comment, but not enough rep yet ;-)&lt;/p&gt;&#xA;" OwnerUserId="32648" LastActivityDate="2016-12-08T20:01:16.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37174" PostTypeId="1" AcceptedAnswerId="37175" CreationDate="2016-12-08T20:28:56.660" Score="0" ViewCount="225" Body="&lt;p&gt;I use Cisco SPA 122 to convert analog signals (eg fax signals) into a digital signal capable of being transmitted in SIP communications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that when I plug in a postage meter or a credit card terminal, the center is never reached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know a way to make this transmission to work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In France, these machines call surtaxed numbers like  &lt;code&gt;0800 ... ...&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="19787" LastActivityDate="2016-12-08T21:17:20.467" Title="How use Cisco Spa 122 for credit card terminal / postage meter" Tags="|cisco|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37175" PostTypeId="2" ParentId="37174" CreationDate="2016-12-08T21:17:20.467" Score="3" Body="&lt;p&gt;You are basically using a MODEM in the device working over SIP.  Modems work with modulated audio signals to indicate bits of data.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SIP traffic is unreliable (UDP) network traffic, data packets are not re-transmitted if dropped or received out of order (jitter).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some of the codecs (Coder Decoders) can prevent successful communications because of the lossy compression, meaning the sound may have changed.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm guessing you may have heard phone calls that sound like they are &quot;tinny&quot;.  That is because of the fidelity lost in the compression process.  It's like comparing JPG to GIF - JPG removes some of the data, but generally not enough to make it grainy.  Or MP3 vs. WAV audio files - you wouldn't want to listen to 56k music, but for voice it would be fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of things you can do to ensure success modem communications most or perhaps all of the time over SIP:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use the G.711 codec - This gives you enough audio bandwidth to pass all of the modem communications tones.  G.722 will be even better if available.&lt;/li&gt;&#xA;&lt;li&gt;Drop the modem speed to 36K or lower.  Lower speeds will be more forgiving to some packet drop or jitter.&lt;/li&gt;&#xA;&lt;li&gt;Turn off error correction on the terminal device if possible.  We have fax machines that run more reliably set this way.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32328" LastActivityDate="2016-12-08T21:17:20.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37176" PostTypeId="2" ParentId="2501" CreationDate="2016-12-08T22:07:54.317" Score="0" Body="&lt;p&gt;It works except on ASA devices. The key is you have to have destination file name. Whether you use x.x.x.x:flash:filename or x.x.x.x://filename&lt;/p&gt;&#xA;" OwnerUserId="32650" LastActivityDate="2016-12-08T22:07:54.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37180" PostTypeId="1" AcceptedAnswerId="37206" CreationDate="2016-12-09T01:52:45.567" Score="0" ViewCount="2987" Body="&lt;p&gt;I have 2 PCs connected to each other using two 1 Gbps ethernet link, to have an aggregate data bandwidth of 2 Gbps. In IxChariot, I can create multiple TCP pairs and split them into:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC1_LAN1 &amp;lt;-&amp;gt; PC2_LAN1 (5 TCP pairs)&#xA;PC1_LAN2 &amp;lt;-&amp;gt; PC2_LAN2 (5 TCP pairs)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IxChariot aggregates these as 10 TCP pairs and runs a 2 Gbps throughput test. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to do something similar using iPerf. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In iPerf, I could run 2 parallel iPerf instances on a single client, 1st instance holding IP of PC2_LAN1 &amp;amp; 2nd instance holding IP of PC2_LAN2. This tries to utilize the 2 ethernet links on the server side. But how can I make,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1st iperf instance send packets on PC1_LAN1 &amp;lt;-&gt; PC2_LAN1 (5 TCP pairs)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; iperf -c PC2_LAN1 -P 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;, and make &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2nd iperf instance send packets on PC1_LAN2 &amp;lt;-&gt; PC2_LAN2 (5 TCP pairs).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; iperf -c PC2_LAN2 -P 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4270" LastEditorUserId="4270" LastEditDate="2016-12-10T22:36:17.970" LastActivityDate="2016-12-10T22:36:17.970" Title="Use iperf to split multiple tcp streams between 2 NIC on same client (similar to IxChariot)" Tags="|ethernet|tcp|bridge|throughput|iperf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37181" PostTypeId="1" AcceptedAnswerId="37190" CreationDate="2016-12-09T03:03:20.130" Score="3" ViewCount="3457" Body="&lt;p&gt;I have this task. I need to find the way how to configure a trunk in this switch for 3 VLANS 200,201 and 1(native) . I already read the guide. In this switches you need to activate the vlan and then change the port to switchport (layer 2) the you configure it the port inside the vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;interface vlan 200&lt;/p&gt;&#xA;&#xA;&lt;p&gt;tagged gi 0/3&lt;/p&gt;&#xA;&#xA;&lt;p&gt;exit&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and that interface is already a trunk for vlan 200. I did the same with vlan 201 but with vlan 1 I dont have that option.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Fzsg6.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fzsg6.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I dont have the untagged and tagged options. Also I dont see the ip routing option to alloq Vlan communication. How can I do it in this switch?&lt;/p&gt;&#xA;" OwnerUserId="14378" LastEditorUserId="32282" LastEditDate="2016-12-09T12:59:05.430" LastActivityDate="2017-02-19T02:01:23.827" Title="Dell force10 mxl 10/40gbe create trunk port" Tags="|dell|force10|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37182" PostTypeId="2" ParentId="5748" CreationDate="2016-12-09T06:32:52.457" Score="0" Body="&lt;p&gt;You should have to anounce your connected interfaces on R2. because the only network 192.168.1.0 does not now what is the next hop. &#xA;You can checking with &lt;strong&gt;&quot;show ip bgp&quot;&lt;/strong&gt; on R3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see 192.168.1.0 in R3 bgp table but not inserted to routing table. Because it does not know what is the next-hop&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Solution:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Redistribute connected interfaces on R2&lt;/li&gt;&#xA;&lt;li&gt;Say EBGP neighbor that who is next hop as &quot;&lt;strong&gt;neighbor 172.16.1.2 next-hop-self&lt;/strong&gt;&quot; on &lt;strong&gt;R1&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="32656" LastActivityDate="2016-12-09T06:32:52.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37184" PostTypeId="1" CreationDate="2016-12-09T10:36:29.070" Score="1" ViewCount="1543" Body="&lt;p&gt;I would like to configure a MAC ACL on my cisco router. From the official CISCO documentation I can see this is done by typing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco# configure terminal&#xA;cisco(config) # mac access-list &amp;lt;mac-list-name&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However when I use this I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisco(config)#mac access-list mac-Permit&#xA;                   ^&#xA;% Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I noticed in config mode there is a command of it's own called access-list and in here I assume I can use this to configure single rules. Is this where it is supposed to be done or am I missing something? Why does the mac access-list command not work? Is it not supported on my software version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Version: c1900-universalk9-mz.SPA.153-1.T1.bin - 15.0(1r)M16&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advanced.&lt;/p&gt;&#xA;" OwnerUserId="32660" LastEditorUserId="32660" LastEditDate="2016-12-09T11:43:14.747" LastActivityDate="2016-12-10T00:19:52.467" Title="Cisco C1900 on 1921/K9 router. Mac address ACL" Tags="|cisco|cisco-commands|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="37185" PostTypeId="1" AcceptedAnswerId="37186" CreationDate="2016-12-09T11:18:29.023" Score="1" ViewCount="52" Body="&lt;p&gt;Can I make several VLANs in a typical Catalyst (for instance, Cisco C3640) that share the same addressing? For example:&#xA;vlan 1 -&gt; address in Fa0/0.1: 3.3.3.1/29&#xA;vlan 2 -&gt; address in Fa0/0.2: 3.3.3.2/29&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="32663" LastActivityDate="2021-01-24T10:39:23.277" Title="Cisco Catalyst: interVLAN with shared addressing" Tags="|cisco|vlan|ip|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37186" PostTypeId="2" ParentId="37185" CreationDate="2016-12-09T11:24:32.890" Score="2" Body="&lt;p&gt;If you want to use same adressing that means it will be one network you can not separate it two vlan.&lt;/p&gt;&#xA;" OwnerUserId="32664" LastActivityDate="2016-12-09T11:24:32.890" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="37190" PostTypeId="2" ParentId="37181" CreationDate="2016-12-09T13:47:54.913" Score="0" Body="&lt;p&gt;VLAN 1 is the native VLAN, which means its traffic is untagged. That is fine for a trunk because it will be the only VLAN with untagged traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You tag traffic on trunks so that the other end of the trunk can separate which frames belong to which VLANs. Having a single untagged (native) VLAN will work with this. It is only if you have multiple untagged VLANs on a trunk where you couldn't separate the frames into VLANs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-09T13:47:54.913" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37192" PostTypeId="2" ParentId="37184" CreationDate="2016-12-09T14:15:08.950" Score="0" Body="&lt;p&gt;I searched for the feature MAC ACL in the Cisco Feature Navigator and I found a mention to 'MAC Filtering'. After clicking the in the description of the feature, I was redirected to a document (the one mentioned before) and I didn't realize it's a document for the XE platform (my apologies). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found, however, a document named 'Security Configuration Guide: Access Control Lists, Cisco IOS Release&#xA;15M&amp;amp;T', and I didn't find any mention to MAC filtering for this specific IOS. I might be wrong, but it looks like we could conclude that this IOS doesn't support it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look in the document: &#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/15-mt/sec-data-acl-15-mt-book.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_data_acl/configuration/15-mt/sec-data-acl-15-mt-book.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32602" LastActivityDate="2016-12-09T14:15:08.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37195" PostTypeId="2" ParentId="37152" CreationDate="2016-12-09T15:01:49.843" Score="0" Body="&lt;p&gt;Yes they should work just fine as long as the proper optics and jumpers are used on each end.&lt;/p&gt;&#xA;" OwnerUserId="17172" LastActivityDate="2016-12-09T15:01:49.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37196" PostTypeId="2" ParentId="37171" CreationDate="2016-12-09T15:29:19.587" Score="1" Body="&lt;p&gt;A 10/100 switch should suffice from a bandwidth perspective. But I would recommend considering a Gigabit switch for it's full duplex capabilities if your existing 10/100 (FastEthernet) switch is only capable of half duplex.&lt;/p&gt;&#xA;" OwnerUserId="16882" LastActivityDate="2016-12-09T15:29:19.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37197" PostTypeId="2" ParentId="28372" CreationDate="2016-12-09T16:12:16.747" Score="0" Body="&lt;p&gt;Physical cable is required. It's security function. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ron Maupin said, you can ask TAC to submit a feature request but I think you're going to have a hard time making a business case for it. &lt;/p&gt;&#xA;" OwnerUserId="21983" LastActivityDate="2016-12-09T16:12:16.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37198" PostTypeId="2" ParentId="35958" CreationDate="2016-12-09T18:15:29.827" Score="-4" Body="&lt;p&gt;100.64.0.0 this ip belongs to class A ip address. There are some range of private ip address for each class of ip address. For class A private ip range is 10.0.0.0/8. So if you want a private ip from class A then that belongs to 10.x.x.x ip segment. You cant allocate 100.64.0.0 ip address as a private ip.&lt;/p&gt;&#xA;" OwnerUserId="32383" LastActivityDate="2016-12-09T18:15:29.827" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="37199" PostTypeId="2" ParentId="33512" CreationDate="2016-12-09T19:02:25.963" Score="0" Body="&lt;p&gt;In your topology R3 &amp;amp; R4 is a OSPF point to point connection. So there are no DR or BDR election. The neighbourship between r3 and r4 in a FULL state always. But r3 and r2 only from adjacency no neighbourship is fromed between them because r1 elected as a DR among them. So r3 and r1 , r2 and r1 will only from neighbourship &lt;/p&gt;&#xA;" OwnerUserId="32383" LastActivityDate="2016-12-09T19:02:25.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37200" PostTypeId="1" AcceptedAnswerId="43310" CreationDate="2016-12-09T20:15:10.790" Score="2" ViewCount="8707" Body="&lt;p&gt;I am having a little bit of a problem setting up a IKEv2 site to site to Azure cloud. I am using the IPSec permaeters from &lt;a href=&quot;https://docs.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;this&quot;&gt;this&lt;/a&gt; document.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phase1 is established, but I cant figure out Phase2, here is the crypto config:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Config&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set azure-ipsec-proposal-set esp-aes-256 esp-sha-hmac&#xA;crypto ipsec ikev2 ipsec-proposal azure-ikev2-ipsec-proposal-set&#xA; protocol esp encryption aes-gcm-256&#xA; protocol esp integrity sha-1&#xA;crypto ipsec security-association lifetime seconds 3600&#xA;crypto ipsec security-association lifetime kilobytes 102400000&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto map outside_map 10 match address vpn-traffic-ikev2&#xA;crypto map outside_map 10 set peer 1.1.1.1&#xA;crypto map outside_map 10 set ikev2 ipsec-proposal azure-ikev2-ipsec-proposal-set&#xA;crypto map outside_map interface outside&#xA;crypto ca trustpool policy&#xA;crypto ikev2 policy 5&#xA; encryption aes-256 3des&#xA; integrity sha256 sha&#xA; group 2&#xA; prf sha&#xA; lifetime seconds 10800&#xA;crypto ikev2 enable outside&#xA;crypto ikev2 enable Comcast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Debug&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;Its lengthy so I will just paste where the problem is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IKEv2-PROTO-2: (34): Processing IKE_AUTH message&#xA;IKEv2-PROTO-1: (34): Failed to find a matching policy&#xA;IKEv2-PROTO-1: (34): Received Policies:&#xA;ESP: Proposal 1:  AES-GCM-256 Don't use ESN&#xA;&#xA;ESP: Proposal 2:  AES-CBC-256 SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 3:  AES-CBC-256 SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 4:  AES-CBC-128 SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 5:  3DES SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 6:  3DES SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 7:  DES SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 8:  AES-CBC-256 SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 9:  AES-CBC-256 SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 10:  AES-CBC-256 SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 11:  AES-CBC-128 SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 12:  AES-CBC-128 SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 13:  AES-CBC-128 SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 14:  3DES SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 15:  3DES SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 16:  3DES SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 17:  AES-CBC-256 SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 18:  AES-CBC-256 SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 19:  AES-CBC-256 SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 20:  AES-CBC-256 SHA96 Don't use ESN&#xA;&#xA;ESP: Proposal 21:  AES-CBC-256 SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 22:  AES-CBC-128 SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 23:  AES-CBC-128 SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 24:  AES-CBC-128 SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 25:  AES-CBC-128 SHA256 Don't use ESN&#xA;&#xA;ESP: Proposal 26:  3DES SHA96 Don't use ESN&#xA;&#xA;IKEv2-PROTO-1: (34): Failed to find a matching policy&#xA;IKEv2-PROTO-1: (34): Expected Policies:&#xA;IKEv2-PROTO-5: (34): Failed to verify the proposed policies&#xA;IKEv2-PROTO-1: (34): Failed to find a matching policy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So from the debug its obvious that I have the policies messed up during the Phase2 negotiation process, but according to debug Proposal 1 should be AES-GCM-256, which is what I have configured.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Phase1 Tunnel&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IKEv2 SAs:&#xA;Session-id:44, Status:UP-IDLE, IKE count:1, CHILD count:0&#xA;&#xA;Tunnel-id     Local                Remote     Status         Role&#xA;980175485     2.2.2.2/500     1.1.1.1/500      READY    RESPONDER&#xA;      Encr: AES-CBC, keysize: 256, Hash: SHA96, DH Grp:2, Auth sign: PSK, Auth verify: PSK&#xA;      Life/Active Time: 10800/26 sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4271" LastActivityDate="2018-07-24T05:19:50.393" Title="IKEv2 Site to Site from Cisco ASA 5506 to Azure &quot;RouteBased&quot; VPN" Tags="|cisco-asa|vpn|ike|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37202" PostTypeId="2" ParentId="28652" CreationDate="2016-12-09T22:45:19.787" Score="2" Body="&lt;p&gt;I too recommend a Wireless survey.  This avoids dead spots and other issues.  With 2.4Ghz APs, you only have 3 clear channels that do not overlap.  5Ghz isn't so much of a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might be able to get sufficient wireless coverage with 3 APs.  Omni-directional antennas transmit like a bagel, Directly above and below aren't the best spot.  Maybe two on the lower floor on the ceiling at each end and one on the second floor in the middle.  Without a survey it'll be a guess, but we can apply some logic anyway.  You can always lay it out and use the freebie Ekahau heat mapper to see what it looks like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I highly recommend isolating your voice traffic from your LAN traffic with a voice VLAN.  The SG200 switches are voice aware.  A voice aware switch should use QoS to prioritize voice traffic above your other traffic to avoid jitter and lost of frames.  Voice traffic uses UDP protocol which isn't reliable (but it's fast).  Traffic is dropped if network congestion happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some APs can do a Captive Portal mode where they either have a micro webserver or push the client to an external webserver (external from the AP).  I advise you use something like this and have an Acceptable Use Policy that they must accept prior to accessing the internet.  This limits your liability in the event they do something illegal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the 2800 AP, it's a thin AP and on Cisco's site you will find a bullet that reads &quot;Cisco Mobility Express and controller based&quot;.  Cisco Mobility Express can be purchased with some of the more expensive switches (such as a 3650).  Look for something like the 300 series.  They support Captive Portal as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your public network needs to be isolated from your internal traffic so people cannot access your business data.  If you use VLAN, it must not have any route to your internal network.  I recommend physical isolation so there is no chance of data leakage.  Just pull a cable to a router network port (not a switched port but a VLAN or routed port).  I also recommend using some kind of guest isolation so public wireless network users are not attempting to penetrate other public users devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your wireless LAN can be on the same subnet as your LAN or on a different one.  If different, it needs to be routed by your router.  If your internal wireless users are going to have full network access, I'd just flatten it out to make it simple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your Router needs to be able to have virtual sub interfaces for VLAN or have multiple physical interfaces so you can send the guest traffic to the router directly.  The Cisco RV215W has &quot;Separate &quot;virtual&quot; networks to limit access to sensitive information&quot; in it's description, so look at a router that has that kind of description.  Whatever product you might choose, download and read the manuals to see if they will do what you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireless routers are not really that great.  I have a Cisco RV180W at home and I loose a lot.  Enough that I want to move it, but that complicates things because I have an AP in the back of the house (for the yard...), a NAS, a wired Blu-ray.  Next purchase will be an AP that will be in the living room coat closet...I have it wired already for PoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question - what is your phone system?  Something hosted?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at web managed switches and APs such as Meraki - They are pretty cool and if you attend a webinar, you can get a switch and an ap for free.  However the cost model is a subscription.  If you get a subscription model device, buy with the most years you can get up front as the prices increase over time.&lt;a href=&quot;https://i.stack.imgur.com/QiGvb.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QiGvb.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's really a fairly simple network layout. You might need multiple connections to the router for each VLAN if it can't trunk like this:&lt;a href=&quot;https://i.stack.imgur.com/zYvqL.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zYvqL.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32328" LastActivityDate="2016-12-09T22:45:19.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37203" PostTypeId="2" ParentId="37184" CreationDate="2016-12-10T00:19:52.467" Score="2" Body="&lt;p&gt;MAC access lists can be defined numerically in any standard IOS in the ranges of 1100-1199 for extended or 700-799 for basic, as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#access-list ?&#xA;  &amp;lt;1-99&amp;gt;            IP standard access list&#xA;  &amp;lt;100-199&amp;gt;         IP extended access list&#xA;  &amp;lt;1100-1199&amp;gt;       Extended 48-bit MAC address access list&#xA;  &amp;lt;1300-1999&amp;gt;       IP standard access list (expanded range)&#xA;  &amp;lt;200-299&amp;gt;         Protocol type-code access list&#xA;  &amp;lt;2000-2699&amp;gt;       IP extended access list (expanded range)&#xA;  &amp;lt;2700-2799&amp;gt;       MPLS access list&#xA;  &amp;lt;300-399&amp;gt;         DECnet access list&#xA;  &amp;lt;700-799&amp;gt;         48-bit MAC address access list&#xA;  compiled          Enable IP access-list compilation&#xA;  dynamic-extended  Extend the dynamic ACL absolute timer&#xA;  rate-limit        Simple rate-limit specific access list&#xA;&#xA;router(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So - that's how you &lt;em&gt;define&lt;/em&gt; a mac access list.  As per my comment, however, it may not behave the way you think it does.  It's actually intended for use with bridging - so, for example, blocking a specific MAC address from passing through a bridge group.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not really analogous to the MAC filtering you might find on a consumer router in that there isn't a way to simply say &quot;don't accept traffic from mac address x&quot; on a standard routed interface.  If you want to use IRB (see &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/bridging/configuration/guide/15_2s/br_15_2s_book/br_transprnt_brdg.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;CCO Transparent Bridging Configuration Guide&lt;/a&gt;) you could put the IP on a BVI and then join it and one or more Ethernet interfaces into a bridge-group and then apply MAC filters via access-expressions on the physical interfaces (...thus allowing/preventing certain MAC addresses, or ranges of addresses, from making it to the BVI).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best way to put it might actually be that the sort of MAC filtering you see on a consumer network device is actually part of the &lt;em&gt;switch&lt;/em&gt; (..to include any integrated AP) while IP-based rules are likely part of the router.  To this end - if you were using a Cisco switch then you could apply MAC filters in a pretty straightforward way via VACL's or PACL's.  On a device acting as a pure router, however, it's going to be a different story.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-10T00:19:52.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37205" PostTypeId="2" ParentId="25932" CreationDate="2016-12-10T03:13:18.217" Score="0" Body="&lt;p&gt;AIUI 100BASE-TX without autonegotiation relies on carrier detection to determine if the link is up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder if a possible soloution would be to get a third network card and hook it's transmit lines up to the receive lines on the card used to send data. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-12-10T03:13:18.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37206" PostTypeId="2" ParentId="37180" CreationDate="2016-12-10T03:44:07.713" Score="0" Body="&lt;p&gt;Well that was easy, all we need to do is 'bind' the IP address and/or port to the client. For example,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iperf -c PC2_LAN1 -P 5 -B PC1_LAN1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;AND&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iperf -c PC2_LAN2 -P 5 -B PC1_LAN2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;splits the data on two different LAN connections on the Client PC as well as the Server PC. This is quite useful for WiFi testing of data rate &gt; 1 Gbps.&lt;/p&gt;&#xA;" OwnerUserId="4270" LastActivityDate="2016-12-10T03:44:07.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37207" PostTypeId="2" ParentId="5818" CreationDate="2016-12-10T05:50:47.247" Score="0" Body="&lt;p&gt;The type of SFP transciver you use is determiend by the fiber type.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to chose between singlemode and multimode. Singlemode fiber is cheaper than multimode but the transcievers are more expensive and the termination must be performed more carefully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Singlemode fiber tends to be more future proof than multimode. Current high grade multimode fiber (OM4) will support 1G and 10G over the distance you are working at but is likey to have difficulty handling anything above that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest asking your installation contractor to price out both OM4 multimode and singlemode options and if the cost of the singlemode option is the same or only a little higher to go with the single mode option.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-12-10T05:50:47.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37210" PostTypeId="1" AcceptedAnswerId="37227" CreationDate="2016-12-10T13:43:51.883" Score="0" ViewCount="70" Body="&lt;p&gt;I am new to setting up a site-to-site VPN and I just wanted to clarify how you set one up. I'm a little confused at where to configure the S-2-S VPN as several sources say on router or firewall. Do you need to do configuration on both router and firewall? Do you even need a firewall to do it? or can you just configure it between routers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="23768" LastActivityDate="2016-12-11T01:00:57.107" Title="Site-to-Site VPN - verificaton" Tags="|router|vpn|firewall|" AnswerCount="1" CommentCount="5" ClosedDate="2019-02-17T00:11:38.283" ContentLicense="CC BY-SA 3.0" />
  <row Id="37213" PostTypeId="1" CreationDate="2016-12-10T14:33:32.693" Score="1" ViewCount="75" Body="&lt;p&gt;I have 2 hosts, called client1 and client2, connected with a switch and this switch with another host called firewall, having access only with firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to forbid ping between clients? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firewall have a dhcp server too, I don't know if dhcp server have an option for this.&lt;/p&gt;&#xA;" OwnerUserId="32694" LastEditorUserId="21048" LastEditDate="2017-08-01T11:28:58.513" LastActivityDate="2017-08-01T11:28:58.513" Title="Forbidden icmp package between hosts?" Tags="|icmp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37214" PostTypeId="2" ParentId="37213" CreationDate="2016-12-10T15:19:32.290" Score="1" Body="&lt;p&gt;You can forbid that in a few ways. If your users are on different VLANs, you can impose the firewall between them, or a layer-3 switch could have an ACL between the VLANs. If you use something like a private VLAN, the users cannot communicate with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most cases, the users are on the same VLAN on a layer-2 switch, and you simply cannot control traffic between them because one host communicates directly to the other host via layer-2, and ICMP is a layer-3 protocol.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-10T15:44:39.607" LastActivityDate="2016-12-10T15:44:39.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37219" PostTypeId="2" ParentId="35688" CreationDate="2016-12-10T19:51:03.537" Score="4" Body="&lt;p&gt;These are normal log messages for a port bouncing on a HP Procurve/Aruba switch.  The normal sequence of events for a port (connected to a non-STP edge host as most IP phones are) coming on-line and then off-line is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Port is Blocked by STP&lt;/li&gt;&#xA;&lt;li&gt;Port is now on-line&lt;/li&gt;&#xA;&lt;li&gt;Port is now off-line&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The port enters STP blocked when it is first brought up.  There is a 3 second delay before the port can be brought on-line.  This is due to the auto-edge feature, which waits 3 seconds and if it doesn't receive any STP BPDUs, it decides the port is an STP edge port and brings it on-line without waiting for the normal STP timers.  When the port goes down, we see the off-line message.  In your case I guess the port isn't staying up for 3 seconds, so you only see messages 1 &amp;amp; 3.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want, you can set the port to admin-edge-port, which may bring it on-line without the 3 second delay, but this isn't really going to help due to the cabling fault.  You need to troubleshoot the cabling fault.  The messages are normal and don't indicate any STP issues.&lt;/p&gt;&#xA;" OwnerDisplayName="user27899" LastActivityDate="2016-12-10T19:51:03.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37221" PostTypeId="1" CreationDate="2016-12-10T22:42:16.347" Score="2" ViewCount="2776" Body="&lt;p&gt;I readed some articles but I still don't undestand the difference, &#xA;is point-to-point transmites unicast messages, so point-to-multipoint uses broadcasts ?&#xA;is point-to-point consist of one dedicated physical cable, so point-to-multipoint consist of shared routes ?....&#xA;and wich topology is used in Internet and Ethernet ?&lt;/p&gt;&#xA;" OwnerUserId="32700" LastActivityDate="2016-12-11T02:30:52.290" Title="point-to-point VS point-to-multipoint" Tags="|ethernet|internet|point-to-point|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37222" PostTypeId="2" ParentId="33273" CreationDate="2016-12-10T23:35:59.097" Score="1" Body="&lt;p&gt;If you're working on this file  --  3.2.4.7 Packet Tracer - Troubleshooting a VLAN Implementation - Scenario 1.pka&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC5 is actually connected on Fa0/17 on S3 and not on Fa0/18(check by hovering to the green dot on S3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-this is one of the flaws that I've seen on this activity file, other than wrong switch labels for ip addressing table, wrong port labels on logical diagram(i.e G1/1 instead of G0/1, etc.), and stuck to 60/70% completion even when everything is all good.&lt;/p&gt;&#xA;" OwnerUserId="32702" LastActivityDate="2016-12-10T23:35:59.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37225" PostTypeId="2" ParentId="37221" CreationDate="2016-12-11T00:03:00.537" Score="3" Body="&lt;p&gt;Most of time, the terms point to point or point to multipoint refer to logical topology, not physical topology.  One can configure P2P or P2MP on various type of media, and the ability to use broadcasts depends on the type of media you have.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet is usually considered a broadcast media, where every station can hear every other station, but modern switched Ethernet makes it act like P2P, because the switch connects a sender and receiver with a single logical connection.  And when you have a single Ethernet cable connecting two devices, that can also be considered a P2P connection although the media is still broadcast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the context of OSPF configuration, again it's a logical topology, so you get to decide how it's configured.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-11T00:03:00.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37226" PostTypeId="2" ParentId="19768" CreationDate="2016-12-11T00:05:32.957" Score="2" Body="&lt;p&gt;I use my clear modem as a regular wifi router.&#xA;Power up your old clear modem. Connect to it through wifi signal. Log in to it through browser, type clearmodem/ or 192.168.15.1 in search field. Default password is &quot;admin&quot;. Once in there find DHCP and turn it off (uncheck the box). Plug one end of ethernet cable to you ISP router (e.g. Arris) and another end to LAN port of clear modem. This is it. Easy peasy.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/EIbVQ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EIbVQ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32704" LastActivityDate="2016-12-11T00:05:32.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37227" PostTypeId="2" ParentId="37210" CreationDate="2016-12-11T01:00:57.107" Score="2" Body="&lt;p&gt;To answer some of your basic questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You only need two devices to establish a site-to-site tunnel.  Very often those devices are routers and/or firewalls.  Especially in small or medium business a device which is really a router AND firewall in one (an appliance) is used.  You don't &lt;em&gt;need&lt;/em&gt; a firewall per se, but it would be silly not to have one in place on each end of real production sites because a firewall allows you to configure rules to permit only the type of traffic coming from a specific person/place to traverse your private network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your question about configuring both the router and firewall: Yes, you'll need to build the tunnel and also configure the rules in the firewall to allow the traffic from the trusted site, otherwise your hosts at site A will not be able to communicate to your hosts at site B.  Again, the firewall is often the same device as the router, but both areas still need to be configured specifically for what you're trying to acheive in the end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The steps for building a tunnel between sites varies depending on what kind of hardware one uses, but a generic description for Cisco is &lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/867-cisco-router-site-to-site-ipsec-vpn.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.  This will give you an idea of what's involved.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-12-11T01:00:57.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37228" PostTypeId="2" ParentId="37221" CreationDate="2016-12-11T02:30:52.290" Score="1" Body="&lt;p&gt;These terms refer to Wide Area Networking at the &lt;em&gt;link layer&lt;/em&gt;, i.e., data link layer.  Sites/branch offices can be connected via dedicated end-to-end links (point to point) or they can be connected via a single link to a shared infrastructure, sometimes called a cloud.  The benefit of the mesh topology vs point to point is that spokes/branch offices can:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;communicate directly with other spokes without having to route (hairpin) through a central site.  &lt;/li&gt;&#xA;&lt;li&gt;utilize a single link to the mesh cloud (provider) vs having to provision several (n+1) links.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Frame relay and MPLS are often implemented as mesh topologies, called Non Broadcast Multi Access (NBMA).  Layer 2 Ethernet WAN's are very popular now.  This would be a Broadcast Multi Access (BMA).  In any case, these terms refer to the passing of &lt;em&gt;frames&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Internet (as in Internet Protocol, IP) is a higher layer / level communications model whereby &lt;em&gt;packets&lt;/em&gt; are routed based on available underlying &lt;em&gt;links&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-11T02:30:52.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37230" PostTypeId="1" AcceptedAnswerId="37238" CreationDate="2016-12-11T03:37:58.090" Score="1" ViewCount="145" Body="&lt;p&gt;I am trying to accommodate the following situation and am looking for guidance on whether the topology I am envisioning is possible, what are its implications and what else I should be thinking about. I am new to networking and, thus, have a lot of confusion/questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have n wireless devices positioned around a room. I want another wireless device d1 to be able to form a network with these n devices such that d1 has a direct route to each other device.  Basically this is a star graph with d1 at the center. Is this possible? I want a packet from d1 to r1 to not need to route through some intermediary node. I know they can form an ad hoc network, but then I have no guarantees about direct routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My real problem is that I want to have an arbitrary number of d's {d1..dn} where each di is the center of its own star graph with each r1..rn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If all of these devices are in a network together, can I send ethernet/Wi-Fi frames directly to MAC addresses?&lt;/p&gt;&#xA;" OwnerUserId="31969" LastEditorUserId="8499" LastEditDate="2016-12-11T15:19:10.220" LastActivityDate="2016-12-11T15:19:10.220" Title="Overlay star network topology" Tags="|ad-hoc-wireless|topology|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37233" PostTypeId="1" CreationDate="2016-12-11T11:36:47.010" Score="2" ViewCount="1305" Body="&lt;p&gt;I'm trying to figure out what is the difference between ACLs, Firewall and static rules in FloodLight OpenFlow controller. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having look at &lt;a href=&quot;https://floodlight.atlassian.net/wiki/display/floodlightcontroller/Floodlight+REST+API&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://floodlight.atlassian.net/wiki/display/floodlightcontroller/Floodlight+REST+API&lt;/a&gt;, there are 3 different things I can do about the controller. I can define ACLs, Firewall rules and static entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a network background and I know that basically ACL = firewall. Now, coming to the OpenFlow and SDN world, it's hard for me to understand the difference between the 3 of them. Can somebody please explain it? &lt;/p&gt;&#xA;" OwnerUserId="32516" LastActivityDate="2018-03-11T06:36:22.763" Title="FloodLight OpenFlow controller - ACLs, Firewall, static rules - what is the difference between them?" Tags="|firewall|acl|sdn|openflow|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37235" PostTypeId="1" AcceptedAnswerId="39020" CreationDate="2016-12-11T12:47:28.390" Score="1" ViewCount="401" Body="&lt;p&gt;I have an Intel h2000 4 module (s2000WP mobi's) chassis with 2 port (Chipset 82599 x520 sfp+ card in each module. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wanting to buy/use a J9264A HP 6600 procurve 24+4 that has 4 SFP+ 10GBE ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have bought HP X242 10G SFP+ to SFP+ 3m DAC Cable J9283B DAC cables that are happily compatable with the procurve 6600 switch &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was told the intel x520 should also connect to nearly anything and all should be well does this sound right ??&lt;/p&gt;&#xA;" OwnerUserId="32715" LastEditorUserId="32715" LastEditDate="2016-12-12T15:21:21.603" LastActivityDate="2017-02-17T17:09:54.310" Title="Intel x520 SFP+ connecting to a J9264A HP Procure 6600 switch" Tags="|hp-procurve|sfp|10gbase|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37236" PostTypeId="2" ParentId="32777" CreationDate="2016-12-11T14:40:53.150" Score="0" Body="&lt;p&gt;I changed the Inspection method to proxy based in web filtering profiles and the skype started working. I hope this one helps for all. &lt;/p&gt;&#xA;" OwnerUserId="23114" LastActivityDate="2016-12-11T14:40:53.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37237" PostTypeId="1" AcceptedAnswerId="37239" CreationDate="2016-12-11T15:07:00.677" Score="1" ViewCount="713" Body="&lt;p&gt;I have received a Summit 200-24 from a friend to help host a small LAN party this weekend. However having never used a managed switch before, I have no clue how to log into it. It has a console port on the side but I have to computer that has one of those ports. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't appear to have an IP address on my network, so I cannot for the life of me find its IP address to see if I can log into it from a browser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone can tell me how I can log into this switch that would be great!!&lt;/p&gt;&#xA;" OwnerUserId="32716" LastEditorUserId="8499" LastEditDate="2016-12-11T15:38:33.740" LastActivityDate="2016-12-11T15:38:33.740" Title="How to log into an Extreme Networks Summit 200-24?" Tags="|switch|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37238" PostTypeId="2" ParentId="37230" CreationDate="2016-12-11T15:17:51.967" Score="0" Body="&lt;p&gt;Layer-2 protocols that use MAC addresses, where you have bridges, send frames directly to the MAC address of the destination host. The frames may pass through one or more bridges to get to the destination host. That is the case with ethernet switches or Infrastructure Wi-Fi WAPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ron Trunk pointed out, frames will pass through a WAP in infrastructure mode, but the frames are addressed with the destination host's MAC address.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I want another wireless device d1 to be able to form a network with&#xA;  these n devices such that d1 has a direct route to each other device.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You seem to be confusing the network layers. Routers, not an end-device will determine the route a packet takes, and it is usually the most direct route. Routing happens at layer-3, and it connects different LANs. Frames will be address with the router's MAC address and go to the router (gateway), the frames will be stripped off the packets at the router, and new frames applied for the next LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A MAC address is only valid on the LAN where the host with that MAC address is, and a host on a different LAN has no idea what the MAC address of a host on a different LAN is.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-11T15:17:51.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37239" PostTypeId="2" ParentId="37237" CreationDate="2016-12-11T15:37:33.957" Score="0" Body="&lt;p&gt;You are going to need a console cable, a serial port on your PC, and a terminal application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is all explained in &lt;a href=&quot;http://extrcdn.extremenetworks.com/wp-content/uploads/2014/02/Summit200User.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Summit 200 Series Switch Installation and User Guide&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Accessing the BootROM menu&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Interaction with the BootROM menu is only required under special&#xA;  circumstances, and should be done only under the direction of Extreme&#xA;  Networks Customer Support. The necessity of using these functions&#xA;  implies a non-standard problem which requires the assistance of&#xA;  Extreme Networks Customer Support.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To access the BootROM menu, follow these steps:&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Attach a serial cable to the console port of the switch.&lt;/li&gt;&#xA;  &lt;li&gt;&lt;p&gt;Attach the other end of the serial cable to a properly configured&#xA;  terminal or terminal emulator, power cycle the switch while&#xA;  depressing the spacebar on the keyboard of the terminal.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;As soon as you see the &lt;code&gt;BootROM-&amp;gt;&lt;/code&gt; prompt, release the spacebar. You&#xA;  can see a simple help menu by pressing &lt;code&gt;h&lt;/code&gt;. Options in the menu&#xA;  include&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;— Selecting the image to boot from&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;— Booting to factory default configuration&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;  &#xA;  &lt;p&gt;For example, to change the image that the switch boots from in flash&#xA;  memory, press &lt;code&gt;1&lt;/code&gt; for the image stored in primary or &lt;code&gt;2&lt;/code&gt; for the image&#xA;  stored in secondary. Then, press the &lt;code&gt;f&lt;/code&gt; key to boot from newly&#xA;  selected on-board flash memory.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To boot to factory default configuration, press the &lt;code&gt;d&lt;/code&gt; key for&#xA;  default and the &lt;code&gt;f&lt;/code&gt; key to boot from the configured on-board flash.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-11T15:37:33.957" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37240" PostTypeId="5" CreationDate="2016-12-11T16:27:51.347" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2016-12-11T16:27:51.347" LastActivityDate="2016-12-11T16:27:51.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37241" PostTypeId="4" CreationDate="2016-12-11T16:27:51.347" Score="0" Body="Aruba (now a subsidiary of  Hewlett Packard Enterprise)  is a provider of networking equipment. This is a generic tag to be used when no more specific tags are available. See the partial list of tags in the full Tag Wiki." OwnerUserId="18922" LastEditorUserId="18922" LastEditDate="2016-12-11T16:58:37.480" LastActivityDate="2016-12-11T16:58:37.480" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37242" PostTypeId="1" AcceptedAnswerId="38290" CreationDate="2016-12-11T18:00:47.543" Score="2" ViewCount="1461" Body="&lt;p&gt;I have ASA-5505 with public IP facing interface with port forwarding https/443 to a Barracuda SSL VPN appliance. (Barracuda has private ip only).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Running in L2 mode where remote hosts feel like they plugged into a switch next to this appliance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When VPN appliance is on TCP mode, remote hosts can connect but fails at UDP mode. (Failure at TLS handshake where appliance can't reply back).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anything wrong with my ACL and NAT rules?&#xA;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;55ASA# show run&#xA;: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz&#xA;:&#xA;ASA Version 9.2(4) &#xA;!&#xA;hostname 55ASA&#xA;domain-name vpn.com&#xA;enable password&#xA;xlate per-session deny tcp any4 any4&#xA;xlate per-session deny tcp any4 any6&#xA;xlate per-session deny tcp any6 any4&#xA;xlate per-session deny tcp any6 any6&#xA;xlate per-session deny udp any4 any4 eq domain&#xA;xlate per-session deny udp any4 any6 eq domain&#xA;xlate per-session deny udp any6 any4 eq domain&#xA;xlate per-session deny udp any6 any6 eq domain&#xA;passwd &#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!             &#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 172.16.0.1 255.255.0.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 1.2.3.4 255.0.0.0 &#xA;!&#xA;interface Vlan3&#xA; no nameif    &#xA; no security-level&#xA; no ip address&#xA;!&#xA;boot system disk0:/asa924-k8.bin&#xA;ftp mode passive&#xA;clock timezone PST -8&#xA;clock summer-time PDT recurring&#xA;dns domain-lookup inside&#xA;dns server-group DefaultDNS&#xA; name-server 84.200.69.80&#xA; name-server 8.8.8.8&#xA; domain-name vpn.com&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network hostNW&#xA; host 172.16.100.100&#xA;object network hostHTTP&#xA; host 172.16.1.180&#xA;object network obj-172&#xA; subnet 172.16.0.0 255.255.0.0&#xA;object service https-udp&#xA; service udp source eq 443 destination eq 443 &#xA;object-group service DM_INLINE_SERVICE_1&#xA; service-object object https-udp &#xA; service-object tcp destination eq https &#xA; service-object udp destination eq 443 &#xA;access-list inside_access_in extended permit ip object obj-172 any4 &#xA;access-list outside_access_in extended deny ip 10.0.0.0 255.0.0.0 any &#xA;access-list outside_access_in extended deny ip 172.16.0.0 255.240.0.0 any &#xA;access-list outside_access_in extended deny ip 192.168.0.0 255.255.0.0 any &#xA;access-list host-acl extended permit object-group DM_INLINE_SERVICE_1 any object hostNW &#xA;access-list host-acl extended permit tcp any object hostHTTP eq www &#xA;pager lines 24&#xA;logging enable&#xA;logging buffer-size 987564&#xA;logging buffered informational&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;ip verify reverse-path interface inside&#xA;ip verify reverse-path interface outside&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-762-150.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;!&#xA;object network hostNW&#xA; nat (inside,outside) static interface net-to-net service tcp https https &#xA;object network hostHTTP&#xA; nat (inside,outside) static interface service tcp www www &#xA;object network obj-172&#xA; nat (inside,outside) dynamic interface&#xA;!&#xA;nat (inside,outside) after-auto source dynamic any interface&#xA;access-group inside_access_in in interface inside&#xA;access-group host-acl in interface outside&#xA;&#xA;route outside 0.0.0.0 0.0.0.0 4.3.2.1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL &#xA;aaa authentication http console LOCAL &#xA;aaa local authentication attempts max-fail 3&#xA;http server enable&#xA;http 172.16.0.0 255.255.0.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto ca trustpool policy&#xA;no crypto isakmp nat-traversal&#xA;telnet timeout 5&#xA;ssh stricthostkeycheck&#xA;ssh 172.16.0.0 255.255.0.0 inside&#xA;ssh timeout 5&#xA;ssh version 2&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;management-access inside&#xA;no vpn-addr-assign aaa&#xA;no vpn-addr-assign dhcp&#xA;no vpn-addr-assign local&#xA;no ipv6-vpn-addr-assign aaa&#xA;no ipv6-vpn-addr-assign local&#xA;&#xA;dhcp-client client-id interface outside&#xA;dhcpd dns 84.200.69.80 8.8.8.8&#xA;dhcpd domain vpn.com&#xA;dhcpd update dns both override &#xA;dhcpd option 3 ip 172.16.0.1&#xA;!&#xA;dhcpd address 172.16.1.100-172.16.1.130 inside&#xA;dhcpd enable inside&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics host&#xA;threat-detection statistics access-list&#xA;threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200&#xA;ntp server 216.228.192.69 source outside&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-tunnel-protocol l2tp-ipsec &#xA;username 55lt password FOFWAf8le0N1mWrv encrypted privilege 15&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect icmp &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;Cryptochecksum:ff597b145b695afa61ce3c60ae8cc8b9&#xA;: end&#xA;55ASA# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user10221" LastActivityDate="2017-01-22T23:53:54.590" Title="allowing udp/443 on top of tcp/443 on ASA-5505" Tags="|cisco-asa|sslvpn|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37243" PostTypeId="1" CreationDate="2016-12-11T19:17:36.570" Score="4" ViewCount="16075" Body="&lt;p&gt;I see the term headend thrown around a lot at work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What sort of device in what role gets considered a headend?&lt;/p&gt;&#xA;" OwnerUserId="32719" LastActivityDate="2018-03-29T05:36:14.027" Title="What is a headend device?" Tags="|network-core|architecture|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37244" PostTypeId="2" ParentId="37181" CreationDate="2016-12-11T19:32:05.780" Score="1" Body="&lt;p&gt;As a best practice, I like to define all &quot;trunk&quot; ports as hybrid ports in the Force10 terminology. In my opinion is more flexible, allow you to pass only the relevant VLAN taged and only one untagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a reminder, Force10 don't like to usee VLAN 1 for production purpose. I always use a fiction &quot;vlan 2&quot; as default VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Answering your question, try defining the port-channel as &quot;portmode hybrid&quot; and &quot;switchport&quot;. About inter-vlan routing, it's enabled  when you assign and ip address to the interface vlan.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2016-12-11T19:32:05.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37246" PostTypeId="1" AcceptedAnswerId="37321" CreationDate="2016-12-12T00:13:54.300" Score="1" ViewCount="385" Body="&lt;p&gt;I'm not seeing traffic in either direction on a new site-to-site VPN. (Two others are fine) I can't see what is wrong. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;:&#xA;ASA Version 9.2(4)13 &#xA;!&#xA;hostname wss&#xA;domain-name xxxxxxxxxxxx.com&#xA;enable password qJtG/3webvseVHy/m encrypted&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.0.1 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 209.xxx.xxx.250 255.255.255.248 &#xA;!&#xA;ftp mode passive&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring&#xA;dns server-group DefaultDNS&#xA; domain-name xxxxxxxxxxxx.com&#xA;object network obj_any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network 209.xxx.xxx.249&#xA; host 209.xxx.xxx.249&#xA;object network NETWORK_OBJ_10.100.100.0_24&#xA; subnet 10.100.100.0 255.255.255.0&#xA;object network NETWORK_OBJ_192.168.0.0_24&#xA; subnet 192.168.0.0 255.255.255.0&#xA;access-list outside_cryptomap extended permit ip 192.168.0.0 255.255.255.0 10.100.100.0 255.255.255.0 &#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (inside,outside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static NETWORK_OBJ_10.100.100.0_24 NETWORK_OBJ_10.100.100.0_24 no-proxy-arp route-lookup&#xA;!&#xA;object network obj_any&#xA; nat (inside,outside) dynamic interface&#xA;!&#xA;nat (inside,outside) after-auto source dynamic any interface&#xA;route outside 0.0.0.0 0.0.0.0 209.xxx.xxx.249 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;http server enable&#xA;http 192.168.0.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set myset esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev2 ipsec-proposal DES&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES192&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto map outside_map 1 match address outside_cryptomap&#xA;crypto map outside_map 1 set peer 71.xxx.xxx.34 &#xA;crypto map outside_map 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map outside_map 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256&#xA;crypto map outside_map interface outside&#xA;crypto ca trustpool policy&#xA;crypto ikev2 policy 1&#xA; encryption aes-256&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 10&#xA; encryption aes-192&#xA; integrity sha&#xA; group 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 20&#xA; encryption aes&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 30&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 40&#xA; encryption des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 enable outside&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 am-disable&#xA;crypto ikev1 policy 10&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet timeout 5&#xA;no ssh stricthostkeycheck&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;&#xA;dhcpd address 192.168.0.20-192.168.0.70 inside&#xA;dhcpd dns 8.8.8.8 8.8.4.4 interface inside&#xA;dhcpd enable inside&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;group-policy GroupPolicy_71.xxx.xxx.34 internal&#xA;group-policy GroupPolicy_71.xxx.xxx.34 attributes&#xA; vpn-tunnel-protocol ikev1 ikev2 &#xA;tunnel-group DefaultL2LGroup ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;tunnel-group 71.xxx.xxx.34 type ipsec-l2l&#xA;tunnel-group 71.xxx.xxx.34 general-attributes&#xA; default-group-policy GroupPolicy_71.xxx.xxx.34&#xA;tunnel-group 71.xxx.xxx.34 ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;&#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;Cryptochecksum:a50bb6e11ewrgertgba5362d09896cd2&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the other side:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: &#xA;: Serial Number: JMXXXXXX03M&#xA;: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz&#xA;:&#xA;ASA Version 9.2(4)13 &#xA;!&#xA;hostname ortho&#xA;domain-name xxxxxxxxxx.com&#xA;enable password y4Cbeg45a6TNeJj encrypted&#xA;xlate per-session deny tcp any4 any4&#xA;xlate per-session deny tcp any4 any6&#xA;xlate per-session deny tcp any6 any4&#xA;xlate per-session deny tcp any6 any6&#xA;xlate per-session deny udp any4 any4 eq domain&#xA;xlate per-session deny udp any4 any6 eq domain&#xA;xlate per-session deny udp any6 any4 eq domain&#xA;xlate per-session deny udp any6 any6 eq domain&#xA;passwd lWz.HrbgH8Pg2vLY encrypted&#xA;names&#xA;ip local pool mypool 192.168.19.10-192.168.19.20 mask 255.255.255.0&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!&#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.100.100.252 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 71.xxx.xxx.34 255.255.255.248 &#xA;!&#xA;boot system disk0:/asa924-13-k8.bin&#xA;boot system disk0:/asa924-k8.bin&#xA;ftp mode passive&#xA;clock timezone EST -5&#xA;clock summer-time EDT recurring&#xA;dns server-group DefaultDNS&#xA; domain-name xxxxxxxx.com&#xA;same-security-traffic permit intra-interface&#xA;object network obj-10.100.100.0&#xA; subnet 10.100.100.0 255.255.255.0&#xA;object network obj-10.100.101.0&#xA; subnet 10.100.101.0 255.255.255.0&#xA;object network obj-192.168.19.0&#xA; subnet 192.168.19.0 255.255.255.0&#xA;object network obj-192.168.20.0&#xA; subnet 192.168.20.0 255.255.255.0&#xA;object network obj_any&#xA; subnet 0.0.0.0 0.0.0.0&#xA;object network obj-10.100.200.0&#xA; subnet 10.100.200.0 255.255.255.0&#xA;object network NETWORK_OBJ_192.168.1.32_27&#xA; subnet 192.168.1.32 255.255.255.224&#xA;object network NETWORK_OBJ_192.168.19.0_27&#xA; subnet 192.168.19.0 255.255.255.224&#xA;object network NETWORK_OBJ_10.100.100.0_24&#xA; subnet 10.100.100.0 255.255.255.0&#xA;object network 192.168.19.0&#xA; subnet 192.168.19.0 255.255.255.0&#xA;object network NETWORK_OBJ_192.168.0.0_24&#xA; subnet 192.168.0.0 255.255.255.0&#xA;object-group service allowedports tcp&#xA; port-object eq https&#xA; port-object eq smtp&#xA; port-object eq www&#xA;access-list tovergennes extended permit ip 10.100.100.0 255.255.255.0 10.100.101.0 255.255.255.0 &#xA;access-list nonat extended permit ip 10.100.100.0 255.255.255.0 10.100.101.0 255.255.255.0 &#xA;access-list nonat extended permit ip 10.100.100.0 255.255.255.0 object 192.168.19.0 &#xA;access-list nonat extended permit ip 10.100.100.0 255.255.255.0 192.168.20.0 255.255.255.0 &#xA;access-list split standard permit 10.100.100.0 255.255.255.0 &#xA;access-list split standard permit 10.100.200.0 255.255.255.0 &#xA;access-list split standard permit 10.100.101.0 255.255.255.0 &#xA;access-list allowin extended permit gre any4 any4 &#xA;access-list allowin extended permit ip object obj-10.100.100.0 object obj-192.168.19.0 &#xA;access-list outside_cryptomap_30 extended permit ip 10.100.100.0 255.255.255.0 10.100.200.0 255.255.255.0 &#xA;access-list inside_access_out extended deny tcp 10.100.100.0 255.255.255.0 any eq smtp &#xA;access-list outside_cryptomap_2 extended permit ip 10.100.100.0 255.255.255.0 192.168.0.0 255.255.255.0 &#xA;no pager&#xA;logging enable&#xA;logging buffered debugging&#xA;logging asdm notifications&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-761.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (inside,any) source static obj-10.100.100.0 obj-10.100.100.0 destination static obj-10.100.101.0 obj-10.100.101.0 no-proxy-arp&#xA;nat (inside,any) source static obj-10.100.100.0 obj-10.100.100.0 destination static 192.168.19.0 192.168.19.0 no-proxy-arp&#xA;nat (inside,any) source static obj-10.100.100.0 obj-10.100.100.0 destination static obj-192.168.19.0 obj-192.168.19.0 no-proxy-arp route-lookup&#xA;nat (inside,any) source static obj-10.100.100.0 obj-10.100.100.0 destination static obj-192.168.20.0 obj-192.168.20.0 no-proxy-arp&#xA;nat (inside,any) source static obj-10.100.100.0 obj-10.100.100.0 destination static obj-10.100.200.0 obj-10.100.200.0 no-proxy-arp route-lookup&#xA;nat (inside,outside) source static any any destination static NETWORK_OBJ_192.168.1.32_27 NETWORK_OBJ_192.168.1.32_27 no-proxy-arp route-lookup&#xA;nat (inside,outside) source static NETWORK_OBJ_10.100.100.0_24 NETWORK_OBJ_10.100.100.0_24 destination static NETWORK_OBJ_192.168.19.0_27 NETWORK_OBJ_192.168.19.0_27 no-proxy-arp route-lookup&#xA;!&#xA;object network obj_any&#xA; nat (inside,outside) dynamic interface&#xA;access-group inside_access_out out interface inside&#xA;access-group allowin in interface outside&#xA;route outside 0.0.0.0 0.0.0.0 71.xxx.xxx.33 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;user-identity default-domain LOCAL&#xA;aaa authentication enable console LOCAL &#xA;aaa authentication http console LOCAL &#xA;aaa authentication serial console LOCAL &#xA;aaa authentication ssh console LOCAL &#xA;aaa authentication telnet console LOCAL &#xA;http server enable 5555&#xA;http 10.100.100.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;crypto ipsec ikev1 transform-set myset esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac &#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport&#xA;crypto ipsec ikev2 ipsec-proposal DES&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal 3DES&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES192&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal AES256&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1 md5&#xA;crypto ipsec ikev2 ipsec-proposal myset&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-128-SHA&#xA; protocol esp encryption aes&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-128-MD5&#xA; protocol esp encryption aes&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-192-SHA&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-192-MD5&#xA; protocol esp encryption aes-192&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-256-SHA&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-AES-256-MD5&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-3DES-SHA&#xA; protocol esp encryption 3des&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-3DES-MD5&#xA; protocol esp encryption 3des&#xA; protocol esp integrity md5&#xA;crypto ipsec ikev2 ipsec-proposal ESP-DES-SHA&#xA; protocol esp encryption des&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal ESP-DES-MD5&#xA; protocol esp encryption des&#xA; protocol esp integrity md5&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-&#xA;&#xA;SHA ESP-DES-MD5&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES&#xA;crypto map mymap 1 match address outside_cryptomap_2&#xA;crypto map mymap 1 set peer 209.xxx.xxx.250 &#xA;crypto map mymap 1 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map mymap 1 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256 myset ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA&#xA;crypto map mymap 20 match address toes&#xA;crypto map mymap 20 set peer 64.xxx.xxx.145 &#xA;crypto map mymap 20 set ikev1 transform-set myset&#xA;crypto map mymap 20 set ikev2 ipsec-proposal myset&#xA;crypto map mymap 30 match address outside_cryptomap_30&#xA;crypto map mymap 30 set peer 69.xxx.xxx.14 &#xA;crypto map mymap 30 set ikev1 transform-set myset&#xA;crypto map mymap 30 set ikev2 ipsec-proposal myset&#xA;crypto map mymap 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map mymap interface outside&#xA;crypto ca trustpoint VPN&#xA; enrollment terminal&#xA; subject-name CN=ortho&#xA; crl configure&#xA;crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0&#xA; enrollment self&#xA; subject-name CN=10.100.100.252,CN=ortho&#xA; crl configure&#xA;crypto ca trustpool policy&#xA;crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0&#xA; certificate 8b2a9757&#xA;    3082022f 30820198 a0030201 0202048b 2a975730 0d06092a 864886f7 0d010105 &#xA;    0500305c 31133011 06035504 03130a6d 6964646c 65627572 79311730 15060355 &#xA;    0403130e 31302e31 30302e31 30302e32 3532312c 302a0609 2a864886 f70d0109 &#xA;    02161d6d 6964646c 65627572 792e6275 726c696e 67746f6e 64727567 2e636f6d &#xA;    301e170d 31363037 32393135 31373434 5a170d32 36303732 37313531 3734345a &#xA;    305c3113 30110603 55040313 0a6d6964 646c6562 75727931 17301506 03550403 &#xA;    130e3130 2e313030 2e313030 2e323532 312c302a 06092a86 4886f70d 01090216 &#xA;    1d6d6964 646c6562 7572792e 6275726c 696e6774 6f6e6472 75672e63 6f6d3081 &#xA;    9f300d06 092a8648 86f70d01 03442eee 03818d00 30818902 818100d1 018faa97 &#xA;    bf6b8ae0 8ce5d37b 5c6f433c c6d70271 f1c1115e 4daa2b7f d1cd2ea7 158aa154 &#xA;    239b4229 d8147393 ec8637e6 d7ff2ccf 6a719c67 764b71ba 0750eb2e b40e18e0 &#xA;    a45899ce 2dcf23b8 91d9684c 2c617a01 3cb98e1c 772daec7 2c996780 f1fa7fe5 &#xA;    b01c22dc a27cbb08 e1353d10 fdf97ba1 1e6a23ed bf92f11e ac956b02 03010001 &#xA;    300d0609 2a864886 f70d0101 05050003 818100ab 76aeb2f2 ccc9d166 3cb2f21a &#xA;    488b9639 69142eb9 6a2ff4c9 c95abde6 f0ebc4f2 e0e559f1 71fb927e cc208449 &#xA;    86f7a8da fa90fd87 a6b1c2af 032ba70e b3df42bf d2edd591 2f1ee61b c7815f55 &#xA;    d5cd9bab 0b4fce88 a91905dc da035584 e538febd f5413f3b 3508a721 77cb021a &#xA;    881126e1 9f93508e 3c923447 7f54b12c 1b6a6d&#xA;  quit&#xA;crypto ikev2 policy 1&#xA; encryption aes-256&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 10&#xA; encryption aes-256&#xA; integrity sha&#xA; group 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 20&#xA; encryption aes&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 30&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 40&#xA; encryption des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 enable outside client-services port 443&#xA;crypto ikev2 remote-access trustpoint ASDM_Launcher_Access_TrustPoint_0&#xA;crypto ikev1 enable outside&#xA;crypto ikev1 am-disable&#xA;crypto ikev1 policy 10&#xA; authentication pre-share&#xA; encryption aes-256&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;telnet 10.100.100.0 255.255.255.255 inside&#xA;telnet timeout 5&#xA;ssh stricthostkeycheck&#xA;ssh 0.0.0.0 0.0.0.0 inside&#xA;ssh timeout 60&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;management-access inside&#xA;vpn-sessiondb max-other-vpn-limit 10&#xA;vpn-sessiondb max-anyconnect-premium-or-essentials-limit 2&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection scanning-threat shun except ip-address 10.100.100.0 255.255.255.0&#xA;threat-detection scanning-threat shun except ip-address 10.100.101.0 255.255.255.0&#xA;threat-detection scanning-threat shun except ip-address 10.100.200.0 255.255.255.0&#xA;threat-detection scanning-threat shun duration 3600&#xA;threat-detection statistics&#xA;threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200&#xA;ssl trust-point ASDM_Launcher_Access_TrustPoint_0 outside&#xA;ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside&#xA;ssl trust-point ASDM_Launcher_Access_TrustPoint_0 inside vpnlb-ip&#xA;webvpn&#xA; no anyconnect-essentials&#xA; anyconnect image disk0:/anyconnect-win-3.1.14018-k9.pkg 1&#xA; anyconnect profiles RemoteAccessIKEv2_client_profile disk0:/RemoteAccessIKEv2_client_profile.xml&#xA; anyconnect enable&#xA; tunnel-group-list enable&#xA;group-policy DfltGrpPolicy attributes&#xA; vpn-idle-timeout 120&#xA; webvpn&#xA;  anyconnect ssl keepalive none&#xA;  anyconnect dpd-interval client none&#xA;  anyconnect dpd-interval gateway none&#xA;  anyconnect ssl compression deflate&#xA;  customization value DfltCustomization&#xA;group-policy GroupPolicy_RemoteUsers internal&#xA;group-policy GroupPolicy_RemoteUsers attributes&#xA; wins-server none&#xA; dns-server none&#xA; vpn-tunnel-protocol ikev2 &#xA; default-domain value burlingtondrug.com&#xA;group-policy GroupPolicy_RemoteAccessIKEv2 internal&#xA;group-policy GroupPolicy_RemoteAccessIKEv2 attributes&#xA; wins-server none&#xA; dns-server value 10.100.100.4&#xA; vpn-tunnel-protocol ikev2 ssl-clientless&#xA; default-domain value phsrx.local&#xA; webvpn&#xA;  anyconnect profiles value RemoteAccessIKEv2_client_profile type user&#xA;group-policy GroupPolicy2 internal&#xA;group-policy GroupPolicy2 attributes&#xA; vpn-tunnel-protocol ikev1 ikev2 &#xA;group-policy GroupPolicy1 internal&#xA;group-policy GroupPolicy1 attributes&#xA; vpn-tunnel-protocol ikev1 &#xA;group-policy GroupPolicy_209.xxx.xxx.250 internal&#xA;group-policy GroupPolicy_209.xxx.xxx.250 attributes&#xA; vpn-tunnel-protocol ikev1 ikev2 &#xA;group-policy marble internal&#xA;group-policy marble attributes&#xA; wins-server value 10.100.100.4&#xA; dns-server value 10.100.100.4&#xA; vpn-tunnel-protocol ikev1 l2tp-ipsec &#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value split&#xA;username llauf password drnUg2FB/kwVbg5S encrypted&#xA;username llauf attributes&#xA; service-type nas-prompt&#xA;username gregs password SgGYd9kk/N7wNpyb encrypted&#xA;username gregs attributes&#xA; service-type nas-prompt&#xA;username phsrx password LFjGdPBp3.PJH2wz encrypted privilege 15&#xA;username kathyd password 0y8FY/jATMgQeSNR encrypted&#xA;username kathyd attributes&#xA; service-type nas-prompt&#xA;username dianeg password ZEpP2RmvIWwlezst encrypted&#xA;username dianeg attributes&#xA; service-type nas-prompt&#xA;username anetap password mjdjyXum3raO74y3 encrypted&#xA;username anetap attributes&#xA; service-type nas-prompt&#xA;username mboise password DHv.i0NLnFnAH2sR encrypted&#xA;username mboise attributes&#xA; service-type nas-prompt&#xA;tunnel-group 64.xxx.xxx.145 type ipsec-l2l&#xA;tunnel-group 64.xxx.xxx.145 ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;tunnel-group marble type remote-access&#xA;tunnel-group marble general-attributes&#xA; address-pool mypool&#xA; default-group-policy marble&#xA;tunnel-group marble ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA;tunnel-group 69.xxx.xxx.14 type ipsec-l2l&#xA;tunnel-group 69.xxx.xxx.14 ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;tunnel-group 209.xxx.xxx.250 type ipsec-l2l&#xA;tunnel-group 209.xxx.xxx.250 general-attributes&#xA; default-group-policy GroupPolicy_209.xxx.xxx.250&#xA;tunnel-group 209.xxx.xxx.250 ipsec-attributes&#xA; ikev1 pre-shared-key *****&#xA; ikev2 remote-authentication pre-shared-key *****&#xA; ikev2 local-authentication pre-shared-key *****&#xA;tunnel-group RemoteAccessIKEv2 type remote-access&#xA;tunnel-group RemoteAccessIKEv2 general-attributes&#xA; address-pool mypool&#xA; default-group-policy GroupPolicy_RemoteAccessIKEv2&#xA;tunnel-group RemoteAccessIKEv2 webvpn-attributes&#xA; group-alias RemoteAccessIKEv2 enable&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA; class class-default&#xA;  user-statistics accounting&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;call-home&#xA; profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic&#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA;hpm topN enable&#xA;Cryptochecksum:74fc0f94854gete59566de608cafc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27364" LastEditorUserId="2142" LastEditDate="2016-12-12T13:52:37.063" LastActivityDate="2016-12-14T19:57:18.027" Title="No traffic over ASA 5505 site to site tunnel" Tags="|cisco-asa|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37250" PostTypeId="2" ParentId="37243" CreationDate="2016-12-12T07:52:18.923" Score="0" Body="&lt;p&gt;Systemically, think of a directional graph.  The Head-end would be the node/point feeding the arc/edge, with the dead-end being the receiving node/point of the arc/edge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Colloquially, in the communications industry, head-end equipment is frequently associated with a transmitting station, while dead-end equipment might be the end user receiving equipment.&lt;/p&gt;&#xA;" OwnerUserId="32594" LastActivityDate="2016-12-12T07:52:18.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37252" PostTypeId="1" AcceptedAnswerId="37255" CreationDate="2016-12-12T08:27:19.660" Score="2" ViewCount="2869" Body="&lt;p&gt;I am new to networking and I have the following problem. In the small company I work in we have a load balance router with two ISPs (only one ISP is connected at the moment) and to the router there is a server connected with several websites hosted on it. The server has a static IP address from ISP1. This is the address that is routed on the Internet. The problem is, when ISP2 is connected to the router, it gives the server a different IP and the sites are not accessible anymore. All I can think of at the moment is calling ISP2 and requesting that they route the address from ISP1, but I don't know if they will agree to that. What is the best way to solve the problem and is there a solution that does not involve calling either ISP?&#xA;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATE: While the solution below is perfectly valid, it turns out that in our circumstances it will be pretty hard to accomplish, as we are not directly connected to the ISPs and configuring BGP will require lengthy talks with other people. Is it possible to just register the address from ISP2 (with RIPE ?), so that if the first one fails, the server is reached via the second one?&lt;/p&gt;&#xA;" OwnerUserId="21387" LastEditorUserId="21387" LastEditDate="2016-12-13T12:56:24.087" LastActivityDate="2017-01-05T16:57:49.667" Title="Web server address with two ISPs" Tags="|failover|ip-address|load-balancer|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37253" PostTypeId="1" CreationDate="2016-12-12T10:07:25.853" Score="1" ViewCount="49" Body="&lt;p&gt;I have questions regarding the following designs in my test lab:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.Ethernet port of one switch is connected to TenGig port of the Firewall.Why would anyone do this(connecting Ethernet and Tengigabit Ethernet)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.N5k E1/4 (LC type) connected to E1/4(LC type) with MMF as the media. The speed shown is 10Gb. Is this possible? If so, how?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2016-12-12T10:07:25.853" Title="Regarding Physical Connectivity" Tags="|ethernet|layer1|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37255" PostTypeId="2" ParentId="37252" CreationDate="2016-12-12T11:24:27.063" Score="1" Body="&lt;p&gt;The most appropriate solution for you is to run BGP with your own address space. Then you can allocate your own Provider Independent address to the server and advertise it to both ISPs. Otherwise any adequate ISP &lt;strong&gt;will not agree&lt;/strong&gt; to route network wich doesn't belong to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Except BGP the only option I see is to use something like dyndns. Albeit this solution is inappropriate for critical applications.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastEditorUserId="29564" LastEditDate="2017-01-05T16:37:37.540" LastActivityDate="2017-01-05T16:37:37.540" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37260" PostTypeId="2" ParentId="35880" CreationDate="2016-12-12T19:44:03.320" Score="1" Body="&lt;p&gt;You might want to look at your RRD graphs to see what's going on with blocked traffic, and/or examine what you have exposed to the WAN that could be getting beat on [that would be services that originate from the pfSense box and which might well be only intended for your local network, but which may have default (or non-default) settings that make them available on the WAN interface as well.]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also want to consider moving up to 2.3.2.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-12-12T19:44:03.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37261" PostTypeId="2" ParentId="37135" CreationDate="2016-12-12T20:09:28.613" Score="1" Body="&lt;p&gt;The LED display has one LED for each port, laid out in the same order as the ports are located on the front panel.&#xA;The LED's show speed and activity on the ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the port LED is off, there is no link, when it is green, there is a 10/100Mbps link present and when it is amber, there is a 1000MB link present The port LED will flash when there is traffic being transmitted or received by the port.&#xA;Note: The LED's will not show whether the port is in full or half duplex mode.&#xA;The power and diagnostic LED's are used to indicate whether the switch is operating correctly.&#xA;Both Power and Diag LED's should be green when everything is okay.&#xA;If the power LED is off, or RED, then there is a power supply fault and the switch will not boot up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Diagnostic LED indicates the status of the switch.&#xA;When the switch is powered up, the Diag LED flashes green for about 40 seconds, then extinguishes. When the LED comes back to a solid green colour (approx 60 seconds) then the switch is ready to be managed or pass traffic.&#xA;The Diag LED will show if a loopback fault has occurred on a port, or if an internal cooling fan has failed.&#xA;It will flash red if a fan has failed, and the switch will continue to operate.&#xA;It will be solid red, and the corresponding port LED will flash amber/ green, if a port fails the loopback test at bootup. The switch will continue to operate, but the failed port will be disabled.&lt;/p&gt;&#xA;" OwnerUserId="32745" LastActivityDate="2016-12-12T20:09:28.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37262" PostTypeId="2" ParentId="37152" CreationDate="2016-12-12T21:58:51.650" Score="2" Body="&lt;p&gt;The thing to watch with 40G between devices is multi-mode fibre patch leads.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unlike regular multi-mode SFP/SFP+ where you have only two cores of fibre which are crossed over between devices, multi-mode QSFPs connect to MTP cabling, which is 12 cores, of which, 4 will be active to achieve a 40Gbps interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When looking at your QFX or Fortigate QSFP with the &quot;key&quot; at the top, you will be presented with the following (T is Transmit and R is Receive):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;         __________________    &#xA; _______|       &quot;key&quot;      |__________&#xA;|                                    |&#xA;|[T][T][T][T][ ][ ][ ][ ][R][R][R][R]|&#xA;|1  2  3  4  5  6  7  8  9  10 11 12 |&#xA;~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(apologies for woeful ASCII art)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are patching directly between both devices (i.e. no structured cabling), you will need a patch lead that maps cores 1-12, 2-11, 3-10, 4-9.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These patch leads are known as MTP Polarity B (essentially an MTP cross-over cable).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using single-mode to connect the devices, then none of this will apply - your QSFP+ single-mode transceivers will present LC connectors, and regular OS1 patch-leads will work just fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could also just use QFSP+ DACs (Direct-Attach Copper) which are pre-terminated.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="1392" LastEditDate="2016-12-12T22:04:57.077" LastActivityDate="2016-12-12T22:04:57.077" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37263" PostTypeId="2" ParentId="37159" CreationDate="2016-12-12T22:27:48.067" Score="6" Body="&lt;p&gt;Yes, this is expected behaviour.&lt;/p&gt;&#xA;&lt;p&gt;Even though PC3 sees the ARP &lt;strong&gt;request&lt;/strong&gt; from PC1, it does not populate it's ARP cache with the IP-to-MAC mapping of PC1.&lt;/p&gt;&#xA;&lt;p&gt;While this may not seem to be the most efficient method of distributing address to host information, you need to remember that the ARP protocol was developed in 1982[1] and even back then the author made the following very relevant point:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The workstations aren't generally going to be talking to each other&#xA;(and therefore have 100 useless entries in a table); they will be&#xA;mainly talking to a mainframe, file server or bridge, but only to a&#xA;small number of other workstations (for interactive conversations, for&#xA;example). The protocol described in this paper distributes information&#xA;as it is needed, and only once (probably) per boot of a machine.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;It would be a trivial usage of resource on today's PCs to populate the entire ARP table for the local subnet(s) the machine resides on, but perhaps not so for a networked machine back in 1982.&lt;/p&gt;&#xA;&lt;p&gt;[1] RFC826 - An Ethernet Address Resolution Protocol - &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc826&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-12-12T22:27:48.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37265" PostTypeId="1" CreationDate="2016-12-13T01:08:38.520" Score="1" ViewCount="288" Body="&lt;p&gt;Was hoping for some advice regarding an OSPF solution for a customer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically the customer has about 4 sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These would all be linked together physically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have attached a basic network diagram.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/odBfH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/odBfH.png&quot; alt=&quot;Which can be viewed here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As you can see there is several redundant  layer 2 links between the sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each site has an NTU.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;At the DC there is an access switch which has a trunk to a core router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This core router has an uplink to the ISP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When ordering a connection from the ISP we get a VLAN tag and configure a VPLS ID and matching VLAN ID on the router and switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NTU on each site uses a separate VLAN ID that we use for monitoring purposes.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Can we use the one public  IP address and the ISP defined VLAN tag for every customer location (their WAN traffic)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do this I was going to install a router in our rack at our DC with an OSPF instance running on it. This router with a private IP address would be the default route for all CPEs. Then on this router I would configure its own default route to the ISP gateway. It would be connected to the access switch which is connected to our core router with ISP defined VLAN tag.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would this work? It seems abit messy, I was wondering if anyone could give me any feedback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know if anyone needs anything clarified and thank you for your assistance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hey everyone I have added a diagram for the internal data center connection for clarity purposes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xS670.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xS670.png&quot; alt=&quot;CORE diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32264" LastEditorUserId="32264" LastEditDate="2016-12-13T08:35:40.673" LastActivityDate="2016-12-13T08:35:40.673" Title="OSPF question from ISP perspective" Tags="|routing|vlan|ospf|isp|vpls|" AnswerCount="0" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="37268" PostTypeId="1" CreationDate="2016-12-13T02:51:45.340" Score="1" ViewCount="557" Body="&lt;p&gt;In an HDLC frame, the address field can be 8 bits, or extended according to what the first bit is. I know that &lt;code&gt;11111111&lt;/code&gt; is a broadcast address, and that there are 2^7 possible addresses in an 8-bit address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: How are those addresses are distributed? Is there a random addressing or something live DHCP provided by HDLC?&lt;/p&gt;&#xA;" OwnerUserId="32750" LastEditorUserId="8499" LastEditDate="2016-12-13T03:17:23.173" LastActivityDate="2016-12-13T03:17:23.173" Title="How are addresses distributed in HDLC?" Tags="|layer2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37269" PostTypeId="2" ParentId="37268" CreationDate="2016-12-13T03:06:27.617" Score="1" Body="&lt;p&gt;First, HDLC is actually vendor-dependent, and the HDLC implementation from one vendor is not compatible with HDLC implementation from another vendor.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;...there is 2^7 possible addresses in 8bits address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In an 8-bit address, there are 2^8 possible addresses, from &lt;code&gt;0&lt;/code&gt; to &lt;code&gt;(2^8)-1&lt;/code&gt;, or &lt;code&gt;0&lt;/code&gt; to &lt;code&gt;255&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;my question is how those addresses are distributed, is there a random&#xA;  addressing or something live dhcp provided by hdlc?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You seem to be confusing things. DHCP is for layer-3 addressing, but HDLC is a layer-2 protocol. How each vendor assigns addresses is vendor-specific. For example, Cisco HDLC has two addresses: &lt;code&gt;10001111&lt;/code&gt; and &lt;code&gt;00001111&lt;/code&gt; for broadcast and unicast, respectively. The Cisco broadcast address only means that the layer-3 protocol has a broadcast address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-13T03:06:27.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37270" PostTypeId="1" CreationDate="2016-12-13T04:19:33.330" Score="1" ViewCount="65" Body="&lt;p&gt;1st: I would like to thank you for your time.&#xA;2nd: I was asked by a charity organization to help building a system and network for the charity center where they help the most needed groups in the society as much as they can. We need to keep the budget as low as possible.&#xA;We need help choosing cheap network devices (Routers-Switches-APs) but good enough not to impedes the work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the network we need to build:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/IvSF9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IvSF9.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notes:&#xA;1- The Router will be connected to ADSL so the users can access the internet and to allow remote monitor for the surveillance cameras.&#xA;2- The PCs numbers in the pictures are the actual real numbers of PCs in each subnet. (maybe very few cellphones connected to some APs and a few printers).&#xA;3- Merging vlans is possible if necessary.&#xA;4- Can unmanaged switches be used to reduce coast? would it possible to use cheap non-Cisco switches and access points that doesn't understand Vlans?. Switches and APs from TP-Link as an example.&#xA;5- I know that the SW_0 is considered a single point failure, but we have to work with a very low budget.&#xA;6- I'm an IT technician not a network engineer (studing to be), so I don't have much experience and knowledge with cisco networks. I'm kinda a CCNA level network engineer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help us to make to make things better for the most needed people out here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you again : )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a nice day everyone.&lt;/p&gt;&#xA;" OwnerUserId="32752" LastActivityDate="2016-12-13T04:43:55.963" Title="Need Advice From Experienced Techs Please - For Charity Organization in Africa" Tags="|layer2|access-point|layer3|" AnswerCount="1" CommentCount="2" ClosedDate="2016-12-13T14:05:37.813" ContentLicense="CC BY-SA 3.0" />
  <row Id="37271" PostTypeId="1" CreationDate="2016-12-13T04:23:05.113" Score="1" ViewCount="481" Body="&lt;p&gt;Do I need to add an IP route for all subnets past the subnet I've routed to?&#xA;For example, from R1, do I need to set up a route for .64, .112, .128, .80, .144, .160, and .96?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zHCd2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zHCd2.png&quot; alt=&quot;Network Map&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32751" LastEditorUserId="32751" LastEditDate="2016-12-13T04:31:28.467" LastActivityDate="2021-01-11T07:57:46.500" Title="Do I need to add a route for each subnet beyond the subnet I've routed to?" Tags="|cisco|routing|ipv4|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37272" PostTypeId="2" ParentId="37271" CreationDate="2016-12-13T04:31:53.030" Score="4" Body="&lt;p&gt;In short: yes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For routing to work all routers must know the routes to all destination. Because keeping all routers correctly configured manually is tedious and error-prone you usually use a routing protocol (OSPF etc) to do that automatically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Non-routers (PCs etc) need to have a route to a default gateway that will route the packet to its destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the network becomes larger then you usually aggregate routes. So instead of having separate routes for (for example) &lt;code&gt;10.1.0.0/24&lt;/code&gt;, &lt;code&gt;10.1.1.0/24&lt;/code&gt;, &lt;code&gt;10.1.2.0/24&lt;/code&gt; and &lt;code&gt;10.1.3.0/24&lt;/code&gt; all pointing in the same direction you would aggregate that into one route for &lt;code&gt;10.1.0.0/22&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2016-12-13T04:31:53.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37273" PostTypeId="2" ParentId="37270" CreationDate="2016-12-13T04:43:55.963" Score="1" Body="&lt;p&gt;I can't provide brand recommendations, but I would recommend used enterprise-grade hardware.  Ebay is a great resource.  Managed layer-2 and even layer-3 switches, for instance, can be had for pennies on the original retail dollar, especially if you're willing to work with cosmetically imperfect equipment.  I'm not very familiar with TP-Link, but I do know you can buy quality used network hardware for less than new TP gear, and I would enthusiastically recommend doing so.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Managed switches are &lt;em&gt;necessary&lt;/em&gt; to implement VLANs.  Switch0 could utilize a pair of aggregated links to its downlink partners (i.e. SW1) when possible to provide an extra inexpensive and easy-to-configure layer of redundancy and extra bandwidth as well.  Switch0 could actually be a pair of switches too.  This would give the core itself some extra redundancy.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-12-13T04:43:55.963" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37275" PostTypeId="1" CreationDate="2016-12-13T07:57:32.087" Score="1" ViewCount="816" Body="&lt;p&gt;I have a Juniper EX3300 switch that has a 10Gbps connection to our upstream provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our upstream provider (lets call them Provider A) passes us various connections on tagged VLANs over this single connection. Transit and interconnect etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We now have a 3rd party provider (Provider B) who has a pop in another data center that we need to pull into our network. It was agreed that Provider A would run a L2 interconnect to their pop and then pass their traffic tagged down our 10Gb trunk. This was all fine until the requirement has changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Provider B now needs to send us their customer traffic tagged on various VLANs. This means that we need to somehow accept VLANs in VLANs (Q-in-Q).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks to me like the EX3300 can only use the dot1q-tunneling options within the vlans stanza and you can't mix and match VLANs using dot1q-tunneling with VLANs that aren't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any ideas of how I might be able to run both on my trunk port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ProviderB is passing us Customer1's traffic tagged on VLAN 1201. ProviderA is passing us all of ProviderB's traffic tagged on VLAN 1755&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ProviderB-Customer1 {&#xA;    vlan-id 1755;&#xA;    interface {&#xA;        xe-0/1/0.0;&#xA;    }&#xA;    dot1q-tunneling {&#xA;        customer-vlans 1201;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However I can't commit this config mixing dot1q-tunneling with normal VLANs&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;error: Trunk interface &amp;lt;ae0.0&amp;gt; can not be memeber of both dot1q-tunneling enabled vlan &amp;lt;ProviderA-Customer1&amp;gt;, and a non dot1q-tunneled vlan &amp;lt;ProviderA-Transit&amp;gt; when dot1q-tunneling ethernet-type is not &amp;lt;0x8100&amp;gt;&#xA;error: configuration check-out failed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT2&lt;/strong&gt;&#xA;I have just found a post on the &lt;a href=&quot;https://forums.juniper.net/t5/Ethernet-Switching/QinQ-VLAN-transport-Issue-over-Etherchannel/td-p/222647&quot; rel=&quot;nofollow noreferrer&quot;&gt;Juniper forums&lt;/a&gt; that contains the following snippet&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When enabling dot1q tunneling, the inner ether-type VLAN tag (C-TAG)&#xA;  uses the TPID value of 0x8100 while the outer ether-type VLAN tag&#xA;  (S-VLAN) uses the TPID value of 0x88A8. By default, a standard trunk&#xA;  interface understands the 0x8100 format and will not understand how to&#xA;  process a VLAN tag with the TPID value of 0x88A8. Because of this&#xA;  behavior, you must EITHER enable dot1q tunneling on all trunk&#xA;  interfaces that will be passing the S-VLAN tag OR you can set the&#xA;  dot1q tunneling VLAN tags to use the TPID value of 0x8100 by manually&#xA;  defining the dot1q tunneling ether-type value under the  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;[edit ethernet-switching-options]&#xA;  set dot1q-tunneling ether-type 0x8100. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;One or the other.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I have tried this and I can now commit my config with both normal VLANs and dot1q enabled VLANs on the same port. Hopefully this will work as expected!&lt;/p&gt;&#xA;" OwnerUserId="139" LastEditorUserId="139" LastEditDate="2016-12-13T08:45:06.863" LastActivityDate="2016-12-13T08:45:06.863" Title="Juniper EX3300 and Q-in-Q" Tags="|vlan|juniper|juniper-ex|qinq|dot1q|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37280" PostTypeId="2" ParentId="9854" CreationDate="2016-12-13T09:54:24.157" Score="1" Body="&lt;p&gt;On the Firewall if you are using an SRX, check what your security flow sessions are set to and if it is reaching the limit.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show security flow session summary &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32760" LastEditorUserId="1392" LastEditDate="2017-01-18T08:16:08.890" LastActivityDate="2017-01-18T08:16:08.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37282" PostTypeId="1" CreationDate="2016-12-13T12:30:38.373" Score="1" ViewCount="189" Body="&lt;p&gt;I am confused about sequence &amp;amp; acknowledgement numbers of TcpIp. Here is the detail why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: I have two server connections and two client connections. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client make connections at remote addresses. &#xA;Server accepts two connections separately not those which are for clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So Is each client &amp;amp; server will manage separate unique sequence &amp;amp; acknowledgement number. e.g Client 1 seq=5   Client 2 sequence= 10  Server 1 sequence=17    &amp;amp; Server 2 sequence number =25&#xA;?&lt;/p&gt;&#xA;" OwnerUserId="32762" LastEditorUserId="8499" LastEditDate="2017-07-16T03:38:38.570" LastActivityDate="2017-07-16T03:38:38.570" Title="Sequence &amp; Acknowledgement numbers in TcpIp" Tags="|tcp|layer4|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37283" PostTypeId="1" AcceptedAnswerId="37297" CreationDate="2016-12-13T13:18:28.613" Score="1" ViewCount="66" Body="&lt;p&gt;Assume that we got a lot of distributed computers, and their internal clocks unreliable. We can measure round trip times by a ping and a response, but how can one calculate the to and from times between all of the computers? &lt;/p&gt;&#xA;" OwnerUserId="32763" LastActivityDate="2016-12-14T01:11:20.943" Title="To and from time estimation using round trip time" Tags="|routing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37284" PostTypeId="2" ParentId="37252" CreationDate="2016-12-13T13:41:19.610" Score="2" Body="&lt;p&gt;Unfortunately BGP will not help you, this is small-scale.  You will not be able to justify a provider-independent block of addresses for a single web server even if RIPE is still issuing them.  Without a large enough address block, no ISP can advertise your PI address block anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really must host these webservers yourself then the solution is to host the DNS for your domains, possibly using CNAME records if you need to.  You control the IP address used to contact the servers at any moment in time.  You may need to buy some sort of DNS appliance or load-balancer to do this, or maybe just multiple use DNS views on a single DNS server.  It just depends on your business need and budget.  Good resilience is expensive and you need to analyse what risks you are protecting against and ensure that in increasing the complexity you are not creating extra technical and/or operational risks.  The details of this solution are off-topic here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, unless you have ambitions to grow into a hosting centre business, I can't see why you wouldn't just stick the webservers in the cloud and relieve yourself of this sort of network problem.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-12-13T13:41:19.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37288" PostTypeId="2" ParentId="37252" CreationDate="2016-12-13T17:22:28.600" Score="0" Body="&lt;p&gt;I agree with @artem_d93 that BGP is the most appropriate solution.  With BGP, when one path fails, re-convergence occurs and a new path (over the alternate ISP) is presented to network traffic.  This can take several minutes to occur.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really need to ask yourself or management how critical it is that these servers remain available if an ISP or a piece of network equipment fails.  If it's not overkill and it's really necessary, one way to go might be to so something like I've done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two Cisco 4431 routers for each ISP, each connected directly to the other, sharing a standby (HSRP) address.  These connect to a pair of DMZ switches that are port channeled together (not a stack as a stack could fail).  Then have two ASA 5515X that are connected so they share state and failover.  Then on to two Nexus 5548UP switches at my network core.  This is a fully redundant setup so if there is a failure anywhere along the line, we will keep running.  Our IPv4 and IPv6 blocks are used for addresses between the ASA 5515x and ISR4431 routers.  I also have a dedicated WAN router (that has other one off connections) connected back to my core as well as to the 4431 routers &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ask one of your ISPs to allocate you an IPv4 /24 block (the smallest possible).  You will pay a monthly fee for this, but then it will be assigned for your needs as long as you stay with the ISP.  You will need at least one business class router or routing firewall appliance that can handle BGP.  Most of the dedicated routers can as well as some of the firewall appliances.  Consumer grade equipment &lt;strong&gt;cannot&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have a block assigned, you will need to get an ASN from RIPE.  This Autonomous System Number will allow you to be a unique node on the internet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have redundant ISPs, you should have two routers that share an IP address (look up HSRP) in a standby/failover config, each router connected to one ISP.  With HSRP, if one router fails, traffic will run over the other - the will share one of your assigned public addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Between the previously mentioned routers and your private network, you should have a (or a pair) of firewall devices.  And perhaps a pair of DMZ switches.  With all of this interconnected, you can have a fully redundant internet connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or you can have a pair of firewall devices that have all of this self contained.  It can get pretty extensive, but if you really need it, it's really a solid way to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If you are accessing the addresses by IP address and port, give your end users both and tell them to use one if the other fails to load.  It's clumsy work-around though.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If you have control over your DNS records, you can update the address, but make sure the TTL is set very low so stale records won't be around very long.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a web hosting service if possible - Some of them can provide VPN connectivity so the hosted servers can access internal data, however the type of access might make this unusable (such as database access).  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32328" LastActivityDate="2016-12-13T17:22:28.600" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37289" PostTypeId="1" AcceptedAnswerId="37302" CreationDate="2016-12-13T19:21:17.870" Score="1" ViewCount="1011" Body="&lt;p&gt;Quick question - I was learning about subinterfaces and using Cisco Packet Tracer I wanted to create simple network with two computers (every in different networks (192.168.1.1/24 and 192.168.2.1/24 and different VLAN) and using one router connect them. So my problem is that when I was typing the network &lt;code&gt;R1(config-subif)#ip address 192.168.1.10 255.255.255.0&lt;/code&gt;&#xA; wasn't working while &lt;code&gt;R1(config-subif)#ip address 192.168.1.1 255.255.255.0&lt;/code&gt;&#xA; was working.&#xA;I'm just curious why there is there difference because both 192.168.1.1/24 and 192.168.1.10/24 will give 192.168.1.1 - 192.168.1.254 host adresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&#xA;So to be more precise I was just pinging two computers and there was &quot;Request timed out&quot; message.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/u0gx5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u0gx5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32468" LastEditorUserId="32468" LastEditDate="2016-12-13T19:47:37.823" LastActivityDate="2021-01-10T12:16:58.920" Title="Subinterface in cisco router" Tags="|routing|subnet|" AnswerCount="3" CommentCount="7" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37290" PostTypeId="1" AcceptedAnswerId="37291" CreationDate="2016-12-13T19:29:39.887" Score="1" ViewCount="676" Body="&lt;p&gt;I have an HP 5406zl layer 3 switch. Attached below is a simple diagram of the network.&#xA;the network 172.16.0.0/16 (vlan 10) has the gateway 172.16.0.1 which sits behind the switch. And the network 172.30.0.0 (vlan 20) has it's gateway on the switch (172.30.0.1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9H7ZI.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9H7ZI.png&quot; alt=&quot;simple network diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently what happens is when i want to reach vlan 20 from vlan 10, the traffic flow to the router behind the swtch and then back to the switch and to vlan 20.&#xA;I want to know if its possible to create a Policy Based Route on the switch which would directly route the traffic coming from vlan10 to vlan20 without going to the vlan10 gateway(router). And all other traffic from vlan 10 should go to the the router.&lt;/p&gt;&#xA;" OwnerUserId="32771" LastActivityDate="2016-12-14T04:29:33.147" Title="Policy Based Routing on switch that is not the gateway" Tags="|routing|hp|pbr|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37291" PostTypeId="2" ParentId="37290" CreationDate="2016-12-13T19:33:36.300" Score="1" Body="&lt;p&gt;If the switch isn't routing, then you need to do PBR on the router.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The proper way to configure your network is to make the layer-3 switch the gateway for both VLANs, and create a routed link from the layer-3 switch to the WAN router. The layer-3 switch should be the LAN router, separate from the WAN router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-13T19:33:36.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37293" PostTypeId="1" CreationDate="2016-12-13T22:39:41.943" Score="1" ViewCount="451" Body="&lt;p&gt;When saying (end-to-end QoS) in network, what do we really mean by that?&lt;/p&gt;&#xA;" OwnerUserId="32299" LastActivityDate="2016-12-13T22:44:21.040" Title="The meaning of end-to-end QoS in network" Tags="|cisco|qos|network-core|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37294" PostTypeId="2" ParentId="37293" CreationDate="2016-12-13T22:44:21.040" Score="2" Body="&lt;p&gt;QoS is a very large and complex subject that encompasses everything from classifying and marking packets, to performing some sort of action (shaping, policing, queuing, etc.) based on the classification/marking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;End-to-end QoS involves classifying and marking packets at the source and having comprehensive and consistent QoS policies of how the various classifications/markings are treated from the packet source to the packet destination.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-13T22:44:21.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37297" PostTypeId="2" ParentId="37283" CreationDate="2016-12-14T01:11:20.943" Score="1" Body="&lt;p&gt;To get accurate one-way latency you need one of the following-&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;A single device that connects to both points in the network.  This is usually a traffic generator (a la iXia or similar) that will send a packet out one interface and receive on another.  This is how port-to-port latency on a network device is typically measured but would rarely be seen outside a specific test environment.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Hosts (and network devices) that &lt;strong&gt;do&lt;/strong&gt; support a highly accurate time protocol - specifically IEEE 1588, the &lt;a href=&quot;https://en.wikipedia.org/wiki/Precision_Time_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;Precision Time Protocol&lt;/a&gt;, which allows for &lt;em&gt;much&lt;/em&gt; more precise clock distribution than good old NTP.  One of the common uses of PTP is actually for network devices (and certain applications) to very precisely timestamp packets as they traverse the network.  Since the timing is both well-distributed and high resolution this provides an excellent ongoing view of one-way latency values on both a per-hop and an end-to-end basis.  PTP is a fairly common feature in a lot of DC-class switches nowadays (..although implementation quality varies) but its deployment tends to be sparse outside of certain industry verticals.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-14T01:11:20.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37298" PostTypeId="2" ParentId="37282" CreationDate="2016-12-14T01:14:22.993" Score="1" Body="&lt;p&gt;Sequence numbers are negotiated and incremented on a per-socket basis.  If there are two TCP sessions running between two hosts the TCP sequence numbers are completely independent.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-14T01:14:22.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37299" PostTypeId="2" ParentId="37233" CreationDate="2016-12-14T04:05:16.110" Score="1" Body="&lt;p&gt;The difference between an ACL and a firewall is keyword &lt;em&gt;stateful&lt;/em&gt;.  A firewall keeps a state table whereas a basic ACL simply filters based on layer 3/4 properties.  In a router, firewall functionality has been called Context based acccess control, CBAC.  There are also reflexive ACL's.  We now have NGFW's with deepest packet inspection (application aware firewalls).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://floodlight.atlassian.net/wiki/display/floodlightcontroller/Static+Entry+Pusher+API&quot; rel=&quot;nofollow noreferrer&quot;&gt;Static Entries&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;when a packet reaches an OpenFlow switch without a matching flow. The&#xA;  packet is sent to the controller, which evaluates it, adds the&#xA;  appropriate entries, and lets the switch continue its forwarding.&#xA;  Alternatively, entries can be inserted proactively by the controller&#xA;  in switches before packets arrive.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-14T04:05:16.110" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37300" PostTypeId="2" ParentId="37289" CreationDate="2016-12-14T04:15:30.423" Score="0" Body="&lt;p&gt;Default gateway missing on PC's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your hosts/endpoints need to have a default gateway in addition to an IP address.  Without the default gateway, the endpoint don't know how/where to send the packet for the other subnet.  The default gateway is going to be on the same subnet as the PC's NIC card.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-14T04:15:30.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37301" PostTypeId="2" ParentId="37290" CreationDate="2016-12-14T04:29:33.147" Score="0" Body="&lt;p&gt;HP 5406zl max's out at 150 ports.  Just change your IP scheme to a /22 which accommodates 1024 hosts and run a single VLAN across switches.  You might even be able to get away with a /24 subnet on a single VLAN across the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a good reason for and insist on multiple VLAN's, you'll get best inter-vlan performance on that 5406 switch, however, if you happen to have a transparent or virtual wire firewall, the router on a stick topology (routing in the router vs the switch) is required to enable that (so you can insert in the path of intervlan frames/packets).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-14T04:29:33.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37302" PostTypeId="2" ParentId="37289" CreationDate="2016-12-14T08:27:28.737" Score="1" Body="&lt;p&gt;Besides on what was already mentioned, just to answer your question, it looks like you are trying to setup an IP address in the router which already belongs to PC0. Take a look and notice as they are the same - and you might know that two devices can not have the same IP address. &lt;/p&gt;&#xA;" OwnerUserId="32602" LastActivityDate="2016-12-14T08:27:28.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37305" PostTypeId="1" AcceptedAnswerId="37350" CreationDate="2016-12-14T11:05:36.183" Score="1" ViewCount="887" Body="&lt;p&gt;i have ipsec l2l VPN over internet, I wander if there is default policy in ASA for making ipsec traffic with higher priority? &#xA;My question basically is, if one of packet from two packets must be dropped, which one will it be ipsec or any other? what is the default?  &lt;/p&gt;&#xA;" OwnerUserId="27132" LastEditorUserId="27132" LastEditDate="2016-12-14T11:27:48.973" LastActivityDate="2016-12-16T15:55:27.127" Title="ASA's traffic policy(QoS) for ipsec VPN tunnels" Tags="|cisco-asa|vpn|ipsec|qos|policing|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37311" PostTypeId="1" AcceptedAnswerId="37312" CreationDate="2016-12-14T14:52:03.403" Score="1" ViewCount="7522" Body="&lt;p&gt;There was this config in my show run config in Cisco 2900 series router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip forward-protocol nd&#xA;!&#xA;ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this config the reason i had to restart the biometric devices every single time.&#xA;Could you please help me understand this config. &#xA;Help.&lt;/p&gt;&#xA;" OwnerUserId="23114" LastEditorUserId="8499" LastEditDate="2018-03-09T21:12:34.037" LastActivityDate="2018-03-09T21:12:34.037" Title="Understanding the config" Tags="|cisco|router|cisco-commands|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37312" PostTypeId="2" ParentId="37311" CreationDate="2016-12-14T14:57:22.780" Score="3" Body="&lt;p&gt;None of those commands should have any effect on your networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ip forward-protocol nd&lt;/code&gt; command simply means that the router will forward ND packets for diskless workstations. This is rather obsolete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;ip http&lt;/code&gt; commands are for the HTTP server in the router itself. It is a way to configure the router with HTTP, and it means nothing to anything else connected to the router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-14T14:57:22.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37315" PostTypeId="1" AcceptedAnswerId="37426" CreationDate="2016-12-14T15:47:45.597" Score="3" ViewCount="7657" Body="&lt;p&gt;For example, I have a MAC address which i know is the MAC address on one of the interfaces. However when I search to what interface the MAC address belongs, it does not show me to what interface it belongs as this is on a separate line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using grep to go through a router config I can use &lt;strong&gt;grep -5 [MAC ADDRESS]&lt;/strong&gt; to show 5 lines above and 5 lines below the line on which the search string is found. How ever MAC addresses are not in the running config, so is this possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A sort of workaround I use now is use &lt;strong&gt;sh interaces | begin [MAC ADDRESS]&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I know the interface below I know what interface the MAC address belongs to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is there an equivalent of &lt;strong&gt;grep -5 [MAC ADDRESS]&lt;/strong&gt;?&lt;/p&gt;&#xA;" OwnerUserId="30328" LastEditorUserId="30328" LastEditDate="2016-12-14T19:38:46.467" LastActivityDate="2019-05-13T15:27:51.077" Title="Can I match on a search string and show the lines above it in IOS?" Tags="|cisco-ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37318" PostTypeId="1" CreationDate="2016-12-14T17:32:42.053" Score="1" ViewCount="210" Body="&lt;p&gt;We have been experiencing an issue with one-way VOIP calls from our Cisco 7936 conference phone, as of late.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Initially, the call starts off OK, but after few minutes remote leg drops and they cannot hear us. This applies to internal and external calls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phone - Cisco 7936&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Protocols  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CUCM 9.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VG - 2921 IOS 15&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Phone is connected to 2960P 10/100mbps switch &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the interface it connects to I can see multiple drops &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can we improve our QOS settings at all? If so, what bits need changing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I disable QOS globally on the switch to see if QOS is at fault?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some show output from the 2960P switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;FROM INTERFACE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh mls qos int fa 0/33 statistics&#xA;FastEthernet0/33 (All statistics are in packets)&#xA;dscp: incoming&#xA;-------------------------------&#xA;0 - 4 : 108722 0 0 0 0  &#xA;5 - 9 : 0 0 0 0 0  &#xA;10 - 14 : 0 0 0 0 0&#xA;15 - 19 : 0 0 0 0 0&#xA;20 - 24 : 0 0 0 0 2833166&#xA;25 - 29 : 0 0 0 0 0&#xA;30 - 34 : 0 0 0 0 0&#xA;35 - 39 : 0 0 0 0 0&#xA;40 - 44 : 0 0 0 0 0&#xA;45 - 49 : 0 28807936 0 0 0&#xA;50 - 54 : 0 0 0 0 0&#xA;55 - 59 : 0 0 0 0 0&#xA;60 - 64 : 0 0 0 0&#xA;dscp: outgoing&#xA;-------------------------------&#xA;0 - 4 : 407407368 0 0 0 0&#xA;5 - 9 : 0 0 0 0 0&#xA;10 - 14 : 0 0 0 0 0  &#xA;15 - 19 : 0 0 0 0 0  &#xA;20 - 24 : 0 0 0 0 480949  &#xA;25 - 29 : 0 0 0 0 0  &#xA;30 - 34 : 0 0 0 0 0  &#xA;35 - 39 : 0 0 0 0 0  &#xA;40 - 44 : 0 0 0 0 0  &#xA;45 - 49 : 0 756928 0 5353 0  &#xA;50 - 54 : 0 0 0 0 0  &#xA;55 - 59 : 0 0 0 0 0  &#xA;60 - 64 : 0 0 0 0  &#xA;cos: incoming  &#xA;-------------------------------  &#xA;0 - 4 : 602511 0 0 2832957 0  &#xA;5 - 7 : 28807936 0 0  &#xA;cos: outgoing  &#xA;-------------------------------  &#xA;0 - 4 : 1372914286 0 0 1495358 0  &#xA;5 - 7 : 1021323 5353 11171  &#xA;Policer: Inprofile: 8845 OutofProfile: 0&#xA;sh int fa 0/33 switching&#xA;&#xA;FastEthernet0/33&#xA;Throttle count 0&#xA;Drops RP 0 SP 0&#xA;SPD Flushes Fast 0 SSE 0&#xA;SPD Aggress Fast 0&#xA;SPD Priority Inputs 0 Drops 0&#xA;Protocol Path Pkts In Chars In Pkts Out Chars Out&#xA;Other Process 0 0 2695252 161715120&#xA;Cache misses 0&#xA;Fast 0 0 0 0&#xA;Auton/SSE 0 0 0 0&#xA;Spanning Tree Process 0 0 26729009 1710656576&#xA;Cache misses 0&#xA;Fast 0 0 0 0&#xA;Auton/SSE 0 0 0 0&#xA;CDP Process 449615 65194111 449590 295830220&#xA;Cache misses 0&#xA;Fast 0 0 0 0&#xA;Auton/SSE 0 0 0 0&#xA;Policed-dscp map:&#xA;d1 : d2 0 1 2 3 4 5 6 7 8 9&#xA;---------------------------------------&#xA;0 : 00 01 02 03 04 05 06 07 08 09&#xA;1 : 10 11 12 13 14 15 16 17 18 19&#xA;2 : 20 21 22 23 00 25 00 27 28 29&#xA;3 : 30 31 32 33 34 35 36 37 38 39&#xA;4 : 40 41 42 43 44 45 00 47 48 49&#xA;5 : 50 51 52 53 54 55 56 57 58 59&#xA;6 : 60 61 62 63&#xA;Dscp-cos map:&#xA;d1 : d2 0 1 2 3 4 5 6 7 8 9&#xA;---------------------------------------&#xA;0 : 00 00 00 00 00 00 00 00 01 01&#xA;1 : 01 01 01 01 01 01 02 02 02 02&#xA;2 : 02 02 02 02 03 03 03 03 03 03&#xA;3 : 03 03 04 04 04 04 04 04 04 04&#xA;4 : 05 05 05 05 05 05 05 05 06 06&#xA;5 : 06 06 06 06 06 06 07 07 07 07&#xA;6 : 07 07 07 07&#xA;Cos-dscp map:&#xA;cos: 0 1 2 3 4 5 6 7&#xA;--------------------------------&#xA;dscp: 0 8 16 24 32 46 48 56&#xA;#show platform port-asic stats drop&#xA;&#xA;Port-asic Port Drop Statistics - Summary&#xA;========================================&#xA;RxQueue 0 Drop Stats: 0&#xA;RxQueue 1 Drop Stats: 0&#xA;RxQueue 2 Drop Stats: 0&#xA;RxQueue 3 Drop Stats: 0&#xA;Port 0 TxQueue Drop Stats: 0&#xA;Port 1 TxQueue Drop Stats: 0&#xA;Port 2 TxQueue Drop Stats: 440662713&#xA;Port 3 TxQueue Drop Stats: 440672169&#xA;Port 4 TxQueue Drop Stats: 440661375&#xA;Port 5 TxQueue Drop Stats: 440683372&#xA;Port 6 TxQueue Drop Stats: 440659135&#xA;Port 7 TxQueue Drop Stats: 440706463&#xA;Port 8 TxQueue Drop Stats: 101014&#xA;Port 9 TxQueue Drop Stats: 440664511&#xA;Port 10 TxQueue Drop Stats: 440672995&#xA;Port 11 TxQueue Drop Stats: 441258960&#xA;Port 12 TxQueue Drop Stats: 440659986&#xA;Port 13 TxQueue Drop Stats: 440652146&#xA;Port 14 TxQueue Drop Stats: 1406763&#xA;Port 15 TxQueue Drop Stats: 440658062&#xA;Port 16 TxQueue Drop Stats: 440655907&#xA;Port 17 TxQueue Drop Stats: 440677503&#xA;Port 18 TxQueue Drop Stats: 440651635&#xA;Port 19 TxQueue Drop Stats: 440661862&#xA;Port 20 TxQueue Drop Stats: 440660011&#xA;Port 21 TxQueue Drop Stats: 442472877&#xA;Port 22 TxQueue Drop Stats: 133670&#xA;Port 23 TxQueue Drop Stats: 440664683&#xA;Port 24 TxQueue Drop Stats: 440661050&#xA;Port 25 TxQueue Drop Stats: 440659656&#xA;Supervisor TxQueue Drop Statistics&#xA;Queue 0: 0&#xA;Queue 1: 0&#xA;Queue 2: 0&#xA;Queue 3: 1239773644&#xA;Queue 4: 0&#xA;Queue 5: 0&#xA;Queue 6: 0&#xA;Queue 7: 15220&#xA;Queue 8: 1302109834&#xA;Queue 9: 0&#xA;Queue 10: 62354137&#xA;Queue 11: 0&#xA;Queue 12: 0&#xA;Queue 13: 0&#xA;Queue 14: 0&#xA;Queue 15: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT - EXTRA SHOW OUTPUT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;**#sh mls qos** &#xA;QoS is enabled&#xA;QoS ip packet dscp rewrite is enabled&#xA;&#xA;&#xA;**#show mls qos interface fa0/23**&#xA;&#xA;FastEthernet0/23&#xA;Attached policy-map for Ingress: AutoQoS-Police-CiscoPhone&#xA;trust state: trust cos&#xA;trust mode: trust cos&#xA;trust enabled flag: ena&#xA;COS override: dis&#xA;default COS: 0&#xA;DSCP Mutation Map: Default DSCP Mutation Map&#xA;Trust device: cisco-phone&#xA;qos mode: port-based&#xA;MK-2960P-01#show mls qos interface fa0/33&#xA;FastEthernet0/33&#xA;Attached policy-map for Ingress: AutoQoS-Police-CiscoPhone&#xA;trust state: trust cos&#xA;trust mode: trust cos&#xA;trust enabled flag: ena&#xA;COS override: dis&#xA;default COS: 0&#xA;DSCP Mutation Map: Default DSCP Mutation Map&#xA;Trust device: cisco-phone&#xA;qos mode: port-based&#xA;&#xA;**#sh run int fa0/33**&#xA;&#xA;Building configuration...&#xA;Current configuration : 324 bytes&#xA;!&#xA;interface FastEthernet0/33&#xA; switchport access vlan 20&#xA; switchport mode access&#xA; switchport voice vlan 50&#xA; srr-queue bandwidth share 10 10 60 20&#xA; priority-queue out &#xA; mls qos trust device cisco-phone&#xA; mls qos trust cos&#xA; auto qos voip cisco-phone &#xA; spanning-tree portfast&#xA; service-policy input AutoQoS-Police-CiscoPhone&#xA;end&#xA;&#xA;&#xA;**#show mls qos queue-set**&#xA;&#xA;Queueset: 1&#xA;Queue     :       1       2       3       4&#xA;----------------------------------------------&#xA;buffers   :      10      10      26      54&#xA;threshold1:     138     138      36      20&#xA;threshold2:     138     138      77      50&#xA;reserved  :      92      92     100      67&#xA;maximum   :     138     400     318     400&#xA;Queueset: 2&#xA;Queue     :       1       2       3       4&#xA;----------------------------------------------&#xA;buffers   :      16       6      17      61&#xA;threshold1:     149     118      41      42&#xA;threshold2:     149     118      68      72&#xA;reserved  :     100     100     100     100&#xA;maximum   :     149     235     272     242&#xA;&#xA;&#xA;**#show platform port-asic stats drop FastEthernet 0/33**&#xA;  Interface Fa0/33 TxQueue Drop Statistics&#xA;    Queue 0&#xA;      Weight 0 Frames 0&#xA;      Weight 1 Frames 0&#xA;      Weight 2 Frames 0&#xA;    Queue 1&#xA;      Weight 0 Frames 0&#xA;      Weight 1 Frames 0&#xA;      Weight 2 Frames 0&#xA;    Queue 2&#xA;      Weight 0 Frames 0&#xA;      Weight 1 Frames 0&#xA;      Weight 2 Frames 0&#xA;    Queue 3&#xA;      Weight 0 Frames 0&#xA;      Weight 1 Frames 0&#xA;      Weight 2 Frames 451146373&#xA;&#xA;**#sh int fa0/33 capabilities**&#xA;FastEthernet0/33&#xA;  Model:                 WS-C2960-48PST-L&#xA;  Type:                  10/100BaseTX&#xA;  Speed:                 10,100,auto&#xA;  Duplex:                half,full,auto&#xA;  Trunk encap. type:     802.1Q&#xA;  Trunk mode:            on,off,desirable,nonegotiate&#xA;  Channel:               yes&#xA;  Broadcast suppression: percentage(0-100)&#xA;  Flowcontrol:           rx-(off,on,desired),tx-(none)&#xA;  Fast Start:            yes&#xA;  QoS scheduling:        rx-(not configurable on per port basis),&#xA;                         tx-(4q3t) (3t: Two configurable values and one fixed.)&#xA;  CoS rewrite:           yes&#xA;  ToS rewrite:           yes&#xA;  UDLD:                  yes&#xA;  Inline power:          yes&#xA;  SPAN:                  source/destination&#xA;  PortSecure:            yes&#xA;  Dot1x:                 yes&#xA;&#xA;&#xA;**#show mls qos interface fastEthernet 0/33 queueing**&#xA;FastEthernet0/33&#xA;Egress Priority Queue : enabled&#xA;Shaped queue weights (absolute) :  25 0 0 0&#xA;Shared queue weights  :  10 10 60 20&#xA;The port bandwidth limit : 100  (Operational Bandwidth:100.0)&#xA;The port is mapped to qset : 1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32792" LastEditorUserId="32792" LastEditDate="2016-12-15T11:29:19.250" LastActivityDate="2019-05-06T06:02:45.810" Title="One-way calls Cisco 7936" Tags="|cisco-voip|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37319" PostTypeId="2" ParentId="37315" CreationDate="2016-12-14T18:13:36.327" Score="2" Body="&lt;p&gt;According to the following Cisco documentation there is no such equivalent grep-5 command.  The pipe command does support regular expressions to help filter the output.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/configuration/15_sy/fundamentals-15-sy-book/cf-cli-search.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/fundamentals/configuration/15_sy/fundamentals-15-sy-book/cf-cli-search.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following command could make the output more readable.  (Alternation)  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interfaces | include Gig|0000.0000.0000&#xA;&#xA;&#xA;Switch#show interfaces | in Gig|000c.5e48.0801&#xA;GigabitEthernet0/0 is up, line protocol is up (connected) &#xA;GigabitEthernet0/1 is up, line protocol is up (connected) &#xA;  Hardware is iGbE, address is 000c.5e48.0801 (bia 000c.5e48.0801)&#xA;GigabitEthernet0/2 is up, line protocol is up (connected) &#xA;GigabitEthernet0/3 is up, line protocol is up (connected) &#xA;GigabitEthernet1/0 is up, line protocol is up (connected) &#xA;GigabitEthernet1/1 is up, line protocol is up (connected) &#xA;GigabitEthernet1/2 is up, line protocol is up (connected) &#xA;GigabitEthernet1/3 is up, line protocol is up (connected) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some switch IOS code will list the MAC addresses of its interfaces with the following.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show mac address-table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OR&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show mac-address-table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2016-12-14T18:35:07.067" LastActivityDate="2016-12-14T18:35:07.067" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37320" PostTypeId="1" AcceptedAnswerId="37322" CreationDate="2016-12-14T19:52:15.660" Score="2" ViewCount="592" Body="&lt;p&gt;I was wondering if anyone knows if there is a way to change how to port lights function on a 6500 switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most switches work like this...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;No Light - Port in shutdown or no connection&lt;/li&gt;&#xA;&lt;li&gt;Solid Orange - Port error (spanning-tree issue, truck issue, etc...)  &lt;/li&gt;&#xA;&lt;li&gt;Flashing Orange - Duplex error &lt;/li&gt;&#xA;&lt;li&gt;Flashing Green - Working&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On the cisco 6500 it works like this...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Solid Orange - Port Shutdown&lt;/li&gt;&#xA;&lt;li&gt;Flashing Orange - Duplex error &lt;/li&gt;&#xA;&lt;li&gt;Flashing Green - Working&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Which is fine except I'm colourblind and its extremely difficult to tell the orange apart from the green led so if anyone know of a way to change this it would help be greatly the internet seems to say this is just the way it is but maybe its wrong.&lt;/p&gt;&#xA;" OwnerUserId="32793" LastActivityDate="2016-12-14T21:17:55.343" Title="Cisco 6500 Port Lights" Tags="|cisco|switch|ethernet|cisco-6500|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37321" PostTypeId="2" ParentId="37246" CreationDate="2016-12-14T19:57:18.027" Score="0" Body="&lt;p&gt;I found i was missing a NAT exemption on one side. Added it and it is working now.&lt;/p&gt;&#xA;" OwnerUserId="27364" LastActivityDate="2016-12-14T19:57:18.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37322" PostTypeId="2" ParentId="37320" CreationDate="2016-12-14T21:17:55.343" Score="2" Body="&lt;p&gt;Sorry to say that this isn't a configurable item.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-14T21:17:55.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37324" PostTypeId="2" ParentId="32970" CreationDate="2016-12-14T23:28:35.727" Score="8" Body="&lt;p&gt;Here is the answer : I couldn't find this value of 7981 bytes anywhere, and the links on wikipedia were dead, so I edited it to 2304.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The maximum 802.11 MTU is 2304 bytes.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the different possible maximum frame size of a 802.11 packet, according to the encryption scheme in use :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;MTU + MAC Header + Encryption Header&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;WEP&lt;/strong&gt; : 2304 + 34 + 8 = 2346 bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;WPA (TKIP)&lt;/strong&gt; : 2304 + 34 + 20 = 2358 bytes&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;WPA2 (CCMP)&lt;/strong&gt; : 2304 + 34 + 16 = 2354 bytes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If QoS is used, an additional 2 bytes header is added before the payload, increasing the frame size by 2 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/l4klM.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/l4klM.png&quot; alt=&quot;802.11 MPDU&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note that the Encryption header is missing on the picture. It would be placed after QoS Control, inside the frame body, but would not decrease the available 2304 bytes for application data.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, the &quot;Address 4&quot; field of a 802.11 frame is often not used, effectively reducing the frame size by 6 bytes for most 802.11 &lt;a href=&quot;https://en.wikipedia.org/wiki/Protocol_data_unit#Media_access_control_protocol_data_unit&quot; rel=&quot;noreferrer&quot;&gt;MPDU&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="24434" LastEditorUserId="24434" LastEditDate="2017-05-17T01:01:53.663" LastActivityDate="2017-05-17T01:01:53.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37327" PostTypeId="1" CreationDate="2016-12-15T07:21:47.600" Score="1" ViewCount="66" Body="&lt;p&gt;I want to implement the following scenario. I have an application that is hosted on a public server. My requirement is that I want make the internal network visible to the application. E.g&#xA;&lt;a href=&quot;http://app.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://app.com&lt;/a&gt; is the web app. One PC 172.16.1.54 has internet connection. I want my application to scan other hosts on network 172.16.1.0/24 using 172.16.1.54 (Not all PCs will have internet connection)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some research and some people suggested to configure a site-to-site vpn. However I am unable to grasp the concept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can some one please explain how this scenario will be implemented? &lt;/p&gt;&#xA;" OwnerUserId="32802" LastActivityDate="2016-12-15T13:06:54.873" Title="Connecting internal network to public server" Tags="|vpn|network-discovery|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37328" PostTypeId="2" ParentId="37327" CreationDate="2016-12-15T08:02:03.093" Score="2" Body="&lt;p&gt;There are 2 approaches for &lt;code&gt;VPN&lt;/code&gt;, one is &lt;code&gt;site-to-site VPN&lt;/code&gt; and other is &lt;code&gt;VPN client access&lt;/code&gt;. I think &lt;code&gt;VPN client access&lt;/code&gt; is sufficient(If the hosted app server is the only server wants to access &lt;code&gt;172.16.1.0/24&lt;/code&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should configure you hosted app server(&lt;code&gt;as VPN client&lt;/code&gt;) to create tunnel to your site. I believe your site has the gateway(Router), make &lt;code&gt;VPN&lt;/code&gt; config according to that. Now in your &lt;code&gt;app&lt;/code&gt; you should explicit scan &lt;code&gt;172.16.1.0/24&lt;/code&gt; network. Once that hosted app server has the &lt;code&gt;VPN&lt;/code&gt; configuration, then it knows how to forward the traffic which is destined to &lt;code&gt;176.16.1.0/24&lt;/code&gt;. Any way you should ask network admin&lt;/p&gt;&#xA;" OwnerUserId="17153" LastActivityDate="2016-12-15T08:02:03.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37329" PostTypeId="1" CreationDate="2016-12-15T08:50:47.820" Score="0" ViewCount="199" Body="&lt;p&gt;&lt;strong&gt;Thoughts and Query&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was tring to understand Inter-vlan routing and realised, that each exsisting vlan in the switch is configured with a different subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this is a good practice or is there any specific reasons,like what are the advantages of doing this(as each vlan is in itself a separate subnet...just an analogy)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts would be helpful.&lt;/p&gt;&#xA;" OwnerUserId="32806" LastActivityDate="2016-12-15T12:53:17.667" Title="Separate Subnet for Each Vlan?" Tags="|switch|vlan|subnet|trunk|" AnswerCount="2" CommentCount="0" ClosedDate="2016-12-15T13:20:39.620" ContentLicense="CC BY-SA 3.0" />
  <row Id="37330" PostTypeId="2" ParentId="37329" CreationDate="2016-12-15T09:10:12.997" Score="0" Body="&lt;p&gt;Most probably you have Router on a stick situation when single router is doing the routing for all these vlans. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you are a link to get the idea: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/336-cisco-router-8021q-router-stick.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/336-cisco-router-8021q-router-stick.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically you can't have overlapping IP addressing on a single router (ignoring VRFs)&lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2016-12-15T09:10:12.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37332" PostTypeId="1" CreationDate="2016-12-15T10:11:10.800" Score="1" ViewCount="759" Body="&lt;p&gt;I have a system that has an old network card, supporting 10 Mbps Half duplex.&#xA;Is there a way to &quot;wrap&quot; the system with a router or switch that will allow me to connect it to a 1000 Mbps full duplex network?&lt;/p&gt;&#xA;" OwnerUserId="32810" LastActivityDate="2016-12-15T16:08:56.573" Title="How to connect an old network card (10 Mbps) to a new network (1000Mbps)" Tags="|autonegotiation|half-duplex|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37333" PostTypeId="2" ParentId="37329" CreationDate="2016-12-15T12:53:17.667" Score="1" Body="&lt;p&gt;Vlans are layer two constructs.  Subnets are layer three constructs.&#xA;In all but a very few exceptions, you have one subnet per VLAN and vice versa.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-15T12:53:17.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37334" PostTypeId="2" ParentId="37327" CreationDate="2016-12-15T13:06:54.873" Score="1" Body="&lt;p&gt;A VPN can be thought of as a tunnel between your application server and your internal network, so that your server can access the internal network as if it were directly connected to it. The tunnel is established from your app server and your internet connected host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because you have PCs without Internet connectivity, and you want the scanning to appear to come from your internal host, this will get more complicated.  You may need some component of your app to run on the host.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-15T13:06:54.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37336" PostTypeId="2" ParentId="37332" CreationDate="2016-12-15T14:01:40.743" Score="2" Body="&lt;p&gt;Have you tried simply plugging it in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many, even most, (but not all) gigabit ports will negotiate down there. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the one you have won't, buy a small switch that &lt;strong&gt;will&lt;/strong&gt; (look for specs like 10/100/1000 for the port speeds), and put it between slow old device and the rest of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, put a new(er) network card in the device.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-12-15T14:01:40.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37337" PostTypeId="2" ParentId="37332" CreationDate="2016-12-15T14:05:25.047" Score="3" Body="&lt;p&gt;The router/switch you are plugging into should negotiate with the card. If you are plugging into a managed switch, you will likely be able to hard code the port's speed/duplex. In a Cisco device this would look like so:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Switch# conf t &lt;br&gt;&#xA;  Switch(config)# int fa0/0 &lt;br&gt;&#xA;  Switch(config)# speed 10 &lt;br&gt;&#xA;  Switch(config)# duplex half &lt;br&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15501" LastActivityDate="2016-12-15T14:05:25.047" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37339" PostTypeId="2" ParentId="35350" CreationDate="2016-12-15T15:16:36.957" Score="1" Body="&lt;p&gt;Having spent many weeks working with JTAC to find a solution... the answer was simply to reboot the node which is missing from the SNMP output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have set up a few SRX (345) clusters since having this issue and each time they have exhibited the fault. JTAC could not replicate so it's unlikely they will fix it.&lt;/p&gt;&#xA;" OwnerUserId="30148" LastActivityDate="2016-12-15T15:16:36.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37340" PostTypeId="2" ParentId="37318" CreationDate="2016-12-15T15:24:46.290" Score="2" Body="&lt;p&gt;@Dan I do not have reputation required, so I can't add comments... Please excuse me. Regarding the issue as far as I can see you have egress drops on queue 3 only. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here you are a guide describing very precisely how to configure the egress profile (QoS in 2960 is the same as 3750): &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-3750-series-switches/91862-cat3750-qos-config.html#def-config&quot; rel=&quot;nofollow noreferrer&quot;&gt;Catalyst QOS config&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When SRR scheduler is configured in shared mode, bandwidth allocated to each queue is based on relative weight. E.g. when configuring “srr-queue bandwidth share 30 20 25 25″ we obtain the weight sum as 30+20+25+25 = 100 (could be different, but it’s nice to reference to “100”, as a representation of 100%). Relative weights are therefore “30/100”, “20/100”, “25/100”, “25/100” and you can calculate the effective bandwidth &lt;em&gt;guaranteed&lt;/em&gt; to a queue multiplying this weight by the interface bandwidth: e.g. 30/100*100Mbps = 30Mbps for the 100Mbps interface and 30/100*10Mbps=3Mbps for 10Mbps interface. Of course, the weights are only taken in consideration when interface is oversubscribed, i.e. experiences a congestion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you enable “priority-queue out” on an interface, it turns queue 1 into priority queue, and scheduler effectively does not account for the queue’s weight in calculations. Note that PQ will also ignore shaped mode settings as well, and this may make other queues starve. In my opinion you can try to remove it. &lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2016-12-15T15:24:46.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37341" PostTypeId="2" ParentId="37332" CreationDate="2016-12-15T16:08:56.573" Score="1" Body="&lt;p&gt;I have done this several times (connecting 10M devices to 1G ports) and what I can tell is there is no rule for it, that could tell us in advance whether it will work or not. In theory, it should work, but some devices simply can't negotiate with the switch (or the switch with the device), which means that you will have to force the speed/duplex, just like the answer before. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just plug in and make a test, just like the in first answer. In case in case it doesn't work, start forcing the speed/duplex and good luck!&lt;/p&gt;&#xA;" OwnerUserId="32602" LastActivityDate="2016-12-15T16:08:56.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37342" PostTypeId="1" AcceptedAnswerId="37343" CreationDate="2016-12-15T18:02:18.617" Score="1" ViewCount="111" Body="&lt;p&gt;In a largish (1M+) IP environment I am responsible for monitoring/alarming and guarding IPAM integrity. Seeing an opportunity to kill two birds with one stone, I asked the guys responsible for the network (a mix of Cisco and Juniper) to configure the routers to send traps on BGP table content changes of internal networks. I want to use them for the NMS and to check for unauthorized networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are convinced this is a bad idea but are not able to explain, or I am not able to understand why, except for that this will generate a lot of traps, which I don't care for. Filtering and fatter NICs will take care of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a really bad idea and if so what would be a better approach? Keep in mind that a commercial solution is not an option.&lt;/p&gt;&#xA;" OwnerUserId="31307" LastEditorUserId="31307" LastEditDate="2016-12-16T05:51:22.440" LastActivityDate="2016-12-16T05:51:22.440" Title="Is letting routers generate traps on bgp changes a bad idea" Tags="|bgp|monitoring|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37343" PostTypeId="2" ParentId="37342" CreationDate="2016-12-15T18:08:21.197" Score="4" Body="&lt;p&gt;The concern is that generating the traps will affect the performance of the router, especially on that day when things go wrong and you have a lot of changes.  Some problem will cause instability, which will lead to a flurry of traps, which will tax the router, leading to even more instability,...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An alternative is to dedicate a router to monitoring the BGP table.  This router does not route traffic.  It participates in BGP, but does not advertise any prefixes.  This router can send you traps -- if it runs into problems, your network is not affected.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-15T18:08:21.197" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37347" PostTypeId="1" CreationDate="2016-12-15T19:24:07.667" Score="1" ViewCount="432" Body="&lt;p&gt;I have a remote site that needs both data and voice.  We have a VPN L2L tunnel up and running back to the hospital, no problem. The concern is that I have data and voice on the same VLAN, and it is working, but we have not placed a large load on the remote office as of yet.  Is there a preferred setup to have data and VoIP connecting back through a VPN connection?  Our hardware at the remote site is a Cisco 5505.&lt;/p&gt;&#xA;" OwnerUserId="32820" LastEditorUserId="8499" LastEditDate="2016-12-15T23:21:18.350" LastActivityDate="2016-12-16T05:34:49.330" Title="VoIP on a remote VPN site" Tags="|vpn|voip|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37348" PostTypeId="2" ParentId="37305" CreationDate="2016-12-15T20:28:36.847" Score="1" Body="&lt;p&gt;Unless your circuit provider is honoring QoS over the entire path between you and the other end of the tunnel, your traffic is at the mercy of the traffic control of every network you transit.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the traffic enters this uncontrolled space (think the Internet) packet behavior is unpredictable.  There is nothing that can be done to prevent packet drops once the traffic enters the l2l VPN tunnel.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;End-to-End QoS is required to change the likelyhood of a packet being dropped as it transits the network.  End-to-End QoS is typically reserved for Enterprise Grade private circuits as an additional feature/product of the service.  A QoS-enabled MPLS circuit or QoS- MetroEthernet circuit would be an example.  Business grade DLS or cable Internet would not be such examples.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, only traffic destined within the private circuit would be protected.&lt;/p&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2016-12-15T20:28:36.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37350" PostTypeId="2" ParentId="37305" CreationDate="2016-12-16T01:03:09.163" Score="1" Body="&lt;p&gt;It depends on what the real bottleneck is, where it is located and if you have any QoS treatments in place. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming the bottleneck is the available bandwidth by the provider and you have no treatments in place, both packets will exit out of your Firewall and the provider makes a decision on whether to drop the traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both packets ingress their respective interfaces.  One into the tunnel and another for the outside interface.   The firewall sees these as two logical interfaces though they are the same physical interface.  Since both interfaces can handle the traffic, both packets exit, unchallenged.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again the circuit provider will do what it wants with the traffic.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2016-12-16T15:55:27.127" LastActivityDate="2016-12-16T15:55:27.127" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37351" PostTypeId="2" ParentId="37347" CreationDate="2016-12-16T05:34:49.330" Score="3" Body="&lt;p&gt;They can be on the same VLAN.  That will have no impact whatsoever.  Your main potential issue is the lack of QoS on the Internet path.  Interestingly, this is a special scenario where disabling split tunneling may be advisable.  What I mean is that if all Internet traffic is routed through the main site / hospital, you have some control over the inbound traffic to the branch (and from).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you want to configure a class based queueing mechanism whereby voice always gets priority and other traffic is shaped so as to prohibit the branch from getting overloaded on ingress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, choose an Internet optimized codec for the telephony endpoints, iLBC i believe may be a good choice.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-16T05:34:49.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37353" PostTypeId="1" CreationDate="2016-12-16T11:51:33.393" Score="1" ViewCount="689" Body="&lt;p&gt;Is it possible to implement the below topology? I see that there is a port channel going downstream to the firewalls. By any chance, are the firewalls running as one virtual entity? As we see here are 2 different downstream firewalls, and we cannot run the portchannel.&lt;br&gt;&#xA;So if we cluster the FW01 and FW02 as a single entity and run the port channel in no LACP suspend mode, does that possibility exist? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note:SW01 and SW02 are N5k&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Peer KA link denotes peer keepalive link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Peer link denotes vpc peer link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/K3c6g.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K3c6g.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2016-12-16T17:35:36.463" LastActivityDate="2016-12-16T23:09:16.373" Title="Virtual port channel topology with firewall" Tags="|firewall|vpc|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37355" PostTypeId="2" ParentId="37353" CreationDate="2016-12-16T15:38:19.620" Score="1" Body="&lt;p&gt;Yes, a stacked switch topology is not proper for a data center, however it's fine for an IDF.  Why?  It's not 99.999, more like 95-99% uptime due to ISSU ain't gonna really work.  The port channels are simply a link/layer 2 bonding mechanism.  Put the default gateway interfaces on the firewall. Done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next gen solution is SDN-ish, whereby the firewalling happens directly on the network port that the endpoint connects to.  That way you can (1) sniff all traffic, even intraVLAN and (2) the firewall policies follow the endpoints as they move around the physical infrastructure (data centers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, if you are talking about Cisco Nexus, below is how you do it (notice DO NOT dual home FEX's)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Od4hE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Od4hE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2016-12-16T17:03:12.057" LastActivityDate="2016-12-16T17:03:12.057" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37359" PostTypeId="2" ParentId="37353" CreationDate="2016-12-16T23:09:16.373" Score="2" Body="&lt;p&gt;I don't know what you mean &quot;FW01 and FW02 as a single entity&quot;. In most scenarios, the FW cluster are composed by 2 independent firewall talking via 1 o 2 HA links where one keeps active and other are standby.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, answering your question. Is this design correct? In my opinion, &lt;strong&gt;it's not valid&lt;/strong&gt;. As @Ron stated in the comments, you can't port channel a device to two separate devices. If a firewall failover occurs, the redundancy will not work.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2016-12-16T23:09:16.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37362" PostTypeId="1" AcceptedAnswerId="37371" CreationDate="2016-12-17T04:23:33.937" Score="1" ViewCount="1943" Body="&lt;p&gt;1.I understand that irrespective of the STP priority, vPC primary always sends the BPDUs.The vPC secondary device will just proxy those BPDUs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please confirm if the above understanding is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.If vPC secondary has lower STP priority than vPC primary, who becomes the root switch?&#xA;Who will forward the BPDU and who will proxy the BPDU?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.Imagine N5k1 is vPC primary.It also has lower STP priority.&#xA;Now if for some reason, N5k1 goes down, N5k2 becomes operational primary.&#xA;N5k2 also becomes the STP root.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From one of the blogs, i read:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the Primary failed Switch N5K-1 comes online but  vPC role is non-Preemptive in that case Primary N5K-1 continue to be act Operational Secondary but we have configured lower STP priority earlier on N5K-1 , now we have STP role change , Peer link will become STP root Port and that will trigger SYNC process inherit in VPC process , which blocks vPC  trunk member port although time conumpation in overall process of SYNC is quite low but in production HFT envirnoment it matter alot .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to avoid this, we use vpc peer-switch command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please confirm if the above behaviour is  expected&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2016-12-17T08:55:39.650" Title="Understanding virtual port channel peer switch command" Tags="|switching|spanning-tree|vpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37363" PostTypeId="1" CreationDate="2016-12-17T04:29:21.870" Score="0" ViewCount="1326" Body="&lt;p&gt;FYI: this is not a homework question. I was reading an article (&lt;a href=&quot;http://packetlife.net/blog/2008/jun/19/ospf-network-types/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://packetlife.net/blog/2008/jun/19/ospf-network-types/&lt;/a&gt;) in OSPF and couldn't understand this point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;a segment containing ten routers would require 45 adjacencies to form a mesh, but only 17 when a DR and BDR are in place.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was specifically for the broadcast type of network in OSPF.&lt;/p&gt;&#xA;" OwnerUserId="23142" LastActivityDate="2016-12-17T07:16:01.640" Title="What are the number of adjacencies in 10 router in mesh topology and DR/BDR topology in OSPF?" Tags="|ospf|broadcast|topology|" AnswerCount="1" CommentCount="1" ClosedDate="2018-08-07T00:19:01.997" ContentLicense="CC BY-SA 3.0" />
  <row Id="37365" PostTypeId="1" CreationDate="2016-12-17T06:25:30.517" Score="0" ViewCount="715" Body="&lt;p&gt;There is a service out there, &lt;a href=&quot;http://www.openport.io&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.openport.io&lt;/a&gt;, which allows a computer to open up services, such as SSH and Web servers, to the rest of the world even if the computer is behind a firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently deploying Raspberry pi machines in my clients' homes which are almost always behind firewalls with dynamic IPs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does openports do this? Are there any alternatives? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am asking about this because openports is poorly documented and they are not responsive to emails. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: No-IP solves the dynamic ip problem. It does not help you get around the firewall. &lt;/p&gt;&#xA;" OwnerUserId="32855" LastActivityDate="2016-12-17T09:17:36.687" Title="How does openport.io open up services like SSH even though I am behind a firewall?" Tags="|ip|" AnswerCount="2" CommentCount="1" ClosedDate="2016-12-17T16:52:17.713" ContentLicense="CC BY-SA 3.0" />
  <row Id="37366" PostTypeId="2" ParentId="37363" CreationDate="2016-12-17T07:16:01.640" Score="2" Body="&lt;p&gt;8 routers form adjacencies to both the DR and BDR (8*2 = 16) plus an adjacency formed between the DR and BDR equals 17.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a full mesh were required it would be 10 routers each with 9 connections.  Counted as adjacencies this is (9*10)/2 = 45.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-17T07:16:01.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37367" PostTypeId="1" CreationDate="2016-12-17T07:21:31.163" Score="0" ViewCount="87" Body="&lt;p&gt;How can i take network report of bandwidth consumption that integrated with AD or users?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have ASA 5506 and configured netflow 9 with PRTG,&#xA;I can see the source IP and Destination IPs, Is there any way to see bandwidth consumption by each users?&lt;/p&gt;&#xA;" OwnerUserId="21915" LastActivityDate="2019-07-30T06:56:54.950" Title="Network report integrated with Active Directory or Users" Tags="|cisco|cisco-asa|bandwidth|cisco-commands|netflow|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37368" PostTypeId="2" ParentId="37365" CreationDate="2016-12-17T07:24:35.577" Score="1" Body="&lt;p&gt;The &quot;server&quot; you want to make available makes an outbound connection to openport.io and maintains an open socket.  When the &quot;client&quot; connects to a specified port on openport.io this connection is tied back to the original socket. It's basically a cross-connect, potentially with the added ability to multiplex multiple connections across the single &quot;server&quot; socket (didn't dig in too deeply).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately it's just tying together two sockets - so essentially just a special-case proxy server.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-17T07:24:35.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37369" PostTypeId="2" ParentId="37367" CreationDate="2016-12-17T07:41:19.223" Score="2" Body="&lt;p&gt;So the trick here is tying user ID's to source IP's within your network.  If you assume that a given user's traffic all comes from their PC and, in turn, that their PC's traffic is only attributable to them then it's fairly straightforward to come up with long-term DHCP assignments and simple substitute IP's for user-id's.  Heck, at the most trivial level you could give the user PC's machine names that correspond to users and just run DNS resolution for the source IP's in your report.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Beyond the trivial case, though, it becomes a lot harder.  Dynamic IP's?  Multiple concurrent devices?  Multiple users coming from a single IP?  Application proxies on-site?  This is where it starts to get ugly and is why there isn't really a truly generalized case.  If you had some kind of ironclad way to associate user devices with login/logout - say 802.1X on both wired and wireless connections - you'd likely end up with RADIUS accounting logs that could include IP's in use, connection times, etc.  This could be correlated (via a script) with the firewall traffic logs to associate Internet bandwidth use.  It's basically something close to an ISP billing problem.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option might be to require users to register with the firewall before using the Internet.  This might provide a shortcut that's easier than the above - check &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-firepower-services/200566-Configure-Active-Directory-Integration-w.html#anc19&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article on AD and ASA single-sign on integration&lt;/a&gt; for some ideas that might fit and be a lot cleaner than the general approaches listed above.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-17T07:41:19.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37371" PostTypeId="2" ParentId="37362" CreationDate="2016-12-17T08:55:39.650" Score="3" Body="&lt;p&gt;Under normal conditions only the root ID and bridge priority of the VPC primary will be sent &lt;em&gt;via VPC downstream links&lt;/em&gt;.  Within VPC links only the operational primary transmits or processes BPDU's (nb - the secondary forwards rather than proxies).  In the case of non-VPC links the actual ID's and priorities will be sent, thus allowing STP to continue to function as expected.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best practice is that the lower (better) root priority should be on the VPC primary.  If it isn't the case and the seondary has a better priority then downstream VPC connections will still receive the ID and priority of the VPC primary - even though it's the worse of the two.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the VPC primary fails (loss of peer link + peer keepalive) then the VPC operational role shifts as the VPC secondary assumes the role of primary.  In this instance you are correct that a new root bridge has appeared and STP needs to run throughout the topology - with attendant interruption of service. This is where the peer-switch feature comes in...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When enabled the peer-switch command actually causes the two VPC paired switches to create a third (common) &lt;em&gt;virtual&lt;/em&gt; root ID that should always have the lowest priority in the topology.  This means that both switches are going to send BPDU's with the virtual ID as the root of the topology and their respective physical bridge ID's as the candidate for designated forwarder.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - Any downstream non-VPC switch will see a common root ID and two potential candidates for designated forwarder with distinct ID's but &lt;strong&gt;identical priorities&lt;/strong&gt; (nb - strong suggestion that VLAN STP priorities be equal on VPC peers) and will pick accordingly (..generally choosing the lower bridge ID).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For VPC downstream switches the BPDU created by the VPC primary will just see a neighbor of the new virtual root address.  In the event of a failure the secondary will maintain the identical advertisement - same ID, same priority... so zero STP convergence required.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-17T08:55:39.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37372" PostTypeId="2" ParentId="37365" CreationDate="2016-12-17T09:17:36.687" Score="-2" Body="&lt;p&gt;I found NGROK and they have much better documentation. &lt;/p&gt;&#xA;" OwnerUserId="32857" LastActivityDate="2016-12-17T09:17:36.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37373" PostTypeId="1" CreationDate="2016-12-17T10:01:16.343" Score="1" ViewCount="65" Body="&lt;p&gt;I have a web application that run from a local server. When I run the application from the server using remote desktop connection, the application performance is smooth and fast. For example, searching for data or opening windows takes only around a second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But when I run the application from my computer, the application performance is very slow, and searching for a data record can take a half minute instead of a second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the reason of the slowness of the application performance? Is it the application itself or the network speed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to make the application run faster in my computer in the same speed, when I run it directly from the server?&lt;/p&gt;&#xA;" OwnerUserId="32859" LastEditorUserId="20757" LastEditDate="2016-12-17T16:39:21.240" LastActivityDate="2016-12-17T16:39:21.240" Title="How to make a web application run as fast as when I run it directly through the server?" Tags="|wireless|performance|" AnswerCount="1" CommentCount="1" ClosedDate="2016-12-17T16:42:40.197" ContentLicense="CC BY-SA 3.0" />
  <row Id="37375" PostTypeId="2" ParentId="37373" CreationDate="2016-12-17T12:36:35.287" Score="1" Body="&lt;p&gt;Considering that it is the Network Engineering SE, I explain only the network related part.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can very easily decide, if it is an (on-topic) network related problem, or an (off-topic) problem in your web application: test your network on layer 1, 2 and 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It actually means:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;test your network connectivity, maybe there is a packet loss. You can do this very easily with ping (instead of some builtin tool, I would suggest to use rather a dedicated tester tool). If there isn't too big packet loss, you can this close out.&lt;/li&gt;&#xA;&lt;li&gt;simply &lt;em&gt;measure&lt;/em&gt; the total loaded data in a typical working session. There are various tools also for this, most simplest is maybe the cross-platform &lt;a href=&quot;https://www.wireshark.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;wireshark&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;measure&lt;/em&gt; your actual bandwidth to the server, the simplest way for that is to simply download a big file from it.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Furthermore, if it is an application-level problem, it can be still network related. For example, it is possible that your web-app (or its server side container) tries to resolve your IP address by a reverse DNS lookup, and it timeouts in the lack of a properly configured reverse DNS service.&lt;/p&gt;&#xA;" OwnerUserId="20757" LastActivityDate="2016-12-17T12:36:35.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37381" PostTypeId="1" AcceptedAnswerId="37382" CreationDate="2016-12-18T01:50:59.013" Score="6" ViewCount="3080" Body="&lt;p&gt;In different wire protocols there is often a set of reserved bits that must be set to 0 or else the connection is ended. What is the purpose of such reserved bits? When was the last time these were actually used in 'future'? If other machine is going to end the connection on it being non-zero, how is it going to be backwards compatible in the future then?&lt;/p&gt;&#xA;" OwnerUserId="32873" LastEditorUserId="8499" LastEditDate="2016-12-18T02:04:15.260" LastActivityDate="2016-12-18T18:33:38.350" Title="Why is there reserved bit or byte in network protocols?" Tags="|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37382" PostTypeId="2" ParentId="37381" CreationDate="2016-12-18T02:02:38.300" Score="5" Body="&lt;p&gt;The reserved bits are so that the protocol can gain additional features in the future. This happens every once in a while.&lt;/p&gt;&#xA;&lt;p&gt;For example, off the top of my head I know that the original IPv6 multicast protocol (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3306&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3306&lt;/a&gt;) called for four flag bits (&lt;code&gt;00PT&lt;/code&gt;), the first two of which were reserved. A more recent RFC (&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3956&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3956&lt;/a&gt;) updated this to use one of the reserved bits to indicate the presence of an embedded RP address (&lt;code&gt;0RPT&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2016-12-18T18:33:38.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37384" PostTypeId="1" AcceptedAnswerId="37393" CreationDate="2016-12-18T06:59:22.600" Score="3" ViewCount="592" Body="&lt;p&gt;When the web server sends data back to the browser, the browser receives that data using a particular port on my system. How can I find out what that port is on a Linux machine?&lt;/p&gt;&#xA;" OwnerDisplayName="user32876" LastActivityDate="2016-12-18T14:41:59.647" Title="How on the Linux platform can I find out what port my web browser is using to receive packets from a web server?" Tags="|tcp|" AnswerCount="2" CommentCount="1" ClosedDate="2016-12-18T15:54:07.183" ContentLicense="CC BY-SA 3.0" />
  <row Id="37385" PostTypeId="2" ParentId="37384" CreationDate="2016-12-18T07:24:52.097" Score="3" Body="&lt;p&gt;There is no fixed port on the browser for receiving the data. The source port of a TCP connection is picked more or less random (depending on the system) and differs from the source port of all other TCP connections from the same host to the same target host+port. There are often multiple TCP connections open to the same target at the same time. To have a look what connections are currently open and which ports they use run &lt;code&gt;netstat -npt&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="4063" LastActivityDate="2016-12-18T07:24:52.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37389" PostTypeId="1" AcceptedAnswerId="37401" CreationDate="2016-12-18T12:11:07.993" Score="1" ViewCount="662" Body="&lt;p&gt;I am completing a lab and have been told I should ALWAYS block Egress traffic from private address ranges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA performs NAT translation of private IPs to the public IP address assigned to the 'outside' interface so this is therefore taken care of isn't it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In which scenario could the source IP contain a private address? I assume only if no NAT translation takes place?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could I somehow get past the ASA NAT translation by using IP spoofing? Surely, if the ASA is performing NAT translation to a public IP this not really of any benefit unless we wish to hide the internal IP address of a malicious user so returning traffic believes it originated from a different machine?&lt;/p&gt;&#xA;" OwnerUserId="32882" LastActivityDate="2016-12-18T17:33:56.493" Title="Block private addresses for Egress traffic passing through an ASA firewall performing NAT translation" Tags="|cisco-asa|nat|private-vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37393" PostTypeId="2" ParentId="37384" CreationDate="2016-12-18T14:41:59.647" Score="1" Body="&lt;p&gt;Linux will choose a new local port number for each connection you open. To see what range of port numbers your kernel is configured to use you can type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cat /proc/sys/net/ipv4/ip_local_port_range&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For historical reasons that sysctl has &lt;code&gt;ipv4&lt;/code&gt; in its name, but the setting does in fact apply to both IPv4 and IPv6. The default range is 32768 - 61000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your question is not what it will use for new connections but rather what it is using for currently open connections, you can use the &lt;code&gt;netstat&lt;/code&gt; command. For example I usually use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;netstat -ntpW&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here &lt;code&gt;n&lt;/code&gt; means no reverse DNS is performed on the IP addresses. &lt;code&gt;t&lt;/code&gt; means I want to know about TCP connections. &lt;code&gt;p&lt;/code&gt; means I want to know which PID each connection is associated with (this information will be incomplete if I don't have privileges to see the information or if the socket is open by more than one PID). And &lt;code&gt;W&lt;/code&gt; means to use wide format (without that argument the IP addresses in the output may be truncated).&lt;/p&gt;&#xA;" OwnerUserId="5842" LastActivityDate="2016-12-18T14:41:59.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37398" PostTypeId="1" AcceptedAnswerId="37400" CreationDate="2016-12-18T15:51:15.347" Score="1" ViewCount="79" Body="&lt;p&gt;Can cat6 be used as a 1:1 replacement for telephone cable ? Ive seen it done multiple times and its worked fine, but can it be considered a 1:1 replacement or are there some downsides of doing it ? &lt;/p&gt;&#xA;" OwnerUserId="19472" LastEditorUserId="8499" LastEditDate="2016-12-18T16:24:40.053" LastActivityDate="2016-12-18T16:24:40.053" Title="Can cat6 be used as a 1:1 replacement for telephone cable?" Tags="|cable|layer1|telephony|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37400" PostTypeId="2" ParentId="37398" CreationDate="2016-12-18T16:08:06.007" Score="2" Body="&lt;p&gt;A higher category cable can be used for a lower category cable. Ordinary telephone cable is Category-3 cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The downside is that simply replacing one category cable for another can be very misleading. Simply having cable at a category is meaningless. All the cable components (connectors, patch panels, etc.) must all be the same category, and they must pass the category test suite after installation to be considered in that category. Installation can be challenging for higher category cables, and I have seen experienced installers frustrated with Category-6 cable installation (getting it to pass the Category-6 test suite).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also have problems because the cable and wire diameters can be larger in the higher cable categories. This can present problems with the cable path, and cause poor connections if lower category connectors are used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a cable vendor installs cabling, you need to get each cable tested for its category suite, and a complete report should be supplied to you after installation.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-18T16:08:06.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37401" PostTypeId="2" ParentId="37389" CreationDate="2016-12-18T17:33:56.493" Score="1" Body="&lt;p&gt;Even though your ISP should be doing this, you would typically block your private address range on ingress. You would allow your private range to pass thru on the inside interface and then NAT on the way out assuming you are egress filtering (which you should be doing).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example you have the following network using 192.168.1.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet ---- ASA ----- Internal Network&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the inside interface you would allow 192.168.1.0/24 inbound on the inside interface. Then on the outside interface NAT to your public address. This will allow your internal host to talk to the outside. Blocking private address range on the ingress help will prevent spoofing of your internal host.&lt;/p&gt;&#xA;" OwnerUserId="30169" LastActivityDate="2016-12-18T17:33:56.493" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37402" PostTypeId="1" CreationDate="2016-12-18T17:36:21.737" Score="3" ViewCount="1835" Body="&lt;p&gt;I'm working on developing the ingress logic of a software switch and have a doubt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So here's my understanding. When a frame ingresses a switch, its 13th and 14th byte are checked against standard 802.1Q TPID, i.e. 0x8100. If it matches, the frame is decided as tagged. Oherwise untagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now there's another concept of configuring a switch port's ingress and egress TPID. If not otherwise configured, it's taken as 0x8100 by default. Suppose a user configures a custom ingress TPID of 0x9100, then the frame will only be considered tagged if its TPID is 0x9100.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My doubt is, is this decision only relevant in case the port itself is a &quot;tagged&quot; member of the VLAN? What happens when the port is untagged member of a VLAN (i.e. a trunk port). Will the frame undergo the same routine of tagging decision?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand if a frame is decided to be untagged, it is pushed a pvid based on the native VLAN which the port is part of. And unicasted/broadcasted into that VLAN domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have to work on provider bridging logic of the switch. In that case the ingress TPID of the switch is configured as 0x88a8. So a frame ingressing with TPID 0x8100 or any value other than 0x88a8 will be considered untagged. If so, the frame's tag containing the CVLAN will be looked up against &lt;code&gt;CVLAN--&amp;gt;SVLAN&lt;/code&gt; mapping in the switch and added an SVLAN with TPID 0x88a8. Hence making the frame tagged and forwarding it into SVLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I understanding it correctly?&lt;/p&gt;&#xA;" OwnerUserId="6205" LastEditorUserId="6205" LastEditDate="2016-12-18T18:13:56.017" LastActivityDate="2016-12-18T18:13:56.017" Title="Frame tag decision based on switch port TPID (EtherType)" Tags="|switch|vlan|metro-ethernet|service-provider|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37403" PostTypeId="2" ParentId="37402" CreationDate="2016-12-18T17:55:58.707" Score="2" Body="&lt;p&gt;The first 6 bytes of an ethernet &lt;em&gt;frame&lt;/em&gt; are the destination MAC address, the next 6 bytes are the source MAC address. The next two bytes, 13th and 14th bytes, are the payload length (&amp;lt;= 1500) or the EtherType field (&gt;= 1536). An EtherType of &lt;code&gt;0x8100&lt;/code&gt; indicates the presence of and 802.1Q tag, and the real EtherType field is moved four bytes over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An untagged frame is a native VLAN (the VLAN as configured on the switch interface; some vendors can only use VLAN 1 as the native VLAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens to tagged frames received on non-trunk switch interfaces is undefined. Some switches will simply forward them, and some switches will drop them (possibly as giant frames).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The EtherTypes you mention (&lt;code&gt;0x88a8&lt;/code&gt; and &lt;code&gt;0x9100&lt;/code&gt;) are registered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The EtherType of &lt;code&gt;0x88a8&lt;/code&gt; is registered, and it is used by Provider Bridging (IEEE 802.1AD) &amp;amp; Shortest Path Bridging (IEEE 802.1AQ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The EtherType of &lt;code&gt;0x9100&lt;/code&gt; is registered, and it is used for VLAN-tagged (IEEE 802.1Q) frames with double tagging.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-18T18:07:03.773" LastActivityDate="2016-12-18T18:07:03.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37405" PostTypeId="1" CreationDate="2016-12-18T20:02:29.183" Score="2" ViewCount="328" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/k3vLg.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k3vLg.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;I got two routers on my network and I am pinging one router's serial port ip address from that router itself. by checking traceroute I found ping is going outside to neighbor router which is directly connected via serial link on the same port I am pinging.what is the reason of that traceroute behaviour? Image of Router R1, traceroute from R1 to R2, R1 have ip address of 10.1.1.1/24 and R2 have 10.1.1.2/24.&lt;/p&gt;&#xA;" OwnerUserId="32890" LastEditorUserId="32890" LastEditDate="2016-12-18T20:24:15.880" LastActivityDate="2017-07-19T08:09:29.133" Title="Traceroute of Router's own serial port" Tags="|cisco|routing|router|cisco-ios|traceroute|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37408" PostTypeId="2" ParentId="26659" CreationDate="2016-12-18T20:22:40.970" Score="0" Body="&lt;p&gt;Yes you can.  The question is what computer language do you intend on using?  There are traditional server-side languages such as Python as well as client side languages such as JavaScript.  There's also linux bash commands (available on Windows via cygwin).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sendip -p ipv4 -is 192.168.1.81 -p udp -us 5070 -ud 5060 -d &quot;Hello&quot; -v 192.168.1.81&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://moythreads.com/wordpress/2012/03/15/sending-udp-packets-from-the-command-line/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sending UDP packets from the command line&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-18T20:22:40.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37409" PostTypeId="1" AcceptedAnswerId="37410" CreationDate="2016-12-18T20:27:55.700" Score="1" ViewCount="63" Body="&lt;p&gt;I am trying to check my understanding about the ways of communication in IP networks. I would classify the ways of communication in IP networks into three generic types:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The source requests &lt;code&gt;name resolution&lt;/code&gt; of the destination using DNS service.&lt;/li&gt;&#xA;&lt;li&gt;TCP handshaking.&lt;/li&gt;&#xA;&lt;li&gt;UDP.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Can someone validate my reasoning?&lt;/p&gt;&#xA;" OwnerUserId="32892" LastEditorUserId="8499" LastEditDate="2016-12-18T20:36:57.303" LastActivityDate="2021-01-24T11:13:05.893" Title="Understanding the ways of communication in IP networks" Tags="|cisco|ip|tcp|network-core|udp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37410" PostTypeId="2" ParentId="37409" CreationDate="2016-12-18T20:35:42.443" Score="0" Body="&lt;p&gt;Name resolution is an application-layer protocol/function, and it can happen with protocols other than IP; it really has nothing to do with IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP and UDP are layer-4 protocols, while IP is a layer-3 protocol. Theoretically, TCP and UDP could be used on protocols other than IP, but I am unaware of any such implementations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP has a field in the header to tell IP to which upper-layer protocol it should send its payload. IPv4 uses the Protocol field , and IPv6 uses the Next Header field for this. There are many &lt;a href=&quot;https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IANA registered protocols&lt;/a&gt; which use IP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-18T20:35:42.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37411" PostTypeId="2" ParentId="37409" CreationDate="2016-12-18T20:38:04.807" Score="0" Body="&lt;p&gt;--&gt; when user tries to access webpage using URL, request for webpage go to the DNS for Ip resolution, after getting Ip request go through all layers of OSI and reach to the related server and server respond to that request. TCP or UDP is totally depends on the request you are making. TCP and UDP is for service port authentication in networking. after that IP address works to reach out servers.&lt;/p&gt;&#xA;" OwnerUserId="32890" LastActivityDate="2016-12-18T20:38:04.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37412" PostTypeId="1" CreationDate="2016-12-18T22:42:04.313" Score="1" ViewCount="86" Body="&lt;p&gt;One of our clients bought two of these switches. Now, Dell sent a fiber splitter with a 40GB GBIC. See the pictures below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LO1jj.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LO1jj.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aMxY8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aMxY8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I connect both GBICs and connect both splitters, one in each switch, and then I use A fiber female adapter to test connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And nothing happens. I already set the no shutdown command in both switches, but it is not working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not sure if I need to do something else to get these GBICs online.&lt;/p&gt;&#xA;" OwnerUserId="14378" LastEditorUserId="8499" LastEditDate="2016-12-18T22:46:10.847" LastActivityDate="2017-01-18T15:52:43.467" Title="Force10 S4820T Fiber GBIC is not working" Tags="|fiber|layer1|dell|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37413" PostTypeId="1" AcceptedAnswerId="37420" CreationDate="2016-12-18T22:44:43.553" Score="1" ViewCount="879" Body="&lt;p&gt;A discussion on the security stackexchange &lt;a href=&quot;https://security.stackexchange.com/a/145674/37973&quot;&gt;https://security.stackexchange.com/a/145674/37973&lt;/a&gt; has raised the question of unidirectional transmission over Ethernet with the return path physically removed. Unidirectional reception with the transmitting wires unconnected certainly is possible, e.g. in simple Ethernet wiretapping tools like &lt;a href=&quot;https://greatscottgadgets.com/throwingstar/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://greatscottgadgets.com/throwingstar/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would transmitting raw Ethernet frames be possible in this manner?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An answer to an earlier question (&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/20292/ethernet-frames-on-unidirectional-link&quot;&gt;Ethernet Frames on Unidirectional Link&lt;/a&gt;) states that a response link is required for Ethernet autonegotiation, however older standards such as 10BASE-T should work (with a proper crossover cable) even in absence of autonegotiation. It's clear that the sender can't know if the message was received, but that can be handled in various ways, the question is if standard Ethernet network cards will send the required data over the physical layer in absence of any response/negotiation/handshake/etc.&lt;/p&gt;&#xA;" OwnerUserId="4340" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-12-19T04:59:58.110" Title="Ethernet unidirectional transmission" Tags="|ethernet|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37414" PostTypeId="2" ParentId="37413" CreationDate="2016-12-18T23:08:05.247" Score="1" Body="&lt;p&gt;Ethernet uses CSMA-&lt;em&gt;CD&lt;/em&gt;, where the &lt;em&gt;CD&lt;/em&gt; stands for &lt;em&gt;Carrier Detection&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can sometimes see this in a device, e.g. Cisco shows something like &lt;code&gt;GigabitEthernet0/0 is up, line protocol is down&lt;/code&gt; because there is no carrier. The interface is unusable in this situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are (expensive) devices sold for unidirectional ethernet as security devices.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-18T23:08:05.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37416" PostTypeId="2" ParentId="26256" CreationDate="2016-12-19T00:48:29.540" Score="3" Body="&lt;p&gt;The reason many people gloss over this stuff is because if you actually look at the real details and not oversimplified models it's a massive rabbit hole.&lt;/p&gt;&#xA;&lt;p&gt;Firstly Ethernet is not just one type of interface but a whole family of them with the fastest variant being FORTY THOUSAND times faster than the slowest.&lt;/p&gt;&#xA;&lt;p&gt;Secondly many modern interfaces don't fit nicely into either the traditional parallel or serial model. Many modern interfaces use a multi-lane arrangement where multiple connections carry data in parallel but each &amp;quot;lane&amp;quot; has separately managed bit timings and the receiver adds small delays to make up for timing skew and bring the data back into sync.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Generally frames are first transferred from main memory to a buffer in the medium access controller. The interface used will depend on the application, an on-chip MAC is likely to use a parallel interface. Old off-chip MACs also used parallel interfaces but nowadays serial interfaces are increasingly used. 10 gigabit and faster interfaces typically use multi-lane PCIe which isn't really either a traditional parallel or a traditional serial interface.&lt;/p&gt;&#xA;&lt;p&gt;The buffer inside the MAC is needed to decouple the timings on the Ethernet interface from the timings on the host interface.&lt;/p&gt;&#xA;&lt;p&gt;The MAC decides when to transmit a frame (using CSMA/CD if needed) and transmits it at wire speed to the PHY. For 100 megabit and 1 gigabit systems the MAC to PHY interface is typically a narrow (2-8 bits) parallel interface, though serial interfaces are also sometimes used. For 10 gigabit and 25 gigabit I believe a fast LVDS serial interface is typically used. For higher speeds I believe a multi-lane interface built up out of fast LVDS serial links is used.&lt;/p&gt;&#xA;&lt;p&gt;The PHY takes the data from the MAC and re-encodes it for the wire. 10BASE-T uses manchester encoding. 100BASE-TX first passes the data through a 4B5B encoding process. This is then further encoded using &amp;quot;MLT-3&amp;quot; to reduce the effective frequency. 1000BASE-T uses multiple pairs in parallel, uses a multi-level encoding scheme to send multiple bits at the same time on the same pair and uses echo and crosstalk cancellation techniques to use all four pairs in both directions at the same time.&lt;/p&gt;&#xA;&lt;p&gt;On fiber at speeds up to 25 gigabit data is normally sent serially on a single wavelength.&lt;/p&gt;&#xA;&lt;p&gt;At higher speeds there are a dizzying array of different options for transmission over fiber. Some use multiple separate optical lanes, either carried on separate fibres, some use multi-level PAM4 encoding and some use coherent optical technology where the phase of the light is modulated.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="36720" LastEditDate="2022-12-15T06:30:25.100" LastActivityDate="2022-12-15T06:30:25.100" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="37417" PostTypeId="1" AcceptedAnswerId="37428" CreationDate="2016-12-19T03:10:35.330" Score="1" ViewCount="520" Body="&lt;p&gt;Apologies ahead of time if I missed an article or a posting with the answer to this question...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm fairly new to Wireshark and I was analyzing my network traffic, I'd like to be able to do multiple display filters without having it all clumped in the overhead one line filter field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently its set to a long string of '!(ipv6.src == xxxx::xxxx:x... or ip.dst == xxx.xxx... or arp or lldp or ...)'. I'd like to know if there a way of creating kind of a separate file with a nicely formatted list of all the 'noise' I want tucked away so that I only see sneaky traffic. That or if there is a better method of filter large quantities of known connections so that I only see what I want to see.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you much! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to Jaap Keuter for the pointer on Wireshark Display Filter Macros. There seems to be some thin documentation online from what I could find after some short searches, this is what I've found:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has a pretty good write up on Display Filter Macros&#xA;&lt;a href=&quot;https://support.cloudshark.org/administrator-guide/display-filter-macros.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://support.cloudshark.org/administrator-guide/display-filter-macros.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Wireshark go to 'Analyze' &gt; 'Display Filter Macros...'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 'Name' type a name for your macro which you will later use to call it.&#xA;For 'Text' type in your query e.g. '!(ip.src == 192.168.2.1 or arp or lldp)' or if you prefer something like '!(ip.src == $1 or ip.src == $2)' where $# is an item you will fill later when calling the macro.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example used later on:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Name: 'Nonlocal' &#xA;Text: '!(ip.src &gt;= $1 &amp;amp;&amp;amp; ip.src &amp;lt;= $2)'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Calling the Macro:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Wireshark, where the 'Apply a display filter... ' appears type in ${YourMacroName} if it has no variables to pass on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are variables to pass on in the case of '!(ip.src == $1 or ip.src == $2)' then type the following when calling your macro '${YourMacroName:Value1;Value2}' &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example from before in action:&#xA;${NonLocal:192.168.2.0;192.168.2.255}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT#2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Combining several Display Filter Macros is fairly simple, after a quick test I found that using &amp;amp;&amp;amp; allows you to run multiple Macros at once. e.g: '${Macro1} &amp;amp;&amp;amp; ${Macro2}'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps someone.&lt;/p&gt;&#xA;" OwnerUserId="32895" LastEditorUserId="32895" LastEditDate="2016-12-20T04:49:55.827" LastActivityDate="2016-12-20T04:49:55.827" Title="Wireshark Display Filters" Tags="|wireshark|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37418" PostTypeId="2" ParentId="26256" CreationDate="2016-12-19T04:17:35.867" Score="-3" Body="&lt;p&gt;From &lt;a href=&quot;http://www.quepublishing.com/articles/article.aspx?p=170275&amp;amp;seqNum=2&quot; rel=&quot;nofollow noreferrer&quot;&gt;Que Publishing&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Serial Versus Parallel Information Transfer&lt;/h2&gt;&#xA;  &#xA;  &lt;h3&gt;Parallel Information Transfers&lt;/h3&gt;&#xA;  &#xA;  &lt;p&gt;Parallel transfers use multiple &quot;lanes&quot; for data and programs, and in keeping with the 8 bits = 1 byte&#xA;  nature of computer information, most parallel transfers use multiples&#xA;  of 8. Parallel transfers take place between the following devices:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;CPU and RAM&lt;/li&gt;&#xA;  &lt;li&gt;CPU and interface cards (see Chapter 8)&lt;/li&gt;&#xA;  &lt;li&gt;LPT (printer) port and parallel printer&lt;/li&gt;&#xA;  &lt;li&gt;SCSI port and SCSI devices&lt;/li&gt;&#xA;  &lt;li&gt;ATA/IDE host adapter and ATA/IDE drives&lt;/li&gt;&#xA;  &lt;li&gt;RAM and interface cards (either via the CPU or directly with DMA)&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;h3&gt;Serial Transfers&lt;/h3&gt;&#xA;  &#xA;  &lt;p&gt;A serial transfer uses a single &quot;lane&quot; in the computer for information transfers. This sounds like a recipe for&#xA;  slowdowns, but it all depends on how fast the speed limit is on the&#xA;  &quot;data highway.&quot;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following ports and devices in the computer use serial transfers:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Serial (also called RS-232 or COM) ports and devices&lt;/li&gt;&#xA;  &lt;li&gt;USB (Universal Serial Bus) 1.1 and 2.0 ports and devices&lt;/li&gt;&#xA;  &lt;li&gt;Modems (which can be internal devices or can connect to serial or USB ports)&lt;/li&gt;&#xA;  &lt;li&gt;IEEE-1394 (FireWire, i.Link) ports and devices&lt;/li&gt;&#xA;  &lt;li&gt;Serial ATA (SATA) host adapters and drives&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-19T04:17:35.867" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="37419" PostTypeId="2" ParentId="36993" CreationDate="2016-12-19T04:53:51.467" Score="0" Body="&lt;p&gt;A collision happens when two devices transmit at the same time, so, yes, a collision occurs, even if the two sending devices cannot detect the collision. It is, after all, CSMA/&lt;em&gt;CA&lt;/em&gt; (for &lt;em&gt;Collision Avoidance&lt;/em&gt;). The WAP will dtect the collision, and it will not send CTS to either requesting host. Both hosts will try again, later.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-19T04:53:51.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37420" PostTypeId="2" ParentId="37413" CreationDate="2016-12-19T04:59:58.110" Score="2" Body="&lt;p&gt;Yes - it is possible and from a limited perspective it's not even uncommon in certain circumstances.  A good example is the use-case with Ethernet taps where transmitted frames are passively copied to an analysis box.  The breakout is certainly transmit only.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recall seeing something similar to what you're describing in an ultra high volume Netflow collection situation where routers with optical interfaces would split a transmit from a common dummy source and drop it into the receive ports of multiple routers.  It was enough to keep the link up while the corresponding transmit links (..carrying solely Netflow UDP packets) sent their payloads off into the ether.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There also used to be an accommodation in IOS for simplex Ethernet drops (usually from microwave) via the command &quot;transmit-interface,&quot; which took an additional interface as a corresponding receive only.  I think the point there was to have the transmit-only throttle based on flow control (..or collisions) on the corresponding receive port, but it's beyond obscure at this point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a bunch of caveats - most fairly obvious.  Any kind of link negotiation, flow control or QoS is completely out of the question.  Speed and duplex need to be locked and only connectionless protocols (UDP, ICMP, etc) make any sense.  Multicast and broadcast would be fine but unicast would likely require hard-coded MAC addresses (...this is how the Netflow situation mentioned above was managed) and if it's being dropped on a switch there very well could be some strange behaviors at both L2 and L3 as far as timers are concerned as the target address likely isn't sending any responses to build CAM and ARP tables.&lt;br&gt;&#xA;This, again, could be mitigated through hard-coding if the platform supports it.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-19T04:59:58.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37421" PostTypeId="1" AcceptedAnswerId="37424" CreationDate="2016-12-19T10:14:24.313" Score="1" ViewCount="129" Body="&lt;p&gt;Those are the default path cost for STP :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10 Mbps --&gt; 100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;100 Mbps --&gt; 19&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 Gbps --&gt; 4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this topology :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jveK3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jveK3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All interfaces are set to 100Mb/s so each path cost is equal to 19. I forced the speed to 10 Mbps on  the interface on S1 connected to S4 (fa0/1). However the path cost is still set 19 (100 Mbps) instead of 100 (10 Mbps).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MyuPQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MyuPQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jFghf.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jFghf.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[Edit]&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1142 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname S1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!         &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;! &#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA;!&#xA;interface FastEthernet0/1&#xA; speed 10&#xA;!&#xA;interface FastEthernet0/2&#xA; speed 100&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!         &#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;-&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; VLAN1 is executing the ieee compatible Spanning Tree protocol&#xA;  Bridge Identifier has priority 32768, address cc05.2858.0000&#xA;  Configured hello time 2, max age 20, forward delay 15&#xA;  We are the root of the spanning tree&#xA;  Topology change flag set, detected flag set&#xA;  Number of topology changes 36 last change occurred 00:01:17 ago&#xA;          from FastEthernet0/2&#xA;  Times:  hold 1, topology change 35, notification 2&#xA;          hello 2, max age 20, forward delay 15 &#xA;  Timers: hello 0, topology change 14, notification 0, aging 300&#xA;&#xA; Port 1 (FastEthernet0/0) of VLAN1 is forwarding&#xA;   Port path cost 19, Port priority 128, Port Identifier 128.1.&#xA;   Designated root has priority 32768, address cc05.2858.0000&#xA;   Designated bridge has priority 32768, address cc05.2858.0000&#xA;   Designated port id is 128.1, designated path cost 0&#xA;   Timers: message age 0, forward delay 0, hold 0&#xA;   Number of transitions to forwarding state: 1&#xA;   BPDU: sent 4555, received 0&#xA;&#xA; Port 2 (FastEthernet0/1) of VLAN1 is forwarding&#xA;   Port path cost 19, Port priority 128, Port Identifier 128.2.&#xA;   Designated root has priority 32768, address cc05.2858.0000&#xA;   Designated bridge has priority 32768, address cc05.2858.0000&#xA;   Designated port id is 128.2, designated path cost 0&#xA;   Timers: message age 0, forward delay 0, hold 0&#xA;   Number of transitions to forwarding state: 1&#xA;   BPDU: sent 4744, received 755&#xA;&#xA; Port 3 (FastEthernet0/2) of VLAN1 is forwarding&#xA;   Port path cost 19, Port priority 128, Port Identifier 128.3.&#xA;   Designated root has priority 32768, address cc05.2858.0000&#xA;   Designated bridge has priority 32768, address cc05.2858.0000&#xA;   Designated port id is 128.3, designated path cost 0&#xA;   Timers: message age 0, forward delay 0, hold 0&#xA;   Number of transitions to forwarding state: 1&#xA;   BPDU: sent 4634, received 335&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32641" LastEditorUserId="32641" LastEditDate="2016-12-19T12:07:09.690" LastActivityDate="2016-12-19T12:12:59.893" Title="STP - Port path cost won't update" Tags="|cisco|spanning-tree|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37424" PostTypeId="2" ParentId="37421" CreationDate="2016-12-19T12:12:59.893" Score="2" Body="&lt;p&gt;The STP port costs are based on the bandwidth setting, not the hardware port speed.  The bandwidth parameter is also used in calculating routing link costs in OSPF and EIGRP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can change the setting by the bandwidth command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface fa 0/1&#xA;bandwidth 10000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-19T12:12:59.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37425" PostTypeId="2" ParentId="37412" CreationDate="2016-12-19T13:05:47.253" Score="2" Body="&lt;p&gt;I understand you are using a 40G port with a breakout cable (4x10G). In this case, you need to split the 40G port in 4x10G ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the manual:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Split a single 40G port into four 10G ports.&#xA;CONFIGURATION mode&#xA;stack-unit stack-unit-number port number portmode quad&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;number: enter the port number of the 40G port to be split.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that you have to reload the device after change to take effect.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2016-12-19T13:05:47.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37426" PostTypeId="2" ParentId="37315" CreationDate="2016-12-19T13:16:24.160" Score="4" Body="&lt;p&gt;I got this awnser from another forum:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I figured it out, but you need an IOS version that has IOS.sh:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;term shell&#xA;sh ru | grep -u H.H.H | tail 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The -u flag will show all of the lines above the mac address you're searching and then the tail command will just show the last ten lines of that output. You can substitute &quot;10&quot; with however many lines you want.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Prerequisites for Cisco IOS.sh&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• Cisco IOS Release 15.1(4)M, 15.1(2)S, and later releases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;• Cisco IOS.sh must be configured and enabled to use the Cisco IOS.sh features and functions on yourrouter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/netmgmt/configuration/guide/Convert/IOS_Shell/nm_ios_shell.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/netmgmt/configuration/guide/Convert/IOS_Shell/nm_ios_shell.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30328" LastEditorUserId="509" LastEditDate="2016-12-19T13:20:02.793" LastActivityDate="2016-12-19T13:20:02.793" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37428" PostTypeId="2" ParentId="37417" CreationDate="2016-12-19T14:49:08.883" Score="-1" Body="&lt;p&gt;First of all, for Wireshark questions you should try your luck at &lt;a href=&quot;https://ask.wireshark.org&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wireshark Q&amp;amp;A&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But since were here I could point you to using display filter macros. These form a single word representation of your filter expression, even with parameters, if you which.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So '!(ipv6.src == xxxx::xxxx:x... or ip.dst == xxx.xxx... or arp or lldp or ...)' could become '${NotThatStuff}'.&lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2016-12-19T14:49:08.883" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37430" PostTypeId="2" ParentId="26659" CreationDate="2016-12-19T14:57:06.437" Score="0" Body="&lt;p&gt;Yes, it's called Foo over UDP on Linux.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://man7.org/linux/man-pages/man8/ip-gue.8.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;man page&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://people.netfilter.org/pablo/netdev0.1/papers/UDP-Encapsulation-in-Linux.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;paper&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://lwn.net/Articles/614348/&quot; rel=&quot;nofollow noreferrer&quot;&gt;lwn article&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20558" LastActivityDate="2016-12-19T14:57:06.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37431" PostTypeId="1" AcceptedAnswerId="37434" CreationDate="2016-12-19T15:57:44.073" Score="1" ViewCount="500" Body="&lt;p&gt;Could anyone help me with Cisco 4948 config?&#xA;I have to route multicast traffic from one Vlan to another. Multicast source and multicast destination are IGMP-enabled devices, there are no PIM-devices in the network. Can this task be solved with such hardware?&lt;/p&gt;&#xA;" OwnerUserId="32907" LastEditorUserId="8499" LastEditDate="2018-03-19T20:58:48.617" LastActivityDate="2018-03-19T20:58:48.617" Title="Cisco 4948 - multicast routing" Tags="|cisco|routing|multicast|igmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37433" PostTypeId="1" CreationDate="2016-12-19T17:13:54.013" Score="1" ViewCount="588" Body="&lt;p&gt;I have added BGP to routing domain 0 on the BIG IP GUI using the AWS cloud BIG IP. however i cannot find out where to add my routing peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;imish does not work tmsh does not work zebos does not work&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where do i specify the routing neighbors?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;admin@(ip-1 )(cfg-sync Standalone)(Active)(/Common)(tmos)# zebos enable bgp &#xA;=== Protocols are no longer enabled or disabled with === &#xA;=== this utility. Please use tmsh, gui or icontrol. ===&#xA;&#xA;usage: zebos [-r &amp;lt;rd_id | -a] check zebos [-r &amp;lt;rd_id | -a] (cmd command1),command2]&#xA;&#xA;admin@(ip-1 )(cfg-sync Standalone)(Active)(/Common)(tmos)# imish Dynamic routing is not enabled in route domain 0 &#xA;admin@(ip-1 )(cfg-sync Standalone)(Active)(/Common)(tmos)# imish ? &#xA;admin@(ip-1 )(cfg-sync Standalone)(Active)(/Common)(tmos)# tmsh ? Syntax Error: unexpected argument &quot;tmsh&quot; &#xA;admin@(ip-1 )(cfg-sync Standalone)(Active)(/Common)(tmos)# tmsh Syntax Error: unexpected argument &quot;tmsh&quot; &#xA;admin@(ip-1 )(cfg-sync Standalone)(Active)(/Common)(tmos)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the no commands seem to work, i just get the same message each time&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;admin@(ip-10-53-53-151)(cfg-sync Standalone)(Active)(/Common)(tmos)# run util zebos -r 0 check&#xA;=== route domain: 0 ===&#xA;No dynamic routing protocol enabled&#xA;admin@(ip-10-53-53-151)(cfg-sync Standalone)(Active)(/Common)(tmos)# run util zebos -r 0 bgp enable&#xA;Unknown command: bgp&#xA;usage: zebos [-r &amp;lt;rd_id | -a] check&#xA;       zebos [-r &amp;lt;rd_id | -a] (cmd command1)[,command2]&#xA;&#xA;admin@(ip-10-53-53-151)(cfg-sync Standalone)(Active)(/Common)(tmos)# run util zebos -r 0 enable bgp&#xA;=== Protocols are no longer enabled or disabled with ===&#xA;=== this utility. Please use tmsh, gui or icontrol.  ===&#xA;&#xA;usage: zebos [-r &amp;lt;rd_id | -a] check&#xA;       zebos [-r &amp;lt;rd_id | -a] (cmd command1)[,command2]&#xA;&#xA;admin@(ip-10-53-53-151)(cfg-sync Standalone)(Active)(/Common)(tmos)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32910" LastEditorUserId="775" LastEditDate="2021-05-04T23:34:10.310" LastActivityDate="2021-05-04T23:34:10.310" Title="F5 on AWS BGP configuration" Tags="|f5|aws|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37434" PostTypeId="2" ParentId="37431" CreationDate="2016-12-19T17:38:47.207" Score="1" Body="&lt;p&gt;The 4948 is a very capable platform and can definitely route IP multicast between subnets.  Take a look at &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/54sg/configuration/guide/config/mcastmls.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this configuration guide&lt;/a&gt; to get yourself started.  It's fairly comprehensive and you'll want to focus on the section about PIM with a static RP (&quot;Configuring a Single Static RP&quot;).  You'll generally be doing the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Globally enable multicast routing (&quot;ip multicast routing&quot;).&lt;/li&gt;&#xA;&lt;li&gt;Set up an RP - &quot;ip pim rp x.y.z.q&quot; If you don't have an RP in your network just set up a loopback interface on your switch and use its address.  &lt;/li&gt;&#xA;&lt;li&gt;On each L3 interface (SVI, routed switchport) you want to support multicast routing enter &quot;ip pim sparse-mode&quot;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;That's pretty much it.  There are some other considerations if you want to route the multicast to hosts on other switches or if you want to support SSM but this should get you started with basic multicast routing.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-19T17:38:47.207" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37435" PostTypeId="2" ParentId="37433" CreationDate="2016-12-19T20:00:32.990" Score="1" Body="&lt;p&gt;The &lt;code&gt;tmos&lt;/code&gt; in the prompt indicates that you are already inside the tmsh shell.  No need to prefix commands with tmsh.  You would only do this if you were in the bash shell (to get there from tmos, type &lt;code&gt;run util bash&lt;/code&gt;).  To get to the imish and zebos shells, you have to use &lt;code&gt;run util imish&lt;/code&gt; or &lt;code&gt;run util zebos&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-12-19T20:00:32.990" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37437" PostTypeId="1" AcceptedAnswerId="37438" CreationDate="2016-12-19T22:29:53.840" Score="1" ViewCount="1289" Body="&lt;p&gt;I have programmed raw socket programs in C/C++ to initiate small tasks such as TCP/IP 3-way-handshakes, UDP, RTMP, etc. However I became curious about the next layer below IP and I was looking at an Ethernet header in Wireshark and noticed there is a source mac address. Obviously one appeal to raw sockets is IP spoofing. However even in raw sockets you do not have to specify an Ethernet header because the OS will handle that for you. So since it generates the source mac address can this source mac address be used to identify the sender in anyway?&lt;/p&gt;&#xA;" OwnerUserId="32913" LastActivityDate="2016-12-20T03:48:06.060" Title="Can the source mac address in an Ethernet header be used to identify the sender?" Tags="|ethernet|mac-address|packet-analysis|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37438" PostTypeId="2" ParentId="37437" CreationDate="2016-12-19T22:35:29.067" Score="0" Body="&lt;p&gt;A MAC address, for protocols that use MAC addresses (not all do, and some are 48-bit and some are 64-bit), is local to the LAN on which the host with that address is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A layer-3 device, e.g. a router, will strip off the layer-2 frames, including the source and destination MAC addresses, and discard them. The router will then route the layer-3 packets, based on the layer-3 addresses in the packets. When the router sends the packet to the next interface, it will create a new frame for the new interface, but it will do that without the information from the original layer-2 frame.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Obviously one appeal to raw sockets is IP spoofing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is certainly &lt;em&gt;not&lt;/em&gt; an appeal, and, in many cases, illegal.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-19T22:35:29.067" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37444" PostTypeId="2" ParentId="37437" CreationDate="2016-12-20T03:48:06.060" Score="0" Body="&lt;p&gt;If the receiver of the spoofed packet is &quot;on-link&quot; with the sender and suitable software is installed then the source MAC address could in principle be logged. In practice this is fairly unlikely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to construct the complete Ethernet packet (except the FCS) yourself you can use an &quot;AF_PACKET&quot; raw socket. This will let you control the source MAC address.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-12-20T03:48:06.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37446" PostTypeId="1" AcceptedAnswerId="37476" CreationDate="2016-12-20T06:44:41.073" Score="1" ViewCount="401" Body="&lt;p&gt;I am wondering what the Reverse Received Signal Strength Indicator (RSSI) is. I came across the term in the &lt;a href=&quot;http://bluvision.com/wp-content/uploads/2015/12/Specs-iBEEK1.6.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;BEEKS Beacon's datasheet&lt;/a&gt;, under the heading &quot;Bluvision BLE Stack Specification&quot;.&lt;/p&gt;&#xA;" OwnerUserId="19402" LastEditorUserId="19402" LastEditDate="2016-12-20T20:10:27.653" LastActivityDate="2016-12-21T00:11:17.207" Title="Reverse Received Signal Strength Indicator (RSSI)" Tags="|wireless|protocol-theory|terminology|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37447" PostTypeId="1" AcceptedAnswerId="37450" CreationDate="2016-12-20T10:22:41.627" Score="3" ViewCount="8561" Body="&lt;p&gt;Is there a SNMP OID to detect network equipment vendor name? For Cisco and Juniper equipment I have used sysDescr.0(.1.3.6.1.2.1.1.1.0), which among other data includes the vendor name. However, this is usually a multi-line string with no fixed structure and needs to be parsed if used in scripts. Maybe there is a standard OID to query equipment vendor name? Or equipment OS(Junos, IOS XR, IOS, IOS XE, etc) family?&lt;/p&gt;&#xA;" OwnerUserId="3620" LastActivityDate="2019-10-01T19:32:52.330" Title="SNMP OID to detect network equipment vendor" Tags="|snmp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37448" PostTypeId="1" AcceptedAnswerId="38885" CreationDate="2016-12-20T11:49:26.607" Score="1" ViewCount="319" Body="&lt;p&gt;I have two questions about Probe Request frames in 802.11n:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;On which rate are Probe Request frames sent in 802.11n? Is it fixed in the standard, or can it be tuneable? &lt;/li&gt;&#xA;&lt;li&gt;Are Probe Request frames sent in older modulation techniques to support older 802.11 versions? I guess this should be the same as the other Management Frames.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="32925" LastActivityDate="2017-08-12T12:40:39.093" Title="Probe Request frames in 802.11n" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37449" PostTypeId="2" ParentId="20265" CreationDate="2016-12-20T12:01:25.573" Score="0" Body="&lt;p&gt;&lt;strong&gt;tl;dr&lt;/strong&gt; Use official &lt;a href=&quot;http://www.winpcap.org/install/default.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;code&gt;winpcap&lt;/code&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have yet another slightly different answer. I don't have &lt;code&gt;wireshark&lt;/code&gt; installed. And it's &lt;code&gt;nmap-7.31&lt;/code&gt; now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Originally, I installed &lt;code&gt;nmap&lt;/code&gt; with &lt;code&gt;chocolatey&lt;/code&gt;. But it gave me &lt;code&gt;Failed to open device&lt;/code&gt; error. Then I uninstalled &lt;code&gt;npcap&lt;/code&gt; which came with &lt;code&gt;nmap&lt;/code&gt;. And &lt;code&gt;nmap&lt;/code&gt; said:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WARNING: Could not import all necessary Npcap functions. You may need to&#xA;upgrade to version 0.07 or higher from http://www.npcap.org. Resorting to&#xA;connect() mode -- Nmap may not function completely&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But finished successfully. I tried the above with installer from nmap.org, but it was the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I've run into &lt;a href=&quot;http://seclists.org/nmap-dev/2008/q2/677&quot; rel=&quot;nofollow noreferrer&quot;&gt;the following suggestion&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also please try it with the official WinPcap 4.0.2 installer, available&#xA;  at &lt;a href=&quot;http://www.winpcap.org/install/default.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.winpcap.org/install/default.htm&lt;/a&gt;. Remove the Nmap winpcap&#xA;  from &quot;Add or Remove Programs&quot; first, then run the installer.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And it worked.&lt;/p&gt;&#xA;" OwnerUserId="32924" LastActivityDate="2016-12-20T12:01:25.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37450" PostTypeId="2" ParentId="37447" CreationDate="2016-12-20T13:24:53.320" Score="3" Body="&lt;p&gt;No, there's not a single OID tree to describe the equipment.  There is a vendor-specific tree, and each vendor implements their own MIB tree under that.  Whether or not any particular vendor bothers (major enterprise vendors do) is a matter for them.  Within their own tree the vendor can define whatever they like and that may include the model.  Not all equipment from a single vendor will support their entire MIB tree.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2016-12-20T13:24:53.320" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37451" PostTypeId="1" CreationDate="2016-12-20T13:29:15.897" Score="3" ViewCount="4151" Body="&lt;p&gt;i have a problem with BGP AS number. We have configured two BGP peers to different ISPs on a Cisco ISR4451-X Router. One peer works fine but at the second peer the state oft the connection is always idle.&#xA;When I look into the logging I see that the wrong AS number is transmitted:&lt;br&gt;&#xA;I have configured the AS 202xxx but transmitted is always the number 23456.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Log Buffer (4096 bytes):&#xA;Dec 20 12:52:13.940: BGP_Router: unhandled major event code 128,minor 0&#xA;Dec 20 12:52:19.609: BGP: xxx active went from Idle to Active&#xA;Dec 20 12:52:19.609: BGP: xxx open active, local address xxx&#xA;Dec 20 12:52:19.621: BGP: ses global xxx (0x7F33116D6630:0) act Adding topology IPv4 Unicast:base&#xA;Dec 20 12:52:19.621: BGP: ses global xxx (0x7F33116D6630:0) act Send OPEN&#xA;Dec 20 12:52:19.621: BGP: xxx active went from Active to OpenSent&#xA;Dec 20 12:52:19.621: BGP: xxx active sending OPEN, version 4, my as: 23456, holdtime 180 seconds, ID B99E6022&#xA;Dec 20 12:52:19.634: BGP: ses global xxx (0x7F33116D6630:0) act Remote close.&#xA;Dec 20 12:52:19.634: BGP: nbr_topo global xxx IPv4 Unicast:base (0x7F33116D6630:0) Not scheduling for GR processing [Peer did not advertise GR cap]&#xA;Dec 20 12:52:19.634: %BGP-5-NBR_RESET: Neighbor xxx active reset (Peer closed the session)&#xA;Dec 20 12:52:19.634: BGP: ses global xxx (0x7F33116D6630:0) act Reset (Peer closed the session).&#xA;Dec 20 12:52:19.634: BGP: nbr_topo global xxx IPv4 Unicast:base (0x7F33116D6630:0) NSF delete stale NSF not active&#xA;Dec 20 12:52:19.634: BGP: nbr_topo global xxx IPv4 Unicast:base (0x7F33116D6630:0) NSF no stale paths state is NSF not active&#xA;Dec 20 12:52:19.634: BGP: nbr_topo global xxx IPv4 Unicast:base (0x7F33116D6630:0) Resetting ALL counters.&#xA;Dec 20 12:52:19.634: BGP: xxx active closing&#xA;Dec 20 12:52:19.634: BGP: ses global xxx (0x7F33116D6630:0) act Session close and reset neighbor xxx topostate&#xA;Dec 20 12:52:19.634: BGP: nbr_topo global xxx IPv4 Unicast:base (0x7F33116D6630:0) Resetting ALL counters.&#xA;Dec 20 12:52:19.634: BGP: xxx active went from OpenSent to Idle&#xA;Dec 20 12:52:19.634: %BGP_SESSION-5-ADJCHANGE: neighbor xxx IPv4 Unicast topology base removed from session  Peer closed the session&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A monitor capture output with wireshark also show the wrong AS Number and the BGP notification message show Bad Peer AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Border Gateway Protocol - OPEN Message&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   Marker: ffffffffffffffffffffffffffffffff&#xA;   Length: 29&#xA;   Type: OPEN Message (1)&#xA;   Version: 4&#xA;   My AS: 23456&#xA;   Hold Time: 180&#xA;   BGP Identifier: xxx&#xA;   Optional Parameters Length: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Border Gateway Protocol - NOTIFICATION Message&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Marker: ffffffffffffffffffffffffffffffff&#xA;Length: 21&#xA;Type: NOTIFICATION Message (3)&#xA;Major error Code: OPEN Message Error (2)&#xA;Minor error Code (Open Message): Bad Peer AS (2)&#xA;&#xA;router bgp 202xxx&#xA;bgp router-id xxx&#xA;bgp log-neighbor-changes&#xA;neighbor xxx remote-as 212xx&#xA;neighbor xxx dont-capability-negotiate&#xA;neighbor xxx password 7 0337723xxxxxxxx&#xA;&#xA;BGP router identifier xxx, local AS number 202xxx&#xA;BGP table version is 1814938, main routing table version 1814938&#xA;613561 network entries using 152163128 bytes of memory&#xA;613561 path entries using 73627320 bytes of memory&#xA;102358/96231 BGP path/bestpath attribute entries using 25384784 bytes of memory&#xA;88809 BGP AS-PATH entries using 4146064 bytes of memory&#xA;1 BGP ATTR_SET entries using 40 bytes of memory&#xA;201 BGP community entries using 7928 bytes of memory&#xA;0 BGP route-map cache entries using 0 bytes of memory&#xA;0 BGP filter-list cache entries using 0 bytes of memory&#xA;BGP using 255329224 total bytes of memory&#xA;BGP activity 1988167/1374600 prefixes, 3700228/2473531 paths, scan interval 60 secs&#xA;&#xA;&#xA;Neighbor    V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down    State/PfxRcd&#xA;xxx         4   xxx    0      0        1       0   0    5d04h    Idle&#xA;xxx         4   xxx  609982   3337     1814810 0   0    1d01h    613562&#xA;xxx         4   xxx     0      0        1       0   0    never    Active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is the wrong AS transmitted at this peer?&lt;/p&gt;&#xA;" OwnerUserId="32927" LastEditorUserId="8499" LastEditDate="2016-12-20T15:13:46.780" LastActivityDate="2016-12-21T08:55:42.193" Title="wrong BGP AS number transmitted" Tags="|routing|bgp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37452" PostTypeId="2" ParentId="37451" CreationDate="2016-12-20T13:41:24.680" Score="1" Body="&lt;p&gt;AS23456 is a special ASN called &amp;quot;AS_TRANS&amp;quot;. When 4-byte ASN's were introduced to deal with the shortage of AS-numbers, not every router was running software able to handle that. AS23456 was used so routers only supporting 2-byte ASN's are able to properly handle routes to 4-byte ASN's without needing to upgrade them. You can read more about this in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4893&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4893&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;I'm a bit amazed your router still logs that AS as its local ASN though. 4-byte AS numbers have been the standard for a long time now.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-12-20T13:41:24.680" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37453" PostTypeId="2" ParentId="35573" CreationDate="2016-12-20T13:58:53.127" Score="0" Body="&lt;p&gt;Okay so this is one of those times when you should always verify your network map even if you are pretty confident it is correct. The jack on the wall at my desk that I was connecting the switch to was passing through an old Dell switch hidden away on a rack. The Dell switch was only passing untagged traffic so this is the reason Span tree was not working. This is why when I would run my debugs on both ends I could see the BPDU's leaving each switch but neither Cisco switch would recieve any BPDU's from each other. As soon as I ripped that old dell out of the server room and threw it away, everything works. I suppose this is why we have an OSI model for troubleshooting, always start at layer 1 and always verify even if someone swears the network map is correct. &lt;/p&gt;&#xA;" OwnerUserId="14372" LastActivityDate="2016-12-20T13:58:53.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37457" PostTypeId="1" AcceptedAnswerId="37458" CreationDate="2016-12-20T15:57:39.120" Score="1" ViewCount="1378" Body="&lt;p&gt;I have a Cisco switch model 3500 series 48 port. I need to enable port security on this switch. Could you tell me the configuration commands to apply this policy?&lt;/p&gt;&#xA;" OwnerUserId="29568" LastEditorUserId="8499" LastEditDate="2018-03-02T18:33:56.763" LastActivityDate="2021-01-27T11:35:23.483" Title="How do I enable port security on Cisco switch?" Tags="|cisco|switch|switching|cisco-catalyst|switchport|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37458" PostTypeId="2" ParentId="37457" CreationDate="2016-12-20T16:21:17.187" Score="3" Body="&lt;p&gt;Enabling port security is extremely easy at its core. It gets more complicated with the options.&lt;/p&gt;&#xA;&lt;p&gt;Enabling port security on a switch port is done with a simple command: &lt;code&gt;switchport port-security&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Cisco maintains &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;documentation&lt;/a&gt; on its commands.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="36720" LastEditDate="2021-01-27T11:35:23.483" LastActivityDate="2021-01-27T11:35:23.483" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="37459" PostTypeId="2" ParentId="25362" CreationDate="2016-12-20T16:37:30.880" Score="2" Body="&lt;p&gt;Your question appears to be not, &quot;are there any global networks other than the Internet&quot; but &quot;are there any global networks other than the Internet, and do any of those use a non-IP transport&quot; and the answer here is yes.  The global switched telephone network, aka the PSTN, was originally built on non-IP transports.  About fifteen years ago telephone operators initiated a huge undertaking to move the PSTN from circuit-switched (TDM) to packet-switched (IP) but there are still huge chunks of the network that are non-IP.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example is X.25.  This was a WAN technology extensively used in global networking up until the 1980s and still survives in certain niche applications today (packet radio I'm told, and some credit card/ATM uses).  If you were a multinational of that time, chances are that you connected your sites in a mesh using X.25 links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, TCP/IP is not a perfect protocol.  There are some places where the cracks really start to show.  Talking to satellites is one example (though there is work going in on this area, eg SCPS).  I've learnt that just because protocol X is the winner in the market, doesn't mean it was technically the best...only that it was the easiest to get going and adapt.  In 25 years' time we'll be running something else!&lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2016-12-20T16:37:30.880" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37460" PostTypeId="2" ParentId="37451" CreationDate="2016-12-20T17:09:24.687" Score="0" Body="&lt;p&gt;I think your issue is this command &lt;code&gt;neighbor xxx dont-capability-negotiate&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This disables negotiation of all capabilities, one of which is a 4byte AS &lt;code&gt;neighbor x.x.x.x dont-capability-negotiate four-byte-as&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2016-12-20T17:09:24.687" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37462" PostTypeId="1" CreationDate="2016-12-20T17:52:35.680" Score="2" ViewCount="2358" Body="&lt;p&gt;Okay,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am currently trying to understand this exact problem. I understand that switches operate at level 2, therefore use MAC addresses for comms. Let's assume that the switch is connected to a router and the router has internet access, and there are two computers connected to the switch A and B. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1.&#xA;If A would like to connect to the internet, let's say connect to Google, how does it do this? Does it simply look at its ARP cache and find that it doesn't know where to find google, so looks up the MAC address for the default gateway (router) and forward this frame onto the router? If this is the case, where do IP addresses come into this, what does the router then do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2. &#xA;Does A and B have an IP address allocated to it? If so, how does this happen? My understanding is that the router has a DHCP, but how does it know that it needs to allocate two IP addresses to A and B? Plus, as the switch is level 2 how can it handle IP addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope someone can help clear up my confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="32935" LastActivityDate="2017-01-19T23:20:04.253" Title="How do computers connected to a switch (which is connected to a router) have access to the internet?" Tags="|switch|router|internet|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37463" PostTypeId="2" ParentId="37233" CreationDate="2016-12-20T18:08:36.347" Score="0" Body="&lt;p&gt;From a networking point of view:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ACL - a filter based on either source or destination IP address or port/ protcol. ACLs should never be used in place of a firewall at your network edge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firewall - same as above but more intelligent, depending on type can be based on application and behavior, session type etc. They can be staeful and application aware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static rules - if I understand your context correctly you're referring to &quot;static firewall rules&quot; which would be more like ACLs i.e. block/allow traffic dependent on IP/port source/destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Paul&lt;/p&gt;&#xA;" OwnerUserId="3846" LastActivityDate="2016-12-20T18:08:36.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37464" PostTypeId="2" ParentId="37462" CreationDate="2016-12-20T18:23:50.410" Score="2" Body="&lt;p&gt;First, it is Layer 2, not level 2. The OSI model specifies seven layers. Layer 2 is the Data-Link Layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 addresses, e.g. MAC addresses, are used in layer-2 frame headers to get the layer-2 frame from one host on a LAN to another host on the same LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-3 addresses, e.g. IPv4 addresses, are used in layer-3 packet headers to get the layer-3 packet from the source network to the destination network. A router (layer-3 device) will look up the destination layer-3 address of a layer-3 packet in its routing table to determine where to forward the layer-3 packet towards the destination layer-3 address.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q1. If A would like to connect to the internet, let's say connect to&#xA;  Google, how does it do this? Does it simply look at its ARP cache and&#xA;  find that it doesn't know where to find google, so looks up the MAC&#xA;  address for the default gateway (router) and forward this frame onto&#xA;  the router? If this is the case, where do IP addresses come into this,&#xA;  what does the router then do?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A source host will compare its layer-3 network to the layer-3 network of the destination address. If the layer-3 destination address is on the same network as the source host's layer-3 address, the layer-2 destination address used is that of the destination host. If the layer-3 destination address is on a different network than the source host's layer-3 address, the source host will use the layer-2 address of its configured gateway (router). The source host will use something like ARP (Address &lt;em&gt;Resolution&lt;/em&gt; Protocol) to &lt;em&gt;resolve&lt;/em&gt; the layer-3 destination address, or layer-3 gateway address, to the layer-2 destination address, and it will build a layer-2 frame to encapsulate the layer-3 packet with the layer-2 destination address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router receiving a layer-2 frame will strip off the layer-2 frame from the layer-3 packet. The router will look up the destination layer-3 address in its routing table. If the router cannot find a match to the destination network, it will discard the layer-3 packet, other wise the routing table will tell the router where to forward the layer-3 packet. The router will build a new layer-2 frame for the interface it will use to forward the packet.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Q2. Does A and B have an IP address allocated to it? If so, how does&#xA;  this happen? My understanding is that the router has a DHCP, but how&#xA;  does it know that it needs to allocate two IP addresses to A and B?&#xA;  Plus, as the switch is level 2 how can it handle IP addresses?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The source and destination hosts will probably have some layer-3 address. If the path is across the Internet, the addresses will be IPv4 or IPv6 addresses. (IP stands for Internet Protocol.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-3 addresses can be assigned to a host by manually configuring it on the host, or by some automated process (DHCP for IPv4, DHCPv6, SLAAC, or Random Addressing for IPv6, etc.). How the layer-3 addresses are chosen depend on what method of assigning layer-3 addresses is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A switch is a layer-2 device, and it doesn't know or care what layer-3 protocols or addressing are used. A switch only looks at the layer-2 frame; it doesn't strip off the layer-2 frame to inspect the layer-3 packets the way a router does.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-20T18:41:43.537" LastActivityDate="2016-12-20T18:41:43.537" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37466" PostTypeId="1" AcceptedAnswerId="39846" CreationDate="2016-12-20T18:55:38.110" Score="0" ViewCount="466" Body="&lt;p&gt;Recently I came across the concept of a Private VLAN (&lt;a href=&quot;https://en.wikipedia.org/wiki/Private_VLAN&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Private_VLAN&lt;/a&gt;). However, I can't seem to see the difference between a PVLAN and a VLAN which is configured on one port only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine that I have a switch with 4 ports:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The trunk port&lt;/li&gt;&#xA;&lt;li&gt;VLAN 1&lt;/li&gt;&#xA;&lt;li&gt;VLAN 2&lt;/li&gt;&#xA;&lt;li&gt;VLAN 3&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;In the above set-up, each VLAN can be regarded as a PVLAN. Is that correct?&lt;/p&gt;&#xA;" OwnerUserId="25533" LastActivityDate="2017-03-21T03:49:49.900" Title="Is a PVLAN the same as a one-port VLAN" Tags="|vlan|private-vlan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37467" PostTypeId="2" ParentId="37466" CreationDate="2016-12-20T19:37:46.327" Score="1" Body="&lt;p&gt;In short, no, those VLANs would be considered primary VLANs, not private VLANs or PVLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PVLANs are a segmentation technique that can isolate hosts within the same  'primary' VLAN into 'secondary' or private VLANs. These PVLAN hosts belong to the same IP subnet. In order for the hosts to communicate, they will have to traverse a router. PVLANs have to be configured as such and are different from &quot;regularly&quot; configured VLANs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See if these links at &lt;a href=&quot;http://packetlife.net/blog/2010/aug/30/basic-private-vlan-configuration/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Packetlife&lt;/a&gt; and &lt;a href=&quot;http://blog.ine.com/2008/01/31/understanding-private-vlans/&quot; rel=&quot;nofollow noreferrer&quot;&gt;INE&lt;/a&gt; can help explain more. PVLANs can get quite complicated. &lt;/p&gt;&#xA;" OwnerUserId="15501" LastActivityDate="2016-12-20T19:37:46.327" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37468" PostTypeId="2" ParentId="23960" CreationDate="2016-12-20T20:13:43.600" Score="0" Body="&lt;p&gt;I have a MikroTik RB941-2nD-TC &quot;hAP lite&quot; running version 6.37.3 (6.34.2 also worked), that I wanted to add to an existing home router to extend wifi into a blackspot. I labeled the MikroTik as ecwa_01 (ethernet-connected-wifi-ap), to distinguish it from the existing router. The house already had an ethernet cable from the routers location to the blackspot. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because the default config does most of what I needed I just, (from linux command line)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;sudo ip a a 192.168.88.254 dev eth0; ssh admin@192.168.88.1&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/system identity set name=ecwa_01&#xA;/system package enable ipv6&#xA;/ip pool remove numbers=0&#xA;/ip dhcp-server remove [find where interface=bridge]&#xA;/interface bridge port add bridge=bridge interface=ether1&#xA;/ip address add address=192.168.88.3/24 interface=bridge&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I connect port 1 (ether1 labeled internet) of ecwa_01 to the ethernet cable that leads back to the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few other things that I set, such as a passphrase for the device and:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/ip service disable telnet&#xA;/ip service disable api&#xA;/ip service disable winbox&#xA;/ip service disable api-ssl&#xA;/ip service disable www&#xA;/ip service disable ftp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the customer also wants to use the MikroTik via wifi then I use a slightly modified version from the answer by &lt;a href=&quot;https://networkengineering.stackexchange.com/users/20690/mcdnl90&quot;&gt;mcdnl90&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface wireless&#xA;set ssid=&quot;ecwa_01&quot; numbers=0&#xA;set wlan1 mode=ap-bridge wireless-protocol=802.11 band=2ghz-b/g/n frequency=auto ssid=&quot;ecwa_01&quot; disabled=no&#xA;/interface wireless security-profiles&#xA;set [find default=yes] authentication-types=wpa-psk,wpa2-psk group-ciphers=tkip,aes-ccm unicast-ciphers=tkip,aes-ccm mode=dynamic-keys wpa-pre-shared-key=&quot;**Your WiFi password**&quot; wpa2-pre-shared-key=&quot;**Your WiFi password**&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;N.B. you can cut-n-paste most of this, but you have to change **Your WiFi password** and there may be a delay when you add ether1 to the bridge. (Which is why I usually do that last.)&lt;/p&gt;&#xA;" OwnerUserId="32936" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-12-20T20:13:43.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37469" PostTypeId="2" ParentId="37462" CreationDate="2016-12-20T20:54:15.610" Score="-1" Body="&lt;p&gt;It's the Internet, not internet (capital I).  Internet Protocol, IP, is the (no so) secret sauce.  Link layer protocols such as Ethernet and WiFi enable communications links, but network layer protocols such as IP allow internetworking, the passing of traffic/communications over multiple links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP is basically some open source software.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-20T20:54:15.610" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37471" PostTypeId="1" CreationDate="2016-12-20T22:38:25.093" Score="3" ViewCount="735" Body="&lt;p&gt;What would happen if you have an access layer switch with a 10 Gbps uplink and 1 Gbps downlinks and 1 machine (behind one of the 1 Gbps ports) would be attacked by a 10 Gbps UDP flood type attack? Will the switch accept the whole 10 Gbps of traffic and pass only 1 Gbps to the downlink and have its uplink saturated or only let 1 Gbps pass through, so that the uplink isn't congested (10% used)? I'm trying to find out what would happen in case a 10 Gbps network attack targets one machine connected at 1 Gbps to a switch having a 10 Gbps uplink. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="32941" LastActivityDate="2017-04-20T07:30:55.527" Title="What happens to switch with 1 Gbps downlinks and 10 Gbps uplink in case of 10 Gbps attack?" Tags="|switch|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37472" PostTypeId="2" ParentId="37471" CreationDate="2016-12-20T22:43:52.953" Score="1" Body="&lt;p&gt;The switch will accept up to the interface speed from an interface*. Switches have very tiny buffers. With 10 Gbps of traffic going to a 1 Gbps interface, 90% of the traffic will be dropped at the 1 Gbps interface.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;*There are cases where this may not be possible. For example, a switch with an ASIC that serves an interface, but the ASIC can't handle the full traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-20T22:43:52.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37473" PostTypeId="1" AcceptedAnswerId="37477" CreationDate="2016-12-20T23:00:54.390" Score="3" ViewCount="2269" Body="&lt;p&gt;I have a 24-port gigabit switch, a couple of 1U horizontal cable management bars and a 24-port patch panel in a rack. I've made a clip-art version of my present setup below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EOIBs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EOIBs.png&quot; alt=&quot;rack components&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The gray thing in the middle is one of the cable management bars. The patch panel ports go to regular Ethernet jacks (ports 1 - 12) around the building, security cameras, HDMI/ USB of Ethernet adapters, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ethernet switch ports 1 - 12 connect to the patch panel ports 1 - 12. Ports 13 and up on the Ethernet switch connect to other equipment in the cabinet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem is the cable management. The odd ports are in the top row of the switch, while even ones are on the bottom. In this case, I've seen installers use two patch panels--one above and another below the switch. The top panel serves the odd ports while the bottom serves the even ones. They then use extremely short patch cables with no cable management bars to do the connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only have a single patch panel--it wouldn't make sense for me to install another one--I just don't have that many things to connect. I suppose I could connect the bottom row on the switch to the patch panel and the top row to the equipment inside the cabinet itself. However, I kinda like having port 1 on the switch map to port 1 on the patch panel for troubleshooting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any advice on how I should route this? Will I need to make 12 custom length patch cables? Right now I'm using 1-foot cables and even with the cable management bar, it's a mess.&lt;/p&gt;&#xA;" OwnerUserId="32940" LastEditorUserId="32940" LastEditDate="2017-12-18T22:55:28.047" LastActivityDate="2017-12-18T22:55:28.047" Title="Cable management for a small LAN with a 24 port patch panel" Tags="|cabling|cable|layer1|rack-layout|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37474" PostTypeId="1" AcceptedAnswerId="37475" CreationDate="2016-12-20T23:42:45.940" Score="2" ViewCount="152" Body="&lt;p&gt;I've seen all sorts of RJ45 crimp plugs advertised for use with Cat. 6 cable. I know Cat. 6 has more stringent requirements on the cable than Cat. 5 or 5e. It seems like there would similarly be more stringent requirements on the termination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;http://www.l-com.com/multimedia/datasheets/DS_TSP4388C6.PDF&quot; rel=&quot;nofollow noreferrer&quot;&gt;data sheet&lt;/a&gt; for one brand shows a wire separator and a load bar and only advertises compatibility with Cat. 6. Another brand advertises that their plug works with both Cat. 5e and Cat. 6 and includes none of the those extra components. Are the wire separator and load bar unnecessary? Are there a lot of cheap Cat 5e RJ45 plugs out there that are just being advertised for Cat. 6 also?&lt;/p&gt;&#xA;" OwnerUserId="32940" LastEditorUserId="8499" LastEditDate="2016-12-21T00:05:41.743" LastActivityDate="2016-12-21T00:15:26.753" Title="Are most Cat. 6 RJ45 plugs really Cat. 6 certified?" Tags="|cabling|cable|layer1|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37475" PostTypeId="2" ParentId="37474" CreationDate="2016-12-21T00:04:53.300" Score="1" Body="&lt;p&gt;Category-6 parts, including the cabling, plugs, sockets, patch panels, etc. do indeed need to meet the Category-6 requirements. A cable system must use all Category-6 parts, and pass the Category-6 test suite before it can be certified as a Category-6 cable system, despite what may be printed on any or all of the individual parts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual installation plays a very big part in this, and I have seen very good, experienced installers struggle to get a cable installation to pass the Category-6 test suite. Something simple as having the blue wire on top of the blue-white wire when punching down the wires can cause it to fail. I have also never seen an installer able to make a Category-6 patch cord that will pass the Category-6 test suite. As far as I'm concerned, only factory-built patch cords should be used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, there is a lot of crap sold that claims to be certified for one category or another. I would not be comfortable using any part that claims Category-5e and Category-6 compatibility. The reason is that most Category-5e cable is 24-gauge wire, but most Category-6 cable is made thicker (23-gauge wire) in order to meet the Category-6 requirements. Something seemingly so small can cause big problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way to be sure that any cable system meets Category-6 is to individually test each cable run with an expensive tester. A cable installer is supposed to do exactly that after installation, repairing any problems, and providing the customer with a complete report of all tested parameters at the end of the installation.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;FYI, there really is no such thing as Category-5, anymore. Categories 1, 2, 4, and 5 have all been de-regsitered/de-certified by ANSI/TIA/EIA, the standards bodies responsible for cable categories.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-21T00:15:26.753" LastActivityDate="2016-12-21T00:15:26.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37476" PostTypeId="2" ParentId="37446" CreationDate="2016-12-21T00:11:17.207" Score="2" Body="&lt;p&gt;This doesn't appear to be a common term outside of Bluvision products. I would contact them directly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My best guess is that their product, when acting as a peripheral, will send the central an RSSI value in the response to the central's scan request packet (since they mention this feature in the context of advertising). That RSSI value is the signal strength of the central's scan request packet as heard by the Bluvision sensor.&lt;/p&gt;&#xA;" OwnerUserId="32940" LastActivityDate="2016-12-21T00:11:17.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37477" PostTypeId="2" ParentId="37473" CreationDate="2016-12-21T00:13:29.007" Score="2" Body="&lt;p&gt;To do this properly, you would use a standard cable length, usually two meters. Run one cable at a time from the switch to the patch panel. Run a cable from switch port 1, routing the cable down to the horizontal cable management, out the left end, let the cable naturally drape, then back into the horizontal cable management, and down to patch panel port 1. Repeat for the first half of the switch ports. Then start with the last switch port, do the same thing as above, except drape the cables out the right end of the horizontal cable management.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use velcro tie wraps to make thing even neater. Using zip ties carries some risk of warping the wire twists inside the cable sheath, as well as being inconvenient should changes be necessary, and they should be avoided.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-21T00:13:29.007" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="37479" PostTypeId="2" ParentId="34267" CreationDate="2016-12-21T01:38:34.180" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/access-lists/26448-ACLsamples.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configure Commonly Used IP ACLs&lt;/a&gt; by Cisco shows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname R1&#xA;!&#xA;interface ethernet0&#xA;ip access-group 1 in&#xA;!&#xA;access-list 1 deny host 192.168.10.1&#xA;access-list 1 permit any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SY/configuration/guide/sy_swcg/port_acls.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Port ACLs (PACLs)&lt;/a&gt; offer the ability to filter/deny a specific MAC address on the Ethernet switch port.  Check your switch for feature availability.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(config)# mac access-list extended simple-mac-acl&#xA;Switch(config-ext-macl)# deny host 000.000.011 any&#xA;Switch(config-ext-macl)# end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-21T01:38:34.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37480" PostTypeId="2" ParentId="37405" CreationDate="2016-12-21T03:46:31.393" Score="2" Body="&lt;p&gt;Because of when you traceroute you own IP address on a point-to-point serial interface the ICMP packet goes over the wire to the other side and back.&lt;/p&gt;&#xA;" OwnerUserId="32460" LastActivityDate="2016-12-21T03:46:31.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37481" PostTypeId="1" AcceptedAnswerId="37508" CreationDate="2016-12-21T05:36:28.540" Score="4" ViewCount="532" Body="&lt;p&gt;Has anyone achieved line-speed or close to line-speed throughput on a SINGLE IPSec tunnel on a 10Gbps port? If this is not possible, what would be a reasonable throughput (w.r.t interface speed) to expect out of a single IPSec tunnel?&#xA;I have an assumption that live back haul networks always split the load across multiple IPSec tunnels to achieve better throughput. Is this correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: &quot;back-haul&quot; is wrong. What I meant was access-network-to-core connection. (Ex: radio access network to core in a telco network). Hence, the need for IPSec. Again, I would like to highlight the &quot;single tunnel&quot; term. The server class machines (ex: HP Gen 8/9) running DPDK based routing solution does not seem to handle &quot;single&quot; flows well. The whole RSS (receive side scaling) works only if there are multiple flows. So, when there is only one flow, this becomes a bottleneck. That is, the throughput achieved is what a single core can handle. If there are multiple flows, meaning multiple IPSec tunnels, there is no problem in achieving throughput somewhere close to line speed. So, my question is &quot;does anyone also face this issue with the usage of a single IPSec tunnel and had to use multiple tunnels for better throughput on cisco/juniper?&quot;&lt;/p&gt;&#xA;" OwnerUserId="32158" LastEditorUserId="32158" LastEditDate="2016-12-22T11:36:00.980" LastActivityDate="2016-12-22T11:36:00.980" Title="Does any router support line-speed throughput for a single IPSec tunnel?" Tags="|cisco|juniper|ipsec|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37483" PostTypeId="1" CreationDate="2016-12-21T05:42:19.713" Score="-1" ViewCount="593" Body="&lt;p&gt;HELP ME..!!!!&#xA;I want to Design my Network as like as Below. &#xA;I tried several times but Failed (Failed to ping Web server from my Local LAN and also from LAN). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My configuration is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.16.1 255.255.255.0&#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 203.1.1.2 255.255.255.0&#xA;!&#xA;interface Vlan3&#xA; no forward interface Vlan 1&#xA; nameif dmz&#xA; security-level 50&#xA; ip address 192.168.27.51 255.255.255.248&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA; switchport access vlan 1&#xA;!&#xA;interface Ethernet0/2&#xA; switchport access vlan 3&#xA;!&#xA;dhcpd address 192.168.16.5-192.168.16.16 inside&#xA;dhcpd enable inside&#xA;!&#xA;object network LAN&#xA; subnet 192.168.16.0 255.255.255.0&#xA;object network out&#xA; subnet 203.1.1.0 255.255.255.248&#xA;!&#xA;!&#xA;route dmz 0.0.0.0 0.0.0.0 192.168.27.52 1&#xA;!&#xA;access-list in_to_dmz extended permit tcp any any&#xA;access-list in_to_dmz extended permit icmp any any&#xA;!&#xA;!&#xA;access-group in_to_dmz in interface dmz&#xA;object network out&#xA; nat (outside,dmz) dynamic interface&#xA;access-group in_to_dmz in interface dmz&#xA;object network LAN&#xA; nat (inside,dmz) dynamic interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UBolP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UBolP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32946" LastEditorUserId="8499" LastEditDate="2016-12-21T05:48:05.667" LastActivityDate="2016-12-21T14:27:18.267" Title="Can't Configure CISCO ASA 5505 firewall" Tags="|cisco|cisco-asa|firewall|security|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37484" PostTypeId="1" AcceptedAnswerId="37486" CreationDate="2016-12-21T07:29:21.540" Score="0" ViewCount="178" Body="&lt;p&gt;&lt;strong&gt;Background:&lt;/strong&gt; We're a very small company with a guest WLAN using captive portal authentification which by itself is working fine. Now we want to seperate the guests completly from our internal network ressources using vlans. In general this also works: The access points (TP-Link EAP110) add the vlan tag based on the SSID and the switch (D-Link DGS-1210) has an asymmetric vlan configured containing the AP ports and the external router allowing access to the internet while being on the guest wlan. The part where I am stuck is including the captive portal authentification since it is provided by one of the network ressources which we are trying to seperate from the guests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Issue:&lt;/strong&gt; So our server (running SLES11) has two ethernet interfaces, the first (&lt;code&gt;eth0&lt;/code&gt;) being the only to be used up to now. My plan was to use the other one (&lt;code&gt;eth1&lt;/code&gt;) for a second connection to the same switch but on a different vlan which is used by our guests, then utilize the firewall to only open port 80 on &lt;code&gt;eth1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am unsure how to configure this setup. I looked up several vlan for linux ressources but these seem to always assume the machine is using only one connection. Currently, both &lt;code&gt;eth0&lt;/code&gt; and &lt;code&gt;eth1&lt;/code&gt; receive their ip-adresses from the DHCP to which I added a &lt;code&gt;vlan0&lt;/code&gt; on the respective VID using &lt;code&gt;eth1&lt;/code&gt; and the same ip as &lt;code&gt;eth1&lt;/code&gt; (but static, at least for testing) but I can't get any response from the machine while being on the vlan (although I see packets with that VID arriving on that machine). It is responding fine on both ips from the main vlan. Also, I can't reach the outside world using &lt;code&gt;eth1&lt;/code&gt; so my network configuration is wrong at some point:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ifconfig&#xA;eth0      Link encap:Ethernet  HWaddr 00:25:90:A6:BB:A4  &#xA;          inet addr:192.168.100.11  Bcast:192.168.100.255  Mask:255.255.255.0&#xA;          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1&#xA;          RX packets:17885592942 errors:0 dropped:80376 overruns:2811 frame:0&#xA;          TX packets:20780035729 errors:0 dropped:0 overruns:0 carrier:0&#xA;          collisions:0 txqueuelen:1000 &#xA;          RX bytes:21191101223489 (20209408.9 Mb)  TX bytes:24496578689971 (23361757.9 Mb)&#xA;          Memory:dfee0000-dff00000 &#xA;&#xA;eth1      Link encap:Ethernet  HWaddr 00:25:90:A6:BB:A5  &#xA;          inet addr:192.168.102.11  Bcast:192.168.102.255  Mask:255.255.255.0&#xA;          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1&#xA;          RX packets:135707 errors:0 dropped:29 overruns:0 frame:0&#xA;          TX packets:832 errors:0 dropped:0 overruns:0 carrier:0&#xA;          collisions:0 txqueuelen:1000 &#xA;          RX bytes:46277408 (44.1 Mb)  TX bytes:111178 (108.5 Kb)&#xA;          Memory:dfe60000-dfe80000 &#xA;&#xA;lo        Link encap:Local Loopback  &#xA;          inet addr:127.0.0.1  Mask:255.0.0.0&#xA;          UP LOOPBACK RUNNING  MTU:16436  Metric:1&#xA;          RX packets:445849353 errors:0 dropped:0 overruns:0 frame:0&#xA;          TX packets:445849353 errors:0 dropped:0 overruns:0 carrier:0&#xA;          collisions:0 txqueuelen:0 &#xA;          RX bytes:307472500200 (293228.6 Mb)  TX bytes:307472500200 (293228.6 Mb)&#xA;&#xA;&#xA;# route -n&#xA;Kernel IP routing table&#xA;Destination     Gateway         Genmask         Flags Metric Ref    Use Iface&#xA;0.0.0.0         192.168.100.1   0.0.0.0         UG    0      0        0 eth0&#xA;127.0.0.0       0.0.0.0         255.0.0.0       U     0      0        0 lo&#xA;169.254.0.0     0.0.0.0         255.255.0.0     U     0      0        0 eth0&#xA;192.168.100.0   0.0.0.0         255.255.255.0   U     0      0        0 eth0&#xA;192.168.102.0   0.0.0.0         255.255.255.0   U     0      0        0 eth1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Machine1 (Main vlan) ping 192.168.100.11 - &amp;gt; success (ping arrives on eth0)&#xA;Machine1 (Main vlan) ping 192.168.102.11 - &amp;gt; success (ping arrives on eth0)&#xA;Machine2 (Guest vlan) ping 192.168.100.11 - &amp;gt; host not reachable&#xA;Machine2 (Guest vlan) ping 192.168.102.11 - &amp;gt; host not reachable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Screenshot of the Switch configuration:&#xA;&lt;img src=&quot;https://i.stack.imgur.com/XCCX7.png&quot; alt=&quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;35/36 are the APs&lt;/li&gt;&#xA;&lt;li&gt;37 is eth0 of the server in question&lt;/li&gt;&#xA;&lt;li&gt;45 is eth1 of the server in question&lt;/li&gt;&#xA;&lt;li&gt;47 is the external router&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32948" LastEditorUserId="32948" LastEditDate="2016-12-22T06:58:28.900" LastActivityDate="2016-12-22T06:58:28.900" Title="Different VLans of seperate interfaces" Tags="|routing|vlan|ethernet|" AnswerCount="1" CommentCount="3" ClosedDate="2018-08-06T22:30:53.477" ContentLicense="CC BY-SA 3.0" />
  <row Id="37485" PostTypeId="2" ParentId="37136" CreationDate="2016-12-21T08:02:58.900" Score="2" Body="&lt;p&gt;It looks like does not have such command.&lt;br&gt;&#xA;&lt;b&gt;&#xA;&quot;show ip bgp&quot;, &quot;show ip bgp neighbors 10.0.0.2 advertised-routes&quot;&lt;/b&gt;&#xA;able to find &quot;&gt;&quot; for bestpath.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or follow command is work. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vtysh -c 'show ip bgp' | grep -i '&amp;gt;'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You must run on you OS shell.&#xA;its better than 'show ip bgp regex'&lt;/p&gt;&#xA;" OwnerUserId="32460" LastActivityDate="2016-12-21T08:02:58.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37486" PostTypeId="2" ParentId="37484" CreationDate="2016-12-21T08:29:36.303" Score="2" Body="&lt;p&gt;You can configure VLAN on the linux server, but this is not needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The easiest way is to configure the switch so the port on which you connect eth1 is in access mode for the wanted VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also VLAN 0 is a special VLAN, don't use it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you shouldn't have the same network (192.168.100.0/24) on 2 different interfaces.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2016-12-21T08:29:36.303" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37488" PostTypeId="1" CreationDate="2016-12-21T09:24:21.630" Score="1" ViewCount="517" Body="&lt;p&gt;I tried upgrading ASA 5506W AP and upload the wrong image k9w8- full lightweight instead k9w7- autonomus. How to fix it &lt;/p&gt;&#xA;" OwnerUserId="32951" LastActivityDate="2018-06-15T10:50:01.820" Title="ASA 5506W AP the wrong image upload" Tags="|cisco-asa|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37492" PostTypeId="1" CreationDate="2016-12-21T13:01:30.347" Score="1" ViewCount="2081" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2460#section-8.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2460, Internet Protocol, Version 6 (IPv6) Specification, Section 8.1 Upper-Layer Checksums&lt;/a&gt;, states the UDP checksum is mandatory and any IPv6 receivers must discard UDP packets containing a zero checksum, whereas it is optional for IPv4.&lt;/p&gt;&#xA;&lt;p&gt;Who drops it and at what level?&lt;/p&gt;&#xA;&lt;p&gt;Does the hardware discard it or does some layer in the stack discard it?&lt;/p&gt;&#xA;" OwnerUserId="21360" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2018-12-26T05:07:34.633" Title="How does the TCP/IP stack handle UDP checksum errors?" Tags="|ethernet|ipv6|udp|rfc|checksum|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37493" PostTypeId="2" ParentId="37483" CreationDate="2016-12-21T14:02:17.020" Score="2" Body="&lt;p&gt;Can you ping from the ASA all the other @IP ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand your design, I think your default route have to be : &#xA;route outside 0.0.0.0 0.0.0.0 203.1.1.1 1&lt;/p&gt;&#xA;" OwnerUserId="32957" LastEditorUserId="32957" LastEditDate="2016-12-21T14:27:18.267" LastActivityDate="2016-12-21T14:27:18.267" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37494" PostTypeId="1" AcceptedAnswerId="37500" CreationDate="2016-12-21T14:41:32.630" Score="3" ViewCount="1723" Body="&lt;p&gt;I have recently sat in some networking lectures and have a few questions about DMZ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The example that I was given was: I have an office, in which it has a private network. In that private network, there is a database which stores all of the office's figures, as well as bank transaction details and staff details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There was a requirement for the office's headquarters to access the store's figures. The lecturer introduced DMZ, but didn't go into enough detail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1. Would the DMZ simply have a web server sitting within it, which would then get updated periodically by the private network's database? (only updating the web server with the store's figures of course). Or would the web server be the one querying the internal database? Pardon my ignorance here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2. Assuming that there were two firewalls installed in the network, Firewall 1 only allowing traffic from the Internet destined for the DMZ, and Firewall 2 only allowing traffic from the DMZ to the internal network. How would the private network have Internet access? Would Firewall 1 and Firewall 2 also be set up to allow HTTP and HTTPS traffic destined for the private network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note, that computer networking is my weakest subject, so I apologise in advance if I have missed anything fundamental out. I am just looking to enhance my understanding of DMZ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="32935" LastActivityDate="2016-12-22T18:53:29.280" Title="Implementing a DMZ and sharing data from the private network" Tags="|firewall|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37500" PostTypeId="2" ParentId="37494" CreationDate="2016-12-21T16:18:10.133" Score="2" Body="&lt;p&gt;Q1:  Either way would work, and it would likely be dependent on the application.  One could argue that pushing the data to the web server might be more secure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:  The firewalls also allow connections to start from the inside (trusted) to the outside (untrusted).  This is the default policy for most firewalls.  Note that the direction (who is initiating the connection) is important here: inside to outside is normally allowed, outside to inside is only allowed for specific hosts and protocols.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-21T16:18:10.133" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37503" PostTypeId="2" ParentId="37492" CreationDate="2016-12-21T17:59:28.930" Score="1" Body="&lt;p&gt;Ethernet has its own checksum, and it has nothing to to with IP, TCP, or UDP. Neither TCP not IPv6 have anything to do with the UDP checksum. UDP on the source will create the checksum, and UDP on the destination will verify the checksum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you don't really understand the network stack layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 protocols, e.g. ethernet, Wi-Fi, etc., may use a checksum. In general, layer-2 protocols will drop any layer-2 frame with a bad checksum anywhere along the layer-2 path. For instance, a switch will discard an ethernet frame with a bad checksum. Layer-2 protocols don't care which layer-3 or layer-4 protocols are carried in their frames, nor are they aware of any layer-3 or layer-4 checksums.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In layer-3, IPv4 has a header checksum that layer-3 devices, e.g. routers or hosts, will inspect to verify the integrity of the IPv4 header, discarding any layer-3 packets with a bad header checksum. IPv6 has done away with the IPv4 header checksum. Layer-3 protocols do not care which layer-2 protocol carries their layer-3 packets, nor which layer-4 protocols they carry. Neither are they aware of any layer-2 or layer-4 checksums.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-4 protocols, e.g. TCP, UDP, etc. may have a checksum. In IPv4, the UDP checksum was optional, but it is mandatory with IPv6. A layer-4 protocol will inspect it own checksum, and it will discard any datagrams with bad layer-4 checksums. Layer-4 protocols are unaware of any layer-2 or layer-3 checksums.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-21T17:59:28.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37507" PostTypeId="2" ParentId="37488" CreationDate="2016-12-22T00:02:44.773" Score="1" Body="&lt;p&gt;From the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa95/configuration/general/asa-95-general-config/admin-swconfig.html#ID-2152-000009a1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Documentation&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Recover and Load an Image for the ASA 5506W-X Wireless Access Point&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To recover and load a software image onto an ASA 5506W-X using TFTP, perform the following steps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Procedure&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Step 1   Session to the access point (AP) and enter the AP ROMMON (not the ASA ROMMON):&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ciscoasa# hw-module module wlan recover image&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Step 2   Follow the procedure in the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/wireless/access_point/12-4-25d-JA/Configuration/guide/cg_12_4_25d_JA/scg12-4-25d-JA-chap22-trouble.html#wp1048378&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IOS Software Configuration Guide for Cisco Aironet Access Points&lt;/a&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2016-12-22T00:02:44.773" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37508" PostTypeId="2" ParentId="37481" CreationDate="2016-12-22T00:10:54.333" Score="4" Body="&lt;p&gt;Yes.  The Cisco ASR 1001-HX is one that is advertised to do it.  Just step through 2 clicks of &lt;a href=&quot;http://www.cisco.com/c/dam/assets/prod/routers/cisco-router-selector/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco's router selector&lt;/a&gt; and see all the boxes that do 10G+ of IPSec.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-22T00:10:54.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37511" PostTypeId="2" ParentId="36656" CreationDate="2016-12-22T00:52:33.443" Score="1" Body="&lt;p&gt;Get rid of VLAN 30 called &quot;link&quot;.  It's not necessary and is complicating your config.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, one does inter-VLAN routing on the main/core switch only.  In such a topology, you configure interface VLAN 10 and VLAN 20 on the main switch, each having an IP address which is the default gateway for each subnet.  Done.  Disable IP routing on the other switch but put an IP address on it for management purposes only.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you insist on doing interVLAN routing on both switches, you need to configure HSRP or VRRP so that interVLAN routing works if a single switch fails.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-22T00:52:33.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37513" PostTypeId="2" ParentId="30231" CreationDate="2016-12-22T03:11:04.467" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Stateful_firewall&quot; rel=&quot;nofollow noreferrer&quot;&gt;Stateful firewalls&lt;/a&gt; keep state information.  So, port(s) are in fact opened for your response to reach you.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-22T03:11:04.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37516" PostTypeId="1" AcceptedAnswerId="38298" CreationDate="2016-12-22T07:50:00.870" Score="1" ViewCount="521" Body="&lt;p&gt;When calling cells in US sometimes our company number shows as blocked or restricted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our topology is &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CUCM 9.1 &amp;lt;-&gt; 2921 VG 15.2(4) &amp;lt;-&gt; T1 PRI&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our telco advised to make sure we have parameters assigned to our PBX:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order for caller ID number to be delivered to cell carriers these 3 calling parameters needs to be set in your PBX.&#xA;It may work sometimes w/o these parameters but the only way to GUARENTEE CID number delivery to cells is if the PBX has these 3 parameters populated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nature of address indicator ANSI: Unique national (significant) number&#xA;Numbering plan indicator: ISDN (Telephony) numbering plan (Recommendation E.164)&#xA;Screening indicator: Reserved for ‘User Provided, Passed Network Screening’&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;These are your current settings in your PBX.&#xA;&#xA;Calling party number parameter&#xA;Parameter name 10 Calling party number&#xA;Length indicator 7 $07&#xA;Odd even indicator 0 even&#xA;Nature of address indicator                            0&#xA;Spare 0 –&#xA;Numbering plan indicator                               0&#xA;Address presentation restricted indicator 0 presentation allowed&#xA;Screening indicator 1                                      user provided, screening passed&#xA;Address signals 618615098&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;debug isdn Q.931&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    375718: Dec 21 17:53:09.016: %IPPHONE-6-REGISTER_NEW: ephone-29:SEP2C3F38C838FF IP:10.1.102.11 Socket:15 DeviceType:Phone has registered.&#xA;375719: Dec 21 12:53:52.068: ISDN Se0/0/0:23 Q931: TX -&amp;gt; SETUP pd = 8 callref = 0x0B53&#xA;Bearer Capability i = 0x8090A2&#xA;Standard = CCITT&#xA;Transfer Capability = Speech&#xA;Transfer Mode = Circuit&#xA;Transfer Rate = 64 kbit/s&#xA;Channel ID i = 0xA98381&#xA;Exclusive, Channel 1&#xA;Calling Party Number i = 0x0081, '6176140715'&#xA;Plan:Unknown, Type:Unknown&#xA;Called Party Number i = 0x80, '17816084388'&#xA;Plan:Unknown, Type:Unknown&#xA;375720: Dec 21 12:53:52.392: ISDN Se0/0/0:23 Q931: RX &amp;lt;- CALL_PROC pd = 8 callref = 0x8B53&#xA;Channel ID i = 0xA98381&#xA;Exclusive, Channel 1&#xA;375721: Dec 21 12:53:53.360: ISDN Se0/0/0:23 Q931: RX &amp;lt;- ALERTING pd = 8 callref = 0x8B53&#xA;Progress Ind i = 0x8488 - In-band info or appropriate now available&#xA;375722: Dec 21 12:54:22.529: ISDN Se0/0/0:23 Q931: TX -&amp;gt; DISCONNECT pd = 8 callref = 0x0B53&#xA;Cause i = 0x8090 - Normal call clearing&#xA;375723: Dec 21 12:54:22.577: ISDN Se0/0/0:23 Q931: RX &amp;lt;- RELEASE pd = 8 callref = 0x8B53&#xA;375724: Dec 21 12:54:22.597: ISDN Se0/0/0:23 Q931: TX -&amp;gt; RELEASE_COMP pd = 8 callref = 0x0B53&#xA;375725: Dec 21 17:55:49.661: %IPPHONE-6-UNREGISTER_NORMAL: ephone-29:SEP2C3F38C838FF IP:10.1.102.11 Socket:15 DeviceType:Phone has unregistered normally.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Gateway is configured as MGCP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config&#xA;&#xA;interface Serial0/0/0:23&#xA;no ip address&#xA;encapsulation hdlc&#xA;isdn switch-type primary-ni&#xA;isdn incoming-voice voice&#xA;isdn map address ^011 plan unknown type unknown&#xA;isdn bind-l3 ccm-manager&#xA;no cdp enable&#xA;&#xA;ccm-manager fallback-mgcp &#xA;ccm-manager mgcp&#xA;no ccm-manager fax protocol cisco&#xA;ccm-manager music-on-hold&#xA;ccm-manager config server 10.10.10.10&#xA;ccm-manager config&#xA;!&#xA;&#xA;mgcp&#xA;mgcp call-agent 10.10.10.10 2427 service-type mgcp version 0.1&#xA;mgcp dtmf-relay voip codec all mode out-of-band&#xA;mgcp rtp unreachable timeout 1000 action notify&#xA;mgcp modem passthrough voip mode nse&#xA;mgcp package-capability rtp-package&#xA;mgcp package-capability sst-package&#xA;mgcp package-capability pre-package&#xA;mgcp default-package fxr-package&#xA;no mgcp package-capability res-package&#xA;no mgcp timer receive-rtcp&#xA;mgcp sdp simple&#xA;mgcp rtp payload-type g726r16 static&#xA;mgcp bind control source-interface GigabitEthernet0/0&#xA;mgcp bind media source-interface GigabitEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32792" LastEditorUserId="32792" LastEditDate="2016-12-22T07:55:34.720" LastActivityDate="2017-01-23T10:55:51.237" Title="Calls show as blocked or restricted on US cells" Tags="|cisco|cisco-ios|cisco-voip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37518" PostTypeId="2" ParentId="28962" CreationDate="2016-12-22T15:38:16.367" Score="0" Body="&lt;p&gt;Yes, different applications can bind to the same port on different transport protocols. They can also open the same port on the same protocol but different IP addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the packet works it's way up the processing chain various bits of information are looked at.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say a frame containing an IP packet containing a UDP datagram comes in on an Ethernet card.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First the host will look at the destination MAC address to see if it matches either it's own address or an appropriate broadcast or multicast address. This first level of checking is usually implemented in hardware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it will need to determine what type of Ethernet frame it is dealing with (for historical reasons there are several).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it will need to determine which network layer protocol to pass the frame to. For an &quot;Ethernet II&quot; frame (the most common type) this is determined by the &quot;ethertype&quot; field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming our frame represents an IP packet it will then need to determine whether it is destined for an IP address that belongs to the local machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming it is destined for the local machine then it will need to look at the protocol number and pass it up to the UDP implementation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally it will need to compare the IP addresses and ports against it's table of sockets to determine which socket to pass the datagram to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number of possible transport protocols under IP is limited by the size of the protocol field. Similarly the number of possible network layer protocols for an &quot;Ethernet II&quot; frame is limited by the range of usable Ethertype values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore using new transport protocols isn't a good way to get around port count limitations. Protocols other than TCP/UDP/ICMP will not be properly understood by many firewalls and NATs.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-12-22T16:00:39.413" LastActivityDate="2016-12-22T16:00:39.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37519" PostTypeId="1" AcceptedAnswerId="37520" CreationDate="2016-12-22T17:20:25.493" Score="3" ViewCount="157" Body="&lt;p&gt;While being on the same channel as another network is not ideal, is it better than being on a neighboring overlapping channel &lt;strong&gt;because 802.11 specification has methods for dealing with co-channel interference&lt;/strong&gt;?&lt;/p&gt;&#xA;&lt;p&gt;Or in other way, is it better to be in the non overlapping channels 1, 6, and 11 (besides they will be probably shared between many other networks) or choose some channel between them containing less networks?&lt;/p&gt;&#xA;&lt;p&gt;I am asking about the 2.4GHz ISM band.&lt;/p&gt;&#xA;" OwnerUserId="32985" LastEditorUserId="67636" LastEditDate="2021-05-21T09:56:05.663" LastActivityDate="2021-05-21T09:56:05.663" Title="In 802.11 Wi-Fi, Is it better to be on the same channel as other networks instead of being in an overlapping channel?" Tags="|wireless|ieee-802.11|bandwidth|ieee-802.1x|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="37520" PostTypeId="2" ParentId="37519" CreationDate="2016-12-22T17:39:42.757" Score="6" Body="&lt;p&gt;It is better to be in the same channel as your interfering signals (if you can't find a free channel) rather than in overlapping channels that are not the same channel - if you are in a nearby channel, there is interference, but no communication. On the same channel, the spec requires some cordination to share the channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often your best actual bet is to run more wire, and place your APs at lower power nearer your end use devices. Using the 5GHz band is also very helpful as there are more non-overlapping channels in most of the world, and it does not penetrate walls so well, keeping neighboring signals out of your space (or at least greatly reducing them.)&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-12-22T17:39:42.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37521" PostTypeId="2" ParentId="37494" CreationDate="2016-12-22T18:53:29.280" Score="0" Body="&lt;p&gt;The paradigm of a DMZ (as I've learned it) is &quot;consider all hosts in the DMZ as being hacked&quot;. The network protection by a firewall should ensure that even in this (&quot;worst&quot;) case the data on the internal network is safe from external access.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have to expose some of your data to the internet you publish it on a server in the DMZ. In a DMZ malicious attacks from outside directly hit the hosts whereas attacks against internal resources hit the firewall - and firewalls are designed and equipped to withhold attacks of various sorts, in contrast to multi-purpose servers (or operating systems).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following this line of thought you would implement one rule that data from the inside will always be pushed into the DMZ and never actively pulled from the DMZ. In case a DMZ server is compromised it cannot pull data or use services you have not intended or explicitly denied in the first place.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This has consequences though. For instance, a server might query an external time source which has to reside on the internet then. Or if the server needs to resolve internal names via DNS one would install a second DNS in the DMZ with a subset of the data.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding your questions:  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2&lt;br&gt;&#xA;Firewalls usually have multiple ports and control traffic between those ports with 'rules' or 'policies'. A DMZ would always be connected to a port of it's own, likewise the internal LAN and the WAN. So you have all means to allow certain services, to/from certain sources or destinations, at certain times etc. Everything not mentioned explicitly is denied. Today's firewalls will try to protect the servers and hosts behind it by various means like IPS or Application Control, that is, content inspection. They do more than just allow or deny traffic and route it, and are then called UTM firewalls or NGFW (next generation FW).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1&lt;br&gt;&#xA;From the above one would only allow pushing data onto the DMZ webserver and never allow access from it to internal resources.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case though I would not even consider to put sensitive data into the public. If HQ has data that a branch needs it should access the branch server via IPsec VPN. The data will be transfered in private, to authenticated partners and will be monitored for integrity.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2016-12-22T18:53:29.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37522" PostTypeId="1" AcceptedAnswerId="37524" CreationDate="2016-12-22T19:00:48.387" Score="2" ViewCount="12594" Body="&lt;p&gt;I'm trying to access a LAN through OpenVPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current setup is that I have one machine (Linux (old)) that can successfully connect to OpenVPN running on a pfSense (2.3.2) machine. Behind the pfSense machine is a LAN with a third machine attached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The subnet used for OpenVPN clients is &lt;code&gt;10.0.8.0/24&lt;/code&gt;. The client I'm testing with has the IP &lt;code&gt;10.0.8.3&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The subnet used for the LAN is &lt;code&gt;X.Y.Z.0/24&lt;/code&gt;. The machine that's on the LAN has the IP &lt;code&gt;X.Y.Z.12&lt;/code&gt;, and it can ping its gateway, &lt;code&gt;X.Y.Z.254&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I'd like the machine that's connected to pfSense over OpenVPN to be able to talk to the machine that's on the LAN. In the pfSense configuration for the OpenVPN server, there is an option &quot;IPv4 Local network(s)&quot;, which implies that the VPN clients should have access to the specified subnets. I put &lt;code&gt;X.Y.Z.0/24&lt;/code&gt; for that option. I also added a firewall rule that allows all traffic from hosts on &lt;code&gt;10.0.8.0/24&lt;/code&gt; to hosts on &lt;code&gt;X.Y.Z.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last bit of configuration I did is I manually added routing rules on the OpenVPN client, since they are not added successfully by the OpenVPN client (likely due to a version mismatch?). Following are the current (relevant) routing rules on the OpenVPN client:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ ip route&#xA;10.0.8.1 dev tun0  scope link&#xA;X.Y.Z.0/24 via 10.0.8.1 dev tun0&#xA;10.0.8.0/24 via 10.0.8.1 dev tun0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;10.0.8.1&lt;/code&gt; is the gateway that the OpenVPN connection command outputs on the client, although I am unable to ping it. When multiple OpenVPN clients are connected, they can ping each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pfSense can ping both the OpenVPN client and the machine on the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this configuration, I expect that trying to ping &lt;code&gt;X.Y.Z.12&lt;/code&gt; from my connected OpenVPN client should yield a response, but any attempt to connect fails. Trying &lt;code&gt;traceroute X.Y.Z.12&lt;/code&gt; outputs only stars.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect that either I need to tell pfSense how to route traffic between &lt;code&gt;10.0.8.0/24&lt;/code&gt; and &lt;code&gt;X.Y.Z.0/24&lt;/code&gt;, such as with a bridge or a NAT, or that my routing table is incorrect. It's possible that there's something obvious I'm missing since I'm not very familiar with networking stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there an error in my configuration, or is there an additional step I need to take to access the LAN from an OpenVPN client?&lt;/p&gt;&#xA;" OwnerUserId="32988" LastActivityDate="2016-12-22T20:06:48.640" Title="Access pfSense LAN through OpenVPN" Tags="|vpn|lan|pfsense|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37524" PostTypeId="2" ParentId="37522" CreationDate="2016-12-22T20:06:48.640" Score="3" Body="&lt;p&gt;You're going down the correct path, you need a route for your local LAN. But you need a route back from your LAN machine. At the moment it only has a default route of X.Y.Z.254 so sends all its traffic not on the local LAN here. Theres 2 options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Add a route on your gateway router, if its a half decent after-market router you should be able to add a route to 10.0.8.0/24 pointing at your pfsense box. So any traffic going there will be directed out the OpenVPN route.&lt;/li&gt;&#xA;&lt;li&gt;If you cant add the route then for every device you will need to add a static route to the VPN clients so it knows that subnet exists through the pfSense box.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;For Windows:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;route add 10.0.8.0 mask 255.255.255.0 X.Y.Z.pfsense -p&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;^^ replace the IP on your LAN with that of the pfsense box, the P flag is to permanently add it to the routing table&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Linux:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ip route add 10.0.8.0/24 via X.Y.Z.pfsense&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;^^to persistantly add it varies per Linux distro&lt;/p&gt;&#xA;" OwnerUserId="9981" LastActivityDate="2016-12-22T20:06:48.640" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37526" PostTypeId="2" ParentId="19831" CreationDate="2016-12-23T04:52:29.303" Score="0" Body="&lt;p&gt;A and B &lt;em&gt;should&lt;/em&gt; be able to communicate, &#xA;because both A's host portion and B's host portion &#xA;are within the subnets of each, where the original post showed A with a /24 and B with a /30...while C had a /29.&#xA;C cannot talk to B, since the C host's. 3 would be a broadcast address (not a valid host) in B's subnet masking. &#xA;Basically, based on non-overlapping valid host bits:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A and B could talk&lt;/li&gt;&#xA;&lt;li&gt;A and C could talk&lt;/li&gt;&#xA;&lt;li&gt;B and C cannot talk, because C's. 3 is a broadcast address in B's subnet 0, where .1 and .2 are valid hosts,&#xA;but .3 is a broadcast address in B's subnet 0, where .4 is its next subnet---which has only. 5 and .6 as valid hosts, with .7 as the broadcast address, and with .8 as the next 'block' or subnet. I have basically the same question as goofology, and would like to know definitively if A and B could talk as they are.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32994" LastActivityDate="2016-12-23T04:52:29.303" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37527" PostTypeId="1" AcceptedAnswerId="37532" CreationDate="2016-12-23T09:27:48.593" Score="3" ViewCount="2772" Body="&lt;p&gt;So, I was reading about the L2TP protocol and I understand what it basically does. But I fail to see why it would be preferred over pure IPSEC(VPN). VPN already provides end-to-end encryption between the gateway and my PC then why would I add more headers to the encapsulated packet and increase my bandwidth? Even if I am connecting one enterprise network located in two locations, can't we still do it via a pure VPN connection?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I am missing something very basic here. Can someone point it out! Thanks a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-koundi&lt;/p&gt;&#xA;" OwnerUserId="32995" LastActivityDate="2016-12-23T12:28:53.673" Title="L2tp/IPSEC vs pure IPSEC" Tags="|ipsec|l2tp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37528" PostTypeId="1" AcceptedAnswerId="37540" CreationDate="2016-12-23T09:46:41.837" Score="1" ViewCount="1459" Body="&lt;p&gt;I have built a topology in GNS3 with five routers with a goal to perform:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1)inter vrf routing with bgp as the routing Protocol between Routers.&#xA;2)build DMVPN tunnel on the top of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was successful in the 1st task but stuck with the second one. I have one DMVPN router which is spoke, one R1 which is Hub and a WAN between them. DMVPN router seem to be generating nhrp registration requests but the hub is not receiving the nhrp registration requests. but underlay routing seems to be fine because i can ping from one Router's Public IP to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am attaching the configs of all the Routers in comments and also the Topology I am working on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been stuck on this thing from the past two days. Any help would be appreciated&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You in advance!&#xA;&lt;a href=&quot;https://i.stack.imgur.com/q0iby.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/q0iby.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DMVPN Config&#xA;&#xA;DMVPN#sh run  &#xA;Building configuration...  &#xA;Current configuration : 2393 bytes  &#xA;!  &#xA;version 15.2  &#xA;service timestamps debug datetime msec  &#xA;service timestamps log datetime msec  &#xA;!  &#xA;hostname DMVPN  &#xA;!  &#xA;boot-start-marker  &#xA;boot-end-marker  &#xA;!  &#xA;!  &#xA;!  &#xA;no aaa new-model  &#xA;no ip icmp rate-limit unreachable    &#xA;ip cef  &#xA;!  &#xA;ip vrf spoke1  &#xA; rd 65000:1  &#xA;!    &#xA;no ip domain lookup    &#xA;no ipv6 cef    &#xA;!  &#xA;!  &#xA;multilink bundle-name authenticated  &#xA;!&#xA;!  &#xA;!  &#xA;!  &#xA;ip tcp synwait-time 5  &#xA;!  &#xA;&#xA;!  &#xA;!  &#xA;!  &#xA;!  &#xA;interface Loopback0  &#xA; ip address 1.1.1.1 255.255.255.255  &#xA;!  &#xA;interface Tunnel0  &#xA; ip vrf forwarding spoke1  &#xA; ip address 192.168.1.1 255.255.255.0  &#xA; no ip redirects  &#xA; ip nhrp authentication DMVPN  &#xA; ip nhrp map multicast 50.50.21.2  &#xA; ip nhrp map 192.168.1.2 50.50.21.2  &#xA; ip nhrp network-id 1  &#xA; ip nhrp nhs 192.168.1.2  &#xA; tunnel source FastEthernet0/0  &#xA; tunnel mode gre multipoint  &#xA;!  &#xA;interface FastEthernet0/0  &#xA; ip vrf forwarding spoke1  &#xA; ip address 50.50.1.2 255.255.255.0  &#xA; duplex full  &#xA;!  &#xA;interface FastEthernet1/0  &#xA; no ip address  &#xA; speed auto  &#xA; duplex auto  &#xA;!  &#xA;interface FastEthernet1/1  &#xA; no ip address  &#xA; shutdown  &#xA; speed auto  &#xA; duplex auto  &#xA;!  &#xA;interface FastEthernet2/0  &#xA; ip vrf forwarding spoke1  &#xA; ip address 172.16.1.10 255.255.255.0 &#xA; speed auto  &#xA; duplex auto  &#xA;!  &#xA;!  &#xA;!  &#xA;router bgp 5000  &#xA; bgp log-neighbor-changes  &#xA; !  &#xA; address-family ipv4 vrf spoke1  &#xA;  network 172.16.1.0 mask 255.255.255.0  &#xA;  neighbor 50.50.1.1 remote-as 5001  &#xA;  neighbor 50.50.1.1 activate  &#xA; exit-address-family  &#xA;!  &#xA;!  &#xA;ip forward-protocol nd   &#xA;!  &#xA;!  &#xA;no ip http server  &#xA;no ip http secure-server  &#xA;!  &#xA;!  &#xA;!  &#xA;!  &#xA;control-plane  &#xA;! &#xA;line con 0  &#xA; exec-timeout 0 0  &#xA; privilege level 15  &#xA; logging synchronous  &#xA; stopbits 1  &#xA;line aux 0  &#xA; exec-timeout 0 0  &#xA; privilege level 15  &#xA; logging synchronous  &#xA; stopbits 1  &#xA;line vty 0 4  &#xA; login  &#xA;!  &#xA;!  &#xA;end  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 config: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh run  &#xA;Building configuration...  &#xA;&#xA;Current configuration : 2234 bytes &#xA;!  &#xA;version 15.2  &#xA;service timestamps debug datetime msec  &#xA;service timestamps log datetime msec  &#xA;!  &#xA;hostname R1  &#xA;! &#xA;boot-start-marker  &#xA;boot-end-marker  &#xA;!  &#xA;!  &#xA;! &#xA;no aaa new-model &#xA;no ip icmp rate-limit unreachable  &#xA;ip cef &#xA;! &#xA;ip vrf hub &#xA; rd 65000:2 &#xA;!&#xA;!  &#xA;!  &#xA;!  &#xA;!  &#xA;!  &#xA;no ip domain lookup  &#xA;no ipv6 cef  &#xA;!  &#xA;!  &#xA;multilink bundle-name authenticated  &#xA;!&#xA;!  &#xA;!  &#xA;ip tcp synwait-time 5  &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!  &#xA;!  &#xA;!  &#xA;!  &#xA;!  &#xA;!  &#xA;!  &#xA;!  &#xA;interface Loopback1  &#xA; ip address 5.5.5.5 255.255.255.255  &#xA;!  &#xA;interface Tunnel0  &#xA; ip vrf forwarding hub  &#xA; ip address 192.168.1.2 255.255.255.0  &#xA; no ip redirects  &#xA; ip nhrp authentication DMVPN  &#xA; ip nhrp map multicast dynamic  &#xA; ip nhrp network-id 1  &#xA; tunnel source FastEthernet1/0  &#xA; tunnel mode gre multipoint  &#xA;!  &#xA;interface FastEthernet1/0  &#xA; ip vrf forwarding hub  &#xA; ip address 50.50.21.2 255.255.255.0  &#xA; speed auto  &#xA; duplex auto  &#xA;!  &#xA;interface FastEthernet1/1  &#xA; ip vrf forwarding hub  &#xA; ip address 172.16.21.10 255.255.255.0  &#xA; speed auto  &#xA; duplex auto  &#xA;!  &#xA;!  &#xA;!  &#xA;router bgp 5002  &#xA; bgp log-neighbor-changes  &#xA; ! &#xA; address-family ipv4 vrf hub  &#xA;  bgp router-id 3.3.3.3  &#xA;  network 172.16.21.0 mask 255.255.255.0  &#xA;  neighbor 50.50.21.1 remote-as 5001  &#xA;  neighbor 50.50.21.1 activate  &#xA; exit-address-family  &#xA;!  &#xA;!  &#xA;ip forward-protocol nd  &#xA;!  &#xA;!  &#xA;no ip http server  &#xA;no ip http secure-server  &#xA;!  &#xA;!  &#xA;!  &#xA;!  &#xA;control-plane  &#xA;! &#xA;line con 0  &#xA; exec-timeout 0 0  &#xA; privilege level 15  &#xA; logging synchronous  &#xA; stopbits 1  &#xA;line aux 0  &#xA; exec-timeout 0 0  &#xA; privilege level 15  &#xA; logging synchronous  &#xA; stopbits 1  &#xA;line vty 0 4  &#xA; login  &#xA;!  &#xA;!  &#xA;end &#xA;&#xA;&#xA;&#xA;&#xA;WAN#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 2431 bytes&#xA;!&#xA;version 15.2&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;!&#xA;hostname WAN&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;ip vrf hub&#xA; rd 65000:2&#xA; route-target export 65000:2&#xA; route-target import 65000:1&#xA;!&#xA;ip vrf spoke1&#xA; rd 65000:1&#xA; route-target export 65000:1&#xA; route-target import 65000:2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 2.2.2.2 255.255.255.255&#xA;!&#xA;interface Loopback1&#xA; ip vrf forwarding spoke1&#xA; ip address 4.4.4.4 255.255.255.255&#xA; shutdown&#xA;!&#xA;interface Loopback2&#xA; ip vrf forwarding hub&#xA; ip address 5.5.5.5 255.255.255.255&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/0&#xA; ip vrf forwarding spoke1&#xA; ip address 50.50.1.1 255.255.255.0&#xA; duplex full&#xA;!&#xA;interface FastEthernet1/0&#xA; ip vrf forwarding hub&#xA; ip address 50.50.21.1 255.255.255.0&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet1/1&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet2/1&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface Serial3/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface FastEthernet4/0&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet4/1&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface GigabitEthernet5/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet6/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;router bgp 5001&#xA; bgp log-neighbor-changes&#xA; !&#xA; address-family ipv4 vrf hub&#xA;  redistribute connected&#xA;  neighbor 50.50.21.2 remote-as 5002&#xA;  neighbor 50.50.21.2 activate&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf spoke1&#xA;  redistribute connected&#xA;  neighbor 50.50.1.2 remote-as 5000&#xA;  neighbor 50.50.1.2 activate&#xA; exit-address-family&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;WAN Config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WAN#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 2431 bytes&#xA;!&#xA;version 15.2&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;!&#xA;hostname WAN&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;ip cef&#xA;!&#xA;ip vrf hub&#xA; rd 65000:2&#xA; route-target export 65000:2&#xA; route-target import 65000:1&#xA;!&#xA;ip vrf spoke1&#xA; rd 65000:1&#xA; route-target export 65000:1&#xA; route-target import 65000:2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 2.2.2.2 255.255.255.255&#xA;!&#xA;interface Loopback1&#xA; ip vrf forwarding spoke1&#xA; ip address 4.4.4.4 255.255.255.255&#xA; shutdown&#xA;!&#xA;interface Loopback2&#xA; ip vrf forwarding hub&#xA; ip address 5.5.5.5 255.255.255.255&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/0&#xA; ip vrf forwarding spoke1&#xA; ip address 50.50.1.1 255.255.255.0&#xA; duplex full&#xA;!&#xA;interface FastEthernet1/0&#xA; ip vrf forwarding hub&#xA; ip address 50.50.21.1 255.255.255.0&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet1/1&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet2/1&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface Serial3/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial3/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface FastEthernet4/0&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet4/1&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface GigabitEthernet5/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet6/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;router bgp 5001&#xA; bgp log-neighbor-changes&#xA; !&#xA; address-family ipv4 vrf hub&#xA;  redistribute connected&#xA;  neighbor 50.50.21.2 remote-as 5002&#xA;  neighbor 50.50.21.2 activate&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf spoke1&#xA;  redistribute connected&#xA;  neighbor 50.50.1.2 remote-as 5000&#xA;  neighbor 50.50.1.2 activate&#xA; exit-address-family&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32997" LastEditorUserId="32997" LastEditDate="2016-12-23T16:28:19.707" LastActivityDate="2016-12-23T16:30:12.423" Title="DMVPN Tunnel Spoke sending registration requests but Hub does not get it" Tags="|cisco|routing|bgp|troubleshooting|vrf-lite|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37529" PostTypeId="1" AcceptedAnswerId="37539" CreationDate="2016-12-23T09:49:44.837" Score="3" ViewCount="2902" Body="&lt;p&gt;Can we run OSPFv2 on few interfaces and OSPFv3 on few interfaces within the same system? Can we run both OSPF v2 and v3 as different processes?&lt;/p&gt;&#xA;" OwnerUserId="22270" LastEditorUserId="8499" LastEditDate="2016-12-23T18:23:20.020" LastActivityDate="2016-12-23T18:23:20.020" Title="Can OSPF v2 and v3 coexist in the same router?" Tags="|cisco|routing|ospf|network-core|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37531" PostTypeId="2" ParentId="37529" CreationDate="2016-12-23T12:22:25.297" Score="3" Body="&lt;p&gt;Yes, OSPFv2 and v3 are completely different and independent protocols.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-23T12:22:25.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37532" PostTypeId="2" ParentId="37527" CreationDate="2016-12-23T12:28:53.673" Score="3" Body="&lt;p&gt;The &lt;a href=&quot;https://security.stackexchange.com/questions/144528/why-use-l2tp-ipsec-insted-of-just-ipsec/144533#144533&quot;&gt;same question was asked on the Information Security SE&lt;/a&gt;.  Here's my answer to that question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;L2TP/IPSec uses IPsec to protect the L2TP tunnel. So the real question&#xA;  is, why use L2TP?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Layer two tunneling protocol, as the name implies, provides a layer 2&#xA;  link over an arbitrary L3 network. So, for example, if you needed to&#xA;  have a single VLAN appear in two locations (two data centers, for&#xA;  example), you can use L2TP to connect them together and appear as one&#xA;  logical VLAN/subnet, even though there is an arbitrary L3 network&#xA;  between them (like the Internet). Since you probably don't want your&#xA;  data center traffic traversing the Internet unprotected, you use IPSec&#xA;  to keep your traffic confidential.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="-1" LastEditDate="2017-03-17T10:46:10.953" LastActivityDate="2016-12-23T12:28:53.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37533" PostTypeId="2" ParentId="37529" CreationDate="2016-12-23T12:45:36.797" Score="3" Body="&lt;p&gt;As long as they are defiened on that router, so sure we can run OspfV2 on few interfaces and OspfV3 on few interfaces within the same system.&lt;/p&gt;&#xA;" OwnerUserId="31857" LastActivityDate="2016-12-23T12:45:36.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37539" PostTypeId="2" ParentId="37529" CreationDate="2016-12-23T16:16:27.233" Score="3" Body="&lt;p&gt;Sure, this is possible, depending on the router model and software. OSPFv2 is for IPv4 only and OSPFv3 for both IPv4 and IPv6. There are however differences in the implementation of both protocols (as these are two completely independent protocols), depending on the vendor and sometimes even on the model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider Cisco for example: In regular IOS and IOS-XE, you can run both protocols at the same time, even for IPv4. Note however, when running both OSPFv2 and OSPFv3 for IPv4, routes learned via OSPFv2 will always take precedence, ignoring &quot;normal&quot; OSPF route selection rules, which are only evaluated within a process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On IOS-XR, for example, OSPFv3 is not even supported for AF IPv4, only for IPv6.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-12-23T16:16:27.233" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37540" PostTypeId="2" ParentId="37528" CreationDate="2016-12-23T16:30:12.423" Score="1" Body="&lt;p&gt;You are running DMVPN on a VRF enabled device. Both your public interface (used as tunnel source) and your tunnel endpoint is VRF enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To have the tunnel endpoint in a VRF, you need to enable VRF forwarding on the tunnel interface, which you have done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To have the tunnel source in a VRF (called frontdoor VRF), you need two things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The tunnel source interface needs to have VRF forwarding enabled&lt;/li&gt;&#xA;&lt;li&gt;You need &lt;code&gt;tunnel vrf spoke1&lt;/code&gt; under the tunnel, to instruct the tunnel to use the specified VRF&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;On R1 and DMVPN, add the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;int tun 0&#xA;   tunnel vrf spoke1&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can get additional information on frontdoor VRFs for example on &lt;a href=&quot;http://www.networkingwithfish.com/tunnels-and-the-use-of-front-door-vrfs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog post&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-12-23T16:30:12.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37541" PostTypeId="2" ParentId="37242" CreationDate="2016-12-23T16:51:21.587" Score="0" Body="&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;object-group service DM_INLINE_SERVICE_1&#xA; service-object udp destination eq 4444 &#xA;object network openNW-udp&#xA; nat (inside,outside) static interface service udp 4444 4444&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerDisplayName="user10221" LastActivityDate="2016-12-23T16:51:21.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37542" PostTypeId="1" CreationDate="2016-12-23T19:25:06.717" Score="1" ViewCount="1839" Body="&lt;p&gt;In Packet Tracer 7.0:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After directly connecting two switches or a router and switch, pinging the neighboring device always fails on the first one or 2 attempts (i.e. only 4/5 or 3/5 ping attempts are successful.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/rHqJ8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rHqJ8.png&quot; alt=&quot;screenshot-icmp&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this an artifact of the PT simulation or is this an expected behavior on a &quot;new&quot; network whose hosts have never communicated with the switch before (ARP resolution?)&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="8499" LastEditDate="2018-12-25T03:16:25.470" LastActivityDate="2018-12-25T03:16:25.470" Title="Initial ping failure in Packet Tracer" Tags="|cisco|ping|packet-tracer|icmp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37543" PostTypeId="1" AcceptedAnswerId="37544" CreationDate="2016-12-23T17:05:38.097" Score="0" ViewCount="459" Body="&lt;p&gt;If I install 20meters of ethernet unshielded utp wire (rj-45) together with a phone twisted pair wire (rj-11), one touching the other, will create interferences between them?&lt;/p&gt;&#xA;" OwnerDisplayName="Alejandro Martin" LastActivityDate="2016-12-23T19:39:43.940" Title="Could ethernet wire interfere with phone wire?" Tags="|ethernet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37544" PostTypeId="2" ParentId="37543" CreationDate="2016-12-23T17:07:38.387" Score="3" Body="&lt;p&gt;No, it is extremely unlikely. This is done everywhere. It is very common to use the &quot;unused&quot; pairs in typical 10-Base T ethernet connections for either traditional analog or even digital phone service. The construction of &quot;category&quot; ethernet cable has precision twisting of the four pairs exactly to minimize any crosstalk between the ethernet and the telephone signals.&lt;/p&gt;&#xA;" OwnerDisplayName="Richard Crowley" LastActivityDate="2016-12-23T17:07:38.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37545" PostTypeId="2" ParentId="37543" CreationDate="2016-12-23T19:39:43.940" Score="1" Body="&lt;p&gt;Shouldn't be a problem generally speaking.  The ethernet carries digital signals on the wires and the two-pair POTS wires carry analog signals.  If crosstalk or other interference did occur I think it would most likely be during ringing of the phone, when current was being drawn through the wire to ring the phone(s).&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2016-12-23T19:39:43.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37547" PostTypeId="2" ParentId="37542" CreationDate="2016-12-23T21:29:58.073" Score="1" Body="&lt;p&gt;This actually happens in the real world, too. On ethernet, and other protocols that use MAC addresses, it is due to ARP. You will drop one or two initial pings. It can happen, too, with frame relay, depending on how you have it configured.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-23T21:29:58.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37548" PostTypeId="2" ParentId="37516" CreationDate="2016-12-24T00:37:06.790" Score="0" Body="&lt;p&gt;There's 2 distinct parameters: calling number and calling name.  They are not the same.  Some PSTN providers allow you to set one or both of these to whatever you want, others will not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Passing calling number should be trivial.  There is a mask field in CM, as I recall.  Don't mask outbound calls.  Put &quot;XXXX&quot; in there rather than the main number.  Note this setting may appear in the line configuration page and the route pattern page.  ...It's been a while.  Should be easy though.  Just remember, your provider may not allow you to spoof / provide other numbers than your DID range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as passing name goes, I believe your PSTN provider sets that for you and you would need to coordinate with them if you want something other than &quot;&quot; to show up for particular DID's.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2016-12-24T00:37:06.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37549" PostTypeId="2" ParentId="36798" CreationDate="2016-12-24T03:32:45.283" Score="0" Body="&lt;p&gt;You'd probably have to do the later.  You'd need access to the underlying OS.  Since the way it operates I don't believe you actually need VMWare tools.  There isn't really any advantage to install it either.  If you need 10GB nics, look at VMware vsphere 6.0 and above.  10GB support is built in.&lt;/p&gt;&#xA;" OwnerUserId="33007" LastActivityDate="2016-12-24T03:32:45.283" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37552" PostTypeId="1" CreationDate="2016-12-24T05:28:36.190" Score="2" ViewCount="1393" Body="&lt;p&gt;I would like to monitor all traffic that passes between devices connected to a switch (no particular switch make or model - I would need to do this for many types of switches encountered on many different networks.) I originally intended to configure the switch to mirror traffic on all ports to the SPAN port, which is then connected to my monitoring device. However, I recall hearing that switches sometimes have load issues when asked to mirror many ports at once. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a genuine concern that could prevent this from working? If so, is there any alternative method I could employ to accomplish this? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="33010" LastActivityDate="2017-05-24T07:56:41.803" Title="Switch SPAN Port Overload" Tags="|switch|switching|packet-analysis|mirror|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37553" PostTypeId="2" ParentId="37552" CreationDate="2016-12-24T06:14:40.337" Score="0" Body="&lt;p&gt;If the aggregate bandwidth of the traffic from all the other switch interfaces exceeds the bandwidth of the monitor interface, you will not be able to capture all the traffic, some will need to be dropped, and you will not have any control over what gets dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if you have a switch with twenty-four 1 Gbps access interfaces, you will likely lose some traffic (maybe more than half), even with a 10 Gbps monitor interface, but you will lose a lot of traffic if you only have a 1 Gbps monitor interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SPAN is really designed to be used for network troubleshooting. Configure it when you have a problem, and remove it when you have fixed the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are simply looking to analyse traffic statistics, many enterprise-grade network devices support NetFlow, or one of its variants. You can set up a NetFlow collector, and use software to create reports. The NetFlow collector doesn't even need to be on the same switch or even network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-24T06:14:40.337" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37555" PostTypeId="1" CreationDate="2016-12-24T13:02:57.500" Score="1" ViewCount="85" Body="&lt;p&gt;I have two WS-C3560E-48PD switches in the same organisation. How can I know which ports are utilized on the switches, and PC, phones, and printers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there are some command used to know above issue?&lt;/p&gt;&#xA;" OwnerUserId="29568" LastEditorUserId="8499" LastEditDate="2016-12-24T18:53:55.030" LastActivityDate="2017-01-25T09:39:18.013" Title="Utilization of ports on switch" Tags="|switch|switching|switchport|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37556" PostTypeId="1" AcceptedAnswerId="37587" CreationDate="2016-12-24T15:30:28.133" Score="1" ViewCount="1299" Body="&lt;p&gt;The problem is:&#xA;I can not find a QinQ(a.k.a. double vlan tagging or dot1q tunnel) feature in the following cisco switch:&#xA;WS-C4510R+E, SUP8-E with WS-X4748-UPOE+E line card installed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco Feature Navigator says it should be in my platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty new at the IOS-XE, the only IOS supported by this HW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've upgraded ios-xe to the:&#xA;cat4500es8-universalk9.SPA.03.08.01.E.152-4.E1.bin&#xA;And also I've tried:&#xA;cat4500es8-universal.SPA.03.03.00.XO.151-1.XO.bin&#xA;cat4500es8-universalk9.SPA.03.09.01.E.152-5.E1.bin&#xA;No luck. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;May be I have some license or feature enable(mechanism) in IOS-XE Problem.&#xA;My current license looks like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show license all &#xA;License Store: Primary License Storage&#xA;License Store: Dynamic License Storage&#xA;StoreIndex: 0 Feature: entservices  Version: 1.0&#xA;      License Type: Evaluation&#xA;        Evaluation total period: 8 weeks 4 days &#xA;        Evaluation period left: 8 weeks 3 days &#xA;      License State: Inactive&#xA;      License Count: Non-Counted&#xA;      License Priority: Low&#xA;StoreIndex: 1 Feature: entservices  Version: 1.0&#xA;      License Type: PermanentRightToUse&#xA;      License State: Active, Not in Use, EULA accepted&#xA;      License Count: Non-Counted&#xA;StoreIndex: 2 Feature: ipbase  Version: 1.0&#xA;      License Type: Evaluation&#xA;        Evaluation total period: 8 weeks 4 days &#xA;        Evaluation period left: 8 weeks 4 days &#xA;      License State: Inactive&#xA;      License Count: Non-Counted&#xA;      License Priority: None&#xA;StoreIndex: 3 Feature: ipbase  Version: 1.0&#xA;      License Type: PermanentRightToUse&#xA;      License State: Active, Not in Use, EULA accepted&#xA;      License Count: Non-Counted&#xA;StoreIndex: 4 Feature: lanbase  Version: 1.0&#xA;      License Type: PermanentRightToUse&#xA;      License State: Active, Not in Use, EULA accepted&#xA;      License Count: Non-Counted&#xA;StoreIndex: 5 Feature: apcount  Version: 1.0&#xA;      License Type: Evaluation&#xA;        Evaluation total period: 8 weeks 4 days &#xA;        Evaluation period left: 8 weeks 4 days &#xA;      License State: Active, Not in Use, EULA not accepted&#xA;      License Count: 0/0&#xA;      License Priority: None&#xA;StoreIndex: 6 Feature: apcount  Version: 1.0&#xA;      License Type: PermanentRightToUse&#xA;      License State: Inactive&#xA;      License Count: 0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I haven't find the sdm template command there also.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show dot1? &#xA;dot1x  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;First of all i've tried to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure terminal&#xA;    int gi 1/1&#xA;    (config-if)#swi mode ?&#xA;          access        Set trunking mode to ACCESS unconditionally&#xA;          dynamic       Set trunking mode to dynamically negotiate access or trunk mode&#xA;          private-vlan  Set private-vlan mode&#xA;          trunk         Set trunking mode to TRUNK unconditionally&#xA;    (config-if)#int te 5/5&#xA;    (config-if)#swi mode ?&#xA;          access        Set trunking mode to ACCESS unconditionally&#xA;          dynamic       Set trunking mode to dynamically negotiate access or trunk mode&#xA;          private-vlan  Set private-vlan mode&#xA;          trunk         Set trunking mode to TRUNK unconditionally&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And nothing about:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode dot1q-tunnel&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and even&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show dot1q?&#xA;% Unrecognized command&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Because I'm not setting up QinQ in the first time. I've checked at Cisco Feature Navigator to be sure my IOS-XE supported it. Yes cat4500es8-universalk9.SPA.03.08.01.E.152-4.E1.bin supports QinQ and even Selective QinQ. I've tried to configure QinQ at line-card and SUP8-E - no such command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    (config)#default int te5/5&#xA;    Interface TenGigabitEthernet5/5 set to default configuration&#xA;    (config)#int te 5/5&#xA;    (config-if)#switchport &#xA;    (config-if)#switchport mode access &#xA;    (config-if)#switchport access vlan 10&#xA;    (config-if)#switchport nonegotiate &#xA;    (config-if)#switchport mode ?&#xA;          access        Set trunking mode to ACCESS unconditionally&#xA;          dynamic       Set trunking mode to dynamically negotiate access or trunk mode&#xA;          private-vlan  Set private-vlan mode&#xA;          trunk         Set trunking mode to TRUNK unconditionally&#xA;&#xA;&#xA;&#xA;    (config)#default int te5/5&#xA;    Interface TenGigabitEthernet5/5 set to default configuration&#xA;    (config)#int te 5/5&#xA;    (config-if)#switchport &#xA;    (config-if)#switchport mode access &#xA;    (config-if)#switchport access vlan 10&#xA;    (config-if)#switchport nonegotiate &#xA;    (config-if)#switchport mode ?&#xA;          access        Set trunking mode to ACCESS unconditionally&#xA;          dynamic       Set trunking mode to dynamically negotiate access or trunk mode&#xA;          private-vlan  Set private-vlan mode&#xA;          trunk         Set trunking mode to TRUNK unconditionally&#xA;    (config-if)#switchport vl?&#xA;          % Unrecognized command&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think the main problem is Inactive ent license:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;StoreIndex: 0 Feature: entservices  Version: 1.0&#xA;      License Type: Evaluation&#xA;        Evaluation total period: 8 weeks 4 days &#xA;        Evaluation period left: 8 weeks 3 days &#xA;      License State: Inactive&#xA;      License Count: Non-Counted&#xA;      License Priority: Low&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33015" LastEditorUserId="33015" LastEditDate="2016-12-25T12:57:39.887" LastActivityDate="2016-12-26T09:44:16.593" Title="Cisco, No dot1q tunnel mode on switchport" Tags="|cisco-catalyst|tunnel|qinq|switchport|" AnswerCount="1" CommentCount="18" ContentLicense="CC BY-SA 3.0" />
  <row Id="37557" PostTypeId="2" ParentId="37555" CreationDate="2016-12-24T15:38:27.340" Score="0" Body="&lt;p&gt;First of all, which ports type you are trying to monitor? Physical, SVI's or other? &#xA;Best way to do that in a long-term perspective is setup the SNMP credentials on a switch and add it to the monitoring system to collect the information that you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fast way to see some information from switch cli is:&#xA;show int fa1/1 or gi1/1 (See the 5 minute utilization and input/output packets. Queue analysis can help also)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do you mean about PC/Phones/Printers? Do you what to know where they connected or you want to discover that? If you know the exact ports, you may use the same commands as said.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following command could be helpful for you: &lt;code&gt;show int | i FastEthernet|packets input|packets output|queue&lt;/code&gt; Change FastEthernet for your type of Ethernet if you don't see anything. &lt;/p&gt;&#xA;" OwnerUserId="33015" LastEditorUserId="33015" LastEditDate="2016-12-26T07:49:01.027" LastActivityDate="2016-12-26T07:49:01.027" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37561" PostTypeId="2" ParentId="37555" CreationDate="2016-12-24T18:57:12.737" Score="1" Body="&lt;p&gt;Depending on what you really mean, you could use the &lt;code&gt;show mac-address-table&lt;/code&gt; command to see the MAC address table on a switch. This will give you the MAC addresses and the interfaces on which traffic from those MAC addresses was seen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A MAC address for a device will tell you the OUI (manufacturer) of the ethernet interface of the device.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-24T18:57:12.737" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37564" PostTypeId="1" CreationDate="2016-12-25T01:22:26.523" Score="1" ViewCount="830" Body="&lt;p&gt;I've been reading about FIB and tried to understand the design,&#xA;I read that FIB and RIB have one-to-one correlation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.What does it mean they have one-to-one correlation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.In my understanding - most routers have flat FIB, why is that? for example, why wouldn't one prefer having a hierarchical FIB ? In a paper I've read, having a hierarchical FIB reduces the table size and improves performance&lt;/p&gt;&#xA;" OwnerUserId="33022" LastActivityDate="2016-12-28T20:35:18.807" Title="Flat vs Hierarchical FIB" Tags="|ip-forwarding-table|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37566" PostTypeId="2" ParentId="23317" CreationDate="2016-12-25T05:26:33.060" Score="0" Body="&lt;p&gt;Your timeout formula is not correct. It should be&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;timeout = EstimatedRTT + 4* DevRTT&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample RTT is the RTT which is given in the question i.e. &lt;code&gt;330&lt;/code&gt; , &lt;code&gt;400&lt;/code&gt;, &lt;code&gt;320&lt;/code&gt; for each iteration&#xA;and estimatedRTT is previously estimatedRTT&lt;/p&gt;&#xA;" OwnerUserId="33024" LastActivityDate="2016-12-25T05:26:33.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37567" PostTypeId="2" ParentId="37552" CreationDate="2016-12-25T05:36:49.093" Score="2" Body="&lt;p&gt;So a few points to this-&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;SPAN is actually Cisco-specific terminology.  The generic is just called port mirroring.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There is huge variability in terms of the behavior of port mirroring implementations across different hardware.  As an example - in a surprising number of platforms (across different vendors) oversubscribing the amount of traffic being mirrored to a given port can actually cause packet loss on otherwise undersubscribed ports. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Keep in mind that mirrored traffic often won't include packets with errors (..they get dropped at ingress on most switches) and that there's also no guarantee that packets will be delivered in order or that duplication will always be suppressed.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;There are also limits as to the number of mirroring sessions, the number of ports/VLAN's being mirrored and whether the sources are monitored bidirectionally (ex: some switches might allow mirroring input from all 24 ports on a switch not input+output).  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So - depending on the switch platform in use there are a bunch of things that can be used to control load and otherwise make the problem a lot more approachable.  As Ron mentions, something like Netflow or sFlow can be a great way to go but won't provide a packet-by-packet level of analysis or allow diving into packet payloads.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being careful with the application of mirroring through the use of ACL's can explicitly exclude/include traffic based on the problem being solved.  Some platforms also allow for the truncation of mirrored packets, which can also vastly reduce the sheer volume of information being managed.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another interesting approach is the use of ACL's to copy/redirect interesting traffic on an in-line basis.  This is very different from port mirroring and ends up looking a lot more like policy routing but, again, like much of the above is incredibly hardware dependent.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also item like in-line taps that can physically copy the traffic on a given link to your analyzer.  This is almost invariably a better solution to a permanent requirement for full traffic visibility but is obviously a lot more expensive and a lot less flexible.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of actual use I tend to see larger organizations focusing first on natural choke points - switch uplinks, routers, firewalls, etc and then adding a capability to look at edge ports on an as-needed basis.  Obviously use-cases vary but the sheer volume of data that can be generated can be overwhelming.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2016-12-25T05:36:49.093" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37568" PostTypeId="1" CreationDate="2016-12-25T14:56:32.897" Score="1" ViewCount="433" Body="&lt;p&gt;Many WiFi-routers have the feature to block LAN connections.&lt;br&gt;&#xA;A router is configured to block traffic for private IP addresses 10.x.x.x, 172.16.x.x, 192.168.x.x except few like 10.0.0.1. Internet access is available for all computer on the network.&#xA;The packet will be terminated at router if the target address is one of those and packet is originating from IP address in the list.&lt;br&gt;&#xA;Is it possible to communicate to those blocked IP addresses by sending packets to the public IP and then to the internal IP by using Network address translation?&lt;br&gt;&#xA;The router will send the packet to the public IP router. Then the public IP router will send it to the internal address. The blocking conditions are not meet.&lt;br&gt;&#xA;Is this a valid bypass?&lt;/p&gt;&#xA;" OwnerUserId="33026" LastActivityDate="2016-12-25T15:45:48.840" Title="Re-routing packets to private ip through public ip?" Tags="|router|nat|lan|" AnswerCount="1" CommentCount="0" ClosedDate="2016-12-25T17:36:37.697" ContentLicense="CC BY-SA 3.0" />
  <row Id="37569" PostTypeId="2" ParentId="37568" CreationDate="2016-12-25T15:45:48.840" Score="1" Body="&lt;p&gt;If you are talking about home routers, which are off topic here, they don't block private IPs, they block client to client traffic. But that is usually configurable-- you can turn that feature off. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-25T15:45:48.840" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37571" PostTypeId="1" AcceptedAnswerId="37573" CreationDate="2016-12-25T17:11:56.960" Score="4" ViewCount="3127" Body="&lt;p&gt;If a device wants to broadcast traffic does it send it to the &quot;all ones&quot; IP? &lt;em&gt;(Which is &lt;strong&gt;255.255.255.255&lt;/strong&gt;)?&lt;/em&gt; Or does it send it to &quot;the all ones of the subnet&quot;? &lt;em&gt;(For example if the subnet is 123.123.0.0/16 then broadcast to &lt;strong&gt;123.123.255.255&lt;/strong&gt;).&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;strong&gt;255.255.255.255&lt;/strong&gt; is true then why is &lt;strong&gt;123.123.255.255&lt;/strong&gt; left unused?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Note that I'm assuming that a broadcast can't reach outside its subnet. Tell me if this is not always the case.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also is there a specific term for each one of those &quot;all ones&quot;?&lt;/p&gt;&#xA;" OwnerUserId="31518" LastEditorUserId="8499" LastEditDate="2020-07-17T02:44:54.053" LastActivityDate="2020-07-17T02:44:54.053" Title="Broadcasting traffic by 255.255.255.255 or by &quot;subnet dot all ones&quot;?" Tags="|ip|ipv4|subnet|ip-address|broadcast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37572" PostTypeId="1" CreationDate="2016-12-25T17:19:42.643" Score="1" ViewCount="205" Body="&lt;p&gt;I have two routers that are connected with a DCE cable on Interface Se2/0(both sides).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two routers have one computer each with ip addresses as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;1.1.1.1&lt;/code&gt; with mask &lt;code&gt;255.255.255.0&lt;/code&gt; -&gt; router1 IP on interface &lt;code&gt;Fa0/0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;2.2.2.2&lt;/code&gt; with mask &lt;code&gt;255.255.255.0&lt;/code&gt; -&gt; router2 IP on interface &lt;code&gt;Fa0/0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The ip addresses on interfaces Se2/0 are set as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;11.11.11.11&lt;/code&gt; with mask &lt;code&gt;255.255.255.0&lt;/code&gt; -&gt; router1 IP on interface &lt;code&gt;Se2/0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;22.22.22.22&lt;/code&gt; with mask &lt;code&gt;255.255.255.0&lt;/code&gt; -&gt; router1 IP on interface &lt;code&gt;Se2/0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Adding the routes should go as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ip route 2.2.2.0 255.255.255.0 22.22.22.22&lt;/code&gt; -&gt; for router1.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ip route 1.1.1.0 255.255.255.0 11.11.11.11&lt;/code&gt; -&gt; for router2.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;However, these routes aren't established. If I use the &lt;code&gt;show ip route&lt;/code&gt; command, it shows(router1 inpute for example),without the route shown:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.0.0.0/24 is subnetted, 1 subnets&#xA;  C 1.1.1.0 is directly connected, FastEthernet0/0&#xA;11.0.0.0/24 is subnetted, 1 subnets&#xA;  C 11.11.11.0 is directly connected, Serial2/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong? My initial thought is I'm messing up the masks? Because I tried another address(for example &lt;code&gt;10.0.0.1&lt;/code&gt; with mask &lt;code&gt;255.255.255.252&lt;/code&gt;) and it worked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Networks and configuration(for only one router, symetric with the other router):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Si1pp.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Si1pp.jpg&quot; alt=&quot;Networkss&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Uk5wZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Uk5wZ.jpg&quot; alt=&quot;Configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vzRLa.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vzRLa.jpg&quot; alt=&quot;Configuration continued&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33029" LastEditorUserId="33030" LastEditDate="2016-12-25T18:02:33.413" LastActivityDate="2017-02-23T20:59:42.617" Title="static routing and masks" Tags="|cisco|routing|packet-tracer|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37573" PostTypeId="2" ParentId="37571" CreationDate="2016-12-25T17:21:03.033" Score="7" Body="&lt;p&gt;An application can send broadcasts to either the network broadcast address (network all ones) or the limited broadcast address (all ones address).&lt;/p&gt;&#xA;&lt;p&gt;It used to be the default for routers to allow routing of the network broadcast address (IP directed broadcast), but that proved to be a huge security problem, so routers default to not allow IP directed broadcast. Some routers can be configured to do this.&lt;/p&gt;&#xA;&lt;p&gt;The limited broadcast, by definition, cannot be routed.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc919&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 919, BROADCASTING INTERNET DATAGRAMS&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc922&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 922, BROADCASTING INTERNET DATAGRAMS IN THE PRESENCE OF SUBNETS&lt;/a&gt; explain broadcasting in more detail.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2016-12-25T18:15:11.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37574" PostTypeId="2" ParentId="37572" CreationDate="2016-12-25T17:27:29.957" Score="2" Body="&lt;p&gt;Your static route, &lt;code&gt;ip route 2.2.2.0 255.255.255.0 22.22.22.22&lt;/code&gt; on Router 1 doesn't work because Router 1 doesn't know how to get to &lt;code&gt;22.22.22.22&lt;/code&gt;, so it cannot send traffic destined for the &lt;code&gt;2.2.2.0/24&lt;/code&gt; anywhere, and it drops the traffic. The same thing applies to Router 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers learn how to get to other networks in three ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Directly connected networks.&lt;/li&gt;&#xA;&lt;li&gt;Statically configured routes, but the router needs to know how to&#xA;get to the next hop.&lt;/li&gt;&#xA;&lt;li&gt;By sharing routes through a common routing protocol.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If your two routers share a common network between them, each router knows to send the traffic on that interface because the network is directly connected to both routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also use something like, &lt;code&gt;ip route 2.2.2.0 255.255.255.0 Serial2/0&lt;/code&gt;, but that is not a good idea for other reasons.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-25T18:07:28.180" LastActivityDate="2016-12-25T18:07:28.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37575" PostTypeId="2" ParentId="37572" CreationDate="2016-12-25T19:33:05.290" Score="1" Body="&lt;p&gt;Your two serial interfaces have to be on the same subnet like on a side 11.11.11.11 and on the other side 11.11.11.12. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The directly connected interfaces always have to be on the same subnet.&lt;/p&gt;&#xA;" OwnerUserId="33031" LastActivityDate="2016-12-25T19:33:05.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37576" PostTypeId="2" ParentId="37571" CreationDate="2016-12-25T19:38:32.353" Score="-2" Body="&lt;p&gt;Broadcast stops at a router interface. So each IP on the same side as the broadcaster will receive the packet&lt;/p&gt;&#xA;" OwnerUserId="33031" LastActivityDate="2016-12-25T19:38:32.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37577" PostTypeId="1" AcceptedAnswerId="37578" CreationDate="2016-12-25T21:06:21.023" Score="2" ViewCount="1089" Body="&lt;p&gt;An arriving client sends a DHCP discover with source IP &lt;code&gt;0.0.0.0:68&lt;/code&gt; and destination IP &lt;code&gt;255.255.255.255:67&lt;/code&gt; and the server replies with an offer having its IP to destination &lt;code&gt;255.255.255.255:68&lt;/code&gt;, then the DHCP request and ack happen the same way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if 2 (or more) clients arrive to the network at the same time? How do they communicate? How do the server and the clients distinguish between the packets?&lt;/p&gt;&#xA;" OwnerUserId="31518" LastEditorUserId="8499" LastEditDate="2018-03-11T01:56:15.607" LastActivityDate="2018-03-11T02:24:27.640" Title="How does a DHCP server differentiate between 2 requesting devices?" Tags="|ipv4|ip|dhcp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37578" PostTypeId="2" ParentId="37577" CreationDate="2016-12-25T21:28:57.677" Score="4" Body="&lt;p&gt;They differentiate with a MAC address identifying a unique NIC.&lt;/p&gt;&#xA;" OwnerUserId="33031" LastEditorUserId="453" LastEditDate="2018-03-11T02:24:27.640" LastActivityDate="2018-03-11T02:24:27.640" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37579" PostTypeId="2" ParentId="37577" CreationDate="2016-12-25T21:51:53.367" Score="5" Body="&lt;p&gt;The DHCP server knows the layer-2 (MAC) address of the requesting host because of the CHADDR (Client hardware address) field in the DHCPDISCOVER message. The DHCPOFFER message also contains a CHADDR field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For DHCP requests to a DHCP server on a different LAN, a DHCP relay is used, and the DHCP server gets the DHCPDISCOVER message that includes DHCP Option 82 that tells the DHCP server to send the DHCPOFFER back to the DHCP relay. The DHCP relay stands in for the DHCP server on the host LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-25T21:51:53.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37582" PostTypeId="2" ParentId="11200" CreationDate="2016-12-26T03:10:39.837" Score="2" Body="&lt;p&gt;You can think of the &lt;em&gt;network ID&lt;/em&gt; as the &quot;neighborhood&quot;. Then think of the host IP addresses as the &quot;house numbers&quot;. &#xA;The subnet mask helps define the network ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a big picture perspective, consider this classful address:&#xA;Network ID: 192.168.0.0&#xA;Subnet mask: 255.255.255.0&#xA;(I realize that 192.168.0.0 isn't a common example, but it is valid and helps illustrate the point.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Valid host IP addresses in the &quot;neighborhood&quot; for the &quot;house numbers&quot; are: 192.168.0.1 through 192.168.0.254&#xA;The network ID is 192.168.0.0&#xA;The broadcast address is 192.168.0.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what is looks like if this is not a classful address:&#xA;Network ID: 192.168.0.0&#xA;Subnet mask: 255.255.0.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Valid host IP addresses in the &quot;neighborhood&quot; for the &quot;house numbers&quot; are: 192.168.0.1 through 192.168.255.254&#xA;The network ID is 192.168.0.0&#xA;The broadcast address is 192.168.0.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice that in both of these examples, the network ID (without the subnet mask) looks the same. However, the subnet mask defines them with two completely different host IP address ranges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using your original analogy, you can divide the neighborhood into streets with subnetting. For example, starting with 192.168.0.0 and 255.255.255.0, you can divide it into two subnets:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnet 1&#xA;192.168.0.0&#xA;255.255.255.128&#xA;Host IP address range: 192.168.0.1 through 192.168.0.126&#xA;Broadcast IP: 192.168.0.127&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Subnet 2&#xA;192.168.0.128&#xA;255.255.255.128&#xA;Host IP address range: 192.168.0.129 through 192.168.0.254&#xA;Broadcast IP: 192.168.0.255&lt;/p&gt;&#xA;" OwnerUserId="13630" LastActivityDate="2016-12-26T03:10:39.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37587" PostTypeId="2" ParentId="37556" CreationDate="2016-12-26T09:44:16.593" Score="3" Body="&lt;p&gt;As QinQ is ISP feature the key was in Not in Use entservice license state:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show license all&#xA;...&#xA;StoreIndex: 1 Feature: entservices  Version: 1.0&#xA;    License Type: PermanentRightToUse&#xA;    License State: Active, Not in Use, EULA accepted&#xA;    License Count: Non-Counted&#xA;...&#xA;#configure terminal&#xA;    #(config)#license boot level entservices !&#xA;#reload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just After reload(No license were entered!):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show license all&#xA;    ...&#xA;    StoreIndex: 1 Feature: entservices  Version: 1.0&#xA;    License Type: PermanentRightToUse&#xA;    License State: Active, In Use&#xA;    License Count: Non-Counted&#xA;    ...&#xA;show log&#xA;    ...&#xA;    *Dec 26 01:20:03.606: %C4K_IOSSYS-6-IMAGELEVEL: Supervisor booting in image level 'entservices'&#xA;    ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;All commands needed for QinQ feature(and much more) became available:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show dot1q-tunnel ?&#xA;    interface  specify an interface&#xA;    |          Output modifiers&#xA;    &amp;lt;cr&amp;gt;&#xA;(config)#int gi 1/1&#xA;    (config-if)#switchport mode ?&#xA;    access        Set trunking mode to ACCESS unconditionally&#xA;    dot1q-tunnel  set trunking mode to TUNNEL unconditionally&#xA;    dynamic       Set trunking mode to dynamically negotiate access or trunk mode&#xA;    private-vlan  Set private-vlan mode&#xA;    trunk         Set trunking mode to TRUNK unconditionally&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;By the way, all interface configuration commands are available in any switchport mode, just error can occurs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config)#int gi 1/1&#xA;    (config-if)#no switchport&#xA;    (config-if)#switchport mode dot1q-tunnel &#xA;        Command rejected: Te5/5 is not a switching port.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And all show command available:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show dot1q-tunnel &#xA;    dot1q-tunnel mode LAN Port(s)&#xA;    -----------------------------&#xA;    Gi1/24&#xA;    Te5/5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33015" LastActivityDate="2016-12-26T09:44:16.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37588" PostTypeId="1" CreationDate="2016-12-26T12:58:24.743" Score="4" ViewCount="12074" Body="&lt;p&gt;is there a difference between subneting, segmentation and segregation ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;After reading I felt subnetting and segmentation seems to be the same meaning which just divide into smaller network. &#xA;Segregation seem to be a little more advanced in terms of permitting the traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On enterprise level when it comes to creating different VLANs, i believe we should be using segregation more ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Segregation also seem to be more secure ?&lt;/p&gt;&#xA;" OwnerUserId="33044" LastActivityDate="2016-12-26T15:21:40.490" Title="What's the difference between subneting, segmentation and segregation" Tags="|vlan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37590" PostTypeId="2" ParentId="37588" CreationDate="2016-12-26T14:33:54.803" Score="0" Body="&lt;p&gt;I think subneting is the logical implementation of the segregation.&lt;/p&gt;&#xA;" OwnerUserId="31857" LastActivityDate="2016-12-26T14:33:54.803" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37591" PostTypeId="2" ParentId="37588" CreationDate="2016-12-26T15:21:40.490" Score="7" Body="&lt;p&gt;&lt;strong&gt;Subneting&lt;/strong&gt; is the process of breaking up IP address networks into smaller networks. It is typically used in the context of an ISP providing a company a /16 (for example), which is 65536~ IP Addresses, and that company breaking up those 65k IP addresses into smaller groups for more efficient deployment in their network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Segmentation&lt;/strong&gt; is the concept of breaking up one larger network into multiple smaller network. It is often associated with &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans/&quot; rel=&quot;nofollow noreferrer&quot;&gt;VLANs&lt;/a&gt;, but doesn't require them. BUT, each new network does require its own IP address range, and therefore also involves the process of &lt;strong&gt;Subneting&lt;/strong&gt; described above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Segregation&lt;/strong&gt; can probably mean different things to different shops, but I've always taken it to mean the concept of placing servers/hosts with different security requirements in different network &quot;zones&quot; so you can apply security policies to traffic flowing to and in between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, traffic flowing to your web server will be filtered differently than traffic flowing to your database server. As such, it is wise to put your web server in a different network than your database server, and also ideally separate those networks with some sort of Firewall or security device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Segregation will involve creating different/isolated networks, which might involve Segmentation, which will therefore also involve Subnetting.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2016-12-26T15:21:40.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37592" PostTypeId="2" ParentId="36122" CreationDate="2016-12-26T16:11:04.267" Score="1" Body="&lt;p&gt;The logging discriminator might be the feature you are looking for here.&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/htnmsylg.html#wp1056391&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t11/htnmsylg.html#wp1056391&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The format of such a discriminator is as follows : &#xA;logging discriminator discr-name [[facility | mnemonics | msg-body {drops | includes} string] | severity {drops | includes} sev-num | rate-limit msglimit]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example , say the logged message for the ACL is of the kind &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;*May  1 22:12:13.243: %SEC-6-IPACCESSLOGP: list ACL-IPv4-E0/0-IN permitted&#xA;     tcp 192.168.1.3(1024) -&gt; 192.168.2.1(22), 1 packet&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your discriminator would be :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;logging discriminator BLOCKACL mnemonics includes %SEC-6-IPACCESSLOGP &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="13861" LastActivityDate="2016-12-26T16:11:04.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37594" PostTypeId="1" AcceptedAnswerId="37596" CreationDate="2016-12-26T17:48:19.257" Score="7" ViewCount="747" Body="&lt;p&gt;As a knowledgeable person in computer networks I have always had an itch for learning how to create custom-length fiber optic cables. So, as a personal goal, I want to get trained and certified in cable termination and splicing. What is a good reputable industry-standard certification to pursue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm located in Los Angeles, so if anyone knows a good place for training please let me know (something that wouldn't break the bank, e.g. community college but I'm open to contemplating others).&lt;/p&gt;&#xA;" OwnerUserId="33050" LastEditorUserId="8499" LastEditDate="2019-01-03T03:02:06.243" LastActivityDate="2019-01-03T03:02:06.243" Title="What certifications are there for Fiber Optic termination and splicing?" Tags="|layer1|fiber|design|hardware|optics|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37595" PostTypeId="2" ParentId="37594" CreationDate="2016-12-26T17:52:05.680" Score="2" Body="&lt;p&gt;The standards body, which also provides training and certifications, is &lt;a href=&quot;https://www.bicsi.org/Default.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;BICSI&lt;/a&gt;. You must join BICSI. There are then classes, some offered by BICSI, some offered by approved third parties. You take certification tests as BICSI offers them in various places at various times.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-26T17:52:05.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37596" PostTypeId="2" ParentId="37594" CreationDate="2016-12-26T20:04:37.820" Score="5" Body="&lt;p&gt;It's not terribly difficult to train yourself, if you care about the &lt;strong&gt;doing&lt;/strong&gt;. If you care about &lt;strong&gt;selling yourself&lt;/strong&gt; more, BICSI will happily take your money as a certifier. Probably better if you can get your employer to have you certified as continuing education so BICSI can take their money, but if it's not applicable enough to your job, it's not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I was teaching myself (for work, but the budget was low) I managed to attend a quasi-local fiber optic conference which had lots of BICSI training classes as part of the offerings (but attendees could attend regardless of affiliation - BICSI members would get their cards stamped [or equivalent] to prove they had kept up with training classes.) I've also done some online training webinars under the same circumstances. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As someone new to fiber optics who had actually read and understood the basic background information, I found that there was very little new content to most of these training sessions (and many of them were not-so-subtle sales pitches for some company's product, yet they were an approved training class.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I remain unaffiliated with BICSI, but I built a fiber optic network that has been running for 6 years now with few problems, and at a very attractive price for my employer. But I don't have any &lt;em&gt;certificate&lt;/em&gt; for that...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, if you are talking about &quot;custom length &lt;em&gt;patch&lt;/em&gt; cables&quot; rather than &lt;em&gt;fiber in walls&lt;/em&gt; or &lt;em&gt;between buildings&lt;/em&gt;, I can save you the bother - the industry-wide recommendation is to order those factory made, it's almost always a better cable that's more cost effective. Concentrate on remembering to inspect and clean before every connection, and put your initial educational effort there.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-12-26T20:04:37.820" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37598" PostTypeId="1" CreationDate="2016-12-26T21:22:10.390" Score="1" ViewCount="220" Body="&lt;p&gt;I am doing this migration with these 3com switches.So our client told me that the configuration was made for a network administrator who was fired some years ago. So I dont have any kind of documentation so I need to figure what does each command. I am having trouble with 2 ACL and a QOS  policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&#xA; acl number 3997&#xA; rule 0 permit ip dscp ef&#xA; rule 1 permit tcp destination-port eq www&#xA; rule 2 permit udp destination-port eq snmp&#xA; rule 3 permit udp destination-port eq snmptrap&#xA; rule 4 permit ip dscp cs6&#xA; rule 5 permit ip dscp cs7&#xA;#&#xA;acl number 4999&#xA; rule 0 permit type 8868 ffff&#xA; rule 1 permit source 00e0-bb00-0000 ffff-ff00-0000&#xA; rule 2 permit source 0003-6b00-0000 ffff-ff00-0000&#xA; rule 3 permit source 00e0-7500-0000 ffff-ff00-0000&#xA; rule 4 permit source 00d0-1e00-0000 ffff-ff00-0000&#xA; rule 5 permit source 0001-e300-0000 ffff-ff00-0000&#xA; rule 6 permit source 000f-e200-0000 ffff-ff00-0000&#xA; rule 7 permit source 0060-b900-0000 ffff-ff00-0000&#xA; rule 8 deny dest 0000-0000-0000 ffff-ffff-ffff&#xA;#&#xA;qos-profile default&#xA; packet-filter inbound link-group 4999 rule 8&#xA; traffic-priority inbound ip-group 3997 rule 0 cos voice&#xA; traffic-priority inbound ip-group 3997 rule 4 cos network-management&#xA; traffic-priority inbound ip-group 3997 rule 5 cos network-management&#xA;  traffic-priority inbound link-group 4999 rule 0 dscp ef cos voice&#xA; traffic-priority inbound link-group 4999 rule 1 dscp ef cos voice&#xA; traffic-priority inbound link-group 4999 rule 2 dscp ef cos voice&#xA; traffic-priority inbound link-group 4999 rule 3 dscp ef cos voice&#xA; traffic-priority inbound link-group 4999 rule 4 dscp ef cos voice&#xA; traffic-priority inbound link-group 4999 rule 5 dscp ef cos voice&#xA; traffic-priority inbound link-group 4999 rule 6 dscp ef cos voice&#xA; traffic-priority inbound link-group 4999 rule 7 dscp ef cos voice&#xA;#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ACL 3997 is an ACL for the QOS policy. Is the interesting traffic. I understand that. The second one is a list of MAC addresses allowed in the same QOS policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And finally the QOS policy. I have zero experience working with QOS politics in switches. I dont understand how to migrate the QOS policy. I have found some examples but since I dont understand what I am doing I dont want to copy paste a configuration and hope for the best results. Any good resource for a quick crash course for  QOS. at least the basic to understand this policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or if you have the time explain me here what is the meaning of each command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="32651" LastEditorUserId="8499" LastEditDate="2016-12-26T21:34:19.750" LastActivityDate="2016-12-26T21:34:19.750" Title="3com 5500G migration to force10 s4810" Tags="|switch|qos|dell|force10|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37599" PostTypeId="2" ParentId="19090" CreationDate="2016-12-27T00:01:07.130" Score="1" Body="&lt;p&gt;For any receiver there is a threshold above which the system will stop receiving correctly and a further threshold above which the receiver will actually be damaged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://youtu.be/_KFpXuHqHQg?t=4612&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://youtu.be/_KFpXuHqHQg?t=4612&lt;/a&gt; 10km optics will normally work fine even with a very short fiber. 40km optics will not work correctly but are unlikely to be damaged. 80km optics may suffer actual damage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically it's a potential issue for people playing the long distance WDM or dark fiber game. It shouldn't be an issue for links within a site or links to other nearby sites.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2016-12-27T00:01:07.130" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37600" PostTypeId="2" ParentId="36813" CreationDate="2016-12-27T01:51:24.543" Score="2" Body="&lt;p&gt;As a general rule hardware is good when you have a relatively simple task that you need to do very quickly/frequently. Software is good when you have a more complex task that is not so speed-critical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unmanaged switches do pretty much everything in hardware. Their job is a simple one, add MAC addresses to a table, match MAC addresses against that table. It's simple but it needs to be fast and cheap, dedicated hardware is the order of the day. It wouldn't surprise me if there were some tiny processors inside doing initialisation stuff but if there are they aren't visible from outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Managed switches have a CPU to handle the management side of things. Building the management interface in hardware would be prohibitively expensive both from a development and production point of view. It would also make it impossible to fix bugs or add features after the hardware was produced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A similar principle applies to high end routers, the actual high speed data forwarding is handled by dedicated hardware but the management side of things including talking to other routers is done in software.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2016-12-27T16:41:22.897" LastActivityDate="2016-12-27T16:41:22.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37601" PostTypeId="1" AcceptedAnswerId="37616" CreationDate="2016-12-27T09:36:43.247" Score="0" ViewCount="1472" Body="&lt;p&gt;We can mark all the tcp packet while forwarding them using the following :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;iptables -A FORWARD -t mangle -p tcp -j MARK --set-mark 1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to mark the packets for a particular IP address?&lt;/p&gt;&#xA;" OwnerUserId="33066" LastActivityDate="2016-12-27T23:33:48.413" Title="How to mark the packet with a specific IP address using iptables command?" Tags="|ip|firewall|" AnswerCount="1" CommentCount="1" ClosedDate="2018-08-06T00:15:00.297" ContentLicense="CC BY-SA 3.0" />
  <row Id="37609" PostTypeId="1" AcceptedAnswerId="37610" CreationDate="2016-12-27T15:53:41.773" Score="7" ViewCount="5750" Body="&lt;p&gt;I have following scenario:&#xA;My AS: 64501 has two routers R3 (Redundand) and R4 (Main).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP AS: 64500 has 3 routers R1, R2 and R5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have eBGP peering with ISP, I have no access to ISP configuration, only to configuration on my net (R3, R4).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Cb7If.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Cb7If.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need that incoming traffic from ISP always was sent to Main router (R4) and only if Main isn't accessible send traffic to Geo redundant (R3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can do it using AS-PATH Prepend sent from  Geo-redundant router (R3) and it's working:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZLQ8c.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZLQ8c.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in this case traffic in ISP from R5 is sent as showed on picture (via R1-R2-R4) - one more hop, not straight (R5-R2-R4). This happens because iBGP is not using AS-PATH prepend, so R1 is preferring route via R2, as route R1&amp;lt;-&gt;R3 is prepended. But R1 is sending iBGP route update to R5 without as-path prepend. So for R5 there are two equal routes to My network, and it's choosing route via R1, as R1 IP address is lower that R2 IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question#1: Can I configure somehow devices only in My network, so traffic will pass like this, without MED or Communities?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions#2: Can I configure somehow devices in My and in ISP network, so traffic will pass like this, without MED or Communities?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LJ1kK.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LJ1kK.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="19524" LastEditorUserId="8499" LastEditDate="2020-11-27T23:28:18.493" LastActivityDate="2020-11-27T23:28:18.493" Title="iBGP AS path prepend propogation" Tags="|routing|router|bgp|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37610" PostTypeId="2" ParentId="37609" CreationDate="2016-12-27T16:25:23.417" Score="6" Body="&lt;p&gt;I think you are confusing routers and ASes. To BGP, an AS is a hop, not a router. You can try to influence a neighbor AS for which peer it uses to send traffic to your AS, but the neighbor AS is free to ignore your suggestions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like your neighbor AS is following your suggestion for which of your routers it should use to get to your AS, and you could specify which of your routes could come in on which of your routers, but you cannot control routing inside the neighbor AS to the degree that you seem to want. In any case, MED wouldn't be any more effective than AS prepending. Both are pretty blunt, and neither will give you any degree of control inside the neighbor AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would need to work with the neighbor AS administrators to see if you could come to some arrangement. That &lt;em&gt;may&lt;/em&gt; be using communities, or it may be something the neighbor AS administrators want to do on their own. You simply have no direct control over what happens in a different AS. That is the &lt;em&gt;Autonomous&lt;/em&gt; in Autonomous System.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Question#1: Can I configure somehow devices only in My network, so&#xA;  traffic will pass like this, without MED or Communities?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Nothing you do in your AS will change the internal routing of a neighbor AS.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Questions#2: Can I configure somehow devices in My and in ISP network,&#xA;  so traffic will pass like this, without MED or Communities?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You don't have the authority to configure devices in your neighbor's AS.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Your problem seems to be that your neighbor AS prefers to send R5 traffic to R1, and that is its right, and there really isn't anything you can do about that, except through business negotiation. What you could do is to make R3 your main router, and R4 your backup router. That would achieve your goal, at least until you are in a failover situation, at which point you will be in the same situation you are now.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2016-12-28T17:41:38.623" LastActivityDate="2016-12-28T17:41:38.623" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37611" PostTypeId="2" ParentId="37609" CreationDate="2016-12-27T16:49:00.093" Score="3" Body="&lt;p&gt;Just to expand on @RonMaupin 's answer -- &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole point of BGP is that the AS administrator is the one who gets to decide how the traffic flows in his or her network -- not you.  You can signal your desires, but the AS admin can (and often does) ignore them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now since, in your example, you can see inside AS64500, you wonder why traffic flows the way it does.  You have assumed that iBGP ignores prepends, but that is not the case.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 receives advertisements from both R3 and R2.  R3 advertises the prefix with the prepends, but R2 does not.  So R1 chooses the shorter path advertised by R2 and that is what it installs in its routing table.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-27T16:49:00.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37613" PostTypeId="1" AcceptedAnswerId="37614" CreationDate="2016-12-27T18:18:45.947" Score="13" ViewCount="2377" Body="&lt;p&gt;I play with &lt;code&gt;libpcap&lt;/code&gt; in C recently to create an arp sniffer program that captures arp requests on the air. I came up with a strange effect. &lt;strong&gt;I captured arp requests from my router.&lt;/strong&gt; I don't know if this is a bug of my program, but I was curious (even more after I analyzed the packet and found that the operation code was set to &lt;code&gt;1&lt;/code&gt; which means we have to do with arp request). Is this ever possible? I didn't found any entry for a similar question on the Internet.&lt;/p&gt;&#xA;" OwnerDisplayName="user33076" LastEditorUserId="8499" LastEditDate="2018-03-12T19:18:39.720" LastActivityDate="2018-03-12T19:18:39.720" Title="Can a router send ARP requests to hosts?" Tags="|router|arp|layer2|layer3|pcap|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37614" PostTypeId="2" ParentId="37613" CreationDate="2016-12-27T18:21:16.317" Score="22" Body="&lt;p&gt;ARP is used by a host on a LAN to resolve a layer-3 address to a layer-2 address so that a frame can be built for the LAN. A router is just another host on a LAN, and it will need to resolve layer-3 addresses to layer-2 addresses, the same way a PC on a LAN does.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-27T18:21:16.317" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37616" PostTypeId="2" ParentId="37601" CreationDate="2016-12-27T23:25:38.540" Score="1" Body="&lt;p&gt;Assuming the destination is 192.168.1.1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables -A FORWARD -t mangle -d 192.168.1.1/24 -j MARK --set-mark 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33085" LastEditorUserId="33085" LastEditDate="2016-12-27T23:33:48.413" LastActivityDate="2016-12-27T23:33:48.413" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37623" PostTypeId="2" ParentId="37609" CreationDate="2016-12-28T11:01:16.440" Score="2" Body="&lt;p&gt;To extend the other two answers: The issue here is IGP routing inside the AS64500. The actual question is, why does R5 send the traffic to R1 instead of R2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R5 only has one BGP route, which is the one without prepending. This is because R1 learns both the eBGP routes including the prepending and the iBGP route from R2 and prefers the route from R2 due to the shorter AS-Path (assuming, no weight or local-pref is set). Hence R1 will only advertise its best path to its neighbours, R5 ends up with only knowing the path without advertising.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The actual paths depends on the IGP routing. The BGP routing update received by R5 contains the next-hop field, which is most likely either set to R4's address on the R2-R4 link or to one of R2's addresses (next-hop-self configured on R2). This next-hop is then resolved using the configured IGP, which dictates the actual routing of the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your second question (you hardly can influence IGP path decisions in another AS via your BGP configuration), have a look at R5, check which next-hop is advertised on the BGP routing update and have a look in the IGP-resolution of this next-hop. This should give you a fairly good idea why the traffic is routed the way it currently is. If you can modify the BGP config of the ISP, you could also use any other &quot;BGPish&quot; way to accomplish that. There are many ways, including local-preference.&lt;/p&gt;&#xA;" OwnerUserId="3875" LastActivityDate="2016-12-28T11:01:16.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37627" PostTypeId="1" AcceptedAnswerId="37628" CreationDate="2016-12-28T15:16:10.887" Score="3" ViewCount="793" Body="&lt;p&gt;In a BGP routing context, giving these networks address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.0.0 /28&#xA;192.168.0.32 /28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For me, the summary address will be :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.0.0 /26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But someone tells me that this is impossible because at least &lt;code&gt;192.168.0.16/28&lt;/code&gt; is missing, so i'm wondering if this is possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another example where this is impossible (in his point of view):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.0.0/28&#xA;192.168.0.16/28&#xA;192.168.0.32/28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For him, this is impossible to summarize because of the lack of &lt;code&gt;192.168.0.48/28&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.0.0000|0000&#xA;192.168.0.0001|0000&#xA;192.168.0.0010|0000&#xA;192.168.0.0011|0000   --because this one is missing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;if &lt;code&gt;192.168.0.48/28&lt;/code&gt; was present, then the summary address will be:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;192.168.0.0 /26&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="21354" LastActivityDate="2017-01-02T23:07:41.587" Title="Why I Can't Summarize (aggregate) These Subnets in BGP router?" Tags="|bgp|subnet|route-summarization|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37628" PostTypeId="2" ParentId="37627" CreationDate="2016-12-28T15:28:27.423" Score="6" Body="&lt;p&gt;Generally speaking, route summarization hides information about more specific routes.  It also hides the fact that you may not have a route to all addresses in your summary.  So yes, you can summarize.  Whether or not you should depends on what you are doing with your summary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of BGP, you are advertising that you can reach all networks in your summary  - but in fact you can't.  You will &quot;blackhole&quot; the missing networks because your router will attract traffic for 192.168.0.16/28 (in your example), but you may not actually have a route to that network and you will end up dropping the traffic.  If that is OK in your network, then go ahead and summarize.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-01-01T14:13:29.523" LastActivityDate="2017-01-01T14:13:29.523" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37629" PostTypeId="1" AcceptedAnswerId="37630" CreationDate="2016-12-28T18:12:37.760" Score="1" ViewCount="139" Body="&lt;p&gt;Switch: Dell PowerConnect 5548&lt;br&gt;&#xA;DHCP is being handled by Windows 2012 R2&lt;br&gt;&#xA;If it's relevant the router is a Sonicwall NSA 2600  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our network is currently &lt;code&gt;10.1.1.0/24&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I were to just create a VLAN on the switch it would change the 3rd octet&lt;br&gt;&#xA;ex: command VLAN 10 would make &lt;code&gt;10.1.10.0/24&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I want to make our network have multiple ranges for various VLANs.&lt;br&gt;&#xA;keeping &lt;code&gt;10.1.x&lt;/code&gt; for the switch and router and proxy,&lt;br&gt;&#xA;but using &lt;code&gt;10.2.x&lt;/code&gt; for everything else. (&lt;code&gt;10.2.2.x&lt;/code&gt; for servers, &lt;code&gt;10.2.3.x&lt;/code&gt; for printers, etc.)  .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a small company so these changes are definitely possible, just a matter of when I implement them. Or in the case of this question, how.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I do this with the PowerConnect 5548 with the network's CIDR set to &lt;code&gt;/24&lt;/code&gt; or do I need to switch to &lt;code&gt;/16&lt;/code&gt; to change the second octet when I create a VLAN?&lt;/p&gt;&#xA;" OwnerUserId="33112" LastEditorUserId="8499" LastEditDate="2016-12-28T18:33:07.160" LastActivityDate="2016-12-28T18:41:46.200" Title="Do I have to change to /16 instead of /24 to set up these VLANs" Tags="|switch|vlan|dell|powerconnect|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37630" PostTypeId="2" ParentId="37629" CreationDate="2016-12-28T18:31:31.840" Score="0" Body="&lt;p&gt;IP address octets have nothing to do with VLANs, or really anything other than making a 32-bit number easier to read for humans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your switch supports VLAN, and you usually want each VLAN to have a separate IP network address. This can be on VLAN boundaries if it makes it easier for you, and you have enough addresses to do this. The different IP networks certainly do not need to be on IP boundaries. For example, you could have four networks: &lt;code&gt;10.1.1.0/26&lt;/code&gt;, &lt;code&gt;10.1.1.64/26&lt;/code&gt;, &lt;code&gt;10.1.1.128/26&lt;/code&gt;, and &lt;code&gt;10.1.1.192/26&lt;/code&gt;. You could chop it into eight using &lt;code&gt;/27&lt;/code&gt;, or any power of two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you want to use &lt;code&gt;10.1.1.0/24&lt;/code&gt; for a management VLAN, and various &lt;code&gt;10.2.x.x/xx&lt;/code&gt; for other VLANs. You can do that. Each of the other VLANs could be &lt;code&gt;/24&lt;/code&gt;, or whatever size is appropriate. Your VLANs do not even need to be the same size nor contiguous, but they cannot overlap. You may want to learn more about IP addressing first. See &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;this answer&lt;/a&gt; to understand how to do this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not clear where you intend to do the routing between the VLANs, but I don't think your switch has layer-3 capabilities, so you will need to trunk the VLANs to your SonicWall and create the VLANs there as the gateway for the VLANs. Create each VLAN with a separate non-overlapping IP network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your switch management address can stay in your management VLAN of &lt;code&gt;10.1.1.0/24&lt;/code&gt;. Each VLAN IP network is completely independent of any other VLAN IP network, other than they cannot be overlapping.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2016-12-28T18:41:46.200" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37631" PostTypeId="2" ParentId="37629" CreationDate="2016-12-28T18:39:10.757" Score="1" Body="&lt;p&gt;Setting the subnet to a /16 might cause some issues with broadcasts.  Remember that your broadcast traffic is always the last address (the .255).  I'm not sure what else might happen.  Haven't tried it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If traffic needs to travel between VLANs, you need to route between the VLANs.  The configuration of each VLAN's addressing should match the devices on the VLAN, so if you go with /24 for your workstations, the VLAN needs to be the same.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can easily route traffic between VLANs with the SonicWALL &lt;a href=&quot;https://support.sonicwall.com/kb/sw13826&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://support.sonicwall.com/kb/sw13826&lt;/a&gt;, but be aware that all workstation to server traffic will be passing through the interface on the SonicWALL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on this post &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/4929/dell-powerconnect-5524-vlan-routing&quot;&gt;Dell PowerConnect 5524 VLAN routing&lt;/a&gt;, it sounds like the PowerConnect switch can route at L3 and that would be the ideal choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Look at the manual &lt;a href=&quot;http://downloads.dell.com/manuals/common/powerconnect-5500-series_ug_en-us.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://downloads.dell.com/manuals/common/powerconnect-5500-series_ug_en-us.pdf&lt;/a&gt; on page 213.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let us know how this works out for you.&lt;/p&gt;&#xA;" OwnerUserId="32328" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2016-12-28T18:39:10.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37632" PostTypeId="1" CreationDate="2016-12-28T18:55:28.877" Score="1" ViewCount="88" Body="&lt;p&gt;What is the purpose / function of media converters on Single-Fiber mode cable runs?  How does this work or is necessary?&lt;/p&gt;&#xA;" OwnerUserId="33114" LastActivityDate="2016-12-30T17:04:55.903" Title="Single Mode Fiber Optic Connectors" Tags="|security|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37634" PostTypeId="2" ParentId="37632" CreationDate="2016-12-28T19:23:55.877" Score="5" Body="&lt;p&gt;There is nothing special about media converters in regard to single-mode fiber.  A media converter would typically be used to extend the reach of copper (using fiber in between the media converters) or to accommodate endpoints that don't support the media in use.  For example, if you have fiber between two endpoints that only support RJ45 copper media.  You could use media converters to convert the fiber/optical to copper/electrical.&lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2016-12-28T19:23:55.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37635" PostTypeId="1" AcceptedAnswerId="37636" CreationDate="2016-12-28T19:33:07.217" Score="3" ViewCount="7254" Body="&lt;p&gt;I am using ASR 9k series Routers, which runs &lt;code&gt;IOS-XE&lt;/code&gt; &lt;code&gt;advancedmetroipaccess&lt;/code&gt; License&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried erasing NVRAM: and then tried to run &lt;code&gt;copy start run&lt;/code&gt;&#xA;But it gives me error : &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname#erase /all nvram:&#xA;hostname#copy startup-config running-config&#xA;Destination filename [running-config]? &#xA;%% Non-volatile configuration memory invalid or not present&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to erase running-configuration in IOS-XE,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reason to erase:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I use huge number of VRF distinguishers, and when my network changes its Loopback0, I have to change the loopback0's in all the VRFs. For that, I have to first remove the each &lt;code&gt;rd&lt;/code&gt; in every &lt;code&gt;vrf&lt;/code&gt; which takes lot of time (more than 30 min).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current method I employ is: first set &lt;code&gt;config-register&lt;/code&gt; to &lt;code&gt;0x2142&lt;/code&gt;&#xA;then reload the router and again configure the router with new configuration, and set &lt;code&gt;config-register&lt;/code&gt; to &lt;code&gt;0x2102&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="6118" LastEditorUserId="8499" LastEditDate="2018-12-25T03:20:15.087" LastActivityDate="2018-12-25T03:20:15.087" Title="How to erase running-configuration in Cisco IOS-XE?" Tags="|cisco|router|cisco-ios|cisco-commands|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37636" PostTypeId="2" ParentId="37635" CreationDate="2016-12-28T19:39:30.840" Score="1" Body="&lt;p&gt;If you have erased the startup configuration, then you just reload the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you have a valid startup configuration, copying it to the running configuration would not disable any existing running configuration. For example, if your running configuration has something non-default enabled, and your startup configuration does not have that enabled, it would remain enabled when you merge the startup configuration with the running configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The bottom line is that you can erase the startup configuration, then you need to reload the router to start over. It will ask if you want to save the running configuration, but you just choose &lt;code&gt;No&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-28T19:39:30.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37638" PostTypeId="2" ParentId="37564" CreationDate="2016-12-28T20:35:18.807" Score="1" Body="&lt;p&gt;I'll briefly answer the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RIB (routing information base) contains all of the knowledge the router has obtained about how to reach destination networks.  For example, it may have two different paths to reach the same network, both stored in the FIB.  Or it might have learned the path the same network via two different routing protocols.  Again, they would be unique, separate entries in the main RIB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router extracts the best entries from the RIB and inserts them into the FIB (forwarding information base.)  For example, the router might be configured to prefer paths learned via one protocol over another, therefore leaving behind one of them and not inserting it into the FIB since it prefers the path via BGP vs. OSPF.  There could also be a tie, and it takes two equal paths and inserts them into the FIB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bottom line, the router applies policy to extract the best paths from the RIB and insert them into the FIB.  The FIB is generally composed of high speed memory that is used to build &quot;hardware shortcuts&quot; that allows the unit to switch packets at high speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A hierarchical FIB seeks to eliminate duplication of fields/data in each FIB entry.  See &lt;a href=&quot;http://newnog.net/meetings/nanog40/presentations/ClarenceFilsfils-BGP.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://newnog.net/meetings/nanog40/presentations/ClarenceFilsfils-BGP.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="407" LastActivityDate="2016-12-28T20:35:18.807" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37647" PostTypeId="1" CreationDate="2016-12-29T05:10:02.623" Score="2" ViewCount="12905" Body="&lt;p&gt;I've just started my Cisco Router 886VA with factory settings. I am willing to assign port &lt;code&gt;FastEthernet 0&lt;/code&gt; to an IP address. This port is connected to my laptop which acts as a NAT between the router and the Cisco machine. All FastEthernet ports are assigned to &lt;code&gt;VLAN1&lt;/code&gt; (by default), and when I try to assign the IP address, I get the error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;% IP addresses may not be configured on L2 links.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why is that happening?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, it is still not working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again: my settings are like the following: &lt;code&gt;FastEthernet3&lt;/code&gt; is connect to another home router, i should retrieve an IP address per DHCP which is working (&lt;code&gt;192.168.1.8&lt;/code&gt;). I assigned this port to &lt;code&gt;VLAN3&lt;/code&gt; and this should be NAT ouside since i want to NAT from &lt;code&gt;VLAN3&lt;/code&gt; to &lt;code&gt;VLAN1&lt;/code&gt;. Now, i setup a DHCP pool &lt;code&gt;192.168.100.1&lt;/code&gt; for 3 the other 3 ports: &lt;code&gt;FastEthernet 0-2&lt;/code&gt;, they are assigned to VLAN1, which is NAT inside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not becoming connection on my computer which is connected to &lt;code&gt;FastEthernet 1&lt;/code&gt; (but still having an address from the pool). what shall i do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Debugging info: NAT translation is failing !!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So altogether, i am trying to enable NAT between &lt;code&gt;VLAN1&lt;/code&gt; (inside) to &lt;code&gt;VLAN3&lt;/code&gt; (outside)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why am not able to connect or at all ping the home router???&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would be thankful for any help!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are my configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building configuration...&#xA;&#xA;Current configuration : 1689 bytes&#xA;!&#xA;! Last configuration change at 23:24:01 UTC Thu Jan 5 2017&#xA;version 15.3&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname x&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;enable secret 5 $1$34LK$ekdCKQuEmravI.qziPae7.&#xA;enable password xxxxxx!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 10&#xA;!&#xA;!&#xA;!         &#xA;!&#xA;!&#xA;!&#xA;&#xA;&#xA;!&#xA;ip dhcp excluded-address 192.168.100.210 192.168.100.253&#xA;ip dhcp excluded-address 192.168.100.1 192.168.100.50&#xA;!&#xA;ip dhcp pool LAN&#xA; network 192.168.100.0 255.255.255.0&#xA; default-router 192.168.100.1 &#xA; dns-server 8.8.8.8 &#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;license udi pid xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&#xA;!         &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;controller VDSL 0&#xA;!&#xA;! &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Ethernet0&#xA; no ip address&#xA; no ip route-cache&#xA; shutdown&#xA;!&#xA;interface BRI0&#xA; no ip address&#xA; encapsulation hdlc&#xA; shutdown&#xA; isdn termination multidrop&#xA;!&#xA;interface ATM0&#xA; no ip address&#xA; shutdown&#xA; no atm ilmi-keepalive&#xA;!&#xA;interface FastEthernet0&#xA; no ip address&#xA;!&#xA;interface FastEthernet1&#xA; no ip address&#xA;!&#xA;interface FastEthernet2&#xA; no ip address&#xA;!&#xA;interface FastEthernet3&#xA; description Extern-Router&#xA; switchport access vlan 3&#xA; no ip address&#xA;!&#xA;interface Vlan1&#xA; description inside&#xA; ip address 192.168.100.1 255.255.255.0&#xA; no ip redirects&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA; ip tcp adjust-mss 1412&#xA;!&#xA;interface Vlan3&#xA; ip address dhcp&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA;!&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 192.168.1.1&#xA;!&#xA;!&#xA;!         &#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; no modem enable&#xA;line aux 0&#xA;line vty 0 4&#xA; password xxxxxxxxxxxxxx&#xA; login&#xA; transport input all&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It is still not working, in other words &lt;code&gt;sh ip nat translations&lt;/code&gt; still show nothing!&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wow it works - thank you alot !!!&lt;/p&gt;&#xA;" OwnerUserId="33122" LastEditorUserId="8499" LastEditDate="2018-03-12T02:53:09.373" LastActivityDate="2020-08-22T07:35:35.323" Title="Assigning IP addresses to FastEthernet" Tags="|cisco|router|ip|nat|ip-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37648" PostTypeId="2" ParentId="37647" CreationDate="2016-12-29T05:15:21.957" Score="3" Body="&lt;p&gt;Your router has a switch module. The interfaces of the switch module are not router interfaces, and they cannot be assigned IP addresses they way you do with router interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the switch interfaces you need to assign VLANs, and you can create SVIs (Switch Virtual Interfaces) to which you assign IP addresses. For instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA; ip address 10.0.0.1 255.255.255.0&#xA; no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The SVI will define the gateway address for your VLAN.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit for your update:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have not enabled NAT. Yes, you have the &lt;code&gt;ip nat inside&lt;/code&gt; and &lt;code&gt;ipnat outside&lt;/code&gt; commands on the interfaces, but you have not created an ACL for the interesting traffic, nor have you enabled NAT on the router. That would look something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list 10 interface Vlan3 overload&#xA;!&#xA;access-list 10 permit 192.168.100.0 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-06T01:02:33.933" LastActivityDate="2017-01-06T01:02:33.933" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37653" PostTypeId="1" CreationDate="2016-12-29T15:08:37.687" Score="2" ViewCount="516" Body="&lt;p&gt;Two routers, ethernet link, priority both set to default of 1, R1 sits exclusively in AREA 1 with RID: 192.168.23.3.  R2 is the ABR leading to AREA 0, RID: 192.168.23.2.  No other routers in AREA 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is R2 winning the DR election?  This seems very straightforward that 192.168.23.3 RID should win for this segment.  Output of election process for perspective:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Dec 29 14:57:54.291: OSPF-10 ADJ   Fa0/0: DR/BDR election&#xA;*Dec 29 14:57:54.295: OSPF-10 ADJ   Fa0/0: Elect BDR 192.168.23.3&#xA;*Dec 29 14:57:54.295: OSPF-10 ADJ   Fa0/0: Elect DR 192.168.23.2&#xA;*Dec 29 14:57:54.295: OSPF-10 ADJ   Fa0/0: Elect BDR 192.168.23.3&#xA;*Dec 29 14:57:54.299: OSPF-10 ADJ   Fa0/0: Elect DR 192.168.23.2&#xA;*Dec 29 14:57:54.299: OSPF-10 ADJ   Fa0/0: DR: 192.168.23.2 (Id)   BDR: 192.168.23.3 (Id)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2016-12-29T16:53:29.220" Title="OSPF - Lower RID elected as DR?" Tags="|ospf|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37654" PostTypeId="2" ParentId="37653" CreationDate="2016-12-29T15:39:42.077" Score="2" Body="&lt;p&gt;R1 does not become the DR because DR election in OSPF is not preemptive.  That means that once a router (R2 in this case) becomes the DR, it remains the DR even if a new adjacency is formed with another router with a higher RID.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, a DR gets elected &quot;President for Life.&quot;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2016-12-29T16:08:09.343" LastActivityDate="2016-12-29T16:08:09.343" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37655" PostTypeId="2" ParentId="37653" CreationDate="2016-12-29T15:41:45.320" Score="1" Body="&lt;p&gt;You really haven't provided enough information to be completely sure, but a router coming up first will decide it is the DR, and if there is already a DR, there will not be a DR election unless the DR goes down. Also, according to &lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328, OSPF Version 2&lt;/a&gt;, the BDR is elected first, which appears to be the case in what you have in your question. If Router 2 is the DR, then Router 1 is elected as the BDR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The algorithm for DR/BDR election from Section 9.4:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Note the current values for the network's Designated Router and&#xA;  Backup Designated Router.  This is used later for comparison&#xA;  purposes.&lt;/li&gt;&#xA;  &lt;li&gt;Calculate the new Backup Designated Router for the network as&#xA;  follows.  Only those routers on the list that have not declared&#xA;  themselves to be Designated Router are eligible to become Backup&#xA;  Designated Router.  If one or more of these routers have declared&#xA;  themselves Backup Designated Router (i.e., they are currently&#xA;  listing themselves as Backup Designated Router, but not as&#xA;  Designated Router, in their Hello Packets) the one having highest&#xA;  Router Priority is declared to be Backup Designated Router.  In case&#xA;  of a tie, the one having the highest Router ID is chosen.  If no&#xA;  routers have declared themselves Backup Designated Router, choose&#xA;  the router having highest Router Priority, (again excluding those&#xA;  routers who have declared themselves Designated Router), and again&#xA;  use the Router ID to break ties.&lt;/li&gt;&#xA;  &lt;li&gt;Calculate the new Designated Router for the network as follows.  If&#xA;  one or more of the routers have declared themselves Designated&#xA;  Router (i.e., they are currently listing themselves as Designated&#xA;  Router in their Hello Packets) the one having highest Router&#xA;  Priority is declared to be Designated Router.  In case of a tie, the&#xA;  one having the highest Router ID is chosen.  If no routers have&#xA;  declared themselves Designated Router, assign the Designated Router&#xA;  to be the same as the newly elected Backup Designated Router.&lt;/li&gt;&#xA;  &lt;li&gt;If Router X is now newly the Designated Router or newly the Backup&#xA;  Designated Router, or is now no longer the Designated Router or no&#xA;  longer the Backup Designated Router, repeat steps 2 and 3, and then&#xA;  proceed to step 5.  For example, if Router X is now the Designated&#xA;  Router, when step 2 is repeated X will no longer be eligible for&#xA;  Backup Designated Router election.  Among other things, this will&#xA;  ensure that no router will declare itself both Backup Designated&#xA;  Router and Designated Router.&lt;/li&gt;&#xA;  &lt;li&gt;As a result of these calculations, the router itself may now be&#xA;  Designated Router or Backup Designated Router.  See Sections 7.3 and&#xA;  7.4 for the additional duties this would entail.  The router's interface state should be set accordingly.  If the router itself is&#xA;  now Designated Router, the new interface state is DR.  If the router&#xA;  itself is now Backup Designated Router, the new interface state is&#xA;  Backup. Otherwise, the new interface state is DR Other.&lt;/li&gt;&#xA;  &lt;li&gt;If the attached network is an NBMA network, and the router itself&#xA;  has just become either Designated Router or Backup Designated&#xA;  Router, it must start sending Hello Packets to those neighbors that&#xA;  are not eligible to become Designated Router (see Section 9.5.1). &#xA;  This is done by invoking the neighbor event Start for each neighbor&#xA;  having a Router Priority of 0.&lt;/li&gt;&#xA;  &lt;li&gt;If the above calculations have caused the identity of either the&#xA;  Designated Router or Backup Designated Router to change, the set of&#xA;  adjacencies associated with this interface will need to be modified.&#xA;  Some adjacencies may need to be formed, and others may need to be&#xA;  broken.  To accomplish this, invoke the event AdjOK?  on all&#xA;  neighbors whose state is at least 2-Way.  This will cause their&#xA;  eligibility for adjacency to be reexamined (see Sections 10.3 and&#xA;  10.4).&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2016-12-29T15:41:45.320" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="37658" PostTypeId="2" ParentId="37653" CreationDate="2016-12-29T16:53:29.220" Score="1" Body="&lt;p&gt;&lt;strong&gt;CREDIT:&lt;/strong&gt; &#xA;Ron Trunk and Ron Maupin generated all of the answer content, I simply produced this post for organizational purposes / clarity for future readers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ROOT CAUSE:&lt;/strong&gt;&#xA;R2 via some mechanism was already considered a DR for the link R1/R2 shared and so, regardless of it having a lower RID, it maintained it's position as the DR for that link since DR status is non-preemptive in OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ADDITIONAL CONTEXT:&lt;/strong&gt;&#xA;If there is only one router on a link which would generally elect a DR/BDR, that router may DECLARE itself the DR.  Re-election of the DR status will only happen upon the trigger of the AdjOK? event.  It appears that in the Cisco implementation of OSPF this can be generated in two ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Shutting down the DR interface (disruptive)&lt;/li&gt;&#xA;&lt;li&gt;Setting the DR interfaces priority to 0 (non-disruptive)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2016-12-29T16:53:29.220" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37664" PostTypeId="1" AcceptedAnswerId="37672" CreationDate="2016-12-29T23:11:15.793" Score="22" ViewCount="26822" Body="&lt;p&gt;Since UDP is a connectionless protocol, I'm confused by the setting on my Sonicwall Firewall for &quot;UDP Connection Timeout&quot;.  It's set at a default of 30 seconds -- but what exactly times out after 30 seconds?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/leECJ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/leECJ.png&quot; alt=&quot;WTF?&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's my actual real-world situation:&#xA;I have an NTP server in the ntp.org pool that serves about 3000 queries per minute.  This puts a bit of a strain on my SOHO grade TZ-200 -- not in terms of bandwidth; but in terms of # of connections it has passing through it.  I'm wondering if the UDP connections somehow are 'kept alive' on the SonicWall; even though they're (by definition) connectionless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing here?  What does SonicWall mean when it talks about a &quot;UDP Connection Timeout&quot;?&lt;/p&gt;&#xA;" OwnerUserId="33143" LastActivityDate="2017-06-30T07:52:03.650" Title="What does a UDP connection timeout really mean?" Tags="|sonicwall|udp|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37666" PostTypeId="1" CreationDate="2016-12-29T23:25:14.097" Score="0" ViewCount="87" Body="&lt;p&gt;So, I have switched to a gigabit internet connection at my house.  Through the internet provider's modem, I consistently get between 800-950 Mbps when I check.  But, through the wifi on the internet provider's modem, I get around 300-350 Mbps.  So, I got out my relatively new router that I thought I bought to do gigabit speeds and it still pumps out 300-350 Mbps.  So, I was in Best Buy and was talking to a guy there and he said I just needed a better router.  I got a new linksys router (MAX-STREAM AC5000) with three bands.  The 5G band I think is rated at 2166 Mbps.  Anyways, I plugged it up and now get around 500-550 with my computer plugged up a foot away.  I was going to move my computer back to where it was in the other room to see if it goes back down to 350, but 500-550 is still not even close to the speed of my wired connection..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I just dreaming in this day and age to get a gigabit wifi connection?!?  Or am I doing something wrong here?&lt;/p&gt;&#xA;" OwnerUserId="33145" LastActivityDate="2016-12-29T23:43:03.567" Title="Linksys wifi router performs 50% of wired connection" Tags="|ethernet|ieee-802.11|" AnswerCount="1" CommentCount="4" ClosedDate="2016-12-29T23:45:39.433" ContentLicense="CC BY-SA 3.0" />
  <row Id="37667" PostTypeId="2" ParentId="37664" CreationDate="2016-12-29T23:40:30.203" Score="11" Body="&lt;p&gt;Your firewall is maintaining a connection table for UDP connections.  For example, when you send a DNS query, the firewall creates an entry for that flow so that the DNS reply will be allowed back into your network.   The entries in the table time out after 30 seconds of no activity.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2016-12-29T23:40:30.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37668" PostTypeId="2" ParentId="37666" CreationDate="2016-12-29T23:43:03.567" Score="2" Body="&lt;p&gt;It's likely that your WiFi card on your laptop will only support speeds of 300-350 Mbps -- that sounds a lot like the high practical end on most mainstream WiFi adapters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that WiFi has a lot more variables that Wired Ethernet -- so &quot;Practical&quot; speed is often different that &quot;Theoretical Max&quot; speeds.&lt;/p&gt;&#xA;" OwnerUserId="33143" LastActivityDate="2016-12-29T23:43:03.567" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37670" PostTypeId="2" ParentId="37664" CreationDate="2016-12-30T02:43:09.420" Score="4" Body="&lt;p&gt;Your NTP server is behind your NAT (firewall).   UDP is connectionless from the point of view of the application and OS and for most network appliances along the way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your NAT firewall, however, it records whenever a UDP packet goes out so that a response from the other end will end up being redirected to the same computer inside your network.   These get called &quot;connections&quot; by the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, in theory, the NAT knows that the external port will be the NTP well known port, but it looks like your firewall doesn't support that.   If this is your only use for UDP through this firewall, you could set the Connection timeout to a smaller number.   Alternately, if it lets you set by application port, you could set it to a smaller time (1 second, say) for that specific port.&lt;/p&gt;&#xA;" OwnerUserId="33150" LastActivityDate="2016-12-30T02:43:09.420" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37672" PostTypeId="2" ParentId="37664" CreationDate="2016-12-30T03:50:28.173" Score="20" Body="&lt;p&gt;While there is no formal &quot;connection&quot; with UDP there is still a convention that clients send requests and expect to get responses back with the source IP and port swapped with the Destinatoin IP and port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stateful firewalls and NATs therefore assume that packets with a given combination of source IP/source port/Destination IP/Destination port and the corresponding combination with source and destination swapped form part of a &quot;connection&quot;. This allows rules like &quot;outgoing connections only&quot; to be applied to UDP and allows reverse translations to be applied to response packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately the firewall or NAT has no way of knowing when the client has finished talking to the server. So it has to wait for a timeout before removing the entry from it's state tracking tables. That is the timeout you are setting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In principle it would be possible to build a NAT box that used a stateless approach for port forwards while maintaining a stateful approach for outgoing connections but it's simpler to just use stateful NAT for everything and it sounds like this is what your vendor is doing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately as you have discovered this sucks for stateless UDP servers serving large numbers of small requests. You end up in a situation where the firewall consumes far more resources than the sever itself.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-01-02T01:12:06.273" LastActivityDate="2017-01-02T01:12:06.273" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37676" PostTypeId="1" CreationDate="2016-12-30T11:59:23.953" Score="1" ViewCount="390" Body="&lt;p&gt;I'm using Wireshark for getting all https packets and decoding them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I follow two methods in Wireshark. The first method is on this link: &lt;a href=&quot;https://wiki.wireshark.org/SSL&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wireshark SSL&lt;/a&gt;. In short, I do following things:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;generate key.bem&lt;/li&gt;&#xA;&lt;li&gt;Import to Wireshark in Protocols\SSL Section. I add an item in RSA Key List.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here is the detail:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IpAddress: 0.0.0.0&#xA;Port: 0&#xA;Protocol: HTTP&#xA;Keyfile: point to by key.bem&#xA;Password: Empty&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But When I tried to go some https page such as &lt;code&gt;https://www.google.com&lt;/code&gt;. I still cannot decode. &lt;/p&gt;&#xA;" OwnerUserId="27149" LastEditorUserId="8499" LastEditDate="2018-02-16T04:20:09.590" LastActivityDate="2018-02-16T04:20:09.590" Title="Wireshark: configure for capturing ssl data" Tags="|wireshark|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37679" PostTypeId="2" ParentId="37676" CreationDate="2016-12-30T13:41:18.793" Score="3" Body="&lt;p&gt;Decoding HTTPS traffic to / from google will only work if you have the private key of Googles webserver imported into Wireshark and the connection is not using PFS (Perfect Forward Secrecy). Otherwise any form of TLS (SSL) encryption would be pretty useless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more Details on TLS/SSL see &lt;a href=&quot;https://www.feistyduck.com/books/bulletproof-ssl-and-tls/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bulletproof SSL and TLS&lt;/a&gt; by Ivan Ristić.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2016-12-30T13:41:18.793" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="37680" PostTypeId="1" AcceptedAnswerId="37682" CreationDate="2016-12-30T14:22:02.280" Score="1" ViewCount="499" Body="&lt;p&gt;Hi I´m having problems with telnet through NAT Load Balancing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Always return when i try to do telnet 192.168.192.100 80: Destination unreachable; gateway or host down&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/3rjoE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3rjoE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ROUTER NAT config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1366 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname NAT&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 172.16.1.4 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.192.4 255.255.255.0&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip forward-protocol nd&#xA;!&#xA;ip alias 192.168.192.100 23&#xA;!&#xA;ip nat pool APACHE_LIST 176.16.1.1 176.16.1.3 prefix-length 24 type rotary&#xA;ip nat inside destination list LOADBALANCE pool APACHE_LIST&#xA;!&#xA;!&#xA;ip access-list extended LOADBALANCE&#xA; permit tcp any host 192.168.192.100 eq www&#xA; permit tcp any host 192.168.192.100 eq telnet&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In WWW routers the only configuration I´ve done was assign ip to the interface and activate ip http server and activate VTY Lines&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your time&lt;/p&gt;&#xA;" OwnerUserId="33167" LastEditorUserId="2142" LastEditDate="2016-12-30T14:29:21.390" LastActivityDate="2016-12-30T16:27:02.580" Title="NAT Load Balancing" Tags="|cisco|tcp|nat|load-balancing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37682" PostTypeId="2" ParentId="37680" CreationDate="2016-12-30T16:11:02.703" Score="2" Body="&lt;p&gt;You have a few errors in your configuration that I have spotted.  There may be more issues with how you have configured NAT.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/0&#xA; ip address 172.16.1.4 255.255.255.0&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;&#xA;ip nat pool APACHE_LIST 176.16.1.1 176.16.1.3 prefix-length 24 type rotary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The subnet assigned to your interface FastEthernet 0/0 does not match your inside local address pool.  (172.16.1.0/24 vs 176.16.1.0/24)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NAT(config)#ip alias 192.168.192.100 23&#xA;Invalid IP address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Issue a &lt;code&gt;no ip alias 192.168.192.100 23&lt;/code&gt; command.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also may want to change your duplex and speed settings.  I think that you will find the interface to be operating at half-duplex if you issue a &lt;code&gt;show int fa 0/0 | in duplex&lt;/code&gt; command.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2016-12-30T16:27:02.580" LastActivityDate="2016-12-30T16:27:02.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37683" PostTypeId="2" ParentId="37632" CreationDate="2016-12-30T17:04:55.903" Score="0" Body="&lt;p&gt;Your question is vague, to say the least.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I run a small campus single-mode fiber optic network without any &quot;media converters&quot; (so-called.) I do have switches with both copper and SFP ports, and those do convert from one transport to the other, generally at far more attractive prices and with better performance than most &quot;media converters.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether done by a &quot;converter&quot; or a switch, conversion allows the data to flow to devices with different interface types, or through a medium that has better performance (such as length between nodes) that's between two devices with the same interface type. I can't run 4000 feet of copper between two computers, but I can run 100 feet of copper to a switch connected to 3850 feet of fiber connected to another switch connected to 50 feet of copper connected to the other computer; And when a thunderstorm comes along, I'm very happy not to have copper between them.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2016-12-30T17:04:55.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37689" PostTypeId="1" CreationDate="2016-12-31T13:07:30.530" Score="1" ViewCount="253" Body="&lt;p&gt;We are planning to connect a pair of QFX 5200 (QFX is a WAN device where ISP connections terminates) and a pair Fortinet 3800. Fortinet further connects to my LAN core switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For redundancy purpose we are planning to connect QFX and Fortinet in criss-cross so the each QFX will connect to each Fortinet. Now, Fortinet that runs in HA mode (active-active), should be able to talk to the same gateway IP in QFX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each QFX has L3 separation no L2 link between them. So I cannot run VRRP on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, how do I provide redundant out going gateway in QFX. In each QFX I can have an aggregated interface and assign a IP to it. But I cannot have two WAN outgoing gateway IPs in the Fortinet without vrrp. In Fortinet HA mode, it is just one single config for both units. It internally syncs the config to other firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts?&lt;/p&gt;&#xA;" OwnerUserId="22114" LastEditorUserId="22114" LastEditDate="2016-12-31T13:24:54.153" LastActivityDate="2018-11-30T05:01:45.313" Title="QFX 5200 and Fortinet 3800 connectivity" Tags="|juniper|fortinet|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37694" PostTypeId="2" ParentId="34553" CreationDate="2017-01-01T01:20:41.587" Score="-1" Body="&lt;p&gt;The third party components will work fine.  If you find otherwise, I would love to hear back...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't resell them as Cisco though.  People have gone to prison for doing so...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if you tell Cisco TAC they will void your SMARTnet contract out.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-01T01:20:41.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37695" PostTypeId="2" ParentId="34553" CreationDate="2017-01-01T01:58:27.697" Score="1" Body="&lt;p&gt;So the obvious question is how much all that media converter stuff costs versus just buying a cheap 10G NIC with an SFP+ port and using fiber, twinax or AOC to achieve a sane and supportable result?  Will the converter work?  Sure - most likely... will it be supportable and stable?  It's definitely outside the realm of best practice.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-01T01:58:27.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37698" PostTypeId="2" ParentId="34259" CreationDate="2017-01-01T08:38:10.767" Score="2" Body="&lt;p&gt;Check the ssl inspection. If you don't configure SSL inspection the fortigate won't block HTTPS web pages&lt;/p&gt;&#xA;" OwnerUserId="28155" LastActivityDate="2017-01-01T08:38:10.767" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37700" PostTypeId="1" CreationDate="2017-01-01T16:26:21.373" Score="1" ViewCount="4042" Body="&lt;p&gt;Maybe I do not correctly understand the two things, but doesn't Source NAT always require destination NAT to work? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say, we have two stations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A: 192.168.0.10&#xA;B: 192.168.0.20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And a router with a public IP: 10.11.12.13 that is doing Source NAT, so it changes the source address of all packets from A and B to 10.11.12.13.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how should they ever get a response? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Isn't my home router doing both source and destination NAT?&lt;/p&gt;&#xA;" OwnerUserId="33198" LastActivityDate="2017-01-06T12:55:51.293" Title="Source NAT and Destination NAT" Tags="|nat|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37703" PostTypeId="2" ParentId="37700" CreationDate="2017-01-01T20:50:21.397" Score="1" Body="&lt;p&gt;One man's source is another man's destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But seriously, the terms source and destination are relative to some reference, and in this case, it's the device doing the translation.  So from your router's point of view, the source is its internal network.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-01T20:50:21.397" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37704" PostTypeId="2" ParentId="37700" CreationDate="2017-01-01T22:28:06.277" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Maybe I do not correctly understand the two things, but doesn't Source NAT always require destination NAT to work? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That rather depends on exactly how you define those terms.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At a packet level for NAT to work translation of the packets belonging to a particular connection must be symetrical. If the outgoing packets have their source address (and possiblly port) changed the responses to those packets must have their destination address (and possiblly port) changed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are various approaches to handling this at an administrative and state-tracking level.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The approach taken by iptables on linux (a common implementation used on home/SMB routers among other places) is connection-orientated. The first packet of a new connection passes through the chains in the &quot;nat&quot; table. Based on those tables mappings are set up that apply to all packets for the connection. Later packets belonging to the connection don't pass through the chains in the &quot;nat&quot; table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when one of your machines connects to a sever on the Internet the following happens.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Your client sends to initial packet.&lt;/li&gt;&#xA;&lt;li&gt;The router gets the initial packet, determines it relates to a new connection and passes it through the chains in the &quot;nat table&quot;. The packet is matched against the SNAT rule.&lt;/li&gt;&#xA;&lt;li&gt;The router modifies the source address. It may also modify the source port if the rule requested a randomised source port or if needed to disambiguate return traffic.&lt;/li&gt;&#xA;&lt;li&gt;The router creates an entry in it's connection tracking tables describing the new connection and the translations that were performed on it.&lt;/li&gt;&#xA;&lt;li&gt;The router sends the packet onwards towards the internet.&lt;/li&gt;&#xA;&lt;li&gt;The server crafts a reply, swapping source and destination IP and port as normal.&lt;/li&gt;&#xA;&lt;li&gt;The router gets the reply packet, looks it up in it's connection tracking tables and determines it is related to an existing connection. It changes the destination IP and possibly port.&lt;/li&gt;&#xA;&lt;li&gt;The client gets it's reply with the expected addresses and ports.&lt;/li&gt;&#xA;&lt;li&gt;Further packets relating to the connection continue to be translated based on the information in the connection tracking tables. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-01-06T12:55:51.293" LastActivityDate="2017-01-06T12:55:51.293" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37707" PostTypeId="2" ParentId="29863" CreationDate="2017-01-02T01:39:35.830" Score="0" Body="&lt;p&gt;It depends on the switches and how they are configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switches support IGMP snooping and are configured to use it then the multicast traffic should be limited to the nodes that have joined the multicast groups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if the switches don't support IGMP spoofing or it is disabled then the traffic will be flooded to all ports. This could easily cause significant network problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tread carefully when using multicast.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-02T01:39:35.830" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37710" PostTypeId="1" AcceptedAnswerId="37711" CreationDate="2017-01-02T09:24:45.580" Score="1" ViewCount="720" Body="&lt;p&gt;I just want to know if it's possible to implement mLACP (with VSS) or vPC on L3 interfaces. I just can't find any answer to this on cisco doc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="24395" LastActivityDate="2017-01-02T22:41:10.103" Title="mLACP or vPC on L3 interfaces" Tags="|cisco|layer3|etherchannel|vpc|vss|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37711" PostTypeId="2" ParentId="37710" CreationDate="2017-01-02T09:30:16.427" Score="2" Body="&lt;p&gt;(m)LACP and vPC are Layer 2 technologies, thus they don't apply to layer 3 interfaces&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At layer 3 you use for example VRRP (to provide gateway to hosts) or routing protocols (like OSPF) to achieve redundancy and automatic switchover.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-01-02T09:30:16.427" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37720" PostTypeId="1" CreationDate="2017-01-02T21:11:48.953" Score="1" ViewCount="486" Body="&lt;p&gt;I do have 3 networks 192.24.0.0/21 - 192.24.8.0/22 - 192.24.16.0/20 , I need to aggregate those addresses, I calculated the appropriate address which is 192.24.0.0/19 , now I want to simulate all that in packettracer, so I've configurated the 3 routers but I don't know how to configurate the one which take the aggregation address, I tried :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;## first router ##&#xA;Cambridge(config)#interface FastEthernet0/0&#xA;Cambridge(config-if)#ip addr 192.24.7.1 255.255.248.0&#xA;&#xA;## second router ##&#xA;Edimbourg(config)#dfinterface fastethernet 1/0&#xA;Edimbourg(config-if)#ip addr 192.24.11.1 255.255.252.0&#xA;&#xA;## third router ##&#xA;Oxford(config)#interface FastEthernet1/1&#xA;Oxford(config-if)#ip address 192.24.31.1 255.255.240.0&#xA;&#xA;## Main router ##&#xA;Router(config)#route bgp 1&#xA;Router(config-router)#aggregate-address 192.24.0.0 255.255.224.0&#xA;                      ^&#xA;% Invalid input detected at '^' marker. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it generates an error on CLI &#xA;&lt;a href=&quot;https://i.stack.imgur.com/yXejK.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yXejK.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33231" LastEditorUserId="33231" LastEditDate="2017-01-02T21:45:48.213" LastActivityDate="2017-01-03T02:32:07.640" Title="aggregate address on packet tracer" Tags="|packet-tracer|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37721" PostTypeId="2" ParentId="37710" CreationDate="2017-01-02T22:41:10.103" Score="1" Body="&lt;p&gt;Yes, you can absolutely.  You can setup a Port-Channel interface and set it with an IP. This is referred to as a Layer 3 port-channel and you can run routing protocols over it as needed.  This will work regardless of if you are running this directly on the same switch or over a mLACP/ vPC.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int po1&#xA;description Uplink &#xA;ip address 10.0.1.1 255.255.255.0 &#xA;no switchport&#xA;&#xA;int gi1/1/2&#xA;no switchport    (--- important that all interfaces are in layer 3&#xA;channel-group 1 mode active&#xA;&#xA;int eth2/1/2&#xA;no switchport    (--- important that all interfaces are in layer 3&#xA;channel-group 1 mode active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This would be a very bare bones example. &lt;/p&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-01-02T22:41:10.103" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37722" PostTypeId="2" ParentId="37627" CreationDate="2017-01-02T23:07:41.587" Score="3" Body="&lt;p&gt;I think what the question is about is if BGP will install the summarized route, if that middle subnet does not existing in the IP Route table.  If that's the case, then the answer is yes, it will as long as one of the routes is in the BGP table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip bgp | i 192.168.0.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'd want to look to see if the 192.168.0.0/28 or 192.168.0.32/28 routes exist there.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 64999&#xA;network 192.168.0.0 mask 255.2555.255.240&#xA;network 192.168.0.32 mask 255.255.255.240&#xA;aggregate-address 192.168.0.0 255.255.255.192 summary-only&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More info can be seen at &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/19345-bgp-noad.html#topic5&quot; rel=&quot;nofollow noreferrer&quot;&gt;Troubleshooting When BGP Routes Are Not Advertised&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Routes Announced Using the aggregate-address Command BGP allows the aggregation of specific routes into one route using the&#xA;  aggregate-address address mask command. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Aggregation applies to routes that exist in the BGP routing table.&#xA;  This is in contrast to the network command, which applies to the&#xA;  routes that exists in IP routing table. Aggregation can be performed&#xA;  if at least one or more of the specific routes of the aggregate&#xA;  address exists in the BGP routing table. Refer to Understanding Route&#xA;  Aggregation in BGP for more information on BGP aggregation and&#xA;  associated attributes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-01-02T23:07:41.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37723" PostTypeId="2" ParentId="37720" CreationDate="2017-01-03T02:25:45.623" Score="2" Body="&lt;p&gt;Packet tracer 7.0 doesn't appear to include the ability to summarize.  Here're the only commands available to me on any of the available routers in 7.0, including those running the simulated version of 15.x:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config-router)#?&#xA;  bgp              BGP specific commands&#xA;  distance         Define an administrative distance&#xA;  exit             Exit from routing protocol configuration mode&#xA;  neighbor         Specify a neighbor router&#xA;  network          Specify a network to announce via BGP&#xA;  no               Negate a command or set its defaults&#xA;  redistribute     Redistribute information from another routing protocol&#xA;  synchronization  Perform IGP synchronization&#xA;  timers           Adjust routing timers&#xA;Router(config-router)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="13361" LastEditDate="2017-01-03T02:32:07.640" LastActivityDate="2017-01-03T02:32:07.640" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37725" PostTypeId="1" AcceptedAnswerId="37780" CreationDate="2017-01-03T08:46:43.120" Score="5" ViewCount="696" Body="&lt;p&gt;Im trying to measure our cisco router availability data based on downtime happened. I assume from show version, the time mentioned in tag &quot;System returned to ROM&quot; is when reload started, and next line &quot;System restarted at&quot; is when router back online again. The only thing confusing is RouterA node showing exact time when returned to ROM while RouterB is not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know the different? And how to make RouterB shows the exact time router reloaded next time on the show version command print out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterA#show version&#xA;Cisco IOS Software, s72033_rp Software (s72033_rp-ITPK9V-M), Version 12.2(33)IRI, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2012 by Cisco Systems, Inc.&#xA;Compiled Fri 04-May-12 14:04 by prod_rel_team&#xA;&#xA;ROM: System Bootstrap, Version 12.2(17r)S4, RELEASE SOFTWARE (fc1)&#xA;&#xA; RouterA uptime is 4 years, 11 weeks, 5 days, 17 hours, 27 minutes&#xA;Uptime for this control processor is 4 years, 11 weeks, 5 days, 17 hours, 19 minutes&#xA;System returned to ROM by reload at 00:01:24 JAVT Thu Oct 11 2012 (SP by reload)&#xA;System restarted at 00:05:58 JAVT Thu Oct 11 2012&#xA;System image file is &quot;bootdisk:s72033-itpk9v-mz.122-33.IRI.bin&quot;&#xA;Last reload type: Normal Reload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RouterB#show version&#xA;Cisco IOS Software, s72033_rp Software (s72033_rp-ITPK9V-M), Version 12.2(33)IRI, RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2012 by Cisco Systems, Inc.&#xA;Compiled Fri 04-May-12 14:04 by prod_rel_team&#xA;&#xA;ROM: System Bootstrap, Version 12.2(17r)S4, RELEASE SOFTWARE (fc1)&#xA;&#xA; RouterB uptime is 4 years, 11 weeks, 6 days, 16 hours, 29 minutes&#xA;Uptime for this control processor is 4 years, 11 weeks, 6 days, 16 hours, 25 minutes&#xA;System returned to ROM by reload (SP by reload)&#xA;System restarted at 01:04:31 JAVT Wed Oct 10 2012&#xA;System image file is &quot;bootdisk:s72033-itpk9v-mz.122-33.IRI.bin&quot;&#xA;Last reload type: Normal Reload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33239" LastEditorUserId="33239" LastEditDate="2017-01-11T03:59:43.923" LastActivityDate="2018-08-04T17:01:07.187" Title="Time Cisco Router reload not always mentioned" Tags="|cisco|router|cisco-ios|cisco-commands|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37727" PostTypeId="2" ParentId="8288" CreationDate="2017-01-03T10:33:27.467" Score="2" Body="&lt;p&gt;MTU is maximum IP packet size of a given link.&#xA;MSS is Maximum TCP segment size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MTU is used for fragmentation i.e packet larger than MTU is fragmented.But in case of &#xA;MSS, packet larger than MSS is discarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MSS is specified during TCP handshake basically in SYN and its value can't be changed after the connection is established.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MSS=MTU-40(IP header(20 bytes) + TCP header(20 bytes) )&lt;/p&gt;&#xA;" OwnerUserId="33243" LastActivityDate="2017-01-03T10:33:27.467" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37729" PostTypeId="2" ParentId="22645" CreationDate="2017-01-03T11:17:09.580" Score="2" Body="&lt;p&gt;Make sure the routers RIP configurations are as shown below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For R1,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; network 192.168.1.0&#xA; no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For R2,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; network 192.168.2.0&#xA; no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and R3,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; network 192.168.2.0&#xA; no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above configuration makes the Routing Protocol to work 100%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are the Routes in the Routing tables of the following routers,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh ip route&#xA;Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area&#xA;       * - candidate default, U - per-user static route, o - ODR&#xA;       P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/30 is subnetted, 2 subnets&#xA;R       10.1.1.0 [120/1] via 10.1.1.5, 00:00:05, Serial0/0/0&#xA;C       10.1.1.4 is directly connected, Serial0/0/0&#xA;C    192.168.1.0/24 is directly connected, FastEthernet0/0&#xA;     192.168.2.0/25 is subnetted, 2 subnets&#xA;R       192.168.2.0 [120/1] via 10.1.1.5, 00:00:05, Serial0/0/0&#xA;R       192.168.2.128 [120/2] via 10.1.1.5, 00:00:05, Serial0/0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For R2,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sh ip  route&#xA;Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area&#xA;       * - candidate default, U - per-user static route, o - ODR&#xA;       P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/30 is subnetted, 2 subnets&#xA;C       10.1.1.0 is directly connected, Serial0/0/1&#xA;C       10.1.1.4 is directly connected, Serial0/0/0&#xA;R    192.168.1.0/24 [120/1] via 10.1.1.6, 00:00:02, Serial0/0/0&#xA;     192.168.2.0/25 is subnetted, 2 subnets&#xA;C       192.168.2.0 is directly connected, FastEthernet0/0&#xA;R       192.168.2.128 [120/1] via 10.1.1.1, 00:00:12, Serial0/0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and R3,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#sh ip route&#xA;Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP&#xA;       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area&#xA;       * - candidate default, U - per-user static route, o - ODR&#xA;       P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;     10.0.0.0/30 is subnetted, 2 subnets&#xA;C       10.1.1.0 is directly connected, Serial0/0/0&#xA;R       10.1.1.4 [120/1] via 10.1.1.2, 00:00:11, Serial0/0/0&#xA;R    192.168.1.0/24 [120/2] via 10.1.1.2, 00:00:11, Serial0/0/0&#xA;     192.168.2.0/25 is subnetted, 2 subnets&#xA;R       192.168.2.0 [120/1] via 10.1.1.2, 00:00:11, Serial0/0/0&#xA;C       192.168.2.128 is directly connected, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="33246" LastEditorUserId="8499" LastEditDate="2017-01-03T15:10:26.817" LastActivityDate="2017-01-03T15:10:26.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37731" PostTypeId="1" CreationDate="2017-01-03T12:11:38.853" Score="1" ViewCount="171" Body="&lt;p&gt;I am facing STP issue in my network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured STP protocol in two branches like Building A and Building B both are Cisco SG300 24 port switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I configured dual Link primary and secondary which is connected in GE25 and GE26 Since 1.5 years working normal. (GE25 is the ROOT port and GE26 is the alternate)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;right now i am facing some issue like getting packet drops and flapping. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;While i am checking the logs and States is continuously changing the states listening, forwarding and blocking and some time port status is getting down and Up &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any one help us to resolve the issue &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/13IOv.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/13IOv.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20971" LastEditorUserId="20971" LastEditDate="2017-01-03T12:29:38.340" LastActivityDate="2017-01-03T15:03:22.660" Title="STP Protocol issue" Tags="|cisco|switch|switching|spanning-tree|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="37732" PostTypeId="1" AcceptedAnswerId="37738" CreationDate="2017-01-03T12:18:41.253" Score="2" ViewCount="3882" Body="&lt;p&gt;I know that the latest Cisco Routers can be used as DHCP server. &lt;br&gt;&#xA;I have 2 questions: &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Can Cisco Routers be used as DNS server too?&lt;/li&gt;&#xA;&lt;li&gt;Can router, that is used as DHCP server, lease ip addresses to specific MAC addresses (as in usual DHCP server)?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23552" LastEditorUserId="23552" LastEditDate="2017-01-04T05:15:21.700" LastActivityDate="2017-01-04T05:15:21.700" Title="Can Cisco Router be used as DNS server?" Tags="|router|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37734" PostTypeId="1" AcceptedAnswerId="37740" CreationDate="2017-01-03T12:42:03.570" Score="2" ViewCount="2742" Body="&lt;p&gt;I know that it's not recommended to assign the network and broadcast addresses to a host but is there any way/hack using which you can assign them?&lt;/p&gt;&#xA;" OwnerUserId="33242" LastActivityDate="2017-01-03T14:32:38.527" Title="Is it possible to assign network and broadcast addresses to hosts in the same network?" Tags="|broadcast|ip-address|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37737" PostTypeId="2" ParentId="37734" CreationDate="2017-01-03T14:07:01.603" Score="1" Body="&lt;p&gt;There is no need to assign a broadcast or network address to a host. When you have assigned an address to a host, based on the subnetmask, the host will calculate based on the mask what to use for network and broadcast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Linux hosts you can already add the network and broadcast address in the interface file but I have no idea what the point of it is.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastEditorUserId="27056" LastEditDate="2017-01-03T14:24:46.930" LastActivityDate="2017-01-03T14:24:46.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37738" PostTypeId="2" ParentId="37732" CreationDate="2017-01-03T14:15:43.760" Score="4" Body="&lt;p&gt;There is a way to configure DNS server on your Cisco router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first portion enables the DNS service on the router and enables lookups on the local router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1# configure terminal&#xA;R1(config)# ip dns server&#xA;R1(config)# ip domain-lookup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The next step is to configure upstream DNS servers for lookups that you do not have entries for. This is optional if you only want to lookup names that you specify and no other.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)# ip name-server 8.8.8.8&#xA;R1(config)# ip name-server 4.4.4.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The next step allows you to create manual entries on the router for entries host1, host2 and host3 which will resolve to the IP address at the end,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)# ip host host1 192.168.1.10&#xA;R1(config)# ip host host2 192.168.1.11&#xA;R1(config)# ip host host3 192.168.1.12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When you perform name resolution on the router, you will get the correct IP address that you have added in the previous steps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just make sure your other clients use the &lt;strong&gt;routers&lt;/strong&gt; IP address to use the DNS service on the router itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DHCP POOL WITH RESERVATIONS&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your DHCP server question. You can use the client identifier to reserve by MAC address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool MYPOOL&#xA;   host 10.0.0.10 255.255.255.0&#xA;   client-identifier 0123.1e9e.99de.aa12&#xA;   default-router 10.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2017-01-03T14:15:43.760" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37739" PostTypeId="2" ParentId="37734" CreationDate="2017-01-03T14:23:32.077" Score="1" Body="&lt;p&gt;You will often see this scenario on point to point links. eg. (172.16.0.0/31 and 172.16.0.1/31). &lt;a href=&quot;http://www.faqs.org/rfcs/rfc3021.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3021&lt;/a&gt; describes this situation for conserving address space. &lt;a href=&quot;http://packetlife.net/blog/2008/jun/18/using-31-bit-subnets-on-point-point-links/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Packetlife&lt;/a&gt; has a good blog post about this as well. &lt;/p&gt;&#xA;" OwnerUserId="15501" LastActivityDate="2017-01-03T14:23:32.077" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37740" PostTypeId="2" ParentId="37734" CreationDate="2017-01-03T14:32:38.527" Score="1" Body="&lt;p&gt;On linux it is possible to create a network where the first and last addresses are not special and can be used as regular host addresses as follows.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Assign the IP addresses to the interface with a /32 netmask&lt;/li&gt;&#xA;&lt;li&gt;Add an explicit route with the netmask you want.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I do not know if the same trick will work on other operating systems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example that creates two network namespaces and a virtual network between them using the .0 and .255 addresses.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip netns add blue&#xA;ip netns add red&#xA;ip netns exec red ip link set dev lo up&#xA;ip netns exec blue ip link set dev lo up&#xA;ip link add veth0 type veth peer name veth1&#xA;ip link set veth0 netns red&#xA;ip link set veth1 netns blue&#xA;ip netns exec red ip link set dev veth0 up&#xA;ip netns exec red ip addr add 192.168.168.0/32 dev veth0&#xA;ip netns exec red ip route add 192.168.168.0/24 dev veth0&#xA;ip netns exec blue ip link set dev veth1 up&#xA;ip netns exec blue ip addr add 192.168.168.255/32 dev veth1&#xA;ip netns exec blue ip route add 192.168.168.0/24 dev veth1&#xA;ip netns exec red ping 192.168.168.255&#xA;ip netns exec blue ping 192.168.168.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-03T14:32:38.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37741" PostTypeId="2" ParentId="37731" CreationDate="2017-01-03T15:03:22.660" Score="3" Body="&lt;p&gt;It seems that you are not having an STP issue, but a cable issue.  Any time a non-portfast enabled port goes up or down, a STP change (TCN) is sent and the port will cycle through the spanning tree states you see.  Try running &lt;code&gt;show int &amp;lt;port&amp;gt;&lt;/code&gt; for both the interfaces on both switches to see if you have any errors such as CRC.  It's possible you have a bad cable or Gbic.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you may want to consider changing these links to an etherchannel, instead of using STP to manage the redundancy.  Doing this will ensure a faster failover in the event of an issue and increase the link bandwidth because both ports will be fowarding instead of one in blocking. &lt;/p&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-01-03T15:03:22.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37742" PostTypeId="1" AcceptedAnswerId="37747" CreationDate="2017-01-03T15:47:36.627" Score="1" ViewCount="390" Body="&lt;p&gt;I have this 10Gbps Netgear switch (XS748T), but for some reason I can't get it to light up with devices that seem to be 100Mbps. I've tested this with all different cables, devices, and other switches to make sure the devices and cables work. Works well with 1Gbps and 10Gbps, but just not the 100Mbps...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also have a XS716T switch, which is the same model, just 16 ports instead of 48 ports, and both are fully updated in terms of firmware, and the 16 port 10Gbps switch works just great out of the box with anything I connect it to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first I thought this was just a bad switch, and so did the Netgear support guy, to which he approved an RMA, and sent this second switch, except it is acting in exactly the same fashion, leaving me to believe that this might be a configuration issue and not an issue with the switch itself. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've checked the configuration settings side by side as best I could with the working 16 port and the not working 48 port and can't seem to find any differences between them, is there something that I'm missing?&lt;/p&gt;&#xA;" OwnerUserId="32425" LastActivityDate="2018-10-05T04:05:13.280" Title="Netgear XS748T switch not connecting to 100Mbps devices" Tags="|switch|netgear-prosafe|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37743" PostTypeId="1" AcceptedAnswerId="37750" CreationDate="2017-01-03T16:03:05.510" Score="1" ViewCount="58" Body="&lt;p&gt;How can a computer have a &lt;strong&gt;session&lt;/strong&gt; with another computer without going through the transport, network, data link and physical layers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I took this information from &lt;a href=&quot;https://youtu.be/HEEnLZV2wGI?t=10m8s&quot; rel=&quot;nofollow noreferrer&quot;&gt;this video&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="24049" LastActivityDate="2017-01-03T18:43:08.150" Title="Already session between two computers before going through layers?" Tags="|protocol-theory|osi|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37744" PostTypeId="1" CreationDate="2017-01-03T16:51:53.607" Score="3" ViewCount="234" Body="&lt;p&gt;At work we have 5 engineers that all have the same test bench setup in their area. Each test bench has 10 modules, each of which have an ip address &quot;burned/assigned in firmware by the manufacture. Each model of module all have the same IP and can not be changed. So only one engineer at a time can have their test bench connected to the network at a time or else they all interfere/control each others test bench. There is one Ethernet jack (from company network) in each area for their laptop (the laptop gets an IP via DHCP). The laptop needs to connect to the test bench and the rest of the company network for internet, servers, printers, email, etc. The test bench only needs to have communication to the laptop. Currently they unplug the laptop from the company network and plug it into a switch on the test bench but have to go back and forth when they need to access documentation and internet. They have tired adding a USB NIC to the laptop and the software for the modules doesnt ever work with 2 NICs (it looks for the modules out the wrong NIC due to the addressing scheme). I have purchased a Cisco 1811 Router/Switch combo for the solution. Should cover the task and be budget friendly. I have a block of static IP's set aside for this. I have thought of a half a dozen different ways to try this. I am perhaps overthinking the configuration on the 1811 for this so i am asking for help. The IP address of the modules are 192.168.81.6, 7,8,9,20,56,60,61,76,86. Our company network uses the 192.168.80 and 192.168.81.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for your help in advance, I appreciate your time.&lt;/p&gt;&#xA;" OwnerUserId="33254" LastActivityDate="2018-04-29T13:26:23.497" Title="Unique Cisco problem/situation to solve..." Tags="|cisco|routing|nat|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37745" PostTypeId="1" CreationDate="2017-01-03T16:58:04.890" Score="0" ViewCount="154" Body="&lt;p&gt;I have just had a lecture on VPNs and RADIUS and have a question with regards to authentication. I am aware of protocols such as EAP and PEAP and was wondering how these protocols work alongside RADIUS, if at all. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately as the question title suggests, if a user would like to connect to a network device on an internal network using SSL VPN how would they authenticate? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial thoughts were that the VPN server defines an authentication protocol such as EAP, the user then provides the correct credentials in accordance with the protocol and the VPN server acting as a RADIUS client forwards the data to the RADIUS server using the RADIUS protocol. The RADIUS server looks up the given credentials and if correct issues an acceptance message. The user is then authenticated and the VPN server can allow access to the network resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would be grateful if someone could give me some guidance. I appteciate that my initial thoughts may be completely incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="32935" LastActivityDate="2017-01-03T22:44:05.897" Title="How VPNs authenticate a user using RADIUS" Tags="|vpn|authentication|radius|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37746" PostTypeId="2" ParentId="37744" CreationDate="2017-01-03T16:59:34.507" Score="0" Body="&lt;p&gt;You can run 2 NICs on PC/laptop simultaneously.  The trick is that DHCP can only be enabled on one at a time (bcs only 1 default gateway).  Also, you may need to add some host routes if resources reachable through the second NIC are on a different subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://serverfault.com/questions/100011/windows-7-route-single-ip-over-different-interface-wlan&quot;&gt;https://serverfault.com/questions/100011/windows-7-route-single-ip-over-different-interface-wlan&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2017-01-03T16:59:34.507" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37747" PostTypeId="2" ParentId="37742" CreationDate="2017-01-03T17:04:20.853" Score="3" Body="&lt;p&gt;I have just been looking at the datasheet for those models.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;XS716T&lt;/strong&gt; supports 16x 100M/1G/10G Copper Ports&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;strong&gt;XS748T&lt;/strong&gt; does not support any 100M but 44 x 1G/10G so this is your issue and why you are seeing that it works on the XS716T but not the XS748T.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found this information &lt;a href=&quot;http://www.netgear.co.uk/images/Products/Switches/SmartSwitches/10Gigabitsmartswitchseries/XS708T_XS716T_XS728T_XS748T_DS_15Apr16.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; on page 2.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2017-01-03T17:04:20.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37749" PostTypeId="1" AcceptedAnswerId="37758" CreationDate="2017-01-03T18:38:20.923" Score="-1" ViewCount="602" Body="&lt;p&gt;(On-the-fly) packet de-duplication is an advertised feature of some devices in which exact copies of packets can be allegedly filtered out at near line-speed. Ignoring the plausibility of this working in the real world (just think of the amounts of data, how many packets or for which can you realistically store and retrieve for comparison?) for now, what would be valid use cases?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't think of any use cases apart from&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;those arising from a bad (monitoring) network design&lt;/li&gt;&#xA;&lt;li&gt;those arising from technical limitations of monitoring features, e.g. one spam port for everything&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I wouldn't consider such uses cases valid, so are there any that don't fall into these categories? Or am I right in my assumption that none exist and that in a perfect world this feature would be needed?&lt;/p&gt;&#xA;" OwnerUserId="27647" LastEditorUserId="27647" LastEditDate="2017-01-07T14:09:16.480" LastActivityDate="2017-01-08T01:26:12.557" Title="Valid use cases for packet deduplication?" Tags="|design|monitoring|" AnswerCount="2" CommentCount="13" ClosedDate="2018-08-05T20:09:18.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="37750" PostTypeId="2" ParentId="37743" CreationDate="2017-01-03T18:43:08.150" Score="3" Body="&lt;p&gt;The video is a little misleading, IMO.  Remember that the OSI model is an idealized abstraction, and doesn't accurately represent anything actually in use.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the video talks about creating a session with another computer, it is a logical connection.  That means the session functions on one computer are understood and processed by the corresponding session functions on the other.  But that is a logical connection -- the data still goes through the encapsulation/de-encapsulation of the other layers. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-03T18:43:08.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37751" PostTypeId="1" CreationDate="2017-01-03T18:46:17.167" Score="2" ViewCount="280" Body="&lt;p&gt;We had DDoS couple days ago and following is netflow data but i am confused with numbers which i am seeing here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you look at first &lt;code&gt;Bytes(%)&lt;/code&gt; column &lt;code&gt;67.2 G(80.6)&lt;/code&gt; so it's in GB what does this means? I have checked network interface graph and i am seeing only &lt;code&gt;2G&lt;/code&gt; spike in link.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Top 10 IP Addr ordered by packets:&#xA;Date first seen          Duration Proto           IP Addr    Flows(%)     Packets(%)       Bytes(%)         pps      bps   bpp&#xA;2017-01-02 13:49:03.031   960.927 any        70.xx.xx.26    18659( 1.5)   52.3 M(29.4)   67.2 G(80.6)    54456  559.6 M  1284&#xA;2017-01-02 13:56:24.412   258.948 any       23.xx.xx.62        9( 0.0)   15.8 M( 8.9)   21.9 G(26.3)    60904  677.0 M  1389&#xA;2017-01-02 13:49:02.981   961.013 any         70.xx.xx.6    76721( 6.0)   15.3 M( 8.6)    2.1 G( 2.5)    15957   17.4 M   136&#xA;2017-01-02 13:49:03.029   960.970 any         70.xx.xx.5    76277( 5.9)   15.1 M( 8.5)    2.1 G( 2.5)    15675   17.1 M   136&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;EDIT&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;Netflow config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;flow record netflow-record&#xA; match ipv4 destination address&#xA; match ipv4 source address&#xA; match transport destination-port&#xA; match transport source-port&#xA; match ipv4 protocol&#xA; collect counter bytes&#xA; collect counter packets&#xA; collect timestamp sys-uptime first&#xA; collect timestamp sys-uptime last&#xA;!&#xA;flow exporter netflow-exporter&#xA; destination x.x.x.x&#xA; source TenGigabitEthernet0/0/0&#xA; transport udp 9995&#xA;!&#xA;flow monitor netflow-monitor&#xA; exporter netflow-exporter&#xA; cache timeout active 60&#xA; record netflow-record&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2017-01-04T16:51:22.253" LastActivityDate="2017-05-04T20:25:19.787" Title="Netflow and Nfsen related question" Tags="|cisco|router|netflow|network|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="37753" PostTypeId="2" ParentId="20943" CreationDate="2017-01-03T20:45:56.263" Score="2" Body="&lt;p&gt;Following the steps from &lt;a href=&quot;http://arstechnica.com/civis/viewtopic.php?t=46654&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; you should be able to reset the password.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. Connect to the router using a RS-232 cable&#xA;2. Connect to the router via HyperTerminal&#xA;3. Settings for HyperTerminal = 9600 - 8 - None - 1 Flow Control = None&#xA;4. Power cycle the router and right away press the s key continuously until you see the login prompt &amp;gt; &#xA;   (Starts up with current release but no configuration)&#xA;5. You will now have to Delete the previous manager password configuration line described below using the internal text editor.&#xA;   The editor is invoked with the command: &#xA;   EDIT filename.cfg (filename is the name of you config file) &#xA;   Delete the line that states: &#xA;   set user=manager pass=3af00c6cad11f7ab5db4467b66ce503eff priv=manager &#xA;   Save and exit editor by pressing the key sequence of Ctrl k x&#xA;6. Now, type the command &amp;gt;restart router to reload the original configuration. &#xA;   The Manager password is now regenerated as &quot;friend&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33260" LastActivityDate="2017-01-03T20:45:56.263" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37756" PostTypeId="2" ParentId="37745" CreationDate="2017-01-03T22:44:05.897" Score="-1" Body="&lt;p&gt;&lt;a href=&quot;https://technet.microsoft.com/en-us/library/bb457039.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Microsoft says it well&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Architecturally, an EAP infrastructure consists of the following:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;EAP peer Computer that is attempting to access a network, also known    as an access client. EAP authenticator An access point or&#xA;  network    access server (NAS) that is requiring EAP authentication&#xA;  prior to    granting access to a network.&lt;/li&gt;&#xA;  &lt;li&gt;Authentication server A server computer    that negotiates the use of a specific EAP method with an EAP peer,    validates the EAP peer's&#xA;  credentials, and authorizes access to the    network.&lt;/li&gt;&#xA;  &lt;li&gt;Typically, the authentication server is a Remote    Authentication Dial-In User Service (RADIUS) server.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;EAP is extensible through EAP methods that plug-in at both the EAP&#xA;  peer and authenticating server ends of a connection. To add support&#xA;  for a new EAP method, you install an EAP method library file on both&#xA;  the EAP peer and the authenticating server. This capability to extend&#xA;  EAP provides vendors with the opportunity to create new authentication&#xA;  schemes. EAP provides the highest flexibility to allow for more secure&#xA;  authentication methods.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The EAP peer and the EAP authenticator send EAP messages using a&#xA;  supplicant-a software component that uses EAP to authenticate network&#xA;  access-and a data link layer transport protocol such as PPP or IEEE&#xA;  802.1X. The EAP authenticator and the authentication server send EAP messages using RADIUS. The end result is that EAP messages are&#xA;  exchanged between the EAP components on the EAP peer and the&#xA;  authentication server. The following figure shows EAP infrastructure&#xA;  and information flow.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/e5DMI.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e5DMI.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-03T22:44:05.897" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37757" PostTypeId="2" ParentId="37751" CreationDate="2017-01-04T00:21:22.380" Score="2" Body="&lt;p&gt;The column &quot;Bytes(%)&quot; refers to the total volume of data coming from and going to that host during the sampling interval (~960 seconds for 3 of the flows and ~260 for the fourth) and the percentage of all data this number represents in the overall interval while, in contrast, &quot;bps&quot; refers to average bits per second during the individual interval - so ostensibly (bytes * 8) / (interval in seconds).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The percentages add up to over 100% - which is why I think this table is actually capturing total data to- &lt;em&gt;and&lt;/em&gt; from- the IP's in question and that it's likely that some amount of this traffic could be between some of these hosts.  A top-n table based on source + destination or, better still, source IP + destination subnet might be more illuminating and should be pretty easy to generate from the data.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-04T00:21:22.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37758" PostTypeId="2" ParentId="37749" CreationDate="2017-01-04T00:24:11.253" Score="6" Body="&lt;p&gt;Usually this is discussed in the context of network capture appliances.  So - for example - if you have taps on four links and a given packet happens to traverse all four then you'll naturally see four copies of the same packet.  De-duplication is the capability to deliver only one copy of this packet to a protocol analyzer.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ETA: Some actual use-cases might help to illustrate both the need and the function better.  Imagine a classic enterprise network that consists of dozens of switches organized into a series of core, aggregation and end-device access switches.  A few of these switches might connect to the firewalls and routers that go to the Internet while others connect to a WAN and others still are for servers and users.  If there's a desire to be able to monitor traffic on a wide-scale basis it tends to make sense to deploy some combination of in-line taps and on-switch port mirroring (i.e. SPAN ports).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The result of this (common) monitoring mechanism is that the output of these various taps is brought back to a common point for analysis by sniffers, performance analyzers, security devices, etc.  One problem that arises with this is that I'll see the same packet as it traverses each switch.  In the case of communications between two servers on two access switches I might see that packet three times - once on its source, once on an intermediate aggregation switch and then again on its destination.  At the same time if I want to see traffic from one of those servers to the Internet I could see the same packet on its source, the aggregation, a core switch and then whatever connects to the Internet (four copies of the same packet).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;De-duplication (and, yes, it's a real feature that several vendors implement in actual shipping products) makes sure that an otherwise identical packet is only presented once.  This is really crucial because the condition of seeing the same packet multiple times can also be indicative of forwarding loops or other network problems.  Similarly any kind of performance management solution is going to be gathering inflated data, security devices may see a DoS/traffic flood, etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Incidentally - the same issue occurs when gathering Netflow/sFlow data from multiple switches, but it's arguably somewhat trickier to implement de-dupe in that situation as there's a need to interpolate information that's not exactly in sync (vs looking at packets that should hash equivalently).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way the root cause is the same - taking a bunch of isolate point-in-time data and aggregating it on a device that has no way of knowing that it's receiving the same information but processed serially.  I suppose one could set up three or four parallel packet captures on an as-needed basis (..and varying based on which switches in the path had the needed information) but it ends up being a lot more convenient to be able to look at the traffic from a &lt;strong&gt;bunch&lt;/strong&gt; of different places at once and have it pre-processed in such a way that you can immediately look at what's interesting rather than spending hours (or likely days) determining where to look and how to pull apart the information. &lt;/p&gt;&#xA;" OwnerUserId="1172" LastEditorUserId="1172" LastEditDate="2017-01-08T01:26:12.557" LastActivityDate="2017-01-08T01:26:12.557" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37761" PostTypeId="2" ParentId="37744" CreationDate="2017-01-04T01:21:43.747" Score="1" Body="&lt;p&gt;So - I'm assuming that the 192.168.81.x network is set aside for the labs while 192.168.80.x is your production gear?  If so, then you're looking for vrf NAT.  &lt;a href=&quot;http://www.packetu.com/2012/07/26/vrfing-103-using-nat-virtual-interfaces-for-global-reachability/&quot; rel=&quot;nofollow noreferrer&quot;&gt;This article&lt;/a&gt; is a great example that hits most of your use cases.  The solution will look something like this-&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Each test bench will have a physical connection to the router/switch and will be assigned to its own VLAN.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The L3 interfaces in the VLAN will be configured with identical IP's but will each be placed in a separate vrf.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;An additional link from the router will connect to your internal network.  This interface will be in vrf &quot;production&quot; and have an IP on the existing internal network.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Within each vrf you'll need a default route via the production interface.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;There are a few ways you can do the NAT, but the most universal is likely just a static subnet translation.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For sake of example let's say that the test benches are each put in vrf's bench-A through bench-E and then make another vrf called &quot;production&quot;.  Within vrf A we'd have a NAT statement mapping 192.168.80.0/24 to 192.168.0.0/24 in the vrf &quot;production&quot; while in vrf B we'd have a NAT statement mapping 192.168.80.0/24 to 192.168.1.0/24 in vrf &quot;production.&quot; The 1811's &quot;production&quot; interface would need an L3 link to the existing infrastructure - likely with a default route.  The existing router would, in turn, have routes to 192.168.0.0/24 through 192.168.4.0/24 (the 5 test benches) via the 1811.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other way to do this would be via a NAT range or overload - general info is &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_nat/configuration/15-mt/nat-15-mt-book/iadnat-addr-consv.html#GUID-1B07F018-EEE8-40AF-953E-7E674D5E4A23&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; but this likely gets into a bunch of special use-cases where the full network translation will allow for fairly simple bidirectional connectivity.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the subnet translation case all of the engineer's laptops could be put in the standard internal network and would be able to connect to the bench network via the translated subnet.  So, for example, if they wanted to communicate with 192.168.81.6 in the first bench they might instead point to 192.168.0.6 while the second bench would be 192.168.1.6, etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - if instead the situation is that 192.168.81.x also contains a bunch of other production systems then things are going to get a lot more complicated as you'd need to do some kind of hack involving proxy arp and NAT that I'm not at all convinced would work.  If this is, in fact, the case then consider clearing out anything else in 192.168.81.x.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-04T01:21:43.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37764" PostTypeId="1" AcceptedAnswerId="37765" CreationDate="2017-01-04T12:53:03.810" Score="1" ViewCount="47" Body="&lt;p&gt;So I ran &lt;code&gt;netstat -s&lt;/code&gt; in the process of learning and actually looked through the output and found something rather puzzling: for tcp, the number of &quot;connection accepts&quot; is a little more than the number of &quot;connection requests&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can this be possible? How can a system accept more connections than were requested?? I could upload a screenshot of my terminal, but I found the next best thing: &lt;a href=&quot;http://www.ibm.com/support/knowledgecenter/en/ssw_aix_72/com.ibm.aix.cmds4/netstat.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;a link from IBM where the same thing can be noticed in sample output&lt;/a&gt; and &lt;a href=&quot;http://www.frascati.enea.it/documentation/tru6450/ARH9GATE/CHNTXXXX.HTM&quot; rel=&quot;nofollow noreferrer&quot;&gt;another documentation page with example output&lt;/a&gt; if you please just Ctrl+F for &lt;em&gt;accepts&lt;/em&gt;, it's in only one place on the page. &lt;/p&gt;&#xA;" OwnerUserId="33274" LastActivityDate="2017-01-04T13:49:06.657" Title="Number of tcp connection accepts more than number of connection requests in output of netstat" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37765" PostTypeId="2" ParentId="37764" CreationDate="2017-01-04T13:49:06.657" Score="1" Body="&lt;p&gt;I think you'll find it's showing incoming &quot;accepts&quot; and outgoing &quot;requests&quot;&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-01-04T13:49:06.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37766" PostTypeId="1" AcceptedAnswerId="37768" CreationDate="2017-01-04T14:59:45.057" Score="1" ViewCount="1049" Body="&lt;p&gt;Unlike it's Unix/Linux counterpart, the Windows &lt;code&gt;tracert&lt;/code&gt; software doesn't seem to have flags to switch between ICMP and UDP.  Does anyone know for certain which it uses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am having trouble with two machines on the same network. I can ping from one to the other, but I am unable to perform a &lt;code&gt;tracert&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="33262" LastEditorUserId="8499" LastEditDate="2017-01-04T16:55:45.443" LastActivityDate="2017-01-04T19:53:41.220" Title="Windows implementation of traceroute (tracert)" Tags="|ping|traceroute|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37767" PostTypeId="2" ParentId="37766" CreationDate="2017-01-04T15:15:03.137" Score="3" Body="&lt;p&gt;Windows uses ICMP echoes for traceroute (tracert), while most *nix systems (including Cisco routers) use UDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: traceroute in Linux can use ICMP with the -I option.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-04T15:15:03.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37768" PostTypeId="2" ParentId="37766" CreationDate="2017-01-04T15:21:33.100" Score="3" Body="&lt;p&gt;You can't use &lt;code&gt;traceroute&lt;/code&gt; or &lt;code&gt;tracert&lt;/code&gt; on the same network because it counts router hops. It uses the IP TTL that is decremented by routers, but devices on the same network communicate directly, not through a router, so the TTL will never be decremented, and a router will not generate an ICMP message telling &lt;code&gt;traceroute&lt;/code&gt; or &lt;code&gt;tracert&lt;/code&gt; that the TTL timed out.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-04T15:21:33.100" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37769" PostTypeId="1" AcceptedAnswerId="38697" CreationDate="2017-01-04T17:39:11.010" Score="1" ViewCount="425" Body="&lt;p&gt;I need single /24 private IP address space that spans two locations across a L2VPN with Cisco CSR 1000v (ax license and vmware vsphere hypervisor)?&#xA;Tunnel and VC status up but cant connect from location A to location B in same single network.&#xA;Same config good working in Cisco 2911 but with low performance ~50mbps.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Config:&#xA;    mpls label protocol ldp&#xA;    l2vpn&#xA;    !&#xA;    interface Tunnel0&#xA;     ip address 10.1.1.1 255.255.255.252&#xA;     ip tcp adjust-mss 1390&#xA;     mpls ip&#xA;     mpls mtu 1430&#xA;     tunnel source 185.3.xx.yy&#xA;     tunnel destination 185.25.xx.yy&#xA;    !&#xA;    interface GigabitEthernet1&#xA;     ip address 185.3.xx.yy 255.255.255.0&#xA;     negotiation auto&#xA;    interface GigabitEthernet2.200&#xA;     encapsulation dot1Q 200&#xA;     xconnect 10.1.1.2 200 encapsulation mpls&#xA;      mtu 1430&#xA;    !&#xA;    mpls ldp router-id Tunnel0 force&#xA;&#xA;Info:&#xA;    csr01#sh mpls l2transport binding&#xA;      Destination Address: 10.1.1.2,VC ID: 200&#xA;        Local Label:  21&#xA;            Cbit: 1,    VC Type: Ethernet,    GroupID: 7&#xA;            MTU: 1430,   Interface Desc: n/a&#xA;            VCCV: CC Type: CW [1], RA [2], TTL [3]&#xA;                  CV Type: LSPV [2]&#xA;        Remote Label: 18&#xA;            Cbit: 1,    VC Type: Ethernet,    GroupID: 7&#xA;            MTU: 1430,   Interface Desc: n/a&#xA;            VCCV: CC Type: CW [1], RA [2], TTL [3]&#xA;                  CV Type: LSPV [2]&#xA;csr01#sh mpls l2transport summary&#xA;Destination address: 10.1.1.2, total number of vc: 1&#xA;  0 unknown, 1 up, 0 down, 0 admin down, 0 recovering, 0 standby, 0 hotstandby&#xA;  1 active vc on MPLS interface Tu0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user24629" LastEditorUserId="2142" LastEditDate="2017-01-04T17:41:29.433" LastActivityDate="2017-05-03T11:58:33.983" Title="MPLS L2VPN on Cisco CSR" Tags="|cisco|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37770" PostTypeId="1" CreationDate="2017-01-04T18:26:18.933" Score="2" ViewCount="873" Body="&lt;p&gt;I'm having trouble finding the actual temperature point where a C2821 router will send out the trap for temperature. So far, I know the operating temperatures are from 0C to 40C. But at which point does it send the trap?&lt;/p&gt;&#xA;" OwnerUserId="4634" LastActivityDate="2018-04-01T13:49:47.833" Title="At what temperature does an envmon temperature alert trigger on a Cisco 2821" Tags="|cisco|router|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37771" PostTypeId="2" ParentId="25933" CreationDate="2017-01-04T19:27:37.390" Score="2" Body="&lt;p&gt;I just tested with ASA 9.1.7 and found that telnet and ssh with password authentication works fine with &quot;auto-enable&quot;, but ssh with publickey does not.  A workaround is to push the enable sequence to each ssh session:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;notroot@ubuntu:/www$ ssh 10.89.168.49 $'en\n\n'&#xA;Type help or '?' for a list of available commands.&#xA;LABNET-CORE-ASA5510-1&amp;gt; en&#xA;Password: &#xA;LABNET-CORE-ASA5510-1# &amp;lt;you are left here&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you're industrious, open up a TAC case and ask Cisco to fix the bug.&lt;/p&gt;&#xA;" OwnerUserId="33279" LastActivityDate="2017-01-04T19:27:37.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37773" PostTypeId="2" ParentId="37766" CreationDate="2017-01-04T19:53:41.220" Score="-2" Body="&lt;p&gt;It uses icmp for sure. Would you mind to post the error message?&lt;/p&gt;&#xA;" OwnerUserId="33276" LastActivityDate="2017-01-04T19:53:41.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37774" PostTypeId="1" AcceptedAnswerId="37782" CreationDate="2017-01-04T20:06:44.683" Score="1" ViewCount="68" Body="&lt;p&gt;We currently use many IPSec VPNs to connect to separate companies, but the VPNs are managed by a third party. We are interested in running these VPNs ourselves, using any method as long as it is IPSec. These clients share information with each other exclusively through us. Our organization acts as the hub that connects two spokes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any methods or best practices you may know of related to efficiently managing a large number of IPSec VPNs like this?&lt;/p&gt;&#xA;" OwnerUserId="33278" LastEditorUserId="33278" LastEditDate="2017-01-04T20:14:25.027" LastActivityDate="2017-01-05T05:29:44.340" Title="Managing many L2TP VPNs?" Tags="|vpn|ipsec|best-practices|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37776" PostTypeId="1" AcceptedAnswerId="37778" CreationDate="2017-01-05T00:11:11.937" Score="1" ViewCount="8258" Body="&lt;p&gt;From my understanding, a Layer 3 switch can handle cross-communication between separate LANs and VLANs, as well as fine-tuned ACL control between VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Despite this, I know a Layer 3 switch should definitely not be used in place of a Firewall, such as between your LAN and WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are some examples of the primary advantages of a Firewall over a Layer 3 switch in guarding your network, on top of ACLs?&lt;/p&gt;&#xA;" OwnerUserId="33283" LastEditorUserId="8499" LastEditDate="2018-03-09T21:14:31.827" LastActivityDate="2021-01-10T12:06:59.163" Title="What are the advantages of a firewall over a Layer-3 switch?" Tags="|routing|switch|firewall|layer3|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37777" PostTypeId="2" ParentId="37770" CreationDate="2017-01-05T00:15:22.173" Score="0" Body="&lt;p&gt;As far as I know, trap will occur if it exceeds 65C. &lt;br&gt;It cannot modify the command.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can check the current temperature of the router with &quot;show environment&quot; command.&lt;/p&gt;&#xA;" OwnerUserId="32460" LastActivityDate="2017-01-05T00:15:22.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37778" PostTypeId="2" ParentId="37776" CreationDate="2017-01-05T00:17:31.903" Score="5" Body="&lt;p&gt;Firewalls are usually stateful. Usually, you want a firewall to block everything but established communication, and this can be difficult to impossible with ACLs, depending on the router or switch vendor and software version. Some devices (router or switch) support reflexive ACLs that can be stateful, but they are more limited, and it becomes a large burden to to maintain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next-generation firewalls can also look beyond the network traffic into the application data in order to block/allow applications.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you set up a traditional ACL to block all incoming traffic (firewall default behavior), then a host requesting data from outside could never get the data because the ACL will block all incoming traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A reflexive ACL could see the outbound connection, and it can be configured to reflect (allow traffic back on that connection). This behavior maintains a connection state. This is basically what a firewall does; it maintains the state of a connection, up to a timeout period of inactivity. It will again block when the connection is closed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A next-generation firewall goes even further. It will be able to do deep packet inspection to deterministically or heuristically determine what type of data is passing through, or which application is communicating. That adds flexibility to block or allow in a more finely-grained fashion. For example, the firewall could actually detect and block malware in a data stream, it could block a torrent, or you could allow only traffic to and from a single application on a particular host. This type of firewall needs to have a maintenance contract that allows the software to be updated to stay current.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-05T00:53:46.007" LastActivityDate="2017-01-05T00:53:46.007" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37779" PostTypeId="2" ParentId="37776" CreationDate="2017-01-05T01:03:16.910" Score="3" Body="&lt;p&gt;The line between firewall and gateway (aka router) continues to get blurred.  Each device advances to include the others features.  However, fundamentally, a routers job is to route packets whereas a firewalls job is to inspect and control connections through the device. &lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-05T01:03:16.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37780" PostTypeId="2" ParentId="37725" CreationDate="2017-01-05T02:06:21.980" Score="-2" Body="&lt;p&gt;It looks like you need to verify config register.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;execute &lt;code&gt;show bootvar&lt;/code&gt; for RP and &lt;code&gt;remote command switch show bootvar&lt;/code&gt; for SP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Find the config-register value.&lt;/p&gt;&#xA;" OwnerUserId="32460" LastEditorUserId="8499" LastEditDate="2017-01-05T02:07:48.103" LastActivityDate="2017-01-05T02:07:48.103" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37782" PostTypeId="2" ParentId="37774" CreationDate="2017-01-05T05:29:44.340" Score="2" Body="&lt;p&gt;So the question is kind of vague but there are some guiding principles worth considering:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Separate connectivity into tiers - so, for example, a few external aggregation boxes might feed into a larger number of boxes focused strictly on encryption and decryption that, in turn, connect to infrastructure that separates customer connections into multiple logical tenants that are then cross-connected through a layer that can provide appropriate policy based controls and security.  Greater flexibility in this regard will let you make more optimal choices about horizontal versus vertical scale - so more cheap boxes vs fewer high-density/exotic ones, etc.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Good management invariably means a very deep understanding and integration of operational processes into orchestration.  You don't bolt automation on.  Like security you really have to bake it in from the start.  As you put together your infrastructure you want to choose product sets that integrate with your toolsets and you want to provide a product that integrates with your customer's toolsets.  Success in anything like an SP network is going to be pretty directly tied to the extent you can keep humans out of day-to-day provisioning, troubleshooting, etc.. and to maximize the effectiveness of those humans when their attention &lt;strong&gt;is&lt;/strong&gt; required.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Visibility and measurement are worthy investment targets.  Be able to gather data from each and every tier and device and have an efficient and sane way to store and analyze this information.  These areas are often neglected earlier in the process and it causes a lot of pain.  This can be the means by which business and infrastructure can be well done and can be a significant competitive advantage and source of revenue.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Anyhow - if you can more specifically describe the problem you're trying to solve we can make better recommendations about the sorts of technologies and approaches that might be a win. &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-05T05:29:44.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37783" PostTypeId="1" CreationDate="2017-01-05T05:47:10.957" Score="1" ViewCount="325" Body="&lt;p&gt;We have Cisco Catalyst 2960-S switches,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And we noticed some employees plug out the internet cables to connect them to their Lab top. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want the command that I can use to make the port shutdown when someone plug out the cable from the PC. &lt;/p&gt;&#xA;" OwnerUserId="33287" LastActivityDate="2017-01-05T17:07:10.693" Title="Shut down the port when someone plug out the cable" Tags="|switch|security|cable|port-security|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37784" PostTypeId="1" CreationDate="2017-01-05T06:03:33.277" Score="1" ViewCount="57" Body="&lt;p&gt;How to select Fiber Cable (multi-mode or single mode). For example, if i need fiber backbone around 700 meters with 2 GB speed, how i choose, om 2, om 3 or OS 1 &amp;amp; Os 2. Is there any calculator or calculations available for it..?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Binoj&lt;/p&gt;&#xA;" OwnerUserId="33288" LastEditorUserId="8499" LastEditDate="2018-03-21T00:24:44.410" LastActivityDate="2018-03-21T00:24:44.410" Title="Fiber Cable speed tester" Tags="|layer1|fiber|cable|cabling|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37785" PostTypeId="2" ParentId="37783" CreationDate="2017-01-05T06:17:07.453" Score="2" Body="&lt;p&gt;There's no such thing as block port administratively when it comes down operationally. Though as you mentioned in the tags, you can use port security for that and configure maximum MAC addresses per port. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface X&#xA; switchport port-security&#xA; switchport port-security maximum 1&#xA; switchport port-security violation shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Violation mode defaults to shutdown, so this line is optional&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-01-05T06:17:07.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37786" PostTypeId="1" AcceptedAnswerId="80723" CreationDate="2017-01-05T06:25:14.287" Score="3" ViewCount="1273" Body="&lt;p&gt;I was going through the use cases of GRE tunnel and see that it is also used to carry multicast traffic over the internet.I understand that multicast IP belongs to &lt;code&gt;class D&lt;/code&gt; address which is a public IP and can be routed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1:Why is multicast not supported over the internet ? Why do we need to encapsulate in GRE ? Can you please explain in laymen terms ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:When we use the term 'internet', what exactly does it refer to?&#xA;Would it be collection of all ISPs across the world?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2022-12-21T10:09:48.370" Title="Regarding Multicast over the internet" Tags="|internet|multicast|gre|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37787" PostTypeId="2" ParentId="37784" CreationDate="2017-01-05T06:27:00.043" Score="2" Body="&lt;p&gt;So you don't specify the connection type (fibre channel?  Ethernet? SONET?) but it's safe to say that at 700M you're outside the realm of what should be run with multimode on just about anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the link needs to be single mode you'd likely have an easier time just using OS1, which has somewhat higher attenuation but is less fragile and thus much easier to run within a building.  The lesser attenuation of OS2 isn't going to be a factor until you're into many tens of kilometers.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-05T06:27:00.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37788" PostTypeId="2" ParentId="37786" CreationDate="2017-01-05T06:32:16.007" Score="3" Body="&lt;p&gt;A1: Because normally you need to run PIM protocol in order to achieve end-to-end connectivity for multicast network. PIM doesn't normally run between ISP boundaries. It would be pretty complicated and protocol itself wasn't designed for that scale.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A2: It depends. From networking point of view I would say that Internet is merely a collection of public routes, i. e. BGP full view.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-01-05T06:32:16.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37789" PostTypeId="1" AcceptedAnswerId="37801" CreationDate="2017-01-05T08:40:37.660" Score="1" ViewCount="1487" Body="&lt;p&gt;I am testing a setup with 2 Nexus 3524 and a 2960X in a VPC Topology :&#xA;&lt;a href=&quot;https://i.stack.imgur.com/4fXS7.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4fXS7.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this test lab, I miss some SFP so there's only one physical link between each switch (and those link are copper using 1000BASE-T Copper SFP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All 3 switches have VLAN 17 up and configured with an IP address:   &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Nexus 1 (left) :      192.168.17.254&lt;br&gt;&#xA;  Nexus 2 (right) :   192.168.17.252&lt;br&gt;&#xA;  2960X : 192.168.17.2&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Both ports channel are trunk with VLAN 17 allowed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When all links are up I can ping all addresses from any switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I shutdown the link between 2960X and Nexus1 I got this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2960X can ping Nexus2&lt;/li&gt;&#xA;&lt;li&gt;Nexus2 can ping Nexus1   &lt;/li&gt;&#xA;&lt;li&gt;29060X cannot ping Nexus1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that the purpose is to use the Nexus as gateway for a bunch of VLAN with HSRP (also there will be 8 switches 2960X used as TOR, each with a VPC to the Nexus). HSRP is not configured yet as I want to have a working VPC configuration first.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the configurations:&lt;br&gt;&#xA;(all 3 switches are factory default settings apart from the configuration bellow, all interfaces not shown have no config at all)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Nexus 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 6.0(2)A1(1b)&#xA;hostname STA-TST-NEXUS1&#xA;&#xA;no feature telnet&#xA;cfs eth distribute&#xA;feature interface-vlan&#xA;feature hsrp&#xA;feature lacp&#xA;feature vpc&#xA;&#xA;control-plane&#xA;  service-policy input copp-system-policy&#xA;&#xA;vrf context management&#xA;  ip route 0.0.0.0/0 10.22.110.254&#xA;vlan 1&#xA;vlan 17&#xA;  name test-17&#xA;vlan 18&#xA;  name test-18&#xA;&#xA;vpc domain 100&#xA;  role priority 2000&#xA;  system-priority 4000&#xA;  peer-keepalive destination 10.22.110.12&#xA;  auto-recovery&#xA;&#xA;interface Vlan1&#xA;&#xA;interface Vlan17&#xA;  no shutdown&#xA;  ip address 192.168.17.254/24&#xA;&#xA;interface Vlan18&#xA;  no shutdown&#xA;  ip address 192.168.18.254/24&#xA;&#xA;interface port-channel10&#xA;  switchport mode trunk&#xA;  switchport trunk allowed vlan 17-18&#xA;  vpc 100&#xA;&#xA;interface port-channel100&#xA;  switchport mode trunk&#xA;  spanning-tree port type network&#xA;  vpc peer-link&#xA;&#xA;interface Ethernet1/1&#xA;  switchport mode trunk&#xA;  speed 1000&#xA;  channel-group 100&#xA;&#xA;&#xA;interface Ethernet1/23&#xA;  switchport mode trunk&#xA;  switchport trunk allowed vlan 17-18&#xA;  speed 1000&#xA;  channel-group 10 mode active&#xA;&#xA;&#xA;interface mgmt0&#xA;  no ip redirects&#xA;  ip address 10.22.110.11/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Nexus 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 6.0(2)A1(1b)&#xA;hostname STA-TST-NEXUS2&#xA;&#xA;no feature telnet&#xA;cfs eth distribute&#xA;feature interface-vlan&#xA;feature lacp&#xA;feature vpc&#xA;&#xA;control-plane&#xA;  service-policy input copp-system-policy&#xA;&#xA;vrf context management&#xA;  ip route 0.0.0.0/0 10.22.110.254&#xA;&#xA;vlan 1&#xA;&#xA;vlan 17&#xA;  name test-17&#xA;&#xA;vlan 18&#xA;  name test-18&#xA;&#xA;vpc domain 100&#xA;  role priority 3000&#xA;  system-priority 4000&#xA;  peer-keepalive destination 10.22.110.11&#xA;  auto-recovery&#xA;&#xA;interface Vlan1&#xA;&#xA;interface Vlan17&#xA;  no shutdown&#xA;  ip address 192.168.17.252/24&#xA;&#xA;interface Vlan18&#xA;  no shutdown&#xA;  ip address 192.168.18.252/24&#xA;&#xA;interface port-channel10&#xA;  switchport mode trunk&#xA;  switchport trunk allowed vlan 17-18&#xA;  vpc 100&#xA;&#xA;interface port-channel100&#xA;  switchport mode trunk&#xA;  spanning-tree port type network&#xA;  vpc peer-link&#xA;&#xA;interface Ethernet1/1&#xA;  switchport mode trunk&#xA;  speed 1000&#xA;  channel-group 100&#xA;&#xA;interface Ethernet1/24&#xA;  switchport mode trunk&#xA;  switchport trunk allowed vlan 17-18&#xA;  speed 1000&#xA;  channel-group 10 mode active&#xA;&#xA;interface mgmt0&#xA;  no ip redirects&#xA;  ip address 10.22.110.12/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;2960X&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 15.2&#xA;hostname STA-TSTSW1&#xA;!&#xA;switch 1 provision ws-c2960x-48td-l&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;lldp run&#xA;!&#xA;interface Port-channel1&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0&#xA; ip address 10.22.110.13 255.255.255.0&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; switchport access vlan 17&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; switchport access vlan 17&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/23&#xA; switchport mode trunk&#xA; shutdown&#xA; channel-group 1 mode active&#xA;!&#xA;interface GigabitEthernet1/0/24&#xA; switchport mode trunk&#xA; channel-group 1 mode active&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan17&#xA; ip address 192.168.17.2 255.255.255.0&#xA;!&#xA;ip default-gateway 10.22.110.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So the question is: Why can't I ping between 2960X and Nexus1 when I cut a link?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bonus: How to configure HSRP in this configuration?&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-01-05T16:59:57.720" Title="Gateway on Nexus 3500 with VPC" Tags="|cisco-nexus|vpc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37791" PostTypeId="1" AcceptedAnswerId="37792" CreationDate="2017-01-05T11:38:36.650" Score="5" ViewCount="5271" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/INsdi.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/INsdi.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hi,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to configure Multi area OSPF between these routers. I created test simulation on packet tracer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can any one help me how I can do that because I am bit confused about the configuration in Mesh topology. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In single area all things and fail-overs also working fine, but when I tried to configure multi-area network, I am getting confused that where I configure which area. Because every router is connected to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help me..&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Pq8UL.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Pq8UL.jpg&quot; alt=&quot;Is this work&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@John, If I not put my complete thing in Area 0, this could be the possible topology? Can I achieve my goal with this?&lt;/p&gt;&#xA;" OwnerUserId="22728" LastEditorUserId="8499" LastEditDate="2019-01-05T00:47:24.497" LastActivityDate="2019-01-05T00:47:24.497" Title="OSPF configuration in MESH topology" Tags="|cisco|routing|router|ospf|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37792" PostTypeId="2" ParentId="37791" CreationDate="2017-01-05T12:11:55.480" Score="6" Body="&lt;p&gt;The area design you have specified will not work. The interface and its adjacent interface need to be in the same area. You can't have one interface in area0 and the adjacent router interface in area1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One of the conditions to create a successful relationship with a neighbour is that the area id must match, which it would never do in your design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the picture below which might help you understand it better.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xrewe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xrewe.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see that the interface and its adjacent interface are both in the same area and not separate. This will allow a neighbour relationship to be established.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2017-01-05T12:11:55.480" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="37794" PostTypeId="1" CreationDate="2017-01-05T13:04:07.387" Score="1" ViewCount="45" Body="&lt;p&gt;Assume a scenario where a network technician in an organization may remotely access network devices for routine maintenance, but should only be able to set up network configurations (e.g. VLAN settings, filtering rules) that are authorized by a central entity of the organization. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it usually supported by common switches to verify (non-OEM) signatures of configuration files in order to prevent unauthorized changes?&lt;/p&gt;&#xA;" OwnerUserId="33297" LastActivityDate="2017-01-05T13:18:41.090" Title="Switch Configuration Security -- Signed Configurations" Tags="|switch|security|management|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37795" PostTypeId="2" ParentId="37794" CreationDate="2017-01-05T13:10:20.863" Score="3" Body="&lt;p&gt;AAA configs on a network device can tell it to pass all authorisation checks back to an ACS / ISE / RADIUS server. The backend server can then send a message back to the device saying &quot;Yes that person can do that command&quot; or &quot;No, they're unauthorised&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, on some Cisco devices at least, you can mark the boot image and config file as being secured - you can make it impossible to edit or remove them except with physical access to the console port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure about actually signing copies of the config though. You'd need to check the signature against a CA which you couldn't do unless the device was online and able to contact the CA. You could save certificates locally, but so could an attacker to work around this.&lt;/p&gt;&#xA;" OwnerUserId="106" LastEditorUserId="106" LastEditDate="2017-01-05T13:18:41.090" LastActivityDate="2017-01-05T13:18:41.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37798" PostTypeId="2" ParentId="37791" CreationDate="2017-01-05T14:46:46.223" Score="5" Body="&lt;p&gt;I wasn't able to paste this picture in the comments.  Usually what you want is your full mesh connections to all be in the backbone area 0.  Then you split off other stub areas that are all attached to area 0.  So all of your WAN links would be in area 0, then the links on the router towards the local site LAN would be in its own area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DXgBz.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DXgBz.jpg&quot; alt=&quot;OSPF areas&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2017-01-05T14:46:46.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37800" PostTypeId="2" ParentId="35395" CreationDate="2017-01-05T15:34:20.263" Score="2" Body="&lt;p&gt;Just to add to this, client outbound active FTP (Ron's first picture) is &lt;strong&gt;not supported&lt;/strong&gt; as of December 2016 without installing beta firmware on the Meraki MX appliances.  Check the first note on the Meraki documentation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://documentation.meraki.com/MX-Z/NAT_and_Port_Forwarding/Active_and_Passive_FTP_Overview_and_Configuration&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://documentation.meraki.com/MX-Z/NAT_and_Port_Forwarding/Active_and_Passive_FTP_Overview_and_Configuration&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is because Meraki MX does not ship with a FTP inspection engine like other vendors for client FTP sessions.  There is a beta firmware available to correct this, have to open a Meraki TAC case to have it pushed down for upgrade.&lt;/p&gt;&#xA;" OwnerUserId="33300" LastActivityDate="2017-01-05T15:34:20.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37801" PostTypeId="2" ParentId="37789" CreationDate="2017-01-05T16:27:57.017" Score="5" Body="&lt;p&gt;For your first question, enable 'peer-gateway' under the VPC domain settings.  This allows for directed ping forwarding over the VPC peer-link.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With core Nexus VPC peers, it is also recommended to set 'peer-switch' under the VPC domain settings and set their STP priorities for VPC vlans to the same values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your second question, HSRP is configured under the SVI on both N9k's:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;N9k-1&lt;/b&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 17&#xA;  no shutdown&#xA;  ip address 192.168.17.254/24&#xA;  hsrp version 2&#xA;  hsrp 17&#xA;    priority 110&#xA;    ip 192.168.17.1&#xA;    preempt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;N9k-2&lt;/b&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan17&#xA;  no shutdown&#xA;  ip address 192.168.17.252/24&#xA;  hsrp version 2&#xA;  hsrp 17&#xA;    ip 192.168.17.1&#xA;    preempt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HSRP version 2 is not required here, default HSRP priority of 100.  Verify HSRP is working between peers with 'show hsrp brief' and make sure you can ping all the various IP's.&lt;/p&gt;&#xA;" OwnerUserId="33300" LastEditorUserId="33300" LastEditDate="2017-01-05T16:59:57.720" LastActivityDate="2017-01-05T16:59:57.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37802" PostTypeId="1" AcceptedAnswerId="40239" CreationDate="2017-01-05T16:37:58.020" Score="0" ViewCount="5757" Body="&lt;p&gt;Let me start by prefixing my knowledge of Wireshark is very limited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Context : I'm investigating logs between a server hosted files and an AV that supported ICAP protocol. In this logs I'm very interesting about the string : &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Unable to read data from the transport connection: A connection attempt failed because the connected party did not properly respond after a period of time&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I though a trace could be a good idea to investigate this logs so I'm using &lt;code&gt;icap&lt;/code&gt; flag to find all record about icap transaction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As icap is based on the TCP/IP pile my question is :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Should I use &lt;code&gt;icap and tcp.analysis.flags&lt;/code&gt; as a flag in Wireshark to find bad TCP packet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="32102" LastActivityDate="2017-04-06T00:26:04.357" Title="Does tcp.analysis.flags in Wireshark find bad TCP packet?" Tags="|tcp|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37803" PostTypeId="2" ParentId="37252" CreationDate="2017-01-05T16:57:49.667" Score="0" Body="&lt;p&gt;Your server is not behind a router if it is getting a public IP address from ISP1 via DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A DNS A record can take a secondary IP address.  Use that for the failover/backup access.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-05T16:57:49.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37804" PostTypeId="2" ParentId="37783" CreationDate="2017-01-05T17:07:10.693" Score="0" Body="&lt;p&gt;Put the switch in a locked closet, or, get a wallmount lock box for it.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/inKl5.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/inKl5.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-05T17:07:10.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37805" PostTypeId="1" AcceptedAnswerId="37806" CreationDate="2017-01-05T18:06:12.703" Score="0" ViewCount="516" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XAxN3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XAxN3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Corp1(config)# access-list 10 permit tcp 192.168.33.3 0.0.0.0 177.22.242.23 0.0.0.0 eq www&#xA;Corp1(config)# access-list 10 deny tcp 192.168.33.0 0.0.0.255  177.22.242.23 0.0.0.0 eq www&#xA;Corp1(config)# access-list 10 permit ip any any&#xA;Corp1(config)#interface fa0/1&#xA;Corp1(config-if)# IP access-group 10 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is what I came up with I dont have a lab facility or access to packet tracer to test it out.I want to know if the following statement will allow the access to finicial webserver to only host c with IP address 192.168.33.3 and not to the rest of the hosts and if the 2nd and 3rd statement will override the first statement.I was thinking of applying the access list on routers fa interface with .254 IP address .&lt;/p&gt;&#xA;" OwnerUserId="33307" LastEditorUserId="8499" LastEditDate="2018-12-25T03:22:19.090" LastActivityDate="2018-12-25T03:22:19.090" Title="Extended access list conflict condition will it cause override?" Tags="|cisco|router|acl|access-control|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37806" PostTypeId="2" ParentId="37805" CreationDate="2017-01-05T18:11:16.920" Score="3" Body="&lt;p&gt;Access lists work on a first-match basis. The traffic will be compared to the list, starting with the first statement in the list. As soon as a match is found, then the router exits the list.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-05T18:11:16.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37808" PostTypeId="2" ParentId="37791" CreationDate="2017-01-05T18:53:38.550" Score="1" Body="&lt;p&gt;OSPF doesn't use a mesh topology. All OSPF areas must connect to Area 0 (backbone area) because all traffic from one are to another area &lt;em&gt;must&lt;/em&gt; travel through Area 0. This is a loop prevention mechanism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An OSPF router knows about everything (routes routers, costs, etc.) in its own area. Areas separate and compartmentalize this knowledge. All the router knows about other areas is that it must send traffic destined to another area to Area 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, as sometimes happens, you have an area that cannot physically attach to Area 0, you must create a virtual link between that area and Area 0. Area 0 must also be contiguous, you cannot have two different Area 0s. You will need to implement a virtual link if Area 0 is split.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want redundant connections, then you need to have multiple connections from each area into Area 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason you cannot use a mesh with OSPF is found in &lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 2328, OSPF Version 2&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;3.1.  The backbone of the Autonomous System&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The OSPF backbone is the special OSPF Area 0 (often written as Area&#xA;  0.0.0.0, since OSPF Area ID's are typically formatted as IP addresses). The OSPF backbone always contains all area border routers.&#xA;  The backbone is responsible for distributing routing information&#xA;  between non-backbone areas. The backbone must be contiguous. However,&#xA;  it need not be physically contiguous; backbone connectivity can be&#xA;  established/maintained through the configuration of virtual links.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Virtual links can be configured between any two backbone routers that&#xA;  have an interface to a common non-backbone area.  Virtual links belong&#xA;  to the backbone.  The protocol treats two routers joined by a virtual&#xA;  link as if they were connected by an unnumbered point-to-point&#xA;  backbone network.  On the graph of the backbone, two such routers are&#xA;  joined by arcs whose costs are the intra-area distances between the&#xA;  two routers.  The routing protocol traffic that flows along the&#xA;  virtual link uses intra- area routing only.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;3.2.  Inter-area routing&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When routing a packet between two non-backbone areas the backbone is&#xA;  used.  The path that the packet will travel can be broken up into&#xA;  three contiguous pieces: an intra-area path from the source to an area&#xA;  border router, a backbone path between the source and destination&#xA;  areas, and then another intra-area path to the destination.  The&#xA;  algorithm finds the set of such paths that have the smallest cost.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Looking at this another way, inter-area routing can be pictured as&#xA;  forcing a star configuration on the Autonomous System, with the&#xA;  backbone as hub and each of the non-backbone areas as spokes.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The topology of the backbone dictates the backbone paths used between&#xA;  areas.  The topology of the backbone can be enhanced by adding virtual&#xA;  links.  This gives the system administrator some control over the&#xA;  routes taken by inter-area traffic.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The correct area border router to use as the packet exits the source&#xA;  area is chosen in exactly the same way routers advertising external&#xA;  routes are chosen.  Each area border router in an area summarizes for&#xA;  the area its cost to all networks external to the area.  After the SPF&#xA;  tree is calculated for the area, routes to all inter-area destinations&#xA;  are calculated by examining the summaries of the area border routers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-06T02:19:49.137" LastActivityDate="2017-01-06T02:19:49.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37809" PostTypeId="1" AcceptedAnswerId="37813" CreationDate="2017-01-05T19:46:42.540" Score="6" ViewCount="5130" Body="&lt;p&gt;What is the difference between &lt;strong&gt;session&lt;/strong&gt; and &lt;strong&gt;flow&lt;/strong&gt; in networks? In fact, I always visualize &lt;em&gt;flow&lt;/em&gt; as a set of packets having the same source and destination. What confuses me is session. So I'd like to know the difference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="29636" LastEditorUserId="29636" LastEditDate="2017-01-05T20:00:42.633" LastActivityDate="2017-01-06T04:53:04.900" Title="The Difference between session and flow in networks" Tags="|cisco|switch|router|network-core|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37810" PostTypeId="2" ParentId="37809" CreationDate="2017-01-05T20:19:32.077" Score="2" Body="&lt;p&gt;To use an analogy, a flow is me speaking to you.  A session is a conversation between us.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-05T20:19:32.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37813" PostTypeId="2" ParentId="37809" CreationDate="2017-01-05T21:24:26.427" Score="4" Body="&lt;p&gt;A &lt;strong&gt;flow&lt;/strong&gt; is the data-plane stream of packets between sender and receiver that shares key IP header information.  For example, a client at 10.1.1.1 port 12398 communicating with a server at 192.168.1.1 port 22 for SSH is a specific flow that can be captured as the key fields don't change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;strong&gt;session&lt;/strong&gt; is the control-plane communication between sender and receiver.  The TCP 3-way handshake creates a session that establishes a connection between the sender's source port and receiver's destination listening port.  TCP window size, initial sequence and acknowledge values, and keepalives are negotiated as part of building the session.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, &lt;strong&gt;flow&lt;/strong&gt; represents the data-plane and &lt;strong&gt;session&lt;/strong&gt; represents the control-plane.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Removed bidirectional requirement for a flow.&lt;/p&gt;&#xA;" OwnerUserId="33300" LastEditorUserId="33300" LastEditDate="2017-01-05T23:07:50.380" LastActivityDate="2017-01-05T23:07:50.380" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37821" PostTypeId="2" ParentId="37809" CreationDate="2017-01-06T04:53:04.900" Score="0" Body="&lt;p&gt;A session typically involves a handshake and some back and forth communication whereas a flow may not involve a handshake and the communication may be uni-directional.  Think of a Web session vs a multicast flow.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-06T04:53:04.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37822" PostTypeId="2" ParentId="36950" CreationDate="2017-01-06T05:02:35.410" Score="0" Body="&lt;p&gt;NFV simply describes virtualizing a networking device.  Installng a firewall on a VM inside a host, for example.  That's NFV.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Service Chaining describes distributing networking device features/services out across several devices (whether physical or virtual) vs having them all centralized in a single box (whether physical or virtual).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-06T05:02:35.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37829" PostTypeId="1" AcceptedAnswerId="37832" CreationDate="2017-01-06T11:44:38.147" Score="1" ViewCount="1156" Body="&lt;p&gt;I have a EdgeMax Router X and I got the basic to work.&#xA;The subnet for the default is 192.168.178.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My wifi access points have the option for guest networks.&#xA;Those however are on a seperate subnet 192.168.179.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This didn't seem like a problem to me but the 179 subnet doesn't seem to be getting internet access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Who should I give the 179 subnet internet access? In doing so will it also be able to communicate with the 178?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to add a manual ip to the 'switch0' interface in my router (so both 178 and 179 are configured there) but it doesn't seem to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oemHL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oemHL.png&quot; alt=&quot;diagram&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/IENsw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IENsw.png&quot; alt=&quot;table&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33333" LastEditorUserId="33333" LastEditDate="2017-01-06T13:46:05.317" LastActivityDate="2017-01-06T13:56:41.670" Title="Multiple subnets internet access" Tags="|router|subnet|ubiquiti|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="37830" PostTypeId="1" CreationDate="2017-01-06T12:15:06.750" Score="2" ViewCount="4902" Body="&lt;p&gt;Well, I'm trying to configure email notifications alert on our Cisco Prime Infrastructure v.3.0, so that I´ll be able to receive email alerts, for instance, when any interface, devices like router, access points, switches and even server goes off or down, or gives any error on its interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm kind of a little new in this industry, but able to configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So can someone kindly help me with a straight-forward guide that helps me to accomplish this problem?&lt;/p&gt;&#xA;" OwnerUserId="33335" LastEditorUserId="8499" LastEditDate="2017-01-06T15:16:04.713" LastActivityDate="2017-02-07T02:37:02.500" Title="How to configue email notifications alert on cisco prime infrastructure 3.0" Tags="|cisco-catalyst|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="37832" PostTypeId="2" ParentId="37829" CreationDate="2017-01-06T13:56:41.670" Score="1" Body="&lt;p&gt;The details of what you need to do are too involved for a post here, but these are the high level steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Create two VLANs on your switch- one for users and one for guests&lt;/li&gt;&#xA;&lt;li&gt;Create a trunk port on the link between your switch and router to&#xA;tag the VLANs&lt;/li&gt;&#xA;&lt;li&gt;Create subinterfaces on your router-- one for each VLAN: 178 and 179&lt;/li&gt;&#xA;&lt;li&gt;Create a new DHCP scope for your guest network&lt;/li&gt;&#xA;&lt;li&gt;Apply an access control list on your router to block guests from&#xA;reacing your internal network.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-06T13:56:41.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37835" PostTypeId="1" CreationDate="2017-01-06T16:15:48.337" Score="1" ViewCount="76" Body="&lt;p&gt;I am setting up multiple networks(pods) at a trade show. Each pod will be running on it's own separate network. In each pod are a machine(s) and a wireless barcode scanner (android tablet) to verify the feeder set-up. My question is: would it be better to have one access point that connects all the machine to the scanner, or run each pod independently using it's own access point? I've been told that using multiple access-points independently would cause performance problems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks You &#xA;John&lt;/p&gt;&#xA;" OwnerUserId="33341" LastActivityDate="2017-02-05T21:50:32.713" Title="One Access point or individual Access points" Tags="|access-point|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37836" PostTypeId="2" ParentId="37835" CreationDate="2017-01-06T16:24:55.723" Score="2" Body="&lt;p&gt;Does it need to be connected with wireless?  I'd assume that a trade show is going to have a lot of wireless interference from other attendees.  Adding more AP's won't help that and its possibly that your users will have no wireless access in that crowded of an environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your main question, you could have a separate SSID per pod on a single AP but depending on your AP hardware there is a limited number of SSID's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If possible, I'd physically cable this all up and skip the wireless and feed it back to whatever the trade show is giving you as a main connection (if Internet is required).  Then you could just run separate VLANs/subnets for each pod.&lt;/p&gt;&#xA;" OwnerUserId="33300" LastActivityDate="2017-01-06T16:24:55.723" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37839" PostTypeId="2" ParentId="35696" CreationDate="2017-01-06T19:54:06.623" Score="2" Body="&lt;p&gt;Just wanted to circle back and mark the correct answer that fixed my issue. Turns out my system that I was seeing jitter on had a MTU value of 1440 and my Cisco routers were all set to 1400. Once I lowered my value in the 1200 range everything started working as expected. &lt;/p&gt;&#xA;" OwnerUserId="31189" LastActivityDate="2017-01-06T19:54:06.623" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37842" PostTypeId="2" ParentId="37749" CreationDate="2017-01-07T14:57:05.000" Score="1" Body="&lt;p&gt;It's impossible to tell for sure, since you have chosen not to disclose the context of your question.  But assuming you are talking about packet capture or flow monitoring devices, the issue is that, in a large network, you will be capturing or sampling at several points in your network -- there isn't one main aggregation point.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider a large network with several exit points (Internet, extranets, etc), as well as two or more data centers.  Where are you going to capture data?  You can try to capture everything in the core, but that has problems:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The speeds are usually higher, making equipment substantially more&#xA;expensive.&lt;/li&gt;&#xA;&lt;li&gt;Not all data flows traverse the core.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You can capture at the edges, where speeds are lower, but then you have many capture points (more equipment).  Often, you end up with a compromise, with some captures at the core or data center aggregation as well as some edge locations.&#xA;The result is a high probability that you will capture the same packet more than once-- once when it enters the network, once wen it passes through the core, and perhaps once and again when it reaches its destination.  In a large network, it's nearly impossible not to have duplicate packets if you want to have comprehensive monitoring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet de-duplicators are &quot;smart&quot; enough to detect that they have captured multiple copies of the same packet and only send one to whatever monitoring device (IPS, Netflow, FPC, etc) you may have.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-01-07T15:12:22.123" LastActivityDate="2017-01-07T15:12:22.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37843" PostTypeId="1" AcceptedAnswerId="37844" CreationDate="2017-01-07T16:37:48.333" Score="1" ViewCount="40" Body="&lt;p&gt;I have an ISP modem connected to a 24-port switch. Can I have the modem pass on port forwarding to the switch instead of it being done by the modem? How is this done? DMZ?&lt;/p&gt;&#xA;" OwnerUserId="32293" LastEditorUserId="8499" LastEditDate="2017-01-07T16:42:49.367" LastActivityDate="2017-01-07T16:42:49.367" Title="Change port forwarding to switch instead of modem" Tags="|switch|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37844" PostTypeId="2" ParentId="37843" CreationDate="2017-01-07T16:41:42.360" Score="0" Body="&lt;p&gt;Port forwarding is done by the device doing the NAT. It is unlikely that a switch will do NAT.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;It seems rather foolish to not have a firewall between your ISP and your network (switch). This puts your business at risk. You should have a firewall, and you can NAT on the firewall if you like, then you could forward ports there.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-07T16:41:42.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37845" PostTypeId="1" CreationDate="2017-01-07T16:58:56.560" Score="4" ViewCount="3417" Body="&lt;p&gt;My main question is why service providers don't move to all software switches? I know the answer must be the rates, capacity and port density of the hardware switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what are the difference between the throughout rate, port density supported and the capacity (in terms of memory) of hardware switches/routers, like Cisco ASR 1000 family and a software switch (OVS on DPDK) running on Intel Xeon E5 family for instance?&lt;/p&gt;&#xA;" OwnerUserId="33355" LastEditorUserId="33355" LastEditDate="2017-01-07T18:47:19.283" LastActivityDate="2017-01-08T05:34:37.173" Title="Software Switches vs Hardware Switches" Tags="|switch|hardware|" AnswerCount="2" CommentCount="3" ClosedDate="2018-03-24T21:16:19.843" ContentLicense="CC BY-SA 3.0" />
  <row Id="37846" PostTypeId="1" AcceptedAnswerId="37855" CreationDate="2017-01-07T17:41:04.283" Score="1" ViewCount="191" Body="&lt;p&gt;I admit I have some large holes in my understanding of this topic, but it seems like you run into physical limitations of the speed of light.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the speed of electricity through copper is about 280,000,000 meters per second, and the clock on the ethernet card is running at 125Mhz (found this online, not sure if this is the right speed), the signal should only be able to travel about &lt;code&gt;280,000,000 * (1/125,000,000) = ~2.24 meters&lt;/code&gt; before the next clock cycle starts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming only 1 bit can be on a wire at a time (possibly a bad assumption), how is 100 meters possible?&lt;/p&gt;&#xA;" OwnerUserId="33356" LastEditorUserId="8499" LastEditDate="2017-01-07T23:31:46.200" LastActivityDate="2017-01-07T23:31:46.200" Title="How can 100Base-T achieve 100 meter distance at 125Mhz clock?" Tags="|ethernet|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37848" PostTypeId="1" CreationDate="2017-01-07T18:38:46.180" Score="0" ViewCount="6046" Body="&lt;p&gt;I have a DHCP server set up on a L3 24port switch that connects to multiple routers that different clients connect to (hotel room scenario). With the dhcp on the switch everyone can see who is connected to the entire network if they look. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I only want devices connected to the same router to be able to see each other. (Can/should it be done from the L3 dhcp switch) or is it best to have dhcp done from the router?&lt;/p&gt;&#xA;" OwnerUserId="32293" LastEditorUserId="32293" LastEditDate="2017-01-07T18:51:17.520" LastActivityDate="2017-02-07T10:38:36.463" Title="DHCP server on Switch or on Router" Tags="|switch|router|dhcp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37849" PostTypeId="2" ParentId="37848" CreationDate="2017-01-07T19:06:18.393" Score="1" Body="&lt;p&gt;When you say 'everyone can see who is connected' who is everyone?  The DHCP reservations on that switch should only be visible to the network admins and not end-users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to have local DHCP for each routed network, DHCP on each router is perfectly fine.  From an administrative standpoint, this can be a burden since the DHCP reservations are not centralized for monitoring.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, I want to make sure I'm reading your question correctly as no users would be able to 'see' other devices connected to other routers via DHCP.  If access between networks is an issue then just block access with IPv4 access-lists.&lt;/p&gt;&#xA;" OwnerUserId="33300" LastActivityDate="2017-01-07T19:06:18.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37850" PostTypeId="2" ParentId="37845" CreationDate="2017-01-07T19:14:10.200" Score="8" Body="&lt;p&gt;It comes down to what is accelerated through purpose-built hardware/ASICs versus what traffic flows can be punted to software/CPU for processing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Physical switches have extremely fast switching speeds because of the purpose-built hardware ASICs meant for network switching.  A Xeon E5 can do it but will be slower since it is a general purpose chipset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also like others have said, physical switches are meant for high port-density for end-users/phones/servers that a virtual switch cannot match unless everything is already virtual.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's why software routers are more popular today compared to switches as many routing tasks are typically punted to CPU anyway in software so this can be extracted from a physical router and installed in a VM.  Cisco CSR1000v is a good example of a production-ready software router for terminating VPNs, dynamic peerings, control-plane for SD-WAN, etc.&lt;/p&gt;&#xA;" OwnerUserId="33300" LastActivityDate="2017-01-07T19:14:10.200" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37851" PostTypeId="1" AcceptedAnswerId="43286" CreationDate="2017-01-07T20:35:51.907" Score="3" ViewCount="1702" Body="&lt;p&gt;On &lt;a href=&quot;https://en.wikipedia.org/wiki/Slot_time&quot; rel=&quot;nofollow noreferrer&quot;&gt;wikipedia&lt;/a&gt; there is this paragraph:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Since a pulse's runtime will never exceed slot time (the maximum theoretical time for a frame to travel a network), the NIC waits a minimum of slot time before retransmitting after a collision happened, in order to allow any pulse that was initiated at the time that the &lt;strong&gt;waiting NIC&lt;/strong&gt; was &lt;strong&gt;requested to send&lt;/strong&gt;, to reach all other nodes. By allowing the pulse to reach the waiting NIC, a local collision occurs (ie. while still sending) rather than a late collision occurring (after sending may or may not has ended). By having the collision occur at the NIC (local) and not on the wire (late) CSMA/CD implementation recover the situation by retransmitting later.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What is the &lt;strong&gt;waiting NIC&lt;/strong&gt; referring to? Is it the NIC mentioned in the previous sentence or another NIC which was involved in the collision?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The NIC is &quot;&lt;strong&gt;requested to send&lt;/strong&gt;&quot; by the upper OSI layer (in other words, by the node that it is attached to) ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is the exponential back-off algorithm using multiples of the &lt;strong&gt;slot time&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand that the &lt;strong&gt;slot time&lt;/strong&gt; is computed such that a node is still transmitting when the signal announcing the collision (jamming signal) arrives at it. But what does this have to do with how much time nodes should wait after a collision occurs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another &lt;a href=&quot;https://en.wikipedia.org/wiki/Carrier_sense_multiple_access_with_collision_detection&quot; rel=&quot;nofollow noreferrer&quot;&gt;wikipedia&lt;/a&gt; article states:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The maximum jam-time is calculated as follows: The maximum allowed diameter of an Ethernet installation is limited to 232 bits. This makes a round-trip-time of 464 bits. As the slot time in Ethernet is 512 bits, the difference between slot time and round-trip-time is 48 bits (6 bytes), which is the maximum &quot;jam-time&quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Why should there be a &lt;strong&gt;maximum&lt;/strong&gt; jamming time?&lt;/p&gt;&#xA;" OwnerUserId="33361" LastActivityDate="2017-08-15T18:58:24.240" Title="CSMA/CD slot and jamming time" Tags="|ethernet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37852" PostTypeId="1" CreationDate="2017-01-07T21:13:29.487" Score="1" ViewCount="781" Body="&lt;p&gt;I have from my isp a static ip X.X.X.X and an unrouted public subnet Y.Y.Y.0/24 registred at ripe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An ex-coworker of mine setup a server that does the routing which have te folowing config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  ISP-------&amp;gt;(eth0) Server (eth1)---&amp;gt;Switch---&amp;gt; Multiple pc&#xA;X.X.X.X       eth0   : X.X.X.X            Static ip: Y.Y.Y.100-150 (each pc have its own public ip)&#xA;              eth1:2 : Y.Y.Y.1            Gateway  : Y.Y.Y.1&#xA;              eth1:3 : Y.Y.Y.2                                   &#xA;              eth1:4 : Y.Y.Y.3                                   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once I changed my plan to 10Gpbs (Internet in Romania is dirt cheap) the server was deprecated so we bougnt a new capable one.&#xA;I can't find on internet how to setup the new one to do exactly the same thing as the old one.... Most of the ISPs route the subnet themselves but mine doesn't.&#xA;When I called my ISP for help their answer was: &quot;Deal with it! Search on google !&quot;&lt;/p&gt;&#xA;" OwnerUserId="33362" LastEditorUserId="8499" LastEditDate="2019-01-04T23:28:38.950" LastActivityDate="2019-01-04T23:28:38.950" Title="How do I route a public /24 subnet?" Tags="|routing|subnet|isp|route-server|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37853" PostTypeId="2" ParentId="37852" CreationDate="2017-01-07T21:20:31.587" Score="2" Body="&lt;p&gt;You will need to run BGP with your ISP. BGP will advertise your prefix(es) to the ISP, and vice versa. If you only have one ISP, the you could negotiate for the ISP to only send a default route, or ignore what your ISP sends you in favor of a default route. You will need to get your own AS number unless your ISP will let you use a private AS number.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;You probably don't want to do this with a server. Use a real router. If you insist on using a server, then you should ask this question on &lt;a href=&quot;https://serverfault.com/&quot;&gt;Server Fault&lt;/a&gt; instead of here.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-08T21:53:47.823" LastActivityDate="2017-03-08T21:53:47.823" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="37854" PostTypeId="2" ParentId="37851" CreationDate="2017-01-07T21:33:12.637" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the waiting NIC referring to? Is it the NIC mentioned in the&#xA;  previous sentence or another NIC which was involved in the collision?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That refers to any NICs waiting to send a frame, especially those involved in a collision.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The NIC is &quot;requested to send&quot; by the upper OSI layer (in other words,&#xA;  by the node that it is attached to) ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The NIC is at OSI layer-1. OSI layer-2 for ethernet is the MAC layer. Layer-3 would be IP. Layer-4 is the transport protocol, e.g. TCP or UDP. Above layer-4 are the application layers (off-topic here). An application will start sending data to the transport layer, that then sends through the network layer to the MAC layer that gives it to the NIC.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is the exponential back-off algorithm using multiples of the slot&#xA;  time?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That makes sure that the back-off time is never less than the slot time, and it is quick and easy to calculate.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I understand that the slot time is computed such that a node is still&#xA;  transmitting when the signal announcing the collision (jamming signal)&#xA;  arrives at it. But what does this have to do with how much time nodes&#xA;  should wait after a collision occurs?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That makes sure that all stations have heard the jamming signal, and no station will transmit while the jamming signal is still traversing the link. A host immediately next to the host doing the jamming will hear the signal before other hosts on the link, and it will stop hearing the jamming signal while it is still traversing the link.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why should there be a maximum jamming time?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Jamming when it is no longer needed will slow collision recovery, and therefore, unnecessarily reduce throughput on the link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-07T21:33:12.637" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37855" PostTypeId="2" ParentId="37846" CreationDate="2017-01-07T21:41:00.680" Score="2" Body="&lt;p&gt;Your assumption that only one bit can be on the wire at a time is completely incorrect. Your calculations can compute how far apart the signals on the wire are, but all the bits of the entire frame can be on the wire at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also need to understand that one data bit does not equal one bit on the wire. You will need to understand the encoding used to figure that out.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-07T21:41:00.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37860" PostTypeId="2" ParentId="37830" CreationDate="2017-01-08T02:26:12.047" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/net_mgmt/prime/infrastructure/3-0/administrator/guide/PIAdminBook/SNMPTraps.html#48718&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Email Notifications for SNMP Traps&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/aW9eq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aW9eq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-08T02:26:12.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37861" PostTypeId="2" ParentId="37845" CreationDate="2017-01-08T05:34:37.173" Score="3" Body="&lt;p&gt;The basic architecture of general purpose compute is just that - general purpose.  It's great at applying significant amounts of processing power to a huge variety of workloads but it doesn't truly &lt;em&gt;excel&lt;/em&gt; at many of them.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example - GPU's are used because they're incredibly good at certain kinds of calculations and can perform the work that would equivalently be performed by dozens or hundreds of physical CPU's, all while consuming vastly less power and space while producing much less heat.  Could we build performant graphics cards out of tons of CPU's in parallel and just use software?  Probably, but it would kind of ridiculous.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same applies to networking.  Applying the problem of how to move massive amounts of I/O in a distributed fashion also doesn't map well to an architecture where all processing is basically handled on a small number of big, central CPU's.  As impressive as the amount of bandwidth is between a CPU and main memory nowadays it's a fraction of the aggregate throughput of even a few 40GE connections.  What's worse is that outside purpose-built hardware architectures such CPU's have to process interrupts for every single packet to be forwarded.  Oh, and this is just forwarding packets - no crypto, no translation, encapsulation or other intensive processes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do the math on how many packets per second need to be forwarded even on a 10GE link is about 14.8 &lt;strong&gt;million&lt;/strong&gt; per second in &lt;em&gt;one direction&lt;/em&gt; (with small packets).  A basic commodity 48-port 10GE switch  has to read, process and regenerate on the order of 1.4 &lt;em&gt;billion&lt;/em&gt; packets per second (..on top of any kind of control plane functions).  That's for a switch that was considered novel technology a decade ago.  At this point switches with nearly 300 &lt;strong&gt;100&lt;/strong&gt; gigabit ports are &lt;em&gt;readily&lt;/em&gt; available, with higher densities and speeds just a matter of product ship dates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way this has been approached is in a distributed fashion - pushing as much of that processing load to semi-autonomous processors running in dedicated silicon close to the ports themselves.  Processing terabits on a single piece of silicon is sci-fi.  Processing hundreds of gigabits on hundreds of parallel port ASIC's, though?  Done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why don't SP's just move the network to a bunch of Linux boxes or, better yet, push it to a public cloud?  Because all that compute can only exist in a useful way when its compute is surrounded by dedicated hardware that can feed it data (..and in turn that network hardware is only relevant because of the compute, of course).  Is there some cross-over in terms of programmability for network gear?  Absolutely.  Is there some common hardware for control planes?  Sure.  Cloud routers?  Totally.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately, though, just like the machine learning guys started on general purpose compute but have moved to GPU farms and, more recently, dedicated ASIC's so too can many basic networking tasks be run on general purpose compute (the vast majority of network gear never sees anything close to 100% utilization at any point in its life) but ultimately economics and practical engineering mean that there will always be dedicated network hardware.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Oh - and to let you in on a dirty secret, for a very, very long time now pretty much &lt;strong&gt;all&lt;/strong&gt; networking has been software-defined.)&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-08T05:34:37.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37862" PostTypeId="1" AcceptedAnswerId="37864" CreationDate="2017-01-08T05:51:11.307" Score="2" ViewCount="8402" Body="&lt;p&gt;According to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC791&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Every internet module must be able to forward a datagram of 68 octets without further fragmentation. This is because an internet header may be up to 60 octets, and the minimum fragment is 8 octets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;I'm a bit confused about the &amp;quot;an internet header may be up to 60 octets&amp;quot; part. The minimum size of a IPv4 header is 20 bytes and not 60. So shouldn't the minimum MTU be 20 bytes for the IPv4 header plus the minimum fragment which is 8 bytes? And shouldn't we consider the upper layer header lengths as well?&lt;/p&gt;&#xA;&lt;p&gt;The RFC also mentions:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Every internet destination must be able to receive a datagram of 576 octets either in one piece or in fragments to be reassembled.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;So is the MTU 68 bytes or 576 bytes?&lt;/p&gt;&#xA;" OwnerUserId="33242" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2018-12-27T01:14:20.650" Title="Why is the minimum MTU of a IPv4 packet 68 bytes?" Tags="|ip|ipv4|protocol-theory|rfc|mtu|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37863" PostTypeId="1" CreationDate="2017-01-08T06:46:30.367" Score="1" ViewCount="1676" Body="&lt;p&gt;I am a novice. Please bear with me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a cluster with 4 racks (A,B,C,D). Each rack consists of 25 machines and an ethernet switch.&#xA;Switch-A and -B are connected via Switch-D (Network Trunk)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that the inter-switch bandwidth is limited by the slow trunk connections.&#xA;(The speed of the network between Switch-A and -B is limited by the ports connected to the Switch-D)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there are remaining ports on each switch.&#xA;Can I increase the network bandwidth between Switch-A and -B by putting more cables between them? (Plugging cat-6 cables to the ports of Switch-A and -B)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no idea how to configure the switch. The switch is IBM System Networking RackSwitch G8000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where should I start to resolve this issue?&lt;/p&gt;&#xA;" OwnerUserId="33325" LastEditorUserId="33325" LastEditDate="2017-01-08T07:04:05.657" LastActivityDate="2017-01-08T11:37:05.017" Title="Connecting two ethernet switches for higher inter-switch bandwidth" Tags="|switch|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37864" PostTypeId="2" ParentId="37862" CreationDate="2017-01-08T07:04:01.543" Score="4" Body="&lt;p&gt;You need to account for Internet Options in the header.  Take a look at the third example in appendix A which shows a few option fields appended to get well past 20 bytes (the example adds 12 bytes, but the number is variable and can be more).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The upper-layer header lengths aren't IP's direct concern.  The header obviously contains information about the protocol type but apart from that the upper-layer protocol spec is outside the scope of the IP header.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the RFC is basically saying that, for a router, the biggest possible IP header is 60 bytes and the smallest payload is 8 bytes (so, a 68 byte packet).  In turn a given &lt;em&gt;end host&lt;/em&gt; must be able to receive a final packet of up to 576 bytes (which may be made up of a bunch of fragments, depending on the MTU's of routers along the path).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the minimum sized packet could - in theory - be 20 bytes of header (no options) plus the minimum 8 bytes of payload.  This would &lt;em&gt;have&lt;/em&gt; to be a fragment, as otherwise the packet would include some amount of L4 header protocol information.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-08T07:04:01.543" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37865" PostTypeId="2" ParentId="37863" CreationDate="2017-01-08T07:26:41.613" Score="3" Body="&lt;p&gt;I'm going to assume that the various servers in question are all in the same subnet (i.e. L2 domain).  If this isn't the case then you'll need a different approach.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, however, you'll want to logically bundle together a number of links between the switches using link aggregation.  Based on a quick Google the switch does apparently support 802.3ad link aggregation (see &lt;a href=&quot;http://www-01.ibm.com/support/docview.wss?uid=isg3T7000554&amp;amp;aid=1&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; on page 111).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will allow the traffic moving between the two switches to be generally balanced across the various links available.  I don't know the upper limit of your particular switch but it's safe to say that the lower limit is 2 and that it can likely support as many as 8 links.  The links should be the same speed, obviously.  Given the hashing algorithms at work the best balance tends to happen at powers of 2 - so 2, 4 or 8 links will work more efficiently than, say, 3 or 5. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please also keep in mind that the speed of a single flow between two servers can't be any faster than the speed of one of the links in the bundle.  Also keep in mind that traffic isn't going to be perfectly spread amongst the links.  It gets more efficient with a larger number but will always be somewhat unbalanced.  There may be tweaks to the hashing algorithm in use, but I don't know the IBM platform well enough to comment on particulars.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-08T07:26:41.613" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37866" PostTypeId="1" CreationDate="2017-01-08T07:34:45.833" Score="0" ViewCount="1755" Body="&lt;p&gt;I used a cluster with infiniband 40Gb switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the sake of testing my application program, I need to measure the performance at a network environment with lower communication speed such as 1Gbps or 10 Gbps ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to limit the network bandwidth usage of a certain network interface?&lt;/p&gt;&#xA;" OwnerUserId="33325" LastActivityDate="2017-03-09T17:44:30.200" Title="How can I limit bandwidth usage of a network interface?" Tags="|bandwidth|" AnswerCount="2" CommentCount="4" ClosedDate="2019-02-10T00:31:50.813" ContentLicense="CC BY-SA 3.0" />
  <row Id="37867" PostTypeId="2" ParentId="37848" CreationDate="2017-01-08T10:34:52.683" Score="2" Body="&lt;p&gt;If all you want to achieve is separate users from each other you can try setting &lt;a href=&quot;https://en.wikipedia.org/wiki/Private_VLAN&quot; rel=&quot;nofollow noreferrer&quot;&gt;Private VLAN&lt;/a&gt; or port isolation. This way each port can only communicate with gateway (uplink port). With such setup it does not matter whether DHCP server is directly on switch or external, but for flexibility reasons it is better to be external and just configure dhcp relay on switch to forward all requests to dhcp server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also if switch support &quot;gleaning&quot; to see DHCP transactions or DHCP lease query (RFC4388) it can even block all attempts of users to use unathorized IP addresses. For example on Mikrotik equipment you can use embedded DHCP server to put all DHCP clients into ARP tables directly and by turnning off arp responses it can force clients to only use DHCP assigned addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is theory. In practice it all depends on the actual hardware and software involved. By giving more info we can give you better answers with examples.&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2017-01-08T10:34:52.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37868" PostTypeId="2" ParentId="37863" CreationDate="2017-01-08T11:37:05.017" Score="0" Body="&lt;p&gt;Better balancing of traffic between ports depends on the switches being used. Enterprise switches often support also layer 3 and layer 4 hashing methods - so balancing also via IP addresses and ports. In such cases all traffic will be balanced among connections much better than simple Layer 2 hashing based on MAC addresses. So single session will not be faster than single port speed, but total throughput will be closer to limit of server or all the ports combined!&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2017-01-08T11:37:05.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37869" PostTypeId="2" ParentId="37866" CreationDate="2017-01-08T11:47:51.387" Score="1" Body="&lt;p&gt;If you are testing the application you can limit speed in virtual enviroment:&#xA;- in VirtualBox &lt;a href=&quot;https://www.virtualbox.org/manual/ch06.html#network_bandwidth_limit&quot; rel=&quot;nofollow noreferrer&quot;&gt;network bandwidth limit&lt;/a&gt; or &#xA;- in VMWare Workstation - &lt;a href=&quot;https://pubs.vmware.com/workstation-9/topic/com.vmware.ws.using.doc/GUID-7BFFA8B3-C134-4801-A0AD-3DA53BBAC5CA.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configure Bandwidth and Packet Loss Settings for a Virtual Machine&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With VMWare you can even simulate unstable connection with packet loss!&lt;/p&gt;&#xA;" OwnerUserId="8057" LastActivityDate="2017-01-08T11:47:51.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37870" PostTypeId="1" AcceptedAnswerId="37886" CreationDate="2017-01-08T12:00:48.173" Score="1" ViewCount="942" Body="&lt;p&gt;I heard about plenty of alternatives to ethernet like for example token ring, ARCNET, SONET, or to IP4/6 for example IPX but once I decided to look for software and hardware support I realized those are rather historic protocols and no modern, high speed hardware is available. I know that PPP over various serial stuff and DSL family protocols are still widely used by ISP. Also some fibre protocols - GPON/GEPON.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is - what are &lt;em&gt;currently used&lt;/em&gt; protocols and link technologies capable of being used as interconnect between border TCP/IP networks?. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not necessarily mainstream or super popular - but just still usable with modern hardware/software support.&lt;/p&gt;&#xA;" OwnerUserId="8352" LastEditorUserId="8352" LastEditDate="2017-01-08T12:28:00.020" LastActivityDate="2017-01-09T02:59:22.520" Title="What are currently used L2 and L3 protocols? (other than ethernet and ip4/6)" Tags="|protocol-theory|transport-protocol|standardisation|" AnswerCount="1" CommentCount="4" ClosedDate="2019-02-15T05:37:58.533" ContentLicense="CC BY-SA 3.0" />
  <row Id="37872" PostTypeId="1" AcceptedAnswerId="37876" CreationDate="2017-01-08T14:48:21.363" Score="1" ViewCount="447" Body="&lt;h2&gt;Information&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I have recently been learning networking programming with Python, and I am now building a &lt;strong&gt;host scanner&lt;/strong&gt; utilizing the &lt;strong&gt;ICMP Destination Unreachable Message&lt;/strong&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed, I have partially realized it. I can identify all the Windows/Linux/Android systems that connect to the networks at my home, but the problem is that:  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I could not use the same way to find &lt;strong&gt;all the hosts with MacOS and IOS systems&lt;/strong&gt;.  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;h2&gt;My Code&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here following is the main part which I used to decide if there exists a host:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/YqihR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YqihR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;I have sent a message &quot;PYTHONRULES!&quot; to a port to every possible IP in my IP subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And my result is the following:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SCqSZ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SCqSZ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, in fact, at my room I have connected the wifi with an iPhone, a MBP and an Ubuntu(using the bridged network with VirtualBox).&lt;br&gt;&#xA;I have checked each devices with its ip,  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;1. iPhone: 192.168.0.4&lt;br&gt;&#xA;2. MBP: 192.168.0.2&lt;/strong&gt;&lt;br&gt;&#xA;3. Ubuntu: 192.168.0.21&lt;br&gt;&#xA;4. DNS Server: 192.168.0.1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Easy to see, the problem exists.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What I Have Done&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I have directly checked the returned ICMP message from MBP to avoid the situation that the port is indeed active. &lt;strong&gt;the return ICMP type and code both equal to 3(That is Destination Host Unreachable)&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;I have then checked the length of each of the returned messages. Here the difference comes:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The length of returned message from &lt;strong&gt;Ubuntu is 68 bytes&lt;/strong&gt;, while the length of that from &lt;strong&gt;MBP is 56 bytes.&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;I have also tried in a networks with &lt;strong&gt;Windows systems&lt;/strong&gt; which also returned a message of &lt;strong&gt;68 bytes&lt;/strong&gt; as the Ubuntu.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;I have searched through the Google about the phenomena, but could not find detailed explanation.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I have searched through the Google about the format of &lt;strong&gt;ICMP Destination Unreachable Message&lt;/strong&gt;, which states as&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;IP Header(20 bytes) + ICMP Header(8 bytes) + Original IP Header(20 bytes) + First 8 bytes of the original message(8 bytes)(ps: I supposed this to be the UDP header here)&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which is equal to the length of what returned from MBP, 56 bytes. So, definitely the more 12 bytes from the Ubuntu is the length of the message I have sent and I actually used this information to make sure that the returned message is a response to what I sent. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;h2&gt;Questions&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;As a result, here come my questions,  &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;If I am not misunderstood, there does exist a difference between ICMP Destination Host Unreachable Message from MacOS/IOS and Windows?? Why???&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;And if I want to use the same strategy to decide if there is a host, how could I modify my codes and make sure that returned message is a response to what I have sent for every systems(windows, MacOS/IOS and Linux). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="33367" LastEditorUserId="33367" LastEditDate="2017-01-08T14:53:24.540" LastActivityDate="2017-01-08T17:04:37.660" Title="Does there exist a difference between ICMP Destination Host Unreachable Message from MacOS/IOS and from Windows/Ubuntu?" Tags="|ipv4|icmp|network|" AnswerCount="1" CommentCount="1" ClosedDate="2017-01-08T17:57:32.810" ContentLicense="CC BY-SA 3.0" />
  <row Id="37873" PostTypeId="1" CreationDate="2017-01-08T15:09:49.983" Score="1" ViewCount="3088" Body="&lt;p&gt;I am having trouble configuring trunking on these switches. I am unsure how to configure different VLANs on different switches, each connected to one another. I tried to configure the 802.1Q trunk on these switches using the &lt;code&gt;switchport encapsulation&lt;/code&gt; command. However, every time I issue this command, an error message occurs. I tried configuring the interface with the &lt;code&gt;switchport mode trunk&lt;/code&gt; command. However, every time I issue the &lt;code&gt;switchport allowed vlan&lt;/code&gt; command and then the VLAN numbers I want to enable, which are &lt;code&gt;1-3&lt;/code&gt;, I get an error message. Could you please provide an explanation as clearly as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch1-vlan 1 is called Research and management. &#xA;Switch2- vlan2 is called Sales and Marketing&#xA;Switch3- vlan 3 is the server vlan&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/pRfRh.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/pRfRh.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6SsXp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6SsXp.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33318" LastEditorUserId="8499" LastEditDate="2017-01-08T19:29:10.337" LastActivityDate="2017-01-08T21:07:00.540" Title="Trunking between switches" Tags="|cisco|switch|vlan|trunk|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37874" PostTypeId="2" ParentId="37873" CreationDate="2017-01-08T15:42:12.973" Score="0" Body="&lt;p&gt;First of all, you must configure all 3 VLANs on all Switches. After that you can deploy the trunking ports configuration:&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch3: int fa0/5 &lt;br/&gt;&#xA;Switchport mode trunk&lt;br/&gt;&#xA;Switchport trunk allowed vlan 1-3&lt;br/&gt;&#xA;&lt;br/&gt;&#xA;Switch2: int fa0/4 &lt;br/&gt;&#xA;Switchport mode trunk&lt;br/&gt;&#xA;Switchport trunk allowed vlan 1-3&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch2: int fa0/1 &lt;br/&gt;&#xA;Switchport mode trunk&lt;br/&gt;&#xA;Switchport trunk allowed vlan 1-3&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch1: int fa0/2 &lt;br/&gt;&#xA;Switchport mode trunk&lt;br/&gt;&#xA;Switchport trunk allowed vlan 1-3&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suppose that the Router R2 work like router on a stick ?&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch1: int fa0/3 &lt;br/&gt;&#xA;Switchport mode trunk&lt;br/&gt;&#xA;Switchport trunk allowed vlan 1-3&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco 2960 supports only IEEE 802.1Q trunking methods for sending VLAN traffic over Ethernet ports&lt;/p&gt;&#xA;" OwnerUserId="31495" LastEditorUserId="31495" LastEditDate="2017-01-08T18:10:32.763" LastActivityDate="2017-01-08T18:10:32.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37876" PostTypeId="2" ParentId="37872" CreationDate="2017-01-08T17:04:37.660" Score="3" Body="&lt;p&gt;What you are seeing is the difference between older and newer versions of the ICMP standard. The original specification stated that the header + 8 bytes (64 octets) must be included, but &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1812#section-4.3.2.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1812&lt;/a&gt; states:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Historically, every ICMP error message has included the Internet header and at&#xA;least the first 8 data bytes of the datagram that triggered the error.&#xA;This is no longer adequate, due to the use of IP-in-IP tunneling and other&#xA;technologies.  Therefore, the ICMP datagram SHOULD contain as much of the&#xA;original datagram as possible without the length of the ICMP datagram exceeding&#xA;576 bytes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Apparently IOS and Mac OS use the older specification which doesn't include anything beyond your UDP header. Your code assumes that the last 12 bytes of the ICMP error is your &lt;code&gt;magic_message&lt;/code&gt;, which only happens when the other device implements the revised RFC 1812 definition.&lt;/p&gt;&#xA;" OwnerUserId="632" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-01-08T17:04:37.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37877" PostTypeId="2" ParentId="7928" CreationDate="2017-01-08T17:30:29.410" Score="0" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Word_(computer_architecture)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Word&lt;/a&gt; size.  They were writing software, not designing computer hardware - although I'm sure they had performance and portability in mind.  At that time, 32 bit was the &lt;code&gt;word&lt;/code&gt;, the &lt;code&gt;longword&lt;/code&gt;, or &lt;code&gt;int&lt;/code&gt; or &lt;code&gt;longInt&lt;/code&gt; or whatever.  See &lt;a href=&quot;https://en.wikipedia.org/wiki/Word_(computer_architecture)#Word_size_choice&quot; rel=&quot;nofollow noreferrer&quot;&gt;Word Size Choice&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They wrote this software &quot;during the first decades of 32-bit architectures (the 1960s to the 1980s).&quot; -&lt;a href=&quot;https://en.wikipedia.org/wiki/32-bit&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2017-01-08T19:53:03.153" LastActivityDate="2017-01-08T19:53:03.153" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37878" PostTypeId="2" ParentId="37873" CreationDate="2017-01-08T18:04:32.677" Score="1" Body="&lt;p&gt;The allowed vlan command is not correct.  Try using: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk allowed vlan 1-3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As mentioned you'll want to ensure that all three switches have the vlans created and that all three are trunked on all links.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interface trunk &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The above command will allow you to verify the trunking protocol and vlans in the trunk. as mentioned, some switches only support one protocol, and do not allow the encapsulation to be configured. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, it's a best practice to not use vlan 1 for anything.&lt;/p&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-01-08T18:04:32.677" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37879" PostTypeId="2" ParentId="37873" CreationDate="2017-01-08T18:04:41.220" Score="1" Body="&lt;p&gt;You are missing the &lt;code&gt;trunk&lt;/code&gt; keyword in your &lt;code&gt;switchport allowed vlan 1-3&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport trunk allowed vlan 1-3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, many switches will now only do 802.1Q encapsulation, so the command to set the encapsulation is no longer needed or supported. It is only use on switches that can be set to different encapsulations.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-08T18:04:41.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37880" PostTypeId="2" ParentId="37873" CreationDate="2017-01-08T21:07:00.540" Score="-1" Body="&lt;p&gt;Issues with standing up trunking usually revolve around the ports shutting themselves down due to STP/loop protection.  Start by administratively shutting down the ports you want to trunk.  Then configure them, then administratively turn them hack up / &lt;code&gt;no shut&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All you really have to do is configure a &lt;code&gt;port-group 1&lt;/code&gt; interface, then assign the individual port(s) to &lt;code&gt;switchport mode trunk&lt;/code&gt; and &lt;code&gt;trunk mode on&lt;/code&gt; (I believe/if I remember correctly), and lastly assign &lt;code&gt;trunk group 1&lt;/code&gt;.  Unshut, you're good.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-08T21:07:00.540" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37882" PostTypeId="2" ParentId="35757" CreationDate="2017-01-09T01:34:26.013" Score="4" Body="&lt;p&gt;We're talking about two different versions of spanning-tree, IEEE 802.1D STP standard and IEEE 802.1W RSTP, they cannot work together because 802.1D does not understand RSTP BPDUs, but when a RSTP Switch receives an 802.1D BPDU, it responds with 802.1D BPDU and &#xA;eventually the two switches runs 802.1D to communicate.&lt;br/&gt;&#xA;The best practice is to configure RSTP on all Switched environment.&lt;br/&gt;&#xA;&lt;br/&gt;&#xA;I don't understand the need of spanning-tree on the routers, they never cause a layer 2 loop.&lt;/p&gt;&#xA;" OwnerUserId="31495" LastActivityDate="2017-01-09T01:34:26.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37884" PostTypeId="2" ParentId="19869" CreationDate="2017-01-09T01:51:17.857" Score="0" Body="&lt;p&gt;You should check a few things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if the access port are belongs to the desired vlan on L2 Switch&lt;/li&gt;&#xA;&lt;li&gt;if the desired VLANs are present on L2 Switch&lt;/li&gt;&#xA;&lt;li&gt;if the VLANs are allowed on trunk interface&lt;/li&gt;&#xA;&lt;li&gt;if the SVI's are up on Multilayer Switch&lt;/li&gt;&#xA;&lt;li&gt;and then fainally the DHCP pools&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you have any other problem please attach the show running-config of the Multilayer Switch&lt;/p&gt;&#xA;" OwnerUserId="31495" LastEditorUserId="31495" LastEditDate="2017-01-11T17:46:34.390" LastActivityDate="2017-01-11T17:46:34.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37885" PostTypeId="2" ParentId="3134" CreationDate="2017-01-09T01:55:02.803" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any compelling argument for keeping things the way they are?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Good question, some thoughts.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Compatibility is often more important than efficiency. &lt;/li&gt;&#xA;&lt;li&gt;Most network builders (outside some very high security applications) don't want to statically assign devices to ports. So some kind of system for automatically locating devices is needed.&lt;/li&gt;&#xA;&lt;li&gt;It is useful to have an identifier that identifies a specific piece of hardware wherever it happens to be plugged in.&lt;/li&gt;&#xA;&lt;li&gt;For IPv4 at least we probably don't want to waste an IPv4 address on every switch port. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;It would probably be possible to design a link protocol that solved 2 through 4 while having a lower encapsulation overhead than Ethernet framing or possibly no Encapsulation overhead at all but it would not be a trivial case of saying &quot;just use IP&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And then you still have to convince people about 1, lots of pain in adopting a new standard for a relatively small gain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cranking up the speeds while keeping the framing format the same is the path of least resistance. So it's what happens.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-09T01:55:02.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37886" PostTypeId="2" ParentId="37870" CreationDate="2017-01-09T02:59:22.520" Score="2" Body="&lt;p&gt;There's a pretty good Wikipedia article that has a list that's not exhaustive but is quite thorough - check it out &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_network_protocols_(OSI_model)&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As far as &lt;em&gt;currently&lt;/em&gt; used?  It's probably safe to say that &lt;em&gt;somewhere&lt;/em&gt; just about all of them are probably either encapsulated (usually in IP or MPLS) or are soldiering on forgotten in a dusty closet.  If one has &lt;em&gt;truly&lt;/em&gt; died in the real world someone in a museum has resurrected a bit of it for posterity (or as a cautionary tale).  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-09T02:59:22.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37887" PostTypeId="1" CreationDate="2017-01-09T03:16:57.290" Score="4" ViewCount="989" Body="&lt;p&gt;Hoping someone has an oid to poll (get/walk) an MX router to retrieve configured static route information and next-hop? Searched MIBs and mib walks on router to no avail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="33378" LastActivityDate="2017-01-10T00:08:34.880" Title="Juniper MX snmp oid for static route" Tags="|juniper|juniper-mx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37888" PostTypeId="1" AcceptedAnswerId="37889" CreationDate="2017-01-09T03:37:15.587" Score="1" ViewCount="78" Body="&lt;p&gt;so for simplicity sake in testing this configuration, I have a sample project that looked like this: &#xA;&lt;a href=&quot;https://i.stack.imgur.com/TnFwO.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TnFwO.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;breakdown:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://pastebin.com/ekMnexg4&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configurations&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vlans configured on multilayer switch which is also vtp server:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vlan 2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip address 192.168.2.1 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ip helper-address 192.168.3.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;vlan 3:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ip address 192.168.3.2 255.255.255.0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;dhcp resides in vlan 3, static address 192.168.3.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pool:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;default gateway: 192.168.3.254&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;starting ip: 192.168.3.2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;subnet mask: 255.255.255.0 &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;maximum users: 200&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;all crossover connections are trunks (verified)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;all straight connections are assigned to vlan 3 (verified)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pc 1 &amp;amp; 2 can properly receive a response from the DHCP server, but PC0 cannot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to get this to work while attempting to debug a 3 tier network design I'm working on for my networking 101 class. After multiple days trying to figure out why the traffic is not properly routing, I broke down the design trying to find the point of failure. As far as I have narrowed down, the issue is from intermediary switch (switch 1) which is part of the distribution layer but I am unable to grasp what is wrong with it's configuration (all ports trunk, vtp mode transparent).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel like I've missed something very fundamental in the routing setup, especially as I've gotten this configuration to work in the past, but I am unable to replicate the proper configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;//&#xA;//multilayer switch0&#xA;//&#xA;Building configuration...&#xA;&#xA;Current configuration : 2249 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip routing&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/5&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/7&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/8&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/9&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/10&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/11&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/12&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/13&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/14&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/15&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/16&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/17&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/18&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/19&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/20&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/21&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/22&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/23&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport trunk encapsulation dot1q&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan2&#xA; mac-address 0010.1151.c701&#xA; ip address 192.168.2.1 255.255.255.0&#xA; ip helper-address 192.168.3.1&#xA;!&#xA;interface Vlan3&#xA; mac-address 0010.1151.c702&#xA; ip address 192.168.3.254 255.255.255.0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&#xA;&#xA;//&#xA;//switch 0&#xA;//&#xA;Switch#sh running-config&#xA;Building configuration...&#xA;&#xA;Current configuration : 2168 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/5&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/7&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/8&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/9&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/10&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/11&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/12&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/13&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/14&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/15&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/16&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/17&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/18&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/19&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/20&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/21&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/22&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&#xA;//&#xA;//switch1&#xA;//&#xA;Building configuration...&#xA;&#xA;Current configuration : 1620 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;!&#xA;!&#xA;vtp mode transparent&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/5&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/7&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/8&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/9&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/10&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/11&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/12&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/13&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/14&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/15&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/16&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/17&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/18&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/19&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/20&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/21&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/22&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/23&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&#xA;//&#xA;// switch 2&#xA;//&#xA;Building configuration...&#xA;&#xA;Current configuration : 2168 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/5&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/6&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/7&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/8&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/9&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/10&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/11&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/12&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/13&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/14&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/15&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/16&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/17&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/18&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/19&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/20&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/21&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/22&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&#xA;//&#xA;// switch 3&#xA;//&#xA;Building configuration...&#xA;&#xA;Current configuration : 1118 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33380" LastEditorUserId="33380" LastEditDate="2017-01-09T04:17:21.450" LastActivityDate="2017-01-09T04:37:54.127" Title="unable to route traffic 2 switches deep (3 tier design)" Tags="|routing|switch|dhcp|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37889" PostTypeId="2" ParentId="37888" CreationDate="2017-01-09T04:02:14.780" Score="0" Body="&lt;p&gt;You either need to use VTP or manually configure the VLANs in global configuration, and you can optionally name them so that it makes sense:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vlan 2&#xA; name Name2&#xA;!&#xA;Vlan3&#xA; name Name3&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-09T04:37:54.127" LastActivityDate="2017-01-09T04:37:54.127" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37890" PostTypeId="1" AcceptedAnswerId="37891" CreationDate="2017-01-09T04:55:17.693" Score="1" ViewCount="622" Body="&lt;p&gt;I am following the guide that is &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_55_se/configuration/guide/3560_scg/swlldp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;listed here&lt;/a&gt; for enabling LLDP on my Cisco Catalyst 3560G switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short I entered the following into my switch.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch# configure terminal&#xA;Switch(config)# lldp run&#xA;Switch(config)# interface GigabitEthernet 0/5&#xA;Switch(config-if)# lldp transmit&#xA;Switch(config-if)# lldp receive&#xA;Switch(config-if)# end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What I am confused about however is that LLDP is enabled on all ports not just 0/5. This is actually what I wanted but I am curious if specifying 0/5 which I am forced to do or it doesn't recognize the command has any implications?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone has a better title for this let me know. I am very new to switches and layer 2 networking protocols.&lt;/p&gt;&#xA;" OwnerUserId="33004" LastEditorUserId="33004" LastEditDate="2017-01-09T05:34:09.657" LastActivityDate="2017-05-10T00:54:58.560" Title="Cisco LLDP config question" Tags="|cisco|cisco-catalyst|lldp|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="37891" PostTypeId="2" ParentId="37890" CreationDate="2017-01-09T06:06:26.760" Score="1" Body="&lt;p&gt;Summarizing the conversation of this post the command&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet 0/5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Was not doing anything since LLDP was enabled globally already. This would however allow you to disable LLDP on an interface and have it enabled on every other port. I don't see a huge use for enabling it on just one port other than being explicit but maybe someone else can fill in this knowledge gap.&lt;/p&gt;&#xA;" OwnerUserId="33004" LastActivityDate="2017-01-09T06:06:26.760" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37892" PostTypeId="1" AcceptedAnswerId="37916" CreationDate="2017-01-09T06:26:28.657" Score="1" ViewCount="410" Body="&lt;p&gt;Please consider the attached image below:&#xA;A GRE tunnel is set up between R1 and R4.&#xA;Tunnel source is R1 interface having the IP address &lt;code&gt;172.16.0.1/16&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tunnel destination is R4 interface having the IP address &lt;code&gt;192.16.0.2/16&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is IGP reachabilty between &lt;code&gt;172.16.0.0/16&lt;/code&gt;and &lt;code&gt;192.16.0.0/16&lt;/code&gt; network.&#xA;Hence we bring up the tunnel as below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On R1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config)#interface tunnel 1   &#xA;R1(config-if)#tunnel source 172.16.0.1&#xA;R1(config-if)#tunnel destination 192.16.0.2&#xA;R1(config-if)#ip address 8.8.8.1 255.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On R4&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R4(config)#interface tunnel 1   &#xA;R4(config-if)#tunnel source 192.16.0.2&#xA;R4(config-if)#tunnel destination 172.16.0.1&#xA;R4(config-if)#ip address 8.8.8.2 255.0.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Objective is to ping &lt;code&gt;4.4.4.4&lt;/code&gt; with Source as &lt;code&gt;1.1.1.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1: When the packet is encapsulated, how will it look like?&#xA;Please explain in terms of Outer source IP address, Outer Destination IP address, Inner Source IP address, Inner destination IP address, GRE header etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A: Outer Source IP address: &lt;code&gt;8.8.8.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Outer Dest IP address: &lt;code&gt;8.8.8.2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inner Src IP address: &lt;code&gt;1.1.1.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Inner Dest IP address: &lt;code&gt;4.4.4.4&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2: Since R2 and R3 DO NOT have knowledge of tunnel, how will they see when the packet comes to them? What Source and destination IP address will they see? Why would they not drop the packet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A: R2 and R3 are unaware of the tunnel. Hence they have no knowledge of the &lt;code&gt;8.0.0.0&lt;/code&gt; subnet. So when the packet comes to R2, it will ONLY see the TUNNEL DESTINATION, e.g. &lt;code&gt;192.16.0.2&lt;/code&gt;, but what about the Src IP address? My confusion here is, will the original packet be tweaked? What happens to Outer Src IP address and Outer Dest IP address at this point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3: The most common advantage of GRE tunnel(they say) is support for multicast (thereby we can run routing protocols over the tunnel as routing protocols require multicast. Is that the only advantage?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A: I guess this is the major advantage&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q4: To bring up the tunnel itself, we need to ensure that the Tunnel Source and destination are reachable (say via IGP), then how is it different from Q3? I mean, to bring the tunnel itself, we need the IGP reachabilty (which would also require multicast).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A:I am not sure of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jFey6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jFey6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have updated the post with my own answer. Please correct me if wrong.&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="8499" LastEditDate="2017-01-09T19:08:07.667" LastActivityDate="2017-01-09T21:41:47.260" Title="Regarding Gre tunnel encapsulation" Tags="|ip|tunnel|gre|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="37893" PostTypeId="1" AcceptedAnswerId="37911" CreationDate="2017-01-09T09:23:19.943" Score="2" ViewCount="333" Body="&lt;p&gt;I do networking generally, i have recently been using 802.11AC devices (Ubiquiti, Mikrotik) to transfer data over short Distances like 3KM. They generally provided good throughputs, i was reading about 802.16 Wimax Standards. I always thought the kind of connections i was doing with 802.11n and 802.11ac are wimax.. I guess my main question is , with the relatively new 802.11AC , how should i choose between the two? Especially for long distance transmitions, lets say 10KM&lt;/p&gt;&#xA;" OwnerUserId="25610" LastActivityDate="2017-02-08T20:00:53.737" Title="802.11AC Vs 802.16" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37896" PostTypeId="1" AcceptedAnswerId="37897" CreationDate="2017-01-09T11:27:18.897" Score="79" ViewCount="518343" Body="&lt;p&gt;Yesterday an interviewer asked me what the port number for ping is and which protocol ping uses: TCP or UDP.&lt;/p&gt;&#xA;&lt;p&gt;After the interview, I searched on the Internet and found different results: someone says ICMP uses port 7, someone says it does not use any port number, on one site I found it uses IP protocol 1, etc.&lt;/p&gt;&#xA;&lt;p&gt;Can anyone help me with the correct explanation?&lt;/p&gt;&#xA;" OwnerUserId="22728" LastEditorUserId="43734" LastEditDate="2023-12-15T05:31:19.630" LastActivityDate="2023-12-15T05:31:19.630" Title="Ping port number?" Tags="|tcp|ping|udp|icmp|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="37897" PostTypeId="2" ParentId="37896" CreationDate="2017-01-09T11:35:37.907" Score="105" Body="&lt;p&gt;The standard ping command does not use TCP or UDP. It uses ICMP. To be more precise ICMP type 8 (echo message) and type 0 (echo reply message) are used.&#xA;ICMP has no ports!&lt;/p&gt;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc792&quot; rel=&quot;noreferrer&quot;&gt;RFC792&lt;/a&gt; for further details.&lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorUserId="-1" LastEditorDisplayName="user2084" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2017-01-09T12:11:52.523" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37900" PostTypeId="1" CreationDate="2017-01-09T13:53:26.647" Score="1" ViewCount="702" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/KMYuz.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KMYuz.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I'm trying to enable span mirroring in cisco switch, but the switch doesn't seem to have the &amp;quot;monitor&amp;quot; option. Could someone tell me how to make this work?&lt;/p&gt;&#xA;" OwnerUserId="33389" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-01-09T18:07:12.647" Title="SPAN mirroring in cisco switch - Invalid input error" Tags="|cisco|mirror|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="37909" PostTypeId="2" ParentId="37900" CreationDate="2017-01-09T18:07:12.647" Score="2" Body="&lt;p&gt;Packet Tracer has some built-in functionality to allow you to view the packets on the wire and won't support the monitor commands.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if you weren't on tracer, the setup is straightforward. E.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;monitor session 1&#xA;monitor session 1 source int gi1/0/2 both (-- specifies span tx and rx&#xA;monitor sessions 1 destination int gi1/0/3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-01-09T18:07:12.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37910" PostTypeId="1" CreationDate="2017-01-09T19:18:26.083" Score="0" ViewCount="2673" Body="&lt;p&gt;We have Cisco 2801 router , which uses static NAT translation.The problem is that we are not able to remove the NAT entry from the 2801 router.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We tested with the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config)#clear ip nat translation*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The router will take the command but nothing happens. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tried adding another NAT to the existing line, then the result was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config)#ip nat outside source static tcp 192.168.3.11 80 201.x.x.x 80 extendable&#xA;&#xA;% similar static entry (192.168.3.11-&amp;gt; 201.x.x.x ) already exists&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, how can we permanently delete this NAT?&lt;/p&gt;&#xA;" OwnerUserId="33309" LastEditorUserId="509" LastEditDate="2017-01-10T12:31:50.133" LastActivityDate="2017-01-10T12:31:50.133" Title="How do we remove Static NAT from 2801 Router?" Tags="|cisco|nat|" AnswerCount="1" CommentCount="2" ClosedDate="2018-08-05T00:09:10.753" ContentLicense="CC BY-SA 3.0" />
  <row Id="37911" PostTypeId="2" ParentId="37893" CreationDate="2017-01-09T19:40:54.947" Score="4" Body="&lt;p&gt;WiMax operates in spectra that needs to be licensed from the FCC (or the corresponding body if you're not in the US).  Depending on the frequency in use the licensing process may- or may not- be an issue, but it's not a situation where you can simply buy the gear and start using it the same day. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast, the 802.11 standards operate in unlicensed frequencies and don't require a special license.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are plenty of Wifi links operating at- and well beyond- the 10KM mark, with the caveat that the link needs to be properly surveyed and engineered and appropriate antennae (read: high gain / highly directional) employed.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general I would say that there's a lot more activity happening with 802.11 than 802.16.  This means that there's more (and cheaper) solutions and a lot more innovation and development happening in the industry.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-09T19:40:54.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37912" PostTypeId="2" ParentId="37910" CreationDate="2017-01-09T19:47:54.720" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You need to look at your existing configuration (&lt;code&gt;sh run&lt;/code&gt; from an enabled prompt) and find the existing NAT configuration (&lt;code&gt;ip nat inside...&lt;/code&gt; or &lt;code&gt;ip nat outside...&lt;/code&gt; with the dots being the remainder of the command). &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Enter configuration mode (&quot;conf t&quot;) &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Type &quot;no&quot; before the line to be removed.  So - for example - if it presently has something like &quot;ip nat inside source ...&quot; you would type &quot;&lt;strong&gt;no&lt;/strong&gt; ip nat inside source...&quot; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;At this point you should be able to enter the new translation command. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Don't forget to save your configuration when you're done. &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-09T19:47:54.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37913" PostTypeId="1" CreationDate="2017-01-09T19:56:34.050" Score="3" ViewCount="1092" Body="&lt;p&gt;If i would like to do a BGP peering with someone do i need to have a direct connection to him? Meaning that we are in the same segment?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If not, would i be able to do a peering with someone even if i use a standard DSL connection (with static ip address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What i don't understand here that when i announce my AS to someone and i have for instance the ip 20.100.100.1 on my DSL link. If i now announce 30.100.100.0/24 to someone, he will start sending packages addressed to this subnet to my DSL ip address. But does my DSL provider not throw away those packages as the are addressed to someone else, or if they are addressed to me, how do i know where they were originally addressed to? &lt;/p&gt;&#xA;" OwnerUserId="33400" LastActivityDate="2018-10-25T21:46:25.117" Title="Which kind of connection do i need for BGP peering?" Tags="|routing|bgp|adsl|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37914" PostTypeId="2" ParentId="37913" CreationDate="2017-01-09T20:04:34.930" Score="0" Body="&lt;p&gt;You need to peer with your ISP, or you need to create a tunnel to the network with which you want to peer. ASes (Autonomous Systems) are, by definition, autonomous, so you will have no control over what the other AS will or will not send to you. All you can do is advertise some or all of your prefixes to the other AS, and use any of the prefixes the other AS advertises to you.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-09T20:04:34.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37915" PostTypeId="2" ParentId="37913" CreationDate="2017-01-09T21:10:05.933" Score="0" Body="&lt;p&gt;Remember that BGP is an application that merely advertises prefixes between peers and rides on top of IP/TCP port 179.  There already needs to be 'underlay' reachability between peers either by connected routes or other dynamic/static routing protocols.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;eBGP&lt;/strong&gt; requires directly-connected peers as the TTL=1 for those hellos.  This can be overridden with the 'ebgp-multihop #' to set a different TTL.  eBGP is by definition between two different autonomous systems (AS).  This is typical for ISP connections&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;iBGP&lt;/strong&gt; has a TTL of 255 so this can be peered across the enterprise within the same AS.  This is typical for enterprise remote site connections or internal BGP as the main routing protocol of the enterprise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With BGP you peer directly via IP address and not by multicasted hellos so static IP addressing is preferred as both sides of the peering need to match as it requires a TCP handshake for the peering to establish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are correct in that when you advertise a prefix to your ISP, the updates include your IP next-hop to point to your edge IP address.  This is how the internet routers will route back to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone else in the internet advertises the same prefix via BGP, hopefully this does not happen as there is not much to do other than rely on backbone ISP filtering that will disregard the advertisement from other enterprises.  As long as you have the route advertised first, oldest route wins between multiple paths from the ISP's perspective.&lt;/p&gt;&#xA;" OwnerUserId="33300" LastActivityDate="2017-01-09T21:10:05.933" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37916" PostTypeId="2" ParentId="37892" CreationDate="2017-01-09T21:41:47.260" Score="2" Body="&lt;p&gt;Q1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Inner Source: 1.1.1.1&#xA;Inner Dest: 4.4.4.4&#xA;Outer source: 172.16.0.1&#xA;Outer Dest: 192.16.0.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Q2:&#xA;The source address is the tunnel source, 172.16.0.1 (for R1-R4 traffic).  The inner and outer addresses are not modified.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3:&#xA;That is only one advantage. There are many uses.   Generally, you use a tunnel whenever you need to hide the underlying infrastructure. or when you can't route over it directly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q4:&#xA;The tunnel &quot;hides&quot; the underlying topology.   &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-09T21:41:47.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37917" PostTypeId="2" ParentId="37913" CreationDate="2017-01-09T23:21:56.230" Score="1" Body="&lt;p&gt;You must have IP connectivity to the BGP peer.  It is unnecessary for the BGP peer to be adjacent; it can be several hops away.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-09T23:21:56.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37919" PostTypeId="2" ParentId="37887" CreationDate="2017-01-10T00:08:34.880" Score="5" Body="&lt;p&gt;The best you'll be able to get is &lt;code&gt;inetCidrRouteTable&lt;/code&gt; from &lt;code&gt;IP-FORWARD-MIB&lt;/code&gt; - this will give you all routes, regardless of protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OID is &lt;code&gt;.1.3.6.1.2.1.4.24.7&lt;/code&gt; and if you walk it, you'll see a table of entries.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The format of entries is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;IP-MIB::ip.24.7.1.7.1.4.0.0.0.0.0.2.0.0.1.4.10.0.0.254 = INTEGER: 13&#xA;                        |     | |           |        |&#xA;                Prefix (0.0.0.0)| Next Hop (10.0.0.254)&#xA;                 CIDR Mask (/0)-+&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you're specifically after static routes, I would recommend ditching SNMP, and instead use the Junos REST API (available from Junos 15.1 onwards), or NETCONF calls via PyEZ.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-01-10T00:08:34.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37924" PostTypeId="2" ParentId="16720" CreationDate="2017-01-10T11:08:52.960" Score="2" Body="&lt;p&gt;Quoting 'cpt_fink':&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You need something acting as the multicast querier, but not the&#xA;  multicast router. I do not know if this is possible on a TP-Link&#xA;  device. – cpt_fink Feb 18 '15 at 5:19&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A workaround is possible: Add whatever cheap network device (cheap router, old network card in linux PC, etc) and send IGMP v2 or v3 queries to switch. Switch will detect that a querier is available, and send all multicast traffic to the cheap device. The eth hw of device will filter and reject the multicasts packets.&#xA;In my network I captured IGMP v3 queries, and send the packets using tcpdump.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a IGMP querier is not found, probably the switch broadcasts the multicast packets to all ports.&#xA;Success&#xA;Zajo Bajo&lt;/p&gt;&#xA;" OwnerUserId="33418" LastEditorUserId="1172" LastEditDate="2017-01-11T05:01:24.367" LastActivityDate="2017-01-11T05:01:24.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37927" PostTypeId="2" ParentId="37913" CreationDate="2017-01-10T15:28:11.513" Score="2" Body="&lt;p&gt;You can bring up a BGP session (though you will likely have to override the default TTL limit), the problem is actually sending the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;next hop IP address&quot; is a local concept, used to look up the interface and MAC address (or equivilent for other interface types), sometimes used to look up a route in other routing protocols (for ibgp used with an igp) it never actually appears on the wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to have meaningful peering you really want a connection between you and your peer that lets you send IP packets to each other without any intermediate routers looking at their IP headers and making routing descisions. That connection could be a dedicated point to point link. It could be a peering lan provided by an exchange point. It could be a tunnel of some sort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that peering over tunnels has it's downsides, particularly if you ever get any downstreams it can easily cause loops. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-01-10T23:20:15.857" LastActivityDate="2017-01-10T23:20:15.857" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37928" PostTypeId="1" AcceptedAnswerId="37929" CreationDate="2017-01-10T16:48:59.047" Score="1" ViewCount="125" Body="&lt;p&gt;I´m trying to test this etherchannel configuration but did´t work properly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to entablish a L2 communication channel between A and B, but i neet to put on the middle 2 equipments and try to load balance the traffic accross then. To do that i figure out the use of an etherchannel configuration like i described on the image, but did not work properly, i generate a lot of traffic and neither get to its destination&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be appreciated&lt;a href=&quot;https://i.stack.imgur.com/mpUC4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mpUC4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2017-01-10T17:04:55.240" Title="Etherchannel configuration!" Tags="|switch|switching|etherchannel|load-balancing|bridging|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37929" PostTypeId="2" ParentId="37928" CreationDate="2017-01-10T16:57:11.127" Score="1" Body="&lt;p&gt;If I understand you correctly, you have four bridges in a loop, but you want to load balance. The problem is that STP will block one direction in order to prevent layer-2 looping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An etherchannel must start on one device, and terminate on another device. You cannot channel from one device through two other devices to a fourth device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can channel from A to each of the two middle bridges, but it will be two separate links, one to each of the middle bridges. The same goes for B to the middle bridges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LACP is a link protocol that cannot be sent through a bridge. It is only between the two devices on each end of the physical link. LACP frames are sent with the special &lt;code&gt;01:80:c2:00:00:02&lt;/code&gt; multicast MAC address. The IEEE has reserved the &lt;code&gt;01:80:c2&lt;/code&gt; OUI for link protocols, and frames with this special multicast OUI are not allowed to be forwarded from the interface on which they are received to another interface on 802.1D compliant bridges.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-10T17:04:55.240" LastActivityDate="2017-01-10T17:04:55.240" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="37930" PostTypeId="1" AcceptedAnswerId="37931" CreationDate="2017-01-10T17:02:26.087" Score="1" ViewCount="1345" Body="&lt;p&gt;I have a task to upgrade Cisco switch with a &lt;strong&gt;cryptographic&lt;/strong&gt; image. However, I can't figure out with one I can choose from the list that I have available to me. Please advice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my current switch info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco Internetwork Operating System Software &#xA;IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(22)EA4a, RELEASE SOFTWARE (fc1)&#xA;!--- the version of software is 121-22.EA4&#xA;&#xA;Copyright (c) 1986-2005 by cisco Systems, Inc.&#xA;Compiled Fri 16-Sep-05 10:46 by yenanh&#xA;Image text-base: 0x80010000, data-base: 0x80562000&#xA;&#xA;ROM: Bootstrap program is C2950 boot loader&#xA;&#xA;SW-MNGT-C1 uptime is 1 year, 41 weeks, 6 days, 2 hours, 56 minutes&#xA;System returned to ROM by power-on&#xA;System restarted at 10:41:46 UTC Wed Feb 25 2015&#xA;System image file is &quot;flash:/c2950-i6q4l2-mz.121-22.EA4a.bin&quot;&#xA;Model number: WS-C2950G-24-EI&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is the list of cisco images that I have to choose from:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 3041280 2008-05-17 11:04 c2950-c3h2s-mz.120-5.2.WC.1.tar&#xA; 3041280 2008-08-27 14:43 c2950-c3h2s-mz.120-5.3.WC.1.tar&#xA; 3041280 2008-08-27 14:43 c2950-c3h2s-mz.120-5.4.WC.1.tar&#xA; 1681612 2008-08-22 05:09 c2950-c3h2s-mz.120-5.wc2b.bin&#xA; 3041280 2008-08-22 05:09 c2950-c3h2s-mz.120-5.WC2b.tar&#xA; 3041280 2008-08-22 05:09 c2950-c3h2s-mz.120-5.WC2.tar&#xA; 1356288 2008-05-17 07:47 c2950-html-plus.120-5.2.WC.1.tar&#xA; 1356288 2008-05-17 07:47 c2950-html-plus.120-5.3.WC.1.tar&#xA; 1356288 2008-05-17 08:06 c2950-html-plus.120-5.4.WC.1.tar&#xA; 1356288 2008-05-17 08:06 c2950-html-plus.120-5.WC2.tar&#xA; 3681121 2008-08-22 03:00 c2950-i6k2l2q4-mz.121-22.ea3(1).bin&#xA; 3681121 2008-08-22 06:52 c2950-i6k2l2q4-mz.121-22.ea3.bin&#xA; 3692710 2008-05-17 08:03 c2950_i6k2l2q4_mz.121_22.ea5a.bin&#xA; 3699303 2008-08-22 06:52 c2950-i6k2l2q4-mz.121-22.ea6.bin&#xA; 3704943 2008-08-22 02:54 c2950-i6k2l2q4-mz 121-22 ea7.bin&#xA; 3706442 2008-05-17 07:48 c2950-i6k2l2q4-mz.121-22.ea8a.bin&#xA; 5409280 2008-08-22 14:32 c2950-i6k2l2q4-tar.121-13.EA1b.tar&#xA; 5693440 2008-05-17 07:50 c2950-i6k2l2q4-tar.121-22.EA9.tar&#xA; 2774747 2008-05-17 07:50 c2950-i6q4l2-mz.121-12c.ea1.bin&#xA; 2980487 2008-08-21 20:57 c2950-i6q4l2-mz.121-19.ea1a.bin&#xA; 2974409 2008-05-17 07:50 c2950-i6q4l2-mz.121-19.ea1.bin&#xA; 2980731 2008-08-21 22:28 c2950-i6q4l2-mz.121-19.ea1c.bin&#xA; 3081999 2008-08-21 22:28 c2950-i6q4l2-mz.121-22.ea1.bin&#xA; 3097872 2008-05-17 07:51 c2950-i6q4l2-mz.121-22.ea4.bin&#xA; 3103337 2008-08-21 19:22 c2950-i6q4l2-mz.121-22.ea5a.bin&#xA; 3103308 2008-05-17 07:51 c2950-i6q4l2-mz.121-22.ea5.bin&#xA; 3110758 2008-08-27 14:39 c2950-i6q4l2-mz.121-22.ea6.bin&#xA; 3117090 2008-08-27 14:39 c2950-i6q4l2-mz.121-22.ea7.bin&#xA; 3117954 2008-05-17 07:54 c2950-i6q4l2-mz.121-22.ea8a.bin&#xA; 3117390 2008-08-27 14:39 c2950-i6q4l2-mz.121-22.ea8.bin&#xA; 2251822 2008-08-27 14:49 c2950-i6q4l2-mz.121-6.EA2b.bin&#xA; 3974656 2008-08-27 14:49 c2950-i6q4l2-mz.121-6.EA2b.tar&#xA; 2253443 2008-08-27 14:41 c2950-i6q4l2-mz.121-6.EA2c.bin&#xA; 3978240 2008-08-22 02:46 c2950-i6q4l2-mz.121-6.EA2c.tar&#xA; 3974656 2008-08-27 14:49 c2950-i6q4l2-mz.121-6.EA2.tar&#xA; 2490607 2008-05-17 07:57 c2950-i6q4l2-mz.121-9.EA1.bin&#xA; 2487439 2008-05-17 07:58 c2950-i6q4l2-mz.121-9.EA1d.bin&#xA; 4500992 2008-05-17 09:53 c2950-i6q4l2-tar.121-12c.EA1.tar&#xA; 4464576 2008-05-17 09:53 c2950-i6q4l2-tar.121-12c.EA1.zip&#xA; 4877312 2008-05-17 08:00 c2950-i6q4l2-tar.121-13.EA1c.tar&#xA; 4823040 2008-05-17 08:00 c2950-i6q4l2-tar.121-22.EA4.tar&#xA; 5109760 2008-08-27 15:07 c2950-i6q4l2-tar.121-22.EA9.tar&#xA; 4013232 2008-08-22 16:22 c2950-i6q4l2-tar.121-9.EA1.zip&#xA; 4213760 2008-08-22 16:22 c2950lre-i6l2q4-tar.121-11.YJ2.tar&#xA; 4214272 2008-05-17 08:03 c2950lre-i6l2q4-tar.121-11.YJ3.tar&#xA; 4235776 2008-05-17 08:03 c2950lre-i6l2q4-tar.121-11.YJ4.tar&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I assume that my current version of iOS is 121-22.EA4&#xA;A also assume that the crypto image has a &quot;k&quot; letter in the file name. Am I right? From there I get confused. Which file should I use to upgrade my current iOS to the newer and crypto one? (The reason behind why we need a crypto version is because need to control it remotely)&#xA;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="33424" LastEditorUserId="8499" LastEditDate="2018-12-25T03:25:02.943" LastActivityDate="2018-12-25T03:25:02.943" Title="Which system image should I choose to upgrade my Cisco switch? It has to be a cryptographic image" Tags="|cisco|switch|cisco-ios|cisco-catalyst|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="37931" PostTypeId="2" ParentId="37930" CreationDate="2017-01-10T17:33:10.333" Score="1" Body="&lt;p&gt;We cannot tell you which image to use. That is up to you to decide, based on the features, bugs, etc. in each image, and you need to go to &lt;a href=&quot;https://www.cisco.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com&lt;/a&gt; to get the information on each image. The latest image is not always the correct one because as features are added, new bugs are often introduced. If what you have now works for your needs, then you could simply use that one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your switch has what you need to remotely manage the device in a secure manner. As is, it supports TACACS+ or RADIUS authentication. It also supports SSH for connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/en/US/products/hw/switches/ps628/products_data_sheet09186a00801cfb71.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Catalyst 2950 Series Switches with Standard Image SW&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;NETWORK SECURITY&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Cisco Catalyst 2950 Series switches offer enhanced data security&#xA;  through a wide range of security features. These features allow&#xA;  customers to provide network security based on users or MAC addresses.&#xA;  The security enhancements are available free by downloading the latest&#xA;  software for the Cisco Catalyst 2950 Series switches.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Secure Shell version 2 (SSHv2) protects information from being&#xA;  eavesdropped or being tampered with by encrypting information being&#xA;  passed on the network, thereby guarding administrative information.&#xA;  Private VLAN Edge isolates ports on a switch, ensuring that traffic&#xA;  travels directly from the entry point to the aggregation device&#xA;  through a virtual path and cannot be directed to another port. In&#xA;  addition, for authentication of users with a TACACS+ or a RADIUS&#xA;  server, 802.1x provides port-level security. Simple Network Management&#xA;  Protocol Version 3 (SNMPv3) (non-cryptographic) monitors and controls&#xA;  network devices as well as manages configurations, performance,&#xA;  collection of statistics, and security.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For authentication of users with a Terminal Access Controller Access&#xA;  Control System (TACACS+) or RADIUS server, 802.1x provides port-level&#xA;  security. 802.1x, in conjunction with a RADIUS server, allows for&#xA;  dynamic port-based user authentication. 802.1x-based user&#xA;  authentication can be extended to dynamically assign a VLAN based on a&#xA;  specific user, regardless of where they connect on the network. With&#xA;  802.1x with Guest VLAN, guests are allowed access to the Internet via the Guest VLAN but cannot access the customer's internal network. This&#xA;  intelligent adaptability allows IT departments to offer greater&#xA;  flexibility and mobility to their stratified user populations. By&#xA;  combining access control and user profiles with secure network&#xA;  connectivity, services, and applications, enterprises can more&#xA;  effectively manage user mobility and drastically reduce the overhead&#xA;  associated with granting and managing access to network resources.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;With the Cisco Catalyst 2950SX-48, 2950T-48, 2950SX-24, 2950-24, and&#xA;  2950-12 switches, network managers can make ports and consoles highly&#xA;  secure. MAC-address-based port-level security prevents unauthorized&#xA;  stations from accessing the switch. Multilevel access security on the&#xA;  switch console and the Web management interface prevents unauthorized&#xA;  users from accessing or altering switch configurations and can be&#xA;  implemented using an internal user database on each switch or a&#xA;  centrally administered TACACS+ or RADIUS server. Using 802.1x in&#xA;  conjunction with a RADIUS server allows dynamic port-based user&#xA;  authentication. In addition, 802.1x can coexist with port security on&#xA;  a per-port basis. Security features can be deployed using Cisco&#xA;  Network Assistant software security wizards, which ease the deployment&#xA;  of security features that restrict user access to a server or portion&#xA;  of the network or restrict the applications used in certain areas of&#xA;  the network.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cisco has guides on how to harden your network devices. For example, the &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/access-lists/13608-21.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Guide to Harden Cisco IOS Devices&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-10T17:33:10.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37932" PostTypeId="1" AcceptedAnswerId="37934" CreationDate="2017-01-10T17:52:24.883" Score="1" ViewCount="1045" Body="&lt;p&gt;While reading up on front-door vrf concept &lt;a href=&quot;http://www.networkingwithfish.com/tunnels-and-the-use-of-front-door-vrfs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, i am just wondering , what if we made the network statements more precise/specific or used different subnets altogether, we would never have our tunnel go down due to &lt;code&gt;recursive routing&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you please confirm if this is a good approch to understanding &lt;code&gt;front-door vrf&lt;/code&gt; concept?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2017-01-10T17:58:19.920" LastActivityDate="2017-01-11T18:08:51.237" Title="Regarding front door vrf concept" Tags="|tunnel|gre|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37934" PostTypeId="2" ParentId="37932" CreationDate="2017-01-10T19:01:13.827" Score="3" Body="&lt;p&gt;You have to at least create static host routes pointing to the endpoint IPs of your tunnel to make sure they remain established.  Front door vrf is handy if your endpoint is using a dynamic IP address, forcing you to have a default route pointing out the internet circuit.  Splitting it into different vrfs allows you create a second default route pointing down a tunnel.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;When you create a tunnel, you will have a source IP and destination IP for the tunnel.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zfjw9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zfjw9.jpg&quot; alt=&quot;Show crypto isa sa&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to avoid pointing your default route to your ISP (maybe you want to point down a tunnel instead), you will need at a minimum to create a host route for the tunnel destination IP address pointing to the ISP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 150.0.0.2 255.255.255.255 1.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This way you can reach the other end of the tunnel.  Then you can point the default route down a tunnel and it won't break your tunnel.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 Tunnel0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if you have spoke routers that have dynamic IP addresses which aren't known, you can't create a host route for them.  In this case you can create a front door vrf in order to use two default routes without breaking your tunnels.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You place your external interface into the new vrf.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface Gig0&#xA;ip vrf forwarding FRONT-DOOR&#xA;ip address x.x.x.x y.y.y.y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you can create a default route in that vrf used for establishing the tunnels.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route vrf FRONT-DOOR 0.0.0.0 0.0.0.0 z.z.z.z&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You have to tell the tunnel interface to use the new vrf for establishing the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface Tunnel0&#xA;tunnel vrf FRONT-DOOR&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now you can create a default route in the global routing table without interfering with the tunnel establishment.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 a.a.a.a&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="31609" LastEditorUserId="31609" LastEditDate="2017-01-11T18:08:51.237" LastActivityDate="2017-01-11T18:08:51.237" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37948" PostTypeId="1" CreationDate="2017-01-11T11:08:16.523" Score="2" ViewCount="61" Body="&lt;p&gt;We have a situation where users are unable to access servers on network &lt;code&gt;192.168.140.0/24&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I examine our bgp network routes, I notice the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network_router#show ip bgp | inc 192.168.140&#xA;Network          Next Hop            Metric LocPrf Weight Path&#xA;*&amp;gt; 192.168.140.0    0.0.0.0                  0         32768 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What does the next hop &lt;code&gt;0.0.0.0&lt;/code&gt; mean? Also why the metric is set to 0?&lt;/p&gt;&#xA;" OwnerUserId="21461" LastEditorUserId="2142" LastEditDate="2017-01-11T12:36:42.230" LastActivityDate="2017-01-14T13:34:39.207" Title="Cisco bgp disables network routing for local network" Tags="|cisco|routing|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37949" PostTypeId="1" AcceptedAnswerId="37955" CreationDate="2017-01-11T11:32:55.970" Score="5" ViewCount="2466" Body="&lt;p&gt;For connect some customer we want to advertise only one network out and different networks in they provide us. For this I read about route-map and advertising-map feature in Cisco Docu. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example this one for feature advertis-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 2 &#xA; bgp log-neighbor-changes &#xA; network 128.16.16.0 mask 255.255.255.0 &#xA; neighbor 10.10.10.1 remote-as 1 &#xA; neighbor 10.10.10.1 advertise-map ADVERTISE    &#xA;! &#xA;access-list 60 permit 128.16.16.0 0.0.0.255 &#xA;!  &#xA;route-map ADVERTISE permit 10 &#xA; match ip address 60 &#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this one for the route-map feature:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 2 &#xA; bgp log-neighbor-changes &#xA; network 128.16.16.0 mask 255.255.255.0 &#xA; neighbor 10.10.10.1 remote-as 1 &#xA; neighbor 10.10.10.1 route-map RED out   &#xA;! &#xA;ip prefix-list 1 permit 128.16.16.0/24 &#xA;!&#xA;route-map RED permit 10 &#xA; match ip address prefix-list 1 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have found this booth Solutions to limit the number of networks that announced to customer. The goal is to Create a routing to a BGP Member and advertise only one subnet to the customer, the customer himself advertise one network in our direction? Is it possible with one of this solution and what is the diffrence between this solutions? &lt;/p&gt;&#xA;" OwnerUserId="20772" LastEditorUserId="20772" LastEditDate="2017-01-11T14:24:27.070" LastActivityDate="2017-01-11T14:24:27.070" Title="Best practice for advertising routes in BGP" Tags="|cisco|routing|bgp|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37950" PostTypeId="1" CreationDate="2017-01-11T12:09:01.693" Score="5" ViewCount="7003" Body="&lt;p&gt;For example, at work, a network is made up of 10 workstations all connected to a switch through a patch panel. From my inexperienced opinion, it is extra cost that can be avoided; however, as I do more research it appears to be common sense to use a patch panel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the need for patch panels?&lt;/p&gt;&#xA;" OwnerUserId="33456" LastEditorUserId="8499" LastEditDate="2019-01-02T23:06:29.063" LastActivityDate="2023-07-17T09:11:53.730" Title="Why are patch panels used (instead of connecting directly to a switch)?" Tags="|layer1|cable|cabling|utp|patch-panel|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37951" PostTypeId="1" AcceptedAnswerId="37952" CreationDate="2017-01-11T12:09:41.760" Score="1" ViewCount="1524" Body="&lt;p&gt;Can You help me !! &#xA;I want to force users to authentificate to get IP from DHCP-server (win server) if not they can't get ip @ adress !! even they are connected to network &lt;/p&gt;&#xA;" OwnerUserId="33455" LastActivityDate="2017-01-11T15:11:42.973" Title="How to force users to authenticate to get IP adress from DHCP?" Tags="|dhcp|network-access|pfsense|authentication|network|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37952" PostTypeId="2" ParentId="37951" CreationDate="2017-01-11T12:23:35.513" Score="3" Body="&lt;p&gt;There's a standard to achieve this: 802.1X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically the switch request authentication from the computer, then contact an authentication server to validate the credentials and depending on the answer the switch will deny or allow access. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's further possible options, like placing the host in a guest vlan if not authenticated or placing the host in a specific VLAN depending of some of the user properties.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously your switch must support 802.1X and you need an authentication server (usually a radius server).   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a windows environment, the Network Policy Server role can act as the authentication server. It is natively integrated with Active Directory.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-01-11T12:30:05.573" LastActivityDate="2017-01-11T12:30:05.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37954" PostTypeId="2" ParentId="37950" CreationDate="2017-01-11T12:32:07.723" Score="4" Body="&lt;p&gt;What if you don't use a patch panel, then decide you have to move your switch further down the rack or you need to move the connection to equipment in a different location in the rack? Now your cable is not long enough to reach the new location.  You are screwed because now you have to run an entire new cable through the walls.  With a patch panel you would just grab a longer patch cable and be done with it.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2017-01-11T12:32:07.723" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37955" PostTypeId="2" ParentId="37949" CreationDate="2017-01-11T12:35:06.720" Score="7" Body="&lt;p&gt;You are conflating two different issues:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Route-maps can act as a policy filter, selecting which prefixes are advertised to neighbors and which are accepted from neighbors.  Advertise-maps allow you to &lt;em&gt;conditionally&lt;/em&gt; advertise prefixes based on the presence of other prefixes.  They don't control prefixes received from neighbors. Generally, route-maps are simpler to use, unless you really need the conditional feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access-lists and prefix-lists can do the same thing, but prefix-lists are easier to read and allow more precise control over route policies.  In the context of BGP, prefix lists make more intuitive sense, since BGP advertises prefix reachability.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-01-11T12:41:57.797" LastActivityDate="2017-01-11T12:41:57.797" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37956" PostTypeId="2" ParentId="37948" CreationDate="2017-01-11T12:39:59.153" Score="4" Body="&lt;p&gt;The next hop 0.0.0.0 means that the route is originated from this router - &lt;em&gt;i.e.&lt;/em&gt;, this is the router that is sourcing this route.  The metric (or multi exit discriminator) is set to 0 by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That information probably doesn't help you troubleshoot your problem.  If you include a diagram of your network, we will be better able to help you.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-11T12:39:59.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37957" PostTypeId="1" AcceptedAnswerId="37962" CreationDate="2017-01-11T12:57:06.980" Score="1" ViewCount="648" Body="&lt;p&gt;we have an HPE 1920 PoE switch connected to a Cisco 1841 router, vers 12.4. The HP switch has two VLANs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Data - VLAN 1 - 192.168.50.0/24&lt;/li&gt;&#xA;&lt;li&gt;Voice - VLAN 55 - 192.168.55.0/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The port on the switch that uplinks to the router has VLAN 1 untagged and VLAN 55 tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router has two subinterfaces configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1.1&#xA; encapsulation dot1Q 1 native&#xA; ip address 192.168.50.254 255.255.255.0&#xA; no snmp trap link-status&#xA; no cdp enable&#xA;!&#xA;interface FastEthernet0/1.55&#xA; encapsulation dot1Q 55&#xA; ip address 192.168.55.1 255.255.255.0&#xA; no snmp trap link-status&#xA; no cdp enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;show vlans on the router shows No Virtual LANs configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is connectivity on the default VLAN okay but not for the second VLAN, I'm not even able to ping the .55 subinterface from the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to get this working please?&lt;/p&gt;&#xA;" OwnerUserId="33459" LastEditorUserId="33459" LastEditDate="2017-01-11T13:26:46.747" LastActivityDate="2017-02-10T17:44:11.997" Title="HP VLANS and Cisco subinterfaces" Tags="|cisco|hp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37958" PostTypeId="2" ParentId="37950" CreationDate="2017-01-11T13:00:17.793" Score="6" Body="&lt;p&gt;There's several reasons:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Cable Length and rack organization&lt;/strong&gt;&lt;br /&gt;&#xA;as explained by @John K in his answer this allow to adjust cable length at need. This also allow to organize the rack properly.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Cable weariness&lt;/strong&gt;&lt;br /&gt;&#xA;With time the cable, and especially the connector, may get screwed up and can cause various network issues very hard to diagnose.&lt;/p&gt;&#xA;&lt;p&gt;If you must redo the connector, you need to get someone experimented with the proper tool, and then have the cable certified again.&lt;br /&gt;&#xA;This will cost and will also shorten the cable.&lt;/p&gt;&#xA;&lt;p&gt;A patch panel with, fixed cable properly attached, is much more resilient, easier to diagnose, and you only need to change the inexpensive patch cable.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Multiple usage&lt;/strong&gt;&lt;br /&gt;&#xA;Structured cabling is not used only for Ethernet connection. You can use it to connect for example a phone / DSL line, a fax or other device using a RJ11 or RJ12 connector, or a console cable (very useful to get the console of a network device in your comfortable office rather than in a noisy and cold IT room).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2023-07-17T09:11:53.730" LastActivityDate="2023-07-17T09:11:53.730" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="37959" PostTypeId="2" ParentId="37957" CreationDate="2017-01-11T13:30:24.223" Score="1" Body="&lt;p&gt;Check your switch configuration. You have to define the trk port for that VLAN to go outside.&#xA;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;trunk 49-50 trk1&#xA;&#xA;vlan [vlan_id] &#xA;name &quot;valn name&quot;&#xA;untagged [port number that you want to untagged]&#xA;tagged Trk1&#xA;no ip address&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22728" LastEditorUserId="8499" LastEditDate="2017-01-11T15:21:32.750" LastActivityDate="2017-01-11T15:21:32.750" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37961" PostTypeId="2" ParentId="37950" CreationDate="2017-01-11T15:20:38.503" Score="8" Body="&lt;p&gt;The horizontal cable needs to be solid-core cable. this type of cable gives better performance, but it is much more fragile, and it needs to to terminate in a fixed location, and not be moved after installation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Patch cords use stranded cable, which have poorer performance, but they are much less fragile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;ANSI/TIA/EIA Commercial Building Telecommunications Cabling Standard&lt;/em&gt; specifies the horizontal cable up to 90 meters, and stranded patch cords not totaling more than 10 meters on each end. This gives you up to 100 meters of copper wire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The combination of good performing  horizontal cable, and poor performing stranded patch cords should pass the test suite for the cable category you installed. You could find your cable plant does not work correctly if you use stranded cable for the horizontal cable, as someone on Server Fault did.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-11T15:20:38.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37962" PostTypeId="2" ParentId="37957" CreationDate="2017-01-11T17:24:15.973" Score="0" Body="&lt;p&gt;Thanks everyone but I found out what the issue was, the uplink port on the switch was enabled for Voice VLAN, as soon as I disabled this, it worked as expected.&lt;/p&gt;&#xA;" OwnerUserId="33459" LastActivityDate="2017-01-11T17:24:15.973" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="37963" PostTypeId="1" AcceptedAnswerId="37964" CreationDate="2017-01-11T17:32:30.713" Score="1" ViewCount="13382" Body="&lt;p&gt;&lt;strong&gt;What command do you use to view the ARP Timeout &lt;em&gt;setting&lt;/em&gt; on a Cisco Router?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not the remaining time or ageing time on a particular ARP entry. But the actual timeout setting itself. I know it is by default 4 hours, I just need to know what show command &lt;em&gt;shows&lt;/em&gt; this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some searches online pointed me towards &lt;code&gt;show arp timeout&lt;/code&gt; or &lt;code&gt;show ip arp timeout&lt;/code&gt; but neither of these worked on the GNS3 Routers I tried it against. It may only be available on real Routers, in which case I would love to have that confirmed. (And for someone to post the output of the command from a real router).&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2017-01-11T17:41:00.640" Title="How to view the ARP Timeout setting on Cisco Router?" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37964" PostTypeId="2" ParentId="37963" CreationDate="2017-01-11T17:41:00.640" Score="2" Body="&lt;p&gt;Sigh, rookie mistake. The command &lt;code&gt;arp timeout&lt;/code&gt; is available in interface configuration mode only, and is set specific to each interface. You can view the setting in &lt;code&gt;show interface&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router1#  conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;router1(config)# arp timeout 99999&#xA;                     ^&#xA;% Invalid input detected at '^' marker.&#xA;&#xA;router1(config)# int eth0/1&#xA;router1(config-if)# arp timeout 99999&#xA;router1(config-if)# end&#xA;*Jan 11 17:37:56.285: %SYS-5-CONFIG_I: Configured from console by console&#xA;router1# show int eth0/1 | i Timeout&#xA;  ARP type: ARPA, ARP Timeout 1d03h&#xA;router1# show int eth0/1&#xA;Ethernet0/1 is administratively down, line protocol is down&#xA;  Hardware is AmdP2, address is aabb.cc00.0110 (bia aabb.cc00.0110)&#xA;  MTU 1500 bytes, BW 10000 Kbit/sec, DLY 1000 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  ARP type: ARPA, ARP Timeout 1d03h&#xA;  Last input never, output never, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2017-01-11T17:41:00.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37966" PostTypeId="1" AcceptedAnswerId="37967" CreationDate="2017-01-11T18:53:56.283" Score="1" ViewCount="508" Body="&lt;p&gt;Do standard NICs that support IPv6 have the ability to perform MLD?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially I understand MLD, but am struggling to find if it needs to be configured or if it is enabled by default on a host. Just want to understand how a host sends a Multicast Listener Report. Does it happen automatically when a Multicast Listener query is sent by the router/switch? &lt;/p&gt;&#xA;" OwnerUserId="21360" LastEditorUserId="8499" LastEditDate="2018-03-19T21:21:03.003" LastActivityDate="2018-03-19T21:21:03.003" Title="Enabling Multicast Listener Discovery (MLD)" Tags="|ipv6|multicast|icmpv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37967" PostTypeId="2" ParentId="37966" CreationDate="2017-01-11T19:00:19.430" Score="2" Body="&lt;p&gt;First, NICs have no idea if they are used for IPv4, IPv6, IPX, or any other layer-3 protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet, and other IEEE LAN protocols, support multicast, which is heavily used in IPv6. MLD is something similar to IGMP, and the NICs are ignorant of these upper-layer protocols. NICs only understand the layer-1 communications for which they are manufactured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any IEEE 802.3 compliant ethernet NIC will work with IPv6 and MLD (or IPv4 and IGMP, for that matter), and the NIC will be none the wiser.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-11T19:00:19.430" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37968" PostTypeId="2" ParentId="37950" CreationDate="2017-01-11T19:34:29.337" Score="-2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Modularity is the degree to which a system's components may be&#xA;  separated and recombined.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;-&lt;a href=&quot;https://en.wikipedia.org/wiki/Modularity&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-11T19:34:29.337" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37970" PostTypeId="1" AcceptedAnswerId="37982" CreationDate="2017-01-11T20:00:19.837" Score="1" ViewCount="527" Body="&lt;p&gt;I am trying to configure a RPM probe to ping a web service using an IP address, using junos version 12.1x &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;probe My-Probe {&#xA;    test My-Test &#xA;        probe-type http-get&#xA;        target url http://10.10.10.11:8080/services/id/1 &#xA;        probe-interval 30&#xA;        test-interval 60 &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The web service is up and running, I can hit the target url successfully with any other client.  For example, in the shell on the same router i can use &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fetch http://10.10.10.11:8080/services/id/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And see the 200/OK response.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is, when the RPM probe tries to hit the target url, it doesn't work.  The server responds with a 400/Bad Request error, &quot;Invalid Hostname&quot;.  Investigating with wireshark, I can see a malformed get request:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GET /services/id/1 HTTP/1.1\r\n&#xA;\r\n&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's it - it's missing a &quot;Host&quot; header, just as the web service host machine indicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I have to do to send a correctly formatted get request? &#xA;What i would expect to see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;GET /services/id/1 HTTP/1.1\r\n&#xA;Host: 10.10.10.11:8080\r\n&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="33471" LastActivityDate="2017-01-12T09:16:24.617" Title="Juniper rpm configuration - http probe bad request" Tags="|juniper|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37972" PostTypeId="2" ParentId="34868" CreationDate="2017-01-11T23:04:03.490" Score="2" Body="&lt;p&gt;As mentioned before, your bottleneck is the WAN switch.  You'll need to upgrade that device to a higher speed port, or alternatively depending on your security requirements, you could patch your modem into your core switch on an isolated VLAN.  Then plug the WAN port from your firewall into another port on the core switch on the same isolated VLAN.  &lt;/p&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-01-11T23:04:03.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37974" PostTypeId="1" CreationDate="2017-01-12T01:33:05.070" Score="4" ViewCount="1503" Body="&lt;p&gt;I have a Cisco IOS router that is used for WAN access. I have 2 additional users defined with less privilege to check status and to use ssh. I wonder if it is possible to restrict certain user to only login via console port and not via VTY (ssh in my case)? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using aaa new-model but I don't want to use additional tacacs server.&lt;/p&gt;&#xA;" OwnerUserId="22375" LastActivityDate="2018-03-10T05:49:23.080" Title="Can I limit Cisco IOS login to specific users?" Tags="|cisco-ios|ssh|aaa|authorization|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37975" PostTypeId="1" AcceptedAnswerId="37976" CreationDate="2017-01-12T02:17:13.110" Score="2" ViewCount="49" Body="&lt;p&gt;Suppose I have a server running different services, say Email exchange, storage space, web server, and SQL database. Assuming this server is bounded with one IP address and one NIC card, how can I distinguish which traffic that belongs to each service since all services share the server IP address and MAC address? Looking at the packet header alone won't help in this case, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="32299" LastActivityDate="2021-01-08T05:03:11.280" Title="How to distinguish a traffic that belongs to specific service" Tags="|cisco|routing|tcp|switching|osi|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37976" PostTypeId="2" ParentId="37975" CreationDate="2017-01-12T02:28:40.213" Score="1" Body="&lt;p&gt;In general each of the applications you list actually use different network protocols - so the web server is likely on TCP/80 and TCP/443 while the database is probably on TCP/1433.  If you're tagging packets on a switch or router it's fairly typical to base classification on this layer-4 info.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also possible for the server to actually tag its own packets as they're created.  This can be accomplished on a bulk basis (more or less equivalent to the classification above - L4-based) or by the app itself if the developer has made appropriate accommodations.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-12T02:28:40.213" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="37978" PostTypeId="1" AcceptedAnswerId="37981" CreationDate="2017-01-12T05:11:46.067" Score="2" ViewCount="690" Body="&lt;p&gt;For the neighbor relationship, the update source IP from router R1 must match the neighbor command on router R2, and vice versa&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To test the above,I set up my lab with R1 and R2 to test the above.(refer the pic shown below)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sho ip int bri&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;FastEthernet0/0            1.1.1.1         YES manual up                    up&#xA;FastEthernet0/1            unassigned      YES unset  administratively down down&#xA;Loopback0                  11.11.11.11     YES manual up                    up&#xA;R1#&#xA;R1#&#xA;R1#sho run | sec router bgp&#xA;router bgp 1&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; neighbor 22.22.22.22 remote-as 2&#xA; neighbor 22.22.22.22 ebgp-multihop 2&#xA; no auto-summary&#xA;R1#&#xA;&#xA;&#xA;R1#sho ip route 22.22.22.22&#xA;Routing entry for 22.0.0.0/8&#xA;  Known via &quot;static&quot;, distance 1, metric 0&#xA;  Routing Descriptor Blocks:&#xA;  * 1.1.1.2&#xA;      Route metric is 0, traffic share count is 1&#xA;&#xA;R1#sho ip bgp summary | b Neighbor&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;22.22.22.22     4     2      13      12        0    0    0 00:26:10 Active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For R2, i have&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sho ip int bri&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;FastEthernet0/0            unassigned      YES unset  administratively down down&#xA;FastEthernet0/1            1.1.1.2         YES manual up                    up&#xA;Loopback0                  22.22.22.22     YES manual up                    up&#xA;&#xA;R2#sho run | sec router bgp&#xA;router bgp 2&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; neighbor 11.11.11.11 remote-as 1&#xA; neighbor 11.11.11.11 ebgp-multihop 2&#xA; no auto-summary&#xA;R2#&#xA;&#xA;&#xA;&#xA;R2#sho ip route 11.11.11.11&#xA;Routing entry for 11.0.0.0/8&#xA;  Known via &quot;static&quot;, distance 1, metric 0&#xA;  Routing Descriptor Blocks:&#xA;  * 1.1.1.1&#xA;      Route metric is 0, traffic share count is 1&#xA;&#xA;R2#sho ip bgp summary | b Neighbor&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;11.11.11.11     4     1       6       7        0    0    0 00:17:27 Active&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Q1:As you see, my BGP neighborship is stuck in active state.From what i understand, R1 expects the neighborship packets from R2 with a source-ip of &lt;code&gt;22.22.22.22&lt;/code&gt;&#xA;If you do &lt;code&gt;sho ip route&lt;/code&gt; on R2 for 11.11.11.11, you see that it is learnt via &lt;code&gt;1.1.1.1&lt;/code&gt; as &lt;code&gt;static route&lt;/code&gt;. Therefore, the bgp neighborship packets sourced from R2 will use this egress source ip(&lt;code&gt;1.1.1.2&lt;/code&gt;)&#xA; Please confirm if my understanding is correct&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:I add the following on R2.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config)#router bgp 2&#xA;R2(config-router)#ne&#xA;R2(config-router)#nei&#xA;R2(config-router)#neighbor 11.11.11.11 up&#xA;R2(config-router)#neighbor 11.11.11.11 update-source lo&#xA;R2(config-router)#neighbor 11.11.11.11 update-source loopback 0&#xA;R2(config-router)#end&#xA;R2#&#xA;*Mar  1 00:56:26.211: %SYS-5-CONFIG_I: Configured from console by console&#xA;R2#sho ip bgp summary | b Neighbor&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;11.11.11.11     4     1       6       7        0    0    0 00:35:17 Active&#xA;R2#&#xA;*Mar  1 00:56:37.107: %BGP-5-ADJCHANGE: neighbor 11.11.11.11 Up&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The bgp neighborship now comes up.&#xA;My question is- why does the neighborship not come up as seen in the first case?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/QXOZB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QXOZB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3:Now i advertise a different loopback from R2 towards R1 as follows&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2(config-router)#do sho run int lo2&#xA;Building configuration...&#xA;&#xA;Current configuration : 61 bytes&#xA;!&#xA;interface Loopback2&#xA; ip address 222.222.222.222 255.255.0.0&#xA;end&#xA;&#xA;R2(config)#router bgp 2&#xA;R2(config-router)#network 222.222.0.0 mask 255.255.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then on R1, i see the prefix received&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sho ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;C    1.0.0.0/8 is directly connected, FastEthernet0/0&#xA;S    22.0.0.0/8 [1/0] via 1.1.1.2&#xA;C    11.0.0.0/8 is directly connected, Loopback0&#xA;B    222.222.0.0/16 [20/0] via 22.22.22.22, 00:04:53&#xA;R1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Q: R1 is learning &lt;code&gt;222.222.0.0&lt;/code&gt; with a next hop of &lt;code&gt;22.22.22.22&lt;/code&gt;.&#xA;Why is &lt;code&gt;22.22.22.22&lt;/code&gt; the next-hop ? &lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2017-01-12T05:17:12.020" LastActivityDate="2017-01-12T07:38:02.927" Title="Regarding bgp neighborship basics" Tags="|bgp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37979" PostTypeId="1" CreationDate="2017-01-12T05:42:38.293" Score="2" ViewCount="2080" Body="&lt;p&gt;Is there have any difference between this two terms, 'Clock Synchronization' and 'Time Synchronization' in a network?&#xA;I understand that when clock frequency has corrected to run in same pace is called 'Syntonization'. And Synchronization + Syntonization = Network Synchronization. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I noticed that 'Clock Synchronization' and 'Time Synchronization' has been synchronously used. But I was wonder, if there have any technical differences?&lt;/p&gt;&#xA;" OwnerUserId="30640" LastActivityDate="2017-01-12T06:05:07.560" Title="What is the difference between 'clock synchronization' and 'time synchronization'?" Tags="|ieee-802.1ax|ad-hoc-wireless|network|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="37980" PostTypeId="2" ParentId="37979" CreationDate="2017-01-12T06:05:07.560" Score="3" Body="&lt;p&gt;At least in the context of network devices clock synchronization tends to refer to synchronous circuits where a constant time signal has to be maintained so that two devices can know the precise rate at which data is being transmitted and received.  If the respective clocks of two devices are skewed then the integrity of the circuit will suffer.  As such it's fairly typical for one device to derive its clock from a neighbor which, in turn, either works from an internal oscillator or an external source.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Time synchronization is generally referring to maintaining accurate time/data values on a number of devices.  An example of this would be through the use of the Network Time Protocol (NTP) which allows for synchronization of time/date to global standards with at least a fair degree of precision.  Keeping accurate time is incredibly important for logging/forensic purposes but also crucial for certain cryptographic and security processes (among other things).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - you can think of clock synchronization as being akin to making sure the second hand on two clocks are ticking at the same rate while time synchronization is making sure that the absolute second, minute and hour hands of the two clocks keep reading the same.  As such it's possible for two devices to have clock synchronization but be set to different times and, within some definition, two unsynchronized devices to have very closely synced time/dates (or calendars as they're sometimes known).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside - it's possible to get high-resolution timing devices that can both act as an accurate source of time/date information as well as providing high-resolution reference clocking but these functions can also potentially be had independently.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-12T06:05:07.560" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37981" PostTypeId="2" ParentId="37978" CreationDate="2017-01-12T06:18:44.863" Score="3" Body="&lt;p&gt;OK - so there are a few things going on here and I'll try to address them in some approximate order.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;There are two sub-variants of BGP - internal (iBGP) and external (eBGP).  In the case of iBGP the ASN's of the two peers are identical.  In the case of eBGP the two ASN's are different.  In your example you're using eBGP.  I mention this because a number of rules are different between eBGP and iBGP.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Most &lt;em&gt;typically&lt;/em&gt; eBGP sessions occur between directly connected interfaces.  In your example this would mean that R1 and R2 would peer to one another as 1.1.1.1 and 1.1.1.2 respectively (i.e. R1 has a neighbor statement to 1.1.1.2, R2 has its statement to 1.1.1.1).  This works because each router can reach the other via a directly connected route.  If you deleted the update-source and static route and simply peered the routers on their directly connected interfaces the peer would come up without any further configuration.  Also - as an aside, if you have a point-to-point link use a /30 or /31 prefix rather than a /8.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;It's &lt;em&gt;possible&lt;/em&gt; to configure what's called &lt;em&gt;multihop&lt;/em&gt; eBGP.  This means peering two router interfaces that aren't directly connected.  This requires that another route needs to be in place for the interfaces to be able to pass packets.  When you changed the source of the sessions to loopbacks you needed the static routes in place to allow the session to come up.  Typically the peering session will require an additional statement specifying the maximum number of IP hops for the session but since in this instance they're only a single hop apart it may not have been necessary (..although it used to be).  This is also known as a recursive route - so a route received with a next-hop of the remote router's loopback will actually use the static route as a way of resolving the interface that a given packet will take (in this case 1.1.1.x).  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;By default for eBGP routes will be advertised with a next-hop of the peering address (unless specifically altered via a knob or route-map).  This is one of the differences with iBGP where the next-hop address will be normally unchanged across peers unless configured to behave otherwise.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-12T06:18:44.863" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37982" PostTypeId="2" ParentId="37970" CreationDate="2017-01-12T06:19:54.340" Score="2" Body="&lt;p&gt;Unfortunately, JunOS does not support those feature at this time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;port number and sub url does not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the RPM target url only supported FQHN such as&lt;br&gt;&#xA;&lt;code&gt;target url http://10.10.10.11/&lt;/code&gt; &lt;br&gt;&#xA;&lt;code&gt;target url http://SERVERA/&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should feature request to juniper.&lt;/p&gt;&#xA;" OwnerUserId="32460" LastEditorUserId="32460" LastEditDate="2017-01-12T09:16:24.617" LastActivityDate="2017-01-12T09:16:24.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37984" PostTypeId="1" CreationDate="2017-01-12T07:02:54.973" Score="3" ViewCount="617" Body="&lt;p&gt;I thought a bandwidth is a number represent maximum amount of traffic. But it seems not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me show the Network map in my company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/narNc.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/narNc.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this image. WAN has a 155Mbps bandwidth and there are a lot of PC and mobile devices. &lt;em&gt;I tested network benchmark from 6 PCs &lt;strong&gt;at the same time&lt;/strong&gt;.&lt;/em&gt; &#xA;The result of min download speed is &lt;strong&gt;91.2 Mbps&lt;/strong&gt; and min upload speed is &lt;strong&gt;88.7 Mbps&lt;/strong&gt;. For this reason I wonder how this is possible or it works even though WAN has 155 Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Addition&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used Mbps as mega bit not byte.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems I gave you confuse what I want to know. I'm not good at English so It was my best But let me try more to explain specific.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;I did't mean why the speed less than 155 Mbps even though the bandwidth of WAN is 155 Mbps.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is how 6 hosts can speed almost 100 Mbps at the same time. WAN is the Internet bandwidth which is ISP(Internet Service Provider) gave our company and that moment may be more than 100 hosts use the Internet when I tested. So How can 100 hosts have speed over than 90 Mbps at the same time even ISP gave us the 155 Mbps for the Internet?&lt;/p&gt;&#xA;" OwnerUserId="33480" LastEditorUserId="33480" LastEditDate="2017-01-13T09:49:01.117" LastActivityDate="2018-05-15T13:12:26.113" Title="How the Internet speed on PCs can be almost 100Mbps although the bandwidth of WAN is 155Mbps?" Tags="|switch|internet|bandwidth|topology|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="37985" PostTypeId="1" AcceptedAnswerId="38000" CreationDate="2017-01-12T07:18:35.107" Score="1" ViewCount="270" Body="&lt;p&gt;We have 20 MBPS Internet lease line, suddnly my bandwidth utilization reached peak that causes slowness of internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not able to trace whether the problem is and what should I do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please assist me.&lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2017-03-13T14:47:07.220" Title="Abnormally Bandwidth utilization goes high what should I do" Tags="|internet|bandwidth|fortigate|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37986" PostTypeId="2" ParentId="37978" CreationDate="2017-01-12T07:31:54.990" Score="2" Body="&lt;p&gt;when you want to create neighbourship in BGP with loopbacks interface. you should change update-source to loopback IP address. what for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;because when you create neighborship with loopback interface and you did not change source IP address. both routers try to establish a TCP session with source IP of egress port. then router2 receive a message that the source IP is 1.1.1.1 and the destination IP is 22.22.22.22. but it wants to be a neighbor with 11.11.11.11 while it receives messages from 1.1.1.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3: in BGP you should perform recursive lookup for find a route to the destination. &#xA;for example in &#xA;&lt;strong&gt;B    222.222.0.0/16 [20/0] via 22.22.22.22, 00:04:53&lt;/strong&gt;&#xA;first, you find 22.22.22.22 then you should see routing table for 22.22.22.22. that is:&#xA;&lt;strong&gt;S    22.0.0.0/8 [1/0] via 1.1.1.2&lt;/strong&gt;&#xA;so, your packets go from 1.1.1.2 to the destination.&#xA;Good luck&lt;/p&gt;&#xA;" OwnerUserId="33460" LastEditorUserId="33460" LastEditDate="2017-01-12T07:38:02.927" LastActivityDate="2017-01-12T07:38:02.927" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37988" PostTypeId="1" AcceptedAnswerId="38006" CreationDate="2017-01-12T08:58:00.540" Score="1" ViewCount="7242" Body="&lt;p&gt;I have access-lists in place. When i use the &lt;code&gt;show ip access-list&lt;/code&gt; command, some of access-lists show counters (hit counts), and some don't. If I change the rule from permit to deny, interesting traffic is denied and counters will appear, but when I change to permit again the counters won't increase, although there is the traffic which is allowed with same sequence number. &lt;/p&gt;&#xA;" OwnerUserId="27132" LastEditorUserId="8499" LastEditDate="2017-01-12T15:38:51.410" LastActivityDate="2017-01-12T16:24:31.220" Title="Access-list won't show all hit matches" Tags="|cisco|cisco-catalyst|acl|logging|access-control|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37990" PostTypeId="1" AcceptedAnswerId="37992" CreationDate="2017-01-12T09:52:24.940" Score="2" ViewCount="88" Body="&lt;p&gt;I am investingating the option of connecting our business network to 2 separate ISPs for redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since we have a couple of B2B services which need to be accessible from outside, in order to have automatic failover not only from inside out, but also from outside in, as I understand, we should implement BGP and have our own (optimally provider independent [PI]) Autonomous System (ASN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that IPv4 ASNs are depleted and -- especially global ones -- are comparatively expensive and hard to obtain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A couple of ISPs are offering IPv4 ASNs, however, they are giving provider aggregated ones, which would mean we would be stuck with the provider as long as we use them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;is there any other way to provide reasonable failover connection to&#xA;my network beside ASN+BGP? &lt;/li&gt;&#xA;&lt;li&gt;alternatively, is it feasible and recommended to get IPv6 PI ASN --&#xA;as I understand those should be available easier and cheaper, but I&#xA;haven't been able to find the info yet. Would a pure IPv6 network be&#xA;reacable from the rest of the Internet nowadays anyway?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33485" LastActivityDate="2017-01-12T10:20:00.730" Title="Multhoming including incoming connections?" Tags="|bgp|ipv6|failover|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="37991" PostTypeId="1" CreationDate="2017-01-12T10:16:16.263" Score="1" ViewCount="3732" Body="&lt;p&gt;I have a requirement to regularly produce spreadsheet showing Cisco router interface information, in particular bandwidths of each interface and IP addresses. I have access to a network management tool which I can pull reports from so the information is there, I just need to understand it and present it logically &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So one of the requirements is to show LAN and WAN side IP addresses in the spreadsheet under their own column.  I understand the difference between these in a home network context – LAN side is the local IP that other devices see and the WAN side is the address that the internet sees. However in this context, I cannot seem to separate which is which..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I have to work with (IPs and interface descriptions have been removed) for example for each interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Device name,    Interface Name  Interface Description   IP Address  Speed   Type&#xA;Hostname1   FastEthernet0/0/0 (Fa0/0/0) Example LAN     2 MBit/s (F)    ethernetCsmacd&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I look at the IP addresses and work out whether the IP relates to the LAN or WAN side? &lt;/p&gt;&#xA;" OwnerUserId="33487" LastActivityDate="2017-10-11T00:57:27.033" Title="Identifying WAN or LAN side IP addresses on cisco routers" Tags="|cisco|ip|lan|wan|ip-address|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37992" PostTypeId="2" ParentId="37990" CreationDate="2017-01-12T10:20:00.730" Score="5" Body="&lt;p&gt;You're mixing up terminology a bit here. There's no such thing as an IPv4 ASN or IPv6 ASN. There's IP space, which is either IPv4 or IPv6, and there are ASN's. An ASN can announce IPv4 prefixes, IPv6 prefixes, or both. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you concluded, PI space (at least in the RIPE region, which roughly covers EMEA, but I think the same goes for other RIRs) is depleted. This leaves you two choices to obtain your own IP addresses:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;become a LIR (Local Internet Registry), you get a /22 of IPv4 space&lt;/li&gt;&#xA;&lt;li&gt;buy IP space. There's a number of IP brokers where you can buy any number of IP addresses&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Both these options do cost money. Option 1 has an additional yearly fee, option 2 mostly depends on the number of IP's you're buying.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is there any other way to provide reasonable failover connection to my network beside ASN+BGP? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This depends a bit on what exactly you're trying to achieve. For some services, changing DNS labels when one of the connections may work if the TTL is low enough. Or you can offload the your using for example CloudFlare or Akamai, and switch to another backend IP address. Both these options require manual intervention or maybe some smart scripting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to have one set of IP addresses available through different networks, you're mostly stuck with BGP.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;alternatively, is it feasible and recommended to get IPv6 PI ASN (...) Would a pure IPv6 network be reacable from the rest of the Internet nowadays anyway?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I said, there's no such thing. You can get an ASN and IPv6 space, but a large part of the internet still only has IPv4 connectivity, so having your services only available on IPv6 will probably not work as well as you'd like it to. You could possibly consider to have a service like CloudFlare or Akamai (or another CDN) to do the IPv4 hosting and connect to your services via IPv6, but I'm not aware if they do support this, and this probably only works for HTTP(S) services.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-01-12T10:20:00.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37994" PostTypeId="2" ParentId="37991" CreationDate="2017-01-12T11:08:50.363" Score="0" Body="&lt;p&gt;Usually the WAN IP address will be a publicly routable IP address while the LAN will be a private IP address.&lt;/p&gt;&#xA;&lt;p&gt;Note that it is not always the case.&lt;/p&gt;&#xA;&lt;p&gt;Private IP address are defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt; and are:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; 10.0.0.0        -   10.255.255.255  (10/8 prefix)&#xA; 172.16.0.0      -   172.31.255.255  (172.16/12 prefix)&#xA; 192.168.0.0     -   192.168.255.255 (192.168/16 prefix)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If you get one IP in one of those blocks and another one which is not then you are good, otherwise we can't tell you.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-01-12T11:08:50.363" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37995" PostTypeId="1" AcceptedAnswerId="37996" CreationDate="2017-01-12T11:39:51.423" Score="12" ViewCount="20462" Body="&lt;p&gt;There are two types of pinouts for terminating twisted pair cable with a 8P8C (RJ45) connector:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VJKLT.jpg&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VJKLT.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But why must one not simply align the wires serially, e.g:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Green pair - Orange pair - Blue pair - Brown pair&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do the current standards offer a nontrivial solution?&lt;/p&gt;&#xA;" OwnerUserId="32950" LastActivityDate="2023-08-27T03:17:15.767" Title="What is the reason for T568A and T568B termination?" Tags="|utp|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="37996" PostTypeId="2" ParentId="37995" CreationDate="2017-01-12T11:57:45.820" Score="17" Body="&lt;p&gt;UTP cables used in the 586 standard inherited their color code from the &lt;strong&gt;25 pair color code&lt;/strong&gt; developed by &lt;em&gt;AT&amp;amp;T&lt;/em&gt; for cabling used in telecommunication purposes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following table shows the combination of colors to be used for each pair&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eYz5l.jpg&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eYz5l.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This gives us this set of combinations:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ph3Th.png&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ph3Th.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UTP cabling simply used the first four combinations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The order used in &lt;em&gt;586a&lt;/em&gt; and &lt;em&gt;586b&lt;/em&gt; is compatible with 1-pair and 2-pair Universal Service Order Codes &lt;a href=&quot;http://www.connectworld.net/usoc.html&quot;&gt;(USOC) pinouts&lt;/a&gt; that are a &lt;strong&gt;requirement&lt;/strong&gt; in federal contracts by the U.S. government.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Pair 1&lt;/strong&gt; connects to the &lt;em&gt;center pins&lt;/em&gt; (4 and 5) of the connector. It gives compatibility with the first line of RJ11, RJ14, RJ25, and RJ61 connectors that all have the first pair in the center pins of these connectors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The position of the other wires is because &lt;em&gt;signal shielding&lt;/em&gt; would be optimized by alternating the &quot;live&quot; and &quot;earthy&quot; pins of each pair. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However it isn't possible because the &lt;em&gt;outermost pair&lt;/em&gt; would be too far to meet the &lt;em&gt;electrical echo requirements&lt;/em&gt; of high-speed LAN protocols.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's why only one pair is &quot;untwisted&quot; and used as a &lt;strong&gt;shielding&lt;/strong&gt; for the central pair.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2017-01-12T12:02:46.557" LastActivityDate="2017-01-12T12:02:46.557" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="37998" PostTypeId="1" CreationDate="2017-01-12T13:01:20.857" Score="1" ViewCount="203" Body="&lt;p&gt;I have seen this static route in one of the interfaces of the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route vrf vrf_45065 1.1.1.1 255.255.255.255 172.22.145.153 2&#xA;ip route vrf vrf_45065 10.158.138.192 255.255.255.192 172.22.145.153 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why use  &lt;code&gt;1.1.1.1 255.255.255.255 172.22.145.153 2&lt;/code&gt;  at all ?&lt;/p&gt;&#xA;" OwnerUserId="33494" LastEditorUserId="2142" LastEditDate="2017-01-12T13:21:41.890" LastActivityDate="2021-01-08T05:59:26.763" Title="Understanding static routes" Tags="|routing|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="37999" PostTypeId="2" ParentId="37998" CreationDate="2017-01-12T13:19:42.060" Score="4" Body="&lt;p&gt;The route&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route vrf vrf_45065 1.1.1.1 255.255.255.255 172.22.145.153 2   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is often called a host route.  It means that traffic to the address 1.1.1.1 (only) will be forwarded to 172.22.145.153.  The administrative distance for this route is set to 2.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-12T13:19:42.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38000" PostTypeId="2" ParentId="37985" CreationDate="2017-01-12T13:30:35.243" Score="2" Body="&lt;p&gt;You should capture all network traffic from your internet connection to understand what traffic is causing it.  Until you know what causes it, you cannot take effective action to stop it happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are various ways of performing the capture but they depend on your specific network hardware and toplogy.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-01-12T13:30:35.243" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38001" PostTypeId="2" ParentId="37984" CreationDate="2017-01-12T15:32:19.860" Score="0" Body="&lt;p&gt;You really don't provide enough information to accurately answer the question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN circuits can use physical circuits that are different speeds than the LAN connections used by hosts. It is possible that the hosts connect to workgroup switches at only 100 Mbps, despite the 1 Gbps connection between the firewall and router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the diagram shows a hub, and those connections are half-duplex. The hosts connected to a hub compete for sole use of the hub for each frame, and collisions will slow the effective throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With 1412 PCs, you certainly have a large bandwidth oversubscription with many hosts competing for the limited upstream bandwidth resource. If you divide 1000 Mbps (1 Gbps) by 1000 hosts, each would average 1 Mbps. You don't give us how many hosts are competing for the upstream bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-12T15:32:19.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38002" PostTypeId="1" AcceptedAnswerId="38003" CreationDate="2017-01-12T15:33:53.103" Score="1" ViewCount="571" Body="&lt;p&gt;I'm reading a scientific paper about NTP DDoS attacks (&lt;a href=&quot;http://mdbailey.ece.illinois.edu/publications/imc14-ddos.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;) and they wrote &quot;routed block&quot; multiple times. I can't figure out what they're talking about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone explain me ?&lt;/p&gt;&#xA;" OwnerUserId="33498" LastActivityDate="2017-01-12T17:48:34.933" Title="What is a routed block?" Tags="|ip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38003" PostTypeId="2" ParentId="38002" CreationDate="2017-01-12T15:41:29.473" Score="1" Body="&lt;p&gt;In the context of this paper, you can substitute the words &quot;advertised prefix.&quot;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-12T15:41:29.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38004" PostTypeId="1" CreationDate="2017-01-12T15:45:27.510" Score="4" ViewCount="1079" Body="&lt;p&gt;Looking at a fiber ring network of 11 switches on the same subnet, with 3 types of devices per module (device 1, 2 &amp;amp; 3).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;control room switch         192.168.11.100&#xA;module 1 ethernet switch    192.168.11.101&#xA;module 2 ethernet switch    192.168.11.102&#xA;module 3 ethernet switch    192.168.11.103&#xA;module 4 ethernet switch    192.168.11.104&#xA;module 5 ethernet switch    192.168.11.105&#xA;module 6 ethernet switch    192.168.11.106&#xA;module 7 ethernet switch    192.168.11.107&#xA;module 8 ethernet switch    192.168.11.108&#xA;module 9 ethernet switch    192.168.11.109&#xA;module 10 ethernet switch   192.168.11.110&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Isolating broadcasting messages/ communication between device type using VLANs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN 1 - device 1&#xA;VLAN 2 - device 2&#xA;VLAN 3 - device 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Devices are not required to communicate across the VLAN (eg Device 1 does not need to talk to Device 2), but the controller needs to be able to access all of 3, which is why one subnet is preferred as opposed to 1 to 1 VLAN/Subnet relationship.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done a lot of searching on the internet and there is a lot of debate on whether it is possible to have multiple VLANs on a single subnet. Or if it is better practice to have one subnet per VLAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone clarify...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is it possible to have multiple VLANs under one subnet?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;On the assumption it is not possible..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other considerations:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;VLANs and multiple subnets (not preferable)&lt;/li&gt;&#xA;&lt;li&gt;Access lists - Port Access Control table with Moxa switches - assigning port to MAC address?&lt;/li&gt;&#xA;&lt;li&gt;Using multicast filtering: IGMP snooping -register hosts with multicast groups, IP querier L2 switch with lowest IP address, forwards packets to registered ports only. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is it possible to use IGMP snooping on one LAN without the use of separate VLANs?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Correct me if I'm wrong but if the control room switch is the IGMP querier, it will send queries to all module switch ports, and reports will be sent back by the ports wanting to register to the multicast group. When data belonging to a multicast group is received by the control room switch, it will send information to all the ports that have registered in that multicast group. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this also work the other way round - sending data from the module ethernet switch to the control room switch? For example data from device 1 on module 10, only needs to be received by the control room switch. Can IGMP snooping be used here to send packets to the control room switch port designated to that multicast group? How will the packet be forwarded if the module 10 switch is the source but not the querier?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can IGMP snooping be used to trasmit packets to registered ports from any switch or just from the querier switch?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="33496" LastEditorUserId="33496" LastEditDate="2017-01-13T12:41:59.773" LastActivityDate="2017-01-13T16:12:50.233" Title="Multiple VLANs under one subnet (for traffic control)" Tags="|vlan|subnet|multicast|igmp|" AnswerCount="1" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="38006" PostTypeId="2" ParentId="37988" CreationDate="2017-01-12T16:24:31.220" Score="3" Body="&lt;p&gt;If the platform is Cisco Catalyst as reflected in the tags for the question, that may be the case. Some platforms reflect only punted (soft-switched) packets in the &quot;show ip access-list [...]&quot; output, while others reflect none. For example, for Catalyst 6500 and Sup720 You'd need to use &lt;code&gt;show tcam int x/y acl in|out protocol&lt;/code&gt;, while for other Catalyst platforms You'd usually be able to see aggregated statistics for ASIC or whole box via &lt;code&gt;show access-list hardware counters&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2017-01-12T16:24:31.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38007" PostTypeId="1" AcceptedAnswerId="38021" CreationDate="2017-01-12T17:09:05.783" Score="2" ViewCount="1112" Body="&lt;p&gt;How can I configure to secure my switch from brute force attacks via ssh? Can I configure something like Fail2ban?&lt;/p&gt;&#xA;" OwnerUserId="29533" LastActivityDate="2017-01-13T06:05:27.750" Title="How to configure Juniper EX switch for anti-bruteforcing?" Tags="|juniper|juniper-ex|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38008" PostTypeId="2" ParentId="37995" CreationDate="2017-01-12T17:11:57.393" Score="8" Body="&lt;p&gt;It is actually a very trivial and straighforward reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The standard starts with a single pair, two pins in the middle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This expands to a 4 pin plug for two pairs.&lt;br&gt;&#xA;What happens if you plan the pairs &quot;straightforward&quot; as you suggest? You break backwards compatibility with systems using only a centre pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you need to wrap the second pair around the first pair, even though this is &lt;strong&gt;not good&lt;/strong&gt; for your signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, the standard also allows for 4 pairs, but not 3 pairs. So you jump from the 2 pair to the 4 pair, so you obviously choose the set-up where you can wire in the pairs as fully twisted as you can.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The wrapping has, in fact, nothing to do with shielding, as the set-up does not help with any of that. At all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing to do with signal integrity and signal balance in some of the systems that use RJ-based plugs is the demand for colour-white-colour-white-colour-white...etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This actually does shield pairs from coupling into each other positively &lt;em&gt;on the board&lt;/em&gt;. But this would have been achieved just as easily in your set-up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only reason it not being like that is legacy. That's all.&lt;/p&gt;&#xA;" OwnerUserId="33501" LastActivityDate="2017-01-12T17:11:57.393" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38009" PostTypeId="2" ParentId="38002" CreationDate="2017-01-12T17:48:34.933" Score="1" Body="&lt;p&gt;This presumably refers to the CIDR &amp;quot;hierarchical blocks of IP addresses&amp;quot; from &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4632&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4632&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;...prefixes may be defined to describe any power of two-sized block of&#xA;between one and 2^32 end system addresses.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="32832" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-01-12T17:48:34.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38010" PostTypeId="2" ParentId="37995" CreationDate="2017-01-12T17:50:46.240" Score="4" Body="&lt;p&gt;The current Ethernet 8P8C connector that carries 4 data pairs traces it's heritage to phone jacks carrying a varying number of phone lines. The first line starts in the middle, which allows using smaller plug in a larger socket. You think it shouldn't work? In modern offices, wired for Ethernet it's commonplace to re-purpose an 8P8C line for a phone or a fax and plug RJ11 directly into it. Whenever the RJ11 is wired for 1 (center) or 2 (center and one layer next) it works pretty well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the actual question is : why all 4 pairs are not wired center-out as a 4 phone lines would make most sense? If you look at RJ25, it carries 3 lines  expectably, in a concentric fashion. Why Rj45 is strange?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The answer is that the original RJ45 was not in fact designed to carry 4 lines as the pincount suggests. It was designed to carry only 1 line for a modem and a little trick: a programming resistor. Value of this resistor would tell the connected modem roughly how long the line is so the modem would set the transmit power accordingly. But now, if they wired this resistor in place where a pair would be normally wired, then something bad could happen if a regular, phone multi-line plug got accidentally plugged there. So they picked pins 7&amp;amp;8, which &lt;strong&gt;do not constitute a pair&lt;/strong&gt; under regular phone-wiring rules. So now even if you would plug a 6-pin RJ25, it would connect the central pair to the only pair, and one pin of the outmost pair to one pin of the resistor. Phew, at least no wrong circuit is completed this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And now Ethernet comes to the stage where most of the seats are already taken. So what do Ethernet designers do? They take the only pairs that remain guaranteed unused. The original, 10MB, Ethernet needs only 2 pairs. So it uses the &lt;strong&gt;second&lt;/strong&gt; center line, the one not used for modem, and the &lt;strong&gt;other&lt;/strong&gt; outer line, pins 1&amp;amp;2, not taken by programming resistor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long, long time later, the RJ45 phone wiring can be pronounced dead without a doubt. So the remaining &quot;phone&quot; pairs are finally free for the Ethernet to take, as Gigabit Ethernet dully takes advantage of.&lt;/p&gt;&#xA;" OwnerUserId="23152" LastActivityDate="2017-01-12T17:50:46.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38011" PostTypeId="2" ParentId="38007" CreationDate="2017-01-12T18:44:27.027" Score="0" Body="&lt;p&gt;I don't have a Juniper EX to test this on and it is for an SRX, but JunOS is built to be standardized across platforms, so these steps may work on the EX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB28968&amp;amp;actp=search&quot; rel=&quot;nofollow noreferrer&quot;&gt;How to block Telnet and SSH Brute Force log-in attacks&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2017-01-12T18:44:27.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38012" PostTypeId="2" ParentId="26424" CreationDate="2017-01-12T19:32:45.977" Score="5" Body="&lt;h2&gt;What is the difference between the &lt;code&gt;WILL&lt;/code&gt; and &lt;code&gt;DO&lt;/code&gt; request?&lt;/h2&gt;&#xA;&lt;p&gt;There is a very important concept involved here, that you need to understand when implementing a Telnet server or client, otherwise your implementation might misbehave in rather odd ways:&lt;/p&gt;&#xA;&lt;p&gt;Every numbered option that can be negotiated actually has &lt;strong&gt;two independent&lt;/strong&gt; sets of states associated with it - one set of states is associated with the communication from &lt;em&gt;you&lt;/em&gt; (the application you are implementing, be it a client or server) to the &lt;em&gt;peer&lt;/em&gt; (the communication partner that sits at the other end of the line, be it a server or client) and the other set of states is associated with the opposite direction of communication from the &lt;em&gt;peer&lt;/em&gt; to &lt;em&gt;you&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;You &lt;strong&gt;must&lt;/strong&gt; keep and handle both sets of states independently if you want to prevent negotiation loops and undesired behavior for the user.&lt;/p&gt;&#xA;&lt;p&gt;There may be some interoperation between the both sets of states involved, depending on what the option does (you should read the particular RFC for each option you intent to support), but you best implement that on a higher level of abstraction. The basic option negotiation in both directions needs to be independent.&lt;/p&gt;&#xA;&lt;p&gt;Let's take option 0 &lt;code&gt;TRANSMIT-BINARY&lt;/code&gt; as an example. One set of states is about whether &lt;em&gt;you&lt;/em&gt; will send bytes using all 8 bits (binary) to the &lt;em&gt;peer&lt;/em&gt; and the other is about whether the &lt;em&gt;peer&lt;/em&gt; will send binary to &lt;em&gt;you&lt;/em&gt;. All 4 combinations are possible (&lt;em&gt;you&lt;/em&gt; 7-bit &amp;amp; &lt;em&gt;peer&lt;/em&gt; 7-bit, &lt;em&gt;you&lt;/em&gt; binary &amp;amp; &lt;em&gt;peer&lt;/em&gt; 7-bit, &lt;em&gt;you&lt;/em&gt; 7-bit &amp;amp; &lt;em&gt;peer&lt;/em&gt; binary, &lt;em&gt;you&lt;/em&gt; binary &amp;amp; &lt;em&gt;peer&lt;/em&gt; binary) and changing the option for one direction doesn't (directly) change the same option for the other direction.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;If &lt;strong&gt;you&lt;/strong&gt; send an &lt;code&gt;IAC&lt;/code&gt; &lt;code&gt;WILL&lt;/code&gt; &lt;code&gt;TRANSMIT-BINARY&lt;/code&gt;, you are talking about the direction from &lt;em&gt;you&lt;/em&gt; to the &lt;em&gt;peer&lt;/em&gt; and you are effectively asking the &lt;em&gt;peer&lt;/em&gt; to allow you send binary. The &lt;em&gt;peer&lt;/em&gt; can answer either &lt;code&gt;DO&lt;/code&gt; or &lt;code&gt;DONT&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If &lt;strong&gt;you&lt;/strong&gt; send an &lt;code&gt;IAC&lt;/code&gt; &lt;code&gt;DO&lt;/code&gt; &lt;code&gt;TRANSMIT-BINARY&lt;/code&gt;, you are instead talking about the direction from the &lt;em&gt;peer&lt;/em&gt; to &lt;em&gt;you&lt;/em&gt; and you are effectively asking the &lt;em&gt;peer&lt;/em&gt; to start transmitting binary if it is able to and willing. The &lt;em&gt;peer&lt;/em&gt; can answer either &lt;code&gt;WILL&lt;/code&gt; or &lt;code&gt;WONT&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;However, if the &lt;strong&gt;peer&lt;/strong&gt; sends an &lt;code&gt;IAC&lt;/code&gt; &lt;code&gt;WILL&lt;/code&gt; &lt;code&gt;TRANSMIT-BINARY&lt;/code&gt; (as opposed to you sending it), it is talking about the direction from the &lt;em&gt;peer&lt;/em&gt; to &lt;em&gt;you&lt;/em&gt; and it is effectively asking &lt;em&gt;you&lt;/em&gt; to allow it send binary. &lt;em&gt;You&lt;/em&gt; can answer either &lt;code&gt;DO&lt;/code&gt; or &lt;code&gt;DONT&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Analogously, if the &lt;strong&gt;peer&lt;/strong&gt; sends an &lt;code&gt;IAC&lt;/code&gt; &lt;code&gt;DO&lt;/code&gt; &lt;code&gt;TRANSMIT-BINARY&lt;/code&gt;, it is talking about the direction from &lt;em&gt;you&lt;/em&gt; to the &lt;em&gt;peer&lt;/em&gt; and it is effectively asking &lt;em&gt;you&lt;/em&gt; to start transmitting binary if you are able to and willing. &lt;em&gt;You&lt;/em&gt; can answer either &lt;code&gt;WILL&lt;/code&gt; or &lt;code&gt;WONT&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Similar things can be said about requests initiated with &lt;code&gt;WONT&lt;/code&gt; and &lt;code&gt;DONT&lt;/code&gt;, with the important difference that the only allowed replies to those are &lt;code&gt;DONT&lt;/code&gt; and &lt;code&gt;WONT&lt;/code&gt; respectively. That means options can always and at any time be turned off (while turning them on is subject to mutual agreement).&lt;/p&gt;&#xA;&lt;p&gt;You may want to read &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1143&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1143&lt;/a&gt;, which is suggesting a way to implement the negotiation and the associated sets of states.&lt;/p&gt;&#xA;&lt;h2&gt;About the meaning of &lt;code&gt;NVT&lt;/code&gt;&lt;/h2&gt;&#xA;&lt;p&gt;What they are talking about there is that the &lt;code&gt;NVT&lt;/code&gt; is a specification of a basic set of fallback properties and behaviors. I.e. if all negotiable options are off (they are required to be off at the start of the connection and if some are turned on during the session, you can turn them all off again, if you so desire), what you have is the minimal set of defined behaviours, you are left with the functionality specified as &lt;code&gt;NVT&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Turning options on diverges from the specified basic &lt;code&gt;NVT&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;What this all means is that either end can just refuse turning on any options and then just behave in the same manner as is specified for a &lt;em&gt;Network Virtual Terminal&lt;/em&gt; in the relevant RFC's and it can be sufficiently sure that the other end supports that mode of operation in some way (as operating with any and all options turned off is mandated in the standard).&lt;/p&gt;&#xA;" OwnerUserId="33505" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2017-01-13T06:26:13.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38013" PostTypeId="2" ParentId="37974" CreationDate="2017-01-12T19:58:27.280" Score="1" Body="&lt;p&gt;For console physical access control, easiest would just be to use local user logins and then SSH would still reference TACACS:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username test privilege 15 secret test&#xA;!&#xA;aaa authentication login console-grp local&#xA;aaa authentication login default group tacacs+ local&#xA;!&#xA;line con 0&#xA;    login authentication console-grp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To block certain users from SSH getting into the device, that would be a change on the TACACS+ server to not allow that authentication.&lt;/p&gt;&#xA;" OwnerUserId="33300" LastActivityDate="2017-01-12T19:58:27.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38014" PostTypeId="1" CreationDate="2017-01-12T20:04:39.557" Score="0" ViewCount="924" Body="&lt;p&gt;I have 2 3Com 5500 switch in stack and one of them is fault, I want to replace them with a new switch, which configuration must be added to the new switch before it can be added to the switch stack? (It's like a Cisco, no configuration is required?)&lt;/p&gt;&#xA;" OwnerUserId="31495" LastActivityDate="2017-06-13T01:07:57.463" Title="3Com 5500G EI Switch Stack Configuration" Tags="|switch|stacking|3-com|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38021" PostTypeId="2" ParentId="38007" CreationDate="2017-01-13T06:05:27.750" Score="3" Body="&lt;p&gt;Ideally you want to use SSH Key-based authentication and move away from user-based as much as possible, but in areas where I need to use username and password logging, I tend to standardise on the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set system login retry-options backoff-threshold 2&#xA;set system login retry-options backoff-factor 10&#xA;set system login retry-options tries-before-disconnect 3&#xA;set system ssh root-login deny&#xA;set system ssh protocol-version v2&#xA;set system ssh max-sessions-per-connection 1&#xA;set system ssh client-alive-interval 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This gives you three guesses at the password, but after the 2nd wrong attempt, it will make you wait 10 seconds before having a third go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This also stops the &lt;code&gt;root&lt;/code&gt; account from being able to log in remotely (instead you can escalate to &lt;code&gt;root&lt;/code&gt; via &lt;code&gt;su&lt;/code&gt; in the shell later) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be very careful with &lt;code&gt;set system login retry-options lockout-period&lt;/code&gt; - it does not work per IP as fail2ban does, but instead works by username (which is pretty disappointing for a security feature).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means if someone bruteforces your legitimate username, they will lock your account out continuously and you will be unable to log into your own device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This raises a final point which is to make your network infrastructure username unique eg: not your email address prefix, and not generic accounts such as &lt;code&gt;admin&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-01-13T06:05:27.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38022" PostTypeId="1" CreationDate="2017-01-13T08:47:22.993" Score="1" ViewCount="1312" Body="&lt;p&gt;In our organization, there are more than 2000 Internet users. Someone is connecting a Wi-Fi device in our LAN port and accessing the Internet without my knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is possible to block the Wi-Fi router when it is connected to my LAN port? I want to configure this in my Cisco SG300 28-port switch.&lt;/p&gt;&#xA;" OwnerUserId="20971" LastEditorUserId="8499" LastEditDate="2017-01-15T17:38:07.060" LastActivityDate="2017-01-15T18:57:25.060" Title="How to block Wi-Fi router in switch?" Tags="|cisco|switch|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38023" PostTypeId="2" ParentId="38022" CreationDate="2017-01-13T10:37:50.810" Score="1" Body="&lt;p&gt;Trace MAC of that wi-fi router and do this for each VLAN on you switch.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch(conf)#mac address-table static [mac_address]  vlan [id] drop&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2017-01-13T10:37:50.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38026" PostTypeId="1" AcceptedAnswerId="38027" CreationDate="2017-01-13T13:48:00.567" Score="2" ViewCount="7446" Body="&lt;p&gt;I am trying to monitor behaviour of packets from my PC -&gt; VirtualBox machine which represents a virtual router, and I have established SSH session to it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how to filter out &lt;strong&gt;all&lt;/strong&gt; SSH traffic from displaying and monitor other protocols ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far, the filter that I am using:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip.addr == 10.0.0.31 &amp;amp;&amp;amp; tcp.port != 22 &amp;amp;&amp;amp; not ssh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;is showing me ACK packets, and somehow it isn't &quot;filtered&quot; completely.&lt;/p&gt;&#xA;" OwnerUserId="33441" LastActivityDate="2020-06-08T06:10:50.113" Title="How to fiter non SSH traffic in Wireshark" Tags="|wireshark|ssh|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38027" PostTypeId="2" ParentId="38026" CreationDate="2017-01-13T14:44:03.590" Score="4" Body="&lt;p&gt;The ACK packets are not recognised as SSH packets, so the &quot;not ssh&quot; part of your filter doesn't match on them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How about simply using&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip.addr == 10.0.0.31 &amp;amp;&amp;amp; tcp.port != 22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2017-01-13T14:44:03.590" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38030" PostTypeId="2" ParentId="38004" CreationDate="2017-01-13T16:12:50.233" Score="2" Body="&lt;p&gt;Switches have no concept of subnets.  The term is virtual LAN's, VLANs.  The management interface on each switch certainly can be on the same VLAN (and subnet).  The ring topology requires some flavor of STP to handle the loop prevention of frames.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-13T16:12:50.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38032" PostTypeId="2" ParentId="38014" CreationDate="2017-01-13T22:15:03.013" Score="1" Body="&lt;p&gt;It depends which one is the &quot;management device&quot;.  &lt;a href=&quot;http://h20628.www2.hp.com/km-ext/kmcsdirect/emr_na-c02581968-1.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Switch 5500 Family Configuration Guide&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Bhswr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Bhswr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xdZj3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xdZj3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-13T22:15:03.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38033" PostTypeId="2" ParentId="34082" CreationDate="2017-01-13T22:29:13.837" Score="1" Body="&lt;p&gt;I think you'd be better off assuming these are not plastic/polymer since yellow = single mode = long haul = glass.  See &lt;a href=&quot;https://en.wikipedia.org/wiki/Plastic_optical_fiber&quot; rel=&quot;nofollow noreferrer&quot;&gt;Plastic optical fiber&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the IEEE has not yet passed any of the proposals into a final extension of the existing ethernet standards.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-13T22:29:13.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38035" PostTypeId="2" ParentId="33175" CreationDate="2017-01-14T01:09:06.503" Score="1" Body="&lt;p&gt;Fair question, but it's way too wordy.  Basically, change the IP addresses so that they don't overlap.  That's the answer.  Just do it.  There is no sense in some bandaid NAT hack to allow it to continue.  And change your subnet masks to /24's.  Keep it simple.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-14T01:09:06.503" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38037" PostTypeId="2" ParentId="29621" CreationDate="2017-01-14T05:15:59.807" Score="0" Body="&lt;p&gt;First, validate that you can ping from one router to the other.  If you can't, the link between them is not up/up.  If you can, the link between them is up/up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you've got the link between the routers working, you need to apply IP addressing to the endpoints (not the switches).  Typically this is automated using DHCP which can be configured in the routers.  Endpoints get an IP address, subnet mask, and default gateway (and usually DNS servers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All you need in terms of routing on the default gateways is a static route on each one, telling it the LAN facing subnet which is accessible across the router-to-router link.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-14T05:15:59.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38042" PostTypeId="1" AcceptedAnswerId="38052" CreationDate="2017-01-14T08:02:14.630" Score="1" ViewCount="917" Body="&lt;p&gt;i have this setup which is a bit low end because i ran out of test server to test so i'm just doing what i can to attain target setup. Normally i would use a blade or rack type server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my setup normally in a rack type server would have a 4 Ethernet port but on a desktop type machine it only has 1 so what i did to have a sort of 4 Ethernet port is have it setup as VLAN, (eth1.100, eth2.100, etc) and connected it to a 2950 cisco switch. I configured the ports connected to the machine as trunk so all VLANS will pass through it. As to why i need these vlan is because i need 4 ports which is a limitation to a desktop type machine (buying is an NIC 4 port is not an option so i will stick to this setup).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, my problem is i cannot ping 1.1.1.1 in PC0 to 1.1.1.2 in PC1, even though i have already configured those ports to trunk. See picture below to have a more understandable setup. Also, i have read that when you configure a VLAN / sub-interface, physical port would be automatically on trunk mode&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jJLZK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jJLZK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am i doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way as an added info, i tested this to a normal switch (not managed, just a normal household switch and i got a successfull ping)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just so everyone will know, i cannot test my setup on a packet tracer since i cannot configure a VLAN (subinterface) on a PC machine in packet tracer, the picture above is only to have everyone a clear view on my setup. Logs, setup, configuration is not available since its isolated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UPDATES:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw1#show interfaces trunk &#xA;Port        Mode         Encapsulation  Status        Native vlan&#xA;Fa0/1       on           802.1q         trunking      1&#xA;Fa0/2       on           802.1q         trunking      1&#xA;&#xA;Port        Vlans allowed on trunk&#xA;Fa0/1       1-1005&#xA;Fa0/2       1-1005&#xA;&#xA;Port        Vlans allowed and active in management domain&#xA;Fa0/1       1,100&#xA;Fa0/2       1,100&#xA;&#xA;Port        Vlans in spanning tree forwarding state and not pruned&#xA;Fa0/1       1,100&#xA;Fa0/2       1,100&#xA;&#xA;sw1#&#xA;&#xA;sw1#show interfaces fa0/1&#xA;FastEthernet0/1 is up, line protocol is up (connected)&#xA;  Hardware is Lance, address is 0030.a311.5301 (bia 0030.a311.5301)&#xA; BW 100000 Kbit, DLY 1000 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 100Mb/s&#xA;  input flow-control is off, output flow-control is off&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:08, output 00:00:05, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue :0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     956 packets input, 193351 bytes, 0 no buffer&#xA;     Received 956 broadcasts, 0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     2357 packets output, 263570 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 10 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;sw1#show interfaces fa0/2&#xA;FastEthernet0/2 is up, line protocol is up (connected)&#xA;  Hardware is Lance, address is 0030.a311.5302 (bia 0030.a311.5302)&#xA; BW 100000 Kbit, DLY 1000 usec,&#xA;     reliability 255/255, txload 1/255, rxload 1/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 100Mb/s&#xA;  input flow-control is off, output flow-control is off&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:08, output 00:00:05, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue :0/40 (size/max)&#xA;  5 minute input rate 0 bits/sec, 0 packets/sec&#xA;  5 minute output rate 0 bits/sec, 0 packets/sec&#xA;     956 packets input, 193351 bytes, 0 no buffer&#xA;     Received 956 broadcasts, 0 runts, 0 giants, 0 throttles&#xA;     0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort&#xA;     0 watchdog, 0 multicast, 0 pause input&#xA;     0 input packets with dribble condition detected&#xA;     2357 packets output, 263570 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 10 interface resets&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;sw1#&#xA;&#xA;sw1#show interfaces switchport &#xA;Name: Fa0/1&#xA;Switchport: Enabled&#xA;Administrative Mode: trunk&#xA;Operational Mode: trunk&#xA;Administrative Trunking Encapsulation: dot1q&#xA;Operational Trunking Encapsulation: dot1q&#xA;Negotiation of Trunking: On&#xA;Access Mode VLAN: 1 (default)&#xA;Trunking Native Mode VLAN: 1 (default)&#xA;Voice VLAN: none&#xA;Administrative private-vlan host-association: none&#xA;Administrative private-vlan mapping: none&#xA;Administrative private-vlan trunk native VLAN: none&#xA;Administrative private-vlan trunk encapsulation: dot1q&#xA;Administrative private-vlan trunk normal VLANs: none&#xA;Administrative private-vlan trunk private VLANs: none&#xA;Operational private-vlan: none&#xA;Trunking VLANs Enabled: All&#xA;Pruning VLANs Enabled: 2-1001&#xA;Capture Mode Disabled&#xA;Capture VLANs Allowed: ALL&#xA;Protected: false&#xA;Appliance trust: none&#xA;&#xA;Name: Fa0/2&#xA;Switchport: Enabled&#xA;Administrative Mode: trunk&#xA;Operational Mode: trunk&#xA;Administrative Trunking Encapsulation: dot1q&#xA;Operational Trunking Encapsulation: dot1q&#xA;Negotiation of Trunking: On&#xA;Access Mode VLAN: 1 (default)&#xA;Trunking Native Mode VLAN: 1 (default)&#xA;Voice VLAN: none&#xA;Administrative private-vlan host-association: none&#xA;Administrative private-vlan mapping: none&#xA;Administrative private-vlan trunk native VLAN: none&#xA;Administrative private-vlan trunk encapsulation: dot1q&#xA;Administrative private-vlan trunk normal VLANs: none&#xA;Administrative private-vlan trunk private VLANs: none&#xA;Operational private-vlan: none&#xA;Trunking VLANs Enabled: All&#xA;Pruning VLANs Enabled: 2-1001&#xA;Capture Mode Disabled&#xA;Capture VLANs Allowed: ALL&#xA;Protected: false&#xA;Appliance trust: none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25515" LastEditorUserId="25515" LastEditDate="2017-01-14T13:41:58.527" LastActivityDate="2017-01-14T15:42:37.787" Title="VLAN trunk between Single Port Machine to Switch" Tags="|switch|vlan|interface|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38044" PostTypeId="1" AcceptedAnswerId="38053" CreationDate="2017-01-14T08:29:07.843" Score="1" ViewCount="14137" Body="&lt;p&gt;Could anyone help me with a simple explanation for the below ACL and what does have to do with DHCP server and IP address requests coming from hosts...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 112 permit udp any eq bootpc any eq bootps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;Ethem&lt;/p&gt;&#xA;" OwnerUserId="23982" LastEditorUserId="509" LastEditDate="2017-01-14T09:37:37.647" LastActivityDate="2017-02-13T19:01:20.487" Title="DHCP &amp; bootpc ACL" Tags="|acl|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38046" PostTypeId="1" AcceptedAnswerId="38054" CreationDate="2017-01-14T12:53:00.180" Score="1" ViewCount="872" Body="&lt;p&gt;Long time ago I heard from friend that on really short distance using optical links makes no much sense because comparing to passive connection optical interfaces introduce another layer of hardware converting electrical signal to light.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Considering 0.5m 10g passive DAC vs 0.5m 10g AOC - which one provides lower latency if any?&lt;/p&gt;&#xA;" OwnerUserId="8352" LastActivityDate="2017-01-14T17:24:47.153" Title="Latency of AOC vs passive DAC" Tags="|cabling|latency|sfp|optics|10gbase|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38047" PostTypeId="2" ParentId="37991" CreationDate="2017-01-14T13:14:00.163" Score="0" Body="&lt;p&gt;Actually if you are looking at a company network then the private versus private addresses does not work. You cannot tell by looking at an IP address is LAN or WAN just by the address. However generally WAN interfaces have a subnet mask of 255.255.255.252. &lt;/p&gt;&#xA;" OwnerUserId="33528" LastActivityDate="2017-01-14T13:14:00.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38048" PostTypeId="2" ParentId="37948" CreationDate="2017-01-14T13:34:39.207" Score="-3" Body="&lt;p&gt;Next hop 0.0.0.0/0 means that traffic to this subnet is using the default route. Anytime you see 0.0.0.0/0 it is a default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Default routes are a way of telling the router that if there is no specific route for a given destination then send it this in this direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The previous answer that 0.0.0.0/0 means it is originated from this router is incorrect, however having a metric of 0 implies that it is originated locally. &lt;/p&gt;&#xA;" OwnerUserId="33528" LastActivityDate="2017-01-14T13:34:39.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38052" PostTypeId="2" ParentId="38042" CreationDate="2017-01-14T15:42:37.787" Score="2" Body="&lt;p&gt;First of all, having one port with sub-interfaces in different VLANS is not the same thing as having four ports.  Having a machine with that many NICs in different VLANs is generally a bad idea.  As a network guy, I don't trust the server to know what interface it should be sending traffic out.  In your scenario, can you say for sure which NIC the original ping request is coming out of?  If it's not eth1.100 every time, the ping will fail.  It could also fail if it goes out eth1.100 and when it's received by PC1 that machine sends the reply out any interface other than eth1.100.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could use a wireshark capture on the machines to look for where the packets are coming/going.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;do a &lt;code&gt;show mac address-table&lt;/code&gt; on the switch and look to see which VLAN the mac addresses are showing as being on.  Although, with your config this could change at the will of the PCs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From your output, only VLAN 100 is actually being trunked to the two PCs.  So you are missing 200, 300, and 400.  Verify that those VLANs are created on the switch with &lt;code&gt;show vlan&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-01-14T15:42:37.787" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38053" PostTypeId="2" ParentId="38044" CreationDate="2017-01-14T17:05:16.553" Score="2" Body="&lt;pre&gt;&lt;code&gt;access-list 112 permit udp any eq bootpc any eq bootps&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Whatever interface this is attached to is permitting any upd bootp client requests destined for any bootp server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if a client on that interface sends a bootp request it will be forwarded to a bootp server.&lt;/p&gt;&#xA;" OwnerUserId="33526" LastEditorUserId="8499" LastEditDate="2017-01-14T17:26:58.880" LastActivityDate="2017-01-14T17:26:58.880" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38054" PostTypeId="2" ParentId="38046" CreationDate="2017-01-14T17:24:47.153" Score="2" Body="&lt;p&gt;The difference here is incredibly trivial - literally on the order of single-digit nanoseconds.  The amount of time it takes to get the packet organized and across the switch is likely 2- to 3- orders of magnitude higher (and you're still in microseconds at that point) - and that's before you consider how long a host takes to actually receive, decode and process the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To accurately measure the differences here would require some very specialized equipment (read: hundreds of thousands of dollars) but, yes, a .5M passive twinax cable has less propagation delay than a 10M AOC.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-14T17:24:47.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38055" PostTypeId="1" AcceptedAnswerId="38056" CreationDate="2017-01-14T19:42:53.700" Score="2" ViewCount="1798" Body="&lt;p&gt;How can I know which packet belongs to a specific TCP session? In my experiment, a client establishes a TCP session with the web server every 5 seconds using &lt;code&gt;wget&lt;/code&gt; command (I also noticed it uses different port number each time). When I trace the packets in Wireshark, I use port number of the client side to filter the packets that belong to each session. Is that practical? I thought I can use sequence numbers but this will be tedious !!!&lt;/p&gt;&#xA;" OwnerUserId="32299" LastEditorUserId="8499" LastEditDate="2017-01-14T20:08:22.193" LastActivityDate="2017-01-14T20:08:22.193" Title="How to refer packets that belong to specific TCP session?" Tags="|cisco|tcp|wireshark|network-core|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38056" PostTypeId="2" ParentId="38055" CreationDate="2017-01-14T20:07:46.013" Score="2" Body="&lt;p&gt;TCP creates connections between the TCP peers. Each TCP peer creates a socket, which is identified by the TCP address (port) and IP address. The pair of sockets (one in each TCP peer) uniquely identifies the connection. To identify which TCP segments belong to which TCP connection, you need to identify the source and destination IP addresses and source and destination TCP addresses (ports).&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 793, TRANSMISSION CONTROL PROTOCOL&lt;/a&gt; explains this:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Multiplexing:&lt;/p&gt;&#xA;&lt;p&gt;To allow for many processes within a single Host to use TCP&#xA;communication facilities simultaneously, the TCP provides a set of&#xA;addresses or ports within each host.  Concatenated with the network&#xA;and host addresses from the internet communication layer, this forms a&#xA;socket.  A pair of sockets uniquely identifies each connection. That&#xA;is, a socket may be simultaneously used in multiple connections.&lt;/p&gt;&#xA;&lt;p&gt;The binding of ports to processes is handled independently by each&#xA;Host.  However, it proves useful to attach frequently used processes&#xA;(e.g., a &amp;quot;logger&amp;quot; or timesharing service) to fixed sockets which are&#xA;made known to the public.  These services can then be accessed through&#xA;the known addresses.  Establishing and learning the port addresses of&#xA;other processes may involve more dynamic mechanisms.&lt;/p&gt;&#xA;&lt;p&gt;Connections:&lt;/p&gt;&#xA;&lt;p&gt;The reliability and flow control mechanisms described above require&#xA;that TCPs initialize and maintain certain status information for each&#xA;data stream.  The combination of this information, including sockets,&#xA;sequence numbers, and window sizes, is called a connection. Each&#xA;connection is uniquely specified by a pair of sockets identifying its&#xA;two sides.&lt;/p&gt;&#xA;&lt;p&gt;When two processes wish to communicate, their TCP's must first&#xA;establish a connection (initialize the status information on each&#xA;side).  When their communication is complete, the connection is&#xA;terminated or closed to free the resources for other uses.&lt;/p&gt;&#xA;&lt;p&gt;Since connections must be established between unreliable hosts and&#xA;over the unreliable internet communication system, a handshake&#xA;mechanism with clock-based sequence numbers is used to avoid erroneous&#xA;initialization of connections.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Your question says that you are only using one criterion of the four criteria that identify a unique TCP connection.&lt;/p&gt;&#xA;&lt;p&gt;As you discovered, each time an HTTP client requests a connection to an HTTP server, it will use a different, random TCP address, know as an ephemeral port. There is a port range in your OS (varies by OS) for these ephemeral ports. The IANA recommendation for ephemeral ports is to use ports &lt;code&gt;49152&lt;/code&gt; to &lt;code&gt;65535&lt;/code&gt;, but different OSes use different ranges.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;FYI:&lt;/p&gt;&#xA;&lt;p&gt;The TCP datagrams are usually referred to a segments because TCP segments the data stream. Packet is used to refer to a layer-3 datagram, e.g. an IP packet, but TCP is a layer-4 protocol.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2017-01-14T20:07:46.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38057" PostTypeId="1" AcceptedAnswerId="38058" CreationDate="2017-01-14T20:57:54.443" Score="1" ViewCount="249" Body="&lt;p&gt;In some simulation environment, such as &lt;a href=&quot;https://github.com/mininet/mininet/wiki/Introduction-to-Mininet&quot; rel=&quot;nofollow noreferrer&quot;&gt;mininet&lt;/a&gt;, you are given parameters when you define your virtual link between switches such as: bandwidth, delay, and loss. I understand a link has a bandwidth but I don't understand how a link can cause a delay or loss! Kindly, can anyone elaborate that?  &lt;/p&gt;&#xA;" OwnerUserId="32892" LastActivityDate="2021-01-27T11:14:18.597" Title="How ethernet links can have a delay and loss" Tags="|cisco|ethernet|packet-loss|mininet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38058" PostTypeId="2" ParentId="38057" CreationDate="2017-01-14T23:05:30.090" Score="6" Body="&lt;p&gt;All links introduce latency.  It's a trivial amount when passing traffic over a 2M Ethernet patch cable but it's substantial on a trans-Pacific circuit.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some links also have packet loss.  It might be a function of the link being congested or there could be a physical issue like a flaky cable, RF interference on a wireless link or other anomalies.  This is particularly relevant when simulating the behavior of a network (or application) mapped over an Internet link, where occasional packet loss is pretty much expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - if you're trying to simulate real-world network conditions then being able to model the what-ifs of different latencies and the possibility of packet loss can be a huge help.  It allows something closer to a real-world simulation as well as testing how various network protocols, designs and actual implementations respond under different kinds of stresses.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-14T23:05:30.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38061" PostTypeId="1" AcceptedAnswerId="38062" CreationDate="2017-01-15T03:06:49.793" Score="1" ViewCount="1247" Body="&lt;p&gt;Generally speaking, we can calculate the packet delivery time using this formula, &lt;a href=&quot;https://en.wikipedia.org/wiki/Transmission_time&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Latency = Transmission delay + Propagation delay + queuing delay + processing delay&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is: Is it acceptable to use the value of RTT to be the estimated latency? In fact, the simulation environment I use provides the calculation of RTT so I wonder if it is close enough to use this value to be the estimated latency of a path from source and destination. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kindly, I'd like to refine this reasoning if it is not correct. &lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2017-01-15T03:30:27.283" Title="Using the value of RTT to estimate the latency" Tags="|cisco|routing|ethernet|protocol-theory|latency|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38062" PostTypeId="2" ParentId="38061" CreationDate="2017-01-15T03:18:13.957" Score="1" Body="&lt;p&gt;Network latency (what is on topic here) will vary from measurement to measurement. The queuing delay is constantly changing, based on the traffic at the time. With relatively little traffic, you will see pretty good latency, but as soon as someone start downloading a software update or watching a video, your latency can greatly increase until that stops. There are tools, like IP SLA, to constantly measure latency of various protocols, which will be different for different network protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RTT will be more than double the network latency because it includes both directions and the host processing times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Properly configured and managed QoS will give you the best throughput. Large queues under heavy load will give you the worst latency, so smaller queues with things like RED that will purposely drop packets in order to keep queues from filling and TCP from getting globally synchronized (a bad thing) so throughput can be greatly affected, are used.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-15T03:30:27.283" LastActivityDate="2017-01-15T03:30:27.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38063" PostTypeId="2" ParentId="38022" CreationDate="2017-01-15T06:15:58.220" Score="2" Body="&lt;p&gt;You could enable port-security with a low max number of MAC, say 1 or 2, on each port in the switch. Set the violation mode to shutdown (or restrict, depending on your goal). If you don't want to do this globally, you should be able to easily ID the port in question if your only switch the the SG300 mentioned. Use &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh mac addr &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and look for the switch port with multiple MACs hanging off of it that is NOT your uplink.&lt;/p&gt;&#xA;" OwnerUserId="1068" LastActivityDate="2017-01-15T06:15:58.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38064" PostTypeId="2" ParentId="38022" CreationDate="2017-01-15T06:24:34.940" Score="1" Body="&lt;p&gt;The real way to do something like this is to use 802.1X. That would let you authenticate all devices connecting to your switch interfaces, and it is pretty fine-grained. The problem with 802.1X is that it needs a server/software infrastructure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While port security could be used to thwart some cases of using a WAP, or other bridge (switch), using port security can be fooled by a router because the router would only have a MAC address of the router coming through the switch interface. Port security can also have problems if you have VoIP phones because they can use two or three MAC addresses, or if different devices need to connect to the same switch interface in a relatively short period of time.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-15T06:24:34.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38065" PostTypeId="1" AcceptedAnswerId="38067" CreationDate="2017-01-15T08:00:14.090" Score="2" ViewCount="496" Body="&lt;p&gt;I see that many IETF RFC documents use &quot;end site&quot; term.&#xA;However I cannot find exact definition of an &quot;end site&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody have a reasonable explanation of what is an &quot;end site&quot;?&#xA;In particular I am interested whether &quot;end site&quot; can be considered as being in one location like a building, or it can be spread in many locations.&lt;/p&gt;&#xA;" OwnerUserId="33550" LastEditorUserId="8499" LastEditDate="2018-12-26T05:28:03.613" LastActivityDate="2018-12-26T05:28:03.613" Title="What does &quot;end site&quot; mean?" Tags="|rfc|terminology|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38067" PostTypeId="2" ParentId="38065" CreationDate="2017-01-15T12:14:54.010" Score="4" Body="&lt;p&gt;In the context of &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6177&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 6177&lt;/a&gt;, &lt;em&gt;&amp;quot;IPv6 Address Assignment to End Sites&amp;quot;&lt;/em&gt;, an end site would be a &lt;strong&gt;single location&lt;/strong&gt; with its own dedicated IP service provision.&lt;/p&gt;&#xA;&lt;p&gt;That definition &lt;em&gt;might&lt;/em&gt; encompass multiple buildings if they're all on one site and sharing the same upstream IP service, and interconnected via an inter-building LAN.&lt;/p&gt;&#xA;&lt;p&gt;For a multi-location SME who takes separate internet service for each location from the &lt;em&gt;same&lt;/em&gt; ISP, that ISP might allocate a /48 for the SME as a whole, but then allocate a /56 from within that /48 for each physical location.&lt;/p&gt;&#xA;&lt;p&gt;This aggregation of multiple end sites within one larger subnet allows for simpler firewall policies, VPN settings, etc.&lt;/p&gt;&#xA;" OwnerUserId="20449" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-01-16T08:38:29.923" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38068" PostTypeId="1" CreationDate="2017-01-15T12:21:44.760" Score="1" ViewCount="31" Body="&lt;p&gt;I don't quite understand why 'wireless' is a correct answer for the first box in the left column (i.e. computers in wireless networks receive packet that may be part of a message for itself). The question and answers are as below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/og1MY.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/og1MY.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/RNyHl.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RNyHl.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33554" LastActivityDate="2017-01-15T16:32:31.057" Title="Why might computers in wireless networks receive packet that may be part of a message for itself?" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38069" PostTypeId="1" AcceptedAnswerId="38074" CreationDate="2017-01-15T13:14:07.563" Score="2" ViewCount="588" Body="&lt;p&gt;I want to ask: how PD (Powered device) which run on POE Mode A separate Data and Power from pairs? How can it read data signal when power is on same pairs?&lt;/p&gt;&#xA;" OwnerUserId="33555" LastEditorUserId="8499" LastEditDate="2017-01-15T16:38:40.893" LastActivityDate="2017-02-10T16:55:58.533" Title="POE - How does Mode A work?" Tags="|power-over-ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38070" PostTypeId="1" CreationDate="2017-01-15T13:45:06.600" Score="1" ViewCount="190" Body="&lt;p&gt;Should Path MTU Discovery (PMTUD) be implemented over fragmentation regardless of whether it is IPv4 or IPv6? Or should it just be implemented in ipv6 due to fragmentation now being handled through extension headers and no longer being handled by routers?&lt;/p&gt;&#xA;" OwnerUserId="25289" LastActivityDate="2017-01-15T15:05:16.450" Title="Is Path MTU Protocol more beneficial for IPv6" Tags="|ipv4|ipv6|fragmentation|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38071" PostTypeId="2" ParentId="25895" CreationDate="2017-01-15T14:59:33.883" Score="1" Body="&lt;p&gt;In computing the term &quot;word&quot; generally refers to the &quot;natural&quot; unit of data processing of a system. The size of this varies but is usually either 2 or 4 bytes. A byte in turn is normally 8 bits (internet standards are very much built around the assumption of an 8 bit byte).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reading the rest of the RFC there are references to both &quot;16 bit words&quot; and &quot;32-bit words&quot;. I believe that if the authors had intended to mean alignment on a 2-octect (16 bit) boundary they would have said so explicitly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I believe that the RFC authors intended the term &quot;word&quot; in it's general meaning. That a system could use the NOP option to align options on a boundary that was convenient for processing, whatever multiple of octets that boundary happened to be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not an issue for interoperability as all receivers are required to handle unaligned options.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-15T14:59:33.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38072" PostTypeId="2" ParentId="38070" CreationDate="2017-01-15T15:05:16.450" Score="4" Body="&lt;p&gt;IPv4 packets have a Don't-Fragment (DF) flag which indicates whether routers on the path are allowed to perform fragmentation when the packet doesn't fit the MTU of the next link. If you leave the DF flag off you can just send packets as large as possible on your local link, and routers along the path will fragment if/when necessary. You therefore as a sender don't need to discover the MTU for the whole path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only when you tell routers not to fragment IPv4 and turn the DF bit on do you need to learn about lower MTU's further along the path. Routers that would have fragmented will now send back ICMP messages (type 3: Destination Unreachable, subtype 4: Fragmentation Needed and Don't Fragment was Set) and the sender needs to receive these so they can adjust their packet size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 doesn't have a DF flag, fragmentation along the path is always prohibited. It therefore behaves in a similar way as IPv4 with the DF flag on. Routers will send back ICMP messages (Type 2: Packet Too Big, it's not a subtype of Destination Unreachable anymore, it now is so important it has its own type) and the sender has to take those into account when determining the packet size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So whether you have to implement Path MTU Discovery has nothing to do with where in the header the fragmentation is implemented (main header vs extension header), it depends on whether fragmentation is handled along the path or whether the sender has to determine the right packet size. If the routers along the path handle it (IPv4 with DF off) then the sender doesn't need to care, but otherwise (IPv4 with DF on, and IPv6) the sender must be able to receive those ICMP messages so it can adjust its behaviour accordingly.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2017-01-15T15:05:16.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38074" PostTypeId="2" ParentId="38069" CreationDate="2017-01-15T15:44:45.520" Score="3" Body="&lt;p&gt;Twisted pair Ethernet is transformer isolated. To allow the signals to pass through the transformers (which block DC and low frequencies). the signal is transmitted at high frequency and coding schemes are used to avoid DC and near DC components in the signal. This applies regardless of whether POE is in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;POE with power on the signal pairs (POE mode A for 10/100, any POE mode for 1G and higher) seperates the power from the signals in two ways.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly the signal is transmitted as a voltage difference between the two wires in a pair while the power is transmitted as a voltage difference between two pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly the power is DC, which will be blocked by the transformers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The power is applied and extracted by using transformers with a centre tap on the cable side (the transformers may or may not also have centre taps on the device side for unrelated reasons) and a sufficiently beefy core that the DC currents do not cause magnetic saturation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Isolated DC to DC converters are used to pass power to and from the Ethernet cable while maintaining isolation (this applies equally to modes A and B). &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-02-10T16:55:58.533" LastActivityDate="2017-02-10T16:55:58.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38076" PostTypeId="2" ParentId="38068" CreationDate="2017-01-15T16:32:31.057" Score="1" Body="&lt;p&gt;You must think about why wireless and bus topologies are similar. They are both half-duplex technologies, and every frame sent &quot;on the wire&quot; is sent to every host. That means every host will hear every frame, and some of those frames must be for a listening host.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-15T16:32:31.057" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38078" PostTypeId="1" AcceptedAnswerId="38079" CreationDate="2017-01-15T18:32:57.297" Score="1" ViewCount="4164" Body="&lt;p&gt;Consider the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario 1 (route-map PERMIT and ACL permit):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#route-map boston permit 1&#xA;router(config-route-map)#match ip address 5&#xA;router(config-route-map)#set community 120&#xA;router(config)#access-list 5 permit 10.5.1.121 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Scenario 2 (route-map PERMIT and ACL deny):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#route-map boston permit 1&#xA;router(config-route-map)#match ip address 5&#xA;router(config-route-map)#set community 120&#xA;router(config)#access-list 5 deny 10.5.1.121 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Scenario 3 (route-map DENY and ACL permit):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#route-map boston deny 1&#xA;router(config-route-map)#match ip address 5&#xA;router(config-route-map)#set community 120&#xA;router(config)#access-list 5 permit 10.5.1.121 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Scenario 4 (route-map DENY and ACL DENY):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#route-map boston deny 1&#xA;router(config-route-map)#match ip address 5&#xA;router(config-route-map)#set community 120&#xA;router(config)#access-list 5 deny 10.5.1.121 0.0.0.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Q: What is the difference in the four scenarios? Please clarify. For ease of understanding, is there some kind of truth table that we can construct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can the following truth table be applied universally?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Route-map(permit), ACL(permit)----&gt;DO THE TASK&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Route-map(permit), ACL(deny)----&gt;DON'T DO THE TASK&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Route-map(deny), ACL(permit)----&gt;DON'T DO THE TASK&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Route-map(deny), ACL(deny)----&gt;DON'T DO THE TASK&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="8499" LastEditDate="2018-12-17T02:32:18.337" LastActivityDate="2018-12-17T02:32:18.337" Title="Regarding route-map and ACL combination" Tags="|cisco|acl|route-map|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38079" PostTypeId="2" ParentId="38078" CreationDate="2017-01-15T18:40:09.790" Score="2" Body="&lt;ul&gt;&#xA;&lt;li&gt;Scenario 1:  Will set the community to 120 for 10.5.1.0/24 &lt;/li&gt;&#xA;&lt;li&gt;Scenario 2:  Will not set the community to 120 for any route&lt;/li&gt;&#xA;&lt;li&gt;Scenario 3:  Will not set the community to 120 for any route&lt;/li&gt;&#xA;&lt;li&gt;Scenario 4:  Will not set the community to 120 for any route&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There is an implicit deny in the route-map statement.  So if permit 1's match clause in Scenario 2 doesn't match because of the deny statement in the ACL, then the rest of the networks would not be matched either. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider this additional scenario: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router(config)#route-map boston permit 10&#xA;router(config-route-map)#match ip address 5&#xA;router(config-route-map)#set community 120&#xA;router(config)#access-list 5 deny 10.5.1.121 0.0.0.255&#xA;router(config)#route-map boston permit 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In this scenario, you would be saying set the community to 120 for any route that's NOT 10.5.1.0/24. &lt;/p&gt;&#xA;" OwnerUserId="599" LastEditorUserId="599" LastEditDate="2017-01-15T18:46:45.307" LastActivityDate="2017-01-15T18:46:45.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38080" PostTypeId="1" AcceptedAnswerId="38083" CreationDate="2017-01-15T18:41:39.273" Score="6" ViewCount="1437" Body="&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291&lt;/a&gt; specifies that IPv6 link-local unicast addresses must have a high-order bit sequence of &lt;code&gt;1111111010&lt;/code&gt;, or &lt;code&gt;fe80::/10&lt;/code&gt;.  However, the same document specifies that the 54 bits following the first 10 bits are zeros:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Link-Local addresses are for use on a single link.  Link-Local&#xA;   addresses have the following format:&#xA;&#xA;   |  10 bits |         54 bits         |          64 bits           |&#xA;   +----------+-------------------------+----------------------------+&#xA;   |1111111010|           0             |       interface ID         |&#xA;   +----------+-------------------------+----------------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Why isn't the link-local address format simply specified as &lt;code&gt;fe80::/64&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="13361" LastEditorUserId="53795" LastEditDate="2023-08-07T06:17:06.013" LastActivityDate="2023-08-07T06:17:06.013" Title="Why is the IPv6 link-local address range fe80::/10 rather than fe80::/64?" Tags="|ip|subnet|ipv6|protocol-theory|ip-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="38081" PostTypeId="2" ParentId="38022" CreationDate="2017-01-15T18:57:25.060" Score="1" Body="&lt;p&gt;While other answers are definitely correct, one additional method to help prevent un-authorized devices is to use &lt;code&gt;spanning-tree bpduguard enable&lt;/code&gt; on the switchports that should be going to single hosts.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will put the port into an err-disabled state if it sees any spanning-tree bpdu packets ingress to the port.  A lot of wifi-routers will trigger this condition.  Generally, I configure the following on access ports facing users:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree bpduguard enable&#xA;spanning-tree guard root&#xA;switchport port-security &amp;lt;max 2&amp;gt; (if using VoIP phones with the desktop patched to the phone) &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-01-15T18:57:25.060" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38082" PostTypeId="2" ParentId="38078" CreationDate="2017-01-15T18:57:28.600" Score="2" Body="&lt;p&gt;Cisco has documentation for this. It may be simpler to think about the interaction with redistribution. The following example is from &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/route_maps.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Defining Route Maps&lt;/a&gt; and an identical example in &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/49111-route-map-bestp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Route-Maps for IP Routing Protocol Redistribution Configuration&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Permit and Deny Clauses&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Route-maps can have &lt;strong&gt;permit&lt;/strong&gt; and &lt;strong&gt;deny&lt;/strong&gt; clauses. In route map&#xA;  &lt;strong&gt;ospf-to-eigrp&lt;/strong&gt;, there is one deny clause (with sequence number 10) and two permit clauses. The deny clause rejects route matches from&#xA;  redistribution. Therefore, these rules apply:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;If you use an ACL in a route map permit clause, routes that are    permitted by the ACL are redistributed.&lt;/li&gt;&#xA;  &lt;li&gt;If you use an ACL in a route map deny clause, routes that are    permitted by the ACL are not redistributed.&lt;/li&gt;&#xA;  &lt;li&gt;If you use an ACL in a route map permit or deny clause, and the ACL    denies a route, then the route map clause match is not found and the&#xA;  next route map clause is evaluated.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This seems to line up with the Boolean &lt;code&gt;AND&lt;/code&gt; logic table from high school:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;True  AND True  = True&#xA;True  AND False = False&#xA;False AND True  = False&#xA;False AND False = False&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-15T19:12:42.403" LastActivityDate="2017-01-15T19:12:42.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38083" PostTypeId="2" ParentId="38080" CreationDate="2017-01-15T19:21:15.637" Score="10" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Why isn't the link-local address format simply specified as FE80::/64?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because that would leave the option open for using other, non link-local networks that start with &lt;code&gt;fe80&lt;/code&gt; as the first word. For example &lt;code&gt;fe80:1:2:3::/64&lt;/code&gt; would not be in &lt;code&gt;fe80::/64&lt;/code&gt;, so theoretically could be used for something else, and that would be an undesired result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also leaves the possibility that the current 54 &lt;code&gt;0&lt;/code&gt; bits could be used for some enhancement of link-local addresses in the future. Basically, they are reserved bits. Often, protocols with reserved bits start using those bits to add functionality, later. For example, IPv6 multicast has scopes and flags, and there were originally two reserved flags, but one of those was used to add functionality to IPv6 multicast. Then, with only one reserved flag bit left, a later RFC expanded the number of flag bits to eight, even though only three flag bits are used.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-15T19:40:55.820" LastActivityDate="2017-01-15T19:40:55.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38085" PostTypeId="2" ParentId="24536" CreationDate="2017-01-15T22:39:23.070" Score="0" Body="&lt;p&gt;You can typically log into the customer premise equipment (CPE) by connecting to it via your web browser.  (Yours is done like &lt;a href=&quot;http://setuprouter.com/router/technicolor/tc8305c/login.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;).  So, look at what your DHCP provided ip default gateway is (in windows open command prompt type ipconfig/all).  Plug that IP address into your browser to connect.  You may need to add &lt;code&gt;/admin&lt;/code&gt; after the address.  Search based on your model CPE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once in there, most CPE's allow you to assign your single public IP address to a device in your home network.  You would apply that IP address to your router.  From there, configure it as you wish.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-15T22:39:23.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38086" PostTypeId="1" AcceptedAnswerId="38087" CreationDate="2017-01-15T23:14:16.687" Score="0" ViewCount="148" Body="&lt;p&gt;The PuTTY version 0.66.0.0 I have on my computer can supposedly be exploited, allowing remote servers to perform a DoS attack or execute arbitrary code. I'm sure it's because PSCP is missing a bounds check for a stack buffer when  processing the SCP-SINK file size response to a download request, but I'm having trouble finding the CVE identifier for this vulnerability. Could you please help me find it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my first time posting so sorry if there's anything I did wrong.&lt;/p&gt;&#xA;" OwnerUserId="33566" LastEditorUserId="8499" LastEditDate="2017-01-16T03:13:20.397" LastActivityDate="2017-01-16T03:13:20.397" Title="CVE Identifier for PuTTY vulnerability?" Tags="|cisco|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ClosedDate="2017-01-16T06:22:30.350" ContentLicense="CC BY-SA 3.0" />
  <row Id="38087" PostTypeId="2" ParentId="38086" CreationDate="2017-01-16T00:04:01.007" Score="1" Body="&lt;p&gt;Simply look at the &lt;a href=&quot;http://www.chiark.greenend.org.uk/~sgtatham/putty/&quot; rel=&quot;nofollow noreferrer&quot;&gt;PuTTY home page&lt;/a&gt;. It has all the information and links. It would have been much, much faster for you if you had done a simple search. It took less than a second for me to find it.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;summary&lt;/strong&gt;: Vulnerability: old-style scp downloads may allow remote code execution&lt;br&gt;&#xA;  &lt;strong&gt;class&lt;/strong&gt;: vulnerability: This is a security vulnerability.&lt;br&gt;&#xA;  &lt;strong&gt;difficulty&lt;/strong&gt;: fun: Just needs tuits, and not many of them.&lt;br&gt;&#xA;  &lt;strong&gt;priority&lt;/strong&gt;: high: This should be fixed in the next release.&lt;br&gt;&#xA;  &lt;strong&gt;present-in&lt;/strong&gt;: 0.66&lt;br&gt;&#xA;  &lt;strong&gt;fixed-in&lt;/strong&gt;: 0.67 &lt;a href=&quot;https://git.tartarus.org/?p=simon/putty.git;a=commitdiff;h=bc6c15ab5f636e05b7e91883f0031a7e06117947&quot; rel=&quot;nofollow noreferrer&quot;&gt;bc6c15ab5f636e05b7e91883f0031a7e06117947&lt;/a&gt;  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Many versions of PSCP prior to 0.67 have a stack corruption&#xA;  vulnerability in their treatment of the 'sink' direction (i.e.&#xA;  downloading from server to client) of the old-style SCP protocol.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In order for this vulnerability to be exploited, the user must connect&#xA;  to a malicious server and attempt to download any file.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;(Note however that the vulnerability kicks in after host key&#xA;  verification, so the host key of the server has to have been accepted&#xA;  to get this far.)&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This vulnerability only arises in the old SCP protocol, so you can&#xA;  work around it in a vulnerable PSCP by using the -sftp option to force&#xA;  the use of the newer SFTP protocol, provided your server supports that&#xA;  protocol.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This bug was discovered by &lt;a href=&quot;https://github.com/tintinweb/pub/tree/master/pocs/&quot; rel=&quot;nofollow noreferrer&quot;&gt;tintinweb&lt;/a&gt; and has been assigned CVE ID&#xA;  &lt;a href=&quot;http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2563&quot; rel=&quot;nofollow noreferrer&quot;&gt;CVE-2016-2563&lt;/a&gt;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;em&gt;Vulnerability details&lt;/em&gt;: Prior to any download in the SCP sink protocol, the server sends a line of text consisting of an octal&#xA;  number encoding Unix file permissions, a decimal number encoding the&#xA;  file size, and the file name. Since the file size can exceed 232&#xA;  bytes, and in some compilation configurations of PuTTY the host&#xA;  platform's largest integer type is only 32 bits wide, PuTTY extracts&#xA;  the decimal file size into a temporary string variable to send to its&#xA;  own 64-bit decimal decoding function. Unfortunately, that extraction&#xA;  was done carelessly, using a sscanf with no length limit, permitting a&#xA;  buffer overrun.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-16T00:04:01.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38088" PostTypeId="5" CreationDate="2017-01-16T03:20:36.720" Score="0" Body="&lt;p&gt;Cable installations need to be certified for the specific category or class, and some companies require network device hardware/software to be certified for use within the company.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-16T03:20:36.720" LastActivityDate="2017-01-16T03:20:36.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38089" PostTypeId="4" CreationDate="2017-01-16T03:20:36.720" Score="0" Body="For questions involving certification of network hardware, software, cabling, etc. for use. This tag is not meant for educational certifications, e.g. CCNA." OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-16T03:20:36.720" LastActivityDate="2017-01-16T03:20:36.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38090" PostTypeId="1" CreationDate="2017-01-16T06:26:13.087" Score="2" ViewCount="1230" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8uN2D.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8uN2D.jpg&quot; alt=&quot;DIAGRAM&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A little confused here. Im trying to determine the root port for SWITCH B. SWITCH C here is the ROOT SWITCH. I understand that to determine the root port you need to find the lowest cost path to the root switch. So at the path highlighted in green, is the root path cost:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;38 (because FA0/2 from SWITCH A + FA0/1 from SWITCH C)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;23 (FA0/1 from SWITCH A + Gi 0/2 from SWITCH B)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I cannot which part should I look at to determine the cost (especially the connection between SW A and SW B). They are connected but on different speed port, one using Fast Ethernet, the other one Gigabit Ethernet?&lt;/p&gt;&#xA;" OwnerUserId="33570" LastActivityDate="2017-01-17T08:22:20.207" Title="Root path cost?" Tags="|cisco|switch|spanning-tree|speed|network|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38091" PostTypeId="2" ParentId="38090" CreationDate="2017-01-16T06:45:02.950" Score="1" Body="&lt;p&gt;I think you need to consider the fact that although both interfaces are capable of different speeds, ultimately the link would only come up if it negotiated at the lowest speed supported by both ends.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-01-16T06:45:02.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38092" PostTypeId="1" CreationDate="2017-01-16T08:06:44.570" Score="3" ViewCount="1849" Body="&lt;p&gt;I would like to monitor/manage VPN /Tunnel for Vyatta router 5600 through SNMP . Can't find mib or specific OID for the Vyatta router 5600. ? &#xA;Please answer with Mib or SNMP OID .&#xA;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="33571" LastActivityDate="2018-11-13T04:04:05.623" Title="Monitor Vyatta router VPN through SNMP" Tags="|router|vpn|snmp|vyatta|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="38093" PostTypeId="1" AcceptedAnswerId="38098" CreationDate="2017-01-16T09:59:43.153" Score="2" ViewCount="252" Body="&lt;p&gt;So I'm revising for a Networking exam and struggling to understand IP routing. If I explain how I understand it, could you tell me where I'm right and where I'm wrong? I'd really appreciate it. Here's how I see it:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Hosts ARPs for gateway (if needed).&lt;/li&gt;&#xA;&lt;li&gt;Host sends request to gateway. Ethernet frame has the gateway MAC address for it's destination, but the internal IP packet has the destination address of the server that is ultimately trying to be reached.&lt;/li&gt;&#xA;&lt;li&gt;Gateway compares the IP packet destination address to the IP address prefixes in it's route table. If one matches, it sends it down that port. Every subsequent server does the same and in a well-established route every one of them will have an address prefix matching the destination to some degree and will send it on down this familiar path.&lt;/li&gt;&#xA;&lt;li&gt;If the gateway &lt;em&gt;doesn't&lt;/em&gt; have an address prefix that matches the destination address, then it begins routing. It uses an Internal Gatewway Protocol (IGP) such as RIP or OSPF to ask it's neighbours within it's Autonomous System (AS)(most likely a Transit AS belonging to your ISP), &quot;do you know where this is?&quot;.&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;This message is passed around within the AS until one of the gateways recognises a part of the network prefix, such as perhaps the region of the address, and has a vague notion of where to send it on.&lt;/li&gt;&#xA;&lt;li&gt;That gateway will then use an External Gateway Protocol (EGP) such as BGP to communicate with the AS(es?) that it's linked to and ask them for routing information.&lt;/li&gt;&#xA;&lt;li&gt;One of these may recognise the second block and be able to route it further in the correct direction&lt;/li&gt;&#xA;&lt;li&gt;Eventually a gateway will use EGP on the AS that owns the destination address and that target gateway will reply yes, I can get there in n hops. &lt;/li&gt;&#xA;&lt;li&gt;This message follows back through the path, each hop adding one to the length until it gets back to our original gateway that now knows of a path of y hops to get to the destination. &lt;/li&gt;&#xA;&lt;li&gt;It will add this to it's routing table, wrap the IP packet in a new ethernet frame with a destination address of the first hop on this path and send it on it's way.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33574" LastActivityDate="2017-01-16T23:07:04.370" Title="Do I understand IP Routing correctly?" Tags="|routing|ip|bgp|igp|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38096" PostTypeId="1" AcceptedAnswerId="38099" CreationDate="2017-01-16T12:51:17.917" Score="1" ViewCount="135" Body="&lt;p&gt;I am stucked with this problem since a view days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to deploy a transparent firewall between my users and the default gateway. For different reasons, the firewall cannot be deployed in-line between users and the default gateway but has to be physically connected to the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/orWlp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/orWlp.png&quot; alt=&quot;Illustration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&#xA;What switching technique would you recommend to forcing the traffic through the firewall. Is this even possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for you support&lt;/p&gt;&#xA;" OwnerUserId="33580" LastActivityDate="2017-01-16T13:31:42.250" Title="Control traffic on layer2 switch - All traffic should be &quot;routed&quot; to transparent firewall" Tags="|firewall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38097" PostTypeId="1" AcceptedAnswerId="38101" CreationDate="2017-01-16T12:58:12.767" Score="2" ViewCount="1091" Body="&lt;p&gt;With the following config I try to advertise a network to neighbor but the show command only list 0 prefixes to this neighbor.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 2&#xA; bgp log-neighbor-changes&#xA; neighbor 128.16.16.34 remote-as 1&#xA; !&#xA; address-family ipv4&#xA;  network 128.16.16.0&#xA;  network 128.16.16.0 mask 255.255.255.0&#xA;  neighbor 128.16.16.34 activate&#xA;  neighbor 128.16.16.34 route-map red out&#xA; exit-address-family&#xA;!&#xA;ip route 128.16.16.0 255.255.255.0 Null0 200&#xA;!&#xA;ip prefix-list 1 seq 5 permit 128.16.16.16/28&#xA;!&#xA;route-map red permit 10&#xA; match ip address prefix-list 1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On one interface there is the network 128.16.16.32/30 connected (BGP neighbor) and on a second interface there is the network 128.16.16.16/28 connected, this second network should be advertised to the neighbor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh ip route | inc 128.16.16.&#xA;S        128.16.16.0/22 is directly connected, Null0&#xA;C        128.16.16.16/28 is directly connected, GigabitEthernet0/0/0&#xA;L        128.16.16.18/32 is directly connected, GigabitEthernet0/0/0&#xA;C        128.16.16.32/30 is directly connected, GigabitEthernet0/0/1&#xA;L        128.16.16.33/32 is directly connected, GigabitEthernet0/0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the output of sh bgp command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh bgp | inc 128.16.16.&#xA;BGP table version is 39103822, local router ID is 128.16.16.34&#xA; *&amp;gt;  128.16.16.0/22  0.0.0.0                  0         32768 i&#xA;                       128.16.16.34                          0 1 i&#xA;                       128.16.16.34                          0 1 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this one the show advertised route command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh ip bgp neighbors 128.16.16.34 advertised-routes &#xA;&#xA;Total number of prefixes 0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I delete the &lt;code&gt;neighbor 128.16.16.34 route-map red out&lt;/code&gt; command then the sh advertised route command contains all routes. How can I debug why the route don't advertise the route from route map.&lt;/p&gt;&#xA;" OwnerUserId="20772" LastEditorUserId="20772" LastEditDate="2017-01-16T14:00:02.690" LastActivityDate="2017-01-16T17:46:18.007" Title="Why there is no advertised route to a neighbor on Cisco ISR?" Tags="|cisco|routing|bgp|cisco-ios|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38098" PostTypeId="2" ParentId="38093" CreationDate="2017-01-16T13:17:11.507" Score="2" Body="&lt;p&gt;Hosts contain their own routing tables, and will consult those to determine whether the packet can be delivered directly, or forwarded to a gateway (and if so, which one).   Only then does your step 1 start.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your final step is completely incorrect.  At no point does a router &quot;ask&quot; its neighbours for a route to a specific destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routing protocols run continuously in the background, updating the router's internal routing tables (the RIB and FIB) with a complete reachability table, on the fly, as links and neighbours come and go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's no matching route in the routing tables, the packet will be dropped.  An ICMP &quot;network unreachable&quot; packet should be returned.&lt;/p&gt;&#xA;" OwnerUserId="20449" LastEditorUserId="20449" LastEditDate="2017-01-16T13:48:56.153" LastActivityDate="2017-01-16T13:48:56.153" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38099" PostTypeId="2" ParentId="38096" CreationDate="2017-01-16T13:31:42.250" Score="2" Body="&lt;p&gt;Create two VLANS on your switch (100 and 200). All users go in vlan 100. Your gateway connects to vlan 200.  Your firewall connects to both vlans. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-16T13:31:42.250" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38100" PostTypeId="1" AcceptedAnswerId="38102" CreationDate="2017-01-16T13:44:52.703" Score="1" ViewCount="40" Body="&lt;p&gt;We are a very small company which currently has the below configuration, with two Internet-Services providers:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One only for Internet acces with High-speed Optical-Fiber&lt;/li&gt;&#xA;&lt;li&gt;The second one for phone that also provides a backup ADSL connexion in case of temporary failure of the first one. We switch manually in case of failure.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Btvtn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Btvtn.png&quot; alt=&quot;Former configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we would now like is to have the bellow new configuration, with only one Switch accepting two different entries and managing automatically the switch from the first one to the second in case of internet failure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Nf2JQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nf2JQ.png&quot; alt=&quot; Future Configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is the Cisco SLM2048PT-EU suitable for this type of task? What is the key functionality that I should look for this type of task?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="33582" LastEditorUserId="8499" LastEditDate="2017-01-16T15:48:20.497" LastActivityDate="2017-01-16T15:48:20.497" Title="New switch upgrade choice for small company network" Tags="|cisco|switch|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38101" PostTypeId="2" ParentId="38097" CreationDate="2017-01-16T14:14:29.087" Score="5" Body="&lt;p&gt;You don't have a network statement for the network you are trying to advertise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Add the network in you BGP config will solve this issue:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 2&#xA; !&#xA; address-family ipv4&#xA;  network 128.16.16.16 mask 255.255.255.240&#xA; exit-address-family&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33583" LastEditorUserId="20772" LastEditDate="2017-01-16T17:46:18.007" LastActivityDate="2017-01-16T17:46:18.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38102" PostTypeId="2" ParentId="38100" CreationDate="2017-01-16T15:28:34.283" Score="0" Body="&lt;p&gt;You seem to be confusing switches and routers. Routers route between networks, but switches switch traffic on the same network. Your ISPs have networks, and you will have one or more networks, and you need a router to route between the networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also need a firewall between the ISPs and your network. It would be rather foolish not to protect your network with a firewall.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Also, from the Cisco web site for this switch model:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;NOTE: This product is no longer being sold and might not be supported.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-16T15:28:34.283" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38103" PostTypeId="1" AcceptedAnswerId="38105" CreationDate="2017-01-16T15:41:04.087" Score="2" ViewCount="787" Body="&lt;p&gt;Let's say our router has 2 WAN IP addresses - ether1 with 199.16.1.2 and ether2 with 199.16.2.2, and a single default route pointing to 199.16.1.1 (the router directly connected to our router on ether1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a packet comes in on ether1 destined to 199.16.1.2, things are pretty straightforward - the reply from our router goes back out ether1 (using the default gateway route) with a source IP of 199.16.1.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a packet comes in on ether2 destined to 199.16.2.2, the router's reply will go out the default gateway (out ether1), and its source IP address will be 199.16.2.2 (ether2's IP). If you want the reply to go out the same interface it came in on, you need some way to tell it that anything with the source IP address of 199.16.2.2 should go out ether2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does that sound right?&lt;/p&gt;&#xA;" OwnerUserId="33585" LastEditorUserId="8499" LastEditDate="2017-01-16T16:31:26.460" LastActivityDate="2017-01-16T20:16:14.787" Title="Do routers send a reply out the same interface they got a request from?" Tags="|routing|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38104" PostTypeId="2" ParentId="38103" CreationDate="2017-01-16T15:58:05.510" Score="3" Body="&lt;p&gt;Normally routers only consider the destination IP when routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many routers can route based on more complex criteria, including the source address but this needs to be specially configured. This is usually called &quot;policy routing&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally it is a bit odd for packets to be destined for a router unless the router is also doing NAT. At least on Linux I found that policy routing and NAT had an issue with each other, specifically the source IP Linux used for policy routing was the original source IP, not the translated source IP. I detail a method I found for working around this at &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/35400/how-to-make-multiple-subnet-able-to-use-one-resource-without-being-able-to-conne/35435&quot;&gt;how to make multiple subnet able to use one resource without being able to connect to each other in any way&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2017-01-16T20:16:14.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38105" PostTypeId="2" ParentId="38103" CreationDate="2017-01-16T15:58:13.937" Score="4" Body="&lt;p&gt;Routers route packets individually, based on the destination address, not the source address. A router doesn't know that any packet is a reply to any other packet. This can sometimes result in asymmetric routing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-16T15:58:13.937" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38106" PostTypeId="2" ParentId="38097" CreationDate="2017-01-16T16:16:21.313" Score="0" Body="&lt;p&gt;Your network statement is for a /24 or the classfull, your prefix-list only allows /28 and your local networks don't match. You need to align the masks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;try this out as example. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     network 128.16.16.0 mask 255.255.252.0&#xA;&#xA;     ip prefix-list 1 seq 5 permit 128.16.16.16/22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33524" LastActivityDate="2017-01-16T16:16:21.313" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38107" PostTypeId="1" AcceptedAnswerId="38118" CreationDate="2017-01-16T17:06:13.960" Score="1" ViewCount="756" Body="&lt;p&gt;I am IT admin, and I got this report from a user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you help me understand the TCP connection entry to to this doubleclick Foreign Address? Is it a concern for the end user/organization? What could possibly open so many connections to doubleclick?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\myPc&amp;gt;netstat&#xA;&#xA;Active Connections&#xA;&#xA;  Proto  Local Address          Foreign Address        State&#xA;  TCP    127.0.0.1:5939         doubleclick:49713      ESTABLISHED&#xA;  TCP    127.0.0.1:27017        doubleclick:51340      ESTABLISHED&#xA;  TCP    127.0.0.1:27017        doubleclick:51341      ESTABLISHED&#xA;  TCP    127.0.0.1:27017        doubleclick:51354      ESTABLISHED&#xA;  TCP    127.0.0.1:27017        doubleclick:51626      ESTABLISHED&#xA;  TCP    127.0.0.1:49677        doubleclick:49678      ESTABLISHED&#xA;  TCP    127.0.0.1:49678        doubleclick:49677      ESTABLISHED&#xA;  TCP    127.0.0.1:49680        doubleclick:49681      ESTABLISHED&#xA;  TCP    127.0.0.1:49681        doubleclick:49680      ESTABLISHED&#xA;  TCP    127.0.0.1:49705        doubleclick:49706      ESTABLISHED&#xA;  TCP    127.0.0.1:49706        doubleclick:49705      ESTABLISHED&#xA;  TCP    127.0.0.1:49713        doubleclick:5939       ESTABLISHED&#xA;  TCP    127.0.0.1:49722        doubleclick:49723      ESTABLISHED&#xA;  TCP    127.0.0.1:49723        doubleclick:49722      ESTABLISHED&#xA;  TCP    127.0.0.1:50570        doubleclick:50572      ESTABLISHED&#xA;  TCP    127.0.0.1:50572        doubleclick:50570      ESTABLISHED&#xA;  TCP    127.0.0.1:50573        doubleclick:50574      ESTABLISHED&#xA;  TCP    127.0.0.1:50574        doubleclick:50573      ESTABLISHED&#xA;  TCP    127.0.0.1:50575        doubleclick:50576      ESTABLISHED&#xA;  TCP    127.0.0.1:50576        doubleclick:50575      ESTABLISHED&#xA;  TCP    127.0.0.1:50579        doubleclick:50580      ESTABLISHED&#xA;  TCP    127.0.0.1:50580        doubleclick:50579      ESTABLISHED&#xA;  TCP    127.0.0.1:50581        doubleclick:50582      ESTABLISHED&#xA;  TCP    127.0.0.1:50582        doubleclick:50581      ESTABLISHED&#xA;  TCP    127.0.0.1:50583        doubleclick:50584      ESTABLISHED&#xA;  TCP    127.0.0.1:50584        doubleclick:50583      ESTABLISHED&#xA;  TCP    127.0.0.1:50585        doubleclick:50586      ESTABLISHED&#xA;  TCP    127.0.0.1:50586        doubleclick:50585      ESTABLISHED&#xA;  TCP    127.0.0.1:50617        doubleclick:50618      ESTABLISHED&#xA;  TCP    127.0.0.1:50618        doubleclick:50617      ESTABLISHED&#xA;  TCP    127.0.0.1:50619        doubleclick:50620      ESTABLISHED&#xA;  TCP    127.0.0.1:50620        doubleclick:50619      ESTABLISHED&#xA;  TCP    127.0.0.1:51340        doubleclick:27017      ESTABLISHED&#xA;  TCP    127.0.0.1:51341        doubleclick:27017      ESTABLISHED&#xA;  TCP    127.0.0.1:51354        doubleclick:27017      ESTABLISHED&#xA;  TCP    127.0.0.1:51626        doubleclick:27017      ESTABLISHED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33588" LastEditorUserId="8499" LastEditDate="2017-01-17T02:56:21.653" LastActivityDate="2017-01-17T02:56:21.653" Title="Help me understand this netstat report" Tags="|troubleshooting|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38109" PostTypeId="1" AcceptedAnswerId="38110" CreationDate="2017-01-16T17:48:26.957" Score="3" ViewCount="2193" Body="&lt;p&gt;I am really confused about tunneling protocol family and all related protocols. I read a bunch of articles, rfc but still cannot get the idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will put my questions between my explanation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A little bit about my network configuration.&lt;br&gt;&#xA;1. I have home router (wifi), it is connected to my ISP via &lt;code&gt;PPPoE&lt;/code&gt;.&lt;br&gt;&#xA;2. All packets were captured while I was connected to the remote &lt;code&gt;VPN&lt;/code&gt; server over &lt;code&gt;PPTP&lt;/code&gt; protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;In computer networking, Point-to-Point Protocol (PPP) is a data link (layer 2) protocol used to establish a direct connection between two nodes.&lt;/em&gt;&lt;br&gt;&#xA;&lt;strong&gt;Q-1: What does point to point in general mean ? How can I connect not point to point ? I have only one cable, in case of my network, my router is connected to the switch with the cable ?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have captured packets, here is wireshark information about the PPP packet. &lt;a href=&quot;https://i.stack.imgur.com/hYI3T.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/hYI3T.jpg&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Q-2: &lt;em&gt;Point-to-Point Protocol (PPP) is a data link&lt;/em&gt;  Hmm. Why then this packet is encapsulated inside &lt;code&gt;IP&lt;/code&gt; -&gt; &lt;code&gt;GRE&lt;/code&gt; ???? It is not second layer&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Q-3: How PPP (PPPoe) differs from simple Data Link ethernet frame (used by switches) ?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also VPN connection is called PPTP, so as I could guess PPTP is used just for session establishment, nothing else. Because I can see PPTP packets only serveral times while communication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Captured packet &lt;a href=&quot;https://i.stack.imgur.com/XBFQt.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/XBFQt.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And this goes even further above Layer 4 (TCP). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am really confused about all these stuff, so I try to explain how I understand a process is general. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all &lt;code&gt;PPP&lt;/code&gt; is just standard for special packet format on the data link layer, it is used because this protocol (PPP) is implemented above different physical environments like Ethernet, ATM... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is it used ? Because it provides auth on the second layer of OSI using LCP, NCP protocols. So basically when I am connecting to my provider I use credentials to establish the connection. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes encapsulation is mentioned as an advantage of this protocol &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Q-4: Why this is an advantage ? OSI stack assumes encapsulation out of the box, each higher layers is just encapsulated inside payload field of the the lower one !!&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So basically PPP allows authentication and compression. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I am using VPN (PPTP) as far as PPTP server is specific application that uses port (1723) in order to listen inbound connections.Thats why it is located above TCP. And this protocol is just used to establish communication with the server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Q-5: How does further communication work if PPP packets are just wrapped in IP and no port is specified ? How does VPN server machine know that this packet is tunnel and it should be redirected to the 1723 port application in order to proceed ?&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help me to understand this topic, please answer my questions. I would be grateful for any help&lt;/p&gt;&#xA;" OwnerUserId="33587" LastActivityDate="2017-01-16T18:27:31.500" Title="PPP, VPN, Tunneling and OSI model" Tags="|vpn|ip|tunnel|osi|ppp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38110" PostTypeId="2" ParentId="38109" CreationDate="2017-01-16T18:19:25.007" Score="3" Body="&lt;p&gt;Your question is really too broad, and home networking and consumer-grade devices are explicitly off-topic here, but I will try to give you some general answers.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;PPP is a layer-2 protocol, the same way that ethernet, HDLC, frame&#xA;relay, ATM, etc. are. PPP is specifically a point-to-point protocol&#xA;with only two endpoints. Other protocols, e.g. ethernet, are&#xA;designed to work with multiple possible endpoints. Because ethernet,&#xA;and other IEEE LAN protocols can have multiple connection, they use&#xA;MAC addresses, but PPP doesn't.&lt;/li&gt;&#xA;&lt;li&gt;I don't really understand your second question. PPP is a layer-2&#xA;protocol, but IP is a layer-3 protocol. In general, layer-2&#xA;protocols don't care about layer-3, and they can carry any number of&#xA;layer-3 protocols.&lt;/li&gt;&#xA;&lt;li&gt;Ethernet is both a layer-1 and a layer-2 protocol. PPPoE uses PPP&#xA;for the layer-2 protocol on an ethernet layer-1. The PPP frames are&#xA;encapsulated in ethernet frames. As far as your traffic is&#xA;concerned, it is passing through an interface that uses PPP as the&#xA;layer-2 protocol. PPP can be used on multiple different layer-1&#xA;interfaces, e.g. serial, ATM, etc. PPP adds some feature that allow you to negotiate layer-3 addressing, data compression, authentication, etc. that do not exist in other layer-2 protocols.&lt;/li&gt;&#xA;&lt;li&gt;Your fourth question doesn't really make much sense. You seem to be&#xA;comparing apples to oranges. PPP is a layer-2 protocol, but PPTP&#xA;basically allows you to extend a LAN on top of other protocols. As&#xA;you wrote, it is above layer-4, and the layer-2 protocol used when&#xA;using PPTP could be PPP. Unfortunately protocols above layer-4 are&#xA;explicitly off-topic here.&lt;/li&gt;&#xA;&lt;li&gt;PPP frames are not wrapped in IP packets. It is the other way&#xA;around; IP packets can be wrapped in PPP (or other layer-2 protocol)&#xA;frames. Neither layer-2 nor layer-3 know anything about ports, which&#xA;are layer-4 addresses for some layer-4 protocols. Routers strip off&#xA;layer-2 frames from the layer-3 packets, so the router on the other&#xA;end of the PPP link will strip off the PPP frame. A router will then&#xA;route the layer-3 packet, and it will create a new frame for the new&#xA;interface for the packet. By the time the packet gets to a server,&#xA;the PPP frame will be long gone. The server will have a network&#xA;stack through which the frame it receives passes. When it gets to&#xA;TCP at layer-4, then it will have the port used, and it will know to&#xA;which process in the server it should send the TCP segment.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-16T18:27:31.500" LastActivityDate="2017-01-16T18:27:31.500" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38111" PostTypeId="2" ParentId="38093" CreationDate="2017-01-16T18:32:45.650" Score="1" Body="&lt;p&gt;Routers don't &quot;ask&quot; each other about routes when deciding where to send a packet. The routes a router knows about are determined in advance, either statically or by routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To reduce the size of routing tables summarisation techniques are employed. Within your site you need routes for each of your subnets. Ideally your ISP only needs a route for your site as a whole and the internet only needs a route for your ISP as a whole.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In reality things are messier than that. Sites and ISPs will grow and therefore end up with multiple IP blocks that cannot be aggregated. This is especially a problem with IPv4 due to address shortages and the resulting tight allocation policies. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The extreme case of summarisation is the &quot;default route&quot;. A place where all packets for which no other route is known get sent. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some routers have no default route. They have an explicit routing table built over BGP that covers the whole internet. This is a big table (over half a million routes) which needs a beefy router to handle. This would be the normal setup in the &quot;core network&quot; of a provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other routers will only have local routes and a default gateway. Any traffic heading towards other providers will be sent to the default route. This would be the normal setup in the &quot;access network&quot; of a provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And of course there are possibilities in-between. For example a smaller ISP using older routers that can no longer handle the whole internet routing table may choose to pull in only part of the internet routing table and use a default route to a transit provider to handle the rest.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-16T18:32:45.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38118" PostTypeId="2" ParentId="38107" CreationDate="2017-01-16T22:19:39.913" Score="2" Body="&lt;p&gt;Doubleclick is an ad service for websites. What you are seeing is someone who went to a web site that had doubleclick ads. Web browsers will open multiple connections when viewing a web site in order to download multiple parts of a web page simultaneously.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-16T22:29:10.540" LastActivityDate="2017-01-16T22:29:10.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38119" PostTypeId="1" AcceptedAnswerId="38168" CreationDate="2017-01-16T22:56:57.967" Score="3" ViewCount="2090" Body="&lt;p&gt;I was reading juniper MX sercies specifications. I saw DPC (Dense Port Concentrator) and MPC (Modular Port Concentrator). What are those ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I googles I saw this on Juniper website&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A Dense Port Concentrator (DPC) is optimized for Ethernet density&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no simple what it this or that....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would you explain me that ?&lt;/p&gt;&#xA;" OwnerUserId="33600" LastActivityDate="2017-01-18T05:57:08.627" Title="What are Juniper DPC and MPC?" Tags="|juniper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38120" PostTypeId="1" CreationDate="2017-01-16T23:05:18.647" Score="1" ViewCount="3464" Body="&lt;p&gt;First of all devices:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;HP ProCurve Switch 2610-24-PWR&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Cisco IP Phone 8811&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;PC&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm receiving loads of logs like these:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I 01/16/17 23:58:39 ports: port 20 is Blocked by STP&#xA;I 01/16/17 23:58:39 ports: port 20 is now on-line&#xA;I 01/16/17 23:58:54 ports: port 20 is now off-line&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These logs are occurring every minute of every hour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a problem with cable or IP Phone considered as a switch? Or maybe something else? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="33599" LastEditorUserId="8499" LastEditDate="2017-01-17T02:54:57.450" LastActivityDate="2017-09-15T10:48:50.150" Title="STP port flapping" Tags="|spanning-tree|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38121" PostTypeId="2" ParentId="38093" CreationDate="2017-01-16T23:07:04.370" Score="0" Body="&lt;p&gt;You are inter mingling IP routing and Ethernet switching.  In terms of routing, it's pretty simple: If a route to the &lt;em&gt;packets&lt;/em&gt; destination exists, forward the &lt;em&gt;packet&lt;/em&gt;; else don't.  If multiple destinations exist choose the most specific one; if more than one most specific, choose based on other factors (administrative distance).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-16T23:07:04.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38122" PostTypeId="2" ParentId="38120" CreationDate="2017-01-16T23:10:19.107" Score="0" Body="&lt;p&gt;An IP phone through which you connect a PC is a switch. Depending on how you have things configured, you will either trunk VoIP and data VLANs to the phone (recommended), or you will have a single VLAN for both VoIP and data (not recommended). In either case, the phone has an integrated switch to allow the PC to communicate with the rest of the network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-16T23:10:19.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38123" PostTypeId="1" AcceptedAnswerId="38125" CreationDate="2017-01-16T23:28:49.107" Score="1" ViewCount="325" Body="&lt;p&gt;In my simulation platform, I noticed three new parameters to me:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Hierarchical Token Bucket (TBF scheduling).&lt;/li&gt;&#xA;&lt;li&gt;Explicit Congestion Notification (ECN)&lt;/li&gt;&#xA;&lt;li&gt;Random Early Detection (RED)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When I googled them, I roughly understood them as: &lt;strong&gt;2&lt;/strong&gt; and &lt;strong&gt;3&lt;/strong&gt; are primarily used for congestion control while &lt;strong&gt;1&lt;/strong&gt; is used for queue scheduling. In this case, would it be reasonable to enable TBF with RED or ECN in my simulation's routers and switches? Would that make sense?&lt;/p&gt;&#xA;" OwnerUserId="19107" LastActivityDate="2017-01-16T23:35:59.430" Title="How to choose the right congestion control algorithm" Tags="|cisco|congestion|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38124" PostTypeId="1" AcceptedAnswerId="38126" CreationDate="2017-01-16T23:35:12.900" Score="1" ViewCount="3428" Body="&lt;p&gt;Is there a way to interconnect VLANs using this diagram?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MLS0 has this configuration: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And SW0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport access vlan 175&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/3&#xA; switchport access vlan 176&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/4&#xA; switchport mode trunk`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DqrPa.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DqrPa.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33602" LastEditorUserId="8499" LastEditDate="2018-12-25T03:30:04.257" LastActivityDate="2021-01-10T08:31:27.293" Title="Inter VLAN with layer 2 and 3 switch" Tags="|cisco|routing|switch|vlan|layer3|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38125" PostTypeId="2" ParentId="38123" CreationDate="2017-01-16T23:35:59.430" Score="0" Body="&lt;p&gt;Each of those three things does something very different.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Token buckets can be used for shaping. That is, bandwidth assignment&#xA;for various protocols or interfaces.&lt;/li&gt;&#xA;&lt;li&gt;ECN is used by TCP to inform the hosts about network congestion.&lt;/li&gt;&#xA;&lt;li&gt;RED is used to prevent queues from filling up by randomly dropping&#xA;queued packets. Full queues lead to tail-drop, and this can cause&#xA;multiple TCP flows to become globally synchronized, simultaneously&#xA;shrinking and expanding their windows, alternately starving and&#xA;filling queues.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;All three could be used at the same time because they do very different things.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-16T23:35:59.430" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38126" PostTypeId="2" ParentId="38124" CreationDate="2017-01-16T23:45:27.300" Score="2" Body="&lt;p&gt;To get traffic from one VLAN to another VLAN, you need to use a router. The layer-3 switch could be used as a router. The hosts connected to each VLAN would use the SVI on the layer-3 switch for it VLAN as the gateway.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;!&#xA;interface Vlan175&#xA; ip address 10.175.0.1 255.255.255.0&#xA; no shutdown&#xA;!&#xA;interface Vland176&#xA; ip address 10.176.0.1 255.255.255.0&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The PCs on VLAN 175 would use &lt;code&gt;10.175.0.1&lt;/code&gt; as their gateway, and the PCs on VLAN 176 would use &lt;code&gt;10.176.0.1&lt;/code&gt; as their gateway.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;With two layer-3 switches (routers) you could use a FHRP (First Hop Redundancy Protocol), e.g. HSRP, to create a virtual gateway that the PCs use as their gateway, and the real routers will decide which is the active gateway, but will automatically fail over in the event of a router failure.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-16T23:45:27.300" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38128" PostTypeId="2" ParentId="34972" CreationDate="2017-01-17T02:25:45.087" Score="2" Body="&lt;p&gt;Without knowing what model the switches are, what is the default MTU on the interfaces? Often they default to 1500, and with the addition of the vlan tag you may be surpassing that. This could certainly manifest itself in the manner you described.  A ping from one of the clients at increasing packet sizes will tell you (it would likely last reply at 1496).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To expound on this, reason this would be an issue now is that the VLAN header adds 4 bytes.  Any decently sized flow (mostly anything consisting of more than a packet or 2) will come from the client and server (and from the Internet) at 1500 bytes. Those packets would then be getting dropped.&lt;/p&gt;&#xA;" OwnerUserId="33604" LastEditorUserId="33604" LastEditDate="2017-01-17T02:41:34.123" LastActivityDate="2017-01-17T02:41:34.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38129" PostTypeId="1" CreationDate="2017-01-17T03:41:01.787" Score="1" ViewCount="382" Body="&lt;p&gt;With Cisco switches you can pick to use one of the three modes: Cut-through, store-and-forward and fragment free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not mentioned is why you would use one of the other or use the higher latency one over just using the lower latency one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, with processing and ram getting faster, wouldn't latency practically be none existent anyway if you were to use store-and-forward for extra reliability? &lt;/p&gt;&#xA;" OwnerUserId="2349" LastActivityDate="2017-01-17T05:04:59.080" Title="Why Switching Modes and when to use one of the other?" Tags="|cisco|switching|switching-modes|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38130" PostTypeId="2" ParentId="38129" CreationDate="2017-01-17T05:04:59.080" Score="2" Body="&lt;p&gt;This is a lot more complex than just a software-selectable forwarding option - and is true not only for Cisco but most other vendors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all - store-and-forward vs cut-through generally &lt;em&gt;isn't&lt;/em&gt; software selectable on most switches.  It's potentially available if the speeds of ingress and egress ports are equivalent but as soon as multiple speeds are involved (say 10G -&gt; 1G, for example) then store-and-forward isn't an option but rather a basic necessity.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The entire premise of cut-through is that the switch doesn't need to wait for the entire frame to arrive but rather as soon as the destination of the frame is determined (..within the first few dozen bytes received) the frame is immediately copied to the output port.  This is to say that the output port is transmitting while the receive port is still receiving.  In the case of a mismatch of speeds this literally isn't possible, as the bits arriving on a 1G port aren't clocked quickly enough to be pushed out at 10G (and, similarly, need to be buffered in the other direction).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast, store-and-forward means that a given switch needs to receive the entire frame before it's transmitted.  This necessarily means that each switch incurs enough time for the frame to be de-serialized, processed and re-serialized.  It also means that packets with errors can be dropped and other kinds of processing can be achieved.  There are actually some other wins in this kind of approach as far as prioritization and certain kinds of fancy forwarding are concerned.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know fragment-free refers to.  There isn't really a notion of fragmentation in L2 switching.  I've heard of various mechanisms of memory management concerned with fragmentation management but it's not directly applicable to the traditional s-and-f vs cut-through discussion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To your last question - the lowest-latency switches out there tend to run fairly light buffers and fully symmetrical bandwidth which allows for the box to have as little processing (read: latency) as possible.  This is true for both the Ethernet world as well as Infiniband.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is that maps pretty well to the spines of spine-and-leaf designs but starts to break down when applied to the traditional requirements of actual at-scale networks in the real-world (read: 2-3 orders of bandwidth, ranging from 100M/1G/10G/25G at the edge to 10G/40G/50G at aggregation and 40/50/100G at the core).  Put another way - good for spines, bad for leaves, worse for traditional networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The performance of store-and-forward &lt;strong&gt;is&lt;/strong&gt; absolutely improving and the truth is that some switches can actually operate in a hybrid mode but store-and-forward is still pretty much overwhelmingly common.  Faster memory and advances in bus design have absolutely contributed to this improvement but it's important to note that many of these improvements asymptotic and are tied to improvements in IC fabrication scale and, ultimately, physics (thus the oft-promised push for silicon photonics).&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-17T05:04:59.080" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38131" PostTypeId="1" CreationDate="2017-01-17T06:55:34.097" Score="4" ViewCount="1376" Body="&lt;p&gt;my topology along with IP and config:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/ZabWm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZabWm.png&quot; alt=&quot;SS topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I do:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A. Normal tracert.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With everything on/&lt;code&gt;no shutdown&lt;/code&gt;, I do &lt;code&gt;tracert&lt;/code&gt; from &lt;code&gt;PC0&lt;/code&gt;|&lt;code&gt;192.168.1.2&lt;/code&gt; to &lt;code&gt;PC1&lt;/code&gt;|&lt;code&gt;172.16.1.2&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;tracert 172.16.1.2&#xA;&#xA;Tracing route to 172.16.1.2 over a maximum of 30 hops: &#xA;&#xA;  1   0 ms      0 ms      0 ms      192.168.1.1&#xA;  2   0 ms      0 ms      0 ms      10.10.10.2&#xA;  3   1 ms      1 ms      0 ms      172.16.1.2&#xA;&#xA;Trace complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's okay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;B. Shutdown &lt;code&gt;g0/0&lt;/code&gt; in &lt;code&gt;router0&lt;/code&gt;, and do &lt;code&gt;tracert&lt;/code&gt;.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shutdown interface &lt;code&gt;g0/0&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router0&amp;gt;en&#xA;router0#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;router0(config)#int g0/0&#xA;router0(config-if)#shut&#xA;&#xA;router0(config-if)#&#xA;%LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to administratively down&#xA;&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to down&#xA;&#xA;02:40:32: %OSPF-5-ADJCHG: Process 10, Nbr 172.16.1.1 on GigabitEthernet0/0 from FULL to DOWN, Neighbor Down: Interface down or detached&#xA;&#xA;router0(config-if)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tracert&lt;/code&gt; from &lt;code&gt;PC0&lt;/code&gt;|&lt;code&gt;192.168.1.2&lt;/code&gt; to &lt;code&gt;PC1&lt;/code&gt;|&lt;code&gt;172.16.1.2&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;tracert 172.16.1.2&#xA;&#xA;Tracing route to 172.16.1.2 over a maximum of 30 hops: &#xA;&#xA;  1   0 ms      0 ms      0 ms      192.168.1.1&#xA;  2   0 ms      *         0 ms      192.168.1.1&#xA;  3   *         0 ms      *         Request timed out.&#xA;  4   0 ms      *         0 ms      192.168.1.1&#xA;  5   *         3 ms      *         Request timed out.&#xA;  6   0 ms      *         0 ms      192.168.1.1&#xA;  7   *         0 ms      *         Request timed out.&#xA;  8   0 ms      *         0 ms      192.168.1.1&#xA;  9   *         0 ms      *         Request timed out.&#xA;  10   0 ms      *         0 ms      192.168.1.1&#xA;Control-C&#xA;^C&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It fails no matter how long I wait.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C. Turn on &lt;code&gt;g0/0&lt;/code&gt; in &lt;code&gt;router0&lt;/code&gt; again, and do &lt;code&gt;tracert&lt;/code&gt;.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Turn on &lt;code&gt;g0/0&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router0(config-if)#no shut&#xA;&#xA;router0(config-if)#&#xA;%LINK-5-CHANGED: Interface GigabitEthernet0/0, changed state to up&#xA;&#xA;%LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/0, changed state to up&#xA;&#xA;router0(config-if)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tracert&lt;/code&gt; from &lt;code&gt;PC0&lt;/code&gt;|&lt;code&gt;192.168.1.2&lt;/code&gt; to &lt;code&gt;PC1&lt;/code&gt;|&lt;code&gt;172.16.1.2&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;tracert 172.16.1.2&#xA;&#xA;Tracing route to 172.16.1.2 over a maximum of 30 hops: &#xA;&#xA;  1   1 ms      0 ms      0 ms      192.168.1.1&#xA;  2   1 ms      0 ms      32 ms     10.10.11.2&#xA;  3   1 ms      1 ms      3 ms      10.10.12.1&#xA;  4   2 ms      1 ms      1 ms      172.16.1.2&#xA;&#xA;Trace complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It finally changes the route to &lt;code&gt;10.10.11.2&lt;/code&gt; and &lt;code&gt;10.10.12.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;after a while in &lt;code&gt;router0&lt;/code&gt; appear text:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;02:53:30: %OSPF-5-ADJCHG: Process 10, Nbr 172.16.1.1 on GigabitEthernet0/0 from LOADING to FULL, Loading Done&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So when I do &lt;code&gt;tracert&lt;/code&gt; again, it backs to the original route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;tracert 172.16.1.2&#xA;&#xA;Tracing route to 172.16.1.2 over a maximum of 30 hops: &#xA;&#xA;  1   8 ms      0 ms      0 ms      192.168.1.1&#xA;  2   1 ms      0 ms      1 ms      10.10.10.2&#xA;  3   0 ms      0 ms      13 ms     172.16.1.2&#xA;&#xA;Trace complete.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it supposed to be normal?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I make &lt;code&gt;PC0&lt;/code&gt; can &lt;code&gt;ping&lt;/code&gt;/&lt;code&gt;tracert&lt;/code&gt; to &lt;code&gt;PC1&lt;/code&gt; when the &lt;code&gt;g0/0&lt;/code&gt; in &lt;code&gt;router0&lt;/code&gt; state is &lt;code&gt;shutdown&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in case you need to see the &lt;a href=&quot;https://drive.google.com/open?id=0BzxeBLxTvFKBcDgzTmc2UTV6U0E&quot; rel=&quot;nofollow noreferrer&quot;&gt;config &amp;amp; pkt files&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;router0&lt;/code&gt; config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 15.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname router0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO1941/K9 sn FTX15244356&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 10.10.10.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.1.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 10.10.11.1 255.255.255.0&#xA;!&#xA;interface Serial0/0/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 10&#xA; log-adjacency-changes&#xA; network 10.10.10.0 0.0.0.255 area 0&#xA; network 10.10.11.0 0.0.0.255 area 0&#xA; network 192.168.1.0 0.0.0.255 area 0&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;router1&lt;/code&gt; config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 15.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname router1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO1941/K9 sn FTX15243RGR&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 10.10.10.2 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 172.16.1.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0/0&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 10.10.12.1 255.255.255.0&#xA; clock rate 64000&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 10&#xA; log-adjacency-changes&#xA; network 10.10.12.0 0.0.0.255 area 0&#xA; network 10.10.10.0 0.0.0.255 area 0&#xA; network 172.16.1.0 0.0.0.255 area 0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;router2&lt;/code&gt; config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;version 15.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname router2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO1941/K9 sn FTX15249JA2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 10.10.11.2 255.255.255.0&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 10.10.12.2 255.255.255.0&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 10&#xA; log-adjacency-changes&#xA; network 10.10.12.0 0.0.0.255 area 0&#xA; network 10.10.11.0 0.0.0.255 area 0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33605" LastEditorUserId="33605" LastEditDate="2017-01-17T09:56:38.277" LastActivityDate="2018-07-11T17:06:15.960" Title="OSPF doesn't work when one interface is shutdown" Tags="|cisco|router|ospf|packet-tracer|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38132" PostTypeId="1" AcceptedAnswerId="38134" CreationDate="2017-01-17T07:16:56.360" Score="0" ViewCount="2413" Body="&lt;p&gt;I have a network with three AP's, a server and a router.&#xA;where should i set up the DHCP server? On the router or on the server?&lt;/p&gt;&#xA;" OwnerUserId="33607" LastEditorUserId="-1" LastEditDate="2017-01-18T19:52:53.183" LastActivityDate="2017-01-18T19:52:53.183" Title="What is best for DHCP server?" Tags="|dhcp|" AnswerCount="1" CommentCount="1" ClosedDate="2017-01-17T14:11:17.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="38133" PostTypeId="1" CreationDate="2017-01-17T07:43:49.843" Score="1" ViewCount="73" Body="&lt;p&gt;With the passage of time we have come to a stage where we are surrounded by various devices using WiFi as a medium of connectivity. But there is a problem, i.e. we can connect to only one WiFi device using our current WiFi radio at any given moment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a workaround for that? And why is that limitation with this?&lt;/p&gt;&#xA;" OwnerUserId="33609" LastEditorUserId="33" LastEditDate="2017-01-19T04:20:49.880" LastActivityDate="2017-01-19T04:20:49.880" Title="Why don't WiFi allows user to connect to multiple devices using same radio?" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38134" PostTypeId="2" ParentId="38132" CreationDate="2017-01-17T07:53:34.157" Score="1" Body="&lt;p&gt;I think the router will be more convenient for you. &lt;br&gt;&#xA;Because you may use your server in other needs.&lt;/p&gt;&#xA;" OwnerUserId="23552" LastActivityDate="2017-01-17T07:53:34.157" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38137" PostTypeId="2" ParentId="38090" CreationDate="2017-01-17T08:22:20.207" Score="3" Body="&lt;p&gt;Switch B's root port will be G0/1. This is because the cost for each link is not what speed the port is capable of running, but the speed it is actually running. In this scenario, the link between Switch C and Switch D has a cost of 19, because the Gigabit port on Switch D will negotiate down to 100Mbps, not stay at 1Gbps. The link between Switch B and Switch D will have a cost of 4 because it will negotiate to 1Gbps. From Switch B's perspective, G0/2 has a root path cost of 38 while G0/1 will have a root path cost of 23.&lt;/p&gt;&#xA;" OwnerUserId="33610" LastActivityDate="2017-01-17T08:22:20.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38140" PostTypeId="1" AcceptedAnswerId="38154" CreationDate="2017-01-17T10:56:45.697" Score="2" ViewCount="63" Body="&lt;p&gt;Not sure if this is is the right place to ask, but i will still go ahead.I have been reading up on Cisco's VMS solution and i see that the main stress is laid on the fact that things which were done using dedicated ASICs(burnt-in hardware into the box for dedicated application), can now be performed using software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1:How can a software ever do a piece of work that a hardware initially did?A software is nothing but a piece of code. I fail to understand how it works. Can you please give a real life example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:Assuming the software can do the job of a hardware, how would it make that better? Is it because of --ease of update, ease of management and ease of shipping?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please clarify.&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2017-01-17T11:04:40.543" LastActivityDate="2017-01-17T18:55:26.917" Title="Regarding Virtual Managed Services Solution vs Traditional Hardware approach" Tags="|cisco|virtual|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38144" PostTypeId="2" ParentId="38133" CreationDate="2017-01-17T14:08:11.630" Score="1" Body="&lt;p&gt;The CSMA/CA algorithm requires the AP to &quot;coordinate&quot; all the clients.  If clients talked with other APs or with each other, it would be impossible to prevent interference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore, the assumption is that your client is using Wi-Fi as an access layer technology to connect to a larger network.  Why would you need to connect to more than one? &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-17T14:08:11.630" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38145" PostTypeId="1" AcceptedAnswerId="38149" CreationDate="2017-01-17T16:12:19.890" Score="2" ViewCount="1397" Body="&lt;p&gt;I am confused about the need of IKE Phase 1. As far as I understand, IKE uses 2 phases, first one is to exchange parameters, such as encryption, authentication method, hashing type and so on. It creates a SA for IPSec to exchange it's parameters in Phase 2. Why can't the IPSec create SA using DH, exchange parameters and then use the same SA for data?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From my understanding, IPSec SAs still exchange keys using DH during their lifetime when they need to create a new key, so why do it all inside another SA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="16890" LastActivityDate="2017-01-17T16:52:09.010" Title="Why is IKE needed for IPSec VPN?" Tags="|ipsec|ike|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38146" PostTypeId="1" CreationDate="2017-01-17T16:26:01.463" Score="2" ViewCount="939" Body="&lt;p&gt;We have recently gotten DDoS attacked and we found in NetFlow around 30 ro 40 source IP addresses are attacking us and filling our pipe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to prevent DDoS we have null routed the destination (target IP) and it mitigated the attack; but, it was big service outage when you do destination &lt;code&gt;D/RTBH&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We talked to ISP to support &lt;code&gt;S/RTBH&lt;/code&gt; so we can block source (attacker) IP address instead of destination but ISP reply was they doesn't support &lt;code&gt;S/RTBH&lt;/code&gt;. Just wondering why? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if I block any source in &lt;code&gt;S/RTBH&lt;/code&gt; and that source null route will push out to BGP routing table but does that mean from that source will block for other customers to whoever is on that ISP? I thought it should be like if destination X and source is Y then block but if only source is specified then it will be blocked for all other customer who are on that ISP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that true? &lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="453" LastEditDate="2017-09-15T02:44:19.497" LastActivityDate="2018-02-12T07:38:05.770" Title="How does S/RTBH work in BGP?" Tags="|cisco|bgp|security|isp|network|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38147" PostTypeId="1" CreationDate="2017-01-17T16:30:01.987" Score="3" ViewCount="10488" Body="&lt;p&gt;I manage a small network, and use Meraki devices to run it. Those of us who resolve www.google.com to 172.217.5.238 are able to access Google, Gmail, etc. However, those of us who resolve www.google.com to 172.217.5.228 are not able to access Google, Gmail, etc. Their access is being blocked by Meraki. I don't want Meraki to block Google.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ curl -v www.google.com&#xA;* Rebuilt URL to: www.google.com/&#xA;*   Trying 172.217.5.228...&#xA;* Connected to www.google.com (172.217.5.228) port 80 (#0)&#xA;&amp;gt; GET / HTTP/1.1&#xA;&amp;gt; Host: www.google.com&#xA;&amp;gt; User-Agent: curl/7.43.0&#xA;&amp;gt; Accept: */*&#xA;&amp;gt;&#xA;&amp;lt; HTTP/1.1 302 Found&#xA;&amp;lt; Location: http://wired.meraki.com:8090/blocked.cgi?blocked_server=172.217.5.228:80&amp;amp;blocked_url=http%3A%2F%2Fwww.google.com%2F&amp;amp;blocked_categories=bc_057&#xA;&amp;lt; Content-Type: text/html&#xA;&amp;lt; Content-Length: 216&#xA;&amp;lt; Cache-Control: no-cache&#xA;&amp;lt; Content-Type: text/html&#xA;&amp;lt; Pragma: no-cache&#xA;&amp;lt; Expires: 0&#xA;&amp;lt; Continue: close&#xA;&amp;lt;&#xA;&amp;lt;html&amp;gt;&amp;lt;body&amp;gt;You are being &amp;lt;a href='http://wired.meraki.com:8090/blocked.cgi?blocked_server=172.217.5.228:80&amp;amp;amp;blocked_url=http%3A%2F%2Fwww.google.com%2F&amp;amp;amp;blocked_categories=bc_057'&amp;gt;redirected&amp;lt;/a&amp;gt;.&amp;lt;/body&amp;gt;&amp;lt;/html&amp;gt;&#xA;* Connection #0 to host www.google.com left intact&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I caution you that I am &lt;em&gt;not&lt;/em&gt; a network engineer, and I don't play one on TV either.&lt;/p&gt;&#xA;" OwnerUserId="33622" LastActivityDate="2018-03-26T17:15:12.667" Title="Meraki blocking some of Google (and this is undesired)" Tags="|meraki|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38148" PostTypeId="2" ParentId="38146" CreationDate="2017-01-17T16:36:01.480" Score="1" Body="&lt;p&gt;Your ISP is likely just blackholing prefixes in BGP. Routing protocols don't look at the source address of traffic. It is a pretty simple matter to route traffic with a certain destination to the &lt;code&gt;null0&lt;/code&gt; interface, but it is much more complicated to do policy routing based on the source address, and it takes considerable router resources, and the ISP router(s) to which you are connected may be used for multiple customers, affecting them, even if they are not needing traffic from any of those addresses by simply slowing the router(s) to a crawl. Add to that the fact that a DDoS is using many sources, and the sources are subject to change without notice, and the ISP has decided that offering &lt;code&gt;S/RTBH&lt;/code&gt; is simply not worth it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-17T16:36:01.480" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38149" PostTypeId="2" ParentId="38145" CreationDate="2017-01-17T16:52:09.010" Score="3" Body="&lt;p&gt;Simply because IPsec was not built to initially include a Key Exchange. In fact, early implementations of IPsec expected you to manually configure an IPsec Key, from which Encryption and Authentication keys were derived.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it was determined manually setting and rotating keys would not scale, they looked to find another solution, but one that didn't involve re-writing every IPsec implementation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now, you have the ability to manually configure IPsec keys (archaic, no one does this anymore, neither should you), &lt;em&gt;or&lt;/em&gt; you can use ISAKMP to auto-magically provide keys to IPsec.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISAKMP (Internet Security Association and &lt;em&gt;Key Management&lt;/em&gt; Protocol) exists for the purpose of securely establishing keying material, over an insecure medium (&lt;em&gt;Internet&lt;/em&gt;), for IPsec to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that is not all ISAKMP does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPsec &lt;em&gt;also&lt;/em&gt; wasn't written with a direct &lt;a href=&quot;http://www.practicalnetworking.net/series/cryptography/authentication/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Authentication&lt;/a&gt; method -- verifying the other end is who they say they are. The initial idea was if both parties manually configured an IPsec key, and both parties manually configured &lt;em&gt;the same&lt;/em&gt; session key, then clearly if they reproduced that key they are indeed who they think they are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if those same IPsec keys are being auto-magically determined across the Internet, then there needs to be a way of first validating the other party you are securely exchanging keys with is who they say they are. Which is the other part of what ISAKMP does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, ISAKMP (Phase1) is primarily responsible for validating the other party (securely), and generating keys for IPsec to use.  Then IPsec is primarily responsible for securely transferring data. What ties both of these protocols together, is the Internet Key Exchange, or IKE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are more details in a &lt;a href=&quot;https://www.reddit.com/r/networking/comments/5kp9ps/why_is_secure_tunnel_established_in_ike_phase_1/dbpmojn/&quot; rel=&quot;nofollow noreferrer&quot;&gt;write up I made over on Reddit&lt;/a&gt; when someone asked &lt;em&gt;&quot;Why is secure tunnel established in ike phase 1 not used for data transmission?&quot;&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2017-01-17T16:52:09.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38154" PostTypeId="2" ParentId="38140" CreationDate="2017-01-17T18:55:26.917" Score="3" Body="&lt;p&gt;So the &lt;em&gt;functional&lt;/em&gt; distinction between hardware and software is actually a lot less than you might think.  Most - if not all - switching and routing functions are first specified, implemented and debugged in software implementations long before they're adapted to run on a piece of dedicated silicon.  This is, of course, because the process of changing, fixing and debugging software is cheap and easy while doing the same in hardware for dedicated ASIC can literally cost many, many millions of dollars and take months/years to accomplish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example - it's absolutely possible to take a standard PC running a fairly standard OS (Linux is the most common nowadays but hardly the only one capable) with a bunch of NIC's and run software to bridge and route packets.  You can use a bunch of crossover cables to hook up end stations and then connect an additional port to an ISP, turn up NAT and - surprise - you have a complete LAN and WAN solution without having purchased a single piece of dedicated hardware.  Heck, throw in a wireless interface or two and have it run as an AP to hook up wireless clients.  Turn up firewalls, QoS, VOIP, etc.  Seriously - just about anything function you can turn up on a dedicated piece of network hardware can run on a general purpose PC running a mostly stock operating system.  Heck, arguably there are things you can do on these platforms that would be tough to achieve on dedicated hardware!  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the thing, though - the solution I just described above is going to be orders of magnitude slower and generally substantially more expensive (on a unit basis) than dedicated hardware.  It's also going to lack a ton of supportability.  Ethernet switches are cheap and fast and if you're trying to solve the problem of physically connecting machines then they're superior in almost every way.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Things start to get muddier when you move to situations where density and performance requirements aren't as stringent.  An example of this would be the use of virtual firewalls, load balancers and routers in a virtualized/cloud environment.  Increasingly the major vendors are making their products available as software-only offerings.  As an example a Cisco CSR (same IOS-XE software as the hardware-based ASR1000) can be spun up quickly in a cloud environment (AWS, GCE or local virtualization) to provide VPN termination, full routing integration and the like.  It's literally an order of magnitude slower than the hardware ASR but that still means it can move gigabits of traffic - which, honestly, is more than sufficient for its intended use-cases.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember that the concept in these environments is to scale &lt;em&gt;out&lt;/em&gt; rather than scaling &lt;em&gt;up&lt;/em&gt; - so deploying 5-10 slower virtual instances in parallel is more useful than buying a huge piece of dedicated hardware.  The key here is to retain all the function and &lt;em&gt;enough&lt;/em&gt; performance while gaining the capability to quickly spin new virtual devices up- and down- as needed while still retaining full commercial support.  This is the way in which a lot of folks want to consume the offerings of the big networking vendors and, as such, it's increasingly an option these vendors are providing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now - as to VMS?  It's basically reiterating the above - taking the services you'd traditionally get out of purchased pieces of hardware (specifically including aggregation routers, firewalls, load balancers, IDS, etc) and running it as a service.  Behind the scenes it may be some combination of hardware and software but to the end consumer it's a pre-integrated, well-managed solution that can be bought as a subscription.  The customer might still want to buy dedicated hardware at the edge of the network but, again, it's at least &lt;em&gt;technically&lt;/em&gt; possible to accomplish a full end-to-end network using virtual routers running as clients on a hypervisor.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-17T18:55:26.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38156" PostTypeId="1" CreationDate="2017-01-17T20:34:21.510" Score="0" ViewCount="118" Body="&lt;p&gt;Some providers employ BGP anycast for their NS servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a user, when doing a traceroute, many may show an identical location for both servers, for a given client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When he.net used to anycast their DNS from different locations for a client in Europe, and one of their POPs went bust for a few hours, the &lt;code&gt;ns&lt;/code&gt; server from that pop was unavailable for a number of minutes, prior to being taken over by another POP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, doesn't it take a certain number of seconds (or even minutes?) in BGP for the takeover to take place?  Does it mean that if a provider is always routing all NS to a single location, then at any time, such setup would be completely cut-off from certain clients for some number of seconds should a certain POP go bust?&lt;/p&gt;&#xA;" OwnerUserId="296" LastEditorUserId="8499" LastEditDate="2018-02-15T05:23:42.927" LastActivityDate="2018-02-15T05:23:42.927" Title="Is DNS geo-redundant if my traceroute to each NS shows the same location?" Tags="|routing|bgp|dns|anycast|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38158" PostTypeId="2" ParentId="38156" CreationDate="2017-01-17T21:36:50.843" Score="2" Body="&lt;p&gt;It's hard to know.  The issue is that the anycast route needs to be provisioned in such a way as to not get lost behind a summary route or otherwise held up such that a retraction is actually seen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other issue is how the carrier has linked the health of the service to the route advertisement.  So - for example - if the /24 where the DNS server lives continues to be advertised whether the server is live or not (hopefully this isn't the case) then all manner of failures can occur without even an attempt at restoration.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMO the ideal design should be advertising the route conditional on the proper return of a synthetic transaction and that said route should be a valid/non-summarized /24 (i.e. fully accepted by all carriers) but there's no guarantee that this would be the case.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-17T21:36:50.843" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38159" PostTypeId="1" CreationDate="2017-01-17T21:50:09.803" Score="1" ViewCount="125" Body="&lt;p&gt;I have been tasked to build a network on PT which involves 4 subnets and they are all connected via one router using serial cables any ideas on how i can do it. That one router is acting as the internet in this case.&lt;/p&gt;&#xA;" OwnerUserId="33629" LastActivityDate="2021-01-10T10:08:38.047" Title="Packet tracer networks" Tags="|routing|packet-tracer|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38162" PostTypeId="1" AcceptedAnswerId="38163" CreationDate="2017-01-18T03:49:16.697" Score="2" ViewCount="607" Body="&lt;p&gt;We have BGP running over &lt;code&gt;default&lt;/code&gt; route for &lt;code&gt;x.x.x.x/24&lt;/code&gt; subnet, but yesterday after talking to ISP they said if you want to send traffic over to their specific &lt;code&gt;peer&lt;/code&gt; ISP then you need to use &lt;code&gt;65000:170&lt;/code&gt; BGP community, How do i set that in my BGP config to advertise specific communities over BGP and does it work for individual IP address or i have to do &lt;code&gt;/24&lt;/code&gt; whole subnet for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;does single IP will work or i need to do &lt;code&gt;255.255.255.0&lt;/code&gt; full subnet?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;access-list 101 permit ip host 1.1.1.1 host 255.255.255.255&#xA;!&#xA;route-map Peer-R1 permit 10&#xA; match ip address 101&#xA; set community 65000:170&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2017-01-18T03:58:09.613" Title="BGP send community for individual IP" Tags="|cisco|routing|bgp|isp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38163" PostTypeId="2" ParentId="38162" CreationDate="2017-01-18T03:51:15.660" Score="3" Body="&lt;p&gt;You need to set the community on any prefixes that you advertise. It is unlikely that you are advertising only a host prefix.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-18T03:51:15.660" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38164" PostTypeId="2" ParentId="38162" CreationDate="2017-01-18T03:58:09.613" Score="4" Body="&lt;p&gt;While technically your access-list can specify any length subnet mask you want, most (good) ISPs will only accept a maximum length of a /24 for prefixes advertised by you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for this is that the global routing table would explode in size (more than it already has) if everyone started advertising /24-/32s.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-01-18T03:58:09.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38165" PostTypeId="2" ParentId="38147" CreationDate="2017-01-18T04:15:22.340" Score="1" Body="&lt;p&gt;Both of those IP addresses resolve to iad30s07-in-f14.1e100.net (using nslookup).  Also, Why would some machines resolve to one while others to the other (unless you have multiple locations, maybe)?  Either way, they're hitting the same box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Curl will misleadingly connect to a RESTful API (a website) while your browser may fail to connect to that same website using the very same method (GET, POST, whatever).  The browser has CORS restrictions that curl doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I'd say you might be experiencing issues with your browsers / endpoints rather than with your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Identify the problem.  Once you do that, you can make some progress.  Good luck.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-18T04:15:22.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38166" PostTypeId="2" ParentId="38156" CreationDate="2017-01-18T04:19:59.263" Score="1" Body="&lt;p&gt;As mxrx mentioned - the length of time it takes to fail over is not a known quantity - it would entirely depend on the health-check mechanism running against the service, and the triggering of the BGP withdrawal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As to serving in different locations - the purpose of anycast in this situation isn't just redundancy, it is also performance.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under normal operating conditions, you would always want your clients to go to the NEAREST PoP, for primary or secondary services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously with something as complex and opaque as Internet routing relationships, &quot;nearest&quot; from a routing perspective doesn't always mean nearest from a latency perspective, but the theory is, clients would always use services from their &quot;nearest&quot; PoPs unless there was an issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DNS is an interesting one though - assuming the primary and secondary name servers you are provided aren't actually the same box in the back-end, then the delay in detecting failure and withdrawing the anycast prefix that covers both servers would need to be shorter than the delay for clients switching to their secondary NS (on no answer from the primary), otherwise clients are going to get no answer from both.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-01-18T04:19:59.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38167" PostTypeId="2" ParentId="38147" CreationDate="2017-01-18T04:32:54.080" Score="2" Body="&lt;p&gt;Based on your output above, this specific site is matching blocked category &lt;code&gt;bc_057&lt;/code&gt;, so something is triggering it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under &lt;code&gt;Security Appliance &amp;gt; Configure &amp;gt; Content Filtering&lt;/code&gt; what is configured?  Check for &lt;code&gt;Web search filtering&lt;/code&gt;, &lt;code&gt;Blocked URL patterns&lt;/code&gt; and &lt;code&gt;Blocked Website Categories&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there is nothing obvious under &lt;code&gt;Content Filtering&lt;/code&gt;, this may be being applied via Group Policy instead (which may explain why it's a problem for some users and not others).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Meraki, group policy config overrides the default configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check under &lt;code&gt;Group Policies&lt;/code&gt; and confirm that no Blocked Website Categories, URL patterns or Web Search filtering is applied here.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-01-18T04:32:54.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38168" PostTypeId="2" ParentId="38119" CreationDate="2017-01-18T05:50:42.610" Score="4" Body="&lt;p&gt;DPCs (Dense Port Concentrators) were the original line cards released for the MX series back around 2006.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They were named so because they were a fixed configuration with high (for the time) port capacity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not long after, MPCs (Modular Port Concentrators) were released, which as the name implies were just a carrier card for MICs (Modular Interface Cards) so you could pick and choose your interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MPCs also used Juniper's Trio ASIC, which gave them much better scale and features than was possible on the older DPCs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These days, MPCs aren't always modular - some only come in fixed form-factor, however the name has stuck and they still all include one or more Trio ASICs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DPCs are all end of life&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="1392" LastEditDate="2017-01-18T05:57:08.627" LastActivityDate="2017-01-18T05:57:08.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38169" PostTypeId="2" ParentId="22493" CreationDate="2017-01-18T08:15:23.740" Score="1" Body="&lt;p&gt;If they restrict scanning to the IP range of the wireless network (highly recommended, you shouldn't have too many issues on your LAN, even if the source of the scan is connected to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each scan would be at worst a TCP connection initiated to each IP in a range - bandwidth-wise this would be trivial.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-01-18T08:15:23.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38171" PostTypeId="1" CreationDate="2017-01-18T09:27:04.640" Score="1" ViewCount="624" Body="&lt;p&gt;I have a switch with 2 SFP port and I want to connect a fiber optic cable to the switch. I need to connect the cable only on one SFP port or on both SFP port?&lt;/p&gt;&#xA;" OwnerUserId="33642" LastEditorUserId="8499" LastEditDate="2018-03-20T23:49:26.147" LastActivityDate="2018-03-20T23:49:26.147" Title="SFP port with fiber optic cable" Tags="|switch|fiber|layer1|cable|sfp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38172" PostTypeId="2" ParentId="38171" CreationDate="2017-01-18T09:32:44.297" Score="2" Body="&lt;p&gt;Each SFP port can host an optical transceiver which has a send and receive port. So you connect one fiberpair to one transceiver. If your switch has room for two transceivers, you need to connect send and receive to one transceiver, and you have room for one more fiber connection.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-01-18T09:32:44.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38173" PostTypeId="1" AcceptedAnswerId="38176" CreationDate="2017-01-18T09:48:58.590" Score="1" ViewCount="157" Body="&lt;p&gt;I have 7 rooms wired with Cat5e. I plan to attach the other end of the cables to a GigaBit switch (Netgear GS108). This leaves one port on the switch. I will attach my router to the remaining port. I will attach my router to my modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: &#xA;Will making the cable between the router and switch and the cable between the router and modem a CAT6, as opposed to CAT 5e, cable make a difference?&lt;/p&gt;&#xA;" OwnerUserId="33641" LastEditorUserId="8499" LastEditDate="2018-03-20T23:27:57.050" LastActivityDate="2018-03-20T23:27:57.050" Title="Will Cat6 make a difference" Tags="|ethernet|layer1|cabling|cable|utp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38176" PostTypeId="2" ParentId="38173" CreationDate="2017-01-18T10:53:39.083" Score="2" Body="&lt;p&gt;Cat5e is fine for Gigabit Ethernet, so no it would not make a difference&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-01-18T10:53:39.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38179" PostTypeId="2" ParentId="38159" CreationDate="2017-01-18T11:55:11.580" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/EfhIC.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/EfhIC.jpg&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;There are a number of ways to do this, this is a rather basic solution &lt;br&gt;&#xA;&lt;br&gt;&#xA;If you want the pt file let me know. Here is a very rough way on how to do it using EIGRP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the configs for the routers:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Net 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;en&#xA;conf t&#xA;Hostname Net_1 &#xA;&#xA;int fa0/0&#xA;ip addr 192.168.1.1 255.255.255.0&#xA;no shut&#xA;&#xA;int s0/0/0&#xA;ip addr 192.168.5.2 255.255.255.252&#xA;no shut&#xA;&#xA;exit&#xA;Router eigrp 1&#xA;no auto-summary&#xA;network 192.168.5.0 0.0.0.3&#xA;network 192.168.1.0 0.0.0.255&#xA;&#xA;end&#xA;wr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Net 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;en&#xA;conf t&#xA;Hostname Net_2&#xA;&#xA;int fa0/0&#xA;ip addr 192.168.2.1 255.255.255.0&#xA;no shut&#xA;&#xA;int s0/0/0&#xA;ip addr 192.168.5.6 255.255.255.252&#xA;no shut&#xA;&#xA;exit&#xA;Router eigrp 1&#xA;no auto-summary&#xA;network 192.168.5.4 0.0.0.3&#xA;network 192.168.2.0 0.0.0.255&#xA;&#xA;end&#xA;wr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Net 3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;en&#xA;conf t&#xA;Hostname Net_3&#xA;&#xA;int fa0/0&#xA;ip addr 192.168.3.1 255.255.255.0&#xA;no shut&#xA;&#xA;int s0/0/0&#xA;ip addr 192.168.5.10 255.255.255.252&#xA;no shut&#xA;&#xA;exit&#xA;Router eigrp 1&#xA;no auto-summary&#xA;network 192.168.5.8 0.0.0.3&#xA;network 192.168.3.0 0.0.0.255&#xA;&#xA;end&#xA;wr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Net 4&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;en&#xA;conf t&#xA;Hostname Net_4&#xA;&#xA;int fa0/0&#xA;ip addr 192.168.4.1 255.255.255.0&#xA;no shut&#xA;&#xA;int s0/0/0&#xA;ip addr 192.168.5.14 255.255.255.252&#xA;no shut&#xA;&#xA;exit&#xA;Router eigrp 1&#xA;no auto-summary&#xA;network 192.168.5.12 0.0.0.3&#xA;network 192.168.4.0 0.0.0.255&#xA;&#xA;end&#xA;wr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Gateway&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;en&#xA;conf t&#xA;Hostname Gateway&#xA;&#xA;Int lo0&#xA;description Internet&#xA;ip addr 89.55.47.33 255.255.255.252&#xA;&#xA;int s0/0/0&#xA;ip addr 192.168.5.1 255.255.255.252&#xA;clock rate 64000&#xA;bandwidth 64&#xA;no shutdown&#xA;&#xA;int s0/0/1&#xA;ip addr 192.168.5.5 255.255.255.252&#xA;clock rate 64000&#xA;bandwidth 64&#xA;no shutdown&#xA;&#xA;int s0/1/0&#xA;ip addr 192.168.5.9 255.255.255.252&#xA;clock rate 64000&#xA;bandwidth 64&#xA;no shutdown&#xA;&#xA;int s0/1/1&#xA;ip addr 192.168.5.13 255.255.255.252&#xA;clock rate 64000&#xA;bandwidth 64&#xA;no shutdown&#xA;&#xA;&#xA;Router eigrp 1&#xA;no auto-summary&#xA;Network 192.168.5.0 0.0.0.3&#xA;Network 192.168.5.4 0.0.0.3&#xA;Network 192.168.5.8 0.0.0.3&#xA;Network 192.168.5.12 0.0.0.3&#xA;redistribute static&#xA;exit&#xA;&#xA;ip route 0.0.0.0 255.255.255.255 Lo0&#xA;&#xA;end&#xA;&#xA;wr&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33647" LastEditorUserId="8499" LastEditDate="2017-01-18T15:02:07.150" LastActivityDate="2017-01-18T15:02:07.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38180" PostTypeId="2" ParentId="28980" CreationDate="2017-01-18T14:03:31.243" Score="0" Body="&lt;p&gt;A DNAT rule is used to change the destination of traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember for NAT to work you must arrange for replies to go back via the NAT. It may be necessary to use SNAT in combination with DNAT to do this.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-18T14:03:31.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38183" PostTypeId="1" AcceptedAnswerId="38188" CreationDate="2017-01-18T14:55:06.780" Score="1" ViewCount="72" Body="&lt;p&gt;I wanted to know if a SPAN port on a switch (which is used to monitor all packets passing through the network) is similar to any other port if a mac flooding attack is performed.&lt;/p&gt;&#xA;" OwnerUserId="33651" LastEditorUserId="8499" LastEditDate="2017-01-18T15:31:31.313" LastActivityDate="2017-01-18T15:31:31.313" Title="Port SPAN similar to MAC flooding?" Tags="|mirror|network|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38187" PostTypeId="2" ParentId="38171" CreationDate="2017-01-18T15:04:39.193" Score="1" Body="&lt;p&gt;One will work, but two can provide redundancy as well as doubling the bandwidth (port channel setup required)&lt;/p&gt;&#xA;" OwnerUserId="33654" LastActivityDate="2017-01-18T15:04:39.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38188" PostTypeId="2" ParentId="38183" CreationDate="2017-01-18T15:16:41.617" Score="0" Body="&lt;p&gt;Not really. A SPAN interface is primarily used as a one-way interface; copied traffic goes out. The monitoring equipment on the SPAN interface has no real need to send any traffic into the switch, so there isn't much, if any, traffic that would be redirected from the SPAN interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-18T15:16:41.617" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38193" PostTypeId="1" CreationDate="2017-01-18T16:59:20.217" Score="1" ViewCount="157" Body="&lt;p&gt;Lets say we send segment A with some data. Sender waits for ACK from receiver but there is timeout and sender send this segment (A) again. After this, sender received delayed ACK segment (B). What is now happening with duplicated data/ack packets?&lt;/p&gt;&#xA;" OwnerUserId="33657" LastEditorUserId="8499" LastEditDate="2017-07-16T03:28:30.280" LastActivityDate="2017-07-16T03:28:30.280" Title="TCP/IP receiving ACK after retransmittion data" Tags="|tcp|ip|layer4|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38196" PostTypeId="1" CreationDate="2017-01-18T18:20:03.373" Score="1" ViewCount="3873" Body="&lt;p&gt;I need a 24 port gigabit ethernet cisco switch with 2 fiber ports in gns3. An example of this switch is the Cisco SGE2000 switch, i found out that the gns3 only provides only their default etherswitch router which only provides fastethernet ports. So can i emulate a switch like cisco SGE2000 in gns3?&lt;/p&gt;&#xA;" OwnerUserId="33660" LastActivityDate="2017-02-17T19:51:37.377" Title="Having 24 gigabit ethernet ports cisco switch in gns3" Tags="|gns3|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38197" PostTypeId="2" ParentId="38196" CreationDate="2017-01-18T18:47:51.733" Score="2" Body="&lt;p&gt;No you can't. It looks like newer versions of GNS3 support IOSvL2 (shipped with &lt;a href=&quot;http://virl.cisco.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco VIRL&lt;/a&gt;) and you now can setup many standard switch features (spanning-tree, LACP, port-security, ...). But this will not be like a standard 24 port switch running IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And BTW: Cisco SMB Switches do not run IOS, they are quite different. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2017-01-18T18:47:51.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38200" PostTypeId="1" AcceptedAnswerId="38203" CreationDate="2017-01-18T20:01:55.160" Score="9" ViewCount="4138" Body="&lt;p&gt;As an LIR, you are getting a /29 to /32 network allocation by the RIPE, but I am a bit overwhelmed by the size of this subnet, and don't find a starting point to split this into common sizes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we need to address with this subnet:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;office workstations&lt;/strong&gt;&#xA;We currently have two offices in (yet) one country. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;office IoT stuff&lt;/strong&gt;&#xA;cameras, phones, tv's, other stuff&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;local office servers&lt;/strong&gt;&#xA;Just a bunch of VM hosts and routes/switches&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;data centers&lt;/strong&gt;&#xA;Currently we have servers in one datacenter. &#xA;There we are hosting several different services:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;shared SaaS applications&lt;/li&gt;&#xA;&lt;li&gt;dedicated servers for individual customers&lt;/li&gt;&#xA;&lt;li&gt;shared web hosting&lt;/li&gt;&#xA;&lt;li&gt;internal service&lt;/li&gt;&#xA;&lt;li&gt;a bunch of routes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My problem is that I don't have a idea how big subnets I should assign to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;individual host&lt;/li&gt;&#xA;&lt;li&gt;service group (like, workstations, or all hosts of specific product)&lt;/li&gt;&#xA;&lt;li&gt;location&lt;/li&gt;&#xA;&lt;li&gt;county&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33400" LastEditorUserId="8499" LastEditDate="2018-03-09T21:28:17.587" LastActivityDate="2018-03-09T21:28:17.587" Title="What are common sizes to split a /29 - /32 IPv6 subnet?" Tags="|subnet|ipv6|ip-address|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38201" PostTypeId="2" ParentId="38200" CreationDate="2017-01-18T20:30:17.347" Score="4" Body="&lt;p&gt;The good news is that there is a standard IPv6 network size: &lt;code&gt;/64&lt;/code&gt;. You could use other sizes, but there are some features of IPv6 that can break if you use network sizes other than &lt;code&gt;/64&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;The recommendation is to assign a &lt;code&gt;/48&lt;/code&gt;, or shorter, network to a site, and subnet that into &lt;code&gt;/64&lt;/code&gt; networks for each network, even if you have very few devices on a network. Each &lt;code&gt;/48&lt;/code&gt; network can have 65,536 &lt;code&gt;/64&lt;/code&gt; networks. Also, ISPs will not advertise any prefixes longer than &lt;code&gt;/48&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;You should use &lt;code&gt;/128&lt;/code&gt; networks for things like loopback addresses, and &lt;code&gt;/127&lt;/code&gt; networks for point-to-point links. A best practice is to not use any other part of the &lt;code&gt;/64&lt;/code&gt; network from which you use a &lt;code&gt;/127&lt;/code&gt; or &lt;code&gt;/128&lt;/code&gt; network. There are plenty of addresses, so get out of the IPv4 &amp;quot;&lt;em&gt;I must conserve addresses&lt;/em&gt;&amp;quot; mindset.&lt;/p&gt;&#xA;&lt;p&gt;At any given site, you can use IPv6 prefix delegation to assign networks to interfaces.&lt;/p&gt;&#xA;&lt;p&gt;There are actually RFCs about things like this. For example, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6177&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 6177, IPv6 Address Assignment to End Sites&lt;/em&gt;&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7421&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 7421, Analysis of the 64-bit Boundary in IPv6 Addressing&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-01-18T22:32:07.083" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38203" PostTypeId="2" ParentId="38200" CreationDate="2017-01-18T22:28:12.510" Score="19" Body="&lt;p&gt;Some simple guidelines that work most of the time:&lt;/p&gt;&#xA;&lt;h2&gt;Dividing your /29&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The standard size of your allocation from RIPE NCC is a /32&lt;/li&gt;&#xA;&lt;li&gt;A /32 is a well-accepted prefix size in the global routing table&lt;/li&gt;&#xA;&lt;li&gt;You can get a /29 just by asking for it&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Conclusion&lt;/strong&gt;: Get a /29 and start using the a /32, save the other /32s for when you deploy to other countries, continents etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Determining per-site prefix size&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;RIPE allows you to assign up to a /48 per site without having to explain anything. When you assign a shorter prefix (/47, /46 etc) you'll have to explain why you need more than a /48.&lt;/li&gt;&#xA;&lt;li&gt;A /32 contains 65,536 /48s.&lt;/li&gt;&#xA;&lt;li&gt;So no need to give a site anything smaller than a /48 (/49, /50 etc) either.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Conclusion&lt;/strong&gt;: /48 per site&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;Determining LAN prefix size&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The standards say to use a /64.&lt;/li&gt;&#xA;&lt;li&gt;So in your addressing plan always align on /64s&lt;/li&gt;&#xA;&lt;li&gt;Configuring a &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6164&quot; rel=&quot;nofollow noreferrer&quot;&gt;/127 on point-to-point links&lt;/a&gt; is common and can protect you against cache overflows, use &lt;code&gt;x:y:z::a&lt;/code&gt; on one end and &lt;code&gt;x:y:z::b&lt;/code&gt; on the other end for readability.&lt;/li&gt;&#xA;&lt;li&gt;Reserve a /64 for router loopback addresses, anycasted services etc. I usually choose the first /64 from the /48 for this so the addresses are nice and short to write with &lt;code&gt;::&lt;/code&gt; notation. Configure /128 addresses from this /64 on loopback interfaces etc.&lt;/li&gt;&#xA;&lt;li&gt;Don't even think about not using a /64 on a LAN or VLAN, things will break. If not today then very probably in the future.&lt;/li&gt;&#xA;&lt;li&gt;Don't change your LAN/VLAN architecture yet, just assign /64s to each existing LAN/VLAN.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h2&gt;The remaining bits&lt;/h2&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There are still choices to be made:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How to use the bits on country-level between a /32 and a /48?&lt;/li&gt;&#xA;&lt;li&gt;How to use the bits in a site between a /48 and a /64?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;In both places you could just use random numbers between &lt;code&gt;0000&lt;/code&gt; and &lt;code&gt;ffff&lt;/code&gt;, but that would create a mess that is hard to understand and remember, so do something useful with those bits!&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Always split at multiples of 4 bits (nibbles) so your addressing plan structure matches the hexadecimal notation of IPv6 addresses (each character in an IPv6 address represents 4 bits)&lt;/li&gt;&#xA;&lt;li&gt;What to use those bits for depends on your organisation. You might divide the country-level /32 into /36 blocks and use a /36 per province. Or you use a /40 for some structure that is important to your organisational or infrastructure architecture. Or both.&lt;/li&gt;&#xA;&lt;li&gt;The same for the /48:&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Maybe you want to give a /52 to each building on the site and give a /56 to each floor in each building. That works well with prefix aggregation in your routing protocols.&lt;/li&gt;&#xA;&lt;li&gt;Or maybe you want to assign a /52 or /56 to each security zone in your security architecture. That makes maintaining firewall policies and rules a lot easier!&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Whatever you choose to do: keep a balance. Don't just start assigning from 0 up to ffff sequentially without giving any thought to how to organise those numbers, but also don't over-engineer it. If you want to put too much information in the prefixes (building + floor + security zone + function of the server + what brand of server it is + etc etc) then your addressing plan becomes impossible to work with.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;Plug: I wrote a paper on this for SURFnet a couple of years ago. RIPE NCC has translated it to English: &lt;a href=&quot;https://www.ripe.net/support/training/material/IPv6-for-LIRs-Training-Course/Preparing-an-IPv6-Addressing-Plan.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.ripe.net/support/training/material/IPv6-for-LIRs-Training-Course/Preparing-an-IPv6-Addressing-Plan.pdf&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="632" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-01-18T22:28:12.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38207" PostTypeId="2" ParentId="38193" CreationDate="2017-01-19T03:58:01.083" Score="1" Body="&lt;p&gt;In short, nothing.  The connection resumes communicating.  There is no duplicate &lt;em&gt;data&lt;/em&gt;, only a duplicate &lt;em&gt;segment&lt;/em&gt;.  Each segment contains a sequence number that permits the receiver to discard duplicate data and re-order out of order segments so that the receiver sees the data stream as the correct sequence of bytes.&lt;/p&gt;&#xA;" OwnerUserId="33675" LastActivityDate="2017-01-19T03:58:01.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38208" PostTypeId="2" ParentId="38133" CreationDate="2017-01-19T04:15:55.053" Score="-1" Body="&lt;p&gt;There is a mode called &quot;ad-hoc&quot; which doesn't use an AP, but allows nodes to talk directly to each other.  This has been used for mobile networks where topology varies dramatically over short timespans, like seconds.&lt;/p&gt;&#xA;" OwnerUserId="33675" LastActivityDate="2017-01-19T04:15:55.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38210" PostTypeId="1" CreationDate="2017-01-19T07:24:28.843" Score="1" ViewCount="198" Body="&lt;p&gt;How do we define broadcast domains in Dualstack mode(IPV4 &amp;amp; IPV6)?&#xA;I have a layer3 edge device having a vlan with both ipv4 and ipv6 subnet.is broadcast domain changes from ipv4 to ipv6 if these are in same vlan?&lt;/p&gt;&#xA;" OwnerUserId="33680" LastActivityDate="2017-01-19T07:38:09.877" Title="broadcast domains in Dualstack mode(IPV4 &amp; IPV6)" Tags="|ip|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38211" PostTypeId="2" ParentId="38210" CreationDate="2017-01-19T07:38:09.877" Score="1" Body="&lt;p&gt;There is no broadcast in IPv6 - all one-to-many communications are handled via link-local multicast groups.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, if your switch(es) are not configured to snoop this traffic, it will be flooded across all interfaces in the same VLAN regardless.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your question though - these domains are both identical - they both exist amongst all ports within a VLAN.  The only difference would be that if you have your switch configured to snoop, your IPv6 domain will be limited to IPv6 speaking hosts, where as IPv4 broadcasts will be sent to all hosts - even IPv6-only speakers.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-01-19T07:38:09.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38212" PostTypeId="1" CreationDate="2017-01-19T08:09:43.350" Score="1" ViewCount="367" Body="&lt;p&gt;Can we use same VRID (VRRP instance) for both IPv4 and IPv6 virtual router in VRRP or VRRP-E?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a layer-3 router, we have requirement to configure interface VE with both IPv4 and IPv6 gateways with same VRID in VRRP-E.&lt;/p&gt;&#xA;" OwnerUserId="33680" LastEditorUserId="8499" LastEditDate="2018-03-12T00:28:20.203" LastActivityDate="2018-03-12T00:28:20.203" Title="VRRP VRID configuration for IPv6" Tags="|ipv4|ip|ipv6|vrrp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38213" PostTypeId="2" ParentId="119" CreationDate="2017-01-19T08:34:05.880" Score="0" Body="&lt;p&gt;The best way of dividing ipv6 is into /64 subnets.&#xA; because /64 address can be easily mapped to IPV4 manually&lt;/p&gt;&#xA;" OwnerUserId="33680" LastActivityDate="2017-01-19T08:34:05.880" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38214" PostTypeId="1" AcceptedAnswerId="38215" CreationDate="2017-01-19T09:09:08.480" Score="4" ViewCount="1829" Body="&lt;p&gt;I have always wondered what causes an network engineer to pick EIGRP or OSPF over the other. Obviously OSPF is opened standard so can be used in a multi-vendor environment. If all equipment was cisco, what factors would you consider to implement OSPF and which factors would you consider for EIGRP?&lt;/p&gt;&#xA;" OwnerUserId="33647" LastActivityDate="2021-01-10T09:15:09.647" Title="Choosing a routing protocol" Tags="|cisco|routing|ospf|eigrp|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38215" PostTypeId="2" ParentId="38214" CreationDate="2017-01-19T09:41:13.627" Score="4" Body="&lt;p&gt;To choose a routing protocol you should consider these topics:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Configuration&lt;/strong&gt;: How easy is to configure and troubleshoot the protocol.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Efficiency&lt;/strong&gt;: How fast it converges? How much bandwith it uses?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Size and topology&lt;/strong&gt;: Is the network a star? partial mesh? full mesh?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I recommend you to read this &lt;a href=&quot;http://www.networkworld.com/article/2347622/cisco-subnet/eigrp-vs-ospf.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;document&lt;/a&gt; about EIGRP vs OSPF.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2017-01-19T09:41:13.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38218" PostTypeId="1" CreationDate="2017-01-19T09:56:12.223" Score="0" ViewCount="205" Body="&lt;p&gt;Good day! Is it possible to do systems administration on packet tracer?&#xA;Ex. disabling a computer to access its hard drive.&#xA;If so, is testing also possible? &#xA;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="33660" LastActivityDate="2017-02-18T13:12:15.530" Title="systems administration using Packet Tracer" Tags="|cisco|packet-tracer|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38219" PostTypeId="2" ParentId="38218" CreationDate="2017-01-19T10:53:37.870" Score="1" Body="&lt;p&gt;No, packet tracer is for simulating networks, not for simulating computers.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="16930" LastEditDate="2017-02-18T13:12:15.530" LastActivityDate="2017-02-18T13:12:15.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38221" PostTypeId="2" ParentId="37984" CreationDate="2017-01-19T11:16:35.430" Score="-1" Body="&lt;p&gt;Hope that my answer will clear what you are asking:&#xA;first of all lets talk about the speed test and what does it actually mean.&#xA;When you do any speed test from any pc at your network (recommended to do the test directly from the ISP router)well,it shows the bit rate for the download direction that can be transferred from the pinged server to your pc and the upload speed will show you the bit rate from your pc to the pinged server.&#xA;and when you do the speed test ,you are not actually using this data rate ,you are only sending the ping message and getting the response.&#xA;but the real usage will happen when your pc and the other pcs in your network will try to actually download/upload data from/to specific web server.&lt;/p&gt;&#xA;" OwnerUserId="23982" LastActivityDate="2017-01-19T11:16:35.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38222" PostTypeId="2" ParentId="38212" CreationDate="2017-01-19T14:15:44.880" Score="1" Body="&lt;p&gt;Yes. The VRID field is an 8-bit field in the VRRP packet, which makes up part of the virtual MAC address. A network interface will have the same MAC address for both IPv4 and IPv6, which are completely separate layer-3 protocols. IPv4 and IPv6 VRRP packets are not interoperable, and an IPv4 VRRP packet can have the same VRID as an IPv6 VRRP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What VRRP is really doing is fooling the hosts on a network at layer-2 (MAC address). When a host uses ARP in IPv4, or ND in IPv6 to determine the MAC address of its configured gateway (the virtual IP address), VRRP will return a virtual MAC address. Traffic destined for the configured gateway will be encapsulated at layer-2 with the (virtual) destination MAC address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-19T14:15:44.880" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38225" PostTypeId="2" ParentId="37984" CreationDate="2017-01-19T18:50:53.780" Score="2" Body="&lt;p&gt;There are many possibilities and substantial further testing is needed to narrow down which ones apply in your case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One is that the speed test you are using only actually tests for a very short period, so although you think you are testing multiple machines at the same time you are not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another is that the speed test is downloading the test file from a cache in your network, not the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another is that the 155Mbps is not in fact a hard limit but a soft limit which is only enforced after it is exceeded for a sustained period.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another is that your ISP only enforces the speed cap on traffic it considers &quot;out of network&quot; and there is a speed test server for the site you are using within your ISPs network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another is that your ISP simply forgot to set up the limit on your line. ISPs are run by humans who screw up from time to time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another is that your ISP is playing the &quot;cheat at speedtests&quot; game and this has resulted in speed test traffic bypassing the limiter.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-19T18:50:53.780" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38227" PostTypeId="2" ParentId="119" CreationDate="2017-01-19T19:16:14.483" Score="0" Body="&lt;p&gt;The main differences between v4 and v6 &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;there should be no need to micromanage. Address space is relatively plentiful.&lt;/li&gt;&#xA;&lt;li&gt;The expectation is that all subnets will be /64s&lt;/li&gt;&#xA;&lt;li&gt;NAT is strongly discouraged. For large buisnesses that is no problem, they just get PI space or even register as an LIR and advertise their space over BGP. However for small businesses it leaves a difficult choice, do they apply for PI space and buy more expensive internet connections that will let them use it? Do they run private addresses and ISP allocated public addresses in parallel and hope that no ISP allocated addresses end up in long term configuration files? do they ignore the IETF and run NAT anyway?&lt;/li&gt;&#xA;&lt;li&gt;The hexadecimal notation makes nibble boundries conviniant for addressing levels.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Beyond that it shouldn't be much different from v4, figure out what subnets you need, figure out what logical groupings they fall into and how much room for future expansion you want at each level and start putting together a plan.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-19T19:16:14.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38232" PostTypeId="1" AcceptedAnswerId="43388" CreationDate="2017-01-19T22:16:47.703" Score="3" ViewCount="2126" Body="&lt;p&gt;Using switches that support OpenFlow, is it possible to forward packets for specific flows to multiple outgoing ports, so that each port receives a copy of the packet (similar to multicasting scenario, but locally on a per-flow basis)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen something called Port Mirroring, but I assume it's a per-port thing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="33698" LastEditorUserId="33698" LastEditDate="2017-01-20T00:53:58.763" LastActivityDate="2017-08-19T03:36:15.790" Title="Forwarding to multiple output ports using SDN" Tags="|sdn|openflow|ip-forwarding-table|switchport|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38233" PostTypeId="2" ParentId="38232" CreationDate="2017-01-19T22:40:24.633" Score="0" Body="&lt;p&gt;Yes, but I don't think that TCAM rules is what it is called.  TCAM behavior is usually baked into the hardware systems OS or firmware.  Forwarding packets to multiple outgoing ports refers to routing behavior (not switching where datagrams are referred to as frames).  Finally, to forward packets for specific flows to multiple egress ports sounds like a feature called load balancing, or Encapsulated RSPAN (ERSPAN), or maybe multicasting.  The feature you would use depends on your use case.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-19T22:40:24.633" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38235" PostTypeId="2" ParentId="38214" CreationDate="2017-01-19T23:06:58.227" Score="2" Body="&lt;p&gt;I don't think that EIGRP is yet playing a role in today's routing networks. I have not seen any EIGRP Networks for about 5 years at my customer's networks. &#xA;I think that Cisco will put EIGRP to a deprecated status within the next years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main reason i think is that there is an enormous amount of new players within the enterprise routing world that can compete with Cisco. Name them Juniper, Huawei and Nokia (formerly Alcatel Lucent). &#xA;I have not talked of big players in Datacenter Layer3 Switching or NG-Firewall vendors that want to be implemented in today's routing structures too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The document referenced in above Post is from 2007. Ten years ago there was Cisco and Cisco and nothing else, so i don't think that this article should be a reference for today's decision.&#xA;On current platforms it is quite easy to implement an OSPF network that converges in milliseconds, even with single-Area implementations. Routers equiped with Hexacore Xeons do not start sweating on dijkstra's calculations like the poor MIPS boxes did 10 Years ago.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My scheme is:&#xA;if you need a routing protocol to make routers reachable to each other (as a base for MPLS platforms or similar): use ISIS!&#xA;If you want to make networks reachable by each other: use OSPF!&#xA;If you want to interconnect networks: use BGP!&lt;/p&gt;&#xA;" OwnerUserId="31569" LastActivityDate="2017-01-19T23:06:58.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38236" PostTypeId="2" ParentId="37462" CreationDate="2017-01-19T23:20:04.253" Score="1" Body="&lt;p&gt;Plugging in a computer and visiting google is a surprisingly complex process. This answer tries to explain the basic process without going into too much detail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you plug your computer in to the network it uses a protocol called DHCP to request IP configuration for itself. This configuration will include IP address, subnet mask, default gateway and DNS servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DHCP request is sent as a broadcast to all systems on the local Ethernet network and is answered by the DHCP server. In a typical home or small buisness environment the DHCP server will be running on the router. The switch doesn't (normally) know or care about DHCP it just passes the requests and responses around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you go to visit google.com your browser asks the operating system to convert google.com to an IP address. The operating system generates a DNS request and queues it for sending to the DNS server address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It then looks up the DNS server's address in it's routing table. To determine a &quot;next hop IP address&quot; and interface. By default if the destination is on the local subnet then the next hop IP address will be the same as the destination IP address. Otherwise the next hop IP address will be the default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That is when ARP first comes into play. The &quot;next hop IP address&quot; must be translated to a MAC address. The computer will look in it's ARP table, if it finds an entry then great, otherwise it will make an ARP request to try and locate the MAC address that corresponds to the next hop IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens next depends a bit on configuration. Maybe the router routes the packet out to a DNS server on the Internet, maybe it performs NAT, maybe the router has a local DNS server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either way the router will end up with a DNS reply addressed to your client machine. It will look up your machine's IP address in it's routing table and determine it is on the local network. It will then look it up in it's ARP table so it can send it to your machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;your computer gets a DNS reply. So it has an IP address for google.com and can attempt to connect to it. The connection process starts by sending a TCP syn packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once again the destination IP address is looked up in the routing and arp tables and the packet is sent to the router. In a typical home/small buisness setup the router will perform network address translation so the packet appears to come from the router and send the packet out towards the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the reply arrives the router will reverse any network address translation and send the packet back to your host. Again it uses it's arp table to find your host's MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch is largely ignorant of all of this. It just uses the source MAC addresses to build a table mapping MAC addresses to ports. If it knows which port the destination MAC address is behind it will send the packet there, otherwise it will flood it everywhere.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-19T23:20:04.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38238" PostTypeId="2" ParentId="38214" CreationDate="2017-01-19T23:54:18.467" Score="0" Body="&lt;p&gt;Follow the KISS principle when designing systems (including networks).  The decision to introduce an interior dynamic routing protocol should be balanced against the overhead it introduces.  Overhead meaning administrative effort, new admin handoff, maintenance (patches, sw updates, etc), interoperability, etc.  I've even seen mid sized companies introduce BGP for all interior routing.  They would spend weeks, months, fighting the most mundane of tasks.  I won't name them but will say that particular client was one of the most respected names in I.T.  ...Very perplexing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, network engineers are often eager to enable features because of technical training.  For example, great cooks know that the only seasoning a rib-eye should get is salt.  Green cooks are gonna over do it with a concoction, or worse a marinade.  Same idea with network engineers and most other arts.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-19T23:54:18.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38240" PostTypeId="2" ParentId="38214" CreationDate="2017-01-20T01:40:59.727" Score="0" Body="&lt;p&gt;I think protocol selection is just like selecting any product or service: your needs will lead you to the best solution. Each protocol has advantages and disadvantages when it comes to scalability, speed, reliability, security, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are designing a network, you should consider the top factors for the owner of that network. Selecting the protocol is easy after that - there are many sources of information out there that detail and compare how each protocol addresses those factors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bottom line: The most important factor in selecting a protocol is making sure it best meets the customer's need.&lt;/p&gt;&#xA;" OwnerUserId="33705" LastActivityDate="2017-01-20T01:40:59.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38241" PostTypeId="2" ParentId="10509" CreationDate="2017-01-20T03:32:52.450" Score="1" Body="&lt;p&gt;ICMP (Ping) traffic might be allowed but other types of traffic might not be allowed to communicate to each other. Figure out what type of traffic you need, create access groups, then create access rules that allow those specific types of traffic to communicate between each vlan.&lt;/p&gt;&#xA;" OwnerUserId="33710" LastActivityDate="2017-01-20T03:32:52.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38246" PostTypeId="1" AcceptedAnswerId="38247" CreationDate="2017-01-20T09:50:24.667" Score="1" ViewCount="985" Body="&lt;p&gt;I would like to enable the jumbo frame support on my N5k for specific SCSI trafic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read we can't do it per interface but only on the system itself :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map type network-qos JUMBO_MTU&#xA;  class type network-qos class-default&#xA;    mtu 9216&#xA;&#xA;!&#xA;&#xA;system qos&#xA;  service-policy type network-qos JUMBO_MTU&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this enables jumbo frame on the whole switch. Can I identify the SCSI traffic on the policy-map so that it's applied just for the traffic I want?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And so the jumbo from other type of traffic would be processed normally ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="24395" LastActivityDate="2017-01-20T16:12:33.143" Title="Jumbo frame on Nexus 5k" Tags="|cisco|qos|mtu|cisco-nexus-5k|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38247" PostTypeId="2" ParentId="38246" CreationDate="2017-01-20T12:23:27.313" Score="4" Body="&lt;p&gt;Yes you can, you just have to classify the traffic.  Here is an example where we classify iSCSI into its own class.  The class-default class will match any other traffic.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map type qos match-all iSCSI&#xA;  match protocol iscsi&#xA;  match cos 4&#xA;&#xA;policy-map type qos POLICY-QOS&#xA;  class iSCSI&#xA;    set qos-group 3&#xA;  class class-fcoe&#xA;    set qos-group 1&#xA;&#xA;class-map type network-qos iSCSI&#xA;  match qos-group 3&#xA;&#xA;policy-map type network-qos JUMBO&#xA;  class type network-qos iSCSI&#xA;    mtu 9216&#xA;    pause no-drop&#xA;  class type network-qos class-fcoe&#xA;    pause no-drop&#xA;    mtu 2158&#xA;  class type network-qos class-default&#xA;    multicast-optimize&#xA;&#xA;&#xA;system qos&#xA;  service-policy type network-qos JUMBO&#xA;  service-policy type qos input POLICY-QOS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Just an additional note, you should modify the classification to match your environment and requirements.  You can classify based on other criteria as well such as IP address.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;class-map type qos match-all iSCSI&#xA;  match access-group name PERMIT-ANY&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/qos/b_Cisco_Nexus_5000_Series_NX-OS_Quality_of_Service_Configuration_Guide/Cisco_Nexus_5000_Series_NX-OS_Quality_of_Service_Configuration_Guide_chapter3.html#con_1056888&quot; rel=&quot;nofollow noreferrer&quot;&gt;N5K Configuration Guide&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastEditorUserId="31609" LastEditDate="2017-01-20T16:12:33.143" LastActivityDate="2017-01-20T16:12:33.143" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38255" PostTypeId="1" AcceptedAnswerId="38256" CreationDate="2017-01-20T20:24:40.637" Score="1" ViewCount="129" Body="&lt;p&gt;I've been trying to find out what type of packet is &lt;code&gt;0x5577&lt;/code&gt;, based on this &lt;a href=&quot;http://csie.nqu.edu.tw/smallko/sdn/latency.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;page&lt;/a&gt;. The following is a snapshot of the source code that indicates this values:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   f = myproto()&#xA;    f.timestamp = int(time.time()*1000 - start_time)&#xA;    #print f.timestamp&#xA;    e = pkt.ethernet()&#xA;    e.src=EthAddr(&quot;0:0:0:0:0:2&quot;)&#xA;    e.dst=EthAddr(&quot;0:1:0:0:0:1&quot;)&#xA;    e.type=0x5577  # What ethernet value is this?&#xA;    e.payload = f&#xA;    msg = of.ofp_packet_out()&#xA;    msg.data = e.pack()&#xA;    msg.actions.append(of.ofp_action_output(port=2))&#xA;    core.openflow.getConnection(src_dpid).send(msg)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't also find it in &lt;a href=&quot;https://en.wikipedia.org/wiki/EtherType&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. I did Google search but without an answer! Has anyone seen this type of ethernet packet before?&lt;/p&gt;&#xA;" OwnerUserId="32892" LastEditorUserId="32892" LastEditDate="2017-01-20T20:36:40.027" LastActivityDate="2017-01-20T20:50:11.273" Title="What type of packet is 0x5577" Tags="|cisco|ethernet|protocol-theory|packet-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38256" PostTypeId="2" ParentId="38255" CreationDate="2017-01-20T20:50:11.273" Score="0" Body="&lt;p&gt;That is an unregistered EtherType, so, it has no standard meaning or type. It appears that someone just made it up to use for a project. Anyone else could use that value for a different project, and it could mean something else. You will need to ask the person who wrote the code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EtherTypes are &lt;a href=&quot;https://standards.ieee.org/develop/regauth/tut/ethertype.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;registered with the IEEE&lt;/a&gt;, and you can find the registered ones &lt;a href=&quot;http://standards-oui.ieee.org/ethertype/eth.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. IANA also, maintains &lt;a href=&quot;https://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;an unofficial page&lt;/a&gt; of EtherTypes.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-20T20:50:11.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38257" PostTypeId="2" ParentId="38232" CreationDate="2017-01-20T21:47:45.397" Score="4" Body="&lt;p&gt;Yes, the openflow &lt;em&gt;protocol&lt;/em&gt; supports the creation of flows with multiple actions, and each action can be to send a frame/packet out a certain port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, whether or not your openflow switch supports this is a different matter.&#xA;E.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/sdn/configuration/b_openflow_agent_nxos/b_openflow_agent_nxos_chapter_01.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this Cisco doc&lt;/a&gt; states that only &quot;output to a single port&quot; is supported by version 1.1.5 of their Openflow agent on Nexus switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In such a scenario where the switch does not support multiple output ports in a flow, you could define the flow to send the matching frames to the controller, and configure the controller to send multiple packet_out commands to the switch (with the same frame but different output port). Please note that in this case scalability may be a concern, i.e the bandwidth to/from the controller and/or the processing power of the controller may become a bottleneck.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2017-01-20T21:47:45.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38260" PostTypeId="1" AcceptedAnswerId="38264" CreationDate="2017-01-21T00:31:42.200" Score="0" ViewCount="74" Body="&lt;p&gt;I am working on network simulation where my network should be as close from real-world conditions as possible. I am coding a function that calculates the latency and bandwidth of between &lt;code&gt;switch A&lt;/code&gt; and &lt;code&gt;switch B&lt;/code&gt; every minute. Isn't it more reasonable and accurate to capture the current TCP throughput instead of the bandwidth? Throughput formula as I remember is: &lt;code&gt;TCP window size/ RTT&lt;/code&gt; but I don't know how to find TCP window size here (Assuming switch A and B are intermediate switches along a path from the sender to the receiver)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you so much in advance. Appreciate any response.&lt;/p&gt;&#xA;" OwnerUserId="33734" LastActivityDate="2017-01-21T04:32:13.327" Title="Finding the TCP throughput for intermediate switches along a transmission path" Tags="|cisco|network-core|bandwidth|throughput|" AnswerCount="1" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38261" PostTypeId="1" CreationDate="2017-01-21T00:37:42.253" Score="1" ViewCount="912" Body="&lt;p&gt;I tried to configure my router to use NTP server. I thought it is trivial but I was wrong. It causes a very nasty problem when router have yet to gain internet access (during boot).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see the following message printed on the console.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Translating &quot;1.pool.ntp.org&quot;...domain server (255.255.255.255)&#xA;&#xA;Translating &quot;2.pool.ntp.org&quot;...domain server (255.255.255.255)&#xA;&#xA;Translating &quot;2.pool.ntp.org&quot;...domain server (255.255.255.255)&#xA;&#xA;Translating &quot;0.pool.ntp.org&quot;...domain server (255.255.255.255)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems those DNS resolutions actually blocks the router from booting into the login prompt. It adds minutes to the boot time and prevents some config from being applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I prevent the DNS lookup from blocking the router? I searched on the &quot;Translating&quot; topic but they all refers to handling typos which is not the problem I faced. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there trustworthy NTP servers similar to Google's 8.8.8.8 which I can point to without doing DNS resolution?&lt;/p&gt;&#xA;" OwnerUserId="22375" LastActivityDate="2017-01-21T01:06:43.717" Title="Cisco IOS NTP server config causes slow boot" Tags="|cisco-ios|ntp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38262" PostTypeId="2" ParentId="38261" CreationDate="2017-01-21T01:05:45.467" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;It seems those DNS resolutions actually blocks the router from booting&#xA;  into the login prompt. It adds minutes to the boot time and prevents&#xA;  some config from being applied.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is not preventing you from booting to the login prompt, it is preventing the router from presenting the login prompt. The router is still booting, and it doesn't really add any time to the boot process, it just seems that way.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How can I prevent the DNS lookup from blocking the router?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is not actually blocking the router.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Are there trustworthy NTP servers similar to Google's 8.8.8.8 which I&#xA;  can point to without doing DNS resolution?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. Unfortunately such recommendations are explicitly off-topic here. Such a recommendation may become obsolete, and this site is meant as an archive. Also, specific IPv4 addresses will not work if you change to IPv6.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-21T01:05:45.467" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38263" PostTypeId="2" ParentId="38261" CreationDate="2017-01-21T01:06:43.717" Score="1" Body="&lt;p&gt;First, you need to turn off domain lookup&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip domain-lookup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then, you need to specify your NTP servers by IP address, rather than by name. You could manually resolve the ntp.org server names and use those addresses.  Two addresses ought to be fine, unless you are doing something with your router that requires very accurate time.  But for logging purposes, it only matters that your devices are all synced to the same time source.  The absolute accuracy isn't important. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-21T01:06:43.717" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38264" PostTypeId="2" ParentId="38260" CreationDate="2017-01-21T04:32:13.327" Score="0" Body="&lt;p&gt;Several factors determine actual throughput, for example, datagram size (see &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Mix&quot; rel=&quot;nofollow noreferrer&quot;&gt;IMIX&lt;/a&gt;) and datagram processing (fast switching, process switching, etc).  Terms such as packet per second, pps, and bits per second, bps, are distinct and are typically seen in performance literature.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-21T04:32:13.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38265" PostTypeId="1" AcceptedAnswerId="38267" CreationDate="2017-01-21T06:37:07.090" Score="1" ViewCount="937" Body="&lt;p&gt;I tested a GRE tunnel on a lousy link, and all traffic seems lagging and slow, but when I switch to a healthy link, everything run smoothly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is a GRE tunnel, in general, very sensitive to packet loss? I want to find out if any setting could reduce packet loss impact to the tunnel itself.&lt;/p&gt;&#xA;" OwnerUserId="4479" LastEditorUserId="8499" LastEditDate="2017-01-21T06:55:50.147" LastActivityDate="2017-01-21T06:55:50.147" Title="Is a GRE tunnel sensitive to packet loss?" Tags="|tunnel|packet-loss|gre|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38267" PostTypeId="2" ParentId="38265" CreationDate="2017-01-21T06:52:50.380" Score="0" Body="&lt;p&gt;A tunnel itself is just wrapping packets inside an outer packet as the payload of the outer packet. If the link which the tunnel packets cross is losing traffic, having a tunnel is no better than not having a tunnel. The problem could be exacerbated because packets may need to be fragmented because of the smaller MTU on the tunnel, and loss of any packet fragment is loss of the entire packet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-21T06:52:50.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38271" PostTypeId="1" CreationDate="2017-01-21T13:49:59.397" Score="1" ViewCount="125" Body="&lt;p&gt;I'm absurdly new on networking, and I just want to know if it possible to set a network with 3 computers without a router, switch; just UTP CAT5 cables (or any category)&lt;/p&gt;&#xA;" OwnerUserId="33744" LastActivityDate="2017-01-21T19:42:55.157" Title="Is it possible to set a 3 computers LAN using just cables?" Tags="|lan|utp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38272" PostTypeId="2" ParentId="38271" CreationDate="2017-01-21T13:58:15.403" Score="5" Body="&lt;p&gt;It's theoretically possible &lt;em&gt;if&lt;/em&gt; one of the computers has two network interfaces. Otherwise, how would you connect them all? But that would be a kludge at best. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are actually thinking about doing this, don't bother.  Network switches are very cheap.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-21T13:58:15.403" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38274" PostTypeId="2" ParentId="38271" CreationDate="2017-01-21T18:54:01.940" Score="-2" Body="&lt;p&gt;Assuming you are talking about Ethernet: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Ethernet was originally based on the idea of computers communicating&#xA;  over a shared coaxial cable acting as a broadcast transmission medium.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In a modern Ethernet, the stations do not all share one channel&#xA;  through a shared cable or a simple repeater hub; instead, each station&#xA;  communicates with a switch, which in turn forwards that traffic to the&#xA;  destination station.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Ethernet#Shared_media&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Practically speaking, you don't need any cables at all.  WiFi (wireless LAN) technology is dirt cheap and has reached LAN speed/performance.  Every laptop, tablet, and smartphone ships with a WiFi network interface card, NIC.  Many PC's ship with them, or can have one plugged in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All you need is a WiFi access point, sometimes called a WiFi router.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-21T18:54:01.940" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38275" PostTypeId="2" ParentId="38271" CreationDate="2017-01-21T19:42:55.157" Score="2" Body="&lt;p&gt;Well you could get old school and use 10Base2 if you  find the proper networking cards for your computers. You just need some RG58 cables, some T connectors and two terminators.  &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastActivityDate="2017-01-21T19:42:55.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38278" PostTypeId="1" AcceptedAnswerId="38279" CreationDate="2017-01-21T22:51:53.210" Score="0" ViewCount="75" Body="&lt;p&gt;What I have in mind is software, where I can build network virtualy, with routers, switches, subnets etc. (maybe with some kind of checking mechanism). I want to understand concept of networking better by building some network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there are some diagram tools, but thats not exactly what I have in mind.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is... Is there any software, where I can emulate/build enterprise network, with some error/conflict checking?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: You will probably put it on hold anyway, because as I found out....software reccomendations are not allowed here.&lt;/p&gt;&#xA;" OwnerUserId="32635" LastEditorUserId="32635" LastEditDate="2017-01-22T06:01:04.357" LastActivityDate="2017-01-22T06:01:04.357" Title="Network building software" Tags="|network|" AnswerCount="1" CommentCount="1" ClosedDate="2017-01-22T04:31:50.417" ContentLicense="CC BY-SA 3.0" />
  <row Id="38279" PostTypeId="2" ParentId="38278" CreationDate="2017-01-21T22:59:01.660" Score="1" Body="&lt;p&gt;See &lt;a href=&quot;https://www.gns3.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;GNS3&lt;/a&gt;.  Also, look at Oracles &lt;a href=&quot;https://www.virtualbox.org/wiki/VirtualBox&quot; rel=&quot;nofollow noreferrer&quot;&gt;VirtualBox&lt;/a&gt; which allows you to stand up multiple virtual routers such as Cisco's CSR 1000v or VyOS on a PC or laptop.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-21T22:59:01.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38282" PostTypeId="1" CreationDate="2017-01-22T13:33:21.100" Score="1" ViewCount="366" Body="&lt;p&gt;Recently, my company bought a Cisco 881. Although I am able to get it up and working by copying some configuration on the Internet, I still do not understand how does the layer 2 (LAN) and layer 3 (WAN) interface interact within the same router? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to google but I still couldn't find a good explanation on how it works.&lt;/p&gt;&#xA;" OwnerUserId="33754" LastEditorUserId="8499" LastEditDate="2017-01-23T01:01:24.923" LastActivityDate="2017-01-23T01:56:21.797" Title="Cisco 800 series guide" Tags="|cisco|vlan|layer2|layer3|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38283" PostTypeId="1" AcceptedAnswerId="38285" CreationDate="2017-01-22T13:47:26.137" Score="1" ViewCount="221" Body="&lt;p&gt;The term &lt;code&gt;encapsulation&lt;/code&gt; generally signifies the below in terms of OSI model as described clearly &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/6380/osi-model-and-networking-protocols-relationship&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Each “function” (broadly speaking) encapsulates the layer(s) above it. The network layer encapsulates the layers above it. The data link layer encapsulates the network layer, and so on.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q:But many a times, we also see that terms like mac in ip encapsulation (e.g OTV).In this case, the upper layer(Layer3) is encapsulating the lower layer(Layer2). Please explain why do we use the term &lt;code&gt;encapsulation&lt;/code&gt; here. Is it not contradictory to what &lt;code&gt;encapsulation&lt;/code&gt; generally means?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-01-23T00:02:40.460" Title="Regarding Encapsulation in OSI layer" Tags="|ip|osi|mac|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38284" PostTypeId="1" AcceptedAnswerId="38292" CreationDate="2017-01-22T15:15:49.623" Score="2" ViewCount="895" Body="&lt;p&gt;I would like to implement two VPNs on the same interface of a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Oqnjw.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Oqnjw.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router in question is router A which has one public interface Fa0/0 with IP: 22.33.44.55 (ex).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First IPSec tunnel is a LAN-to-LAN IPSec to the peer router B: Fa0/1 with IP: 2.3.4.5&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second IPSec tunnel is to cisco VPN Client, these clients use a public router to connect to internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The scenario is like this:  Client connected to router C will use cisco VPN client to connect to the router A and this router will forward the request to router B using IPSec tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BR&lt;/p&gt;&#xA;" OwnerUserId="33756" LastActivityDate="2017-05-23T03:35:52.407" Title="Two way IPSec tunneling" Tags="|cisco|router|vpn|ipsec|tunnel|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38285" PostTypeId="2" ParentId="38283" CreationDate="2017-01-22T15:19:44.480" Score="3" Body="&lt;p&gt;Since you're quoting me, allow me to answer your question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't think it's contradictory at all.  While it's true that tunneling protocols* don't fit the OSI model, the process of encapsulation remains the same.  The original protocol data unit (PDU) is contained within another PDU, such that the inner PDU's structure and semantics (meaning) can be ignored.  The outer PDU is processed irrespective of what &quot;data&quot; it is carrying.  In OTV, the outer PDU is IP, and that IP packet is processed like any other. The fact that it is carrying OTV data does not affect how the IP packet is processed as it travels through the network.  That is the essential feature on encapsulation.  It doesn't matter if the inner PDU is a &quot;higher&quot; or &quot;lower&quot; layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;. * In addition to OTV, you can add all the other tunneling protocols, including TRILL, LISP, GRE, MPLS, IPSec, IPinIP, etc.  None of them were anticipated by the ISO when they developed their model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that I think about it, you could say that all tunneling protocols are an example of encapsulation.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-01-22T15:38:51.773" LastActivityDate="2017-01-22T15:38:51.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38286" PostTypeId="2" ParentId="38282" CreationDate="2017-01-22T16:45:34.550" Score="2" Body="&lt;p&gt;It is much like a layer-3 switch. The switch interfaces are layer-2 interfaces, and they are configured for VLANs. The default VLAN is VLAN 1. For each VLAN you use, you can create and SVI (Switched Virtual Interface). You place the layer-3 VLAN configuration on the SVI, and the layer-3 address of the SVI is the gateway address for the VLAN. The SVI is like another router interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA; ip address 10.1.0.1 255.255.255.0&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can create multiple SVIs and assign different switch interfaces to different VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router will automatically route between directly connected networks, so it will route between your virtual and physical interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-22T16:45:34.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38288" PostTypeId="2" ParentId="35420" CreationDate="2017-01-22T23:37:21.287" Score="0" Body="&lt;p&gt;You were on target until the fourth sentence:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But if it was behind a router, then you will have to have the router&#xA;  properly configured to forward your packet to the target machine,&#xA;  which can be accomplished by using a port number&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The last part of that sentence is inaccurate, namely, &quot;which can be accomplished using a port number.&quot;  Port numbering is not required for your packet to reach the endpoints NIC card.  The port number comes into play &lt;em&gt;within&lt;/em&gt; the endpoint (computer) as the packet gets consumed (routed to / unpackaged) by a particular application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP addressing is how packets are forwarded through an IP based network.  That's it.  Each router in the path simply has a route to the endpoints address, or it doesn't.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-22T23:37:21.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38290" PostTypeId="2" ParentId="37242" CreationDate="2017-01-22T23:53:54.590" Score="2" Body="&lt;p&gt;&lt;a href=&quot;http://barracuda.optrics.com/download/barracuda-SSLVPN-administrators-guide.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;B a r r a c u d a S S L V P N A d m i n i s t r a t o r ’ s G u i d e&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/67ZxP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/67ZxP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-22T23:53:54.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38291" PostTypeId="2" ParentId="38283" CreationDate="2017-01-23T00:02:40.460" Score="2" Body="&lt;p&gt;The term &lt;code&gt;encapsulation&lt;/code&gt; does not appear at all in the &lt;a href=&quot;http://www.itu.int/rec/dologin_pub.asp?lang=e&amp;amp;id=T-REC-X.200-199407-I!!PDF-E&amp;amp;type=items&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSI/ITU-T's Reference Model&lt;/a&gt;.  The term is used because it describes the function of the method being utilized, namely, encapsulating, or packaging, stuff to then send on.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-23T00:02:40.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38292" PostTypeId="2" ParentId="38284" CreationDate="2017-01-23T00:08:32.833" Score="2" Body="&lt;p&gt;What you describe is possible and has been configured countless times.  Simply look up the commands to configure your networking equipment.  Since you mention Cisco's VPN client, I assume you are using Cisco routers and Cisco Anyconnect VPN Client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, configure the Site-to-Site (or LAN-to-LAN) VPN tunnel between A &amp;amp; B.  Then configure the Remote Access VPN service on A.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-23T00:08:32.833" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38293" PostTypeId="2" ParentId="38282" CreationDate="2017-01-23T01:56:21.797" Score="0" Body="&lt;p&gt;Think of it as a router with an Ethernet switch linecard attached.  If you aren't very familiar with configuring Cisco equipment, have a look at &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_usr_cfg/configuration/xe-3s/sec-usr-cfg-xe-3s-book/sec-autosecure.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;AutoSecure&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The AutoSecure feature secures a router by using a single CLI command&#xA;  to disable common IP services that can be exploited for network&#xA;  attacks, enable IP services and features that can aid in the defense&#xA;  of a network when under attack, and simplify and harden the security&#xA;  configuration of the router.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-23T01:56:21.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38294" PostTypeId="2" ParentId="30173" CreationDate="2017-01-23T03:24:13.553" Score="1" Body="&lt;p&gt;I believe it is done by setting the unit priority (lowest number becomes master) see info here&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.dlink.com/it/it/-/media/business_products/dgs/dgs-3420/manual/dgs_3420_series_r150_cli_reference_guide.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.dlink.com/it/it/-/media/business_products/dgs/dgs-3420/manual/dgs_3420_series_r150_cli_reference_guide.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="33768" LastActivityDate="2017-01-23T03:24:13.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38295" PostTypeId="2" ParentId="9677" CreationDate="2017-01-23T06:07:18.310" Score="0" Body="&lt;p&gt;If you have connected the switch-port to a WIFI-AP then you would need to add multiple hosts to a single switch-port as all the hosts would be using a single switch-port.&lt;/p&gt;&#xA;" OwnerUserId="33770" LastActivityDate="2017-01-23T06:07:18.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38298" PostTypeId="2" ParentId="37516" CreationDate="2017-01-23T10:55:51.237" Score="1" Body="&lt;p&gt;In the end we have configured it on the CUCM as it is a MGCP gateway and controlled from the server rather than gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now all calls pass full number and locality on both landlines and molife phones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our final settings after few hours of testing in the picture below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JtGZn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JtGZn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32792" LastActivityDate="2017-01-23T10:55:51.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38301" PostTypeId="1" AcceptedAnswerId="38303" CreationDate="2017-01-23T14:48:09.157" Score="6" ViewCount="11924" Body="&lt;p&gt;I'm going to replace some old &quot;central&quot; access switches to some Cisco Catalyst 2960X, and I'm not sure what to do on their STP configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this network, we have some &quot;central&quot; access switches, that connect some hosts and some unknown unmanaged or &quot;smart&quot; switches. For now, I have to maintain these unknown switches working, but I want to avoid getting my entire network down in case of a loop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How should I configure these access ports regarding STP? At first, I thought it was better to turn off the STP using &lt;code&gt;portfast&lt;/code&gt; in all ports (except my trunk), but i'm afraid that some of these connected switches might cause a loop in the entire network. If I turn on BPDU filter, as far as I know, any connected switch will put the port in &lt;code&gt;err-disable&lt;/code&gt;, and I don't want that either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way that I can have these unmanaged switches connected on the access ports and just disable their ports to the Cisco in case of a problem? &lt;/p&gt;&#xA;" OwnerUserId="17000" LastEditorUserId="8499" LastEditDate="2017-08-30T20:02:19.483" LastActivityDate="2017-08-30T20:02:19.483" Title="Should I disable STP on my access ports?" Tags="|switch|switching|cisco-catalyst|spanning-tree|layer2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38303" PostTypeId="2" ParentId="38301" CreationDate="2017-01-23T15:03:18.590" Score="12" Body="&lt;p&gt;You really, really do not want to disable STP where you connect switches to other switches. That is the entire purpose of STP. If you disable STP, and there is a problem, it will really be too late because your entire network could crash when you notice it, and recovering from a broadcast storm is no fun at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, &lt;code&gt;portfast&lt;/code&gt; doesn't actually disable STP, it just skips the whole learning process, and it should only be enabled on a true access interface, not where you connect another switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A best practice is to not connect an access switch to another access switch, but if you do this, you can set the interface to trunk and set the native VLAN to what you had for the access VLAN. You can even restrict the VLANs allowed to only allow the native VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The use of globally enabled &lt;code&gt;portfast&lt;/code&gt; and &lt;code&gt;bpduguard&lt;/code&gt; is recommended. This will not be enabled on trunk interfaces unless you use the &lt;code&gt;trunk&lt;/code&gt; keyword. This will give you the protection on access interfaces, but not anywhere you connect other switches with a trunk interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-23T15:14:08.767" LastActivityDate="2017-01-23T15:14:08.767" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38305" PostTypeId="1" AcceptedAnswerId="60545" CreationDate="2017-01-23T15:49:10.883" Score="2" ViewCount="3861" Body="&lt;p&gt;Cisco OSPF has area 0 with 10.0.0.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PFsense OSPF has area 0 with 10.0.0.0/24 and area 10 with 10.10.2.0/24 and area 20 with 192.168.122.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routers have full &quot;FULL/DR&quot; &amp;amp; &quot;FULL/BDR&quot; relationship with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, although &quot;show route&quot; and &quot;ip route&quot; show routes from each different devices, ospf neighbors can't talk to each other.&#xA;(To rule out firewall/acl on both Cisco and PFsense, I put in static routes and it worked).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What else can I do to make them talk to each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(ASA output)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisASA# show route&#xA;&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, + - replicated route&#xA;&#xA;Gateway of last resort is 107.204.168.1 to network 0.0.0.0&#xA;&#xA;S*    0.0.0.0 0.0.0.0 [1/0] via 107.204.168.1, outside&#xA;O IA     10.10.2.0 255.255.255.0 [110/20] via 10.0.0.119, 15:17:07, inside&#xA;C        107.0.0.0 255.0.0.0 is directly connected, outside&#xA;L        107.204.169.233 255.255.255.255 is directly connected, outside&#xA;C        10.0.0.0 255.255.0.0 is directly connected, inside&#xA;L        10.0.0.1 255.255.255.255 is directly connected, inside&#xA;O IA  192.168.122.0 255.255.255.0 [110/20] via 10.0.0.119, 15:17:07, inside&#xA;&#xA;cisASA# show ospf nei&#xA;&#xA;&#xA;Neighbor ID     Pri   State           Dead Time   Address         Interface&#xA;100.100.100.100   1   FULL/BDR        0:00:39    10.0.0.119    inside&#xA;cisASA# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(PFsense output)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IPv4 Routes&#xA;Destination Gateway Flags   Use Mtu Netif   Expire&#xA;0.0.0.0/32  10.0.0.1    UGS 0   1450    em3 &#xA;default 10.0.0.1    UGS 57016   1450    em3 &#xA;8.8.8.8 00:3d:2c:15:26:57   UHS 17  1450    em3 &#xA;10.10.2.0/24    link#2  U   0   1450    em1 &#xA;10.10.2.1   link#2  UHS 212364  16384   lo0 &#xA;84.200.69.80    00:3d:2c:15:26:57   UHS 166 1450    em3 &#xA;127.0.0.1   link#8  UH  823 16384   lo0 &#xA;10.0.0.0/16 10.0.0.1    UGS 120297  1450    em3 &#xA;10.0.0.119  link#4  UHS 0   16384   lo0 &#xA;192.168.122.0/24    link#3  U   63230   1450    em2 &#xA;192.168.122.1   link#3  UHS 212299  16384   lo0 &#xA;&#xA;&#xA;Quagga OSPF Neighbors&#xA;&#xA;    Neighbor ID Pri State           Dead Time Address         Interface            RXmtL RqstL DBsmL&#xA;5.5.5.5           1 Full/DR           34.501s 10.0.0.1      em3:10.0.0.119         0     0     0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(ASA Config)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;cisASA# show run&#xA;&#xA;: Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz&#xA;:&#xA;ASA Version 9.2(4) &#xA;!&#xA;hostname cisASA&#xA;&#xA;enable password .jaY8R6W./JP9tz1 encrypted&#xA;xlate per-session deny tcp any4 any4&#xA;xlate per-session deny tcp any4 any6&#xA;xlate per-session deny tcp any6 any4&#xA;xlate per-session deny tcp any6 any6&#xA;xlate per-session deny udp any4 any4 eq domain&#xA;xlate per-session deny udp any4 any6 eq domain&#xA;xlate per-session deny udp any6 any4 eq domain&#xA;xlate per-session deny udp any6 any6 eq domain&#xA;&#xA;names&#xA;!&#xA;interface Ethernet0/0&#xA; switchport access vlan 2&#xA;!&#xA;interface Ethernet0/1&#xA;!             &#xA;interface Ethernet0/2&#xA;!&#xA;interface Ethernet0/3&#xA;!&#xA;interface Ethernet0/4&#xA;!&#xA;interface Ethernet0/5&#xA;!&#xA;interface Ethernet0/6&#xA;!&#xA;interface Ethernet0/7&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 10.0.0.1 255.255.0.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address 7.4.1.2 255.0.0.0 &#xA;!&#xA;interface Vlan3&#xA; no nameif    &#xA; no security-level&#xA; no ip address&#xA;!&#xA;boot system disk0:/asa924-k8.bin&#xA;ftp mode passive&#xA;clock timezone PST -8&#xA;clock summer-time PDT recurring&#xA;dns domain-lookup inside&#xA;dns server-group DefaultDNS&#xA; name-server 84.200.69.80&#xA; name-server 8.8.8.8&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network obj-100&#xA; subnet 10.0.0.0 255.255.0.0&#xA;object network loader&#xA;object network ospf-10&#xA; subnet 10.0.2.0 255.255.255.0&#xA;object network ospf-20&#xA; subnet 10.0.20.0 255.255.255.0&#xA;object network ospf-30&#xA; subnet 10.0.30.0 255.255.255.0&#xA;object network ospf-40&#xA; subnet 192.168.122.0 255.255.255.0&#xA;object-group service DM_INLINE_SERVICE_1&#xA;&#xA;&#xA;access-list inside_access_in extended permit ip object obj-100 any4 &#xA;access-list inside_access_in extended permit ip object ospf-10 any4 &#xA;access-list inside_access_in extended permit ip object ospf-20 any4 &#xA;access-list inside_access_in extended permit ip object ospf-30 any4 &#xA;access-list inside_access_in extended permit ip object ospf-40 any4 &#xA;access-list outside_access_in extended permit ip 192.168.0.0 255.255.0.0 any &#xA;access-list outside_access_in extended permit ip 10.0.0.0 255.0.0.0 any &#xA;access-list outside_access_in extended permit ip 172.16.0.0 255.240.0.0 any &#xA;pager lines 24&#xA;logging enable&#xA;logging buffer-size 987564&#xA;logging buffered informational&#xA;logging asdm informational&#xA;mtu inside 1450&#xA;mtu outside 1450&#xA;ip verify reverse-path interface inside&#xA;ip verify reverse-path interface outside&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;asdm image disk0:/asdm-762-150.bin&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;!&#xA;&#xA;object network obj-1000&#xA; nat (inside,outside) dynamic interface&#xA;object network ospf-10&#xA; nat (inside,outside) dynamic interface&#xA;object network ospf-20&#xA; nat (inside,outside) dynamic interface&#xA;object network ospf-30&#xA; nat (inside,outside) dynamic interface&#xA;object network ospf-40&#xA; nat (inside,outside) dynamic interface&#xA;!&#xA;nat (inside,outside) after-auto source dynamic any interface&#xA;access-group inside_access_in in interface inside&#xA;access-group open-acl in interface outside&#xA;router ospf 5505&#xA; router-id 5.5.5.5&#xA; network 10.0.0.0 255.255.0.0 area 0&#xA; log-adj-changes&#xA; redistribute static subnets&#xA;!&#xA;route outside 0.0.0.0 0.0.0.0 7.4.1.1&#xA;&#xA;management-access inside&#xA;&#xA;dhcp-client client-id interface outside&#xA;dhcpd dns 84.200.69.80 8.8.8.8&#xA;dhcpd update dns both override &#xA;dhcpd option 3 ip 10.0.0.1&#xA;!&#xA;dhcpd address 10.0.1.100-10.0.1.130 inside&#xA;dhcpd enable inside&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics host&#xA;threat-detection statistics access-list&#xA;threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200&#xA;ntp server 216.228.192.69 source outside&#xA;&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect icmp &#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context &#xA;no call-home reporting anonymous&#xA;Cryptochecksum:72ade258e5ac8ab26363b2a9beb2724a&#xA;: end&#xA;cisASA#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(PFsense Config is in GUI format)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;But pretty much the same&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user10221" LastEditorDisplayName="user10221" LastEditDate="2017-01-23T16:06:06.687" LastActivityDate="2019-07-20T15:30:19.763" Title="OSPF between Cisco &amp; PFsense" Tags="|cisco|ospf|pfsense|" AnswerCount="1" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="38306" PostTypeId="2" ParentId="38301" CreationDate="2017-01-23T16:12:32.090" Score="1" Body="&lt;p&gt;So you are in a situation where for whatever reason people sometimes plug desktop switches into access ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an ideal world you wouldn't have this but in practice it can be difficult. Sometimes rooms simply do not have enough outlets for the amount of equipment that is in them. Adding more wiring and/or cabinets so you can replace the desktop switches with properly secured and managed ones can cost a lot of money and time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would say the first thing to do is research. Write a script to figure out how many MAC addresses are behind each port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That will let you get an idea of the scale of the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may also be an idea to run the script multiple times so you can figure out if the unknown switches are remaining static or are moving around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Probablly a reasonable compromise is to limit ports by default to a small number of MAC addresses (maybe 7). This should quickly shut down any loops while not blocking small unmanaged switches on desktops. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If I turn on BPDU filter, as far as I know, any connected switch will put the port in err-disable, and I don't want that either.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Afiact only a switch that sends BDPUs will and your typical unmanaged desktop switch doesn't. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-23T16:12:32.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38308" PostTypeId="2" ParentId="35224" CreationDate="2017-01-23T18:26:09.443" Score="2" Body="&lt;p&gt;You hand out a backup DNS server address to your endpoints via DHCP.  That's how it's done.  A router should not be involved.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-23T18:26:09.443" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38309" PostTypeId="2" ParentId="35224" CreationDate="2017-01-23T19:35:04.933" Score="0" Body="&lt;p&gt;To perform a translation like this a few things need to hold&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The router needs to have a suitably flexible NAT implementation. &lt;/li&gt;&#xA;&lt;li&gt;The traffic needs to actually reach the router&lt;/li&gt;&#xA;&lt;li&gt;The return traffic needs to return via the same router so it can be correctly reverse translated.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Point 1 is certainly true for Linux NAT, I can't comment on other implementations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point 2 is fine if the DNS server is on a different subnet from the client but if they are on the same subnet then some trickery is needed. It would be possible to have a script make the router take over the DNS server's IP address but then you have a potential IP conflict to deal with when the DNS server comes back up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point 3 means you need to think about your routing. If there is only one path from the client machine to the internet and the same path back then you are fine. Otherwise you may have problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overall, while certainly possible to implement this seems like a bad idea. Far more sensible to just have two DNS servers and then set the &quot;primary&quot; and &quot;secondary&quot; DNS server settings appropriately.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-23T19:35:04.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38310" PostTypeId="2" ParentId="22866" CreationDate="2017-01-23T20:14:27.853" Score="1" Body="&lt;p&gt;On unix-like operating systems the term &quot;daemon&quot; refers to a long running program that performs some service. Generally started by the systems startup scripts and stopped by it's shutdown scripts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A routing daemon is a daemon that implements a routing protocol. It sends and receives routes from other routers and uses them to update the routing table in the kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do know know (and it may well be a secret) exactly how things are broken down on propietary routers but there will almost certainly be a split between the buisness of managing what routes are in use and the buisness of actually forwarding packets based on those routes.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-23T20:14:27.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38311" PostTypeId="1" AcceptedAnswerId="38313" CreationDate="2017-01-24T02:31:45.350" Score="1" ViewCount="151" Body="&lt;p&gt;When I read Cisco CCNP official guide, I found an explanation on how to calculate the cost of intra-area routes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Find all networks inside the area, based on the stub interfaces&#xA;listed in the Type 1 LSAs and based on any Type 2 Network LSAs.&lt;/li&gt;&#xA;&lt;li&gt;Run SPF to find all possible paths through the area’s topology,&#xA;from itself to each network.&lt;/li&gt;&#xA;&lt;li&gt;Calculate the OSPF interface costs for all outgoing interfaces in&#xA;each route, picking the lowest-total-cost route for each network as&#xA;the best route.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;My question is: is finding all possible paths one of SPF algorithm's functions? I thought all possible paths is implicitly shown by LSDB, SPF algorithm's mission is just creating a SPF tree, and get the shortest path to each network which are leaves of this tree. Or here the author want to express the meaning that SPF traverses all possible paths and find the shortest path.&lt;/p&gt;&#xA;" OwnerUserId="27348" LastEditorUserId="8499" LastEditDate="2017-01-24T03:47:33.343" LastActivityDate="2017-01-24T03:47:33.343" Title="Does SPF algorithm find all possible paths through the LSDB?" Tags="|ospf|sfp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38313" PostTypeId="2" ParentId="38311" CreationDate="2017-01-24T03:44:20.860" Score="0" Body="&lt;p&gt;Each router in an area will run Dijkstra's (SPF) algorithm when its LSDB is updated to determine the shortest (lowest-cost) path for each network in the LSDB. The wording may be confusing. Every possible path on every possible exit point is examined to determine the lowest cost interface for the route. Each possible path must be walked to add up all the costs for the possible paths, and that may lead to the confusion. The SPF algorithm will look at each possible path to determine which has the lowest cost, and the interface toward that path for the route gets installed into the routing table for that route.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-24T03:44:20.860" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38314" PostTypeId="1" AcceptedAnswerId="38345" CreationDate="2017-01-24T01:40:57.320" Score="1" ViewCount="1119" Body="&lt;p&gt;I am trying to connect a new server of mine to an existing FC Patch Panel on a strand that has been patched to a FC Switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Fiber used is single-mode and in order to hook it up, I am using a single-mode lc-st cable. I am bit confused about choosing the right transceiver for this connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a working connection, this is the transceiver. &lt;a href=&quot;https://i.stack.imgur.com/9G8xB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;Brocade 10G SFP+&lt;/a&gt;. I did find quite a few transceivers of the same model number, but slightly different numbers/revisions? . Unfortunately, I have not been able to find what the different numbers mean. Here is an example &lt;a href=&quot;https://i.stack.imgur.com/kKPPm.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;from ebay&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only thing I did find  was a brocade data-sheet that lists the compatibility of these models with their switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="33811" OwnerDisplayName="feverDream" LastEditorUserId="33811" LastEditDate="2017-01-25T05:57:51.757" LastActivityDate="2017-01-25T05:57:51.757" Title="Choosing the right SFP+ Transceiver" Tags="|fiber|sfp|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="38316" PostTypeId="1" AcceptedAnswerId="38351" CreationDate="2017-01-24T08:40:05.443" Score="1" ViewCount="8488" Body="&lt;p&gt;I have fortigate 300C, since today morning I am getting error &lt;code&gt;NAT port is exhausted&lt;/code&gt; and also I observed high bandwidth consumption due to which links were getting flapped. I have search on google but not found any satisfactory answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone help me to understand why this is happened, and what should I do to troubleshoot. &lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2017-01-25T09:58:36.280" Title="NAT port is exhausted" Tags="|nat|internet|fortigate|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38318" PostTypeId="1" AcceptedAnswerId="38322" CreationDate="2017-01-24T09:13:47.893" Score="1" ViewCount="151" Body="&lt;p&gt;Consider we are using &lt;code&gt;1.1.1.1&lt;/code&gt; as our VIP which is the IP address of the load balancer. I'm aware that I should disable ARP replies on loop back interfaces of back end servers. However another issue confuses me with this topology:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Router sends ARP request to find MAC address of &lt;code&gt;1.1.1.1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Load balancer replies back with its own mac address. (Lets say &lt;code&gt;AA:AA:AA:AA:AA:AA&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Router caches this information (mapping of &lt;code&gt;1.1.1.1&lt;/code&gt; to &lt;code&gt;AA:AA:AA:AA:AA:AA&lt;/code&gt;)&lt;/li&gt;&#xA;&lt;li&gt;Router forwards packet to load balancer&lt;/li&gt;&#xA;&lt;li&gt;Load balancer changes destination MAC address from &lt;code&gt;AA:AA:AA:AA:AA:AA&lt;/code&gt; to MAC address of back end server which is &lt;code&gt;BB:BB:BB:BB:BB:BB&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Back end server replies back to the client directly which means it sends reply packet with source IP of &lt;code&gt;1.1.1.1&lt;/code&gt; (VIP) and source MAC address of &lt;code&gt;BB:BB:BB:BB:BB:BB&lt;/code&gt; (This is the MAC address of back end server)&lt;/li&gt;&#xA;&lt;li&gt;Packet arrives at router. Router will notice that &lt;code&gt;1.1.1.1&lt;/code&gt; should have MAC address of &lt;code&gt;AA:AA:AA:AA:AA:AA&lt;/code&gt; (MAC address of load balancer) but now current packet says &lt;code&gt;1.1.1.1&lt;/code&gt; has a MAC address of &lt;code&gt;BB:BB:BB:BB:BB:BB&lt;/code&gt; which is conflicting with router ARP cache)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now the question is what is the behavior of the router in this scenario?&lt;/p&gt;&#xA;" OwnerUserId="24635" LastActivityDate="2017-01-24T12:59:00.750" Title="Conflicting of MAC addresses in reply path of direct server response" Tags="|arp|load-balancing|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38322" PostTypeId="2" ParentId="38318" CreationDate="2017-01-24T12:59:00.750" Score="2" Body="&lt;p&gt;ARP table entries are only updated by ARP packets, not by IP packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the reply packet has no effect on the router's ARP table.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-24T12:59:00.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38323" PostTypeId="1" CreationDate="2017-01-24T13:17:58.350" Score="3" ViewCount="1102" Body="&lt;p&gt;Please find the network diagram,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have MPLS and Internet connectivity in our some of spoke sites in Hub router running in IPSLA for failure purpose. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here MPLS is the primary and VPN is the secondary. If primary link goes down failure is happened and working via VPN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is If i change the route priory as a VPN i can't access my application server. I can ping the ip and i can see the traffic via VPN but i can access the server and any thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help us me to troubleshoot the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In some of spoke sites have both MPLS links that locations are working if i do above changes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cwvCb.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cwvCb.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20971" LastEditorUserId="509" LastEditDate="2017-01-24T13:23:35.580" LastActivityDate="2017-01-25T00:22:44.077" Title="Asymmetric routing issue" Tags="|cisco|vpn|firewall|ipsec|asymmetric-routing|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38329" PostTypeId="2" ParentId="22866" CreationDate="2017-01-24T18:54:54.160" Score="2" Body="&lt;p&gt;The picture you show is a logical diagram that shows functional elements. As such the functions within it may or may not be implemented as separate software processes, threads, daemons, etc. UNIX and its variants tend to implement the boxes in the picture as processes. Thus you have the netstat command to view the routing table and the route command to update it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also have a routing daemon (long running server process) to take care of updating the routing table without requiring manual intervention via the route command. In the vast majority of servers there is a limited number of routes needed so it is just as efficient to set up the routing table by hand and dispense with a routing daemon. But for those that do,  they can run a daemon. The name of the daemon varies according to the routing update and distribution protocol that is in use. For example, routed for RIP, bgpd for BGP. &lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2017-01-24T18:54:54.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38330" PostTypeId="1" AcceptedAnswerId="38348" CreationDate="2017-01-24T20:35:00.980" Score="1" ViewCount="4881" Body="&lt;p&gt;Pretty straight-forward question. Read through Section One of the 802.3 standard, and I found a nice model of a MAC frame that gives me extra insight, but I see that this question is not asked anywhere and I can't find a straight to the point answer anywhere else.&lt;/p&gt;&#xA;" OwnerUserId="33814" LastEditorUserId="8499" LastEditDate="2017-01-24T20:54:01.940" LastActivityDate="2017-08-24T21:20:08.783" Title="Does every packet contain headers from each layer of the OSI model?" Tags="|ethernet|packet-analysis|osi|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38331" PostTypeId="2" ParentId="38330" CreationDate="2017-01-24T20:53:34.380" Score="1" Body="&lt;p&gt;The OSI model is a theoretical model, and the real world often deviates from it. For example, layers 5, 6, and 7 are generally combined because the OS programmers never implemented them. Layers 1 to 4 generally map to the OSI model, but even there, there is some controversy about it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-24T20:53:34.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38333" PostTypeId="1" CreationDate="2017-01-24T23:18:48.630" Score="2" ViewCount="961" Body="&lt;p&gt;I learned that &lt;code&gt;Label Switching (LS)&lt;/code&gt; technique, such as &lt;code&gt;MPLS&lt;/code&gt;, is really faster than the classical routing method where each router takes a bit time to look up its IP table for routing to the next hop. If this is the claim, I want to understand why label switching is faster? To me both techniques are still similar, in terms of time, because routers still need to check the label on each packet before switching!! Right? I don't see any less computation or speeding up here. If I am wrong, I'd like to know the correct reasoning of that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="33818" LastActivityDate="2017-01-25T00:16:48.777" Title="Why Label switching is faster than table lookups" Tags="|cisco|switch|router|network-core|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38335" PostTypeId="2" ParentId="38333" CreationDate="2017-01-25T00:14:30.427" Score="2" Body="&lt;p&gt;I agree - I don't think the claim that label switching is faster than IP routing is true (regardless of what the current &quot;label switching&quot; article on wikipedia says).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe back in the day on platforms that did forwarding in software, IP routing look-ups might have been expensive and time-consuming when the routing table got bigger, but I don't see how there would be any difference today in a label lookup vs. a route lookup in a FIB implemented in ASIC.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-01-25T00:14:30.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38336" PostTypeId="2" ParentId="38333" CreationDate="2017-01-25T00:16:48.777" Score="3" Body="&lt;p&gt;You're mixing number of scenarios. To simplify, you have three scenarios:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;IP routing interface to IP routing interface (no MPLS, no labels of any kind); router will do lookup in the FIB to find best path and forward IP packet to the next-hop; with current generation FPGAs/ASICs it's done in a very efficient manner, with FIB being structure that's usually hierarchical and very fast to look up.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IP routing interface to MPLS enabled interface or vice versa; here You'll do additional lookup to check if label imposition or deposition is needed; &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Pure MPLS to MPLS switching - you're looking at incoming label and based on it, You're swapping the label to different label.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Router will decide on input what kind of packet it receives based on Ethertype - with IPv4, IPv6 and MPLS all having distinct values. As for destination - the destination IP in FIB will contain instruction which label to push to the packet before forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On surface, (3) is fastest, because you can search single label space quite efficiently in one lookup. For RIB/FIB you're usually dealing with hierarchy/tree, so it usually requires multiple lookups (with a lot of work during last 10-20 years on the construction and optimization of such search trees).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only in theory however - current generation FPGAs/ASICs are capable of doing multiple lookups at the same time, and what's even more important - are doing it anyway. Why? They need to check for various services assigned to the packet/FEC - like QoS, filtering and so on.&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2017-01-25T00:16:48.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38337" PostTypeId="2" ParentId="38323" CreationDate="2017-01-25T00:22:44.077" Score="3" Body="&lt;p&gt;The answer is most likely in your question subject.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you change the route priority at the spoke so that traffic comes in via the VPN/Firewall, then return traffic will still most likely leave via the MPLS network (if nothing else changes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your VPN firewall is most likely stateful, and will only have half a session in it's flow table eg: it will see the SYN, but no SYN/ACK, then when the client at the spoke sends the final ACK, the firewall will drop it because it is not in sync with the handshake.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-01-25T00:22:44.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38339" PostTypeId="1" AcceptedAnswerId="38344" CreationDate="2017-01-25T00:28:13.697" Score="4" ViewCount="873" Body="&lt;p&gt;I was watching a tutorial video on Lynda.com. The presenter said:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class A: First octet between 1 and 126. &lt;/li&gt;&#xA;&lt;li&gt;Class B: First octet between 128 and 191.  &lt;/li&gt;&#xA;&lt;li&gt;Class C: First octet between 192 and 223.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I did some Google searching, and according to Wikipedia,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class A  starts from 0.0.0.0 and ends with 127.255.255.255.&lt;/li&gt;&#xA;&lt;li&gt;Class B  starts from 128.0.0.0 and ends with 191.255.255.255.&lt;/li&gt;&#xA;&lt;li&gt;Class C  starts from 192.0.0.0 and ends with 223.255.255.255.&lt;/li&gt;&#xA;&lt;li&gt;Class D  starts from 224.0.0.0 and ends with 239.255.255.255.&lt;/li&gt;&#xA;&lt;li&gt;Class E  starts from 240.0.0.0 and ends with 255.255.255.255.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I found another similar course on Udemy. The presenter said:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class Address Range&lt;/li&gt;&#xA;&lt;li&gt;A     1.0.0.1 to 126.255.255.254&lt;/li&gt;&#xA;&lt;li&gt;B     128.1.0.1 to 191.255.255.254&lt;/li&gt;&#xA;&lt;li&gt;C     192.0.1.1 to 223.255.254.254&lt;/li&gt;&#xA;&lt;li&gt;D     224.0.0.0 to 239.255.255.255&lt;/li&gt;&#xA;&lt;li&gt;E     240.0.0.0 to 254.255.255.254&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I cannot ask the presenters directly, so my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Should 127 be included in Class A or not?&lt;/li&gt;&#xA;&lt;li&gt;Why does the address range vary (sometimes from 128.1.0.1, sometimes from 128.0.0.0, as well as end with 254 or 255)? Which one is correct?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am surprised that this classful addressing must have been around for years, why there is not a unified definition? Sorry about the wordy questions and thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="33820" LastEditorUserId="8499" LastEditDate="2018-03-10T00:16:21.307" LastActivityDate="2023-02-06T20:16:15.473" Title="Some confusion in Classful Addressing" Tags="|ipv4|ip|network|ip-address|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38341" PostTypeId="2" ParentId="38339" CreationDate="2017-01-25T00:38:17.913" Score="6" Body="&lt;p&gt;Classful networking is dead, and it has been for over 20 years, killed in 1993 by RFCs &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1518&quot; rel=&quot;nofollow noreferrer&quot;&gt;1518&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1518&quot; rel=&quot;nofollow noreferrer&quot;&gt;1519&lt;/a&gt;, which defined CIDR (&lt;em&gt;Classless&lt;/em&gt; Inter-Domain Routing). Please, let it rest in peace. Modern networking does not use classes.&lt;/p&gt;&#xA;&lt;p&gt;If you insist on using outdated, obsolete classes, IPv4 addresses are 32-bit integers. If you remember &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc870&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 870, ASSIGNED NUMBERS&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Class A networks have the first bit as &lt;code&gt;0&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Class B networks have the first two bits as &lt;code&gt;10&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Class C networks have the first three bits as &lt;code&gt;110&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Class D networks have the first four bits as &lt;code&gt;1110&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;Class E networks have the first four bits as &lt;code&gt;1111&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;You should be able to figure out the old network class for any address with the above information, not that it means anything, anymore.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2017-01-25T00:46:00.777" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38342" PostTypeId="2" ParentId="30044" CreationDate="2017-01-25T03:17:36.220" Score="0" Body="&lt;pre&gt;&lt;code&gt;file copy your-server:/homes/fred/tmp/juniper.conf.gz-YOUR FILE&#xA;configure&#xA;load juniper.conf.gz-YOUR FILE&#xA;commit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2017-01-25T03:33:22.960" LastActivityDate="2017-01-25T03:33:22.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38344" PostTypeId="2" ParentId="38339" CreationDate="2017-01-25T04:34:26.107" Score="2" Body="&lt;p&gt;Yes, 127.x.x.x should be included as a Class A address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;128.1.0.0 - 128.1.0.255 is the correct entire network block for a /24 network.&lt;br&gt;&#xA;128.1.0.1 - 128.1.0.254 are the correct usable &#xA;hosts for a /24 network.&lt;br&gt;&#xA;128.1.0.0 is your network.&lt;br&gt;&#xA;128.1.0.255 is your broadcast address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will sometime see the first IP (128.1.0.0) and last IP (128.1.0.255) left off when documenting the usable host addresses.&lt;/p&gt;&#xA;" OwnerUserId="16882" LastEditorUserId="16882" LastEditDate="2017-01-26T05:46:30.220" LastActivityDate="2017-01-26T05:46:30.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38345" PostTypeId="2" ParentId="38314" CreationDate="2017-01-25T04:41:45.563" Score="4" Body="&lt;p&gt;Comments converted into answer: Please spend a bit of time learning the actual terminology rather than inventing your own, which confuses both you and us. An SFP (small form pluggable) is not a connector. It typically HAS one or more often two female optical connectors as part of itself, but what it IS is an electro-optical transceiver. The 10 Gig ones are not SFPs, they are SFP+ The optical cable does not matter if it's the right family and clean, what you need to is know what the SFP (or SFP+) that you are connecting to at the switch is, and get one compatible with it. Clean, by the way, is a VERY big deal with single mode fiber connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the SFP+ you have shown (without showing the relevant part where the cables plug in) most likely needs a &lt;strong&gt;pair&lt;/strong&gt; of optical cables, not a single cable. If it has two optical connectors, one is transmit, one is receive. Transmit at one end connects to receive on the other. I'd guess that 10GE-LR is intended to be 10GBASE-LR, which is 1310 nm lasers on single-mode fiber up to 10 kilometers, not a bidirectional standard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/10_Gigabit_Ethernet&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/10_Gigabit_Ethernet&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cable test tag on your patch cable showing what its insertion and return losses at various wavelengths were when it shipped from the factory is utterly irrlevant to the choice of the correct SFP+ - which seems to be your question, buried under a lot of mis-used terminology you &lt;em&gt;need&lt;/em&gt; to learn if you have anything to do with this equipment.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2017-01-25T04:53:13.127" LastActivityDate="2017-01-25T04:53:13.127" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38346" PostTypeId="1" AcceptedAnswerId="38347" CreationDate="2017-01-25T04:50:05.040" Score="1" ViewCount="817" Body="&lt;p&gt;According to what I learned from Cisco documents, by default a normal NSSA area's ABR does not create a default route. Unless you use the command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Area 1 nssa default-information-originate&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on ASBRs or ABRs.But if an area is a totally NSSA area, its ABR will create a Type 3 LSA containing a default route in the area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this mean if an area is NSSA totally, the ASBR's external default route would conflict with ABR's default route? I know I should test it in the lab first, but I cannot help getting the answer immediately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your answers!&lt;/p&gt;&#xA;" OwnerUserId="27348" LastEditorUserId="27348" LastEditDate="2017-01-25T05:09:33.580" LastActivityDate="2017-01-25T06:08:15.983" Title="Can an external default route be injected into a NSSA totally stub area?" Tags="|ospf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38347" PostTypeId="2" ParentId="38346" CreationDate="2017-01-25T04:57:03.573" Score="0" Body="&lt;p&gt;You are confusing a couple of terms. An NSSA (&lt;em&gt;Not&lt;/em&gt; So Stubby Area) area is &lt;em&gt;not&lt;/em&gt; a Totally Stubby Area. The difference is actually rather large. An NSSA area can contain an ASBR, but a Totally Stubby Area cannot. An NSSA area allows routes from outside the AS to be introduced into the OSPF AS, but a Totally Stubby Area does not. These are types are mutually incompatible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your edit, you need to understand that the &lt;code&gt;no-summary&lt;/code&gt; keyword on an ABR will suppress any regular Type-3 and Type-4 LSAs, and only send in a default route into the area. A default route from an ASBR, or from the area itself, will then have no meaning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;default-information-originate&lt;/code&gt; keyword injects a default route into OSPF from an area if the area has a default route in its route table. This is a route leaving the area, compared to one entering the area. What should a router do about a default route from within the area compared to one from a different AS? OSPF trusts itself more than an external route, so the external default route is suppressed. This can be modified by changing the metric types and costs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-25T05:37:03.013" LastActivityDate="2017-01-25T05:37:03.013" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38348" PostTypeId="2" ParentId="38330" CreationDate="2017-01-25T04:59:06.793" Score="5" Body="&lt;p&gt;Technically a packet is a layer 3 protocol data unit (PDU). But yes, PDUs are generally referred to as packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As previously mentioned the OSI model is a theoretical model. Though to answer your question, not all layers have headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layers 5 - 7 are typically just referred to as data.&lt;br&gt;&#xA;Layers 2 - 4 have headers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 4 - Transport - TCP header.&lt;br&gt;&#xA;Layer 3 - Network - IP header.&lt;br&gt;&#xA;Layer 2 - Data Link - MAC header &amp;amp; FCS footer.&lt;br&gt;&#xA;Layer 1 does not have headers as it is converted to binary data.  &lt;/p&gt;&#xA;" OwnerUserId="16882" LastEditorUserId="16882" LastEditDate="2017-08-24T21:20:08.783" LastActivityDate="2017-08-24T21:20:08.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38349" PostTypeId="2" ParentId="38346" CreationDate="2017-01-25T06:08:15.983" Score="1" Body="&lt;p&gt;If the ASBR at the edge of an NSSA receives- and redistributes- a default route then it will show up within the area as an N1 or N2.  This is basically the type-7 equivalent of the usual type-5 E1/E2 external routes in a standard area.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A default route originated by the ABR with the command you listed will show up within the NSSA as an inter-area summary route (i.e. type-3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To the various routers within the NSSA a type-3 is going to be preferred over an external route.  This is just the basic behavior of route selection in OSPF (O &gt; O IA &gt; E1 &gt; E2 &gt; N1 &gt; N2).  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-25T06:08:15.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38350" PostTypeId="1" CreationDate="2017-01-25T08:29:48.997" Score="2" ViewCount="1898" Body="&lt;p&gt;I have Two switches on the same rack:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Switch A&lt;/em&gt; uses &lt;code&gt;192.168.0.1 - 192.168.0.254&lt;/code&gt; range IP addresses&lt;/li&gt;&#xA;&lt;li&gt;&lt;em&gt;Switch B&lt;/em&gt; uses &lt;code&gt;100.1.0.1 - 100.1.0.254&lt;/code&gt; range IP addresses&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I want is for me to assign a &lt;em&gt;Switch A&lt;/em&gt; IP address to a &lt;em&gt;Switch B&lt;/em&gt; connected PC, which will be able to ping &lt;em&gt;Switch A&lt;/em&gt; connected networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would that be possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not at all fluent in networking, so I don't understand most of the articles I have read that might be the solution to my problem, so please bear with me.&lt;/p&gt;&#xA;" OwnerUserId="33822" LastEditorUserId="8499" LastEditDate="2017-01-25T22:34:20.013" LastActivityDate="2020-02-18T11:16:18.707" Title="Two switches, and using the others IP addresses while connected to the other" Tags="|switch|router|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38351" PostTypeId="2" ParentId="38316" CreationDate="2017-01-25T09:58:36.280" Score="3" Body="&lt;p&gt;This message means that all high ports (&gt;1023) are used up for outbound NATted connections. This is very rare and signifies that your FGT is processing way too many sessions. Check the number of open sessions in the GUI or CLI (&lt;em&gt;get sys perf stat&lt;/em&gt;), &quot;average sessions&quot; and &quot;average sessions setup rate&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two main reasons may apply: either you've hit a firmware bug or some host(s) on your internal network start sessions wildly, possibly malware induced. High (outbound) bandwidth consumptions hints into the malware direction, too.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remedy: reboot your FGT. Watch the session count and buildup rate. Depending on the firmware version used, check FortiView to determine where the majority of sessions either originate or are destined to. Then follow the trails.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may find more hints and help on the Fortinet forum (forum.fortinet.com).&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2017-01-25T09:58:36.280" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38352" PostTypeId="1" AcceptedAnswerId="38362" CreationDate="2017-01-25T10:32:20.913" Score="1" ViewCount="98" Body="&lt;p&gt;Servers configured with DHCP have a default route in the corporate network. Every time a &quot;new&quot; host is connected, a &quot;no route to host error&quot; is received. The second request after a few seconds works fine. This happens most frequently on port 443.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can this be fixed, as the firewall used is a checkpoint firewall and there is no further information in the log files. Is there a linux command to trace the error constantly, as this only happens every time the host is unkown.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I am not an Network engineer I just need a way to gather more information for the specialists.&lt;/p&gt;&#xA;" OwnerUserId="33823" LastActivityDate="2017-01-25T15:24:21.323" Title="Consistent no route to host errors on servers" Tags="|router|firewall|troubleshooting|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38353" PostTypeId="1" AcceptedAnswerId="38355" CreationDate="2017-01-25T10:43:55.263" Score="1" ViewCount="10351" Body="&lt;p&gt;I need to implement two types of Anyconnect. One has to be IPSec based, AAA authentication for users and certificate based authentication in tunnel (IKEv2). Second has to be SSL (tunnel mode), certificate based user authentication (user and machine certificate), and also certificate based authentication in tunnel (IKEv2). Certificates can be self-signed. Can anyone paste me cli configuration or point to some manual for my requirements?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastActivityDate="2017-07-24T19:12:23.957" Title="Anyconnect example configuration" Tags="|cisco-anyconnect|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38354" PostTypeId="1" AcceptedAnswerId="41479" CreationDate="2017-01-25T10:59:05.103" Score="1" ViewCount="2057" Body="&lt;p&gt;I am not a network engineer, I have very limited knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;background:&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We currently have a HP1920-48g switch + others around our building.  Originally these were &quot;daisy chainned&quot;, the new I.T Director changed this into what he describes as a &quot;spider&quot; like configuration (totally not a tech term im thinking).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Issue:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have just installed a new telephone IP system, which works with a little computer software called &quot;navigate&quot; recently people coming in later to the building trying to access this would result in a long wait untill there settings loaded etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we have traced this to a issue with the switch reaching 256 limit in the ARP table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can we increase this limit, ither purchase a new switch (rather not but understand if we must).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or can we set up something to increase the limit somehow?  Unfortunatly I have very little network knowledge.  We played around with turning of the Gratuitous ARP but not really sure that we should do this. &lt;/p&gt;&#xA;" OwnerUserId="33824" LastActivityDate="2017-07-24T22:16:59.070" Title="hp 1920 ARP limit" Tags="|switch|arp|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38355" PostTypeId="2" ParentId="38353" CreationDate="2017-01-25T12:07:43.480" Score="1" Body="&lt;p&gt;Please find below configuration for both cases from &lt;em&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/113692-technote-anyconnect-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;AnyConnect over IKEv2 to ASA with AAA and Certificate Authentication&lt;/a&gt;&lt;/em&gt;: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;Configuration on the ASA&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;This section describes the ASA configurations that are required before&#xA;  the connection occurs.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; The Cisco Adaptive Security Device Manager (ASDM) allows you to create the basic configuration with only a few clicks. Cisco&#xA;  recommends that you use it in order to avoid mistakes. &lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Crypto Map Configuration&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Here is a crypto map example configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto dynamic-map DYN 1 set pfs group1&#xA;crypto dynamic-map DYN 1 set ikev2 ipsec-proposal secure&#xA;crypto dynamic-map DYN 1 set reverse-route&#xA;crypto map STATIC 65535 ipsec-isakmp dynamic DYN&#xA;crypto map STATIC interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;h2&gt;IPsec Proposals&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Here is an IPsec proposal example configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ipsec ikev2 ipsec-proposal secure&#xA; protocol esp encryption aes 3des&#xA; protocol esp integrity sha-1&#xA;crypto ipsec ikev2 ipsec-proposal AES256-SHA&#xA; protocol esp encryption aes-256&#xA; protocol esp integrity sha-1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;h2&gt;IKEv2 Policies&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Here is an IKEv2 policy example configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ikev2 policy 1&#xA; encryption aes-256&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 10&#xA; encryption aes-192&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 20&#xA; encryption aes&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 30&#xA; encryption 3des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;crypto ikev2 policy 40&#xA; encryption des&#xA; integrity sha&#xA; group 5 2&#xA; prf sha&#xA; lifetime seconds 86400&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;h2&gt;Client Services and Certificate&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;You must enable client services and certificates on the correct&#xA;  interface, which is the outside interface in this case. Here is an&#xA;  example configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto ikev2 enable outside client-services port 443&#xA;crypto ikev2 remote-access trustpoint OUTSIDE&#xA;ssl trust-point OUTSIDE outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; The same trustpoint is also assigned for Secure Sockets Layer (SSL), which is intended and required.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Enable AnyConnect Profile&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;You must enable the AnyConnect profile on the ASA. Here is an example&#xA;  configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;webvpn&#xA; enable outside&#xA; anyconnect image disk0:/anyconnect-win-3.0.5080-k9.pkg 1 regex &quot;Windows NT&quot;&#xA; anyconnect profiles Anyconnect disk0:/anyconnect.xml&#xA; anyconnect enable&#xA; tunnel-group-list enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;h2&gt;Username, Group-Policy, and Tunnel-Group&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Here is an example configuration for a basic username, group-policy,&#xA;  and tunnel-group on the ASA:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;group-policy GroupPolicy_AC internal&#xA;group-policy GroupPolicy_AC attributes&#xA; dns-server value 4.2.2.2&#xA; vpn-tunnel-protocol ikev1 ikev2 l2tp-ipsec ssl-client ssl-clientless&#xA; default-domain value cisco.com&#xA; webvpn&#xA;  anyconnect profiles value Anyconnect type user&#xA;username cisco password 3USUcOPFUiMCO4Jk encrypted privilege 15&#xA;tunnel-group AC type remote-access&#xA;tunnel-group AC general-attributes&#xA; address-pool VPN-POOL&#xA; default-group-policy GroupPolicy_AC&#xA;tunnel-group AC webvpn-attributes&#xA; authentication aaa certificate&#xA; group-alias AC enable&#xA; group-url https://bsns-asa5520-1.cisco.com/AC enable&#xA; without-csd&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;h2&gt;AnyConnect Profile&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Here is an example profile with the relevant parts shown in bold:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&amp;gt;&#xA;&amp;lt;AnyConnectProfile xmlns=&quot;http://schemas.xmlsoap.org/encoding/&quot;&#xA; xmlns:xsi=&quot;http://www.w3.org/2001/XMLSchema-instance&quot; xsi:schemaLocation=&#xA; &quot;http://schemas.xmlsoap.org/encoding/ AnyConnectProfile.xsd&quot;&amp;gt;&#xA;   &amp;lt;ClientInitialization&amp;gt;&#xA;    &amp;lt;UseStartBeforeLogon UserControllable=&quot;true&quot;&amp;gt;false&amp;lt;/UseStartBeforeLogon&amp;gt;&#xA;    &amp;lt;AutomaticCertSelection UserControllable=&quot;true&quot;&amp;gt;false&#xA;      &amp;lt;/AutomaticCertSelection&amp;gt;&#xA;    &amp;lt;ShowPreConnectMessage&amp;gt;false&amp;lt;/ShowPreConnectMessage&amp;gt;&#xA;    &amp;lt;CertificateStore&amp;gt;All&amp;lt;/CertificateStore&amp;gt;&#xA;    &amp;lt;CertificateStoreOverride&amp;gt;false&amp;lt;/CertificateStoreOverride&amp;gt;&#xA;    &amp;lt;ProxySettings&amp;gt;Native&amp;lt;/ProxySettings&amp;gt;&#xA;    &amp;lt;AllowLocalProxyConnections&amp;gt;true&amp;lt;/AllowLocalProxyConnections&amp;gt;&#xA;    &amp;lt;AuthenticationTimeout&amp;gt;12&amp;lt;/AuthenticationTimeout&amp;gt;&#xA;    &amp;lt;AutoConnectOnStart UserControllable=&quot;true&quot;&amp;gt;false&amp;lt;/AutoConnectOnStart&amp;gt;&#xA;    &amp;lt;MinimizeOnConnect UserControllable=&quot;true&quot;&amp;gt;true&amp;lt;/MinimizeOnConnect&amp;gt;&#xA;    &amp;lt;LocalLanAccess UserControllable=&quot;true&quot;&amp;gt;false&amp;lt;/LocalLanAccess&amp;gt;&#xA;    &amp;lt;ClearSmartcardPin UserControllable=&quot;true&quot;&amp;gt;true&amp;lt;/ClearSmartcardPin&amp;gt;&#xA;    &amp;lt;AutoReconnect UserControllable=&quot;false&quot;&amp;gt;true&#xA;       &amp;lt;AutoReconnectBehavior UserControllable=&quot;false&quot;&amp;gt;DisconnectOnSuspend &#xA;        &amp;lt;/AutoReconnectBehavior&amp;gt;&#xA;    &amp;lt;/AutoReconnect&amp;gt;&#xA;    &amp;lt;AutoUpdate UserControllable=&quot;false&quot;&amp;gt;true&amp;lt;/AutoUpdate&amp;gt;&#xA;    &amp;lt;RSASecurIDIntegration UserControllable=&quot;true&quot;&amp;gt;Automatic&#xA;      &amp;lt;/RSASecurIDIntegration&amp;gt;&#xA;    &amp;lt;WindowsLogonEnforcement&amp;gt;SingleLocalLogon&amp;lt;/WindowsLogonEnforcement&amp;gt;&#xA;    &amp;lt;WindowsVPNEstablishment&amp;gt;LocalUsersOnly&amp;lt;/WindowsVPNEstablishment&amp;gt;&#xA;    &amp;lt;AutomaticVPNPolicy&amp;gt;false&amp;lt;/AutomaticVPNPolicy&amp;gt;&#xA;    &amp;lt;PPPExclusion UserControllable=&quot;false&quot;&amp;gt;Disable&#xA;       &amp;lt;PPPExclusionServerIP UserControllable=&quot;false&quot;&amp;gt;&amp;lt;/PPPExclusionServerIP&amp;gt;&#xA;    &amp;lt;/PPPExclusion&amp;gt;&#xA;    &amp;lt;EnableScripting UserControllable=&quot;false&quot;&amp;gt;false&amp;lt;/EnableScripting&amp;gt;&#xA;    &amp;lt;EnableAutomaticServerSelection UserControllable=&quot;false&quot;&amp;gt;false&#xA;       &amp;lt;AutoServerSelectionImprovement&amp;gt;20&amp;lt;/AutoServerSelectionImprovement&amp;gt;&#xA;       &amp;lt;AutoServerSelectionSuspendTime&amp;gt;4&amp;lt;/AutoServerSelectionSuspendTime&amp;gt;&#xA;    &amp;lt;/EnableAutomaticServerSelection&amp;gt;&#xA;    &amp;lt;RetainVpnOnLogoff&amp;gt;false&#xA;    &amp;lt;/RetainVpnOnLogoff&amp;gt;&#xA;  &amp;lt;/ClientInitialization&amp;gt;&#xA;  &amp;lt;ServerList&amp;gt;&#xA;      &amp;lt;HostEntry&amp;gt;&#xA;          &amp;lt;HostName&amp;gt;bsns-asa5520-1&amp;lt;/HostName&amp;gt;&#xA;          &amp;lt;HostAddress&amp;gt;bsns-asa5520-1.cisco.com&amp;lt;/HostAddress&amp;gt;&#xA;          &amp;lt;UserGroup&amp;gt;AC&amp;lt;/UserGroup&amp;gt;&#xA;      &amp;lt;PrimaryProtocol&amp;gt;IPsec&amp;lt;/PrimaryProtocol&amp;gt;&#xA;      &amp;lt;/HostEntry&amp;gt;&#xA;  &amp;lt;/ServerList&amp;gt;&#xA;&amp;lt;/AnyConnectProfile&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Here are some important notes about this configuration example:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;When you create the profile, the HostAddress must match the    Certificate Name (CN) on the certificate that is used for IKEv2.&lt;br&gt;&#xA;  Enter the &lt;strong&gt;crypto ikev2 remote-access trustpoint&lt;/strong&gt; command in order&#xA;  to    define this.&lt;/li&gt;&#xA;  &lt;li&gt;The UserGroup must match the name of the tunnelgroup to which the    IKEv2 connection falls. If they do not match, the connection often&lt;br&gt;&#xA;  fails and the debugs indicate a Diffie-Hellman (DH) group mismatch or &#xA;  a similar false negative.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;h2&gt;Verification on ASA&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Enter this command on the ASA in order to verify that the connection&#xA;  uses IKEv2 as well as AAA and certificate authentication:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bsns-asa5520-1# show vpn-sessiondb detail anyconnect filter name cisco&#xA;&#xA;Session Type: AnyConnect Detailed&#xA;Username : cisco Index : 6&#xA;Assigned IP : 172.16.99.5 Public IP : 1.2.3.4&#xA;Protocol : IKEv2 IPsecOverNatT AnyConnect-Parent&#xA;License : AnyConnect Premium&#xA;Encryption : AES256 AES128 Hashing : none SHA1 SHA1&#xA;Bytes Tx : 0 Bytes Rx : 960&#xA;Pkts Tx : 0 Pkts Rx : 10&#xA;Pkts Tx Drop : 0 Pkts Rx Drop : 0&#xA;Group Policy : GroupPolicy_AC Tunnel Group : AC&#xA;Login Time : 15:45:41 UTC Tue Aug 28 2012&#xA;Duration : 0h:02m:41s&#xA;Inactivity : 0h:00m:00s&#xA;NAC Result : Unknown&#xA;VLAN Mapping : N/A VLAN : none&#xA;IKEv2 Tunnels: 1&#xA;IPsecOverNatT Tunnels: 1&#xA;AnyConnect-Parent Tunnels: 1&#xA;AnyConnect-Parent:&#xA; Tunnel ID : 6.1&#xA; Public IP : 1.2.3.4&#xA; Encryption : none Auth Mode : Certificate and userPassword&#xA; Idle Time Out: 30 Minutes Idle TO Left : 27 Minutes&#xA; Client Type : AnyConnect&#xA; Client Ver : 3.0.08057&#xA;IKEv2:&#xA; Tunnel ID : 6.2&#xA; UDP Src Port : 60468 UDP Dst Port : 4500&#xA;Rem Auth Mode: Certificate and userPassword&#xA; Loc Auth Mode: rsaCertificate&#xA; Encryption : AES256 Hashing : SHA1&#xA; Rekey Int (T): 86400 Seconds Rekey Left(T): 86238 Seconds&#xA; PRF : SHA1 D/H Group : 5&#xA; Filter Name :&#xA; Client OS : Windows&#xA;IPsecOverNatT:&#xA; Tunnel ID : 6.3&#xA; Local Addr : 0.0.0.0/0.0.0.0/0/0&#xA; Remote Addr : 172.16.99.5/255.255.255.255/0/0&#xA; Encryption : AES128 Hashing : SHA1\&#xA; Encapsulation: Tunnel&#xA; Rekey Int (T): 28800 Seconds Rekey Left(T): 28638 Seconds&#xA; Rekey Int (D): 4608000 K-Bytes Rekey Left(D): 4608000 K-Bytes&#xA; Idle Time Out: 30 Minutes Idle TO Left : 27 Minutes&#xA; Bytes Tx : 0 Bytes Rx : 960&#xA; Pkts Tx : 0 Pkts Rx : 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="8499" LastEditDate="2017-01-25T15:42:59.487" LastActivityDate="2017-01-25T15:42:59.487" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38356" PostTypeId="1" AcceptedAnswerId="38358" CreationDate="2017-01-25T12:35:06.103" Score="6" ViewCount="2360" Body="&lt;p&gt;In the case only hubs are used to connect devices do we need ARP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packets will be forwarded to every device. So, when a packet whose destination IP doest does not match with the device IP, it will be discarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In such a scenario I believe that it is not efficient to generate ARP traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something?&lt;/p&gt;&#xA;" OwnerUserId="33603" LastEditorUserId="33603" LastEditDate="2018-08-02T15:16:41.803" LastActivityDate="2018-08-03T11:56:47.253" Title="Do we really need ARP when only hubs are used to connect devices?" Tags="|arp|" AnswerCount="5" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="38357" PostTypeId="2" ParentId="38356" CreationDate="2017-01-25T12:51:51.780" Score="1" Body="&lt;p&gt;Yes, you're missing the effectiveness of hardware (MAC based) filtering vs. software (IP address based) filtering.&lt;/p&gt;&#xA;" OwnerUserId="13967" LastActivityDate="2017-01-25T12:51:51.780" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38358" PostTypeId="2" ParentId="38356" CreationDate="2017-01-25T13:40:16.777" Score="3" Body="&lt;p&gt;The destination MAC address serves three functions.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It allows switches to limit the distribution of the frame.&lt;/li&gt;&#xA;&lt;li&gt;It allows network cards to filter out unwanted frames in hardware.&lt;/li&gt;&#xA;&lt;li&gt;It ensures unicast frames are received and processed by exactly one host/router, preventing packet duplication.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I am sure you could hack up a TCP/IP stack to remove arp and use a single MAC address for everything and you could make it work on a local network with only hubs and no switches or routers. Why anyone would want to do such a think I have no idea.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-25T13:40:16.777" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38359" PostTypeId="2" ParentId="38356" CreationDate="2017-01-25T13:57:36.230" Score="0" Body="&lt;p&gt;Peter and Jaap are both right but more fundamentally, we use a layered model to ensure interoperability between vendors.  The MAC layer uses a MAC address, full-stop.  ARP allows us to discover those MAC addresses rather than entering them manually into a table.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-01-25T13:57:36.230" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38361" PostTypeId="2" ParentId="38354" CreationDate="2017-01-25T14:27:13.037" Score="1" Body="&lt;p&gt;It sadly does have that limit of 256 entries. Perhaps there will be a &quot;Comware 7&quot; upgrade to this switch which will increase that limit, perhaps it won´t. But you can try to disable gratuitous ARP packets learning function &lt;code&gt;(Network -&amp;gt; ARP Management -&amp;gt; Gratuitous ARP)&lt;/code&gt;and delete dynamic ARP records.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this will work. &lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2017-01-25T14:27:13.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38362" PostTypeId="2" ParentId="38352" CreationDate="2017-01-25T15:24:21.323" Score="0" Body="&lt;p&gt;There are a couple of reason this may happen.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The switch to which the new host is connected could have STP enabled&#xA;on the access interface, and it is going through the STP&#xA;initialization (blocking, listening, learning, forwarding). You don't&#xA;detail the switch model, but you can skip the process on Cisco&#xA;switches by enabling &lt;code&gt;portfast&lt;/code&gt;.&lt;/li&gt;&#xA;&lt;li&gt;The new host doesn't yet have anything in it ARP cache, so it must&#xA;use ARP to discover the layer-2 address of its target. You often see&#xA;this on a new host when you ping: there will be one or two&#xA;unsuccessful pings before it starts to work.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-25T15:24:21.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38363" PostTypeId="2" ParentId="38350" CreationDate="2017-01-25T15:32:27.273" Score="1" Body="&lt;p&gt;Your question really needs more detail, and it is not completely clear, but I think you need to use VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs logically separate multiple networks on the same switch. Some switch interfaces can be in one VLAN, some in another, and others in other VLANs. For hosts connected to one VLAN to communicate with hosts in any other VLAN requires a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, assume the two switches each have 24 ports, and VLAN 10 has the &lt;code&gt;192.168.0.0/24&lt;/code&gt; network, while VLAN 20 has the &lt;code&gt;100.1.0.0/24&lt;/code&gt; network. You could assign the first 12 ports on each switch to VLAN 10, and the last 12 ports on each switch to VLAN 20. You will need to connect the two switch with a trunk, and you will need a trunk from one of the switches to a router if you want the devices on VLAN 10 to be able to communicate with the devices on VLAN 20.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-25T15:32:27.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38367" PostTypeId="1" AcceptedAnswerId="38376" CreationDate="2017-01-25T19:33:48.953" Score="1" ViewCount="7334" Body="&lt;p&gt;I would like to test my network with continuous ping in packet tracer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I use for example: &lt;code&gt;ping 192.168.4.100 -t&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Command line says &lt;code&gt;Invalid command&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I´m trying to ping from Laptop command line in packet tracer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there other ways to do that?&lt;/p&gt;&#xA;" OwnerUserId="24668" LastEditorUserId="8499" LastEditDate="2018-12-21T05:16:01.023" LastActivityDate="2018-12-21T05:16:01.023" Title="Continual ping in Packet Tracer" Tags="|ping|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38368" PostTypeId="2" ParentId="36605" CreationDate="2017-01-25T19:40:36.780" Score="1" Body="&lt;p&gt;Lets assume all arp tables are initially empty (not very realistic but meh) and that all the links use Ethernet-like protocols.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Host1 looks up host2's IP address in it's routing table to determine the interface and next hop IP address. It doesn't find any better matches so it uses the default gateway.&lt;/li&gt;&#xA;&lt;li&gt;Host1 looks up the next hop IP address (router1) in it's ARP table for the interface. It doesn't find a match.&lt;/li&gt;&#xA;&lt;li&gt;Host1 queues the packet and sends out an ARP request looking for Router1. &lt;/li&gt;&#xA;&lt;li&gt;Router1 replies to the ARP request.  &lt;/li&gt;&#xA;&lt;li&gt;Host1 updates it's ARP table dequeues the packet and sends it to router1&lt;/li&gt;&#xA;&lt;li&gt;Router1 looks up host2's IP address in it's routing table to determine the interface and next hop IP address. It finds a match which says it should send the packet to router2.&lt;/li&gt;&#xA;&lt;li&gt;Router1 looks up the next hop IP address (router2) in it's ARP table for the interface facing router2. It doesn't find a match.&lt;/li&gt;&#xA;&lt;li&gt;Router1 queues the packet and sends out an ARP request looking for router2&lt;/li&gt;&#xA;&lt;li&gt;Router2 replies to the ARP request.&lt;/li&gt;&#xA;&lt;li&gt;Router1 updates it's ARP table, dequeues the packet and sends it to router2.&lt;/li&gt;&#xA;&lt;li&gt;Router2 looks up host2's IP address in it's routing table to determine the interface and next hop IP address. It finds a match which says that host2 is on a local subnet. So the next hop IP address is the same as the destination address.&lt;/li&gt;&#xA;&lt;li&gt;Router2 looks up the next hop IP address (host2) in it's ARP table for the interface facing host2. It doesn't find a match.&lt;/li&gt;&#xA;&lt;li&gt;Router2 queues the packet and sends out an ARP request looking for host2&lt;/li&gt;&#xA;&lt;li&gt;host2 replies to the ARP request.&lt;/li&gt;&#xA;&lt;li&gt;Router2 updates it's ARP tables, deques the packet and sends it to host2.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-01-25T19:40:36.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38369" PostTypeId="2" ParentId="36122" CreationDate="2017-01-25T19:41:52.473" Score="1" Body="&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/configfun/configuration/guide/ffun_c/fcf013.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco IOS Configuration Fundamentals Configuration Guide, Release 12.2 Troubleshooting, Fault Management, and Logging&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You just finish your &lt;em&gt;standard&lt;/em&gt; ACL statement with the &lt;code&gt;log&lt;/code&gt; keyword.  The level of logging is configured per logging destination.  Note this may negatively impact performance of your networking device.  Use with caution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cf0xL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cf0xL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-25T19:41:52.473" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38370" PostTypeId="2" ParentId="38350" CreationDate="2017-01-25T19:54:28.443" Score="0" Body="&lt;p&gt;Yes this is possible.  It's quite basic really.  The subnets are typically bound to a designated VLAN, each of which has a default gateway to enable inter-vlan routing/connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, create an identical numbered/named VLAN for each subnet on both switches, maybe call them VLAN192 and VLAN100.  Enable a link (an uplink) between the switches to carry traffic for both VLAN's.  This is called a trunk interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that each switch has access to both VLAN's, enable IP routing on one of them and configure an interface VLAN192 and an interface VLAN100 with an IP address on each subnet, in other words interface VLAN192 gets 192.168.0.254 255.255.255.0, for example.  Same for other VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, clients with IP addressing including a default gateway will be able to communicate cross VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your switches don't support routing (layer3), you will require a dedicated router for interVLAN connectivity.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-25T19:54:28.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38371" PostTypeId="1" AcceptedAnswerId="38406" CreationDate="2017-01-25T20:22:33.583" Score="2" ViewCount="620" Body="&lt;p&gt;I created little network and set up OSPF protocol. When I took away one ethernet cable I was hoping to see change in routing table...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what happened was that the router only showed directly connected networks and none of the OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just a note: It still had other routers connected to it. All I removed was one cable out of the network.&lt;a href=&quot;https://i.stack.imgur.com/eRy7X.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eRy7X.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is R0 routing table when everything is connected.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     192.168.1.0/29 is subnetted, 1 subnets&#xA;C       192.168.1.0 is directly connected, FastEthernet0/1&#xA;     192.168.2.0/29 is subnetted, 1 subnets&#xA;C       192.168.2.0 is directly connected, FastEthernet0/0&#xA;     192.168.3.0/29 is subnetted, 1 subnets&#xA;O       192.168.3.0 [110/2] via 192.168.1.2, 00:00:49, FastEthernet0/1&#xA;     192.168.4.0/29 is subnetted, 1 subnets&#xA;O       192.168.4.0 [110/2] via 192.168.2.2, 00:00:49, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This s R0 routing table when I disconnect R1 and R0 (All the ospf networks dissapear)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     192.168.1.0/29 is subnetted, 1 subnets&#xA;C       192.168.1.0 is directly connected, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The question is why is it happening. Shouldn't it stay the same except for the one that is disconnected?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R0&#xA;Router(config)#router ospf 1&#xA;Router(config-router)#network 192.168.1.0 0.0.0.7 area 0&#xA;Router(config-router)#network 192.168.2.0 0.0.0.7 area 0&#xA;&#xA;R1&#xA;Router(config)#router ospf 1&#xA;Router(config-router)#network 192.168.2.0 0.0.0.7 area 0&#xA;Router(config-router)#network 192.168.4.0 0.0.0.7 area 0&#xA;&#xA;R2&#xA;Router(config)#router ospf 1&#xA;Router(config-router)#network 192.168.4.0 0.0.0.7 area 0&#xA;Router(config-router)#network 192.168.3.0 0.0.0.7 area 0&#xA;&#xA;R3&#xA;Router(config)#router ospf 1&#xA;Router(config-router)#network 192.168.3.0 0.0.0.7 area 0&#xA;Router(config-router)#network 192.168.1.0 0.0.0.7 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 692 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.2.1 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.1.1 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; network 192.168.1.0 0.0.0.7 area 0&#xA; network 192.168.2.0 0.0.0.7 area 0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show run&#xA;Building configuration...&#xA;&#xA;Current configuration : 692 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.2.2 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.4.1 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; network 192.168.2.0 0.0.0.7 area 0&#xA; network 192.168.4.0 0.0.0.7 area 0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 692 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.3.2 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.4.2 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; network 192.168.4.0 0.0.0.7 area 0&#xA; network 192.168.3.0 0.0.0.7 area 0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 692 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.3.1 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.1.2 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; network 192.168.3.0 0.0.0.7 area 0&#xA; network 192.168.1.0 0.0.0.7 area 0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24668" LastEditorUserId="2142" LastEditDate="2017-01-27T00:13:42.837" LastActivityDate="2017-01-27T00:13:42.837" Title="Why do I lose my OSPF routes?" Tags="|ospf|packet-tracer|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="38372" PostTypeId="1" AcceptedAnswerId="38375" CreationDate="2017-01-25T21:18:49.790" Score="3" ViewCount="4054" Body="&lt;p&gt;I have tried to find the answer on how network throttling works e.g. by ISP when they limit your access to say 100 Mbps. As far as I know TCP/IP itself does not have any mechanisms for that, so it is probably something on top of the protocol that interferes with the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that the packets received from the server are not sent directly to the client, but wait in some kind of throttling queue and the server does not send the next packet until the confirmation is received. I am not really a big expert on this, but would like to understand how this happens or maybe some good reference to how it works in simple terms, without too deep details (conceptual overview).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. Not sure if throttling is protocol dependent, perhaps it's the same techniques that are used for others.&lt;/p&gt;&#xA;" OwnerUserId="33837" LastEditorUserId="33837" LastEditDate="2020-04-14T07:41:35.093" LastActivityDate="2020-04-14T07:41:35.093" Title="How does throttling of network traffic work (to limit bandwidth by ISP e.g.)?" Tags="|routing|tcp|qos|bandwidth|layer4|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="38373" PostTypeId="1" AcceptedAnswerId="38374" CreationDate="2017-01-25T21:52:46.467" Score="1" ViewCount="114" Body="&lt;p&gt;We want to setup a small network on our corporate network which will emulate the setup that would be in place at our customers' sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a Windows 2016 server which we want to use as a DHCP server, but we obviously don't want it to affect the existing networks DHCP and Exchange servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the main part, this network wants to be invisible to the rest of the network. However, the server will also be used as a build machine as well as a demo server, so we need to be able to access it from the corporate network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be much appreciated!&lt;/p&gt;&#xA;" OwnerUserId="33835" LastEditorUserId="8499" LastEditDate="2017-01-25T22:32:09.937" LastActivityDate="2017-01-25T22:32:09.937" Title="Test network - subnet or VLAN?" Tags="|vlan|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38374" PostTypeId="2" ParentId="38373" CreationDate="2017-01-25T22:10:13.357" Score="1" Body="&lt;p&gt;The way many companies do this safely is to install a firewall between the production and test networks. You can use the firewall to permit or deny traffic as needed, even down to individual hosts if that is required, allowing the production network access to the test network, while denying most access from the test network to the production network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, you could require any communications between the networks to be initiated from the production network. Simply setting up a test VLAN with its own subnet could endanger the production network if anything goes wrong on the test network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-25T22:10:13.357" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38375" PostTypeId="2" ParentId="38372" CreationDate="2017-01-25T22:20:38.653" Score="5" Body="&lt;p&gt;This really has nothing to do with TCP, or any other layer-4 protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the most part, this is done simply through policing (dropping) any inbound packets that would exceed the bandwidth limit. Outbound packets could be policed or shaped to a specific bandwidth. Shaping does use queues, but queues are finite and fairly small, not like the buffering you see for watching a video, and when a queue gets full, the traffic to be queued gets dropped. There are multiple shaping strategies. ISPs tend to want things simple, and most probably just use policing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The whole QoS concept is far too large to explain in this site. There are entire books on QoS that have chapters on policing and shaping. You could do some further research on those concepts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How each ISP does this type of thing may vary from ISP to ISP, and networks not under your control are off-topic here, so we can't tell you what any particular ISP does for this.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-25T22:20:38.653" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="38376" PostTypeId="2" ParentId="38367" CreationDate="2017-01-26T00:55:06.860" Score="3" Body="&lt;p&gt;The -t has to go before the address, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ping -t 192.168.4.100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2017-01-26T00:55:06.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38380" PostTypeId="2" ParentId="32247" CreationDate="2017-01-26T10:22:59.867" Score="2" Body="&lt;p&gt;There will be 3rd step but in stealth scan third step is only RST where as on the other hand third step in Full open scan is ACK+RST.&lt;/p&gt;&#xA;" OwnerUserId="33853" LastActivityDate="2017-01-26T10:22:59.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38382" PostTypeId="1" AcceptedAnswerId="38385" CreationDate="2017-01-26T12:48:55.837" Score="1" ViewCount="1314" Body="&lt;p&gt;I use a firewall with two interfaces to protect my network but I don't know witch ports to close or open in LAN and WAN interface ?&#xA;thanks for your help !!&lt;/p&gt;&#xA;" OwnerUserId="33455" LastActivityDate="2017-01-26T14:18:14.803" Title="What is the ports that I should close in firewall to protect my LAN?" Tags="|firewall|security|lan|wan|port-security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38384" PostTypeId="2" ParentId="24762" CreationDate="2017-01-26T13:32:31.010" Score="1" Body="&lt;p&gt;&quot;Configure ASA to drop any IP fragments it receives as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA# conf t&#xA;ASA(config)# fragment chain 1&#xA;ASA(config)# exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Caution: Please note that this can be configured globally only, so it will affect all user traffic passing across the ASA, not only traffic specifically directed toward the Cisco ASA CX module. This configuration will result in all IP fragments being dropped by the ASA, even if this traffic will not be handled by the ASA CX module.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-cas?emailclick=CNSemail&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170125-cas?emailclick=CNSemail&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="33859" LastActivityDate="2017-01-26T13:32:31.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38385" PostTypeId="2" ParentId="38382" CreationDate="2017-01-26T14:18:14.803" Score="1" Body="&lt;p&gt;As @TeunVink mentions, you should close all ports, except only those needed for your network services.  Most firewalls, by default, do not allow inbound connections from WAN to LAN.  So the question is what ports should you open for outbound connections?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is one strategy: for a typical office, you can allow ports TCP 22, 80 and 443.  If you have an internal DNS server, you can allow UDP 53 for that server only.  If not, allow UDP 53 only to a few known public servers (Google, for example).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again, this is just an example.  You may have other business needs that require opening other ports.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-26T14:18:14.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38390" PostTypeId="1" CreationDate="2017-01-26T16:49:45.633" Score="1" ViewCount="61" Body="&lt;p&gt;My goal is make a web controller to connect and manage a configuration AP,&#xA;like &lt;a href=&quot;http://tanaza.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Tanaza&lt;/a&gt;, &lt;a href=&quot;http://ubnt.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ubiquiti&lt;/a&gt;, or Sophos.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do they communicate between server and my private network without port forwarding?&lt;/p&gt;&#xA;" OwnerUserId="33866" LastEditorUserId="8499" LastEditDate="2017-01-27T00:50:44.590" LastActivityDate="2017-01-27T00:50:44.590" Title="How does a cloud controller access point work?" Tags="|access-point|network|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38392" PostTypeId="2" ParentId="38390" CreationDate="2017-01-26T17:01:51.270" Score="1" Body="&lt;p&gt;Cloud controlled network devices initiate the communication to the cloud. This is the same way that hosts with web browsers communicate with web servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a privately addressed network, it uses NAT to communicate with the public Internet. NAT will maintain a table of connections from inside to outside so that any connection initiated from the inside can receive responses from the outside. Port forwarding is really just making a permanent entry in the NAT table, allowing communications to be initiated from the outside.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;As a side note, you need to be very, very careful with security and cloud controlled devices. The recent IoT takeover and nefarious use of such devices in a massive DDoS attack demonstrates the problem.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-26T17:01:51.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38395" PostTypeId="1" AcceptedAnswerId="38398" CreationDate="2017-01-26T18:34:29.183" Score="1" ViewCount="376" Body="&lt;p&gt;I need to calculate the max length of a collision domain.&#xA;There is this &lt;a href=&quot;https://wikimedia.org/api/rest_v1/media/math/render/svg/b7557843f69e1ac3177238cc37e5e18b545c80f4&quot; rel=&quot;nofollow noreferrer&quot;&gt;formula.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short: &lt;code&gt;maxLength = (c * velocityFactor * 512 Bit)/(vBit)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;c = speed of light&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;velocity factor = ?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;vBit = bit transfer speed&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Well I know that the velocity factor of a COAX cable is ~0,77. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what is the VF of twisted pair? Or other cable types? One of my CD's is 600m --&gt; so the VF should be ~0,27. Is this possible?&lt;/p&gt;&#xA;" OwnerUserId="33854" LastEditorUserId="8499" LastEditDate="2018-03-21T00:29:59.083" LastActivityDate="2019-01-19T13:44:27.723" Title="Velocity(factor) of different cable types - Collision domain" Tags="|layer1|cable|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="38396" PostTypeId="1" AcceptedAnswerId="38397" CreationDate="2017-01-26T18:57:39.353" Score="1" ViewCount="509" Body="&lt;p&gt;I have a L2 port-channel, up and running, between two Cisco switches 3560 and 3750E. Traffic is load-balanced fine by &lt;code&gt;src-dest-ip&lt;/code&gt;, but I have one problem: I can't ping the radio links connected to each one of the ports of the bundle from my NMS server. I am sure that this is a problem related to arp-mac address tables and load-balanced traffic. The MAC table entries are correct to the portchannel interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea to resolve the connectivity issue?&#xA;I can't separate the two VLANs passing through the portchannel, and static mac assignation to the portchannel interface doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devices sometimes respond to ping and sometimes not, and it depends on the device from which I am pinging.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yFaOe.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yFaOe.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2028" LastEditorUserId="8499" LastEditDate="2018-12-25T03:36:33.570" LastActivityDate="2018-12-25T03:36:33.570" Title="Ping to radio links attached to port-channels interfaces" Tags="|cisco|switch|cisco-catalyst|port-channel|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38397" PostTypeId="2" ParentId="38396" CreationDate="2017-01-26T19:23:56.123" Score="1" Body="&lt;p&gt;You are running into a problem with the port-channel hash algorithm. To the switch, the port-channel is now the interface, not the physical interfaces, and which physical interface is used is up to the hash algorithm. The algorithm you are using is apparently giving you a different interface at different times. You probably use one that takes into account the source address, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, the algorithm may cause you to need to change the link where a radio connects if the hash is going to send the traffic for a MAC address out the opposite link, or you may need to change the MAC addresses on your radios.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can try to change the algorithm to see if that fixes your problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/lan-switching/etherchannel/12023-4.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Understanding EtherChannel Load Balancing and Redundancy on Catalyst Switches&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Catalyst 3750/3560&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The Catalyst 3750/3560 series switch can support up to eight&#xA;  compatibly configured Ethernet interfaces in an EtherChannel. The&#xA;  EtherChannel provides full-duplex bandwidth up to 800 Mbps (Fast&#xA;  EtherChannel) or 8 Gbps (Gigabit EtherChannel) between your switch and&#xA;  another switch or host. With Cisco IOS Software Release 12.2(20)SE and&#xA;  earlier, the number of EtherChannels has a limit of 12. With Cisco IOS&#xA;  Software Release 12.2(25)SE and later, the number of EtherChannels has&#xA;  a limit of 48.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;EtherChannel balances the traffic load across the links in a channel&#xA;  through the reduction of part of the binary pattern that the addresses&#xA;  in the frame form to a numerical value that selects one of the links&#xA;  in the channel. EtherChannel load balancing can use MAC addresses or&#xA;  IP addresses, source or destination addresses, or both source and&#xA;  destination addresses. The mode applies to all EtherChannels that are&#xA;  configured on the switch. You configure the load balancing and&#xA;  forwarding method with use of the &lt;strong&gt;port-channel load-balance {dst-ip&#xA;  | dst-mac | src-dst-ip | src-dst-mac | src-ip | src-mac}&lt;/strong&gt; global&#xA;  configuration command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;You can find out which interface is used in the EtherChannel to&#xA;  forward traffic based on the load balancing method. The command for&#xA;  this determination is &lt;strong&gt;test etherchannel load-balance interface&#xA;  port-channel&lt;/strong&gt; &lt;em&gt;number&lt;/em&gt; &lt;strong&gt;{ip | mac}&lt;/strong&gt; [&lt;em&gt;source_ip_add&lt;/em&gt; |&#xA;  &lt;em&gt;source_mac_add&lt;/em&gt;] [&lt;em&gt;dest_ip_add&lt;/em&gt; | &lt;em&gt;dest_mac_add&lt;/em&gt;].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;While what you are doing may work for the traffic, it is a very bad idea. Trying to run a port channel across links that changes speed on the link can cause problems.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-26T19:23:56.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38398" PostTypeId="2" ParentId="38395" CreationDate="2017-01-26T19:24:55.107" Score="1" Body="&lt;p&gt;Thanks to Ron Maupin, I now understand what's wrong with my question. &#xA;I misunderstood velocity factor with the nominal velocity of propagation (NVP). &#xA;Which is about 60-100% depends on the cable type. This means, I think so, you can always use a value between this borders of you don't know the cable type. &lt;/p&gt;&#xA;" OwnerUserId="33854" LastEditorUserId="33854" LastEditDate="2019-01-19T13:44:27.723" LastActivityDate="2019-01-19T13:44:27.723" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="38402" PostTypeId="1" AcceptedAnswerId="38403" CreationDate="2017-01-26T20:51:53.567" Score="1" ViewCount="549" Body="&lt;p&gt;I am reading about field buses and for instance the HART protocol and PROFIBUS call their level 2 frames telegrams. Is this on purpose to differentiate from datagrams (a term used for instance in the IP protocol) in a qualitative way?&lt;/p&gt;&#xA;" OwnerUserId="30828" LastActivityDate="2018-08-07T17:26:00.950" Title="Is a telegram different from a datagram?" Tags="|protocol-theory|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38403" PostTypeId="2" ParentId="38402" CreationDate="2017-01-26T20:58:32.783" Score="3" Body="&lt;p&gt;Practically, it's the same thing.&#xA;But as far as I know, the word &quot;datagram&quot; is not used in some industrials protocols because they don't always carry data, sometimes they are used for control.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it's just a semantic difference for me.&lt;/p&gt;&#xA;" OwnerUserId="33518" LastEditorUserId="33518" LastEditDate="2018-08-07T17:26:00.950" LastActivityDate="2018-08-07T17:26:00.950" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="38404" PostTypeId="1" AcceptedAnswerId="38405" CreationDate="2017-01-26T23:05:02.237" Score="1" ViewCount="2933" Body="&lt;p&gt;We have an L2 path between a tape drive and a NetApp. The path goes through 3 switches (a 6509 and two N5K) but the two devices are on the same VLAN. All 10 gig fiber. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found out that while most of the ports in the path are set to an MTU of 9216, one of them (the port on the 6509 core going to the first N5K) is set to 1500. The interface on the other side is set to 9216.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are getting a max of 750 Mpbs between these two systems and I'm thinking this might be the cause.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm guessing that the systems are using PMTUD in this situation and are using 1500 byte frames when talking to each other but this is causing less optimal data transfer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been told by Cisco that to change this, I need to enable system jumbomtu 9216 on the 6509 (it's not set right now) and then set the interface MTU to 9216 as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is our core switch I'm hesitant to do this without knowing how the system jumbomtu will affect things. Since it has a redundant non-VSS sister, I should make the change on both of them. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would there be any ill effects of making this change?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm reading things in Cisco's docs that I don't fully understand. For example, the setting jumbo MTU config section says:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;For Layer 2 Ethernet ports, you can configure only the global egress LAN port MTU size&quot; &amp;lt;- (which is set using system jumbomtu)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several L2 (non routed, non SVI) ports configured for both 1500 and 9216 yet the system jumbomtu command is not set on this switch. Does that mean that the 9216 setting on these L2 ports is getting ignored?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I set system jumbomtu 9216, will this effectively change all the L2 ports to an egress MTU of 9216?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Catalyst switches are running IOS 12.2. No CatOS.&lt;/p&gt;&#xA;" OwnerUserId="23610" LastEditorUserId="8499" LastEditDate="2017-01-26T23:44:38.847" LastActivityDate="2017-01-27T00:19:23.323" Title="Setting system jumbomtu on Cat 6500" Tags="|cisco|cisco-ios|cisco-catalyst|mtu|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38405" PostTypeId="2" ParentId="38404" CreationDate="2017-01-26T23:19:45.893" Score="1" Body="&lt;p&gt;I think you may be confusing the VLAN database MTU and the interface MTU. Pay special attention to the note at the end. Enabling jumbo frames in the VLAN database for a VLAN will not suddenly cause all the switch interfaces in that VLAN to be enabled for jumbo frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6000-series-switches/24048-148.html#c1&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Jumbo/Giant Frame Support on Catalyst Switches Configuration Example&lt;/em&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Catalyst 6000/6500 / Cisco 7600 OSR Series&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;The Catalyst 6000 series and 7600 Optical Services Router (OSR)&#xA;  platform can support jumbo frame sizes as of release 6.1(1) of CatOS,&#xA;  and 12.1(1)E for Native IOS. However, this is dependent on the type of&#xA;  line cards that you use. There are generally no restrictions to enable&#xA;  the jumbo frame size feature. You can use this feature with&#xA;  trunking/non-trunking and channeling/non-channeling. The default MTU&#xA;  size is 9216 bytes after you enable jumbo frame support on the&#xA;  individual port. However, an Application Specific Integrated Circuit&#xA;  (ASIC) limitation requires that you limit the MTU size to 8092 bytes&#xA;  on these 10/100-based line cards:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;WS-X6248-RJ-45&lt;/li&gt;&#xA;  &lt;li&gt;WS-X6248A-RJ-45&lt;/li&gt;&#xA;  &lt;li&gt;WS-X6248-TEL&lt;/li&gt;&#xA;  &lt;li&gt;WS-X6248A-TEL&lt;/li&gt;&#xA;  &lt;li&gt;WS-X6348-RJ-45&lt;/li&gt;&#xA;  &lt;li&gt;WS-X6348-RJ-45V&lt;/li&gt;&#xA;  &lt;li&gt;WS-X6348-RJ-21&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;The WS-X6516-GE-TX is also affected at 100 Mbps. At 10/1000 Mbps, up&#xA;  to 9216 bytes can be supported. However, the WS-X6548-RJ-45 line card&#xA;  is not affected, as this line card uses newer ASICs.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; Jumbo frame support is available on WS-X6101 ATM modules.&lt;/p&gt;&#xA;  &#xA;  &lt;h2&gt;Configure Native IOS&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7609(config)#int gigabitEthernet 1/1 &#xA;7609(config-if)#mtu ? &#xA;  &amp;lt;1500-9216&amp;gt;  MTU size in bytes &#xA;&#xA;7609(config-if)#mtu 9216&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;h2&gt;Verify in Native IOS&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;7609#show interfaces gigabitEthernet 1/1 &#xA;GigabitEthernet1/1 is up, line protocol is up (connected) &#xA;  Hardware is C6k 1000Mb 802.3, address is 0007.0d0e.640a (bia 0007.0d0e.640a) &#xA;  MTU 9216 bytes, BW 1000000 Kbit, DLY 10 usec, &#xA;  reliability 255/255, txload 1/255, rxload 1/255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;The port ASICs on the Catalyst 6000 count as oversized, which are&#xA;  those frames greater than 1548 bytes but less than the configured&#xA;  jumbo MTU. It uses the rxOversizedPkts counter to track these frames&#xA;  in the output from the &lt;strong&gt;show counter &lt;/strong&gt; command. In this&#xA;  case, the ifInErrors counter value increments and can equal the number&#xA;  of rxOversizedPkts packets value in the &lt;strong&gt;show counter &lt;/strong&gt;&#xA;  command output. On a Catalyst 6000 that runs Cisco Integrated IOS&#xA;  (Native Mode), use the &lt;strong&gt;show interface &lt;/strong&gt; command to&#xA;  check whether the input errors counter increments along with giant&#xA;  counters on the interface that receives these frames.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; There is no relationship between the MTU value that you can specify in the VLAN database and the mtu command in the interface&#xA;  configuration mode. With the VLAN database setting, the switch checks&#xA;  for an MTU value greater than 1500. If the switch detects a higher&#xA;  value, puts the VLAN in a non-operational state. Therefore, to support&#xA;  large frames, you only need to change the interface MTU value and not&#xA;  the VLAN database MTU value. If SVI is used, then in order to support&#xA;  large frames, you must increase the MTU on the SVI to route the&#xA;  traffic between VLANs . Refer to the &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/intrface.html#wp1041111&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Configuring Jumbo Frame&#xA;  Support&lt;/em&gt;&lt;/a&gt; section of &lt;a href=&quot;http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/intrface.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Interface Configuration&lt;/em&gt;&lt;/a&gt; for more&#xA;  information about Jumbo Frame support on the Catalyst 6500.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In any case, a switch will not send out jumbo frames to an interface, even on an interface with jumbo frames enabled, unless it receives incoming jumbo frames destined for that interface.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your concern about the &lt;code&gt;system jumbomtu&lt;/code&gt; command is misplaced. That command sets the non-default MTU size to which you can configure some types of interfaces, but it doesn't actually set the interface MTU size. The warning is about setting the value to the default ethernet MTU value. Doing that will change all the interfaces with non-default MTU sizes back to the default value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The default for the &lt;code&gt;system jumbomtu&lt;/code&gt; is 9216, which seems to be what you want, so you should not need to change that value. If, however, you set your 10 Gb MTU to 9216, then you change the &lt;code&gt;system jumbomtu&lt;/code&gt; value to 1500, you will find that any interfaces where you changed the MTU to 9216 will now have an MTU&quot; of 1500 because the &lt;code&gt;system jumbomtu&lt;/code&gt; is now different than what you are allowed to set the MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, for some types of interfaces, You can either use the default MTU of 1500, or you can change the MTU to the value set by the &lt;code&gt;system jumbomtu&lt;/code&gt; command, but not any other value.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-27T00:19:23.323" LastActivityDate="2017-01-27T00:19:23.323" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="38406" PostTypeId="2" ParentId="38371" CreationDate="2017-01-26T23:20:03.817" Score="3" Body="&lt;p&gt;The problem you see is caused by the lack of a stable router ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF requires a router ID to identify itself in routing updates. If you don't manually specify the router ID, the router will use the highest loopback address as the router ID.  Since you haven't created a loopback interface, the router chooses the highest interface address as the router ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you unplug a cable, the IP address on that interface is no longer valid (because the interface is down). So the OSPF process stops running.  That's why you don't see any OSPF routes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good practice is to manually create a router ID:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1&#xA;router-id 1.1.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that although the router ID is written in dotted decimal like an IP address, it is not an address -- it's just a number.  Pick any unique number you like.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you can create a loopback interface.  The router will use this address as the router ID. Since it's a virtual interface, it never goes down.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback 0&#xA;ip address 1.1.1.1 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-26T23:20:03.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38414" PostTypeId="1" AcceptedAnswerId="38422" CreationDate="2017-01-27T09:39:06.267" Score="0" ViewCount="353" Body="&lt;p&gt;I have just bought one of these: &lt;a href=&quot;http://www.maplin.co.uk/p/ultra-high-speed-adsl-cable-5m-a96cg?cmpid=ppc&amp;amp;gclid=Cj0KEQiA_KvEBRCtzNil4-KR-LIBEiQAmgekF3UvjZnXVhaZqLbXrSsakpU1-phMOHfGTf3oWtoolq4aAqxp8P8HAQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ultra High Speed ADSL Cable 5m&lt;/a&gt; to move my router from the hall into my living room.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before and after I installed it I did a batch of speed tests. I was getting 75-80 Mbps which is as high as it has ever been so I assumed that the new cable had not degraded my connection at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today whilst working from home I have noticed the remote connection not responding a few times so I set up a ping to my ISP's first hop and sure enough I was getting more missed packets than I would expect. (I was also pinging my router over wifi and basically got no lost packets there so I can assume that the packets are going missing between my router and my ISP - implicating the RJ11 cable or something external to the house).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I was running the cable I forced it under the skirting board to go round a door. This was a tight fit and I had to use a relatively large amount of force to squeeze the cable in there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have now pulled the cable out from this point and I do not seem to be dropping any packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible for a cable that is squeezed to provide a poor network connection then for it to &quot;recover&quot; when it is no longer compressed? I can't see how the physics here would work. Surely if the cables are still properly insulated it wouldn't matter if they are squeezed!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="8772" LastActivityDate="2017-01-27T15:08:38.967" Title="Can squeezing an RJ11 cable affect network performance?" Tags="|cabling|adsl|network|" AnswerCount="2" CommentCount="1" ClosedDate="2017-01-27T16:11:34.647" ContentLicense="CC BY-SA 3.0" />
  <row Id="38415" PostTypeId="2" ParentId="38414" CreationDate="2017-01-27T10:51:57.790" Score="0" Body="&lt;p&gt;Yes, it may affect network speed. When cable becomes squeezed, it becomes a little hot and affects speed.&lt;/p&gt;&#xA;" OwnerUserId="23552" LastActivityDate="2017-01-27T10:51:57.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38416" PostTypeId="1" AcceptedAnswerId="38418" CreationDate="2017-01-27T11:09:52.173" Score="4" ViewCount="695" Body="&lt;p&gt;I have surfed the Internet and have not found much information &lt;br&gt;&#xA;about benefits of AAA. &lt;br&gt;&#xA;What is AAA? Do we have to use it? Is it kind of encryption? &lt;br&gt;&#xA;It is not clear to me.&#xA;Who can explain? &lt;br&gt;&#xA;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="23552" LastActivityDate="2017-02-15T03:16:45.153" Title="What AAA is needed for? How is it secure?" Tags="|routing|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38417" PostTypeId="1" CreationDate="2017-01-27T12:02:42.893" Score="1" ViewCount="1674" Body="&lt;p&gt;I have a Cisco router connected to a TACACS server via two interfaces. As a prerrequisite, no loopback should be set on the router. My question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to set these two interfaces as source interfaces in my router? The Cisco command to set a source interface for TACACS is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip tacacs source-interface &amp;lt;my-interface&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Luis&lt;/p&gt;&#xA;" OwnerUserId="32663" LastActivityDate="2017-01-27T12:33:55.590" Title="TACACS: multiple source interfaces" Tags="|cisco|interface|tacacs|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38418" PostTypeId="2" ParentId="38416" CreationDate="2017-01-27T12:21:44.857" Score="5" Body="&lt;p&gt;AAA is a big topic and this forum is not the place for a full discussion.  But briefly, AAA is a model for controlling access.  It specifies how clients (users) are identified (Authentication), what they are allowed to do (Authorization), and how the user's actions are monitored (Accounting). It also specifies the components (functions) for controlling access.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer your specific questions:&#xA;No, you don't have to use it.   You can use simple passwords on Cisco routers, for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AAA is not an encryption algorithm.  But encryption is often used as part of the authentication and authorization functions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can read more about AAA in articles like &lt;a href=&quot;http://www.cisco.com/c/en/us/about/press/internet-protocol-journal/back-issues/table-contents-35/101-aaa-part1.html&quot;&gt;&lt;em&gt;Network Authentication, Authorization, and Accounting: Part One&lt;/em&gt;&lt;/a&gt;, by Sean Convery.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-01-27T12:53:21.853" LastActivityDate="2017-01-27T12:53:21.853" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38419" PostTypeId="2" ParentId="38417" CreationDate="2017-01-27T12:33:55.590" Score="1" Body="&lt;p&gt;Not using a loopback address can cause many problems, as you will likely discover on your own ;-p&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The command you quote is used to specify the source interface, if I understand your question.  You can only specify one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't specify the source interface, the router will use the interface closest to the destination, based on the routing table. If you don't specify an interface, then the source interface can change if there is a topology change.  Your AAA server may not recognize the new address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do specify a physical interface and that interface goes down, TACACS stops working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use a loopback interface, the source address never changes, since the interface never goes down.  This is considered a good practice.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-27T12:33:55.590" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38421" PostTypeId="2" ParentId="17737" CreationDate="2017-01-27T14:16:15.857" Score="0" Body="&lt;p&gt;I have both, from my experience the Edge Router has more of a learning curve, however it is a faster and more powerful ROUTER, don't use this for any switching though it will take a performance hit. The Cisco RV325 however isn't great for big networks but it is easy and quick to set up. This device as a router is slower than the EdgeRouter.&lt;/p&gt;&#xA;" OwnerUserId="33896" LastActivityDate="2017-01-27T14:16:15.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38422" PostTypeId="2" ParentId="38414" CreationDate="2017-01-27T15:08:38.967" Score="0" Body="&lt;p&gt;With balanced twisted pair cables running at high frequencies, like for data, untwisting the pairs can have a detrimental affect on performance. Squeezing a cable will spread the twists out. There are problems if you exceed the pulling tension of minimum bend radius, and you can permanently damage the cable.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-27T15:08:38.967" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38425" PostTypeId="2" ParentId="38416" CreationDate="2017-01-27T17:41:32.780" Score="-6" Body="&lt;p&gt;AAA defines the model of gaining access to a network,e.g., 4gLTE connections, aDSL PPP, PPPoE cable modem, etc. AAA relates to network access (not application access, e.g. email or Facebook).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;acronym&lt;/em&gt; AAA is in measurable decline according to the below Google Trend Views.  Note the differences from perspectives of &quot;computers&quot; vs &quot;telecom&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Higher layer (Web) security implementations are trending on the Authentication front, namely SSL/TLS (aka clientless VPN).  You see this as a preferred approach in WiFi and VPN access, for example (See Cisco AnyConnect Premium / &quot;clientless SSL VPN&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/IF2Oq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/IF2Oq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/SvEbt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/SvEbt.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2017-02-15T03:16:45.153" LastActivityDate="2017-02-15T03:16:45.153" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38428" PostTypeId="1" AcceptedAnswerId="38429" CreationDate="2017-01-27T20:38:45.727" Score="1" ViewCount="2154" Body="&lt;p&gt;I am working with Cisco Nexus 3000 switch. I was under the assumption that a switch will always have a single MAC address but when I ran the following command, it displayed two different MAC addresses though only the first two bytes were different.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interface ethernet 1/17 mac-address&#xA;&#xA;Output:&#xA;MAC-Address              Burn-in-Mac-Address&#xA;ab:cd:ef:gh:ij:12        ab:cd:ef:gh:ij:78&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Each interface on the switch has a different MAC. Can someone explain to me the importance of this? When does the common MAC address and interface specific addresses be used?&lt;/p&gt;&#xA;" OwnerUserId="24153" LastEditorUserId="8499" LastEditDate="2017-01-28T03:35:04.327" LastActivityDate="2021-01-24T10:49:28.123" Title="Why does a switch have different MAC addresses?" Tags="|cisco|switch|mac-address|switching|layer2|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38429" PostTypeId="2" ParentId="38428" CreationDate="2017-01-27T21:09:45.393" Score="3" Body="&lt;p&gt;Cisco assigns a large block, e.g. 1024, MAC addresses to a switch supervisor for use in STP because Cisco defaults to PVST+ and needs a MAC address for each VLAN. Each interface that may send ethernet traffic needs a unique MAC address. Logical interfaces, e.g. SVIs, will also get MAC addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-27T21:09:45.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38432" PostTypeId="1" AcceptedAnswerId="38440" CreationDate="2017-01-28T01:16:02.137" Score="2" ViewCount="12551" Body="&lt;p&gt;I'm coming to terms with JunOS, and I have set up a lab that includes two SRX210s. I have set ge-0/0/1 on both devices to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ge-0/0/1 {&#xA;unit 0 {&#xA;    family inet {&#xA;        address 20.0.0.1/24;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;.1 on SRX1 and .2 on SRX2. Because they are directly connected and on the same subnet, a route should be visible, but when I perform a show route, I don't see anything. Perhaps I am missing something here? Am I making some stupid, rookie mistake that I will later be forced to kick myself over?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further details: Not even learning a mac over these interfaces, but I do if I use family ethernet-switching instead. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to anyone with any idea!&lt;/p&gt;&#xA;" OwnerUserId="27412" LastActivityDate="2017-02-07T10:00:07.530" Title="Can't ping directly connected SRX210 (Juniper)" Tags="|routing|juniper|juniper-srx|srx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38434" PostTypeId="2" ParentId="26452" CreationDate="2017-01-28T01:52:29.740" Score="2" Body="&lt;p&gt;&lt;strong&gt;LLDP&lt;/strong&gt; is the tool for discovering/visibility into switches on your LAN(s).  BTW, if you don't have access to any of them via console, issue LLDP commands from your router, try and web into your default gateway, or load an LLDP client on your laptop.  Something like &lt;a href=&quot;https://www.hanewin.net/lldp-e.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.hanewin.net/lldp-e.htm&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h3&gt;&lt;a href=&quot;https://e-catalog.hirschmann.com/download/managed/pim/c976d9c2-5371-46ce-8773-aa043f046d6a/RM_CLI_L2B_40_en.pdf;jsessionid=6C6ED1A05904D9EB3403304E98C812C2?type=attachment&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hirschmann Reference Manual&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;p&gt;&lt;code&gt;show lldp remote-data &amp;lt;{slot/port|all}&amp;gt; mgmt-addr&lt;/code&gt;&#xA;Display the remote data's management address only.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;4.8.13 lldp Enable/disable the LLDP/IEEE802.1AB functionality on this device. If disabled, the LLDP protocol will become inactive, but the&#xA;LLDP MIBs can still be accessed. This command is a shorthand notation&#xA;for lldp config chas sis admin-state {off|on} (see “lldp config&#xA;chassis admin-state” on page 153).&#xA;&lt;strong&gt;The default setting is on.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-01-28T01:58:56.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38435" PostTypeId="1" CreationDate="2017-01-28T06:03:13.800" Score="0" ViewCount="703" Body="&lt;p&gt;I am a newbie in network engineering. Now, I want to know how a browser understands a subnet mask in IPv4. For example, &lt;code&gt;78.39.197.180&lt;/code&gt; with &lt;code&gt;255.255.0.0&lt;/code&gt; is a unique address, and &lt;code&gt;78.39.197.180&lt;/code&gt; with &lt;code&gt;255.255.255.0&lt;/code&gt; is a unique address, too. So, when i put the address in a browser, how can the browser understand which one of those is my need?&lt;/p&gt;&#xA;" OwnerUserId="33929" LastEditorUserId="8499" LastEditDate="2017-01-28T15:51:29.987" LastActivityDate="2017-01-28T15:51:29.987" Title="How does a browser understand a subnet mask in IPv4?" Tags="|ipv4|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38436" PostTypeId="2" ParentId="38435" CreationDate="2017-01-28T08:30:51.350" Score="2" Body="&lt;p&gt;Those two addresses are the same, there's not distinction. Changing the netmask does not make it a different IP address, it just changes which range of addresses is considered to be the local network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, browsers do nothing with netmasks, they only know IP addresses and DNS names. You can't enter a netmask in a browser.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-01-28T08:30:51.350" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38437" PostTypeId="1" AcceptedAnswerId="38438" CreationDate="2017-01-28T08:41:54.907" Score="2" ViewCount="3927" Body="&lt;p&gt;I'm working on a project where I could need Nexus 5600. These switches support sampled netflow and not netflow. I would like to use netflow to do stats and to analyze trafic at some specific times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is sampled netflow good for watching trafic at a time where I underwent a problem?&#xA;I mean, as it exports just a rate of packets, I won't have a good view of the amount of trafic that passed really?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm hesistating between sampled netflow and SPAN with a netflow 3000 appliance. It could be a good solution too but the switch can just handle 2 sessions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do you recommend?&lt;/p&gt;&#xA;" OwnerUserId="24395" LastActivityDate="2017-01-28T15:47:10.217" Title="Netflow vs sampled netflow" Tags="|monitoring|netflow|mirror|cisco-nexus-5k|cisco-nexus|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38438" PostTypeId="2" ParentId="38437" CreationDate="2017-01-28T09:20:36.763" Score="3" Body="&lt;p&gt;For traffic analysis sampled netflow is often used, because 1:1 sampling (or non-sampled) netflow can be quite a burden on both the router sending the flow data and on the flow receiver. Most setups I've seen use a sampling rate varying from 1:100 upto 1:4000 (depending on the size of the network and the amount of traffic pushed), and they're perfectly able to do traffic anomaly analysis (DDoS detection) or even customer usage billing with that.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-01-28T09:20:36.763" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38439" PostTypeId="2" ParentId="38437" CreationDate="2017-01-28T10:46:52.597" Score="0" Body="&lt;p&gt;Sampling is good for determining top applications.  If you need to perform investigations, you will probably desire 100% flow collection. It can be frustrating when you go to look at traffic from a specific host and it wasn't sampled enough or at all. If you are just looking to get over all traffic utilization, use SNMP if it is an option.  Multiplying the sampled flows in order to determine the actual utilization will give some pretty crazy results which can often be misleading.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read that the 5000 can only sample NetFlow which means you might not have many options. If you haven't purchased the switch yet, you might want to consider a switch that allows you to avoid sampling.   &lt;/p&gt;&#xA;" OwnerUserId="33937" LastEditorUserId="8499" LastEditDate="2017-01-28T15:47:10.217" LastActivityDate="2017-01-28T15:47:10.217" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38440" PostTypeId="2" ParentId="38432" CreationDate="2017-01-28T10:55:51.167" Score="4" Body="&lt;p&gt;In junos it is not enough to just assign IP to the interface to be functional , for interface to be pinable you need to do the below : &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;assign the interface for security zone : &#xA;EX: set security zones security-zone untrust interfaces ge-0/0/1.0 &lt;/li&gt;&#xA;&lt;li&gt;you have to enable ping in the security zone : &#xA;EX: set security zones security zone host inbound traffic system services  ping&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="1906" LastEditDate="2017-02-07T10:00:07.530" LastActivityDate="2017-02-07T10:00:07.530" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38444" PostTypeId="2" ParentId="13293" CreationDate="2017-01-28T20:50:14.813" Score="2" Body="&lt;p&gt;Mikrotik Graphing only displays download/upload speed, but not the data usage as in how much mb was downloaded/uploaded during a period of time.&lt;/p&gt;&#xA;" OwnerUserId="33945" LastActivityDate="2017-01-28T20:50:14.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38448" PostTypeId="1" CreationDate="2017-01-29T07:48:30.733" Score="4" ViewCount="3450" Body="&lt;p&gt;Consider the below topology:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/8Ocxw.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8Ocxw.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine that both the vPC peer keepalive link and vPC peer link have gone down.&#xA;I am trying to understand how will that lead to unpredictable traffic flows or loops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what i have read on Cisco docs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;If the vPC keepalive link fails first and then a peer &#xA;link fails, the vPC secondary switch assumes the &#xA;primary switch role and keeps its vPC member ports up.&#xA;If the peer link and keepalive link fails, there could &#xA;be a chance that both vPC switches are healthy and the &#xA;failure occurs because of a connectivity issue between &#xA;the switches. In this situation, both vPC switches claim &#xA;the primary switch role and keep the vPC member ports up. &#xA;This situation is known as a split-brain scenario. Because &#xA;the peer link is no longer available, the two vPC switches &#xA;cannot synchronize the unicast MAC address and the IGMP &#xA;group and therefore they cannot maintain the complete unicast &#xA;and multicast forwarding table.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I understand the above, but i want to further dig deep into how loop might occur.How will unpredictable traffic scenario occur? I understand that there will be two vPC primary switch(both of them will act as STP root).Can you please clarify by using a simple topology?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On further searching, i see the below post &lt;a href=&quot;https://supportforums.cisco.com/discussion/12883126/vpc-peer-link-and-peer-keepalive-link-down-scenario&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/TnPTH.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/TnPTH.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;From what i understood, since we have 2 switches acting as vPC Primary(and hence both of them will be STP root as well), the links will be in forwarding state and hence there are chances of loop. Is that correct understanding?&#xA;I am also trying to figure out, if a packet is sourced from S1, how is that likely to undergo loop?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="8499" LastEditDate="2018-03-19T16:00:56.927" LastActivityDate="2020-04-18T13:24:12.133" Title="Regarding vPC Dual Active or Split Brain scenario" Tags="|mac-address|spanning-tree|multicast|vpc|igmp|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38449" PostTypeId="1" CreationDate="2017-01-29T08:17:40.293" Score="0" ViewCount="745" Body="&lt;p&gt;I've currently at a bit of a roadblock.  The scenario is i have two sites approx 5km apart. Each site consists of multiple levels, now i have set up VLANS at both sites, and each PC can ping each other if they're at the same site, but unable to ping a PC from a different site.  In packet tracer i have a 2620 and 2621 Routers for each site, but can't for the life of me, set up a route between the two routers&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2621 Router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fa0/0 - 172.16.0.1 255.255.255.128&#xA;Se1/0 - 172.16.4.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2620 Router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fa0/0 - 172.16.5.1 255.255.255.128&#xA;Se1/0 - 172.16.4.129&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both Routers have the same VLAN config table&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FastEthernet0/0.2      172.16.0.129&lt;br&gt;&#xA;FastEthernet0/0.3      172.16.1.1&lt;br&gt;&#xA;FastEthernet0/0.4      172.16.1.129&lt;br&gt;&#xA;FastEthernet0/0.5      172.16.2.1&lt;br&gt;&#xA;FastEthernet0/0.6      172.16.2.129&lt;br&gt;&#xA;FastEthernet0/0.7      172.16.3.1&lt;br&gt;&#xA;FastEthernet0/0.8      172.16.3.129&lt;br&gt;&#xA;FastEthernet0/0.9      172.16.5.129&lt;br&gt;&#xA;FastEthernet0/0.10     172.16.6.1&lt;br&gt;&#xA;FastEthernet0/0.11     172.16.6.129&lt;br&gt;&#xA;FastEthernet0/0.12     172.16.7.1&lt;br&gt;&#xA;FastEthernet0/0.13     172.16.7.129&lt;br&gt;&#xA;FastEthernet0/0.14     172.16.8.1&lt;br&gt;&#xA;FastEthernet0/0.15     172.16.8.129&lt;br&gt;&#xA;FastEthernet0/0.16     172.16.9.1&lt;br&gt;&#xA;FastEthernet0/0.17     172.16.9.129&lt;br&gt;&#xA;FastEthernet0/0.18     172.16.10.1    &lt;/p&gt;&#xA;" OwnerUserId="33957" LastActivityDate="2021-01-08T05:37:43.407" Title="Static Routes between two routers" Tags="|routing|vlan|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38450" PostTypeId="1" AcceptedAnswerId="38465" CreationDate="2017-01-29T13:13:09.793" Score="1" ViewCount="6794" Body="&lt;p&gt;Consider the attached topology.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/gNDuG.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gNDuG.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a vPC domain, with vPC 20 for Sw2 and vPC 10 for Sw1.&#xA;vPC peer link exists between NxOS1 and NxOS2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose, Sw2 sends broadcast traffic.This broadcast traffic (after hashing) will choose any of the links while going upstream to NxOS1.&#xA;Now the broadcast traffic is received on NXOS1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NxOS1 sends broadcast traffic to all ports except port20. Hence, NxOS1 will send the traffic egress via Port 10 and the Peer link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, the NxOS2 receives the traffic, it knows what was the status of port 10 and port 20 of NxOS1 (via CFS protocol).&#xA;So, NxOS2 knows that SW1 might have received traffic from NxOS1 via Port 10 of NxOS1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NxOS2 also knows that (via CFS protocol) the broadcast traffic would have come to NxOS1(on port 20) from SW2. (I believe when the port channel is established, the system-mac of Sw2 is known to both NxOS1 and NxOS2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence, NxOS2 DOES NOT further send broadcast traffic(in egress direction downstream) on port 20 and port 10 of NxOS2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1:Please validate if my above understanding is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:Here, CFSoE is playing a great role(for mac address synchronisation).What would happen if CFSoE stops working(assume peer link goes down)? Even then how would loop occur in above scenario?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2017-01-30T04:51:38.477" Title="vpc loop avoidance scenario" Tags="|vpc|loop|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38451" PostTypeId="2" ParentId="38450" CreationDate="2017-01-29T14:12:20.123" Score="2" Body="&lt;p&gt;I'm not quite sure CFS is the thing preventing loops. It is more about syncing and consistency checks. There's a simple rule though: do not send traffic out of member port if it was received over a peer link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If peer link breaks, nothing works. It's a split brain scenario, where each switch believes it's a master. In theory there can be loop (you can see that &quot;8&quot; between switches), but the situation per se is abnormal, so it's difficult to determine actual behavior. &lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-01-29T14:12:20.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38453" PostTypeId="1" AcceptedAnswerId="38458" CreationDate="2017-01-29T16:58:40.367" Score="1" ViewCount="1447" Body="&lt;p&gt;If I want to send an IPv6 UDP multicast message, how does L3 to L2 address resolution occur?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think I understand ARP and how this same idea applies to unicast, but I am struggling to grasp the idea of how it works for multicast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am aware of MLD and NDP, but not sure how they come into play with my question.&lt;/p&gt;&#xA;" OwnerUserId="21360" LastEditorUserId="8499" LastEditDate="2018-03-12T00:41:58.507" LastActivityDate="2018-03-12T00:41:58.507" Title="How does address resolution work with multicast, specifically IPv6?" Tags="|ip|ipv6|arp|multicast|udp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38454" PostTypeId="2" ParentId="38449" CreationDate="2017-01-29T17:07:09.657" Score="2" Body="&lt;p&gt;You've configured the same subnets at each site across a routed link/interface?  Looks like you [think that you] want to bridge the traffic rather than route it.  If that's the case, you need configure bridging.  &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ibm-technologies/source-route-transparent-srt-bridging/10676-37.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Transparent Bridging&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h2&gt;Bridging&lt;/h2&gt;&#xA;&lt;p&gt;Bridges connect and transfer data between LANs. The following are four kinds of bridging:&lt;/p&gt;&#xA;&lt;h3&gt;Transparent bridging -&lt;/h3&gt;&#xA;&lt;p&gt;found primarily in Ethernet environments, and is mostly used to bridge networks which have the same media types. Bridges keep a table of destination addresses and outbound interfaces.&lt;/p&gt;&#xA;&lt;h3&gt;Source-Route Bridging (SRB) -&lt;/h3&gt;&#xA;&lt;p&gt;found primarily in Token Ring environments. Bridges only forward frames based on the routing indicator contained in the frame. Endstations are responsible for determining and maintaining the table of destination addresses and routing indicators. For more information, refer to Understanding and Troubleshooting Local Source-Route Bridging.&lt;/p&gt;&#xA;&lt;h3&gt;Translational bridging -&lt;/h3&gt;&#xA;&lt;p&gt;used to bridge data between different media types. This is typically used to go between Ethernet and FDDI or Token Ring to Ethernet.&lt;/p&gt;&#xA;&lt;h3&gt;Source-Route Translational Bridging (SR/TLB) -&lt;/h3&gt;&#xA;&lt;p&gt;a combination of source-route bridging and transparent bridging that allows communication in mixed Ethernet and Token Ring environments. Translational bridging without routing indicators between Token Ring and Ethernet is also called SR/TLB. For more information, refer to Understanding and Troubleshooting Source-Route Translational Bridging.&#xA;Bridging happens at the data-link layer, which controls data flow, handles transmission errors, provides physical addressing, and manages access to the physical medium. Bridges analyze incoming frames, make forwarding decisions based on those frames, and forward the frames to their destinations. Sometimes, such as in SRB, the frame contains the entire path to the destination. In other cases, such as in transparent bridging, frames are forwarded one hop at a time toward the destination.&lt;/p&gt;&#xA;&lt;p&gt;Bridges can be either remote or local. Local bridges provide direct connections between many LAN segments in the same area. Remote bridges connect LAN segments in different areas, usually over telecommunication lines.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-01-29T17:07:09.657" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38456" PostTypeId="2" ParentId="34515" CreationDate="2017-01-29T17:20:29.123" Score="1" Body="&lt;p&gt;Use TACACS+ for admin access to your networking devices.  That's the tool for the job.  However, those brand of firewalls may not support it.  I did find a RADIUS setup guide.  &lt;a href=&quot;https://support.sonicwall.com/kb/sw6958&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://support.sonicwall.com/kb/sw6958&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than using that, just create a batch script (windows):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.howtogeek.com/263177/how-to-write-a-batch-script-on-windows/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.howtogeek.com/263177/how-to-write-a-batch-script-on-windows/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Do you know how to use the Command Prompt? If you do, you can write a&#xA;  batch file. In its simplest form, a batch file (or batch script) is a&#xA;  list of several commands that are executed when you double-click the&#xA;  file. Batch files go all the way back to DOS, but still work on modern&#xA;  versions of Windows.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;PowerShell scripts and Bash scripts may be more powerful, but batch&#xA;  files can still be plenty useful if you need to run basic Windows&#xA;  commands.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-29T17:20:29.123" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38457" PostTypeId="2" ParentId="34513" CreationDate="2017-01-29T17:27:01.543" Score="1" Body="&lt;h3&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/interface/command/ir-cr-book/ir-s4.html#wp3301450229&quot; rel=&quot;nofollow noreferrer&quot;&gt;show interface history&lt;/a&gt;&lt;/h3&gt;&#xA;&lt;p&gt;To display histograms of interface utilization, use the showinterfacehistory command in privileged EXEC mode.&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;show interface [ type number ] history [ all | 60sec | 60min | 72hour ] [ both | input | output ]&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NIQmt.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NIQmt.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-01-29T17:27:01.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38458" PostTypeId="2" ParentId="38453" CreationDate="2017-01-29T18:03:12.107" Score="2" Body="&lt;p&gt;IPv6 does not use ARP, it uses ND. ARP uses broadcast, which interrupts every host on the LAN, but IPv6 doesn't have broadcast. Instead, each IPv6 interface must subscribe to a solicited-node multicast address for each IPv6 unicast or anycast address configured on the interface. These solicited-node multicast addresses are based on the IPv6 unicast or anycast addresses, so, in all likelihood, the resolution request only interrupts the one host with that IPv6 address, or possibly a very few hosts. This is a better solution than ARP.&lt;/p&gt;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#section-2.7.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 4291, IP Version 6 Addressing Architecture, Section 2.7.1. Pre-Defined Multicast Addresses&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Solicited-Node multicast address are computed as a function of a&#xA;node's unicast and anycast addresses.  A Solicited-Node multicast&#xA;address is formed by taking the low-order 24 bits of an address&#xA;(unicast or anycast) and appending those bits to the prefix&#xA;FF02:0:0:0:0:1:FF00::/104 resulting in a multicast address in the&#xA;range&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;     FF02:0:0:0:0:1:FF00:0000&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;to&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;     FF02:0:0:0:0:1:FFFF:FFFF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;For example, the Solicited-Node multicast address corresponding to&#xA;the IPv6 address 4037::01:800:200E:8C6C is FF02::1:FF0E:8C6C.  IPv6&#xA;addresses that differ only in the high-order bits (e.g., due to&#xA;multiple high-order prefixes associated with different aggregations)&#xA;will map to the same Solicited-Node address, thereby reducing the&#xA;number of multicast addresses a node must join.&lt;/p&gt;&#xA;&lt;p&gt;A node is required to compute and join (on the appropriate&#xA;interface) the associated Solicited-Node multicast addresses for&#xA;all unicast and anycast addresses that have been configured for the&#xA;node's interfaces (manually or automatically).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;IPv6 uses the solicited node multicast address for the IPv6 layer-3 unicast or anycast address which it wants to resolve to the layer-2 address. A host will compute the solicited node multicast address for the address to resolve, and it will multicast a Neighbor Solicitation message to the multicast group. The host with the layer-3 address will reply with its layer-2 address.&lt;/p&gt;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 4861, Neighbor Discovery for IP version 6 (IPv6)&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Nodes accomplish address resolution by multicasting a Neighbor&#xA;Solicitation that asks the target node to return its link-layer&#xA;address.  Neighbor Solicitation messages are multicast to the&#xA;solicited-node multicast address of the target address.  The target&#xA;returns its link-layer address in a unicast Neighbor Advertisement&#xA;message.  A single request-response pair of packets is sufficient for&#xA;both the initiator and the target to resolve each other's link-layer&#xA;addresses; the initiator includes its link-layer address in the&#xA;Neighbor Solicitation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;To create an IPv6 layer-2 multicast address from an IPv6 layer-3 multicast address you simply use &lt;code&gt;33-33&lt;/code&gt; and append the last 32-bits of the IPv6 layer-3 multicast address. This gives you a lot more layer-2 multicast addresses than IPv4 has because IPv4 only uses 23 bits of the layer-3 multicast address in the layer-2 multicast address.&lt;/p&gt;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2464&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 2464, Transmission of IPv6 Packets over Ethernet Networks&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol start=&quot;7&quot;&gt;&#xA;&lt;li&gt;Address Mapping -- Multicast&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;An IPv6 packet with a multicast destination address DST, consisting&#xA;of the sixteen octets DST&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#section-2.7.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;1&lt;/a&gt; through DST[16], is transmitted to the&#xA;Ethernet multicast address whose first two octets are the value 3333&#xA;hexadecimal and whose last four octets are the last four octets of&#xA;DST.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;              +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;              |0 0 1 1 0 0 1 1|0 0 1 1 0 0 1 1|&#xA;              +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;              |   DST[13]     |   DST[14]     |&#xA;              +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;              |   DST[15]     |   DST[16]     |&#xA;              +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Also, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7042#section-2.3.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 7042, IANA Considerations and IETF Protocol and Documentation Usage for IEEE 802 Parameters, Section 2.3.1. Identifiers Prefixed &amp;quot;33-33&amp;quot;&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;2.3.1.  Identifiers Prefixed &amp;quot;33-33&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;All MAC-48 multicast identifiers prefixed &amp;quot;33-33&amp;quot; (that is, the 2**32&#xA;multicast MAC identifiers in the range from 33-33-00-00-00-00 to&#xA;33-33-FF-FF-FF-FF) are used as specified in [RFC2464] for IPv6&#xA;multicast.  In all of these identifiers, the Group bit (the bottom bit&#xA;of the first octet) is on, as is required to work properly with&#xA;existing hardware as a multicast identifier.  They also have the Local&#xA;bit on and are used for this purpose in IPv6 networks.&lt;/p&gt;&#xA;&lt;p&gt;(Historical note: It was the custom during IPv6 design to use &amp;quot;3&amp;quot; for&#xA;unknown or example values, and 3333 Coyote Hill Road, Palo Alto,&#xA;California, is the address of PARC (Palo Alto Research Center,&#xA;formerly &amp;quot;Xerox PARC&amp;quot;).  Ethernet was originally specified by the&#xA;Digital Equipment Corporation, Intel Corporation, and Xerox&#xA;Corporation.  The pre-IEEE [802.3] Ethernet protocol has sometimes&#xA;been known as &amp;quot;DIX&amp;quot; Ethernet from the first letters of the names of&#xA;these companies.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2017-01-29T18:17:36.777" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38460" PostTypeId="1" AcceptedAnswerId="38461" CreationDate="2017-01-29T18:55:38.580" Score="3" ViewCount="23478" Body="&lt;p&gt;Yesterday I had a look at my router configuration, and I saw that my office's local LAN gateway's IP address is written on the router's VLAN1 interface.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What is a VLAN1 interface in a router?&lt;/li&gt;&#xA;&lt;li&gt;Is it different from a switch's VLAN?&lt;/li&gt;&#xA;&lt;li&gt;Why is it not configured on a gigabit interface?&lt;/li&gt;&#xA;&lt;li&gt;Does it mean that all interfaces refer to VLAN1?&lt;/li&gt;&#xA;&lt;li&gt;If yes, how can we assign each port to VLAN1?&lt;/li&gt;&#xA;&lt;li&gt;How can we create VLANs?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="23552" LastEditorUserId="8499" LastEditDate="2018-12-12T03:25:10.280" LastActivityDate="2019-03-11T18:10:53.213" Title="What is VLAN1 interface in routers?" Tags="|cisco|router|vlan|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38461" PostTypeId="2" ParentId="38460" CreationDate="2017-01-29T19:10:53.543" Score="3" Body="&lt;p&gt;Since you have not included the router model, I will assume it is a Cisco router, something like an ISR with a built-in switch module.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some Cisco routers can have a built-in or optional, add-on switch modules. The interfaces for this module are switch interfaces, not router interfaces. You need to create VLAN interfaces to link the layer-2 switch to the layer-3 router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You configure the switch interfaces the same way that you do for a layer-2 switch. They are switch interfaces, not router interfaces, so you cannot configure layer-3 on those interfaces. That is where the SVIs come in. You assign a VLAN to each switch interface, and create an SVI for each VLAN. The SVIs get configured with the layer-3 information for the VLAN. The layer-3 addresses configured on the SVIs will be the gateways for the VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router will also have some router interfaces that get configured for layer-3. Routers will, by default, route everything between its layer-3 interfaces, including SVIs configured for layer-3.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Let's assume you have eight switch interfaces (GigabitEthernet0 - 7), and two router interfaces (GigabitEthernet8 - 9), like a Cisco 892 router. There are two connections to other routers, and there are four VLANs (two switch interfaces on each VLAN). The first eight interfaces are switch interfaces, and they are configured like a layer-2 switch. The last two interfaces are router interfaces, and they are configured with layer-3. The four VLAN interfaces are configured as layer-3 interfaces. Routing between the VLANs and the router interfaces will happen, as long as they are configured for layer-3, and there are no other configurations to block, e.g. ACLs. The gateways for the VLANs will be the addresses configured on the VLAN interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could have something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigbitEthernet0&#xA; description VLAN 1&#xA; switchport access vlan 1&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigbitEthernet1&#xA; description VLAN 1&#xA; switchport access vlan 1&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigbitEthernet2&#xA; description VLAN 2&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigbitEthernet3&#xA; description VLAN 2&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigbitEthernet4&#xA; description VLAN 3&#xA; switchport access vlan 3&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigbitEthernet5&#xA; description VLAN 3&#xA; switchport access vlan 3&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigbitEthernet6&#xA; description VLAN 4&#xA; switchport access vlan 4&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigbitEthernet7&#xA; description VLAN 4&#xA; switchport access vlan 4&#xA; switchport mode access&#xA; no shutdown&#xA;!&#xA;interface GigbitEthernet8&#xA; description Link to Router 2&#xA; ip address 10.2.0.1 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;!&#xA;interface GigbitEthernet9&#xA; description Link to Router 3&#xA; ip address 10.3.0.1 255.255.255.252&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;!&#xA;interface Vlan1&#xA; description VLAN1&#xA; ip address 192.168.1.0 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;!&#xA;interface Vlan2&#xA; description VLAN2&#xA; ip address 192.168.2.0 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;!&#xA;interface Vlan3&#xA; description VLAN3&#xA; ip address 192.168.3.0 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;!&#xA;interface Vlan4&#xA; description VLAN4&#xA; ip address 192.168.4.0 255.255.255.0&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; no shutdown&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-12-12T03:25:22.237" LastActivityDate="2018-12-12T03:25:22.237" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="38462" PostTypeId="1" AcceptedAnswerId="38467" CreationDate="2017-01-29T19:35:13.757" Score="1" ViewCount="769" Body="&lt;p&gt;I'm sorry if its a simple question, but its a really big problem for me at the moment. We have a project to program a router network in Quagga, and I did that (though with some problems since we only did OSPF in class), but I can't figure out how to assign cost to RIP and BGP. From what I can tell, from the quagga.pdf on the nongnu website, they don't have cost only distance, which I'm not sure is the same thing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If is possible to use cost, I'd appreciate any help in how to do it, cause I'm stumped at the moment.&lt;/p&gt;&#xA;" OwnerUserId="33967" LastEditorUserId="8499" LastEditDate="2017-01-29T19:52:11.153" LastActivityDate="2017-01-29T20:05:05.657" Title="How do you define cost in Quagga for BGP and RIP?" Tags="|bgp|rip|quagga|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38463" PostTypeId="2" ParentId="38462" CreationDate="2017-01-29T19:48:07.713" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How do you define cost in Quagga for BGP and RIP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Simply put, you don't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are comparing apples to oranges. OSPF, a link-state routing protocol, uses cost, but neither RIP nor BGP use cost. RIP is a distance-vector protocol that uses the hop count as its metric, and BGP uses a variety of properties to determine the direction to send traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would politely suggest that, because you had to ask this question, you simply do not have the skills to properly configure BGP. BGP is a very complex protocol, and you really need to understand it. It connects different ASes (Autonomous Systems) that are managed by different entities, each of which maintains its own routing policies. BGP can suggest something to a different AS, but the other AS is completely free to ignore that and route how it wants to route.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-29T19:48:07.713" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38464" PostTypeId="2" ParentId="38460" CreationDate="2017-01-29T19:50:58.653" Score="-1" Body="&lt;p&gt;It's gonna look like &lt;code&gt;Interface GigabitEthernet0/0.1&lt;/code&gt; in the running configuration, e.g. &lt;code&gt;show run&lt;/code&gt; from the admin console.  It's the dot, ...after the dot.  The main interface will probably show &lt;code&gt;encapsulation dot1q&lt;/code&gt; or something like that.  We call them &lt;em&gt;subinterfaces&lt;/em&gt; typically for the .x VLAN interfaces.  The dot1q has nothing to do with the VLAN number, it's the specification for handing VLAN's.  So you might have subinterface int G0/0.2 for VLAN2, for example.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-29T19:50:58.653" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38465" PostTypeId="2" ParentId="38450" CreationDate="2017-01-29T19:51:37.243" Score="2" Body="&lt;p&gt;The VPC peer link has a few special roles - it carries the CFSoE traffic (mentioned below) to allow the peers to sync (enabled automatically when &lt;code&gt;feature vpc&lt;/code&gt; is turned on) and carries traffic for orphan ports.  It doesn't behave completely like a normal port channel and, as a result, it's best practice to keep non-VPC VLAN's on a different physical link.  One significant difference is, as mentioned, that broadcast traffic is sent over the peer link but normally would not be sent to any &lt;em&gt;non-orphan&lt;/em&gt; member link.  Orphans still need to receive broadcasts.  &lt;a href=&quot;http://www.cisco.com/c/dam/en/us/td/docs/switches/datacenter/sw/design/vpc_design/vpc_best_practices_design_guide.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; design best practice guide is for the 7K but more-or-less equally applies to 5K, 9K or 3K.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CFS is basically the mechanism by which state is synchronized between VPC members.  It's the way in which parameters are exchanged to assure configuration consistency, the place where STP configuration is normalized, where multicast/IGMP information is programmed and, if configured, is how IP ARP and/or IPv6 ND information is preemptively synchronized.  What is unequivocally &lt;strong&gt;not&lt;/strong&gt; the case is that CFS is tracking on a per-packet basis which traffic should- and should not- traverse the peer link.  Its job is basically to maintain synchronization of basic configuration state, not real-time traffic control.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To your specific question - &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The assumption in a VPC environment is that under normal operating conditions all devices have member links to both VPC peers.  As such, broadcasts received on NXOS1 in your diagram would be sent to the other member links on that same switch (...which is to say NXOS2).  It is also sent over the peer link to NXOS2.  NXOS2 will not send a broadcast received on the peer link to any of its member ports (as, again, it's assumed NXOS1 has already done this).  If it has any orphan ports, however, it will replicate to them.  As an example - imagine the link from SW1 to NXOS1 had failed.  SW2 sends a broadcast that happens to hash to NXOS1.  NXOS1 forwards across its peer link to NXOS2 which sees that SW1 is operating as an orphan (learned via CFS) and will send the broadcast accordingly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To your second question - if the VPC peer link fails but the keep-alive is still up then the VPC peer that's operating as a secondary will shut down its VPC member ports (including L3 SVI's), thus forcing the downstream switches to only use links to the VPC primary.  There are knobs to mediate this - to, say, allow orphans or some SVI's to stay up but this should be approached with extreme caution as you could easily end up in a situation where the secondary switch is attracting L3 traffic from upstream that it can't actually reach at L2.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT (to answer question in comments)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question of what goes wrong in a split-brain situation (i.e. both P/L and keep-alive failing) depends on the surrounding topology.  In the topology you've drawn where there are literally only L2 devices and the switches are both dual-connected to both VPC peer devices and there aren't any other links?  There isn't a ton of risk of loops if the downstream switches continue to see the member links as correctly aggregated, as split-horizon would be correctly maintained for broadcasts.  There could be some protocol issues depending on the VPC configuration as the downstream switches would see STP PDU's with different sources coming from different members of a port-channel, but that behavior depends on how VPC was configured on the two switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dual/independent (non-synchronized) IGMP would break some things and could potentially see duplicate multicast packets flooded as both VPC masters would perform the same function independently (...this is one of those important things that CFS handles over the peer link).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now - if the topology is more involved?  It can get much uglier.  Add in L3 on that VPC pair and perhaps some orphan links and all of a sudden you're going to be dropping traffic as two routers advertise reachability to subnets they can only partially see.  Put a link between S1 and S2 and you could end up with an unstable network as they keep seeing TCN's as the two VPC pairs keep sending BPDU's with conflicting information.  Or imagine a back-to-back VPC where the upstream VPC pair is now hashing traffic (including broadcast/multicast) across the two VPC switches which, in turn, end up flooding the same packet across various downstream member links.  Plenty of opportunity for duplicated broadcasts, improper flooding, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally - if any of these issues causes LACP to break - or if seeing differing LACP bundle information showing up on different channels breaks the downstream switch then you've got a situation where the downstream switches are now potentially forwarding between the VPC switches.  That's definitely ripe for a L2 loop.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These types of scenarios are why the best practice documents so stringently emphasize the necessity of physically redundant peer links (two links on a 5K, spread across multiple modules on a 9500 or 7K) and why running the keepalive traffic on a completely independent set of links (and infrastructure) is so crucial.  As in any active/active clustering system a split-brain is always dangerous.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastEditorUserId="1172" LastEditDate="2017-01-30T04:51:38.477" LastActivityDate="2017-01-30T04:51:38.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38466" PostTypeId="2" ParentId="36239" CreationDate="2017-01-29T19:58:24.433" Score="0" Body="&lt;p&gt;It depends on what you're pinging from; where is the failure from, as well.  Each endpoint's subnet requires a gateway in order to reach other subnets.  Further, each endpoint must know it's default gateway.  If your endpoint can ping its default gateway but not other subnets, then it's the other subnet's devices that don't know how to get back to you...&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-29T19:58:24.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38467" PostTypeId="2" ParentId="38462" CreationDate="2017-01-29T20:05:05.657" Score="1" Body="&lt;p&gt;So there's a decision tree that just about any router goes through when determining routes.  The respective routing protocols (RIP, BGP, OSPF, IS-IS, static) run their own algorithms to determine the ideal path to a given prefix.  If the router is presented the &lt;strong&gt;same&lt;/strong&gt; route (i.e. identical network and prefix length) then the &lt;strong&gt;administrative distance&lt;/strong&gt; is consulted.  This is the relative priority of the various routing protocols on the box, and in most implementations the lowest value wins.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - my understanding from Quagga is that it treats RIP routes as having a default administrative distance of 120.  If you don't specify a different AD on a static route it will end up with a value of 1.  As such, a static route will normally take precedent over a RIP route.  In turn, if you set up a static route with an AD of 200 (for example) it will only be used if the equivalent RIP route leaves the table (this is known as a floating static route).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example the situation is that routes received via BGP may have one of two different AD's - one for internal BGP routes (this is 200 by default in Cisco - would assume something similar for Quagga) and another for externals (usually much lower - 20 in Cisco).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can adjust the AD in Quagga manually.  Take a look at the &lt;a href=&quot;http://www.nongnu.org/quagga/docs/docs-info.html#RIP-distance&quot; rel=&quot;nofollow noreferrer&quot;&gt;manual&lt;/a&gt; and specifically consider the &lt;code&gt;distance&lt;/code&gt; command under each routing protocol definition.  You can see these rules in effect when you look at the routing table, where the format is usually something like x.y.z.q/nn [AA/MMMM] where AA = administrative distance and MMMM = the metric within the protocol.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside - and I hope this is obvious from what I've written above - the longest prefix match is always the most important factor.  A /32 received in RIP with an AD of 120 will trump an overlapping /24 from eBGP with an AD of 20.  This is just basic routing, though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also - in almost every properly designed networking scenario there is no need to adjust AD.  If this seems like the only way to approach the design I would strongly consider re-approaching the design altogether as there's lots of potential for operational issues, routing loops and the like when AD is not consistently applied.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-29T20:05:05.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38471" PostTypeId="1" AcceptedAnswerId="38474" CreationDate="2017-01-29T23:54:26.007" Score="19" ViewCount="149175" Body="&lt;p&gt;In Wireshark, I see &lt;code&gt;TCP duplicate ACK&lt;/code&gt; packets sent from the receiver to the sender. What does it mean? Does it imply packet loss?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="33818" LastActivityDate="2017-01-30T05:13:14.260" Title="What does TCP DUP ACK mean?" Tags="|cisco|tcp|packet-loss|transport-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38474" PostTypeId="2" ParentId="38471" CreationDate="2017-01-30T05:13:14.260" Score="20" Body="&lt;p&gt;There can be several things going on - the most common would be the use of &lt;a href=&quot;https://en.wikipedia.org/wiki/TCP_congestion_control#Fast_retransmit&quot; rel=&quot;noreferrer&quot;&gt;TCP Fast Retransmission&lt;/a&gt; which is a mechanism by which a receiver can indicate that it has seen a gap in the received sequence numbers that implies the loss of one or more packets in transit.  The repeated acknowledgements at the last known value before the gap signal which packets the sender should retransmit.  This can occur without waiting for the acknowledgement timeout for the lost packet to hit on the transmitter - which, as the name implies, means recovering a lot faster.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's also possible that the same symptom of gaps in sequence numbers might be seen in a situation where packets are being delivered out of order.  As above, if the receiver sees (for example) a segment with sequence #5 followed by another with #7 before seeing sequence #6 then it might try to begin to trigger a fast retransmit.  Upon seeing #6 arrive, though, it would stop sending the duplicate acknowledgements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A less common cause would be certain media problems where certain packets might end  up being seen more than once.  If this is the case, however, you're likely to see other problems on the link (...including other packets showing as dupes in Wireshark).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - if you're seeing a few random duplicate ACK's but no (or few) actual retransmissions then it's likely packets arriving out of order.  If you're seeing a lot more duplicate ACK's followed by actual retransmission then some amount of packet loss is taking place.  Both situations are, unfortunately, entirely possible on the global Internet.  If you're seeing other kinds of duplicate packets as CRC issues and generally slow performance then it might make sense to look at link issues on your own network.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-30T05:13:14.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38476" PostTypeId="2" ParentId="38416" CreationDate="2017-01-30T06:37:33.373" Score="3" Body="&lt;p&gt;Network access control is a security mechanism for controlling admission to networks&#xA;and resources. These controls enforce the security policy and employ rules about which&#xA;resources can be accessed. Network access control ensures the confidentiality and integrity&#xA;of the network resources.&#xA;The core of network access control forms the AAA framework, which consists of the&#xA;following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;■ Authentication establishes the user’s identity and access to the network resources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;■ Authorization describes what can be done and what can be accessed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;■ Accounting provides an audit trail of activities by logging the actions of the user.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Authentication, authorization, and accounting (AAA) are the network security services&#xA;that help manage the network access control on your network equipment. AAA provides&#xA;you with methods to secure access to network devices based on more granular techniques&#xA;than just IP addressing information. For example, you might have a requirement to control&#xA;access for a group of users regardless of their IP location. With AAA, you can integrate user&#xA;directories such as LDAP and AD so that groups of users can have the same access levels&#xA;decoupled from IP location. The implementation of AAA services requires authentication ;&#xA;however, authorization and accounting are optional services.&lt;/p&gt;&#xA;" OwnerUserId="33973" LastActivityDate="2017-01-30T06:37:33.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38477" PostTypeId="2" ParentId="28369" CreationDate="2017-01-30T06:39:20.410" Score="0" Body="&lt;p&gt;I eventually got Cisco to RMA two of the three switches. The new ones were revision V01 instead of V00, so I was hopeful for an improvement. However the new ones were doing the same thing after a few days, one of them worse than the other but still did it. I'm basically using these as unmanaged switches, so it's definitely not a config problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read on a Cisco forum that the new firmware 1.1.1.2 has resolved the problem. I'm upgrading now from version 1.0.0.19. I will update if this hasn't resolved it. &lt;/p&gt;&#xA;" OwnerUserId="23311" LastActivityDate="2017-01-30T06:39:20.410" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38481" PostTypeId="1" CreationDate="2017-01-30T14:22:04.233" Score="1" ViewCount="183" Body="&lt;p&gt;What are the possibilities of connection/link failover in the following configuration:&#xA;2 geographic locations connected by 2 independent radios (a primary and a backup, the backup is a mikrotik device). The idea is to use the primary with higher bandwidth and if there is a malfunction, switch to the second (mikrotik) one until the primary becomes available. The network is equipped with Ciscos 2960s, 3650 and a router on the remote location site. The network heavily relies on VLANs which are in many cases shared between the locations. I have been suggested 3 options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Complete network separation and full routing&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It has the disadvantage of having to separate the shared vlans and in my view, complicating the structure of the network.&lt;/li&gt;&#xA;&lt;li&gt;I dislike this solution as it seems to be a travel back in time neglecting the advantages of vlans etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Spanning tree&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Some network engineers dislike this and they claim it would clog the backup connection (nonsense as we have been running with ST on the planned backup for many years).&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;LACP link aggregation&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is a doubt how Mikrotik as an L3 device fits into this schema.&lt;/li&gt;&#xA;&lt;li&gt;The backup device management would not be available when the primary is active and vice versa.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Can you please comment on the above suggestions or provide any more suggestions that would work so that I could decide? Although I am not a cisco certified, but I know a thing or two about networks and for me option #2 is the most appealing, #3 has the problem of availability of the other device pair, otherwise I also like it but I wonder what you think.&lt;/p&gt;&#xA;" OwnerUserId="33989" LastActivityDate="2017-01-31T00:56:00.960" Title="Possibilities to switch between primary and backup radios between locations" Tags="|routing|vlan|switching|spanning-tree|ieee-802.1ax|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38482" PostTypeId="2" ParentId="38481" CreationDate="2017-01-30T14:34:03.580" Score="0" Body="&lt;p&gt;This type of thing is handled in routing all the time. Your MikroTik is off-topic here, but your Cisco router is on-topic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your Cisco router, you can set two static, default routes with different administrative distances. The link with the lower AD will be preferred. When that link goes down, the route is removed from the routing table, and the other default route now takes over. When the preferred link comes back up, its route is reinstalled in the routing table. This is called a floating, static route.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-30T14:34:03.580" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="38484" PostTypeId="1" AcceptedAnswerId="38487" CreationDate="2017-01-30T16:42:47.217" Score="2" ViewCount="853" Body="&lt;p&gt;We've been using the LTM and ZebOS for some time now. Time and again we've run into OSPF bugs, and an upgrade usually resolved them. ZebOS's BGP has been relatively stable in that regard.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're planning on extending our site (that will have its own DC), and need a (carrier-grade) router that'll potentially have a 100G pipe to the internet (and 10/40G connections internally). Would a Viprion 4800 chassis be a terrible choice for a router? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We'd like something that is MPLS L3/L2VPN capable, which F5 doesn't support yet. On the other hand, there could be load balancing requirements in the future, in which case, we'd have to drop an F5 behind an upstream Cisco/Juniper router. By having F5 as THE router for that site, we do away with SNAT (since it'll be inline for all the traffic), and take advantage of its ADC capabilities. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Amongst other things that concern me, since I haven't come across any vendor documentation, is whether F5 can hold the internet routing table (more than half a million routes) in its forwarding table, and if we're taking a performance hit by using a wildcard forwarding virtual server instead of hardware forwarding on a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would appreciate any inputs on whether F5 should/shouldn't be a choice, or if someone in here is using F5s as backbone routers. TIA!&lt;/p&gt;&#xA;" OwnerUserId="12034" LastActivityDate="2017-01-31T13:13:03.807" Title="F5 as a backbone router" Tags="|router|network-core|design|f5|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38485" PostTypeId="2" ParentId="38481" CreationDate="2017-01-30T17:01:13.440" Score="0" Body="&lt;p&gt;You seem to prefer a link layer mechanism so as to maintain layer 2 adjacency between the sites.  A possible gotcha LACP is that the links must be the same speed, layer 2, and the links need to attach to the same switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really need to have layer2 adjacency you can either forego the backup link or figure out a way to tunnel/bridge over IP.  In other words stand up a GRE tunnel between your Cisco routers, then configure bridging between your LAN side interface and that tunnel interface.  Layer 3 all the wireless links.  That would be a clever config, may be pushing the limits of the OS, would enable redundant link usability, maintain layer 2 adjacency, and would be fun to attempt :-)  See &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/integrated-routing-bridging-irb/17054-741-10.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;IRB&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-01-30T17:01:13.440" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38487" PostTypeId="2" ParentId="38484" CreationDate="2017-01-30T17:34:00.330" Score="7" Body="&lt;p&gt;Pushing full routes into a load balancer is about as far from best practice as you can get.  Give it a default route to an actual router and a static route back to your subnets and it should be able to do anything you'd want.  This also leaves you free to use that actual router to terminate &lt;em&gt;multiple&lt;/em&gt; connections for diversity / best path options without having to now worry about a RIB containing &lt;em&gt;millions&lt;/em&gt; of routes in your load balancer.  If you really want to scale the typical design would actually have a pair of routers acting as an outbound gateway for the load balancer and then, in turn, a whole series of border routers terminating multiple ISP connections.  Manage the heavy BGP work on a platform / OS specifically designed to do so and you won't be stuck in a position to be trying to diagnose whether app slowness is a function of a server, the load balancer, churning routing tables or just weirdness in a routing protocol implementation that is only marginally supported.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If appropriately designed (read: on a modular basis) this also leaves you in a place where scaling load balancers horizontally becomes a possibility to really hit high speeds, improved fail-over, etc.  It also opens up a bunch of possibilities in terms of scalable cross-site multi-tenancy (this ties to your point about MPLS features - again, absolutely not a set of features that can be dropped in from open source) as well as opening up the possibilities for various overlay network topologies (read: SDN, et al).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure if you ask the F5 guys whether they recommend carrying full views that they're going to tend to discourage it.  They make an excellent appliance for app-level functions like load balancing, L4-L7 security, etc.  That's a very, very different problem than scalable L2/L3.  In many ways it's akin to asking whether the super-basic load balancer I can run in hardware on a Cisco switch (ITD) is an apt replacement for an F5 front-ending a complex web site (read: &lt;strong&gt;no&lt;/strong&gt;).  Can it handle some functions?  Sure.  Is it designed to run all the fancy features you actually need to operate at scale? Absolutely not.  The same rationale applies to using a LB/ADC as a core router.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-30T17:34:00.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38488" PostTypeId="1" AcceptedAnswerId="38489" CreationDate="2017-01-30T20:03:11.587" Score="1" ViewCount="982" Body="&lt;p&gt;In Cisco packet tracer, when I connect 2 switches together, the CAM table on each switch gives the MAC address of the switch port of the other switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is surprising to me, and it really threw me off when I was playing with port-security (the maximum number of MAC addresses was reached, which triggered a violation, and I could not figure out why. It turns out I was not accounting for the MAC address of a directly connected switch port). I am relieved that I understand now, my questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Why / How (what protocol) did they learn the mac address of the&#xA;switch port on the other end? Perhaps something to do with&#xA;auto-negotiation? Do they ping each other (I don’t suppose this can&#xA;happen without IP’s assigned on VLAN interface?)&lt;/li&gt;&#xA;&lt;li&gt;Is this perhaps an action by packet tracer and this would not be&#xA;reflected with real switches?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="33019" LastEditorUserId="8499" LastEditDate="2017-01-30T20:09:25.097" LastActivityDate="2017-01-30T20:14:17.163" Title="What protocol forces a switch to populate it's CAM table with the MAC address of a directly connected switchport?" Tags="|cisco|switch|mac-address|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38489" PostTypeId="2" ParentId="38488" CreationDate="2017-01-30T20:07:18.950" Score="1" Body="&lt;p&gt;Spanning tree sends BPDUs, and these will have the source MAC address of the sending switch. A switch will populate its MAC address table with the source MAC address on any frame entering the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really don't want to set up port security with a MAC address limitation on a link between two switches, and you certainly do not want to disable STP where you have two switches connected.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-30T20:14:17.163" LastActivityDate="2017-01-30T20:14:17.163" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38490" PostTypeId="1" AcceptedAnswerId="38491" CreationDate="2017-01-30T22:17:05.197" Score="1" ViewCount="124" Body="&lt;p&gt;We will be replacing our campus network in the next year or two, and we are leaning towards increasing the use of wireless since most people primarily work from laptops &amp;amp; mobile devices. Plus, we can even order desktop PCs with wireless cards and still use wired ports where it’s needed. We don’t necessarily need a network port at every desk, and we can order fewer switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But wait. Our voice people are looking to go VoIP, which would require a network port for every phone. Even if they could do VoIP over wireless, they still want to use PoE so they don’t have to worry about electrical outlets. So now it seems we’re back to one network port per station.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my questions for anyone who has been through a similar upgrade recently:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have you been able to reduce your switch count even though you were&#xA;using VoIP?&lt;/li&gt;&#xA;&lt;li&gt;Did you still use PoE switches, or did you use a combination of VoIP&#xA;over wireless and maybe a large scale injector system?&lt;/li&gt;&#xA;&lt;li&gt;Is VoIP over wireless even a good idea (I doubt we’ll do this but was&#xA;curious)?&lt;/li&gt;&#xA;&lt;li&gt;Is it worth it to seriously beef up your wireless infrastructure if&#xA;you’re going to need a switch port at most every station anyway?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We have a medium sized campus with both office and lab space. We have around 500 people, 5 buildings and 15 IDFs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize that a VoIP phone at every desk doesn’t make much sense financially, but the company has decided they still want desk phones everywhere.&lt;/p&gt;&#xA;" OwnerUserId="23610" LastEditorUserId="8499" LastEditDate="2017-01-30T22:47:08.520" LastActivityDate="2017-01-31T21:20:47.650" Title="Mostly wireless campus vs. VoIP" Tags="|switching|voip|power-over-ethernet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38491" PostTypeId="2" ParentId="38490" CreationDate="2017-01-30T22:43:31.693" Score="3" Body="&lt;p&gt;While wireless is a good, convenient, possibly necessary thing for a company to have and use, you don't own the airwaves, and you must be willing to accept any interference that disrupts your Wi-Fi, even if it disrupts your business. Having a wired infrastructure can save your business a lot of money. I don't think you really want to bet the company on something that is out of your control. Also, a proper wireless infrastructure (WLCs, WAPs, and supporting hardware) can be as much or more than a switched network infrastructure, and it takes work to keep the wireless network properly tuned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with VoIP over Wi-Fi is that QoS, necessary for VoIP, is problematic for Wi-Fi. Wired VoIP phones are actually switches, too, so you can connect a PC through a phone, using a single switch interface for both devices. That saves on the number of switch interfaces necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The company where I work has people drooling over the idea of wireless-only sites, but it just has not proved practical.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;FYI,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;ANSI/TIA/EIA 568, Commercial Building Telecommunications Cabling Standard&lt;/em&gt; actually calls for a minimum of two telecommunications outlets per work area:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Each individual work area shall be serviced with a minimum of two&#xA;  telecommunications outlets. One will be associated with voice and the&#xA;  other data.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit for the comments:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If everyone suddenly switches to Wi-Fi for primary network access, you must be prepared for disappointment. The users often have expectations from using Wi-Fi at home that you simply cannot meet in the workplace. For instance, a home user have very little wireless contention on the half-duplex medium, but there will be much more contention in the office. Only one device on a particular Wi-Fi channel can use the medium at any given time, and the Wi-Fi protocol enforces sharing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A home user downloading files doesn't have much competition for the WAP, but given multiple users on a WAP trying to simultaneously send and receive files, you &lt;em&gt;will&lt;/em&gt; notice it, and network drive shares can seem very sluggish. On-line meeting software, like Lync or Skype, can be greatly affected, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not all bad. Things like limited networking for things like meeting rooms get much easier to remedy. The key is to manage user expectations, but don't expect that you can actually do a good job of that when so many people have such high expectations based on what they experience at home every day. There are companies that have made the transition and enjoy it, but how they use the network may not even resemble how your company uses the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to be prepared for some users to simply revert to wired networking for most things. The more users that do this, the better the wireless network performs for the remaining wireless users. A natural balance will be struck, but it may take some time as users switch back and forth before settling to what they prefer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you really need to hire a company to do a wireless site survey before you decide on how to design the wireless network. This will give you the WAP quantities, WAP placement, frequencies to use on each WAP, power levels for each WAP, etc. Shortly after you implement the wireless network and start using it, you should perform a follow-up wireless site survey. This will help you fine-tune things for optimal performance. It is not a bad idea to do this every year or if you notice problems. Things one the airwaves do change. For example, you could have a neighboring company move in and crank up their Wi-Fi radios to full power on a frequency that you are using close to their location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All in all, between the expanded number of WAPs, the switches required for the WLCs, and the users that prefer to remain on the wired network, you will probably not save many switch ports, if any. You may find that you use more switch ports (switches do come with fixed port quantities).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-01-31T18:20:29.157" LastActivityDate="2017-01-31T18:20:29.157" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="38492" PostTypeId="2" ParentId="38481" CreationDate="2017-01-31T00:56:00.960" Score="1" Body="&lt;p&gt;OK - so there's an old saying I learned when I started doing networking:  LAN's are bridged and WAN's are routed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What this means is that networks that host lots of end stations are going to be well-served by physically proximate switches with &lt;em&gt;effectively&lt;/em&gt; infinite, cheap, and readily available bandwidth.  Lots of broadcasts and multicasts to find services?  No biggie.  Random bursty transfers?  It's all localized, so who cares.  Someone blew something up and the LAN is fried?  Painful but it's only effecting people &lt;em&gt;within that site&lt;/em&gt; and &lt;em&gt;within that network&lt;/em&gt;.  In larger enterprises this tends to mean a few dozen to a few hundred people in part of the floor of an office building.  If something breaks it's a critical problem but in such situations the workers can often just take the elevator to another floor while someone fixes the problem.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with what you're describing (old-style bridging) is that it exactly fails at all of the above.  A problem that saturates a given LAN now also saturates your most limited resource: inter-site bandwidth.  That saturation means that an &lt;strong&gt;entire site&lt;/strong&gt; is now potentially offline.  The cause of such an issue could be a bad NIC, misbehaving app, a user who decided to run a huge backup job in the middle of the day, a misconfiguration of that STP you've been running for years.  Heck, something as innocuous as an end user in a conference room accidentally plugging in two ports from the wall into a single dumb switch can cause a loop that ends up taking down &lt;strong&gt;both&lt;/strong&gt; of your wireless links (and thus all communications) while someone tries to find a laptop and console cable to attempt to isolate the problem - assuming, of course, they're in the right site to help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Seriously - everything is going to run better if you run L3 over those links.  You have the potential to implement traffic shaping / QoS in an intelligent way to prioritize your voice traffic &lt;em&gt;before&lt;/em&gt; it hits the radio, you can actually engineer some traffic to normally use the backup link while sending the remainder over the primary.  As Ron correctly points out, failover is measured in milliseconds rather than minutes.  Want to add a third site?  Easy.  Try that with STP and it starts to get ugly. Add a third link?  Maybe come up with a solution where you put an Internet connection in the second site and use a site-to-site VPN to carry certain traffic?  No problem.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is that while - ideally - each site ends up with its own subnets (the model shown to scale and function reliably and the recommendation of literally every significant network vendor on the market) you could add in some kind of overlay to map L2 over the safe/sane L3 backbone.  Set up L2TP or OTV via some routers and have the subnets show up wherever you want.  Heck, consider some of the possibilities with VXLAN-EVPN where a modern switch can make sure any subnet shows up anywhere while still locally routing traffic over that L3 backbone.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relying on spanning tree across remote sites for redundancy is a bad idea even with two sites.  It was bad in 1995 and it's no better in 2017.  It gets progressively more horrible as any amount of size or complexity is added.  Seriously - to this day I still periodically see horrific STP problems in major data centers operated by highly qualified dedicated crews under fairly controlled conditions.  Moving this into the realm of potentially flaky long-haul wireless and workgroup-scale hardware isn't going to improve things.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-01-31T00:56:00.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38496" PostTypeId="2" ParentId="23369" CreationDate="2017-01-31T09:11:26.920" Score="7" Body="&lt;p&gt;I guess you could run the command below, it will depict every capability your software and hardware networking has, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sudo ethtool -T &amp;lt;interface&amp;gt;&lt;/code&gt; interface information such as names are accessible via &lt;code&gt;ifconfig&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example it is my network system output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Time stamping parameters for eth0:&#xA;Capabilities:&#xA;    hardware-transmit     (SOF_TIMESTAMPING_TX_HARDWARE)&#xA;    software-transmit     (SOF_TIMESTAMPING_TX_SOFTWARE)&#xA;    hardware-receive      (SOF_TIMESTAMPING_RX_HARDWARE)&#xA;    software-receive      (SOF_TIMESTAMPING_RX_SOFTWARE)&#xA;    software-system-clock (SOF_TIMESTAMPING_SOFTWARE)&#xA;    hardware-raw-clock    (SOF_TIMESTAMPING_RAW_HARDWARE)&#xA;PTP Hardware Clock: 0&#xA;Hardware Transmit Timestamp Modes:&#xA;    off                   (HWTSTAMP_TX_OFF)&#xA;    on                    (HWTSTAMP_TX_ON)&#xA;Hardware Receive Filter Modes:&#xA;    none                  (HWTSTAMP_FILTER_NONE)&#xA;    all                   (HWTSTAMP_FILTER_ALL)&#xA;    ptpv1-l4-sync         (HWTSTAMP_FILTER_PTP_V1_L4_SYNC)&#xA;    ptpv1-l4-delay-req    (HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ)&#xA;    ptpv2-l4-sync         (HWTSTAMP_FILTER_PTP_V2_L4_SYNC)&#xA;    ptpv2-l4-delay-req    (HWTSTAMP_FILTER_PTP_V2_L4_DELAY_REQ)&#xA;    ptpv2-l2-sync         (HWTSTAMP_FILTER_PTP_V2_L2_SYNC)&#xA;    ptpv2-l2-delay-req    (HWTSTAMP_FILTER_PTP_V2_L2_DELAY_REQ)&#xA;    ptpv2-event           (HWTSTAMP_FILTER_PTP_V2_EVENT)&#xA;    ptpv2-sync            (HWTSTAMP_FILTER_PTP_V2_SYNC)&#xA;    ptpv2-delay-req       (HWTSTAMP_FILTER_PTP_V2_DELAY_REQ)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is also a documentation in kernel source in case you want to see more about the flags! &lt;a href=&quot;https://www.kernel.org/doc/Documentation/networking/timestamping.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope it helps.&lt;/p&gt;&#xA;" OwnerUserId="34010" LastEditorUserId="67900" LastEditDate="2020-04-26T13:35:20.833" LastActivityDate="2020-04-26T13:35:20.833" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="38498" PostTypeId="1" AcceptedAnswerId="38548" CreationDate="2017-01-31T12:16:03.953" Score="1" ViewCount="570" Body="&lt;p&gt;we have sonicwall TZ 210 and most of the licenses have expired. I have to block facebook apps, youtube and so on from mobile users as well as workstations. &#xA;As i followed the guide for this configuration, &#xA;&lt;a href=&quot;https://support.sonicwall.com/kb/sw8620&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://support.sonicwall.com/kb/sw8620&lt;/a&gt;&#xA;I get this error when i go to firewall&gt;app control advanced&#xA;&lt;a href=&quot;https://i.stack.imgur.com/PGkG2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PGkG2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i was told that the firewall was reconfigured some time ago and before that application such as facebook youtube was blocked. So what are the alternatives for this one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help.&lt;/p&gt;&#xA;" OwnerUserId="23114" LastActivityDate="2017-02-01T20:28:08.430" Title="Blocking facebook app in sonic wall" Tags="|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38500" PostTypeId="1" AcceptedAnswerId="38501" CreationDate="2017-01-31T12:42:34.133" Score="1" ViewCount="657" Body="&lt;p&gt;I have an industrial network with ring topology, consisting of a number of dumb switches and one manageable switch (Siemens OSM 62) acting like a supervisor. But now I would like to add new switch to this network. The problem is that this new switch (Stratix 5700 it's a Cisco clone) is manageable too and I'd like to force it to act as a dumb one (just to forward data from one port to another). Is there any chance how to set this new switch (using some &quot;fancy hack&quot;) to doing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Matej   &lt;/p&gt;&#xA;" OwnerUserId="28233" LastActivityDate="2021-01-08T05:22:24.090" Title="Forwarding communication between two ports on switch" Tags="|cisco|routing|switching|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38501" PostTypeId="2" ParentId="38500" CreationDate="2017-01-31T12:50:15.807" Score="2" Body="&lt;p&gt;Manageable switches and &quot;dumb&quot; switches work the same way.  A Cisco switch with default configuration (i.e., &quot;out of the box&quot;) will forward packets just like any dumb switch.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might have to pay attention to spanning tree if your switches are in a ring.  but we'd need more information t be sure.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-01-31T12:50:15.807" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38502" PostTypeId="2" ParentId="38484" CreationDate="2017-01-31T13:13:03.807" Score="3" Body="&lt;p&gt;Not enough points to comment in agreement with mxrx yet, or vote his answer up, so I'll answer in agreement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The BIG-IP can do routing well yes, but in support of application delivery. But if you follow the &quot;right tool for the job&quot; principle, as much I as would like our sales guys to sell you a Viprion for this it would be a disservice to you to do so. For security and application delivery, the hardware and software is designed from the ground up. That isn't the case with routing, that's a 3rd party license that is incorporated into the packaging to extend BIG-IP's core functionality.&lt;/p&gt;&#xA;" OwnerUserId="34013" LastActivityDate="2017-01-31T13:13:03.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38503" PostTypeId="1" AcceptedAnswerId="38504" CreationDate="2017-01-31T13:35:58.047" Score="1" ViewCount="91" Body="&lt;p&gt;We have an appliance that always uses the IPv6 gateway's MAC address as the link layer destination address for all its outgoing IPv6 packets, even when the receivers IPv6 address is on the same subnet. The network is IPv6 over Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g.:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Appliance: 2001:DB8::2342/64, MAC 00:11:11:11:11:11&#xA;Gateway: 2001:DB8::1/64, MAC 00:AA:AA:AA:AA:AA&#xA;Client: 2001:DB8::4711/64, MAC: 00:22:22:22:22:22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When ever the appliance tries to send a packet to the client, it looks like so:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source IP address: 2001:DB8::2342, Source MAC address: 00:11:11:11:11:11&#xA;Dest IP address: 2001:DB8::4711, Dest MAC address: 00:AA:AA:AA:AA:AA&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;instead of &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Source IP address: 2001:DB8::2342, Source MAC address: 00:11:11:11:11:11&#xA;Dest IP address: 2001:DB8::4711, Dest MAC address: 00:22:22:22:22:22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Unfortunately we don't have access to the appliance routing table and our gateway is dropping packets which should be delivered to the same subnet they originate from. Therefore the appliance's connectivity to its local subnet is effectively unidirectional.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are in correspondence with the maker of the misbehaving appliance, but the support engineer for the device is pretty unaware of how IPv6 works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is it a violation to any standard if a host sends &lt;strong&gt;every&lt;/strong&gt; IPv6 packet to the gateway, even if the recipient is on the same subnet? If so, which standards (RFC, BCP, IEEE, whatever) are relevant?&lt;/li&gt;&#xA;&lt;li&gt;Is the gateway misbehaving dropping those packets instead of sending them out to the interface they came in? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="29627" LastActivityDate="2017-01-31T13:59:31.033" Title="Misbehaving host always uses the gw's MAC as destination: Violation of standard?" Tags="|router|ethernet|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38504" PostTypeId="2" ParentId="38503" CreationDate="2017-01-31T13:59:31.033" Score="3" Body="&lt;p&gt;It's not a violation of the standard to send all packets to the gateway, but it is inefficient. Usually that behaviour is controlled from the router advertisement. If it contains the local prefix and it advertises it as on-link then the appliance should insert a route in its routing table to deliver that traffic to the local network directly. So before concluding that the appliance is at fault take a look at your router advertisements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The gateway is at fault though because it definitely has a route and should deliver the packets, optionally sending a redirect to the sender to let it know it doesn't need to use the gateway. Some firewalls allow you to block intra-subnet traffic forwarding, so it might also be a configuration issue there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your traffic is breaking because of a combination of two issues, which are either bugs or configuration errors/choices.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2017-01-31T13:59:31.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38506" PostTypeId="1" AcceptedAnswerId="38585" CreationDate="2017-01-31T15:28:26.773" Score="2" ViewCount="1436" Body="&lt;p&gt;I'm on a Cisco 1811 with &lt;strong&gt;IOS 15.1(3)T&lt;/strong&gt; - yes it's really old, but that probably doesn't matter here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this TCL script that makes an HTTP POST to a destination and i want to pass in ANY Syslog message emitted by the system into the request body.&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;&amp;lt; my own http_get implementation here &amp;gt;&amp;gt;&#xA;&#xA;namespace import ::cisco::eem::*&#xA;namespace import ::cisco::lib::*&#xA;&#xA;set url &quot;http://some.url.out.there:8000&quot;&#xA;set mystdin [gets stdin]&#xA;set res [http_get $url -query $mystdin]&#xA;&#xA;puts &quot;POSTed to url&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My Event Manager applet looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;event manager applet TRIGGER&#xA;    event syslog occurs 1 pattern &quot;%.*&quot;&#xA;    action 2.0 policy sendevent.tcl $_syslog_msg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now this works fine except that i'm not getting anything into &lt;code&gt;$mystdin&lt;/code&gt;, so my request body is empty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do i pass in Event Manager's &lt;code&gt;$_syslog_msg&lt;/code&gt; to the TCL script?&#xA;Maybe there's a way to query for &quot;last Syslog event&quot; from within the script without reading from &lt;code&gt;stdin&lt;/code&gt;?&lt;/p&gt;&#xA;" OwnerUserId="10197" LastActivityDate="2017-02-03T15:08:07.737" Title="Cisco EEM pass Syslog message to TCL script" Tags="|cisco|syslog|cisco-eem|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="38507" PostTypeId="1" AcceptedAnswerId="38936" CreationDate="2017-01-31T16:06:26.147" Score="1" ViewCount="1367" Body="&lt;p&gt;I am facing this issue in my snmpv3 deployment. In some of catalyst cisco switches I am using snmpv3 with authpriv as sha and aes256. The porblem is that when I run an snmpwalk for v3 credentials it timesout. Though I have noticed that if i change the authpriv to MD5 and DES it runs fine and results successful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wanted to know why this behaviour on IOS accepts the sha/aes but doesn't respond? Any help?&lt;/p&gt;&#xA;" OwnerUserId="34021" LastActivityDate="2017-02-15T04:00:41.770" Title="snmpv3 authentication with sha and md5" Tags="|cisco|switch|snmp|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="38508" PostTypeId="1" CreationDate="2017-01-31T16:10:24.247" Score="1" ViewCount="792" Body="&lt;p&gt;As a UDP segment traverses down the stack, each layer adds a header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What occurs for this to happen? Does the kernel do a bunch stuff then add the header?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am particularly interested in the transition from the network to data-link layer on an Ethernet system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is ARP performed and then the cache searched in order to provide the next hope information?&lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2017-01-31T22:24:06.820" Title="How does data encapsulation work in the TCP/IP stack?" Tags="|ethernet|ipv6|udp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38510" PostTypeId="2" ParentId="38508" CreationDate="2017-01-31T16:52:10.303" Score="1" Body="&lt;p&gt;Each OS can do this differently. It is up to the OS designers how this specifically happens in an OS.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 826, An Ethernet Address Resolution Protocol -- or -- Converting Network Protocol Addresses to 48.bit Ethernet Address for Transmission on Ethernet Hardware&lt;/em&gt;&lt;/a&gt; gives you a general outline of what is supposed to happen, but an OS &lt;em&gt;could&lt;/em&gt; skip the whole table creation and use ARP requests for every packet.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Packet Generation:&lt;/p&gt;&#xA;&lt;p&gt;As a packet is sent down through the network layers, routing&#xA;determines the protocol address of the next hop for the packet and on&#xA;which piece of hardware it expects to find the station with the&#xA;immediate target protocol address.  In the case of the 10Mbit&#xA;Ethernet, address resolution is needed and some lower layer (probably&#xA;the hardware driver) must consult the Address Resolution module&#xA;(perhaps implemented in the Ethernet support module) to convert the&#xA;&amp;lt;protocol type, target protocol address&amp;gt; pair to a 48.bit Ethernet&#xA;address.  The Address Resolution module tries to find this pair in a&#xA;table.  If it finds the pair, it gives the corresponding 48.bit&#xA;Ethernet address back to the caller (hardware driver) which then&#xA;transmits the packet.  If it does not, it probably informs the caller&#xA;that it is throwing the packet away (on the assumption the packet will&#xA;be retransmitted by a higher network layer), and generates an Ethernet&#xA;packet with a type field of ether_type$ADDRESS_RESOLUTION.  The&#xA;Address Resolution module then sets the ar$hrd field to&#xA;ares_hrd$Ethernet, ar$pro to the protocol type that is being resolved,&#xA;ar$hln to 6 (the number of bytes in a 48.bit Ethernet address), ar$pln&#xA;to the length of an address in that protocol, ar$op to&#xA;ares_op$REQUEST, ar$sha with the 48.bit ethernet address of itself,&#xA;ar$spa with the protocol address of itself, and ar$tpa with the&#xA;protocol address of the machine that is trying to be accessed.  It&#xA;does not set ar$tha to anything in particular, because it is this&#xA;value that it is trying to determine.  It could set ar$tha to the&#xA;broadcast address for the hardware (all ones in the case of the 10Mbit&#xA;Ethernet) if that makes it convenient for some aspect of the&#xA;implementation.  It then causes this packet to be broadcast to all&#xA;stations on the Ethernet cable originally determined by the routing&#xA;mechanism.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-01-31T16:52:10.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38511" PostTypeId="1" AcceptedAnswerId="38937" CreationDate="2017-01-31T16:54:37.810" Score="0" ViewCount="2027" Body="&lt;p&gt;I have a request from business where they need to have this feature which only allows users to connect to remote vpn only if they are using company provided laptop and restrict them if they use their personal laptop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion how can I achieve this? &lt;/p&gt;&#xA;" OwnerUserId="34021" LastActivityDate="2017-05-04T18:15:38.510" Title="Remote access vpn to connect company provided laptop only" Tags="|cisco-asa|vpn|cisco-anyconnect|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="38513" PostTypeId="1" AcceptedAnswerId="38516" CreationDate="2017-01-31T20:30:11.293" Score="1" ViewCount="382" Body="&lt;p&gt;I'm not good at English But I really confused about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I used the word computer but it can be mobiles or any of devices which can have networking.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let just the Internet bandwidth is 100Mbps, and It is linked to a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many switches and hubs which connected to the router.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eventually, 200 of computers connected to this network by the switches and hubs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, Is bandwidth of the computer in the network (100/200)Mbps? Which means a maximum of the Internet speed is 0.5Mbps when all of the computers uses the Internet?&lt;/p&gt;&#xA;" OwnerUserId="33480" LastActivityDate="2017-05-31T23:41:46.070" Title="Is bandwidth a sum of network speed each computer in sub network?" Tags="|network-core|bandwidth|speed|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38514" PostTypeId="2" ParentId="38490" CreationDate="2017-01-31T20:43:43.697" Score="0" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;we’re back to one network port per station&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You're back to one network port per wired IP phone and/or wired endpoint.  Other endpoints in a typical campus includes IP video cameras, badge readers, and other PoE capable devices.&lt;/p&gt;&#xA;&lt;p&gt;There is still a place for wired ports because of power delivery.  Otherwise, you could get rid of the access switches alltogether.&lt;/p&gt;&#xA;&lt;h3&gt;Idea1 - Preferred&lt;/h3&gt;&#xA;&lt;p&gt;Use single number reach which allows you to publish a campus owned DID(phone number) that will auto matically ring their personal cell, while preserving campus voicemail (vm as an email attachment).&lt;/p&gt;&#xA;&lt;h3&gt;Idea2&lt;/h3&gt;&#xA;&lt;p&gt;For the majority of users, a soft client (downloadable on a tablet or smartphone as an app) on their personal smart phone.  So, you still utilize an IP-based PBX but you limit the number of hardphones to fewer users.&lt;/p&gt;&#xA;&lt;p&gt;Like I said though, PoE is more than just IP phones...&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-01-31T21:20:47.650" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38516" PostTypeId="2" ParentId="38513" CreationDate="2017-01-31T20:54:07.750" Score="1" Body="&lt;p&gt;This subject is very large, but I will try to cover some key points.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The bandwidth of the link to the ISP is 100 Mbps. That means that your router can send 100 Mb to the ISP's router each second, and the ISP's router can send the same to your router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must consider the traffic direction.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For outbound traffic, the bandwidth for each computer is whatever the link speed from the computer to the next device is. For example, your computers could have 1000 Mbps links to the access switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The access switches to which the computers connect will have links to some type of aggregation, and those links will have a bandwidth associated with them. The aggregate access bandwidth compared to the uplink bandwidth will give you an oversubscription ratio. For example, if you have a switch with twenty-four 1 Gbps access ports, and a 1 Gbps uplink, you have a 24:1 oversubscription ratio.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also calculate an oversubscription ratio to the router, and to the ISP's router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not as simple as dividing the bandwidth of the oversubscribed link between all the computers. For the example of the 24-port switch above, one computer could send 1 Gbps to the aggregation switch if it is the only one sending. If all 24 computers are trying to send 1 Gbps at the same time, a lot of traffic will be dropped. The frames going to the aggregation switch will be sent on a first-come, first-served basis. Switches have very, very small buffers, so the vast majority of the traffic will be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How that affects things depends on what is being sent. For example, UDP will be lost, but TCP will request lost segments to be resent.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For inbound traffic, it is unlikely that any links are oversubscribed, and you usually have much more inbound than outbound traffic. You really don't have much control over the traffic from the Internet to your network. If a single request from a computer on your network starts another computer on the Internet sending 1 Gbps of traffic to your network, it can basically monopolize your inbound ISP connection. Someone wanting to disrupt you network can try to overload your incoming network connection in a DoS (Denial of Service) attack.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;There is QoS to try to introduce your vision of fairness to your network. For example, you can prioritize real-time traffic, e.g. VoIP. You can't really do a lot about the traffic coming into your network from the Internet because you don't control the Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-01-31T20:54:07.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38517" PostTypeId="2" ParentId="38508" CreationDate="2017-01-31T20:57:49.737" Score="0" Body="&lt;p&gt;It is handled by a protocol stack, namely, an Internet Protocol Stack.  For example, there is the &lt;a href=&quot;https://en.wikipedia.org/wiki/LwIP&quot; rel=&quot;nofollow noreferrer&quot;&gt;Lightweight Internet Protocol Stack&lt;/a&gt;.  Once you get to the link layer, e.g. Ethernet or WiFi, you are then talking about firmware functionality.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2017-01-31T22:24:06.820" LastActivityDate="2017-01-31T22:24:06.820" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38518" PostTypeId="2" ParentId="38511" CreationDate="2017-01-31T22:44:55.307" Score="1" Body="&lt;p&gt;If your network is based on Microsoft Active Directory, you can configure the system to only allow computers that are joined to the domain to access the corporate network. Since the employee won't have the domain administrator credentials necessary to join his/her personal laptop to the domain, this will prohibit the personal machine from connecting to the network via the VPN. Since you mention Cisco AnyConnect, this can be configured to authenticate the VPN connections via Active Directory, however the exact steps vary depending on the version and type of VPN gateway, as well as the version of Windows Server in use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another step would be to implement MAC based filtering, to only allow certain MAC addresses access, although this would involve recording the MAC addresses of every device that needs access (And should not be the only method of access control as MAC addresses are not difficult to spoof) &lt;/p&gt;&#xA;" OwnerUserId="34027" LastActivityDate="2017-01-31T22:44:55.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38521" PostTypeId="2" ParentId="32838" CreationDate="2017-02-01T00:50:26.497" Score="1" Body="&lt;p&gt;You cannot limit the number of sessions to a policy - there would be no way to determine &quot;good&quot; sessions from &quot;bad&quot; ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the service (let's assume a web-server) you could simply limit the number of connections it will accept on the server - this can be done in things like Apache, NGINX, IIS etc - you should even be able to apply the limit based on whether the source is inside your firewall or outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option could be to apply rate-limiting to specific policies on the SRX - that way if it is a specific service that is attracting the most traffic, you could set a hard limit on the amount of bandwidth it offers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This can be done client-to-server or server-to-client.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do this, set up an application-traffic-control profile, and then reference it in your policy after permit eg:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 match source-address any&#xA;set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 match destination-address SERVER1&#xA;set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 match application junos-http&#xA;set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 match application junos-https&#xA;set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 then permit application-services application-traffic-control rule-set INTERNET-LIMITS&#xA;set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 then log session-init&#xA;set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 then log session-close&#xA;set security policies from-zone INTERNET to-zone DMZ policy PERMIT-SERVER1 then count&#xA;&#xA;set class-of-service application-traffic-control rate-limiters 10M bandwidth-limit 10485760&#xA;set class-of-service application-traffic-control rate-limiters 10M burst-size-limit 524288&#xA;set class-of-service application-traffic-control rule-sets INTERNET-LIMITS rule WEB-10M match application junos-http&#xA;set class-of-service application-traffic-control rule-sets INTERNET-LIMITS rule WEB-10M match application junos-https&#xA;set class-of-service application-traffic-control rule-sets INTERNET-LIMITS rule WEB-10M then rate-limit server-to-client 10M&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will limit all traffic from SERVER1 back to the client to 10M, which will not limit sessions, but instead slow them down so that they don't use all your upstream bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-02-01T00:50:26.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38529" PostTypeId="1" AcceptedAnswerId="38535" CreationDate="2017-02-01T12:52:22.643" Score="1" ViewCount="264" Body="&lt;p&gt;while I was working today on router, My senior said that since VoIP protocol works on UDP, it doesn't support load balancing, which I couldn't quite understand. Can someone enlighten me on this.&#xA;We have tunneling/ connection from India office to Australia office, we have 2 ISPs to connect to that location, one ISP as a backup. Because of we use VoIP calls, we cannot use load balacing or something similar.&lt;/p&gt;&#xA;" OwnerUserId="34047" LastActivityDate="2017-02-01T14:39:31.000" Title="Does UDP work for Load Balancing?" Tags="|cisco|vpn|bgp|voip|split-tunneling|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38535" PostTypeId="2" ParentId="38529" CreationDate="2017-02-01T14:39:31.000" Score="0" Body="&lt;p&gt;The problem with UDP is that it is a simple, connectionless, fire-and-forget, best-effort protocol that has no ordering or guarantees. VoIP and other real-time protocols need to have a reasonably steady data stream that arrives in order.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Load balancing of packets causes jitter and out-of-order packet arrival, both of which are VoIP killers. VoIP can tolerate a fair amount of delay, but it simply can't tolerate much variation in the delay (jitter), not can it tolerate out-of-order packet delivery. Instead of hearing, &quot;Hello,&quot; you may hear what sounds like, &quot;Oh, hell.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be possible to load balance individual flows.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-01T14:39:31.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38537" PostTypeId="2" ParentId="29210" CreationDate="2017-02-01T15:47:19.563" Score="2" Body="&lt;p&gt;HP Procurves should auto-sense any reasonable speed, but 8-N-1-XOn/XOff are required.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2017-02-01T15:47:19.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38538" PostTypeId="1" CreationDate="2017-02-01T15:48:08.123" Score="5" ViewCount="13429" Body="&lt;p&gt;While analyzing Wireshark capturing, I noticed that the sender or the receiver sometimes sends a bunch of consecutive ACKs together as oppose to what I have learned. I learned that for every packet send, an ACK is returned, somehow in the form (send followed by Ack)! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did some searching about that. I found a related concept called &lt;code&gt;ACKs aggregation&lt;/code&gt; but I am not sure if this is the cause. Would someone kindly explain this observation?&lt;/p&gt;&#xA;" OwnerUserId="32299" LastEditorUserId="8499" LastEditDate="2017-07-16T00:50:23.327" LastActivityDate="2020-05-26T16:38:03.163" Title="The reason why TCP sends consecutive ACKs all together" Tags="|cisco|tcp|protocol-theory|transport-protocol|layer4|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38539" PostTypeId="1" AcceptedAnswerId="38572" CreationDate="2017-02-01T16:02:16.640" Score="5" ViewCount="13657" Body="&lt;p&gt;Because I do not find the correct question that I can ask google, due to the lack of terminology. I'm trying to ask it here. Please have patience.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Question is similar to the questions asked &lt;a href=&quot;https://superuser.com/questions/1100537/how-can-i-communicate-to-multiple-devices-that-are-all-at-the-same-ip-address&quot;&gt;here&lt;/a&gt;  and &lt;a href=&quot;https://superuser.com/questions/721354/how-to-communicate-with-devices-that-have-the-same-ip-address&quot;&gt;here&lt;/a&gt; .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to connect to devices that have a the same ip address 192.168.1.1.&#xA;Clearly this is not possible because a IP address needs to be unique.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which setup do I need, in order to access multiple devices that have the same id.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea that I have so far is to use a managed switch that maps the IP address 192.168.&lt;strong&gt;2.n&lt;/strong&gt; to 192.168.&lt;strong&gt;1.1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Image of Routing Overview:&lt;/strong&gt; &lt;a href=&quot;https://www.dropbox.com/s/ezz6zztiaiiq595/Switch.png?dl=0&quot; rel=&quot;nofollow noreferrer&quot;&gt;Image of Routing Overview&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gdpyF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gdpyF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a setup like the image above suggests could be achived, then could you please guide me to how to set it up.&#xA;Also I'm very thankful if you could provide me with the right terminology of what I'm trying to achive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like: Connect two Vlan from port 1 to Port2 with a &lt;strong&gt;bridge&lt;/strong&gt; ....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Author of the post above suggested: &#xA;The managed switch is setup so that each port is &lt;strong&gt;vlan'd into its own untagged vlan and all of those vlans are tagged on the port&lt;/strong&gt; connected to the PC.&#xA;What does it mean, can you explain further?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your help is highly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: What I really trying to achieve is to automate the installment of software on a Linux device that by default comes with a default IP address of 192.168.1.1. Detect the connected device on the network ssh into it and install &amp;amp; configure the software.&lt;/p&gt;&#xA;" OwnerUserId="34055" LastEditorUserId="8499" LastEditDate="2019-01-12T23:10:47.767" LastActivityDate="2022-03-24T21:22:32.100" Title="Network setup for multiple devices with the same IP" Tags="|routing|switch|ip|ipv4|ip-address|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="38541" PostTypeId="1" AcceptedAnswerId="38597" CreationDate="2017-02-01T17:12:11.923" Score="9" ViewCount="5483" Body="&lt;p&gt;I know that a VPN may be used in lots of different ways for lots of different things, so I'm not suggesting that IPv6 removes the need for a VPN completely.&#xA;I'm interested in one particular use-case:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a cellular (GSM) router, and traditionally, a standard SIM from my local network operator will give me a dynamic IPv4 address. In order to be able to reach my router from the internet, today I use a VPN. This does 2 things:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It gives my router a static IPv4 address. This will not change, if the dynamic IPv4 address assigned by the operator changes, or if I change operators.&lt;/li&gt;&#xA;&lt;li&gt;It allows me to traverse the operator's NAT firewall. If my router is acting as a server, I can initiate a connection to it.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm still learning about IPv6, but it seems to me that if a network operator supports IPv6 (say Verizon Wireless in the US), then I no longer need a VPN:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;3GPP cellular operators use SLAAC, and I get a Global Unicast Address. This, by definition, is globally-routable. There is no NAT.&lt;/li&gt;&#xA;&lt;li&gt;I know what /64 prefix the operator assigns, and I know what Interface ID will be used (either EUI-64 or RFC 7217), so I have a static IPv6 address.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is this correct? Or am I missing something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, I'm aware that a VPN provides extra security, because it adds authentication and encryption. But lets assume for the purposes of this discussion that I will use an IPv6 firewall, or IPsec, or TLS at the application layer, for security.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I could continue to use a VPN with IPv6, and this would allow me to use Unique Local IPv6 Addresses just like my old private IPv4 addresses. But why would I &lt;em&gt;need&lt;/em&gt; to?&lt;/p&gt;&#xA;" OwnerUserId="31396" LastEditorUserId="8499" LastEditDate="2019-01-02T22:31:55.400" LastActivityDate="2023-12-05T09:45:07.173" Title="Does IPv6 remove the need for a VPN?" Tags="|ipv4|vpn|nat|ipv6|mobile|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38542" PostTypeId="2" ParentId="38541" CreationDate="2017-02-01T17:35:56.957" Score="5" Body="&lt;p&gt;The primary point of IPv6 is that it restores the original idea of every device having a unique IP address, which restores the end-to-end concept of IP. NAT is a kludge to extend the life of IPv4 until IPv6 can become ubiquitous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point of a VPN (Virtual &lt;em&gt;Private&lt;/em&gt; Network) is to give your traffic &lt;em&gt;privacy&lt;/em&gt; while in transit, although it can fix some of the problems inherent with IPv4 NAT, but fixing those problems is &lt;em&gt;not&lt;/em&gt; the real purpose of a VPN. You can use a VPN with IPv6 for the real reason of a VPN: privacy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 does have, built into it, a way to encrypt traffic on the wire. Unfortunately, it is poorly supported in the way it was intended, although OSPFv3 uses it. The intention was to not need a VPN wrapper around the IPv6 packets, but to move that inside the IPv6 packets. With the current environment of both IPv4 and IPv6, it is much simpler to have one way to encrypt your traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-01T17:35:56.957" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38544" PostTypeId="2" ParentId="38539" CreationDate="2017-02-01T18:55:50.570" Score="2" Body="&lt;p&gt;Your drawing and idea have some problems:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Your router has multiple interfaces in the same network, but that&#xA;will not work. Routers route between networks, not from a network&#xA;back to the same network, so router interfaces must be in the&#xA;different networks.&lt;/li&gt;&#xA;&lt;li&gt;Switches are layer-2 devices, and they are ignorant of layer-3, e.g.&#xA;IP. Layer-2 can carry any number of layer-3 protocols (IPv4, IPX,&#xA;IPv6, AppleTalk, etc.) because they do not know or care about&#xA;layer-3.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The idea of changing IP addresses on packets is NAT (Network Address Translation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A real problem for you is that on whatever network a PC connected, changing the address on the PC to a different network address will stop the PC from communicating after you change the address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-01T18:55:50.570" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38548" PostTypeId="2" ParentId="38498" CreationDate="2017-02-01T20:28:08.430" Score="1" Body="&lt;p&gt;You need to have valid licenses to use Advanced Services as Content Filtering or App control. There are no alternative to this. Just check in www.mysonicwall.com what license do you have for your device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your license are still valid, you need to resync or re-register the device.&#xA;If your license expired, only option is renewing it (paying it of course :P)&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2017-02-01T20:28:08.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38551" PostTypeId="2" ParentId="35499" CreationDate="2017-02-02T00:17:08.287" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is why are the IP addresses incomplete?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;An ARP entry is marked as incomplete when the device in question (in this case your switch) can't get an ARP response from the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This generally means that host IP doesn't exist, or you are filtering ARP responses on either the host (generally difficult to do), or on the switch (eg: using a VLAN access-map and blocking the ARP Ethertype).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your switch is L3 (eg: it is routing to each of those subnets), then it may be that devices elsewhere in your network are trying to reach them, and while the switch has the subnet locally attached to it, it cannot resolve ARP and work out the destination MAC.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why does it show duplicate mac addresses in same VLAN?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I could be wrong, but I think VLAN ID is in the second last column of your output, in which case, you have a bunch of different VLANs all trunked on &lt;code&gt;Po133&lt;/code&gt; and you are just seeing the same MAC in multiple VLANs (which is perfectly legitimate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that ARP Tables and MAC-address-tables are two very different things - one relates to routing (L3), and one to switching (L2).&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-02-02T00:17:08.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38556" PostTypeId="1" CreationDate="2017-02-02T10:00:40.907" Score="1" ViewCount="1226" Body="&lt;p&gt;have two DC, with 2 N5K on each DC. I want to connect these pairs with Fabricpath to have full bandwidth used. I've seen that vPC back to back can do the trick. &#xA;BUT Fabricpath brings vPC+ with it, and I use FEX on each site. So is it worth having Fabricpath to get the vPC+ or no and I must consider the vPC classic with FEX and vPC back to back between pairs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="24395" LastActivityDate="2017-02-02T16:32:10.613" Title="Fabricpath or vpc back to back" Tags="|cisco|cisco-nexus-5k|vpc|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38558" PostTypeId="2" ParentId="38538" CreationDate="2017-02-02T10:52:34.510" Score="0" Body="&lt;p&gt;You're looking for &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122#page-96&quot; rel=&quot;nofollow noreferrer&quot;&gt;Delayed ACk&lt;/a&gt;, see 4.2.3.2  When to Send an ACK Segment&lt;/p&gt;&#xA;" OwnerUserId="13967" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2017-02-02T10:52:34.510" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38559" PostTypeId="2" ParentId="38538" CreationDate="2017-02-02T10:58:59.653" Score="0" Body="&lt;p&gt;In general, nothing can be said about when an ACK is sent. This because the network protocol aims to optimize the sending, for instance by delaying the ACK and &lt;a href=&quot;https://en.wikipedia.org/wiki/Piggybacking_(data_transmission)&quot; rel=&quot;nofollow noreferrer&quot;&gt;piggybacking&lt;/a&gt; it to another data frame instead of sending it by itself immediately.&lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2017-02-02T10:58:59.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38560" PostTypeId="2" ParentId="38541" CreationDate="2017-02-02T11:04:59.960" Score="0" Body="&lt;p&gt;In case of privacy alone, just maybe... but it still has other uses like bypassing geo-restrictions and unblocking websites and all... so i guess a vpn serves a purpose greater than just offering privacy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apart from the technical discussion, I think this page pretty much sums up what a vpn can do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ivacy.com/what-is-vpn/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.ivacy.com/what-is-vpn/&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="34084" LastActivityDate="2017-02-02T11:04:59.960" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38561" PostTypeId="1" AcceptedAnswerId="38570" CreationDate="2017-02-02T11:32:28.110" Score="2" ViewCount="304" Body="&lt;p&gt;I want my WiFi to be invisible to anyone, and I don't mean hidden. I know about the hidden SSID method, but in this method the network is visible like &quot;hidden network&quot;. I would like to create a really hidden network, visible only to me in someway. Is it possible?&lt;/p&gt;&#xA;" OwnerUserId="34085" LastActivityDate="2018-04-08T01:17:29.047" Title="Really Invisible WiFi (not just hidden)" Tags="|ieee-802.11|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38563" PostTypeId="1" AcceptedAnswerId="38589" CreationDate="2017-02-02T12:08:11.207" Score="2" ViewCount="1418" Body="&lt;p&gt;Is is possible to setup site to site ipsec tunnel on two ASA with certificate authentication without available certificate authority for both ASA.&#xA;As per guide from: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/110221-asavpnclient-ca.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco site&lt;/a&gt;&#xA;Certificate authority is required. Anyone could help with some materials, guides etc? Business need is to eliminate PSK.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sH3xn.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sH3xn.gif&quot; alt=&quot;diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-02T20:29:33.450" Title="Cisco ASA Site to Site Ikev2 certificate authentication without Certificate authority" Tags="|cisco|cisco-asa|vpn|tunnel|" AnswerCount="1" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="38564" PostTypeId="1" CreationDate="2017-02-02T12:18:21.683" Score="3" ViewCount="379" Body="&lt;p&gt;When we where using Cisco VPN client, we configured preshared key, under tunnel configuration, and that preshared key had to be configured on VPN client, and on ASA. And client had to have this preshared key if he wanted to connect to ASA. Is preshared key configurable in IKEv2 when tunnel is RA? If not, how can be configured client authentication in tunnel? Not only ASA authentication with certificate that IKEv2 uses.&lt;/p&gt;&#xA;" OwnerUserId="3481" LastActivityDate="2018-12-25T06:01:05.210" Title="IKEv2 client authentication in tunnel RA vpn" Tags="|cisco-anyconnect|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38565" PostTypeId="2" ParentId="38564" CreationDate="2017-02-02T12:30:48.867" Score="1" Body="&lt;p&gt;Ideally you want to setup directory like Radius to authenticate against.&#xA;Please see guide hope that help: &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/117641-config-asa-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;guide&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although you can have a local users as per this guide: &lt;a href=&quot;https://supportforums.cisco.com/document/74111/asa-anyconnect-ikev2-configuration-example&quot; rel=&quot;nofollow noreferrer&quot;&gt;guide&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-02T12:30:48.867" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38570" PostTypeId="2" ParentId="38561" CreationDate="2017-02-02T12:47:15.867" Score="3" Body="&lt;p&gt;Hi WiFi network as it names says is wireless, you can't hide it.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;There is few options you can do like disable beacon frame broadcast. &#xA;Than you won't be able to discovery network SSID. But packets will be still sent and simple WiFi scan would find your network SSID.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You can decrease TX/RC power to make it range shorter just to cover chosen area.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Modification of frequency spectrum that WiFi client and AP is working on different than assigned frequencies (2.4,  5) but it would be more likely illegal to use different range. It as well not hiding your network but moving it to different frequency and with proper tools you would be able to see packets flowing.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-02T12:47:15.867" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="38571" PostTypeId="2" ParentId="38556" CreationDate="2017-02-02T13:14:16.383" Score="2" Body="&lt;p&gt;You don't need fabricpath to run a vPC+ from a FEX.  Fabricpath is really only useful in large data centers where you have a multiple tier topology (Core, Aggregation, Access).  In a smaller setup using a collapsed core type design, vPC is simpler and accomplishes the same goal of getting rid of spanning tree.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2017-02-02T13:14:16.383" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38572" PostTypeId="2" ParentId="38539" CreationDate="2017-02-02T13:50:01.793" Score="1" Body="&lt;p&gt;Here is how I would do it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get a linux box and fit enough network interfaces that each device you want to talk to can have it's own port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Put each of the device ports in it's own network namespace. Connect the network namespaces back to a bridge in the main network namespace using veth pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now in each network namespace you can use NAT to translate a unique PC-side destination address to a non-unique device-side destination address.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-02T13:50:01.793" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38573" PostTypeId="1" AcceptedAnswerId="38575" CreationDate="2017-02-02T14:41:38.053" Score="50" ViewCount="111582" Body="&lt;p&gt;I think I understand these concepts, but I'm a little rusty. Can someone give a concise, easy-to-understand explanation of these concepts? The planes are logical concepts, aren't they? Is this a Cisco only thing?&lt;/p&gt;&#xA;" OwnerUserId="15501" LastEditorUserId="56030" LastEditDate="2020-06-06T13:52:19.753" LastActivityDate="2020-09-16T14:15:44.340" Title="Difference between control plane, data plane and management plane?" Tags="|cisco|switch|router|management|data|" AnswerCount="6" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="38575" PostTypeId="2" ParentId="38573" CreationDate="2017-02-02T15:29:10.163" Score="51" Body="&lt;p&gt;These terms are abstract logical concepts, much like the OSI model.&lt;/p&gt;&#xA;&lt;p&gt;Data plane refers to all the functions and processes that forward packets/frames from one interface to another.&lt;/p&gt;&#xA;&lt;p&gt;Control plane refers to all the functions and processes that determine which path to use. Routing protocols (such as OSPF, ISIS, EIGRP, etc...), spanning tree, LDP, etc are examples.&lt;/p&gt;&#xA;&lt;p&gt;Management plane is all the functions you use to control and monitor devices.&lt;/p&gt;&#xA;&lt;p&gt;These are mostly logical concepts but things like SDN (&lt;strong&gt;S&lt;/strong&gt;oftware &lt;strong&gt;D&lt;/strong&gt;efined &lt;strong&gt;N&lt;/strong&gt;etwork) separate them into actual devices.&lt;/p&gt;&#xA;&lt;p&gt;Finally, all manufacturers use these concepts.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="53804" LastEditDate="2020-09-16T09:05:00.780" LastActivityDate="2020-09-16T09:05:00.780" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="38576" PostTypeId="2" ParentId="959" CreationDate="2017-02-02T15:35:20.647" Score="0" Body="&lt;p&gt;It depends on whether or not transcoding is required.  If you are using a codec in-house that is incompatible with your SIP providers gateway then yes.  Otherwise, no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Same with Unity Express voicemail.  If the voicemail is using the codec you run in-house, no transcoding required.  However if you are compressing voicemails (recording them in g.729, for example), then you will have to invoke the DSP to transcode.  Otherwise, users can't leave VM's.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-02T15:35:20.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38577" PostTypeId="2" ParentId="38573" CreationDate="2017-02-02T15:43:55.293" Score="25" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Forwarding Plane - Moves packets from input to output&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Control Plane - Determines how packets should be forwarded&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Management Plane - Methods of configuring the control plane (CLI,&#xA;  SNMP, etc.)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://learningnetwork.cisco.com/docs/DOC-20959&quot;&gt;Undestand the difference between Forwarding, Control and Management Plane&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-02T15:43:55.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38579" PostTypeId="2" ParentId="38539" CreationDate="2017-02-02T15:58:44.073" Score="-2" Body="&lt;p&gt;Your question says &quot;How to connect to devices that have a the same ip address 192.168.1.1. Clearly this is not possible because a IP address needs to be unique.&quot;  However, that is exactly what Cisco's IOS SLB Feature indicates.  See below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/interfaces-modules/content-switching-module/15055-ios-slb.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring IOS Server Load Balancing with HTTP Probes in the Dispatched Mode&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The Cisco IOS® Server Load Balancing (SLB) feature is a Cisco&#xA;  IOS-based solution that provides server load balancing. This feature&#xA;  allows you to define a virtual server that represents a cluster of&#xA;  real servers, known as a server farm. When a client initiates a&#xA;  connection to the virtual server, the IOS SLB load balances the&#xA;  connection to a chosen real server, depending on the configured&#xA;  load-balance algorithm or predictor.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;IOS SLB can be configured to operate in the following two modes.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;dispatched mode—In this mode, the virtual server address is known to&#xA;  the real servers. You must configure each of the real servers with&#xA;  loopback addresses for their unique loopback interface. This is&#xA;  necessary to give &lt;strong&gt;each machine in the server farm the same IP address&lt;/strong&gt;&#xA;  as the actual virtual server. The destination real server will then be&#xA;  allowed to respond directly to clients using the loopback address,&#xA;  just as it would for its own IP address. IOS SLB redirect packets to&#xA;  the real server at Layer 2 at the media access control (MAC) layer.&#xA;  Since the virtual server IP address is not modified in dispatched&#xA;  mode, the real servers must be Layer 2-adjacent to IOS SLB, or&#xA;  intervening routers might not be able to route to the chosen real&#xA;  server.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2017-02-02T22:39:01.993" LastActivityDate="2017-02-02T22:39:01.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38581" PostTypeId="2" ParentId="38556" CreationDate="2017-02-02T16:32:10.613" Score="2" Body="&lt;p&gt;Both approaches will work and are actively documented and supported.  FP starts to really have a significant advantage if you have more than the 4 switches in your design and, particularly, if you ever wanted to add more sites (3 sites would push you back to STP).  FP has the advantage of less configuration and the ability to do some interesting things with anycast HSRP (again - more significant if you wanted to run more than two switches in a site) and somewhat greater flexibility.  The downside is that it's not only Cisco proprietary but is limited to a smaller subset of older (and more expensive) switches - specifically 7K with F-series or M3 blades and 5500/5600.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-02T16:32:10.613" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38582" PostTypeId="1" AcceptedAnswerId="38583" CreationDate="2017-02-02T16:50:06.317" Score="2" ViewCount="126" Body="&lt;p&gt;While reading the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC&lt;/a&gt; of NDP I wondered, why it is necessary to monitor upper layer traffic in order to know if a neighbor is reachable, e.g. a TCP ACK.&lt;/p&gt;&#xA;&lt;p&gt;I do get the IPv6 packet anyway, so I know it's reachable without having to bother about TCP.&lt;/p&gt;&#xA;" OwnerUserId="34092" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2018-12-26T05:09:52.193" Title="Why does Neighbor Discovery Protocol have to monitor upper-layer protocols?" Tags="|tcp|ipv6|layer3|layer4|rfc|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38583" PostTypeId="2" ParentId="38582" CreationDate="2017-02-02T17:31:34.693" Score="2" Body="&lt;p&gt;Where does it say it is &amp;quot;&lt;em&gt;necessary to monitor upper layer traffic?&lt;/em&gt;&amp;quot; &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 4861, Neighbor Discovery for IP version 6 (IPv6)&lt;/em&gt;&lt;/a&gt; actually says:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;When available, this upper-layer information SHOULD be used.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2119&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 2119, Key words for use in RFCs to Indicate Requirement Levels&lt;/em&gt;&lt;/a&gt; defines the term SHOULD:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;SHOULD   This word, or the adjective &amp;quot;RECOMMENDED&amp;quot;, mean that there may exist valid reasons in particular circumstances to ignore a&#xA;particular item, but the full implications must be understood and&#xA;carefully weighed before choosing a different course.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The use of upper-layer protocol information deals with Neighbor Unreachability Detection. This deals with neighbors that have already been discovered, but something may have gone wrong. For instance, a the neighbor's NIC was swapped, so the MAC address for the neighbor has changed. You need to make sure that the forward path works. See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861#section-7.3.1&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;7.3.1. Reachability Confirmation&lt;/em&gt;&lt;/a&gt;, specifically:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The receipt of a solicited Neighbor Advertisement serves as&#xA;reachability confirmation, since advertisements with the Solicited&#xA;flag set to one are sent only in response to a Neighbor Solicitation.&#xA;Receipt of other Neighbor Discovery messages, such as Router&#xA;Advertisements and Neighbor Advertisement with the Solicited flag set&#xA;to zero, MUST NOT be treated as a reachability confirmation.  Receipt&#xA;of unsolicited messages only confirms the one-way path from the&#xA;sender to the recipient node.  In contrast, Neighbor Unreachability&#xA;Detection requires that a node keep track of the reachability of the&#xA;forward path to a neighbor from its perspective, not the neighbor's&#xA;perspective.  Note that receipt of a solicited advertisement&#xA;indicates that a path is working in both directions.  The&#xA;solicitation must have reached the neighbor, prompting it to generate&#xA;an advertisement.  Likewise, receipt of an advertisement indicates&#xA;that the path from the sender to the recipient is working.  However,&#xA;the latter fact is known only to the recipient; the advertisement's&#xA;sender has no direct way of knowing that the advertisement it sent&#xA;actually reached a neighbor.  From the perspective of Neighbor&#xA;Unreachability Detection, only the reachability of the forward path&#xA;is of interest.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-02-02T17:31:34.693" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38585" PostTypeId="2" ParentId="38506" CreationDate="2017-02-02T18:31:46.213" Score="3" Body="&lt;p&gt;Alright, so&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;action policy POLICY_NAME $arg&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;doesn't pass arguments to the script - had to switch to&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;action cli command &quot;tclsh flash:/script.tcl $arg&quot;`&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which does, HOWEVER...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EEM actions are unable to capture beyond a newline from a variable.&#xA;I did find a way out though - trim the newline from &lt;code&gt;$_syslog_msg&lt;/code&gt; (newline is the first char) and assign to a new variable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the end-to-end solution:&lt;/p&gt;&#xA;&#xA;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;CISCO-1811#sh run | s event&#xA;event manager directory user policy &quot;flash:/&quot;&#xA;event manager directory user library &quot;flash:/&quot;&#xA;event manager directory user repository tftp://1.1.1.3/&#xA;event manager applet TRIGGER_ON_SYSLOG&#xA;  event syslog occurs 1 pattern &quot;%.*&quot;&#xA;  action 1.0 string trimleft &quot;$_syslog_msg&quot;&#xA;  action 2.0 cli command &quot;enable&quot;&#xA;  action 2.1 cli command &quot;tclsh flash:/sendevent.tcl \&quot;$_string_result\&quot;&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$_string_result&lt;/code&gt; is an EEM built-in variable that collects the output of string trimleft&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/command/eem-cr-book/eem-cr-a2.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/eem/command/eem-cr-book/eem-cr-a2.html&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Use the &lt;code&gt;action string trimleft&lt;/code&gt; command to trim a string from the left end of another string.&#xA;  This command trims the characters specified by &lt;code&gt;string2&lt;/code&gt; from the left end of &lt;code&gt;string1&lt;/code&gt;. By default, &lt;code&gt;string2&lt;/code&gt; corresponds to white space.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The table below shows the built-in variable in which the result of the &lt;code&gt;action string trimleft&lt;/code&gt; command is stored.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Built-in Variable&lt;/strong&gt;:&#xA;  &lt;code&gt;$_string_result&lt;/code&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Description&lt;/strong&gt;:&#xA;  The result of the &lt;code&gt;action string trimleft&lt;/code&gt; command is stored in this variable.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The above is actually incomplete/misleading/or Cisco has no idea how the language they picked works:&#xA;&lt;code&gt;string trimleft&lt;/code&gt; without a second argument trims &lt;strong&gt;space, tab, newline, and CR&lt;/strong&gt; not just white space (See this: &lt;a href=&quot;http://wiki.tcl.tk/10177&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://wiki.tcl.tk/10177&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;sendevent.tcl&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#...&#xA;# my own http_get implementation here&#xA;# ...&#xA;&#xA;# My actual event code&#xA;&#xA;set url &quot;http://some.http.destination:8000&quot;&#xA;&#xA;# Event log message is passed in as &quot;$argv 0&quot;.&#xA;# That's the first item in $argv (which is a list)&#xA;set rawmsg [lindex $argv 0]&#xA;&#xA;# Strip quotes from syslog message&#xA;set cleanmsg [string map { &quot;\&quot;&quot; &quot;&quot; } $rawmsg]&#xA;&#xA;# Get the time stamp at source&#xA;set timestamp [clock format [clock seconds] -format &quot;%Y-%m-%dT%H:%M:%S&quot;]&#xA;&#xA;set json &quot;{&#xA;    \&quot;RouterTimestamp\&quot;: \&quot;$timestamp\&quot;,&#xA;    \&quot;Message\&quot;: \&quot;$cleanmsg\&quot;&#xA;}\n&quot;&#xA;&#xA;# This makes a POST request. Yes a POST.&#xA;# Don't know, ask the TCL developers what's with the name :)&#xA;if {[catch {http_get $url -query $json} token]} {&#xA;    puts &quot;HTTP POST request failed: $token&quot;&#xA;} else {&#xA;    # Everything is fine&#xA;    puts &quot;POST successful.&quot;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h3&gt;Result&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;POST / HTTP/1.1&#xA;Accept: */*&#xA;Host: some.http.destination&#xA;User-Agent: Snobu Speshul TCL HTTP/1.1 Client library // build 21&#xA;Connection: close&#xA;Content-Length: 151&#xA;Content-Type: application/json&#xA;&#xA;{&#xA;    &quot;RouterTimestamp&quot;: &quot;2017-02-02T10:09:49&quot;,&#xA;    &quot;Message&quot;: &quot;*Feb  2 10:09:49.307: %CLEAR-5-COUNTERS: Clear counter on all interfaces by console&quot;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;GitHub repo here (code complete): &lt;a href=&quot;https://github.com/snobu/cisco-syslog-over-http&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/snobu/cisco-syslog-over-http&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10197" LastEditorUserId="8499" LastEditDate="2017-02-03T15:08:07.737" LastActivityDate="2017-02-03T15:08:07.737" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38586" PostTypeId="2" ParentId="38561" CreationDate="2017-02-02T18:42:18.783" Score="3" Body="&lt;p&gt;What you're trying to accomplish is not really feasible. As Wi-Fi uses radio waves, they will propagate to the environment. Really, the only way to prevent others from seeing your Wi-Fi is an RF-insulated room (implemented using a Faraday cage -- you need to take into account the wavelength of Wi-Fi signals if using a net instead of using solid metal). Such rooms are very common in companies that do radio wave related work. Oh, and your mobile phone will not work in such a room.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;May I suggest a wired network instead? You can hide your wired network extremely well: in theory, there may be some emissions from twisted pair cables, but in practice nobody with an ordinary computer will see that you have a wired network. If your enemy is an intelligence agency, then you should consider reading the Wikipedia article on TEMPEST.&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2017-02-02T18:42:18.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38587" PostTypeId="1" AcceptedAnswerId="38624" CreationDate="2017-02-02T18:43:51.813" Score="2" ViewCount="318" Body="&lt;p&gt;I have following doubt regarding Fast retransmitting.&#xA;First of all i will Explain Fast retransmit.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Fast Retransmit-:If a sender has  send packet P,P+1,P+2...P+N and let Packet P is  lost ,Now Reciever is expecting Packet P.Reciever will send 3 Duplicate Ack to sender &quot;expecting Packet P&quot;.Sender on recieving  3 Duplicate Ack,Retransmit Packet P.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;My doubt-:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;What Happens to Packet P+1,P+2,...,P+N ?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;li&gt;Do sender Need to retransmit Packet P+1,P+2....P+N also??&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32176" LastActivityDate="2017-02-03T16:34:41.727" Title="Fast Retransmit" Tags="|tcp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38588" PostTypeId="1" AcceptedAnswerId="38590" CreationDate="2017-02-02T19:47:19.047" Score="13" ViewCount="34203" Body="&lt;p&gt;Can someone explain the differences between a RIB and FIB a little further? I didn't see any similar questions on the site so I thought this would be a good addition. The RIB routes and the FIB forwards? Is that all there is to it?&lt;/p&gt;&#xA;" OwnerUserId="15501" LastActivityDate="2017-02-02T20:36:42.553" Title="RIB vs FIB differences?" Tags="|cisco|routing|switching|layer2|layer3|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38589" PostTypeId="2" ParentId="38563" CreationDate="2017-02-02T20:29:33.450" Score="3" Body="&lt;p&gt;From the comments I understand that you mean you have a CA, it's just not reachable by the VPN peers. (If you do not have a CA at all, things are different).&#xA;As you mention yourself in the comments, installing the CA certificate on each side is enough to be able to valide the peer's certificate, and access to the CA is only required if you want to do revocation checking (i.e. download the CRL).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are multiple ways to solve this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) If you control the CA, you can configure it to push the CRL out to a separate HTTP server that is accessible from the VPN peers, and include that server's URL as the CDP in the certificates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) If you control the CA, you can configure it to issue certificates without a CDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) On the VPN peers, you can configure &quot;crl nocheck&quot; under the CA trustpoint.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously, solution 1 would be the most secure as it still allows revocation checking.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2017-02-02T20:29:33.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38590" PostTypeId="2" ParentId="38588" CreationDate="2017-02-02T20:36:42.553" Score="13" Body="&lt;p&gt;The forwarding information base (FIB) is the actual information that a routing/switching device uses to choose the interface that a given packet will use for egress.  For example, the FIB might be programmed such that a packet bound to a destination in 192.168.1.0/24 should be sent out of physical port ethernet1/2.  There may actually be multiple FIB's on a device for unicast forwarding vs multicast RPF checking, different protocols (ip vs mpls vs ipv6) but the basic function is the same - selection criteria (usually destination) mapping to output interface/encapsulation.  Individual FIB's may also be partitioned to achieve concurrent independent forwarding tables (i.e. vrf's).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each FIB is programmed by one or more routing information bases (RIB).  The RIB is a selection of routing information learned via static definition or a dynamic routing protocol.  The algorithms used within various RIB's will vary - so, for example, the means by which BGP or OSPF determines potential best paths vary quite a bit.  The means by which multiple RIB's are programmed into a common (set) of FIB's in a box will vary by implementation but this is where concepts like administrative distance are used (e.g. identical paths are learned via eBGP and OSPF, the eBGP is usually preferred for FIB injection).  Again, RIB's may also be potentially partitioned to allow for multiple vrf's, etc.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-02T20:36:42.553" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38591" PostTypeId="1" AcceptedAnswerId="38600" CreationDate="2017-02-02T22:33:03.393" Score="2" ViewCount="260" Body="&lt;p&gt;I have the following config snippets on a layer 3 switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;!&#xA;interface GigabitEthernet1/0/22&#xA; switchport access vlan 51&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/23&#xA; switchport access vlan 15&#xA; switchport mode access&#xA;!&#xA;interface Vlan15&#xA; ip address 192.168.15.240 255.255.255.0&#xA;!&#xA;interface Vlan51&#xA; ip address 192.168.51.1 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have no access lists.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Computer A is 192.168.51.50 on Vlan 51.&#xA;&#xA;Computer B is 192.168.15.200 on Vlan 15.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;G1/0/23 actually plugs into a dumb switch, and Vlan15 is a large unmanaged network on the .15 range.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer A can ping &lt;code&gt;192.168.15.240&lt;/code&gt;, however cannot ping computer B. My Layer 3 switch can ping 192.168.15.240, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer B does not have &lt;code&gt;192.168.15.240&lt;/code&gt; as gateway. However, I don't know if this matters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is routing not working between computer A and B? What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="33283" LastEditorUserId="8499" LastEditDate="2018-12-12T23:57:12.823" LastActivityDate="2021-01-05T14:20:58.967" Title="Cisco cross-vlan routing" Tags="|cisco|routing|switch|vlan|layer3|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38594" PostTypeId="2" ParentId="38591" CreationDate="2017-02-02T22:47:30.583" Score="3" Body="&lt;p&gt;Computer B needs to have a default gateway if it needs to communicate with endpoints on a different subnet. Typically, endpoints get their default gateway from a DHCP server automatically.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-02T22:47:30.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38596" PostTypeId="2" ParentId="38591" CreationDate="2017-02-02T22:55:28.307" Score="3" Body="&lt;p&gt;Computer A requires a mask of 255.255.255.0 and a default gayeway of 192.168.51.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer B requires a mask of 255.255.255.0 and a default gateway of 192.168.15.240.&lt;/p&gt;&#xA;" OwnerUserId="34109" LastActivityDate="2017-02-02T22:55:28.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38597" PostTypeId="2" ParentId="38541" CreationDate="2017-02-02T23:30:06.463" Score="4" Body="&lt;p&gt;I think your idea that consumer and mobile ISPs will give out static IPv6 is optimistic to say the least. Some may do so but many probably will not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPNs provide two main features.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;They provide protection for the traffic against evesdropping, spoofing, replay attacks and so-on.&lt;/li&gt;&#xA;&lt;li&gt;They decouple your addressing and routing from the operators of your underlying networks.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Feature 2 is useful for many reasons. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You can work around &quot;outgoing connections only&quot; firewalls/NATs. While Nat is strongly discouraged for v6 &quot;outgoing connections only firewalls are likely to remain common. &lt;/li&gt;&#xA;&lt;li&gt;You can keep a consistent IP address on machines even when your provider readdresses their networks.&lt;/li&gt;&#xA;&lt;li&gt;You can keep a consistent IP address on machines even when they move location or provider.&lt;/li&gt;&#xA;&lt;li&gt;Due to the above two points you can more easily use IP based access control, either within your own networks or for access to third party services.&lt;/li&gt;&#xA;&lt;li&gt;If you have high quality links between your campuses around the world and good connections from each campus into the local broadband/mobile providers you can route traffic from your mobile and work at home users down those links rather than down whatever shitty transit their &quot;broadband&quot; provider bought.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some of these may be less of an issue in a v6 world but I expect that VPNs will still be useful in general and will likely remain a good solution for administering remote devices.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-02T23:30:06.463" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38599" PostTypeId="1" AcceptedAnswerId="38602" CreationDate="2017-02-03T00:06:55.610" Score="2" ViewCount="1018" Body="&lt;p&gt;Consider two machines A and B, machine A sends 3 packets to B of sequence number 1, 2, 3 during transmission only packets 1 and 3 are received by B. Now B requests for packet 2, and machine A sends the requested packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a doubt here, does machine store all the packets in some memory as buffer or does it again make packets and send only the requested packets?  And if it is based on having buffer memory to store all the packets, where this buffer is stored in the serving machine? and when this buffer is cleared? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does the whole process of recovery of packets take place? &lt;/p&gt;&#xA;" OwnerUserId="27914" LastEditorUserId="27914" LastEditDate="2017-02-03T00:18:54.030" LastActivityDate="2017-02-03T03:06:14.053" Title="TCP error recovery" Tags="|tcp|protocol-theory|udp|transport-protocol|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38600" PostTypeId="2" ParentId="38591" CreationDate="2017-02-03T00:45:07.467" Score="2" Body="&lt;p&gt;For a host to communicate with any other host not on its network, it needs to have a proper gateway configuration. A host will mask both the destination and its own source addresses with its network mask to determine if the destination address is on a different network. If the destination address is on a different network, then the traffic gets sent to its configured gateway, and it is up to the gateway to send the traffic to the other network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If either of your hosts do not have their gateways set to their respective gateway addresses (the IP addresses on the SVI for their respective VLANs), then you cannot have two-way communication between the two hosts, because traffic destined for the other network will never be sent to the gateway for routing to the other network.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Why is routing not working between computer A and B?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Routing seems to be working from Computer A to Computer B, but not the other way around. Ping is bidirectional, and Computer B is getting the ping request from Computer A, but Computer B is unable to reply because it has no route to Computer A.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-03T01:48:12.520" LastActivityDate="2017-02-03T01:48:12.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38602" PostTypeId="2" ParentId="38599" CreationDate="2017-02-03T03:06:14.053" Score="3" Body="&lt;p&gt;&lt;a href=&quot;http://www.ciscopress.com/articles/article.asp?p=769557&amp;amp;seqNum=2&quot; rel=&quot;nofollow noreferrer&quot;&gt;This book&lt;/a&gt; has a good answer to your question:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Nodes that are transmitting also use the acknowledgment number,&#xA;  sequence number, and window value as a gauge of how long to retain&#xA;  data that has been previously transmitted. &lt;strong&gt;Each segment that has&#xA;  been transmitted and is awaiting acknowledgment is placed in a&#xA;  &lt;em&gt;retransmission queue&lt;/em&gt; and is considered to be unacknowledged by the&#xA;  recipient application process.&lt;/strong&gt; When a segment is placed in the&#xA;  retransmission queue, a timer is started indicating how long the&#xA;  sender will wait for an acknowledgment.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;And then,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The purpose of this retransmission queue is twofold:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It allows the transmitting node to allocate &lt;strong&gt;memory capacity&lt;/strong&gt; to retain&#xA;  the segments that have been previously transmitted. If a segment is&#xA;  lost (congestion, packet loss), it can be transmitted from the&#xA;  retransmission queue, and remains there until acknowledged by the&#xA;  recipient application process (window update). It allows the original&#xA;  segment, once placed in the retransmission queue, to be removed from&#xA;  the original transmission queue. This in effect allows TCP to be&#xA;  continually extracting data from the local transmitting application&#xA;  process while not compromising the transmitting node's ability to&#xA;  retransmit should a segment become lost or otherwise unacknowledged.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="129" LastActivityDate="2017-02-03T03:06:14.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38604" PostTypeId="1" AcceptedAnswerId="38613" CreationDate="2017-02-03T08:36:30.273" Score="1" ViewCount="2371" Body="&lt;p&gt;We have connection problems to some 3rd party https endpoints.&#xA;We checked the network packages via Wireshark to find the problem but we couldn't identify anything yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I compared one working and one not working endpoint to see the differences and see a strange type of protocol shown on Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark shows ClientHello as SSL in the packet list.&#xA;But if I check the SSL layer of the package I see it as Version: TLS 1.2 (0x0303)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why Wireshark identify this packet as SSL?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the captured packages .pcapng files:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Wrong protocol:(connection is RESET from the server side)&#xA;&lt;a href=&quot;https://drive.google.com/open?id=0B95MNyFyqGw0bFk2ZFhMdEFpRDQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=0B95MNyFyqGw0bFk2ZFhMdEFpRDQ&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Correct protocol: (connection is OK)&#xA;&lt;a href=&quot;https://drive.google.com/open?id=0B95MNyFyqGw0OVVVd3VIa19Ud3M&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=0B95MNyFyqGw0OVVVd3VIa19Ud3M&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We suspect that maybe this wrong protocol is causing the connection failed.&lt;/p&gt;&#xA;" OwnerUserId="34121" LastEditorUserId="30070" LastEditDate="2018-09-15T15:04:07.993" LastActivityDate="2018-09-15T15:04:07.993" Title="Wireshark shows wrong protocol" Tags="|wireshark|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="38606" PostTypeId="1" AcceptedAnswerId="38608" CreationDate="2017-02-03T10:03:29.937" Score="0" ViewCount="192" Body="&lt;p&gt;I recently came across a question which I don't know is a genuine one and the question was,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which of the following options are examples of VLSM?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A. Subnetting 192.168.1.0/27 into multiple /30s&lt;/li&gt;&#xA;&lt;li&gt;B. Subnetting 192.168.1.0/24 into multiple /29s&lt;/li&gt;&#xA;&lt;li&gt;C. Subnetting 172.16.1.0/24 into multiple /26s&lt;/li&gt;&#xA;&lt;li&gt;D. Subnetting 10.1.24.128/26 into multiple /28s&lt;/li&gt;&#xA;&lt;li&gt;E. Subnetting 172.16.0.0/16 into multiple /24s&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And the correct options were A, C &amp;amp; D.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I fail to understand this question though I know what VLSMs are and how they work. Because, I can subnet a 192.168.1.0/24 into multiple /29s, right?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone explain what's been asked and how to solve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="31049" LastActivityDate="2017-02-03T10:24:07.580" Title="How do VLSMs work?" Tags="|subnet|network|" AnswerCount="1" CommentCount="1" ClosedDate="2017-02-03T14:48:32.327" ContentLicense="CC BY-SA 3.0" />
  <row Id="38607" PostTypeId="2" ParentId="18440" CreationDate="2017-02-03T10:12:52.350" Score="1" Body="&lt;p&gt;There are a few different ways to handle this problem, but to begin with I'd say you should prioritize the physical topology, then focus on the logical. That setup is pretty scary, if you lose one device, say Switch 3, you'd be losing connection to most of you devices. You should look into a star or mesh topology, try to minimize the number of devices a client has to go through to get to your core devices/services. Once you have looked into a more appropriate physical topology, take a look into Etherchannel, which is just Cisco link aggregation, and possibly Multiple Spanning Tree. Depending on the state of your configuration and VLANs, MSTP might be overkill, but it helps to lessen the blow that you'll take to bandwidth from STP. &lt;/p&gt;&#xA;" OwnerUserId="34120" LastActivityDate="2017-02-03T10:12:52.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38608" PostTypeId="2" ParentId="38606" CreationDate="2017-02-03T10:24:07.580" Score="0" Body="&lt;p&gt;Check the Class of the IP Address, the ones you have identified as being the correct answers are already subnetted and are then going to be split again.&lt;/p&gt;&#xA;" OwnerUserId="34120" LastActivityDate="2017-02-03T10:24:07.580" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38609" PostTypeId="1" AcceptedAnswerId="38610" CreationDate="2017-02-03T11:39:18.320" Score="-1" ViewCount="3523" Body="&lt;p&gt;what is the first valid host and the last valid host for the network that the IP address 10.150.174.20/17 is a part of?&lt;/p&gt;&#xA;" OwnerUserId="34127" LastEditorUserId="34127" LastEditDate="2017-02-03T13:22:18.813" LastActivityDate="2017-02-03T13:22:18.813" Title="Calculating valid host range" Tags="|ipv4|subnet|network|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ClosedDate="2017-02-03T14:38:30.300" ContentLicense="CC BY-SA 3.0" />
  <row Id="38610" PostTypeId="2" ParentId="38609" CreationDate="2017-02-03T11:42:56.650" Score="0" Body="&lt;p&gt;IP address 10.150.174.20/17 is part of 10.150.128.0/17 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First valid host:   10.150.128.1 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last valid host: 10.150.255.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Broadcast: 10.150.255.255&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-03T11:42:56.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38612" PostTypeId="2" ParentId="38604" CreationDate="2017-02-03T12:40:19.823" Score="0" Body="&lt;p&gt;For reference please see TLS/SSL handshake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZMbWo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZMbWo.png&quot; alt=&quot;SSL/TLS handshake&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of clients hello have same content TLSv1.2, the difference in the labeling comes from the fact that in the first instance the negotiation doesn't complete, therefore wireshark labels both packets differently. In pcap files you can see that after client trying to establish SSL connection server replaying with RST, ACK packet. &#xA;Than again client trying to establish another connection hello is labeled TLSv1.2. But again server is sending RST. Both hello are TLSv1.2 there is only difference how wireshark is labelling them. I would assume that server is misconfigured. I would suggest checking cipher suits used on server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possibly the best way to troubleshoot this is by simply trying to connect to the server with openssl.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;openssl s_client -connect example.com:443&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should see what cipher is selected in this transaction (if it works at all). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But this post is offtopic for this group.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-03T13:51:04.367" LastActivityDate="2017-02-03T13:51:04.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38613" PostTypeId="2" ParentId="38604" CreationDate="2017-02-03T12:56:15.383" Score="2" Body="&lt;p&gt;Wireshark identifies the protocol based on several variables.  In this case, it starts out assuming SSL, and then changes it as it goes through its dissection process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I notice that the good capture contains a handshake session ID, while the bad one does not.  I assume this is one of the reasons the bad capture stays at SSL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, it's clear these are two different client versions, and that's why you're getting resets.  You can try allowing older SSL versions on the PA and see if that helps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a &lt;a href=&quot;https://ask.wireshark.org/questions/15995/ssl-dissector-tlsv1-versus-ssl&quot; rel=&quot;nofollow noreferrer&quot;&gt;link to a similar question&lt;/a&gt; on the Wireshark wiki.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-02-03T12:56:15.383" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38616" PostTypeId="1" AcceptedAnswerId="38621" CreationDate="2017-02-03T14:02:08.070" Score="2" ViewCount="472" Body="&lt;p&gt;At work we are moving from a TCP to a UDP protocol for a kind of 3D engine because we have 1s hang when a packet is lost. Since our engine is not designed to handle packet loss nor out of order arrival, we use a library (Lidgren) to do reliable UDP. So far, this is working as expected but it is slightly slower than TCP (20 to 30 %) in term of latency. A coworker of mine argues that this is because the reliability and ordering of packet involves CPU overhead for UDP while it is handled directly by the network adapter for TCP. So, is the network adapter doing some special work when using TCP and not UDP to spare CPU work?&lt;/p&gt;&#xA;" OwnerUserId="34131" LastActivityDate="2017-02-05T10:22:09.287" Title="Tcp reliabity handled at hardware level?" Tags="|tcp|udp|network|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38617" PostTypeId="2" ParentId="38616" CreationDate="2017-02-03T14:19:51.107" Score="1" Body="&lt;p&gt;IMHO I assume that lidgren is working on Layer 7 (application layer). Which would increase CPU overhead and latency.&#xA;Packets are still handled as normal by lower layers supported by operating system, as Lidgren don't change how UDP is handled by operating system. So to process additional checks on higher layer it would take time and use additional resources. Not really sure but maybe lidgren is adding additional headers in data which are handled by application and to process this you need CPU and is where latency could increase.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-03T15:06:39.683" LastActivityDate="2017-02-03T15:06:39.683" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="38618" PostTypeId="1" CreationDate="2017-02-03T14:28:35.877" Score="2" ViewCount="1343" Body="&lt;p&gt;We want to configure our new network with 2 switches, redundantly, so if one of the uplinks goes down, or one of the switches dies, the network keeps on going..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have the following setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Switches are 2x Dell Networking N1524)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&quot;public&quot; VLAN configured on port 10-24 on every switch&#xA;1x Uplink connected to SW01-p24&#xA;1x Uplink connected to SW02-p24&#xA;cross-cable connected from SW01-p23 to SW01-p23&#xA;rapid-STP enabled on both switches&#xA;servers connected with an equal amount of cables to both switches&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do we need anything else for the network to be redundant this way? Any additional configuration?&lt;/p&gt;&#xA;" OwnerUserId="34132" LastActivityDate="2017-06-04T00:24:31.247" Title="Multi-switch configuration with double uplink" Tags="|redundancy|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38619" PostTypeId="2" ParentId="38618" CreationDate="2017-02-03T14:39:10.170" Score="2" Body="&lt;p&gt;Is not gonna work that way unless you have stacked switches and ether channel/bundle or VPC configured on both switches to servers. Which not all switches support. Server usually don't take part in STP election. If you enable server to take part of STP election than you would have redundant links but at same time only 1 link would work and another would be in blocking state.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/om5SX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/om5SX.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-03T14:45:49.237" LastActivityDate="2017-02-03T14:45:49.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38620" PostTypeId="2" ParentId="38616" CreationDate="2017-02-03T14:55:41.613" Score="2" Body="&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;High speed adapters (1 Gb and above) do have special hardware to process TCP on the NIC itself, thereby saving CPU cycles. This is usually found on servers since they process more traffic than user workstations.  &quot;TCP offload&quot; can be disabled through the adapter settings if it is causing application problems.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-02-03T15:15:16.967" LastActivityDate="2017-02-03T15:15:16.967" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="38621" PostTypeId="2" ParentId="38616" CreationDate="2017-02-03T14:55:55.637" Score="2" Body="&lt;p&gt;The network adapter is a layer-1/2 device that really doesn't know or care about the layer-3 (IP, etc.) or layer-4 (TCP, UDP, etc.) protocol that is carried as the payload of layer-2 (ethernet, etc) protocol. The NIC is happy to carry something like IPX that uses SPX as its layer-4 protocol.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-03T14:55:55.637" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38622" PostTypeId="2" ParentId="38604" CreationDate="2017-02-03T15:17:44.730" Score="1" Body="&lt;p&gt;This question was &lt;a href=&quot;https://www.reddit.com/r/networking/comments/5i04kb/understanding_ssltls_in_wireshark/&quot; rel=&quot;nofollow noreferrer&quot;&gt;asked on Reddit&lt;/a&gt; not too long ago.&lt;/p&gt;&#xA;&lt;p&gt;Here was my answer there:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;SSL is the original protocol developed by Netscape 1994. This was SSL&#xA;version 1.0 (major version &lt;code&gt;1&lt;/code&gt; minor version &lt;code&gt;0&lt;/code&gt;). In 1995, Netscape&#xA;came out with SSL version 2.0 (major version &lt;code&gt;2&lt;/code&gt; minor version &lt;code&gt;0&lt;/code&gt;).&#xA;In 1996, Netscape came out with SSL version 3.0 (major version &lt;code&gt;3&lt;/code&gt;&#xA;minor version &lt;code&gt;0&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;In 1999, maintenance of the &amp;quot;SSL&amp;quot; protocol was handed over to the&#xA;IETF, who renamed it &amp;quot;TLS&amp;quot;. They started with TLS 1.0, which was&#xA;&lt;strong&gt;major version &lt;code&gt;3&lt;/code&gt; minor version &lt;code&gt;1&lt;/code&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&lt;p&gt;And it continued....  TLS 1.1 is major version &lt;code&gt;3&lt;/code&gt; minor version &lt;code&gt;2&lt;/code&gt;.&#xA;TLS 1.2 is major version &lt;code&gt;3&lt;/code&gt; minor version &lt;code&gt;3&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;As you can see, TLS (all the way through 1.2) is mostly &lt;em&gt;minor&#xA;revisions on SSL 3.0&lt;/em&gt;. What you are in fact looking at is a SSL3.0&#xA;structured header, advertising the client can support SSL up to major&#xA;version 3, minor version 3, otherwise colloquially known as TLS1.2.&lt;/p&gt;&#xA;&lt;p&gt;Hence, Wireshark decodes it as a SSLv3.0 header -- the header format&#xA;has not changed since SSL3.0. Whereas SSL2.0 is an entirely new&#xA;header, and if you could force a browser to initiate an SSL2.0&#xA;handshake, you would see Wireshark decode it as such. (google turned&#xA;up &lt;a href=&quot;http://pcapr.net/view/mu/ssl-v2-2.pcap.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; though)&lt;/p&gt;&#xA;&lt;p&gt;I couldn't find a perfect reference that proves this, but you can make&#xA;out the gist of it in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5246#appendix-E&quot; rel=&quot;nofollow noreferrer&quot;&gt;Appendix E of the TLS1.2&#xA;RFC&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Newer versions of Wireshark will &lt;em&gt;correct&lt;/em&gt; the protocol label to what was negotiated between the two clients after the Client Hello and Server Hello messages.&lt;/p&gt;&#xA;&lt;p&gt;If you delete the Server Hello from the capture, you will see Wireshark will continue to label the whole conversation as &amp;quot;SSL 3.0&amp;quot; since it does not know what the agreed version of SSL/TLS was.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-02-03T15:17:44.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38624" PostTypeId="2" ParentId="38587" CreationDate="2017-02-03T15:47:06.537" Score="2" Body="&lt;p&gt;Full process in details is described in RFC 2581 3.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The fast retransmit enhancement works as follows: if a TCP sender receives a specified number of acknowledgements which is usually set to three duplicate acknowledgements with the same acknowledge number (that is, a total of four acknowledgements with the same acknowledgement number), the sender can be reasonably confident that the &lt;strong&gt;segment with the next higher sequence number was dropped&lt;/strong&gt;, and will not arrive out of order. The sender will then retransmit the packet that was presumed dropped before waiting for its timeout.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-03T16:34:41.727" LastActivityDate="2017-02-03T16:34:41.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38627" PostTypeId="2" ParentId="2665" CreationDate="2017-02-03T18:22:24.960" Score="-1" Body="&lt;p&gt;I am just learning about L2, but I think whether &quot;Ethernet&quot; AP hardware uses MAC tables or IP addresses to determining routing is a moot question. The point is that an Ethernet network establishes a unique correspondence between the MAC and IP address, so in principle an AP could route based on either. Hardware that routes on MAC however could be more flexible, for example in setting up &quot;transparent&quot; bridges connected to LAN endpoints. &lt;/p&gt;&#xA;" OwnerUserId="34142" LastActivityDate="2017-02-03T18:22:24.960" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38628" PostTypeId="2" ParentId="38618" CreationDate="2017-02-03T18:54:03.140" Score="2" Body="&lt;p&gt;We need to know more about the host configuration.  If you have some sort of active/passive NIC-teaming setup that can detect a failure then this configuration can work.  There are various options in both (modern) Windows and Linux to accomplish this, as well as a number of mechanisms to detect failures.  The upshot, though, is that a single MAC/IP address will normally show up on the primary NIC and that in the event of a failure both will be transferred to the standby.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had switches that could support MLAG or stacking you could provision the two NIC's as a single logical link.  This has the advantage of faster failover and load-sharing but I don't think the switches listed would support such a setup.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-03T18:54:03.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38632" PostTypeId="1" AcceptedAnswerId="38633" CreationDate="2017-02-04T05:43:09.290" Score="1" ViewCount="535" Body="&lt;p&gt;For example: &lt;code&gt;192.168.*.1&lt;/code&gt; is reserved, but for what? What device? What others exist on private or other networks?&lt;/p&gt;&#xA;" OwnerUserId="34153" LastEditorUserId="8499" LastEditDate="2018-03-11T01:46:31.233" LastActivityDate="2018-03-11T01:46:31.233" Title="What reserved IP addresses exist on a local private network?" Tags="|ipv4|ip|ip-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38633" PostTypeId="2" ParentId="38632" CreationDate="2017-02-04T05:47:30.450" Score="2" Body="&lt;p&gt;There are no reserved addresses on private networks, other than the network and broadcast addresses (the same as any other network). Where did you get the idea that &lt;code&gt;192.168.*.1&lt;/code&gt; is reserved?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;a href=&quot;https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;IANA IPv4 Special-Purpose Address Registry&lt;/em&gt;&lt;/a&gt; details all the special IPv4 address ranges, and information about each.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-04T06:05:33.347" LastActivityDate="2017-02-04T06:05:33.347" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38634" PostTypeId="1" CreationDate="2017-02-04T06:17:11.887" Score="2" ViewCount="26389" Body="&lt;p&gt;My company have Fortinet firewall. we need to block YouTube from entire network. we already make firewall rule for block YouTube and that rule not applying only for Google chrome. YouTube Still working on Google Chrome browser. i think this is because of QUCK protocol. so i create another rule for block QUCK protocol. but still YouTube working. when i clean cache memory youtube not working. most of the users bringing there laptops to home and watching youtube from there personol connections. when they come again to company network. again youtube working. please support me to fix this issue.&lt;/p&gt;&#xA;" OwnerUserId="34154" LastActivityDate="2020-04-09T20:50:52.990" Title="Block YouTube from Fortinet firewall" Tags="|firewall|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38637" PostTypeId="1" CreationDate="2017-02-04T14:25:41.303" Score="6" ViewCount="1347" Body="&lt;p&gt;When I test with Cisco 2960 series switches or with ISR routers, then if port receives an Ethernet frame larger than its MTU value seen in &lt;code&gt;sh int&lt;/code&gt; output, then device drops this frame and increases the &lt;code&gt;giants&lt;/code&gt; counter. In my opinion this is an expected behavior. However, for example some Linux servers(different NIC vendors and thus different kernel modules) still process frames with larger MTU than seen in &lt;code&gt;ip link show&lt;/code&gt; or &lt;code&gt;ifconfig&lt;/code&gt; output and send fragmented reply back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is a correct behavior? What should a device do when it receives an Ethernet frame larger than its MTU? I would expect it to either silently drop this frame or behave like Cisco equipment which nicely counts giant frames.&lt;/p&gt;&#xA;" OwnerUserId="3620" LastEditorUserId="8499" LastEditDate="2018-03-02T18:53:31.493" LastActivityDate="2018-03-02T18:53:31.493" Title="What should a device do with an Ethernet frame larger than its MTU?" Tags="|cisco|switch|ethernet|cisco-catalyst|mtu|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38639" PostTypeId="2" ParentId="38637" CreationDate="2017-02-04T15:41:48.310" Score="6" Body="&lt;p&gt;The ethernet standard (IEEE 802.3) calls the large frames damaged because the bits where the FCS is supposed to be don't match the CRC of the bits coming before them. What you see the Cisco switch do is correct for the default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some vendors have adopted Jumbo Frames, and what you see on the servers is the use of those. Unfortunately, there is no actual standard for Jumbo Frames so the limit on the size can vary from manufacturer to manufacturer, and even on different models from the same manufacturer. For example, see &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6000-series-switches/24048-148.html&quot;&gt;&lt;em&gt;Jumbo/Giant Frame Support on Catalyst Switches Configuration Example&lt;/em&gt;&lt;/a&gt;. That document tells you that the Cisco 2960 series switch can be configured to use an MTU up to 1998 bytes on 10/100 Mbps interfaces, and up to 9000 bytes on 1000 Mbps interfaces.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-04T16:17:05.030" LastActivityDate="2017-02-04T16:17:05.030" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38640" PostTypeId="1" AcceptedAnswerId="38651" CreationDate="2017-02-04T16:32:08.720" Score="6" ViewCount="24995" Body="&lt;p&gt;Here is an ARP packet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.1.3     ARP 62  Who has 192.168.1.1? Tell 192.168.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How to display only ARP packets with &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) specific &quot;Who has&quot; IP (&lt;code&gt;192.168.1.1&lt;/code&gt; here)?&lt;br&gt;&#xA;2) specific &quot;Tell&quot; IP (&lt;code&gt;192.168.1.2&lt;/code&gt; here)?&lt;/p&gt;&#xA;" OwnerUserId="34166" LastEditorUserId="34166" LastEditDate="2017-02-04T16:38:56.137" LastActivityDate="2017-02-05T16:10:21.510" Title="Filter ARP packets with specific &quot;Who has&quot; and &quot;Tell&quot; IP" Tags="|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38641" PostTypeId="1" CreationDate="2017-02-04T17:27:26.763" Score="0" ViewCount="106" Body="&lt;p&gt;I own several phone numbers in the United Kingdom that my UK customers can call to reach my business in the US. When we call UK customers from our US-based phones, we want the UK customers to see our UK phone number rather than our US phone number. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the simplest way to transform the caller ID that will be seen on a UK-based phone such that it appears as a UK number? Is there a way to achieve this with some sort of proxy?&lt;/p&gt;&#xA;" OwnerUserId="34144" LastActivityDate="2017-04-06T01:33:32.043" Title="How can I spoof a UK caller ID from the US?" Tags="|telephony|sip|" AnswerCount="1" CommentCount="2" ClosedDate="2018-08-01T00:18:57.330" ContentLicense="CC BY-SA 3.0" />
  <row Id="38644" PostTypeId="1" CreationDate="2017-02-04T21:52:34.423" Score="0" ViewCount="2829" Body="&lt;p&gt;I have 2960 with two vlans, voice(40), data(50). I have 2 laptops and a VOIP phone connected. I can ping the gateway ( a Fortigate 60D which is the DHCP server which is working properly) from both laptops, I can ping the phone IP from the switch and the Fortigate. However, I can not ping the two laptops from the switch or the firewall, nor can i ping from 1 laptop to the other. &#xA;Vlan interface on the Fortigate which is the gateway:VLAN50 10.45.5.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco 2960 - VLAN 50- ip address 10.45.5.2 255.255.255.0&#xA;             VLAN 40- ip address 10.45.4.2 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is this possible?&lt;/p&gt;&#xA;" OwnerUserId="30695" LastEditorUserId="30695" LastEditDate="2017-02-04T22:05:33.573" LastActivityDate="2017-07-05T04:40:43.680" Title="How can I ping from the cisco switch to host on one vlan but not another vlan?" Tags="|cisco-2960|" AnswerCount="1" CommentCount="4" ClosedDate="2018-08-01T00:18:22.363" ContentLicense="CC BY-SA 3.0" />
  <row Id="38645" PostTypeId="2" ParentId="38644" CreationDate="2017-02-04T23:43:11.070" Score="1" Body="&lt;p&gt;A missing default gateway on an IP endpoint can cause this.  Also, the source address of the ping can cause this.  If you just type &lt;code&gt;ping&lt;/code&gt; and press enter you'll get options including the ability to source that packet off a particular interface.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-04T23:43:11.070" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38646" PostTypeId="2" ParentId="38641" CreationDate="2017-02-04T23:45:05.073" Score="1" Body="&lt;p&gt;It depends on your PSTN provider.  Some will allow you to put anything in the 'calling number' parameter during call setup.  Usually though, they will filter out spam.  However, you might be able to work with them, or maybe search for a provider that will allow this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, route the traffic through the UK - for real.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-04T23:45:05.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38647" PostTypeId="2" ParentId="38634" CreationDate="2017-02-04T23:47:51.810" Score="0" Body="&lt;p&gt;You are wanting to configure &quot;URL Filtering&quot;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;You can allow or block access to specific URLs by adding them to the&#xA;  Static URL Filter list.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/Web_Filter/Static%20URL%20Filter.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Fortinet&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-04T23:47:51.810" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38650" PostTypeId="1" AcceptedAnswerId="38653" CreationDate="2017-02-05T09:00:45.433" Score="0" ViewCount="978" Body="&lt;p&gt;I'm working with a VxWorks PPP server running on an embedded system. There seems to be a problem with IPCP DNS negotiation. Each time the PPP server offers a IPCP to a client, the client seems to be rejecting the DNS1 and DNS2 fields and is accepting the IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried with a windows dial up connection ( with 'automatically request dns' option) and an Ubuntu pppoed client (with 'usepeerdns' option). In both cases the clients are configured to obtain the DNS from the PPP server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The packet sequence are as follows:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Client sends IPCP Configure-Request with IP, DNS1 and DNS2 set to 0.&lt;/li&gt;&#xA;&lt;li&gt;Server sends IPCP Configure-Request with the relevant IP, DNS1 and DNS2 in the options field.&lt;/li&gt;&#xA;&lt;li&gt;Client sends Configure-Reject (Code 0x04) with DNS1 and DNS2 in the payload.&lt;/li&gt;&#xA;&lt;li&gt;Server sends IPCP Configure-Request with just the IP.&#xA;Handshaking completes with a ACK and both agreeing on just the IP address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I'm not really sure where this is going wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is much appreciated!&#xA;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="34178" LastActivityDate="2017-02-05T10:32:02.270" Title="IPCP DNS : Configure-Reject" Tags="|dns|pppoe|ppp|" AnswerCount="1" CommentCount="1" ClosedDate="2017-02-05T16:14:05.177" ContentLicense="CC BY-SA 3.0" />
  <row Id="38651" PostTypeId="2" ParentId="38640" CreationDate="2017-02-05T09:27:51.923" Score="6" Body="&lt;p&gt;&lt;a href=&quot;https://www.wireshark.org/docs/dfref/a/arp.html&quot; rel=&quot;noreferrer&quot;&gt;Wireshark ARP filter reference&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;To filter &quot;Who has&quot; you need &lt;code&gt;( arp.dst.proto_ipv4 == 192.168.1.1 ) &amp;amp;&amp;amp; ( arp.opcode==1 )&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;To find &quot;Tell&quot; you need &lt;code&gt;( arp.src.proto_ipv4 == 192.168.1.2 ) &amp;amp;&amp;amp; ( arp.opcode==1 )&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34178" LastEditorUserId="8499" LastEditDate="2017-02-05T16:10:21.510" LastActivityDate="2017-02-05T16:10:21.510" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38652" PostTypeId="2" ParentId="38616" CreationDate="2017-02-05T10:22:09.287" Score="4" Body="&lt;p&gt;This is a good place to list what kinds of TCP offloading features a NIC hardware can have.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most basic form of offload is &lt;b&gt;checksum offload&lt;/b&gt;. It improves performance somewhat, but not much. Checksum is something that is very easy to do in hardware. Checksum offload, however, can show strange checksums when a .pcap is captured, so it is not fully transparent to the user. The solution to the .pcap problem is to turn checksum offload off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Large send offload&lt;/b&gt; works because often an application write()'s a large buffer such as 64 kilobytes. Let's assume that of this, the TCP window and congestion control allow sending 24 kilobytes immediately. The operating system constructs a virtual TCP segment of 24 kilobytes and the 24 kilobyte virtual TCP segment passes through the operating system stack only once. Then the NIC breaks the large virtual 24 kilobyte segment into smaller physical segments. The idea here is to reduce software overheads by handling large virtual packets instead of small physical packets. The per-packet processing overhead applies then to a larger chunk of data. So, the effect is similar to running a large MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Large receive offload&lt;/b&gt; is large send offload in the oppoisite direction, and works with the interrupt mitigation features of a NIC. In this case, the idea is that the NIC won't interrupt the operating system per each arriving packet but actually waits for a while for more packets to arrive. If the further packets seem to be consecutive packets belonging to the same connection, they are combined into one larger virtual segment (let's say a 32 kilobyte segment). Then the operating system's stack will process the large 32 kilobyte virtual segment once, and the packet processing overhead is amortized over 32 kilobytes instead of the usual 1500 bytes. This is the receive-side equivalent of large send offload. However, this feature will break routers, so it cannot be used in machines doing IP forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All of these previously listed TCP offload features are stateless. They are nice because they do not require practically any modifications to the operating system's TCP stack. There is a more full way of performing TCP offloading, called &lt;b&gt;TCP offload engine&lt;/b&gt;. In it, part of the state of the TCP connection is offloaded to the NIC, and the NIC performs part of the TCP packet processing. However, the problem is that different manufacturers have different views of what the NIC should do. Thus, in practice if there are 10 NIC vendors, you need 10 different copies of the operating system TCP stack, each tailor-modified to work with a specific NIC vendor. Not going to happen! Also, once the rules are hardcoded to an ASIC, you cannot fix bugs in the rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In modern Linux systems using good network interface cards, checksum offloading, large send offloading and large receive offloading are used. However, TCP offload engine is not supported by any standard Linux kernel. Same probably applies to Windows as well.&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2017-02-05T10:22:09.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38653" PostTypeId="2" ParentId="38650" CreationDate="2017-02-05T10:32:02.270" Score="1" Body="&lt;p&gt;In IPCP (like LCP and related protocols) there are two negociations, one for each direction of the link. Your step 1 is the client asking for IP and DNSs, step 2 is &lt;strong&gt;not&lt;/strong&gt; the server answering to this request, but the server asking for its own IP and DNSs (the other negociation).  In step 3 the client rejects, as it does not want to provide DNSs to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you sure you see all the IPCP packets exchanged?  In you sequence, the server never answers to the client request.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should see something like (just one common scenario, this may differ):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;client conf&#xA; C&amp;gt;S req IP=0.0.0.0, DNS1=0.0.0.0, DNS2=0.0.0.0  # client asks&#xA; C&amp;lt;S nak IP=a.b.c.d, DNS1=e.f.g.h, DNS2=i.j.k.l  # server suggests values&#xA; C&amp;gt;S req IP=a.b.c.d, DNS1=e.f.g.h, DNS2=i.j.k.l  # client requests suggested values&#xA; C&amp;lt;S ack IP=a.b.c.d, DNS1=e.f.g.h, DNS2=i.j.k.l  # servers acks&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and another negociation (possibly interleaved) maybe something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; server conf&#xA; S&amp;gt;C req IP=v.w.x.y.z  # server informs about its IP&#xA; S&amp;lt;C ack IP=v.w.x.y.z  # client acks the server IP address&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IPCP is decribed in RFC1332, but it says&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IPCP uses the same packet exchange machanism as&#xA;     the Link Control Protocol (LCP).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So one has to read rfc1661 for the description of how the negociations take place.&lt;/p&gt;&#xA;" OwnerUserId="33078" LastActivityDate="2017-02-05T10:32:02.270" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38656" PostTypeId="1" AcceptedAnswerId="38657" CreationDate="2017-02-05T19:09:31.470" Score="0" ViewCount="11134" Body="&lt;p&gt;Lets say I have to create 256 subnets (it could be any number), how would I find the first and last (network/broadcast addresses) for a randomly chosen subnet? For instance, subnet 139. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll give an example. &#xA;Network IP: 145.0.0.0/8 &#xA;This IP needs to be subsetted into 300 subnets. &#xA;Network mask: 255.0.0.0&#xA;Network address (first address):145.0.0.0/8 &#xA;Broadcast address: 145.255.255.255/8&#xA;Number of hosts: 2^(32-8) = 16777216&#xA;Addresses/subnet: 65536 (16777216/256)&#xA;Subnet mask: /16 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not really concerned about usable addresses, just trying to understand a concept. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first subnet would be:&#xA;Network address: 145.0.0.0/16&#xA;Broadcast Address: 145.0.255.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is there a formula or method to finding a randomly picked subnet's network/broadcast address? &lt;/p&gt;&#xA;" OwnerUserId="34187" LastActivityDate="2017-02-05T19:18:29.263" Title="How to calculate random subnet first/last address" Tags="|subnet|" AnswerCount="1" CommentCount="0" ClosedDate="2017-02-07T06:22:16.810" ContentLicense="CC BY-SA 3.0" />
  <row Id="38657" PostTypeId="2" ParentId="38656" CreationDate="2017-02-05T19:18:29.263" Score="0" Body="&lt;p&gt;Take the subnet number, subtract one (the first one is &lt;code&gt;0&lt;/code&gt;), and put that in the subnet part of the address. In your example, &lt;code&gt;145.0.0.0/8&lt;/code&gt; will have 256 &lt;code&gt;/16&lt;/code&gt; subnets. The 139th subnet will be &lt;code&gt;145.138.0.0/16&lt;/code&gt;. You only need the subnet and the mask to figure out anything else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do this correctly (otherwise you can make some serious mistakes with non-octet bounded networks), you need to do it in binary. See &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;this answer&lt;/a&gt; for how to do all the calculations.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-02-05T19:18:29.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38659" PostTypeId="2" ParentId="19051" CreationDate="2017-02-05T21:21:40.707" Score="2" Body="&lt;p&gt;Allow me to clarify that It is possible to use cat3 cabling for IP phones in addition to POE.&lt;br&gt;&#xA;Since the early 1990s, prior to many IP standards and written documentation for LAN Networks I have connected successfully many computers using only 2-pairs on a cat3 cable. Additionally, you can use 1-cat3 cable split out to 2-data jacks to run 2-computers. But, cat3 is limited to 16mbps, more commonly seen as 10-mbps. &#xA;A POE enabled switch will provide power on pairs 2 and 3; pins 1,2,3 6.  This is known as phantom power POE running on same pairs in which data is transmitted and received.&lt;br&gt;&#xA;Let's discuss cat4 cable, very rare to see but supports up to 20mbps only and same configuration as above applies. &#xA;A POE Adapter provides power in ununsed pairs 1 and 4; pins 4,5,7,8. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then we come to Cat 5, 5e, 6, and 7 as discussed on the internet. &lt;/p&gt;&#xA;" OwnerUserId="34190" LastActivityDate="2017-02-05T21:21:40.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38660" PostTypeId="2" ParentId="37835" CreationDate="2017-02-05T21:50:32.713" Score="1" Body="&lt;p&gt;@John Hengst - I concur with cmschmidt15 towards providing a guaranteed service to the pods with structured cabling. We do a couple of shows per year and primarily provide cabling installed by licensed cablers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But there are always a couple of pods where the clients are physically too far and wireless becomes the solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could investigate installing installing an access point as a workgroup bridge. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an example from one manufacturer and just about all other manufacturers have that option. &#xA;&lt;a href=&quot;https://supportforums.cisco.com/document/16796/how-configure-cisco-access-point-ap-workgroup-bridge&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://supportforums.cisco.com/document/16796/how-configure-cisco-access-point-ap-workgroup-bridge&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And avoid using 802.11b/g if you can but use 802.11a as Androids supports them. Not much interference on the 5GHz ranges compared to the 2.4GHz ranges.&lt;/p&gt;&#xA;" OwnerUserId="4565" LastActivityDate="2017-02-05T21:50:32.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38662" PostTypeId="1" CreationDate="2017-02-06T00:21:16.553" Score="0" ViewCount="1123" Body="&lt;p&gt;I want to launch a HTTP request to a website I've never visited before. I would like to pick up all of the packets related to this request; so DNS packets, TCP packets, et cetera.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to pick up all of these? I have found that I can filter by the website's IP address, but this does not give me the DNS packets. How can I get all related packets?&lt;/p&gt;&#xA;" OwnerUserId="25685" LastEditorUserId="8499" LastEditDate="2018-02-16T03:51:18.007" LastActivityDate="2019-01-04T00:15:17.870" Title="Wireshark - capture all packets for HTTP request" Tags="|wireshark|dns|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38663" PostTypeId="2" ParentId="38662" CreationDate="2017-02-06T02:12:59.793" Score="1" Body="&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(ip.addr==192.0.2.4) and (http or dns)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;192.0.2.4&lt;/code&gt; is your PC's address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;You could include the addresses of your DNS server and the website &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(ip.addr==&amp;lt;nameserver&amp;gt; and DNS) or (ip.addr==&amp;lt;website&amp;gt; and http)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="33968" LastEditDate="2019-01-04T00:15:17.870" LastActivityDate="2019-01-04T00:15:17.870" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="38665" PostTypeId="1" AcceptedAnswerId="38673" CreationDate="2017-02-06T07:27:23.623" Score="4" ViewCount="1516" Body="&lt;p&gt;Reading up about the data link layer I found that the &lt;b&gt;logical link control sublayer&lt;/b&gt; uses &lt;b&gt;sequence numbers&lt;/b&gt; to find duplicate &lt;strike&gt;packet&lt;/strike&gt; frame transmissions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understood the sequence number game with respect to &lt;i&gt;one transmitter&lt;/i&gt; and &lt;i&gt;receiver&lt;/i&gt; but &lt;b&gt;&lt;i&gt;how does it work with multiple transmitters and a single receiver?&lt;/i&gt;&lt;/b&gt; Does the receiver need to &lt;b&gt;maintain a table with MAC address and the next sequence number&lt;/b&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or the duplicate &lt;strike&gt;frame&lt;/strike&gt; &lt;b&gt;&quot;data&quot; (or whatever it is called at that layer)&lt;/b&gt; detection is done at a higher layer?&lt;/p&gt;&#xA;" OwnerUserId="34200" LastEditorUserId="34200" LastEditDate="2017-02-06T12:24:15.480" LastActivityDate="2017-02-06T13:09:26.117" Title="How are duplicate packets handled at the Data Link Layer?" Tags="|wireless|mac-address|lan|layer2|osi|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38668" PostTypeId="1" AcceptedAnswerId="38669" CreationDate="2017-02-06T09:54:45.530" Score="2" ViewCount="798" Body="&lt;p&gt;I captured a 70MB tcpdump of a linux client that downloads many big files with curl. At some point curl aborts the download with the errror&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;transfer closed with 3304876121 bytes remaining to read&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(the bytes differ every time)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I now want to gather more details about the cause of that so I decided to create and analyze a tcpdump. The Problem now is, that I don't have much experience with tcpdump analyzing except basic filtering and following streams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you please advice me on how I can find the right stream and gather some info's regarding the cause of the abortion?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using wireshark 2.2.3 on Win10 to analyze the traffic.&lt;/p&gt;&#xA;" OwnerUserId="34203" LastEditorUserId="19543" LastEditDate="2017-02-06T12:41:53.763" LastActivityDate="2017-02-06T12:41:53.763" Title="Wireshark - How to find cause of incomplete download" Tags="|wireshark|tcpdump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38669" PostTypeId="2" ParentId="38668" CreationDate="2017-02-06T10:04:20.987" Score="3" Body="&lt;p&gt;You can use source and destination filter in wireshark:&#xA; ip.src==192.168.0.1 and ip.dst==192.168.0.2 if it's http you can add filter:&#xA;tcp.port == 80 or tcp.port == 443 for ssl. &#xA;When you find your stream you can click &quot;Follow TCP Stream&quot;. You can compare time of failed download and apply time filter to narrow yours search.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately there is no way to filter failed download unless you know reason for fail or some additional information. &lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-06T10:17:51.487" LastActivityDate="2017-02-06T10:17:51.487" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38670" PostTypeId="1" AcceptedAnswerId="38671" CreationDate="2017-02-06T10:46:03.760" Score="2" ViewCount="532" Body="&lt;p&gt;We're in the process of dividing a &lt;code&gt;/24 network&lt;/code&gt; into a &lt;code&gt;/25 network&lt;/code&gt;, a &lt;code&gt;/26 network&lt;/code&gt; and a &lt;code&gt;/27 network&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our original plan was as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;10.97.21.0/24 (original network)&lt;/strong&gt; to&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.97.21.0-31 /27&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.97.21.32-159 /25&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.97.21.160-223 /26&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.07.21.224-255 /27&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I have been told that this won't work because it's imperative to always start with the largest network first. Why is that the case? &lt;/p&gt;&#xA;" OwnerUserId="15706" LastActivityDate="2017-02-06T11:32:02.683" Title="Subnetting of a /24 network due to using VLANs" Tags="|subnet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38671" PostTypeId="2" ParentId="38670" CreationDate="2017-02-06T10:53:00.180" Score="6" Body="&lt;p&gt;Is not gonna work as:&#xA;10.97.21.32/25 is part of 10.97.21.0/25 network which is overlapping with your  10.97.21.0/27&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.97.21.160/26 is part of 10.97.21.128/26 which is overlapping again with other of yours network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That should work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.97.21.0/25 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.97.21.128/26&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.97.21.192/27 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.97.21.224/27&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-06T11:02:28.543" LastActivityDate="2017-02-06T11:02:28.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38672" PostTypeId="2" ParentId="38670" CreationDate="2017-02-06T11:32:02.683" Score="3" Body="&lt;p&gt;It is not imperative to always start with the largest network but it is easier if you're not accustomed with sub-netting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can take it this way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Divide your &lt;code&gt;10.97.21.0/24&lt;/code&gt; network into 2 /25 networks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.97.21.0/25&#xA;10.97.21.128/25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since you need a /25, keep one and further subnet the other one, once again in two networks:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.97.21.0/25&#xA;10.97.21.128/26&#xA;10.97.21.192/26&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You need a /26, so you keep the first one and divide the other one in two:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.97.21.0/25&#xA;10.97.21.128/26&#xA;10.97.21.192/27&#xA;10.87.21.224/27&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as you can see we get the solution given by  @Datagram.Network, but if choose instead to divide the first subnet and keep the second we can also have&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.97.21.0/27&#xA;10.97.21.32/27&#xA;10.97.21.64/26&#xA;10.87.21.128/25&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For more information you may find this answer to &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/16930&quot;&gt;How do you calculate the prefix, network, subnet, and host numbers?&lt;/a&gt; interesting&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2017-02-06T11:32:02.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38673" PostTypeId="2" ParentId="38665" CreationDate="2017-02-06T12:46:09.823" Score="5" Body="&lt;p&gt;Connection-oriented protocols are not used in &quot;one transmitter, many receivers&quot; scenarios, because of exactly the problem you mention.  This is true not only of 802.2 Type 2, but also for IP multicast, which only uses UDP, not TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Practically speaking, 802.2 type 2 is obsolete -- You would be hard pressed to find it in use anywhere.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-02-06T12:46:09.823" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38674" PostTypeId="1" CreationDate="2017-02-06T14:48:58.310" Score="2" ViewCount="373" Body="&lt;p&gt;This is my first time using stack exchange. Let me give a brief backstory. I work at a company, we have multiple phone lines. One of the phone lines was cancelled but had a phone hooked up to it. I am attempting to move that phone to the an existing but open number that we have from the POTS provider.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Onto the question... I am looking at the box provided by POTS service provider. There is a typical 66 punch down block but I am working in the box next to that where it looks like the wires are punched down again in some sort of goo? I've attached two pictures down below because I doubt that I am explaining it correctly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Nd6S6.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Nd6S6.jpg&quot; alt=&quot;First picture of goo punchdown&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JlD44.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JlD44.jpg&quot; alt=&quot;Second picture of goo punchdown&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am unsure of how to make a connection with the goo in there. I have tried putting the wires in all sorts of ways. I have tried looking this question up online but was unable to find any sort of information. Specifically I am working the the brown pair that is on the bottom row to the most right. They are in the spot they need to go in and they feel somewhat snug in there, but I believe I am not making a solid connection. If anyone  has any experience/ knowledge of this and can tell make how to make a connection here it would be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="34205" LastActivityDate="2018-12-01T08:01:40.297" Title="Wiring question at POTS DEMARC point" Tags="|cable|telephony|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38675" PostTypeId="2" ParentId="38634" CreationDate="2017-02-06T14:55:17.993" Score="2" Body="&lt;p&gt;Use application control to block youtube. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Go to security profiles click on application control -&gt; Create new (give name youtube block) -&gt; block category video/audio -&gt; In application overrides add signature Youtube.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Go to your internet policy and apply this app control to it. &#xA;It will block your Youtube. &lt;/p&gt;&#xA;" OwnerUserId="22728" LastActivityDate="2017-02-06T14:55:17.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38676" PostTypeId="2" ParentId="38634" CreationDate="2017-02-06T15:01:57.357" Score="0" Body="&lt;p&gt;If you block UDP port 80 and 443 that should block QUCK.&#xA;Of course you need have in place as well URL filter for youtube over TCP.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-06T15:01:57.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38677" PostTypeId="1" CreationDate="2017-02-06T16:17:32.603" Score="2" ViewCount="461" Body="&lt;p&gt;It is possible, through IPFIX, take each size packet in a flow? It seems to exist only the sum of the sizes and the number of packets.&lt;/p&gt;&#xA;" OwnerUserId="34209" LastEditorUserId="19543" LastEditDate="2017-02-07T10:12:27.783" LastActivityDate="2017-02-07T10:12:27.783" Title="Packet sizes with ipfix" Tags="|packet-analysis|ipfix|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38679" PostTypeId="1" CreationDate="2017-02-06T17:09:02.050" Score="2" ViewCount="489" Body="&lt;p&gt;Let's say we have 4 machines connected to a layer 2, managed switch which is connected to a layer 3 switch. Say that 1.2.3.0/24 is routed to the layer 3 switch. Our goal is to have 1.2.3.0-63 usable only by the first machine, 1.2.3.64-127 usable only by the second machine and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly, from the layer 3 switch, we have to create 4 VLAN's and assign 1.2.3.0/26 to the first, 1.2.3.64/26 to the second and so on. This will VLAN tag the Ethernet frames. We then have, on the layer 2 switch, to assign a VLAN for each port and mark it as tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Does the VLAN number configured on the L2 and L3 switches have to be the same?&lt;/li&gt;&#xA;&lt;li&gt;What will be the broadcast IP address for each machine?&lt;/li&gt;&#xA;&lt;li&gt;What will be the usable IP addresses for each machine?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;We normally only use L3 switches, so in that case, for the first machine, for instance, the broadcast IP address would have been 1.2.3.1 and 1.2.3.2-62 would have been usable.&lt;/p&gt;&#xA;" OwnerUserId="32941" LastEditorUserId="8499" LastEditDate="2018-03-21T01:11:36.610" LastActivityDate="2018-03-21T01:11:36.610" Title="Understanding VLAN tagging" Tags="|switch|vlan|ethernet|layer2|layer3|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38680" PostTypeId="2" ParentId="38679" CreationDate="2017-02-06T17:16:34.627" Score="1" Body="&lt;p&gt;Frames on trunk interfaces get 802.1Q tags in order to marks which frames belong to which VLANs. Frames on access interfaces do not get tagged. The access interfaces are assigned a VLAN number (default is VLAN 1), but the traffic on the access interfaces is not tagged. Most end-devices don't understand VLAN tags (some servers do, but that would be for sending traffic for multiple VLANs on a trunk to the server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The link between your two switches would be a trunk. The gateway for each VLAN would be the address assigned to the SVI on the layer-3 switch. The broadcast address is always the last address in the network. The first address in the network is the network address. Those two addresses are unusable for host addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-06T17:16:34.627" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38681" PostTypeId="2" ParentId="38677" CreationDate="2017-02-06T17:19:42.287" Score="3" Body="&lt;p&gt;The premise of the protocol is to provide &lt;em&gt;flow&lt;/em&gt;-level telemetry information.  As such the specific size of each packet isn't really in-scope.  For reference a full list of fields potentially captured in IPFIX can be found &lt;a href=&quot;http://www.iana.org/assignments/ipfix/ipfix.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said - you can obviously get a pretty good idea by taking the average size of a packet (total flow volume / number of packets) during a given interval.  From a statistical point of view this is generally more than sufficient for capacity planning/traffic characterization purposes.  It's also generally find for [D]DoS detection as a relative drop in average packet size compared with growth in total packets is trivial to alert on.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing to remember is that there are some pretty stark limitations that show up at the scale of PPS on 10, 40 and 100GE links and the only way to realistically address these is to both statistically sample and aggregate information.  This unfortunately implies a necessary loss of granularity in the service of maintaining visibility at scale.  The good news is that there are some novel mechanisms emerging to allow for much deeper traffic analysis.  The bad news is that these will likely be substantially different than what's seen with IPFIX/Netflow/sFlow.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-06T17:19:42.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38682" PostTypeId="1" AcceptedAnswerId="38691" CreationDate="2017-02-06T17:27:59.913" Score="1" ViewCount="82" Body="&lt;p&gt;I have a Cisco 3550. I wanted to connect a 9971(used) to it, but it is not going beyond POST. I see the keys blinking but nothing happens after that, and this happens in a loop. Could that be a problem with Phone or with Switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch Information - C3550 Software (C3550-IPSERVICESK9-M), Version 12.2(44)SE6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Model number: WS-C3550-24PWR-SMI&lt;/p&gt;&#xA;" OwnerUserId="20572" LastEditorUserId="33" LastEditDate="2018-12-05T22:04:09.003" LastActivityDate="2018-12-05T22:04:09.003" Title="Cisco 9971 connected to Cisco 3550" Tags="|cisco|cisco-catalyst|cisco-ios-12|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38683" PostTypeId="1" CreationDate="2017-02-06T18:46:35.310" Score="2" ViewCount="386" Body="&lt;p&gt;I have the need to calculate the variance of the size of the packets in a flow. So it is impossible using IPFIX? There are new alternatives to IPFIX that would allow me to calculate that value? Thanks&lt;/p&gt;&#xA;" OwnerUserId="34212" LastEditorUserId="19543" LastEditDate="2017-02-07T10:12:30.853" LastActivityDate="2019-10-11T20:16:44.943" Title="ipfix - variance of size packets in a flow" Tags="|packet-analysis|ipfix|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38687" PostTypeId="1" CreationDate="2017-02-06T20:37:49.810" Score="7" ViewCount="4456" Body="&lt;p&gt;&lt;strong&gt;TL/DR&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I set up a static nat rule, so that I can use my public internet IP address to directly ssh into a dedicated machine on the inside network. As a result I cannot ssh into the dedicated machine anymore, when connected through AnyConnect VPN. Why? How do I fix this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Long story:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an ASA 5512-X which I use to terminate AnyConnect VPN sessions. This has been working very well. People use AnyConnect to connect to the ASA, the get IP addresses from the specially assigned IP pool and they can access everything I put in the access-lists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I have this idea to directly forward port 22 to a dedicated machine in my network (I only have inside and outside interfaces), so that I can SSH into my public IP address and end up on the dedicated machine, without the requirement for a VPN connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The setup seemed simple enough:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network MyEndpoint&#xA;    host 10.0.0.1&#xA;    nat (inside, outside) static interface service tcp ssh ssh&#xA;access-list from_outside_inside extended permit tcp any object MyEndpoint eq ssh&#xA;access-group from_outside_inside in interface outside&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it actually works. Now I can&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh ssh.mydomain.com&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and actually get a ssh session on my dedicated machine. However, this success comes at the cost that &lt;code&gt;ssh 10.0.0.1&lt;/code&gt; does not work anymore when I am connected to my ASA/network through AnyConnect as it used to, before I set up static NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can deterministically control the ASA's behaviour:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I &lt;strong&gt;don't have&lt;/strong&gt; the &lt;code&gt;nat (inside,outside)&lt;/code&gt; line in my configuration,&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ssh 10.0.0.1&lt;/code&gt; works but&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ssh ssh.mydomain.com&lt;/code&gt; does not work.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When I &lt;strong&gt;have&lt;/strong&gt; the &lt;code&gt;nat (inside,outside)&lt;/code&gt; rule as part of the configuration, it is the other way round:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;ssh ssh.mydomain.com&lt;/code&gt; works but&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;ssh 10.0.0.1&lt;/code&gt; does not work.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To investigate I set up a capture on the ASA&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;capture MyEndpoint type raw-data interface inside&#xA;capture MyEndpoint type raw-data interface outside&#xA;capture MyEndpoint match tcp host 10.0.0.1 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I first connect via AnyConnect and then try to &lt;code&gt;ssh 10.0.0.1&lt;/code&gt;, the capture doesn't show/capture anything, as long as the &lt;code&gt;nat (inside,outside)&lt;/code&gt; rule is active. Also, my SSH connect attempts never reach the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clearly the ASA is eating the connection requests originating from AnyConnect-connected endpoints, when the &lt;code&gt;nat&lt;/code&gt; rule is active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At first I thought I require some addition to the access-list, but I couldn't make it work that way. On which interface does VPN traffic enter the ASA anyway? outside or inside? I suppose in this case doesn't matter, because I am using a wildcard (&lt;code&gt;any&lt;/code&gt;) for the source, which, in my oppinion, includes VPN traffic as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I thought the ASA would always apply the nat, which means the packet carrying the SYN-ACK would be natted to my outside IP which breaks the connection, as I am connecting from a private VPN address, not the Internet. But the SYNs never get to the server, hence there are no SYN-ACKs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I spent all day warpping my head around the &quot;new&quot; &lt;code&gt;nat&lt;/code&gt; command. When I do a &lt;code&gt;show nat&lt;/code&gt; on my ASA I get&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Auto NAT Policies (Section 2)&#xA;1 (inside) to (outside) source static MyEndpoint interface   service tcp ssh ssh &#xA;    translate_hits = 0, untranslate_hits = 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As far as I got today this only does a source address translation for leaving traffic. I have no idea, how/why this implies a destination address translation for traffic originating from the Internet arriving at the ASA. Can anybody explain to me why the ASA is behaving this way?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit 1: &lt;code&gt;packet-tracer&lt;/code&gt;&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Reading on through the documentations I came accross the ASA command &lt;code&gt;packet-tracer&lt;/code&gt;. When I do&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;packet-tracer input inside tcp 10.100.0.2 31337 10.0.0.1 22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The ASA tells me a flow would be created and the packet accepted. When I do&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;packet-tracer input outside tcp 10.100.0.2 31337 10.0.0.1 22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Phase: 6&#xA;Type: WEBVPN-SVC&#xA;Subtype: in&#xA;Result: DROP&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Result:&#xA;input-interface: outside&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: inside&#xA;output-status: up&#xA;output-line-status: up&#xA;Action: drop&#xA;Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So I guess this is some implicitly wanted behaviour, except if you are me.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit 2: Searching for hairpins&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I found some articles which eventually pointed me to &lt;a href=&quot;http://packetpushers.net/cisco-asa-8-38-4-hairpinning-nat-configuration/&quot; rel=&quot;noreferrer&quot;&gt;this promissing one&lt;/a&gt; which held the information I might need a nat rule along the lines of&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nat (outside,outside) \&#xA;    source static \&#xA;        client_vpn_pool client_vpn_pool \&#xA;    destination static \&#xA;        remote_office_net remote_office_net&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but it didn't work. I have a network object for my vpn client subnet and a network object for the subnet of 10.0.0.1. Adapting the template above did not yield the expected result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When my &lt;code&gt;nat (inside,outside)&lt;/code&gt; rule is in place, SSH does not work, but I can ping 10.0.0.1 just fine. When I add a &lt;code&gt;nat (outside,ouside)&lt;/code&gt; rule as suggested by the article, the ping stops working. I also tried versions of the outside-ouside rule with network objects for the specific host and just the range of the &lt;code&gt;ip local pool&lt;/code&gt; used for vpn clients. They all just make the ping stop.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit 3: Never mind&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;It's working now. I literally didn't change anything. I just went to bed. I guess there was some internal state in the ASA that caused this behaviour and it timed out while I was asleep.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is still the thing that when I use &lt;code&gt;packet-tracer input [inside|outside] tcp &amp;lt;my vpn ip&amp;gt; 31337 10.0.0.1 22&lt;/code&gt; packet-tracer always says the packet would be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I put &lt;code&gt;packet-tracer input inside&lt;/code&gt; it fails at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Phase: 6&#xA;Type: WEBVPN-SVC&#xA;Subtype: in&#xA;Result: DROP&#xA;Config:&#xA;Additional Information:&#xA;&#xA;[...]&#xA;Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and when I put &lt;code&gt;packet-tracer input outside&lt;/code&gt; it fails at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Phase: 6&#xA;Type: NAT&#xA;Subtype: rpf-check&#xA;Result: DROP&#xA;Config:&#xA;object network MyEndpoint&#xA; nat (inside,outside) static interface service tcp ssh ssh &#xA;Additional Information:&#xA;&#xA;[...]&#xA;Drop-reason: (acl-drop) Flow is denied by configured rule&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Yet, as of today, ping and SSH to/from my VPN-connected Laptop to MyEndpoint (a.k.a. 10.0.0.1) works like a charm. How does this ASA thing work???&lt;/p&gt;&#xA;" OwnerUserId="34213" LastEditorUserId="34213" LastEditDate="2017-02-07T08:54:38.040" LastActivityDate="2018-11-04T16:00:31.277" Title="Cisco ASA: Why does static NAT block access through VPN?" Tags="|cisco-asa|nat|cisco-anyconnect|" AnswerCount="2" CommentCount="7" ClosedDate="2018-11-25T17:23:55.393" ContentLicense="CC BY-SA 3.0" />
  <row Id="38688" PostTypeId="1" AcceptedAnswerId="38692" CreationDate="2017-02-06T21:38:29.610" Score="2" ViewCount="4437" Body="&lt;p&gt;We have two &lt;code&gt;ASA5550&lt;/code&gt; primary &amp;amp; secondary and they are pretty old running from since last couple year and we never bother to touch but recently we are doing some maintenance and found we need to failover device without any downtime.&lt;/p&gt;&#xA;&lt;h1&gt;Question:&lt;/h1&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;How do i check the status of failover to make failover is correctly configure.&lt;/li&gt;&#xA;&lt;li&gt;Is there any downtime or small packet loss?&lt;/li&gt;&#xA;&lt;li&gt;How do i &lt;code&gt;manually&lt;/code&gt; do failover instead of &lt;code&gt;reload&lt;/code&gt; active device?&lt;/li&gt;&#xA;&lt;li&gt;Anything else i need to make sure before doing failover? like sync config, connection etc?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-02-07T06:05:51.930" Title="ASA5550 manual failover question" Tags="|cisco|cisco-asa|failover|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38689" PostTypeId="2" ParentId="38679" CreationDate="2017-02-06T23:04:11.660" Score="0" Body="&lt;p&gt;The term &lt;em&gt;managed switch&lt;/em&gt; is meaningless in the context of telecommunications engineering.  As for VLAN tagging, you are speaking of tagging &lt;em&gt;frames&lt;/em&gt;.  Simply think of frames as signals (shouts, if you will) passing through the switch.  The tag on the frame (the signal or shout) determines whether the switch will allow it to pass out of a particular port.  Access ports are assigned to a VLAN, Trunk ports can allow more than one VLAN to pass.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's a tiny bit oversimplified, but basically how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of IP addressing and subnets, typically, each VLAN carries traffic for one and only one subnet.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-06T23:04:11.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38690" PostTypeId="2" ParentId="38662" CreationDate="2017-02-06T23:59:10.370" Score="0" Body="&lt;p&gt;I believe you will have more luck first using the web developer part of firefox of equivalent. Because one request to a website as seen from the user perspective may mean a lot of network trafic on various other websites, to load images, scripts, CSS and such. So filtering only on one IP makes you missing eventually a lot of interactions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The browser should show you all HTTP requests that are made for your website access. After which you could redo it at the network level to capture all trafic and such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way: make sure to have a &quot;quiet&quot; computer, without any extra traffic or other browsing and so (or the minimum amount of traffic), and then capture all network packets just for the time of your HTTP request, and after that filter out what you really need. Otherwise if you filter too much beforehand you may never know that you miss something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW: DNS uses UDP too! And your DNS packets go to your local recursive DNS server(s) (except if you run your own recursive DNS server on the same computer?), so this is not related in any way with the website IP or such.&lt;/p&gt;&#xA;" OwnerUserId="33968" LastActivityDate="2017-02-06T23:59:10.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38691" PostTypeId="2" ParentId="38682" CreationDate="2017-02-07T00:16:15.493" Score="1" Body="&lt;p&gt;Probably an inline power issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/collaboration-endpoints/unified-ip-phone-9971/data_sheet_c78-565717.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Phone Specs says&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IEEE Power over Ethernet 802.3af and 802.3at supported, class 4. The&#xA;  9971 is compatible with both class 3 and class 4 IEEE PoE switch&#xA;  blades and supports both Cisco Discovery Protocol (CDP) and Link Layer&#xA;  Discovery Protocol - Power over Ethernet (LLDP-PoE)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps646/prod_bulletin09186a008010b358.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Switch Spec says&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Additionally, &lt;strong&gt;up to&lt;/strong&gt; 15.4W/port of inline power on every 10/100 port&#xA;  ensures maximum device support for IP telephony and wireless LAN&#xA;  deployments.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Maximum power availability for a converged voice and data network is&#xA;  attainable when the Catalyst 3550-24 PWR switch is combined with the&#xA;  Cisco Redundant Power System 675 (&lt;strong&gt;RPS 675&lt;/strong&gt;) (available 1HCY03) for&#xA;  seamless protection against internal power supply failures and an&#xA;  uninterruptible power supply (UPS) system to safeguard against power&#xA;  outages.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-07T00:16:15.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38692" PostTypeId="2" ParentId="38688" CreationDate="2017-02-07T00:28:09.260" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How do i check the status of failover to make failover is correctly&#xA;  configure. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;These commands will give a good indicator of the status and configuration&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show failover&#xA;show failover state&#xA;show monitor-interface&#xA;show running-config failover&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there any downtime or small packet loss?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This depends on the type of traffic (Stateful/Non-Stateful), type of failover (Active/Active, Active/Standby, Cluster),  type of failure (monitored interface down, hardware failure, flapping interface, etc), failover timers, and how modern the hardware is.  I always recommend a maintenance window and &lt;em&gt;prepare&lt;/em&gt; for unexpected downtime.  Thorough testing will provide a baseline.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has some guidelines here:&#xA;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/ha-failover.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/general/asa-97-general-config/ha-failover.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How do i manually do failover instead of reload active device?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Force active status on standby unit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;failover active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Force standby status on active unit:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no failover active&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Usage: &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/ha_active_standby.html#wp1097426&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/ha_active_standby.html#wp1097426&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Anything else i need to make sure before doing failover? like sync&#xA;  config, connection etc?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Configurations should be sync'ed unless commands have been sent to the Secondary unit directly.  If you suspect otherwise, a configuration comparison should be made.  Some other recommendations are listed below.  Ask any engineer and they will likely have additional recommendations.  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Verify current failover status using commands above&lt;/li&gt;&#xA;&lt;li&gt;Develop a thorough testing plan&lt;/li&gt;&#xA;&lt;li&gt;Adequate maintenance window&lt;/li&gt;&#xA;&lt;li&gt;Backup Configurations&lt;/li&gt;&#xA;&lt;li&gt;Write Running configurations to Start-up configurations&lt;/li&gt;&#xA;&lt;li&gt;Out-of-band Access&lt;/li&gt;&#xA;&lt;li&gt;Preemptive Cisco TAC case (very controversial among engineers and excessive IMHO) &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2017-02-07T06:05:51.930" LastActivityDate="2017-02-07T06:05:51.930" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38693" PostTypeId="1" CreationDate="2017-02-07T02:24:36.813" Score="1" ViewCount="2353" Body="&lt;p&gt;I want to know if I'm protected for ARP spoofing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my network, all PCs, printers, phones and servers are in distinct VLANs. I got a layer 3 switch for servers, which handles routing between these VLANs, and layer 2 switches for connecting PCs, printers and phones. I use DHCP snooping to be sure that only my DHCP server is giving IP addresses. I have an internet gateway in the same VLAN used for servers. I don't have any specific configuration for ARP on the layer 2 and 3 switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since ARP is blocked by routers, am I open or not to ARP spoofing?&lt;/p&gt;&#xA;" OwnerUserId="34224" LastEditorUserId="8499" LastEditDate="2018-12-21T04:56:50.717" LastActivityDate="2018-12-21T04:56:50.717" Title="ARP spoofing in different VLAN" Tags="|routing|vlan|arp|layer2|layer3|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38694" PostTypeId="2" ParentId="38693" CreationDate="2017-02-07T02:29:49.227" Score="1" Body="&lt;p&gt;ARP spoofing only works on a LAN, not across LANs, so you are safe from ARP spoofing from outside a LAN. Unfortunately, most successful attacks happen from within a network. For example, a host on your network could be compromised (look at other SE sites to see the large quantity of questions from workers looking to bypass a company's network security to be able to play games or stream videos). Since you are running DHCP snooping, you could add DAI (Dynamic ARP Inspection) to prevent ARP spoofing on a LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-07T02:29:49.227" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38695" PostTypeId="2" ParentId="38687" CreationDate="2017-02-07T02:47:30.007" Score="1" Body="&lt;p&gt;So, if I understand correctly you can't access the inside interface of your ASA via SSH when connected via VPN?  Have you tried issuing the following command on the ASA:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;management-access inside&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your VPN tunnel terminates on one interface, but you want to manage the ASA by accessing a different interface, you need to identify that interface as a management-access interface.&lt;/p&gt;&#xA;" OwnerUserId="34227" LastActivityDate="2017-02-07T02:47:30.007" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="38696" PostTypeId="1" CreationDate="2017-02-07T06:09:44.067" Score="1" ViewCount="2785" Body="&lt;p&gt;we want to prevent loops in the network be it LAN or WAN. However for layer 2 LAN networks STP is used to prevent looping switches.&#xA;However at layer 3 TTL field is used.&#xA;why not use STP for layer 3 too ?&lt;/p&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="8499" LastEditDate="2018-03-21T00:01:44.020" LastActivityDate="2018-03-21T00:01:44.020" Title="spanning tree at layer 3" Tags="|lan|spanning-tree|protocol-theory|wan|layer3|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38697" PostTypeId="2" ParentId="37769" CreationDate="2017-02-07T06:16:30.217" Score="4" Body="&lt;p&gt;Enable Promiscuous mode in dSwitch.&lt;/p&gt;&#xA;" OwnerDisplayName="user24629" LastActivityDate="2017-02-07T06:16:30.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38699" PostTypeId="2" ParentId="38696" CreationDate="2017-02-07T07:12:38.553" Score="1" Body="&lt;p&gt;Layer 3 has no issue with loops, on the contrary, the very purpose of the ARPANET (which eventually became the Internet) was to have a meshed network, resilient to attacks (I.E. where the loss of a node doesn't impact the overall network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actually the more &quot;loops&quot; you have in your network at layer 3, the more robust the network is.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-07T07:12:38.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38700" PostTypeId="2" ParentId="38696" CreationDate="2017-02-07T07:56:10.220" Score="0" Body="&lt;p&gt;It makes no sense to build a spanning tree on layer 3 simply because each packet can take a different path from source to destination; this is by design. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The mechanism that prevents a packet from looping forever in a layer 3 network (which should never happen unless there's a routing error) is, as you've mentioned, the Time To Live field (TTL) whose value is reduced by 1 at each hop.         &lt;/p&gt;&#xA;" OwnerUserId="19543" LastEditorUserId="19543" LastEditDate="2017-02-07T10:23:32.103" LastActivityDate="2017-02-07T10:23:32.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38701" PostTypeId="2" ParentId="38683" CreationDate="2017-02-07T08:06:11.617" Score="2" Body="&lt;p&gt;IPFIX's purpose is to measure packet flow, not the size of the single packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you can calculate the variance of packet size by time calculating the average size of a packet as the total flow volume divided by the number of packets during different intervals, and seeing how this value changes over time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to calculate the variance in size of different individual packets in a single flow, that's not possible AFAIK. &lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2017-02-07T08:06:11.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38702" PostTypeId="2" ParentId="38696" CreationDate="2017-02-07T10:14:34.333" Score="1" Body="&lt;p&gt;First things first you need to remember that IP and Ethernet were different protocols designed by different people to fill different needs. I know vendors like to use the terms &quot;layer 2&quot; and &quot;layer 3&quot; as if the protocols were part of some consistent protocol stack but they doesn't mean they really are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet was designed to provide local networking in a building or maybe a campus. Traditional Ethernet networks were essentially a bus, repeaters/hubs/bridges/switches extended this to a tree. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However trees are bad from a performance and reliability point of view, the bridges/switches in the center of the network become a bottleneck and a single point of failure. The bigger the network gets the worse this becomes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP goes some way towards solving the reliability issues. Link aggregation goes some way towards solving the performance issues but overall it is still a lousy way to build large networks. Thanks to STP disabling links large ammounts of capacity sits idle and packets frequently take much longer routes than needed to get to their destination and if the STP root fails then reprecussings may be seen across the whole network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP was designed for interconnecting multiple networks at least one of which (the ARPANET) already had multiple sites. Trying to force the network into a tree would have made little sense. Instead IP networks rely on a combination of staticly defined routes and routing protocols to determine where data should be sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &quot;TTL&quot; is a safety valve to stop misrouted packets looping forever. It should not be reaching zero in normal operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Interestingly the scalability problems with Ethernet along with a desire for large, geographically spread out Ethernet domains (for example to allow seamless VM migrations between datacenters) have lead to people running Ethernet on top of other protocols. The new hotness seems to be to encapsulate the Ethernet frames in UDP packets using VXLAN and then use BGP to control where they are sent. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="775" LastEditDate="2017-02-09T19:45:02.703" LastActivityDate="2017-02-09T19:45:02.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38707" PostTypeId="1" CreationDate="2017-02-07T12:55:56.910" Score="1" ViewCount="1095" Body="&lt;p&gt;I have two sites connected using ipsec, The ipsec is connected using two netscreen boxes and I want to extend VLAN from one site to other &#xA;Is it possible to achieve that without adding any new component &lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-02-07T15:59:16.537" Title="Extend VLAN over L3 network" Tags="|vlan|ethernet|data|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38708" PostTypeId="2" ParentId="38707" CreationDate="2017-02-07T13:23:25.067" Score="1" Body="&lt;p&gt;You can achieve this by configuring:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;L2TPv3&lt;/li&gt;&#xA;&lt;li&gt;EoMPLS &lt;/li&gt;&#xA;&lt;li&gt;QinQ&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;More likely in your case it would be QinQ or L2TP. &#xA;More information you can find under this link: &lt;a href=&quot;https://networklessons.com/switching/802-1q-tunneling-q-q-configuration-example/&quot; rel=&quot;nofollow noreferrer&quot;&gt;QinQ&lt;/a&gt;, &lt;a href=&quot;http://www.ipwithease.com/q-in-q-tunneling-configuration-scenario/&quot; rel=&quot;nofollow noreferrer&quot;&gt;QinQ-2&lt;/a&gt;&#xA;or juniper guide: &lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos/topics/task/configuration/qinq-tunneling-ex-series-cli-els.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;L2TP guide: &lt;a href=&quot;http://www.juniper.net/techpubs/en_US/junos/topics/usage-guidelines/services-l2tp-minimum-configuration.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;L2TP&lt;/a&gt; and netscreen guide: &lt;a href=&quot;https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB4107&amp;amp;actp=search&quot; rel=&quot;nofollow noreferrer&quot;&gt;netscreen&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-07T15:59:16.537" LastActivityDate="2017-02-07T15:59:16.537" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38710" PostTypeId="1" CreationDate="2017-02-07T13:54:04.083" Score="1" ViewCount="155" Body="&lt;p&gt;The &lt;em&gt;sampling&lt;/em&gt; parameter in openvswitch to enable IPFIX what it refers to? For example, a value of 1 means what? Furthermore, as the difference there is &lt;em&gt;per-bridge sampling&lt;/em&gt; and &lt;em&gt;per-flow sampling&lt;/em&gt;?&lt;/p&gt;&#xA;" OwnerUserId="34212" LastEditorUserId="34212" LastEditDate="2017-02-07T14:00:04.010" LastActivityDate="2017-02-07T23:05:55.847" Title="Ipfix in openvSwitch" Tags="|packet-analysis|ipfix|ovs|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38711" PostTypeId="2" ParentId="37689" CreationDate="2017-02-07T14:15:25.493" Score="1" Body="&lt;p&gt;If the Fortinets are connected to the QFX via layer-3, then they are routing, and you don't configure gateways for routers. Routers learn routes in three ways: directly connected network, statically configured routes, or through routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If everything is connected via layer-3, then you run OSPF, and let the routing protocol handle the redundancy. The two WAN routers should have default routes to the Internet, and you inject those into OSPF.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-07T14:15:25.493" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38713" PostTypeId="2" ParentId="38707" CreationDate="2017-02-07T15:18:18.513" Score="2" Body="&lt;p&gt;So, you want to tunnel Ethernet frames over an IP network that has an IPsec link? Works like any IP network, but you have to be careful with MTU (as always). IPsec links usually have lower maximum transmission unit (MTU) than 1500, but with Ethernet over IP you will anyway run into MTU problems.&lt;/p&gt;&#xA;&lt;p&gt;The solution may be VXLAN, specified in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7348&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC7348&lt;/a&gt;. However, do note that as VXLAN operates over UDP, there is a large amount of overhead. If the IPsec link has an MTU of 1500, then IPsec, UDP and VXLAN together add overheads meaning the Ethernet link has an MTU smaller than 1500. To have MTU of 1500 for the Ethernet link, you will need an MTU bigger than 1500 for the IPsec link, which isn't usually possible in the Internet.&lt;/p&gt;&#xA;&lt;p&gt;Note that as VXLAN operates on layer 2, it has no way to generate ICMP packet too big messages (which are layer 3 messages). This means that you have to manually configure the MTU to a smaller value for the Ethernet link, or otherwise you will have dropped packets (=no connectivity) or fragmented packets (=performance problems).&lt;/p&gt;&#xA;&lt;p&gt;GRE (generic routing encapsulation) specified in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2784&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC2784&lt;/a&gt; can also be used to transfer Ethernet frames (transparent Ethernet bridging, Ethertype 0x6558), but firewalls may not like GRE running directly on top of IP as much as they like VXLAN running on top of UDP. However, GRE is an industry standard that is almost unanimously used, so most good quality firewalls from reputable vendors should offer the possibility to allow GRE traffic.&lt;/p&gt;&#xA;&lt;p&gt;The MTU/fragmentation issues apply equally to all protocols running on top of IP or UDP without TCP inbetween.&lt;/p&gt;&#xA;&lt;p&gt;Now, what about TCP as the transport for Ethernet packets? The traffic you're transferring through the Ethernet link probably has already one level where TCP is being used, so you would then run TCP over TCP. This is heavily discouraged, as you have then two levels where retransmissions occur, meaning that the performance of the system can catastrophically degrade if there's packet loss. TCP would eliminate MTU problems, but because TCP over TCP can have catastrophical behaviour in the case of packet loss, I don't recommend it.&lt;/p&gt;&#xA;" OwnerUserId="34098" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-02-07T15:18:18.513" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38714" PostTypeId="2" ParentId="37866" CreationDate="2017-02-07T15:28:09.217" Score="0" Body="&lt;p&gt;Yes, there is. For FreeBSD, &lt;a href=&quot;https://www.hyperois.com/members/knowledgebase.php?action=displayarticle&amp;amp;id=1&quot; rel=&quot;nofollow noreferrer&quot;&gt;dummynet&lt;/a&gt; might be the answer. However, most people use Linux these days instead of FreeBSD. You can in Linux use &lt;a href=&quot;https://wiki.linuxfoundation.org/networking/netem&quot; rel=&quot;nofollow noreferrer&quot;&gt;tc&lt;/a&gt; -- see the rate control part of the link. tc with netem can also add constant or variable latency to packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do consider, however, that real networks have high latency in addition to low bandwidth. So, you might want to emulate latency in addition to limited bandwidth as well. Otherwise you aren't testing your application well enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use FreeBSD or Linux, you don't need to change the switch configuration to obtain the limited bandwidth. It can be done on the host where the application program runs. Unfortunately, if you run the application on Windows, I don't have a solution for you. In that case, you need to see if the switch has rate limiting options. Not all switches do.&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2017-02-07T15:28:09.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38715" PostTypeId="1" AcceptedAnswerId="38718" CreationDate="2017-02-07T15:59:27.457" Score="1" ViewCount="831" Body="&lt;p&gt;I have a Cisco SG220 and a ZyXel USG20 firewall appliance.  I'm new to the SG220 and SFP ports in general.  Where is the optimal place to plug in the Firewall to the Switch. Normally I would just plug it into any port on the switch, but with the SFP I'm not sure. &lt;a href=&quot;https://i.stack.imgur.com/Zsz0U.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zsz0U.png&quot; alt=&quot;Network Setup&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34239" LastActivityDate="2017-02-07T17:01:50.447" Title="Where to plug the Firewall into the SFP or a normal port?" Tags="|routing|switch|ethernet|sfp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38717" PostTypeId="1" CreationDate="2017-02-07T16:59:20.333" Score="1" ViewCount="192" Body="&lt;p&gt;We have 2 ASA 5505's. The one that is in production does have a current contract on it, but the second one is a spare so we did not renew it since it was replaced with a 5512 at another location. Since the production ASA 5505 has been kept up to date, in the event of a failure I would like to have a &quot;drop in&quot; replacement until the support contract ships a replacement. Am I able to legally update the firmware on the spare device without purchasing an additional licensing contract or is there a different type of contract that I need to purchase or am I forced into paying for a full contract even though it's going to sit on a shelf collecting dust until the production one fails, that is if it ever does fail?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What are my options and where can I verify if anything isn't needed as an additional cost?&lt;/p&gt;&#xA;" OwnerUserId="34242" LastActivityDate="2017-02-07T20:34:00.560" Title="Does a cold spare Cisco ASA we need a separate license to keep it up to date?" Tags="|cisco-asa|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38718" PostTypeId="2" ParentId="38715" CreationDate="2017-02-07T17:01:50.447" Score="2" Body="&lt;p&gt;USG20 supports 1Gbps so I would connect to SG220 over one of two GigabitEthernet Ports which are usually used for uplinks next to port 0/23 and 0/24. Unfortunately USG20 doesn't support LCAP/PaGP so you won't be able to create bundle for redundancy purposes. But to be honest as @Ron Maupin said doesn't matter where exactly you will connect more likely your limited factor will be WAN. &lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-07T17:01:50.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38719" PostTypeId="2" ParentId="38717" CreationDate="2017-02-07T17:06:23.960" Score="0" Body="&lt;p&gt;Legally? Not. you should have a support contract for each device.&#xA;But I don't think so that this is enforced in anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On April 13, 2017 there is End of Service Contract Renewal Date. And last date of support is: January 31, 2018. So I would suggest upgrade to 5506.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More information you can obtain on this site: &lt;a href=&quot;http://www.cisco.com/c/en/us/services/order-services.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Order Services&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-07T17:14:58.020" LastActivityDate="2017-02-07T17:14:58.020" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38720" PostTypeId="1" CreationDate="2017-02-07T18:22:11.047" Score="2" ViewCount="413" Body="&lt;p&gt;I'm trying to configure the forwarding of my router model CISCO 2801, which has ip publishes 201.236.137.xxx. For this, I am using the following command: &lt;strong&gt;ip nat inside source static&lt;/strong&gt; ...&#xA;What I want to do is run a virtual server on my computer that is inside the network with ip 192.168.3.11 on port 7001.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have done it in the following way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static tcp 192.168.3.11 7001 201.236.137.xxx 80&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So when I make a request from outside to the ip publishes 201.236.137.xxx I intend to see my server. I have not had success doing this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To check the operation, I used the command &lt;code&gt;show ip nat translation&lt;/code&gt;, and I can not find the configuration that I did. I only see others configurations that I have not done, like the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show ip nat translation&#xA;&#xA;Pro Inside global      Inside local       Outside local      Outside global&#xA;tcp 201.236.137.156:1052 192.168.3.11:1052 64.233.190.84:443 64.233.190.84:443&#xA;tcp 201.236.137.156:1053 192.168.3.11:1053 188.172.192.3:5938 188.172.192.3:5938&#xA;tcp 201.236.137.156:1057 192.168.3.11:1057 23.96.38.64:443   23.96.38.64:443&#xA;tcp 201.236.137.156:1065 192.168.3.11:1065 190.98.163.146:80 190.98.163.146:80&#xA;tcp 201.236.137.156:1066 192.168.3.11:1066 64.233.190.94:80  64.233.190.94:80&#xA;tcp 201.236.137.156:1071 192.168.3.11:1071 64.233.190.94:443 64.233.190.94:443&#xA;tcp 201.236.137.156:1074 192.168.3.11:1074 64.233.190.113:443 64.233.190.113:443&#xA;tcp 201.236.137.156:1075 192.168.3.11:1075 64.233.190.95:443 64.233.190.95:443&#xA;tcp 201.236.137.156:1078 192.168.3.11:1078 64.233.190.101:443 64.233.190.101:443&#xA;tcp 201.236.137.156:1079 192.168.3.11:1079 64.233.190.84:443 64.233.190.84:443&#xA;tcp 201.236.137.156:1080 192.168.3.11:1080 64.233.190.94:443 64.233.190.94:443&#xA;tcp 201.236.137.156:1082 192.168.3.11:1082 64.233.190.99:443 64.233.190.99:443&#xA;tcp 201.236.137.156:1083 192.168.3.11:1083 64.233.190.132:443 64.233.190.132:443&#xA;tcp 201.236.137.156:1084 192.168.3.11:1084 64.233.190.94:443 64.233.190.94:443&#xA;tcp 201.236.137.156:1085 192.168.3.11:1085 216.58.212.131:443 216.58.212.131:443&#xA;tcp 201.236.137.156:1086 192.168.3.11:1086 64.233.190.94:443 64.233.190.94:443&#xA;tcp 201.236.137.156:1087 192.168.3.11:1087 82.165.143.100:80 82.165.143.100:80&#xA;tcp 201.236.137.156:1088 192.168.3.11:1088 64.233.186.154:80 64.233.186.154:80&#xA;tcp 201.236.137.156:1089 192.168.3.11:1089 82.165.143.100:80 82.165.143.100:80&#xA;tcp 201.236.137.156:1090 192.168.3.11:1090 82.165.143.100:80 82.165.143.100:80&#xA;&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Complete Router Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router# configure terminal&#xA;router(config) #interface fastethernet 0/0&#xA;router(config-if) # ip address 192.168.3.1 255.255.255.0&#xA;router(config-if) # no shutdown&#xA;router(config) #interface fastethernet 0/1&#xA;router(config-if) # ip address 201.236.137.xxx 255.255.255.248&#xA;router(config-if) # no shutdown&#xA;router(config) #service dhcp&#xA;router(config) #ip dhcp pool RED1&#xA;router(dhcp-config) #network 192.168.3.1 255.255.255.0&#xA;router(dhcp-config) #default-router 201.236.137.153&#xA;router(dhcp-config) #dns-server 8.8.8.8&#xA;router(dhcp-config) #dns-server 8.8.4.4&#xA;router(config) #ip dhcp excluded-address 192.168.3.1 192.168.3.10&#xA;router(config) #access-list 10 permit 192.168.3.1 0.0.0.255&#xA;router(config) #ip nat inside source list 10 interface f0/1 overload&#xA;router(config) #interface f0/0&#xA;router(config-if) #ip nat inside&#xA;router(config-if) #exit&#xA;router(config) #interface f0/1&#xA;router(config-if) #ip nat outside&#xA;router(config-if) #exit&#xA;router(config) #ip route 0.0.0.0 0.0.0.0 f 0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Show Running Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show running-config&#xA;Building configuration...&#xA;Current configuration : 1198 bytes&#xA;!&#xA;! Last configuration change at 18:19:54 UTC Tue Feb 7 2017&#xA;!&#xA;version 15.0&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;ip source-route&#xA;!&#xA;!&#xA;ip dhcp excluded-address 192.168.3.1 192.168.3.10&#xA;!&#xA;ip dhcp pool RED1&#xA;network 192.168.3.0 255.255.255.0&#xA;default-router 201.236.137.153&#xA;dns-server 8.8.4.4&#xA;!&#xA;!&#xA;ip cef&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO2801 sn FTX151501M2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA;ip address 192.168.3.1 255.255.255.0&#xA;ip nat inside&#xA;ip virtual-reassembly&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA;ip address 201.236.137.xxx 255.255.255.248&#xA;ip nat outside&#xA;ip virtual-reassembly&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;ip nat inside source list 10 interface FastEthernet0/1 overload&#xA;ip nat inside source static tcp 192.168.3.11 7001 201.236.137.156 80      extendable&#xA;ip route 0.0.0.0 0.0.0.0 FastEthernet0/1&#xA;!&#xA;access-list 10 permit 192.168.3.0 0.0.0.255&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA;login&#xA;!&#xA;scheduler allocate 20000 1000&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why do I see this? Any idea why my forwarding does not work and other configurations appear? Please help&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much&lt;/p&gt;&#xA;" OwnerUserId="33309" LastEditorUserId="33309" LastEditDate="2017-02-07T18:56:30.463" LastActivityDate="2018-10-01T08:58:52.627" Title="Forwarding on CISCO 2801" Tags="|cisco|router|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38721" PostTypeId="2" ParentId="38717" CreationDate="2017-02-07T18:27:47.640" Score="2" Body="&lt;p&gt;I just received the following response from Cisco:&#xA;&quot;Upgrading the version of the ASA is not related to any licenses, therefore as long as you can download the desired image from cisco.com you will be able to upload it on the device in question and upgrade.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And another response further clarifying:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;If you are not using any licensed features, I do not see an issue swapping two devices, since they are both 5505 and would have the same config and version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition, here are some links regarding 5505 memory requirements and upgrade path (depends on what version it is currently on):&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/product_bulletin_c25-586414.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/products/collateral/security/asa-5500-series-next-generation-firewalls/product_bulletin_c25-586414.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/upgrade/upgrade92.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa92/upgrade/upgrade92.html&lt;/a&gt;&#xA;&quot;&lt;/p&gt;&#xA;" OwnerUserId="34242" LastEditorUserId="34242" LastEditDate="2017-02-07T20:34:00.560" LastActivityDate="2017-02-07T20:34:00.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38727" PostTypeId="2" ParentId="38720" CreationDate="2017-02-07T19:34:10.413" Score="0" Body="&lt;p&gt;NAT is bidirectional but maybe try on outside interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat outside source static tcp 201.236.137.156 80 192.168.3.11 7001       extendable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and than confirm if is working with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show ip nat translations&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-07T21:18:35.493" LastActivityDate="2017-02-07T21:18:35.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38732" PostTypeId="1" CreationDate="2017-02-07T22:20:59.587" Score="1" ViewCount="571" Body="&lt;p&gt;We are making some changes to our network and after changing which router we use as our core router, there is a strange problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that there are two subnets (out of a total of more than 10) where hosts on those subnets can't be reached by hosts on other subnets, but as soon as I log on to the core switch/router (Catalyst 4507E+) and ping one of those hosts, then everyone can ping the host in question. Then about ten minutes after I've done the ping from the core router, the host that I enabled becomes unreachable from other subnets again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The subnets are directly connected to the core.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far my only guess is that there is some ARP problem. Pinging from the core helps these nodes successfully ARP and then the ARP cache entries time out and they are unreachable again, perhaps?&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Edit:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;I've been unwittingly monitoring Windows hosts on the subnet with the main problem all along and they have never been unavailable, so it only affects Linux hosts on that subnet. That makes me think maybe this is more a question for ServerFault, since the problem is OS-specific.&lt;/p&gt;&#xA;" OwnerUserId="4889" LastEditorUserId="4889" LastEditDate="2017-02-21T15:29:02.820" LastActivityDate="2021-01-08T03:28:08.667" Title="Can't ping Linux hosts on a certain subnet unless core router pings them first" Tags="|routing|cisco-catalyst|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="38733" PostTypeId="1" AcceptedAnswerId="43547" CreationDate="2017-02-07T23:05:24.803" Score="2" ViewCount="2999" Body="&lt;p&gt;I would like to connect only two IP phones to talk each other (I have no idea about IP telephony). Is it possible without using a PBX? I mean, just connecting IP phone to IP phone with a straight/crossover cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="14468" LastActivityDate="2017-08-24T15:29:05.930" Title="VoIP only for two phones" Tags="|voip|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38734" PostTypeId="2" ParentId="38710" CreationDate="2017-02-07T23:05:55.847" Score="2" Body="&lt;p&gt;Almost certainly 1 out of &lt;em&gt;x&lt;/em&gt; packets.  This is a common technique to reduce overhead for flow processing.  A value of 1 means no sampling.  If you use a higher value you need to make sure your collection / analysis tools are similarly configured to allow for proper interpolation.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-07T23:05:55.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38735" PostTypeId="2" ParentId="38733" CreationDate="2017-02-07T23:09:15.913" Score="1" Body="&lt;p&gt;Nope.  Something needs to provide firmware for download, initial configuration and some kind of control plane to allow the phones to find one another and negotiate codecs and such.  A basic installation of Asterix or Call Manager Express on a router would be a good place to start.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-07T23:09:15.913" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38736" PostTypeId="1" AcceptedAnswerId="38738" CreationDate="2017-02-08T00:19:26.883" Score="1" ViewCount="229" Body="&lt;p&gt;I have a lan server with websites that need to be accessed remotely and locally via domain names.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The domain dns is setup to my ISP static ip, and router's firewall is open on port 80 and is forwarding to the static Lan ip of my server. The only issue is I can't access the server using the domain name when I'm on the same local network as the server, everything remotely works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should be configured on my router so that I can access these websites on my server regardless if I'm local or not?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;cisco rv320&lt;/p&gt;&#xA;" OwnerUserId="34246" LastEditorUserId="34246" LastEditDate="2017-02-08T00:26:04.207" LastActivityDate="2017-03-11T13:34:09.180" Title="Unable to access local server via domain" Tags="|cisco|routing|router|lan|wan|" AnswerCount="2" CommentCount="3" ClosedDate="2019-02-10T00:25:06.437" ContentLicense="CC BY-SA 3.0" />
  <row Id="38738" PostTypeId="2" ParentId="38736" CreationDate="2017-02-08T00:29:56.873" Score="1" Body="&lt;p&gt;The issue is more likely that DNS name is pointing towards external IP address, and NAT is in use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest to use&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Split DNS&lt;/li&gt;&#xA;&lt;li&gt;Hairpinning&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-08T00:29:56.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38745" PostTypeId="1" AcceptedAnswerId="38755" CreationDate="2017-02-08T07:52:33.180" Score="3" ViewCount="302" Body="&lt;p&gt;I have a site-to-site ipsec connection which has low throughput, but the ethernet connection itself between the same endpoints is good (ie without ipsec there is high throughput). The ipsec routers have low cpu load during the tests. The vpn tunnel negotiation works fine, so no trouble there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking of doing a wireshark capture but I'm not quite sure what to look for there. Do I look for anything in particular when it comes to potential ipsec problems?  What are typical signs to look for?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appreciate your thoughts&lt;/p&gt;&#xA;" OwnerUserId="34262" LastActivityDate="2017-02-23T06:42:16.150" Title="How troubleshoot poor ipsec connection?" Tags="|ipsec|packet-analysis|throughput|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38751" PostTypeId="1" AcceptedAnswerId="38764" CreationDate="2017-02-08T11:11:15.633" Score="3" ViewCount="591" Body="&lt;p&gt;I'd like to know if there is any way to configure the switch so, that in case the radius-server is dead and devices try to (re)-authenticate the port gets the latest vlan which was authorized on this port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe I just need a command that says: &quot;if (re)authentication fails because the radius server is unrechable, use the latest vlan from the specific port&quot;.&lt;/p&gt;&#xA;" OwnerUserId="34274" LastActivityDate="2017-02-08T20:55:51.773" Title="AAA &amp; NAC: Use last authorized vlan of a port, if AAA-Server is dead?" Tags="|cisco|aaa|ieee-802.1x|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38753" PostTypeId="2" ParentId="29014" CreationDate="2017-02-08T11:58:35.283" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;How is the above table constructed?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The table is constructed from the source MAC addresses of frames passing through the bridge.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Question 2: But if a frame gets generated at veth1 with a destination MAC address that's not a bridge port then how does the bridging works? I assume the bridge floods all the ports with this frame.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Correct&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;But then what? IF a port accepts the flooding frame, does it notify the bridge that I have this MAC address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It doesn't explicitly notify the bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But typically a request will provoke a response. Typically that response will tell the bridge where the MAC address is located.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also except in cases where a bridge was rebooted without rebooting the connected devices this is unlikely to happen in the first place. Normally when hosts start to communicate they will send arp broadcasts (or for IPv6 ND &quot;multicast&quot;) before they start sending unicast traffic.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If no port on the bridge is the receiver, how does the bridge know what's the uplink port&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It doesn't, there is no concept of &quot;uplink port&quot; in Ethernet bridging. Just a list of ports each with a list of associated MAC addresses.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-08T11:58:35.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38755" PostTypeId="2" ParentId="38745" CreationDate="2017-02-08T13:10:46.673" Score="3" Body="&lt;p&gt;Normally you would first check whether all packets are being encapsulated and decapsulated OK by viewing ipsec counters on the tunnel endpoints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if you want to look at packets, first you need to know whether or not low throughput is first caused by TCP effects, either packet loss or latency.  That will influence where to look next.  You need to see the traffic in the clear at either end of the tunnel if that's possible, not so easy if you are using transport mode, but I assume your &quot;connection&quot; is a tunnel, please confirm.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can capture packets at both ends of the tunnel and also the IPSec packets, it is relatively easy to match them, as IPSec has a fixed overhead for the tunnel depending upon ciphers used. You can then see where they are getting dropped or delayed.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-02-08T13:10:46.673" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38758" PostTypeId="1" CreationDate="2017-02-08T17:31:27.520" Score="1" ViewCount="1813" Body="&lt;p&gt;We have a Cisco router (887VA) supplied by a 3rd party. The supplier says its switch ports are simply untagged/access-mode. However our HP switch, which is connected to the Cisco router's switch through a port on the HP switch (j9772a), which untagged/access-mode refuses to work correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have verified that a laptop which directly connects to either the Cisco or the HP works as intended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The strangest part is that if we use VLAN 1, untagged, on the HP-switch, the setup does work as intended. How can using a different VLAN, specifically VLAN 1, matter for the connection if its untagged? Is there magic between the two devices I should know about?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HP config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname &quot;SW02-E2&quot;&#xA;trunk 45-46 trk10 lacp&#xA;stack join e0071b-0000&#xA;interface 44&#xA;   name &quot;000 WAN&quot;&#xA;   exit&#xA;snmp-server community &quot;public&quot; unrestricted&#xA;vlan 1&#xA;   name &quot;DEFAULT_VLAN&quot;&#xA;   no untagged 1-24,37-44,49-52,Trk10&#xA;   untagged 25-36&#xA;   tagged 47-48&#xA;   no ip address&#xA;   exit&#xA;vlan 2&#xA;   name &quot;Default vlan2&quot;&#xA;   untagged 37-42,49-52,Trk10&#xA;   no ip address&#xA;   exit&#xA;vlan 10&#xA;   name &quot;Office network&quot;&#xA;   untagged 1-24&#xA;   tagged 47-48,Trk10&#xA;   ip address 192.168.178.2 255.255.255.0&#xA;   exit&#xA;vlan 213&#xA;   name &quot;VPN network&quot;&#xA;   untagged 43-44&#xA;   tagged 7-8,10&#xA;   ip address 192.168.213.66 255.255.255.192&#xA;   exit&#xA;vlan 1000&#xA;   name &quot;stacking&quot;&#xA;   no ip address&#xA;   exit&#xA;spanning-tree&#xA;spanning-tree Trk10 priority 4&#xA;spanning-tree mode rapid-pvst&#xA;device-profile name &quot;default-ap-profile&quot;&#xA;   cos 0&#xA;   exit&#xA;password manager&#xA;password operator&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="6222" LastEditorUserId="8499" LastEditDate="2018-12-25T03:40:55.260" LastActivityDate="2018-12-25T03:40:55.260" Title="Network does not work between Cisco router and HP switch" Tags="|cisco|switch|router|vlan|hp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38759" PostTypeId="2" ParentId="38758" CreationDate="2017-02-08T17:40:39.573" Score="1" Body="&lt;p&gt;VLAN 1 is the default native (untagged) VLAN. You need to have the native VLAN match between the two switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also run into STP problems. The Cisco device is going to use PVST+ by default, but the HP can't do that. You may need to change the Cisco device to MSTP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-08T18:20:21.487" LastActivityDate="2017-02-08T18:20:21.487" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="38761" PostTypeId="1" AcceptedAnswerId="38762" CreationDate="2017-02-08T19:40:07.043" Score="0" ViewCount="528" Body="&lt;p&gt;I am setting up Anyconnect for multiple organizations with offices world wide. They are going to be sharing two Azure data centers which have vASAs, one is in Europe and the other is in the US. At each location we will have a hub and spoke topology to all sites for each organization.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We plan to use Anyconnect for remote access. I'm trying to sort out the most logical way to set this up considering that users will be coming from all over and will also be traveling internationally. Here are my thoughts, and questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Three main business groups biz1, biz2, and biz3. All of them will have resources in the Azure data centers and may need access to resources at specific sites&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 1:&#xA;Have FQDNs vpn.biz1.com, vpn.biz2.com, and vpn.biz3.com. Point the DNS records to a site that &quot;represents&quot; each company. Get SSL certs each for these. Downside is that users needing access to the data centers will end up hairpinning (u-turn) out of the ASA at each site and go back into the data center. Using twice the data. If users are international then they may end up having high latency depending on which business they are with. Biz1 is mostly US, while Biz2 and Biz3 are mostly EU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 2:&#xA;Use the Azure data centers as hubs for these connections. Most will end up needing access to the resources there anyway and if they do need access to resources that are local to sites, they will then hairpin out to the site they need to access. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 2 seems like it would make the most sense, but I don't know how we would should resolve the names. It would be fantastic if when a user for Biz1 is in the US, they will resolve the vpn.biz1.com address to the public IP for the US Azure site. And if they are in Europe they will get the other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What options exist to geographically resolve addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What issues could I experience with SSL certificates? Not my strong suit but I thought that SSL Certificates need to be bound to 1 domain name and 1 public IP. Can a single certificate be used for two separate public IP addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All sites have ASAs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any input!&lt;/p&gt;&#xA;" OwnerUserId="34280" LastActivityDate="2017-02-08T20:30:21.090" Title="Remote VPN connectivity - international - DNS geolocation" Tags="|vpn|dns|cisco-anyconnect|" AnswerCount="1" CommentCount="1" ClosedDate="2018-07-31T00:46:30.600" ContentLicense="CC BY-SA 3.0" />
  <row Id="38762" PostTypeId="2" ParentId="38761" CreationDate="2017-02-08T20:30:21.090" Score="0" Body="&lt;p&gt;Option 2 could be done with split DNS. Over &lt;a href=&quot;http://geoip.site/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; you can download ready to use geolocation databases for BIND. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 3 you can build your VPN solution based on anycast.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-08T20:30:21.090" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38763" PostTypeId="2" ParentId="28321" CreationDate="2017-02-08T20:50:26.407" Score="-1" Body="&lt;p&gt;This is my first post here, so mostly food for thought. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had a similar situation like this, however we found it was best to simply just use the ISP provided router for the modem capability.  We essentially bridged the ASA to the ISP provided modem/router. Eliminates the need for this double NAT situation and will reduce packet overheads. You'll most likely have to adjust MTU settings also. &lt;/p&gt;&#xA;" OwnerUserId="34272" LastActivityDate="2017-02-08T20:50:26.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38764" PostTypeId="2" ParentId="38751" CreationDate="2017-02-08T20:55:51.773" Score="2" Body="&lt;p&gt;If you are using 802.1x on a cisco switch, you can configure the interface to fallback to an authorized vlan if the server is dead.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; authentication event server dead action authorize vlan XX&#xA; authentication event server dead action authorize voice&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know of any way to cause the switch to &quot;remember&quot; the last authorized vlan.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2017-02-08T20:55:51.773" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38766" PostTypeId="2" ParentId="38674" CreationDate="2017-02-08T21:02:47.917" Score="2" Body="&lt;p&gt;I would say it is some type of electrical grease, to keep moisture out. Maybe try trace the pair from the block you are wanting to connect into, trace that pair back to the cable coming into the distribution block, cut it out from back of block and use scotch locks, or soemthing similar, to crimp your pair to the POTS pair. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could get into trouble by to the main ISP who owns the cable into the POTS however, so I take no responsibility fro your actions. &lt;/p&gt;&#xA;" OwnerUserId="34272" LastActivityDate="2017-02-08T21:02:47.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38772" PostTypeId="1" AcceptedAnswerId="38776" CreationDate="2017-02-09T08:41:37.253" Score="0" ViewCount="1276" Body="&lt;p&gt;I am working in wireshark. I am monitoring the wifi traffic on the same network. We have 6 pc's there and one machine was installed on wireshark to  capture wifi traffic. I got my team mates Ip address in the endpoint list.  My machine have installed wiresahrk. whenever they ping to my machine. my machine ip : 192.168.1.214. and others are: 192.168.1.31, 164,188,242. and they ping a request to my m/c I can capture that request.&#xA;And if 192.168.1.188 machine send a http request to a local server to other ip like 164, 31 . I couldn't capture that http request. Its hows only mdns protocol.. here is the screenshot..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why I can't capture the http request ? Why other team mates IP (188--&gt;164.31) was not capture ?  Anyone please help me &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am working in ubuntu machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My router type is : &lt;code&gt;Belkin Surf N150 Wireless Modem Router, F9J1001 v1.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root@naveen-Inspiron-3542:/home/naveen# airmon-ng start wlp6s0&#xA;&#xA;&#xA;Found 5 processes that could cause trouble.&#xA;If airodump-ng, aireplay-ng or airtun-ng stops working after&#xA;a short period of time, you may want to kill (some of) them!&#xA;-e &#xA;PID Name&#xA;1114    NetworkManager&#xA;1117    avahi-daemon&#xA;1144    avahi-daemon&#xA;1311    wpa_supplicant&#xA;7662    dhclient&#xA;Process with PID 7662 (dhclient) is running on interface wlp6s0&#xA;Process with PID 8073 (dumpcap) is running on interface wlp6s0&#xA;&#xA;&#xA;Interface   Chipset     Driver&#xA;&#xA;wlp6s0      Atheros     ath9k - [phy0]&#xA;                (monitor mode enabled on mon0)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I click on mon0 interface. I got the 802.11 management frames..&#xA;&lt;a href=&quot;https://i.stack.imgur.com/p1Jto.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/p1Jto.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my question is I can't capture the http request ?&lt;/p&gt;&#xA;" OwnerUserId="34275" LastEditorUserId="34275" LastEditDate="2017-02-10T03:46:33.197" LastActivityDate="2017-02-10T03:46:33.197" Title="Unable to capture http request in Wireshark" Tags="|wireshark|" AnswerCount="1" CommentCount="7" ClosedDate="2017-02-10T03:59:38.173" ContentLicense="CC BY-SA 3.0" />
  <row Id="38776" PostTypeId="2" ParentId="38772" CreationDate="2017-02-09T12:28:50.207" Score="0" Body="&lt;p&gt;The most likely reason is that you (and all the other hosts) are connected to a network switch.  The switch only forwards packets to the port where the destination host is.  Since you are not the destination, you don't see the packet.  Broadcast packets are forwarded out all ports, and that is what you are seeing in Wireshark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a Cisco switch, you can configure a span port to forward all traffic on the switch.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-02-09T12:28:50.207" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="38777" PostTypeId="2" ParentId="38736" CreationDate="2017-02-09T12:57:08.607" Score="0" Body="&lt;p&gt;I face the same last year ,in my case it was due to port blocking by default windows firewall.&#xA;DNS server runs on port 53, which is blocked by default in Windows 7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I added rule for allowing port 53 on machine where BIND is installed. For doing this,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Open cmd with admin rights.&#xA;Execute &gt;netsh firewall add portopening ALL 53 DNS-server&lt;/p&gt;&#xA;" OwnerUserId="34303" LastActivityDate="2017-02-09T12:57:08.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38778" PostTypeId="2" ParentId="38693" CreationDate="2017-02-09T13:02:25.533" Score="0" Body="&lt;p&gt;Look for the insider attacks ,ARP spoofing dont work outside the LAN. &#xA;Routers are never effected by ARP spoofing or poisoning as they work on layer 3.&lt;/p&gt;&#xA;" OwnerUserId="34303" LastActivityDate="2017-02-09T13:02:25.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38780" PostTypeId="1" CreationDate="2017-02-09T14:26:56.050" Score="1" ViewCount="528" Body="&lt;p&gt;In &lt;code&gt;Multiple Spanning Tree&lt;/code&gt;, &lt;code&gt;802.1s&lt;/code&gt;, an MST region appears to the external world (another MST region, a 802.1d or 802.1w switch) as a single (virtual) bridge, using its IST instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the priority of this virtual bridge? How do we configure it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What need to be configured on all members of the MST region to ensure this MST region virtual bridge will always be elected as root bridge?&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-10T16:30:18.340" Title="MST region and CST virtual bridge priority" Tags="|cisco|spanning-tree|ieee-802.1s|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38781" PostTypeId="1" AcceptedAnswerId="38785" CreationDate="2017-02-09T14:27:52.630" Score="2" ViewCount="581" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/belh4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/belh4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hi there, so {unnamed company} has set up some VLSM networks, but they overlap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So network 1 is &lt;code&gt;10.15.0.0/16&lt;/code&gt; and network 2 is &lt;code&gt;10.15.208.0/24&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now you can see how these overlap:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.15.0.1 - 254.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.15.208.1 - 254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...they both contain &lt;code&gt;10.15.208.2&lt;/code&gt;. Which is the IP of a DC on network 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Machines in network 1 can connect to the DC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is... how? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran it through a simulation on a packet tracer, and I can see that hosts on network 1 send out an ARP, to which router 0 replies with its own mac address. Why is that? Is it because router 0 has a static route for 10.15.208.0/24?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What also are the implications of this strange set up? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router0:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Gateway of last resort is not set&#xA;         10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;    C       10.15.0.0/16 is directly connected, FastEthernet0/0&#xA;    S       10.15.208.0/24 [1/0] via 192.168.0.2&#xA;    C    192.168.0.0/16 is directly connected, FastEthernet0/1&#xA;&#xA;&#xA;Building configuration...&#xA;&#xA;Current configuration : 557 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.15.0.1 255.255.0.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.0.1 255.255.0.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;ip route 10.15.208.0 255.255.255.0 192.168.0.2 &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Gateway of last resort is not set&#xA;     10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;S       10.15.0.0/16 [1/0] via 192.168.0.1&#xA;C       10.15.208.0/24 is directly connected, FastEthernet0/0&#xA;C    192.168.0.0/16 is directly connected, FastEthernet0/1&#xA;&#xA;Building configuration...&#xA;&#xA;Current configuration : 557 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.15.208.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 192.168.0.2 255.255.0.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;ip route 10.15.0.0 255.255.0.0 192.168.0.1 &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34307" LastEditorUserId="34307" LastEditDate="2017-02-09T16:28:00.990" LastActivityDate="2017-02-09T16:28:00.990" Title="Overlapping VLANs / Router ARP reply" Tags="|switch|arp|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38782" PostTypeId="2" ParentId="38732" CreationDate="2017-02-09T14:54:34.497" Score="3" Body="&lt;p&gt;CAM and ARP table are populeted while you ping from 4500. Is just aging faster from CAM than from ARP. If you would wait 4 hours it would time out as well from ARP. Is those 4500 clustered? &#xA;If yes I would say that VLAN is not getting to Active node for mac address population. All the request are coming to passive node and they are dropped. Maybe STP topology for particular VLAN is blocking state to Active node.&#xA;I would compare STP topology of working vlan with not working one. Double check uplinks from access layer for this VLAN. Could be as well that VSL link between 4500 is not allowing particualr vlan. You need as well make sure that both 4500 have ports in this vlan. As well check floodset between 4500:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show platform hardware floodset vlan [VLANID]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If both 4500's having floodset on required interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Temporary fix would be increase vlan aging time for exmaple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#mac address-table aging-time 14400 vlan [VLANID]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-09T15:07:36.647" LastActivityDate="2017-02-09T15:07:36.647" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38783" PostTypeId="2" ParentId="38781" CreationDate="2017-02-09T15:05:00.963" Score="0" Body="&lt;p&gt;I would say that this is how routers making forwarding decisions. &#xA;If both of networks are advertised by same routing protocol administrative distance would be same. But smaller network /24 would be preffered so even router know how to reach 10.15.0.0/16 for any IP in network 10.15.208.0/24 would send it to data centre as it's more prefered. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Implication is that network overlap and this could cause serious issues somewhere on the line.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-09T16:17:43.480" LastActivityDate="2017-02-09T16:17:43.480" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38785" PostTypeId="2" ParentId="38781" CreationDate="2017-02-09T16:00:34.937" Score="2" Body="&lt;p&gt;The router is using proxy ARP.  This is a feature enabled by default.  Since the router knows how to reach the destination address, it will respond on the host's behalf with its own MAC address and all frames from the source will be sent to the router which can then route to the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13718-5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Proxy ARP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2017-02-09T16:00:34.937" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38786" PostTypeId="2" ParentId="38781" CreationDate="2017-02-09T16:12:42.883" Score="1" Body="&lt;p&gt;Assuming router0 and router1 know about all networks, this is normal behavior.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers (Cisco) use the following algorithm to determine where to forward packets &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If no route matches the destination address, drop the packet.&lt;/li&gt;&#xA;&lt;li&gt;If only one route matches the address, forward the packet out the&#xA;defined interface.&lt;/li&gt;&#xA;&lt;li&gt;If more than one route exists, use the route with the longest subnet&#xA;mask (the most specific route).&lt;/li&gt;&#xA;&lt;li&gt;If more than one route has the most specific route, choose the one&#xA;with the lowest administrative distance.&lt;/li&gt;&#xA;&lt;li&gt;If more than one route has the same administrative distance, choose&#xA;the one with the lowest metric.&lt;/li&gt;&#xA;&lt;li&gt;If more than one has the lowest metric, alternate among all routes&#xA;(either per-packet or per-flow, depending on the configuration).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-02-09T16:12:42.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38787" PostTypeId="2" ParentId="38781" CreationDate="2017-02-09T16:24:31.077" Score="1" Body="&lt;p&gt;Your router is participating in &lt;a href=&quot;http://www.practicalnetworking.net/series/arp/proxy-arp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Proxy ARP&lt;/a&gt;.  Proxy ARP occurs when someone answers an ARP Request &lt;em&gt;on behalf&lt;/em&gt; of another entity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, the Router is offering an ARP Response, on behalf of the hosts in the 10.15.208.0/24 network. The router is doing this because it knows how to get to the /24 network because of the static route (&lt;code&gt;ip route 10.15.208.0 255.255.255.0 192.168.0.2&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an illustration of how Proxy ARP works:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/arp/proxy-arp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Az209.gif&quot; alt=&quot;Proxy ARP - Practical Networking .net&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2017-02-09T16:24:31.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38789" PostTypeId="1" AcceptedAnswerId="71867" CreationDate="2017-02-09T17:00:59.747" Score="2" ViewCount="145" Body="&lt;p&gt;Hi My network has the following resources:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;3 ASA-5505 w/site-to-site VPN's&lt;/li&gt;&#xA;&lt;li&gt;newly acquired c801F-K9 router&lt;/li&gt;&#xA;&lt;li&gt;Exchange Server&lt;/li&gt;&#xA;&lt;li&gt;3 ISP's (soon to be 2) A t-1, DSL, Satellite.&lt;/li&gt;&#xA;&lt;li&gt;VOIP Cisco Cme&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;My goal is to do away with the T1 and use the DSL and Sat.  Because of the latency with the satellite, I would like to have the DSL as gateway for the email and VPNs and the rest of outbound traffic to be handled by the satellite.&lt;/p&gt;&#xA;&lt;p&gt;Questions:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can I just replace my Local ASA-5505 with the C891 and use policy base routing to handle everything?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="34023" LastEditorUserId="36720" LastEditDate="2021-01-05T11:02:29.660" LastActivityDate="2021-01-05T11:02:29.660" Title="connecting two ISPs to my network" Tags="|routing|cisco-asa|isp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="38790" PostTypeId="2" ParentId="38789" CreationDate="2017-02-09T17:26:21.670" Score="2" Body="&lt;p&gt;This depends on if you have a block of public IP's (or an ASN) that you want redundant reachability for.  If all you need to do is handle multiple outbound paths for your LAN(s), I would use the router - the new 891 and configure it accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want redundant (multipath) inbound reachability, that's probably going to involve BGP peering with your ISP(s), unless a single ISP provides both links - in which case they can probably set that up for you on their equipment.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-09T17:26:21.670" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38793" PostTypeId="2" ParentId="38780" CreationDate="2017-02-09T18:49:27.720" Score="3" Body="&lt;p&gt;Set the root priority on the 0 instance:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree mst 0 root primary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will insure this bridge has the lowest priority of any other switch in the region.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To configure a switch to become the root, use the spanning-tree mst&#xA;  instance-id root global configuration command to modify the switch&#xA;  priority from the default value (32768) to a significantly lower value&#xA;  so that the switch becomes the root switch for the specified&#xA;  spanning-tree instance. When you enter this command, the switch checks&#xA;  the switch priorities of the root switches. Because of the extended&#xA;  system ID support, the switch sets its own priority for the specified&#xA;  instance to 24576 if this value will cause this switch to become the&#xA;  root for the specified spanning-tree instance.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2950/software/release/12-1_11_yj4/configuration/guide/lrescg/swmstp.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Source&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-02-09T18:49:27.720" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38797" PostTypeId="1" AcceptedAnswerId="38798" CreationDate="2017-02-09T20:20:52.573" Score="2" ViewCount="2272" Body="&lt;p&gt;I was reading about the &lt;strong&gt;DISCOVERY&lt;/strong&gt; operation phase for an RSN. There a diagram shows NULL Authentication (Second Part, in the diagram). What is it and what is the use?&lt;br&gt;&#xA;&lt;br&gt;The image is from the book, &lt;em&gt;Cryptography and Network Security: Principles and Practice&lt;/em&gt;.&lt;br&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KQQAN.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KQQAN.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31720" LastActivityDate="2017-03-11T23:52:14.747" Title="What is null authentication in WLAN and why is it required?" Tags="|wireless|network-discovery|authentication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38798" PostTypeId="2" ParentId="38797" CreationDate="2017-02-09T20:52:14.767" Score="1" Body="&lt;p&gt;&quot;Open authentication&quot;, is fundamentally a NULL authentication where the client says &quot;authenticate me&quot;, and the AP responds with &quot;yes&quot;. &#xA;Open authentication is the only method used in enterprise WLAN deployments, it is fundamentally a NULL authentication, Therefore, &quot;real authentication&quot; is achieved by using 802.1X/EAP authentication mechanisms.&#xA;A typical secure enterprise WLAN AP blocks WLAN client traffic at the AP until a successful 802.1X authentication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means that there is no verification of the user or machine. Open Authentication allows any device that places an authentication request to the access point (AP). Open Authentication uses clear-text transmission to allow a client to associate to an AP and therefore 802.1x could be used.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-09T21:03:21.590" LastActivityDate="2017-02-09T21:03:21.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38801" PostTypeId="1" CreationDate="2017-02-09T22:44:31.500" Score="0" ViewCount="3847" Body="&lt;p&gt;Running SRX firewall, and when running command show route, one of the outputs shows as reject&#xA;could you help in troubleshooting the reason for this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10.14.224.193/32   *[Local/0] 24w6d 22:05:53&#xA;                      Reject&lt;/p&gt;&#xA;" OwnerUserId="34323" LastActivityDate="2017-02-10T21:11:22.580" Title="SRX FW - Show route - output reject" Tags="|routing|juniper|srx|" AnswerCount="1" CommentCount="4" ClosedDate="2017-08-16T21:44:20.253" ContentLicense="CC BY-SA 3.0" />
  <row Id="38802" PostTypeId="2" ParentId="38801" CreationDate="2017-02-09T23:07:12.263" Score="2" Body="&lt;p&gt;Most common reasons to reject route on local interface is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;interface with assigned IP is down/disabled&lt;/li&gt;&#xA;&lt;li&gt;there is IP conflict and this IP is assigned in two places, could be even on unused interface etc.&lt;/li&gt;&#xA;&lt;li&gt;zone misconfiguration &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Please supply full configuration so we can advise.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-09T23:07:12.263" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38805" PostTypeId="1" CreationDate="2017-02-10T06:28:37.810" Score="5" ViewCount="6186" Body="&lt;p&gt;As per title. Sorry if this is a duplicate question, but in the numerous posts online, I could only find how a connection is torn down, but not (convincingly) why it is done in such a way.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. A -----FIN-----&amp;gt; B&#xA;2. A &amp;lt;----ACK------ B&#xA;3. A &amp;lt;----FIN------ B&#xA;4. A -----ACK-----&amp;gt; B        &amp;lt;====== Why is this one necessary?&#xA;&#xA;======if 3 or 4 lost=======&#xA;5. A &amp;lt;....FIN...... B&#xA;6. A .....ACK.....&amp;gt; B&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It seems B can shutdown the socket as soon as it sends out its &lt;code&gt;FIN(3)&lt;/code&gt; because&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;if the &lt;code&gt;FIN(3)&lt;/code&gt; is not lost, all is well.&lt;/li&gt;&#xA;&lt;li&gt;if it is lost, A can timeout anyway and close the connection. One can argue that if this does happen, A will have to wait for a very long time. But B bears some risk with this last &lt;code&gt;ACK(4)&lt;/code&gt; as well. Suppose the connection suddenly goes down (though with low probability) right after A sends out the last &lt;code&gt;ACK(4)&lt;/code&gt;, causing B unable to receive it. Then B will have to wait and timeout, too. Since both approaches are flawed, why not save this last &lt;code&gt;ACK&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My guess&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the only exception is that there is a reasonably high chance of packet loss such that both &lt;code&gt;FIN(3)&lt;/code&gt; and &lt;code&gt;ACK(4)&lt;/code&gt; won't arrive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;FIN(3)&lt;/code&gt; is lost, receiving nothing back from A, B will resend its new &lt;code&gt;FIN(5)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, if &lt;code&gt;ACK(4)&lt;/code&gt; is lost, B will think that its &lt;code&gt;FIN(3)&lt;/code&gt; is lost and resend the &lt;code&gt;FIN(5)&lt;/code&gt; as well. A, though having sent out &lt;code&gt;ACK(4)&lt;/code&gt;, is supposed in the &lt;code&gt;TIME-WAIT&lt;/code&gt; status, will hopefully receive this new &lt;code&gt;FIN(5)&lt;/code&gt; and resend an &lt;code&gt;ACK(6)&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems only if the scenario described above happens reasonably frequently, will the last &lt;code&gt;ACK(4)&lt;/code&gt; have a significant impact.&lt;/p&gt;&#xA;" OwnerUserId="24749" LastEditorUserId="8499" LastEditDate="2017-07-16T00:27:35.770" LastActivityDate="2021-09-10T20:59:36.407" Title="Why is the last ACK needed in TCP four way termination" Tags="|tcp|layer4|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="38806" PostTypeId="2" ParentId="20265" CreationDate="2017-02-10T06:41:19.690" Score="0" Body="&lt;p&gt;Download the actual npcap executable from npcap.org after uninstalling the one that comes with nmap. That did the trick for me. No more error message finding eth0. No more error message saying npcap functions not importing. Done.&lt;/p&gt;&#xA;" OwnerUserId="34330" LastActivityDate="2017-02-10T06:41:19.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38808" PostTypeId="1" CreationDate="2017-02-10T08:15:30.427" Score="1" ViewCount="11804" Body="&lt;p&gt;I'm trying to set up a IPSec VPN connection between a Cisco ASA and a Mikrotik router (which is behind a Fritzbox in DMZ mode). I think everything is set up correctly except for that NAT-T is missing on the Cisco. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a Mikrotik you can enable NAT-T per peer, but on the Cisco it's globally. Does enabling NAT-T there break other active tunnels? Or is it just a detection mechanism if IPSec needs to traverse NAT / DMZ devices?&lt;/p&gt;&#xA;" OwnerUserId="20112" LastEditorUserId="30321" LastEditDate="2017-10-09T13:00:37.240" LastActivityDate="2017-12-08T14:15:22.757" Title="NAT-T Traversal on a Cisco ASA" Tags="|cisco-asa|nat|ipsec|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38809" PostTypeId="2" ParentId="38808" CreationDate="2017-02-10T10:45:05.593" Score="1" Body="&lt;p&gt;NAT Traversal performs two tasks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Detects if both ends support NAT-T  &lt;/li&gt;&#xA;&lt;li&gt;Detects NAT devices along the transmission path (NAT-Discovery)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If NAT-T is enabled&#xA;and client is behind NAT, then NAT-T is used&lt;/p&gt;&#xA;&#xA;&lt;p&gt;no NAT exists, then Native IPsec (ESP) is used&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So not gonna affect your current tunnels.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-10T10:45:05.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38810" PostTypeId="2" ParentId="38805" CreationDate="2017-02-10T13:34:10.287" Score="9" Body="&lt;pre&gt;&lt;code&gt;A -----FIN-----&amp;gt; B&#xA;FIN_WAIT_1       CLOSE_WAIT&#xA;A &amp;lt;----ACK------ B&#xA;FIN_WAIT_2&#xA;&#xA;(B can send more data here, this is half-close state)&#xA;&#xA;A &amp;lt;----FIN------ B&#xA;TIME_WAIT        LAST_ACK&#xA;A -----ACK-----&amp;gt; B&#xA;|                CLOSED&#xA;2MSL Timer&#xA;|&#xA;CLOSED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The ACK to a FIN is required because the end sending the FIN will retransmit it until it receives an ACK. So, the question is, why TCP keeps sending the FIN if not ACK is received? My understanding is that given that a connection may be in a half-close state, the side that is receiving the last FIN (A in your diagram) may be waiting for data &amp;quot;indefinitely&amp;quot; wasting resources in that end when no more data will be received. B needs to be sure that A received the FIN (and closes the connection), hence it requires an ACK.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;To be more precise about half-close. In your example, A can close its side of the connection sending the first FIN and receiving the first ACK, but B can keep sending more data at will for any period of time before closing the connection and sending the last FIN. So, the time between the first FIN/ACK sequence and the second one can't be determined or timed-out. A needs the last FIN to be sure B has closed its side of the connection.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Edit 2&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;What happen if the last FIN from B to A is lost? Then, B will not receive the ACK and will retransmit the FIN until it receives an ACK. So, A will eventually get the FIN and transition to the TIME_WAIT state.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;A -----FIN-----&amp;gt; B&#xA;FIN_WAIT_1       CLOSE_WAIT&#xA;A &amp;lt;----ACK------ B&#xA;FIN_WAIT_2&#xA;&#xA;(B can send more data here, this is half-close state)&#xA;&#xA;A  (Lost)X&amp;lt;--FIN------ B&#xA;FIN_WAIT_2       LAST_ACK&#xA;                 (timeout waiting for ACK)&#xA;A &amp;lt;----FIN------ B&#xA;TIME_WAIT&#xA;A -----ACK-----&amp;gt; B&#xA;|                CLOSED&#xA;2MSL Timer&#xA;|&#xA;CLOSED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;What happen if the last ACK is lost? Then, B will think that A did not receive the FIN and will retransmit the FIN. From B point of view this is the same as if the FIN was lost, from A point of view this different since A now is in the TIME_WAIT or CLOSED state. When A receives the new FIN from A if it is in the TIME_WAIT state it will send the ACK again.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;A -----FIN-----&amp;gt; B&#xA;FIN_WAIT_1       CLOSE_WAIT&#xA;A &amp;lt;----ACK------ B&#xA;FIN_WAIT_2&#xA;&#xA;(B can send more data here, this is half-close state)&#xA;&#xA;A &amp;lt;----FIN------ B&#xA;TIME_WAIT        LAST_ACK&#xA;A -----ACK--&amp;gt;X(Lost)   B&#xA;TIME_WAIT        LAST_ACK&#xA;                 (timeout waiting for ACK)&#xA;A &amp;lt;----FIN------ B&#xA;A -----ACK-----&amp;gt; B&#xA;|                CLOSED&#xA;2MSL Timer&#xA;|&#xA;CLOSED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;If A is in the CLOSED state it will send a RESET, in either case B will be able to close its side of the connection.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;A -----FIN-----&amp;gt; B&#xA;FIN_WAIT_1       CLOSE_WAIT&#xA;A &amp;lt;----ACK------ B&#xA;FIN_WAIT_2&#xA;&#xA;(B can send more data here, this is half-close state)&#xA;&#xA;A &amp;lt;----FIN------ B&#xA;TIME_WAIT        LAST_ACK&#xA;A -----ACK--&amp;gt;X(Lost)   B&#xA;TIME_WAIT        LAST_ACK&#xA;|&#xA;2MSL Timer&#xA;|&#xA;CLOSED&#xA;                 (timeout waiting for ACK)&#xA;A &amp;lt;----FIN------ B&#xA;A -----RST-----&amp;gt; B&#xA;                 CLOSED&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34223" LastEditorUserId="78487" LastEditDate="2021-09-10T16:49:48.353" LastActivityDate="2021-09-10T16:49:48.353" CommentCount="10" ContentLicense="CC BY-SA 4.0" />
  <row Id="38811" PostTypeId="1" AcceptedAnswerId="38812" CreationDate="2017-02-10T14:20:40.567" Score="1" ViewCount="2160" Body="&lt;p&gt;Regarding Cisco port-security. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is mac address aging just for dynamic/sticky mac addresses?&lt;br&gt;&#xA;Does the ageing play any part in a statically configured mac address?&lt;br&gt;&#xA;If no static or sticky configuration is configured, does the ageing come into play?&lt;/p&gt;&#xA;" OwnerUserId="33019" LastActivityDate="2017-02-10T15:03:09.903" Title="Is mac address aging just for dynamic/sticky mac addresses?" Tags="|cisco|mac-address|port-security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38812" PostTypeId="2" ParentId="38811" CreationDate="2017-02-10T14:26:06.357" Score="3" Body="&lt;p&gt;You can configure an interface to convert the dynamic MAC addresses to sticky secure MAC addresses and to add them to the running configuration by enabling sticky learning. To enable sticky learning, enter the switchport port-security mac-address sticky command. When you enter this command, the interface converts all the dynamic secure MAC addresses, including those that were dynamically learned before sticky learning was enabled, to sticky secure MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sticky secure MAC addresses do not automatically become part of the configuration file, which is the startup configuration used each time the switch restarts. If you save the sticky secure MAC addresses in the configuration file, when the switch restarts, the interface does not need to relearn these addresses. If you do not save the configuration, they are lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So they wont be ageing  from port security, mac address only ageing from CAM and ARP. Port security and ARP table are two different concepts. &lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-10T15:03:09.903" LastActivityDate="2017-02-10T15:03:09.903" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38813" PostTypeId="1" CreationDate="2017-02-10T14:29:57.387" Score="2" ViewCount="5241" Body="&lt;p&gt;I have a mixed environment using HP and Blade / IBM / Lenovo networking switches. We have VLANs for many subnets. We don't have any central management for switches, nor VLAN aware mapping. I'm having a problem where I think I need to figure out how a VLANs traffic is being sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a VLAN that is connected thusly:&#xA;Router --- [bldmgtswitch] --- [bldG8000] ={=}= [bldG8264]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The --- is untagged 1Gbit, the ={=}= is a tag on a 10Gbit connection. Connecting to [bldmgtswitch] untagged I can ping router. Connecting to [bldG8000] untagged I cannot ping router...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm thinking this may be because there's something wrong with the configuration on [bldG8000], but the VLANs are all configured correctly. Spanning tree doesn't seem to be blocking... I'm wondering if the port cost is the issue. More so, I just am not sure how at Layer 2 to figure out where the frames are going when I plug into the untagged port on [bldG8000]...&lt;/p&gt;&#xA;" OwnerUserId="32445" LastActivityDate="2017-08-12T11:51:53.670" Title="How to traceroute layer 2 VLANs on non-cisco devices?" Tags="|vlan|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="38815" PostTypeId="2" ParentId="38808" CreationDate="2017-02-10T15:53:23.590" Score="1" Body="&lt;p&gt;Enabling NAT-Traversal on a Cisco Router/Firewall simply enables &lt;em&gt;the detection&lt;/em&gt; of NAT devices in path (if the other side also supports and has NAT-T enabled).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will not change or affect other tunnels to turn it on. If they were able to build before (with NAT-T disabled), then there was no NAT device in path, and NAT-T would detect that and cause no changes to the negotiation and tunnel transport.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To learn more, I wrote about NAT-T in &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/23185/should-i-increase-the-timeout-value-for-udp-on-our-vpn-router-device/23188#23188&quot;&gt;this post&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-02-10T15:53:23.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38817" PostTypeId="2" ParentId="38780" CreationDate="2017-02-10T16:30:18.340" Score="2" Body="&lt;p&gt;CIST Root Bridges Election Process&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a switch boots up, it declares itself as CIST Root and CIST Regional Root and announces this fact in outgoing BPDUs. The switch will adjust its decision upon reception of better information and continue advertising the best known CIST Root and CIST Regional Root on all internal ports. On the boundary ports, the switch advertises only the CIST Root Bridge ID and CIST External Root Path Cost thus hiding the details of the region’s internal topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CIST External Root Path Cost is the cost to reach the CIST Root across the links connecting the boundary ports – i.e. the inter-region links. When a BPDU is received on an internal port, this cost is not changed. When a BPDU is received on a boundary port, this cost is adjusted based on the receiving boundary port cost. In result, the CIST External Root Path Cost is propagated unmodified inside any region.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Only a boundary switch could be elected as the CIST Regional Root, and this is the switch with the lowest cost to reach the CIST Root. If a boundary switch hears better CIST External Root Path cost received on its internal link, it will relinquish its role of CIST Regional Root and start announcing the new metric out of its boundary ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Every boundary switch needs to properly block its boundary ports. If the switch is a CIST Regional Root, it elects one of the boundary ports as the “CIST Root port” and blocks all other boundary ports. If a boundary switch is not the CIST Regional Root, it will mark the boundary ports as CIST Designated or Alternate. The boundary port on a non regional-root bridge becomes designated only if it has superior information for the CIST Root: better External Root Path cost or if the costs are equal better CIST Regional Root Bridge ID. This follows the normal rules of STP process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result of CIST construction, every region will have one switch having single port unblocked in the direction of the CIST Root. This switch is the CIST Regional Root. All boundary switches will advertise the region’s CIST Regional Root Bridge ID out of their non-blocking boundary ports. From the outside perspective, the whole region will look like a single virtual bridge with the Bridge ID = CIST Regional Root ID and single root port elected on the CIST Regional Root switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The region that contains the CIST Root will have all boundary ports unblocked and marked as CIST designated ports. Effectively the region would look like a virtual root bridge with the Bridge ID equal to CIST Root and all ports being designated. Notice that the region with CIST Root has CIST Regional Root equal to CIST Root as they share the same lowest bridge priority value across all regions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have a look at the diagram below. It demonstrates the CIST topology calculated from the physical topology we outlined above. First, SW1-1 is elected as the CIST Root as it has the lowest Bridge ID among all bridges in all regions. This automatically makes region 1 a virtual bridge with all boundary ports unblocked. Next, SW2-1 and SW3-1 are elected as the CIST Regional Roots in their respective regions. Notice that SW3-1 and SW2-3 have equal External Costs to reach the CIST Root but SW3-1 wins the CIST Regional Root role due to lower priority. Keep in mind that in the topology with multiple MSTP regions, every region that does not contain the CIST Root has to change the IST Root election process and make IST Root equal to CIST Regional Root.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blog.ine.com/2010/02/22/understanding-mstp/#CIST&quot; rel=&quot;nofollow noreferrer&quot;&gt;source&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cU1ux.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cU1ux.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-10T16:30:18.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38818" PostTypeId="2" ParentId="12821" CreationDate="2017-02-10T17:16:01.730" Score="0" Body="&lt;p&gt;If host A and B are on different networks or subnets and connected to the same switch I believe that they can communicate through the default gateway.&lt;/p&gt;&#xA;" OwnerUserId="34344" LastActivityDate="2017-02-10T17:16:01.730" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38819" PostTypeId="1" AcceptedAnswerId="38821" CreationDate="2017-02-10T17:44:49.830" Score="1" ViewCount="144" Body="&lt;p&gt;If I turn on port security and configure a port with the following; the violation mode to protected, the ageing time to 10 minutes, maximum number of mac addresses to 1.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If in the future I replace the device on the switch port, if I wait 10 minutes will the switch begin to accept the new frames with a new mac address? Or do I have to shutdown and reenable the port?&lt;/p&gt;&#xA;" OwnerUserId="33019" LastActivityDate="2017-02-10T19:40:41.377" Title="Regarding the port security violation mode protected, what action needs to be taken when a new device replaces an old device?" Tags="|mac-address|port-security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38820" PostTypeId="2" ParentId="38805" CreationDate="2017-02-10T18:29:06.320" Score="0" Body="&lt;p&gt;TCP provides a reliable transmission service.  This includes each party knowing it has received &lt;strong&gt;all&lt;/strong&gt; the data the other intended to transmit.  In your example, A won't know it has received all B's data until it receives the FIN. B is going to retransmit the FIN, so that it knows that A knows all data has been transmitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a side note, this also implies A needs to &quot;stay here&quot; after it has sent its ACK to B's FIN: when B retransmits the FIN, if A's gone, B won't get any ACK (and possibly a RST) and so cannot guarantee A knows it has received all data.  A stays some time in the TIME_WAIT state to ACK such retransmitted FINs.  Strictly, it would need to stay there until it knows B has received its ACK but that's an unsolvable problem often dubbed the &quot;two-armies&quot; problem.&lt;/p&gt;&#xA;" OwnerUserId="33078" LastActivityDate="2017-02-10T18:29:06.320" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38821" PostTypeId="2" ParentId="38819" CreationDate="2017-02-10T18:50:53.830" Score="1" Body="&lt;p&gt;protect —The PFC drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so answer is no you don't need shutdown and re-enable port, after 10 minutes mac address will age out from port protected and new mac address will be assigned in case of using sticky.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can add to aging type {absolute | inactivity} &#xA;For absolute aging, all the secure addresses on this port ago out exactly after the time (minutes) specified and are removed from the secure address list. For inactive aging, the secure addresses on this port ago out only if there is no data traffic from the secure source address for the specified time period.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-10T19:40:41.377" LastActivityDate="2017-02-10T19:40:41.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38825" PostTypeId="1" AcceptedAnswerId="38826" CreationDate="2017-02-10T21:45:56.273" Score="0" ViewCount="649" Body="&lt;p&gt;I'm currently investigating an unusual MTU issue. I have a server running Red Hat with a single interface which has an MTU of 1500. I have verified this by running &lt;code&gt;netstat -i&lt;/code&gt;. When I packet capture the interface, the MTU seems to be completely ignored and there are individual Ethernet frames larger than 1500 leaving the interface. I always thought that this was impossible because the OS ensured the frames were fragmented to the configured MTU. I've had a couple of CCIE engineers look at the capture and they have confirmed these are single frames (I'm not misreading the capture).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone got any idea what might be happening? Is it possible for a TCP connection to override the MTU? I know that it can set the MSS but I thought this can't increase the MTU. I've been reading about path MTU discovery in more depth, can this increase the MTU of the interface?&lt;/p&gt;&#xA;" OwnerUserId="34350" LastActivityDate="2017-02-10T21:53:57.623" Title="Override Interface MTU" Tags="|mtu|" AnswerCount="1" CommentCount="5" ClosedDate="2017-02-10T21:52:14.257" ContentLicense="CC BY-SA 3.0" />
  <row Id="38826" PostTypeId="2" ParentId="38825" CreationDate="2017-02-10T21:53:57.623" Score="1" Body="&lt;p&gt;try:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;echo 0 &amp;gt; /proc/sys/net/core/enable_tcp_offloading&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-10T21:53:57.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38828" PostTypeId="1" AcceptedAnswerId="38829" CreationDate="2017-02-11T01:39:07.790" Score="1" ViewCount="1483" Body="&lt;p&gt;Stub areas have many advantages, but can someone tell me what are their disadvantages?&lt;/p&gt;&#xA;" OwnerUserId="30265" LastEditorUserId="8499" LastEditDate="2017-02-11T01:55:13.253" LastActivityDate="2017-02-11T01:55:13.253" Title="What are disadvantage of Stub Area in OSPF?" Tags="|ospf|stub|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38829" PostTypeId="2" ParentId="38828" CreationDate="2017-02-11T01:54:39.527" Score="0" Body="&lt;p&gt;Basically, a stub area is a dead-end area. For instance, a stub are cannot be used as a transit for virtual links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 2328, OSPF Version 2, Section 3.6 Supporting stub areas&lt;/em&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;There are a couple of restrictions on the use of stub areas. Virtual&#xA;  links cannot be configured through stub areas.  In addition, AS&#xA;  boundary routers cannot be placed internal to stub areas.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cisco has a document, &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/7039-1.html#t31&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;OSPF Design Guide&lt;/em&gt;&lt;/a&gt;, that has a section on stub areas:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;An area could be qualified a stub when there is a single exit point&#xA;  from that area or if routing to outside of the area does not have to&#xA;  take an optimal path. The latter description is just an indication&#xA;  that a stub area that has multiple exit points, will have one or more&#xA;  area border routers injecting a default into that area. Routing to the&#xA;  outside world could take a sub-optimal path in reaching the&#xA;  destination by going out of the area via an exit point which is&#xA;  farther to the destination than other exit points.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Other stub area restrictions are that a stub area cannot be used as a&#xA;  transit area for virtual links. Also, an ASBR cannot be internal to a&#xA;  stub area. These restrictions are made because a stub area is mainly&#xA;  configured not to carry external routes and any of the above&#xA;  situations cause external links to be injected in that area. The&#xA;  backbone, of course, cannot be configured as stub.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;All OSPF routers inside a stub area have to be configured as stub&#xA;  routers. This is because whenever an area is configured as stub, all&#xA;  interfaces that belong to that area will start exchanging Hello&#xA;  packets with a flag that indicates that the interface is stub.&#xA;  Actually this is just a bit in the Hello packet (E bit) that gets set&#xA;  to 0. All routers that have a common segment have to agree on that&#xA;  flag. If they don't, then they will not become neighbors and routing&#xA;  will not take effect.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-11T01:54:39.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38830" PostTypeId="2" ParentId="35880" CreationDate="2017-02-11T04:39:05.303" Score="0" Body="&lt;p&gt;Your most likely getting beat up from the Internet.  My firewall is regularly scanned from multiple places.  Since it seems to be flooding your pipe, I would recommend looking at your firewall blocked log to see if you can identify the offending IP's.  If its one or 2, your ISP may be able to block that for you upstream to get that load off your connection.  &lt;/p&gt;&#xA;" OwnerUserId="34358" LastActivityDate="2017-02-11T04:39:05.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38831" PostTypeId="1" AcceptedAnswerId="38833" CreationDate="2017-02-11T07:55:51.690" Score="1" ViewCount="2762" Body="&lt;p&gt;Why is R1 giving these error messages?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP-EIGRP(Default-IP-Routing-Table:400): Neighbor 192.168.2.1 not on common subnet for FastEthernet1/0&#xA;&#xA;IP-EIGRP(Default-IP-Routing-Table:400): Neighbor 192.168.2.2 not on common subnet for FastEthernet1/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/acsi6.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/acsi6.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 is able to ping every router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configs:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 routing table&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     20.0.0.0/29 is subnetted, 1 subnets&#xA;D       20.20.20.0 [90/30720] via 192.168.1.2, 00:06:56, FastEthernet1/0&#xA;     10.0.0.0/29 is subnetted, 1 subnets&#xA;C       10.10.10.0 is directly connected, FastEthernet0/0&#xA;     192.168.1.0/29 is subnetted, 1 subnets&#xA;C       192.168.1.0 is directly connected, FastEthernet1/0&#xA;     192.168.2.0/29 is subnetted, 1 subnets&#xA;D       192.168.2.0 [90/30720] via 10.10.10.2, 00:06:56, FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;!&#xA;!&#xA;&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;! &#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.10.10.1 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 192.168.1.1 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router eigrp 400&#xA; network 10.10.10.0 0.0.0.7&#xA; network 192.168.1.0 0.0.0.7&#xA; no auto-summary&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;!&#xA;!&#xA;&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;! &#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 20.20.20.1 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 192.168.1.2 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router eigrp 400&#xA; network 20.20.20.0 0.0.0.7&#xA; network 192.168.1.0 0.0.0.7&#xA; no auto-summary&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R3&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;!&#xA;!&#xA;&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R3&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;! &#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.10.10.2 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 192.168.2.1 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router eigrp 400&#xA; network 10.10.10.0 0.0.0.7&#xA; network 192.168.2.0 0.0.0.7&#xA; no auto-summary&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R4&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;!&#xA;!&#xA;&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R4&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 5&#xA;no ip icmp rate-limit unreachable&#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;! &#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 20.20.20.2 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 192.168.2.2 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;router eigrp 400&#xA; network 20.20.20.0 0.0.0.7&#xA; network 192.168.2.0 0.0.0.7&#xA; no auto-summary&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="24668" LastActivityDate="2017-02-16T02:25:31.450" Title="EIGRP neighbor problem" Tags="|eigrp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38832" PostTypeId="1" CreationDate="2017-02-11T08:47:32.013" Score="1" ViewCount="600" Body="&lt;p&gt;I have this setup configured where an IPSEC tunnel is established between 10.15.10.2(ROUTER) and 10.16.70.2(LINUX machine) . Now I want pass traffic through the same tunnel from two more diffrent network ip's. So for that, i have created 3 VLAN interfaces so that  will make Feth1 as trunk mode but i was not able to use switchport command on that interface.&#xA;What other solution I can look for?&#xA;Router Device-Cisco 1800&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/kBg0L.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/kBg0L.png&quot; alt=&quot;Set up diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router COnfigurations&#xA;----------------------------&#xA;Building configuration...&#xA;&#xA;Current configuration : 7269 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname SYSTEM74&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;logging buffered 51200 warnings&#xA;!&#xA;no aaa new-model&#xA;clock timezone IST 5 30&#xA;!&#xA;crypto pki trustpoint TP-self-signed-3437774698&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-3437774698&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-3437774698&#xA;!&#xA;!&#xA;crypto pki certificate chain TP-self-signed-3437774698&#xA; certificate self-signed 01&#xA;  30820255 308201BE A0030201 02020101 300D0609 2A864886 F70D0101 04050030&#xA;  31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274&#xA;  69666963 6174652D 33343337 37373436 3938301E 170D3130 30323035 31323433&#xA;  31375A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649&#xA;  4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D33 34333737&#xA;  37343639 3830819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281&#xA;  81009569 6E1C913C A3678C3D 946ABFC9 51E4684F E0B528EC 8EACCF2D F17E99A9&#xA;  8BBE38C3 A9802B37 5DB22C30 36CBA715 2B342327 27C69124 8249C9B3 1D7A92E4&#xA;  BC59516B F1F7DCAF CBA322E0 E82E84AB 073ABAAB 0B4DA09D FA11B2E6 CC348931&#xA;  D0AC0ACC 2013BBF0 D6F51103 842EFD95 9161CC53 59AC40D4 2BDA2BC3 FF3D5C7F&#xA;  56C50203 010001A3 7D307B30 0F060355 1D130101 FF040530 030101FF 30280603&#xA;  551D1104 21301F82 1D535953 54454D37 342E6C61 622E696E 6469612E 61727961&#xA;  6B612E63 6F6D301F 0603551D 23041830 16801484 8473E828 8FCF6E76 EC899091&#xA;  44F750CB E00BDC30 1D060355 1D0E0416 04148484 73E8288F CF6E76EC 89909144&#xA;  F750CBE0 0BDC300D 06092A86 4886F70D 01010405 00038181 0035D6D9 BB2CC8B5&#xA;  E27D6DDF B13380EE DE61B886 0DE7661D A3799500 4CDAD07F A5F5E2AE 397897CE&#xA;  BB4138D8 6A3B062B B569A171 AB7BC9E6 6B88CB53 DB4277A0 11995570 0159AE7F&#xA;  1DE587B2 A52170FF 70551219 33AEDD58 238DD2B2 CFD553DF 5C14D9EA C38ED718&#xA;  52246C7B 3AAFB00F EA6E25B5 283D2F73 74243F36 A88F7BD1 DC&#xA;        quit&#xA;dot11 syslog&#xA;!&#xA;!&#xA;ip cef&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip name-server 172.16.1.20&#xA;ip name-server 172.16.1.39&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;vtp domain cisco&#xA;vtp mode transparent&#xA;username aryaka privilege 15 password 0 aryaka&#xA;!&#xA;!&#xA;crypto isakmp policy 1&#xA; encr aes&#xA; authentication pre-share&#xA; group 2&#xA; lifetime 3600&#xA;crypto isakmp key aryaka address 10.16.70.2&#xA;crypto isakmp key aryaka address 10.16.70.3&#xA;!&#xA;crypto isakmp peer address 10.16.70.2&#xA;!&#xA;crypto isakmp peer address 10.16.70.3&#xA;!&#xA;!&#xA;crypto ipsec transform-set strong esp-3des esp-md5-hmac&#xA;!&#xA;crypto map vpn 10 ipsec-isakmp&#xA; set peer 10.16.70.2&#xA; set peer 10.16.70.3&#xA; set transform-set strong&#xA; match address BP_HP&#xA;!&#xA;archive&#xA; log config&#xA;  hidekeys&#xA;!&#xA;!&#xA;vlan 100,110,150,160,210,250,260&#xA;!&#xA;!&#xA;class-map match-all class1&#xA; match any&#xA;!&#xA;!&#xA;policy-map policy1&#xA; class class1&#xA;  set dscp af31&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback1&#xA; ip address 192.168.74.2 255.255.255.255&#xA;!&#xA;interface Tunnel1&#xA; description Tunnel1&#xA; ip address 1.1.1.74 255.255.255.0&#xA; keepalive 10 3&#xA; tunnel source Loopback1&#xA; tunnel destination 192.168.75.2&#xA;!&#xA;interface Tunnel2&#xA; ip address 3.3.3.3 255.255.255.0&#xA; tunnel source Loopback1&#xA; tunnel destination 192.168.76.1&#xA;!&#xA;interface FastEthernet0&#xA; ip address 172.19.8.74 255.255.254.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1&#xA; ip address 10.15.10.2 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA; vlan-range dot1q 209 261&#xA;  exit-vlan-config&#xA; !&#xA; crypto map vpn&#xA; service-policy output policy1&#xA;!&#xA;interface BRI0&#xA; no ip address&#xA; encapsulation hdlc&#xA; shutdown&#xA;!&#xA;interface FastEthernet2&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet3&#xA; switchport access vlan 160&#xA;!&#xA;interface FastEthernet4&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet5&#xA;!&#xA;interface FastEthernet6&#xA;!&#xA;interface FastEthernet7&#xA; switchport access vlan 110&#xA;!&#xA;interface FastEthernet8&#xA; switchport access vlan 110&#xA;!&#xA;interface FastEthernet9&#xA; switchport access vlan 110&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan110&#xA; ip address 10.20.10.1 255.255.255.0&#xA;!&#xA;interface Vlan100&#xA; no ip address&#xA;!&#xA;interface Vlan160&#xA; ip address 10.20.60.3 255.255.255.0&#xA;!&#xA;interface Vlan150&#xA; ip address 10.20.50.3 255.255.255.0&#xA;!&#xA;interface Vlan260&#xA; ip address 10.15.60.2 255.255.255.0&#xA;!&#xA;interface Vlan250&#xA; ip address 10.15.50.2 255.255.255.0&#xA;!&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 172.19.8.1&#xA;ip route 10.5.20.0 255.255.255.0 Tunnel2&#xA;ip route 10.15.0.0 255.255.0.0 FastEthernet1&#xA;ip route 10.16.70.0 255.255.255.0 10.15.10.1&#xA;ip route 10.20.30.0 255.255.255.0 Tunnel1&#xA;ip route 10.20.50.0 255.255.255.0 Tunnel1&#xA;ip route 10.20.60.0 255.255.255.0 Tunnel1&#xA;ip route 10.20.60.0 255.255.255.0 10.20.10.2&#xA;ip route 10.32.201.2 255.255.255.255 10.15.10.1&#xA;ip route 192.168.75.2 255.255.255.255 10.15.10.1&#xA;ip route 192.168.76.1 255.255.255.255 10.15.10.1&#xA;!&#xA;!&#xA;ip http server&#xA;ip http access-class 23&#xA;ip http authentication local&#xA;ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;!&#xA;ip access-list extended BP_HP&#xA; permit gre host 192.168.74.2 host 192.168.75.2&#xA; permit gre host 192.168.74.2 host 192.168.76.1&#xA; permit gre host 192.168.74.2 host 10.32.201.2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;banner exec ^C&#xA;% Password expiration warning.&#xA;-----------------------------------------------------------------------&#xA;&#xA;Cisco Router and Security Device Manager (SDM) is installed on this device and&#xA;it provides the default username &quot;cisco&quot; for  one-time use. If you have already&#xA;used the username &quot;cisco&quot; to login to the router and your IOS image supports the&#xA;&quot;one-time&quot; user option, then this username has already expired. You will not be&#xA;able to login to the router with this username after you exit this session.&#xA;&#xA;It is strongly suggested that you create a new username with a privilege level&#xA;of 15 using the following command.&#xA;&#xA;username &amp;lt;myuser&amp;gt; privilege 15 secret 0 &amp;lt;mypassword&amp;gt;&#xA;&#xA;Replace &amp;lt;myuser&amp;gt; and &amp;lt;mypassword&amp;gt; with the username and password you want to&#xA;use.&#xA;&#xA;-----------------------------------------------------------------------&#xA;^C&#xA;banner login ^C&#xA;-----------------------------------------------------------------------&#xA;Cisco Router and Security Device Manager (SDM) is installed on this device.&#xA;This feature requires the one-time use of the username &quot;cisco&quot;&#xA;with the password &quot;cisco&quot;. The default username and password have a privilege level of 15.&#xA;&#xA;Please change these publicly known initial credentials using SDM or the IOS CLI.&#xA;Here are the Cisco IOS commands.&#xA;&#xA;username &amp;lt;myuser&amp;gt;  privilege 15 secret 0 &amp;lt;mypassword&amp;gt;&#xA;no username cisco&#xA;&#xA;Replace &amp;lt;myuser&amp;gt; and &amp;lt;mypassword&amp;gt; with the username and password you want to use.&#xA;&#xA;For more information about SDM please follow the instructions in the QUICK START&#xA;GUIDE for your router or go to http://www.cisco.com/go/sdm&#xA;-----------------------------------------------------------------------&#xA;^C&#xA;!&#xA;line con 0&#xA; login local&#xA;line aux 0&#xA;line vty 0 4&#xA; session-timeout 15&#xA; access-class 23 in&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; login local&#xA; transport input telnet ssh&#xA;line vty 5 15&#xA; access-class 23 in&#xA; privilege level 15&#xA; login local&#xA; transport input telnet ssh&#xA;!&#xA;ntp clock-period 17180293&#xA;ntp server 172.17.1.1 prefer&#xA;end&#xA;&#xA;SYSTEM74#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34361" LastEditorUserId="34361" LastEditDate="2017-02-14T03:45:27.710" LastActivityDate="2017-02-14T03:45:27.710" Title="i want to pass the traffic vlan traffic through already established IPSec tunel" Tags="|router|ipsec|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38833" PostTypeId="2" ParentId="38831" CreationDate="2017-02-11T10:58:16.677" Score="1" Body="&lt;p&gt;EDIT: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP uses multicast hello packets in order to communicate to other EIGRP neighbors. EIGRP generates the not on common subnet error message when it receives an EIGRP hello packet sourced from an IP address on a subnet that is not configured on its receiving interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are the general cause for this error message:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Misconfiguration of the interfaces or switch ports or cabling&#xA;problem.&lt;/li&gt;&#xA;&lt;li&gt;Mismatch of primary/secondary IP addresses on the neighbor interface.&lt;/li&gt;&#xA;&lt;li&gt;A switch/hub is leaking multicast packets to other ports.&lt;/li&gt;&#xA;&lt;li&gt;If using a LAN switch, the vlans may have joined routers together.&lt;/li&gt;&#xA;&lt;li&gt;Another router uses EIGRP advertising on the same subnet/vlan as this&#xA;router and is misconfigured with an incorrect AS number.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In order to troubleshoot this issue, check these items:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Verify that the cable is connected correctly.&lt;/li&gt;&#xA;&lt;li&gt;Double-check the interface configuration for misconfigured IP&#xA;addresses on the local and neighboring routers.&lt;/li&gt;&#xA;&lt;li&gt;Verify that the primary address of the interface is in the same&#xA;subnet as the primary address of the neighbor router.&lt;/li&gt;&#xA;&lt;li&gt;If the EIGRP neighbor connection is joined via a LAN hub, use&#xA;separate hubs in order to break up the broadcast domain for each&#xA;logical LAN segment, or configure no eigrp log-neighbor-warnings to&#xA;eliminate the errors.&lt;/li&gt;&#xA;&lt;li&gt;If there is a switch involved, check the switch configuration to make&#xA;sure different LAN segments are not configured to be in the same VLAN&#xA;that share the same broadcast domain.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I would suggest check physical connection and configuration.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-11T18:25:07.320" LastActivityDate="2017-02-11T18:25:07.320" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38834" PostTypeId="2" ParentId="38832" CreationDate="2017-02-11T12:28:40.247" Score="2" Body="&lt;p&gt;You can use OTV, L2TP or VXLAN.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-13T15:01:20.873" LastActivityDate="2017-02-13T15:01:20.873" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38835" PostTypeId="1" CreationDate="2017-02-11T12:38:43.640" Score="0" ViewCount="173" Body="&lt;p&gt;During Congestion in a network switch HW ,for examplewhen  a shaping rate to the interface that imposes a speed limit lower than the maximum interface line speed .&#xA;The concept of back pressure is applied . Who back pressures whom and what is the exact behavior inside the network transmit queue.&lt;/p&gt;&#xA;" OwnerUserId="34364" LastActivityDate="2017-02-12T03:18:36.057" Title="What exactly happens in the queues when a congested network applies back pressure ?" Tags="|qos|" AnswerCount="2" CommentCount="2" ClosedDate="2017-02-12T16:02:15.760" ContentLicense="CC BY-SA 3.0" />
  <row Id="38836" PostTypeId="1" AcceptedAnswerId="38838" CreationDate="2017-02-11T13:01:33.613" Score="0" ViewCount="479" Body="&lt;p&gt;I want to set up a &lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-routers/336-cisco-router-8021q-router-stick.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&quot;router on stick&quot;&lt;/a&gt; configuration in my home network. I have a very basic wireless router (DLink DIR-836L ) that connects to the cable modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I connect this router to a managed switch (CISCO 2950) and create VLANS?. From my research it appears that routers need to support certain protocols (VTP, dotq11) to work with VLANS, is that true? &lt;/p&gt;&#xA;" OwnerUserId="34366" LastActivityDate="2017-02-11T13:35:46.733" Title="Router requirements for VLANS" Tags="|switch|router|vlan|" AnswerCount="2" CommentCount="1" ClosedDate="2017-02-11T16:59:53.020" ContentLicense="CC BY-SA 3.0" />
  <row Id="38837" PostTypeId="2" ParentId="38836" CreationDate="2017-02-11T13:26:24.197" Score="0" Body="&lt;p&gt;That's correct you need to have support of dot1q on Dlink to be able implement router on stick. Ideal solution would be intervlan routing on switch but yours 2950 is layer 2 device, router on the stick isn't preffered solution.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-11T13:26:24.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38838" PostTypeId="2" ParentId="38836" CreationDate="2017-02-11T13:29:46.517" Score="0" Body="&lt;p&gt;If you want your VLANS to talk to each other and the Internet then you need something that can route between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few ways this can be set up. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;have a separate interface on the router for each VLAN. In this case you would need a router that can support multiple independent lan-side interfaces.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;have the router do 802.1q. In this case your router would need to support 802.1q virtual interfaces.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;have a layer 3 capable switch handle the routing between the VLANs and use the router for external routing only. The router would then have a static route configured to tell it to send all traffic for other vlans to the switch while the L3 switch would have it's default gateway pointing at the router..&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Looking at the manual for your router I belive options 1 and 2 are not possible with your current router but option 3 looks doable.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-02-11T13:35:46.733" LastActivityDate="2017-02-11T13:35:46.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38839" PostTypeId="2" ParentId="38835" CreationDate="2017-02-11T13:35:33.703" Score="-1" Body="&lt;p&gt;In IP world Explicit Congestion Notification would kick in.&#xA;All about ECN you can find in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3168&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC3168&lt;/a&gt; or &lt;a href=&quot;https://en.wikipedia.org/wiki/Explicit_Congestion_Notification&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-02-11T13:35:33.703" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38840" PostTypeId="1" CreationDate="2017-02-11T13:39:42.417" Score="2" ViewCount="1034" Body="&lt;p&gt;I’ve been going round in circles for the last few days trying to accomplish this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’ve not had much experience with cisco routers, this is a ASA 5510 running 8.2 (old command structure).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a nutshell I want to translate a LAN request for one of our external ips to the internal webserver (I think this is also called hair pinning).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have a block of 8 external IP’s&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.i.i.97, 98, 99, 100, 101, 102, 210, 211&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our interface running config is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;interface Ethernet0/0&#xA;nameif OUTSIDE&#xA; security-level 0&#xA; ip address 213.106.251.100 255.255.255.248 &#xA;!&#xA;interface Ethernet0/1&#xA; nameif INSIDE&#xA; security-level 100&#xA; ip address 10.22.16.25 255.255.240.0 &#xA;!&#xA;interface Ethernet0/2&#xA; no nameif&#xA; security-level 50&#xA; no ip address&#xA;!&#xA;interface Ethernet0/2.23&#xA; vlan 23&#xA; nameif GuestWireless&#xA; security-level 10&#xA; ip address 172.22.225.1 255.255.255.0 &#xA;!&#xA;interface Ethernet0/3&#xA; shutdown&#xA; no nameif&#xA; no security-level&#xA; no ip address&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the inside I have a server on 10.22.16.34 which I want to expose ports 21, 80, 8000, 8082 to internet clients.  However I need internal LAN clients when requesting the external IP i.i.i.98 to be redirected to 10.22.16.34&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’ve tried lots of guides but run into problems each time, I would be very grateful for some guidance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="34368" LastEditorUserId="29518" LastEditDate="2017-02-11T16:57:33.713" LastActivityDate="2018-02-08T01:33:26.660" Title="Cisco ASA 5510 IP Hairpin NAT" Tags="|cisco|cisco-asa|ip|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38841" PostTypeId="1" CreationDate="2017-02-11T14:09:03.277" Score="0" ViewCount="102" Body="&lt;p&gt;One of the issues with phase 2 is doing summarization at the hub for the other spoke networks. Currently, the spokes are summarizing their own networks via EIGRP to the hub and the hub is then re-advertising this summary route to the remaining spokes. In phase 3, I will do all of the summarizing at the hub, but I'm not seeing that as a huge benefit compared to the spokes doing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any issues with doing the summarization at the spokes in phase 2? What are the benefit of having the hub do summarization in phase 3 compared to the spokes doing summarization in phase 2? To me, it looks like its accomplishing the same goal. I feel like there is something that I'm not realizing here.&lt;/p&gt;&#xA;" OwnerUserId="30010" LastActivityDate="2017-04-12T16:26:19.683" Title="DMVPN Phase 2 question" Tags="|cisco|routing|vpn|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38842" PostTypeId="2" ParentId="38840" CreationDate="2017-02-11T14:21:41.373" Score="0" Body="&lt;p&gt;It could look as below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;your default dynamic PAT for LAN users to access internet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global (outside) 1 interface&#xA;nat (inside) 1 10.22.16.0 255.255.240.0&#xA;nat (inside) 1 172.22.225.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Than Static NAT for server:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static (inside,outside) [PUBLICIP] [INTERNALIP] netmask 255.255.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You need enable same security interface traffic:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;same-security-traffic permit intra-interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Than another nat inside to inside:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static (inside,inside) [PUBLICIP] 10.22.16.0 netmask 255.255.240.0&#xA;static (inside,inside) [PUBLICIP] 172.22.225.0 netmask 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and just add:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;global (inside) 1 interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That's should be pretty much all. Don't have device on 8.2 to test it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may want to check out &lt;a href=&quot;http://www.firewall.cx/cisco-technical-knowledgebase/cisco-firewalls/1150-cisco-asa-firewall-nat-reflection-loopback-hairpinning-configuration.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; or &lt;a href=&quot;http://mike-knight.blogspot.co.uk/2012/10/asa-82-and-hairpin-nat.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; post.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-11T14:41:23.263" LastActivityDate="2017-02-11T14:41:23.263" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38843" PostTypeId="2" ParentId="38841" CreationDate="2017-02-11T15:10:36.980" Score="1" Body="&lt;p&gt;Mr. Robot&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMHO Only while your DMVPN is part of your bigger network I can see point of doing summarization at hub. Unskilled summarization at hub could create many issues and pretty much destroy DMVPN for example you can break spoke to spoke traffic flow. While summarizing at hub you need to take into account split horizon and next hop for EIGRP.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-11T15:16:48.720" LastActivityDate="2017-02-11T15:16:48.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38845" PostTypeId="2" ParentId="38832" CreationDate="2017-02-11T16:52:09.907" Score="0" Body="&lt;p&gt;Why are you looking to make a trunk port on your router? If you want traffic from other vlans to cross the tunnel you will need to modify the Crypto ACL on both sides of the tunnel to reflect those vlans.&lt;/p&gt;&#xA;" OwnerUserId="33610" LastActivityDate="2017-02-11T16:52:09.907" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38846" PostTypeId="1" CreationDate="2017-02-11T17:19:38.717" Score="1" ViewCount="114" Body="&lt;p&gt;My problem, I have a hotel in a remote area, with many guests and a lot of Internet use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to use Internet from different sources and combine it to increase the total network speed? Maybe using a network switch to direct traffic needs? &lt;/p&gt;&#xA;" OwnerUserId="34373" LastActivityDate="2017-08-13T15:40:55.310" Title="Is it possible to create a collaborative network?" Tags="|hardware|" AnswerCount="5" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38847" PostTypeId="2" ParentId="38846" CreationDate="2017-02-11T17:33:57.910" Score="3" Body="&lt;p&gt;There are a lot of solutions on market. I would check if any of your local ISPs support line bonding. That would be ideal option. &lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="8499" LastEditDate="2017-02-12T03:51:32.443" LastActivityDate="2017-02-12T03:51:32.443" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38850" PostTypeId="1" CreationDate="2017-02-11T18:53:37.923" Score="2" ViewCount="213" Body="&lt;p&gt;Let's say that the professional business router is connected to the Internet through the WAN port and has some devices in the office connected through the other ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devices in the office building have internal IP addresses and only the router has an external IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can it be said that the router performs actual routing or only does NAT?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It does not seem that the router performs any routing at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devices in the office have only internal IP addresses and inside the business there is no subnet, so the user only has one external IP address which is take by the router's external connection to the Internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is it an exaggeration to say that a business router for an office is a router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do most business routers have the actual capability to even do routing or they can only do NAT?&lt;/p&gt;&#xA;" OwnerUserId="23730" LastEditorUserId="8499" LastEditDate="2017-02-11T21:12:54.697" LastActivityDate="2021-01-05T13:43:43.160" Title="Does a Business Router from an ISP perform actual routing or only Network Address Translation (NAT)?" Tags="|routing|router|nat|subnet|internet|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38851" PostTypeId="2" ParentId="38850" CreationDate="2017-02-11T18:57:19.780" Score="4" Body="&lt;p&gt;Of course it does, it route packets from A to B. Usually home routers only have a default route, but this doesn't mean that they don't route packets. Their routing table is just smaller with one default route and few directly connected interfaces.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-11T18:59:02.087" LastActivityDate="2017-02-11T18:59:02.087" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38852" PostTypeId="1" AcceptedAnswerId="38854" CreationDate="2017-02-11T20:01:59.590" Score="3" ViewCount="2577" Body="&lt;p&gt;I've got a terrible doubt that does not let me sleep for last few days. I have a network with different bandwidth interfaces (&lt;code&gt;Gi0/2&lt;/code&gt; and &lt;code&gt;F0/2&lt;/code&gt;). The interfaces to which I'm referring are the ones inside the blue &quot;circle&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the cost for &lt;code&gt;Gi0/2&lt;/code&gt; is &lt;code&gt;4&lt;/code&gt;, and the cost for &lt;code&gt;Fa0/2&lt;/code&gt; is &lt;code&gt;19&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is that I need to get the cost of that segment, but I'm really confused because I don't really know whether i make the sum of the 2 values. I mean &lt;code&gt;4 + 19 = 23&lt;/code&gt; as the cost of the link, or I assume that the cost is the biggest value of both interfaces. For example, in this case would be &lt;code&gt;Fa0/2&lt;/code&gt; be a cost of &lt;code&gt;19&lt;/code&gt;, or if a take the cost of each one as separate value. For example, if I'm referring to Switch 2, do I take the cost of &lt;code&gt;4&lt;/code&gt; because of &lt;code&gt;Gi0/2&lt;/code&gt; by default?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can´t sleep because im trying to get certified, but I don't know how this concept works for STP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If someone can help me i will appreciate it a lot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/S9FdE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/S9FdE.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31658" LastEditorUserId="8499" LastEditDate="2017-02-11T23:09:24.863" LastActivityDate="2019-07-05T12:00:35.963" Title="Path cost between a different bandwidth interface in STP" Tags="|cisco|spanning-tree|" AnswerCount="5" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38853" PostTypeId="1" AcceptedAnswerId="38855" CreationDate="2017-02-11T20:10:57.360" Score="2" ViewCount="1945" Body="&lt;p&gt;&lt;strong&gt;Quick question for a network ninja....&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say I have four sub-interfaces on a router (not a layer 3 switch).  Each interface has already been configured and each sub-int is a /23.  Now, the parent interface isn't configured.  There isn't an IP address configured at all.  I want to know if I can get away with making the parent int a /24 on a totally different subnet since the sub-ints aren't actually part of the parent int network.  Not sure if I'm making sense so I will show...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Say these are the sub-interfaces:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-interface FastEthernet1/0.10 &#xA;-description FacultyVLAN&#xA;-encapsulation dot1Q 10&#xA;-ip address 10.10.10.1 255.255.254.&#xA;&#xA;-interface FastEthernet1/0.20&#xA;-description AdministrativeVLAN&#xA;-encapsulation dot1Q 20&#xA;-ip address 10.10.12.1 255.255.254.0&#xA;&#xA;-interface FastEthernet1/0.30&#xA;-description InstructionalVLAN&#xA;-encapsulation dot1Q 30&#xA;-ip address 10.10.14.1 255.255.254.0&#xA;&#xA;-interface FastEthernet1/0.40&#xA;-description ServerVLAN&#xA;-encapsulation dot1Q 40&#xA;-ip address 10.10.16.1 255.255.254.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Am I ok to set the parent FastEthernet port as 10.10.18.1/24?  From my understanding the parent interface at this point is only serving as the gateway for those SVIs to get, correct.  Need a little help with understanding.  Cheers mates!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just want to make sure that I'm going about this the right way.  Cheers!&lt;/p&gt;&#xA;" OwnerUserId="34376" LastEditorUserId="34376" LastEditDate="2017-02-11T20:40:44.393" LastActivityDate="2021-01-07T14:45:49.100" Title="Parent Interfaces and Sub-interfaces" Tags="|cisco|routing|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38854" PostTypeId="2" ParentId="38852" CreationDate="2017-02-11T20:21:33.257" Score="3" Body="&lt;p&gt;An ethernet connection such as you describe will only connect at 100 Mbps (FastEthernet). You are incorrect that the cost of &lt;code&gt;G0/2&lt;/code&gt; is &lt;code&gt;4&lt;/code&gt; because it connects at 100 Mbps, then the cost is &lt;code&gt;19&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For STP, a switch looks at the cost on its interface for the link because the cost of a link is the same on both ends, there is only one cost for the link. You only add costs for multiple links to the root.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-11T20:21:33.257" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38855" PostTypeId="2" ParentId="38853" CreationDate="2017-02-11T20:29:05.657" Score="2" Body="&lt;p&gt;Each interface, including logical interfaces, e.g. subinterfaces, is a separate interface, and it is configured independently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, with subinterfaces for a LAN, you will use 802.1Q encapsulation, and that places each interface in a different VLAN. The physical interface will be in its own VLAN. VLANs can have completely different addresses and masks, independent of any other interface configuration..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is a WAN interface with something like frame relay, each interface, or subinterface, will have its own DLCI, and those logical links will each have their own IP addresses and masks, independent of any other interface configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, yes, you can configure the physical interface with a different address mask, as long as it doesn't overlap with any already configured network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-11T20:29:05.657" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38856" PostTypeId="2" ParentId="38852" CreationDate="2017-02-11T20:31:07.940" Score="3" Body="&lt;p&gt;The cost is decided on the bandwidth of the link (cable). &#xA;Now it is highly unlikely that the same cable will have different speeds at different ends.&#xA;The speed of the wire is always the same.&#xA;the speed is modulated through switch NIC interfaces.&#xA;But as we are talking about STP here, I dont think there is any need for the switch to change/set speeds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Long story short you can have only one speed per link and thus one cost per link.&#xA;If the link is 100 mbps, the cost will be 19, regardless which switch you measure from .&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-02-11T20:31:07.940" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38857" PostTypeId="2" ParentId="38852" CreationDate="2017-02-11T20:58:40.130" Score="0" Body="&lt;p&gt;STP has no concept of &quot;&lt;em&gt;cost of segment&lt;/em&gt;&quot;. STP convergence is 3 steps process:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Choosing root switch with better BID(lowest is better). Root switch will sends hello bpdu out of all his ports. In your scenario, SW2 will be root switch because he has BID of 8192 and he will sends hello bpdu out of Gi0/2 and Gi0/3 interfaceses with zero cost(because he is root).&lt;/li&gt;&#xA;&lt;li&gt;Each non-root switch chooses one root port(port that has lowest cost to the root). In your scenario you have only 1 non-root switch, SW3. SW3's root port is Gi0/3 because he has cost of 4(he receives bpdu hello from root with 0 cost and then adds his Gi0/3 cost of 4, so summary cost is 0+4=4).&lt;/li&gt;&#xA;&lt;li&gt;On each segment STP needs to choose one designated port(port that advertises lowest-cost hello onto a segment). In your scenario on serment SW2(Gi0/2) &amp;lt;--&gt; SW3(Fa0/2), SW2's Gi0/2 it's designated port, because all root's ports are designated. So SW3's Fa0/2 will be in blocked state, because he is not root port or designated port. By the way, untill blocked, SW3's Fa0/2 will sends bpdu with cost of 23 on that segment(because default FastEthernet cost for stp is 19 plus 4 of SW3's Gi0/3 = 23).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Although this is not essential in this scenario, don't forget about autonegotiation rule that tells that SW2's Gi0/2 will works as FastEthernet port at 100Mbit/s.&lt;/p&gt;&#xA;" OwnerUserId="34301" LastActivityDate="2017-02-11T20:58:40.130" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38858" PostTypeId="2" ParentId="38846" CreationDate="2017-02-11T21:06:26.287" Score="0" Body="&lt;p&gt;As @datagram network pointed out there are several ways to do this.&#xA;One of them might be to use just a single ISP and request a very high bandwidth add various access points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Else you can subscribe to multiple ISP's i.e get multiple addresses for yourself and then divide the use among people eg. management and customer.&#xA;This would also ensure reliability in case of connection failure from one ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another not so good approach would be reduce the speed of the router links such that no particular set of users thwart the entire bandwidth &lt;/p&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="30735" LastEditDate="2017-02-12T00:23:55.570" LastActivityDate="2017-02-12T00:23:55.570" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38859" PostTypeId="2" ParentId="38850" CreationDate="2017-02-11T21:11:33.223" Score="1" Body="&lt;p&gt;Of course business routers route. A router routes between networks, so every interface on a router is in a different network, even logical interfaces you may have created while configuring the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT is something completely different. NAT is a kludge that was created to try to conserve IPv4 addresses until IPv6 becomes ubiquitous. NAT breaks the IP promise of a unique IP address for every device, and end-to-end connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN routers are often a convenient place to do NAT, but that is not always the case. Many businesses own blocks of public IPv4 addresses, and the WAN routers inside and outside addresses are public addresses, with NAT taking place on an internal firewall or proxy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most businesses probably have multiple networks on the inside of the business, and many have a mixture of public and private addressing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-11T21:11:33.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38860" PostTypeId="2" ParentId="38850" CreationDate="2017-02-11T21:20:15.200" Score="0" Body="&lt;p&gt;yes, it does&#xA;I encourage you to read private and public address space to get an idea on the need for NATing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically when you send a packet from your host to the router its a part on NATing (if necessary). The router sends it to the web servers passing through various networks and geographical area. This uses routing protocols and is a part of routing.&#xA;The server will respond to your packet and send it back to the router at your home. This is again routing. the router finally sends the received packet back to your host system using NAT if necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NATing bacame necessary due to shortage of address space in IPv4 and happens on the LAN side of the network &lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-02-11T21:20:15.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38862" PostTypeId="2" ParentId="38835" CreationDate="2017-02-12T03:18:36.057" Score="2" Body="&lt;p&gt;As mentioned, ECN provides an explicit means @ L3 for a signaling of link congestion.  On certain L2 transports there are also mechanisms that can be engaged when buffers fill - in frame relay there's the BECN/FECN mechanism.  In certain flavors of ATM (read: ABR) there's a live feedback mechanism to both signal congestion and even adjust provisioned PVC levels.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also flow control mechanisms in traditional Ethernet - 802.3x.  This is a MAC-layer mechanism that can be issued that will halt all traffic until the pause status is lifted.  This is most commonly seen nowadays in certain storage appliances.  As above, though, this is strictly a L2 construct and only operates on a hop-by-hop basis.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In modern Ethernet - very specifically the suite of protocols known as DCB (Data Center Bridging) there are mechanisms to both segregate different types of traffic into different forwarding queues (most crucially to identify lossless traffic - generally FCoE) as well as specific control messages sent at MAC layer to turn on flow control on a per-queue basis.  The idea here is to proactively pause traffic for queues that can tolerate loss, thus protecting lossless traffic.  The mechanism by which this operates is similar to 802.3x but is, in practice, massively more useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally - at L4 - TCP is probably overwhelmingly the most common point at which flow control and back-pressure occurs.  The mechanism here, of course, is sliding window.  When congestion occurs and packets are dropped TCP will adapt the rate at which packets are retransmitted (and, in turn, the rate at which subsequent data is sent).  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-12T03:18:36.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38863" PostTypeId="2" ParentId="38852" CreationDate="2017-02-12T06:01:30.270" Score="3" Body="&lt;p&gt;SW3 receives the same computed value from SW2 via the two links.  When performing its own calculation it will add the &lt;em&gt;locally determined&lt;/em&gt; value for its respective links.  It doesn't need to know what &lt;em&gt;any&lt;/em&gt; of SW2's link bandwidths may be - including the links it has to SW3. &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-12T06:01:30.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38865" PostTypeId="1" AcceptedAnswerId="38866" CreationDate="2017-02-12T10:34:49.540" Score="0" ViewCount="977" Body="&lt;p&gt;I have the following topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ssKfU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;Topology&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I intend to build this network with the PC acting as a DHCP server and multiple IP-enabled custom development boards connected to the switch and some connected to each other for network redundancy. By design, each dev board has two Ethernet ports and retransmits data received on a port to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am worried that the connections between the dev boards could generate loops. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Can this topology be used without existing the risk of loops appearing? How? Does the switch automatically recognize the connected devices (MACs) and avoids loops?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="34389" LastEditorUserId="34389" LastEditDate="2017-02-12T10:47:30.093" LastActivityDate="2017-02-12T11:08:25.210" Title="Is this topology loop free?" Tags="|switch|topology|loop|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38866" PostTypeId="2" ParentId="38865" CreationDate="2017-02-12T10:58:25.460" Score="2" Body="&lt;p&gt;Switch uses Layer 2 Spanning Tree Protocol to ensures a loop free topology for any bridged Ethernet network. So if yours IOT device will forward bridge protocol data unit (BPDU) accross, switch will maintain loop free topology. BPDU are transsmited accross local network to detect loops in network topologies. If BPDU won't be forwarded you can possibly have a loop. But effect of STP could be something like on this picture.&lt;a href=&quot;https://i.stack.imgur.com/8Uill.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8Uill.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So two IOT boards would be able only to talk with DHCP server thru another IOT board.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-12T11:08:25.210" LastActivityDate="2017-02-12T11:08:25.210" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="38869" PostTypeId="1" CreationDate="2017-02-12T15:13:20.737" Score="0" ViewCount="133" Body="&lt;p&gt;I've run into this config on Cisco firewall:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;nat (IFNAME1) 99 0.0.0.0 0.0.0.0 outside&lt;/p&gt;&#xA;&#xA;&lt;p&gt;global (IFNAME2) 99 100.100.100.100 netmask 255.255.255.255&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like an ok PAT config that would translate IP address of packets coming on interface IFNAME1 then they go out through IFNAME2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could someone explain to me what does the keyword &quot;outside&quot; at the end of 1st line nat statement mean? Because all the examples I've found online do not have this &quot;outside&quot; keyword. Maybe it allows reverse translation if packets would come to IFNAME2?&lt;/p&gt;&#xA;" OwnerUserId="34394" LastEditorUserId="34394" LastEditDate="2017-02-12T19:00:54.720" LastActivityDate="2017-02-14T16:30:36.170" Title="Cisco PIX PAT config" Tags="|cisco|firewall|pix|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38871" PostTypeId="2" ParentId="38869" CreationDate="2017-02-12T15:38:26.213" Score="1" Body="&lt;p&gt;It's NAT to outside interface. So all packets would be rewritten with IP assigned to outside interface. &lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-12T15:38:26.213" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38874" PostTypeId="1" AcceptedAnswerId="38880" CreationDate="2017-02-12T17:31:49.853" Score="2" ViewCount="521" Body="&lt;p&gt;I've been doing some work on the Juniper SRX210 firewalls/routers, and I have been making progress in learning the ins and outs of the OS, but I am having a bit of an issue with BGP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I currently have the two SRXs connected via &lt;code&gt;ge-0/0/0&lt;/code&gt;, both configured for inet on the &lt;code&gt;10.0.0.0/24&lt;/code&gt; subnet. I also created a static route (unnecessary here), just in case. I can ping in both directions. I also created some loopback addresses on one of the SRXs (lets call it SRX2). I want to export those addresses via BGP to the other SRX (SRX1).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To avoid confusion, I created my security zones and policy settings with basically an all allow setup because I don't want to introduce security yet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My issue is that I am stuck in the BGP connect state (occasionally goes into active), and I can't seem to get it established. I am wondering if there is some security setting that I left in there that would block me?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 11.4R5.5;&#xA;system {&#xA;    host-name SRX210Bottom;&#xA;    root-authentication {&#xA;        encrypted-password &quot;$1$P1EoZ8l8$kDeaHpuxfNAhza8Z.5jsz/&quot;; ## SECRET-DATA&#xA;    }&#xA;    name-server {&#xA;        208.67.222.222;&#xA;        208.67.220.220;&#xA;    }&#xA;    services {&#xA;        ssh;&#xA;        telnet;&#xA;        xnm-clear-text;&#xA;        web-management {&#xA;            http {&#xA;                interface vlan.0;&#xA;            }&#xA;            https {&#xA;                system-generated-certificate;&#xA;                interface vlan.0;&#xA;            }&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        archive size 100k files 3;&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any critical;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands error;&#xA;        }&#xA;    }&#xA;    max-configurations-on-flash 5;&#xA;    max-configuration-rollbacks 5;&#xA;    license {&#xA;        autoupdate {&#xA;            url https://ae1.juniper.net/junos/key_retrieval;&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0;&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.0.0.2/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    fe-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    fe-0/0/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    fe-0/0/4 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    fe-0/0/5 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    fe-0/0/6 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    fe-0/0/7 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    lo0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 20.0.0.2/24;&#xA;                address 30.0.0.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop 10.0.0.1;&#xA;    }&#xA;    aggregate {&#xA;        route 30.0.0.0/16;&#xA;    }&#xA;    router-id 10.0.0.2;&#xA;    autonomous-system 65503;&#xA;}&#xA;protocols {&#xA;    bgp {&#xA;        group external-peers {&#xA;            type external;&#xA;            local-address 10.0.0.2;&#xA;            import bgp-import-all;&#xA;            export bgp-export-local;&#xA;            peer-as 65501;&#xA;            local-as 65503;&#xA;            neighbor 10.0.0.1;&#xA;        }&#xA;    }&#xA;}&#xA;policy-options {&#xA;    policy-statement bgp-export-local {&#xA;        term 1 {&#xA;            from {&#xA;                route-filter 20.0.0.0/24 exact;&#xA;            }&#xA;            then accept;&#xA;        }&#xA;        term 2 {&#xA;            from protocol aggregate;&#xA;            then accept;&#xA;        }&#xA;    }&#xA;    policy-statement bgp-import-all {&#xA;        term 1 {&#xA;            from {&#xA;                protocol bgp;&#xA;                route-filter 0.0.0.0/0 orlonger;&#xA;            }&#xA;            then accept;&#xA;        }&#xA;    }&#xA;}&#xA;security {&#xA;    policies {&#xA;        from-zone internal to-zone internal {&#xA;            policy allow-all {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    zones {&#xA;        security-zone internal {&#xA;            address-book {&#xA;                address network_mine 10.0.0.0/24;&#xA;                address network_loopback 20.0.0.0/24;&#xA;            }&#xA;            interfaces {&#xA;                ge-0/0/1.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            ping;&#xA;                            ssh;&#xA;                            all;&#xA;                        }&#xA;                    }&#xA;                }&#xA;                lo0.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            ping;&#xA;                            ssh;&#xA;                            all;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;version 10.4R3.4;&#xA;system {&#xA;    host-name SRX210Top;&#xA;    root-authentication {&#xA;        encrypted-password &quot;$1$P1EoZ8l8$kDeaHpuxfNAhza8Z.5jsz/&quot;; ## SECRET-DATA&#xA;    }&#xA;    name-server {&#xA;        208.67.222.222;&#xA;        208.67.220.220;&#xA;    }&#xA;    services {&#xA;        ssh;&#xA;        telnet;&#xA;        xnm-clear-text;&#xA;        web-management {&#xA;            http {&#xA;                interface vlan.0;&#xA;            }&#xA;            https {&#xA;                system-generated-certificate;&#xA;                interface vlan.0;&#xA;            }&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        archive size 100k files 3;&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any critical;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands error;&#xA;        }&#xA;    }&#xA;    max-configurations-on-flash 5;&#xA;    max-configuration-rollbacks 5;&#xA;    license {&#xA;        autoupdate {&#xA;            url https://ae1.juniper.net/junos/key_retrieval;&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0;&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.0.0.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    fe-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    ge-0/0/2 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    fe-0/0/3 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    fe-0/0/4 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    fe-0/0/5 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    fe-0/0/6 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    fe-0/0/7 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    static {&#xA;        route 20.0.0.0/24 next-hop 10.0.0.2;&#xA;    }&#xA;    router-id 10.0.0.1;&#xA;    autonomous-system 65501;&#xA;}&#xA;protocols {&#xA;    bgp {&#xA;        group external-peers {&#xA;            type external;&#xA;            local-address 10.0.0.1;&#xA;            import bgp-import-all;&#xA;            export bgp-export-all;&#xA;            peer-as 65503;&#xA;            local-as 65501;&#xA;            neighbor 10.0.0.2;&#xA;        }&#xA;    }&#xA;}&#xA;policy-options {&#xA;    policy-statement bgp-export-all {&#xA;        term 1 {&#xA;            from {&#xA;                route-filter 0.0.0.0/0 orlonger;&#xA;            }&#xA;            then accept;&#xA;        }&#xA;        term 2 {&#xA;            then accept;&#xA;        }&#xA;    }&#xA;    policy-statement bgp-import-all {&#xA;        term 1 {&#xA;            from {&#xA;                protocol bgp;&#xA;                route-filter 0.0.0.0/0 orlonger;&#xA;            }&#xA;            then accept;&#xA;        }&#xA;    }&#xA;}&#xA;security {&#xA;    zones {&#xA;        security-zone internal {&#xA;            address-book {&#xA;                address network_mine 10.0.0.0/24;&#xA;                address network_loopback 20.0.0.0/24;&#xA;            }&#xA;            interfaces {&#xA;                ge-0/0/1.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            ping;&#xA;                            ssh;&#xA;                            all;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    policies {&#xA;        from-zone internal to-zone internal {&#xA;            policy allow-all {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="27412" LastEditorUserId="27412" LastEditDate="2017-02-12T22:46:51.077" LastActivityDate="2017-02-13T01:54:25.813" Title="BGP between two SRX210s?" Tags="|routing|bgp|juniper-srx|srx|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38876" PostTypeId="1" AcceptedAnswerId="38877" CreationDate="2017-02-12T18:40:02.537" Score="8" ViewCount="6609" Body="&lt;p&gt;I was a little confused between packet and frame. The confusion was based on, if a switch is a layer 2 device, how does it reads a packet from a layer 3 device, and where is the 'frame' thing which is understandable to a switch (or layer 2 device)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From all the blogs and articles I read, I came to conclusion that when a host send out a packet to a switch, it only reads it up to the data link layer, and the process of putting that packet from ingress to egress port is where the frame terminology is used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am sorry if I haven't communicated my question thoroughly, but this is kind of messed up for me.&lt;/p&gt;&#xA;" OwnerUserId="34388" LastEditorUserId="8499" LastEditDate="2018-03-19T00:23:17.950" LastActivityDate="2018-03-19T00:23:17.950" Title="Does a switch understand packets? If yes, what is the frame terminology for?" Tags="|switch|switching|layer2|osi|layer3|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38877" PostTypeId="2" ParentId="38876" CreationDate="2017-02-12T18:47:19.557" Score="14" Body="&lt;p&gt;You need to understand the concept of layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An application will send data to the Transport Layer. The Transport Layer protocol will encapsulate the data inside headers for the Transport Layer protocol, and pass those to the Network Layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Network Layer will encapsulate the datagrams it receives inside Network Layer headers, and those are called packets. The packets will be passed to the Data-Link Layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Data-Link Layer will encapsulate the packets inside Data-Link Layer headers, and those are called frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches only look at the frames, and not at the packets. Routers strip off and discard the frame headers, and they only look at the packets.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An application on Host A sends data to an application on Host B, via TCP. The application on Host A will send the data to TCP, and TCP segments the data into TCP segments, each of which have a TCP header that includes the source and destination TCP addresses (ports).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP passes the segments to IP. IP will add the IP headers, creating IP packets, each of which contain the source and destination IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP passes the packets to ethernet. Ethernet will add the ethernet headers, creating ethernet frames, each of which will have the source and destination ethernet addresses (MAC addresses).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet will send the frames on the wire to an ethernet switch. The switch will inspect the frame headers, and it will switch the frames to the interface where it last saw the destination MAC address. If it doesn't have a destination interface, it will flood the frames to all interfaces except the one where it received the frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch doesn't know or care what Network Layer protocol is used because it knows nothing about Network Layer protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the destination host receives the frame, it reverses the process used to encapsulate the data, and the data end up in the destination application.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-09-20T16:09:39.930" LastActivityDate="2017-09-20T16:09:39.930" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38879" PostTypeId="2" ParentId="38876" CreationDate="2017-02-12T23:56:36.340" Score="0" Body="&lt;p&gt;As Ron pointed out the switch encapsulates the data from the router.&#xA;You can use this for your reference:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;information generated at the application layer (for instance this web browser) is called data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the transport layer encapsulates it and calls segment&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At network layer it is a called a packet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A frame at the data link layer &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and at the physical layer they are just bits transmitted through various mechanisms.&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-02-12T23:56:36.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38880" PostTypeId="2" ParentId="38874" CreationDate="2017-02-13T01:54:25.813" Score="2" Body="&lt;p&gt;A couple of things - your major issue is that you aren't allowing bgp under your &lt;code&gt;host-inbound-traffic&lt;/code&gt; - think of this is like an ACL directly to your interface IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fix this with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security zones security-zone internal host-inbound-traffic protocols bgp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A couple of other things I spot:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;your loopback address should be a /32, not a /24 - it doesn't provide access to other hosts in that subnet.&lt;/li&gt;&#xA;&lt;li&gt;there is no need for the BGP import policy - the default behaviour for EBGP is to accept all BGP routes&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-02-13T01:54:25.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38881" PostTypeId="2" ParentId="18873" CreationDate="2017-02-13T02:26:54.893" Score="9" Body="&lt;p&gt;It has also been, in my years of understanding, general network traffic descriptors:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;North/South - Meaning traffic coming into and out of the network into Internet space, i.e in and out of edge firewalls and/routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;East/West - Traffic internal to the network that doesn't leave, i.e. LAN client to server and server to server communications. &lt;/p&gt;&#xA;" OwnerUserId="34404" LastActivityDate="2017-02-13T02:26:54.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38882" PostTypeId="2" ParentId="38876" CreationDate="2017-02-13T05:32:21.317" Score="-1" Body="&lt;p&gt;If it's a layer3 switch with IP routing enabled, it's effectively a router.  Regarding a switch, it processes frames.  That's it.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-13T05:32:21.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38884" PostTypeId="2" ParentId="38813" CreationDate="2017-02-13T07:47:19.557" Score="0" Body="&lt;p&gt;Try setup a switch port analyser(port mirror/SPAN, other commons terms) , that will mirror packets from your port of interest, out to a specified port. Then plug a laptop/pc into the port that is mirroring the data and use a packet sniffer like wire shark, you'll be able to see all the layer 2 frames with tagging etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps! &lt;/p&gt;&#xA;" OwnerUserId="34272" LastActivityDate="2017-02-13T07:47:19.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38885" PostTypeId="2" ParentId="37448" CreationDate="2017-02-13T08:59:45.133" Score="1" Body="&lt;p&gt;Since probe requests are management frames, they are sent at the lowest rate in the network (1Mbps in 2.4GHz, 6Mbps in 5GHz). I'm not 100% if it's a norm standard, but this is at least an industry standard.&lt;/p&gt;&#xA;" OwnerUserId="28361" LastActivityDate="2017-02-13T08:59:45.133" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38886" PostTypeId="1" AcceptedAnswerId="38889" CreationDate="2017-02-13T09:45:13.327" Score="0" ViewCount="319" Body="&lt;p&gt;Lets say I own 207.45.222.0/24. If I subnet to create 207.45.222.0/25 and 207.45.222.128/25, have I effectively given up all those /24 addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens to the /24 designation in terms of routing? What would be the result of pinging one such address previously assigned to a host (ex: 207.45.222.1/24)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From a theoretical standpoint, a number like 207.45.222.0/24 and 207.45.222.0/25 are distinguishable--the first network has an address 24 bits long and the second, 25 bits. Therefore, it appears that a router should be able to distinguish between these two subnets and I should be able to use my old /24 addresses alongside my new /25 addresses. In the /24 subnet, I would have 256 addresses at my disposal, while in the two /25 subnets, I would have 128 addresses each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize this is silly, but I don't know why. (One implication would be a single number 207.45.222.0 being used in many subnets /24, /25, /26, /27, ...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what is wrong with the above reasoning? How does the subnetting designation work?&lt;/p&gt;&#xA;" OwnerUserId="34410" LastActivityDate="2017-02-13T13:55:59.930" Title="IPv4 theoretical question about subnetting" Tags="|ipv4|subnet|" AnswerCount="3" CommentCount="1" ClosedDate="2017-02-13T14:08:49.573" ContentLicense="CC BY-SA 3.0" />
  <row Id="38889" PostTypeId="2" ParentId="38886" CreationDate="2017-02-13T10:38:25.113" Score="1" Body="&lt;p&gt;You can't use both a full /24 network and in the same time some subnets of this network.&#xA;(that's of course true for any network size).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, most router will not allow to configure overlapping network, be it on different interfaces or on the same interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However some routers will allow it, so what happens in this case?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let say you configure:&lt;br&gt;&#xA; eth1 with ip address &lt;code&gt;207.45.222.1/24&lt;/code&gt;&lt;br&gt;&#xA; eth2 with IP address &lt;code&gt;207.45.222.1/25&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then you will have in the routing table two entries&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;207.45.222.0/24 via eth1&#xA;207.45.222.0/25 via eth2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when the router receive a packet for &lt;code&gt;207.45.222.17&lt;/code&gt; for example, it looks in its routing table for the more specific match (this is a very important point and a fundamental basic of how IP routing works).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case the closest match is &lt;code&gt;207.45.222.0/25 via eth2&lt;/code&gt; so the router will send the packet out of eth2 (after arp resolution, etc...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So even if you have a host 207.45.222.17 behind eth1, the router will never send it anything. The /24 network will be unreachable from outside world.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-13T10:38:25.113" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="38892" PostTypeId="1" CreationDate="2017-02-13T12:02:15.190" Score="1" ViewCount="358" Body="&lt;p&gt;If the speed of the CSMA/CD network is scaled up and if all the other parameters stay unchanged does that mean the utilization will stay unchanged?&lt;/p&gt;&#xA;" OwnerUserId="34416" LastActivityDate="2017-06-14T12:48:44.093" Title="Effect on Utilization if speed of CSMA/CD network is scaled up?" Tags="|network|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38893" PostTypeId="1" AcceptedAnswerId="38894" CreationDate="2017-02-13T12:25:19.153" Score="0" ViewCount="145" Body="&lt;p&gt;I'm trying to learn the DHCP protocol and the importance of what he gives to the computers connected to him.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I send everything through the router, why I need the DHCP to provide me the subnet of my LAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="34417" LastActivityDate="2017-02-13T13:38:51.393" Title="Why the DHCP provide us our subnet?" Tags="|subnet|dhcp|lan|" AnswerCount="2" CommentCount="1" ClosedDate="2017-02-13T13:48:42.160" ContentLicense="CC BY-SA 3.0" />
  <row Id="38894" PostTypeId="2" ParentId="38893" CreationDate="2017-02-13T12:40:02.587" Score="1" Body="&lt;p&gt;You don't need to use DHCP and staticly assigned IP addresses to machines. But in some networks like client access network that could be very difficult task to maintain is why we are using DHCP. Please below why you should use DHCP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dynamic Host Configuration Protocol (DHCP) is a client/server protocol that automatically provides an Internet Protocol (IP) host with its IP address and other related configuration information such as the subnet mask and default gateway.&#xA;&#xA;RFCs 2131 and 2132 define DHCP as an Internet Engineering Task Force (IETF) standard based on Bootstrap Protocol (BOOTP), a protocol with which DHCP shares many implementation details. DHCP allows hosts to obtain necessary TCP/IP configuration information from a DHCP server.&#xA;&#xA;Benefits of DHCP:&#xA;&#xA;Reliable IP address configuration. DHCP minimizes configuration&#xA;   errors caused by manual IP address configuration, such as&#xA;   typographical errors, or address conflicts caused by the assignment&#xA;   of an IP address to more than one computer at the same time.&#xA;&#xA;Reduced network administration. DHCP includes the following features to reduce network administration: &#xA;&#xA; - Centralized and automated TCP/IP configuration&#xA; - The ability to define TCP/IP configurations from a central location.&#xA; - The ability to assign a full range of additional TCP/IP configuration&#xA;   values by means of DHCP options.&#xA; - The efficient handling of IP address changes for clients that must be&#xA;   updated frequently, such as those for portable computers that move to&#xA;   different locations on a wireless network.&#xA; - The forwarding of initial DHCP messages by using a DHCP relay agent,&#xA;   thus eliminating the need to have a DHCP server on every subnet.&#xA;&#xA;Why use DHCP&#xA;Every device on a TCP/IP-based network must have a unique unicast IP address to access the network and its resources. Without DHCP, IP addresses must be configured manually for new computers or computers that are moved from one subnet to another, and manually reclaimed for computers that are removed from the network.&#xA;&#xA;DHCP enables this entire process to be automated and managed centrally. The DHCP server maintains a pool of IP addresses and leases an address to any DHCP-enabled client when it starts up on the network. Because the IP addresses are dynamic (leased) rather than static (permanently assigned), addresses no longer in use are automatically returned to the pool for reallocation.&#xA;&#xA;The network administrator establishes DHCP servers that maintain TCP/IP configuration information and provide address configuration to DHCP-enabled clients in the form of a lease offer. The DHCP server stores the configuration information in a database, which includes:&#xA;&#xA; - Valid TCP/IP configuration parameters for all clients on the network.&#xA; - Valid IP addresses, maintained in a pool for assignment to clients, as well as excluded addresses.&#xA; - Reserved IP addresses associated with particular DHCP clients. This allows consistent assignment of a single IP address to a single DHCP client.&#xA; - The lease duration, or the length of time for which the IP address can be used before a lease renewal is required.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-13T12:40:02.587" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38897" PostTypeId="2" ParentId="38886" CreationDate="2017-02-13T13:17:09.870" Score="2" Body="&lt;p&gt;In answer to your comment on JFL's answer, the specific/closest match is known as the 'longest prefix match' and can be explained as follows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router can hold many routes that match the destination IP address of a received packet. For example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;207.45.0.0/16&lt;/li&gt;&#xA;&lt;li&gt;207.45.222.0/24&lt;/li&gt;&#xA;&lt;li&gt;207.45.222.0/25&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Each route has a different prefix length, written in decimal notation /xx, and represents the number of contiguous binary 1's in the subnet mask. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the binary representation for each prefix.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;/16 = &lt;strong&gt;11111111.11111111&lt;/strong&gt;.00000000.00000000 (255.255.0.0)&lt;/li&gt;&#xA;&lt;li&gt;/24 = &lt;strong&gt;11111111.11111111.11111111&lt;/strong&gt;.00000000 (255.255.255.0)&lt;/li&gt;&#xA;&lt;li&gt;/25 = &lt;strong&gt;11111111.11111111.11111111.1&lt;/strong&gt;0000000 (255.255.255.128)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The router will examine the destination IP address in the IP header and run an algorithm to determine the longest prefix match against the possible routes in its routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once the longest prefix match is determined, the router will use the route information to forward the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example, if the router receives a packet with a destination address of 207.45.222.100, the router will select 207.45.222.0/25 as the longest prefix match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, if the router receives a packet with a destination address of 207.45.222.200, the router will select 205.45.222.0/24 as the longest prefix match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you configured two networks of 207.45.222.0/24 and 207.45.222.0/25, traffic destined to hosts in the bottom half of 207.45.222.0/24 (.1 to .126) will find they are unable to receive traffic from outside of their subnet (this is quite a common problem when hosts have an incorrectly configured subnet mask). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to longest prefix length matching, the router will forward traffic destined to hosts 207.45.222.1 to .126 towards the 207.45.222.0/25 network.&lt;/p&gt;&#xA;" OwnerUserId="34415" LastActivityDate="2017-02-13T13:17:09.870" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38898" PostTypeId="2" ParentId="38893" CreationDate="2017-02-13T13:38:51.393" Score="0" Body="&lt;p&gt;When a host needs to send some data to another host, the sending host must determine whether the receiving host is on the same network or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The sending host uses its own IP address and mask information to calculate whether the receiving host is on the same network. If it is, it sends the data direct to the host, if not, it will send the data towards its default gateway.&lt;/p&gt;&#xA;" OwnerUserId="34415" LastActivityDate="2017-02-13T13:38:51.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38901" PostTypeId="2" ParentId="38886" CreationDate="2017-02-13T13:55:59.930" Score="1" Body="&lt;p&gt;The easiest way to answer the question of &quot;So what is wrong with the above reasoning?&quot; part of your question is that you're talking about IP addresses as if they themselves include their prefix length (ex: 207.45.222.1/24), but when another endpoint communicates with you, they're just using your IP, meaning they would have no way of contacting two different &quot;types&quot; of 207.45.222.1.&lt;/p&gt;&#xA;" OwnerUserId="17048" LastActivityDate="2017-02-13T13:55:59.930" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38902" PostTypeId="2" ParentId="38892" CreationDate="2017-02-13T14:40:35.887" Score="2" Body="&lt;p&gt;You should consider that most CSMA/CD networks although in theory using CSMA/CD in practice are really switched full duplex networks where collisions cannot occur. So, scaling up the speed does not change the situation at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about real CSMA/CD networks, then? If you scale up the speed and keep the maximum allowed network size constant, you must scale up the minimum allowed packet size. Otherwise collisions cannot be detected. Eventually, the minimum allowed packet size exceeds whatever packet size is most common in your network, and then in that case you must insert dummy data to the end of the packet so that collisions can be detected. So, if increasing the speed is taken to the extreme, utilization will actually become lower.&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2017-02-13T14:40:35.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38904" PostTypeId="2" ParentId="38892" CreationDate="2017-02-13T15:03:49.587" Score="1" Body="&lt;p&gt;There are several slightly different definitions of utlisation, for the purpose of this post I will assume it means the ratio of capacity used to successfully send useful data verses total low level capacity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also the question of what the hosts are trying to do. If the hosts aren't actually trying to max the network out then obviously your utilitsation will drop as you increase the network speed regardless of low-level protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is you can't really scale up the speed of a CSMA/CD network while keeping &quot;all other parameters unchanged&quot;. You must either increase the minimum packet size or reduce the maximum network size. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you increase the minimum packet size then you end up sending more padding. Thus reducing utilisation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you reduce the maximum network size you don't have that problem but you may end up with a protocol that is unable to operate over a practically sized network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This problem along with shifts in the relative costs of processing/buffering electronics verses line-driving electronics  has caused CSMA/CD to fall out of favour. At 10M you could build a large CSMA/CD network. At 100M CSMA/CD was sometimes used but the maximum extent of a collision domain was far more limited meaning all but the smallest networks would have to use some bridges/switches. At 1G CSMA/CD was standardised but is pretty much never actually used. At higher speeds they didn't even bother to include it in the standards at all.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-06-14T12:48:44.093" LastActivityDate="2017-06-14T12:48:44.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38908" PostTypeId="2" ParentId="38044" CreationDate="2017-02-13T19:01:20.487" Score="0" Body="&lt;p&gt;The ACL is going to catch layer 3 stuff.  DHCP happens largely at Layer 2 (link layer).  You will often see &lt;code&gt;ip helper-address &amp;lt;DHCP SRVR ADD&amp;gt;&lt;/code&gt; on the LAN/subnet interface directing DHCP request on to a remote server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That ACL line is in there probably becuase there is an overall ACL on that interface and they had to add that line to allow the DHCP request to reach the remote server (to bypass the explicit &lt;code&gt;deny&lt;/code&gt; at the end of the ACL).&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-13T19:01:20.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38909" PostTypeId="1" CreationDate="2017-02-13T21:54:53.027" Score="1" ViewCount="6026" Body="&lt;p&gt;A few office APs are not joining the WLC after a restart, and this is the log from the controller:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*spamReceiveTask: Feb 13 20:18:44.173: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.77.76.3&#xA;*spamReceiveTask: Feb 13 20:18:15.485: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.74.7.27&#xA;*spamReceiveTask: Feb 13 20:17:48.129: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.75.7.22&#xA;*spamReceiveTask: Feb 13 20:17:47.166: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.77.161.10&#xA;*spamReceiveTask: Feb 13 20:17:46.888: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.77.161.11&#xA;*spamReceiveTask: Feb 13 20:17:46.518: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.74.7.25&#xA;*spamReceiveTask: Feb 13 20:17:46.511: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.73.100.11&#xA;*spamReceiveTask: Feb 13 20:17:45.667: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.72.7.20&#xA;*spamReceiveTask: Feb 13 20:17:41.915: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.71.77.103&#xA;*spamReceiveTask: Feb 13 20:17:40.132: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.77.76.3&#xA;*spamReceiveTask: Feb 13 20:17:39.695: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.77.121.13&#xA;*spamReceiveTask: Feb 13 20:17:39.185: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.77.161.13&#xA;*spamReceiveTask: Feb 13 20:17:39.006: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.77.161.12&#xA;*spamReceiveTask: Feb 13 20:17:38.833: %DTLS-3-HANDSHAKE_FAILURE: openssl_dtls.c:631 Failed to complete DTLS handshake with peer 10.73.100.10&#xA;*spamReceiveTask: Feb 13 20:17:37.075: %CAPWAP-3-DISC_INTF_ERR1: capwap_ac_sm.c:1445  (2) from AP 00:22:90:a1:b1:40&#xA;*spamReceiveTask: Feb 13 20:17:36.793: %CAPWAP-3-DISC_INTF_ERR1: capwap_ac_sm.c:1445 Ignoring discovery request received on non-management interface (2) from AP 00:24:14:ff:73:10&#xA;*spamReceiveTask: Feb 13 20:17:30.021: %CAPWAP-3-DISC_INTF_ERR1: capwap_ac_sm.c:1445 Ignoring discovery request received on non-management interface (2) from AP 88:43:e1:14:58:50&#xA;*spamReceiveTask: Feb 13 20:17:29.522: %CAPWAP-3-DISC_INTF_ERR1: capwap_ac_sm.c:1445 Ignoring discovery request received on non-management interface (2) from AP 00:24:14:31:f6:b0&#xA;*spamReceiveTask: Feb 13 20:17:29.466: %CAPWAP-3-DISC_INTF_ERR1: capwap_ac_sm.c:1445 Ignoring discovery request received on non-management interface (2) from AP 00:24:97:71:b9:b0&#xA;*spamReceiveTask: Feb 13 20:17:28.347: %LWAPP-3-DISC_INTF_ERR1: spam_lrad.c:1298 Ignoring discovery request received on non-management interface (2) in L3 LWAPP mode from AP 00:24:97:b7:03:b0&#xA;*spamReceiveTask: Feb 13 20:17:28.345: %CAPWAP-3-DISC_INTF_ERR1: capwap_ac_sm.c:1445 Ignoring discovery request received on non-management interface (2) from AP 00:24:97:b7:03:b0&#xA;*nim_t: Feb 13 20:17:28.293: %SIM-3-PORT_UP: sim.c:9820 Physical port 2 is up!.&#xA;*nim_t: Feb 13 20:17:28.290: %SIM-3-PORT_UP: sim.c:9820 Physical port 1 is up!.&#xA;*fp_main_task: Feb 13 20:17:28.069: %CNFGR-3-INV_COMP_ID: cnfgr.c:2221 Invalid Component Id : Unrecognized (77) in cfgConfiguratorInit.&#xA;*fp_main_task: Feb 13 20:17:27.987: %LOG-3-Q_IND: rrmCfg.c:1501 RRM LOG: Airewave Director: Configuration has been sanitized -- save configuration to commit&#xA;*fp_main_task: Feb 13 20:17:27.780: %RRM-3-RRM_LOGMSG: rrmCfg.c:1501 RRM LOG: Airewave Director: Configuration has been sanitized -- save configuration to commit&#xA;*fp_main_task: Feb 13 20:17:20.955: %MM-3-MEMBER_ADD_FAILED: mm_dir.c:926 Could not add Mobility Member. Reason: IP already assigned, Member-Count:1,MAC: 00:00:00:00:00:00, IP: 0.0.0.0&#xA;*fp_main_task: Feb 13 20:17:20.747: %DTL-3-DSNET_CONF_FAILED: dtl_ds.c:424 Unable to set symmetric mobility tunneling to disabled on Distribution Service interface.&#xA;*fp_main_task: Feb 13 20:17:03.486: %CNFGR-3-INV_COMP_ID: cnfgr.c:2221 Invalid Component Id : Unrecognized (36) in cfgConfiguratorInit.&#xA;*mfpKeyRefreshTask: Feb 13 20:17:03.485: %SSHPM-3-NOT_INIT: bsnrandom.c:621 Random context not initialized&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have connected to one of the APs and captured the following from serial:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;*Feb 13 18:26:14.083: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY&#xA;*Feb 13 18:26:14.083: %CAPWAP-5-CHANGED: CAPWAP changed state to DISCOVERY&#xA;*Feb 13 18:26:14.135: %LWAPP-3-CLIENTERRORLOG: LWAPP LED Init: incorrect led state 255&#xA;*Feb 13 18:26:14.139: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to administratively down&#xA;*Feb 13 18:26:14.139: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to administratively down&#xA;*Feb 13 18:26:14.147: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to reset&#xA;*Feb 13 18:26:14.163:  status of voice_diag_test from WLC is false&#xA;*Feb 13 18:26:14.163: %LINK-3-UPDOWN: Interface Dot11Radio1, changed state to up&#xA;*Feb 13 18:26:14.175: %LINK-3-UPDOWN: Interface Dot11Radio0, changed state to up&#xA;*Feb 13 18:26:14.183: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to reset&#xA;*Feb 13 18:26:24.000: %CAPWAP-5-DTLSREQSEND: DTLS connection request sent peer_ip: 10.77.77.59 peer_port: 5246&#xA;*Feb 13 18:26:24.000: %CAPWAP-5-CHANGED: CAPWAP changed state to&#xA;*Feb 13 18:26:24.099: %PKI-3-CERTIFICATE_INVALID_EXPIRED: Certificate chain validation has failed.  The certificate (SN: 3C1E27950000000C5C4B) has expired.    Validity period ended on 19:56:24 UTC Jan 17 2017&#xA;*Feb 13 18:26:24.099: %LWAPP-3-CLIENTERRORLOG: Peer certificate verification failed&#xA;*Feb 13 18:26:24.099: %CAPWAP-3-ERRORLOG: Certificate verification failed!&#xA;*Feb 13 18:26:24.099: DTLS_CLIENT_ERROR: ../capwap/capwap_wtp_dtls.c:352 Certificate verified failed!&#xA;*Feb 13 18:26:24.099: %DTLS-4-BAD_CERT: Certificate verification failed. Peer IP: 10.77.77.59&#xA;*Feb 13 18:26:24.099: %DTLS-5-SEND_ALERT: Send FATAL : Bad certificate Alert to 10.77.77.59:5246&#xA;*Feb 13 18:26:24.099: %DTLS-3-BAD_RECORD: Erroneous record received from 10.77.77.59: Malformed Certificate&#xA;*Feb 13 18:26:24.099: %DTLS-5-SEND_ALERT: Send FATAL : Close notify Alert to 10.77.77.59:5246&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it a certificate issue? Provided that the certificate is actually not expired.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="21193" LastEditorUserId="8499" LastEditDate="2017-02-13T22:23:58.833" LastActivityDate="2017-03-16T00:01:56.373" Title="APs not joining WLC Cisco 4400 Series" Tags="|cisco|access-point|cisco-wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38910" PostTypeId="2" ParentId="38909" CreationDate="2017-02-13T22:06:17.957" Score="1" Body="&lt;p&gt;Certificate with serial number: 3C1E27950000000C5C4B expired on 17 Jan 2017. Please double check certificates and configured trustpoints. It could be manufacturing installed certificates. I've found issue over &lt;a href=&quot;https://supportforums.cisco.com/document/12453081/lightweight-ap-fail-create-capwaplwapp-connection-due-certificate-expiration&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; check if is not same in your case.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastActivityDate="2017-02-13T22:06:17.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38911" PostTypeId="5" CreationDate="2017-02-13T22:06:37.020" Score="0" Body="&lt;p&gt;The access point (AP) usually connects to a router (via a wired network) as a standalone device, but it can also be an integral component of the router itself. An AP is differentiated from a hotspot, which is the physical location where Wi-Fi access to a WLAN is available.&lt;/p&gt;&#xA;" OwnerUserId="4795" LastEditorUserId="4795" LastEditDate="2017-02-13T22:22:11.413" LastActivityDate="2017-02-13T22:22:11.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38912" PostTypeId="4" CreationDate="2017-02-13T22:06:37.020" Score="0" Body=" A networking hardware device that allows a Wi-Fi compliant device to connect to a wired network." OwnerUserId="4795" LastEditorUserId="4795" LastEditDate="2017-02-13T22:22:14.603" LastActivityDate="2017-02-13T22:22:14.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38913" PostTypeId="5" CreationDate="2017-02-13T22:08:17.180" Score="0" Body="&lt;p&gt;IP addresses are usually written and displayed in human-readable notations, such as 172.16.254.1 (IPv4), and 2001:db8:0:1234:0:567:8:1 (IPv6).&lt;/p&gt;&#xA;" OwnerUserId="4795" LastEditorUserId="4795" LastEditDate="2017-02-13T22:20:56.833" LastActivityDate="2017-02-13T22:20:56.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38914" PostTypeId="4" CreationDate="2017-02-13T22:08:17.180" Score="0" Body="A numerical label assigned to each device (e.g., computer, printer) participating in a computer network that uses the Internet Protocol for communication." OwnerUserId="4795" LastEditorUserId="4795" LastEditDate="2017-02-13T22:21:15.113" LastActivityDate="2017-02-13T22:21:15.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38915" PostTypeId="1" AcceptedAnswerId="38918" CreationDate="2017-02-13T22:26:19.533" Score="2" ViewCount="4720" Body="&lt;p&gt;I am redistributing an eBGP route into OSPF, I see the route flooded in the database, but it is not installed in the routing table on the other routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would cause this route not to install in the routing table?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is the some troubleshooting output from &lt;code&gt;dallas&lt;/code&gt; and &lt;code&gt;atlanta&lt;/code&gt;.  I'm expecting the route 172.16.192.0/19 to be available on &lt;code&gt;atlanta&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;asr1k/dallas#show run | sec router ospf 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1 vrf blue&#xA; router-id 172.18.255.1&#xA; ispf&#xA; prefix-suppression&#xA; timers throttle spf 10 100 1000&#xA; timers throttle lsa 10 100 1000&#xA; timers lsa arrival 50&#xA; timers pacing flood 5&#xA; timers pacing retransmission 60&#xA; redistribute static subnets&#xA; redistribute bgp 65001 subnets tag 0&#xA; passive-interface default&#xA; no passive-interface GigabitEthernet0/0/2.100&#xA; no passive-interface Tunnel1000&#xA; network 172.16.0.0 0.15.255.255 area 0&#xA; neighbor 172.16.254.25&#xA; neighbor 172.16.254.19&#xA; neighbor 172.16.254.22&#xA; neighbor 172.16.254.20&#xA; neighbor 172.16.255.27 cost 5000&#xA; maximum-paths 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;asr1k/dallas#show ip route vrf blue 172.16.192.0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Routing Table: blue&#xA;Routing entry for 172.16.192.0/19&#xA;  Known via &quot;bgp 65001&quot;, distance 20, metric 100&#xA;  Tag 65000, type external&#xA;  Redistributing via ospf 1&#xA;  Advertised by ospf 1 subnets tag 0&#xA;  Last update from 169.254.13.109 03:37:09 ago&#xA;  Routing Descriptor Blocks:&#xA;  * 169.254.13.109, from 169.254.13.109, 03:37:09 ago&#xA;      Route metric is 100, traffic share count is 1&#xA;      AS Hops 2&#xA;      Route tag 65000&#xA;      MPLS label: none&#xA;      MPLS Flags: NSF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;asr1k/dallas#show ip ospf 1 database&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            OSPF Router with ID (172.18.255.1) (Process ID 1)&#xA;&#xA;        Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;172.16.255.28   172.16.255.28   358         0x80005070 0x00C976 18&#xA;172.17.255.1    172.17.255.1    696         0x8000A4AB 0x003027 18&#xA;172.18.255.1    172.18.255.1    344         0x8002933B 0x00B226 23&#xA;172.19.255.1    172.19.255.1    1562        0x8000FEE0 0x00553C 22&#xA;172.20.255.1    172.20.255.1    762         0x800F04F8 0x00A1D6 23&#xA;172.21.255.1    172.21.255.1    1223        0x8002CAA2 0x00DFAF 3&#xA;172.22.255.1    172.22.255.1    125         0x8000D829 0x00DD6C 23&#xA;172.23.255.1    172.23.255.1    192         0x80004AD5 0x00EFB5 19&#xA;172.24.255.1    172.24.255.1    306         0x80006A76 0x0005AF 18&#xA;172.25.255.1    172.25.255.1    238         0x8000B51E 0x00B20C 23&#xA;172.27.255.1    172.27.255.1    159         0x8000588C 0x000254 19&#xA;172.30.255.1    172.30.255.1    1693        0x80001EC0 0x00045E 18&#xA;172.31.255.1    172.31.255.1    323         0x8000E561 0x004758 16&#xA;172.32.255.1    172.32.255.1    655         0x80003F20 0x00A33F 2&#xA;&#xA;        Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;172.16.253.0    172.25.255.1    2011        0x80003F1C 0x00E1E7&#xA;&#xA;        Type-5 AS External Link States&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;172.16.192.0    172.18.255.1    597         0x80000003 0x008B87 0&#xA;172.17.0.0      172.17.255.1    1461        0x800073C6 0x00CF1B 0&#xA;172.18.0.0      172.18.255.1    1881        0x8000739C 0x001003 0&#xA;172.19.0.0      172.19.255.1    1066        0x8000736F 0x0056E7 0&#xA;172.20.0.0      172.20.255.1    762         0x8000731A 0x00ECA4 0&#xA;172.22.0.0      172.22.255.1    1412        0x80007396 0x00CB45 0&#xA;172.23.0.0      172.23.255.1    1445        0x80003B75 0x00A2C5 0&#xA;172.24.0.0      172.24.255.1    306         0x800052F9 0x00408A 0&#xA;172.25.0.0      172.25.255.1    2011        0x80007341 0x003A26 0&#xA;172.27.0.0      172.27.255.1    1672        0x80003390 0x003419 0&#xA;172.28.0.0      172.16.255.28   601         0x8000442E 0x006F1E 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is the output from a different router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;asr1k/atlanta#show run | sec router ospf 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router ospf 1 vrf blue&#xA; router-id 172.22.255.1&#xA; ispf&#xA; prefix-suppression&#xA; timers throttle spf 10 100 1000&#xA; timers throttle lsa 10 100 1000&#xA; timers lsa arrival 50&#xA; timers pacing flood 5&#xA; timers pacing retransmission 60&#xA; redistribute static subnets&#xA; passive-interface default&#xA; no passive-interface GigabitEthernet0/0/2.100&#xA; no passive-interface Tunnel1000&#xA; network 172.16.0.0 0.15.255.255 area 0&#xA; neighbor 172.16.254.19&#xA; neighbor 172.16.254.18&#xA; neighbor 172.16.254.25&#xA; neighbor 172.16.254.20&#xA; neighbor 172.16.255.27 cost 5000&#xA; maximum-paths 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;asr1k/atlanta#show ip route vrf blue 172.16.192.0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Routing Table: blue&#xA;% Subnet not in table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;asr1k/atlanta#show ip ospf 1 database&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            OSPF Router with ID (172.22.255.1) (Process ID 1)&#xA;&#xA;        Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;172.16.255.28   172.16.255.28   515         0x80005070 0x00C976 18&#xA;172.17.255.1    172.17.255.1    853         0x8000A4AB 0x003027 18&#xA;172.18.255.1    172.18.255.1    501         0x8002933B 0x00B226 23&#xA;172.19.255.1    172.19.255.1    1718        0x8000FEE0 0x00553C 22&#xA;172.20.255.1    172.20.255.1    918         0x800F04F8 0x00A1D6 23&#xA;172.21.255.1    172.21.255.1    1380        0x8002CAA2 0x00DFAF 3&#xA;172.22.255.1    172.22.255.1    280         0x8000D829 0x00DD6C 23&#xA;172.23.255.1    172.23.255.1    347         0x80004AD5 0x00EFB5 19&#xA;172.24.255.1    172.24.255.1    462         0x80006A76 0x0005AF 18&#xA;172.25.255.1    172.25.255.1    394         0x8000B51E 0x00B20C 23&#xA;172.27.255.1    172.27.255.1    314         0x8000588C 0x000254 19&#xA;172.30.255.1    172.30.255.1    1849        0x80001EC0 0x00045E 18&#xA;172.31.255.1    172.31.255.1    480         0x8000E561 0x004758 16&#xA;172.32.255.1    172.32.255.1    811         0x80003F20 0x00A33F 2&#xA;&#xA;        Net Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;172.16.253.0    172.25.255.1    132         0x80003F1D 0x00DFE8&#xA;&#xA;        Type-5 AS External Link States&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;172.16.192.0    172.18.255.1    755         0x80000003 0x008B87 0&#xA;172.17.0.0      172.17.255.1    1619        0x800073C6 0x00CF1B 0&#xA;172.18.0.0      172.18.255.1    1           0x8000739D 0x000E04 0&#xA;172.19.0.0      172.19.255.1    1223        0x8000736F 0x0056E7 0&#xA;172.20.0.0      172.20.255.1    919         0x8000731A 0x00ECA4 0&#xA;172.22.0.0      172.22.255.1    1568        0x80007396 0x00CB45 0&#xA;172.23.0.0      172.23.255.1    1601        0x80003B75 0x00A2C5 0&#xA;172.24.0.0      172.24.255.1    463         0x800052F9 0x00408A 0&#xA;172.25.0.0      172.25.255.1    132         0x80007342 0x003827 0&#xA;172.27.0.0      172.27.255.1    1829        0x80003390 0x003419 0&#xA;172.28.0.0      172.16.255.28   759         0x8000442E 0x006F1E 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;asr1k/atlanta#show ip ospf 1 database external 172.16.192.0&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;            OSPF Router with ID (172.22.255.1) (Process ID 1)&#xA;&#xA;        Type-5 AS External Link States&#xA;&#xA;  LS age: 764&#xA;  Options: (No TOS-capability, DC, Downward)&#xA;  LS Type: AS External Link&#xA;  Link State ID: 172.16.192.0 (External Network Number )&#xA;  Advertising Router: 172.18.255.1&#xA;  LS Seq Number: 80000003&#xA;  Checksum: 0x8B87&#xA;  Length: 36&#xA;  Network Mask: /19&#xA;    Metric Type: 2 (Larger than any link state path)&#xA;    MTID: 0&#xA;    Metric: 1&#xA;    Forward Address: 0.0.0.0&#xA;    External Route Tag: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also tried removing &lt;code&gt;tag 0&lt;/code&gt; on the redistributing router, I have the same behavior in Atlanta.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;asr1k/atlanta#show ip ospf 1 database  external 172.16.192.0&#xA;&#xA;            OSPF Router with ID (172.22.255.1) (Process ID 1)&#xA;&#xA;        Type-5 AS External Link States&#xA;&#xA;  LS age: 23&#xA;  Options: (No TOS-capability, DC, Downward)&#xA;  LS Type: AS External Link&#xA;  Link State ID: 172.16.192.0 (External Network Number )&#xA;  Advertising Router: 172.18.255.1&#xA;  LS Seq Number: 80000001&#xA;  Checksum: 0x9D99&#xA;  Length: 36&#xA;  Network Mask: /19&#xA;    Metric Type: 2 (Larger than any link state path)&#xA;    MTID: 0&#xA;    Metric: 1&#xA;    Forward Address: 0.0.0.0&#xA;    External Route Tag: 3489667571&#xA;&#xA;asr1k/atlanta# show ip route vrf blue 172.16.192.0&#xA;&#xA;Routing Table: blue&#xA;% Network not in table&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="412" LastEditorUserId="412" LastEditDate="2017-02-14T16:00:50.793" LastActivityDate="2017-02-14T17:31:33.383" Title="Why would Type-5 AS External OSPF Route not install in routing table?" Tags="|cisco|ospf|cisco-ios-15|cisco-asr|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38917" PostTypeId="2" ParentId="38915" CreationDate="2017-02-14T00:44:36.783" Score="3" Body="&lt;p&gt;The issue is right here in your database output:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Options: (No TOS-capability, DC, Downward)&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the point of redistribution the Down bit is being set as a loop prevention mechanism.  By itself this wouldn't necessarily be a bad thing but you're also clearing the domain tags that are otherwise being set at the point of redistribution.  This mechanism is described &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/118800-configure-ospf-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; and, basically, is such that any downstream ASBR that sees an OSPF entry with that down bit set &lt;em&gt;and an identical or missing domain ID&lt;/em&gt; is not going to allow it as an installed route. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, it's basically a loop prevention mechanism.  Try removing the &lt;code&gt;tag 0&lt;/code&gt; statement from the redistribution on the Dallas router.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It also might be a smart thing to have some kind route-maps on the redistribution to have both an explicit degree of control over what's passing between domains as well as a mechanism to control route attributes/metrics (just one example: type-1's can be really nice for choosing between multiple ASBR's based on IGP, but being able to selectively manipulate metrics based on BGP communities can be worth its weight).  This is purely just a hygiene suggestion, though.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-14T00:44:36.783" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38918" PostTypeId="2" ParentId="38915" CreationDate="2017-02-14T02:53:10.653" Score="6" Body="&lt;p&gt;&lt;code&gt;capability vrf-lite&lt;/code&gt; is missing under &lt;code&gt;router ospf&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This article has a good explanation.  Essentially, the command tells OSPF to ignore the DN bit and use the LSA in the SPF calculations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/12754196/where-configure-capability-vrf-lite-ce-or-pe&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://supportforums.cisco.com/discussion/12754196/where-configure-capability-vrf-lite-ce-or-pe&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34435" LastEditorUserId="-1" LastEditDate="2017-02-14T17:31:33.383" LastActivityDate="2017-02-14T17:31:33.383" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38921" PostTypeId="1" CreationDate="2017-02-14T11:20:03.323" Score="1" ViewCount="2572" Body="&lt;pre&gt;&lt;code&gt;%Apr 30 11:32:06:216 2000 ICT ARP/4/RATELIMIT: The ARP packet rate(178pps) exceeded the rate limit(50pps) on interface GigabitEthernet1/0/24 in the last 60 seconds.&#xA;%Apr 30 11:33:06:824 2000 ICT ARP/4/RATELIMIT: The ARP packet rate(170pps) exceeded the rate limit(50pps) on interface GigabitEthernet1/0/24 in the last 60 seconds.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What could be the cause?&lt;/p&gt;&#xA;" OwnerUserId="34442" LastEditorUserId="20757" LastEditDate="2017-02-14T13:35:02.657" LastActivityDate="2017-06-14T18:39:02.453" Title="Why HP comware shows &quot;ARP limit exceded&quot;?" Tags="|hp|switchport|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38925" PostTypeId="2" ParentId="38869" CreationDate="2017-02-14T16:30:36.170" Score="1" Body="&lt;p&gt;This type of NAT with outside at the end of nat command called outside NAT.&#xA;For outside NAT (from low security level  to higher security level), you need to use the outside keyword in the nat command. Because if NAT control enabled you can't pass traffic from lower to higher security level without nat configured.&#xA;For example for DMZ hosts to communicate with insude hosts ,nat outside should be configured&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-02-14T16:30:36.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38926" PostTypeId="2" ParentId="38921" CreationDate="2017-02-14T16:37:21.450" Score="2" Body="&lt;p&gt;Possibilities I see:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;An ARP scan is being done by the host either in an NMAP capacity (NMAP is used to create a 'picture' so to speak of your network. This could be done for malicious reasons.)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;For something non-malicious such as printer/other device discovery as in the following article: &lt;a href=&quot;https://blogs.technet.microsoft.com/nettracer/2010/08/05/excessive-arp-requests-is-it-malware-or-legitimate-activity/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blogs.technet.microsoft.com/nettracer/2010/08/05/excessive-arp-requests-is-it-malware-or-legitimate-activity/&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You may have assymetric routing, as in the case of this example: &lt;a href=&quot;http://iosadchuk.blogspot.com/2012/08/dependence-between-arp-max-age-time-and.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://iosadchuk.blogspot.com/2012/08/dependence-between-arp-max-age-time-and.html&lt;/a&gt; which results in a unicast flood.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;HP Comware is showing the ARP rate is exceeded because one of these options may send out ARP requests at an extreme rate (in your case 178 packets per second) while your switchport is set to allow a maximum of 50 pps. &lt;/p&gt;&#xA;" OwnerUserId="23997" LastActivityDate="2017-02-14T16:37:21.450" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38929" PostTypeId="1" AcceptedAnswerId="38934" CreationDate="2017-02-14T18:26:40.000" Score="1" ViewCount="513" Body="&lt;p&gt;How does Tacacs server forward the credentials from client to Authentication server?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does a decryption and Encryption of creds takes place? Or is it just a packet forward ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: The authentication server, i refer to would be a LDAP server to which tacacs would forward the credentials.&lt;/p&gt;&#xA;" OwnerUserId="34455" LastEditorUserId="34455" LastEditDate="2017-02-14T23:05:55.397" LastActivityDate="2021-01-24T10:02:21.130" Title="How does Tacacs server forward the credentials from client to Authentication server?" Tags="|cisco|authentication|tacacs|authorization|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38931" PostTypeId="2" ParentId="3054" CreationDate="2017-02-14T20:27:14.297" Score="0" Body="&lt;p&gt;Fundamentally the problem is the TCP implementation doesn't know what the application is going to do next. When the server application makes a sequence of writes the stack doesn't know whether the writes it has received so-far are the whole sequence or only part of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the time the server application makes writes to the buffer quicker than the network stack is able to empty it. So the buffer is full and full-sized packets come out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But sometimes something else slows the server application down. Maybe waiting for a disk read on an overloaded disk array or something. So the buffer empties and the network stack has to choose between sending out a smaller packet (more overhead) or waiting for data that may never come (adding delay).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-14T20:27:14.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38934" PostTypeId="2" ParentId="38929" CreationDate="2017-02-15T03:21:10.973" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;RADIUS was designed to authenticate and log dial-up remote users to a&#xA;  network, and TACACS+ is used most commonly for administrator access to&#xA;  network devices like routers and switches.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.tacacs.net/docs/TACACS_Advantages.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.tacacs.net/docs/TACACS_Advantages.pdf&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hEqrq.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hEqrq.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-15T03:21:10.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38935" PostTypeId="2" ParentId="34987" CreationDate="2017-02-15T03:26:45.673" Score="0" Body="&lt;p&gt;If I were you I'd take a different approach and poll the interface from a remote point/box.  If the interface dies, the Arista may then have no means of sending &lt;em&gt;any&lt;/em&gt; data, so you got not email/alert.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, Maybe you poll &lt;em&gt;it&lt;/em&gt;.  Look in their documentation for a RESTapi to poll.  If you find one, have a look at my opensource &lt;a href=&quot;https://github.com/rhroyston/intrest&quot; rel=&quot;nofollow noreferrer&quot;&gt;intREST product&lt;/a&gt;.  It's still in the oven but should be ready in a few weeks.  I'd love to adapt it to Arista.  Should be easy.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-15T03:26:45.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38936" PostTypeId="2" ParentId="38507" CreationDate="2017-02-15T04:00:41.770" Score="0" Body="&lt;p&gt;Found the solution, it was the issue with snmpwalk in linux system, there is no provision of selecting AES 256 and by default it takes AES128 key which was mis-mtach.&lt;/p&gt;&#xA;" OwnerUserId="34021" LastActivityDate="2017-02-15T04:00:41.770" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38937" PostTypeId="2" ParentId="38511" CreationDate="2017-02-15T04:06:40.110" Score="0" Body="&lt;p&gt;After a further discussion and readings on this, found that we can do these configurations and set authentication with one factor for certificate or two factor authentication where it uses AD and certificate for authentication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now these certificates can be circulated based on AD group policies where a group users/machines can be bind. Or the manually distribute them and install them&lt;/p&gt;&#xA;&#xA;&lt;p&gt;you can use both a local CA client certificate or if you wish to get it from external trusted CA you can go for that also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configurations can be changed for both legacy remote vpn where you would change authentications in IKE component or webvpn (ssl vpn) where you simply mention the authentication type.&lt;/p&gt;&#xA;" OwnerUserId="34021" LastActivityDate="2017-02-15T04:06:40.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38940" PostTypeId="1" AcceptedAnswerId="38943" CreationDate="2017-02-15T05:56:38.680" Score="1" ViewCount="217" Body="&lt;p&gt;i am learning about Radius Server and particularly freeRadius. NAS devices are responsible for sending Authentication requests to the Radius Server. NAS devices include like Switch, wireless access points, DSLM. My question is Every Switch(different manufacturers) capable of NAS. &lt;/p&gt;&#xA;" OwnerUserId="34047" LastEditorUserId="509" LastEditDate="2017-02-15T06:20:42.387" LastActivityDate="2017-02-15T09:39:06.537" Title="Is every Switch capable of Network Access Server?" Tags="|switch|radius|aaa|route-server|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38941" PostTypeId="1" CreationDate="2017-02-15T06:53:33.597" Score="-1" ViewCount="162" Body="&lt;p&gt;I got an idea there were 3 machines. machine 1,2 amd 3.&#xA;Machine 2 ping to machine 1,  i can capture the packets by using tcpdump. But mchine 2 ping to machine 3 , then machine 1 can't capture by using tcpdump.  This process is same like wireshark ?&#xA;there wont be any packets received at machine one, when there is a communication initiated between Machine2 and Machine3.&#xA;Wireshark is a tool same like tcpdump.&#xA;There wont be any packet reaching to Machine1 from when machine 2 and machine 3 are communicating.&#xA;Is it correct ?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;To make it more clear. Open two terminals in Machine 1 and initiate a&#xA;  tcpdump in each terminals for source as machine 2 and machine 3. Keep&#xA;  this for a few hours and lets analyse the packets..  So I conclude&#xA;  that wireshark is same like tcpdump. It can't capture the request from&#xA;  machine 2 to machine 3&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -n src host 192.168.1.m2 -w output-m2-and-m3.pcap&#xA;&#xA;tcpdump -n src host 192.168.1.m3 -w output-m3-and-m2.pcap&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please tell me your comment&lt;/p&gt;&#xA;" OwnerUserId="34275" LastActivityDate="2017-02-15T14:42:07.763" Title="Wireshark can't capture packets from machine 2 to machine 3" Tags="|wireshark|linux|" AnswerCount="2" CommentCount="2" ClosedDate="2019-12-18T00:24:36.473" ContentLicense="CC BY-SA 3.0" />
  <row Id="38943" PostTypeId="2" ParentId="38940" CreationDate="2017-02-15T08:40:09.100" Score="1" Body="&lt;p&gt;No, not all switches support it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you may have learned already this is part of the &lt;a href=&quot;http://www.ieee802.org/1/pages/802.1x-2004.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE 802.1x standard&lt;/a&gt; , so the devices that support it are those who list &lt;code&gt;802.1X&lt;/code&gt; as a supported feature.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-15T08:40:09.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38944" PostTypeId="2" ParentId="38941" CreationDate="2017-02-15T09:21:46.800" Score="0" Body="&lt;p&gt;yes, I think Wireshark works similar to tcpdump. it captures the packets either incoming or outgoing on particular network interface.&lt;/p&gt;&#xA;" OwnerUserId="34467" LastActivityDate="2017-02-15T09:21:46.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38946" PostTypeId="2" ParentId="38940" CreationDate="2017-02-15T09:39:06.537" Score="0" Body="&lt;p&gt;I think most of the devices in market support forwarding EAPOL message to free radius(Authentication server) but there are several switches which are not capable of handling EAP message. Hence it might not be able to authenticate supplicant through authentication server.&lt;/p&gt;&#xA;" OwnerUserId="34467" LastActivityDate="2017-02-15T09:39:06.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38948" PostTypeId="1" CreationDate="2017-02-15T10:40:50.517" Score="0" ViewCount="5586" Body="&lt;p&gt;I have a endpoint which is on vlan x and a SNTP server on vlan Y of same cisco switch. I am trying to synchronize my time from SNTP server. endpoint is able to resolve ARP  and get the mac of SNTP server but not able to ping/connect to SNTP server. I don't understand why the endpoint is not able to synchronize time from SNTP server, i could not see NTP packets from endpoint.&lt;/p&gt;&#xA;" OwnerUserId="34467" LastActivityDate="2017-02-16T04:39:16.247" Title="Endpoint is getting ARP response but not able to ping it/ connect it" Tags="|switch|vlan|arp|ntp|" AnswerCount="3" CommentCount="5" ClosedDate="2018-07-30T22:59:31.160" ContentLicense="CC BY-SA 3.0" />
  <row Id="38949" PostTypeId="2" ParentId="38948" CreationDate="2017-02-15T10:55:06.153" Score="1" Body="&lt;p&gt;If the addresses are on different vlans it means that you have a router between them, therefore MAC address is the gateway address, not the destination.&lt;/p&gt;&#xA;" OwnerUserId="14771" LastActivityDate="2017-02-15T10:55:06.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38951" PostTypeId="1" CreationDate="2017-02-15T11:53:59.157" Score="1" ViewCount="119" Body="&lt;p&gt;I just heard about this thing called &quot;port forwarding&quot;. &#xA;Now, as far as I learned, this means I can attach my IP adress to some port on the router.&#xA;But why should I do it if the software on my computer automatically (of course through the code) can attach itself to some port on the router (i.e. &quot;bind()&quot; function).?&lt;/p&gt;&#xA;" OwnerUserId="34475" LastEditorUserId="2142" LastEditDate="2017-02-15T12:06:58.477" LastActivityDate="2017-05-16T21:43:04.113" Title="Why do we need &quot;port forwording&quot; if we can connect to the port ourselves?" Tags="|network|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38952" PostTypeId="2" ParentId="38951" CreationDate="2017-02-15T12:04:12.913" Score="2" Body="&lt;p&gt;Port forwarding is not usually found in a true enterprise environment but may be used in a SOHO network when the router IP is the only public IP used.  It enables incoming traffic to a certain port on the router to be forwarded to a defined IP and port (which is not necessarily the same port).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Software on your PC cannot bind to a port directly on the router, but even so it is possible to get a clash, therefore you must choose your ports accordingly.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-02-15T12:04:12.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38953" PostTypeId="1" AcceptedAnswerId="38955" CreationDate="2017-02-15T12:53:34.183" Score="0" ViewCount="406" Body="&lt;p&gt;I try to ping something out with a PC/Router IP address 10.57.1.2 with the following Ping Request and Ping Reply received&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ping Request&#xA;Source      10.57.1.2&#xA;Destination 192.168.31.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reply&#xA;source      10.32.103.3&#xA;Destination 10.57.1.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the PC/Router be treated a successful ping&lt;/p&gt;&#xA;" OwnerUserId="25534" LastEditorUserId="8499" LastEditDate="2018-12-21T05:10:13.800" LastActivityDate="2018-12-21T05:10:13.800" Title="ICMP Ping Request/Reply" Tags="|ping|icmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38954" PostTypeId="2" ParentId="3054" CreationDate="2017-02-15T13:00:23.073" Score="0" Body="&lt;p&gt;If you look at frame 34, you will see that the server has transmitted a 32kB buffer and that the PSH bit is set.  If you look at 82 you will see the same, 32 kB from the previous PSH bit. Packet 52 has a PSH bit even though there has been less than 2kB of the response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PSH bit is typically set by a TCP stack for the last segment of an application PDU written to the network.  So the application uses a 32kB buffer and when there is a lot of data, writes it to the TCP socket 32kB at a time.  When there is less data as in frames 51-52, it is because the application wrote out that record first in the response and it was only 1820 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice that the application that I refer to may in fact not be the server application itself but some intermediate software such as a Java Virtual Machine (JVM) or whatever.  It's not clear from the data content why that 1820 byte PDU was sent, perhaps a 32kB buffer wasn't available at the time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point is that it shouldn't matter, there's no substantive performance penalty.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-02-15T13:00:23.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38955" PostTypeId="2" ParentId="38953" CreationDate="2017-02-15T13:14:48.963" Score="1" Body="&lt;p&gt;It's a success if that's what you're expecting.  All command-line ping programs I've seen will display where the replies have come from.  If you send a braodcast ping you will often get multiple replies, and the ping program will display them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pingers that are built into network equipment may behave differently, in particular if you are pinging for a load-balancer liveness test then you'll have to check your particular load-balancer to see if the different source is accepted.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-02-15T13:14:48.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38956" PostTypeId="1" CreationDate="2017-02-15T14:13:31.573" Score="1" ViewCount="887" Body="&lt;p&gt;I have set up a Router on a stick configuration with a Cisco 1841 router, a Cisco 2960 switch, and ESXi server. I am new to this concept and looking for some clarifications.&#xA;Here is my set up:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Router:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;f0/0 : no ip addrr   (?? is this correct)&#xA;f0/0.1 : native vlan 1 - 10.0.0.1/24&#xA;f0/0.2 : vlan 2 - 10.0.2.2/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;DHCP pool is configured for 10.0.0.1 and 10.0.2.2 networks &lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT is configured for 10.0.0.1/24 and 10.0.2.2/24 networks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One trunk port to Router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another trunk port to ESXi&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ESXi:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A virtual machine group with &quot;All VLANS&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I have is that when I connect a VM to the &quot;ALL VLANS&quot; portgroup, I am not able to configure the network. I have the same problem when I create a port group with VLAN1 in ESXi and connect a VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it works fine for a port group with vlan 2. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I am connecting trunk port to a VM is that I am installing a software called packetfence which needs a trunk cable plugged into the interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything that I am doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="34366" LastEditorUserId="453" LastEditDate="2017-09-14T05:15:05.663" LastActivityDate="2018-03-13T10:54:00.870" Title="Router on a stick with and ESXi" Tags="|switch|router|vlan|" AnswerCount="2" CommentCount="3" ClosedDate="2018-03-13T14:24:12.380" ContentLicense="CC BY-SA 3.0" />
  <row Id="38957" PostTypeId="2" ParentId="38956" CreationDate="2017-02-15T14:29:04.570" Score="1" Body="&lt;p&gt;Simple configuration would like this&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet 0/0&#xA;no shutdown&#xA;&#xA;&#xA;interface FastEthernet 0/0.1&#xA;encapsulation dot1Q 1 native&#xA;ip address 10.0.0.1 255.255.255.0&#xA;&#xA;&#xA;interface FastEthernet 0/0.2&#xA;encapsulation dot1Q 2&#xA;ip address 10.0.2.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface  [UPLINK_INTERFACE]&#xA;description TO_ROUTER&#xA;switchport trunk encapsulation dot1Q&#xA;switchport mode trunk&#xA;switchport trunk native vlan 1&#xA;switchport nonegotiate&#xA;switchport trunk allowed vlan 1,2&#xA;&#xA;interface [Interface_TO_VMWARE1]&#xA;no ip address&#xA;switchport trunk encapsulation dot1q&#xA;switchport trunk allowed vlan 1,2&#xA;switchport mode trunk&#xA;switchport nonegotiate&#xA;spanning-tree portfast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-02-15T15:19:18.813" LastActivityDate="2017-02-15T15:19:18.813" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38958" PostTypeId="2" ParentId="38941" CreationDate="2017-02-15T14:42:07.763" Score="0" Body="&lt;p&gt;You cannot capture any traffic that does not reach the machine that you are using to capture. If the interesting traffic is between two machines, and it never reaches your capture machine, then you can't capture it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the network topology, you may be able to mitigate the problem. For example, setting up SPAN on an ethernet LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-15T14:42:07.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38962" PostTypeId="1" CreationDate="2017-02-15T16:11:42.910" Score="1" ViewCount="224" Body="&lt;p&gt;I have similiary situation like in question &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/32946/increase-transfer-rate-with-link-agreggation&quot;&gt;Increase transfer rate with Link Agreggation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But with some different purposes - need increas backup speed. &#xA;&lt;strong&gt;ServerA&lt;/strong&gt; - backup media server (Win2008r2);&#xA;&lt;strong&gt;ServerF&lt;/strong&gt; - file share (Win2012);&#xA;and switch (24x 1Gbit support LACP, Link Agg etc)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both of servers has two 1Gbit network adapters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem - backup task runs too many hours (more 3TBs in each task). After perfome configuration LACP on both servers and switch ports - upset: &#xA;copy file between hosts - speed not growth upper 113megabytes\sec. I try measure if iperf - same result.&#xA;One positive thing - while different clients copy files each use approximate 1Gbit (140-150megabytes together).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After seaching on web - found same discussion were explaned aggregation speed behavior: &lt;strong&gt;no speed increase for one stream (IP &gt; IP).&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe some other protocols can help me speedup backup jobs tasks ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE 1:&lt;/strong&gt;&#xA;In this brochure (page 9) &#xA;&lt;a href=&quot;https://blog.pingus.de/wp-content/uploads/2016/11/Backup-Exec-Best-Practices-Guide-v.4.0.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://blog.pingus.de/wp-content/uploads/2016/11/Backup-Exec-Best-Practices-Guide-v.4.0.pdf&lt;/a&gt; comparsion table consist mark about teaming with 200MB\s speed.&#xA;Video &lt;a href=&quot;https://www.youtube.com/watch?v=O7V0qz6Q1mw&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.youtube.com/watch?v=O7V0qz6Q1mw&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34478" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-02-16T11:51:02.793" Title="Increase network bandwidth" Tags="|ieee-802.1ax|network|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38963" PostTypeId="2" ParentId="38962" CreationDate="2017-02-15T16:17:33.803" Score="1" Body="&lt;p&gt;Link aggregation increases the bandwidth for multiple flows. A backup job (single flow) will remain the same at what a single link can do because each flow only uses a single link. Multiple flows use multiple links, and the bandwidth is higher on average across the multiple flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Really, the only thing you can do is to use a faster network link. You probably want a dedicated 10 Gb, or faster, link between the production and backup server.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-15T16:17:33.803" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38965" PostTypeId="2" ParentId="38962" CreationDate="2017-02-15T17:12:59.527" Score="1" Body="&lt;p&gt;Link aggregation works under specific scenerio:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switch has 1 host connected to it with ingress traffic at 100 mbps.&#xA;Now at the egress port has 5 links connected through etherchannel capable of providing 1gbps. You will still find your speed stuck at 100 because the ma incoming traffic is 100 mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, load balancing takes place based on several parameters, if the parameter is source ip and you have just one host, in your case while copying files, you will not see significant increase because the source of all packets is the same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-02-15T17:12:59.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38966" PostTypeId="1" AcceptedAnswerId="39016" CreationDate="2017-02-15T19:08:41.033" Score="1" ViewCount="1162" Body="&lt;p&gt;I am in the progress of doing ISSU upgrades on some nexus 7710 chassis' with dual supervisor modules. I set a ping test that to traverse across the switch shortly before the upgrade and experienced about 15-20 seconds of lost pings. Is this test scenario a good one and does this amount of downtime seem acceptable? Is cisco's marketing on this feature just bs? I see the same behavior for a supervisor switchover as well. &lt;/p&gt;&#xA;" OwnerUserId="15501" LastActivityDate="2017-02-17T14:07:02.607" Title="How long of an outage for ISSU Nexus Upgrade?" Tags="|cisco|cisco-nexus|cisco-nx-os|cisco-nexus-7k|nx-os|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38967" PostTypeId="1" CreationDate="2017-02-15T19:09:04.120" Score="4" ViewCount="1186" Body="&lt;p&gt;I manage a mid-sized Industrial automation network. I have roughly 10 client machines and 4 server machines. &#xA;Up until now, we didn’t have a GPS clock in the network. One of the machines, server-A, was working as a time server &amp;amp; NTP was used to sync other machines. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that we are installing this new GPS clock I need to configure server-A to receive the time from the GPS clock so that all the Clients + Servers will get time-synced with the GPS clock. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have manageable Cisco switches in the network and I want to know if I need to plan to do time sync for the switches as well? I did not think so, but I am not sure.  Can you please explain why time sync is required on managed switches and what may go wrong if these switches do not have synchronized times?&lt;/p&gt;&#xA;" OwnerUserId="34482" LastEditorUserId="8499" LastEditDate="2018-12-17T01:19:29.200" LastActivityDate="2018-12-17T01:19:29.200" Title="Cisco Switch - Why do I need to do time synchronization for them" Tags="|cisco|switch|ntp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38968" PostTypeId="2" ParentId="38967" CreationDate="2017-02-15T19:13:53.720" Score="3" Body="&lt;p&gt;Your network devices (routers, switches, etc.) should be using NTP to keep their times synchronized. The primary benefit is for the logs and troubleshooting. When you look in the logs on your syslog server while trying to troubleshoot network problems, your job will be much more difficult if the times are not synchronized.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-15T19:13:53.720" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="38969" PostTypeId="2" ParentId="38948" CreationDate="2017-02-15T19:23:35.707" Score="0" Body="&lt;p&gt;You need to verify the MAC address of the ARP response you get for the SNTP server. Determine if it's the MAC of the server, or the MAC of the default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also check the IP configuration settings on both hosts, and both the vlans. The symptoms are similar to an IP configuration issue.&lt;/p&gt;&#xA;" OwnerUserId="34415" LastActivityDate="2017-02-15T19:23:35.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38970" PostTypeId="2" ParentId="38966" CreationDate="2017-02-15T19:28:07.753" Score="2" Body="&lt;p&gt;The best tip I can give for anything involving ISSU on 7K's is to read- and re-read- the release notes.  There are very specific versions that are supported as origin/destination and there are also some features that are going to work better with ISSU than others.  The other caveat to consider is that in some instances there may be requirements for firmware or EPLD upgrades that could create a brief outage (again - usually mentioned in release notes).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general I can tell you that the ISSU process &lt;em&gt;can&lt;/em&gt; be truly hitless but that you need to stick within the limits of what QA has specifically validated. &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-15T19:28:07.753" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38971" PostTypeId="1" CreationDate="2017-02-15T19:29:58.627" Score="1" ViewCount="106" Body="&lt;p&gt;Is possible to consider via IPFIX only the first n seconds of a flow (statistics)? How to set this in OpenVSwitch if possible?&lt;/p&gt;&#xA;" OwnerUserId="34212" LastEditorUserId="34212" LastEditDate="2017-02-15T20:22:51.413" LastActivityDate="2017-02-16T04:01:49.610" Title="IPFIX - consider only first n seconds of a flow" Tags="|packet-analysis|ipfix|ovs|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="38972" PostTypeId="2" ParentId="34807" CreationDate="2017-02-15T21:20:30.753" Score="1" Body="&lt;p&gt;&lt;em&gt;Option 43&lt;/em&gt; is different from others DHCP options, you can re-define internal length or sub options. In &lt;strong&gt;INFOBLOX&lt;/strong&gt; (as you can read on the admin guide pag 803) you have to put hexadecimal value divided by colon &quot;:&quot; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;04:0c:12:34:0b:12&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="25157" LastActivityDate="2017-02-15T21:20:30.753" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="38974" PostTypeId="2" ParentId="7548" CreationDate="2017-02-15T21:31:06.547" Score="0" Body="&lt;p&gt;Easiest solution? put a &lt;strong&gt;router&lt;/strong&gt; in the WAN, without NAT, and you'll use your L2B mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll &lt;em&gt;lose one IP&lt;/em&gt; (Router LAN/WAN) but it'll give give you a static interface and clean config!&lt;/p&gt;&#xA;" OwnerUserId="25157" LastActivityDate="2017-02-15T21:31:06.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38975" PostTypeId="1" AcceptedAnswerId="38992" CreationDate="2017-02-15T23:03:19.843" Score="1" ViewCount="1323" Body="&lt;p&gt;I am currently trying to configure DHCP as part of a ztp setup. Right now my topology is as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ex2200(me0,10.0.20.2)-&gt;(ge-0/0/1,10.0.20.1)srx100(fe-0/0/2,10.0.80.1)&amp;lt;-(eth0,10.0.80.2)centos6.7_dhcp_server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the dhcp server on the 10.0.80.0/24 subnet, and I want it to assign IP addresses into the 10.0.20.0/24 subnet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vendor-string = option vendor-class-identifier;&#xA;option space ZTPDEMO;&#xA;option ZTPDEMO.image-file-name code 0 = text;&#xA;option ZTPDEMO.config-file-name code 1 = text;&#xA;option ZTPDEMO.image-file-type code 2 = text;&#xA;option ZTPDEMO.transfer-mode code 3 = text;&#xA;option ZTPDEMO-encapsulation code 43 = encapsulate ZTPDEMO;&#xA;option ZTPDEMO.image-file-type &quot;symlink&quot;;&#xA;option option-150 code 150 = ip-address;&#xA;&#xA;host CAN1 {&#xA; hardware ethernet 80:ac:ac:4c:84:ff;&#xA; fixed-address 10.0.20.3;&#xA; option host-name &quot;to-mdf-ex22-sw5&quot;;&#xA; option vendor-class-identifier &quot;Juniper-ex2200-48p-4g;&#xA; option option-150 10.0.80.2;&#xA; option ZTPDEMO.transfer-mode &quot;http&quot;;&#xA; option ZTPDEMO.config-file-name &quot;to-mdf-ex22-sw5-config.txt&quot;;&#xA; option ZTPDEMO.image-file-name &quot;jinstall-ex-2200-15.1R5.5-domestic-signed.tgz&quot;;&#xA;}&#xA;subnet 10.0.20.0 netmask 255.255.255.0 {&#xA; option domain-name-servers 8.8.8.8;&#xA; option routers 10.0.20.1;&#xA; default-lease-time 600;&#xA; max-lease-time 7200;&#xA; authoritative;&#xA; option ZTPDEMO.transfer-mode &quot;http&quot;;&#xA; pool {&#xA;        range dynamic-bootp 10.0.20.3 10.0.20.254;&#xA;        option OPTION-150 10.0.80.2;&#xA;        option P61.config-file-name &quot;default-ex2200-c-12p.config&quot;;&#xA;      }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And here is the error I receive:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb 15 06:26:35 localhost dhcpd: Internet Systems Consortium DHCP Server 4.1.1-P1&#xA;Feb 15 06:26:35 localhost dhcpd: Copyright 2004-2010 Internet Systems Consortium.&#xA;Feb 15 06:26:35 localhost dhcpd: All rights reserved.&#xA;Feb 15 06:26:35 localhost dhcpd: For info, please visit https://www.isc.org/software/dhcp/&#xA;Feb 15 06:26:35 localhost dhcpd: Not searching LDAP since ldap-server, ldap-port and ldap-base-dn were not specified in the config file&#xA;Feb 15 06:26:35 localhost dhcpd: Wrote 0 deleted host decls to leases file.&#xA;Feb 15 06:26:35 localhost dhcpd: Wrote 0 new dynamic host decls to leases file.&#xA;Feb 15 06:26:35 localhost dhcpd: Wrote 0 leases to leases file.&#xA;Feb 15 06:26:35 localhost dhcpd: &#xA;Feb 15 06:26:35 localhost dhcpd: No subnet declaration for eth0 (10.0.80.2).&#xA;Feb 15 06:26:35 localhost dhcpd: ** Ignoring requests on eth0.  If this is not what&#xA;Feb 15 06:26:35 localhost dhcpd:    you want, please write a subnet declaration&#xA;Feb 15 06:26:35 localhost dhcpd:    in your dhcpd.conf file for the network segment&#xA;Feb 15 06:26:35 localhost dhcpd:    to which interface eth0 is attached. **&#xA;Feb 15 06:26:35 localhost dhcpd: &#xA;Feb 15 06:26:35 localhost dhcpd: &#xA;Feb 15 06:26:35 localhost dhcpd: Not configured to listen on any interfaces!&#xA;Feb 15 06:26:35 localhost dhcpd: &#xA;Feb 15 06:26:35 localhost dhcpd: This version of ISC DHCP is based on the release available&#xA;Feb 15 06:26:35 localhost dhcpd: on ftp.isc.org.  Features have been added and other changes&#xA;Feb 15 06:26:35 localhost dhcpd: have been made to the base software release in order to make&#xA;Feb 15 06:26:35 localhost dhcpd: it work better with this distribution.&#xA;Feb 15 06:26:35 localhost dhcpd: &#xA;Feb 15 06:26:35 localhost dhcpd: Please report for this software via the CentOS Bugs Database:&#xA;Feb 15 06:26:35 localhost dhcpd:     http://bugs.centos.org/&#xA;Feb 15 06:26:35 localhost dhcpd: &#xA;Feb 15 06:26:35 localhost dhcpd: exiting.&#xA;[root@localhost dhcp]# service ssh start&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;A few other tidbits: iptables is off, and the port is configured statically on the server: eth0 10.0.80.2 255.255.255.0, gateway 10.0.80.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any ideas what I am doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="27412" LastActivityDate="2017-02-16T19:42:42.623" Title="Juniper ZTP DHCP Server Setup" Tags="|dhcp|juniper|juniper-srx|juniper-ex|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38977" PostTypeId="2" ParentId="38831" CreationDate="2017-02-16T02:25:31.450" Score="1" Body="&lt;p&gt;I was able to fully replicate your topology in GNS3 using IOS 12.4 &lt;strong&gt;without any issues or error messages&lt;/strong&gt;, and without any changes to the configurations you provided.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2 may have had the incorrect configuration at one point which resulted in error messages on R1.  Another possibility is that R1, R3 and R4 were connected to a single SW1 at one time.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The error can also be replicated using your topology by connecting SW1 and SW2 via a single cable.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are actively receiving the error messages, I suggest double-checking your EIGRP configurations.  You can use the following commands to verify the EIGRP configuration and neighborship.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip eigrp neighbors&#xA;show running-config | section eigrp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2017-02-16T02:25:31.450" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38978" PostTypeId="2" ParentId="38971" CreationDate="2017-02-16T04:01:49.610" Score="3" Body="&lt;p&gt;So you need to understand how a given switching device defines a flow.  There's the obvious identifying stuff - the tuple of source and destination port/address, IP protocol number, etc.  There's also clearly a beginning time and, of course, an end time.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The beginning is pretty straightforward.  It's the first point at which the identifying tuple is observed.  The ending, however, is a lot trickier.  In the case of a TCP session seeing a FIN sequence might trigger a stop time but generally the flow end-time is going to be caused by either a timeout (i.e. a UDP session where a packet hasn't been seen in &lt;em&gt;n&lt;/em&gt; seconds) or - &lt;em&gt;much&lt;/em&gt; more likely in practice - the flow cache filled up and space is made for new flows by triggering the purge and export of older ones.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The thing is that the flow (as we've defined it) might not actually be over.  Indeed, a long-lived flow might actually be represented by &lt;em&gt;many&lt;/em&gt; consecutive flow records.  It's the job of the analysis tool to tie all of these individual records together into some kind of sane whole.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's for this reason that your question doesn't really make sense.  The actual flow collector/exporter likely has no idea whether the flow cache entry it's working from represents the beginning or end of the actual flow on the wire.  One of the nasty truths about flow-based collection mechanisms is that the relatively limited size of the cache means that a suitably large variation in identifying tuples on the wire can lead to a degenerate case where a flow record only sees a few packets before being pushed out.  This is why the use of these kinds of analytics on large-scale Internet core boxes tends to be pretty limited and in the places where flow-based measurement is occurring (aggregation/edge platforms) that it's almost exclusively sampled. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - if you want to only look at the first few seconds of a flow then set the aging time on the collection device to be very short.  This will result in lots of flow records being exported (and lots more resources consumed) but will give you data on a very short interval.  In turn, at the point of analysis you can choose to ignore all but the first record generated.  I don't see the win to such an approach, but it at least nominally fits what you're asking for.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-16T04:01:49.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38979" PostTypeId="2" ParentId="38948" CreationDate="2017-02-16T04:39:16.247" Score="0" Body="&lt;p&gt;Since you have refused to provide the requested information that we need to correctly answer your question, and based on your comment, it sounds like you are leaking both layer-2 LANs to the SNTP server, but that doesn't help you with the layer-3 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your host (endpoint), with an address on VLAN X, is trying to communicate with another host (the server), with an address on VLAN Y. The addresses are on different layer-3 networks. A host will use ARP to resolve a layer-3 address to a layer-2 address if both host addresses are on the same layer-3 network. If the destination host is on a different layer-3 network, the source host will use the layer-2 address of its configured gateway. Traffic between different layer-3 addresses must go through a router (the host's configured gateway).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That applies to both hosts in a bidirectional protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want a server to be directly connected to both VLANs, you need the switch to trunk both VLANs to the server, and the server interface must be configured as a trunk, and the server must have an address in each VLAN. How you configure the server for that is off-topic here.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-16T04:39:16.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38981" PostTypeId="1" AcceptedAnswerId="38986" CreationDate="2017-02-16T10:59:39.203" Score="1" ViewCount="112" Body="&lt;p&gt;So now that I can understand that there wont be any packets received at machine one, when there is a communication initiated between Machine2 and Machine3.&#xA;Now I am testing API's using postman. First I am open wireshark and catpure filter by type tcp port 80 and click on the wlan interface and then open postman send a http request. then I see on the wrieshark GUI .Then I got some encrypted data list. But her shows incomplete data &quot;56595sdfdfdf3d.....&quot;. So please help me what are the important points that I should take care of inside the packets. I got the encrypted data why it is incomplete..?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Calling  local API to my machine.  And Checking  all the packets in wireshark.  What should I analyse the content of each packet ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see the data shows incomplete why ?&#xA;Here is an example -&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Data (42 bytes)&#xA;Data: cf0b0800000100002000079898000b980000ffffffff0000...&#xA;0000 01 50 43 00 00 00 94 de 80 7e 7a fa 91 00 00 00&#xA;0010 40 fa cf 0b 08 00 00 01 00 00 20 00 07 98 98 00&#xA;0020 0b 98 00 00 ff ff ff ff 00 00 00 00 00 00 00 00&#xA;0030 00 00 00 00 00 00 00 00 00 00 00 00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34275" LastEditorUserId="34275" LastEditDate="2017-02-20T07:26:16.817" LastActivityDate="2017-02-20T07:26:16.817" Title="Important points that I should take care inside packets by using wireshark" Tags="|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38983" PostTypeId="2" ParentId="38962" CreationDate="2017-02-16T11:51:02.793" Score="1" Body="&lt;p&gt;As explained by @john and @Ron Maupin, link aggregation is so that a single flow will always use the same physical link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's no standard network protocol that will help you in your scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the backup exec documentation and video&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the PDF mention teaming, but this is useful when running concurrent backups toward the same device&lt;/li&gt;&#xA;&lt;li&gt;the video clearly show that the traffic doesn't go higher than 2.4Gbs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;First you have to make sure that the network is the culprit. Quite often the limiting factor is the disk subsystem rather than the network.&lt;br&gt;&#xA;Depending of the software and feature used (compression...) the CPU may also limit the transfer speed.&#xA;This is valid for both sides of the transfer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Outside of network itself, you may change your backup strategy. Weekly full backup with daily incremental backup, compression, block-level differential backups are some way you can investigate, but all of this is for &lt;a href=&quot;https://serverfault.com/&quot;&gt;serverfault&lt;/a&gt; rather than network engineering.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2017-02-16T11:51:02.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38986" PostTypeId="2" ParentId="38981" CreationDate="2017-02-16T14:50:16.460" Score="0" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;What should I analyse the content of each packet ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;That depends on what type of packets you are looking at, and what you want to glean from the packets. For example, IPv4 and IPv6 have different packet headers.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPv4 packet header&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    0                   1                   2                   3&#xA;    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |Version|  IHL  |Type of Service|          Total Length         |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |         Identification        |Flags|      Fragment Offset    |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |  Time to Live |    Protocol   |         Header Checksum       |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                       Source Address                          |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                    Destination Address                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                    Options                    |    Padding    |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;IPv4 packets can be fragmented, so multiple packets may be needed to recreate the original packet.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2460#section-3&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPv6 packet header&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |Version| Traffic Class |           Flow Label                  |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |         Payload Length        |  Next Header  |   Hop Limit   |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                                                               |&#xA;   +                                                               +&#xA;   |                                                               |&#xA;   +                         Source Address                        +&#xA;   |                                                               |&#xA;   +                                                               +&#xA;   |                                                               |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                                                               |&#xA;   +                                                               +&#xA;   |                                                               |&#xA;   +                      Destination Address                      +&#xA;   |                                                               |&#xA;   +                                                               +&#xA;   |                                                               |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;IPv6 can also have different extension headers.&lt;/p&gt;&#xA;&lt;p&gt;Based on the packet headers, you can discover the type of payload, and where the payload starts. Usually, but not always, the packet payload will be either TCP or UDP. TCP and UDP have their own headers.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ietf.org/rfc/rfc768.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;UDP header&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;              0      7 8     15 16    23 24    31  &#xA;             +--------+--------+--------+--------+ &#xA;             |     Source      |   Destination   | &#xA;             |      Port       |      Port       | &#xA;             +--------+--------+--------+--------+ &#xA;             |                 |                 | &#xA;             |     Length      |    Checksum     | &#xA;             +--------+--------+--------+--------+ &#xA;             |                                     &#xA;             |          data octets ...            &#xA;             +---------------- ...                 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc793&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP header&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;    0                   1                   2                   3&#xA;    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |          Source Port          |       Destination Port        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                        Sequence Number                        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                    Acknowledgment Number                      |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |  Data |           |U|A|P|R|S|F|                               |&#xA;   | Offset| Reserved  |R|C|S|S|Y|I|            Window             |&#xA;   |       |           |G|K|H|T|N|N|                               |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |           Checksum            |         Urgent Pointer        |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                    Options                    |    Padding    |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;   |                             data                              |&#xA;   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;The payload for UDP or TCP is the application data being transferred. The contents of the payload are only meaningful in the context of the application using the protocol for transport. As you suggest, the data may be encrypted, and there are different encryption schemes used by different applications. Some applications have application-layer protocols with headers, and some do not, but application-layer protocols are explicitly off-topic here.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-02-16T17:25:57.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38987" PostTypeId="1" AcceptedAnswerId="38988" CreationDate="2017-02-16T15:28:26.070" Score="1" ViewCount="4648" Body="&lt;p&gt;If I am receiving data through UDP, with a checksum that checks out to show no data loss, is there a possibility that the checksum missed some errors. My data transmitted is split into 24-bits chunks by the protocol that uses the checksum. Similarly, if errors are detected through the checksum, does that fully guarantee that the error actually occured?&lt;/p&gt;&#xA;" OwnerUserId="34499" LastEditorUserId="8499" LastEditDate="2017-02-16T17:20:05.207" LastActivityDate="2017-02-16T20:32:34.547" Title="Is there any way a UDP checksum could be inconclusive of error detection?" Tags="|tcp|udp|layer4|checksum|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38988" PostTypeId="2" ParentId="38987" CreationDate="2017-02-16T15:54:32.950" Score="1" Body="&lt;p&gt;If you mean the optional (for IPv4, but required for IPv6) UDP checksum, then that creates a 16-bit checksum that conceptually matches multiple combinations of datagrams that are larger than 16-bits. There is no guarantee that a UDP datagram that matches the checksum is error-free, but the odds of an error are very small. Many errors that would match the checksum would prevent the datagram from reaching its destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the checksum indicates an error, then something is wrong somewhere, and it is almost always corruption in the datagram. Other possibilities include an incorrect or buggy checksum algorithm on the part of the sender or receiver.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you mean a checksum in the application data, that further protects the data, but that is off-topic here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also the possibilities that bits get flipped in RAM or on a disk drive. It does happen, but not very often. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://www.ietf.org/rfc/rfc768.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 768, User Datagram Protocol&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Checksum is the 16-bit one's complement of the one's complement sum of&#xA;  a pseudo header of information from the IP header, the UDP header, and&#xA;  the data,  padded  with zero octets  at the end (if  necessary)  to &#xA;  make  a multiple of two octets.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The pseudo  header  conceptually prefixed to the UDP header contains&#xA;  the source  address,  the destination  address,  the protocol,  and&#xA;  the  UDP length.   This information gives protection against misrouted&#xA;  datagrams. This checksum procedure is the same as is used in TCP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;              0      7 8     15 16    23 24    31 &#xA;             +--------+--------+--------+--------+&#xA;             |          source address           |&#xA;             +--------+--------+--------+--------+&#xA;             |        destination address        |&#xA;             +--------+--------+--------+--------+&#xA;             |  zero  |protocol|   UDP length    |&#xA;             +--------+--------+--------+--------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;If the computed  checksum  is zero,  it is transmitted  as all ones&#xA;  (the equivalent  in one's complement  arithmetic).   An all zero &#xA;  transmitted checksum  value means that the transmitter  generated  no&#xA;  checksum  (for debugging or for higher level protocols that don't&#xA;  care).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-16T20:32:34.547" LastActivityDate="2017-02-16T20:32:34.547" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38992" PostTypeId="2" ParentId="38975" CreationDate="2017-02-16T19:42:42.623" Score="1" Body="&lt;p&gt;Okay, solution found. Expanded subnet, and made some config changes on srx (had ports configured for wrong family).&lt;/p&gt;&#xA;" OwnerUserId="27412" LastActivityDate="2017-02-16T19:42:42.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="38993" PostTypeId="1" AcceptedAnswerId="38994" CreationDate="2017-02-16T19:46:33.773" Score="2" ViewCount="448" Body="&lt;p&gt;What is the maximum sequence number you can use in crypto map with IOS-XE?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or to ask a slightly different question, how many sequences can you have in a crypto map?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't find any limits in the command reference.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-02-16T20:24:13.333" Title="What is the maximum crypto map sequence number in IOS-XE?" Tags="|vpn|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38994" PostTypeId="2" ParentId="38993" CreationDate="2017-02-16T20:24:13.333" Score="1" Body="&lt;p&gt;65535? This is a csr1000v and what it said was:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/yuvae.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/yuvae.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Lb0Rx.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Lb0Rx.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-16T20:24:13.333" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38997" PostTypeId="2" ParentId="25271" CreationDate="2017-02-16T23:53:37.430" Score="1" Body="&lt;p&gt;I admit, I have never attempted this before.  However, it appears you should be able to with a properly configured custom &amp;quot;&lt;strong&gt;Event List&lt;/strong&gt;&amp;quot;.&lt;/p&gt;&#xA;&lt;p&gt;According to the Cisco ASDM User Guide (excerpts):&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Event Lists&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The Event Lists pane lets you create custom lists of events that are used to choose which syslog messages are sent to a&#xA;specific destination. After you enable logging and configure the&#xA;logging parameters using the Logging Setup pane, create one or more&#xA;lists of events in the Event Lists pane. Use these event lists in the&#xA;Logging Filters pane to specify a logging destination for each list of&#xA;events. To access this pane, choose &lt;strong&gt;Configuration &amp;gt; Device&#xA;Management &amp;gt; Logging &amp;gt; Event Lists.&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;To create custom lists of events to send to a specific logging&#xA;destination, perform the following steps:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Click Add to display the Add Event List dialog box.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the Name field, enter the name of the event list. No spaces are allowed.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the Event Class/Severity area, click Add to display the Add Class and Severity Filter dialog box.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Choose the event class from the drop-down list.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Choose the severity level from the drop-down list.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click OK to close this dialog box.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the Message ID Filters area, click Add to display the Add Syslog&#xA;Message ID Filter dialog box.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In the Message IDs field, enter a syslog message ID or range of IDs&#xA;(for example, 101001-199012) to include in the filter.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click OK to close this dialog box.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/asdm/6_1/user/guide/usergd/cfglog.html#wp1201753&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com/c/en/us/td/docs/security/asdm/6_1/user/guide/usergd/cfglog.html#wp1201753&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The line up/down Message ID can be found in the &amp;quot;Cisco ASA Series Syslog Messages&amp;quot; documentation.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;%ASA-1-105006: (Primary) Link status Up on interface interface_name.&#xA;%ASA-1-105007: (Primary) Link status Down on interface interface_name.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logsevp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logsevp.html&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;I would be interested in the resulting configuration.&lt;/p&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-02-16T23:53:37.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="38998" PostTypeId="1" AcceptedAnswerId="38999" CreationDate="2017-02-17T00:15:26.640" Score="5" ViewCount="9469" Body="&lt;p&gt;As I understand VXLAN, it looks like it should be able to encapsulate and properly route VLAN-tagged traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in investigating how to actually configure VXLAN on network devices, it looks like vendors such as Cisco and Arista and Juniper do something like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Set up the physical ethernet port as a VLAN access port on e.g. VLAN 100&lt;/li&gt;&#xA;&lt;li&gt;Configure a VLAN-&gt;VNI mapping which maps VLAN 100 to whatever VNI you want&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For example, see the configuration at the end of &lt;a href=&quot;https://eos.arista.com/vxlan-without-controller-for-network-virtualization-with-arista-physical-vteps/&quot; rel=&quot;noreferrer&quot;&gt;https://eos.arista.com/vxlan-without-controller-for-network-virtualization-with-arista-physical-vteps/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I want to specify that &lt;em&gt;all&lt;/em&gt; traffic, regardless of VLAN tag, which enters a physical port should be put on a specific VNI with no modification of VLAN tags at any point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I misunderstanding the configuration in that example, or are there alternate ways to configure VXLAN? I'm particularly interested in Arista, so if anyone with Arista expertise can chime in, I would appreciate it.&lt;/p&gt;&#xA;" OwnerUserId="34513" LastEditorUserId="8499" LastEditDate="2019-01-04T05:53:33.520" LastActivityDate="2019-01-04T05:53:33.520" Title="How to encapsulate all VLAN traffic inside VXLAN" Tags="|vlan|trunk|vxlan|arista|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="38999" PostTypeId="2" ParentId="38998" CreationDate="2017-02-17T00:56:08.300" Score="5" Body="&lt;p&gt;I think you are confusing a couple of concepts. Looking at the last configuration section of the document you have linked:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;7.2) VXLAN without CVX&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;Configuration on VTEPs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;vlan 100&#xA;vlan 200&#xA;!&#xA;interface Ethernet 1&#xA;  switchport access vlan 100&#xA;!&#xA;interface Ethernet 2&#xA;  switchport mode trunk&#xA;  switchport trunk allowed vlan 100,200&#xA;!&#xA;interface loopback 1&#xA; ip address 1.1.1.1/32&#xA;!&#xA;interface Vxlan 1&#xA;  vxlan source-interface loopback 1&#xA;  vxlan vlan 100 vni 10100&#xA;  vxlan vlan 200 vni 10200&#xA;  vxlan vlan 100 flood vtep 2.2.2.2 4.4.4.4&#xA;  vxlan vlan 200 flood vtep 2.2.2.2 3.3.3.3 4.4.4.4&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Notice that the VXLAN interface, &lt;code&gt;Vxlan 1&lt;/code&gt; has multiple VNIs, just like a trunk has multiple VLANs with tags. Basically, a VNI on a VXLAN is like a VLAN on a trunk. You shouldn't expect that an access interface allow any frames from tagged VLANs, nor should you expect a trunk interface to allow VLANs other than what it is configured to allow. Neither should a VNI have any traffic other than its corresponding VLAN, nor should a VXLAN interface allow traffic for VLANs for which it is not configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really, really don't want frames with &lt;em&gt;any&lt;/em&gt; VLAN tag coming into the access interface &lt;code&gt;Ethernet 1&lt;/code&gt;. That could lead to security problems like VLAN hopping. One would hope that frames with VLAN tags coming into an access interface would be dropped as malformed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, on interface &lt;code&gt;Ethernet 2&lt;/code&gt;, the &lt;code&gt;switchport trunk allowed vlan 100,200&lt;/code&gt; instructs that all incoming frames except those tagged as VLAN 100 or VLAN 200 be dropped, and no frames except those in the two allowed VLANs be sent. Frames tagged with other VLAN numbers will be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The interface &lt;code&gt;Vxlan 1&lt;/code&gt; will send and receive traffic for VLANs 100 and 200, just like the trunk interface  &lt;code&gt;Ethernet 2&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-17T00:56:08.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39003" PostTypeId="1" AcceptedAnswerId="39004" CreationDate="2017-02-17T05:23:51.427" Score="2" ViewCount="1191" Body="&lt;p&gt;In our environment we are noticing packet drops (with reason &quot;No SA Found&quot;) during the SA re-keying. The traffic rate is about 1.2Gbps (pkt size: 800 bytes) and the packet drops are about 200-300 packets in one hour happening during re-keying. Is this normal? The RFC seems to acknowledge that this drop CAN happen and implementations MAY provide a solution for this. (&lt;a href=&quot;https://wiki.strongswan.org/issues/1291&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.strongswan.org/issues/1291&lt;/a&gt;) Strongswan seems to have decided not to fix this. Our IP stack is proprietary, however I would like to know if these drops are seen on other implementations like cisco or juniper and so on.&#xA;Also, what is normally the lifetime configured for an SA? We are using 1 hour, but what is normally used in real production networks?&lt;/p&gt;&#xA;" OwnerUserId="32158" LastEditorUserId="32158" LastEditDate="2017-02-17T06:30:36.747" LastActivityDate="2017-02-21T10:35:57.623" Title="IPSec : Is it normal to see packet drops during SA re-keying?" Tags="|ipsec|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39004" PostTypeId="2" ParentId="39003" CreationDate="2017-02-17T06:04:27.510" Score="2" Body="&lt;p&gt;Yes, this is quite common and I've seen it first hand for many years on both Cisco (ASA) and Juniper (SSG/SRX).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for the amount being dropped, it will depend on your PPS and your SA timer, but I generally see 1-2 seconds of loss during a re-key.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-02-17T06:04:27.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39005" PostTypeId="2" ParentId="39003" CreationDate="2017-02-17T06:29:52.047" Score="2" Body="&lt;p&gt;1.2 Gigabits per second / 8 bytes per bit = .15 Gigabytes = 150 Megabytes = 157,286,400 bytes = 196,608 * 800 byte packets per second.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Losing 200-300 packets is about a 1.2 millisecond interruption (assuming constant rate).  If this is the hit you take for an hourly re-key I think you're doing pretty well!  To put it in context it shouldn't be enough to even cause a noticeable pop - much less a disconnect - on a VOIP call.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't run any IPSec tunnels at that kind of rate but can say that I didn't generally experience anything regularly noticeable connectivity issues with router-to-router IOS-based VPN's with tens of megabits flowing.  That said, though, a millisecond or so of traffic loss would have been within the range of line noise on most Internet connections.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-17T06:29:52.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39007" PostTypeId="1" CreationDate="2017-02-17T07:26:53.217" Score="1" ViewCount="102" Body="&lt;p&gt;I need your support urgently as I've a problem in the connection between 2 servers. &#xA;Here's the below when the connection became down, but this is from the other side so I can't identify what is it ? &#xA;Ping, Telnet or Trace... I know the operation of all of them but I'm confused what is this about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6fW8m.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6fW8m.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance and will wait your reply.&lt;/p&gt;&#xA;" OwnerUserId="34519" LastActivityDate="2017-02-17T07:41:55.487" Title="Wireshark PCAP file clarification" Tags="|wireshark|pcap|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39008" PostTypeId="2" ParentId="39007" CreationDate="2017-02-17T07:41:55.487" Score="1" Body="&lt;p&gt;All the packets in your capture are SYN packets.  It is the first step of the process of establishing a TCP connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems one one device try to establish a connection with a server, and the server doesn't respond, and the device keep trying.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why the server doesn't respond, we cannot say, it can be a firewall rule or the service on the server that doesn't work properly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could check the there's actually something listening on the TCP port involved with the netstat command and check your application log.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-17T07:41:55.487" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39009" PostTypeId="1" AcceptedAnswerId="39010" CreationDate="2017-02-17T07:44:13.667" Score="1" ViewCount="152" Body="&lt;p&gt;Does anybody know how geolocation of IP addresses works? Are ISP obligated to show us real locations of IP addresses or not? How much are IP geolocation services that we can find on Internet reliable?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastActivityDate="2017-02-17T08:12:39.890" Title="IP Geolocation reliability" Tags="|ip-address|" AnswerCount="1" CommentCount="1" ClosedDate="2017-02-17T14:41:05.770" ContentLicense="CC BY-SA 3.0" />
  <row Id="39010" PostTypeId="2" ParentId="39009" CreationDate="2017-02-17T08:12:39.890" Score="3" Body="&lt;p&gt;In the RIPE region (not sure for other Regional Internet Registry), ISP have to declare only the country in which an IP block is used, nothing more. (And I'm quite sure there's no check if this information is correct or not).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Geolocation services maintain their own database and gather information by various ways. For example many use the GPS feature of devices, becoming increasingly common in mobile devices, including laptops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So if you open google maps, and allowed it to access the location service of your Operating System, google will now exactly where you are and can update its database with the location of your IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some also use neighbor WiFi networks, maintaining a database of SSID / locations and cross those data with other sources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How those services exactly works and how much reliable they are greatly vary by service, and this is not something we can answer on this SE site I think.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-17T08:12:39.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39013" PostTypeId="1" AcceptedAnswerId="39023" CreationDate="2017-02-17T10:28:09.690" Score="1" ViewCount="767" Body="&lt;p&gt;For simplicity let's assume that we have very simple LAN. There is some router with uplink to the internet. To this router there is connected some basic 24 ports switch, and from that switch there are cables going out to few workstations in a office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The link from the LAN to the internet is 10mbps download, 2mbps upload. If workstation1 will start downloading data from a website (client-server) with a speed of 5mbps, or 625kBps (since 5 megabits equals 625 kilobytes), will the connection for other people working in a office, on other workstations be better than in the case, where workstation1 is downloading data from torrent client, with the same speed of 5mbps, but from multiple peers, not from one source as is the case in downloading from website?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it have anything to do with the fact that in peer-to-peer you have multiple connections?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If in case of torrent traffic the quality of connection will be worse for other users, then how it will be worse? Will it just increase latency, or will it also worsen downloading speed, increase jitter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And last questions, what are the ways to control side effects of people using p2p for example in small/medium office with one simple LAN?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My explanation of the question may not seem professional, but please use technical terms, I am not looking for &quot;explain it like I am 5 years old&quot; ;) I have quite good understanding of networking, routing, congestion control and protocols etc (at least I think so).&lt;/p&gt;&#xA;" OwnerUserId="34522" LastEditorUserId="8499" LastEditDate="2021-07-11T23:55:28.340" LastActivityDate="2021-07-11T23:55:28.340" Title="If, and why torrent traffic is creating greater congestion on a link, than regular traffic of the same size?" Tags="|lan|qos|congestion|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39014" PostTypeId="2" ParentId="39013" CreationDate="2017-02-17T13:08:35.480" Score="0" Body="&lt;p&gt;TCP has congestion control algorithms. If all hosts are using the same congestion control settings then after a while things should balance out so that all the TCP connections get roughly the same share of the bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bittorrent uses lots of TCP connections for the same download job, so it will grab a much greater share of the bandwidth on a congested link.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-17T13:08:35.480" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39016" PostTypeId="2" ParentId="38966" CreationDate="2017-02-17T14:07:02.607" Score="1" Body="&lt;p&gt;I found the issue. The interfaces of the 7K we were upgrading didn't have the 'no ip redirects' command on. This caused a drop in BFD between the neighboring router we were testing from and also dropped our EIGRP neighborship. This list has similar information: &lt;a href=&quot;https://lists.gt.net/cisco/nsp/141379&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://lists.gt.net/cisco/nsp/141379&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15501" LastActivityDate="2017-02-17T14:07:02.607" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39017" PostTypeId="1" CreationDate="2017-02-17T16:48:06.707" Score="1" ViewCount="183" Body="&lt;p&gt;Our school just received a bunch of hardware from a corporation leaving a location, so now we are upgrading our networking in four classrooms. The rooms have fiber connections to each other. The hardware we have are a Cisco 7606-s router and a Cisco 6506 router and a bunch of switches. The connections between the routers and switches will be 10 Gbit/s fiber links.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that we have two 100 Mbit/s and a single DSL uplink in one room (with the 6505), one 100 Mbit/s and a DSL in another room (with the 7606-s) and a single DSL connection in the third. So how would we bring the 100 Mbit/s connections together so we could do link aggregation? Also the DSL connections should work as a failover (they are independant from each other, but from the same ISP). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought that routing the uplinks through the routers and switches to a single router would be bit of a hack, so would there be any way to balance the traffic between the two routers? That is a bit problematic too, since they are not identical and would have a different number of uplinks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I think we could get the faster connections to come to a single location. That would leave only the DSL connections to figure out&lt;/p&gt;&#xA;" OwnerUserId="34530" LastEditorUserId="34530" LastEditDate="2017-02-18T11:25:29.047" LastActivityDate="2017-02-18T11:25:29.047" Title="Multiple uplinks in multiple locations" Tags="|cisco|load-balancing|uplinks|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39018" PostTypeId="1" AcceptedAnswerId="39019" CreationDate="2017-02-17T17:01:01.590" Score="2" ViewCount="458" Body="&lt;p&gt;Say we have a Juniper EX4200 with the 4x 1G SFP uplink module, with 1G transceivers, and another switch with 10G SFP+ downlinks. Can we connect the 10G SFP+ downlinks of one switch to the 1G SFP uplinks of the other switch and expect them to be detected as 1G?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, does installing an uplink module in an EX4200 cancels some of the other 48 built-in ports, as with the older EX3200?&lt;/p&gt;&#xA;" OwnerUserId="32941" LastActivityDate="2017-02-22T09:21:25.137" Title="From SFP+ to SFP + Juniper EX4200 specific question" Tags="|juniper-ex|sfp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39019" PostTypeId="2" ParentId="39018" CreationDate="2017-02-17T17:07:30.010" Score="3" Body="&lt;p&gt;Nope.  There is no multi-speed option in 1/10G optics for Juniper (or Cisco or most others).  That said, you can likely just put another 1GE SFP optic into the SFP+ slot currently occupied by the 10G SFP+ on the switch side and it ought to work.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastEditorUserId="1172" LastEditDate="2017-02-21T01:31:21.440" LastActivityDate="2017-02-21T01:31:21.440" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39020" PostTypeId="2" ParentId="37235" CreationDate="2017-02-17T17:09:54.310" Score="1" Body="&lt;p&gt;The Intel cards are usually agnostic when it comes to SFPs in my experience, but DAC-cables are a bit of a grey area since there's no standard governing them if I can remember correctly. So if you want to play it safe, buy some 3rd party SFPs for the HP swiches and the name-brand modules for Intel (the Intel modules are cheap enough, but name brand HP modules cost hundreds of dollars per module) and run the whole lot over OM3 fiber instead, it's every so slightly more expensive as the DAC cables. Also, if you haven't bought the X520 cards yet, they can be had with or without SFPs of your choice for the same price. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2017-02-17T17:09:54.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39021" PostTypeId="2" ParentId="34831" CreationDate="2017-02-17T17:17:25.303" Score="1" Body="&lt;p&gt;If you want to do a quick and dirty hack, just loop back the VLANs into each other on a switch. Just add two untagged/access ports in VLAN10, and one for VLAN20 and VLAN30, and just patch the ports together. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Very ugly, extremely sketchy, but it will work as long as you don't have Spanning Tree enabled (and it will work even then if you put BPDU filtering on the ports). But as others have said already, the point of having multiple SSIDs is to separate traffic, if you feed everything into the same network there's not really any point of having multiple SSIDs. &lt;/p&gt;&#xA;" OwnerUserId="22463" LastActivityDate="2017-02-17T17:17:25.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39023" PostTypeId="2" ParentId="39013" CreationDate="2017-02-17T20:11:26.937" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If workstation1 will start downloading data from a website&#xA;  (client-server) with a speed of 5mbps, or 625kBps (since 5 megabits&#xA;  equals 625 kilobytes), will the connection for other people working in&#xA;  a office, on other workstations be better than in the case, where&#xA;  workstation1 is downloading data from torrent client, with the same&#xA;  speed of 5mbps, but from multiple peers, not from one source as is the&#xA;  case in downloading from website?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Anything that monopolizes the WAN bandwidth will affect all other users need to use WAN bandwidth. Each peer that the torrent user is receiving from will try to send as much data as fast as it can.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does it have anything to do with the fact that in peer-to-peer you&#xA;  have multiple connections?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The problem is primarily that the torrents are filling you bandwidth in both directions, monopolizing your WAN.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If in case of torrent traffic the quality of connection will be worse&#xA;  for other users, then how it will be worse? Will it just increase&#xA;  latency, or will it also worsen downloading speed, increase jitter?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Anything that fills your bandwidth, including torrents can cause latency and jitter, and interfere with your normal business operations.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And last questions, what are the ways to control side effects of&#xA;  people using p2p for example in small/medium office with one simple&#xA;  LAN?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;One option is to block torrents on the firewall, but this can be difficult to keep up with, and it depends on your company's policies to allow/disallow such things. Many companies consider this stealing of company resources; it does cost a company money to provide the bandwidth for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can't block the torrents, then this is the perfect case for QoS. QoS is all about fairness, as the network administrator defines it. QoS is a topic too large to go into detail here, but I will cover some points. You may want to hire a consultant who can analyze your traffic and develop a solid QoS policy for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To properly implement QoS, you need a comprehensive set of QoS policies that are consistently implemented across your network devices. You want to mark the traffic as close to the source as possible, usually on the access switches. Many access switches will simply mark all traffic as &lt;code&gt;BE&lt;/code&gt; unless configured otherwise or for trust.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would set up policing, shaping, and queuing on your routers. Most traffic is fine to be marked as &lt;code&gt;BE&lt;/code&gt;. You want real-time protocols, e.g. VoIP marked as &lt;code&gt;EF&lt;/code&gt; and placed in priority queues with policing. Bulk type traffic, e.g. server backups, torrents, etc., should be placed in lower priority queues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also techniques like RED that will randomly drop packets in queues to prevent the queues from filling and doing tail-drop, which can cause TCP global synchronization (very bad, causes queues to alternately fill then starve).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-17T20:17:57.610" LastActivityDate="2017-02-17T20:17:57.610" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39024" PostTypeId="2" ParentId="39017" CreationDate="2017-02-17T22:45:45.937" Score="1" Body="&lt;p&gt;First, you can't do link aggregation unless the carrier is also doing it on their end. But you can load balance between all three 100 m connections. It's best if you can run a routing protocol with your carrier, so you know that each link is available. Your routers can certainly do that. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMO the dsl lines are not needed if you have 300 Mb spread over three connections. You could save yourself some money. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-02-17T22:45:45.937" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39025" PostTypeId="2" ParentId="34223" CreationDate="2017-02-17T23:42:03.537" Score="1" Body="&lt;p&gt;On ASAs, some ACL rules will implicitly allow &lt;strong&gt;returning traffic&lt;/strong&gt;.  These rules only need to define a single direction of traffic.  The &lt;em&gt;CLI Book 2: Cisco ASA Series Firewall CLI Configuration Guide, 9.7&lt;/em&gt; call out distinctions.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;Extended Access Rules for Returning Traffic&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;For TCP, UDP, and SCTP&#xA;connections for both routed and transparent mode, you do not need an&#xA;access rule to allow returning traffic because the ASA allows all&#xA;returning traffic for established, bidirectional connections.&lt;/p&gt;&#xA;&lt;p&gt;For connectionless protocols such as ICMP, however, the ASA&#xA;establishes unidirectional sessions, so you either need access rules&#xA;to allow ICMP in both directions (by applying ACLs to the source and&#xA;destination interfaces), or you need to enable the ICMP inspection&#xA;engine. The ICMP inspection engine treats ICMP sessions as&#xA;bidirectional connections. For example, to control ping, specify&#xA;echo-reply (0) (ASA to host) or echo (8) (host to ASA).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/firewall/asa-97-firewall-config/access-rules.html#ID-2124-0000000&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com/c/en/us/td/docs/security/asa/asa97/configuration/firewall/asa-97-firewall-config/access-rules.html#ID-2124-0000000&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;If your example ACL was on an ASA, you would still be required to explicitly define the reverse traffic because the protocol, &lt;code&gt;ip&lt;/code&gt;, is stateless.&lt;/p&gt;&#xA;&lt;p&gt;Router Extended ACLs do not have notion of statefulness.  The reverse/returning traffic must be explicitly defined. An exception to this rule is &amp;quot;Reflexive ACLs&amp;quot; and are outside the scope of this post.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfreflx.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfreflx.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-02-17T23:59:04.427" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39026" PostTypeId="2" ParentId="36897" CreationDate="2017-02-18T01:42:00.390" Score="1" Body="&lt;p&gt;You can use SonicWALL to create &lt;a href=&quot;https://support.sonicwall.com/kb/sw5857&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPsec Site to Site Tunnel&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But if you want to provide tunnel to another PC on the same WAN subnet it will be difficult (different subnet destination) &lt;/p&gt;&#xA;" OwnerUserId="25157" LastActivityDate="2017-02-18T01:42:00.390" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39027" PostTypeId="2" ParentId="36053" CreationDate="2017-02-18T01:45:48.620" Score="0" Body="&lt;p&gt;Try to use a &lt;a href=&quot;https://support.sonicwall.com/kb/sw11163&quot; rel=&quot;nofollow noreferrer&quot;&gt;Packet Capture&lt;/a&gt; filter and post the result in red (blocked packets) delivered to your public pupil platform!&lt;/p&gt;&#xA;" OwnerUserId="25157" LastActivityDate="2017-02-18T01:45:48.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39030" PostTypeId="2" ParentId="7427" CreationDate="2017-02-18T05:51:56.323" Score="0" Body="&lt;p&gt;As the Network range is 172.18.40.1 to 172.19.47.254&#xA;Network ID is 172.18.40.0&#xA;Broadcast IP is 172.18.47.255....  That means we have Range of 8&#xA;Our SM=255.255.248.0 so we have 11 Host bits&lt;/p&gt;&#xA;&#xA;&lt;p&gt;No. of Hosts=2^no. of host bits-2&#xA;            =2^11-2&#xA;            =2048-2&#xA;            =2046&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this clear your doubts.. &lt;/p&gt;&#xA;" OwnerUserId="34541" LastActivityDate="2017-02-18T05:51:56.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39031" PostTypeId="1" AcceptedAnswerId="39032" CreationDate="2017-02-18T09:08:37.640" Score="6" ViewCount="48634" Body="&lt;p&gt;I have a very rudimentary doubt. We know that a LAN has addresses in the same subnet. &#xA;The LAN ends at the gateway router with that interface also belonging to the same subnet.&#xA;But what exactly will break in the forwarding operation if we assign LAN addresses that belong to different subnets.&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-02-18T23:55:22.627" Title="Different subnets in the same LAN" Tags="|subnet|lan|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39032" PostTypeId="2" ParentId="39031" CreationDate="2017-02-18T09:24:45.353" Score="3" Body="&lt;p&gt;The PC's in the other subnet should be able to communicate with each other. However if they attempt to ping an IP on a different subnet, it won't work unless the default gateway is setup on the router and some form of routing (static/dynamic) is setup on the router. &lt;/p&gt;&#xA;" OwnerUserId="34272" LastActivityDate="2017-02-18T09:24:45.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39034" PostTypeId="2" ParentId="39031" CreationDate="2017-02-18T11:04:52.453" Score="-1" Body="&lt;p&gt;The sending device will send an ARP request broadcast frame on to the network asking for the MAC address of the intended recipient based on the IP address of the destination. The holder of that IP address will respond to the sender advertising the MAC address. They will then be able to communicate with each other with out their traffic having to be routed through a Layer 3 device which is where things start to break down. As already mentioned.&lt;/p&gt;&#xA;" OwnerUserId="34546" LastActivityDate="2017-02-18T11:04:52.453" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39035" PostTypeId="2" ParentId="36053" CreationDate="2017-02-18T11:10:30.183" Score="2" Body="&lt;p&gt;Check the order of the access rules from LAN -&gt; WAN. You may find the newly created rule has been automatically put underneath the debt all rule. If so you should be able to move this up the list so it is above the deny rule.&lt;/p&gt;&#xA;" OwnerUserId="34546" LastActivityDate="2017-02-18T11:10:30.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39036" PostTypeId="2" ParentId="20887" CreationDate="2017-02-18T11:17:48.417" Score="2" Body="&lt;p&gt;The short answer is &quot;SNMP&quot; from a network management platform (canonically Nagios, but there's a world of alternatives).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'd be interested in monitoring:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;The BGP neighbour status of all those routers.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The presence of all those router's loopback addresses in the BGP routing table.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The MPLS path establishment status for each of those circuits.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and so on.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastActivityDate="2017-02-18T11:17:48.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39037" PostTypeId="2" ParentId="28864" CreationDate="2017-02-18T11:41:38.467" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is transmission rate same as Bandwidth?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;In essence yes, with some small adjustments for the difference between the clocking of the media (&quot;bandwidth&quot;) and the actual rate at which packets are  accepted onto the media (ie, minus minor overheads like ethernet headers, SDH segmentation, forward-error control, tunnelling like VLANs, MPLS, GRE).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can do &quot;traffic shaping&quot; in the router so that the packet transmission rate presented to the media is substantially less than the available transmission rate of the media. This is how you can order a 200Mbps service over a gigabit ethernet fibre.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is throughput&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Throughput is the speed visible to the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Often we aren't so much interested in the throughput of a link as the &quot;end-to-end throughput&quot; between two applications communicating over a path consisting of multiple links and routers. End-to-end throughput can be affected by the lowest transmission rate of the links on the path; the path error rate, packet re-ordering, latency and jitter affecting the TCP congestion-control algorithm; the path MTU and packet re-ordering affecting operating system efficiency; the choice of TCP congestion control algorithm used.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;why do we consider transmission delay&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;We usually don't. We used to, since getting a 1.5KB of packet onto the wire took some time at 9600bps. But at the high data rates in modern networks the number is so small as to be safely ignored outside of weird situations.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Shouldn't we also consider the propagation delay?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also called &quot;latency&quot;. Latency remains important as it's the one performance factor in a global network which isn't improving rapidly. As everything else improves then avoiding latency becomes increasingly important to improving performance. This has effects from avoiding round-trips packet exchanges in application and protocol designs; fielding new protocols which move data closer to their endpoint; and architectural responses such as content distribution networks.&lt;/p&gt;&#xA;" OwnerUserId="25444" LastActivityDate="2017-02-18T11:41:38.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39038" PostTypeId="2" ParentId="28301" CreationDate="2017-02-18T11:48:52.253" Score="0" Body="&lt;p&gt;I used two switch HP v1910 conected throw port gigaethernet 1/0/1&#xA;And I needed to execute this commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;_cmdline-mode on   (from console)&#xA;key: 512900&#xA;System-view&#xA;Interface gigabitEthernet 1/0/1 &#xA;Igmp-snooping static-router-port vlan X&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and it worked for me.&lt;/p&gt;&#xA;" OwnerUserId="34548" LastEditorUserId="509" LastEditDate="2017-02-19T11:37:13.700" LastActivityDate="2017-02-19T11:37:13.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39041" PostTypeId="1" CreationDate="2017-02-18T18:10:35.817" Score="1" ViewCount="906" Body="&lt;p&gt;So I've been trying to complete my MCSA, I'm now on 412. Anyway, NLB (network load balancing)... I'm struggling with how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each node in the cluster keeps it's own mac and IP address, whilst also using the cluster defined IP and Mac address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm struggling to understand what MAC address the switch is aware of. I was under the impression that the switch would only know the cluster MAC address. Yet, when I use wireshark and look at the ethernet header, the source address is a nodes personal mac address. I thought a switch records the MAC from the source? Yet this multicast NLB seems to suggest otherwise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone have any pointers for me?&lt;/p&gt;&#xA;" OwnerUserId="34307" LastEditorUserId="8499" LastEditDate="2018-03-19T16:35:52.093" LastActivityDate="2018-03-19T16:35:52.093" Title="NLB Multicast / Source Mac Address" Tags="|mac-address|multicast|mac|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39042" PostTypeId="2" ParentId="39041" CreationDate="2017-02-18T18:33:46.820" Score="0" Body="&lt;p&gt;I don't know how Microsoft characterizes it, but in the real world, a switch looks at the source MAC address to update it MAC address table with the MAC address and interface on which it was seen. Then it looks in its MAC address table to see it it has an interface for the destination address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multicast is s special form of broadcast, and a multicast MAC address is only a destination MAC address. A host sending a frame will use its own MAC address as the source address, not a multicast address.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-18T18:33:46.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39044" PostTypeId="2" ParentId="39031" CreationDate="2017-02-18T21:23:24.257" Score="4" Body="&lt;p&gt;Having more than one subnet on a LAN used to be more common than it is today. You can configure the router interface with a secondary* address.  This will allow the router to be the gateway for both subnets, and it will be able to route between them.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the type of router and software version, some features may not be available on the secondary interface.  For example, Cisco routers would not establish OSPF or EIGRP neighbor relationships on secondary addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*You can have more than just two subnets on a LAN.  Cisco refers to them all as secondary addresses although they technically should be called tertiary, quartenary, &lt;em&gt;etc&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-02-18T21:35:17.020" LastActivityDate="2017-02-18T21:35:17.020" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39047" PostTypeId="2" ParentId="39031" CreationDate="2017-02-18T22:44:35.720" Score="-1" Body="&lt;p&gt;This also has to do with how IP Routing works based on IP subnets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider the following example&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;           10.0.0.0/8            20.0.0.0/8&#xA;HostA     ------------- Router ------------- HostB   &#xA;10.0.0.1     LAN 1                 LAN 2     20.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;When Host A wants to talk to Host B it sends the packet to the&#xA;default gateway router asking it to direct it to the correct LAN.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The router is configured with a subnet on each of its link. It uses&#xA;this configuration to build its routing table (these are called&#xA;connected routes). The router looks up its routing table to find that&#xA;it needs to use LAN 2 to reach any host in the 20.0.0.0/8 network. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The router then uses ARP to find the MAC for Host B in LAN 2. Once&#xA;it figures out the MAC for Host B it rewrites the MAC header in the&#xA;original packet to Host B's MAC and sends the packet out on LAN 2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now imagine if the Host B was assigned IP address belonging to a different subnet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;           10.0.0.0/8            20.0.0.0/8&#xA;HostA     ------------- Router ------------- HostB   &#xA;10.0.0.1     LAN 1                 LAN 2     30.0.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If Host A sends a packet to Host C, the Router will drop the packet since it will not know the LAN to reach 30 network.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This answer is a bit simplified by assuming that Host B does not send any ARP.&lt;/p&gt;&#xA;" OwnerUserId="34557" LastActivityDate="2017-02-18T22:44:35.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39048" PostTypeId="1" AcceptedAnswerId="39049" CreationDate="2017-02-18T22:44:56.963" Score="1" ViewCount="897" Body="&lt;p&gt;I think my understanding of Trunking is off. I have two cisco switches under two vlans, connected to a single SRX240. I have connectivity to the SRX from the switch but not anywhere past it. The switch can ping 192.168.8.4 under vlan 89 but cannot ping 192.168.16.2 under vlan 16.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;THE SRX CONFIGS&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;ge-0/0/0 {&#xA;    unit 0 {&#xA;        description &quot;Eric's Connection&quot;;&#xA;        family ethernet-switching {&#xA;            port-mode access;&#xA;            vlan {&#xA;                members Group-16;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;ge-0/0/1 {&#xA;    unit 0 {&#xA;        description &quot;JSS's Connection&quot;;&#xA;        family ethernet-switching {&#xA;            port-mode access;&#xA;            vlan {&#xA;                members JSS-89;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;ge-0/0/2 {&#xA;    unit 0 {&#xA;        family ethernet-switching {&#xA;            vlan {&#xA;                members vlan-trust;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;ge-0/0/3 {&#xA;    unit 0 {&#xA;        family ethernet-switching {&#xA;            vlan {&#xA;                members vlan-trust;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;ge-0/0/4 {&#xA;    unit 0 {&#xA;        family ethernet-switching {&#xA;            vlan {&#xA;                members vlan-trust;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;vlan {&#xA;    unit 0 {&#xA;        family inet {&#xA;            address 192.168.1.1/24;&#xA;        }&#xA;    }&#xA;    unit 16 {&#xA;        family inet {&#xA;            address 192.168.16.2/24;&#xA;        }&#xA;    }&#xA;    unit 89 {&#xA;        family inet {&#xA;            address 192.168.8.4/24;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;THE SWITCH CONFIGS&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; interface FastEthernet1/0/1&#xA; switchport access vlan 89&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet1/0/2&#xA; switchport access vlan 89&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet1/0/3&#xA;!&#xA;interface FastEthernet1/0/4&#xA;!&#xA;interface FastEthernet1/0/5&#xA;!&#xA;interface FastEthernet1/0/6&#xA;!&#xA;interface FastEthernet1/0/7&#xA; switchport access vlan 89&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet1/0/8&#xA; switchport access vlan 89&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet1/0/9&#xA;!&#xA;interface FastEthernet1/0/10&#xA; switchport access vlan 89&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet1/0/11&#xA;!&#xA;interface FastEthernet1/0/12&#xA; switchport access vlan 89&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet1/0/13&#xA;!&#xA;interface FastEthernet1/0/14&#xA;!&#xA;interface FastEthernet1/0/15&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan89&#xA; ip address 192.168.8.3 255.255.255.0&#xA;!&#xA;ip classless&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;FE1/0/10 is the connection to the SRX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any guidance would be great.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="34558" LastActivityDate="2017-07-19T02:07:36.893" Title="Cisco catalyst and Juniper SRX240 vlan routing" Tags="|cisco-catalyst|juniper-srx|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="39049" PostTypeId="2" ParentId="39048" CreationDate="2017-02-18T22:57:36.150" Score="1" Body="&lt;p&gt;Both the switches will need a default gateway to reach IP addresses on other subnets.&#xA;Configure the 192.168.8.4 as the default gateway IP on 1 switch &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip default gateway 192.168.8.4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and 192.168.16.2 as the default gateway on the other.&lt;/p&gt;&#xA;" OwnerUserId="34557" LastEditorUserId="34557" LastEditDate="2017-02-18T23:08:56.373" LastActivityDate="2017-02-18T23:08:56.373" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39050" PostTypeId="2" ParentId="39041" CreationDate="2017-02-18T23:01:23.287" Score="2" Body="&lt;p&gt;There's a very good reason why the use of Microsoft's multicast NLB is not very popular in a whole lot of networks - it's a hack that breaks several basic operating practices and RFC's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - under normal circumstances multicast means that the destination IP of a packet is somewhere in the 224.0.0.0/4 range, with this range broken up into various well-known chunks.  In turn, there is a mapping of these IP multicast group addresses to certain MAC addresses.  &lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc957928.aspx&quot; rel=&quot;nofollow noreferrer&quot;&gt;Here&lt;/a&gt; is a Microsoft article describing how that mapping is achieved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyhow - what we normally have is that traffic is sent to a multicast group IP that is mapped to a multicast MAC address.  The switch is smart enough to snoop on the Internet Group Management Protocol (IGMP) which is how individual end hosts signify which multicast groups they want to receive.  When the switch sees an IGMP join request, it programs the port such that any packets to the multicast MAC are copied down.  This means that on a network with 100 hosts if only 10 signify interest in this multicast group then traffic bound to that group only shows up on those 10 ports (...vs all 100 in the case of a broadcast).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where Microsoft broke this is that they require a mapping of a &lt;strong&gt;unicast&lt;/strong&gt; IP to a &lt;strong&gt;multicast&lt;/strong&gt; MAC.  They also require the underlying switch to either turn off IGMP snooping (...thus causing the cluster packets to be sent to every host in the subnet, whether they need them or not) or to statically map this address to the physical ports occupied by their servers (hint: this is &lt;strong&gt;NOT&lt;/strong&gt; supported in lots of hardware and breaks vswitches and virtualization pretty horribly as well).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - in essence Microsoft wrote a really, really hacky and awful way of doing this that requires that the underlying network layer break all kinds of accepted best practices for how networks otherwise work.  To their credit they also have some newer modes (IGMP based) that aren't quite as bad but, ultimately, it's now a lot more common in new installations to see folks dropping back to a unicast-based mode that uses some kind of external load balancer to achieve the same effect in a more sane manner.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-18T23:01:23.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39052" PostTypeId="2" ParentId="39031" CreationDate="2017-02-18T23:55:22.627" Score="4" Body="&lt;p&gt;The subnet is used to determine what hosts are &quot;assumed to be on link&quot;. If a host wants to communicate with a host outside it's subnet then (assuming there is nothing special in the host's routing table) it will try and send the packet to it's default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the default gateway knows about all the subnets and is prepared to send packets back out on the same interface they came in through then communication will work fine. Otherwise things are going to break.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the default gateway notices that it is sending a packet back out the way it came in it may send ICMP redirect packets to inform the host that it can send the packet by a more direct route. The sending host may or may not take notice of said redirect.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-18T23:55:22.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39055" PostTypeId="2" ParentId="37181" CreationDate="2017-02-19T02:01:23.827" Score="0" Body="&lt;p&gt;Since a Native Vlan is untagged on all ports it should not matter which vlan id you use as the native vlan. The decision should be local to this device and you should not have to change existing configurations on neighboring switches.&lt;/p&gt;&#xA;" OwnerUserId="34557" LastActivityDate="2017-02-19T02:01:23.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39056" PostTypeId="1" AcceptedAnswerId="39059" CreationDate="2017-02-19T03:51:03.907" Score="2" ViewCount="147" Body="&lt;pre&gt;&lt;code&gt;ip multicast-routing&#xA;crypto isakmp policy 2&#xA; encr 3des&#xA; hash md5&#xA; authentication pre-share&#xA; crypto isakmp key 123 address 1.7.129.10&#xA;!&#xA;crypto ipsec transform-set remotevpn esp-3des esp-md5-hmac&#xA;!&#xA;crypto map remotevpn 1 ipsec-isakmp&#xA; set peer 1.7.129.10&#xA; set transform-set remotevpn&#xA; match address 100&#xA;!&#xA;interface Loopback0&#xA; ip address 10.249.0.157 255.255.255.255&#xA;!&#xA;interface Tunnel0&#xA; ip address 10.249.6.98 255.255.255.252&#xA; ip pim sparse-mode&#xA; tunnel source 10.249.0.157&#xA; tunnel destination 10.249.254.1&#xA;!&#xA;interface fa0/0&#xA; ip address 10.249.52.129 255.255.255.192&#xA; ip pim sparse-mode&#xA; crypto map remotevpn&#xA; ip access-group 199 in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Questions,&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why does loopback0 exist? Is it a &quot;virtual interface&quot; for GRE to be able to use &lt;code&gt;tunnel source 10.249.0.157&lt;/code&gt; on Tunnel0 section?&lt;/li&gt;&#xA;&lt;li&gt;Why do loopback0 and tunnel0 having different IP subnets? &lt;/li&gt;&#xA;&lt;li&gt;Where is the Phase 2 definition on this config?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="4479" LastEditorUserId="453" LastEditDate="2017-05-20T22:13:38.983" LastActivityDate="2017-07-19T23:10:54.863" Title="Cisco IPSec questions on loopback0 and phase 2" Tags="|cisco|ipsec|gre|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39059" PostTypeId="2" ParentId="39056" CreationDate="2017-02-19T07:07:03.227" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Yes, loopback 0 will be used as GRE Tunnel source and it is recommended to use loopback interface as tunnel source because it is always up and could be reachable through different interfaces. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/MxChS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/MxChS.png&quot; alt=&quot;GRE Encpsulation structure&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;The IP on Tunnel interface is totally different from the Tunnel source and destination.Tunnel source will be used along with tunnel destination in GRE header and the Tunnel interface IP will be used as source when you generate packets from the tunnel interface and then that packets will be encapsulated inside the GRE header.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Below is the phase 2 configuration:  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto map remotevpn 1 ipsec-isakmp  &#xA; set peer 1.7.129.10  &#xA; set transform-set remotevpn  &#xA; match address 100  &#xA;crypto ipsec transform-set remotevpn esp-3des esp-md5-hmac  &#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;and the access-list 100.&lt;/p&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="8499" LastEditDate="2017-02-19T07:08:22.987" LastActivityDate="2017-02-19T07:08:22.987" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39060" PostTypeId="2" ParentId="39056" CreationDate="2017-02-19T07:07:11.780" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;There are many reasons for having a loopback interface. Primarily,&#xA;loopback interfaces never go down. This is useful for things like&#xA;routing protocols or tunnels that may have more than one way into a&#xA;router. If one interface into the router goes down, and there are&#xA;other ways into the router, the protocol(s) using the first interface&#xA;will automatically be rerouted into another way into the router&#xA;without bringing down the protocol connection.&lt;/li&gt;&#xA;&lt;li&gt;A tunnel is a separate interface and it needs its own layer-3&#xA;address. The tunnel looks like a point-to-point link with its own&#xA;network. The source and destination addresses can be on very&#xA;different networks, but the tunnel link endpoints need to be on the&#xA;same network.&lt;/li&gt;&#xA;&lt;li&gt;The phases, including, phase 2, are a function of the VPN setup.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-19T07:07:11.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39061" PostTypeId="2" ParentId="24766" CreationDate="2017-02-19T07:40:47.087" Score="1" Body="&lt;p&gt;The network statements in your BGP router configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network 1.1.1.0&#xA;network 1.1.2.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;do not match the actual network addresses, which range from &lt;code&gt;/26&lt;/code&gt; to &lt;code&gt;/32&lt;/code&gt;. BGP will not advertise networks which do not &lt;em&gt;exactly&lt;/em&gt; match what is in the routing table unless you you use the &lt;code&gt;aggregate-address&lt;/code&gt; command. Network statements in BGP will not make up routes that don't already exist.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-04-20T19:54:58.107" LastActivityDate="2017-04-20T19:54:58.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39062" PostTypeId="1" AcceptedAnswerId="39063" CreationDate="2017-02-19T09:38:59.703" Score="1" ViewCount="3105" Body="&lt;p&gt;So a few questions that I've struggled to find firm answers on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1: Does multicast use arp? So does it ask for a corresponding IP address? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the answer is no, as it translates the IP to a MAC itself. But I'd like confirmation of this please. Wireshark would also suggest it doesn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2: When a machine engages in multicast, what MAC address in the CAM table does the switch record for the machine? On an access port we can't allow 2 ports to have the same mac can we?&lt;/p&gt;&#xA;" OwnerUserId="34307" LastEditorUserId="8499" LastEditDate="2018-03-09T21:21:17.420" LastActivityDate="2018-03-09T21:21:17.420" Title="Multicast ARP Switch" Tags="|switch|switching|mac-address|arp|multicast|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39063" PostTypeId="2" ParentId="39062" CreationDate="2017-02-19T09:56:22.150" Score="2" Body="&lt;p&gt;Multicast is a version of broadcast, which sends the frames to all switch interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, there is something called IGMP snooping that allows switches that support this to listen in on the IGMP conversations between hosts and a multicast router to see which switch interfaces want traffic from specific multicast groups. Switches that support this will only send traffic destined for a multicast group to those interfaces that have a destination interested in the traffic destined to that multicast group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not all switches support IGMP snooping. It is not something that is required, and pure layer-2 switches will send multicast frames to all switch interfaces.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;By the way, switches don't use ARP, which is a layer-3 to layer-2 resolution protocol. Layer-2 switches don't know anything about layer-3. Layer-2 switches do maintain MAC address tables to resolve layer-2 addresses to switch interfaces, but not to layer-3 addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-19T09:56:22.150" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39064" PostTypeId="2" ParentId="39062" CreationDate="2017-02-19T10:25:36.710" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Multicast does not use ARP. Multicast IP Address mapped statically into Multicast MAC. Check here: &lt;a href=&quot;https://networklessons.com/multicast/multicast-ip-address-to-mac-address-mapping/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://networklessons.com/multicast/multicast-ip-address-to-mac-address-mapping/&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Source MAC address is recorded. On access port you can limit number of learnt MAC addresses to 1 (or any other number), or you can leave unlimited.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-02-19T10:25:36.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39065" PostTypeId="2" ParentId="6380" CreationDate="2017-02-19T10:35:55.750" Score="1" Body="&lt;p&gt;HTTP (not HTML) has both presentation and application layer.&#xA;VPN Tunnels add overlay layers to the existing stack: it could be either Layer 2 or Layer 3 depends of their kind. Then you will be able to see this added layer(s) twice in the packet.&lt;/p&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-02-19T10:35:55.750" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39069" PostTypeId="1" AcceptedAnswerId="39070" CreationDate="2017-02-19T18:39:56.210" Score="1" ViewCount="486" Body="&lt;p&gt;I have a cat 7 network but the router, switch and APs are hooked up to it using cat 5 cables. Does this reduce the advantages of a cat 7 network?&lt;/p&gt;&#xA;" OwnerUserId="34571" LastEditorUserId="8499" LastEditDate="2018-03-20T23:03:12.627" LastActivityDate="2018-03-20T23:03:12.627" Title="Connecting a router with cat 5 cable to a cat 7 network" Tags="|layer1|cabling|cable|utp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39070" PostTypeId="2" ParentId="39069" CreationDate="2017-02-19T19:13:28.410" Score="3" Body="&lt;p&gt;You simply cannot mix shielded and unshielded parts in a link. The shield only works if it continuous end-to-end  and properly grounded on both ends. The actual wires in shielded cabling cannot meet specifications without working shielding. Having unshielded connectors means that the shielding is broken on the link, and it is not properly grounded. Improperly grounded links with shielded cable cannot meet the required cable specifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are documents that explain things for you. For example, &lt;a href=&quot;http://www.cablinginstall.com/articles/print/volume-3/issue-9/crosstalk-feedback/editorial/shielded-and-unshielded-twisted-pair-cable-revisited.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Shielded and unshielded twisted-pair cable revisited&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If STP cable is combined with improperly shielded connectors,&#xA;  connecting hardware or outlets, or if the foil shield itself is&#xA;  damaged, overall signal quality will be degraded. This, in turn, can&#xA;  result in degraded emission and immunity performance. Therefore, for a&#xA;  shielded cabling system to totally reduce interference, every&#xA;  component within that system must be fully and seamlessly shielded, as&#xA;  well as properly installed and maintained.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;An STP cabling system also requires good grounding and earthing&#xA;  practices because of the presence of the shield. An improperly&#xA;  grounded system can be a primary source of emissions and interference.&#xA;  Whether this ground is at one end or both ends of the cable run&#xA;  depends on the frequency at which a given application is running. For&#xA;  high-frequency signals, an STP cabling system must be grounded, at&#xA;  minimum, at both ends of the cable run, and it must be continuous. A&#xA;  shield grounded at only one end is not effective against&#xA;  magnetic-field interference.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;FYI,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Category-7 doesn't actually exist, I think you mean ISO/IEC Class F. ANSI/EIA/TIA define the cable categories, and so far have declined to certify/recognize a Category-7. ISO/IEC define cable classes, and what some people incorrectly call Category-7 is really ISO/IEC Class F. I get suspicious about vendors claiming Category-7 since the specifications and tests for it do not exist. There are far too many cheap cables on the market that do not meet specifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, Category-5 cable has not been recognized since 1999, and there are no specifications or tests for it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From &lt;em&gt;ANSI/TIA/EIA 568, Commercial Building Telecommunications Cabling Standard&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Recognized Categories&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;Categories 1, 2, 4, and 5 are not recognized as part of the standard&#xA;  and therefore transmission parameters are not listed.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The only recognized categories are 3, 5e, 6, and 6a.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-19T19:30:37.750" LastActivityDate="2017-02-19T19:30:37.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39072" PostTypeId="1" CreationDate="2017-02-19T20:26:57.990" Score="1" ViewCount="47" Body="&lt;p&gt;For the longest time, when I would configure a network device I would login to the GUI, and assign it an IP address. As I am getting into Cisco and their ISO model, I am seeing more and more of assigning IP addresses to actual ports and not the device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the enterprise world, do devices lose their actual IP address and start to inherit IP addresses assigned to the ports or VLANs so they technically start having several IP addresses assigned to them?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastEditorUserId="8499" LastEditDate="2017-02-19T20:38:11.067" LastActivityDate="2021-01-24T10:09:13.020" Title="Am I correct to start thinking in terms of &quot;ports&quot; as &quot;networks&quot; or &quot;devices&quot;?" Tags="|cisco|layer3|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39073" PostTypeId="2" ParentId="39072" CreationDate="2017-02-19T20:36:39.957" Score="2" Body="&lt;p&gt;You probably want to use the word &quot;interface&quot; instead of &quot;port&quot; because a port could be a transport layer address, e.g. TCP port 80 is used by HTTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices don't really have addresses, the addresses are assigned to the interfaces, either physical or logical interfaces. Routers route between networks, so each router interface needs to be in a different network. For Cisco's IOS, you often create logical interfaces (loopbacks, SVIs, etc.), and you assign addresses to those interfaces. Switches can have addresses assigned to SVIs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you use a GUI to assign addresses to a device, you are really assigning an address to a particular interface of the device. I assume you mean something like a home router (off-topic here). A home router will usually have two router interfaces (WAN and LAN), and each of those interfaces get assigned to a different network, and the router routes traffic between the networks. The LAN interface of a home router may be a logical interface to which a switch module and WAP connect inside the chassis.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-19T20:36:39.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39075" PostTypeId="1" AcceptedAnswerId="39076" CreationDate="2017-02-19T22:46:27.043" Score="1" ViewCount="98" Body="&lt;p&gt;I was trying to ping the other router(ROUTER 2[192.168.4.1/30]) from ROUTER 1[192.168.4.5/30], 192.168.4.1. I even placed in a gateway of last resort with no success. Where am I going wrong with my routing logic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ROUTE 1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 15.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 192.168.4.5 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.3.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;ip route 192.168.5.0 255.255.255.0 192.168.4.1 &#xA;ip route 0.0.0.0 0.0.0.0 192.168.4.1 &#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ROUTER 2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 15.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface GigabitEthernet0/0&#xA; ip address 192.168.4.1 255.255.255.252&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.5.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2349" LastActivityDate="2021-01-20T13:15:22.453" Title="Where am I going wrong in my routing logic?" Tags="|cisco|routing|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39076" PostTypeId="2" ParentId="39075" CreationDate="2017-02-19T22:54:03.203" Score="3" Body="&lt;p&gt;The problem you have is that you two different networks: &lt;code&gt;192.168.4.0/30&lt;/code&gt; and &lt;code&gt;192.168.4.4/30&lt;/code&gt;. To get from one network to another network, you need to go through a router. Router 1 has no idea where the &lt;code&gt;192.168.4.0/30&lt;/code&gt; network is. Router 2 has no idea where the &lt;code&gt;192.168.4.4/30&lt;/code&gt; network is.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to have a network in common between the two routers. That is why you use &lt;code&gt;/30&lt;/code&gt; or &lt;code&gt;31&lt;/code&gt; networks for point-to-point links. Each of those two network sizes has exactly two usable addresses, and you would assign one address each router on each end of the link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers learn routes in three ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Directly connected networks&lt;/li&gt;&#xA;&lt;li&gt;Statically configured routes&lt;/li&gt;&#xA;&lt;li&gt;Dynamically from routing protocols&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The flaw with your statically configured routes on Router 1 is that Router 1 has no idea where &lt;code&gt;192.168.4.1&lt;/code&gt; is, or how to send traffic to it. Router 2 will also need to know how to get back to the Router 1 networks.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-19T22:54:03.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39077" PostTypeId="1" CreationDate="2017-02-19T23:24:02.170" Score="3" ViewCount="7431" Body="&lt;p&gt;I have some networking questions about isolating networks and why it's bad to run DHCP and DNS on a router and should be run on a server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the purpose of the WAN interface and how does it separate a local virtual environment from the public internet? And how is it similar to a cable modem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DNS and DHCP are typically running on a server; why is it not a good idea to run these services on a router?&lt;/p&gt;&#xA;" OwnerUserId="34577" LastActivityDate="2019-06-16T04:45:57.977" Title="How WANs work and why it is it bad to run DNS and DHCP on a router?" Tags="|router|dhcp|dns|wan|pfsense|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39078" PostTypeId="2" ParentId="39077" CreationDate="2017-02-19T23:33:07.323" Score="3" Body="&lt;p&gt;WAN is a very subjective term. Routers have interfaces. Some types of router interfaces are more likely to be used as or called WAN interfaces. For example, PPP, HDLC, Frame relay, etc. are rarely used internally in a company, and are generally considered WAN protocols. On the other hand, ethernet, token ring, Wi-Fi, etc. are generally used on an internal LAN. Each of those protocols could actually be used on a WAN or a LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, a WAN is a network connecting geographically separate locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DNS and DHCP are not actually router functions. Many router vendors include such server software in their router software. The problem is that the router versions of the servers are limited compared to a dedicated server, and you may not want to use router resources (RAM and CPU) to do these functions on a busy router. The real point of a router is to route packets as quickly and efficiently as possible, and running servers can interfere with the primary routing function.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-19T23:33:07.323" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39080" PostTypeId="2" ParentId="30032" CreationDate="2017-02-20T04:05:27.407" Score="7" Body="&lt;p&gt;Same answer as Ron T. and Ron M..  I will just add what it took me to understand this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;People don't do this because it takes up space, but sometimes I forget we are dealing with binary sequences/addresses and this is necessary for understanding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Expanding the text &lt;code&gt;2000::&lt;/code&gt; to a sequence of a 1's and 0's, each of the following lines represent &lt;code&gt;hhhh&lt;/code&gt; of the &#xA;&lt;code&gt;hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh:hhhh&lt;/code&gt; notation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Starting Address:&lt;br&gt;&#xA;&lt;code&gt;0010 0000 0000 0000&lt;/code&gt; (first hextet)&lt;br&gt;&#xA;&lt;code&gt;0000 0000 0000 0000&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;0000 0000 0000 0000&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;0000 0000 0000 0000&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;0000 0000 0000 0000&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;0000 0000 0000 0000&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;0000 0000 0000 0000&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;0000 0000 0000 0000&lt;/code&gt; (last hextet) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What the &lt;code&gt;/3&lt;/code&gt; means is hold three of these binary locations constant, the first three. So you'd get something like this, where x's mean either 1 or 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mask:&lt;br&gt;&#xA;&lt;code&gt;001x xxxx xxxx xxxx&lt;/code&gt; (first hextet)&lt;br&gt;&#xA;&lt;code&gt;xxxx xxxx xxxx xxxx&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;xxxx xxxx xxxx xxxx&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;xxxx xxxx xxxx xxxx&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;xxxx xxxx xxxx xxxx&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;xxxx xxxx xxxx xxxx&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;xxxx xxxx xxxx xxxx&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;xxxx xxxx xxxx xxxx&lt;/code&gt; (last hextet)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Substituting x's so you can get your maximum with 1's and you get:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ending Address:&lt;br&gt;&#xA;&lt;code&gt;0011 1111 1111 1111&lt;/code&gt; (first hextet)&lt;br&gt;&#xA;&lt;code&gt;1111 1111 1111 1111&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;1111 1111 1111 1111&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;1111 1111 1111 1111&lt;/code&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;1111 1111 1111 1111&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;1111 1111 1111 1111&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;1111 1111 1111 1111&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;1111 1111 1111 1111&lt;/code&gt; (last hextet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Converting the binary back into hexadecimal, you would get the maximum address &lt;code&gt;3fff:ffff:ffff:ffff:ffff:ffff:ffff:ffff&lt;/code&gt; as Ron M. said.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wont type it out, but &lt;code&gt;/7&lt;/code&gt; and &lt;code&gt;/10&lt;/code&gt; work the same way.  Ipv4 masks also work this way.&lt;/p&gt;&#xA;" OwnerUserId="34580" LastEditorUserId="34580" LastEditDate="2017-02-20T04:13:32.310" LastActivityDate="2017-02-20T04:13:32.310" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39084" PostTypeId="1" CreationDate="2017-02-20T07:56:39.133" Score="2" ViewCount="137" Body="&lt;p&gt;can i check the ip of the machine attached with the network switch port from the switch console?&#xA;I just wanted to get the IP address of all the attached devices by running a simple command in switch console.&lt;/p&gt;&#xA;" OwnerUserId="34585" LastActivityDate="2018-07-04T08:04:20.097" Title="can i check the ip of the machine attached with the network switch port from the switch console" Tags="|switch|ip|switchport|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39085" PostTypeId="2" ParentId="39084" CreationDate="2017-02-20T08:15:48.330" Score="4" Body="&lt;p&gt;In the general case, you can't find directly the IP address of the attached device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you can find is the MAC address of the device, by looking at the switch mac address table.&#xA;This table list the mac addresses associated with each port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you have to map the mac address with the IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A way to do it is to scan the entire network. For example your network is 192.168.0.0/24, then you scan the entire range 192.168.0.1-192.168.1.254 (there's various tool to do so, like NMAP).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once scanned, you look at the arp table of the scanning machine (if this machine is within the network) or the router (if the scanning machine is outside the network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The arp table will give you the mapping between IP addresses and MAC addresses.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2018-07-04T08:04:20.097" LastActivityDate="2018-07-04T08:04:20.097" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="39089" PostTypeId="2" ParentId="39084" CreationDate="2017-02-20T09:44:27.417" Score="-1" Body="&lt;p&gt;Use the arp table .  Which show you ip address of attached machine against the Mac-address or you can check ip address of dynamic entry at physical interface where machine has connected&lt;/p&gt;&#xA;" OwnerUserId="8007" LastEditorUserId="8007" LastEditDate="2018-07-03T14:04:18.853" LastActivityDate="2018-07-03T14:04:18.853" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="39090" PostTypeId="2" ParentId="39075" CreationDate="2017-02-20T10:04:44.437" Score="0" Body="&lt;p&gt;From the config. You can check next hop ip address 4.1 dosen't reachable from router 1 due to wrong subnet ip address configured if both router are point to point connected. Second reverse static route hasn't configured at router 2.&lt;/p&gt;&#xA;" OwnerUserId="8007" LastActivityDate="2017-02-20T10:04:44.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39092" PostTypeId="1" AcceptedAnswerId="39093" CreationDate="2017-02-20T11:30:55.173" Score="8" ViewCount="1678" Body="&lt;p&gt;I don't understand what it is meant for &quot;streamlined ipv6 header&quot;?&#xA;Could you please provide an example?&lt;/p&gt;&#xA;" OwnerUserId="33603" LastActivityDate="2017-02-21T09:19:51.940" Title="What is the meaning of streamlined ipv6 header?" Tags="|ipv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39093" PostTypeId="2" ParentId="39092" CreationDate="2017-02-20T11:50:55.037" Score="10" Body="&lt;p&gt;&lt;em&gt;IPv4&lt;/em&gt; has a lot of fields (14) in the header:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Version&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IHL: Internet Header Length.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;DSCP: Type of Service.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ECN: Explicit Congestion Notification.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Total Length: Length of entire IP Packet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Identification: An identification number for fragmented packets.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Flags&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Fragment Offset: Position of the fragment in the original Packet.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Time to Live.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Protocol: Next level Protocol. (UDP, TCP, etc.).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Header Checksum&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Source Address&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Destination Address&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Options&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ic5Vw.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ic5Vw.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;IPV6&lt;/em&gt; designers have reduced this complexity (&lt;strong&gt;streamlined the header&lt;/strong&gt;) to make it easier for routers and network systems to verify each packet and forward it using a routing table. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The IPV6 header has the following 8 fields:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Version&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Traffic Class: 8-bits, the most significant 6 bits are Type of Service and the remaining 2 are used for Explicit Congestion Notification (ECN).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Flow Label: Used to maintain the sequential flow of the packets belonging to a communication. The source labels the sequence to help the router identify that a particular packet belongs to a specific flow of information. This field helps avoid re-ordering of data packets. It is designed for streaming/real-time media.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Payload Length: Payload is composed of Extension Headers and Upper Layer data. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Next Header: Indicates either the type of Extension Header, or if the Extension Header is not present then it indicates the Upper Layer.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Hop Limit: This is the same as TTL on IPv4.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Source Address (128-bits).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Destination Address (128-bits).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The IPv6 header format was designed to keep the header overhead to a minimum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The non-essential fields and optional fields were moved to extension headers that are placed after the IPv6 header. The IPv6 header  can be processed more efficiently at intermediate routers.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2017-02-21T09:19:51.940" LastActivityDate="2017-02-21T09:19:51.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39094" PostTypeId="1" AcceptedAnswerId="39112" CreationDate="2017-02-20T12:06:52.933" Score="1" ViewCount="7053" Body="&lt;p&gt;If you need to use a certain feature on a Cisco router, you need to enable to the licence, fair enough. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, i have witnessed licences expire, and nothing happens???&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before ....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Index 2 Feature: securityk9&lt;br&gt;&#xA;    Period left: 1  day  18 hours &#xA;    Period Used: 8  weeks 2  days &#xA;    License Type: EvalRightToUse&#xA;    License State: Active, In Use&#xA;    License Count: Non-Counted&#xA;    License Priority: Low&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After ... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Index 2 Feature: securityk9&lt;br&gt;&#xA;        Period left: Life time&#xA;        License Type: RightToUse&#xA;        License State: Active, In Use&#xA;        License Count: Non-Counted&#xA;        License Priority: Low&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So now i have a 'RightToUse' licence, i am led to believe that this honor based, i.e. use it until you pay for it ????&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was informed that after a reboot 'securityk9' will not work, but that turned out not to be true, its just the same after the reboot. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that does not make sense, i thought Cisco were clamping down on this, to add to their billlions....&lt;/p&gt;&#xA;" OwnerUserId="8109" LastActivityDate="2017-02-22T14:58:03.020" Title="Cisco Licence expired" Tags="|cisco|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39095" PostTypeId="2" ParentId="29281" CreationDate="2017-02-20T12:40:45.923" Score="1" Body="&lt;p&gt;if you can, measure whether you have any layer 4 erros i.e run iperf3 UDP test between two hosts on this link. if you do not encounter any loss or too many retransmissions (in TCP test) you don't have to worry. &lt;/p&gt;&#xA;" OwnerUserId="34589" LastActivityDate="2017-02-20T12:40:45.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39100" PostTypeId="2" ParentId="39077" CreationDate="2017-02-20T17:42:34.170" Score="2" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;What is the purpose of the WAN interface and how does it separate a&#xA;local virtual environment from the public internet? And how is it&#xA;similar to a cable modem?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;WAN interface is a vague term but it has a couple widely used meanings.&lt;/p&gt;&#xA;&lt;p&gt;@RonMaupin has given a great description of what WAN interfaces mean to enterprises.  In addition to his description, I would also add BGP as another important WAN edge protocol.&lt;/p&gt;&#xA;&lt;p&gt;However, WAN interfaces often have a slightly different meaning for SOHO and Small Business networking devices.  The WAN interface is often a routed interface with a few additional features preconfigured.  The features are bulleted below.  The remaining ports on such a device are often switched interfaces.  The purpose is to accept an ethernet handoff from a device such as a cable modem or DSL modem and provide internet access to the switched ports/interfaces.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The WAN interface is most likely a routed interface as opposed to a switched interface.&lt;/li&gt;&#xA;&lt;li&gt;The WAN interface is expecting an ethernet, layer-3 handoff.&lt;/li&gt;&#xA;&lt;li&gt;The interface is configured to accept a DHCP address (a static address can usually be set).&lt;/li&gt;&#xA;&lt;li&gt;The WAN interface is configured as an &amp;quot;Outside&amp;quot; interface in respect to Network Address Port Translation(NAPT).  &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc2663#section-4.1.2&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc2663#section-4.1.2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;The WAN interface is configured as the default route.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;There are other purposes and uses for this configuration, but it is safe to say Internet Access is the most common goal.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;DNS and DHCP are typically running on a server; why is it not a good&#xA;idea to run these services on a router?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;While DNS and DHCP services are often available on a router, they are often taxing on the networking device, limited in features, limited in management capabilities and are not suitable in medium to large scale deployments.  @RonMaupin addresses the first point very well, but I also want to draw attention to the other two points.&lt;/p&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-02-20T17:42:34.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39102" PostTypeId="1" AcceptedAnswerId="39111" CreationDate="2017-02-20T18:44:53.953" Score="1" ViewCount="5367" Body="&lt;p&gt;I'm troubleshooting a problem with my site-to-site VPN at one location.  I've narrowed it down to the link being up, but traffic dropping due to routing problems.  I'm running ospf with over ipsec protected gre tunnels on two Ubiquiti routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using tcpdump to try and capture bfd packets with a non-zero diagnostic field.  I'm using the BFD header described in RFC 5880 found &lt;a href=&quot;https://tools.ietf.org/pdf/rfc5880.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wJYgT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wJYgT.png&quot; alt=&quot;bfd packet header from rfc 5880&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially the BFD header field I'm interested in should be bits 3-7 of byte 0 from the BFD header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running the following tcpdump command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;sudo tcpdump -i tun1001 &quot;port 3784 and ip[9] &amp;amp;255==17&quot; -vvv -s 0&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;(I realized that I don't need the &amp;amp;255, I was just trying to make sure things worked the way that I understand them)&lt;/em&gt; This shows me the packets I'm looking for to start with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;13:21:25.269162 IP (tos 0x0, ttl 255, id 18326, offset 0, flags [DF], proto UDP (17), length 52)&#xA;    10.254.254.1.55178 &amp;gt; 10.254.254.2.3784: [no cksum] BFDv1, length: 24&#xA;        Control, State Up, Flags: [Control Plane Independent], Diagnostic: No Diagnostic (0x00)&#xA;        Detection Timer Multiplier: 3 (750 ms Detection time), BFD Length: 24&#xA;        My Discriminator: 0x0000178b, Your Discriminator: 0x0000177d&#xA;          Desired min Tx Interval:     250 ms&#xA;          Required min Rx Interval:    250 ms&#xA;          Required min Echo Interval: 1000 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Adding &lt;strong&gt;ip[24] &amp;amp;31 == 0&lt;/strong&gt; still shows packets, confusingly displaying even packets with a diagnostic field set.  I also tried &lt;strong&gt;ip[24]&amp;amp;192&gt;&gt;5=1&lt;/strong&gt; to get protocol version 1 but that did not behave as expected either.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried adding &lt;strong&gt;((ip[24]&amp;amp;0x1f)!=0)&lt;/strong&gt; without any luck either.  The session drops without showing that packet that I normally see containing ( Diagnostic:Control Detection Time Expired (0x01) ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel like I'm missing something really basic.&lt;/p&gt;&#xA;" OwnerUserId="14879" LastActivityDate="2017-02-20T21:20:31.970" Title="capturing specific BFD packets using tcpdump" Tags="|tcpdump|bfd|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39103" PostTypeId="1" CreationDate="2017-02-20T18:48:07.837" Score="1" ViewCount="388" Body="&lt;p&gt;So I've had a question that I haven't had a real answer to, I'm not even sure if there is an answer other than &quot;That's just how the algorithm does it.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So why does STP only block one end of a line on a switch? So you'll see one port on one end in a BLK(ing) status, and the other one as FWD. Why aren't they both blocked? You can't use that line now, so what's the point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any real reason why? Have I overlooked something?&lt;/p&gt;&#xA;" OwnerUserId="34307" LastEditorUserId="8499" LastEditDate="2018-03-19T00:15:49.610" LastActivityDate="2018-03-19T00:15:49.610" Title="STP / Why one end is in BLK state?" Tags="|ethernet|switching|spanning-tree|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39104" PostTypeId="2" ParentId="39103" CreationDate="2017-02-20T18:51:29.147" Score="3" Body="&lt;p&gt;You need to think about ethernet. Ethernet is a protocol originally designed to connect multiple devices on a link. STP must assume that there could be more than just the two switch interfaces on the link. If STP blocked both ends of the link, any other devices on the link would be disconnected from the rest of the network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-20T19:02:44.953" LastActivityDate="2017-02-20T19:02:44.953" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39105" PostTypeId="2" ParentId="39103" CreationDate="2017-02-20T19:01:11.293" Score="0" Body="&lt;p&gt;when STP is used in a switch topology it allows 3 ports:&#xA;root port: It is the port which connects the switch to the root port (I am assuming you know how the root port selection works)&#xA;Blocked and forwarding port: The basic property of forwarding port is that it can receive BPDU's but not send them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now consider an example where the one of the switch is down STP needs to be converged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If both the ports of a link are down, both ports will wait for the convergence information(that is the information needed for the selection of the new root port) but none will be able to send it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thus both links cannot be blocked.&#xA;I encourage you to read about STP time outs and how convergence process works&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-02-20T19:01:11.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39106" PostTypeId="2" ParentId="12594" CreationDate="2017-02-20T19:01:56.543" Score="0" Body="&lt;p&gt;DHCP has a few characteristics that could be regarded as problems.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;There is no way for a router to say &quot;I have routes to these networks but not the internet in general&quot;.&lt;/li&gt;&#xA;&lt;li&gt;There are no provisions made for redundancy and load balancing of multiple gateways (this can be hacked arround at lower levels). &lt;/li&gt;&#xA;&lt;li&gt;DHCP servers are stateful&lt;/li&gt;&#xA;&lt;li&gt;There is no provision for running multiple adresses in paralell. IPv6 proponents saw running multiple addresses in parallel as a soloution to support multihoming without resorting to NAT or bloating the gloabl routing table with PI space.&lt;/li&gt;&#xA;&lt;li&gt;There is no provision for telling a client that due to unexpected network structure changes previous promises made in the DHCP lease can no longer be kept.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-20T19:01:56.543" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39107" PostTypeId="1" AcceptedAnswerId="39148" CreationDate="2017-02-20T20:51:41.780" Score="5" ViewCount="1900" Body="&lt;p&gt;What happens if an error is detected at the lowest possible layer of the stack ISO/OSI for Ethernet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, considering 100BASE-TX, it is implemented with a 4B5B coding this means that there are 16 combinations of bits are invalid. What happens if a receiver &quot;reads&quot; from the physical medium an invalid combination of bit, e.g. &quot;00001&quot;?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It discards that bit (invalidating the entire frame)&lt;/li&gt;&#xA;&lt;li&gt;It select the &quot;most similar&quot; combination&lt;/li&gt;&#xA;&lt;li&gt;or something else?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I know that upper layers can detect the error, e.g. the MAC layer via the FCS field, but I don't know how the transreceiver works with an error detected in the signal.&lt;/p&gt;&#xA;" OwnerUserId="34600" LastEditorUserId="34600" LastEditDate="2017-02-20T21:58:49.637" LastActivityDate="2017-02-21T23:35:09.270" Title="Physical layer errors in Ethernet" Tags="|ethernet|errors|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39108" PostTypeId="1" AcceptedAnswerId="39109" CreationDate="2017-02-20T20:58:57.410" Score="2" ViewCount="340" Body="&lt;p&gt;I have the following setup: a small office network behind a Cisco 2900 series router. The network consists of about 20 devices - PCs, printers and switches. I have two ISPs that I want to configure failover with. The thing is, ISP1 gives us real, static, public IP addresses, while ISP2 gives us just one such address and everything on the inside network has to be privately addressed (via DHCP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if both ISPs were giving us just one public address, failover could be configured with IP SLA to check if the primary route is still available and then a secondary static route that takes over if the primary fails. But how to do it if all the internal addresses have to change as well, from public to private? Is there some way to have a &quot;dormant&quot; DHCP server, which becomes active only when the primary route fails, and then turns off again when the primary route is restored? Or maybe there is some other option that is exactly for this scenario?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="21387" LastEditorUserId="8499" LastEditDate="2018-03-07T19:10:15.770" LastActivityDate="2018-03-07T19:10:15.770" Title="Failover with two ISPs, one with public and one with private addresses" Tags="|cisco|routing|cisco-ios|nat|failover|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39109" PostTypeId="2" ParentId="39108" CreationDate="2017-02-20T21:09:26.140" Score="3" Body="&lt;p&gt;That depends on whether or not you need to public addresses to be available outside you company. If so, you are going to need to work with the ISPs to set up BGP routing with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't need for your internal, public addresses to be seen outside your network, then you can simply NAT with the failover ISP. NAT doesn't care that addresses are public or private; there is nothing inherent in IP that distinguishes public or private addresses.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-20T21:09:26.140" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39110" PostTypeId="2" ParentId="39108" CreationDate="2017-02-20T21:10:19.653" Score="3" Body="&lt;p&gt;Putting aside the question of why you are using public addresses in your network for a moment, you would configure this the same way if you were using private addresses: you configure NAT (actually PAT) to translate your inside addresses to the one public address.   In other words, it does not matter if your inside addresses are public or private -- NAT works exactly the same way.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-02-20T21:10:19.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39111" PostTypeId="2" ParentId="39102" CreationDate="2017-02-20T21:20:31.970" Score="3" Body="&lt;p&gt;Okay, so I found this &lt;a href=&quot;https://www.wains.be/pub/networking/tcpdump_advanced_filters.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; which had an interesting example of how to build a tcpdump filter to match SMTP packets beginning with the string 'MAIL' in the segment data.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like my biggest error was in forgetting that the UDP packet nested inside the IP packet is what I wanted to filter.  Using that, I came up with &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sudo tcpdump -i tun1001 &quot;(udp[2:2]==3784) and ip[9] &amp;amp;255==17 and ((udp[8] &amp;amp;0x1f)&amp;gt;0)&quot; -vvv -s 0 -XX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which seems to do what I want and show packets with diagnostic bits only.  The correct filter for the version would then be ( in this filter the diagnostics bits are filtered to be &lt;em&gt;absent&lt;/em&gt; ):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; sudo tcpdump -i tun1001 &quot;(udp[2:2]==3784) and ip[9] &amp;amp;255==17 and ((udp[8] &amp;amp;0x1f)=0) and ((udp[8] &amp;amp;0xe0)&amp;gt;&amp;gt;5)==1&quot; -vvv -s 0 -XX&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14879" LastActivityDate="2017-02-20T21:20:31.970" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39112" PostTypeId="2" ParentId="39094" CreationDate="2017-02-20T23:15:36.937" Score="1" Body="&lt;p&gt;Unless something has changed very recently with Cisco's licensing model, the expiration of the eval license does not cause the featureset to stop working on the appliance.  But the EULA you had to accept before enabling the RTU license says something to the effect that you won't try to use it past the 90-day mark.&lt;/p&gt;&#xA;" OwnerUserId="13361" LastActivityDate="2017-02-20T23:15:36.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39113" PostTypeId="2" ParentId="39018" CreationDate="2017-02-20T23:39:23.107" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, does installing an uplink module in an EX4200 cancels some of&#xA;  the other 48 built-in ports, as with the older EX3200?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, the EX4200 allows all 48 fixed interfaces to operate along with the uplink module, unlike the 3200, which disables the last four interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is due to the 4200 having 3x PFEs compared with the 2 built into the 3200.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-02-20T23:39:23.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39117" PostTypeId="1" CreationDate="2017-02-21T04:20:07.730" Score="1" ViewCount="544" Body="&lt;p&gt;I got an information that tcpdump is same like wireshark. In using tcpdump we can capture the packets, but in wireshark we can see the GUI of packet capture. Later I understand that we can use the tcpdump command, it will capture the payload as well&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump -nnvvXSs 1514 -i &amp;lt;interface&amp;gt; port 80 -w output.pcap.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Actually my company tells me that when ever calling an API we need to analyse the data using wireshark. I'm a beginner could you please tell me the what should I need to check with wireshark ?  I know its a packet capture tool, analyse data inside packet.  What should I learn ? What are the important point that should I keep while before capturing packets ? Is anything else other than packet capture ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got some incomplete data, when an incomplete response is resulting back to the console or whatever the tool that  are using for the response and then when sniiff the data, it is showing the incomlpete data -it is called memory leak    is it correct ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;, that I got after type the tcpcump command and then open postman call an http API request, then open wireshark and then anlalyse the packets...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is I need to learn more tcpdump command to work with wireshark ?&#xA;What are the testing possibilities of wireshark ?  like vulnerabilties etc..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which language that every one using in wireshark ?  In coding what everyone finding using with wireshark ?&lt;/p&gt;&#xA;" OwnerUserId="34275" LastEditorUserId="34275" LastEditDate="2017-02-21T12:17:58.297" LastActivityDate="2017-02-21T12:21:32.147" Title="What are the testing possibilities of wireshark?" Tags="|wireshark|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39124" PostTypeId="2" ParentId="39003" CreationDate="2017-02-21T10:35:57.623" Score="1" Body="&lt;p&gt;I have seen it happening in Linux ipsec-tools (KAME stack/racoon IKE daemon), the loss is about 1-2 seconds during re-key.&lt;/p&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-02-21T10:35:57.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39125" PostTypeId="1" CreationDate="2017-02-21T10:36:29.763" Score="1" ViewCount="48" Body="&lt;p&gt;I have a professional issue with this matter, is it technically possible to know if a visitor on my website is connected via mobile data or home/cable/DSL?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got complete IP ranges of all carriers in my country and thought about using a reverse DNS lookup on connection, but maybe it's not the best way to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="34610" LastEditorUserId="8499" LastEditDate="2017-02-21T18:28:53.470" LastActivityDate="2017-02-21T18:28:53.470" Title="Differentiate Data or Cable/DSL visitor on a Website" Tags="|data|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39126" PostTypeId="2" ParentId="39125" CreationDate="2017-02-21T11:01:45.307" Score="2" Body="&lt;p&gt;Is carrier is also ISP in your country? You can know ISP by the IP, but carrier can be different (technically). Another question is each carrier uses only one access method ? if the answers yes&amp;amp;yes, you probably not need for reverse DNS, just check source IP of the connection.&#xA;This does not cover cases when users are using VPNs or proxies of course, so you need to be aware that checking source IP is not 100% trustworthy.&lt;/p&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-02-21T11:01:45.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39127" PostTypeId="2" ParentId="39117" CreationDate="2017-02-21T12:21:32.147" Score="1" Body="&lt;p&gt;As @adam86 points out, Wireshark can do more than just capture packets, but you need to understand what your application does and how it communicates in order to make any sense out of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark is a protocol analyzer.  It lets you dissect most commonly used protocols down to the bit-level, so you can see why things might be going wrong.  It can display conversations between two endpoints.  Wireshark can also calculate throughput in TCP streams.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark can do other things, but again, if you don't understand what you are trying to do, or how the protocols work, it won't be of much help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I may suggest, go to the Wireshark website and watch or read some of their tutorials.  That may give you a better appreciation.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-02-21T12:21:32.147" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39131" PostTypeId="1" CreationDate="2017-02-21T14:02:24.347" Score="3" ViewCount="1403" Body="&lt;p&gt;From IOS 15 we can log on Cisco IOS with RSA public key authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However we still have to assign a password to the user. If we don't the user can log on without any password (and without the private key).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means that the password can still be brute-forced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm looking for is a way for users to log on to the switch with privilege 15 without entering any password and totally disabling the password authentication for those users.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found for example (among others) &lt;a href=&quot;https://supportforums.cisco.com/discussion/11344526/disable-password-authentication-ssh&quot; rel=&quot;nofollow noreferrer&quot;&gt;this answer on Cisco forums&lt;/a&gt; that says it isn't possible but I hope that 5 years latter a solution has been found to this security issue.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2021-08-09T12:27:15.363" Title="Cisco IOS public-key auth with privilege 15 and no password" Tags="|cisco|ssh|authentication|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39132" PostTypeId="1" CreationDate="2017-02-21T14:12:59.347" Score="1" ViewCount="792" Body="&lt;p&gt;how can i config the default gateway and the mgmt ip address in this raisecom  equipment?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Product Name      : ISCOM5508&#xA;Product Version   : P300R003C000T000&#xA;ROAP Version      : 1.3&#xA;System MAC Address: 000e.5e3e.aa7e&#xA;&#xA;&#xA;Slot ID: 1&#xA;&#xA;Card Type         : ISCOM5508-GPSC&#xA;&#xA;System1  Version  : ISCOM5508-GPSC_ROAP_2.41.1(SP1)_20160503&#xA;&#xA;System2  Version  : ISCOM5508-GPSC_ROAP_2.41.2(SP1)_20161010(active)(committed)&#xA;&#xA;Mainrom1 Version  : ISCOM5508-GPSC_FLASH_MAINROM_2.3.2_20131122(active)(committed)&#xA;&#xA;Mainrom2 Version  : ISCOM5508-GPSC_FLASH_MAINROM_2.3.2_20131122&#xA;&#xA;Bootrom  Version  : ISCOM5508-GPSC_FLASH_BOOTROM_2.3.1_20131017&#xA;&#xA;Hardware Version  : A.00&#xA;&#xA;Firmware Version  : 2.3_build_61_0&#xA;&#xA;CPLD     Version  : V1.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;thanks for the help,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards,&#xA;1m4g1n3&lt;/p&gt;&#xA;" OwnerUserId="34298" LastEditorUserId="775" LastEditDate="2018-07-18T11:40:06.363" LastActivityDate="2022-03-29T20:03:45.350" Title="raisecom olt (ISCOM5508) default gateway" Tags="|fiber|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39134" PostTypeId="2" ParentId="39125" CreationDate="2017-02-21T15:20:05.313" Score="0" Body="&lt;p&gt;Actually, no. You are asking about a layer-1 connection that is only known or relevant on the layer-1 link. There is nothing about layer-1 that is carried into the upper network layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be possible to discover the ISP that owns the IP address used, but that is not definitive, especially where the owner provides mobile, home, and business Internet services, or the ISP is a smaller home ISP that uses IP address blocks from a larger business ISP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-21T15:20:05.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39138" PostTypeId="2" ParentId="39094" CreationDate="2017-02-21T17:59:08.703" Score="0" Body="&lt;p&gt;Cisco hardware ready to use on buy but some software features need license to work actively like mpls traffic engineering or Brodging L3 to L2 vpn access solutions.&lt;/p&gt;&#xA;" OwnerUserId="8007" LastActivityDate="2017-02-21T17:59:08.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39139" PostTypeId="2" ParentId="38967" CreationDate="2017-02-21T18:10:09.710" Score="0" Body="&lt;p&gt;Another reason: if the time of a HTTPS client is significantly different from the time of a HTTPS server, the connection may not work. I have observed this once, when a laptop had time that was off by probably several months. No HTTPS site worked. Fixing the time allowed HTTPS to work. I'm not sure if this was connected to certificate validity or something else, but the effect of HTTPS not working with severely incorrect time is true.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, in a typical switch lifetime of 10 years or so, it is unlikely that the clock of a switch would be severely off so much that HTTPS does not work. This also applies only if the switch implements HTTPS. Some insecure managed switches may support only HTTP.&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2017-02-21T18:10:09.710" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39140" PostTypeId="1" AcceptedAnswerId="39142" CreationDate="2017-02-21T19:39:25.397" Score="1" ViewCount="2993" Body="&lt;p&gt;Please consider the following scenario&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The router (Linksys E2000) has an INTERNET port where the main network is plugged in. The router has some ETHERNET/OUT ports where a switch, laptop or PC can plug in. The router has the address 192.168.X.Y&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;A LAN wire from one of the ETHERNET ports of the router is plugged back into the main network port.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Will main network see the router's DHCP address 192.168.X.Y?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know if I should clarify further.&lt;/p&gt;&#xA;" OwnerUserId="34627" LastEditorUserId="8499" LastEditDate="2018-03-19T05:46:08.743" LastActivityDate="2018-03-19T05:46:08.743" Title="Does a network switch broadcast local IP Addresses?" Tags="|switch|router|ieee-802.11|multicast|broadcast|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39141" PostTypeId="1" CreationDate="2017-02-21T19:54:05.837" Score="2" ViewCount="375" Body="&lt;p&gt;I am having trouble troubleshooting this OP script. When I run the following script and include an IP address, I get the following error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;{primary:node1}&#xA;user@fwB&amp;gt; op tpol source-address x.x.x.x destination-address x.x.x.0 destination-port 2002    (Real IPs redacted)&#xA;error: jcs:execute: null argument&#xA;error: xmlXPathCompiledEval: evaluation failed&#xA;error: runtime error: file /var/db/scripts/op/policy-test-v2.slax line 104 element variable&#xA;error: Failed to evaluate the expression of variable 'get-route'.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I ran traceoptions for op-scripts and it looks like it is actually failing at line 111:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb 21 13:29:54 reading op script 'policy-test-v2.slax'&#xA;Feb 21 13:29:57 jcs:execute: null argument&#xA;&#xA;Feb 21 13:29:57 xmlXPathCompiledEval: evaluation failed&#xA;Feb 21 13:29:57 runtime error: file /var/db/scripts/op/policy-test-v2.slax line 111 element variable&#xA;&#xA;Feb 21 13:29:57 Failed to evaluate the expression of variable 'get-int'.&#xA;&#xA;Feb 21 13:29:57 op script output&#xA;Feb 21 13:29:57 begin dump&#xA;&amp;lt;?xml version=&quot;1.0&quot;?&amp;gt;&#xA;Feb 21 13:29:57 end dump&#xA;Feb 21 13:29:57 inspecting op output 'policy-test-v2.slax'&#xA;Feb 21 13:29:57 finished op script 'policy-test-v2.slax'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm having trouble figuring out what piece of the evaluation is missing, it seems like everything is called as necessary, but I am not an expert with these scripts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(As a side question, is it possible to edit an op-script on-box instead of deleting and re-uploading a script?)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1   /* Machine Crafted with Care (tm) by slaxWriter */&#xA;2   version 1.0;&#xA;3  &#xA;4   ns junos = &quot;http://xml.juniper.net/junos/*/junos&quot;;&#xA;5   ns xnm = &quot;http://xml.juniper.net/xnm/1.1/xnm&quot;;&#xA;6   ns jcs = &quot;http://xml.juniper.net/junos/commit-scripts/1.0&quot;;&#xA;7  &#xA;8  &#xA;9   /*&#xA;10  This is a simple script that looks up all the entries in the policy table that match a particular query&#xA;11  It is useful to debug polcy configurations&#xA;12   */&#xA;13  import &quot;../import/junos.xsl&quot;;&#xA;14  var $arguments = {&#xA;15      &amp;lt;argument&amp;gt; {&#xA;16          &amp;lt;name&amp;gt; &quot;source-address&quot;;&#xA;17          &amp;lt;description&amp;gt; &quot;Source IP address of the initial session creation packet&quot;;&#xA;18      }&#xA;19      &amp;lt;argument&amp;gt; {&#xA;20          &amp;lt;name&amp;gt; &quot;destination-address&quot;;&#xA;21          &amp;lt;description&amp;gt; &quot;Destination IP address of the initial session creation packet&quot;;&#xA;22      }&#xA;23      &amp;lt;argument&amp;gt; {&#xA;24          &amp;lt;name&amp;gt; &quot;source-port&quot;;&#xA;25          &amp;lt;description&amp;gt; &quot;Source port of the packet&quot;;&#xA;26      }&#xA;27      &amp;lt;argument&amp;gt; {&#xA;28          &amp;lt;name&amp;gt; &quot;destination-port&quot;;&#xA;29          &amp;lt;description&amp;gt; &quot;Destination port of the packet&quot;;&#xA;30      }&#xA;31      &amp;lt;argument&amp;gt; {&#xA;32          &amp;lt;name&amp;gt; &quot;from-zone&quot;;&#xA;33          &amp;lt;description&amp;gt; &quot;Ingress zone of the packet&quot;;&#xA;34      }&#xA;35      &amp;lt;argument&amp;gt; {&#xA;36          &amp;lt;name&amp;gt; &quot;to-zone&quot;;&#xA;37          &amp;lt;description&amp;gt; &quot;Egress zone of the packet&quot;;&#xA;38      }&#xA;39  }&#xA;40  /* Open a persistent connection */&#xA;41  var $connection = jcs:open();&#xA;42  param $source-address = {&#xA;43      expr &quot;0.0.0.0/0&quot;;&#xA;44  }&#xA;45  param $destination-address = {&#xA;46      expr &quot;0.0.0.0/0&quot;;&#xA;47  }&#xA;48  param $source-port = {&#xA;49      expr &quot;0&quot;;&#xA;50  }&#xA;51  param $destination-port = {&#xA;52      expr &quot;0&quot;;&#xA;53  }&#xA;54  param $protocol = {&#xA;55      expr &quot;0&quot;;&#xA;56  }&#xA;57  param $from-zone = {&#xA;58      call find-zone($ip = $source-address);&#xA;59  }&#xA;60      param $to-zone = {&#xA;61      call find-zone($ip = $destination-address);&#xA;62  }   &#xA;63          &#xA;64 &#xA;65  /* print-policy: Displays the policy info */&#xA;66  template print-policy ($name, $from-zone, $to-zone, $source-address, $destination-address, $application, $action, $comment, $row = number(&quot;1&quot;), $header = false()) {&#xA;67      var $format-string = &quot;%-15.14s %-15.14s %-25.24j1s %-25.24s %-25.24s %-15.14s %-10.9s %s \n&quot;;&#xA;68      &#xA;69      if ($header) {&#xA;70          expr jcs:printf($format-string, &quot;From-Zone&quot;, &quot;To-Zone&quot;, &quot;Name&quot;, &quot;Src-Addr&quot;, &quot;Dst-Addr&quot;, &quot;Application&quot;, &quot;Action&quot;, &quot;&quot;);&#xA;71      &#xA;72      } else {&#xA;73          var $num-rows = {&#xA;74              if (count($application) &amp;gt;= count($source-address) &amp;amp;&amp;amp; count($application) &amp;gt;= count($destination-address)) {&#xA;75                  expr count($application);&#xA;76              &#xA;77              } else if (count($source-address) &amp;gt; count($application) &amp;amp;&amp;amp; count($source-address) &amp;gt; count($destination-address)) {&#xA;78                  expr count($source-address);&#xA;79              &#xA;80              } else {&#xA;81                  expr count($destination-address);&#xA;82              }&#xA;83          }&#xA;84          &#xA;85          if ($row &amp;lt;= $num-rows) {&#xA;86              expr jcs:printf($format-string, $from-zone, $to-zone, $name, $source-address[$row] , $destination-address[$row] , $application[$row] , $action, $comment);&#xA;87              call print-policy($row = $row + 1, $num-rows, $source-address, $destination-address, $application);&#xA;88          }&#xA;89      }&#xA;90  }&#xA;91 &#xA;92  /* find-zone: Returns the zone where a given IP is */&#xA;93  template find-zone ($ip) {&#xA;94      &#xA;95      if ($ip == &quot;0.0.0.0/0&quot;) {&#xA;96          expr &quot;any&quot;;&#xA;97      &#xA;98      } else {&#xA;99          var $get-route-rpc = &amp;lt;command&amp;gt; {&#xA;100             expr &quot;show route &quot;;&#xA;101             expr $ip;&#xA;102             expr &quot; active-path best&quot;;&#xA;103         }&#xA;104         var $get-route = jcs:execute($connection, $get-route-rpc);&#xA;105         var $zone = {&#xA;106             if ($get-route//via) {&#xA;107                 var $get-int-rpc = &amp;lt;command&amp;gt; {&#xA;108                     expr &quot;show interface &quot;;&#xA;109                     expr $get-route//via;&#xA;110                 }&#xA;111                 var $get-int = jcs:execute($connection, $get-int-rpc);&#xA;112                 &#xA;113                 expr $get-int//logical-interface-zone-name;&#xA;114             &#xA;115             } else {&#xA;116                 expr &quot;any&quot;;&#xA;117             }&#xA;118         }&#xA;119         &#xA;120         expr $zone;&#xA;121     }&#xA;122 }&#xA;123&#xA;124 /* rshift: Shifts bits to the right. Used to do an IP/MASK comparision */&#xA;125 template rshift ($number, $count) {&#xA;126     &#xA;127     /* &amp;lt;output&amp;gt;&#xA;128     &amp;lt;xsl:value-of select=&quot;jcs:printf('Shifting %i %i times\n',$number, $count)&quot;/&amp;gt;       &#xA;129     &amp;lt;/output&amp;gt; */&#xA;130     if ($count &amp;lt;= 0) {&#xA;131         expr $number;&#xA;132     &#xA;133     } else {&#xA;134         call rshift($number = floor($number div 2), $count = ($count) - 1);&#xA;135     }&#xA;136 }&#xA;137&#xA;138 /* match-ip: Returns true if the ip is in the prefix */&#xA;139 template match-ip ($prefix, $ip) {&#xA;140     var $bytes-network = jcs:regex(&quot;([0-9]+).([0-9]+).([0-9]+).([0-9]+)/([0-9]+)&quot;, $prefix);&#xA;141     var $subnet = {&#xA;142         call rshift($number = $bytes-network[2] * 16777216 + $bytes-network[3] * 65536 + $bytes-network[4] * 256 + $bytes-network[5], $count = 32 -($bytes-network[6]));&#xA;143     }&#xA;144     var $bytes-ip = jcs:regex(&quot;([0-9]+).([0-9]+).([0-9]+).([0-9]+)&quot;, $ip);&#xA;145     var $ipnet = {&#xA;146         call rshift($number = $bytes-ip[2] * 16777216 + $bytes-ip[3] * 65536 + $bytes-ip[4] * 256 + $bytes-ip[5], $count = 32 - $bytes-network[6]);&#xA;147     }&#xA;148     &#xA;149     if ($ipnet == $subnet) {&#xA;150         expr true();&#xA;151     &#xA;152     } else {&#xA;153         expr false();&#xA;154     }&#xA;155 }&#xA;156&#xA;157 /* match-prefix-list: Returns true if the ip is in the prefix list */&#xA;158 template match-prefix-list ($ip, $prefix-list) {&#xA;159     &#xA;160     if ($ip == &quot;0.0.0.0/0&quot;) {&#xA;161         expr true();&#xA;162     } else {&#xA;163     if (not($prefix-list)) {&#xA;164         expr false();&#xA;165     &#xA;166     } else {&#xA;167         var $match-prefix = {&#xA;168             call match-ip($ip, $prefix = $prefix-list);&#xA;169         }&#xA;170         &#xA;171         if ($match-prefix == &quot;true&quot;) {&#xA;172             expr true();&#xA;173         &#xA;174         } else {&#xA;175             call match-prefix-list($ip, $prefix-list = $prefix-list[position() &amp;gt; 1 ] );&#xA;176             }&#xA;177         }&#xA;178     }&#xA;179 }&#xA;180&#xA;181 match / {&#xA;182     &amp;lt;op-script-results&amp;gt; {&#xA;183         /* First, check parameters passed */&#xA;184         if (not(jcs:parse-ip($source-address))) {&#xA;185             &amp;lt;output&amp;gt; jcs:printf(&quot;Bad IP address format: %s&quot;, $source-address);&#xA;186         &#xA;187         } else if (not(jcs:parse-ip($destination-address))) {&#xA;188             &amp;lt;output&amp;gt; jcs:printf(&quot;Bad IP address format: %s&quot;, $destination-address);&#xA;189         &#xA;190         } else if (not($source-port &amp;gt;= 0 &amp;amp;&amp;amp; $source-port &amp;lt;= 65535)) {&#xA;191             &amp;lt;output&amp;gt; jcs:printf(&quot;Bad IP port number: %s&quot;, $source-port);&#xA;192         &#xA;193         } else if (not($destination-port &amp;gt;= 0 &amp;amp;&amp;amp; $destination-port &amp;lt;= 65535)) {&#xA;194             &amp;lt;output&amp;gt; jcs:printf(&quot;Bad IP port number: %s &quot;, $destination-port);&#xA;195         &#xA;196         } else {&#xA;197             &amp;lt;output&amp;gt; {&#xA;198                 call print-policy($header = true());&#xA;199                 expr jcs:trace( &quot;from-zone &quot;,$from-zone);&#xA;200                 expr jcs:trace( &quot;to-zone &quot;,$to-zone);&#xA;201             }&#xA;202             var $filters = {&#xA;203                 if ($from-zone != &quot;any&quot;) {&#xA;204                     expr &quot; from-zone &quot;;&#xA;205                     expr $from-zone;&#xA;206                 }&#xA;207                 if ($to-zone != &quot;any&quot;) {&#xA;208                     expr &quot; to-zone &quot;;&#xA;209                     expr $to-zone;&#xA;210                 }&#xA;211             }&#xA;212             &#xA;213             var $get-policies-rpc = &amp;lt;command&amp;gt; {&#xA;214                 expr &quot; show security policies &quot;;&#xA;215                 expr $filters;&#xA;216                 expr &quot; detail &quot;;&#xA;217             }&#xA;218             expr jcs:trace( &quot;command &quot;, $get-policies-rpc );&#xA;219             /* Get the list of possible policies */&#xA;220             var $connection2 = jcs:open();&#xA;221             var $policies = jcs:execute( $connection2 , $get-policies-rpc );&#xA;222             /* Loop throught the policies to find the matching ones */&#xA;223             &#xA;224             for-each ($policies//policy-information) {&#xA;225                 var $match-source = {&#xA;226                     call match-prefix-list($ip = $source-address, $prefix-list = .//source-address//address-prefix);&#xA;227                     }&#xA;228                         expr jcs:trace( &quot;source-address &quot;, $source-address,&quot; prefix-list &quot;, .//source-address//address-prefix ,&quot; &quot;, $match-source );&#xA;229                 &#xA;230                 var $match-destination = {&#xA;231                     call match-prefix-list($ip = $destination-address, $prefix-list = .//destination-address//address-prefix);&#xA;232                     }&#xA;233                     expr jcs:trace( &quot;dest-address &quot;, $destination-address,&quot; prefix-list &quot;, .//destination-address//address-prefix ,&quot; &quot;, $match-destination );&#xA;234                 &#xA;235                 var $match-destination-port = {&#xA;236                     if ($destination-port == &quot;0&quot;) {&#xA;237                         expr true();&#xA;238                     &#xA;239                     } else if (./applications/application/application-term/destination-port-range[low == &quot;0&quot; &amp;amp;&amp;amp; high == &quot;0&quot;]) {&#xA;240                         expr true();&#xA;241                     &#xA;242                     } else if (./applications/application/application-term/destination-port-range[low &amp;lt;= $destination-port &amp;amp;&amp;amp; high &amp;gt;= $destination-port]) {&#xA;243                         expr true();&#xA;244                     &#xA;245                     } else {&#xA;246                         expr false();&#xA;247                     }&#xA;248                 }&#xA;249                 var $match-source-port = {&#xA;250                     if ($source-port == &quot;0&quot;) {&#xA;251                         expr true();&#xA;252                     &#xA;253                     } else if (./applications/application/application-term/source-port-range[low == &quot;0&quot; &amp;amp;&amp;amp; high == &quot;0&quot;]) {&#xA;254                         expr true();&#xA;255                     &#xA;256                     } else if (./applications/application/application-term/source-port-range[low &amp;lt;= $source-port &amp;amp;&amp;amp; high &amp;gt;= $source-port]) {&#xA;257                         expr true();&#xA;258                     &#xA;259                     } else {&#xA;260                         expr false();&#xA;261                     }&#xA;262                 }&#xA;263                 &#xA;264                  /* &amp;lt;output&amp;gt;&#xA;265                 &amp;lt;xsl:value-of select=&quot;jcs:printf('Policy name: %s\n',./policy-name)&quot;/&amp;gt;&#xA;266                 &amp;lt;xsl:value-of select=&quot;jcs:printf('  match source: %s\n', $match-source)&quot;/&amp;gt;&#xA;267                 &amp;lt;xsl:value-of select=&quot;jcs:printf('  match destination: %s\n', $match-destination)&quot;/&amp;gt;&#xA;268                 &amp;lt;xsl:value-of select=&quot;jcs:printf('  match source port: %s\n', $match-source-port)&quot;/&amp;gt;&#xA;269                 &amp;lt;xsl:value-of select=&quot;jcs:printf('  match destination port: %s\n', $match-destination-port)&quot;/&amp;gt;&#xA;270                 &amp;lt;/output&amp;gt; */&#xA;271                 if ($match-source == &quot;true&quot; &amp;amp;&amp;amp; $match-destination == &quot;true&quot; &amp;amp;&amp;amp; $match-source-port == &quot;true&quot; &amp;amp;&amp;amp; $match-destination-port == &quot;true&quot;) {&#xA;272                     &amp;lt;output&amp;gt; {&#xA;273                         call print-policy($from-zone = ../../context-information/source-zone-name, $to-zone = ../../context-information/destination-zone-name, $name = ./policy-name, $destination-address = ./destination-addresses/destination-address/address-name, $source-address = ./source-addresses/source-address/address-name, $application = ./applications/application/application-name, $action = ./policy-action/action-type);&#xA;274                     }&#xA;275                 }&#xA;276             }&#xA;277         }&#xA;278     }&#xA;279 }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17253" LastEditorUserId="17253" LastEditDate="2017-02-21T20:28:24.353" LastActivityDate="2017-02-23T00:50:33.277" Title="Junos SRX OP-Script errors" Tags="|juniper-junos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39142" PostTypeId="2" ParentId="39140" CreationDate="2017-02-21T20:14:32.957" Score="2" Body="&lt;p&gt;Switches are transparent devices. Switches, themselves, don't broadcast anything. A switch will flood unknown unicast frames, and broadcast or (possibly) multicast frames will be sent to all switch interfaces, but switches do not originate traffic, nor do they care anything about layer-3 protocols, e.g. IP, so a switch doesn't know about IP addresses, much less broadcast them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each device on a network has its own addresses, and each knows what the local network is based on its configured network mask.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Based on your edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Linksys router, and all consumer-grade devices, are explicitly off-topic here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DHCP requests are broadcast from the hosts to the network, so DHCP requests will go to all switch interfaces, including the switch interface of your DHCP server (possibly running in your router chassis). The DHCP server will respond to the requesting host with the necessary information (IP address, mask, gateway address, etc.).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-22T20:09:17.143" LastActivityDate="2017-02-22T20:09:17.143" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="39146" PostTypeId="2" ParentId="36036" CreationDate="2017-02-21T23:07:23.690" Score="0" Body="&lt;p&gt;It sounds like you're using a Gateway-to-Gateway tunnel.&#xA;Having dabbled with IPSec somewhat lately, I too have come across this same problem.  Unfortunately I was not able to overcome this problem without using STATIC IPs on both ends of the tunnel.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found that I could get it to work behind a NAT as long I forwarded UDP 500 and UDP 4500 through the NAT to the internal IP.  But as soon as your public IP changes then the tunnel will drop and you'll need to reconfigure everything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my particular case, the devices did not seem to support using DNS to resolve to an IP.  Both ends supported IP addresses only.&lt;/p&gt;&#xA;" OwnerUserId="3333" LastActivityDate="2017-02-21T23:07:23.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39148" PostTypeId="2" ParentId="39107" CreationDate="2017-02-21T23:35:09.270" Score="3" Body="&lt;p&gt;For the specific case of 100BASE-TX and the 100Mbps MII interface: there is a &lt;a href=&quot;https://en.wikipedia.org/wiki/Media-independent_interface#Receiver_signals&quot; rel=&quot;nofollow noreferrer&quot;&gt;receiver signal&lt;/a&gt; RX_ER.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Physical Coding Sublayer (PCS) specification says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;24.2.2.1.7 Invalid code-groups&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;...The PCS indicates the reception of an Invalid code-group on the MII&#xA;  through the use of the RX_ER signal.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The Reconciliation Sublayer and Media Independent Interface specification says:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;22.2.1.5 Response to RX_ER indication from MII&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If, during frame reception, both RX_DV and RX_ER are asserted, the&#xA;  Reconciliation sublayer shall ensure that the MAC will detect a&#xA;  FrameCheckError in that frame.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So the PHY part indicates the error out of band, and the MAC does what it likes, as long as it ends up generating a FrameCheckError. &lt;/p&gt;&#xA;" OwnerUserId="6377" LastActivityDate="2017-02-21T23:35:09.270" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39150" PostTypeId="2" ParentId="39131" CreationDate="2017-02-22T00:38:16.993" Score="3" Body="&lt;p&gt;This works on 2960x software 152-7.E4:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;ip ssh version 2&lt;/code&gt;&lt;br&gt;&#xA;&lt;strong&gt;&lt;code&gt;no ip ssh server algorithm authentication password&lt;/code&gt;&lt;/strong&gt;&lt;br&gt;&#xA;&lt;strong&gt;&lt;code&gt;no ip ssh server algorithm authentication keyboard&lt;/code&gt;&lt;/strong&gt;&lt;br&gt;&#xA;&lt;code&gt;line vty 0 15&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;  transport input ssh&lt;/code&gt;&lt;br&gt;&lt;/p&gt;&#xA;&lt;p&gt;This should remove telnet login also&lt;/p&gt;&#xA;" OwnerUserId="32460" LastEditorUserId="-1" LastEditDate="2021-08-09T12:27:15.363" LastActivityDate="2021-08-09T12:27:15.363" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="39153" PostTypeId="2" ParentId="11232" CreationDate="2017-02-22T04:11:24.497" Score="0" Body="&lt;p&gt;The PHY is responsible for physically sensing the carrier and detecting the collision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MAC is responsible for using that information to decide when to transmit a packet and retransmitting the packet if a collision happens.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PHY performs the auto-negotiation process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At least on the implementations I have seen the host processor reads the negotiated settings from the PHY and programs them into the settings registers of the MAC and PHY (some settings, for example speed will need to be configured the same on both MAC and PHY). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How settings are read and written from the MAC and PHY is implementation dependent, typically for separate PHYs an interface called MDIO is used. On integrated MAC/PHY chips the PHY registers may be integrated into the controller's main register map.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-22T04:11:24.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39154" PostTypeId="1" AcceptedAnswerId="39352" CreationDate="2017-02-22T04:57:03.283" Score="2" ViewCount="1253" Body="&lt;p&gt;I'm new to the Quagga and I'm wondering if it is possible to run a different OSPFd daemon per linux network namespace. My goal is to present a different logical OSPF router to external routers per network namespace. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, if I have two network namespaces; red and blue. Eth0=nsred and Eth1=nsblue. Eth0/nsred would be connected to external router1 and eth1/nsblue would be connected to external router2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone point me towards documentation on how to do this or know of a better way? Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="34641" LastActivityDate="2017-07-18T20:26:29.947" Title="Per Network Namespace Quagga OSPF" Tags="|network|quagga|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39157" PostTypeId="2" ParentId="39132" CreationDate="2017-02-22T07:20:10.957" Score="1" Body="&lt;p&gt;&lt;code&gt;config&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;ip default-gateway &amp;lt;your default gw&amp;gt;&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;management-port ip address &amp;lt;yourip&amp;gt; &amp;lt;yourmask&amp;gt;&lt;/code&gt;&lt;br&gt;&#xA;&lt;br&gt;&#xA;verify:&lt;br&gt;&#xA;&lt;code&gt;show management-port ip&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;ping &amp;lt;gw ip&amp;gt;&lt;/code&gt;&#xA;&lt;br&gt;&#xA;Just read the manual.&#xA;&lt;br&gt;&lt;/p&gt;&#xA;" OwnerUserId="32460" LastActivityDate="2017-02-22T07:20:10.957" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39158" PostTypeId="1" AcceptedAnswerId="39160" CreationDate="2017-02-22T08:39:33.743" Score="1" ViewCount="97" Body="&lt;p&gt;on a switch or router interfaces,why can't I assign an IP address with 32 bit subnet mask (255.255.255.255)?and should be (255.255.255.0)&#xA;kindly enlighten me on that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OLjvq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OLjvq.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="23982" LastEditorUserId="8499" LastEditDate="2018-03-10T04:26:54.803" LastActivityDate="2020-06-18T20:53:40.623" Title="Assigning an IP address" Tags="|cisco|ip|cisco-commands|ip-address|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39160" PostTypeId="2" ParentId="39158" CreationDate="2017-02-22T09:23:11.140" Score="3" Body="&lt;p&gt;An IP address is a parameter to make a device to &lt;strong&gt;get into&lt;/strong&gt; a network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The netmask defines the &lt;strong&gt;size&lt;/strong&gt; of the network, for example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;/24 (255.255.255.0)  has 256 addresses in the network.&lt;/li&gt;&#xA;&lt;li&gt;/30 (255.255.255.252) has 4 addreses in the network. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;/32 (255.255.255.255) has 1 adddress in the network. So the device will be &lt;strong&gt;isolated&lt;/strong&gt; and not in a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you could be able to assign that address, how can it be acccesed if it is alone?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an exception to that and it is when you create a loopback interface that doesn't need to be accesible from outside.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2017-02-22T12:22:24.947" LastActivityDate="2017-02-22T12:22:24.947" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39161" PostTypeId="1" CreationDate="2017-02-22T09:55:32.180" Score="4" ViewCount="621" Body="&lt;p&gt;SNMP agent on an embedded device. When I query SNMP device for the particular private enterprise OID object, it says &quot;No such object available on this agent at this OID&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;snmpget -v2c -c public 10.x.x.x .1.3.6.1.4.1.8595..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These objects are included in MTA config file. So my assumption was that these private OIDs objects are present in the system, but they may not be available for viewing with default &quot;public&quot; community string, &lt;em&gt;or&lt;/em&gt; they are shown via SNMP version &lt;strong&gt;v3c&lt;/strong&gt; access, &lt;em&gt;or&lt;/em&gt; some more reasons. So first I  should check SNMP agent code built into that device, does it actually contain that private MIBs? If it contains, then it should be accessible via SNMP query, is it correct? Or even it exist on the SNMP agent, it may not be accessible with SNMP query?&lt;/p&gt;&#xA;" OwnerUserId="34647" LastEditorUserId="34647" LastEditDate="2017-02-22T22:16:32.503" LastActivityDate="2017-10-22T12:51:34.367" Title="SNMP agent on embedded device, No such object available on this agent at this OID" Tags="|router|snmp|linux|docsis|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39162" PostTypeId="1" AcceptedAnswerId="39164" CreationDate="2017-02-22T09:57:32.027" Score="0" ViewCount="1226" Body="&lt;p&gt;We have a medium sized network setup with multiple switches and one firewall (pfsense). &#xA;We now have IPv6 since two months and sometimes can observe, that there is a huge amount of traffic on the firewall (~800MBit/s).&#xA;I ran ethdump and it showed up, that the network is spammed by DHCPv6 - Solicit XID packaged (~200k in 1s), that will slow the network or even break it down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What for I can see is, that I only saw microsoft products (Windows 7, Windows Server 2012 and one Surface Tablet), no Android or Linux-server was involved by now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody has similar experiences or any recommendations? I tried to block it in the firewall (IPv6 UDP dest. port 456-457, but it didn't work)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/auzx6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/auzx6.png&quot; alt=&quot;Wireshark Packagecapture&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34646" LastActivityDate="2017-02-22T10:44:57.757" Title="High traffic caused by DHCPv6" Tags="|dhcp|ipv6|pfsense|" AnswerCount="1" CommentCount="1" ClosedDate="2017-02-22T14:13:50.993" ContentLicense="CC BY-SA 3.0" />
  <row Id="39164" PostTypeId="2" ParentId="39162" CreationDate="2017-02-22T10:44:57.757" Score="2" Body="&lt;p&gt;I have seen this behaviour before. It tends to happen when you set the M (Managed) flag in the RA (Router Advertisement) but have a DHCPv6 server that doesn't provide the client with IA_NA (basically a DHCPv6 server that doesn't assign addresses). The client will go into a loop requesting addresses over and over again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't assign addresses with DHCPv6 then you should make sure the RA doesn't have the M flag set. If you need the M flag for some clients then it usually helps to rate limit the other clients. They retry immediately when they receive a DHCPv6 advertise that doesn't give them what they want, but they wait for a timeout when they don't receive a response at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know why firewalling doesn't work, it should. But remember that the clients will be using multicast to reach the server (group ff02::1:2), so you might need to adjust your filters to take that into account.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2017-02-22T10:44:57.757" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39169" PostTypeId="1" AcceptedAnswerId="39205" CreationDate="2017-02-22T14:23:29.440" Score="2" ViewCount="1035" Body="&lt;p&gt;So here's a problem I need to solve and I am having issues researching for an answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an optical cable that's coming in through SFP and it is forced to be connected to a switch before going to the router. This link is actually a trunk and it holds a few VLANs. The problem is, the switch will take this link and connect to the router with PPPoE, and then the router will have a connection going back into the switch with dot1Q (for VLANs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the current scenario is this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch receives an optical trunk link, switch is connected to router (PPPoE), router connects back to switch (dot1Q) in order to distribute to the rest of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So is it possible? If I am not mistaken, the router on hand is the Cisco 1800 router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if this is not possible, any suggestions on how to deal with this? The router is not able to take the optical trunk link, which is why this whole problem is created.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Zfj3L.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Zfj3L.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="21153" LastEditorUserId="8499" LastEditDate="2017-02-23T16:01:54.563" LastActivityDate="2017-02-23T16:05:41.440" Title="Is it possible to run PPPoE and dot1Q protocol simultaneously on a cisco router?" Tags="|cisco|switch|router|trunk|optical|" AnswerCount="1" CommentCount="16" ContentLicense="CC BY-SA 3.0" />
  <row Id="39170" PostTypeId="2" ParentId="39094" CreationDate="2017-02-22T14:58:03.020" Score="2" Body="&lt;p&gt;From &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/access/sw_activation/SA_on_ISR.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;Software Activation on Cisco Integrated Services Routers and Cisco Integrated Service Routers G2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Starting with Cisco IOS Releases 15.0(1)M6, 15.1(1)T4, 15.1(2)T4, 15.1(3)T2, and 15.1(4)M, Evaluation licenses are replaced with Evaluation Right To Use licenses. &lt;strong&gt;Evaluation Right to Use licenses automatically become Right to Use licenses after the initial evaluation period.&lt;/strong&gt; &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When you order a license from Cisco, you will receive a Right to Use Notification. You may begin using the licensed features upon receipt of the Right to Use Notification. Keep the Right to Use Notification for your records as proof of your license purchase.&#xA;  Right to Use licenses are available on Cisco IOS Release 15.0(1)M4, 15.1(1)T2, 15.1(2)T2, 15.1(3)T, 15.1(4)M1, or later. &#xA;  &lt;strong&gt;These licenses are available on the honor system&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8109" LastActivityDate="2017-02-22T14:58:03.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39171" PostTypeId="2" ParentId="39161" CreationDate="2017-02-22T15:23:57.823" Score="2" Body="&lt;p&gt;Whenever I face issues with an OID not being found, I always use the &lt;code&gt;snmpwalk&lt;/code&gt; command, in order to see what the devices do respond to:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmpwalk -v 2c -c public 10.x.x.x &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8109" LastEditorUserId="453" LastEditDate="2017-10-22T12:51:34.367" LastActivityDate="2017-10-22T12:51:34.367" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39173" PostTypeId="2" ParentId="39158" CreationDate="2017-02-22T17:08:31.033" Score="2" Body="&lt;p&gt;You &lt;strong&gt;can&lt;/strong&gt; assign a /32 address to certain interfaces - specifically loopback addresses.  Loopbacks are always up and act as a logical destination on a given IP host. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Non loopback interfaces are generally either broadcast or point-to-point (a few other options exist, but aren't common).  These interfaces are specifically set up to get traffic from one point to another and, as such, a subnet with only one host possible doesn't make sense.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-22T17:08:31.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39175" PostTypeId="2" ParentId="10173" CreationDate="2017-02-22T18:00:25.047" Score="0" Body="&lt;p&gt;Using &lt;code&gt;show CDP neighbors detail&lt;/code&gt; you will get this info:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Device ID:&#xA;Entry address(es): &#xA;IP address:&#xA;Platform:&#xA;Capabilities: &#xA;Interface:&#xA;Port ID (outgoing port):&#xA;Holdtime :&#xA;Version :&#xA;advertisement version: &#xA;Protocol Hello:&#xA;VTP Management Domain:&#xA;Duplex:&#xA;Management address(es): &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;BUT IP is not a good identifier because it could be modified manually, I would prefer to use &lt;code&gt;show version&lt;/code&gt; or &lt;code&gt;show inventory&lt;/code&gt; to get the serial number of the device.&lt;/p&gt;&#xA;" OwnerUserId="34644" LastEditorUserId="5518" LastEditDate="2017-02-23T15:00:44.197" LastActivityDate="2017-02-23T15:00:44.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39176" PostTypeId="1" AcceptedAnswerId="39184" CreationDate="2017-02-22T18:14:20.643" Score="1" ViewCount="1386" Body="&lt;p&gt;I want to see how much traffic is coming from a class C network into my network. How can have the SRX only output the IP, date and time to a specific file?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Class C Network: 201.6.2.0/24&#xA;Log file: /var/tmp/incoming.log&#xA;Interface: ge-0/0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19829" LastActivityDate="2017-02-22T22:20:53.063" Title="Juniper SRX Log Traffic From Source Address" Tags="|juniper-srx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39177" PostTypeId="2" ParentId="39154" CreationDate="2017-02-22T19:16:33.707" Score="2" Body="&lt;p&gt;You can run anything in a network namespace with &quot;ip netns exec&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it should just be a matter of writing some scripts to launch your routing daemon in different network namespaces and with different configuration/data files.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-22T19:16:33.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39178" PostTypeId="1" CreationDate="2017-02-22T19:52:17.100" Score="0" ViewCount="179" Body="&lt;p&gt;New (to enterprise networking) guy--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My org is facing room re-numbering of a 5 building, multi floor campus, wherein all nodes (PCs, printers, A/V) will need to be renamed. &#xA;Wondering if, after the renaming, would there a way to update port aliases, via LLDP, OFDP, whatever, to avoid manually updating new names. (Seems like port aliases shouldn't be handled manually in any case...)&lt;/p&gt;&#xA;" OwnerUserId="34667" LastActivityDate="2017-07-24T11:07:09.300" Title="Newb question, about LLDP for inventory" Tags="|lldp|switchport|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39179" PostTypeId="1" AcceptedAnswerId="39180" CreationDate="2017-02-22T20:46:46.230" Score="1" ViewCount="633" Body="&lt;p&gt;I read a couple of Q&amp;amp;A's here on vlans, but mostly they seem to assume having VLANs as a given.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My situation is that I have inherited a network of about 6 different subnets [some for different companies], and all the end devices are simply plugged into a total of around 20 HP Procurve switches and they all come together into a (Routerboard) router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment switches are used as dumb switches -- no VLANs configured, no nothing, and all the net division is regulated by router firewall/nat rules.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On one hand this is very easy to administer -- I don't have to do anything with switches and can make all the changes in the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, having everybody assume VLANs as a given, what would be the disadvantages of the current setup and should I consider enabling VLANs in switches? Why?&lt;/p&gt;&#xA;" OwnerUserId="33485" LastActivityDate="2017-02-24T01:47:35.197" Title="Should the network be separated into VLANs?" Tags="|vlan|firewall|subnet|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39180" PostTypeId="2" ParentId="39179" CreationDate="2017-02-22T21:02:24.553" Score="1" Body="&lt;p&gt;VLANs allow you to have different networks on a single switch. Rather than getting two switches, one for each of two VLANs, you could run both networks on a single switch (assuming you have enough switch ports on one switch). If every switch connects directly to a router, and you only need one network per switch, then there really is no need for VLANs. It also obviates the need for STP and the problems inherent in that.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-22T21:02:24.553" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="39181" PostTypeId="1" AcceptedAnswerId="39209" CreationDate="2017-02-22T21:06:13.513" Score="6" ViewCount="2225" Body="&lt;p&gt;BGP has three ways to advertise a route:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;network&lt;/code&gt; command&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;redistribute&lt;/code&gt; command&lt;/li&gt;&#xA;&lt;li&gt;Aggregation&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;There are two reasons I've come across for using the &lt;code&gt;network&lt;/code&gt; command vs the &lt;code&gt;redistribute&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;1.&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;network&lt;/code&gt; command advertises routes with an origin code of &lt;code&gt;i&lt;/code&gt; for IGP. The &lt;code&gt;redistribute&lt;/code&gt; command advertises routes with an origin code of &lt;code&gt;?&lt;/code&gt; for Incomplete.  Later, these are used in the Path Selection process whereby the origin code of &lt;code&gt;i&lt;/code&gt; is preferred to &lt;code&gt;?&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;BUT&lt;/em&gt; the Origin Code can be changed to anything you like using a route-map.  So for the purpose of this question, let's ignore the different origin codes since they can be overridden.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;2.&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;network&lt;/code&gt; command requires you to &lt;em&gt;explicitly&lt;/em&gt; specify which networks should be advertised into BGP. Where as the &lt;code&gt;redistribute&lt;/code&gt; command might inadvertently advertise networks into BGP that you did not &lt;em&gt;explicitly&lt;/em&gt; select (aka, using &lt;code&gt;redistribute connected&lt;/code&gt; and later adding an loopback interface for testing that you did not mean to get advertise).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;BUT&lt;/em&gt; you can also use a route-map to limit what network(s) are being redistributed, so in &lt;em&gt;both&lt;/em&gt; cases you can still advertise networks &lt;em&gt;explicitly&lt;/em&gt;.  So for the purpose of this question, let's ignore the difference in explicit advertisements since that is possible in both method.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;BR /&gt;&#xA;&lt;strong&gt;My question: &lt;em&gt;OTHER&lt;/em&gt; than the two differences identified above... what are reasons why one might choose to use the &lt;code&gt;redistribute&lt;/code&gt; command verses the &lt;code&gt;network&lt;/code&gt; command.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it simply come to personal preference?  Or local policies? Or are there other definitive use-cases that would &lt;em&gt;require&lt;/em&gt; the use of one or the other.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2020-04-21T11:52:53.310" Title="What considerations should be made when determining whether to use the BGP &quot;network&quot; command vs Redistribution?" Tags="|bgp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39182" PostTypeId="1" AcceptedAnswerId="39185" CreationDate="2017-02-22T21:11:43.687" Score="0" ViewCount="1164" Body="&lt;p&gt;I download a bgp archive from routeviews website. I get as this line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BGP4MP|1378027817|A|202.249.2.86|7500|41.191.103.0/24|7500 2518 2914 1273 36994 37672 37089|IGP|202.249.2.86|0|0||NAG||&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can you help me to interpret this line? I don't know who announce the prefix : AS7500 or AS37089?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="34669" LastActivityDate="2020-05-15T11:41:23.970" Title="How interpret BGP message gerated by libbgpdump?" Tags="|bgp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39183" PostTypeId="1" AcceptedAnswerId="39215" CreationDate="2017-02-22T21:29:08.007" Score="3" ViewCount="4792" Body="&lt;p&gt;I have following scenario:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[VoIP phone]--------[ASA 5550]----------[SIP Server] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VoIP phone: 10.0.0.10&lt;/li&gt;&#xA;&lt;li&gt;SIP server: Public Address &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Question: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;In above scenario do i need to specify or open RTP port range &lt;code&gt;10000-20000&lt;/code&gt; on ASA or does ASA will use &lt;code&gt;pinhole&lt;/code&gt; method when VoIP phone initiate connection to SIP server? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;How does firewall handle UDP port stat? because in TCP we know its stateful but how does firewall understand its UDP traffic initiated from inside to outside to keep that port open bi-directional traffic?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If i enable &lt;code&gt;SIP Inspection&lt;/code&gt; does that automatically open RTP media port after &lt;code&gt;SDP&lt;/code&gt; inspection in &lt;code&gt;INVITE&lt;/code&gt;? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;what if i do not enable &lt;code&gt;SIP Inspection&lt;/code&gt; in that case do i need to open full RTP port range to allow outside to inside traffic? &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2019-04-15T18:02:00.313" Title="Cisco ASA SIP/RTP inspection question" Tags="|cisco|cisco-asa|firewall|voip|sip|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39184" PostTypeId="2" ParentId="39176" CreationDate="2017-02-22T22:20:53.063" Score="2" Body="&lt;p&gt;There are a number of ways you could do this depending on what you mean by &quot;how much traffic&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you just want to log individual flows from that range, the following will work:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set system syslog file incoming.log any any&#xA;set system syslog file incoming.log match .*RT_FLOW.*201.6.2.*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Be aware though that running a regex match against all traffic passing through your SRX can be quite taxing on the CPU depending on how many flows you're currently seeing, and it would then be up to you to sum all the log entries to work out bytes in/out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might actually be better off exporting all your flow logs to an external syslog server, Junos Space Security Director, or an ELK stack and performing all your matching/filtering offline on the collected data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another, less CPU intensive method would be to create a specific security policy that matches on this prefix as a source address.  You would then need to place it at the top of your security policies.  Make sure the action is count, and then you can simply use:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;show security policies policy-name PERMIT-201-6-2 detail &lt;/p&gt;&#xA;&#xA;&lt;p&gt;to get a nicely rolled up count of session hits, bytes in and bytes out for just this subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The caveat to using this approach is that you'd need to make sure that the matching application contained all applications that would normally apply to &quot;any&quot; traffic coming from the same zone, so that you wouldn't give this prefix more or less access than it had before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck!&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-02-22T22:20:53.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39185" PostTypeId="2" ParentId="39182" CreationDate="2017-02-22T22:48:09.067" Score="1" Body="&lt;p&gt;For those unfamiliar with libbgpdump: it's a library for analysing dump files generated by Zebra/Quagga and MRT. It's maintained by RIPE NCC: &lt;a href=&quot;https://bitbucket.org/ripencc/bgpdump/wiki/Home&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://bitbucket.org/ripencc/bgpdump/wiki/Home&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AS-path recorded is &lt;code&gt;7500 2518 2914 1273 36994 37672 37089&lt;/code&gt;. So AS37089 &lt;em&gt;originated&lt;/em&gt; the prefix, AS7500 &lt;em&gt;announced&lt;/em&gt; it to the router on which the dump was generated.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-02-22T22:48:09.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39186" PostTypeId="2" ParentId="39141" CreationDate="2017-02-23T00:50:33.277" Score="3" Body="&lt;p&gt;I'm having a recursion problem with your script, so I'll see if I can hack through that first, but:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;As a side question, is it possible to edit an op-script on-box instead of deleting and re-uploading a script?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are three ways to make you SLAX development experience less painful (can't do much about SLAX itself unfortunately ;) ).&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You can open two sessions to your box, and drop into the shell on one and use vi directly in the shell to edit your script in one window and test in Junos on the other.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Run a webserver on your development PC that the box can reach, edit the file locally on your PC and then call it remotely.  :&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set system scripts op file tpol.slax arguments destination-address&#xA;set system scripts op file tpol.slax arguments destination-port&#xA;set system scripts op file tpol.slax arguments from-zone&#xA;set system scripts op file tpol.slax arguments source-address&#xA;set system scripts op file tpol.slax arguments source-port&#xA;set system scripts op file tpol.slax arguments to-zone&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then execute with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;op url http://172.16.10.30/slax/tpol.slax destination-addres x.x.x.x etc. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;Use the Junos User Interface Script Environment (JUISE), which gives you the SLAX language offboard on a remote system, while still allowing you to connect to a remote Juniper device to pull data - &lt;a href=&quot;https://github.com/Juniper/juise&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://github.com/Juniper/juise&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-02-23T00:50:33.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39187" PostTypeId="2" ParentId="39179" CreationDate="2017-02-23T00:53:13.197" Score="2" Body="&lt;p&gt;The key issue to consider with your current setup is that the devices on different subnets are not really isolated from each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sure IPv4 unicast traffic will by default go by the router but IPv4 unicast traffic is far from the only type of traffic that can flow over an ethernet network and even the IPv4 unicast traffic can be made to flow directly with some minor tweaks to the routing table on the hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs OTOH isolate the hosts on different VLANS from each other so that the only way they can communicate is via the router/firewall.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-23T00:53:13.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39190" PostTypeId="2" ParentId="2594" CreationDate="2017-02-23T05:48:02.767" Score="2" Body="&lt;p&gt;Historically WAN links were almost always serial connections, to connect to service providers csu / dsu normally a serial cable was run from the router to the device sp. &lt;a href=&quot;https://www.vcetests.com/200-355-vce.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco 200-355 VCE&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet is used internally within the organization for the LAN, so the router has an ethernet port for that purpose.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nowadays there is less use of serial interfaces, since WAN connections use the ethernet derivations of service providers for MPLS, Ethernet Metro, etc. There is usually a fiber device installed by the service provider and an Ethernet cable from which it goes to the router. So using serial interfaces for new connections is now less common, they are still loads out there though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for why PT default to a serial link between two routers, I guess that's what the developers chose as a default. Probably because connecting two routers together is usually a WAN connection. And ICND1 and 2 cover a lot of serial interface material, and Frame Relay, which also runs in series.&lt;/p&gt;&#xA;" OwnerUserId="34675" LastActivityDate="2017-02-23T05:48:02.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39194" PostTypeId="2" ParentId="2594" CreationDate="2017-02-23T06:53:22.540" Score="0" Body="&lt;p&gt;A serial interface on a Wan Interface Card (WIC) card is common.  The configured framing for it varies depending on implementation but could be hdlc, ppp, etc.  The DTE/DCE specifies your cable pinouts.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-02-23T06:53:22.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39201" PostTypeId="1" CreationDate="2017-02-23T12:09:38.550" Score="2" ViewCount="232" Body="&lt;p&gt;I have a little concern regarding HP Procurve switches. I am monitoring an important number of HP switches, and I observed that after the reboot, few seconds later CPU usage raised up to 100% and stood there for like 20 minutes, then came back to normal. I could not detect any issue, and after a quick research on the internet, I found that it's a common issue for some HP switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know if anyone here has more details/information on the exact switch series having this problem (for my case, most switches showing this behaviour were HP J4813A ProCurve Switch 2524) ? Is it normal? Is there a way to avoid this or see what's going on the background of this behaviour ?&lt;/p&gt;&#xA;" OwnerUserId="34681" LastEditorUserId="8499" LastEditDate="2017-02-23T15:04:51.297" LastActivityDate="2017-02-24T15:21:33.023" Title="HP ProCurve CPU at 100% for 20 minutes after reboot" Tags="|switch|hp|hp-procurve|cpu|" AnswerCount="1" CommentCount="6" ClosedDate="2017-02-26T02:32:42.653" ContentLicense="CC BY-SA 3.0" />
  <row Id="39204" PostTypeId="2" ParentId="36450" CreationDate="2017-02-23T15:36:30.700" Score="12" Body="&lt;p&gt;Lets test this out then. If we send multicast packets to multiple devices connected to a WiFi access point at a constant rate, then the access point should report the same amount of traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To run this test, I'm sending packets from a wired PC to an an android tablet and a raspberry pi. Don't have any iOS devices. The network testing tool iperf can easily be used to send and receive these packets with the following settings:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Server (Devices on WiFI): iperf -s -u -B 230.5.5.82&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client (Wired PC): iperf -u -c 230.5.5.82 -t 60 -b 1M&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With these settings we're sending multicast packets at 1Mbps for a minute. Running this test and looking at the wireless traffic on the access point shows it is consistently about 1Mbps so it must be doing true multicast. The other notable thing from the results is that the packet loss is really bad at well over 50%. This is likely because multicast packets are getting sent at the lowest possible speed so lets force the access point to only run in the fastest speed. I'm using a WRT54GL running dd-wrt where the setting is called &quot;Transmission Fixed Rate&quot;. Running the same tests again after setting this to the fastest speed gives a much more acceptable packet loss of less than 5%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To actually answer the questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Get the fastest access point that allows you to fix the transmission rate and that supports multicast. There are definitely access points that do automatically convert multicast packets to unicast. For the speed issue, it isn't enough to just use a wide 5GHz channel since there are a number of different speeds that clients can actually communicate at.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Can't imagine things would work differently on iOS devices since the main determining factor would be the access point.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;See 1 as it depends on the access point.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Edit: After testing things out more and on some ac APs, it turns out the important thing for mulitcast is being able to set the available rates. Multicast still uses g speeds so the available physical rates are 6, 9, 12, 18, 24, 36, 48 and 54Mbps. Most APs are going to default to the slower speeds so being able to disable them to force it to use the higher rates will give a huge speed up. Being able to set this is probably the most important criterion for a multicast AP. As an example, in modern versions of DD-WRT, this can be set using the &quot;wl rateset&quot; command on the command line. It sure is well hidden and most firmware doesn't allow this to be set.&lt;/p&gt;&#xA;" OwnerUserId="34689" LastEditorUserId="34689" LastEditDate="2017-04-20T22:43:39.493" LastActivityDate="2017-04-20T22:43:39.493" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39205" PostTypeId="2" ParentId="39169" CreationDate="2017-02-23T15:58:32.673" Score="2" Body="&lt;p&gt;Now that your question is a bit more clear, you con connect the switch to the router on one of the copper interfaces. Just configure the link between the router and the switch as a trunk link. If you need PPPoE on one of the VLANs, then set up PPPoE on the subinterface for that VLAN. Just don't run your internal VLANs out to the ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The drawing is a pretty poor way of doing things because you have no firewall, and your network equipment is exposed to the public Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just because the ISP connects to your switch via fiber, that does not mean that your switch must connect to the router via fiber. The switch really doesn't care which interface is connected to either the ISP, the router, or the hosts. As far as the switch is concerned, the router is just another host, but one connected via a trunk, and you can run a trunk on any of the switch interfaces, as long as the device on the other end of the link understands VLAN tags.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-23T16:05:41.440" LastActivityDate="2017-02-23T16:05:41.440" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39209" PostTypeId="2" ParentId="39181" CreationDate="2017-02-23T22:40:39.180" Score="8" Body="&lt;p&gt;First - there are two distinctly different problems being solved with these commands:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The &lt;code&gt;network&lt;/code&gt; and &lt;code&gt;redistribute&lt;/code&gt; commands are mechanisms to initiate routes into BGP, either statically (with a backing route) or coming from another dynamic routing protocol.  As mentioned in the notes there are certainly differences between the two mechanisms (origin types being an example) but the underlying function of route initiation is a common element.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Route aggregation creates a supernet route within BGP &lt;em&gt;as a function of other BGP routes&lt;/em&gt; - so, for example, the presence of one or more /24 subnets in a /19 can cause the /19 to be advertised (with or without the component /24's, depending on policy).  There are a bunch of knobs typically available within route aggregation (AS sets, bundling attributes, etc) but the basic notion of working completely within the context of BGP (vs initiating an altogether new route) distinguishes it from &lt;code&gt;network&lt;/code&gt; and &lt;code&gt;redistribute&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So - your question might be better phrased as why choose one method of initiating routes into BGP versus another.  The answer is honestly going to be a function of design.  Redistributing from an IGP allows for a dynamic set of routes to be pushed into BGP.  So - for example - networks might constantly be added and removed from OSPF within one portion of an enterprise network.  These routes would (within policy limits) be added- and removed- from BGP without any further intervention.  Similarly it's possible to use dynamic tagging mechanisms to control how certain classes of routes are treated in the network.  As another example - a tag could be applied to a route from the prior case (enterprise OSPF) such that a particular prefix would have a BGP community applied at the point of redistribution that allowed it to be leaked past a summary.  Or in a more mundane example an IGP tag might signify the need to append AS tags to the prefix at the point of BGP redistribution to make it less favorable (..or change MED, localpref, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In contrast, the &lt;code&gt;network&lt;/code&gt; command just initiates a set of routes into BGP as long as an identical backing route is in the table.  This is a very static method that's typically employed when a BGP speaker at the edge of the network wants to initiate a set of prefixes into the network under almost all circumstances.  The typical case for this would be BGP-connected end customers, who generally advertise a relatively small (and unchanging) set of solely-owned prefixes.  They'll often pin the backing routes up with a static route as well as receiving more specific routes via an IGP (this can be thought of as a crude form of summarization).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both approaches have their place and there's often a fair degree of overlap.  It's harder to screw up the &lt;code&gt;network&lt;/code&gt; command (although I've seen it done) while the added number of knobs and potential for loops with redistribution is often associated with a greater degree of complexity.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-23T22:40:39.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39211" PostTypeId="2" ParentId="39179" CreationDate="2017-02-24T01:47:35.197" Score="1" Body="&lt;p&gt;VLANs are mostly used to separate broadcast domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a smart decision to use different VLANs on different Companies Subnets, that way you segregate the traffic from different companies adding more security to your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs are also good on reducing signalling on the network, therefore improving the network efficiency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would recommend you go to this website: &lt;a href=&quot;http://www.firewall.cx/networking-topics/vlan-networks.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.firewall.cx/networking-topics/vlan-networks.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They have an awesome material on VLANs.&lt;/p&gt;&#xA;" OwnerUserId="34699" LastActivityDate="2017-02-24T01:47:35.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39213" PostTypeId="1" CreationDate="2017-02-24T02:59:16.070" Score="1" ViewCount="481" Body="&lt;p&gt;My ADSL provider is providing me with a routed subnet over ADSL.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two IP address ranges: the PPP range (to estabilish the PPP connection between the modem and the ISP) and what they call the LAN range, a /30 which is the publicly routable subnet that they route to the modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, in the default setup they gave me, they assigned the second LAN address to the router and the third LAN address to a NAT. So, basically, all I really have is just one public IP which I use to surf the Internet through NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since I want to use all the four IP addresses they are routing to me, without caring for the fact that they are a subnet, I'd like the modem not to have an IP address and to just &quot;reroute&quot; all the four IPs to a firewall such as pfSense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I do this?&lt;/p&gt;&#xA;" OwnerUserId="30698" LastActivityDate="2017-02-25T04:31:03.300" Title="ADSL connection with routed subnet" Tags="|routing|adsl|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39214" PostTypeId="2" ParentId="39213" CreationDate="2017-02-24T03:08:36.480" Score="1" Body="&lt;p&gt;Apparently, the LAN network range the ISP is giving you is &lt;code&gt;/30&lt;/code&gt;. There really are not four usable addresses in a &lt;code&gt;/30&lt;/code&gt; network, there are only two. That means you assign one address to a router LAN interface, and one address to something like a server. You only have two usable addresses, and that is it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need to do is have two LAN networks: one private network as large as you like, and one public network with two usable addresses (router and some other device).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-24T03:08:36.480" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39215" PostTypeId="2" ParentId="39183" CreationDate="2017-02-24T03:54:57.903" Score="1" Body="&lt;p&gt;Assuming that your VOIP phone is on remote site and you are connected to firewall through VPN(IKEv1 or IKEv2) connection. Your end terminal is able to reach SIP server on some port 5060,5061 or any other port and successfully registers itself with SIP server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, I think you do not need to explicitly open port for SIP and RTP messages as ASA will automatically create necessary pinholes. &lt;/p&gt;&#xA;" OwnerUserId="34467" LastActivityDate="2017-02-24T03:54:57.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39216" PostTypeId="2" ParentId="39178" CreationDate="2017-02-24T06:27:42.533" Score="1" Body="&lt;p&gt;You would need some form of script to do this in a sane manner - it would need to log into the switch, check the LLDP neighbor and update the port description.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I question the point of this though, since you have this information in LLDP already, and it is automatically updated when someone re-patches their device, unlike the script method which would have to be re-run every time a port changes state (in case people are moving stuff).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LLDP also wouldn't work for most hosts, without installing 3rd-party agents, but APs and Phones (and some printers) are able to self-report out of the box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You don't mention your switch vendor, but some support NetBIOS snooping, whereby you can discover the SMB Network Name of connected devices automatically as well.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-02-24T06:27:42.533" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39218" PostTypeId="1" CreationDate="2017-02-24T07:19:28.927" Score="2" ViewCount="96" Body="&lt;p&gt;People talked about we have around &gt;600k IP prefix blocks in use today. Out of curiosity, is there a place finding all the in-use IP prefix?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to make sure such list up to date?&lt;/p&gt;&#xA;" OwnerUserId="34708" LastActivityDate="2017-02-24T08:22:24.767" Title="Can I get the complete IP prefix lists?" Tags="|ipv4|bgp|internet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39220" PostTypeId="2" ParentId="39218" CreationDate="2017-02-24T07:57:28.697" Score="2" Body="&lt;p&gt;Today, February 24 2017, I have one ISP that advertises me 626063 routes and another one 625418.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(the difference being due to different summarization between each ISP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many providers provide &lt;a href=&quot;https://www.google.be/search?q=bgp+looking+glass&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP looking glasses&lt;/a&gt; which allow you to query BGP tables in real time. Not sure if any allow you to dump an entire table.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-24T07:57:28.697" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39221" PostTypeId="2" ParentId="39218" CreationDate="2017-02-24T08:22:24.767" Score="5" Body="&lt;p&gt;RIPE NCC has a set of route collectors and offers their routing tables for download: &lt;a href=&quot;https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/ris-raw-data&quot; rel=&quot;noreferrer&quot;&gt;https://www.ripe.net/analyse/internet-measurements/routing-information-service-ris/ris-raw-data&lt;/a&gt;. They have historical data going back to at least 1999.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-02-24T08:22:24.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39222" PostTypeId="1" CreationDate="2017-02-24T10:01:09.647" Score="0" ViewCount="71" Body="&lt;p&gt;When I type &quot;ipconfig&quot; within my command line, I get this thing:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   IPv4 Address. . . . . . . . . . . : 10.100.102.6&#xA;   Subnet Mask . . . . . . . . . . . : 255.255.255.0&#xA;   Default Gateway . . . . . . . . . : 10.100.102.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why tha hack my subnet mask is 255.255.255.0 and my IP CLASS is A?&#xA;Because this thing, I have 2^16  of network prefix and 2^8 hosts can be - which is wnormous number I will never use!&#xA;How can I make my IP to be class C (to be able to host only 2^8 hosts, and then subnneting this IP to be \29 so I my network will be able to hold just 5 computers trying to connect.?)?&lt;/p&gt;&#xA;" OwnerUserId="34710" LastActivityDate="2017-02-24T13:54:09.760" Title="Why my computer subnet works like this?" Tags="|subnet|" AnswerCount="2" CommentCount="1" ClosedDate="2017-02-24T16:18:18.543" ContentLicense="CC BY-SA 3.0" />
  <row Id="39223" PostTypeId="2" ParentId="39222" CreationDate="2017-02-24T10:10:54.617" Score="2" Body="&lt;p&gt;You are using a mask &lt;code&gt;255.255.255.0&lt;/code&gt;, it means that the range of addresses is from &lt;code&gt;10.100.102.0&lt;/code&gt;to &lt;code&gt;10.100.102.255&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 1993, the Internet Engineering Task Force published RFC 1518 and RFC 1519. These RFCs define a new concept called &lt;strong&gt;Classless Inter Domain Routing&lt;/strong&gt;. The most important thing of those RFCs is that obsoletes the &lt;strong&gt;Classful Network&lt;/strong&gt; where ranges where associated with classes with fixed netmasks.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2017-02-24T10:10:54.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39226" PostTypeId="2" ParentId="39222" CreationDate="2017-02-24T13:54:09.760" Score="0" Body="&lt;p&gt;Your ip is in the 10 range because it belongs to the group of private IP, which are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. Since this ranges are not routed onto to the public network you can do whatever you want with this ips on your home or office network.&lt;/p&gt;&#xA;" OwnerUserId="13605" LastActivityDate="2017-02-24T13:54:09.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39227" PostTypeId="2" ParentId="39201" CreationDate="2017-02-24T15:21:33.023" Score="0" Body="&lt;p&gt;When the switch boots, one of the initialization tasks is creation of encryption keys. Having the keys created in advance means that later, when a feature such as SSL or SSH that uses the keys is configured or used, there is minimal delay in the availability. This task takes a few seconds before it ramps up, depending on the switch model, the configuration being loaded, and the software revision. Even though the task consumes up to 100% of the CPU, it runs at a very low priority. Therefore, if another task requiring CPU cycles is started, this low priority task will back off (So, users should never have any performance issues). If this initialization/key generation task runs uninterrupted by higher priority tasks, it takes about 10 minutes to complete. If the CPU is busy with other tasks, the completion time will be extended.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Faizan -&#xA;Network Consultant&#xA;HPE&lt;/p&gt;&#xA;" OwnerUserId="34715" LastActivityDate="2017-02-24T15:21:33.023" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39228" PostTypeId="1" AcceptedAnswerId="39229" CreationDate="2017-02-24T15:27:01.823" Score="1" ViewCount="70" Body="&lt;p&gt;I'm very confused by this spanning-tree output. Each subsequent vlan id has a Priority that is higher than the configured 16384. I think this has something to do with the extended system id, but I'm not sure how. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN0001&#xA;  Spanning tree enabled protocol rstp&#xA;  ***Root ID    Priority    16385***&#xA;             Address     xxxx.xxxx.xxxx&#xA;             This bridge is the root&#xA;             Hello Time  2  sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    16385  (priority 16384 sys-id-ext 1)&#xA;             Address     xxxx.xxxx.xxxx&#xA;             Hello Time  2  sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;...&#xA;&#xA;VLAN0005&#xA;  Spanning tree enabled protocol rstp&#xA;  ***Root ID    Priority    16389***&#xA;             Address     xxxx.xxxx.xxxx&#xA;             This bridge is the root&#xA;             Hello Time  2  sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    16389  (priority 16384 sys-id-ext 5)&#xA;             Address     xxxx.xxxx.xxxx&#xA;             Hello Time  2  sec  Max Age 20 sec  Forward Delay 15 sec&#xA;...&#xA;&#xA;VLAN0020&#xA;  Spanning tree enabled protocol rstp&#xA;  ***Root ID    Priority    16404***&#xA;             Address     xxxx.xxxx.xxxx&#xA;             This bridge is the root&#xA;             Hello Time  2  sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    16404  (priority 16384 sys-id-ext 20)&#xA;             Address     xxxx.xxxx.xxxx&#xA;             Hello Time  2  sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15501" LastEditorUserId="2142" LastEditDate="2017-02-24T15:45:19.970" LastActivityDate="2017-02-24T15:57:00.337" Title="Weird output on Nexus spanning-tree?" Tags="|vlan|layer2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39229" PostTypeId="2" ParentId="39228" CreationDate="2017-02-24T15:57:00.337" Score="4" Body="&lt;p&gt;if you set the priority for a VLAN to 0 on the switch, and enable sys-id extension it just adds the system extension number to the set priority. This is most likely why you are seeing the number higher.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;F.e., You have the priority for VLAN20 set as 16384 but the sys-id-ext is 20. So its as simple as the set priority plus the sys-id-ext.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Btw, the sys-id-ext is equal to the VLAN identifier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See also here: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7181/spanning-tree-default-priority-values&quot;&gt;Spanning tree Default Priority Values&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-02-24T15:57:00.337" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39230" PostTypeId="1" AcceptedAnswerId="39231" CreationDate="2017-02-24T17:20:06.603" Score="6" ViewCount="1776" Body="&lt;p&gt;Today we received email from our ISP saying they are performing maintenance on their network so if you have HSRP connectivity with them in that case you need to clear &lt;code&gt;ARP table&lt;/code&gt; or  reduce &lt;code&gt;ARP timeout&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We do have &lt;code&gt;HSRP&lt;/code&gt; connectivity with our ISP and following i found where i got confused. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show mac address-table aging-time&#xA;Vlan    Aging Time  Configured Aging Time&#xA;----    ----------  ---------------------&#xA;Global Vlan Admin Age: 300&#xA;   1    300         300&#xA;   2    300         300&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On interface: ARP timeout 4 hour &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh int te1/50&#xA;TenGigabitEthernet1/50 is up, line protocol is up (connected)&#xA;  Hardware is Ten Gigabit Ethernet Port, address is 68ef.bd75.7370 (bia 68ef.bd75.7370)&#xA;  Description: ISP_A&#xA;  MTU 1500 bytes, BW 10000000 Kbit, DLY 10 usec,&#xA;     reliability 255/255, txload 33/255, rxload 36/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive set (10 sec)&#xA;  Full-duplex, 10Gb/s, link type is auto, media type is 10GBase-LR&#xA;  input flow-control is on, output flow-control is off&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;what are those two timeout? &lt;/li&gt;&#xA;&lt;li&gt;in Document saying you should keep CAM timeout and ARP timeout equal but how?&lt;/li&gt;&#xA;&lt;li&gt;When ISP say you should reduce &lt;code&gt;ARP timeout&lt;/code&gt; does that means only for specific interface which is connected to their router or whole switch? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="8499" LastEditDate="2018-12-25T03:47:18.210" LastActivityDate="2018-12-25T03:47:18.210" Title="Cisco HSRP CAM vs ARP timeout" Tags="|cisco|network|arp|hsrp|fhrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39231" PostTypeId="2" ParentId="39230" CreationDate="2017-02-24T17:36:09.680" Score="6" Body="&lt;p&gt;What the ISP means is that as they make changes, you may lose connectivity for a time because the ARP table entries your router has with them will not match the changes it is making. If you reduce the ARP timeout, you reduce the time you may have lost connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really only need to change &lt;code&gt;arp timeout&lt;/code&gt; on the interface used to connect to the ISP.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# interface Ethernet0/0&#xA; arp timeout &amp;lt;seconds&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;The ARP timeout deals with the amount of time an ARP (layer-3 to layer-2 address resolution) entry remains in the ARP table before it is aged away.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CAM table used by a switch deals with the MAC address to interface resolution. Layer-2 switches don't care about layer-3 or layer-3 addresses, so they don't use ARP, but they do care about which interface should be used for a MAC address, so they have a table to resolve that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These two table deal with very different things. It may be desirable, on a layer-3 switch, to keep the two tables coordinated. The switch CAM timeout is set by:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mac address-table aging-time &amp;lt;seconds&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-24T17:49:39.783" LastActivityDate="2017-02-24T17:49:39.783" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39234" PostTypeId="2" ParentId="5935" CreationDate="2017-02-24T20:44:59.507" Score="0" Body="&lt;p&gt;I think its a bit late, but.. here I go&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should use communities to mark the routes and then use it on policies instead ACLs over BGP.&lt;/p&gt;&#xA;" OwnerUserId="34723" LastActivityDate="2017-02-24T20:44:59.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39235" PostTypeId="1" AcceptedAnswerId="39236" CreationDate="2017-02-24T21:11:59.903" Score="12" ViewCount="73082" Body="&lt;p&gt;I totally understand the difference between bandwidth and throughput. While bandwidth shows the maximum amount of data can be transmitted from a sender to a receiver, throughput is the actual amount of data that has been transmitted as they could be different factors such as latency affecting throughput. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bit rate is the amount of data(number of bits) can be transmitted per second which sounds the same as throughput to me. So what is the key difference? &lt;/p&gt;&#xA;" OwnerUserId="34724" LastActivityDate="2023-06-09T14:19:54.630" Title="Bandwidth vs Throughput vs Data(bit) rate" Tags="|bandwidth|throughput|" AnswerCount="6" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39236" PostTypeId="2" ParentId="39235" CreationDate="2017-02-24T21:46:16.190" Score="12" Body="&lt;p&gt;Some of these terms are used differently by different people, but below is what is generally accepted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bandwidth is the number of bits per second that a link can send or receive, including all flows. For example, the bandwidth of a 100 Mbps connections is 100 Mbps, but that doesn't mean it is always sending or receiving 100 Mbps, but that is the maximum possible on that link. Unlike what many people mean by bandwidth, it does &lt;strong&gt;not&lt;/strong&gt; mean data usage. I see people say that they have a bandwidth limitation (every link does), and they have used all their bandwidth for the month. This is an incorrect use of the term. What they mean to say is that they have a data usage limitation, and they have used it up for the month.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Throughput is the amount of data during a time period that a flow (process to process) can send or receive. This includes all the host overhead, and contention on the link (multiple flows on a link will each use some percentage of the bandwidth, reducing the throughput of each).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bit rate is closer to bandwidth, but it is often per host, or source to destination devices. You may have a bit rate of 100 Mbps from a host to a switch, but the bit rate from a host to a host is less. This usually includes multiple flows.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-24T21:56:35.923" LastActivityDate="2017-02-24T21:56:35.923" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39241" PostTypeId="2" ParentId="39213" CreationDate="2017-02-25T04:31:03.300" Score="0" Body="&lt;p&gt;It's difficult to be more specific without knowing exactly what equipment you have but afiact if you can add static routes on the ISP router the following should be possible.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Add the IPs as &quot;loopbacks&quot; on your firewall box. Since these are loopbacks and not assigned to a network there is no need for &quot;network&quot; or &quot;broadcast&quot; addresess.&lt;/li&gt;&#xA;&lt;li&gt;Use private IPs for the link between your firewall and the ISP-supplied router&lt;/li&gt;&#xA;&lt;li&gt;Add a static route to the ISP supplied router to forward the &quot;LAN range&quot; to your firewall box. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-25T04:31:03.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39242" PostTypeId="2" ParentId="12455" CreationDate="2017-02-25T04:59:23.850" Score="0" Body="&lt;p&gt;Create a bridge and assign WAN and LAN PORT in same bridge.  Assign your DHCP to new bridge interface.  Start leasing and make static leases.  The lease should be the same between interfaces in new Bridge.&lt;/p&gt;&#xA;" OwnerUserId="34731" LastActivityDate="2017-02-25T04:59:23.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39244" PostTypeId="1" AcceptedAnswerId="39252" CreationDate="2017-02-25T07:03:11.480" Score="1" ViewCount="2568" Body="&lt;p&gt;which type information can be seen by executing keywords &quot;GET&quot; and &quot;SHOW&quot; with combination other keywords at Fortigate firewall cli in general way. Can anyone differentiate the information print by using these keywords.           &lt;/p&gt;&#xA;" OwnerUserId="8007" LastActivityDate="2017-02-25T17:43:09.637" Title="Fortigate Firewall cli query || show and get" Tags="|fortigate|fortinet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39250" PostTypeId="1" CreationDate="2017-02-25T15:08:47.920" Score="1" ViewCount="96" Body="&lt;p&gt;I hope this is an appropriate question for here.  I'm a software guy, I usually do &quot;ok&quot; figuring stuff out, but I can't get this one.  I know it's easy, too.. I just can't get it, and I need help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem arose after switching to Comcast Business.&#xA;&lt;br/&gt;&lt;b&gt;Setup:&lt;/b&gt;&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Comcast Business router, Cisco DPC3941B&lt;/li&gt;&#xA;&lt;li&gt;Static IP, DMZ to server&lt;/li&gt;&#xA;&lt;li&gt;SmarterMail Email Server&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Issue:&lt;/b&gt;&lt;br/&gt;&#xA;Email is not sent from, nor delivered to phones on local network wifi.  If I turn wifi off on the device, and &quot;resend&quot; over 4g, success.  If I am connected to any remove wifi network, success.  Issue is only over local network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;b&gt;Problem:&lt;/b&gt;&lt;br/&gt;&#xA;I have no idea if this is a setting in SmarterMail, in my router, or what to do.  I'm hoping that you guys can have mercy and give me a hand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know what information you need if you are willing to assist.  I don't even know what router or server settings to give you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance guys, R/&lt;br/&gt;&#xA;&lt;br/&gt;&#xA;&lt;b&gt;Edit:&lt;/b&gt;&lt;br/&gt;&#xA;NAT Configuration&#xA;1 [static IP address] 10.1.10.99 [Enabled]&#xA;&lt;br/&gt;&lt;br/&gt;&#xA;No Static Routing&#xA;&lt;br/&gt;&lt;br/&gt;&#xA;Dynamic DNS Disabled&#xA;&lt;br/&gt;&lt;br/&gt;&#xA;Let me know if this is enough or if anything else is needed.&lt;/p&gt;&#xA;" OwnerUserId="34740" LastEditorUserId="34740" LastEditDate="2017-02-25T16:08:54.133" LastActivityDate="2017-03-29T15:23:39.277" Title="Email not delivered over local wifi, delivered all other times" Tags="|cisco|routing|" AnswerCount="1" CommentCount="1" ClosedDate="2017-03-29T15:24:35.870" ContentLicense="CC BY-SA 3.0" />
  <row Id="39251" PostTypeId="1" AcceptedAnswerId="39256" CreationDate="2017-02-25T17:31:31.007" Score="2" ViewCount="3561" Body="&lt;p&gt;I'm making a simple exercise to understand how to route between vlans.&#xA;I have this setup, a router in the top where routing occurs and three vlans.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gNLn6.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gNLn6.jpg&quot; alt=&quot;Packet Tracer 7 visualization&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've created the vlans and added encapsulation for each vlan in Router1 and attributed IP for the gateways accordingly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router1 has the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 865 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/0.2&#xA; no ip address&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1.1&#xA; encapsulation dot1Q 2&#xA; ip address 192.168.1.254 255.255.255.0&#xA;!&#xA;interface FastEthernet0/1.2&#xA; encapsulation dot1Q 3&#xA; ip address 192.168.2.254 255.255.255.0&#xA;!&#xA;interface FastEthernet0/1.3&#xA; encapsulation dot1Q 4&#xA; ip address 192.168.3.254 255.255.255.0&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch0 has the following vlans configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1091 bytes&#xA;!&#xA;version 12.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/24&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch1 has the following vlans configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1288 bytes&#xA;!&#xA;version 12.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; description connects to PC1&#xA; switchport access vlan 3&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA; description connects to Switch0&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/23&#xA; description connects to Switch2&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/24&#xA; description connects to router1&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch2 has the following vlans configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1114 bytes&#xA;!&#xA;version 12.1&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA; switchport access vlan 4&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/2&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;PC1 has the following configurations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 192.168.2.1&#xA;Subnet Mask: 255.255.255.0&#xA;Default Gateway: 192.168.2.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;PC2 has the following configurations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 192.168.3.1&#xA;Subnet Mask: 255.255.255.0&#xA;Default Gateway: 192.168.3.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Wireless Router has the following configurations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Default Gateway: 192.168.1.254&#xA;IP Address: 192.168.1.1&#xA;Subnet Mask: 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The laptop is getting dhcp from the wireless router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everyone should talk to anybody. Both PCs talk to each other and the laptop can reach the PCs. But I can't figure what is needed to make the PCs talk to the laptop or ping the wireless router successfully.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my packet tracer 7 file:&#xA;&lt;a href=&quot;https://drive.google.com/open?id=0Bxt6AIcey5oTTkJZaTZxRlBwZ1k&quot; rel=&quot;nofollow noreferrer&quot;&gt;exercise_pkt&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34742" LastEditorUserId="34742" LastEditDate="2017-02-25T20:23:52.310" LastActivityDate="2021-01-05T09:56:20.390" Title="Routing between vlans with two routers" Tags="|cisco|routing|switch|vlan|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39252" PostTypeId="2" ParentId="39244" CreationDate="2017-02-25T17:43:09.637" Score="2" Body="&lt;p&gt;As far as I can remember show is used to check parameters and options as they are set in configuration, while get is used to check runtime values. Let say you have configured an interface for autonegotiation. You can see this with a show command. When the interface comes up it negotiates 100/full. You can check this with a get command&lt;/p&gt;&#xA;" OwnerUserId="76" LastActivityDate="2017-02-25T17:43:09.637" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39255" PostTypeId="1" AcceptedAnswerId="39258" CreationDate="2017-02-25T21:09:27.687" Score="2" ViewCount="1080" Body="&lt;p&gt;I have a few routers, each controlling a /16, connected together with VPN tunnels. These routers are all in the same OSPF area. Now, I'm also doing BGP with some other routers that I don't control, such that they may advertise routes to the other /16s, that I already get from the VPN tunnels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the time, the BGP routes are better than the OSPF ones, so I'd like far away routers to know about them. So I thought I'd redistribute the BGP routes into OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I then end up with externals in the OSPF database, which are never chosen over the intra-area OSPF routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to have this work? Other than doing BGP between all the routers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE to anyone who replies: I can copy and paste Cisco documentation, too. Please consider writing an useful answer. Thanks.&lt;/p&gt;&#xA;" OwnerUserId="34745" LastEditorUserId="8499" LastEditDate="2019-01-04T22:07:21.263" LastActivityDate="2019-01-04T22:07:21.263" Title="Prioritize redistributed BGP routes over OSPF intra-area" Tags="|routing|bgp|ospf|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39256" PostTypeId="2" ParentId="39251" CreationDate="2017-02-25T21:12:11.333" Score="0" Body="&lt;p&gt;I think your problem stems from the wireless router, which, unfortunately, is a consumer-grade device, so it is explicitly off-topic here. Likely, it is configured with a firewall that drops ICMP on the WAN interface, and it will not respond to ping. You will need to disable that if you want to ping. If the wireless router is performing NAT, then you will have a problem initiating traffic from outside to inside the router. You should disable NAT if you want to ping the laptop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you will need routes in both routers so that they know how to reach the networks on the other side of the other router. Routers learn routes in three ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Directly connected networks&lt;/li&gt;&#xA;&lt;li&gt;Statically configured routes&lt;/li&gt;&#xA;&lt;li&gt;Dynamically from a routing protocol&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Router1 will need to know that it should go to the wireless router in order to reach the network on the other side of the wireless router. You have not given use the network that you are using on the other side of the wireless router, so I will use &lt;code&gt;10.1.1.0/24&lt;/code&gt; as an example. On Router1, you can use a static route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 10.1.1.0 255.255.255.0 192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the wireless router, you will need to configure routes to &lt;code&gt;192.168.2.0/24&lt;/code&gt; and 192.168.3.0/24&lt;code&gt;through&lt;/code&gt;192.168.1.254&lt;code&gt;. The wireless router already knows how to reach the&lt;/code&gt;192.168.1.0/24` network because it is directly connected to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your other configurations, You should make some tweaks to follow best practices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Router1, you should set the host name to match the diagram. You will also need a password on the VTY lines if expect to connect to the router via telnet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname Router1&#xA;!&#xA;line vty 0 15&#xA; password MyRouter1Password&#xA; login&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Switch0, you should configure a trunk interface for the interface that connects to Switch1. Use descriptions on the interfaces, including the one connected to the wireless router. Also, you will also need a password on the VTY lines if expect to connect to the switch via telnet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname Switch0&#xA;!&#xA;interface FastEthernet0/23&#xA; description Connection to Wireless Router F0/0&#xA; switchport access vlan 2&#xA; switchport mode access&#xA;!&#xA;interface FastEthernet0/24&#xA; description Connection to Switch1 F0/22&#xA; switchport mode trunk&#xA;!&#xA;line vty 0 15&#xA; password MySwitch0Password&#xA; login&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Switch1, use descriptions on the interfaces. Also, you will also need a password on the VTY lines if expect to connect to the switch via telnet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname Switch1&#xA;!&#xA;interface FastEthernet0/22&#xA; description Connection to Switch0 F0/24&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/23&#xA; description Connection to Switch2 F0/24&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/24&#xA; description Connection to Router1 F0/1&#xA; switchport mode trunk&#xA;!&#xA;line vty 0 15&#xA; password MySwitch1Password&#xA; login&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On Switch2, use descriptions on the interfaces. Also, you will also need a password on the VTY lines if expect to connect to the switch via telnet.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;hostname Switch2&#xA;!&#xA;interface FastEthernet0/24&#xA; description Connection to Switch1 F0/23&#xA; switchport mode trunk&#xA;!&#xA;line vty 0 15&#xA; password MySwitch2Password&#xA; login&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-25T21:12:11.333" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39258" PostTypeId="2" ParentId="39255" CreationDate="2017-02-25T21:28:24.543" Score="2" Body="&lt;p&gt;Regardless of a route’s metric or administrative distance, OSPF will choose routes in the following order:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Intra-Area (O)&lt;/li&gt;&#xA;&lt;li&gt;Inter-Area (O IA)&lt;/li&gt;&#xA;&lt;li&gt;External Type 1 (E1)&lt;/li&gt;&#xA;&lt;li&gt;External Type 2 (E2)&lt;/li&gt;&#xA;&lt;li&gt;NSSA Type 1 (N1)&lt;/li&gt;&#xA;&lt;li&gt;NSSA Type 2 (N2)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You simply cannot get OSPF to prefer an external route over an internal route.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-02-25T21:28:24.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39259" PostTypeId="1" AcceptedAnswerId="39260" CreationDate="2017-02-25T21:29:31.027" Score="3" ViewCount="2977" Body="&lt;p&gt;I am a newbie to networking. I think I have a good grasp on Switching, routing and VLANs. I am trying to extend my knowledge to wireless networks. Looking for answers on a few questions&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Should I connect Wireless access point to a trunk port on the switch&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Is WAP technically a router or a switch.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34366" LastEditorUserId="8499" LastEditDate="2018-03-19T00:14:30.377" LastActivityDate="2021-01-27T14:33:57.830" Title="Wireless access point to switch connection" Tags="|vlan|ethernet|wireless|ieee-802.11|access-point|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39260" PostTypeId="2" ParentId="39259" CreationDate="2017-02-25T21:36:14.287" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;1) Should I connect Wireless access point to a trunk port on the&#xA;  switch&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That depends. Are you using a single SSID and comfortable with the WAP management address on the same network as the wireless users? If so, an access interface should work. If you want to offer multiple SSIDs, or you want to manage the WAP at an address on a different network, then you need to connect the WAP to a trunk interface.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2) Is WAP technically a router or a switch.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A WAP is a bridge, like a switch. Unlike a switch, a WAP is a translating bridge; it must translate the layer-2 protocols between ethernet (IEEE 802.3) and Wi-Fi (IEEE 802.11). Those two protocols use different frames, and the WAP must convert them. In the old days, we had translating bridges for ethernet and token ring (IEEE 802.5). An ethernet switch is a transparent bridge.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-02-25T21:57:38.140" LastActivityDate="2017-02-25T21:57:38.140" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39264" PostTypeId="1" AcceptedAnswerId="39266" CreationDate="2017-02-26T09:54:16.633" Score="2" ViewCount="4078" Body="&lt;p&gt;Let us assume that I have a large corporate WLAN network with many access points having the same SSID. The WLAN access points are connected to each other by learning Ethernet switches. Now, each client in the WLAN network has its own MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a client moves from the area of one access point to another, it has to perform an access point change because its signal level went down. AFAIK, the MAC address of the client does not change during this procedure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, how do the switches in the network learn that the client has moved to another access point if the client is only consuming downlink data? Let us assume that there is a mostly quiescent TCP connection that has data transfer only in the downlink direction at 10-second intervals, with no keepalive. Of course, there will be uplink ACKs but only as a response to the downlink data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the client has performed an access point change, if there's no uplink data, my understanding is that the switches will direct the downlink TCP data to an incorrect access point until the (MAC address, port) pairs in the switches expire.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some kind of dummy uplink packet sent after an access point change to inform the switches in the network that the MAC address has moved to a new switch port?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or is there some kind of mechanism where the old access point will redirect the packet to the new access point?&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2019-10-17T22:51:07.520" Title="How does access point changing populate MAC addresses in switch tables?" Tags="|switch|ieee-802.11|mac-address|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39265" PostTypeId="2" ParentId="39264" CreationDate="2017-02-26T10:03:36.743" Score="0" Body="&lt;p&gt;When the client move to AP, there is two possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;In case the new AP connected to the same switch of the old AP, the switch will update its CAM table with the first packet sent from the client to the new AP port.&lt;/li&gt;&#xA;&lt;li&gt;In case the new AP connected to a different switch, the old switch will learn that MAC has moved with the first broadcast Packet send by the client.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Normally the client will send a broadcast packet directly after connecting to the network for ARP, DHCP..etc &lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-02-26T10:03:36.743" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39266" PostTypeId="2" ParentId="39264" CreationDate="2017-02-26T10:03:37.823" Score="2" Body="&lt;p&gt;So, first of all, TCP is two-way protocol. If there's data travelling one way, you'll have data travelling the other way as well even if only just for the ACKs. You are correct however, that client MAC doesn't change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The AP association/reassociation/leaving are quite interesting, and it's actually very chatty before AP and Your host assume they have a 'link up' between each other - sometimes it's 'only' four frames being exchanged, but with more security, it's usually whole discussion taking place over wireless. Take a look here for technical description of the process from 802.11 side:&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/116493-technote-technology-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/wireless-mobility/wireless-lan-wlan/116493-technote-technology-00.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Roaming itself became also quite complex process, with natural push to provide seamless mobility for the host roaming. Take a look at 802.11r if You're interested in the details:&#xA;&lt;a href=&quot;https://en.wikipedia.org/wiki/IEEE_802.11r-2008&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/IEEE_802.11r-2008&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="286" LastActivityDate="2017-02-26T10:03:37.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39267" PostTypeId="1" AcceptedAnswerId="39268" CreationDate="2017-02-26T10:25:04.760" Score="2" ViewCount="976" Body="&lt;p&gt;Just curious on learning about protocols. I know that &lt;code&gt;TELNET&lt;/code&gt; is connection oriented protocol and &lt;code&gt;IP&lt;/code&gt; is connectionless protocol. What does it imply when the networking blogs and resources say that &quot;&lt;strong&gt;Telnet runs over IP&lt;/strong&gt;&quot;?&lt;/p&gt;&#xA;" OwnerUserId="34757" LastActivityDate="2017-02-26T10:38:48.437" Title="What does &quot;Telnet runs over IP&quot; means?" Tags="|ip|tcp|internet|osi|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39268" PostTypeId="2" ParentId="39267" CreationDate="2017-02-26T10:38:48.437" Score="4" Body="&lt;p&gt;Telnet belongs to the OSI layer 7 (application layer) and IP belongs to the OSI layer 3 (network layer). At the network layer, the protocol is indeed connectionless, and at the application layer, it is indeed connection-oriented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What solves this impedance mismatch, then? It is TCP. TCP works at OSI layer 4 (transport layer), and provides a reliable connection-oriented infrastructure on top of a connectionless network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, telnet doesn't directly run on top of IP. There is TCP inbetween. But, it is not incorrect to say that telnet runs on top of IP, as the OSI layer 7 protocol indirectly works on top of the OSI layer 3 protocol, being a higher-layer protocol.&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2017-02-26T10:38:48.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39269" PostTypeId="1" AcceptedAnswerId="39270" CreationDate="2017-02-26T12:02:03.580" Score="3" ViewCount="1834" Body="&lt;p&gt;Ethernet switches have a learning process through which they gradually begin to understand the network topology -- which MAC address is behind which port. When seeing a port to send a frame with a certain source MAC address, the MAC address table is updated to indicate that the source MAC is behind the port that sent the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when moving a computer to another switch port, it typically after a while sends a frame that teaches the entire network its new location in the network. So, the network will eventually learn the new location of the computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is: do typical Ethernet switches have in addition to this MAC address re-learning a timeout for the MAC address entries in the table? This would be similar to the ARP table timeout in endpoint hosts. If so, what is the range of typical default values for MAC address timeout?&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2021-03-08T15:29:23.470" Title="Do typical Ethernet switches have timeout for MAC table entries?" Tags="|switch|ethernet|mac-address|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39270" PostTypeId="2" ParentId="39269" CreationDate="2017-02-26T12:24:54.920" Score="4" Body="&lt;p&gt;A typical timeout is 5 min (often called &lt;em&gt;mac-aging&lt;/em&gt;). Re-learning MAC addresses can be dangerous in terms of security.&#xA;On the other hand, when you disconnect your computer from the switch, all MACs associated with the port to which it was connected are flushed immediately; when you reconnect your computer (to the same or a different port), the switch can relearn the appropriate mapping.&lt;/p&gt;&#xA;&lt;p&gt;Please be aware that, while this is typical behaviour, there are some switches configured to stick with a MAC once it was learnt (or to limit the number of MACs that can be dynamically learnt: once the limit is reached, manual intervention is required).&lt;/p&gt;&#xA;" OwnerUserId="35348" LastEditorUserId="36720" LastEditDate="2021-03-08T15:29:23.470" LastActivityDate="2021-03-08T15:29:23.470" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="39272" PostTypeId="1" AcceptedAnswerId="39275" CreationDate="2017-02-26T15:45:34.800" Score="4" ViewCount="23429" Body="&lt;p&gt;I was learning about TCP and came across Data offset. This was the answer I found.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot; Data offset specifies the size of the TCP header in 32 bit words. The min. size header is 5 words and the max. is 15 words, thus giving the min. size of 20 bytes and max. of 60 bytes.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the &lt;strong&gt;word&lt;/strong&gt; means ? 32 bit words, 5 words, 15 words. How they concluded the size as 20 bytes and 60 bytes.&lt;/p&gt;&#xA;" OwnerUserId="34760" LastEditorUserId="36720" LastEditDate="2021-04-04T10:44:57.137" LastActivityDate="2021-04-04T10:44:57.137" Title="What is Data Offset and its uses in TCP Header?" Tags="|ip|tcp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39273" PostTypeId="2" ParentId="39272" CreationDate="2017-02-26T15:54:33.733" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;in 32 bit words&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;means that in this context the &lt;code&gt;word&lt;/code&gt; unit is defined as &lt;code&gt;32 bits&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since 1 byte = 8 bits, a word is 4 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So a header 5 words long is 20 bytes and a 15 words header is 60 bytes.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-26T15:54:33.733" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39274" PostTypeId="2" ParentId="2450" CreationDate="2017-02-26T16:12:37.553" Score="0" Body="&lt;p&gt;With Mikrotik routers, you can using bonding in broadcast mode, see &lt;a href=&quot;https://wiki.mikrotik.com/wiki/Manual:Interface/Bonding&quot; rel=&quot;nofollow noreferrer&quot;&gt;bonding&lt;/a&gt;. I made some tests accross a 4G link connection, it does reduce packet loss going from 1 to 2 and I benefit from TCP speed improvements. Packet losses are not completely eliminated but going to 3 links does not further improve. I would investigate next in network coded TCP.&lt;/p&gt;&#xA;" OwnerUserId="34761" LastActivityDate="2017-02-26T16:12:37.553" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39275" PostTypeId="2" ParentId="39272" CreationDate="2017-02-26T18:51:10.840" Score="3" Body="&lt;p&gt;The purpose of the data offset is to tell the upper layers where the data starts.  As you point out, the TCP header can be anywhere from 5-15 words long.  So you need to know where the header ends and the data begins. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-02-26T18:51:10.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39276" PostTypeId="2" ParentId="7619" CreationDate="2017-02-26T19:00:47.633" Score="2" Body="&lt;p&gt;Like user27884 said, you could configure Iperf server in this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iperf -s -u -p 5061 -S 0xC0 -l 200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;..and the iperf client like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iperf -c 127.0.0.1 -u -p 5061 -S 0xC0 -l 200 -t 200 -b 200k -i 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;this will show parcial results every 10 seconds and the entire test with 200 seconds.&lt;/p&gt;&#xA;" OwnerUserId="30127" LastActivityDate="2017-02-26T19:00:47.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39287" PostTypeId="1" CreationDate="2017-02-27T09:55:57.977" Score="1" ViewCount="432" Body="&lt;p&gt;I'm testing one WiFi Gateway where the toggle option for MIMO power save mode need to be tested.I'm capturing the WiFi beacon frames using sniffer but I'm not able to find out which information element represents the MIMO power save mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-02-27T09:55:57.977" Title="How to check the MIMO power save state in a WiFi Beacon frame?" Tags="|ieee-802.11|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39288" PostTypeId="1" CreationDate="2017-02-27T11:25:10.120" Score="5" ViewCount="763" Body="&lt;p&gt;A simple question but important one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do I need as a programmer, to have the &lt;code&gt;&quot;port forwording&quot;&lt;/code&gt; phrase in my world, if I have a simple tools within my language I use, called &lt;code&gt;&quot;bind()&quot;&lt;/code&gt;, &lt;code&gt;&quot;listen()&quot;&lt;/code&gt; &lt;code&gt;&quot;accept()&quot;&lt;/code&gt; that hellps me to listen as a server to clients in sime port I decided on?&lt;/p&gt;&#xA;" OwnerUserId="34776" LastEditorUserId="2142" LastEditDate="2017-02-27T12:10:05.300" LastActivityDate="2017-02-27T15:06:23.853" Title="Why do we need &quot;port forwarding&quot;?" Tags="|internet|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39289" PostTypeId="2" ParentId="39288" CreationDate="2017-02-27T11:37:02.470" Score="3" Body="&lt;p&gt;I will try to explain in layman terms. The concept of port forwarding comes into picture when a host in WAN side( eg. Internet) need to contact the Private Server/PC hosted at the LAN side of a modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having an IPv4 Public address for all the clients in the world is not possible due to technical limitations, but this problem can be solved with Port Forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use Case #1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;let us Say you have a static public IP address (111.22.33.44)for your Modem from the ISP.You also have a linux PC connected to the modem with private IP 192.168.1.15.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this particular condition the PC host cannot be reached from the WAN side/Internet.&#xA;Imagine you have to access the LAN PC via SSH when you were on vacation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you could just enable the Port forwarding for SSH (port 22) in your modem to the Destination IP of 192.168.1.15 then the same PC can be accessed from Internet simply by accessing the ssh at 111.22.33.44 IP address. Modem will take care of the routing when it gets a TCP syn packet at its's WAN IP's 22 port.&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-02-27T11:37:02.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39291" PostTypeId="1" AcceptedAnswerId="39293" CreationDate="2017-02-27T14:08:03.057" Score="3" ViewCount="559" Body="&lt;p&gt;I need to be able to mirror traffic from 4 ports on Cisco Nexus 3000 switch to 2 ports on a same switch and connect 2 IPS appliances to those 2 ports. But I don't think it is possible to mirror port to 2 ports on Nexus devices, Any advice in how to solve this? &lt;/p&gt;&#xA;" OwnerUserId="2024" LastActivityDate="2017-02-27T14:39:36.447" Title="Mirror traffic from few interfaces in nexus 3000 switch to 2 interfaces for IPS" Tags="|cisco|cisco-nexus|mirror|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39292" PostTypeId="1" CreationDate="2017-02-27T14:23:11.337" Score="-1" ViewCount="99" Body="&lt;p&gt;If I can easely bind some computer in internal network to a port on the router by code - so its right to say that we need &quot;port-forwording&quot; only for cases that it easier to us then build a new software and bind it to some port?&lt;/p&gt;&#xA;" OwnerUserId="34777" LastEditorUserId="34855" LastEditDate="2017-03-01T20:45:28.773" LastActivityDate="2021-01-05T13:28:20.787" Title="Is &quot;port-forwarding&quot; used just for comfort?" Tags="|routing|internet|security|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39293" PostTypeId="2" ParentId="39291" CreationDate="2017-02-27T14:39:36.447" Score="2" Body="&lt;p&gt;I'm afraid that is not possible to do this directly on the Nexus, since:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;only one destination port is allowed in a monitor configuration&lt;/li&gt;&#xA;&lt;li&gt;the same source port cannot be set in two different sessions.&lt;/li&gt;&#xA;&lt;li&gt;the destination port of a session cannot be set as the source port of another session.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some IOS based switches allow this configuration (with 2 destination ports), so if you have such switches with ports available you could do it. Obviously it increases the cost and number of ports required.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-27T14:39:36.447" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39294" PostTypeId="2" ParentId="39250" CreationDate="2017-02-27T14:42:34.407" Score="1" Body="&lt;p&gt;With only the info provided, it sounds like the issue is that the devices, when connected to the local WiFi, are attempting to contact the public IP address used to connect to the mail server.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a connection to the mail server is made from inside the same network as the server, the traffic is attempting to &quot;hairpin&quot; through the router.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Client -&amp;gt; private IP on near (&quot;local&quot;) interface of router -&amp;gt; public IP on far (&quot;Internet&quot;) interface of router -&amp;gt; private IP on near (&quot;local&quot;) interface of router -&amp;gt; Server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Same diagram, rearranged to demonstrate the hairpin:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Client -&amp;gt; Router (local) -&amp;gt; Router (public) -&#xA;                                             |&#xA;Server &amp;lt;- Router (local) &amp;lt;-------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When the same connection is attempted from another network, the hairpin is not present:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Client -&amp;gt; Internet -&amp;gt; Router (public) -&amp;gt; Router (local) -&amp;gt; Server&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The local interface on the router is not traversed multiple times for connections coming in from the outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are lots of problems associated with hairpinning traffic through network devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your email client supports multiple server profiles, you could set up a profile that will work internally and one that will work externally.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A better solution would be to have the hostname used in the email clients to resolve the internal IP address when on the internal network and resolve to the public IP address elsewhere.  Make sure to keep the TTL of the DNS record low enough that it will not be cached for long to minimize the delay when transitioning between internal and external networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wikipedia entry on &lt;a href=&quot;https://en.wikipedia.org/wiki/Hairpinning&quot; rel=&quot;nofollow noreferrer&quot;&gt;Hairpinning&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-Rich Alloway (RogueWave)&lt;/p&gt;&#xA;" OwnerUserId="34097" LastEditorUserId="34097" LastEditDate="2017-02-27T14:48:28.143" LastActivityDate="2017-02-27T14:48:28.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39295" PostTypeId="2" ParentId="39288" CreationDate="2017-02-27T15:06:23.853" Score="3" Body="&lt;p&gt;As a programmer you really don't need. This is network function usually used to connect to server sitting after NAT via public network. Sometimes can also be used to convert TCP/UDP port X to port Y or alike network needs&lt;/p&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-02-27T15:06:23.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39296" PostTypeId="1" CreationDate="2017-02-27T15:19:33.733" Score="1" ViewCount="768" Body="&lt;p&gt;I've recently inherited an all wireless network that has every single client in the native VLAN, at multiple sites. The site in question currently has around 550 clients on a /22, which I feel is causing issues during peak times with an alarming number of broadcasts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;So my question is:&lt;/strong&gt;&#xA;Will splitting this up into separate VLANs while allowing every VLAN to be passed along the trunk ports (All AP switchports are setup as Trunk ports), and placing certain clients on their preferred VLAN, improve performance?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With Cisco Meraki APs you can create group policies that will tag an individual client to a particular VLAN&lt;/p&gt;&#xA;" OwnerUserId="34780" LastActivityDate="2017-09-26T18:10:44.473" Title="802.1Q VLAN Tagging over WiFi (Meraki)" Tags="|cisco|vlan|wireless|meraki|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39297" PostTypeId="2" ParentId="39296" CreationDate="2017-02-27T15:43:51.623" Score="0" Body="&lt;p&gt;In general 550 is great number for single network; splitting will make it more healthy. Separating your network into VLANs will reduce number of broadcasts clients receive, but not necessarily will reduce broadcasts on AP itself.&lt;/p&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-02-27T15:43:51.623" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39298" PostTypeId="2" ParentId="39292" CreationDate="2017-02-27T16:09:54.490" Score="2" Body="&lt;p&gt;The short answer is &quot;NO&quot;. There is nothing common between &quot;writing software&quot; and port forwarding.&#xA;Check here &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/39288/why-do-we-need-port-forwarding&quot;&gt;Why do we need &amp;quot;port forwarding&amp;quot;?&lt;/a&gt; to learn more why port forwarding is needed&lt;/p&gt;&#xA;" OwnerUserId="35348" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-02-27T16:09:54.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39300" PostTypeId="2" ParentId="36893" CreationDate="2017-02-27T16:53:21.117" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;blockquote&gt;&#xA;    &lt;p&gt;And if so, what does the bellow line means exactly ? :&lt;/p&gt;&#xA;    &#xA;    &lt;p&gt;Speciﬁc priority values are unimportant; only relative ordering matters&lt;/p&gt;&#xA;  &lt;/blockquote&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Suppose you have to flows with priority 10 and 20 respectively. Now instead of 10 and 20, you can change it to 10 and 11 resp. or 19 and 20 resp. or 50 and 100 resp. You see, the number doesn't matter. Just the relative difference matters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am assuming that you must have landed on the man page for ovs. In case you haven't here is the link: &lt;a href=&quot;http://openvswitch.org/support/dist-docs/ovs-vswitchd.conf.db.5.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;OVS-vSwitch&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34782" LastActivityDate="2017-02-27T16:53:21.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39302" PostTypeId="2" ParentId="36869" CreationDate="2017-02-27T17:09:35.597" Score="2" Body="&lt;p&gt;If by Ethernet, you mean Ethernet 'frames' then that packet is sent to the Controller. The Controller then instructs the Switch about packet modification and actions for output port.&#xA;Alternatively, the Switch may just send a 'pointer' to the packet rather than sending the whole packet to the Controller.&lt;/p&gt;&#xA;" OwnerUserId="34782" LastActivityDate="2017-02-27T17:09:35.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39303" PostTypeId="2" ParentId="32783" CreationDate="2017-02-27T17:19:12.643" Score="1" Body="&lt;p&gt;Perhaps the first two hosts get an IP assigned in the same subnet. Hence, they may be communicating over traditional network.&#xA;Since, you didn't add a switch, the question of loops shouldn't arise.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have a misconfigured code. The Controller object needs to be 'built' and only Switches have to be 'started'.&#xA;Use net.build() instead of net.start(). The start() function is for switches.&lt;/p&gt;&#xA;" OwnerUserId="34782" LastActivityDate="2017-02-27T17:19:12.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39304" PostTypeId="2" ParentId="39296" CreationDate="2017-02-27T18:19:44.217" Score="1" Body="&lt;p&gt;I would segment the VLANs based on the local structure.&#xA;e.g.:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Floor Level1 =&gt; VLAN101&lt;/li&gt;&#xA;&lt;li&gt;Floor Level2 =&gt; VLAN102&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This is a quite static approach in segmenting your network and much more simple to implement than using group policys. In my opinion troubleshooting is also simplified in this approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Group policys are great for an organisation-based segmentation of your network, but in my opinon unnecessary if only the size of your broadcast-domain is your aim.&lt;/p&gt;&#xA;" OwnerUserId="31569" LastActivityDate="2017-02-27T18:19:44.217" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39305" PostTypeId="1" AcceptedAnswerId="39318" CreationDate="2017-02-27T18:57:58.930" Score="2" ViewCount="1227" Body="&lt;p&gt;Here's an example command and output from a 2921 running BGP:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router#show ip bgp summary&#xA;BGP router identifier a.b.c.d, local AS number xxxxx&#xA;BGP table version is 352841773, main routing table version 352841773&#xA;629306 network entries using 90620064 bytes of memory&#xA;629307 path entries using 50344560 bytes of memory&#xA;106106/105965 BGP path/bestpath attribute entries using 16976960 bytes of memory&#xA;97455 BGP AS-PATH entries using 4812166 bytes of memory&#xA;1 BGP ATTR_SET entries using 40 bytes of memory&#xA;12009 BGP community entries using 1523662 bytes of memory&#xA;116 BGP extended community entries using 7108 bytes of memory&#xA;220 BGP route-map cache entries using 7920 bytes of memory&#xA;0 BGP filter-list cache entries using 0 bytes of memory&#xA;BGP using 164292440 total bytes of memory&#xA;BGP activity 12705113/12039960 prefixes, 19056016/18390892 paths, scan interval 60 secs&#xA;&#xA;Neighbor        V           AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;a.b.c.d         4        xxxxx       0       0        1    0    0 8w4d     Idle (Admin)&#xA;a.b.c.d         4        xxxxx 7319210   47142 352841520    0    0 2w1d       629303&#xA;a.b.c.d         4        xxxxx   33222 4258052 352841520    0    0 2w6d            1&#xA;a.b.c.d         4        xxxxx   33251 4258051 352841520    0    0 2w6d            1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm curious about this line:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;BGP activity &lt;strong&gt;12705113&lt;/strong&gt;/&lt;strong&gt;12039960&lt;/strong&gt; prefixes, &lt;strong&gt;19056016&lt;/strong&gt;/&lt;strong&gt;18390892&lt;/strong&gt; paths, scan interval 60 secs&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;What do the four bold numbers mean?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All I can find in the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp5.html#wp1162534&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Command Reference&lt;/a&gt; is this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;BGP activity...    Displays the number of times that memory has been allocated or released for a path or prefix.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="23971" LastActivityDate="2017-02-28T08:44:58.237" Title="What do BGP activity numbers mean?" Tags="|bgp|cisco-ios|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39306" PostTypeId="1" AcceptedAnswerId="39308" CreationDate="2017-02-27T19:20:00.207" Score="2" ViewCount="1886" Body="&lt;p&gt;im struggeling in setting up LDP based VPLS in a Cisco/Juniper mixed vendor environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configuration is currently running between two Cisco Boxes, but i have to migrate on side to Juniper.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is the current configuration:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco ASR1k:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;l2 vfi VPLS-1839 manual &#xA;vpn id 1839&#xA;bridge-domain 1839&#xA;neighbor x.x.x.x encapsulation mpls&#xA;&#xA;interface GigabitEthernet0/0/3&#xA; no ip address&#xA; negotiation auto&#xA; service instance 1839 ethernet&#xA;  encapsulation untagged&#xA;  rewrite ingress tag push dot1q 1839 symmetric&#xA;  bridge-domain 1839&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Juniper MX:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;routing-instances {&#xA;    VPLS-1839 {&#xA;        instance-type vpls;&#xA;        vlan-id none;&#xA;        interface xe-1/1/0.0;&#xA;        protocols {&#xA;            vpls {&#xA;                no-tunnel-services;&#xA;                vpls-id 1839;&#xA;                neighbor x.x.x.x;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;a &quot;show vpls connections&quot; on the Juniper shows following output.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Instance: VPLS-1839&#xA;  VPLS-id: 1839&#xA;    Neighbor                  Type  St     Time last up          # Up trans&#xA;    x.x.x.x(vpls-id 1839) rmt OL   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;OL is described as &quot;no outgoing label&quot;, but i don't have an idea what this message is trying to tell me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LDP is running on alle core-facing interfaces and the lo0.0. MPLS address-family is also present on all interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea how to isolate the cause of this issue?&#xA;Thanks in advance for any hints.&lt;/p&gt;&#xA;" OwnerUserId="31569" LastActivityDate="2017-02-27T23:40:44.053" Title="LDP based VPLS between Cisco IOS XE and Juniper MX" Tags="|cisco|juniper|mpls|vpls|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39308" PostTypeId="2" ParentId="39306" CreationDate="2017-02-27T23:40:44.053" Score="4" Body="&lt;p&gt;No outgoing label indicates that Junos doesn't have a label for the loopback you are targeting on the Cisco (your x.x.x.x address)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Confirm the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Your NNI interface from the Juniper has &lt;code&gt;family mpls&lt;/code&gt; configured&lt;/li&gt;&#xA;&lt;li&gt;Under &lt;code&gt;protocols mpls&lt;/code&gt; you have the NNI &lt;code&gt;interface&lt;/code&gt; defined&lt;/li&gt;&#xA;&lt;li&gt;Under &lt;code&gt;protocols ldp&lt;/code&gt; you have the NNI &lt;code&gt;interface&lt;/code&gt; defined&lt;/li&gt;&#xA;&lt;li&gt;Under &lt;code&gt;protocols ldp&lt;/code&gt; you also have the loopback &lt;code&gt;interface&lt;/code&gt; defined&lt;/li&gt;&#xA;&lt;li&gt;Finally, use &lt;code&gt;show ldp session&lt;/code&gt; or &lt;code&gt;show route table inet.3&lt;/code&gt; and  confirm that the far-end loopback is visible in the list&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-02-27T23:40:44.053" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39311" PostTypeId="1" CreationDate="2017-02-28T03:20:15.893" Score="2" ViewCount="14888" Body="&lt;p&gt;When statically routing a route in the format [destination network address] [mask] [next hop address or interface name], I get the Inconsistent Address and mask error. Any assistance would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network address:&lt;code&gt;10.10.233.0&lt;/code&gt;&lt;br&gt;&#xA;Mask: &lt;code&gt;255.255.254.0&lt;/code&gt; (fitted to suit 300 host )&lt;br&gt;&#xA;Hop address: &lt;code&gt;10.10.235.162&lt;/code&gt;  &lt;/p&gt;&#xA;" OwnerUserId="34791" LastEditorUserId="8499" LastEditDate="2018-03-07T18:40:37.213" LastActivityDate="2018-03-07T18:40:37.213" Title="Inconsistent Address and mask" Tags="|routing|router|ipv4|ip|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39312" PostTypeId="2" ParentId="39311" CreationDate="2017-02-28T03:26:50.953" Score="3" Body="&lt;p&gt;That would be correct. If you mask the address you think is the network's address with the network mask, you get a different, real network address.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address   10.10.233.0 = 00001010000010101110100100000000&#xA;Mask    255.255.254.0 = 11111111111111111111111000000000&#xA;                 AND    ================================&#xA;Network                 00001010000010101110100000000000 = 10.10.232.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The network is from &lt;code&gt;10.10.232.0&lt;/code&gt; to &lt;code&gt;10.10.233.255.255&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must do IP math in binary, then it makes sense, and otherwise you make mistakes. See this &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;excellent answer&lt;/a&gt; for how to do that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With that mask (&lt;code&gt;255.255.254.0&lt;/code&gt;), that address (&lt;code&gt;10.10.233.0&lt;/code&gt;) is not a network address, it is a host address on a different network (&lt;code&gt;10.10.232.0&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-02-28T14:56:49.897" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39315" PostTypeId="1" AcceptedAnswerId="39317" CreationDate="2017-02-28T05:28:43.040" Score="5" ViewCount="4279" Body="&lt;p&gt;I am reading up on VxLAN and understand the encapsulation process somewhat as below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step1: Take your original Ethernet frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step2:Put it inside VxLAN encapsulation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step3:VxLAN should then go inside of UDP header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step4:UDP goes inside of IP(this should be the transport IP, i guess)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step5: IP goes inside of whatever the transport is(e.g.Ethernet)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q1: Please confirm if the above understanding is correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:Why do we need VxLAN header to go inside UDP, why not send it over plain IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q3:In other tunnel mechanisms, like the OTV, we don't use any layer 4 protocol(like TCP or UDP), so why use it here? Any specific reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q4: Why use UDP(since it is best-effort based), why not use TCP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q5: Can i look at VxLAN the way i look at HTTP or Telnet(both are applications and operate at layer 7), HTTP uses TCP port 80, telnet uses TCP port 23, what i am trying to understand is VxLAN an application that operates at layer 7 and fits into osi model ?&#xA;Also, which OSI layer would OTV be operating at and why?One answer below says that OTV can be done using UDP as well rather than MPLS/GRE, does that make OTV a protocol that operates at layer 7?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have also attached a snapshot of packet capture of VxLAN header from one of the video lectures.&lt;a href=&quot;https://i.stack.imgur.com/f53RU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/f53RU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2017-03-01T04:09:30.330" LastActivityDate="2017-03-01T04:09:30.330" Title="Regarding VxLAN Encapsulation" Tags="|vxlan|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39317" PostTypeId="2" ParentId="39315" CreationDate="2017-02-28T07:38:10.647" Score="10" Body="&lt;p&gt;Yes - your understanding of encapsulation is correct: a given frame has a VXLAN header applied.  This is carried in a UDP packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP is used as a convenient format in terms of programming and its use of src/dst port provides a ready means to both multiplex connections as well as a means by which intermediary forwarding elements can hash connections over parallel links.  In short, UDP is familiar, has low overhead and is already extremely well understood.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OTV can run over MPLS-GRE or UDP, with UDP being the preferred mechanism for the past few years.  Again, one of the big drivers was depolarization of traffic (allowing parallel paths to carry determinstically hashed fractions of overall traffic).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why not TCP?  Excessive overhead on the encapsulating device and added latency are big examples.  The bigger point, though, is that to get any value out of TCP would require the ability to concatenate the individual packets to be encapsulated into an overall stream to be managed via sliding windows rather than simply maintaining a 1:1 mapping.  Add in the amount of state tracking and buffering issues associated with having the capability for retransmission and it becomes truly unruly.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-02-28T07:38:10.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39318" PostTypeId="2" ParentId="39305" CreationDate="2017-02-28T08:39:13.983" Score="3" Body="&lt;p&gt;What that is saying is that memory has been allocated to your prefixes &lt;strong&gt;12705113&lt;/strong&gt; times and released &lt;strong&gt;12039960&lt;/strong&gt; times. It has been allocated to your paths &lt;strong&gt;19056016&lt;/strong&gt; and released &lt;strong&gt;18390892&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I suspect your router has been up for a while.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A route announcement is sometimes referred to as a 'prefix'. A prefix announced in BGP consists of the IPV4 or IPV6 address block being announced and also a path of AS numbers, indicating which ASNs the traffic must pass through to reach the announced address block. A BGP prefix would look something like (IPV4): 701 1239 42 206.24.14.0/24. The /24 part is referred to as a CIDR mask. The /24 indicates that the first 24 bits in the address block is the ?network? part of the address block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.sprint.net/index.php?p=faq_bgp&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.sprint.net/index.php?p=faq_bgp&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP Activity displays the number of times that memory has been allocated or released for a path or prefix. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp5.html#wp1162687&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/iproute_bgp/command/reference/irg_book/irg_bgp5.html#wp1162687&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34733" LastEditorUserId="34733" LastEditDate="2017-02-28T08:44:58.237" LastActivityDate="2017-02-28T08:44:58.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39320" PostTypeId="1" AcceptedAnswerId="39338" CreationDate="2017-02-28T09:37:58.200" Score="2" ViewCount="820" Body="&lt;p&gt;I need to confirm the below  as i don't have access to a lab.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 4 XR boxes connected linearly as shown.Router A is advertsing PC subnet in isis.&#xA;My understanding:&#xA;So when the subnet of PC A reaches the Router D, the overall metric&#xA;should be as&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cost of PC A to Router A link + 16777214(A-B link cost) + 16777214(B-C link cost) +16777214 (C-D link cost)&#xA;But the max metric in isis is 16777214, so will the final route get installed or not? If so, with what metric?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With what metric will Router D learn the subnet of PC connected to Router A?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZeaGb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZeaGb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2017-02-28T17:50:12.357" Title="ISIS Max metric" Tags="|is-is|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39321" PostTypeId="1" CreationDate="2017-02-28T09:53:35.237" Score="4" ViewCount="952" Body="&lt;p&gt;I'm trying to configure segment-routing with Juniper MX routers. but i can not find much documentation related with that. if anyone have configuration guide i ll be appreciate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks.&lt;/p&gt;&#xA;" OwnerUserId="34798" LastActivityDate="2018-09-20T11:05:52.193" Title="Segment routing with JUNOS MX routers" Tags="|routing|juniper|juniper-junos|juniper-mx|" AnswerCount="1" CommentCount="4" ClosedDate="2018-09-21T14:01:06.167" ContentLicense="CC BY-SA 3.0" />
  <row Id="39323" PostTypeId="1" AcceptedAnswerId="39324" CreationDate="2017-02-28T10:25:53.863" Score="3" ViewCount="869" Body="&lt;p&gt;I need to flood my router's NAT table for testing the boundary condition behavior of my Router. Apart from manual options( Opening enormous number of websites/Paraller downloads of Torrents/Nmap scan of Internet) is there any other tool or script available to achieve the required setup?&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-02-28T10:36:34.023" Title="How to flood my router's NAT table?" Tags="|ip|nat|" AnswerCount="1" CommentCount="0" ClosedDate="2018-07-29T00:23:56.863" ContentLicense="CC BY-SA 3.0" />
  <row Id="39324" PostTypeId="2" ParentId="39323" CreationDate="2017-02-28T10:36:34.023" Score="4" Body="&lt;p&gt;There's a tool widely used for testing networks : &lt;a href=&quot;https://github.com/esnet/iperf&quot; rel=&quot;nofollow noreferrer&quot;&gt;iperf&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the &lt;code&gt;-P &amp;lt;number&amp;gt;&lt;/code&gt; option you can open a great number of flow simultaneously.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a default max of 128 for this option, but there's no hard limit. You can change this value editing the &lt;code&gt;src/iperf.h&lt;/code&gt; file.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-28T10:36:34.023" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39327" PostTypeId="2" ParentId="39315" CreationDate="2017-02-28T11:48:49.543" Score="2" Body="&lt;p&gt;Another reason for using UDP is that it is a 'standard' protocol, so unlike things like GRE/IPSEC and similar, you don't need intermediary devices to support anything exotic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider, too, that you can implement TCP somewhat efficiently on top of UDP, but not the other way round: if you choose TCP, you opt-in to all kinds of extras (as compared to UDP), like error detection and retransmits, that will cost you whether you make full use of them or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One reason VxLAN was developed in the first place is that placing headers directly in the frame would effectively make this a GRE or VLAN. It also has limitations, notably linked to the fact you can only pile an extra 20 bytes onto your frame so many times before it requires MTUs to be adjusted throughout your network, or will start impacting throughput (not to mention switching overhead linked to reading/popping/adding VLAN tags). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VxLAN provides VLAN like isolation with point-to-point connectivity, meaning your network can be entirely ignorant of the details, or indeed, of the overlay network. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not related to VxLAN, but for 'building TCP from UDP + time', see for example &lt;a href=&quot;https://hpbn.co/building-blocks-of-udp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://hpbn.co/building-blocks-of-udp/&lt;/a&gt; (and I would recommend reading the TCP section to understand what the disadvantages of TCP vs UDP can be). &lt;/p&gt;&#xA;" OwnerUserId="34804" LastActivityDate="2017-02-28T11:48:49.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39331" PostTypeId="2" ParentId="39315" CreationDate="2017-02-28T13:42:01.243" Score="2" Body="&lt;p&gt;Key to understanding the design of VXLAN is understanding where it is intended to be used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is designed for big multi tenant datacenters that need to provide virtual Ethernet networks to their tennants but are outgrowing the conventional VLAN/STP soloution in terms of the number of VLAN numbers or the ability to efficently route traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In such environments it is important that the overlay network plays nice with the underlay network. The underlay network is likely to be very high traffic and thus make use of features like Link aggregation and Equal cost multipath.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ECMP and link aggregation rely on being able to hash the header fields of packets so that packets belonging to the same transport layer session go down the same path and hence are delivered in-order. To maximise efficiency you want different sessions on the overlay network to be regarded as different sessions by the devices on the underlay network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most better ECMP and link aggregation implementations understand UDP. VXLAN uses the UDP source port number to communicate session hashing information from the overlay network to the underlay network.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-02-28T13:42:01.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39335" PostTypeId="2" ParentId="39315" CreationDate="2017-02-28T15:08:01.753" Score="3" Body="&lt;p&gt;While the accepted answer explains well why UDP is used instead of raw IP, it doesn't explain well why TCP is not used. The short reason is that the Ethernet packets traveling inside a VXLAN tunnel have most commonly already one level of TCP. If you encapsulate those packets inside another level of TCP, you have two levels of TCP in the same packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP over TCP is a bad idea: &lt;a href=&quot;http://sites.inka.de/bigred/devel/tcp-tcp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://sites.inka.de/bigred/devel/tcp-tcp.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While TCP over TCP may appear to work if packet loss is low, having retransmissions at two different levels makes the system increasingly inefficient at high packet loss rates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So: don't do that! UDP or raw IP is a much better encapsulation, as they don't provide another unnecessary level of retransmissions. Tunneling protocols exist both for UDP (GTP, VXLAN, Geneve) and for raw IP (GRE).&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2017-02-28T15:08:01.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39337" PostTypeId="2" ParentId="32783" CreationDate="2017-02-28T17:35:04.197" Score="1" Body="&lt;p&gt;There are 2 problems here based on the fact that Mininet considers one interface in a host as the &quot;default&quot; interface for the node. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;In a host with many interfaces, mininet assigns an IP only to the default interface, so you have to assign the IP with a coherent IP plan. &#xA;&lt;a href=&quot;https://mailman.stanford.edu/pipermail/mininet-discuss/2013-August/002843.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;See here for details.&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see in the following code that you can have a different result changing only the order in which you add the links (when you add a link, the interfaces are also created and if the new interface is the first in the host, it will be the &quot;default&quot;, thus with an IP):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python&#xA;&#xA;from mininet.net import Mininet&#xA;from mininet.log import setLogLevel&#xA;import os,time&#xA;&#xA;if __name__ == '__main__':&#xA;    #setLogLevel( 'info' )&#xA;    net = Mininet()&#xA;&#xA;    num_nodes = 8&#xA;    hosts=[None] * num_nodes&#xA;&#xA;    for i in range(1,num_nodes):&#xA;        hosts[i]=net.addHost(&quot;h%d&quot;%i)&#xA;    for i in range(2,num_nodes,2):&#xA;        net.addLink(hosts[i], hosts[i-1])&#xA;    for i in range(3,num_nodes,2):&#xA;        net.addLink(hosts[i], hosts[i-1])&#xA;&#xA;    net.start()&#xA;    net.pingAll()&#xA;    net.stop()&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    h1 -&amp;gt; h2 X X X X X &#xA;    h2 -&amp;gt; h1 X X X X X &#xA;    h3 -&amp;gt; X X h4 X X X &#xA;    h4 -&amp;gt; X X h3 X X X &#xA;    h5 -&amp;gt; X X X X h6 X &#xA;    h6 -&amp;gt; X X X X h5 X &#xA;    h7 -&amp;gt; X X X X X X &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;pingAll() tries to ping from each host to the IP of the default interface of any other host. This can work only if you enable the ip forwarding in every host in this way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;host.cmd('sysctl -w net.ipv4.ip_forward=1')&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;otherwise you have to ping the neighbors of each host giving the right IP. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here you can find the code that can assign the IPs to the interfaces and ping all the neighbors for each node.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#!/usr/bin/python&#xA;&#xA;from mininet.net import Mininet&#xA;from mininet.log import output&#xA;&#xA;if __name__ == '__main__':&#xA;&#xA;    net = Mininet()&#xA;&#xA;    num_nodes = 8 &#xA;&#xA;    # from 1 to num_nodes&#xA;    for i in range(1,num_nodes+1): &#xA;        net.addHost('h%d'%i,ip=None)&#xA;&#xA;    # from 1 to num_nodes-1 because the index starts from zero&#xA;    for i in range(1,num_nodes): &#xA;&#xA;        h1 = net.hosts[i-1]&#xA;        h2 = net.hosts[i]&#xA;&#xA;        net.addLink(h2, h1, intfName1 = '%s-eth0'%h2.name, intfName2 = '%s-eth1'%h1.name)&#xA;        h2.intf('%s-eth0'%h2.name).setIP('10.0.%d.1'%i, 24) &#xA;        h1.intf('%s-eth1'%h1.name).setIP('10.0.%d.2'%i, 24) &#xA;&#xA;    net.start()&#xA;&#xA;    # Ping forward and backward nodes&#xA;    for i in range(0,num_nodes):&#xA;        node = net.hosts[i]&#xA;&#xA;        fwdNode, bwNode = None, None&#xA;&#xA;        output('%s -&amp;gt; '%node.name)&#xA;&#xA;        if i!=0:&#xA;            bwNode = net.hosts[i-1]&#xA;            bwIP = bwNode.IP('%s-eth1'%bwNode.name)&#xA;            result = node.cmd('ping -c1 %s'%bwIP)&#xA;            sent, received = net._parsePing(result)&#xA;&#xA;            output(('%s '%bwNode.name) if received else 'X ')&#xA;&#xA;        if i!=7:&#xA;            fwdNode = net.hosts[i+1]&#xA;            fwdIP = fwdNode.IP('%s-eth0'%fwdNode.name)&#xA;            result = node.cmd('ping -c1 %s'%fwdIP)&#xA;            sent, received = net._parsePing(result)&#xA;&#xA;            output(('%s '%fwdNode.name) if received else 'X ')&#xA;&#xA;        output('\n')&#xA;&#xA;    net.stop()&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this is the output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;h1 -&amp;gt; h2 &#xA;h2 -&amp;gt; h1 h3 &#xA;h3 -&amp;gt; h2 h4 &#xA;h4 -&amp;gt; h3 h5 &#xA;h5 -&amp;gt; h4 h6 &#xA;h6 -&amp;gt; h5 h7 &#xA;h7 -&amp;gt; h6 h8 &#xA;h8 -&amp;gt; h7 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34816" LastActivityDate="2017-02-28T17:35:04.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39338" PostTypeId="2" ParentId="39320" CreationDate="2017-02-28T17:50:12.357" Score="2" Body="&lt;p&gt;I just labbed it in VIRL.  For the PC subnet, I get a metric of 50331642 on Router D:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Routing entry for 10.0.0.4/30&#xA;  Known via &quot;isis 1&quot;, distance 115, metric 50331642, type level-2&#xA;  Installed Feb 28 17:46:19.166 for 00:00:07&#xA;  Routing Descriptor Blocks&#xA;    10.0.0.17, from 192.168.0.2, via GigabitEthernet0/0/0/0&#xA;      Route metric is 50331642&#xA;  No advertising protos. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that I had to manually set the IS-IS link metric to 16777214 on all applicable interfaces under the ISIS config.  Otherwise it defaults to a link metric of 10 for a total metric of 30 on Router D.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2017-02-28T17:50:12.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39339" PostTypeId="1" CreationDate="2017-02-28T18:17:06.597" Score="1" ViewCount="34" Body="&lt;p&gt;I'm currently looking into OpenFlow Networks in a Windows environment. To just get a network to run properly one needs to define quite a few Flows already. Per example, Active Directory communication, DHCP, DNS, WINS and so on. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now before diving in myself and just examine what hits my Controller and see if I want to open up the communication for that protocol, I was wondering if anyone has done this or something similar already?&lt;/p&gt;&#xA;" OwnerUserId="34817" LastEditorUserId="8499" LastEditDate="2017-02-28T18:36:17.863" LastActivityDate="2017-02-28T18:36:17.863" Title="OpenFlow: Baseline Flows for Windows environments" Tags="|sdn|openflow|" AnswerCount="0" CommentCount="1" ClosedDate="2018-07-29T00:23:30.120" ContentLicense="CC BY-SA 3.0" />
  <row Id="39341" PostTypeId="1" AcceptedAnswerId="39346" CreationDate="2017-02-28T18:45:23.687" Score="2" ViewCount="123" Body="&lt;p&gt;I need to create 4x test environments, each environment contains 3x servers within a 192.168.215.0/24 subnet.  Each test environment does NOT need to be aware of the other test environments.  The environments exist on an ESXi server and each have their own vSwitch.&#xA;The vSwitches are each presented through their own interface on the ESXi host to a Procurve 2810.  The Procurve is in turn connected to an ASA 5512-X.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server at 192.168.91.1 needs to be able to connect to each host using a NAT'd address in the 192.168.93.0/24 range.  E.g. Environment 1, server 1 is 192.168.93.1, environment 2, server 1 is 192.168.93.11&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't bring each environment into the ASA on separate interfaces as there are no more spare.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each environment will need an internal default gateway (192.168.215.254/24) but I can't work out where to set this.  If I create separate VLANS in the Procurve they can't all have the same IP, and the same for the ASA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sure there is a really obvious answer to this, and that I am overthinking it as I've been looking at it for too long, but at the moment the answer is eluding me...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/Op9pJ.jpg&quot; alt=&quot;Example&quot;&gt;&lt;/p&gt;&#xA;" OwnerUserId="34818" LastEditorUserId="31801" LastEditDate="2019-01-02T19:01:58.117" LastActivityDate="2019-01-02T19:01:58.117" Title="NAT test environments" Tags="|cisco-asa|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="39344" PostTypeId="1" AcceptedAnswerId="39349" CreationDate="2017-02-28T19:59:25.573" Score="3" ViewCount="537" Body="&lt;p&gt;I have created a virtual routing instance allow traffic to be transmitted over private IP space:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;static-cust-inet {&#xA;    description &quot;Virtual Routing Instance&quot;;&#xA;    instance-type virtual-router;&#xA;    interface ge-1/1/3.5312;&#xA;    interface ge-1/1/3.5324;&#xA;    routing-options {&#xA;        static {&#xA;            route 10.0.0.0/24 next-hop 172.30.212.2;&#xA;            route 192.168.0.0/24 next-hop 172.30.211.2;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Applying a filter to the interfaces specified there doesn't work. How would I do it in this situation? This is the policer I want to apply is like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;if-exceeding {&#xA;    bandwidth-limit 10m;&#xA;    burst-size-limit 1m;&#xA;}&#xA;then discard;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The firewall filter is specified under the &quot;firewall family inet&quot; hierarchy level. Is that the correct place?&lt;/p&gt;&#xA;" OwnerUserId="20112" LastActivityDate="2017-02-28T22:20:01.347" Title="Traffic shaping on juniper virtual-router" Tags="|routing|firewall|juniper|virtual|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39345" PostTypeId="1" AcceptedAnswerId="39353" CreationDate="2017-02-28T20:01:00.070" Score="3" ViewCount="159" Body="&lt;p&gt;If you have a router that traffic passes through, and you want to classify different types of traffic using DSCP values, do you need to take special care to avoid setting DSCP values on certain types of traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My worry is that certain protocols that offer data integrity, like SSH or VPNs, would take a hash of the IP header, including the DSCP value, and if the DSCP value changes, the client would reject the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It appears that ESP and AH, as described &lt;a href=&quot;http://unixwiz.net/techtips/iguide-ipsec.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; take care to avoid hashing the DSCP field. Are there other protocols that aren't as careful, that might break if you change the DSCP values on their packets? Or is changing DSCP willy-nilly generally considered safe?&lt;/p&gt;&#xA;" OwnerUserId="33585" LastActivityDate="2017-02-28T23:16:59.307" Title="Are there any protocols that DSCP will break?" Tags="|ipv4|ip|dscp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39346" PostTypeId="2" ParentId="39341" CreationDate="2017-02-28T21:06:47.330" Score="1" Body="&lt;p&gt;I would create a virtualized router in each environment that provide the local environment gateway and has the &quot;external&quot; IP address within the 192.168.93.0/24 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is this router that would NAT traffic coming from the test environment with its 192.168.93.X IP.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-02-28T21:06:47.330" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39349" PostTypeId="2" ParentId="39344" CreationDate="2017-02-28T22:20:01.347" Score="1" Body="&lt;p&gt;Here's how we do this on an MX80.  Important to understand that policing is ingress (drops traffic if metrics are exceeded and can also cause lots of problems with TCP if the remote end isn't shaping toward you) and shaping is egress (which is queued and plays nicely with TCP by default).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to admit though that I'm not certain if the syntax with a VRI would be different:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;class-of-service {&#xA;    interfaces {&#xA;         {&#xA;            unit &quot;vlan_id&quot; {&#xA;                shaping-rate &quot;shaping_rate&quot;;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;&#xA;Example:&#xA;class-of-service {&#xA;    interfaces {&#xA;        xe-1/2/0 {&#xA;            unit 948 {&#xA;                shaping-rate 500m;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="34824" LastActivityDate="2017-02-28T22:20:01.347" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39350" PostTypeId="2" ParentId="39315" CreationDate="2017-02-28T22:20:53.897" Score="5" Body="&lt;p&gt;One additional reason to use UDP vs L2oIP is to enhance entropy. In most cases load-balancing is done per flow/5 tuple, UDP ports are the keys in the hash, VxLAN allows UDP source port to be set to any arbitrarily value (within the range), that could be exposed to the application layer, hence increasing granularity in flow setup and better load-balancing while traversing the network towards remote VTEP   &lt;/p&gt;&#xA;" OwnerUserId="22619" LastActivityDate="2017-02-28T22:20:53.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39351" PostTypeId="1" AcceptedAnswerId="39354" CreationDate="2017-02-28T22:34:07.640" Score="2" ViewCount="1081" Body="&lt;p&gt;I am testing an openflow switch for its performance. I am using &quot;pktgen&quot; kernel module  available in linux to generate packets at different flow rates. I have a host with two interfaces eth1 and eth2. Both interfaces are connected to switch port1 and port2 respectively. I am injecting traffic from eth1 using pktgen. Simultaneously I am also running tcpdump on eth1 interface. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I am not able to see the traffic that is being generated by the host on eth1 interface. I used &lt;code&gt;tcpdump -i eth1 -f udp port 9&lt;/code&gt; to view traffic as packets generated by pktgen are on udp port 9. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did look for possible solutions on Google and the closest thing to a solution is &lt;a href=&quot;https://www.spinics.net/lists/vlan/msg01051.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this thread&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I am still not able to see any traffic generated by pktgen on eth1 interface. Please let me know if there are any suggestions ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please see below the pktgen script i am using. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;function pgset() {&#xA;local result&#xA;&#xA;echo $1 &amp;gt; $PGDEV&#xA;&#xA;result=`cat $PGDEV | fgrep &quot;Result: OK:&quot;`&#xA;if [ &quot;$result&quot; = &quot;&quot; ]; then&#xA;     cat $PGDEV | grep Result:&#xA;fi&#xA;}&#xA;&#xA;function pg() {&#xA;    echo inject &amp;gt; $PGDEV&#xA;    cat $PGDEV&#xA;}&#xA;&#xA;PGDEV=/proc/net/pktgen/kpktgend_0&#xA;echo &quot;Removing all devices&quot;&#xA;pgset &quot;rem_device_all&quot;&#xA;echo &quot;Adding eth1&quot;&#xA;pgset &quot;add_device eth1&quot;&#xA;&#xA;CLONE_SKB=&quot;clone_skb 10&quot;&#xA;PKT_SIZE=&quot;pkt_size 60&quot;&#xA;&#xA;COUNT=&quot;count 100&quot;     &#xA;DELAY=&quot;delay 0&quot; &#xA;&#xA;PGDEV=/proc/net/pktgen/eth1&#xA;echo &quot;Configuring $PGDEV&quot;&#xA;pgset &quot;$COUNT&quot;&#xA;pgset &quot;$CLONE_SKB&quot;&#xA;pgset &quot;$PKT_SIZE&quot;&#xA;pgset &quot;$DELAY&quot;&#xA;&#xA;pgset &quot;dst_min 192.168.6.1&quot;&#xA;pgset &quot;dst_max 192.168.63.255&quot;&#xA;&#xA;pgset &quot;flows 100&quot;&#xA;pgset &quot;flowlen 1&quot;&#xA;&#xA;PGDEV=/proc/net/pktgen/pgctrl&#xA;&#xA;echo &quot;Running... ctrl^C to stop&quot;&#xA;pgset &quot;start&quot;&#xA;echo &quot;Done&quot;&#xA;#pgset &quot;stop&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="23374" LastEditorUserId="23374" LastEditDate="2017-02-28T23:32:52.233" LastActivityDate="2017-03-01T00:00:14.213" Title="How to Capture packets generated from linux pktgen traffic generator?" Tags="|wireshark|tcpdump|" AnswerCount="1" CommentCount="7" ClosedDate="2018-07-29T00:18:29.600" ContentLicense="CC BY-SA 3.0" />
  <row Id="39352" PostTypeId="2" ParentId="39154" CreationDate="2017-02-28T23:14:34.810" Score="0" Body="&lt;p&gt;I was able to get a per namespace instance of quagga running by specifying namespace specific options per daemon. For example, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Zebra:&#xA;/usr/lib/quagga/blue/zebra -d -f /etc/quagga/zebrab.conf -A 127.0.0.1 -P 2000 -i /var/run/quagga/blue/zebra.pid -z /var/run/quagga/blue/zserv.api&#xA;&#xA;OSPFd:&#xA;/usr/lib/quagga/red/ospfd -d -f /etc/quagga/ospfdb.conf -A 127.0.0.1 -P 2001 -i /var/run/quagga/blue/ospfd.pid -z /var/run/quagga/blue/zserv.api&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm sure there is a better way but this makes it functional. I need to do some work on the VTY options but using telnet to make the ospfd configurations works.&lt;/p&gt;&#xA;" OwnerUserId="34641" LastActivityDate="2017-02-28T23:14:34.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39353" PostTypeId="2" ParentId="39345" CreationDate="2017-02-28T23:16:59.307" Score="3" Body="&lt;p&gt;No protocols will break due to a changed DSCP - how they are treated by upstream devices may change however (traffic may be more likely to be dropped, or aggressively shaped), so this will need to be taken into consideration if you don't have control/visibility end-to-end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your VPN example, traffic encapsulated in a tunnel header will have it's DSCP values preserved.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changing the DSCP value of the tunnel traffic (eg: outer IP header) will have no effect on checksums (checksum will be against payload, not entire packet).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact the default behaviour of most IPSEC VPN devices I've worked with over the years is to copy the DSCP header from the tunnelled traffic to the outer tunnel header so that it can still be identified.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-02-28T23:16:59.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39354" PostTypeId="2" ParentId="39351" CreationDate="2017-03-01T00:00:14.213" Score="0" Body="&lt;p&gt;Based on &lt;a href=&quot;https://www.mail-archive.com/netdev@vger.kernel.org/msg22176.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this answer&lt;/a&gt; it seems that pktgen sends packets below the packet capture hooks and it is not possible to see outgoing packets, untill and unless we modify the working of pktgen code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If anyone has a different suggestion please let me know. Thanks. &lt;/p&gt;&#xA;" OwnerUserId="23374" LastActivityDate="2017-03-01T00:00:14.213" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39355" PostTypeId="1" AcceptedAnswerId="39357" CreationDate="2017-03-01T02:30:08.093" Score="3" ViewCount="4852" Body="&lt;p&gt;I do realize that most LANs sit behind a device running NAT, which translates the users private IP address to a public IP address. My question is still if you are trying to connect to a private device, how does the internet know which private IP you are connecting to, since many LANs have the possibility of using that IP address? Is it that you can only connect using the public IP address?&lt;/p&gt;&#xA;" OwnerUserId="34829" LastEditorUserId="8499" LastEditDate="2017-03-01T03:20:30.623" LastActivityDate="2021-01-05T12:17:13.723" Title="How can multiple devices share an IP across the internet?" Tags="|routing|ip|nat|lan|wan|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39356" PostTypeId="2" ParentId="39355" CreationDate="2017-03-01T02:36:25.857" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it that you can only connect using the public IP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Basically, yes. Every IP address connected to the public Internet should be unique*. One of the premises of IP is that every device has a unique IP address and end-to-end connectivity. NAT breaks that in order to try to stretch IPv4 until IPv6 is ubiquitous, which will restore unique addressing and end-to-end connectivity.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;*There are also reasons to share public addresses. Anycast uses this to provide more localized services by having multiple devices with the same address in different locations. IP routing will direct packets to the nearest (according to the network protocol) device.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-01T03:16:27.933" LastActivityDate="2017-03-01T03:16:27.933" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39357" PostTypeId="2" ParentId="39355" CreationDate="2017-03-01T03:10:57.223" Score="3" Body="&lt;p&gt;In order for some device on the internet to connect inbound to a device on your private network you must use a NAT configuration.  On residential equipment like a cable modem/router this is often referred to as port-forwarding.  Think of it this way.  If you are using a single public IP address and sharing it between several private addresses, you must tell the cable modem/router that if I receive a connection on the public IP address on TCP port 80, then that should go to the private address of x.x.x.x on port 80 (or any port you want really).  This gives the modem/router enough information to successfully deliver the packets to the internal device from a device out on the internet.&lt;/p&gt;&#xA;" OwnerUserId="34831" LastActivityDate="2017-03-01T03:10:57.223" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39358" PostTypeId="1" AcceptedAnswerId="39382" CreationDate="2017-03-01T05:22:58.643" Score="7" ViewCount="625" Body="&lt;p&gt;I'm pretty new to network design. I know enough to wire small buildings and such, but I'm puzzled as to how work this one out. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A building I'm working on is an odd shape, and very large. Unfortunately, it is too large for standard cat5e. I certainly wish I could run fiber, but that is not in the budget. I have received multiple pieces of advice for running this building, one being multiple switches using STP or inter-VLAN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     Router&#xA;       |&#xA;     Switch&#xA;    /      \&#xA;Switch  -  Switch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       Router&#xA;     /   |   \&#xA;Switch Switch Switch&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My question is: Is this the best possible way to wire cat5e, and if so, how much will it impact a gigabit network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&#xA;I was asked to provide the layout of the building:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/gErkZ.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gErkZ.png&quot; alt=&quot;Building Layout&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The red points are all available to be used for networking. Unfortunately, from each individual point, the opposite end of the building is greater than 300ft away. The walls are also cinder block up to the ceiling, so running through walls is not an option. The picture shows what I had planned to wire. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all, by the way, for suggesting cat6a, I was always told that cat5e was far cheaper, but a simple google search cleared that up for me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches I am planning to use are the Summit X450E-24P. These do have SFP connections, however, they are still restricted to 1Gbs. Any suggestions on utilizing fiber to connect them? I could certainly aggregate a few lines, then trunk over to the other switches, but that could be done just as easily with cat6a.&lt;/p&gt;&#xA;" OwnerDisplayName="user34833" LastEditorDisplayName="user34833" LastEditDate="2017-03-01T19:08:59.027" LastActivityDate="2019-01-11T16:38:13.743" Title="Building too large for ethernet runs" Tags="|vlan|spanning-tree|fiber|trunk|best-practices|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39359" PostTypeId="2" ParentId="20790" CreationDate="2017-03-01T05:24:29.370" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;your do not need to connect the SFP ports, you getting the same performance with the normal port.&lt;/li&gt;&#xA;&lt;li&gt;I do not find as per your description any difference between SW1 and SW2, so there is no difference&lt;/li&gt;&#xA;&lt;li&gt;It is preferred to configure the Voice VLAN and the configuration will depend on if you will connect the users to the LAN port on the IP phone.&#xA;-for your last question, yes you can control the traffic between Wifi 1 and wifi 2 by configuring access lists on the router &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-03-01T05:24:29.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39360" PostTypeId="1" CreationDate="2017-03-01T05:57:09.513" Score="1" ViewCount="274" Body="&lt;p&gt;I have a two different CUPS installation. &#xA;One is 2.2.0 runs on macOS (10.12.2)&#xA;Another one is 1.6.3 runs on Linux minibian 4.1.7-v7+ ( Raspberry )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is thermal printer connected via network and cups sends a RAW ESC/P commands to the printer. ( It does not make any processing on it )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is Printer stops to responds ACK at some point when printing comes from Linux minibian, while from macOS it runs fine ( so far ) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I take a dump from macOS connection to print and from Linux&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Appears that macOS send a less amount of TCP frames pushing more data into the every frame ( 512bytes ) while linux is pushing just 128bytes per frame and at some point it waits too long for an ACK, and resend the packets few more times.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Printer window size is 1K&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wondering is there anyway to adjust how many bytes should be pushed into the single TCP frame? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is dump from macOS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cloudshark.org/captures/6c6ca839721a&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cloudshark.org/captures/6c6ca839721a&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and here is dump from Linux &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cloudshark.org/captures/065ac8cfb15e&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cloudshark.org/captures/065ac8cfb15e&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Added&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked linux with another printer and it works fine&#xA;cloudshark.org/captures/a700f0d7a143&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I take a look and found out that all frames was 512bytes now.&#xA;So I checked the first frames and noticed that another printer returns window size 1024 on first frame while old printer returns 128 on first frame. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looks like linux driver does not respect window size from next calls ( Like after frame 5 server still pushing data by 128bytes, while call 5 saying window is 1024 now )&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it issue with a driver? &#xA;macOS handles it properly&lt;/p&gt;&#xA;" OwnerUserId="34834" LastEditorUserId="34834" LastEditDate="2017-03-01T08:16:17.113" LastActivityDate="2017-03-01T08:16:17.113" Title="Is it possible to control data length inside tcp frame?" Tags="|tcp|linux|" AnswerCount="1" CommentCount="3" ClosedDate="2017-03-01T13:11:11.117" ContentLicense="CC BY-SA 3.0" />
  <row Id="39361" PostTypeId="1" CreationDate="2017-03-01T06:08:48.047" Score="2" ViewCount="69" Body="&lt;p&gt;I have four LAN that are separated by VLAN. Access switches are connected to a L3 Core Switch.&lt;br&gt;&#xA;I have a main Server and my ISP that are connected to the L3 Core Switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The main server needs to communicate with all the VLAN but those VLAN need not to communicate with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the procedure that I have to done for this criteria in L3 switch (commands)?&lt;/p&gt;&#xA;" OwnerUserId="34795" LastEditorUserId="16930" LastEditDate="2017-03-01T07:43:17.347" LastActivityDate="2017-03-01T12:21:14.540" Title="Related to layer 3 switch" Tags="|routing|switch|vlan|" AnswerCount="2" CommentCount="1" ClosedDate="2017-08-17T03:57:08.033" ContentLicense="CC BY-SA 3.0" />
  <row Id="39362" PostTypeId="2" ParentId="39361" CreationDate="2017-03-01T07:09:26.560" Score="1" Body="&lt;p&gt;What you describe can be achieved by a Router with Access List. Each LAN may have it's seprate vlan (as well L3 subnet). Then put Access Rules allowing flow from server to each access LAN and denying everything else.&#xA;This seems to be simplest option for your needs as I understood it&lt;/p&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-03-01T07:09:26.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39363" PostTypeId="2" ParentId="39360" CreationDate="2017-03-01T07:19:07.273" Score="1" Body="&lt;p&gt;Sure, you can affect MSS (maximum segment size) in a device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Linux it can be done either globally by sysctl&#xA;&lt;a href=&quot;https://itsthe.network/post/TCP%20MSS%20Linux%20Kernel%20Setting/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://itsthe.network/post/TCP%20MSS%20Linux%20Kernel%20Setting/&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or per rule (e.g. with iptables), details:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.frozentux.net/iptables-tutorial/chunkyhtml/x4721.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.frozentux.net/iptables-tutorial/chunkyhtml/x4721.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-03-01T07:19:07.273" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39364" PostTypeId="2" ParentId="39358" CreationDate="2017-03-01T08:16:09.637" Score="4" Body="&lt;p&gt;First, POE can be used on Ethernet cables at the full maximum cable length, which is 100m / 328ft (90m (295 ft) of solid &quot;horizontal&quot; cabling between the patch panel and the wall jack, plus 5 meters (16 ft) of stranded patch cable between each jack and the attached device).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess your issue is not POE but the Ethernet max distance. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, although  CAT5e is still doing a great job, it's time to consider CAT6A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Structured cabling, especially in a large building, is a huge investment that is supposed to last for 20 years. It is really, really not the thing you should restrict budget on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I strongly advise consulting a specialized firm to do it. Home made cabling will lead you to many issues that will cost you much more than having it done correctly from the beginning.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Back to the question itself, the solution really depends on the building topology.&lt;br&gt;&#xA;A typical way to solve great length issue is to have several distribution cabinets within various place in the building and have those cabinets linked together or to a central IT room with fibers links (which are really more future-proof than copper).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-01T08:16:09.637" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39365" PostTypeId="1" AcceptedAnswerId="39373" CreationDate="2017-03-01T08:54:39.017" Score="2" ViewCount="889" Body="&lt;p&gt;Does it make sense to have an iptable rule as below?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;-A INPUT -p esp -m state --state NEW,RELATED,ESTABLISHED -j ACCEPT&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could not find any documentation that would explain the meaning of &quot;states&quot; on an ESP flow. TCP/UDP/ICMP are explained in this link (&lt;a href=&quot;http://www.iptables.info/en/connection-state.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.iptables.info/en/connection-state.html&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since ESP does not have the concept of port or connection, is it meaningful to have a rule as above? How will conntrack determine the state of a flow here? If it actually means something, could someone kindly explain and point out the documentation?&lt;/p&gt;&#xA;" OwnerUserId="32158" LastEditorUserId="8499" LastEditDate="2018-02-15T19:38:01.530" LastActivityDate="2018-02-15T19:38:01.530" Title="IPSec: Does it make sense to use conntrack state on ESP in an iptable rule?" Tags="|ipsec|" AnswerCount="1" CommentCount="0" ClosedDate="2017-09-15T00:54:29.983" ContentLicense="CC BY-SA 3.0" />
  <row Id="39366" PostTypeId="1" CreationDate="2017-03-01T09:09:31.903" Score="1" ViewCount="259" Body="&lt;p&gt;Everybody heared about the IPV4 getting consumed due alot of people in the world need it.&#xA;But for this purpose, we have NAT, which do atchually port forwording to inside &quot;unreal&quot; ips.. (10.&lt;em&gt;\196.168.&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this article:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.ccnahub.com/ip-fundamentals/understanding-classless-subnet-mask/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.ccnahub.com/ip-fundamentals/understanding-classless-subnet-mask/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there is the next paragraph:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Because Class A, B, and C default Masks (255.0.0.0, 255.255.0.0,&#xA;  255.255.255.0) respectively were not an efficient approach to identify Network bits. So, in the the beginning of the 90’s, the default&#xA;  Netmask approach was not efficient due to releasing BIG Blocks of IP&#xA;  Addresses to the Public. Using just default Masks would have made the&#xA;  IP Space consumed long time ago. Therefore, Subnet Masks were evolved&#xA;  to distribute the IP space more efficiently, hence, smaller Blocks can&#xA;  be released to save the rest of the IP Space, which made it possible&#xA;  to have the Internet available to everyone back then.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Which actually saies that subnet is what anwer the consuming IPV4 problem.&#xA;Can you order my mind please?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With subnet I can devide inside network. but why it have any relation for saving ips?&lt;/p&gt;&#xA;" OwnerUserId="34838" LastActivityDate="2017-03-02T11:52:21.887" Title="Why there is any relationship between Subnet and IPV4 consumed?" Tags="|internet|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39368" PostTypeId="2" ParentId="39366" CreationDate="2017-03-01T10:03:59.720" Score="3" Body="&lt;p&gt;Before 1993 the internet used &lt;em&gt;classful&lt;/em&gt; networks, it meant that the full IPv4 scope was divide like this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Class A&lt;/strong&gt;: from &lt;code&gt;1.0.0.0&lt;/code&gt; to &lt;code&gt;127.255.255.255&lt;/code&gt; (netmask &lt;em&gt;255.0.0.0&lt;/em&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Class B&lt;/strong&gt;: from &lt;code&gt;128.0.0.0&lt;/code&gt; to &lt;code&gt;191.255.255.255&lt;/code&gt; (netmask &lt;em&gt;255.255.0.0&lt;/em&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Class C&lt;/strong&gt;: from &lt;code&gt;192.0.0.0&lt;/code&gt; to &lt;code&gt;223.255.255.255&lt;/code&gt; (netmask &lt;em&gt;255.255.255.0&lt;/em&gt;)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For example, in 1988 &lt;strong&gt;IBM&lt;/strong&gt; asked for a range of IP addresses and the assigned range was &lt;code&gt;9.0.0.0&lt;/code&gt;. It is a Class A range, so it went from &lt;code&gt;9.0.0.0&lt;/code&gt; to &lt;code&gt;9.255.255.255&lt;/code&gt; (a range of &lt;em&gt;16777214&lt;/em&gt; hosts). (source: &lt;a href=&quot;https://www.wikiwand.com/en/List_of_assigned_/8_IPv4_address_blocks&quot; rel=&quot;nofollow noreferrer&quot;&gt;wikipedia&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's very likely that IBM never uses &lt;em&gt;16 millions&lt;/em&gt; of public addresses, so it becomes a waste of public addressses that can be used by other companies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, in 1993 the Internet Engineering Task Force published &lt;em&gt;&lt;a href=&quot;https://tools.ietf.org/pdf/rfc1518.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1518&lt;/a&gt;&lt;/em&gt; and &lt;em&gt;&lt;a href=&quot;https://tools.ietf.org/pdf/rfc1519.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1519&lt;/a&gt;&lt;/em&gt;. These RFCs defined a new concept called &lt;strong&gt;Classless Inter Domain Routing&lt;/strong&gt;. The most important thing of those RFCs is that obsoletes the &lt;strong&gt;Classful Network&lt;/strong&gt; where ranges where associated with classes with fixed netmasks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, from 1993 a range as &lt;code&gt;9.0.0.0 Class A&lt;/code&gt; becomes &lt;code&gt;9.0.0.0/8&lt;/code&gt; and it can be segmented in multiple networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example in 2 networks of more than 8 million hosts each one:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;9.0.0.0/&lt;strong&gt;9&lt;/strong&gt; (from 9.0.0.0 to 9.127.255.255) -Total hosts 8388608&lt;/li&gt;&#xA;&lt;li&gt;9.128.0.0/&lt;strong&gt;9&lt;/strong&gt; (from 9.128.0.0 to 9.255.255.255) - Total hosts 8388608&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;or a mix of different masks, for example::&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;9.0.0.0/&lt;strong&gt;24&lt;/strong&gt; (from 9.0.0.0 to 9.0.0.255) - total hosts 256&lt;/li&gt;&#xA;&lt;li&gt;9.1.0.0/&lt;strong&gt;24&lt;/strong&gt; (from 9.1.0.0 to 9.1.0.255) - total hosts 256&lt;/li&gt;&#xA;&lt;li&gt;9.2.0.0/&lt;strong&gt;30&lt;/strong&gt; (from 9.2.0.0 to 9.2.0.3) - total hosts    4&lt;/li&gt;&#xA;&lt;li&gt;9.2.0.4/&lt;strong&gt;30&lt;/strong&gt; (from 9.2.0.4 to 9.2.0.7) -total hosts 4&lt;/li&gt;&#xA;&lt;li&gt;9.2.0.8/&lt;strong&gt;29&lt;/strong&gt; (from 9.2.0.8 to 9.2.0.15) - total hosts 8&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This system allows to use the ranges in a more efficient way, and be as flexible as possible to avoid the waste of addresses.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2017-03-01T10:09:34.483" LastActivityDate="2017-03-01T10:09:34.483" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39369" PostTypeId="2" ParentId="39366" CreationDate="2017-03-01T10:04:15.453" Score="2" Body="&lt;p&gt;Classful addressing was a fixed scheme in which a network was strictly defined and with a limited number of networks of fixed size.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;there was 128 class A networks, 16,384 class B networks, and  2,097,152 class C networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2,097,152 seems a lot, but those are small networks of 253 hosts each, not suitable for many organizations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even the class B networks with 65,533 hosts were not big enough for some companies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the reverse, a class A network with   16,777,213 usable address is too big for most companies, and some of those network were given to companies that only ever used a small fraction of it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you had a very limited number of usable networks, only 3 possible size which most of the time didn't fit the actual need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To solve those issue and allow allocation of networks tailored to the actual needs, &lt;code&gt;Classless Inter Domain Rouging (CIDR)&lt;/code&gt; was introduced.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically CIDR allow to create a network of custom size. Networks still have to respect boundaries, since it is based on binary, so in practice you have 32 different sizes, from /1 (/0 is not relevant, 0.0.0.0/0 is the whole Internet) to /32 (a single host).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Subnetting&lt;/code&gt; is a different process that consist in cutting a given network in smaller parts to use in different place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, as a Local Internet Registry, my company was assigned a /21 network, and we can do what you want with it:&lt;br&gt;&#xA;* We use a subnet, a /24 for out internal use on a site&lt;br&gt;&#xA;* we use another /24 subnet on another site&lt;br&gt;&#xA;* we assigned another /24 network to a customer&lt;br&gt;&#xA;* we assigned a /27 to another customer&lt;br&gt;&#xA;* etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So this somewhat alleviate the waste of address space by giving a network of appropriate size.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-01T10:04:15.453" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39370" PostTypeId="2" ParentId="39366" CreationDate="2017-03-01T10:25:24.013" Score="0" Body="&lt;p&gt;It has nothing to do with NAT. NAT helps multiple devices with local IPs share the same valid IP to get access to internet. by doing so, limited number of valid IPv4 addresses can support many more people.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;subnet is a whole different story. suppose a company needs 32768 IP addresses. A class 'C' subnet holds only 256 IP address(which is not enough). A class 'B' subnet on the other hand holds 65536. if we assign this company a class 'B' subnet we would waste 65536-32768=32768 IP addresses. &#xA;by using CIDR(Classless Inter-Domain Routing) we can define a subnet like this: 192.168.0.0-192.168.15.256 and the subnet mask of this network is 255.255.128.0 .&#xA;and therefor we would not waste any IP addresses.&lt;/p&gt;&#xA;" OwnerUserId="13376" LastActivityDate="2017-03-01T10:25:24.013" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39373" PostTypeId="2" ParentId="39365" CreationDate="2017-03-01T12:03:05.903" Score="1" Body="&lt;p&gt;A lot like it would for UDP, basically: it checks if a flow has been seen previously. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In passing, I don't think you need to have RELATED in there (that's more for things like FTP, where you have more than one flow involved in a connection). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general, you would have ESP in tunnel mode, where the only states are pretty much 'there', or 'not there'. &#xA;NEW would simply mean (I think) you allow remote hosts to initiate the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would therefore need the rule if remote hosts did need to connect, and the rule could be made to justify its presence by limiting ESP flows to known hosts only (i.e. use a &lt;code&gt;-s MYNETWORK&lt;/code&gt;, or an ipset, to limit who can speak ESP to whom). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You possibly don't &lt;em&gt;need&lt;/em&gt; stateful, though.&lt;/p&gt;&#xA;" OwnerUserId="34804" LastActivityDate="2017-03-01T12:03:05.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39375" PostTypeId="2" ParentId="25659" CreationDate="2017-03-01T12:16:33.910" Score="1" Body="&lt;p&gt;Adding &lt;em&gt;something&lt;/em&gt; that can do a first layer of filtering is not without its advantages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether you need a router or a dedicated firewall is another matter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either solution (router or firewall) may provide other functionality, not necessarily 'purely' security related, that still makes your service more resilient (a means of doing load-balancing, packet inspection, null-routing, etc). &#xA;All this can be done in other ways, but it can be useful to have a box that makes this easier. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strike&gt;One thing I haven't seen mentioned so far is that&lt;/strike&gt; Such a system isn't just for ingress filtering, but also egress: having a box dedicated to ensuring what leaves your network is at least vaguely legitimate is something you probably want to consider at some stage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, if Server1 is compromised, you may not be able to find out what left the network, or to where. &#xA;Since Server1 exposes software to the world at large, that's definitely a consideration, I think.&#xA;A router removes that issue to a point (until, of course, the router/firewall is compromised.... turtles all the way). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: should really read all other comments more thoroughly before making rash statements. &lt;/p&gt;&#xA;" OwnerUserId="34804" LastActivityDate="2017-03-01T12:16:33.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39376" PostTypeId="2" ParentId="39361" CreationDate="2017-03-01T12:21:14.540" Score="1" Body="&lt;p&gt;Private VLANs could help in such scenario . please make use of this link &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swpvlan.html#wp1044399&quot; rel=&quot;nofollow noreferrer&quot;&gt;this link&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2017-03-01T12:21:14.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39377" PostTypeId="1" AcceptedAnswerId="39492" CreationDate="2017-03-01T12:25:29.620" Score="3" ViewCount="5288" Body="&lt;p&gt;When looking at the output of &lt;code&gt;show interfaces transceiver&lt;/code&gt; on a Cat 4500X you notice that there is a Tx and a Rx power measurement. My questions about this output are: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Why is each transceiver transmitting at a different power level? &lt;/li&gt;&#xA;&lt;li&gt;How is the transmission power chosen? I always thought there was some standard defining the transmission power.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When subtracting the RX on one end from the TX of the transceiver on the other end, do I get the actual loss on the fiber? Is this an accurate measurement?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show interfaces &#xA;&#xA;If device is externally calibrated, only calibrated values are printed.&#xA;++ : high alarm, +  : high warning, -  : low warning, -- : low alarm.&#xA;NA or N/A: not applicable, Tx: transmit, Rx: receive.&#xA;mA: milliamperes, dBm: decibels (milliwatts).&#xA;&#xA;                                 Optical   Optical&#xA;           Temperature  Voltage  Tx Power  Rx Power&#xA;Port       (Celsius)    (Volts)  (dBm)     (dBm)&#xA;---------  -----------  -------  --------  --------&#xA;Te1/1/3      27.9       3.19      -2.3      -4.7&#xA;Te1/1/4      30.2       3.32      -1.9      -4.3&#xA;Te2/1/3      32.5       3.30      -1.0      -4.1      &#xA;Te2/1/4      32.1       3.24      -2.4      -5.6&#xA;Te2/1/17     33.4       3.32      -5.4      -8.5&#xA;Te2/1/18     33.3       3.32      -2.4      -2.4&#xA;Te2/1/19     32.4       3.34      -2.1      -1.6&#xA;Te2/1/20     33.2       3.31      -2.2      -3.3&#xA;Te2/1/21     31.5       3.32      -2.2      -4.6&#xA;Te2/1/22     34.2       3.32      -1.9     -11.0&#xA;Te2/1/23     33.3       3.31      -1.9      -2.0&#xA;Te2/1/24     30.5       3.31      -2.3      -2.5&#xA;Te2/1/25     27.3       3.32      -2.4      -6.6&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="29627" LastEditorUserId="8499" LastEditDate="2018-03-20T23:31:33.083" LastActivityDate="2018-03-20T23:31:33.083" Title="sh int transceiver Explanations" Tags="|cisco-ios|fiber|layer1|transceiver|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39378" PostTypeId="1" AcceptedAnswerId="39381" CreationDate="2017-03-01T12:26:24.963" Score="2" ViewCount="1942" Body="&lt;p&gt;I have a Cisco router with two ISPs connected to it, and I wanted to configure a failover between them using an IP SLA, track for the IP SLA and two static routes (when the first route fails, the second becomes the primary). However, it turned out that the IOS on the router does not support IP SLAs, because it does not have the appropriate license (which costs $1000, and buying it is not an option). I tried to use the predecessor to IP SLA, the &quot;rtr&quot; command, but it's not supported either. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case, is there something else I can use to achieve failover functionality?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance.&lt;/p&gt;&#xA;" OwnerUserId="21387" LastEditorUserId="8499" LastEditDate="2017-03-01T13:44:48.043" LastActivityDate="2017-03-01T13:44:48.043" Title="IP SLA command not available, alternatives?" Tags="|cisco|cisco-ios|failover|" AnswerCount="1" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39380" PostTypeId="2" ParentId="39358" CreationDate="2017-03-01T13:16:28.887" Score="0" Body="&lt;p&gt;PoE, like ethernet, is limited 100 meters: 90 meters for solid-core horizontal cable, and a total of 10 meters of stranded patch cables. If the building is too large for PoE, it is too large for ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The proper solution is to build another TR (Telecommunications Room). You can use a fiber backbone cable to connect your two TRs, and run horizontal cableing from both, covering the building. You can add multiple TRs, if necessary.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-01T13:16:28.887" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39381" PostTypeId="2" ParentId="39378" CreationDate="2017-03-01T13:43:22.760" Score="2" Body="&lt;p&gt;The simplest way to achieve a failover is by using floating static routes. You are going to need a default route (&lt;code&gt;0.0.0.0/0&lt;/code&gt;) to your ISPs. Cisco has AD (Administrative Distance) that basically tells you which of identical routes is preferred. Static routes normally have an AD of &lt;code&gt;1&lt;/code&gt; (lower is better, like golf), but you can give a static route a specific AD. When an interface goes down, the route is withdrawn from the routing table, and an identical route with a higher AD will then take over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example (where &lt;code&gt;172.1.2.3&lt;/code&gt; is ISP 1 and &lt;code&gt;10.11.12.13&lt;/code&gt; is ISP 2):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 172.1.2.3&#xA;ip route 0.0.0.0 0.0.0.0 10.11.12.13 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both commands create an identical static, default route, but the first command leaves the AD as &lt;code&gt;1&lt;/code&gt; to the primary ISP, while the second command sets the AD to &lt;code&gt;10&lt;/code&gt; to the secondary ISP. If the interface to the primary ISP fails, then the default route automatically fails over to the secondary ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This works if the interface on the router loses connection to the ISP (&lt;code&gt;Down/Down&lt;/code&gt; or &lt;code&gt;Up/Down&lt;/code&gt;). It may be possible, depending on the physical connection to the ISP, that your interface still shows &lt;code&gt;Up/Up&lt;/code&gt;, but for some reason the ISP doesn't respond, and this this configuration will not work correctly. That is where IP SLA would work.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-01T13:43:22.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39382" PostTypeId="2" ParentId="39358" CreationDate="2017-03-01T14:12:56.520" Score="6" Body="&lt;p&gt;Fiber is not so expensive unless you are getting fleeced. Indeed, it can be cheaper than copper cabling. It's also the right solution to long runs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given the installation costs, it's likewise foolish to install 5e rather than 6A at this date and into the future for copper. The cost of the cable is a tiny fraction of the cost to get it installed correctly. With 6A your inter-switch links can run at 10Gb, even if your drops are only running at 1Gb. But your inter-switch links should really be fiber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are stuck with a penny-wise, pound-foolish corporate mindset, drop in a switch every 100 meters or less. Throughput from [everything on a switch] is going to be limited by what the switch uplink speed is, to the extent that more than one thing on a switch wants to pass data up or down the uplink.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Commenting on topology without some sort of sketch of the building and knowledge of what other PWPF limitations on common sense are in effect is shooting in the dark.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Post diagram and switch model:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it more or less than 100 meters of cable between each of the 3 switches? Is it more or less than 100 meters of cable from each device to the switch it connects to? &quot;The far end of the building&quot; is not a factor here, unless there's a cable you are trying to run from this switch to that end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If more than 100 meters, you need fiber to make the link. If less, copper is an option, but fiber is a superior option. If you limit yourself to that particular switch model, 4 fibers (2 links, aggregated) from each remote switch to the switch at the router is all you're going to be able to manage. Use 12 fiber cable anyway, it's not much more expensive if you shop well. A different switch at the router might offer you 8 SFPs and aggregating 4 links to the other switches, but changing all three to a switch model that supports SFP+ would be 2.5 times better than that...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, if you don't actually have things like local file servers and this is all connected to a 50, 100 or 500 Mb (or even 1Gb) internet uplink, and nearly all network traffic is from or to the internet, not between local devices (or not with large data between local devices) this may not be a bottleneck in practice, as the internet connection will be the limiting factor. When looking to optimize a network I tend to try and eliminate bottlenecks on the assumption that if not now, at some point someone might hang a fileserver  or database server off the network and it would be nice if the network worked well with that, but with a low-budget approach that may not be a current concern for your application - in which case a single gigabit link would be OK, though a dual aggregated link will offer minor protection from a cable disconnect. Connecting the distal switches with a normally STP blocked path will again offer minimal protection against one of them becoming disconnected, though in this layout a cable cut would be likely to take out both such links at once so the benefit is probably minor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If cost is such a concern and your blue lines are fairly accurate, smaller switches might save quite a bit of money.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Going a bit further into why we push fiber: at 10 Gb, fiber transceivers are much more power-efficient than copper transceivers. Fiber is effectively immune to electrical noise, while copper is subject to it; the design of copper systems is intended to reduce such noise pickup, but that can be thrown off by pulling a cable too hard, bending it too tightly, or many other fiddly installation details. Fiber, particularly single-mode fiber, is effectively unlimited (itself) in terms of bandwidth; upgrades merely involve plugging in the newer, faster transceiver on each end, rather than replacing fibers in walls and ceilings. And, as mentioned, fiber is the only way to get past the 100m limit at full speed and without intermediate devices. But in your case, you seem to have missed that the &quot;100m limit&quot; applies to &quot;cables between devices&quot; not &quot;overall size of the building&quot; - when you get to a switch and go out another port, you start counting again at 0m from the switch port.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2017-03-01T19:55:35.060" LastActivityDate="2017-03-01T19:55:35.060" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39383" PostTypeId="1" AcceptedAnswerId="39405" CreationDate="2017-03-01T14:32:45.643" Score="5" ViewCount="4041" Body="&lt;p&gt;Lets say site.example.com runs only with AAAA records, and I wish to access that site from IPv4-only network, and I don't want to do tunneling neither other protocols that masquerades IPv4 over IPv6 addresses...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that possible? I'm struggling because I want to host a website and my provider is giving me only IPv6 public/global addresses, and not even one public IPv4 address.&lt;/p&gt;&#xA;" OwnerUserId="34828" LastEditorUserId="8499" LastEditDate="2017-03-01T20:57:58.500" LastActivityDate="2017-07-21T16:47:30.803" Title="Host IPv6-only website and allow access to IPv4-only clients" Tags="|ipv4|ipv6|dns|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39384" PostTypeId="2" ParentId="39383" CreationDate="2017-03-01T14:40:27.923" Score="1" Body="&lt;p&gt;IPv4 and IPv6 are two completely separate protocols, and they do not communicate with each other. If you need to connect from one protocol to another, you need some mechanism like what you reject to do a conversion for you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most ISPs now support IPv6, and it is a simple matter for most people to get IPv6 directly from their ISP, or via 6rd from one of the free providers of this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your server only has IPv6, then there really isn't anything you can do for people that refuse to run any form of IPv6. The RIRs have run out of IPv4 addresses to assign to the ISPs, and it is going to be more and more difficult to get IPv4 addresses in the future. It is past time for people to at least use both protocols and prepare for the IPv6 future.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-01T14:40:27.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39385" PostTypeId="2" ParentId="38092" CreationDate="2017-03-01T16:41:57.413" Score="1" Body="&lt;p&gt;A google found this &quot;Supported MIBs&quot; in Vyatta Remote Management Reference Guide&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.brocade.com/content/html/en/configuration-guide/vrouter5600_3.5R1_RemoteManagement/GUID-2789A59B-7B4B-47E5-98F1-EECE7E8C6005.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.brocade.com/content/html/en/configuration-guide/vrouter5600_3.5R1_RemoteManagement/GUID-2789A59B-7B4B-47E5-98F1-EECE7E8C6005.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34850" LastActivityDate="2017-03-01T16:41:57.413" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39387" PostTypeId="1" CreationDate="2017-03-01T17:31:30.237" Score="7" ViewCount="14260" Body="&lt;p&gt;I know its a dummy question, but I couldn't find any information about it around the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know about modems and routers and how they work, but I don't get how the ISP connects me to the internet? I mean...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do ISP's communicate with eachother and runs the entire system?&lt;/p&gt;&#xA;" OwnerUserId="34853" LastEditorUserId="65771" LastEditDate="2020-03-14T16:34:31.517" LastActivityDate="2023-02-02T02:32:59.053" Title="How does the ISP connect me to the Internet?" Tags="|internet|" AnswerCount="3" CommentCount="3" ClosedDate="2020-02-06T22:04:56.767" ContentLicense="CC BY-SA 4.0" />
  <row Id="39388" PostTypeId="2" ParentId="39387" CreationDate="2017-03-01T17:36:14.417" Score="2" Body="&lt;p&gt;You really don't seem to understand what the Internet is. It is simply a bunch of ISPs all connected to each other. The ISPs comprising the Internet have agreed to certain protocols. Each ISP is connected to at least one, and probably multiple, other ISP(s).&lt;/p&gt;&#xA;&lt;p&gt;When you send or receive traffic on the Internet, it probably crosses multiple ISPs to reach its destination. It may be that the source or destination of your traffic is on the same ISP you are, but that may be unlikely.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2023-02-02T02:32:59.053" LastActivityDate="2023-02-02T02:32:59.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39389" PostTypeId="1" CreationDate="2017-03-01T17:55:26.010" Score="6" ViewCount="805" Body="&lt;p&gt;We are moving to TIA-606-B for labeling. I have read most of the TIA-606-B standard. Some parts I have only skimmed, while others I have studied in depth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do not understand the rationale behind the identifiers for Cabling Subsystem 1 links (formerly known as horizontal links).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The standard has this to say (TIA-606-B, section 5.1.7.1):&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;For TIA-606-A compatible administration systems,&#xA;the Cabling Subsystem 1 link identifier shall&#xA;have a format of either:&#xA;&#xA;    f1s1.x1y1-r1:P1 / f2s2.x2y2-r2:P2 (Cabling Subsystem 1 link&#xA;    terminated on patch panels on both ends)  &#xA;&#xA;or  &#xA;&#xA;    fs-an (Cabling Subsystem 1 terminated on a work area outlet)  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;f1s1.x1y1-r1:P1 / f2s2.x2y2-r2:P2&lt;/code&gt; format makes sense to me. You have both a near-end and far-end identifier. You have floor, space, and XY grid coordinates. You know where the cable should be connected both ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where it gets weird to me is the &lt;code&gt;fs-an&lt;/code&gt; format for cables terminated on a work area outlet. Because it is terminated on an outlet, I no longer care about having both near-end and far-end identifiers? How am I supposed to locate the other end of the cable in a warehouse the size of two football fields?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I misinterpreting the TIA-606-B standard as it applies to Cabling Subsystem 1 links? What is the proper format for the identifier?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What follows is not part of the question - it is a definition of the &lt;code&gt;fs-an&lt;/code&gt; format:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;fs-an is defined as follows:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;fs= the TS identifier for the location of the patch panel or termination block on which the cable terminates. This portion of the identifier is optional for a class 1 administration system limited to a single equipment room or an administration system limited to a single computer room.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;a= one or two alpha characters uniquely identifying a single patch panel, a group of patch panels with sequentially numbered ports, a termination block, or a group of termination blocks, serving as part of the horizontal cross-connect.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;n= two to four numeric characters designating the port on a patch panel, or the section of a termination block on which a Cabling Subsystem 1 link is terminated in the TS. Enough numeric characters must be used for this portion of the identifier to accommodate all Cabling Subsystem 1 links in a distributor.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="34852" LastEditorUserId="8499" LastEditDate="2017-03-02T00:03:36.600" LastActivityDate="2019-10-07T08:13:02.263" Title="How to properly name TIA-606-B Cabling Subsystem 1 far end identifier for work area equipment outlets?" Tags="|cabling|layer1|standardisation|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39391" PostTypeId="1" AcceptedAnswerId="39438" CreationDate="2017-03-01T18:22:42.360" Score="4" ViewCount="10536" Body="&lt;p&gt;Let's say I have the the following configuration on a Cisco router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ISP 1&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connected and configured into GigabitEthernet8.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 1 192.168.0.0/24, NAT configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gateway is 192.168.0.1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ISP 2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connected to interface FastEthernet0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently not configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP gives one dynamic IP so &quot;ip address dhcp&quot; should be in place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT must be configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What would you do to configure ISP 2 gateway to be 192.168.0.2?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If ISP 1 fails and gateway is not reachable, it must not failover to ISP 2 gateway, also load-balancing must not be active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea is to manually set the ISP 2 gateway on specific computers manually when needed, or through a DHCP server configured inside the subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current configuration, removed and censored unnecessary stuff.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet1&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet2&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet3&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet4&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet5&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet6&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet7&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet8&#xA; ip address X.X.X.42 255.255.255.248 (First ISP 1 usable IP for NAT)&#xA; no ip redirects&#xA; no ip unreachables&#xA; no ip proxy-arp&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; duplex full&#xA; speed auto&#xA; no keepalive&#xA; no cdp enable&#xA;!&#xA;interface Vlan1&#xA; ip address 192.168.0.1 255.255.255.0&#xA; no ip proxy-arp&#xA; ip nat inside&#xA; ip inspect Firewall in&#xA; ip virtual-reassembly in&#xA;!&#xA;!&#xA;ip nat inside source list NAT interface GigabitEthernet8 overload&#xA;ip nat inside source static 192.168.0.143 X.X.X.43 extendable (A few NAT1:1)&#xA;ip nat inside source static 192.168.0.144 X.X.X.44 extendable&#xA;ip nat inside source static 192.168.0.145 X.X.X.45 extendable&#xA;ip nat inside source static 192.168.0.146 X.X.X.46 extendable&#xA;ip route 0.0.0.0 0.0.0.0 190.196.17.41 (ISP 1 gateway)&#xA;!&#xA;ip access-list standard ADMIN&#xA; permit 200.75.15.0 0.0.0.63&#xA; permit 200.75.19.192 0.0.0.63&#xA;!&#xA;ip access-list extended FILTERS&#xA; permit icmp any any&#xA; permit ip host 192.168.0.143 host X.X.X.43 (Filters to allow NAT1:1 all traffic)&#xA; permit ip host 192.168.0.144 host X.X.X.44&#xA; permit ip host 192.168.0.145 host X.X.X.45&#xA; permit ip host 192.168.0.146 host X.X.X.46&#xA;ip access-list extended NAT&#xA; permit ip 192.168.0.0 0.0.0.255 any&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Ideas for the solution,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We know that ISP 2 is at FastEthernet0 and has a dynamic IP, so also since it's only one IP we need NAT outside when more than one client uses the ISP 2 gateway, supposedly to be configured at 192.168.0.2.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0&#xA; ip address dhcp&#xA; ip nat outside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And after that I'm not sure what to do, add an outbound route for Internet access to the gateway for ISP 2? Set the ISP 2 gateway to be 192.168.0.2? But how?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found this on a forum, please give it a read:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.dslreports.com/forum/r20113274-&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.dslreports.com/forum/r20113274-&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be aware that the ISP 2 device is actually a generic Arris router that I have configured to be &quot;bridged&quot;, I can set it back to routed and configure it according to that forum post if the setup can't done with the ISP 2 router working in bridge mode.&lt;/p&gt;&#xA;" OwnerDisplayName="user34559" LastEditorDisplayName="user34559" LastEditDate="2017-03-02T20:59:52.057" LastActivityDate="2019-08-24T15:28:12.367" Title="Can I set two gateways or more on the same subnet with NAT on a Cisco router?" Tags="|cisco|nat|subnet|isp|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39392" PostTypeId="2" ParentId="39389" CreationDate="2017-03-01T18:39:36.017" Score="2" Body="&lt;p&gt;What you are reading about the &lt;code&gt;fs-an&lt;/code&gt; label is for the label on the WAO. That points you to the termination in the TS. Remember that your terminations in a TS are fixed, while the work area outlet, itself, may move, especially if it terminates in modular furniture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is very common to need to know from the WAO where to go to complete a connection in a TS, but it is much less common to need to from a TS where a WAO is. For example, you connect a device at a work area, then you need to make the connection in the TS, but you usually don't make a connection in the TS, then need to find the WAO to connect a device. The formats of both guidelines are aimed at letting you identify where to make connections. In any case, you should have building drawings showing the WAOs, preferably approved by an RCDD. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;TIA-606-B is really a set of guidelines. You are free to add or use whatever makes sense to you, but whatever you choose must be applied consistently and uniformly to every area, and it needs to be communicated to any vendors involved.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It establishes guidelines for owners, end users, manufacturers,&#xA;  consultants, contractors, designers, installers, and facilities&#xA;  administrators involved in the administration of the&#xA;  telecommunications infrastructure.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-01T18:39:36.017" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39393" PostTypeId="2" ParentId="10065" CreationDate="2017-03-01T19:07:11.127" Score="0" Body="&lt;p&gt;There is no specific standard for broadcasting.  They use regular IP (Internet Protocol) to send and receive to/from specifically addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have worked on several brands of automation systems, most of which are server-based.  They use regular networking equipment like your office PC network.  I have even seen both run on the same system, but that doesn't work at large stations because a single user might cause interruptions of broadcast audio.  It is best to keep them separate.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only place where it might make sense to have them connected is in &quot;traffic&quot; - making sure commercials get played per contract, and logging to verify same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way these broadcast audio systems work is very much like a mail server or Netflix.  The particular studio will &quot;ask&quot; the server for a specific file (a song or promo, etc.) then will stream it through the control board to an output leading to the transmitter.  Playlists are usually set up from one PC in the PD (program director)'s office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You asked about DHCP.  It is simply a way to automatically assign addresses to the control boards in the studios, and the PD's PC.  The specific addresses themselves are not important, much like your address on your ISP when you reach out to the mail server to retrieve your email or to Netflix to watch a video.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only address that is important is the server itself.  Just like your email server - pop.xyzcorp.com and smtp.xyzcorp.com, or www.netflix.com.  Those addresses are generally coded into each studio just like your email program  'remembers' the addresses to the server used for sending and receiving email.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most automation server systems provide DHCP services (whether in the same box or another on the network), so you do not need to enter static IP addresses for each client studio.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your question is how the signals don't get tangled up and sent to the wrong place, your answer is probably found in the switches that interconnect studios with the servers.  They examine the destination address and send the packets out the correct port for the studio with that particular address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, in the industry the whole thing is colloquially called a router, but that is a holdover from the old television days where the router was a physical unit that sent video signals from one place to another.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They were crosspoint switchers, but were called routers simply because when you instructed them to take video from input x and send it to output y they would take care of routing the signal as instructed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network switches are smart enough to send the server files to the correct studio, much like your ISP sends your email just to you and not to all your neighbors.  That is the nature of IP (Internet Protocol).&lt;/p&gt;&#xA;" OwnerUserId="34855" LastEditorUserId="34855" LastEditDate="2017-03-01T19:15:16.657" LastActivityDate="2017-03-01T19:15:16.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39395" PostTypeId="2" ParentId="39391" CreationDate="2017-03-01T19:31:00.700" Score="-2" Body="&lt;p&gt;Anything is possible; especially with Cisco routers.  But to do what you are suggesting would most likely require contracting a specialist to set up and maintain a system like that.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your requirement that it not perform a failover is a particularly unique requirement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As part of your decision-making, consider the cost of having someone on-call at all times to sort out  any errors that arise due to your configuration.&lt;/p&gt;&#xA;" OwnerUserId="34855" LastEditorUserId="34855" LastEditDate="2017-03-01T20:19:09.777" LastActivityDate="2017-03-01T20:19:09.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39396" PostTypeId="2" ParentId="39387" CreationDate="2017-03-01T19:37:35.437" Score="3" Body="&lt;p&gt;It connects you to the Internet very much the same way your home network connects your PC to the router, using IP (Internet Protocol).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP doesn't have any magic equipment; just more of it than you are likely to have at home.  i.e., at home you may have just a few computers, but the ISP services hundreds or thousands of users.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are free to buy your own routers and such, but your ISP will want some way to charge you for the service.  For a modem it might be a password.  For a cable network the ISP will likely lease you a combination modem/router as part of the service.  Their systems recognize the address of your device so they know it is you.&lt;/p&gt;&#xA;" OwnerUserId="34855" LastActivityDate="2017-03-01T19:37:35.437" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39397" PostTypeId="2" ParentId="39292" CreationDate="2017-03-01T19:54:49.717" Score="2" Body="&lt;p&gt;The only good reason for port forwarding is to allow incoming connections to reach a server which is behind the NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, if you are running a normal web server, you will want to use port forwarding (programmed in the router) to allow port 80 to be forwarded into your web server's IP address.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that this can open security holes; if your web server gets hacked it will have access to the rest of your network unless you set up a DMZ by using two routers - one with port forwarding into your web server, then another to hide the rest of your network.&lt;/p&gt;&#xA;" OwnerUserId="34855" LastActivityDate="2017-03-01T19:54:49.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39401" PostTypeId="1" AcceptedAnswerId="39404" CreationDate="2017-03-02T02:05:20.833" Score="2" ViewCount="1313" Body="&lt;p&gt;My company has had dual 100 Mbps Internet connections running BGP on two Cisco 2921 routers for several years. It works as expected... when there are issues on one line, BGP cuts over properly. If we want to do maintenance on one, we manually flip BGP over without missing a beat, and all is well. We are only getting default routes from our providers, so memory is not a concern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are about to upgrade one of the connections to 1 Gbps, but the 2921 routers cannot pass traffic at that speed. I am considering getting a Cisco 3560CX switch with an IP Services license which would work fine. However, I'm very curious to try a Ubiquiti EdgeRouter Pro (ERPro‑8) instead. I'm just so shocked as to how cheap it is, and it makes me wonder if something is wrong. It would be a straight-up replacement for one of the 2921s, so I wouldn't be doing any firewall, NAT, or any other fancy functionality. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can you think of any reason why this sub-$400 router would not work as well for basic BGP routing as a Cisco 3560-CX IP Services (about $2,500) or a Cisco 4431 with the high-speed license that would cost about $10,000? Is it unreliable? Does it only last for a year before exploding? How can this be?!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="34860" LastActivityDate="2017-03-02T07:18:11.993" Title="Ubiquiti EdgeRouter Pro ERPro‑8 as BGP 1 Gbps endpoint" Tags="|router|bgp|ubiquiti|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39404" PostTypeId="2" ParentId="39401" CreationDate="2017-03-02T07:18:11.993" Score="1" Body="&lt;p&gt;This router run &lt;code&gt;EdgeOs&lt;/code&gt; which is a fork of the community (open source) &lt;code&gt;Vyatta&lt;/code&gt; software.  Vyatta was bought by Brocade and the community edition discontinued. It was then forked to EdgeOs and &lt;code&gt;VyOs&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not an Ubiquity / EdgeOs user but I do use VyOs intensively, including for BGP (full table, multiple ISP, 10Gbs links), for years in production environments and it run perfectly stable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As commented by &lt;a href=&quot;https://networkengineering.stackexchange.com/users/2142/ron-trunk&quot;&gt;@Ron Trunk&lt;/a&gt; you have to check if the hardware and throughput  specifications meet your needs.&#xA;From &lt;a href=&quot;https://dl.ubnt.com/datasheets/edgemax/EdgeRouter_DS.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this datasheet&lt;/a&gt; we get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Layer 3 Forwarding Performance &#xA;Packet Size: 64 Bytes&#xA;Packet Size: 512 Bytes or Larger&#xA;2,400,000 pps&#xA;8 Gbps (Line Rate)&#xA;&#xA;Processor     Dual-Core 1 GHz, MIPS64 with Hardware Acceleration for Packet Processing&#xA;System Memory    2 GB DDR3 RAM&#xA;On-Board Flash Storage    4 GB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2017-03-02T07:18:11.993" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39405" PostTypeId="2" ParentId="39383" CreationDate="2017-03-02T07:19:13.753" Score="3" Body="&lt;p&gt;IPv4 and IPv6 are separate protocols. So if you want IPv4 only clients to be able to access your IPv6 only server you will need some kind of gateway/proxy service that can provide an IPv4 address to clients and pass the traffic to you over IPv6.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="8499" LastEditDate="2017-07-21T16:47:30.803" LastActivityDate="2017-07-21T16:47:30.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39407" PostTypeId="1" AcceptedAnswerId="39411" CreationDate="2017-03-02T10:51:44.560" Score="4" ViewCount="8085" Body="&lt;p&gt;Once an interviewer asked me, &quot;&lt;em&gt;Can we use OSPF without area 0?&lt;/em&gt;&quot; I was not able to answer at that time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later on, I searched, but I did not not find a satisfactory answer for this question. So, can we really use OSPF without Area 0?&lt;/p&gt;&#xA;" OwnerUserId="22728" LastEditorUserId="8499" LastEditDate="2017-03-02T12:39:08.410" LastActivityDate="2021-12-06T19:21:30.043" Title="OSPF without Area 0" Tags="|routing|ospf|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39408" PostTypeId="2" ParentId="39407" CreationDate="2017-03-02T11:37:51.843" Score="-1" Body="&lt;p&gt;No OSPF should have a backbone area because it acts as a hub to transmit routing information about other areas in the network.&lt;/p&gt;&#xA;" OwnerUserId="34870" LastActivityDate="2017-03-02T11:37:51.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39409" PostTypeId="2" ParentId="39366" CreationDate="2017-03-02T11:52:21.887" Score="0" Body="&lt;p&gt;IP addresses are provided by IANA authority.Large companies or ISPs have to buy IP addresses form IANA  so to reduce the wastage and provide only the required IP address it has to be subnetted.In case of private IP adresses subnetting is done to divide the networks.&#xA;NAT maps many private IPs into a single public IP address&lt;/p&gt;&#xA;" OwnerUserId="34870" LastActivityDate="2017-03-02T11:52:21.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39411" PostTypeId="2" ParentId="39407" CreationDate="2017-03-02T12:02:34.660" Score="10" Body="&lt;p&gt;There is only one way to use OSPF without an Area 0, and that is to use OSPF with a single area. If you only have one OSPF area, you can number it any way you like, but if you have even two areas, you must have an Area 0.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-02T12:02:34.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39413" PostTypeId="2" ParentId="39387" CreationDate="2017-03-02T14:24:05.417" Score="3" Body="&lt;p&gt;To get your packets to their destination and the replies back to you there needs to be a route there and a route back. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are two (there are a few other cases as well but we don't need to consider those here) main types of relationships networks have with each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a peering relationship two networks connect to each other so that network A and it's customers can talk to network B and it's customers. Peering connections may run over a direct point to point link or over an Internet exchange point that connects multiple providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Different networks have different policies on peering. Pretty much all of them will require you have your own IP space and AS number. Some networks will peer with almost anyone who gets themselves an AS number and buys a link to an Internet exchange point where they have a presence. Some will only peer with networks they see as equals. Some will only peer with you if you build your own international network and peer with them in multiple cities around the world. Some may expect you to pay for the physical connection to them or even pay them for the privilege of peering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a transit relationship there is a provider/customer relationship. A transit provider provides a transit customer with connectivity to the Internet in general. The transit provider will almost certainly charge the transit customer money for this service.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the top of the pile there are a small number of providers who do not buy any transit, relying entirely on peering connections to serve their customers. It's very difficult to join this group as most of the existing transit-free providers are not friendly to new peers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you have a small ammount of traffic it's not worth playing the peering game yourself, it's cheaper to pay an ISP to do it for you. As your average traffic needs start to get into the gigabits per second it can make sense to start playing the peering game yourself.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-02T14:24:05.417" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39414" PostTypeId="1" AcceptedAnswerId="39416" CreationDate="2017-03-02T15:41:49.750" Score="1" ViewCount="273" Body="&lt;p&gt;I have multiple routers connected to frame relay switches. I am using serial links from the routers to connect to the relay switches. I'm also using an unnumbered loopback address on all of the serial links. &#xA;When I look at the routing table, the costs of all the routes to other loopbacks are 2. Having some trouble finding out why. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 -&gt; FRS1 -&gt; FRS2 -&gt; R2&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Loopback0&#xA;ip address 1.1.1.1 255.255.255.255&#xA;ip ospf 1 area 0&#xA;!&#xA;interface Tunnel23&#xA;no ip address&#xA;!&#xA;interface FastEthernet0/0&#xA;ip address 192.168.1.1 255.255.255.0&#xA;duplex full&#xA;!&#xA;interface Serial1/0&#xA;no ip address&#xA;encapsulation frame-relay&#xA;serial restart-delay 0&#xA;frame-relay interface-dlci 102 ppp Virtual-Template1&#xA;frame-relay interface-dlci 103 ppp Virtual-Template1&#xA;frame-relay interface-dlci 104 ppp Virtual-Template1&#xA;frame-relay interface-dlci 108 ppp Virtual-Template1&#xA;frame-relay interface-dlci 109 ppp Virtual-Template1&#xA;!&#xA;interface Virtual-Template1&#xA;ip unnumbered Loopback0&#xA;ip ospf 1 area 0&#xA;!&#xA;router ospf 1&#xA;router-id 1.1.1.1&#xA;network 1.1.1.1 0.0.0.0 area 0&#xA;network 192.168.1.0 0.0.0.255 area 0&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;  1.0.0.0/32 is subnetted, 1 subnets&#xA;C        1.1.1.1 is directly connected, Loopback0&#xA;  2.0.0.0/32 is subnetted, 1 subnets&#xA;O        2.2.2.1 [110/2] via 2.2.2.1, 02:28:41, Virtual-Access1&#xA;&#xA;&#xA;&#xA;&#xA;        OSPF Router with ID (1.1.1.1) (Process ID 1)&#xA;&#xA;            Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;1.1.1.1         1.1.1.1         1038        0x8000001F 0x00BBF0 7&#xA;2.2.2.1         2.2.2.1         1294        0x8000001E 0x008625 7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are more than the two routers but i left them out for clarity. IM using cisco 7200 in GNS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks again &lt;/p&gt;&#xA;" OwnerUserId="34558" LastEditorUserId="8499" LastEditDate="2018-12-25T04:05:08.063" LastActivityDate="2018-12-25T04:05:08.063" Title="In OSPF, do virtual links have a cost when looking at the routing table?" Tags="|cisco|router|ospf|frame-relay|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39416" PostTypeId="2" ParentId="39414" CreationDate="2017-03-02T16:15:26.093" Score="0" Body="&lt;p&gt;You haven't really given enough details about how you you have virtual links connected, but virtual links end up with the costs of the individual hops added together, just as if there wasn't a virtual link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, consider this scenario:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  Area 0         |                 Area 1               |    Area 2&#xA;  Cost 10               Cost 10              Cost 10             Cost 10 &#xA;10.0.0.0/24&amp;lt;--&amp;gt;R1&amp;lt;--&amp;gt; 10.0.1.0/24&amp;lt;--&amp;gt;R2&amp;lt;--&amp;gt;10.0.2.0/24&amp;lt;-&amp;gt;R3&amp;lt;--&amp;gt;10.0.3.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R3 has a virtual link to R1 in Area 0 The cost that R3 sees across the virtual link to &lt;code&gt;10.0.0.0/24&lt;/code&gt; in Area 0 is &lt;code&gt;30&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a document that explains OSPF virtual links: &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/open-shortest-path-first-ospf/47866-ospfdb7.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;OSPF Virtual Link&lt;/em&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-02T16:15:26.093" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39417" PostTypeId="1" AcceptedAnswerId="39418" CreationDate="2017-03-02T16:17:51.843" Score="2" ViewCount="11701" Body="&lt;pre&gt;&lt;code&gt;Here is the configuration:&#xA;&#xA;Current configuration : 154 bytes&#xA;!&#xA;interface Port-channel1&#xA; description TRUNK&#xA; switchport trunk allowed vlan 10,20&#xA; switchport mode trunk&#xA;end&#xA;&#xA;&#xA;interface GigabitEthernet1/0/47&#xA; description SW1&#xA; switchport trunk allowed vlan 10,20&#xA; switchport mode trunk&#xA; speed 1000&#xA; duplex full&#xA; channel-protocol lacp&#xA; channel-group 1 mode active&#xA;end&#xA;&#xA;&#xA;interface GigabitEthernet1/0/48&#xA; description SW1&#xA; switchport trunk allowed vlan 10,20&#xA; switchport mode trunk&#xA; speed 1000&#xA; duplex full&#xA; channel-protocol lacp&#xA; channel-group 1 mode active&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have verified and other side of switch has same configuration. i have matched them word to word. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the etherchannel summary &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+-----------------------------------------------&#xA;1      Po1(SU)         LACP      Gi1/0/47(P) Gi1/0/48(s)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On switch port i have seen &lt;code&gt;Amber light&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In log i have seen:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Feb 28 22:39:45.558: %EC-5-L3DONTBNDL2: Gi1/0/48 suspended: LACP currently not enabled on the remote port.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;etherchannel details:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh etherchannel 1 detail&#xA;Group state = L2&#xA;Ports: 2   Maxports = 16&#xA;Port-channels: 1 Max Port-channels = 16&#xA;Protocol:   LACP&#xA;Minimum Links: 0&#xA;&#xA;&#xA;        Ports in the group:&#xA;        -------------------&#xA;Port: Gi1/0/47&#xA;------------&#xA;&#xA;Port state    = Up Mstr Assoc In-Bndl&#xA;Channel group = 1           Mode = Active          Gcchange = -&#xA;Port-channel  = Po1         GC   =   -             Pseudo port-channel = Po1&#xA;Port index    = 0           Load = 0x00            Protocol =   LACP&#xA;&#xA;Flags:  S - Device is sending Slow LACPDUs   F - Device is sending fast LACPDUs.&#xA;        A - Device is in active mode.        P - Device is in passive mode.&#xA;&#xA;Local information:&#xA;                            LACP port     Admin     Oper    Port        Port&#xA;Port      Flags   State     Priority      Key       Key     Number      State&#xA;Gi1/0/47  SA      bndl      32768         0x1       0x1     0x130       0x3D&#xA;&#xA;Partner's information:&#xA;&#xA;                  LACP port                        Admin  Oper   Port    Port&#xA;Port      Flags   Priority  Dev ID          Age    key    Key    Number  State&#xA;Gi1/0/47  SA      32768     6c99.8962.2900   0s    0x0    0x10   0x110   0x3D&#xA;&#xA;Age of the port in the current state: 1d:17h:22m:19s&#xA;&#xA;Port: Gi1/0/48&#xA;------------&#xA;&#xA;Port state    = Up Cnt-bndl-rmt Suspend Mstr Rmt-LACP_Dsbl Not-in-Bndl&#xA;Channel group = 1           Mode = Active          Gcchange = -&#xA;Port-channel  = null        GC   =   -             Pseudo port-channel = Po1&#xA;Port index    = 0           Load = 0x00            Protocol =   LACP&#xA;&#xA;Flags:  S - Device is sending Slow LACPDUs   F - Device is sending fast LACPDUs.&#xA;        A - Device is in active mode.        P - Device is in passive mode.&#xA;&#xA;Local information:&#xA;                            LACP port     Admin     Oper    Port        Port&#xA;Port      Flags   State     Priority      Key       Key     Number      State&#xA;Gi1/0/48  SA      susp      32768         0x1       0x1     0x131       0x7D&#xA;&#xA;Age of the port in the current state: 0d:00h:28m:16s&#xA;&#xA;        Port-channels in the group:&#xA;        ---------------------------&#xA;&#xA;Port-channel: Po1    (Primary Aggregator)&#xA;&#xA;------------&#xA;&#xA;Age of the Port-channel   = 1d:17h:26m:42s&#xA;Logical slot/port   = 9/1          Number of ports = 1&#xA;HotStandBy port = null&#xA;Port state          = Port-channel Ag-Inuse&#xA;Protocol            =   LACP&#xA;Port security       = Disabled&#xA;&#xA;Ports in the Port-channel:&#xA;&#xA;Index   Load   Port     EC state        No of bits&#xA;------+------+------+------------------+-----------&#xA;  0     00     Gi1/0/47 Active             0&#xA;&#xA;Time since last port bundled:    1d:17h:22m:19s    Gi1/0/47 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Otherside switch &lt;code&gt;SW1&lt;/code&gt; i am seeing this. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Group  Port-channel  Protocol    Ports&#xA;------+-------------+-----------+-----------------------------------------------&#xA;16     Po16(SU)        LACP      Gi1/0/14(D) Gi1/0/15(P)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;interface status:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#sh int Gi1/0/14&#xA;GigabitEthernet1/0/14 is down, line protocol is down (notconnect)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2017-03-02T17:17:33.367" Title="Cisco 2960 etherchannel suspended mode" Tags="|cisco|switch|ieee-802.1ax|etherchannel|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="39418" PostTypeId="2" ParentId="39417" CreationDate="2017-03-02T17:17:33.367" Score="1" Body="&lt;p&gt;This often happens when you connect to an interface that doesn't have LACP enabled, as you have discovered. Using CDP or LLDP will tell you for sure what the interface on the other end is, assuming you have one of those enabled on both devices.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-02T17:17:33.367" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39419" PostTypeId="1" CreationDate="2017-03-02T17:27:19.910" Score="-2" ViewCount="243" Body="&lt;p&gt;In the below configuration, what does &lt;code&gt;aaa&lt;/code&gt; mean?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication login CON local&#xA;aaa authentication login VTY group VTY local    &#xA;aaa authentication dot1x default group DOT1x&#xA;aaa authorization exec VTY group VTY if-authenticated   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34865" LastEditorUserId="8499" LastEditDate="2017-03-02T17:32:24.360" LastActivityDate="2017-03-02T17:32:24.360" Title="What does aaa mean?" Tags="|cisco|cisco-ios|cisco-commands|authentication|aaa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39420" PostTypeId="2" ParentId="39419" CreationDate="2017-03-02T17:31:46.087" Score="2" Body="&lt;p&gt;That stands for Authentication, Authorization, and Accounting. It controls who is authorized on a device, what authorization each has, and accounting of who is doing what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has documents, e.g. &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios/12_2/security/configuration/guide/fsecur_c/scfaaa.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Cisco IOS Security Configuration Guide, Release 12.2&lt;/em&gt;&lt;/a&gt;, that explain what it is and how it works on Cisco devices.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-02T17:31:46.087" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39425" PostTypeId="1" AcceptedAnswerId="39426" CreationDate="2017-03-02T19:20:09.097" Score="2" ViewCount="216" Body="&lt;p&gt;Using protocols like RIP, OSPF and EIGRP, would IPv6 converge faster in smaller network like 4 routers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would it differ in bigger networks?&lt;/p&gt;&#xA;" OwnerUserId="24668" LastEditorUserId="8499" LastEditDate="2017-03-02T19:26:52.863" LastActivityDate="2017-03-02T19:26:52.863" Title="Difference in convergence time IPv4 vs IPv6" Tags="|ipv4|ospf|ipv6|eigrp|rip|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39426" PostTypeId="2" ParentId="39425" CreationDate="2017-03-02T19:26:11.550" Score="1" Body="&lt;p&gt;The routing protocol algorithms are identical for either IPv4 or IPv6, so convergence should be the same. There may be differences in an implementation on some router software, but that would be an implementation-specific difference. For example, IPv6 as the newer protocol may have a better, newer, faster implementation of the RIP algorithm on a particular router model.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-02T19:26:11.550" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39428" PostTypeId="1" AcceptedAnswerId="39889" CreationDate="2017-03-02T20:43:39.797" Score="2" ViewCount="2213" Body="&lt;p&gt;I'm doing a project in which I need to capture a live feed of all wireless networks available around a given device. I was hoping to go a step further and capture all packets as well using Wireshark, but from what I've seen, Wireshark will require you to capture only on a particular network or at least on a particular wireless channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are: a) is there a way for Wireshark to capture &lt;em&gt;all&lt;/em&gt; wireless traffic on all channels and networks at once? And, if not, then, b) is there a way to at least capture (probably using some other tool) a live feed of all wireless networks available?&lt;/p&gt;&#xA;" OwnerUserId="8404" LastActivityDate="2017-03-22T22:39:53.557" Title="How to capture packets from all wifi channels at once?" Tags="|wireless|wireshark|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39435" PostTypeId="1" CreationDate="2017-03-03T07:13:25.407" Score="0" ViewCount="495" Body="&lt;p&gt;How to limit the connection (upload and download) speed of a particular application (e.g., a particular exe file) in accessing the internet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently, it is easy to allow or block completely using a firewall. But I could not see any option that addresses the above intention, i.e., just limit the connection to specified speed.&lt;/p&gt;&#xA;" OwnerUserId="34896" LastActivityDate="2017-03-03T12:44:02.913" Title="Limit bandwidth of a particular application" Tags="|firewall|internet|bandwidth|speed|" AnswerCount="1" CommentCount="3" ClosedDate="2018-03-13T05:05:31.403" ContentLicense="CC BY-SA 3.0" />
  <row Id="39437" PostTypeId="1" CreationDate="2017-03-03T07:33:33.180" Score="2" ViewCount="840" Body="&lt;p&gt;On an MX router I have configured a DHCP server and radius server authentication. Unfortunately, it is not working yet. On another MX router I have configured the same configuration and that it working fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the logs below from the authlog log. It sees a request coming in and setting up the radius access request. But when it wants to send the request to the radius server it says that no authentication server is configured. Which is weird because, I have configured it right here under 'access':&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;radius-server {&#xA;    xx.xx.xx.xx {&#xA;        secret &quot;secret&quot;; ## SECRET-DATA&#xA;        source-address yy.yy.yy.yy;&#xA;    }&#xA;}&#xA;&#xA;&#xA;Mar  2 15:36:55.368548 radius-access-request: User-Name added: core-nkh-03.xe-0/0/3:1035&#xA;Mar  2 15:36:55.368616 radius-access-request: Service-Type added: 2&#xA;Mar  2 15:36:55.368675 radius-access-request: Chargeable-User-Identity added:&#xA;Mar  2 15:36:55.368729 radius-access-request: Acct-Session-Id added:   1039&#xA;Mar  2 15:36:55.368829 radius-access-request: DHCP-Options (Juniper-ERX-VSA) added: 35 01 01 etc&#xA;Mar  2 15:36:55.368892 radius-access-request: DHCP-MAC-Address (Juniper-ERX-VSA) added: 906c.acd1.acfb&#xA;Mar  2 15:36:55.368946 radius-access-request: NAS-Identifier added: core-nkh-03&#xA;Mar  2 15:36:55.369000 radius-access-request: NAS-Port added: 00 c0 04 0b&#xA;Mar  2 15:36:55.369046 radius-access-request: NAS-Port-Id added: xe-0/0/3.1073742606:1035&#xA;Mar  2 15:36:55.369096 radius-access-request: NAS-Port-Type added: 15&#xA;Mar  2 15:36:55.369155 authd_create_application_specific_radius_server: No authentication-server list configured&#xA;Mar  2 15:36:55.369198 authd_auth_module_start: result = 4 start_auth; state = 0&#xA;Mar  2 15:36:55.369237 authd_auth_module_start: Error in calling the start_auth&#xA;Mar  2 15:36:55.369278 REQUEST: AUTHEN - module_index 0 module(radius) return: SERVER&#xA;Mar  2 15:36:55.369330 Framework: auth result is 12. Performing post-auth operations&#xA;Mar  2 15:36:55.369370 Framework: result is 12.&#xA;Mar  2 15:36:55.369412 authd_auth_send_answer: conn=2c3d000, reply-code=3 (TIMEOUT), result-subopcode=12 (ACCESS_TIMEOUT), sub-id=1039, cookie=65795, rply_len=28, num_tlv_blocks=0&#xA;Mar  2 15:36:55.369480 Delete session: 1039&#xA;Mar  2 15:36:55.369523 Begin to logout Subscriber&#xA;Mar  2 15:36:55.369606 Removing client snapshot&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, what am i missing here?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&amp;lt;-----&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@Jordan&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show configuration access &#xA;radius-server {&#xA;    10.10.10.18 {&#xA;        secret &quot;$9$secret&quot;; ## SECRET-DATA&#xA;        source-address 10.10.10.10;&#xA;    }&#xA;}&#xA;domain-name-server-inet {&#xA;    10.10.10.18&#xA;    10.10.10.19;&#xA;}&#xA;profile local-kpn {&#xA;    accounting-order radius;&#xA;    authentication-order radius;&#xA;    accounting {&#xA;        order radius;&#xA;    }&#xA;}&#xA;address-assignment {&#xA;    pool local-kpn {&#xA;        family inet {&#xA;            network 20.20.20.0/25;&#xA;            dhcp-attributes {&#xA;                maximum-lease-time 3600;&#xA;                router {&#xA;                    20.20.20.1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;show configuration access-profile &#xA;    local-kpn;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Looks good to me right?&lt;/p&gt;&#xA;" OwnerUserId="20112" LastEditorUserId="8499" LastEditDate="2018-03-22T15:15:24.753" LastActivityDate="2018-03-22T15:15:24.753" Title="Juniper MX Radius server configuration: No authentication-server list configured" Tags="|router|authentication|radius|juniper-mx|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39438" PostTypeId="2" ParentId="39391" CreationDate="2017-03-03T08:28:42.857" Score="6" Body="&lt;p&gt;I think you misunderstood how a router process a packet, thus coming with a solution that is not at all appropriate for your needs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Why?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let say computer A has the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;mac address &lt;code&gt;00:53:BA:12:17:19&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;IP address &lt;code&gt;192.168.0.7&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;subnet mask of &lt;code&gt;255.255.255.0&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;default gateway &lt;code&gt;192.168.0.1&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A send a packet to the internet host www.example.com which has IP address &lt;code&gt;203.0.113.5&lt;/code&gt;.&lt;br&gt;&#xA;The packet has the following characteristics:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;source IP address : 192.168.0.7&lt;/li&gt;&#xA;&lt;li&gt;destination IP address: 203.0.113.5&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It compare (in binary) its subnet mask with the destination IP address and find that the destination is not on the local subnet, so it will send the packet to its default gateway, 192.168.0.1  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It lookup in its ARP table and if needed perform an ARP request to find the mac address of the host which hold the 192.168.0.1 IP address.&lt;br&gt;&#xA;It finds &lt;code&gt;00:53:00:17:a7:b3&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it builds a frame with the following characteristics:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;source mac address: 00:53:BA:12:17:19&lt;/li&gt;&#xA;&lt;li&gt;destination mac address: 00:53:00:17:a7:b3&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;inside this ethernet frame the IP packet is encapsulted, and it still has:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;source IP address : 192.168.0.7&lt;/li&gt;&#xA;&lt;li&gt;destination IP address: 203.0.113.5&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;As you can seed the destination IP address is NOT the gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the router receive this frame, strip the Ethernet header and lookup the packet to perform a routing decision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The basic of routing is that the routing decision is made solely on the destination IP address, 203.0.113.5&#xA;The router then look in its routing table, find a route for 203.0.113.5 and send the packet through the associated interface (performing NAT if configured which is required here).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see, the IP address of the gateway that was used has no role in the routing decision. And, more importantly, &lt;strong&gt;the router does not even know what was this IP address.&lt;/strong&gt; It only know on which interface the frame arrived&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok so, why not configuring 2 different gateways on two different interfaces. Well you can't, not on a Cisco router. You cannot have two overlapping networks on two different layer 3 interfaces. Otherwise the router could not decide on which interface it must send a packet for this network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is why your dual gateway cannot work. &#xA;But more importantly, it's not required to achieve your goal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What could work?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if you want the router to take a different routing decision based on the sender, it is possible. It's called &lt;code&gt;policy based routing&lt;/code&gt; (PBR)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PBR allow you to configure different routing table on the router, and perform routing decision on different criteria.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The most common (and easy to configure) criteria are the source IP address and destination IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you can specify the outgoing interface rather than the next-hop IP, which is handy for a outgoing interface configured by DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what you have to do (if I understood correctly what you want), is to:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;set a group of computers with specific IP address pool (fixed IP, DHCP reservations)&lt;/li&gt;&#xA;&lt;li&gt;set another group of computer with a second IP address pool&lt;/li&gt;&#xA;&lt;li&gt;write a route map that will set the destination IP or outgoing interface for each pool&lt;/li&gt;&#xA;&lt;li&gt;activate PBR on the incoming interface (the one that has the LAN gateway)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To manually change the outgoing interface for some computer in case one link fail, you just have to alter the route-map, which is a matter of minutes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can have 4 pools for example:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;computers that will always use ISP 1, and never fail-over to ISP2&lt;/li&gt;&#xA;&lt;li&gt;computers that will always use ISP 2, and never fail-over to ISP1&lt;/li&gt;&#xA;&lt;li&gt;computer that will use ISP 1 if available, and manually fail-over to ISP2 if needed&lt;/li&gt;&#xA;&lt;li&gt;computer that will use ISP 2 if available, and manually fail-over to ISP1 if needed&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-03-03T08:37:09.617" LastActivityDate="2017-03-03T08:37:09.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39439" PostTypeId="2" ParentId="24834" CreationDate="2017-03-03T08:52:50.643" Score="1" Body="&lt;p&gt;Although nmap can do some things to 'get around' stateful firewalls, its basic use is in identifying running services.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, I know it is called nmap for a reason, but I do not believe its primary use case is mapping firewall-protected remote networks (rather, you would use it to see what a given range might be exposing - &lt;a href=&quot;https://www.shodan.io/&quot; rel=&quot;nofollow noreferrer&quot;&gt;shodan&lt;/a&gt; exists in part because what people think is exposed and what is exposed are often different).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a host within the same broadcast domain, then you can enumerate all hosts whether or not they have a firewall, by generating some kind of ARP ping. &#xA;One way of doing that would be to try and send a single ICMP echo request to each host, and then check your ARP table for live entries (e.g. using &lt;code&gt;ip n&lt;/code&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are not within the same broadcast domain, then it is another matter. You could mess around with GRE and IPIP, I guess (there is a slim chance that could do something for you), but in general, stateful firewalls will do their job fairly effectively, and obfuscate much of the network they are trying to protect. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, it never hurts to look at the TTLs of returning packets, in order to try and get a sense of the network's depth. &lt;/p&gt;&#xA;" OwnerUserId="34804" LastActivityDate="2017-03-03T08:52:50.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39440" PostTypeId="2" ParentId="24834" CreationDate="2017-03-03T09:10:14.330" Score="0" Body="&lt;p&gt;You use an arp scan. Since arp packets never hit the IP layer they will never hit the IP firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IIRC nmap will do this by default if the targets are on the same subnet as the scanner.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-03T09:10:14.330" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39441" PostTypeId="1" AcceptedAnswerId="39442" CreationDate="2017-03-03T09:27:37.567" Score="-1" ViewCount="97" Body="&lt;p&gt;How does NVIDIA GeForce NOW manage such high and massive data transmission between PC and servers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: Please attach relevant articles or journal papers to support your claim.&lt;/p&gt;&#xA;" OwnerUserId="34898" LastActivityDate="2017-03-03T11:13:11.937" Title="High Speed data Transmission" Tags="|network-core|network|data|" AnswerCount="1" CommentCount="3" ClosedDate="2017-03-03T13:36:40.773" ContentLicense="CC BY-SA 3.0" />
  <row Id="39442" PostTypeId="2" ParentId="39441" CreationDate="2017-03-03T11:13:11.937" Score="2" Body="&lt;p&gt;Figured it might be better to work my comment into an answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nvidia requires a fair amount of available bandwidth to be available, and also has a requirement for users to be within a 60ms RTT of one of their (6) datacenters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Their maximum bandwidth requirement is 50Mb/s (6.25MB/s) for 1080p quality. This is substantially more than Netflix requires for an equivalent quality stream (1080p is an HD feed, Netflix wants 10 times less (5Mb/s) for it).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we assumed the entire network to be one continuous strand of fiber AND that the light was travelling in a perfect vacuum (neither of these assumptions is actually realistic), then you would need to be within a 9000 kilometer radius of one of their DCs:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;299792458 * 0.03 = 8993773.74 meters&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, in plain english: speed of light in meters/second times 30 milliseconds (60ms RTT means a 30ms one way trip) gives you about 9000km.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real world is not generally ideal, so I suspect the real distance you need to be from their DCs is going to be quite a bit lower (speed of light in fiber is 1.5 times the speed of light in a vacuum, so on a pure fiber network with no switching, max distance is already something like 6000km, not 9000km).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words: the great performance is totally dependent on the quality of content delivered, and on the distance between you and an Nvidia DC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What exactly is transferred to/from their servers is also an unknown to me, and it may be mouse/keyboard is processed locally, and the resulting coordinates/events are transferred up (this is a total guess). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, on the face of it, the answer is that they have pretty high network requirements, which allows them to move a fair bit of data round when they need to. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Refs:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Speed_of_light&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Speed_of_light&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://shield.nvidia.com/support/geforce-now/system-requirements/2&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://shield.nvidia.com/support/geforce-now/system-requirements/2&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://help.netflix.com/en/node/306&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://help.netflix.com/en/node/306&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="34804" LastActivityDate="2017-03-03T11:13:11.937" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39444" PostTypeId="2" ParentId="39435" CreationDate="2017-03-03T12:44:02.913" Score="1" Body="&lt;p&gt;Please provide more information on the question and the Network environment.Also tell us in which device you are planning to do the bandwidth limiting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use the netstat or identify the ports which are being used by the application and then apply tc rules based on the ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are using a Linux based Desktop/Router then you can do a Token Bucket Filter with TC commands. It can slow down traffic for a given port and services on Desktop or OpenWRT based routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When traffic is shaped, its rate of transmission is under control, in other words you apply some sort of bandwidth allocation for each port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A Sample Use Case: &#xA;Commands for throttling Upload 2mbit and Download 4mbit for OpenWRT based Router.We can modify the same set of commands once we know what is the type of service/exe we are looking at here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Upload Bandwidth Limiting&lt;/strong&gt;:&#xA;tc qdisc add dev eth0 root tbf rate 2mbit burst 10kb latency 50ms peakrate 4mbit minburst 1540&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Download Bandwidth Limiting&lt;/strong&gt;:&#xA;tc qdisc add dev br-lan root tbf rate 4mbit burst 10kb latency 50ms peakrate 8mbit minburst 1540&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-03-03T12:44:02.913" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39445" PostTypeId="1" AcceptedAnswerId="39448" CreationDate="2017-03-03T13:50:37.893" Score="1" ViewCount="476" Body="&lt;p&gt;In &quot;Computer Networks : A Top-Down Approach&quot; by Kurose and Ross they say: &lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Instead of measuring a SampleRTT for every&#xA;  transmitted segment, most TCP implementations take only one SampleRTT measurement at a time. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;(SampleRTT for a segment is the amount of time between when the segment is sent (that is, passed to IP) and when an acknowledgment for the segment is received.) &lt;br/&gt;&#xA;Why is that? What's wrong with measuring for, say, at most half of the segments sent?&lt;/p&gt;&#xA;" OwnerUserId="34904" LastEditorUserId="8499" LastEditDate="2017-07-16T00:25:09.450" LastActivityDate="2017-07-16T00:25:09.450" Title="Estimating the round trip time" Tags="|tcp|protocol-theory|layer4|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39446" PostTypeId="1" AcceptedAnswerId="39447" CreationDate="2017-03-03T14:41:05.700" Score="2" ViewCount="1010" Body="&lt;p&gt;I'm doing some tests in a company, and I have some problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My mission is to configure an autonomous AP Cisco AIRCAP-2602E, and do a Wi-Fi bridge point-to-point between a Cisco lightweight AP and the autonomous AP (which is the Cisco AIRCAP-2602E). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lightweight AP is connected to a Cisco Wi-Fi controler and my autonomous AP is alone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to do a bridge between these two APs to broadcast the network (from the vlan 10), which is broadcast by the lightweight AP on the Gigabit interface of my autonomous AP that will be linked to a computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I'm searching on the web for a solution. I have tested a lot of things, and nothing works. I cannot bridge between these APs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have much knowledge about the Wi-Fi with Cisco. I tried a lot of things like set up bridge-group, do universal root bridge, etc., but nothing works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the good mode for the autonomous AP? How do I connect them together?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm so lost please help me...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Sory for my bad english, I've done my best...&lt;/em&gt;&#xA;&lt;em&gt;If you have questions for some precision ask me&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerUserId="34905" LastEditorUserId="8499" LastEditDate="2017-03-03T15:10:19.613" LastActivityDate="2017-03-03T16:38:57.910" Title="Cannot bridge point-to-point between autonomous AP and lightweight AP" Tags="|cisco|wireless|ieee-802.11|bridge|capwap|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39447" PostTypeId="2" ParentId="39446" CreationDate="2017-03-03T15:04:57.453" Score="1" Body="&lt;p&gt;You can configure the WAP to be a client of the LWAP. The WAP would act as a wireless bridge. It will not be a point-to-point link, but the WAP will bridge the devices connected to its ethernet interface to the LWAP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apparently, you can only configure this for one radio in the WAP. In the radio configuration, use the &lt;code&gt;station-role workgroup-bridge&lt;/code&gt; command. Cisco provides an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AP# configure terminal&#xA;AP(config)# interface dot11radio 0&#xA;AP(config-if)# station-role workgroup-bridge&#xA;AP(config-if)# ssid infra&#xA;AP(config-ssid)# infrastructure-ssid&#xA;AP(config-ssid)# authentication client username wgb1 password cisco123&#xA;AP(config-ssid)# exit&#xA;AP(config-if)# exit&#xA;AP(config)# workgroup-bridge client-vlan 22&#xA;AP(config)# end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;One hitch is that the WAP as a bridge can time out the MAC addresses of the clients it is bridging, if they do not send very often, even if they are receiving. You can increase the timeout for this problem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;configure terminal&#xA;bridge &amp;lt;bridge-group-number&amp;gt; &amp;lt;aging-time seconds&amp;gt;&#xA;exit&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco has the full set of instructions on configuring a workgroup bridge, e.g. &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/wireless/access_point/15-3-3/configuration/guide/cg15-3-3/cg15-3-3-chap19-wgb-standby.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Cisco IOS Configuration Guide for Autonomous Aironet Access Points Cisco IOS Release 15.3(3)JAB&lt;/em&gt;&lt;/a&gt;. In particular, there is a section on configuring a workgroup bridge, and a following section on how to work with a workgroup bridge as a client of an LWAP.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;Understanding Workgroup Bridge Mode&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;You can configure access points as workgroup bridges. In workgroup&#xA;  bridge mode, the unit associates to another access point as a client&#xA;  and provides a network connection for the devices connected to its&#xA;  Ethernet port. For example, if you need to provide wireless&#xA;  connectivity for a group of network printers, you can connect the&#xA;  printers to a hub or to a switch, connect the hub or switch to the&#xA;  access point Ethernet port, and configure the access point as a&#xA;  workgroup bridge. The workgroup bridge associates to an access point&#xA;  on your network.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If your access point has two radios, either the 2.4-GHz radio or the&#xA;  5-GHz radio can function in workgroup bridge mode. When you configure&#xA;  one radio interface as a workgroup bridge, the other radio remains up.&#xA;  However, both radios cannot be configured to operate simultaneously as&#xA;  a workgroup bridge. The other radio can either be disabled (shutdown),&#xA;  or be in root (access point or bridge), scanner, or spectrum mode.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-03T16:38:57.910" LastActivityDate="2017-03-03T16:38:57.910" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39448" PostTypeId="2" ParentId="39445" CreationDate="2017-03-03T15:26:56.797" Score="4" Body="&lt;p&gt;As in most systems engineering topics, there's a balance between performance and accuracy. In the case of TCP, it &lt;em&gt;could&lt;/em&gt; take a SampleRTT measurement every other segment, but that would imply a higher processing delay, and thus a higher queueing delay, etc. The single SampleRTT measurement helps TCP get an idea of the RTT while staying lean and fast.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each node wants to spend the &lt;em&gt;minimum&lt;/em&gt; time possible processing each segment so that it can get forwarded onto the network and move on to the next segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[EDIT] Additionally, each subsequent measurement is less valuable than the one before. The first measurement lets you know the neighborhood of RTT, the second helps you fine-tune that, etc. So there's a diminishing payoff the more RTTs you measure, especially since after each measurement you have fewer segments remaining to send. What's the point of measuring the RTT if there's only 5 segments left to send? Thus the first RTT measurement is the most important and really the only one needed.&lt;/p&gt;&#xA;" OwnerUserId="34908" LastEditorUserId="34908" LastEditDate="2017-03-03T18:09:19.627" LastActivityDate="2017-03-03T18:09:19.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39449" PostTypeId="1" AcceptedAnswerId="39451" CreationDate="2017-03-03T16:06:40.600" Score="3" ViewCount="226" Body="&lt;p&gt;I would like to create a network like the one in the screenshot. I would have 2 VLANs : &#xA;&lt;br&gt;-VLAN10 : Service1&lt;br&gt;&#xA;-VLAN20 : Service2&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing is working but i don't know if I can have adresses on 192.168.1.X behind both routers. &#xA;Because on both routers my FA0/0 needs to be reachable by each machine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For exemple on the left, &lt;strong&gt;192.168.1.2&lt;/strong&gt; and &lt;strong&gt;192.168.2.3&lt;/strong&gt; need to be able to reach the gateway, but they are not on the same subnet, so how is it possible ? And even if this is possible, if I want &lt;strong&gt;192.168.1.2&lt;/strong&gt; to ping &lt;strong&gt;192.168.1.3&lt;/strong&gt;, &lt;strong&gt;192.168.1.2&lt;/strong&gt; will send ARP requests since it is the same subnet, and he won't try to reach the gatway. Dots are red because i did the screenshot while packet tracer was starting but routing is done.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you in advance for your help :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UQ7zB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UQ7zB.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34911" LastActivityDate="2017-03-03T16:26:07.237" Title="Respect VLAN through routers with DHCP server on WAN" Tags="|cisco|vlan|dot1q|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39450" PostTypeId="1" AcceptedAnswerId="39621" CreationDate="2017-03-03T16:14:48.717" Score="2" ViewCount="1249" Body="&lt;p&gt;I trying to copy a running config from a cisco switch using the snmp commands on a Cisco ASR1002.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the Cisco ASR I enabled snmp-server manager by using this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;   snmp-server manager&#xA;   exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the switch I want to pull the config from I add the ASR's IP to an access-list that has write privilege.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then back on the ASR I want to run these commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp set v2c SWITCH_IP WRITE_STRING oid 1.3.6.1.4.1.9.9.96.1.1.1.1.2.333 integer 1&#xA;snmp set v2c SWITCH_IP WRITE_STRING oid 1.3.6.1.4.1.9.9.96.1.1.1.1.3.333 integer 4&#xA;snmp set v2c SWITCH_IP WRITE_STRING oid 1.3.6.1.4.1.9.9.96.1.1.1.1.4.333 integer 1&#xA;snmp set v2c SWITCH_IP WRITE_STRING oid 1.3.6.1.4.1.9.9.96.1.1.1.1.5.333 ip-address TFTP_SERVER&#xA;snmp set v2c SWITCH_IP WRITE_STRING oid 1.3.6.1.4.1.9.9.96.1.1.1.1.6.333 string routertest.txt&#xA;snmp set v2c SWITCH_IP WRITE_STRING oid 1.3.6.1.4.1.9.9.96.1.1.1.1.14.333 integer 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I time out on the first command.&#xA;I can ping from one device to the other.  So I'm not sure if I'm missing another snmp-server setting that I need to set up.&lt;/p&gt;&#xA;" OwnerUserId="34910" LastActivityDate="2017-03-11T22:17:35.667" Title="How to copy Running Config from a switch using SNMP commands on Cisco ASR1002?" Tags="|cisco|snmp|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39451" PostTypeId="2" ParentId="39449" CreationDate="2017-03-03T16:26:07.237" Score="1" Body="&lt;p&gt;As you've drawn this, you can't do it.  You can't have the same subnet in two locations (separated by a layer 3 link).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make this work, you need 4 VLANS, two at each site. You can make the ones on the left&#xA;192.168.1.0/25 and 192.168.2.0/25,  and the ones on the right 192.168.1.128/25 and 192.168.2.128/25.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The lower two routers will have a subinterface on each VLAN/subnet.  The switch will trunk both VLANs to the router.&#xA;You can apply any security filtering to the /24 block as needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this were a real network, ask yourself why would you need to have the same subnet in both locations?  There are rarely any strong reasons for doing so.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-03T16:26:07.237" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39452" PostTypeId="1" AcceptedAnswerId="39469" CreationDate="2017-03-03T18:46:54.373" Score="3" ViewCount="1562" Body="&lt;p&gt;Consider an overly simple example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say we want to calculate the checksum of &quot;hi&quot;. Since h is the 8th letter of the alphabet, we'll say h=8, and similarly, i=9. So the checksum of hi is 8+9=17.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) What if i is accidentally flipped to j, but it's balanced out by the fact that h gets flipped to g?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) What if i gets flipped to j, but the checksum itself also gets corrupted and ends up being 18?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems that checksums can allow you to strongly suspect something, but not be certain. If so, why are they used if we need certainty?&lt;/p&gt;&#xA;" OwnerUserId="34554" LastActivityDate="2017-03-04T15:18:04.877" Title="Why are checksums used if they're flawed?" Tags="|checksum|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39454" PostTypeId="1" AcceptedAnswerId="40541" CreationDate="2017-03-03T20:07:48.423" Score="3" ViewCount="1533" Body="&lt;p&gt;I have a Cisco SG300 Small business switch, and the GUI interface is creating a lot of broadcast traffic: Source IP (The GUI IP): 172.16.xx.254:5353, Destination IP (Broadcast) 224.0.0.251:5353&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have disabled Bonjour and CDP globally on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I turn this traffic off? &#xA;(Command line answer preferred, but GUI is also OK.)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Edit #1 - JFL's answer prompted me to make a Wireshark capture just to be 100% sure that the traffic was coming from the switch.... it is.  The control GUI is broadcasting.  I don't need or want that to happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have &lt;strong&gt;no bonjour enable&lt;/strong&gt; globally.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the &lt;strong&gt;Discovery - Bonjour&lt;/strong&gt; menu Discovery: Enable is uncheked, and the &#xA;&lt;strong&gt;Bonjour Discovery Interface Control Table&lt;/strong&gt; is &lt;strong&gt;EMPTY&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a sample packet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Frame 60: 362 bytes on wire (2896 bits), 362 bytes captured (2896 bits) on interface 0&#xA;    Interface id: 0 (enp0)&#xA;    Encapsulation type: Ethernet (1)&#xA;    Arrival Time: Mar  3, 2017 16:14:17.875849274 EST&#xA;    [Time shift for this packet: 0.000000000 seconds]&#xA;    Epoch Time: 1488575657.875849274 seconds&#xA;    [Time delta from previous captured frame: 1.461698815 seconds]&#xA;    [Time delta from previous displayed frame: 4.999822643 seconds]&#xA;    [Time since reference or first frame: 43.461018609 seconds]&#xA;    Frame Number: 60&#xA;    Frame Length: 362 bytes (2896 bits)&#xA;    Capture Length: 362 bytes (2896 bits)&#xA;    [Frame is marked: False]&#xA;    [Frame is ignored: False]&#xA;    [Protocols in frame: eth:ethertype:ip:udp:mdns]&#xA;    [Coloring Rule Name: UDP]&#xA;    [Coloring Rule String: udp]&#xA;Ethernet II, Src: 00:9e:1e:xx:xx:x1 (00:9e:1e:xx:xx:x1), Dst: IPv4mcast_fb (01:00:5e:yy:yy:yb)&#xA;    Destination: IPv4mcast_fb (01:00:5e:yy:yy:yb)&#xA;        Address: IPv4mcast_fb (01:00:5e:yy:yy:yb)&#xA;        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)&#xA;        .... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)&#xA;    Source: 00:9e:1e:xx:xx:x1 (00:9e:1e:xx:xx:x1)&#xA;        Address: 00:9e:1e:xx:xx:x1 (00:9e:1e:xx:xx:x1)&#xA;        .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)&#xA;        .... ...0 .... .... .... .... = IG bit: Individual address (unicast)&#xA;    Type: IPv4 (0x0800)&#xA;Internet Protocol Version 4, Src: 172.16.xx.254, Dst: 224.0.0.251&#xA;    0100 .... = Version: 4&#xA;    .... 0101 = Header Length: 20 bytes&#xA;    Differentiated Services Field: 0xe0 (DSCP: CS7, ECN: Not-ECT)&#xA;        1110 00.. = Differentiated Services Codepoint: Class Selector 7 (56)&#xA;        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)&#xA;    Total Length: 348&#xA;    Identification: 0x2e4f (11855)&#xA;    Flags: 0x00&#xA;        0... .... = Reserved bit: Not set&#xA;        .0.. .... = Don't fragment: Not set&#xA;        ..0. .... = More fragments: Not set&#xA;    Fragment offset: 0&#xA;    Time to live: 1&#xA;        [Expert Info (Note/Sequence): &quot;Time To Live&quot; != 255 for a packet sent to the Local Network Control Block (see RFC 3171)]&#xA;            [&quot;Time To Live&quot; != 255 for a packet sent to the Local Network Control Block (see RFC 3171)]&#xA;            [Severity level: Note]&#xA;            [Group: Sequence]&#xA;    Protocol: UDP (17)&#xA;    Header checksum: 0xca52 [validation disabled]&#xA;        [Good: False]&#xA;        [Bad: False]&#xA;    Source: 172.16.xx.254&#xA;    Destination: 224.0.0.251&#xA;    [Source GeoIP: Unknown]&#xA;    [Destination GeoIP: Unknown]&#xA;User Datagram Protocol, Src Port: 5353 (5353), Dst Port: 5353 (5353)&#xA;    Source Port: 5353&#xA;    Destination Port: 5353&#xA;    Length: 328&#xA;    Checksum: 0x6346 [validation disabled]&#xA;        [Good Checksum: False]&#xA;        [Bad Checksum: False]&#xA;    [Stream index: 0]&#xA;Multicast Domain Name System (response)&#xA;    Transaction ID: 0x0000&#xA;    Flags: 0x8000 Standard query response, No error&#xA;        1... .... .... .... = Response: Message is a response&#xA;        .000 0... .... .... = Opcode: Standard query (0)&#xA;        .... .0.. .... .... = Authoritative: Server is not an authority for domain&#xA;        .... ..0. .... .... = Truncated: Message is not truncated&#xA;        .... ...0 .... .... = Recursion desired: Don't do query recursively&#xA;        .... .... 0... .... = Recursion available: Server can't do recursive queries&#xA;        .... .... .0.. .... = Z: reserved (0)&#xA;        .... .... ..0. .... = Answer authenticated: Answer/authority portion was not authenticated by the server&#xA;        .... .... ...0 .... = Non-authenticated data: Unacceptable&#xA;        .... .... .... 0000 = Reply code: No error (0)&#xA;    Questions: 0&#xA;    Answer RRs: 1&#xA;    Authority RRs: 0&#xA;    Additional RRs: 0&#xA;    Answers&#xA;        VSDPb45501._csco-sb-vsdp._mdns._udp.local: type TXT, class IN&#xA;            Name: VSDPb45501._csco-sb-vsdp._mdns._udp.local&#xA;            Type: TXT (Text strings) (16)&#xA;            .000 0000 0000 0001 = Class: IN (0x0001)&#xA;            0... .... .... .... = Cache flush: False&#xA;            Time to live: 25&#xA;            Data length: 255&#xA;            TXT Length: 6&#xA;            TXT: type=0&#xA;            TXT Length: 9&#xA;            TXT: version=1&#xA;            TXT Length: 21&#xA;            TXT: refresh-age-timeout=0&#xA;            TXT Length: 10&#xA;            TXT: priority=0&#xA;            TXT Length: 14&#xA;            TXT: refresh-flag=0&#xA;            TXT Length: 34&#xA;            TXT: root-mac-address=00:9e:1e:xx:xx:x1&#xA;            TXT Length: 6&#xA;            TXT: cost=0&#xA;            TXT Length: 26&#xA;            TXT: transm-address=172.16.xx.254&#xA;            TXT Length: 23&#xA;            TXT: transm-interface=100049&#xA;            TXT Length: 16&#xA;            TXT: voice-vlan-id=10&#xA;            TXT Length: 16&#xA;            TXT: voice-vlan-vpt=5&#xA;            TXT Length: 18&#xA;            TXT: voice-vlan-dscp=46&#xA;            TXT Length: 43&#xA;            TXT: md5-auth=01af9cba5ed0218b0848195834e6a878ae&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Edit #2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the following by rooting around on the console.  Don't know if this gives anybody any ideas, but the documentation doesn't say anything useful.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show bonjour &#xA;Bonjour global status: disabled&#xA;Bonjour L2 interfaces port list: none&#xA;&#xA;Service   Admin Status   Oper Status&#xA;-------   ------------   -----------&#xA;csco-sb   enabled        enabled &#xA;http      enabled        enabled &#xA;https     enabled        enabled &#xA;ssh       enabled        enabled &#xA;telnet    enabled        disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34916" LastEditorUserId="36720" LastEditDate="2019-05-02T20:33:42.293" LastActivityDate="2019-05-02T20:33:42.293" Title="Reducing broadcast traffic on Cisco SG300" Tags="|broadcast|cisco-sg300|" AnswerCount="4" CommentCount="7" ContentLicense="CC BY-SA 4.0" />
  <row Id="39457" PostTypeId="2" ParentId="39454" CreationDate="2017-03-03T21:01:39.470" Score="1" Body="&lt;p&gt;224.0.0.251 is the multicast (and not broadcast) address used by the apple Bonjour protocol but also by the associated multicast DNS (&lt;a href=&quot;http://www.rfc-editor.org/rfc/rfc6762.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc6762&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there's two cause of traffic sent to this multicast address:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;bonjour advertisements &lt;/li&gt;&#xA;&lt;li&gt;resolution of .local DNS names&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So I would first double check that bonjour advertisement are disabled (in Administration &gt; Discovery - Bonjour.) but also check that there's no DNS name ending with .local anywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Analysing the frame sent (with wireshark / tcdump / MS message analyser) could also determine if they are actually bonjour discovery message&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it's actually bonjour discovery packet and it's really off then I'll upgrade the switch with the latest software and see if it persists, then submit the issue to Cisco.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-03T21:01:39.470" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39459" PostTypeId="1" CreationDate="2017-03-03T21:52:32.437" Score="3" ViewCount="289" Body="&lt;p&gt;Given:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A typical collapsed core design where there are X number of L3 access switches connected to one L3 distribution switch.&lt;/li&gt;&#xA;&lt;li&gt;VLAN trunking is enabled between the various AS and the DS.&lt;/li&gt;&#xA;&lt;li&gt;A router that is the default gateway is connected to the DS.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Should the GW on the clients connected to various AS be set to a VLAN subinterface on the specific AS they are connected to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, should the GW for all be set to a VLAN subinterface on the DS?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think the latter, but I am uncertain that my understanding is complete.&lt;/p&gt;&#xA;" OwnerUserId="34852" LastActivityDate="2017-11-29T04:34:28.700" Title="Should the gateway for devices on a VLAN be set to the L3 switch they are connected to? Or just one switch?" Tags="|vlan|trunk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39461" PostTypeId="1" AcceptedAnswerId="39463" CreationDate="2017-03-03T22:06:07.817" Score="2" ViewCount="651" Body="&lt;p&gt;This is the scenario, a Cisco router with 1 VLAN with 2 or more subnets and a DHCP server inside of one of those subnets.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan1&#xA; ip address 192.168.0.1 255.255.255.0&#xA; ip address 192.168.1.1 255.255.255.0 secondary&#xA; ip address 192.168.2.1 255.255.255.0 secondary&#xA; ...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's say the DHCP server is inside the subnet 192.168.0.1/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the DHCP server be able to broadcast to all clients inside all the subnets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will clients be able to do UDP broadcasts to all the subnets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will clients be able to communicate with clients in another subnet without problems?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers!&lt;/p&gt;&#xA;" OwnerDisplayName="user34559" LastActivityDate="2017-03-04T04:22:58.300" Title="2 or more subnets in 1 VLAN with a DHCP server inside one of the subnets on a Cisco router" Tags="|cisco|vlan|subnet|dhcp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39462" PostTypeId="2" ParentId="39459" CreationDate="2017-03-03T23:25:31.460" Score="1" Body="&lt;p&gt;The host gateways needs to be set to the gateway, which is the address on that network of the device that will route traffic to other networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your access switches are running layer-3, then they should be using routed links to a layer-3 distribution switch. That means the distribution switch does not have addresses in the access networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your access switches are only running at layer-2 (even if they are layer-3 switches), then you have trunks to the layer-3 distribution switch, and the gateway for a client would be the address in its network of the layer-3 distribution switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you really don't want to do is to trunk all the networks to all the switches and set up all the access and distribution switches as layer-3 switches on all the networks. That really defeats the whole purpose of using layer-3 in the first place.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-03T23:25:31.460" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39463" PostTypeId="2" ParentId="39461" CreationDate="2017-03-04T04:22:58.300" Score="2" Body="&lt;p&gt;From the DHCP server's point of view it's no different than any other VLAN and will respond accordingly.  Keep in mind that - without additional information - the server has no idea to which secondary subnet a given client should belong. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP broadcasts map to an L2 broadcast address and so, yes, all clients on the subnet will receive the frame.  That said, though, the broadcast will be ignored by the IP stacks of the clients not in the same subnet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Clients will be able to communicate with one another, assuming they've been configured with the corresponding default gateway.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-03-04T04:22:58.300" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39464" PostTypeId="1" CreationDate="2017-03-04T05:46:15.130" Score="3" ViewCount="232" Body="&lt;p&gt;Can COA be used to change SSID of a device. I am trying to set up packet fence as  captive portal solution. Here is what I found in documentation &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;On wireless networks, the usual PacketFence setup dictate that you configure two SSIDs: an open one and a secure one. The open one is used to help users configure the secure one properly and requires authentication over the captive portal.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I am trying to understand how COA can change SSID on the device &lt;/p&gt;&#xA;" OwnerUserId="34366" LastActivityDate="2017-03-08T11:41:45.083" Title="COA to change SSID" Tags="|wireless|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39467" PostTypeId="1" AcceptedAnswerId="39468" CreationDate="2017-03-04T11:09:39.143" Score="4" ViewCount="236" Body="&lt;p&gt;In a scenario, there are three devices R_A, R_B, R_C and connected as shown in diagram, &lt;a href=&quot;https://i.stack.imgur.com/C3PWI.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C3PWI.jpg&quot; alt=&quot;topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can implement that Link 1 and Link 2 work in active and standby mode i.e. Link 2 will be active if Link 1 get fail other Link 2 on standby where Link 3 active all time with use of  auto cost single IGP process  and vrrp at all devices.  &lt;/p&gt;&#xA;" OwnerUserId="8007" LastEditorUserId="8007" LastEditDate="2017-03-04T12:58:39.980" LastActivityDate="2017-03-04T12:58:39.980" Title="link redundancy" Tags="|routing|router|redundancy|vrrp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39468" PostTypeId="2" ParentId="39467" CreationDate="2017-03-04T11:54:40.880" Score="2" Body="&lt;p&gt;You could achieve this using ospf between R_A and R_B and give the link 1 lower metric&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-03-04T11:54:40.880" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="39469" PostTypeId="2" ParentId="39452" CreationDate="2017-03-04T13:12:41.607" Score="4" Body="&lt;p&gt;When transmitting TCP over IPv4 over Ethernet, there are three levels where checksum (or CRC) is used:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ethernet has 32-bit CRC called frame check sequence (FCS). This is very reliable: for random corruption, it means that 1 in 4 billion packets gets accidentally accepted even though it contains corrupted data. Considering that one packet is typically about a kilobyte, this means that random corruption corrupts your data once per 4 terabytes of corrupted data sent. Unfortunately, Ethernet's FCS is not true end-to-end checksum.&lt;/li&gt;&#xA;&lt;li&gt;IPv4 has 16-bit header checksum. It is calculated using the Internet checksum algorithm. It is much less reliable than Ethernet's FCS, and each router must modify the packet by decrementing hop count (and thus recalculating checksum), so this is not true end-to-end checksum either. Due to the additional workload required on routers, IPv6 has eliminated this checksum.&lt;/li&gt;&#xA;&lt;li&gt;TCP has 16-bit whole data checksum protecting some parts of the IPv4 header, TCP header and all of the data. This is a true end-to-end checksum calculated using the same algorithm as IPv4 header checksum. Unfortunately, there is one in 65536 chance of accepting random corruption, meaning that 64 megabytes of randomly corrupted data sent will be once accepted given a kilobyte segment size.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Because data can be corrupted when in the computer's packet buffer memory, not just when traveling over a link, good protocols implement their own checksumming even when operating over TCP, as the checksum of TCP is not that reliable. None of these three checksums are cryptographic quality. For example, the Git version control system protects all data using cryptographic quality SHA-1 (that unfortunately has been recently found to suffer from collisions...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If TCP was designed today, it surely would use a 32-bit or even 64-bit CRC instead of the 16-bit Internet checksum.&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2017-03-04T13:12:41.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39472" PostTypeId="2" ParentId="39452" CreationDate="2017-03-04T15:18:04.877" Score="1" Body="&lt;p&gt;There is no absolute reliability of data. A checksum is a relatively small and fast way of providing some security that the data are correct, but it is up to the application to ensure that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP does use a checksum, but it does not guarantee the data are correct. The reliability of TCP is because TCP guarantees that the segments are delivered and presented to the application in the proper order. It has mechanisms for requesting lost segments, and it can reorder out-of-order segments.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-04T15:18:04.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39473" PostTypeId="1" AcceptedAnswerId="39476" CreationDate="2017-03-04T15:18:52.137" Score="2" ViewCount="81" Body="&lt;p&gt;I am reading about statistical multiplexing in packet switching and I don't understand one thing. What happens if two packets arrive at router at the same time? Is it possible? If not, why? If yes, how the router knows which bit belongs to which packet?&lt;/p&gt;&#xA;" OwnerUserId="34935" LastEditorUserId="34935" LastEditDate="2017-03-04T15:25:53.340" LastActivityDate="2017-03-04T16:27:29.243" Title="Overlapping in statistical multiplexing" Tags="|routing|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39474" PostTypeId="1" CreationDate="2017-03-04T15:39:19.677" Score="2" ViewCount="393" Body="&lt;p&gt;Given the diagram below, does it make sense to trunk between the L2 access switches? Otherwise, all VLAN 10 and VLAN 20 broadcast domain traffic has to go through the L3 distribution switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thick blue lines are trunks from L2 AS to L3 DS. Red dashed lines are proposed trunks between L2 AS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hatTD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hatTD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34852" LastEditorUserId="8499" LastEditDate="2018-03-02T19:45:08.880" LastActivityDate="2018-03-02T19:45:08.880" Title="Should we trunk between L2 AS switches? Or send everything to the L3 DS?" Tags="|vlan|spanning-tree|trunk|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39475" PostTypeId="2" ParentId="39474" CreationDate="2017-03-04T15:58:32.157" Score="3" Body="&lt;p&gt;Spanning tree will make sure that all traffic from one switch to another switch only has a single path, and that is through the root switch, which really needs to be the distribution switch. The best that you could hope for is that your dashed red lines end up being redundant paths that kick in only when the link to the distribution switch fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP guarantees a loop-free path. The way it does that is to create a single path that is most direct to the root switch. All other paths are placed in blocking. If you had multiple paths that allowed layer-2 loops, then your network would crash with broadcast storms.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;A best practice is to only allow a VLAN on a single switch. You can have multiple VLANs on a switch, but they should not extend to other access switches. The helps eliminate the possibility of STP problems. It is no longer necessary to have everything connected to a layer-2 network. We live in a layer-3 world, and routing has become cheap, and it introduces security points and eliminates STP problems. It used to be, &quot;&lt;em&gt;Switch where you can, route where you must&lt;/em&gt;,&quot; but that is no longer the case.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-04T15:58:32.157" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39476" PostTypeId="2" ParentId="39473" CreationDate="2017-03-04T16:20:18.130" Score="1" Body="&lt;p&gt;I think you are not understanding how different layer-1/2 technologies work. While it may be possible, from a purely layer-1 point of view, to interleave bits on the wire, there are checks in place to prevent that from happening. For instance, ethernet uses CSMA/CD so that only one host can transmit a frame at any given time. If two hosts transmit simultaneously, then there is a collision, and the collision is detected, the transmissions stop, and everything is discarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Entire packets may be multiplexed because packets have labels, such as source and destination addresses, but bits are much more difficult to multiplex because they have no labels. Some protocols, e.g. TDMA, do this by setting aside particular time periods for bits from a particular source, but that does waste bandwidth if the sources with other time periods do not send anything; a source cannot use the time periods for other devices. It boils down to setting things up so that only one device can transmit on a channel at any one time.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-04T16:27:29.243" LastActivityDate="2017-03-04T16:27:29.243" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39480" PostTypeId="1" CreationDate="2017-03-04T19:25:26.433" Score="1" ViewCount="139" Body="&lt;p&gt;I'm currently puzzled by why a switch works only when in unmanaged mode. If I enable Management mode, using default configuration, things break down. Here's the current situation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                        VL60        TRUNK&#xA;    PC --------- SW1 ------- SW2 ------------ RT&#xA;10.0.0.1/24    &amp;lt;none&amp;gt;       &amp;lt;none&amp;gt;       10.0.0.254/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;SW1 is a Dell 2848 operating in unmanaged mode  &lt;/li&gt;&#xA;&lt;li&gt;SW2 is an Arista 7048-A running in managed mode&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Given the above, everything WORKS. &lt;code&gt;PC&lt;/code&gt; can reach its default gateway (&lt;code&gt;RT&lt;/code&gt;) and anywhere else is properly routed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;However, if I change &lt;code&gt;SW1&lt;/code&gt; to managed mode, &lt;code&gt;PC&lt;/code&gt; cannot ping &lt;code&gt;RT&lt;/code&gt;.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've factory reset SW1 and don't see anything out of the ordinary. Looking at status, the ports are up and forwarding. Any port on &lt;code&gt;SW1&lt;/code&gt; can ping any other port on itself. If I ping from PC, I can see the lights blinking on both SW1's incoming (from PC) and outgoing (to SW2) ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to the Dell user manual for the 2848, here are the changes when in management mode:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Switch can be managed through the web interface.&lt;/li&gt;&#xA;&lt;li&gt;Managed Mode LED is ON.&lt;/li&gt;&#xA;&lt;li&gt;Device uses the saved running configuration (if it exists) or the default configuration.&lt;/li&gt;&#xA;&lt;li&gt;The current running configuration is automatically saved to local storage. If the system is switched to unmanaged mode via the Managed Mode button, the system does not load the saved configuration, but it is still maintained in the device’s local storage.&lt;/li&gt;&#xA;&lt;li&gt;From Managed mode, you can move to Unmanaged mode by pressing the Mode button on the&#xA;device, or you can move to Secure mode using the web interface&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;None of which looks like the underlying cause... What am I missing?&lt;/p&gt;&#xA;" OwnerUserId="13988" LastActivityDate="2017-03-04T19:25:26.433" Title="Unexpected behavior when changing switch from unmanaged to managed mode" Tags="|switch|ipv4|dell|arista|" AnswerCount="0" CommentCount="5" ClosedDate="2019-02-10T17:58:50.860" ContentLicense="CC BY-SA 3.0" />
  <row Id="39483" PostTypeId="1" AcceptedAnswerId="39732" CreationDate="2017-03-05T00:52:33.213" Score="3" ViewCount="345" Body="&lt;p&gt;Network community,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am testing a Juniper virtual-SRX (D.70).  When configured on a desktop the vSRX works wonderfully (fully functional/connected OSPF router), however when I plug it into the rest of the network, it is not able to retrieve any LLDP information.  (Note: In this instance, there were no virtual bridges)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Configuration using virtual-bridge&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the links were configured using virtual bridges, the vSRX could see all of its *virtual LLDP neighbors, but again, could not see out to the rest of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect to a &lt;em&gt;physical&lt;/em&gt; Juniper/Cisco router, they are of course able to see the network, but are not able to see the directly connected vSRX.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;All ports are set to promiscuous mode as specified by Juniper for installation&lt;/li&gt;&#xA;&lt;li&gt;All firewall/security functionality was deleted and flow status is set to &quot;packet-based&quot;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any help would be appreciated.  I have a feeling it has to do with the virtual bridge configuration.  Will follow up once I have a solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you again,&lt;/p&gt;&#xA;" OwnerUserId="23081" LastActivityDate="2017-03-15T18:40:44.460" Title="Virtual Bridges do not seem to be carrying LLDP information" Tags="|routing|juniper|juniper-junos|virtual|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39485" PostTypeId="1" CreationDate="2017-03-05T05:31:30.653" Score="4" ViewCount="91" Body="&lt;p&gt;Even after the spanning tree is determined why Root Bridge periodically send configuration message.  &lt;/p&gt;&#xA;" OwnerUserId="34956" LastActivityDate="2017-03-05T07:29:09.083" Title="Even after the spanning tree is determined why Root Bridge periodically send configuration message." Tags="|cisco|protocol-theory|spanning-tree|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39488" PostTypeId="2" ParentId="39485" CreationDate="2017-03-05T07:29:09.083" Score="3" Body="&lt;p&gt;The root bridge will keep sending Periodic configuration message with the Root Identifier and the Bridge Identifier would be the same as the Bridge think it is the root, This message will be relayed to all the bridges participating in the spanning tree and each bridge will add its cost to the root before sending it out to all its neighbours on the designated ports, this message will be like keep alive message from the root bridge to all the bridges and in case the root stop sending for max-age time that will trigger new root election.&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-03-05T07:29:09.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39490" PostTypeId="2" ParentId="37036" CreationDate="2017-03-05T17:20:57.637" Score="0" Body="&lt;p&gt;Thank you rnxrx,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We actually ended up going back and systematically creating/scripting a virtual bridge for each interface.  Then assigned those virtual bridges to the virtual routers, instead of the physical interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Although, for the time being, all interfaces are still set to promiscuous mode.&lt;/p&gt;&#xA;" OwnerUserId="23081" LastActivityDate="2017-03-05T17:20:57.637" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39492" PostTypeId="2" ParentId="39377" CreationDate="2017-03-05T20:54:23.830" Score="2" Body="&lt;ol&gt;&#xA;&lt;li&gt;Differences in manufacturing and different types of optics ( SR,LR, ZR.. Brands.. ) &lt;/li&gt;&#xA;&lt;li&gt;It is dependent on the specific optic ( varies per each unique optic ), it is specified for the type of transceiver by the manufacturer in the datasheet. It is not a dynamic value.&lt;/li&gt;&#xA;&lt;li&gt;This is usually good enough for rough measurements but can not be considered to be as good as a proper attenuation measurement done with calibrated instrument. This measurement is also only at one wavelenght for obvious reasons. &#xA;I have used optical values from 'show int tran' many times for finding out headroom before CWDM/DWDM filter inserts etc and it has been good enough for that use. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34970" LastActivityDate="2017-03-05T20:54:23.830" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39493" PostTypeId="1" AcceptedAnswerId="39495" CreationDate="2017-03-05T21:06:48.083" Score="5" ViewCount="3108" Body="&lt;p&gt;I'm currently using a Cisco ASA 5512-X to establish an IKEv1 VPN with an Amazon Web Services VPC. I'm using BGP to advertise the route as per &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/200982-ASA-IPsec-VTI-connection-Amazon-Web-Serv.html&quot; rel=&quot;noreferrer&quot;&gt;this example&lt;/a&gt;. So far everything is working great, my local network (172.16.2.0/24) is advertising its availability, and my AWS VPC (172.24.0.0/16) is doing the same. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The one thing I can't figure out, is how to add additional static routes to my BGP table. For example, my local network (that AWS sees) is 172.16.2.0/24. My client VPN's subnet is 172.16.252.0/24, also served by the ASA. I need to somehow tell the ASA to advertise the 172.16.252.0/24 network in it's BGP advertisements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've looked through the docs and haven't found anything obvious. Anyone have any experience with the newish BGP features in the ASAs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm running 9.7(1) for what it's worth, here is my ASA's &quot;router&quot; config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 65000&#xA; bgp log-neighbor-changes&#xA; timers bgp 10 30 0&#xA; address-family ipv4 unicast&#xA;  neighbor 169.254.45.189 remote-as 7224&#xA;  neighbor 169.254.45.189 activate&#xA;  neighbor 169.254.46.229 remote-as 7224&#xA;  neighbor 169.254.46.229 activate&#xA;  network 172.16.2.0 mask 255.255.255.0&#xA;  network 172.16.252.0 mask 255.255.255.0&#xA;  redistribute static&#xA;  no auto-summary&#xA;  no synchronization&#xA; exit-address-family&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the show bgp output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# sh bgp&#xA;&#xA;BGP table version is 26, local router ID is 172.16.2.1&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale, m multipath&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop        Metric LocPrf Weight  Path&#xA;*&amp;gt; 172.16.2.0/24    0.0.0.0              0         32768  i&#xA;*&amp;gt; 172.24.0.0       169.254.45.189     100             0  7224 i&#xA;*                   169.254.46.229     200             0  7224 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34972" LastEditorUserId="8499" LastEditDate="2017-03-05T21:11:02.083" LastActivityDate="2017-03-05T23:31:13.553" Title="Advertise static route via BGP from Cisco ASA 5512-x" Tags="|cisco|cisco-asa|vpn|bgp|ike|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39494" PostTypeId="2" ParentId="9404" CreationDate="2017-03-05T22:52:47.780" Score="1" Body="&lt;p&gt;The real answer is it's complicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Latency is made up of multiple components.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Time spent travelling through the physical medium&lt;/li&gt;&#xA;&lt;li&gt;Time spent sitting in queues&lt;/li&gt;&#xA;&lt;li&gt;Time spent serialising and deserialising data&lt;/li&gt;&#xA;&lt;li&gt;Time spent in processing&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Time spent travelling through the physical medium can only be changed by choosing a different physical medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Time spent sitting in queues will generally be reduced by having faster links. So will time spent serialising and de-serialising data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The effects on processing can get complicated. If the processing step stays the same then it will generally take less time at a faster data rate. However techniques designed to extract more bandwidth from existing links may also introduce additional processing delays. A classic example of this is DSL interleaving.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-05T22:52:47.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39495" PostTypeId="2" ParentId="39493" CreationDate="2017-03-05T23:31:13.553" Score="4" Body="&lt;p&gt;I believe the feature you are looking for is &quot;&lt;strong&gt;Reverse Route Injection&lt;/strong&gt;&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Reverse route injection (RRI) is the ability for static routes to be&#xA;  automatically inserted into the routing process for those networks and&#xA;  hosts protected by a remote tunnel endpoint. These protected hosts and&#xA;  networks are known as remote proxy identities.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Each route is created on the basis of the remote proxy network and&#xA;  mask, with the next hop to this network being the remote tunnel&#xA;  endpoint. By using the remote Virtual Private Network (VPN) router as&#xA;  the next hop, the traffic is forced through the crypto process to be&#xA;  encrypted.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;By default, an ASA will not include VPN-tunneled routes into the routing table.  Since they are not technically in the routing table, BGP cannot advertise them with a &lt;code&gt;network&lt;/code&gt; statement.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setting a Reverse-Route allows the route to be injected into the routing table.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is enable in the crypto map portion of the VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Example:&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;crypto map LOCAL_TO_REMOTE_MAP 10 match address LOCAL_TO_REMOTE_ACL&#xA;crypto map LOCAL_TO_REMOTE_MAP 10 set peer 203.0.113.0.6&#xA;crypto map LOCAL_TO_REMOTE_MAP 10 set ikev1 transform-set LOCAL_TO_REMOTE_TRANSFORM_SET&#xA;crypto map LOCAL_TO_REMOTE_MAP 10 set reverse-route&#xA;crypto map LOCAL_TO_REMOTE_MAP interface OUTSIDE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More details and usage can be found here:&#xA;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/xe-16/sec-vpn-availability-xe-16-book/sec-rev-rte-inject.html#GUID-30538C61-6729-4DEC-A7E3-3FBF1DC446B1&quot; rel=&quot;noreferrer&quot;&gt;https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnav/configuration/xe-16/sec-vpn-availability-xe-16-book/sec-rev-rte-inject.html#GUID-30538C61-6729-4DEC-A7E3-3FBF1DC446B1&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2017-03-05T23:31:13.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39497" PostTypeId="1" CreationDate="2017-03-06T07:47:43.683" Score="6" ViewCount="1009" Body="&lt;p&gt;I'm learning about Ethernet and the sources I've found seem to be controversial regarding the role of the physical sublayers of Ethernet displayed on the following image.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/uvSem.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uvSem.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just to mention an example for that: the en.wikipedia.org/wiki/Physical_Medium_Dependent Wikipedia page says the transmitters/receivers are located in the PMD layer while the &lt;a href=&quot;http://docwiki.cisco.com/wiki/Ethernet_Technologies#The_802.3_Physical_Layer_Relationship_to_the_ISO_Reference_Model.&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Technology Handbook&lt;/a&gt; states they're located in the PMA. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;What are the roles exactly of the reconciliation, PLS, PCS, MII, PMA and PMD sublayers?&lt;/li&gt;&#xA;&lt;li&gt;Does the reconciliation sublayer handle errors, also is one of its responsibilities to hide the different MII interfaces from the MAC layer?&lt;/li&gt;&#xA;&lt;li&gt;Where is line encoding like NRZ/NRZI performed?&lt;/li&gt;&#xA;&lt;li&gt;Where is scrambling/descrambling done?&lt;/li&gt;&#xA;&lt;li&gt;Where is signaling like MLT performed?&lt;/li&gt;&#xA;&lt;li&gt;Where is auto negotiation performed? Some sources say it's done in the PCS, some displayed it separately below the PMD layer.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34570" LastEditorUserId="34570" LastEditDate="2017-03-12T22:12:44.250" LastActivityDate="2023-04-02T10:16:04.727" Title="Responsibility of the physical sublayers of Ethernet" Tags="|ethernet|osi|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39499" PostTypeId="1" CreationDate="2017-03-06T11:05:02.107" Score="1" ViewCount="694" Body="&lt;p&gt;I am working on a WAN setup. Normally, the user IPs are assigned using DHCP, but users accidentally set their IP to static, which can causes 2 computers in network have same IP in same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I detect this situation? And what is the best practices to handle?&lt;/p&gt;&#xA;" OwnerUserId="34985" LastActivityDate="2017-03-07T21:10:01.457" Title="How to detect IP conflict in WAN and best practices" Tags="|dhcp|wan|network|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-17T05:00:07.570" ContentLicense="CC BY-SA 3.0" />
  <row Id="39500" PostTypeId="1" AcceptedAnswerId="41457" CreationDate="2017-03-06T11:43:14.730" Score="1" ViewCount="78" Body="&lt;p&gt;Modern wifi systems increasingly use beamforming to spatially divide the stream. For this to work, the radio must be able to calculate the relative position of the client. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to access this data?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Clarification: I am trying to figure out if it is doable to track the location of wifi devices through this mechanism, and what approach is the most promising. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only resources I found so far are scholarly articles.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="34987" LastEditorUserId="34847" LastEditDate="2017-03-10T07:31:09.530" LastActivityDate="2017-05-25T06:43:39.327" Title="I want to access positioning data from mimo beamforming. Is it possible to access this?" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="6" ClosedDate="2019-02-05T02:11:06.757" ContentLicense="CC BY-SA 3.0" />
  <row Id="39504" PostTypeId="1" CreationDate="2017-03-06T14:01:52.583" Score="2" ViewCount="1246" Body="&lt;p&gt;I have below setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+------------------+         vPC           +------------------+&#xA;|                  |                       |                  |&#xA;|  NX5K-SW01       +-----------------------+       NX5K-SW02  |&#xA;|                  |                       |                  |&#xA;+------------------+--+                 +--+------------------+&#xA;                      |                 |&#xA;                      |                 |&#xA;                      |                 |&#xA;               FET1   |                 |  FET2&#xA;                      |                 |&#xA;                      |                 |&#xA;                      |                 |&#xA;                 +----+-----------------+----+&#xA;                 |                           |&#xA;                 |             NX2K          |&#xA;                 |                           |&#xA;                 +---------+-----+-----------+&#xA;                           |     |&#xA;                           |     |&#xA;                           |     |&#xA;                           |     Eth101/1/37&#xA;                           |     +&#xA;                   Eth101/1/38   |&#xA;                           +     |&#xA;                           |     |&#xA;                  +--------+-----+--------+&#xA;                  |                       |&#xA;                  |     Cisco ASA         |&#xA;                  |                       |&#xA;                  +-----------------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Eth101/1/37&lt;/code&gt; and &lt;code&gt;Eth101/1/38&lt;/code&gt; are members of port-channel 22, which is utilized for voice traffic (RTP). Now, when I look at the link utilization, I see below numbers (it's the same on NX5k-SW02 obviously):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NX5K-SW01# show port-channel traffic interface port-channel 22&#xA;ChanId      Port Rx-Ucst Tx-Ucst Rx-Mcst Tx-Mcst Rx-Bcst Tx-Bcst&#xA;------ --------- ------- ------- ------- ------- ------- -------&#xA;22  Eth101/1/38    0.0%    0.0%  50.00%   1.62%    0.0%    0.0%&#xA;22  Eth101/1/37    0.0% 100.00%  49.99%  98.37%    0.0% 100.00%&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;loadbalancing is default on NX5k switches:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NX5K-SW01# show port-channel load-balance&#xA;&#xA;Port Channel Load-Balancing Configuration:&#xA;System: source-dest-ip&#xA;&#xA;Port Channel Load-Balancing Addresses Used Per-Protocol:&#xA;Non-IP: source-dest-mac&#xA;IP: source-dest-ip source-dest-mac&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and on the ASA it is:  &lt;code&gt;src-dst-ip&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA has other port-channel connections to NX2k, which are showing normal loadbalancing 50/50.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any idea why this port-channel is behaving like this?&lt;/p&gt;&#xA;" OwnerUserId="539" LastEditorUserId="8499" LastEditDate="2018-12-25T04:11:34.273" LastActivityDate="2018-12-25T04:11:34.273" Title="Unbalanced port-channel utilization" Tags="|cisco|cisco-asa|load-balancing|cisco-nexus-5k|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39506" PostTypeId="2" ParentId="39504" CreationDate="2017-03-06T14:22:52.380" Score="1" Body="&lt;p&gt;The load balancing on a port channel is per flow. All the traffic in a single flow will use the same port channel member. Each flow is limited to a single physical link, but different flows will use different links. The way you have it configured, a flow is determined by the source and destination IP and MAC addresses on the Nexus, meaning that any traffic with the same values for those will always use the same port channel member. There is a hash algorithm that determines which flows use which port channel members, and it is only when you have multiple flows between different devices that you get load balancing across the different links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You seem to be sending traffic on that port channel from a single source to a single destination, and that traffic will always use the same port channel member. It is also possible that you have multiple flows that just happen to hash to the same port channel member.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you were to load balance individual frames, rather than flows, you will end up with problems created by out-of-order packet delivery. That would be especially and extremely detrimental to VoIP.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-06T15:45:05.680" LastActivityDate="2017-03-06T15:45:05.680" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39508" PostTypeId="5" CreationDate="2017-03-06T15:14:37.090" Score="0" Body="" OwnerUserId="-1" LastEditorUserId="-1" LastEditDate="2017-03-06T15:14:37.090" LastActivityDate="2017-03-06T15:14:37.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39509" PostTypeId="4" CreationDate="2017-03-06T15:14:37.090" Score="0" Body="For questions about Packet INternet Groper [PING].  " OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2017-03-06T15:41:06.910" LastActivityDate="2017-03-06T15:41:06.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39518" PostTypeId="1" CreationDate="2017-03-07T08:34:22.310" Score="4" ViewCount="1193" Body="&lt;p&gt;I have a Cisco 1841 router with an HWIC-4ESW switchport module attached to it. Fa0/0 is connected to ISP1 and Fa0/1 to ISP2 and both are &quot;ip nat outside&quot;, the switchports are in interface Vlan 1, which has an IP address 192.168.0.1/24 and is &quot;ip nat inside&quot;. Here is the config. (I have changed the IP addresses for posting here).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 3495 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;ip cef&#xA;!&#xA;!&#xA;no ip dhcp use vrf connected&#xA;ip dhcp excluded-address 192.168.0.1&#xA;ip dhcp excluded-address 192.168.0.22&#xA;ip dhcp excluded-address 192.168.0.6&#xA;ip dhcp excluded-address 192.168.0.5&#xA;ip dhcp excluded-address 192.168.0.7&#xA;ip dhcp excluded-address 192.168.0.3&#xA;ip dhcp excluded-address 192.168.0.101&#xA;ip dhcp excluded-address 192.168.0.19&#xA;ip dhcp excluded-address 192.168.0.18&#xA;ip dhcp excluded-address 192.168.0.23&#xA;ip dhcp excluded-address 192.168.0.24&#xA;ip dhcp excluded-address 192.168.0.35&#xA;ip dhcp excluded-address 192.168.0.17&#xA;!&#xA;ip dhcp pool HSI&#xA;network 192.168.0.0 255.255.255.0&#xA;default-router 192.168.0.1&#xA;dns-server 1.1.1.1 192.168.0.1 1.1.3.7 1.1.2.233 1.1.2.129 8.8.8.8&#xA;!&#xA;!&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;archive&#xA;log config&#xA;hidekeys&#xA;!&#xA;!&#xA;!&#xA;track 1 rtr 1 reachability&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA;description Primary Route&#xA;ip address 1.1.1.165 255.255.255.0&#xA;ip nat outside&#xA;ip virtual-reassembly&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA;description Backup Route&#xA;ip address 1.1.2.132 255.255.255.128&#xA;ip nat outside&#xA;ip virtual-reassembly&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface FastEthernet0/0/0&#xA;!&#xA;interface FastEthernet0/0/1&#xA;!&#xA;interface FastEthernet0/0/2&#xA;!&#xA;interface FastEthernet0/0/3&#xA;!&#xA;interface Vlan1&#xA;ip address 192.168.0.1 255.255.255.0&#xA;ip nat inside&#xA;ip virtual-reassembly&#xA;!&#xA;ip forward-protocol nd&#xA;ip route 0.0.0.0 0.0.0.0 1.1.1.3 track 1&#xA;ip route 0.0.0.0 0.0.0.0 1.1.2.130 3&#xA;!&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;ip nat inside source list 10 interface FastEthernet0/0 overload&#xA;ip nat inside source list 20 interface FastEthernet0/1 overload&#xA;ip nat inside source static tcp 192.168.0.22 80 1.1.1.160 80 extendable&#xA;ip nat inside source static tcp 192.168.0.6 80 1.1.1.163 80 extendable&#xA;ip nat inside source static tcp 192.168.0.5 21 1.1.1.165 21 extendable&#xA;ip nat inside source static tcp 192.168.0.5 22 1.1.1.165 22 extendable&#xA;ip nat inside source static tcp 192.168.0.5 80 1.1.1.165 80 extendable&#xA;ip nat inside source static tcp 192.168.0.7 80 1.1.1.165 83 extendable&#xA;ip nat inside source static tcp 192.168.0.3 80 1.1.1.165 86 extendable&#xA;ip nat inside source static tcp 192.168.0.101 80 1.1.1.165 87 extendable&#xA;ip nat inside source static tcp 192.168.0.19 80 1.1.1.168 80 extendable&#xA;ip nat inside source static tcp 192.168.0.18 80 1.1.1.169 80 extendable&#xA;ip nat inside source static tcp 192.168.0.23 9100 1.1.1.183 9100 extendable&#xA;ip nat inside source static tcp 192.168.0.24 9100 1.1.1.184 9100 extendable&#xA;ip nat inside source static tcp 192.168.0.35 80 1.1.1.187 80 extendable&#xA;ip nat inside source static tcp 192.168.0.7 80 1.1.1.200 80 extendable&#xA;ip nat inside source static tcp 192.168.0.17 80 1.1.1.201 80 extendable&#xA;!&#xA;ip sla 1&#xA;icmp-echo 1.1.1.3&#xA;timeout 6000&#xA;frequency 10&#xA;ip sla schedule 1 life forever start-time now&#xA;access-list 10 permit 192.168.0.0 0.0.0.255&#xA;access-list 20 permit 192.168.0.0 0.0.0.255&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line vty 0 4&#xA;login&#xA;!&#xA;scheduler allocate 20000 1000&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &quot;ip nat inside source static&quot; statements are for websites that are hosted on a server in VLAN 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that this configuration didn't work - I could ping the Internet from the router, but not from the PCs in Vlan 1. From them I could ping the router's outside interfaces and no further. I removed the &quot;ip nat outside&quot; from Fa0/1 (the backup route) and this fixed that problem, but then I didn't have failover functionality. I thought there may be some problem with the NAT, so I tried with a route-map:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 100 permit ip 192.168.0.0 0.0.0.255 any&#xA;&#xA;route-map isp1 permit 10&#xA;match ip address 100&#xA;match interface FastEthernet0/0&#xA;&#xA;route-map isp2 permit 10&#xA;match ip address 100&#xA;match interface FastEthernet0/1&#xA;&#xA;ip nat inside source route-map isp1 interface FastEthernet0/0 overload&#xA;ip nat inside source route-map isp2 interface FastEthernet0/1 overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, after that there is no connectivity at all (can't ping Fa0/0 or Fa0/1 from the router itself).&#xA;Help will be greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="21387" LastEditorUserId="21387" LastEditDate="2017-04-05T13:21:13.517" LastActivityDate="2017-04-05T13:21:13.517" Title="Dual ISP NAT Failover Not Working" Tags="|cisco|cisco-ios|failover|" AnswerCount="0" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39521" PostTypeId="1" CreationDate="2017-03-07T11:41:56.013" Score="3" ViewCount="1510" Body="&lt;p&gt;I have hit a bit of a snag when setting up a series of VLANs, I am trying to have one PC that is able to access multiple VLANs, but at the same time not having the different VLANs being connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch in question is a Netgear GS724Tv4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To simplify my setup I have three computers, connected to port 1, 2 and 3.&#xA;What I wish to achieve is two VLANs (+ default);&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN1 (default) = Computer 1  &#xA;VLAN4 = Computer 1 and 2&#xA;VLAN5 = Computer 1 and 3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am trying to communicate with both computer 2 and 3 from Computer 1, but limiting 2 and 3 to not see each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an image of the Port PVID Configuration of the switch, were you can see the port VLAN membership as well;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hRtCP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hRtCP.png&quot; alt=&quot;PVID Configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently trying to send a ping-request from Computer 1 to either Computer 2 or 3, but am getting &lt;code&gt;Request timed out.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I bypass the switch and connect the devices directly I get a response from the ping. Any ideas on what I am doing wrong?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;My IP configuration is;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Computer 1: 192.168.0.31&#xA;Computer 2: 192.168.0.48&#xA;Computer 3: 192.168.0.49&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35007" LastEditorUserId="35007" LastEditDate="2017-03-08T09:03:47.073" LastActivityDate="2018-04-25T08:19:25.853" Title="Netgear GS724Tv4 one port connected to multiple VLANs" Tags="|switch|vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39522" PostTypeId="1" CreationDate="2017-03-07T12:26:56.163" Score="22" ViewCount="22754" Body="&lt;p&gt;Actually I am learning Computer Networks and while at it, I am confused in &lt;strong&gt;how a web server maintains multiple connections?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Simply to state, I learned trough some googling is that sockets handles a each client request. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So lets say there is a web server and lets say 2 clients with IPs &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Client A: 5.5.5.5&#xA;Client B: 10.10.10.10 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;They both try to connect to the server at &lt;strong&gt;port 80.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, from googling what I got is, the server listens at &lt;strong&gt;port 80&lt;/strong&gt; for incoming requests. Then lets say a &lt;strong&gt;client A&lt;/strong&gt; tries to connect to the server (make TCP/IP connection). During which a socket is created between these two. Then it is executed as separate thread for its further communication making the server to again listen for other client requests at that particular port. And &lt;strong&gt;Client B&lt;/strong&gt; connects the same way. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my first question is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1. How does server communicate with these two clients simultaneously  &#xA;   after the connection has been established?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now practically not only 2 clients but thousands and millions user may connect to a server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then my next question is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2. Now, how do those thousands of clients get connected to a single server?&#xA;&#xA;   If we assume every client is connected to the server through wire, it is not &#xA;   practically possible to maintain that many sockets on a hardware for&#xA;   connection. How those thousands connections are made and handled?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Lastly, my 3rd question is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;3. Above I said (actually heard) how **client A** connected to the the server&#xA;   and similarly the client B.&#xA;&#xA;   But I didn't get the part stating &quot;after a TCP/IP connection is made they&#xA;   continue separately in a separate socket and making server to listen for &#xA;   other client requests.&quot; What does that mean? If one client is communicating&#xA;   to the server, how come other can communicate at the same time to same server.&#xA;&#xA;   Isn't it like while a student is asking question to a teacher, other can't&#xA;   ask at the same time since that particular student is busy or occupying the&#xA;   teacher at the moment so others should wait, which we compare than client B &#xA;   should wait when client A is communicating.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These are my basics questions that I'm not getting. Please correct me if I'm getting it all wrong. You can suggest me some books/pdfs to read if the answers are detailed or not partiularly focused on specific part. Thanks&lt;/p&gt;&#xA;" OwnerUserId="35005" LastEditorUserId="8499" LastEditDate="2017-07-16T00:22:03.573" LastActivityDate="2017-07-16T00:22:03.573" Title="How multiple client connections are made to single web server?" Tags="|tcp|network|layer4|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39525" PostTypeId="1" AcceptedAnswerId="39565" CreationDate="2017-03-07T14:12:21.103" Score="1" ViewCount="120" Body="&lt;p&gt;I have a Cisco 3925 on 15.01. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm attempting to allow machines on the Engineering network to access a webserver on the Management network on VLAN10 through a Static NAT.  The webserver on the Management network is configured for 192.168.1.125.  Any Engineering machine can hit the main page of the website at &lt;a href=&quot;https://10.230.32.132&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://10.230.32.132&lt;/a&gt; but as soon as I click on a link on the web page NAT appears to stop working.  I can see it attempting to load the next webpage from 192.168.1.125 rather than 10.230.32.132 as I think it should until it times out.  All webpages loaded from this web server should appear to be loaded from 10.230.32.132 from the perspective of any machine on the Engineering network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specific machines on the Management network are allowed to access the internet through interface gi/0/0 but machines on the engineering network are not.  That last bit may not be relevant.  The webserver also has access to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Relevant settings here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface gi0/1.10  &#xA; description Management Network  &#xA; ip address 192.168.1.1 255.255.255.128  &#xA; ip nat inside  &#xA; encapsulation dot1Q 10  &#xA;&#xA;Interface gi0/2  &#xA; description Engineering Network  &#xA; ip address 10.230.32.132 255.255.255.0  &#xA; ip nat outside  &#xA;&#xA;Interface gi0/0/0  &#xA; description Connection to the Internet  &#xA; ip address x.x.x.x 255.255.255.240  &#xA; ip nat outside  &#xA;&#xA;ip nat inside source list 1 interface GigabitEthernet0/0 overload  &#xA;ip nat inside source static 192.168.1.125 10.230.32.132  &#xA;ip route 0.0.0.0 0 0.0.0.0 X.X.X.X &amp;lt;-- default gateway to the internet.  &#xA;&#xA;access-list 1 permit 192.168.1.111  &#xA;access-list 1 permit 192.168.1.121  &#xA;access-list 1 permit 192.168.1.125  &#xA;access-list 1 deny any  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any suggestions on how I can fix this?&lt;/p&gt;&#xA;" OwnerUserId="35011" LastEditorUserId="509" LastEditDate="2017-03-07T14:14:55.470" LastActivityDate="2017-03-10T19:48:34.477" Title="Static NAT fails to continue NATing" Tags="|cisco|nat|cisco-ios|" AnswerCount="2" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="39526" PostTypeId="2" ParentId="39522" CreationDate="2017-03-07T14:38:49.660" Score="9" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Now, from googling what I got is, the server listens at port 80 for incoming requests.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Indeed, more specifically there is a special type of socket called a &quot;listening&quot; socket.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally a socket is associated with a combination of local IP, local port, remote IP and remote port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A listening socket is different. It is not associated with any specific remote IP and port. It is associated with a specific local port. It may or may not be associated with a specific local IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally your web server will have a listening socket with a local port of 80 &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Then lets say a client A tries to connect to the server (make TCP/IP connection). During which a socket is created between these two. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A pair of sockets actually one on the client, one on the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client application creates a socket and asks the client OS to connect it to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client OS allocates a random local port, chooses a local IP (normally based on which interface the packet will be sent out on) and fills in the remote IP and port requested by the client application. Then it starts the process of connecting to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server OS notifies the holder of the listening socket that a new connection is coming in. The server application accepts the connection and a new socket is created to handle it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Multiple threads or even processes may monitor the same listing socket. The OS will ensure that exactly one of them gets to accept a given connection.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Then it is executed as separate thread for its further communication&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is up to the implementer of the server application. They may choose to use multiple threads or they may choose to use an API like &quot;select&quot; or &quot;poll&quot; that allows a single thread to monitor multiple sockets for activity.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;How does server communicate with these two clients simultaneously&lt;br&gt;&#xA;  after the connection has been established?&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The server OS will match the packets against sockets by the combination of source IP, source port, destination IP and destination port and deliver them to the appropriate socket.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;&lt;p&gt;Now, how do those thousands of clients get connected to a single server?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If we assume every client is connected to the server through wire, it is not &#xA;  practically possible to maintain that many sockets on a hardware for&#xA;  connection. How those thousands connections are made and handled?&lt;/p&gt;&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&quot;Socket&quot; in this context does not refer to a physical socket, just to a data structure within the operating system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still there are limits, thousands is easilly doable on a modern server, millions gets difficult.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Isn't it like while a student is asking question to a teacher, other can't&#xA;     ask at the same time since that particular student is busy or occupying the&#xA;     teacher at the moment so others should wait, which we compare than client B &#xA;     should wait when client A is communicating.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Computers are much better at splitting their attention than people are. Obviously if the server has only one processor core it can only be doing one thing at a time but if it can switch between things quickly enough the clients won't notice that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And of course many servers nowadays do have multiple processor cores.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A new connection, not socket, gets created. I think you are extending the OP's confusion about what a socket is.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It seems the problem is that the rfc differs from actual practice in it's definition of socket.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just went and looked up the documentation for &quot;accept&quot; for three major operating systems, all of them talk about accept creating a new socket. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://man7.org/linux/man-pages/man2/accept.2.html&quot; rel=&quot;noreferrer&quot;&gt;http://man7.org/linux/man-pages/man2/accept.2.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.freebsd.org/cgi/man.cgi?query=accept&amp;amp;sektion=2&quot; rel=&quot;noreferrer&quot;&gt;https://www.freebsd.org/cgi/man.cgi?query=accept&amp;amp;sektion=2&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://msdn.microsoft.com/en-us/library/windows/desktop/ms737526%28v=vs.85%29.aspx&quot; rel=&quot;noreferrer&quot;&gt;https://msdn.microsoft.com/en-us/library/windows/desktop/ms737526%28v=vs.85%29.aspx&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-03-08T22:00:21.347" LastActivityDate="2017-03-08T22:00:21.347" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39528" PostTypeId="1" CreationDate="2017-03-07T16:06:17.387" Score="2" ViewCount="2371" Body="&lt;p&gt;So my boss has tasked me with setting up a SonicWall NSA 2400 we have lying around to act as a backup in case our current Firewall goes down for whatever reason. He doesn't want the high availability option, just wants to be able to unplug the current firewall and hookup the backup in the event of downtime.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We don't know what the old setup is on the 2400, so based on several tutorials, I've put taken the following steps to put the appliance into safe mode so I can use the default IP address for port X0:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Take a paperclip and press the small reset button&lt;/li&gt;&#xA;&lt;li&gt;Hold until the amber test light comes on&lt;/li&gt;&#xA;&lt;li&gt;Once the light begins blinking, the device should be in Safe mode.&lt;/li&gt;&#xA;&lt;li&gt;Set a static IP address for the computer you're using to connect to the appliance that falls into the same subnet as that of the appliance.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;According to the tutorials, the default IP of port X0 should, at this point, be 192.168.168.168, subnet mask 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried setting my computer up with the three different static IP addresses, with no luck so far:&#xA;192.168.168.1&lt;br&gt;&#xA;192.168.168.4&lt;br&gt;&#xA;192.168.168.20&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've made sure that I'm connected to the X0 port on the appliance, and even tried switching to the X1 port as a last ditch effort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my first time working with a FireWall appliance, so I'm wondering if I'm missing something obvious?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One possible issue is that I don't have the WAN port connected to the internet. My boss doesn't want me to disconnect our current Firewall, so I can't connect the backup directly to the internet, and he doesn't want me to risk causing interference on the network, so he'd like me to try setting up the FireWall without connecting the WAN port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My impression, based on what I've read, is that this is the most likely issue, but I'm hoping that's not the case. If it is, is there a way to hook it up without interfering with the rest of the network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, I'm trying to connect using a Mac with Safari, which according to the documentation is an approved browser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any and all help/advice is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="35013" LastActivityDate="2017-06-24T19:40:04.593" Title="Can't connect to SonicWall NSA 2400 whether in/not in Safe Mode" Tags="|firewall|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39529" PostTypeId="1" CreationDate="2017-03-07T18:51:25.343" Score="3" ViewCount="837" Body="&lt;p&gt;I'm trying to configure a Juniper EX4200 switch. Usually packets are statically forwarded to me, but this time they are VLAN tagged. Here is my configuration :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interfaces {&#xA;    ge-0/0/0 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    // ...&#xA;     ge-0/0/46 {&#xA;        unit 0 {&#xA;            family ethernet-switching;&#xA;        }&#xA;    }&#xA;    vlan {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address // The /29 configured on the next switch.&#xA;            }&#xA;        }&#xA;        unit 100 {&#xA;            family inet {&#xA;                address // End user's IPs.&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop // Gateway of the /29 on the next switch.;&#xA;    }&#xA;}&#xA;&#xA;vlans {&#xA;    TEST_VLAN {&#xA;        vlan-id 100;&#xA;        interface {&#xA;            ge-0/0/46.0;&#xA;        }&#xA;        l3-interface vlan.100;&#xA;    }&#xA;    default {&#xA;        l3-interface vlan.0;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The uplink is connected to switch port 0 and the end user (downlink) connected to switch port 46. I can SSH into the switch, but cannot get end user's IP addresses to respond to ping. I feel like the fact that incoming packets are VLAN tagged is messing things up, but I'm not sure how to deal with this?&lt;/p&gt;&#xA;" OwnerUserId="32941" LastActivityDate="2017-03-07T22:08:40.240" Title="Juniper EX incoming packets VLAN tagged" Tags="|vlan|juniper|juniper-junos|juniper-ex|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39532" PostTypeId="2" ParentId="39499" CreationDate="2017-03-07T21:03:15.533" Score="1" Body="&lt;p&gt;As @JFL said we probably need more details... (what is the DHCP server? Linux, MAC, Windows clients?, etc) However, since the duplication happens in the &quot;LAN&quot; (same subnet, even if it crosses WAN) I have few things to propose:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a scanner box: Have a job to periodically scan the whole LAN range (nmap maybe). Then use the ARP table of the box (after every scan) to read and temporarily store the IP/MAC address mapping. Cross-reference this with the DHCP leases. You should see MAC addresses matching an IP the DHCP does not know about! This might depend on the (hop) distance of the non-legit box, so you might need to deploy more that one scanners.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Have a passive ARP and DHCP/BOOTP sniffer in combination with a monitoring port on your switch so you can track IP to MAC resolutions. Remember which boxes used DHCP... If you notice a machine relying to an ARP request but never used a DHCP request, that is your statically configured box. In this case you might also need multiple sniffers...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IF you have a single gateway for that LAN, monitor the gateway. Contrary to the previous 2 ways you don't need to deploy anything. All you have to do is periodically poll the MAC address table of the gateway (filtered to the interface/vlan that you expect the duplication). You can do this with SNMP or SSH (depending on lots of things, like vendor, use of VRFs - more info here?)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Now, best practices - I am not sure... could be port security (MAC based registration on the network) on the switches, &lt;code&gt;iptables&lt;/code&gt; (or similar) to block any MACs not known to the DHCP server, etc. Depending on you setup and security requirements, best practices can be a separate question!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope that helps, let me know if you have questions and will update the answer&lt;/p&gt;&#xA;" OwnerUserId="23556" LastEditorUserId="23556" LastEditDate="2017-03-07T21:10:01.457" LastActivityDate="2017-03-07T21:10:01.457" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39533" PostTypeId="2" ParentId="39529" CreationDate="2017-03-07T22:08:40.240" Score="3" Body="&lt;p&gt;Might be quicker to start over here - the below configuration should clean out what you have and give you a good place to start (don't commit this until the end though):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;delete interfaces ge-0/0/0&#xA;delete interfaces ge-0/0/46&#xA;delete interfaces vlan&#xA;delete vlans TEST_VLAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Firstly, create the L3 interface that we'll bind to VLAN_TEST later:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces vlan.100 family inet address x.x.x.x/29&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Next, create VLAN_TEST, assign it a &lt;code&gt;vlan-id&lt;/code&gt; and bind the above &lt;code&gt;l3-interface&lt;/code&gt; to it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set vlans TEST_VLAN vlan-id 100&#xA;set vlans TEST_VLAN l3-interface vlan.100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you'll need to set &lt;code&gt;ge-0/0/0&lt;/code&gt; to be in &lt;code&gt;trunk&lt;/code&gt; mode in order to accept and send tagged frames and then add &lt;code&gt;VLAN_TEST&lt;/code&gt; (100) to it:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode trunk&#xA;set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members TEST_VLAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Finally, you'll need to allow VLAN_TEST to send/receive untagged frames (the default) on &lt;code&gt;ge-0/0/46&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces ge-0/0/46 unit 0 family ethernet-switching vlan members TEST_VLAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I remember having a conversation years ago with some of the product team when they were designing the EX about how they should do port and VLAN assignment - whether they would allow you to assign ports to VLANs from the VLAN/Bridge-Domain stanza (which is how they did it on their existing products at the time), or from under the interface configuration, so that people familiar with IOS would find it familiar.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;They decided to support both methods simultaneously, which has been the cause of much confusion ever since.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-03-07T22:08:40.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39534" PostTypeId="1" AcceptedAnswerId="39535" CreationDate="2017-03-08T00:56:48.243" Score="2" ViewCount="373" Body="&lt;p&gt;&lt;code&gt;tcpdump -i eth0 'bootp.type == 2'&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Results in a: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;tcpdump: syntax error &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;However, &lt;code&gt;bootp.type == 2&lt;/code&gt; works fine in Wireshark. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also &lt;code&gt;tcpdump -i eth0 'tcp[13] &amp;amp; 16!=0'&lt;/code&gt; works fine, no syntax error. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;update: I am attempting to follow the answer here &lt;a href=&quot;https://serverfault.com/a/8534/101677&quot;&gt;https://serverfault.com/a/8534/101677&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="7823" LastEditorUserId="-1" LastEditDate="2017-04-13T12:14:47.153" LastActivityDate="2017-03-11T17:50:27.847" Title="`tcpdump bootp.type == 2` tcpdump: syntax error" Tags="|wireshark|packet-analysis|tcpdump|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39535" PostTypeId="2" ParentId="39534" CreationDate="2017-03-08T01:25:17.637" Score="2" Body="&lt;p&gt;Ahh, it isn't possible. &lt;code&gt;bootp.type&lt;/code&gt; filter is only for Wireshark &amp;amp; TShark. I need to use TShark for the &lt;code&gt;bootp.type&lt;/code&gt; filter. This works for me:&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;tshark -i eth0 -Y 'bootp.type == 2'&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here are the options explained from &lt;code&gt;man tshark&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;code&gt;-i  &amp;lt;capture interface&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;&lt;code&gt;-Y  &amp;lt;displaY filter&amp;gt; &lt;/code&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://serverfault.com/a/304715/101677&quot;&gt;https://serverfault.com/a/304715/101677&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Update: The &lt;code&gt;-Y &amp;lt;display filter&amp;gt;&lt;/code&gt; option is available on at least tshark 1.10.6, some servers may have an older version like 1.8.10 which don't support that filter. If you cannot or don't want to install a new version then use the &lt;code&gt;-R &amp;lt;read (display) filter&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="7823" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-03-11T17:50:27.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39536" PostTypeId="1" AcceptedAnswerId="39553" CreationDate="2017-03-08T07:09:18.253" Score="0" ViewCount="3753" Body="&lt;p&gt;I've set up a sonicwall site to site vpn between two Sonicwall devices - site A is a TZ210. They are connected as far as the VPN is concerned, but there is no traffic, or one way traffic at best.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site A 192.168.15.0/24&#xA;Site B 192.168.7.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site B is able to ping the sonicwall at Site A, and send out pings to other IPs at Site A, but not get any replies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site A doesn't seem to want to send ANY traffic out at all. When I try to ping an address at site B, I get request timed out, but what's interesting is that the data inside Site A's sonicwall doesn't even show any packets going out - it stays at 0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's where it gets interesting: I am able to ping addresses on Site B's network directly from the &quot;Diagnostics&quot; page of Site A's sonicwall with a response - just not from a PC on Site A's network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have updated firmware, restarted both devices, even gone as far as completely resetting and starting from scratch on Site A's Sonicwall. The access rules are correctly &quot;auto-created&quot; by the VPN setup on the sonicwall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Access Rules Created:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lan to VPN from Local Network to Remote Network ALLOW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VPN to Lan from Remote Network to Local Network ALLOW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've double, triple, quadruple checked the address objects on both ends, both correct. I'm at a loss - everything seems to be configured correctly, so I don't udnerstand why there's no traffic!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any feedback or help.&lt;/p&gt;&#xA;" OwnerUserId="35021" LastActivityDate="2017-03-08T17:55:53.570" Title="Sonicwall Site to Site VPN no Traffic" Tags="|vpn|sonicwall|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39537" PostTypeId="1" AcceptedAnswerId="39539" CreationDate="2017-03-08T07:34:41.377" Score="3" ViewCount="286" Body="&lt;p&gt;I was trying to configure BGP peers on sample topologies, Now considering that BGP is the protocol that routes the internet it must not be possible to establish thousands of EBGP peers by such manual configuration using CLI commands. So I was wondering is there a way to automate this process and how to do it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a related topic, BGP I read that BGP exchanges RIB information and updates once the peer group is established. Can someone point out what exactly are the contents of that RIB and how is policy implemented through them.?&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-03-08T08:50:59.853" Title="Automating BGP neighborship formation" Tags="|router|bgp|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39538" PostTypeId="1" CreationDate="2017-03-08T07:40:42.760" Score="1" ViewCount="1006" Body="&lt;p&gt;We have Radius authentication setup on a number of CISCO devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each device also has a local account.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to make it so you can only use the local account when the radius server is unreachable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, both Radius accounts and the Local account are usable.&lt;/p&gt;&#xA;" OwnerUserId="35022" LastActivityDate="2017-03-08T11:35:51.853" Title="Cisco Radius Authentication with Local Fallback" Tags="|cisco|router|authentication|radius|authorization|" AnswerCount="1" CommentCount="2" ClosedDate="2019-12-18T18:50:09.523" ContentLicense="CC BY-SA 3.0" />
  <row Id="39539" PostTypeId="2" ParentId="39537" CreationDate="2017-03-08T08:16:47.460" Score="3" Body="&lt;p&gt;Many vendors provide some infrastructure for automation, for example using &lt;a href=&quot;https://en.wikipedia.org/wiki/SNMP&quot; rel=&quot;nofollow noreferrer&quot;&gt;SNMP-set&lt;/a&gt;, &lt;a href=&quot;https://en.wikipedia.org/wiki/NETCONF&quot; rel=&quot;nofollow noreferrer&quot;&gt;Netconf&lt;/a&gt;, &lt;a href=&quot;https://en.wikipedia.org/wiki/Ansible_(software)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Ansible&lt;/a&gt; or &lt;a href=&quot;https://en.wikipedia.org/wiki/Puppet_(software)&quot; rel=&quot;nofollow noreferrer&quot;&gt;Puppet&lt;/a&gt;. This allows you to build scripts which can pull peer configuration from a database and provision BGP sessions accordingly. Which solution works best is differs per vendor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One very cool example of this is the way &lt;a href=&quot;https://coloclue.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;Coloclue&lt;/a&gt; (a Dutch not for profit ISP) manages its peering sessions: they allow you to do pull requests on their &lt;a href=&quot;https://github.com/coloclue/peering&quot; rel=&quot;nofollow noreferrer&quot;&gt;github repository&lt;/a&gt; which contains their peering records, and once the pull request is accepted the configuration is pushed to their routers, using peer information from &lt;a href=&quot;https://peeringdb.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;PeeringDB&lt;/a&gt;. &lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2017-03-08T08:22:57.617" LastActivityDate="2017-03-08T08:22:57.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39540" PostTypeId="1" AcceptedAnswerId="39590" CreationDate="2017-03-08T08:25:50.940" Score="2" ViewCount="4021" Body="&lt;p&gt;I have tried Googling for Apple TV and ports, and I've even reviewed the &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_TCP_and_UDP_port_numbers&quot; rel=&quot;nofollow noreferrer&quot;&gt;List of TCP and UDP ports&lt;/a&gt; on Wikipedia, and I can't find the information I need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a TCP port that all Apple TV's listen on so that it can be identified using a port scanner?&lt;/p&gt;&#xA;" OwnerUserId="4822" LastActivityDate="2017-03-10T11:30:16.410" Title="How can I discover Apple TV's on my network?" Tags="|transport-protocol|network-discovery|" AnswerCount="3" CommentCount="0" ClosedDate="2018-03-17T01:21:18.693" ContentLicense="CC BY-SA 3.0" />
  <row Id="39541" PostTypeId="2" ParentId="39537" CreationDate="2017-03-08T08:50:59.853" Score="3" Body="&lt;p&gt;You are looking for &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2sx/12_2sxh/feature/guide/sx_bdyn.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;BGP Dynamic Peering&lt;/a&gt; which, in the Cisco world, allows an entire subnet range to be specified as a peer and a given interface to be set to simply listen for new connections.  It's actually an older feature and the wisdom in its use both was- and is- arguably limited.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider that there were (and are) good reasons for BGP relationships to be explicitly defined: security, management of scalability, consistency of policy application, stability of infrastructure, etc.  There seems to be a push periodically to make BGP act like an IGP.  I would suggest this is slightly better than trying to make OSPF handle inter-domain routing but still the wrong tool for the job.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The right answer for maintaining lots of BGP peering info is the use of a tool like Ansible or Puppet (or most any similar scripting tool that can front-end a policy repository) but if you insist on a mechanism to dynamically form peers then the above works, as does the use of dynamically generated v6 link local addresses to establish NLRI (...see RFC 5549).&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-03-08T08:50:59.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39542" PostTypeId="2" ParentId="39540" CreationDate="2017-03-08T08:51:49.643" Score="1" Body="&lt;p&gt;Please have a look at the link below it mentioned that &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;These network ports are used by Apple TV for communications on your network.&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;TCP port 123 is used to communicate with a network time server.&lt;/li&gt;&#xA;  &lt;li&gt;TCP port 3689 is used to communicate with iTunes while using the iTunes Library Sharing feature.&lt;/li&gt;&#xA;  &lt;li&gt;UDP port 5353 is used by Apple TV for automatically finding computers with iTunes on your network using Bonjour.&lt;/li&gt;&#xA;  &lt;li&gt;TCP port 80 is used for communicating with podcast servers.&lt;/li&gt;&#xA;  &lt;li&gt;TCP port 80 and 443 are used for basic and secure communications with the iTunes Store via the Internet.&lt;/li&gt;&#xA;  &lt;li&gt;TCP port 53 is used for regular DNS.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.administrivia.com/resources/apple-tv-tcp-and-udp-ports-and-protocols-used/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.administrivia.com/resources/apple-tv-tcp-and-udp-ports-and-protocols-used/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35024" LastEditorUserId="-1" LastEditDate="2017-03-08T13:08:45.453" LastActivityDate="2017-03-08T13:08:45.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39543" PostTypeId="2" ParentId="39538" CreationDate="2017-03-08T09:06:19.780" Score="-1" Body="&lt;p&gt;Try the below configuration and note the &quot;local&quot; keyword after aaa configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa group server radius &amp;lt;group-name&amp;gt;&#xA;&#xA;server-private ip-address [ auth-port port-number | acct-port port-number ] [non-standard] [ timeout seconds ] [ retransmit retries ] [ key string ]&#xA;&#xA;exit&#xA;&#xA;!&#xA;&#xA;aaa authentication login default group &amp;lt;group-name&amp;gt; local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;hope that help&lt;/p&gt;&#xA;" OwnerUserId="35025" LastEditorUserId="1392" LastEditDate="2017-03-08T11:35:51.853" LastActivityDate="2017-03-08T11:35:51.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39544" PostTypeId="2" ParentId="39540" CreationDate="2017-03-08T10:08:39.937" Score="2" Body="&lt;p&gt;Apple Bonjour protocol use Multicast DNS, which has been normalized in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6762&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6762&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6763&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6763&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;It uses multicast IPv4 address &lt;code&gt;224.0.0.251&lt;/code&gt; or IPv6 address &lt;code&gt;FF02::FB&lt;/code&gt;&lt;/p&gt;&#xA;&lt;p&gt;An bonjour enabled device will announce itself by multicast; so what you have to do is to examine traffic sent to 224.0.0.251 (with TCDPUMP, wireshark or equivalent).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-03-08T10:43:47.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39545" PostTypeId="2" ParentId="39464" CreationDate="2017-03-08T11:41:45.083" Score="2" Body="&lt;p&gt;No, it can't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CoA can change attributes of an existing connection (disconnect a user, apply different policy etc.), but SSID selection is a function of the wireless client (think Layer 1), not the authentication process (Layer 2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you think about it from a Wired network perspective, that would be like trying to use CoA to patch a user into another port.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-03-08T11:41:45.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39548" PostTypeId="1" AcceptedAnswerId="39586" CreationDate="2017-03-08T14:58:57.623" Score="1" ViewCount="186" Body="&lt;p&gt;My server should receive &lt;code&gt;routes&lt;/code&gt; via &lt;code&gt;RIP&lt;/code&gt;.&lt;br&gt;&#xA;I have tried it with &lt;code&gt;Bird&lt;/code&gt; on &lt;code&gt;Ubuntu 10.04&lt;/code&gt;.&lt;br&gt;&#xA;The server should work with the interface option &lt;code&gt;passive&lt;/code&gt;.&lt;br&gt;&#xA;(Receive routes and not send)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;protocol kernel {&#xA;    persist;                &#xA;    scan time 20;&#xA;    export all;            &#xA;}&#xA;&#xA;protocol device {&#xA;    scan time 10;           &#xA;}&#xA;&#xA;protocol rip {&#xA;    export none;&#xA;    import all;&#xA;    interface &quot;eth0&quot; {&#xA;            passive yes;&#xA;    };&#xA;    debug all;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I start bird, I get &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bird: /etc/bird.conf, line 15: syntax error&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35031" LastActivityDate="2017-03-10T10:06:07.810" Title="Bird rip : routes should only be received" Tags="|rip|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39549" PostTypeId="1" AcceptedAnswerId="39550" CreationDate="2017-03-08T15:26:44.613" Score="2" ViewCount="2793" Body="&lt;p&gt;Could someone please explain the difference between the console, monitor and buffer logging in Cisco IOS. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Console logging: level debugging, 32 messages logged, xml disabled,&#xA;                     filtering disabled&#xA;    Monitor logging: level debugging, 0 messages logged, xml disabled,&#xA;                     filtering disabled&#xA;    Buffer logging:  level debugging, 32 messages logged, xml disabled,&#xA;                    filtering disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I think I have an idea that when you telnet into the above device, and issue the command &quot;terminal monitor&quot;, the debug messages are shown in the telnet session.Is that right? So when does the console logging and buffer logging used?&lt;/p&gt;&#xA;" OwnerUserId="31597" LastEditorUserId="8499" LastEditDate="2017-03-08T15:55:01.757" LastActivityDate="2017-03-11T10:30:03.547" Title="Console, Monitor and Buffer Logging" Tags="|cisco|cisco-ios|cisco-commands|logging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39550" PostTypeId="2" ParentId="39549" CreationDate="2017-03-08T15:37:11.320" Score="3" Body="&lt;p&gt;Since you do not specify, I will assume you mean Cisco IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are connected to the console or a VTY line, you can see the messages as they happen with &lt;code&gt;console&lt;/code&gt; or &lt;code&gt;terminal&lt;/code&gt; commands, respectively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Log messages are sent to a buffer in the device, and you can retrieve the buffer to see past messages, no matter how you connect to the device, with the &lt;code&gt;show logging&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can have different logging levels on each of those three, and you can adjust the size of the logging buffer.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Because the logging messages can pop up in the middle of a command you are typing in the terminal or console, you can place the &lt;code&gt;logging synchronous&lt;/code&gt; command on the lines to restore the the command where you left off after the message is displayed.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-08T15:37:11.320" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39551" PostTypeId="1" CreationDate="2017-03-08T15:47:43.357" Score="6" ViewCount="8523" Body="&lt;p&gt;so the BLE advertising channels are located at 2402Mhz, 2426Mhz and 2480Mhz.&#xA;That is so it does not interfere with the 3 wifi channels in the 2.4Ghz band.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is especially about the 2426Mhz advertising channel. Wifi channel 6 ranges from 2426Mhz to 2448Mhz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding is that the 2426Mhz advertising channel of BLE ranges from 2425Mhz to 2427Mhz. Is this correct?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then it does overlap with a wifi channel and interfere? Where is my falacy in the logic? I dont get it and cant find any information about this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Execuse my probably bad english, its not my native language.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards&lt;/p&gt;&#xA;" OwnerUserId="35036" LastActivityDate="2018-08-23T00:59:43.420" Title="Why doesnt Bluetooth Low Energy interfere with Wifi" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39552" PostTypeId="2" ParentId="39551" CreationDate="2017-03-08T17:31:28.653" Score="7" Body="&lt;p&gt;Wifi Channel 6 is centered at 2437Mhz and is 22Mhz large, so ranging from 2426 to 2448 as you stated (well that would rather be 23Mhz large, so not sure if it is 2427-2448 or 2426-2447).&lt;/p&gt;&#xA;&lt;p&gt;But data is actually transmitted along a 20 MHz bandwidth, the remaining 2Mhz are used as a guard band so there's enough attenuation along the edge channel.&lt;/p&gt;&#xA;&lt;p&gt;So there's no data transmitted at 2426 Mhz when using Wifi Channels 1 or 6 (1, 6 and 11 are the most used since they are non-overlapping)&lt;/p&gt;&#xA;&lt;p&gt;From &lt;a href=&quot;http://www.argenox.com/a-ble-advertising-primer/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Argenox&lt;/a&gt;&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;LE uses 40 1MHz wide channels, numbered 0 to 39. Each is separated by&#xA;2MHz.&lt;/p&gt;&#xA;&lt;p&gt;Channels 37, 38, and 39 are used only for sending advertisement&#xA;packets. The rest are used for data exchange during a connection.&#xA;We’re interested in what’s happening in these 3 channels, and that’s&#xA;what we’ll cover here.&lt;/p&gt;&#xA;&lt;p&gt;During BLE advertisement, a BLE Peripheral device transmits packets on&#xA;the 3 advertising channels one after the other. A Central device&#xA;scanning for devices or beacons will listen to those channels for the&#xA;advertising packets, which helps it discover devices nearby.&lt;/p&gt;&#xA;&lt;p&gt;Channels 37, 38 and 39 are spread across the 2.4GHz spectrum on&#xA;purpose. 37 and 39 are the first and last channels in the band, while&#xA;38 is in the middle. If any single advertising channel is blocked, the&#xA;other channels are likely to be free since they’re separated by quite&#xA;a few MHz of bandwidth.&lt;/p&gt;&#xA;&lt;p&gt;This is especially true since most other devices that interfer with&#xA;BLE are narrow band. Channel 38 in particular was placed between Wi-Fi&#xA;channels 1 and 6 so it avoids the Wi-Fi signal. The wide spacing of&#xA;the advertisement channels helps BLE better manage the interference&#xA;from Wi-Fi, Classic Bluetooth, Microwaves, Baby Monitors, etc to&#xA;ensure that advertisements succeed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;You may find this study relevant to your question:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.researchgate.net/publication/265602069_Coexistence_and_Interference_Tests_on_a_Bluetooth_Low_Energy_Front-End&quot; rel=&quot;nofollow noreferrer&quot;&gt;Coexistence and Interference Tests on a Bluetooth Low Energy Front-End&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Here are some parts:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;On  other  hand Wi-Fi signals will  see  Bluetooth as  narrow  band&#xA;interference and  only in  the  cases  that the Bluetooth interference&#xA;is  not  more  than  10 dB below  the Wi-Fi signal can occasionally&#xA;cause interference.  In most  cases Wi-Fi transmits 20 dBm and&#xA;Bluetooth transmits 0 dBm  so  if  we  take into account the  path&#xA;loss  Friis equation of  the  transmitted Wi-Fi signal&lt;/p&gt;&#xA;&lt;p&gt;Lpath= −27.55dB +20 log (2.4MHz ) +20×log[dist(m)]&lt;/p&gt;&#xA;&lt;p&gt;and the Link Budget equation&lt;/p&gt;&#xA;&lt;p&gt;Received  Power  (dBm)  =  Transmitted  Power  (dBm)  +  Gains (dB) −&#xA;Losses (dB) − Lpath&lt;/p&gt;&#xA;&lt;p&gt;We get to the theoretically conclusion that only&#xA;if the Wi-Fi  Router  is  more  than  3  meters  away  from  the&#xA;connecting  equipment and the Bluetooth equipment is on  a  3 meters&#xA;area  around  the  Wi-Fi equipment, that  occasionally the  Bluetooth&#xA;signal can cause interference over the Wi-Fi&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;The study conclude that:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;C. Coexistence with Wi-Fi  Due  to  their  dependence  on  the  same&#xA;band,  the  potential  for interference exists. Therefore it is&#xA;important to  see if there  is  interference  from  Wi-Fi  on  the&#xA;BLE  transmissions.  The  results show no effect on the Bit Error Rate&#xA;or RSSI readout,  in  fact  the  RSSI readout shows  that  the  value&#xA;increases. The  results  obtained  show  that  BLE  hopping  is&#xA;effectively  avoiding  the  Wi-Fi occupy  channels,  therefore  there&#xA;is very  good coexistence between BLE and Wi-Fi.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-03-08T17:49:00.513" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39553" PostTypeId="2" ParentId="39536" CreationDate="2017-03-08T17:55:53.570" Score="0" Body="&lt;p&gt;&lt;strong&gt;Solved&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Solution:&lt;/strong&gt; Another web appliance in the network had OPENVPN installed with an overlapping subnet in the address pools, and the traffic wasn't getting past there - so it wasn't even making it to the sonicwall. I removed the overlapping subnet and traffic started passing through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Troubleshooting steps:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Checked sonicwall logs - no traffic was even being logged when ping&#xA;or RDP attempts occurred through the computer.  &lt;/li&gt;&#xA;&lt;li&gt;Did tracert - tracert showed first hop was going to Untangle web&#xA;appliance, then not responding after that.&lt;/li&gt;&#xA;&lt;li&gt;Disabled all applications on Untangle and traffic went through -&#xA;enabled one by one, testing after each one, and found traffic was&#xA;blocked by Open VPN. Upon further research there was an overlapping&#xA;subnet in OpenVPN and the traffic was being directed there and not&#xA;sent to the gateway/Sonicwall.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="35021" LastActivityDate="2017-03-08T17:55:53.570" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39555" PostTypeId="1" CreationDate="2017-03-08T20:03:54.683" Score="2" ViewCount="361" Body="&lt;p&gt;Created a new VPLS Service first manually and then when it did not work reattempted with our Alcatel SAM 5620 to get a VLAN to pass end to end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both configs look the same, neither the command line method nor the GUI method brought it up. Looking through the config, it is near identical to all prior VPLS in the 7450-ESS-6 and 7450-ESS-1. The configs were checked line by line by two different people and we have not found an error.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Physical  Setup =&amp;gt;  Equip &amp;lt;--Port--ESS6--Router Port--&amp;gt;&amp;lt;--Router Port--ESS1(1st Hop)--Router Port--&amp;gt;Router Port--ESS1(2nd Hop)--Port--&amp;gt;Equip&#xA;&#xA;Logical Setup VPLS Service over MPLS LSP =&amp;gt; Equip &amp;lt;--SAP--ESS6--SDP--&amp;gt;&amp;lt;--MPLS OSPF LSP--&amp;gt;&amp;lt;--SDP--ESS1--SAP--&amp;gt; Equip&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Service shows up in SAM from end to end with no errors.&#xA;Each End ESS can ping the System IP Address of the other ESS.&#xA;ESS6 holding the VLAN Routing information of 10.0.248.1/21&#xA;Devices currently in this range have 10.0.255.1-254&#xA;ESS6 can ping 10.0.248.1&#xA;ESS1 on other end can ping 10.0.248.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All other services to site and ports are working.&#xA;Ran &quot;show service id &amp;lt;#&gt; fdb detail on both ends and the VPLS shows the MAC address of the equipment passing from either end.&#xA;It appears to be a Layer 3 issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ran Traceroute from Equipment ends cannot ping the router 10.0.248.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traceroute to device shows &#xA;0.0.0.0             * * *&#xA;0.0.0.0             * *&#xA;10.0.248.1/21   96ms  !H &#xA;repeated&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traceroute from device&#xA;Shows no route to destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing Table on ESS6 shows 10.0.248.1/21 Local&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I feel I am passing over something and am a bit perplexed. It seems like there is no ARP traffic being to other end or the OSPF MPLS link is updating dynamically for this VLAN.  My next thought is to put static ARP through sites, but I thought this should be unnecessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone experienced a similar issue? Any help, ideas, test commands I should try to see result would be helpful. Thanks ahead of time.&lt;/p&gt;&#xA;" OwnerUserId="35040" LastEditorDisplayName="user36472" LastEditDate="2018-02-04T10:33:50.020" LastActivityDate="2018-02-04T10:33:50.020" Title="Cannot Ping endpoints across a VPLS connected VLAN" Tags="|router|vlan|mpls|vpls|" AnswerCount="0" CommentCount="0" ClosedDate="2018-07-28T01:48:05.313" ContentLicense="CC BY-SA 3.0" />
  <row Id="39556" PostTypeId="1" CreationDate="2017-03-08T20:34:48.390" Score="6" ViewCount="5368" Body="&lt;p&gt;I have a very basic query on Collision Domain and Full Duplex Mode. There are two types of logical topology: Ethernet and Token Ring .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever we read about Ethernet the first thing that we are taught is CSMA/CD. It says that in Ethernet two computers can not send data simultaneously. I am trying to figure out why it is not possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario 1: Two computers connected directly to each other via ethernet cable. No switch or hub in between. Both the adapters are in full duplex mode. In this scenario if both the computers started pinging each other, will it not work? If not, then why not and if it works then why is there no CSMA/CD involved?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario 2: Two computers connected to each other via a plain hub (not a switch).  In this scenario can two computers ping each other simultaneously?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it matter on the type of cable: UTP or Coaxial?&lt;/p&gt;&#xA;" OwnerUserId="19353" LastEditorUserId="8499" LastEditDate="2019-01-03T01:34:32.050" LastActivityDate="2019-10-09T15:52:15.440" Title="Full Duplex and Collision Domain" Tags="|ethernet|layer1|lan|cable|duplex|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39557" PostTypeId="1" AcceptedAnswerId="39558" CreationDate="2017-03-08T20:34:56.350" Score="2" ViewCount="3997" Body="&lt;p&gt;Once I'm connected via telnet to certain CISCO equipment I type &quot;Show inventory&quot; and I get to something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Barragan_3750&amp;gt;show inventory&#xA;NAME: &quot;1&quot;, DESCR: &quot;WS-C3750G-12S&quot;&#xA;PID: WS-C3750G-12S-E   , VID: V06, SN: FDO1129Z9ZJ&#xA;&#xA;NAME: &quot;GigabitEthernet1/0/1&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID:                     , VID:    , SN: H006K022        &#xA;&#xA;NAME: &quot;GigabitEthernet1/0/2&quot;, DESCR: &quot;10/100/1000BaseTX SFP&quot;&#xA;PID: GLC-T               , VID:    , SN: 00000MTC1444080Z&#xA;&#xA;NAME: &quot;GigabitEthernet1/0/3&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID:                     , VID:    , SN: H006K083        &#xA;&#xA;NAME: &quot;GigabitEthernet1/0/4&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID:                     , VID:    , SN: H006K021        &#xA;&#xA;NAME: &quot;GigabitEthernet1/0/5&quot;, DESCR: &quot;1000BaseSX SFP&quot;&#xA;PID:                     , VID:    , SN: FNS11190FLE     &#xA;&#xA;NAME: &quot;GigabitEthernet1/0/6&quot;, DESCR: &quot;1000BaseSX SFP&quot;&#xA;PID:                     , VID:    , SN: P7K08UQ         &#xA;&#xA;NAME: &quot;GigabitEthernet1/0/7&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID:                     , VID:    , SN: H006K032        &#xA;&#xA;NAME: &quot;GigabitEthernet1/0/8&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID:                     , VID:    , SN: H006K040        &#xA;&#xA;NAME: &quot;GigabitEthernet1/0/9&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID:                     , VID:    , SN: FNS14420533     &#xA;&#xA;NAME: &quot;GigabitEthernet1/0/10&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID: GLC-LH-SMD          , VID: V86, SN: FNS16361SG0     &#xA;&#xA;NAME: &quot;GigabitEthernet1/0/11&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID: GLC-LH-SMD          , VID: V86, SN: FNS174002FT     &#xA;&#xA;NAME: &quot;GigabitEthernet1/0/12&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID: GLC-LH-SMD          , VID: V86, SN: FNS183503FS     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Let's take this entry for the example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;NAME: &quot;GigabitEthernet1/0/9&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID:                     , VID:    , SN: FNS14420533 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I type &quot;show cdp neighbors detail &quot; this is showed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Device ID: Arquitectura_Salones&#xA;Entry address(es): &#xA;  IP address: 148.228.000.85&#xA;Platform: cisco WS-C2960S-48TS-S,  Capabilities: Switch IGMP &#xA;Interface: GigabitEthernet1/0/9,  Port ID (outgoing port): GigabitEthernet0/49&#xA;Holdtime : 157 sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now we know that I have Arquitectura_Salones connected at GigabitEthernet1/0/9, it's serial number is: FNS14420533 and the IP is: 148.228.000.85&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I connect via telnet to this equipment and type &quot;show version&quot; this information is showed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Base ethernet MAC Address       : 00:23:05:46:8B:00&#xA;Motherboard assembly number     : 73-9835-09&#xA;Power supply part number        : 341-0097-02&#xA;Motherboard serial number       : FOC12351HVZ&#xA;Power supply serial number      : AZS123206WY&#xA;Model revision number           : F0&#xA;Motherboard revision number     : A0&#xA;Model number                    : WS-C2960-48TC-L&#xA;System serial number            : FOC1235Z1W5&#xA;Top Assembly Part Number        : 800-26672-04&#xA;Top Assembly Revision Number    : A0&#xA;Version ID                      : V04&#xA;CLEI Code Number                : COM3F00BRC&#xA;Hardware Board Revision Number  : 0x02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see, the serial number is different.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I know which is the correct one?&lt;/p&gt;&#xA;" OwnerUserId="34644" LastEditorUserId="34847" LastEditDate="2017-03-10T07:30:46.203" LastActivityDate="2017-03-11T14:03:35.690" Title="Why do I get different serial number from &quot;show version&quot; than from &quot;show inventory&quot;" Tags="|cisco|cisco-commands|cdp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39558" PostTypeId="2" ParentId="39557" CreationDate="2017-03-08T20:44:36.817" Score="5" Body="&lt;p&gt;&lt;code&gt;Show inventory&lt;/code&gt; is for local information only.  You are finding the serial number of the 1000BaseLX SFP optic in Gi1/0/9 with this output.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;show inventory&lt;/code&gt; and &lt;code&gt;show version&lt;/code&gt; on the 2960 should match.  Be aware that sometimes the mainboard serial number is sometimes shown with the same description as the device, so double-checking between the inventory and version outputs is recommended.&lt;/p&gt;&#xA;" OwnerUserId="3912" LastActivityDate="2017-03-08T20:44:36.817" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39559" PostTypeId="2" ParentId="39556" CreationDate="2017-03-08T21:11:20.790" Score="5" Body="&lt;p&gt;You seem to be confused about logical topology (bus, ring, star). Ethernet has a couple of different topologies, but token ring has only the logical ring topology.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full-duplex ethernet doesn't use CSMA/CD because it has separate send and receive paths between two devices. When you share send and receive paths, then you must use CSMA/CD in order to detect collisions (two devices sending at the same time). With full-duplex, there is no possibility of collisions; the send path on one device is the receive path on the other end, and vice versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A hub means you must use half-duplex because the possibility of collisions exists, and you must detect the collisions, so you use CSMA/CD. The devices connected to the hub take turns sending (and resending when there are collisions). Each will have the opportunity to get frames on the wire, so, yes, they can ping each other at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For ethernet: Coaxial cable only has a single path, so it must be half-duplex. UTP cable as point-to-point between two devices can use full-duplex because each device has separate send and receive paths, but on a hub, you have multiple devices trying to send on on the same path, and receive on the same path, so you must use half-duplex with CSMA/CD. Fiber will have separate send and receive paths.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For token ring: there can be no collisions because only one device possesses the token at a time, and no device can send without possession of the token.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Wi-Fi: all devices share the medium, so there are going to be collisions. Wi-Fi doesn't use CSMA/CD. CSMA/CA was developed for Wi-Fi to try to avoid collisions.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-03-19T00:10:53.883" LastActivityDate="2018-03-19T00:10:53.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39560" PostTypeId="1" CreationDate="2017-03-08T21:30:06.967" Score="3" ViewCount="2526" Body="&lt;p&gt;Thank you for reviewing my question. I am researching &quot;Wi-Fi__33&quot;. It's a real thing. I see it mentioned in places such as &lt;a href=&quot;http://www.logisticsit.com/blog/2017/02/07/three-retail-tech-trends-to-watch-in/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.logisticsit.com/blog/2017/02/07/three-retail-tech-trends-to-watch-in/&lt;/a&gt;, and &lt;a href=&quot;http://www.omega.com/technical-learning/next-industrial-revolution.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.omega.com/technical-learning/next-industrial-revolution.html&lt;/a&gt;, but I find no definition of it anywhere. I think it may be used in payments, retail, and/or Industry 4.0. It could be quite new. I could really use a definition. &lt;/p&gt;&#xA;" OwnerUserId="35041" LastEditorUserId="8499" LastEditDate="2017-03-08T21:38:06.193" LastActivityDate="2019-12-02T12:07:26.267" Title="I know Wi-Fi, but what on earth is Wi-Fi__33?" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39562" PostTypeId="2" ParentId="39556" CreationDate="2017-03-08T22:31:40.510" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Whenever we read about Ethernet the first thing that we are taught is CSMA/CD. It says that in Ethernet two computers can not send data simultaneously. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Unfortunately there is a lot of reference material out there that is horribly outdated and/or doesn't make a clear distinction between &quot;original Ethernet&quot; and &quot;modern Ethernet&quot;. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Scenario 1: Two computers connected directly to each other via ethernet cable. No switch or hub in between. Both the adapters are in full duplex mode. In this scenario if both the computers started pinging each other, will it not work?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It will work&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;if it works then why is there no CSMA/CD involved?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is no CSMA/CD in full duplex mode. Collisions simply cannot happen.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does it matter on the type of cable: UTP or Coaxial?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, coaxial Ethernet cannot support full duplex mode. Only the twisted pair and fiber physical layers can.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Scenario 2: Two computers connected to each other via a plain hub (not a switch). In this scenario can two computers ping each other simultaneously?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, hubs cannot support full duplex mode. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="-1" LastEditDate="2019-10-09T15:52:15.440" LastActivityDate="2019-10-09T15:52:15.440" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="39565" PostTypeId="2" ParentId="39525" CreationDate="2017-03-09T08:03:34.483" Score="1" Body="&lt;p&gt;This is not an issue with your static NAT configuration - but actually with the content on the pages the web server is dishing out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most cases, a web server sh/would return relative links eg:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;lt;a href=&quot;/some/other/location.html&quot;&amp;gt;Link&amp;lt;/a&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;in your case, it is returning absolute links in the form:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;&amp;lt;a href=&quot;http://192.168.1.125/some/other/location.html&quot;&amp;gt;Link&amp;lt;/a&amp;gt;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT occurs at Layer 3 - the web server returning links with it's address encoded into the URL is happening at Layer 7, and beyond the control of your router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static NAT is the wrong tool for the job in this case - explain to your Supervisor that the only way to resolve this issue is to use an ACL or have the web application re-written.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="1392" LastEditDate="2017-03-09T08:09:14.150" LastActivityDate="2017-03-09T08:09:14.150" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39566" PostTypeId="1" AcceptedAnswerId="39571" CreationDate="2017-03-09T08:13:50.280" Score="2" ViewCount="416" Body="&lt;p&gt;A Wi-Fi AP and client advertise and negotiate WPA/WPA2, RSN Information Element field is used:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/u3Kp0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/u3Kp0.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Group Cipher (for broadcast and multicast data frame), highlighted field is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I wonder that, what if Group Cipher is set to one of Reserved?&#xA;Does this mean the AP will not use any cipher for broadcast and multicast,&#xA;and just sends data frames in plaintext?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Hvb4u.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Hvb4u.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35048" LastActivityDate="2017-03-09T14:20:25.107" Title="Is it possible for IEEE 802.11 WPA/WPA2 not to use Group Cipher?" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39567" PostTypeId="1" AcceptedAnswerId="39568" CreationDate="2017-03-09T09:47:26.147" Score="8" ViewCount="42070" Body="&lt;p&gt;I am familiar with PPPoE but getting confused with the term IPoE. Is this same as usual ethernet with DHCP server? Does this have any auth built-in? How do I get authenticated? What can a client connect? I did some googling but the information I got is still not clear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&#xA;gs&lt;/p&gt;&#xA;" OwnerUserId="35050" LastEditorUserId="8499" LastEditDate="2018-05-17T12:47:53.777" LastActivityDate="2018-05-17T12:47:53.777" Title="What exactly is IPoE?" Tags="|ethernet|ip|pppoe|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39568" PostTypeId="2" ParentId="39567" CreationDate="2017-03-09T10:36:38.000" Score="11" Body="&lt;p&gt;So in the strictest sense, &quot;IP over Ethernet&quot; is exactly what it sounds like, it's the encapsulation of IP packets (datagrams, formally) in standard ethernet frames.  For much of the networking universe this is just &quot;normal&quot; IP as so much of the transport has migrated to Ethernet nowadays.  Somewhat more specifically speaking, IPoE is often used in comparison to PPPoE when discussing how services such as residential broadband are delivered to the end user.  This can be a little confusing as PPPoE would more accurately be described as &quot;IP packets encapsulated in PPP, which is in turn encapsulated in Ethernet&quot;... but it's just broadly known as &quot;PPPoE&quot;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The use of either &quot;PPPoE&quot; or &quot;IPoE&quot; in the context of residential broadband also almost always implies other components of the service delivery system, such as address allocation, authentication, accounting, etc.  Authentication is normally a RADIUS server or sometimes Diameter.  The exact rules on how authentication is performed and what devices can/can't connect are usually set up by the specific service provider.  Broadly speaking, &quot;IPoE&quot; is more common in cable access networks, and &quot;PPPoE&quot; is more common in DSL and dialup access networks: although this is by no means cast in stone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I found the document below to be relatively useful:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://telecomsite.ru/upload/news/using_pppoe_and_ipoe.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://telecomsite.ru/upload/news/using_pppoe_and_ipoe.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13955" LastActivityDate="2017-03-09T10:36:38.000" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39569" PostTypeId="2" ParentId="39567" CreationDate="2017-03-09T11:40:36.357" Score="10" Body="&lt;p&gt;IPoE is essentially DHCP-triggered subscriber interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It has come about because most modern broadband access networks are able to deliver Ethernet from end-to-end (e.g.: xPON/FTTH).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Users are &quot;authenticated&quot; through the use of DHCPv4/v6 Option-82 inserting their Circuit-ID into their initial DHCP Discovery - this identifies the physical location of the user based on the tail that they are connected to (this would be done at an aggregation switch between the xPON network and whatever backhaul gets them to their ISP of choice).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After this it's pretty much boring old Q-in-Q to deliver all users from a specific neighbourhood to their various ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP will then service the DHCP request (if the Circuit-ID can be mapped to a valid user via RADIUS), provide an IP (and hopefully prefix-delegation if they're offering IPv6) and then create a logical interface representing that subscriber that you they apply their filtering/rate-shaping to and start grabbing stats from.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="1392" LastEditDate="2017-03-09T14:23:43.373" LastActivityDate="2017-03-09T14:23:43.373" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39571" PostTypeId="2" ParentId="39566" CreationDate="2017-03-09T14:20:25.107" Score="0" Body="&lt;p&gt;Reserved values are not valid for the standard; they are reserved for future use. The AP and STA will not negotiate a Reserved value. Either receiving a value that it doesn't support should refuse with a status value meaning &quot;Invalid group cipher.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In fact, Vendor-specific was defined in order to prevent non-standard use of Reserved. Of course, both the AP and STA must be able to use the same vendor-specific method before they can agree on its use.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-09T14:20:25.107" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39572" PostTypeId="1" AcceptedAnswerId="39626" CreationDate="2017-03-09T15:20:37.120" Score="2" ViewCount="2088" Body="&lt;p&gt;I have a access switch with a 10gb upstream interface and a 1gb downstream interface, i can see from the show interfaces [int] that traffic is being dropped on the upstream downstream direction.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;TenGigabitEthernet1/1 is up, line protocol is up (connected)&#xA;Hardware is Ten Gigabit Ethernet Port, address is f4cf.e213.7e30 (bia f4cf.e213.7e30)&#xA;Description: MATE.A01&#xA;MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,&#xA; reliability 255/255, txload 5/255, rxload 1/255&#xA;Encapsulation ARPA, loopback not set&#xA;Keepalive set (10 sec)&#xA;Full-duplex, 1000Mb/s, link type is auto, media type is 1000BaseSX&#xA;input flow-control is on, output flow-control is on&#xA;ARP type: ARPA, ARP Timeout 04:00:00&#xA;Last input 00:00:45, output never, output hang never&#xA;Last clearing of &quot;show interface&quot; counters never&#xA;Input queue: 0/2000/0/0 (size/max/drops/flushes); Total output drops: 7556661&#xA;Queueing strategy: Class-based queueing&#xA;Output queue: 0/40 (size/max)&#xA;5 minute input rate 5364000 bits/sec, 1098 packets/sec&#xA;5 minute output rate 22402000 bits/sec, 2980 packets/sec&#xA; 863690200 packets input, 401065551603 bytes, 0 no buffer&#xA; Received 6568826 broadcasts (1428513 multicasts)&#xA; 0 runts, 0 giants, 0 throttles&#xA; 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored&#xA; 0 input packets with dribble condition detected&#xA; 2787171938 packets output, 1962145408543 bytes, 0 underruns&#xA; 0 output errors, 0 collisions, 4 interface resets&#xA; 0 unknown protocol drops&#xA; 0 babbles, 0 late collision, 0 deferred&#xA; 0 lost carrier, 0 no carrier&#xA; 0 output buffer failures, 0 output buffers swapped out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Most probably the cause of these drops are due to the fact that the traffic is comming from a higher bandwitdh interface to a lower bandwith one. the buffer gets full quickly and the switch as to discard some packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a command where i can see the packet drops at a buffer level? Are there more causes for output drops? how can i troubleshoot these output drops more in detail?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks  &lt;/p&gt;&#xA;" OwnerUserId="13605" LastActivityDate="2017-03-12T11:01:30.633" Title="CIsco 4500 output drops" Tags="|switch|switching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39573" PostTypeId="1" CreationDate="2017-03-09T17:45:25.753" Score="1" ViewCount="75" Body="&lt;p&gt;three routers are connected where&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Router A connected to router B &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;A (gig0/0/0  ip address 10.10.1.1)====&amp;gt; B(gig0/0/0 ip address 10.10.1.2    &#xA;A(gig0/0/0=&amp;gt; ip address 10.11.1.1===&amp;gt;B(gig0/0/1  ip address 10.11.1.2))&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router A connected toRouter C &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(A (gig0/0/2=&amp;gt; ip address 10.12.1.1 )====&amp;gt;  C (gig0/0/0  ip address 10.12.1.2)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;An IS-IS process is running among nodes. At Router A, Can apply a route policy so that link between Router A to Router B only one link active for certain routes based on next hope Address match condition. for example  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if routes 157.1.1.1/32, 57.1.1.1/32, 47.1.1.1/32 has two next hop 10.10.1.1 and 10.11.1.1 for Same destination Router B.how can i apply effectively in ISIS process the below policy:- &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip ip-prefix Next_add index 10 permit 10.11.1.0 30 &#xA;ip ip-prefix rouisis index 10 permit 157.1.1.1 32&#xA;ip ip-prefix rouisis index 20 permit 57.1.1.1 32  &#xA;ip ip-prefix rouisis index 30 permit 47.1.1.1 32 &#xA;route-policy isispref permit node 20  &#xA;if-match ip-prefix rouisis &#xA;if-match ip next-hop ip-prefix Next_add&#xA;apply preference 200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8007" LastEditorUserId="509" LastEditDate="2017-03-09T20:31:07.093" LastActivityDate="2017-03-09T20:31:07.093" Title="Policy routing with IS-IS" Tags="|routing|is-is|huawei|" AnswerCount="0" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39574" PostTypeId="1" CreationDate="2017-03-09T18:19:36.760" Score="4" ViewCount="1373" Body="&lt;p&gt;Our company has a 3/.5 DSL connection.  On this connection we have a VPN where the execs are able to access files on the network as well as VOIP.  On this connection we also have our exchange email server.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to decrease the amount bandwidth that is used by the exchange server to give more to the VPN...specifically the VOIP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My hope is there something I put on the particular port to slow its access speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="34023" LastEditorUserId="8499" LastEditDate="2021-07-11T23:47:01.830" LastActivityDate="2022-06-28T15:46:15.857" Title="limit bandwidth on a Cisco switch port," Tags="|cisco|switch|qos|bandwidth|interface|" AnswerCount="1" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39575" PostTypeId="2" ParentId="39574" CreationDate="2017-03-09T18:44:01.773" Score="3" Body="&lt;p&gt;What you need to do is implement QoS. QoS is a very large and complex subject (too broad for details here, as entire books are written on how to use it) that encompasses everything from classifying and marking packets, to performing some sort of action (shaping, policing, queuing, etc.) based on the classification/marking. To properly implement QoS, you need to have a comprehensive set of QoS policies that are implemented consistently across your network.&lt;/p&gt;&#xA;&lt;p&gt;Also, understand that your QoS policies and markings will not work on the public Internet. You may be able to pay your ISP to respect some of your QoS policies and markings, but QoS on any traffic sent from your ISP to others on it way to the destination will be ignored. You also have no direct control of any traffic coming from the public Internet until you have received it on your network, where you can properly mark and treat it.&lt;/p&gt;&#xA;&lt;p&gt;To properly treat the traffic, you need to first mark it, and you want to do that as close to the source as possible, ideally on the source device, but you can get into trouble simply trusting applications. Practically, this means marking on the access switches as the traffic comes into the access switches.&lt;/p&gt;&#xA;&lt;p&gt;Some Cisco switches default to marking everything coming as &lt;code&gt;BE&lt;/code&gt; (Best Effort). You probably want most traffic to be marked &lt;code&gt;BE&lt;/code&gt;, but you will want VoIP data to be marked &lt;code&gt;EF&lt;/code&gt; (Expedited Forwarding). You will also want to mark some things, e.g. control traffic (VoIP control, routing protocols, etc.), with a higher priority, but not &lt;code&gt;EF&lt;/code&gt;, and you will want to mark some things, e.g. server backup, with a lower priority.&lt;/p&gt;&#xA;&lt;p&gt;Once you have your traffic properly marked, then you want to use that. Cisco switches can do some limited queuing, but you certainly want to use the markings on your routers where you can do queuing, policing, and shaping. Typically, you will want to set up a priority queue for VoIP to guarantee some bandwidth, and you really want to police any traffic beyond the priority queue bandwidth. Other traffic will have various queue sizes.&lt;/p&gt;&#xA;&lt;p&gt;You really want to keep it fairly simple. A rookie mistake is to try to set up markings and queue for every different traffic type. The simplest, and often best, QoS policies leave most traffic as &lt;code&gt;BE&lt;/code&gt;, and you only mark and treat differently any exceptional traffic like VoIP, control, or bulk traffic.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2022-06-28T15:46:15.857" LastActivityDate="2022-06-28T15:46:15.857" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="39577" PostTypeId="5" CreationDate="2017-03-09T20:31:49.877" Score="0" Body="" OwnerUserId="509" LastEditorUserId="509" LastEditDate="2017-03-09T20:31:49.877" LastActivityDate="2017-03-09T20:31:49.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39578" PostTypeId="4" CreationDate="2017-03-09T20:31:49.877" Score="0" Body=" A tag for questions involving Huawei networking hardware or software. " OwnerUserId="509" LastEditorUserId="509" LastEditDate="2017-03-09T20:31:49.877" LastActivityDate="2017-03-09T20:31:49.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39580" PostTypeId="1" AcceptedAnswerId="39581" CreationDate="2017-03-09T23:58:03.040" Score="2" ViewCount="108" Body="&lt;p&gt;I am trying to find a way to disable the redundant supervisor mode in my switch, as it is disabling another line card, so it can have enough power to spare for a redundant slot I wont use. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried searching around and haven't found a way to do so. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sup720 1x 6509 chassis, no redundant is installed, but the IOS keeps holding power for a slot I won't be using.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;after doing show power &#xA;Slot Card-Type          Watts   A @42V Watts   A @42V State State&#xA;---- ------------------ ------- ------ ------- ------ ----- -----&#xA;3    WS-X6148-45AF       107.94  2.57   107.94  2.57  on    on&#xA;5    WS-SUP720-3B        282.24  6.72   282.24  6.72  on    on&#xA;6    (Redundant Sup)       -     -      282.24  6.72  -     -&#xA;8    WS-X6148-GE-TX      103.74  2.47   103.74  2.47  on    on&#xA;9    WS-X6748-GE-TX      407.40  9.70     -     -     on    off (FRU-power denied)&#xA;system power total =     1153.32 Watts (27.46 Amps @ 42V)&#xA;system power used =       832.86 Watts (19.83 Amps @ 42V)&#xA;system power available =  320.46 Watts ( 7.63 Amps @ 42V)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simple solution was since the x6748 can go in any slot I put it in the slot6 so that it could use the already reserved power as part of its own. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Slot Card-Type          Watts   A @42V Watts   A @42V State State&#xA;---- ------------------ ------- ------ ------- ------ ----- -----&#xA;3    WS-X6148-45AF       107.94  2.57   107.94  2.57  on    on&#xA;5    WS-SUP720-3B        282.24  6.72   282.24  6.72  on    on&#xA;6    WS-X6748-GE-TX      407.40  9.70   407.40  9.70  on    on&#xA;8    WS-X6148-GE-TX      103.74  2.47   103.74  2.47  on    on&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4646" LastEditorUserId="8499" LastEditDate="2018-12-25T04:16:50.453" LastActivityDate="2018-12-25T04:16:50.453" Title="Lab: I am running 15.1 on a catalyst and need to disable redundant supervisormp" Tags="|cisco|cisco-catalyst|redundancy|cisco-6500|lab|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39581" PostTypeId="2" ParentId="39580" CreationDate="2017-03-10T00:11:07.010" Score="0" Body="&lt;p&gt;You can disable the power for any 6509 slot with the &lt;code&gt;no power enable module &amp;lt;slot number&amp;gt;&lt;/code&gt; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Commands such as these are very easy to find on Cisco's web site. Cisco maintains extensive documentation on its products. A simple search turned up &lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/22389-142.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Power Management for Catalyst 6000 Series Switches&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your edit of the &lt;code&gt;show power&lt;/code&gt; command, your redundant supervisor slot is not actually using any power. Your switch simply doesn't have enough power to power the chassis and all the line cards you want to power. The 6748 line card uses a lot of power (a significant chunk of the power supply output). Not all the power of the power supply is available to the slots; much of it is used to power the chassis itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could get a bigger power supply (the one you have is pretty small for a 6509; more appropriate in a 6506 or 6503), or you could add a second power supply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your power supply, you may be able to use 220V to increase the available power.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-10T00:30:21.553" LastActivityDate="2017-03-10T00:30:21.553" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39583" PostTypeId="1" AcceptedAnswerId="39587" CreationDate="2017-03-10T03:47:34.773" Score="5" ViewCount="874" Body="&lt;p&gt;Would one ever find a router that had been intentionally configured to not have any default routes? No default gateway, no &lt;code&gt;0.0.0.0/0&lt;/code&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sort of an academic question, someone at work mentioned it, and it seems a bit crazy to me. Even large backbone routers would need to have a default route if they had an address they didn't recognize...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't know much about BGP, so I may be shooting myself in the foot here.&lt;/p&gt;&#xA;" OwnerUserId="35067" LastEditorUserId="35067" LastEditDate="2017-03-11T04:54:21.600" LastActivityDate="2021-01-05T12:32:04.483" Title="Router configured (intentionally) with no default routes?" Tags="|routing|transport-protocol|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39584" PostTypeId="2" ParentId="39583" CreationDate="2017-03-10T03:54:15.393" Score="2" Body="&lt;p&gt;This is certainly something that is done. If your WAN routers have full Internet routing tables, then, at least in theory, your WAN routers know how to reach every public address on the public Internet. A default route would only allow routers configured this way to send traffic with a a destination not in the routing table to the ISP routers, but the WAN routers should have the same routing knowledge as the ISP routers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-10T03:54:15.393" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39586" PostTypeId="2" ParentId="39548" CreationDate="2017-03-10T10:06:07.810" Score="0" Body="&lt;p&gt;I had the bird version from the official repositorie (&lt;code&gt;bird 1.1.5-1&lt;/code&gt;).&lt;br&gt;&#xA;This version is very old and the option passive don't work.&lt;br&gt;&#xA;I update bird to &lt;code&gt;1.6.3&lt;/code&gt; and everything works.&lt;br&gt;&#xA;Thanks to the BIRD Mailing List! (&lt;a href=&quot;http://bird.network.cz/pipermail/bird-users/2017-March/011074.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bird.network.cz/pipermail/bird-users/2017-March/011074.html&lt;/a&gt;)&lt;/p&gt;&#xA;" OwnerUserId="35031" LastActivityDate="2017-03-10T10:06:07.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39587" PostTypeId="2" ParentId="39583" CreationDate="2017-03-10T10:19:29.027" Score="5" Body="&lt;p&gt;As Ron Maupin pointed out, this is not uncommon. It's especially used between autonomous systems speaking BGP, and there actually is a thing called the &quot;&lt;a href=&quot;https://en.wikipedia.org/wiki/Default-free_zone&quot; rel=&quot;noreferrer&quot;&gt;Default Free Zone&lt;/a&gt;&quot;, the core of the internet in which no default gateways are configured: all routes are exchanged via BGP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not having default routes there actually serves a purpose: it prevents traffic to unallocated destinations to be discarded at the first possible hop, so it will not bounce between networks.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-03-10T10:19:29.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39589" PostTypeId="1" AcceptedAnswerId="39595" CreationDate="2017-03-10T11:17:35.313" Score="2" ViewCount="679" Body="&lt;p&gt;I am new to networks and had some quick lessons from Tannenbaum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was playing with my router and found out that the router assigns my devices an IP address in the range of 192.168.178.x. However, the public IP address is something different which I could find out over www.whatismyip.com.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is how does the router know which device (laptop 1 or laptop 2) has sent the query to an external server because the external server replies just with my public IP address, and the router has to route the response to the device which sent the request. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read about NAT (Network Address Translation), but I could not find any reference to it in the Manual of my router. Is it really NAT that is doing the look up table for the IP addresses, or is there some other software running in the router that prepares the lookup table, i.e does the translation?&lt;/p&gt;&#xA;" OwnerUserId="35072" LastEditorUserId="8499" LastEditDate="2018-03-12T02:51:40.033" LastActivityDate="2018-03-12T02:51:40.033" Title="How does Network Address Translation work on my router?" Tags="|router|nat|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="39590" PostTypeId="2" ParentId="39540" CreationDate="2017-03-10T11:30:16.410" Score="0" Body="&lt;p&gt;Apple TV's will respond on TCP port 3689, 5000, 7000, 7100 and 62078&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: nmap 7.40 against an Apple TV.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;nmap -O 10.110.60.28&#xA;&#xA;Starting Nmap 7.40 ( https://nmap.org ) at 2017-03-10 12:26 W. Europe Standard Time&#xA;Nmap scan report for 10.110.60.28&#xA;Host is up (0.013s latency).&#xA;Not shown: 995 closed ports&#xA;PORT      STATE SERVICE&#xA;3689/tcp  open  rendezvous&#xA;5000/tcp  open  upnp&#xA;7000/tcp  open  afs3-fileserver&#xA;7100/tcp  open  font-service&#xA;62078/tcp open  iphone-sync&#xA;OS details: Apple Mac OS X 10.7.0 (Lion) - 10.11 (El Capitan) or iOS 4.1 - 9.3.3 (Darwin 10.0.0 - 15.6.0)&#xA;Network Distance: 4 hops&#xA;&#xA;OS detection performed. Please report any incorrect results at https://nmap.org/submit/ .&#xA;Nmap done: 1 IP address (1 host up) scanned in 41.81 seconds&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4822" LastActivityDate="2017-03-10T11:30:16.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39595" PostTypeId="2" ParentId="39589" CreationDate="2017-03-10T15:38:42.780" Score="1" Body="&lt;p&gt;NAT (Network Address Translation) is a method created to extend the life of IPv4. Without it, we would have completely run out of IPv4 addresses many years ago, instead of more recently, as has happened. Unfortunately, NAT breaks the IP model of end-to-end connectivity, where each device has a unique IP address.&lt;/p&gt;&#xA;&lt;p&gt;NAT, at it core, simply translates either or both the source and destination addresses on IP packets to be different addresses. There are multiple variations of NAT. The common version used to allow devices on a network with private addresses use a single public address is call NAPT (Network Address Port Translation).&lt;/p&gt;&#xA;&lt;p&gt;NAT can be used on different device types, but it is most convenient to to run a NAT process on a firewall or router that connects a private network to the public Internet. It is not a firewall or router requirement to run NAT, but that is usually the logical place to run it.&lt;/p&gt;&#xA;&lt;p&gt;NAPT looks at the source layer-3 and layer-4 addresses of packets passing from inside to outside, then it creates or updates an entry in a NAT table and replaces the source layer-3 and layer-4 addresses with different addresses before forwarding the packets.&lt;/p&gt;&#xA;&lt;p&gt;When a packet comes in from the outside with the layer-3 destination address of the NAT device, NAPT looks at the destination layer-3 and layer-4 addresses, and it looks up in the NAT table to determine which layer-3 and layer-4 address to use to replace the destination addresses, then it replaces those addresses and forwards the packets to the inside. NAT drops any packets for which there are NAT table entries.&lt;/p&gt;&#xA;&lt;p&gt;NAT table entries will time out, or, in some cases with TCP, will be purged when the connection ends.&lt;/p&gt;&#xA;&lt;p&gt;It important to NAPT to inspect both the source and destination addresses to create NAT table entries for a particular conversation. That helps to prevent outside hosts that are not part of the conversation from sending unwanted packets to the inside host.&lt;/p&gt;&#xA;&lt;p&gt;Both the source and destination addresses on the packets must match the NAT table entries before packets are allowed from outside to inside. That means that only inside hosts can initiate a conversation because there is no NAT table entry in place for an outside host to initiate a conversation. This brings up the concept of port forwarding, which essentially create a permanent NAT table entry in order to allow outside hosts to initiate a conversation with an inside host.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;For more information about NAT, you can look at &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3022&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 3022, Traditional IP Network Address Translator (Traditional NAT)&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-03-10T16:03:59.640" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="39596" PostTypeId="1" CreationDate="2017-03-10T17:09:23.047" Score="1" ViewCount="681" Body="&lt;p&gt;I have a Cisco ASA 5508-X with IOS 9.6(1), and I have Apex licenses for AnyConnect which support Suite B, NGE. How can I generate a self-signed certificate with a hash other than default SHA-1. For example SHA256 or SHA512? I dont see those settings under trustpoint?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastEditorUserId="562" LastEditDate="2021-04-14T12:07:03.077" LastActivityDate="2021-04-14T12:07:03.077" Title="How can I generate a self-signed certificate with a hash other than SHA-1 on cisco ASA?" Tags="|cisco-asa|" AnswerCount="0" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="39599" PostTypeId="1" CreationDate="2017-03-10T18:47:11.720" Score="4" ViewCount="621" Body="&lt;p&gt;We have about 30 switches (multiple vendors) in a network which consists of a main ring and several branches. A couple of the branches may have loops.  Some of the switches are smart switches with RSTP enabled, most of the switches are either smart switches with RSTP disabled or dumb switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the diameter of the RSTP-enabled switches is around 10, we're getting convergence times after a topology change of under a minute. As we increase the diameter the convergence time scales up dramatically, hitting 15-20 minutes as the diameter approaches 13 or 14. This looks like it might be a case of the network falling back to STP and the diameters being too large for the default STP settings on the switches. The same setup is being used for a different network and it rapidly converges in seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a way to isolate which switch might be causing the network to fall back to STP? Some of the switches provide more status details about the RSTP state (e.g. whether the port is RSTP/STP), but most of the switches provide very little diagnostic info.&lt;/p&gt;&#xA;" OwnerUserId="35085" LastActivityDate="2017-04-11T11:49:33.103" Title="RSTP Troubleshooting" Tags="|spanning-tree|ieee-802.1w|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39600" PostTypeId="1" CreationDate="2017-03-10T19:12:51.653" Score="0" ViewCount="1454" Body="&lt;p&gt;This is my first post here.&#xA;I am currently working on a project, and I am supposed to get the URL of a website I am browsing using a sniffer (such as wireshark).&#xA;So, what I have done is look at the HTTP packets in wireshark, and there the url is displayed and accessable. The problem is&#xA;websites that use HTTPS (Secure), and not just HTTP- because the data in the packets is encrypted, I am unable to find the URL (there are no http packets to look at).&#xA;I eventually am supposed to write a python script for doing this-meaning that when a user browses different websites, the script will create a txt document with a list of all the websites the user browsed.&#xA;I have been trying to figure this out for days, but haven't managed to do so :\&#xA;I would really really appreciate some help :)&#xA;Thank you in advance&lt;/p&gt;&#xA;" OwnerUserId="35088" LastActivityDate="2017-03-10T19:24:53.680" Title="Getting URL of a website using a sniffer" Tags="|wireshark|network-discovery|" AnswerCount="1" CommentCount="1" ClosedDate="2017-03-10T19:31:56.297" ContentLicense="CC BY-SA 3.0" />
  <row Id="39601" PostTypeId="2" ParentId="39600" CreationDate="2017-03-10T19:24:53.680" Score="1" Body="&lt;p&gt;For encrypted traffic, really, the only thing you can find is the host of the URL, the port and perhaps the scheme. You find the host by either of the two ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;sniffing DNS packets and finding what host the client is trying to resolve&lt;/li&gt;&#xA;&lt;li&gt;performing a reverse DNS lookup for the address the client is communicating with&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Of these methods, the DNS sniffing is the most reliable, as an IP address can run many websites with different hosts on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot find the path of the URL, as the purpose of the encryption is to hide that from evil sniffers. The port can be found (it's usually 443), and you can also try to guess the scheme from the port (if 443, it's HTTPS), but that's about all you can do.&lt;/p&gt;&#xA;" OwnerUserId="34098" LastActivityDate="2017-03-10T19:24:53.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39602" PostTypeId="2" ParentId="39525" CreationDate="2017-03-10T19:48:34.477" Score="1" Body="&lt;p&gt;After reading your comment, it appears that you have a need for an ACL instead of NAT. NAT is a method to save address space, essentially. Try doing this:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Router(config)# ip access-list extended ACL&lt;/p&gt;&#xA;&lt;p&gt;Router(config-ext-nacl)# permit tcp 10.230.32.0 0.0.0.255 host 192.168.1.125 eq www&lt;/p&gt;&#xA;&lt;p&gt;Router(config-ext-nacl)# deny tcp any host 192.168.1.125 eq www&lt;/p&gt;&#xA;&lt;p&gt;Router(config-ext-nacl)# exit&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;ACLs look at their rules in a top-down fashion. So, when a packet enters an interface, the ACL will start at the top and work its way down the list until the packet matches a rule. If there is no rule in the ACL which addresses a packet, the packet gets dropped.&lt;/p&gt;&#xA;&lt;p&gt;This is just an example configuration. You should read up on ACLs to ensure that you use the proper configuration for your situation.&lt;/p&gt;&#xA;&lt;p&gt;The first step creates an extended ACL and moves the user to Extended ACL Configuration Mode.&lt;/p&gt;&#xA;&lt;p&gt;The second step creates an ACL rule which allows traffic from all hosts in subnet 10.230.32.0 to reach the web server at 192.168.1.125 using destination TCP port 80 (HTTP). Note that ACLs use wildcard masks (e.g. 0.0.0.255) to describe a subnet mask, rather than the typical subnet mask you would use when creating static routes, DHCP pools, etc.&lt;/p&gt;&#xA;&lt;p&gt;The third step denies all other hosts from accessing the web server via HTTP.&lt;/p&gt;&#xA;&lt;p&gt;Next, you need to assign the ACL to an interface. With extended ACLs, you want to configure the router interface which is closest to the source. So, whichever interface is connected to the 10.230.32.0 needs to have your new ACL configured. We'll just use g0/1 as a placeholder for this example.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Router# configure terminal&lt;/p&gt;&#xA;&lt;p&gt;Router(config)# interface GigabitEthernet 0/1&lt;/p&gt;&#xA;&lt;p&gt;Router(config-if)# ip access-group ACL in&lt;/p&gt;&#xA;&lt;p&gt;Router(config-if)# end&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Finally, the last steps show how to configure your new ACL on the incoming interface of your router.&lt;/p&gt;&#xA;&lt;p&gt;Good luck. And don't forget to remove your NAT configs first.&lt;/p&gt;&#xA;" OwnerUserId="35089" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-03-10T19:48:34.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39605" PostTypeId="2" ParentId="11106" CreationDate="2017-03-10T20:23:18.213" Score="0" Body="&lt;p&gt;You said:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When I disconnect the trunk between Switch with VLAN20 to Root switch - the port to Switch VLAN21 doesn't forward packets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is most likely due to how STP converges after a change in network topology. After the trunk from Vlan20 is shut down, the surrounding switches will change their STP behavior to accommodate the change. This can lead to ports being blocked which were not blocked before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should set one of your core switches to be the primary root for half of the vlans, and the other core switch to be primary root for the other half. This will typically allow all vlan traffic to reach all devices in a LAN. &lt;/p&gt;&#xA;" OwnerUserId="35089" LastActivityDate="2017-03-10T20:23:18.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39606" PostTypeId="2" ParentId="39599" CreationDate="2017-03-10T20:29:59.877" Score="1" Body="&lt;p&gt;The default convergence time for 802.1D STP is 50 seconds. Something like 15-20 minutes is insanity. I agree with Ron in the comments - it sounds like you need a layer of distribution switches in your network to act as the STP roots for your VLANs. This helps keep things nice and orderly while ensuring that no loops occur.&lt;/p&gt;&#xA;" OwnerUserId="35089" LastActivityDate="2017-03-10T20:29:59.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39607" PostTypeId="2" ParentId="37890" CreationDate="2017-03-10T21:18:26.323" Score="1" Body="&lt;p&gt;The &quot;LLDP run&quot; command enables LLDP globally, but you still need to configure each interface with the transmit/receive commands for it to exchange frames with neighbors on that interface.&lt;/p&gt;&#xA;" OwnerUserId="35089" LastActivityDate="2017-03-10T21:18:26.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39608" PostTypeId="1" AcceptedAnswerId="39612" CreationDate="2017-03-10T21:56:52.777" Score="2" ViewCount="240" Body="&lt;p&gt;I have a very rudimentary doubt. I am sure missing something but cant recollect what.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose we have 2 hosts connected on 2 interfaces of a switch. if host 1 pings host 2 , it will first send an ARP request for host 2, host 2 will reply and it will be entered in the ping packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BUT, we dmac is always of the next hop of the packet. In this case the next hop of the packet is the switch interface, so why dmac of the host and not the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it that next hop concept is used in routers and not in switches ?&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-03-11T02:50:16.120" Title="ARP reply and use" Tags="|lan|switching|arp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39609" PostTypeId="2" ParentId="39608" CreationDate="2017-03-10T22:00:49.923" Score="1" Body="&lt;p&gt;Hops are for routers, or other layer-3 devices. Switches are transparent devices, and the frames are unchanged by a switch. A switch will terminate the physical layer-1 connection, but it doesn't terminate the layer-2 connection. Hosts, including routers, will terminate a layer-2 connection.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-11T02:24:55.673" LastActivityDate="2017-03-11T02:24:55.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39612" PostTypeId="2" ParentId="39608" CreationDate="2017-03-11T02:50:16.120" Score="1" Body="&lt;p&gt;Hosts do not know whether they are &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host/&quot; rel=&quot;nofollow noreferrer&quot;&gt;connected to directly to another host&lt;/a&gt;, or to &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-switch/&quot; rel=&quot;nofollow noreferrer&quot;&gt;a switch&lt;/a&gt;, or to &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/communication-through-multiple-switches/&quot; rel=&quot;nofollow noreferrer&quot;&gt;two switches&lt;/a&gt;. They only know who the other party is they want to speak to, not what devices may or may not exist in between.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After having completed the &lt;a href=&quot;http://www.practicalnetworking.net/series/arp/traditional-arp/&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARP process&lt;/a&gt;, the host will be able to create a packet with a L2 header that includes a destination MAC address of the other host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch will then behave as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ITXpQ.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ITXpQ.gif&quot; alt=&quot;Packet Traveling - Host to Host communication through a Switch&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this example, the initial frame is addresses unicast, directly to Host B. The switch will flood the frame out all ports because it does not know (at this point) where Host B's MAC address exists.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Had the initial frame been a &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-switch/#broadcasts&quot; rel=&quot;nofollow noreferrer&quot;&gt;broadcast&lt;/a&gt;, which is to say a frame destined to the MAC address &lt;code&gt;ffff.ffff.ffff&lt;/code&gt;, the effect would have been the same -- the switch would have &lt;a href=&quot;http://www.practicalnetworking.net/series/packet-traveling/host-to-host-through-a-switch/#flooding&quot; rel=&quot;nofollow noreferrer&quot;&gt;flooded&lt;/a&gt; the frame.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2017-03-11T02:50:16.120" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39615" PostTypeId="2" ParentId="39557" CreationDate="2017-03-11T08:25:38.923" Score="0" Body="&lt;p&gt;show inventory : Displays the switch type, components (including media), and Dell Networking OS version including hardware identification numbers and configured protocols&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Show Version&#xA;The show version command is very useful. From running the command I can see the following useful pieces of information about my router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Model&#xA;Uptime&#xA;IOS Version &amp;amp; software release&#xA;CPU, RAM, NVRAM &amp;amp; Flash details&#xA;Configuration Register setting&lt;/p&gt;&#xA;" OwnerUserId="35100" LastEditorUserId="8499" LastEditDate="2017-03-11T14:03:35.690" LastActivityDate="2017-03-11T14:03:35.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39616" PostTypeId="2" ParentId="39557" CreationDate="2017-03-11T08:46:17.717" Score="0" Body="&lt;p&gt;The show inventory command allows you to view the UDI for a NAM device. This identity information is stored in the NAM device's non-volatile memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•PID—Product identification (ID) number of the device&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•VID—Version ID of the device. Displays as 0 if the version number is not available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;•SN—Serial number of the device &lt;/p&gt;&#xA;&#xA;&lt;p&gt;example :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SW-1#show inve&#xA;FI-CIS-MRF-SW-1#show inventory&#xA;NAME: &quot;1&quot;, DESCR: &quot;WS-C3750X-48&quot;&#xA;PID: WS-C3750X-48T-E   , VID: V06  , SN: FDO1825Z16G&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAME: &quot;Switch 1 - Power Supply 0&quot;, DESCR: &quot;FRU Power Supply&quot;&#xA;PID: C3KX-PWR-350WAC   , VID: V03L , SN: LIT18110PRW&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAME: &quot;Switch 1 - FRULink Slot 1 - FRULink Module&quot;, DESCR: &quot;FRULink 1G Module&quot;&#xA;PID: C3KX-NM-1G        , VID: V01  , SN: FDO14381EJN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAME: &quot;GigabitEthernet1/1/1&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID: GLC-LH-SMD          , VID: V01  , SN: FNS164802G2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAME: &quot;GigabitEthernet1/1/2&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID: GLC-LH-SMD          , VID: V01  , SN: AGA1730U4KS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAME: &quot;GigabitEthernet1/1/3&quot;, DESCR: &quot;1000BaseLX SFP&quot;&#xA;PID: Unspecified       , VID:      , SN: OP10G4CE1330&lt;/p&gt;&#xA;" OwnerUserId="35101" LastActivityDate="2017-03-11T08:46:17.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39618" PostTypeId="1" AcceptedAnswerId="46656" CreationDate="2017-03-11T15:18:19.473" Score="3" ViewCount="209" Body="&lt;p&gt;I have csr1000v running in virtualbox and I managed to connect to it and&#xA;the console looks like &quot;&lt;code&gt;RP/0/0/CPU0:ios(admin)#&lt;/code&gt;&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when I try to launch tclsh - it says &quot;invalid input detected&quot;.&#xA;How do I enable it? I assume tcl is installed on all IOS devices, isn't it?&lt;/p&gt;&#xA;" OwnerUserId="35104" LastActivityDate="2017-12-29T11:35:30.647" Title="How do I enable tcl console on csr1000v?" Tags="|cisco-ios|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39621" PostTypeId="2" ParentId="39450" CreationDate="2017-03-11T22:17:35.667" Score="2" Body="&lt;p&gt;I figured it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASR's IP address needs to be in an ACL on the device that you want to pull the config from.  It must also have write privilege.  The ASR also needs the IP address in an ACL from the device that you are trying to pull the config from.  If you do a debug snmp packets on both devices you will see the communication waiting for responses from both devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Optional:  If you are trying to push a file from another tftp server through SNMP the device that is receiving the file will also need an ACL with that server's IP address for it to work.&lt;/p&gt;&#xA;" OwnerUserId="34910" LastActivityDate="2017-03-11T22:17:35.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39622" PostTypeId="2" ParentId="18873" CreationDate="2017-03-12T07:23:03.900" Score="3" Body="&lt;p&gt;North South traffic is usually considered from end users to the internet, where traditionally organizations used to have fat links to end user and thin links to the external connectivity. In the recent times, the traffic patterns have changed drastically and more traffic is generated inside the data center in a server to server communication which is referred as east west traffic.&lt;/p&gt;&#xA;" OwnerUserId="35112" LastActivityDate="2017-03-12T07:23:03.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39623" PostTypeId="2" ParentId="33905" CreationDate="2017-03-12T07:32:44.073" Score="0" Body="&lt;p&gt;All the above are reasonable replies, but if your deploying these in a carrier class network there is also the considerable issue of where you need to deploy them.&#xA;One approach is to have an NFV micro instance ready to spin up at every node, but then they can rarely be stateful if the packet flow is dynamic.&#xA;Another approach is to funnel all the traffic through a small number of points near the customer gateways to maintain state but at the cost of scaling.&#xA;In an enterprise environment then firewalls can often be virtualised/scaled at the boundary of the SDN network or before the access layer. &lt;/p&gt;&#xA;" OwnerUserId="35105" LastActivityDate="2017-03-12T07:32:44.073" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39624" PostTypeId="2" ParentId="18873" CreationDate="2017-03-12T07:44:05.120" Score="1" Body="&lt;p&gt;I have also seen it used in an NFV context where the traffic entering/leaving a NFV stack. North/South (entering and leaving a virtual router) and traffic between modules at the same layer in the same physical infrastructure is referred to as East/West, i.e. Routing within the same physical box.&lt;/p&gt;&#xA;" OwnerUserId="35105" LastActivityDate="2017-03-12T07:44:05.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39626" PostTypeId="2" ParentId="39572" CreationDate="2017-03-12T11:01:30.633" Score="1" Body="&lt;p&gt;The most likely scenario is that multiple downstream interfaces are receiving bursts of traffic bound for this 10G uplink, and it is unable to cope for short periods of time, leading to these drops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your Interface reliability counter is showing &lt;code&gt;255/255&lt;/code&gt;, so it is unlikely that this condition is regular, however clearing down the interface stats each day (or even graphing them in a 3rd-party SNMP tool) would be worthwhile to correlate new output errors with current traffic volumes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility is that you have a QoS policy applied to the interface that is limiting outbound traffic in some way - check this with &lt;code&gt;show policy-map interface TenGigabitEthernet1/1&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-03-12T11:01:30.633" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39627" PostTypeId="2" ParentId="39599" CreationDate="2017-03-12T11:24:34.230" Score="2" Body="&lt;p&gt;15 minute convergence?  Ouch! ;)  But yes, I agree with your suspicion - multiple 802.1D bridges scattered around the network could easily blow out convergence, as they block all ports other than root while in their Listening state - multiply this by a few boxes and you'll have quite a few topology state changes as the radius increases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, if you're running STP, you need to run it on all switches period.  Trying to diagnose whether BPDUs will be forwarded or dropped by switches with STP disabled is a path to madness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have devices that don't support STP, either bin them, or move them out to the edges of the network where they can't interfere with the topology (eg: on a branch of the network with only 1 uplink and 1 downlink).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP is hard to troubleshoot at scale because of the fact that there is really only unidirectional communication when everything is working - eg: BPDUs only travel out from the root of the tree, so it's hard to know the state of a downstream device from an upstream one.  I would strongly suggest you print out a physical map of the network (or draw it), mark the root bridge and then connect to every adjacent bridge, marking out which is the root port (and speed), designated ports (and speed) and any blocked ports for each node.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the amount of information you can pull from each switch, you might be able to determine STP vs RSTP by the port costs associated to each interface - STP treats a 1Gbps interface as a port cost of 4 and RSTP treats them as a cost of 20,000 - this might give you a hint as to where the offending switches are.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-03-12T11:24:34.230" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39631" PostTypeId="1" CreationDate="2017-03-12T15:37:19.313" Score="1" ViewCount="161" Body="&lt;p&gt;In NS2, I connected one sink node with two source nodes. For that, seperate two agents are created for sink (For example TCPSink) node and connected with source node (TCP). My question is, are these connections form seperate channels or only one channel? &lt;/p&gt;&#xA;" OwnerUserId="35122" LastActivityDate="2017-03-12T15:37:19.313" Title="Connection between nodes in NS2" Tags="|network|" AnswerCount="0" CommentCount="2" ClosedDate="2019-02-09T01:05:06.913" ContentLicense="CC BY-SA 3.0" />
  <row Id="39633" PostTypeId="2" ParentId="38808" CreationDate="2017-03-12T16:35:40.050" Score="0" Body="&lt;p&gt;Although enabling nat-t is global command but you can disable NAT-T on a per VPN basis, on crypto map entry: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;EX: crypto map outside_map 5 set nat-t-disable&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but anyway enabling nat-t is not going to impact your other tunnels at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAT-T functionality will allow the ASA to detect devices behind a NAT and will use UDP port 4500 instead of UDP 500.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current peers that are not behind a nat device will just work as usual with UDP port 500.&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-03-12T16:35:40.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39635" PostTypeId="1" CreationDate="2017-03-12T22:33:57.427" Score="2" ViewCount="117" Body="&lt;p&gt;Say I have a PBX system and want to connect the outside line to another PBX unit (as an extension). And say I want to connect that to a larger PBX, etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, assuming that 9 is the outside line selector at each level, it would look something like when you dial the number 555-1212:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not on PBX: 555-1212&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Top Level PBX: 9-555-1212&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1st Nested PBX: 99-555-1212&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2nd Nested PBX: 999-555-1212&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3rd Nested PBX: 9999-555-1212&lt;/p&gt;&#xA;&#xA;&lt;p&gt;...and so on...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(the PSTN is hierarchical in structure so this doesn't seem that radical)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would there be any complications in such a setup, where you just move up the stack at each level?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note I am not asking about a VoIP or digital setup: just a regular analog system and analog phone. As such, there would no concept of a &quot;dial plan&quot; in this system. There is literally nothing like to configure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a forum that exemplifies exactly what I'm talking about: &lt;a href=&quot;http://www.classicrotaryphones.com/forum/index.php?topic=16612.0&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.classicrotaryphones.com/forum/index.php?topic=16612.0&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27721" LastEditorUserId="27721" LastEditDate="2017-03-31T01:29:36.237" LastActivityDate="2017-03-31T01:29:36.237" Title="Can you nest Private Branch Exchanges?" Tags="|telephony|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39636" PostTypeId="2" ParentId="39635" CreationDate="2017-03-12T22:42:42.727" Score="2" Body="&lt;p&gt;Yes, that is possible - the local telephone exchange is basically just a large PBX (without the P/Private bit).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your PABX, you may not even require multiple layers of trunk access code to get an outside line, but that would be device-specific.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-03-12T22:42:42.727" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="39639" PostTypeId="2" ParentId="37243" CreationDate="2017-03-13T03:34:58.157" Score="5" Body="&lt;p&gt;It's the last point of significance in a service provider's network, relative to the consumers of that service, from the point of view of the service provider. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;in the days of dial up Internet service, the consumers had modems in their homes attached to phone lines, and the head end was the concentrator where all those phone lines met up. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;in cable TV systems its the unit that everyone's coax connects to for bundling back to the cable provider. Could be a street cabinet or a CMTS. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;etc. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2017-03-13T03:34:58.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39640" PostTypeId="1" AcceptedAnswerId="39647" CreationDate="2017-03-13T06:57:06.370" Score="3" ViewCount="4800" Body="&lt;p&gt;I am new to networking and I want to understand how to merge (bridge) two networks and what all things (parametres) change when the nerworks are merged. Can somebody explain more in an educational way? Thanks a lot!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By merge I mean 'bridge' two networks. The two networks are LANs which are operated by separate dedicated switches. I don't want to just connect them with a router. I want to use a bridge and merge them into a single network.&lt;/p&gt;&#xA;" OwnerUserId="35134" LastEditorUserId="35134" LastEditDate="2017-03-13T08:44:19.870" LastActivityDate="2017-03-13T14:58:04.193" Title="Merging two networks" Tags="|bridge|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39641" PostTypeId="1" CreationDate="2017-03-13T07:05:47.573" Score="1" ViewCount="30" Body="&lt;p&gt;I have successfully connected to Alcatel OmniPCX device via Serial COM port with help of XShell program to config interface. &lt;br&gt;&#xA;It says that it is connected. It doesn's ask for login and password.  &lt;br&gt;&#xA;But I have to write login and password to continue my configuration. &lt;br&gt;&#xA;How and where can I write my login and password? &lt;br&gt;&#xA;Thank you guys!&lt;/p&gt;&#xA;" OwnerUserId="23552" LastActivityDate="2017-03-13T07:05:47.573" Title="When connecting via com port, it doesnt ask login and password" Tags="|port-channel|" AnswerCount="0" CommentCount="3" ClosedDate="2018-07-27T00:24:30.973" ContentLicense="CC BY-SA 3.0" />
  <row Id="39643" PostTypeId="1" AcceptedAnswerId="39650" CreationDate="2017-03-13T07:33:22.427" Score="5" ViewCount="22584" Body="&lt;p&gt;I read somewhere that a fragmented ip packet can further be fragmented depending on the changes in the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now how is the packet reassembled at the router. Because the identification bit can be used for one set of packets. Can someone give an example &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, is the identification number randomly chosen or does it have some specific algorithm behind it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And finally, what is the significance of the reserved bit used in the IP flag&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2020-04-28T11:06:21.523" Title="Ip fragmentation and packet headers" Tags="|ip|fragmentation|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39646" PostTypeId="2" ParentId="39643" CreationDate="2017-03-13T09:05:34.137" Score="0" Body="&lt;p&gt;It's unlikely to have MRU different than the MTU.&#xA;If fragmentation is needed on an already fragmented packet, the router treats it just like any other IP packet that needs fragmentation.&#xA;The routers in the middle do not reassemble the packet. Reassembly is done at the destination. The routers simply fragment the packet and simply adjust the offset value. And for the IPID I don't think the routers change it(that's my guess), as the destination host is the one who is handling the reassembly.&lt;/p&gt;&#xA;" OwnerUserId="35135" LastActivityDate="2017-03-13T09:05:34.137" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39647" PostTypeId="2" ParentId="39640" CreationDate="2017-03-13T10:07:09.470" Score="2" Body="&lt;p&gt;A switch is a bridge. To connect the two networks together at layer 2, all you have to do is to connect a cable between the 2 existing switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if both networks use different IP addressing , they will not be able to communicate with each other without a router or without re-addressing all devices in one network&lt;/li&gt;&#xA;&lt;li&gt;if both use the same IP addressing, you may have conflicts if the same IP address is used in both networks, so you should change IP addresses of conflicting host before connecting the two network together&lt;/li&gt;&#xA;&lt;li&gt;if you use VLANs you must also assess the logical topology and design the new merged network accordingly&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-13T10:07:09.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39648" PostTypeId="5" CreationDate="2017-03-13T10:19:22.633" Score="0" Body="&lt;p&gt;Arista manufactures routers and switches that use EOS (Extendible Operating System). &lt;/p&gt;&#xA;" OwnerUserId="35139" LastEditorUserId="8499" LastEditDate="2017-03-13T14:51:22.427" LastActivityDate="2017-03-13T14:51:22.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39649" PostTypeId="4" CreationDate="2017-03-13T10:19:22.633" Score="0" Body="Use this tag for Arista Specific questions. " OwnerUserId="35139" LastEditorUserId="509" LastEditDate="2017-03-13T12:17:26.850" LastActivityDate="2017-03-13T12:17:26.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39650" PostTypeId="2" ParentId="39643" CreationDate="2017-03-13T10:52:12.357" Score="6" Body="&lt;p&gt;The &lt;a href=&quot;https://en.wikipedia.org/wiki/IPv4#Fragmentation_and_reassembly&quot; rel=&quot;noreferrer&quot;&gt;Fragmentation and reassembly&lt;/a&gt; section of the &lt;a href=&quot;https://en.wikipedia.org/wiki/IPv4&quot; rel=&quot;noreferrer&quot;&gt;IPv4&lt;/a&gt; Wikipedia article explains it quite well:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Fragmentation and reassembly Main article: IP fragmentation&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Internet Protocol enables networks to communicate with one&#xA;  another. The design accommodates networks of diverse physical nature;&#xA;  it is independent of the underlying transmission technology used in&#xA;  the Link Layer. Networks with different hardware usually vary not only&#xA;  in transmission speed, but also in the maximum transmission unit&#xA;  (MTU). When one network wants to transmit datagrams to a network with&#xA;  a smaller MTU, it may fragment its datagrams. In IPv4, this function&#xA;  was placed at the Internet Layer, and is performed in IPv4 routers,&#xA;  which thus only require this layer as the highest one implemented in&#xA;  their design.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In contrast, IPv6, the next generation of the Internet Protocol, does&#xA;  not allow routers to perform fragmentation; hosts must determine the&#xA;  path MTU before sending datagrams.  &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Fragmentation&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When a router receives a packet, it examines the destination address&#xA;  and determines the outgoing interface to use and that interface's MTU.&#xA;  If the packet size is bigger than the MTU, and the Do not Fragment&#xA;  (DF) bit in the packet's header is set to 0, then the router may&#xA;  fragment the packet.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The router divides the packet into fragments. The max size of each&#xA;  fragment is the MTU minus the IP header size (20 bytes minimum; 60&#xA;  bytes maximum). The router puts each fragment into its own packet,&#xA;  each fragment packet having following changes:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The total length field is the fragment size.&lt;/li&gt;&#xA;  &lt;li&gt;The more fragments (MF) flag is set for all fragments except the last one, which is set to 0.&lt;/li&gt;&#xA;  &lt;li&gt;The fragment offset field is set, based on the offset of the fragment in the original data payload. This is measured in units of&#xA;  eight-byte blocks.&lt;/li&gt;&#xA;  &lt;li&gt;The header checksum field is recomputed.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;For example, for an MTU of 1,500 bytes and a header size of 20 bytes,&#xA;  the fragment offsets would be multiples of (1500–20)/8 = 185. These&#xA;  multiples are 0, 185, 370, 555, 740, ...&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;It is possible for a packet to be fragmented at one router, and for&#xA;  the fragments to be fragmented at another router. For example,&#xA;  consider a Transport layer segment with size of 4,500 bytes, no&#xA;  options, and IP header size of 20 bytes. So the IP packet size is&#xA;  4,520 bytes. Assume that the packet travels over a link with an MTU of&#xA;  2,500 bytes. Then it will become two fragments: &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bxuZz.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bxuZz.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note that the fragments preserve the data size: 2480 + 2020 = 4500.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note how we get the offsets from the data sizes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.&#xA;0 + 2480/8 = 310.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;Assume that these fragments reach a link with an MTU of 1,500 bytes.&#xA;  Each fragment will become two fragments: &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gVr4m.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gVr4m.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note that the fragments preserve the data size: 1480 + 1000 = 2480,&#xA;  and 1480 + 540 = 2020.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Also in this case, the More Fragments bit remains 1 for ALL the&#xA;  fragments that came with 1 in them and for the last fragment that&#xA;  arrives, it works as usual, that is the MF bit is set to 0 only in the&#xA;  last one. And of course, the Identification field continues to have&#xA;  the same value in all re-fragmented fragments. This way, even if&#xA;  fragments are re-fragmented, the receiver knows they have initially&#xA;  all started from the same packet.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note how we get the offsets from the data sizes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.&#xA;0 + 1480/8 = 185&#xA;185 + 1000/8 = 310&#xA;310 + 1480/8 = 495&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;  &#xA;  &lt;p&gt;We can use the last offset and last data size to calculate the total&#xA;  data size: 495*8 + 540 = 3960 + 540 = 4500. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Reassembly&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A receiver knows that a packet is a fragment if at least one of the&#xA;  following conditions is true:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The &quot;more fragments&quot; flag is set. (This is true for all fragments except the last.)&lt;/li&gt;&#xA;  &lt;li&gt;The &quot;fragment offset&quot; field is nonzero. (This is true for all fragments except the first.)&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;The receiver identifies matching fragments using the foreign and local&#xA;  internet address, the protocol ID, and the identification field. The&#xA;  receiver will reassemble the data from fragments with the same ID&#xA;  using both the fragment offset and the more fragments flag. When the&#xA;  receiver receives the last fragment (which has the &quot;more fragments&quot;&#xA;  flag set to 0), it can calculate the length of the original data&#xA;  payload, by multiplying the last fragment's offset by eight, and&#xA;  adding the last fragment's data size. In the example above, this&#xA;  calculation was 495*8 + 540 = 4500 bytes.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When the receiver has all the fragments, it can put them in the&#xA;  correct order, by using their offsets. It can then pass their data up&#xA;  the stack for further processing.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As for the reserved bit, it is reserved and must be zero and has no special significance. &lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-13T10:52:12.357" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39653" PostTypeId="2" ParentId="16170" CreationDate="2017-03-13T13:21:42.187" Score="-2" Body="&lt;p&gt;well unlike all of the other answer you have already received (and probably will receive) :&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;YES (but nobody has done it before)&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;TCP is a stream-oriented protocol hence logical connections between request &amp;amp; response have to be established - in the case of multicast at least one important information is missing : the recipient address. Without that, quite a few algorithms (if not all) will stop working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The solution seems to be horribly complex - one would need to incercept all (!) of the packets at the &lt;a href=&quot;https://en.wikipedia.org/wiki/OSI_model#Layer_3:_Network_Layer&quot; rel=&quot;nofollow noreferrer&quot;&gt;network layer&lt;/a&gt; on all sides &lt;em&gt;(weird people call it &quot;internet layer&quot;)&lt;/em&gt; hence create an entirely new protocol which actually just maps against a real one. Plus : your multicast traffic will not be routed beyond your local network border, literally all ISPs will refuse these packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also : the multicast sender will have to deal with &lt;strong&gt;&lt;em&gt;n&lt;/em&gt;&lt;/strong&gt; answers to each of these transmissions - which will reduce the bandwidth gain significantly, in fact it will most definitely also increase processing time and probably overstress most NIC processing chips.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That might be a very cool experiment, though - you will need advanced programming skills and a LOT of knowledge about computer networks, operating systems and network standards :)&lt;/p&gt;&#xA;" OwnerUserId="35081" LastEditorUserId="35081" LastEditDate="2017-03-14T09:15:21.197" LastActivityDate="2017-03-14T09:15:21.197" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="39655" PostTypeId="2" ParentId="9868" CreationDate="2017-03-13T14:56:49.410" Score="-1" Body="&lt;p&gt;Create one more vlan (you can delete it afterwards) and it should resolve your problem&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;add vlan 999&#xA;exit &#xA;no vlan 999&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35146" LastEditorUserId="5965" LastEditDate="2020-08-21T13:07:04.617" LastActivityDate="2020-08-21T13:07:04.617" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="39656" PostTypeId="2" ParentId="22841" CreationDate="2017-03-13T14:56:55.163" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;My question is, must every intermediary device on network wait for all the IP datagram fragments to arrive and reassemble them in the correct order and re-fragment if necessary?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The original intent was that reassembly would be performed only on the final end host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However some intermediate devices will reassemble fragmented packets because it makes firewalling and NAT much simpler. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-13T14:56:55.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39659" PostTypeId="1" AcceptedAnswerId="39672" CreationDate="2017-03-13T17:04:01.513" Score="1" ViewCount="325" Body="&lt;p&gt;We going to open branch office.&#xA;In Head office we have 2 ASA firewalls (active-standby) and 2960 switches on each floor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can i connect branch office to the main office ?&#xA;I have 2901 Router and HP 1910-8 Switch. Can they work properly ?&lt;/p&gt;&#xA;" OwnerUserId="32384" LastEditorUserId="8499" LastEditDate="2018-12-25T04:19:40.333" LastActivityDate="2018-12-25T04:19:40.333" Title="Branch office network" Tags="|cisco|router|cisco-asa|firewall|hp|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="39660" PostTypeId="1" CreationDate="2017-03-13T17:08:15.363" Score="4" ViewCount="202" Body="&lt;p&gt;I dont know if my research is enough or not but I could not find answers on the net. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is why not use bridges instead of routers. We know bridges can connect two different networks. Using bridges (or switches) we can transfer data from one network to another using the MAC address to identify the hosts. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, we say routers selects the best possible routes and send data to that line. It's just algorithm and so such algorithms like (Distance Vector Routing or Link State Routing) can be implemented in the bridges. Then bridges too can select best possible path and futhermore operates just using MAC addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now wouldn't this question the existence of router? And if routers don't exist then there would be no existence of IP address too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, my question is why need extra IP addressing to identify the devices. I also know people say IP is logical addressing and Bridges dont operate in Network Layer and such. So my question becomes why the exact need of Network Layer when Layer 2 can do those such things. What is the noticeable distinction between layer 2 and layer 3 such that layer 3 is essential?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am well aware that I am missing some points. I just need to clarify my doubts with strong reasoning of need of IP addresses, Routers and Network Layer.&lt;/p&gt;&#xA;" OwnerUserId="35005" LastEditorUserId="8499" LastEditDate="2019-01-05T03:41:50.317" LastActivityDate="2021-01-05T12:47:45.933" Title="Need of routers and IP addresses" Tags="|routing|router|ip-address|layer2|layer3|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39661" PostTypeId="2" ParentId="39660" CreationDate="2017-03-13T17:38:05.470" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;We know bridges can connect two different networks. Using bridges (or&#xA;  switches) we can transfer data from one network to another using the&#xA;  MAC address to identify the hosts.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That just isn't true. A bridge is a transparent, layer-2 device that works on a LAN. It knows nothing about other LANs or layer-3, e.g. IP, and there is no hierarchy. Every host on a LAN is a peer, and all broadcast traffic reaches, and interrupts, every host on a LAN, even if the traffic is not meant for that host, and LANs can grow large enough that they break because of all the broadcast traffic. (LANs are also know as broadcast domains.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router is required to get traffic from one LAN to another LAN because there is no concept of different LANs at layer-2. You need to have layer-3 to distinguish between LANs. The Internet routing table is huge, over 600,000 routes to different networks, but layer-2 would require individual addresses for all the hosts on each of those networks, and that just isn't practical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is very little security on a LAN, but it is very easy to add security between LANs at layer-3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 will get you from one host to a different host on the same LAN, but you need layer-3 to get from on LAN to another LAN, and you need layer-4 to get to the process within a host.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-13T17:38:05.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39662" PostTypeId="2" ParentId="39660" CreationDate="2017-03-13T17:40:39.580" Score="7" Body="&lt;p&gt;Imagine you are connected to a bridge with 3 ports.  One port is connected to your host; one connects to networks to the west of you, and the last one connects to networks to the east of you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now suppose you want to send data to a device with a layer 2 address. How does your bridge know whether to forward the packet to the east or the west? Obviously, your bridge will look up the MAC address in its forwarding table and forward the packet out the proper interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now imagine you are in a global network.  Are you going to keep every MAC address in the world on your bridge?  What happens as devices are turned on or off?  If they move?  How will you find unknown devices?  Will you flood over the entire globe?  You can't keep track of every device on a global network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, layer 3 address provide routing information.  Layer 3 address have a hierarchy that conveys location as well as identity.  The network portion of an IP address tells you &lt;em&gt;where&lt;/em&gt; the host is (topologically), and that information can be summarized, so your PC doesn't need to know how to forward data to every host on the Internet.  That ability to scale routing makes a global Internet possible.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-13T17:40:39.580" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39663" PostTypeId="2" ParentId="39659" CreationDate="2017-03-13T18:00:30.170" Score="1" Body="&lt;p&gt;Since you are using private addressing internally at each site, you need to set up a tunnel between the sites over the public Internet, and it would be wise to encrypt the contents of the tunnel (VPN). When you have the tunnel in place, you can route traffic between the two sites in the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are using Cisco equipment, and Cisco maintains documentation on how to set up site-to-site tunnels, e.g. &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/vpn_modules/6342/vpn_cg/6342site3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Site-to-Site and Extranet VPN Business Scenarios&lt;/em&gt;&lt;/a&gt;, but you can search for other documents, too.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-13T18:00:30.170" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39664" PostTypeId="1" CreationDate="2017-03-13T19:31:06.950" Score="2" ViewCount="1810" Body="&lt;p&gt;I have to set up and design a network as illustrated in:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8b6O3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8b6O3.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need  to configure ACLs on inside interface and outside one. However, when&#xA;I implemented the access-lists, the flow of traffic was affected and the internet connectivity was unavailable, and also external users could&#xA;not access published services. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you please have a look on the configured ACLs and give me a clue about the issue? &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;! This ACL gets applied to the interface interface which is connected to my LAN&#xA;&#xA;ip access-list extended INSIDE_ACL_IN&#xA;permit ip 20.20.20.0 0.0.0.15 any&#xA;deny ip any any &#xA;&#xA;&#xA;==========================================================================================&#xA;==========================================================================================&#xA;&#xA;! This ACL gets applied to the Outside interface which is connected to my Internet provider&#xA;&#xA;&#xA;ip access-list extended OUTSIDE_ACL_IN&#xA;&#xA;deny ip 127.0.0.0 0.255.255.255 any &#xA;deny ip 255.0.0.0 0.255.255.255 any &#xA;deny ip 224.0.0.0 31.255.255.255 any &#xA;deny ip host 0.0.0.0 any &#xA;deny ip 10.0.0.0 0.255.255.255 any &#xA;deny ip 172.16.0.0 0.15.255.255 any &#xA;deny ip 192.0.2.0 0.0.0.255 any &#xA;deny ip 192.168.0.0 0.0.255.255 any &#xA;deny ip 14.0.0.0 0.255.255.255 any &#xA;deny ip 169.254.0.0 0.0.255.255 any &#xA;deny ip 198.18.0.0 0.0.255.255 any &#xA;deny ip 66.238.29.0 0.0.0.31 any &#xA;deny ip 240.0.0.0 15.255.255.255 any&#xA;deny ip 162.16.0.0 0.15.255.255 any&#xA;deny 53 any any&#xA;deny 55 any any&#xA;deny 77 any any&#xA;deny pim any any&#xA;deny tcp any any eq bgp &#xA;deny tcp any eq bgp any &#xA;deny ipinip any any&#xA;deny gre any any&#xA;deny pim any any&#xA;deny 90 any any&#xA;deny ospf any any &#xA;deny eigrp any any &#xA;deny udp any eq rip any &#xA;deny udp any any eq rip &#xA;deny tcp any any eq 0 -input&#xA;deny udp any any eq 0 -input&#xA;deny tcp any any range 135 139&#xA;deny udp any any range 135 netbios-ss&#xA;deny udp any any eq snmp&#xA;deny udp any any eq snmptrap&#xA;deny tcp any any eq 445&#xA;deny udp any any eq 445&#xA;deny tcp any any eq 901&#xA;deny udp any any eq 901&#xA;deny tcp any any eq 1080&#xA;deny udp any any eq 1080&#xA;deny tcp any any range 1433 1434&#xA;deny udp any any range 1433 1434&#xA;deny tcp any any eq 1900&#xA;deny udp any any eq 1900&#xA;deny tcp any any eq 3389&#xA;deny udp any any eq 3389&#xA;deny tcp any any eq 5000&#xA;deny udp any any eq 5000&#xA;permit icmp any 10.1.1.0 0.0.0.255 echo-reply&#xA;permit icmp any 10.1.1.0 0.0.0.255 unreachable&#xA;permit icmp any 10.1.1.0 0.0.0.255 time-exceeded&#xA;permit icmp any 10.1.1.0 0.0.0.255 source-quench&#xA;permit icmp any 10.1.1.0 0.0.0.255 packet-too-big&#xA;permit icmp any 10.1.2.0 0.0.0.255 echo-reply&#xA;permit icmp any 10.1.2.0 0.0.0.255 unreachable&#xA;permit icmp any 10.1.2.0 0.0.0.255 time-exceeded&#xA;permit icmp any 10.1.2.0 0.0.0.255 source-quench&#xA;permit icmp any 10.1.2.0 0.0.0.255 packet-too-big&#xA;permit icmp any 10.1.3.0 0.0.0.7 echo-reply&#xA;permit icmp any 10.1.3.0 0.0.0.7 unreachable&#xA;permit icmp any 10.1.3.0 0.0.0.7 time-exceeded&#xA;permit icmp any 10.1.3.0 0.0.0.7 source-quench&#xA;permit icmp any 10.1.3.0 0.0.0.7 packet-too-big&#xA;permit icmp any 172.16.0 0.0.0.7 echo-reply&#xA;permit icmp any 172.16.0 0.0.0.7 unreachable&#xA;permit icmp any 172.16.0 0.0.0.7 time-exceeded&#xA;permit icmp any 172.16.0 0.0.0.7 source-quench&#xA;permit icmp any 172.16.0 0.0.0.7 packet-too-big&#xA;deny icmp any any fragments&#xA;deny icmp any any redirect&#xA;deny icmp any any&#xA;deny tcp any 192.168.1.0 0.0.0.255 eq 22 &#xA;deny tcp any 192.168.1.0 0.0.0.255 eq telnet &#xA;deny tcp any 192.168.1.0 0.0.0.255 eq www &#xA;deny tcp any 192.168.1.0 0.0.0.255 eq 443 &#xA;deny tcp any 192.168.1.0 0.0.0.255 eq 22 &#xA;deny tcp any 192.168.1.0 0.0.0.255 eq telnet &#xA;deny tcp any 192.168.1.0 0.0.0.255 eq www &#xA;deny tcp any 192.168.1.0 0.0.0.255 eq 443 &#xA;deny tcp any host 20.20.20.2  eq 22 &#xA;deny tcp any host 20.20.20.2  eq telnet &#xA;deny tcp any host 20.20.20.2  eq www &#xA;deny tcp any host 20.20.20.2  eq 443 &#xA;deny tcp any host 20.20.20.2  eq 22 &#xA;deny tcp any host 20.20.20.2  eq telnet &#xA;deny tcp any host 20.20.20.2  eq www &#xA;deny tcp any host 20.20.20.2  eq 443 &#xA;permit ip 10.1.0.0 0.0.255.255 10.1.0.0 0.0.255.255 &#xA;permit icmp 10.1.0.0 0.0.255.255 10.1.0.0 0.0.255.255&#xA;permit icmp 172.16.0 0.0.0.7 172.16.0 0.0.0.7&#xA;deny tcp any 66.238.29.0 0.0.0.31  fragments&#xA;deny udp any 66.238.29.0 0.0.0.31  fragments&#xA;deny icmp any 66.238.29.0 0.0.0.31  fragments&#xA;deny udp any any eq snmp&#xA;deny udp any any eq snmptrap&#xA;deny ip 192.0.2.0 0.0.0.255 any  &#xA;deny ip 4.0.0.0 0.255.255.255 any  &#xA;deny ip 69.254.0.0 0.0.255.255 any   &#xA;permit ip any 10.1.0.0 0.0.255.255&#xA;permit ip any 172.16.0 0.0.0.7 &#xA;deny ip any any log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35151" LastEditorUserId="8499" LastEditDate="2018-12-25T04:21:18.290" LastActivityDate="2018-12-25T04:21:18.290" Title="ACL on Internet Facing Interface" Tags="|cisco|router|acl|access-control|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39665" PostTypeId="2" ParentId="39664" CreationDate="2017-03-13T19:46:53.537" Score="1" Body="&lt;p&gt;You didn't include the entire router configurations (you should really do that), but you seem to be confusing the &lt;code&gt;in&lt;/code&gt; and &lt;code&gt;out&lt;/code&gt; keywords on the &lt;code&gt;INSIDE_ACL_IN&lt;/code&gt; configuration. The &lt;code&gt;in&lt;/code&gt; and &lt;code&gt;out&lt;/code&gt; keywords are from the perspective of the router, so applying the &lt;code&gt;permit ip 20.20.20.0 0.0.0.15 any&lt;/code&gt; (it should really be for &lt;code&gt;20.20.20.0 0.0.0.3&lt;/code&gt;) ACL from the interface for the &lt;code&gt;10.10.0.0/29&lt;/code&gt; network inbound to the router doesn't really make sense. It looks like you are trying to permit anything inbound from the &lt;code&gt;10.10.0.0/29&lt;/code&gt; network with a source address in the &lt;code&gt;20.20.20.0/28&lt;/code&gt; network, but deny everything else from that interface, which would deny traffic from the &lt;code&gt;10.10.0.0/29&lt;/code&gt; network into the router from the network interface for that network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are using extended access lists, so you want to apply those as close to the source as possible.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-14T17:15:13.627" LastActivityDate="2017-03-14T17:15:13.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39667" PostTypeId="1" CreationDate="2017-03-13T21:01:16.743" Score="2" ViewCount="3761" Body="&lt;p&gt;&lt;strong&gt;current configuration&lt;/strong&gt; &#xA;is that in my office we are using netgear GS switches which are configured as VLAN1 and VLAN2.  VLAN2 is for Voice. We have a Avaya Ip Phone System on a 192.168.200.XX.  The Data Network is 192.168.100.xx&#xA;The Switch ports are configured with both Data &amp;amp; Voice so when we connect a avaya phone to one of the ports it will detect it and give an IP from AVAYA Communication Manage which is on 192.168.200.xx also we can connect a laptop to the phone and it will get a IP address from 192.168.100.xx&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem&lt;/strong&gt;&#xA;I recently bought a Cisco 3750G-24P Switch, and trying to do the same but the avaya phone does not pick up IP address from the 200.xx but when I connect the PC to the same port it picks up a IP from the DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&#xA;How can i correctly configure my cisco router so that I can achieve what netgear switch does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately I am a noobe so step by step instructions is appreciated so i can lean as well&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you so much&lt;/p&gt;&#xA;&#xA;&lt;p&gt;************* current Config****** edited on 150317******&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 2&#xA; name avayaip-phone  &#xA;!  &#xA;vlan 101,401  &#xA;lldp run  &#xA;!  &#xA;!  &#xA;!  &#xA;interface GigabitEthernet1/0/1  &#xA;!  &#xA;interface GigabitEthernet1/0/2  &#xA; switchport access vlan 2  &#xA; switchport mode access  &#xA;!  &#xA;interface GigabitEthernet1/0/3  &#xA; switchport access vlan 2  &#xA; switchport mode access  &#xA; switchport voice vlan 2  &#xA; ip dhcp relay information check-reply  &#xA; spanning-tree portfast  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;" OwnerUserId="35154" LastEditorDisplayName="user36472" LastEditDate="2019-02-25T11:54:04.327" LastActivityDate="2019-02-25T11:54:04.327" Title="how to configure Cisco 3750 switch with Avaya IP Phone" Tags="|cisco|switch|cisco-catalyst|avaya|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39670" PostTypeId="2" ParentId="37974" CreationDate="2017-03-14T02:32:18.503" Score="-1" Body="&lt;p&gt;You can configure a lower privilege level directly on the console port. However, anyone who has physical access to the router/switch (the console port) actually can perform a factory reset on it. So, that kinda goes against the idea of implementing lower level access on the console port it seems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/VaAwG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/VaAwG.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastEditorUserId="15240" LastEditDate="2017-10-11T03:40:45.937" LastActivityDate="2017-10-11T03:40:45.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39671" PostTypeId="2" ParentId="39635" CreationDate="2017-03-14T02:43:58.170" Score="1" Body="&lt;p&gt;Nesting is not a commonly used term in telephony.  Extension numbers, aka directory numbers, or direct inward dial numbers, are defined in what is called the &lt;em&gt;dial plan&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of routing calls towards the Public Switched Telephone Network, PSTN, this is sometimes called route pattern or destination pattern matching.  Prefixing outside calls with a 9 is not necessary but is common.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A PSTN analog line is an FXO port.  While is it possible to connect FXS to FXO ports in-house, you practically never see this. Usuallu\y, a PBX is going to have PSTN connection(s) directly into it, preferable digital (ISDN PRI) or SIP trunks so you can get calling name and number and DID functionality.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-03-14T02:43:58.170" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39672" PostTypeId="2" ParentId="39659" CreationDate="2017-03-14T02:50:39.763" Score="0" Body="&lt;p&gt;It depends.  The ASA's potentially have deeper packet inspection / security functionality than the 2901 router.  So, do you centralize the ISP/Internet access out of HQ, or have split tunneling so that the branch office uses a local Internet pipe and IOS-firewall (CBAC) on the 2901?  Figure that out... See FirePower add-on bundle for ASA's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In terms of enabling connectivity between your IP endpoints (computers/printers/etc) in these 2 locations, that's called a VPN tunnel.  You'll be interested in a &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-negotiation-ike-protocols/119425-configure-ipsec-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Site-to-Site VPN tunnel between ASA and 2901&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-03-14T02:50:39.763" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39673" PostTypeId="2" ParentId="36662" CreationDate="2017-03-14T07:11:16.410" Score="8" Body="&lt;p&gt;I will explain here in the context of switches (layer 2).&lt;/p&gt;&#xA;&lt;h1&gt;Flooding&lt;/h1&gt;&#xA;&lt;p&gt;When a switch receives a &lt;strong&gt;unicast frame&lt;/strong&gt; (a frame with a specific MAC address intended for a particular device), it looks for the frame's destination MAC in its MAC address table. If there is no entry for the destination MAC in its table, it will simply send the frame out to everyone connected to its ports.&lt;/p&gt;&#xA;&lt;p&gt;The frame is still a unicast frame, since it has a specific destination MAC address in its header. The switch doesn't change any header data in the frame.&lt;/p&gt;&#xA;&lt;p&gt;All the devices that receive the frame will compare the destination MAC address in the frame with their own MAC address and drop the frame if it doesn't match.&lt;/p&gt;&#xA;&lt;h1&gt;Broadcasting&lt;/h1&gt;&#xA;&lt;p&gt;A broadcast frame is created by the host itself. A frame becomes a &lt;strong&gt;broadcast frame&lt;/strong&gt; if the destination MAC address is &lt;strong&gt;ff:ff:ff:ff:ff:ff&lt;/strong&gt;. Usually, the host creates this type of frames during the ARP process. When the switch receives a broadcast frame, it sends it out to everyone connected to it.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;In flooding the switch sends the frame to all because it doesn't know how to reach the destination.&lt;/p&gt;&#xA;&lt;p&gt;In broadcasting the host that created the frame itself addressed the frame to everyone.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="28128" LastEditorUserId="43734" LastEditDate="2023-12-03T13:49:11.210" LastActivityDate="2023-12-03T13:49:11.210" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="39675" PostTypeId="1" AcceptedAnswerId="39676" CreationDate="2017-03-14T07:24:58.720" Score="1" ViewCount="61" Body="&lt;p&gt;Two different websites have been opened from two different browsers(for instance chrome and firefox) on the same IP Device(PC) connected to the same router. When the response comes from far end, it's received by the router and then sent to the IP devices which has requested for it. How does the router decide which request have come from which browser? I am assuming, routers only have knowledge about IP addresses of the devices and not the browsers which is running on the device. So is the operating system involved in this decision making? Or is there something else happening? &lt;/p&gt;&#xA;" OwnerUserId="34803" LastActivityDate="2017-03-14T08:55:36.627" Title="Router decision making w.r.t web browsers" Tags="|router|nat|dns|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39676" PostTypeId="2" ParentId="39675" CreationDate="2017-03-14T07:38:54.910" Score="3" Body="&lt;p&gt;You're mixing up various layers of the &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_protocol_suite&quot; rel=&quot;nofollow noreferrer&quot;&gt;Internet Protocol Suite&lt;/a&gt; (or &lt;a href=&quot;https://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow noreferrer&quot;&gt;OSI model&lt;/a&gt; if you like). Routers do not interact with browers directly. Routers interact with hosts, which have IP addresses. As far as the router is concerned, both requests come from the same IP address, so return traffic goes back to that IP address, and it's up to that host to decide what to do with it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each browser on the host uses &lt;a href=&quot;https://en.wikipedia.org/wiki/Transmission_Control_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP/IP&lt;/a&gt; to communicate with the remote webserver, and each browser uses a different unique TCP source port to send traffic from. The host can distinguish based on this port number, so the TCP/IP stack on the host uses that to pass return traffic to the correct browser.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-03-14T07:38:54.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39678" PostTypeId="1" AcceptedAnswerId="39679" CreationDate="2017-03-14T09:23:40.697" Score="16" ViewCount="4841" Body="&lt;p&gt;In our rented office, we have a router (&lt;a href=&quot;https://www.productsandservices.bt.com/products/smart-hub&quot; rel=&quot;noreferrer&quot;&gt;BT smart hub&lt;/a&gt;) connected to a large switch (model unknown).  The two are connected using &lt;strong&gt;three&lt;/strong&gt; ethernet cables, thus:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;-----------------------&#xA;|  1  2  3  4  Router |  &#xA;-----------------------&#xA;   |  |  |  |&#xA;   |  |  |  ------[Mobile signal booster]&#xA;   |  |  | &#xA;------------------------------------&#xA;|  1  2  3  4 5 6 7 8 9 10  Switch |&#xA;------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Can anyone please explain the advantage this offers?  I always assumed that a switch was connected to a router using a single cable (as &lt;a href=&quot;https://www.howtogeek.com/99001/htg-explains-routers-and-switches/&quot; rel=&quot;noreferrer&quot;&gt;here&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="19942" LastActivityDate="2017-03-14T16:40:03.630" Title="Why would a switch be connected to a router using three ethernet cables?" Tags="|switch|router|ethernet|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39679" PostTypeId="2" ParentId="39678" CreationDate="2017-03-14T09:46:16.650" Score="32" Body="&lt;p&gt;The switch is probably a managed switch on which multiple VLANs are configured.  The three cables between the router and the switch are used to provide inter-VLAN routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility is that the multiple cables are used for link aggregation (e.g. LACP) to increase throughput.&lt;/p&gt;&#xA;" OwnerUserId="19543" LastActivityDate="2017-03-14T09:46:16.650" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39681" PostTypeId="1" AcceptedAnswerId="39682" CreationDate="2017-03-14T12:00:46.283" Score="1" ViewCount="68" Body="&lt;p&gt;I was researching &lt;a href=&quot;https://en.wikipedia.org/wiki/Load_balancing_(computing)#Load_balancer_features&quot; rel=&quot;nofollow noreferrer&quot;&gt;network load balancer features&lt;/a&gt; recently and I couldn't find a certain feature.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe I heard some years ago about a network load balancer feature (don't remember any feature name) in which the network balancer 'knows' how loaded (CPU, I/O, RAM etc.) a backend server is and dispatches the next request to the least loaded server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there such a feature? Are there reasons for not having this feature?&lt;/p&gt;&#xA;" OwnerUserId="35169" LastActivityDate="2017-03-14T15:05:31.497" Title="Load balancer features - load compensation" Tags="|load-balancing|load-balancer|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39682" PostTypeId="2" ParentId="39681" CreationDate="2017-03-14T12:37:40.070" Score="2" Body="&lt;p&gt;Some manufacturers have this feature.  It is an agent that runs on the host and reports the load back to the load balancer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some reasons for not using it:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;CPU usage fluctuates quite a bit, and isn't always a reliable indicator of &quot;load&quot;&lt;/li&gt;&#xA;&lt;li&gt;Some people don't want extra agents running on their servers.&lt;/li&gt;&#xA;&lt;li&gt;For a dedicated web server, the load is proportional to the number of connections -- which the balancer already knows, so the agent doesn't give you much more information.&lt;/li&gt;&#xA;&lt;li&gt;There may be an extra cost to use this feature.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-14T12:37:40.070" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39683" PostTypeId="2" ParentId="39681" CreationDate="2017-03-14T12:39:42.373" Score="2" Body="&lt;p&gt;I know at least F5 LTM has a feature where it monitors performance of each pool member and adjust its loadbalancing method based on this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Predictive (member): [...] the system analyzes the trend of the ranking over time, determining whether a node's performance is improving or declining. The nodes in the pool with better performance rankings that are currently improving, rather than declining, receive a higher proportion of the connections. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So pool members which responds faster get more requests. That may make them slower to others, so those will then get more requests. This can work quite nicely.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-03-14T12:39:42.373" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39684" PostTypeId="1" AcceptedAnswerId="39685" CreationDate="2017-03-14T12:45:21.320" Score="2" ViewCount="129" Body="&lt;p&gt;IPv6 Authentication Header uses MD5 hash on the payload, the header, and unchanging fields of the IPv6 header and options to prevent sequence quessing attacks. But all these required information to calculate this hash are also available to any attacker that spies the connection (and impersonnated the real host's IP address), since they also are in the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what guarranties the attacker cannot steal the real host's connexion? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what payload is processed in the MD5? The payload of the current packet or the payload of the previous packet?&lt;/p&gt;&#xA;" OwnerUserId="4249" LastActivityDate="2017-03-14T13:15:31.550" Title="How does IPv6 AH guarranties authentication?" Tags="|ipv6|authentication|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39685" PostTypeId="2" ParentId="39684" CreationDate="2017-03-14T13:15:31.550" Score="3" Body="&lt;p&gt;Before 2 hosts start using AH with each other, they need to agree on a common set of parameters, a security association or SA. This is typically achieved using the IKE protocol (IKEv1 or IKEv2).&#xA;As part of this negotiation they also derive a session key or &quot;secret&quot;, i.e. a random value that only these 2 hosts know.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This secret is then also fed into the hashing function (which can be MD5 or some other algorithm) that is used to calculate the ICV (Integrity Check Value) in the AH header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence, if an attacker wants to spoof a packet (or modify a packet sent by the real sender) he cannot generate the correct ICV because he does not know the secret.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The payload that is protected by the ICV is always that of the current packet.&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2017-03-14T13:15:31.550" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39686" PostTypeId="1" CreationDate="2017-03-14T13:27:42.433" Score="1" ViewCount="1134" Body="&lt;p&gt;I know that MAC address is a physical address attached to Network Interface Card(NIC) to identify your computer uniquely. However, MAC address of Ethernet NIC or Wireless 802.11a/b/g/n WiFi NIC are different. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;So, does it mean a laptop can be identified with 2 different MAC address depending on the network interfaces it&#xA;supports?(Wifi/Ethernet or both)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Also, modem has MAC address found on the bottom of the Modem. Why does modem has a unique MAC address on your home network besides laptop, phone and other devices connected to the Internet?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="34724" LastEditorUserId="34724" LastEditDate="2017-03-14T13:44:00.650" LastActivityDate="2017-03-14T14:00:01.287" Title="Does modem has unique MAC address on your home network?" Tags="|mac-address|" AnswerCount="2" CommentCount="0" ClosedDate="2017-08-17T05:19:08.210" ContentLicense="CC BY-SA 3.0" />
  <row Id="39689" PostTypeId="2" ParentId="39686" CreationDate="2017-03-14T13:55:03.920" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So, does it mean a laptop can be identified with 2 different MAC&#xA;  address depending on the network interfaces it supports?(Wifi/Ethernet&#xA;  or both)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes.  The MAC address identifies the interface, not the laptop.  Every interface will (should) have a unique address.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Also, modem has MAC address found on the bottom of the Modem. Why does&#xA;  modem has a unique MAC address on your home network besides laptop,&#xA;  phone and other devices connected to the Internet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because the modem had an Ethernet interface, it has a MAC address.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-14T13:55:03.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39690" PostTypeId="2" ParentId="39678" CreationDate="2017-03-14T13:56:00.960" Score="6" Body="&lt;p&gt;I couldn't find the full specs of the router, but from the little there is I am not sure it supports anything fancy on its ethernet side. It could be just a mistake or stupidity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In theory and as a general answer it could be different VLANs like @dr01 said, load balancing, allowing x3  of the &#xA;capacity of a single ethernet link, or fall back in case one port fails.&lt;/p&gt;&#xA;" OwnerUserId="35175" LastActivityDate="2017-03-14T13:56:00.960" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39691" PostTypeId="2" ParentId="39686" CreationDate="2017-03-14T14:00:01.287" Score="1" Body="&lt;p&gt;1: Yes it does. Theoretically you can add as much NICs as you want to your device, you are able to be identified. But layer two adresses aren't the only attributes which are needed to identify a device. The hardware, the software and user behavior is used nowadays (at least in the world of the ads). The more information you announce, the better you are able to be identified.&lt;br/&gt;&lt;br/&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2: Network communication without layer two is unusual or rather not possible (at least for most, there might be other ways which I don't know). IP is based on MAC. Thereforce the modem needs to have a mac adress to communicate via IP with the WAN. &lt;/p&gt;&#xA;" OwnerUserId="14081" LastActivityDate="2017-03-14T14:00:01.287" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39693" PostTypeId="2" ParentId="25533" CreationDate="2017-03-14T16:31:44.397" Score="1" Body="&lt;p&gt;A router transfers packets between two (or more) different networks. A typical case is a router sitting between the home or office network and the ISP's network. A more complex case might have several separate LANs, a separate VoIP network, multiple ISP connections and several VPNs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are cases where the ISP provides a connection which is directly usable by the router (like a plain Gigabit-Ethernet link). In such a case, there will be no obvious modem box (even though Gigabit-Ethernet is actually a modulated signal - the Ethernet transceiver is therefore a modem, just not as visible as a typical obvious modem box used to translate DOCSIS, ADSL, VDSL, SDSL or whatever to Ethernet or whatever else).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also the option to set up complex routed networks without physical network hardware (and therefore no modem, not even Ethernet transceivers). Just a bunch of virtual machines, connected to each others via virtual network adapters and virtual switches. A use case for such a setup might be the test of router software, running in one or more of the VMs, with clients and servers running in other VMs.&lt;/p&gt;&#xA;" OwnerUserId="35180" LastActivityDate="2017-03-14T16:31:44.397" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39695" PostTypeId="2" ParentId="39678" CreationDate="2017-03-14T16:40:03.630" Score="4" Body="&lt;p&gt;As this is a rented office do you share the connection with other tenants ?&lt;br&gt;&#xA;It is not uncommon to have a separate outlet for each customer on the router.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch receives each of those connections on a separate port and keeps them internally separated by using VLAN's. Depending on to which office the various other connections on the switch go these connections are placed in the same VLAN as the router-link for that customer.&lt;br&gt;&#xA;(The alternative approach to that would be to hook up a dedicated switch for each customer to each router outlet, which is easier to configure, but probably more expensive.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than that link-aggregation comes to mind, but that doesn't make sense as the BT router and the internet connection would not profit at all from the increased bandwidth as the internet is in general much slower than a single link between router and switch.&lt;br&gt;&#xA;(And as Rsf already mentioned, it is doubtful the BT router would technically be able to support it. Most SOHO routers don't.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That leaves a simple mistake as option number 3. &lt;/p&gt;&#xA;" OwnerUserId="27026" LastActivityDate="2017-03-14T16:40:03.630" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39702" PostTypeId="1" AcceptedAnswerId="39703" CreationDate="2017-03-15T02:35:27.450" Score="2" ViewCount="7951" Body="&lt;p&gt;In an OSPF router LSA (LS Type 1), the Link State ID is the Router ID of the originating router. The Advertising Router used to identify the sender is also the Router ID.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So does it mean that the two parameters will always be same for every type 1 LSA.&#xA;Can you point a use case where it is not? &lt;/p&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="8499" LastEditDate="2017-03-15T03:13:46.737" LastActivityDate="2018-07-31T13:50:08.503" Title="Advertising Router and Link State ID in OSPF" Tags="|routing|ospf|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39703" PostTypeId="2" ParentId="39702" CreationDate="2017-03-15T03:12:15.197" Score="1" Body="&lt;p&gt;The Link State ID identifies what is being advertised by the LSA. A router LSA is describing what a router claims is directly connected to it, so the Link State ID is the Router ID of the originating router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Advertising Router is the Router ID of the router that originated the LSA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With LS Type 1 LSAs, these two pieces of information happen to be identical, but that is not the case for other LS Types. An LS Type 1 LSA with different values in those two fields would be damaged and invalid.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-15T03:12:15.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39704" PostTypeId="1" CreationDate="2017-03-15T06:41:06.467" Score="1" ViewCount="448" Body="&lt;p&gt;I am study on Power Save Mechanisms. Could you please show me what is difference between WMM-PS, Power Save Poll, Power Save non-Poll, Unscheduled Automatic Power Save Delivery (U-APSD)? and how to test each type of Power Save?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you so much.&lt;/p&gt;&#xA;" OwnerUserId="35002" LastActivityDate="2017-03-15T06:41:06.467" Title="What is difference between WMM-PS, Power Save Poll, Power Save non-Poll, Unscheduled Automatic Power Save Delivery (U-APSD)?" Tags="|wireless|ieee-802.11|cisco-wireless|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39706" PostTypeId="1" CreationDate="2017-03-15T08:14:12.563" Score="2" ViewCount="346" Body="&lt;p&gt;we are developing an industrial network where we must to guaranteed three separated LAN (LAN1, LAN2 and LAN3, please see the attached image below). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our client want the networks to be separated, so packets from one of the LAN shouldn't be transmitted on the other two LAN, except for several Modbus TCP/IP connections between elements (PC and a ADAM IO module) placed on diferent LAN.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is this possible via managed Switch? VLAN would be the correct way? Can I configure three VLAN and some port forwarding for this modbus tcp links?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We will use the EKI-7656 managed switch from Advantech.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keeping separated networks is our main client requirement and I'd like to ensure this with a correct switch configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ZnrCQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ZnrCQ.png&quot; alt=&quot;Our network scenario&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35210" LastActivityDate="2017-05-14T16:38:16.783" Title="Which is the correct configuration for this network scenario?" Tags="|routing|vlan|network|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39707" PostTypeId="2" ParentId="39706" CreationDate="2017-03-15T08:36:44.937" Score="3" Body="&lt;p&gt;I would assume your customer wants the separation due to security reasons. In this case VLAN will not do the desired separation. What you probably need is Firewall that will control what is allowed to pass and what should be prevented. The device you mentioned supports IP Access List so you need to check if ACL can address your filtering needs. &lt;/p&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-03-15T08:36:44.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39708" PostTypeId="2" ParentId="34723" CreationDate="2017-03-15T08:59:25.820" Score="0" Body="&lt;p&gt;to add some more info to @Ron's answer- &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Different clients may use different hardware and software, so even if you place both of them in an isolated and controlled environment you might still get different results. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's even more complicated in reality since for example if you put your iPhone near your Mac they will communicate with each other creating some disturbances, while this will not happen with a Windows machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware is everything from the controller itself, controller peripherals (power amplifiers etc.), antenna design and location, integration of all of the above with cables, conductors or connectors for example. Note that this might be different for the transmit and receive path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each part of the chain can influence the chosen final speed, first by adding a different attenuation but also by small implementation details. An imaginary example could be the choice and design of the D/A and A/D stage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Than there's the software the runs all this, it's the MAC layer but also the higher level driver and lower layer firmware. All have different implementations per platform and hardware. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unrelated to WIFI since you measure performance using a web site then even the IP stack, the OS itself and browser can influence your results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last and not necessarily least are bugs found all over the above, bugs in software but also bugs in hardware. &lt;/p&gt;&#xA;" OwnerUserId="35175" LastActivityDate="2017-03-15T08:59:25.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39711" PostTypeId="2" ParentId="7456" CreationDate="2017-03-15T09:51:17.683" Score="1" Body="&lt;p&gt;The Null0 &quot;interface&quot; is a virtual bit-bucket. Meaning it's a trash can to route things to. There's automatically a Null0 route (called a Discard Route) created when you do a summary-address or area-range or things like that with routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The idea behind this is that you are creating a summary address manually to tell other routers about. If you are therefore expecting to receive packets for anything within that summary range, what will your router do about it? if it has more specific routes, packets will get routed perfectly fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anything not matching more specific routes would get sent to the discard route and therefore destroyed in a flash of Null0 mayhem. Without the discard route, your router would be either trying to look things up or possibly sending to a default route (0.0.0.0/0) it has in its table. This in turn, may cause a routing loop where the router with the 0/0 route contains the summary you manually advertised and so packets bounce needlessly until the TTL expires!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's a protection mechanism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also use Null0 as a destination in static routes if you would like particular packets to die a horrible death as well! also u can see the site below exactly from Mr.Rafael A Couto Cabral&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://blogbt.net/index.php/2014/03/routing-to-null0-interface/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://blogbt.net/index.php/2014/03/routing-to-null0-interface/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Worood Naif :)&lt;/p&gt;&#xA;" OwnerUserId="35100" LastActivityDate="2017-03-15T09:51:17.683" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39712" PostTypeId="2" ParentId="39706" CreationDate="2017-03-15T09:54:15.360" Score="1" Body="&lt;p&gt;You can use VLAN to separate your 3 networks, but with only the EKI-7656C switch, which is layer 2 only, you have no way to allow the Modbus connection between the VLAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To do so you need a router or a firewall that will perform inter-VLAN routing and filter which traffic is allowed between the 3 VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another way would be to have the modbus device multi-homed, I.E. having a separate interface in each network, but this require those devices to have several interfaces, and it is not recommended (this would somewhat break the isolation between the networks).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-15T09:54:15.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39713" PostTypeId="1" CreationDate="2017-03-15T10:09:28.870" Score="1" ViewCount="87" Body="&lt;p&gt;This is happening in between PE router and CE router. Immediately after configured the neighbor command on CE router, connectivity to CE router lost. Telnet management of CE router has been enabled through PE router, so whenever WAN connectivity lost management(telnet) too lost.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When check BGP neighbor table from PE router at that time, BGP neighborship was formed. Also other side(CE router) too shown neighborship is ok(this is checked by tech team by console login @ CE router side) but ping to WAN IPs not work(ping time outs).&#xA;No any error message received to the router until debug the CE router for BGP. then getting attached error message.&lt;a href=&quot;https://i.stack.imgur.com/sMcP8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sMcP8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PE router details are: Cisco IOS XR Software, Version 5.1.3.&gt;&gt;asr9k-os-mbi-5.1.3.sp3-1.0.0/0x100000/mbiasr9k-rp.vm &lt;/p&gt;&#xA;&#xA;&lt;p&gt;CE router details are: &quot;flash:c800-universalk9-mz.SPA.154-3.M3.bin&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was trying so many things to fix this. It was noticed immidiately after remove the neighbor command from CE router again WAN connectivity is ok(ping &amp;amp; telnet management ok). When check BGP neighbor table it was found more than 300 prefixes on BGP table.&#xA;Finally I found a way to temporally fix it by limiting BGP prefixes to very limited value(first it was 5) by using a &quot;ip prefix-list&quot; under the BGP process. &#xA;But this is not acceptable by my customer because he need to have full routing table(all the BGP prefixes) in CE router.&#xA;Please answer my question if any one had come a cross this issue previously.&lt;/p&gt;&#xA;" OwnerUserId="35203" LastActivityDate="2017-03-15T10:09:28.870" Title="WAN connectivity down when BGP neighborship formed" Tags="|bgp|mpls-vpn|" AnswerCount="0" CommentCount="7" ClosedDate="2019-02-09T00:52:40.813" ContentLicense="CC BY-SA 3.0" />
  <row Id="39716" PostTypeId="2" ParentId="39667" CreationDate="2017-03-15T11:44:26.213" Score="1" Body="&lt;p&gt;First, enable lldp globally:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;lldp run&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then also configre lldp on each interface. The native vlan should be vlan 1 (data) and the voice vlan should be 2, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/3  &#xA; switchport access vlan 1  &#xA; switchport mode access  &#xA; switchport voice vlan 2  &#xA; ip dhcp relay information check-reply  &#xA; spanning-tree portfast&#xA; lldp transmit&#xA; lldp receive &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-15T11:44:26.213" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39717" PostTypeId="1" CreationDate="2017-03-15T11:55:48.900" Score="2" ViewCount="723" Body="&lt;p&gt;How packet will travel from pc1 to pc2 if there are two switches are in between.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC1  &gt; SWITCHING1 &gt; SWITCHING 2 &gt; PC2 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;what will be first action arp or ICMP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If ARP comes fast then what is arp request? will it go only switch1 or both switches. (SW 1 and sw2)&#xA; I know only ARP will broadcast but not sure will it broadcast to sw1 only since only sw1 is directly connected to pc1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;please help me this question.&lt;/p&gt;&#xA;" OwnerUserId="35219" LastActivityDate="2017-03-16T09:37:36.523" Title="What will happen Pc1 &gt; switch1 &gt; switch2&gt; PC2" Tags="|switch|arp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39718" PostTypeId="2" ParentId="39717" CreationDate="2017-03-15T12:01:07.980" Score="2" Body="&lt;p&gt;The PCs don't &quot;know&quot; there are switches in between them -- they operate the same way as if they were directly connected. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switches operate at layer 2, so they don't process ARP packets.  They forward frames without modification. If the destination MAC address is unknown, the switch floods the frame out all ports.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-15T12:01:07.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39719" PostTypeId="2" ParentId="29103" CreationDate="2017-03-15T12:01:48.823" Score="1" Body="&lt;p&gt;You migh also be hitting Cisco bug CSCvb65304....&lt;/p&gt;&#xA;" OwnerUserId="35220" LastActivityDate="2017-03-15T12:01:48.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39721" PostTypeId="1" AcceptedAnswerId="39725" CreationDate="2017-03-15T13:53:28.193" Score="2" ViewCount="2264" Body="&lt;p&gt;I have 2 computers and both are connected to same network via WAN. Now i have &lt;code&gt;started 1 application on 8080 port and also i have open 8080 port on my router&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now &lt;code&gt;my 1 computer's ip - 192.168.0.150&lt;/code&gt;(on which i am running application using 8080 port) and &lt;code&gt;2nd computer's ip -192.168.0.151.&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now i can access my 1st computer application via my 2nd computer - i have simply enter &lt;code&gt;192.168.0.150:8080&lt;/code&gt; in browser and i am able to access application through my 2nd pc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now have static ip - &lt;code&gt;104.435.xx.xx&lt;/code&gt; . So i can also access my application with this static ip from anywhere(not on my network. have to connect different network/net)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now the problem is - When i type 104.435.xx.xx:8080 from my 2nd pc then it &lt;code&gt;shows message unable to connect . The connection has timed out .&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now i want to access 1st computer application on same network with my static ip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how can i access my 1st pc application with my static ip through my 2nd pc on same network ??&lt;/p&gt;&#xA;" OwnerUserId="35224" LastActivityDate="2017-03-17T00:03:50.300" Title="How to access other computer from LAN through interet" Tags="|router|vlan|ip|dhcp|wan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39723" PostTypeId="1" AcceptedAnswerId="39724" CreationDate="2017-03-15T14:08:39.710" Score="3" ViewCount="2479" Body="&lt;p&gt;I'm trying to update the enable secret and account password on a Cisco3560-CG switch with an encrypted password shared by devices throughout the company.  I use the following command for the enable secret and get the following output.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enable secret 5 &amp;lt;encrypted password&amp;gt;&#xA;ERROR: The secret you entered is not a valid encrypted secret. To&#xA;enter an UNENCRYPTED secret, do not specify type 5 encryption. When&#xA;you properly enter an UNENCRYPTED secret, it will be encrypted.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We've used this encrypted password successfully on many other devices so I know it's a valid encrypted secret, but we haven't used it on any other 3560-CG's. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've tried updating to the latest OS (15.2.2E6) and rolling back to 15.0.2 and neither helps.  I can add an enable secret in clear text, but that doesn't work for our organizational policy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone else run into this issue on this or any other model of Cisco switch?&lt;/p&gt;&#xA;" OwnerUserId="35223" LastActivityDate="2017-03-15T15:00:44.453" Title="Adding encrypted password on Cisco 3560-CG switch" Tags="|cisco|switch|troubleshooting|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39724" PostTypeId="2" ParentId="39723" CreationDate="2017-03-15T15:00:44.453" Score="3" Body="&lt;p&gt;You are receiving the error because the &quot;&lt;em&gt;password&lt;/em&gt;&quot; you are entering is not a proper MD5 hash.  Check to verify that you are trying to enter a complete MD5 hash and that it is not another type of hash. Cleartext, Type 4 or Type 7 passwords will not suffice.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may be trying to use a password obscured by a Vigenère cipher.  The Vigenère cipher is often refered as a &lt;em&gt;Type 7&lt;/em&gt; password.  It is associated with the &lt;code&gt;service password-encryption&lt;/code&gt; and &lt;code&gt;enable password 7 supersecretpw&lt;/code&gt;commands.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Type 7 password hashes look something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;098f6bcd4621d373cade4e832627b4f6&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Type 5 (MD5) hashes look a little something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;$1$jR5i$.HDBuKq.wIDOn2EYpCPYc0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco Type 5 hashes will always be comprised of 3 elements, separated by &lt;code&gt;$&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the above example:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;1&lt;/strong&gt; - Denotes a salted hash&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;jR5i&lt;/strong&gt; - 24-bit randomly generated salt value&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;.HDBuKq.wIDOn2EYpCPYc0&lt;/strong&gt; - MD5 hash&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Jeremy Stretch does a great write-up on how Cisco leverages MD5 here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://packetlife.net/blog/2008/jul/9/a-bit-more-detail-on-ios-password-hashes/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://packetlife.net/blog/2008/jul/9/a-bit-more-detail-on-ios-password-hashes/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2017-03-15T15:00:44.453" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39725" PostTypeId="2" ParentId="39721" CreationDate="2017-03-15T15:03:57.883" Score="2" Body="&lt;p&gt;Your problem is that the port forwarding you configured works only for connection coming from outside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router that connect you to the Internet has two interfaces and two IP addresses: one on the LAN and the second that connect to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The port forwarding rule must match all criteria :   &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;destination = 104.435.xx.xx&lt;/li&gt;&#xA;&lt;li&gt;protocol = TCP&lt;/li&gt;&#xA;&lt;li&gt;port = 8080&lt;/li&gt;&#xA;&lt;li&gt;interface = WAN interface&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;When you connect from the LAN , the last criteria is not met and so the port forwarding doesn't apply&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some routers, but not all, allow to configure a rule that will work on connection coming through the LAN interface. This is know as &quot;NAT hairpin&quot; or &quot;NAT loopback&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your router support NAT hairpin, this is the easiest way to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually the need for such feature is that you want to connect from both inside and outside with the same DNS name. In this case, &lt;code&gt;split DNS&lt;/code&gt; is sometime used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Split DNS is when you have, for the same domain name an internal DNS server that resolve the names with the internal (private) IP while the public DNS server resolve the same name with the public IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when accessible &lt;code&gt;server.example.com&lt;/code&gt; from the LAN, the internal DNS server will respond with &lt;code&gt;192.168.0.151&lt;/code&gt; and you can connect to the server without going through the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When accessing &lt;code&gt;server.example.com&lt;/code&gt; from the Internet, the public DNS server will respond with &lt;code&gt;104.435.xx.xx&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some DNS servers allow to have a single DNS to answer with a different response based on (for example) the asker IP address, in which case you can configure such a split DNS scheme on a single server.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-03-16T08:25:55.263" LastActivityDate="2017-03-16T08:25:55.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39726" PostTypeId="2" ParentId="39706" CreationDate="2017-03-15T15:27:29.310" Score="0" Body="&lt;p&gt;Note that by themselves, VLANs do not enhance security.  They simply limit broadcast domains.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the world was only as big as your diagram above, sure, traffic would always be isolated within a single VLAN.  In the real world, traffic needs to be routed in order to be useful.  You must control traffic between the VLANs with a layer-3 aware device such as a layer-3 switch, router or firewall.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2017-03-15T15:27:29.310" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39728" PostTypeId="2" ParentId="20141" CreationDate="2017-03-15T16:29:27.810" Score="1" Body="&lt;p&gt;IP doesn't handle varying MTUs well. Typically each time the MTU reduces there will be another round of path MTU discovery and when the MTU increases again the sending host will have no way to discover that fact. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Plus if you want to support IPv6 you will need a MTU of at least 1280 bytes. Theoretically IPv4 should support MTUs down to 68 bytes but operation with such small MTUs will be highly inefficient and is unlikely to be well-tested.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So yes if your underlying link has a short and variable maximum packet size you should perform your own fragmentation and reassembly below the IP layer. Once you are doing that you may as well make the IP MTU 1500 bytes.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-15T16:29:27.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39731" PostTypeId="1" CreationDate="2017-03-15T18:07:32.707" Score="4" ViewCount="1204" Body="&lt;p&gt;I just noticed a big difference in numbers looking at the sent and receive counters for RSTP BPDUs.The port I'm looking at is a &lt;strong&gt;root port&lt;/strong&gt;. I see a very less number of BPDUs sent against to BPDUs received. Is there a reason for this? I have 9 BPDUs sent but more than 50k BPDUs received.&lt;/p&gt;&#xA;" OwnerUserId="24153" LastActivityDate="2017-07-14T17:15:24.480" Title="Why is there a large difference between BPDUs sent and received counters for RSTP root port?" Tags="|spanning-tree|ieee-802.1w|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39732" PostTypeId="2" ParentId="39483" CreationDate="2017-03-15T18:40:44.460" Score="1" Body="&lt;p&gt;Turns out you just need to make a few changes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit --&gt;  /etc/sysctl.conf&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Set all the: net.bridge.bridge-nf-call-(ip6,ip,arptables) = 0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then make sure to address the &quot;linux bridges silently drop LLDP messages&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Great example found here:  &lt;a href=&quot;https://thenetworkway.wordpress.com/2016/01/04/lldp-traffic-and-linux-bridges/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://thenetworkway.wordpress.com/2016/01/04/lldp-traffic-and-linux-bridges/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: Also enabled spanning tree, although I have yet to confirm if that truly makes a difference.&lt;/p&gt;&#xA;" OwnerUserId="23081" LastActivityDate="2017-03-15T18:40:44.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39734" PostTypeId="1" CreationDate="2017-03-15T23:01:20.497" Score="2" ViewCount="618" Body="&lt;p&gt;Force10 Release 8.3.7.1 &#xA; NetBSD 1.6.1 (S4810) #0: Thu Apr  7 09:04:27 PDT 2011&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to interrupt the normal boot with a serial connector and I can stop  the boot but in this version I can't reset the configuration I can only change the boot image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It doesn't have:&#xA; an options menu&#xA; the reset command has not been implemented&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems I'd need to boot from a tftp sever but I don't have the image to write to the tftp server.&lt;/p&gt;&#xA;" OwnerUserId="35300" LastActivityDate="2017-03-15T23:01:20.497" Title="How to factory reset Force10 Release 8.3.7.1" Tags="|force10|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39735" PostTypeId="2" ParentId="35804" CreationDate="2017-03-15T23:30:11.043" Score="0" Body="&lt;p&gt;I believe your question boils down to, How does Internet Protocol addressing work?  &lt;a href=&quot;https://en.wikipedia.org/wiki/IP_address&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia has a great intro&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The IP address space is managed globally by the Internet Assigned&#xA;  Numbers Authority (IANA), and by five regional Internet registries&#xA;  (RIR) responsible in their designated territories for assignment to&#xA;  end users and local Internet registries, such as Internet service&#xA;  providers. Addresses have been distributed by IANA to the RIRs in&#xA;  blocks of approximately 16.8 million addresses each. Each ISP or&#xA;  private network administrator assigns an IP address to each device&#xA;  connected to its network. Such assignments may be on a static (fixed&#xA;  or permanent) or dynamic basis, depending on its software and&#xA;  practices.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-03-15T23:30:11.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39739" PostTypeId="1" AcceptedAnswerId="39744" CreationDate="2017-03-16T08:56:57.853" Score="0" ViewCount="2215" Body="&lt;p&gt;My shop is 500 meters far from the outer gate, on a steep hill, and there is no straight path or line of sight between the 2 points. How would be the best way to extend the internet connection from the outer gate to the shop router ? I have read this &lt;a href=&quot;https://electronics.stackexchange.com/questions/156031/very-long-distance-ethernet-connection-for-internet-and-other-data-2000-feet&quot;&gt;post&lt;/a&gt; that solves the problem using ethernet extenders like &lt;a href=&quot;http://www.trendnet.com/support/supportdetail.asp?prod=265_TPA-311&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; and another &lt;a href=&quot;https://serverfault.com/questions/328307/long-distance-networking-options&quot;&gt;post&lt;/a&gt; that recommends using optic fiber and media converters like &lt;a href=&quot;http://rads.stackoverflow.com/amzn/click/B00009B5AA&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt;. I only need the network for common usage (browsing) and the coaxial cable from the ISP is standard RG-6&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I choose the first option (extenders) how exactly would the setup look like ? My guess: the coaxial cable from my ISP would go into the modem and the modem would connect to the first extender placed near the outer gate with RJ45 cable. Then a 500 meters coaxial cable would link this extender to a second one, and a RJ45 cable would link the second extender to my router. Is there a way the modem can be placed at the end point (my shop), and the ISP cable would go directly into the extender ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I choose the second option (media converter) I guess I would have to do something similar: to keep the modem next to a media converter, by the outer gate, connected via RJ45 cable and then link the first converter with a 500 meters cable to a second converter to change back from light to electricity ? In this case would the 2 converters be different ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which approach is the easiest/best one ? Where can I find more detailed instructions ? Which compatibility issues should I care about ?&lt;/p&gt;&#xA;" OwnerUserId="35250" LastEditorUserId="-1" LastEditDate="2017-04-13T12:33:08.917" LastActivityDate="2017-03-16T12:11:53.603" Title="how to build a long distance wired network" Tags="|ethernet|fiber|" AnswerCount="1" CommentCount="4" ClosedDate="2017-03-16T12:25:05.397" ContentLicense="CC BY-SA 3.0" />
  <row Id="39742" PostTypeId="2" ParentId="39717" CreationDate="2017-03-16T09:37:36.523" Score="1" Body="&lt;pre&gt;&lt;code&gt;what will be first action arp or ICMP?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ICMP is the result of initiating the ping from a source to a destination.It has got nothing to do with ARP as such.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But for any 2 devices to talk to each other, each device would need to know the &lt;code&gt;mac address&lt;/code&gt; or layer 2 address of the other device(assuming the devices are in same network; if not in same network,they need to reach their gateway at least). This is where ARP comes in. ARP says, can you give me the mac address for this IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP helps in building the control plane(say building a road), before the actual ICMP traffic in this case(the data plane) starts moving.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;will it go only switch1 or both switches&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;ARP is always restricted to a broadcast domain.Always remember that a L3 device(a router) marks the boundary of a broadcast domain.&#xA;To answer your question, ARP initiated by the PC, will have it's destination mac set to all &lt;code&gt;f&lt;/code&gt; (broadcast). &#xA;Remember a switch only understands mac address. When this frame(layer 2 entity), comes to SW1, it looks in it's mac-address table and since it is a broadcast, it is flooded to all ports except the one it is received on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, the frame travels to SW2 and undergoes the same process to be only received by PC2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC2 says, hey this is my IP address and let me reply to this.This travels back all the way to PC1, but this time it is a unicast.&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2017-03-16T09:37:36.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39743" PostTypeId="1" CreationDate="2017-03-16T11:58:32.287" Score="2" ViewCount="1376" Body="&lt;p&gt;We have a Juniper EX4200. Ports 0, 2, 4 and 6 are connected to another Juniper switch. These ports are our network uplinks. All other ports are connected to our servers. We want traffic to use all 4 uplinks (total capacity 4 Gbps), but it seems like only the first port (0) is every used, all other show no or little traffic, even under heavy load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our switch :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show interfaces&#xA;ge-0/0/0 {&#xA;    unit 0 {&#xA;        family ethernet-switching;&#xA;    }&#xA;}&#xA;&#xA;...&#xA;&#xA;# show interfaces vlan&#xA;unit 401 {&#xA;    family inet {&#xA;        address e.f.g.2/29;&#xA;    }&#xA;}&#xA;unit 101 {&#xA;    family inet {&#xA;        address a.b.c.1/29;&#xA;    }&#xA;}&#xA;unit 102 {&#xA;    family inet {&#xA;        address a.b.c.9/29;&#xA;    }&#xA;} &#xA;...&#xA;&#xA;#show vlans&#xA;server-1 {&#xA;    vlan-id 101;&#xA;    interface {&#xA;        ge-0/0/1.0;&#xA;    }&#xA;    l3-interface vlan.101;&#xA;}&#xA;server-2 {&#xA;    vlan-id 103;&#xA;    interface {&#xA;        ge-0/0/3.0;&#xA;    }&#xA;    l3-interface vlan.103;&#xA;}&#xA;default {&#xA;    vlan-id 401;&#xA;    l3-interface vlan.401;&#xA;}&#xA;v401;&#xA;&#xA;...&#xA;&#xA;show routing-options&#xA;static {&#xA;    route 0.0.0.0/0 next-hop e.f.g.1;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Our switch ports 0, 2, 4 and 6 connects to ports 0, 1, 2 and 3 of the upstream switch. The upstream switch is configured like :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set routing-options static route a.b.c.1/24 next-hop e.f.g.2&#xA;&#xA;set interfaces ge-0/0/0 unit 0 family ethernet-switching&#xA;set interfaces ge-0/0/1 unit 0 family ethernet-switching&#xA;set interfaces ge-0/0/2 unit 0 family ethernet-switching&#xA;set interfaces ge-0/0/3 unit 0 family ethernet-switching&#xA;&#xA;set vlans v401 vlan-id 401&#xA;set vlans v401 interface ge-0/0/3.0&#xA;set vlans v401 interface ge-0/0/2.0&#xA;set vlans v401 interface ge-0/0/1.0&#xA;set vlans v401 interface ge-0/0/0.0&#xA;set vlans v401 l3-interface vlan.401&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why aren't we seeing traffic flowing through the 3 other uplinks?&lt;/p&gt;&#xA;" OwnerUserId="32941" LastActivityDate="2017-03-18T22:26:52.100" Title="How to get multiple uplinks on Juniper EX switch to work?" Tags="|routing|juniper|juniper-junos|juniper-ex|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39744" PostTypeId="2" ParentId="39739" CreationDate="2017-03-16T12:11:53.603" Score="3" Body="&lt;p&gt;As you say the setup is much the same either way. One converter to hook up to the ISP kit and one converter to go back to regular Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiber has a number of advantages.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Complete electrical isolation, no need to worry about surge protection.&lt;/li&gt;&#xA;&lt;li&gt;Potential for better performance (though often the ISP will be the bottleneck anyway).&lt;/li&gt;&#xA;&lt;li&gt;The actual cable is generally cheaper (glass is cheap)&lt;/li&gt;&#xA;&lt;li&gt;It's more common/standardised. Ethernet over coax is a niche thing.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And one MAJOR disadvantage.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It's not really feasible to diy-terminate/splice fiber. You can buy it pre-terminated but if someone digs through the fiber you are going to need to find someone with field-splicing equipment and experience. Their services may not come cheap.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-16T12:11:53.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39748" PostTypeId="1" AcceptedAnswerId="39750" CreationDate="2017-03-16T14:26:30.293" Score="0" ViewCount="47" Body="&lt;p&gt;I have tried both bit.ly and goo.gl, but they both give the same info. Time clicked, referrers, and the country. However, I am wondering if there are any URL shorteners that obtain and show more info, such as IP Addresses.&lt;/p&gt;&#xA;" OwnerUserId="35258" LastActivityDate="2017-03-16T14:35:57.673" Title="Are there any link shorteners that obtain IP Addresses?" Tags="|ip-address|" AnswerCount="1" CommentCount="0" ClosedDate="2017-03-16T14:37:09.353" ContentLicense="CC BY-SA 3.0" />
  <row Id="39749" PostTypeId="2" ParentId="39731" CreationDate="2017-03-16T14:29:09.570" Score="2" Body="&lt;p&gt;RSTP protocol which is now widely implemented is sending BPDUs only on designated ports. Those 9 are sent during convergence activity in the past.&lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-03-16T14:29:09.570" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39750" PostTypeId="2" ParentId="39748" CreationDate="2017-03-16T14:35:57.673" Score="1" Body="&lt;p&gt;You can used bit.do. It is providing IP addresses of the clients accessing the link. &lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-03-16T14:35:57.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39751" PostTypeId="1" AcceptedAnswerId="39752" CreationDate="2017-03-16T15:04:44.137" Score="1" ViewCount="372" Body="&lt;p&gt;I tried to listen for ipv4 packets on the HTTP port 80,&#xA;however I just got received HTTP string back - is this the right&#xA;way to go about things? My understanding was that a TCP packet&#xA;would be returned, containing HTTP.&lt;/p&gt;&#xA;" OwnerUserId="35260" LastEditorUserId="8499" LastEditDate="2018-02-16T03:51:05.537" LastActivityDate="2018-02-16T03:51:05.537" Title="capturing ipv4 packets on a http port" Tags="|ipv4|tcp|packet-analysis|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39752" PostTypeId="2" ParentId="39751" CreationDate="2017-03-16T15:18:03.647" Score="2" Body="&lt;p&gt;When a client contact an htpp server on TCP port 80, this port is the &lt;code&gt;destination&lt;/code&gt; port.&#xA;The client use a random port with a number higher than 1024 as the &lt;code&gt;source&lt;/code&gt; port&#xA;When the server reply the source and destination (for both IP and ports) are reversed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I.E. the request from the client to the server has those characteristics:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;source IP adress: the client IP address&lt;/li&gt;&#xA;&lt;li&gt;protocol : TCP&lt;/li&gt;&#xA;&lt;li&gt;source port :  a random port greater than 1024&lt;/li&gt;&#xA;&lt;li&gt;destination IP address: the server IP address&lt;/li&gt;&#xA;&lt;li&gt;destination port : 80&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then when the server reply, the reply has those characteristics: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;source IP adress: the server IP address&lt;/li&gt;&#xA;&lt;li&gt;protocol : TCP&lt;/li&gt;&#xA;&lt;li&gt;source port : 80 &lt;/li&gt;&#xA;&lt;li&gt;destination IP address: the client IP address&lt;/li&gt;&#xA;&lt;li&gt;destination port : the random port that was used in the request&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So if you want to listen to the traffic you must filter on both answers and responses that have different destination IP and port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most packet sniffers (TCPDump , Wireshark...) can filter traffic on the IP on port without specifyin if it is source or destination. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I.E. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;tcpdump host 198.51.100.7 and port 80&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;will match traffic in either direction.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-16T15:18:03.647" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39753" PostTypeId="1" AcceptedAnswerId="39898" CreationDate="2017-03-16T15:32:49.500" Score="2" ViewCount="369" Body="&lt;p&gt;Versions of TCP that use Van Jacobson algorithm are unfair in some contexts, such as satellite communication. I cannot understand why. Is this problem caused by asymmetric links, in which the receiver has more possibility to send acknowledgement packets than the sender?&lt;/p&gt;&#xA;" OwnerUserId="35262" LastActivityDate="2017-03-23T09:02:59.663" Title="Unfairness of TCP with in large RTT context" Tags="|wireless|tcp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39757" PostTypeId="1" CreationDate="2017-03-16T17:51:09.333" Score="2" ViewCount="136" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Ci6e7.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Ci6e7.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am adding a 2nd layer 3 link between data centers using EIGRP. I want the remote sites to continue to use the 100 Mb to routes that are in Data Center 2 (unless the link is down).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I'm correct the 200 Mb link from data center 1 then across would be a better metric. Can I use the &lt;code&gt;bandwidth&lt;/code&gt; command on the Nexus interface to get the result I want?&lt;/p&gt;&#xA;" OwnerUserId="35269" LastEditorUserId="8499" LastEditDate="2018-12-25T04:23:20.197" LastActivityDate="2018-12-25T04:23:20.197" Title="Adding 2nd EIGRP route to Data Center" Tags="|cisco|routing|router|eigrp|cisco-nexus|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39758" PostTypeId="2" ParentId="39757" CreationDate="2017-03-16T17:53:55.510" Score="1" Body="&lt;p&gt;You can influence EIGRP routing with either the &lt;code&gt;bandwidth&lt;/code&gt; or &lt;code&gt;delay&lt;/code&gt; commands. In general, the &lt;code&gt;delay&lt;/code&gt; command is preferred because the bandwidth command can change other things, e.g. QoS.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-16T17:53:55.510" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39759" PostTypeId="1" AcceptedAnswerId="39764" CreationDate="2017-03-16T19:00:36.107" Score="4" ViewCount="1264" Body="&lt;p&gt;I was presented with an issue regarding an actual setup using pfSense at two locations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pfSense Site A is the OpenVPN Server and B is the client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Everything works, the LAN on Site A can communicate with LAN on site B and also the other way around.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Site A LAN GW IP is 192.168.10.254&#xA;Site B LAN GW IP is 192.168.5.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issue is that some specific hosts on Site A should use Internet Breakout at site B but as they have the 192.168.10.254 as GW automatically get to the Internet through Site A WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to achieve is having Site A hosts going to Internet through Site B WAN instead of A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to set the default GW on site A Host (eg. 192.168.10.33) as 192.168.5.1, but of course it has no routes for that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm sorry if some information is missing, but not really a network guy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance&lt;/p&gt;&#xA;" OwnerUserId="35271" LastActivityDate="2019-05-06T12:02:55.547" Title="pfSense Site-to-Site routes" Tags="|routing|vpn|pfsense|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39760" PostTypeId="1" AcceptedAnswerId="39820" CreationDate="2017-03-16T19:02:59.887" Score="2" ViewCount="1216" Body="&lt;p&gt;I'm not very familiar with firewalls. I have a &quot;fortigate 90d&quot;. I must simply prohibit access to the internet (via wired network) to a group of about twenty pc. This ban must be made by mac address of PC. this rule must be turned on or off at any time. Who can help me please?&#xA;I add a clarification: &lt;strong&gt;Current Running Firmware: FGT90D-5.00-build318&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have followed this excellent tutorial &lt;a href=&quot;http://cookbook.fortinet.com/mac-access-control/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://cookbook.fortinet.com/mac-access-control/&lt;/a&gt; but the web interface does not match the tutorial because based on newer firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;These are interfaces:&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/K9dHa.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/K9dHa.jpg&quot; alt=&quot;interfaces&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34076" LastEditorUserId="34076" LastEditDate="2017-03-27T08:58:44.290" LastActivityDate="2017-03-27T08:58:44.290" Title="mac access management with fortigate 90d" Tags="|firewall|mac-address|policing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39761" PostTypeId="1" AcceptedAnswerId="39762" CreationDate="2017-03-16T19:07:10.233" Score="4" ViewCount="1347" Body="&lt;p&gt;I am new to the networking world and am attempting my first few projects in Packet Tracer. The first few were easy but I've gotten to a road block. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal is to have three separate VLANs with at least one client on each VLAN. My goal is to use a layer 3 switch for inter-VLAN routing so that I am able to setup the L3 switch as a VTP server, two other switches as VTP clients, and have each client switch connect to various VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is: I cannot figure out how to get pings to work between the VLANs coming from different switches. I've attached my network topography and the configurations for each switch. Please help!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help would be GREATLY appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch 1 (VTP Client 1)&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1566 bytes&#xA;&#xA;!&#xA;&#xA;version 12.2&#xA;&#xA;no service timestamps log datetime msec&#xA;&#xA;no service timestamps debug datetime msec&#xA;&#xA;no service password-encryption&#xA;&#xA;!&#xA;&#xA;hostname anton&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;spanning-tree mode pvst&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/1&#xA;&#xA;switchport trunk native vlan 99&#xA;&#xA;switchport mode trunk&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/2&#xA;&#xA;switchport access vlan 10&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/3&#xA;&#xA;switchport access vlan 10&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/4&#xA;&#xA;switchport access vlan 10&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/5&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/6&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/7&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/8&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/9&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/10&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/11&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/12&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/13&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/14&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/15&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/16&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/17&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/18&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/19&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/20&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/21&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/22&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/23&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/24&#xA;&#xA;!&#xA;&#xA;interface GigabitEthernet0/1&#xA;&#xA;!&#xA;&#xA;interface GigabitEthernet0/2&#xA;&#xA;!&#xA;&#xA;interface Vlan1&#xA;&#xA;no ip address&#xA;&#xA;shutdown&#xA;&#xA;!&#xA;&#xA;interface Vlan10&#xA;&#xA;mac-address 00e0.8f04.7201&#xA;&#xA;ip address 192.168.10.254 255.255.255.0&#xA;&#xA;!&#xA;&#xA;interface Vlan20&#xA;&#xA;mac-address 00e0.8f04.7202&#xA;&#xA;ip address 192.168.20.254 255.255.255.0&#xA;&#xA;!&#xA;&#xA;interface Vlan30&#xA;&#xA;mac-address 00e0.8f04.7203&#xA;&#xA;ip address 192.168.30.254 255.255.255.0&#xA;&#xA;!&#xA;&#xA;interface Vlan99&#xA;&#xA;mac-address 00e0.8f04.7204&#xA;&#xA;ip address 192.168.99.10 255.255.255.0&#xA;&#xA;!&#xA;&#xA;ip default-gateway 192.168.10.0&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;line con 0&#xA;&#xA;!&#xA;&#xA;line vty 0 4&#xA;&#xA;login&#xA;&#xA;line vty 5 15&#xA;&#xA;login&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Switch 2 (VTP Client 2)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1582 bytes&#xA;&#xA;!&#xA;&#xA;version 12.2&#xA;&#xA;no service timestamps log datetime msec&#xA;&#xA;no service timestamps debug datetime msec&#xA;&#xA;no service password-encryption&#xA;&#xA;!&#xA;&#xA;hostname anton&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;spanning-tree mode pvst&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/1&#xA;&#xA;switchport trunk native vlan 99&#xA;&#xA;switchport mode trunk&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/2&#xA;&#xA;switchport access vlan 20&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/3&#xA;&#xA;switchport access vlan 30&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/4&#xA;&#xA;switchport access vlan 30&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/5&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/6&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/7&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/8&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/9&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/10&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/11&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/12&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/13&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/14&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/15&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/16&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/17&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/18&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/19&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/20&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/21&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/22&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/23&#xA;&#xA;!&#xA;&#xA;interface FastEthernet0/24&#xA;&#xA;!&#xA;&#xA;interface GigabitEthernet0/1&#xA;&#xA;!&#xA;&#xA;interface GigabitEthernet0/2&#xA;&#xA;!&#xA;&#xA;interface Vlan1&#xA;&#xA;no ip address&#xA;&#xA;shutdown&#xA;&#xA;!&#xA;&#xA;interface Vlan10&#xA;&#xA;mac-address 00e0.a334.8b03&#xA;&#xA;ip address 192.168.10.254 255.255.255.0&#xA;&#xA;!&#xA;&#xA;interface Vlan20&#xA;&#xA;mac-address 00e0.a334.8b01&#xA;&#xA;ip address 192.168.20.254 255.255.255.0&#xA;&#xA;!&#xA;&#xA;interface Vlan30&#xA;&#xA;mac-address 00e0.a334.8b02&#xA;&#xA;ip address 192.168.30.254 255.255.255.0&#xA;&#xA;!&#xA;&#xA;interface Vlan99&#xA;&#xA;mac-address 00e0.a334.8b04&#xA;&#xA;ip address 192.168.99.10 255.255.255.0&#xA;&#xA;!&#xA;&#xA;ip default-gateway 192.168.10.0&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;line con 0&#xA;&#xA;!&#xA;&#xA;line vty 0 4&#xA;&#xA;password cisco&#xA;&#xA;login&#xA;&#xA;line vty 5 15&#xA;&#xA;login&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;!&#xA;&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Layer 3 Switch (VTP Server)&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1708 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname anton&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip routing&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/1&#xA;switchport trunk native vlan 99&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/2&#xA;switchport trunk native vlan 99&#xA;switchport trunk encapsulation dot1q&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA;no ip address&#xA;shutdown&#xA;!&#xA;interface Vlan10&#xA;mac-address 00d0.5894.8e01&#xA;ip address 192.168.10.254 255.255.255.0&#xA;!&#xA;interface Vlan20&#xA;mac-address 00d0.5894.8e02&#xA;ip address 192.168.20.254 255.255.255.0&#xA;!&#xA;interface Vlan30&#xA;mac-address 00d0.5894.8e03&#xA;ip address 192.168.30.254 255.255.255.0&#xA;!&#xA;interface Vlan99&#xA;mac-address 00d0.5894.8e04&#xA;ip address 192.168.99.10 255.255.255.0&#xA;!&#xA;ip default-gateway 192.168.10.0&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA;login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/5judp.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5judp.png&quot; alt=&quot;The Network Topography&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35272" LastEditorUserId="8499" LastEditDate="2018-03-21T01:38:20.693" LastActivityDate="2018-03-21T01:38:20.693" Title="Inter-VLAN Routing with VTP Server and Clients in Packet Tracer" Tags="|switch|layer3|packet-tracer|vtp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39762" PostTypeId="2" ParentId="39761" CreationDate="2017-03-16T19:14:05.933" Score="3" Body="&lt;p&gt;It seems you have the SVI for VLANs 10, 20, and 30 configured on all three switches. This is going to cause an IP conflict.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only switch that actually needs the SVI is whatever switch that will be doing the routing. All the others just need to simply forward data at L2. From what I can gather, that would be your Switch 3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest reading through &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/routing-between-vlans/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article to help understand the different options for routing between VLANs&lt;/a&gt;, and specifically this section on using a &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/routing-between-vlans/#l3switch&quot; rel=&quot;nofollow noreferrer&quot;&gt;Layer 3 Switch&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2017-03-16T19:14:05.933" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39763" PostTypeId="1" AcceptedAnswerId="49939" CreationDate="2017-03-16T22:45:49.467" Score="9" ViewCount="266" Body="&lt;p&gt;4 routers, lab environment.  Trying to filter out routes originating from AS2 (not that leverage AS2 as transit).  The process I've followed is:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bakers#sh ip bgp regex _2_&#xA;BGP table version is 41, local router ID is 33.33.33.33&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*&amp;gt; 2.2.2.0/24       192.168.23.2             0             0 2 i&#xA;*  4.4.4.0/24       192.168.23.2                           0 2 1 i&#xA;*&amp;gt; 22.22.22.0/24    192.168.23.2             0             0 2 i&#xA;*  44.44.44.0/24    192.168.23.2                           0 2 1 i&#xA;*&amp;gt; 192.168.12.0     192.168.23.2             0             0 2 i&#xA;*  192.168.14.0     192.168.23.2                           0 2 1 i&#xA;*  192.168.23.0     192.168.23.2             0             0 2 i&#xA;&#xA;Bakers#sh ip bgp regex _2$&#xA;BGP table version is 41, local router ID is 33.33.33.33&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*&amp;gt; 2.2.2.0/24       192.168.23.2             0             0 2 i&#xA;*&amp;gt; 22.22.22.0/24    192.168.23.2             0             0 2 i&#xA;*&amp;gt; 192.168.12.0     192.168.23.2             0             0 2 i&#xA;*  192.168.23.0     192.168.23.2             0             0 2 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At this point, I'm thinking, OK - have what I need to make an as-path ACL to filter out the stuff originating from AS2 since the regex searching checks out per the above.  I create and apply the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bakers#sh run | i as-path&#xA;ip as-path access-list 10 deny _2$&#xA;ip as-path access-list 10 permit .*&#xA;router bgp 3&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; &amp;lt;truncated&amp;gt;&#xA; neighbor 192.168.23.2 remote-as 2&#xA; neighbor 192.168.34.4 remote-as 4&#xA; neighbor 192.168.34.4 filter-list 10 out&#xA; no auto-summary&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I would then expect the advertised routes to mimic the 'sh ip bgp regex &lt;em&gt;2&lt;/em&gt;' output from earlier (giving me the desired result), sans the routes output with the 'sh ip bgp regex _2$' routes.  Unfortunately, I get this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Bakers#sh ip bgp neigh 192.168.34.4 advertised-routes &#xA;BGP table version is 41, local router ID is 33.33.33.33&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*&amp;gt; 3.3.3.0/24       0.0.0.0                  0         32768 i&#xA;*&amp;gt; 33.33.33.0/24    0.0.0.0                  0         32768 i&#xA;*&amp;gt; 192.168.23.0     0.0.0.0                  0         32768 i&#xA;*&amp;gt; 192.168.34.0     0.0.0.0                  0         32768 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;It's filtering out all of the routes originating from AS1 (meaning that downstream, that router can no longer use AS3 as transit to AS1 - breaking my use case).  What am I missing here?&lt;/p&gt;&#xA;" OwnerUserId="1353" LastActivityDate="2018-06-16T04:59:18.313" Title="Unexpected AS-PATH ACL behavior" Tags="|bgp|" AnswerCount="1" CommentCount="4" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39764" PostTypeId="2" ParentId="39759" CreationDate="2017-03-16T23:10:28.710" Score="1" Body="&lt;p&gt;That might be easier if Site B were the server and Site A were the OVPN client.  Provide Site A (via the OVPN server config) with the subnet and gateway available on the other end of the tunnel and see how things go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then if Site A host 192.168.10.33 has a default route that travels across 192.168.10.254 (which has a IP provided via OVPN of 192.168.5.2, let's say) and a next hop of 192.168.5.1 and then a WAN IP of {some.public.ip.here} then that makes perfect sense to me.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may need to use a firewall rule to direct 192.168.10.33 traffic to an alternate gateway under the Advanced firewall rule settings.&lt;/p&gt;&#xA;" OwnerUserId="35275" LastActivityDate="2017-03-16T23:10:28.710" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39766" PostTypeId="2" ParentId="39721" CreationDate="2017-03-17T00:03:50.300" Score="0" Body="&lt;p&gt;NAT reflection or (if you are willing to use DNS) a split DNS configuration would solve your problem.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now, your internal 2nd PC is trying an external IP to use a resource but the request will go out of your network (per routing) and go back in the same path which is rejected.&lt;/p&gt;&#xA;" OwnerUserId="35275" LastActivityDate="2017-03-17T00:03:50.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39768" PostTypeId="2" ParentId="32474" CreationDate="2017-03-17T05:57:08.433" Score="2" Body="&lt;p&gt;Based on your question, my best guess is that you have some configurations similar to &lt;strong&gt;Private Vlan&lt;/strong&gt;. So here primary vlan will be Vlan10 and both Vlan20 &amp;amp; Vlan30 will be the secondary vlans for Vlan10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&lt;/p&gt;&#xA;" OwnerUserId="35282" LastActivityDate="2017-03-17T05:57:08.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39772" PostTypeId="2" ParentId="20138" CreationDate="2017-03-17T10:01:36.193" Score="0" Body="&lt;p&gt;the switch or router uses by default the outgoing interface, if you have two outgoing interfaces with the same mask, I think the switch uses the lowest ip address. I know from personal experience that, if you have a 32 bit mask ip address on a loopback the switch will use that ip for all pings if you dont define the source. In your case when you ping a device that is on another subnet than the 10.x.x.x network you dont get a reply because that gateway is not aware of other subnets, since its a voip network that gateway is only aware of voip ip addresses.&lt;/p&gt;&#xA;" OwnerUserId="13605" LastActivityDate="2017-03-17T10:01:36.193" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39774" PostTypeId="1" AcceptedAnswerId="39775" CreationDate="2017-03-17T11:56:30.900" Score="4" ViewCount="3197" Body="&lt;p&gt;So, I am new to these concepts so my question may be stupid. I know that there are 5 classes of public IP addresses and we use the 3 of them (Class A, B, C). I also know their range. But when it comes to private IPs I am a little confused. I know the ranges of these IPs too. So, if my puvlic IP is e.g 130.133.45.120 (Class B), does this mean that alla the private IPs in my house should be from 172.16.0.0 through 172.31.255.255 ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you &lt;/p&gt;&#xA;" OwnerUserId="35289" LastActivityDate="2017-03-18T18:54:45.463" Title="Public vs Private IP addresses" Tags="|ip|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39775" PostTypeId="2" ParentId="39774" CreationDate="2017-03-17T12:16:17.870" Score="4" Body="&lt;p&gt;No, your private IP range is entirely separate from your public IP range. Your private range is determined by your own configuration on your router. You can choose whichever private range you'd like.&lt;/p&gt;&#xA;" OwnerUserId="30549" LastActivityDate="2017-03-17T12:16:17.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39777" PostTypeId="2" ParentId="39774" CreationDate="2017-03-17T12:31:43.610" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;Repeat after me:  &quot;Classful addressing is obsolete.  Classful&#xA;addressing is obsolete.&quot;  Say that to yourself ten times.&lt;/li&gt;&#xA;&lt;li&gt;There is no relationship between public and private addresses.  Your&#xA;devices can have either public or private addresses -- it's up to you. But if private,&#xA;they can't be routed over the Internet.&lt;/li&gt;&#xA;&lt;li&gt;There is nothing special about private addresses. Routers treat&#xA;public and private addresses exactly the same way.  The only&#xA;difference is the Internet community has agreed not to route private&#xA;addresses on the Internet.&lt;/li&gt;&#xA;&lt;li&gt;Network Address Translation (NAT) is used to translate private&#xA;    addresses into public ones so your PC with a private address can communicate over the&#xA;    Internet.  There are lots of explanations on how NAT works just a quick&#xA;    Google search away.&lt;/li&gt;&#xA;&lt;li&gt;Since private addresses are local to networks under your control,&#xA;    you can use any address you want.  Fun fact:  some organizations&#xA;    actually &quot;borrow&quot; public addresses to use on their internal&#xA;    networks, and translate them to their assigned public addresses. &#xA;    This is &lt;strong&gt;poor practice&lt;/strong&gt;, yet it's more common than you'd think.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-17T12:31:43.610" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39778" PostTypeId="1" CreationDate="2017-03-17T12:51:48.873" Score="1" ViewCount="279" Body="&lt;p&gt;I have an issue with a Netgear network. We use the following equipment:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Netgear WC7500 Controller&lt;/li&gt;&#xA;&lt;li&gt;Netgear WNDAP660&lt;/li&gt;&#xA;&lt;li&gt;Netgear PoE-Switches and regular Switches&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The deployment is basically the following&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;WC 7500 &amp;lt;-&amp;gt; PoE &amp;lt;-&amp;gt; WNDAP&#xA;          \&#xA;           Switch &amp;lt;-&amp;gt; PoE &amp;lt;-&amp;gt; WNDAP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything uses Cat 6 Cable, so 1 Gbit/s shouldn't be the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue is, with 3 out of 4 access points, we regularly have the problem, that the connection drops. When simply surfing, the users mostly do not notice, but when streaming video or audio, the connection to the stream is lost and the playback stops. A ping during such a phase usually looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;64 bytes from 192.168.0.1: icmp_seq=871 ttl=64 time=3.884 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=872 ttl=64 time=7.145 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=873 ttl=64 time=40.071 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=874 ttl=64 time=19.888 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=875 ttl=64 time=8.871 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=876 ttl=64 time=3118.215 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=877 ttl=64 time=2157.423 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=878 ttl=64 time=1195.459 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=879 ttl=64 time=233.174 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=880 ttl=64 time=7.620 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=881 ttl=64 time=8.889 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=882 ttl=64 time=7.988 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=883 ttl=64 time=3.538 ms&#xA;64 bytes from 192.168.0.1: icmp_seq=884 ttl=64 time=2.443 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you see, the ping is quite ok, then it increases to several seconds and drops pretty fast again to something we call &quot;good&quot; (&amp;lt;10ms isn't to worry imo). Sometimes the internet connection, when using the wireless network, is lost completly, but cable remains ok. We switched providers a few days back which din't change anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What we already tried:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Change channels all the way through&lt;/li&gt;&#xA;&lt;li&gt;change DTIM&lt;/li&gt;&#xA;&lt;li&gt;decreasing RTS&lt;/li&gt;&#xA;&lt;li&gt;playing around with beacon time&lt;/li&gt;&#xA;&lt;li&gt;decreasing data rate&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;We have tried stuff from these resources:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://kb.netgear.com/23655/Troubleshooting-intermittent-wireless-or-dropped-Wi-Fi-connections&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://kb.netgear.com/23655/Troubleshooting-intermittent-wireless-or-dropped-Wi-Fi-connections&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://community.netgear.com/t5/WiFi-Range-Extenders-Repeaters/WNDAP360-losing-connection/td-p/434686&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://community.netgear.com/t5/WiFi-Range-Extenders-Repeaters/WNDAP360-losing-connection/td-p/434686&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I really have no idea, why this isn't working anymore and it bugs me quite a lot. I tried everything I know and I hope you people have an idea, what to try!&lt;/p&gt;&#xA;" OwnerUserId="35290" LastActivityDate="2017-03-17T12:51:48.873" Title="Intermittent network with netgear access points" Tags="|wireless|access-point|netgear-prosafe|" AnswerCount="0" CommentCount="4" ClosedDate="2019-02-09T00:49:41.340" ContentLicense="CC BY-SA 3.0" />
  <row Id="39784" PostTypeId="1" CreationDate="2017-03-17T16:09:00.707" Score="1" ViewCount="55" Body="&lt;p&gt;I need to write a code (it may be in C, C++, Java, whatever) in order to add filters into a Datacom Switch (DM4001 - ETH24GX+2x10GX H Series), but I can't find anything on Google to help me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is not with the code itself. What I can't find is the syntax of how to add/remove filters. Can someone give a hint?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Manually, do I need to telnet and/or ssh the Switch and run commands to add/remove filters?&lt;/p&gt;&#xA;" OwnerUserId="34913" LastActivityDate="2017-03-17T16:09:00.707" Title="How to add filters programmatically into a Datacom - DM4001?" Tags="|switch|" AnswerCount="0" CommentCount="5" ClosedDate="2018-07-27T00:10:11.897" ContentLicense="CC BY-SA 3.0" />
  <row Id="39787" PostTypeId="1" AcceptedAnswerId="39827" CreationDate="2017-03-17T17:21:05.753" Score="2" ViewCount="111" Body="&lt;p&gt;on my network vlan1 is to be non routed management traffic between switches etc. vlan2 is general network  vlan3 is wifi vlan4 is a point to point between routed interfaces vlan5 for servers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I have a trunk on port 3 of the isr so it can pass vlan1 &amp;amp; 3. &#xA;I had just recently realized the reason my routed traffic was not going any where on the 6500 was due to my not using a layer3 interface (I think). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have tried setting up port 2 on the isr as an access port with vlan4 as the native.  I tried setting the layer3 on the 6500 as vlan4 and no response.  I then tried sub-interfaces to get it to respond with no luck. it wont let me set vlan1 on sub-interfaces either so I suspect that wont work well either.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;the isr has no issues routing to the internet.  If I add a vlan2 address and set the isr as the gateway there are no issues getting out.  &lt;/p&gt;&#xA;" OwnerUserId="4646" LastActivityDate="2017-03-20T13:02:03.107" Title="Lab: I have a ISR with layer 2 ports that i need to connect to a 6500 layer 3 routed port" Tags="|routing|layer2|layer3|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39790" PostTypeId="2" ParentId="38951" CreationDate="2017-03-17T19:45:59.960" Score="1" Body="&lt;p&gt;Port forwarding is generally a technique that is used with network address translation and specifically DNAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose there is an enterprise which has 2 servers 1 which accepting connections for SSH (port 22) and one is acting as web browser(port 80). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The enterprise is using a single public IP and further uses NAT for its 2 servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, one host that has never contacted this server tries to communicate with the web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing in the internet is always through public IP so using the enterprise IP the packet will reach the gateway router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now imagine the routing table for the gateway router. It has received packet which has a destination IP of its own interface. where does it send the packet now or rather how will it know it needs to send the packet to its web server which is defined behind the NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this we need port forwarding.&#xA;This is basically saying whenever you get a packet with Dport 80 simply send it out of that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that we were now unable to distinguish hosts based on IP addresses so now we are using ports to distinguish them. &lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-03-17T19:45:59.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39791" PostTypeId="2" ParentId="39787" CreationDate="2017-03-17T22:39:33.360" Score="0" Body="&lt;p&gt;Packet exchange between IP endpoints on differing subnets occurs through a gateway/router.  VLANs need to be created on both devices and a trunk link enabled between the two.  Layer 3 interfaces created and maybe routing/static routes?  Endpoints typically get IP addresses and default gateway addresses via DHCP.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-03-17T22:39:33.360" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39794" PostTypeId="1" AcceptedAnswerId="39825" CreationDate="2017-03-18T02:31:03.953" Score="9" ViewCount="9035" Body="&lt;p&gt;I'm finally embarking on the voyage that is IPv6.  I am not sure however, on the best way of assigning a unique local address (ULA) to each host in my LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPv4 I prefer to have a DHCP server with all the mappings between MAC addresses and fixed IPs, as most OSes default to DHCP so it means there is less configuration this way.  I also have a small dynamic pool for guests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I am wondering whether I should be running a DHCPv6 server to mimic this behaviour, or whether I can somehow make use of stateless IPv6 configuration instead.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since my router advertises my global prefix and clients pick it up automatically, is it possible to have a second router (my network switch) also advertise a ULA prefix, so that clients can set themselves up with &lt;em&gt;two&lt;/em&gt; IPs automatically?  This would let them have a global and a ULA address and I wouldn't need to run a dedicated DHCPv6 server somewhere, or bother with NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd also like to run the ULA prefix advertisement on a different device if possible (rather than the existing DSL modem) so that if the modem ever gets taken offline it won't disrupt local network traffic.  Or ideally, I'd get both the modem and the switch to advertise the same ULA prefix so either one can go away or be replaced without disrupting the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this the way ULA addresses are supposed to be allocated?  Or are you supposed to choose between DHCPv6 and static allocation, or some other method I haven't learned about yet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Some background, if you need it:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have received a global prefix from my ISP (via 6rd) and I've set that up on my router so each PC on the LAN now has a global IPv6 address.  This works fine, but if I want to SSH to another machine I have to look up its IPv6 address somehow as the prefix I receive from my ISP changes regularly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To avoid this, I want to assign each host a ULA address, so that I can put these in local DNS and just use hostnames from that point on.  I am not planning to use any form of NAT as each machine already has a global IP, this is just for direct access between machines in the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(As an aside, link-local addresses are impractical for this as the network interface must be specified every time you use the address.  Even if I were to put a link-local address in DNS, I'd still have to figure out what the name of the network interface is called on each machine and specify it every time I tried to make an outgoing connection, even via hostname, which ULA should avoid.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am also aware that with stateless IPv6 config it would mean the final IP includes the machine's MAC address, so I'd have to update DNS if the NIC ever changes, but if I was using DHCP instead I'd still have to update the DHCP config with the new MAC anyway, so I don't think this is any more or less effort.&lt;/p&gt;&#xA;" OwnerUserId="35309" LastActivityDate="2017-07-18T13:03:35.890" Title="Method for assigning IPv6 ULA addresses to LAN" Tags="|ipv6|dhcpv6|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39797" PostTypeId="1" AcceptedAnswerId="39801" CreationDate="2017-03-18T09:39:45.343" Score="1" ViewCount="94" Body="&lt;p&gt;I have 3 nodes in my (IP) network:&lt;/p&gt;&#xA;&lt;p&gt;A  --  B  --  C&lt;/p&gt;&#xA;&lt;p&gt;A is connected to B and B is connected to C.&#xA;I need to access A from C, and vice-versa.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;C = 192.168.224.3&lt;/li&gt;&#xA;&lt;li&gt;B = 192.168.224.1, 192.168.223.146&lt;/li&gt;&#xA;&lt;li&gt;A =                192.168.223.2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;From C, I'm able to ping both IP@ of B (224.1 and 223.146).&#xA;But the ping to A (223.2) fails.&lt;/p&gt;&#xA;&lt;p&gt;What would have I overlooked?&#xA;I'm pasting the route table details of the three nodes below.&lt;/p&gt;&#xA;&lt;h3&gt;C's route table&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Destination     Gateway        Interface&#xA;&lt;/li&gt;&#xA;&lt;li&gt;192.168.223.0    192.168.224.1    eth1&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;B's route table&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Destination      Gateway       Interface&#xA;&lt;/li&gt;&#xA;&lt;li&gt;192.168.223.0    192.168.223.146  eol23&lt;/li&gt;&#xA;&lt;li&gt;192.168.224.0    192.168.224.1    eob0&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;h3&gt;A's route table&lt;/h3&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Destination      Gateway       Interface&#xA;&lt;/li&gt;&#xA;&lt;li&gt;192.168.223.0    192.168.223.2    eol23&lt;/li&gt;&#xA;&lt;li&gt;192.168.224.0    192.168.223.2    eol23&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="35320" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-03-18T17:29:17.923" Title="Debugging non-reachable nodes in IP networks" Tags="|routing|" AnswerCount="1" CommentCount="1" ClosedDate="2019-02-09T00:48:01.937" ContentLicense="CC BY-SA 3.0" />
  <row Id="39801" PostTypeId="2" ParentId="39797" CreationDate="2017-03-18T17:29:17.923" Score="2" Body="&lt;p&gt;Based on Your diagnostic&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;From C, I'm able to ping both IP@ of B (224.1 and 223.146). But the&#xA;  ping to A (223.2) fails.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can decide - problem most probable in routing from A to C (on A node)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking routing tables Im found incorrect route to BC network.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.224.0 192.168.223.2 eol23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;must be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.224.0 192.168.223.146 eol23&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2017-03-18T17:29:17.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39802" PostTypeId="2" ParentId="39774" CreationDate="2017-03-18T18:54:45.463" Score="3" Body="&lt;p&gt;I feel your original question may have many other questions embedded in it. I have therefore provided some background as well as helping you understand how you might choose your private IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Public IPs are very tightly controlled resources that are in very short supply. Private IPs are used on internal networks and can be whatever you want, providing they are separated by a NAT boundary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Different IP networks are connected together by network routers. Network routers are simply devices that know how to route your network traffic to its destination and how to route the reply back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So for example, if you are using a laptop on a private network with an IP of 10.1.1.12 and you wanted to visit a website on 34.201.21.54. Your laptop would send it's requests to the router hoping the router knows a valid route to the target IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Public and private IPv4 networks are often separated by a Network Address Translation (NAT) boundary. A NAT boundary is simply a network device (often the router) that effectively hides the source IP. So in the case above the IP address the server at 34.201.21.54 would see is a NAT'd  IP, not the original 10.1.1.12 IP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You asked what your private IP should be. In order to determine what your IP should be you first need to determine what network address you would like to use and how many nodes you are going to need on that private network. Normally people do not bother with this process and simply go for an easy option. I will lay out both an easy option and a slightly more involved opportunity to learn below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Easy option:&#xA;Pick whatever network address you want, e.g. 192.168.0.0/24. This will allow you to use any private IP between 192.168.0.1 and 192.168.0.254. Give your router an IP of 192.168.0.1 and ensure everything on the network uses the subnet mask 255.255.255.0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More difficult option:&#xA;Pick whatever address you want, but increase the /24 value to reduce the number of available IP addresses to match what you actually need. For example if you chose 192.168.0.0/25, this would allow you to use any IP from 192.168.0.1 to 192.168.0.126. Give your router the same IP, but this time use a subnet mask of 255.255.255.128.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above example uses CIDR blocks instead of classes. The class of a network is not that relevant as such. What is more relevant is the address range and subnet mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/24, /25 or other netmasks simply determine how many bits of an IP address are used for the network address. Thus leaving the remaining bits for host addresses. To understand this you simply need to convert the IP to its binary form, examples below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;11111111.11111111.11111111.00000000 = 255.255.255.0. This is /24 because there are 24 ones in the binary address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;11111111.11111111.11111111.10000000 = 255.255.255.128. This is /25 because there are 25 ones in the binary address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The more ones you have for the network portion, the less digits you have free for host addresses. Thus the higher the netmask value, the fewer IPs you can have on your network. The network mask also determines how many networks you can have.....but I suggest we ignore that bit for now :).&lt;/p&gt;&#xA;" OwnerUserId="35331" LastActivityDate="2017-03-18T18:54:45.463" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39803" PostTypeId="2" ParentId="39743" CreationDate="2017-03-18T22:26:52.100" Score="3" Body="&lt;p&gt;As Ron has mentioned, this is most likely the result of spanning-tree blocking the remaining three interfaces, as you have created a loop in your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To achieve what you're after (load-sharing/flow-hasing), configure the following on BOTH switches to form an aggregated ethernet link:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set chassis aggregated-devices ethernet device-count 8&#xA;&#xA;wildcard range delete interfaces ge-0/0/[0-3]&#xA;wildcard range delete vlans v401 interface ge-0/0/[0-3]&#xA;&#xA;set interfaces interface-range AE0-MEMBERS ether-options 802.3ad ae0&#xA;wildcard range set interfaces interface-range AE0-MEMBERS member ge-0/0/[0-3]&#xA;set interfaces ae0 aggregated-ether-options lacp active&#xA;&#xA;set interfaces ae0 unit 0 family ethernet-switching&#xA;set vlans v401 interface ae0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm not a fan of assigning interfaces to the VLAN, so you can replace the last line with:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set interfaces ae0 unit 0 family ethernet-switching members v401&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I liken Junos VLAN assignment to the eternal struggle over which side of the roll toilet paper should be hung.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-03-18T22:26:52.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39804" PostTypeId="1" CreationDate="2017-03-19T02:35:05.047" Score="3" ViewCount="930" Body="&lt;p&gt;My main question is why are hubs always half duplex and layer 2 switches can be full duplex?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because let's say I have a ethernet cable that has pins that can send and receive data at the same time, and I use these cables to connect, let's say four devices, with a central hub in one place, and in another place I do the same thing in another location, but this time with a switch. Now in a scenario where all the devices are constantly sending broadcast messages, it does not matter if they are hubs or switches, they will all be flooded to all the ports. Now, in this case if a switch can be in full duplex, why can,t the hub as well?&lt;/p&gt;&#xA;" OwnerUserId="35336" LastEditorUserId="8499" LastEditDate="2017-03-19T06:56:39.227" LastActivityDate="2017-03-19T12:01:09.907" Title="Full duplex vs. half duplex" Tags="|duplex|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39807" PostTypeId="1" AcceptedAnswerId="39811" CreationDate="2017-03-19T10:55:33.383" Score="3" ViewCount="24894" Body="&lt;p&gt;I'm following the Cisco routing &amp;amp; switching course, but there is something I don't understand. It is said that OSPF exchange five packet type:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Hello (discover neighbors)&lt;/li&gt;&#xA;&lt;li&gt;DBD (database description)&lt;/li&gt;&#xA;&lt;li&gt;LSR (link state request)&lt;/li&gt;&#xA;&lt;li&gt;LSU (link state update)&lt;/li&gt;&#xA;&lt;li&gt;LS ack (link state acknowledges)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I understand what these packets do, but when there is LSA (link state advertisement). As Cisco say, LSA are used to create/maintain the link state database. So what is the difference between LSA and LSR/LSU/LSAck ? As I understand, they all are used for the exact same purpose. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="35344" LastActivityDate="2017-03-20T19:45:53.253" Title="What's the difference between LSA and LSR, LSU, LSAck in OSPF" Tags="|ospf|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39808" PostTypeId="2" ParentId="39804" CreationDate="2017-03-19T11:37:09.763" Score="2" Body="&lt;p&gt;With a hub all ports are in a single collision domain meaning that all frames are visible on all ports and their connected devices.  In a switch every port is its own collision domain so frames sent on one port cannot collide with frames sent on another port.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Full duplex is negotiated between the end host and the switch port this allows the use of all send and receive channels/wires on the cable and forming the single collision domain (between the switchport and the end host).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference between hubs and switches is that a switch builds a mac address table (learns the mac addresses of the connected end systems) and will only broadcast frames when a mac address is not already known in the mac address table.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a mac address is learned on a port only frames destined for that particular mac address (end host) will continue to be forwarded on that port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A hub will not build a mac address table and will always forward all frames on all connected ports.&lt;/p&gt;&#xA;" OwnerUserId="248" LastActivityDate="2017-03-19T11:37:09.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39809" PostTypeId="2" ParentId="39807" CreationDate="2017-03-19T11:50:21.857" Score="0" Body="&lt;p&gt;LSA can be seen as &quot;item of information&quot;: Link State Advertisement. &#xA;LSU,LSR, LSack are messages managing the sync between routers of this items. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;LSU: link state update&#xA;LSR: link state request&#xA;LSack: link state ack&lt;/p&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-03-19T11:50:21.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39810" PostTypeId="2" ParentId="39804" CreationDate="2017-03-19T12:01:09.907" Score="0" Body="&lt;p&gt;The key difference is that a switch has the ability to receive multiple frames at the same time and store them in internal queues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sure eventually you are going to hit the point where those queues fill up and frames have to be dropped but hopefully dropping is the exception not the rule.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A hub operates at a much lower level. It never stores complete frames, it just passes traffic through as it comes in. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-19T12:01:09.907" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39811" PostTypeId="2" ParentId="39807" CreationDate="2017-03-19T12:54:51.857" Score="4" Body="&lt;ul&gt;&#xA;&lt;li&gt;LSA&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Link state advertisement It is a message that communicates the router's local routing topology to all other local routers in the same OSPF area. This LSA has types depend on the type of router and has also sequence number.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;LSDB&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Every OSPF router maintains a Link state database (LSDB). Each router stores the received LSA packets in the link-state database (LSDB). After LSDBs are synced between the routers, OSPF uses the shortest path first (SPF) algorithm to calculate the best routes. (full version of the database)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DBDs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Database description packets (also referred as DDPs) These packets are exchanged when an adjacency is being initialized. They describe the contents of the topological database. It does not include full LSAs but would include LSA headers in the link-state database of the sender..&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;LSR&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;After exchanging Database Description packets with a neighboring router, a router may find that parts of its topological database are out of date. The Link State Request packet is used to request the pieces of the neighbor's database that are more up to date. The sending of Link State Request packets is the last step in bringing up an adjacency&#xA;  What other have (DBDs) – What I have (LADB) = What I need to order (LSR)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Link-State Update (LSU)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A packet that contains fully detailed LSAs, typically sent in response to an LSR message&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Link-State Acknowledgment (LSAck)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Sent to confirm receipt of an LSU message&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2017-03-19T12:54:51.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39812" PostTypeId="1" AcceptedAnswerId="40547" CreationDate="2017-03-19T15:51:54.237" Score="2" ViewCount="543" Body="&lt;p&gt;Total output drops are still increasing on a Cisco 2960 switch trunk interface that is connected to ASA interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What causes these drops?&lt;/p&gt;&#xA;" OwnerUserId="32384" LastEditorUserId="8499" LastEditDate="2017-03-19T18:28:57.297" LastActivityDate="2017-05-06T23:32:55.627" Title="Increasing output drops on a 2960 switch" Tags="|switch|cisco-asa|trunk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39813" PostTypeId="2" ParentId="39812" CreationDate="2017-03-19T17:32:46.680" Score="0" Body="&lt;p&gt;Usually, that would be due to an oversubscription. For example, if it is a 24-port switch, with 24 1 Gbps access interfaces, and a 1 Gbps uplink interface, then you could have 24 Gbps coming into the switch from the access interfaces and contending for 1 Gbps on the uplink interface. That is a 24:1 oversubscription, and you are going to lose 23 out of 24 frames to output drops because the uplink can only handle 1 Gbps.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-19T17:32:46.680" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39819" PostTypeId="1" CreationDate="2017-03-20T05:05:25.797" Score="3" ViewCount="551" Body="&lt;p&gt;I am unsure what the IS-41 location registration process is.&#xA;Could someone please explain this?&lt;/p&gt;&#xA;" OwnerUserId="35361" LastActivityDate="2017-03-23T23:48:20.090" Title="What is the IS-41 location registration process?" Tags="|wireless|mobile|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39820" PostTypeId="2" ParentId="39760" CreationDate="2017-03-20T05:08:40.113" Score="2" Body="&lt;p&gt;The mentioned solution in the link will not do the job, you need to do the below:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;collect the MAC addresses of  devices&lt;/li&gt;&#xA;&lt;li&gt;Creating a device group as mentioned by the link:&#xA;Go to User &amp;amp; Device &gt; Device &gt; Device Groups and create a new group.&#xA;Add the new device to the Members list with their MAC addresses&#xA;3.Create security policy  and configure its action as deny&#xA;Go to Policy &amp;amp; Objects &gt; Policy &gt; IPv4 and create a new policy.&#xA;Set Incoming Interface to your LAN interface, Source Device Type to the device group, and Outgoing Interface to the Internet-facing interface and set the destination to any and the action to drop&lt;/li&gt;&#xA;&lt;li&gt;confirm that the created policy position is on the top of the policies&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-03-20T05:08:40.113" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39821" PostTypeId="1" CreationDate="2017-03-20T06:26:50.683" Score="1" ViewCount="36" Body="&lt;p&gt;In the zigbee mesh network, who assigns the coordinator node and the FFD?&#xA;Is there any algorithm by which this is done?&lt;/p&gt;&#xA;" OwnerUserId="35362" LastActivityDate="2017-03-20T06:26:50.683" Title="Who assigns the Coordinator Node in Zigbee mesh network?" Tags="|wireless|protocol-theory|" AnswerCount="0" CommentCount="0" ClosedDate="2019-02-09T00:36:04.217" ContentLicense="CC BY-SA 3.0" />
  <row Id="39822" PostTypeId="1" CreationDate="2017-03-20T08:41:10.217" Score="1" ViewCount="493" Body="&lt;p&gt;I need to get the IP routing table from a remote router which is not situated on my network, got this from &lt;code&gt;http://www.sharontools.com/online-lab/device/?q=cisco-r2&lt;/code&gt; i have enabled snmp and created snmp users on the router, now i need to send a snmpget request to this router with the OID for the IP routing table, but when i send a request to an address(IP) from the list of interfaces which are up on this router, I am getting Timed Out error? where am i going wrong and what is the correct way to do this ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 1 : Now i am able to fire snmp requests to the router, but when i do a snmpwalk on the ipRouteTable object i get the following error &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP-MIB::ip.21 = No Such Object available on this agent at this OID&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;the user belongs to a group with a view which has write access to iso.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit 2 : Adding the snmp related configs from the output of &lt;code&gt;show running-config&lt;/code&gt; command, the user belongs to Group: &lt;code&gt;GROUP2&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server group GROUP1 v3 priv read ALL-ACCESS &#xA;snmp-server group GROUP2 v3 priv write ROUTE-TABLE &#xA;snmp-server group NetOps v3 priv &#xA;snmp-server view ALL-ACCESS iso included&#xA;snmp-server view ALL-ACCESS internet included&#xA;snmp-server view ALL-ACCESS ip.21 included&#xA;snmp-server view ROUTE-TABLE ip.21 included&#xA;snmp-server community public RO&#xA;snmp-server community private RW&#xA;snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart&#xA;snmp-server enable traps flowmon&#xA;snmp-server enable traps transceiver all&#xA;snmp-server enable traps call-home message-send-fail server-fail&#xA;snmp-server enable traps tty&#xA;snmp-server enable traps rf&#xA;snmp-server enable traps memory&#xA;snmp-server enable traps cpu_threshold&#xA;snmp-server enable traps eigrp&#xA;snmp-server enable traps ospf state-change&#xA;snmp-server enable traps ospf errors&#xA;snmp-server enable traps ospf retransmit&#xA;snmp-server enable traps ospf lsa&#xA;snmp-server enable traps ospf cisco-specific state-change nssa-trans-change&#xA;snmp-server enable traps ospf cisco-specific state-change shamlink interface&#xA;snmp-server enable traps ospf cisco-specific state-change shamlink neighbor&#xA;snmp-server enable traps ospf cisco-specific errors&#xA;snmp-server enable traps ospf cisco-specific retransmit    &#xA;snmp-server enable traps ospf cisco-specific lsa&#xA;snmp-server enable traps flex-links status&#xA;snmp-server enable traps fru-ctrl&#xA;snmp-server enable traps entity&#xA;snmp-server enable traps ethernet cfm cc mep-up mep-down cross-connect loop config&#xA;snmp-server enable traps ethernet cfm crosscheck mep-missing mep-unknown service-up&#xA;snmp-server enable traps ether-oam&#xA;snmp-server enable traps aaa_server&#xA;snmp-server enable traps flash insertion removal&#xA;snmp-server enable traps l2tc threshold sys-threshold&#xA;snmp-server enable traps power-ethernet police&#xA;snmp-server enable traps rep&#xA;snmp-server enable traps vswitch dual-active vsl&#xA;snmp-server enable traps udld link-fail-rpt status-change&#xA;snmp-server enable traps vtp&#xA;snmp-server enable traps vlancreate&#xA;snmp-server enable traps vlandelete&#xA;snmp-server enable traps auth-framework sec-violation&#xA;snmp-server enable traps dot1x auth-fail-vlan guest-vlan no-auth-fail-vlan no-guest-vlan&#xA;snmp-server enable traps envmon fan shutdown supply temperature status&#xA;snmp-server enable traps entity-diag boot-up-fail hm-test-recover hm-thresh-reached scheduled-test-fail&#xA;snmp-server enable traps port-security&#xA;snmp-server enable traps ethernet evc status create delete&#xA;snmp-server enable traps energywise        &#xA;snmp-server enable traps ipsla&#xA;snmp-server enable traps vstack&#xA;snmp-server enable traps bfd&#xA;snmp-server enable traps bgp&#xA;snmp-server enable traps bulkstat collection transfer&#xA;snmp-server enable traps cef resource-failure peer-state-change peer-fib-state-change inconsistency&#xA;snmp-server enable traps config-copy&#xA;snmp-server enable traps config&#xA;snmp-server enable traps config-ctid&#xA;snmp-server enable traps event-manager&#xA;snmp-server enable traps hsrp&#xA;snmp-server enable traps ipmulticast&#xA;snmp-server enable traps isis&#xA;snmp-server enable traps msdp&#xA;snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message&#xA;snmp-server enable traps bridge newroot topologychange&#xA;snmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistency    &#xA;snmp-server enable traps syslog&#xA;snmp-server enable traps isakmp policy add&#xA;snmp-server enable traps isakmp policy delete&#xA;snmp-server enable traps isakmp tunnel start&#xA;snmp-server enable traps isakmp tunnel stop&#xA;snmp-server enable traps ipsec cryptomap add&#xA;snmp-server enable traps ipsec cryptomap delete&#xA;snmp-server enable traps ipsec cryptomap attach&#xA;snmp-server enable traps ipsec cryptomap detach&#xA;snmp-server enable traps ipsec tunnel start&#xA;snmp-server enable traps ipsec tunnel stop&#xA;snmp-server enable traps ipsec too-many-sas&#xA;snmp-server enable traps errdisable&#xA;snmp-server enable traps ethernet cfm alarm&#xA;snmp-server enable traps vlan-membership&#xA;snmp-server enable traps mac-notification change move threshold&#xA;snmp-server enable traps vrfmib vrf-up vrf-down vnet-trunk-up vnet-trunk-down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35364" LastEditorUserId="35364" LastEditDate="2017-03-20T11:13:40.437" LastActivityDate="2017-03-20T11:13:40.437" Title="How to send a snmpget request to a remote router?" Tags="|router|snmp|network-discovery|" AnswerCount="0" CommentCount="2" ClosedDate="2018-07-27T00:06:08.257" ContentLicense="CC BY-SA 3.0" />
  <row Id="39824" PostTypeId="1" AcceptedAnswerId="40607" CreationDate="2017-03-20T10:54:56.950" Score="4" ViewCount="2153" Body="&lt;p&gt;I've a multicast network for security cameras (multiple RPs, bsr, connectivity with OSPF).&#xA;The problem is that the monitors sometimes stop receiving the video stream.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(10.0.0.1, 234.0.0.1), 00:10:11/00:00:24, flags: T&#xA;  Incoming interface: Vlan1, RPF nbr 10.0.1.1, RPF-MFD&#xA;  Outgoing interface list:&#xA;    GigabitEthernet0/0, Forward/Sparse, 00:10:11/00:03:24, H&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I noticed that after the &quot;expire&quot; timer counts down and the Outgoing interface changes to &quot;null&quot;. Soon after that the route disappears from &quot;sho ip mroute&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could you get me some info how this should work? In test environment the counter restarts before reach 2:30. Moreover, when I remove the &lt;strong&gt;IGMP join-group&lt;/strong&gt; the &quot;show ip mroute&quot; entries immediately goes to &quot;null&quot; outgoing interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm wondering what is responsible for resetting expire counter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerUserId="16778" LastEditorUserId="8499" LastEditDate="2018-03-19T15:50:58.400" LastActivityDate="2018-03-19T15:50:58.400" Title="Multicast timer expires" Tags="|multicast|igmp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39825" PostTypeId="2" ParentId="39794" CreationDate="2017-03-20T10:55:56.217" Score="7" Body="&lt;p&gt;After experimenting with this, I have made a few discoveries that end up dictating which path to choose.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Multiple subnet advertisements means multiple IPs in the same subnet&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;If you have multiple routers advertising the same prefix, you don't end up with redundancy, you end up with multiple IP addresses in the &lt;em&gt;same&lt;/em&gt; prefix/subnet.  This is like assigning yourself both 192.168.0.1 and 192.168.0.2 on the same NIC.  It works, but it causes problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example I was running a DNS server on one of these machines, and when clients were querying it through the primary IP, it was responding on the second one.  Clients were ignoring this response assuming someone was trying to spoof them, instead waiting for a reply on the same IP they sent the query to, so DNS completely broke.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Static IPs and router advertisements don't mix (for the same prefix)&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;You might think, as I did, that assigning a static IP in the same subnet would prevent an automatic IP assignment from the same prefix.  After all, in IPv4 if you have a static IP address, DHCP doesn't give you another one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is wrong.  You get the static IP address alright, but you also get a second one in the same subnet/prefix thanks to the advertisement from the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The end result is two IPs in the same subnet, leading to the same problem as above.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Advertise a different prefix&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;In the end the only solution that works is this one.  It requires letting go of a few IPv4 ideas though.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My goal was to mimic my IPv4 setup with IPv6.  That is, assign a few machines fixed addresses, and have the rest dynamic, while having everything as robust as possible.  And hopefully not having to run a DHCP server anymore.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By having a router advertise a ULA prefix, all hosts will self-assign their addresses, just like with DHCP.  But you can't have multiple routers advertising that prefix.  Maybe in some fancier setup you could have a backup router take over if it notices that the primary one has stopped advertising, but this isn't possible at present.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you don't have to be tied to placing fixed and dynamic IPs in the same subnet with IPv6.  ULA addresses have the facility to specify a subnet (up to 65536 of them), so I ended up using that so that the /48 ULA prefix had two /64 subnets in it.  The router advertises one for stateless config (equivalent to DHCP) while the other is not advertised anywhere and used for static IPs configured on each host.  You can even use a third ULA subnet for a backup router in case the primary one stops advertising its ULA, just to be sure that your hosts always have a site-wide routable address, even when no global IPs are available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks to the magic of IPv6 there is no need to set up any routing rules when this all happens within the same LAN segment.  Everyone gets a dynamic address, and the machines with fixed addresses get a static IP as well, but as they are in different /64 subnets, there is little confusion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only issue is that those hosts with fixed IPs should always used the fixed IPs to talk to each other.  If a connection is made to the dynamic IP from a host who has lost its dynamic IP, it will make the connection out from the remaining static IP instead - which means the multi-homed server will reply back using its own static IP and you'll again have the mismatch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But as long as hosts with static IPs always use the static subnet to talk to each other then there is never a problem.  Multi-homed hosts can of course talk to those in the dynamic subnet without any problem as well.&lt;/p&gt;&#xA;" OwnerUserId="35309" LastActivityDate="2017-03-20T10:55:56.217" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39827" PostTypeId="2" ParentId="39787" CreationDate="2017-03-20T13:02:03.107" Score="1" Body="&lt;p&gt;It appears that the config didn't apply properly the first time or I some how got things confused between the two devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;on the layer2 port of the isr access mode and vlan setting need to be applied. on the Layer3 device the ip needs to be applied as well as the vlan setting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;if its a layer2 trunk then on the layer 3 side a sub interface would be needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ron mentioned ospf or another routing protocol has to be turned on on the 6500 series to allow routing to happen properly. the ISR is able to route with &lt;strong&gt;&lt;em&gt;ip route&lt;/em&gt;&lt;/strong&gt; command &lt;/p&gt;&#xA;" OwnerUserId="4646" LastActivityDate="2017-03-20T13:02:03.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39831" PostTypeId="1" CreationDate="2017-03-20T15:34:05.853" Score="2" ViewCount="743" Body="&lt;p&gt;For VLAN communication we need a layer 3 device. For internetwork communication, we also need a layer 3 device. Then why did concept of VLAN emerge? &lt;/p&gt;&#xA;" OwnerUserId="34586" LastEditorUserId="8499" LastEditDate="2018-03-21T00:55:34.590" LastActivityDate="2018-03-21T00:55:34.590" Title="VLAN vs Subnet in switch" Tags="|switch|vlan|subnet|switching|layer3|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39833" PostTypeId="2" ParentId="39831" CreationDate="2017-03-20T15:43:39.363" Score="1" Body="&lt;p&gt;A VLAN (Virtual LAN) is an implementation of a layer-2 broadcast domain. Originally, bridges, including switches, had all the interfaces in the same LAN, and broadcasts would be sent to all interfaces (except the originating interface). VLANs were created in order to be able to segment different bridge interfaces into different LANs, breaking up the network into multiple broadcast domains. This reduces broadcast traffic on each LAN. It also provides the ability to easily place restrictions (security) on traffic allowed between the VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a layer-2 LAN, frames are delivered directly from one host to another host. In order for traffic from one layer-2 LAN to reach another layer-2 LAN, you need a layer-3 device, e.g. a router. Routers route packets between networks (LANs). Routers strip off the frames from the packets, and this means that you cannot broadcast between LANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a layer-3 network, you also need a router to get to a different layer-3 network. Trying to run multiple layer-3 networks on the same LAN is problematic because routers should run split horizon, meaning a router will not route from an interface back out to the same interface. With VLANs, you can set up logical router interfaces on the same physical router interface to get around this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some corner cases where you may want multiple layer-3 networks on the same LAN, but you really need to understand what you are doing before attempting this, and you should not expect hosts in one network to be able to communicate with hosts on a different network on the same LAN. This is why you will almost always see each layer-2 LAN (VLAN) with a different layer-3 network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-20T15:50:16.617" LastActivityDate="2017-03-20T15:50:16.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39834" PostTypeId="1" CreationDate="2017-03-20T15:54:07.583" Score="2" ViewCount="759" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sncPD.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sncPD.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following network in which we are trying to connect our routers to the LAN switches using OSPF. Here OSPF Area will have 8 interfaces, where we are advertising the default &lt;code&gt;0.0.0.0&lt;/code&gt; route from router and all LAN subnets from the switch 1 and 2 to the routers. For redundancy we also have point-to-point links between the two routers as well as two switches. They run point-to-point OSPF where the same LAN routes and default routes are available as well. Here, is there a OSPF loop possible because two different areas advertising the same routes, or based on SPF it will be taken care?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Area 0 will have four &lt;code&gt;/30&lt;/code&gt; configured on four links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Area 1 will have two IP addresses on an point-to-point link&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Area 2 will also have point-to-point link using two IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Switch 1 and switch 2, we will advertise all LAN routes to router for which it is receiving traffic from Internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From router we will advertise the default route for out going traffic to reach the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't have active running config as we are working on this to know whether it is fundamentally correct.&lt;/p&gt;&#xA;" OwnerUserId="22114" LastEditorUserId="8499" LastEditDate="2017-03-20T20:11:47.720" LastActivityDate="2017-03-21T01:41:56.100" Title="Multi Area OSPF and loop" Tags="|routing|ospf|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39835" PostTypeId="2" ParentId="39834" CreationDate="2017-03-20T16:07:46.413" Score="0" Body="&lt;p&gt;First, I do not see why you have Area 1 and Area 2. Those two areas seem gratuitous. You could make those two links Area 0 links because they will only advertise the link addresses. Each OSPF router in an area has a full understanding of all the routes and routers within the area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, what are your intentions about the user LANs? Are they going to be in a separate area(s)? It seems that you really only need the single Area 0 unless you have other routers out on the user LANs.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-20T16:07:46.413" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39837" PostTypeId="1" CreationDate="2017-03-20T17:05:39.627" Score="2" ViewCount="3564" Body="&lt;p&gt;I have two separate networks: a data network and a VoIP network. The data network has a sonicwall tz210 on it between our network and our ISP. We just installed a separate VoIP network connected via a router to a different ISP. I need to connect the data network to the VoIP network only for administration of the VoIP server and control of the phones  (app that runs on the desktop to control the phone). No call traffic will go over the data network. I am not quite sure how to setup the sonicwall to do this properly. below is a our setup and criteria for the setup&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DATA network 10.0.0.0/24&#xA;VoIP network 172.24.1.0/24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VoIP network has 52 port managed switch and router installed by telephone vendor connected to FIOS (5 static IPs, using 100.40.4.102)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DATA network has managed switches connected to a sonicwall tz210 then to cable modem-&gt;internet. x0 LAN, x1 wan (we will be moving the data network to use the FIOS on one of the other static IPs.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to use x2 to connect to the VoIP network so that only traffic bound for 172.24.1.0/24 goes out x2. and all other traffic goes out x1. Each user will need their PC (on DATA) to see their phone (on VoIP) as well as I will need to be able to connect to the VoIP server (on VoIP). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;on DATA there is a windows server running DHCP (sonicwall DHCP is disabled). On VoIP the router there is giving out IP to the phones via DHCP. so i need DHCP servers not to interfere with each other. unfortunately our phone vendor in not familiar with the sonicwalls. Any help would be appreciated. Thanks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;LBC &lt;/p&gt;&#xA;" OwnerUserId="35376" LastEditorUserId="27721" LastEditDate="2017-03-22T17:10:03.107" LastActivityDate="2017-03-22T17:10:03.107" Title="Routing to another local network with sonicwall" Tags="|routing|sonicwall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39839" PostTypeId="2" ParentId="35573" CreationDate="2017-03-20T18:34:42.010" Score="0" Body="&lt;p&gt;You need to do a &amp;quot;no shutdown&amp;quot; command in the VLAN 4 interface of each switch.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Switch1(config)# interface vlan 4&lt;/p&gt;&#xA;&lt;p&gt;Switch1(config-if)# no shutdown&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Traffic between VLANs will be dropped if the VLAN destination is shut down on the receiving switch.&lt;/p&gt;&#xA;" OwnerUserId="35089" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-03-20T18:34:42.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39840" PostTypeId="2" ParentId="39807" CreationDate="2017-03-20T19:45:53.253" Score="2" Body="&lt;p&gt;OSPF uses link-state packets (LSPs) to establish and maintain neighbor adjacencies and exchange routing updates. There are 5 different LSP types and you have just mentioned them in your question. What's important to understand, is that LSU (link state update packets) can CONTAIN 11 different types of OSPF LSAs. The key point to remember is that the difference between LSU and LSA terms can sometimes be confusing because these terms are often used interchangeably. Hovewer, an LSU contains one or more LSAs.&lt;/p&gt;&#xA;" OwnerUserId="24620" LastActivityDate="2017-03-20T19:45:53.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39841" PostTypeId="1" AcceptedAnswerId="39843" CreationDate="2017-03-20T23:17:14.227" Score="2" ViewCount="156" Body="&lt;p&gt;I'm setting up my voip system and having trouble getting things off the ground.&lt;br&gt;&#xA; In my lab environment I  have the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;isr4331 router: 10.3.222.100&#xA;be6km server: 10.3.222.101&#xA;3650 switch:  10.1.222.1&#xA;workstation:  10.1.1.1&#xA;Internet T-1: 65.xx.xx.xx/30 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;To install the be6km I need to have internt access to the be6km and the workstation. I'm not concerned about securty at the moment as I have a firewall this will all sit behind once the configuration is complete.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;my confguration for  the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    !&#xA;    !&#xA;   interface GigabitEthernet0/0/0&#xA;    description ***uplink to 3650-1 10.1.222.1 ***&#xA;    ip address 10.3.222.100 255.255.0.0&#xA;    negotiation auto&#xA;   !&#xA;   interface GigabitEthernet0/0/1&#xA;    description ****INTERNET*****&#xA;    ip address 65.xx.xx.xx 255.255.255.248&#xA;    negotiation auto&#xA;   !&#xA;   interface GigabitEthernet0/0/2&#xA;    no ip address&#xA;    shutdown&#xA;    no negotiation auto&#xA;    !&#xA;   interface Vlan1&#xA;    no ip address&#xA;    shutdown&#xA;   !&#xA;   ip default-gateway 65.xx.xx.xx&#xA;   ip forward-protocol nd&#xA;   no ip http server&#xA;   no ip http secure-server&#xA;   ip tftp source-interface GigabitEthernet0&#xA;   ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/0/1&#xA;   !&#xA;   !&#xA;   !&#xA;   !&#xA;   !&#xA;   control-plane&#xA;   !&#xA;   !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My configuration for the switch&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; !&#xA;   interface GigabitEthernet0/0&#xA;    vrf forwarding Mgmt-vrf&#xA;    no ip address&#xA;    negotiation auto&#xA;   !&#xA;   interface GigabitEthernet1/0/1&#xA;    description *******TO ISR4331*****&#xA;    switchport access vlan 103&#xA;    switchport mode access&#xA;   !&#xA;   interface GigabitEthernet1/0/2&#xA;    description ***MAINVOIP*****&#xA;    switchport access vlan 103&#xA;    switchport mode access&#xA;   !&#xA;   interface GigabitEthernet1/0/3&#xA;    switchport access vlan 103&#xA;    switchport mode access&#xA;   !&#xA;&#xA;   !&#xA;   interface Vlan1&#xA;    no ip address&#xA;    shutdown&#xA;   !&#xA;   interface Vlan100&#xA;    description COMP Wired Data VLAN&#xA;    ip address 10.1.222.1 255.255.0.0&#xA;   !&#xA;   interface Vlan103&#xA;    description COMP Wired VOIP VLAN&#xA;    ip address 10.3.222.1 255.255.0.0&#xA;    ip helper-address 10.3.222.102&#xA;   !&#xA;   interface Vlan104&#xA;    description COMP Wireless VOIP VLAN&#xA;    ip address 10.4.222.1 255.255.0.0&#xA;    ip helper-address 10.3.222.102&#xA;   !&#xA;   interface Vlan105&#xA;    description Wireless Data VLAN&#xA;    ip address 10.5.222.1 255.255.0.0&#xA;    ip helper-address 10.1.7.7&#xA;   !&#xA;   interface Vlan200&#xA;    ip address 65.xx.xx.xx 255.255.255.248&#xA;   !&#xA;   ip default-gateway 65.xx.xx.xx&#xA;   ip forward-protocol nd&#xA;   ip http server&#xA;   ip http authentication local&#xA;   ip http secure-server&#xA;   ip route 0.0.0.0 0.0.0.0 65.xx.xx.xx&#xA;   !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This the new configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   switch 1 provision ws-c3650-48pd&#xA;   !&#xA;   !&#xA;   !&#xA;   !&#xA;   !&#xA;   ip routing&#xA;   !&#xA;   !&#xA;&#xA;   !&#xA;   !&#xA;   interface GigabitEthernet0/0&#xA;    description Trunk to 3650-1&#xA;    vrf forwarding Mgmt-vrf&#xA;    no ip address&#xA;    negotiation auto&#xA;   !&#xA;   interface GigabitEthernet1/0/1&#xA;    description Link to ISR4331&#xA;    no switchport&#xA;    ip address 10.0.0.2 255.255.255.252&#xA;   !&#xA;   interface GigabitEthernet1/0/2&#xA;    description ***MAINVOIP*****&#xA;    switchport access vlan 103&#xA;    switchport mode access&#xA;   !&#xA;   interface GigabitEthernet1/0/3&#xA;    switchport access vlan 100&#xA;    switchport mode access&#xA;&#xA;   interface Vlan1&#xA;    no ip address&#xA;    shutdown&#xA;   !&#xA;   interface Vlan100&#xA;    description COMP Wired Data VLAN&#xA;    ip address 10.1.222.1 255.255.0.0&#xA;    ip helper-address 10.1.7.7&#xA;   !&#xA;   interface Vlan103&#xA;    description COMP Wired VOIP VLAN&#xA;    ip address 10.3.222.1 255.255.0.0&#xA;    ip helper-address 10.3.222.102&#xA;   !&#xA;   interface Vlan104&#xA;    description COMP Wireless VOIP VLAN&#xA;    ip address 10.4.222.1 255.255.0.0&#xA;    ip helper-address 10.3.222.102&#xA;   !&#xA;   interface Vlan105&#xA;    description Wireless Data VLAN&#xA;    ip address 10.5.222.1 255.255.0.0&#xA;    ip helper-address 10.1.7.7&#xA;   !&#xA;   router ospf 1&#xA;    auto-cost reference-bandwidth 100000&#xA;    network 0.0.0.0 255.255.255.255 area 0&#xA;   !&#xA;   ip forward-protocol nd&#xA;   ip http server&#xA;   ip http authentication local&#xA;   ip http secure-server&#xA;   !&#xA;   ip access-list extended AutoQos-4.0-Acl-Default&#xA;    permit ip any any&#xA;   !&#xA;   logging trap debugging&#xA;   logging host 10.1.10.117&#xA;   !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   !&#xA;   !&#xA;   !&#xA;   interface GigabitEthernet0/0/0&#xA;    description Link to 3650-1&#xA;    ip address 10.0.0.1 255.255.255.252&#xA;    negotiation auto&#xA;   !&#xA;   interface GigabitEthernet0/0/1&#xA;    description ****INTERNET*****&#xA;    ip address 65.xx.xx.xx 255.255.255.248&#xA;    negotiation auto&#xA;   !&#xA;   interface GigabitEthernet0/0/2&#xA;    no ip address&#xA;    shutdown&#xA;    no negotiation auto&#xA;   !&#xA;   interface Service-Engine0/1/0&#xA;   !&#xA;   interface Service-Engine0/2/0&#xA;   !&#xA;   interface Service-Engine0/4/0&#xA;   !&#xA;   interface Service-Engine1/0/0&#xA;   !&#xA;   interface GigabitEthernet0&#xA;    vrf forwarding Mgmt-intf&#xA;    no ip address&#xA;    shutdown&#xA;    negotiation auto&#xA;   !&#xA;   interface Vlan1&#xA;    no ip address&#xA;    shutdown&#xA;   !&#xA;   router ospf 1&#xA;    auto-cost reference-bandwidth 100000&#xA;    passive-interface GigabitEthernet0/0/1&#xA;    network 0.0.0.0 255.255.255.255 area 0&#xA;    default-information originate&#xA;   !&#xA;   ip forward-protocol nd&#xA;   no ip http server&#xA;   no ip http secure-server&#xA;   ip tftp source-interface GigabitEthernet0&#xA;   ip route 0.0.0.0 0.0.0.0 65.xx.218.193&#xA;   !&#xA;   !&#xA;   !&#xA;&#xA;    !&#xA;    !&#xA;    !&#xA;    !&#xA;   !&#xA;   mgcp behavior rsip-range tgcp-only&#xA;   mgcp behavior comedia-role none&#xA;   mgcp behavior comedia-check-media-src disable&#xA;   mgcp behavior comedia-sdp-force disable&#xA;   !&#xA;   mgcp profile default&#xA;   !&#xA;   !&#xA;   !&#xA;   !&#xA;   !&#xA;   !&#xA;   line con 0&#xA;    stopbits 1&#xA;   line aux 0&#xA;    stopbits 1&#xA;   line vty 0 4&#xA;    login&#xA;   !&#xA;   !&#xA;   end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34023" LastEditorUserId="34023" LastEditDate="2017-03-31T11:25:31.613" LastActivityDate="2017-03-31T11:25:31.613" Title="Internet connectivity for the lab" Tags="|cisco|routing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39843" PostTypeId="2" ParentId="39841" CreationDate="2017-03-21T00:24:17.003" Score="0" Body="&lt;p&gt;You are not routing for VLANs 100, 104, 105, and 200. There are a couple of ways to do this.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Routing on the router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0/0&#xA; description Trunk to 3650-1&#xA; no ip address&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet0/0/0.100&#xA; encapsulation dot1Q 100&#xA; ip address 10.1.222.100 255.255.0.0&#xA; ip helper-address 10.3.222.102&#xA;!&#xA;interface GigabitEthernet0/0/0.103&#xA; encapsulation dot1Q 103&#xA; ip address 10.3.222.100 255.255.0.0&#xA; ip helper-address 10.3.222.102&#xA;!&#xA;interface GigabitEthernet0/0/0.104&#xA; encapsulation dot1Q 104&#xA; ip address 10.4.222.100 255.255.0.0&#xA; ip helper-address 10.3.222.102&#xA;!&#xA;interface GigabitEthernet0/0/0.105&#xA; encapsulation dot1Q 105&#xA; ip address 10.5.222.100 255.255.0.0&#xA; ip helper-address 10.3.222.102&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 65.xx.218.193&#xA;!&#xA;no ip default-gateway 65.xx.218.193&#xA;! Don't use the default gateway command for a router that is routing. You use the default route. The router *is* the gateway.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The host gateways, including the switch, should be set to the router address for the correct VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/1&#xA; description Trunk to ISR4331&#xA; switchport mode trunk&#xA; switchport nonegotiate&#xA;!&#xA;interface Vlan100&#xA; description COMP Wired Data VLAN&#xA; ip address 10.1.222.1 255.255.0.0&#xA;!&#xA;interface Vlan103&#xA; description COMP Wired VOIP VLAN&#xA; no ip address&#xA;!&#xA;interface Vlan104&#xA; description COMP Wireless VOIP VLAN&#xA; ip address 10.4.222.1 255.255.0.0&#xA; no ip address&#xA;!&#xA;interface Vlan105&#xA; description Wireless Data VLAN&#xA; ip address 10.5.222.1 255.255.0.0&#xA; no ip address&#xA;!&#xA;ip default-gateway 10.1.222.100&#xA;!&#xA;no interface Vlan200&#xA;! The network cannot be defined on both the switch and the router if separated by layer-3.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Or, you can do LAN routing on the switch if it is a layer-3 switch, but the Internet is routed on the router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0/0&#xA; description Link to 3650-1&#xA; ip address 10.0.0.1 255.255.255.252&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 65.xx.218.193&#xA;!&#xA;no ip default-gateway 65.xx.218.193&#xA;! Don't use the default gateway command for a router that is routing. You use the default route. The router *is* the gateway.&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; auto-cost reference-bandwidth 100000&#xA; passive interface GigabitEthernet0/0/1&#xA; network 0.0.0.0 255.255.255.255 area 0&#xA; default-information originate&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description Link to ISR4331&#xA; no switchport&#xA; ip address 10.0.0.2 255.255.255.252&#xA;!&#xA;no interface Vlan200&#xA;! The network cannot be defined on both the switch and the router if separated by layer-3.&#xA;!&#xA;no ip default-gateway 65.xx.218.193&#xA;no ip route 0.0.0.0 0.0.0.0 65.xx.218.193&#xA;!&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; auto-cost reference-bandwidth 100000&#xA; network 0.0.0.0 255.255.255.255 area 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Instead of OSPF, you could use another routing protocol, or use static routes, which do not scale.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The host gateways, including the switch, should be set to the switch VLAN address for the correct VLAN.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you have not configured NAT this is one way to do that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0/0&#xA; description Link to 3650-1&#xA; ip address 10.0.0.1 255.255.255.252&#xA; ip nat inside&#xA;!&#xA;interface GigabitEthernet0/0/1&#xA; description ****INTERNET*****&#xA; ip address 65.xx.218.195 255.255.255.248&#xA; ip nat outside&#xA;!&#xA;ip nat inside source list 10 interface GigabitEthernet0/0/1 overload&#xA;!&#xA;access-list 10 permit 10.0.0.0 0.255.255.255&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will translate any &lt;code&gt;10.0.0.0/8&lt;/code&gt; address to the public internet address assigned to your Internet interface (&lt;code&gt;GigabitEthernet0/0/1&lt;/code&gt;).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-21T19:59:23.307" LastActivityDate="2017-03-21T19:59:23.307" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="39844" PostTypeId="2" ParentId="32560" CreationDate="2017-03-21T00:25:59.193" Score="10" Body="&lt;p&gt;I know this is an older question, hopefully you've solved it by now, but I wanted to toss in my two cents, for the benefit of future generations if nothing else.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First of all, yes, ethernet and PoE specs mean you can do exactly what you're trying to do, and run two PoE cameras over a single Cat5e. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;First up, there are very, very, VERY few IP surveillance cameras that use gigabit ethernet; 99.99% of them are 10/100 Fast Ethernet only. The ones that do use GbE will be super high-end, super high-res, and super expensive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, very very few cameras use more than about 5-6 watts. Most IR cameras won't pull more than about 4W with the IR on; non-IR cameras will typically use 2W or less. To use a full 15W you'd be looking at something with massive IR range, heater, fan, and probably PTZ as well. The Axis outdoor cameras I use, with internal heater and fan to dissipate moisture, spec a maximum 12.1W draw.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With all that in mind: 10/100 ethernet uses only two of the four pairs, and PoE &quot;mode A&quot;, aka &quot;endspan&quot; runs power over that same pair. This means that &lt;strong&gt;if your switch and cameras both support Mode A or endspan power&lt;/strong&gt; (which will include most except the very cheapest), you can run a camera over only two pairs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That leaves the other two pairs free for a second device - I've run a second camera that way, a IP video decoder, a wireless access point, a room temperature monitor... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the switch end, I'll often just strip the jacket back 2-3&quot;, terminate the orange and green pairs normally in one RJ45 plug (n that case, for T-568B, the plug would look like white/orange, orange, white/green, blank, blank, green, blank, blank), and then put the brown and blue pairs where the orange and green pairs would go in a second plug (I use brown for orange and blue for green, just to keep it simple to keep track of). The two can then plug into adjacent ports in the switch. If you prefer to split the two out into adjacent keystone jacks and use standard patch cords, you can do that too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other end, you can split the pairs out in a box and terminate into keystones, then run patch cords to the cameras... or bring it in behind one camera, put plugs on the ends and plug one into that camera, then run an extension to the other camera and put a keystone on it to connect to your home run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, you can adjust the termination types to suit your purposes. In a pinch I've just used &quot;beanie&quot; connectors to splice the wires - at the end of the day, they're still just moving electricity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now some PoE switches will do up to a full 15W per port, but for only half the ports, and more typically provide 7.5W per port... but again, with most cameras, that will be more than enough, and again, that's per port - you're plugging each camera into its own port here, so that's not a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, this is all very &quot;non-standard&quot;... but it is certainly possible, easy to do, and so far it's worked very reliably for me when there have been no other options.&lt;/p&gt;&#xA;" OwnerUserId="35385" LastActivityDate="2017-03-21T00:25:59.193" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39845" PostTypeId="2" ParentId="39834" CreationDate="2017-03-21T01:41:56.100" Score="4" Body="&lt;p&gt;Areas exist as a mechanism to control database scale in OSPF by hiding and abstracting information.  Your design could &lt;em&gt;almost&lt;/em&gt; do this if, for example, there were, say, a few dozen subnets in the &quot;user LAN&quot; segment of your drawing indicted to be in area 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, if there were an extensive WAN hanging off of the routers you could connect a bunch of sites into area 1 and summarize their routes into area 0.  In so doing it would reduce the amount of information that the various area 0 boxes would need to maintain while also eliminating the vast majority of database information that devices in area 1 have about area 2 (...an vice-versa).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - following the above suppositions - the idea here is that there's not much need for routers in the notional WAN in area 1 to see (and process) information about events happening in area 2, just as a flapping WAN link on the WAN shouldn't be burdening the processing of a LAN switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Putting backup links in different areas accomplishes nothing, apart from potentially yielding surprising (..in the bad sense) results as far as link-selection is concerned.  Given that you aren't summarizing or running &quot;special&quot; areas (traditional stub, not-so-stubby, totally not-so-stubby, etc) the use of additional areas doesn't accomplish anything positive in your diagram. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practical usage there really isn't much of an argument for four routers running multi-area.  In fact, at least some of the argument for area separation (reducing SPF run-times/CPU consumption) has been minimized in recent years as router CPU's have gotten so much faster - especially when compared to John Moy's era when a 16MHz CPU with 1M of RAM was considered a fairly beefy control plane.  This tends to mean that short of much larger numbers of routers or a design with high degrees of summarization possible that the net benefit of multi-area setups has diminished somewhat.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-03-21T01:41:56.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39846" PostTypeId="2" ParentId="37466" CreationDate="2017-03-21T03:49:49.900" Score="1" Body="&lt;p&gt;Yes and no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Yes&lt;/strong&gt; in the sense that the effect of two ports in an isolated PVLAN or two ports in two &lt;em&gt;different&lt;/em&gt; community PVLANs can not communicate, as if they were in two different actual VLANs (considered Primary VLANs when discussing PVLAN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;No&lt;/strong&gt; in the sense that with Private VLANs, all four of the hosts I mentioned previously are able to speak to the same port, configured as a Promiscuous port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With &quot;regular&quot; VLANs (Primary VLANs), they may all be able to speak out the same &lt;em&gt;trunk&lt;/em&gt; port, but each of their traffic will still be isolated from the other due to the &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/vlans/#tagged-untagged&quot; rel=&quot;nofollow noreferrer&quot;&gt;VLAN Tag&lt;/a&gt;. That is why if you had four traditional VLANs, you would typically have four different IP subnets and a &lt;a href=&quot;http://www.practicalnetworking.net/stand-alone/routing-between-vlans/&quot; rel=&quot;nofollow noreferrer&quot;&gt;router handling the Routing between the VLANs&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With PVLANs, all four hosts could be able to speak out the exact same Promiscuous port, that could be facing a Router that does &lt;em&gt;not&lt;/em&gt; have to maintain four different IP networks. A step further, all four hosts could also be using IP addresses from the same IP network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;sup&gt;&lt;em&gt;Note: There are different games you can play with VRFs and multi-context devices that allow four different VLANs to use the same IP Subnet, but given the nature of the question I believe those technologies are outside the scope of what the OP is asking about.&lt;/em&gt;&lt;/sup&gt;&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2017-03-21T03:49:49.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39847" PostTypeId="1" AcceptedAnswerId="39852" CreationDate="2017-03-21T05:52:50.027" Score="4" ViewCount="1522" Body="&lt;p&gt;I was reading about the 'IP' in TCP/IP. Most of its functions seem to be for connecting different (types of) networks. Does this mean that network layer is not required for communication between computers in the same LAN? If not, what other functions are provided by network layer other than common addressing (in case of IP) and routing? &lt;/p&gt;&#xA;" OwnerUserId="35134" LastEditorUserId="8499" LastEditDate="2018-03-18T21:19:51.683" LastActivityDate="2018-03-18T21:19:51.683" Title="Need for network layer" Tags="|ip|network|layer3|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39848" PostTypeId="2" ParentId="39847" CreationDate="2017-03-21T06:02:48.203" Score="1" Body="&lt;p&gt;Frames on a layer-2 LAN are delivered directly from one host to another host on the same LAN. To get from one LAN to another LAN, you need layer-3 (IPv4, IPX, IPV6, etc.). IPv4 and IPv6 both provide fields in the IP header for facilitating QoS, and each has various options, which may also be extended in the future.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 791, Internet Protocol&lt;/em&gt;&lt;/a&gt; provides the scope of IP:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;1.2.  Scope&lt;/p&gt;&#xA;&lt;p&gt;The internet protocol is specifically limited in scope to provide the&#xA;functions necessary to deliver a package of bits (an internet&#xA;datagram) from a source to a destination over an interconnected system&#xA;of networks.  There are no mechanisms to augment end-to-end data&#xA;reliability, flow control, sequencing, or other services commonly&#xA;found in host-to-host protocols.  The internet protocol can capitalize&#xA;on the services of its supporting networks to provide various types&#xA;and qualities of service.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;IPv4 also provides for fragmentation and reassembly of packets, but that has been eliminated in IPv6.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-03-21T06:02:48.203" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39849" PostTypeId="2" ParentId="39847" CreationDate="2017-03-21T06:05:05.363" Score="1" Body="&lt;p&gt;I would say the opposite - IP is designed to connect to all (IP) networks, regardless of the underlying link-layer technology supporting them (Ethernet/WLAN/WiMAX/LTE)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Coming at it from the other end - don't assume a host only ever has a single IP address - think about a web server hosting multiple sites bound to multiple addresses in the same subnet - the link-layer cannot provide any information for the host OS to determine which one to send it to.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-03-21T06:05:05.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39851" PostTypeId="2" ParentId="37471" CreationDate="2017-03-21T06:40:29.100" Score="2" Body="&lt;p&gt;In a typical scenario, the switch has no way to tell the upstream device to stop sending it so much. So it will receive 10Gbps from upstream. Obviously it can only send 1Gbps downstream. So it will send 1Gbps downstream. Of the remaining 9Gbps, a few packets will probably be buffered and the rest will be dropped by the switch.&lt;/p&gt;&#xA;" OwnerUserId="12046" LastActivityDate="2017-03-21T06:40:29.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39852" PostTypeId="2" ParentId="39847" CreationDate="2017-03-21T07:07:29.453" Score="3" Body="&lt;p&gt;That is correct - the IP layer is not &lt;em&gt;required&lt;/em&gt; for communication within a LAN. On Ethernet for example, there's no reason a computer can't send an Ethernet frame addressed to some other computer with some non-IP data inside it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, now that the Internet is ubiquitous, TCP/IP is the most useful configuration and therefore the most work has gone into supporting it. There's rarely any reason for a commercial software vendor to make a protocol that runs directly over Ethernet, when they could make it run over IP instead, and have it be able to work on the Internet. I can't think of any protocols &lt;em&gt;used by the average consumer&lt;/em&gt; that don't use IP, besides ARP. (NetBIOS used to be ubiquitous on Windows LANs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, professional networking gear does use such protocols. Two examples that came to mind are the &lt;a href=&quot;https://en.wikipedia.org/wiki/IS-IS&quot; rel=&quot;nofollow noreferrer&quot;&gt;IS-IS&lt;/a&gt; routing protocol, or &lt;a href=&quot;https://en.wikipedia.org/wiki/Spanning_Tree_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;STP&lt;/a&gt; used by Ethernet switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IS-IS could've run over IP, really (there's a similar protocol OSPF that does just that). STP runs on Ethernet switches, which might not even have IP addresses, so it really does need to run over Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I imagine most protocols that run on IP (such as TCP) could be adapted to run over Ethernet, Token Ring, ATM, or whatever - but there would be no benefit to doing so.&lt;/p&gt;&#xA;" OwnerUserId="12046" LastActivityDate="2017-03-21T07:07:29.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39854" PostTypeId="1" CreationDate="2017-03-21T09:22:04.653" Score="2" ViewCount="930" Body="&lt;p&gt;I am a programmer and we can filter out the packets in the router to manipulate the IP or MPLS headers. My question is there any way to distinguish between UDP 1 byte traceroute data vs user traffic data? The traceroute udp packet will have different udp source and destination port number and there is no standard port for it. Is there any IP fields through which I can distinguish traceroute packet?&lt;/p&gt;&#xA;" OwnerUserId="35397" LastEditorUserId="8499" LastEditDate="2017-03-22T14:38:25.167" LastActivityDate="2017-05-21T15:12:54.863" Title="How to differentiate between UDP traceroute packet and the normal data traffic?" Tags="|router|udp|traceroute|layer4|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39855" PostTypeId="1" CreationDate="2017-03-21T09:20:50.847" Score="7" ViewCount="831" Body="&lt;p&gt;I have setup a new VLAN on my corporate network for use for guests only. I am trying to setup a guest WiFi service and keep all of the traffic separate from the business traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far I have created a 172.16.0.0/24 subnet using VLAN 172 for guests.&#xA;This is separate from my 10.11.0.0 network but still is travelling through the same Cisco hardware to get from the Cisco Aironet out to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The aim is to get the traffic from the guests device to travel through multiple hops as follows:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Guest device &gt; Cisco Aironet 1600 &gt; Cisco WLC 2504 &gt; Cisco Catalyst 3560 - All on 10.11.23.0 subnet in one physical location, then it passes to the 10.11.1.0 subnet and uses a Cisco WS-C2960G &gt; Cisco 1941 router &gt; Internet, which is in another physical location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My switches on the 10.11.23.0 subnet can all see all of the route hops on the 172 VLAN but not outside of its physical location, e.g they cannot see the next hops that reside in the other physical location and the same for the 10.11.1.0 subnet.&#xA;So there is a big gap in the middle where VLAN 172 is missing the connection which joins the two physical locations together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am pretty sure that the switchports that are responsible for joining these two locations together are not trunked. I think this is the answer but the rest of my live network relies on these ports. If I enable trunk mode to test this, am I likely to disconnect everything else that is currently working?&lt;/p&gt;&#xA;" OwnerUserId="42737" OwnerDisplayName="Becky" LastEditorUserId="8499" LastEditDate="2018-03-18T23:39:21.577" LastActivityDate="2018-04-18T00:12:51.777" Title="New VLAN across multiple Cisco switches" Tags="|cisco|switch|vlan|cisco-catalyst|trunk|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39856" PostTypeId="2" ParentId="39854" CreationDate="2017-03-21T09:31:20.527" Score="1" Body="&lt;p&gt;Unix tracertroute will use destenation port range  33434 - 33464, it will start for the first hop with 33434 and for each node will increase it by one till it reach 33464&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-03-21T09:31:20.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39857" PostTypeId="2" ParentId="39855" CreationDate="2017-03-21T10:24:46.657" Score="1" Body="&lt;p&gt;Since both end of link must be setup the same way, yes changing a link from access mode to trunk mode will cause a disruption, at least a few seconds.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you access the management of one of those switch through the link you are changing, then you need to first change the configuration on this switch, then on the other one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's better to have console access on both, so you don't loose the management and can quickly correct any misconfiguration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are filtering VLAN, enter first the&lt;br&gt;&#xA; &lt;code&gt;switchport trunk allowed vlan *your vlan list*&lt;/code&gt;&lt;br&gt;&#xA;and, if needed,&lt;br&gt;&#xA;&lt;code&gt;switchport trunk encapsulation dot1q&lt;/code&gt; (not all switches require it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;the you can issue simultaneously&#xA;&lt;code&gt;switchport mode trunk&lt;/code&gt;on both switches&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-21T10:24:46.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39858" PostTypeId="2" ParentId="39854" CreationDate="2017-03-21T10:35:23.090" Score="1" Body="&lt;p&gt;Traceroute relies on TTL to find each hop.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first traceroute packet has a TTL of 1, then the value is incremented by 1 for each following node.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regular traffic will (almost) always have the default TTL value from the operating system, usually 64 or 128, this value being of course decreased for each router traversed between the originating host and your packet sniffer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, unless you are performing a traceroute for a destination that is more than 30 hops away (which is larger than Internet diameter), a filtering on the TTL field should give you a good match.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-21T10:35:23.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39860" PostTypeId="1" AcceptedAnswerId="39862" CreationDate="2017-03-21T10:55:38.033" Score="2" ViewCount="598" Body="&lt;p&gt;Does anyone know can Cisco ACS be used as syslog server? For collecting logs from cisco devices?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastActivityDate="2017-04-13T14:53:28.877" Title="Cisco Access Control Server ACS" Tags="|cisco|syslog|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39862" PostTypeId="2" ParentId="39860" CreationDate="2017-03-21T11:48:02.903" Score="2" Body="&lt;p&gt;Cisco ACS can't be used as syslog server, but it could be used as AAA server which is include Accounting:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;if you are looking to use ACS as accounting server for management account which is include logging for the commands and changes done by any ASA  user you have to define the ACS as tacacs server for the ASA &#xA;you could find more info on this link: &#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/112967-acs-aaa-tacacs-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASA 8.3: TACACS Authentication using ACS 5.X&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;or if you want to use it for VPN accounting, you should enable the VPN authentication and authorization on the ASA to use ACS as radius server and in this case you can retrieve the VPN users sessions details from the ACS logs&lt;br&gt;&#xA;you could find more info on this link: &#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113449-asa-vpn-acs-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Radius Authorization (ACS 5.x) for VPN Access&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="-1" LastEditDate="2017-04-13T14:53:28.877" LastActivityDate="2017-04-13T14:53:28.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39863" PostTypeId="1" CreationDate="2017-03-21T12:54:45.770" Score="1" ViewCount="107" Body="&lt;p&gt;I'm trying to set up a VPN connection for a client-to-site scheme with  a fortigate VM applicance. This is for testing puropose so all clients and the fortigate are runned on VMWare.&#xA;Here is what I did so far :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Client1 in LAN (Windows XP) : IP = 192.168.50.2&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Client2 outside (Windows XP) : IP = 196.47.60.1 (to simulate a public IP address)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;LNS (L2TP Network Server) : Fortigate&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;2 ports : port1(LAN) with IP = 192.168.50.2 and port2(WAN) with IP = 196.47.60.2&lt;/li&gt;&#xA;&lt;li&gt;One reserved range of IP that the VPN client will be given : 192.168.50.[50-60]. That reserved range is used cor the 'config vpn l2tp' sip and eip settings&lt;/li&gt;&#xA;&lt;li&gt;One I have create an address object related to the devices VPN clients will be able to access in the LAN. Nothing more than 192.168.50/24&lt;/li&gt;&#xA;&lt;li&gt;I created a firewall policy saying : incoming interface (port1) with IP range 192.168.50[50-60] -&gt; outgoing interface (port2) with IP 192.168.50/24&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Brief I followed the tutorial here &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/PPTP_L2TP.104.15.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%205.0%20Help/PPTP_L2TP.104.15.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the client2, I created a VPN connection. I want the target IP to be 192.168.50.2 but it doesnt work. Though I am able to bing port2 of the fortigate from my client. When I change the target address to 196.47.50.1, it does not work either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What did I do wrong ? I hope I won't need to post MY WHOLE CONFIG here....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NB : Please I don't want to use forticlient ; only&lt;/p&gt;&#xA;" OwnerUserId="35404" LastEditorUserId="-1" LastEditDate="2017-03-21T14:16:26.803" LastActivityDate="2017-03-21T14:16:26.803" Title="What is wrong with my Fortigate LNS IP scheme configuration?" Tags="|vpn|fortigate|l2tp|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39864" PostTypeId="1" AcceptedAnswerId="39867" CreationDate="2017-03-21T13:11:58.163" Score="1" ViewCount="382" Body="&lt;p&gt;I have been able to set up routing table for a simple one without internet access. However I am not able to set it up correctly with multiple interfaces. My set up look like this.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#PC1&#xA; address 10.1.10.103&#xA; netmask 255.255.255.0&#xA; broadcast 10.1.10.255&#xA; gateway 10.1.10.10&#xA; network 10.1.10.0&#xA;&#xA;#PC2&#xA; address 192.168.10.10&#xA; netmask 255.255.255.0&#xA; broadcast 192.168.10.255&#xA; network 192.168.10.0&#xA; gateway 192.168.10.2  &#xA;&#xA;#Router&#xA;&#xA;auto eth0&#xA;iface eth0 inet static &#xA;&#xA;address 10.1.10.10&#xA;netmask 255.255.255.0&#xA;broadcast 10.1.10.255&#xA;network 10.1.10.0&#xA;&#xA;auto eth1&#xA;iface eth1 inet static &#xA;&#xA; address 192.168.10.2&#xA; netmask 255.255.255.0&#xA; broadcast 192.168.10.255&#xA; network 192.168.10.0&#xA; gateway 192.168.10.1 &#xA;&#xA;auto eth2&#xA;iface eth2 inet dhcp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;pc1 can ping pc2 and vice versa, but pc1 cannot ping 192.168.10.1 !! I don't gate why.&#xA;Router has access to the internet but pc1 don't have access to internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have made 192.168.10.1 the default gateway in the routing table but nothing changed. I have also 192.168.10.2 default gateway, it still did not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could be wrong? How do I get pc1 to ping 192.168.10.1 and access the internet? I guess the routing table is wrong&lt;/p&gt;&#xA;" OwnerUserId="34494" LastActivityDate="2017-03-21T15:04:55.637" Title="routing table set up with multiple interfaces" Tags="|routing|ipv4|" AnswerCount="1" CommentCount="6" ClosedDate="2018-07-26T23:03:00.600" ContentLicense="CC BY-SA 3.0" />
  <row Id="39865" PostTypeId="2" ParentId="39854" CreationDate="2017-03-21T14:13:25.730" Score="1" Body="&lt;p&gt;There is an actual traceroute protocol, which has now been deprecated (see &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1393&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 1393, Traceroute Using an IP Option&lt;/em&gt;&lt;/a&gt;). This may still be used by some OSes, but some OSes use ICMP, and some use other protocols, but the key is incrementing TTLs.&lt;/p&gt;&#xA;&lt;p&gt;The key to look for is small TTLs in the IP packet header. The minimum TTL that most OSes start with is 64 (some start with 128). You can send packets around the world in about a dozen hops, so if you see single digit TTLs, you can assume that you see traceroute packets.&lt;/p&gt;&#xA;&lt;p&gt;Traceroute is often misunderstood. It is a useful tool on you own network where you understand the network design and know what the route should be. Using traceroute on the Internet can be very misleading because some ISPs in the path may look for ICMP or traceroute, and then reroute those packets. That is to prevent you from casually discovering the internal network of the ISP. In that case, the path you normal traffic takes can be very different than what the traceroute shows you.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-03-21T14:13:25.730" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39867" PostTypeId="2" ParentId="39864" CreationDate="2017-03-21T15:04:55.637" Score="1" Body="&lt;p&gt;The router at 192.168.10.1 doesn't have a route to 10.1.10.0.  You need to add a static route for 10.1.10.0/24 on that device with the next hop at 192.168.10.2&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-21T15:04:55.637" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39868" PostTypeId="1" CreationDate="2017-03-21T15:58:33.873" Score="2" ViewCount="3663" Body="&lt;p&gt;I am facing a situation where on the core network I have around 15k MAC addresses, and on the edge switches (Access Layer), I am finding switches with 27k MAC addresses. Access switches are configured to allow one MAC address per interface, and if there is VoIP, two MAC addresses per interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is a layer 2 network, I don't understand why I have more MAC addresses on the Access switches. I was able to find out&#xA;that some MAC addresses are on two VLANs at the same time, mainly MAC addresses that belong to VoIP phones, but so far I'm unable to find why this is happening.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anyone experienced a similar situation? If so, what was the reason or causes of such situation?  &lt;/p&gt;&#xA;" OwnerUserId="13605" LastEditorUserId="8499" LastEditDate="2020-07-18T18:01:24.600" LastActivityDate="2020-07-19T04:39:07.820" Title="Same MAC address on different VLANs" Tags="|vlan|switching|mac-address|layer2|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39869" PostTypeId="2" ParentId="39868" CreationDate="2017-03-21T16:07:35.123" Score="2" Body="&lt;p&gt;VoIP phones are actually switches, too, if they allow you to connect a PC. Limiting a switch interface to two MAC addresses when using a VoIP phone can be problematic because some VoIP phones use more than one MAC address for themselves (one for the phone itself, and one or two for the switch interfaces), then you have a MAC address for the PC connected to the phone, so it could use three or more MAC addresses on the switch interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a switch, the phone negotiates a trunk to the switch to which it is connected, and a VoIP phone MAC address could appear on more than one VLAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-21T16:19:18.037" LastActivityDate="2017-03-21T16:19:18.037" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39870" PostTypeId="2" ParentId="22824" CreationDate="2017-03-21T20:00:19.557" Score="0" Body="&lt;p&gt;Create a standard access list to identify the internal traffic being translated.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list 1 permit 192.168.0.0 0.0.255.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in the NAT statement reflect the access-list&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source list 1 interface serial 0/0/0 overload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will work in NAPT.&lt;/p&gt;&#xA;" OwnerUserId="13605" LastEditorUserId="8499" LastEditDate="2017-03-22T00:33:45.937" LastActivityDate="2017-03-22T00:33:45.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39872" PostTypeId="1" CreationDate="2017-03-22T00:25:47.173" Score="2" ViewCount="2168" Body="&lt;p&gt;This question is actually a follow up to this link: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/1550/converting-ap-from-capwap-to-autonomous-bvi1-interface-gets-reverted-back-to-d?newreg=0a78155a09b6469daba9ee5a9b51e9be&quot;&gt;converting AP from CAPWAP to autonomous - BVI1 interface gets reverted back to DHCP&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The method I tried to follow: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AP#debug capwap console cli   &#xA;AP5475.d0f5.2ee7#enable&#xA;AP5475.d0f5.2ee7#conf t&#xA;AP5475.d0f5.2ee7(config)#ip default-gateway 10.10.10.1&#xA;AP5475.d0f5.2ee7(config)#int bvi1&#xA;AP5475.d0f5.2ee7(config-if)#ip address 10.10.10.102 255.255.255.0&#xA;AP5475.d0f5.2ee7(config-if)#no shut&#xA;AP5475.d0f5.2ee7(config-if)#end&#xA;AP5475.d0f5.2ee7#copy tftp://10.10.10.103/ap3g2-k9w8-tar.152-2.jb.tar flash:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then my TFTP gets interrupted during 75% of the transferred with the prompt. “Could not discover WLC. Either IP address is not assigned or assigned IP is wrong. Renewing DHCP.”&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made sure to change my PC IP address as &lt;code&gt;10.10.10.103 255.255.255.0&lt;/code&gt; with default-gateway as &lt;code&gt;10.10.10.1&lt;/code&gt; and a preferred DNS as &lt;code&gt;10.10.10.1&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The path of my firmware is &lt;code&gt;C:\tftpd64.400\ap3g2-k9w8-tar.152-2.jb.tar&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help.&lt;/p&gt;&#xA;" OwnerUserId="35421" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2017-10-01T23:38:24.810" Title="converting AP from autonomous to CAPWAP; DHCP keeps interrupting TFTP Process (follow up)" Tags="|cisco|ipv4|dhcp|access-point|tftp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39873" PostTypeId="1" AcceptedAnswerId="39956" CreationDate="2017-03-22T02:48:58.057" Score="3" ViewCount="120" Body="&lt;p&gt;What is the difference between wireless controllers and access points, and how come you need both devices to work efficiently together?&lt;/p&gt;&#xA;" OwnerUserId="35421" LastEditorUserId="8499" LastEditDate="2017-03-22T04:27:06.570" LastActivityDate="2021-01-23T09:54:20.150" Title="Wireless controllers and access points" Tags="|cisco|wireless|access-point|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39874" PostTypeId="2" ParentId="39873" CreationDate="2017-03-22T02:52:30.903" Score="1" Body="&lt;p&gt;A WLC will control all your LWAPs. You can control all the aspects of the LWAPs from the WLC. Normally, your LWAPs will create a CAP/WAP tunnel back to the WLC, and the Wi-Fi traffic will traverse the tunnel back to the WLC, where it will be put onto the network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-22T02:52:30.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39876" PostTypeId="2" ParentId="22889" CreationDate="2017-03-22T08:44:34.670" Score="2" Body="&lt;p&gt;If throughput (performance) license is enabled as it is shown on the attached picture, your throughput is 100mbps. Using a 4321 you have 2 options. 50mbps without performance license, and 100mbps with it.&lt;/p&gt;&#xA;" OwnerUserId="35426" LastActivityDate="2017-03-22T08:44:34.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39879" PostTypeId="1" AcceptedAnswerId="39880" CreationDate="2017-03-22T12:00:21.243" Score="2" ViewCount="11447" Body="&lt;p&gt;I'm trying to see how much RAM is being used by each switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switch is a cisco WS-C2960-24TT-L IOS version 12.2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I am seeing from the switch when I run the show version command.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;cisco WS-C2960-24TT-L (PowerPC405) processor (revision R0) with 65536K bytes of memory.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I've seen another 2960 Version 12.2 which showed the ram usage, however, this was a 2960-24TC-L switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tNitT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tNitT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35429" LastActivityDate="2017-03-23T12:05:10.547" Title="Show RAM usage Cisco 2960" Tags="|cisco|switch|ethernet|cisco-ios|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39880" PostTypeId="2" ParentId="39879" CreationDate="2017-03-22T12:02:44.117" Score="3" Body="&lt;p&gt;You can try to use command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show proc mem&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;you will get output like: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Processor Pool Total:   43953664 Used:   12967924 Free:   30985740&#xA;      I/O Pool Total:    8388608 Used:    2998796 Free:    5389812&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or for more detailed you can use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show memory summary&#xA;                Head    Total(b)     Used(b)     Free(b)   Lowest(b)  Largest(b)&#xA;Processor    1652A00    43953664    12972664    30981000    29707060    30031048&#xA;      I/O   80000000     8388608     2998920     5389688     3992572     4660984&#xA;[output omitted] &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Total = the total amount of memory available after the system image loads and builds its data structures.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Used = the amount of memory currently allocated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Free = the amount of memory currently free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lowest = the lowest amount of free memory recorded by the router since it was last booted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Largest = the largest free memory block currently available.&lt;/p&gt;&#xA;" OwnerUserId="29518" LastEditorUserId="29518" LastEditDate="2017-03-22T12:31:09.343" LastActivityDate="2017-03-22T12:31:09.343" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="39881" PostTypeId="1" CreationDate="2017-03-22T12:48:38.153" Score="1" ViewCount="556" Body="&lt;p&gt;Hello and thanks in advance for your advice.  I recently started supporting a small business and have a problem I can't figure out.  The office has 6 remote employees who access the office network via Global VPN software connecting to a TZ210 SonicWall.  They use company supplied machines to run the VPN software and connect to desktops in the office.  This company runs some data-intensive apps and they don't perform well over the internet so this was the preferred setup and it works very well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found one exception.  He doesn't remote into a machine in the office, he runs the apps from his desktop.  Somehow, this user connects to the network without a VPN connection (and has no VPN account on the firwall) and has been  working for months.  I found out because he was having performance issues and started complaining.  I created a VPN login and installed the software; it connects successfully.  When we try to Remote Desktop to his machine in the office the RD software throws an &quot;Internal Error&quot; while connecting.  However, if I don't enable the VPN, he can connect to his remote desktop.  So, something in the firewall is letting him in but I have no clue where to start looking?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some relevant details:&#xA;(&quot;computer&quot; refers to his machine outside the network)&#xA; - Computer is running windows 7&#xA; - Computer is not joined to the domain&#xA; - IP and DNS are set to dynamic&#xA; - Firewall is a SonicWall TZ210&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions where to start looking are appreciated.&lt;/p&gt;&#xA;" OwnerUserId="35430" LastActivityDate="2020-02-22T18:00:43.617" Title="How is user gaining Remote access via SonicWall without VPN" Tags="|vpn|firewall|sonicwall|" AnswerCount="1" CommentCount="6" ClosedDate="2020-02-22T18:02:00.467" ContentLicense="CC BY-SA 3.0" />
  <row Id="39884" PostTypeId="2" ParentId="39837" CreationDate="2017-03-22T15:18:48.027" Score="1" Body="&lt;p&gt;Your question doesn't list any specific IPs so I'm just going to make some assumptions, change them as needed. You can do what you want, DHCP is broadcast only within the local subnet (won't be passed by a router unless you configure specific options to do so).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Assuming:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SonicWALL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;X0 = Data LAN (let's say 10.0.0.1/24) - connects to Data switch&#xA;X1 = WAN&#xA;X2 = VoIP (new)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Telephone Vendor Router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;port0 = Voice LAN (let's say 172.21.1.1/24) - connects to VoIP switch&#xA;port1 = WAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;On the SonicWALL, configure:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Configure X2&lt;/em&gt; on the SonicWALL with a free IP on the VoIP subnet, let's say: 172.21.1.2/24. If the vendor controls this subnet ask them for a free IP, otherwise do an IP Scan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under Network | &lt;em&gt;PortShield Group&lt;/em&gt;, edit X2 and ensure it is Unassigned (not assigned to X1). Then under Network | &lt;em&gt;Interfaces&lt;/em&gt;, edit X2. Assign it to the LAN zone (assuming you trust the VoIP traffic - if you don't then use DMZ and you will need to create Firewall rules; choose LAN if you're unsure, to start). Set it for a Static IP, configure the IP, and other settings as desired.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: A route will automatically be created under Network | &lt;em&gt;Routing&lt;/em&gt; (from Any to X2 Subnet, for Any Service).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you selected X2 Zone = LAN the Firewall rules will already be created (assuming Interface Trust is enabled for the LAN zone, which it is by default). If you set X2 Zone = DMZ you will need to go to Firewall | Access Rules. Create or edit rule from LAN &gt; DMZ, and DMZ &gt; LAN for the X0 and X2 interface (I would suggest keeping things wide open, Any/Any/Any, during testing and then tighten up after if needed).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Connect X2 to the VoIP switch.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;On the Phone Router:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOW: you or the &lt;em&gt;Phone Vendor will need to create a route&lt;/em&gt; on the other router. No IP or interface needs to be configured. The route will need to be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Destination: 10.0.0.0/24&#xA;Gateway: 172.21.1.2   (or whatever IP you assigned to X2)&#xA;Metric: 10 (or as needed)&#xA;[All services, if it asks. Interface is whatever interface is the &quot;lan&quot; interface on that device. Hopefully they know how to configure their own device]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you were &lt;em&gt;testing&lt;/em&gt; with a PC connected to the VoIP network (with a 172.21.1.x IP) the Windows route command would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route add 10.0.0.0 mask 255.255.255.0 172.21.1.2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Depending on the config of the Voice Router there may be firewall polices that need to be created, but hard to say - I suspect not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Result:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anything on your Data LAN will have a default gateway of the SonicWALL - and the SonicWALL has an interface on the VoIP network so can pass packets along. Anything on the Void Network will have a default gateway of the Phone Router and that router now has a route pointing to the Data LAN via the IP you assigned to the X2 interface, so packets can travel back.&lt;/p&gt;&#xA;" OwnerUserId="2702" LastActivityDate="2017-03-22T15:18:48.027" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39886" PostTypeId="1" AcceptedAnswerId="39887" CreationDate="2017-03-22T18:26:11.050" Score="2" ViewCount="263" Body="&lt;p&gt;Just found today there is a 0-day exploit in many Cisco switch which use &lt;code&gt;CMP&lt;/code&gt; cluster management protocol which allow remote command execution. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per above link when i run this command to check CMP is running or not, its seems its not enable on my switch does that means we are secure?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW1#show subsys class protocol | include ^cmp&#xA;SW1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2017-03-22T18:48:39.470" Title="Cisco 0-day CMP exploit" Tags="|cisco|switch|security|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39887" PostTypeId="2" ParentId="39886" CreationDate="2017-03-22T18:48:39.470" Score="1" Body="&lt;p&gt;According the the &lt;a href=&quot;https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20170317-cmp&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Advisory&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cisco devices running a vulnerable Cisco IOS XE release are affected&#xA;  by this vulnerability when the following conditions are met: &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The CMP  subsystem is present on the Cisco IOS XE software image running on the device, &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;and &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The device is configured to accept incoming Telnet&#xA;  connections. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In order to determine if the CMP subsystem is present on&#xA;  the running software image, execute the command show subsys class&#xA;  protocol | include ^cmp from a privileged CLI prompt on the device.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following example shows the output of the command &lt;strong&gt;show subsys&#xA;  class protocol | include ^cmp&lt;/strong&gt; when the CMP subsystem is present on the&#xA;  software image running on the device:&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Switch#show subsys class protocol | include ^cmp cmp                  &#xA; Protocol    1.000.001      Switch#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The following example shows the output of the command &lt;strong&gt;show subsys&#xA;  class protocol | include ^cmp&lt;/strong&gt; when the CMP subsystem is not present on&#xA;  the software image running on the device:  &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#show subsys class protocol | include ^cmp     &#xA;Switch# &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;In order to determine if the&#xA;  device is configured to accept incoming Telnet connections, execute&#xA;  the command show running-config | include ^line vty|transport input&#xA;  from a privileged CLI prompt. The command output may indicate one of&#xA;  multiple possible configurations, such as the following: The absence&#xA;  of a transport input configuration line after the line vty&#xA;  configuration line indicates the device is using the default set of&#xA;  protocols for incoming connections through a virtual terminal (VTY).&#xA;  The default set of protocols includes the Telnet protocol; hence, this&#xA;  device will accept Telnet connections on all VTYs. This is a&#xA;  vulnerable configuration.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-22T18:48:39.470" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39888" PostTypeId="1" AcceptedAnswerId="40003" CreationDate="2017-03-22T19:22:16.047" Score="2" ViewCount="198" Body="&lt;p&gt;Good evening!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Recently i've got some problem in configuring cisco router (IOS 12.x). There is an virtual interface for a vlan:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1.203&#xA; description Department XXX&#xA; encapsulation dot1Q 203&#xA; ip address 10.0.0.193 255.255.255.192&#xA; ip helper-address 192.168.0.3&#xA; ip access-group v203in in&#xA; no ip proxy-arp&#xA; ip flow ingress&#xA; ip flow egress&#xA; ip virtual-reassembly&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and there is an extended access-list:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended v203in&#xA; deny ip any any log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And all is brilliant. Computer connected to some trunc port via cisco switch can't get it's ip-address from dhcp server and can't access the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we will do some magic:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip access-list extended v203in&#xA;ip access-list extended v203in&#xA; permit udp any any eq 67&#xA; permit udp any any eq 68&#xA; deny ip any any log&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Oh, good, our computer have got it's IP-address... but... wait, what the hell?!&lt;br&gt;&#xA;(sorry for cyrillic output, it's trivial to understand):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\&amp;gt;ping ya.ru&#xA;Обмен пакетами с ya.ru [93.158.134.3] с 32 байтами данных:&#xA;Ответ от 93.158.134.3: число байт=32 время=2мс TTL=55     &#xA;Ответ от 93.158.134.3: число байт=32 время=2мс TTL=55    &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;tracert ya.ru&lt;/code&gt; says &lt;code&gt;reply from 10.0.0.193: host is unreachable&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can please any one explain to me this 'magic' or how the packets flows thru ACL?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Workstation's ip is 10.0.0.194/26, gateway is 10.0.0.193.&lt;/p&gt;&#xA;" OwnerUserId="35439" LastEditorUserId="35439" LastEditDate="2017-03-22T19:34:50.760" LastActivityDate="2017-03-28T09:50:53.460" Title="ACL on virtual interface get ignored" Tags="|cisco|router|acl|" AnswerCount="2" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="39889" PostTypeId="2" ParentId="39428" CreationDate="2017-03-22T22:39:53.557" Score="4" Body="&lt;p&gt;No.Because of the design of physical radio interface. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;As you can not connect to all the channels (more than one) at a time, same applies while capturing the WLAN traffic. In capture scenario you are merely turning your radio interface from access mode to monitor mode and hence it can monitor only on one channel at a time.&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;To do this, you need to build a specialized capture device. &lt;/p&gt;&#xA;&#xA;&lt;h2&gt;If i were you, i would try with Raspberry Pi's, setting up a linux distro which lets you install air-mon and try.&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;All the best!!!!&lt;/p&gt;&#xA;" OwnerUserId="35442" LastActivityDate="2017-03-22T22:39:53.557" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39891" PostTypeId="1" AcceptedAnswerId="39892" CreationDate="2017-03-22T23:20:34.083" Score="2" ViewCount="879" Body="&lt;p&gt;In &lt;a href=&quot;http://flylib.com/books/en/3.223.1.48/1/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Subnet Addressing of TCP/IP Illustrated, Vol. 1: The Protocols&lt;/a&gt;, there is description: &#xA;&lt;code&gt;This makes sense because class A and class B addresses have too many bits allocated for the host ID: 16384 - 2 and 65536 - 2, respectively.&lt;/code&gt;, I think this is the reason of &lt;code&gt;Subnet Addressing&lt;/code&gt;, but I don't know where to find the protocol, which describe the any two hosts can communicate each other only if they have the same &lt;code&gt;network id&lt;/code&gt; and &lt;code&gt;subnet id&lt;/code&gt;?    This is relative to &lt;code&gt;Ethernet&lt;/code&gt;? but I did not find the description about it. I know there must be something I missed! &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, &#xA;&lt;a href=&quot;https://i.stack.imgur.com/tvndU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tvndU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, the gateway has &lt;code&gt;1.4&lt;/code&gt;, aix has &lt;code&gt;1.92&lt;/code&gt;, solaris has &lt;code&gt;1.32&lt;/code&gt;, and above thick line, there is &lt;code&gt;1.0&lt;/code&gt;&#xA;I don't know whether I can summary my question, Why in &lt;code&gt;LAN&lt;/code&gt;, if the first  host want ping the second host, the first one is &lt;code&gt;140.252.1.4&lt;/code&gt;, then the second one must be &lt;code&gt;140.252.1.x&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For making my question clear, I make a test that I connected my mac and Fedora linux directly by cable, then:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under mac:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ~ » sudo ifconfig en0 192.168.90.104                          &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Under Fedora Linux:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[abelard@bogon ~] ifconfig eno1 192.168.90.197&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and execute the flollowing command under mac:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~ » ping 192.168.90.197                                          abelard@localhost&#xA;PING 192.168.90.197 (192.168.90.197): 56 data bytes&#xA;64 bytes from 192.168.90.197: icmp_seq=0 ttl=64 time=0.803 ms&#xA;64 bytes from 192.168.90.197: icmp_seq=1 ttl=64 time=0.602 ms&#xA;64 bytes from 192.168.90.197: icmp_seq=2 ttl=64 time=0.606 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But when I changed mac's ip into &lt;code&gt;192.168.91.104&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     ~ » sudo ifconfig en0 192.168.91.104                          &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;then&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;~ » ping 192.168.90.197                                       abelard@localhost&#xA;PING 192.168.90.197 (192.168.90.197): 56 data bytes&#xA;Request timeout for icmp_seq 0&#xA;Request timeout for icmp_seq 1&#xA;Request timeout for icmp_seq 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;why?&lt;/p&gt;&#xA;" OwnerUserId="35443" LastEditorUserId="35443" LastEditDate="2017-03-23T00:55:13.677" LastActivityDate="2017-03-23T12:48:17.120" Title="why the two hosts with same &quot;Subnet Address&quot; in LAN can be pinged?" Tags="|ipv4|tcp|protocol-theory|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39892" PostTypeId="2" ParentId="39891" CreationDate="2017-03-22T23:44:37.223" Score="1" Body="&lt;p&gt;An IPv4 address is really just a 32-bit binary number. The entire 32 bits are significant for a host address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conceptually an address is divided into two parts: the network part and the host part. The dividing line can be moved by the network mask that determines which bits of an address are for the network part. More recently, the network mask is being replaced with the mask length (address and mask length are a network prefix), and you can easily convert a mask length to a mask by setting the length number of most significant bits to one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example the mask length appears to be &lt;code&gt;24&lt;/code&gt;, but assuming you use &lt;code&gt;16&lt;/code&gt;, that would make the mask &lt;code&gt;255.255.0.0&lt;/code&gt;, meaning the usable network host addresses are from &lt;code&gt;.0.1&lt;/code&gt; to &lt;code&gt;.255.254&lt;/code&gt;. If the mask length was &lt;code&gt;17&lt;/code&gt;, then the last usable host number is &lt;code&gt;.127.254&lt;/code&gt;, while for &lt;code&gt;18&lt;/code&gt;, it would be &lt;code&gt;.63.254&lt;/code&gt;, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must convert the dotted-decimal notation, that is simply for human readability, into binary to perform your calculations. When you do that, everything becomes obvious. Convert back to dotted-decimal when you are done with your calculations. Remember, IPv4 addresses are really 32-bit binary numbers, and trying to do this in dotted-decimal will lead to confusion and errors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/8499&quot;&gt;this answer&lt;/a&gt; for how do do all your IPv4 calculations.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Assuming you have a router that knows how to get to all the other networks, you can actually ping any host address, even hosts not on your network. Traffic is delivered directly from host-to-host by layer-2, e.g. ethernet, on a LAN, but it needs layer-3, e.g. IPv4, to get from one LAN to another LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A host will mask both its address and a destination address to see if both are on the same LAN. If they are, it lets layer-2 deliver directly to the destination. If not, it has layer-2 send to it configured gateway. It is then up to the gateway to get the packets forwarded toward the destination.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2017-03-23T12:48:17.120" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="39893" PostTypeId="1" AcceptedAnswerId="39895" CreationDate="2017-03-23T04:02:28.797" Score="5" ViewCount="862" Body="&lt;p&gt;Considering UDP packets can get lost or arrive late to their target destination, does it make more sense to:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a TCP socket for important messages &amp;amp; events (ex: in a game where a player gets hit, attacks, dies, picks up item, saves the princess, etc.), &lt;br/&gt;&lt;br/&gt;OR...&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Should a &quot;reliability system&quot; of some sort be developed in your UDP packets structure to confirm the reception of those particular events?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It seems that, at a minimum, for the few bytes difference that TCP have over UDP (min of 64b vs 52b, so 12b apart, according to this answer: &lt;a href=&quot;https://stackoverflow.com/a/1846139/468206&quot;&gt;https://stackoverflow.com/a/1846139/468206&lt;/a&gt; ) that it would make more sense to let a TCP connection handle those events rather than re-invent the wheel in UDP. But maybe I'm missing the point?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does keeping a TCP connection alive in the long-term / the duration of an app / game (let's say a minimum of 15mins) apply some overhead that can't be easily reduced or controlled as well as a custom-made &quot;&lt;em&gt;reliable&lt;/em&gt;&quot; UDP implementation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would the bytes savings be more apparent in UDP because, for example, the &lt;em&gt;reliable-event&lt;/em&gt; message in question could have some unreliable data piggy-back to it? (unreliable data = as in, basically any piece of data that would normally omit sending the extra &quot;reliability&quot; bytes, using a &lt;strong&gt;Fire-and-Forget&lt;/strong&gt; approach)?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note: There's probably some aspects of TCP that I forgotten or didn't take in consideration, which is why I reach out to you lovely experienced network developers to help bring up and drive the point home! :)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="35445" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2017-03-23T16:19:58.937" Title="Does implementing some level of reliability in UDP packets defeat its purpose over using TCP?" Tags="|tcp|udp|layer4|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39894" PostTypeId="1" CreationDate="2017-03-23T05:54:00.603" Score="1" ViewCount="714" Body="&lt;p&gt;I'm trying to figure out scenarios in which one would use single homed, dual homed and double sided vpc and what benefits each topology would have? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can already see that dual homed vpc would have better redundancy and more bandwidth than single homed. What other advantages and disadvantages exist between each method?&lt;/p&gt;&#xA;" OwnerUserId="35447" LastEditorUserId="253" LastEditDate="2017-03-23T08:34:33.607" LastActivityDate="2017-03-23T19:57:02.263" Title="Single homed, dual homed and double sided vpc" Tags="|vpc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39895" PostTypeId="2" ParentId="39893" CreationDate="2017-03-23T06:16:31.583" Score="5" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;Considering UDP packets can get lost or arrive late to their target destination, does it make more sense to:&#xA;Use a TCP socket for important messages &amp;amp; events (ex: in a game where a player gets hit, attacks, dies, picks up item, saves the princess, etc.),&lt;/p&gt;&#xA;&lt;p&gt;OR...&#xA;Should a &amp;quot;reliability system&amp;quot; of some sort be developed in your UDP packets structure to confirm the reception of those particular events?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In short, neither.&lt;/p&gt;&#xA;&lt;p&gt;There are a lot of resources online discussing precisely this (real-time protocol design, especially in gaming), but to summarise, the model whereby one host acts as a &amp;quot;server&amp;quot; and keeps track of game state (all players, statistics and object state in a world), and all clients communicate with the server via UDP is the industry standard.&lt;/p&gt;&#xA;&lt;p&gt;UDP connections are used because you negate any round-trip latency associated with connection set-up or segment acknowledgement.&lt;/p&gt;&#xA;&lt;p&gt;Because you have a server tracking state, it doesn't need to care about the client receiving frames or not - the client and server just send deltas, which they then update from the last known state.&lt;/p&gt;&#xA;&lt;p&gt;This is of course an over-simplification of a very complex topic, but the gist is that there is no need for upper-layer protocols to be hacked over the top of UDP to make it &amp;quot;reliable&amp;quot; - the nature of real-time traffic, is that it is worthless if not delivered within a very short window.&lt;/p&gt;&#xA;&lt;p&gt;I highly recommend the following article discussing experiments and observations by John Carmack when writing the Quake 3 networking code:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;http://trac.bookofhook.com/bookofhook/trac.cgi/wiki/Quake3Networking&quot; rel=&quot;noreferrer&quot;&gt;http://trac.bookofhook.com/bookofhook/trac.cgi/wiki/Quake3Networking&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-03-23T06:16:31.583" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39896" PostTypeId="1" CreationDate="2017-03-23T07:54:06.847" Score="2" ViewCount="491" Body="&lt;p&gt;We have a proplem with server-to-server latency. How can I determine the reason for it?  These servers are connected to different Cisco switches. Althought the reason for this problem might not be network related. How can I check that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;topology is: VMWare virtual server 1 -&gt; ESXi -&gt; IBM BladeCenter Switch -&gt; Cisco Nexus9k -&gt; another IBM BladeCenter Switch -&gt; ESXi -&gt; VMWare virtual server 2&lt;/p&gt;&#xA;" OwnerUserId="35451" LastEditorUserId="35451" LastEditDate="2017-03-23T08:58:20.680" LastActivityDate="2017-03-27T19:10:35.573" Title="How can I determinte the reason of server-to-server latency in my network?" Tags="|cisco|latency|vmware|" AnswerCount="3" CommentCount="6" ClosedDate="2018-07-26T02:35:37.150" ContentLicense="CC BY-SA 3.0" />
  <row Id="39897" PostTypeId="2" ParentId="39753" CreationDate="2017-03-23T08:35:26.410" Score="0" Body="&lt;p&gt;After some researches I have found an answer. It is not only for the delay-bandwidth product as suggested in the comment but for some reasons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA; &lt;li&gt; The throughput of a sender could be written as Throughput=CongestionWindow/RoundTripTime, so if you have a bigger RTT you need bigger CW to reach the same throughput;&lt;/li&gt;&#xA; &lt;li&gt; The capacity of the channel could be written as Capacity=Delay*Bandwidth, so you could retrieve the bandwidth available in this way Bandwidth=Capacity/Delay (and Delay could be the half of the RTT or equal the RTT considering that for each packet the ACK is needed);&lt;/li&gt;&#xA; &lt;li&gt; The CongestionWindow could be written as function of the RTT in that way:&lt;br&gt;&#xA;    - CongestionWindow = 2 ^ (t/RTT) in slow start phase, where t is the time;&lt;br&gt;&#xA;     - CongestionWindow = ss + (t - tss)/RTT in congestion avoidance phase, where ss is the slow start threshold, t is the time, tss is the time when you reach the slow start threshold and ss is the value of the slow start threshold.&lt;br&gt;&#xA;Avoiding to make formulas more complicate because of the possible error that can occur that change the CongestionWindow and th slow start threshold,&#xA;it could be easly seen that the CongestionWindow strongly depends on the RTT, and since it appears on the denominator both in slow start phase and in congestion avoidance phase, bigger the RTT is, more disadvantaged the sender is.&#xA; &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="35262" LastActivityDate="2017-03-23T08:35:26.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39898" PostTypeId="2" ParentId="39753" CreationDate="2017-03-23T09:02:59.663" Score="1" Body="&lt;p&gt;Basically, TCP's Congestion Window (CW) grows as new ACK packets arrive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then, if a connection C1 has a large RTT it means that &lt;em&gt;fewer&lt;/em&gt; ACKs will arrive in a certain time period compared to another connection C2 with a smaller RTT, due to the following facts:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the destination will send an acknowledgement when the packet arrives, so in C2 this happens &lt;strong&gt;earlier&lt;/strong&gt; than in C1&lt;/li&gt;&#xA;&lt;li&gt;the C2 acknowledgement itself will take a shorter time period to reach the source&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="35455" LastActivityDate="2017-03-23T09:02:59.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39899" PostTypeId="2" ParentId="39879" CreationDate="2017-03-23T12:05:10.547" Score="0" Body="&lt;p&gt;I checked this in our local lab with default configurations on the&#xA;switch. I saw that 83.4% of I/O pool was used with default config on the&#xA;switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I added some running config  and I observed 94.5% used. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;SO this is how it works and I guess nothing to worry about.&lt;/p&gt;&#xA;" OwnerUserId="35450" LastActivityDate="2017-03-23T12:05:10.547" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39900" PostTypeId="1" CreationDate="2017-03-23T12:23:41.740" Score="3" ViewCount="221" Body="&lt;p&gt;So we are looking into implementing IP mobility in our network.&lt;/p&gt;&#xA;&lt;p&gt;The use case would be for a laptop to be able to roam between wired and wireless mode of operation while retaining all TCP/UDP based connections (ongoing browser downloads, conferencing sessions, SIP/RTM softphone connections, RDP connections)&lt;/p&gt;&#xA;&lt;h3&gt;Current state&lt;/h3&gt;&#xA;&lt;p&gt;Due to a generous /16 IPv4 network assignment from the olden days, we were hardly pressed to implement IPv6. So we didn't.&#xA;The basic outline of the environment:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Windows servers in public IPv4 address space, with a permanently assigned IPv4 address&lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/unified-communications/unified-communications-manager-callmanager/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco UCM&lt;/a&gt; - based phone network&lt;/li&gt;&#xA;&lt;li&gt;Windows clients in public IPv4 address space, with a permanently assigned IPv4 address&lt;/li&gt;&#xA;&lt;li&gt;countless wireless clients are getting a dynamically assigned address from a private IPv4 address space&lt;/li&gt;&#xA;&lt;li&gt;the private address space router is NATting outbound connections to a pool of public IPv4 addresses&lt;/li&gt;&#xA;&lt;li&gt;Clients and servers are mainly Windows, basically everything that is still covered under Microsoft's extended support policy (Server 2008-2016, Windows 7 - Windows 10 1607)&lt;/li&gt;&#xA;&lt;li&gt;all hosts are members of an AD domain.&lt;/li&gt;&#xA;&lt;li&gt;Cisco gear on the network side&lt;/li&gt;&#xA;&lt;li&gt;MAC-/&lt;a href=&quot;http://www.cisco.com/en/US/tech/tk389/tk814/tk839/tsd_technology_support_sub-protocol_home.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;VMPS&lt;/a&gt;-based VLAN assignment on the wired network&lt;/li&gt;&#xA;&lt;li&gt;no 802.1x auth for wired hosts&lt;/li&gt;&#xA;&lt;li&gt;Radius-backed 802.1x (EAP-TTLS-PAP) for wireless connections&lt;/li&gt;&#xA;&lt;li&gt;Communications between clients and servers are restricted by the Cisco routers' ACLs as well as by server-side Windows Firewall rules&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The ancillary conditions fro the use case are that&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;users should not be required to start/connect a separate VPN client&lt;/li&gt;&#xA;&lt;li&gt;we likely do not have the resources to implement &lt;a href=&quot;https://en.wikipedia.org/wiki/Proxy_Mobile_IPv6&quot; rel=&quot;nofollow noreferrer&quot;&gt;Proxy Mobile IPv6&lt;/a&gt; as we would need IPv6 routing and address management working first, which we do not have and are not going to get in the short term&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;h3&gt;Options considered&lt;/h3&gt;&#xA;&lt;p&gt;We have a Cisco ASA - based VPN in place, so remote and wireless users are capable of connecting into our network. But since we restrict access to our systems on a per-address basis, using this to create an overlay network for all of our users has severe management implications:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;we would permanently need to assign an additional IPv4 address from the public VPN address pool to each employee, which is going to deplete our address pools&lt;/li&gt;&#xA;&lt;li&gt;the router ACLs and host firewall rules are often configured with exemptions for ranges and subnets in the wired network which reflect our organization's structure (departments having own subnets). If we simply assign addresses to employees from a contiguous, non-structured pool, this method of access control will be rendered unusable.&lt;/li&gt;&#xA;&lt;li&gt;currently, a VPN-connected client is routing all traffic through the ASA gateways. This is not going to scale all that well if we let all users connect to the gateways at all times to support the seamless roaming scenario. Even if only connections to our internal servers would be routed through the tunnel, we are looking into more bandwidth on the tunneling endpoints, than we can possibly handle.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Windows obviously comes with things like Teredo and 6to4 tunneling along with opportunistic encryption for connections over IPSEC, which we might consider using in lieu of the current network-address based access control. But as far as I can see, no current Windows stack is implementing &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6275&quot; rel=&quot;nofollow noreferrer&quot;&gt;Mobile IPv6&lt;/a&gt; and I am having a hard time finding working implementations altogether.&lt;/p&gt;&#xA;&lt;p&gt;I have been made aware of &lt;a href=&quot;http://lisp.cisco.com/lisp_over.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;LISP&lt;/a&gt; but even after reading the overview publications on this topic I am having difficulties embracing the extent of infrastructure changes needed for it to work for us. Also, as most publications are mentioning &amp;quot;datacenter mobility&amp;quot;, I cannot yet see if it would fit our use case of roaming &lt;em&gt;clients&lt;/em&gt; as well.&lt;/p&gt;&#xA;&lt;p&gt;So what options would remain?&lt;/p&gt;&#xA;" OwnerUserId="795" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-11-02T14:59:25.030" Title="Mobile IP in a large-ish IPv4 network" Tags="|ip|network-access|mobile|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="39902" PostTypeId="2" ParentId="39855" CreationDate="2017-03-23T14:52:21.593" Score="0" Body="&lt;p&gt;Yes, this is essentially what we do as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;guest device &gt; Cisco AP &gt; Cisco WLC &gt; core router &gt; guest FW &gt; cable Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best to setup the 172 VLAN on the core switch, without an interface VLAN, and then trunk that traffic over to your 2960 and then setup an interface or sub-interface on your router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would suggest that you use a separate Internet service for your guest traffic. We use to use our primary Internet circuit back in the day for guest Internet, but once you get blacklisted for email spamming or illegal content, you'll wish you did.&lt;/p&gt;&#xA;" OwnerUserId="35463" LastActivityDate="2017-03-23T14:52:21.593" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39903" PostTypeId="2" ParentId="39819" CreationDate="2017-03-23T16:16:47.157" Score="3" Body="&lt;p&gt;IS-41 is a protocol used to manage many aspects of mobile (as in cellular phone) networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When someone places a call (or sends a text message or IP packet) to a subscriber of a mobile network, the mobile network needs to find out where the subscriber's phone (usually referred to as User Equipment, or UE) is located in order to deliver the call to the subscriber. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One way to do this would be to transmit a paging message to the called UE from every cell in the network. This approach would not be feasible for an even moderately large network, because all of the radio resources (airtime) in the network would rapidly be consumed by these paging messages, and there would be no airtime left in which to transmit actual phone calls / messages / data packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, cellular networks using IS-41 organize groups of geographically adjacent cells into Location Areas (LAs). When a subscriber first powers on his or her UE, the UE scans for a cell belonging to the subscriber's network operator and decodes certain informational messages from that cell, including the cell's Location Area Code (LAC). The UE then performs a procedure to connect to the network which includes, among other things, informing the network of the LAC of its serving cell. Servers in the network store the subscriber UE's LAC for later use. (Search for HLR and VLR if you want more information on these servers / network elements.) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As the subscriber moves out of the area of one cell into another, the UE checks the new cell's LAC against the previous cell's LAC. If the old and new serving cells have the same LAC, then the phone takes no further action. If, however, the LAC of the new cell is different than the LAC of the old cell, the UE will perform the location registration process again to inform the network of its new serving cell's new LAC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The purpose of this is so that, when the network needs to deliver a call (or other type of message) to a UE, it only has to transmit a paging message addressed to the UE on every cell in the UE's serving LAC instead of every cell in the entire network. This drastically cuts down on the amount of paging traffic and allows for the creation of large cellular networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a tradeoff regarding the number of cells in an LA. With more cells in an LA, each paging message consumes more radio resources because it has to be transmitted from more cells, but fewer radio resources are consumed by UE location update procedures, because UEs move between LAs less frequently. On the other hand, with fewer cells in an LA, each paging message consumes fewer radio resources because it has to be transmitted from fewer cells, but more radio resources are consumed by UE location update procedures, because UEs move between LAs more frequently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Mobile network operators monitor paging and location update traffic and optimize the size and &quot;shape&quot; of LAs based on the observed traffic patterns.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further (very specific) details on the IS-41 location registration and call delivery procedures can be found in the book Design and Analysis of Wireless Networks by Yi Pan and Yang Xiao, a relevant excerpt from which can be found at: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://books.google.com/books?id=voJf4sF4UDEC&amp;amp;lpg=PA20&amp;amp;ots=8hbN5VIT-H&amp;amp;dq=is-41%20location%20registration&amp;amp;pg=PA21#v=onepage&amp;amp;q=is-41%20location%20registration&amp;amp;f=false&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://books.google.com/books?id=voJf4sF4UDEC&amp;amp;lpg=PA20&amp;amp;ots=8hbN5VIT-H&amp;amp;dq=is-41%20location%20registration&amp;amp;pg=PA21#v=onepage&amp;amp;q=is-41%20location%20registration&amp;amp;f=false&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be noted that IS-41 is only used in certain cellular networks; another protocol called Mobile Application Part (MAP) is used in GSM and UMTS networks.&lt;/p&gt;&#xA;" OwnerUserId="13516" LastEditorUserId="13516" LastEditDate="2017-03-23T23:48:20.090" LastActivityDate="2017-03-23T23:48:20.090" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39904" PostTypeId="2" ParentId="39893" CreationDate="2017-03-23T16:19:58.937" Score="6" Body="&lt;p&gt;Size overhead is negligable. Sending out acks doesn't block delivery of data to the application. Connection setup time is negligable for something like a game that keeps a session open for a long time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The real problem with TCP is head of line blocking. If a single packet is lost on a TCP connection then the loss must be detected,the packet resent and the resent packet must be delivered to the application before any data coming after the lost packet can be delivered to the application.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is possible to implement some level of reliability without head of line blocking and that is what I would expect any sensible developer of a realtime game to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Games where realtime isn't so critical can get away with just using TCP.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-23T16:19:58.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39905" PostTypeId="1" AcceptedAnswerId="39919" CreationDate="2017-03-23T16:34:09.700" Score="1" ViewCount="1471" Body="&lt;p&gt;The attached network diagram is what I am trying to accomplish.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I run BGP on an IP Unnumbered interface on R1, R2, R3?  These are Cisco ASR1001's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The goal is to prevent R4 and R5 from communicating while minimizing IP Address usage and configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C2Bd0.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C2Bd0.png&quot; alt=&quot;Network Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="412" LastActivityDate="2017-03-24T03:36:12.183" Title="Can I run BGP on an IP Unnumbered interface?" Tags="|cisco|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39907" PostTypeId="2" ParentId="39855" CreationDate="2017-03-23T16:37:58.217" Score="0" Body="&lt;p&gt;The Ethernet frames on VLAN 172 should get tunneled to the WLC 2504, where the security/routing is configured.  So, you must enable your network (switches) to allow VLAN 172 to reach the WLC 2504.  The interface between the WLC 2504 and the switch must be a trunk interface.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-03-23T16:37:58.217" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39908" PostTypeId="2" ParentId="36419" CreationDate="2017-03-23T16:58:06.110" Score="1" Body="&lt;p&gt;I was a Sprint cellular subscriber for parts of the 2000s decade and I am 99% sure they used Mobile IP on their CDMA 1xRTT/1xEV-DO network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I recall Sprint cell phones of the era coming with the IP address(es) of a &quot;home agent&quot; configured in their settings. I never saw the need to (or even experimented with) change my HA settings but I do recall people discussing some Sprint HAs being &quot;faster&quot; (less oversubscribed?) than others, as well as suggesting that selecting an HA near your physical location would result in less latency between the handset/UE and the Internet (presumably at the cost of a one-time change of IP address), as in the following thread from 2006:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.evdoforums.com/thread2001.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.evdoforums.com/thread2001.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="13516" LastActivityDate="2017-03-23T16:58:06.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39912" PostTypeId="2" ParentId="39894" CreationDate="2017-03-23T19:57:02.263" Score="2" Body="&lt;p&gt;You kind of answered it yourself.  The advantage for each is an increased level of redundancy.  The advantage of vPC is that is provides link redundancy as well as chassis redundancy.  A dual-homed connection would be used for end devices that support port-channeling.  For double-sided you of course need the downstream devices to also support vPC, such as a core layer of Nexus 9k connecting to a pair of Nexus 5k.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2017-03-23T19:57:02.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39914" PostTypeId="1" AcceptedAnswerId="39915" CreationDate="2017-03-23T23:08:50.633" Score="1" ViewCount="3788" Body="&lt;p&gt;I am currently using an old desktop with a dual port PCI NIC as a pfSense router. Interface em0 is assigned to the WAN interface, and em1 is assigned to the LAN interface, as well as 3 VLAN interfaces as shown below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/cMzu8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cMzu8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All interfaces shown go through a single cable to a trunked port on my switch. From there, ports are assigned VLANs according to what net the device is supposed to be on. The current LAN network is unused, and is waiting to assign IP addresses to VLAN 1 on my switch (which is not used). Since the LAN interface is not used, I would like to disable it, or remove it all together, and have just VLAN traffic between the router and switch. However, whenever I disable or remove the LAN interface in pfSense, everything on the network loses connectivity and I need to restore a recent config in the pfSense console. I can't seem to figure out why this affects the VLAN traffic that is also supposed to be going through the same port. I have not posted my switch config since I have no reason to believe the issue is on the switch side, but I can post it if necessary. Ideally I would like to remove the LAN interface and still have my VLAN networks be able to communicate. Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="30228" LastActivityDate="2017-03-24T00:22:27.187" Title="Issues trunking VLANs from pfSense to Cisco switch" Tags="|vlan|interface|pfsense|pfsense-2|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39915" PostTypeId="2" ParentId="39914" CreationDate="2017-03-24T00:22:27.187" Score="3" Body="&lt;p&gt;This has to do with how FreeBSD (the source OS for pfSense) handles interfaces.  What you are labeling as &quot;LAN&quot; is the &quot;VLAN parent interface&quot; and when you perform a shut or &quot;if down&quot; on that interface (or uncheck &quot;Enable interface&quot; and &quot;Apply Settings&quot;,) it does just that.  What you are not anticipating is shutting down the parent interface shuts down its child interfaces.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's actually fine--you just need to not interact with that interface at all and things will work the way you expect them to. The challenge is removing the config you don't want and still winding up with your VLAN interfaces up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can remove the interface completely (this will shut down your VLANs naturally) but you can also leave it with no IP assignment and that will allow you to monitor bandwidth over that physical (parent) interface--even though it has no IP.  If you remove the interface, you can not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how do you get the VLAN's back up?  With the configuration changed, you can reboot the device.  You can also do it from the command line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the big takeaway is that you should expect any &quot;up&quot; or &quot;down&quot; you apply to that parent interface will take the whole group down.&lt;/p&gt;&#xA;" OwnerUserId="35275" LastActivityDate="2017-03-24T00:22:27.187" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39916" PostTypeId="2" ParentId="39888" CreationDate="2017-03-24T02:26:17.483" Score="1" Body="&lt;p&gt;Your ACL is only allowing DHCP (ports 67 and 68). ICMP, which is what ping uses, doesn't operate at layer 4 therefore it doesn't have a port number. Traceroute uses a port in 30,000's range (I forget the exact number). The ACL statement you have is blocking all ports except port 67 and 68. Hope this helps.&lt;/p&gt;&#xA;" OwnerUserId="35478" LastActivityDate="2017-03-24T02:26:17.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39919" PostTypeId="2" ParentId="39905" CreationDate="2017-03-24T03:36:12.183" Score="2" Body="&lt;p&gt;Your issue isn't BGP.  If you can get IP connectivity, you can get BGP running.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Instead, your issue is that IP unnumbered is for use on &lt;em&gt;point-to-point&lt;/em&gt; interfaces, &lt;strong&gt;not&lt;/strong&gt; shared segments.  If you wanted to set aside specific VLAN tags for the transit links between R[1-3] and R[4-5] you could use unnumbered, and would generally base it on a loopback (not necessary, but probably the most typical).  Put another way - VLAN A would include [R1,R4], VLAN B would be [R1,R5], VLAN C would be [R2,R4], VLAN D [R2,R5], etc.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That said, if you set aside different VLAN's for each link then you wouldn't have to worry about any kind of conversation between R4 and R5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to run on a shared segment then you'll need some kind of addressing to disambiguate what traffic is bound to where.  If you want to keep clients from talking to one another on this shared segment then you'll need some mechanism at L2 - likely PVLAN, but I suppose there are other (likely more labor-intensive) ways to accomplish this.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what it's worth the problem you're describing is pretty common in a lot of IX's: tons of routers from different organizations on a shared IP segment that should only be allowed to talk to one another according to a very specific (if frequently changing) set of rules.  Based on your design and the requirement to keep R4 and R5 independent I would look in this direction if I were you.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-03-24T03:36:12.183" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39920" PostTypeId="2" ParentId="39896" CreationDate="2017-03-24T03:43:45.660" Score="3" Body="&lt;p&gt;First off I'd want to identify exactly &lt;em&gt;how&lt;/em&gt; the latency in question is being identified.  Is it a particular application running slowly or a wide variety of traffic that can be specifically observed with either long transit times or loss?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is something specific to one type of application traffic and it isn't the actual application (a very common theme, unfortunately) then I'd want to understand the nature of the traffic that was slow and try to see if I could isolate it.  Is it high-bandwidth / large packet that's causing the issue?  Lots of small packets?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, some basic isolation might shed some light - can you send the same type of traffic experiencing high latency between two hosts on the same vSwitch (i.e. exclude the physical switch)?  Between hosts on two different hypervisors on the same blade switch (exclude the Nexus and its connections)?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other common causes should also be ruled out - taking errors on any physical interfaces (in either direction), weird STP/L2 configuration problems (incredibly common on blade switch configurations, unfortunately), tell-tale error messages, counters for packet drops on anything in line, etc.   &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-03-24T03:43:45.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39923" PostTypeId="1" CreationDate="2017-03-24T07:20:11.353" Score="0" ViewCount="3041" Body="&lt;p&gt;For a mobile network what is the GSM location registration process?&lt;/p&gt;&#xA;" OwnerUserId="35361" LastActivityDate="2017-03-24T14:21:15.453" Title="What is the GSM location registration process?" Tags="|wireless|mobile|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39924" PostTypeId="2" ParentId="39923" CreationDate="2017-03-24T07:45:48.653" Score="2" Body="&lt;p&gt;I hope you are referring to the GSM location update procedure during the first attach or when MS is visiting a new location. This normally happens when the mobile is switched on and attempts to register towards the network via BSC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In GSM terminology this process is  know as &quot;attach&quot;. Depending upon when and where you switch on the network the Location update will be sent to VLR/HLR.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is the first time the MS is reporting the location to a VLR (Visitor location register)then the same information will be forwarded to HLR (Home Location Register) as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Location Update procedure can be triggered from both MS and BSS side.From the BSC point of view,VLR handles the Location update for authentication process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A location update will contain both TMSI and LAI.It is nothing but your Location Area identity and a Unique value (TMSI) which is derived from your IMSI.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next time, please raise your questions with more clarity rather than just asking with a one liner.So that we can provide better answers to the point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will give you a clear picture:GSM call flow:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/rEvcX.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rEvcX.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-03-24T07:45:48.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39929" PostTypeId="2" ParentId="39923" CreationDate="2017-03-24T14:21:15.453" Score="0" Body="&lt;p&gt;Yes, in GSM/MAP, this is called the location update procedure, not the location registration procedure as in IS-41. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Renold's answer provides a good answer as to the details of your question. For a general overview of why the location update procedure is needed and how it is managed in mobile networks, refer to my answer to your earlier question about the &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/39819/what-is-the-is-41-location-registration-process&quot;&gt;IS-41 location registration procedure&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="13516" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:10.960" LastActivityDate="2017-03-24T14:21:15.453" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39931" PostTypeId="2" ParentId="37492" CreationDate="2017-03-24T15:01:59.353" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does the hardware discard it or does some layer in the stack discard it?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Traditionally the NIC would only concern itself with Ethernet level stuff. So it would verify the &quot;frame check sequence&quot; and check the destination MAC address, but higher level checksums would be left to the OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However modern NICs often have the option to at least partilly handle higher levels of the protocol stack to reduce load on the main CPU.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-24T15:01:59.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39932" PostTypeId="1" CreationDate="2017-03-24T15:19:56.963" Score="1" ViewCount="999" Body="&lt;p&gt;I have a Cisco SG-200-26 switch connected to a port on a Meraki switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Meraki switch shows a list of all devices detected on that switch port (the Cisco switch and all of the devices connected to the Cisco switch).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have VLANs configured on a Meraki L3 switch upstream from the Meraki switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Meraki port is configured to be a &lt;strong&gt;&lt;em&gt;Trunk port using native VLAN 10; allowed VLANs: all&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Cisco switch is configured to have a static IP of 10.128.10.12, which is in VLAN 10, and a default gateway of 10.128.10.1. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I accomplish all of the following things: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Configure the port on the Meraki switch to be &lt;strong&gt;&lt;em&gt;Trunk port using native VLAN 1&lt;/em&gt;&lt;/strong&gt;, and have the Cisco switch still work with a static IP in VLAN 10.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;When I set the port on the Meraki switch to be &lt;strong&gt;&lt;em&gt;Trunk port using native VLAN 1&lt;/em&gt;&lt;/strong&gt;, the Cisco switch loses connectivity because it's static IP is set to be 10.128.10.12. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only way I am able to get in to the Cisco web interface is to set the Meraki switch port back to &lt;strong&gt;&lt;em&gt;Trunk port using native VLAN 10&lt;/em&gt;&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have the Meraki switch port to be &lt;strong&gt;&lt;em&gt;Trunk port using native VLAN 1&lt;/em&gt;&lt;/strong&gt;, because all of the other Meraki switches I have are configured that way.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Configure a port on the Cisco switch to be an access port on VLAN 20. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Basically, what I need to be able to do is connect a device to a port on the Cisco switch, and have it be put into VLAN 20, so that in the Meraki interface, it shows both the switch (in VLAN 10), and the device (in VLAN 20). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I followed the instructions on &lt;a href=&quot;http://sbkb.cisco.com/CiscoSB/GetArticle.aspx?docid=67844b99e2da4a7f88db0c588197487d_Creating_VLANs_on_Cisco_Managed_Switches.xml&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt; to configure the port to be Tagged for VLAN 20, but it doesn't work - the device does not have network connectivity, and does not show up in the Meraki switch port client list.&lt;/p&gt;&#xA;" OwnerUserId="35492" LastEditorUserId="35492" LastEditDate="2017-03-24T15:30:42.667" LastActivityDate="2017-04-23T15:51:08.250" Title="Configure VLAN on Cisco SG-200 switch connected to a Meraki switch/network" Tags="|cisco|vlan|switchport|meraki|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39935" PostTypeId="2" ParentId="39932" CreationDate="2017-03-24T15:45:47.997" Score="1" Body="&lt;p&gt;Here are the general steps on the Cisco switch:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Define VLANs 10 and 20 on the switch&lt;/li&gt;&#xA;&lt;li&gt;Configure the port connected to the Meraki as a Trunk port, with&#xA;VLAN 1 as the native VLAN (should be the default).  Allow all VLANs&#xA;on that port.&lt;/li&gt;&#xA;&lt;li&gt;Configure the port connected to the device as an access port in VLAN&#xA;20&lt;/li&gt;&#xA;&lt;li&gt;Change the management VLAN on the switch to VLAN 10&lt;/li&gt;&#xA;&lt;li&gt;For all devices downstream from the Cisco switch, decide which VLAN&#xA;you want them to use, and configure their ports as access ports in&#xA;the chosen VLAN.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-24T15:45:47.997" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39936" PostTypeId="1" AcceptedAnswerId="40102" CreationDate="2017-03-24T17:01:40.503" Score="0" ViewCount="578" Body="&lt;p&gt;I am currently setting up PacketFence and trying to make it work with the Cisco 3750 switch. I have followed the instructions from this &lt;a href=&quot;https://packetfence.org/doc/PacketFence_Network_Devices_Configuration_Guide.html#_cisco&quot; rel=&quot;nofollow noreferrer&quot;&gt;PacketFence network configuration&lt;/a&gt; (except using a different VLAN in the end).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I connect a device to the switchport that was set up, it asks me for a 802.1X username and password and I have tried both for PacketFence and local user from the switch and it doesn't work. This is my first time setting something like this up, so please excuse my lack of knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PacketFence logs are not outputting anything, but command &lt;strong&gt;show aaa servers&lt;/strong&gt; produces following output on the switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RADIUS: id 1, priority 1, host 147.32.232.117, auth-port 1812, acct-port 1813&#xA;     State: current DEAD, duration 2110s, previous duration 182s&#xA;     Dead: total time 2110s, count 1&#xA;     Quarantined: No&#xA;     Authen: request 196, timeouts 196, failover 0, retransmission 147&#xA;             Response: accept 0, reject 0, challenge 0&#xA;             Response: unexpected 0, server error 0, incorrect 0, time 0ms&#xA;             Transaction: success 0, failure 49&#xA;             Throttled: transaction 0, timeout 0, failure 0&#xA;     Author: request 0, timeouts 0, failover 0, retransmission 0&#xA;             Response: accept 0, reject 0, challenge 0&#xA;             Response: unexpected 0, server error 0, incorrect 0, time 0ms&#xA;             Transaction: success 0, failure 0&#xA;             Throttled: transaction 0, timeout 0, failure 0&#xA;     Account: request 0, timeouts 0, failover 0, retransmission 0&#xA;             Request: start 0, interim 0, stop 0&#xA;             Response: start 0, interim 0, stop 0&#xA;             Response: unexpected 0, server error 0, incorrect 0, time 0ms&#xA;             Transaction: success 0, failure 0&#xA;             Throttled: transaction 0, timeout 0, failure 0&#xA;     Elapsed time since counters last cleared: 38m&#xA;     Estimated Outstanding Access Transactions: 0&#xA;     Estimated Outstanding Accounting Transactions: 0&#xA;     Estimated Throttled Access Transactions: 0&#xA;     Estimated Throttled Accounting Transactions: 0&#xA;     Maximum Throttled Transactions: access 0, accounting 0&#xA;     Requests per minute past 24 hours:&#xA;             high - 0 hours, 18 minutes ago: 22&#xA;             low  - 0 hours, 38 minutes ago: 0&#xA;             average: 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nothing else that I have tried said anything more useful. Does somebody know what is going on ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much for your help&lt;/p&gt;&#xA;" OwnerUserId="35496" LastActivityDate="2017-03-31T17:12:17.407" Title="Cisco 3750 AAA configuration troubleshooting" Tags="|cisco|aaa|" AnswerCount="1" CommentCount="10" ClosedDate="2018-07-26T02:32:05.053" ContentLicense="CC BY-SA 3.0" />
  <row Id="39937" PostTypeId="1" AcceptedAnswerId="39938" CreationDate="2017-03-24T19:18:06.567" Score="2" ViewCount="5427" Body="&lt;p&gt;I have multiple sites, all connected centrally to a corporate office over VPN.  I can see the IP addresses of the remote hosts but the MAC gets stripped.  Is there a way to configure the network so that the source IP and MAC get passed?&lt;/p&gt;&#xA;" OwnerUserId="35497" LastActivityDate="2017-03-26T05:32:40.007" Title="Source MAC address across VPN" Tags="|vpn|mac-address|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39938" PostTypeId="2" ParentId="39937" CreationDate="2017-03-24T19:26:03.557" Score="3" Body="&lt;p&gt;MAC addresses are only significant or seen on the layer-2 LAN where the host connects. Not all layer-2 protocols even use MAC addresses, and some use 48-bit MAC addresses, and some use the newer 64-bit MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers operate at layer-3, so they strip the layer-2 frames off the layer-3 packets so they can build new layer-2 frames for the new interface out which the packets will be forwarded.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-24T19:26:03.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39941" PostTypeId="2" ParentId="39140" CreationDate="2017-03-25T00:48:52.583" Score="1" Body="&lt;p&gt;Although your network topology is not quite clear to me (consider including diagrams in questions) there are a few concepts to keep in mind here. The first of which is a broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YHL8t.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YHL8t.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A broadcast domain is a logical division of a computer network, in&#xA;  which all nodes can reach each other by broadcast at the data link&#xA;  layer. A broadcast domain can be within the same LAN segment or it can&#xA;  be bridged to other LAN segments.&#xA;  - &lt;a href=&quot;https://en.wikipedia.org/wiki/Broadcast_domain&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This essentially means that all broadcasts including DHCP are not going to make it any further than your router. If a unicast or multicast packet destined for another network reaches your router, it will be forwarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another concept to consider is layer 3 switching. It is unknown to me if this applies to your network, but it is plausible that you can have a switch that does same network or inter-VLAN routing to take  load off of your router and minimize packet travel. However, a switch also has a &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/13012/how-does-a-switch-learn-a-switch-table&quot;&gt;Source Address Table (SAT)&lt;/a&gt; used to forward traffic without flooding all switch ports with the traffic. The initial DHCP request will reach the entire broadcast domain, but then further traffic of the DHCP process will be between the server and client exclusively, and will not be seen by other devices connected to the switch or router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this answers your question. If you provide an updated explanation of your topology or a network diagram I may be able to better answer your question.&lt;/p&gt;&#xA;" OwnerUserId="30228" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-03-25T00:48:52.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39942" PostTypeId="2" ParentId="39937" CreationDate="2017-03-25T01:28:12.147" Score="0" Body="&lt;p&gt;I have been studying this very concept the past couple weeks and have conducted a few labs consisting of 4+ Cisco routers and 3 Cisco switches. When a client on your network is trying to send a packet to a client at another site, it will send an ARP request to the router since the destination is on a different network (assuming ARP tables arent populated). It will then forward the packet to the router (it's default gateway). The router will have a route set (or default gateway) and it will forward the packet through that route. At this point the L2 frame will be stripped, and the router will re-encapsulate the packet, but the source MAC address will be set to that of the routers WAN MAC address, but it will of course preserve the origin IP so responses can find their way back to the correct client. It will then forward the packet to the next router designated in the routing table. This process will continue until the destination client is reached.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unless you want to deviate from the standard convention of internet routing protocols and re-program all your networking hardware and clients, I don't think you will be able to get around this.&lt;/p&gt;&#xA;" OwnerUserId="30228" LastEditorUserId="30228" LastEditDate="2017-03-25T02:06:59.113" LastActivityDate="2017-03-25T02:06:59.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39944" PostTypeId="1" AcceptedAnswerId="39962" CreationDate="2017-03-25T12:11:09.607" Score="1" ViewCount="739" Body="&lt;p&gt;I have a doubt. IP addresses of the PCs connected to this network do not seem to change every time they connect to the network. I should tidy up the IP addresses, respecting the physical layout of the PC. The firewall is a fortigate 90d, while the firmware version is v5.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I post a picture, to understand how the network is set:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/a6yV1.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/a6yV1.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;--UPDATE--&lt;/strong&gt;&#xA;&lt;strong&gt;I tried to reserve an IP address, but the PC network card fails to obtain the ip:&lt;/strong&gt;&#xA;&lt;a href=&quot;https://i.stack.imgur.com/KZy8H.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/KZy8H.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34076" LastEditorUserId="34076" LastEditDate="2017-03-27T07:06:51.323" LastActivityDate="2017-03-27T07:06:51.323" Title="tidy up the IP addresses on fortigate 90d" Tags="|ip|fortigate|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39945" PostTypeId="2" ParentId="39944" CreationDate="2017-03-25T14:57:06.133" Score="0" Body="&lt;p&gt;Please explain what do you mean by saying &quot;tidy up&quot;, and &quot;respecting the physical layout of the PC&quot;?&#xA;And it's not a bad thing to have your pc get same ip add eventhou it's getting it from dynamic dhcp pool. It's just mean that in dhcp binding table of the fortinet your pc mac address is associated with that offered ip add. You can make dhcp changing more frequently on pc if you decrease dhcp lease time on fortinet dhcp pool configuration. &#xA;I hope this helps &lt;/p&gt;&#xA;" OwnerUserId="33973" LastActivityDate="2017-03-25T14:57:06.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39947" PostTypeId="1" CreationDate="2017-03-25T15:22:43.313" Score="1" ViewCount="174" Body="&lt;p&gt;Need some expert advice..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So some time ago I got water damage, my PoE switch was completely flooded. &#xA;Since then, I noticed that I could not rotate my cameras anymore via Blue Iris (IP Cam soft), and I could not login anymore. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I had two Huissun (low budget cameras), so I though they were just fried. I bought another PoE camera (SD49225T-HN). On my test stand, the camera worked perfectly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today, I mounted the camera to the wall outside, and it has the same problem as my Huissun. Can't rotate and can't login, but I get visual via Blue Iris.&#xA;Could this really be the cable that is screwed or something else? I am clueless, and if it's the cable I'm really screwed..&lt;/p&gt;&#xA;" OwnerUserId="35508" LastEditorUserId="8499" LastEditDate="2018-03-21T00:23:41.463" LastActivityDate="2018-03-21T00:23:41.463" Title="PoE cable defective?" Tags="|layer1|cable|cabling|power-over-ethernet|utp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39948" PostTypeId="1" CreationDate="2017-03-25T15:23:17.793" Score="1" ViewCount="9918" Body="&lt;p&gt;Here are the steps I configured so far:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;General configuration steps&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following steps provide an overview of configuring and testing the&#xA;  hardware used in this example. For best results in this configuration,&#xA;  follow the procedures in the order given. Also, note that if you&#xA;  perform any additional actions between procedures, your configuration&#xA;  may have different results.&lt;/p&gt;&#xA;  &#xA;  &lt;ol&gt;&#xA;  &lt;li&gt;Configure the FortiGate unit&lt;br&gt;&#xA;  • Configure the external interface&lt;br&gt;&#xA;  • Add two VLAN subinterfaces to the internal network interface&lt;br&gt;&#xA;  • Add firewall addresses and address ranges for the internal and external networks&lt;br&gt;&#xA;  • Add security policies to allow: (this is technically for inter-vlan routing)&lt;br&gt;&#xA;  • the VLAN networks to access each other&lt;br&gt;&#xA;  • the VLAN networks to access the external network.&lt;/li&gt;&#xA;  &lt;li&gt;Configure the VLAN switch&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Also created the trunk on the switch that connects to the LAN interface of the Fortinet, made a switchport access and assigned switchport access VLAN to it. Still not working as designed? &lt;/p&gt;&#xA;" OwnerUserId="33973" LastEditorUserId="8499" LastEditDate="2017-03-25T17:43:40.993" LastActivityDate="2018-06-02T10:58:23.553" Title="Fortinet 200D: how to implement VLAN, inter-VLAN routing, and DHCP relay?" Tags="|routing|vlan|dhcp|fortigate|fortinet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39950" PostTypeId="1" CreationDate="2017-03-25T16:16:16.643" Score="1" ViewCount="3440" Body="&lt;p&gt;Fortinet 200d has 8 internal (LAN) interfaces, but there is no way in the GUI to modify specific interface. For example: &lt;code&gt;int1&lt;/code&gt; of &lt;code&gt;int2&lt;/code&gt; on &lt;code&gt;int3&lt;/code&gt;. They are all under one internal LAN interface. So, how would I apply different VLANs for different interfaces and route between them?&lt;/p&gt;&#xA;" OwnerUserId="33973" LastEditorUserId="8499" LastEditDate="2017-03-25T17:46:25.823" LastActivityDate="2021-01-05T09:08:47.797" Title="How to create separate network on different interfaces on Fortinet 200d and route bettwen them?" Tags="|routing|vlan|fortigate|fortinet|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39952" PostTypeId="2" ParentId="39896" CreationDate="2017-03-25T17:16:27.157" Score="2" Body="&lt;p&gt;&lt;em&gt;Latency issues&lt;/em&gt; might not be specific enough.  You can certainly get round trip (millisecond) response times using basic &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_Control_Message_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;ICMP tools&lt;/a&gt; like ping and traceroute.  However, poor &lt;em&gt;application performance / response times&lt;/em&gt; could be rooted in higher layer issues.  If the network looks good via ICMP, try looking at your application logs and/or debugging tools for a clue.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-03-25T17:16:27.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39953" PostTypeId="2" ParentId="39947" CreationDate="2017-03-25T17:36:59.910" Score="1" Body="&lt;p&gt;If your cabling got wet in the flood, there is a strong possibility that it is ruined. Indoor UTP cabling is &lt;em&gt;not&lt;/em&gt; waterproof, and it can easily be damaged by moisture. Water changes the dielectric properties of the cabling, and modern networking uses very high frequencies that need strict tolerances.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other than that, your applications, consumer-grade devices, and host configurations are all off-topic here.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-25T17:36:59.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39956" PostTypeId="2" ParentId="39873" CreationDate="2017-03-26T04:51:01.033" Score="3" Body="&lt;p&gt;The controller function (not necessarily a dedicated device by the way) is essential to how any wireless network bigger than what you have at home works.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;It allows you to configure large sets of APs efficiently from a single point&lt;/li&gt;&#xA;&lt;li&gt;It manages the APs' radio layer such that the APs work together as a whole without interfering with each other&lt;/li&gt;&#xA;&lt;li&gt;It may provide a termination point for traffic which needs to be tunneled up to a central point and filtered through a firewall (typically guest traffic for example)&lt;/li&gt;&#xA;&lt;li&gt;By centralizing the &quot;intelligence&quot; of the wireless network it theoretically allows for simpler and cheaper APs (hence the &quot;Lightweight&quot; par of LWAP), though honestly I'm not sure to what extent this is still true.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In the Cisco world all that gets handled by the WLC, usually as a set of physical appliances, but there are other manufacturers which split this up, such as Aerohive, where the config server may be in the cloud, the radio management part is handled in peer-to-peer fashion by the APs themselves and you can get a sort of vpn gateway for tunneling traffic back to a central point.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2017-03-26T04:51:01.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39957" PostTypeId="2" ParentId="39937" CreationDate="2017-03-26T05:32:40.007" Score="0" Body="&lt;p&gt;You need to use Layer 2 VPN for this to work. Then you can get virtually same LAN across VPN endpoints.&lt;/p&gt;&#xA;" OwnerUserId="35348" LastActivityDate="2017-03-26T05:32:40.007" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39961" PostTypeId="1" AcceptedAnswerId="39965" CreationDate="2017-03-26T12:54:50.443" Score="1" ViewCount="325" Body="&lt;p&gt;Basically if the frame size of a packet is more than the MTU size configured in the router (which is an intermediate hop) the packet is dropped. Since IP does not have any ARQ mechanism, is there a method to know at source that packets are being dropped? What is the thing to do in this scenario. Does the network operator ensure manually this does not happen?&lt;/p&gt;&#xA;" OwnerUserId="30909" LastActivityDate="2017-03-26T14:12:50.887" Title="What happens when an intermediate hop router encounters a packet whose MTU size is more than what it can handle?" Tags="|router|ip|mtu|packet-loss|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="39962" PostTypeId="2" ParentId="39944" CreationDate="2017-03-26T13:11:41.427" Score="2" Body="&lt;p&gt;@Nroot: your explanation is not quite right. The FGT doesn't reserve an address for a specific MAC address unless manually configured to do so. Rather, the client requests the same address as previously obtained.&#xA;And shortening the lease interval will just create more traffic, not more addresses - for the same reason.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to control the address a host uses either assign static addresses or set up reserved DHCP addresses on the FGT.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2017-03-26T13:11:41.427" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39963" PostTypeId="2" ParentId="39950" CreationDate="2017-03-26T13:22:10.057" Score="1" Body="&lt;p&gt;You can split the internal switch into individual ports. The way depends on your version of FortiOS. In v5.4 you can for instance pull a single port from the switch via the GUI (network 》interfaces 》lan). Below v5.4 set &#xA;'Config system global, set internall-interfacemode interface'&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that you can only change a port if it is not referenced/used anywhere else - policy, DHCP server, addtess etc. You need to delete all references beforehand. That's why this usually is done right at the beginning of a configuration.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2017-03-26T13:22:10.057" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="39964" PostTypeId="1" CreationDate="2017-03-26T13:48:29.923" Score="1" ViewCount="79" Body="&lt;p&gt;I would like to know more information about this details for a firewall:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;50,000 Max. connections; 650Mbps Overall Throughput; 246,900 Packets PS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I understood is that the firewall can accept 50k requests from one client and 246,900 packets per second. Can someone can clarify this? The same thing with 650Mbps. What I understood is the firewall can handle 650Mbp data size, which is the requests sent from the clients.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone correct me if I am wrong?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What if the client managed to overload the firewall by sending more than 650Mbp. Is the firewall going to shutdown?&lt;/p&gt;&#xA;" OwnerUserId="35521" LastActivityDate="2017-03-26T15:40:48.793" Title="Firewall Details Explanation" Tags="|firewall|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39965" PostTypeId="2" ParentId="39961" CreationDate="2017-03-26T14:12:50.887" Score="4" Body="&lt;p&gt;If the MTU of the outgoing interface is smaller than the packet, the router will fragment the packet &lt;em&gt;unless&lt;/em&gt; the DF flag is set. In that case the router will drop the packet and send an ICMP packet too big message back to the sender. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-03-26T14:12:50.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39966" PostTypeId="1" AcceptedAnswerId="39970" CreationDate="2017-03-26T15:34:58.433" Score="3" ViewCount="157" Body="&lt;ol&gt;&#xA;&lt;li&gt;If a PC wants to send to another PC through a switch and does not&#xA;know its MAC address, that means all PCs on network will receive it&#xA;and see it!!&lt;/li&gt;&#xA;&lt;li&gt;If we change the NIC for a PC in the network, how will the other PCs&#xA;know?&lt;/li&gt;&#xA;&lt;li&gt;In a flood MAC address table attack, why does the PC still sends&#xA;frames, although it doesn't know the MAC address for a destination?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I cannot understand please explain it!! &lt;/p&gt;&#xA;" OwnerUserId="35524" LastEditorUserId="8499" LastEditDate="2017-03-26T15:54:20.643" LastActivityDate="2017-03-26T16:08:05.897" Title="Switches - help me to understand please" Tags="|switch|switching|arp|mac|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39967" PostTypeId="2" ParentId="39964" CreationDate="2017-03-26T15:40:48.793" Score="2" Body="&lt;p&gt;A stateful firewall has to keep some metadata about a connection (more cortectly: a session) like source and destination address,  state, NAT port etc. In a table in RAM. This always is limited by hardware. The figure is meant for all concurrent sessions or session attempts globally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Throughput in bits per second the sum of all traffic on all ports in and out. Some vendors count inbound traffic twice as it has to leave the fw again, some don't. The more honest figure is packets per second which is limited by hatdware, clock speed and latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When packet size gets smaller throughput in Mbps drops but pps stay constant. HTTP can use big packet with 1500 bytes but often uses much smaller one at eg 64 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Overload can be handled in a begnin way by just dropping traffic or more dramatically by having the fw lock up or reboot. This depends on the architecture and vendor.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2017-03-26T15:40:48.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39970" PostTypeId="2" ParentId="39966" CreationDate="2017-03-26T16:08:05.897" Score="3" Body="&lt;blockquote&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If a PC wants to send to another PC through a switch and does not&#xA;know its MAC address, that means all PCs on network will receive it&#xA;and see it!!&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Hosts on a LAN with a protocol that uses MAC addresses, e.g. ethernet, maintain an ARP table. A host on such a broadcast domain may eventually learn all the MAC addresses of the other hosts on the LAN in its ARP table, but the entries in the ARP table probably do time out after a while.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;If we change the NIC for a PC in the network, how will the other PCs&#xA;know?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;This is a problem that is discussed at the end of &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc826&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 826, An Ethernet Address Resolution Protocol -- or -- Converting Network Protocol Addresses to 48.bit Ethernet Address for Transmission on Ethernet Hardware&lt;/em&gt;&lt;/a&gt; in the section title, &amp;quot;&lt;em&gt;Related issue&lt;/em&gt;&amp;quot; (see below). Normally, a MAC address in an ARP table will eventually time out, or a host with a new NIC can perform a gratuitous ARP to inform all the other hosts of its new MAC address.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;ol start=&quot;3&quot;&gt;&#xA;&lt;li&gt;In a flood MAC address table attack, why does the PC still sends&#xA;frames, although it doesn't know the MAC address for a destination?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;A host cannot send a frame unless it knows, or thinks it knows, the MAC address of the destination. It will use ARP to get a MAC address for the destination. Your question is more about the switch, and if a switch doesn't know the interface to which it should send frames for a MAC address, it will flood the frames to all other switch interfaces, and the host with that MAC address will get the frames destined to it.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Related issue:&lt;/p&gt;&#xA;&lt;p&gt;It may be desirable to have table aging and/or timeouts.  The&#xA;implementation of these is outside the scope of this protocol. Here is&#xA;a more detailed description (thanks to MOON@SCRC@MIT-MC).&lt;/p&gt;&#xA;&lt;p&gt;If a host moves, any connections initiated by that host will work,&#xA;assuming its own address resolution table is cleared when it moves.&#xA;However, connections initiated to it by other hosts will have no&#xA;particular reason to know to discard their old address.  However,&#xA;48.bit Ethernet addresses are supposed to be unique and fixed for all time, so they shouldn't change.  A host could &amp;quot;move&amp;quot; if a host name&#xA;(and address in some other protocol) were reassigned to a different&#xA;physical piece of hardware.  Also, as we know from experience, there&#xA;is always the danger of incorrect routing information accidentally&#xA;getting transmitted through hardware or software error; it should not&#xA;be allowed to persist forever.  Perhaps failure to initiate a&#xA;connection should inform the Address Resolution module to delete the&#xA;information on the basis that the host is not reachable, possibly&#xA;because it is down or the old translation is no longer valid.  Or&#xA;perhaps receiving of a packet from a host should reset a timeout in&#xA;the address resolution entry used for transmitting packets to that&#xA;host; if no packets are received from a host for a suitable length of&#xA;time, the address resolution entry is forgotten.  This may cause extra&#xA;overhead to scan the table for each incoming packet.  Perhaps a hash&#xA;or index can make this faster.&lt;/p&gt;&#xA;&lt;p&gt;The suggested algorithm for receiving address resolution packets tries&#xA;to lessen the time it takes for recovery if a host does move.  Recall&#xA;that if the &amp;lt;protocol type, sender protocol address&amp;gt; is already in the&#xA;translation table, then the sender hardware address supersedes the&#xA;existing entry.  Therefore, on a perfect Ethernet where a broadcast&#xA;REQUEST reaches all stations on the cable, each station will be get&#xA;the new hardware address.&lt;/p&gt;&#xA;&lt;p&gt;Another alternative is to have a daemon perform the timeouts. After a&#xA;suitable time, the daemon considers removing an entry. It first sends&#xA;(with a small number of retransmissions if needed) an address&#xA;resolution packet with opcode REQUEST directly to the Ethernet address&#xA;in the table.  If a REPLY is not seen in a short amount of time, the&#xA;entry is deleted.  The request is sent directly so as not to bother&#xA;every station on the Ethernet.  Just forgetting entries will likely&#xA;cause useful information to be forgotten, which must be regained.&lt;/p&gt;&#xA;&lt;p&gt;Since hosts don't transmit information about anyone other than&#xA;themselves, rebooting a host will cause its address mapping table to&#xA;be up to date.  Bad information can't persist forever by being passed&#xA;around from machine to machine; the only bad information that can&#xA;exist is in a machine that doesn't know that some other machine has&#xA;changed its 48.bit Ethernet address.  Perhaps manually resetting (or&#xA;clearing) the address mapping table will suffice.&lt;/p&gt;&#xA;&lt;p&gt;This issue clearly needs more thought if it is believed to be&#xA;important.  It is caused by any address resolution-like protocol.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-03-26T16:08:05.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39972" PostTypeId="1" AcceptedAnswerId="39973" CreationDate="2017-03-26T18:30:54.597" Score="1" ViewCount="436" Body="&lt;h1&gt;Introduction&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I am currently trying to build up a networking layer for Unity from scratch. Currently I am testing the communication via UDP using Node.js for the server and the client. However I guess the language of the implementation will not matter for what I am asking for.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Current approach&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;The current approach using Node.js for the server and the client is pretty basic. I simply send a packet from a client to my server while the client and the server are not in the same local network. Both are behind a router and therefore also behind a NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The server then sends back an answer to the IP and port received within the UDP packet that was sent from the client.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Problem&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;I am curious about the security on the client side regarding to ports being opened on the client machines and routers. So far I assumed that I don't need to do anything to secure the client from attackers or anything else that can do something with the ports that are used by my application. The following assumption shows why I think that I don't need to do anything to secure the clients.&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;Assumption&lt;/h1&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Server is setting up callbacks.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Server starts listening to a specific port which is also forwarded to the servers machine within the router.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Server now will call a callback when a UDP message was received. The server then will send a UDP message to the address and the port of the client obtained by the message received.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Client is setting up callbacks.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Client starts listening to port 0 which for Node.js's &lt;code&gt;dgram&lt;/code&gt; means:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For UDP sockets, causes the dgram.Socket to listen for datagram messages on a named port and optional address. If port is not specified or is 0, the operating system will attempt to bind to a random port. - &lt;a href=&quot;https://nodejs.org/api/dgram.html#dgram_socket_bind_port_address_callback&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://nodejs.org/api/dgram.html#dgram_socket_bind_port_address_callback&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;So the operating system now knows that packets sent to this port belong to my application.&lt;/li&gt;&#xA;&lt;li&gt;Nobody can use this for something malicious.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Client, which knows the servers address and port, starts the process of sending a UDP message to the server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Clients router receives the UDP message. NAT creates a random port (used on the public side) and maps it to the clients (local) address and port.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;So the router now knows that packets sent to the public address and the newly generated port belong to the local address and port.&lt;/li&gt;&#xA;&lt;li&gt;Nobody can use this for something malicious.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Clients router sends UDP message containing the public address and the NAT generated port to the server.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The worst thing that can happen is that a man-in-the-middle attacker can read the data the client is sending. Due to it is only gamedata like positions and so on that is sent this is not a big problem while developing the basics.&lt;/li&gt;&#xA;&lt;li&gt;Nobody can use this for something malicious.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Server receives the message and calls the callback described in 3. So the server sends to the public address and the NAT generated port of the client.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The worst thing that can happen is that a man-in-the-middle attacker can read the data the server is sending. Due to it is only gamedata like positions and so on that is sent this is not a big problem while developing the basics.&lt;/li&gt;&#xA;&lt;li&gt;Nobody can use this for something malicious.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Same as 7. with the servers router and the servers local address and port.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Same as 8. with the servers router.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Client receives the UDP message of the server and calls a callback which processes the message contents.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Due to the local port of the client is bound to my application only nobody can use this for something malicious due to I simply ignore the contents if they are not from the real server.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;h1&gt;Question&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;So is my assumption correct and I really don't need to secure the client from any attacks that will harm the clients in any way?&lt;/p&gt;&#xA;" OwnerUserId="35526" LastActivityDate="2017-03-26T18:40:33.043" Title="Client security using UDP" Tags="|nat|security|udp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39973" PostTypeId="2" ParentId="39972" CreationDate="2017-03-26T18:40:33.043" Score="0" Body="&lt;p&gt;If a malicious host somehow knows the IP and UDP addresses being used in the conversation, it could spoof the NAT and client into thinking that they are receiving data from the server, when it is really bad data from the malicious host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How that could damage the host depends on the process in the host that receives the bad data, and what the process does with the bad data. Unfortunately, applications, programming, and protocols above OSI layer-4 are all off-topic here. To learn more about what could happen in your specific circumstance, you could try to ask on &lt;a href=&quot;https://stackoverflow.com/&quot;&gt;Stack Overflow&lt;/a&gt;, where there are many network-savvy programmers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-26T18:40:33.043" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="39976" PostTypeId="1" AcceptedAnswerId="39977" CreationDate="2017-03-27T05:14:41.220" Score="2" ViewCount="297" Body="&lt;p&gt;I've read that many networks use ingress/egress filtering to eliminate the number of spoofed UDP packets sent and received by their network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that network provides have been much more diligent in restricting the amount of spoofed UDP packets sent and received by their networks, is it possible to send a UDP packet with a spoofed header that is drastically different than it's actual IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Besides blocking spoofed packets from leaving their networks, in which other ways can network providers ensure that they are not passing along or sending spoofed UDP packets?&lt;/p&gt;&#xA;" OwnerUserId="35540" LastActivityDate="2017-03-27T06:26:34.110" Title="Is it possible to successfully send a spoofed UDP header with a completely unrelated source IP?" Tags="|udp|network|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39977" PostTypeId="2" ParentId="39976" CreationDate="2017-03-27T06:26:34.110" Score="3" Body="&lt;p&gt;It's hard to address the degree of diligence of providers in blocking spoofed packets as there's a huge degree of variability out there.  It is safe to say that it's still very possible to successfully send such packets from lots of places as the continued prevalence of certain types of DoS attacks attests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice the most common mechanism of blocking spoofed traffic is the use of unicast RPF checking.  This basically causes a given interface to drop packets sourced from an address that isn't reachable by that interface (validating the packet based on the return route, in other words).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;uRPF is a good mechanism in general but tends to lose effectiveness the further from the edge the point of enforcement moves.  Applied against an individual customer advertising a couple of /24's?  Great.  Applied against a peering connection with a few thousand routes?  Could be ok, but can start to falter in bigger/more complex environments. Against a transit link with 600K routes?  Almost useless.  The other problem - paradoxically - is that it's a somewhat expensive feature to implement in hardware and tends not to be as commonly found on cheaper edge ports.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-03-27T06:26:34.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39979" PostTypeId="1" CreationDate="2017-03-27T07:33:29.737" Score="1" ViewCount="10457" Body="&lt;p&gt;How to find the total number of subnets available for one subnet mask?. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, take this subnet mask:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;255.255.255.224&lt;/code&gt; and IP address as &lt;code&gt;192.168.5.139&lt;/code&gt;, book shows that there are &lt;strong&gt;6&lt;/strong&gt; subnet for the given subnet mask, ranging from &lt;code&gt;192.168.5.32&lt;/code&gt; to &lt;code&gt;192.168.5.192&lt;/code&gt; , how &lt;strong&gt;6&lt;/strong&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried to solve it like this &lt;em&gt;2^3 = 8&lt;/em&gt; and &lt;em&gt;8-2 = 6&lt;/em&gt; But I thought that we should subtract &lt;em&gt;2&lt;/em&gt; only when we find number of hosts (because of network ID and Broadcast).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why do we subtract 2 for subnets?&lt;/p&gt;&#xA;" OwnerUserId="35543" LastEditorUserId="16654" LastEditDate="2017-03-27T09:17:44.080" LastActivityDate="2017-03-27T09:30:33.493" Title="How to find number of subnets?" Tags="|subnet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="39981" PostTypeId="2" ParentId="39979" CreationDate="2017-03-27T08:38:04.817" Score="3" Body="&lt;p&gt;If a network address is subnetted, the &lt;em&gt;first subnet&lt;/em&gt; obtained after subnetting the network address is called &lt;strong&gt;subnet zero&lt;/strong&gt; and the last subnet obtained is called the &lt;strong&gt;all-ones&lt;/strong&gt; subnet.&lt;/p&gt;&#xA;&lt;p&gt;In your example:&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Network&lt;/strong&gt;: 192.168.5.0&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Subnet Mask&lt;/strong&gt;: 255.255.255.224&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Subnets&lt;/strong&gt;:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;Subnet            Broadcast&#xA;192.168.5.0      192.168.0.31   &amp;lt;-- subnet zero&#xA; &#xA;192.168.5.32     192.168.0.63&#xA;&#xA;192.168.5.64     192.168.0.95&#xA;&#xA;192.168.5.96     192.168.0.127&#xA;&#xA;192.168.5.128    192.168.0.159&#xA;&#xA;192.168.5.160    192.168.0.191&#xA;&#xA;192.168.5.192    192.168.0.223&#xA;&#xA;192.168.5.224    192.168.0.255    &amp;lt;-- all ones&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Traditionally, it was strongly recommended that &lt;strong&gt;subnet zero&lt;/strong&gt; and the &lt;strong&gt;all-ones&lt;/strong&gt; subnet not be used for addressing.&lt;/p&gt;&#xA;&lt;p&gt;According to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc950&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 950&lt;/a&gt; from 1985:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&amp;quot;It is useful to preserve and extend the interpretation of these&#xA;special (network and broadcast) addresses in subnetted networks. This&#xA;means the values of all zeros and all ones in the subnet field should&#xA;not be assigned to actual (physical) subnets.&amp;quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Remember that this is a 1985 recommendation. More than 30 years have passed from then.&lt;/p&gt;&#xA;&lt;p&gt;Using &lt;strong&gt;subnet zero&lt;/strong&gt; for addressing is discouraged because of the confusion inherent in having a &lt;em&gt;network&lt;/em&gt; &lt;code&gt;(192.168.5.0)&lt;/code&gt; and a &lt;em&gt;subnet&lt;/em&gt; &lt;code&gt;(192.169.5.0)&lt;/code&gt; with indistinguishable addresses, and the &lt;strong&gt;all-ones&lt;/strong&gt; subnet for the confusion inherent in having a network and a subnet with identical broadcast addresses &lt;code&gt;(192.168.5.255)&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;This recommendation was overruled in 1995 by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1878&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC-1878&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1812&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC-1812&lt;/a&gt;. So, nowadays we can use all the subnets and the devices' hardware /software support it.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-03-27T09:30:33.493" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="39984" PostTypeId="2" ParentId="22425" CreationDate="2017-03-27T12:25:25.663" Score="1" Body="&lt;p&gt;--as-path-lookups is based on RADB IRR data, which may very well be incorrect/missing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;traceroute/as_lookups.c in traceroute-2.1.0 Dmitry Butskoy&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/*&#xA;    Copyright (c)  2006, 2007           Dmitry Butskoy&#xA;                                        &amp;lt;buc@citadel.stu.neva.ru&amp;gt;&#xA;    License:  GPL v2 or any later&#xA;&#xA;    See COPYING for the status of this software.&#xA;*/&#xA;&#xA;#define DEF_RADB_SERVER         &quot;whois.radb.net&quot;&#xA;#define DEF_RADB_SERVICE        &quot;nicname&quot;&#xA;...&#xA;if (!ra_addr.sa.sa_family) {&#xA;    const char *server, *service;&#xA;    struct addrinfo *res;&#xA;    int ret;&#xA;&#xA;    server = getenv (&quot;RA_SERVER&quot;);&#xA;    if (!server)  server = DEF_RADB_SERVER;&#xA;&#xA;    service = getenv (&quot;RA_SERVICE&quot;);&#xA;    if (!service)  service = DEF_RADB_SERVICE;&#xA;&#xA;&#xA;    ret = getaddrinfo (server, service, NULL, &amp;amp;res);&#xA;    if (ret) {&#xA;        fprintf (stderr, &quot;%s/%s: %s\n&quot;, server, service,&#xA;                                            gai_strerror(ret));&#xA;        exit (2);&#xA;    }   &#xA;&#xA;    memcpy (&amp;amp;ra_addr, res-&amp;gt;ai_addr, res-&amp;gt;ai_addrlen);&#xA;&#xA;    freeaddrinfo (res);&#xA;}&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;example of incorrect information&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  * 203.208.171.202 (203.208.171.202) [AS19905]  180.570 ms 203.208.153.254 (203.208.153.254) [AS19905]  187.246 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;based on RADB IRR&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ whois -h whois.radb.net 203.208.171.202&#xA;route:      203.208.171.0/24&#xA;descr:      AC_SINGTEL&#xA;origin:     AS19905&#xA;mnt-by:     MAINT-AS7786&#xA;changed:    wan.engineering@neustar.biz 20150730  #02:53:10Z&#xA;source:     RADB&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://irrexplorer.nlnog.net/search/203.208.171.202&quot; rel=&quot;nofollow noreferrer&quot;&gt;IRR/BGP comparison on IRR Explorer&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;203.208.128.0/17 BGP from AS7473, RADB AS7473&lt;/li&gt;&#xA;&lt;li&gt;203.208.171.0/24 not seen in BGP, Level3 AS19905, RADB AS7473 the &lt;/li&gt;&#xA;&lt;li&gt;traceroute hop 203.208.171.202 is actually in AS7473&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Moral of the story, there is no way to reliable get a route's origin AS in any static database (IRR, registry etc). And the origin may very well be different depending on your vantage point in DFZ.&lt;/p&gt;&#xA;" OwnerUserId="34" LastActivityDate="2017-03-27T12:25:25.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="39991" PostTypeId="2" ParentId="39896" CreationDate="2017-03-27T19:10:35.573" Score="1" Body="&lt;p&gt;A packet capture at the 9k should do the trick. You can see when each packet comes in and heads out, which will tell you the latency. I would suggest one on the interface where &quot;Virtual Server 1&quot; comes in and one on the interface where &quot;Virtual Server 2&quot; comes in. This will give you a good idea of how long the packets spend in your switch. Odds are the answer will be &quot;essentially zero time.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A capture at each of the IBM BladeCenter switches would be good as well, the interfaces leading to your VMWare cluster. Same idea, compare one to the other. It should at least tell you where the delay isn't. ie, if all the packets on the left-side switch enter and leave within 2-3ms of each other, that server's not the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, and this is where I'd start, a capture at each server may be your best and simplest option (others will disgree, but I find captures from Cisco switches to be laborious). If your server receives a packet and doesn't respond for several seconds, guess what? You've found your problem!&lt;/p&gt;&#xA;" OwnerUserId="19140" LastActivityDate="2017-03-27T19:10:35.573" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40003" PostTypeId="2" ParentId="39888" CreationDate="2017-03-28T09:50:53.460" Score="1" Body="&lt;p&gt;That was a bug in iOS 12.4. Other device with 15.x doesn't have that problems.&lt;/p&gt;&#xA;" OwnerUserId="35439" LastActivityDate="2017-03-28T09:50:53.460" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40005" PostTypeId="1" CreationDate="2017-03-28T12:00:08.600" Score="0" ViewCount="136" Body="&lt;p&gt;Sorry in advance if the title is wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a (kubernetes) cluster of computers and I would like to have one static IP that all machines share when making requests to external services like databases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A real world example of this is Segment.io - they ask you to whitelist two ip addresses that all of their servers make requests through. This afford them the ability to spin up as many servers as they need but never ask their clients to whitelist more ip addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My two questions are: what is this called and what technology does it use? I know that load balancing is for incoming traffic, so what this is called when it is regarding outgoing traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second question is how can I achieve this on a cloud platform like Google Cloud, AWS, or Azure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Networking is not my strength so I apologize if I described any of this incorrectly.&lt;/p&gt;&#xA;" OwnerUserId="35579" LastActivityDate="2017-05-28T09:23:17.183" Title="Route all computers through one external IP" Tags="|routing|" AnswerCount="1" CommentCount="1" ClosedDate="2017-08-17T05:26:18.807" ContentLicense="CC BY-SA 3.0" />
  <row Id="40006" PostTypeId="2" ParentId="40005" CreationDate="2017-03-28T12:46:21.353" Score="1" Body="&lt;p&gt;This sounds like a standard NAT solution that you would have at your home internet connection. The relevant &lt;a href=&quot;https://en.wikipedia.org/wiki/Network_address_translation#One-to-many_NAT&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt; page&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At home you would use a router to translate your private IP (RFC 1918) addresses of your home PC/laptop to the public IP assigned by your provider. This can also be done with a private IP address, so translating from private to private.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: to clear some things up: your home is not the only place to use NAT. A lot of companies use NAT to provide internet access, a lot of loadbalancers also use NAT.&lt;/p&gt;&#xA;" OwnerUserId="2914" LastEditorUserId="2914" LastEditDate="2017-03-29T08:15:11.783" LastActivityDate="2017-03-29T08:15:11.783" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40008" PostTypeId="2" ParentId="35313" CreationDate="2017-03-28T14:01:54.910" Score="0" Body="&lt;p&gt;So sorry for posting it too late but as it turns out, the NAS wasn't able to make a connection to the RADIUS due to the firewall and hence all the requests were being rejected. We fixed the iptables rules on RADIUS and the same dynamic profile is working now.&lt;/p&gt;&#xA;" OwnerUserId="30266" LastActivityDate="2017-03-28T14:01:54.910" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40009" PostTypeId="1" AcceptedAnswerId="40467" CreationDate="2017-03-28T14:14:04.723" Score="1" ViewCount="806" Body="&lt;p&gt;We have a VoD server that's directly connected to Juniper MX104 BNG. Juniper MX104 is also acting as a BRAS. Right now if any user accesses that VoD server, all the incoming and outgoing traffic is added to the user's accounting details, however, for this particular VoD server we don't want the data to be added in user's monthly allowed quota. &#xA;Please advice how can we get this mechanism.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you.&lt;/p&gt;&#xA;" OwnerUserId="30266" LastActivityDate="2017-04-16T07:02:45.293" Title="No RADIUS Accounting for Particular Server" Tags="|firewall|juniper|pppoe|radius|accounting|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40018" PostTypeId="1" AcceptedAnswerId="40020" CreationDate="2017-03-28T18:52:38.987" Score="1" ViewCount="1264" Body="&lt;p&gt;I am having some trouble identifying a switch model via the CLI, and also understanding the differences between a few different models. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The models in question are :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;3850-48P-S&lt;/li&gt;&#xA;&lt;li&gt;3850-48P-L&lt;/li&gt;&#xA;&lt;li&gt;3850-48P-E&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Any 'show version' or 'show hardware' command I use only shows 3850-48P and not the suffixes S, L or E that Cisco has on their website. Where in the world can I compare these models to see the difference? Additionally, how can I find what model my switch is via the CLI?&lt;/p&gt;&#xA;" OwnerUserId="15501" LastEditorUserId="8499" LastEditDate="2017-03-28T19:17:10.200" LastActivityDate="2017-03-28T19:17:10.200" Title="Cisco 3850 Model Naming Convention?" Tags="|cisco|switch|hardware|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40020" PostTypeId="2" ParentId="40018" CreationDate="2017-03-28T19:08:06.500" Score="1" Body="&lt;p&gt;It is reporting your hardware. The letter to which you refer is the license, which can be updated.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;L is for the LAN Base license&lt;/li&gt;&#xA;&lt;li&gt;S is for the IP Base License&lt;/li&gt;&#xA;&lt;li&gt;E is for the IP Services license&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The letter is really only significant when you order the device because you can change the license, but the hardware doesn't change.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-28T19:15:38.943" LastActivityDate="2017-03-28T19:15:38.943" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40021" PostTypeId="2" ParentId="2134" CreationDate="2017-03-28T19:59:37.560" Score="2" Body="&lt;p&gt;I know this thread is old but for sake of completeness:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the high cpu occurs randomly and you are not able to determine the process causing this we can create the script below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With this script we are going to capture the process extensive when a process raises more than the normal or expected threshold, this should not disrupt any traffic but a MW is still recommended. However i see you have narrowed it to be RPD.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp {&#xA;    health-monitor {&#xA;        interval 30;&#xA;        rising-threshold 60;&#xA;        falling-threshold 50;&#xA;    }&#xA;}&#xA;&#xA;event-options {&#xA;    policy MONITOR-CPU {&#xA;        events snmpd_health_mon_thresh_cross;&#xA;        attributes-match {&#xA;            snmpd_health_mon_thresh_cross.event-name matches &quot;Health Monitor.+CPU.+rising&quot;;&#xA;        }&#xA;        then {&#xA;            execute-commands {&#xA;                commands {&#xA;                    &quot;show system processes extensive&quot;;&#xA;                }&#xA;                output-filename cpu-processes;&#xA;                destination local-flash;&#xA;                output-format text;&#xA;            }&#xA;        }                               &#xA;    }&#xA;    destinations {&#xA;        local-flash {&#xA;            archive-sites {&#xA;                /var/tmp;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;DISPLAY SET OUTPUT&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set snmp health-monitor interval 30&#xA;set snmp health-monitor rising-threshold 60&#xA;set snmp health-monitor falling-threshold 50&#xA;set event-options policy MONITOR-CPU events snmpd_health_mon_thresh_cross&#xA;set event-options policy MONITOR-CPU attributes-match snmpd_health_mon_thresh_cross.event-name matches &quot;Health Monitor.+CPU.+rising&quot;&#xA;set event-options policy MONITOR-CPU then execute-commands commands &quot;show system processes extensive&quot;&#xA;set event-options policy MONITOR-CPU then execute-commands output-filename cpu-processes&#xA;set event-options policy MONITOR-CPU then execute-commands destination local-flash&#xA;set event-options policy MONITOR-CPU then execute-commands output-format text&#xA;set event-options destinations local-flash archive-sites /var/tmp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also have you checked if any ddos messages have been reported? You could run the following commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ddos-protection protocols statistics brief&#xA;show ddos-protection statistics&#xA;show ddos-protection version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then depending what you see it can be narrowed down for example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ddos-protection protocols ttl statistics&#xA;show ddos-protection protocols ttl violations&#xA;show ddos-protection protocols ttl flow-detection detail  */*this cm needs prior config*/*&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Juniper also has a collection list for this type of issues under KB22637&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;High CPU&lt;/strong&gt; &#xA;CLI Commands&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set cli timestamp&#xA;show chassis routing-engine (multiple snapshots, atleast 5)&#xA;show system processes extensive (multiple snapshots atleast 5)&#xA;show system users&#xA;show system connections&#xA;show system statistics&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Turn on task accounting and collect the task accounting detail output (three times with a gap of 30 seconds). Don't forget to turn it off after finished.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set task accounting on &#xA;show task accounting detail&#xA;set task accounting off&#xA;&#xA;show task memory detail&#xA;show task memeory summary&#xA;show task io&#xA;show task history&#xA;show task statistics&#xA;show task job&#xA;show task jobs&#xA;show krt queue&#xA;show krt state&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Logs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Archive /var/log as specified in Step 1 above&#xA;Traceoptions&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@router# show routing-options &#xA;traceoptions { &#xA;file routing-trace size 10m files 20 world-readable; &#xA;flag task; &#xA;flag state; &#xA;flag timer; &#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also if you are running an old version which made be prone for bugs, you might want to check the life support of the code:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/support/eol/junos.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.juniper.net/support/eol/junos.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another point to mention which could be a vector attack is not having protected your RE from unwanted exception traffic. Make sure you have a firewall filter under the loopback.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have seen in the past scripts on the router causing high cpu not sure if rpd came into my view, but this is something you might not want to overlook.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you see in the logs many hits with RPD_MPLS_PATH_BANDWIDTH_CHANGE you might be using a very aggressive adjust-interval&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check any drops on &quot;show system queue: this is the kernel queue, some clue may appear.&lt;/p&gt;&#xA;" OwnerUserId="35590" LastEditorUserId="509" LastEditDate="2017-03-28T20:24:48.220" LastActivityDate="2017-03-28T20:24:48.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40025" PostTypeId="1" CreationDate="2017-03-28T23:26:19.417" Score="1" ViewCount="1762" Body="&lt;p&gt;We have following network diagram, but &lt;code&gt;SW3&lt;/code&gt; isn't in place, and I have a question before I plug &lt;code&gt;SW3&lt;/code&gt; into the network.&lt;/p&gt;&#xA;&lt;h1&gt;Sorry, I put in the wrong diagram before. The following diagram is the correct one:&lt;/h1&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6xa36.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6xa36.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;h1&gt;EDIT&lt;/h1&gt;&#xA;&lt;p&gt;Currently, the following ports are in &lt;code&gt;FWD&lt;/code&gt; mode, and 2G is Alt blocking port.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;SW1 - 10G interface in FWD - 2G BLK&#xA;SW2 - 10G interface in FWD - 2G BLK&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Here is the output of &lt;code&gt;SW2&lt;/code&gt; switch. PO1 is an etherchannel interface 2x1G.&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;SW2#sh spanning-tree int te1/0/2&#xA;&#xA;Vlan                Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;VLAN0010            Root FWD 2         128.52   P2p&#xA;VLAN0020            Root FWD 2         128.52   P2p&#xA;VLAN0030            Root FWD 2         128.52   P2p&#xA;&#xA;&#xA;SW2#sh spanning-tree int po1&#xA;&#xA;Vlan                Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;VLAN0010            Altn BLK 3         128.456  P2p&#xA;VLAN0020            Altn BLK 3         128.456  P2p&#xA;VLAN0030            Altn BLK 3         128.456  P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;h1&gt;Questions:&lt;/h1&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Which path will SW3 take to the Root Bridge?&lt;/li&gt;&#xA;&lt;li&gt;If I increase the cost of the 2G interface on &lt;code&gt;SW3&lt;/code&gt;, then it will take the 10G interface path, but the problem is what will happened when the link goes down between &lt;code&gt;SW1&lt;/code&gt; and &lt;code&gt;SW2&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;li&gt;I want &lt;code&gt;SW3&lt;/code&gt; switch to primarily use the 10G interface, and if the link between &lt;code&gt;SW1&lt;/code&gt; and &lt;code&gt;SW2&lt;/code&gt; is down, then use &lt;code&gt;2G&lt;/code&gt; backup link.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-03-30T02:06:24.223" Title="Spanning Tree cost calculation" Tags="|cisco|spanning-tree|network-core|network|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40026" PostTypeId="2" ParentId="40025" CreationDate="2017-03-28T23:32:20.463" Score="2" Body="&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on your new drawing, it make more sense. Switch 2 prefers the path through Switch 1 because it has a cost of &lt;code&gt;6&lt;/code&gt;, but the 2G connection has a cost of &lt;code&gt;7&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch 3 will have a cost of &lt;code&gt;8&lt;/code&gt; (or &lt;code&gt;9&lt;/code&gt; in a failure of the link between switches 1 and 2) through Switch 2, but like Switch 2, the cost for Switch 3 through the 2G connection is &lt;code&gt;7&lt;/code&gt;, so it will be the preferred path in either scenario.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This design doesn't follow best practices. Since each switch has two connections, both connections should be to the layer above. A best practice is to never connect access switches to each other. You also want to pay attention to the oversubscription ratio (maximum 20:1 for access to distribution, and maximum 4:1 for distribution to backbone).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-03-30T01:06:19.980" LastActivityDate="2017-03-30T01:06:19.980" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="40029" PostTypeId="1" CreationDate="2017-03-29T08:13:18.360" Score="1" ViewCount="6454" Body="&lt;p&gt;I have the below output from an IOS-XR box:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:RTR1#show route 10.10.10.10&#xA;Wed Mar 27 13:34:52.553 IST&#xA;&#xA;Routing entry for 10.10.10.10/32&#xA;  Known via &quot;isis IGP&quot;, distance 115, metric 261, type level-2&#xA;  Installed Mar 27 01:21:50.992 for 12:13:01&#xA;  Routing Descriptor Blocks&#xA;    172.16.185.6, from 10.10.10.10, via TenGigE0/0/0/1, Backup&#xA;      Route metric is 0&#xA;    172.16.184.253, from 10.10.10.10, via Bundle-Ether7, Protected&#xA;      Route metric is 261&#xA;  No advertising protos.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Q1:what is the meaning of 'Route metric is 0' in the above output?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2: Is &lt;code&gt;fast-reroute&lt;/code&gt; in any way related to Q1 ? I see that &lt;code&gt;fast-reroute&lt;/code&gt; is configured under BE7 and not under Te0/0/0/1 in the running config.&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2018-07-05T21:58:08.043" Title="Understanding route metric 0" Tags="|is-is|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40030" PostTypeId="1" CreationDate="2017-03-29T08:52:43.923" Score="1" ViewCount="635" Body="&lt;p&gt;I know vPC back to back to avoid spanning tree between two pairs of Nexus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I've two 4500 pairs and I need to connect them. Is there a way to do something similar to the vPC back to back to don't use spanning tree?&lt;/p&gt;&#xA;" OwnerUserId="24395" LastActivityDate="2017-04-04T07:43:11.333" Title="VSS back to back like vPC back to back" Tags="|spanning-tree|vpc|vss|cisco-4500|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40032" PostTypeId="1" AcceptedAnswerId="40033" CreationDate="2017-03-29T11:18:28.290" Score="0" ViewCount="150" Body="&lt;p&gt;I'm studying Telecomunications Engineering and I know how to configurate routers using the command line interface (I've done lots of simulations). My problem is that I'm trying to configurate 2 routers TP-LINK and I don't know how to access to the CLI. How can someone access to a router CLI using linux?&lt;/p&gt;&#xA;" OwnerUserId="31891" LastActivityDate="2017-03-29T14:24:31.030" Title="How can I acces to CLI on a router?" Tags="|router|cli|" AnswerCount="1" CommentCount="1" ClosedDate="2017-03-29T15:01:12.927" ContentLicense="CC BY-SA 3.0" />
  <row Id="40033" PostTypeId="2" ParentId="40032" CreationDate="2017-03-29T11:57:25.040" Score="1" Body="&lt;p&gt;Firstly note that there is no standard for router CLIs. It varies both between brands and sometimes between product lines within a brand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly note that home/small buisness routers may not have a CLI at all or at least may not have a documented CLI. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for actually accessing the CLI you can either use a serial cable with a serial console application or a network protocol like ssh or telnet. If the device has a documented CLI then the manufacturer should tell you how to access it.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-29T11:57:25.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40034" PostTypeId="2" ParentId="40030" CreationDate="2017-03-29T12:02:04.357" Score="1" Body="&lt;p&gt;You can configure VSS on Cisco 4500E, The Cisco Virtual Switching System is a clustering technology that pools two Cisco Catalyst 4500-E Series Switches with Cisco Catalyst Supervisor Engine 7-E or 7-LE or two Catalyst 4500-X Series Switches into a single virtual switch. In a VSS, the data plane of both clustered switches is active at the same time in both chassis. VSS members are connected by virtual switch links (VSLs) using standard Gigabit or 10 Gigabit Ethernet connections between the VSS members. VSLs can carry regular user traffic in addition to the control plane communication between the VSS members.&#xA;you could find more info on the below link: &#xA;&lt;a href=&quot;https://supportforums.cisco.com/document/124626/virtual-switching-system-vss-configuration-cisco-4500-series-switches&quot; rel=&quot;nofollow noreferrer&quot;&gt;Virtual switching system (VSS) Configuration For Cisco 4500 series switches&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-03-29T12:02:04.357" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40035" PostTypeId="1" CreationDate="2017-03-29T14:11:40.170" Score="1" ViewCount="2132" Body="&lt;p&gt;I have a client that has purchased two SonicWall NSA 5600s and they would like to run two WAN connections from separate providers into two SonicWalls into two Cisco switches so that they can achieve full redundancy and fail-over. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I am confused about is what is needed for this kind of setup? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I understand correctly, one port per router would connect into each firewall. Both switches would have 4 VLAns, one for WAN, one for servers, one for phones, and one for client workstations. I would think that spanning tree would need to be enabled for redundancy at the switch level or inter-switch link, possibly LACP between the switches?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which VLANs would need to be tagged and what VLAN should contain the HA heartbeat cable?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am having a hard time wrapping my head around how to do this. Any assistance would be greatly appreciated.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/vujm4.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vujm4.jpg&quot; alt=&quot;Site1Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35603" LastEditorUserId="453" LastEditDate="2017-09-28T04:49:04.287" LastActivityDate="2018-03-27T12:22:32.883" Title="Sonicwall NSA 5600 Dual Wan / HA + Dual Switches how to setup fault tolerance and VLANs" Tags="|cisco|switch|sonicwall|wan|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40038" PostTypeId="2" ParentId="28678" CreationDate="2017-03-29T14:39:36.717" Score="0" Body="&lt;p&gt;If CDP is disabled then mostly likely LLDP might be disabled too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW, both of them are used to discover the L2 network. And the only viable option is to discover the L2 network is via ARP. ARP tables can be polled via SNMP. (In case you want to discover/map the L3 network, then you can do that by reading routing tables of your routers, starting from the seed router.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you using any monitoring tool? They have functions to discover &amp;amp; map networks. &lt;/p&gt;&#xA;" OwnerUserId="35607" LastActivityDate="2017-03-29T14:39:36.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40041" PostTypeId="1" CreationDate="2017-03-29T17:54:33.577" Score="1" ViewCount="596" Body="&lt;p&gt;I have a conceptual question which I cannot understand. Can the TCP throughput be equal to the bandwidth and why? &#xA;The throughput from what I have learned so far is (3/4)*congwing/RTT. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is is fair to equalize that to the bandwidth? And is the window size we find the minimum window size?&lt;/p&gt;&#xA;" OwnerUserId="35613" LastEditorUserId="8499" LastEditDate="2017-07-16T00:15:13.610" LastActivityDate="2017-07-16T00:15:13.610" Title="Can tcp throughput be equal to bandwidth?" Tags="|tcp|layer4|congestion|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40043" PostTypeId="1" CreationDate="2017-03-29T20:16:40.203" Score="2" ViewCount="3452" Body="&lt;p&gt;Given the following diagram, I've modified the static routing tables with an entry for each router of the other two, through the serial interface, and everything works fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What should I change so that if 192.168.23.4 /30 would stop working, I could still reach 192.168.22.1 from 192.168.21.1 through 192.168.20.1?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RYvT5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RYvT5.png&quot; alt=&quot;network diag&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32919" LastEditorUserId="453" LastEditDate="2018-04-13T23:40:19.080" LastActivityDate="2018-04-13T23:40:19.080" Title="Fault tolerance with 3 routers in Packet Tracer" Tags="|packet-tracer|redundancy|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40045" PostTypeId="2" ParentId="40043" CreationDate="2017-03-29T21:20:43.830" Score="3" Body="&lt;p&gt;The simplest solution would be to add a dynamic routing protocol such as &lt;code&gt;RIP&lt;/code&gt;, &lt;code&gt;EIGRP&lt;/code&gt; or &lt;code&gt;OSPF&lt;/code&gt;.  Then raise the &lt;a href=&quot;https://en.wikipedia.org/wiki/Administrative_distance&quot; rel=&quot;nofollow noreferrer&quot;&gt;Administrative Distance&lt;/a&gt; of the static routes so the dynamically learned routes are preferred.  These static routes with the higher administrative distance become &lt;a href=&quot;https://howdoesinternetwork.com/2013/static-floating-route&quot; rel=&quot;nofollow noreferrer&quot;&gt;floating static routes&lt;/a&gt;.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2017-03-29T21:47:53.553" LastActivityDate="2017-03-29T21:47:53.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40046" PostTypeId="1" AcceptedAnswerId="40049" CreationDate="2017-03-29T22:15:00.373" Score="0" ViewCount="2566" Body="&lt;p&gt;I want to ask a question that seems to confuse me. I have a question in my self-study &quot;Computer Networking&quot; book which distinguishes a packet error from ACK error for a Selective Repeat protocol and for Go-Back-N.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To my knowledge the repetition will still make a timeout happen since a faulty ACK is still not understood so that wouldn't make a difference in behavior. That is it will retransmit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing something or is the question deliberately making me confused?&lt;/p&gt;&#xA;" OwnerUserId="35614" LastActivityDate="2017-03-30T06:35:38.810" Title="Difference between packet loss and ACK loss" Tags="|protocol-theory|" AnswerCount="1" CommentCount="0" ClosedDate="2017-03-31T00:50:11.423" ContentLicense="CC BY-SA 3.0" />
  <row Id="40048" PostTypeId="2" ParentId="40025" CreationDate="2017-03-30T02:06:24.223" Score="1" Body="&lt;p&gt;For this topology, you should enable &quot;spanning-tree pathcost method long&quot; on all switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have you correctly configured the root for the spanning trees using &quot;spanning-tree vlan x-y priority xxxx&quot; as I assume you are using some flavor of PVST?&lt;/p&gt;&#xA;" OwnerUserId="35626" LastActivityDate="2017-03-30T02:06:24.223" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40049" PostTypeId="2" ParentId="40046" CreationDate="2017-03-30T06:35:38.810" Score="0" Body="&lt;p&gt;Yes, dependin upon the implementation protocol such as selective repeat or go-back N, will result in re-transmission. However ack and data packet are completely different entities. &#xA;1. loss of ack will cause a re transmit because the timer at the sender will expire and force the client to send again. However the receiver already has this packet, and needs to discard the packet as duplicate. If the data packet it self was lost, re transmission would still occur but this time the receiver actually does not have a packet. Both deal with expiration of a timer, so you migh have been confused. But ack and data packet have completely different use. Later when you study the TCP protocol you will see that data packet consumes a sequence number while ack packet does not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So both cannot be generalized as one. &lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-03-30T06:35:38.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40050" PostTypeId="1" AcceptedAnswerId="40052" CreationDate="2017-03-30T06:39:39.963" Score="1" ViewCount="1824" Body="&lt;p&gt;I am trying to implement and test BGP in a lab environment. Due to some error, I have assigned wrong AS numbers to the routers and I would like to change that. Simply running the same commands with the correct configuration does not work. I have also tried to reset the BGP connection. But that resets the peers and not the router settings. Is there a way to simply remove any ad all BGP configurations that are present on teh router and such that the router will then have no instabnce of BGP running and I can start afresh with the configurations?&lt;/p&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="509" LastEditDate="2017-03-30T06:51:34.137" LastActivityDate="2017-03-30T06:51:34.137" Title="Change BGP AS number after configuration" Tags="|router|bgp|cisco-ios|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40052" PostTypeId="2" ParentId="40050" CreationDate="2017-03-30T06:51:24.380" Score="2" Body="&lt;p&gt;This should work (but removes all bgp config):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no router bgp [old ASN]&#xA;router bgp [new ASN]&#xA;(rest of new config)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-03-30T06:51:24.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40053" PostTypeId="2" ParentId="40041" CreationDate="2017-03-30T07:27:18.527" Score="2" Body="&lt;p&gt;This will be a really long answer, So here it goes.&#xA;First things first the rate at which TCP will send the data is dependent on 3 things- application generating data, receive window, congestion window. The effective rate will be determined by the minimum these three. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for this question let us assume there is no flow and congestion control required and the application always has data to send.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now as you pointed out, TCP uses buffers to send data. the buffer size decides the maximum of packets TCP can sent without waiting for an ack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now when TCP sends the any data, the packet will travel at link speed ie 100% link utilization and reach the sender. The sender will reply with an ack that again travels with link speed to reach the sender. Thus time elapsed during this activity is equal to RTT. Note that the amount of traffic sent by the TCP during this RTT time is equal to buffer size. The average utilization is given by total data set in the given time. Thus utilization is :- window size / RTT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now if we want to send data where average utilization equal to bandwidth then &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;window size / RTT = bandwidth&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Thus, if we can have window size = bandwidth * RTT, then utilization is equal to bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now apart from the maths, Try to understand why this is the case. The TCP has to wait a time equal to RTT, before transmitting again, This is how TCP works. So the only way we can control utilization is by sending the number of packets at a time on the link. If we want to transmit at full bandwidth for continuously for RTT units of time but we cannot pump data continuously so we send bandwidth * RTT units of data together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus to for utilization = bandwidth --&gt; window size = bandwidth * RTT &lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-03-30T07:27:18.527" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40056" PostTypeId="1" CreationDate="2017-03-30T08:44:33.490" Score="1" ViewCount="89" Body="&lt;p&gt;I manage a small event venue space, and a client for an upcoming event recently asked me for our IP address. He's planning on setting up a few stations (laptops) to do sales and collect money for fundraising. These laptops will be connected to our wireless internet. Apparently he wants to know our IP address &quot;so that multiple sales from your location that day aren’t flagged as spam.&quot;  Can anyone please tell me which IP address he is referring to and how I can find that IP address for him? Our ISP is Webpass, and we use Cisco Meraki MX80 with Meraki MR34 access points. Thanks&lt;/p&gt;&#xA;" OwnerUserId="35636" LastEditorUserId="8499" LastEditDate="2018-03-19T18:13:25.037" LastActivityDate="2018-03-19T18:13:25.037" Title="Which IP address is being referred to in this situation?" Tags="|ip|ip-address|meraki|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40057" PostTypeId="2" ParentId="40056" CreationDate="2017-03-30T09:01:17.490" Score="3" Body="&lt;p&gt;I think your client is asking for your public IP address (static/Dynamic) provided by your ISP.Please check the authenticity of the request before providing the information(IP address) to your client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your sales process includes a call to a third party payment gateway/Banking API then it makes sense. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes when multiple clients with the same Public IP address send back to back queries to their API/services then the Automatic security routines/algorithms will start classifying them as fishy/trigger captachas or even block the IP address altogether. You client might have foreseen this problem and taking actions to prevent the problem by white listing the IP address upfront.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just Google &quot;what is my public IP address&quot; You will get to know the IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can also access the ISP provided Modem's GUI from your PC then also check it from the Web GUI as well.The IP address must be listed on WAN IP address  section.&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-03-30T09:01:17.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40058" PostTypeId="1" AcceptedAnswerId="40060" CreationDate="2017-03-30T09:18:44.597" Score="0" ViewCount="304" Body="&lt;p&gt;How many IP address in &lt;strong&gt;197.210.152.14/30&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If im correct, its just 1 &gt; 197.210.152.14&#xA;Gateway is 197.210.152.13&lt;/p&gt;&#xA;" OwnerUserId="17045" LastEditorUserId="8499" LastEditDate="2018-03-10T04:27:30.103" LastActivityDate="2018-03-10T04:27:30.103" Title="IP address Question, IP given by ISP" Tags="|ipv4|ip|subnet|ip-address|" AnswerCount="1" CommentCount="0" ClosedDate="2018-07-26T00:28:05.657" ContentLicense="CC BY-SA 3.0" />
  <row Id="40059" PostTypeId="1" AcceptedAnswerId="40061" CreationDate="2017-03-30T09:19:55.693" Score="1" ViewCount="436" Body="&lt;p&gt;I want to save the details of the network traffic by my Cisco Switch [source IP, dest, protocol...]. &#xA;Is it possible to enable logging to capture the details of the network traffic by my Cisco in a Syslog Server?  If Yes, how can I do it ? o_O&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope someone will understand my problem&lt;br&gt;&#xA;Thanks in advance :)&lt;/p&gt;&#xA;" OwnerUserId="35263" LastActivityDate="2017-03-30T09:41:28.410" Title="How to capture the details of the network traffic by Cisco?" Tags="|cisco-ios|logging|syslog|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40060" PostTypeId="2" ParentId="40058" CreationDate="2017-03-30T09:33:34.693" Score="2" Body="&lt;p&gt;The &lt;code&gt;/30&lt;/code&gt; network that include the  &lt;code&gt;197.210.152.14&lt;/code&gt; IP address is &lt;code&gt;197.210.152.12/30&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The /30 part indicate that there's 2 bits that define the host portion of the address (32-30 = 2).&#xA;So you have 2^2 = 4 available IP addresses:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;197.210.152.12&#xA;197.210.152.13&#xA;197.210.152.14&#xA;197.210.152.15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first address of a subnet is reserved, it is the &lt;code&gt;network address&lt;/code&gt;. The last address is also reserved, it is the &lt;code&gt;broadcast address&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This leave you 2 usable addresses: 13 and 14. So you use one for your equipment and the other one is the ISP gateway address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that, to avoid wasting IP addresses, a point to point link can be configured with a /31 network, in which there's only 2 addresses. This is an exception, defined in &lt;a href=&quot;https://tools.ietf.org/rfc/rfc3021.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC3021&lt;/a&gt; in which the addresses that are normally used for network and broadcast can be configured on hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For information a point to point link can also be configured as &lt;code&gt;unnumbered&lt;/code&gt;, in this case you route the traffic trough interface rather than IP. &lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-03-30T09:45:21.920" LastActivityDate="2017-03-30T09:45:21.920" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40061" PostTypeId="2" ParentId="40059" CreationDate="2017-03-30T09:41:28.410" Score="2" Body="&lt;p&gt;There's a protocol created by Cisco for this very purpose: &lt;code&gt;netflow&lt;/code&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have to check if your version of IOS support it, and you need a netflow &lt;code&gt;collector&lt;/code&gt; that will receive and record the information from the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco reference some free Netwflow software on &lt;a href=&quot;http://www.cisco.com/c/en/us/products/ios-nx-os-software/ios-netflow/networking_solutions_products_genericcontent0900aecd805ff72b.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this page&lt;/a&gt; but there's plenty others. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many software provide both the &lt;code&gt;syslog&lt;/code&gt; and the &lt;code&gt;netflow&lt;/code&gt; functionalities, but this is two different services that address different needs. &lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-30T09:41:28.410" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40062" PostTypeId="1" CreationDate="2017-03-30T11:24:14.407" Score="0" ViewCount="240" Body="&lt;p&gt;I have a set of cisco catalyst switches, that are configured with vlan 10.10.1.0 and 10.10.0.0. I have a CPE from my provider, which is configured with the following information:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network: 10.0.30.8/30&#xA;Gateway: 10.0.30.9&#xA;CPE: 10.0.30.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can i connect these devices, so that i can access the CPE from my workstations, configured with the addresses from the 10.10.0.0 and .1 networks?&lt;/p&gt;&#xA;" OwnerUserId="35640" LastActivityDate="2018-04-24T20:16:48.807" Title="Connecting CPE to Cisco catalyst switch" Tags="|cisco|network|ip-address|" AnswerCount="3" CommentCount="1" ClosedDate="2018-07-26T00:26:02.973" ContentLicense="CC BY-SA 3.0" />
  <row Id="40063" PostTypeId="2" ParentId="40062" CreationDate="2017-03-30T11:28:32.630" Score="0" Body="&lt;p&gt;Configure the Gateways of VLAN 10.10.1.0 and 10.10.0.0 on CPE, by connecting the catalyst switches to CPE and you are done :)&lt;/p&gt;&#xA;" OwnerUserId="31465" LastActivityDate="2017-03-30T11:28:32.630" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="40065" PostTypeId="2" ParentId="19943" CreationDate="2017-03-30T11:56:46.867" Score="0" Body="&lt;p&gt;vlan32 has a virtual vlan interface,&#xA;all traffic originating from vlan32 need to go out of this vlan will send traffic to vlan32's virtual interface, from the virtual interface perspective, these traffic are IN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;traffic originating from other vlan like vlan 40 and need to go to vlan32, will need to use vlan32's interface as a relay, these traffic will go out of vlan32's virtual interface to go to vlan32, so these traffic from vlan32's interface perspective, they are OUT&lt;/p&gt;&#xA;" OwnerUserId="35642" LastActivityDate="2017-03-30T11:56:46.867" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40066" PostTypeId="1" AcceptedAnswerId="40068" CreationDate="2017-03-30T12:24:39.913" Score="1" ViewCount="178" Body="&lt;p&gt;I intend to setup a small office network. Based on the article below, it mention that I should use switch for all the LAN points for my cubicles, but I am puzzled. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How does switch issues IP address for each of the machine plug-in? since switch does not act like router and do not provide DHCP service.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building a Small Office Network: The Difference Between Switches and Routers&#xA;&#xA;When building a small office network, the two most essential pieces of equipment you will need are switches and routers. Though they look similar, the two devices perform different functions in a network.&#xA;&#xA;Switches connect multiple devices (computers, printers, servers) on the same network within a building or campus. A switch enables connected devices to share information and talk to each other. Building a small office network isn’t possible without switches to tie devices together.&#xA;Routers tie multiple networks together. When building a small office network, you’ll need one or more routers. A router connects your networked computers to the Internet. This enables all connected computers to share one single Internet connection. A router acts as a dispatcher, choosing the best route for your information to travel. It connects your business to the world, protects information from security threats, and can even decide which computers get priority over others.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/solutions/small-business/resource-center/connect-employees-offices/primer-building-small-office-network.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com/c/en/us/solutions/small-business/resource-center/connect-employees-offices/primer-building-small-office-network.html&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="27964" LastActivityDate="2018-12-05T21:55:32.247" Title="Setting up small office network" Tags="|switch|router|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40067" PostTypeId="2" ParentId="40062" CreationDate="2017-03-30T12:28:13.387" Score="1" Body="&lt;p&gt;You have 3 options:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;configure a local route on each host (computer) so the traffic to the VPN goes to the CPE. This is bad solution.&lt;/li&gt;&#xA;&lt;li&gt;add a route on your firewall so it redirect traffic to the CPE. This is the simplest solution.&lt;/li&gt;&#xA;&lt;li&gt;use Layer 3 switches, configure them as the gateway for your local networks, add a route for the Internet to your firewall and another route for the VPN to the CPE. This has some advantages in term of performance, but if your switch are not already Layer3 capable, include additional costs.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-30T12:28:13.387" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40068" PostTypeId="2" ParentId="40066" CreationDate="2017-03-30T12:34:24.083" Score="3" Body="&lt;p&gt;Switches don't issue IP addresses to devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either all devices have a statically configured IP address, or you use a DHCP server that will assign the IP automatically. (or a mix of it, generally servers and specific devices like printers have static IP addresses while users computer have DHCP assigned IP)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many routers include a DHCP server feature, but you don't have to use them. A server, be it Windows, Linux, Netware, Solaris, etc.. can act as the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches allow the different devices in the network to communicate, this include the communication between the devices and the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some high-end (read expensive) switches have routing capabilities and even DHCP services but this is really different functions embedded in a single box, and the DHCP service is still unrelated to the switching function.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-03-30T12:34:24.083" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="40072" PostTypeId="2" ParentId="40056" CreationDate="2017-03-30T14:28:42.457" Score="2" Body="&lt;p&gt;What he needs to know is the publiv IP address(es) that will be used when clients on your wifi network make requests to services on the Internet so that he can whitelist them in his abuse-control system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your network setup that may be an individual IP address or it may be a range of addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are sure you only have a single internet IP address you can go to a &quot;what is my IP&quot; type site. If you have a pool of addresses you should have a record somewhere of what that pool is.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-04-03T19:09:39.227" LastActivityDate="2017-04-03T19:09:39.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40073" PostTypeId="1" AcceptedAnswerId="44624" CreationDate="2017-03-30T14:39:07.230" Score="1" ViewCount="423" Body="&lt;p&gt;I've completed the installation of my CUCM 11.5 using a bootable .iso file.  Now I'm trying to install CUC for the voicemail and can't get it done because there isn't a bootable .iso only a regular .iso file.  I've followed the instructions at &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/10x/install_upgrade/guide/10xcuciumgx/10xcuciumg010.html#81415&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/voice_ip_comm/connection/10x/install_upgrade/guide/10xcuciumgx/10xcuciumg010.html#81415&lt;/a&gt; &#xA; Where it says to edit the settings to first boot into bios and change the boot order to cdrom first, hd second and still vmware gets all the way down to network boot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="34023" LastActivityDate="2018-03-01T20:20:15.310" Title="cisco cuc installation" Tags="|cisco|cisco-ios|vmware|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40082" PostTypeId="1" CreationDate="2017-03-30T19:53:02.837" Score="1" ViewCount="467" Body="&lt;p&gt;I would like to limit the usage of a 10 MBit internet connection for a specific internal VLAN to 2 MByte (on a Cisco router, IOS 15.3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that possible in general?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can the router make sure that the incoming/returning traffic from the internet destined to that VLAN will not exceed the desired rate? I.e. if a server is sending back (i.e. file transfers) with a very high rate? Of course the router could just drop everyhting which exceeds the desired rate, but isn´t it too late at that stage, because the WAN link would already been saturated?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="35653" LastEditorUserId="8499" LastEditDate="2018-12-12T23:54:38.823" LastActivityDate="2018-12-12T23:54:38.823" Title="Cisco IOS: Limiting internet bandwidth usage for specific VLAN" Tags="|cisco|vlan|qos|bandwidth|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40083" PostTypeId="2" ParentId="40082" CreationDate="2017-03-30T20:03:32.533" Score="2" Body="&lt;p&gt;You have limited control over traffic coming into your network. By the time you see the traffic, the bandwidth has been used. At that point, all you can do is to police it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the traffic is in TCP connections, loss of traffic will result in retransmission requests that should cause the sender to slow, but it is an inexact way to do it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-30T20:03:32.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40085" PostTypeId="1" CreationDate="2017-03-30T20:59:45.490" Score="2" ViewCount="156" Body="&lt;p&gt;We have a Juniper EX-4200 (1Gbps downlinks) with the SFP+ uplink module. The switch is connected to our providers via 10x aggregated 1Gbps ports (ge-0/0/0 to ge-0/0/9). Can we connect a server to the 10Gbps uplink module (xe-0/1/0) and expect to be able to push 10 Gbps from the server in multiple or a single TCP connection? I know the uplink module cancels 2 ports in EX-3200, but does it cancel ports in EX-4200 switches? Thanks a lot.&lt;/p&gt;&#xA;" OwnerUserId="35657" LastActivityDate="2017-04-04T21:48:52.670" Title="Juniper EX uplink module for access downlinks" Tags="|juniper|juniper-junos|juniper-ex|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40086" PostTypeId="1" CreationDate="2017-03-30T21:45:06.743" Score="3" ViewCount="2188" Body="&lt;p&gt;I have a point to point connection by fiber with 1000BASE-X Ethernet.  The rate is always at 1 Gbps, and I believe full-duplex would not be a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the link is point to point, it seems that there is no reason to &quot;negotiate&quot; speed or duplex.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, can I just disable the Auto-Negotiation function?&lt;/p&gt;&#xA;" OwnerUserId="35658" LastEditorUserId="8499" LastEditDate="2018-03-18T23:38:29.230" LastActivityDate="2024-01-20T17:33:43.707" Title="Do I need Auto-Negotiation in 1000BASE-X Ethernet if I have a point-to-point link always at 1 Gbps?" Tags="|ethernet|autonegotiation|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40088" PostTypeId="1" AcceptedAnswerId="40090" CreationDate="2017-03-30T22:55:51.560" Score="3" ViewCount="3876" Body="&lt;p&gt;In my Fedora linux, My eno1's ip is &lt;code&gt;192.168.1.105&lt;/code&gt; and my gateway's ip is &lt;code&gt;192.168.1.1&lt;/code&gt;, and netmask &lt;code&gt;netmask 255.255.255.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For monitoring ARP request, in one terminal, I used &lt;code&gt;sudo tcpdump -i eno1 -v &quot;icmp or arp&quot;&lt;/code&gt;, in another terminal, I run the &lt;code&gt;ping 192.168.1.5&lt;/code&gt;(not exist) or &lt;code&gt;ping 192.168.91.1&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I &lt;code&gt;ping 192.168.1.5&lt;/code&gt;, which is not existed in my LAN, in the &lt;code&gt;tcpdump&lt;/code&gt; terminal, I got the &lt;code&gt;ARP&lt;/code&gt; request:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; [abelard@localhost iputils]$ sudo tcpdump -i eno1 -v &quot;icmp or arp&quot;&#xA; [sudo] password for abelard: &#xA; tcpdump: listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes&#xA; 06:39:13.111379 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has     192.168.1.5 tell localhost.localdomain, length 28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I &lt;code&gt;ping 192.168.91.5&lt;/code&gt;, which is still not existed in my LAN, in the &lt;code&gt;tcpdump&lt;/code&gt; terminal, I did not get the &lt;code&gt;ARP&lt;/code&gt; request:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; [abelard@localhost iputils]$ sudo tcpdump -i eno1 -v &quot;icmp or arp&quot;&#xA; tcpdump: listening on eno1, link-type EN10MB (Ethernet), capture size 262144 bytes&#xA; 06:50:02.417926 IP (tos 0x0, ttl 64, id 32986, offset 0, flags [DF], proto ICMP (1), length 84)&#xA;localhost.localdomain &amp;gt; 192.168.91.1: ICMP echo request, id 6682, seq 1, length 64&#xA; 06:50:03.417060 IP (tos 0x0, ttl 64, id 33783, offset 0, flags [DF], proto ICMP (1), length 84)&#xA;localhost.localdomain &amp;gt; 192.168.91.1: ICMP echo request, id 6682, seq 2, length 64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to know who determines to send &lt;code&gt;ARP&lt;/code&gt; request or not to send &lt;code&gt;ARP&lt;/code&gt; request?&#xA;The some googled results said this is done by linux kernel, if yes, I want to know where in linux kernel? &lt;/p&gt;&#xA;" OwnerUserId="35443" LastEditorUserId="35443" LastEditDate="2017-03-30T23:50:20.330" LastActivityDate="2022-11-30T03:05:56.233" Title="who determines whether should ping send a ARP request?" Tags="|ipv4|tcp|tcpdump|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40089" PostTypeId="2" ParentId="40088" CreationDate="2017-03-30T23:28:39.413" Score="6" Body="&lt;p&gt;What happens is&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ping builds a ping packet and passes it to the kernel.&lt;/li&gt;&#xA;&lt;li&gt;The kernel looks up the destination in the routing table. Based on the routing table it determines an interface and a &quot;next hop IP address&quot;.&lt;/li&gt;&#xA;&lt;li&gt;If the interface is &quot;Ethernet like&quot; the kernel looks up the next hop IP address in the ARP table for the interface.&lt;/li&gt;&#xA;&lt;li&gt;If there is an entry in the ARP table the kernel attaches the MAC addresses to the packet and sends it. Otherwise it puts it in a queue and sends out an ARP request.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You do not say what your subnet mask is but I will assume it is 255.255.255.0&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ping 192.168.1.5&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ping generates a packet destined for 192.168.1.5&lt;/li&gt;&#xA;&lt;li&gt;The kernel looks up the destination in the routing table. The packet matches the implicit route created by setting the subnet mask. This tells it that the destination is &quot;on link&quot; on eth0. Since the destination is on-link the next hop IP address is the same as the destination address.&lt;/li&gt;&#xA;&lt;li&gt;The kernel looks up the next hop in the arp table for eth0. It finds no entry.&lt;/li&gt;&#xA;&lt;li&gt;The kernel sends out an arp request.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ping 192.168.91.5&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ping generates a packet destined for 192.168.91.5&lt;/li&gt;&#xA;&lt;li&gt;The kernel looks up the destination in the routing table. The packet matches the default route (aka the default gateway). The next hop IP address is 192.168.1.1&lt;/li&gt;&#xA;&lt;li&gt;The kernel looks up 192.168.1.1 in the arp table and most likely finds a match (you tend to talk to your default gateway quite a lot).&lt;/li&gt;&#xA;&lt;li&gt;The ping gets sent.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Sorry I don't know the exact layout of the code in the linux kernel to tell you where the code implementing this is.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-03-30T23:40:38.703" LastActivityDate="2017-03-30T23:40:38.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40090" PostTypeId="2" ParentId="40088" CreationDate="2017-03-30T23:28:53.227" Score="3" Body="&lt;p&gt;A host that needs to send something to another host on the LAN needs to &lt;em&gt;resolve&lt;/em&gt; the layer-3 (e.g. IP) address to the layer-2 (e.g. ethernet) address. That is what ARP (Address &lt;em&gt;Resolution&lt;/em&gt; Protocol) does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A host will maintain an ARP table in which it can look up a layer-3 address to resolve to the corresponding layer-2 address. If the layer-3 address is not in the ARP table, then the host broadcasts an ARP request to get the necessary information.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-30T23:28:53.227" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="40091" PostTypeId="1" CreationDate="2017-03-31T00:07:22.497" Score="2" ViewCount="1142" Body="&lt;p&gt;What are examples of Cisco IOS Syslog level 0 (emergency) messages? I have never come across one, nor have I been able to google for one.&lt;/p&gt;&#xA;" OwnerUserId="35662" LastEditorUserId="8499" LastEditDate="2017-03-31T00:45:35.020" LastActivityDate="2017-04-25T01:08:00.327" Title="What are examples of Cisco IOS Syslog level 0 (emergency) messages?" Tags="|cisco|cisco-ios|syslog|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40092" PostTypeId="1" CreationDate="2017-03-31T02:54:19.193" Score="1" ViewCount="6091" Body="&lt;p&gt;I need to capture UDP information coming to me via an Ethernet frame.  I have a point to point connection by fiber with 1000BASE-X Ethernet. The information coming to me is in GMII format; which is bytes at a rate of 125 MHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The UDP header format is shown below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;              0      7 8     15 16    23 24    31  &#xA;             +--------+--------+--------+--------+ &#xA;             |     Source      |   Destination   | &#xA;             |      Port       |      Port       | &#xA;             +--------+--------+--------+--------+ &#xA;             |                 |                 | &#xA;             |     Length      |    Checksum     | &#xA;             +--------+--------+--------+--------+ &#xA;             |                                   |   &#xA;             |          data octets              |&#xA;             +-----------------------------------+                 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Source Port      = SP&#xA;Destination Port = DP&#xA;Length           = L&#xA;Checksum         = CS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, the Ethernet frame is shown below.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    +-----------+-------+---------+---------+--------+------------------+---------+ &#xA;    |  Preamble |  SFD  |   DA    |   SA    |   TL   | Data (Payload)   | CRC-32  | &#xA;    |  6 bytes  |1 Byte | 6 bytes | 6 bytes |2 bytes | 46 to 1500 bytes | 4 bytes |&#xA;    +-----------+-------+---------+---------+--------+------------------+---------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming that my data will be placed in the Data (Payload) field of the Etnernet frame, my question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Will the order of the double bytes be, first DP, second SP, third CS, fourth L, fifth data byte1, sixth data byte2, etc.?&#xA;2) Least significant bytes first?&lt;/p&gt;&#xA;" OwnerUserId="35658" LastEditorUserId="8499" LastEditDate="2018-03-19T00:01:03.520" LastActivityDate="2018-03-19T00:01:03.520" Title="UDP Over Ethernet - Where exactly and in what order will the UDP information show up in the payload of my Ethernet frame?" Tags="|ethernet|layer2|udp|layer4|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40093" PostTypeId="2" ParentId="40092" CreationDate="2017-03-31T04:24:12.510" Score="1" Body="&lt;p&gt;You are missing a network layer:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Layer-1/2: ethernet&lt;/li&gt;&#xA;&lt;li&gt;Layer-3: IPv4 or IPv6&lt;/li&gt;&#xA;&lt;li&gt;Layer-4: UDP&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;The payload of the ethernet frames will probably be either IPv4 or IPv6 packets. You need to check the ethernet frame header EtherType field to determine what, specifically the payload is.&lt;/p&gt;&#xA;&lt;p&gt;UDP datagrams will be the payload of either IPv4 or IPv6 packets. You can check the IPv4 packet header Protocol field, or the IPv6 header Next Header field to determine the payload of the IP packets.&lt;/p&gt;&#xA;&lt;p&gt;As far as the byte order goes, the IETF has a &lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-newman-network-byte-order-01&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Network Byte Order&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;1.1. Background and Motivation&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The document &amp;quot;ON HOLY WARS AND A PLEA FOR PEACE&amp;quot; [&lt;a href=&quot;https://datatracker.ietf.org/doc/html/draft-newman-network-byte-order-01#ref-IEN-137&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEN-137&lt;/a&gt;]&#xA;written in 1980 argues that the industry should settle on a single&#xA;byte order.  Since then, the IETF has largely settled on a single byte&#xA;order known as &amp;quot;Network Byte Order&amp;quot; and this memo is intended to&#xA;record that rough concensus.  Unfortunately, the &amp;quot;holy war&amp;quot; continues&#xA;among CPU manufacturers.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;2. Definition of Network Byte Order&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;When a number is too large to fit in a single byte, multiple bytes are&#xA;used to encode that number.  When such numbers are sent over a&#xA;byte-oriented protocol (e.g., TCP is 8-bit-byte oriented) an order for&#xA;the bytes must be selected so both ends interpret the numbers in the&#xA;same way independent of CPU architecture.  When the bytes which make&#xA;up such multi-byte numbers are ordered from most significant byte to&#xA;least significant byte, that is called &amp;quot;network byte order&amp;quot; or &amp;quot;big&#xA;endian.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;For example, take the unsigned hexidecimal number 0xFEEDFACE (decimal&#xA;4,277,009,102).  If this is sent as a sequence of 8-bit bytes using&#xA;network byte order (big endian), the sequence would be: 0xFE, 0xED,&#xA;0xFA, 0xCE.  In little endian (least significant byte to most&#xA;significant byte), this would be: 0xCE, 0xFA, 0xED, 0xFE.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;For ethernet, and other IEEE LANs, the destination address comes first, but for IPv4, IPv6, TCP, UDP, and other IETF standards, the source address comes first.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:24:50.413" LastActivityDate="2017-03-31T04:31:18.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40094" PostTypeId="2" ParentId="40085" CreationDate="2017-03-31T06:12:11.017" Score="2" Body="&lt;p&gt;If you connect server to 10 gbps uplink and you push data from your server to the aggregated uplinks you will have 1 gbps speed for single flow, speed will not be aggregated for any single TCP flow but it will use single uplink.&#xA;For the uplink module it can be configured to support up to four 1-gigabit SFP transceivers or up to two 10-gigabit small form-factor pluggable (SFP+) transceivers.&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-03-31T06:12:11.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40097" PostTypeId="2" ParentId="17246" CreationDate="2017-03-31T13:54:46.950" Score="1" Body="&lt;p&gt;&quot;Multimode fiber is like shooting a shotgun down a conduit - you get a lot of pellets into it, but they tend to bounce of the walls so they don't go very far and they aren't very accurate. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Singlemode fiber is like firing a rifle down the conduit - it's just a single bullet but it will go straighter, faster, and further than the pellets. &quot;&#xA;- Jim Jachette&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the explanation that made sense to me. Both modes are one shot of light. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for why the two modes exist. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Singlemode equipment use to be very expensive. Multimode equipment was alot cheaper than Singlemode. So it made sense to use multimode on the short distances. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today the equipment prices and fiber prices themselves are almost equal. People are just hung up on multimode or need to maintain existing multimode networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are building a new fiber network, just go for Singlemode.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps. &lt;/p&gt;&#xA;" OwnerUserId="35676" LastActivityDate="2017-03-31T13:54:46.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40099" PostTypeId="2" ParentId="40086" CreationDate="2017-03-31T14:47:23.013" Score="3" Body="&lt;p&gt;The link probably doesn't need auto-negotiation, but you probably should not change the default without a good reason. There is nothing about having it configured that will cause you any problem, and it only happens when the link comes up. It takes virtually no time to happen. You really don't want to make network changes, just because. &quot;&lt;em&gt;If it ain't broke, don't fix it!&lt;/em&gt;&quot;&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-03-31T14:47:23.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40100" PostTypeId="2" ParentId="23718" CreationDate="2017-03-31T15:54:39.280" Score="0" Body="&lt;p&gt;In a sense we have done this. If you look at something like 100GBASE-SR10 you find that at the physical layer it is essentially a group of ten 10GBASE-SR links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's generally better to do this stuff at as low a level as possible because any buffering or delay mismatches between the communication streams will make the reassembly process much harder.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-03-31T15:54:39.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40102" PostTypeId="2" ParentId="39936" CreationDate="2017-03-31T17:12:17.407" Score="0" Body="&lt;p&gt;I have done it - the problem could have been in blocked ports but also - I had nonexisting user doing the testing. After I have changed the testing user it started working and the server is seen alive. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for all the comments&lt;/p&gt;&#xA;" OwnerUserId="35496" LastActivityDate="2017-03-31T17:12:17.407" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40103" PostTypeId="2" ParentId="40035" CreationDate="2017-03-31T17:20:01.010" Score="1" Body="&lt;p&gt;You are mixing some concepts about HA, redundancy, port-channels and VLAN. Let's try to define every part of this network design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;HA Firewall&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need to conect 2 firewalls directly with one (or two) cables back-to-back for Control &amp;amp; Data. This consumes one (or two) ethernet ports in every firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This connection is just &quot;a HA link&quot;. You don't need to define any special config about VLAN, addressing or nothing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aditionally, you need to replicate &lt;strong&gt;exactly&lt;/strong&gt; every cable in Primary Firewall and Secondary Firewall. I mean, if your FW1 X0 goes to VLAN 10 untagged in the core, you need to put FW2 X0 to same VLAN 10 untagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;WANs&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tipically, every WAN connection has a cable from ISP device. But, remenber you need 2 cables for &lt;strong&gt;every&lt;/strong&gt; interface in the Firewall. You need Layer 2 visibility for ISP Router, FW1-X1 and FW2-X1 (assuming default WAN). You can achieve this in several ways but 2 more typical:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ask ISP to provide a second cable in the router. First cable goes to FW1 and second cable goes to FW2. Router provide layer2 visibility.&lt;/li&gt;&#xA;&lt;li&gt;Create an infraestructure VLAN in your core switch. Create a L2 VLAN (not routed) to connect cable from ISP router, FW1-X1 and FW2-X1.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;About the second WAN, you just need to replicate the physical connection in other router/VLAN/FW port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just remember that your are aproaching 2 different things: device/link redundancy with double cable to ISP and WAN failover using 2 differente ISP providers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Internal connections&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have several LANs understood as &quot;Users&quot;, &quot;VoIP&quot;, &quot;DMZ&quot; and so on. Each of these LANS have a logical interface in the firewall. This is interface can be unique for the LAN (untagged frames from core to FW) or shared between LANS (FW subinterfaces and tagged frames from core to FW).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In these two scenarios, you need to make again a double cable connection from FW to Cores. For example, if you use X0 for LAN_Users and your VLAN Users have ID 10. Then you need to connect a cable from FW1-X0 to a port in core as acces VLAN 10 and another cable from FW2-X0 to a another port in core as access VLAN 10. No need for STP because you are defining FW as L3 ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best approach in to try to plug every firewal in a different device BUT in the same forwarding plane. I mean, you can have a single device, a stack or a MLAG with VLT/VPC technologies. In the first case, plug the cable to same device. In the other two cases, distribute your cables to different switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;About port-channels, it's an extra link redundancy but in my opinion is unworthy to waste FW ports in this HA scenario. If a device/link fails, it just trigger a FW failover and you will work trought the other Firewall.&lt;/p&gt;&#xA;" OwnerUserId="3949" LastActivityDate="2017-03-31T17:20:01.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40105" PostTypeId="1" AcceptedAnswerId="40138" CreationDate="2017-03-31T17:33:33.277" Score="1" ViewCount="3334" Body="&lt;p&gt;I have a Cisco 3750 switch and I want to make it work with PacketFence NAC. I have configured the switch according to their network configuration document &lt;a href=&quot;https://packetfence.org/doc/PacketFence_Network_Devices_Configuration_Guide.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;, but the switch is still not communicating with the server - I can ping the server and keys are the same.&#xA;Here is my running-config (stripped of non-related things)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 8496 bytes&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa group server radius packetfence&#xA; server name pfnac&#xA;!&#xA;aaa authentication login default local&#xA;aaa authentication dot1x default group packetfence&#xA;aaa authorization exec default local &#xA;aaa authorization network default group packetfence &#xA;!&#xA;!&#xA;aaa server radius dynamic-author&#xA; client 147.32.232.117 server-key 7 0311480E351B3343400E1C172417081E013E&#xA; port 3799&#xA;!&#xA;aaa session-id common&#xA;!&#xA;!&#xA;!&#xA;dot1x system-auth-control&#xA;!&#xA;!         &#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; description 10.D16&#xA; switchport access vlan 40&#xA; switchport mode access&#xA; switchport port-security maximum 1 vlan access&#xA; switchport port-security&#xA; switchport port-security violation restrict&#xA; switchport port-security mac-address 0200.0001.0101&#xA; authentication order dot1x mab&#xA; authentication priority dot1x mab&#xA; authentication port-control auto&#xA; authentication periodic&#xA; authentication timer restart 10800&#xA; authentication timer reauthenticate 7200&#xA; authentication violation replace&#xA; mab      &#xA; no snmp trap link-status&#xA; dot1x pae authenticator&#xA; dot1x timeout quiet-period 2&#xA; dot1x timeout tx-period 3&#xA;!&#xA;interface Vlan40&#xA; ip address 172.16.40.1 255.255.255.0&#xA; no ip proxy-arp&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;snmp-server community lauer RW&#xA;snmp-server community public RO&#xA;snmp-server community private RW&#xA;snmp-server trap-source Vlan40&#xA;snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart&#xA;snmp-server enable traps flowmon&#xA;snmp-server enable traps transceiver all&#xA;snmp-server enable traps call-home message-send-fail server-fail&#xA;snmp-server enable traps tty&#xA;snmp-server enable traps license&#xA;snmp-server enable traps auth-framework sec-violation&#xA;snmp-server enable traps cluster&#xA;snmp-server enable traps config-copy&#xA;snmp-server enable traps config&#xA;snmp-server enable traps config-ctid&#xA;snmp-server enable traps dot1x auth-fail-vlan guest-vlan no-auth-fail-vlan no-guest-vlan&#xA;snmp-server enable traps energywise&#xA;snmp-server enable traps fru-ctrl&#xA;snmp-server enable traps entity&#xA;snmp-server enable traps event-manager&#xA;snmp-server enable traps power-ethernet police&#xA;snmp-server enable traps cpu threshold&#xA;snmp-server enable traps ipsla&#xA;snmp-server enable traps vstack&#xA;snmp-server enable traps bridge newroot topologychange&#xA;snmp-server enable traps stpx inconsistency root-inconsistency loop-inconsistency&#xA;snmp-server enable traps syslog&#xA;snmp-server enable traps vtp&#xA;snmp-server enable traps vlancreate&#xA;snmp-server enable traps vlandelete&#xA;snmp-server enable traps flash insertion removal&#xA;snmp-server enable traps port-security&#xA;snmp-server enable traps port-security trap-rate 1&#xA;snmp-server enable traps envmon fan shutdown supply temperature status&#xA;snmp-server enable traps stackwise&#xA;snmp-server enable traps errdisable&#xA;snmp-server enable traps mac-notification change move threshold&#xA;snmp-server enable traps vlan-membership&#xA;snmp-server host 147.32.232.117 version 2c public  port-security&#xA;snmp-server host 172.16.40.2 v2c &#xA;snmp-server host 172.16.40.2 version 2c write &#xA;!&#xA;radius-server vsa send authentication&#xA;!&#xA;radius server pfnac&#xA; address ipv4 147.32.232.117 auth-port 1812 acct-port 1813&#xA; automate-tester username myuser idle-time 2&#xA; key 7 071A32497D1D0B0A19150E1E372F28362D27&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also here are some other outputs :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show aaa servers&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RADIUS: id 1, priority 1, host 147.32.232.117, auth-port 1812, acct-port 1813&#xA;     State: current UP, duration 633s, previous duration 0s&#xA;     Dead: total time 605813s, count 11&#xA;     Quarantined: No&#xA;     Authen: request 30438, timeouts 30438, failover 0, retransmission 22834&#xA;             Response: accept 0, reject 0, challenge 0&#xA;             Response: unexpected 0, server error 0, incorrect 0, time 0ms&#xA;             Transaction: success 0, failure 7604&#xA;             Throttled: transaction 0, timeout 0, failure 0&#xA;     Author: request 0, timeouts 0, failover 0, retransmission 0&#xA;             Response: accept 0, reject 0, challenge 0&#xA;             Response: unexpected 0, server error 0, incorrect 0, time 0ms&#xA;             Transaction: success 0, failure 0&#xA;             Throttled: transaction 0, timeout 0, failure 0&#xA;     Account: request 0, timeouts 0, failover 0, retransmission 0&#xA;             Request: start 0, interim 0, stop 0&#xA;             Response: start 0, interim 0, stop 0&#xA;             Response: unexpected 0, server error 0, incorrect 0, time 0ms&#xA;             Transaction: success 0, failure 0&#xA;             Throttled: transaction 0, timeout 0, failure 0&#xA;     Elapsed time since counters last cleared: 1w1h2m&#xA;     Estimated Outstanding Access Transactions: 0&#xA;     Estimated Outstanding Accounting Transactions: 0&#xA;     Estimated Throttled Access Transactions: 0&#xA;     Estimated Throttled Accounting Transactions: 0&#xA;     Maximum Throttled Transactions: access 0, accounting 0&#xA;     Requests per minute past 24 hours:&#xA;             high - 0 hours, 30 minutes ago: 20&#xA;             low  - 0 hours, 43 minutes ago: 0&#xA;             average: 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show aaa command handler&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;AAA Command Handler Statistics:&#xA;    account-logon: 0, account-logoff: 0&#xA;    account-query: 0, pod: 0&#xA;    service-logon: 0, service-logoff: 0&#xA;    user-profile-push: 0, session-state-log: 0&#xA;    reauthenticate: 0, bounce-host-port: 0&#xA;    disable-host-port: 0, update-rbacl: 0&#xA;    update-sgt: 0, update-cts-policies: 0&#xA;    invalid commands: 0&#xA;    async message not sent: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show radius statistics&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                  Auth.      Acct.       Both&#xA;         Maximum inQ length:         NA         NA          1&#xA;       Maximum waitQ length:         NA         NA          5&#xA;       Maximum doneQ length:         NA         NA          2&#xA;       Total responses seen:          0          0          0&#xA;     Packets with responses:          0          0          0&#xA;  Packets without responses:       7604          0       7604&#xA;  Access Rejects           :          0&#xA; Average response delay(ms):          0          0          0&#xA; Maximum response delay(ms):          0          0          0&#xA;  Number of Radius timeouts:      30438          0      30438&#xA;       Duplicate ID detects:          0          0          0&#xA; Buffer Allocation Failures:          0          0          0&#xA;Maximum Buffer Size (bytes):        260          0        260&#xA;Malformed Responses        :          0          0          0&#xA;Bad Authenticators         :          0          0          0&#xA;Unknown Responses          :          0          0          0&#xA; Source Port Range: (2 ports only)&#xA; 1645 - 1646&#xA; Last used Source Port/Identifier:&#xA; 1645/180&#xA; 1646/0&#xA;&#xA;  Elapsed time since counters last cleared: 3w3d7h3m&#xA;Radius Latency Distribution:&#xA;&amp;lt;= 2ms :          0          0&#xA;3-5ms  :          0          0&#xA;5-10ms :          0          0&#xA;10-20ms:          0          0&#xA;20-50ms:          0          0&#xA;50-100m:          0          0&#xA;&amp;gt;100ms :          0          0&#xA;&#xA;Current inQ length  : 0&#xA;Current doneQ length: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show radius server-group all&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Server group radius&#xA;    Sharecount = 1  sg_unconfigured = FALSE&#xA;    Type = standard  Memlocks = 1&#xA;    Server(147.32.232.117:1812,1813) Transactions:&#xA;    Authen: 0   Author: 0   Acct: 0&#xA;    Server_auto_test_enabled: TRUE&#xA;     Keywrap enabled: FALSE&#xA;Server group packetfence&#xA;    Sharecount = 1  sg_unconfigured = FALSE&#xA;    Type = standard  Memlocks = 1&#xA;    Server(147.32.232.117:1812,1813) Transactions:&#xA;    Authen: 198 Author: 0   Acct: 0&#xA;    Server_auto_test_enabled: TRUE&#xA;     Keywrap enabled: FALSE&#xA;Server group  private_sg-7560&#xA;    Server(147.32.232.117:1812,1813) Successful Transactions:&#xA;    Authen: 0   Author: 0   Acct: 0&#xA;    Server_auto_test_enabled: TRUE&#xA;    Keywrap enabled: FALSE&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show aaa clients&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Dynamic Author Client 147.32.232.117 &#xA;    CoA: requests: 0, transactions: 0&#xA;        retransmissions: 0, active transactions: 0&#xA;        Ack responses: 0, Nak reponses: 0&#xA;        invalid requests: 0, errors: 0&#xA;    PoD: requests: 0, transactions: 0&#xA;        retransmissions: 0, active transactions: 0&#xA;        Ack responses: 0, Nak reponses: 0&#xA;        invalid requests: 0, errors: 0&#xA;    Average Ack response time: 0 msec&#xA;    Requests per minute past 24 hours:&#xA;        high - 0 hours, 50 minutes ago: 0&#xA;        low  - 0 hours, 50 minutes ago: 0&#xA;        average: 0&#xA;&#xA;Dropped request packets: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show aaa sessions&lt;/strong&gt; (last one)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Session Id: 2293&#xA;   Unique Id: 1864&#xA;   User Name: *not available*&#xA;   IP Address: 0.0.0.0&#xA;   Idle Time: 0&#xA;   CT Call Handle: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;show aaa user all&lt;/strong&gt; (last one)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;--------------------------------------------------&#xA;Unique id 1865 is currently in use.&#xA;  No data for type 0&#xA;  No data for type EXEC&#xA;  No data for type CONN&#xA;  NET: Username=(n/a)&#xA;    Session Id=000008F6 Unique Id=00000749&#xA;    Start Sent=0 Stop Only=N&#xA;    stop_has_been_sent=N&#xA;    Method List=0&#xA;    Attribute list:&#xA;      07B361DC 0 00000001 session-id(408) 4 2294(8F6)&#xA;      07B36210 0 00000001 start_time(418) 4 Mar 31 2017 19:28:40&#xA;--------&#xA;  No data for type CMD&#xA;  No data for type SYSTEM&#xA;  No data for type VRRS&#xA;  No data for type RM CALL&#xA;  No data for type RM VPDN&#xA;  No data for type AUTH PROXY&#xA;  No data for type DOT1X&#xA;  No data for type CALL&#xA;  No data for type VPDN-TUNNEL&#xA;  No data for type VPDN-TUNNEL-LINK&#xA;  No data for type IPSEC-TUNNEL&#xA;  No data for type MCAST&#xA;  No data for type RESOURCE&#xA;  No data for type SSG&#xA;  No data for type IDENTITY&#xA;  No data for type ConnectedApps&#xA;Accounting:&#xA;  log=0x18001&#xA;  Events recorded :&#xA;    CALL START&#xA;    INTERIM START&#xA;    INTERIM STOP&#xA;  update method(s) :&#xA;    NONE&#xA;  update interval = 0&#xA;  Outstanding Stop Records : 0&#xA;  Dynamic attribute list:&#xA;    07B361DC 0 00000001 connect-progress(75) 4 Auth Timeout&#xA;    07B36210 0 00000001 pre-session-time(334) 4 86(56)&#xA;    07B36244 0 00000001 elapsed_time(414) 4 0(0)&#xA;    07B36278 0 00000001 bytes_in(146) 4 0(0)&#xA;    07B362AC 0 00000001 bytes_out(311) 4 0(0)&#xA;    07B39B3C 0 00000001 pre-bytes-in(330) 4 6484(1954)&#xA;    07B39B70 0 00000001 pre-bytes-out(331) 4 2012(7DC)&#xA;    07B39BA4 0 00000001 paks_in(147) 4 0(0)&#xA;    07B39BD8 0 00000001 paks_out(312) 4 0(0)&#xA;    07B39C0C 0 00000001 pre-paks-in(332) 4 25(19)&#xA;    07B33ECC 0 00000001 pre-paks-out(333) 4 18(12)&#xA;Debg: No data available&#xA;Radi: No data available&#xA;Interface:&#xA;  TTY Num = -1&#xA;  Stop Received = 0&#xA;  Byte/Packet Counts till Call Start:&#xA;    Start Bytes In = 4362869       Start Bytes Out = 8971432   &#xA;    Start Paks  In = 26485         Start Paks  Out = 25251     &#xA;  Byte/Packet Counts till Service Up:&#xA;    Pre Bytes In = 4369353       Pre Bytes Out = 8973444   &#xA;    Pre Paks  In = 26510         Pre Paks  Out = 25269     &#xA;  Cumulative Byte/Packet Counts :&#xA;    Bytes In = 4369353       Bytes Out = 8973444   &#xA;    Paks  In = 26510         Paks  Out = 25269     &#xA;  StartTime = 19:28:40 UTC Mar 31 2017&#xA;  Component = Dot1X&#xA;Authen: service=8021X type=EAP method=NONE Fallover-from= RADIUS&#xA;Kerb: No data available&#xA;Meth: No data available&#xA;Preauth: No Preauth data.&#xA;General:&#xA;  Unique Id = 00000749&#xA;  Session Id = 000008F6&#xA;  Attribute List:&#xA;    07B33ECC 0 00000001 port-type(225) 4 Ethernet&#xA;    07B33F00 0 00000081 interface(221) 20 GigabitEthernet1/0/1&#xA;PerU: No data available&#xA;Service Profile: No Service Profile data.&#xA;Unkn: No data available&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Sorry for this much output, bud I will be able to connect to the switch in about two days, so I have tried to get as much info as possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help&lt;/p&gt;&#xA;" OwnerUserId="35496" LastActivityDate="2017-07-01T11:41:37.133" Title="Cisco 3750 switch not communicating with RADIUS server" Tags="|cisco|switch|radius|aaa|" AnswerCount="1" CommentCount="19" ContentLicense="CC BY-SA 3.0" />
  <row Id="40108" PostTypeId="1" CreationDate="2017-03-31T19:58:20.110" Score="4" ViewCount="6633" Body="&lt;p&gt;I just configured logical system but cannot ping between two routers logical and it shows the message: &quot;Can't assign requested address&quot;.&#xA;My configuration is as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set logical-systems r1 interfaces ge-0/0/0 unit 17 vlan-id 17&#xA;set logical-systems r1 interfaces ge-0/0/0 unit 17 family inet address 10.0.17.1/24  &#xA;set logical-systems r7 interfaces ge-0/0/1 unit 17 vlan-id 17&#xA;set logical-systems r7 interfaces ge-0/0/1 unit 17 family inet address 10.0.17.7/24&#xA;set interfaces ge-0/0/0 vlan-tagging&#xA;set interfaces ge-0/0/1 vlan-tagging&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How can I resolve this issue?&lt;/p&gt;&#xA;" OwnerUserId="35684" LastEditorUserId="453" LastEditDate="2018-05-30T08:54:58.833" LastActivityDate="2018-07-07T10:18:48.633" Title="Can't assign requested address in logical system" Tags="|juniper|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="40114" PostTypeId="1" AcceptedAnswerId="40130" CreationDate="2017-04-01T02:19:32.140" Score="1" ViewCount="1409" Body="&lt;p&gt;As part of my internship/thesis, I am looking to implement HSRP in a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The network has 2 separate locations that are connected with a fibre cable (layer 3 to layer 3).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each layer 3 (Cisco 3560-x) is connected to an HP-router that is managed by our ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was thinking about setting up HSRP on one interface of both switches, but I imagine an IP route to the virtual IP address won't work because it is on the same switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Would I be correct to think that in my current configuration, HSRP is only possible on the routers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any other input regarding the issue is welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;extra info:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router 1 IP address is &lt;code&gt;10.10.255.251&lt;/code&gt; and Router 2 IP address is &lt;code&gt;10.10.255.252&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch1 :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA; no switchport&#xA; ip address 10.10.255.253 255.255.255.248&#xA; standby 1 ip 10.10.255.250&#xA; standby priority 110&#xA; exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface FastEthernet0/1&#xA; no switchport&#xA; ip address 10.10.255.254 255.255.255.248&#xA; standby 1 ip 10.10.255.250&#xA; standby priority 110&#xA; exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The reason why I want to do this on the switches is that I can't configure the routers as they are managed by our ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The virtual IP address would be &lt;code&gt;10.10.255.250&lt;/code&gt;, but when this is configured on the switch interfaces, I cannot add an IP route to this virtual IP address because the next hop would be on the same switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also don't see how the Internet traffic would reach the routers in this configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, to repeat the question: am I right in thinking this won't work, or is this possible in a way that I did not try yet?&lt;/p&gt;&#xA;" OwnerUserId="35690" LastEditorUserId="8499" LastEditDate="2018-03-21T01:36:23.280" LastActivityDate="2018-03-21T01:36:23.280" Title="HSRP on switch interfaces" Tags="|cisco|switch|cisco-catalyst|layer3|hsrp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40115" PostTypeId="1" CreationDate="2017-04-01T02:41:48.923" Score="1" ViewCount="62" Body="&lt;p&gt;we can find the maximum packet size by the formula &lt;/p&gt;&#xA;&#xA;&lt;p&gt;packet err rate = 1 - (1 - bit err rate)^(max packet size)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so does this max packet size include the FEC bits?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume this formula gives the max size of packet so it includes all kind of overhead.&lt;/p&gt;&#xA;" OwnerUserId="23142" LastActivityDate="2017-04-01T02:41:48.923" Title="Does increasing the FEC decreases the payload in the maximum packet size?" Tags="|packet-analysis|mtu|packet-loss|ber|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40120" PostTypeId="1" AcceptedAnswerId="40121" CreationDate="2017-04-01T09:07:13.803" Score="1" ViewCount="153" Body="&lt;p&gt;In a datacenter, can I be able to use switches of cisco in some parts and juniper products too ? I mean in the active side ??can I be able to link both to do a single functionality ?&lt;/p&gt;&#xA;" OwnerUserId="35450" LastActivityDate="2017-04-01T09:27:05.393" Title="In a datacenter, can i use the combination of cisco and juniper routers and switches?" Tags="|cisco|switch|router|juniper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40121" PostTypeId="2" ParentId="40120" CreationDate="2017-04-01T09:27:05.393" Score="1" Body="&lt;p&gt;It is certainly possible to mix brands.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are pros and cons to doing so, on the one hand mixing vendors reduces the risk of a single bug taking down everything and puts you in a stronger negotatings position when it comes to buying stuff. On the other hand mixing brands can expose interoperability bugs, may limit the use of some features and requires you to maintain familiarity with both.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-04-01T09:27:05.393" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40125" PostTypeId="1" AcceptedAnswerId="40127" CreationDate="2017-04-01T11:31:48.957" Score="1" ViewCount="846" Body="&lt;p&gt;I have a doubt,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I have understood is that leased line would give full bandwidth for all computers placed in my network (under the firewall) If i am using Leased line connection in my office.&#xA;Which means If i have 10MBps leased line connection in my office  every each system will have full bandwidth 10MBps even if all systems access the internet at once.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If its a 100Mbps Broad Band connection, the 100Mbps bandwidth will be shared for every each systems. lets say some systems will have good speed and some of the systems will have normal speed, and if all the systems access the internet at once the speed will be very low in Broad Band...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this correct ?? If this is correct please gimme some link where i can get the full details or else please give me the clarifications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&#xA;Ansar :)&lt;/p&gt;&#xA;" OwnerUserId="35700" LastActivityDate="2020-10-09T03:50:30.790" Title="Leased line Vs Broad Band connections" Tags="|internet|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40127" PostTypeId="2" ParentId="40125" CreationDate="2017-04-01T11:48:32.757" Score="0" Body="&lt;p&gt;No. The bandwidth is that maximum amount of data that can be sent across a link per second. A 10 Mbps bandwidth on a link means that the aggregate bandwidth of all the hosts using the link is 10 Mbps, and it doesn't matter if the line is leased or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you are confusing terms. In a baseband connection, a frame crossing the link uses the full bandwidth of the link. That is like many forms of ethernet, e.g. 100BASE-TX (the BASE means baseband), where only one device at a time can send a frame. On the other hand, broadband means that there are multiple channels that can simultaneously carry frames across the link, e.g cable TV.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately, the government has ignored these definitions, and it has determined that broadband means any link above a certain bandwidth, but in reality, the bandwidth doesn't determine if a link is baseband or broadband.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, a leased line simply means that you have leased a physical connection from one endpoint to another endpoint. This is typically a private network connection between two of your sites, as opposed to a connection to the public Internet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-01T11:48:32.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40130" PostTypeId="2" ParentId="40114" CreationDate="2017-04-01T18:01:23.597" Score="0" Body="&lt;p&gt;What you seem to be proposing is running HSRP toward the ISP routers in attempt to fool your own routers, but HSRP is a protocol designed to fool LAN hosts, e.g. PCs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On your layer-3 switches, you will have one or more VLANs configured in SVIs. For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;!&#xA;interface Vlan10&#xA; ip address 10.10.10.1 255.255.255.0&#xA;!&#xA;interface Vlan20&#xA; ip address 10.20.20.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Those are the interfaces on which you would configure HSRP to give a redundant gateway to your LAN hosts.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you want redundancy to the ISP routers, you need to do that with routing. You probably have a static default route. For example, assume the ISP routers are &lt;code&gt;10.10.255.249&lt;/code&gt; (primary) and &lt;code&gt;10.10.255.250&lt;/code&gt; (backup):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 10.10.255.249     ! primary route with AD of 1&#xA;ip route 0.0.0.0 0.0.0.0 10.10.255.250 10  ! backup route with AD of 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This establishes two static default routes. A lower AD will be in the routing table unless it goes down, at which point it is removed from the routing table, and the backup route is put into the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is invisible to the hosts because the hosts use the layer-3 switches for their gateways. Hosts don't know or care about the routing; all they care about is that they have a configured gateway, and the gateway is supposed to know how to route traffic toward the destination.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-01T18:01:23.597" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="40138" PostTypeId="2" ParentId="40105" CreationDate="2017-04-02T10:16:25.840" Score="1" Body="&lt;p&gt;Finally got it - the problem was that PacketFence iptables rules were set for RADIUS traffic from management interface, but I had to send it from another one. So adding some iptables rules made it work ! Thanks&#xA;(will accept answer when possible)&lt;/p&gt;&#xA;" OwnerUserId="35496" LastActivityDate="2017-04-02T10:16:25.840" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40140" PostTypeId="1" AcceptedAnswerId="41694" CreationDate="2017-04-02T11:01:18.587" Score="1" ViewCount="5836" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/fKFrK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fKFrK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a problem that Vlans won't communicate with each other. PC in the same Vlan can communicate with each other perfectly fine. I have the following configuration.&#xA; Connections to Switch0:&lt;br&gt;&#xA; - PC0 and PC1 are in VlanA&lt;br&gt;&#xA; - PC2 and PC3 are in VlanB  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC0 ip: 192.168.1.10 subnet: 255.255.255.0 Gateway: 192.168.1.0&#xA;PC1 ip: 192.168.1.20 subnet: 255.255.255.0 Gateway: 192.168.1.0&#xA;PC2 ip: 192.168.2.10 subnet: 255.255.255.0 Gateway: 192.168.2.0&#xA;PC3 ip: 192.168.2.20 subnet: 255.255.255.0 Gateway: 192.168.2.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Connections to Switch1:&lt;br&gt;&#xA; - PC4 and PC5 are in VlanC&lt;br&gt;&#xA; - PC6 and PC7 are in VlanD  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;PC4 ip: 192.168.3.10 subnet: 255.255.255.0 Gateway: 192.168.3.0&#xA;PC5 ip: 192.168.3.20 subnet: 255.255.255.0 Gateway: 192.168.3.0&#xA;PC6 ip: 192.168.4.10 subnet: 255.255.255.0 Gateway: 192.168.4.0&#xA;PC7 ip: 192.168.4.20 subnet: 255.255.255.0 Gateway: 192.168.4.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Switch0 and Switch1 are connected to switch2 by a normal crossover connection. &#xA;SWitch2 and router are in a Router on stick configuration. So fa0/3 of Switch2 is trunk with fa0/0 of router.&lt;br&gt;&#xA;Router Configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router_A(config)#interface fastethernet 0/0  &#xA;Router_A(config-if)#no shutdown  &#xA;Router_A(config-if)#interface fastethernet 0/0.1 &#xA;Router_A(config-subif)#encapsulation dot1q 10  &#xA;Router_A(config-subif)#ip address 192.168.1.0 255.255.255.0  &#xA;Router_A(config-if)#interface fastethernet 0/0.2  &#xA;Router_A(config-subif)#encapsulation dot1q 20  &#xA;Router_A(config-subif)#ip address 192.168.2.0 255.255.255.0&#xA;Router_A(config-if)#interface fastethernet 0/0.3  &#xA;Router_A(config-subif)#encapsulation dot1q 30  &#xA;Router_A(config-subif)#ip address 192.168.3.0 255.255.255.0  &#xA;Router_A(config-if)#interface fastethernet 0/0.4  &#xA;Router_A(config-subif)#encapsulation dot1q 40  &#xA;Router_A(config-subif)#ip address 192.168.4.0 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35708" LastEditorUserId="35708" LastEditDate="2017-04-02T15:44:07.947" LastActivityDate="2017-06-06T00:25:08.470" Title="How to properly connect two swtiches with multiple vlans to another switch and router?" Tags="|cisco|switch|router|vlan|packet-tracer|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40148" PostTypeId="1" CreationDate="2017-04-03T08:49:42.100" Score="0" ViewCount="34" Body="&lt;p&gt;I have a dsl-ac68u DSL router. It has RJ11 and RJ45 plugs. Plug in the wall only has a coaxial output. Can I go around my ISP's router/modem and connect directly my router to the wall? If so, how? Should I get an Coaxial to RJ45 adapter? Please don't laugh at me, if I am not thinking correctly :( ;)&lt;/p&gt;&#xA;" OwnerUserId="35736" LastActivityDate="2017-04-03T09:00:39.937" Title="Trying to connect router to swiss coax plug" Tags="|router|isp|" AnswerCount="1" CommentCount="1" ClosedDate="2017-04-03T12:41:51.500" ContentLicense="CC BY-SA 3.0" />
  <row Id="40149" PostTypeId="2" ParentId="40148" CreationDate="2017-04-03T09:00:39.937" Score="2" Body="&lt;p&gt;You seem to have confused with connectors and the use case where Co-axial to RJ45 adapters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your ISP is providing connection to your home via Co-axial cable then you should get the Modem provided by ISP or any modem which is available at the market which support Coax(Something like Motorola Surfboard series).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you not plan to buy the modem provided by the ISP then you should also check with your ISP whether they will support third party provided supported Modems or not? Technically,the third party modem should work but sometimes ISP refuse the authenticate the third party modems in their ACS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will suggest you to buy/procure the modem provided buy ISP and Connect the Ethernet output of the modem to the WAN port of your ASUS Modem.&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-04-03T09:00:39.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40153" PostTypeId="1" CreationDate="2017-04-03T13:06:19.920" Score="2" ViewCount="3529" Body="&lt;p&gt;So, can I set &lt;code&gt;127.0.0.1&lt;/code&gt; as the default gateway to my router/modem instead &lt;code&gt;192.168.1.1&lt;/code&gt;? If yes, why?&lt;/p&gt;&#xA;" OwnerUserId="35742" LastEditorUserId="8499" LastEditDate="2018-03-09T21:39:54.543" LastActivityDate="2018-03-09T21:39:54.543" Title="Can my default gateway of router be 127.0.0.1?" Tags="|router|ipv4|network|ip-address|loopback|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="40155" PostTypeId="1" AcceptedAnswerId="40231" CreationDate="2017-04-03T13:18:34.657" Score="3" ViewCount="731" Body="&lt;p&gt;How does the receiver determine the length of a PPP frame (not PPPoE or PPPoA)?  &lt;a href=&quot;https://en.wikipedia.org/wiki/Point-to-Point_Protocol#Structure_of_a_PPP_frame&quot; rel=&quot;nofollow noreferrer&quot;&gt;Structure of a PPP frame&lt;/a&gt; shows no length field.  Sure, at the end of the frame there is a 2-byte checksum followed by a magic byte, but that is hardly collision-proof.&lt;/p&gt;&#xA;" OwnerUserId="35743" LastEditorUserId="35743" LastEditDate="2018-07-26T20:40:34.687" LastActivityDate="2018-07-26T20:40:34.687" Title="How is the length of a PPP frame known?" Tags="|layer2|ppp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40156" PostTypeId="2" ParentId="40153" CreationDate="2017-04-03T14:27:34.537" Score="4" Body="&lt;p&gt;No. Any address in the &lt;code&gt;127.0.0.0/8&lt;/code&gt; block can never appear anywhere on any network, nor can any address in that block be used as a source or destination address.&lt;/p&gt;&#xA;&lt;p&gt;The goes back at least as far as &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc990&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 990, ASSIGNED NUMBERS&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The class A network number 127 is assigned the &amp;quot;loopback&amp;quot; function,&#xA;that is, a datagram sent by a higher level protocol to a network 127&#xA;address should loop back inside the host.  No datagram &amp;quot;sent&amp;quot; to a&#xA;network 127 address should ever appear on any network anywhere.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1122#section-3.2.1.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 1122, Requirements for Internet Hosts -- Communication Layers&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;(g)  { 127,  }&lt;/p&gt;&#xA;&lt;p&gt;Internal host loopback address.  Addresses of this form MUST NOT&#xA;appear outside a host.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Also &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3330&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 3330, Special-Use IPv4 Addresses&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;127.0.0.0/8 - This block is assigned for use as the Internet host loopback address.  A datagram sent by a higher level protocol to an&#xA;address anywhere within this block should loop back inside the host.&#xA;This is ordinarily implemented using only 127.0.0.1/32 for loopback,&#xA;but no addresses within this block should ever appear on any network&#xA;anywhere [RFC1700, page 5].&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;By the way, routers that are actually routing shouldn't use the &lt;code&gt;default-gateway&lt;/code&gt; command because they &lt;em&gt;are&lt;/em&gt; the gateways. Instead, they should use a default route.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-04-03T14:27:34.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40161" PostTypeId="1" CreationDate="2017-04-03T19:18:20.443" Score="6" ViewCount="18521" Body="&lt;p&gt;I'm using Wireshark for my project. I sent a ping over to Google.com and Wireshark said that the length was 57 bytes(when I received the reply it was 60 bytes long and it contained 6 bits of padding.&#xA;After I decided to send another packet that Wireshark said was 56 long the reply was 60 bytes long again but the padding contained 8 bits lets say I sent a packet with 42 lengths I received a 60 bytes reply but the padding contained 24 bits.&#xA;I want to know the reason why.&lt;/p&gt;&#xA;" OwnerUserId="35754" LastEditorUserId="30070" LastEditDate="2018-09-15T18:49:06.963" LastActivityDate="2018-09-15T18:49:06.963" Title="Ethernet padding" Tags="|ethernet|wireshark|ping|icmp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="40162" PostTypeId="2" ParentId="22580" CreationDate="2017-04-03T20:10:08.777" Score="0" Body="&lt;p&gt;The compressor assigns &quot;connection numbers&quot; to TCP/IP connections. The compressor and decompressor use these as indexes into a state table to construct the compressed headers and reconstruct the full headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The compression operates at the level of individual point to point links, it sits below the IP layer but above the link level framing. When a packet comes in over a link using header compression it will reconstruct the full header before making any routing descisions. If the outgoing interface also uses header compression it will then attempt to recompress the header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to separate state tables a packet may be compressible on the incoming interface but not the outgoing interface or vice-versa.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-04-03T20:10:08.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40164" PostTypeId="2" ParentId="38538" CreationDate="2017-04-04T00:28:33.557" Score="5" Body="&lt;p&gt;In order to optimize the use of high latency links, receivers avoid acknowledging every single packet. Otherwise in a e.g. 300ms you would only be able to send 3 packets per second. Being 1500 bytes the usual maximum MTU for an Ethernet link you can see how this is not scalable (4.5KB/sec? bring back the 56Kbps modem days!)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how is this issue solved? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Receivers advertise a receive window when negotiating the three way handshake. This receive window is also known as the TCP window. This window is a value in the TCP header that goes from 0 to 64KB. If the receiver advertises a receive window (let me call it RWIN for short from now on) of 64KB on a 300ms link, the sender can send 64KB worth of packets until having to sit waiting for an acknowledgement. This means you might see ~20 sent packets and only one ACK at the end (&lt;strong&gt;this is not accurate&lt;/strong&gt;: You should see at least one ACK every other packet, but you'll see them delayed). Given an unlimited link bandwidth, this combination of link latency and RWIN will let you transfer files up to 192KB/sec. Much better than before, 42 times faster! still not enough for today's links though. There's a byte in the TCP header that specifies a multiplier for the receive window up to 256, which gives you about 50MB receive window.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The above actually explains one of the reasons you don't see one ACK per each received packet, but as you can see there's way more into the RWIN topic and, just so you know, the sender is not always willing to send as much data as possible without waiting for an acknowledgement (e.g the sender application might not have that much to send); so analysing a specific behaviour on this topic might prove tricky.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have also mentioned you see a bunch of ACKs together and as another response said, delayed ACKs might be the reason in some scenarios, although another reason why you'll see a bunch of ACKs seemingly sent together is if the receiver is quick at ingesting the data it has in the receive buffers. The receiver will acknowledge segments before fully filing the receive window, prompting the sender to keep sending data (as the receive window does not fill up). This way once again you can improve the maximum bandwidth you can use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, on the other hand, the receiver is slow at ingesting the data received, the receive window will fill up and the receiver will have to instruct the sender to stop sending data. You would see this reflected on the advertised receive window shrinking during the capture, until it hits zero.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more reason you might see several ACKs seemingly together is Selective Acknowledgement: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the receiver advertised a receive window of 15K, the sender would send 10 packets of 1.5K without waiting for an ACK. Let's imagine the receiver got packets from 1 to 4 and from 6 to 10 - the receiver will start acknowledging those segments received up until #4, at which point it will start explicitly marking the first and last seq number for packets received while acknowledging #4 for every packet received after #5. The sender will realize the receiver has packets 1 to 4 and 6 to 10, but not packet 5, so it will retransmit this (and only this) packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some network analysers might tag this bunch of ACKs as duplicated ACK by looking just at their &quot;ACK&quot; field (always the one from the last received packet) and not the SLE/SRE for first/last seq number acknowledged. &lt;/p&gt;&#xA;" OwnerUserId="444" LastEditorUserId="444" LastEditDate="2017-04-12T23:35:56.357" LastActivityDate="2017-04-12T23:35:56.357" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40166" PostTypeId="2" ParentId="40056" CreationDate="2017-04-04T03:24:13.783" Score="0" Body="&lt;p&gt;Put simply, if you are on the same wireless network the vendor will be using and you search &quot;what is my ip&quot; in a Google search window, you will get a reply with your public IP (also called the outbound NAT IP.  Hopefully there is only one and not a range.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are other sites which will provide you a similar response such as &lt;a href=&quot;https://www.whatismyip.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.whatismyip.com/&lt;/a&gt; but the Google search is a nice easter egg.&lt;/p&gt;&#xA;" OwnerUserId="35275" LastActivityDate="2017-04-04T03:24:13.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40167" PostTypeId="2" ParentId="2658" CreationDate="2017-04-04T03:31:48.983" Score="0" Body="&lt;p&gt;I know, for example Dell's &lt;a href=&quot;http://www.dell.com/support/manuals/us/en/04/force10-s4048-on/S4048_ON_9.9.0.0_Config_Pub-v1/Force10-Resilient-Ring-Protocol-(FRRP)?guid=GUID-28D908FC-E158-403A-819A-6B8ADF0D7B0A&amp;amp;lang=en-us&quot; rel=&quot;nofollow noreferrer&quot;&gt;Force10 Redundant Ring Protocol  (FRRP)&lt;/a&gt; &quot;can converge within 150ms to 1500ms&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco REP (4500 Series Switch Release 12.2(44)SG and later) is advertised to offer these convergence times:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;3750ME converges between 20ms and 79ms&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;ME3400 converges between 40ms and 70ms&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/lanswitch/configuration/xe-3s/lsw-cfg-rep.html#GUID-C9CFA780-2657-47C6-98D2-984F9182B71F&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuration Examples for REP&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gZLPv.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gZLPv.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-04-04T03:31:48.983" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40170" PostTypeId="1" AcceptedAnswerId="40176" CreationDate="2017-04-04T04:49:17.510" Score="2" ViewCount="125" Body="&lt;p&gt;Using Wireshark packet capture, I want to be notified when a new device joins my wifi network. Is it possible to determine this by capturing 802.11 control packets? If so, what filters will let me find this packet?&lt;/p&gt;&#xA;" OwnerUserId="35758" LastActivityDate="2017-05-04T09:24:36.313" Title="Detecting a device joining WLAN" Tags="|ieee-802.11|wireshark|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40172" PostTypeId="2" ParentId="40030" CreationDate="2017-04-04T07:43:11.333" Score="1" Body="&lt;p&gt;If you configured each pair of 4500s as a VSS, then linked them together with an active/LACP port channel you could achieve an all active topology (which is what I assume you are looking for).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would need to ensure that one port from each PortChannel is assigned to each VSS member.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-04-04T07:43:11.333" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40174" PostTypeId="2" ParentId="40170" CreationDate="2017-04-04T07:48:14.380" Score="1" Body="&lt;p&gt;Not really.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Re-associations by existing devices (e.g.: coming out of hibernation, roaming from other APs etc) would appear identical to a new device joining.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Short of writing a display filter that matched associations NOT from existing MACs on your network, this would be very complex to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would be better off tackling this from another perspective - e.g.: monitoring new DHCP leases (since most DHCP servers will maintain MAC-to-IP mappings for existing devices).&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-04-04T07:48:14.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40175" PostTypeId="2" ParentId="40108" CreationDate="2017-04-04T07:54:37.543" Score="2" Body="&lt;p&gt;At first glance it could be one of three things:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, what platform are you testing this on and does it support logical systems?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, do you have interface &lt;code&gt;ge-0/0/0&lt;/code&gt; physically patched to &lt;code&gt;ge-0/0/1&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, are you using the correct command to ping e.g.:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ping logical-system r1 10.0.17.7&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-04-04T07:54:37.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40176" PostTypeId="2" ParentId="40170" CreationDate="2017-04-04T08:24:11.777" Score="1" Body="&lt;p&gt;Every successful connection to Access Point will pass following steps:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Probe&lt;/li&gt;&#xA;&lt;li&gt;Authentication&lt;/li&gt;&#xA;&lt;li&gt;Association/Re-association&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So filtering &lt;strong&gt;Association/Re-association Response&lt;/strong&gt; packets will help to find out connected devices. Consider that these packets are management packets (not control). Following display filter of &lt;code&gt;Wireshark&lt;/code&gt; shows &lt;strong&gt;Association/Re-association Response&lt;/strong&gt; packets:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;wlan.fc.type_subtype == 0x01 || wlan.fc.type_subtype == 0x03&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32227" LastActivityDate="2017-04-04T08:24:11.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40177" PostTypeId="1" AcceptedAnswerId="40184" CreationDate="2017-04-04T08:44:29.110" Score="2" ViewCount="1177" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WaDiW.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WaDiW.jpg&quot; alt=&quot;Vlan&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to connect two Vlans to communicate with the Database server&lt;br&gt;&#xA;I have a Cisco SG200-50 50-port Gigabit Smart Switch&lt;br&gt;&#xA;    The sg200-50 Smart switch is layer two.&lt;br&gt;&#xA;  First vlan ip address range 50.50.50.2&lt;br&gt;&#xA;Second vlan ip address range 192.168.100.1&lt;/p&gt;&#xA;" OwnerUserId="35764" LastActivityDate="2018-02-17T08:27:37.307" Title="How to connect two Vlans to Database server" Tags="|cisco|switch|vlan|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40179" PostTypeId="1" AcceptedAnswerId="40182" CreationDate="2017-04-04T09:55:53.653" Score="0" ViewCount="95" Body="&lt;p&gt;Thanks in advance for the time you will spend helping me.&#xA;I have set up a testing environment with the following structure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    __________                   __________               _____________&#xA;   |          |                 |          |             |             |&#xA;   |Router to | == Ethernet ==&amp;gt; |    PC 1  | == WiFi ==&amp;gt; | Main Modem/ | ==&amp;gt; Internet&#xA;   |configure |                 |          |             | Router      |&#xA;   |__________|                 |__________|             |_____________|&#xA;    192.168.0.1              Eth: 192.168.0.9             192.168.10.254&#xA;                             WiFi: 192.168.10.80&#xA;&#xA;                                         AND&#xA;     _______               ______________________&#xA;    |       |             |                      |&#xA;    |  PC 2 | == WiFi ==&amp;gt; | Main Modem/Router    | ==&amp;gt; Internet&#xA;    |       |             | (the same as before) |&#xA;    |_______|             |______________________|&#xA;    192.168.10.188            192.168.10.254&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to connect to the &quot;Router to Configure&quot; (192.168.0.1) from &quot;PC 2&quot; (192.168.10.118). I already enabled IP Routing on &quot;PC 1&quot; (The one with two NICs) and running &lt;code&gt;ip-config -all&lt;/code&gt; returns &lt;code&gt;Routing IP Enabled: Yes&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then I set up a route on &quot;PC 2&quot; with &lt;code&gt;route add 192.168.0.1 mask 255.255.255.255 192.168.10.80 metric 1&lt;/code&gt; and it returned &lt;code&gt;OK&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If connect to 192.168.0.1 from &quot;PC 1&quot;, it correctly shows the Router configuration page, but it won't work from &quot;PC 2&quot;. So I launched &lt;code&gt;tracert 192.168.0.1&lt;/code&gt; from &quot;PC 2&quot; to see what was going on and the result was:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1  5ms   *    13ms    PC1 [192.168.10.80]&#xA;2  *     *    *       Request timeout&#xA;3  *     *    *       Request timeout&#xA;.&#xA;.&#xA;.&#xA;30  *    *    *       Request timeout&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't know how I can solve it, and I googled many times in vain. There is surely something I miss.&#xA;Being this a testing environment, I have complete access to every router and PC listed above, so I can modify everything needed. If I manage to get this working, I will apply the same structure but with VPN inbetween PCs (which will no longer be on the same network) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope you can help me, and thanks again.&lt;/p&gt;&#xA;" OwnerUserId="35744" LastEditorUserId="35744" LastEditDate="2017-04-04T10:18:08.993" LastActivityDate="2017-04-04T11:53:36.047" Title="Connect to the second NIC of a remote PC and remotely configure router" Tags="|routing|router|ipv4|traceroute|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40180" PostTypeId="2" ParentId="24106" CreationDate="2017-04-04T10:00:59.767" Score="0" Body="&lt;p&gt;You can redistribute default route from EBGP into OSPF, but you should form IBGP neighbor between your uplinks routers and either use local preference or AS_Path to control the the outbound traffic, Below simple setup for this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ISP                        ISP&#xA;|(BGP)                      |(BGP)&#xA;R1                         R2&#xA;|----(my_network/cloud)-----|&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1 ------  IBGP ------------- R2&#xA;R1  ------ OSPF ------------- R2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The scenario will be like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 receive default in EBGP from ISP 1 and redistribute it into OSPF&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As EBGP AD is 20 R1 will install default route from EBGP and keep the redistributed default in the OSPF DB, R2 will receive default from ISP also here you need to modify either set local preference on R1 to ensure all your traffic will go via R1 or Prepend your ISP AS to the incoming default route from the ISP like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map FromISP permit 10&#xA;match ip address 1&#xA;set as-path prepend ISPAS ISPAS ISPAS&#xA;&#xA;router bgp xxx&#xA;neighbour xxxx remote-as xxx&#xA;neighboor xxx route-map FromISP in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now your are receiving 2 Default in 2 routers each router will receive 2 default one from the ISP directly (EBGP) and one from the IBGP neighbour.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on the AS_Path length the router will decide to install one of these defaults routes, R1 will install the one that came from the EBGP because AS-Path length is shorter than that received from the IBGP, R2 will install the default that came from IBGP in the BGP table because it's the AS_Path shorter but will not use it like R1. Why? Because IBGP Administrative distance is 200, OSPF 110 for summary:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 - have 3 Default routes : 1 EBGP 1 IBGP 1 OSFP (redistributed from BGP)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Routing table of BGP will install the one from EBGP , shorter AS path.&lt;/li&gt;&#xA;&lt;li&gt;Routing table of R1 will install the default from EBGP because AD = 20&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;R2 - have 3 Default routes : 1 EBGP 1 IBGP 1 OSFP (redistributed from BGP)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Routing table of BGP will install the one from IBGP , shorter AS path.&lt;/li&gt;&#xA;&lt;li&gt;Routing table of R2 will install the default from OSPF because AD = 110 &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Hope this will help to understand&lt;/p&gt;&#xA;" OwnerUserId="35762" LastEditorUserId="31800" LastEditDate="2017-04-04T12:53:10.353" LastActivityDate="2017-04-04T12:53:10.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40181" PostTypeId="1" AcceptedAnswerId="40189" CreationDate="2017-04-04T11:16:28.327" Score="1" ViewCount="86" Body="&lt;p&gt;For BGP AS relationship, I have the following explanations:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Prefer routes in which the next-hop AS is a customer over routes in which the next-hop is a peer. Prefer routes in which the nexthop AS is a peer over routes in which the next-hop is a provider.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;AS prefers to use customer path, then peer, then provider.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;And I know that peer-to-peer means two entities agree to provide free routing service to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But I still cannot understand above explanations well. Please give me an example to explain it.&lt;/p&gt;&#xA;" OwnerUserId="22125" LastEditorUserId="22125" LastEditDate="2017-04-05T01:46:44.147" LastActivityDate="2017-04-05T01:46:44.147" Title="Explain BGP AS relationship" Tags="|routing|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40182" PostTypeId="2" ParentId="40179" CreationDate="2017-04-04T11:53:36.047" Score="1" Body="&lt;p&gt;Very strange topology... However in my opinion you have to add route on &quot;Router to configure&quot; for 192.168.10.X network pointing to PC1 ( 192.168.0.9). &lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-04-04T11:53:36.047" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40183" PostTypeId="2" ParentId="40177" CreationDate="2017-04-04T12:26:21.733" Score="-1" Body="&lt;p&gt;There are 4 mandatory steps:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) Create the vlans&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vlan 10&#xA;Vlan 20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2) Create vlan interfaces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int vlan 10&#xA;ip add 50.50.50.1/24 &#xA;int vlan 20 &#xA;192.168.100.1/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;3) Assign relevant interfaces to correct vlan. E.g. lets imagine fa0/1 is pointing to PC0 ( vlan 1).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int fa0/1 &#xA;switchport mode access &#xA;switchport access vlan 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;4) Enable &lt;code&gt;ip routing&lt;/code&gt; on the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NOTE:&lt;/strong&gt; Do not forget to put a default GW on the PCs pointing to the address of the switch in the respective vlan. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;E.g. If PC0 is in vlan 10 following setting will be fine:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP 192.168.100.10 &#xA;SM 255.255.255.0&#xA;GW 192.168.10.1 ( IP of the SW in VLAN 10)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="25563" LastEditorUserId="32227" LastEditDate="2017-04-04T12:52:40.440" LastActivityDate="2017-04-04T12:52:40.440" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40184" PostTypeId="2" ParentId="40177" CreationDate="2017-04-04T12:35:28.083" Score="3" Body="&lt;p&gt;In order to cross from one subnet (layer 3 boundary) to another, you need a router.  The SG200 is a layer 2 only switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also consider putting all your devices into one VLAN, although with the limited information you've provided, I can't recommend that for sure.  &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-04T12:35:28.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40185" PostTypeId="2" ParentId="40161" CreationDate="2017-04-04T12:38:08.537" Score="9" Body="&lt;p&gt;&lt;code&gt;IEEE 802.3&lt;/code&gt; describes structure of &lt;code&gt;Ethernet&lt;/code&gt; frames. As it says the minimum frame length is 64 bytes. Every frame less than 64 bytes should be padded with 0 before transmitted on the &lt;code&gt;Ethernet&lt;/code&gt; link. This padding is done by &lt;code&gt;Ethernet&lt;/code&gt; network card adapter so you see 60 bytes frame only in received frames. In fact Wireshark capture transmitting frames before they leave the OS and entering the network adapter, i.e before padding process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that Wireshark omits the 4 last bytes of frame names FCS (Frame Check Sequence) which is used to detect corrupted frames. Thus you see 60 bytes instead of 64 bytes.&lt;/p&gt;&#xA;" OwnerUserId="32227" LastActivityDate="2017-04-04T12:38:08.537" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40189" PostTypeId="2" ParentId="40181" CreationDate="2017-04-04T15:27:56.587" Score="2" Body="&lt;p&gt;These are typical routing policies used by providers based on a business decision.  Customers pay you money.  Peers are free (generally speaking).  Providers cost you money.  Thus, if you receive the same prefix from all three connections, you would have a routing policy (local-pref) to prefer the customer connection over the peer connection, and the peer connection over the provider connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The more bandwidth used on the customer connection, the more the customer has to pay you.  The more bandwidth you use on the provider connection, the more you have to pay the provider.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2017-04-04T15:27:56.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40190" PostTypeId="1" AcceptedAnswerId="40192" CreationDate="2017-04-04T16:25:55.020" Score="1" ViewCount="1263" Body="&lt;p&gt;I have searched and am having a hard time understanding VLANs, as I am jsut getting into networking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My Question: If you create a VLAN with a Class-C like 192.168.1 and another VLAN with 192.168.2 can each VLAN contain its own 256 addresses giving my 192 network 528 addresses total? Or, will the routing only hand out a maximum of 256 total and split them between the 2 VLANs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I understand class-c=256 and class-b=@65000, but does a vlan not abide by those rules entirely?&lt;/p&gt;&#xA;" OwnerUserId="35772" LastActivityDate="2017-04-04T17:30:28.097" Title="Can Class-C VLAN have more than 256 addresses?" Tags="|vlan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40191" PostTypeId="2" ParentId="40190" CreationDate="2017-04-04T16:56:47.990" Score="1" Body="&lt;p&gt;A VLAN is a layer 2 concept and provides isolation on that layer. IP addresses are a layer 3 concept, so there's no concept of &quot;number of usable IP addresses you could have in a VLAN&quot;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you've meant subnets, you can have subnets much bigger than /24 (what you call Class-C, terminology which is deprecated) or smaller, as you please.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As closure, you can have more than one subnet in the same VLAN; but people tend to use VLANs to isolate subnets that share physical equipment or a layer 2 domain.&lt;/p&gt;&#xA;" OwnerUserId="444" LastActivityDate="2017-04-04T16:56:47.990" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40192" PostTypeId="2" ParentId="40190" CreationDate="2017-04-04T17:30:28.097" Score="1" Body="&lt;p&gt;VLANs are layer 2 constructs.  Subnets are layer 3 constructs.  While normally there is a 1:1 correspondence between VLANs and subnets, it isn't always the case.  You can have multiple subnets per VLAN or a subnet that spans multiple VLANs.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, you have identified two VLANs and two subnets.  Your DHCP server will hand out addresses for each subnet based on the subnet size. Your network (meaning all the subnets under your control) will have as many possible addresses as the sum of all the addresses on all your subnets.  That is independent of the number of VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an aside, classful addressing is obsolete, and has been since before you were born. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-04T17:30:28.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40193" PostTypeId="1" CreationDate="2017-04-04T17:40:27.020" Score="0" ViewCount="771" Body="&lt;p&gt;I want to connect our branch office to main office with VPN, but I have following constraints:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;branch office is behind dynamic IP and NAT&lt;/li&gt;&#xA;&lt;li&gt;main office has static Public IP available for this purpose&lt;/li&gt;&#xA;&lt;li&gt;clients on branch office should access internet directly, and only needed internal resources through VPN&lt;/li&gt;&#xA;&lt;li&gt;several subnets on main office need to be accessible to clients on branch office (through routing)&lt;/li&gt;&#xA;&lt;li&gt;two VLANs (where one is for VoIP) need to be bridged across offices completely transparently&lt;/li&gt;&#xA;&lt;li&gt;VPN device on branch office should be, as much as possible, maintenance free &lt;em&gt;&quot;set and forget&quot;&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;we prefer open source approach whenever possible&lt;/li&gt;&#xA;&lt;li&gt;expected bandwidth usage for this connection is not much (e.g. 10 Mbit or less)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Can this be done with OpenVPN?&lt;/p&gt;&#xA;" OwnerUserId="35775" LastEditorUserId="2142" LastEditDate="2017-04-04T17:46:31.403" LastActivityDate="2017-08-09T16:06:54.633" Title="Selecting VPN for transparent site to site VLAN bridging" Tags="|vlan|vpn|layer2|" AnswerCount="1" CommentCount="4" ClosedDate="2018-07-25T00:51:07.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="40199" PostTypeId="2" ParentId="40085" CreationDate="2017-04-04T21:48:52.670" Score="1" Body="&lt;p&gt;Mr.lock is correct - I would only add that no - enabling uplink ports on the EX4200 does not disable the last 4 fixed ports as it does on the EX3200.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-04-04T21:48:52.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40201" PostTypeId="1" AcceptedAnswerId="40205" CreationDate="2017-04-04T23:23:22.543" Score="1" ViewCount="1080" Body="&lt;p&gt;I see that regular IOS &amp;amp; NX-OS &amp;amp; ASR(IOS-XE) have different ways of setting out-of-band management interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below is brief config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping my immediate default gw but can't ping anything outside of my vlan/subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help appreciated, thanks!&lt;/p&gt;&#xA;&#xA;#&#xA;&#xA;#&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:ios#show run&#xA;Tue Apr  4 16:17:55.079 UTC&#xA;Building configuration...&#xA;!! IOS XR Configuration 5.3.3&#xA;!! Last configuration change at Tue Apr  4 15:58:22 2017 by admin&#xA;!&#xA;vrf mgmt&#xA;!&#xA;interface MgmtEth0/RSP0/CPU0/0&#xA; ipv4 address 10.7.0.38 255.255.255.0&#xA;!&#xA;interface MgmtEth0/RSP0/CPU0/1&#xA; shutdown&#xA;!&#xA;!&#xA;router static&#xA; address-family ipv4 unicast&#xA;  0.0.0.0/8 10.7.0.1&#xA; !&#xA; vrf mgmt&#xA;  address-family ipv4 unicast&#xA;   0.0.0.0/0 10.7.0.1&#xA;  !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;#&#xA;&#xA;#&#xA;" OwnerDisplayName="user10221" LastActivityDate="2017-04-05T03:23:01.377" Title="ASR-9K (vrf route and mgmt)" Tags="|cisco-asr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40202" PostTypeId="1" CreationDate="2017-04-05T00:18:56.110" Score="1" ViewCount="746" Body="&lt;p&gt;I have just had a cisco 200-26 smart switch with 24 ports. I have set the IP of VLAN1 (also management Lan) to &lt;code&gt;192.168.1.254&lt;/code&gt;. All ports except port 10 and 11 are assigned to VLAN1. Furthermore, I have created another VLAN with id VLAN2 and this VLAN is getting IP from DHCP server of my university network and the internet comes through the university network. The VLAN2 is using IP's from the range &lt;code&gt;10.103.72.x&lt;/code&gt;. What I want to accomplish here is that, I have a full &lt;code&gt;192.168.1.xx&lt;/code&gt; network behind VLAN1 and only requirement is that it should be passing the internet traffic to VLAN2 and getting the results back to the relevant devices in VLAN1.&lt;br&gt;&#xA;For VLAN2, I have already done port to vlan mapping and assigned them port 10 and 11 with &lt;code&gt;trunk&lt;/code&gt; and &lt;code&gt;untagged&lt;/code&gt; settings.&lt;br&gt;&#xA;It seems what I am trying to do is really simple but I am sort of a newbie in networking and don't know much about network configurations. Please also guide me how to make the required configuration through web ui. I am not really into the command line interface of cisco switches.&lt;br&gt;&#xA;Regards&lt;/p&gt;&#xA;" OwnerUserId="35782" LastEditorUserId="8499" LastEditDate="2018-05-07T02:40:07.013" LastActivityDate="2018-10-04T05:00:18.330" Title="Accessing Internet from a different VLAN. Cisco 200-26" Tags="|cisco|routing|switch|vlan|bridge|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40203" PostTypeId="2" ParentId="40009" CreationDate="2017-04-05T00:30:57.287" Score="1" Body="&lt;p&gt;You need to use Juniper's Per-Service Session Accounting.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a nutshell, this involves defining services using a firewall filter, applying those services per subscriber, then the MX will send independent RADIUS Accounting updates for each service per subscriber.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your case, you would define a VoD or generic unmetered service, with an firewall filter matching your VoD server and any other local resources you don't wish to count, and then apply this as a service to each of your subscribers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would then have a second service applied covering all other traffic, and this is what you would actually count.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NE StackExchange discourages linking to other sites due to link rot, but search for &quot;Junos Configuring Per-Service Session Accounting&quot;&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-04-05T00:30:57.287" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40204" PostTypeId="2" ParentId="40202" CreationDate="2017-04-05T00:36:34.810" Score="1" Body="&lt;p&gt;What you need is a router. Routers route traffic between networks, but layer-2 switches (what your switch is) do not. VLANs keep the networks separate, and to get traffic from one VLAN to another VLAN, you need a layer-3 device (router or layer-3 switch).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your router will need a route, probably a static default route, for the interface toward the bigger network, and the router on the bigger network will need a route to the network behind your router. The easiest way to do this is to share a routing protocols with the router on the bigger network. That way, both routers can tell each other the networks about which they know. You really want fixed IP addresses for your router interfaces, if it is at all possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your switch, you only use trunk interfaces for links that will have multiple VLANs crossing them. You tag the frames on a trunk link so that the switch on the other end can tell which frames belong to which VLANs. You could have one native (untagged) VLAN on a trunk, but all the other VLANs on the trunk will be tagged. Native VLANs can be a security problem, as can VLAN 1, so the recommendation is to not use native VLANs or VLAN 1.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-05T00:36:34.810" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40205" PostTypeId="2" ParentId="40201" CreationDate="2017-04-05T03:23:01.377" Score="3" Body="&lt;p&gt;You have a typo in your route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.0.0.0/8 10.7.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;should be &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;0.0.0.0/0 10.7.0.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-04-05T03:23:01.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40206" PostTypeId="1" AcceptedAnswerId="40207" CreationDate="2017-04-05T05:00:57.790" Score="2" ViewCount="1983" Body="&lt;p&gt;Trying to enable ssh on ASR-9K via vrf management interface.&#xA;Doesn't seem as straight forward as regular IOS or NX-OS.&#xA;Help appreciated.&lt;/p&gt;&#xA;&#xA;#&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:asr#show run&#xA;Tue Apr  4 21:54:55.407 UTC&#xA;Building configuration...&#xA;!! IOS XR Configuration 5.3.3&#xA;!! Last configuration change at Tue Apr  4 17:55:46 2017 by admin&#xA;!&#xA;hostname asr&#xA;domain name cislab.com&#xA;username su&#xA; password 7 32221112255&#xA;!&#xA;vrf mgmt&#xA;!&#xA;line default&#xA; transport input ssh&#xA;!&#xA;ipv4 access-list 10&#xA; 10 permit ipv4 any any&#xA;!&#xA;interface MgmtEth0/RSP0/CPU0/0&#xA; vrf mgmt&#xA; ipv4 address 10.7.0.38 255.255.255.0&#xA;!&#xA;interface MgmtEth0/RSP0/CPU0/1&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0/0/0&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0/0/1&#xA; shutdown&#xA;!&#xA;interface TenGigE0/0/2/2&#xA; shutdown&#xA;!&#xA;interface TenGigE0/0/2/3&#xA; shutdown&#xA;!&#xA;router static&#xA; vrf mgmt&#xA;  address-family ipv4 unicast&#xA;   0.0.0.0/0 10.7.0.1&#xA;  !&#xA; !&#xA;!&#xA;ssh server vrf default&#xA;end&#xA;RP/0/RSP0/CPU0:asr#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;#&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RP/0/RSP0/CPU0:asr#show ssh sess de&#xA;Tue Apr  4 22:16:49.281 UTC&#xA;SSH version : Cisco-2.0 &#xA;&#xA;id  key-exchange  pubkey  incipher  outcipher  inmac   outmac &#xA;-------------------------------------------------------------------&#xA;Incoming Session &#xA;&#xA;Outgoing connection &#xA;RP/0/RSP0/CPU0:asr#show log&#xA;&#xA;RP/0/RSP0/CPU0:asr#show tcp br&#xA;Tue Apr  4 22:18:30.424 UTC&#xA;   PCB     VRF-ID     Recv-Q Send-Q Local Address          Foreign Address        State&#xA;0x50255d30 0x60000002      0      0  :::22                  :::0                   LISTEN&#xA;0x502554ac 0x00000000      0      0  :::22                  :::0                   LISTEN&#xA;0x50255b60 0x60000002      0      0  0.0.0.0:22             0.0.0.0:0              LISTEN&#xA;0x50195484 0x00000000      0      0  0.0.0.0:22             0.0.0.0:0              LISTEN&#xA;RP/0/RSP0/CPU0:asr#&#xA;&#xA;&#xA;RP/0/RSP0/CPU0:asr#show log | incl ssh&#xA;Tue Apr  4 22:18:53.668 UTC&#xA;RP/0/RSP0/CPU0:Apr  4 17:45:08.766 : SSHD_[65766]: %SECURITY-SSHD-6-INFO_GENERAL : no matching kex found: client ssh-rsa server ssh-dss &#xA;RP/0/RSP0/CPU0:Apr  4 17:46:41.377 : SSHD_[65857]: %SECURITY-SSHD-6-INFO_GENERAL : no matching kex found: client ssh-rsa server ssh-dss &#xA;RP/0/RSP0/CPU0:Apr  4 17:47:26.352 : SSHD_[65766]: %SECURITY-SSHD-6-INFO_GENERAL : no matching kex found: client ssh-rsa server ssh-dss &#xA;RP/0/RSP0/CPU0:asr#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user10221" LastEditorDisplayName="user10221" LastEditDate="2017-04-05T05:22:36.250" LastActivityDate="2017-04-06T17:29:50.757" Title="SSH V2 on ASR-9K" Tags="|cisco-asr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40207" PostTypeId="2" ParentId="40206" CreationDate="2017-04-05T05:14:05.700" Score="3" Body="&lt;p&gt;You configured the SSH server to be active in the default vrf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh server vrf default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So changing the vrf should help:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh server vrf mgmt&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If that doesn't help, please consider adding more information to your question like debugging results and log messages. &quot;Doesn't seem as straight forward&quot; doesn't explain the exact problem you're running into very well.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-04-05T05:14:05.700" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40212" PostTypeId="1" CreationDate="2017-04-05T11:30:53.687" Score="1" ViewCount="2110" Body="&lt;p&gt;What is difference between QinQ  and selective QinQ ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We need to configure selective QinQ  VLAN trunk between our setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help in selective QinQ . &lt;/p&gt;&#xA;" OwnerUserId="33680" LastEditorUserId="8499" LastEditDate="2019-01-04T06:14:19.510" LastActivityDate="2019-01-04T06:14:19.510" Title="QinQ and selective QinQ" Tags="|vlan|trunk|qinq|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40217" PostTypeId="1" AcceptedAnswerId="40816" CreationDate="2017-04-05T13:58:02.773" Score="3" ViewCount="1180" Body="&lt;p&gt;I've managed to get QinQ subscriber management working. Now I want to shape / police both VLAN connections. As a test I have configured this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DYNINTF-STACKED-KANTOOR-TEST {&#xA;    interfaces {&#xA;        &quot;$junos-interface-ifd-name&quot; {&#xA;            unit &quot;$junos-interface-unit&quot; {&#xA;                proxy-arp restricted;&#xA;                vlan-tags outer &quot;$junos-stacked-vlan-id&quot; inner &quot;$junos-vlan-id&quot;;&#xA;                filter {&#xA;                    input &quot;$junos-input-filter&quot;;&#xA;                    output &quot;$junos-output-filter&quot;;&#xA;                }&#xA;                family inet {&#xA;                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;}&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The filter:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show firewall filter 17Mb &#xA;term test {&#xA;    then policer 17Mb-policer;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And at last, the policer:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policer 17Mb-policer {&#xA;    if-exceeding {&#xA;        bandwidth-limit 17m;&#xA;        burst-size-limit 1m;&#xA;    }&#xA;    then discard;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If I for example configure police-17M on both input and output filter hierarchy in the dynamic profile then it works fine:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IPv4 Input Filter Name: police-17M-ge-1/1/4.1073936801-in&#xA;IPv4 Output Filter Name: police-17M-ge-1/1/4.1073936801-out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But this is not the way it should be.. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;UPDATE&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I now receive on the Juniper:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Apr  7 12:16:58.908497 radius-access-accept: Ingress-Policy-Name (Juniper-ERX-VSA) received: police-17M&#xA;Apr  7 12:16:58.908552 radius-access-accept: Egress-Policy-Name (Juniper-ERX-VSA) received: police-17M&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, showing this subscriber in extensive mode, I don't see it being applied to the dynamic interface. Any idea why?&lt;/p&gt;&#xA;" OwnerUserId="20112" LastEditorUserId="20112" LastEditDate="2017-04-07T12:25:35.373" LastActivityDate="2018-03-22T10:17:50.890" Title="Juniper Dynamic Subscriber Management Traffic Policing" Tags="|juniper|juniper-junos|policing|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40219" PostTypeId="2" ParentId="40212" CreationDate="2017-04-05T14:06:17.213" Score="3" Body="&lt;p&gt;QinQ is a method to tag already tagged frames with an outer frame. It is like a layer-2 tunneling on a trunk. Selective QinQ allows you to tag some of the tagged frames, but not others.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-05T14:06:17.213" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40221" PostTypeId="1" AcceptedAnswerId="40224" CreationDate="2017-04-05T14:12:23.627" Score="1" ViewCount="1013" Body="&lt;p&gt;In my Network are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client 1: Victim &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client 2: Attacker (Raspberry Pi)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Client 3: My Computer (SSH to Raspberry)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All Clients are connected wireless to the router.&#xA;All Clients are registered at the Router (IP/MAC bind)&#xA;Router is set to accept connection only from registered Clients.&#xA;Router has DHCP enabled.&#xA;Programm used: dsniff/arpspoof&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I arpsoofed client 1 and set Client 2 to act as MITM and forwarded the traffic. As soon as router refreshes arp tables it works.&#xA;After 5-10 minutes the router assign a new IP to Client 1 and forgot the old IP Adress.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got 2 questions now:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is IP/MAC binding for when its easy to manipulate one client to use multiple IPs and router accepting it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is it possible that the spoofed client 1 who shouldnt have any communication with the router directly is given a new IP after some time?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is for education purposes only!&#xA;Thank you !&lt;/p&gt;&#xA;" OwnerUserId="35796" LastActivityDate="2017-09-03T11:33:35.397" Title="Specific questions regarding Arp/DHCP" Tags="|dhcp|arp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40224" PostTypeId="2" ParentId="40221" CreationDate="2017-04-05T14:54:15.373" Score="0" Body="&lt;p&gt;What you are describing is more about network disruption than information stealing. Also, clients don't register with routers, and DHCP is gratuitous in the situation you describe because the DHCP server plays no part in the situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There really isn't any such thing as IP/MAC binding they way you may think. You need to understand the network layers. Layer-2 is the local LAN, and all traffic on the local LAN is delivered directly from one host to another host by the LAN, e.g. MAC, address. Some layer-2 protocols use MAC addresses (either 48-bit or 64-bit MAC addresses), and some do not. Layer-3 is the network, and layer-3 protocols use layer-3, e.g. IP, addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order for one host on the LAN to send traffic to another host on the LAN, the host needs to &lt;em&gt;resolve&lt;/em&gt; the destination layer-3 address into the destination layer-2 address in order to build a frame. That is where ARP (Address &lt;em&gt;Resolution&lt;/em&gt; Protocol) comes in.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ARP maintains a table for translating layer-3 to layer-2 addresses. The entries in this table usually time out, but that depends on the OS. To get or update an entry in its ARP table, a host will use ARP requests. A host will also update its ARP table from any traffic it sees on the LAN. That means that when the victim sends out any traffic that the other hosts see, they will update their ARP tables with the new information. This could be the victim sending its own ARP request to discover the layer-2 address of another host, a gratuitous ARP, unknown unicast traffic, or unicast traffic to another host that updates it ARP table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is also something else to consider if this is a switched ethernet LAN. Ethernet switches maintain MAC address tables (not to be confused with ARP tables) to resolve the MAC address to an interface where the MAC address was last seen. A switch will update its MAC address table with a frame's source MAC address every time a frame comes into the switch, and it will use the MAC address table to determine to which switch interface it will send the frame with the destination MAC address. If the destination MAC address is not in its MAC address table, the switch will flood the frame to all the switch interfaces, except the one where the frame entered the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, put it all together. If a malicious host tries to hijack a MAC address, it will only be temporary because the ARP tables in the other hosts will update, and the switch will constantly change the interface to which it delivers frames with that destination MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A real man-in-the-middle attack needs to happen on a link through which traffic must pass, but that is not the case on most LANs since traffic on LANs is passed directly from host-to-host, not through a single point.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-05T14:54:15.373" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40227" PostTypeId="2" ParentId="40217" CreationDate="2017-04-05T18:11:53.617" Score="0" Body="&lt;p&gt;You can check if the counters of the policer are increasing:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;show policer | match interface &quot;ge-1/1/4&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-04-05T18:11:53.617" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40228" PostTypeId="1" CreationDate="2017-04-05T19:16:31.613" Score="1" ViewCount="221" Body="&lt;p&gt;I'm new to centos and networks and I was reading documents about how to use direct commands on centos7 firewall-cmd using &lt;code&gt;man 1 firewall-cmd&lt;/code&gt; I saw this line:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The first argument of each option has to be ipv4 or ipv6 or eb. With ipv4 it will be for IPv4 (iptables(8)), with ipv6 for IPv6 (ip6tables(8)) and with eb&#xA;         for ethernet bridges (ebtables(8)).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Can somebody explain simply what eb(ethernet bridge) is and give me a vision to its usage as a result I could know when should I use eb rather than ip if I want to setup my firewall rules on a correct format.&lt;/p&gt;&#xA;" OwnerUserId="15565" LastEditorUserId="8499" LastEditDate="2017-04-05T19:23:52.117" LastActivityDate="2017-04-05T21:07:24.717" Title="What is EB (Ethernet Bridge)?" Tags="|ethernet|bridge|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ClosedDate="2017-04-06T07:05:35.370" ContentLicense="CC BY-SA 3.0" />
  <row Id="40229" PostTypeId="2" ParentId="40228" CreationDate="2017-04-05T19:23:00.177" Score="2" Body="&lt;p&gt;An ethernet bridge bridges two ethernet segments at layer-2. An ethernet switch is an ethernet bridge, it just usually has a lot more interfaces than a simple bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bridges operate at layer-2, so they do not know or care about the layer-3 (IPv4, IPX, IPv6, AppleTalk, etc.) or layer-4 (TCP, UDP, etc.) protocols being carried by the layer-2 protocols being bridged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A bridge will use spanning tree to create a loop-free layer-2 path, and it will maintain a MAC address table in order to be able to know out which interface each MAC address on the LAN is. That lets the bridge send traffic directly to where it needs to go, eliminating the wasteful flooding of frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some bridges can use VLANs and trunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Transparent bridges, e.g. ethernet switches, bridge like-to-like LANs, and they do not modify the frames (except maybe to add a VLAN tag on a trunk link) or the frame payloads. Translating bridges, e.g. Wi-Fi APs, will need to modify the frames in order to translate from one LAN protocol to another LAN protocol, e.g. ethernet to Wi-Fi.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-04-05T19:28:45.153" LastActivityDate="2017-04-05T19:28:45.153" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40230" PostTypeId="1" CreationDate="2017-04-05T19:53:53.327" Score="1" ViewCount="721" Body="&lt;p&gt;can you explain in DHCP dora process &#xA;how discover ,offer, request and ack massages send on L2 ? i know all 4 massages will be broadcast on L3 but on L2 how they will transfer (unicast or broadcast)&lt;/p&gt;&#xA;" OwnerUserId="35807" LastEditorUserId="36720" LastEditDate="2017-12-02T08:58:59.823" LastActivityDate="2017-12-02T08:58:59.823" Title="DHCP dora process on L2" Tags="|ipv4|dhcp|" AnswerCount="2" CommentCount="2" ClosedDate="2019-01-24T23:12:18.350" ContentLicense="CC BY-SA 3.0" />
  <row Id="40231" PostTypeId="2" ParentId="40155" CreationDate="2017-04-05T20:08:18.980" Score="3" Body="&lt;p&gt;The PPP header starts with a 16-bit protocol id. You need to look at that first in order to know how to interpret the rest.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the protocol id is LCP/IPCP/IPv6CP then the header structure typically looks like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;struct PPP {&#xA;    uint16_t protocolId;&#xA;    uint8_t code;&#xA;    uint8_t identifier;&#xA;    uint16_t length; // &amp;lt;= network-encoded length field&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the protocol id is IPv4 or IPv6 then the IP header comes immediately after the protocol id. Both IPv4 and IPv6 have a length field in their headers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not familiar with HDLC frames, but I assume you are receiving them from a socket. The socket read/receive function would provide you with the size of each incoming frame. So you can use that for validation purposes as well.&lt;/p&gt;&#xA;" OwnerUserId="15769" LastEditorUserId="15769" LastEditDate="2017-04-05T20:21:31.923" LastActivityDate="2017-04-05T20:21:31.923" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40232" PostTypeId="2" ParentId="40228" CreationDate="2017-04-05T20:55:29.693" Score="2" Body="&lt;p&gt;Basically your linux machine can act as:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;a server, accepting traffic that will be passed to an application, like a web server. In this scenario &lt;code&gt;iptables&lt;/code&gt; are used to filter which services are accessible from which machines&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;a router, transferring network traffic from an IP network to another IP network. In this case, &lt;code&gt;iptables&lt;/code&gt; are used to filter which traffic is allowed to pass, based typically on IP source and destination, protocols (UDP, TCP, ICMP...) and ports &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;a switch, transferring network traffic from an ethernet segment to another ethernet segment, in the same way as a network switch. In this case you will use &lt;code&gt;ebtables&lt;/code&gt; to filter traffic based, for example on source and destination mac address. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This last case is less common, since hardware network switches are inexpensive and more efficient to do it. The most common use case I can think of is when the machine is an hypervisor and you bridge the physical network interface card (NIC) with virtual network interface (VIF) of virtual machines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note in all this case there's more advanced use of ip/eb tables like logging, NAT, QoS, MSS Clamping etc...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must first define what you want to achieve and then select the proper tool to do it.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-04-05T21:07:24.717" LastActivityDate="2017-04-05T21:07:24.717" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40235" PostTypeId="2" ParentId="40230" CreationDate="2017-04-05T23:51:57.897" Score="0" Body="&lt;p&gt;ARP (Address Resolution Protocol) is what is used to resolve a layer-3 address to a layer-2 address. The ARP process for a host will send out an ARP request to get the layer-2 address for a layer-3 address. When you have a layer-3 broadcast address, that will not work because no host will claim the layer-3 broadcast address. That means that when you broadcast at layer-3, you must broadcast at layer-2 because it is not possible to resolve a layer-3 broadcast address to a layer-2 unicast address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, there are variation of DHCP where only some of the DHCP messages are broadcast. Unfortunately, protocols above OSI layer-4, e.g. DHCP, are explicitly off-topic here.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-05T23:51:57.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40239" PostTypeId="2" ParentId="37802" CreationDate="2017-04-06T00:26:04.357" Score="1" Body="&lt;p&gt;There is no such thing as a bad TCP packet, unless you are expecting to find a packet corrupted on its way to your capture point, in which case the NIC might drop it before sending it up to the OS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The string you've shared it just means one party tried to connect to the remote party and never received a response, so this is what you want to look for in Wireshark:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Assume 1.2.3.4 is the client and 4.3.2.1 is the server)&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A SYN packet (tcp.flags.syn == 1) from client to server (ip.src == 1.2.3.4 &amp;amp; ip.dst == 4.3.2.1) that it has been retransmitted (tcp.analysis.retransmission)&lt;/li&gt;&#xA;&lt;li&gt;When you have located it, right-click on that packet and select &quot;Follow TCP stream&quot;. Close the pop up window you'll get with the raw contents of the connection.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;You'll be left with a filter on a specific tcp stream and you might see this behaviour:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A SYN packet is sent&lt;/li&gt;&#xA;&lt;li&gt;A second SYN packet is sent 3 seconds later&lt;/li&gt;&#xA;&lt;li&gt;A third SYN packet is sent 6 seconds later&lt;/li&gt;&#xA;&lt;li&gt;A fourth SYN packet is sent 12 seconds later&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And you might never see a packet coming from 4.3.2.1 to 1.2.3.4;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your real problem might be:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A firewall in the path.&lt;/li&gt;&#xA;&lt;li&gt;Service is not listening at destination.&lt;/li&gt;&#xA;&lt;li&gt;There's no route to the destination, so the packet gets sent to a default route at some point and dropped silently (probably leaving your Internet edge?)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="444" LastActivityDate="2017-04-06T00:26:04.357" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40241" PostTypeId="2" ParentId="17893" CreationDate="2017-04-06T02:12:37.293" Score="1" Body="&lt;p&gt;&lt;strong&gt;From Junos MPLS and VPNs Student GUide Volume 1 of 3 revision 12.a&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basic functional RSVP configuration requires:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.Adding the mpls family to desired interfaces (not needed for lo0)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.Linking interfaces with the routers MPLS process&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.Enabling RSVP on desired interfaces&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4.Configure the label-switched-path under the protocols mpls hierarchy&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As your  outputs fall short, and the config given was &lt;em&gt;displayed set|match&lt;/em&gt; I can only say based on the evidence you have provided that you are missing point 4.&#xA;One common mistake I would add is also not having configured &lt;em&gt;no-cspf&lt;/em&gt; under mpls stanza.`&lt;/p&gt;&#xA;&#xA;&lt;p&gt;`&lt;/p&gt;&#xA;" OwnerUserId="35590" LastActivityDate="2017-04-06T02:12:37.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40242" PostTypeId="1" AcceptedAnswerId="40268" CreationDate="2017-04-06T04:54:50.893" Score="2" ViewCount="1700" Body="&lt;p&gt;I've read that fragmented IP packets &quot;always&quot; become reassembled at their ultimate destination, e.g. the recipient host. (see for instance &lt;a href=&quot;http://www.tcpipguide.com/free/t_IPMessageReassemblyProcess.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.tcpipguide.com/free/t_IPMessageReassemblyProcess.htm&lt;/a&gt;)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what happens if the packets traverse a path where there is a VPN such as a IPsec running in tunnel mode, where the IPsec endpoints routers are not the ultimate destination, and the encrypting endpoint fragments the packets? Shouldn't packets get reassembled at the decrypting endpoint? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance, in the diagram below assume PC1 sends packets to PC2 and there is a tunnel between R1 and R2. Packets become fragmented at R1. Do they become reassembled at R2 or at PC2?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BCOWk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BCOWk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34262" LastEditorUserId="34262" LastEditDate="2017-04-06T05:11:33.480" LastActivityDate="2017-04-06T20:29:05.877" Title="When do IP packets get reassembled if fragmentation occurs in a tunnel?" Tags="|vpn|ip|fragmentation|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40243" PostTypeId="1" AcceptedAnswerId="40258" CreationDate="2017-04-06T05:04:07.990" Score="3" ViewCount="2693" Body="&lt;p&gt;I have spent the last two hours trying to capture an Ethernet collision using wireshark and a few other tools in vain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have hooked up 7 computers to a hub and &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Am transferring a large video file from PC1 -&gt; PC7&lt;/li&gt;&#xA;&lt;li&gt;PC2...PC6 are pinginig PC7&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The &quot;Collision&quot; LED on the hub keeps flickering, but not a single packet with collisions are captured. I am expecting to see some corrupted packets - am I expecting too much? Are these discarded by the chip?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would a collision look in HEX?&lt;/p&gt;&#xA;" OwnerUserId="35818" LastActivityDate="2017-04-06T20:14:40.493" Title="What does an Ethernet collision look like?" Tags="|ethernet|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40245" PostTypeId="2" ParentId="40242" CreationDate="2017-04-06T06:49:45.483" Score="1" Body="&lt;p&gt;Imagine a situation when packet arrives at the first router and it's size is nearly to the MTU of the physical egress port of the router, then it is encapsulated with IPSEC headers. Those additional headers will probably exceed the MTU of the egress port&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In such situation the packet is going to be fragmented after encryption  - post-fragmentation. Of course this forces the remote IPsec peer to perform reassembly before decryption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can avoid post-fragmentation if you set the MTU in the upstream data path to ensure that fragmentation occurs before encryption (prefragmentation). Prefragmentation is really important from performance perspective because it is moving the reassembly task from the remote IPSEC peer to the end host.&lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-04-06T06:49:45.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40246" PostTypeId="2" ParentId="40221" CreationDate="2017-04-06T07:15:45.660" Score="2" Body="&lt;p&gt;Ron has done a great job of explaining the concept. I just want to add my 2 cents for your specific scenario. You mentioned that you have arpspoofed client 1(victim) and client 3(attacker). In order to intercept all traffic (going to and from the victim), I assume you have arpspoofed between gateway and client 1(victim) as well. The whole point of this MITM attack is to manipulate the ARP tables(IP-Mac binding) of both the gateway(router) and the victim. In order to maintain the manipulated ARP tables for both the router and the victim, you need to keep sending the spoofed arp replies to both as long as you want to intercept the traffic. &lt;/p&gt;&#xA;" OwnerUserId="35823" LastActivityDate="2017-04-06T07:15:45.660" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40247" PostTypeId="2" ParentId="40243" CreationDate="2017-04-06T07:19:13.433" Score="2" Body="&lt;p&gt;The collision is handled by the Network Interface Card (NIC) in its hardware / firmware. The NIC will only pass to the operating system the valid frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wireshark will  capture traffic sent by the NIC to the operating system, so only after collision has been handled.&#xA;As such it doesn't see the collisions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As for what it looks like, my guess is a frame with some part being garbage (random).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-04-06T07:19:13.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40251" PostTypeId="1" AcceptedAnswerId="40257" CreationDate="2017-04-06T11:26:18.607" Score="1" ViewCount="45" Body="&lt;p&gt;I'm not sure if the way I think WiFi works is the real one. To ask the question first I have to explain it a little.&#xA;I think WiFi works this way: there is a shared environment, which is the air, and the information is transmitted through radio waves in a certain frequency. As it is shared, the devices have to take turns, and the AC is the one in charge to tell everybody when it is his turn to send information, to use the channel. If there were two devices sending information at the same time, there would produce collisions and none of the messages would be readable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is: wouldn't it be possible that there was a malicious host sending messages all the time, even when it is not his turn, and making the connection useless? Is it true that this host would not even need to be connected to the WiFi network, only to send messages in the same frequency?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is not the way it works, I would appreciate a little explanation or a link to where it is explained.&lt;/p&gt;&#xA;" OwnerUserId="35829" LastEditorUserId="8499" LastEditDate="2017-04-06T14:09:25.583" LastActivityDate="2017-04-06T16:36:38.643" Title="Is it possible and easy to make useless a WiFi connection by generating collissions?" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40253" PostTypeId="1" AcceptedAnswerId="40261" CreationDate="2017-04-06T14:00:03.973" Score="1" ViewCount="141" Body="&lt;p&gt;We have a Cisco 2901 being used as a small office router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;GigabitEthernet0/1 is connected to an ADSL Modem.&#xA;GigabitEthernet0/0 is connected to the local LAN with an IP address 192.168.1.1. The network 192.168.1.0 is NAT'd and has Internet access through the ADSL modem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config for the LAN interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    interface GigabitEthernet0/0&#xA;    description ADSL LAN Interface&#xA;    ip address 192.168.1.1 255.255.255.0&#xA;    no ip redirects&#xA;    no ip unreachables&#xA;    no ip proxy-arp&#xA;    ip nat inside&#xA;    ip virtual-reassembly&#xA;    duplex auto&#xA;    speed auto&#xA;    no cdp enable&#xA;    !&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;We have no services running that would need any port forwarding from the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We do have SMB, FTP and other services running just on machines on the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would we configure an ACL to prevent Internet access to machines on the LAN?&lt;/p&gt;&#xA;" OwnerUserId="35832" LastActivityDate="2017-04-06T17:58:02.667" Title="Configure ACL for ADSL" Tags="|cisco|cisco-ios|acl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40257" PostTypeId="2" ParentId="40251" CreationDate="2017-04-06T16:36:38.643" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;As it is shared, the devices have to take turns, and the AC is the one in charge to tell everybody when it is his turn to send information&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;All nodes on the same channel and in radio range of each other must cooperate to avoid colllisions. This applies even if they are part of different networks.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The question is: wouldn't it be possible that there was a malicious host sending messages all the time, even when it is not his turn, and making the connection useless? Is it true that this host would not even need to be connected to the WiFi network, only to send messages in the same frequency?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's absoloutely possible to Jam a wifi connection in this way. There are also some sneakier ways to mess with wifi such as triggering deassociation from the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that messing with other peoples RF communications, even on your own premises may well be illegal. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://fortune.com/2015/11/04/fcc-hotels-wifi-blocking/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://fortune.com/2015/11/04/fcc-hotels-wifi-blocking/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-04-06T16:36:38.643" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40258" PostTypeId="2" ParentId="40243" CreationDate="2017-04-06T17:07:19.287" Score="5" Body="&lt;p&gt;Ethernet started out as a protocol for coaxial shared medium networks. In the event of a collision the voltage levels on the cable would be wrong and the transceivers would detect this and tell the MACs. Any data received at this point would be garbage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The receiving MAC would ignore any data coming in, and possibly increment a collision counter. The MAC has no reason to pass the garbage coming in from the PHY up to the host computer. The sending MACs would also see the collision, they would keep transmitting for the minimum frame time to ensure the collision was seen throughout the network. They would then wait for a random backoff before trying to send the frame again, hopefully the random backoff times used by the two sending MACs would be sufficiently different that one of them would succesfully send it's frame while the other would detect the line as busy and wait it's turn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now enter repeaters (aka hubs). A repeater has a number of PHYs but no MACs. When a repeater detects a collision it outputs a &quot;Jam signal&quot;. This ensures that the collision is seen across the whole network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what about twisted pair? All common variants of twisted pair Ethernet are full duplex at the physical layer but for backwards compatibility and to support the use of hubs most of them have a &quot;half duplex&quot; mode. In half duplex mode simultaneous activation of transmitter and receiver is treated as a collision.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Putting that all together lets imagine you had a device plugged in to one of the spare ports on your hub that could capture and analyse low level Ethernet signals, what would it see?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would see the start of a frame as normal. Then when the collision happened you would see a Jam signal from the hub. Once the Jam signal was over you would then see a period of idle line until one of the sender's random back-off timers expires and a retransmission begins.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-04-06T20:14:40.493" LastActivityDate="2017-04-06T20:14:40.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40260" PostTypeId="2" ParentId="20138" CreationDate="2017-04-06T17:38:15.520" Score="0" Body="&lt;p&gt;you have configured theinterfaces for voice vlan, please try to use below command for interfaces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switchport mode dynamic desirable&#xA;switchport voice vlan 200&#xA;duplex auto&#xA;speed auto&#xA;mls qos trust device cisco-phone&#xA;mls qos trust cos&#xA;spanning-tree portfast&#xA;no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and also put &lt;code&gt;ip default-gateway &amp;lt;ip of router interface&amp;gt;&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="35815" LastEditorUserId="8499" LastEditDate="2017-04-06T19:44:56.810" LastActivityDate="2017-04-06T19:44:56.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40261" PostTypeId="2" ParentId="40253" CreationDate="2017-04-06T17:58:02.667" Score="2" Body="&lt;p&gt;As your hosts are behiend a dynamic nat it is not possible for external host to connect to any host running inside your lan network.&#xA;The only possible passing packets from the internet to your internal lan will be the reply packets to connections established from your internal hosts&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-04-06T17:58:02.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40262" PostTypeId="1" CreationDate="2017-04-06T18:39:10.343" Score="0" ViewCount="226" Body="&lt;p&gt;My question is different from the one being marked as duplicate of. The problem with my question arises when the octet in which I'm working in is used up but there are still networks left to be assigned suitable addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 4 networks connected to 1 router. Number of users on each network are; 99, 77, 13 and 5. The starting or working network address is 192.168.10.0/24. Using VLSM, I'm supposed to get each network suitable range of host addresses. I started from the network with the highest users and realized by the time i got to network with 13 users, all the host addresses in the 4th octet were used up. So i decided to enter the 3rd octet since all the hosts there are not used up and i get network address of 192.168.11.0/28. Am i correct? &#xA;Or in this case, i should have started from network with the smallest users?&lt;/p&gt;&#xA;" OwnerUserId="35835" LastEditorUserId="35835" LastEditDate="2017-04-06T19:43:29.743" LastActivityDate="2017-04-06T19:43:29.743" Title="Variable Length Subnet Masking" Tags="|subnet|" AnswerCount="2" CommentCount="7" ClosedDate="2017-04-06T19:24:49.220" ContentLicense="CC BY-SA 3.0" />
  <row Id="40263" PostTypeId="2" ParentId="40262" CreationDate="2017-04-06T18:44:03.090" Score="-1" Body="&lt;p&gt;You can use following network/subnet mask&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.10.0/25 for 96 and 77 users&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.11.0/28 for 13 users&#xA;192.168.11.0/29 for 5 users&lt;/p&gt;&#xA;" OwnerUserId="35815" LastActivityDate="2017-04-06T18:44:03.090" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="40264" PostTypeId="2" ParentId="40262" CreationDate="2017-04-06T19:12:34.190" Score="1" Body="&lt;ul&gt;&#xA;&lt;li&gt;A /25 can normally support 125 end users.&lt;/li&gt;&#xA;&lt;li&gt;A /26 can normally support 61 end users.&lt;/li&gt;&#xA;&lt;li&gt;A /27 can normally support 29 end users.&lt;/li&gt;&#xA;&lt;li&gt;A /28 can normally support 13 end users&lt;/li&gt;&#xA;&lt;li&gt;A /29 can normally support 5 end users&lt;/li&gt;&#xA;&lt;li&gt;A /30 can normally support 1 end users&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So to do this with traditional subnetting (even with variable subnet masks) assigning one subnet to each network you would need two /25's, a /28 and a /29. That isn't going to fit in your /24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So how can we solve this problem? I see a couple of options.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Assign two subnets to the network with 77 users. If we assign it a /26 and a /27 we cover it's users while leaving a /26 free for further subdivision. Downside is that some formerly local traffic will end up going via the router and local firewalls may make incorrect assumptions about what is on the local network.&lt;/li&gt;&#xA;&lt;li&gt;Use proxy arp on the subnet with 77 users. We can then assign smaller subnets which overlap with unused parts of that subnet and proxy arp will pick up the traffic. Again local firewalls may make incorrect assumptions about what is on the local network. Proxy arp can also magnify the problems experienced in the event of a misconfiguration.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-04-06T19:20:56.073" LastActivityDate="2017-04-06T19:20:56.073" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40266" PostTypeId="1" CreationDate="2017-04-06T19:41:18.990" Score="2" ViewCount="175" Body="&lt;p&gt;When does the flags proposal and agreement are set in RSTP? What are its importance?&lt;/p&gt;&#xA;" OwnerUserId="24153" LastActivityDate="2017-04-06T19:41:18.990" Title="When exactly the Proposal and Agreement flags are used in RSTP" Tags="|spanning-tree|layer2|ieee-802.1w|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40267" PostTypeId="1" AcceptedAnswerId="40269" CreationDate="2017-04-06T19:59:35.940" Score="0" ViewCount="699" Body="&lt;p&gt;Console output became garbled/scrambled during the reset procedure using ROMon, making it unviewable, and has been ever since on this device. See screenshot.&lt;a href=&quot;https://i.stack.imgur.com/E9FPl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/E9FPl.png&quot; alt=&quot;console output&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have tried various suggested baud rates with no success. Console cable and COM port are also OK, (have tested with other devices subsequently).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a secondhand router I purchased from Ebay for a home CCNA LAB. &lt;/p&gt;&#xA;" OwnerUserId="23395" LastActivityDate="2017-04-06T20:39:44.463" Title="Console output garbled - Cisco 1812 Router" Tags="|cisco|router|cisco-ios|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="40268" PostTypeId="2" ParentId="40242" CreationDate="2017-04-06T20:29:05.877" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I've read that fragmented IP packets &quot;always&quot; become reassembled at their ultimate destination, e.g. the recipient host.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That was the original intent of the Designers of IP, it's not so true nowadays though. Many firewalls will defragment packets because it's difficult to do effective firewalling on fragments.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;For instance, in the diagram below assume PC1 sends packets to PC2 and there is a tunnel between R1 and R2. Packets become fragmented at R1. Do they become reassembled at R2 or at PC2?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends on how they are fragmented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If they are fragmented before encapsulation then the fragmented packets can travel seperately to the end host (though as mentioned above many firewalls will defragment them)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand if the encapsulated packet is fragmented then it must be reassembled before it can be de encapsulated.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-04-06T20:29:05.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40269" PostTypeId="2" ParentId="40267" CreationDate="2017-04-06T20:39:44.463" Score="3" Body="&lt;p&gt;Please try to power cycle the Router and try following baud rate speeds: 1200, 2400, 4800, 9600, 19200, 38400, 57600, 115200. set flow control none, data bits 8, parity none, stop bits 1. Let me know if it helps you.&lt;/p&gt;&#xA;" OwnerUserId="35815" LastActivityDate="2017-04-06T20:39:44.463" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40270" PostTypeId="2" ParentId="40177" CreationDate="2017-04-06T20:50:44.027" Score="0" Body="&lt;p&gt;If the server has two NIC card, you can connect one NIC to vlan related to 50.50.50.2 subnet and second NIC to vlan 192.168.100.1. I have seen the environment where server can support trunk with one NIC card, and from the switch side, enable trunk and allowed vlan list, not sure for your server it support or not. Let me know if that helps you.&lt;/p&gt;&#xA;" OwnerUserId="35815" LastActivityDate="2017-04-06T20:50:44.027" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40271" PostTypeId="2" ParentId="40140" CreationDate="2017-04-06T23:00:17.427" Score="2" Body="&lt;p&gt;Please try to put gateway IP in PCs, and also amend IPs in router subinterfaces they will act like default gateway for PCs in particular VLAN, and also configure trunk between all three Switches and Router.&lt;/p&gt;&#xA;" OwnerUserId="35815" LastActivityDate="2017-04-06T23:00:17.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40272" PostTypeId="2" ParentId="40125" CreationDate="2017-04-06T23:07:21.557" Score="1" Body="&lt;p&gt;With Leased Line Connection, lets say 100Mbps, you can download data with 100Mbs suppose you have one computer, and if you have 10 Computer, it will be shared, same with upload speed. but with Broadband Connection, generally they come with lesser upload speed generally 10% of Download Speed. so basically if you are uploading a large file, your network connection would be appeared slow, while download will be much faster, same concept here for shared bandwidth.&lt;/p&gt;&#xA;" OwnerUserId="35815" LastActivityDate="2017-04-06T23:07:21.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40273" PostTypeId="2" ParentId="40125" CreationDate="2017-04-06T23:19:14.077" Score="1" Body="&lt;p&gt;No, the speed of the link is the speed of the link. You won't get more than that total.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The difference between &quot;leased line&quot; and &quot;broadband&quot; connections is more subtle. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;leased line connections are usually symmetric while &quot;broadband&quot; connections are usually asymetric.&lt;/li&gt;&#xA;&lt;li&gt;broadband connections are usually priced at levels home users and small buisnesses can reasonablly afford. &quot;leased lines&quot; tend to cost considerbally more.&lt;/li&gt;&#xA;&lt;li&gt;With broadband connections you usually get the line and internet service as a package. With leased lines you can lease a line to an ISP and then seperately negotiate an Internet service contract.&lt;/li&gt;&#xA;&lt;li&gt;With broadband connections your service may be contended at the local level, with leased lines it's usually dedicated at least as far as the ISP (though no internet connection can really be truely uncontended).&lt;/li&gt;&#xA;&lt;li&gt;With leased lines you usually get a service level agreement which means that (in theory at least) if something goes wrong an engineer should be out to fix it quickly. With broadband connections you get very little guarantee of anything.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-04-06T23:19:14.077" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40275" PostTypeId="1" CreationDate="2017-04-07T01:17:16.687" Score="2" ViewCount="2020" Body="&lt;p&gt;I am trying to better understand how the channels in QSFP+ operate. I have recently run into issues with Juniper QFX-QSFP-40G-ESR4 and QFX-QSFP-40G-SR4 where they are not allowing me to channelize the ports to run at 40G to 4x10G. The systems these are being installed into are QFX5200 and QFX5100. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the method I used to configure the ports:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;To configure an individual 40-Gigabit Ethernet (et) port to operate&#xA;as 10-Gigabit Ethernet (xe) ports, specify a port number and channel&#xA;speed:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit chassis fpc 0 pic 0]&#xA;user@switch# set port port-number channel-speed speed&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For example, to configure port 3 to operate as 10-Gigabit Ethernet&#xA;ports:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit chassis fpc 0 pic 0]&#xA;user@switch# set port 3 channel-speed 10g&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Review your configuration and issue the commit command.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[edit]&#xA;user@switch# commit&#xA;commit complete&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Is there anything I am missing? Any assistance would be greatly appreciated!&lt;/p&gt;&#xA;" OwnerUserId="35839" LastEditorUserId="8499" LastEditDate="2017-04-07T01:29:17.037" LastActivityDate="2017-04-07T01:56:46.880" Title="Why do some QSFP+ not allow breakouts? Shouldn't all MTP QSFP allow -&gt; 40G QSFP+ to 4x10G SFP+?" Tags="|juniper-junos|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40276" PostTypeId="2" ParentId="40275" CreationDate="2017-04-07T01:56:46.880" Score="2" Body="&lt;p&gt;That is pretty much all there is to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a QFX, once you have committed the above &lt;strong&gt;&lt;em&gt;and inserted the QSFP+&lt;/em&gt;&lt;/strong&gt; you should now be able to run &lt;code&gt;show interfaces terse&lt;/code&gt; and see:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;xe-0/0/3:0&#xA;xe-0/0/3:1&#xA;xe-0/0/3:2&#xA;xe-0/0/3:3&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If not, try restarting the FPC (or the entire platform).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be aware of the following limitations on the QFX5100 depending on the model you are using:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/qfx5100-port-mode-configuring.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.juniper.net/documentation/en_US/junos/topics/task/configuration/qfx5100-port-mode-configuring.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more little limitation I've hit using 4x10 break-out is that if you use &lt;code&gt;interface-range&lt;/code&gt; at all, you can't reference any of the break-out interfaces in your &lt;code&gt;member&lt;/code&gt; statements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Juniper appears to have missed allowing the &quot;:&quot; delimeter in their &lt;code&gt;member&lt;/code&gt; regex, at least this is still the case up to Junos 17.1R1.8&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-04-07T01:56:46.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40278" PostTypeId="1" AcceptedAnswerId="40281" CreationDate="2017-04-07T03:11:01.190" Score="0" ViewCount="63" Body="&lt;p&gt;I'm quite new with networking. I need to set up this VLAN setup (shown below). I have a Media Converter Device (EDD). My trouble is I don't know how to setup VLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know the basics of VLAN (concepts). But I don't know how to set it up in a router/switch device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Vr3Pj.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Vr3Pj.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the interface for the device I am working on:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QUVhG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QUVhG.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="35841" LastEditorUserId="35841" LastEditDate="2017-04-07T03:16:20.590" LastActivityDate="2017-04-07T07:28:35.767" Title="Need help setting up VLAN" Tags="|vlan|" AnswerCount="1" CommentCount="2" ClosedDate="2018-07-25T00:39:00.773" ContentLicense="CC BY-SA 3.0" />
  <row Id="40279" PostTypeId="1" AcceptedAnswerId="40280" CreationDate="2017-04-07T04:30:04.500" Score="8" ViewCount="140020" Body="&lt;p&gt;I'm trying to figure out the MAC address of my router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This picture is of using the command ipconfig:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nbRkF.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nbRkF.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This picture is of using the arp -a command:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/8M2q8.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8M2q8.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see it says my IPv4 address is 192.168.1.114, so I go down to it in the arp -a command. However, there are many different MAC addresses for it. It also says the default gateway is 192.168.1.1, so my question is: Which one is my router MAC address? Help would be appreciated. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="35843" LastActivityDate="2020-06-04T13:01:26.967" Title="How to find the MAC address of a router?" Tags="|router|mac-address|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40280" PostTypeId="2" ParentId="40279" CreationDate="2017-04-07T04:43:07.187" Score="4" Body="&lt;p&gt;According to your screenshot, the ARP Cache entry for 192.168.1.1 is &lt;code&gt;c8d7.1914.f1d1&lt;/code&gt;, which is likely the MAC address of the router interface to which you are connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to your output of &lt;code&gt;ipconfig/all&lt;/code&gt;, the MAC Address of your Network Interface is &lt;code&gt;844b.f522.6f98&lt;/code&gt;.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2017-04-07T05:32:15.560" LastActivityDate="2017-04-07T05:32:15.560" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="40281" PostTypeId="2" ParentId="40278" CreationDate="2017-04-07T07:28:35.767" Score="0" Body="&lt;p&gt;The process is pretty straight forward.&#xA;1. identify the devices that need isolation- each VLAN per such device.&#xA;2. Remember VLANS are set up at the switch interface.&#xA;3. the switch interface links that have been configured with non native vlans (other than default) have to be trunk - VTP, ISL , etc&#xA;4. For communication between two devices in different VLAN's - if needed you will need a layer 3 device - router or SVI.&#xA;5, Router have no concept of VLANS, they operate at layer 3.&#xA;thus there is no configuration involved at the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a more conceptual understanding about VLANS you may want to read about VLAN tags, switch forwarding table and switch virtual interfaces.&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-04-07T07:28:35.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40286" PostTypeId="2" ParentId="22889" CreationDate="2017-04-07T14:30:37.410" Score="1" Body="&lt;p&gt;You can use the security licenses to activate the advanced security features offered on the Cisco 4000 Series ISR platform. The HSEC license is required for a feature to have full crypto functionality. Without the HSEC license, only 225 secure tunnels and 85 Mbps of crypto bandwidth would be available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/guide-c07-732797.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;enter link description here&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The license quoted above however, is a FL-4320-PERF-K9, which will increase routing throughput from 50Mbps to 100Mbps on the Ethernet interfaces. You MUST activate it once installed:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1 – Install license:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;06600r2#license install flash:FDO210102MX_20170401103432129.lic &#xA;Installing licenses from &quot;flash:FDO210102MX_20170401103432129.lic&quot; &#xA;Installing...Feature:throughput...Successful:Supported&#xA;1/1 licenses were successfully installed &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;2 – Apply/&lt;strong&gt;configure&lt;/strong&gt; the new throughput level:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;06600r2#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;&#xA;06600r2(config)#platform hardware throughput level 100000 &#xA;% The config will take effect on next reboot&#xA;&#xA;06600r2#show platform hardware throughput level &#xA;The current throughput level is 50000 kb/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Following reboot:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3 – Confirm throughput:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;06600r1#show platform hardware throughput level &#xA;The current throughput level is 100000 kb/s&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35853" LastEditorUserId="8499" LastEditDate="2017-04-07T17:48:14.700" LastActivityDate="2017-04-07T17:48:14.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40288" PostTypeId="1" CreationDate="2017-04-07T17:24:32.893" Score="2" ViewCount="6584" Body="&lt;p&gt;Ping works in the internet layer, but when I ping an IP address in my terminal, is ping in the application layer? If it is, how does the application pass transport layer?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it is not, can I say those applications that use protocols in the application layer (SSH, DHCP, etc.) and pass the transport layer can be in the application layer not all applications?&lt;/p&gt;&#xA;" OwnerUserId="35857" LastEditorUserId="8499" LastEditDate="2017-07-09T07:50:38.733" LastActivityDate="2017-07-09T07:50:38.733" Title="Is ping in the application layer?" Tags="|tcp|ping|osi|transport-protocol|layer4|" AnswerCount="2" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40290" PostTypeId="2" ParentId="40288" CreationDate="2017-04-07T17:38:18.803" Score="1" Body="&lt;p&gt;Typically &quot;ping&quot; is implemented using &quot;raw sockets&quot;. These let applications bypass the transport layer and generate/interpret packets themselves.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Raw sockets have security implications and hence there are often restrictions on them beyond those applied to regular sockets. Traditionally on unix-like systems ping was &quot;suid&quot; to allow it to use raw sockects through recent linux distros often use &quot;capabilities&quot; instead. I dunno what the picture looks like on other platforms.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-04-07T17:38:18.803" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40291" PostTypeId="2" ParentId="40288" CreationDate="2017-04-07T18:28:53.680" Score="5" Body="&lt;p&gt;I'll start with the oft-repeated caveat (at least by me, anyway) that things don't fit neatly into the OSI model.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;Ping&quot; is the name of an application that generates ICMP echo request packets and receives echo reply packets.  ICMP doesn't neatly fit into the OSI or TCP/IP model, so you can call it layer 3 or layer 3.5, depending on your point of view.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-07T18:28:53.680" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40292" PostTypeId="2" ParentId="40279" CreationDate="2017-04-07T18:35:16.443" Score="5" Body="&lt;p&gt;You can issue &lt;code&gt;tracert 8.8.8.8&lt;/code&gt; from your PC and find out the next hop IP address, that would be your next hop (gateway IP address) IP address, after that, issue command &lt;code&gt;arp -a&lt;/code&gt;, and see that IP address mapped to which MAC address and that MAC address is the next hop (gateway).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following is just for example.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;C:\Users\&amp;gt;tracert 8.8.8.8  &#xA;Tracing route to google-public-dns-a.google.com [8.8.8.8]  &#xA;over a maximum of 30 hops:  &#xA;  1     5 ms     5 ms     5 ms  192.168.1.1**  &#xA;  2     5ms      5ms      5ms   10.11.12.13   &#xA;  3  ^C&#xA;&#xA;C:\Users\&amp;gt;arp -a  &#xA;&#xA;Interface: 192.168.1.1 --- 0xb  &#xA;  Internet Address      Physical Address      Type  &#xA;  192.168.1.1            c8d7.1914.f1d1     dynamic  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Hope this answer helps you.  &lt;/p&gt;&#xA;" OwnerUserId="35815" LastEditorUserId="8499" LastEditDate="2017-04-07T19:00:58.823" LastActivityDate="2017-04-07T19:00:58.823" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40297" PostTypeId="1" AcceptedAnswerId="41030" CreationDate="2017-04-08T00:00:22.967" Score="2" ViewCount="137" Body="&lt;p&gt;I am shopping for a good VPN router to replace my terrible stock ADSL modem + router from my ISP, which need to be restarted 4 times a day. This is for my office use, which connected by around 17 devices or more in the future, and also able to setup a VPN for my sales person to access intranet web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While searching around, I find that most business router don't come with ADSL2+ connection. This mean I need to spend money for a modem too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, why don't they design a modem + router device just like consumer router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And when I search for &quot;business modem&quot;, I don't get much useful result... How do small business design their Network and connect to internet?&lt;/p&gt;&#xA;" OwnerUserId="35866" LastActivityDate="2017-06-07T15:50:37.503" Title="Why Business Class router don't usually include ADSL?" Tags="|router|adsl|cisco-small-business|modem|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40298" PostTypeId="2" ParentId="40297" CreationDate="2017-04-08T02:51:22.537" Score="3" Body="&lt;p&gt;A DSL or DOCSIS modem is a specialized bridging device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Including one in a router is either a cheap gimmick or increases the expense of a business device that will limit its adoption.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spring for the ADSL2+ modem and you will both probably never have to replace it and will have every option under the sun for routers.&lt;/p&gt;&#xA;" OwnerUserId="35275" LastActivityDate="2017-04-08T02:51:22.537" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40304" PostTypeId="1" CreationDate="2017-04-08T17:38:47.227" Score="2" ViewCount="9192" Body="&lt;p&gt;Ultimately I've been tasked with the installation of a serviced office with upwards of 1000 staff, potentially being spread across 50+ VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The hardware bought was out of my hands, but it's fairly decent high-end switching that should be able to achieve what we require. See below diagram to hopefully aid my description (Layer 3, MLAG etc.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GsERK.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GsERK.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially we will have two core 24 port switches, which we would like to put into high availability. My idea would be to use MLAG, but I'm looking for guidance in that regard. These each have 4 port add-in for 10GB fibre. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will have 3 stacks, A, B and C. C being in a remote office. Each stack will be connected to the core via the 10GBe fibre ports. The top and bottom switch in each stack, connected to CORE01 and CORE02 respectfully. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Green cables are stacking cables, blue and orange uplinks to CORE1 and CORE2 respectfully).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm really looking for some guidance on the best way to configure these for redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MLAG between the two core switches? (these cannot be stacked, no stacking ports) for redundancy, the 3 stacks as below, with two uplinks split across each core? These would both be trunk links carrying all VLANs as tagged VLANs?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or simply just redundant links and enable STP? Or something completely different? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do we connect the two CORE switches via Fibre (meaning we can only use one fibre connection from stack C to the core) or just use 1GBe Ethernet between them? Really looking for some advice and/or best practices for a large setup like this. &lt;/p&gt;&#xA;" OwnerUserId="35883" LastActivityDate="2019-10-29T18:49:20.960" Title="Designing a redundant switching infrastructure" Tags="|switching|layer3|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40307" PostTypeId="2" ParentId="40304" CreationDate="2017-04-08T20:48:31.350" Score="2" Body="&lt;p&gt;That is a good way to design and you may want to consider adding a third layer to your design.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your core switches appear to be a core/distribution setup and you really want to separate your core switches so they aren't affected by spanning tree loops, yes they do happen.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could implement ospf between your cores and the distribution switches which could then be split between buildings, floors, geographically, etc.&#xA;Your vlans spanning tree roots are then on the distribution switches. &#xA;You could then test your vPC/MLAG solution without taking out the whole network :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not really sure which vendor solution has been selected but they should have documentation available for design and best practice for high availability/redundancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Side note: some designs even take routing to the access switches thus containing spanning tree loops to the access switch stack but I think the expense is best spent on a couple of beefy core switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And you can test it all in GNS3 (or similar app) prior to deploying :-)&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="4565" LastEditDate="2017-04-08T20:59:04.340" LastActivityDate="2017-04-08T20:59:04.340" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="40308" PostTypeId="1" AcceptedAnswerId="40309" CreationDate="2017-04-09T05:49:01.977" Score="1" ViewCount="78" Body="&lt;p&gt;I have 3 routers, let's call them A, B, C. I need to configure mesh VPNs (i.e. A-B, B-C, A-C) between them. Can I use the same IP as endpoint (local or remote) IP on the same router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example we now have 3 VPN connections:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;A 192.168.1.1 - B 192.168.1.2&lt;/li&gt;&#xA;&lt;li&gt;B 192.168.1.2 - C 192.168.1.3&lt;/li&gt;&#xA;&lt;li&gt;A 192.168.1.1 - C 192.168.1.3&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Will this cause problems? What if there are also OSPF on 3 routers? What if there are multiple concurrent VPN connections (different type) between the same routers using the same endpoint IPs?&lt;/p&gt;&#xA;" OwnerUserId="32304" LastActivityDate="2017-04-09T08:28:41.423" Title="Can I use the same IP for endpoints in a mesh VPN network?" Tags="|routing|vpn|ospf|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40309" PostTypeId="2" ParentId="40308" CreationDate="2017-04-09T08:28:41.423" Score="3" Body="&lt;p&gt;You can use the same IP as source in multiple VPN as the destination is different and there is no issue if you use the same interface as another type VPN source.&#xA;This is the general case, there is no logical reason to deny that &lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-04-09T08:28:41.423" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40310" PostTypeId="2" ParentId="36989" CreationDate="2017-04-09T10:56:22.167" Score="1" Body="&lt;p&gt;The destination IP address is the same as the source IP address with BFD Echo mode, check out this packet capture &lt;a href=&quot;https://www.cloudshark.org/captures/ada0ef51d5f5&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cloudshark.org/captures/ada0ef51d5f5&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="35892" LastActivityDate="2017-04-09T10:56:22.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40311" PostTypeId="1" AcceptedAnswerId="40314" CreationDate="2017-04-09T11:00:09.340" Score="1" ViewCount="92" Body="&lt;p&gt;What are the common methods to have VLANs on a wireless network through profiles ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scenario :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;access points ==&gt; wireless controller ==&gt; core switch ==&gt; UTM &lt;/p&gt;&#xA;&#xA;&lt;p&gt;there is 3 main profiles for users to access Wireless network , Managers , Users &lt;/p&gt;&#xA;&#xA;&lt;p&gt;and Guests .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;so basically we need every profile from the mentioned above to be on separate VLAN .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it can't be done , what are the other scenarios we can adopt to achieve this ? &lt;/p&gt;&#xA;" OwnerUserId="35735" LastActivityDate="2017-04-10T07:13:19.840" Title="VLANs on a wireless network" Tags="|vlan|wireless|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40313" PostTypeId="1" CreationDate="2017-04-09T15:01:31.387" Score="5" ViewCount="531" Body="&lt;p&gt;Is there an IEEE recognized method for splicing Category 5e or 6 cabling, and maintaining the expected data rates?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such as the junction box shown in the link below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.lowvoltagecables.com/keystone-jack-inserts/junction-box.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.lowvoltagecables.com/keystone-jack-inserts/junction-box.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35895" LastEditorUserId="8499" LastEditDate="2019-01-03T02:21:24.867" LastActivityDate="2019-01-03T02:21:24.867" Title="Is there an IEEE recognized method for splicing Category 5e or 6 cabling?" Tags="|layer1|cable|cabling|utp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40314" PostTypeId="2" ParentId="40311" CreationDate="2017-04-09T15:12:15.940" Score="2" Body="&lt;p&gt;Generally, each group has its own SSID, and the SSIDs are mapped to VLANs in the controller. You can have different authentication methods for each SSID. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-09T15:12:15.940" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40315" PostTypeId="2" ParentId="40313" CreationDate="2017-04-09T17:34:11.327" Score="5" Body="&lt;p&gt;Copper cable splices are not allowed. Cabling standards are set by &lt;em&gt;ANSI/TIA/EIA 568 Commercial Building Telecommunications Cabling Standard&lt;/em&gt;. For instance, this is for copper cabling:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Only one transition point or consolidation point between the&#xA;  horizontal cross connect and the telecommunications outlet shall be&#xA;  allowed, and bridged taps and splices are not allowed in the copper&#xA;  horizontal.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You are allowed to splice fiber cabling, but you must consider the effect on your link attenuation and loss budget.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, simply using parts that are rated at a category doesn't necessarily mean that you end up with a rated link. Installation is the biggest failure in cabling. You must use a proper tester (quite expensive, but can normally be rented, if you know what you are doing) to run the link through the test suite for the particular category. Any failures must be fixed. Even experienced installers can have trouble getting Category 6 or 6a to pass the test suite. You can permanently ruin a cable by exceeding the minimum bend radius or maximum pulling tension when installing, and I have seen simple things like having the Blue wire on top of the Blue/White at the termination prevent the link from passing the test suite.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-04-09T18:45:05.210" LastActivityDate="2017-04-09T18:45:05.210" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40322" PostTypeId="2" ParentId="16875" CreationDate="2017-04-10T05:47:36.500" Score="-2" Body="&lt;p&gt;No.  Bandwidth is not something the cable contains.  It is simply a physical connection medium.  10mbps is the speed of data flow, not the quantity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The original Ethernet specification limits the individual copper cable lengths to 100 meters, because of the latency time of getting a packet from end-to-end then getting the returning ACK before timing out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To go further than that you need a bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of this should affect the speed of the cable.  But it can affect total throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For instance:  when you are transferring 10 MB of data, longer cables will be a bit slower to transfer that total amount than shorter ones simply because the signals travel at about 2/3 of the speed of light in copper.  More length means more latency.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding bridges will also slow down the total throughput a bit because of the latency involved in receiving packets, acknowledging them, then regenerating them to be passed along to the next segment.  &lt;/p&gt;&#xA;" OwnerUserId="34855" LastActivityDate="2017-04-10T05:47:36.500" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40324" PostTypeId="2" ParentId="40311" CreationDate="2017-04-10T07:13:19.840" Score="0" Body="&lt;p&gt;In addition to what Mr. Trunk said:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming your WiFi uses WPA2 enterprise, you'd have some kind of authentication server that would authenticate (or deny access) centrally, and communicate settings such as the IP address to be assigned to a station to the access point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I haven't read into the underlying 802.11 standard (I think it's 11x) deeply enough, but my impression was that also things like routes to be set up can be communicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway, with wpa2 enterprise, the network is already segregated, and users can't read the traffic of other users on the same network, and vlan tagging should be doable on addresses alone in your access point&lt;/p&gt;&#xA;" OwnerUserId="15991" LastActivityDate="2017-04-10T07:13:19.840" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40326" PostTypeId="1" AcceptedAnswerId="40482" CreationDate="2017-04-10T08:15:25.953" Score="1" ViewCount="1086" Body="&lt;p&gt;I need to write a code, which communicates between 2 computers. &#xA;I saw many people use port 8820 in their code when they want to communicate between computers.&#xA;I know the term port but What is port 8820? &lt;/p&gt;&#xA;" OwnerUserId="35910" LastEditorUserId="8499" LastEditDate="2017-04-16T18:37:47.167" LastActivityDate="2018-03-01T01:50:53.683" Title="port 8820 - what is it?" Tags="|tcp|udp|layer4|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40327" PostTypeId="2" ParentId="40326" CreationDate="2017-04-10T10:34:01.497" Score="4" Body="&lt;p&gt;Port 8820 is unassigned.  You can see the official &lt;a href=&quot;ftp://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.txt&quot; rel=&quot;noreferrer&quot;&gt;IANA list here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-10T10:34:01.497" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40328" PostTypeId="1" AcceptedAnswerId="40336" CreationDate="2017-04-10T10:40:38.843" Score="2" ViewCount="27132" Body="&lt;p&gt;Short bg:&lt;/p&gt;&#xA;&lt;p&gt;I wanted to host a website on my laptop (&lt;code&gt;192.168.0.102&lt;/code&gt;) via apache server. I set up port &lt;code&gt;8080&lt;/code&gt; and forwarded the port that I was able to access it via &lt;code&gt;192.168.0.102:8080&lt;/code&gt;. Then there was a problem that via my public IP (&lt;code&gt;91.223.224.42&lt;/code&gt;) I could not do so. My router has a WAN of &lt;code&gt;192.168.13.234&lt;/code&gt; (and, btw, I was also able to access the website via &lt;code&gt;192.168.13.234:8080&lt;/code&gt;) and is standing behind a router with an IP of &lt;code&gt;192.168.30.105&lt;/code&gt;. So I called my ISP and they told me, that the last router is their &lt;code&gt;PPPOE&lt;/code&gt; router, and so that I will only be able to access my laptop from the outside if I pay for &lt;code&gt;static IP&lt;/code&gt; address, because &amp;quot;my current public IP corresponds to &lt;code&gt;PPPOE server&lt;/code&gt; and I need the &lt;code&gt;static routing&lt;/code&gt;&amp;quot;.*&lt;/p&gt;&#xA;&lt;p&gt;I googled and found out that there are &lt;code&gt;routable&lt;/code&gt; and &lt;code&gt;non routable&lt;/code&gt; IP addresses, but did not find any explanation relating to my problem, only found definitions of local subnets as &lt;code&gt;192.168...&lt;/code&gt; and public IP, but I already know that. I think I also get what &lt;code&gt;dynamic IP&lt;/code&gt; and &lt;code&gt;static IP&lt;/code&gt; mean but I am not familiar with &lt;code&gt;PPPOE&lt;/code&gt; and why is that so important to get &lt;code&gt;static IP&lt;/code&gt; if I am dealing with &lt;code&gt;PPOE&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Thanks in advance!&lt;/p&gt;&#xA;" OwnerDisplayName="user35914" LastEditorUserId="2142" LastEditDate="2020-09-19T04:11:38.730" LastActivityDate="2021-08-25T16:08:35.327" Title="What is a &quot;routable&quot; IP?" Tags="|routing|wan|network-access|" AnswerCount="4" CommentCount="3" ClosedDate="2017-04-11T13:16:46.697" ContentLicense="CC BY-SA 4.0" />
  <row Id="40329" PostTypeId="2" ParentId="40328" CreationDate="2017-04-10T12:00:02.817" Score="1" Body="&lt;p&gt;192.168.0.0 this is a private range , that means traffic coming from this IP &lt;/p&gt;&#xA;&#xA;&lt;p&gt;range will not be routed to the internet. It's reserved to the private  network &lt;/p&gt;&#xA;&#xA;&lt;p&gt;use , along with (172.16.0.0) and (10.0.0.0) ranges . so when you see those ranges you &lt;/p&gt;&#xA;&#xA;&lt;p&gt;should know you are in a private network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dynamic IP changes every time you router rebooted . So people can't access your &lt;/p&gt;&#xA;&#xA;&lt;p&gt;website . what You need is an static IP , which will remain the same .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static IP comes with extra charge , you can discuss the cost with your &lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP presenter .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally , there is a lot of free or paid hosting Services you can use to host &lt;/p&gt;&#xA;&#xA;&lt;p&gt;your website . &lt;/p&gt;&#xA;" OwnerUserId="35735" LastActivityDate="2017-04-10T12:00:02.817" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40331" PostTypeId="1" AcceptedAnswerId="40332" CreationDate="2017-04-10T12:41:27.703" Score="1" ViewCount="499" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UFPDZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UFPDZ.jpg&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have simple tree topology network. I want to configure VLAN on this network, PFA the &lt;a href=&quot;https://i.stack.imgur.com/UFPDZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;image&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I wrong? Can VLANs actually be configured like this. I have setup this topology on mininet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More of setting up this network on a linux machine.&lt;/p&gt;&#xA;" OwnerUserId="34469" LastActivityDate="2021-01-04T06:02:21.503" Title="How to configure VLAN?" Tags="|routing|vlan|topology|mininet|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40332" PostTypeId="2" ParentId="40331" CreationDate="2017-04-10T13:07:11.183" Score="2" Body="&lt;p&gt;VLANs are layer-2 constructs, and they cannot cross a layer-3 device, e.g. router. You could not have the same VLAN on two different router interfaces, as your drawing seems to suggest. You could, however, use the same VLAN numbers on the two different router interfaces, but they would not actually be the same VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If instead of a router, you use a layer-3 switch (which is at its heart, a layer-2 switch), you could implement this, where you have the same VLANs on both layer-3 switch interfaces because they would be layer-2 interfaces on the layer-3 switch. You would need to configure them as trunk interfaces in order to allow more than one VLAN on the link.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-10T13:07:11.183" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40333" PostTypeId="1" AcceptedAnswerId="40335" CreationDate="2017-04-10T15:02:25.043" Score="2" ViewCount="196" Body="&lt;p&gt;Say we have a router (capable of the 802.11 protocol standards) and some number of devices that are configured to communicate with this router. I have learnt about how devices/nodes use CSMA/CA to transmit data, and other mechanisms such as RTS/CTS &amp;amp; NAV, to help prevent collisions in the wireless medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I haven't been able to find an answer to a subtle issue. If one device intends to communicate with another device, then would it be possible (as per the 802.11 standard) for the devices to communicate directly with one another (assuming they are within each other's range)? Or would they still have to send packets via the router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just feel that a significant latency is introduced if the devices have data to send to each other, but have to still route packets through the router. The same CSMA/CA scheme could be used to coordinate transmissions between the devices directly.&lt;/p&gt;&#xA;" OwnerUserId="35917" LastEditorUserId="8499" LastEditDate="2018-11-04T19:01:09.247" LastActivityDate="2018-11-04T19:01:09.247" Title="Routing packets in 802.11 (Wi-Fi)" Tags="|wireless|ieee-802.11|mac|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40334" PostTypeId="2" ParentId="40328" CreationDate="2017-04-10T15:04:57.110" Score="2" Body="&lt;p&gt;All IP addresses are routable, the Internet Protocol was designed for this very purpose.&lt;/p&gt;&#xA;&lt;p&gt;But not all of them are routed &lt;em&gt;everywhere&lt;/em&gt;&lt;/p&gt;&#xA;&lt;p&gt;There's a bunch of network that were assigned for specific purposes and that are not routed &lt;strong&gt;on the public Internet&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;The 2 most common type of IP addresses you will heard off are commonly called &lt;code&gt;public IP addresses&lt;/code&gt; and &lt;code&gt;private IP addresses&lt;/code&gt;&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;a  &lt;strong&gt;public IP address&lt;/strong&gt; is a &amp;quot;normal&amp;quot; IP address which has not been assigned for special purpose. Those addresses are routable on the public Internet.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;a &lt;strong&gt;private IP address&lt;/strong&gt; is defined by &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;rfc1918&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Those addresses are :&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt; 10.0.0.0        -   10.255.255.255  (10/8 prefix)&#xA; 172.16.0.0      -   172.31.255.255  (172.16/12 prefix)&#xA; 192.168.0.0     -   192.168.255.255 (192.168/16 prefix)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;Anyone can use those addresses in private network, but due to this, those addresses are no longer unique and so cannot be routed on the Internet. Any decent Internet Service Provider will drop packets that have such address as source or destination.&lt;br /&gt;&#xA;But in private LAN, those addresses &lt;strong&gt;are routed&lt;/strong&gt;, within the company network or even between different companies that have (private) cross connectivity.&lt;/p&gt;&#xA;&lt;p&gt;There's other type of reserved addresses that are not public nor private, for example &lt;code&gt;loopback&lt;/code&gt; addresses , &lt;code&gt;127.0.0.0/8&lt;/code&gt; cannot be routed at all, even on private networks, or &lt;code&gt;multicast&lt;/code&gt; addresses, &lt;code&gt;224.0.0.0/4&lt;/code&gt; which, in theory, could be routed on the Internet, but practically is not routed, since it was not really designed for a worldwide internet.&lt;/p&gt;&#xA;&lt;p&gt;You will find all reserved IP addresses on the Wikipedia page &lt;a href=&quot;https://en.wikipedia.org/wiki/Reserved_IP_addresses&quot; rel=&quot;nofollow noreferrer&quot;&gt;Reserved IP addresses&lt;/a&gt;, or as pointed out by &lt;a href=&quot;https://networkengineering.stackexchange.com/users/8499/ron-maupin&quot;&gt;RonMaupin&lt;/a&gt; you'll find a more technical but more accurate and with appropriate official reference source at the &lt;a href=&quot;https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IANA IPv4 Special-Purpose Address Registry&lt;/a&gt; page&lt;/p&gt;&#xA;&lt;p&gt;Concerning static IP and PPoE, those are 2 different things.&lt;br /&gt;&#xA;PPPoE is widely found in ADSL connection (but not only);  ADSL specifically is a bad fit to host services (which is why you need a fixed IP) because the &amp;quot;A&amp;quot; stand for &amp;quot;Asymmetric&amp;quot;. I.E. the upload speed is much lower than the download speed.&lt;/p&gt;&#xA;&lt;p&gt;So it's uncommon to have fixed IP on an ADSL / PPPoE connection but it's perfectly possible (if your ISP is willing to provide it).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2017-04-10T16:18:33.170" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40335" PostTypeId="2" ParentId="40333" CreationDate="2017-04-10T15:08:40.747" Score="1" Body="&lt;p&gt;Packets are layer-3 datagrams, e.g. IP packets, that get routed, but Wi-Fi (IEEE 802.11) is a layer-1/2 protocol that uses frames, which encapsulate the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Wi-Fi has an infrastructure mode, where all frames must pass through the WAP, and an ad hoc mode, where frames are sent directly to another host. You must use one or the other. Most businesses use infrastructure mode with WAPs to get traffic to and from the main network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-10T15:08:40.747" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40336" PostTypeId="2" ParentId="40328" CreationDate="2017-04-10T15:14:10.013" Score="6" Body="&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;What is a “routable” IP?&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;IP addresses can be divided into several categories.&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Routable on the public Internet.&lt;/li&gt;&#xA;&lt;li&gt;Routable on private networks but not on the public Internet&lt;/li&gt;&#xA;&lt;li&gt;Not routable at all.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;People often say &amp;quot;routable&amp;quot; when they mean &amp;quot;publically routable&amp;quot; and &amp;quot;non-routable&amp;quot; when they mean &amp;quot;not publically routable&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;The IANA maintains a list of special purpose IP addresses at &lt;a href=&quot;https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.iana.org/assignments/iana-ipv4-special-registry/iana-ipv4-special-registry.xhtml&lt;/a&gt; the &amp;quot;forwardable&amp;quot; column tells you whether the addresses can be routed on private networks, the &amp;quot;Globally Reachable&amp;quot; column tells you whether the addresses can be routed on the public Internet.&lt;/p&gt;&#xA;&lt;p&gt;If it's not on that list then it's most likely a regular publically routable IP.&lt;/p&gt;&#xA;&lt;p&gt;Note that publically routable doesn't necessarily mean publically routed. Some ISPs (cellular providers in particular) have been known to abuse space that was either unallocated or allocated to companies who chose not to advertise it on the public Internet to give them additional space for addressing devices behind their NATs. This causes problems when the legitimate owners of the IP space later decide to start using it on the public internet.&lt;/p&gt;&#xA;&lt;p&gt;Probablly the best test is to do what you just did, compare the &amp;quot;WAN&amp;quot; IP address shown by your NAT router to the address shown by a &amp;quot;what is my IP&amp;quot; site.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I think I also get what dynamic IP and static IP mean but I am not familiar with PPPOE and why is that so important to get static IP if I am dealing with PPOE.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;PPPOE has little to do with it beyond the fact that the &amp;quot;PPPoE server&amp;quot; is likely the first IP device your traffic hits in your ISPs network.&lt;/p&gt;&#xA;&lt;p&gt;NAT can be used to translate the addresses on packets to hide multiple clients behind one address. In your case you have two layers of NAT, your local &amp;quot;router&amp;quot; acts as a NAT hiding your private network behind 192.168.13.234 your ISP in turn has a NAT hiding multiple customers behind 91.223.224.42.&lt;/p&gt;&#xA;&lt;p&gt;If you control the NAT you can &amp;quot;port forward&amp;quot; incoming services through it, but if you don't control the NAT you can't do that. So you can forward stuff through your NAT but it doesn't really help you because you can't forward it through the ISPs NAT to your NAT.&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;I will only be able to access my laptop from the outside if I pay for static IP address, because &amp;quot;my current public IP corresponds to PPPOE server and I need the static routing&amp;quot;.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;That is more of a policy thing than a technical thing. Your ISP could offer a &amp;quot;dynamic public IP&amp;quot; option but they have chosen not to. So your choices are a dynamic private IP behind a NAT or a static public IP.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="15245" LastEditDate="2021-08-25T16:08:35.327" LastActivityDate="2021-08-25T16:08:35.327" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="40342" PostTypeId="2" ParentId="40333" CreationDate="2017-04-10T16:52:59.430" Score="0" Body="&lt;p&gt;You are not wrong.  It adds both latency and consistency issues but hopefully you can source a high quality access point to mitigate that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WiFi Direct (which Miracast uses) allows certified devices to contact each other directly using a &quot;Soft AP&quot; approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Wi-Fi_Direct&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Wi-Fi_Direct&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However this is beyond the 802.11 standard but I thought I would mention it as it might interest you.&lt;/p&gt;&#xA;" OwnerUserId="35275" LastActivityDate="2017-04-10T16:52:59.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40343" PostTypeId="1" AcceptedAnswerId="40344" CreationDate="2017-04-10T19:50:02.810" Score="1" ViewCount="117" Body="&lt;p&gt;I get somewhat confused when I come across the adjective 'logical'. Some contexts I come across them: logical addressing, logical connection, logical topology, logical network etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it just as simple as being high(er) level and (more) abstract? For example, is an ip address a logical address because it's on a higher layer than a physical address?&lt;/p&gt;&#xA;" OwnerUserId="13978" LastActivityDate="2017-04-10T20:37:53.057" Title="What does the adjective 'logical' mean in logical- addressing, connection, topology etc?" Tags="|terminology|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40344" PostTypeId="2" ParentId="40343" CreationDate="2017-04-10T20:37:53.057" Score="1" Body="&lt;p&gt;When using logical, or virtual, that is opposed to the physical version.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A logical address is something like an IP address, where it really has no physical presence, but a physical address is like a MAC address where it is burned into a PROM on the interface. (In practice, MAC addresses can easily be changed, but the one burned into the PROM will still be there for the next time you restart). On the other hand, IP addresses are assigned in software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to logical connections, topology, etc., you have to remember that how devices are connected physically may look different than how they look logically. For instance, VLANs, trunks, tunnels, etc. can all affect how traffic flows that is different than how physical links seem to be connected. For example, a tunnel has two endpoints, but it may actually pass through many different links, each with two endpoints. To the traffic, the tunnel is a single hop, rather than all the multiple hops (which may change from packet to packet) that are really how the traffic flows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also can have logical (virtual) interfaces that behave like real, physical interfaces, but they are software constructs. A good example of that is a loopback interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-10T20:37:53.057" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40345" PostTypeId="2" ParentId="16875" CreationDate="2017-04-10T20:38:58.053" Score="1" Body="&lt;p&gt;I feel the other two answers here are actually giving you misleading information:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If a certain cable has a bandwidth of 10 mbps, that means in can&#xA;  contain 10 megabytes of data inside it at any given second.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;OK first lets clarify terminology, “10Mbps” is used to denominate a unit of speed “megabits per second” which is 10,000,000 bits per second. Megabytes being 8 times larger and MB (MegaBytes) usually used to denote volume of data as a unit. I assume you meant the former, 10Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly, I think you have misunderstood some basic networking aspects based on the wording in your question and I don’t think the other answers are clearing up your misunderstanding, only worsening it. There is almost no link to the length of a cable and the speed at which data is sent across it. The speed at which electrical signals travel down a copper wire is related to the dialectric constant of the  physical cable and casing properties. Long story short, they can travel at nearly the speed of light, copper cabling for all intents and purposes isn’t slower than fibre optics which many people seem to think.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to say how much data a cable can &quot;hold&quot;, irrelevant of length, the answer would be &quot;1 bit&quot; (a pair can be transitioning form DC+ to DC- or from DC- to DC+ at any one moment in time).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thirdly, speed is not the same as bandwidth. In networking nomenclature we use the word &quot;bandwidth&quot; to describe the volume of data that was moved. We can move 10MBs (megabytes) of data and 1Mbps (megabits per second), or we can move it at 10Mbps and it will take 1/10th of the time it would have taken at 1Mbps. The speed at which data is transferred over a copper cable does not change based on the length of the cable. We can have a 5 meter cable that runs at 10Mbps, 100Mbps, 1Gbps, 10Gbps etc (there is a slight increase in delay with longer cables as I said above, the electrical signal does have to propagate down the cable,  but this is so tiny it is negligible, it doesn’t change the speed of the network link). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;...a nominal maximum length of 100m. Longer than that your bandwidth will most likely drop (quickly to 0).&lt;/code&gt; - the bandwidth doesn't drop, it either &quot;is&quot; or it &quot;isn't&quot;. The data was either received without error at the speed the link operates at (10Mbps, or 100Mbps etc.) or it wasn’t and the data must be resent. This is only if you are using protocols that support re-transmission and/or you are sending data which must be re-sent (e.g. live TV streams, dropped packets are lost and not usually retransmitted). Since speed and bandwidth are not the same thing, it is possible for the error rate to increase without the bandwidth dropping by sending larger frames or packets for example, so few packets need to be successfully send and received because they carry more data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;so no it does [not] increase with length (again, rather decrese)&lt;/code&gt; - nope, bandwidth is not dependent on length. Again, the misuse of phrasing is making things unclear. I take bandwidth to mean &quot;the goodput of data successfully transferred&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;The original Ethernet specification limits the individual copper cable lengths to 100 meters, because of the latency time of getting a packet from end-to-end then getting the returning ACK before timing out.&lt;/code&gt; - No. ACK is something that happens at the transport layer in TCP. The length of 100 meters likely stems from CMSA/CD (Carrier-Sense Multiple Access with Collision Detection). This is the process of listening on the wire for a specific time, to check if another device is transmitting, if no device is transmitting (nothing is received) then it is assumed to be safe to transmit without a collision occurring. How long should we wait before we know its safe to transmit? We wait as long as it would take for the signal to travel from a device 100 meters away!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;For instance: when you are transferring 10 MB of data, longer cables will be a bit slower to transfer that total amount than shorter ones simply because the signals travel at about 2/3 of the speed of light in copper. More length means more latency.&lt;/code&gt; - this is a bit of misnomer. I touched on it above. The increase in delay from the extra cable length is so small it has no measurable impact. Wikipedia (&lt;a href=&quot;https://en.wikipedia.org/wiki/Speed_of_electricity&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Speed_of_electricity&lt;/a&gt;) lists the speed of electricity to be in the range of 50%-99% the speed of light. At 0.5 c it takes 0.0000006 seconds for the electrical signal to travel 100 meters. For a 10 meter cable it takes “one less zero”, 0.000006 seconds. This has no measurable impact on you day-to-day application performance. What does have an impact is the operating speed, such as 10Mbps or 100Mbps. On a 10 meter length of Cat5e cable running at 10Mbps you will only get 10Mbps, no more, no less. Equally, if you now connect that same 10 meter length of Cat5e up at 100Mbps it will run at 100Mbps, no more, no less. What really makes a difference are factors like the encoding scheme used (&lt;a href=&quot;https://en.wikipedia.org/wiki/64b/66b_encoding&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/64b/66b_encoding&lt;/a&gt;), serialisation delay, the error detection and correction methods used (see &lt;a href=&quot;https://en.wikipedia.org/wiki/Reed%E2%80%93Solomon_error_correction&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Reed%E2%80%93Solomon_error_correction&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Hamming_code&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Hamming_code&lt;/a&gt;), etc. This is because as the length increases so will the attenuation, NeXT, FeXT (&lt;a href=&quot;https://en.wikipedia.org/wiki/Crosstalk&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Crosstalk&lt;/a&gt; and &lt;a href=&quot;https://en.wikipedia.org/wiki/Attenuation-to-crosstalk_ratio&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Attenuation-to-crosstalk_ratio&lt;/a&gt;) etc. resulting in (eventually) data loss.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2017-04-10T20:38:58.053" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="40347" PostTypeId="2" ParentId="40193" CreationDate="2017-04-10T21:33:21.087" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Can this be done with OpenVPN?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It can almost certainly be done with a combination of OpenVPN and the networking features in the Linux kernel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two openVPN instances one for each VLAN, bridged to the real networks with Linux bridging can connect the sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keeping internet traffic local can be achived in a few ways. One way would be to use different default gateway IPs for the two sides but that would then mean either forgoing DHCP on one side of the VPN or doing some fancy stuff in the DHCP server to give machines the right default gateway IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another possibility may be to use the same default gateway IP on both sides and then use ebtables to block traffic to/from the default gateways from crossing the VPN.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-04-11T14:27:46.853" LastActivityDate="2017-04-11T14:27:46.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40348" PostTypeId="2" ParentId="3326" CreationDate="2017-04-10T22:55:17.063" Score="0" Body="&lt;p&gt;Please find latest updates on GNS3.&#xA;It now supports etherchannel, spanning tree features and other L2 features as well.&#xA;&lt;a href=&quot;http://docs.gns3.com/1aQSkL4KyIh-3j-UCeuukj4Wg1VJ7uI-vwcewaUHbjbU/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://docs.gns3.com/1aQSkL4KyIh-3j-UCeuukj4Wg1VJ7uI-vwcewaUHbjbU/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="27552" LastActivityDate="2017-04-10T22:55:17.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40349" PostTypeId="2" ParentId="40328" CreationDate="2017-04-10T23:01:11.470" Score="0" Body="&lt;p&gt;It is a basic concept.&#xA;The IP that ISP provided may have been 'Shared' among different clients.&#xA;As ISP advised, you need to buy/rend a static IP from ISP.&#xA;Routeable IPs are public IPs on the internet. You need to NAT your private IP to public IP so the website can be reachable from the internet.&#xA;As for now, you only seem to access on intranet i.e locally defined private IP.&lt;/p&gt;&#xA;" OwnerUserId="27552" LastActivityDate="2017-04-10T23:01:11.470" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40350" PostTypeId="1" AcceptedAnswerId="40351" CreationDate="2017-04-11T01:04:28.340" Score="1" ViewCount="473" Body="&lt;p&gt;A Cisco switch (IOS) on our network configured with VLAN 7 and VLAN 8 as access VLANs (7 being the native for the trunk on the switch) had the VLANs bridged by someone who connected a patch cable from one network jack to another network jack (essentially connecting two ports together one with access VLAN 7, the other with access VLAN 8). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This created a bridge that caused all static IP devices from VLAN 8 to stop working, and any DHCP requests that came from a port that was configured to VLAN 8 was answered by the subnet on VLAN 7. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found a great deal of documentation on how and why people would want this enabled, however, I want this type of behavior to be errdisabled, and I'm not sure which spanning tree configuration (if any) would allow me to block this behavior. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The two ports just had a 3 basic configurations:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; switchport access vlan 8&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;&#xA; switchport access vlan 7&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From my understanding, spanning-tree guard root would only errdisable a port if it detects a potential switching loop, however this wasn't a loop, but a bridge. What would be the best practice here?&lt;/p&gt;&#xA;" OwnerUserId="35933" LastEditorUserId="8499" LastEditDate="2018-12-25T04:36:32.617" LastActivityDate="2018-12-25T04:36:32.617" Title="How can I prevent VLAN bridging on a Cisco switch" Tags="|cisco|switch|vlan|spanning-tree|bridge|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40351" PostTypeId="2" ParentId="40350" CreationDate="2017-04-11T01:22:59.797" Score="0" Body="&lt;p&gt;You can, and really should, globally enable portfast and bpduguard:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;spanning-tree portfast default&#xA;spanning-tree portfast bpduguard default&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will errdisable access interfaces receiving BPDUs. It does not affect trunk interfaces unless you use the &lt;code&gt;trunk&lt;/code&gt; keyword.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you do this globally, you don't need to worry about configuring and changing individual interfaces as their roles may change.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-11T01:22:59.797" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40352" PostTypeId="1" CreationDate="2017-04-11T04:01:25.440" Score="8" ViewCount="8273" Body="&lt;p&gt;I am trying to find differences between PPPoE and L2TP.Both are tunneling protocols. When to use what?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks,&#xA;GL&lt;/p&gt;&#xA;" OwnerUserId="35050" LastActivityDate="2017-04-13T10:14:46.550" Title="PPPoE vs L2TP protocols" Tags="|vpn|pppoe|l2tp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40359" PostTypeId="1" CreationDate="2017-04-11T16:24:41.917" Score="2" ViewCount="70" Body="&lt;p&gt;Let us say we have switch with multiple gigabit interfaces and there is two machines connected to that switch, one with gigabit NIC and one with 100 mbps NIC and we start copying file from the gigabit machine to the fast ethernet machine.&#xA;The file copy speed will be maximum 100 mbps but how the 1 gbps machine will know about the second party speed and send slower? Is it through TCP messages? And in case we are sending ICMP/UDP packets what will happen?&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-04-11T17:48:25.877" Title="How did the sender detect the reciver speed?" Tags="|ethernet|tcp|qos|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40363" PostTypeId="2" ParentId="40359" CreationDate="2017-04-11T17:40:06.703" Score="2" Body="&lt;p&gt;If TCP is in use and Ethernet flow control is not the following will happen.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The sender will start sending packets, initially slowly but then increasing the rate over time.&lt;/li&gt;&#xA;&lt;li&gt;When the data rate gets too high the packet buffer on the switch will fill up and a packet will be dropped.&lt;/li&gt;&#xA;&lt;li&gt;The sender will then back off the data rate, the rate on the line will remain around the capacity of the line gradually increasing until a packet is dropped and then backing off again.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Other protocol combinations may vary. In some cases large volumes of packets may end up being dropped by the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first and most commonly implemented flow control system for Ethernet used &quot;pause frames&quot;. Pause frames were intended as a means of implementing &quot;back pressure&quot; within the Ethernet network so that switch buffers did not overflow as the speed of sending nodes was limited to what the downstream devices could tag. Unfortunately they created problems where one congested flow could cause blocking of other uncongested flows, so they are often disabled in practice.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-04-11T17:48:25.877" LastActivityDate="2017-04-11T17:48:25.877" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40364" PostTypeId="2" ParentId="40359" CreationDate="2017-04-11T17:44:18.703" Score="3" Body="&lt;p&gt;Fundamentally, if the switch can only forward packets at 100M, then the switch buffers will overflow and drop packets. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're using TCP, the sender will react to no ACKs by slowing down until an equilibrium (more or less) is reached. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-11T17:44:18.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40366" PostTypeId="1" AcceptedAnswerId="40370" CreationDate="2017-04-11T23:39:13.853" Score="1" ViewCount="379" Body="&lt;p&gt;So I've looked a lot into accessing devices with the same IP and haven't been able to find much of an answer, but I imagine there is some solution and that this issue is somewhat common.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I often find myself in a situation where I need to configure a bunch of hardware devices that have a factory IP. The conventional method is to connect to them individually and configure them, then take them off the network for deployment elsewhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was sick of the repetition in this, so I create a node JS application to do it for me, the problem is they are still all on the same IP so I still have to do them one at a time. What I envision is some router configuration in which every physical port has a predetermined IP address. I would need to configure these ports to forward the traffic to the factory IP of the hardware, but once that is done I could connect them all to the router and then have my node application configure them at the same time using the port-assigned IP address instead of the factory IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any information or even a nudge in the right direction would be greatly appreciated!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw this post: &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/16062/assign-an-ip-address-based-on-switch-port?rq=1&quot;&gt;Assign an IP address based on switch port&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems pretty close to what I need except it looks like it requires the devices to be set to DHCP. This isn't an option for hardware that comes with a static IP as the factory default settings.&lt;/p&gt;&#xA;" OwnerUserId="35956" LastEditorUserId="-1" LastEditDate="2017-04-13T12:57:11.173" LastActivityDate="2017-08-19T13:56:19.333" Title="Accessing multiple devices with factory IP on single router individually. Force IP based on port?" Tags="|router|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40367" PostTypeId="2" ParentId="40366" CreationDate="2017-04-12T01:32:27.753" Score="0" Body="&lt;p&gt;The problem is that each router interface must be in a different network; routers route between networks, not from a network back to the same network. A router with multiple interfaces in the same network would not know which interface to use.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-12T01:32:27.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40368" PostTypeId="2" ParentId="38538" CreationDate="2017-04-12T01:58:48.883" Score="1" Body="&lt;p&gt;I have seen this quite a few times myself and in most cases, depending on where I was capturing traffic, this was the result of &lt;strong&gt;propagation delay&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you're capturing somewhere upstream closer to the sender, particularly in high latency links, you will see lots of packets sent to the receiver before the receiver has time to receive, process, and acknowledge the packets and for those acknowledgements to make it back over the network to your capture point resulting in an apparent &quot;ack burst&quot;. Propagation delay is what causes this effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, this traffic pattern can also be caused by many &lt;strong&gt;other factors&lt;/strong&gt; (e.g. low or over-utilized CPU/memory/etc. resources, poor NIC drivers, or old NIC hardware on the receiver), but in most cases I have dealt with this was the result of good 'ole propagation delay/high latency.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;This effect is sometimes better understood via an example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a scenario where you have a server and a client separated by a wide area network that has a bandwidth capacity of 100Mbps and a end-to-end network latency (propagation delay) of 20ms round-trip-time (RTT).&lt;br&gt;&#xA;The client has advertised a classic TCP receive window (RWIN) value of 64KB, transport is IP, MTU and TCP maximum segment size are 1500 and 1460 bytes, respectively, and the server is sending a large file via TCP to the client.&lt;br&gt;&#xA;In this scenario, congestion windows/slow start, selective acknowledgments, and RWIN scaling are ignored for simplicity's sake.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Due to the concept of receive windowing, the TCP sender (the server in this case) knows it can send up 64KB of TCP payload data before the client (receiver) acknowledges it has received any of that data.&#xA;With an MSS of 1460 bytes, this would equate to 45 packets for a total of approx. 526Kb (64KB + TCP/IP overhead / 8 bits per byte).&lt;br&gt;&#xA;At 100Mbps, the server is able to send those 526Kb in approx. 5.3 milliseconds. The server is unable to send any additional data until the client starts acknowledging the data that has already been sent (data in flight).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because of the propagation delay of the network, it takes 10ms for the first data packet to arrive at the client (20ms RTT/2 = one-way delay). Even if the client acknowledges each packet immediately as it arrives (or more likely, due to delayed acks, acknowledges every other packet), those acknowledgements will take another 10ms to travel from the client back to the server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the time the server receives the first acknowledgement, it will have already been waiting for at least 14.7ms since it sent its last packet to the client, with the rest of the acknowledgements arriving over the next several milliseconds.&lt;br&gt;&#xA;When capturing traffic on the server side, this will appear as a burst of data packets from the server, followed by a delay, followed by a burst of acks coming in from the client, followed by (or interspersed with) another burst of data packets etc. until the data transfer is complete.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's important to understand here, though, is that from the client side, it is acknowledging packets as soon as they arrive, and indeed if you captured on the client side, you would see a delay, followed by an even mix of data packets arriving and acks being sent out, followed by a delay, etc.&lt;br&gt;&#xA;This is why it is very important to understand where the traffic capture took place when interpreting it.&lt;/p&gt;&#xA;" OwnerUserId="21833" LastEditorUserId="68736" LastEditDate="2020-05-26T16:38:03.163" LastActivityDate="2020-05-26T16:38:03.163" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40369" PostTypeId="1" CreationDate="2017-04-12T05:57:01.070" Score="1" ViewCount="440" Body="&lt;p&gt;first question is what type of operating system is used by BRAS Or Border Network Gateway computer.I sit Linux Or Windows Server or it can be any. I have read about windows server Gateway that is support BGP protocol.do most isp use Linux or windows and which one will be better. Second question is Is the Billing software installed at the BRAS Computer or im lost. just asking out of curiosity &lt;/p&gt;&#xA;" OwnerUserId="35961" LastActivityDate="2017-04-12T08:06:03.300" Title="What really happens On the BRAS or Border Network Gateway Computer At Isp" Tags="|routing|internet|" AnswerCount="1" CommentCount="1" ClosedDate="2017-04-12T13:15:27.190" ContentLicense="CC BY-SA 3.0" />
  <row Id="40370" PostTypeId="2" ParentId="40366" CreationDate="2017-04-12T06:26:41.413" Score="2" Body="&lt;p&gt;Even if each device has the same IP, it has another address that is unique to each device: the &lt;code&gt;Media Access Control (MAC)&lt;/code&gt; address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you must find a way to access the devices with this MAC address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP to MAC address binding is done through &lt;code&gt;Address Resolution Protocol (ARP)&lt;/code&gt;. An arp resolution is normally performed to associate them, but you can do it manually with a static ARP entry on your management station.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could try to :  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;gather all MAC addresses of the devices, put them in a file&lt;/li&gt;&#xA;&lt;li&gt;connect all your devices plus your management station to a switch (without a router)&lt;/li&gt;&#xA;&lt;li&gt;have your application to read the MAC list file, set a static arp entry for the first device, configure it, change the static ARP entry to the second device, etc...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;This will probably require you software to run with administrative privilege on the station to be allowed to set static ARP entry.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-08-18T12:34:48.160" LastActivityDate="2017-08-18T12:34:48.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40371" PostTypeId="1" AcceptedAnswerId="40372" CreationDate="2017-04-12T07:08:03.357" Score="0" ViewCount="1085" Body="&lt;p&gt;Does anyone know any possibility to do Bandwidth reservation or something equal to it. Mainly to give VoIP and IPTV Bandwidth before the Internet when there is no possibility to use QoS and VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should be possible to automatically detect the device connected to the port (based on MAC address or device name) and then enable either VLAN X if its a IPTV Box connected or VLAN Y if its a SOHO Router connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any input may it be another View to the situation or a maybe possible solution is kindly requested.&lt;/p&gt;&#xA;" OwnerUserId="3227" LastEditorUserId="8499" LastEditDate="2017-04-12T14:12:54.030" LastActivityDate="2017-04-12T14:12:54.030" Title="Bandwidth regulation without QoS and VLAN" Tags="|switch|router|vlan|qos|voip|" AnswerCount="1" CommentCount="1" ClosedDate="2018-07-24T00:19:22.203" ContentLicense="CC BY-SA 3.0" />
  <row Id="40372" PostTypeId="2" ParentId="40371" CreationDate="2017-04-12T07:53:55.027" Score="1" Body="&lt;p&gt;Your description and Heading contradicts each other.In description you mentioned that you want to achieve it without using VLAN and QOS.However,In description you have mentioned that &quot;enable either VLAN X if its a IPTV Box connected or VLAN Y if its a SOHO Router connected&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Given that,the best method is to use QOS and VLAN to achieve your requirement.There is also another method do it using a different way. &lt;strong&gt;Iptables + tc in a linux based router&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Identifier for Device:&lt;/strong&gt;&#xA;You can use the Option 60 in DHCP request.Vendor Class identifier to understand the type of device connected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Bandwidth rate limiting Logic&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use both iptables policies and tc to limit the bandwidth for particular devices with different Vendor class identifier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since your query doesn't have more details about the bandwidth rate or name of vendor class identifiers.I will just give some sample commands for your reference.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sample TC rule for 100mbps&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;tc class add dev eth0 parent 1: classid 1:1 htb rate 100mbit&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm sure if you explore both tc and iptables,you should be able to come up with a script to achieve your requirement.It is good to use an openW.R.T based router with tc support for your setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: The best solution is to use VLAN + QOS solution.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDITED based on the Comment&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A good router/Gateway/CPE at the customer end can solve this problem. I belive what you are trying to achieve is to provide seamless services to your end customers. &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Faster connectivity to End Customer and Priority for the SetTop Box Traffic in your network.Constraint: STB doesn't support QOS.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;SOHO router packets need to be considered with lower priority and treated in a differnt VLAN.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Do you have access/own the Gateway/Router at the Customer Premise.If yes,then Scheduling and Prioritizing the packets with different queues can provide a solution for this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option #1: Using vendor class idetifier &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming that an STB can be identified using DHCP option 60 in the network,You can tag all the packets from STB with Higher priority with (eg. &quot;CS5&quot; for Broadcast Video).Similarly you can tag all the SIP/RTP packets with &quot;EF&quot; priority and rest of the packets in Best effort queue. This will help you to maintain a good QOS for customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option #2:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why don't you create and establish different PPPOE from WAN (at Router)based on the service.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;PPP_IPTV for STB services at 122.123.124.125 IP range.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;PPP_Data for Default data at 172.15.45.1 &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;PPP_VOIP for VOIP services at 181.44.22.44&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;IP address mentioned above is arbitrary.&lt;/p&gt;&#xA;" OwnerUserId="34773" LastEditorUserId="34773" LastEditDate="2017-04-12T11:22:58.403" LastActivityDate="2017-04-12T11:22:58.403" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="40373" PostTypeId="2" ParentId="40369" CreationDate="2017-04-12T08:06:03.300" Score="1" Body="&lt;p&gt;It really depends of the type of vendor for the BRAS.However,BRAS doesn't use Consumer grade Linux or Windows User,simply because their architecture is not designed for a highly critical device in an ISP infrastructure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most of the BRAS equipment vendors will have their own proprietor OS with different licenses for their expensive features and cards. Huawei ME60-X16 uses proprietary OS and will support the below mentioned use cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switching Capacity :25.2 Tbit/s&lt;/p&gt;&#xA;&#xA;&lt;p&gt;User access protocol: PPPoE, PPPoEoA, IPoE, IPoEoA, and PPPoA 802.1X&#xA;User authentication protocol: PAP, CHAP, MSCHAP, RADIUS, and HWTACACS&#xA;User accounting protocol: RADIUS, HWTACACS, and COPS&#xA;User authorization protocol: RADIUS, HWTACACS, and COPS&#xA;Policy protocol: COPS and COA&lt;/p&gt;&#xA;&#xA;&lt;p&gt;22 slots, including 2 MPUs (1:1 backup), 4 SFUs (3+1 backup), and 16 LPUs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly a BRAS provided by Juniper or ZTE will have different spec and their own OS.&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-04-12T08:06:03.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40375" PostTypeId="1" AcceptedAnswerId="40376" CreationDate="2017-04-12T08:34:33.353" Score="3" ViewCount="1400" Body="&lt;p&gt;I've read my ISP, &lt;a href=&quot;https://en.wikipedia.org/wiki/Telecom&quot; rel=&quot;nofollow noreferrer&quot;&gt;Telecom&lt;/a&gt; uses a &lt;em&gt;Point-to-Point&lt;/em&gt; regarding the ADSL networking over ATM nowadays (which is rarely used in my country, and it's non-commercial). My friend told me it actually uses TR-069, is it true? Obviously, he isn't completely certain of what he said.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the actual difference? What method does Telecom actually use? I think it is an highly country-dependent answer.&lt;/p&gt;&#xA;" OwnerUserId="35968" LastActivityDate="2017-04-12T09:50:03.783" Title="What's the difference of TR-069 and Point-To-Point protocol?" Tags="|isp|adsl|point-to-point|atm|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40376" PostTypeId="2" ParentId="40375" CreationDate="2017-04-12T09:50:03.783" Score="4" Body="&lt;p&gt;I think you are confused with the terms Point to Point and TR-069 here. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;An ISP normally uses IPOE/PPPOE/PPPOA for establishing the connectivity between CPE(Modem/Gateway) and their BRAS. They also use their own radius server to authenticate the PPP connection for obvious reasons.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TR-069 is a mechanism to provision a Gateway/Modem with the respective plan(End customer plans based on their chosen plan) and other operation from the network operator point of view.TR-069 also can be used to fetch the complete data model of the Modem and operator can pretty much read and write(only Writable Parameters) from the CPE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to this,ISP will also set a periodic inform counter in which CPE will also send periodic Inform with information such as Model number,Software version and other details towards ISP's ACS(Access Control System). This is how ISP understand the firmware version of the CPE and trigger a Software upgrade on a scheduled basis.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TR-069 can also be used for ISP to trigger Remote Procedure calls where CPE will trigger WiFi Scan,GET,Set, etc operations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;On a layman perspective, PPP is L2 protocol and TR-069 is an application layer protocol.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will be more happy to provide more detailed answer for any queries regarding CWMP or TR-069.Let me know if you need more info on this.&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-04-12T09:50:03.783" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40378" PostTypeId="1" CreationDate="2017-04-12T10:23:51.513" Score="1" ViewCount="118" Body="&lt;p&gt;Let's assume I have a connection between a machine at a datacenter in France and a datacenter in Singapore and the RTT between the two is around &lt;code&gt;270 ms&lt;/code&gt; according to ping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I do a traceroute from the machine in France to the machine in Singapore, I see this as part of the traceroute output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 8  ldn-bb2-link.telia.net (62.115.115.202)  3.888 ms  ae-2-3201.ear1.london1.level3.net (4.69.141.66)  4.109 ms  4.174 ms&#xA; 9  ldn-b5-link.telia.net (80.91.247.92)  3.977 ms ix-ae-20-0.tcore1.ldn-london.as6453.net (195.219.83.101)  4.150 ms  4.132 ms&#xA;10  tata-ic-300410-ldn-b5.c.telia.net (62.115.9.174)  3.967 ms  4.106 ms  4.084 ms&#xA;11  if-ae-15-2.tcore2.l78-london.as6453.net (80.231.131.117)  265.990 ms  266.042 ms  266.074 ms&#xA;12  if-ae-9-2.tcore2.wyn-marseille.as6453.net (80.231.200.13)  262.892 ms  263.072 ms  263.093 ms&#xA;13  if-ae-2-2.tcore1.wyn-marseille.as6453.net (80.231.217.1)  268.949 ms  269.093 ms  268.861 ms&#xA;14  if-ae-5-2.tcore1.mlv-mumbai.as6453.net (80.231.217.30)  264.870 ms if-ae-5-2.tcore1.mlv-mumbai.as6453.net (180.87.38.125)  271.598 ms  264.201 ms&#xA;15  if-ae-2-2.tcore2.mlv-mumbai.as6453.net (180.87.38.2)  263.022 ms  262.824 ms  262.757 ms&#xA;16  if-ina-2.tcore2.svw-singapore.as6453.net (180.87.12.226)  266.572 ms  261.399 ms  268.869 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Assuming that the city names in the PTR host entries match the geolocation, the packets would travel that way around the world (Note: In the traceroute output I cut the &lt;code&gt;France-&amp;gt; Great Britain&lt;/code&gt; part off.):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;France -&amp;gt; Great Britain -&amp;gt; France -&amp;gt; India -&amp;gt; Singapore&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But then the RTT's clearly conflict with that assumption. One would assume a high RTT between Europe and Asia, but not between 2 peering networks in the same city (see hop 10 and 11). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the conclusion seems to be that any &quot;geolocation&quot; info in the PTR record is basically useless? Also any whois information on IP geolocation seem to be useless, because if you do a whois query on the hops 11-15 you will get these country information:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11 80.231.131.117 (if-ae-15-2.tcore2.l78-london.as6453.net) -&amp;gt; &quot;country: Great Britain&quot;&#xA;12 80.231.200.13 (if-ae-9-2.tcore2.wyn-marseille.as6453.net) -&amp;gt; &quot;country: France&quot;&#xA;13 80.231.217.1 (if-ae-2-2.tcore1.wyn-marseille.as6453.net) -&amp;gt; &quot;country: France&quot;&#xA;14 80.231.217.30 (if-ae-5-2.tcore1.MLV-Mumbai.as6453.net)-&amp;gt; &quot;country: France&quot;&#xA;15 180.87.38.2 (if-ae-2-2.tcore2.MLV-Mumbai.as6453.net) -&amp;gt; &quot;country: India&quot;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As one can see even these are inconsistent (e.g. hop 14 - PTR record &quot;Mumbai&quot; vs whois record &quot;France&quot;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is: Is the naming just arbitrary? Have I overlooked anything or is there really no connection between geolocation and router DNS records and even whois information?&lt;/p&gt;&#xA;" OwnerUserId="35970" LastActivityDate="2017-04-12T11:25:41.297" Title="Relationship between DNS records of routers, whois information and geolocation?" Tags="|routing|network-core|peering|" AnswerCount="1" CommentCount="3" ClosedDate="2017-04-12T13:16:52.397" ContentLicense="CC BY-SA 3.0" />
  <row Id="40379" PostTypeId="1" AcceptedAnswerId="40384" CreationDate="2017-04-12T10:29:22.463" Score="1" ViewCount="398" Body="&lt;p&gt;I just got a Cisco SG300-10 switch (my first switch &amp;amp; Cisco product), installed the latest firmware (1.4.7.06), changed the management IP to 192.168.3.254 (static, not dhcp) but am having trouble pinging it from a different subnet (192.168.1.0/30). I can, however, ping the switch (192.168.3.254) directly from my router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a test, I was able to plug in a laptop to the same ethernet port on my router that the switch is currently using, set the laptop's IP to 192.168.3.254, and ping the laptop from 192.168.1.0/30. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts on why I can't reach the switch from 192.168.1.0/30?&lt;/p&gt;&#xA;" OwnerUserId="35972" LastActivityDate="2017-04-12T13:40:08.767" Title="Can't reach switch through router" Tags="|cisco|switch|router|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40380" PostTypeId="1" AcceptedAnswerId="40381" CreationDate="2017-04-12T10:31:23.447" Score="0" ViewCount="46" Body="&lt;p&gt;My laptop is connected to the internet via a wifi router. In other words my router is connected to the internet. When i check my ip address via a web service i see that the ip address keeps changing. The ip address that my router gets yesterday is different from what i get today. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) I am wondering when is a computer given a static ip address? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) Does one need to pay for a static ip address? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;3) Since the point of ip address is to uniquely identify a computer in a network, shouldn't the address be always static? in other words if the address keeps changing then how can it help in uniquely identifying a computer? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I appreciate any help to the above curiosities i have. Thanks a lot!&lt;/p&gt;&#xA;" OwnerUserId="35973" LastActivityDate="2017-04-12T11:05:21.387" Title="When is static ip address given?" Tags="|ipv4|isp|ip-address|" AnswerCount="1" CommentCount="1" ClosedDate="2017-04-12T11:12:01.410" ContentLicense="CC BY-SA 3.0" />
  <row Id="40381" PostTypeId="2" ParentId="40380" CreationDate="2017-04-12T10:53:15.470" Score="1" Body="&lt;p&gt;There are two network elements in here to consider.One is your Wifi Router and another one is your Laptop.Currently I don't know whether your setup works in bridged mode or routed mode. In any case from the ISP's perspective providing you a static IP most like would need an additional payment.ISP's BRAS normally will have a Pool of IP address and based on the availability of the users connected to their network they provide these IP address from the pool using PPPOE(PPP) or DHCP(IPOE).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not necessary and not practically feasible to provide all the connected devices in Internet with a unique IP due to limitations in IPv4. This is where NAT is coming into picture to help them.If NAT is enabled on your router then your laptop will have a Local IP address (192.168.1.xxx/172.16.xxx.xxx,10.xxx.xxx.xxx).NAT will help the routing of a connected device in Local IP with the help of IP + port number in the local scope of router. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1) I am wondering when is a computer given a static ip address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;When the user want to access that PC remotely or that PC will need to act as server in the Internet where the IP is binded to a domain name. Eg. Web Server,Gaming server,DNS server etc.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;2) Does one need to pay for a static ip address?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes,Most likely.However,Some ISP used to provide Static IP free for their premium users or users who pay for higher plans.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Since the point of ip address is to uniquely identify a computer in a&#xA;  network, shouldn't the address be always static? in other words if the&#xA;  address keeps changing then how can it help in uniquely identifying a&#xA;  computer?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;NAT.Nat will help indirectly for a node in the INTERNET to uniquely identify a computer with Public IP+port. However,the public IP will also subject to change if ISP doesnt provide static IP address to your router. This is where people use DynDNS to reach their PC or Modem from internet.&lt;/p&gt;&#xA;" OwnerUserId="34773" LastEditorUserId="34773" LastEditDate="2017-04-12T11:05:21.387" LastActivityDate="2017-04-12T11:05:21.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40383" PostTypeId="2" ParentId="40378" CreationDate="2017-04-12T11:25:41.297" Score="3" Body="&lt;p&gt;The thing is that you have an MPLS network in the middle of your traceroute. Actually results from traceroute are not really accurate when it comes to MPLS environment. What happens is that all ICMP TTL exceeded messages originated by a P device first have to be tunneled to the other edge using the original label stack before being sent back to the originator of traceroute operation. Therefore, you will always see end-to-end RTT across the provider core in the output. You need to trace from PE router toward a provider-scoped IP address to resolve this &quot;layering&quot; problem and observe proper RTT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: DNS resolving is correctly configured.&lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-04-12T11:25:41.297" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40384" PostTypeId="2" ParentId="40379" CreationDate="2017-04-12T13:40:08.767" Score="3" Body="&lt;p&gt;Sounds like you don't have a default gateway configured on your Cisco switch.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2017-04-12T13:40:08.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40392" PostTypeId="2" ParentId="23421" CreationDate="2017-04-12T18:44:14.480" Score="0" Body="&lt;p&gt;I know it's been a few years but I'll share my experience for future reference: I had the same problem and solved it by removing spaces on my web servers. I can see you have a web server called &quot;Win7 Test&quot;, change that to &quot;Win7_test&quot; and that should do the trick (at least it did it for me).&lt;/p&gt;&#xA;" OwnerUserId="35985" LastEditorUserId="253" LastEditDate="2017-04-16T09:29:12.807" LastActivityDate="2017-04-16T09:29:12.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40393" PostTypeId="1" AcceptedAnswerId="40394" CreationDate="2017-04-12T18:47:01.847" Score="1" ViewCount="119" Body="&lt;p&gt;When EIGRP loses Successor route and transfers to Feasible Successor route does it calculate another Feasible Successor right away? So the first Feasible Successor becomes the Successor and new FS is calculated. Or does it wait for both Successor and FS to die and only then it looks for new best routes?&lt;/p&gt;&#xA;" OwnerUserId="24668" LastEditorUserId="8499" LastEditDate="2018-12-25T04:38:02.000" LastActivityDate="2018-12-25T04:38:02.000" Title="EIGRP protocol convergence" Tags="|cisco|routing|eigrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40394" PostTypeId="2" ParentId="40393" CreationDate="2017-04-12T19:21:07.380" Score="1" Body="&lt;p&gt;If the Reported Distance for a route is less than or equal to the Feasible Distance, then the route is a Feasible Successor. You can have multiple Feasible Successors, or none at all. The Feasible Distance is the historic, since the route went Active, best metric for a destination. It is possible for there to be multiple routes to the destination, but none are Feasible Successors because the Reported Distances are all larger than the Feasible Distance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the Successor route goes away, then the Feasible Successor with the best metric takes over, end of story. If there are no Feasible Successors (because none of the other routes' Reported Distances meet the Feasible Distance), then a query goes out to see if there are any neighbors that know how to reach the destination. If so, then the new Successor, and possibly Feasible Successors, are chosen.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-12T19:21:07.380" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40396" PostTypeId="1" AcceptedAnswerId="40397" CreationDate="2017-04-12T22:14:31.470" Score="1" ViewCount="620" Body="&lt;p&gt;I understand that if I were to send a packet to a destination outside my LAN, it would have to reach the gateway first before it is being routed to the final destination. However, when I visit a website(which is clearly not hosted in my LAN), I do not see any packets being sent to or from my gateway ip from the wireshark window. The gateway ip is obtained from ipconfig. It seems that TCP and HTTP are both communicated directly between my PC and the external web server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I find the real ip address of the gateway?Is the one given in ipconfig always the one where the packets are forwarded to first?&lt;/p&gt;&#xA;" OwnerUserId="35989" LastActivityDate="2017-04-12T22:22:21.440" Title="Why is my pc not forwarding packets to my default gateway?" Tags="|router|ipv4|lan|arp|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40397" PostTypeId="2" ParentId="40396" CreationDate="2017-04-12T22:22:21.440" Score="1" Body="&lt;p&gt;The IP address of the default gateway is learned by DHCP or is manually set. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think you are confused about how the gateway works. The destination IP address of your packet does not change.  The PC forwards the packet to the gateway by learning the MAC address of the gateway. So the destination MAC address of the Ethernet packet will be the default gateway. The IP address will be the website you're going to. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-12T22:22:21.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40401" PostTypeId="1" AcceptedAnswerId="40402" CreationDate="2017-04-13T05:12:41.093" Score="1" ViewCount="89" Body="&lt;p&gt;Google search gives me definition of Value Added Services and other things, &lt;a href=&quot;https://www.google.com/search?client=ubuntu&amp;amp;channel=fs&amp;amp;q=stackexchange%20networking&amp;amp;ie=utf-8&amp;amp;oe=utf-8#channel=fs&amp;amp;q=what%20are%20Operator%20Specific%20Services%20in%20telecom&quot; rel=&quot;nofollow noreferrer&quot;&gt;but not OSS's&lt;/a&gt;. I have read about OSS's &lt;a href=&quot;https://www.google.com/search?client=ubuntu&amp;amp;channel=fs&amp;amp;q=stackexchange%20networking&amp;amp;ie=utf-8&amp;amp;oe=utf-8#channel=fs&amp;amp;q=what%20are%20Operator%20Specific%20Services%20in%20telecom&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The GSM service control function (gsmSCF) is a new entity that&#xA;  consists of service logic for operator-specific services (OSSs).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="33681" LastActivityDate="2017-04-13T05:33:48.627" Title="What is meant by Operator Specific Services (OSSs) in telecommunication?" Tags="|telephony|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40402" PostTypeId="2" ParentId="40401" CreationDate="2017-04-13T05:33:48.627" Score="1" Body="&lt;p&gt;I hope you might have encountered the term OSSs while going through the CAMEL procedure in GSM. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;One point to note here is that the CAMEL feature is a network feature and not a supplementary service. It is a tool to help the network operator to&#xA;provide the subscribers with the operator specific services even when roaming outside the HPLMN(Home PLMN).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OSSs is the set of services which are not covered by standardized GSM services&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Services could be very specific to the particular Operator like Caller Tunes,IVR responses and any set of service provided by the operator which is not a standard one with respect to GSM standard.&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-04-13T05:33:48.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40404" PostTypeId="1" AcceptedAnswerId="40411" CreationDate="2017-04-13T08:38:52.077" Score="2" ViewCount="398" Body="&lt;p&gt;I am learning about SAN. I know about LAN and NIC.&#xA;I wanted to what is the difference as per the above subject of the question?&#xA;HBA/CNA supports Fibre Optic Cables (SMF/MMF).&#xA;Please provide some specifics, that would be much appreciated.&lt;/p&gt;&#xA;" OwnerUserId="27552" LastActivityDate="2017-04-24T01:41:09.117" Title="What is the difference between Host Bus Adapters, Converged Network Adapters and Network Interface Card?" Tags="|lan|san|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40408" PostTypeId="2" ParentId="40352" CreationDate="2017-04-13T10:14:46.550" Score="9" Body="&lt;p&gt;The most and noticeable different is layer of tunneling. &lt;code&gt;PPPOE&lt;/code&gt; is a Layer 2 (Data Link Layer) tunneling protocol while &lt;code&gt;L2TP&lt;/code&gt; is a Layer 3 (Network Layer) tunneling protocol. This means that &lt;code&gt;PPPOE&lt;/code&gt; can create a tunnel between devices in a broadcast domain (such as devices connect to the same switch) but &lt;code&gt;L2TP&lt;/code&gt; can create a tunnel between two IP-based device anywhere in the world (if they are reachable from each other).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose there are two computer A and B which are connected to a R:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A &amp;lt;------&gt; R &amp;lt;--------&gt; B&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;A cannot tunnels to B using &lt;code&gt;PPPOE&lt;/code&gt; because A and B are not in the same broadcast domain but a tunnel could be created using &lt;code&gt;L2TP&lt;/code&gt; protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Other differences are in authentication and encryption methods which &lt;code&gt;L2TP&lt;/code&gt; is more flexible in authentication and is more secure in encryption. &lt;/p&gt;&#xA;" OwnerUserId="32227" LastActivityDate="2017-04-13T10:14:46.550" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40411" PostTypeId="2" ParentId="40404" CreationDate="2017-04-13T14:04:29.427" Score="3" Body="&lt;p&gt;To understand the terms you have to understand some history.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &quot;host bus adaptor&quot; was originally something used to connect a SCSI storage bus to a host computer. You could in theory have multiple computers on the same SCSI bus but limits on total devices made it impractical to have more than a couple.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The networking world used the term &quot;Network Interface card&quot; or &quot;network interface controller&quot; (both abbreviated to &quot;NIC&quot;) for the device used to connect a computer to a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Systems like Fibre Channel that were primarily used for storage kept the name &quot;host bus adaptor&quot; even as the storage network grew way beyond a simple bus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;People started wanting to build storage networks based on Ethernet because Ethernet is a lot cheaper than dedicated storage networking technologies and because it's often useful to only have to run one infrastructure rather than two. Various technologies have been created for this including &quot;Fiber Channel over Ethernet&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To support this at a hardware level device vendors introduced new &quot;converged network adapters&quot;. These provide support for both regular Ethernet services and hardware support for storage-specific protocols. For example Intel's cards support both Fibre Channel over Ethernet and iSCSI.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-04-24T01:41:09.117" LastActivityDate="2017-04-24T01:41:09.117" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40413" PostTypeId="1" CreationDate="2017-04-11T21:30:40.517" Score="4" ViewCount="7102" Body="&lt;p&gt;CORE: Dell N4032 (6.3.0.18)&#xA;Access: Dell N2048 (6.3.1.13)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are in the process of setting up a serviced office that will serve multiple businesses. Each &quot;customer&quot; will naturally be on their own VLAN, and each VLAN will require access to the Internet and some other VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There will be some open VLANs like a &quot;Public Print&quot; VLAN and so forth. There will also be &quot;Server&quot; VLANs which potentially all other VLANs will need to access (or some may not, i.e. filtered)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have core L3 switches, 20 L2 Access Switches and two HA firewalls.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is whether we do the routing for the VLANs on the L3 switches themselves, or via the Firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My thoughts - if we route via the firewall (i.e. Router on a Stick), all inter-VLAN traffic is going to have to go via our Firewall device, which will naturally put on a load on it's overall throughput (especially with DPI enabled). The pro being it's a hell of a lot easier to configure the firewalling between the VLANs this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we route via the L3 switch, we benefit from the full throughput of the firewall for the WAN (which will be a 1Gbps connection), but the con being having to use &quot;Policy Based Routing&quot; on the 2 Core Switches which is generally a pain to administer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a best practice in a situation like this? What should I consider to make a decision? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The issue using the ACLs on the switch is as follows.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;There is a maximum of 100 ACLs&lt;/li&gt;&#xA;&lt;li&gt;We will have &quot;Customer VLANs&quot; that will require access to the Internet, to a VOIP VLAN, a Server VLAN and Print VLAN.&lt;/li&gt;&#xA;&lt;li&gt;They however should not have access to the other &quot;Customer VLANs&quot;.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Problem is all &quot;Customers&quot; will be within one /16 - i.e.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[Parent subnet being 10.100.0.0/16]&#xA;Customer 1 - 10.100.0.0/24&#xA;Customer 2 - 10.100.1.0/24&#xA;Customer 3 - 10.100.2.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I need to apply the ACLs on the VLAN so when traffic hits that VLAN it is blocked from accessing other customer VLANs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I have something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1000 deny 10.100.0.0 0.0.255.255 192.168.50.0 0.255.255.255 &#xA;1010 deny 10.100.0.0 0.0.255.255 192.168.60.0 0.255.255.255  &#xA;1020 permit any any &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is then applied to all Customer VLAN interfaces. This solves the issue of blocking access to Server VLANs and other private VLANs, however, this doesn't prevent these VLANs from then accessing other customer VLANs (within the 10.100.0.0/16). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem is we could end up having 50 plus customers, which would mean an inconceivable number of ACLs (given each ACL can only have 10 entries, and each ACL would need an ACE for every other customer). This hits the max number of ACLs the switch supports almost instantly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just can't see another way of doing this at this stage without using our firewall as a &quot;Router on a Stick&quot;. Any advice is greatly appreciated. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update #2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Strange a I attempted this today with an ACL on a Customer VLAN as below (applied &quot;IN&quot; on the interface)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1000 deny 10.100.0.0 0.0.255.255 192.168.50.0 0.255.255.255 &#xA;1010 deny 10.100.0.0 0.0.255.255 192.168.60.0 0.255.255.255 &#xA;1015 deny 10.100.0.0 0.0.255.255 10.100.0.0 0.0.255.255 &#xA;1020 permit any any &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE #3&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When applying suggested ACL below - it prevents access between devices on the same VLAN. The ACL is L3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list Block_Customers&#xA; 1000 deny ip any 10.100.0.0 0.0.255.255&#xA; 1020 permit any any&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, then, two devices on this VLAN, with IPs that can speak to each other i.e. 10.100.1.0/24, can no longer ping one another. If I remove the ACL, they once again can ping each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is wrong right, my traffic on one VLAN is L2, why is this L3 ACL applying? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE #4&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I apply the ACL as suggested and...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Two devices on the same VLAN on different switches, they cannot ping in each other (without the ACL they can ping so the trunks must be working). They can ping the Internet. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Two devices on the same VLAN, on the same switch, they can ping each other, but can no longer ping the SVI IP Address on the core switch on that VLAN. They can however ping the Internet, so traffic can reach that IP. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="35883" OwnerDisplayName="PnP" LastEditorUserId="8499" LastEditDate="2018-03-18T21:26:02.937" LastActivityDate="2021-01-08T04:32:36.090" Title="Layer 3 Switch Routing vs Router on a Stick" Tags="|routing|switch|firewall|switching|layer3|" AnswerCount="4" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="40414" PostTypeId="2" ParentId="40413" CreationDate="2017-04-11T21:40:00.200" Score="1" Body="&lt;p&gt;L3 and even some L2 services (such as DHCP) are not just a pain to administrate on any given switch directly; they're typically dangerously clumsy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't recommend administrating the vast majority of switches directly beyond very small implementations. Instead, you might consider abstracting their interfaces away via an SDN solution such as OpenDaylight (there are many others - this is just an example). An SDN system will use &quot;drivers&quot; to render your standard and friendly configurations into configurations that the given switch will understand. This can vastly help you to standardize your control plane in a safe and highly effective manner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In addition to that, CM platforms like SaltStack or Puppet have switch support that may work well for you. This won't give you as complete an experience that an SDN platform would, but it's a step in the right direction.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router on a stick is to be avoided, though. In small stacks it's fine, but yours sounds too big for those shoes.&lt;/p&gt;&#xA;" OwnerUserId="36006" OwnerDisplayName="SmallLoanOf1M" LastActivityDate="2017-04-11T21:40:00.200" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40415" PostTypeId="2" ParentId="40413" CreationDate="2017-04-12T19:47:57.423" Score="1" Body="&lt;p&gt;It appears that you are using some type of Cisco layer-3 switch. It is extremely easy to deny traffic from a network to all the other networks contained within a supernet. If all the customer network are in &lt;code&gt;10.100.0.0/16&lt;/code&gt;, you can have a single ACL that will block one customer from the other customers' networks. Simply apply it inbound to the layer-3 switch on the layer-3 interfaces (SVIs). For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended Block_Customers&#xA; deny ip any 10.100.0.0 0.0.255.255&#xA; permit any any&#xA;!&#xA;interface Vlan10&#xA; ip address 10.100.10.1 255.255.255.0&#xA; ip access-group Block_Customers in&#xA;!&#xA;interface Vlan11&#xA; ip address 10.100.11.1 255.255.255.0&#xA; ip access-group Block_Customers in&#xA;!&#xA;interface Vlan12&#xA; ip address 10.100.12.1 255.255.255.0&#xA; ip access-group Block_Customers in&#xA;!&#xA;interface Vlan13&#xA; ip address 10.100.13.1 255.255.255.0&#xA; ip access-group Block_Customers in&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will prevent any traffic destined for the &lt;code&gt;10.100.0.0/16&lt;/code&gt; network from entering the router (layer-3, not layer-2) part of the switch from the customer networks. This only affects layer-3, and it has absolutely no affect on any traffic within the network, even if the network extends across multiple switches (a bad practice, by the way).&lt;/p&gt;&#xA;" OwnerUserId="8499" OwnerDisplayName="Ron Maupin" LastActivityDate="2017-04-12T19:47:57.423" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="40417" PostTypeId="1" CreationDate="2017-04-13T17:14:23.020" Score="1" ViewCount="3392" Body="&lt;p&gt;I only getting familiar with Wireshark, and there is one thing that I can't put together: estimating sizes of messages. I want to understand how much traffic my desktop application generates during it's communication with the server for a given application routine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Setup: The desktop app runs in Windows Server VirtualBox VM. The capture is done on that VM on the Ethernet interface. The app server is running on the Mac side and bound to the vboxnet0 interface to talk to the VM.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why: I am trying to learn more about processing load, traffic estimation and things like that to learn how to scale a system.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is one of the GET requests the app makes to bring a JSON back. The &lt;code&gt;length&lt;/code&gt; field is 1242B.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/8M3vC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/8M3vC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand form other posts and documentation length is the size of the frame that was captured. Hence, a unit of data for every layer above should be smaller. So the TCP segment size is 1188B, which makes sense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I don't understand is how this frame size of 1142B is related to reassembled TCP segments size of 76448B? If I look at how Wireshark display is I see that this 1142B frame has #1387. If I click on that highlighted row (see pic above) and then go to &quot;Reassembled TCP&quot; section I see that there are 54 frames and the &lt;em&gt;last&lt;/em&gt; frame is #1387, which is the one displayed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So &lt;strong&gt;Question 1&lt;/strong&gt;: does this actually mean that there are in fact 54 more frames that are intentionally hidden from the capture output and sort of folded into that one line from the above picture?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QbV53.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QbV53.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 2&lt;/strong&gt; I am struggling to better put this into a question, so I will try to elaborate what I don't understand. Length is number of bytes captured in a particular frame. However, it's clear that there are more than one frame that make up the highlighted message in the first picture because reassembled TCP is 76448B and the JSON message in it is too large to fit into 1242B. So if the length field can't be used to get the size of the message, what is the right procedure to get that? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, how can one use Wireshark to estimate the amount of data sent between two nodes?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And if Wireshark it not the right tool for this, what is?&lt;/p&gt;&#xA;" OwnerUserId="36002" LastEditorUserId="34855" LastEditDate="2017-04-13T20:00:13.973" LastActivityDate="2017-04-13T20:00:13.973" Title="Size of packets in Wireshark" Tags="|tcp|wireshark|packet-analysis|" AnswerCount="0" CommentCount="2" ClosedDate="2018-07-24T00:14:24.843" ContentLicense="CC BY-SA 3.0" />
  <row Id="40418" PostTypeId="1" AcceptedAnswerId="40426" CreationDate="2017-04-13T18:24:14.117" Score="1" ViewCount="726" Body="&lt;p&gt;I bought a used SRX240 on ebay to learn a bit about it (and use it as a home router).&#xA;Upon starting it seems it has a very old firmware, so I wanted to update it.&#xA;So I created an account on juniper.com, but when I try to access the firmware under &lt;a href=&quot;https://webdownload.juniper.net/swdl/dl/secure/site/1/record/65481.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://webdownload.juniper.net/swdl/dl/secure/site/1/record/65481.html&lt;/a&gt; I get the error: &quot;You have encountered this error because your account privileges do not permit access to the information or service requested.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do I need to do or rather - what is the best/easiest way to get the upgrade?&lt;/p&gt;&#xA;" OwnerUserId="36008" LastActivityDate="2017-04-14T01:49:34.950" Title="How do I update a 2nd hand bought Juniper SRX240" Tags="|juniper|juniper-junos|juniper-srx|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40420" PostTypeId="1" AcceptedAnswerId="40421" CreationDate="2017-04-13T21:09:18.497" Score="1" ViewCount="2808" Body="&lt;p&gt;I am using Scapy to try and read the seq and ack numbers of tcp packets using the following sample code:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;packet = sniff(iface=argv[1], prn=scan, filter=&quot;&quot;, count=1)[0]&#xA;print &quot;Found SEQ &quot; + str(packet.getlayer(TCP).seq) +&quot; ACK &quot; + str(packet.getlayer(TCP).ack)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However,I found the numbers to be extremely large like  3786938882 and 298237083. When I view the packets in wireshark, their values were only like 65 and 150 for example. Am I supposed to put the values into some sort of formatting?&lt;/p&gt;&#xA;" OwnerUserId="35989" LastEditorUserId="8499" LastEditDate="2017-04-16T18:36:51.773" LastActivityDate="2017-04-16T18:36:51.773" Title="Extremely large sequence and acknowledge numbers when using Scapy" Tags="|ip|tcp|packet-analysis|network|layer4|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40421" PostTypeId="2" ParentId="40420" CreationDate="2017-04-13T21:17:44.000" Score="1" Body="&lt;p&gt;TCP actually starts with a large, random, 32-bit sequence number. Scapy appears to be showing you what the sequence numbers actually are.  Wireshark is converting the TCP sequence numbers into relative sequence numbers. see &lt;a href=&quot;https://wiki.wireshark.org/TCP_Relative_Sequence_Numbers&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP_Relative_Sequence_Numbers&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;TCP Relative Sequence Numbers &amp;amp; TCP Window Scaling&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;By default Wireshark and TShark will keep track of all TCP sessions&#xA;  and convert all Sequence Numbers (SEQ numbers) and Acknowledge Numbers&#xA;  (ACK Numbers) into relative numbers. This means that instead of&#xA;  displaying the real/absolute SEQ and ACK numbers in the display,&#xA;  Wireshark will display a SEQ and ACK number relative to the first seen&#xA;  segment for that conversation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This means that all SEQ and ACK numbers always start at 0 for the&#xA;  first packet seen in each conversation.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This makes the numbers much smaller and easier to read and compare&#xA;  than the real numbers which normally are initialized to randomly&#xA;  selected numbers in the range 0 - (2^32)-1 during the SYN phase.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This usability feature relies on features from&#xA;  TCP_Analyze_Sequence_Numbers so in order to use this feature you must&#xA;  also enable TCP_Analyze_Sequence_Numbers.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Using relative sequence numbers is a usability enhancement, making the&#xA;  numbers easier to read and compare. In order to compare a dissection&#xA;  with data from a less advanced analyzer that can not handle relative&#xA;  sequence numbers it might be required to temporarily disable this&#xA;  feature in Wireshark.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For Wireshark versions prior to 1.5: When the Relative Sequence&#xA;  Numbers preference is enabled Wireshark will also enable &quot;Window&#xA;  Scaling&quot;.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;For Wireshark 1.5 &amp;amp; newer: &quot;Window Scaling&quot; is a separate TCP&#xA;  preference enabled by default.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If &quot;Window Scaling&quot; is enabled, Wireshark will try to monitor the TCP&#xA;  Window Scaling option negotiated during the SYN phase and if such TCP&#xA;  Window Scaling has been detected, Wireshark will also scale the window&#xA;  field and translate it to the effective window size. This may affect&#xA;  what the dissected and reported window is and may make Wireshark to&#xA;  decode packets differently, but more accurately, than other tools.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To disable relative sequence numbers and instead display them as the&#xA;  real absolute numbers, go to the TCP preferences and untick the box&#xA;  for&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Qz5ol.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Qz5ol.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;relative sequence numbers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-13T21:17:44.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40426" PostTypeId="2" ParentId="40418" CreationDate="2017-04-14T01:49:34.950" Score="1" Body="&lt;p&gt;Unfortunately, you need an active support contract in order to be able to download firmwares/software from the Juniper website. The error message you are seeing is expected if you haven't associated any support contract with the SRX serial number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HTH&lt;/p&gt;&#xA;" OwnerUserId="36015" LastActivityDate="2017-04-14T01:49:34.950" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40427" PostTypeId="2" ParentId="34749" CreationDate="2017-04-14T01:56:54.853" Score="1" Body="&lt;p&gt;If you are having problems in getting the URL right, jump into the FreeBSD shell (using &quot;start shell&quot;) and do the ftp from there:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@router&amp;gt; start shell&#xA;% ftp 192.168.254.254&#xA;Connected to 192.168.254.254.&#xA;220 router FTP server (Version 6.00LS) ready.&#xA;Name (192.168.254.254:user): user&#xA;331 Password required for user.&#xA;Password:&#xA;230 User user logged in.&#xA;Remote system type is UNIX.&#xA;Using binary mode to transfer files.&#xA;ftp&amp;gt; bin&#xA;200 Type set to I.&#xA;ftp&amp;gt; get &amp;lt;file&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36015" LastActivityDate="2017-04-14T01:56:54.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40430" PostTypeId="1" AcceptedAnswerId="40432" CreationDate="2017-04-14T08:32:10.143" Score="2" ViewCount="131" Body="&lt;p&gt;I'm quite new to networking, just learning the basics. I have a doubt, hope you can solve it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suppose I have a LAN ip 192.168.0.103 and I have a public IP of 66.249.79.122.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I have read that whenever my machine is communicating with another machine in the world wide web, there comes &lt;code&gt;router&lt;/code&gt; that creates a map and keeps track of websites or machines I'm talking to so that replies to my public ip from those networks are directed to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is if there's another machine that wants to communicate with me using telnet of ftp then how can it? Because if it knows my public ip and sends a packet there the router will not know where to deliver that packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is what I'm thinking. Can anyone please explain if I'm correct or not and if I'm then is it possible to deliver the packet in anyway?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated. Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="36018" LastEditorUserId="36018" LastEditDate="2017-04-14T08:38:21.170" LastActivityDate="2021-01-04T07:39:37.670" Title="How to reach a particular destination in LAN" Tags="|routing|router|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40431" PostTypeId="1" AcceptedAnswerId="40433" CreationDate="2017-04-14T09:33:02.933" Score="1" ViewCount="1033" Body="&lt;p&gt;there is something I don't understand. Some switches have SFP ports, it means that you can connect fiber or rj-45 cables I believe?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some switches like Nexus 5600 have unified ports. So they can support fiber and rj-45 (and FCOE).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What's the difference between SFP and unified, just the FCOE support?&lt;/p&gt;&#xA;" OwnerUserId="24395" LastActivityDate="2017-04-14T10:33:25.160" Title="Diifference between sfp/sfp+ ports and unified ports" Tags="|switch|interface|sfp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40432" PostTypeId="2" ParentId="40430" CreationDate="2017-04-14T10:28:01.867" Score="2" Body="&lt;p&gt;To enable someone from the WAN (Wide Area Network) to communicate to your PC in the LAN (Local Area Network) with telnet ftp ssh etc.., your router must use NAPT (Network Address Port Translation).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When a PC from WAN (Internet) will telnet your PC (LAN) he will actually telnet your public ip adress which is the router interface on the WAN side with a port number, by default it's 23 for telnet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want someone from the WAN to telnet you in your LAN you need to setup the PAT on your router, it work like this, you configure your router to make him forward the packet he will receive on a specific port number to a computer on your LAN and to a port number of this computer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say someone from WAN telnet your public ip adress 66.249.79.122&#xA;He will probably use the default port number of 23, you configure your router to forward all the traffic from port 23, to your local ip 192.168.0.103 on the port 23, so when someone will telnet you he will actually telnet your router which will forward the request to your LAN PC.&lt;/p&gt;&#xA;" OwnerUserId="36019" LastEditorUserId="36019" LastEditDate="2017-04-14T12:03:23.240" LastActivityDate="2017-04-14T12:03:23.240" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40433" PostTypeId="2" ParentId="40431" CreationDate="2017-04-14T10:33:25.160" Score="2" Body="&lt;p&gt;Unified ports allow you to move from an existing segregated platform approach where you choose LAN and SAN port optionsto transition to a single, unified fabric that istransparent and consistent with existing practices and management software. You will need to swap SFPs (for now, at least) and reconfigure the port, and you must cycle/reset the module in which the ports reside in order to switch personality. Personally, I think the Unified Port functionality is extremely useful. &lt;/p&gt;&#xA;" OwnerUserId="35541" LastActivityDate="2017-04-14T10:33:25.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40434" PostTypeId="1" CreationDate="2017-04-14T11:49:11.443" Score="1" ViewCount="413" Body="&lt;p&gt;Why do we need VLAN tagging when there's already MAC address table to refer to?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch A VLAN 10 -&gt; Switch B VLAN 10&lt;/p&gt;&#xA;" OwnerUserId="36021" LastEditorUserId="8499" LastEditDate="2017-04-14T12:25:10.150" LastActivityDate="2017-04-14T12:25:10.150" Title="Why do we need VLAN tagging when there's already MAC address table to refer to" Tags="|switch|vlan|mac-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40435" PostTypeId="2" ParentId="40434" CreationDate="2017-04-14T12:18:32.143" Score="1" Body="&lt;p&gt;Because we need to add tags to frames on trunk interfaces so that the other end of the trunk link knows which frames belong to which VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example, with a single VLAN shared across two switches, you do not need to trunk, and would not have VLAN tags if you don't. If you had multiple VLANs on both switches, then you need to tag the frames between the switches, otherwise you end up leaking frames between VLANs, which leads to problems.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-14T12:18:32.143" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40438" PostTypeId="1" CreationDate="2017-04-14T16:21:11.883" Score="2" ViewCount="648" Body="&lt;p&gt;I don't understand what exactly VC Networks and Datagram Networks are? Could you explain the differences between these two Networks.&lt;/p&gt;&#xA;" OwnerUserId="36028" LastActivityDate="2017-06-15T10:55:56.943" Title="What is the main difference between VC Networks and Datagram Networks?" Tags="|network|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40439" PostTypeId="2" ParentId="40438" CreationDate="2017-04-14T16:46:57.657" Score="3" Body="&lt;p&gt;Without knowing the exact context for the question I'm not 100% sure if this is what you are looking for, but a virtual circuit is a network path that is established before data is transmitted and then subsequently utilized for all data thereafter until the VC is terminated. A datagram network refers to a different approach to packet transmission where each packet traverses the network on a more individual basis. A packet sent out on a datagram network may or may not take the same route as the one before or after, depending on the decisions made at each node in the network.&lt;/p&gt;&#xA;" OwnerUserId="36027" LastActivityDate="2017-04-14T16:46:57.657" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40441" PostTypeId="2" ParentId="7733" CreationDate="2017-04-14T17:30:55.380" Score="2" Body="&lt;p&gt;Just leaving the comment. As today, another use for the Opaque LSA is for Segment Routing with OSPF as the IGP.&lt;/p&gt;&#xA;" OwnerUserId="115" LastActivityDate="2017-04-14T17:30:55.380" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40442" PostTypeId="2" ParentId="6808" CreationDate="2017-04-14T18:43:04.283" Score="1" Body="&lt;p&gt;I used to have lots of strange issues with SIP400 cards and 7609 chassis...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Not sure if this one is matching the behaviour but please check it:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://bst.cloudapps.cisco.com/bugsearch/bug/CSCsb69734&quot; rel=&quot;nofollow noreferrer&quot;&gt;CSCsb69734&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SIP400: Sub-int IP state up but not reachable after SSO &amp;amp; reload &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Symptom:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In rare situations, the 7600-SIP-400 SPA-2X1GE sub-interfaces can be unreachable even when the interface state is up. Ping or even control plane traffic (such as OSPF hellos) do not pass through the sub-interface but traffic passes through the main interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Conditions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem might be encountered when a SSO switchover is done concurrently on one of the routers and line card/SPA reset is done on the directly connected interface on the other router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Workaround:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the interface is manually reset the problem disappears (i.e. shutdown, then no shutdown on the interface). A SPA/line card reset also solves the problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Further Problem Description:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This problem is seen with IP &amp;amp; IPv6 configurations on the subinterface.&lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-04-14T18:43:04.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40443" PostTypeId="1" AcceptedAnswerId="40445" CreationDate="2017-04-14T18:48:54.403" Score="3" ViewCount="325" Body="&lt;p&gt;I'm a sys/net admin for a small hosting company, and I need to expand my understanding of how our WAN connections (two, exactly) work together to provide high availability for our hosted servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have two onsite routers, each advertising BGP routes on our AS# 19772.  We have one link over Sprint (BGP remote-as 1239) and one link over AT&amp;amp;T (BGP remote-as 7018).  I have two questions - the second one considerably more in depth than the first - that I'd like an expert to chime in on, please &amp;amp; thank you :)&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;1.. When I run a BGP table lookup (e.g. &lt;a href=&quot;http://www.cogentco.com/en/network/looking-glass&quot; rel=&quot;nofollow noreferrer&quot;&gt;Looking Glass&lt;/a&gt;) for one of the &lt;code&gt;/23&lt;/code&gt; subnets we host &amp;amp; advertise, it shows BGP table as:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BGP routing table entry for 63.164.138.0/23, version 3560718486&#xA;Paths: (1 available, best #1, table Default-IP-Routing-Table)&#xA;  1239 19772&#xA;    154.54.12.22 (metric 10186060) from 38.28.1.83 (38.28.1.83)&#xA;      Origin IGP, metric 4294967294, localpref 100, valid, internal, best&#xA;      Community: 174:10004 174:20666 174:21000 174:22013&#xA;      Originator: 154.54.66.86, Cluster list: 38.28.1.83, 38.28.1.67, 38.28.1.65, 154.54.66.49&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice the paths traverse Sprint's AS &amp;amp; our AS as well.  This leads me to believe that if AS1239 went down (or more realistically if our routers lost BGP session to it) traffic could still arrive at that subnet over AS19772 (presumably via neighboring AT&amp;amp;T AS7018).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But, I'd like to KNOW, somehow, that this failover behavior will indeed happen if we lose our session to our BGP peer on AS1239.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Is there any way to verify, ahead of time, that AS7018 will advertise a direct neighboring route to AS19772 when it needs to?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&#xA;OK I think I have answered this first question by checking from within AS7018 via &lt;a href=&quot;http://route-server.ip.att.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;AT&amp;amp;T's looking glass&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rviews@route-server.ip.att.net&amp;gt; show route protocol bgp 63.164.138.0     &#xA;&#xA;inet.0: 631792 destinations, 9475808 routes (631792 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;63.164.138.0/23    *[BGP/170] 1w6d 23:05:58, localpref 100, from 12.122.125.165&#xA;                      AS path: 7018 19772 I, validation-state: unknown&#xA;                    &amp;gt; to 12.0.1.1 via em0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Notice the AS Numbers 7018 &amp;amp; 19772, to me means 7018 is properly neighboring with 19772 for this subnet. &lt;strong&gt;Yay!  OK, onto #2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;2.. We are also advertising four &lt;code&gt;/26&lt;/code&gt; prefixes as parts of a larger &lt;code&gt;/24&lt;/code&gt; prefix.  Since Sprint AS1239 doesn't advertise peers less than &lt;code&gt;/24&lt;/code&gt;, our &lt;code&gt;/26&lt;/code&gt;s get &quot;supernetted&quot; into a &lt;code&gt;/12&lt;/code&gt; advertisement:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;BGP routing table entry for 63.160.0.0/12, version 3549613850&#xA;Paths: (1 available, best #1, table Default-IP-Routing-Table)&#xA;  1239&#xA;    154.54.12.22 (metric 10186060) from 38.28.1.83 (38.28.1.83)&#xA;      Origin IGP, metric 4294967294, localpref 100, valid, internal, best&#xA;      Community: 174:10004 174:20666 174:21000 174:22013&#xA;      Originator: 154.54.66.86, Cluster list: 38.28.1.83, 38.28.1.67, 38.28.1.65, 154.54.66.49&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;which is not ideal.. Notice how our AS19772 is not mentioned at all in that route.. just the AS1239 on the &lt;code&gt;/12&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To add to that, I'm being told that AT&amp;amp;T AS7018 doesn't forward routes smaller than &lt;code&gt;/24&lt;/code&gt; &lt;strong&gt;AT ALL&lt;/strong&gt;, so in that case my &lt;code&gt;/26&lt;/code&gt;s are lost as a direct neighbor..&#xA;Evidenced here via AT&amp;amp;T's looking glass:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rviews@route-server.ip.att.net&amp;gt; show route protocol bgp 63.165.22.192 &#xA;&#xA;inet.0: 631773 destinations, 9475523 routes (631773 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;63.160.0.0/12      *[BGP/170] 2d 13:58:14, localpref 100, from 12.122.125.106&#xA;                      AS path: 7018 1239 I, validation-state: unknown&#xA;                    &amp;gt; to 12.0.1.1 via em0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Shows AT&amp;amp;T AS7018 has the /12 route, through AS1239, but mention of the more specific /26 route via AS19772.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This leads me to believe that the &lt;code&gt;/26&lt;/code&gt;s are not multi-homed properly, and if our AS1239 session is cut, those nets will be unavailable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, OK, why not just advertise the four &lt;code&gt;/26&lt;/code&gt;s as one &lt;code&gt;/24&lt;/code&gt;?  Well, on the routers we have an interface on one of the &lt;code&gt;/26&lt;/code&gt; networks.  The other three &lt;code&gt;/26&lt;/code&gt; nets are static routed out a different interface..  I seem to remember during router interface turn-up we were having connectivity issues until we made the BGP advertisement mask match the interface mask..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Does anyone know if BGP advertising a &lt;code&gt;/24&lt;/code&gt; from the routers would interfere with traffic on an interface that has a subnetted &lt;code&gt;/26&lt;/code&gt; from that same &lt;code&gt;/24&lt;/code&gt;?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;  Per the great answer provided by Ron:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OK, so the piece of the puzzle I am likely missing is the aggregate advertisement for BGP. If I begin advertising the /24 prefix, both neighboring AS's should see that and begin forwarding direct neighbor connections to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The last thing I would like to see is evidence that I can advertise an aggregate prefix that I don't have in the routing table.  &lt;strong&gt;Does anyone have reference to some material I can review to confirm this?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="36026" LastEditorUserId="36026" LastEditDate="2017-04-17T14:34:21.783" LastActivityDate="2017-04-17T16:10:23.993" Title="BYO thoughts on BGP routing" Tags="|routing|bgp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40445" PostTypeId="2" ParentId="40443" CreationDate="2017-04-14T20:35:50.180" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;Both of your neighbor ASes are advertising your networks. It just&#xA;depends from where you are looking on the Internet as to which is&#xA;the preferred route to your networks. If one of your neighbors goes&#xA;down, the other neighbor will be the only one advertising your&#xA;routes, so everywhere on the Internet will converge to that path.&lt;/li&gt;&#xA;&lt;li&gt;I don't believe any ISPs will advertise prefixes longer than &lt;code&gt;/24&lt;/code&gt;.&#xA;You could of course advertise aggregate prefixes. If you tried&#xA;manually combining four &lt;code&gt;/26&lt;/code&gt; prefixes into a single &lt;code&gt;/24&lt;/code&gt; prefix&#xA;and using a network statement to advertise that, it would fail&#xA;because BGP need the exact prefixes that it is advertising to be in&#xA;the routing table. There is an exception to that, and it is called&#xA;an aggregate address. You can advertise an aggregate address instead&#xA;of the separate prefixes, and, BGP will advertise it as long as any&#xA;one of the prefixes is in the routing table. You could also tell it&#xA;to only advertise the aggregate address, or both the aggregate&#xA;address and the individual prefixes.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the Cisco document &lt;em&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/19345-bgp-noad.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Troubleshooting When BGP Routes Are Not Advertised&lt;/a&gt;&lt;/em&gt; section called &lt;em&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/19345-bgp-noad.html#topic1&quot; rel=&quot;nofollow noreferrer&quot;&gt;Routes Announced Using a Basic Network Statement&lt;/a&gt;&lt;/em&gt;. Also, see &lt;em&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5441-aggregation.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding Route Aggregation in BGP&lt;/a&gt;&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-04-17T16:10:23.993" LastActivityDate="2017-04-17T16:10:23.993" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="40447" PostTypeId="2" ParentId="40413" CreationDate="2017-04-14T23:36:22.253" Score="2" Body="&lt;p&gt;My suggestion is to keep it simple. You seem to be trying to add more complexity to a scenario that could be simplified. This is so far what you are doing, please correct me if I'm wrong:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Isolating customers by using VLANs.&lt;/li&gt;&#xA;&lt;li&gt;Removing that isolation by enabling routing between VLANs.&lt;/li&gt;&#xA;&lt;li&gt;Asking what will be the best way to isolate them based on your available resources.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My point is to not route traffic between VLANs by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Suggested solutions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Use VRFs on the L3 cores: A VRF per VLAN. This way you could keep the isolation, but provide access to common resources. You might even want to consider doing NAT between VLANs to enable (controlled) communications between them. Why NAT? Because you might also want to use the same IP addressing space on all customer's VLANs - making new deployments easier for you (they're repeatable, standardized)&lt;/li&gt;&#xA;&lt;li&gt;Instead of VRFs, a physical router per VLAN and repeat the above.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="444" LastActivityDate="2017-04-14T23:36:22.253" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40449" PostTypeId="1" AcceptedAnswerId="40450" CreationDate="2017-04-15T04:18:42.180" Score="2" ViewCount="6721" Body="&lt;p&gt;Given &lt;code&gt;/26&lt;/code&gt; subnets for a &lt;code&gt;/24&lt;/code&gt; network:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Subnet 1 0-63 &#xA;Subnet 2 64-127&#xA;Subnet 3 128-191&#xA;Subnet 4 192-255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does every subnet have its own network ID and broadcast address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Meaning:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Subnet 1 0-63 (network is 0, broadcast is 63)&#xA;Subnet 2 64-127 (network is 64, broadcast is 127)&#xA;Subnet 3 128-191 (network is 128, broadcast is 191)&#xA;Subnet 4 192-255 (network is 192, broadcast is 255)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Therefore, -2 for every subnet as they cant be assign to a host.&#xA;Am i right?&lt;/p&gt;&#xA;" OwnerUserId="36021" LastEditorUserId="8499" LastEditDate="2018-03-21T16:06:25.243" LastActivityDate="2019-01-12T22:43:19.930" Title="Does every subnet have broadcast and network addresses?" Tags="|ipv4|ip|subnet|ip-address|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40450" PostTypeId="2" ParentId="40449" CreationDate="2017-04-15T04:39:25.310" Score="2" Body="&lt;p&gt;Yes, you are right. Although no one does this in the practical day to day world, it is easier to see this if you convert the subnet in question into binary digits and then remember that the broadcast address is simply the case with all 1s and the network address with all zeroes. &lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2017-04-15T04:39:25.310" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40451" PostTypeId="2" ParentId="40449" CreationDate="2017-04-15T06:00:38.570" Score="1" Body="&lt;p&gt;Yes you are correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I will explain here how we got that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For a given number of binary digits (say x), 2^x gives the number of different binary numbers that can be made from it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when we consider the number of '0' bits in the subnet mask, we can find out the number of different binary numbers that can be made from it using the above formula. However, in a subnetwork two numbers out of these possible different binary numbers is reserved to make the Network address and the Broadcast address. These are formed by combining the network portion of the IP address with the 1st possible combination and the last possible combination of the number of bits under the host portion of the IP address receptively.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me explain this through an example.&#xA;Consider 192.168.209.176/28&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;11000000 10101000 11010001 10110000 - IP address&#xA;11111111 11111111 11111111 11110000 - Subnet mask&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There are 4 '0' bits in the subnet mask. 2^4=16. The combinations are 0000, 0001, 0010, ... , 1101, 1110, 1111.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Combining the network portion of the IP address (11000000 10101000 11010001 1011) with the 1st combination (0000) gives us 11000000 10101000 11010001 10110000 which when converted to decimal is 192.168.209.176. This is the Host address for this subnet.    &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Combining the network portion of the IP address (11000000 10101000 11010001 1011) with the last combination (1111) gives us 11000000 10101000 11010001 10111111 which when converted to decimal is 192.168.209.191. This is the broadcast address for this subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you have stated in your question, we have to substract 2 addresses, the Network address and the broadcast addresses because we cannot assign them to hosts. Therefore we can modify the above equation to obtain the number of hosts in a subnetwork as (2^x)-2 where x is the number of host bits in the subnet mask&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Now consider 192.168.209.176/31.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since there is only 1 host bit in the subnet mask, 2 addresses can be formed. But since we &lt;strong&gt;must&lt;/strong&gt; reserve 2 addresses for the network address and broadcast address, we are not left with any addresses to be assigned to hosts. (2^2)-2=0.     &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore a subnetwork with /31 useless.&lt;/p&gt;&#xA;" OwnerUserId="36040" LastEditorUserId="8499" LastEditDate="2019-01-12T22:43:19.930" LastActivityDate="2019-01-12T22:43:19.930" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="40452" PostTypeId="1" AcceptedAnswerId="40458" CreationDate="2017-04-15T06:47:02.093" Score="1" ViewCount="657" Body="&lt;p&gt;While configuring BGP on Cisco IOS, the &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;sh ip bgp &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;command lists the local preference of each of the learnt routes. I understand the default is 100. However for some routes, it is explicitly stated as 100 while for others it is simply blank. Why this discrepancy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly I have confusion on how local preference works. Is local preference set for a neighboring router, for an neighboring AS or it is set per router interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it is local per router and hence not propagated, but on what basis is it assigned to ?&lt;/p&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="30735" LastEditDate="2017-04-16T18:49:01.123" LastActivityDate="2017-04-16T18:49:01.123" Title="BGP local preference" Tags="|bgp|packet-path|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40453" PostTypeId="1" CreationDate="2017-04-15T09:26:08.830" Score="4" ViewCount="258" Body="&lt;p&gt;I am busy redesigning my OSPF network to break it up into different areas and use route summarization to reduce the size of my LSDB and then setup MPLS. It is a rather large network with a thousand+ routers on the backbone area(Hence the need to redesign this).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have come across an issue which I am trying to figure out a way around. An example area which I am creating has 2 connections to the backbone, so 2 ABRs. I configure summary routes in each of the ABRs, and everything seems to work nicely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem comes in when some link between 2 routers in the middle of the area goes down. Now, the summarized routes get distributed from both ABRs as normal, and only the lowest cost route gets used by the backbone. So the backbone only ends up with the one path to the summarized route towards one of the ABRs. This leaves the other side of the area isolated from the network, because the backbone routes all requests to the entire supernet, to the one ABR, and some of the routers are on the other side of the link that is down, from the ABR where the backbone is routing the supernet&lt;a href=&quot;https://i.stack.imgur.com/vOiR2.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vOiR2.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt; to&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a best practice way to get around this? How do people handle this situation?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please let me know if my description is not clear enough.&lt;/p&gt;&#xA;" OwnerUserId="36042" LastEditorUserId="36042" LastEditDate="2017-04-15T10:05:18.667" LastActivityDate="2017-05-18T04:10:50.823" Title="Broken OSPF area and summarized routes" Tags="|ospf|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40455" PostTypeId="2" ParentId="40449" CreationDate="2017-04-15T11:22:20.883" Score="-1" Body="&lt;p&gt;Regarding the /32 and /31 questions...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/32 is a subnet in the sense that it's 'a part of a larger network.'&#xA;/31 is also.&#xA;But /32 is typically used to reference a single host.&#xA;Typically /31 just isn't used.  Even for an access list, people commonly would put two /32's or preface the IP with host...twice.&#xA;That being said, I'm pretty sure you're never going to see a l3 link configured with a /32 or a /31 ever.  But you may see individual hosts or ACL's with /32's.&lt;/p&gt;&#xA;" OwnerUserId="14384" LastActivityDate="2017-04-15T11:22:20.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40456" PostTypeId="1" AcceptedAnswerId="40457" CreationDate="2017-04-15T11:55:48.010" Score="1" ViewCount="733" Body="&lt;p&gt;I'm trying to determine a class which would be used as default for new IP's on my network, here's my current setup:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Delete qdisc rule&#xA;tc qdisc del dev br-lan root&#xA;&#xA;# Add qdisc rule&#xA;tc qdisc add dev br-lan root handle 1: htb default 10&#xA;&#xA;# Setup parent class&#xA;tc class add dev br-lan parent 1: classid 1:1 htb rate 2000kbit ceil 2000kbit&#xA;&#xA;# Add child classes of parent class 1:&#xA;#Wired&#xA;tc class add dev br-lan parent 1:1 classid 1:10 htb rate 2000kbit ceil 2000kbit&#xA;#Wired2&#xA;tc class add dev br-lan parent 1:1 classid 1:11 htb rate 1000kbit ceil 1000kbit&#xA;#Wireless1&#xA;tc class add dev br-lan parent 1:1 classid 1:12 htb rate 250kbit ceil 150kbit&#xA;&#xA;# Create packet filter rule using parent 1: class, matching to IP (src = outbound traffic, dst = inbound traffic)&#xA;# and assigning child class rule via flowid&#xA;&#xA;tc -s filter show dev br-lan&#xA;&#xA;tc filter add dev br-lan parent 1: protocol ip prio 1 u32 match ip src 192.168.1.35 flowid 1:10&#xA;tc filter add dev br-lan parent 1: protocol ip prio 1 u32 match ip dst 192.168.1.35 flowid 1:10&#xA;tc filter add dev br-lan parent 1: protocol ip prio 1 u32 match ip src 192.168.1.67 flowid 1:11&#xA;tc filter add dev br-lan parent 1: protocol ip prio 1 u32 match ip dst 192.168.1.67 flowid 1:11&#xA;tc filter add dev br-lan parent 1: protocol ip prio 1 u32 match ip src 192.168.1.104 flowid 1:12&#xA;tc filter add dev br-lan parent 1: protocol ip prio 1 u32 match ip dst 192.168.1.104 flowid 1:12&#xA;tc filter add dev br-lan parent 1: protocol ip prio 1 u32 match ip dst 192.168.1.104 flowid 1:12&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In an ideal world, the default class would be class id 1:12, as shown above, allowing 250kbit bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the moment, any unrecognized device uses the parent class:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tc class add dev br-lan parent 1: classid 1:1 htb rate 2000kbit ceil &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Which means they have the ability of taking the entire bandwidth of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried to study the following article: &lt;a href=&quot;http://lartc.org/howto/lartc.qdisc.classful.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://lartc.org/howto/lartc.qdisc.classful.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I'm struggling to implement 'leaf classes', could anyone shed some light into this situation? Thanks&lt;/p&gt;&#xA;" OwnerUserId="24349" LastEditorUserId="24349" LastEditDate="2017-04-17T21:10:33.697" LastActivityDate="2017-04-17T21:10:33.697" Title="TC &amp; Qdisc Rules with 'Leaf' classes" Tags="|qos|bandwidth|linux|" AnswerCount="1" CommentCount="1" ClosedDate="2017-04-17T21:13:42.520" ContentLicense="CC BY-SA 3.0" />
  <row Id="40457" PostTypeId="2" ParentId="40456" CreationDate="2017-04-15T12:21:16.363" Score="1" Body="&lt;p&gt;Using the line:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tc qdisc add dev br-lan root handle 1: htb default 10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The following code determines the class which will be used for devices which have not been declared in the list of filters &lt;code&gt;'default 10'&lt;/code&gt; No idea how I previously overlooked this.&lt;/p&gt;&#xA;" OwnerUserId="24349" LastActivityDate="2017-04-15T12:21:16.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40458" PostTypeId="2" ParentId="40452" CreationDate="2017-04-15T13:11:18.793" Score="1" Body="&lt;p&gt;So, let's go one by one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Cisco IOS, the 'sh ip bgp' will not show Local Preference for routes received from eBGP peers, but it will show Local Preference on iBGP peers. Here's example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; *&amp;gt;   12.39.0.0/16     41.61.16.1                             0 3356 1239 i&#xA; * i                   172.16.7.7               0    100      0 3356 1239 i&#xA; *&amp;gt;   33.56.0.0/16     41.61.16.1                             0 3356 i&#xA; * i                   172.16.7.7               0    100      0 3356 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The '172.16.7.7' is iBGP neighbor, thus Local Preference is shown, while 41.61.16.1 is eBGP and Local Preference is NOT shown, however you can ask BGP for the prefix and then Local Preference as resulting from policies/etc will be shown. For 12.39.0.0/16 above:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; CEL6#sh ip bgp 12.39.0.0&#xA; BGP routing table entry for 12.39.0.0/16, version 17&#xA; [...]&#xA; 3356 1239, (aggregated by 1239 12.39.3.3)&#xA;  41.61.16.1 from 41.61.16.1 (33.56.1.1)&#xA;   Origin IGP, localpref 100, valid, external, atomic-aggregate, best&#xA;   rx pathid: 0, tx pathid: 0x0&#xA; 3356 1239, (aggregated by 1239 12.39.3.3)&#xA;  172.16.7.7 (metric 2) from 172.16.7.7 (172.16.7.7)&#xA;   Origin IGP, metric 0, localpref 100, valid, internal, atomic-aggregate&#xA;   rx pathid: 0, tx pathid: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For the Local Preference in general - &lt;strong&gt;&lt;em&gt;it is propagated&lt;/em&gt;&lt;/strong&gt;, but only within the local AS. Weight (Cisco specific attribute) is not propagated even between routers within the same AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can set Local Preference on prefix, be it either per neighbor (all prefixes received from peer) or with some more granularity (like for example, adjust Local Preference only for specific AS_PATHs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please sit down and read more about BGP - starting from &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/26634-bgp-toc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="8499" LastEditDate="2017-04-15T15:04:20.757" LastActivityDate="2017-04-15T15:04:20.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40459" PostTypeId="2" ParentId="40449" CreationDate="2017-04-15T15:31:58.893" Score="6" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Therefore, -2 for every subnet as they cant be assign to a host. Am i&#xA;  right?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There are two exceptions to that rule: &lt;code&gt;/31&lt;/code&gt; and &lt;code&gt;/32&lt;/code&gt; networks.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;code&gt;/31&lt;/code&gt; networks are used for point-to-point links. This was&#xA;standardized in December 2000, when &lt;a href=&quot;https://tools.ietf.org/rfc/rfc3021.txt&quot; rel=&quot;noreferrer&quot;&gt;&lt;em&gt;RFC 3021, Using 31-Bit Prefixes&#xA;on IPv4 Point-to-Point Links&lt;/em&gt;&lt;/a&gt; was published. The key is that&#xA;there is no need for broadcast on a point-to-point link because every&#xA;other host on a point-to-point network will get the traffic, anyway.&#xA;Ordinarily, using &lt;code&gt;/30&lt;/code&gt; for point-to-point networks wastes half of&#xA;the network addresses. This can really add up when your business has&#xA;a lot of point-to-point links. You can cut the number of used&#xA;addresses in half, doubling the number of point-to-point links with&#xA;the same number of addresses.&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;/32&lt;/code&gt; networks are commonly used for things like router loopbacks.&#xA;These networks must be routed to send or receive traffic to/from any other host&#xA;because there is only one possible host on the network.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-15T15:31:58.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40460" PostTypeId="1" AcceptedAnswerId="40464" CreationDate="2017-04-15T16:21:14.610" Score="0" ViewCount="613" Body="&lt;p&gt;Is there a way to setup PFSense so that each VLAN get's a different DNS Host Override for the same domain. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As in, if I have 2 VLAN's and a client on each one goes to internalsite.com, it will redirect to different IP's based on the VLAN that they are in. Host override only lets me specify the host override for ALL or one VLAN not each one individually. &lt;/p&gt;&#xA;" OwnerUserId="36046" LastActivityDate="2017-04-15T23:48:42.650" Title="Per VLAN DNS Host Override Using Same Name" Tags="|dns|pfsense|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40464" PostTypeId="2" ParentId="40460" CreationDate="2017-04-15T23:48:42.650" Score="2" Body="&lt;p&gt;Yes, it is possible.&#xA;You can manually set your name server in your box.&#xA;You have to connect to a same server that has a capability of deep packet inspection such that the DNS reply depends on the layer 2 ether VLAN field. It is unlikely that you will find such a name server unless configured by your ISP. So the solution is set up your own and send queries to that server. You might also want to clear the DNS cache in your browser or PC. &lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-04-15T23:48:42.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40467" PostTypeId="2" ParentId="40009" CreationDate="2017-04-16T07:02:45.293" Score="1" Body="&lt;p&gt;OK, so here's what I did to achieve no accounting from particular server:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Configure Service Profile INTERNET and SERVER.&lt;/li&gt;&#xA;&lt;li&gt;Enable Service-Accounting only for INTERNET. MX will initiate per service accounting for INTERNET.&lt;/li&gt;&#xA;&lt;li&gt;Preference is given for SERVER. So any traffic matching VoD server will not be accounted.  Firewall configuration has service-filter-hit term which means that traffic matching this Service-Profile should bypass Service-Profile INTERNET.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  mist@ERX-MX960-II-RE0# show dynamic-profiles PPPOE-PROFILE&#xA;    interfaces {&#xA;&#xA;    pp0 {&#xA;        unit &quot;$junos-interface-unit&quot; {&#xA;            no-traps;&#xA;            ppp-options {&#xA;                pap;&#xA;            }&#xA;            pppoe-options {&#xA;                underlying-interface &quot;$junos-underlying-interface&quot;;&#xA;                server;&#xA;            }&#xA;            targeted-distribution;&#xA;            keepalives interval 30;&#xA;            family inet {&#xA;                unnumbered-address lo0.0;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;&#xA;mist@ERX-MX960-II-RE0# show dynamic-profiles SERVER          &#xA;variables {&#xA;    SERVER-IN uid;&#xA;    SERVER-OUT uid;&#xA;}&#xA;interfaces {&#xA;    pp0 {&#xA;        unit &quot;$junos-interface-unit&quot; {&#xA;            family inet {&#xA;                filter {&#xA;                    input &quot;$SERVER-IN&quot; precedence 60;&#xA;                    output &quot;$SERVER-OUT&quot; precedence 60;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;firewall {&#xA;    family inet {&#xA;        filter &quot;$SERVER-IN&quot; {&#xA;            interface-specific;&#xA;            term 1 {&#xA;                from {&#xA;                    destination-address {&#xA;                        200.200.200.2/32;&#xA;                    }&#xA;                }&#xA;                then {&#xA;                    service-accounting;&#xA;                    service-filter-hit;&#xA;                    accept;&#xA;                }&#xA;            }&#xA;        }&#xA;        filter &quot;$SERVER-OUT&quot; {&#xA;            interface-specific;&#xA;            term 1 {&#xA;                from {&#xA;                    source-address {&#xA;                        200.200.200.2/32;&#xA;                    }&#xA;                }&#xA;                then {&#xA;                    service-accounting;&#xA;                    service-filter-hit;&#xA;                    accept;&#xA;                }&#xA;            }&#xA;        }&#xA;   }&#xA;}&#xA;&#xA;&#xA;&#xA;mist@ERX-MX960-II-RE0# show dynamic-profiles INTERNET &#xA;variables {&#xA;    Bandwidth-IN mandatory;&#xA;    Burst-IN mandatory;&#xA;    Bandwidth-OUT mandatory;&#xA;    Burst-OUT mandatory;&#xA;    INTERNET-IN uid;&#xA;    INTERNET-OUT uid;&#xA;    Policer-IN uid;&#xA;    Policer-OUT uid;&#xA;}&#xA;interfaces {&#xA;    pp0 {&#xA;        unit &quot;$junos-interface-unit&quot; {&#xA;            family inet {&#xA;                filter {&#xA;                    input &quot;$INTERNET-IN&quot; precedence 100;&#xA;                    output &quot;$INTERNET-OUT&quot; precedence 100;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;firewall {&#xA;    family inet {&#xA;        filter &quot;$INTERNET-IN&quot; {&#xA;            interface-specific;&#xA;            term 1 {&#xA;                from {&#xA;                    service-filter-hit;&#xA;                }&#xA;                then accept;&#xA;            }&#xA;            term 2 {&#xA;                then {&#xA;                    policer &quot;$Policer-IN&quot;;&#xA;                    service-accounting;&#xA;                    accept;&#xA;                }&#xA;            }&#xA;        }&#xA;        filter &quot;$INTERNET-OUT&quot; {&#xA;            interface-specific;&#xA;            term 1 {&#xA;                from {&#xA;                    service-filter-hit;&#xA;                }&#xA;                then accept;&#xA;            }&#xA;            term 2 {&#xA;                then {&#xA;                    policer &quot;$Policer-OUT&quot;;&#xA;                    service-accounting;&#xA;                    accept;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    policer &quot;$Policer-IN&quot; {&#xA;        filter-specific;&#xA;        if-exceeding {&#xA;            bandwidth-limit &quot;$Bandwidth-IN&quot;;&#xA;            burst-size-limit &quot;$Burst-IN&quot;;&#xA;        }&#xA;        then discard;&#xA;    }                                  &#xA;    policer &quot;$Policer-OUT&quot; {&#xA;        filter-specific;&#xA;        if-exceeding {&#xA;            bandwidth-limit &quot;$Bandwidth-OUT&quot;;&#xA;            burst-size-limit &quot;$Burst-OUT&quot;;&#xA;        }&#xA;        then discard;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Flow is below&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Subscriber login to MX.&lt;/li&gt;&#xA;&lt;li&gt;Radius will return attribute to activate both Server and INTERNET profile.&lt;/li&gt;&#xA;&lt;li&gt;MX will activate both the Services i.e Server and Internet.&lt;/li&gt;&#xA;&lt;li&gt;Accounting is activated only for service-profile INTERNET.&lt;/li&gt;&#xA;&lt;li&gt;Preference is given for Server than Internet [Lower preference more preferred]. So traffic matching the Service-Profile Server will bypass Internet  Server using service-filter-hit term.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;RADIUS ATTRIBUTES&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cleartext-Password := &quot;mist123&quot;&#xA;ERX-Service-Activate:1 += &quot;SERVER&quot;,&#xA;ERX-Service-Activate:2 += &quot;INTERNET(100M,1M,200M,2M)&quot;,&#xA;ERX-Service-Acct-Interval:2 += &quot;600&quot;,&#xA;ERX-Service-Statistics:2 += time-volume&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Below is the testing&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;mist@ERX-MX960-II-RE0# run show subscribers extensive&#xA;Type: VLAN&#xA;Logical System: default&#xA;Routing Instance: default&#xA;Interface: demux0.3221225495&#xA;Interface type: Dynamic&#xA;Underlying Interface: ae0&#xA;Dynamic Profile Name: DYN-VLAN-Q-IN-Q-AE-PROFILE&#xA;Dynamic Profile Version: 1&#xA;State: Active&#xA;Session ID: 100034&#xA;PFE Flow ID: 40068&#xA;Stacked VLAN Id: 0x8100.1&#xA;VLAN Id: 0x8100.1&#xA;Login Time: 2017-04-11 13:21:34 IST&#xA;&#xA;Type: PPPoE&#xA;User Name: test@erx.com&#xA;IP Address: 10.200.0.12&#xA;IP Netmask: 255.255.255.255&#xA;Domain name server inet: 8.8.4.4&#xA;Domain name server inet6: 2001:4860:4860::8844&#xA;Logical System: default&#xA;Routing Instance: default&#xA;Interface: pp0.3221225496&#xA;Interface type: Dynamic&#xA;Underlying Interface: demux0.3221225495&#xA;Dynamic Profile Name: PPPOE-PROFILE&#xA;Dynamic Profile Version: 1&#xA;MAC Address: 00:16:01:00:00:01&#xA;State: Active&#xA;Radius Accounting ID: 100035&#xA;Session ID: 100035&#xA;PFE Flow ID: 40069&#xA;Stacked VLAN Id: 1&#xA;VLAN Id: 1&#xA;Login Time: 2017-04-11 13:21:34 IST&#xA;Service Sessions: 2&#xA;IP Address Pool: ipv4-pool&#xA;Accounting interval: 600&#xA;&#xA;   Service Session ID: 100036&#xA;   Service Session Name: SERVER&#xA;   Service Session Version: 1&#xA;   State: Active&#xA;   Family: inet&#xA;   IPv4 Input Filter Name: SERVER-IN_UID4030-pp0.3221225496-in&#xA;   IPv4 Output Filter Name: SERVER-OUT_UID4031-pp0.3221225496-out&#xA;   Service Activation time: 2017-04-11 13:21:35 IST&#xA;   Dynamic configuration:&#xA;     SERVER-IN: SERVER-IN_UID4030&#xA;     SERVER-OUT: SERVER-OUT_UID4031&#xA;&#xA;   Service Session ID: 100037&#xA;   Service Session Name: INTERNET&#xA;   Service Session Version: 1&#xA;   State: Active&#xA;   Family: inet&#xA;   IPv4 Input Filter Name: INTERNET-IN_UID4033-pp0.3221225496-in&#xA;   IPv4 Output Filter Name: INTERNET-OUT_UID4035-pp0.3221225496-out&#xA;   Service Activation time: 2017-04-11 13:21:35 IST&#xA;   Accounting interval service: 600&#xA;   Dynamic configuration:&#xA;     Bandwidth-IN: 100M&#xA;     Bandwidth-OUT: 200M&#xA;     Burst-IN: 1M                       &#xA;     Burst-OUT: 2M&#xA;     INTERNET-IN: INTERNET-IN_UID4033&#xA;     INTERNET-OUT: INTERNET-OUT_UID4035&#xA;     Policer-IN: Policer-IN_UID4032&#xA;     Policer-OUT: Policer-OUT_UID4034&#xA;&#xA;&#xA;mist@ERX-MX960-II-RE0# run show interfaces pp0.3221225496 extensive&#xA;  Logical interface pp0.3221225496 (Index 536910981) (SNMP ifIndex 200040069) (Generation 40042)&#xA;    Flags: Up Point-To-Point Encapsulation: PPPoE&#xA;    PPPoE:&#xA;      State: SessionUp, Session ID: 1,&#xA;      Session AC name: MX960, Remote MAC address: 00:16:01:00:00:01,&#xA;      Underlying interface: demux0.3221225495 (Index 536910980)&#xA;    Traffic statistics:&#xA;     Input  bytes  :             62560176&#xA;     Output bytes  :             63087314&#xA;     Input  packets:                82050&#xA;     Output packets:                82061&#xA;    Local statistics:&#xA;     Input  bytes  :                    0&#xA;     Output bytes  :                    0&#xA;     Input  packets:                    0&#xA;     Output packets:                    0&#xA;    Transit statistics:&#xA;     Input  bytes  :             62560176               107112 bps&#xA;     Output bytes  :             63087314                36288 bps&#xA;     Input  packets:                82050                   10 pps&#xA;     Output packets:                82061                   10 pps&#xA;  Keepalive settings: Interval 30 seconds, Up-count 3, Down-count 3&#xA;  LCP state: Opened&#xA;  NCP state: inet: Opened, inet6: Not-configured, iso: Not-configured, mpls: Not-configured&#xA;  CHAP state: Closed&#xA;  PAP state: Success&#xA;    Protocol inet, MTU: 1492, Generation: 0, Route table: 0&#xA;      Flags: Unnumbered&#xA;      Donor interface: lo0.0 (Index 322)&#xA;      Input Filters: SERVER-IN_UID4030-pp0.3221225496-in (60), INTERNET-IN_UID4033-pp0.3221225496-in (100)&#xA;      Output Filters: SERVER-OUT_UID4031-pp0.3221225496-out (60), INTERNET-OUT_UID4035-pp0.3221225496-out (100)&#xA;      Addresses, Flags: Is-Primary&#xA;        Destination: Unspecified, Local: 10.200.0.1, Broadcast: Unspecified, Generation: 0&#xA;&#xA;&#xA;mist@ERX-MX960-II-RE0# run show firewall&#xA;&#xA;Filter: __default_bpdu_filter__                               &#xA;&#xA;&#xA;Filter: SERVER-IN_UID4030-pp0.3221225496-in                   &#xA;Counters:&#xA;Name                                                Bytes              Packets&#xA;__junos-dyn-service-counter                      60341436                78894&#xA;&#xA;Filter: SERVER-OUT_UID4031-pp0.3221225496-out                 &#xA;Counters:&#xA;Name                                                Bytes              Packets&#xA;__junos-dyn-service-counter                      60848755                78905&#xA;&#xA;Filter: INTERNET-IN_UID4033-pp0.3221225496-in                 &#xA;Counters:&#xA;Name                                                Bytes              Packets&#xA;__junos-dyn-service-counter                             0                    0&#xA;Policers:&#xA;Name                                                Bytes              Packets&#xA;Policer-IN_UID4032-pp0.3221225496-in                    0                    0&#xA;&#xA;Filter: INTERNET-OUT_UID4035-pp0.3221225496-out               &#xA; Counters:&#xA;Name                                                Bytes              Packets&#xA;__junos-dyn-service-counter                             0                    0&#xA;Policers:&#xA;Name                                                Bytes              Packets&#xA;Policer-OUT_UID4034-pp0.3221225496-out                    0                    0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30266" LastActivityDate="2017-04-16T07:02:45.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40471" PostTypeId="5" CreationDate="2017-04-16T09:36:12.903" Score="0" Body="&lt;p&gt;Questions relating to the operations of ISPs. This could be your links to your ISP(s), questions on ISP policies or operations, ISP best practices etc.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2017-04-16T16:48:08.517" LastActivityDate="2017-04-16T16:48:08.517" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40472" PostTypeId="4" CreationDate="2017-04-16T09:36:12.903" Score="0" Body="Questions relating to the operations of ISPs and interacting with them." OwnerUserId="253" LastEditorUserId="253" LastEditDate="2017-04-16T16:48:21.887" LastActivityDate="2017-04-16T16:48:21.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40473" PostTypeId="5" CreationDate="2017-04-16T09:38:33.313" Score="0" Body="&lt;p&gt;For questions about or relating to general firewall questions. There are separate tags available for VPNs and ACLs etc.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorDisplayName="user36472" LastEditDate="2018-03-02T19:02:04.937" LastActivityDate="2018-03-02T19:02:04.937" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40474" PostTypeId="4" CreationDate="2017-04-16T09:38:33.313" Score="0" Body="For questions about or relating to firewall operations, configuration and troubleshooting." OwnerUserId="253" LastEditorDisplayName="user36472" LastEditDate="2018-03-02T19:02:00.013" LastActivityDate="2018-03-02T19:02:00.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40475" PostTypeId="5" CreationDate="2017-04-16T09:40:39.343" Score="0" Body="&lt;p&gt;For questions related to traffic switching and troubleshooting the traffic switching process (such as Ethernet forwarding). There is a separate tag for &lt;a href=&quot;/questions/tagged/switch&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;switch&amp;#39;&quot; rel=&quot;tag&quot;&gt;switch&lt;/a&gt;es.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="31801" LastEditDate="2018-08-14T13:05:22.873" LastActivityDate="2018-08-14T13:05:22.873" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40476" PostTypeId="4" CreationDate="2017-04-16T09:40:39.343" Score="0" Body="For questions related to traffic switching and troubleshooting the traffic switching process." OwnerUserId="253" LastEditorUserId="253" LastEditDate="2017-04-16T16:48:18.553" LastActivityDate="2017-04-16T16:48:18.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40482" PostTypeId="2" ParentId="40326" CreationDate="2017-04-16T20:05:17.783" Score="1" Body="&lt;p&gt;&lt;strong&gt;8820 is an unreserved port.&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I think, you are doing socket programming. You want to connect two PC. You want to transfer data. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Socket = IP Address + Port Number.&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP address is used to identity the PC. Port number is used to identity the process in that PC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each process runs in an unique port number. Port number is 16bit address. When we want process to process communication, we use port number. This works at transport layer. Please read transport layer in TCP/IP model. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some Port numbers which are reserved such as port number 80 is used for HTTP. 20 and 21 for FTP. 22 for ssh. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Port Number Ranges&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP, UDP, UDP-Lite, SCTP, and DCCP use 16-bit namespaces for their&#xA;   port number registries.  The port registries for all of these&#xA;   transport protocols are subdivided into three ranges of numbers&#xA;   [RFC1340], and Section 8.1.2 describes the IANA procedures for each&#xA;   range in detail:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;o  the System Ports, also known as the Well Known Ports, from 0-1023&#xA;      (assigned by IANA)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;o  the User Ports, also known as the Registered Ports, from 1024-&#xA;      49151 (assigned by IANA)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;o  the Dynamic Ports, also known as the Private or Ephemeral Ports,&#xA;      from 49152-65535 (never assigned)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of the assignable port ranges (System Ports and User Ports, i.e.,&#xA;   port numbers 0-49151), individual port numbers are in one of three&#xA;   states at any given time:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;o  Assigned: Assigned port numbers are currently assigned to the&#xA;      service indicated in the registry.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;o  Unassigned: Unassigned port numbers are currently available for&#xA;      assignment upon request, as per the procedures outlined in this&#xA;      document.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;o  Reserved: Reserved port numbers are not available for regular&#xA;      assignment; they are &quot;assigned to IANA&quot; for special purposes.&#xA;      Reserved port numbers include values at the edges of each range,&#xA;      e.g., 0, 1023, 1024, etc., which may be used to extend these&#xA;      ranges or the overall port number space in the future.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to keep the size of the registry manageable, IANA typically&#xA;   only records the Assigned and Reserved service names and port numbers&#xA;   in the registry.  Unassigned values are typically not explicitly&#xA;   listed.  (There are very many Unassigned service names and&#xA;   enumerating them all would not be practical.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a data point, when this document was written, approximately 76% of&#xA;   the TCP and UDP System Ports were assigned, and approximately 9% of&#xA;   the User Ports were assigned.  (As noted, Dynamic Ports are never&#xA;   assigned.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you choose any port number which are not reserved.&#xA;Max port numbers is 2^16. Because port number is 16bit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, You can use 5000, ...6800,...8821, 8822, ....,46789,...,65353 etc. Choose any unreserved port. Remember, port number in both PC should be same. &lt;/p&gt;&#xA;" OwnerUserId="34219" LastEditorUserId="34219" LastEditDate="2018-03-01T01:50:53.683" LastActivityDate="2018-03-01T01:50:53.683" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40483" PostTypeId="1" CreationDate="2017-04-16T20:29:29.293" Score="4" ViewCount="9207" Body="&lt;p&gt;I've read that frames are tagged only when going over a &lt;strong&gt;trunk&lt;/strong&gt; port and that access ports do not tag frames passing through them. But don't access ports actually tag frames? When I configure a particular port to be in a particular VLAN (for example VLAN 5), when traffic comes into the access port from a PC, isn't that frame then being tagged with the respective VLAN configured for that port? If the frame is not tagged by the switch's access port (assuming that the access port is not configured with a native VLAN, but another VLAN, for example VLAN5), then how would a trunk know what tag (VLAN 5) to put on that frame as it sends it across the trunk. If I'm able to configure a switch's access port to belong to a particular VLAN, then why wouldn't the switch tag the frame as it enters the switch access port? Isn't this the point of configuring an access port with a certain (non native) VLAN - to tag the frame to delimit where the frame can travel? Also, wouldn't the frame need to be tagged when entering the switch access port from the PC, so then the switch would know (if it was a broadcast) to where the broadcast should be delimited to (only ports within that VLAN)?&lt;/p&gt;&#xA;" OwnerUserId="36067" LastEditorUserId="53804" LastEditDate="2021-10-02T18:24:45.853" LastActivityDate="2021-12-13T21:29:38.737" Title="Aren't Switch Access ports tagged?" Tags="|vlan|trunk|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="40484" PostTypeId="2" ParentId="40483" CreationDate="2017-04-16T21:07:04.410" Score="4" Body="&lt;p&gt;Access links (ports) are presented to any device without tags. When traffic leaves that VLAN going into the switch for a destination not on the same VLAN it gets a tag of the VLAN added to each frame, to allow the switch to forward it correctly. When you speak of a native VLAN, it is the common VLAN that two devices agree to send non tag packets. The default VLAN on cisco switches is VLAN 1.  Devices need a common untag network to communicate on. Tags are for forwarding purposes. They provide no value within a VLAN.&lt;/p&gt;&#xA;" OwnerUserId="36068" LastEditorUserId="53804" LastEditDate="2021-10-02T18:24:24.957" LastActivityDate="2021-10-02T18:24:24.957" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40485" PostTypeId="1" AcceptedAnswerId="40486" CreationDate="2017-04-16T21:31:21.960" Score="3" ViewCount="491" Body="&lt;p&gt;I know the concept of IP unnumbered interfaces and that it was used to preserve IP addresses before VLSM came to be. I'm just curious to know if there are scenarios in current networks where IP unnumbered is/could be used.&lt;/p&gt;&#xA;" OwnerUserId="35823" LastActivityDate="2017-04-17T00:41:39.867" Title="Is IP unnumbered still in wide use today?" Tags="|ipv4|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40486" PostTypeId="2" ParentId="40485" CreationDate="2017-04-16T23:23:21.623" Score="2" Body="&lt;p&gt;'Wide' is a bit broad to define.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, it is still used for example in serial p2p interfaces, but maybe not to such an extent as in the past.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scaling was the historical factor, however it is the implementation of the interface to have IP processing without a hardcoded IP address that allows still it's usefulness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From Juniper on IPv6: &quot;you can configure unnumbered interfaces to share the same subnet across multiple interfaces.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Perhaps 3 unspecific scenarios: overlapping subnets, wildcard interface for further processing, network design corner cases.&lt;/p&gt;&#xA;" OwnerUserId="35590" LastActivityDate="2017-04-16T23:23:21.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40487" PostTypeId="2" ParentId="40485" CreationDate="2017-04-17T00:41:39.867" Score="2" Body="&lt;p&gt;Unnumbered certainly was helpful pre-VLSM but it's almost exclusively been adopted as a convenience - no need to allocate/configure individual IP's for point-to-point interfaces which means easier and/or less labor intensive provisioning.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's definitely out there in certain places.  Smaller shops often use it because it's simple and, honestly, it shows up in a lot of basic configuration examples.  There's also been a bit of a resurgence in certain DevOps contexts as it reduces the number of touch points for turning up L3 connections.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also - as has been the case since inception - it's also still frowned upon by plenty of engineers as it makes certain kinds of troubleshooting more difficult.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-04-17T00:41:39.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40488" PostTypeId="1" CreationDate="2017-04-17T01:02:08.773" Score="2" ViewCount="5081" Body="&lt;p&gt;I am a little confused on the process OSPF uses to select the Router ID. Is following correct for the selection of the router ID in OSPF?&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Manual configuration&lt;/li&gt;&#xA;&lt;li&gt;Highest IP address on a loopback interface&lt;/li&gt;&#xA;&lt;li&gt;Highest IP address on a non-loopback interface&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="36071" LastEditorUserId="8499" LastEditDate="2020-03-30T01:08:40.063" LastActivityDate="2020-03-30T01:08:40.063" Title="What is the election process of Router ID in OSPF?" Tags="|routing|router|protocol-theory|ospf|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40489" PostTypeId="2" ParentId="40483" CreationDate="2017-04-17T01:08:30.527" Score="7" Body="&lt;p&gt;I think you're confusing what goes on internally on the switch.  How it keeps track of which ports are in which VLAN is up to the manufacturer.&lt;/p&gt;&#xA;&lt;p&gt;It's important to remember that 802.1q frames are a different format than &amp;quot;standard&amp;quot; Ethernet (802.3).   Standard Ethernet frames do not have VLAN IDs.  A PC or other device transmits and receives Ethernet frames (802.3) when they send/receive it to/from an access port of a switch.&lt;/p&gt;&#xA;&lt;p&gt;When a switch transmits frames on a trunk, it uses 802.1q framing, which includes a VLAN tag. If the switch is transmitting frames with tags, then that port is a trunk port.  Most hosts do not understand 802.1q frames, so they ignore them.   That is why you can have tagged and untagged frames on the same port. But it's still a trunk port.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="53804" LastEditDate="2021-10-02T18:24:35.613" LastActivityDate="2021-10-02T18:24:35.613" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="40490" PostTypeId="2" ParentId="40488" CreationDate="2017-04-17T02:19:53.430" Score="4" Body="&lt;p&gt;Amazingly enough, for something so important to OSPF, the RFC doesn't define the Router ID selection process. A Router ID is simply a 32-bit number, and the implementation of it may vary from vendor to vendor. What you describe is how Cisco does it, but other vendors are free to do it any way they want. In fact, the example in &lt;a href=&quot;https://www.ietf.org/rfc/rfc2328.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 2328, OSPF Version 2&lt;/em&gt;&lt;/a&gt; is using the smallest IP address (see below), not the largest as Cisco does.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Router ID &lt;em&gt;is not&lt;/em&gt; an IPv4 address, and you can use a Router ID that is any 32-bit number, even if it looks like a bad IPv4 address.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Router ID&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A 32-bit number that uniquely identifies this router in the&#xA;  AS. One possible implementation strategy would be to use the &lt;strong&gt;smallest&#xA;  IP interface address&lt;/strong&gt; belonging to the router. If a router's OSPF&#xA;  Router ID is changed, the router's OSPF software should be restarted&#xA;  before the new Router ID takes effect.  In this case the router should&#xA;  flush its self-originated LSAs from the routing domain (see Section&#xA;  14.1) before restarting, or they will persist for up to MaxAge minutes.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-03-07T18:25:17.763" LastActivityDate="2018-03-07T18:25:17.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40493" PostTypeId="1" CreationDate="2017-04-17T09:19:16.093" Score="1" ViewCount="360" Body="&lt;p&gt;In my network, a specific url is being blocked by fortiguard firewall. Now I want to know which all devices had tried to access that blocked url. I traced the mac address inside the packet. But how will I know which person has tried to access blocked url if the device in no longer connected to that network ?&lt;/p&gt;&#xA;" OwnerUserId="36077" LastEditorUserId="36077" LastEditDate="2017-04-17T11:47:18.110" LastActivityDate="2017-08-15T16:12:28.923" Title="Can a fortigate firewall know which device tried to access its restricted url?" Tags="|firewall|security|network-access|fortigate|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40497" PostTypeId="2" ParentId="40493" CreationDate="2017-04-17T10:05:34.113" Score="2" Body="&lt;p&gt;You could track that by going to Destinations in Fortiview, or if it is blocked by Fortigate you can find more info from FortiView-Web sites&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-04-17T10:05:34.113" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40498" PostTypeId="2" ParentId="40488" CreationDate="2017-04-17T10:37:40.917" Score="0" Body="&lt;p&gt;OSPF Router-ID selection happens in the below order.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Manually configure a 32-bit Router-ID.&lt;/li&gt;&#xA;&lt;li&gt;Highest IP of the loop back interface, if 1 is not configured.&lt;/li&gt;&#xA;&lt;li&gt;Highest IP of any active interface,if 1 &amp;amp; 2 has not configured.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="36079" LastActivityDate="2017-04-17T10:37:40.917" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40499" PostTypeId="1" CreationDate="2017-04-17T15:24:43.717" Score="2" ViewCount="765" Body="&lt;p&gt;My problem is that I declared a static route in a Cisco ASR-901 and it is shown while doing &lt;code&gt;show ip route&lt;/code&gt;: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SOYUNCORESWITCH(config)#do sh ip route&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area &#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;      ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP&#xA;   a - application route&#xA;   + - replicated route, % - next hop override, p - overrides from PfR&#xA;&#xA;Gateway of last resort is 192.168.3.254 to network 0.0.0.0&#xA;&#xA;S*    0.0.0.0/0 [1/0] via 192.168.3.254&#xA;                [1/0] via 192.168.3.1&#xA;      172.26.0.0/16 is variably subnetted, 2 subnets, 2 masks&#xA;C        172.26.248.96/27 is directly connected, Vlan60&#xA;L        172.26.248.114/32 is directly connected, Vlan60&#xA;      192.168.3.0/24 is variably subnetted, 3 subnets, 2 masks&#xA;C        192.168.3.0/24 is directly connected, FastEthernet0/0&#xA;S        192.168.3.66/32 [1/0] via 192.168.3.64&#xA;L        192.168.3.99/32 is directly connected, FastEthernet0/0&#xA;      192.168.10.0/24 is variably subnetted, 2 subnets, 2 masks&#xA;C        192.168.10.8/29 is directly connected, Vlan100&#xA;L        192.168.10.12/32 is directly connected, Vlan100&#xA;SOYUNCORESWITCH(config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But, when I try to ping 192.168.3.66 it does not respond:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SOYUNCORESWITCH#ping 192.168.3.66&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 192.168.3.66, timeout is 2 seconds:&#xA;.....&#xA;Success rate is 0 percent (0/5)&#xA;SOYUNCORESWITCH#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I checked the route on the other end and it is ok, so is there anything missing? or badly done?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PD: Here is the current configuration of the router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SOYUNCORESWITCH#sh run&#xA;   Building configuration...&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 3534 bytes&#xA;!&#xA;! Last configuration change at 21:05:11 UTC Sun Apr 17 2011 by r03py&#xA;! NVRAM config last updated at 20:20:41 UTC Sun Apr 17 2011 by r03py&#xA;!&#xA;version 15.6&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;!&#xA;hostname SOYUNCORESWITCH&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;enable secret 5 $1$f743$eVtDaxgWmCvSPcOoi4qKB0&#xA;!&#xA;no aaa new-model&#xA;ethernet lmi global&#xA;ip cef&#xA;!&#xA;no ipv6 cef&#xA;!&#xA;multilink bundle-name authenticated&#xA;l3-over-l2 flush buffers&#xA;asr901-storm-control-bpdu 1000&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;license udi pid A901-6CZ-FS-A sn CAT2043U1RN&#xA;license boot level AdvancedMetroIPAccess&#xA;&amp;lt;removed&amp;gt;    !&#xA;cdp run&#xA;!&#xA;interface Loopback0&#xA; no ip address&#xA;!&#xA;interface GigabitEthernet0/0&#xA; description ver_asr_901_pg_358&#xA; mtu 1500&#xA; no ip address&#xA; negotiation auto&#xA; cdp enable&#xA; service instance 60 ethernet&#xA;  description ##### CONEXION A RED MPLS  #####&#xA;  encapsulation dot1q 60&#xA;  rewrite ingress tag pop 1 symmetric&#xA;  bridge-domain 60&#xA; !&#xA;!&#xA;interface GigabitEthernet0/1&#xA; description #####  CONEXION CON WAN TECO  #####&#xA; mtu 1500&#xA; no ip address&#xA; negotiation auto&#xA; service instance 100 ethernet&#xA;  encapsulation untagged&#xA;  bridge-domain 100&#xA; !&#xA;!&#xA;interface GigabitEthernet0/2&#xA; no ip address&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet0/3&#xA; mtu 1500&#xA; no ip address&#xA; negotiation auto&#xA; cdp enable&#xA;!&#xA;interface GigabitEthernet0/4&#xA; no ip address&#xA; media-type auto-select&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet0/5&#xA; no ip address&#xA; media-type auto-select&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet0/6&#xA; no ip address&#xA; media-type auto-select&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet0/7&#xA; no ip address&#xA; media-type auto-select&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet0/8&#xA; no ip address&#xA; negotiation auto&#xA; qos-config scheduling-mode min-bw-guarantee&#xA;!&#xA;interface GigabitEthernet0/9&#xA; no ip address&#xA; negotiation auto&#xA; qos-config scheduling-mode min-bw-guarantee&#xA;!&#xA;interface GigabitEthernet0/10&#xA; no ip address&#xA; negotiation auto&#xA; qos-config scheduling-mode min-bw-guarantee&#xA;!&#xA;interface GigabitEthernet0/11&#xA; no ip address&#xA; negotiation auto&#xA; qos-config scheduling-mode min-bw-guarantee&#xA;!&#xA;interface TenGigabitEthernet0/0&#xA; no ip address&#xA; qos-config scheduling-mode min-bw-guarantee&#xA;!&#xA;interface TenGigabitEthernet0/1&#xA; no ip address&#xA; qos-config scheduling-mode min-bw-guarantee&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.3.99 255.255.255.0&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan60&#xA; ip address 172.26.248.114 255.255.255.224&#xA;!&#xA;interface Vlan100&#xA; ip address 192.168.10.12 255.255.255.248&#xA;!&#xA;interface Vlan777&#xA; ip address 172.17.17.66 255.255.255.252&#xA;!&#xA;router ospf 100&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip route static adjust-time 3&#xA;ip route 0.0.0.0 0.0.0.0 192.168.3.254&#xA;ip route 0.0.0.0 0.0.0.0 192.168.3.1&#xA;ip route 172.17.17.64 255.255.255.252 GigabitEthernet0/3&#xA;ip route 172.17.17.64 255.255.255.252 72.17.17.66 permanent&#xA;ip route 192.168.3.66 255.255.255.255 192.168.3.64&#xA;ip route 192.198.3.64 255.255.255.252 GigabitEthernet0/3&#xA;ip ospf name-lookup&#xA;!&#xA;no service-routing capabilities-manager&#xA;!&#xA;control-plane&#xA;!&#xA;environment monitor&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; exec-timeout 15 0&#xA;&amp;lt;removed&amp;gt;&#xA; private&#xA; logging synchronous&#xA; login local&#xA; transport input telnet&#xA;line vty 5 15&#xA; login local&#xA; transport input telnet&#xA;!&#xA;exception crashinfo buffersize 128&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36084" LastEditorUserId="8499" LastEditDate="2018-03-17T14:44:34.370" LastActivityDate="2018-03-17T14:44:34.370" Title="ASR-901 shows static route but not MAC address table and ping does not respond" Tags="|cisco|routing|router|ping|cisco-asr|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40500" PostTypeId="1" AcceptedAnswerId="40501" CreationDate="2017-04-17T15:37:48.350" Score="0" ViewCount="660" Body="&lt;p&gt;Based on this topology : &lt;a href=&quot;https://i.stack.imgur.com/O8XTG.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://i.stack.imgur.com/O8XTG.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;1) Can OSPF and static route work together? IS there conflict if i&#xA;  were to configured a static route from R1 to R3 directly.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;2) If R1 to R3 best route is R1-&gt;R2-&gt;R3. And I configured a static&#xA;  route from R1 to R3 directly. Which route would it still take?&#xA;  R1-&gt;R2-R3? or R1-R3?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="36021" LastActivityDate="2017-04-17T15:44:09.150" Title="Combining OSPFv2 with Static route" Tags="|routing|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40501" PostTypeId="2" ParentId="40500" CreationDate="2017-04-17T15:44:09.150" Score="-1" Body="&lt;p&gt;The answer is yes OSPF and static route can work together using command on CISCO&lt;/p&gt;&#xA;&#xA;&lt;p&gt;redistributed connected subnet&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The 2nd answer yes you can give static route between R1 &gt; R3 provided they should be connected to the area 0, and satic route will be best as its AD value is 1 and OSPF is 110 lower is better&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hail network and if you find useful please click correct&lt;/p&gt;&#xA;" OwnerUserId="32628" LastActivityDate="2017-04-17T15:44:09.150" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40505" PostTypeId="1" CreationDate="2017-04-17T17:49:32.910" Score="0" ViewCount="825" Body="&lt;p&gt;I have a SG300-28p switch I want to connect 18 devices, but want to balance or distribute evenly the traffic between groups of six ports (1-6, 7-12, 13-18). I was hoping to have DHCP enabled for all ports (if configuring for VLAN 100,101,102 to the ports respectively).  Any advice for this configuration?  I'm hitting a brick wall (as I'm a newbie). (Background - want to connect multiple Raspberry PI's for data analysis - so will consume lots of traffic).&lt;/p&gt;&#xA;" OwnerUserId="36090" LastActivityDate="2019-04-10T04:22:13.707" Title="SG300 Load balancing / distribution configuration" Tags="|cisco|routing|switch|vlan|ipv4|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40506" PostTypeId="1" CreationDate="2017-04-17T18:27:05.473" Score="1" ViewCount="2934" Body="&lt;p&gt;If a TCP packet is fragmented then would the identification field of the header stay the same for all of the fragmented packets, or would it increment by 1 so that the receiver would know what packet comes next? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say a packet isn't fragmented and another unfragmented packet is sent directly after, would their identification fields differ by 1 or would the be totally different? &lt;/p&gt;&#xA;" OwnerUserId="36091" LastEditorUserId="8499" LastEditDate="2018-10-18T19:04:07.693" LastActivityDate="2019-01-17T10:01:45.340" Title="In IPv4 does the identification field in a TCP packet change for fragmented packets?" Tags="|ip|ipv4|tcp|layer3|layer4|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40507" PostTypeId="2" ParentId="40506" CreationDate="2017-04-17T18:31:32.083" Score="0" Body="&lt;p&gt;Packets are a layer-3 datagrams, and they are fragmented and reassembled at layer-3. TCP is a layer-4 protocol using segments that are carried in the layer-3 packets. The layer-3 packets are fragmented and reassembled transparently to layer-4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv4 will fragment (if necessary) and reassemble packets, and it will pass the payload of a fully reassembled packet up to layer-4 (TCP, in this case). TCP will never know that a packet was fragmented and reassembled.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2018-10-18T19:11:23.180" LastActivityDate="2018-10-18T19:11:23.180" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40510" PostTypeId="1" AcceptedAnswerId="40555" CreationDate="2017-04-17T21:20:34.207" Score="2" ViewCount="429" Body="&lt;p&gt;I am wondering if all the private IPv6 address non overlapping. And if yes, I am wondering if RD is required for IPv6 addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When two customer sites of an ISP are using same overlapping private IPv4 space, RD is used to identify the specific VPN. If an ISP assigns blocks of non overlapping IPv6 to all the customers, is RD required at all since all the addresses will be already unique?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will MP-BGP multiprotocol Reachable NLRI ever have AFI of 2 (IPv6) and SAFI of 128(NLRI for labeled VPN forwarding)?&lt;/p&gt;&#xA;" OwnerUserId="36017" LastActivityDate="2017-04-18T23:55:49.063" Title="Are all the private IPv6 addresses nonoverlapping? If yes, is Route distinguisher required for IPv6?" Tags="|ipv6|mpls|mpls-vpn|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40511" PostTypeId="2" ParentId="40510" CreationDate="2017-04-17T21:30:33.320" Score="1" Body="&lt;p&gt;IPv6 doesn't have NAT, so ISPs assign Global IPv6 addresses to their customers. That was the whole point of IPv6. IPv4 ran out of public addresses, and NAT was a kludge created as a way to extend IPv4 until IPv6, with its unimaginable number of addresses, becomes ubiquitous. NAT breaks the IP promise of a unique address for every host that allows end-to-end connectivity. IPv6 restores end-to-end connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 does have ULA (Unique Local Addressing), but that is for addresses that will never be routed on the public Internet. ULA does have some restrictions in place that make it difficult to duplicate addressing at different sites.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-17T21:30:33.320" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40514" PostTypeId="2" ParentId="40453" CreationDate="2017-04-18T03:25:15.587" Score="2" Body="&lt;p&gt;Implement IBGP with a lower preference than OSPF and import summary routes narrow with a route-filter policy and define additional BGP attributes with the algorithm based on your need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RPM with static routes. Not all routers have this, maybe a firewall or other device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Event policy with a script. If possible and depending on: platform, urgency, and knowledge may not be the most suitable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As user3476261 said, split the network, administratively not always possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Ron Trunk suggested do not summarize, although based on your need you are looking to reduce control plane burden, hence not likely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get more cabling done for redundancy (not scalable).&lt;/p&gt;&#xA;" OwnerUserId="35590" LastActivityDate="2017-04-18T03:25:15.587" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40517" PostTypeId="1" AcceptedAnswerId="40523" CreationDate="2017-04-18T05:29:59.400" Score="0" ViewCount="547" Body="&lt;p&gt;The access point I am talking about is for phones; as in the method for connecting to data services. In the Access Point Names setting on my AT&amp;amp;T phone, I see these settings:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Name: ATT Nextgenphone&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;APN: nxtgenphone&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;MMSC: &lt;a href=&quot;http://mmsc.mobile.att.net&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://mmsc.mobile.att.net&lt;/a&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Multimedia message proxy: proxy.mobile.att.net&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Multimedia message port: 80&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The rest of the settings I don't believe I should give out. But, if I created my own server to do this on my own Internet connection, and changed my phone's settings to use that server, would it be possible for me to use that connection anywhere and therefore, have unlimited data?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, how can I create one?&lt;/p&gt;&#xA;" OwnerUserId="36101" LastActivityDate="2017-04-18T07:07:19.627" Title="If I create an &quot;Access Point&quot; server, could I have unlimited data on my phone?" Tags="|internet|mobile|" AnswerCount="1" CommentCount="3" ClosedDate="2017-04-18T13:45:18.380" ContentLicense="CC BY-SA 3.0" />
  <row Id="40520" PostTypeId="1" CreationDate="2017-04-18T06:10:16.173" Score="1" ViewCount="106" Body="&lt;p&gt;I got so confused studying VLANS. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4Ay1r.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4Ay1r.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OzKlR.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OzKlR.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever I try to setup my laptop with VLANID 200,i cant access the MMC (managed media converter) web gui or management. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have setup the VLANID 200 (on my laptop) with the right IP subnet range to that of the mmc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The set IP interface in the MMC are these ones:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 1 - 10.1.1.1 /24&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN 4005 - 10.211.1.1 -16 (for management)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whenever I setup VLAN 4005 on my laptop I can ping the mmc.But when I set up VLAN 200 on my laptop I can't. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on the above diagram, do I have to setup an IP address (on the mmc) for VLAN 200 and VLAN 300 each? I thought I was only supposed to setup an IP address (on the mmc device) for the management VLAN which is the 4005. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;BTW: the port from mmc to laptop is port 3 and from mmc to cisco switch is port 1 as shown in the image above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for any help guys.. I'm trying to learn VLAN and have read other posts in here.. &lt;/p&gt;&#xA;" OwnerUserId="35841" LastActivityDate="2017-04-18T11:23:25.613" Title="Does setting up VLAN on the ports on my switch makes the packet coming out of those ports tagged?" Tags="|vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40521" PostTypeId="1" CreationDate="2017-04-18T06:34:20.163" Score="1" ViewCount="1200" Body="&lt;p&gt;I have created the following Network in GNS3 &lt;a href=&quot;https://i.stack.imgur.com/mESwX.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mESwX.png&quot; alt=&quot;GNS3 Simple Network Diagram&quot;&gt;&lt;/a&gt;&#xA; Let me explain the SetUp:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The internet cloud &lt;strong&gt;Cloud 1&lt;/strong&gt; is connected to my &lt;strong&gt;LAN&lt;/strong&gt; and not &lt;strong&gt;loopback&lt;/strong&gt;.&lt;/li&gt;&#xA;&lt;li&gt;R1 routers' F0/0 is getting the IP from DHCP, to which i can telnet and ping from any remote host in my LAN.&lt;/li&gt;&#xA;&lt;li&gt;R1 also configured with SNMP access (public community string)&lt;/li&gt;&#xA;&lt;li&gt;The IP for R1 routers' F0/1 interface is manually configured.  &lt;/li&gt;&#xA;&lt;li&gt;This interface i can ping from any remote host on my LAN however Telnet fails.&#xA;R2 routers' F0/0 ip is manully configured. The situation is same here, where i am able to ping however telnet is failing. All the configuration is same between R1 and R2.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Just mentioning again, all the interfaces are ping-able from any Remote Host in the same LAN, however only R1's F0/0 is telnet-able (hope that is a word)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there some configuration change that i can do to get telnet access to all the interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S: My cloud internet gateway is 10.226.22.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration of R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building configuration...&#xA;&#xA;Current configuration : 2016 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address dhcp&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 10.226.22.34 255.255.255.224&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet3/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Ethernet4/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/1&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/2&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/3&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/4&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/5&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/6&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/7&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet5/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet5/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial6/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial6/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial6/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial6/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router rip&#xA; network 10.0.0.0&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 10.226.22.1&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;ip http path flash:&#xA;!&#xA;!&#xA;snmp-server community public RO&#xA;no cdp advertise-v2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;!&#xA;telephony-service&#xA; max-conferences 4 gain -6&#xA; web admin system name cisco secret 5 $1$1pTn$/eGx7afnUPhFB2AqoFApH.&#xA; dn-webedit&#xA; time-webedit&#xA;!&#xA;!&#xA;line con 0&#xA; stopbits 1&#xA;line aux 0&#xA;line vty 0 4&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configuration of R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building configuration...&#xA;&#xA;Current configuration : 2119 bytes&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;ip cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 10.226.22.35 255.255.255.224&#xA; duplex half&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface GigabitEthernet3/0&#xA; no ip address&#xA; shutdown&#xA; negotiation auto&#xA;!&#xA;interface Ethernet4/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/1&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/2&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/3&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/4&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/5&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/6&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Ethernet4/7&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet5/0&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet5/1&#xA; no ip address&#xA; shutdown&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial6/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial6/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial6/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial6/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router rip&#xA; network 10.0.0.0&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 10.226.22.34&#xA;!&#xA;ip http server&#xA;no ip http secure-server&#xA;ip http path flash:&#xA;!&#xA;!&#xA;no cdp advertise-v2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;!&#xA;telephony-service&#xA; max-conferences 4 gain -6&#xA; web admin system name cisco secret 5 $1$/jP3$0HbV8qC5BIn8Ezww4Nuv7.&#xA; dn-webedit&#xA; time-webedit&#xA;!&#xA;!&#xA;line con 0&#xA; stopbits 1&#xA;line aux 0&#xA;line vty 0 4&#xA; login&#xA; transport input telnet&#xA; transport output telnet&#xA;line vty 5 15&#xA; login&#xA; transport input telnet&#xA; transport output telnet&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As an additional info, my gateway for R1 is 10.226.22.1 which is not reachable from R2. (Maybe i need to somehow get the gateway reachable from R2?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing info of R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 10.226.22.1 to network 0.0.0.0&#xA;&#xA;     10.0.0.0/8 is variably subnetted, 3 subnets, 2 masks&#xA;S       10.238.60.13/32 [254/0] via 10.226.22.1, FastEthernet0/0&#xA;C       10.226.22.32/27 is directly connected, FastEthernet1/0&#xA;C       10.226.22.0/27 is directly connected, FastEthernet0/0&#xA;S*   0.0.0.0/0 [1/0] via 10.226.22.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Routing info of R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is 10.226.22.34 to network 0.0.0.0&#xA;&#xA;     10.0.0.0/27 is subnetted, 2 subnets&#xA;C       10.226.22.32 is directly connected, FastEthernet0/0&#xA;R       10.226.22.0 [120/1] via 10.226.22.34, 00:00:15, FastEthernet0/0&#xA;S*   0.0.0.0/0 [1/0] via 10.226.22.34&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34450" LastEditorUserId="8499" LastEditDate="2018-12-17T03:29:52.160" LastActivityDate="2018-12-17T03:29:52.160" Title="GNS3 - Telnet issue" Tags="|cisco|router|gns3|lab|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40522" PostTypeId="2" ParentId="40521" CreationDate="2017-04-18T06:57:35.097" Score="0" Body="&lt;p&gt;on Cisco router try this command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line vty 0 15&#xA;transport input telnet&#xA;transport output telnet&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;These above commands will help you to activate telnet the reason would be when you try to telnet R1 from lan the input command would be given but when it passes through R1 to R2 it won't able to telnet as output command is not given try this &lt;/p&gt;&#xA;" OwnerUserId="32628" LastEditorUserId="509" LastEditDate="2017-04-18T08:15:32.937" LastActivityDate="2017-04-18T08:15:32.937" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40523" PostTypeId="2" ParentId="40517" CreationDate="2017-04-18T07:07:19.627" Score="1" Body="&lt;p&gt;No.There are several parameters when your mobile connection is validated at the Operator's Network and APN is one among them.This is the explanation from a layman point of view.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per the GSM,3G,LTE standards the procedure of enabling data services for a subscriber is known as Attach.In this procedure UE/Mobile will have to send its parameters like TMSI,APN and another couple of parameters to authenticate the itself on the network. Depending upon the technology you use the service will be authenticated from the network by BSC(2G)(base station controller along with SGSN or from EPC side(LTE))&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if you manage to create a new configuration at your phone and tried to attach the phone with network,The request will not get authenticated and data service will not be activated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just for you to understand,the operator network equipment vendors are normally Nokia,Ericsson,Alcatel lucent and Zte.Almost all the security aspects will be covered at multiple stages of the product deployment.On the other side,3gpp standards are very well defined to make sure unauthorized access are NACKed from the network as well.&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-04-18T07:07:19.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40525" PostTypeId="1" AcceptedAnswerId="40528" CreationDate="2017-04-18T08:59:13.043" Score="1" ViewCount="86" Body="&lt;p&gt;I'm trying to generate a map of the physical network just from the configuration of every item in the network (switch, router). But the only way I found to be sure an Equipment is plug to another is on the interface description. If the description is badly/wrongly/not filled, I can't assert who is plugged. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only bit i'm sure of, is  on what side a &lt;code&gt;MAC address&lt;/code&gt; is from an &lt;code&gt;interface&lt;/code&gt; (from the &lt;code&gt;Mac address table&lt;/code&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my question is : Is there a way to know who is on the second end of a link from my switch/router configurations ? (When I say configuration I mean &lt;code&gt;show running config&lt;/code&gt; for Cisco etc...) &lt;/p&gt;&#xA;" OwnerUserId="36106" LastEditorUserId="36106" LastEditDate="2017-04-18T09:04:15.957" LastActivityDate="2017-04-18T09:56:56.113" Title="Draw physical link map from configuration" Tags="|network-discovery|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40528" PostTypeId="2" ParentId="40525" CreationDate="2017-04-18T09:56:56.113" Score="1" Body="&lt;p&gt;No. A interface description is just a label. The only way to find out what's REALLY plugged in is to show the MAC addresses as you noted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For networking equipment, if you turned on LLDP or CDP it would make it easier to determine what networking equipment is connected to each others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But for hosts you need to use the MAC address table&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2017-04-18T09:56:56.113" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="40530" PostTypeId="1" AcceptedAnswerId="41304" CreationDate="2017-04-18T11:22:19.090" Score="0" ViewCount="916" Body="&lt;p&gt;I have an 8-pin cable running through my wall (from basement to first floor) which was probably an old phone cable, which I terminated with RJ45 plugs on each end - resulting in a Cat5 cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tested it with a network cable tester and everything works fine. But when I plug it into my computer, I only get 100mbit/s instead of gigabit, which sucks because my internet is faster than this (I tried Powerline, but my internet connection is too fast/the distance is too far).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why is gigabit not working? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="36111" LastActivityDate="2017-06-18T17:34:39.447" Title="Cat5 Gigabit not working" Tags="|ethernet|cable|" AnswerCount="1" CommentCount="11" ClosedDate="2018-07-23T17:29:35.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="40531" PostTypeId="2" ParentId="40520" CreationDate="2017-04-18T11:23:25.613" Score="1" Body="&lt;p&gt;Unless you are using special drivers, your laptop can't understand 802.1q framing.   Set your switch port 1 to access (VLAN 200), or, leave it as a trunk, but set the native VLAN to 200.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-18T11:23:25.613" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40532" PostTypeId="1" CreationDate="2017-04-18T11:29:24.040" Score="4" ViewCount="1510" Body="&lt;p&gt;Is it possible to use multiple NICs and increase throughput and/or decrease network latency?  If so, what would be the scaling limit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="36112" LastActivityDate="2017-04-20T10:32:22.277" Title="Can I increase throughput and decrease network latency by installing multiple NICs?" Tags="|speed|throughput|" AnswerCount="2" CommentCount="2" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40534" PostTypeId="1" AcceptedAnswerId="40584" CreationDate="2017-04-18T12:35:28.287" Score="7" ViewCount="913" Body="&lt;p&gt;What is the difference between SDN (Software Defined Networking) &amp;amp; NFV (Network Function Virtualization)?  Wikipedia says NFV relies on standard client-server model. How is this model different than Data plane-Controller plane model?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please explain it with an example if possible.&lt;/p&gt;&#xA;" OwnerUserId="14440" LastEditorUserId="253" LastEditDate="2017-04-20T11:11:54.070" LastActivityDate="2018-05-15T23:40:53.237" Title="What exactly is the difference between SDN &amp; NFV?" Tags="|sdn|nfv|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40535" PostTypeId="2" ParentId="40532" CreationDate="2017-04-18T12:53:46.910" Score="2" Body="&lt;p&gt;Yes,The first part of your question is possible.You can very well do the NIC bonding of two NICs connected to a machine and increase the throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However,Network Latency cannot be improved simply by NIC bonding.Latency will be a bottleneck due to physical limitations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please also note that you may also have to configure the Link aggregation at the Router/Switch side as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Reference:&lt;a href=&quot;https://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interface.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cyberciti.biz/tips/linux-bond-or-team-multiple-network-interfaces-nic-into-single-interface.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-04-18T12:53:46.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40538" PostTypeId="2" ParentId="40521" CreationDate="2017-04-18T14:00:24.767" Score="1" Body="&lt;p&gt;When you want to telnet to a Cisco device, you must have a password configured for the VTY lines. Use something like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line vty 0 15&#xA; logging synchronous&#xA; exec-timeout 15 0&#xA; password &amp;lt;your telnet password&amp;gt;&#xA; login&#xA; transport input telnet&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-18T14:00:24.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40539" PostTypeId="1" AcceptedAnswerId="40542" CreationDate="2017-04-18T15:10:15.620" Score="1" ViewCount="176" Body="&lt;p&gt;We are going to have potentially 50~ VRFs which will each be segregated customers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We will have a VOIP LAN, and Print LAN, that all VRFs need access to. Currently I am having to create leaked routes on the switch, but this is a huge admin PITA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I use OSPF to share that route to all VRFs (given this will all be happening on the same switch?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For every VRF routing table, I have a static route:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route vrf NAME 1.1.1.0 255.255.255.0 VLAN_PRINT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then in the global routing table, a route back to every VRF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route VRF_LAN 255.255.255.0 VRF_VLAN&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can imagine, this leads to 100s of static routes on this single core switch, can I simplify this with some form of dynamic routing protocol?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switch is a &lt;code&gt;Dell N4032 (L3)&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="35883" LastActivityDate="2017-04-18T17:41:49.397" Title="Can I use a Dynamic Routing Protocol in this scenario?" Tags="|bgp|ospf|vrf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40541" PostTypeId="2" ParentId="39454" CreationDate="2017-04-18T17:14:53.010" Score="1" Body="&lt;p&gt;Unfortunately it appears to be a bug in Cisco IOS:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://quickview.cloudapps.cisco.com/quickview/bug/CSCum51028&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://quickview.cloudapps.cisco.com/quickview/bug/CSCum51028&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34916" LastActivityDate="2017-04-18T17:14:53.010" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40542" PostTypeId="2" ParentId="40539" CreationDate="2017-04-18T17:41:49.397" Score="2" Body="&lt;p&gt;I'm not familiar enough with Dell routers to know if you can have address families in OSPF. But even if you can, OSPF is a poor choice, because it's difficult to filter advertisements--each VRF will learn the routes of the other VRFs through the common VRF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP would make more sense since it allows you to control what routes you advertise.  But there are still two major drawbacks:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You would need an additional router for inter-VRF routing.  &lt;/li&gt;&#xA;&lt;li&gt;The BGP configuration won't be any easier (simpler) than static route leaking.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Maybe someone else can think of a better way, but given your requirements, route leaking makes the most sense. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-18T17:41:49.397" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40543" PostTypeId="1" AcceptedAnswerId="40546" CreationDate="2017-04-18T18:09:21.477" Score="1" ViewCount="699" Body="&lt;p&gt;I'm testing some Cisco 3650 switches with Cisco VoIP handsets and using auto qos. Is there a way to see if qos is kicking in and prioritising the voice traffic? Tried looking through the cli and can't find anything.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for reading, appreciate any advice.&lt;/p&gt;&#xA;" OwnerUserId="36125" LastEditorUserId="8499" LastEditDate="2018-12-25T04:45:10.690" LastActivityDate="2018-12-25T04:45:10.690" Title="Confirm QoS Cisco 3650" Tags="|cisco|switch|cisco-catalyst|cisco-commands|qos|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40544" PostTypeId="1" AcceptedAnswerId="40545" CreationDate="2017-04-18T18:23:09.563" Score="2" ViewCount="54" Body="&lt;p&gt;Consider the following example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;H1 --- S1 --- S2 --- S3 --- H2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hx are hosts, Sx are switches.&#xA;Both hosts are connected with access port on VLAN 20 to the corresponding switches, while all the other ports are trunks.&#xA;No VTP is enabled, meaning that only S1 and S3 has VLAN20 in their table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is how I reason the process of sending a frame from H1 to H2:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The frame is tagged with VLAN 20 upon leaving via the trunk port from S1&lt;/li&gt;&#xA;&lt;li&gt;The frame reaches S2, since it can't recognize the VLAN, it simply drops the frame, hence H2 doesn't receive the frame.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;After trying to simulate this with PacketTracer, I was surprised to see that the frame did get to H2. So my new reasoning regarding this is as follows:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The frame is tagged with VLAN 20 upon leaving via the trunk port from S1 &lt;/li&gt;&#xA;&lt;li&gt;It is untagged when entering the left trunk port on S2, but S2 remembers it's tag. Since no port matches the VLAN, and no port matches the dest MAC, S2 sends it through all possible trunks other than the original one (hence through the right one).&lt;/li&gt;&#xA;&lt;li&gt;S3's trunk port removes the tag, and since it can find the VLAN in its table, it tries and successfuly associates it with the access port which connects to H2.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So I'm really not sure what's happening here, so I'd like to have a more thorough explanation about what's really going on under the hood here. Both in the VLAN aspect, and even in how it combines with the switch's lookups over the MAC table (which one comes first for example, the MAC table lookup, or the VLAN table lookup).&lt;/p&gt;&#xA;" OwnerUserId="36126" LastActivityDate="2017-04-18T18:31:14.067" Title="Exact trunk operations over an incoming tagged frame" Tags="|switch|vlan|layer2|mac|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40545" PostTypeId="2" ParentId="40544" CreationDate="2017-04-18T18:31:14.067" Score="2" Body="&lt;p&gt;Packet Tracer is not always a faithful simulation of actual switch behavior.  In the real (Cisco) world, the switches would operate as you initially described.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-18T18:31:14.067" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40546" PostTypeId="2" ParentId="40543" CreationDate="2017-04-18T18:39:56.253" Score="0" Body="&lt;p&gt;Probably you are looking for things like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show mls qos&#xA;show mls qos interface&#xA;show mls qos interface &amp;lt;slot/port&amp;gt; stat&#xA;show mls qos interface buffers&#xA;show mls qos interface queuing&#xA;show mls qos queue-set&#xA;show policy-map interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your IOS version, you may need to use these commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show policy-map &amp;lt;policy map&amp;gt;&#xA;show qos interface &amp;lt;slot/port&amp;gt;&#xA;show interface &amp;lt;slot/port&amp;gt; counters detail&#xA;show interface &amp;lt;slot/port&amp;gt; counters all&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-04-18T19:24:16.753" LastActivityDate="2017-04-18T19:24:16.753" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40547" PostTypeId="2" ParentId="39812" CreationDate="2017-04-18T19:36:09.910" Score="0" Body="&lt;p&gt;Drops are normally caused by buffers filling up. If data comes in destined for a port faster than it can be sent out of that port then some of it is going to have to be dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general most bulk transfer protocols will increase the data rate until they start seeing packet drops then back off slightly. So it is absoloutely normal that some packets are dropped somewhere in your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where the drops happen will depend on the topology of your network. If the ASA is doing routing between local subnets then the line from the switch to the ASA is likely one of the most congested on your network, so it is where you would expect to see drops. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the ASA is only doing routing to/from the outside world then it would be more unusual to see drops on the line feeding the ASA unless your internet connection is as fast as your LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Total packets dropped is a fairly meaningless metric, what you really need to know is the proportion. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-05-06T23:32:55.627" LastActivityDate="2017-05-06T23:32:55.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40548" PostTypeId="2" ParentId="40543" CreationDate="2017-04-18T19:38:57.477" Score="1" Body="&lt;p&gt;Aside from CLI show commands, you may want to look into 3rd party software with traffic visibility.  I cannot give specific names as applications and vendor recommendations are off-topic.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there are a lot of options out there that give granular visibility of the traffic flows and break them down and track traffic tags such as IP ToS.  Look for applications with &lt;strong&gt;NetFlow&lt;/strong&gt; support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco basic NetFlow v5 will track the following information:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Ingress interface (SNMP ifIndex) &lt;/li&gt;&#xA;&lt;li&gt;Source IP address &lt;/li&gt;&#xA;&lt;li&gt;Destination IP address &lt;/li&gt;&#xA;&lt;li&gt;IP protocol Source port for UDP or TCP, 0 for other protocols&lt;/li&gt;&#xA;&lt;li&gt;Destination port for UDP or TCP, type and code for ICMP, or 0 for&#xA;other protocols &lt;/li&gt;&#xA;&lt;li&gt;IP Type of Service&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;While you may not be able to tell whether queues are explicitly being congested from the reports, you are often able to tell whether tags are being properly applied and honored.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2017-04-18T19:38:57.477" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40551" PostTypeId="2" ParentId="14905" CreationDate="2017-04-18T19:45:23.300" Score="1" Body="&lt;p&gt;Ethernet is designed around a tree toplogy. Your switches support some variant of spanning tree protocol which has disabled forwarding on one of the ports to prevent a loop. As other answes have said the orange light indicates that forwarding is disabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the switches did not support spanning tree you would have succeeded in creating a loop which would result in a broadcast storm and a broken network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do want to use both links at the same time then you will need to configure some form of link aggregation.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-04-18T19:45:23.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40552" PostTypeId="1" AcceptedAnswerId="40553" CreationDate="2017-04-18T20:21:24.820" Score="1" ViewCount="2847" Body="&lt;p&gt;I have a WAN port (firewall, 192.168.70.1/24) plugged into port 24 of a Cisco 3750G. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/24&#xA;  no switchport&#xA;  ip address 192.168.70.2 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have my default route going out this port.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.70.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I can get out to the internet from the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a computer (192.168.71.201/24 GW .1) plugged into port 1, vlan 71:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/1&#xA;  switchport access vlan 71&#xA;  switchport mode access&#xA;&#xA;interface Vlan71&#xA;  ip address 192.168.71.1 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The computer can ping the &lt;code&gt;71.1&lt;/code&gt; gateway, however can't get to the internet via &lt;code&gt;70.1&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I route this out?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Full Switch Config:&#xA;&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname pac-inet-cs1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable secret 5 xxx&#xA;enable password xxx&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;switch 1 provision ws-c3750g-24t&#xA;system mtu routing 1500&#xA;authentication mac-move permit&#xA;ip subnet-zero&#xA;ip routing&#xA;ip name-server 8.8.8.8&#xA;ip name-server 4.4.4.4&#xA;!&#xA;crypto pki trustpoint TP-self-signed-231101568&#xA; enrollment selfsigned&#xA; subject-name cn=IOS-Self-Signed-Certificate-231101568&#xA; revocation-check none&#xA; rsakeypair TP-self-signed-231101568&#xA;!&#xA;!&#xA;crypto pki certificate chain TP-self-signed-231101568&#xA; certificate self-signed 01&#xA; xxx&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree etherchannel guard misconfig&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; switchport access vlan 71&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; switchport access vlan 71&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA;!&#xA;interface GigabitEthernet1/0/5&#xA;!&#xA;interface GigabitEthernet1/0/6&#xA;!&#xA;interface GigabitEthernet1/0/7&#xA;!&#xA;interface GigabitEthernet1/0/8&#xA;!&#xA;interface GigabitEthernet1/0/9&#xA;!&#xA;interface GigabitEthernet1/0/10&#xA;!&#xA;interface GigabitEthernet1/0/11&#xA;!&#xA;interface GigabitEthernet1/0/12&#xA;!&#xA;interface GigabitEthernet1/0/13&#xA;!&#xA;interface GigabitEthernet1/0/14&#xA;!&#xA;interface GigabitEthernet1/0/15&#xA;!&#xA;interface GigabitEthernet1/0/16&#xA;!&#xA;interface GigabitEthernet1/0/17&#xA;!&#xA;interface GigabitEthernet1/0/18&#xA;!&#xA;interface GigabitEthernet1/0/19&#xA;!&#xA;interface GigabitEthernet1/0/20&#xA;!&#xA;interface GigabitEthernet1/0/21&#xA;!&#xA;interface GigabitEthernet1/0/22&#xA;!&#xA;interface GigabitEthernet1/0/23&#xA;!&#xA;interface GigabitEthernet1/0/24&#xA; no switchport&#xA; ip address 192.168.70.2 255.255.255.0&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan71&#xA; description Spectrum Public&#xA; ip address 192.168.71.1 255.255.255.0&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 192.168.70.1&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;!&#xA;ip sla enable reaction-alerts&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; password xxx&#xA; login&#xA;line vty 5 15&#xA; password xxx&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33283" LastEditorUserId="8499" LastEditDate="2018-12-27T02:26:33.627" LastActivityDate="2020-12-13T12:17:08.203" Title="Routing VLAN out to internet on a Cisco 3750G" Tags="|cisco|routing|switch|vlan|firewall|" AnswerCount="3" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="40553" PostTypeId="2" ParentId="40552" CreationDate="2017-04-18T20:28:22.873" Score="3" Body="&lt;p&gt;One likely problem is that you have not enabled routing on the switch. This is very common. You need to make sure that you enable routing from the global configuration mode:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip routing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, your firewall needs to know to send traffic destined to the &lt;code&gt;192.168.71.0/24&lt;/code&gt; network to the switch. Unless you have a static route in the firewall or you are running a common routing protocol between the firewall and the switch, the firewall has no way to know to send that traffic to the switch, so it will send the traffic to its default route (the Internet connection).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-18T20:28:22.873" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40554" PostTypeId="2" ParentId="40552" CreationDate="2017-04-18T22:12:08.083" Score="-1" Body="&lt;p&gt;traceroute to a internet address. See which route its taking. Make sure its hitting your next hop. Once you find the last hop you can start looking there.&lt;/p&gt;&#xA;" OwnerUserId="36128" LastActivityDate="2017-04-18T22:12:08.083" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40555" PostTypeId="2" ParentId="40510" CreationDate="2017-04-18T23:55:49.063" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am wondering if all the private IPv6 address non overlapping.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The closest non-deprecated thing in the IPv6 world to private IPv4 space are &quot;unique local addresses&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current reccomended scheme for assigning unique local addresses to sites is &quot;probabalisticaly unique&quot; for small groups of sites however.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Some people are sure to ignore the recommendations and pick addresses that look nice or are easy to remember. &lt;/li&gt;&#xA;&lt;li&gt;Even if people follow the RFC the chance of two sites having colliding addresses increases substantially with the number of sites under consideration. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If an ISP assigns blocks of non overlapping IPv6 to all the customers,&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Running your internal network on ISP-assigned addresses is generally a bad idea. The reasonable choices for internal traffic are unique local addresses or provider-independent addresses.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is RD required at all since all the addresses will be already unique?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not at all convinced that there won't be customers with overlapping IPv6 addresses on their internal networks. Furthermore I think even if there are no address overlaps there will still be a desire to keep traffic belonging to different customers separate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly because it's less error prone to tag everything with a customer than to maintain a massive central list of what addresses belong to what customer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly because you will get situations where two customers &lt;em&gt;do&lt;/em&gt; want to talk to each other but they want to route that traffic through a central location where it can be firewalled/monitored, not just have it hop across by the shortest path.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-04-18T23:55:49.063" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40556" PostTypeId="2" ParentId="40534" CreationDate="2017-04-19T00:15:04.620" Score="2" Body="&lt;p&gt;Disclaimer: Ok, I'm going to get into trouble as there's always a lot of discussion around SDN and NFV concepts, so please take my answer with a pinch of salt. Your views might differ and we both might be right or wrong :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I see SDN as two things, depending on who you ask:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ability to automate / orchestrate your physical network.&lt;/li&gt;&#xA;&lt;li&gt;Completely abstract the physical network and use it as a resource pool for virtual (overlay?) networking so to speak. Then apply the previous automation / orchestration point of course.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;NFV is more focused on extracting the value proposition of a networking product and virtualising it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NFV does not often have a place on #1 above, because we're just orchestrating a physical network and automating changes. We are not virtualising any function.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On #2 NFV makes more sense. I like to illustrate this with the &quot;firewall&quot; example as it is easy to visualize. On most networks you'd like to have some visibility and control over your traffic, so you strategically place a firewall appliance (or a pair in HA) and make sure the traffic has to go through it; then you deploy your favourite firewall rules and enable logging for a bunch of them, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On a virtualised network you can still deploy a VM running the same firewall software and mimic your physical network deployments, but why don't go a step further and virtualise the firewall function and not the product itself?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All your virtual networking traffic already goes through virtual switches. These virtual switches reside on all your physical hosts. &lt;a href=&quot;https://docs.openstack.org/user-guide/cli-nova-configure-access-security-for-instances.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Why don't we deploy those firewall rules directly on the virtual switch?&lt;/a&gt; This way you are virtualising the firewall function and distributing the cost of controlling traffic among your infrastructure, thus having a more predictable cost of scaling (i.e. your firewall capabilities increase with your computing capabilities).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it's not about the management model of each, it is about the purpose of each of them. There's overlapping between the both and SDN is definitely an enabled for NFV.&lt;/p&gt;&#xA;" OwnerUserId="444" LastActivityDate="2017-04-19T00:15:04.620" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40557" PostTypeId="2" ParentId="40499" CreationDate="2017-04-19T00:38:34.710" Score="0" Body="&lt;p&gt;I spotted one typos on the configuration.&#xA;&lt;br&gt;&#xA;&lt;code&gt;ip route 172.17.17.64 255.255.255.252 72.17.17.66 permanent&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is this correct IP ? &lt;code&gt;172.17.17.66&lt;/code&gt;&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;permanent&lt;/code&gt; is not recommended value. It cannot detect gateway is down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.3.254&lt;/code&gt;&lt;br&gt;&#xA;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 192.168.3.1&lt;/code&gt;&lt;br&gt;&#xA;Multiple ip route destination is is configured.&#xA;Is not the value of administrative distance necessary?&lt;/p&gt;&#xA;" OwnerUserId="32460" LastActivityDate="2017-04-19T00:38:34.710" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40558" PostTypeId="2" ParentId="40499" CreationDate="2017-04-19T01:08:30.263" Score="1" Body="&lt;p&gt;You have a problem with this command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 192.198.3.64 255.255.255.252 GigabitEthernet0/3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That interface has no IP configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/3&#xA; mtu 1500&#xA; no ip address&#xA; negotiation auto&#xA; cdp enable&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;FastEthernet0/0&lt;/code&gt; interface already has the IP addressing for the &lt;code&gt;192.198.3.0/24&lt;/code&gt; network that encompasses the &lt;code&gt;192.198.3.64/30&lt;/code&gt; network you are trying to use on the &lt;code&gt;GigabitEthernet0/3&lt;/code&gt; interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That will not work. You cannot have the same or overlapping networks on two different layer-3 interfaces. If you want &lt;code&gt;GigabitEthernet0/3&lt;/code&gt; to be a switch interface, then you need to set it up that way with a VLAN, and define an SVI for that VLAN (it defaults to VLAN 1 that you have shut down), but you cannot assign addressing to the SVI that overlaps the network on &lt;code&gt;FastEthernet0/0&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It looks like you are trying to confuse layer-2 and layer-3.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-19T01:08:30.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40561" PostTypeId="1" AcceptedAnswerId="40567" CreationDate="2017-04-19T05:49:27.487" Score="1" ViewCount="1071" Body="&lt;p&gt;I understand the below points,please confirm if my understanding is correct.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;MTU &gt; MSS&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;E.g if my MSS is 1460 bytes, then MTU should be &lt;em&gt;at least&lt;/em&gt; 1500 bytes(20 bytes for IP header and 20 bytes for TCP header).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also understand that since the upper layer (MSS) will be finally encapsulated inside lower layer(Ethernet MTU), therefore MTU has to be greater than MSS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.I undertstand that CLNS is equivalent to Networking Layer of OSI model that ISO came up with.&#xA;where does clns mtu operate--at which layer(i know it is not any of the osi layer as ISIS was developed before OSI layer)--so what would be the relation of &lt;em&gt;clns mtu&lt;/em&gt; and &lt;em&gt;mtu&lt;/em&gt; ? Should it be greater than/less than Ethernet mtu ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3.In some config snippets, where isis is running, i see the below config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;clns mtu 1500&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Why do we need the above command ?What if i remove the above command ?&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;is the following config valid(just want to test/understand in my lab)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mtu 1400&lt;/p&gt;&#xA;&#xA;&lt;p&gt;clns mtu 1500&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Here, i have made mtu smaller than clns mtu. This will fail ?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2017-04-19T05:54:33.067" LastActivityDate="2020-12-17T21:55:53.457" Title="Regarding clns mtu" Tags="|cisco-ios|osi|mtu|is-is|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40563" PostTypeId="1" AcceptedAnswerId="40564" CreationDate="2017-04-19T06:56:11.850" Score="1" ViewCount="85" Body="&lt;p&gt;I would like to change chassis description. Command show chassis hardware display the list of all hardware (also chassis) with interesting parameters (also description). It's possible to change eg. Chassis description? Below example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@host&amp;gt; show chassis hardware&#xA;Hardware inventory:&#xA;Item             Version  Part number  Serial number     Description&#xA;Chassis                                E1372             MX10-T&#xA;Midplane         REV 01   711-038211   YF5285            MX10-T&#xA;PEM 0            Rev 04   740-028288   VB01678           AC Power Entry Module&#xA;Routing Engine            BUILTIN      BUILTIN           Routing Engine&#xA;TFEB 0                    BUILTIN      BUILTIN           Forwarding Engine Processor&#xA;  QXM 0          REV 05   711-028408   ZA9053            MPC QXM&#xA;FPC 0                     BUILTIN      BUILTIN           MPC BUILTIN&#xA;  MIC 0                   BUILTIN      BUILTIN           4x 10GE XFP&#xA;    PIC 0                 BUILTIN      BUILTIN           4x 10GE XFP&#xA;FPC 1                     BUILTIN      BUILTIN           MPC BUILTIN&#xA;  MIC 0          REV 24   750-028392   YX9436            3D 20x 1GE(LAN) SFP&#xA;    PIC 0                 BUILTIN      BUILTIN           10x 1GE(LAN) SFP&#xA;      Xcvr 0     REV 01   740-031851   AM1107SUFQW       SFP-SX&#xA;    PIC 1                 BUILTIN      BUILTIN           10x 1GE(LAN) SFP&#xA;Fan Tray       &#xA;&#xA;                                      Fan Tray&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I cannot find an answer in Juniper decumentation and technical forums. I have only simulator of Juniper on GNS3 environment, which don't contain real hardware. Thus I cannot check in on real device. I suspect that this parameter is not editable.&lt;/p&gt;&#xA;" OwnerUserId="36132" LastEditorUserId="509" LastEditDate="2017-04-19T07:01:11.020" LastActivityDate="2017-04-19T07:07:21.730" Title="How to change chassis description?" Tags="|juniper|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40564" PostTypeId="2" ParentId="40563" CreationDate="2017-04-19T07:07:21.730" Score="2" Body="&lt;p&gt;This is not a description you can configure in JUNOS, it's a description which type of hardware it is. So you're using a GNS3 image (if that's the correct term, I'm not familiar with GNS3) which emulates a MX10-T.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-04-19T07:07:21.730" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40567" PostTypeId="2" ParentId="40561" CreationDate="2017-04-19T10:48:47.363" Score="3" Body="&lt;p&gt;That will fail. MTU is setting the L2 MTU while IP MTU is setting the L3 MTU.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The CLNS MTU determines both the maximum size of LSP plus the hello size when padding. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you tried to send a 2000 byte LSP over a 1500 MTU L2 link, it will get dropped&lt;/p&gt;&#xA;" OwnerUserId="1055" LastActivityDate="2017-04-19T10:48:47.363" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40568" PostTypeId="2" ParentId="1962" CreationDate="2017-04-19T11:50:31.133" Score="-1" Body="&lt;p&gt;offset-list actually alters the delay property for a given prefix matching the ACL.  Lab it. you'll see.&lt;/p&gt;&#xA;" OwnerUserId="36137" LastActivityDate="2017-04-19T11:50:31.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40573" PostTypeId="1" AcceptedAnswerId="40574" CreationDate="2017-04-19T17:09:20.823" Score="1" ViewCount="469" Body="&lt;p&gt;We have recently signed up for Metro Ethernet for our main campus and 8 branches. It's a &quot;mesh&quot; with the carrier providing a virtual layer-2 switch in the cloud. I have a Cisco router at each site running EIGRP and they all have neighbor relationships with one another on their &quot;WAN-facing&quot; interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The carrier has provided a second circuit into the main campus, which comes into a different building via a completely diverse path. That's good because there's a lot of construction going on at the main campus. I'm trying to think of the best way to provide failover. Load balancing isn't necessary since each branch has 100 Mbps and the main campus has 1 Gbps, so even without load balancing, there's no way that the 1 Gbps could be saturated. That connection is currently terminating in an ASR1001-X at the main campus.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each campus also has a backup Internet connection running between 7 and 60 Mbps terminating via DMVPN into an ISR-4431. I mention that because I'm fine if terminating the second Ethernet WAN connection is done in the same ASR1001-X as the “primary” line if that makes it easier.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some possibilities...&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Both connections into the ASR&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Have a normal interface and a &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/access/1900/software/configuration/guide/Software_Configuration/backup.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;backup interface&lt;/a&gt;. However, since the WAN connections terminate into a CPE, the link light probably wouldn't go off even if the back-end connection is experiencing trouble. I saw an &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srethcfm.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;article on Ethernet CFM&lt;/a&gt; but haven't really looked into it yet.&lt;/li&gt;&#xA;&lt;li&gt;See if the carrier supports VLAN-trunk interfaces. That way I could have two virtual connections at each branch and let EIGRP manage what's up and down based on keepalives/neighbor relationships. This would also provide load balancing (which I don't really need). I'd rather not screw around with dot1q sub-interfaces or worry about tagging to the carrier, but if need be...&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Terminate the second connection into a different router (e.g., the aforementioned 4431) and adjust stuff like bandwidth and delay so EIGRP doesn't mark it as equal-cost.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Anybody had this scenario and found an ideal solution?&lt;/p&gt;&#xA;" OwnerUserId="34860" LastEditorUserId="8499" LastEditDate="2019-01-05T01:25:38.313" LastActivityDate="2019-01-05T01:25:38.313" Title="Handling multiple redundant Metro Ethernet circuits in one location" Tags="|routing|cisco-ios|eigrp|failover|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40574" PostTypeId="2" ParentId="40573" CreationDate="2017-04-19T17:30:32.707" Score="1" Body="&lt;p&gt;I don't see why you can't have two interfaces and just let the routing protocol decide which link works, and which doesn't. You could manipulate the delay on one if you want an active/standby setup, but that doesn't require two routers, or you could do it with two routers. That is the real point of dynamic routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it takes too long to fail over for some things, so you could run BFD.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-19T17:30:32.707" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="40583" PostTypeId="1" CreationDate="2017-04-20T07:53:43.213" Score="1" ViewCount="46" Body="&lt;p&gt;Can someone explain the relationship between ONIE and some installed Networking OS, like DNOS9/FTOS in a simple way?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, when I was reading about upgrading ONIE, I saw that when upgrading they need you to have a minimum previous version of ONIE (obviously), and it also seems linked to BIOS and CPLD.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, when looking requirements for upgrading the Networking OS, in this case DNOS, they have a requirement on the minimum ONIE version (so far, so good), however: The DNOS image seems to contain images for 1) boot-flash 2) boot-selector 3) CPLD. Now both ONIE and DNOS are somehow linked to the CPLD for example.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So my questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) In case I would like to upgrade all parts of the system to the most recent releases, what would be the correct order to upgrade in order to fulfill all dependencies at all times?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) What is in fact the actual order of the parts of the system booting? BIOS -&gt; Boot-Selector (Grub) -&gt; Boot-Flash (???) -&gt; ONIE -&gt; NOS? (What exactly is the Boot-Flash etc. anyway?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is especially strange as for example DNOS seems to be installed just like ONIE (you can select it in the boot loader). So if only one can be selected, where is the part where they depend on one another?&lt;/p&gt;&#xA;" OwnerUserId="2329" LastEditorUserId="8499" LastEditDate="2017-04-20T13:43:36.173" LastActivityDate="2017-04-20T13:43:36.173" Title="Relationship between ONIE and Networking OS" Tags="|untagged|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40584" PostTypeId="2" ParentId="40534" CreationDate="2017-04-20T08:19:18.187" Score="6" Body="&lt;p&gt;I disagree with the answer provided @Pedro Perez, I think his answer is mixing phrases and ambiguous so I have provided my own interpretation below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SDN:&lt;/strong&gt;&#xA;I think it is pretty much what the name says “Software Defined Networking”. This means to me that software is defining the paths that packets take across the network automatically (possibly with some upper bound / lower bound constraints provided by a human operator). It can also readjust paths automatically that are within those predefined constraints. I would consider a deployment that uses an off-box (centralised) control plane such as the OpenDaylight SDN controller with protocols such as Open Flow, BGP-LS or PCEP to be an SDN deployment. The SDN controller is talking to network devices and steering traffic based on live data it receives from the network devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NFV:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Again pretty much what the acronym suggests “Network Function Virtualisation”. This to me is about virtualising network functions – not how devices forward packets and make decisions (which is covered by SDN) but at the device level how one can virtualise and containerise network functions so that they may be rapidly deployed, re-replayed, migrated, decommissioned etc. To clarify a network function here would be say NAT, CG-NAT, ACLs, QoS, tunnelling, DNS or web filtering, load-balancing etc. I would consider a deployment that uses standard computing hardware (such as x86 servers for example) to run virtual machines or containers that are routers, switches, firewalls load balancers etc. to be an NFV deployment. With NFV one can chain multiple virtual functions together to form a service chain.  For example running multiples virtual machines on a single x86 box that forms a pipeline and a packet must pass through the entire VM pipeline; the first VM could be a virtual switch and faces an office LAN, if the packet is destine to the Internet it could hand over to a virtual firewall, if the packet passes the firewall rules it can hand over to a virtual router, which can then send the packet out of a physical WAN link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NSO/LSO:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;“Network Service Orchestration” or “Lifecycle Service Orchestration” have an overlapping definition in my opinion regarding the (usually) automated process of applying changes to network devices, configuration and infrastructure and managing the infrastructure such as deployment, upgrades, decommissioning etc. I am bringing this up because a NFV based network can be completely deployed by hand; you might be using KVM on Linux and you SSH in to each KVM machine and start up virtual router images from the likes of Juniper and Cisco by hand, on the CLI using &lt;code&gt;virsh&lt;/code&gt; for example. It could also be VMware using ESXi and again you use the web console to do everything (these are just common examples). You are still virtualising network functions and potentially chaining them together if required, just slowly and potentially erroneously by hand. With SDN one could be using BGP-LS with an off box controller to automatically steer traffic flows around the network which could be built using physical routers (the traditional infrastructure build method), but the controller could also be controlling traffic flows on virtual routers (an NFV based infrastructure), SDN is agnostic of whether the devices are physical or virtual or just two bean cans and some string and an API layer above them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NSO/LSO approaches to network operations have existing for years, but not with the formal guidance that they have now (such as through the MEF LSO (Metro Ethernet Forum) standards). In its most basic form, engineers have been writing scripts that telnet or SSH to a device and apply commands via the CLI. If one expands that basic example a bit further to have scripts that automatically apply bits of config to devices vi the CLI, TFTP boot new firmware versions on devices, generate config files from templates, which is all stuff people have been doing for years, then we have an informal NSO/LSO platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope that has made it clear that NSO/LSO is different from NFV and SDN, they are three concepts that can all exist without the other two or be used in any combination with the other two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Side note about network overlays, virtual networking and network virtualisation:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;@Pedro Perez mentioned: Completely abstract the physical network and&#xA;  use it as a resource pool for virtual (overlay?) networking so to&#xA;  speak.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Virtual networking and network virtualisation are two different things in my opinion. Firstly to take a step back, there are some protocols that provide what I would call a network overlay such as VXLAN, NVGRE and STT (which in turn use transport protocols like MPLS, or IP in IP etc.). Those overlay protocols alone though don’t provide a virtualised network, they transport traffic across the network, but we also need support for network functions or services within the overlay network (such as NAT, QoS, ACLs, maybe traffic steering like TE etc.), also some amount of administration and management is required, reporting and quality control and so on. Once we have all of that then I would say we have a virtual network offering (“virtual networking”).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We consider virtual servers to be servers that run on top of physical servers (let’s forget about nested virtualisation/nested hypervisors for the moment!).  Above I defined what I consider a virtual network which runs over a “real” network which would have traditionally been physical tin. One example could be that as an ISP one can deliver a virtual network to a customer in the form of MPLS L3 VPNs (L3 IP VPNs using VRFs/RTs/RDs as the overlay model, MPLS for the transport protocol, MP-BGPv4 for the control plane and MPLS OAM for some operational management). This would run over a physical network that supports MPLS as a transport protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the definition of network virtualisation, I would refer back to the NFV section above. So to go full circle; in this ISP example, if our customer offing is a virtual networking and if we run our backbone network as an NFV based deployment, then I would say we are offering virtual networking over our network virtualisation deployment. Clear as mud.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2017-04-20T08:19:18.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40585" PostTypeId="5" CreationDate="2017-04-20T08:29:40.160" Score="0" Body="&lt;p&gt;Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically. There are separate tags for &lt;a href=&quot;/questions/tagged/firewall&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;firewall&amp;#39;&quot; rel=&quot;tag&quot;&gt;firewall&lt;/a&gt;s and &lt;a href=&quot;/questions/tagged/vpn&quot; class=&quot;post-tag&quot; title=&quot;show questions tagged &amp;#39;vpn&amp;#39;&quot; rel=&quot;tag&quot;&gt;vpn&lt;/a&gt;s in general.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="31801" LastEditDate="2018-08-14T13:05:15.260" LastActivityDate="2018-08-14T13:05:15.260" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40586" PostTypeId="4" CreationDate="2017-04-20T08:29:40.160" Score="0" Body="Questions relating to IPSEC VPN configuration, operation and troubleshooting specifically." OwnerUserId="253" LastEditorUserId="253" LastEditDate="2017-04-20T13:29:21.847" LastActivityDate="2017-04-20T13:29:21.847" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40587" PostTypeId="2" ParentId="40532" CreationDate="2017-04-20T10:32:22.277" Score="4" Body="&lt;p&gt;This is an interesting but complicated topic and like most things engineering the answer is: It depends! In this case the lack of detail adds ambiguity (I'm not allowed to comment asking for clarification just yet).&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Scenario 1:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Lets start with a common scenario that applies to your question. You have a file server and 4 users in an office, all connected via Gigabit Ethernet to the same switch.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/itfJB.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/itfJB.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;The server only has 1Gbit of total bandwidth to share between all the users, so if 2 users download files at the same time they would get ~500Mbit each. This case justifies adding another NIC to increase the server total bandwidth.&lt;/p&gt;&#xA;&lt;p&gt;Assuming the users are not saturating the new 2Gbit link, latency to the server will also improve. This is because packets will not have to be queued at either side of the link connecting the switch and server waiting their turn.&lt;/p&gt;&#xA;&lt;p&gt;You can scale this solution until the client to server bandwidth ratio is 1:1.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;Scenario 2:&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;Another common scenario that applies to your question. You have a file server located in New York and a bunch of users in Los Angeles. Everyone is still connected by 1Gbit links.&lt;/p&gt;&#xA;&lt;p&gt;In this case distance starts playing a role for overall throughput. In the office scenario the latency from server to client was &amp;lt;1ms when the link was not saturated. However getting from NY to LA takes longer, lets say the round trip time is 100ms.&lt;/p&gt;&#xA;&lt;p&gt;In this scenario 2 users would not be able to max out the 1Gbit link on a standard file transfer. This is because link capacity is no longer the limiting factor, rather &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1323&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP window scaling&lt;/a&gt; starts to play a significant role.&#xA;How significant? A rough estimate (throughput = window size / round trip time) shows that a each user download will max out around ~5-6Mbit/s.&lt;/p&gt;&#xA;&lt;p&gt;Generally, adding NICs can significantly improve throughput and by extension latency, but it 100% depends on what underlying problem you are dealing with.&lt;/p&gt;&#xA;" OwnerUserId="25825" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-04-20T10:32:22.277" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40588" PostTypeId="1" CreationDate="2017-04-20T11:23:40.437" Score="1" ViewCount="763" Body="&lt;p&gt;I have active/passive servers cluster talking with another cluster located behind a Router, for some bug in the operating system in the first cluster  it did not send GARP message after switch-over and the communication with the second cluster will be broken till either the ARP cache timed out on the router or someone clear the ARP cache table on the router manually.&#xA;to resolve this I have two options, Either reduce the cache timeout on the router or implement script and add it to the switch-over procedure to be called automatically during switch-over, but the first option look easier to implement and more safe.&#xA;I have concern that reducing the cache timeout on the router would cause high broadcast on the network,is it safe to reduce the Cache time out? &lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-04-20T12:53:57.813" Title="Reduce ARP cache time-out?" Tags="|routing|arp|redundancy|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40590" PostTypeId="2" ParentId="40588" CreationDate="2017-04-20T12:53:57.813" Score="4" Body="&lt;p&gt;I have personally done that ARP timeout set to 60 sec for a single VLAN caused 0.05% ARP usage on cisco 29XX series. It is running like that for over a month. No problems at all. Still I'd not recommend using the network for solving clustering problems. &lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-04-20T12:53:57.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40592" PostTypeId="1" CreationDate="2017-04-20T13:47:19.220" Score="1" ViewCount="1064" Body="&lt;p&gt;I have a mixed switch stack : - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch Ports Model              SW Version            SW Image                 &#xA;------ ----- -----              ----------            ----------               &#xA;*    1 52    WS-C3750G-48PS     12.2(55)SE            C3750-IPBASEK9-M         &#xA;     2 54    WS-C3750X-48P      12.2(55)SE            C3750E-UNIVERSALK9-M     &#xA;     5 54    WS-C3750X-48P      12.2(55)SE            C3750E-UNIVERSALK9-M     &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I am required to upgrade the stack to SE10 versions of the IOS code.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steps that I will be taking:- &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Copy SE10 version of IPBASE on switch 1&lt;/li&gt;&#xA;&lt;li&gt;Copy SE10 version of UNIVERSAL9 on switch2,5.&lt;/li&gt;&#xA;&lt;li&gt;Change boot statements to the respective IOS files.&lt;/li&gt;&#xA;&lt;li&gt;Reload the stack.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Questions/Concerns:- &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is this the best method to go for this task?&lt;/li&gt;&#xA;&lt;li&gt;Will this cause mismatch between the switch and cause the stack to&#xA;break?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="36123" LastEditorUserId="8499" LastEditDate="2017-06-03T03:34:43.587" LastActivityDate="2017-06-03T03:34:43.587" Title="Mixed stack IOS upgrade - Cisco 3750x,3750G" Tags="|switch|cisco-ios|cisco-3750|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40597" PostTypeId="1" AcceptedAnswerId="40600" CreationDate="2017-04-20T19:47:02.890" Score="3" ViewCount="13260" Body="&lt;p&gt;I am using Cisco Packet Tracer to simulate a network of two routers each connected to a switch and two hosts per switch. The network is setup as so:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/o4JE8.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/o4JE8.jpg&quot; alt=&quot;Current configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm using a default subnet mask of &lt;code&gt;255.255.255.0&lt;/code&gt;. Between router to router, they can ping each other successfully. Between computers on the same switch, they can ping each other successfully. However, when I try to ping PC7 to PC1 for instance, or vice versa, the requests time out. The IP Address of the Seattle Router is &lt;code&gt;23.12.0.1/24&lt;/code&gt; and Van Nuys is &lt;code&gt;23.12.0.2/24&lt;/code&gt;. I think it might have something to do with the &lt;code&gt;ip route&lt;/code&gt; command, but I feel like I've tried everything and still won't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?&lt;/p&gt;&#xA;" OwnerUserId="36174" LastEditorUserId="8499" LastEditDate="2018-12-25T04:48:53.303" LastActivityDate="2018-12-25T04:48:53.303" Title="Computer unable to ping another over two routers" Tags="|cisco|routing|subnet|ping|packet-tracer|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40600" PostTypeId="2" ParentId="40597" CreationDate="2017-04-20T20:26:16.553" Score="1" Body="&lt;p&gt;Based on you comments, it seems that you first problem is that you don't know how to subnet, and you need to divide your &lt;code&gt;23.12.0.0/24&lt;/code&gt; network into four subnets. You can do this by using &lt;code&gt;/26&lt;/code&gt; networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assign a different &lt;code&gt;/26&lt;/code&gt; network to each of the sites, and you will need a network different than the site-assigned networks for you router-to-router link. Usually, you will use a &lt;code&gt;/30&lt;/code&gt; or &lt;code&gt;/31&lt;/code&gt; network for a point-to-point link like you have between the routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have the networks correctly assigned, you can set up your routing. Each router will inherently know about the networks directly connected to it, but the router will need to be told about the networks on the other side of the other router. You can do this with static routes (this doesn't scale well), or you can run a common routing protocol between the routers that will automatically tell each router about the networks connected to to the other router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-20T20:26:16.553" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40601" PostTypeId="1" CreationDate="2017-04-20T22:11:11.747" Score="5" ViewCount="1191" Body="&lt;p&gt;I'm trying to configure a remote acccess vpn into a cisco ASA 5510 (9.1(7)15).  I want to be able to use IKEv2 with Certificate + user/password xauth with strongswan as the client under Ubuntu.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have this working for an IKEv1 tunnel after much frustration, but I cannot get an IKEv2 configuration to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ipsec.conf:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 2&#xA;config setup&#xA;        strictcrlpolicy=no&#xA;        charondebug=&quot;ike 4, knl 2, cfg 2&quot;&#xA;&#xA;conn %default&#xA;        ikelifetime=1440m&#xA;        keylife=60m&#xA;        rekeymargin=3m&#xA;        keyingtries=1&#xA;        ike=aes256-sha1-modp1536     #Phase1 parameters&#xA;        esp=aes256-sha1              #Phase2 parameters&#xA;        xauth=client              #Xauth client mode&#xA;        xauth_identity=chris      #identity for Xauth&#xA;        auto=add&#xA;&#xA;conn &quot;cert2&quot;&#xA;        keyexchange=ikev2&#xA;        authby=xauthrsasig&#xA;        aggressive=no&#xA;        leftsourceip=%config&#xA;        leftauth2=xauth&#xA;        leftcert=chris2.cer&#xA;        right = vpn.my.company.com&#xA;        rightid=%any&#xA;        rightsubnet=0.0.0.0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;From the logs on the ASA it looks like it wants to treate the IKE2 connection as a L2L tunnel.   It wants to match the DefaultL2LGroup and if I remove the %config from leftsourceip, the tunnel will come up, but shows to be a L2L tunnel and doesn't work since I dont get a DHCP address.  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-2: attempting to find tunnel group for IP: 72.48.127.151&#xA;2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-2: ignoring tunnel-group-map default group, not L2L&#xA;2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-2: mapped to DefaultL2LGroup&#xA;2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-2: tg_name set to: DefaultL2LGroup&#xA;2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-2: tunn grp type set to: L2L&#xA;&#xA;2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-1: (82): Process request attribute: Unable to get webvpn session&#xA;2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-1: Error processing config mode request attibute: 1&#xA;2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PLAT-1: Failed to build config mode reply&#xA;2017-04-20T16:52:59-05:00 5510a : %ASA-7-711001: IKEv2-PROTO-2: (82): Error in retrieving config mode data to send&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I feel like there's something very obvious that I must not understand about strongswan and/or the ASA ikev2 config.&lt;/p&gt;&#xA;" OwnerUserId="36176" LastActivityDate="2018-07-17T11:29:10.327" Title="Is IKEv2 remote access VPN possible to an ASA 5510 without Cisco AnyConnect as the client?" Tags="|vpn|cisco-asa|linux|ike|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40603" PostTypeId="2" ParentId="36450" CreationDate="2017-04-21T05:02:32.487" Score="14" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;As I understand Wifi, it can never true multicast, as each device&#xA;  holds a '1:1&quot; relationship with the AP, and then receives the same&#xA;  packet... then the next device connects and gets the same packet.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Your understanding is flawed. Multicast does exist, but like most management traffic on a wireless network it must run at the lowest supported base/basic/required data rate. By default this is typically the lowest data rate supported by the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason why is that anything that is broadcast or multicast from the AP to surrounding clients must be sent at a speed that all clients must support and can receive reliably.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you are referring to is a technique that many access points can employ, which is a multicast-to-unicast conversion. Because the radio medium is a shared medium, a multicast frame sent at the lowest data rate can take 300X or more &quot;airtime&quot; than a unicast frame sent at the highest data rate.  This is often far more efficient than sending multicast as multicast traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example situation on a default configuration AP (802.11n or newer), it could take less time to deliver 10 unicast frames to each of 10 devices (i.e. 100 frames total) at the highest possible speed than it would to deliver even one multicast frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two other considerations for multicast on 802.11 that are often reasons to use multicast-to-unicast conversion are that multicast frames are never acknowledged whereas unicast frames are acknowledged and retransmitted by the AP if there is no ack (not to be confused with TCP acks, this is a L2 mechanism and part of the process for finding optimal data rates between AP and client).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, if any client device in the BSS is using power save mode, multicast frames are only sent periodically (based on configured DTIM and beacon intervals) to ensure that multicast frames are again received by all clients. With multicast-to-unicast conversion, frames go to clients immediately if they aren't using power save mode and only delayed to clients that are in power save mode.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;there are multiple types of router/APs - &quot;3x3&quot; and &quot;4x4&quot;, some with&#xA;  MIMO, etc. what should I use as criterion for choice of AP?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;First, you would want an access point that meets or exceeds the capabilities of your client device. By this, I mean that if your clients are 802.11n 2x2 capable devices, then you want at least an 802.11n 2x2 AP. 802.11ac will give you some advantages even with all 802.11n clients and more spatial streams never hurts as the extra streams are in other ways utilized.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second, you would want an access point where you would have configuration options to disable/enable multicast-to-unicast conversion, select specific supported/required data rates for the ESS, and preferrably to be able to configure the DTIM and beacon intervals.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;can I TRULY multicast over wifi to iOS devices? Is my theory correct? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Respectively, yes and no. You can do it, however unless you really know what you are doing, or just to keep things simple, you may get a more &quot;real time&quot; experience utilizing a mulicast-to-unicast feature. Failure to get the below correct for your situation can actually reduce the experience on the client devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For good performance you would need to adjust the required data rate upward as far as possible while maintaining a reliable signal based on your environment and distance of the client devices from the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since iOS devices do certainly use power save mode, you may then want to further tweak the DTIM and beacon intervals to reduce the delay introduced by power save mode. Keep in mind that these settings can also decrease the efficiency of your airtime utilization (i.e. lowering beacon intervals means more beacons, etc) creating more problems than it resolves.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;is there a way to multicast instead of treating each packet/client as a unicast?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As I already covered, yes. As long as your AP either doesn't have a multicast-to-unicast feature in the first place or has an option to let you disable it.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2017-04-21T05:07:44.207" LastActivityDate="2017-04-21T05:07:44.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40604" PostTypeId="1" CreationDate="2017-04-21T09:09:10.013" Score="1" ViewCount="85" Body="&lt;p&gt;I have many dampened routes for now. What could possibly happen if I will disable BGP dampening that is previously enabled? &lt;/p&gt;&#xA;" OwnerUserId="33530" LastEditorUserId="8499" LastEditDate="2019-01-05T00:11:17.020" LastActivityDate="2019-01-05T00:11:17.020" Title="Disabling BGP dampening that is enabled for a long time" Tags="|cisco|routing|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40607" PostTypeId="2" ParentId="39824" CreationDate="2017-04-21T12:28:34.583" Score="3" Body="&lt;p&gt;Normally the router will periodically send a membership query to destination 224.0.0.1 (all hosts multicast group address). Hosts that receive this message will respond with a IGMP membership report to tell the router that they are still interested in receiving the multicast traffic. When the router receives the membership report, it’s expiry timer will be refreshed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Expiration can happen due to 2 reasons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;When no hosts respond, the router knows that nobody is interested anymore in the multicast traffic and it will then remove the entry once the timer exceeds. &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Leave group messages: when a host no longer wants to listen to a multicast group address then it will report to the router that it has stopped listening.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Most probably you have an application issue on the server listening to the traffic and it is not sending IGMP messages correctly. You can solve the problem by adding ip igmp static group to the outgoing interface.&lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-04-21T12:28:34.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40609" PostTypeId="2" ParentId="40604" CreationDate="2017-04-21T14:08:17.253" Score="1" Body="&lt;p&gt;Prefixes get dampened because they are not stable; they are added and withdrawn multiple times. This is a sign of network instability. Having prefixes constantly added and withdrawn places a large burden on your routers, and it can cause lost traffic, broken TCP connections, etc. BGP dampening is protecting your network from the worst of this instability. What you need to do is determine the root cause of the network instability, and correct it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It used to be (and still is with some companies) that if you have a lot of network instability, other ASes would basically cut you off and refuse to peer with you, or you would cut off and refuse to peer with other ASes exhibiting such instability, until such a time as the unstable AS proves it has corrected its problems.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-04-21T14:27:53.383" LastActivityDate="2017-04-21T14:27:53.383" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40617" PostTypeId="1" AcceptedAnswerId="40619" CreationDate="2017-04-21T18:58:08.797" Score="1" ViewCount="727" Body="&lt;p&gt;I am setting up a &lt;code&gt;/21&lt;/code&gt; VLAN on a Cisco Layer 3 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like the network to be DHCP and range from &lt;code&gt;192.168.38.0 - 192.168.46.254&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I assign as such:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Vlan38&#xA; ip address 192.168.38.1 255.255.248.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get an error on an overlap with a &lt;code&gt;192.168.32.0/24&lt;/code&gt; VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the correct IP to set as the Gateway if not the bottom one?&lt;/p&gt;&#xA;" OwnerUserId="33283" LastActivityDate="2017-04-21T19:11:27.127" Title="What do I assign as the Gateway on a /21 network?" Tags="|vlan|subnet|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="40619" PostTypeId="2" ParentId="40617" CreationDate="2017-04-21T19:11:27.127" Score="4" Body="&lt;p&gt;the range 192.168.38.0 - 192.168.46.254 is not a /21 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The closest /21 networks are &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;192.168.32.0/21&lt;/code&gt;  (192.168.32.0 - 192.168.39.255)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;192.168.40.0/21&lt;/code&gt;  (192.168.40.0 - 192.168.47.255)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Obviously you have the &lt;code&gt;192.168.32.0/24&lt;/code&gt; network configured on a vlan interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you set &lt;code&gt;ip address 192.168.38.1 255.255.248.0&lt;/code&gt;on another interface you get an error because you are actually adding the &lt;code&gt;192.168.32.0/21&lt;/code&gt;network and this conflict with &lt;code&gt;192.168.32.0/24&lt;/code&gt; which is a subnet of &lt;code&gt;192.168.32.0/21&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot chose an arbitrary range of IP address and declare that this range is a network. When you work with the IP address in binary form you can see why.&#xA;See this answer: &lt;a href=&quot;https://networkengineering.stackexchange.com/a/7117/16930&quot;&gt;How do you calculate the prefix, network, subnet, and host numbers?&lt;/a&gt; for more details&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-04-21T19:11:27.127" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40622" PostTypeId="1" AcceptedAnswerId="40624" CreationDate="2017-04-22T04:56:29.210" Score="0" ViewCount="1324" Body="&lt;p&gt;I'm studying the pcapng file format, and I know that when wireshark reads a pcapng file, it tells you all sorts of information.  I've been reading the &lt;a href=&quot;https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;pcap-ng format&lt;/a&gt; and I don't see anywhere in pcapng files where any IP address is actually listed. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm nowhere near fully understanding the file format yet, but I do understand from the documentation that it has 6 blocks. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Section Header&lt;/li&gt;&#xA;&lt;li&gt;Interface Description&lt;/li&gt;&#xA;&lt;li&gt;Enhanced Packet&lt;/li&gt;&#xA;&lt;li&gt;Simple Packet&lt;/li&gt;&#xA;&lt;li&gt;Name Resolution&lt;/li&gt;&#xA;&lt;li&gt;Interface Statistics&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What piece of this puzzle am I not understanding?&lt;/p&gt;&#xA;" OwnerUserId="35593" LastActivityDate="2017-04-22T06:34:48.567" Title="Where in PCAP-NG does the Source/Destination IP address information reside?" Tags="|tcp|wireshark|udp|tcpdump|pcap|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40624" PostTypeId="2" ParentId="40622" CreationDate="2017-04-22T06:34:48.567" Score="2" Body="&lt;p&gt;The pcap-ng format just describes the container format which encapsulates the captured packets. It does not describe the content of the captured packet. Thus if you have captured an IP packet you need to refer to the specification of IP to get the source and destination IP address. And if the captured data also include the ethernet frame you have to remove this first before you get to the IP part. If you want to get to the TCP ports you have to understand the TCP header format in order to find where the port numbers are in the TCP header inside the IP packet etc. None of this is part of pcap or pcap-ng.&lt;/p&gt;&#xA;" OwnerUserId="4063" LastActivityDate="2017-04-22T06:34:48.567" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40628" PostTypeId="1" CreationDate="2017-04-22T14:51:05.677" Score="2" ViewCount="119" Body="&lt;p&gt;I cannot get a successful connection between the three PCs. These are the commands im using on the relevant routers. What am I doing wrong / missing here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that the show ip route command is &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP route &lt;em&gt;network address, subnet-mask, (ip address (next hop) | exit interface)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2 :&#xA;&lt;br&gt; ip route 172.16.3.0 255.255.255.0 s0/0/0 &lt;br&gt;&#xA;ip route 192.168.2.0 255.255.255.0 s0/0/1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;br&gt; R1: &lt;br&gt;&#xA;ip route 172.16.1.0 255.255.255.0 s0/0/0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3: &lt;br&gt;&#xA;ip route 172.16.1.0 255.255.255.0 s0/0/1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oUfqZ.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oUfqZ.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/o5vXI.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/o5vXI.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36213" LastEditorUserId="36213" LastEditDate="2017-04-22T15:19:43.970" LastActivityDate="2017-05-22T16:24:10.743" Title="Building Static Routing Network" Tags="|cisco|routing|cisco-commands|packet-tracer|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40630" PostTypeId="2" ParentId="40628" CreationDate="2017-04-22T16:09:07.550" Score="3" Body="&lt;p&gt;I'm assuming that you have entered the correct exit interfaces on the static routes you have configured. As such, you should be able to:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ping from PC2 to PC1&lt;/li&gt;&#xA;&lt;li&gt;Ping from PC2 to PC3&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;What you shouldn't be able to do is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Ping from PC1 to PC3 and vice-versa&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is because you have static routes to the R1-Lan and R3-Lan on R2 but only have static routes to the R2-Lan on both R1 and R3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you ping from R1 to R3, you're actually able to send the packets till R3. When R3 recieves the packet and tries to reply, it checks it's routing table and has no route back to R1 and hence drops the packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Basically, you have to add a static route to R3-Lan from R1 and vice-versa.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, you just need to add the following commands on R1 and R3:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On R1:&#xA;ip route 192.168.2.0 255.255.255.0 s/0/0/0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On R3:&#xA;ip route 172.168.3.0 255.255.255.0 s/0/0/1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should resolve your issue.&lt;/p&gt;&#xA;" OwnerUserId="35823" LastEditorUserId="35823" LastEditDate="2017-04-22T16:19:45.700" LastActivityDate="2017-04-22T16:19:45.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40631" PostTypeId="1" AcceptedAnswerId="40633" CreationDate="2017-04-22T18:56:30.453" Score="1" ViewCount="289" Body="&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;Problem:&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I have two routers, and two separate ISPs (two different public ASNs).  I wish to accept full BGP routes in order for us to &lt;em&gt;properly&lt;/em&gt; set up true reliable ISP failover in a way that allows both links to be utilized.  From my understanding, the only truly effective/reliable way of doing this is by accepting full routes and advertising my public ASN to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem here is that obtaining a public /24 IPv4 block of addresses is not possible due to cost/lack of IPv4 public address space.  Additionally, the LAN/intranet network must remain IPv4 on the &quot;backend&quot;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;em&gt;My question is:&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Is it possible to leverage the untapped IPv6 public IP address space and use that &lt;strong&gt;in lieu of&lt;/strong&gt; a public /24 IPv4 block in order to advertise our public ASN out multiple providers (and therefore, provide the flexibility and control needed in order to manage those multihomed connections)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key here is that IPv6 would ONLY be used to allow us to accept full routes and advertise our public ASN across both providers.  &lt;strong&gt;The backend (literally the entire LAN/intranet) would have to run strictly on IPv4.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this even possible?  If so, what are the limitations?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follow-up question: How do people in modern times (i.e. mid 2010s) tackle this multihoming problem when they are unable to obtain a /24 public IPv4 block?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;For more clarity, the ultimate goal is the ability to utilize both ISPs at the same time for every day traffic flow to the point where if a current video conferencing session over one ISP was to fail, it would automatically re-route and continue working over the other ISP.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note: For the sake of this question, it is not possible to a) use IPv6 on the LAN/Intranet side instead of IPv4 and b) Somehow obtain a /24 public IPv4 block by purchasing it from a third party.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="13969" LastEditorUserId="8499" LastEditDate="2019-01-04T22:50:49.717" LastActivityDate="2019-01-04T22:50:49.717" Title="Using IPv6 for multihome ISP eBGP peering due to IPv4 public /24s no longer available" Tags="|routing|bgp|ipv6|internet|bgp-ipv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40632" PostTypeId="1" CreationDate="2017-04-22T19:01:28.783" Score="2" ViewCount="3989" Body="&lt;p&gt;I have a layer 3 switch with multiple VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created a trunk port that connects to a layer 2 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can now successfully access the layer 3 switch VLANs from an access port on the layer 2 switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I am not sure how to make the switches themselves talk to each other directly, i.e. so I can telnet from one switch to another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I make a &quot;network management&quot; VLAN and assign an IP on each switch? I tried this, however each switch can't even ping itself on this address. Perhaps this is because I didn't assign the VLAN to any access port, however it would seem like a waste of a port, as I only want them to talk through the trunk port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the standard way to go about this?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Full Layer 3 Switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 5362 bytes&#xA;!&#xA;version 12.2&#xA;no service pad&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname pac-inet-cs1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;switch 1 provision ws-c3750g-24t&#xA;system mtu routing 1500&#xA;authentication mac-move permit&#xA;ip subnet-zero&#xA;ip routing&#xA;ip name-server 8.8.8.8&#xA;ip name-server 4.4.4.4&#xA;ip dhcp excluded-address 192.168.30.1 192.168.30.10&#xA;ip dhcp excluded-address 192.168.32.1 192.168.32.10&#xA;ip dhcp excluded-address 192.168.36.1 192.168.36.10&#xA;!&#xA;ip dhcp pool Vlan30&#xA;   network 192.168.30.0 255.255.255.0&#xA;   domain-name mailpac.net&#xA;   default-router 192.168.30.1&#xA;   dns-server 8.8.8.8&#xA;!&#xA;ip dhcp pool Vlan32&#xA;   network 192.168.32.0 255.255.255.0&#xA;   domain-name mailpac.net&#xA;   default-router 192.168.32.1&#xA;   dns-server 8.8.8.8&#xA;!&#xA;ip dhcp pool Vlan36&#xA;   network 192.168.36.0 255.255.255.0&#xA;   domain-name mailpac.net&#xA;   default-router 192.168.36.1&#xA;   dns-server 8.8.8.8&#xA;!&#xA;!&#xA;&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;spanning-tree etherchannel guard misconfig&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface GigabitEthernet1/0/1&#xA; switchport access vlan 71&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/2&#xA; switchport access vlan 71&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet1/0/3&#xA; description Trunk to pac-inet-as1&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/4&#xA;!&#xA;interface GigabitEthernet1/0/5&#xA; switchport access vlan 30&#xA;!&#xA;interface GigabitEthernet1/0/6&#xA; switchport access vlan 32&#xA;!&#xA;interface GigabitEthernet1/0/7&#xA; switchport access vlan 36&#xA;!&#xA;interface GigabitEthernet1/0/8&#xA;!&#xA;interface GigabitEthernet1/0/9&#xA;!&#xA;interface GigabitEthernet1/0/10&#xA;!&#xA;interface GigabitEthernet1/0/11&#xA;!&#xA;interface GigabitEthernet1/0/12&#xA;!&#xA;interface GigabitEthernet1/0/13&#xA;!&#xA;interface GigabitEthernet1/0/14&#xA;!&#xA;interface GigabitEthernet1/0/15&#xA;!&#xA;interface GigabitEthernet1/0/16&#xA;!&#xA;interface GigabitEthernet1/0/17&#xA;!&#xA;interface GigabitEthernet1/0/18&#xA;!&#xA;interface GigabitEthernet1/0/19&#xA;!&#xA;interface GigabitEthernet1/0/20&#xA;!&#xA;interface GigabitEthernet1/0/21&#xA;!&#xA;interface GigabitEthernet1/0/22&#xA;!&#xA;interface GigabitEthernet1/0/23&#xA;!&#xA;interface GigabitEthernet1/0/24&#xA; no switchport&#xA; ip address 192.168.70.2 255.255.255.0&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface Vlan15&#xA; description Inet Server Public&#xA; ip address 192.168.15.2 255.255.255.0&#xA;!&#xA;interface Vlan28&#xA; description Management VLAN&#xA; ip address 192.168.28.121 255.255.255.0&#xA;!&#xA;interface Vlan30&#xA; description Inet Client&#xA; ip address 192.168.30.1 255.255.255.0&#xA;!&#xA;interface Vlan32&#xA; description Inet Public Client&#xA; ip address 192.168.32.1 255.255.255.0&#xA;!&#xA;interface Vlan34&#xA; description Inet Direct Access&#xA; ip address 192.168.34.1 255.255.255.0&#xA;!&#xA;interface Vlan36&#xA; description Wi-Fi Management&#xA; ip address 192.168.36.1 255.255.255.0&#xA;!&#xA;interface Vlan38&#xA; description Wi-Fi Client&#xA; ip address 192.168.46.1 255.255.248.0&#xA;!&#xA;interface Vlan71&#xA; description Spectrum Public&#xA; ip address 192.168.71.1 255.255.255.0&#xA;!&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 192.168.70.1&#xA;ip http server&#xA;ip http secure-server&#xA;!&#xA;!&#xA;ip sla enable reaction-alerts&#xA;!&#xA;!&#xA;line con 0&#xA;line vty 0 4&#xA; password xxxxxx&#xA; login&#xA;line vty 5 15&#xA; password xxxxxx&#xA; login&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Full Layer 2 Switch:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;version 12.2&#xA;no service pad&#xA;service timestamps debug uptime&#xA;service timestamps log uptime&#xA;no service password-encryption&#xA;!&#xA;hostname pac-inet-as1&#xA;!&#xA;no aaa new-model&#xA;switch 2 provision ws-c3750g-48ts&#xA;ip subnet-zero&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no file verify auto&#xA;spanning-tree mode pvst&#xA;spanning-tree extend system-id&#xA;!&#xA;vlan internal allocation policy ascending&#xA;!&#xA;interface GigabitEthernet2/0/1&#xA; switchport access vlan 30&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet2/0/2&#xA;!&#xA;interface GigabitEthernet2/0/3&#xA;!&#xA;interface GigabitEthernet2/0/4&#xA;!&#xA;interface GigabitEthernet2/0/5&#xA;!&#xA;interface GigabitEthernet2/0/6&#xA;!&#xA;interface GigabitEthernet2/0/7&#xA;!&#xA;interface GigabitEthernet2/0/8&#xA;!&#xA;interface GigabitEthernet2/0/9&#xA;!&#xA;interface GigabitEthernet2/0/10&#xA;!&#xA;interface GigabitEthernet2/0/11&#xA;!&#xA;interface GigabitEthernet2/0/12&#xA;!&#xA;interface GigabitEthernet2/0/13&#xA;!&#xA;interface GigabitEthernet2/0/14&#xA;!&#xA;interface GigabitEthernet2/0/15&#xA;!&#xA;interface GigabitEthernet2/0/16&#xA;!&#xA;interface GigabitEthernet2/0/17&#xA;!&#xA;interface GigabitEthernet2/0/18&#xA;!&#xA;interface GigabitEthernet2/0/19&#xA;!&#xA;interface GigabitEthernet2/0/20&#xA;!&#xA;interface GigabitEthernet2/0/21&#xA;!&#xA;interface GigabitEthernet2/0/22&#xA;!&#xA;interface GigabitEthernet2/0/23&#xA;!&#xA;interface GigabitEthernet2/0/24&#xA;!&#xA;interface GigabitEthernet2/0/25&#xA;!&#xA;interface GigabitEthernet2/0/26&#xA;!&#xA;interface GigabitEthernet2/0/27&#xA;!&#xA;interface GigabitEthernet2/0/28&#xA;!&#xA;interface GigabitEthernet2/0/29&#xA;!&#xA;interface GigabitEthernet2/0/30&#xA;!&#xA;interface GigabitEthernet2/0/31&#xA;!&#xA;interface GigabitEthernet2/0/32&#xA;!&#xA;interface GigabitEthernet2/0/33&#xA;!&#xA;interface GigabitEthernet2/0/34&#xA;!&#xA;interface GigabitEthernet2/0/35&#xA;!&#xA;interface GigabitEthernet2/0/36&#xA;!&#xA;interface GigabitEthernet2/0/37&#xA;!&#xA;interface GigabitEthernet2/0/38&#xA;!&#xA;interface GigabitEthernet2/0/39&#xA;!&#xA;interface GigabitEthernet2/0/40&#xA;!&#xA;interface GigabitEthernet2/0/41&#xA;!&#xA;interface GigabitEthernet2/0/42&#xA;!&#xA;interface GigabitEthernet2/0/43&#xA;!&#xA;interface GigabitEthernet2/0/44&#xA;!&#xA;interface GigabitEthernet2/0/45&#xA;!&#xA;interface GigabitEthernet2/0/46&#xA;!&#xA;interface GigabitEthernet2/0/47&#xA; switchport trunk encapsulation dot1q&#xA; switchport mode trunk&#xA;!&#xA;interface GigabitEthernet2/0/48&#xA;!&#xA;interface GigabitEthernet2/0/49&#xA;!&#xA;interface GigabitEthernet2/0/50&#xA;!&#xA;interface GigabitEthernet2/0/51&#xA;!&#xA;interface GigabitEthernet2/0/52&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA;!&#xA;interface Vlan28&#xA; ip address 192.168.28.141 255.255.255.0&#xA;!&#xA;ip classless&#xA;ip http server&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA; password xxxxxxx&#xA; login&#xA;line vty 0 4&#xA; password xxxxxxx&#xA; login&#xA;line vty 5 15&#xA; no login&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Layer 3 Switch Spanning Tree on Vlan 28:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;VLAN0028&#xA;  Spanning tree enabled protocol ieee&#xA;  Root ID    Priority    32796&#xA;             Address     0019.2f19.c800&#xA;             Cost        4&#xA;             Port        3 (GigabitEthernet1/0/3)&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;&#xA;  Bridge ID  Priority    32796  (priority 32768 sys-id-ext 28)&#xA;             Address     0027.0dc6.5480&#xA;             Hello Time   2 sec  Max Age 20 sec  Forward Delay 15 sec&#xA;             Aging Time  300 sec&#xA;&#xA;Interface           Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;Gi1/0/3             Root FWD 4         128.3    P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Layer 2 Switch had no spanning tree on Vlan 28:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Spanning tree instance(s) for vlan 28 does not exist.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="33283" LastEditorUserId="8499" LastEditDate="2018-03-21T00:57:13.060" LastActivityDate="2021-01-04T04:22:28.217" Title="How to make two Cisco switches talk to each other" Tags="|cisco|routing|switch|vlan|layer3|" AnswerCount="3" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="40633" PostTypeId="2" ParentId="40631" CreationDate="2017-04-22T19:05:31.050" Score="2" Body="&lt;p&gt;You can certainly run eBGP with your ISPs with IPv4 and receive the full IPv4 Internet prefixes to use in outbound routing; you just can't advertise your prefixes that are longer than &lt;code&gt;/24&lt;/code&gt;. That has nothing to do with IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv4 and IPv6 are two completely separate protocols. Advertising and receiving IPv6 prefixes will not do anything for your IPv4 routing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you only exchange IPv6 prefixes with your peer ASes, then your routing tables will only have the Internet IPv6 prefixes, not the IPv4 prefixes that you seem to want, you still cannot advertise your IPv4 prefixes to the Internet unless you have &lt;code&gt;/24&lt;/code&gt; prefixes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should still head toward IPv6. Get that set up, too, and start adding IPv6 to your network. That is the direction the world is heading, and putting it off will be painful in the long term.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Note: For the sake of this question, it is not possible to a) use IPv6&#xA;  on the LAN/Intranet side instead of IPv4 and b) Somehow obtain a /24&#xA;  public IPv4 block by purchasing it from a third party.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Based on your edit, you have a problem. If you want to advertise your IPv4 prefix(es) on the public Internet, you are going to need a public IPv4 prefix of &lt;code&gt;/24&lt;/code&gt; or shorter. That is simply all that the ISPs will advertise. If you cannot get one on the open market, for whatever reason, then you cannot advertise your IPv4 prefix(es) on the public Internet. This is the reason the Internet must transition to IPv6; there just are not enough IPv4 addresses to support the needs of everyone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv6 doesn't &quot;fix&quot; IPv4, it replaces it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can certainly add IPv6 support to your network. You don't need to completely replace IPv4 on your network at this time. You can dual-stack your network with both IPv4 and IPv6. Most people now have access to the IPv6 Internet, too. You will eventually need to support IPv6, and the longer you put it off, the more painful it will be.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-04-22T20:54:08.123" LastActivityDate="2017-04-22T20:54:08.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40634" PostTypeId="2" ParentId="40632" CreationDate="2017-04-22T19:11:08.977" Score="2" Body="&lt;p&gt;One way to do this is to create a VLAN for management (you don't have to have a separate VLAN, but it's a good practive), and assign IP addresses to the VLAN interfaces.  Make sure they are in the same IP subnet.  Then, make sure your trunk port on both switches allows that VLAN.  You don't need an access port on that VLAN -- just the trunk port will do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;You need to create the VLAN on the layer 2 switch.  From the config  prompt, type:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan 28&#xA;name Management&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then you should see the spanning tree instance on the witch&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-04-24T18:17:03.197" LastActivityDate="2017-04-24T18:17:03.197" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40635" PostTypeId="2" ParentId="40632" CreationDate="2017-04-22T19:33:58.663" Score="2" Body="&lt;p&gt;First, in your layer-3 switch, the default route is to an address for which you have no network. That isn't going to work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, I don't see a default gateway for your layer-2 switch. It is like any other host on VLAN 28, and it needs a default gateway to be able to get to other network. That should be the layer-3 switch VLAN 28 address: &lt;code&gt;192.168.28.121&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should also set up the password, and login on all the VTY lines, and have &lt;code&gt;transport input telnet&lt;/code&gt; on the VTY lines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you telnet into one switch, you should be able to run telnet on that switch to get to the other switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-22T19:33:58.663" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40637" PostTypeId="1" CreationDate="2017-04-23T04:23:15.910" Score="1" ViewCount="2561" Body="&lt;p&gt;I created a very simple network in &lt;a href=&quot;https://www.nrl.navy.mil/itd/ncs/products/core&quot; rel=&quot;nofollow noreferrer&quot;&gt;CORE Network Emulator&lt;/a&gt; with Host h1, Router R1, Router R2, and Host h2 (screen shot).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I got into the shell for h1, and tried to ping the other devices.  I can ping both IP addresses of R1, but attempts to ping anything beyond it, i.e. R2 fails.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I &quot;log into&quot; R1 I can ping the IP address of R2 that is connected to R1, but not the IP address on the other side (which connects to h2).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vJ8ey.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vJ8ey.png&quot; alt=&quot;Screen Shot&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the config in the CORE/IMUNES format:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;node n1 {&#xA;    type router&#xA;    model router&#xA;    network-config {&#xA;    hostname R1&#xA;    !&#xA;    interface eth1&#xA;     ip address 10.0.1.1/24&#xA;     ipv6 address 2001:1::1/64&#xA;    !&#xA;    interface eth0&#xA;     ip address 10.0.0.1/24&#xA;     ipv6 address 2001:0::1/64&#xA;    !&#xA;    }&#xA;    canvas c1&#xA;    iconcoords {371.0 308.0}&#xA;    labelcoords {371.0 340.0}&#xA;    interface-peer {eth0 n3}&#xA;    interface-peer {eth1 n2}&#xA;}&#xA;&#xA;node n2 {&#xA;    type router&#xA;    model router&#xA;    network-config {&#xA;    hostname R2&#xA;    !&#xA;    interface eth1&#xA;     ip address 10.0.2.1/24&#xA;     ipv6 address 2001:2::1/64&#xA;    !&#xA;    interface eth0&#xA;     ip address 10.0.1.2/24&#xA;     ipv6 address 2001:1::2/64&#xA;    !&#xA;    }&#xA;    canvas c1&#xA;    iconcoords {598.0 305.0}&#xA;    labelcoords {598.0 337.0}&#xA;    interface-peer {eth0 n1}&#xA;    interface-peer {eth1 n4}&#xA;}&#xA;&#xA;node n3 {&#xA;    type router&#xA;    model host&#xA;    network-config {&#xA;    hostname h1&#xA;    !&#xA;    interface eth0&#xA;     ip address 10.0.0.10/24&#xA;     ipv6 address 2001:0::10/64&#xA;    !&#xA;    }&#xA;    canvas c1&#xA;    iconcoords {201.0 465.0}&#xA;    labelcoords {201.0 497.0}&#xA;    interface-peer {eth0 n1}&#xA;}&#xA;&#xA;node n4 {&#xA;    type router&#xA;    model host&#xA;    network-config {&#xA;    hostname h2&#xA;    !&#xA;    interface eth0&#xA;     ip address 10.0.2.10/24&#xA;     ipv6 address 2001:2::10/64&#xA;    !&#xA;    }&#xA;    canvas c1&#xA;    iconcoords {753.0 460.0}&#xA;    labelcoords {753.0 492.0}&#xA;    interface-peer {eth0 n2}&#xA;}&#xA;&#xA;link l1 {&#xA;    nodes {n3 n1}&#xA;    bandwidth 0&#xA;}&#xA;&#xA;link l2 {&#xA;    nodes {n1 n2}&#xA;    bandwidth 0&#xA;}&#xA;&#xA;link l3 {&#xA;    nodes {n2 n4}&#xA;    bandwidth 0&#xA;}&#xA;&#xA;canvas c1 {&#xA;    name {Canvas1}&#xA;}&#xA;&#xA;option global {&#xA;    interface_names no&#xA;    ip_addresses yes&#xA;    ipv6_addresses no&#xA;    node_labels yes&#xA;    link_labels yes&#xA;    show_api no&#xA;    background_images no&#xA;    annotations yes&#xA;    grid yes&#xA;    traffic_start 0&#xA;}&#xA;&#xA;option session {&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36222" LastEditorUserId="8499" LastEditDate="2017-04-23T14:09:38.077" LastActivityDate="2017-04-23T14:09:38.077" Title="Can't Ping Past Router in CORE Network Emulator" Tags="|routing|router|ping|network|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40638" PostTypeId="2" ParentId="40637" CreationDate="2017-04-23T05:26:11.020" Score="3" Body="&lt;p&gt;You don't have any type of routing configured. Routers need to know where to send packets, otherwise they will simply drop the packets Routers learn where networks are in three ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Directly connected networks&lt;/li&gt;&#xA;&lt;li&gt;Statically configured routes&lt;/li&gt;&#xA;&lt;li&gt;Through a dynamic routing protocol&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You routers know about the networks that are directly connected to them, but they need to be told about networks that are not directly connected to them. You can either put in static routes to the other networks, or you can run a common routing protocol between the routers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-23T05:26:11.020" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40641" PostTypeId="2" ParentId="40534" CreationDate="2017-04-23T12:28:18.507" Score="0" Body="&lt;p&gt;&lt;strong&gt;SDN&lt;/strong&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In SDN enabled network there will be a controller (different controllers POX, RYU, OPENDAYLIGHT,FLOODLIGHT) and this controller will have knowledge of the entire network elements and also knows the real time traffic information. This knowledge can be used to perform real time traffic engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;NFV&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With help of NFV we can implement network elements in software instead of &#xA;dedicated hardware.&#xA;Eg. we can run &lt;strong&gt;click programs(click modular router)&lt;/strong&gt; to impliment network elemets like load balencer in open-flow switch instead of dedicated hardware&lt;/p&gt;&#xA;" OwnerUserId="36038" LastActivityDate="2017-04-23T12:28:18.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40642" PostTypeId="1" CreationDate="2017-04-23T12:38:44.170" Score="1" ViewCount="257" Body="&lt;p&gt;What is the need for ISP now - ring protection link protocol, ECFM, UP MEPS, DOWN MEPS - basically L2 protocols? Or ISP needs only MPLS, L3, VPLS, VPWS - L3 protocols only now. I am asking this question is do we need to know these L2 protocols and are they being used by the industry or ISP? Does with L3 protocol there is no need to worry about ECFM,RPL, or MEF-8 protocols.&lt;/p&gt;&#xA;" OwnerUserId="35397" LastActivityDate="2017-05-06T23:13:43.187" Title="What is the use case of Automatic protection ring , ERPS, ECFM, UP MEPs or Down MEPs in ISP now?" Tags="|switch|router|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40644" PostTypeId="2" ParentId="36036" CreationDate="2017-04-23T15:32:52.880" Score="0" Body="&lt;p&gt;If you can't get the Static IP at your end then why don't you try for the IPSEC+NAT-T? If the AWS also support NAT-T then that would be the best solution to establish the tunnel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As Dave pointed out,You may have to think about the issue when WAN IP is changed at your gateway.From my experience with IPSEC,We used StrongSwan IPsec with NAT-T and it worked flawlessly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would also suggest you to load an Open WRT based distribution in your gateway to have more flexibility with IPSec&lt;/p&gt;&#xA;" OwnerUserId="34773" LastActivityDate="2017-04-23T15:32:52.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40646" PostTypeId="2" ParentId="11126" CreationDate="2017-04-23T17:41:10.753" Score="10" Body="&lt;p&gt;To me, it doesn't seem like it was necessarily a primary design choice to make the fragmentation offset on 8 byte boundaries.  Rather, it was a result of the number of bits available to them within the primary design choices of how large the header should be, and how many bits were needed for other fields.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The designers chose the header size to be 20 bytes, and in that 20 bytes, given how they allocated bits for the various fields, they ended up with only 13 bits available for fragment offset.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xdNoS.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xdNoS.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that gives 2^13 = 8192 possible offset values.  At the same time, the total length field is 16 bits, so &lt;em&gt;technically&lt;/em&gt; the max payload size is 2^16 - 20 = 65516 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course the fragment offset field must be able to span the entire spectrum of possible sizes, so 65536 / 8192 = 8.&lt;/p&gt;&#xA;" OwnerUserId="36230" LastEditorUserId="36230" LastEditDate="2017-04-23T18:53:31.317" LastActivityDate="2017-04-23T18:53:31.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40651" PostTypeId="1" CreationDate="2017-04-24T02:07:55.750" Score="2" ViewCount="153" Body="&lt;p&gt;i have configured 3 static routes on a Cicso router using command&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;ip route x.x.x.x [mask] interface name&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;These routes are however not visible in the routers FIB table.&lt;/p&gt;&#xA;&lt;p&gt;when I specifically check for static they are shown as&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;M  192.168.0.0/24 [1/0] via GigabitEthernet0/3 [N]&lt;/p&gt;&#xA;&lt;p&gt;M  192.168.1.0/24 [1/0] via GigabitEthernet0/1 [N]&lt;/p&gt;&#xA;&lt;p&gt;M  192.168.2.0/24 [1/0] via GigabitEthernet0/2 [N]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;where [N] for non active.&#xA;Why are they non active.&#xA;Going by the administrative distance AD of static route is 1. There shoudnt be any overwrite for it in the FIB&lt;/p&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-04-24T04:02:26.577" Title="Static routes on Cisco" Tags="|cisco|router|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40653" PostTypeId="2" ParentId="40651" CreationDate="2017-04-24T03:45:49.567" Score="5" Body="&lt;p&gt;By default, if the interface is down, administratively shutdown or non-connected the route will not be injected into the routing table.  This is a caveat when using interfaces as the next hop instead of an IP address.  There are exceptions to this such as Null interfaces.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2017-04-24T04:02:26.577" LastActivityDate="2017-04-24T04:02:26.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40655" PostTypeId="1" CreationDate="2017-04-24T09:48:22.467" Score="1" ViewCount="174" Body="&lt;p&gt;There's a company (B2B interface) that provide certain services through a custom ISP (DSL), but this limits the internet connection only to this site, and on the office we have an regular ISP (DSL) that gives internet access to all computers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We want to run 2 modem/routers, and connect them, and give access to the internet to all computers, but when they reach the specific site , route the traffic through the other ISP (modem) instead of switching from wireless/physical network each time, not sure what options I can have (there's no problem to add entries on the hosts file (windows clients) to change the domain to a specific IP).  Not sure if routing tables is the way to go, or there's any way to define a kind of proxy.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modem that is currently connected to the internet is D-Link DSL 6850U, the other is still not there (if some model specific or feature is needed we can buy it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="36245" LastActivityDate="2018-04-20T02:43:41.163" Title="Specific web site traffic on 2 ISPs" Tags="|routing|router|internet|isp|modem|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="40656" PostTypeId="1" AcceptedAnswerId="45965" CreationDate="2017-04-24T13:05:35.993" Score="4" ViewCount="18201" Body="&lt;p&gt;Is it reasonable to set higher MTU size between RAN (3g, LTE) and RNC/SGW? Say, we have S1-U interface with GTP encapsulation, which leads to reduced data size for mobile user. Data size can be adjusted by SGW itself for TCP (MSS manipulation), but there's possibility to increase MTU from default 1500 value to, say, 1600, so that user can use bigger segment size for TCP, and other L4 protocols will not be fragmented at any level. Will this really help to improve performance and user experience or would there be some unaccounted factors that make the whole plan pointless?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="29564" OwnerDisplayName="artem_d93" LastEditorUserId="775" LastEditDate="2017-04-24T16:58:43.910" LastActivityDate="2023-07-14T10:53:57.230" Title="Increasing the MTU size for 3G/LTE networks" Tags="|ip|mtu|mobile|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40658" PostTypeId="1" AcceptedAnswerId="41203" CreationDate="2017-04-24T13:58:11.700" Score="1" ViewCount="760" Body="&lt;p&gt;I want to create a Fortigate cluster with two Fortigate running the same frimware version.&#xA;Each Fortigate has its own license, so each one has its serial number.&#xA;I have configured HA links by following the steps described on Cookbook. But the routers (Salve &amp;amp; Master) don't synchronize. Someone might know why? o_O&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help me please!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The configurations are:&#xA;####################Fortigate 1####################&#xA;config system ha&#xA;&#xA;set group-name &quot;Cluster&quot;&#xA;&#xA;    set mode a-p&#xA;&#xA;    set password ENC YYxXRRuXdiXkbfjL...&#xA;&#xA;    set hbdev &quot;port3&quot; 50  &quot;port4&quot; 50&#xA;&#xA;    set session-pickup enable&#xA;&#xA;    set override disable&#xA;&#xA;    set monitor &quot;port1&quot; &quot;port3&quot; &quot;port4&quot; &quot;port5&quot;&#xA;&#xA;end&#xA;#############################&#xA;&#xA;get system ha status&#xA;&#xA;Model : Fortigate-VM64&#xA;&#xA;Mode: a-p&#xA;&#xA;Group: 0&#xA;&#xA;Debug: 0&#xA;&#xA;ses_pickup: enable, ses_pickup_delay=disable&#xA;&#xA;Master : 128 Fortigate1         &#xA;&#xA;Number of vcluster: 1&#xA;&#xA;vcluster 1 : work 168.254.0.4&#xA;&#xA;Master : 0 FGVM100000XXXX&#xA;&#xA;Salve : 1 FGVM100000XXYY&#xA;&#xA;#############################&#xA;&#xA;diagnose sys ha cluster-csum&#xA;&#xA;=======================Fortigate 1 ================================&#xA;&#xA;is_manage_master ()=0, is_root_master ()=0&#xA;debugzone&#xA;&#xA;global : 8c db d6 fc 9a 84 bb 8d d7 10 d6 e0 a6 6f 09 7e&#xA;&#xA;root : 49 f0 12 10 42 09 c7 66 aa 04 c5 2c 29 52 0f 76&#xA;&#xA;all: 9e 2c a7 e5 7c 6f a6 88 e5 a9 ea 26 e6 48 69 e6&#xA;&#xA;&#xA;checksum&#xA;&#xA;global : 8c db d6 fc 9a 84 bb 8d d7 10 d6 e0 a6 6f 09 7e&#xA;&#xA;root : 49 f0 12 10 42 09 c7 66 aa 04 c5 2c 29 52 0f 76 &#xA;&#xA;all: 9e 2c a7 e5 7c 6f a6 88 e5 a9 ea 26 e6 48 69 e6&#xA;&#xA;&#xA;####################Fortigate 2####################&#xA;&#xA;config system ha&#xA;&#xA;    set group-name &quot;Cluster&quot;&#xA;&#xA;    set mode a-p&#xA;&#xA;    set password ENC YYxXRRuXdiXkbfjL...&#xA;&#xA;    set hbdev &quot;port3&quot; 50  &quot;port4&quot; 50&#xA;&#xA;    set session-pickup enable&#xA;&#xA;    set override disable&#xA;&#xA;    set priority 50&#xA;&#xA;    set monitor &quot;port1&quot; &quot;port3&quot; &quot;port4&quot; &quot;port5&quot; &#xA;&#xA;end&#xA;&#xA;get system ha status&#xA;&#xA;Model : Fortigate-VM64&#xA;&#xA;Mode: a-p&#xA;&#xA;Group: 0&#xA;&#xA;Debug: 0&#xA;&#xA;ses_pickup: enable, ses_pickup_delay=disable&#xA;&#xA;Slave : 50 Fortigate2       &#xA;&#xA;Number of vcluster: 1&#xA;&#xA;Salve : 1 FGVM100000XXXX&#xA;&#xA;Master : 0 FGVM100000XXXX&#xA;&#xA;&#xA;diagnose sys ha cluster-csum&#xA;&#xA;=======================Fortigate 2 ================================&#xA;&#xA;is_manage_master ()=0, is_root_master ()=0&#xA;debugzone&#xA;&#xA;global : 0f d4 37 ca f2 7e 5b ff ca fb ac aa 8b 38 88 6d&#xA;&#xA;root : 1c 85 55 fe a7 e5 7c 6f a6 88 e5 a9 ea 26 e6 92&#xA;&#xA;all: f5 62 b2 ce 81 9a c9 04 8f 67 07 ec a7 44 60 1f&#xA;&#xA;&#xA;checksum&#xA;&#xA;global : 0f d4 37 ca f2 7e 5b ff ca fb ac aa 8b 38 88 6d&#xA;&#xA;root : 1c 85 55 fe a7 e5 7c 6f a6 88 e5 a9 ea 26 e6 92&#xA;&#xA;all: f5 62 b2 ce 81 9a c9 04 8f 67 07 ec a7 44 60 1f&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35263" LastEditorUserId="509" LastEditDate="2017-04-24T14:51:54.390" LastActivityDate="2017-05-16T07:54:24.713" Title="Synchronization of Fortigate Cluster on VMware" Tags="|fortigate|vmware|" AnswerCount="1" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40659" PostTypeId="2" ParentId="40656" CreationDate="2017-04-24T15:14:18.237" Score="5" Body="&lt;p&gt;I think it's always best to allow end-user traffic to use an MTU of 1500.  Therefore when encapsulated the overlay network has to cater for this either by a larger MTU size in the encapsulated domain or by fragmentation/reassembly techniques.  Since fragmentation is computationally expensive when performed in software, I believe that a service provider should define and use an MTU in the domain of the encapsulated traffic sufficient to allow 1500 at the user level and avoid any fragmenation, as you say 1600 for instance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This won't significantly improve TCP performance in the steady-state, but it will avoid complications.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a service provider you should be in a position to define the MTU of your network to the customer, and if you define it at 1500 nobody can complain, and you will reduce potential problems where for instance PMTUD doesn't work well for any reason or is slow to adjust or settles for TCP minimum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The downside is that you will need to ensure that every Ethernet port along the way has an appropriate MTU defined.  Some equipment may default to dropping jumbos (or mini-jumbos if you prefer).  If you fail to do this then traffic may be black-holed somewhere along the route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The worst case is of course when the service provider just leaves everything default and doesn't really actually have a defined MTU with the service offering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would caveat all this by saying I haven't ever worked on the radio network, so I don't know if there's any frame or cell structure there that would lead you towards a different end-user MTU for bandwidth efficiency.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-04-24T15:14:18.237" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40660" PostTypeId="2" ParentId="40655" CreationDate="2017-04-24T15:29:32.283" Score="1" Body="&lt;p&gt;You can do outbound routing to specific destination with static routes. You can prefer one of ISPs for particular site inbound with BGP and your own PI pool. You can do advanced routing decision with some L4-L7 technologies, for instance, Cisco PfR. Though I can't see a good way to reroute through another ISP after connection to remote site is established, if I understood your intent correctly.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-04-24T15:29:32.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40661" PostTypeId="2" ParentId="40655" CreationDate="2017-04-24T19:01:31.020" Score="0" Body="&lt;p&gt;This sort of thing is possible but not easy in the general case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first problem is how to split traffic. If the provider of &quot;special services&quot;. If the destination IP addresses for the &quot;special services&quot; are well-known and don't conflict with resources you need on the public Internet this is easy, just use static routes. IF they are not well known or there is an addressing conflict then life will get far more painful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will also want NAT so that the source address used is correct for the network the packets are sent over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second issue is DNS, assuming the special services are not in the public DNS and the DNS for the special services won't resolve public hostnames you will need a local DNS server that is smart/configurable enough to forward queries to the right place.&#xA;may prefer other soloutions.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-04-24T19:01:31.020" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40664" PostTypeId="2" ParentId="40091" CreationDate="2017-04-25T00:45:55.680" Score="1" Body="&lt;p&gt;Cisco has a large listing of Syslog Messages and Severity level here: &lt;a href=&quot;https://www.cisco.com/c/en/us/support/switches/catalyst-6500-series-switches/products-system-message-guides-list.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Syslog Messages&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This list includes Syslog Messages for the following:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IOS Software Release 15SY&lt;/li&gt;&#xA;&lt;li&gt;IOS Software Release 12.2SY&lt;/li&gt;&#xA;&lt;li&gt;IOS Software Release 12.2SX&lt;/li&gt;&#xA;&lt;li&gt;ASA Services Module&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;For the IOS Guides, you have to drill into the individual error messages to find the severity level.  The ASA has a &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/asa/syslog-guide/syslogs/logsevp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;specific section&lt;/a&gt;, breaking down the severity Level.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Per Cisco documentation, the ASA IOS does not actually list any Severity 0 (Emergency) level messages.&lt;/strong&gt;  After a quick glance, I was not able to come up with any IOS Syslog messages with a Severity 0 (although, some may be found after some deep digging into the documentation).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco does not call out any reason for lack of Severity 0 messages.  However, Cisco does allows users to reassign the severity of Syslog messages.  &lt;strong&gt;I suspect the lack of default Severity 0 messages is to give users a custom level to which they can assign.&lt;/strong&gt;  The thought process could be that if a user needs to reassign a Syslog Message Severity Level, it must be very important and it will likely be assigned the highest severity level.    &lt;/p&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2017-04-25T01:08:00.327" LastActivityDate="2017-04-25T01:08:00.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40665" PostTypeId="1" AcceptedAnswerId="40666" CreationDate="2017-04-25T04:03:54.537" Score="2" ViewCount="1180" Body="&lt;p&gt;I'm working on optimizing an OSPF network, and I'm looking at different network types. Here is what I understand:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Broadcast: Dynamic neighbors; uses multicast; elects DR&lt;/li&gt;&#xA;&lt;li&gt;NBMA: Static neighbors; uses unicast; elects DR&lt;/li&gt;&#xA;&lt;li&gt;PTP: Single neighbor; uses multicast; does not elect DR&lt;/li&gt;&#xA;&lt;li&gt;PTMP: Dynamic neighbors; uses multicast; does not elect DR&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;How does PTMP maintain efficiency without electing a DR? I assume it uses the &quot;hub&quot;, but how does it know what the hub is if everything is on the same subnet?&lt;/p&gt;&#xA;" OwnerUserId="33762" LastEditorUserId="8499" LastEditDate="2017-08-19T23:34:25.863" LastActivityDate="2017-08-19T23:34:30.627" Title="What is the difference in functionality between PTMP and Broadcast?" Tags="|ospf|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40666" PostTypeId="2" ParentId="40665" CreationDate="2017-04-25T06:32:02.377" Score="3" Body="&lt;p&gt;Routers form FULL adjacency with each other. This mode is useful for hub and spoke design. One of the examples - Frame Relay network.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-04-25T06:32:02.377" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40668" PostTypeId="1" CreationDate="2017-04-25T09:22:05.127" Score="2" ViewCount="11246" Body="&lt;p&gt;I have recently taken over responsibility of the management of the switches in my apartment complex. We two switches, 1 and 2, the fiber connection to the internet is connected to switch 1. Switch 2 is connected to Switch 1 through an ethernet cable. Switch 2 is configured so that the port that connects the two switches has a trunk option activated. From what I gather this is normal (all the outgoing traffic through this switch is sent through this port?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in switch 1 there is also a port with a trunk option activated. However, this port is the port that is connected to the apartment of the old responsible of the switches in our apartment complex. Finally my question is, is this normal, or has this guy been up to something fishy?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit:&#xA;The model of the switch is HP ProCurve Switch 2650  J4899A.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under Switch Configuration -&gt; Port/Trunk Settings&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Type      Enabled      Mode      Flow Ctrl  Group  Type&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10/100TX  | Yes      Auto          Disable    Trk1   Trunk&lt;/p&gt;&#xA;" OwnerUserId="36264" LastEditorUserId="36264" LastEditDate="2017-04-25T13:44:40.427" LastActivityDate="2017-04-25T15:31:15.470" Title="What is the purpose of a trunk port in a network switch?" Tags="|switch|trunk|" AnswerCount="2" CommentCount="4" ClosedDate="2017-06-08T01:49:29.510" ContentLicense="CC BY-SA 3.0" />
  <row Id="40670" PostTypeId="1" AcceptedAnswerId="41044" CreationDate="2017-04-25T09:58:47.037" Score="3" ViewCount="14858" Body="&lt;p&gt;On a Cisco isr 4451 with base image I need to check if IPSec is available. Is there an command to list available vpn features?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt; The image name includes K9 (UNIVERSALK9-M) but the command failed as invalid input detected at isakmp. How can I enable IPSEC on K9 Image.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&#xA;As mentioned here is the output of sh license&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#sh license &#xA;Index 1 Feature: appxk9                         &#xA;    Period left: Not Activated&#xA;    Period Used: 0  minute  0  second  &#xA;    License Type: EvalRightToUse&#xA;    License State: Active, Not in Use, EULA not accepted&#xA;    License Count: Non-Counted&#xA;    License Priority: None&#xA;Index 2 Feature: uck9                           &#xA;    Period left: Not Activated&#xA;    Period Used: 0  minute  0  second  &#xA;    License Type: EvalRightToUse&#xA;    License State: Active, Not in Use, EULA not accepted&#xA;    License Count: Non-Counted&#xA;    License Priority: None&#xA;Index 3 Feature: securityk9                     &#xA;    Period left: Not Activated&#xA;    Period Used: 0  minute  0  second  &#xA;    License Type: EvalRightToUse&#xA;    License State: Active, Not in Use, EULA not accepted&#xA;    License Count: Non-Counted&#xA;    License Priority: None&#xA;Index 4 Feature: ipbasek9                       &#xA;    Period left: Life time&#xA;    License Type: Permanent&#xA;    License State: Active, In Use&#xA;    License Count: Non-Counted&#xA;    License Priority: Medium&#xA;Index 5 Feature: cme-srst                       &#xA;    Period left: Not Activated&#xA;    Period Used: 0  minute  0  second  &#xA;    License Type: EvalRightToUse&#xA;    License State: Active, Not in Use, EULA not accepted&#xA;    License Count: 0/0  (In-use/Violation)&#xA;    License Priority: None&#xA;Index 6 Feature: hseck9                         &#xA;Index 7 Feature: throughput                     &#xA;    Period left: Not Activated&#xA;    Period Used: 0  minute  0  second  &#xA;    License Type: EvalRightToUse&#xA;    License State: Active, Not in Use, EULA not accepted&#xA;    License Count: Non-Counted&#xA;    License Priority: None&#xA;Index 8 Feature: internal_service      &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20772" LastEditorUserId="2142" LastEditDate="2019-03-11T18:06:00.847" LastActivityDate="2019-03-11T18:06:00.847" Title="How to check if IPSec is available on Cisco ISR 4451" Tags="|cisco|ipsec|cisco-isr|license|" AnswerCount="3" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40676" PostTypeId="1" AcceptedAnswerId="40747" CreationDate="2017-04-25T11:22:06.320" Score="1" ViewCount="1924" Body="&lt;p&gt;I have a router running BIRD. It is connected to network A using eBGP and B using OSPF. I want to let network B have routes to network A as another area (i.e. this is an area border router). How to achieve this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Already tried adding the following to OSPF network B block: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;area 1.2.3.4 {&#xA;    default cost 100;&#xA;    external {&#xA;            &amp;lt;Network A prefix&amp;gt;&#xA;            };&#xA;    };&#xA;};&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but seems to be no use.&lt;/p&gt;&#xA;" OwnerUserId="32304" LastActivityDate="2017-04-27T13:41:30.687" Title="How to redistribute BGP routes to OSPF using BIRD?" Tags="|bgp|ospf|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40677" PostTypeId="2" ParentId="40670" CreationDate="2017-04-25T11:26:40.557" Score="4" Body="&lt;p&gt;On the router console, type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show version&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If the image name includes the letters &quot;K9&quot;, as in &lt;code&gt;C3000-UNIVERSALK9-M,&lt;/code&gt; then yes.  Otherwise, no.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also type a command like&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show crypto isakmp sa&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you don't get an error, then IPsec is available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To enable IPSec with this IOS version, you have to buy the security license (securityk9) to enable that feature.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-05-04T12:36:47.273" LastActivityDate="2017-05-04T12:36:47.273" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40678" PostTypeId="1" CreationDate="2017-04-25T11:31:55.387" Score="2" ViewCount="3018" Body="&lt;p&gt;We have two IPsec VPN tunnels (over the public network) to a VPC in AWS. Each tunnel has one BGP session. Our router is a Cisco 3925E.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Under load (not necessarily excessive), the BGP sessions are often flapping (hold time expired). I've already tried to play with the keepalive / hold time parameters but without any success... What's the best approach to solve this issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Current BGP config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 65000&#xA; neighbor 169.254.26.225 remote-as 10124&#xA; neighbor 169.254.34.93  timers 5 30 30&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Logs:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Apr 25 10:30:09.897: %BGP-3-NOTIFICATION: sent to neighbor 169.254.34.93 4/0 (hold time expired) 0 bytes &#xA;Apr 25 10:30:09.899: %BGP-5-NBR_RESET: Neighbor 169.254.34.93 reset (BGP Notification sent)&#xA;Apr 25 10:30:09.899: %BGP-5-ADJCHANGE: neighbor 169.254.34.93 Down BGP Notification sent&#xA;Apr 25 10:30:09.899: %BGP_SESSION-5-ADJCHANGE: neighbor 169.254.34.93 IPv4 Unicast topology base removed from session  BGP Notification sent&#xA;Apr 25 10:30:13.023: %LINEPROTO-5-UPDOWN: Line protocol on Interface Tunnel21, changed state to down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36269" LastActivityDate="2017-04-25T14:20:35.323" Title="BGP over IPsec: session flapping" Tags="|cisco|routing|vpn|bgp|ipsec|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40679" PostTypeId="1" AcceptedAnswerId="40729" CreationDate="2017-04-25T12:23:00.250" Score="1" ViewCount="349" Body="&lt;p&gt;I need to create the same network with cisco and juniper routers. I find tutorial to cisco. When i clicked on configuration in cisco router i have a lot of options for example WICs, its emulated by Dynamips. How i can add WIC in juniper router? I'm using Juniper Olive emulated by virtual box. Someone knows different image of juniper with this option, or knows how to switch it on? &lt;a href=&quot;https://i.stack.imgur.com/gHpN6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gHpN6.png&quot; alt=&quot;&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36270" LastActivityDate="2017-04-26T22:30:46.677" Title="Which one of juniper routers image gives me this option (GNS3)?" Tags="|juniper|juniper-junos|gns3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40680" PostTypeId="2" ParentId="32511" CreationDate="2017-04-25T12:26:57.813" Score="2" Body="&lt;p&gt;With a ring, STP (Spanning Tree Protocol) shuts off one port (usually in the switch with highest mac and the highest used port on that switch in that ring if not configured differently). This prevents loops. When you break the working path, STP has to figure what &quot;it&quot; thinks is the next best path. That takes time. It can take up to 50 seconds with STP. RSTP (Rapid Spanning Tree) is much faster but will still exhibit this behavior. Some model switches have faster/different ways of doing this. It is working as designed. You may need a different design if this isn't acceptable. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a link that might help. There are many resources to understand STP out there of course. &lt;a href=&quot;http://www.enterprisenetworkingplanet.com/netsp/article.php/3580966/Networking-101-Understanding-Spanning-Tree.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;Understanding STP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2017-04-25T12:26:57.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40681" PostTypeId="2" ParentId="40678" CreationDate="2017-04-25T12:35:20.563" Score="1" Body="&lt;p&gt;Disable path-mtu-discovery on the neighbors.&lt;/p&gt;&#xA;" OwnerUserId="2104" LastActivityDate="2017-04-25T12:35:20.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40682" PostTypeId="1" CreationDate="2017-04-25T12:50:21.713" Score="2" ViewCount="310" Body="&lt;p&gt;I'm slightly confused about the significance of the SNAP header. Attached is a DTP capture between 2 switches. Could someone elaborate on what 0xaa signifies?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also notice that CDP/VTP/DTP/PAgP/UDLD frames are all destined to the same MAC address of 01-00-0c-cc-cc-cc. How would the switch know which protocol the frame is intended for. I'm guessing this is where the SNAP header plays in?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/t5g8R.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/t5g8R.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31597" LastActivityDate="2018-04-10T02:20:39.367" Title="Confusion regarding SNAP Headers" Tags="|ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40683" PostTypeId="1" CreationDate="2017-04-25T13:08:45.410" Score="3" ViewCount="1763" Body="&lt;p&gt;One can find routes matching an IP using &lt;code&gt;show route 192.0.2.123&lt;/code&gt;. What is the equivalent way to find matching prefixes, if any, in a long prefix list? ... to determine quickly and conclusively whether or not an IP matches a prefix list? ... to generate a list of all prefix lists that an IP matches?&lt;/p&gt;&#xA;" OwnerUserId="47" LastActivityDate="2017-04-26T22:23:45.583" Title="How to test an IP against a prefix list on JUNOS CLI" Tags="|juniper-junos|cli|prefix|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40684" PostTypeId="1" AcceptedAnswerId="40687" CreationDate="2017-04-25T13:48:46.970" Score="0" ViewCount="527" Body="&lt;p&gt;I understand the differences between PT(M)P and NBMA:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;PT(M)P uses dynamic neighbor discovery and multicast, while NBMA does not&lt;/li&gt;&#xA;&lt;li&gt;NBMA elects a DR, while PT(M)P does not&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I'm trying to optimize a network composed almost exclusively with wireless links. What, if any, advantages does PT(M)P have over NBMA other than dynamic neighbor discovery? And conversely, what advantages, if any, does NBMA have over PT(M)P other than not using multicast?&lt;/p&gt;&#xA;" OwnerUserId="33762" LastActivityDate="2017-04-25T14:44:54.543" Title="OSPF: PT(M)P vs NBMA" Tags="|ospf|" AnswerCount="1" CommentCount="1" ClosedDate="2017-04-25T19:14:12.600" ContentLicense="CC BY-SA 3.0" />
  <row Id="40685" PostTypeId="2" ParentId="40678" CreationDate="2017-04-25T14:20:35.323" Score="2" Body="&lt;p&gt;As mentioned by others in the comments section, you are losing enough BGP keep-alive packets to cause the session to fail.  When the session drops then all traffic will likely cease until BGP re-establishes its session (which is a minimum of 60 seconds and usually a fair amount longer).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - you've got two options: either find a mechanism to prioritize BGP traffic or make BGP less sensitive to packet loss. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The former (prioritization) likely isn't going to be doable given that, as you point out, you're relying on a public network and the other side of the session is outside your control.  You can certainly prioritize and protect the packets you actually transmit, of course, but that has no guarantee of being honored a hop beyond the router you manage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The latter approach (BGP less sensitive) may be a more pragmatic option.  In this case I would suggest making your dead timer longer.  At the moment you have packets being sent every 5 seconds, with the session timing out if a response isn't received in 30.  Try increasing the latter value to 60 or 90 (also consider increasing the third number, as it is the minimum you will allow negotiated and we don't know the peer's info).  This gives you a better shot of getting a keep-alive through during a bursty period.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finding an optimum value for keep-alives is always a compromise between stability and detection speed.  I would add, though, that if this is the only path to AWS for you - or if the alternate path is substantially less desirable - that erring on the side of slow failure detection actually makes a lot of sense.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-04-25T14:20:35.323" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40686" PostTypeId="2" ParentId="40668" CreationDate="2017-04-25T14:26:44.763" Score="0" Body="&lt;p&gt;The term trunk port means different things to diffrent vendors. For example, in Cisco it is a port that uses multiple VLANs normally used to connect two switches together so all vlans traverse the network. It can be used for other devices like ip phones that need more than 1 vlan. In HP it is the combining of multiple interfaces between switches to carry more traffic. It's a bundle or aggregation of interfaces(ports) via programming and physical connection. &lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2017-04-25T14:26:44.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40687" PostTypeId="2" ParentId="40684" CreationDate="2017-04-25T14:44:54.543" Score="4" Body="&lt;p&gt;So the practical differences are, as you point out, whether OSPF speakers on a given multi-access network will dynamically form adjacencies or if explicit neighbor relationships need to be configured.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It used to be that the decision of which method was dictated by both the transport in use and the feature sets supported on the software / hardware platform.  The classic case was frame-relay / X.25 where, initially, a manual mapping of unicast IP to hardware destination has to be maintained.  The lack of any notion of broadcast (let alone multicast!) meant that adjacencies also had to be manually set up.  This approach was augmented with the use of per-destination subinterfaces, which moved to the classic point-to-point L3 configuration and attendant automatic adjacency formation.  It's also worth noting that other IGP's (notably IS-IS) didn't support NBMA at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More recently it's rare to find a physical transport that requires the use of NBMA, but certain logical transports (ex: certain NHRP-based VPN's) can still require it under certain circumstances.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - assuming the transport can support either p-t-p or NBMA topologies the pros and cons are basically this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NBMA - more efficient IP utilization, likely somewhat less overall router configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point-to-Point - A logical interface per connection burns more IP's and potentially requires lots of configuration.  It also allows for the granular deployment of features like QoS and security and arguably provides a much cleaner mechanism of troubleshooting, capacity analysis and traffic engineering.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately the two approaches don't vary in terms of the number of adjacencies (and associated overhead).  There's going to be some advantage to the NBMA approach in terms of numbers of LSA's generated (one per subnet for one /24 vs 128 /31's) but the actual impact of this is going to vary tremendously with network design and hardware capacity.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To sum it up - if both options are available and scale isn't an issue then I would tend toward the operational benefits of point-to-point.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-04-25T14:44:54.543" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40688" PostTypeId="2" ParentId="39528" CreationDate="2017-04-25T15:04:19.793" Score="2" Body="&lt;p&gt;I just did this with an NSA 2600.&#xA;Once you have the device in safe mode (TEST is blinking) connect the ethernet from your computer to the management port. You might notice the uplink light on X0 goes out after putting in to safe mode.&#xA;Change your local IP on your machine to 192.168.1.20/255.255.255.0 (or whatever IP you want as long as its not .254).&#xA;Open browser and connect to 192.168.1.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://support.sonicwall.com/kb/sw10509&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://support.sonicwall.com/kb/sw10509&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36274" LastActivityDate="2017-04-25T15:04:19.793" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40689" PostTypeId="2" ParentId="40668" CreationDate="2017-04-25T15:31:15.470" Score="3" Body="&lt;p&gt;There's nothing inherently &quot;fishy&quot; about running a trunk port to &quot;the apartment of the person formerly responsible for administering the switches&quot; (which is what I decipher you to mean) - as a network manager I certainly prefer to be able to troubleshoot a network from the comfort of my office rather than having to drag a laptop down to the network hub area. The reality is that that person's (or yours, now) integrity is the only thing standing between a person with network administrative powers and other people's data - integrity is part of the job, and it is not changed (for better, or for worse) by having a trunk port. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this person is no longer responsible for that function, then it might well be appropriate to turn that off - it in part depends on what the VLAN configuration of the switches is and how service is provided to apartments (each on it's own VLAN? Some other way? you need to understand it before you can effectively manage it.) Depending on switch software, some have very simple &quot;trunk&quot; setups where everything is always on a trunk, others can have a trunk that only has a few specific VLANs on it, such as the management VLAN and the access VLAN for the particular apartment. If the setup is that it's &quot;all&quot; for a trunk, the only way to get the management VLAN to an apartment along with the apartment access VLAN would be to send everything there, and then depend on integrity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the transfer of responsibility is not overtly hostile, you might want to discuss how things are set up with the &quot;Old Responsible&quot; - if you can't do that, you may have a lot of self-education to accomplish in a hurry.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2017-04-25T15:31:15.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40693" PostTypeId="2" ParentId="2432" CreationDate="2017-04-25T17:05:21.197" Score="0" Body="&lt;p&gt;That is what I do, removing only the network statement, leaving all the other options in.  When I need to switch over to this DHCP, I add back in just the network statement.&lt;/p&gt;&#xA;" OwnerUserId="36281" LastActivityDate="2017-04-25T17:05:21.197" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40694" PostTypeId="1" CreationDate="2017-04-25T17:05:40.470" Score="5" ViewCount="364" Body="&lt;p&gt;Background: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 Cisco 2911 for two ISPs -&gt; two physical ports on a Cisco 2960 switch -&gt; a single port on ASA5520&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am running out of ports on a the ASA so I am thinking if i could do this the following way:&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;ON ASA&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA;no ip address&#xA;duplex auto&#xA;speed auto&#xA;!&#xA;interface GigabitEthernet0/1.1&#xA;description ISP1&#xA;vlan 1&#xA;nameif OUTSIDE&#xA;ip address 202.X.X.100 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1.11&#xA;description ISP2&#xA;vlan 11&#xA;nameif OUTSIDE11&#xA;ip address 102.X.X.100 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;h2&gt;ON SWITCH&lt;/h2&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet1/0/1&#xA;description to ASA GE01&#xA;switchport trunk allowed vlan 1,11&#xA;switchport mode trunk&#xA;!&#xA;interface GigabitEthernet1/0/10&#xA;description ISP1&#xA;switchport mode access&#xA;switchport access vlan 1&#xA;!&#xA;interface GigabitEthernet1/0/20&#xA;description ISP2&#xA;switchport mode access&#xA;switchport access vlan 11&#xA;!&#xA;interface vlan 1&#xA;ip address 202.X.X.99 255.255.255.0&#xA;!&#xA;interface vlan 11&#xA;ip address 102.X.X.99 255.255.255.0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, I am not able to ping each other after configuring the vlans and the subinterfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any comment would be appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stephen&lt;/p&gt;&#xA;" OwnerDisplayName="Stephen Fung" LastActivityDate="2018-07-16T18:26:55.567" Title="Issue configuring multiple ISPs under subinterfaces" Tags="|cisco-asa|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40697" PostTypeId="1" AcceptedAnswerId="40699" CreationDate="2017-04-25T17:58:35.340" Score="1" ViewCount="326" Body="&lt;p&gt;I am doing static routing to connect computers over three routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my scenario:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/hv4db.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hv4db.jpg&quot; alt=&quot;network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of the hosts are in &lt;code&gt;/21&lt;/code&gt; subnets. Each of the routers are assigned IP addresses over a &lt;code&gt;/30&lt;/code&gt; subnet. When I go in each of the routers' CLIs, I can ping a host on the &lt;code&gt;VanNuys&lt;/code&gt; to a host on &lt;code&gt;Seattle&lt;/code&gt; and I can ping a host on &lt;code&gt;Seattle&lt;/code&gt; to a host on &lt;code&gt;OK City&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My trouble now is figuring out how a host on &lt;code&gt;Van Nuys&lt;/code&gt; can successfully ping one on &lt;code&gt;OK City&lt;/code&gt;. Could such a thing be possible using this configuration or would I have to add an additional serial cable that goes directly from &lt;code&gt;OK City&lt;/code&gt; to &lt;code&gt;Van Nuys&lt;/code&gt;? If so, what would that look like?&lt;/p&gt;&#xA;" OwnerUserId="36174" LastEditorUserId="8499" LastEditDate="2018-12-25T04:50:55.580" LastActivityDate="2018-12-25T04:50:55.580" Title="How would I formulate an &quot;ip route&quot; command in order for two non-adjacent routers to communicate?" Tags="|cisco|routing|router|subnet|packet-tracer|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40698" PostTypeId="1" AcceptedAnswerId="40702" CreationDate="2017-04-25T18:01:36.603" Score="3" ViewCount="531" Body="&lt;p&gt;On a Cisco Packet Tracer sample &lt;a href=&quot;http://lifebeam.net/cisco/files/e2-232.pka&quot; rel=&quot;nofollow noreferrer&quot;&gt;e2-232&lt;/a&gt;, there is something I don't understand, even after following the step-by-step instructions on the sample project.The logical topology is shown in the following screen-shot.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/uDKXl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/uDKXl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result of pings are shown below:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;on &lt;strong&gt;PC2&lt;/strong&gt; : ping &lt;em&gt;172.16.1.1&lt;/em&gt; interface of &lt;strong&gt;R2&lt;/strong&gt;: &lt;kbd&gt;OK&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;li&gt;on &lt;strong&gt;PC2&lt;/strong&gt; : ping &lt;em&gt;172.16.2.2&lt;/em&gt; interface of &lt;strong&gt;R2&lt;/strong&gt;: &lt;kbd&gt;OK&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;li&gt;on &lt;strong&gt;PC2&lt;/strong&gt; : ping &lt;em&gt;192.168.1.2&lt;/em&gt; interface of &lt;strong&gt;R2&lt;/strong&gt;: &lt;kbd&gt;OK&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;li&gt;on &lt;strong&gt;R1&lt;/strong&gt; : ping &lt;em&gt;172.16.1.1&lt;/em&gt; interface of &lt;strong&gt;R2&lt;/strong&gt;: &lt;kbd&gt;NOT GOOD&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;li&gt;on &lt;strong&gt;R1&lt;/strong&gt; : ping &lt;em&gt;172.16.2.2&lt;/em&gt; interface of &lt;strong&gt;R2&lt;/strong&gt;: &lt;kbd&gt;OK&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;li&gt;on &lt;strong&gt;R1&lt;/strong&gt; : ping &lt;em&gt;192.168.1.2&lt;/em&gt; interface of &lt;strong&gt;R2&lt;/strong&gt;: &lt;kbd&gt;NOT GOOD&lt;/kbd&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Now, my question is why &lt;code&gt;ping&lt;/code&gt;results on &lt;strong&gt;R1&lt;/strong&gt;, which is a router, are different from those on &lt;strong&gt;PC2&lt;/strong&gt;, which is a desktop computer. Considering the fact that both &lt;strong&gt;R1&lt;/strong&gt; and &lt;strong&gt;PC2&lt;/strong&gt; are directly connected to &lt;strong&gt;R2&lt;/strong&gt;, why are the data-packets, sent to &lt;strong&gt;R2&lt;/strong&gt;, treated differently based on their origin?&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Running-Configurations of &lt;strong&gt;R1&lt;/strong&gt; are as follows:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Router#show running-config &#xA;Building configuration...&#xA;&#xA;Current configuration : 713 bytes&#xA;!&#xA;version 12.3&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 172.16.3.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 172.16.2.1 255.255.255.0&#xA;!&#xA;interface Serial0/0/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; no login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, &lt;strong&gt;R2&lt;/strong&gt; running-configurations are:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&#xA;Router#show running-config &#xA;Building configuration...&#xA;&#xA;Current configuration : 724 bytes&#xA;!&#xA;version 12.3&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip ssh version 1&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 172.16.1.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 172.16.2.2 255.255.255.0&#xA; clock rate 64000&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 192.168.1.2 255.255.255.0&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; no login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/pre&gt;&#xA;" OwnerUserId="36279" LastEditorUserId="8499" LastEditDate="2018-12-25T04:51:35.697" LastActivityDate="2018-12-25T04:51:35.697" Title="Data-packets, sent to a router, are treated differently based on their origin: clarification needed" Tags="|cisco|routing|router|ping|packet-tracer|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="40699" PostTypeId="2" ParentId="40697" CreationDate="2017-04-25T18:02:45.527" Score="2" Body="&lt;p&gt;Simply add routes to the networks on the other side of the other router. You did that already for some of your routes, but you need to do it for all of the routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static routes don't scale. You should really use a dynamic routing protocol in common with your routers.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;You obviously created static routes on your routers in order for a host on the Van Nuys network to be able to ping a host on the Seattle network. Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route &amp;lt;destination network address&amp;gt; &amp;lt;destination network mask&amp;gt; &amp;lt;next hop router&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You did this on the Van Nuys router, pointing to the Seattle router, and vice versa. You need to do the same thing for any other networks on the other side of the Seattle router, including the link from the Seattle router to the OK City router, and the network on the other side of the OK City router. From Van Nuys, those networks are on the other side of the Seattle router, which is the next hop router for the networks attached to the Seattle router. You will also need to do the same thing on the OK City router for the networks on the other side of the Seattle router from the perspective of the OK City router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-04-25T22:55:06.993" LastActivityDate="2017-04-25T22:55:06.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40700" PostTypeId="1" AcceptedAnswerId="40721" CreationDate="2017-04-25T18:06:48.417" Score="0" ViewCount="132" Body="&lt;p&gt;I'm a database developer that inherited and managing an environment, we recently got disconnected from our parent company.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyway we got couple of ESX servers, physical servers and we're having issues with the DHCP, no IP leases has been going on, we were attached to their DHCP, if I connect any PCs directly we get a lease, but not behind or over our switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what should I look for?  Anyone can help please?  I added Ip-Helper on the Vlan 90 but still no luck, doing a wireshark can only show dhcp discover messages, nothing else!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&#xA;Jason&lt;/p&gt;&#xA;" OwnerUserId="36285" LastEditorUserId="36285" LastEditDate="2017-04-25T18:11:05.530" LastActivityDate="2017-04-26T17:59:37.600" Title="DHCP behind catalyst 3750 POE-48" Tags="|cisco|dhcp|switching|cisco-catalyst|" AnswerCount="1" CommentCount="7" ClosedDate="2019-02-07T00:23:30.640" ContentLicense="CC BY-SA 3.0" />
  <row Id="40701" PostTypeId="2" ParentId="40698" CreationDate="2017-04-25T18:11:49.423" Score="3" Body="&lt;p&gt;It's because R1 doesn't know how to reach those other interfaces (it doesn't have routes for those networks).  You need routes on R1 pointing to R2 for the other two subnets.  R1 of course knows how to reach 172.16.2.2 because it has an interface on that network.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2017-04-25T18:11:49.423" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40702" PostTypeId="2" ParentId="40698" CreationDate="2017-04-25T18:33:00.023" Score="2" Body="&lt;p&gt;Your routers have no routes to non-connected networks. Routers get routes in three ways:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Directly connected networks&lt;/li&gt;&#xA;&lt;li&gt;Statically configured routes&lt;/li&gt;&#xA;&lt;li&gt;Through dynamic routing protocols&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;You need to use one or both of the last two methods for a router to learn about networks not directly connected to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PC can ping a host, e.g. its router, on the same LAN, and it will have the router as its gateway, so it can reach any networks about which its router knows (the router's directly connected routes). A different router doesn't know about the network where the PC is attached, so the router has no way to know to send that traffic to the router for that network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-04-25T18:43:43.647" LastActivityDate="2017-04-25T18:43:43.647" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="40706" PostTypeId="2" ParentId="9455" CreationDate="2017-04-26T02:46:04.883" Score="1" Body="&lt;p&gt;To answer your question as to why your Wireshark is not showing any TCP protocol when you visit any website is because of your enabled filter &quot;ip.addr==192.168.0.1&quot;.&#xA;Your wireshark capture is all about your transaction with &quot;ip.addr==192.168.0.1&quot; which I believe is your gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your initial capture clearly shows that your device is looking for a DNS server as it needs to translate as to what is the IP address of &quot;twitter.com&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once your machine couldn't find a DNS server, it goes on to search for devices that offer DNS services thus SSDP was triggered. SSDP is expertly defined by user2373 above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, the reason why you cannot see any TCP or HTTP packets is because your filter captures your machine looking for a DNS service. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps.  &lt;/p&gt;&#xA;" OwnerUserId="36291" LastActivityDate="2017-04-26T02:46:04.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40708" PostTypeId="1" AcceptedAnswerId="40709" CreationDate="2017-04-26T03:32:10.967" Score="1" ViewCount="679" Body="&lt;p&gt;If I configure a loopback interface and then set a router id by typing, &lt;code&gt;eigrp router-id 10.0.0.1&lt;/code&gt;, for example, and the router protocol is EIGRP, what will be the accurate id for this router if the ID I set is higher than the loopback address?&lt;/p&gt;&#xA;" OwnerUserId="35524" LastEditorUserId="8499" LastEditDate="2018-12-25T04:52:09.277" LastActivityDate="2018-12-25T04:52:09.277" Title="A question about the router ID for EIGRP" Tags="|cisco|routing|router|eigrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40709" PostTypeId="2" ParentId="40708" CreationDate="2017-04-26T03:37:35.903" Score="2" Body="&lt;p&gt;If you specifically set the router ID, then that is what the router ID will be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_2/iproute/command/reference/fiprrp_r/1rfeigrp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Chapter: EIGRP Commands&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h2&gt;Defaults&lt;/h2&gt;&#xA;  &#xA;  &lt;p&gt;EIGRP automatically selects an IP address to use as the router ID when&#xA;  an EIGRP process is started. The highest local IP address is selected&#xA;  and loopback interfaces are preferred. The router ID is not changed&#xA;  unless the EIGRP process is removed with the &lt;strong&gt;no router eigrp&lt;/strong&gt;&#xA;  command or if the router ID is manually configured with the &lt;strong&gt;eigrp&#xA;  router-id&lt;/strong&gt; command.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-26T03:37:35.903" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40713" PostTypeId="2" ParentId="16438" CreationDate="2017-04-26T06:23:48.660" Score="1" Body="&lt;p&gt;I believe another reason fiber propagates &quot;slower&quot; than copper is because the light is, by definition, refracting across the fiber along the distance of the cable. The physics stack exchange has a different take on this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://physics.stackexchange.com/questions/80043/how-fast-does-light-travel-through-a-fibre-optic-cable&quot;&gt;https://physics.stackexchange.com/questions/80043/how-fast-does-light-travel-through-a-fibre-optic-cable&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36296" LastActivityDate="2017-04-26T06:23:48.660" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40715" PostTypeId="1" AcceptedAnswerId="40716" CreationDate="2017-04-26T08:21:57.150" Score="3" ViewCount="1367" Body="&lt;p&gt;Suppose,&#xA;My host is &lt;strong&gt;A&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;A&lt;/strong&gt;(my machine) has ip address 12.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;B&lt;/strong&gt; has ip address 13&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C&lt;/strong&gt; has ip address 14&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My machine has below entries in ARP cache&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;B&lt;/strong&gt; =&gt; ip address 13 and its corresponding MAC address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;C&lt;/strong&gt; =&gt; ip address 14 and its corresponding MAC address&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, &lt;strong&gt;B&lt;/strong&gt; and &lt;strong&gt;C&lt;/strong&gt; disconnects from LAN and when they are connected back to LAN, but this time &lt;strong&gt;C&lt;/strong&gt; is assigned IP address 13 and &lt;strong&gt;B&lt;/strong&gt; is assigned IP address 14&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But my ARP cache has old info. What would happen if I try to ping &lt;strong&gt;B&lt;/strong&gt; now ?&lt;/p&gt;&#xA;" OwnerUserId="34757" LastActivityDate="2022-04-04T22:47:16.803" Title="When ARP cache is updated?" Tags="|arp|network|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40716" PostTypeId="2" ParentId="40715" CreationDate="2017-04-26T08:52:37.997" Score="6" Body="&lt;p&gt;If that were to happen just as you state, then your pings would fail.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practise if you are using DHCP to hand out addresses, the server will give you back the same address.  Even if it doesn't (because you clear your DHCP server cache and reboot it, all before your ARP cache times out) you'll probably find that your B and C will send gratuitous ARPs anyway to update the ARP cache.&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-04-26T08:52:37.997" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40717" PostTypeId="1" AcceptedAnswerId="40748" CreationDate="2017-04-26T10:03:20.247" Score="1" ViewCount="162" Body="&lt;p&gt;can someone please tell me what the &quot;cross-protocol replay attack for protocols sharing common keys&quot; refers to in the RFC7474?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Indeed, in the case of an extern attacker, he does not know any of the key shared by any protocol normally.&#xA;And in the case of an internal attacker (who compromised a router), the attacker knows Ko and the protocol identifier normally, so it means he can generate all Ks used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks for any consideration,&lt;/p&gt;&#xA;" OwnerUserId="34880" LastActivityDate="2017-04-27T13:46:30.990" Title="&quot;RFC7474 : cross-protocol replay attack&quot;, what is it?" Tags="|ospf|rfc|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40721" PostTypeId="2" ParentId="40700" CreationDate="2017-04-26T17:59:37.600" Score="1" Body="&lt;p&gt;I needed to make the DHCP interface to hosts as a trusted interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;interface 1/0/23&#xA;ip dhcp snooping trust&lt;/p&gt;&#xA;" OwnerUserId="36285" LastActivityDate="2017-04-26T17:59:37.600" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40728" PostTypeId="2" ParentId="40683" CreationDate="2017-04-26T22:23:45.583" Score="2" Body="&lt;p&gt;In Junos you have the command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;test policy &amp;lt;&amp;lt;POLICY-NAME&amp;gt;&amp;gt; &amp;lt;&amp;lt;Prefix&amp;gt;&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;however, it doesn't do quite what you are asking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly, create your prefix-list and match it in a policy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-options {&#xA;    prefix-list SOME-PREFIXES {&#xA;        172.16.10.1/32;&#xA;        172.16.10.32/27;&#xA;        172.16.10.50/32;&#xA;        172.16.10.96/29;&#xA;        172.16.10.104/29;&#xA;        172.16.10.128/27;&#xA;    }&#xA;    policy-statement ACCEPT-PREFIXES {&#xA;        term MATCH-PREFIXES {&#xA;            from {&#xA;                prefix-list SOME-PREFIXES;&#xA;            }&#xA;            then accept;&#xA;        }&#xA;        then reject;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, given the following routes in inet.0:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bdale@0ffnet-lab-gw&amp;gt; show route 172.16.10.0/24 &#xA;&#xA;inet.0: 98 destinations, 100 routes (98 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;172.16.10.0/24     *[Direct/0] 6d 05:39:58&#xA;                    &amp;gt; via vlan.10&#xA;172.16.10.21/32    *[Access-internal/12] 6d 05:31:47&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;172.16.10.22/32    *[Access-internal/12] 6d 05:39:43&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;172.16.10.23/32    *[Access-internal/12] 6d 05:39:42&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;172.16.10.24/32    *[Access-internal/12] 5d 21:25:31&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;172.16.10.25/32    *[Access-internal/12] 6d 05:38:15&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;172.16.10.28/32    *[Access-internal/12] 6d 05:39:26&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;172.16.10.32/32    *[Access-internal/12] 15:13:51&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;172.16.10.34/32    *[Access-internal/12] 14:51:36&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;172.16.10.37/32    *[Access-internal/12] 14:50:48&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;172.16.10.50/32    *[Access-internal/12] 6d 05:39:32&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;172.16.10.51/32    *[Access-internal/12] 6d 05:39:28&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;run the test:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;bdale@0ffnet-lab-gw&amp;gt; test policy ACCEPT-PREFIXES 172.16.10.0/24 &#xA;&#xA;inet.0: 98 destinations, 100 routes (98 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both&#xA;&#xA;172.16.10.50/32    *[Access-internal/12] 6d 05:43:06&#xA;                    &amp;gt; to 172.16.10.254 via vlan.10&#xA;&#xA;Policy ACCEPT-PREFIXES: 1 prefix accepted, 21 prefix rejected&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And you'll see you only get one match.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The prefix you enter into the test command basically says &quot;show me all the routes that match this prefix &lt;strong&gt;or longer&lt;/strong&gt;&quot; - in a similar to the way a &lt;code&gt;show route&lt;/code&gt; command works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, when matching a prefix list, prefixes are matched &lt;strong&gt;exactly&lt;/strong&gt;, so even though our prefix list has a covering prefix (eg: &lt;code&gt;172.16.10.32/27&lt;/code&gt;) that doesn't cause a match because that exact prefix isn't in the routing table.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-04-26T22:23:45.583" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40729" PostTypeId="2" ParentId="40679" CreationDate="2017-04-26T22:30:46.677" Score="1" Body="&lt;p&gt;Olives aren't emulated hardware - they are actual Junos routing-engines (supervisors in Cisco terminology), so it isn't possible to add &quot;WICs&quot; as you would to a Cisco (which is being emulated along with the WICs) in GNS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could possibly add extra Ethernet ports using the &lt;code&gt;NM-1FE-TX&lt;/code&gt; option in the other Slot drop-downs but from memory when I built some physical Olives many moons ago I think this was limited to a max of 4 interfaces on top of the first &lt;code&gt;fxp0&lt;/code&gt; port.&lt;/p&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-04-26T22:30:46.677" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40731" PostTypeId="1" AcceptedAnswerId="40745" CreationDate="2017-04-26T23:04:04.060" Score="2" ViewCount="2147" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/7m0WQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7m0WQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have above network and here is the cisco trunk configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nexus 5548&#xA;&#xA; interface Ethernet1/9&#xA;  description F5-10G-Link&#xA;  switchport mode trunk&#xA;  switchport trunk allowed vlan 201&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco 3850 (non-root switch)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Port-channel20&#xA; description F5-2G-Etherchannel trunk&#xA; switchport trunk allowed vlan 201&#xA; switchport mode trunk&#xA;end&#xA;&#xA;interface GigabitEthernet1/0/45&#xA; description F5-1G-a&#xA; switchport trunk allowed vlan 201&#xA; switchport mode trunk&#xA; channel-protocol lacp&#xA; channel-group 20 mode active&#xA;end&#xA;&#xA;!&#xA;interface GigabitEthernet1/0/46&#xA; description F5-1G-b&#xA; switchport trunk allowed vlan 201&#xA; switchport mode trunk&#xA; channel-protocol lacp&#xA; channel-group 20 mode active&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;links are up but if i check in STP configuration on cisco my 10G link is in blocking mode and 2G link is forwarding mode, as per STP cost calculation 10G link should be in forwarding because it has total cost to reach root is 4 and 2G link total cost to root is 5 right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even i tried to increase spanning-tree cost of 2G link but it didn't work still that link is in FWD mode.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;SW2#sh spanning-tree int po20&#xA;&#xA;Vlan                Role Sts Cost      Prio.Nbr Type&#xA;------------------- ---- --- --------- -------- --------------------------------&#xA;VLAN0201            Desg FWD 3         128.2046 P2p      &#xA;&#xA;Nexus#sh spanning-tree int e1/9&#xA;&#xA;Vlan             Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;VLAN0201         Altn BLK 2         128.137  P2p&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If i am trying to shutdown 2G trunk then on Nexus switch i am seeing following spanning-tree status which is weird&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Nexus# sh spanning-tree int e1/9&#xA;&#xA;Vlan             Role Sts Cost      Prio.Nbr Type&#xA;---------------- ---- --- --------- -------- --------------------------------&#xA;VLAN0201         Desg BKN*2         128.137  P2p *LOOP_Inc&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and this interface never come into forwarding state.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;what i am doing wrong here? is my cisco config is wrong on trunk?&lt;/p&gt;&#xA;&#xA;&lt;h1&gt;EDIT&lt;/h1&gt;&#xA;&#xA;&lt;p&gt;In f5 side we have default STP setting which is &quot;Passthrough&quot;, Should i change it to RSTP? &lt;/p&gt;&#xA;" OwnerUserId="17285" LastEditorUserId="17285" LastEditDate="2017-04-27T02:27:39.510" LastActivityDate="2017-04-27T12:26:59.230" Title="Cisco STP issue with BIG IP F5 trunk" Tags="|cisco|switch|spanning-tree|f5|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40735" PostTypeId="1" CreationDate="2017-04-27T03:50:04.610" Score="1" ViewCount="423" Body="&lt;p&gt;I am trying to configure my Cisco 2800 router to communicate between VLANs and route traffic to the Internet. VLANs can access each other but not the Internet. The router can ping the modem but not the Internet. The configuration is below of the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 2904 bytes&#xA;!&#xA;! Last configuration change at 03:36:32 UTC Thu Apr 27 2017&#xA;!&#xA;version 15.0&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;boot-start-marker&#xA;warm-reboot&#xA;boot-end-marker&#xA;!&#xA;enable password tyson987&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;!&#xA;dot11 syslog&#xA;ip source-route&#xA;!&#xA;!&#xA;ip cef&#xA;ip dhcp excluded-address 192.168.3.1 192.168.3.50&#xA;ip dhcp excluded-address 192.168.4.1 192.168.4.50&#xA;ip dhcp excluded-address 192.168.1.200&#xA;ip dhcp excluded-address 192.168.1.250&#xA;ip dhcp excluded-address 192.168.1.251&#xA;ip dhcp excluded-address 192.168.1.252&#xA;ip dhcp excluded-address 192.168.1.253&#xA;ip dhcp excluded-address 192.168.1.254&#xA;ip dhcp excluded-address 192.168.10.200&#xA;ip dhcp excluded-address 192.168.10.250&#xA;ip dhcp excluded-address 192.168.10.251&#xA;ip dhcp excluded-address 192.168.10.252&#xA;ip dhcp excluded-address 192.168.10.253&#xA;ip dhcp excluded-address 192.168.10.254&#xA;ip dhcp excluded-address 192.168.20.200&#xA;ip dhcp excluded-address 192.168.30.200&#xA;ip dhcp excluded-address 192.168.40.200&#xA;ip dhcp excluded-address 192.168.2.2&#xA;ip dhcp excluded-address 192.168.2.240&#xA;ip dhcp excluded-address 192.168.2.250&#xA;ip dhcp excluded-address 192.168.2.1&#xA;ip dhcp excluded-address 192.168.3.1&#xA;ip dhcp excluded-address 192.168.3.200&#xA;ip dhcp excluded-address 192.168.2.200&#xA;ip dhcp excluded-address 192.168.4.1&#xA;ip dhcp excluded-address 192.168.4.200&#xA;ip dhcp excluded-address 192.168.2.200 192.168.2.254&#xA;!&#xA;ip dhcp pool DHCP-ADMIN&#xA;   import all&#xA;   network 192.168.3.0 255.255.255.0&#xA;   default-router 192.168.3.200&#xA;   dns-server 8.8.8.8&#xA;!&#xA;ip dhcp pool DHCP-STUDENTS&#xA;   import all&#xA;   network 192.168.4.0 255.255.255.0&#xA;   default-router 192.168.4.200&#xA;   dns-server 8.8.8.8&#xA;!&#xA;ip dhcp pool DHCP-SERVER&#xA;   import all&#xA;   network 192.168.2.0 255.255.255.0&#xA;   dns-server 8.8.8.8&#xA;   default-router 192.168.2.200&#xA;!&#xA;!&#xA;ip name-server 192.168.2.2&#xA;ip name-server 8.8.8.8&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;license udi pid CISCO2821 sn FHK1307F1JZ&#xA;!&#xA;redundancy&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA; !&#xA;!&#xA;interface GigabitEthernet0/0.10&#xA; encapsulation dot1Q 10&#xA; ip address 192.168.10.200 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/0.20&#xA; encapsulation dot1Q 20&#xA; ip address 192.168.3.200 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/0.30&#xA; encapsulation dot1Q 30&#xA; ip address 192.168.4.200 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 192.168.2.254 255.255.255.0&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA; !&#xA;!&#xA;ip default-gateway 192.168.5.200&#xA;ip forward-protocol nd&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 110.142.236.228&#xA;ip route 0.0.0.0 0.0.0.0 GigabitEthernet0/1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA; !&#xA;!&#xA;!&#xA;line con 0&#xA; password tyson987&#xA; login&#xA;line aux 0&#xA;line vty 0 4&#xA; password tyson987&#xA; login&#xA;!&#xA;scheduler allocate 20000 1000&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36325" LastEditorUserId="8499" LastEditDate="2018-12-11T01:16:52.357" LastActivityDate="2018-12-11T01:16:52.357" Title="VLAN Internet access" Tags="|cisco|routing|router|vlan|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40736" PostTypeId="2" ParentId="40735" CreationDate="2017-04-27T03:57:01.707" Score="4" Body="&lt;p&gt;You did not configure &lt;code&gt;ip nat inside&lt;/code&gt; on the layer-3 LAN interfaces. Nor do I see where you have defined the addresses to be translated. Also, you should not have two default routes the way you do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0.10&#xA; ip nat inside&#xA;!&#xA;interface GigabitEthernet0/0.20&#xA; ip nat inside&#xA;!&#xA;interface GigabitEthernet0/0.30&#xA; ip nat inside&#xA;!&#xA;ip nat inside source list 10 interface GigabitEthernet0/1 overload&#xA;!&#xA;access-list 10 permit 192.168.10.200 0.0.0.255&#xA;access-list 10 permit 192.168.3.200 0.0.0.255&#xA;access-list 10 permit 192.168.4.200 0.0.0.255&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-27T03:57:01.707" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40739" PostTypeId="1" CreationDate="2017-04-27T07:30:37.393" Score="6" ViewCount="543" Body="&lt;p&gt;While studying MPLS I couldn't understand it's one basic functionality.&#xA;Mpls creates tunnel interfaces or pseudowires between label edge routers. To achieve traffic engineering I can set different limits on different tunnels. But what decides which packet takes which tunnel. &#xA;For instance at the ingress LER there are 3 tunnel interfaces with throughout 50,100,250 mbps respectively. If a packet now enters the mpls network what decides which tunnel it will use .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One option I saw was static which has obvious limitations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Second option was route maps. Does this mean I can match source IP address and determine tunnel interface ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third option is auto and I couldn't understand how it works.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general does any deep packet inspection technique be used ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-08-09T13:28:18.553" Title="MPLS traffic engineering" Tags="|routing|mpls|mpls-te|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40740" PostTypeId="1" AcceptedAnswerId="40742" CreationDate="2017-04-27T08:23:04.753" Score="0" ViewCount="128" Body="&lt;p&gt;Can you list me names of the standards from where I can prove that 2G phones will not work over 3G network? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it's a common fact but I need something like a standard.&lt;/p&gt;&#xA;" OwnerUserId="34620" LastEditorUserId="34620" LastEditDate="2017-04-27T08:36:01.847" LastActivityDate="2017-04-27T10:01:30.850" Title="2G or 3G network standards" Tags="|mobile|standardisation|" AnswerCount="1" CommentCount="0" ClosedDate="2018-07-22T00:37:59.360" ContentLicense="CC BY-SA 3.0" />
  <row Id="40741" PostTypeId="2" ParentId="40739" CreationDate="2017-04-27T08:56:51.277" Score="6" Body="&lt;p&gt;Traffic steering is actually the task that is beyond MPLS TE itself. TE tunnel just provides the path, and it's up to other protocols and techniques to steer actual traffic. The same is true for bandwidth reservation. TE just says &quot;there are 300 mbps reserved&quot;, but nothing stops your client from sending more than that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, your options are policies, static routes and IGPs. If you want granular control you go with static routes and policies. If you just want to get fast restoration you go with announcing tunnels into IGP. Steering technique depends on your task.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastEditorUserId="29564" LastEditDate="2017-04-27T10:42:48.263" LastActivityDate="2017-04-27T10:42:48.263" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40742" PostTypeId="2" ParentId="40740" CreationDate="2017-04-27T10:01:30.850" Score="1" Body="&lt;p&gt;I think your question is way too wide. There's protocol stack for 2G, and for 3G. They're different. Frequencies are different. Even controller/core is at least logically different. For documentation you can visit &lt;a href=&quot;http://www.3gpp.org/specifications&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.3gpp.org/specifications&lt;/a&gt;. Find protocol stacks and compare them &quot;line by line&quot; if it meets your purpose. &lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-04-27T10:01:30.850" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40745" PostTypeId="2" ParentId="40731" CreationDate="2017-04-27T12:26:59.230" Score="2" Body="&lt;p&gt;If your F5 is in passthrough mode, that means it is transparent to BPDUs -- The C3850 and Nexus switch see each other as directly connected STP neighbors.  So it makes sense that you can't block the 2G link.  To the switches, the 10G and 2G links are the same link.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should adjust the cost on the link between the two C3850 switches so that that one is blocking.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco rapid-pvst and RSTP (802.1w) are not compatible, so you should not configure RSTP on the F5. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-27T12:26:59.230" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="40747" PostTypeId="2" ParentId="40676" CreationDate="2017-04-27T13:41:30.687" Score="2" Body="&lt;p&gt;I've figured out this myself. Have to add &lt;code&gt;import all;&lt;/code&gt; or some custom import filter in OSPF block.&lt;/p&gt;&#xA;" OwnerUserId="32304" LastActivityDate="2017-04-27T13:41:30.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40748" PostTypeId="2" ParentId="40717" CreationDate="2017-04-27T13:46:30.990" Score="0" Body="&lt;p&gt;The &amp;quot;cross-protocol&amp;quot; refers to multiple protocols that may use the same key. This can be common because people are lazy, and it is easy to use the same key for different things.&lt;/p&gt;&#xA;&lt;p&gt;If you have an OSPF router on a broadcast medium, it will send its packets to every device on the medium, and it will listen to every device on the medium. A device that runs a different protocol could try the key used by that protocol to attack OSPF. If OSPF uses the same key, there could be a problem.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7474#section-6&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 7474, Security Extension for OSPFv2 When Using Manual Key Management&lt;/em&gt;&lt;/a&gt; addresses this:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;&lt;strong&gt;6.  Mitigating Cross-Protocol Attacks&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;p&gt;In order to prevent cross-protocol replay attacks for protocols&#xA;sharing common keys, the two-octet OSPFv2 Cryptographic Protocol ID is&#xA;appended to the authentication key prior to use.  Refer to the IANA&#xA;Considerations (Section 9).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-04-27T13:46:30.990" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40758" PostTypeId="2" ParentId="40739" CreationDate="2017-04-28T04:00:59.417" Score="3" Body="&lt;p&gt;to expand on the previous answer -- policy is generally dictated by qos.  an s/p will generally match on dscp or cos bits (cbts or pbts) to decide tunnel path.&#xA;there are other ways, in which you can match by source/destination addresses, vrf, etc.  they usually take the form of some sort of access-list applied as a policy to the tunnel-path.  the policy can take the form as a route-map, depending on platform.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;q.&lt;/p&gt;&#xA;" OwnerUserId="36357" LastActivityDate="2017-04-28T04:00:59.417" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40760" PostTypeId="1" CreationDate="2017-04-28T07:10:12.210" Score="2" ViewCount="18619" Body="&lt;p&gt;I can change easily &lt;em&gt;Router&lt;/em&gt; and &lt;em&gt;Switch&lt;/em&gt; names in Packet Tracer using &lt;code&gt;hostname&lt;/code&gt; command in &lt;code&gt;global config mode&lt;/code&gt;. But how could I change a label of a Generic PC, let's say from &lt;strong&gt;PC0&lt;/strong&gt; to &lt;strong&gt;Sales&lt;/strong&gt;? i could not find one. I know there should be a way since I saw some Cisco Packet tracer example files that has different labels for their PCs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using by the way &lt;strong&gt;Cisco Packet Tracer 6.3&lt;/strong&gt; for your information.&lt;/p&gt;&#xA;" OwnerUserId="27993" LastActivityDate="2020-04-28T06:08:53.353" Title="Changing Label for Generic PC in Packet Tracer" Tags="|cisco-ios|packet-tracer|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40761" PostTypeId="1" AcceptedAnswerId="40934" CreationDate="2017-04-28T11:04:04.890" Score="0" ViewCount="418" Body="&lt;p&gt;We are going to set up a new office in a new location our concern is that if there is a network flooding or too much bandwidth is being used can we identify the culprit without DOS'ing the in-house server.&lt;/p&gt;&#xA;&lt;p&gt;there will be 90 pc's with one  Cisco sg-300 28pp managed switch and four un managed switch to connect all of them&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/vpX7J.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vpX7J.jpg&quot; alt=&quot;Rough Network design&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;We will have 4 vlans for different departments Marketing, Ruby, DotNet and Servers&#xA;in case of a network flooding or storm before we had no option as the switches were all plug n play now we have decided to segment into different vlans to control broadcast and minimize network outage.&lt;/p&gt;&#xA;&lt;p&gt;so if any of the pc is flooding the network can we pin point the ip  or the pc without having to go through all one by one?&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT&lt;/strong&gt;  : The Router is Cisco's RV016 Multi-Wan VPN Router.&lt;/p&gt;&#xA;&lt;p&gt;&lt;strong&gt;EDIT2&lt;/strong&gt; : Now we have seven SG300-52 managed switches to operate and configure network.&lt;/p&gt;&#xA;" OwnerUserId="36361" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-05-05T12:02:38.567" Title="Finding the Ip address of a pc hogging the bandwidth in a switched environment" Tags="|cisco|switch|network-discovery|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40762" PostTypeId="1" AcceptedAnswerId="40915" CreationDate="2017-04-28T11:51:25.970" Score="3" ViewCount="1237" Body="&lt;p&gt;We have changed our ASA's DNS name from vpn-1.old-domain.com to vpn-1.new-domain.com. A connection profile in a user PC contains the old one VPN host: vpn-1.old-domain.com. So, due to connection there will be an SSL cert error displayed, such as SSL_ERROR_BAD_CERT_DOMAIN like in the Firefox.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can ASA do redirect Anyconnect SSL VPN connection from old DNS to the new one ? Maybe there is another more straight, correct way ?&#xA;ASA version is 9.6(2)13&lt;/p&gt;&#xA;" OwnerUserId="34493" LastEditorUserId="34493" LastEditDate="2017-04-28T12:15:12.147" LastActivityDate="2017-10-31T16:51:39.270" Title="Cisco ASA, redirect Anyconnect SSL VPN to new address/url" Tags="|cisco-asa|sslvpn|cisco-anyconnect|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40763" PostTypeId="2" ParentId="40761" CreationDate="2017-04-28T12:26:28.917" Score="0" Body="&lt;p&gt;I think you are being silly with your hardware choices, buying one expensive cisco switch and a bunch of totally unmanaged ones. Even something like a TP-Link &quot;smart&quot; (note: not &quot;websmart/easysmart&quot;) switch would be better than an unmanaged switch. If money is tight I would much rather have some level of management on all my switches than one switch with great management and four with no management at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general managed/smart switches have the ability to monitor traffic on individual ports (either through the switches UI or through SNMP) but they typically don't offer higher level monitoring. So if you have some level of management on all your switches you can easily see which computer is the problem. If you don't then all you will see is which unmanaged switch the problem computer is on, with a handful of machines on one desk connected to an unmanaged switch that is tolerable but with 20 odd on one unmanaged switch it will be a massive PITA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some routers are able to monitor on the basis of IP addresses but since you tell us nothing about your router we don't know if yours can. Furthermore even if monitoring on the router is possible it will tell you nothing about traffic that remains within a VLAN and never hits the router.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-04-28T13:06:40.063" LastActivityDate="2017-04-28T13:06:40.063" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40764" PostTypeId="1" CreationDate="2017-04-28T14:50:13.977" Score="2" ViewCount="1779" Body="&lt;p&gt;I need to connect two Juniper routers with fastethernet interface. When I am connected by em0, I can check the connection between them by ping. But when I tried to set fe-0/0/0 in two routers, I can't ping them. I see this message: &lt;code&gt;ping: sendto: No route to host&lt;/code&gt;. How to fix this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My first router config is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fe-1/0/0 {&#xA;unit 0 {&#xA;    family inet {&#xA;        address 192.168.1.2/24;&#xA;    }&#xA;}&#xA;em1 {&#xA;description R1;&#xA;vlan-tagging;&#xA;unit 0 {&#xA;    vlan-id 10;&#xA;    family inet {&#xA;        address 192.168.10.1/30;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the second is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fe-1/0/0 {&#xA;unit 0 {&#xA;    family inet {&#xA;        address 192.168.1.1/24;&#xA;    }&#xA;}&#xA;em1 {&#xA;description R2;&#xA;vlan-tagging;&#xA;unit 0 {&#xA;    vlan-id 10;&#xA;    family inet {&#xA;        address 192.168.10.2/30;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The symptom:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root&amp;gt; ping 192.168.10.2&#xA;PING 192.168.10.2 (192.168.10.2): 56 data bytes&#xA;64 bytes from 192.168.10.2: icmp_seq=0 ttl=64 time=16.168 ms&#xA;64 bytes from 192.168.10.2: icmp_seq=1 ttl=64 time=5.968 ms&#xA;64 bytes from 192.168.10.2: icmp_seq=2 ttl=64 time=3.244 ms&#xA;^Z&#xA;Suspended&#xA;root@% ping 192.168.1.2&#xA;PING 192.168.1.2 (192.168.1.2): 56 data bytes&#xA;ping: sendto: No route to host&#xA;ping: sendto: No route to host&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36365" LastEditorUserId="20757" LastEditDate="2017-04-28T18:23:11.873" LastActivityDate="2017-04-30T08:31:52.037" Title="How to connect two Juniper gns3 with fastethernet?" Tags="|juniper|juniper-junos|gns3|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40765" PostTypeId="2" ParentId="40217" CreationDate="2017-04-28T15:11:24.183" Score="0" Body="&lt;p&gt;I'm going to go out on a limb here, please let me know if this isn't what you're after.  I think you might be getting bitten by what is basically a syntax issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;both [edit firewall filter] and [edit firewall family inet filter] are valid configuration hierarchies.  the [edit firewall filter] configuration section was left over from much earlier releases of JUNOS, and while can still be valid in some scenarios, it's a lot more clear to use family inet (it's also best practice). &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DYNINTF-STACKED-KANTOOR-TEST {&#xA;    interfaces {&#xA;        &quot;$junos-interface-ifd-name&quot; {&#xA;            unit &quot;$junos-interface-unit&quot; {&#xA;                proxy-arp restricted;&#xA;                vlan-tags outer &quot;$junos-stacked-vlan-id&quot; inner &quot;$junos-vlan-id&quot;;&#xA;                filter {&#xA;                    input &quot;$junos-input-filter&quot;;&#xA;                    output &quot;$junos-output-filter&quot;;&#xA;                }&#xA;                family inet {&#xA;                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What you should likely have is this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DYNINTF-STACKED-KANTOOR-TEST {&#xA;    interfaces {&#xA;        &quot;$junos-interface-ifd-name&quot; {&#xA;            unit &quot;$junos-interface-unit&quot; {&#xA;                proxy-arp restricted;&#xA;                vlan-tags outer &quot;$junos-stacked-vlan-id&quot; inner &quot;$junos-vlan-id&quot;;&#xA;                family inet {&#xA;                    filter {&#xA;                        input &quot;$junos-input-filter&quot;;&#xA;                        output &quot;$junos-output-filter&quot;;&#xA;                    }                    &#xA;                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, basically, you're not defining the filter as &quot;inet&quot; in your dynamic-profile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OR&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It could be your filter itself that you're not defining as &quot;inet&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;jhead@lab01# show firewall family inet filter 17Mb&#xA;term test {&#xA;    then policer 17Mb-policer;&#xA;}&#xA;&#xA;jhead@lab# show firewall policer 17Mb-policer&#xA;if-exceeding {&#xA;    bandwidth-limit 17m;&#xA;    burst-size-limit 1m;&#xA;}&#xA;then discard;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Or it could be both.&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="3075" LastActivityDate="2017-04-28T15:11:24.183" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40766" PostTypeId="1" AcceptedAnswerId="41427" CreationDate="2017-04-28T15:20:45.233" Score="2" ViewCount="1086" Body="&lt;p&gt;As the title says,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does a &quot;advsecurity&quot; license enables &quot;crypto isakmp&quot; on a Cisco C891F?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the show license output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Index 1 Feature: advipservices&#xA;    Period left: Life time&#xA;    License Type: Permanent&#xA;    License State: Active, In Use&#xA;    License Count: Non-Counted&#xA;    License Priority: Medium&#xA;Index 2 Feature: advsecurity&#xA;Index 3 Feature: ios-ips-update&#xA;    Period left: Not Activated&#xA;    Period Used: 0  minute  0  second&#xA;    License Type: EvalRightToUse&#xA;    License State: Not in Use, EULA not accepted&#xA;    License Count: Non-Counted&#xA;    License Priority: None&#xA;Index 4 Feature: MEM-8XX-512U1GB&#xA;    Period left: Not Activated&#xA;    Period Used: 0  minute  0  second&#xA;    License Type: EvalRightToUse&#xA;    License State: Not in Use, EULA not accepted&#xA;    License Count: Non-Counted&#xA;    License Priority: None&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is the abbreviated show version output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco IOS Software, C800 Software (C800-UNIVERSALK9-M), Version 15.3(3)M6, &#xA;RELEASE SOFTWARE (fc1)&#xA;Technical Support: http://www.cisco.com/techsupport&#xA;Copyright (c) 1986-2015 by Cisco Systems, Inc.&#xA;Compiled Tue 04-Aug-15 05:50 by prod_rel_team&#xA;&#xA;ROM: System Bootstrap, Version 15.4(1r)T1, RELEASE SOFTWARE (fc1)&#xA;&#xA;License Information for 'c800'&#xA;  License Level: advipservices   Type: Permanent&#xA;  Next reboot license Level: advipservices&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I currently cannot use &quot;crypto isakmp&quot; and I believe it is due to not having this license.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will the &quot;advsecurity&quot; license enable it or is it not supported on this hardware?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cheers!&lt;/p&gt;&#xA;" OwnerDisplayName="user34559" LastActivityDate="2021-02-10T18:10:57.490" Title="Does a &quot;advsecurity&quot; license enables &quot;crypto isakmp&quot; on a Cisco C891F?" Tags="|cisco|cisco-ios-15|cisco-isr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40768" PostTypeId="1" AcceptedAnswerId="40769" CreationDate="2017-04-28T16:44:41.107" Score="2" ViewCount="157" Body="&lt;p&gt;More exactly: Which protocol is embedded into which?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The relevant &lt;a href=&quot;https://en.wikipedia.org/wiki/Wi-Fi_Protected_Access&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wiki page&lt;/a&gt; describes only the protocol, but not its relation to the ethernet. It isn't even made clear if it uses embedded ethernet packets in it, or it is some modification of it (i.e. a different L2 protocol, using the same 48-bit addressing scheme).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Digging some Linux kernel sources also doesn't reveal too much - most of the WPA communication is being done by hardware support, as I understood it, the kernel can see only an ethernet interface from it.&lt;/p&gt;&#xA;" OwnerUserId="20757" LastEditorUserId="8499" LastEditDate="2018-10-26T19:13:11.077" LastActivityDate="2018-10-26T19:35:49.423" Title="How does the encrypted Wi-Fi protocols relate to ethernet?" Tags="|ethernet|wireless|ieee-802.11|protocol-theory|layer2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40769" PostTypeId="2" ParentId="40768" CreationDate="2017-04-28T16:48:55.553" Score="2" Body="&lt;p&gt;Ethernet (IEEE 802.3) is a completely separate protocol from Wi-Fi (IEEE 802.11). The IEEE has had and maintained multiple different LAN protocols. For example, there is token ring (IEEE 802.5), and it has no relationship to either ethernet or Wi-Fi. They are simply separate LAN protocols maintained by the same standards body.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-28T16:48:55.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40773" PostTypeId="1" CreationDate="2017-04-28T22:55:20.113" Score="7" ViewCount="10875" Body="&lt;p&gt;I need to have a site to site VPN between two sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the following topology for each site:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Site A: One Cisco 1921 WAN port (192.168.3.2) connected to ISP router (192.168.3.66), both the Cisco 1921 and the ISP's router are doing NAT Overload.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Site B: One Cisco 1921 WAN port (192.168.2.2) connected to the ISP router (192.168.2.66), both the Cisco 1921 and the ISP's router are doing NAT Overload.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;From the above topology it is clear that I do not have control over the ISP router to do port forwarding.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I successfully configure a Site-to-Site IPSec tunnel between the two routers?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not asking about &quot;How to do the VPN in Cisco IOS&quot;, I know how to do it. But I am wondering, how is it possible to make a VPN tunnel over such double NATing considering that port forwarding is not possible on the ISP router?&lt;/p&gt;&#xA;" OwnerUserId="36378" LastEditorUserId="453" LastEditDate="2017-05-27T03:37:08.760" LastActivityDate="2017-07-26T06:37:33.410" Title="How to make IPSEC over double NAT?" Tags="|nat|ipsec|" AnswerCount="4" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="40776" PostTypeId="2" ParentId="40642" CreationDate="2017-04-29T08:40:52.370" Score="3" Body="&lt;p&gt;I think there is a gap in your knowledge perhaps because your question is not 100% clear to me, it doesn't make perfect sense.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;What is the need for ISP now - ring protection link protocol, ECFM, UP MEPS, DOWN MEPS - basically L2 protocols?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ethernet CFM (Connectivity Fault Management) is used by ISPs with Metro Ethernet Networks a.k.a &quot;Met-Nets&quot; or &quot;MANs&quot; (Metropolitan Area Networks that have a continuous Ethernet broadcast domain across the backbone rather that layer 3 between hops). Ethernet CFM and OAM are commonly deployed hand-in-hand in Metro Ethernet Provider or Carrier Ethernet Provider networks to provide service performance statistics and fault identification at the data plane level, to get the same view of the network as the customer.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Or ISP needs only MPLS, L3, VPLS, VPWS - L3 protocols only now. I am asking this question is do we need to know these L2 protocols and are they being used by the industry or ISP? Does with L3 protocol there is no need to worry about ECFM,RPL, or MEF-8 protocols.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes ISPs are using those layer 2 protocols as I described above. MPLS layer 3 VPNs and layer 2 VPNs are overlay services that ISPs can provide across their network. These are services provided to their end customers. Even though the end customers maybe taking an IPVPN service at layer 3 (such as an MPLS L3 VPN for example) the underlying provider backbone may have some layer 2 sections using CFM and OAM to provide monitoring, measuring, fault identification etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So hopefully it is clear to you now that running CFM and OAM protocols is independent of whether the customer is taking a L2 VPN or L3 VPN service from the ISP. If the customer is taking a layer 2 VPN service then the service provider can extend their CFM and OAM configuration to include that customers' service (they can include the customers interfaces in MEPs) but if they are taking a layer 3 service over a layer 2 backbone, then perhaps just the backbone is covered by the ISPs CFM/OAM configuration.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="775" LastEditDate="2017-05-06T23:13:43.187" LastActivityDate="2017-05-06T23:13:43.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40777" PostTypeId="5" CreationDate="2017-04-29T08:50:59.100" Score="0" Body="&lt;p&gt;Questions relating to the configuration, troubleshooting and operating of Internet Key Exchange (IKE, sometimes IKEv1 or IKEv2, depending on version). This is the protocol used to set up a security association (SA) in the IPsec protocol suite. There are separate tags available for VPNs in general, firewalls and IPSEC etc.&lt;/p&gt;&#xA;" OwnerUserId="253" LastEditorUserId="253" LastEditDate="2017-04-29T12:48:20.313" LastActivityDate="2017-04-29T12:48:20.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40778" PostTypeId="4" CreationDate="2017-04-29T08:50:59.100" Score="0" Body="Questions relating to Internet Key Exchange (all versions) configuration, troubleshooting and operating." OwnerUserId="253" LastEditorUserId="253" LastEditDate="2017-04-29T12:48:15.880" LastActivityDate="2017-04-29T12:48:15.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40791" PostTypeId="2" ParentId="40764" CreationDate="2017-04-30T08:31:52.037" Score="2" Body="&lt;p&gt;The &lt;code&gt;em&lt;/code&gt; interfaces are the only usable interfaces on an Olive (Junos emulator). Although Junos will let you configure other interfaces, they will not show up, nor will the prefixes you assign to them be installed in the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can easily check this for yourself :&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuring three interfaces on an emulated Juniper :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root&amp;gt; show configuration interfaces | display set &#xA;set interfaces fe-0/0/0 unit 0 family inet address 10.10.10.1/30&#xA;set interfaces ge-0/0/1 unit 0 family inet address 10.10.99.1/30&#xA;set interfaces em0 unit 0 family inet address 192.168.99.1/30&#xA;&#xA;root&amp;gt; &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Check your interfaces - the (Fast/Gigabit) ethernet interfaces do not show up :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root&amp;gt; show interfaces terse &#xA;Interface               Admin Link Proto    Local                 Remote&#xA;cbp0                    up    up &#xA;demux0                  up    up &#xA;dsc                     up    up &#xA;em0                     up    up &#xA;em0.0                   up    up   inet     192.168.99.1/30 &#xA;em1                     up    up &#xA;em2                     up    up &#xA;em3                     up    up &#xA;gre                     up    up &#xA;&amp;lt;...&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Same goes for your routing table :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;root&amp;gt; show route &#xA;&#xA;inet.0: 2 destinations, 2 routes (2 active, 0 holddown, 0 hidden)&#xA;+ = Active Route, - = Last Active, * = Both &#xA;192.168.99.0/30    *[Direct/0] 00:12:13&#xA;                    &amp;gt; via em0.0&#xA;192.168.99.1/32    *[Local/0] 00:12:13&#xA;                      Local via em0.0&#xA;&#xA;root&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please note that this behaviour (the ability of creating configurations for non-existing interfaces) mimicks the behaviour of 'real' Juniper routers (which makes sense, because an Olive is an emulator) : In real life, you will also be able to prepare and commit your configurations, for example prior to inserting a new linecard.&lt;/p&gt;&#xA;" OwnerUserId="22215" LastActivityDate="2017-04-30T08:31:52.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40793" PostTypeId="2" ParentId="17195" CreationDate="2017-04-30T11:35:29.147" Score="-1" Body="&lt;p&gt;If it goes by satellite then like 22000 miles * 2 one way is like 44000/186282.4 or like 236 milliseconds at least since macines are more like 50%c you can expect one way times to be greater. then if the pings are shorter it can not be going by satellite, something funny is going on. :-O&lt;/p&gt;&#xA;" OwnerUserId="36400" LastActivityDate="2017-04-30T11:35:29.147" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40794" PostTypeId="2" ParentId="17195" CreationDate="2017-04-30T12:24:42.690" Score="3" Body="&lt;p&gt;Not really.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes there is certainly a correlation between ping time and distance. However there are many factors other than distance that can lead to a high ping. Congestion, crappy routing, Satellite links etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So attempting to use ping time as a geoblocking measure is likely to have an unacceptably high false positive rate.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-04-30T12:24:42.690" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40796" PostTypeId="1" AcceptedAnswerId="40805" CreationDate="2017-04-30T16:27:56.360" Score="2" ViewCount="204" Body="&lt;p&gt;I'm planning a little network here and I'm not sure about one thing. Network structure is shown on the image below. ISP binds an IP to a MAC address, so if certain MAC is connected, it gets assigned certain IP and gets access to Internet. There is no need for &lt;code&gt;Switch 1&lt;/code&gt; and &lt;code&gt;Switch 2&lt;/code&gt; to be manageable.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;For this setup shown below, does &lt;code&gt;Primary switch&lt;/code&gt; has to be&#xA;manageable one?&lt;/li&gt;&#xA;&lt;li&gt;Am I correct in my understanding, that in this scenario, &lt;code&gt;Primary&#xA;switch&lt;/code&gt; would have to clone MAC address registered with ISP, then&#xA;assign IPs to &lt;code&gt;Router 1&lt;/code&gt;, &lt;code&gt;Router 2&lt;/code&gt; and &lt;code&gt;Router 3&lt;/code&gt; (for example,&#xA;192.168.0.2, 192.168.0.3 and 192.168.0.4 respectively) and rest of the elements in the network can get their IPs either from the router&#xA;they're connected to or from the &lt;code&gt;Primary switch&lt;/code&gt;?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/AWsHi.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/AWsHi.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17532" LastEditorUserId="8499" LastEditDate="2019-01-02T22:51:10.410" LastActivityDate="2019-01-02T22:51:10.410" Title="Question about a switch" Tags="|switch|router|nat|network|internet|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="40799" PostTypeId="1" CreationDate="2017-04-30T17:09:44.850" Score="1" ViewCount="399" Body="&lt;p&gt;When Encapsulating Security Payload (ESP) is used in the tunnel mode, a new IP header is computed and added. Why is this necessary? Thank you.&lt;/p&gt;&#xA;" OwnerUserId="36405" LastActivityDate="2018-06-25T16:21:00.083" Title="ESP in tunnel mode" Tags="|ip|tunnel|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40800" PostTypeId="2" ParentId="40799" CreationDate="2017-04-30T17:14:39.787" Score="1" Body="&lt;p&gt;A tunnel wraps packets inside other packets, so you have different packet headers for the outer packets. This is true even if the tunnel is not encrypted, e.g. GRE.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-30T17:14:39.787" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40802" PostTypeId="1" CreationDate="2017-04-30T19:27:43.300" Score="1" ViewCount="97" Body="&lt;p&gt;what is the slash form of the subnet mask 255.224.252.0 and if it is invalid, then why is it invalid. I am having trouble with this address mask. Could anyone help!&lt;/p&gt;&#xA;" OwnerUserId="36408" LastActivityDate="2017-04-30T19:39:13.893" Title="Network Subnet Mask" Tags="|network|" AnswerCount="1" CommentCount="1" ClosedDate="2017-04-30T22:21:57.190" ContentLicense="CC BY-SA 3.0" />
  <row Id="40803" PostTypeId="2" ParentId="40802" CreationDate="2017-04-30T19:39:13.893" Score="3" Body="&lt;p&gt;Subnet masks are always in the form (left to right) of contiguous ones, followed by zeros.  You can't have ones, then zeros, then more ones.  If you convert your mask to binary, you will see that you don't have a valid mask for exactly that reason.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-04-30T19:39:13.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40805" PostTypeId="2" ParentId="40796" CreationDate="2017-04-30T22:32:22.780" Score="2" Body="&lt;p&gt;You have the router and switch scenario backwards. You need a router to connect to your ISP. Routers route between networks, and you need that to route between your network and the ISP network. While layer-3 switches can route, they cannot do NAT, which you will need if you use private addressing on your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where you have routers, you probably want layer-3 switches. Router interfaces are expensive compared to switch interfaces, and you rarely want to use a router interface for a single host. Layer-3 switches will allow you to have different networks behind each switch, and still have a high access interface density. It may also eliminate the need for the next level of switches.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-04-30T22:32:22.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40811" PostTypeId="1" AcceptedAnswerId="40813" CreationDate="2017-05-01T09:44:03.080" Score="5" ViewCount="1111" Body="&lt;p&gt;I am just learning the differences between routers and AP. Based on what I have understood, AP just acts like a wireless switch enabling multiple devices to connect to a single router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since it is possible to build a LAN with just a single switch, is it possible to build a LAN with single AP without internet access?&lt;/p&gt;&#xA;" OwnerUserId="34757" LastEditorUserId="8499" LastEditDate="2018-11-04T18:50:05.643" LastActivityDate="2018-11-04T18:50:05.643" Title="Is it possible to build a LAN with just Access Points?" Tags="|switch|router|wireless|ieee-802.11|access-point|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40812" PostTypeId="1" AcceptedAnswerId="40814" CreationDate="2017-05-01T10:21:39.767" Score="2" ViewCount="928" Body="&lt;p&gt;topic : IPv4 multicast addresses as per &lt;a href=&quot;http://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IANA docs&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to register these addresses or they are reserved like 0.0.0.0/8, 10.0.0.0/8, 127.0.0.0/24, etc... ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When we read a specific multicast group is used by a software/vendor, is it possible the vendor is the owner of the address space including the multicast ip, or never possible ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE : I don't want to register one.&lt;/p&gt;&#xA;" OwnerUserId="36428" LastEditorUserId="8499" LastEditDate="2018-03-19T21:18:12.003" LastActivityDate="2018-03-19T21:18:12.003" Title="is it possible to register multicast IP addresses?" Tags="|ipv4|multicast|standardisation|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40813" PostTypeId="2" ParentId="40811" CreationDate="2017-05-01T12:35:30.123" Score="5" Body="&lt;p&gt;Yes, it's possible.  Your wireless clients can communicate with each other (although on some consumer devices, you have to explicitly allow this).&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-01T12:35:30.123" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40814" PostTypeId="2" ParentId="40812" CreationDate="2017-05-01T12:52:50.720" Score="0" Body="&lt;p&gt;There are certain blocks of multicast address space reserved for certain things. For example, the &lt;code&gt;224.0.0.0/24&lt;/code&gt; block is reserved for local network control (Link-Local), and multicast addresses in this block should not be forwarded to another LAN, even with multicast routing enabled.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See the IANA &lt;a href=&quot;https://www.iana.org/assignments/multicast-addresses/multicast-addresses.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;IPv4 Multicast Address Space Registry&lt;/em&gt;&lt;/a&gt; and &lt;a href=&quot;https://www.iana.org/assignments/ipv6-multicast-addresses/ipv6-multicast-addresses.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;IPv6 Multicast Address Space Registry&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Ad-Hoc blocks are used to register/reserve addresses for various functions, but it requires &quot;&lt;em&gt;Expert Review, IESG Approval, or Standards Action&lt;/em&gt;.&quot; Basically, you need to get a consensus. The best way would be to get an RFC approved, but notice that some companies have registered multicast address space. For example, &lt;code&gt;224.0.19.0-224.0.19.63&lt;/code&gt; is registered to the Walt Disney Company.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-01T13:03:06.517" LastActivityDate="2017-05-01T13:03:06.517" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="40815" PostTypeId="2" ParentId="40811" CreationDate="2017-05-01T12:59:38.180" Score="4" Body="&lt;p&gt;A LAN is a layer-2 network, and all hosts on a LAN are peers. Routers route between networks, not from a LAN back to the same LAN. Switches and WAPs are bridges that operate on layer-2 LANs, and neither requires a router unless the hosts need to communicate to/from a different LAN.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-01T12:59:38.180" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40816" PostTypeId="2" ParentId="40217" CreationDate="2017-05-01T13:04:40.077" Score="1" Body="&lt;p&gt;So you need two dynamic profiles. A VLAN and an IP profile. The VLAN profile is for creating dynamic profiles and the IP profile is for applying filters to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice the use of $junos-underlhing-interface-unit which is basically the dynamically created unit by the VLAN profile.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN profile:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DYNINTF-VLAN-DHCP-INET-KPN {&#xA;    interfaces {&#xA;        &quot;$junos-interface-ifd-name&quot; {&#xA;            unit &quot;$junos-interface-unit&quot; {&#xA;                proxy-arp restricted;&#xA;                vlan-id &quot;$junos-vlan-id&quot;;&#xA;                family inet {&#xA;                    unnumbered-address lo0.0 preferred-source-address 10.110.110.1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA; }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IP profile:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; DYNSUB-IP-PROFILE-KPN {&#xA;    interfaces {&#xA;        &quot;$junos-interface-ifd-name&quot; {&#xA;            unit &quot;$junos-underlying-interface-unit&quot; {&#xA;                family inet {&#xA;                    filter {&#xA;                        input &quot;$junos-input-filter&quot;;&#xA;                        output &quot;$junos-output-filter&quot;;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;--&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my situation, i have two VLAN profiles. One for single and one for stacked VLAN customers. The IP profile is configured under the DHCP group for the whole interface while only the stacked VLAN profiles should use them. If anyone got an idea for this, I'm happy to hear you out :-)&lt;/p&gt;&#xA;" OwnerUserId="20112" LastEditorUserId="20112" LastEditDate="2017-05-02T06:55:53.590" LastActivityDate="2017-05-02T06:55:53.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40820" PostTypeId="1" CreationDate="2017-05-01T15:44:33.543" Score="2" ViewCount="30379" Body="&lt;p&gt;We are having trouble when test the VPN remote-access with the above error. It returned domain name successfully when we run nslookup &quot;router_IP&quot; in window CMD but it keeps prompting the error window when we connected via Cisco Any Connect 3.1. We have Router cisco 3925, iOS Version 15.1(1)T1. Please help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Updated1: Router's config&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model  &#xA;aaa authentication login AuthenList local  &#xA;aaa authorization network vpn-group local  &#xA;username vpn1 secret 5 xxxx  &#xA;&#xA;crypto isakmp policy 10  &#xA; encr 3des  &#xA; hash md5  &#xA; authentication pre-share  &#xA; group 2  &#xA;&#xA;ip local pool remote-pool 10.223.131.35 10.223.131.50  &#xA;&#xA;crypto isakmp client configuration group cisco  &#xA; key xxxx  &#xA; pool remote-pool  &#xA;&#xA;crypto ipsec transform-set set1 esp-3des esp-md5-hmac  &#xA;crypto dynamic-map map1 10  &#xA; set transform-set set1  &#xA; reverse-route  &#xA;&#xA;crypto map map1 client authentication list AuthenList  &#xA;crypto map map1 isakmp authorization list vpn-group  &#xA;crypto map map1 client configuration address respond  &#xA;crypto map map1 10 ipsec-isakmp dynamic map1  &#xA;&#xA;&#xA;interface GigabitEthernet0/1  &#xA; ip address A.B.C.D xxxx  &#xA; ip nat outside  &#xA; ip virtual-reassembly  &#xA; duplex auto  &#xA; speed auto  &#xA; crypto map map1  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The error:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;The VPN connection failed due to unsuccessful domain name resolution&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;when I entered the domain name of router's interface g0/1 from nslookup (server 8.8.8.8)**  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Updated2:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I could do forward nslookup but reverse lookup (domain name -&gt; IP) returns failed. Is it a problem?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update3:&lt;/strong&gt;&lt;br&gt;&#xA;In router's config:&lt;br&gt;&#xA;ip name-server 8.8.8.8  &lt;/p&gt;&#xA;" OwnerUserId="36386" LastEditorUserId="36386" LastEditDate="2017-05-02T13:01:09.973" LastActivityDate="2021-02-21T09:22:07.873" Title="The VPN connection failed due to unsuccessful domain name resolution" Tags="|cisco|router|vpn|firewall|cisco-anyconnect|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="40821" PostTypeId="2" ParentId="40811" CreationDate="2017-05-01T17:51:45.517" Score="3" Body="&lt;p&gt;Yes, you can. Computers in this case are in the same network, and they can communicate with each other through the AP.&lt;/p&gt;&#xA;" OwnerUserId="35524" LastEditorUserId="20757" LastEditDate="2017-05-08T02:24:16.677" LastActivityDate="2017-05-08T02:24:16.677" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40822" PostTypeId="1" CreationDate="2017-05-01T18:12:10.903" Score="0" ViewCount="260" Body="&lt;p&gt;Can anyone tell me if the TTL of an IPv4 packet can be 850?&#xA;I thought the maximum was 255.&lt;/p&gt;&#xA;" OwnerUserId="36430" LastEditorUserId="189" LastEditDate="2017-05-01T19:16:22.150" LastActivityDate="2017-05-01T19:16:22.150" Title="Maximum value of IPv4 TTL" Tags="|switch|ipv4|" AnswerCount="1" CommentCount="8" ClosedDate="2018-02-19T03:53:15.293" ContentLicense="CC BY-SA 3.0" />
  <row Id="40823" PostTypeId="1" AcceptedAnswerId="40825" CreationDate="2017-05-01T18:16:24.230" Score="2" ViewCount="6396" Body="&lt;p&gt;On my quest to understand what AP is and how it works, I came across article that says this:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Most often, there are different BSSIDs on an access point for each&#xA;  WLAN configured on a radio. If you have an access point with 2 radios&#xA;  and 32 WLANs configured on each, you would have 64 BSSIDs plus the&#xA;  base access point BSSID. To accommodate the multiple BSSIDs, each&#xA;  access point is assigned a unique block of 64 MAC addresses. Each&#xA;  radio has 32 MAC addresses and supports up to 32 service set&#xA;  identifiers (SSIDs), with one MAC address assigned to each SSID as a&#xA;  basic service set identification (BSSID). All MAC addresses for an&#xA;  access point are assigned based on the base MAC address of the access&#xA;  point.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Source Link: &lt;a href=&quot;https://www.juniper.net/techpubs/en_US/network-director1.5/topics/concept/wireless-ssid-bssid-essid.html#jd0e47&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.juniper.net/techpubs/en_US/network-director1.5/topics/concept/wireless-ssid-bssid-essid.html#jd0e47&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My Confusion:&lt;/strong&gt;&#xA;I just cannot understand that.I thought each &lt;code&gt;AP&lt;/code&gt; has one &lt;code&gt;MAC&lt;/code&gt; address (BSSID), but above it says &quot;each access point is assigned a unique block of 64 &lt;code&gt;MAC&lt;/code&gt; addresses&quot;? And what does &lt;strong&gt;&lt;code&gt;radio&lt;/code&gt;&lt;/strong&gt; mean in the  above context?&lt;/p&gt;&#xA;" OwnerUserId="34757" LastEditorUserId="40371" LastEditDate="2018-11-26T13:58:03.970" LastActivityDate="2018-11-26T13:58:03.970" Title="Is it possible to setup multiple Networks on a single Access Point?" Tags="|routing|wireless|ieee-802.11|access-point|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="40824" PostTypeId="2" ParentId="40822" CreationDate="2017-05-01T18:29:01.207" Score="3" Body="&lt;p&gt;No , TTL is an 8 bit field so it can't be more than 255&lt;/p&gt;&#xA;" OwnerUserId="35524" LastActivityDate="2017-05-01T18:29:01.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40825" PostTypeId="2" ParentId="40823" CreationDate="2017-05-01T18:43:39.690" Score="3" Body="&lt;p&gt;As put in &lt;em&gt;Cisco Networking for Dummies&lt;/em&gt; article on &lt;strong&gt;Multiple SSIDs with a Single Access Point (AP)&lt;/strong&gt; (&lt;a href=&quot;https://www.dummies.com/programming/networking/cisco/multiple-ssids-with-a-single-access-point-ap/&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt;)&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The Service Set Identifier (SSID) defines what is thought of as the wireless network. So if you have an SSID that is called Apple and your neighbor’s SSID is called Orange, people can connect to either the Apple or Orange wireless network. You would expect that the Apple wireless network is not connected to the same wired network as the Orange wireless network.&lt;/p&gt;&#xA;&lt;p&gt;So you can mistakenly think of those two SSIDs being associated with different physical networks.&lt;/p&gt;&#xA;&lt;p&gt;In addition to multiple access points broadcasting or using the same SSID, a single access point can also use multiple SSIDs. Granted, using multiple SSIDs makes sense only if the AP allows you to map each one to a different network connection. This mapping would typically be accomplished through the use of VLAN tagging.&lt;/p&gt;&#xA;&lt;p&gt;If the user’s device associates with a particular SSID, this traffic is then passed to the network switch destined for a specific VLAN. This switch allows each network to have a different set of security standards surrounding it.&lt;/p&gt;&#xA;&lt;p&gt;For example, you may have a wireless network, CorpSSID, which uses certificate-based authentication via WPA2 and AES encryption while using the same APs to provide a second wireless network, GuestSSID, which uses only WEP.&lt;/p&gt;&#xA;&lt;p&gt;Even though you are providing two wireless networks, you can isolate guest traffic from the rest of the corporate network and allow the guest devices to use only some services, such as allowing them through the firewall to get out to the Internet on ports 80 and 443.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="35524" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2018-11-26T13:55:50.147" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40826" PostTypeId="1" AcceptedAnswerId="40828" CreationDate="2017-05-01T19:26:33.127" Score="1" ViewCount="97" Body="&lt;p&gt;if we do not configure HSRP or another protocol ,How data will flood if there is redundancy ?&#xA;please help me I need some explain about load balancing &lt;/p&gt;&#xA;" OwnerUserId="35524" LastEditorUserId="35524" LastEditDate="2017-05-01T20:59:49.543" LastActivityDate="2017-05-02T00:02:20.387" Title="How can use Load balancing?" Tags="|router|redundancy|load-balancing|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40828" PostTypeId="2" ParentId="40826" CreationDate="2017-05-02T00:02:20.387" Score="2" Body="&lt;p&gt;How the data will flood (if it will) depends on the design.&#xA;If there it is a complete L2 network, then by the routes on the host it will forward the packets to the gateway. For that it needs the MAC of the gateway. If both gateways have the same IP, then the gateway that replies first for the ARP is selected. If they have different Ip then the gateway that is configured at the host will reply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the layer 3 network. it depends on the discretion of the routing protocol. If BGP is used than the admin has the flexibility of choosing the gateway.&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-05-02T00:02:20.387" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40829" PostTypeId="2" ParentId="40086" CreationDate="2017-05-02T06:44:29.827" Score="0" Body="&lt;p&gt;If your network now are working well, you don't have to change it. &lt;/p&gt;&#xA;" OwnerUserId="35541" LastActivityDate="2017-05-02T06:44:29.827" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40830" PostTypeId="1" AcceptedAnswerId="41313" CreationDate="2017-05-02T08:28:09.327" Score="1" ViewCount="4020" Body="&lt;p&gt;I have an ASA 5512-X and have the Problem, that when I'm starting an SSH session and leave it running, it cancels the conenction after 60 Minutes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have two Policy Rules &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;  no tcp-inspection&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect sip  &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;  inspect icmp &#xA;  inspect http &#xA; class class-default&#xA;  user-statistics accounting&#xA;!&#xA;service-policy global_policy global&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also see this line in my configugartion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I change the timeout conn to 3 hours ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="22401" LastActivityDate="2019-07-04T09:58:24.837" Title="ASA Idle Connection Timout 60 Minutes" Tags="|cisco|cisco-asa|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40832" PostTypeId="2" ParentId="9571" CreationDate="2017-05-02T09:30:22.423" Score="-3" Body="&lt;p&gt;simply assume that we have 2 connected devices and each one has a network card.&#xA;now, if there was only one service( not exactly service, anything like an osm software,...) in each device, you are right, no need to IP, but consider there are many services in each device and these services should communicate with each other without any conflict.&#xA;so in addition to mac address to identify the device, we need something else( we call it IP) for each service.&lt;/p&gt;&#xA;" OwnerUserId="36442" LastActivityDate="2017-05-02T09:30:22.423" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40833" PostTypeId="1" CreationDate="2017-05-02T10:17:31.277" Score="2" ViewCount="971" Body="&lt;p&gt;I have configured subscriber management on an interface on my MX80 router. Both single and dual-stacked customers can be assigned (an) IP-address(es).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For this I have created two dynamic VLAN profiles for creating virtual VLAN interfaces. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DYNINTF-VLAN-DHCP-INET-KPN {&#xA;interfaces {&#xA;    &quot;$junos-interface-ifd-name&quot; {&#xA;        unit &quot;$junos-interface-unit&quot; {&#xA;            proxy-arp restricted;&#xA;            vlan-id &quot;$junos-vlan-id&quot;;&#xA;            family inet {&#xA;                unnumbered-address lo0.0 preferred-source-address xx.xx.xx.xx;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;DYNINTF-STACKED-VLAN-INET-KPN {&#xA;interfaces {&#xA;    &quot;$junos-interface-ifd-name&quot; {&#xA;        unit &quot;$junos-interface-unit&quot; {&#xA;            proxy-arp restricted;   &#xA;            vlan-tags outer &quot;$junos-stacked-vlan-id&quot; inner &quot;$junos-vlan-id&quot;;&#xA;            family inet {&#xA;                unnumbered-address lo0.0 preferred-source-address xx.xx.xx.xx;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For traffic policing on stacked VLANs, I have created a dynamic IP profile:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DYNSUB-IP-PROFILE-KPN {&#xA;    interfaces {&#xA;        &quot;$junos-interface-ifd-name&quot; {&#xA;            unit &quot;$junos-underlying-interface-unit&quot; {&#xA;                family inet {&#xA;                    filter {&#xA;                        input &quot;$junos-input-filter&quot;;&#xA;                        output &quot;$junos-output-filter&quot;;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;At last but not least, I have to configure the IP profile under the DHCP group for it to be active.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dhcp-local-server {&#xA;    group local-kpn {&#xA;        interface xe-0/0/3.0 {&#xA;            dynamic-profile DYNSUB-IP-PROFILE-KPN;&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this last profile activated, stacked VLAN customers get their IP addresses and traffic policies applied just fine, but single tagged VLAN customers don't. Deactivating the IP profile under the DHCP server group makes it work again for single tagged VLAN customers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would I solve this? I could create blank firewall filters for single tagged VLANs, but that seems like a dirty trick doesn't it?&lt;/p&gt;&#xA;" OwnerUserId="20112" LastActivityDate="2018-04-21T08:55:57.520" Title="MX80 Subscriber Management IP profile only active for stacked VLANs" Tags="|vlan|dhcp|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40836" PostTypeId="1" AcceptedAnswerId="40838" CreationDate="2017-05-02T15:54:28.803" Score="1" ViewCount="408" Body="&lt;p&gt;If I have two servers set up with peer-to-peer NTP and both have different times, how do they decide what time to use?&lt;/p&gt;&#xA;" OwnerUserId="36452" LastActivityDate="2017-05-02T17:02:52.933" Title="How does Peer-to-Peer NTP resolve time variance?" Tags="|ntp|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40837" PostTypeId="1" AcceptedAnswerId="40839" CreationDate="2017-05-02T17:01:37.710" Score="2" ViewCount="12489" Body="&lt;p&gt;According to Cisco documentation for logging, the &lt;code&gt;logging source-interface&lt;/code&gt; command is optional. But if set up it specifies that&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;syslog packets contain the IPv4 or IPv6 address of a specific interface, regardless of which interface the packet uses to exit the router.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I am confused as to what it is doing and why it is optional. At first I thought it was to indicate what interface to send the logging information out of. However, the above documentation indicates that this is not the case. If it has nothing to do with what exit interface is being used to send the logging packets, then what is its purpose?&lt;/p&gt;&#xA;" OwnerUserId="36452" LastActivityDate="2019-06-14T21:18:27.983" Title="What does Cisco's logging source-interface command do?" Tags="|logging|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40838" PostTypeId="2" ParentId="40836" CreationDate="2017-05-02T17:02:52.933" Score="2" Body="&lt;p&gt;Since neither peer is an authority, they will both adjust their clocks to the midpoint of the difference between them.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-02T17:02:52.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40839" PostTypeId="2" ParentId="40837" CreationDate="2017-05-02T17:29:02.673" Score="5" Body="&lt;p&gt;The source interface command specifies which interface IP address will be used as the source IP address of the syslog packets.  The actual outgoing interface will be determined by the routing table.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-02T17:29:02.673" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40842" PostTypeId="1" AcceptedAnswerId="40846" CreationDate="2017-05-02T18:08:43.067" Score="1" ViewCount="826" Body="&lt;p&gt;why when ping an IP address we get 4 replies ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="35524" LastEditorUserId="35524" LastEditDate="2017-05-02T22:59:16.707" LastActivityDate="2017-05-02T22:59:16.707" Title="Ping IP address , 4 Replies" Tags="|ping|icmp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40843" PostTypeId="2" ParentId="40842" CreationDate="2017-05-02T18:16:12.057" Score="2" Body="&lt;p&gt;I will assume you're using a Windows PC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you &quot;ping,&quot; your computer sends (by default) four ICMP echo requests.   Each request will get a reply (if everything is working properly).  So you see each of the four replies.  You can change the number of echo requests with the &quot;-n&quot; switch.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-05-02T18:18:57.867" LastActivityDate="2017-05-02T18:18:57.867" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40844" PostTypeId="1" CreationDate="2017-05-02T20:43:18.010" Score="2" ViewCount="17580" Body="&lt;p&gt;So I am in the process of upgrading our Cisco AnyConnect client on our ASA from 3.1 to 4.4 for an upcoming ISE upgrade.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've transferred the files to the ASA's flash, and we are ready to change the &quot;anyconnect image XXXX&quot; in the configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything that will need to be done on user's computers?  It's mostly people in the IT department that use AnyConnect from home when needed.  Will the AnyConnect client on the user's computers simply pull the required files from the ASA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sorry if this is vague or not accurate, but I cannot seem to find the information I'm looking for, and this is my first time dabbling with this.&lt;/p&gt;&#xA;" OwnerUserId="36457" LastActivityDate="2017-09-10T08:48:39.320" Title="How to Upgrade Cisco AnyConnect?" Tags="|cisco|cisco-asa|firewall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40845" PostTypeId="1" CreationDate="2017-05-02T21:06:41.463" Score="1" ViewCount="141" Body="&lt;p&gt;here is the scenario guys: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2 wlc (5508) in cluster, currently advertising 2 SSIDs, I want to advertise 2 more SSIDs with new vlans. 2 new SSIDs will be using their own RADIUS and NTP servers. Please help on how I can achieve this. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: I cant remove the old SSIDs untill we have rolled out the new ones and they are working properly. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help in advance!&lt;/p&gt;&#xA;" OwnerUserId="36458" LastActivityDate="2018-06-05T09:31:35.960" Title="Cisco Wireless Migration" Tags="|cisco|wireless|wlc|cisco-wireless|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40846" PostTypeId="2" ParentId="40842" CreationDate="2017-05-02T21:49:10.940" Score="2" Body="&lt;p&gt;Ping is just a small program which sends ICMP Echo Requests, and receives the ICMP Echo Replies. Actually, many different implementations of ping exist...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Windows, the default ping utility sends 4 echo request by default. So, when everything is working fine, you will see 4 echo replies. You can send more (or less) requests by passing the &lt;code&gt;-n&lt;/code&gt; option to the ping executable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On Unix systems, the default implementation will keep sending echo requests until  interrupted by the user (with Ctrl-C), and the option to send a specific number of requests is &lt;code&gt;-c&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="189" LastActivityDate="2017-05-02T21:49:10.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40847" PostTypeId="1" AcceptedAnswerId="40855" CreationDate="2017-05-02T22:57:39.583" Score="1" ViewCount="140" Body="&lt;p&gt;I have 2 Switches I made either channel between them , but every switch is connected with other links through other switches that can reach the destination and the spanning tree makes the channel not designated and all messages does not send through it .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;is there any way to select the path I want? ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way to change the cost ?&lt;/p&gt;&#xA;" OwnerUserId="35524" LastEditorUserId="35524" LastEditDate="2017-05-02T23:05:07.117" LastActivityDate="2017-05-03T05:05:33.263" Title="spanning tree, how can I change the path?" Tags="|switching|spanning-tree|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40848" PostTypeId="1" AcceptedAnswerId="40878" CreationDate="2017-05-02T23:15:28.350" Score="1" ViewCount="882" Body="&lt;p&gt;I have a catalyst 3750 which is giving me a headache.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have several &quot;customers&quot; who all produce an identical mixture of tagged and untagged traffic.  I want to take this traffic in and then pass it out on a trunk with a second 802.1Q tag (the customer or 'metro' tag) added on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem I have is that most of the untagged customer traffic is not being sent out the trunk.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vlan dot1q tag native&#xA;vlan 201-224,301-324,401-422&#xA;&#xA;interface GigabitEthernet1/0/1&#xA;  switchport access vlan 401&#xA;  switchport mode dot1q-tunnel&#xA;  switchport trunk native vlan 401 !  This doesn't seem to do anything.&#xA;  no keepalive&#xA;  no cdp enable&#xA;&#xA;interface GigabitEthernet1/0/2&#xA;  switchport access vlan 402&#xA;  switchport mode dot1q-tunnel&#xA;  no keepalive&#xA;  no cdp enable&#xA;&#xA;...&#xA;&#xA;&#xA;interface GigabitEthernet1/0/23&#xA;  !other switches trunk in through here to port 24&#xA;  switchport trunk encapsulation dot1q&#xA;  switchport trunk allowed vlan 201-224,301-324 &#xA;  switchport mode trunk&#xA;  switchport nonegotiate&#xA;  no keepalive&#xA;  no cdp enable&#xA;&#xA;interface GigabitEthernet1/0/24&#xA;  switchport trunk encapsulation dot1q&#xA;  switchport trunk allowed vlan 201-224,301-324,401-422&#xA;  switchport mode trunk&#xA;  switchport nonegotiate&#xA;  no keepalive&#xA;  no cdp enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit1:&lt;/strong&gt;  Setting the native vlan on the access ports does not seem to have any effect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit2:&lt;/strong&gt;  SSH traffic traverses the switch as expected (from trunk to access), but multicast traffic from access to trunk (such as RTPS) does not.  HOWEVER, I have now noticed that when the cable on the access port is unplugged and replugged, RTPS traffic is sent across the trunk as expected for about a second before disappearing again.  I have used an in-line data tap to confirm that the RTPS traffic is still reaching the switch (ie the RTPS traffic is not being turned off at the source)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit3:&lt;/strong&gt; Oops, multicast traffic from the other switches was being dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What works:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;tagged traffic entering port 1,2,... has a customer vlan tag of 401,402,... added and is sent out the trunk port (24)&lt;/li&gt;&#xA;&lt;li&gt;untagged traffic entering port 1,2,... of types ARP and MDNS has customer tags added and is sent out the trunk port (24) &lt;/li&gt;&#xA;&lt;li&gt;tagged unicast traffic from other switches (vlan range 201-224,301-324) transits the switch and emerges from the trunk port (24) unmolested&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What doesn't work:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;untagged traffic (mostly RTPS but also other stuff) entering port 1,2,... is dropped instead of being tagged and sent out the trunk port (24) &lt;/li&gt;&#xA;&lt;li&gt;tagged multicast traffic from the other switches (vlan range 201-224,301-324) is dropped instead of emerging from the trunk port 24.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Side Note:  this all works perfectly on my SG-300 (also a cisco switch) but the configuration language/syntax is completely different and sooooo much simpler. &quot;switchport mode customer/switchport customer vlan ###&quot;&lt;/p&gt;&#xA;" OwnerUserId="36459" LastEditorUserId="8499" LastEditDate="2018-12-25T04:58:06.793" LastActivityDate="2018-12-25T04:58:06.793" Title="Untagged customer traffic inconsistently sent over trunk" Tags="|cisco|switch|vlan|cisco-catalyst|multicast|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40849" PostTypeId="1" AcceptedAnswerId="40858" CreationDate="2017-05-02T23:47:35.073" Score="0" ViewCount="720" Body="&lt;p&gt;I understand that most ARP requests are broadcasted to the entire network. What about ARP replies?Are they sent directly to the host asking for the answer? Or must ARP replies go through the router first? From wireshark,it seems like the ARP replies go directly to the host making the initial ARP request. However, when I try crafting my own packet and sending an ARP reply directly to another host(without the host asking), my destination MAC gets changed automatically to that of the router instead of the MAC of the host I specified.&lt;/p&gt;&#xA;" OwnerUserId="35989" LastActivityDate="2017-05-03T06:49:47.893" Title="Are ARP replies sent directly to the solicitor?" Tags="|routing|mac-address|arp|wireshark|" AnswerCount="2" CommentCount="1" ClosedDate="2019-02-07T00:12:44.960" ContentLicense="CC BY-SA 3.0" />
  <row Id="40850" PostTypeId="1" AcceptedAnswerId="40853" CreationDate="2017-05-02T23:58:54.770" Score="8" ViewCount="32367" Body="&lt;p&gt;I just knew by theory how two host communicate through a port and a protocol, and i always thought  that they must be using the same port number aat both ends to communicate, but looking at the network traffic(using &lt;code&gt;iftop&lt;/code&gt; on unix) on my computer confuses me abit. As you can see there was an https request(port 443) but on my side it uses several different unknown ports why is that ?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;192.168.0.253:47262       &amp;lt;=&amp;gt; 151.101.0.162:443             0b    419Kb   105Kb &#xA;192.168.0.253:59526       &amp;lt;=&amp;gt; 151.101.64.162:443            0b   53.8Kb  13.5Kb &#xA;192.168.0.253:45034       &amp;lt;=&amp;gt; 151.101.128.162:443           0b   41.7Kb  10.4Kb &#xA;192.168.0.253:59534       &amp;lt;=&amp;gt; 151.101.64.162:443            0b   41.4Kb  10.4Kb &#xA;192.168.0.253:45050       &amp;lt;=&amp;gt; 151.101.128.162:443           0b   39.0Kb  9.76Kb &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36461" LastActivityDate="2017-05-03T04:54:36.290" Title="Why does source port and destination port differ, in my network communications?" Tags="|protocol-theory|transport-protocol|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40852" PostTypeId="2" ParentId="40848" CreationDate="2017-05-03T04:07:37.220" Score="1" Body="&lt;p&gt;You have not set a native VLAN on the interfaces. This would be stopping untagged traffic from traversing the trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See below links for clarification;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/m/en_us/techdoc/dc/reference/cli/nxos/commands/l2/switchport-trunk-native-vlan.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/m/en_us/techdoc/dc/reference/cli/nxos/commands/l2/switchport-trunk-native-vlan.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/m/en_us/techdoc/dc/reference/cli/nxos/commands/l2/vlan-dot1q-tag-native.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/m/en_us/techdoc/dc/reference/cli/nxos/commands/l2/vlan-dot1q-tag-native.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36464" LastActivityDate="2017-05-03T04:07:37.220" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40853" PostTypeId="2" ParentId="40850" CreationDate="2017-05-03T04:54:36.290" Score="7" Body="&lt;p&gt;Source ports are randomly generated from the unregistered port range. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The source/destination port works similar to your IP. The port you send from, is the port the service will reply too. For instance; a website is simply a server listening for connections on port 80 (or 443).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you attempt to load a website you generate a free port from the unregistered range and send the request from 192.168.1.1:45676 (Source port selected) your browser then sends the request to 200.20.20.20:80 (IP is an example) as the server is listening on this port.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Much like your IP, when the server replies to you it sets the destination IP AND port In the packets header to the source IP / Port it received the request on. This enables you to run multiple webpages at once.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you had 4 webpages open, all sending and receiving on port 80, it would not know where the response traffic is meant to be directed. This is why the source port is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is an article which might help you understand it a bit better;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.firewall.cx/networking-topics/protocols/tcp/133-tcp-source-destination-ports.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.firewall.cx/networking-topics/protocols/tcp/133-tcp-source-destination-ports.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This video may be of interest as well :):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=PBWhzz_Gn10&quot; rel=&quot;noreferrer&quot;&gt;https://www.youtube.com/watch?v=PBWhzz_Gn10&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36464" LastActivityDate="2017-05-03T04:54:36.290" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40854" PostTypeId="2" ParentId="40849" CreationDate="2017-05-03T04:57:41.233" Score="1" Body="&lt;p&gt;ARP replies are unicast, so only sent to the requestor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These links may assist:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Address_Resolution_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Address_Resolution_Protocol&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7136/arp-replies-can-they-be-broadcast&quot;&gt;ARP Replies can they be Broadcast&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36464" LastActivityDate="2017-05-03T04:57:41.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40855" PostTypeId="2" ParentId="40847" CreationDate="2017-05-03T05:05:33.263" Score="2" Body="&lt;p&gt;You can modify the root bridge and priority to modify the blocking/forwarding ports of STP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is dependant on your setup so without seeing the topology it is a little hard to assist with how you want the setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can find some information on configuring STP on cisco devices here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/5234-5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/5234-5.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36464" LastActivityDate="2017-05-03T05:05:33.263" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40857" PostTypeId="2" ParentId="40086" CreationDate="2017-05-03T06:14:23.513" Score="0" Body="&lt;p&gt;If you disable negotiation then you must do it at both ends as it is not Auto-Detect. Negotiation means the two ends negotiate the connection that is they talk, so If you change only one end the other end will attempt to negotiate get no answer and decide what to use on its own.  With 100Meg ports this is always 10Meg, Half duplex  as (IMHO) that is the most likely if the device does not negotiate.&#xA;The bad thing is that with Full/Half with a lightly loaded link it still works so you move on and when lots of traffic hits the link it goes down.&lt;/p&gt;&#xA;&lt;p&gt;I've not tried this on 1000 Meg or 10000 Meg links so I don't know if this still happens.  I'm not really sure how full/half duplex applies to a 1000Meg link - as on copper I thought it used all four pairs to transmit - so it seemed to me to be inherently half-duplex but I'd think it is point to point and negotiates who will talk next that is not collision sensing.  If so then the Half duplex setting would have a different meaning and you might find it cannot be applied in the config.&lt;/p&gt;&#xA;" OwnerUserId="33676" LastEditorUserId="33676" LastEditDate="2024-01-20T02:01:07.453" LastActivityDate="2024-01-20T02:01:07.453" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="40858" PostTypeId="2" ParentId="40849" CreationDate="2017-05-03T06:49:47.893" Score="1" Body="&lt;p&gt;Perhaps I have misunderstood however- The broadcast domain for a ARP the boundary of the switched network of which each router is a boundary point. &#xA;So yes replies go direct , no they do not and cannot go through a router . However a router will send a response to a Arp request for an IP address that it has.  A proxy arp function exists for some routers and this may be relevant to what you have seen.&#xA;I'm not sure why the router would change a ARP reply from someone else but without seeing what the data and routing layout I can't be sure what is happening. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you trying to force a ARP entry into the ARP table or a device ? Or perhaps you are trying to give an IP address to a device by broadcasting a ARP packet , I remember doing this for some printer servers.  I cannot remember the exact details again however the source of the ARP packet it must be on the switched network.&lt;/p&gt;&#xA;" OwnerUserId="33676" LastActivityDate="2017-05-03T06:49:47.893" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40866" PostTypeId="1" AcceptedAnswerId="40867" CreationDate="2017-05-03T12:59:25.480" Score="1" ViewCount="146" Body="&lt;p&gt;This may sound like a stupid question but it has been bugging me. Lets say I have 2 devices A and B, both connected wirelessly to the same WAP. If A were to talk to B, does the wireless traffic from A go directly to B using the MAC address it has gotten from ARP or does the traffic still have to go through the switch before forwarding it from the  switch to device B? In other words, if device A and B were side by side physically, will B be able to 'intercept' the radio waves sent out by A and therefore, read the packet contents?&lt;/p&gt;&#xA;" OwnerUserId="35989" LastActivityDate="2017-05-03T13:06:08.020" Title="Does wireless traffic in a network still have to go through a switch?" Tags="|routing|switch|wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40867" PostTypeId="2" ParentId="40866" CreationDate="2017-05-03T13:06:08.020" Score="1" Body="&lt;p&gt;Generally all the devices at the AP communicate through AP. There are technologies as Wi-Di and Wi-Fi Direct, but those are beyond the scope of this question. So devices can't communicate directly in common Wi-Fi network. Regarding traffic interception, you should take into consideration ciphering here. Though there are ways to intercept traffic and read it contents, with WPA2 those attacks are very complicated.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-05-03T13:06:08.020" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40868" PostTypeId="1" CreationDate="2017-05-03T13:21:50.267" Score="1" ViewCount="965" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/GPzax.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GPzax.jpg&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been trying to get PC2 to get its IP via DHCP, and the Pool is located at the MKTI router. What I did was to create 3 DHCP pools at the MKTI router however, the third one keeps getting messed up..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I enter these commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address 192.168.10.1&#xA;ip dhcp excluded-address 192.168.10.65&#xA;ip dhcp excluded-address 192.168.10.105&#xA;ip dhcp pool VLAN-POOL-10&#xA;net 192.168.10.0 255.255.255.192&#xA;default-router 192.168.10.1&#xA;ip dhcp pool VLAN-POOL-20&#xA;net 192.168.10.64 255.255.255.224&#xA;default-router 192.168.10.65&#xA;ip dhcp pool POOL-QC&#xA;net 192.168.10.104 255.255.255.192&#xA;default-router 192.168.10.105&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But get this as output:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool VLAN-POOL-10&#xA; network 192.168.10.0 255.255.255.192&#xA; default-router 192.168.10.1&#xA;ip dhcp pool VLAN-POOL-20&#xA; network 192.168.10.64 255.255.255.224&#xA; default-router 192.168.10.65&#xA;ip dhcp pool POOL-QC&#xA; network 192.168.10.64 255.255.255.192&#xA; default-router 192.168.10.105&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any reason that QC is registering as .64 instead of .104? Does this have to do with anything on my VLSM because I'm using only a /24 address space for 3 subnets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit (based on the first response):&#xA;We were asked to create 4 subnets for the network under the address space of 192.168.10.0 /24. The networks needed 40, 20, 3, and 50 hosts respectively so I had to do a subnet for each network...if I did the VLSM right then the network addresses should be 10.0, 10.64, 10.96, and 10.104&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I understand that its incorrect because 192.168.10.104 is considered a host address..but I did the subnetting and from what I've learned it should be the next network address based on the subnetting I've done... &lt;/p&gt;&#xA;" OwnerUserId="36475" LastEditorUserId="36475" LastEditDate="2017-05-03T14:06:58.893" LastActivityDate="2017-05-03T14:06:58.893" Title="Question with DHCP and Subnets (Packet Tracer)" Tags="|subnet|dhcp|packet-tracer|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40869" PostTypeId="2" ParentId="40868" CreationDate="2017-05-03T13:27:34.150" Score="2" Body="&lt;p&gt;The network statement defines the subnet for the DHCP pool. 192.168.10.104/26 (255.255.255.192) is not a valid network address. It's a host address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The /26 network that contains that IP address is 192.168.10.64.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-03T13:27:34.150" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40871" PostTypeId="1" CreationDate="2017-05-03T13:48:45.067" Score="0" ViewCount="682" Body="&lt;p&gt;have quick question How do we find the host name name by using mac address,VLAN or IP address on Layer3 switch .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i pull up the vlan and mac address using my IP by i couldn't figure it out the host name of the layer2 switch &lt;/p&gt;&#xA;" OwnerUserId="36478" LastActivityDate="2017-05-03T13:53:28.823" Title="How do we find the host name name by using mac address,VLAN or IP address on Layer3 switch" Tags="|layer3|" AnswerCount="1" CommentCount="1" ClosedDate="2017-05-03T14:26:30.063" ContentLicense="CC BY-SA 3.0" />
  <row Id="40872" PostTypeId="2" ParentId="40871" CreationDate="2017-05-03T13:53:28.823" Score="2" Body="&lt;p&gt;You can't determine configured hostname by using IP or MAC. You can do it with CDP or LLDP, if protocol is enabled on interface of the switch.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-05-03T13:53:28.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40874" PostTypeId="1" CreationDate="2017-05-03T15:02:00.533" Score="4" ViewCount="34624" Body="&lt;p&gt;The environment I'm working in has an EdgeRouter and a single switch (EdgeSwitch 48).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are looking to add another EdgeSwitch and connect both switches together for a single broadcast domain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, is it possible to connect both switches together, and then connect both switches to the router?  The idea is that internet traffic will go directly from either switch to the router, but LAN traffic can go directly in-between switches.&lt;/p&gt;&#xA;" OwnerUserId="20692" LastActivityDate="2020-01-14T20:20:35.023" Title="Possible to connect two switches together and both to a router?" Tags="|routing|switch|" AnswerCount="7" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40875" PostTypeId="2" ParentId="40874" CreationDate="2017-05-03T15:07:00.207" Score="0" Body="&lt;p&gt;Routers route between network, so each router interface belongs to a different network. Since you cannot connect both switches directly to the same router interface, you would be connecting them to two different networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, switches use spanning-tree in order to create a single, loop-free path on the layer-2 LAN. In order to do this, all switch traffic is sent to the elected root switch. A switch has no idea which packets are destined for the Internet because all layer-2 traffic is local. Switches know nothing about your layer-3 addressing.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-03T15:07:00.207" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40877" PostTypeId="2" ParentId="40848" CreationDate="2017-05-03T15:49:59.137" Score="1" Body="&lt;p&gt;Ron Maupin's comment was exactly on-target.  It also made me realize that multicast traffic from the other switches was NOT traversing this switch as I had previously thought.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no igmp snooping&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Adding this in the global config made everything work the way I wanted it to, although depending on your volume of multicast traffic you may want to enable it for selected vlans and ports only.  I recommend reading &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/68131-cat-multicast-prob.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/68131-cat-multicast-prob.html&lt;/a&gt; for a better understanding of the options.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks everyone!&lt;/p&gt;&#xA;" OwnerUserId="36459" LastActivityDate="2017-05-03T15:49:59.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40878" PostTypeId="2" ParentId="40848" CreationDate="2017-05-03T16:04:10.467" Score="1" Body="&lt;p&gt;It seems that your problem is with Multicast traffic. Switches that default to IGMP snooping have a problem with multicast traffic across multiple switches. Cisco has documents, e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/68131-cat-multicast-prob.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Multicast Does Not Work in the Same VLAN in Catalyst Switches&lt;/em&gt;&lt;/a&gt;, which explain the problem and solutions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is basically that switches with IGMP snooping will listen to IGMP messages in order to learn which switch interfaces are requesting traffic for which IGMP groups. If a switch doesn't have any hosts connected, it will simply drop multicast traffic. The IGMP requests will not span across switch trunks, except in specific scenarios.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Problem&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Multicast traffic does not seem to pass across Catalyst switches, even&#xA;  in the same VLAN. Figure 1 depicts a typical scenario:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Figure 1 – Network Setup with Multicast Source and Receivers&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/HngGc.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/HngGc.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The multicast source is connected to Switch 1, which is a Catalyst&#xA;  6500 Switch with Supervisor Engine 720 that runs Cisco IOS Software.&#xA;  Receiver 1 is connected to Switch 1, and Receiver 2 is connected to&#xA;  Switch 2. Switch 2 is a Catalyst 3750. There is a Layer 2 link, either&#xA;  access or trunk, between Switch 1 and Switch 2.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;In this setup, you find that Receiver 1, which is on the same switch&#xA;  as the source, gets the multicast stream with no problems. However,&#xA;  Receiver 2 does not get any multicast traffic. This document aims to&#xA;  resolve this issue.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;An explanation of the problem with a link to the solutions:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;Understand the Problem and Its Solutions&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;By default, the Catalyst switches have IGMP snooping enabled. With&#xA;  IGMP snooping, the switch snoops (or listens) for IGMP messages on all&#xA;  the ports. The switch builds an IGMP snooping table that basically&#xA;  maps a multicast group to all the switch ports that have requested it.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Assume that, without any prior configuration, Receiver 1 and Receiver&#xA;  2 have signaled their intentions to receive a multicast stream for&#xA;  239.239.239.239 that maps to the L2 multicast MAC address of 01.00.5e.6f.ef.ef. Both Switch 1 and Switch 2 create an entry in their snooping tables for these receivers in response to the IGMP reports&#xA;  that the receivers generate. Switch 1 enters port Gigabit Ethernet&#xA;  2/48 in its table, and Switch 2 enters port Fast Ethernet 1/0/47 in&#xA;  its table.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Note: At this point, the multicast source has not started its traffic,&#xA;  and none of the switches knows about the switch mrouter port.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;When the source on Switch 1 starts to stream multicast traffic, Switch&#xA;  1 has &quot;seen&quot; the IGMP report from Receiver 1. As a result, Switch 1&#xA;  delivers the multicast out port Gigabit Ethernet 2/48. But, since&#xA;  Switch 2 &quot;absorbed&quot; the IGMP report from Receiver 2 as part of the&#xA;  IGMP snooping process, Switch 1 does not see an IGMP report (multicast&#xA;  request) on port Gigabit Ethernet 2/46. As a result, Switch 1 does not&#xA;  send any multicast traffic out to Switch 2. Therefore, Receiver 2&#xA;  never gets any multicast traffic, even though Receiver 2 is in the&#xA;  same VLAN but merely on a different switch than the multicast source.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The reason for this issue is that IGMP snooping is not really&#xA;  supported on any Catalyst platform without an mrouter. The mechanism&#xA;  &quot;breaks down&quot; in the absence of an mrouter port. If you want a fix for&#xA;  this solution, you must have the switches somehow learn or know of an&#xA;  mrouter port. The &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/68131-cat-multicast-prob.html#solu&quot; rel=&quot;nofollow noreferrer&quot;&gt;Solutions&lt;/a&gt; section of this document explains the&#xA;  procedure. But how does the presence of an mrouter port on the&#xA;  switches remedy the situation?&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Basically, when the switches learn or statically know about an mrouter&#xA;  port, two critical things occur:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;The switch &quot;relays&quot; the IGMP reports from the receivers to the mrouter port, which means that the IGMP reports go toward the&#xA;  multicast router. The switch does not relay all the IGMP reports.&#xA;  Instead, the switch sends only a few of the reports to the mrouter.&#xA;  For the purpose of this discussion, the number of reports is not&#xA;  important. The multicast router only needs to know if there is at&#xA;  least one receiver that is still interested in the multicast&#xA;  downstream. In order to make the determination, the multicast router&#xA;  receives the periodic IGMP reports in response to its IGMP queries.&lt;/li&gt;&#xA;  &lt;li&gt;In a source-only multicast scenario, in which no receivers have yet &quot;joined&quot; in, the switch only sends the multicast stream out its&#xA;  mrouter port.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;  &#xA;  &lt;p&gt;When the switches know their mrouter port, Switch 2 relays out the&#xA;  IGMP report that the switch received from Receiver 2 to its mrouter&#xA;  port. This port is Fast Ethernet 1/0/33. Switch 1 gets this IGMP&#xA;  report on the switch port Gigabit Ethernet 2/46. From the perspective&#xA;  of Switch 1, the switch has received merely another IGMP report. The&#xA;  switch adds that port into its IGMP snooping table and begins to send&#xA;  out the multicast traffic on that port as well. At this point, both&#xA;  the receivers receive the requested multicast traffic, and the&#xA;  application works as expected.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;But how do the switches identify their mrouter port so that IGMP&#xA;  snooping works as it is expected to work in a simple environment like&#xA;  this? The &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/68131-cat-multicast-prob.html#solu&quot; rel=&quot;nofollow noreferrer&quot;&gt;Solutions&lt;/a&gt; section provides some answers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cisco lists five different possible solutions to the problem:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Enable PIM on the Layer 3 Router/VLAN Interface&lt;/li&gt;&#xA;&lt;li&gt;Enable IGMP Querier Feature on a Layer 2 Catalyst Switch&lt;/li&gt;&#xA;&lt;li&gt;Configure Static Mrouter Port on the Switch&lt;/li&gt;&#xA;&lt;li&gt;Configure Static Multicast MAC Entries on All the Switches&lt;/li&gt;&#xA;&lt;li&gt;Disable IGMP Snooping on All the Switches&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-03T16:04:10.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40879" PostTypeId="1" CreationDate="2017-05-03T17:08:52.637" Score="2" ViewCount="8401" Body="&lt;p&gt;When using multiple VLANs, what is the best practice for connecting a router to a switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, I can use one single port (and one cable) between the switch and router and set it up as a VLAN trunk so all traffic uses this cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pros: Only one port is required.&#xA;Cons: All VLAN traffic shares 1 Gb link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second option is to connect multiple cables between the router and the switch and setup each port/cable to pass individual VLANs/networks between the router and the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pros: Each VLAN/network has dedicated 1 Gb link.&#xA;Cons: Uses multiple ports on switch and router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a best practice regarding this situation?  The router I'm using (EdgeRouter) doesn't support link aggregation (as far as I know) and the fiber ports are only SFP so every port is only 1 Gb.&lt;/p&gt;&#xA;" OwnerUserId="20692" LastActivityDate="2021-01-26T11:42:09.033" Title="Best practice for connecting router to switch? (re: VLANs and multiple ports)" Tags="|routing|switch|vlan|switching|trunk|" AnswerCount="5" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40880" PostTypeId="2" ParentId="40879" CreationDate="2017-05-03T17:25:48.633" Score="5" Body="&lt;p&gt;At the risk of expressing an opinion here, there is no such thing as &quot;best practice.&quot;  There are good practices,  there are bad practices, and there are a lot in between.  There is no best practice because there are many factors which make each situation different. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the choice you present, you might consider the ease of maintenance/modification, the likelihood that you will exceed the port bandwidth, the ease/cost of cabling, etc.  Each of these will affect your decision.  There is no right answer because only you can determine how much these factors matter in your environment. What's &quot;best&quot; for me may not be best for you.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-05-03T17:55:34.560" LastActivityDate="2017-05-03T17:55:34.560" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40881" PostTypeId="1" CreationDate="2017-05-03T17:29:49.187" Score="2" ViewCount="2671" Body="&lt;p&gt;Is DTP (Dynamic Trunking Protocol) enabled by default on the newest Cisco devices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been using Cisco 2960 switches and DTP is enabled by default. I was wondering if this was the same for the latest and greatest switches? I am assuming it depends on the IOS version and I couldn't find anything specific for the newest versions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason I ask is because I was doing a demonstration of a VLAN hopping attack in which you first initiate trunking from your attacking device. Then once you get the trunk (assuming DTP is enabled) you can use 802.1Q double-tagging to reach a device outside of the native vlan. At the end of demonstration, I was asked if the newest Cisco devices still enabled DTP by default and told the person I would get back to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="31414" LastEditorUserId="31414" LastEditDate="2017-05-03T17:43:37.667" LastActivityDate="2017-05-03T21:47:53.477" Title="Is DTP enabled by default on the newest Cisco devices?" Tags="|cisco|switch|cisco-ios|trunk|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="40883" PostTypeId="1" CreationDate="2017-05-03T18:15:02.627" Score="0" ViewCount="91" Body="&lt;p&gt;For exemple in AS-Interface there is the master who send information and then the slave send a response but in topology bus all systems are connected to one wire so the information will go to all slaves, how the slave know its for him ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;could transceivers do this task?&lt;/p&gt;&#xA;" OwnerUserId="36486" LastActivityDate="2017-05-03T21:43:53.430" Title="How does information move on a topology bus network?" Tags="|topology|" AnswerCount="1" CommentCount="1" ClosedDate="2017-05-03T22:20:34.820" ContentLicense="CC BY-SA 3.0" />
  <row Id="40884" PostTypeId="1" AcceptedAnswerId="40885" CreationDate="2017-05-03T18:18:02.833" Score="2" ViewCount="253" Body="&lt;p&gt;On my VMware internal nat network, when I try to do a simple HTTP request from my guest to my host OS, the arp request from my guest os asks for the MAC address of my host IP and attach it in the destination MAC of the following packets which is totally expected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I try the same thing on a real network(i.e on my school's network while my 'guest os' is now directly connected to the real network through a usb wifi dongle), it seems that the ARP request sent out from my 'guest os' now asks for the MAC address of another IP(which appears to be a switch) instead. Why doesn't my guest os just ask directly for the IP address of my host OS like before? How does my guest os know what ip to look for when sending requests?&lt;/p&gt;&#xA;" OwnerUserId="35989" LastActivityDate="2017-05-04T09:15:15.523" Title="How does my network interface know which destination IP to ask for in an ARP request packet?" Tags="|switch|mac-address|arp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40885" PostTypeId="2" ParentId="40884" CreationDate="2017-05-03T18:30:45.790" Score="2" Body="&lt;p&gt;ARP requests are normally limited to one broadcast domain (one subnet if you like). So when host A knows (based on subnet mask) that host B is located in the same broadcast domain, it sends ARP directly to host B. With ARP host A determines B's mac and sends frame with MAC B and IP B. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Otherwise it looks into IP routing table in order to determine nexthop for B's network if any. You probably have only one IPv4 route on your host - default one. So now host A should send IP packet with IP B and MAC of default gateway - that is how frame reaches IP nexthop. That is why ARP is being sent to DGW. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;P. S. I believe your question is off topic here.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-05-03T18:30:45.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40887" PostTypeId="2" ParentId="40884" CreationDate="2017-05-03T21:15:09.800" Score="1" Body="&lt;p&gt;It first determines if the required IP address is local or requires going via a router  - to do this is compares the RequiredIPaddress  against the LocalIPAddress of each interface , It does a binary and with the NetworkMask to clear the lower order bits &#xA;If these are exactly the same then the ARP request will be sent out that interface. It will be a broadcast at layer 2 &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If however there are no matches for this &quot;is it local question&quot; then it will route.  So it works out the next hop address and gets the IPaddress of a router - it will do another ARP lookup for the IP address of the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you description sounds like is that it did not match the addresses in the &quot;is it local&quot; part and it found that the Switch is the router it wants to use.&lt;/p&gt;&#xA;" OwnerUserId="33676" LastActivityDate="2017-05-03T21:15:09.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40889" PostTypeId="2" ParentId="40883" CreationDate="2017-05-03T21:43:53.430" Score="1" Body="&lt;p&gt;I'm no expert on bus topology, but I'll do my best to answer this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All frames/packets in the bus network will have a source and destination address. All systems in the bus sniff every frame and ignore the ones that aren't destined towards them. Most of this work can be done by a decent NIC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where my system is connected to a bus, I will see:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Message 1: Destination: John, source: Sheila (I'll ignore this)&lt;br&gt;&#xA;Message 2: Destination: Sheila, source: John (I'll ignore this)&lt;br&gt;&#xA;Message 3: Destination: Me, source: John (I'll read this and respond if necessary)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Etc.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2017-05-03T21:43:53.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40890" PostTypeId="2" ParentId="40881" CreationDate="2017-05-03T21:47:53.477" Score="3" Body="&lt;p&gt;The newest small campus access switches are 2960X switches, and they still have DTP enabled by default.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nexus switches are designed for datacenter use, not for user-facing ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DTP is also enabled by default on 3850s, 3650s, and every other switch I get my hands on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm still waiting on a global disable command for it - a 'no dtp run' or similar.  For the time being, it's still strongly recommended to hardcode your port as an access or trunk port, configure &quot;switchport nonegotiate&quot; on the port, and for trunk ports, configure a dead VLAN as the native (I like to use 999 and make sure it doesn't exist in my VLAN database).&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2017-05-03T21:47:53.477" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40891" PostTypeId="1" CreationDate="2017-05-03T22:31:58.313" Score="1" ViewCount="2139" Body="&lt;p&gt;I have two ISP's coming into the building. One is a T1 that is going to be used for VOIP phones. The second is high speed internet connection going to be used for internet. Each office has one cat5e cable ran into them. Is it possible to run both services over one cat5e cable. I need the phones connected to the T1 for reliability and uptime and the computers connected to the other service for the speed. I am trying to avoid having to run an additional cable into each office. I am a little familiar with VLAN's but I don't think they will work in this scenario. Thanks in advance.&lt;/p&gt;&#xA;" OwnerUserId="36492" LastEditorUserId="8499" LastEditDate="2018-03-21T00:35:55.797" LastActivityDate="2019-08-22T10:58:23.137" Title="Can I run two separate internet connections over one Cat5e cable" Tags="|vlan|layer1|cable|voip|utp|" AnswerCount="4" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40892" PostTypeId="1" CreationDate="2017-05-03T23:02:05.500" Score="1" ViewCount="403" Body="&lt;p&gt;The standard TCP handshake goes:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1. SYN     (client-&amp;gt;server)&#xA; 2. SYN+ACK (server-&amp;gt;client)&#xA; 3. ACK     (client-&amp;gt;server)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The NetFlow flags are ORed together and comprise of:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;URG     ACK     PSH     RST     SYN     FIN&#xA;32      16      8       4       2       1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am assuming that if NetFlow collects a flow during different stages of the handshake then the flow TCP flag would match the following table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1. 02 (SYN)&#xA; 2. 18 (SYN+ACK)&#xA; 3. 16 (ACK)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is this correct?&lt;/p&gt;&#xA;" OwnerUserId="36493" LastEditorUserId="36493" LastEditDate="2017-05-03T23:37:16.353" LastActivityDate="2017-07-03T05:07:37.887" Title="What is the expected states of a Cisco Netflow entry if it were collected during different stages of a TCP 3-way handshake?" Tags="|cisco|router|netflow|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="40893" PostTypeId="1" CreationDate="2017-05-03T23:31:22.837" Score="2" ViewCount="789" Body="&lt;p&gt;I am working on converting my core to IPv6. My current addressing scheme includes the VLAN in the IPv6 address:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLAN1511:&#xA;XXXX:XXXX:XXXX:&lt;strong&gt;&lt;em&gt;1511&lt;/em&gt;&lt;/strong&gt;::1/64&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I have some VLAN overlap (the same VLAN number used in different locations/equipment for different roles) between my peering VLANS and customer VLANs. Therefore I can't use the &quot;VLAN in address&quot; scheme. I am wondering if it is OK practice to use ULA address for all the peering and Global for the customer (and internet) facing VLANs? I've heard people recommend and argue against both using ULA for peering and not, however I've never seen/heard any facts as to why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts welcome! Thanks!&lt;/p&gt;&#xA;" OwnerUserId="36494" LastEditorUserId="36494" LastEditDate="2017-05-03T23:43:55.330" LastActivityDate="2017-09-01T03:14:36.447" Title="IPv6 ULA vs. Global addresses for private (intra entity) peering" Tags="|routing|ipv6|" AnswerCount="1" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="40894" PostTypeId="2" ParentId="40893" CreationDate="2017-05-04T00:32:48.300" Score="1" Body="&lt;p&gt;IPv6 allows you to have far more addressing than you actually need. If your business has multiple sites, you should have &lt;code&gt;/48&lt;/code&gt; networks for each site. You can get a much smaller, provider-independent prefix directly from your RIR, and you can use this prefix regardless of the ISP(s) used, and you can easily change ISPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can then develop an IPv6 addressing scheme that takes into account your site. Use a couple of nibbles as a site ID. Use one or more other nibbles for various type of identification. For example, you may have a nibble to identify the network address type (e.g. router loopback, point-to-point link, VoIP network, User VLAN, Wi-Fi VLAN, etc.). You have great flexibility with the expanded IPv6 address space that you simply do not have with the limited IPv4 address space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are all sorts of IPv6 addressing schemes if you search for them, but only you can determine what works for you. I would recommend spending some time designing a good address scheme, and be sure to leave lots of space for future growth. Most companies will readdress multiple times as they come to terms with what can be done with the expanded address space, and a some serious forethought may prevent that.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-04T00:32:48.300" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40895" PostTypeId="2" ParentId="40879" CreationDate="2017-05-04T00:49:12.260" Score="4" Body="&lt;p&gt;To add to the answer by @Ron Trunk.&#xA;The good , best or bad practises depend largely on your network​ and cannot be generalised as one common solution .&lt;/p&gt;&#xA;&lt;h1&gt;Case1&lt;/h1&gt;&#xA;&lt;p&gt;What if the number of Vlans in the network are around 10. The data is in mostly in the form of bursts and no vlan requires high link utilization continuously.&#xA;Sharing a link makes sense here .&lt;/p&gt;&#xA;&lt;h1&gt;Case 2&lt;/h1&gt;&#xA;&lt;p&gt;On the contrary consider a data center topology where these vlans are used to isolate server traffic .&#xA;Considering the high volume of S-N traffic, there are chances of over subscribing the link.&#xA;In this case, even a single vlan may be provided with dedicated links to reduce latency and questing delays.&lt;/p&gt;&#xA;&lt;p&gt;The best practises are generally at the discretion of the network Administrator and the scenerio at hand .&lt;/p&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="30735" LastEditDate="2021-01-25T20:19:27.190" LastActivityDate="2021-01-25T20:19:27.190" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40896" PostTypeId="2" ParentId="40891" CreationDate="2017-05-04T03:22:26.710" Score="4" Body="&lt;p&gt;Yes it is possible all you need is a router where both links will get terminated for voice and data it would act as an gateway.&#xA;Then you need switch connected via router in switch there would be 2 vlan one for voice one for data then one cat5e wire to your phone and from ip phone 2nd wire to your pc&#xA;Thankyou hit correct answer if i cleared your doubt&lt;/p&gt;&#xA;" OwnerUserId="32628" LastActivityDate="2017-05-04T03:22:26.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40897" PostTypeId="1" AcceptedAnswerId="40908" CreationDate="2017-05-04T03:23:09.117" Score="1" ViewCount="489" Body="&lt;p&gt;I have advertised IP address 10.1.1.0/24 using IP-prefix list but it is not showing subnet mask in advertised route. Can you explain this behavior. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;gt; show ip bgp vpnv4 all neighbors   10.27.0.21  advertised-routes&#xA;&amp;gt; &#xA;&amp;gt;    Network          Next Hop            Metric LocPrf Weight Path&#xA;&amp;gt; Route Distinguisher: 22870:10 (default for vrf Data)&#xA;&amp;gt; *&amp;gt; 10.1.1.0     10.1.1.33            0         100 i&#xA;&#xA;&amp;gt; Total number of prefixes 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8007" LastActivityDate="2017-08-02T11:38:46.033" Title="Routes advertised via prefix list in BGP list" Tags="|routing|vpn|bgp|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40898" PostTypeId="2" ParentId="40892" CreationDate="2017-05-04T03:25:16.627" Score="2" Body="&lt;p&gt;Be very careful when looking at this kind of data.  There's considerable variation by hardware platform and even software revision that influences whether TCP information is collected and whether that data is actually collected &lt;em&gt;consistently&lt;/em&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it does work, the TCP information collected by Netflow is a logical AND of the TCP flags seen &lt;em&gt;during that flow interval&lt;/em&gt;.  Keep in mind that a TCP flow lasting, say, 30 minutes might actually generate between 5-6 and potentially dozens of records as aging timers hit, caches overrun or, indeed, FIN packets are seen (in the case of TCP).  As such, unless something is assembling these flow records into some kind of a cohesive whole what you're actually seeing is a bunch of (hopefully) sequential chunks.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;If&lt;/em&gt; TCP flags are being correctly flagged then you might see an interval from, say, the first 30 seconds of the flow where both SYN and ACK were seen.  This would create a value of 010010 (decimal 18). If retransmissions were happening later in the session - say 10 minutes in - then a later record might include 000100 (decimal 4) reflecting that the RST flag was observed.  Toward the end of the overall session you might see a final record that included 000001, indicating a FIN flag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similarly, if an entire flow occurs within the bounds of a single record then the entries for SYN, ACK, RST and FIN might &lt;strong&gt;all&lt;/strong&gt; be seen (010111).  During an uneventful section of the flow there also might be no flags set at all.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;FYI - the TCP flags (from most to least significant bits) are URG,ACK,PSH,RST,SYN,FIN.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-05-04T03:25:16.627" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40899" PostTypeId="2" ParentId="40891" CreationDate="2017-05-04T03:42:14.873" Score="0" Body="&lt;p&gt;There are four pairs of connectors in that Cat5e cable.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The T1 uses two pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the high speed Internet service is provided via Ethernet then it will use either two or four pairs depending on whether it's 100 megabit or 1 gigabit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your Internet connection is DSL-based then it uses only one pair.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So... the next issue is that these different types of transmission mechanisms can potentially interfere with each other.  Technically speaking it's bad practice to mix them inside of a single sheath, but I can't say I haven't seen it done successfully in some cases.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I probably wouldn't be all that concerned with mixing DSL and T1.  They were both designed to run in these kinds of conditions.  I'd honestly be &lt;strong&gt;really&lt;/strong&gt; hesitant to run either with Ethernet, though.  Again - it &lt;em&gt;can&lt;/em&gt; work, but the potential for things being flaky is high.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Bear in mind that someone is going to have to come up with the means on both sides to split out these pairs.  This is going to require an adapter that comes out of the jack you're being provided into two other jacks.  Leaving aside the baseline signal quality questions I would more or less &lt;em&gt;expect&lt;/em&gt; the first technician dispatched to check either service to end up breaking &lt;strong&gt;both&lt;/strong&gt; when (&lt;em&gt;not&lt;/em&gt; if) they pull the wrong plug to perform testing.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me suggest something else, though - the odds are excellent that the building is wired for traditional voice services (i.e. old phone jacks).  The T1 can &lt;em&gt;happily&lt;/em&gt; run on this wiring, thus leaving the Cat5e behind to run high-speed data safely and simply...and even potentially supporting gigabit speeds.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-05-04T03:42:14.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40901" PostTypeId="2" ParentId="37609" CreationDate="2017-05-04T06:18:11.100" Score="0" Body="&lt;p&gt;Well, if R2 has the best route to the destination prefix from your AS 64501, R5 and R1 should also have that in their BGP tables (Rule: All EBGP and best IGBP routes). So if ISP is using only iBGP inside their AS, then traffic from R5 should normally follow the path you desire (R5-R2-R4). The only thing i believe (could be right) is ISP is using a lower AD protocol in R5 (for ex: static route) to steer traffic towards R1. Like other members commented, you cannot influence routing inside another AS which is not in your control. It's also a strange thing for me that how could you get figure out that the traffic is coming from R5-R1 ?&lt;/p&gt;&#xA;" OwnerUserId="36501" LastActivityDate="2017-05-04T06:18:11.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40902" PostTypeId="1" CreationDate="2017-05-04T08:14:01.483" Score="2" ViewCount="208" Body="&lt;p&gt;I have an ASN and IPv4 block, let's say AS 65001 and 10.0.0.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP, AS 65000, has two data centers, locate in Asia and North America.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to break the /24 into two /25, to use it in Asia(10.0.0.1/25) and North America(10.0.0.129/25).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ISP won't accept any annoucement smaller then /24, so I advertised /24 on both sites, and created a GRE tunnel between two sites, to establishe a iBGP peering session.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;65001(Asia)                65001(North America)   &#xA;  \                               /                 &#xA;   +-- 65000 =---gre---= 65000 --+&#xA;       (Asia)        (North America)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With in AS65001, two /25 subnets are able to reach each other. However, if someone from North America try to access Asia part (10.0.0.1), the traffic won't be able to come back to North America. The traffic from Asia won't be able to reach North America too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can see traffic coming from North America destinated Asia, but Asia is trying to respond it using its default gateway, which is the Asia router of ISP, thus it won't work.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can make Asia reachable from North America by adding a routing policy:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip rule add from 10.0.0.0/24 lookup gre_peer_as_gw&#xA;ip route add default via 10.0.0.129 dev gre0 table gre_peer_as_gw&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But that's obveriosuly not what I want. User in Asia area won't be able to reach anything with that being set.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could this be done?&lt;/p&gt;&#xA;" OwnerUserId="34946" LastActivityDate="2018-06-30T12:32:18.267" Title="Routing - BGP Interdomain Routing with Tunnel" Tags="|routing|bgp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40903" PostTypeId="1" AcceptedAnswerId="40906" CreationDate="2017-05-04T08:36:37.037" Score="3" ViewCount="559" Body="&lt;p&gt;For my internal Network, i'd like to set up IPv6 with ULAs assigned with DHCPv6, a bit like with IPv4s RFC1918 private addresses:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I'm independent from the Prefix of my ISP for the internal networking&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I can use DHCPv6 to assign adresses to clients/servers&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I can set up DNS properly (dynamic updates of clients, interanl name resolution, reverse-zone)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;especially the configuration of DNS and DHCPv6 are the points where i have to rely on the ULAs as far as i know, since i can't create stateful dhcp-configurations or DNS reverse-Zones based on a dynamically assigned prefix from my ISP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;At the same time, i still want my clients to have a global addresses (with privacy extensions) which they should use for external communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My initial thought was to assign the ULAs with DHCPv6 from a server on the network (i have a DNS/DHCP-server already doing the same in the IPv4-World), and the global address with the RA of the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, my questions:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;afaik, clients should support this generally, but do the actually do this (request 1 adress with dhcpv6 AND another via neighbor discovery/router advertisement/SLAAC)&lt;/li&gt;&#xA;&lt;li&gt;for clients which don't support this, how do i accomplish connectivity to either external and internal network? (Clients with ULA only or global adress only) I think of a NAT-mechanism like NPTv6 (NOT!!! NAT66)&lt;/li&gt;&#xA;&lt;li&gt;is there any major flaw in this logic which i just can't see? Maybe i'm still thinking too much in IPv4, this was the 1st concept that came to mind for this problem.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;another solution would be to scratch the assignment of global addresses to the clients at all and use only ULAs, DHCPv6 and NPTv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Best regards. &lt;/p&gt;&#xA;" OwnerUserId="36503" LastActivityDate="2017-05-04T09:36:31.973" Title="assigning ULA and global adresses simultaneously" Tags="|router|ipv6|dhcpv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40904" PostTypeId="2" ParentId="40902" CreationDate="2017-05-04T08:47:47.853" Score="1" Body="&lt;p&gt;Of course you can't reach your goal like this. &lt;br /&gt;Both NICs are in a different subnet so you need to install a router between them which routes the traffic between the virtual NICs. But that's not how it works. &lt;br /&gt;&#xA;You normally set up a tunnel between A and B with e.g. openvpn. &lt;br /&gt;&#xA;The ends of the tunnel normally share one subnet e.g. 10.0.0.0/24.&lt;br /&gt;&#xA;Within that tunnel you are then able to perform IBGP without beeing connected directly. &lt;br /&gt;&#xA;Furthermore you do not need &lt;/p&gt;&#xA;" OwnerUserId="14081" LastActivityDate="2017-05-04T08:47:47.853" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40905" PostTypeId="2" ParentId="40884" CreationDate="2017-05-04T09:15:15.523" Score="0" Body="&lt;p&gt;If your guest OS got IP from DHCP server then guest os DHCP client will send a ARP request for the IP it got from DHCP server, to check any conflict is there in the network.&lt;/p&gt;&#xA;" OwnerUserId="36507" LastActivityDate="2017-05-04T09:15:15.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40906" PostTypeId="2" ParentId="40903" CreationDate="2017-05-04T09:36:31.973" Score="2" Body="&lt;p&gt;The basic idea is good. Using both global and ULA addresses in parallel works fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only problem you might run into is that not all clients support DHCPv6 (notorious one is Android) so those clients will only get a global address through SLAAC, so its communication to ULA addresses will go through the router.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2017-05-04T09:36:31.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40907" PostTypeId="2" ParentId="40891" CreationDate="2017-05-04T09:59:55.797" Score="0" Body="&lt;p&gt;Yes, you can. Here is the detailed instruction. &lt;a href=&quot;http://www.instructables.com/id/Hack-your-House-Run-both-ethernet-and-phone-over-/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.instructables.com/id/Hack-your-House-Run-both-ethernet-and-phone-over-/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35541" LastActivityDate="2017-05-04T09:59:55.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40908" PostTypeId="2" ParentId="40897" CreationDate="2017-05-04T10:13:33.497" Score="1" Body="&lt;p&gt;Finally i found.  Becuase mask value wasn't defined in network command and also auto-summariztion enabled.&#xA;Network 10.1.1.0 mask 255.255.255.0&#xA;No  auto-summariztion&lt;/p&gt;&#xA;" OwnerUserId="8007" LastActivityDate="2017-05-04T10:13:33.497" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40913" PostTypeId="2" ParentId="40670" CreationDate="2017-05-04T12:29:24.640" Score="2" Body="&lt;p&gt;On &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/routers/4000-series-integrated-services-routers-isr/datasheet-c78-732542.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this datasheet&lt;/a&gt; we can read :&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When combined with an optional Cisco IOS XE Software Security license,&#xA;  enables WAN link security and VPN services.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So it seems that the K9 indicate that the image loaded on your ISR is IPSEC capable, but you need to activate a license to use it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issuing the &lt;code&gt;show licence&lt;/code&gt; command should show you which license is active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the same page you will find:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Cisco IOS Software Licensing and Packaging&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Universal Cisco IOS XE Image&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;A single Cisco IOS XE Universal image encompassing all functions is&#xA;  delivered with the platform. Advanced features can be enabled simply&#xA;  by activating a software license on the Universal image. Technology&#xA;  packages and feature licenses, enabled through right-to-use licenses,&#xA;  simplify software delivery and decrease the operational costs of&#xA;  deploying new features.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Four major technology licenses are available on the Cisco 4000 Series;&#xA;  these licenses can be activated through the Cisco software activation&#xA;  process identified at &lt;a href=&quot;http://www.cisco.com/go/sa&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/go/sa&lt;/a&gt;. The following&#xA;  licenses are available:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;●   IP Base: This technology package is available as the default.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;●   Application Experience (APPX): This license includes data and&#xA;  application performance features.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;●   Unified Communications (UC):[6] This license includes voice&#xA;  features.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;●   Security (SEC) or Security with No Payload Encryption (SEC-NPE):&#xA;  This license includes features for securing network infrastructure.&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Cisco 4000 Series has a performance-on-demand license to increase&#xA;  the base forwarding throughput with no hardware changes. Also present&#xA;  is the High Security (HSEC) license, which removes the curtailment&#xA;  enforced by the U.S. government export restrictions on the encrypted&#xA;  tunnel count and encrypted throughput. The HSECK9 license is a&#xA;  separately required license for a feature to have full crypto&#xA;  functionality. Without the HSECK9 license, only 225 secure tunnels and&#xA;  85 Mbps of crypto bandwidth would be available.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-05-04T12:29:24.640" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="40915" PostTypeId="2" ParentId="40762" CreationDate="2017-05-04T12:54:06.283" Score="2" Body="&lt;p&gt;The client just connects to an IP address so the ASA doesn't know which name the client resolved to get that IP address, and hence it cannot do any redirection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only 2 options I see are:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;create a new profile (containing the new name) and distribute this to your users somehow out-of-band (e.g. email it to them or email them a URL where to download it)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;create a new profile on the ASA and tell your users to ignore the certificate warning (just this once :)) so they are able to connect, which will automatically update the profile.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2017-05-04T12:54:06.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40917" PostTypeId="1" AcceptedAnswerId="40920" CreationDate="2017-05-04T14:11:22.790" Score="0" ViewCount="1328" Body="&lt;p&gt;I was reading &quot;Computer Networking; A Top-Down Approach&quot; by &quot;Kurose Ross&quot; that I bumped in a question. Consider a  2 Link Network with a router as the following picture:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/G6x9x.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G6x9x.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;by definition: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The instantaneous throughput at any instant of time is the rate&#xA;  (in bits/sec) at which Host B is receiving the file&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;the average throughput of the file transfer is F/T bits/sec.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Consider we have file with size X&lt;em&gt;L in which X is the number of packets and L is the size of packet.&#xA;So as we see in the picture, there is Rs bits/sec Link bottleneck, so (X-1) packets will be transferred to client after the first packet gets to the router.  the first packet needs L/Rs seconds to get to the router. It means transferring the whole file needed X&lt;/em&gt;L/Rc + L/Rs seconds, Which by definition gives the following throughput:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/YGgjM.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/YGgjM.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;but in book, the answer of the same question is:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Having determined the throughput, we&#xA;  can now approximate the time it takes to transfer a large file of F bits from server to client as F/min{Rs, Rc}. For a specific example, suppose you are downloading an MP3 file of F = 32 million bits, the server has a transmission rate of Rs = 2 Mbps, and you have an access link of Rc = 1 Mbps. The time needed to transfer the file is then 32 seconds.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I can not understand why the book doesn't care about the last packet. What is the reason?&lt;/p&gt;&#xA;" OwnerUserId="36518" LastEditorUserId="36518" LastEditDate="2017-05-05T00:12:22.830" LastActivityDate="2017-05-05T00:12:22.830" Title="Throughput in a 2 link network" Tags="|router|network|throughput|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40918" PostTypeId="2" ParentId="7639" CreationDate="2017-05-04T14:48:08.457" Score="1" Body="&lt;p&gt;There is an option that overrides the default timeout to the tacacs server, depending on your software version:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tacacs-server host host-name [port integer] [timeout integer]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;timeout (Optional) Specifies a timeout value. This overrides the global timeout value set with the tacacs-server timeout command for this server only.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On newer versions, where tacacs-server is truncated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tacacs server [group name]&#xA;address ipv4 [tacacs server address]&#xA;key [password]&#xA;timeout [timeout integer]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;timeout - Time to wait for this TACACS server to reply (overrides default)&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&#xA;I can confirm, that we've now changed our TACACS configuration to the following and it works like a charm for all 900 devices, including the timeout option. All switches and routers are running the newest safe harbor IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TACACS is running on Cisco ISE redundant platform. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 2/3 switches and routers, with VRF also (not including Nexus):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa group server tacacs+ TACACS_PLUS&#xA;server-private XX.XX.X.XXX timeout 2 key &amp;lt;password&amp;gt;&#xA;server-private XX.XX.X.XXX timeout 2 key &amp;lt;password&amp;gt;&#xA;Optional: ip vrf forwarding &amp;lt;vrf name&amp;gt;&#xA;&#xA;aaa authorization config-commands&#xA;&#xA;aaa authentication login default group TACACS_PLUS local&#xA;aaa authentication enable default group TACACS_PLUS enable&#xA;aaa authorization exec default group TACACS_PLUS local &#xA;&#xA;aaa authorization commands 0 default group TACACS_PLUS if-authenticated &#xA;aaa authorization commands 1 default group TACACS_PLUS if-authenticated &#xA;aaa authorization commands 15 default group TACACS_PLUS if-authenticated &#xA;&#xA;aaa accounting commands 0 default start-stop group TACACS_PLUS&#xA;aaa accounting commands 1 default start-stop group TACACS_PLUS&#xA;aaa accounting commands 15 default start-stop group TACACS_PLUS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Nexus 5K, 6K, 7K (tested):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;feature tacacs+&#xA;&#xA;tacacs-server host XX.XX.X.XXX key &amp;lt;password&amp;gt; timeout 2&#xA;tacacs-server host XX.XX.X.XXX key &amp;lt;password&amp;gt; timeout 2&#xA;&#xA;aaa group server tacacs+ TACACS_PLUS&#xA;  server XX.XX.X.XXX&#xA;  server XX.XX.X.XXX&#xA;  source-interface &amp;lt;ex. vlan/loopback&amp;gt;&#xA;  !Optional: use-vrf &amp;lt;vrf name&amp;gt;&#xA;&#xA;aaa authentication login default group TACACS_PLUS&#xA;aaa authorization config-commands default group TACACS_PLUS&#xA;aaa authorization commands default group TACACS_PLUS&#xA;aaa accounting default group TACACS_PLUS&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2017-07-27T09:16:02.543" LastActivityDate="2017-07-27T09:16:02.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40920" PostTypeId="2" ParentId="40917" CreationDate="2017-05-04T14:58:29.253" Score="3" Body="&lt;p&gt;I think the reason is : &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Having determined the throughput, we can now &lt;strong&gt;approximate&lt;/strong&gt; the time&#xA;  it takes...&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The last packet is received in about a ms, and this doesn't change much the calculated value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other word, it is negligible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that, anyway, actual communication in a network use various protocols, each of which has some kind of overhead that will impact the actual throughput.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-05-04T14:58:29.253" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40925" PostTypeId="2" ParentId="40917" CreationDate="2017-05-04T19:04:56.410" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I can not understand why the book doesn't care about the last packet. What is the reason?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Because you are referencing two different examples that are slightly different. The first example which is above uses Rs as the bottleneck (link with lowest available bandwidth).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the second example, Rc is the bottleneck. This results in a slightly different way to calculate the time needed to transfer the data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt; Also re-reading the posted question with more care, the first example appears to be talking about calculating the average throughput where the second example appears to be calculating the average time it takes to transfer a file. Not having the full context of the book in front of me, it is likely that wording on the two questions is slightly different.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="33" LastEditDate="2017-05-05T00:08:51.233" LastActivityDate="2017-05-05T00:08:51.233" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="40931" PostTypeId="1" AcceptedAnswerId="40932" CreationDate="2017-05-05T01:21:20.333" Score="0" ViewCount="10820" Body="&lt;p&gt;&lt;strong&gt;Question 1:&lt;/strong&gt; &#xA;I have a mobile which is connected to my home &lt;code&gt;router&lt;/code&gt;. When I am connected to my home &lt;code&gt;router&lt;/code&gt;, I cannot turn on &lt;code&gt;Hotspot&lt;/code&gt; in my mobile whereas if my mobile is connected to internet via cellular telephone service provider, I am able to turn on &lt;code&gt;Hotspot&lt;/code&gt;. why is that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question 2 :&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the difference between &lt;code&gt;Mobile hotspot&lt;/code&gt; and &lt;code&gt;Router&lt;/code&gt; ?&lt;/p&gt;&#xA;" OwnerUserId="34757" LastActivityDate="2017-05-05T01:41:53.113" Title="Difference between Mobile hotspot and Router" Tags="|router|wireless|ieee-802.11|mobile|" AnswerCount="1" CommentCount="2" ClosedDate="2017-05-05T02:16:07.153" ContentLicense="CC BY-SA 3.0" />
  <row Id="40932" PostTypeId="2" ParentId="40931" CreationDate="2017-05-05T01:41:53.113" Score="1" Body="&lt;p&gt;Your cell phone has two primary connection methods - wifi and cellular.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you're connected to a cellular network, your wifi is not in use.  Enabling hotspot turns on our wifi and allows you to share your cellular connection with devices you connect via wifi.  You're turning your cell phone into something very similar to your home router with this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: You're in the mall with your cell phone and a laptop.  Your cell phone has cellular service (4G or something) but no wifi signal.  You turn on mobile hotspot mode on your cell phone, it creates a new wireless network &quot;x&quot;, and you connect your laptop to the &quot;x&quot; network.  Now when you surf the internet on your laptop, it passes the data to your cell phone which passes it along to your cellular network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your cell phone is connected to a wifi network, then the wireless part of your cell phone is in use and couldn't function as a hotspot without disconnecting from the wifi network.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2017-05-05T01:41:53.113" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40934" PostTypeId="2" ParentId="40761" CreationDate="2017-05-05T03:01:39.780" Score="1" Body="&lt;p&gt;Assuming you still have a port open on your SG300, you can use port mirroring/SPAN port to send a copy of all the traffic currently going to your router out another port.  Then you can attach a sniffing monitor to that port.  There are several options out there, but I don't have any experience with them (at least not in this capacity), so I'm not going to comment on their functionality.  The first two I found are BandwidthD and PRTG.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://bandwidthd.sourceforge.net/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://bandwidthd.sourceforge.net/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.paessler.com/manuals/prtg/packet_sniffer_monitoring&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.paessler.com/manuals/prtg/packet_sniffer_monitoring&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2017-05-05T03:01:39.780" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40935" PostTypeId="2" ParentId="40760" CreationDate="2017-05-05T03:05:26.213" Score="2" Body="&lt;p&gt;Two options:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Single click on the computer's name.  A text box might pop up (worked intermittently for me in 6.2) where you can input a new name.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Click on the computer, go to Config, and change the display name.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="74" LastActivityDate="2017-05-05T03:05:26.213" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40936" PostTypeId="2" ParentId="40592" CreationDate="2017-05-05T03:24:27.490" Score="1" Body="&lt;p&gt;Your process is correct, and assuming you get the same version number for all of them, you should be fine.  If you're connected to the stack master, a &quot;dir&quot; should show flash file systems matching each switch (flash-1:, flash-2:, flash-5:).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Remember these when you're copying the files over, but I don't &lt;em&gt;think&lt;/em&gt; you'll need them when you go to configure your boot statement - you should be able to just say &quot;boot system switch 1 flash:&quot;, &quot;boot system switch 2 flash:,&quot; etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The flash on those switches should be big enough to hold a second copy of IOS.  I'd recommend retaining your current version of IOS in addition to the new version to make roll-back easy.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2017-05-05T03:24:27.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40938" PostTypeId="1" CreationDate="2017-05-05T07:04:44.037" Score="2" ViewCount="1494" Body="&lt;p&gt;I've been working with Subscriber Management using DHCP and a FreeRadius server and have been quite successful. Of course, once my company heard that it is possible for customers to bring their public IP address with them to another location, I get to work on this matter :-)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All relevant configuration is below. I feel I'm very close to the solution, but I just need the final 2%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A) The MX80 is able to reach the FreeRadius server;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B) If I deactivate ppp-options { pap } and have a DHCP pool configured, then the client just gets an IP address from the pool. This is not what I want. I want to specify the IP address per customer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;C) Debugging the FreeRadius actions (freeradius -X) I can see that the user is authenticated successfully with given password. What do I need to send back to the Juniper? Framed-IP-Address I suppose, I use this for DHCP as well. The address just doesn't get bound to the dynamic pp0 interface.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;DYNINTF-PPPOE-TEST {&#xA;    routing-instances {&#xA;        &quot;$junos-routing-instance&quot; {&#xA;            interface &quot;$junos-interface-name&quot;;&#xA;            routing-options {&#xA;                access {&#xA;                    route $junos-framed-route-ip-address-prefix {&#xA;                        next-hop &quot;$junos-framed-route-nexthop&quot;;&#xA;                        preference 4;&#xA;                    }&#xA;                }&#xA;                access-internal {&#xA;                    route $junos-subscriber-ip-address {&#xA;                        qualified-next-hop &quot;$junos-interface-name&quot;;&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    interfaces {&#xA;        pp0 {&#xA;            unit &quot;$junos-interface-unit&quot; {&#xA;                ppp-options {&#xA;                    pap;&#xA;                }&#xA;                pppoe-options {&#xA;                    underlying-interface &quot;$junos-underlying-interface&quot;;&#xA;                    server;&#xA;                }&#xA;                keepalives interval 60;&#xA;                family inet {&#xA;                    unnumbered-address &quot;$junos-loopback-interface&quot;;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;VLAN-PROFILE {&#xA;    interfaces {&#xA;        demux0 {&#xA;            unit &quot;$junos-interface-unit&quot; {&#xA;                proxy-arp;&#xA;                vlan-id &quot;$junos-vlan-id&quot;;&#xA;                demux-options {&#xA;                    underlying-interface &quot;$junos-interface-ifd-name&quot;;&#xA;                }&#xA;                family pppoe {&#xA;                    duplicate-protection;&#xA;                    dynamic-profile DYNINTF-PPPOE-TEST;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;access-profile local;&#xA;&#xA;interfaces {&#xA;    ge-1/1/1 {&#xA;        description &quot;PPPoE test interface&quot;;&#xA;        flexible-vlan-tagging;&#xA;        auto-configure {&#xA;            vlan-ranges {&#xA;                dynamic-profile VLAN-PROFILE {&#xA;                    accept pppoe;&#xA;                    ranges {&#xA;                        any;&#xA;                    }&#xA;                }&#xA;                access-profile access-test-profile;&#xA;            }&#xA;        }&#xA;        encapsulation flexible-ethernet-services;&#xA;    }&#xA;    lo0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.120.120.1/32;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&#xA;access {&#xA;    radius-server {&#xA;        xxxx {&#xA;            secret &quot;&quot;; ## SECRET-DATA&#xA;            source-address xxxx;&#xA;        }&#xA;    }&#xA;    domain-name-server {&#xA;        xxxx;&#xA;        xxxx;&#xA;    }&#xA;    profile local {&#xA;        accounting-order radius;&#xA;        authentication-order radius;&#xA;        radius {&#xA;            authentication-server xxxx;&#xA;            accounting-server xxxx;&#xA;        }&#xA;        radius-server {&#xA;            xxxx {&#xA;                secret &quot;&quot;; ## SECRET-DATA&#xA;                source-address xxxx;&#xA;            }&#xA;        }&#xA;        accounting {                    &#xA;            order radius;&#xA;        }&#xA;    }&#xA;    profile access-test-profile {&#xA;        authentication-order radius;&#xA;        radius {&#xA;            authentication-server xxxx;&#xA;        }&#xA;        radius-server {&#xA;            xxxx {&#xA;                secret &quot;&quot;; ## SECRET-DATA&#xA;                source-address xxxx;&#xA;            }&#xA;        }&#xA;    }&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20112" LastEditorUserId="20112" LastEditDate="2018-05-14T14:56:07.003" LastActivityDate="2018-05-14T14:56:07.003" Title="Need help with PPPoE Subscriber Management on a MX80" Tags="|juniper|pppoe|radius|juniper-mx|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40944" PostTypeId="1" AcceptedAnswerId="40948" CreationDate="2017-05-05T12:31:33.420" Score="4" ViewCount="689" Body="&lt;p&gt;I've got a pair of WS-C6509-Es, and it's time to upgrade their IOS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They have been up for 5 years, so I have some concerns if they will boot up after reboot - I would like to ask your opinion if any known bugs, or something I need to have my mind on before I reload them?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both members are identical and running &lt;code&gt;s72033-adventerprisek9-mz.122-33.SXI2a.bin&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Mod Ports Card Type                                      Model             &#xA;--- ----- -----------------------------------------------------------                      &#xA;  1   16  CEF720 16 port 10GE                           WS-X6716-10GE     &#xA;  2    4  CEF720 4 port 10-Gigabit Ethernet             WS-X6704-10GE     &#xA;  3   48  CEF720 48 port 10/100/1000mb Ethernet         WS-X6748-GE-TX    &#xA;  5    2  Supervisor Engine 720 (Active)                WS-SUP720-3B      &#xA;  6   48  CEF720 48 port 1000mb SFP                     WS-X6748-SFP      &#xA;  7   48  CEF720 48 port 1000mb SFP                     WS-X6748-SFP      &#xA;  9   48  CEF720 48 port 1000mb SFP                     WS-X6748-SFP      &#xA;&#xA;   Hw        Fw                Sw           &#xA;------ ------------ ------------ -------&#xA;  1.0   12.2(18r)S1       12.2(33)SXI2 &#xA;  2.2   12.2(14r)S5       12.2(33)SXI2 &#xA;  2.3   12.2(14r)S5       12.2(33)SXI2 &#xA;  4.5   8.1(3)            12.2(33)SXI2 &#xA;  2.3   12.2(18r)S1       12.2(33)SXI2 &#xA;  1.5   12.2(14r)S5       12.2(33)SXI2 &#xA;  1.5 and 12.2(14r)S5     12.2(33)SXI2  --&amp;gt; other member has Hw 1.10 &#xA;&#xA;Mod  Sub-Module                  Model                        Hw     &#xA;---- --------------------------- ------------------ ----------- ------- &#xA;  1  Distributed Forwarding Card       WS-F6700-DFC3C         1.3   &#xA;  2  Centralized Forwarding Card       WS-F6700-CFC           2.0   &#xA;  3  Centralized Forwarding Card       WS-F6700-CFC           2.0   &#xA;  5  Policy Feature Card 3             WS-F6K-PFC3B           2.2   &#xA;  5  MSFC3 Daughterboard               WS-SUP720              2.4   &#xA;  6  Centralized Forwarding Card       WS-F6700-CFC           4.1   &#xA;  7  Centralized Forwarding Card       WS-F6700-CFC           2.0   &#xA;  9  Centralized Forwarding Card       WS-F6700-CFC           2.0   &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="35893" LastEditorUserId="8499" LastEditDate="2017-05-05T12:48:56.880" LastActivityDate="2017-05-05T17:35:06.210" Title="IOS upgrade - pair of WS-C6509-E" Tags="|cisco|switch|router|cisco-ios-12|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40945" PostTypeId="2" ParentId="40944" CreationDate="2017-05-05T12:42:28.997" Score="3" Body="&lt;p&gt;There's bug with some line cards on this platform which leads to card crash when reboot occurs after long uptime. If this happens, the card is subject to RMA. Cisco can determine potentially risky cards by serial number. Best solution for you is to contact technical support and ask them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should use specific version of software based on features you're using. Again, best advisor for you is Cisco. They can verify all potential bugs and recommend good variant for your needs. &lt;/p&gt;&#xA;" OwnerUserId="29564" LastEditorUserId="29564" LastEditDate="2017-05-05T13:00:43.187" LastActivityDate="2017-05-05T13:00:43.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40946" PostTypeId="1" CreationDate="2017-05-05T15:51:25.550" Score="2" ViewCount="2134" Body="&lt;p&gt;I am debugging a problem with my Azure VM Windows server receiving SMTP from the Internet, and want to use Wireshark to show ONLY SMTP.&lt;br&gt;&#xA;I would also like to use Wireshark to show the contents of the SMTP message to see if it is what I sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I cannot figure out, nor find help, on just simply making Wireshark show only SMTP.  Wireshark doc says to set filter to SMTP, but that does not work for me.&lt;/p&gt;&#xA;" OwnerUserId="36545" LastActivityDate="2017-05-05T17:31:32.860" Title="how to capture only SMTP using latest Wireshark 2.2.6 or later" Tags="|tcp|internet|wireshark|troubleshooting|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40947" PostTypeId="2" ParentId="40946" CreationDate="2017-05-05T17:31:32.860" Score="2" Body="&lt;p&gt;Filtering while capturing data in Wireshark is documented here: &lt;a href=&quot;https://wiki.wireshark.org/CaptureFilters&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.wireshark.org/CaptureFilters&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of such for SMTP is: &lt;code&gt;tcp port smtp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Filtering already captured data is here:&#xA;&lt;a href=&quot;https://www.wireshark.org/docs/wsug_html_chunked/ChWorkDisplayFilterSection.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.wireshark.org/docs/wsug_html_chunked/ChWorkDisplayFilterSection.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An example of such for SMTP is: &lt;code&gt;tcp.port == 25&lt;/code&gt; or simply &lt;code&gt;smtp&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When configuring display filters, you have to make sure to press &lt;kbd&gt;enter&lt;/kbd&gt; or click &lt;code&gt;Apply&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="412" LastActivityDate="2017-05-05T17:31:32.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40948" PostTypeId="2" ParentId="40944" CreationDate="2017-05-05T17:35:06.210" Score="1" Body="&lt;p&gt;As has already been mentioned, there are issues with line cards that were manufacture between a certain date period that will fail to boot once they have been on for a certain period of time already and are rebooted/reseated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/field-notices/637/fn63743.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;This&lt;/a&gt; is the field notice for the line cards that fail after a power cycle. If you contact TAC a head of time they can check by serial number if you are likely to be affected or not (that way you can have spears on standby).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In additional to that, if this is a VSS pair you need to ensure that the IOS image is on both SUPs and that the config register and boot variable are in sync. Sometimes this doesn’t all happen automatically and when you reboot the old SUP is still on the old IOS and complains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the command &lt;code&gt;show bootvar&lt;/code&gt; to check that the boot variable is the same on both SUPs. If it isn’t or if the config register isn’t the same a handy trick is to set the config reg to 0x2142 for example (which is the “skip config at boot up” value), save the config, the set the config reg to 0x2102 (which is the “normal” value) and then save the config again. Hopefully this will force a sync between SUPs (you can also check with &lt;code&gt;remote command switch show boot&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="253" LastActivityDate="2017-05-05T17:35:06.210" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40950" PostTypeId="1" AcceptedAnswerId="40952" CreationDate="2017-05-05T21:16:16.803" Score="2" ViewCount="106" Body="&lt;p&gt;I'm running cisco WS-C4948-10GE (MPC8540) and having a vlan configured as following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip address 192.168.1.1 255.255.255.248&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, How to create an ACL to limit the connections for ports 80 and 22 on IP &lt;strong&gt;&quot;192.168.1.2&quot;&lt;/strong&gt; and allow access to it &lt;strong&gt;only from 1.1.1.1 and 2.2.2.2?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that the other IPs on this subnet &quot;192.168.1.3 - 192.168.1.6&quot; should be normally accessed on all ports from everywhere.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="33838" LastActivityDate="2017-05-05T21:26:47.013" Title="Cisco port ACL for one IP" Tags="|cisco|security|acl|port-security|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40952" PostTypeId="2" ParentId="40950" CreationDate="2017-05-05T21:26:47.013" Score="2" Body="&lt;p&gt;Hosts on the same vlan are not limited by the access list. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Access-list extended neteng-se&#xA;    Permit tcp host 1.1.1.1 host 192.168.1.2 eq www&#xA;    Permit tcp host 2.2.2.2 host 192.168.1.2 eq 22&#xA;    Deny ip any host 192.168.1.2&#xA;    Permit ip any any&#xA;&#xA;Interface vlan 1&#xA;Ip access-list neteng-se out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-05T21:26:47.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40954" PostTypeId="1" AcceptedAnswerId="40955" CreationDate="2017-05-05T22:18:40.770" Score="0" ViewCount="1103" Body="&lt;p&gt;What is the difference between Vlans and subnets? I don't mean the configure or structure&lt;/p&gt;&#xA;" OwnerUserId="35524" LastActivityDate="2017-05-05T23:09:36.777" Title="Difference between Vlans and subnets" Tags="|vlan|subnet|" AnswerCount="1" CommentCount="0" ClosedDate="2017-05-05T23:08:21.057" ContentLicense="CC BY-SA 3.0" />
  <row Id="40955" PostTypeId="2" ParentId="40954" CreationDate="2017-05-05T23:09:36.777" Score="1" Body="&lt;p&gt;VLANs are an Ethernet concept. Subnets are an IP concept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VLAN splits an Ethernet network into multiple logically seperate Ethernet networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A subnet defines which hosts a host will try to communicate with directly verses which hosts will need to go via a router. It also defines &quot;network&quot; and &quot;broadcast&quot; addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is common practice to have a 1:1 mapping between subnets and VLANs but it is perfectly possible to have multiple subnets on the same VLAN. Equally it is possible to use proxy arp to split a subnet between multiple VLANs or even have two VLANs using the same IP subnet for different purposes.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-05T23:09:36.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40956" PostTypeId="1" AcceptedAnswerId="40964" CreationDate="2017-05-05T23:10:10.690" Score="0" ViewCount="753" Body="&lt;p&gt;I have a guest network and a corporate network. There is a firewall (Cisco ASA) and a router (3750G L3 switch) sitting between these networks. All of my Apple TVs are on the guest network side. My wireless controller handles all of the Bonjour proxy/gateway stuff and will advertise bonjour services (Airplay) on one vlan to another. However, i still have to allow and route Airplay traffic from one network to another. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What would this acl/policy/rule look like? I've found &lt;a href=&quot;https://support.apple.com/en-us/HT202944&quot; rel=&quot;nofollow noreferrer&quot;&gt;this article from Apple&lt;/a&gt; and &lt;a href=&quot;https://techsupport.cambridgeaudio.com/hc/en-us/articles/200535411-What-firewall-ports-need-to-be-open-to-use-AirPlay-&quot; rel=&quot;nofollow noreferrer&quot;&gt;this helpful article&lt;/a&gt; with just the ports for Airplay. Is it just a matter of specifying the ports and setting the src and dst with the correct info? Or is there more to it?&lt;/p&gt;&#xA;" OwnerUserId="507" LastActivityDate="2017-05-06T02:54:09.370" Title="How do i route and permit Airplay traffic from one network to another?" Tags="|routing|vlan|firewall|multicast|" AnswerCount="1" CommentCount="0" ClosedDate="2019-02-06T00:11:51.493" ContentLicense="CC BY-SA 3.0" />
  <row Id="40957" PostTypeId="2" ParentId="1029" CreationDate="2017-05-05T23:14:03.017" Score="4" Body="&lt;p&gt;A VLAN is an Ethernet level concept, a subnet is an IP level concept.&lt;/p&gt;&#xA;&lt;p&gt;A VLAN splits an Ethernet network into multiple logically separate Ethernet networks.&lt;/p&gt;&#xA;&lt;p&gt;A subnet defines which hosts a host will try to communicate with directly, versus which hosts will need to go via a router. It also defines &amp;quot;network&amp;quot; and &amp;quot;broadcast&amp;quot; addresses.&lt;/p&gt;&#xA;&lt;p&gt;It is common practice to have a 1:1 mapping between subnets and VLANs, but it is perfectly possible to have multiple subnets on the same VLAN. Equally it is possible to use proxy ARP to split a subnet between multiple VLANs or even have two VLANs using the same IP subnet for different purposes.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="31800" LastEditDate="2022-10-13T20:33:28.647" LastActivityDate="2022-10-13T20:33:28.647" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="40958" PostTypeId="1" AcceptedAnswerId="40979" CreationDate="2017-05-05T23:47:41.247" Score="1" ViewCount="993" Body="&lt;p&gt;I have multiple vlans on the same network on the switch , how can I configure the IP address for every sub-interface &#xA;to connect to the router &#xA;I can't do that it causes overlapping .. what is the solution ?&lt;/p&gt;&#xA;" OwnerUserId="35524" LastEditorUserId="35524" LastEditDate="2017-05-06T00:08:45.487" LastActivityDate="2020-12-13T10:19:16.893" Title="Multiple vlans on the same network -please help me" Tags="|switch|vlan|" AnswerCount="4" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="40959" PostTypeId="2" ParentId="40958" CreationDate="2017-05-06T00:37:07.107" Score="1" Body="&lt;p&gt;The first thing you need to understand is that VLANs are an Ethernet concept. The switch doesn't care too much what kind of higher level traffic is flowing over them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second thing you need to understand is that switches have very limited IP functionality. Many only support IP for management purposes, those that do support IP routing usuaully only have very basic routing functionality.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The third thing you need to understand is that overlapping IP blocks are a massive pain in the arse. If you can eliminate them you should do so.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;Ok with all that in mind you have overlapping subnets and you can't get rid of them. What to do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing you need to do is look at the big picture. Figure out what the network looks like. Figure out what your goals are.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Do systems on the different networks need to talk to each other or are you just trying to arrange Internet access.&lt;/li&gt;&#xA;&lt;li&gt;The subnets overlap but do the host addresses actually clash? &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Once you have a picture of what you have and what you need you can start looking for solutions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have overlapping subnets and/or identical default gateways on multiple networks but you don't actually have overlapping host addresses I would look to use a single instance solution on a sufficiently flexible routing platform. Linux will let you assign the same address on multiple interfaces and you can then add /32 routes to send each IP address to the desired interface. If you want hosts on the overlapping subnets to talk to each other you can use proxy arp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do have overlapping host addresses then you probably want to use a solution involving multiple independent instances of the IP stack. Linux calls these instances &quot;network namespaces&quot;, the big name router vendors call them &quot;vrfs&quot;. Each network can be terminated on it's own instance of the IP stack and then NAT rules applied as neede to translate things to a non-overlapping IP space. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-06T00:37:07.107" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40960" PostTypeId="1" AcceptedAnswerId="40962" CreationDate="2017-05-06T00:52:17.980" Score="1" ViewCount="313" Body="&lt;p&gt;Why we use vlans in the different subnets, the subnets are independent so why??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know it is a beginner question  help me please&lt;/p&gt;&#xA;" OwnerUserId="35524" LastActivityDate="2017-05-06T02:18:38.800" Title="Use Vlans on different subnets" Tags="|vlan|subnet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40962" PostTypeId="2" ParentId="40960" CreationDate="2017-05-06T02:18:38.800" Score="2" Body="&lt;p&gt;Because VLANs provide layer-2 segregation while subnetting is layer-3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Two different subnets on the same VLAN (broadcast domain) will still see all the broadcast frames for each.&lt;/p&gt;&#xA;" OwnerUserId="36555" LastActivityDate="2017-05-06T02:18:38.800" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40963" PostTypeId="2" ParentId="40902" CreationDate="2017-05-06T02:31:58.527" Score="1" Body="&lt;p&gt;One way to do this is to take the full BGP routing table. That way outbound packets will follow the shortest route back out and the more specific route will override the normal default route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other issue is that you can only have one default route inserted into the BGP table. So either North America or Asia will be the default route out but not both.&lt;/p&gt;&#xA;" OwnerUserId="36555" LastActivityDate="2017-05-06T02:31:58.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40964" PostTypeId="2" ParentId="40956" CreationDate="2017-05-06T02:54:09.370" Score="0" Body="&lt;p&gt;Yes. :)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As long as Bonjour is being propagated across, then all you need to do is allow traffic on the respective ports for Airplay. You may want to further restrict by IP since they're standard ports, i.e. http, https, rtsp, DAAP, and MDNS.&lt;/p&gt;&#xA;" OwnerUserId="36555" LastActivityDate="2017-05-06T02:54:09.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40965" PostTypeId="1" CreationDate="2017-05-06T02:58:39.683" Score="0" ViewCount="36" Body="&lt;p&gt;Is it possible to completely disregard incoming connections from an i.p. address or does the networking hardware of switches, routers, etc. prevent this from being possible? How do I get my router to refuse to even acknowledge certain incoming i.p.s?&lt;/p&gt;&#xA;" OwnerUserId="36556" LastActivityDate="2017-06-05T03:40:04.513" Title="Is there a way to refuse an i.p. without acknowledging it" Tags="|routing|firewall|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40966" PostTypeId="2" ParentId="40965" CreationDate="2017-05-06T03:02:41.943" Score="1" Body="&lt;p&gt;You can use an inbound ACL to drop the packet but the router will still have to process the incoming packet to match against the ACL. Otherwise, the packet will be dropped.&lt;/p&gt;&#xA;" OwnerUserId="36555" LastActivityDate="2017-05-06T03:02:41.943" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="40975" PostTypeId="1" AcceptedAnswerId="41070" CreationDate="2017-05-06T12:11:42.370" Score="1" ViewCount="636" Body="&lt;p&gt;I tried set DHCP on my host, but it can't find the DHCP server. What am I supposed to do?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Q4yHL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q4yHL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/H80PQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H80PQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;system {&#xA;    root-authentication {&#xA;        encrypted-password &quot;$1$AZZi5zCr$CoHgrnTOOXUpyaCJm3XLn/&quot;; ## SECRET-DAT&#xA;    }&#xA;    services {&#xA;        ssh;&#xA;        web-management {&#xA;            http {&#xA;                interface ge-0/0/0.0;&#xA;            }&#xA;        }&#xA;        dhcp {&#xA;            pool 192.168.10.0/24 {&#xA;                address-range low 192.168.10.2 high 192.168.10.254;&#xA;                router {&#xA;                    192.168.10.1;&#xA;                }&#xA;            }&#xA;            pool 192.168.20.0/24 {&#xA;                address-range low 192.168.20.2 high 192.168.20.254;&#xA;                router {&#xA;                    192.168.20.1;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    syslog {&#xA;        user * {&#xA;            any emergency;&#xA;        }&#xA;        file messages {&#xA;            any any;&#xA;            authorization info;&#xA;        }&#xA;        file interactive-commands {&#xA;            interactive-commands any;&#xA;        }&#xA;    }&#xA;    license {&#xA;        autoupdate {&#xA;            url https://ae1.juniper.net/junos/key_retrieval;&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/0 {&#xA;        vlan-tagging;&#xA;        unit 0 {&#xA;            vlan-id 2;&#xA;            family inet {&#xA;                address 192.168.20.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 192.168.10.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;security {&#xA;    screen {&#xA;        ids-option untrust-screen {&#xA;            icmp {&#xA;                ping-death;&#xA;            }&#xA;            ip {&#xA;                source-route-option;&#xA;                tear-drop;&#xA;            }&#xA;            tcp {&#xA;                syn-flood {&#xA;                    alarm-threshold 1024;&#xA;                    attack-threshold 200;&#xA;                    source-threshold 1024;&#xA;                    destination-threshold 2048;&#xA;                    queue-size 2000; ## Warning: 'queue-size' is deprecated&#xA;                    timeout 20;&#xA;                }&#xA;                land;&#xA;            }&#xA;        }&#xA;    }&#xA;    policies {&#xA;        from-zone trust to-zone trust {&#xA;            policy default-permit {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone trust to-zone untrust {&#xA;            policy default-permit {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    permit;&#xA;                }&#xA;            }&#xA;        }&#xA;        from-zone untrust to-zone trust {&#xA;            policy default-deny {&#xA;                match {&#xA;                    source-address any;&#xA;                    destination-address any;&#xA;                    application any;&#xA;                }&#xA;                then {&#xA;                    deny;&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;    zones {&#xA;        security-zone trust {&#xA;            tcp-rst;&#xA;        }&#xA;        security-zone untrust {&#xA;            screen untrust-screen;&#xA;            interfaces {&#xA;                ge-0/0/0.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            http;&#xA;                            https;&#xA;                            ssh;&#xA;                            telnet;&#xA;                            dhcp;&#xA;                            ping;&#xA;                        }&#xA;                    }&#xA;                }&#xA;                ge-0/0/1.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            ping;&#xA;                            dhcp;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36270" LastEditorUserId="8499" LastEditDate="2017-05-06T15:52:48.077" LastActivityDate="2017-05-10T04:29:35.337" Title="How to set DHCP with VLANs on vSRX (GNS3)?" Tags="|dhcp|juniper-srx|gns3|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40978" PostTypeId="1" CreationDate="2017-05-06T12:44:57.217" Score="2" ViewCount="2098" Body="&lt;p&gt;Can we have exactly same IP addresses with different CIDR notations? Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;194.24.0.20/20&#xA;194.24.0.20/21&#xA;194.24.0.20/16&#xA;194.24.0.20/24&#xA;194.24.0.20/29&#xA;194.24.0.20/15&#xA;And so on...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;How will it effect routing?&lt;/p&gt;&#xA;" OwnerUserId="36564" LastEditorUserId="8499" LastEditDate="2018-12-11T00:15:54.290" LastActivityDate="2020-06-20T11:25:11.627" Title="Same IP addresses with different CIDR notations, is it possible?" Tags="|ip|ipv4|ip-address|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40979" PostTypeId="2" ParentId="40958" CreationDate="2017-05-06T13:06:19.970" Score="2" Body="&lt;p&gt;Short answer : you can't. You either have to make one Vlan ( probably a bad idea) or create multiple IP subnets. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-06T13:06:19.970" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="40982" PostTypeId="2" ParentId="5418" CreationDate="2017-05-06T14:54:09.233" Score="1" Body="&lt;p&gt;In simple terms,if PCB sits in different network PCA doesnt bother about PCB's physical address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When PCA wants to sends data to PCB sitting in different network, PCA needs to know the mac of its gateway. If it doesnt know it will send arp for gateway's physical address.Once ARP is resolved for its gateway address, it will use Destination IP address of PCB and Destination Mac address of gateway's interface.&lt;/p&gt;&#xA;" OwnerUserId="36569" LastActivityDate="2017-05-06T14:54:09.233" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40985" PostTypeId="2" ParentId="40978" CreationDate="2017-05-06T16:06:20.997" Score="1" Body="&lt;p&gt;What you seem to be missing is that when you mask those addresses with your different network masks, they all arrive at the same network address: &lt;code&gt;194.24.0.0&lt;/code&gt;. An IPv4 address is simply a 32-bit binary number. CIDR notation gives you the mask length. When you mask (logical &lt;code&gt;AND&lt;/code&gt;) the address and mask, you get the network address. See the previous question, &lt;a href=&quot;https://networkengineering.stackexchange.com/q/7106/8499&quot;&gt;How do you calculate the prefix, network, subnet, and host numbers?&lt;/a&gt; and its excellent answer for more details.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You cannot assign overlapping network addresses to router interfaces because the router would have no way to know to which interface it should send traffic destined for that network. You can, however, have multiple routes to a network with different mask lengths in a routing table. The router will look at the mask length to determine to which interface it should send traffic destined for that network. The routing table entry with the longest mask length wins. Based on what you have listed in your question, that would be &lt;code&gt;194.24.0.0/29&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-06T16:06:20.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40991" PostTypeId="1" AcceptedAnswerId="40992" CreationDate="2017-05-06T23:31:06.210" Score="-1" ViewCount="47" Body="&lt;p&gt;I'm looking for any router that is indeed only a router (a device that routes traffic from one network to another) and not those &quot;routers&quot; that we see nowadays in people's home that are router + switch in one package.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does it exist? I don't intend to buy it, so it can be old and not available for purchase anymore. I just need to know for searching purposes.&lt;/p&gt;&#xA;" OwnerUserId="28166" LastActivityDate="2017-05-07T00:11:31.507" Title="Any example of routers who are NOT a switch too" Tags="|routing|switch|router|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="40992" PostTypeId="2" ParentId="40991" CreationDate="2017-05-07T00:11:31.507" Score="1" Body="&lt;p&gt;Any router by default runs data path for layer 1,2 and 3 while it runs control plane for all the 5 layers. You cannot skip a layer in the data path at a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, seeing your question you want a router that does no do switching. This is definately possible. How the forwarding takes place, depends on the lookup table it refers to.&#xA;If it refers to the L3 forward table, it will be routing and if it refers to the L2 forwarding table it will do switching&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-05-07T00:11:31.507" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40993" PostTypeId="1" CreationDate="2017-05-07T00:36:37.470" Score="2" ViewCount="777" Body="&lt;p&gt;New to Cisco here, and wanting to know if an idea is possible with my ASA 5506-X  (version 9.5).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ASA has a public/external IP that (for example) is z.z.z.3.  Currently, it is performing SNAT for my internal LAN, handling site-to-site VPNs, etc.  (I believe in Cisco terms it's called PAT.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have another machine that we'll call Host X.  It also has a public IP (z.z.z.4) on the same subnet as the ASA.  The diagram below shows how things are currently set up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/LkRbR.png&quot; alt=&quot;Network diagram showing router connected to ASA and &amp;quot;Host X&amp;quot;&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is:&lt;br&gt;&#xA;&lt;strong&gt;Can I have the ASA be a firewall for Host X with the restrictions below?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Host X must keep it's public IP (I have no admin access to Host X)&lt;/li&gt;&#xA;&lt;li&gt;I have additional empty physical interfaces on the ASA.&lt;/li&gt;&#xA;&lt;li&gt;The ASA must be able to continue doing source NAT for the internal LAN so they have access to the Internet.&lt;/li&gt;&#xA;&lt;li&gt;The ASA must keep it's current external IP address so it can continue being a terminating point for the site-to-site VPNs (not pictured).&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;That way I can lock down access to Host X with ASA access-lists rather than rely on Host X's firewall.  I know this sort of thing would be easy with Linux, but I can't quite wrap my head around how the ASA should be configured.&lt;/p&gt;&#xA;" OwnerUserId="36577" LastActivityDate="2017-10-05T05:25:52.077" Title="Can Cisco ASA be a firewall for another public IP?" Tags="|cisco-asa|firewall|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40995" PostTypeId="2" ParentId="40978" CreationDate="2017-05-07T01:25:18.560" Score="2" Body="&lt;p&gt;Subnets are for routing tables for longest prefix match. But an IP packet in itself has no notion of subnets. so you cannot assign same IP addresses with different subnets.&lt;/p&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="30735" LastEditDate="2017-05-07T01:39:19.013" LastActivityDate="2017-05-07T01:39:19.013" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="40996" PostTypeId="1" CreationDate="2017-05-07T02:11:21.570" Score="1" ViewCount="122" Body="&lt;p&gt;Could someone explain why having a long sequence of 0s or 1s is bad if we use NRZ Encoding? Is it because if we were to have two signals (i.e. 00011000 and 01111111), then with NRZ encoding we couldn't tell where the 1st signal ends and the second signal begins?&lt;/p&gt;&#xA;" OwnerUserId="36579" LastActivityDate="2017-06-06T04:13:16.883" Title="NRZ Encoding Scheme" Tags="|ethernet|layer2|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="40997" PostTypeId="2" ParentId="40996" CreationDate="2017-05-07T03:18:42.493" Score="2" Body="&lt;p&gt;Nrz requires an external clock to keep in sync. Otherwise long sequences of the same digit may get out of sync, and a string of twenty zeros might be mistaken for nineteen zeros, for example. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-07T03:18:42.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41001" PostTypeId="1" AcceptedAnswerId="41717" CreationDate="2017-05-07T07:23:10.553" Score="2" ViewCount="575" Body="&lt;p&gt;If I'm connected to a Tier 3 ISP then does that mean whenever I access anything over the internet, the traffic has to go through a Tier 1 ISP because I've read that Tier 3 ISPs purchase their bandwidth either directly from Tier 1 or indirectly via Tier 2? &lt;/p&gt;&#xA;" OwnerUserId="36580" LastActivityDate="2017-06-06T16:25:31.650" Title="About Tiers in the internet" Tags="|internet|network-core|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41002" PostTypeId="1" CreationDate="2017-05-07T08:11:11.730" Score="1" ViewCount="480" Body="&lt;p&gt;&lt;strong&gt;Setup:&lt;/strong&gt;&lt;br&gt;&#xA;Currently working on  a machine with Red Hat 7.2 (&lt;code&gt;Red Hat Enterprise Linux Server release 7.2 (Maipo)&lt;/code&gt; to be exact.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a vxlan interface configured:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ip link add test.123 type vxlan dev test id 123 dstport 4789&#xA;# ifconfig  test.123&#xA;test.123: flags=4098&amp;lt;BROADCAST,MULTICAST&amp;gt;  mtu 1450&#xA;    ether a2:3a:a8:0c:d9:76  txqueuelen 1000  (Ethernet)&#xA;    RX packets 0  bytes 0 (0.0 B)&#xA;    RX errors 0  dropped 0  overruns 0  frame 0&#xA;    TX packets 0  bytes 0 (0.0 B)&#xA;    TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# ifconfig test.132 up&#xA;# ifconfig test.123&#xA;test.123: flags=4163&amp;lt;UP,BROADCAST,RUNNING,MULTICAST&amp;gt;  mtu 1450&#xA;    inet6 fe80::a03a:a8ff:fe0c:d976  prefixlen 64  scopeid 0x20&amp;lt;link&amp;gt;&#xA;    ether a2:3a:a8:0c:d9:76  txqueuelen 1000  (Ethernet)&#xA;    RX packets 0  bytes 0 (0.0 B)&#xA;    RX errors 0  dropped 0  overruns 0  frame 0&#xA;    TX packets 0  bytes 0 (0.0 B)&#xA;    TX errors 0  dropped 5 overruns 0  carrier 0  collisions 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:&lt;/strong&gt;&lt;br&gt;&#xA;Where does the IPV6 address come from? How can I know it in advance?&lt;br&gt;&#xA;I've tried setting an alternative IPv6 address before performing &lt;code&gt;up&lt;/code&gt;, and I end up with two different IPV6 addresses....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="36582" LastEditorUserId="36582" LastEditDate="2017-05-07T08:36:23.840" LastActivityDate="2017-05-07T12:02:44.487" Title="How do I determine the IPV6 address added to VXLAN when interface is set to up?" Tags="|ipv6|linux|vxlan|" AnswerCount="2" CommentCount="1" ClosedDate="2017-05-07T16:23:19.830" ContentLicense="CC BY-SA 3.0" />
  <row Id="41003" PostTypeId="2" ParentId="41002" CreationDate="2017-05-07T09:23:59.490" Score="1" Body="&lt;p&gt;This is autoconfigured link local address. First 64 bits are always fe80:: according to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#section-2.5.6&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 4291&lt;/a&gt;. Last 64 bits are interface ID. Interface ID is &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4291#page-20&quot; rel=&quot;nofollow noreferrer&quot;&gt;modified MAC address&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;You can disable autoconfiguration:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;echo 0 &amp;gt; /proc/sys/net/ipv6/conf/&amp;lt;interface&amp;gt;/autoconf&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;And set ipv6 address manually.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastEditorUserId="-1" LastEditDate="2021-10-07T07:59:29.080" LastActivityDate="2017-05-07T09:23:59.490" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41004" PostTypeId="2" ParentId="41001" CreationDate="2017-05-07T09:27:42.843" Score="3" Body="&lt;p&gt;Tier X is formal reference. Traffic flows according to IP routing table. Basically you can access some resources without even leaving your provider's network. And some others require traffic to flow through several ISPs with different &quot;tier&quot;.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-05-07T09:27:42.843" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41006" PostTypeId="2" ParentId="41002" CreationDate="2017-05-07T09:54:37.057" Score="0" Body="&lt;p&gt;This is an &lt;a href=&quot;https://en.wikipedia.org/wiki/Link-local_address&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPv6 link local address&lt;/a&gt;, and this is not something specific to VXLAN. Any interface with IPv6 enabled must at least a link local address configured, and optionally other (possibly publicly routable) addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link local addresses are used only on the local network and are typically generated automatically based on the MAC address of the interface.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorDisplayName="user2084" LastEditDate="2017-05-07T12:02:44.487" LastActivityDate="2017-05-07T12:02:44.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41008" PostTypeId="1" CreationDate="2017-05-07T11:33:55.050" Score="2" ViewCount="59" Body="&lt;p&gt;Let's suppose I have a configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;host: 192.168.1.145/25&#xA;gateway: 192.168.1.129&#xA;network: 192.168.1.128/25&#xA;broadcast: 192.168.1.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What happens if I add +1 bit and remove -1 bit to the mask?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) /26&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network: 192.168.1.128/26&#xA;broadcast: 192.168.1.191&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does it affect the host IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) /24 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;network: 192.168.1.0/24&#xA;broadcast: 192.168.1.255&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Does it affect the host IP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So with this example I don't see any difference. But maybe I make something wrong? How should such type of example be done?&lt;/p&gt;&#xA;" OwnerUserId="36388" LastEditorUserId="20757" LastEditDate="2017-05-08T02:15:22.463" LastActivityDate="2017-05-08T02:15:22.463" Title="Host behavior with mask +1 and -1" Tags="|ipv4|ip|layer3|network|" AnswerCount="1" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41009" PostTypeId="2" ParentId="41008" CreationDate="2017-05-07T11:47:41.227" Score="3" Body="&lt;p&gt;All your assumptions are correct. Subnet mask determines subnet length. So in cases you described length of network changes, but host remains inside of the network. The difference is .145 will not need routing entry (except connected 192.168.1 one) in order to reach, say, .200 with /24 and /25 mask, but it will need route in order to reach the same .200 host with /26 mask. And similarly it'll reach .1 without routing entry with /24 mask, but not with /25 and /26.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-05-07T11:47:41.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41010" PostTypeId="1" AcceptedAnswerId="41863" CreationDate="2017-05-07T13:00:51.480" Score="1" ViewCount="1702" Body="&lt;p&gt;I am using Beetel 777VR1 with Airtel Broadband. I am trying to connect with a FTP server but I am not able to access that. However  with same credentials when I try to connect with my mobile connection it is successful. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What can be the cause?&lt;/p&gt;&#xA;" OwnerUserId="36586" LastActivityDate="2017-08-11T15:35:07.317" Title="Can't connect to FTP" Tags="|troubleshooting|network-access|" AnswerCount="1" CommentCount="3" ClosedDate="2018-07-21T00:34:16.897" ContentLicense="CC BY-SA 3.0" />
  <row Id="41011" PostTypeId="1" AcceptedAnswerId="41019" CreationDate="2017-05-07T14:33:31.563" Score="2" ViewCount="1391" Body="&lt;p&gt;I've reciently tested ADSL network. Alongside parameters that I'm familiar with their meaning (SNR marin, Line Attenuation etc.) I come across Tx Power. I tried to google it, but there was no clear explanation, my greatest achievement in this matter was the decoding abbreviation to &quot;transmit power&quot;.&lt;/p&gt;&#xA;" OwnerUserId="36588" LastActivityDate="2017-05-08T03:36:17.817" Title="What's the meaning of &quot;Tx Power&quot; in DSL test?" Tags="|adsl|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41013" PostTypeId="2" ParentId="40993" CreationDate="2017-05-07T18:50:49.133" Score="0" Body="&lt;p&gt;You can use Multiple Context Mode, and 2 instance inside, one for your present configuration, and second for transparent firewall mode for ip-less. You can read about here: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/ha_contexts.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/general/asa_91_general_config/ha_contexts.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be careful, and don't forget to make backup of your configuration. &lt;/p&gt;&#xA;" OwnerUserId="35558" LastActivityDate="2017-05-07T18:50:49.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41014" PostTypeId="1" AcceptedAnswerId="41015" CreationDate="2017-05-07T19:37:59.087" Score="8" ViewCount="54556" Body="&lt;p&gt;I know that the layer 2 doesn't understand IP, and the broadcast domain is same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why can't devices talk, how does it happen?&lt;/p&gt;&#xA;" OwnerUserId="35524" LastEditorUserId="8499" LastEditDate="2020-11-27T22:36:45.497" LastActivityDate="2021-01-04T03:21:04.970" Title="Why can't devices in different subnets talk with each other?" Tags="|routing|switch|router|subnet|switching|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41015" PostTypeId="2" ParentId="41014" CreationDate="2017-05-07T19:44:52.353" Score="19" Body="&lt;p&gt;Devices in different subnets can communicate. That is the purpose of a router. Routers route packets between different networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if devices in different networks are on the same layer-2 broadcast domain, you need a router to let the devices communicate at layer-3. That is because each host will compare the destination layer-3 address and its own layer-3 address and mask to see if they are on the same network. If the destination host is on a different network, the host will send the packets in layer-2 frames to its configured gateway (router).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The host must assume that the destination network could be across the world from its network, and the gateway is the host on the network that knows how to forward packets toward the destination network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-07T19:44:52.353" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41016" PostTypeId="2" ParentId="40993" CreationDate="2017-05-07T20:22:59.440" Score="1" Body="&lt;p&gt;Yes, ASA can be firewall for another public IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Write a specific route for host_x on the router pointing towards firewall and similarly change the default gateway on host_x to point to the firewall IP z.z.z.3 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router(config)# ip route z.z.z.4 255.255.255.255 z.z.z.3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Also, you need to enable the command &lt;code&gt;same-security-level intra-interface traffic&lt;/code&gt; command on the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way, you can control the traffic going to and fro by the access-list defined on interface connecting to the switch on the firewall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know changing default gateway in the host_x requires admin access. I think all the scenarios require changing the default gateway on host_x.&lt;/p&gt;&#xA;" OwnerUserId="21671" LastEditorUserId="453" LastEditDate="2017-10-05T05:25:52.077" LastActivityDate="2017-10-05T05:25:52.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41017" PostTypeId="2" ParentId="37852" CreationDate="2017-05-08T00:01:28.377" Score="0" Body="&lt;p&gt;You can use a free firewall solution that can do great things on your scenario. Like you said, sever is 10 Gb capable, then get the software and install it. With that you will have a router, if you need it, and the main thing, a firewall. Put the IP on your WAN interface, and the same on your LAN interface. At this point, you need t create a static route across your WAN link: 0.0.0 0.0.0.0 next-hop(ip_of_your_isp)&lt;/p&gt;&#xA;" OwnerUserId="17709" LastActivityDate="2017-05-08T00:01:28.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41018" PostTypeId="2" ParentId="12631" CreationDate="2017-05-08T00:12:36.587" Score="1" Body="&lt;p&gt;The answer to this question, in case someone comes across this from a google search, is that the multicast packets were IPv6, called by a bad HP driver that spammed the network when the devices went to sleep. Storm control does not protect from ipv6 multicast spam, and so it was not registering this packets are being broadcast/multicast traffic.&lt;/p&gt;&#xA;" OwnerUserId="10034" LastActivityDate="2017-05-08T00:12:36.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41019" PostTypeId="2" ParentId="41011" CreationDate="2017-05-08T00:59:58.813" Score="1" Body="&lt;p&gt;It is the transmit power (≈ voltage) with which your device sends its signal to the cable. It effectively means, how strongly your device &quot;shouts&quot; on the cable to the receivers (which is mainly an ADSL router by your ISP).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is in decibel. Decibel is a&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;relative&lt;/li&gt;&#xA;&lt;li&gt;logarithmic quantity.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Relative means, that it shows the proportion of the measured quantity, compared to a reference value.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Logarithmic is an uncommon thing. For example, in a linear unit, like meters, 2m means 2 times higher distance as 1m. In the case of decibel, +10 decibel means a 10 times of increase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thus, if you increase the Tx power with 10, you will get 10 times higher power. If you increase with 20, you get 100 times higher power.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note, a 10 dB difference means a 10 times growth in the voltage, and thus a 100 times growth in the power (because the power depends on the voltage in these cases mostly quadratically). This is not important from a network engineering view (but it is from an electronic engineer view).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Tuning the TX parameter can be useful if you have to deal with too long or noisy cables. These cause mainly exponential losses with the cable length, this is why the logarithmic tuning is needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It may be also useful to suppress noise sources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Similar tuning is useful also on other network types, where noise is a significant problem (for example, wifi).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because it is a logarithmic quantity and the loss grow exponentially with the cable length, typically the required decibel has to be tuned linearly with the cable length (i.e. if you require, for example, 10 dB length grow for a cable length growth of 20m, you need again 10 dB for the next 20m).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most L0 electronic can tune the TX on need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience, if you have to tune this value manually, the chances are high that it won't work very well with any setting (this is why the automatical tuning failed).&lt;/p&gt;&#xA;" OwnerUserId="20757" LastEditorUserId="20757" LastEditDate="2017-05-08T03:36:17.817" LastActivityDate="2017-05-08T03:36:17.817" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41023" PostTypeId="2" ParentId="10814" CreationDate="2017-05-08T10:34:16.400" Score="0" Body="&lt;p&gt;First you need to figure out what your problem is.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is the bonded DSL system failing to deliver it's headline speed due to either poor line conditions, congestion on the network (either the DSL backend network or the ISP network) or traffic shaping by the ISP?&lt;/li&gt;&#xA;&lt;li&gt;Do you have an unusual workload (maybe lots of creative types uploading data) that means you are being limited by upload rather than download bandwidth?&lt;/li&gt;&#xA;&lt;li&gt;Do you have a small proportion of users who are using an disproportionate amount of data and/or using aggressive protocols like bit torrent?&lt;/li&gt;&#xA;&lt;li&gt;Or do you simply need more downstream bandwidth than the headline speed of your current bonded DSL setup.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If your problem is 1 or 2 then moving to a leased-line at the same headline speed is likely to help. A leased line gives you an uncontended path to your ISP and typically gives symmetric up/down.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OTOH if you don't need too much upload and your DSL lines are managing to deliver their headline speeds then I don't think moving to a leased line at the same headline speed will help much.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-08T10:34:16.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41025" PostTypeId="1" CreationDate="2017-05-08T11:33:55.190" Score="1" ViewCount="728" Body="&lt;p&gt;Can vtp client revisions be updated from another server switch that connect it only through a router? &#xA; the two switches are in the same domain name&lt;/p&gt;&#xA;" OwnerUserId="35524" LastActivityDate="2017-05-08T11:39:51.083" Title="VTP updates through router!" Tags="|switching|vtp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41026" PostTypeId="2" ParentId="41025" CreationDate="2017-05-08T11:39:51.083" Score="3" Body="&lt;p&gt;VTP is a layer 2 protocol and therefore can't be forwarded over a layer 3 boundary.  Also, since Vlans terminate at a layer 3 boundary, why would you want to?&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-08T11:39:51.083" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41029" PostTypeId="1" AcceptedAnswerId="41045" CreationDate="2017-05-08T13:55:25.563" Score="1" ViewCount="690" Body="&lt;p&gt;I want to send a syslog message from  ASR9k.&#xA;E.g i want to send the message(trigger) &quot;hello world&quot; from my ASR9k. Please suggest the command used for same.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In one of the other blogs, i read:&#xA;send log [Text Here]&#xA;e.g.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cisco# send log Hello World&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will send a SEV 2 message to the logging buffer, and test your syslog settings and alert handling.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, i could not apply the same on ASR9k.&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2017-05-09T05:03:31.027" Title="Trigger a syslog message on ASR9k" Tags="|cisco|cisco-asr|syslog|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41030" PostTypeId="2" ParentId="40297" CreationDate="2017-05-08T15:02:48.240" Score="2" Body="&lt;p&gt;Because &quot;business class&quot; implies use in many situations where the service may be supplied by something other than ADSL. Combined router/modems are pretty much a home/consumer niche device. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Getting your signal via DOCSIS cable? ADSL is useless to you.&lt;/li&gt;&#xA;&lt;li&gt;Got a Fiber line? - ADSL is useless to you.&lt;/li&gt;&#xA;&lt;li&gt;Got an ethernet feed from a provider in your office building? ADSL is&#xA;useless to you.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Likewise, a true &quot;business class&quot; router is hardly ever &lt;em&gt;also&lt;/em&gt; a WiFi access point (and if it claims to be the one and has the other built in, I'll tend to regard its claims of business-class as bogus until proven otherwise.) Meanwhile most consumers don't even know the difference between the two functions.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2017-05-08T15:02:48.240" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41031" PostTypeId="2" ParentId="41029" CreationDate="2017-05-08T16:26:22.513" Score="1" Body="&lt;p&gt;The &lt;code&gt;send&lt;/code&gt; command is used to send messages between users logged into the same router.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;send&#xA;  - To send messages to one or all terminal lines, use the &lt;strong&gt;send&lt;/strong&gt; EXEC command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;send&lt;/strong&gt; {&lt;em&gt;line-number&lt;/em&gt; | * | &lt;strong&gt;aux&lt;/strong&gt; &lt;em&gt;number&lt;/em&gt; | &lt;strong&gt;console&lt;/strong&gt; &lt;em&gt;number&lt;/em&gt; | &lt;strong&gt;tty&lt;/strong&gt; &lt;em&gt;number&lt;/em&gt; | &lt;strong&gt;vty&lt;/strong&gt; &lt;em&gt;number&lt;/em&gt;}&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Syntax Description&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Hw4jC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Hw4jC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Defaults&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;No messages are sent.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Command Modes&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;EXEC&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Command History&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/C7Av1.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/C7Av1.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Usage Guidelines&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;After entering this command, the system prompts for the message to be&#xA;  sent, which can be up to 500 characters long. Enter &lt;strong&gt;Ctrl-Z&lt;/strong&gt; to end&#xA;  the message. Enter &lt;strong&gt;Ctrl-C&lt;/strong&gt; to abort this command.&lt;/p&gt;&#xA;  &#xA;  &lt;hr&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Caution:&lt;/strong&gt; Be aware that in some circumstances text sent using the &lt;strong&gt;send&lt;/strong&gt; command may be interpreted as an executable command by the receiving device. For example, if the receiving device is Unix&#xA;  workstation, and the receiving device is in a state (shell) where&#xA;  commands can be executed, the incoming text (if a valid Unix command)&#xA;  will be interpreted as a command. For this reason you should limit&#xA;  your use of any unmonitored connection to a router that uses an&#xA;  interactive shell.&lt;/p&gt;&#xA;  &#xA;  &lt;hr&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;Examples&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The following example sends a message to all lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2509# send *&#xA;Enter message, end with CTRL/Z; abort with CTRL/C:&#xA;The system 2509 will be shut down in 10 minutes for repairs.^Z&#xA;Send message? [confirm]&#xA;2509#&#xA;***&#xA;***&#xA;*** Message from tty0 to all terminals:&#xA;***&#xA;The system 2509 will be shut down in 10 minutes for repairs.&#xA;2509#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I don't know of any command to send an arbitrary message to the syslog server. Cisco has documents describing the logging facility, e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/access/wireless/software/guide/SysMsgLogging.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;System Message Logging&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-08T16:26:22.513" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41034" PostTypeId="1" CreationDate="2017-05-08T17:47:42.477" Score="1" ViewCount="83" Body="&lt;p&gt;I would like to know whether we can use an HP 1920-48G POE access switch with an HP 5406zl as Core switch. The access switch will be connected through 1 Gbps SFP to the core switch.&lt;/p&gt;&#xA;" OwnerUserId="36611" LastEditorUserId="8499" LastEditDate="2019-01-03T03:05:33.170" LastActivityDate="2019-01-03T03:05:33.170" Title="HP Access Switch 1920-48G POE switch" Tags="|switch|layer1|fiber|hp|transceiver|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41035" PostTypeId="2" ParentId="41034" CreationDate="2017-05-08T17:52:06.433" Score="1" Body="&lt;p&gt;Yes, you can. You just need to make sure that you are using compatible SFPs and the correct fiber for the SFP type.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-08T17:52:06.433" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41036" PostTypeId="1" AcceptedAnswerId="41038" CreationDate="2017-05-08T18:20:57.383" Score="2" ViewCount="2416" Body="&lt;p&gt;There is a layer 3 switch which is responsible for inter-vlan routing. One VLAN (10, network: 172.16.10.0/24) cannot be accessed from any other VLANs (for management purposes). In order to do that I used the following ACL&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 1 permit 172.16.10.0 0.0.0.255&#xA;access-list 1 deny any&#xA;&#xA;interface vlan 10&#xA;ip access-group 1 out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This blocks any traffic with source IP address outside VLAN 10 from exiting out the VLAN 10 SVI interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I chose to block the traffic when exiting the VLAN 10 SVI interface instead of blocking the traffic when entering all the other VLAN SVI interfaces because new VLANs can be added later, which means setting the same ACL for the new VLANs as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that the layer 3 switch has a management interface (172.16.10.1) which any VLANs can access, because the traffic will enter through the SVI interface corresponding to the source VLAN and it will remain in the switch. It will not get a chance to be filtered by the ACL which resides at the exit of the VLAN 10 SVI. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a solution for filtering traffic destined to this interface residing on the switch without putting ACLs on inbound traffic for every other VLAN SVI?&lt;/p&gt;&#xA;" OwnerUserId="33361" LastEditorUserId="8499" LastEditDate="2018-12-25T05:03:09.963" LastActivityDate="2018-12-25T05:03:09.963" Title="Using ACLs to block traffic destined for the switch" Tags="|cisco|switch|vlan|acl|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41037" PostTypeId="2" ParentId="41036" CreationDate="2017-05-08T18:27:03.383" Score="2" Body="&lt;p&gt;You must put the ACL before the target from the perspective of traffic routing. Your problem is that the ACL is after one of the targets. Also, such an outbound ACL will actually route traffic that is destined to be dropped. If you place inbound ACLs, then the traffic will be dropped before resources are used to route the traffic.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could have a single ACL that is used by the other interfaces, but, as you pointed out, you will need to add this ACL to any future networks you may add that should not access that network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-08T18:27:03.383" CommentCount="13" ContentLicense="CC BY-SA 3.0" />
  <row Id="41038" PostTypeId="2" ParentId="41036" CreationDate="2017-05-08T18:38:18.640" Score="3" Body="&lt;p&gt;If you want to restrict management access to the switch, you need to apply the ACL to the VTY interfaces:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list standard MY-ACL&#xA;permit ip 172.16.10.0 0.0.0.255&#xA;&#xA;line vty 0 15&#xA;access-class MY-ACL in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-08T18:38:18.640" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41039" PostTypeId="1" AcceptedAnswerId="41046" CreationDate="2017-05-08T22:35:08.967" Score="3" ViewCount="1987" Body="&lt;p&gt;I'm running &lt;em&gt;EX3300-48T - Junos-12.3R11.2&lt;/em&gt;. After binding multiple /24s on multiple vlans on the same switch, Started to notice that the newly and the old assigned IPs are not pinging on multiple servers on different ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked the ARP table &lt;code&gt;show arp no-resolve&lt;/code&gt; and not all the IPs were there, so I have cleared up the ARP table &lt;code&gt;clear arp&lt;/code&gt; and most of the IPs started to respond again.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;# run show arp no-resolve | match entries&lt;/code&gt; is not exceeding the limit of &lt;strong&gt;4017&lt;/strong&gt; whatever we do.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username@juniper# run show arp no-resolve | match entries    &#xA;Total entries: 3971&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I searched for this range: 192.168.1.0/24, where the server assigned to it was down&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username@juniper# run show arp no-resolve | match 192.168.1    &#xA;{master:0}[edit]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then started the server again, the number raised up to the same limit of 4017&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username@juniper# run show arp no-resolve | match entries    &#xA;Total entries: 4017&#xA;{master:0}[edit]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And some of the IPs were shown&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username@juniper# run show arp no-resolve | match 192.168.1 &#xA;macaddress 192.168.1.9       vlan.131             none&#xA;macaddress 192.168.1.13      vlan.131             none&#xA;macaddress 192.168.1.29      vlan.131             none&#xA;macaddress 192.168.1.42      vlan.131             none&#xA;macaddress 192.168.1.54      vlan.131             none&#xA;macaddress 192.168.1.81      vlan.131             none&#xA;macaddress 192.168.1.91      vlan.131             none&#xA;macaddress 192.168.1.103     vlan.131             none&#xA;macaddress 192.168.1.104     vlan.131             none&#xA;macaddress 192.168.1.116     vlan.131             none&#xA;macaddress 192.168.1.140     vlan.131             none&#xA;macaddress 192.168.1.156     vlan.131             none&#xA;macaddress 192.168.1.179     vlan.131             none&#xA;macaddress 192.168.1.193     vlan.131             none&#xA;macaddress 192.168.1.199     vlan.131             none&#xA;macaddress 192.168.1.201     vlan.131             none&#xA;macaddress 192.168.1.227     vlan.131             none&#xA;macaddress 192.168.1.239     vlan.131             none&#xA;macaddress 192.168.1.244     vlan.131             none&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Arp statistics&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show system statistics arp &#xA;fpc0:&#xA;--------------------------------------------------------------------------&#xA;arp:&#xA;149291335 datagrams received&#xA;33571473 ARP requests received&#xA;108007342 ARP replies received&#xA;342919782 resolution request  received&#xA;0 unrestricted proxy requests&#xA;0 restricted proxy requests&#xA;0 received proxy requests&#xA;0 unrestricted proxy requests not proxied&#xA;0 restricted proxy requests not proxied&#xA;0 datagrams with bogus interface&#xA;0 datagrams with incorrect length&#xA;0 datagrams for non-IP protocol&#xA;0 datagrams with unsupported op code&#xA;0 datagrams with bad protocol address length&#xA;0 datagrams with bad hardware address length&#xA;0 datagrams with multicast source address&#xA;147499 datagrams with multicast target address&#xA;0 datagrams with my own hardware address&#xA;1342124 datagrams for an address not on the interface&#xA;274 datagrams with a broadcast source address&#xA;1404642 datagrams with source address duplicate to mine&#xA;1242680 datagrams which were not for me&#xA;2788 packets discarded waiting for resolution&#xA;125 packets sent after waiting for resolution&#xA;1818267175 ARP requests sent&#xA;33571474 ARP replies sent&#xA;0 requests for memory denied&#xA;0 requests dropped on entry&#xA;0 requests dropped during retry&#xA;0 requests dropped due to interface deletion&#xA;0 requests on unnumbered interfaces&#xA;0 new requests on unnumbered interfaces&#xA;0 replies for from unnumbered interfaces&#xA;0 requests on unnumbered interface with non-subnetted donor&#xA;0 replies from unnumbered interface with non-subnetted donor&#xA;0 arp packets rejected as family is configured with deny arp&#xA;0 arp response packets are rejected on mace icl interface&#xA;1634 arp replies are rejected as source and destination is same&#xA;0 arp probe for proxy address reachable from the incoming interface&#xA;0 arp request discarded for vrrp source address&#xA;0 self arp request packet received on irb interface&#xA;0 proxy arp request discarded as source ip is a proxy target&#xA;71669 arp packets are dropped as nexthop allocation failed&#xA;0 arp packets received from peer vrrp rotuer and discarded&#xA;0 arp packets are rejected as target ip arp resolve is in progress&#xA;0 grat arp packets are ignored as mac address is not changed&#xA;0 arp packets are dropped from peer vrrp&#xA;3501998 arp packets are dropped as driver call failed&#xA;0 arp packets are dropped as source is not validated&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the probability of it's being limited to 4017? Should not we expect at least 3971+254=4225 entry, not 4017 and the other IPs in the range should show up? And if it's limited, how to raise it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="33838" LastEditorUserId="33838" LastEditDate="2017-05-08T22:42:35.323" LastActivityDate="2017-05-09T06:37:54.577" Title="Juniper ARP table max limit" Tags="|juniper|mac-address|arp|juniper-junos|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41040" PostTypeId="1" AcceptedAnswerId="41041" CreationDate="2017-05-08T22:35:43.857" Score="1" ViewCount="65" Body="&lt;p&gt;I have a 200.1.1.0/24 network and a web server which is 150.1.1.100. I want to apply an extended ACL to allow devices in network 200.1.1.0/24 with IPs in the range 1-127 to communicate with the WEB server using only HTTP, whereas, the remaining range can only use HTTPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I issued below commands but all traffic denied by the router :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1(config-ext-nacl)#permit tcp 200.1.1.0 0.0.0.127 eq www host 150.1.1.100&#xA;R1(config-ext-nacl)#permit tcp 200.1.1.128 0.0.0.255 eq 443 host 150.1.1.100&#xA;R1(config-if)#ip access-group WEB_ACCESS in&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I applied ACL (WEB_ACCESS) to inbound interface of the 200.1.1.0 network.&#xA;Where did I make a mistake?&lt;/p&gt;&#xA;" OwnerUserId="35837" LastActivityDate="2017-05-09T02:18:17.317" Title="ACL does not work properly" Tags="|router|cisco-ios|acl|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41041" PostTypeId="2" ParentId="41040" CreationDate="2017-05-08T22:42:26.403" Score="3" Body="&lt;p&gt;Try this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;permit tcp 200.1.1.0 0.0.0.127 host 150.1.1.100 eq www&#xA;permit tcp 200.1.1.128 0.0.0.127 host 150.1.1.100 eq 443&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36613" LastEditorUserId="2142" LastEditDate="2017-05-09T02:18:17.317" LastActivityDate="2017-05-09T02:18:17.317" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41042" PostTypeId="1" AcceptedAnswerId="41043" CreationDate="2017-05-09T00:53:12.980" Score="1" ViewCount="309" Body="&lt;p&gt;I'd like to know if it's possible to split a Cat6 port in an existing wall using a hub or router. The hub or router would then service 2 PoE IP cameras&lt;/p&gt;&#xA;" OwnerUserId="36616" LastActivityDate="2017-05-09T08:52:31.637" Title="Split Cat6 port with hub to service 2 PoE IP cameras" Tags="|power-over-ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41043" PostTypeId="2" ParentId="41042" CreationDate="2017-05-09T03:36:16.327" Score="1" Body="&lt;p&gt;Hubs are not compatible with PoE. A hub will not request power from the PoE-providing device, and it could not pass it on. You only want to use a router if you are connecting different networks because routers route between networks, even assuming the router provides PoE; many do not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can connect a PoE switch to the WAO (Work Area Outlet). The switch would provide PoE for the end-devices, and the switch would be transparent at layer-2 (unlike a router).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-09T03:36:16.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41044" PostTypeId="2" ParentId="40670" CreationDate="2017-05-09T04:31:51.317" Score="4" Body="&lt;p&gt;Check your license boot:&lt;br&gt;&#xA;&lt;code&gt;show run | include boot&lt;/code&gt;&lt;br&gt;&#xA;And if you don't see it there already, add it like this:&lt;br&gt;&#xA;&lt;code&gt;license boot level appxk9&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*edit: in your case, you need &lt;code&gt;license boot level securityk9&lt;/code&gt;&lt;br&gt;&#xA;After adding the boot level and reloading, you should be able to accept the EULA and gain access to ISAKMP/IKE commands. &lt;/p&gt;&#xA;" OwnerUserId="36299" LastEditorUserId="36299" LastEditDate="2017-05-09T04:47:48.100" LastActivityDate="2017-05-09T04:47:48.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41045" PostTypeId="2" ParentId="41029" CreationDate="2017-05-09T05:03:31.027" Score="3" Body="&lt;p&gt;The above requirement worked for me using the below command on ASR9k&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;logmsg [your message]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2017-05-09T05:03:31.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41046" PostTypeId="2" ParentId="41039" CreationDate="2017-05-09T06:37:54.577" Score="3" Body="&lt;p&gt;According to the &lt;a href=&quot;https://www.juniper.net/us/en/local/pdf/datasheets/1000389-en.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;datasheet&lt;/a&gt;, the EX3300 is limited to 4000 ARP entries. It looks like this is a hardware limitation; there is no way to load a different &quot;SDM template&quot; like in Cisco IOS, so you're stuck on this number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a very dynamic network, you can try to reduce the &lt;a href=&quot;https://kb.juniper.net/InfoCenter/index?page=content&amp;amp;id=KB16987&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARP aging timer&lt;/a&gt;, to age-out stale ARP entries faster:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;system {&#xA;    arp {&#xA;        aging-timer 5;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If that doesn't help, you're stuck with buying a bigger switch; &lt;a href=&quot;https://www.juniper.net/assets/de/de/local/pdf/datasheets/1000581-en.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;EX3400&lt;/a&gt; (the successor to EX3300) can handle 16000 ARP entries.&lt;/p&gt;&#xA;" OwnerUserId="8049" LastActivityDate="2017-05-09T06:37:54.577" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41047" PostTypeId="1" CreationDate="2017-05-09T07:18:00.110" Score="1" ViewCount="4743" Body="&lt;p&gt;I would like to completely initialize the ASR1002 to securely pass the device to third party.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To delete all configuration in regular IOS, I usually run &quot;write erase&quot; and delete unnecessary file from &quot;flash&quot; by &quot;delete flash:FILENAME&quot; because I sometimes found backup configuration stored under flash:.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any special way to delete configuration on IOS-XE?&#xA;I deleted startup and running config by following the instruction written here.&#xA;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/37635/how-to-erase-running-configuration-in-cisco-ios-xe&quot;&gt;How to erase running-configuration in Cisco IOS-XE?&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And checked under bootflash:.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the latest output by &quot;show file systems&quot;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; Router#show file systems&#xA;File Systems:&#xA;&#xA;       Size(b)       Free(b)      Type  Flags  Prefixes&#xA;             -             -    opaque     rw   system:&#xA;             -             -    opaque     rw   tmpsys:&#xA;*   7819087872    7215439872      disk     rw   bootflash:&#xA;    2872836096    2384969728      disk     rw   fpd:&#xA;&#xA;       2097152       1585152      disk     rw   obfl:&#xA;&#xA;             -             -    opaque     rw   null:&#xA;&#xA;             -             -    opaque     ro   tar:&#xA;&#xA;             -             -   network     rw   tftp:&#xA;&#xA;      33554432      33553356     nvram     rw   nvram:&#xA;&#xA;             -             -    opaque     wo   syslog:&#xA;&#xA;             -             -   network     rw   rcp:&#xA;&#xA;             -             -   network     rw   ftp:&#xA;&#xA;             -             -   network     rw   http:&#xA;&#xA;             -             -   network     rw   scp:&#xA;&#xA;             -             -   network     rw   https:&#xA;&#xA;             -             -    opaque     ro   cns:&#xA;&#xA;&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36620" LastEditorUserId="509" LastEditDate="2017-05-09T10:55:44.653" LastActivityDate="2017-08-08T04:45:10.793" Title="How to delete data from IOS-XE?" Tags="|cisco|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41052" PostTypeId="1" AcceptedAnswerId="44677" CreationDate="2017-05-09T12:10:11.397" Score="2" ViewCount="9475" Body="&lt;p&gt;Ultimately what I want to do is connect a second physically separate gateway, and assign its WAN port one of the public IP addresses given by our ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I have the following setup currently and is working.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Fibre leased line from ISP.&lt;/li&gt;&#xA;&lt;li&gt;Fibre comes to ISP box&lt;/li&gt;&#xA;&lt;li&gt;Ethernet from ISP box plugs into pfSense WAN port&lt;/li&gt;&#xA;&lt;li&gt;pfSense WAN port set as static IP assignment IP: xxx.xxx.xxx.99, GW: xxx.xxx.xxx.98/30&lt;/li&gt;&#xA;&lt;li&gt;Add one of the public IP addresses as a virtual IP address in pfSense IP: xxx.xxx.xxx.105/29&lt;/li&gt;&#xA;&lt;li&gt;Create a new private network and assign it to a spare ethernet port IP: 10.61.1.5/30&lt;/li&gt;&#xA;&lt;li&gt;Connect the second gateway wan port to pfSense and assign the wan a static IP: 10.61.1.6&lt;/li&gt;&#xA;&lt;li&gt;In pfSense setup 1:1 NAT and outbound NAT to connect all traffic xxx.xxx.xxx.105 &amp;lt;- between-&gt; 10.61.1.6&lt;/li&gt;&#xA;&lt;li&gt;Setup firewall rules in pfSense to allow all traffic between WAN xxx.xxx.xxx.105 and LAN 10.61.1.6&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;While this works and the new device talks over the public IP address, the actual gateway thinks it's public IP address is 10.61.1.6, not xxx.xxx.xxx.105. This make configuration of VPN serves impossible for me as the device is wrongly thinking its public IP is a private one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To clarify, which is my understanding, I might be wrong, the ISP gateway is xxx.xxx.xxx.98 on a /30 network and have given us a /29 block of IPs that are routable through xxx.xxx.xxx.98/30. From my testing the above rules out being able to connect a switch between the ISP box and pfSense WAN and just assign devices those public IPs of the /29 block.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any way I can configure the WAN port on the secondary device with the public IP address, connect it to pfSense someway and just get pfSense to route it out to xxx.xxx.xxx.98?&lt;/p&gt;&#xA;" OwnerUserId="3818" LastEditorUserId="3818" LastEditDate="2017-05-10T11:05:20.513" LastActivityDate="2020-07-26T13:32:37.003" Title="Assign public IP of /29 block directly to a connected device in pfSense" Tags="|ip|pfsense|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41056" PostTypeId="1" AcceptedAnswerId="41059" CreationDate="2017-05-09T17:49:50.533" Score="1" ViewCount="1227" Body="&lt;p&gt;Here I am not able to obtain ip automatically using DHCP. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/cs8rD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/cs8rD.png&quot; alt=&quot;My Topology of my DHCP Problem&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is configuration of swtich0 which is having DHCP Server.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1237 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;ip dhcp excluded-address 192.168.0.1 192.168.0.4&#xA;!&#xA;ip dhcp pool accounts&#xA;network 192.168.0.0 255.255.255.0&#xA;default-router 192.168.0.1&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;    !&#xA;interface FastEthernet0/1&#xA;switchport mode trunk&#xA;!&#xA;interface FastEthernet0/2&#xA;switchport mode trunk&#xA;!&#xA;interface F astEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!   &#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!&#xA;interface FastEthernet0/12&#xA;!&#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!&#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;!&#xA;interface FastEthernet0/19&#xA;!&#xA;interface FastEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface FastEthernet0/24&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA;ip address 172.16.0.2 255.255.255.0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA;login   &#xA;line vty 5 15&#xA;login&#xA;!&#xA;!&#xA;!&#xA;end &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here the Configuration of Switch2 &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building configuration...&#xA;&#xA;Current configuration : 1131 bytes&#xA;    !&#xA;    version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Switch&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/1&#xA;!&#xA;interface FastEthernet0/2&#xA; switchport mode trunk&#xA;!&#xA;interface FastEthernet0/3&#xA;!&#xA;interface FastEthernet0/4&#xA;!&#xA;interface FastEthernet0/5&#xA;!&#xA;interface FastEthernet0/6&#xA;!&#xA;interface FastEthernet0/7&#xA;!&#xA;interface FastEthernet0/8&#xA;!&#xA;interface FastEthernet0/9&#xA;!&#xA;interface FastEthernet0/10&#xA;!&#xA;interface FastEthernet0/11&#xA;!   &#xA;interface FastEthernet0/12&#xA;!   &#xA;interface FastEthernet0/13&#xA;!&#xA;interface FastEthernet0/14&#xA;!&#xA;interface FastEthernet0/15&#xA;!&#xA;interface FastEthernet0/16&#xA;!   &#xA;interface FastEthernet0/17&#xA;!&#xA;interface FastEthernet0/18&#xA;interface FastEthernet0/19&#xA;!&#xA;interface F astEthernet0/20&#xA;!&#xA;interface FastEthernet0/21&#xA;!&#xA;interface FastEthernet0/22&#xA;!&#xA;interface FastEthernet0/23&#xA;!&#xA;interface F astEthernet0/24&#xA; switchport access vlan 10&#xA; switchport mode access&#xA;!&#xA;interface GigabitEthernet0/1&#xA;!&#xA;interface GigabitEthernet0/2&#xA;!&#xA;interface Vlan1&#xA; ip address 172.16.0.3 255.255.255.0&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;line vty 5 15&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please help me thanks :).&lt;/p&gt;&#xA;" OwnerUserId="36631" LastEditorUserId="8499" LastEditDate="2018-12-25T05:03:55.773" LastActivityDate="2022-08-31T12:49:23.707" Title="Switch0 is configured as DHCP server but not working?" Tags="|cisco|switch|vlan|dhcp|packet-tracer|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41059" PostTypeId="2" ParentId="41056" CreationDate="2017-05-09T18:41:48.623" Score="2" Body="&lt;p&gt;You are putting the PC in VLAN 10, but you don't have VLAN 10 defined in global configuration on your switches. Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Vlan 10&#xA; name PC_VLAN&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-09T18:41:48.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41063" PostTypeId="1" AcceptedAnswerId="41072" CreationDate="2017-05-09T20:49:36.710" Score="2" ViewCount="919" Body="&lt;p&gt;I have a Cisco 3750X switch stack (2 switches stacked) and have a Compellent and three Equalogics as well as three VMware hosts directly connected but separated via different vLANs on this switch. The SAN appliances need Jumbo packets turned on (MTU 9000) and the hosts will have the ISCSI interfaces set to use MTU 9000 as well but some of the other interfaces need to remain on MTU 1500. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this particular switch is unable to be configured per interface to have different MTU settings if I change the System MTU to 9000 will this have any adverse effects on those devices still needing their MTU setting set to 1500? Fo the the SAN appliances will I also need to change SYSTEM MTU ROUTING to match the MTU setting of 9000 in order for those to fully utilize Jumbo frames?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unsure and trying to follow best practices for these Dell storage appliances.&lt;/p&gt;&#xA;" OwnerUserId="36641" LastActivityDate="2017-05-10T09:58:41.120" Title="Question regarding MTU settings on a Cisco 3750X Switch" Tags="|cisco-catalyst|mtu|san|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41068" PostTypeId="2" ParentId="41047" CreationDate="2017-05-10T02:30:57.530" Score="1" Body="&lt;p&gt;I actually deleted all directories and files under bootflash: by following commands.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#delete /force /recursive lost+found&#xA;Router#delete /force /recursive .prst_sync&#xA;Router#delete /force /recursive tracelogs.923&#xA;Router#delete /force /recursive tracelogs&#xA;Router#delete /force /recursive .installer&#xA;Router#delete /force /recursive .rollback_timer&#xA;Router#dir /all&#xA;Directory of bootflash:/&#xA;242881  drwx        4096  May 10 2017 02:03:45 +00:00  .rollback_timer&#xA;    14  -rw-   205119800   Mar 1 2016 16:32:14 +00:00  asr1000rp1-ipbasek9.02.04.02.122-33.XND2.bin&#xA;7819087872 bytes total (7216553984 bytes free)&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;HOWEVER, after reboot, as shown below some directories are recreated.&#xA;I guess it is OS-XE's normal behavior..&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router&amp;gt;en&#xA;Router#pwd&#xA;bootflash:&#xA;Router#dir /all&#xA;Directory of bootflash:/&#xA;242881  drwx        4096  May 10 2017 02:03:45 +00:00  .rollback_timer&#xA;437185  drwx        4096  May 10 2017 02:08:09 +00:00  tracelogs&#xA;    11  -rwx        5947  May 10 2017 02:04:30 +00:00  tracelogs.585&#xA;728641  drwx        4096  May 10 2017 02:06:18 +00:00  core&#xA;259073  drwx        4096  May 10 2017 02:06:18 +00:00  .prst_sync&#xA;129537  drwx        4096  May 10 2017 02:07:11 +00:00  .installer&#xA;    14  -rw-   205119800   Mar 1 2016 16:32:14 +00:00  asr1000rp1-ipbasek9.02.04.02.122-33.XND2.bin&#xA;7819087872 bytes total (7216197632 bytes free)&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36646" LastEditorUserId="8499" LastEditDate="2017-05-10T02:34:29.643" LastActivityDate="2017-05-10T02:34:29.643" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41069" PostTypeId="2" ParentId="41052" CreationDate="2017-05-10T04:18:08.673" Score="0" Body="&lt;p&gt;On your step 5 you assigned IP: xxx.xxx.xxx.105/29 to your VIP. That IP address is not in your allocated IP range assigned by your ISP. You have the WAN port configured as x.x.x.99/29 and its gateway as x.x.x.98 which means if its /29 then your usable IP addresses should range from xxx.xxx.xxx.97 to IP: xxx.xxx.xxx.102&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in my opinion you should you one of your allocated IP range as your VIP instead of xxx.xxx.xxx.105/29&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps&lt;/p&gt;&#xA;" OwnerUserId="36648" LastActivityDate="2017-05-10T04:18:08.673" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41070" PostTypeId="2" ParentId="40975" CreationDate="2017-05-10T04:29:35.337" Score="1" Body="&lt;p&gt;You mean both PC 3 and PC 4 cannot get find DHCP ? You might have to configure DHCP helper on your sub-interface to forward DHCP request from your PC's to the intended DHCP server&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope this helps&lt;/p&gt;&#xA;" OwnerUserId="36648" LastActivityDate="2017-05-10T04:29:35.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41072" PostTypeId="2" ParentId="41063" CreationDate="2017-05-10T09:58:41.120" Score="3" Body="&lt;p&gt;Setting the switch to use MTU of 9k globally will not be an issue for host device interfaces that are programmed to use 1500 as a maximum. The host will compile frames that have an MTU size of 1500 maximum and while the switch accepts a maximum of 9000, there will be no fragmentation and it will accept the frames without discarding them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An issue would only arrise if you were to do it the other way round. Passing 9K frames on a switch accepting only a maximum of 1500 Bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just make sure that any 9K frames are passed along switches that support 9K frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally your ISCSI network would remain isolated from the rest of the network and routing would not be enabled due to latency concerns.&lt;/p&gt;&#xA;" OwnerUserId="27056" LastActivityDate="2017-05-10T09:58:41.120" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41074" PostTypeId="1" AcceptedAnswerId="41077" CreationDate="2017-05-10T10:05:48.610" Score="1" ViewCount="209" Body="&lt;p&gt;For a ISR4451 there is a SM-D-ES3G-48-P Module, is this module hotplugable or should I power down the ISR for install the SM Module?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sh hw-module all attribute&#xA;Slot 0 Bay 0 Board 0 Module[ISR4451-X-4x1GE] spa_type 0x76E Daughter Board Not Present&#xA;Basic attributes : length 11, version [2], module-type [ngio-virtual], width [unknown]&#xA;Power Rating [0], Control Endpoint count [0], Daughter Board Count [0]&#xA;KR Support [0x00], 16-bit GPIO [Not present], Submodule reset support [Not required]&#xA;&#xA;Extended Attributes for [Front Panel 4 ports Gigabitethernet Module]&#xA;Port Count 4 Per-port Information : Type [Ethernet] Max IID [0] Connector [RJ45] Network clocking [disable]&#xA;Module OID: 1 3 6 1 4 1 9 12 3 1 9 92 21&#xA;Port OID: 1 3 6 1 4 1 9 12 3 1 10 109&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="20772" LastEditorUserId="20772" LastEditDate="2017-05-10T11:19:42.887" LastActivityDate="2017-05-10T11:19:42.887" Title="Is ISR 4451 hotplugable" Tags="|cisco|router|cisco-isr|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41077" PostTypeId="2" ParentId="41074" CreationDate="2017-05-10T11:13:04.203" Score="4" Body="&lt;p&gt;Enhanced Ethernet modules on ISR are hot swapable, but please note you need to Use the &lt;strong&gt;hw-module slot &amp;lt;1-4&gt; oir-stop&lt;/strong&gt; command when removing or replacing a hot-swappable Cisco enhanced EtherSwitch service module duringonline insertion and removal (OIR).&lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-05-10T11:13:04.203" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41078" PostTypeId="1" CreationDate="2017-05-10T11:49:12.127" Score="2" ViewCount="2657" Body="&lt;p&gt;How can we reset a service account password in F5 from the CLI? Is that even possible? If yes, can anyone please let me know the CLI commands?&lt;/p&gt;&#xA;" OwnerUserId="36655" LastEditorUserId="453" LastEditDate="2017-12-26T21:08:33.663" LastActivityDate="2017-12-26T21:08:33.663" Title="How can we reset a service account password in the F5 CLI?" Tags="|load-balancer|f5|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41079" PostTypeId="1" AcceptedAnswerId="41080" CreationDate="2017-05-10T12:52:22.500" Score="2" ViewCount="115" Body="&lt;p&gt;I'm wondering what would happen in my network in the following configuration: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;on switch1 -&amp;gt; interface1 in mode access, vlan4&#xA;on switch2 -&amp;gt; interfaceA in mode trunk, vlan4 and vlan8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;switch1 is connected through interface1 to switch2's interfaceA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, when something from vlan4 goes through interface1 from switch1, it's tagged vlan4 right? My guess would be: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; it's be going to vlan4, just as if interfaceA was in access.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But what happens when something from vlan4 go through interfaceA from switch2? my guess: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;it's not tagged so it goes into switch1's default VLAN?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Would all incoming traffic from switch2 to switch1 go into default VLAN?&lt;/p&gt;&#xA;" OwnerUserId="36106" LastEditorUserId="8499" LastEditDate="2018-03-07T18:20:42.930" LastActivityDate="2018-03-07T18:20:42.930" Title="What happend when you set a trunk against an Access" Tags="|switch|vlan|switching|trunk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41080" PostTypeId="2" ParentId="41079" CreationDate="2017-05-10T13:01:44.617" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;So, when something from vlan4 goes through interface1 from switch1,&#xA;  it's tagged vlan4 right?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, you seem to have it backwards. Frames exiting an access interface are not tagged because most access devices do not understand VLAN tags. VLAN tags are used on trunks to separate frames belonging to different VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Frames exiting switch1, interface1 will be untagged, and will be interpreted by switch2 as belonging to the native VLAN. Since you do not specifically call out which VLAN is the native VLAN on switch2, it should default to VLAN 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What happens when tagged frames from switch2 are received by an access interface on switch1 is undefined. Some switches will drop the frames as giants, and some switches will simply pass the frames through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cisco switches, if the native VLAN on switch2, interfaceA is not VLAN 4, then you will get messages on switch2 about a native VLAN mismatch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-10T13:01:44.617" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41081" PostTypeId="2" ParentId="41079" CreationDate="2017-05-10T14:03:59.467" Score="0" Body="&lt;p&gt;Trunk against Access --&gt; Access &#xA;the frame will not be tagged, it maybe will be dropped ,the messages from a vlan to the same vlan will arrive.&lt;/p&gt;&#xA;" OwnerUserId="35524" LastActivityDate="2017-05-10T14:03:59.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41086" PostTypeId="1" AcceptedAnswerId="43208" CreationDate="2017-05-10T18:42:44.597" Score="2" ViewCount="336" Body="&lt;p&gt;Everywhere I keep finding &quot;to achieve low latency&quot; or &quot;latency is of concern&quot;, do this!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I don't really get what are the other concerns other than latency. I mean who doesn't want low latency? Or don't they?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, packet loss could be one concern. In production systems where users work with data on a remote network (Eg: NFS), packet loss is not accepted. But doesn't TCP protocol resend a packet if an in time acknowledgement not received? If it is, I guess we shouldn't worry about packet loss which might occur not much frequently and can be resent any time, unless the architecture allows it to have frequent packet loss. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, are there any other concerns?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not from networking background. So, I am wishing that the explanation is as elaborate as possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks!&lt;/p&gt;&#xA;" OwnerUserId="36542" LastEditorUserId="36542" LastEditDate="2017-05-10T18:57:39.753" LastActivityDate="2017-08-13T16:41:51.437" Title="What are the concerns other than latency for network tuning?" Tags="|latency|performance|" AnswerCount="8" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41087" PostTypeId="2" ParentId="41086" CreationDate="2017-05-10T19:24:40.340" Score="0" Body="&lt;p&gt;Packet loss is a concern for TCP, big concern. You can have low latency, but high packet loss means TCP has to resend more packets, which will slow down the communication. The way TCP works is that it sends a bunch of data and waits for acknowledgement. Since you don't have a network background, i will stay away from advanced concepts like retransmissions and Selective Ack. If there is packet loss, TCP will replace the packet BUT it will make the connection poor or slow. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next tuning can be looking into reasons for packet loss, like low up stream bandwidth, or heavy utilization on ports of devices with small buffers. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;yet another form of &quot;tuning&quot; can be looking into MTU sizes and fragmentation. Say if you're running multicast over GRE over IPSEC. You may have the lowest latency, and the highest bandwidth, but without tweaking your MTU, you will see very poor performance. Which in the example of multicast video would mean a pixelated video at the client end. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If by network you mean &quot;Layer 3 and below&quot;, the tuning can go into design choices, load balancing, fault tolerance.. many other things. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However these days, a lot of the bottle necks are above layer3. (OSI model) &lt;/p&gt;&#xA;" OwnerUserId="36373" LastActivityDate="2017-05-10T19:24:40.340" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41089" PostTypeId="2" ParentId="20612" CreationDate="2017-05-10T19:44:01.110" Score="0" Body="&lt;p&gt;It all depends on the setup.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assuming a simple setup with a single router/firewall and a number of Ethernet switches on a flat ethernet network traffic to the private IP will go directly while traffic to the public IP will have to harpin through the router/firewall. That will add latency to the path, how much depends on how highly loaded the router/firewall is, how highly loaded the network in general is, how fast it can process packets, where the router sits on the network relative to the client and server and so-on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a more complex network you would have to look at the overall toplogy of the network to determine what impact using the public IP would have on the path and whether the path going through the translation would be longer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Asside from performance two other issues to bear in mind.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;It is likely that the client IP address seen by the server will be an IP address of a NAT box rather than the internal IP of the client.&lt;/li&gt;&#xA;&lt;li&gt;some NAT setups may not support connections to the public IP from internal clients at all. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-05-10T19:53:00.483" LastActivityDate="2017-05-10T19:53:00.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41093" PostTypeId="1" AcceptedAnswerId="41112" CreationDate="2017-05-10T23:08:47.003" Score="1" ViewCount="225" Body="&lt;p&gt;While plugin a SM-D-ES3G-48-P into a ISR4451 the SM module didn't come up. What steps are needed to setup this SM into the ISR4451.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Google only show me install documents for Catalyst Switches. Anyone can show me the steps for a ISR 4451?&lt;/p&gt;&#xA;" OwnerUserId="20772" LastActivityDate="2017-08-10T10:11:49.393" Title="How to install a SM-D-ES3G-48-P in a ISR 4451" Tags="|cisco|router|cisco-isr|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41094" PostTypeId="2" ParentId="41086" CreationDate="2017-05-11T00:05:47.940" Score="0" Body="&lt;p&gt;You can also tune a network for convergence time or stability ( often the two are in conflict).  When changes occur you want the network to detect and adjust quickly, but you don't want rapid changes to cause instability or overload your routers. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-11T00:05:47.940" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41098" PostTypeId="1" AcceptedAnswerId="41100" CreationDate="2017-05-11T08:34:13.983" Score="1" ViewCount="48" Body="&lt;p&gt;Today I have configured SNMP sensors for the environment parameters on Cisco AS 5300, but I have get shocked that the system health temperature is 29C/84F and when I check the output from the  device console I get the below :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Temperature:&#xA;        Temperature Reading:&#xA;                Temperature at inlet is measured as 24C/75F.&#xA;                Temperature at outlet is measured as 29C/84F.&#xA;        Temperature State:&#xA;                Temperature is in normal state.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;so please I want some advise if this output is normal or there is some  weak fan need to be replaced &lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-05-11T09:53:01.340" Title="Cisco AS5300 high temperature issue?" Tags="|cisco|cisco-ios|environmental-monitoring|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41099" PostTypeId="1" AcceptedAnswerId="41107" CreationDate="2017-05-11T08:42:53.230" Score="0" ViewCount="80" Body="&lt;p&gt;I can't find a good diagram or anything else, that shows the structure of the data/payload/frame body of a 802.11 paket. Is there also any difference between the protocol version, or do all of them use the same 'layout' for the data field? Also, a lot of books write 'data', some 'payload' and other 'frame body'. I think everything means the same, but just in case: Is this right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm just learning more about the 802.11 standard.&lt;/p&gt;&#xA;" OwnerUserId="33598" LastActivityDate="2017-05-11T14:22:07.227" Title="Structure of 802.11 data field" Tags="|ieee-802.11|data|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41100" PostTypeId="2" ParentId="41098" CreationDate="2017-05-11T09:53:01.340" Score="1" Body="&lt;p&gt;The temperature is perfectly normal. Depending on where it is placed and if it has a fan coil available i actually think it looks perfect. Cisco's best practice for operating temperatures is a room temperature not exceeding 27C. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can see Cisco's whitepaper for Data Center installations and temperatures here:&#xA;&lt;a href=&quot;https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/unified-computing/white_paper_c11-680202.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com/c/en/us/solutions/collateral/data-center-virtualization/unified-computing/white_paper_c11-680202.pdf&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastActivityDate="2017-05-11T09:53:01.340" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41101" PostTypeId="2" ParentId="41086" CreationDate="2017-05-11T10:48:25.430" Score="0" Body="&lt;p&gt;Security!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Security is always a concern no matter what. And of course, Network being the most sensitive and crucial part of an organization, it must be protected with utmost concern.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a lot of ways for a network be vulnerable to security threats as listed &lt;a href=&quot;https://www.cybrary.it/0p3n/top-10-network-security-threats-security-measures/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network tuning is done mostly to protect against DoS as far as I know. Considering other kinds of threats/attacks such as any form of intrusion, malware, spoofing etc. you need dedicated modules like firewalls, IDS/IPS in place.&lt;/p&gt;&#xA;" OwnerUserId="31049" LastEditorUserId="31049" LastEditDate="2017-05-13T12:57:55.993" LastActivityDate="2017-05-13T12:57:55.993" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41105" PostTypeId="1" AcceptedAnswerId="41108" CreationDate="2017-05-11T13:52:40.603" Score="1" ViewCount="1427" Body="&lt;p&gt;Consider this MAC : &lt;code&gt;a4:ba:db:fe:b24b&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The method &quot;&lt;strong&gt;SLAAC&lt;/strong&gt;&quot; allows us to generate an IPv6 from this MAC:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;First we put &lt;code&gt;fffe&lt;/code&gt; in the fourth and fifth bytes&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, we invert the 7th bit of the first byte.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thus, the SLAAC-generated IPv6 address should be generated as described below:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Putting &lt;code&gt;fffe&lt;/code&gt; : &lt;code&gt;a4:b1:db:feff:feb2:4B&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Inverting the 7th bit : &lt;code&gt;a6:b1:db:feff:feb2:4B&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Finally, the IPv6 address should be : &lt;code&gt;a6:b1:db:feff:feb2:4B&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;However&lt;/strong&gt;, my teacher found this IPv6 : &lt;code&gt;a6ba:dbff:fefe:b24b&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why?&lt;/p&gt;&#xA;" OwnerUserId="33344" LastEditorUserId="8499" LastEditDate="2017-05-11T19:40:12.673" LastActivityDate="2017-05-11T19:47:04.593" Title="SLAAC : What's wrong with this generated IPv6 address?" Tags="|ipv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41107" PostTypeId="2" ParentId="41099" CreationDate="2017-05-11T14:22:07.227" Score="1" Body="&lt;p&gt;IEEE 802.11 is a series of layer-1/2 protocols. The payload of 802.11 frames is a layer-3 protocol (IPv4, IPX, IPv6, AppleTalk, etc.). The payload of a frame has nothing to do with 802.11 because the frame could be carrying any of a  number of layer-3 protocols, hence you will not find any definitive description of what the frame payload looks like (it can be anything).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer-2 protocols don't know or care what is in their payloads, not do layer-3 protocols care what is in their payloads, etc. This is the abstraction of the network stack. Each layer of the network stack is independent of the other layers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-11T14:22:07.227" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41108" PostTypeId="2" ParentId="41105" CreationDate="2017-05-11T14:33:41.833" Score="2" Body="&lt;p&gt;It appears that you are confusing bytes with words. In an IPv4 (and often in a MAC) address, each separated section is a single byte, but in IPv6, each section is two bytes (16-bit word). You seem to keep the IPv4 thinking. Your original is putting bytes into separate words, but you need to combine two byte into a single word. For example, the &lt;code&gt;fffe&lt;/code&gt; will end up in two separate words because there will be three bytes on either side of it, so you will have a colon between the &lt;code&gt;ff&lt;/code&gt; and the &lt;code&gt;fe&lt;/code&gt;. You should end up with four words (64 bits), separated by colons, but you are trying to create six words (96 bits).&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://tools.ietf.org/search/rfc4291&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 4291, IP Version 6 Addressing Architecture&lt;/em&gt;&lt;/a&gt;, Appendix A, Creating Modified EUI-64 Format Interface Identifiers details the original process:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Links or Nodes with IEEE 802 48-bit MACs&lt;/p&gt;&#xA;&lt;p&gt;[EUI64] defines a method to create an IEEE EUI-64 identifier from an&#xA;IEEE 48-bit MAC identifier.  This is to insert two octets, with&#xA;hexadecimal values of 0xFF and 0xFE (see the Note at the end of&#xA;appendix), in the middle of the 48-bit MAC (between the company_id and&#xA;vendor-supplied id).  An example is the 48-bit IEEE MAC with Global&#xA;scope:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|0              1|1              3|3              4|&#xA;|0              5|6              1|2              7|&#xA;+----------------+----------------+----------------+&#xA;|cccccc0gcccccccc|ccccccccmmmmmmmm|mmmmmmmmmmmmmmmm|&#xA;+----------------+----------------+----------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;where &amp;quot;c&amp;quot; is the bits of the assigned company_id, &amp;quot;0&amp;quot; is the value of&#xA;the universal/local bit to indicate Global scope, &amp;quot;g&amp;quot; is&#xA;individual/group bit, and &amp;quot;m&amp;quot; is the bits of the manufacturer-&#xA;selected extension identifier.  The interface identifier would be of&#xA;the form:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;|0              1|1              3|3              4|4              6|&#xA;|0              5|6              1|2              7|8              3|&#xA;+----------------+----------------+----------------+----------------+&#xA;|cccccc1gcccccccc|cccccccc11111111|11111110mmmmmmmm|mmmmmmmmmmmmmmmm|&#xA;+----------------+----------------+----------------+----------------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;When IEEE 802 48-bit MAC addresses are available (on an interface or a&#xA;node), an implementation may use them to create interface identifiers&#xA;due to their availability and uniqueness properties.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Basically, you split the 48-bit MAC address in half, insert &lt;code&gt;fffe&lt;/code&gt; in the middle, and flip the U/L bit. This results in a 64-bit Interface Identifier from a 48-bit MAC address. When you split the resulting 64 bits of the IID into four 16-bit words separated by colons, you get what your instructor has.&lt;/p&gt;&#xA;&lt;p&gt;Starting with your MAC address, &lt;code&gt;a4:ba:db:fe:b24b&lt;/code&gt;:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;You have six bytes in your MAC address: &lt;code&gt;a4badbfeb24b&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Split those into two sets of three bytes: &lt;code&gt;a4badb&lt;/code&gt; and &lt;code&gt;feb24b&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Insert &lt;code&gt;fffe&lt;/code&gt; in the middle, and you you end up with eight bytes:&#xA;&lt;code&gt;a4badbfffefeb24b&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Separate the 16-bit words by colons: &lt;code&gt;a4ba:dbff:fefe:b24b&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Flip the U/L bit: &lt;code&gt;a6ba:dbff:fefe:b24b&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;That means your 64-bit IPv6 IID is &lt;code&gt;a6ba:dbff:fefe:b24b&lt;/code&gt;, which is what you instructor has.&lt;/p&gt;&#xA;&lt;hr /&gt;&#xA;&lt;p&gt;Many people had concerns about the original SLAAC method of IPv6 address generation. The primary concern is that a user could be tracked by MAC address, regardless of where the user connected to the public Internet.&lt;/p&gt;&#xA;&lt;p&gt;There are subsequent RFCs to address this perceived weakness and allow for privacy extensions and random address generation. For example, &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4941&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 4941, Privacy Extensions for Stateless Address Autoconfiguration in IPv6&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Abstract&lt;/p&gt;&#xA;&lt;p&gt;Nodes use IPv6 stateless address autoconfiguration to generate&#xA;addresses using a combination of locally available information and&#xA;information advertised by routers.  Addresses are formed by combining&#xA;network prefixes with an interface identifier.  On an interface that&#xA;contains an embedded IEEE Identifier, the interface identifier is&#xA;typically derived from it.  On other interface types, the interface&#xA;identifier is generated through other means, for example, via random&#xA;number generation.  This document describes an extension to IPv6&#xA;stateless address autoconfiguration for interfaces whose interface&#xA;identifier is derived from an IEEE identifier.  Use of the extension&#xA;causes nodes to generate global scope addresses from interface&#xA;identifiers that change over time, even in cases where the interface&#xA;contains an embedded IEEE identifier.  Changing the interface&#xA;identifier (and the global scope addresses generated from it) over&#xA;time makes it more difficult for eavesdroppers and other information&#xA;collectors to identify when different addresses used in different&#xA;transactions actually correspond to the same node.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Many OSes have adopted Privacy Extensions and random addressing as the default behavior. It is now fairly rare to find a device where the addresses are generated by the original SLAAC method.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-05-11T19:47:04.593" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41109" PostTypeId="2" ParentId="41105" CreationDate="2017-05-11T14:36:32.940" Score="-2" Body="&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;A link-local address is formed by combining the well-known link-local&#xA;prefix FE80::0 [RFC4291] (of appropriate length) with an interface&#xA;identifier as follows:&#xA;&#xA;1.  The left-most 'prefix length' bits of the address are those of&#xA;    the link-local prefix.&#xA;&#xA;2.  The bits in the address to the right of the link-local prefix are&#xA;    set to all zeroes.&#xA;&#xA;3.  If the length of the interface identifier is N bits, the right-&#xA;    most N bits of the address are replaced by the interface&#xA;    identifier.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4862#section-5.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc4862#section-5.3&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;Applying this algorithm to your address gives:&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;fe80::a4ba:dbfe:b24b&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;I've no idea where the algorithm your teacher uses comes from.&lt;/p&gt;&#xA;&lt;p&gt;It does not seem to be this algorithm either:&#xA;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7217#section-5&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc7217#section-5&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36685" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-05-11T14:36:32.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41112" PostTypeId="2" ParentId="41093" CreationDate="2017-05-12T06:39:05.133" Score="2" Body="&lt;p&gt;deleted.&#xA;SM-D module only work on ISR G2 series..&lt;/p&gt;&#xA;" OwnerUserId="32460" LastEditorUserId="32460" LastEditDate="2017-05-12T07:26:17.727" LastActivityDate="2017-05-12T07:26:17.727" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41117" PostTypeId="2" ParentId="40366" CreationDate="2017-05-12T10:46:46.540" Score="1" Body="&lt;p&gt;This can be done using a Linux box. It can probably also be done with some high-end routers from the likes of cisco but I have no experience of those.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Linux supports what are known as &quot;network namespaces&quot;. Each &quot;network namespace&quot; is a separate logical instance of the network stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Either install lots of network controllers or connect a VLAN-supporting switch, set up the port connected to the Linux box as a trunk and create a virtual interface for each VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then move each of the network interfaces that will be used to connect devices to it's own network namespace. Connect the secondary network namespaces back to the main network namespace using virtual Ethernet (veth) devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now implement NAT in each of the secondary network namespaces. You will probablly want to change both the source and destination IP.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-12T10:46:46.540" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41118" PostTypeId="1" AcceptedAnswerId="41119" CreationDate="2017-05-12T11:46:33.310" Score="0" ViewCount="75" Body="&lt;p&gt;Take a look at this set of commands :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;iptables -F&#xA;&#xA;iptables -P OUTPUT DR0P&#xA;iptables -P INPUT DROP&#xA;iptables -P FORWARD DROP&#xA;&#xA;iptables -A FORWARD -d 195.83.164.0/23 -p udp --dport 53 -i eth0 -j ACCEPT&#xA;iptables -A FORWARD -s 195.83.164.0/23 -p udp --sport 53 -j ACCEPT&#xA;&#xA;iptables -A FORWARD -p tcp --sport 22 -j ACCEPT&#xA;iptables -A FORWARD -p tcp --dport 22 -j ACCEPT&#xA;&#xA;iptables -t nat -A POSTROUTING -s 192.168.1.0/24 -o ppp0 -j MASQUERADE&#xA;&#xA;iptables -A INPUT -i eth0 -j REJECT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tell me if the following points are correct :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The line N°1 flushes all the chains (FORWARD, INPUT, OUTPUT...) of all the tables (MANGLE, NAT, FILTER, ...)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The lines N°2, N°3, N°4 sets the default table's (FILTER) OUTPUT/INPUT/FORWARD chains' default action to DROP&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;First of all, any packet is analyzed by MANGLE's PREROUTING chain : nothing is indicated, so we suppose that the default action is ACCEPT&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then it will be analyzed by NAT's PREROUTING chain : same&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, the destination address of the packet is read........ :&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;IF THE PACKET IS NOT DESTINATED TO THE ROUTER (&quot;NDTR&quot;), THEN... :&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The NDTR packet is analysed by MANGLE's FORWARD chain : nothing is indicated, so we suppose that the default action is ACCEPT&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, the NDTR packet is analyzed by FILTER's FORWARD chain : the lines N°5, N°6, N°7, N°8 and N°4 tell that the NDTR packet will be ACCEPTED only if [ its destination is 195.83.164.0/23 AND destination port is 53 AND destination interface is eth0 ] OR if [ its source is 195.83.164.0/23 AND destination port is 53 ] OR if [ its an SSH packet ] ELSE, it will be DROPPED.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;If the NDTR packet is DROPPED, then... well... it's DROPPED, and it's the end of this &quot;algorithm&quot;. Otherwise, if it's ACCEPTED, it will be analyzed by the MANGLE's POSTROUTING chain : nothing is indicated, we suppose the default action is ACCEPT : then, it will be analyzed by NAT's POSTROUTING chain : nothing is indicated, ACCEPT by default again. Then, the packet has reached its destination.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;OTHERWISE, IF THE PACKET IS ACTUALLY DESTINATED TO THIS ROUTER (&quot;DR&quot;) ..... :&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;The DR packet will be analyzed by MANGLE's INPUT chain : nothing is indicated, we assume ACCEPT&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Then, the DR packet will be analyzed by the FILTER's INPUT chain : it will be REJECTED if its destination interface is eth0, or DROPPED if not.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;In both case, it's the end.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Just for information : the packet would be analyzed then by MANGLE's OUTPUT chain then by NAT's OUTPUT chain then by FILTER's OUTPUT chain then by MANGLE's POSTROUTING chain then by NAT's POSTROUTING chain, then it will be returned to the host that sent it.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Well, did I correctly understand Netfilter/iptables ?&lt;/p&gt;&#xA;" OwnerUserId="33344" LastEditorUserId="8499" LastEditDate="2018-02-15T19:37:48.913" LastActivityDate="2018-02-15T19:37:48.913" Title="iptables : did I understand these commands correctly?" Tags="|firewall|" AnswerCount="1" CommentCount="1" ClosedDate="2017-05-12T13:51:33.413" ContentLicense="CC BY-SA 3.0" />
  <row Id="41119" PostTypeId="2" ParentId="41118" CreationDate="2017-05-12T12:34:39.393" Score="1" Body="&lt;p&gt;You are getting things mostly right, A couple of minor points.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;The NAT engine is connection-based. Only the first packet of a connection goes through the NAT chains. For later packets in the connection translations are performed based on the mappings created by the first packet. I'm not sure exactly where in the process the translations for existing packets are applied.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Your description seems to have missed the MASQUERADE rule in the nat table POSTROUTING chain.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-12T12:34:39.393" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41122" PostTypeId="1" AcceptedAnswerId="49256" CreationDate="2017-05-12T15:28:02.397" Score="1" ViewCount="3254" Body="&lt;p&gt;I'm beginner, and I have problems with BGP. I don't really understand why it doesn't work correctly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is my topology:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/zexHQ.png&quot; alt=&quot;![topology&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/8RQih.png&quot; alt=&quot;detail&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to ping from R8 to R10.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the configuration of R8:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R8&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;! &#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Serial1/0&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/1&#xA; ip address 199.168.1.9 255.255.255.252&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/2&#xA; ip address 50.1.0.1 255.0.0.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/3&#xA; ip address 199.168.1.2 255.255.255.252&#xA; serial restart-delay 0&#xA;!&#xA;interface FastEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet3/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet4/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Serial5/0&#xA; ip address 199.168.1.22 255.255.255.252&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial5/1&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial5/2&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial5/3&#xA; no ip address&#xA; shutdown&#xA; serial restart-delay 0&#xA;!&#xA;router eigrp 1&#xA; redistribute bgp 100 metric 100 100 100 100 100&#xA; network 199.168.1.0 0.0.0.3&#xA; network 199.168.1.8 0.0.0.3&#xA; network 199.168.1.20 0.0.0.3&#xA; auto-summary&#xA;!&#xA;router bgp 100&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; network 50.1.0.0 mask 255.255.255.0&#xA; neighbor 50.1.0.2 remote-as 200&#xA; neighbor 50.1.0.2 next-hop-self&#xA; neighbor 199.168.1.1 remote-as 100&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; login&#xA; escape-character 3&#xA;line vty 5 15&#xA; login&#xA; escape-character 3&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This one is the configuration of R10:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;&#xA;!&#xA;version 12.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R10&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;no aaa new-model&#xA;no ip icmp rate-limit unreachable&#xA;!&#xA;!&#xA;ip cef&#xA;no ip domain lookup&#xA;!&#xA;!&#xA;ip auth-proxy max-nodata-conns 3&#xA;ip admission max-nodata-conns 3&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip tcp synwait-time 5&#xA;! &#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface Serial1/0&#xA; ip address 50.1.0.2 255.0.0.0&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/1&#xA; ip address 195.16.1.10 255.255.255.252&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/2&#xA; ip address 195.16.1.22 255.255.255.252&#xA; serial restart-delay 0&#xA;!&#xA;interface Serial1/3&#xA; ip address 195.16.1.13 255.255.255.252&#xA; serial restart-delay 0&#xA;!&#xA;interface FastEthernet2/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet3/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;interface FastEthernet4/0&#xA; no ip address&#xA; shutdown&#xA; duplex half&#xA;!&#xA;router eigrp 2&#xA; redistribute bgp 200 metric 100 100 100 100 100&#xA; network 195.16.1.8 0.0.0.3&#xA; network 195.16.1.12 0.0.0.3&#xA; network 195.16.1.20 0.0.0.3&#xA; auto-summary&#xA;!&#xA;router bgp 200&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; network 50.1.0.0 mask 255.255.255.0&#xA; redistribute eigrp 2&#xA; neighbor 50.1.0.1 remote-as 100&#xA; neighbor 50.1.0.1 next-hop-self&#xA; neighbor 195.16.1.14 remote-as 200&#xA; no auto-summary&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;no cdp log mismatch duplex&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;gatekeeper&#xA; shutdown&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I run the command, &lt;code&gt;show ip bgp&lt;/code&gt; in R8, I have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R8#show ip bgp&#xA;BGP table version is 7, local router ID is 199.168.1.22&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;* i195.16.1.0/30    20.1.0.2                 0    100      0 200 ?&#xA;*&amp;gt;                  50.1.0.2           2681856             0 200 ?&#xA;* i195.16.1.4/30    20.1.0.2           2681856    100      0 200 ?&#xA;*&amp;gt;                  50.1.0.2           2681856             0 200 ?&#xA;* i195.16.1.8/30    20.1.0.2           2681856    100      0 200 ?&#xA;*&amp;gt;                  50.1.0.2                 0             0 200 ?&#xA;* i195.16.1.12/30   20.1.0.2                 0    100      0 200 ?&#xA;*&amp;gt;                  50.1.0.2                 0             0 200 ?&#xA;* i195.16.1.16/30   20.1.0.2                 0    100      0 200 ?&#xA;*&amp;gt;                  50.1.0.2           2681856             0 200 ?&#xA;* i195.16.1.20/30   20.1.0.2           2681856    100      0 200 ?&#xA;*&amp;gt;                  50.1.0.2                 0             0 200 ?&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Please help me.&lt;/p&gt;&#xA;" OwnerUserId="36712" LastEditorUserId="8499" LastEditDate="2018-12-16T04:38:43.027" LastActivityDate="2018-12-16T04:38:43.027" Title="BGP problems, cannot ping" Tags="|cisco|routing|bgp|eigrp|gns3|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41124" PostTypeId="2" ParentId="41122" CreationDate="2017-05-12T15:54:04.317" Score="3" Body="&lt;p&gt;You have not set the clock rate on the DCE side of the connection. The command is &lt;code&gt;clock rate &amp;lt;rate&amp;gt;&lt;/code&gt;. See &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/interface/command/ir-cr-book/ir-c2.html#wp7552247510&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Cisco IOS Interface and Hardware Component Command Reference&lt;/em&gt;&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another problem is that you have a network statement that does not match the actual network. Your interfaces are in the &lt;code&gt;50.1.0.0/8&lt;/code&gt; network, but your BGP network statement is for the &lt;code&gt;50.1.0.0/24&lt;/code&gt; network. BGP will only advertise the exact network that exists in the routing table, and if the network statement doesn't match, it will not be advertised.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You are also creating a routing loop with your redistribution. eBGP has a lower AD than EIGRP so any routes received from both will prefer eBGP. You should be careful about redistribution. You can use tags and communities to prevent receiving routes originating in your AS from being received from a different AS, or you can drop the redistribution in BGP and only use network statements.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-12T16:15:34.813" LastActivityDate="2017-05-12T16:15:34.813" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41128" PostTypeId="1" AcceptedAnswerId="41129" CreationDate="2017-05-12T18:01:18.233" Score="1" ViewCount="1646" Body="&lt;p&gt;I have a simple network in my company, where I use my ISP's ADSL Router. The LAN is &lt;code&gt;192.168.1.0/24&lt;/code&gt;. Router's IP is &lt;code&gt;192.168.1.1&lt;/code&gt;. It also has DHCP enabled, which ranges from &lt;code&gt;2 to 250&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a Digital Video Recorder (DVR) configured with static IP address, with the following LAN configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP  : 192.168.1.254&#xA;MASK: 255.255.255.0&#xA;GW  : 192.168.1.1&#xA;DNS1: 192.168.1.1&#xA;HTTP: 8080&#xA;SRVR: 6036&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I also need to configure connection ports - in this case, DVR's HTTP port is &lt;code&gt;8080&lt;/code&gt; and Server port is &lt;code&gt;6036&lt;/code&gt;.  I made the adjustments on my router to forward the ports to the DVR. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I downloaded the phone APP and configure it to connect &lt;code&gt;192.168.1.254&lt;/code&gt; - it works. Therefore, DVR network configuration is correct. Then, I configured the DVR's &lt;code&gt;DDNS&lt;/code&gt; and reconfigured the APP on my cellphone... and here is where the problem happens:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I'm &lt;strong&gt;outside&lt;/strong&gt; my work network (ie. 3G or at my house), it works. It connects to my DVR using the &lt;code&gt;DDNS&lt;/code&gt;. However, if I'm in the network it doesn't work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lets say my network's public address is &lt;code&gt;200.30.20.10&lt;/code&gt;. So, from my phone are coming out packets with destination address 200.30.20.10 to both ports (8080 and 6036). So it's trying to connect correctly as expected (because I can connect to the DVR from my house, so I know both DDNS and port-forward are correct)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My reasoning: when I'm inside the network, the packet reaches my router, matches only the default route and goes out the gateway. However, now the packet will have both source and destination address equal to &lt;code&gt;200.30.20.10&lt;/code&gt; ... so the gateway network will just drop my packet? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I thought adding a static route to my routing table would fix this, but as my public IP always changes, that won't be every efficient...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My conclusion so far: you can't connect to your network using your public address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Why I wanna solve this: the way it is now, all phones need two configurations: one to connect to the DVR when we are here, and another one for when we are not here.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My question: what exactly is happening and why?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="23205" LastActivityDate="2017-05-12T19:11:57.427" Title="Connect to local network using WAN IP address" Tags="|packet-analysis|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41129" PostTypeId="2" ParentId="41128" CreationDate="2017-05-12T18:11:54.933" Score="4" Body="&lt;p&gt;Your thinking is correct.  One term you may want to search is &quot;hairpin&quot;.  Basically the idea that a packet makes a U-turn and heads right back inside where it came from.  Different routers and firewalls configure this differently, so you'll have to look up yours.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've also seen it called &quot;NAT loopback,&quot; but I think hairpin is the more common term.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Edit: This is in essence what hairpinning does for you.&lt;/em&gt;&lt;br&gt;&#xA;Imagine you've configured the external IP on the phone app.&lt;br&gt;&#xA;Your phone (example 192.168.1.5) sends a packet to 200.30.20.10.  If you only change the destination IP (DNAT) then when the packet hits the DVR it will look like: 192.168.1.5 -&gt; 192.168.1.254.  The DVR will reply directly to the phone since they are on the same subnet.  Your phone will drop the reply packet because as far as it's concerned, it didn't send anything to 192.168.1.254, it sent a packet to 200.30.20.10!  So you'll have to change the source address (SNAT) as well in that case so the packets go back to the firewall and then back to your phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in the end:&lt;br&gt;&#xA;PHONE ON THE OUTSIDE&lt;br&gt;&#xA;z.z.z.z -&gt; 208.30.20.10&lt;br&gt;&#xA;Router sees this packet and changes it to: z.z.z.z -&gt; 192.168.1.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PHONE ON THE INSIDE (phone configured the same way)&lt;br&gt;&#xA;192.168.1.5 -&gt; 200.30.20.10&lt;br&gt;&#xA;Router sees this packet and needs to change it to: 192.168.1.1 -&gt; 192.168.1.254&lt;/p&gt;&#xA;" OwnerUserId="36577" LastEditorUserId="36577" LastEditDate="2017-05-12T18:31:55.270" LastActivityDate="2017-05-12T18:31:55.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41130" PostTypeId="2" ParentId="40978" CreationDate="2017-05-12T18:59:18.860" Score="1" Body="&lt;p&gt;It's always the same IP address, just in varying subnets (all overlapping, inevitably):&lt;/p&gt;&#xA;&lt;pre&gt;&lt;code&gt;194.24.0.20/15 - part of 194.24.0.0 to 194.25.255.255&#xA;194.24.0.20/16 - part of 194.24.0.0 to 194.24.255.255 (subnet of above)&#xA;194.24.0.20/20 - part of 194.24.0.0 to 194.24.15.255 (subnet of above)&#xA;194.24.0.20/21 - part of 194.24.0.0 to 194.24.7.255 (subnet of above)&#xA;194.24.0.20/24 - part of 194.24.0.0 to 194.24.0.255 (subnet of above)&#xA;194.24.0.20/29 - part of 194.24.0.16 to 194.24.0.23 (subnet of above)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;p&gt;So essentially: no, you can't use the same address for different hosts (if they're connected).&lt;/p&gt;&#xA;&lt;p&gt;The netmask defines the size of the subnet that's directly connected. This is the range of destination IP addresses that can be talked to directly on a common layer 2 connection (e.g. Ethernet). Destination adresses outside this range require the use of a router.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2020-06-20T11:25:11.627" LastActivityDate="2020-06-20T11:25:11.627" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="41131" PostTypeId="2" ParentId="41128" CreationDate="2017-05-12T19:11:57.427" Score="2" Body="&lt;p&gt;The easiest solution is to not use the IP address but the DDNS name. Configure your router (assuming its your local DNS server) to resolve that name to the internal IP address of your DVR (this is called 'split DNS').&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If that isn't possible add the local IP and the DDNS name to your local 'hosts' file, so it doesn't get resolved via DNS at all. For Windows, it's &lt;code&gt;C:\Windows\System32\drivers\etc\hosts&lt;/code&gt;; for Linux, it's &lt;code&gt;/etc/hosts&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-12T19:11:57.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41132" PostTypeId="2" ParentId="38840" CreationDate="2017-05-12T20:07:10.750" Score="2" Body="&lt;p&gt;Any option for split DNS instead (pointing the DNS name to the internal IP on the local DNS server)? Very easy solution.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-12T20:07:10.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41133" PostTypeId="1" AcceptedAnswerId="41135" CreationDate="2017-05-12T23:49:22.053" Score="5" ViewCount="16410" Body="&lt;p&gt;I have a Verizon cell modem that uses IPv6 addressing only. I can use it to access IPv4 addresses, like browsing the Internet. However, if I try to ping this IPv6 address on a cell modem from IPv4 network, it returns &lt;code&gt;Destination host unreachable&lt;/code&gt;. Now I have two questions:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Is it possible for a computer in an IPv4 network (including NAT,&#xA;firewall, etc.) to access IPv6 addresses without too much tweaking? I&#xA;tried to use a Teredo service. It seemed to worked for a time, and then&#xA;I was not able to communicate with IPv6 addressing (for example,&#xA;ipv6.google.com). Is there any tunneling service that I can use to&#xA;bypass internal network layer and directly communicate with IPv6?&lt;/li&gt;&#xA;&lt;li&gt;If I want to open a service, say VNC service in computer connecting&#xA;to that IPv6 cell modem, can I access this service from a regular&#xA;IPv4 network?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Also, may I know where can I find knowledge regarding this kind of issues? It seems like I don't even have the right keywords to google.&lt;/p&gt;&#xA;" OwnerUserId="36725" LastEditorUserId="8499" LastEditDate="2018-03-09T22:46:55.953" LastActivityDate="2018-11-06T17:10:00.777" Title="How does computer in IPv4 network communicate with computer in IPv6 network" Tags="|ipv4|ip|ipv6|ipv6-transition|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41135" PostTypeId="2" ParentId="41133" CreationDate="2017-05-13T00:14:53.763" Score="6" Body="&lt;p&gt;IPv4 and IPv6 are two completely separate protocols, with separate, incompatible packet headers and addressing, and an IPv4-only host cannot directly communicate with an IPv6-only host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The correct way to do this is to dual-stack one or both hosts so that they run both the IPv4 and IPv6 protocols. Otherwise, you must use some type of kludge to translate between IPv4 and IPv6, but there are problems and limitations with any of those. For example, there are far more IPv6 addresses than IPv4 addresses, so it is easier to translate an IPv4 address into something an IPv6-only host understands, than it is to do the opposite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In 2017, the time has passed that there are still IPv4-only hosts and networks. Most ISPs support IPv6, and if your business has not yet begun to roll out IPv6, then it may find itself scrambling to do that in the future.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-13T00:14:53.763" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41137" PostTypeId="1" CreationDate="2017-05-13T04:23:12.107" Score="1" ViewCount="75" Body="&lt;p&gt;The question might sound dumb, but you never learn if you do not ask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When using PPP as a datalink layer, it offers you authentication by using username and password. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where is the username and password stored in the frame? Is it part of the payload or is it part of the frame header? If it is stored in the payload, then we cant we use Ethernet and authenticate over it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am confused and would appreciate the help. &lt;/p&gt;&#xA;" OwnerUserId="36718" LastActivityDate="2017-07-12T08:53:07.330" Title="Where the password is stored when using ppp protocol" Tags="|network|pppoe|ppp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41138" PostTypeId="2" ParentId="41137" CreationDate="2017-05-13T04:33:15.650" Score="1" Body="&lt;p&gt;The currently used authentication method for PPP is CHAP, and it doesn't send the actual password across the wire. Instead, it sends a challenge, and the respondent will hash the challenge with the password and return the result.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The challenge/response happens during the setup of the link, and it will also happen randomly during the life of the connection.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This happens at the datalink layer, and it is transparent to the layer-3 and above protocols.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-13T04:33:15.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41139" PostTypeId="1" CreationDate="2017-05-13T04:50:19.530" Score="0" ViewCount="437" Body="&lt;p&gt;This was an exam question last year, and I was trying to figure out how to get the answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A small company is assigned the class C network 205.67.35.0. You need to divide&#xA;this network to provide subnets for three departments using fixed-length&#xA;subnetting. The departments are approximately the same size. Show the network&#xA;and broadcast addresses for each subnet. Show the slash notation. How many hosts&#xA;are on each subnet? Are the resulting subnets class C networks? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How would you go about doing this? How would you start it? &lt;/p&gt;&#xA;" OwnerUserId="36727" LastActivityDate="2017-05-13T06:01:13.923" Title="How to use Fixed Length subnetting for Class C network?" Tags="|ipv4|subnet|network|" AnswerCount="1" CommentCount="1" ClosedDate="2017-05-13T16:14:12.443" ContentLicense="CC BY-SA 3.0" />
  <row Id="41140" PostTypeId="1" AcceptedAnswerId="41188" CreationDate="2017-05-13T05:10:58.903" Score="1" ViewCount="1662" Body="&lt;p&gt;I've a pair of Nexus 3048 running NXOS version 7.0(3)I2(2d) and I can't enable flow control on ethernet interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When issuing the command: &lt;code&gt;flowcontrol receive on&lt;/code&gt; it returns with: &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;ERROR: This CLI is not supported on n3k platform&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;How to enable flowcontrol on Nexus interfaces?&lt;/p&gt;&#xA;" OwnerUserId="10528" LastActivityDate="2017-05-15T15:28:11.417" Title="Cannot enable Flow Control on Cisco Nexus 3048" Tags="|cisco-nexus|cisco-nx-os|nx-os|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41141" PostTypeId="2" ParentId="41139" CreationDate="2017-05-13T06:01:13.923" Score="3" Body="&lt;p&gt;Classful subnetting has been deprecated 25 years ago. Any exam that still asks about class A, B or C addresses is dangerously obsolete and should not be taken seriously. I strongly recommend to find an educator who has updated their training material less than a quarter of a century ago...&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2017-05-13T06:01:13.923" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41143" PostTypeId="1" AcceptedAnswerId="46244" CreationDate="2017-05-13T12:44:44.863" Score="1" ViewCount="299" Body="&lt;p&gt;Is there any way to configure a switch in GNS3?&lt;/p&gt;&#xA;" OwnerUserId="35524" LastEditorUserId="8499" LastEditDate="2017-05-13T16:29:43.970" LastActivityDate="2018-02-04T21:26:32.710" Title="Configure switch in GNS3" Tags="|voip|gns3|telephony|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41144" PostTypeId="2" ParentId="27856" CreationDate="2017-05-13T13:56:36.017" Score="2" Body="&lt;p&gt;You should assign an IP addresses to your serial interfaces.&#xA;200.0.0.1 and 200.0.0.9&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently your routers have crypto-maps, which set up to look on each other by IP addresses, but this addresses actually not assigned to any router interfaces. On router 1 (HQ) enter in configuration mode: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface S0/0/0 &#xA; ip address 200.0.0.1 255.255.255.0 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And same on other router (branch): &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface S0/0/1&#xA; ip address 200.0.0.9 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29556" LastEditorUserId="29556" LastEditDate="2017-05-18T14:31:47.090" LastActivityDate="2017-05-18T14:31:47.090" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41146" PostTypeId="1" AcceptedAnswerId="41177" CreationDate="2017-05-13T16:48:37.710" Score="5" ViewCount="8116" Body="&lt;p&gt;I have the leftover from a long spool of CAT6. I'd like to run a line to my garage, which is separate from the house.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can &quot;typical&quot; CAT6 be directly buried, or should I buy one of the &quot;waterproof&quot; cables I see on Amazon?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm in the Toronto area, so coldish in the winter, but not particularly wet and in an area with good drainage.&lt;/p&gt;&#xA;" OwnerUserId="36733" LastEditorUserId="8499" LastEditDate="2019-01-02T22:59:02.337" LastActivityDate="2019-01-02T22:59:02.337" Title="Can normal CAT6 be buried?" Tags="|ethernet|layer1|cable|cabling|" AnswerCount="3" CommentCount="1" ClosedDate="2018-07-20T00:43:48.250" ContentLicense="CC BY-SA 3.0" />
  <row Id="41147" PostTypeId="2" ParentId="41146" CreationDate="2017-05-13T17:09:00.770" Score="5" Body="&lt;p&gt;Indoor UTP cabling is not at all suitable for outdoor use. It cannot tolerate any moisture. Category-6 cabling is difficult for even professionals to install and terminate properly in order to pass the Category-6 test suite.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSP (Outside Plant) cabling should only be done by a professional. There life and safety concerns. You must have proper grounding and bonding at both ends (lightning does travel through the ground). Buried cable must either be in conduit, or be specifically designed for direct burial. It must be buried at least 24&quot; or below the frost line, whichever is deeper, because the ground does move.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-13T17:09:00.770" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41152" PostTypeId="1" AcceptedAnswerId="47523" CreationDate="2017-05-14T00:38:45.803" Score="4" ViewCount="565" Body="&lt;p&gt;I work for an MSP with a relatively small network. We're implementing a new set of Cisco ASR 1001-Xs on our edge and I'm trying to improve our BGP configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routers are running: &lt;code&gt;IOS XE Version 03.16.05.S / Version 15.5(3)S5&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One problem I'm trying to solve, is how to make the configuration reasonably scalable in terms of making changes across multiple peers. I imagine this surely must be possible for larger ISP networks with 10s or 100s of BGP peer configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Specifically, I am hoping to define multiple levels of import/export route-maps, where I can define a general route-map for all transit peers, one for customers, one for IXes, etc. Then as a 2nd level of route-maps applied &lt;em&gt;after that&lt;/em&gt; would be AS-specific route-maps for the particular peer.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;What I've tried&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BGP Templates&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried using BGP templates, defining a &lt;code&gt;UPSTREAM_TRANSIT&lt;/code&gt; peer-policy, inherited by a more AS-specific template such as &lt;code&gt;UPSTREAM_TRANSIT_AS1234&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; template peer-policy UPSTREAM_TRANSIT&#xA;  route-map UPSTREAM_TRANSIT_IMPORT in&#xA;  route-map UPSTREAM_TRANSIT_EXPORT out&#xA;  soft-reconfiguration inbound&#xA;  send-community&#xA; exit-peer-policy&#xA;&#xA; template peer-policy UPSTREAM_TRANSIT_AS1234&#xA;  route-map UPSTREAM_TRANSIT_AS1234_IMPORT in&#xA;  route-map UPSTREAM_TRANSIT_AS1234_EXPORT out&#xA;  inherit peer-policy UPSTREAM_TRANSIT 1&#xA; exit-peer-policy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The problem here is that even though I can specify inheritance and import/export route-maps, the child simply overrides the parent, so it does not become cumulative.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Example&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Here's an example of what I'm trying to achieve.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, I've defined two route-maps that I intend to be inherited by all BGP transit peers called &lt;code&gt;UPSTREAM_TRANSIT_IMPORT&lt;/code&gt; and &lt;code&gt;UPSTREAM_TRANSIT_EXPORT&lt;/code&gt;. In this:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;I've defined a prefix list called &lt;code&gt;MARTIANS&lt;/code&gt; and want to block some basic martian subnets on all imports/exports for all transit and peering peers.&lt;/li&gt;&#xA;&lt;li&gt;I want to match against the &lt;code&gt;NO_EXPORT&lt;/code&gt; BGP community and prevent export to all transit peers.&lt;/li&gt;&#xA;&lt;li&gt;Another prefix list for RFC1918 addresses, which should also not be exported or imported to a transit peer.&lt;/li&gt;&#xA;&lt;li&gt;In future I would plan to add matching of communities to do Set LocalPref, AS Prepend etc... For downstream customers, and I'd have a similar CUSTOMER_TRANSIT_IMPORT/EXPORT route-map for that.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Then, I've defined in my AS-specific route-maps I have something like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Only export prefixes to this AS the ones I want to announce&lt;/li&gt;&#xA;&lt;li&gt;Import all prefixes, or maybe only import domestic prefixes by matching a certain community.&lt;/li&gt;&#xA;&lt;li&gt;When importing prefixes from this peer, set a few BGP Informational communities so I can tell: Which transit provider did I get the prefixes from; which POP did it come from; etc.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I've got a full list of BGP communities I plan to work towards supporting on our network, in-line with what you might see from a larger transit provider, as we're working on growing our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So I want to make the configuration as easy as possible to make these kinds of changes as possible. As well, to allow us to easily impact routing policy changes as widely or narrowly as we need. So this is why I need to put some kind of hierarchical structure in place.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And the other reason is that I'm &lt;em&gt;sure&lt;/em&gt; this must be a solved problem for larger ISPs. How can I do this?&lt;/p&gt;&#xA;" OwnerUserId="846" LastEditorUserId="42770" LastEditDate="2018-02-01T09:52:07.580" LastActivityDate="2018-02-01T09:52:07.580" Title="Defining hierarchical BGP route-maps" Tags="|cisco|bgp|design|cisco-ios-15|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="41153" PostTypeId="2" ParentId="6162" CreationDate="2017-05-14T00:45:38.850" Score="1" Body="&lt;p&gt;An &quot;alternative&quot; would appear to me to be (in line with answering &quot;or if you can think of an even better solution&quot;) - Treat the switches and the network as untrusted and force the clients to use VPN to connect.  This is my company's standard response to small offices (4 workstations seems small to me) due to the difficulty of controlling the physical switches on site .For the offices we use like this the printers can only be used when not on VPN or using direct USB.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure this is applicable for you - I either got confused about the switches you propose or you seem to have a requirement for a lot of ports for just four computers.&lt;/p&gt;&#xA;" OwnerUserId="33676" LastActivityDate="2017-05-14T00:45:38.850" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41154" PostTypeId="1" AcceptedAnswerId="41155" CreationDate="2017-05-14T02:18:04.220" Score="1" ViewCount="1630" Body="&lt;p&gt;I'm having trouble understanding whether DTP will always use the native VLAN, even if it's configured to be non-default, or if it will use VLAN 1 in any case. For example, if you configured VLAN 50 to be your native VLAN, would DTP use VLAN 50, or continue on VLAN 1?&lt;/p&gt;&#xA;" OwnerUserId="30549" LastEditorUserId="8499" LastEditDate="2017-05-14T03:13:30.570" LastActivityDate="2017-05-14T03:13:30.570" Title="Will DTP always use the native VLAN or always VLAN 1?" Tags="|cisco|switch|vlan|trunk|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41155" PostTypeId="2" ParentId="41154" CreationDate="2017-05-14T02:50:44.933" Score="1" Body="&lt;p&gt;DTP doesn't actually use a VLAN because it is a local-link protocol that does not go beyond the endpoints of the links. The frames used by DTP are not tagged, so many people say that it uses the native VLAN, but if the native VLAN is used by other switch interfaces, the DTP frames will not be forwarded to those interfaces the way other frames in the native VLAN can be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The current Cisco best practice is to not use a native VLAN or VLAN 1. The link-local frames for things like DTP, CDP, etc. will still reach the other end of the link and work.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-14T02:50:44.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41156" PostTypeId="1" CreationDate="2017-05-14T04:07:54.797" Score="6" ViewCount="4895" Body="&lt;p&gt;I am fairly new towards Fortigate firewalls and I am trying to set up one &lt;strong&gt;FortiGate 100D&lt;/strong&gt; running &lt;strong&gt;firmware v5.0&lt;/strong&gt; as a router for a hotel network. I have 2 ISPs using PPPoE connection that runs on VLAN 500. I created VLANs for both wan1 and wan2 (assuming &lt;strong&gt;ISP_A_vlan&lt;/strong&gt; and &lt;strong&gt;ISP_B_vlan&lt;/strong&gt;) with all ISPs' credential set and I am able to connect and obtain an IP from the ISP, which is fine. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of the 16 ports I have, I've separated it into 8 different networks in pair of 2 ports per network with DHCP enabled, where it serves different IP in different network pair. For example, &lt;strong&gt;Office_lan @ 10.1.1.1/24&lt;/strong&gt; and &lt;strong&gt;Access_point @ 10.1.0.1/24&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, I created a policy for both ISP_A_vlan and ISP_B_vlan with the following configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy type: firewall&#xA;policy subtype: address&#xA;incoming interface: Access_point&#xA;source address: all&#xA;outgoing interface: ISP_A_vlan, ISP_B_vlan &#xA;destination address: ALL&#xA;schedule: always&#xA;service: all&#xA;enable NAT: true (use destination interface address)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similarly for Office_lan:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy type: firewall&#xA;policy subtype: address&#xA;incoming interface: Office_lan&#xA;source address: all&#xA;outgoing interface: ISP_A_vlan, ISP_B_vlan &#xA;destination address: ALL&#xA;schedule: always&#xA;service: all&#xA;enable NAT: true (use destination interface address)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;but when I inspect the Foward Traffic log, there are no internet connection from either Office_lan or Access_point. They are able to negotiate an IP from the DHCP server as well as obtained a DNS server from the ISP itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the similar setup, instead of running PPPoE on vlan wan ports, I took 2 routers (assuming &lt;strong&gt;wan1 for Router_A&lt;/strong&gt; and &lt;strong&gt;wan2 for Router_B&lt;/strong&gt;), configured the ISP's credential in routers then connecting both of the routers to wan1 and wan2 with almost similar configuration as follow: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy type: firewall&#xA;policy subtype: address&#xA;incoming interface: Access_point&#xA;source address: all&#xA;outgoing interface: wan1, wan2 &#xA;destination address: ALL&#xA;schedule: always&#xA;service: all&#xA;enable NAT: true (use destination interface address)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Similarly for Office_lan:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;policy type: firewall&#xA;policy subtype: address&#xA;incoming interface: Office_lan&#xA;source address: all&#xA;outgoing interface: wan1, wan2 &#xA;destination address: ALL&#xA;schedule: always&#xA;service: all&#xA;enable NAT: true (use destination interface address)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and everything works fine. Am I missing something right here? &lt;/p&gt;&#xA;" OwnerUserId="36747" LastActivityDate="2018-09-20T22:00:42.767" Title="Fortigate 100D internet on VLAN wan port" Tags="|vlan|firewall|isp|wan|fortigate|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41158" PostTypeId="2" ParentId="41146" CreationDate="2017-05-14T07:13:24.403" Score="1" Body="&lt;p&gt;I have done this with no problem.  I obsoleted the need for the cable by using WiFi before the cable ever could become a problem.  But while I was using it I had no problems.  The trick is to not just bury the wire.  Enclose it to keep water away from it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since this is for home use, I would suggest that you bury it inside a length of PVC pipe.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get the smallest that will work for you, and put on elbows and such so it comes up at each end then angles down before the cable goes through a wall, so rain stays out of it.  I spray-painted mine black so it was barely noticeable, mounted on the wall.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be sure to plan for failure because this cable is not designed for this, so have a second one in the pipe with the first one just in case.  Maybe also make a third one you keep in the garage in case water does cause a problem with whatever is in the pipe and you have to pull them both out and blow it clean.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Like with any conduit-type installation, make sure you pull in a draw string along with the cable(s).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Connectors on each end for easy swapping, of course.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In any case, give it a try.  The worst that can happen is that it will work for a few months then fail.  You have the cable, and PVC pipe and fittings are all very inexpensive.  Not all the PVC joints will need to be glued, but the elbows that go underground definitely should be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Good luck with this project.&lt;/p&gt;&#xA;" OwnerUserId="34855" LastActivityDate="2017-05-14T07:13:24.403" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41159" PostTypeId="2" ParentId="33545" CreationDate="2017-05-14T07:24:05.753" Score="1" Body="&lt;p&gt;For anything sensitive, make sure you use ssh.   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ssh keygen&#xA;ssh-copy-id -i (remote)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in both directions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;then you can use scp for encrypted transfers.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For Windows you can use WinSCP.  Get the PuTTY suite and look in the directory and you will find it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This makes it simple because it can run both as scripts and as tasks.  Once you exchange public keys it will not prompt you for a password.&lt;/p&gt;&#xA;" OwnerUserId="34855" LastActivityDate="2017-05-14T07:24:05.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41161" PostTypeId="1" AcceptedAnswerId="41162" CreationDate="2017-05-14T08:23:24.707" Score="1" ViewCount="1232" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4oIB9.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4oIB9.jpg&quot; alt=&quot;The confusing image&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I came across this image of a FC frame header. I see that there are two fields, a 2112 byte data field and a 2048 byte payload field. I tried to read about how to distinguish among the two, but ended up being more confused. Some links mention that the maximum data that can be transferred per frame is 2112 bytes, while other sources mention it is 2048 bytes, which makes me feel that these fields are both used for payload delivery somehow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please help. Thank you.&lt;/p&gt;&#xA;" OwnerUserId="36752" LastActivityDate="2017-07-12T15:02:28.933" Title="Data field and Payload Field in Fibre channel frame header" Tags="|fiber|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41162" PostTypeId="2" ParentId="41161" CreationDate="2017-05-14T08:26:04.980" Score="0" Body="&lt;p&gt;Notice that the Payload is part of the Data Field. The only difference is that you can have an optional header, otherwise the Data Field and Payload are the same field, with the same length.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-14T08:26:04.980" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41163" PostTypeId="1" AcceptedAnswerId="43203" CreationDate="2017-05-14T10:29:16.600" Score="1" ViewCount="1550" Body="&lt;p&gt;I have 3 routers in my topology, and two of them have loop backs.Let's say R0 is the one without the loo back.&#xA;I have configured rip with no auto-summary just to make sure I can ping from R1 to the loop back address of R2.&#xA;The ping does not succeed.How is this possible considering I have enabled rip with no auto-summary?The loop back addresses are for R1: 192.168.1.65 and for R2:192.168.1.129&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are is the routing table for R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Gateway of last resort is not set&#xA;&#xA;       172.17.0.0/24 is subnetted, 1 subnets&#xA;  C       172.17.1.0 is directly connected, Serial1&#xA;          172.16.0.0/30 is subnetted, 1 subnets&#xA;  C       172.16.1.0 is directly connected, Ethernet0&#xA;          10.0.0.0/30 is subnetted, 1 subnets&#xA;  R       10.1.1.0 [120/1] via 172.17.1.2, 00:00:23, Serial1&#xA;    192.168.1.0/26 is subnetted, 1 subnets&#xA;  C       192.168.1.64 is directly connected, Loopback1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and here is the routing table for R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    Gateway of last resort is not set&#xA;&#xA;    172.17.0.0/24 is subnetted, 1 subnets&#xA; C       172.17.1.0 is directly connected, Serial1&#xA;         172.16.0.0/30 is subnetted, 1 subnets&#xA; R       172.16.1.0 [120/1] via 172.17.1.1, 00:00:03, Serial1&#xA;         10.0.0.0/30 is subnetted, 1 subnets&#xA; C       10.1.1.0 is directly connected, Serial0&#xA;         192.168.1.0/26 is subnetted, 1 subnets&#xA; C       192.168.1.128 is directly connected, Loopback1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36755" LastActivityDate="2017-08-13T07:52:59.987" Title="RIP version 2 ping to a loopback" Tags="|cisco|rip|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41165" PostTypeId="1" AcceptedAnswerId="41170" CreationDate="2017-05-14T11:27:20.740" Score="3" ViewCount="7698" Body="&lt;p&gt;My understanding is that &lt;/p&gt;&#xA;&#xA;&lt;p&gt;1/ the Transport Layer in the TCP/IP stack creates packets for data that is being sent out, and &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2/ the packets reassembly process occurs at the receiving end's Internet layer, not at its Transport layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please confirm whether any of this is accurate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: my textbook claims that apparently &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;ol start=&quot;2&quot;&gt;&#xA;  &lt;li&gt;TCP creates one or more packets and sends the first one to IP...&lt;/li&gt;&#xA;  &lt;/ol&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;and says that the Internet Layer simply passes on this as a datagram with IP addresses, and does not mention anything about reassembly, so I was simply curious.&lt;/p&gt;&#xA;" OwnerUserId="33554" LastEditorUserId="8499" LastEditDate="2018-10-25T04:37:47.967" LastActivityDate="2022-12-02T17:30:12.093" Title="Where in the TCP/IP stack does packet division and reassembly occur?" Tags="|ip|tcp|internet|layer4|transport-protocol|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41166" PostTypeId="2" ParentId="41163" CreationDate="2017-05-14T14:28:19.427" Score="1" Body="&lt;p&gt;You need to include the Loopback interfaces in the RIP Network statements. right now Router 1 knows about network 192.168.1.64/26 but does not know how to get to network 192.168.1.128/26.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So on router 1 you would add a network statement something like NETWORK 192.168.1.64 to your RIP configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You would do the reverse on Router 2&lt;/p&gt;&#xA;" OwnerUserId="36134" LastActivityDate="2017-05-14T14:28:19.427" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41168" PostTypeId="2" ParentId="41165" CreationDate="2017-05-14T19:40:32.680" Score="3" Body="&lt;p&gt;1) (IP) packets are created by the network layer. While TCP has its own transmission size, MSS, that should correspond to the path MTU, it can send larger segments that must be fragmented (and potentially even reassembled) on the Internet layer. (The path MTU is not easily discovered and the MSS may be too large.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2) &lt;em&gt;Packet&lt;/em&gt; reassembly happens at the network layer. The transport layer doesn't handle packets.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-05-14T20:22:15.120" LastActivityDate="2017-05-14T20:22:15.120" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41170" PostTypeId="2" ParentId="41165" CreationDate="2017-05-14T20:04:18.057" Score="6" Body="&lt;p&gt;Packets are layer-3 (Network layer) datagrams. Fragmentation and reassembly of packets is built into IPv4.&lt;/p&gt;&#xA;&lt;p&gt;Many people get confused because TCP (layer-4, Transport layer) segments a data stream, guarantees delivery of the individual segments, and reassembles them back into a data stream for the application. This is &lt;em&gt;not&lt;/em&gt; the same as packet fragmentation and reassembly.&lt;/p&gt;&#xA;&lt;p&gt;Fragmentation and reassembly of packets can be processor intensive and use resources required to perform high-speed packet switching (routing). Because of this, fragmentation is performed by IPv4, but IPv6 has done away with packet fragmentation. Instead, IPv6 requires the source host to perform fragmentation if it is necessary anywhere along the path.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 791, Internet Protocol&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The internet protocol also provides for fragmentation and reassembly&#xA;of long datagrams, if necessary, for transmission through &amp;quot;small&#xA;packet&amp;quot; networks.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The internet protocol implements two basic functions:  addressing and&#xA;fragmentation.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;In the routing of messages from one internet module to another,&#xA;datagrams may need to traverse a network whose maximum packet size is&#xA;smaller than the size of the datagram.  To overcome this difficulty, a&#xA;fragmentation mechanism is provided in the internet protocol.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;and&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Fragmentation&lt;/p&gt;&#xA;&lt;p&gt;Fragmentation of an internet datagram is necessary when it originates&#xA;in a local net that allows a large packet size and must traverse a&#xA;local net that limits packets to a smaller size to reach its&#xA;destination.&lt;/p&gt;&#xA;&lt;p&gt;An internet datagram can be marked &amp;quot;don't fragment.&amp;quot;  Any internet&#xA;datagram so marked is not to be internet fragmented under any&#xA;circumstances.  If internet datagram marked don't fragment cannot be&#xA;delivered to its destination without fragmenting it, it is to be&#xA;discarded instead.&lt;/p&gt;&#xA;&lt;p&gt;Fragmentation, transmission and reassembly across a local network&#xA;which is invisible to the internet protocol module is called intranet&#xA;fragmentation and may be used [6].&lt;/p&gt;&#xA;&lt;p&gt;The internet fragmentation and reassembly procedure needs to be able&#xA;to break a datagram into an almost arbitrary number of pieces that can&#xA;be later reassembled.  The receiver of the fragments uses the&#xA;identification field to ensure that fragments of different datagrams&#xA;are not mixed.  The fragment offset field tells the receiver the&#xA;position of a fragment in the original datagram.  The fragment offset&#xA;and length determine the portion of the original datagram covered by&#xA;this fragment.  The more-fragments flag indicates (by being reset) the&#xA;last fragment.  These fields provide sufficient information to&#xA;reassemble datagrams.&lt;/p&gt;&#xA;&lt;p&gt;The identification field is used to distinguish the fragments of one&#xA;datagram from those of another.  The originating protocol module of an&#xA;internet datagram sets the identification field to a value that must&#xA;be unique for that source-destination pair and protocol for the time&#xA;the datagram will be active in the internet system.  The originating&#xA;protocol module of a complete datagram sets the more-fragments flag to&#xA;zero and the fragment offset to zero.&lt;/p&gt;&#xA;&lt;p&gt;To fragment a long internet datagram, an internet protocol module (for&#xA;example, in a gateway), creates two new internet datagrams and copies&#xA;the contents of the internet header fields from the long datagram into&#xA;both new internet headers.  The data of the long datagram is divided&#xA;into two portions on a 8 octet (64 bit) boundary (the second portion&#xA;might not be an integral multiple of 8 octets, but the first must be).&#xA;Call the number of 8 octet blocks in the first portion NFB (for Number&#xA;of Fragment Blocks).  The first portion of the data is placed in the&#xA;first new internet datagram, and the total length field is set to the&#xA;length of the first datagram.  The more-fragments flag is set to one.&#xA;The second portion of the data is placed in the second new internet&#xA;datagram, and the total length field is set to the length of the&#xA;second datagram.  The more-fragments flag carries the same value as&#xA;the long datagram.  The fragment offset field of the second new&#xA;internet datagram is set to the value of that field in the long&#xA;datagram plus NFB.&lt;/p&gt;&#xA;&lt;p&gt;This procedure can be generalized for an n-way split, rather than the&#xA;two-way split described.&lt;/p&gt;&#xA;&lt;p&gt;To assemble the fragments of an internet datagram, an internet&#xA;protocol module (for example at a destination host) combines internet&#xA;datagrams that all have the same value for the four fields:&#xA;identification, source, destination, and protocol.  The combination is&#xA;done by placing the data portion of each fragment in the relative&#xA;position indicated by the fragment offset in that fragment's internet&#xA;header.  The first fragment will have the fragment offset zero, and&#xA;the last fragment will have the more-fragments flag reset to zero.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;also, fragmentation happens in routers, but reassembly is performed by the destination host&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;The basic internet service is datagram oriented and provides for the&#xA;fragmentation of datagrams at gateways, with reassembly taking place&#xA;at the destination internet protocol module in the destination host.&#xA;Of course, fragmentation and reassembly of datagrams within a network&#xA;or by private agreement between the gateways of a network is also&#xA;allowed since this is transparent to the internet protocols and the&#xA;higher-level protocols.  This transparent type of fragmentation and&#xA;reassembly is termed &amp;quot;network-dependent&amp;quot; (or intranet) fragmentation&#xA;and is not discussed further here.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-05-14T20:19:07.740" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41171" PostTypeId="2" ParentId="38846" CreationDate="2017-05-14T20:11:39.563" Score="1" Body="&lt;p&gt;You can't solve this with a switch but you can use a router supporting multiple WAN uplinks and then set up traffic rules for splitting the traffic (by user IP, service, load, ...).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, as a very simple setup, you can set up multiple LANs with one router and uplink each.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-14T20:11:39.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41175" PostTypeId="1" AcceptedAnswerId="41176" CreationDate="2017-05-14T22:06:15.377" Score="3" ViewCount="219" Body="&lt;p&gt;When sending a packet from one computer to another over LAN, you send both an ethernet header and an IP header. The ethernet header has a source and designation MAC address, and the IP header has source and destination IP addresses. Isn't this redundant? Are the IP headers ignored when communicating over LAN?&lt;/p&gt;&#xA;" OwnerUserId="36763" LastEditorUserId="8499" LastEditDate="2018-03-10T17:40:51.090" LastActivityDate="2018-03-10T17:40:51.090" Title="Are IP source and destination fields necessary on LAN?" Tags="|ethernet|ipv4|ip|ipv6|mac-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41176" PostTypeId="2" ParentId="41175" CreationDate="2017-05-14T22:11:41.930" Score="4" Body="&lt;p&gt;Don't confuse the network layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet, a layer-2 protocol, doesn't know or care which layer-3 protocol it carries. Also, it is only a protocol for a single layer-2 LAN, and nothing of the ethernet frame survives if the layer-3 packets are destined for a different LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IPv4, IPX, IPv6, AppleTalk, etc. are layer-3 protocols, and they don't know or care which layer-2 protocol caries them. Layer-3 addressing is meant to be used across networks. For example, the Google server needs to know where to send return packets. It has no idea if the source host is on ethernet (IEEE 802.3), Wi-Fi (IEEE 802.11), token ring (IEEE 802.5), FDDI (IEEE 802.8), or any other layer-2 protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The returning host, even if on the same LAN, needs to know the source layer-3 address because the application only talks to layer-4, which talks to layer-3, which needs to know what the layer-3 address of the original host is in order to be able to reply.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-14T22:11:41.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41177" PostTypeId="2" ParentId="41146" CreationDate="2017-05-15T03:53:14.847" Score="3" Body="&lt;p&gt;These normal cat6 cables might not work well for ourdoor using. These is direct burial cable which has a tough jacket that can tolerate abrasion underground. If you're in conduit this matter less, but you might choose it anyway. &lt;/p&gt;&#xA;" OwnerUserId="35541" LastActivityDate="2017-05-15T03:53:14.847" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41178" PostTypeId="2" ParentId="41156" CreationDate="2017-05-15T08:10:34.340" Score="0" Body="&lt;p&gt;This could be a routing issue.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you set up the interfaces and configure PPPoE, did you check &quot;Retrieve default gateway from server&quot;? When using the &quot;wan1&quot; port you do not use PPPoE, so you have to set a static default route yourself. Make sure that you don't have two of them (Routing Monitor).&lt;br&gt;&#xA;Check routing by pinging from the FGT console. If that is working, and ping from PCs doesn't, check the PCs' gateway setting.&lt;/p&gt;&#xA;" OwnerUserId="15678" LastActivityDate="2017-05-15T08:10:34.340" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41183" PostTypeId="1" CreationDate="2017-05-15T10:47:09.523" Score="1" ViewCount="527" Body="&lt;p&gt;I've been looking for information regarding LAG/LACP configuration and the impact on QoS (such as packet delay, out of order delivery, etc.).&#xA;I could only find statements such as &quot;LAG/LACP guarantees same 'flow' QoS&quot; - what exactly is flow?&#xA;Which packets are part of the same flow and which packets aren't?&#xA;Is &quot;flow&quot; guaranteed to be transmitted via the same physical link of the LAG?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I consider employing a specific hash method for a specific service?&#xA;For example, would I use src &amp;amp; dst MAC for some services and src &amp;amp; dst IP for others?&lt;/p&gt;&#xA;" OwnerUserId="36766" LastActivityDate="2017-05-15T11:19:04.283" Title="The impact of LAG/LACP hash method and load balancing configuration on QoS" Tags="|ieee-802.1ax|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41184" PostTypeId="2" ParentId="41183" CreationDate="2017-05-15T11:19:04.283" Score="2" Body="&lt;p&gt;Flow is a chain of packets combined by some attribute. For different protocols attributes are different (ports, seq numbers, etc). Load balancing in LAG may differ, but usually per-flow load balancing is being used. When per-flow balancing is used, flow is guaranteed to be transmitted via the same link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand it is possible to balance based on packet (per-packet balancing). It's not usually the case because of issues, such as out-of-order packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should consider using different hash methods based on your traffic profile. If you have big diversity of MAC addresses (e. g. L2 switched domain), use MAC for hash. If you have big diversity of IP addresses (e. g. small L2 domain + routing), use IP for hash.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-05-15T11:19:04.283" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41185" PostTypeId="1" CreationDate="2017-05-15T11:40:41.570" Score="0" ViewCount="271" Body="&lt;p&gt;I have a system that has a network where customers' devices are connected wirelessly and they fetch some data from a Pc connected to the network by a cable. &#xA;I would like to isolate customers from the local area network (LAN) but give them access to that Pc only to get data. Is that possible? Can I do that on a guest network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have no access to the network. I have a system for shopping malls that serves their customers and I want to have access to their database to get some data. I am a beginner in networking. what I am thinking of is connecting additional access point to the existing network and build wireless guest network with access to specific PC on the local network. On that PC, there is a software installed to receive connections from customers then go to database, get data, and send it back to customers&#xA;(&lt;a href=&quot;https://networkengineering.stackexchange.com/users/2142/ron-trunk&quot;&gt;Ron Trunk&lt;/a&gt; I can not comment! Please have a look at the edit)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit2&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am not trying to hack a network. The shopping mall has its own private local network and its owners want to buy my system.&#xA;Here is more information about the system: the user enters the mall with his mobile device then he connects to open wifi network. on this network there is also a PC where a software is installed. The user's smartphone ask that software to give it some data by connecting to it through the network.&#xA;My problem is the software does not have the data, the data stored on the mall's database and to connect to database the PC should be connected to the mall's private network. &#xA;Now I have that pc in the middle between users and database. So I am thinking to connect the PC to the private LAN and connect addition AP to the LAN. On the AP, I will build guest network where users will be isolated from the LAN. Now they are isolated but I want them to access the PC which is connected to the LAN. Is there a way to do that?&#xA;&lt;a href=&quot;https://networkengineering.stackexchange.com/users/8499/ron-maupin&quot;&gt;Ron Maupin♦&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36774" LastEditorUserId="36776" LastEditDate="2017-05-15T14:09:25.407" LastActivityDate="2017-05-15T14:09:25.407" Title="How to isolate devices on WLAN from LAN but give them access to only one device on LAN?" Tags="|routing|" AnswerCount="1" CommentCount="3" ClosedDate="2017-05-15T13:02:14.790" ContentLicense="CC BY-SA 3.0" />
  <row Id="41186" PostTypeId="2" ParentId="41185" CreationDate="2017-05-15T12:58:08.113" Score="1" Body="&lt;p&gt;You can make this using &lt;strong&gt;&lt;em&gt;Access-List&lt;/em&gt;&lt;/strong&gt; or any Firewall feature that makes possible it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I make that on Mikrotik using the FW feature (&lt;strong&gt;Filter Rules&lt;/strong&gt;), for instance.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LAN 1 - 192.168.0.0/24&#xA;LAN 2 - 192.168.10.0/24&#xA;WLAN  - 192.168.100.0/24&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Both LAN 1 and 2 can access any wireless device, like a PRINTER, but any wireless device can establish a communication in LANs. I had to create a exception, just one wireless device (NOTEBOOK) could access my FTP Server. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; 1   ;;; FTP ACCESS&#xA;     chain=forward action=accept src-address=192.168.100.53 &#xA;     dst-address=192.168.0.96 &#xA;&#xA; 2   ;;; DENY TCP WIRELESS COMMUNICATION&#xA;     chain=forward action=drop protocol=tcp src-address=192.168.100.0/24 &#xA;     dst-address=192.168.0.0/24 &#xA;&#xA; 3   ;;; DENY ICMP WIRELESS COMMUNICATION&#xA;     chain=forward action=drop protocol=icmp src-address=192.168.100.0/24 &#xA;     dst-address=192.168.0.0/24 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Like Ron said, depends on kind of equipment you have.&lt;/p&gt;&#xA;" OwnerUserId="14008" LastActivityDate="2017-05-15T12:58:08.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41188" PostTypeId="2" ParentId="41140" CreationDate="2017-05-15T15:28:11.417" Score="2" Body="&lt;p&gt;As the error indicates, link-level flowcontrol (LLFC) is not supported on the Nexus 3000 and 3100 series. It is supported on the Nexus 3500 series and Nexus 9000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an alternative, you could possibly implement PFC instead, cfr. &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/qos/7x/b_3k_QoS_Config_7x/b_3k_QoS_Config_7x_chapter_011.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/qos/7x/b_3k_QoS_Config_7x/b_3k_QoS_Config_7x_chapter_011.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29562" LastActivityDate="2017-05-15T15:28:11.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41190" PostTypeId="1" CreationDate="2017-05-15T17:07:31.273" Score="1" ViewCount="2788" Body="&lt;p&gt;Network:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;ISPs Actiontec router LAN subnetted to /25 -&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;cannot ping into Cisco subnet&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;Cisco RV130 subnetted to /25&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;WAN port to Actiontec LAN port&lt;/li&gt;&#xA;&lt;li&gt;set as Gateway, Router mode would not allow internet response.&lt;/li&gt;&#xA;&lt;li&gt;ping OK out&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I was hoping some combination of DHCP Relay, Router mode and enabling Dynamic Routing(RIP) would allow me communication from the 1st subnet into the second and retain internet access from inside the 2nd subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I do plan on bridging this modem eventually but wanted to see what it is capable of in this capacity for future reference. None of the suggested Similar Questions presented are quite on point and VLANs are not part of the equation yet. That is why I originally got the router to work with a managed switch on my LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The link is to the emulator for the interface with what I am working with, though mine is not wireless:&#xA;&lt;a href=&quot;http://www.cisco.com/assets/sol/sb/RV130W_Emulators/RV130W_Emulator_v1-0-1-3_20140807/default-asp.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/assets/sol/sb/RV130W_Emulators/RV130W_Emulator_v1-0-1-3_20140807/default-asp.htm&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this is direct enough to discuss here.&lt;/p&gt;&#xA;" OwnerUserId="36290" LastActivityDate="2018-02-10T08:17:39.530" Title="Will DHCP Relay work across different subnets?" Tags="|cisco|routing|subnet|dhcp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41191" PostTypeId="2" ParentId="41190" CreationDate="2017-05-15T17:11:46.927" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Will DHCP Relay work across different subnets?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That is the point of DHCP relay.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you may either be using NAT on the Cisco router, or you have not configured a route in the ISP router to let it know that the network exists on the other side of the Cisco router. If either of those situations exist, then you will not be able to get from the ISP router to the network on the other side of the Cisco router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-15T17:11:46.927" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="41193" PostTypeId="1" AcceptedAnswerId="41195" CreationDate="2017-05-15T18:58:01.537" Score="2" ViewCount="4339" Body="&lt;p&gt;As opposed to just sending the complete message in one big packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a sense of what the answer is, but would find a more informed viewpoint helpful.&lt;/p&gt;&#xA;" OwnerUserId="34554" LastEditorUserId="34554" LastEditDate="2017-05-15T19:10:28.570" LastActivityDate="2017-05-15T19:29:36.797" Title="Why break messages up into packets?" Tags="|routing|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41195" PostTypeId="2" ParentId="41193" CreationDate="2017-05-15T19:29:36.797" Score="2" Body="&lt;p&gt;There are a few reasons why network standards limit the maximum size of a packet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly the bigger a packet is the longer it ties up the line for. That means more latency and jitter for other users sharing the line.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Secondly most network devices work with complete packets. The whole packet is received into a buffer before being passed on to the next processing step. These buffers have finite size. A large packet buffered at every step will also take much longer to deliver than a sequence of small packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thirdly with most standards if a packet is corrupted in transit the whole packet must be discarded and re-sent. So larger packets mean more data is re-sent when corruption occours.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-15T19:29:36.797" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41196" PostTypeId="1" CreationDate="2017-05-15T20:26:03.337" Score="1" ViewCount="311" Body="&lt;p&gt;Some folks at my work are thinking about getting rid of our office (HQ) WAN line from ATT, increasing the speed of our Datacenter connection and then running the office WAN(Internet) through an MPLS connection that connects to the Datacenter. Hopefully that makes sense :) &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done a ton of networks setups in my life, but not this. It feels off, for some reason. Do any of you guys have this setup or set one up? And, if so, does it actually work for you guys? Are there any notable downsides? I can make the setup make sense in my head -- especially if we go with a low latency MPLS line and then a 100Mb/w fiber connection in the office -- but I dont know anyone that has done this. Contracts these days are 3yrs so I want to try to get as much info before any decisions. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main question is for people that have experience with using the Internet connection in the datacenter as their internet connection in the office. Do your users notice any more latency when connecting from the internet connection at the DC via MPLS to the office? Do you end users notice any difference between having the internet connection locally at the office or by sharing it through MPLS from the datacenter. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="36784" LastEditorUserId="36784" LastEditDate="2017-05-16T18:05:12.113" LastActivityDate="2017-05-16T18:05:12.113" Title="Running office WAN via MPLS connected Datacenter's WAN connection. Thoughts?" Tags="|internet|mpls|wan|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41199" PostTypeId="2" ParentId="41196" CreationDate="2017-05-16T06:00:17.790" Score="1" Body="&lt;p&gt;This is pretty much what most corporate WANs used to look like, back when reaching the Internet was a gimmick and all the real work happened in the datacenter. My own corporate network is still pretty much set up this way in Europe and the US... but we have a couple thousand branch offices to manage, and moving that to a different architecture takes time and money. So far we have managed to make it work, but continuing to scale it is a challenge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However if I was starting fresh, I definitely wouldn't bother with backhauling web traffic to the datacenter. If you look at the data it's fairly easy to understand why. Traffic from sites on my network increases by about 25 to 30% every year (driven by heavier web apps, video use, etc...), and 75 to 80% of the total traffic to the datacenter is just passing through on its way to the Internet. Given that we use a cloud proxy service, the datacenter doesn't even really provide any security filtering which would have justified going through it in the past.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, we are putting Internet links back into more and more locations, because that's where the traffic is actually going (Google, Salesforce, etc...), and it's fairly trivial to source 50 to 100Mbps of local broadband, whereas getting and more importantly managing multi-gig Internet links into the datacenter gets complex fast, if only because it creates a single point where any hiccup will balloon into a major incident fast.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2017-05-16T06:00:17.790" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41200" PostTypeId="1" AcceptedAnswerId="41201" CreationDate="2017-05-16T06:37:10.157" Score="2" ViewCount="663" Body="&lt;p&gt;&lt;strong&gt;Scenario&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Three Offices with 2 ISPs each - utilizing static routing to the ISP. Each office has a VPN and leased point-to-point circuits connecting the offices in a ring. A VPN is also connecting the offices together as well. All of which are using OSPF, and all of our firewall's connections to the ISP are advertising a default gateway into OSPF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any existing application/script/method to actively and dynamically determine the &quot;best&quot; path to a specific IP address?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;*My theory**&#xA;Build a script based on Internet ping results from something like SmokePing or PRTG to generate which 'provider' would be the best to take.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is somewhat of a thought experiment; not sure anyone would truly see an improvement.&lt;/p&gt;&#xA;" OwnerUserId="34733" LastEditorUserId="8499" LastEditDate="2019-01-05T00:03:43.847" LastActivityDate="2019-01-05T00:03:43.847" Title="Dynamically generate OSPF/BGP routes based on Internet latency" Tags="|routing|bgp|ospf|latency|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41201" PostTypeId="2" ParentId="41200" CreationDate="2017-05-16T06:51:17.977" Score="1" Body="&lt;p&gt;Both OSPF and BGP are dynamic routing protocols.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OSPF, by design, uses the single, simple, arbitrary value called cost to determine the best path to a destination. Cost is usually, by default, based on the bandwidth of a link, but it can be manually configured to any arbitrary value for any link, and it is cumulative.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;BGP has a much richer and more complex set of attributes to determine the best path to a destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither BGP nor OSPF generate routes, and neither takes into account latency. Also, the latency returned by ping is strictly for ICMP, which has nothing to do with OSPF or BGP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have Cisco equipment, you can run EIGRP, which can use bandwidth, delay, reliability, load, and MTU to determine the best path, By default, EIGRP only uses bandwidth and delay, but it can be configured to use any combination of those metrics.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-16T06:51:17.977" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41203" PostTypeId="2" ParentId="40658" CreationDate="2017-05-16T07:54:24.713" Score="1" Body="&lt;p&gt;Configure a Cluster of Fortigate VM Step by Step:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, when you configure a Cluster of two Fortigate VM you have to :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;On VMware, the two routers are linked via vSwitch, make sure that the VMs are linked.&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Enable a promicsious mode on vSwitch to permit HA communication between the HA interfaces, following this steps: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;1.In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane.&#xA;2.In Hardware, select Networking.&#xA;3.Select Properties of a vSwitch used to connect heartbeat interfaces.&#xA;4.In the Properties window left pane, select vSwitch and then select Edit.&#xA;5.Select the Security tab, set Promiscuous Mode to Accept, then select OK.&#xA;6.Select Close.&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;When we creat a virtual machine with one or more virtual network adapter, two MAC address are generated automatically for each virtual adapter. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The first one is called initial MAC address and is stored on   configuration file. This can not be changed.&lt;/li&gt;&#xA;&lt;li&gt;The seconde one is effective MAC address, which is configured by guest operating system and used as the source MAC address during a communication with other system. The effective MAC address, however, can be changed on vSwitch.&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Because FGCP set a virtual MAC address to the same interfaces on Fortigates, you have to: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;Set the vSwitch to accept the MAC address changes: to allow traffic&#xA;to be passed through the vSwitch to virtual marchine if the initial&#xA;and effective address do not match (Incomming traffic)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Set the vSwitch to accept forged transmit: cause when this is on &quot;Accept&quot;, ESXi don't compare the initial MAC address with effective MAC address when sending paquets. So the paquets don't be rejected by the hypervisor (outgoing traffic)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follow this steps to do it :   &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;&lt;pre&gt;&lt;code&gt;1.In the vSphere client, select your VMware server in the left pane and then select the Configuration tab in the right pane.&#xA;      2.In Hardware, select Networking.&#xA;      3.Select Properties of a vSwitch used to connect heartbeat interfaces.&#xA;      4.In the Properties window left pane, select vSwitch and then select Edit.&#xA;      5.Select the Security tab, set MAC address change to &quot;Accept&quot; and Forged transmit to &quot;Accept&quot;.&#xA;      6.Select OK and Close.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When this done, you can start configure the two Fortigates by following this recipe : &lt;a href=&quot;http://cookbook.fortinet.com/high-availability-two-fortigates/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://cookbook.fortinet.com/high-availability-two-fortigates/&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="35263" LastActivityDate="2017-05-16T07:54:24.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41204" PostTypeId="1" AcceptedAnswerId="41205" CreationDate="2017-05-16T08:52:43.243" Score="13" ViewCount="4945" Body="&lt;p&gt;I recently read about CRC, a checksum to detect package corruption and drop corrupted packages.&#xA;But how does a packet in an IP-based network get corrupted in the first place?&lt;/p&gt;&#xA;" OwnerUserId="36791" LastEditorUserId="3050" LastEditDate="2017-05-16T18:04:04.660" LastActivityDate="2017-05-16T18:04:04.660" Title="How does a packet get corrupted in a network?" Tags="|layer1|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41205" PostTypeId="2" ParentId="41204" CreationDate="2017-05-16T09:13:38.297" Score="21" Body="&lt;p&gt;Packets are long streams of binary numbers (&lt;code&gt;zeros&lt;/code&gt; and &lt;code&gt;ones&lt;/code&gt;).&lt;/p&gt;&#xA;&lt;p&gt;The &lt;code&gt;zeros&lt;/code&gt; and &lt;code&gt;ones&lt;/code&gt; are usually changes of an electric signal, specifically voltage changes.&lt;/p&gt;&#xA;&lt;p&gt;To simplify, suppose that &lt;code&gt;0&lt;/code&gt; is &lt;em&gt;0 volts&lt;/em&gt;  and &lt;code&gt;1&lt;/code&gt; is  represented  alternatively as &lt;em&gt;5 volts&lt;/em&gt; and &lt;em&gt;-5 volts&lt;/em&gt;.&lt;/p&gt;&#xA;&lt;p&gt;Then a long string of zeros and ones will look like this in terms of voltage variations in the cable:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/WQwIK.jpg&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/WQwIK.jpg&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;As you can see, the first &lt;code&gt;1&lt;/code&gt; is 5 volts, but the next &lt;code&gt;1&lt;/code&gt;is -5 volts. This is neccesary to avoid that a long string of &lt;code&gt;1&lt;/code&gt;s energizes the communication line.&lt;/p&gt;&#xA;&lt;p&gt;If the cable is exposed to electromagnetic interference, then the voltage levels can be altered. If a -5 volts value becomes -2 volts then the receiver can't identify it precisely as a &lt;code&gt;zero&lt;/code&gt; or a &lt;code&gt;one&lt;/code&gt;.&lt;/p&gt;&#xA;&lt;p&gt;If your data cable runs for a long stretch parallel to power cables, then the power cable can cause interference to the data cable and induce errors.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-05-16T12:51:34.253" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41206" PostTypeId="1" AcceptedAnswerId="41207" CreationDate="2017-05-16T09:24:47.660" Score="1" ViewCount="344" Body="&lt;p&gt;The configuration I want to achieve is for learning reasons, in Cisco packet tracer, not a real-life scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have one router and two switches connected to them. Each switch has multiple computers connected to them, some of which are in one VLAN, some are in another VLAN. If I understand correctly, computers in the same VLAN should also be in the same subnetwork, but this is unachievable, because trying this configuration results in an error (on the router):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface g0/0.5  &#xA; encapsulation dot1q 5  &#xA; ip address [ip of vlan 5] 255.255.255.0  &#xA;interface g0/0.10  &#xA; encapsulation dot1q 10  &#xA; ip address [ip of vlan 10] 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then I did this for &lt;code&gt;g0/1&lt;/code&gt; interface, too, which resulted in an error. Is what I'm trying to do possible at all? If yes, what did I do wrong and how do I fix it (besides putting the computers of VLAN 5 under switch 1 and putting the computers of VLAN 10 under switch two)?&lt;/p&gt;&#xA;" OwnerUserId="36792" LastEditorUserId="8499" LastEditDate="2017-05-16T18:38:21.240" LastActivityDate="2017-05-16T18:38:21.240" Title="How do I use the same subnetwork on multiple interfaces if the computers on the VLAN are distributed among them?" Tags="|cisco|vlan|packet-tracer|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41207" PostTypeId="2" ParentId="41206" CreationDate="2017-05-16T09:32:11.787" Score="2" Body="&lt;p&gt;Routers route between networks, so each router interface, physical or virtual, must be in a different network. If you are connecting each switch to a different router interface, then you can use the same VLAN numbers, but they are not the same VLANs, and they cannot use the same networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;VLANs are layer-2 broadcast domains, and they are bounded by a layer-3 device, e.g. router. Your VLANs cannot extend across a router. To have the same VLANs on both switches requires that the switches be connected together, and that you trunk between the switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How, for instance, would the router decide which of multiple interface with the same network to send a packet destined for that network? A router's routing table tells it which interface to use for traffic destined to a particular network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-16T09:32:11.787" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41208" PostTypeId="2" ParentId="40438" CreationDate="2017-05-16T09:57:41.220" Score="0" Body="&lt;p&gt;I guess your question is about the difference between routing and switching.&#xA;It applies on networks with inter connexion devices and the two mechanisms try to answer the question each inter connexion device ask himself : where should i transfer the information i just received.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP is a solution based on routing. Information are grouped in packet. Each packet has a destination address and the routers (inter connexion devices in IP) treat each packet independently using the address to determine where the packet should go. It is supposed to be robust to network changes and have a better used of bandwidth resources&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MPLS (or ATM) are solutions based on switching, using Virtual Circuit Identifiers (or labels in MPLS). The idea here is that you have to establish a communication path (usually using a control protocol) before any communication. After that, all the information from the sender to the destination is going to take the same path (the Virtual Circuit). Switching is supposed to be faster by lowering the need for computation in the inter connexion devices.&lt;/p&gt;&#xA;" OwnerUserId="23460" LastActivityDate="2017-05-16T09:57:41.220" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41210" PostTypeId="2" ParentId="41175" CreationDate="2017-05-16T10:11:39.317" Score="1" Body="&lt;p&gt;In theory, you wouldn't need to have a network (Layer 3) protocol to communicate only inside a physical network layer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But the most standard network stack uses IP (Layer 3) and the protocol above it (TCP/UDP and more) to abstract the network for general applications, so that each application doesn't have to know what kind of network or inter-network infrastructure is used to communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some very specific applications, with the hard restriction that they will only communicate with hosts on the same physical network uses only Ethernet (or another layer 2 protocol). ARP for example.&lt;/p&gt;&#xA;" OwnerUserId="23460" LastActivityDate="2017-05-16T10:11:39.317" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41212" PostTypeId="2" ParentId="41200" CreationDate="2017-05-16T12:27:09.293" Score="3" Body="&lt;p&gt;Cisco routers have a feature called &lt;a href=&quot;http://www.cisco.com/c/en/us/products/ios-nx-os-software/performance-routing-pfr/index.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Performance-based routing (PfR)&lt;/a&gt; that does exactly what you're looking for.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-16T12:27:09.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41213" PostTypeId="2" ParentId="41196" CreationDate="2017-05-16T12:48:37.853" Score="2" Body="&lt;p&gt;There really isn't a &quot;right or wrong&quot; answer on how to do it.  You have to weigh the pros and cons and decide for yourself.  Usually a centralized model would be used where all of your security hardware is in the DC, so you backhaul a remote location which doesn't have a firewall or web proxy back through the equipment in the DC.  This requires bigger hardware at the DC to accomidate all the remote locations as well as higher bandwidth MPLS circuits.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or the distributed model where you offload the internet locally would require firewalls at every location to secure this traffic, but then you may also be able to use some smaller hardware at the DC since it doesn't have to worry about that traffic.  You could also use lower bandwidth MPLS circuits based on the traffic patterns.&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2017-05-16T12:48:37.853" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41214" PostTypeId="1" AcceptedAnswerId="41220" CreationDate="2017-05-16T13:01:42.700" Score="1" ViewCount="5646" Body="&lt;p&gt;I have this scenario where the laptop must be able to ping every interface and vice versa and I am not able to understand how to make the Laptop ping the router and other interfaces ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The PCs can ping the printer and other interfaces except the laptop, only the laptop cannot ping any interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have added the Wireless routers internet address as the VLANs management 1st IP address from switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Spent quite some hours but still not able to figure out why, when I use the simulation mode to ping PCs to wireless router the packets fail at the Inter-VLAN router and from Laptop the packets return back to wireless Laptop without going further to the wired router and without any error, I have gone through each interface and the IPs still not able to figure out whats wrong.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Packet Tracer file: &lt;a href=&quot;http://www114.zippyshare.com/v/zF9FR3FV/file.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www114.zippyshare.com/v/zF9FR3FV/file.html&lt;/a&gt; ALL DEVICE PASSWORDS ARE &quot;cisco&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/sd2mF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/sd2mF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You&lt;/p&gt;&#xA;" OwnerUserId="36798" LastEditorUserId="36798" LastEditDate="2017-05-16T13:08:10.900" LastActivityDate="2017-05-27T13:36:02.303" Title="Laptop in a WLAN not pinging to any wired interface and vice versa" Tags="|packet-tracer|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41220" PostTypeId="2" ParentId="41214" CreationDate="2017-05-16T16:03:11.857" Score="1" Body="&lt;p&gt;Packet tracer does NOT allow for Wireless routers to respond to ICMP (ping) packets, I tested this by adding a wired device to the wireless router and pinging all interfaces and it pings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is setting in Access Restriction in GUI tab in wireless routers which HAS to be accessed through the connected wireless PC via web browser (192.68.0.1), just enabling it will allow for the wireless PC to ping all other interfaces but NO setting for wireless router to respond to incoming ping packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This issue is resolved.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You everyone.&lt;/p&gt;&#xA;" OwnerUserId="36798" LastActivityDate="2017-05-16T16:03:11.857" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41224" PostTypeId="2" ParentId="41152" CreationDate="2017-05-16T17:00:16.910" Score="0" Body="&lt;p&gt;In XR (not sure about XE) you can do 'apply' in the middle of a route-policy.  So you would do like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-policy test&#xA;apply generic-policy&#xA;if something then something else&#xA;end route-policy&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And this would run 'generic-policy' in the middle of the 'test' route-policy.  However, it looks like XE uses route-maps and not route-policies, so unfortunately that capability isn't available to you.  route-maps in XE appear to be discrete objects and you can't chain them in that way.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2017-05-16T17:00:16.910" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41225" PostTypeId="2" ParentId="20473" CreationDate="2017-05-16T17:01:17.710" Score="1" Body="&lt;p&gt;If you turn on inbound soft-reconfiguration on the neighbor in question, then you will see another entry in the list with the pre-policy communities on it.&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2017-05-16T17:01:17.710" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41226" PostTypeId="2" ParentId="28481" CreationDate="2017-05-16T17:04:16.007" Score="2" Body="&lt;p&gt;So, the longer answer to your question is that you're &quot;not supposed&quot; to do it that way.  You should have all that overhead configuration in your network monitoring system.  Routers are not very good databases.  For example, if you upgrade your transit connection data rate you might change the CID.  Does that mean you need to change the description on the BGP peer?&lt;/p&gt;&#xA;" OwnerUserId="178" LastActivityDate="2017-05-16T17:04:16.007" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41231" PostTypeId="1" AcceptedAnswerId="41590" CreationDate="2017-05-16T21:23:55.243" Score="3" ViewCount="9398" Body="&lt;p&gt;I have an IPSec site-to-site VPN setup between two SRX300 devices.  I am trying to get &lt;strong&gt;multicast&lt;/strong&gt; to travel across.  I am looking for the simplest configuration possible to get this setup. I have found many articles, but most are far more complicated use cases than I have. I do not have NAT (at least not yet). I was hoping to just enable IGMP and everything would work, but it doesn't seem to be that easy.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;multicast-source---LAN---SRX@remote1          SRX@hub1---LAN---multicast-receiver&#xA;192.168.1.100/24      192.168.1.1/24        192.168.2.1/24    192.168.2.100/24&#xA;                           10.50.1.1/8--WAN--10.50.1.2/8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(Ignore the fact that I'm using a private 10 network on the WAN right now)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SRX Configuration on the hub&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;security {&#xA;    ike {&#xA;        policy ike-phase1-policy {&#xA;            mode aggressive;&#xA;            proposal-set compatible;&#xA;            pre-shared-key ascii-text &quot;$9$VVs4J5TF39t&quot;;&#xA;        }&#xA;        gateway gw-remote1 {&#xA;            ike-policy ike-phase1-policy;&#xA;            address 10.50.1.1;&#xA;            external-interface ge-0/0/5.0;&#xA;        }&#xA;    }&#xA;    ipsec {&#xA;        policy ipsec-phase2-policy {&#xA;            proposal-set compatible;&#xA;        }&#xA;        vpn ike-vpn-remote1 {&#xA;            bind-interface st0.0;&#xA;            ike {&#xA;                gateway gw-remote1;&#xA;                ipsec-policy ipsec-phase2-policy;&#xA;            }&#xA;            establish-tunnels immediately;&#xA;        }&#xA;    }&#xA;...&#xA;    zones {&#xA;        security-zone trust {&#xA;            address-book {&#xA;                address hub1 192.168.2.0/24;&#xA;            }&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                ge-0/0/1.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            all;&#xA;                        }&#xA;                        protocols {&#xA;                            all;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;        security-zone untrust {&#xA;            address-book {&#xA;                address remote1 192.168.1.0/24;&#xA;            }&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    ike;&#xA;                }&#xA;                protocols {&#xA;                    pim;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                ge-0/0/5.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            ping;&#xA;                        }&#xA;                    }&#xA;                }&#xA;                st0.0 {&#xA;                    host-inbound-traffic {&#xA;                        protocols {&#xA;                            pim;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 192.168.2.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/5 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.50.1.2/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    lo0 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.255.0.156/32;&#xA;            }&#xA;        }&#xA;    }&#xA;    st0 {&#xA;        unit 0 {&#xA;            family inet;&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    traceoptions {&#xA;        file all-packets-trace;&#xA;        flag all;&#xA;    }&#xA;    static {&#xA;        route 192.168.1.0/24 next-hop st0.0;&#xA;        route 0.0.0.0/0 next-hop 10.50.1.1;&#xA;    }&#xA;}&#xA;protocols {&#xA;    ospf {&#xA;        area 0.0.0.0 {&#xA;            interface st0.0;&#xA;            interface ge-0/0/5.0 {&#xA;                passive;&#xA;            }&#xA;            interface lo0.0;&#xA;        }&#xA;    }&#xA;    pim {&#xA;        rp {&#xA;            local {&#xA;                address 10.255.0.156;&#xA;            }&#xA;        }&#xA;        interface st0.0;&#xA;        interface ge-0/0/5.0;&#xA;        interface lo0.0 {&#xA;            family inet;&#xA;        }&#xA;    }&#xA;}&#xA;```&#xA;&#xA;SRX Configuration on remote1 (basically a mirror of above):&#xA;```&#xA;security {&#xA;    ike {&#xA;        policy ike-phase1-policy {&#xA;            mode aggressive;&#xA;            proposal-set compatible;&#xA;            pre-shared-key ascii-text &quot;$9$m5F6Ehyrv8&quot;;&#xA;        }&#xA;        gateway gw-hub1 {&#xA;            ike-policy ike-phase1-policy;&#xA;            address 10.50.1.2;&#xA;            external-interface ge-0/0/5.0;&#xA;        }&#xA;    }&#xA;    ipsec {&#xA;        policy ipsec-phase2-policy {&#xA;            proposal-set compatible;&#xA;        }&#xA;        vpn vpn-hub1 {&#xA;            bind-interface st0.0;&#xA;            ike {&#xA;                gateway gw-hub1;&#xA;                ipsec-policy ipsec-phase2-policy;&#xA;            }&#xA;            establish-tunnels immediately;&#xA;        }&#xA;    }&#xA;...&#xA;    zones {&#xA;        security-zone trust {&#xA;            address-book {&#xA;                address remote1 192.168.1.0/24;&#xA;            }&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    all;&#xA;                }&#xA;                protocols {&#xA;                    all;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                ge-0/0/1.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            all;&#xA;                        }&#xA;                        protocols {&#xA;                            all;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;        security-zone untrust {&#xA;            address-book {&#xA;                address hub1 192.168.2.0/24;&#xA;            }&#xA;            host-inbound-traffic {&#xA;                system-services {&#xA;                    ike;&#xA;                }&#xA;                protocols {&#xA;                    pim;&#xA;                }&#xA;            }&#xA;            interfaces {&#xA;                ge-0/0/5.0 {&#xA;                    host-inbound-traffic {&#xA;                        system-services {&#xA;                            all;&#xA;                        }&#xA;                        protocols {&#xA;                            all;&#xA;                        }&#xA;                    }&#xA;                }&#xA;                st0.0 {&#xA;                    host-inbound-traffic {&#xA;                        protocols {&#xA;                            pim;&#xA;                        }&#xA;                    }&#xA;                }&#xA;            }&#xA;        }&#xA;    }&#xA;}&#xA;interfaces {&#xA;    ge-0/0/1 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 192.168.1.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    ge-0/0/5 {&#xA;        unit 0 {&#xA;            family inet {&#xA;                address 10.50.1.1/24;&#xA;            }&#xA;        }&#xA;    }&#xA;    st0 {&#xA;        unit 0 {&#xA;            family inet;&#xA;        }&#xA;    }&#xA;}&#xA;routing-options {&#xA;    traceoptions {&#xA;        file all-packets-trace;&#xA;        flag all;&#xA;    }&#xA;    static {&#xA;        route 192.168.2.0/24 next-hop st0.0;&#xA;        route 0.0.0.0/0 next-hop 10.50.1.2;&#xA;    }&#xA;}&#xA;protocols {&#xA;    ospf {&#xA;        area 0.0.0.0 {&#xA;            interface st0.0;&#xA;            interface ge-0/0/1.0 {&#xA;                passive;&#xA;            }&#xA;            interface lo0.0;&#xA;        }&#xA;    }&#xA;    pim {&#xA;        rp {&#xA;            static {&#xA;                address 10.255.0.156;&#xA;            }&#xA;        }&#xA;        interface ge-0/0/5.0;&#xA;        interface lo0.0;&#xA;        interface st0.0;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36820" LastEditorUserId="8499" LastEditDate="2017-05-17T18:54:01.240" LastActivityDate="2017-05-30T19:18:57.270" Title="How do I forward multicast packets over IPSec VPN Tunnel on Juniper SRX?" Tags="|juniper|multicast|juniper-srx|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41232" PostTypeId="2" ParentId="41231" CreationDate="2017-05-16T21:31:22.137" Score="0" Body="&lt;p&gt;Multicast routing is very different from unicast routing. Multicast, like broadcast, is normally limited to a single LAN, and that is where IGMP works. You are trying to multicast to a different network, and that requires multicast routing, e.g. PIM, to be enabled and configured. Also, your VPN tunnel must allow broadcast (multicast), and not all do.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a diagram about the different multicast protocols:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bqXky.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bqXky.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IGMP is a protocol between the host and the multicast router. PIM works between routers to route multicast packets.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-16T21:31:22.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41234" PostTypeId="1" AcceptedAnswerId="41235" CreationDate="2017-05-17T02:14:29.457" Score="1" ViewCount="422" Body="&lt;p&gt;I'd like to upgrade a stack of Cisco 2960s switches with a new configuration, and I would like to know what is required to copy a pre-populated config.text file from an FTP server to the switch stack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anything special needed to accommodate a stack of 2960s?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the syntax correct:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# copy ftp://server/config.text system:running-config&#xA;# reload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="19081" LastEditorUserId="8499" LastEditDate="2018-03-09T21:47:06.060" LastActivityDate="2018-03-09T21:47:06.060" Title="Updating config on 2960s Stack by copying from FTP" Tags="|cisco|switch|cisco-catalyst|stacking|cisco-2960|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41235" PostTypeId="2" ParentId="41234" CreationDate="2017-05-17T02:24:55.563" Score="4" Body="&lt;p&gt;If you are reloading, you want to replace the startup configuration, not the running configuration. Otherwise, the device will start up with the old startup configuration, which is stored on &lt;code&gt;nvram:&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Replacing the running configuration is always problematic, anyway. You end up merging what you have in the file with the currently running configuration, not completely replacing it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# copy ftp://server/config.text nvram:startup-config&#xA;# reload&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-17T02:24:55.563" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41236" PostTypeId="1" AcceptedAnswerId="48443" CreationDate="2017-05-17T03:19:12.057" Score="2" ViewCount="145" Body="&lt;p&gt;First, a little bit of background information:  I'm working on some custom software that allows a group of computers on the same LAN to co-operate on a real-time task in a distributed, fault-tolerant manner.  In particular, each of the computers sends out a multicast (IPv6/UDP) &quot;heartbeat&quot; packet several times a second, which the others receive, and based on their knowledge of who else is on-line at the time, they self-organize to divvy up a task amongst themselves.  If any peers go offline, their parts of the task are automatically re-assigned to the remaining computers.  In addition, a peer will sometimes use multicast to communicate a one-to-many data-update to the group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all works nicely on a wired Ethernet network; but at some point I'd like to make it able to work well on a wireless network too, e.g. to allow for a self-organizing swarm of drones and other fun experiments like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem is that Wi-Fi is &lt;a href=&quot;https://superuser.com/questions/695813/wifi-udp-unicast-vs-multicast-speed&quot;&gt;notoriously bad at multicast&lt;/a&gt; -- in particular, multicast packets are usually transmitted at the AP's slowest and least efficient rate, and they are often delayed or dropped.  That means that unless I dial my software's tolerances way back, running it over a Wi-Fi network means I occasionally get &quot;false positives&quot; where the system thinks a particular computer has gone away but actually it's just that the Wi-Fi network isn't delivering its heartbeats in a timely manner.  The lack of timeliness also makes it difficult to co-ordinate behaviors precisely in time, since without a near-constant speed network, synchronizing clocks is difficult.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, is Wi-Fi simply not the right tool for this application?  If it's not, is there some other wireless networking technology that I should be looking into using instead?  (it seems that, in principle at least, radio ought to lend itself to efficient multicast/broadcast, since it's inherently a shared medium)  Or if Wi-Fi really is the only game in town for wireless networking, how should I go about tweaking the Wi-Fi settings (on the AP and/or the clients) to get the best multicast performance possible?&lt;/p&gt;&#xA;" OwnerUserId="36826" LastEditorUserId="36826" LastEditDate="2017-05-17T03:53:24.450" LastActivityDate="2018-02-19T16:16:29.243" Title="How to design a wireless network for efficient multicast or broadcast communications?" Tags="|wireless|ieee-802.11|multicast|performance|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41237" PostTypeId="2" ParentId="41236" CreationDate="2017-05-17T03:32:46.407" Score="2" Body="&lt;p&gt;The effective bandwidth and reliability of wireless networks (Wi-fi or any other) is highly dependent on the RF environment.  In order to have some predictable performance, each installation needs to be tuned for the particular environment.  That means a site survey to determine proper AP numbers and placement, antenna configuration, as well as configuring the APs for transmitter power, channel frequency, and data rates.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you need some minimum performance from your wireless networks. The only way to guarantee that is to tune each installation individually.   Some places may be just too noisy (RF) to work at all.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-17T03:32:46.407" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41239" PostTypeId="1" AcceptedAnswerId="41253" CreationDate="2017-05-17T08:10:01.603" Score="0" ViewCount="6408" Body="&lt;p&gt;I know that MAC address has to be unique. It has 6 elements - &lt;strong&gt;k&lt;/strong&gt;. And it chooses from 36 chars (A-Z,0-9) - &lt;strong&gt;n&lt;/strong&gt;. It means that there are &lt;strong&gt;n&lt;sup&gt;k&lt;/sup&gt;&lt;/strong&gt; combinations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;36&lt;sup&gt;6&lt;/sup&gt;= 2176782336&lt;/strong&gt;&#xA;If there are 7.5 billions of people, it's about &lt;strong&gt;0.29 devices per person&lt;/strong&gt; per life. It seems like incredibly low number.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I right or not?&#xA;What and where am I doing mistake?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Mistake found it's not 6 elements but 12 (36&lt;sup&gt;12&lt;/sup&gt; isn't still correct)&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user36832" LastEditorUserId="509" LastEditDate="2017-05-17T08:46:57.180" LastActivityDate="2017-05-17T14:31:57.720" Title="Count of MAC addresses misunderstanding" Tags="|mac-address|network|mac|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41240" PostTypeId="2" ParentId="41239" CreationDate="2017-05-17T08:19:03.850" Score="2" Body="&lt;p&gt;MAC address consists of 48 bits. It is 2**48 or 281 474 976 710 656 addresses, which is more than enough at the moment. Plus there is practice to reuse MAC addresses of obsoleted equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC address is usually represented in hex, which is &lt;strong&gt;n&lt;/strong&gt; in your formula. But one &quot;element&quot; has 00 to FF - which is 256 - combinations. So 256**6 should be used for calculation.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastEditorUserId="29564" LastEditDate="2017-05-17T14:31:57.720" LastActivityDate="2017-05-17T14:31:57.720" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41241" PostTypeId="2" ParentId="41239" CreationDate="2017-05-17T08:28:18.687" Score="2" Body="&lt;p&gt;There are 2^48 addresses. It means 281474976710656 unique combinations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To make it clearer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC Addresses are 6 bytes, for example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;00:50:56:29:33:d2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each byte goes from (in hex) &lt;code&gt;00&lt;/code&gt; to &lt;code&gt;ff&lt;/code&gt; or in binary &lt;code&gt;0000000&lt;/code&gt; to &lt;code&gt;11111111&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;6 bytes * 8 bits per byte = 48 bits&lt;/p&gt;&#xA;&#xA;&lt;p&gt;total combinations of 48 bits = 2^48 = 281474976710656&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MAC addresses can be re-used. Manufacturers usually send cards with duplicate addresses to different parts of the world, so there's no chance of two network cards with the same MAC address on the same network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MAC addresses must be unique on a &lt;strong&gt;local&lt;/strong&gt; network, but there's not a problem for having duplicate MAC addresses if they are separated by one or more routers since the devices won't see each other directly.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2017-05-17T08:38:37.380" LastActivityDate="2017-05-17T08:38:37.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41243" PostTypeId="1" AcceptedAnswerId="41244" CreationDate="2017-05-17T10:09:51.213" Score="1" ViewCount="540" Body="&lt;p&gt;Our institution has a public IP address and now we want to create a private network using a switch which can connect to the Internet through this IP address. What class network should we use, and what would be the default gateway and DNS?&lt;/p&gt;&#xA;" OwnerUserId="36840" LastEditorUserId="8499" LastEditDate="2019-01-02T22:06:15.937" LastActivityDate="2019-01-02T22:06:15.937" Title="Configuring a switch to connect to public IP address to create a private network" Tags="|ip|ipv4|nat|subnet|ip-address|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41244" PostTypeId="2" ParentId="41243" CreationDate="2017-05-17T10:37:24.770" Score="3" Body="&lt;p&gt;You can use any of the addressing defined by RFC 1918:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;10.0.0.0/8&#xA;172.16.0.0/12&#xA;192.168.0.0/16&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;for your private network. As far as the size of your private network, you can use whatever size fits your needs, and you can use multiple networks if necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using a switch will not work unless it is a layer-3 switch that can do NAT. Most switches cannot NAT, and you will probably need a router to NAT your private addressing to the public Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use any usable host address in the network for your gateway address; it is simply the network address you assign to the gateway (the host, usually a router, that knows how to forward packets destined to a different network).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your DNS is is handled by your DNS server. Some routers can have a built-in DNS server, you can have a stand-alone DNS server, or you can use one or more of the DNS servers available on the public Internet (recommendations are off-topic here).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-17T10:37:24.770" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41245" PostTypeId="2" ParentId="40155" CreationDate="2017-05-17T10:42:49.743" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Sure, there is a 2-byte checksum followed by a magic byte, but that is hardly collision-proof.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Occurrences of the magic byte are escaped.  There are two types of escaping used, called &quot;character stuffing&quot; and &quot;bit stuffing&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://technet.microsoft.com/en-us/library/cc957975.aspx&quot; rel=&quot;noreferrer&quot;&gt;https://technet.microsoft.com/en-us/library/cc957975.aspx&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="1664" LastActivityDate="2017-05-17T10:42:49.743" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41246" PostTypeId="1" CreationDate="2017-05-17T10:48:57.743" Score="1" ViewCount="562" Body="&lt;p&gt;In serial wan connection we use PPP or HDLC line protocols,but where would we use PPPOE?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is Ethernet in this term 'PPPOE'?&lt;/p&gt;&#xA;" OwnerUserId="36791" LastEditorUserId="34855" LastEditDate="2017-05-18T14:30:33.600" LastActivityDate="2017-05-18T14:30:33.600" Title="What is PPPOE line protocol?" Tags="|isp|pppoe|ppp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41248" PostTypeId="2" ParentId="41246" CreationDate="2017-05-17T10:53:45.350" Score="3" Body="&lt;p&gt;PPPoE (Point-to-Point Protocol over Ethernet) is a specification for connecting multiple computer users on an Ethernet local area network to a remote site through common customer premises equipment, which is the telephone company's term for a modem and similar devices. PPPoE can be used to have an office or building-full of users share a common Digital Subscriber Line (DSL), cable modem, or wireless connection to the Internet. PPPoE combines the Point-to-Point Protocol (PPP), commonly used in dialup connections, with the Ethernet protocol, which supports multiple users in a local area network. The PPP protocol information is encapsulated within an Ethernet frame.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source:&#xA;&lt;a href=&quot;http://searchnetworking.techtarget.com/definition/PPPoE&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://searchnetworking.techtarget.com/definition/PPPoE&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastActivityDate="2017-05-17T10:53:45.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41249" PostTypeId="2" ParentId="41246" CreationDate="2017-05-17T10:54:56.267" Score="1" Body="&lt;p&gt;PPPoE stands for Point-to-point protocol over Ethernet. It is protocol designed to transmit PPP frames over Ethernet network with additional Ethernet header. This protocol is used for obtaining PPP software properties (e. g. call to some station and thereby establish stateful connection) over Ethernet infrastructure.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-05-17T10:54:56.267" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41252" PostTypeId="1" AcceptedAnswerId="41485" CreationDate="2017-05-17T13:16:37.540" Score="1" ViewCount="120" Body="&lt;p&gt;Forgive me for asking this question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to see how SDN paradigm can be applied to highly dynamic networks, i.e., vehicular networks. If we consider vehicles as edges in a network, (i.e., the edge is moving itself), then how can we report a vehicular geographical position back to a localized SDN controller or a centralized SDN controller?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if we store the vehicle's geographical location in a flowtable, wouldn't it add to a significant SDN Management Overhead? Also, what would happen if one of the localized SDN controllers fails and the centralized SDN controller would loose the globalized view of the network ... is there any alternate arrangement where the disconnected networks relies temporarily? &lt;/p&gt;&#xA;" OwnerUserId="36847" LastActivityDate="2017-10-23T02:07:38.523" Title="SDN for Highly Dynamic Moving Networks" Tags="|sdn|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41253" PostTypeId="2" ParentId="41239" CreationDate="2017-05-17T13:21:38.483" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I know that MAC address has to be unique.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Strictly speaking it only has to be unique on the local network. The way this was supposed to be ensured was by making the default MAC address of devices globally unique. This was acheived through splitting the address into a vendor part and then a part that could be assigned by the vendor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice some vendors are sloppier about this than others. Most VM software and at least one hardware vendor assign addresses randomly from within a vendor ID (which may or may not actually belong to the vendor in question) and just work on the assumption that the number of devices on a network will be small enough that MAC collisions are unlikely.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;It has 6 elements - k. And it chooses from 36 chars (A-Z,0-9) - n. It means that there are nk combinations.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Wrong&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A MAC address is a 48 bit binary number, conventionally written as six hexadecimal numbers each with two digits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So that gives 2^48 addresses, however not all of them are usable for a few reasons.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Two bits are special, one indicates whether an address is &quot;local&quot; or &quot;global&quot;, the other indicates whether it is unicast or multicast.&lt;/li&gt;&#xA;&lt;li&gt;MAC addresses were traditionally allocated to a vendor in blocks of 2&lt;sup&gt;24&lt;/sup&gt;. Most vendors will never use that many leading to lots of wasted addresses. Smaller blocks are now available but only in a very limited range of sizes, so there is still a lot of wastage.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;The IEEE has some concerns about the possibility of MAC address exhaustion, mainly driven by applications that assign large numbers of MAC adddresses to the same device. New applications that don't need backwards compatibility are strongly advised to use EUI-64 instead.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-17T13:21:38.483" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41255" PostTypeId="2" ParentId="41231" CreationDate="2017-05-17T19:11:22.653" Score="1" Body="&lt;p&gt;As far as i know you cannot run multicast over IPSec. What you need to do is have GRE over IPSec and then put multicast through the GRE. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So essentially you are encapsulating the multicast traffic in GRE tunnels, which are then encapsulated by IPSec. &lt;/p&gt;&#xA;" OwnerUserId="36373" LastActivityDate="2017-05-17T19:11:22.653" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41260" PostTypeId="1" AcceptedAnswerId="41262" CreationDate="2017-05-18T05:03:57.210" Score="4" ViewCount="5607" Body="&lt;p&gt;I have 500 feet of what is described as Cat6 Solid STP Copper Bulk Cable (White)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are the full specs&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;CAT6 STP  8-Conductor, Bulk, PVC Jacket, (FTP) Shiedled AWG23,&#xA;Solid-Bare Copper,(UL/ETL) &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;High-Performance Data Communications Cable for noisy Environment&lt;br&gt;&#xA;Suitable for 550MHz High-Speed Data Applications, Gigabit Ethernet,&#xA;Fast Ethernet and 155Mbps TP-PMD/CDDI &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Designed for Indoor Installations (CMR) Riser &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Category-6 Shielded Twisted Pair (STP) Cable &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;4-Pair – Easily Identified Color-Striped Pairs &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;23 AWG Solid Bare Copper Conductors &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Excellent Attenuation and Crosstalk Characteristics &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Exceeds EIA/TIA 568 B.2-1 &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;UL/cUL or ETL Listed &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Sequential Length Markings on Jacket&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Fantastic&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I bought 23 AWG CAT6 plugs with the sled and tray and it just seems as though there is physically not enough room for all the wires to fit. I've been at it for a couple hours and I have not crimped a single cable successfully.I can't get them in to fit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done this with CAT5 and 5E countless times. I've never had this issue before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this a thing known to happen? I know product recommendations are not allowed but is there a spec of plug I should be looking for.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For reference, here is a &lt;a href=&quot;http://cables4sure.com/cat6-solid-stp-bulk-cables/500ft-cat6-solid-stp-copper-bulk-cable-white.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; to the cable I purchased:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PS: If this doesn't belong here, downvote to oblivion.&#xA;I'll delete it.&lt;/p&gt;&#xA;" OwnerUserId="36863" LastEditorUserId="8499" LastEditDate="2017-05-18T05:09:48.033" LastActivityDate="2018-07-10T05:07:17.157" Title="CAT6 cable AWG23 seems too thick for plugs" Tags="|ethernet|cabling|cable|layer1|" AnswerCount="1" CommentCount="0" ClosedDate="2018-07-19T01:14:38.490" ContentLicense="CC BY-SA 3.0" />
  <row Id="41262" PostTypeId="2" ParentId="41260" CreationDate="2017-05-18T05:23:44.207" Score="3" Body="&lt;p&gt;First, Category-6 cable is &lt;em&gt;not&lt;/em&gt; shielded cable, it is specifically UTP (&lt;em&gt;Unshielded&lt;/em&gt; Twisted-Pair) cable. All cable categories are defined by ANSI/TIA/EIA, and they are all for UTP. The ISO/IEC defines cable classes (not categories), some of which are for shielded cable, but you must have the corresponding shielded connectors, and you must have an electrically continuous shield from device to device that is grounded, at least, on both ends, otherwise the shielded cable will perform worse than UTP, and it is probably unsuitable for use. Shielding that isn't properly grounded actually exacerbates the problems it is meant to correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, solid-core cable is used for horizontal cable (the cable in the walls) because it is fragile, and it should not be moved very often, if at all. In fact, your description claims it is riser cable, not suitable for connecting with crimped plugs. The UTP plugs for patch cords are designed for stranded cable, and the punch down terminations for solid-core cable are on the wall plates and patch panels.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your patch cords (what you crimp), you use stranded cable because it is less fragile, although it offers less performance, but the cabling specifications allow you up to 90 meters of solid-core, horizontal cable, and a combined 10 meters of stranded cable (five meters on each end).&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I do not mean any disrespect, but because you don't know these things, you really are not qualified to install Category-6 cable. Even experienced cable installers can have trouble getting a Category-6 installation to pass the required Category-6 test suite, and I doubt you have the proper (read very expensive) tester or experience to certify a Category-6 installation.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-18T05:23:44.207" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41263" PostTypeId="1" AcceptedAnswerId="41267" CreationDate="2017-05-18T06:46:11.033" Score="1" ViewCount="422" Body="&lt;p&gt;I have been reading the below link,  and got few question. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.omnisecu.com/cisco-certified-network-associate-ccna/static-nat-dynamic-nat-and-pat.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.omnisecu.com/cisco-certified-network-associate-ccna/static-nat-dynamic-nat-and-pat.php&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I understand?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Static Nat -&gt; Just a one to one mapping between public and private IP. Only One Private IP. So,&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   X.X.X.123:100 -&amp;gt; Y.Y.Y.Y:123&#xA;   X.X.X.124:100 -&amp;gt; Y.Y.Y.Y:123&#xA;   X.X.X.125:100 -&amp;gt; Y.Y.Y.Y:123&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Dynamic NAT -&gt;  This still makes one to one mapping, but the public address are from NAT pool.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   X.X.X.123:100 -&amp;gt; Y.Y.Y.Y:123&#xA;   X.X.X.124:100 -&amp;gt; Y.Y.Y.Y+1:123&#xA;   X.X.X.125:100 -&amp;gt; Y.Y.Y.Y+2:123&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1) What is that we achieve with Dynamic NAT with different IP address mapping?.  I mean, i am unable to understand the sole use of Dynamic NAT over Static NAT? What is that the problem solves this Dynamic NAT?&lt;/p&gt;&#xA;" OwnerUserId="36865" LastEditorUserId="2142" LastEditDate="2017-05-18T11:05:39.227" LastActivityDate="2017-05-18T11:05:39.227" Title="What problem does Dynamic NAT solve?" Tags="|nat|network-core|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41264" PostTypeId="1" AcceptedAnswerId="41270" CreationDate="2017-05-18T09:03:11.790" Score="4" ViewCount="404" Body="&lt;p&gt;Let's say I know my switches configurations, for each, I know what port are configured in access, what port are in trunk, and what vlan is on a port. For each device. I want to group vlan that can commuicate together. But i can't manage to find a necessary and sufficient condition.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If a two switch (&lt;code&gt;SW1&lt;/code&gt; and &lt;code&gt;SW2&lt;/code&gt;) are connected through &lt;code&gt;access ports&lt;/code&gt;, I can say that the 2 vlan configured on those ports can communicate toghether right ? But now that &lt;code&gt;SW2&lt;/code&gt; has reveived the untagged tram from &lt;code&gt;SW1&lt;/code&gt;, what does it do with it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If my port on &lt;code&gt;SW1&lt;/code&gt; was &lt;code&gt;access vlan2&lt;/code&gt; and my port or &lt;code&gt;SW2&lt;/code&gt; was &lt;code&gt;access vlan3&lt;/code&gt;. Does that mean my &lt;code&gt;sw1.vlan2&lt;/code&gt; and my &lt;code&gt;sw2.vlan3&lt;/code&gt; are on the same &lt;code&gt;layer2 network&lt;/code&gt; ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;code&gt;trunk&lt;/code&gt; case is easier because their is a tag. The only way I found for &lt;code&gt;VLANs&lt;/code&gt; to be mixed on a trunk port is if native vlan on both ends are different (Native vlan mismatch on cisco)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question : Is there a necessary and sufficient condition that I could check to know if two vlan belongs to the same &lt;code&gt;network&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit sum up of what I understand after the answers: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If &lt;code&gt;sw1--access--access--sw2&lt;/code&gt; , both &lt;code&gt;VLAN&lt;/code&gt; configured belongs to the same &lt;code&gt;l2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if &lt;code&gt;sw1--trunk--trunk--sw2&lt;/code&gt; &lt;code&gt;VLAN&lt;/code&gt; configured with the same id are in the same &lt;code&gt;l2&lt;/code&gt; AND both &lt;code&gt;native VLAN&lt;/code&gt; are in the same &lt;code&gt;l2&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if &lt;code&gt;sw1--access--trunk--sw2&lt;/code&gt;  (If the link is up, depends on the constructor) the &lt;code&gt;VLAN&lt;/code&gt; configured on the &lt;code&gt;sw1-access&lt;/code&gt; and the &lt;code&gt;native vlan&lt;/code&gt; on &lt;code&gt;sw2-trunk&lt;/code&gt; are in the same &lt;code&gt;l2&lt;/code&gt;. &lt;/p&gt;&#xA;" OwnerUserId="36106" LastEditorUserId="36106" LastEditDate="2017-05-24T12:38:47.530" LastActivityDate="2017-05-24T12:38:47.530" Title="necessary and sufficient condition for vlans to communicate together" Tags="|vlan|layer2|trunk|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41265" PostTypeId="2" ParentId="41264" CreationDate="2017-05-18T09:19:28.623" Score="1" Body="&lt;p&gt;I find it a bit hard to understand exactly what you are trying to find out. With that said, based on Cisco equipment or other similar products, if you connect two VLANs together directly on an access port, there will be a mismatch condition. If no security measures have been configured, the two VLAN ip subnets can see each other and communicate with each other. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checking for this condition can be done via various options, where normally in a Cisco environment you would enable BPDU guard to shut down the port, when access ports are connected together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://networkengineering.stackexchange.com/questions/18452/native-vlan-mismatch-between-two-access-ports-on-cisco-switches&quot;&gt;Link to native vlan mismatch case on Network Engineering&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2017-05-18T10:57:12.470" LastActivityDate="2017-05-18T10:57:12.470" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41267" PostTypeId="2" ParentId="41263" CreationDate="2017-05-18T10:10:26.853" Score="2" Body="&lt;p&gt;Static NAT uses a &lt;strong&gt;single public&lt;/strong&gt; IP address. That's enough to establish a communication from &lt;em&gt;inside&lt;/em&gt; (local network) to &lt;em&gt;outside&lt;/em&gt; (internet) just like web browsing, use streaming services as Netflix, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If inside the local network I have a &lt;em&gt;web server&lt;/em&gt; and I want it to be public, then in the NAT router I can &lt;strong&gt;open&lt;/strong&gt; a public port (&lt;code&gt;80 for http&lt;/code&gt;) in the public IP and directed it to the IP of the local server. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, a communication can be established from &lt;em&gt;outside&lt;/em&gt; (internet) to &lt;em&gt;inside&lt;/em&gt; (web server).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have another web server in my local network I can't make it public using port 80 because it is in use. I'll need a &lt;strong&gt;second public&lt;/strong&gt; IP adddress and &lt;code&gt;Dynamic NAT&lt;/code&gt; to open port 80 on that second IP and redirected to the IP of the second server.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2017-05-18T10:42:31.827" LastActivityDate="2017-05-18T10:42:31.827" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41269" PostTypeId="1" AcceptedAnswerId="41273" CreationDate="2017-05-18T10:47:49.850" Score="1" ViewCount="4262" Body="&lt;p&gt;I have configured a Cisco 1921 router to act as a DNS Caching Server by using the following configuration snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dns view default&#xA;ip dns server&#xA;ip domain retry 1&#xA;ip domain timeout 1&#xA;ip domain name mgmt.local&#xA;ip name-server 10.110.176.12&#xA;ip name-server 8.8.4.4&#xA;ip name-server 8.8.8.8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The idea is that if my local server (10.110.176.12) becomes unresponsive, I can still get results from Google's public DNS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, despite my configuration, it appears that the timeout is still 3 seconds, and the retry is 3.  Clients which use this caching server will fail beucase that delay is too long for them, and therefore they will not be able to connect to Internet resources if the primary DNS server is unresponsive.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the debug (with cache operations removed) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;122849: May 18 12:33:57.125: DNS: Incoming UDP query (id#2)&#xA;122850: May 18 12:33:57.125: DNS: Type 1 DNS query (id#2) for host 'maps.google.co.uk' from 192.168.110.56(53806)&#xA;122851: May 18 12:33:57.125: DNS: Servicing request using view default&#xA;122873: May 18 12:33:57.125: DNS: Re-sending DNS query (type 1, id#51028) to 10.110.176.12&#xA;122874: May 18 12:34:01.089: DNS: Resending query id #2&#xA;122875: May 18 12:34:01.089: DNS: Re-sending DNS query (type 1, id#51028) to 10.110.176.12&#xA;122876: May 18 12:34:04.089: DNS: Resending query id #2&#xA;122877: May 18 12:34:04.089: DNS: Re-sending DNS query (type 1, id#51028) to 10.110.176.12&#xA;122878: May 18 12:34:07.089: DNS: Resending query id #2&#xA;122879: May 18 12:34:07.089: DNS: Re-sending DNS query (type 1, id#51028) to 8.8.4.4&#xA;122880: May 18 12:34:07.117: DNS: Incoming UDP query (id#51028)&#xA;122881: May 18 12:34:07.117: DNS: Type 1 response (id#51028) for host &amp;lt;maps.google.co.uk&amp;gt; from 8.8.4.4(53)&#xA;122906: May 18 12:34:07.121: DNS: Forwarding back A response - no director required&#xA;122907: May 18 12:34:07.121: DNS: Finished processing query (id#2) in 9.996 secs&#xA;122908: May 18 12:34:07.121: DNS: Forwarding back reply to 192.168.110.56/53806&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Local name resolution works correctly - it times out after 1 second and moves on to the next server.  It's only the DNS Server portion of IOS which is ignoring these values.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Question - which values should I use for the DNS Server if it doesn't use the settings shown above?  I have checked some online guides including this one: &lt;a href=&quot;http://www.itsyourip.com/cisco/configure-cisco-router-as-cachingforwarding-dns-server/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.itsyourip.com/cisco/configure-cisco-router-as-cachingforwarding-dns-server/&lt;/a&gt; and I've not been able to figure it out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco1921/K9 running Cisco Version 15.0(1r)M9, RELEASE SOFTWARE (fc1)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update 1:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've found some more settings that I need to configure:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;LESNOSKIRT01#show ip dns view&#xA;DNS View default parameters:&#xA;Logging is off&#xA;DNS Resolver settings:&#xA;  Domain lookup is enabled&#xA;  Default domain name: mgmt.local&#xA;  Domain search list:&#xA;  Lookup timeout: 1 seconds&#xA;  Lookup retries: 1&#xA;  Domain name-servers:&#xA;    10.110.176.12&#xA;    8.8.4.4&#xA;    8.8.8.8&#xA;DNS Server settings:&#xA;  Forwarding of queries is enabled&#xA;  Forwarder timeout: 3 seconds&#xA;  Forwarder retries: 2&#xA;  Forwarder addresses:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So it looks like i need to try to find some settings to change the &quot;Forwarder timeout&quot; and &quot;Forwarder retries&quot;&lt;/p&gt;&#xA;" OwnerUserId="4822" LastEditorUserId="4822" LastEditDate="2017-05-18T12:11:29.897" LastActivityDate="2017-05-18T12:16:59.467" Title="DNS Caching Server on Cisco Router - How to set Forwarder timeout and retries?" Tags="|cisco|dns|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41270" PostTypeId="2" ParentId="41264" CreationDate="2017-05-18T11:19:31.047" Score="4" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;If my port on SW1 was access vlan2 and my port on SW2 was access&#xA;  vlan3. Does that mean my sw1.vlan2 and my sw2.vlan3 are on the same&#xA;  layer2 network ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes. If you connect two vlans together, you have essentially created one VLAN.  They are in the same broadcast domain and all hosts can address each other directly.  That makes it one layer 2 network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The vlan names &quot;VLAN 2&quot;, &quot;VLAN 3,&quot; are local to the switch - they haven no meaning outside the switch.  Although most switches don't operate this way, you could have the same VLAN have different tags on different ports.  For example, you could have a VLAN that was tagged with VID 2 on one trunk port, but VID 3 on another.  It's still the same layer 2 network.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-18T11:19:31.047" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="41273" PostTypeId="2" ParentId="41269" CreationDate="2017-05-18T12:16:59.467" Score="2" Body="&lt;p&gt;I figured it out:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DNS server on IOS does not use the standard lookup timeout or retries - you have to configure forwarding lookups and retries.  Here is an example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dns view default&#xA;dns forwarding timeout 1&#xA;dns forwarding retry 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="4822" LastActivityDate="2017-05-18T12:16:59.467" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41274" PostTypeId="1" AcceptedAnswerId="41277" CreationDate="2017-05-18T12:35:14.440" Score="5" ViewCount="728" Body="&lt;p&gt;What is the purpose of   &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0  null0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;in a core router of an ISP running BGP?&lt;/p&gt;&#xA;" OwnerUserId="36791" LastEditorUserId="509" LastEditDate="2017-05-18T13:34:48.060" LastActivityDate="2017-05-18T13:41:13.487" Title="Null 0 in ISP Core Router running bGP?" Tags="|cisco|routing|router|bgp|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41275" PostTypeId="2" ParentId="41274" CreationDate="2017-05-18T12:39:43.123" Score="3" Body="&lt;p&gt;It may have different purposes. One of the most popular is to announce default route to customers with &lt;code&gt;default-information originate&lt;/code&gt;. Dropping all unknown destinations (e. g. RFC1918 subnets) in order to prevent traffic loops till TTL exceeds may also be a reason.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastEditorUserId="29564" LastEditDate="2017-05-18T13:32:27.900" LastActivityDate="2017-05-18T13:32:27.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41277" PostTypeId="2" ParentId="41274" CreationDate="2017-05-18T13:12:06.140" Score="6" Body="&lt;p&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 null0&lt;/code&gt; will drop all unknown destinations.  Without a more complete configuration it is difficult to hypothesize its full purpose.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;A popular ISP service is to provide a private Layer 3 MPLS cloud without Internet access.  In this scenario, the customer branch location would send their default traffic (Internet traffic) to the customer HQ, rather than directly to their ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;ip route 0.0.0.0 0.0.0.0 null0&lt;/code&gt; would be in the customer VRF and could be a safeguard on the provider side to drop all other traffic.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2017-05-18T13:12:06.140" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41278" PostTypeId="1" CreationDate="2017-05-18T13:41:11.917" Score="2" ViewCount="170" Body="&lt;p&gt;I trying to understand SAN topology. &#xA;If we have fabric and fabric mode with auto data rate is set == means we will get F_ports, right? &#xA;And if we need use 8G link from SAN storage and no fibre mode is availible, does it OK to use p2p. And is so, it would be N_port. &#xA;By brocade &lt;a href=&quot;http://www.brocade.com/content/html/en/deployment-guide/brocade-vcs-storage-dp/GUID-48CF1FD9-DB97-494F-84C2-545F5027BD67.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.brocade.com/content/html/en/deployment-guide/brocade-vcs-storage-dp/GUID-48CF1FD9-DB97-494F-84C2-545F5027BD67.html&lt;/a&gt; &#xA;i know that F_port using to connect N_port. &#xA;Does &lt;em&gt;any&lt;/em&gt; SAN switch using that logic? &#xA;I cannot make changes to the switch, but can change node connection setting. &#xA;And there is availible only FC-AL and P2P without auto datarate. &lt;/p&gt;&#xA;" OwnerUserId="36880" LastEditorUserId="36720" LastEditDate="2019-10-06T13:29:34.827" LastActivityDate="2019-10-06T13:29:34.827" Title="FibreChannel topology" Tags="|brocade|topology|san|fibrechannel|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41279" PostTypeId="2" ParentId="41274" CreationDate="2017-05-18T13:41:13.487" Score="3" Body="&lt;p&gt;There are already some useful answers here, but one other reason to insert a default route pointing to the discard interface is to prevent traffic to unreachable destinations (for example traffic for networks which dropped out of the default free zone) from being transported throughout the ISP's network. This can happen if routers within the ISP's network do have a default route pointing to other routers, possibly eachother, which would result into routing loops.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-05-18T13:41:13.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41282" PostTypeId="1" AcceptedAnswerId="80609" CreationDate="2017-05-18T15:17:44.367" Score="1" ViewCount="480" Body="&lt;p&gt;I have 2 routers R1 and R2 connected back to back. R1 and R2 are ebgp neighbors for address family ipv4 and address family vpnv4.&#xA;I want to test the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;--Redistribute a route from R2's global routing table into the vpnv4 address family and advertise the same to R1 under vpnv4 address family.&#xA;I did below, but can't see the routes being learnt on R1 under vpnv4 address-family. Please suggest what is incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Below are my current configs:&#xA;On R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#sho ip int bri&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;GigabitEthernet0/0         unassigned      YES unset  administratively down down    &#xA;GigabitEthernet0/1         11.11.11.1      YES manual up                    up      &#xA;Loopback0                  1.1.1.1         YES manual up                    up      &#xA;Loopback111                unassigned      YES unset  up                    up      &#xA;Router#sho run | sec router bgp&#xA;router bgp 1&#xA; bgp router-id 1.1.1.1&#xA; bgp log-neighbor-changes&#xA; neighbor 2.2.2.2 remote-as 2&#xA; neighbor 2.2.2.2 ebgp-multihop 2&#xA; neighbor 2.2.2.2 update-source Loopback0&#xA; !&#xA; address-family vpnv4&#xA;  neighbor 2.2.2.2 activate&#xA;  neighbor 2.2.2.2 send-community extended&#xA; exit-address-family&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;        Router#sho ip int bri | i up&#xA;GigabitEthernet0/1         11.11.11.2      YES manual up                    up      &#xA;Loopback0                  2.2.2.2         YES manual up                    up      &#xA;Loopback22                 22.22.22.22     YES manual up                    up      &#xA;&#xA;&#xA;Router#sho run | sec router bgp&#xA;router bgp 2&#xA; bgp router-id 2.2.2.2&#xA; bgp log-neighbor-changes&#xA; neighbor 1.1.1.1 remote-as 1&#xA; neighbor 1.1.1.1 ebgp-multihop 2&#xA; neighbor 1.1.1.1 update-source Loopback0&#xA; !&#xA; address-family vpnv4&#xA;  neighbor 1.1.1.1 activate&#xA;  neighbor 1.1.1.1 send-community extended&#xA; exit-address-family&#xA;!&#xA; address-family ipv4 vrf TEST22      &#xA;  redistribute static metric 10&#xA; exit-address-family&#xA;Router#&#xA;&#xA;Router#sho run | sec Null&#xA;ip route 100.0.0.0 255.0.0.0 Null0&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2017-05-18T15:46:27.167" LastActivityDate="2022-11-18T22:43:51.600" Title="Regarding BGP redistribution basics" Tags="|bgp|vrf|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41284" PostTypeId="1" CreationDate="2017-05-18T16:54:02.477" Score="1" ViewCount="1231" Body="&lt;p&gt;I am new to Palo Alto Firewalls.  I am working on a project using a PAN 3020 to setup some test networks.  We are moving from one date center to another and don't want to change IP addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am attaching a picture that describes what I would like to accomplish.&lt;a href=&quot;https://i.stack.imgur.com/spHEV.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/spHEV.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36888" LastActivityDate="2018-02-21T21:52:12.770" Title="Palo Alto one to one NAT" Tags="|nat|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41285" PostTypeId="1" CreationDate="2017-05-18T17:01:07.190" Score="1" ViewCount="571" Body="&lt;p&gt;I have a single Multicast source which I would like -for testing purposes- to duplicate over several Multicast addresses, e.g.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;an host sending packets to 239.0.0.1, I would like the same traffic to be sent over 239.0.0.2, ..., 239.0.0.N as well.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible by configuration at network level? I'm working with Cisco L3 Switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance for any suggestion.&lt;/p&gt;&#xA;" OwnerUserId="27712" LastActivityDate="2017-05-18T17:07:25.817" Title="How to duplicate multicast source over several multicast addresses" Tags="|multicast|testing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41286" PostTypeId="2" ParentId="41285" CreationDate="2017-05-18T17:07:25.817" Score="1" Body="&lt;p&gt;A multicast group is a destination IP address on an IP packet. The destination IP address is determined by the sender, and modifying an IP address on a packet is called NAT (Network Address Translation). Cisco switches cannot do NAT, only the routers can. Also, NAT does not duplicate packets, it only modifies existing packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point of multicast is that one packet is sent to multiple devices on a layer-2 LAN that listen to the same multicast group. If you have three devices that listen to three different multicast groups, your multicast source needs to send a packet to each multicast group.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You do not solve this problem with network devices, but with the multicast source or receivers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-18T17:07:25.817" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41293" PostTypeId="1" CreationDate="2017-05-19T09:13:03.843" Score="1" ViewCount="270" Body="&lt;p&gt;Let me first explain my situation:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am currently in the process of trying to build a solution for managing multiple Internet of Things devices on a network. It should be possible to automatically make the clients connect to a central server which is hosting an MQTT-Broker.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In IPv4 networks, I would simply send a broadcast packet from the client, to which the server would respond with a packet containing its own IP address. Now that the client knows the IP address of the server, it would be able to connect to it after this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, things are different with IPv6, since there is no broadcast anymore. How could I make my client automatically find the server without hardcoding a multicast address?&lt;/p&gt;&#xA;" OwnerUserId="36899" LastEditorUserId="8499" LastEditDate="2018-03-19T16:42:04.073" LastActivityDate="2018-03-19T17:37:00.253" Title="How would I make a client find a server with an unknown IPv6 Address?" Tags="|ipv6|multicast|broadcast|network-discovery|" AnswerCount="3" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41294" PostTypeId="2" ParentId="41293" CreationDate="2017-05-19T09:35:15.373" Score="2" Body="&lt;p&gt;In IPv6, there’s no longer any broadcast – sending one packet to a large number of unspecified hosts. There’s only multicast, unicast and anycast. In IPv6 all nodes are required to support multicast. Without multicast, many services that you need will simply not work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;http://ipv6friday.org/blog/2011/12/ipv6-multicast/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://ipv6friday.org/blog/2011/12/ipv6-multicast/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastActivityDate="2017-05-19T09:35:15.373" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="41295" PostTypeId="1" AcceptedAnswerId="43432" CreationDate="2017-05-19T09:47:40.227" Score="2" ViewCount="1415" Body="&lt;p&gt;I am currently digging into WLAN management frames. For this, I wanted to capture management frames using few Linux utilities. So what I did so far is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Put my interface (&lt;code&gt;wlp2s0&lt;/code&gt;) in managed mode without being connected to an AP&lt;/li&gt;&#xA;&lt;li&gt;Create monitoring interface: &lt;code&gt;iw dev wlp2s0 interface add mon0 type monitor&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Bring &lt;code&gt;mon0&lt;/code&gt; up: &lt;code&gt;ifconfig mon0 up&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;Capture all frames on &lt;code&gt;mon0&lt;/code&gt; using wireshark without any filters&lt;/li&gt;&#xA;&lt;li&gt;Trigger active scanning using &lt;code&gt;iwlist wlp2s0 scan&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What I get from this is a bunch of Beacon frames and each time I run the scan, I receive probe responses from the APs. But I don't see any probe requests. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I missing here?&lt;/p&gt;&#xA;" OwnerUserId="36848" LastActivityDate="2017-09-20T03:26:54.187" Title="Can't capture WLAN Probe Request" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41298" PostTypeId="2" ParentId="5832" CreationDate="2017-05-19T13:24:46.800" Score="0" Body="&lt;p&gt;To do the manual reset you must wait for the Fortigate unit STATUS light to turn GREEN before pushing the reset button.&lt;/p&gt;&#xA;" OwnerUserId="36903" LastActivityDate="2017-05-19T13:24:46.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41299" PostTypeId="1" AcceptedAnswerId="41300" CreationDate="2017-05-19T14:02:27.317" Score="1" ViewCount="100" Body="&lt;p&gt;Looking at a Stack Overflow question - &lt;a href=&quot;https://stackoverflow.com/questions/13006949/what-is-the-difference-between-the-data-link-layer-and-link-layer&quot;&gt;https://stackoverflow.com/questions/13006949/what-is-the-difference-between-the-data-link-layer-and-link-layer&lt;/a&gt; - one of the answers says that the data link layer, i.e. a combination of &lt;code&gt;LLC&lt;/code&gt; and &lt;code&gt;MAC&lt;/code&gt; and/or other things (from what I've seen on Google searches) is used for handling local network communication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what &lt;code&gt;LLC&lt;/code&gt; and &lt;code&gt;MAC&lt;/code&gt; are yet, but am hoping to get a high level overview on why such protocols are needed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;i.e. if the data link deals with communication on a local network basis, does that mean that upper levels of the OSI model are 'skipped'?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is different about local network communication vs inter-network communication? And how do things like &lt;code&gt;MAC&lt;/code&gt; and &lt;code&gt;LLC&lt;/code&gt; come into play? I've often read things like 'MAC address'. What is this - is it related to the MAC protocol at all?&lt;/p&gt;&#xA;" OwnerUserId="36904" LastEditorUserId="-1" LastEditDate="2017-05-23T12:37:19.997" LastActivityDate="2017-05-19T15:36:40.093" Title="Why is local network communication handled differently to inter-network communication in the OSI model?" Tags="|osi|mac|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41300" PostTypeId="2" ParentId="41299" CreationDate="2017-05-19T15:07:09.610" Score="1" Body="&lt;p&gt;Remember that the OSI model is simply a model, and the real world doesn't always fit so neatly into it. There are many models, but none are followed completely.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Data-Link layer is layer-2 under the OSI model. The addresses used by many (but not all, just the IEEE) LAN (layer-2) protocols are called MAC (Media Access Control) addresses. Hosts on a LAN using an IEEE LAN protocol (e.g. ethernet or Wi-Fi) communicate with each other using MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One major problem with the OSI model is that OSes never actually implemented separate layers 5, 6, and 7. That means that those layers are really lumped together in the Application layer, which is off-topic here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Application layer sends data to the Transport layer, where it is encapsulated in datagrams for transport. Some Transport layer protocols use source and destination addresses. For TCP and UDP, we call those addresses ports, and the TCP datagrams are called segments because the application data stream is segmented.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Transport layer sends its datagrams to the Network layer, where the datagrams are encapsulated in Network layer datagrams, called packets. The packets have source and destination addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Network layer sends the packets to the Data-Link layer, where the packets are encapsulated into frames (MAC function). The IEEE Data-Link layer protocols use source and destination addresses, called MAC addresses, on the frames. Other layer-2 protocols may use other addressing, or none at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Data-Link layer sends the frames to the Physical layer (hardware) for encoding of the frames where they are placed on the &quot;wire&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The receiving host will reverse the process, decoding the bits on the wire into frames, which send their payloads to the appropriate Network layer protocols (LLC function), which then send the packet payloads to the appropriate Transport layer protocols, which send the payloads to the appropriate application processes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each layer on a source host communicates with the corresponding layer in the destination host, so, no, the upper layers are not skipped when two hosts on the same LAN communicate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understand that a host can have multiple Network layer protocols. The way the IEEE LAN protocol decides which Network layer protocol gets the payload of a frame is referred to as LLC. The actual encapsulation of network packets in frames is called MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Don't make the mistake of thinking the whole world uses IEEE data-link protocols, although they are dominant on LANs. There are many different data-link protocols, and many do not use LLC or MAC, which are defined by IEEE 802.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-19T15:36:40.093" LastActivityDate="2017-05-19T15:36:40.093" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41301" PostTypeId="1" AcceptedAnswerId="42064" CreationDate="2017-05-19T15:18:14.593" Score="4" ViewCount="5191" Body="&lt;p&gt;I have two questions :: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I have read some papers on Software defined network. Every time I see that they work with switches. I want to know Cant we implement SDN with routers ? &lt;/li&gt;&#xA;&lt;li&gt;What are the metrics of  a routing algorithm. ( I want to develop one for SDN based network ) &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Thanks &lt;/p&gt;&#xA;" OwnerUserId="36905" LastEditorUserId="509" LastEditDate="2017-05-19T15:19:10.273" LastActivityDate="2018-04-11T09:52:43.863" Title="Are routers used in Software Defined Network?" Tags="|routing|sdn|" AnswerCount="4" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41304" PostTypeId="2" ParentId="40530" CreationDate="2017-05-19T16:53:17.653" Score="1" Body="&lt;p&gt;Cheap cable testers will only tell you if there is continuity. They won't tell you anything about the high-speed performance of the cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first question is is the cable actually CAT5 or is it some kind of telphone-grade cable. If it's not actually CAT5 then frankly you are lucky to be getting 100 megabit let alone gigabit.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second question is whether the cable is terminated properly. Untwisting needs to be kept to a minimum and you need to ensure that there are no &quot;split pairs&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ultimately if the termination looks good then the cable is almost certainly either inadequate or faulty. Time for a new run of cable.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-19T16:53:17.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41306" PostTypeId="1" AcceptedAnswerId="41308" CreationDate="2017-05-19T18:40:27.280" Score="1" ViewCount="66" Body="&lt;p&gt;Assuming we want to serve something continuously on a local network to hundreds or thousands of devices, is there a solution, except for creating multiple separate networks? Or am I entirely wrong and the maximum WiFi bandwidth is not an issue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I apologise if my question isn't clear enough, please let me know and I'll explain.&lt;/p&gt;&#xA;" OwnerUserId="36909" LastActivityDate="2017-05-22T23:57:32.090" Title="How to work around WiFi bandwidth limit on big events, where there are a lot of devices connected?" Tags="|lan|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41308" PostTypeId="2" ParentId="41306" CreationDate="2017-05-19T18:46:50.057" Score="1" Body="&lt;p&gt;You don't need to create separate networks, but you are going to need a whole lot of WAPs and some WLCs to facilitate roaming. Each WAP will handle about 20 or 30 users. The problem is more about the shared broadcast medium rather than the wireless bandwidth. Only one device can be using the same wireless frequency at any one time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will need to carefully plan the WAP placement, frequencies used, radio power, etc. That is why you get a wireless site survey before you create your installation plan. Once you have implemented this, then you can do a followup survey to tweak things.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-19T18:46:50.057" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41309" PostTypeId="1" AcceptedAnswerId="41310" CreationDate="2017-05-19T18:54:46.447" Score="2" ViewCount="3343" Body="&lt;p&gt;I was wondering if someone could help me with something. I am trying to set up SNMP v3 but with access control. Now, I have made the user and group. That's all fine, but I can't seem to get the access control part working. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I attempt to add it at the end the switch throws a paddy saying it's not possible. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is what I am putting in:&#xA;&lt;code&gt;snmp-server user User1 Group1 v3 auth md5 BeepBoop access 10&lt;/code&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The access list I am trying to make is &lt;code&gt;10&lt;/code&gt;. I have made the list with the IP addresses within the list. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;snmp-server user User1 Group1 v3 auth md5 BeepBoop access 10&#xA;                                                   ^&#xA;ERROR: % Invalid input detected at '^' marker.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cisco Adaptive Security Appliance Software Version 9.8(1) Firepower Extensible Operating System Version 2.2(1.47) Device Manager Version 7.8(1)&lt;/p&gt;&#xA;" OwnerUserId="36911" LastEditorUserId="8499" LastEditDate="2018-03-07T18:33:42.287" LastActivityDate="2018-03-07T18:33:42.287" Title="Access list with SNMP v3 Cisco" Tags="|cisco|cisco-asa|snmp|access-control|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41310" PostTypeId="2" ParentId="41309" CreationDate="2017-05-19T19:23:57.530" Score="2" Body="&lt;p&gt;The problem is that you don't have the &lt;code&gt;access&lt;/code&gt; option on the ASA &lt;code&gt;snmp-server user&lt;/code&gt; command like you do on IOS.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;snmp-server user&lt;/strong&gt; &lt;em&gt;username&lt;/em&gt; &lt;em&gt;group-name&lt;/em&gt; { &lt;strong&gt;v3&lt;/strong&gt; [ &lt;strong&gt;encrypted&lt;/strong&gt; ]] [ &lt;strong&gt;auth&lt;/strong&gt; { &lt;strong&gt;md5&lt;/strong&gt; | &lt;strong&gt;sha&lt;/strong&gt; ]} &lt;em&gt;auth-password&lt;/em&gt; [ &lt;strong&gt;priv&lt;/strong&gt; [&#xA;  &lt;strong&gt;des&lt;/strong&gt; | &lt;strong&gt;3des&lt;/strong&gt; | &lt;strong&gt;aes&lt;/strong&gt; ] [ &lt;strong&gt;128&lt;/strong&gt; | &lt;strong&gt;192&lt;/strong&gt; | &lt;strong&gt;256&lt;/strong&gt; ] priv-password&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As Ricky Beam points out, you use the &lt;code&gt;snmp-server host&lt;/code&gt; command to restict the host access:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;strong&gt;snmp-server host&lt;/strong&gt; interface { hostname | ip_address } [ &lt;strong&gt;trap&lt;/strong&gt; | &lt;strong&gt;poll&lt;/strong&gt; ] [ &lt;strong&gt;community&lt;/strong&gt; community-string ] [ &lt;strong&gt;version&lt;/strong&gt; { &lt;strong&gt;1&lt;/strong&gt; | &lt;strong&gt;2c&lt;/strong&gt; | 3 username }] [ &lt;strong&gt;udp-port&lt;/strong&gt; port ]&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;See the &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/monitor_snmp.html#48140&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Cisco ASA Series CLI Configuration Guide, 9.0&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/zGgHU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/zGgHU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-20T03:34:56.033" LastActivityDate="2017-05-20T03:34:56.033" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41311" PostTypeId="1" AcceptedAnswerId="41458" CreationDate="2017-05-19T19:40:21.090" Score="1" ViewCount="697" Body="&lt;p&gt;My co-worker and I are curious if you can use the traceroute [IP Address] source [interface name] successfully on the Cisco ASA 55** series. We are running on 8.4(2). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="36913" LastActivityDate="2017-05-25T07:05:55.167" Title="Extended Traceroute on ASA 5550" Tags="|cisco|cisco-asa|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41313" PostTypeId="2" ParentId="40830" CreationDate="2017-05-19T19:48:10.963" Score="3" Body="&lt;p&gt;Heritu mentioned timeout conn 3:00:00 which is 100% right but make sure you enter en mode and run conf t prior. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From command line via putty&lt;/p&gt;&#xA;&#xA;&lt;p&gt;en&lt;/p&gt;&#xA;&#xA;&lt;p&gt;conf t&lt;/p&gt;&#xA;&#xA;&lt;p&gt;timeout conn 3:00:00&lt;/p&gt;&#xA;" OwnerUserId="36913" LastActivityDate="2017-05-19T19:48:10.963" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41316" PostTypeId="1" CreationDate="2017-05-19T23:32:57.443" Score="1" ViewCount="827" Body="&lt;p&gt;Is it possible to block just youtube video music from Fortinet? I need my users can watch videos like tutorials from youtube but not music or another kind of entertaiment.&lt;/p&gt;&#xA;" OwnerUserId="36918" LastActivityDate="2017-05-20T06:54:51.997" Title="Block youtube music videos from Fortinet" Tags="|fortinet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41319" PostTypeId="2" ParentId="40694" CreationDate="2017-05-20T04:10:03.933" Score="1" Body="&lt;p&gt;You are likely experiencing a native VLAN issue on the switch. You are tagging VLAN 1 on the ASA, but the switch defaults to untagged for VLAN 1. You can do one of two things:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Option 1: Assign the &lt;code&gt;nameif OUTSIDE&lt;/code&gt; and the IP address to the physical port Gi0/1 and get rid of your Gi0/1.1 definition (but leave the Gi0/1.11), like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/1&#xA; description ISP1&#xA; nameif OUTSIDE&#xA; ip address 202.X.X.100 255.255.255.0&#xA;&#xA;interface GigabitEthernet0/1.11&#xA; description ISP2&#xA; vlan 11&#xA; nameif OUTSIDE11&#xA; ip address 102.X.X.100 255.255.255.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Option 2: Change the native VLAN on the switch to something other than 1 or 11 (e.g., &lt;code&gt;switchport trunk native vlan 1000&lt;/code&gt;)&lt;/p&gt;&#xA;" OwnerUserId="34860" LastActivityDate="2017-05-20T04:10:03.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41320" PostTypeId="2" ParentId="41316" CreationDate="2017-05-20T06:54:51.997" Score="3" Body="&lt;p&gt;In a word: no. YouTube provides no mechanisms to allow a network device like a firewall to differentiate between content types.&#xA;The only method I'm aware of that sort of works is to use a proxy to set a volume quota on YouTube or other streaming media sites in general, high enough so that the odd business use is possible, but streaming music videos all day is not.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2017-05-20T06:54:51.997" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41325" PostTypeId="1" AcceptedAnswerId="41328" CreationDate="2017-05-20T14:03:13.083" Score="2" ViewCount="110" Body="&lt;p&gt;Consider the following config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router bgp 2&#xA; address-family ipv4 vrf TEST_VRF     &#xA;  redistribute static metric 10&#xA; exit-address-family&#xA;Router#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Q1:The above command snippet does the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.I am telling BGP to run inside my vrf TEST_VRF&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.I am redistributing all the static routes &lt;strong&gt;present in TEST_VRF  routing table&lt;/strong&gt; into bgp with a metric of 10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please confirm if my above understanding is correct.&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2017-05-20T15:59:43.667" Title="Redistribution command" Tags="|bgp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41327" PostTypeId="1" CreationDate="2017-05-20T15:03:04.510" Score="0" ViewCount="61" Body="&lt;p&gt;I'm stuck configuring the following scheme, How do I make it to exist communication between every computer? It just communicate in PCs with the same VLAN(For example if I make ping between PC4 and PC5 the communication exist), except with PC6 that haves no communication with PC0 and PC1 and have the same VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9I1sF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9I1sF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36932" LastEditorUserId="453" LastEditDate="2017-05-20T22:13:32.420" LastActivityDate="2017-06-20T02:06:22.523" Title="How can I configure VLANs with two servers?" Tags="|cisco|vlan|" AnswerCount="1" CommentCount="1" ClosedDate="2018-02-19T05:09:00.863" ContentLicense="CC BY-SA 3.0" />
  <row Id="41328" PostTypeId="2" ParentId="41325" CreationDate="2017-05-20T15:59:43.667" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;You're not actually telling BGP to run inside VRF. I would say you're activating address family ipv4 vrf inside BGP process. I. e. BGP process is always bgp 2, but it may contain different address families.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Correct.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="29564" LastActivityDate="2017-05-20T15:59:43.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41333" PostTypeId="2" ParentId="41327" CreationDate="2017-05-21T01:21:18.757" Score="1" Body="&lt;p&gt;U should mention which switches have which interfaces set in which VLAN, if any.&#xA;However from your question it looks like few of your computers are in the same VLAN while few in are in different VLANS.&#xA;This is inter VLAN communication.&#xA;To enable this =, you need to make sure of a few things.&#xA;First you will need a layer 3 forwarding. This can be done using SVI or an actual router.&#xA;Secondly depending on your configuration you might want to set a few interfaces as trunk.&#xA;If you are using an SVI, the the default gateway of the PC should e the IP address of the SVI &lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-05-21T01:21:18.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41336" PostTypeId="1" CreationDate="2017-05-21T07:35:35.110" Score="1" ViewCount="55" Body="&lt;p&gt;Our network layout contains one one vendor switches  so far ,&#xA;We Need to verify adding new vendor for our data center. &#xA;Want to learn the advantage and  disadvantage in connecting such a new vendor.&#xA;What is your recomendation for using integrating 2 vendors ?&lt;/p&gt;&#xA;" OwnerUserId="36947" LastActivityDate="2017-05-21T11:39:49.423" Title="2 switches vendors in one datacenter ?" Tags="|network|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41340" PostTypeId="2" ParentId="41336" CreationDate="2017-05-21T11:39:49.423" Score="2" Body="&lt;p&gt;Mixing devices from multiple vendors is no general problem. However, you need to make sure that they interoperate with the features you require. As long as only standard protocols are used (eg. 802.1Q VLANs, RSTP) there's little to be feared. You may be required to have a deeper understanding of the features and protocols you use, however.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Advantages include that you may gain features from one vendor that others don't offer or you may be able to save some budget. Disadvantages may be that your environment grows more complex, a deeper understanding is required and if something doesn't work it might be harder to point a finger.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-21T11:39:49.423" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41342" PostTypeId="1" CreationDate="2017-05-21T11:56:38.780" Score="2" ViewCount="5086" Body="&lt;p&gt;After layer 3 routing a large IPv6 assignment on an EX Juniper switch, the route forwarding table filled up and some entries corrupted or became otherwise invalid. We want to clear the whole table. How?&lt;/p&gt;&#xA;" OwnerUserId="36951" LastEditorUserId="8499" LastEditDate="2018-12-21T04:41:33.923" LastActivityDate="2021-09-06T08:06:25.570" Title="Juniper EX how to clear route forwarding table?" Tags="|routing|juniper|juniper-junos|layer3|juniper-ex|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41343" PostTypeId="2" ParentId="41342" CreationDate="2017-05-21T12:10:19.820" Score="0" Body="&lt;p&gt;It seems like it cleared up itself after deleting the prefixes from the configuration.&lt;/p&gt;&#xA;" OwnerUserId="36951" LastActivityDate="2017-05-21T12:10:19.820" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41344" PostTypeId="1" AcceptedAnswerId="41345" CreationDate="2017-05-21T13:57:53.150" Score="1" ViewCount="2666" Body="&lt;p&gt;I am trying to understand the difference between &#xA;address-family vpnv4 and address-family ipv4 vrf &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So to test the scenario, i connected 2 routers(R1 and R2) linearly back to back.&#xA;R1 has the loopback as 11.11.11.11&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2 has the loopback address as 22.22.22.22&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On R2, i have the vrf TEST22.&#xA;On R2, i also have a static route to network 100.0.0.0 in vrf TEST22 as shown below&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route vrf TEST22 100.0.0.0 255.0.0.0 null 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want this route to be learnt on R1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On R1, i have the vrf TEST11.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configuration and command outputs on R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sho ip bgp vpnv4 all summary&#xA;BGP router identifier 11.11.11.11, local AS number 1&#xA;BGP table version is 1, main routing table version 1&#xA;&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;22.22.22.22     4     2      17      16        1    0    0 00:03:18        0&#xA;R1#conf t&#xA;Enter configuration commands, one per line.  End with CNTL/Z.&#xA;R1(config)#ip vrf TEST11&#xA;R1(config-vrf)#route&#xA;R1(config-vrf)#route-target im&#xA;R1(config-vrf)#route-target import 2:2&#xA;R1(config-vrf)#end&#xA;R1#&#xA;*Mar  1 00:20:32.703: %SYS-5-CONFIG_I: Configured from console by console&#xA;R1#sho ip bgp vpnv4 all summary&#xA;BGP router identifier 11.11.11.11, local AS number 1&#xA;BGP table version is 1, main routing table version 1&#xA;&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;22.22.22.22     4     2      19      18        1    0    0 00:04:04        0&#xA;R1#sho ip bgp vpnv4 all summary&#xA;BGP router identifier 11.11.11.11, local AS number 1&#xA;BGP table version is 1, main routing table version 1&#xA;&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;22.22.22.22     4     2      19      18        1    0    0 00:04:06        0&#xA;&#xA;R1#&#xA;R1#sho run | sec vrf&#xA;ip vrf TEST11&#xA; rd 1:1&#xA; route-target import 2:2&#xA; address-family ipv4 vrf TEST11&#xA;  no synchronization&#xA;R1#&#xA;R1#&#xA;R1#sho ip bgp vpnv4 all summary&#xA;BGP router identifier 11.11.11.11, local AS number 1&#xA;BGP table version is 3, main routing table version 3&#xA;2 network entries using 280 bytes of memory&#xA;2 path entries using 136 bytes of memory&#xA;2/1 BGP path/bestpath attribute entries using 248 bytes of memory&#xA;1 BGP AS-PATH entries using 24 bytes of memory&#xA;1 BGP extended community entries using 24 bytes of memory&#xA;0 BGP route-map cache entries using 0 bytes of memory&#xA;0 BGP filter-list cache entries using 0 bytes of memory&#xA;BGP using 712 total bytes of memory&#xA;BGP activity 2/0 prefixes, 2/0 paths, scan interval 15 secs&#xA;&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;22.22.22.22     4     2      20      18        3    0    0 00:04:42        1&#xA;R1#&#xA;R1#&#xA;&#xA;&#xA;R1#sho ip bgp vpnv4 vrf TEST11&#xA;BGP table version is 3, local router ID is 11.11.11.11&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;Route Distinguisher: 1:1 (default for vrf TEST11)&#xA;*&amp;gt; 100.0.0.0        22.22.22.22            100             0 2 ?&#xA;R1#E{M'}T&#xA;R1#p}&#xA;R1#&#xA;R1#&#xA;R1#ter len 0&#xA;R1#sho run | sec bgp&#xA;router bgp 1&#xA; bgp log-neighbor-changes&#xA; neighbor 22.22.22.22 remote-as 2&#xA; neighbor 22.22.22.22 ebgp-multihop 2&#xA; neighbor 22.22.22.22 update-source Loopback0&#xA; !&#xA; address-family ipv4&#xA;  neighbor 22.22.22.22 activate&#xA;  no auto-summary&#xA;  no synchronization&#xA; exit-address-family&#xA; !&#xA; address-family vpnv4&#xA;  neighbor 22.22.22.22 activate&#xA;  neighbor 22.22.22.22 send-community extended&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf TEST11&#xA;  no synchronization&#xA; exit-address-family&#xA;R1#&#xA;R1#&#xA;R1#sho run | sec vrf&#xA;ip vrf TEST11&#xA; rd 1:1&#xA; route-target import 2:2&#xA; address-family ipv4 vrf TEST11&#xA;  no synchronization&#xA;R1#&#xA;R1#&#xA;R1#sho ip bgp sum&#xA;R1#sho ip bgp summary&#xA;BGP router identifier 11.11.11.11, local AS number 1&#xA;BGP table version is 1, main routing table version 1&#xA;&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;22.22.22.22     4     2      27      25        1    0    0 00:11:06        0&#xA;R1#&#xA;&#xA;&#xA;R1#sho ip bgp vpnv4 vrf TEST11 summary&#xA;&#xA;&#xA;R1#&#xA;R1#sho ip route&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;C    1.0.0.0/8 is directly connected, FastEthernet0/0&#xA;S    22.0.0.0/8 is directly connected, FastEthernet0/0&#xA;C    11.0.0.0/8 is directly connected, Loopback0&#xA;R1#&#xA;R1#sho ip route vr&#xA;R1#sho ip route vrf TEST11&#xA;&#xA;Routing Table: TEST11&#xA;Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route&#xA;&#xA;Gateway of last resort is not set&#xA;&#xA;B    100.0.0.0/8 [20/100] via 22.22.22.22, 00:07:57&#xA;R1#&#xA;R1#sho ip bgp vpn&#xA;R1#sho ip bgp vpnv4 vr&#xA;R1#sho ip bgp vpnv4 vrf TEST11&#xA;BGP table version is 3, local router ID is 11.11.11.11&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;Route Distinguisher: 1:1 (default for vrf TEST11)&#xA;*&amp;gt; 100.0.0.0        22.22.22.22            100             0 2 ?&#xA;R1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Configuration and command output on R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#&#xA;R2#&#xA;R2#sho run | sec router bgp&#xA;router bgp 2&#xA; bgp log-neighbor-changes&#xA; neighbor 11.11.11.11 remote-as 1&#xA; neighbor 11.11.11.11 ebgp-multihop 2&#xA; neighbor 11.11.11.11 update-source Loopback0&#xA; !&#xA; address-family ipv4&#xA;  neighbor 11.11.11.11 activate&#xA;  no auto-summary&#xA;  no synchronization&#xA; exit-address-family&#xA; !&#xA; address-family vpnv4&#xA;  neighbor 11.11.11.11 activate&#xA;  neighbor 11.11.11.11 send-community extended&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf TEST22&#xA;  redistribute static metric 100&#xA;  no synchronization&#xA; exit-address-family&#xA;R2#&#xA;R2#&#xA;R2#sho ip bgp summ&#xA;R2#sho ip bgp summary&#xA;BGP router identifier 1.1.1.2, local AS number 2&#xA;BGP table version is 1, main routing table version 1&#xA;&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;11.11.11.11     4     1      68      70        1    0    0 00:54:37        0&#xA;R2#&#xA;R2#&#xA;R2#sho ip bgp vpn&#xA;R2#sho ip bgp vpnv4 vr&#xA;R2#sho ip bgp vpnv4 vrf TEST22&#xA;BGP table version is 4, local router ID is 1.1.1.2&#xA;Status codes: s suppressed, d damped, h history, * valid, &amp;gt; best, i - internal,&#xA;              r RIB-failure, S Stale&#xA;Origin codes: i - IGP, e - EGP, ? - incomplete&#xA;&#xA;   Network          Next Hop            Metric LocPrf Weight Path&#xA;Route Distinguisher: 2:2 (default for vrf TEST22)&#xA;*&amp;gt; 100.0.0.0        0.0.0.0                100         32768 ?&#xA;R2#&#xA;R2#&#xA;R2#sho run | sec vrf&#xA;ip vrf TEST22&#xA; rd 2:2&#xA; route-target export 2:2&#xA; address-family ipv4 vrf TEST22&#xA;  redistribute static metric 100&#xA;  no synchronization&#xA;ip route vrf TEST22 100.0.0.0 255.0.0.0 Null0&#xA;R2#&#xA;R2#sho ip bgp vpn&#xA;R2#sho ip bgp vpnv4 al&#xA;R2#sho ip bgp vpnv4 all summ&#xA;R2#sho ip bgp vpnv4 all summary&#xA;BGP router identifier 1.1.1.2, local AS number 2&#xA;BGP table version is 4, main routing table version 4&#xA;1 network entries using 140 bytes of memory&#xA;1 path entries using 68 bytes of memory&#xA;2/1 BGP path/bestpath attribute entries using 248 bytes of memory&#xA;1 BGP extended community entries using 24 bytes of memory&#xA;0 BGP route-map cache entries using 0 bytes of memory&#xA;0 BGP filter-list cache entries using 0 bytes of memory&#xA;Bitfield cache entries: current 1 (at peak 1) using 32 bytes of memory&#xA;BGP using 512 total bytes of memory&#xA;BGP activity 1/0 prefixes, 1/0 paths, scan interval 15 secs&#xA;&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;11.11.11.11     4     1      71      73        4    0    0 00:57:28        0&#xA;R2#&#xA;R2#&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Q1:As you see R1, learns the route 100.0.0.0 in the vrf TEST11. &#xA;Even though i did not &lt;em&gt;activate&lt;/em&gt; the neighbor &lt;code&gt;1.1.1.1&lt;/code&gt;  under &lt;code&gt;address-family ipv4 vrf &amp;lt;vrf name&amp;gt;&lt;/code&gt;, but still R1 learns that route. How? Is the &lt;code&gt;address-family vpnv4&lt;/code&gt;  acting as the transport carrier for that route?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Q2:In another scenario, i removed the neighbor from the vpnv4 address family on both R1 and R2 as seen below&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On R1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;    R1#sho run | sec router bgp&#xA;router bgp 1&#xA; bgp log-neighbor-changes&#xA; neighbor 22.22.22.22 remote-as 2&#xA; neighbor 22.22.22.22 ebgp-multihop 2&#xA; neighbor 22.22.22.22 update-source Loopback0&#xA; !&#xA; address-family ipv4&#xA;  neighbor 22.22.22.22 activate&#xA;  no auto-summary&#xA;  no synchronization&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf TEST22&#xA;  neighbor 22.22.22.22 remote-as 2&#xA;  neighbor 22.22.22.22 ebgp-multihop 2&#xA;  neighbor 22.22.22.22 update-source Loopback0&#xA;  neighbor 22.22.22.22 activate&#xA;  no synchronization&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf TEST11&#xA;  no synchronization&#xA; exit-address-family&#xA;R1#sho ip bgp vpnv4 vrf TEST22 summary | b Neighbor&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;22.22.22.22     4     2       0       0        0    0    0 never    Active&#xA;R1#&#xA;R1#sho run | sec vrf&#xA;ip vrf TEST11&#xA; rd 1:1&#xA; route-target import 2:2&#xA;ip vrf TEST22&#xA; rd 1:2&#xA; route-target import 2:2&#xA; address-family ipv4 vrf TEST22&#xA;  neighbor 22.22.22.22 remote-as 2&#xA;  neighbor 22.22.22.22 ebgp-multihop 2&#xA;  neighbor 22.22.22.22 update-source Loopback0&#xA;  neighbor 22.22.22.22 activate&#xA;  no synchronization&#xA; address-family ipv4 vrf TEST11&#xA;  no synchronization&#xA;R1#&#xA;&#xA;R1#sho ip bgp vpnv4 vrf TEST22 summary | b Neighbor&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;22.22.22.22     4     2       0       0        0    0    0 never    Active&#xA;R1#&#xA;&#xA;R1#sho ip bgp vpnv4 vrf TEST22&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1#&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sho run | sec bgp&#xA;router bgp 2&#xA; bgp log-neighbor-changes&#xA; neighbor 11.11.11.11 remote-as 1&#xA; neighbor 11.11.11.11 ebgp-multihop 2&#xA; neighbor 11.11.11.11 update-source Loopback0&#xA; !&#xA; address-family ipv4&#xA;  neighbor 11.11.11.11 activate&#xA;  no auto-summary&#xA;  no synchronization&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf TEST22&#xA;  redistribute static metric 10&#xA;  neighbor 11.11.11.11 remote-as 1&#xA;  neighbor 11.11.11.11 ebgp-multihop 2&#xA;  neighbor 11.11.11.11 update-source Loopback0&#xA;  neighbor 11.11.11.11 activate&#xA;  no synchronization&#xA; exit-address-family&#xA;R2#&#xA;R2#sho run | i null&#xA;R2#sho run | i route&#xA;ip route 11.0.0.0 255.0.0.0 FastEthernet0/0&#xA;ip route vrf TEST22 100.0.0.0 255.0.0.0 Null0&#xA;R2#&#xA;R2#&#xA;R2#sho ip bgp vpnv4 vrf TEST22 summary | b Neighbor&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;11.11.11.11     4     1       0       0        0    0    0 never    Active&#xA;R2#sho ip bgp summ&#xA;R2#sho ip bgp summary | b Neigh&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;11.11.11.11     4     1     203     205        1    0    0 00:01:42        0&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you see, on R1, the route to 100.0.0.0 no longer exists.&#xA;Moreover, the BGP vrf peering is in Active state.&#xA;Why is this happening ? is there any relation between &lt;code&gt;address-family vpnv4&lt;/code&gt;  and &lt;code&gt;address-family ipv4 vrf &amp;lt;vrf name&amp;gt;&lt;/code&gt;? Is it mandatory for &lt;code&gt;address-family vpnv4&lt;/code&gt; to have neighbor activated for vrf routes to be exchanged?&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2017-05-21T15:12:04.017" LastActivityDate="2018-01-04T17:56:23.787" Title="Understanding MP-BGP basics" Tags="|ipv4|bgp|vrf|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41345" PostTypeId="2" ParentId="41344" CreationDate="2017-05-21T17:05:30.727" Score="5" Body="&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;VPNv4 is the &quot;transport&quot;. Your VRF route-targets match on both devices. Long story short, RT is extcommunity that is sent over VPNv4 session in BGP update. If one of local import RTs matches received extcommunity, routes are being imported in VRF with this RT configured. Actually VPNv4 is quite complex and complete explanation is beyond the scope of this site.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;VPNv4 &lt;strong&gt;is not required&lt;/strong&gt; in order to run routing protocol inside VRF. Cisco calls it VRF-lite. Your problem with &lt;code&gt;Active&lt;/code&gt; state here is related to routing.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;address-family ipv4&#xA; neighbor 11.11.11.11 activate&#xA; no auto-summary&#xA; no synchronization&#xA;exit-address-family&#xA;!&#xA;address-family ipv4 vrf TEST22&#xA; redistribute static metric 10&#xA; neighbor 11.11.11.11 remote-as 1&#xA; neighbor 11.11.11.11 ebgp-multihop 2&#xA; neighbor 11.11.11.11 update-source Loopback0&#xA; neighbor 11.11.11.11 activate&#xA; no synchronization&#xA;exit-address-family&#xA;&lt;/code&gt;&lt;/pre&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Both IPv4 and IPv4 vrf TEST22 address families have Lo0 as the source. As long as IPv4 adjacency is &lt;code&gt;Established&lt;/code&gt; I assume Lo0 &lt;strong&gt;is not in VRF&lt;/strong&gt;. That makes your BGP source inaccessible.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastEditorUserId="29564" LastEditDate="2017-05-22T16:58:02.433" LastActivityDate="2017-05-22T16:58:02.433" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41346" PostTypeId="1" AcceptedAnswerId="41351" CreationDate="2017-05-21T22:04:37.327" Score="2" ViewCount="305" Body="&lt;p&gt;I`m having a query regarding VVRP,If there are multiple backups then as per the election Skew time is useful.But assume there is a tie in priority then as per my research i am seeing which is having the highest IP address will be the master.So kindly help me out in detail.Why skew matters if highest ip elects as the next master ???&lt;/p&gt;&#xA;" OwnerUserId="36954" LastActivityDate="2017-05-22T03:54:13.933" Title="VRRP Election ? Why Skew required" Tags="|switching|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41347" PostTypeId="2" ParentId="40958" CreationDate="2017-05-21T22:18:16.767" Score="2" Body="&lt;p&gt;Vlan concept is of reducing the Broadcast domains,So each valn should be in its own subnet.&#xA;Configure different subnets for each vlan then it will work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regards,&#xA;Harsha D&lt;/p&gt;&#xA;" OwnerUserId="36954" LastActivityDate="2017-05-21T22:18:16.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41348" PostTypeId="2" ParentId="36540" CreationDate="2017-05-21T22:28:41.970" Score="0" Body="&lt;p&gt;I belive there is a Netflow enabled in the router.If there is no netflow then configure the netflow.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before that try this command&#xA;&quot; Sh ip cache verbose flow &quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you can come to know the source/destination/packets everything thing information morethan you required in this command.&lt;/p&gt;&#xA;" OwnerUserId="36954" LastActivityDate="2017-05-21T22:28:41.970" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41349" PostTypeId="2" ParentId="41342" CreationDate="2017-05-22T03:29:41.690" Score="-1" Body="&lt;p&gt;Although your issue is cleared, here is your answer:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.juniper.net/documentation/en_US/junos12.3/topics/reference/command-summary/clear-ethernet-switching-table-bridging-ex-series.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;clear ethernet-switching table&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35590" LastActivityDate="2017-05-22T03:29:41.690" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="41350" PostTypeId="2" ParentId="41301" CreationDate="2017-05-22T03:46:11.050" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Yes you can. Check out i.e Contrail or NorthStar controller solutions from Juniper.&lt;/li&gt;&#xA;&lt;li&gt;Tremendously broad question which involves a) routing b)algorithms , this will take you both time to study.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="35590" LastActivityDate="2017-05-22T03:46:11.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41351" PostTypeId="2" ParentId="41346" CreationDate="2017-05-22T03:54:13.933" Score="1" Body="&lt;p&gt;The reason is when there are several competing devices, you want to reduce the churn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This &lt;a href=&quot;https://lkhill.com/vrrp-skew-time-and-always-be-learning/&quot; rel=&quot;nofollow noreferrer&quot;&gt;link&lt;/a&gt; can be give you more details:&lt;/p&gt;&#xA;" OwnerUserId="35590" LastActivityDate="2017-05-22T03:54:13.933" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41353" PostTypeId="1" AcceptedAnswerId="41354" CreationDate="2017-05-22T07:43:38.903" Score="0" ViewCount="115" Body="&lt;p&gt;I work in a very small software development team where we (just about) manage a couple of Cisco ASAs (model 5510, version 8.4).  None of us are Cisco experts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are attempting to increase our redundancy and during our discussions the following question came up.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can an ASA 5510 be configured to inspect a packets destination IP address, detect if the target machine is up and re-direct to a different IP address if it isn't?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My understanding was that this was a server farm management software function rather than a router function but one of our team thought that perhaps the ASA can do it as it's more than just a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If so, would anyone be able to tell me the name of the protocol/technology so I can do some research and learn how it works?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I turn to Stack Exchange because my research so far has only uncovered articles about failover and alternative links between routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any nudge in the correct general direction would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for taking the time to read my question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;J.M.&lt;/p&gt;&#xA;" OwnerUserId="36961" LastActivityDate="2017-05-22T10:46:44.197" Title="Cisco ASA 5510 - re-route to an alternative destination if server down" Tags="|cisco-asa|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41354" PostTypeId="2" ParentId="41353" CreationDate="2017-05-22T08:34:41.790" Score="2" Body="&lt;p&gt;ASA is a firewall and it can't act as load-balancer/proxy/etc.&lt;/p&gt;&#xA;" OwnerUserId="29556" LastActivityDate="2017-05-22T08:34:41.790" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41355" PostTypeId="2" ParentId="16947" CreationDate="2017-05-22T10:10:04.057" Score="4" Body="&lt;p&gt;&lt;a href=&quot;https://www.ietf.org/rfc/rfc2131.txt&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.ietf.org/rfc/rfc2131.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per this RFC:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Droms                       Standards Track                    [Page 24]&#xA;&#xA;RFC 2131          Dynamic Host Configuration Protocol         March 1997&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Normally, DHCP servers and BOOTP relay agents attempt to deliver&#xA;   DHCPOFFER, DHCPACK and DHCPNAK messages directly to the client using&#xA;   uicast delivery.  The IP destination address (in the IP header) is&#xA;   set to the DHCP 'yiaddr' address and the link-layer destination&#xA;   address is set to the DHCP 'chaddr' address.  Unfortunately, some&#xA;   client implementations are unable to receive such unicast IP&#xA;   datagrams until the implementation has been configured with a valid&#xA;   IP address (leading to a deadlock in which the client's IP address&#xA;   cannot be delivered until the client has been configured with an IP&#xA;   address).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A client that cannot receive unicast IP datagrams until its protocol&#xA;   software has been configured with an IP address SHOULD set the&#xA;   BROADCAST bit in the 'flags' field to 1 in any DHCPDISCOVER or&#xA;   DHCPREQUEST messages that client sends.  The BROADCAST bit will&#xA;   provide a hint to the DHCP server and BOOTP relay agent to broadcast&#xA;   any messages to the client on the client's subnet.  A client that can&#xA;   receive unicast IP datagrams before its protocol software has been&#xA;   configured SHOULD clear the BROADCAST bit to 0.  The BOOTP&#xA;   clarifications document discusses the ramifications of the use of the&#xA;   BROADCAST bit [21].&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A server or relay agent sending or relaying a DHCP message directly&#xA;   to a DHCP client (i.e., not to a relay agent specified in the&#xA;   'giaddr' field) SHOULD examine the BROADCAST bit in the 'flags'&#xA;   field.  If this bit is set to 1, the DHCP message SHOULD be sent as&#xA;   an IP broadcast using an IP broadcast address (preferably 0xffffffff)&#xA;   as the IP destination address and the link-layer broadcast address as&#xA;   the link-layer destination address.  If the BROADCAST bit is cleared&#xA;   to 0, the message SHOULD be sent as an IP unicast to the IP address&#xA;   specified in the 'yiaddr' field and the link-layer address specified&#xA;   in the 'chaddr' field.  If unicasting is not possible, the message&#xA;   MAY be sent as an IP broadcast using an IP broadcast address&#xA;   (preferably 0xffffffff) as the IP destination address and the link-&#xA;   layer broadcast address as the link-layer destination address.&lt;/p&gt;&#xA;" OwnerUserId="36963" LastActivityDate="2017-05-22T10:10:04.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41357" PostTypeId="2" ParentId="41353" CreationDate="2017-05-22T10:46:44.197" Score="1" Body="&lt;p&gt;There is one way to approach this with just an ASA by using a feature called tracking. Essentially what it does is use some sort of test (typically a ping) to track the availability of a resource, and add/remove a static route from the ASA's routing table depending on the status&lt;/p&gt;&#xA;&#xA;&lt;p&gt;See : &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/route_static.html#61801&quot; rel=&quot;nofollow noreferrer&quot;&gt;ASA Config Guide: Configuring Static and Default Routes&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I assume you are trying to do this for a set of servers. Let's say you have two servers, A and B, and you want them to be accessible through a shared IP IPV.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this case you could create a loopback interface on each of the servers with the IPV address, and then use tracking to manage two static routes towards IPV/32:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;One towards the IP of server A, which you associate with a tracking on that same IP.&lt;/li&gt;&#xA;&lt;li&gt;One towards the IP of server B, which you create with a higher admin distance than is normal for static routes, such that it will only be used if the first route is not in the routing table.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Note that this is not a highly intuitive solution, so I would encourage you to use an actual load balancing system (like Microsoft NLB if you are in a Windows environment) rather than resorting to something like this which you may have difficulty troubleshooting over time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, if you are trying to manage not different servers but different Internet links, you can use the tracking feature there as well.&lt;/p&gt;&#xA;" OwnerUserId="21892" LastActivityDate="2017-05-22T10:46:44.197" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41361" PostTypeId="1" CreationDate="2017-05-22T14:26:22.733" Score="1" ViewCount="139" Body="&lt;p&gt;I am working on replacing Cisco AS5350 with Cisco ISR 2900 series , on the old setup I have only one profile to apply for the incoming calls and one IP Pool, but with the new setup I have new requirements to recognize between two types of users and assign them different IP's from different pools and apply different ACL (Two template interfaces) .&#xA;I am wondering if it is possible to recognize the incoming calls based on the dialed number and assign them the connection template based on that? then I will use  different calling number for each group of users. if any one have configuration example for that please share &lt;/p&gt;&#xA;" OwnerUserId="1906" LastActivityDate="2017-05-22T14:26:22.733" Title="Configuring Cisco ISR router as dial-up server" Tags="|cisco|wan|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41364" PostTypeId="1" AcceptedAnswerId="41368" CreationDate="2017-05-22T15:27:15.363" Score="0" ViewCount="83" Body="&lt;p&gt;I'm studying for my networking finals and this thought experiment crossed my mind.&#xA;I was told that as long as two hosts are in the same subnet they can communicate by using only ARP requests skipping the default-gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's suppose that we connect two hosts with a single cable. Is there anything in operating systems or NIC drivers which would prevent two hosts communicating (in the aforementioned way) in subnet /0? Can you essentially create your &quot;own local internet&quot; with all IPv4 (or IPv6) addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the same setup is it possible to block all communication by setting subnet mask to be /32?&lt;/p&gt;&#xA;" OwnerUserId="36971" LastActivityDate="2017-05-22T19:24:14.260" Title="Would two hosts with arbitrary IPs communicate with /0 mask in the same subnet?" Tags="|ipv4|subnet|ipv6|" AnswerCount="1" CommentCount="1" ClosedDate="2017-05-22T19:20:57.187" ContentLicense="CC BY-SA 3.0" />
  <row Id="41366" PostTypeId="2" ParentId="39437" CreationDate="2017-05-22T15:57:01.790" Score="2" Body="&lt;p&gt;Mar  2 15:36:55.369155 authd_create_application_specific_radius_server: No authentication-server list configured&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It seems you missed radius server in &quot;profile local-kpn&quot;. Try following configuration :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;profile local-kpn {  &#xA;    accounting-order radius;  &#xA;    authentication-order radius;  &#xA;    radius {  &#xA;        authentication-server 10.10.10.18;  &#xA;        accounting-server 10.10.10.18;  &#xA;    }      &#xA;    accounting {  &#xA;        order radius;  &#xA;    }  &#xA;}  &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36974" LastEditorUserId="8499" LastEditDate="2017-05-22T19:18:17.630" LastActivityDate="2017-05-22T19:18:17.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41368" PostTypeId="2" ParentId="41364" CreationDate="2017-05-22T17:27:41.197" Score="0" Body="&lt;p&gt;I don't know platform that allows IP address with mask of 0. So generally the answer is you simply can't use /0.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the other hand if route is pointing to the interface, hosts with /32 masks can reach each other. Again, not each host allows /32 on the interface configured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Linux does allow /0 CIDR notation. Behavior doesn't really change: you still can access hosts on shared segment with ip route via interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;General answer:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If host supports particular CIDR notation and routes are pointing to the interface, it can reach other hosts with similar route configuration. Mask doesn't really matter in this case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Note:&lt;/strong&gt; all of above may be useful for educational purposes but is almost not applicable in practice. Don't do this in production.&lt;/p&gt;&#xA;" OwnerUserId="29564" LastEditorUserId="29564" LastEditDate="2017-05-22T19:24:14.260" LastActivityDate="2017-05-22T19:24:14.260" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41370" PostTypeId="2" ParentId="41295" CreationDate="2017-05-22T20:11:32.777" Score="0" Body="&lt;p&gt;There could be one of at least two possible things going on here:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1.) You don't have a strong enough signal from your monitor to the client.  The AP's antennae are better at listening and sorting out background noise than your PC is.  You might need to move closer to the client you're trying to listen to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;2.) Your NIC doesn't support promiscuous mode.  There are many out there that are hardcoded to ignore traffic they aren't supposed to interact with or see.  The only workaround for this is to purchase a NIC that supports promiscuous mode.  You can probably search around for your current NIC model and the term 'promiscuous mode' to see if other people have had similar issues.&lt;/p&gt;&#xA;" OwnerUserId="74" LastActivityDate="2017-05-22T20:11:32.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41374" PostTypeId="2" ParentId="35205" CreationDate="2017-05-22T23:16:49.043" Score="0" Body="&lt;p&gt;If you're viewing individual interfaces and seeing that they're said to be on a certain VLAN, you can configure those interfaces to remove them: &lt;code&gt;conf t&lt;/code&gt; -&gt; &lt;code&gt;int fa(x)/(y)&lt;/code&gt; -&gt; &lt;code&gt;no vlan (z)&lt;/code&gt; and this can alleviate VLAN issues related to those specific interfaces.&lt;/p&gt;&#xA;" OwnerUserId="36261" LastActivityDate="2017-05-22T23:16:49.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41375" PostTypeId="2" ParentId="41306" CreationDate="2017-05-22T23:57:32.090" Score="1" Body="&lt;p&gt;Designing WiFi networks for high density is not a matter of increasing the number of access points and controllers. If it was, we'd all be getting great WiFi service at conferences and stadiums by now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are physical restrictions dictated by available radio frequency bandwidth in any given physical space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the event in one large exhibition hall / conference space or multiple rooms?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the size of each room?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How many users are expected in each room?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How many &lt;strong&gt;concurrent&lt;/strong&gt; users must be supported in each room?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where can Access Points be mounted? If ceiling only, how high is the ceiling?&lt;/p&gt;&#xA;" OwnerUserId="16288" LastActivityDate="2017-05-22T23:57:32.090" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="41376" PostTypeId="1" AcceptedAnswerId="41377" CreationDate="2017-05-23T00:28:52.597" Score="6" ViewCount="57935" Body="&lt;p&gt;How IP helper address works and what is the difference between dhcp and IP helper-address .please explain in brief.&lt;/p&gt;&#xA;" OwnerUserId="36954" LastEditorUserId="8499" LastEditDate="2018-12-25T05:13:38.340" LastActivityDate="2021-10-07T13:40:42.027" Title="How IP helper address works?" Tags="|cisco|routing|dhcp|switching|cisco-commands|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41377" PostTypeId="2" ParentId="41376" CreationDate="2017-05-23T00:42:50.490" Score="8" Body="&lt;p&gt;Using the &lt;code&gt;ip helper-address&lt;/code&gt; command sets up a DHCP relay. DHCP only works on the LAN to which it is connected because it uses broadcast, which cannot cross a router. To remedy that situation, DHCP relay was created. It gives DHCP an option so that a router intercepts the DHCP client's broadcast request, creates a unicast request to the DHCP server on a different LAN, and the DHCP server can give a unicast response to the router based on the DHCP option, that then passes on the DHCP response to the requesting DHCP client.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-23T00:42:50.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41378" PostTypeId="2" ParentId="41376" CreationDate="2017-05-23T02:58:44.253" Score="6" Body="&lt;p&gt;To add to Ron's great answer: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key piece of this is that the Router sending the DHCP request on behalf of the client will unicast the request with a source address from the address space the client is in (the interface the relay/helper-address is configured on).  This is ensures the DHCP server offers an IP from the correct scope.  &lt;/p&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-05-23T02:58:44.253" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41380" PostTypeId="1" CreationDate="2017-05-23T12:20:00.227" Score="0" ViewCount="759" Body="&lt;p&gt;I am trying to send a ping from one subnet to another in cisco packet tracer. The PC sends the packet to the switch, and then to the router of the same subnet via gigabitEthernet (192.168.24.1) and then is sent to the main router of the network on serial connection, from the serial address 192.168.16.1 to the serial on main router 192.168.16.2. The router should then send it to the next subnet, 192.168.24.1, but instead it continiously bounces back between the original subnet router and the main subnet router. Any help with this would be appreciated, thanks!&lt;/p&gt;&#xA;" OwnerUserId="36990" LastActivityDate="2017-05-23T13:02:56.783" Title="Packets stuck between two routers" Tags="|cisco|subnet|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41381" PostTypeId="1" AcceptedAnswerId="41383" CreationDate="2017-05-23T12:52:49.200" Score="3" ViewCount="31205" Body="&lt;p&gt;I know that the range of standard VLAN is 1-1005 and in extended VLAN the range is 1-4094.&lt;br&gt;&#xA;But is just range is the difference?&lt;/p&gt;&#xA;" OwnerUserId="36791" LastEditorUserId="36992" LastEditDate="2017-05-23T14:49:25.600" LastActivityDate="2017-05-23T15:03:24.877" Title="What is difference between standard VLAN extended VLAN?" Tags="|cisco|switch|vlan|layer2|trunk|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41382" PostTypeId="2" ParentId="41380" CreationDate="2017-05-23T13:02:56.783" Score="1" Body="&lt;p&gt;The answer will almost certainly be found in the routing table of the router that sends the packet in an unexpected direction. In your case that seems to be the &quot;central router&quot;.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Is there a route for the network in question?&lt;/li&gt;&#xA;&lt;li&gt;If so does it point to the right interface and nexthop?&lt;/li&gt;&#xA;&lt;li&gt;If so are there any other routes with the same or greater specificness that could route the traffic in a different direction.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Assuming you are using static routes I suspect the most likely explanation is that you made a typo when setting up the route.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-23T13:02:56.783" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41383" PostTypeId="2" ParentId="41381" CreationDate="2017-05-23T13:08:52.440" Score="7" Body="&lt;p&gt;VLAN are introduced by the &lt;a href=&quot;http://standards.ieee.org/getieee802/download/802.1Q-2003.pdf&quot; rel=&quot;noreferrer&quot;&gt;IEEE 802.1Q standard&lt;/a&gt;, which doesn't have this notion of standard or extended VLAN, nor made any difference between VLAN under or above 1005.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is Cisco implementation that introduce this segregation.&#xA;The first Cisco implementation actually supported only VLAN up to 1001, and Cisco reserved VLAN 1002-1005 for FDDI and Token Ring. They added support for VLAN 1006-4094 later, and called them &quot;Extended VLAN&quot;. My guess is that since it was an addition, and probably to enforce backward compatibility, those VLAN are technically different, within Cisco IOS&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Quoted from &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/12_4t/12_4t15/ht_xvlan.html#wp1049404&quot; rel=&quot;noreferrer&quot;&gt;Extended VLAN ID&lt;/a&gt; (Disclaimer: this document date from 2007 and part of the content may be outdated)&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Before Cisco IOS Release 12.4(15)T, users were permitted to configure&#xA;  VLANs numbered from 2 to 1001. The remaining VLANs (numbered from 1006&#xA;  to 4094) were reserved for use as internal VLANs configured by&#xA;  applications. Beginning with Cisco IOS Release 12.4(15)T, all VLAN&#xA;  numbers except those reserved for default and reserved VLANs are&#xA;  available for user configuration. The result is that users and&#xA;  applications share the VLAN number space from 1006 to 4094.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You can find in &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/vlans.html&quot; rel=&quot;noreferrer&quot;&gt;this documentation&lt;/a&gt; for example this table:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/acJOb.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/acJOb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that as pointed out by @Andriy Berestovskyy this table is outdated and Extended VLANs are propagated by VTP version 3&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-05-23T14:03:27.737" LastActivityDate="2017-05-23T14:03:27.737" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41384" PostTypeId="2" ParentId="41381" CreationDate="2017-05-23T13:31:13.647" Score="1" Body="&lt;p&gt;AFAIR, there are just two differences:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Only VTP version 3 supports extended VLAN propagation:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Support for extended range VLAN (VLANs 1006 to 4094) database propagation. VTP versions 1 and 2 propagate only VLANs 1 to 1005.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wp1316856&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wp1316856&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;Extended VLANs are VTP pruning-ineligible, i.e. they have to be pruned manually:&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Extended-range VLANs (VLAN IDs higher than 1005) are also pruning-ineligible.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wp1308874&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swvtp.html#wp1308874&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36992" LastEditorUserId="36992" LastEditDate="2017-05-23T15:03:24.877" LastActivityDate="2017-05-23T15:03:24.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41386" PostTypeId="2" ParentId="40820" CreationDate="2017-05-23T14:52:19.473" Score="1" Body="&lt;p&gt;Seems that configuration of SSL VPN is not completed or incorrect (according to provided part of config). Try to read this &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/200533-AnyConnect-Configure-Basic-SSLVPN-for-I.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;guide&lt;/a&gt; and do a walk thru steps in it.&lt;/p&gt;&#xA;" OwnerUserId="29556" LastActivityDate="2017-05-23T14:52:19.473" CommentCount="12" ContentLicense="CC BY-SA 3.0" />
  <row Id="41387" PostTypeId="1" AcceptedAnswerId="41389" CreationDate="2017-05-23T15:36:37.640" Score="0" ViewCount="1967" Body="&lt;p&gt;Let's say I have three different hosts connected by a Layer 2 Switch:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A) IP 1.0.0.1, Subnet 255.255.255.0, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;B) IP 1.0.0.2, Subnet 255.255.0.0, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;C) IP 1.0.1.1, Subnet 255.255.255.0,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Who would a broadcast message (like an arp request) from each machine reach? I know that if the arp tables were pre-generated, you could send non-broadcast packets directly from A-&gt; B, B-&gt;A, and B-&gt;C , while A-&gt;C, C-&gt;A, and C-&gt;B would be send to the default gateway and fail. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know that connecting subnets like this is non-ideal, I was just wondering how communications work when it's done accidentally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a second question, let's say that they're now connected by a Layer 3 Switch (A Router?) Am I correct in thinking that a ping from B to C would go from B -&gt; C, and the response would go from C -&gt; R -&gt; B?&lt;/p&gt;&#xA;" OwnerUserId="36996" LastEditorUserId="36996" LastEditDate="2017-05-23T15:57:24.350" LastActivityDate="2017-05-23T19:31:47.750" Title="How do broadcast communications work between hosts with different Subnet Masks?" Tags="|routing|subnet|lan|switching|broadcast|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41389" PostTypeId="2" ParentId="41387" CreationDate="2017-05-23T16:14:24.127" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Who would a broadcast message (like an arp request) from each machine reach?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ethernet broadcasts from any host will reach any host connected to the same switch/VLAN. IP broadcasts will not reach any of those hosts, because each host has its own broadcast IP address.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;a ping from B to C would go from B -&gt; C, and the response would go from C -&gt; R -&gt; B?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, if we have static ARP entries for all the hosts, that will be true.&lt;/p&gt;&#xA;" OwnerUserId="36992" LastActivityDate="2017-05-23T16:14:24.127" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41391" PostTypeId="1" AcceptedAnswerId="41393" CreationDate="2017-05-23T18:03:18.510" Score="5" ViewCount="20499" Body="&lt;p&gt;I'm educating myself on how to terminate Cat 6a cables. I've seen some articles talk about &quot;grounding&quot; requirements because of the &quot;shielding&quot; in the cables. But is grounding a concern if I'm just connecting two devices directly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I have a spool of Cat6a cable and I crimp on my own RJ45 shielded connectors, and then I use this cable to connect a router and a switch (for example), do I need to care about grounding? I'm not going through a wall jack. The two devices would be connected directly together.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies if I'm misusing terminology and making this question unclear or confusing.&lt;/p&gt;&#xA;" OwnerUserId="37003" LastEditorUserId="8499" LastEditDate="2018-03-20T23:30:56.307" LastActivityDate="2020-07-15T15:13:27.427" Title="When is &quot;grounding&quot; a concern when running Cat6a cables?" Tags="|ethernet|layer1|cabling|cable|utp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41392" PostTypeId="1" CreationDate="2017-05-23T18:03:52.323" Score="5" ViewCount="1279" Body="&lt;p&gt;I know that cable ISPs use HFC, while DSL uses classic twisted pair. Is the shared medium an intrinsic side effect of a coaxial cable? Couldn't you set up a twisted pair infrastructure to also be a shared medium? Could you set up a coaxial network not to be a shared medium? Is it just a difference in logistic strategy? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: I don't have enough rep to comment, so this will have to do: Thanks Peter!&lt;/p&gt;&#xA;" OwnerUserId="37004" LastEditorUserId="37005" LastEditDate="2017-05-23T23:14:35.647" LastActivityDate="2017-05-23T23:14:35.647" Title="Is the fact that cable internet access is a shared medium intrinsic to its HFC infrastructure?" Tags="|cable|network|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41393" PostTypeId="2" ParentId="41391" CreationDate="2017-05-23T18:11:38.697" Score="5" Body="&lt;p&gt;Category-6a cabling is UTP (&lt;em&gt;Unshielded&lt;/em&gt; Twisted Pair) cabling. If your cable has a shield, it is something else. Any shielded cable must be properly grounded. That requires connectors and equipment that properly ground the shield, at least on both ends. Improperly-grounded, shielded cable will be a problem because the shield will exacerbate the problems it is meant to prevent.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If you really want to learn how to do this correctly, you will need to get (buy or rent) a very expensive cable tester to see if what you terminate actually passes the Category-6a test suite. Building Category-6a patch cables is something I have never seen even experienced installers be able to do and get it to pass the test suite. I have only seen factory built patch cords be able to pass the test suite for Category-6 and Category-6a.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-23T18:11:38.697" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41394" PostTypeId="1" AcceptedAnswerId="41397" CreationDate="2017-05-23T18:19:44.720" Score="0" ViewCount="455" Body="&lt;p&gt;I am being tasked with setting up about 15 PCs to be used as digital signage at my job. These PCs are not allowed to be connected to our internal network/intranet. We do have one Mac workstation that will be connected to our intranet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I'm trying to achieve:&#xA;I need to be able remote into the Mac PC from any workstation in our intranet. From there I need to be able to exchange files with any one of the 15 PCs connected to the Mac. We need the 15 PC assets to be completely isolated and invisible to the rest of the intranet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions are:&#xA;What sort of hardware arrangement would I need to achieve this? How should everything be connected?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do I only need a Layer 3 switch? Are their any particular features in a L3 switch I should be looking for when shopping for one?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please excuse the diagram. I am not a network professional and I'm not sure if I am asking the right question(s).&lt;img src=&quot;https://i.stack.imgur.com/8TZZW.png&quot; alt=&quot;poor diagram&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: To clarify, in regards to the PCs attached to the Mac, I am concerned less about security and more about flying under the radar.&lt;/p&gt;&#xA;" OwnerUserId="37006" LastEditorUserId="37006" LastEditDate="2017-05-23T19:23:53.983" LastActivityDate="2017-05-23T19:23:53.983" Title="How can I set up a VLAN to be firewalled from our intranet?" Tags="|vlan|private-vlan|" AnswerCount="2" CommentCount="1" ClosedDate="2017-05-23T23:36:59.350" ContentLicense="CC BY-SA 3.0" />
  <row Id="41395" PostTypeId="2" ParentId="41394" CreationDate="2017-05-23T18:31:26.833" Score="0" Body="&lt;p&gt;That is what firewalls do. You can use a firewall to isolate parts of your network. This is common in large business networks where labs or other network segments must be isolated from the rest of the network. You install the firewall so that the isolated network is on an outside firewall interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could use ACLs in a router or layer-3 switch to block any traffic to or from the network, too. The difference being that the firewall is stateful, but ACLs are stateless (static). A firewall could be configured to allow fine-grained access from your network to the isolated network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your drawing where you have a host (MAC connected to both networks actually defeats any security that you are trying to implement. If you are concerned that the 15 PCs could try to compromise your network, the MAC defeats that if it is compromised.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-23T18:31:26.833" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41396" PostTypeId="1" AcceptedAnswerId="41402" CreationDate="2017-05-23T18:54:27.203" Score="1" ViewCount="969" Body="&lt;p&gt;I have 2 routers R1 and R2 linearly connected. &#xA;R1's lo0 is in a vrf.&#xA;R1 has the below config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sho run int lo0&#xA;Building configuration...&#xA;&#xA;Current configuration : 81 bytes&#xA;!&#xA;interface Loopback0&#xA; ip vrf forwarding TEST&#xA; ip address 3.3.3.3 255.0.0.0&#xA;end&#xA;&#xA;&#xA;&#xA;R1#sho ip int brief | i up&#xA;FastEthernet0/0            1.1.1.1         YES manual up                    up&#xA;Loopback0                  3.3.3.3         YES manual up                    up&#xA;R1#&#xA;R1#&#xA;R1#sho run | sec route&#xA;ip route vrf TEST 0.0.0.0 0.0.0.0 1.1.1.2 global&#xA;R1#&#xA;R1#sho run | sec vrf&#xA;ip vrf TEST&#xA; ip vrf forwarding TEST&#xA;ip route vrf TEST 0.0.0.0 0.0.0.0 1.1.1.2 global&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R2 has the below config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sho ip int bri | i up&#xA;FastEthernet0/0            1.1.1.2         YES manual up                    up&#xA;Loopback0                  100.0.0.1       YES manual up                    up&#xA;R2#&#xA;R2#sho run | sec route&#xA;ip route 0.0.0.0 0.0.0.0 1.1.1.1&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I want to ping from R2 to vrf lo0 of R1; but it fails, even though i have configured static route leaking.&#xA;Please suggest why it fails&lt;/p&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2017-05-24T00:04:14.260" Title="Route leaking using static route" Tags="|router|ip|ping|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41397" PostTypeId="2" ParentId="41394" CreationDate="2017-05-23T19:01:35.963" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Configure a separate VLAN for your PCs, say VLAN 100.&lt;/li&gt;&#xA;&lt;li&gt;Assign all the PCs ports to this VLAN 100.&lt;/li&gt;&#xA;&lt;li&gt;Configure a subnet for your PCs, say 172.16.0/24&lt;/li&gt;&#xA;&lt;li&gt;Configure your Mac1 port as a 802.1q trunk, so your Mac1 will be connected both to the PCs VLAN 100 and to the Intranet VLAN.&lt;/li&gt;&#xA;&lt;li&gt;Configure a sub interface on Mac1 for VLAN 100 so it also has an IP form the 172.16.0/24 subnet.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;If you have an issue configuring VLAN/trunk port on your existing switch, you can use another switch for PCs and use two NICs on your Mac1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note, that unless you explicitly configure your PCs with a default gateway and your Intranet workstations with a static route, there will be no connectivity between the workstations and PCs as desired.&lt;/p&gt;&#xA;" OwnerUserId="36992" LastActivityDate="2017-05-23T19:01:35.963" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41398" PostTypeId="2" ParentId="41392" CreationDate="2017-05-23T19:07:29.280" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the shared medium an intrinsic side effect of a coaxial cable?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Couldn't you set up a twisted pair infrastructure to also be a shared medium?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It's theoretically possible but not really practical.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Could you set up a coaxial network not to be a shared medium?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;You certainly could, but it would likely be a relatively expensive option.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it just a difference in logistic strategy? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Partly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cable networks were primerally designed for broadcasting TV. Coax has the ability to support wide signal bandwidths and high signal powers making it suitable for broadcasting TV to lots of clients from one headend. It's relatively expensive though, so passive splitters close to the clients are the order of the day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The phone network was/is a system designed for carrying phone calls. Twisted pair cable is relatively cheap allowing each client to be given their own pair back to the telephone exchange, however it has poor high-freqency/high power characteristics.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Neither network is ideal for carrying high-speed internet service, but few providers want to rip up their networks and start from scratch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the phone network side DSL uses has to use clever modulation tricks to correct for the crappiness of the cable and extend the usable bandwidth but the throughput is still poor, especially if the cable run is long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the cable network side you have a few challanges to data service. Firstly a significant portion of the available bandwidth is taken up by TV services. Secondly what is left for internet service is shared. Thirdly the splitters make the signal path very lossy, this is not so much of a problem in the downstream direction where you have a big amplifier at the transmitter and little interference at the receiver but is much more of a problem in the upstream direction where you have a small amplifier at the transmitter and lots of interference at the receiver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Combining the crappy high-frequency behaviour of twisted pair cable with the splitting losses and shared nature of a cable TV like network layout would result in terrible performance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Optical fiber offers both very high bandwidths and cheap cable. The downside is that it requires more expensive tooling and more careful handling. Optical is the obvious choice for newcomers to the market but existing providers with a large deployed base of copper and a large staff used to dealing with copper are more reluctant to switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many existing providers have moved towards hybrid systems. Fiber is run to street cabinet and then VDSL or cable is run to the final customer site. Performance is improved over traditional systems because the length of the copper run is shortened and in the case of cable the level of sharing may also be reduced. This hybrid approach can deliver performance gains to an existing network at a lower initial cost than a complete move to fiber. However it means that active equipment must be maintained in the field.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-05-23T19:55:33.200" LastActivityDate="2017-05-23T19:55:33.200" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41400" PostTypeId="2" ParentId="41387" CreationDate="2017-05-23T19:31:47.750" Score="1" Body="&lt;p&gt;Switch is a layer 2 device.&#xA;IP addresses or subnet masks are above masks are above the switch's pay grade:p&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So in between these hosts if you connected a switch, the broadcast messages will be sent to all interfaces unless you have configured additional VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If we have a router is connected between these hosts, there is no broadcasts in IP as such and it is completely normal for router to have different interfaces in different subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it has a route for these hosts, the communication can take place.&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-05-23T19:31:47.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41401" PostTypeId="2" ParentId="32696" CreationDate="2017-05-23T19:36:28.230" Score="0" Body="&lt;p&gt;Yes it is possible to run two Ethernet lines down one four-pair cat 5 cable. There are some caveats though.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;You will need a splitter box/cable at both ends of the cable run and two seperate ports on the existing hub/switch. &lt;/li&gt;&#xA;&lt;li&gt;This will work for 10BASE-T and 100BASE-TX but not for 1000BASE-T.&lt;/li&gt;&#xA;&lt;li&gt;POE may not work depending on the particular POE implementation in use. &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-23T19:36:28.230" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41402" PostTypeId="2" ParentId="41396" CreationDate="2017-05-23T20:35:15.143" Score="5" Body="&lt;p&gt;The global table on R1 has no idea how to get to 3.3.3.3 in vrf TEST.  You will have to import the loopback into the global table.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-23T20:35:15.143" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41405" PostTypeId="2" ParentId="41396" CreationDate="2017-05-24T00:04:14.260" Score="2" Body="&lt;p&gt;Think of your VRF as another router and draw it out that way.  If R2 needs to ping 3.3.3.3, you've configured it to send the traffic to 1.1.1.1. Which is great, however, 1.1.1.1 (R1 - global VRF) does not have a route to 3.3.3.3 and will drop the traffic.  You will need to tell R1 to send traffic for 3.3.3.3 into the VRF, and then tell the VRF to send traffic out to 1.1.1.1 to reply. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also need a route in the R1 Global table for 100.0.0.1 pointing to 1.1.1.2 if you want to ping 3.3.3.3 from R2's loopback.  &lt;/p&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-05-24T00:04:14.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41409" PostTypeId="1" CreationDate="2017-05-24T04:06:37.707" Score="0" ViewCount="12767" Body="&lt;p&gt;I am following Huawei user guide to enable telnet server and telnet service to a port. However, whenever I am trying to do a telnet, I see this error and the connection times out - &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;HUAWEI %%01SOCKET/4/TCP_AUTH_FAILED(s)[45]:TCP authentication failed.  (AuthenticationType=KeyChain, Cause=no local digest, SourceAddress=21.13.30.147, SourcePort=22, ForeignAddress=10.42.87.97, ForeignPort=45387, Protocol=Unknow Protocol, VpnInstanceName=)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't what am I missing here. How to troubleshoot this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This router is connected with a normal switch and I am trying to access this through my PC. I can access the interface IP - 21.13.30.147 but I can't telnet or ssh. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my display this for aaa&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[HUAWEI-aaa]display this&#xA;#&#xA;aaa&#xA; local-user root password cipher $1a$$z[[J^af*7$D/giK-@j'9.qB&quot;9$$p&amp;gt;!&amp;lt;k&amp;gt;*Yd.IE,{Dnv(.tbDG$&#xA; local-user root service-type terminal telnet ssh&#xA; local-user root level 15&#xA; local-user root state active&#xA; local-user root access-limit 48&#xA; authentication-scheme default0&#xA; authentication-scheme default1&#xA; authentication-scheme default&#xA;  authentication-mode local radius&#xA; authentication-scheme l-h&#xA;  authentication-mode local&#xA; authentication-scheme telnetcheck&#xA;  authentication-mode local&#xA; #&#xA; authorization-scheme default&#xA; #&#xA; accounting-scheme default0&#xA; accounting-scheme default1&#xA; accounting-scheme default&#xA; #&#xA; domain default_admin&#xA;  accounting-scheme default0&#xA; domain default_8021x                     &#xA;  accounting-scheme default0&#xA; #&#xA;#&#xA;return&#xA;[HUAWEI-aaa]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are the details &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;HUAWEI&amp;gt;display version &#xA;Huawei Versatile Routing Platform Software&#xA;VRP (R) software, Version 5.160 (ATN 910I DC V200R005C00SPC100)&#xA;Copyright (C) 2013-2014 Huawei Technologies Co., Ltd.&#xA;HUAWEI ATN 910I DC uptime is 0 day, 13 hours, 17 minutes&#xA;ATN 910I DC version information:&#xA;&#xA;- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -&#xA;CXP version information:&#xA;&#xA;CXP(Master) 2  : uptime is 0 day, 13 hours, 17 minutes&#xA;         StartupTime   2017/05/24   23:37:47 &#xA;  SDRAM Memory Size   : 512M bytes&#xA;  FLASH Memory Size   : 128M bytes&#xA;  CFCARD Memory Size : 122M bytes &#xA;  CXP version information&#xA;  PCB         Version : 910I DC REV B&#xA;  FPGA1       Version : V220&#xA;  CPLD1       Version : V200&#xA;  PE          Version : 000&#xA;  BootROM     Version : 8.60.69&#xA;  BootLoad    Version : 9.60.69&#xA;  Software    Version : Version 5.160 RELEASE 0001&#xA;&amp;lt;HUAWEI&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here are other configs &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;[HUAWEI]display this&#xA;#&#xA;sysname HUAWEI&#xA;#&#xA;vlan batch 100&#xA;#&#xA;undo telnet ipv6 server enable&#xA;#&#xA;radius enable&#xA;#&#xA;energy conservation disable&#xA;#&#xA;over-temperature protection enable&#xA;#&#xA;lldp enable&#xA;#&#xA;ip route-static 10.0.0.0 255.255.0.0 NULL0&#xA;ip route-static 10.0.0.0 255.255.0.0 GigabitEthernet0/2/5&#xA;ip route-static 10.0.0.0 255.255.255.0 LoopBack0&#xA;ip route-static 10.12.0.0 255.255.0.0 11.213.60.1&#xA;ip route-static 10.16.0.0 255.255.0.0 11.213.60.1&#xA;ip route-static 11.213.0.0 255.255.0.0 11.213.60.1&#xA;#&#xA;undo ssh server compatible-ssh1x enable&#xA;stelnet server enable&#xA;ssh user root                             &#xA;ssh user root authentication-type password&#xA;ssh user root service-type stelnet&#xA;#&#xA;lldp enable-dcn authentication %#%#H=9zRo)P=5!)wNK={pB4MHFo&quot;(c#3VxQ7GL&quot;k&amp;lt;bD%#%#&#xA;#&#xA;return&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What is the authentication problem here. I am using aaa authentication on vty 0 -14.&lt;/p&gt;&#xA;" OwnerUserId="13278" LastEditorUserId="13278" LastEditDate="2017-05-26T04:16:57.390" LastActivityDate="2024-01-26T03:08:00.983" Title="Huawei Router Telnet and SSH configuration - Authentication" Tags="|router|huawei|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41415" PostTypeId="1" AcceptedAnswerId="41416" CreationDate="2017-05-24T09:26:13.717" Score="0" ViewCount="4363" Body="&lt;h2&gt;Heading&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Below is a network map for a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/NjZ5e.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/NjZ5e.png&quot; alt=&quot;Network map&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router &lt;code&gt;192.168.0.1&lt;/code&gt; has DHCP enabled. Routers &lt;code&gt;0.2&lt;/code&gt;, &lt;code&gt;0.3&lt;/code&gt;, and &lt;code&gt;0.4&lt;/code&gt; are connected via their LAN ports to router 0.1 by ethernet cable, and have DHCP disabled so that they act as access points. They each have separate SSIDs (the top line in the box for each, &lt;code&gt;Room 1&lt;/code&gt;, &lt;code&gt;Room 2&lt;/code&gt;, etc). Router &lt;code&gt;192.168.0.1&lt;/code&gt; distributes IPs in the range &lt;code&gt;192.168.0.40-254&lt;/code&gt;, as the printers/server have fixed IPs in the &lt;code&gt;.30&lt;/code&gt;s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router &lt;code&gt;Nextbuildingover&lt;/code&gt; (top right) is connected to &lt;code&gt;192.168.0.1&lt;/code&gt; over fibre, through a set of media converters. On the &lt;code&gt;Nextbuildingover&lt;/code&gt; router, the ethernet cable from the media converter goes into the WAN port. It has the IP &lt;code&gt;192.168.1.1&lt;/code&gt;, and has DHCP enabled, in the range &lt;code&gt;192.168.1.100-254&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the fact the &lt;code&gt;Nextbuildingover&lt;/code&gt; router is connected like this correct? Would it be better to connect it via a LAN port, give it the IP &lt;code&gt;192.168.0.5&lt;/code&gt; and turn off DCHP work better, or does the fact it goes over fibre change things?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from the &lt;code&gt;Nextbuildingover&lt;/code&gt; router, are routers &lt;code&gt;0.2&lt;/code&gt;, &lt;code&gt;0.3&lt;/code&gt;, and &lt;code&gt;0.4&lt;/code&gt; set up correctly? I have read conflicting advice, some saying they should have the same SSID, and others saying they need to be set up as bridges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are around 30 users across the access points. We frequently need to reset routers/access points to get things working again after the internet connection drops and laptops report 'No internet connection'. I don't know if it is caused by an incorrect setup, or cheap hardware. All hardware is TP Link, of various models.&lt;/p&gt;&#xA;" OwnerUserId="37017" LastEditorUserId="-1" LastEditDate="2021-08-09T20:38:55.487" LastActivityDate="2021-08-09T20:38:55.487" Title="Correct way to set up network with multiple routers/access points over fiber/ethernet" Tags="|dhcp|lan|fiber|wan|" AnswerCount="1" CommentCount="2" ClosedDate="2019-02-05T02:15:47.280" ContentLicense="CC BY-SA 4.0" />
  <row Id="41416" PostTypeId="2" ParentId="41415" CreationDate="2017-05-24T10:03:44.810" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is the fact the Nextbuildingover router is connected like this correct? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it is correct.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Would it be better to connect it via a LAN port, give it the IP 192.168.0.5 and turn off DCHP work better&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Sure, you can make it as a single subnet instead of two as long as you are ok with the number of users/broadcasts in it and have no security requirements.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will not work better per se, but it might be easier for your users to share resources over a single network.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;does the fact it goes over fibre change things?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not much, unless it has some speed limitations.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Aside from the Nextbuildingover router, are routers 0.2, 0.3, and 0.4 set up correctly?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Looks ok to me. You did not mention it, you must use different channels on the adjacent access points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also consider to connect meeting room and office switches directly.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I have read conflicting advice, some saying they should have the same SSID, and others saying they need to be set up as bridges.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Same SSID helps mobile users to move between the access points. If your users are static - it does not matter.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;We frequently need to reset routers/access points to get things working again after the internet connection drops.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It is hard to guess, you have to track down the issue to its source. Probably you have just one faulty router and you do not have to reset all of them...&lt;/p&gt;&#xA;" OwnerUserId="36992" LastActivityDate="2017-05-24T10:03:44.810" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41418" PostTypeId="1" AcceptedAnswerId="42214" CreationDate="2017-05-24T12:25:19.887" Score="2" ViewCount="886" Body="&lt;p&gt;I've been looking around but I can't seem to find out if power management schemes exist only in 802.11n or in other schemes such as 802.11ac or 802.11af as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone point me to a good reference? I've even gone through the IEEE standards themselves, but still can't seem to be sure of this. Here is the link to the IEEE references: &lt;a href=&quot;https://drive.google.com/open?id=0BxUolX14t897NktqSXNJa3JHVXM&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://drive.google.com/open?id=0BxUolX14t897NktqSXNJa3JHVXM&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="35917" LastActivityDate="2017-06-26T19:26:44.663" Title="Sleep mode in WiFi" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41419" PostTypeId="1" AcceptedAnswerId="41424" CreationDate="2017-05-24T12:34:45.910" Score="1" ViewCount="471" Body="&lt;p&gt;I want to apply static NAT to highlighted servers on the KLRTR router but the issue is the interface s0/0/0 has sub-interface (S0/0/0.203) of frame relay on it. So I applied the NAT on the sub-interface on S0/0/0.203 but then the sub-interface s0/0/0.203 already has an IP assigned (NAT IP is different from the IP between KL_ISP and KLRTR) to it so it didnt work as NAT translations worked but the sender doesn't get a ping response.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In simulation mode mode the packets fail at KL_ISP, not sure why even though I have static route set on KL_ISP to enter the network and other devices are able to ping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I ping from Internet Web Server to DHCP server on its inside local IP, the ping is successful but fails on pinging on the outside global IP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I applied IP address to S0/0/0 and then I applied NAT on it which didnt work either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there any other way to solve this issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/PWRem.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/PWRem.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You&lt;/p&gt;&#xA;&#xA;&lt;p&gt;KLRTR Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;KLRTR#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 2077 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;service password-encryption&#xA;!&#xA;hostname KLRTR&#xA;!&#xA;enable secret 5 $1$mERr$hx5rVt7rPNoS4wqbXKX7m0&#xA;!&#xA;ip dhcp excluded-address 10.11.2.1 10.11.2.3&#xA;!&#xA;ip dhcp pool VLANSalesOnly&#xA; network 10.11.2.0 255.255.255.0&#xA; default-router 10.11.2.1&#xA; dns-server 10.11.5.11&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;username KLISP password 7 0822455D0A16&#xA;!&#xA;no ip domain-lookup&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/1.19&#xA; description Subinterface for VLAN 19 WLAN for security group&#xA; encapsulation dot1Q 19&#xA; ip address 10.11.4.225 255.255.255.248&#xA;!&#xA;interface FastEthernet0/1.188&#xA; description Subinterface for VLAN 188 SalesOnly group&#xA; encapsulation dot1Q 188&#xA; ip address 10.11.2.1 255.255.255.0&#xA;!&#xA;interface FastEthernet0/1.199&#xA; description Subinterface for VLAN 199 switch Management&#xA; encapsulation dot1Q 199&#xA; ip address 10.11.4.201 255.255.255.248&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 172.168.0.10 255.255.0.0 *ADDED FOR TESTING PURPOSE ONLY&#xA; encapsulation frame-relay&#xA; ip nat inside&#xA;!&#xA;interface Serial0/0/0.201 point-to-point&#xA; ip address 10.11.4.250 255.255.255.252&#xA; frame-relay interface-dlci 201&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/0/0.203 point-to-point&#xA; ip address 10.11.4.253 255.255.255.252&#xA; frame-relay interface-dlci 203&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/0/1&#xA; ip address 195.9.16.18 255.255.255.252&#xA; encapsulation ppp&#xA; ppp authentication chap&#xA; ip nat outside&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;router eigrp 1&#xA; redistribute static &#xA; network 10.0.0.0&#xA; network 195.9.16.0&#xA; no auto-summary&#xA;!&#xA;ip nat inside source static 10.11.4.242 160.12.0.1 &#xA;ip nat inside source static 10.11.4.243 160.12.0.2 &#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 195.9.16.17 &#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;line con 0&#xA; password 7 0822455D0A16&#xA; login&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; password 7 0822455D0A16&#xA; login&#xA;line vty 5 15&#xA; password 7 0822455D0A16&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;KL_ISP Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;KLISP#sh run&#xA;Building configuration...&#xA;&#xA;Current configuration : 877 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname KLISP&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;username KLRTR password 0 cisco&#xA;!&#xA;no ip domain-lookup&#xA;!&#xA;spanning-tree mode pvst&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface FastEthernet0/1&#xA; ip address 154.10.12.49 255.255.255.240&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface Serial0/0/0&#xA; ip address 195.9.16.17 255.255.255.252&#xA; encapsulation ppp&#xA; ppp authentication chap&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/0/1&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; shutdown&#xA;!&#xA;ip classless&#xA;ip route 10.11.0.0 255.255.0.0 Serial0/0/0 &#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;no cdp run&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36798" LastEditorUserId="8499" LastEditDate="2018-12-25T05:14:49.990" LastActivityDate="2018-12-25T05:14:49.990" Title="NATting over a single interface?" Tags="|cisco|routing|router|nat|packet-tracer|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41420" PostTypeId="1" AcceptedAnswerId="41455" CreationDate="2017-05-24T12:36:29.860" Score="1" ViewCount="1825" Body="&lt;p&gt;On Cisco router:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When enabling &lt;code&gt;enable secret &amp;lt;password&amp;gt;&lt;/code&gt; it creates a hash(MD5 I believe) so it cannot be read right of the config file. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And when turning encryption on on all passwords like: &lt;code&gt;service password-encryption&lt;/code&gt;, does it encrypt the encrypted password above, or does only encrypt the clear text password?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it encrypts the clear text password it will only be necessary to do &lt;code&gt;enable password &amp;lt;password&amp;gt;&lt;/code&gt; without encrypting it first, since &lt;code&gt;service password-encryption&lt;/code&gt; will do it, how about that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One more thing. The key used for &lt;code&gt;service password-encryption&lt;/code&gt; and &lt;code&gt;enable secret&lt;/code&gt; is this dynamically made for each router or is it a static key, equal to all cisco routers(probably not)?&lt;/p&gt;&#xA;" OwnerUserId="27110" LastActivityDate="2020-12-02T20:52:02.180" Title="Does service password-encryption encrypt the encrypted enable secret?" Tags="|cisco|cisco-ios|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41423" PostTypeId="1" AcceptedAnswerId="41463" CreationDate="2017-05-24T13:38:46.187" Score="1" ViewCount="1095" Body="&lt;p&gt;I have the below topology:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/jNDFQ.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jNDFQ.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have to make sure that the loopback interface of R1(1.0.1.1/32) is learnt on R2 but with a few constraints.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step1: The loopback of R1 is learnt in global routing table of R2 &lt;em&gt;via ospf&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step2: R2 and R3 are ebgp neighbors for &lt;em&gt;address-family ipv4&lt;/em&gt;  (on interface f0/2--which is in global routing table) and &lt;em&gt;address-family ipv4 vrf &lt;/em&gt; (on interface f0/1 which is part of vrf TEST on both R2 and R3)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step3: At R2, I redistribute the ospf learnt routes to BGP (ipv4 address-family).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step4: R3 learns the bgp routes from R2 via ebgp (with a next hop of 192.16.2.9) in global routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step5: At R3, I do a route-leaking from the bgp ipv4 address family to bgp vpnv4 vrf TEST address family for 1.0.1.1/32&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, R3 has a route to 1.0.1.1/32 in vrf TEST with a next hop of 192.16.2.9 (which is in global routing table)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Step 6: R2 learns again the 1.0.1.1/32 route via ebgp address-family ipv4 vrf TEST with a next hop of 192.16.1.10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my objective is to make sure R2 can ping the 1.0.1.1/32 via the vrf TEST(but as expected it fails)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestions on how to get the above scenario working.&#xA;(One of the ways,this can be done is to configure the interface f0/2 on both R2 and R3 as below:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;int f0/2&#xA;ip vrf receive TEST&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2017-05-25T11:20:04.950" Title="Vrf route with global ip as the next hop" Tags="|bgp|ospf|vrf|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41424" PostTypeId="2" ParentId="41419" CreationDate="2017-05-24T14:17:41.017" Score="0" Body="&lt;p&gt;Your inside interface is assigned to an interface with no IP addressing. In fact, you have no address with the addressing for either of your NAT statements, so the packets with those source addresses must be coming into one of your interfaces from somewhere else. You need to put the &lt;code&gt;ip nat inside&lt;/code&gt; statement on the interface(s) where that traffic comes into the router, and that cannot possibly be an interface with no IP address assigned.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have now assigned an IP address to the inside interface, but is that the interface where the packets with the source addresses listed in your NAT statements come into the router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Based on you comments, your outside router (KLISP) has no route to the translated addresses, so it will drop packets destined to those addresses. You must inform KLISP to send packets destined to those addresses to &lt;code&gt;195.9.16.18&lt;/code&gt;. You can do that with statically configured route(s) or dynamically with a routing protocol.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-24T15:07:14.087" LastActivityDate="2017-05-24T15:07:14.087" CommentCount="20" ContentLicense="CC BY-SA 3.0" />
  <row Id="41427" PostTypeId="2" ParentId="40766" CreationDate="2017-05-24T15:55:05.153" Score="2" Body="&lt;p&gt;Yes, it does.&#xA;I've purchased the license upgrade with my ISP since they rent me this router.&lt;/p&gt;&#xA;" OwnerDisplayName="user34559" LastActivityDate="2017-05-24T15:55:05.153" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41428" PostTypeId="1" AcceptedAnswerId="41430" CreationDate="2017-05-24T16:08:52.050" Score="1" ViewCount="276" Body="&lt;p&gt;As the question says:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I bridge multiple interfaces to a single one on a Cisco ISR C891F, but making each one able to communicate only to the destination interface?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I have GigabitEthernet0 to GigabitEthernet7.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I bridge the range GE1-GE7 to GE0 and make each interface only able to communicate with GE0 and not between each other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Cisco IOS Software, C800 Software (C800-UNIVERSALK9-M), Version 15.3(3)M6, RELEASE SOFTWARE (fc1)&lt;/em&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user34559" LastEditorUserId="8499" LastEditDate="2018-03-07T18:37:42.890" LastActivityDate="2018-03-07T18:37:42.890" Title="How can I bridge multiple interfaces to a single one a Cisco ISR C891F but making each one able to communicate only to the destination interface?" Tags="|cisco|router|cisco-ios|bridge|cisco-isr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41429" PostTypeId="1" AcceptedAnswerId="41431" CreationDate="2017-05-24T16:10:03.220" Score="4" ViewCount="8878" Body="&lt;p&gt;Let's says that someone told me that network address is &lt;code&gt;192.168.70.0&lt;/code&gt;, but he does not tell me the neither broadcast address nor network mask.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it correct to say that I cannot determine the maximum IP address in such a network, or should I say that &lt;code&gt;192.168.70.0&lt;/code&gt; is the network address of a Class C network, so the maximum IP address is &lt;code&gt;192.168.70.254&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In other words, and perhaps the question is silly, what's the difference between a network and a subnetwork?&lt;/p&gt;&#xA;" OwnerUserId="19092" LastEditorUserId="8499" LastEditDate="2017-05-24T17:52:30.460" LastActivityDate="2017-05-25T01:40:30.273" Title="Difference between network and subnetwork" Tags="|subnet|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41430" PostTypeId="2" ParentId="41428" CreationDate="2017-05-24T16:21:19.583" Score="1" Body="&lt;p&gt;Those interfaces are bridged (communicating at layer-2) because they are part of the switch module in the router. It sounds like you want to use a Private VLAN. Cisco has documents that describe this. For example, &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3560/software/release/12-2_52_se/configuration/guide/3560scg/swpvlan.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Catalyst 3560 Software Configuration Guide, Release 12.2(52)SE&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Private VLANs provide Layer 2 isolation between ports within the same&#xA;  private VLAN. Private-VLAN ports are access ports that are one of&#xA;  these types:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Promiscuous—A promiscuous port belongs to the primary VLAN and can    communicate with all interfaces, including the community and isolated &#xA;  host ports that belong to the secondary VLANs associated with the&lt;br&gt;&#xA;  primary VLAN.&lt;/li&gt;&#xA;  &lt;li&gt;Isolated—An isolated port is a host port that belongs to an isolated    secondary VLAN. It has complete Layer 2 separation from&#xA;  other ports    within the same private VLAN, except for the&#xA;  promiscuous ports.    Private VLANs block all traffic to isolated&#xA;  ports except traffic from    promiscuous ports. Traffic received from&#xA;  an isolated port is    forwarded only to promiscuous ports.&lt;/li&gt;&#xA;  &lt;li&gt;Community—A community port is a host port that belongs to a community    secondary VLAN. Community ports communicate with other&#xA;  ports in the    same community VLAN and with promiscuous ports. These&#xA;  interfaces are    isolated at Layer 2 from all other interfaces in&#xA;  other communities    and from isolated ports within their private&#xA;  VLAN.&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Configure a private VLAN with all the interfaces as Isolated, except GigabitEthernet0 that you will configure as Promiscuous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem may be that your switch module in a router may not support private VLANs. The switch modules in routers don't always support all the features of a stand-alone switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-24T16:21:19.583" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41431" PostTypeId="2" ParentId="41429" CreationDate="2017-05-24T16:29:59.500" Score="3" Body="&lt;p&gt;Network classes are dead, killed in 1993 by RFCs 1518 and 1519, which defined CIDR (&lt;em&gt;Classless&lt;/em&gt; Inter-Domain Routing). Modern networking does not use network classes. When there were network classes, any network with a mask length longer than the class default mask length was a subnet of the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since CIDR, a subnet is any network with a mask length longer than a network of which it is part. The term network can be applied to any subnet. Technically, any network is a subnet of &lt;code&gt;0.0.0.0/0&lt;/code&gt;. Today, the terms can usually be used interchangeably. You normally would use subnet when comparing to a larger network, or as a verb when chopping a network into smaller networks.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-24T16:29:59.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41432" PostTypeId="1" AcceptedAnswerId="41433" CreationDate="2017-05-24T16:44:35.070" Score="2" ViewCount="632" Body="&lt;p&gt;This is an attempt to clarify my original post which was too long.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My task is to add a DMZ to our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently, the internal network is connected to one ASA interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been able to set up a single device DMZ where one test laptop is directly connected to a spare ASA interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to expand the experiment to include our existing switch so I can prove that two devices can reside inside the DMZ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Should I be using two interfaces on the ASA and running two cables to the switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, should I somehow be using only one ASA interface and one cable to the switch?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or, should I be using two interfaces and two separate switches (one in the DMZ and one in the internal network)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EXTRA DETAIL ABOUT THE SETUP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The environment is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;ASA 5505:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0/0:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;outside&lt;/li&gt;&#xA;&lt;li&gt;public facing IP&lt;/li&gt;&#xA;&lt;li&gt;vlan2&lt;/li&gt;&#xA;&lt;li&gt;security 0&lt;/li&gt;&#xA;&lt;li&gt;connected to the serviced office building main network&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;0/1:  &#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;inside&lt;/li&gt;&#xA;&lt;li&gt;192.168.47.1&lt;/li&gt;&#xA;&lt;li&gt;vlan1&lt;/li&gt;&#xA;&lt;li&gt;security 100&lt;/li&gt;&#xA;&lt;li&gt;connected to 0/0 on a ProCurve 2510G-48    &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;ProCurve 2510G-48:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;DEFAULT_VLAN (came out of the box)&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.47.50&lt;/li&gt;&#xA;&lt;li&gt;0/0:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;uplink to the ASA 5505 0/1&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;The rest:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;various servers &lt;/li&gt;&#xA;&lt;li&gt;another switch to which our desktops are connected&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;My initial experiment:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;ASA 5505:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;0/0:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;outside&lt;/li&gt;&#xA;&lt;li&gt;public facing IP&lt;/li&gt;&#xA;&lt;li&gt;vlan2&lt;/li&gt;&#xA;&lt;li&gt;security 0&lt;/li&gt;&#xA;&lt;li&gt;connected to the serviced office buildings main network &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;0/1:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;inside&lt;/li&gt;&#xA;&lt;li&gt;192.168.47.1&lt;/li&gt;&#xA;&lt;li&gt;vlan1&lt;/li&gt;&#xA;&lt;li&gt;security 100&lt;/li&gt;&#xA;&lt;li&gt;connected to 0/0 on the ProCurve 2510G-48     &lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;0/2:&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;dmz&lt;/li&gt;&#xA;&lt;li&gt;192.168.48.1&lt;/li&gt;&#xA;&lt;li&gt;vlan3&lt;/li&gt;&#xA;&lt;li&gt;security 50&lt;/li&gt;&#xA;&lt;li&gt;connected to TestLaptop1 with IP address 192.168.48.2&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;ProCurve 2510G-48:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;As above&lt;/li&gt;&#xA;&lt;/ul&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;With NAT and access rules I got to the point where I can:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;access the internet from TestLaptop1&lt;/li&gt;&#xA;&lt;li&gt;access the TestLaptop1 from the internet&lt;/li&gt;&#xA;&lt;li&gt;access one single device in the internal network from TestLaptop1 (to simulate limited internal access)&lt;/li&gt;&#xA;&lt;li&gt;access TestLaptop1 from one single device in the internal network (to simulate management access)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I am now trying to add our existing switch into the mix.&lt;/p&gt;&#xA;" OwnerUserId="36961" LastEditorUserId="36961" LastEditDate="2017-05-25T07:04:11.990" LastActivityDate="2020-12-11T14:42:15.677" Title="Options for setting up a DMZ and internal network with an ASA 5505 and a single switch" Tags="|vlan|cisco-asa|network|hp-procurve|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41433" PostTypeId="2" ParentId="41432" CreationDate="2017-05-24T17:57:58.230" Score="1" Body="&lt;p&gt;I wouldn't change the DMZ VLAN ID from 3 (5505) to 10 (2510) - depending on which protocols are active (GVRP, MVRP), this may cause problems.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you tag VLAN3 on 5505 port 0/1 and 2510 port &quot;0/0&quot; (the first port should be &quot;1&quot;) you can trunk both VLANs 1 and 3 on the same cable. Then, on the 2510, just config all required DMZ ports with VLAN3 untagged and they should be within the DMZ.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-24T17:57:58.230" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41434" PostTypeId="2" ParentId="20138" CreationDate="2017-05-24T18:14:12.050" Score="1" Body="&lt;p&gt;My guess is the local networks aren't added to the routing table automatically. Check &lt;code&gt;show ip route&lt;/code&gt; whether they show up and add the local routes if necessary.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-24T18:14:12.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41435" PostTypeId="1" AcceptedAnswerId="41440" CreationDate="2017-05-24T18:14:54.220" Score="2" ViewCount="904" Body="&lt;p&gt;The MTU for 802.11 is 2296 bytes. Does this mean that if TCP is used over 802.11, the MSS can only be 2296 - 40 = 2256? Can't one use a higher MSS which would then get fragmented over 802.11?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In short, is there a strict limit on the MSS for TCP?&lt;/p&gt;&#xA;" OwnerUserId="35917" LastEditorUserId="8499" LastEditDate="2017-07-15T22:10:01.363" LastActivityDate="2017-07-15T22:10:01.363" Title="TCP MSS over WiFi" Tags="|tcp|ieee-802.11|layer4|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41436" PostTypeId="1" AcceptedAnswerId="41438" CreationDate="2017-05-24T18:18:32.343" Score="2" ViewCount="120" Body="&lt;p&gt;I'm having my googlefu fail me. I have a rather complicated network that has grown organically that now is running a mix of IBM / BladeOS switches that are doing VLANs and MST for spanning tree, connected to edge HP Procurve switches of all vintages. I've worked out (more or less) a method to map the physical connections between 2 nodes on a VLAN. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current question is this - say I have a network like this:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/k0In5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k0In5.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1 = Root Bridge&lt;/p&gt;&#xA;&#xA;&lt;p&gt;S1-S3 = Blade MST configured switches&lt;/p&gt;&#xA;&#xA;&lt;p&gt;S4-7 = HP Procurve switches with no STP or RSTP only&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1-2 = Nodes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If Node 1 wants to talk at L2 (all on same VLAN and subnet) to Node 2, if it sends out a frame on a fully learned network - what path would it take?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I can work out according to my reading and the videos I've watched, even though the human &quot;obvious path&quot; would be 1-s6-s4-s2-s1-s3-s5-s7-2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It actually has to go to the logical root bridge unless node 2 was also connected to s6 rather than s7 as it currently is. I.e. the ethernet frames from 1 to 2 actually also go through R1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1-s6-s4-s2-s1-r1-s1-s3-s5-s7-2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this right? Or is the root bridge irrelevant here as we're staying in the same VLAN?&lt;/p&gt;&#xA;" OwnerUserId="32445" LastActivityDate="2017-06-23T16:53:08.157" Title="How do modern switches forward ethernet frames logically?" Tags="|ethernet|spanning-tree|layer2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41438" PostTypeId="2" ParentId="41436" CreationDate="2017-05-24T18:36:13.417" Score="1" Body="&lt;p&gt;The frames from one host to the other will have a path toward the root bridge. At S1, you get a shortcut since S1 will have the MAC address of the destination host in its MAC address table, or it will flood the frame to all non-blocking interfaces, which creates the shortcut, too.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The root bridge is relevant because the only non-blocking path is toward the root bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Assume that there is no S1. S2 and S3 are directly connected to the root bridge, and S2 and S3 have a connection between them. The frames will need to travel through the root bridge because the link between S2 and S3 will be blocked on one side or the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP sets up a single non-blocking path, and that is toward the root bridge. Any links from one of the switches on one side to any of the switches on the other side will not play any part because the only non-blocking path is toward the root bridge.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-24T18:43:04.667" LastActivityDate="2017-05-24T18:43:04.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41439" PostTypeId="2" ParentId="41436" CreationDate="2017-05-24T18:41:26.180" Score="4" Body="&lt;p&gt;Switches learn their MAC table from the frames that run through them. Usually, IP's ARP (or NDP with IPv6) makes sure that all switches learn all MACs they need to know. When 1 sends a frame to 2 S1 already knows that 2 is located on the port to S3 and sends the frame that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The &lt;em&gt;root&lt;/em&gt; switch is only important for (M/R)STP - since you've got no redundant links all links are forwarding and there's no STP blocking. STP protects you if e.g. S4 and S5 are connected by accident.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you do have redundant links, the choice of root switch will be important as (roughly) all switches will block frames to redundant ports facing away from the root bridge and traffic will flow more (not entirely) in the general direction of the root bridge.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-23T16:53:08.157" LastActivityDate="2017-06-23T16:53:08.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41440" PostTypeId="2" ParentId="41435" CreationDate="2017-05-24T19:18:36.053" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does this mean that if TCP is used over 802.11, the MSS can only be 2296 - 40 = 2256?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;MSS = MTU - IP header size - TCP header size:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Maximum_segment_size&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Maximum_segment_size&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can't one use a higher MSS which would then get fragmented over 802.11?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Most routers implement MSS adjust functionality. During TCP handshake the MSS get adjusted on each hop along the path to its minimum value. So the following TCP packets with data are fit into the MTUs along the path and packets do not get fragmented.&lt;/p&gt;&#xA;" OwnerUserId="36992" LastActivityDate="2017-05-24T19:18:36.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41441" PostTypeId="1" CreationDate="2017-05-24T19:55:29.477" Score="1" ViewCount="1049" Body="&lt;p&gt;Is it possible to use local pref attribute to influence outbound routing for a given network that is advertised by different ASNs? So, I have a single network, for e.g. &lt;code&gt;10.10.100.0/24&lt;/code&gt;, and I own, for e.g. AS100 and AS200, and I am advertising this network from both the ASNs. If I tag a higher local pref for this route from AS100, and tag a lower pref for this route from ASN200, and advertise to my neighbors, would my neighbors then always route the traffic to AS100? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If this is not possible, is there any other attribute I can use in my route advertisement to ensure traffic always comes into my AS100?&lt;/p&gt;&#xA;" OwnerUserId="37030" LastEditorUserId="8499" LastEditDate="2018-03-09T21:43:41.067" LastActivityDate="2018-03-09T21:43:41.067" Title="Using local pref attribute to influence outbound routing to different ASN's" Tags="|routing|bgp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41442" PostTypeId="2" ParentId="41441" CreationDate="2017-05-24T20:05:48.067" Score="4" Body="&lt;p&gt;You are actually asking about inbound routing if you want to influence routing to your ASes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The local preference is local to the AS, and it is for outbound routing. What local preference you have in one AS has no effect on the routing in a different AS, whether or not you own both ASes. Other ASes cannot see your local preference. You could try setting a lower MED on the preferred AS, but another AS may ignore that, or you could try prepending to the AS_PATH, or aonther method, but that, too, can be ignored by another AS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can &lt;em&gt;try&lt;/em&gt; to influence routing in a different AS, but the point of ASes (&lt;em&gt;Autonomous&lt;/em&gt; Systems) is that they are actually &lt;em&gt;autonomous&lt;/em&gt;; each AS makes its own routing policies and decisions, independent of any other AS. The administrators of an AS are free to follow your hints (MED, AS_PATH prepending, etc.), or ignore them altogether.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Think about it, you would not want someone in a different AS dictating your routing policy in you AS. The same holds true for other ASes; they don't want you dictating routing policy to them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice, you can &lt;em&gt;probably&lt;/em&gt; influence other ASes with AS_PATH prepending. Some may pay attention to your MED. The only real way to be sure that your hints are respected is to get a business agreement with the other AS.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-24T20:05:48.067" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41443" PostTypeId="2" ParentId="41441" CreationDate="2017-05-24T20:15:44.387" Score="1" Body="&lt;p&gt;In order to influence outbound router decisions you would want to utilize AS PREPEND.  If you look at the BGP route decision ordering, the default behavior is to choose the route with the shortest AS PATH.  In this case, you can advertise 10.10.100.0/24 out AS200 with the AS 200 prepended (typically you would prepend it three times).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example for Router in AS200:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access list standard ACL_MATCH_NET&#xA;permit 10.10.100.0 0.0.0.255&#xA;&#xA;route-map RM_AS_PREPEND permit 10 &#xA;match ip address ACL_MATCH_NET&#xA;set as-path prepend 200 200 200 &#xA;&#xA;router bgp 200 &#xA;network 10.10.100.0 mask 255.255.255.0&#xA;neighbor x.x.x.x remote-as xxxx&#xA;neighbor x.x.x.x route-map RM_AS_PREPEND out&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that the upstream router doesn't have to accept the as path, and can filter or change the path you set too.  &lt;/p&gt;&#xA;" OwnerUserId="599" LastActivityDate="2017-05-24T20:15:44.387" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41444" PostTypeId="2" ParentId="26249" CreationDate="2017-05-24T20:26:32.050" Score="1" Body="&lt;p&gt;I have recently spent a good amount of time to differentiate the keywords used in security enforcement in SDN firewalls. Unfortunately, there exists no standard to back these definitions. However, I could narrow the scope of there meanings:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Flow&lt;/strong&gt;: A sequence of packets traversing a network that share a set of header-field values.&#xA;Eg.- &lt;em&gt;A flow can consist of all packets with same source and destination IP headers.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Flow Policy&lt;/strong&gt;: An Openflow switch consists of flow table consisting of rules(also called flows) defining the flows in the network. These rules constitute the flow policy of the network.&#xA;Eg.- &lt;em&gt;One or many rules in a flowtable of OpenFlow switch.&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Firewall Policy&lt;/strong&gt;: These are the management level security constraints. It consists of different firewall rules (allow/deny). Identifies the characteristics of a packet and accordingly applies some actions. It is different from the traditional firewall rule: Stateful, bidirectional, dynamic. Also, unlike flow policy, this is centrally defined and enforced at the controller.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Eg.- &lt;em&gt;Traffic from Client C to server S should go through a middle box M&lt;/em&gt; &#xA;Eg.- * For a specified switch, block all the traffic from host 10.1.2.2 - &lt;strong&gt;00:00:00:02:00:00&lt;/strong&gt; BLOCK srcip=10.1.2.2 *&lt;/p&gt;&#xA;" OwnerUserId="37031" LastEditorUserId="37031" LastEditDate="2017-05-24T20:50:53.420" LastActivityDate="2017-05-24T20:50:53.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41446" PostTypeId="1" CreationDate="2017-05-24T22:03:31.717" Score="1" ViewCount="577" Body="&lt;p&gt;My question is for small networks or perhaps large ones.  When does it make sense to use a switch compared to a router implementation like NAT overloading?  It seems to me, a networking novice, that both are being used inside the LAN vs. connecting networks to the Internet.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's assume I have 10 computers on a private network.  All ten need access to the internet.  Nevermind VLANs and complex switches with routing capability.  If I use NAT then all 10 machines will have private IPs and share a single public IP address.  If I use a basic switch all 10 share a single public IP, but no private IP.  Which method is better?  Is it common to find networks that don't leverage private IPs?  What is the benefit of using private IPs vs switching?&lt;/p&gt;&#xA;" OwnerUserId="37036" LastEditorUserId="8499" LastEditDate="2017-05-25T15:57:35.420" LastActivityDate="2017-05-25T15:57:35.420" Title="Basic networking: switching vs NAT overloading" Tags="|switch|router|nat|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41447" PostTypeId="2" ParentId="41446" CreationDate="2017-05-24T22:08:20.193" Score="2" Body="&lt;p&gt;You are comparing apples and oranges (layer-2 vs. layer-3). You only use NAT if you really have no other option because of lack of IPv4 addresses, and that has nothing to do with layer-2 LAN connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switching connects hosts at layer-2, while NAT is a kludge that is designed to extend IPv4 layer-3 addresses until IPv6 can become ubiquitous. NAT breaks the IP promise of unique addresses for every host and end-to-end connectivity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Edit:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If I use a basic switch all 10 share a single public IP, but no&#xA;  private IP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That sentence makes no sense. There would be no sharing of the single public IP address. If you connect a switch to the public Internet where you are getting only a single public IP address, then only one device connected to the switch will get the public IP address, but the other devices will not be able to communicate on the public Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Understand that switches switch layer-2 frames on a layer-2 LAN, but routers route layer-3 packets between networks (LANs). Again, you are trying to compare apples and oranges. I think you need to learn more about the network layers and what they do. Each network layer is independent of the other network layers. For example, ethernet, at layer-2 can carry any number of layer-3 protocols (IPv4, IPX, IPv6, AppleTalk, etc.), while IPv4 at layer-3 can be carried by any number of layer-2 protocols (ethernet, Wi-Fi, token ring, PPP, frame relay, ATM, etc.). The protocols at one network layer simply do not care what protocols are used at the other layers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to connect hosts at layer-2, then you use a switch, but if you need to connect networks, you use routers.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-25T15:47:13.157" LastActivityDate="2017-05-25T15:47:13.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41449" PostTypeId="1" AcceptedAnswerId="41450" CreationDate="2017-05-24T22:23:52.697" Score="1" ViewCount="2924" Body="&lt;p&gt;Refurbished ASR1002 not booting due to these problems:&#xA;It got to ROMMON this far.&#xA;How do I go from cleaning to getting this to some random image so that I can desperately upgrade image?&#xA;Thanks.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rommon 14 &amp;gt; dir bootflash:&#xA;Warning: filesystem is not clean&#xA;File System: EXT2/EXT3&#xA;&#xA;11         16384     drwx------     lost+found&#xA;32385      4096      drwxr-xr-x     core&#xA;420993     4096      drwxrwxrwx     .prst_sync&#xA;80961      4096      drwxr-xr-x     .rollback_timer&#xA;12         0         -rw-------     tracelogs.584&#xA;388609     36864     drwxrwxrwx     tracelogs&#xA;518145     4096      drwxrwxrwx     .installer&#xA;13         383648104 -rw-r--r--     asr1002x-universalk9.03.07.01.S.152-4.S1.SPA.bin&#xA;19         3136      -rw-r--r--     TEA_LISP_NOVRF&#xA;15         7371      -rw-r--r--     KGLNS&#xA;16         7371      -rw-r--r--     KGLNS_WORKIN&#xA;113345     4096      drwxr-xr-x     FT&#xA;48578      2412      -rw-r--r--     startup-config&#xA;48579      869710    -rw-r--r--     KP_PR2650_IMIX.cfg&#xA;14         383658280 -rw-r--r--     asr1002x-universalk9.BLD_V152_4_S_XE37_THROTTLE_LATEST_20120810_070021.SSA.bin&#xA;17         1529      -rw-r--r--     basic_confg&#xA;18         3363      -rw-r--r--     TEA_LISP_VRF&#xA;20         1793      -rw-r--r--     basic&#xA;22         17        -rw-r--r--     LISP-MapCache-IPv4-00000000-00100&#xA;21         53796     -rw-r--r--     reload.log&#xA;23         121       -r--r--r--     debug.conf&#xA;129537     4096      drwxr-xr-x     .ssh&#xA;rommon 15 &amp;gt; boot system bootflash:asr1002x-universalk9.03.07.01.S.152-4.S1.SPA.bin&#xA;boot: unsupported boot device &quot;system&quot;&#xA;rommon 16 &amp;gt; boot ?&#xA;boot: unsupported boot device &quot;?&quot;&#xA;rommon 17 &amp;gt; &#xA;&#xA;&#xA;monitor: command &quot;&quot; not found&#xA;&#xA;&#xA;rommon 18 &amp;gt; boot bootflash:asr1002x-universalk9.03.07.01.S.152-4.S1.SPA.bin&#xA;&#xA;&#xA;&#xA;Image validated&#xA;%IOSXEBOOT-4-FILESYS_ERRORS_CORRECTED: (rp/0): bootflash 1 contained errors which were auto-corrected.&#xA;%IOSXEBOOT-4-FILESYS_ERRORS_CORRECTED: (rp/0): bootflash 5 contained errors which were auto-corrected.&#xA;%IOSXEBOOT-4-FILESYS_ERRORS_CORRECTED: (rp/0): bootflash 6 contained errors which were auto-corrected.&#xA;%IOSXEBOOT-4-FILESYS_ERRORS_CORRECTED: (rp/0): bootflash 7 contained errors which were auto-corrected.&#xA;%IOSXEBOOT-4-FILESYS_ERRORS_CORRECTED: (rp/0): bootflash 8 contained errors which were auto-corrected.&#xA;%IOSXEBOOT-4-FILESYS_ERRORS_CORRECTED: (rp/0): bootflash 9 contained errors which were auto-corrected.&#xA;%IOSXEBOOT-4-FILESYS_ERRORS_CORRECTED: (rp/0): bootflash 10 contained errors which were auto-corrected.&#xA;%IOSXEBOOT-4-FILESYS_ERRORS_CORRECTED: (rp/0): bootflash 11 contained errors which were auto-corrected.&#xA;%IOSXEBOOT-4-DEVICE_MISSING: (rp/0): Integrity check for missing device /dev/harddisk not performed.&#xA;%IOSXEBOOT-4-BOOT_ACTIVITY_LONG_TIME: (rp/0): prep_storage took: 41 seconds, expected max time 10 seconds&#xA;%IOSXEBOOT-4-HARDDISK_MISSING: (rp/0): harddisk: not present, boot process continuing&#xA;%IOSXEBOOT-4-BOOT_PARAMETER: (rp/0): Booting with custom BOOT_PARAM setting&#xA;%IOSXEBOOT-4-DEBUG_CONF: (rp/0): Using DEBUG_CONF file /bootflash/debug.conf&#xA;%IOSXEBOOT-4-WATCHDOG_DISABLED: (rp/0): Hardware watchdog timer disabled: disabled by PVP_IGN_CRITICAL_PROC_DOWN&#xA;%IOSXEBOOT-4-SR_INIT_SHELL: (rp/0): Router waiting for interactive input for prechasfsinit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerDisplayName="user10221" LastEditorUserId="8499" LastEditDate="2018-12-25T05:17:48.533" LastActivityDate="2018-12-25T05:17:48.533" Title="ASR1002 - bootflash" Tags="|cisco|router|cisco-asr|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41450" PostTypeId="2" ParentId="41449" CreationDate="2017-05-24T22:32:49.170" Score="1" Body="&lt;p&gt;You can set the config register, then reset to boot up with the image on the device, ignoring the startup-config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rommon 1 &amp;gt; confreg 0x2142&#xA;&#xA;rommon 2 &amp;gt; reset&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once you have it booted up, you can load any image for which you have purchased a license from Cisco.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-24T22:32:49.170" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41451" PostTypeId="1" AcceptedAnswerId="41452" CreationDate="2017-05-24T23:12:45.570" Score="1" ViewCount="446" Body="&lt;p&gt;As the question says,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to do interVLAN routing on a router on a stick configuration on a Cisco ISR C891F with tagged interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's I have 2 VLAN.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface vlan 1&#xA;  ip address 192.168.0.1&#xA;interface vlan 2&#xA;  ip address 192.168.1.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And also I have one interface tagged for each VLAN.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet 1&#xA;  switchport access vlan 1&#xA;interface GigabitEthernet 2&#xA;  switchport access vlan 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is it possible to make both VLAN communicate for devices connected through those interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This router doesn't supports private-vlan and finally remember that there is not a switch, only this router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerDisplayName="user34559" LastEditorUserId="8499" LastEditDate="2018-12-25T05:18:47.553" LastActivityDate="2020-12-10T12:10:04.027" Title="Is it possible to do interVLAN routing on a router on a stick configuration on a Cisco ISR C891F with tagged interfaces?" Tags="|cisco|router|vlan|cisco-ios|cisco-isr|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41452" PostTypeId="2" ParentId="41451" CreationDate="2017-05-24T23:21:01.350" Score="0" Body="&lt;p&gt;First, you are confused about tagging. Access interfaces do not tag frames. Trunk interfaces tag frames. The two interface you show are not tagging frames unless you have specifically configured them to be trunk interfaces. Because trunks carry frames for multiple VLANs, you tag the frames so that the other end of the trunk (usually another switch or router) knows which frames belong to which VLANs. Most hosts don't understand VLAN tags, and there is no reason to tag frames if there is traffic for only one VLAN on an interface, so access interfaces do not tag frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really are not doing router-on-a-stick (that would be using a single physical router interface with subinterfaces, not switch interfaces). Since you have created SVIs on a router, the default is to route between the networks, so you are routing between the VLANs unless you have created some configuration, e.g. ACLs, to block it.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-25T00:48:00.517" LastActivityDate="2017-05-25T00:48:00.517" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41454" PostTypeId="2" ParentId="41429" CreationDate="2017-05-25T01:40:30.273" Score="2" Body="&lt;p&gt;To answer your question, it is correct to say that the IP address range cannot be determined by the network number alone, such as 192.168.70.0.  The subnet mask must be known.&#xA;To answer the network vs subnetwork question, let's use the subnet you provided. If you have a network of 192.168.70.0/24 (/24 = 255.255.255.0), you can break that network into multiple SUBnetworks (aka subnetting) by simply changing the subnet mask.&lt;/p&gt;&#xA;" OwnerUserId="37040" LastActivityDate="2017-05-25T01:40:30.273" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41455" PostTypeId="2" ParentId="41420" CreationDate="2017-05-25T02:36:40.487" Score="2" Body="&lt;p&gt;So I want to answer the questions as they appear.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:  And when turning encryption on on all passwords like: service password-encryption, does it encrypt the encrypted password above, or does only encrypt the clear text password?&lt;/strong&gt;&#xA;Answer:  Only clear text passwords are changed.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:  If it encrypts the clear text password it will only be necessary to do enable password  without encrypting it first, since service password-encryption will do it, how about that?&lt;/strong&gt;&#xA;Answer:  Correct.  The person entering the command will enter the password in clear text because the Cisco security mechanism will obscure it with a hash.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question:  One more thing. The key used for service password-encryption and enable secret is this dynamically made for each router or is it a static key, equal to all cisco routers(probably not)?&lt;/strong&gt;&#xA;Answer:  No &quot;encryption keys&quot; are dynamically made because the password is not being encrypted.  Instead, it's being &quot;hashed&quot;.  When you show the running config and look at the non-clear text password, it's in that format because the device took that clear text password and passed it through the MD5 hashing algorithm and saved the result in the config.  So not even the device knows your clear-text password.  Here's how it works.  Let's say you type in your password to login.  The device takes the password that you typed in and runs it through the MD5 hash and gets a result.  If THAT result matches what's in the config file, you're in.  No encryption needed.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;BONUS:  ENCRYPTION VS HASH&lt;/strong&gt;&#xA;To keep it simple since this bonus would be for another forum:&#xA;Hashing algorithms such as MD5 are &quot;cryptographic&quot; by nature.  BUT - the difference between a HASH and ENCRYPTION is that encryption is always &quot;reversible&quot; via DEcryption (the key that you spoke of earlier).  A HASH is not mathematically reversible.  It simply takes a character string, runs it through a mind numbing mathematical process then outputs a result.  For example, if you take the letter A and put it through a mathematical hash algorithm like MD5, A would always (ALWAYS) result as 7FC56270E7A70FA81A5935B72EACBE29  (see onlinemd5.com).  B would be something completely different than A's output, but the hash would ALWAYS give the same output for B every time.  The more &quot;complex&quot; your hashing algorithm, the more &quot;cryptographic&quot; (not encrypted) your password is.  &lt;/p&gt;&#xA;" OwnerUserId="37040" LastActivityDate="2017-05-25T02:36:40.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41457" PostTypeId="2" ParentId="39500" CreationDate="2017-05-25T06:43:39.327" Score="0" Body="&lt;p&gt;Directly? Not that I am aware of. It may be possible using open source (open-wrt or dd-wrt) firmware on supported devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Via API? Yes, Ruckus utilise data from their antenna when calculating client position. This data can only be accessed via API as the calculated x/y position not the raw antenna data. Cisco &amp;amp; Aruba have similar services. The Ruckus SPoT service requires extensive calibration in order to achieve a reasonable level of accuracy, AP position and density are major factors, as are environmental changes. The same applies across all vendors' solutions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The methods used across these systems to locate wireless devices are broadly similar, combining signal strength, antenna direction and time for data to travel between client and AP. Acquiring this data for each client from multiple APs allows a position to be calculated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's hard. Most systems are only capable of resolution to around 10 meters in real world deployments, which is fine for some applications. Retailers were the first commercial users but aisle level tracking remains an elusive goal. Image processing from CCTV is one of the main competitive technologies but that too has limitations.&lt;/p&gt;&#xA;" OwnerUserId="16288" LastActivityDate="2017-05-25T06:43:39.327" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41458" PostTypeId="2" ParentId="41311" CreationDate="2017-05-25T07:05:55.167" Score="2" Body="&lt;p&gt;ASA does not allow to specify outgoing interface/IP for traceroute command, unfortunately.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To check if packets are running thru ASA correctly you can use &lt;strong&gt;packet-tracer&lt;/strong&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;packet-tracer input &amp;lt;input_interface&amp;gt; &amp;lt;proto&amp;gt; &amp;lt;source_addr_or_fqdn&amp;gt; &amp;lt;port&amp;gt; &amp;lt;dest_addr_or_fqdn&amp;gt; &amp;lt;port&amp;gt; &amp;lt;detailed&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29556" LastActivityDate="2017-05-25T07:05:55.167" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41459" PostTypeId="1" CreationDate="2017-05-25T09:55:26.490" Score="1" ViewCount="3407" Body="&lt;p&gt;I am working as an network engineer support in a company. Our network does not have any DHCP configured for it, we use static for any device... But like a month ago we suddenly have a dhcp server which not coming from our default gateway. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;example default gateway is 172.16.40.254 and dhcp is coming from 172.16.40.204. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked the configuration of our core switch and router and there is no DHCP configured there. Please help.&lt;/p&gt;&#xA;" OwnerUserId="37053" LastActivityDate="2017-05-25T10:45:01.020" Title="Unknown DHCP device" Tags="|dhcp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41461" PostTypeId="2" ParentId="41459" CreationDate="2017-05-25T10:44:24.043" Score="4" Body="&lt;p&gt;One way to trace this is:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;capture DHCP traffic from the server&lt;/li&gt;&#xA;&lt;li&gt;check for the source MAC address&lt;/li&gt;&#xA;&lt;li&gt;look up this MAC address in the forwarding tables of your switches to identify the switch port to which this server is connected&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Possibly you have ARP entries for 172.16.40.204 on other machines in your network. In that case you can skip the first two steps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The MAC address may also help you identify the brand of machine providing these DHCP services, by using a vendor lookup tool like &lt;a href=&quot;http://www.coffer.com/mac_find/&quot; rel=&quot;noreferrer&quot;&gt;this one&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-05-25T10:44:24.043" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41462" PostTypeId="2" ParentId="41459" CreationDate="2017-05-25T10:45:01.020" Score="4" Body="&lt;p&gt;Most likely you have a rogue DHCP server on your network.  Probably a Home grade router that someone brought in to get more network ports in their office or area.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need to hunt down the MAC address in the Hardware Address Tables of your switches so you can find the device and confiscate it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First thing to do is to find out the MAC address of the gateway IP that's being handed out.  Do that by first pinging the DHCP server's IP address from the router it's showing up on.  Then query the ARP table on the router &lt;code&gt;show arp&lt;/code&gt;.  Either that, or get a laptop to get a DHCP lease from the device, ping the dhcp server's address, then run &lt;code&gt;arp -an&lt;/code&gt; on the laptop to get the MAC address of the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you have your MAC address, you can search the MAC address tables on your switches to try and find it &lt;code&gt;show mac-address-table&lt;/code&gt;.  Start with the switches closest to the router.  The arp table will show the port that MAC address is associated with.  If there's another switch plugged into that port, get onto that switch and repeat the process until you find a port associated with the DHCP server's MAC address that isn't plugged into another piece of your network equipment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once you've identified the port, go trace some cables and find out where your rogue device is physically.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then you have the sometimes fun task of writing paperwork to discipline the user that plugged un-authorized equipment into your network.  Make sure you have a &lt;strong&gt;company policy&lt;/strong&gt; that prohibits such things.  &lt;strong&gt;Don't&lt;/strong&gt; actually confiscate the device unless you're allowed to by that policy.  You should be able to remove the device from the network however with no issues.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that it may also be one of those newer printers with WiFi.  This may be solved by re-configuring the device to not act as a DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't have a policy in place, write one!  Then get your C-level executives to sign off on it.  The network is the company's property and you are it's caretaker.  You need to make sure you have the authorization to protect it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, investigate your network device vendor's documentation on DHCP snooping.   This can help you lock down your network and keep rogue DHCP servers from doing any damage.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: Static IPs everywhere?!?  You must not have a lot of hosts on the network.  I would take a look at implementing DHCP leases instead of Static IPs.  That way you have more control over the things plugged into your network and your address space.&lt;/p&gt;&#xA;" OwnerUserId="8251" LastActivityDate="2017-05-25T10:45:01.020" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41463" PostTypeId="2" ParentId="41423" CreationDate="2017-05-25T11:20:04.950" Score="1" Body="&lt;p&gt;I got it working(with guidance of my colleague), please have a look at the configs, note that there is a minor change in the ip(replace 192 with 172), replace 1.0.1.1 with 100.0.0.1; and f0/1 is replaced with subinterfaces.&#xA;Below are the working configs of my lab in GNS3.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#ter len 0&#xA;R1#&#xA;R1#&#xA;R1#&#xA;R1#&#xA;R1#sho run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1076 bytes&#xA;!&#xA;! Last configuration change at 16:46:26 UTC Thu May 25 2017&#xA;!&#xA;version 15.2&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;!&#xA;hostname R1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip domain name lab.local&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; ip address 100.0.0.1 255.255.255.255&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex full&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 172.16.1.14 255.255.255.252&#xA; ip ospf 1 area 0&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet1/1&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;router ospf 1&#xA; network 100.0.0.1 0.0.0.0 area 0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip route 0.0.0.0 0.0.0.0 172.16.1.13&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;R1#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On R2:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#sho run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1697 bytes&#xA;!&#xA;! Last configuration change at 16:48:08 UTC Thu May 25 2017&#xA;!&#xA;version 15.2&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;!&#xA;hostname R2&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;vrf definition TEST&#xA; rd 2:1&#xA; !&#xA; address-family ipv4&#xA; exit-address-family&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip domain name lab.local&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex full&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 172.16.2.9 255.255.255.252&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet1/1&#xA; no ip address&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet1/1.2000&#xA; encapsulation dot1Q 2000&#xA; vrf forwarding TEST&#xA; ip address 172.16.1.9 255.255.255.252&#xA;!&#xA;interface FastEthernet2/0&#xA; ip address 172.16.1.13 255.255.255.252&#xA; ip ospf 1 area 0&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet2/1&#xA; no ip address&#xA; shutdown&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;router ospf 1&#xA;!&#xA;router bgp 65002&#xA; bgp log-neighbor-changes&#xA; neighbor 172.16.2.10 remote-as 65003&#xA; !&#xA; address-family ipv4&#xA;  redistribute ospf 1&#xA;  neighbor 172.16.2.10 activate&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf TEST&#xA;  neighbor 172.16.1.10 remote-as 65003&#xA;  neighbor 172.16.1.10 activate&#xA;  neighbor 172.16.1.10 allowas-in&#xA; exit-address-family&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip route 172.16.1.8 255.255.255.252 FastEthernet1/1.2000&#xA;!&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On R3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R3#ter len 0&#xA;R3#sho run&#xA;Building configuration...&#xA;&#xA;Current configuration : 1567 bytes&#xA;!&#xA;! Last configuration change at 16:23:00 UTC Thu May 25 2017&#xA;!&#xA;version 15.2&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;!&#xA;hostname R3&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;!&#xA;vrf definition TEST&#xA; rd 3:1&#xA; !&#xA; address-family ipv4&#xA;  import ipv4 unicast map GLOBAL_TO_VRF&#xA; exit-address-family&#xA;!&#xA;!&#xA;no aaa new-model&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip domain lookup&#xA;ip domain name lab.local&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; shutdown&#xA; duplex full&#xA;!&#xA;interface FastEthernet1/0&#xA; ip address 172.16.2.10 255.255.255.252&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet1/1&#xA; no ip address&#xA; speed auto&#xA; duplex auto&#xA;!&#xA;interface FastEthernet1/1.2000&#xA; encapsulation dot1Q 2000&#xA; vrf forwarding TEST&#xA; ip address 172.16.1.10 255.255.255.252&#xA;!&#xA;router bgp 65003&#xA; bgp log-neighbor-changes&#xA; neighbor 172.16.2.9 remote-as 65002&#xA; !&#xA; address-family ipv4&#xA;  neighbor 172.16.2.9 activate&#xA; exit-address-family&#xA; !&#xA; address-family ipv4 vrf TEST&#xA;  neighbor 172.16.1.9 remote-as 65002&#xA;  neighbor 172.16.1.9 activate&#xA; exit-address-family&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;ip route vrf TEST 172.16.2.8 255.255.255.252 172.16.2.9 global&#xA;!&#xA;access-list 10 permit any log&#xA;!&#xA;route-map GLOBAL_TO_VRF permit 10&#xA; match ip address 10&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line aux 0&#xA; exec-timeout 0 0&#xA; privilege level 15&#xA; logging synchronous&#xA; stopbits 1&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;end&#xA;&#xA;R3#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Verification:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R2#ping vrf TEST 100.0.0.1&#xA;Type escape sequence to abort.&#xA;Sending 5, 100-byte ICMP Echos to 100.0.0.1, timeout is 2 seconds:&#xA;!!!!!&#xA;Success rate is 100 percent (5/5), round-trip min/avg/max = 52/60/68 ms&#xA;R2#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="5235" LastActivityDate="2017-05-25T11:20:04.950" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41466" PostTypeId="2" ParentId="32511" CreationDate="2017-05-25T13:45:59.063" Score="1" Body="&lt;p&gt;With RSTP the tree needs to converge which takes appr. 4-6 seconds. If you need a faster converge rate you'd need to look at something like SPB or various proprietary alternatives.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, arranging the switches in a ring may save ports but isn't the best approach. The image linked by user4565 provides a better way with two redundant core switches (which you set up with the lowest STP priority) and the rest arranged into a fabric. This will also ensure the fastest possible converge rate with RSTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Still additionally: you should consider providing redundancy through L3/IP multipathing instead of through L2 spanning tree. For IP multipathing you provide (usually) two independent L2 and L3 paths through the fabric.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without redundant bridge loops you can deactivate spanning tree(!), which saves dead reconvergence time and also has the benefit that all physical links can actually be utilized. In the cisco example, you'd connect all left switches to each other for one path and all right switches to each other for the other path.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Of course, you don't need to do the split in half on the physical switch level, you can also do it on the logical VLAN level.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-09-22T19:21:32.603" LastActivityDate="2017-09-22T19:21:32.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41467" PostTypeId="1" AcceptedAnswerId="41469" CreationDate="2017-05-25T13:55:00.913" Score="1" ViewCount="145" Body="&lt;pre&gt;&lt;code&gt;                   DST Host&#xA;                    |&#xA;                    |&#xA;             +-------------+&#xA;             |             |&#xA;             |    RTR3     |&#xA;             |             |&#xA;             +-------------+&#xA;              |           |&#xA;              |           |&#xA;             RTR1--------RTR2&#xA;               | e0       |e1&#xA;               |          |&#xA;               | e0       |e1&#xA;  (Loopback1) SW1        SW2 (loopback2)&#xA;                          |&#xA;                          |&#xA;                         SRC HOST&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;In the above topology, SW1 and SW2 are running ospf on e0 and e1 interfaces. They are also running ospf passive on Loopback 1 and Loopback2. RTR1 and RTR2 are also running OSPF on e0 and e1. Let's say SRC HOST is sending data to DST HOST. I want to apply a NAT rule in SW2 such that packet destined to DST HOST shall have its Source IP translated to Loopback1's IP address. Will this packet reach DST HOST? Can any of the following happen with this packet:&#xA;1. Can RTR2 drop this packet?&#xA;2. Can this packet trigger an incorrect learning in RTR2's L2 table such that RTR2 thinks to reach nexthop, SW1' e0 IP address, destination mac is SW2's e1's MAC?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance. &lt;/p&gt;&#xA;" OwnerUserId="34556" LastActivityDate="2017-05-25T14:28:06.920" Title="Need help with a scenario involving NAT" Tags="|routing|switch|ospf|snat|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41468" PostTypeId="1" AcceptedAnswerId="41501" CreationDate="2017-05-25T14:11:21.190" Score="1" ViewCount="11413" Body="&lt;p&gt;So I thought I knew how to set up my DHCP Server on my 3550 switch and reserve IP's for clients. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I go into the pool I need to reserve the IP in, but I do not have the address command as an option to do it like I have in the past on IOS.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxx3550#sh version &#xA;Cisco IOS Software, C3550 Software (C3550-IPSERVICES-M), Version 12.2(35)SE5, RELEASE SOFTWARE (fc1)&#xA;Copyright (c) 1986-2007 by Cisco Systems, Inc.&#xA;Compiled Thu 19-Jul-07 21:08 by nachen&#xA;Image text-base: 0x00003000, data-base: 0x00D45C28&#xA;ROM: Bootstrap program is C3550 boot loader&#xA;xxx3550 uptime is 1 year, 30 weeks, 6 days, 2 hours, 3 minutes&#xA;System returned to ROM by power-on&#xA;System restarted at 07:35:09 EDT Thu Oct 22 2015&#xA;System image file is &quot;flash:c3550-ipservices-mz.122-35.SE5/c3550-ipservices-mz.122-35.SE5.bin&quot;&#xA;Cisco WS-C3550-24-PWR (PowerPC) processor (revision L0) with 65526K/8192K bytes of memory.&#xA;Processor board ID CAT0937R3D4&#xA;Last reset from warm-reset&#xA;Running Layer2/3 Switching Image&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is the DHCP pool config&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool data&#xA;   network 192.168.5.0 255.255.255.0&#xA;   default-router 192.168.5.1 &#xA;   dns-server xxx.xxx.xxx.x xxx.xxx.xxx.x &#xA;   lease 8&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When i go into dhcp pool configuration I do have the following available:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;xxx3550(config)#ip dhcp pool data &#xA;xxx3550(dhcp-config)#?&#xA;DHCP pool configuration commands:&#xA;  bootfile             Boot file name&#xA;  client-identifier    Client identifier&#xA;  client-name          Client name&#xA;  default-router       Default routers&#xA;  dns-server           DNS servers&#xA;  domain-name          Domain name&#xA;  exit                 Exit from DHCP pool configuration mode&#xA;  hardware-address     Client hardware address&#xA;  host                 Client IP address and mask&#xA;  import               Programatically importing DHCP option parameters&#xA;  lease                Address lease time&#xA;  netbios-name-server  NetBIOS (WINS) name servers&#xA;  netbios-node-type    NetBIOS node type&#xA;  network              Network number and mask&#xA;  next-server          Next server in boot process&#xA;  no                   Negate a command or set its defaults&#xA;  option               Raw DHCP options&#xA;xxx3550(dhcp-config)#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I just need to reserve an IP address for a specific MAC Address. I usually do&#xA; &lt;code&gt;Address xxx.xxx.xxx.xx Hardware-Address AABB.CC00.11FF&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="14372" LastEditorUserId="33" LastEditDate="2018-12-05T22:03:41.733" LastActivityDate="2018-12-05T22:03:41.733" Title="Reserve an IP for client on Cisco DHCP server" Tags="|cisco|dhcp|cisco-catalyst|cisco-ios-12|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41469" PostTypeId="2" ParentId="41467" CreationDate="2017-05-25T14:13:45.703" Score="0" Body="&lt;p&gt;If you are using Cisco switches, then you certainly cannot do NAT on them. Cisco claims NAT requires hardware assist, and it only provides that on routers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, when you NAT a source address, that sets the return traffic to that destination. If the traffic from Switch 2 gets a source address of Switch 1's loopback, any return traffic will be directed to Switch 1's loopback, and Switch 1 has no idea what to do with that traffic, so it gets dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It sounds like you want Switches 1 and 2 to share a NAT table, but it doesn't work that way. The translated traffic will need to be returned to the device that has the translation table in order to get a reverse translation and be sent back to the correct device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You also seem to be confusing the layer-2 (MAC) addressing with the layer-3 (IP) addressing. Layer-2 switches will switch traffic only based on the MAC address in the frame header; they do not look into the frame to even see the layer-3 address in the packet header. Routers will strip off the frame, losing the MAC address, in order to get to the layer-3 packet, and they make their routing decisions based on the layer-3 desitation address, creating a new frame for the new interface in the path toward the destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you want to use NAT to change the source address, the destination host will use that address as the destination address for any return traffic, and a host on one network has no idea what the original layer-2 address was.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-25T14:28:06.920" LastActivityDate="2017-05-25T14:28:06.920" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41470" PostTypeId="2" ParentId="41468" CreationDate="2017-05-25T14:17:04.023" Score="3" Body="&lt;p&gt;You have to create another pool with &lt;code&gt;client-identifier&lt;/code&gt; and your Client ID, which usually defaults to MAC prepended with 01 (Ethernet client), or &lt;code&gt;hardware-address&lt;/code&gt; and your MAC like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool my-host&#xA;    host 10.0.0.1 255.255.255.0&#xA;    client-identifier 01AA.BBCC.0011.FF&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you prefer to configure it manually, please have a look at:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address &amp;lt;first IP&amp;gt; &amp;lt;last IP&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36992" LastEditorUserId="29564" LastEditDate="2017-05-25T19:34:27.683" LastActivityDate="2017-05-25T19:34:27.683" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41471" PostTypeId="1" AcceptedAnswerId="41472" CreationDate="2017-05-25T14:43:55.987" Score="1" ViewCount="862" Body="&lt;p&gt;I have a Cisco 3560 48-PoE.  I am trying to use it for imaging computers.  I can make it work but I only get 1gb a minute.  I have tried various tweaking but that's about has high as I can get.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the max I should be able to get on a closed network.  This is for one server and one client for the entire switch, same vlan, all stock out of the box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried jumbo frames and used ifconfig to change the mtu on the machines.  Didn't help.&lt;/p&gt;&#xA;" OwnerUserId="10344" LastEditorUserId="8499" LastEditDate="2018-12-25T05:19:28.193" LastActivityDate="2018-12-25T05:19:28.193" Title="What is the max throughput I should expect a Cisco 3560-PoE to have for a small network?" Tags="|cisco|switch|cisco-catalyst|interface|throughput|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="41472" PostTypeId="2" ParentId="41471" CreationDate="2017-05-25T14:57:01.783" Score="2" Body="&lt;p&gt;When I see a problem such as you describe, it is almost always a duplex mismatch. Look at the statistics on your switch interfaces. If you see a lot of collisions (should not exist on a full-duplex switch interface) and/or FCS, then you have a duplex mismatch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A duplex mismatch usually occurs when on side of a link is set to auto-negotiate, but the other side of the link is set to a fixed speed. When this is the case, the side set to auto-negotiate cannot negotiate. It will detect the fixed speed, and it will default to the duplex for the speed (half duplex for 10 or 100 Mbps).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco has a document, &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/switches/catalyst-6500-series-switches/17053-46.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Troubleshooting Cisco Catalyst Switches to NIC Compatibility Issues&lt;/em&gt;&lt;/a&gt;, that describes this, that includes a table that tells you what happens at various settings.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-25T17:07:47.967" LastActivityDate="2017-05-25T17:07:47.967" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41473" PostTypeId="1" AcceptedAnswerId="41474" CreationDate="2017-05-25T15:41:03.683" Score="1" ViewCount="383" Body="&lt;p&gt;I have a Cisco C891F with 2 VLAN and 2 WAN, each VLAN has a route map so VLAN1 uses WAN1 and VLAN2 uses WAN2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices are reaching the internet correctly on their routed outbound WAN interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices from VLAN1 can reach the gateway of VLAN2 and viceversa, but they can't reach devices from the other VLAN, doing a traceroute it sends them through the WAN interface without being able to find the destination since they go outside the router to the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Abbreviated configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; !&#xA; ip dhcp excluded-address 10.0.0.1 10.0.0.50&#xA; ip dhcp excluded-address 10.0.1.1 10.0.1.50&#xA; !&#xA; ip dhcp pool vlan1&#xA;   network 10.0.0.0 255.255.255.0&#xA;   default-router 10.0.0.1&#xA;   dns-server 10.0.0.12 10.0.0.10&#xA; !&#xA; ip dhcp pool vlan2&#xA;   network 10.0.1.0 255.255.255.0&#xA;   default-router 10.0.1.1&#xA;   dns-server 10.0.0.12 10.0.0.10&#xA; !&#xA; interface GigabitEthernet8&#xA;   description WAN1&#xA;   ip address 10.0.10.42 255.255.255.248&#xA;   no ip redirects&#xA;   no ip unreachables&#xA;   no ip proxy-arp&#xA;   ip nat outside&#xA;   ip virtual-reassembly in&#xA;   duplex auto&#xA;   speed auto&#xA;   no keepalive&#xA;   no cdp enable&#xA;!&#xA;interface FastEthernet0&#xA;  description WAN2&#xA;  ip address dhcp&#xA;  no ip redirects&#xA;  no ip unreachables&#xA;  no ip proxy-arp&#xA;  ip nat outside&#xA;  ip virtual-reassembly in&#xA;  duplex full&#xA;  speed auto&#xA;  no keepalive&#xA;  no cdp enable&#xA;!&#xA;interface Vlan1&#xA;  description VLAN1&#xA;  ip address 10.0.0.1 255.255.255.0&#xA;  ip access-group VIRUS in&#xA;  no ip proxy-arp&#xA;  ip nat inside&#xA;  ip inspect Firewall in&#xA;  ip virtual-reassembly in&#xA;  ip policy route-map ISP_SELECT&#xA;!&#xA;interface Vlan2&#xA;  description VLAN2&#xA;  ip address 10.0.1.1 255.255.255.0&#xA;  ip access-group VIRUS in&#xA;  no ip proxy-arp&#xA;  ip nat inside&#xA;  ip inspect Firewall in&#xA;  ip virtual-reassembly in&#xA;  ip policy route-map ISP_SELECT&#xA;!&#xA;ip nat inside source list WAN1 interface GigabitEthernet8 overload&#xA;ip nat inside source list WAN2 interface FastEthernet0 overload&#xA;ip route 0.0.0.0 0.0.0.0 10.0.10.41&#xA;ip route 0.0.0.0 0.0.0.0 FastEthernet0&#xA;!&#xA;ip access-list standard WAN1&#xA;  permit 10.0.0.0 0.0.0.255&#xA;ip access-list standard WAN2&#xA;  permit 10.0.1.0 0.0.0.255&#xA;!&#xA;route-map ISP_SELECT permit 10&#xA;  match ip address WAN1&#xA;  set interface GigabitEthernet8&#xA;!&#xA;route-map ISP_SELECT permit 20&#xA; match ip address WAN2&#xA; set interface FastEthernet0&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I fail to understand why only the gateways are reachable from the opposite VLAN and not the whole subnet.&lt;/p&gt;&#xA;" OwnerDisplayName="user34559" LastActivityDate="2017-05-25T15:52:13.900" Title="Why is InterVLAN routing not working in the following scenario?" Tags="|cisco|routing|vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41474" PostTypeId="2" ParentId="41473" CreationDate="2017-05-25T15:52:13.900" Score="1" Body="&lt;p&gt;This is because PBR sends your packets to outside interfaces. To fix that you should replace standard ACL's by extended ACL's and in first lines deny traffic to RFC1918 networks. Example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip access-list extended WAN1&#xA; deny ip 10.0.0.0 0.0.0.255 10.0.0.0 0.255.255.255&#xA; deny ip 10.0.0.0 0.0.0.255 172.16.0.0 0.15.255.255&#xA; deny ip 10.0.0.0 0.0.0.255 192.168.0.0 0.0.255.255&#xA; permit ip 10.0.0.0 0.0.0.255 any&#xA;&#xA;ip access-list extended WAN2&#xA; deny ip 10.0.1.0 0.0.0.255 10.0.0.0 0.255.255.255&#xA; deny ip 10.0.1.0 0.0.0.255 172.16.0.0 0.15.255.255&#xA; deny ip 10.0.1.0 0.0.0.255 192.168.0.0 0.0.255.255&#xA; permit ip 10.0.1.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="29556" LastActivityDate="2017-05-25T15:52:13.900" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41475" PostTypeId="1" AcceptedAnswerId="41476" CreationDate="2017-05-25T18:47:46.747" Score="1" ViewCount="2799" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OJ8yU.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OJ8yU.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;I am having trouble with basic OSPF redistribution into BGP. BGP peers between R10 and R12 are up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have full connectivity between Area 0. R10 0/0 is also in that area. I cannot get BGP routes from R10-&gt;R12  to redistribute into my OSPF area. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I put a &lt;code&gt;default-information originate always&lt;/code&gt; statement in (quad 0's) this will allow connectivity. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I created R28 and was able to get RIP E2 routes into the OSPF, so I am not crazy. R6 shows the E2 route from RIP is getting in. I have tried every method of BGP redistribution (e.g. subnets, connected, metric, etc.). Thoughts greatly appreciated!!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R10 routing configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R10#sh run | sec router&#xA;router ospf 1&#xA; log-adjacency-changes&#xA; redistribute bgp 65000 subnets&#xA; redistribute rip subnets&#xA;router rip&#xA; version 2&#xA; redistribute ospf 1 metric 0&#xA; network 172.0.0.0&#xA; no auto-summary&#xA;router bgp 65000&#xA; no synchronization&#xA; bgp log-neighbor-changes&#xA; redistribute ospf 1&#xA; neighbor 15.1.1.2 remote-as 65000&#xA; no auto-summary&#xA;&#xA;R10#&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R6 routing table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R6#sh ip route&#xA;&#xA;     3.0.0.0/32 is subnetted, 1 subnets&#xA;O       3.3.3.3 [110/3] via 78.33.28.1, 03:56:04, FastEthernet0/1&#xA;     6.0.0.0/32 is subnetted, 1 subnets&#xA;C       6.6.6.6 is directly connected, Loopback0&#xA;     172.0.0.0/30 is subnetted, 1 subnets&#xA;O E2 172.0.0.0 [110/20] via 78.33.44.2, 00:08:54, FastEthernet1/0&#xA;     78.0.0.0/30 is subnetted, 8 subnets&#xA;C       78.33.44.0 is directly connected, FastEthernet1/0&#xA;O       78.33.38.0 [110/4] via 78.33.28.1, 02:20:11, FastEthernet0/1&#xA;O       78.33.34.0 [110/4] via 78.33.28.1, 02:20:12, FastEthernet0/1&#xA;C       78.33.32.0 is directly connected, FastEthernet0/0&#xA;O       78.33.13.0 [110/3] via 78.33.28.1, 03:56:06, FastEthernet0/1&#xA;O       78.33.30.0 [110/3] via 78.33.28.1, 03:56:06, FastEthernet0/1&#xA;C       78.33.28.0 is directly connected, FastEthernet0/1&#xA;O       78.33.24.0 [110/2] via 78.33.28.1, 03:56:07, FastEthernet0/1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tZ3sS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tZ3sS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37062" LastEditorUserId="8499" LastEditDate="2017-05-25T20:34:36.397" LastActivityDate="2017-05-25T20:34:36.397" Title="OSPF into BGP Redistribution issue" Tags="|cisco|redistribution|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41476" PostTypeId="2" ParentId="41475" CreationDate="2017-05-25T18:58:43.770" Score="0" Body="&lt;p&gt;From what I see in your network, you are redistributing &lt;code&gt;172.0.0.0&lt;/code&gt; from RIP into OSPF, and you are not originating any routes in OSPF. You are then redistributing OSPF into iBGP, but the original RIP route is being seen in the other router through OSPF, not iBGP. That would be normal because OSPF has an AD of 110, but iBGP has an AD of 200. Basically, R6 trusts any routes received from OSPF mare than the same routes received from iBGP, so the OSPF routes get installed into its routing table instead of the iBGP routes.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-25T18:58:43.770" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41477" PostTypeId="1" AcceptedAnswerId="41478" CreationDate="2017-05-25T19:00:46.860" Score="9" ViewCount="1596" Body="&lt;p&gt;Other than not being able to claim any more IP addresses in a subnet, what other bad things happen when a subnet reaches 100% utilization, if anything?&lt;/p&gt;&#xA;" OwnerUserId="37063" LastEditorUserId="8499" LastEditDate="2019-01-12T17:10:40.293" LastActivityDate="2019-01-12T17:10:40.293" Title="What happens when a subnet reaches capacity?" Tags="|ip|ipv4|subnet|ipv6|ip-address|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41478" PostTypeId="2" ParentId="41477" CreationDate="2017-05-25T19:10:00.257" Score="19" Body="&lt;p&gt;A subnet (network) is really just a collection of contiguous addresses within a binary mask. It is simply a logical way to divide address block. If you run out of addresses in a network (subnet), then you are simply out of addresses in that network. Adding any more hosts would require reclaiming unused addresses, expanding the network (may not be possible), or adding a new network (requires a router to communicate between networks).&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-25T19:10:00.257" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="41479" PostTypeId="2" ParentId="38354" CreationDate="2017-05-25T19:24:16.890" Score="1" Body="&lt;p&gt;Are you sure this has anything to do with ARP? The 1920 is a layer2 switch and doesn't need to do any ARP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd suspect it has more to do with the subnet size especially the DHCP scope. Once IP address allocation is exhausted - which for the most common /24 subnet size is 256 (or rather 254), you need to enlarge the network. If you've just got this single subnet it's not too hard to do.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-25T19:24:16.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41480" PostTypeId="2" ParentId="39950" CreationDate="2017-05-25T19:38:00.483" Score="1" Body="&lt;p&gt;If you're using the GUI create a new (logical) interface of type hardware switch, add the physical interfaces to it and name it. If there aren't any physical ports available you'd need to remove them first from the logical interface they currently belong to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routing is activated by assigning IP addresses to the newly created interfaces and adding the appropriate firewall policy to allow traffic to be forwarded.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2018-01-20T23:36:59.523" LastActivityDate="2018-01-20T23:36:59.523" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41482" PostTypeId="2" ParentId="29281" CreationDate="2017-05-25T20:02:11.123" Score="2" Body="&lt;p&gt;Check for FCS errors on both switch ports. If there are none for more than a day there's no need to worry at all.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-25T20:02:11.123" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41483" PostTypeId="1" AcceptedAnswerId="41484" CreationDate="2017-05-25T21:06:04.013" Score="2" ViewCount="783" Body="&lt;p&gt;I've been handed a project, and I'm familiar but not experienced enough to make a solid decision on this. I'm actually on the firewall side of things. We've lost our lead engineer and I'm wondering if someone can help with a sample of what would be the best setup for this. I know that OSPF would be for the LAN, and HSRP for failover between the routers on each side, but not sure about the rest of what the customer is wanting. I've included their write-up as well as the diagram:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The customer decided that it needed a redundant WAN topology to ensure that Minneapolis users have a secondary path to the main datacenter in Chicago. To do this, they purchased a private fiber line between sites. Currently, the private fiber is the primary path between Chicago and Minneapolis. Static routing is in place today to steer traffic over this line. The network director has decided that static routing is not the answer and in order to automate failover/failback between WAN paths, routing protocols should be leveraged. BGP is already in use with the MPLS provider between the CE and PE routers and this cannot be changed. You have control over all devices with the exception of the PE router.&#xA;The customer has decided that eBGP, iBGP and OSPF can be used (one or a combination of all 3) and all static routes must be removed. Customer requires that the primary path be the Private fiber and secondary path be the MPLS. Minneapolis also needs to receive a default route from Chicago for internet access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/36vaN.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/36vaN.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37068" LastEditorUserId="8499" LastEditDate="2018-12-25T05:20:28.397" LastActivityDate="2018-12-25T05:20:28.397" Title="Network design questions" Tags="|cisco|routing|network|switching|design|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41484" PostTypeId="2" ParentId="41483" CreationDate="2017-05-25T21:17:41.647" Score="2" Body="&lt;p&gt;If you are running EIGRP over the leased line, then the routes over that link will have an AD of 90. If the routes from the PE come to the CE via iBGP, then the AD will be 200 for those. The routes received from EIGRP will naturally be preferred over those received from iBGP. That means that your scenario will work out without any changes or routing policies, and the network should fail over from the leased line to the MPLS connection automatically, and go back when EIGRP is reestablished once the leased line comes back up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same holds true for OSPF (AD 110) and iBGP (AD 200). The only hitch would be with eBGP (different ASes) which has an AD of 20 (lower than other routing protocols).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If, on the other hand, you are running EIGRP between the CE and PE as is shown in the drawing, then you can decrease the bandwidth or increase the delay (really only labels) on the CE interface toward the PE, and you will then prefer the routes received from the leased line.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-05-26T00:32:52.560" LastActivityDate="2017-05-26T00:32:52.560" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="41485" PostTypeId="2" ParentId="41252" CreationDate="2017-05-25T22:37:32.557" Score="1" Body="&lt;p&gt;The vehicles in this network would be hosts in an actual SDN.&#xA;Since the openFlow kind of SDN switches do not store the state information, there exists no way you can store geographical(read state) information of the vehicles(host) in the forwarding devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, there is a potential to store the location information within the controller. Controllers like ODL are getting more and more stateful.  The centralized repo can easily handle dynamically changing location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your second question is too generic and is not directly related with the usecase you brought up. The problem of a dying controller is major issue in the SDN networks. To solve that, there are multiple topologies(linear, tree, sliced) of the distributed control plane available with different merits as per the usecase. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Nonetheless, that's an interesting use case of SDN.&lt;/p&gt;&#xA;" OwnerUserId="37031" LastActivityDate="2017-05-25T22:37:32.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41486" PostTypeId="2" ParentId="40656" CreationDate="2017-05-26T02:33:24.740" Score="2" Body="&lt;p&gt;It's a reasonable thing to do, technically, but I don't believe it will help improve the users' experience, which is really the only thing that matters in mobile networks. And so, why bother? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consider that voice (rtp) is packetized into tiny lumps, 20 ms being typical. That translates into a lot of small packets, rather than a few large ones, that might benefit from the larger MTU. SIP, the signaling protocol, might do, because in IMS networks the messages are quite large, but that doesn't really contribute to the users perception of their experience. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Data flows are the other case, eg video or email, but again, the video is is short packets and the email (which is typically really https) is not time and latency sensitive in a way that messing with the MTU would help. &lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2017-05-26T02:33:24.740" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41488" PostTypeId="2" ParentId="40773" CreationDate="2017-05-26T07:40:01.957" Score="2" Body="&lt;p&gt;To allow IPSEC tunnel between two sites behind NAT you should have at least one site with NATted udp/500 and udp/4500 from outside to inside.&lt;/p&gt;&#xA;" OwnerUserId="29556" LastActivityDate="2017-05-26T07:40:01.957" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41489" PostTypeId="2" ParentId="40773" CreationDate="2017-05-26T07:44:32.167" Score="3" Body="&lt;p&gt;If you can't forward port on any of the two sites, you cannot establish a VPN directly between the two sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could establish a VPN from each site to a third one, and route accordingly (as suggested in comment by @peterh).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I would try to work with the ISP to have a solution, and if the ISP cant / doesn't want to help, change the ISP.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-05-26T07:44:32.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41493" PostTypeId="1" AcceptedAnswerId="41514" CreationDate="2017-05-26T11:01:37.693" Score="1" ViewCount="202" Body="&lt;p&gt;&lt;br&gt;&#xA;In IS-IS the router knows the interfaces addresses of the other routers. So would it be possible to connect two IPv6 areas over an IPv4 area?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router in area A knows that the destination ipv6 address is at the router in area B. So the route would be set, isn't it?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But what would be the destination of this packet when it is on the IPv4 area?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;best regards&lt;/p&gt;&#xA;" OwnerUserId="37080" LastEditorUserId="8499" LastEditDate="2018-03-12T00:26:52.280" LastActivityDate="2018-03-12T00:26:52.280" Title="IS-IS IPv6 over IPv4" Tags="|routing|ipv4|ip|ipv6|is-is|" AnswerCount="4" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41494" PostTypeId="2" ParentId="41493" CreationDate="2017-05-26T11:08:43.360" Score="1" Body="&lt;p&gt;IS-IS doesn't help you with crossing IPv4 territory for IPv6, you'll need to use a tunnel.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-26T11:08:43.360" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41496" PostTypeId="2" ParentId="40773" CreationDate="2017-05-26T14:40:02.280" Score="1" Body="&lt;p&gt;Without port/protocol forwarding there's no way to connect into either site.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Get yourself an external server with a static address, connect VPNs out from both sites and tie the tunnels together on the external server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additonally, if your ISP routers don't support IPsec traversal you'll be better off with SSL VPN. As peterh suggested, OpenVPN might be a good choice.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, get your ISP to route your sites with at least one static address without NAT.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-26T14:40:02.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41498" PostTypeId="2" ParentId="29456" CreationDate="2017-05-26T15:03:50.347" Score="1" Body="&lt;p&gt;A few things to note.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Wallports with punchdowns are generally only suitable for solid core cable. Plugs may be suitable for solid, stranded or both. Check the datasheets carefully before buying any plugs (and if the datasheet doesn't say go with a different brand.&lt;/li&gt;&#xA;&lt;li&gt;Criming plugs is a fiddly PITA, punchdowns are much easier.&lt;/li&gt;&#xA;&lt;li&gt;Generally running cable is much easier if it doesn't have plugs on the end.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Generally in most installation work you are using bulk solid core cable off a spool. So punchdowns are the way to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;OTOH female-female couplers are the way to go if for whatever reason you want to have stranded cables on both sides.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-07-26T14:56:25.913" LastActivityDate="2017-07-26T14:56:25.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41499" PostTypeId="2" ParentId="41493" CreationDate="2017-05-26T15:05:21.700" Score="0" Body="&lt;p&gt;IS-IS can carry routes for different protocols, but it does not tunnel the packets for the protocols themselves. IPv4 and IPv6 are two completely separate protocols. There are solutions for tunneling IPv6 in IPv4, and you would still need to do something like that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It really is no different than using BGP-MP or OSPFv3, both of which can carry routes for both IPv4 and IPv6, but you will need some method to encapsulate IPv6 packets inside IPv4 packets to cross an IPv4-only area. The routers inside the IPv4-only area will have no idea what to do with IPv6 packets entering the area, so they would be dropped.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-26T15:05:21.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41500" PostTypeId="2" ParentId="41493" CreationDate="2017-05-26T15:39:05.687" Score="3" Body="&lt;p&gt;IPv4 and IPv6 are two incompatible protocols.  In order to forward your IPv6 data across an IPv4 network, you have to use some sort of tunneling mechanism, where the IPv6 packet is encapsulated in an IPv4 packet.  This is because IPv4 devices do not understand IPv6.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IS-IS or any other routing protocol, has nothing to do with this process.  The function of routing protocols is to populate the routing table so that the router knows which interface to forward the packet out of.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-05-26T15:39:05.687" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41501" PostTypeId="2" ParentId="41468" CreationDate="2017-05-26T15:59:01.800" Score="1" Body="&lt;p&gt;There is a solution to avoid the multiple manual bindings.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a link to Cisco documentation concerning DHCP origin and database files:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/15-mt/dhcp-15-mt-book/config-dhcp-server.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/15-mt/dhcp-15-mt-book/config-dhcp-server.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Essentially, you need a tftp/ftp server that records leases from the DHCP server in a database file (text file) on the Cisco device and reads the origin file (also a text file) in which you create all the manual bindings you need.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use this as a disaster recovery tool in case of an unplanned reboot of the Cisco DHCP server:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The binding database saves the network from a DHCP storm and consequent Denial of Service against the DHCP server (self-imposed in the case of not having the binding database).&lt;/li&gt;&#xA;&lt;li&gt;The origin file allows my static bindings to exist and can be edited programmatically as it is only a text file.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The above link contains examples and further reading links.  For older IOS versions (back to at least 12.4) you can refer to similar online resources.&lt;/p&gt;&#xA;" OwnerUserId="37088" LastActivityDate="2017-05-26T15:59:01.800" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41502" PostTypeId="1" AcceptedAnswerId="41503" CreationDate="2017-05-26T16:02:00.143" Score="3" ViewCount="634" Body="&lt;p&gt;I remember in uni that we implemented VPN tunnels always on the border routers and then use GRE tunnels to connect between two remote subnets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was always told that VPN tunnels need to know the external interface (Public IP) of the routers to implement.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was wondering though if there is a way to implement a VPN tunnel between two subnets from site-to-site. For example if we have a remote network with 3 subnets and I want to access the server on subnet 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Usually I would do what I learnt, a VPN tunnell between the two networks and a GRE tunnel for the subnet. But is this right? Or is it better way to do it? &lt;/p&gt;&#xA;" OwnerUserId="37087" LastActivityDate="2017-05-26T16:18:59.623" Title="Site-to-Site VPN tunnel configuration" Tags="|vpn|tunnel|gre|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41503" PostTypeId="2" ParentId="41502" CreationDate="2017-05-26T16:16:39.017" Score="1" Body="&lt;p&gt;A tunnel is really just encapsulation of packets within other packets. The outer packets still need to be able to be routed normally to the address of the tunnel source (different than the tunnel address itself. The packets carried inside the outer packets see the tunnel as a single link, but the outer packets may need to be routed over many hops, especially if routed over the public Internet (which requires public addresses for the outer packets). The tunnel source must be able to send traffic that gets routed to the other tunnel source normally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you have a tunnel source inside a private network, then you cannot use that over the public Internet because you cannot route packets with private addresses over the public Internet. That is why the tunnel source addresses are usually the public WAN addresses of sites. If both your tunnel endpoints are within the same private network, then you could put the tunnel endpoints on any of the devices, as long as the tunnel source can normally reach each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Over a tunnel, you can use routing protocols to let the router on the other end of the tunnel know about any networks at the site, so it doesn't really matter how many networks are on each side of the tunnel. A tunnel is really just like connecting the two sites with a cable because it sets up a single link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are different tunnel types, and some cannot carry broadcast/multicast traffic, so some routing protocols or multicast routing may not work over that tunnel type. You could use a GRE tunnel inside that type of tunnel to overcome this, or use a different tunnel type that supports the features you need to support. Another possibility is to use static routes between the sites, but that doesn't scale, and it is not dynamic the way routing protocols are.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could also have a problem if the private addressing at each of the two sites is using the same private addressing ranges. You may need to use NAT to overcome that.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-26T16:16:39.017" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41504" PostTypeId="2" ParentId="41502" CreationDate="2017-05-26T16:18:59.623" Score="0" Body="&lt;p&gt;why do you need a GRE tunnel ? You're already forming a tunnel via VPN (IPSec), so you dont need to form a GRE tunnel on top of it. There is no reason to use GRE in your case. IF you just need access to a remote server, form a VPN tunnel and then allow access to the server in the remote subnet 2. &#xA;GRE is a way to repackage the data in a new header. Reasons to do this vary, for instance you may want to send multicast over IPSec, or sometimes you may want to have GRE tunnels for Dynamic routing over IPSec VPN or service provicer MPLS... But normally, people do not need GRE and IPSec VPN together, VPN by itslef is enough. &lt;/p&gt;&#xA;" OwnerUserId="36373" LastActivityDate="2017-05-26T16:18:59.623" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41508" PostTypeId="2" ParentId="29250" CreationDate="2017-05-26T19:48:31.093" Score="0" Body="&lt;p&gt;Configure default gateway on the device (ex. PC) connected to the switch. On the switch it would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip default-gateway 192.168.11.100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37095" LastEditorUserId="509" LastEditDate="2017-05-27T06:47:02.857" LastActivityDate="2017-05-27T06:47:02.857" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41510" PostTypeId="1" CreationDate="2017-05-27T01:18:44.373" Score="1" ViewCount="42" Body="&lt;p&gt;I am trying to learn about computer networks. I often come across the term &quot;network service&quot;. When searching a bit, it is told that for example DHCP or HTTP are services. I don't understand this because for me DHCP and HTTP are protocols, and I guess that protocols and a &quot;network services&quot; are 2 different things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what exactly is a &quot;network service&quot;? Is it an application in which a protocol is programmed?&lt;/p&gt;&#xA;" OwnerUserId="37098" LastEditorUserId="8499" LastEditDate="2017-05-27T01:58:16.303" LastActivityDate="2017-05-27T01:58:16.303" Title="Network Service" Tags="|network|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41511" PostTypeId="2" ParentId="29250" CreationDate="2017-05-27T01:28:51.680" Score="2" Body="&lt;p&gt;Configure each VLAN with &quot;no shutdown.&quot; Make sure that the VLANs are active. &quot;Conf t&quot; and the type &quot;vlan 2&quot; and see if that brings the VLAN up. Do this with the rest of the VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure that each switch has all VLANs configured, or else you won't be able to trunk those VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This should solve your problem...&lt;/p&gt;&#xA;" OwnerUserId="35089" LastActivityDate="2017-05-27T01:28:51.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41512" PostTypeId="2" ParentId="41510" CreationDate="2017-05-27T01:30:09.543" Score="1" Body="&lt;p&gt;Yes, DHCP and HTTP are protocols, but they are also services. Those are protocols to speak with servers that perform a function or service for you: DHCP is used to communicate with a DHCP server in order to get configuration information for your host, and HTTP is a protocol to communicate with an HTTP (Web) server in order to get web pages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In general these type of protocols and services are off-topic here because they are applications or protocols above OSI layer-4.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-27T01:30:09.543" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41513" PostTypeId="2" ParentId="36837" CreationDate="2017-05-27T02:21:36.553" Score="2" Body="&lt;p&gt;Great topic.  I'd like to preface my answers with some relevant information, then answer your questions as you've asked.&#xA;&quot;Roaming&quot; is defined as a wireless client migrating from one access point to another.  &quot;Seamless&quot; roaming (aka Fast Roaming, aka Zero Handoff, aka IEEE 802.11r) is defined as a wireless client migrating from one base station to another in a fast, seamless, and &quot;secure&quot; manner.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to your questions.  You asked, &lt;strong&gt;&quot;I expect that somehow the new AP must inform the old one the station has roamed successfully and I suspect it must be done with packets sent through the switch.  I really wanted to know: How It's done in practice?&quot;.&lt;/strong&gt;  Answer:  The new AP does not inform the old ap that the station has roamed successfully.  In fact, the two access points do not communicate to eachother at all.  Even if they were the same model, they don't communicate to eachother.  A wireless network designed as described above is not capable of &quot;fast roaming&quot;, just &quot;roaming&quot;.  A real-world test to prove this to yourself is to connect a wireless VOIP phone to the wireless network, then have a phone conversation on it while roaming.  You will hear a signifigant interruption in your conversation.  Fast roaming would be achieved with another wireless design using a wireless controller (or a bridge).  But your question is, &quot;How is it done in practice&quot; (&quot;it&quot; being how the communication occurs for a successful wireless client migration from one ap to another).  Here's how it happens in the network you have designed, which is a normal SOHO network.  The client is already connected to an access point.  As it physically moves, the client wirelessly probes and finds that another access point also has the BSSID it uses AND has a stronger wireless signal (aka RSSI value) than the one it's currently connected to.  Before we continue, let's state one fact.  A wireless client can only be associated to one access point at a time.  So knowing this, it must &quot;disassociate&quot; from the one it's connected to now before it can &quot;associate&quot; to the stronger one.  So the wireless client sends it's current access point a &quot;disassociation request&quot; (aka Disassociation Frame) and disconnects from it.  Then, the wireless client connects to the new access point by going through its association and authentication process.  Once the wireless client is accepted onto the new access point, that access point communicates to the switch that the mac address can now be found on this switchport.  The switch updates its mac address table and moves the wireless client's mac from the old access point's switchport (in the table) to the new switchport belonging to the new ap.  At this point, the wireless client begins network communication.  All of that was done and the two ap's did not communicate to eachother at all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your second question is: (translated) &lt;strong&gt;What would those packets look like?&lt;/strong&gt;  Answer:  On your wireless client, load the latest version of Wireshark and begin a packet capture before you roam.  After you roam, stop the capture.  You can analyze your traffic to whatever degree you are comfortable with.  NOTE: It would be best to make sure you have the latest wireless &quot;driver&quot; on your device first.  You mentioned that you tried sniffing on the switch and saw nothing.  You now know that to see the migration, you need to sniff on your wlan adapter.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your last question is:  &lt;strong&gt;&quot;I read a CISCO networking book about this topic, but It only contains a recommendation about this process, and It says implementation depends on the manufacturer. But what if the APs made by different manufacturer?&quot;.&lt;/strong&gt;  Answer:  Cisco is correct.  The implementation does depend on the manufacturer.  Each manufacturer thinks they have a better way for a wireless access point to handle clients.  As such, they program their devices in their engineering vision.  So if the ap's are made by a different manufacturer, that's OK.  Here's why.  The access points themselves do not have discussions with eachother in any way, no matter if they're &quot;autonomous ap's&quot; (like the ones you setup in your network) or &quot;thin ap's&quot; that are directed by a controller.  So in your scenario, having two different ap manufacturer's is OK because both MUST follow IEEE standards when communicating with the wireless client(s) and the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;SOURCES CITED:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WIFI ROAMING ANALYSIS:&#xA;&lt;a href=&quot;http://www.revolutionwifi.net/revolutionwifi/2011/12/wi-fi-roaming-analysis-part-1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.revolutionwifi.net/revolutionwifi/2011/12/wi-fi-roaming-analysis-part-1.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11 ASSOCIATION PROCESS EXPLAINED:  &lt;a href=&quot;https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/802.11_Association_process_explained&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/802.11_Association_process_explained&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37040" LastActivityDate="2017-05-27T02:21:36.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41514" PostTypeId="2" ParentId="41493" CreationDate="2017-05-27T04:44:55.030" Score="2" Body="&lt;p&gt;IS-IS is a routing protocol.  It can forward on information about what direction to send traffic for a number of protocols, including IPv4 and IPv6.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The key point there is that it's information about what direction traffic should be forwarded but it's not the means by which the traffic is actually forwarded.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The simplest analogy is that of roads, road signs and addresses: the road sign tells you &lt;em&gt;which road to take&lt;/em&gt; to get to a given address but isn't the road itself.  The road exists whether or not there are signs and the simple existence of signs isn't an assurance that any possible type of address is reachable via a given set of roads.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In concrete terms the implicit item in your question is the distinction between the control plane and the forwarding plane.  The control plane is concerned with exchanging reachability information between independent nodes.  The forwarding plane is purely concerned with the act of receiving, analyzing and forwarding packets (or frames) on the wire.  The control plane both &lt;em&gt;drives&lt;/em&gt; the forwarding plane &lt;em&gt;and&lt;/em&gt; utilizes it to actually exchange information but the two are ultimately distinct.  A control plane protocol (...like IS-IS) can carry information about any number of subjects without the forwarding plane necessarily being able to handle corresponding traffic types.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - back to your question - the IS-IS process might be carrying information about how to reach IPv4, IPv6, IPX, X.25 and CLNS addresses (and, yes, all of these actually have/had specs defined at some point) but this doesn't mean that the routers actually running the protocol are able to forward datagrams for all of them.  IS-IS might tell you about your IPv6 routes but if some of the routers along the way can't actually forward v6 then it's not going to do you much good.. &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-05-27T04:44:55.030" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41515" PostTypeId="2" ParentId="40773" CreationDate="2017-05-27T05:33:29.563" Score="1" Body="&lt;p&gt;A static IP for at least one side is advised; however, DDNS will work for this,(if both sides are assigned dynamic addresses and NAT Overloaded), while both routers have fqdn's assigned for dynamic tracking of peer: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-architecture-implementation/118048-technote-ipsec-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security-vpn/ipsec-architecture-implementation/118048-technote-ipsec-00.html&lt;/a&gt; . &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If DDNS is not leveraged, one side will require to have a public static IP in order to provide a peer IP Address for the remote dynamic peer to initiate interesting traffic. I recommend strongly in getting real time support from Cisco TAC on this configuration and the requirements.&lt;/p&gt;&#xA;" OwnerUserId="21592" LastActivityDate="2017-05-27T05:33:29.563" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41516" PostTypeId="1" AcceptedAnswerId="41528" CreationDate="2017-05-27T10:15:29.927" Score="2" ViewCount="1271" Body="&lt;p&gt;In a recent project,  I have been told to consider four Hubs (two in HQ, and two in DR), where each branch will have EIGRP neighborships with all four, as part of a DMVPN based WAN. I have tested this in my lab and found that the branch learns the same routes from all the hubs with the same metric, causing it to load balance traffic which is undesirable. As per my knowledge, EIGRP has 3 ways of metric manipulations :&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Delay change&lt;/li&gt;&#xA;&lt;li&gt;B/W&lt;/li&gt;&#xA;&lt;li&gt;Offset list to directly manipulate the composite metric &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;However, since DMVPN utilises a GRE multipoint concept, I cannot make any changes to B/W or Delay on the Spoke side (and all servers lie in the DCs behind the hubs). Offset lists works well, but don't seem to be a good solution (uses an access-list as a reference which needs to be changed again once customer has more servers).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another idea I have is to just send a default route to the spokes, with summary-metric set and then use that metric to influence traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would appreciate any other suggestions, and if there are none, can anyone confirm if I am thinking in the right direction (pros and cons of the default route method).&lt;/p&gt;&#xA;" OwnerUserId="13861" LastEditorUserId="8499" LastEditDate="2018-03-07T18:35:46.337" LastActivityDate="2018-03-07T18:35:46.337" Title="Preventing Load balancing in EIGRP" Tags="|cisco|routing|vpn|design|eigrp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41517" PostTypeId="1" AcceptedAnswerId="41521" CreationDate="2017-05-27T11:14:02.047" Score="5" ViewCount="3598" Body="&lt;p&gt;What I don't understand is how I should use zones. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Say, for example, I have to build a network for a company. I would start by looking at the different departments (e.g. Sales, Management) and design VLANs/subnets for each one of them.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;But how can I apply zones to this network? Would I assign a zone to each VLAN/subnet? I've seen an article that assigns IP address ranges to zones, so I believe a zone maps to a subnet/vlan. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or would I have to create completely different zones, for example Inside, Outside, DMZ.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;FWIW, I'm using a PaloAlto Firewall.&lt;/p&gt;&#xA;" OwnerUserId="13978" LastActivityDate="2017-05-27T14:02:57.103" Title="Are firewall zones implemented similarly to VLANs and subnets?" Tags="|firewall|" AnswerCount="2" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41518" PostTypeId="2" ParentId="41517" CreationDate="2017-05-27T12:26:30.623" Score="2" Body="&lt;p&gt;(Security) zones are what you define by your firewall rules. Usually you map the subnets and VLANs you've created to these. Depending on your security requirements, a zone can consist of more than one subnet/VLAN - you might prefer routing subnets within a single zone through L3 switches instead of your firewall.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-05-27T12:56:24.550" LastActivityDate="2017-05-27T12:56:24.550" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41519" PostTypeId="1" CreationDate="2017-05-27T12:55:55.297" Score="1" ViewCount="634" Body="&lt;p&gt;I'm studying computer networking and have a good understanding of tcp/ip how data travel across the internet and etc.  But one thing I keep wondering is that does a Server's Internet Bandwidth affect internet clients' download speeds.  If so which portion of it, the server's internet download or upload speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If 10 computer was to download a file from a server at 10 Mbps each (50Mbps total) and the server only has a internet connection of 30Mbps download and 15Mbps upload wouldn't the server be slowing down those internet client's download because the server can only push out 30 Downs and 15 Ups and the clients demand is 50 downs.&lt;/p&gt;&#xA;" OwnerUserId="37110" LastActivityDate="2017-05-27T13:45:02.843" Title="Does Server Internet Bandwidth affect internet client download speeds" Tags="|ipv4|tcp|bandwidth|network|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41520" PostTypeId="2" ParentId="41214" CreationDate="2017-05-27T13:36:02.303" Score="2" Body="&lt;p&gt;After taking a look at the attached Packet Tracer file in the original post, I've noticed that a couple of things are configured incorrectly. I've addressed the issues that affect the connectivity of the wireless laptop to the other hosts in the network.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The Cisco 2811 router (KucRTR) has a subinterface f0/1.199 with IP&#xA;address 10.11.4.209/29. This happens to be the same IP address as the&#xA;WAN interface of the wireless router.&lt;/li&gt;&#xA;&lt;li&gt;The default gateway and the internet IP address of the internet&#xA;connection of the wireless router are the same. Both are configured&#xA;as 10.11.4.209/29.&lt;/li&gt;&#xA;&lt;li&gt;The interface f0/1 of the Cisco Catalyst 2960 switch (KucMgmt) is&#xA;configured with VLAN 19 while the subinterface f0/1.199 of the Cisco&#xA;2811 router is configured with VLAN ID 199.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In order for the wireless laptop to contact the other hosts in the network and vice versa, consider the following changes:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Change the IP address of the WAN interface of the wireless router to&#xA;10.11.4.210/29.&lt;/li&gt;&#xA;&lt;li&gt;Change the VLAN of interface f0/1 of the layer 2 switch (KucMgmt) to&#xA;VLAN 199.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="36671" LastActivityDate="2017-05-27T13:36:02.303" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41521" PostTypeId="2" ParentId="41517" CreationDate="2017-05-27T13:41:06.300" Score="4" Body="&lt;p&gt;This is Zone Based Firewalling. There are no hard and fast rules as to how you relate your zones to your VLANs but you might for example have 4 VLANs: HR, Finance, Manufacturing and Marketing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could then create a Zone for each VLAN, allowing complete firewall control between each of those VLANs (subnets). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, you might have two zones (which are on two separate /24s) that need to communicate to each other but have no use for firewalling (i.e. there doesn't need to be any security restrictions between these VLANs). In that instance you could have both those VLANs in a single zone which therefore won't be firewalled. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Update&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You have two options - you either configure 3 separate interfaces on the Firewall (each with their own zone as you said) and connect those to the three interfaces on the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OR&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Configure a trunk on the router and the Firewall with sub-interfaces which are VLAN tagged. I think in this instance for you, it will be simpler and easier to understand with the 3 individual cables and interfaces on the router/firewall. &lt;/p&gt;&#xA;" OwnerUserId="35882" LastEditorUserId="35882" LastEditDate="2017-05-27T14:02:57.103" LastActivityDate="2017-05-27T14:02:57.103" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41522" PostTypeId="2" ParentId="41519" CreationDate="2017-05-27T13:45:02.843" Score="2" Body="&lt;p&gt;Short answer, Yes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the server has an upload capacity of 100Mbps then regardless of the clients connecting, it can only service those clients up to 100Mbps. So if 10 clients connect, that allows (in an idea world, which isn't always realistic) 10Mbps per client. Even if those clients each had 1Gbps WAN connections, the server can only provide downloads at it's own maximum capacity. &lt;/p&gt;&#xA;" OwnerUserId="35882" LastActivityDate="2017-05-27T13:45:02.843" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41526" PostTypeId="2" ParentId="41516" CreationDate="2017-05-27T15:23:10.473" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;&quot;As per my knowledge, &lt;strong&gt;EIGRP&lt;/strong&gt; has 3 ways of metric manipulations : &lt;strong&gt;Delay change&lt;/strong&gt;, &lt;strong&gt;B/W&lt;/strong&gt;, and &lt;strong&gt;Offset list to directly manipulate the composite metric&lt;/em&gt;&lt;/strong&gt;&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is another feature of &lt;code&gt;EIGRP&lt;/code&gt; to consider: &lt;strong&gt;External Routes&lt;/strong&gt;.  One trick I have used to influence EIGRP Primary and Secondary paths over DMVPN is to use a dedicated EIGRP AS for the secondary path and then redistribute it into the primary AS.  Redistributed routes will be injected into the EIGRP process as External Routes.  Externals Routes will have an AD (Administrative Distance) of 190 by default and therefore be less preferred. This is not always optimal nor can it always be applied in all use-cases but it is something to consider.   &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;&quot;However, since DMVPN utilizes a gre multipoint concept, I cannot make any changes to B/W or Delay on the Spoke side ( and all servers lie in the DCs behind the hubs).&quot;&lt;/em&gt; &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It sounds like you are using a single Tunnel interface to define both DMVPNs at the Spoke-End.  Split your DMVPN at the Spoke-End into two tunnels and you can influence EIGRP path selection with tunnel Bandwidth or Delay.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2017-05-27T15:23:10.473" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41528" PostTypeId="2" ParentId="41516" CreationDate="2017-05-27T16:24:43.260" Score="3" Body="&lt;p&gt;If you simply want to prevent load balancing, then you can use the &lt;code&gt;maximum-paths&lt;/code&gt; command in EIGRP to do that. Just set it to &lt;code&gt;1&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;router eigrp 1&#xA; maximim-paths 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/routers/crs/software/crs_r4-2/routing/command/reference/b_routing_cr42crs/b_routing_cr42crs_chapter_010.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;EIGRP Commands&lt;/em&gt;&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;h1&gt;maximum-paths (EIGRP)&lt;/h1&gt;&#xA;  &#xA;  &lt;p&gt;To control the maximum number of parallel routes that the Enhanced&#xA;  Interior Gateway Routing Protocol (EIGRP) can support, use the&#xA;  &lt;strong&gt;maximum-paths&lt;/strong&gt; command in the appropriate configuration mode. To remove the &lt;strong&gt;maximum-paths&lt;/strong&gt; command from the configuration file and&#xA;  restore the system to its default condition with respect to the&#xA;  routing protocol, use the &lt;strong&gt;no&lt;/strong&gt; form of this command.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;maximum-paths&lt;/strong&gt; &lt;em&gt;maximum&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;no maximum-paths&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-27T16:24:43.260" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41530" PostTypeId="1" CreationDate="2017-05-27T17:25:28.453" Score="2" ViewCount="513" Body="&lt;p&gt;Here is the setup:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;SonicWALL NSA3600 has WAN on X1 and DMZ on X2&#xA;Netgear FS728TP has port 28 plugged into X2 on SonicWALL and port 27 plugged into a production switch&#xA;Ubiquiti AP's are plugged into ports 1-6 on FS728TP&#xA;VLAN's are set on the Netgear switch as follows:&#xA;VLAN 1 is production VLAN and is marked &quot;U&quot; on all ports except 28 which is blank. Port 27 is marked &quot;T&quot; on VLAN1.&#xA;VLAN 99 is for guest wifi and is marked &quot;U&quot; on ports 1-6. It is marked as &quot;T&quot; on port 28. &#xA;All ports have PVID of VLAN 1 except port 28 which is PVID 99.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When users connect to the guest wireless, they get assigned the proper IP address but cannot get out to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Production wireless works perfectly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts are much appreciated. Please let me know if more info is needed to help diagnose. THANK YOU!&lt;/p&gt;&#xA;" OwnerUserId="37117" OwnerDisplayName="Karl" LastActivityDate="2017-10-24T21:34:41.860" Title="VLANs not working with Netgear FS728TP and Ubiquiti UAP-AC-PRO and SonicWALL" Tags="|router|vlan|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41532" PostTypeId="2" ParentId="41530" CreationDate="2017-05-27T19:19:41.770" Score="1" Body="&lt;p&gt;If you've got VLAN 99 &quot;T&quot;agged on Netgear port 28, you need to have it tagged on the SonicWall X2 as well - alternatively, &quot;U&quot;ntag it on port 28 and it'll most probably work. As it is, the VLAN 99 tagged frames are dropped on the SonicWall X2 port and the WiFi clients can't get to the router.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-27T19:19:41.770" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41537" PostTypeId="1" AcceptedAnswerId="41559" CreationDate="2017-05-28T15:10:53.547" Score="1" ViewCount="105" Body="&lt;p&gt;I have an auditorium measuring 50'x50' and seats 200. I have tried various single consumer router solutions (Asus RT-N12HP, Asus RT-N14UHP, etc) all with disappointing results.  I have a good 10Mbps Internet link on fiber, so I don't think Internet access itself is a problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As accessing the router's configuration web server is also jittery (when the hall is crowded), I suspect the router may be the bottleneck. The Asus RT-N14UHP says it is capable of 300,000 sessions, whatever that means. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As it is all wireless, I have difficulty figuring out who or what may be causing the problem. Are there some faulty devices jamming up the network for example?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What do people typically do for a scenario like this?&lt;/p&gt;&#xA;" OwnerUserId="37130" LastActivityDate="2017-05-29T15:07:48.013" Title="Planning a &quot;simple&quot; wifi network" Tags="|ieee-802.11|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41538" PostTypeId="2" ParentId="41537" CreationDate="2017-05-28T16:07:58.750" Score="1" Body="&lt;p&gt;Usually you would hire an expert to perform a wireless site survey to give you proper WAP quantities, placements, frequencies radio power, etc. You could use business-grade WAPs and a WLC to control and adjust them all.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, 10 Mbps may not really be enough if all 200 people are trying to use the WAN connection at the same time. You should use something that can tell you specifics. For example NetFlow, or one of its variants.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-28T16:07:58.750" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41541" PostTypeId="1" AcceptedAnswerId="41549" CreationDate="2017-05-28T19:35:07.597" Score="3" ViewCount="5412" Body="&lt;p&gt;I need a setup like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+----------+     +----+&#xA;| Router   | --- | AP |&#xA;| (DHCP ?) |     |    |&#xA;+----------+     +----+&#xA;                   |&#xA;                   | wireless&#xA;                   |&#xA;+--------+       +----+&#xA;| PC     | ----- | AP |&#xA;+--------+       +----+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there a way to use Ubiquiti UniFi for this setup? Because some of them have a secondary LAN port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I cant use a wire&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;I dont want to use DLAN&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="37135" LastEditorUserId="37135" LastEditDate="2017-05-28T20:14:10.067" LastActivityDate="2019-02-05T20:44:05.663" Title="Ubiquiti UniFi Wireless bridging over two floors" Tags="|ubiquiti|bridging|" AnswerCount="4" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41542" PostTypeId="2" ParentId="34957" CreationDate="2017-05-28T20:24:30.267" Score="2" Body="&lt;p&gt;vSwitches use static VM/MAC-to-port distribution, do not put redundant ports in trunk mode on the physical switch. With this logic you can have complete control over frame distribution/load balancing which wouldn't be possible with trunking and you can use redundant uplink switches without STP blocking ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Use the vSwitches to map VLAN IDs to port groups:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;connect each VLAN to all uplink host ports&lt;/li&gt;&#xA;&lt;li&gt;for each VLAN add a port group with the required VLAN ID&lt;/li&gt;&#xA;&lt;li&gt;for each required VLAN/port group connection in a virtual machine add a separate guest vNIC and connect it with the port group&lt;/li&gt;&#xA;&lt;li&gt;only if you need to use packet monitoring in a guest you add a port group with VLAN ID 4095, allow promiscuous mode and change the NIC teaming to use a single active NIC - the one connecting to the mirror port&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Trying to separate the trunked VLANs from inside the guest won't work as the port group with VLAN 4095 will forward all frames &lt;em&gt;without tag&lt;/em&gt;.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-05-29T20:09:58.760" LastActivityDate="2017-05-29T20:09:58.760" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41544" PostTypeId="2" ParentId="39497" CreationDate="2017-05-28T22:20:14.833" Score="3" Body="&lt;ol&gt;&#xA;&lt;li&gt;read up on the standard: &lt;a href=&quot;http://standards.ieee.org/about/get/802/802.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://standards.ieee.org/about/get/802/802.3.html&lt;/a&gt;&lt;/li&gt;&#xA;&lt;li&gt;10GE+ PHYs actually do forward error correction (FEC), FCS error frames are dropped in the MAC layer&lt;/li&gt;&#xA;&lt;li&gt;Basic line encoding (4b/5b, 8b/10b, 64b/66b group codes) is done in PCS, with PMD doing some additional, medium-specific coding (e.g. MLT-3)&lt;/li&gt;&#xA;&lt;li&gt;Scrambling/descrambling is part of PCS&lt;/li&gt;&#xA;&lt;li&gt;PMD&lt;/li&gt;&#xA;&lt;li&gt;Auto-negotiation somewhat bypasses the sublayers since it's using its own encoding.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-08-27T07:37:40.717" LastActivityDate="2017-08-27T07:37:40.717" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41549" PostTypeId="2" ParentId="41541" CreationDate="2017-05-29T03:17:58.430" Score="1" Body="&lt;p&gt;The short answer is no. There is no way to configure an Ubiquiti WAP in Unifi to act as a client. The main gigabit port is to be connected to the network infrastructure, the secondary port is just a pass-through port, and the wireless component acts as an access point as it's configured via Unifi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even when you SSH into these devices about the only configuration change you can make to them is to set the which Unifi server they should contact for configuration information.&lt;/p&gt;&#xA;" OwnerUserId="5746" LastActivityDate="2017-05-29T03:17:58.430" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="41550" PostTypeId="2" ParentId="24357" CreationDate="2017-05-29T04:17:12.187" Score="0" Body="&lt;p&gt;the only way is to add a 3rd switch with a trunk connecting the other 2 switches with their trunks and the third switch port 16 to the sonicwall Tz500 and creating the vlans on it&lt;/p&gt;&#xA;" OwnerUserId="37144" LastActivityDate="2017-05-29T04:17:12.187" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41553" PostTypeId="1" AcceptedAnswerId="41555" CreationDate="2017-05-29T08:46:04.363" Score="1" ViewCount="9979" Body="&lt;p&gt;I have a switch that is counting &quot;output errors&quot;. A &quot;show interface gi1/0/46 controller&quot; shows up &quot;2963657 Excess Defer frames&quot; but I really can't find any documentation about &quot;excess defer frames&quot;. &#xA;Can some one tell me what kind of error this is and what circumstance can cause that?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hardware is WS-C3650-48TS, Software 03.06.05E.&#xA;Do you need any more information?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flo&lt;/p&gt;&#xA;" OwnerUserId="37149" LastEditorUserId="37149" LastEditDate="2017-05-29T08:54:21.653" LastActivityDate="2017-05-29T09:11:38.847" Title="What are &quot;Excess Defer Frames&quot; on a show interface gix/x/x controller output?" Tags="|cisco|switch|cisco-catalyst|interface|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41554" PostTypeId="2" ParentId="41553" CreationDate="2017-05-29T09:09:53.747" Score="2" Body="&lt;p&gt;&lt;em&gt;Excess Defer frames&lt;/em&gt;: According to &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3850/software/release/3se/int_hw_components/command_reference/b_int_3se_3850_cr/b_int_3se_3850_cr_chapter_010.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco documentation&lt;/a&gt; it is the number of frames that are not sent after the time exceeds the maximum-packet time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It means that the port is under heavy load. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device connected to the port is transmitting or receiving more traffic that can be handled by the port. Verify if the port is configured as half-duplex or full-duplex.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2017-05-29T09:09:53.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41555" PostTypeId="2" ParentId="41553" CreationDate="2017-05-29T09:11:38.847" Score="1" Body="&lt;p&gt;Check &lt;a href=&quot;https://supportforums.cisco.com/discussion/13203691/excess-defer-frames-or-xmit-errors&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://supportforums.cisco.com/discussion/13203691/excess-defer-frames-or-xmit-errors&lt;/a&gt; - frames that are deferred can't be sent out the destination port right away and get queued. &lt;em&gt;Excess&lt;/em&gt; deferred frames are those dropped when the output queue is overloaded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several possible causes:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the output port is linking at a slower speed than expected&lt;/li&gt;&#xA;&lt;li&gt;a stream from a faster link is funneled through a trunk group (usually, you can't successfully run a fullspeed 10G link through a 10x 1G trunk)&lt;/li&gt;&#xA;&lt;li&gt;your network architecture has a bottleneck and might need rethinking&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-05-29T09:11:38.847" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="41556" PostTypeId="1" CreationDate="2017-05-29T10:09:45.407" Score="0" ViewCount="262" Body="&lt;p&gt;Current flow probes (using eg. IPFIX, netFlow v5/9, sFlow) are able to monitor flows defined at least by the tuple &amp;lt; source IP, source Port, IP protocol, destination IP, destination Port, source interface, destination interface &gt;. But it seems to me that this flow definition might consume probe CPU (even if we use traffic sampling) and  probe&amp;lt;-&gt;collector bandwidth&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So questions are :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;what kind of configuration do ISP and data center use ? do they use traffic aggregates (source-destination IP/net) as flow definition ? if so what is the subnet size ?&lt;/li&gt;&#xA;&lt;li&gt;I heard that the common/minimum reporting period (interval for sending flow records towards the collector) is 5 minutes. Is it real ? is it less ?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="37151" LastActivityDate="2017-06-28T13:07:42.690" Title="Best practices for IP Flow monitoring" Tags="|isp|monitoring|best-practices|netflow|" AnswerCount="1" CommentCount="1" ClosedDate="2018-02-19T05:28:10.920" ContentLicense="CC BY-SA 3.0" />
  <row Id="41557" PostTypeId="2" ParentId="41556" CreationDate="2017-05-29T12:15:12.493" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;what kind of configuration do ISP and data center use ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends. Sometimes you just count bytes on interface and use netflow/sflow for (some) detailed analysis.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;do they use traffic aggregates (source-destination IP/net) as flow definition ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IMO the best option is to aggregate by the client port numbers. Every web page opening generates a dozen of flows with the same src/dst IPs, same dst port (say, 80) but a bunch of client IPs. Wiping out those client ports gives ~10 times less flows (from my experience) without loosing much.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;if so what is the subnet size ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends what your are using your flows for. Sometimes you want to know each IP traffic profile, sometimes you might aggregate using AS prefix lists, because all you need to know is a source/destination AS number...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I heard that the common/minimum reporting period (interval for sending flow records towards the collector) is 5 minutes. Is it real ? is it less ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends. The question is too broad...&lt;/p&gt;&#xA;" OwnerUserId="36992" LastActivityDate="2017-05-29T12:15:12.493" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41559" PostTypeId="2" ParentId="41537" CreationDate="2017-05-29T15:04:31.580" Score="2" Body="&lt;p&gt;Although I do agree with Ron and Zac's answers, I would also like to give input myself to see if it may help you.  First, I want to tell you what to do to assess your current wireless network, then advice on designing a new wireless network for that auditorium.&#xA;Before you make any changes, turn SNMP on on ALL of your network devices and make sure all of the management IP addresses of those &lt;em&gt;network devices&lt;/em&gt; (not the wireless clients nor your laptop) are STATIC and not DHCP.  Next, download a Multi Router Traffic Grapher.  Next, make your laptop WIRED if you can because you don't want that network's wireless problems to interfere with your laptop's ability to gather information.  Once your devices are in there and running, wait until the hall is crowded.  When the problems begin, look at your graphs for either bandwidth saturation, client overload, etc.  It is there that you will be able to assess what problem you're having.  Keep in mind, you may be having more than one problem at the same time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now for the part that stings the pocketbook a bit that Ron and Zac already mentioned - business-grade hardware.  With that, you will be able to advance your wireless network to one that can control things like how much bandwidth you will permit to each user (aka bandwidth throttling), deauth attach prevention, bonding, load balancing, etc.  Prepare for a pricetag and yearly maintenance (software upgrade) costs with business-grade hardware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now to comment on parts of your post.  You mentioned that you have a 50x50 auditorium with 200 seats.  From a design perspective, here are two of the biggest factors to consider.  One, your 200 seats can be assumed as 200 wireless clients.  On average, depending on your hardware, an access point can handle 25 associations (25 devices).  200 divided by 25 is 8.  So at a &lt;strong&gt;MINIMUM&lt;/strong&gt;, you need 8 access points to meet maximum thresholds.  I recommend going with at least 10 to give yourself some breathing room.  Two, multiple access points in a 50x50 area can create a hostile environment if using 2.4GHz antenna's.  Here's why.  In America, the 2.4GHz range will support three channels.  1, 6, and 11.  Meaning, each ap may have only ONE channel.  So if you have only 3 ap's, no problem.  If you have more, then logically you will have a channel that has multiple access points using it within range of eachother.  This causes CO-CHANNEL INTERFERENCE, which results in poor wireless performance for the clients.  To avoid this, get the access points that have antennas in the 5GHz range.  You have many more channels so you can avoid this problem.  Also SPACE OUT YOUR AP'S APPROPRIATELY.  If your 200 clients are evenly spaced, your ap's should be as well. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your 10Mb internet circuit may be questioned as well for 200 users, depending on what they're doing.  Without bandwidth throttling per user, you could theoretically have a couple of users streaming and steal the bandwidth from the others.  Your SNMP graph on the internet interface of your internet router will tell you clearly if 10 is enough.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer the question about what a wireless session is, in short it is a client connection through the access point to a destination.  See &lt;a href=&quot;https://en.wikipedia.org/wiki/Wireless_Session_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Wireless_Session_Protocol&lt;/a&gt;.  So for example, if you have a client that opens a browser and goes to Google, then Yahoo, they have two sessions taken up.  &lt;/p&gt;&#xA;" OwnerUserId="37040" LastEditorUserId="8499" LastEditDate="2017-05-29T15:07:48.013" LastActivityDate="2017-05-29T15:07:48.013" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41564" PostTypeId="1" AcceptedAnswerId="41629" CreationDate="2017-05-29T18:39:16.853" Score="0" ViewCount="248" Body="&lt;p&gt;I would like to know how does router use antennas when in repeater mode. I'm going to use a router with two detachable antennas. The idea is that one antenna will go outside (this will connect to the AP with internet connection which is around 30m from the outside antenna) and the other antenna will be inside where I need wifi network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will it try to connect with both antennas to that AP and create that wifi network on both antennas?&lt;/p&gt;&#xA;" OwnerUserId="37164" LastActivityDate="2017-06-02T07:03:01.640" Title="Which antennas does router use in repeater mode for client network and for AP network" Tags="|router|wireless|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41566" PostTypeId="2" ParentId="39521" CreationDate="2017-05-29T20:29:04.283" Score="1" Body="&lt;p&gt;If the PC1 NIC is VLAN capable you need to configure it (or rather the virtual instances) exactly like its respective uplink port. Each VLAN is a distinct subnet and requires an IP address from that subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want VLANs 4 and 5 to be private for PC1+PC2 and PC1+PC3 you'd connect PC2 to a VLAN 4 untagged port, PC3 to a VLAN 5 untagged port and PC1 to a port with VLAN 1 untagged, VLAN 4 tagged, and VLAN 5 tagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the PC1 NIC isn't VLAN capable you can only connect it to a single subnet. You'll need to add NICs for the other VLANs subnets.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2018-03-26T06:26:10.603" LastActivityDate="2018-03-26T06:26:10.603" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41567" PostTypeId="1" AcceptedAnswerId="41573" CreationDate="2017-05-30T03:46:18.350" Score="3" ViewCount="1454" Body="&lt;p&gt;I am watching a video course from Brocade. The instructor says that &quot;all devices on a single collision domain must operate with the same speed parameters -- for example, 100 megabits; full duplex. This lowers the speed of your network to the slowest device on the segment. When a bridge is used to separate collision domains, each segment can operate a different speeds.&quot; In the slide is a picture of two bus topologies separated by a bridge. Is what he said accurate? If I connected two PCs to a hub -- one with a 10 Mbps NIC and another with a 100 Mbps NIC -- would the switch force the 100 Mbps NIC to operate at 10 Mbps? Or is it possible he's referring to really old coaxial Ethernet setups rather than the twisted-pair hubs?&lt;/p&gt;&#xA;" OwnerUserId="37169" LastActivityDate="2017-05-31T10:50:06.947" Title="The Speed of Hubs and Shared Collision Domains" Tags="|ethernet|speed|" AnswerCount="3" CommentCount="0" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41569" PostTypeId="2" ParentId="41567" CreationDate="2017-05-30T06:37:00.227" Score="2" Body="&lt;p&gt;A standard hub is single speed. I.E. it is either a 10Mbs hub or a 100Mbs hub, so:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;if you connect a 10Mbs NIC on a 100Mbs hub it will not work at all&lt;/li&gt;&#xA;&lt;li&gt;if you connect a 10/100Mbs NIC on a 10Mbs hub, the NIC will operate at 10Mbs&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;So in practice, yes on a true hub all stations operate at the same speed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I said &quot;standard&quot; or &quot;true&quot; hub, because it exists some more advanced hub that allow both 10 and 100Mbs, but those hubs actually embed a 2 ports switch (I.E. bridge) to connect the 10Mbs domain to the 100Mbs domain, so in practice you have a 10Mbs hub + a bridge + a 100Mbs hub.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-05-30T06:37:00.227" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41573" PostTypeId="2" ParentId="41567" CreationDate="2017-05-30T08:14:10.013" Score="2" Body="&lt;p&gt;An ethernet hub is nothing but a &lt;strong&gt;single cable&lt;/strong&gt; inside a box with multiple &#xA; RJ-45 connectors just like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/tqxWZ.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/tqxWZ.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devices connected to the hub are connected among them using a single cable (technically it's called a &lt;em&gt;single domain&lt;/em&gt;).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They &lt;strong&gt;must&lt;/strong&gt; be on the same speed, otherwise the network won't work. Network cards nowadays can use 10/100/100 Mbps per second (through &lt;em&gt;autosensing&lt;/em&gt; they can use the same speed as the network), but there are older cards that are fixed to 10 Mbps or 100 Mbps so in that case the card must be in concordance with the desired speed on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Devices on a hub must use &lt;strong&gt;half duplex&lt;/strong&gt; because they need to be aware of possible collisions on the cable. Full duplex can be used on &lt;strong&gt;switched environments&lt;/strong&gt; where there is no need of collision-hearing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you use a bridge to connect two single domains then each domain can be in a different speed and the bridge controls the speed difference, like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/OS9bV.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/OS9bV.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2017-05-31T10:19:14.823" LastActivityDate="2017-05-31T10:19:14.823" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41575" PostTypeId="1" AcceptedAnswerId="41576" CreationDate="2017-05-30T09:46:35.080" Score="1" ViewCount="181" Body="&lt;p&gt;I was wondering how Ethernet equipment (for example a switch) knows that something have been plugged in and is up ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there a pair of copper wire dedicated for that ? Or a bit exchange ? On which wire ?&lt;/p&gt;&#xA;" OwnerUserId="37175" LastEditorUserId="36720" LastEditDate="2017-09-28T08:08:30.960" LastActivityDate="2017-12-27T13:59:57.647" Title="How does equipment know it has devices connected to it?" Tags="|switch|router|ethernet|network-discovery|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41576" PostTypeId="2" ParentId="41575" CreationDate="2017-05-30T09:51:44.987" Score="2" Body="&lt;p&gt;It's called Autonegotiation: &lt;a href=&quot;https://en.wikipedia.org/wiki/Autonegotiation&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wikipedia&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ports looking for a link send &quot;link pulses&quot; on the data lines that (mostly) convey speed(s) and half/full duplex capabilities. When both sides agree on common link parameters, the link comes up. Some Ethernet variants need to negotiate additional parameters, e.g. 1000BASE-T negotiates the clock master/slave and data pair matching. For precise details, check IEEE 802.3 Clauses 28, 37, and 73.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the absence of autonegotiation - when it is deactivated on a port and a certain speed and duplex mode is manually set - the other side is (usually) able to sense the port speed by line behavior/encoding. However, the duplex mode cannot be sensed and is a common source of problems with autonegotiation disabled.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-08-28T20:49:29.110" LastActivityDate="2017-08-28T20:49:29.110" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41581" PostTypeId="1" CreationDate="2017-05-30T13:56:00.550" Score="1" ViewCount="168" Body="&lt;p&gt;Good afternoon everyone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to know the textbook answer to a network I've been asked to assist with.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an IT cupboard which serves the location as the MDF. I then have a variety of zones (A,B and C) throughout the location. Unfortunately there has been no consistent plan whilst installing cabling to these zones so you have a situation something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;MDF &lt;em&gt;&amp;lt;---1x 60m---&gt;&lt;/em&gt; &quot;A&quot; &lt;em&gt;&amp;lt;---2x 10m---&gt;&lt;/em&gt; &quot;B&quot; &lt;em&gt;&amp;lt;---2x 5m---&gt;&lt;/em&gt; &quot;C&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All cabling is Cat6a.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is the best option here to connect the MDF-A cable to one of the A-B cables, with A and C connecting to B? All switches at A, B and C are identical. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Pros of this approach, traffic from B and C has one fewer hop to reach the MDF and there are no areas more than 3 layers deep. Cons of this approach, traffic from A has one more hop to reach the MDF.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any input you have is appreciated!&lt;/p&gt;&#xA;" OwnerUserId="25750" LastEditorUserId="775" LastEditDate="2017-07-30T01:40:46.403" LastActivityDate="2017-07-30T01:40:46.403" Title="L2 network design questions" Tags="|spanning-tree|layer2|design|network-access|" AnswerCount="2" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41582" PostTypeId="2" ParentId="41581" CreationDate="2017-05-30T14:06:07.753" Score="1" Body="&lt;p&gt;A best practice would be to use a pair of switches as the primary and secondary root switches, and all access switches are connected to both the primary and secondary root switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Daisy-chaining switches is a poor practice that introduces SPoFs (single-points-of-failure). The failure of one switch in the chain will orphan all the devices downstream of the failed switch.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-05-30T14:06:07.753" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41583" PostTypeId="1" AcceptedAnswerId="41799" CreationDate="2017-05-30T14:06:20.870" Score="0" ViewCount="3041" Body="&lt;p&gt;I'm a little bit confused and pretty sure it won't work. But a mate and me are arguing for so long now, I decided to ask you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Imagine a PFSense Firewall with 3 Interfaces. &#xA;2 different LAN-Interfaces&#xA;1 WAN-Interface&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Behind one of the LAN-Interfaces is a Server. Its IP is NATted on the PFSense to a nonRFC1918-IP. &#xA;Behind the other LAN-Interface is another Server whose IP is NATted on the PFSense to a nonRF1918-IP. &#xA;For communication via WAN we have proxy-arp configured with two different IP-addresses for the two servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I want the first server to communicate with the other Server without knowing its private IP. &#xA;So I tried building rules on LAN-side which allow traffic from&#xA;1st Server RFC-1918-IP to 2nd Servers nonRFC1918-IP (the proxy-arp-IP). &#xA;As expected...it doesn't work. &#xA;Does anyone know a solution for this to work?&#xA;I know that the servers could communicate via their private IPs...but it's a must have because of PCI compliances and things. The system should be out of PCI-scope, so it's the only way to get it to work. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hopefully&#xA;Flo&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: If it's not clear enough, maybe I can paint a picture for you ;)&lt;/p&gt;&#xA;" OwnerUserId="37149" LastActivityDate="2017-08-08T16:54:08.010" Title="PFsense - Reach via NAT and Proxy ARP destination behind the same firewall without the system knowing the RFC1918-IP" Tags="|nat|pfsense|proxy-arp|" AnswerCount="1" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="41585" PostTypeId="1" CreationDate="2017-05-30T15:14:35.070" Score="1" ViewCount="198" Body="&lt;p&gt;This is my lab environment:&#xA;I have two rooms with one L2 access switch each with multiple vlans. The switches are connected to a L3 switch. All routing happens on this switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was able to configure pim in dm mode just fine. But then all multicasts are flooded to both rooms. The desired configuration is the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to separate the two rooms in two different routed multicast groups. Per example VLAN 1 to 10 as multicast group 1 and VLAN 11 to 20 as multicast group 2. If in any way possible I don't want to change the client software's configuration. Means, I use the same multicast ip address in both multicast groups. But since they are not routed, I only reach the clients in the room I set the multicast off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this somehow technically possible? I'm using Huawei switches by the way. They support different PIM modes for multicast routing. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much for your input.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards,&#xA;Thomas&lt;/p&gt;&#xA;" OwnerUserId="34817" LastActivityDate="2017-12-27T00:17:04.197" Title="Multiple routed multicast groups on single switch" Tags="|routing|multicast|pim|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41587" PostTypeId="2" ParentId="41585" CreationDate="2017-05-30T15:36:54.880" Score="2" Body="&lt;p&gt;As already stated by Ron Trunk you will need to use PIM Sparse mode. The Huawei switches support this feature and i've linked the configuration guide in the following link. See chapter 7 for a complete walk through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://enterprise.huawei.com/ilink/enenterprise/download/hw_116586&quot; rel=&quot;nofollow noreferrer&quot;&gt;enterprise.huawei.com/ilink/enenterprise/download/hw_116586&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastActivityDate="2017-05-30T15:36:54.880" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41589" PostTypeId="1" CreationDate="2017-05-30T19:10:44.363" Score="0" ViewCount="772" Body="&lt;p&gt;Passive network taps seem to be pretty simple. What if I want an &quot;active&quot; network tap? Let's say I want to change some HTTP packets, for example add info etc.&#xA;Another thing that would interest my project is that I would take a packet, inspect it and send it later or drop if suspect etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What about If i set my computer into a bridge mode and intercept traffic that way (I don't know if that is possible) instead of a passive tap. &lt;/p&gt;&#xA;" OwnerUserId="37182" LastEditorUserId="37182" LastEditDate="2017-05-30T19:19:17.083" LastActivityDate="2017-07-19T13:08:52.817" Title="Is there an &quot;active&quot; network tap (not just passive)?" Tags="|routing|security|wireshark|bridge|tap|" AnswerCount="3" CommentCount="6" ClosedDate="2018-05-15T02:23:19.997" ContentLicense="CC BY-SA 3.0" />
  <row Id="41590" PostTypeId="2" ParentId="41231" CreationDate="2017-05-30T19:18:57.270" Score="1" Body="&lt;p&gt;I believe my issue was in specifying the PIM RP (Rendezvous Point).&#xA;On the SRX with the RP itself, must use:&#xA;&lt;code&gt;set pim rp local address ...&lt;/code&gt;&#xA;but on the remote use:&#xA;&lt;code&gt;set pim rp static address ...&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That seemed to fix everything.  &lt;/p&gt;&#xA;" OwnerUserId="36820" LastActivityDate="2017-05-30T19:18:57.270" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41591" PostTypeId="2" ParentId="41581" CreationDate="2017-05-30T19:36:09.687" Score="1" Body="&lt;p&gt;It's very common for environments to grow and have it built that way over time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each switch the packet will have to pass through is considered a hop as the individual switches have to process/tag/untag, unicast/broadcast packets, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you could direct connect your switches to the mdf with single-mode fibre, that would be a performance plus as you can upgrade to 10G or more. But that would have to be justified with a valid business case...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in those unplanned environments where you have to piggy back from switch to switch with cat5e/cat6/cat6a/cat6a-shielded (mostly stuck with 1G per link due to distance) make sure your uplinks/downlinks are bonded in an etherchannel (or similar) and never go over the maximum number of hops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Until you have your new fibre in place, I'd recommend to have a exact model spare switch on the side towards minimising downtime when one of the switches suffers from some fault.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the hops, see this link from a manufacturer: www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/19120-122.html&lt;/p&gt;&#xA;" OwnerUserId="4565" LastEditorUserId="4565" LastEditDate="2017-05-30T19:43:39.403" LastActivityDate="2017-05-30T19:43:39.403" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41592" PostTypeId="1" AcceptedAnswerId="41610" CreationDate="2017-05-31T00:51:47.737" Score="1" ViewCount="773" Body="&lt;p&gt;I have a Cisco RV325 (Small Business Router), and two WAN ports with two different services.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN1: Comcast - Home Service (256Mbps Down, 30Mbps Up) - Single Dynamic IP&#xA;WAN2: Comcast - Business (100Mbps Down, 20Mbps Up) - 5 Block of Static IP's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am using One to One NAT on several of the IP Addresses from WAN2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I am not specifying NAT, I don't want to use WAN2, I want to stick with WAN1 for all other traffic.  Where WAN2 is for my PBX, Mail Server, and other servers.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my WAN Setting Table:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Mti8p.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Mti8p.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is my One to One NAT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/a8dU3.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/a8dU3.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;Here is my Dual WAN configuration, this seems to be the only way the NATed addresses work:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/UQGNh.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/UQGNh.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;And here is my Bandwith Managment screen:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/H61La.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/H61La.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is happening now, is that sometimes while I am in load balancing mode, my non-natted traffic starts going over WAN2, and I don't want that.  While other times, it goes over WAN1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I stop this from happening, forcing all non-natted traffic to go over WAN1?  I have tried turning Smart Link Backup on, but then it shuts down all of my NAT's from using WAN2 all together.&lt;/p&gt;&#xA;" OwnerUserId="16248" LastActivityDate="2017-06-01T02:10:50.620" Title="Dual Wan &amp; NAT with RV325" Tags="|cisco|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41596" PostTypeId="1" AcceptedAnswerId="42504" CreationDate="2017-05-31T06:50:45.173" Score="1" ViewCount="1660" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/oXtkm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/oXtkm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have setup a little wireless network for some plcs we installed. When we connect directly to the switch or moxa awk 1131, we can ping all ip's 61.1 to 61.6 and also the gateway and get internet connection. When we try to ping from the server where our data collection is we can ping all but the 2 plcs behind the moxa clients. Is there settings in the watchgaurd to configure to allow traffic from behind a wireless client.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks Trent&lt;/p&gt;&#xA;" OwnerUserId="37192" LastEditorUserId="8499" LastEditDate="2018-12-21T05:27:13.470" LastActivityDate="2018-12-21T05:27:13.470" Title="watch guard not allowing ping or traffic through wireless client" Tags="|wireless|firewall|ping|access-point|network-access|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41598" PostTypeId="1" AcceptedAnswerId="41601" CreationDate="2017-05-31T08:39:47.153" Score="2" ViewCount="1031" Body="&lt;p&gt;I’m doing a connection of 2 sites in ipv6 over an ipv4 network. I thought to do a tunnel between this 2 sites and protect it with IPsec. But I saw there are different types of tunnels (by default GRE):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;  aurp    AURP TunnelTalk AppleTalk encapsulation&#xA;  cayman  Cayman TunnelTalk AppleTalk encapsulation&#xA;  dvmrp   DVMRP multicast tunnel&#xA;  eon     EON compatible CLNS tunnel&#xA;  gre     generic route encapsulation protocol&#xA;  ipip    IP over IP encapsulation&#xA;  iptalk  Apple IPTalk encapsulation&#xA;  ipv6ip  IPv6 over IP encapsulation&#xA;  nos     IP over IP encapsulation (KA9Q/NOS compatible)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What are the differences?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I saw there is a possibility to make IPsec with MAPs and access lists. Could this work too? I didn’t saw a possibility to append an ipv6 access list to a crypto map…&lt;/p&gt;&#xA;" OwnerUserId="37080" LastActivityDate="2017-05-31T11:40:28.963" Title="Different tunnel modes (protected with ipsec)" Tags="|cisco|ipsec|tunnel|gre|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41599" PostTypeId="2" ParentId="36945" CreationDate="2017-05-31T09:41:58.807" Score="2" Body="&lt;p&gt;for me it sounds like &lt;strong&gt;&lt;em&gt;problem in CALL HUNTING  configuration&lt;/em&gt;&lt;/strong&gt;&lt;br&gt;&#xA;you have two &lt;strong&gt;&lt;em&gt;ephone-dn&lt;/em&gt;&lt;/strong&gt; 's (4 &amp;amp; 22) with 2000 extension ,which will handle the incommoding calls, where 4 with preference 0 and 22 with preference 1 which making the call going to 4 first ,but you configured 4 with &lt;strong&gt;&lt;em&gt;huntstop channel&lt;/em&gt;&lt;/strong&gt; which will Prevents incoming calls from hunting to the next channel if the first channel is busy or does not answer . so in case of line busy there is no place for the second call to go and it will go to &lt;strong&gt;&lt;em&gt;call-forward busy 6000&lt;/em&gt;&lt;/strong&gt; , but you didn't configure any &lt;strong&gt;&lt;em&gt;dial peer for forward busy&lt;/em&gt;&lt;/strong&gt; . so you need to do two things &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;remove &lt;strong&gt;&lt;em&gt;huntstope channl&lt;/em&gt;&lt;/strong&gt; from ephone-dn 4&lt;/li&gt;&#xA;&lt;li&gt;configure dial peer for forward busy  &lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2017-05-31T09:41:58.807" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41600" PostTypeId="2" ParentId="41567" CreationDate="2017-05-31T10:50:06.947" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I am watching a video course from Brocade. The instructor says that &quot;all devices on a single collision domain must operate with the same speed parameters&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;True.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;for example, 100 megabits; full duplex.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Devices on a collision domain must operate in half duplex mode. If your instructor gave this as an example he either made a mistake or doesn't have a good understanding of how Ethernet works.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This lowers the speed of your network to the slowest device on the segment.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Afaik with a pure hub a device will either link at the speed the hub is set up for or not link at all. Automatically downgrading the whole network would seem like a very undesirable behaviour to me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that there were/are many &quot;dual speed hubs&quot; around. These are logically two separate hubs connected by a two-port bridge. The dual speed hub then negotiates speed on each port and connects it to the appropriate logical hub. At the time This was cheaper to implement than a full switch.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When a bridge is used to separate collision domains, each segment can operate a different speeds.&quot; In the slide is a picture of two bus topologies separated by a bridge. Is what he said accurate? If I connected two PCs to a hub -- one with a 10 Mbps NIC and another with a 100 Mbps NIC -- would the switch force the 100 Mbps NIC to operate at 10 Mbps? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends what exactly the device you connect those two PCs is.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;If it is a pure 10 Mbps hub then most likely* both NICs will operate at 10 Mbps half-duplex. &lt;/li&gt;&#xA;&lt;li&gt;If it is a pure 100 Mbps hub then most likely* the 100 Mbps device will link at 100 Mbps half duplex and the 10 Mbps device will not link at all.&lt;/li&gt;&#xA;&lt;li&gt;If it is a &quot;dual speed hub&quot; then most likely* the 100 Mbps device will like at 100 Mbps half duplex and the 10 Mbps device will link at 10 Mbps half duplex.&lt;/li&gt;&#xA;&lt;li&gt;If it is a &quot;switch&quot; then most likely* the 100 Mbps device will link at 100 Mbps full duplex while the 10 Mbps device will like at 10 Mbps half duplex.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Or is it possible he's referring to really old coaxial Ethernet setups rather than the twisted-pair hubs?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Standardised coax Ethernet only ever ran at 10 Mbps. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;* This assumes that the &quot;10 Mbps NIC&quot; only supports 10 Mbps half duplex and does not have auto-negotiation while the &quot;100 Mbps NIC&quot; support auto-negotiation with 100 Mbps half, 100 Mbps full, 10 Mbps half and 10 Mbps full.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S. True hubs operate at a level above the wire-level encoding of the bits but below the medium access control layer. So from the perspective of medium access control protocols all devices connected to a true hub can be treated as if they were on a single wire even though physically they are not.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-31T10:50:06.947" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41601" PostTypeId="2" ParentId="41598" CreationDate="2017-05-31T11:40:28.963" Score="2" Body="&lt;p&gt;AURP&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Initially designed by Apple Inc. to connect Macintosh computers to&#xA;  printers and file servers in small workgroups, the AppleTalk protocol&#xA;  was later deployed in larger LAN and WAN configurations. While TCP/IP&#xA;  has become the prominent customer choice of protocols, Cisco kept the&#xA;  AppleTalk protocol on its Cisco IOS Software to satisfy the demand in&#xA;  some niche markets such as education and scientific communities.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Due to a significant decrease in Appletalk usage and demand among its&#xA;  customer base, and given the fact that Apple now fully supports the&#xA;  TCP/IP family of protocols, Cisco has reached the decision to&#xA;  discontinue AppleTalk support on Cisco IOS.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The AppleTalk feature removal will be permanent and will also apply to&#xA;  any future IOS releases after 12.4(24)T. This removal will also&#xA;  propagate to other IOS release trains in future (updated product&#xA;  bulletins will be released for other trains).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Features&#xA;The following features will be removed from Cisco IOS Software after Release 12.4(24)T:&#xA;• AppleTalk Phase 1 and Phase 2 support&#xA;• AppleTalk Update-Based Routing Protocol (AURP)&#xA;• AppleTalk Tunneling&#xA;• AppleTalk Remote Access Protocol (ARAP)&#xA;• AppleTalk Access Lists&#xA;• All other AppleTalk related features&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Cayman Tunneling&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Designed by Cayman Systems, Cayman tunneling enables tunneling to&#xA;  enable Cisco routers to interoperate with Cayman GatorBoxes. With&#xA;  Cayman tunneling, you can establish tunnels between two routers or&#xA;  between a Cisco router and a GatorBox. When using Cayman tunneling,&#xA;  you must not configure the tunnel with an AppleTalk network address.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;DVMRP&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Use DVMRP when a router connects to an mrouted (multicast) router to&#xA;  run DVMRP over a tunnel. You must configure Protocol Independent&#xA;  Multicast (PIM) and an IP address on a DVMRP tunnel.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;EON - CLNS&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The ISO Connectionless Network Service (CLNS) protocol is a standard&#xA;  for the network layer of the OSI model. IP traffic can be transported&#xA;  over CLNS; for instance, on the data communications channel (DCC) of a&#xA;  SONET ring. An IP over CLNS tunnel (CTunnel) is a virtual interface&#xA;  that enhances interactions with CLNS networks, allowing IP packets to&#xA;  be tunneled through the Connectionless Network Protocol (CLNP) to&#xA;  preserve TCP/IP services. CLNS can also be used as a transport&#xA;  protocol with GRE as a carrier protocol (GRE/CLNS), carrying both IPv4&#xA;  and IPv6 packets.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;GRE&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Generic routing encapsulation (GRE) is defined in RFC 2784. GRE is a&#xA;  carrier protocol that can be used with a variety of underlying&#xA;  transport protocols, and GRE can carry a variety of passenger&#xA;  protocols. RFC 2784 also covers the use of GRE with IPv4 as the&#xA;  transport protocol and the passenger protocol. Cisco IOS software&#xA;  supports GRE as the carrier protocol with many combinations of&#xA;  passenger and transport protocols.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IPIP&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Use the ipip keyword to specify that IP-in-IP encapsulation will be&#xA;  used. The optional decapsulate-any keyword terminates any number of&#xA;  IP-in-IP tunnels at one tunnel interface. Note that this tunnel will&#xA;  not carry any outbound traffic; however, any number of remote tunnel&#xA;  endpoints can use a tunnel configured this way as their destination.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IPTALK&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IPTalk is a protocol for encapsulating AppleTalk packets in IP&#xA;  datagrams. IPTalk is used to route AppleTalk packets across&#xA;  non-AppleTalk backbones and to communicate with applications on hosts&#xA;  that cannot otherwise communicate via AppleTalk, such as the Columbia&#xA;  AppleTalk Package (CAP). IPTalk also allows serial connections to use&#xA;  IPTalk Serial Line Internet Protocol (SLIP) drivers.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;IPV6IP&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Use the ipv6ip keyword to specify that IPv6 will be used as the&#xA;  passenger protocol and IPv4 as both the carrier (encapsulation) and&#xA;  transport protocol. When additional keywords are not used, manual IPv6&#xA;  tunnels are configured. Additional keywords can be used to specify&#xA;  IPv4-compatible, 6to4, or ISATAP tunnels.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;NOS&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The nos command is used to establish an nos style tunnel, (also known&#xA;  as ka9q or IP-IP tunnel).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes it is absolutely possible to make an IPsec tunnel with MAP's and access lists, that supports IPv6. Link to complete guide:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-3s/sec-sec-for-vpns-w-ipsec-xe-3s-book/sec-ipv6-ipv4-gre.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_vpnips/configuration/xe-3s/sec-sec-for-vpns-w-ipsec-xe-3s-book/sec-ipv6-ipv4-gre.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm not sure on the last question. But i think it must be possible. I don't have equiptment available to check the commands available myself. You've not stated what kind of equipment you are using.&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastActivityDate="2017-05-31T11:40:28.963" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41603" PostTypeId="2" ParentId="3667" CreationDate="2017-05-31T12:49:44.780" Score="0" Body="&lt;p&gt;The big question is are we talking twisted pair or Fiber?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With twisted pair nearly everything supports autonegotiation and unless your equipment is very old autonegotiation works just fine. Occasionally you may find a crossover cable is needed. Be aware that mixing autonegotiation with manually set full duplex is likely to lead to a duplex mismatch. You should only use manual speed/duplex if you have problems with autonegotiation and if you do use it you should use it on both ends of the link. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Fiber on the other hand is a mess of diffent incompatible standards. 1Gbps fiber standards are not compatible with 100Mbps fiber standards. Most 1Gbps fiber gear uses pluggable transcievers and it may be possible to get a 100Mbps transceiver that is compatible with your 1Gbps switch and is compatible with the fiber standard used by your 100Mbps device. Alternatively if the gigabit switch also has twisted pair ports it may be possible to use a media converter to go from 100 Mbps fiber to 100 Mbps twisted pair.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-05-31T12:49:44.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41610" PostTypeId="2" ParentId="41592" CreationDate="2017-06-01T02:10:50.620" Score="1" Body="&lt;p&gt;With my testing, I found out that it does work, however not 100% stable.  So what I did was got another router as a new gateway but same subnet.  I then added that to my network switch, and it worked perfectly, with that new switch, I am running the NAT, and for the NATed computers, I have set the new subnet.&lt;/p&gt;&#xA;" OwnerUserId="16248" LastActivityDate="2017-06-01T02:10:50.620" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41611" PostTypeId="1" AcceptedAnswerId="41645" CreationDate="2017-06-01T04:39:18.787" Score="0" ViewCount="1572" Body="&lt;p&gt;I am an intermediate, not professional network admin for my own small business. I am attempting to add a new tunnel interface for a new VPN branch. I'm using the same config I have implements many times before - this will be my 4th branch. However I'm running into this error message I can't resolve myself. Here is the text from the commit error...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;&quot;In virtual-router default: address 192.168.100.1/24 on interface vlan.2 is duplicate with address 192.168.100.10/24 on interface ethernet1/1.(Module: routed)&#xA;Commit failed&quot;&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which seems to have nothing to do with the new tunnel I am adding, which will be a network on 192.168.150.0/24. Ethernet 1/1 is my wan connection, which is gets a dhcp ip address from my isp, and has no interface ip address specified. My vlan serves addresses on network 192.168.100.0/24.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my own troubleshooting, it seems that if I make any change at all to my virtual router config, commits will fail with this error.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm lost, I've searched my config and cannot find what it is referring too. Any ideas what's up?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I really appreciate the assistance!&lt;/p&gt;&#xA;" OwnerUserId="37210" LastActivityDate="2017-06-03T01:23:12.397" Title="Palo Alto Error Message When Adding a New Tunnel Interface" Tags="|palo-alto|" AnswerCount="1" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="41613" PostTypeId="1" AcceptedAnswerId="42048" CreationDate="2017-06-01T10:00:46.593" Score="1" ViewCount="1796" Body="&lt;p&gt;How I can clear DF bit from incoming packets on Juniper SRX?&#xA;As example, on Cisco router it can be done by route-map on ingress interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;route-map clear-df-bit permit 10 &#xA;    match ip address 111 &#xA;    set ip df 0 &#xA;&#xA;access-list 111 permit tcp any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If it's even possible on Juniper?&lt;/p&gt;&#xA;" OwnerUserId="29556" LastActivityDate="2017-06-22T03:15:50.683" Title="Clear df-bit of incoming packets" Tags="|juniper-srx|fragmentation|" AnswerCount="2" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="41614" PostTypeId="2" ParentId="41589" CreationDate="2017-06-01T12:55:31.437" Score="3" Body="&lt;p&gt;It seems to me that you mis-understand the TAP concept. It only means that you duplicate a link. Then you are able for example :&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;to forward the first TAP output link to the destination (or next hop) and the second output TAP link to a monitoring device.&lt;/li&gt;&#xA;&lt;li&gt;But you also can forward the first output TAP link to a firewall which will filter and/or modify the traffic and the second output TAP link can be forwarded to a monitoring (eg. netflow probe, ...). This is redundant if the firewall is already sending flow details to a monitoring system.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If by 'active TAP' you mean an active way to &quot;trap&quot;/capture traffic and forward it (or not) modified to the real destination, this can be achieved in several ways:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;a box (eg. your computer, a firewall) is directly placed across the packet path (eg. at the network ingress)&lt;/li&gt;&#xA;&lt;li&gt;the DNS (you spoke about HTTP) point to your box IP. Then your box will redirect the traffic towards the real server IP (eg. given the domain name)&lt;/li&gt;&#xA;&lt;li&gt;you announce the end-server IP with BGP advertisements, so that ISPs/AS will forward you the traffic destinated to the end-server IP. You then redirect the traffic towards the server using tunneling methods (eg. GRE tunnels)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="37151" LastEditorUserId="37151" LastEditDate="2017-06-01T15:05:14.717" LastActivityDate="2017-06-01T15:05:14.717" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41615" PostTypeId="1" CreationDate="2017-06-01T13:40:51.430" Score="1" ViewCount="920" Body="&lt;p&gt;In our new office all of our ethernet jacks are &quot;double jacks&quot; (two ethernet ports on one plate on the wall &lt;a href=&quot;https://i.stack.imgur.com/rBoOr.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rBoOr.jpg&quot; alt=&quot;dual ethernet jack&quot;&gt;&lt;/a&gt;), each with their own CAT6 cable wired to a series of identical dual jacks (we didn't have time to order a patch panel) near the switch. We then use CAT5e cables to connect devices to the jacks on one end and the jacks to the switch on the other end.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We just plugged in a Samsung SCX-4848FN printer/scanner to one of the jacks and it works fine. However, the computer (WIN10 Pro) plugged into the jack next to it is suddenly losing connectivity (when we turn of the printer the problem goes away). The network interface shows as connected, but the machine cannot even ping the default gateway (which is a pfSense router plugged into the switch). Both machines are receiving different static IP assignments over DHCP from the router and the MAC addresses are different. The problem is resolved by disabling and re-enabling the network interface on the windows machine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could the problem possibly be caused by interference from the two network jacks next to each other (we have not yet had the ability to see what happens if we plug the printer into a jack located elsewhere)? If not, what else could possibly be causing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only other thing I can think of is that when the guy wired the wall jacks, he wound the slack in the cables around the ports before securing the lid in the panel. I don't know if that would cause interference between the two cables...&lt;/p&gt;&#xA;" OwnerUserId="27379" LastEditorUserId="27379" LastEditDate="2017-06-01T13:47:01.800" LastActivityDate="2017-06-01T14:31:14.953" Title="Two ethernet jacks causing each other problems?" Tags="|cabling|" AnswerCount="1" CommentCount="9" ClosedDate="2018-07-18T04:25:03.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="41616" PostTypeId="2" ParentId="41589" CreationDate="2017-06-01T13:45:06.573" Score="0" Body="&lt;p&gt;The easiest way to do this would be to use a linux machine with &lt;code&gt;OpenVSwitch&lt;/code&gt; and &lt;code&gt;iptables&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;OpenVSwitch&lt;/strong&gt; give you a fine control over traffic forwarding and provide, among many other features:  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;NetFlow support so you can send this traffic to a NetFlow collector (that can run on the same machine or another one)  &lt;/li&gt;&#xA;&lt;li&gt;VLAN support  &lt;/li&gt;&#xA;&lt;li&gt;Port mirroring  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;and is particularly handy if you use virtual machines.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;iptables&lt;/strong&gt; allow you to modify, NAT or drop packets (or event frames) on the fly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many commercial solutions (including proxy as discussed in the question comments) are based on those software pieces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As explained by &lt;a href=&quot;https://networkengineering.stackexchange.com/users/37151/vera&quot;&gt;@vera&lt;/a&gt; in &lt;a href=&quot;https://networkengineering.stackexchange.com/a/41614/16930&quot;&gt;her answer&lt;/a&gt; you need to configure your network so the traffic pass through your machine. This is very dependent on your network setup.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-06-01T13:45:06.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41618" PostTypeId="2" ParentId="41615" CreationDate="2017-06-01T14:31:14.953" Score="3" Body="&lt;p&gt;I would bet on shitty installation causing reduced signal quality and interference between the two ports. Cheap cable testers will tell you if a wire is open-circuit or connected to the wrong pin but won't really tell you anything beyond that.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The first thing I would do is unscrew the ports and inspect the terminations. If you see large amounts of untwisted wire then cut it off and re-terminate with the minimum possible amount of untwisting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you are still having problems then IMO it's time to call in a professional network installation firm who can test the work with high-end test gear and if needed re-do it. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-01T14:31:14.953" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41622" PostTypeId="2" ParentId="35479" CreationDate="2017-06-01T20:47:33.700" Score="2" Body="&lt;p&gt;If you're just looking for interface output queue drops, you can use the cportQosDropPkts OID (part of &lt;a href=&quot;ftp://ftp.cisco.com/pub/mibs/v2/CISCO-PORT-QOS-MIB.my&quot; rel=&quot;nofollow noreferrer&quot;&gt;CISCO-PORT-QOS-MIB&lt;/a&gt;).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ snmptranslate -On CISCO-PORT-QOS-MIB:cportQosDropPkts&#xA;.1.3.6.1.4.1.9.9.189.1.3.2.1.7&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;If you have a CCO you can look up the &lt;a href=&quot;http://snmp.cloudapps.cisco.com/Support/SNMP/do/BrowseOID.do?objectInput=cportQosDropPkts&amp;amp;translate=Translate&amp;amp;submitValue=SUBMIT&quot; rel=&quot;nofollow noreferrer&quot;&gt;OID details here&lt;/a&gt;. &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The count of dropped packets as the result of queuing and scheduling&#xA;  related QoS features that  can produce drops.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This OID shows a depricated, but it should work on the platforms that you've listed in your comment to @Raul D.&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Additional required MIB files:&lt;/h3&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;ftp://ftp.cisco.com/pub/mibs/v2/CISCO-PORT-QOS-MIB.my&quot; rel=&quot;nofollow noreferrer&quot;&gt;CISCO-QOS-PIB-MIB.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;ftp://ftp.cisco.com/pub/mibs/v2/CISCO-SMI.my&quot; rel=&quot;nofollow noreferrer&quot;&gt;CISCO-SMI.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;ftp://ftp.cisco.com/pub/mibs/v2/CISCO-TC.my&quot; rel=&quot;nofollow noreferrer&quot;&gt;CISCO-TC.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;ftp://ftp.cisco.com/pub/mibs/v2/CISCO-VTP-MIB.my&quot; rel=&quot;nofollow noreferrer&quot;&gt;CISCO-VTP-MIB.txt&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;h3&gt;Example using snmpwalk and bash on a C3560:&lt;/h3&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ snmpwalk -v2c -c community 127.0.0.1 CISCO-PORT-QOS-MIB:cportQosDropPkts&#xA;CISCO-PORT-QOS-MIB::cportQosDropPkts.10020.ingress.1 = Counter64: 0 packets&#xA;CISCO-PORT-QOS-MIB::cportQosDropPkts.10020.egress.1 = Counter64: 913 packets&#xA;&#xA;$ ./cportQosDropPkts.sh -c community -h 127.0.0.1&#xA;&#xA;Interface Name          Output Queue Drops&#xA;&#xA;--------------          ------------------&#xA;FastEthernet0/1         0&#xA;FastEthernet0/2         0&#xA;FastEthernet0/3         0&#xA;FastEthernet0/4         0&#xA;FastEthernet0/5         0&#xA;FastEthernet0/6         0&#xA;FastEthernet0/7         0&#xA;FastEthernet0/8         0&#xA;FastEthernet0/9         0&#xA;FastEthernet0/10        0&#xA;FastEthernet0/11        0&#xA;FastEthernet0/12        0&#xA;FastEthernet0/13        0&#xA;FastEthernet0/14        0&#xA;FastEthernet0/15        0&#xA;FastEthernet0/16        0&#xA;FastEthernet0/17        0&#xA;FastEthernet0/18        0&#xA;FastEthernet0/19        0&#xA;FastEthernet0/20        916&#xA;FastEthernet0/21        0&#xA;FastEthernet0/22        0&#xA;FastEthernet0/23        0&#xA;FastEthernet0/24        0&#xA;GigabitEthernet0/1      0&#xA;GigabitEthernet0/2      0&#xA;&#xA;&#xA;$ ./cportQosDropPkts.sh -c community -h 127.0.0.1 -i FastEthernet0/20&#xA;&#xA;Interface Name          Output Queue Drops&#xA;&#xA;--------------          ------------------&#xA;FastEthernet0/20        916&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2476" LastEditorUserId="2476" LastEditDate="2017-06-02T00:03:52.667" LastActivityDate="2017-06-02T00:03:52.667" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41623" PostTypeId="1" AcceptedAnswerId="41624" CreationDate="2017-06-01T22:50:03.507" Score="1" ViewCount="20334" Body="&lt;p&gt;I'm using Cisco Package Tracer Student to test some networks. But I'm getting the error &quot;Invalid IP for this subnet mask&quot; when I try to set the IP of a PC as 10.1.1.255 OR 10.1.2.0 and the mask as 255.255.254.0, this network is supposed to be an /23 so the valid range should be from 10.1.1.1 to 10.1.2.254. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I set the PC's IP as 10.1.0.255/23 it works, just as 10.1.1.0/23. Why can't I use those I need? &lt;/p&gt;&#xA;" OwnerUserId="37226" LastEditorUserId="8499" LastEditDate="2018-12-25T05:22:36.010" LastActivityDate="2018-12-25T05:22:36.010" Title="Cisco Package Tracer &quot;Invalid IP for this subnet mask&quot;" Tags="|cisco|ipv4|subnet|packet-tracer|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41624" PostTypeId="2" ParentId="41623" CreationDate="2017-06-01T23:05:11.817" Score="1" Body="&lt;p&gt;It's because those are invalid host addresses for your network. You are trying to straddle the boundary between two different networks for that network mask.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address 10.1.1.255    = 00001010000000010000000111111111&#xA;Mask    255.255.254.0 = 11111111111111111111111000000000&#xA;                  AND   ================================&#xA;Network               = 00001010000000010000000000000000 = 10.1.0.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The broadcast address for your network, &lt;code&gt;10.1.0.0/23&lt;/code&gt;, is &lt;code&gt;10.1.1.255&lt;/code&gt;, which is the address you are trying to use.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Address 10.1.2.0      = 00001010000000010000001000000000&#xA;Mask    255.255.254.0 = 11111111111111111111111000000000&#xA;                  AND   ================================&#xA;Network               = 00001010000000010000001000000000 = 10.1.2.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The network address for your network, &lt;code&gt;10.1.2.0/23&lt;/code&gt;, is &lt;code&gt;10.1.2.0&lt;/code&gt;, which is the address you are trying to use.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could use the addresses you want to use if you use a shorter network mask, e.g. &lt;code&gt;/22&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-06-01T23:05:11.817" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41625" PostTypeId="2" ParentId="2925" CreationDate="2017-06-02T00:03:41.807" Score="2" Body="&lt;p&gt;A big  point in favour of active would be OTN (optical transport network) which gives advantages such as FEC  (standard Reed Solomon FEC is the equivalent of 6dB gain, other implementations such as Nokia's EFEC2 go even further), performance management stats and additional channels in the overhead used for element management similar to SDH/SONET. This is specified in the ITU's G.709. There's a really interesting primer out there in the Google if you're so inclined.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another advantage is carrying just two types of optics to cover most scenarios - 1310nm and a tunable DWDM which makes deployment and sparing a lot easier.&lt;/p&gt;&#xA;" OwnerUserId="37228" LastActivityDate="2017-06-02T00:03:41.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41629" PostTypeId="2" ParentId="41564" CreationDate="2017-06-02T07:03:01.640" Score="2" Body="&lt;p&gt;TL;DR version: No, you can't do this with a single access point. It just won't work as you hope.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If interested, keep on reading for a brief description of why it won't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;802.11n access points make use of MIMO and multiple spatial streams. As such, each antenna is dedicated to one spatial stream (i.e. antenna 1 = first spatial stream, antenna 2 = second spatial stream, etc). The second spatial stream is only used in conjunction with the first spatial stream at higher data rates, it doesn't function independently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What this means is that if you have one antenna inside and one outside, you will either have single spatial stream data rates either inside or out, but then no connectivity in the other location. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the situation you describe, 802.11n won't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With 802.11ac Wave 2 device, you do have multi-user MIMO (MU-MIMO) which allows the access point to split the spatial streams between multiple clients at the same time. While one might think this would allow the situation you describe, MU-MIMO is actually very complicated and requires the antennas to be at fixed distances from each other. So by moving antennas outside, this will simply break this feature. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the situation you describe, 802.11ac won't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you go with an older devices, such as 802.11g, these did not use MIMO. When these devices had two antennas, it was for diversity. In other words, it only used one antenna, but it could switch between which antenna it used to try to get a better signal. However even in this case, it wouldn't work well as typically there was a &quot;delay&quot; between when it could switch from one antenna to the other and back.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the situation you describe, 802.11g may work in a best case scenario, but with serious performance issues.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2017-06-02T07:03:01.640" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41630" PostTypeId="1" AcceptedAnswerId="41763" CreationDate="2017-06-02T11:37:38.880" Score="3" ViewCount="887" Body="&lt;p&gt;I'm doing a NAT64 translation on cisco router. The translation from IPv6 to IPv4 work but the return isn't translated neighter in the NAT64 statistics.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;config:&#xA;&#xA; interface GigabitEthernet0/1&#xA; nat64 enable&#xA; ipv6 address 2001:2525:3164:1000::1/64&#xA;&#xA;&#xA;interface GigabitEthernet0/0/0&#xA; ip address 194.10.83.2 255.255.255.248&#xA; nat64 enable&#xA;&#xA;nat64 v4 pool pool1 194.10.83.2 194.10.83.2&#xA;nat64 v6v4 list nat64ACL pool pool1 overload&#xA;&#xA;ipv6 access-list nat64ACL&#xA; permit ipv6 2001:2525:3164:1000::/56 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Translation table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;RM_A0.1#sh nat64 translations&#xA;Proto   Original IPv4           Translated IPv4&#xA;        Translated IPv6         Original IPv6&#xA;--------------------------------------------------------&#xA;icmp    194.10.83.1:1           [64:FF9B::C20A:5301]:1&#xA;        194.10.83.2:1           [2001:2525:3164:1000:6188:82D:86F8:708E]:1&#xA;&#xA;tcp     194.10.83.1:23          [64:FF9B::C20A:5301]:23&#xA;        194.10.83.2:60531       [2001:2525:3164:1000:6188:82D:86F8:708E]:60531&#xA;&#xA;Total number of translations: 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;statistics:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Number of packets translated by stateless NAT64:&#xA;        Packets translated (IPv4 -&amp;gt; IPv6): 0&#xA;        Packets translated (IPv6 -&amp;gt; IPv4): 0&#xA;&#xA;Number of packets translated by stateful NAT64:&#xA;        Packets translated (IPv4 -&amp;gt; IPv6): 0&#xA;        Packets translated (IPv6 -&amp;gt; IPv4): 75&#xA;&#xA;Global Statistics&#xA;Prefix: 64:FF9B::/96&#xA;        Packets translated (IPv4 -&amp;gt; IPv6): 0&#xA;        Packets translated (IPv6 -&amp;gt; IPv4): 20&#xA;        Packets dropped: 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Wireshark capture on ipv4 network:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/dPTmf.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dPTmf.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;on the IPv4 network everything looks fine. Any idea?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;edit:&#xA;that's the whole configuration of the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 2039 bytes&#xA;!&#xA;version 15.4&#xA;service timestamps debug datetime msec&#xA;service timestamps log datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname RM_A0.1&#xA;!&#xA;boot-start-marker&#xA;boot-end-marker&#xA;!&#xA;enable password emf&#xA;!&#xA;no aaa new-model&#xA;memory-size iomem 15&#xA;!&#xA;ip cef&#xA;ipv6 unicast-routing&#xA;ipv6 dhcp pool myPool&#xA; dns-server 2001:4860:4860::8888&#xA; domain-name Baldi.local&#xA;!&#xA;ipv6 cef&#xA;multilink bundle-name authenticated&#xA;!&#xA;cts logging verbose&#xA;!&#xA;license udi pid CISCO1921/K9 sn FCZ1918C2N2&#xA;!&#xA;vtp domain emf&#xA;vtp mode transparent&#xA;vtp version 2&#xA;!&#xA;redundancy&#xA;!&#xA;interface Embedded-Service-Engine0/0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface GigabitEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; ipv6 address FE80::1:1:0 link-local&#xA; ipv6 address 2001:2525:3164:100F::/127&#xA; ipv6 ospf 99 area 0&#xA;!&#xA;interface GigabitEthernet0/1&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; nat64 enable&#xA; ipv6 address FE80::1:1:1 link-local&#xA; ipv6 address 2001:2525:3164:1000::1/64&#xA; ipv6 nd other-config-flag&#xA; ipv6 dhcp server myPool&#xA; ipv6 ospf 99 area 0&#xA;!&#xA;interface GigabitEthernet0/0/0&#xA; ip address 194.10.83.2 255.255.255.248&#xA; duplex auto&#xA; speed auto&#xA; nat64 enable&#xA;!&#xA;interface Serial0/1/0&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;interface Serial0/1/1&#xA; no ip address&#xA; shutdown&#xA; clock rate 2000000&#xA;!&#xA;router ospfv3 99&#xA; router-id 0.0.0.1&#xA; !&#xA; address-family ipv6 unicast&#xA; exit-address-family&#xA;!&#xA;router rip&#xA; version 2&#xA; network 194.10.83.0&#xA;!&#xA;ip forward-protocol nd&#xA;!&#xA;no ip http server&#xA;no ip http secure-server&#xA;!&#xA;!&#xA;nat64 v4 pool pool1 194.10.83.2 194.10.83.2&#xA;nat64 v6v4 list nat64ACL pool pool1 overload&#xA;!&#xA;ipv6 access-list nat64ACL&#xA; permit ipv6 2001:2525:3164:1000::/56 any&#xA;!&#xA;control-plane&#xA;!&#xA;line con 0&#xA;line aux 0&#xA;line 2&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport output pad telnet rlogin lapb-ta mop udptn v120 ssh&#xA; stopbits 1&#xA;line vty 0 4&#xA; password emf&#xA; login&#xA; transport input none&#xA;!&#xA;scheduler allocate 20000 1000&#xA;ntp server 2001:2525:3164:1F::&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37080" LastEditorUserId="37080" LastEditDate="2018-12-07T13:05:27.850" LastActivityDate="2018-12-07T13:05:27.850" Title="NAT64 return translation doesn't work" Tags="|cisco|ipv4|ipv6|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 4.0" />
  <row Id="41631" PostTypeId="1" AcceptedAnswerId="41653" CreationDate="2017-06-02T11:38:15.017" Score="2" ViewCount="629" Body="&lt;p&gt;I've got a running 800 series router, it is presenting a HTTP interface on port 8080 and it requests credentials when the IP:port is opened in a browser but I cannot get past the authentication.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am able to access via SSH and can see what appears to be valid HTTP configuration, I am at a loss as to what might be amiss.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the running config I can see the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa authentication login default local&#xA;...&#xA;ip http server&#xA;ip http port 8080&#xA;ip http authentication local&#xA;no ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;...&#xA;username patrick password 7 0512091A2C595D1D0D0D1E1C000509393F31383A31&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The router is reporting the HTTP server is configured&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#show ip http server all&#xA;HTTP server status: Enabled&#xA;HTTP server port: 8080&#xA;HTTP server active supplementary listener ports:&#xA;HTTP server authentication method: local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything else looks normal, I can see history of my connection attempts and all the modules are showing as active.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried enabling IP HTTP debugging (debug ip http authentication) but I see nothing when I make an attempt to login via a browser.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any thoughts on what I've missed out on here? I didn't configure this from scratch so there may be some weirdness elsewhere in the config, but I'm at a loss to work out what to check next.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;! Last configuration change at 10:55:01 BST Wed May 3 2017&#xA;! NVRAM config last updated at 12:14:21 BST Thu May 25 2017&#xA;!&#xA;version 15.4&#xA;no service pad&#xA;service tcp-keepalives-in&#xA;service tcp-keepalives-out&#xA;service timestamps debug datetime msec localtime&#xA;service timestamps log datetime msec localtime&#xA;service password-encryption&#xA;service linenumber&#xA;!&#xA;hostname HOSTNAME&#xA;!&#xA;boot-start-marker&#xA;boot system flash flash:/c800-universalk9-mz.SPA.154-3.M7.bin&#xA;warm-reboot&#xA;boot-end-marker&#xA;!&#xA;!&#xA;logging buffered 51200&#xA;enable secret 5 0000000000000&#xA;!&#xA;aaa new-model&#xA;!&#xA;!&#xA;aaa authentication banner C&#xA;*******************************************************************************&#xA;aaa authentication login default local&#xA;aaa authentication login NO_AUTHEN none&#xA;aaa authentication login SSLVPN local&#xA;aaa authorization exec default local &#xA;aaa authorization network groupauthor local &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;aaa session-id common&#xA;clock timezone GMT 0 0&#xA;clock summer-time BST recurring last Sun Mar 1:00 last Sun Oct 1:00&#xA;service-module wlan-ap 0 bootimage autonomous&#xA;!&#xA;crypto pki trustpoint TRUSTPOINT&#xA; enrollment selfsigned&#xA; ip-address 80.70.60.50&#xA; subject-name CN=remote.HOSTNAMEgroup.com&#xA; revocation-check crl&#xA; rsakeypair SSLVPN_KEYPAIR&#xA;!&#xA;!&#xA;crypto pki certificate chain TRUSTPOINT&#xA; certificate self-signed 01&#xA;  xxx&#xA;    quit&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;&#xA;&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip flow-cache timeout active 1&#xA;ip domain name HOSTNAME.LOCAL&#xA;ip name-server 8.8.8.8&#xA;ip name-server 8.8.4.4&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;multilink bundle-name authenticated&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;cts logging verbose&#xA;license udi pid C887VA-W-E-K9 sn FCZ1921C2P3&#xA;!&#xA;!&#xA;username Patrick password 7 0512091A2C595D1D0D0D1E1C000509393F31383A31  &#xA;!&#xA;crypto vpn anyconnect flash:/webvpn/anyconnect-win-4.4.00243-webdeploy-k9.pkg sequence 1&#xA;!&#xA;crypto vpn anyconnect flash:/webvpn/anyconnect-macosx-i386-4.2.02075-k9.pkg sequence 2&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;controller VDSL 0&#xA;!&#xA;! &#xA;!&#xA;crypto isakmp policy 50&#xA; encr 3des&#xA; hash md5&#xA; authentication pre-share&#xA; group 14&#xA;!&#xA;crypto isakmp policy 55&#xA; encr 3des&#xA; authentication pre-share&#xA; group 2&#xA;crypto isakmp invalid-spi-recovery&#xA;crypto isakmp keepalive 20&#xA;!&#xA;crypto isakmp client configuration group HOSTNAMEGroup&#xA; key Q31h23rlNn1B57p9w0D4VwlxX78CTr74NH&#xA; dns 192.168.50.2&#xA; wins 192.168.50.2&#xA; domain HOSTNAME.local&#xA; pool VPN_CLIENTS&#xA; acl 109&#xA;crypto isakmp profile VPNCLIENT&#xA;   match identity group VPN_CLIENTS&#xA;   client authentication list local&#xA;   isakmp authorization list groupauthor&#xA;   client configuration address respond&#xA;!&#xA;!&#xA;crypto ipsec transform-set 3DES esp-3des esp-sha-hmac &#xA; mode tunnel&#xA;crypto ipsec df-bit clear&#xA;!&#xA;crypto ipsec profile VTI&#xA; set transform-set 3DES &#xA;!&#xA;!&#xA;!&#xA;crypto dynamic-map DYNAMIC_MAP 10&#xA; set transform-set 3DES &#xA; set isakmp-profile VPNCLIENT&#xA;!&#xA;!&#xA;crypto map HOSTNAME_RAS_VPN 10 ipsec-isakmp dynamic DYNAMIC_MAP &#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface Loopback0&#xA; no ip address&#xA;!&#xA;interface Tunnel65535&#xA; description HOSTNAME to MSP_VPNCORE TunnelTunnel65535&#xA; ip address 10.99.199.2 255.255.255.252&#xA; ip mtu 1374&#xA; ip flow ingress&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; ip load-sharing per-packet&#xA; ip tcp adjust-mss 1334&#xA; tunnel source 80.70.60.50&#xA; tunnel mode ipsec ipv4&#xA; tunnel destination 190.160.120.90&#xA; tunnel sequence-datagrams&#xA; tunnel checksum&#xA; tunnel path-mtu-discovery&#xA; tunnel protection ipsec profile VTI&#xA;!&#xA;interface Ethernet0&#xA; no ip address&#xA; shutdown&#xA;!&#xA;interface FastEthernet0&#xA; switchport access vlan 50&#xA; no ip address&#xA; duplex full&#xA; speed 100&#xA;!&#xA;interface FastEthernet1&#xA; switchport access vlan 82&#xA; no ip address&#xA; duplex full&#xA; speed 100&#xA;!&#xA;interface FastEthernet2&#xA; switchport access vlan 50&#xA; no ip address&#xA; duplex full&#xA; speed 100&#xA;!&#xA;interface FastEthernet3&#xA; switchport access vlan 50&#xA; no ip address&#xA; duplex full&#xA; speed 100&#xA;!&#xA;interface Wlan-GigabitEthernet0&#xA; switchport access vlan 50&#xA; no ip address&#xA;!&#xA;interface wlan-ap0&#xA; ip unnumbered Vlan50&#xA;!&#xA;interface Vlan1&#xA; no ip address&#xA; ip virtual-reassembly in&#xA;!&#xA;interface Vlan50&#xA; ip address 192.168.50.1 255.255.255.0&#xA; ip helper-address 192.168.50.2&#xA; ip flow ingress&#xA; ip flow egress&#xA; ip nat inside&#xA; ip virtual-reassembly in&#xA;!&#xA;interface Vlan82&#xA; ip address 80.70.60.50 255.255.255.248&#xA; ip flow ingress&#xA; ip flow egress&#xA; ip nat outside&#xA; ip virtual-reassembly in&#xA; crypto map HOSTNAME_RAS_VPN&#xA;!&#xA;router eigrp 65535&#xA; traffic-share min across-interfaces&#xA; network 10.99.199.0 0.0.0.3&#xA; network 10.168.50.0 0.0.0.255&#xA; network 192.168.50.0&#xA; passive-interface default&#xA; no passive-interface Tunnel65535&#xA; no passive-interface Vlan50&#xA; no eigrp log-neighbor-changes&#xA;!&#xA;ip local pool NAT_POOL 10.168.50.0 10.168.50.255&#xA;ip local pool VPN_CLIENTS 192.168.50.220 192.168.50.229&#xA;ip local pool WEBVPN-POOL 192.168.50.230 192.168.50.234&#xA;ip forward-protocol nd&#xA;ip http server&#xA;ip http port 8080&#xA;ip http authentication local&#xA;no ip http secure-server&#xA;ip http timeout-policy idle 60 life 86400 requests 10000&#xA;!&#xA;ip flow-export source Vlan82&#xA;ip flow-export version 9&#xA;ip flow-export destination 192.168.50.2 9996&#xA;ip flow-export destination 192.168.50.2 12245&#xA;ip flow-top-talkers&#xA; top 20&#xA; sort-by bytes&#xA; cache-timeout 360&#xA; match destination address 0.0.0.0 0.0.0.0&#xA;!&#xA;no ip nat service sip udp port 5060&#xA;ip nat pool HOSTNAME 10.168.50.0 10.168.50.255 prefix-length 24 type match-host&#xA;ip nat inside source list 101 interface Vlan82 overload&#xA;ip nat inside source static tcp 192.168.50.2 3389 interface Vlan82 3389&#xA;ip nat inside source static tcp 192.168.50.2 80 interface Vlan82 80&#xA;ip nat inside source static tcp 192.168.50.2 443 interface Vlan82 443&#xA;ip nat inside source static tcp 192.168.50.2 1723 interface Vlan82 1723&#xA;ip nat inside source static tcp 192.168.50.2 987 interface Vlan82 987&#xA;ip nat inside source static tcp 192.168.50.2 4125 interface Vlan82 4125&#xA;ip nat inside source static tcp 192.168.50.2 25 interface Vlan82 25&#xA;ip nat inside source static tcp 192.168.50.50 990 interface Vlan82 990&#xA;ip nat inside source static udp 192.168.50.50 990 interface Vlan82 990&#xA;ip nat inside source static tcp 192.168.50.50 50000 interface Vlan82 50000&#xA;ip nat inside source static udp 192.168.50.50 50000 interface Vlan82 50000&#xA;ip nat inside source static tcp 192.168.50.50 50001 interface Vlan82 50001&#xA;ip nat inside source static udp 192.168.50.50 50001 interface Vlan82 50001&#xA;ip nat inside source static tcp 192.168.50.50 50002 interface Vlan82 50002&#xA;ip nat inside source static udp 192.168.50.50 50002 interface Vlan82 50002&#xA;ip nat inside source static tcp 192.168.50.50 50003 interface Vlan82 50003&#xA;ip nat inside source static udp 192.168.50.50 50003 interface Vlan82 50003&#xA;ip nat inside source static tcp 192.168.50.50 50004 interface Vlan82 50004&#xA;ip nat inside source static udp 192.168.50.50 50004 interface Vlan82 50004&#xA;ip nat inside source static tcp 192.168.50.50 50005 interface Vlan82 50005&#xA;ip nat inside source static udp 192.168.50.50 50005 interface Vlan82 50005&#xA;ip nat inside source static tcp 192.168.50.50 50006 interface Vlan82 50006&#xA;ip nat inside source static udp 192.168.50.50 50006 interface Vlan82 50006&#xA;ip nat inside source static tcp 192.168.50.50 50007 interface Vlan82 50007&#xA;ip nat inside source static udp 192.168.50.50 50007 interface Vlan82 50007&#xA;ip nat inside source static tcp 192.168.50.50 50008 interface Vlan82 50008&#xA;ip nat inside source static udp 192.168.50.50 50008 interface Vlan82 50008&#xA;ip nat inside source static tcp 192.168.50.50 50009 interface Vlan82 50009&#xA;ip nat inside source static udp 192.168.50.50 50009 interface Vlan82 50009&#xA;ip nat inside source static tcp 192.168.50.50 50010 interface Vlan82 50010&#xA;ip nat inside source static udp 192.168.50.50 50010 interface Vlan82 50010&#xA;ip nat inside source static tcp 192.168.50.7 22 interface Vlan82 22&#xA;ip nat inside source static tcp 192.168.50.7 9090 interface Vlan82 9090&#xA;ip nat inside source static 192.168.50.1 10.168.50.1 route-map MSP extendable&#xA;ip nat inside source static 192.168.50.2 10.168.50.2 route-map MSP extendable&#xA;ip nat inside source static 192.168.50.3 10.168.50.3 route-map MSP extendable&#xA;ip nat inside source static 192.168.50.10 10.168.50.10 route-map MSP extendable&#xA;ip route 0.0.0.0 0.0.0.0 80.70.60.52&#xA;ip route 190.160.120.90 255.255.255.255 80.70.60.52&#xA;ip ssh port 2220 rotary 1&#xA;ip ssh source-interface Vlan50&#xA;ip ssh rsa keypair-name HOSTNAMEgroup.com&#xA;ip ssh version 2&#xA;!&#xA;ip access-list standard ACL_SPLIT_TUNNEL&#xA;!&#xA;ip access-list extended ACL_Outside_In&#xA; deny   ip 192.168.0.0 0.0.255.255 any&#xA; deny   ip 172.16.0.0 0.15.255.255 any&#xA; deny   ip 10.0.0.0 0.255.255.255 any&#xA; deny   ip 127.0.0.0 0.255.255.255 any&#xA; deny   ip 255.0.0.0 0.255.255.255 any&#xA; deny   ip 224.0.0.0 31.255.255.255 any&#xA; deny   ip host 0.0.0.0 any&#xA; deny   ip host 255.255.255.255 any&#xA; permit tcp any any established&#xA; permit udp any eq domain any&#xA; permit udp any eq ntp any&#xA; permit icmp any any unreachable&#xA; permit icmp any any echo-reply&#xA; permit icmp any any packet-too-big&#xA; permit icmp any any time-exceeded&#xA; permit icmp any any traceroute&#xA; permit icmp any any administratively-prohibited&#xA; permit icmp any any echo&#xA; permit esp host 80.160.170.70 any&#xA; permit udp host 80.160.170.70 any eq isakmp&#xA; permit udp host 80.160.170.70 any eq non500-isakmp&#xA; permit udp any any gt 1023&#xA; remark permit udp any any&#xA; deny   icmp any any&#xA; deny   udp any any log&#xA; deny   tcp any any log&#xA; deny   ip any any log&#xA;ip access-list extended RAS_VPN_CLIENTS&#xA; permit ip any host 192.168.50.220&#xA; permit ip any host 192.168.50.221&#xA; permit ip any host 192.168.50.222&#xA; permit ip any host 192.168.50.223&#xA; permit ip any host 192.168.50.224&#xA; permit ip any host 192.168.50.225&#xA; permit ip any host 192.168.50.226&#xA; permit ip any host 192.168.50.227&#xA; permit ip any host 192.168.50.228&#xA; permit ip any host 192.168.50.229&#xA;!&#xA;logging trap debugging&#xA;logging source-interface Loopback0&#xA;dialer-list 1 protocol ip permit&#xA;!&#xA;route-map MSP permit 10&#xA; match ip address 199&#xA; match interface Tunnel65535&#xA;!&#xA;snmp-server community public RO&#xA;snmp-server ifindex persist&#xA;snmp-server packetsize 4096&#xA;snmp-server location HOSTNAME Group&#xA;snmp-server enable traps snmp authentication linkdown linkup coldstart warmstart&#xA;snmp-server enable traps vrrp&#xA;snmp-server enable traps flowmon&#xA;snmp-server enable traps call-home message-send-fail server-fail&#xA;snmp-server enable traps tty&#xA;snmp-server enable traps eigrp&#xA;snmp-server enable traps ospf state-change&#xA;snmp-server enable traps ospf errors&#xA;snmp-server enable traps ospf retransmit&#xA;snmp-server enable traps ospf lsa&#xA;snmp-server enable traps ospf cisco-specific state-change nssa-trans-change&#xA;snmp-server enable traps ospf cisco-specific state-change shamlink interface&#xA;snmp-server enable traps ospf cisco-specific state-change shamlink neighbor&#xA;snmp-server enable traps ospf cisco-specific errors&#xA;snmp-server enable traps ospf cisco-specific retransmit&#xA;snmp-server enable traps ospf cisco-specific lsa&#xA;snmp-server enable traps license&#xA;snmp-server enable traps envmon&#xA;snmp-server enable traps ethernet cfm cc mep-up mep-down cross-connect loop config&#xA;snmp-server enable traps ethernet cfm crosscheck mep-missing mep-unknown service-up&#xA;snmp-server enable traps flash insertion&#xA;snmp-server enable traps flash removal&#xA;snmp-server enable traps c3g&#xA;snmp-server enable traps isdn call-information&#xA;snmp-server enable traps isdn layer2&#xA;snmp-server enable traps isdn chan-not-avail&#xA;snmp-server enable traps isdn ietf&#xA;snmp-server enable traps adslline&#xA;snmp-server enable traps vdsl2line&#xA;snmp-server enable traps mac-notification&#xA;snmp-server enable traps energywise&#xA;snmp-server enable traps cef resource-failure peer-state-change peer-fib-state-change inconsistency&#xA;snmp-server enable traps aaa_server&#xA;snmp-server enable traps atm subif&#xA;snmp-server enable traps bfd&#xA;snmp-server enable traps bgp&#xA;snmp-server enable traps memory bufferpeak&#xA;snmp-server enable traps cnpd&#xA;snmp-server enable traps config-copy&#xA;snmp-server enable traps config&#xA;snmp-server enable traps config-ctid&#xA;snmp-server enable traps entity&#xA;snmp-server enable traps fru-ctrl&#xA;snmp-server enable traps resource-policy&#xA;snmp-server enable traps event-manager&#xA;snmp-server enable traps hsrp&#xA;snmp-server enable traps ipmulticast&#xA;snmp-server enable traps msdp&#xA;snmp-server enable traps mvpn&#xA;snmp-server enable traps pim neighbor-change rp-mapping-change invalid-pim-message&#xA;snmp-server enable traps cpu threshold&#xA;snmp-server enable traps rsvp&#xA;snmp-server enable traps ipsla&#xA;snmp-server enable traps syslog&#xA;snmp-server enable traps l2tun session&#xA;snmp-server enable traps l2tun pseudowire status&#xA;snmp-server enable traps vtp&#xA;snmp-server enable traps pw vc&#xA;snmp-server enable traps firewall serverstatus&#xA;snmp-server enable traps ipmobile&#xA;snmp-server enable traps nhrp nhs&#xA;snmp-server enable traps nhrp nhc&#xA;snmp-server enable traps nhrp nhp&#xA;snmp-server enable traps nhrp quota-exceeded&#xA;snmp-server enable traps gdoi gm-start-registration&#xA;snmp-server enable traps gdoi gm-registration-complete&#xA;snmp-server enable traps gdoi gm-re-register&#xA;snmp-server enable traps gdoi gm-rekey-rcvd&#xA;snmp-server enable traps gdoi gm-rekey-fail&#xA;snmp-server enable traps gdoi ks-rekey-pushed&#xA;snmp-server enable traps gdoi gm-incomplete-cfg&#xA;snmp-server enable traps gdoi ks-no-rsa-keys&#xA;snmp-server enable traps ipsec tunnel start&#xA;snmp-server enable traps ipsec tunnel stop&#xA;snmp-server enable traps ipsec too-many-sas&#xA;snmp-server enable traps vrfmib vrf-up vrf-down&#xA;access-list 101 deny   ip 192.168.50.0 0.0.0.255 10.0.0.0 0.255.255.255&#xA;access-list 101 deny   ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255&#xA;access-list 101 permit ip 192.168.50.0 0.0.0.255 any&#xA;access-list 102 permit ip 192.168.50.0 0.0.0.255 any&#xA;access-list 103 permit ip 192.168.50.0 0.0.0.255 10.99.1.0 0.0.0.255&#xA;access-list 103 permit ip 192.168.50.0 0.0.0.255 10.240.168.128 0.0.0.31&#xA;access-list 103 permit ip 192.168.50.0 0.0.0.255 10.240.140.0 0.0.0.31&#xA;access-list 103 permit ip 192.168.50.0 0.0.0.255 10.99.15.0 0.0.0.255&#xA;access-list 104 permit ip host 192.168.50.201 192.168.50.0 0.0.0.255&#xA;access-list 104 permit ip host 192.168.50.202 192.168.50.0 0.0.0.255&#xA;access-list 104 permit ip host 192.168.50.203 192.168.50.0 0.0.0.255&#xA;access-list 104 permit ip host 192.168.50.204 192.168.50.0 0.0.0.255&#xA;access-list 104 permit ip host 192.168.50.205 192.168.50.0 0.0.0.255&#xA;access-list 109 permit ip any host 192.168.50.220&#xA;access-list 109 permit ip any host 192.168.50.221&#xA;access-list 109 permit ip any host 192.168.50.222&#xA;access-list 109 permit ip any host 192.168.50.223&#xA;access-list 109 permit ip any host 192.168.50.224&#xA;access-list 109 permit ip any host 192.168.50.225&#xA;access-list 109 permit ip any host 192.168.50.226&#xA;access-list 109 permit ip any host 192.168.50.227&#xA;access-list 109 permit ip any host 192.168.50.228&#xA;access-list 109 permit ip any host 192.168.50.229&#xA;access-list 199 permit ip 192.168.50.0 0.0.0.255 10.99.0.0 0.0.255.255&#xA;!&#xA;!&#xA;!&#xA;control-plane&#xA;!&#xA;!&#xA;mgcp behavior rsip-range tgcp-only&#xA;mgcp behavior comedia-role none&#xA;mgcp behavior comedia-check-media-src disable&#xA;mgcp behavior comedia-sdp-force disable&#xA;!&#xA;mgcp profile default&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;alias exec ap service-module wlan-ap0 session&#xA;!&#xA;line con 0&#xA; exec-timeout 0 0&#xA; no modem enable&#xA;line aux 0&#xA;line 2&#xA; no activation-character&#xA; no exec&#xA; transport preferred none&#xA; transport input all&#xA; stopbits 1&#xA;line vty 0 4&#xA; exec-timeout 0 0&#xA; rotary 1&#xA; transport input ssh&#xA;!&#xA;scheduler allocate 20000 1000&#xA;ntp source Vlan50&#xA;ntp server 2.uk.pool.ntp.org&#xA;ntp server 0.uk.pool.ntp.org minpoll 10&#xA;ntp server 1.uk.pool.ntp.org&#xA;ntp server 3.uk.pool.ntp.org&#xA;onep&#xA;!&#xA;!&#xA;!&#xA;!&#xA;webvpn gateway WEBVPN-GATEWAY&#xA; ip address 80.70.60.50 port 9443  &#xA; ssl encryption aes256-sha1&#xA; ssl trustpoint TRUSTPOINT&#xA; logging enable&#xA; inservice&#xA; !&#xA;webvpn context WEBVPN-CONTEXT&#xA; title &quot;HOSTNAME VPN&quot;&#xA; !&#xA; acl &quot;SSL-ACL&quot;&#xA;   permit ip any 192.168.50.0 255.255.255.0&#xA; login-message &quot;HOSTNAME WebVPN&quot;&#xA; aaa authentication list SSLVPN&#xA; gateway WEBVPN-GATEWAY&#xA; max-users 8&#xA; !&#xA; ssl authenticate verify all&#xA; !&#xA; url-list &quot;rewrite&quot;&#xA; inservice&#xA; !&#xA; policy group WEBVPNPOLICY&#xA;   functions svc-enabled&#xA;   filter tunnel SSL-ACL&#xA;   svc address-pool &quot;WEBVPN-POOL&quot; netmask 255.255.255.0&#xA;   svc default-domain &quot;HOSTNAME.local&quot;&#xA;   svc rekey method new-tunnel&#xA;   svc split include 192.168.50.0 255.255.255.0&#xA;   svc dns-server primary 192.168.50.2&#xA;   svc wins-server primary 192.168.50.2&#xA; default-group-policy WEBVPNPOLICY&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37235" LastEditorUserId="37235" LastEditDate="2017-06-02T15:17:27.630" LastActivityDate="2017-06-03T10:45:22.807" Title="Cisco 800 series HTTP interface unavailable" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41632" PostTypeId="2" ParentId="3053" CreationDate="2017-06-02T12:41:55.607" Score="0" Body="&lt;p&gt;The original idea of the IPv6 proponents was that organisations would run multiple address blocks in parallel to allow multi-homing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However in practice this is problematic for several reasons.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;In such a setup when an end-host chooses a source IP it is essentially making routing decisions but end-hosts are poorly placed to make routing decisions. &lt;/li&gt;&#xA;&lt;li&gt;Adding or removing IP prefixes is often difficult as IPs are stored in many places. There were proposed extensions to DNS to help with this but they added a load of complexity and fragility to the DNS system and were eventually abandoned as &quot;historic&quot;.&lt;/li&gt;&#xA;&lt;li&gt;It doesn't really handle the case when connectivity to one provider unexpectedly goes down.&lt;/li&gt;&#xA;&lt;li&gt;Routers will need to make routing decisions based on the source IP. Some routers can do this but it's an advanced feature, not normal routing.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Eventually it seems the powers that be realised that organisations weren't going to put up with that shit and if they wanted to see IPv6 adopted they had to offer IPv6 PI space on similar terms to IPv4 PI space. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Afaict exact policies vary a bit between RIRs but generally if you can demonstrate intent to multihome you should be able to get a block of PI space without too much difficulty.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It will be interesting to see how this plays out in the long term. With IPv6 NAT being strongly discouraged I can see an explosion in the routing table size as medium sized enterprises move from natted v4 to provider-independent IPv6.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-02T12:41:55.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41634" PostTypeId="1" AcceptedAnswerId="41635" CreationDate="2017-06-02T14:03:24.870" Score="0" ViewCount="1588" Body="&lt;p&gt;There are a pair of Netgear S3300-52X switches which are not stacking. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The switches are directly connected by 1m of CAT6 cable between their 10G ports. The switches are both using the same version of the firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even after a restart, the Netgear switches are not auto-stacking and the switches do not show each other in the stack overview page. There are no other switches and the switches have not previously been stacked.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can the switches be made to stack?&lt;/p&gt;&#xA;" OwnerUserId="37237" LastActivityDate="2017-06-02T14:03:24.870" Title="Netgear ProSafe S3300 smart switches not stacking" Tags="|netgear-prosafe|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41635" PostTypeId="2" ParentId="41634" CreationDate="2017-06-02T14:03:24.870" Score="2" Body="&lt;p&gt;Although the switches are set to auto-stack when connected, the ports are set to 'ethernet' rather than 'stack' by default, so you have to set the ports to 'stack' mode. To do this:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Log onto the switch (default address is&#xA;&lt;a href=&quot;http://192.168.0.239/base/cheetah_login.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://192.168.0.239/base/cheetah_login.html&lt;/a&gt; ) &lt;/li&gt;&#xA;&lt;li&gt;Go to System-&gt;Stacking-&gt;Advanced-&gt;Stack-port Configuration and set the&#xA;relevant port to ‘Stack’. Note, only the 4 10G ports can be used for&#xA;stacking. &lt;/li&gt;&#xA;&lt;li&gt;Then restart the switches.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="37237" LastActivityDate="2017-06-02T14:03:24.870" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41636" PostTypeId="1" CreationDate="2017-06-02T16:04:43.737" Score="0" ViewCount="40" Body="&lt;p&gt;Current situation: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The internet available to me is a shared router that I do not have administrative access to. If really needed I could reset the password but I rather not. I plugged in a network cable and plugged it into the WAN port on my own openwrt/lede router. This gives me a semi-functional but secure network where I have a firewall. However this is a double NAT, which breaks some programs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to assign my own network the IP's given from the shared network(192.168.1.0/24) where I keep my firewall enabled. In a way this is similar to assigning public IP's from your ISP to your whole LAN while having a firewall. Simply bridging the WAN and LAN side works but I lose the firewall in this case, which is missing the point. I simply do not trust the other tenants.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately my knowledge about how to route networks is limited to NAT so I don't really know how to approach this(sidenote: any good tutorials on routing?). I did find this: &lt;a href=&quot;https://lede-project.org/docs/user-guide/firewall_configuration#stateful_firewall_without_nat&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://lede-project.org/docs/user-guide/firewall_configuration#stateful_firewall_without_nat&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But that doesn't work. I simply lose internet from my LAN side when I disable masquerading(which I assume is NAT)&lt;/p&gt;&#xA;" OwnerUserId="37240" LastActivityDate="2017-06-02T16:16:46.037" Title="Getting &quot;public&quot; IP's while keeping firewall enabled" Tags="|router|firewall|nat|security|" AnswerCount="1" CommentCount="1" ClosedDate="2017-06-02T16:17:04.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="41637" PostTypeId="2" ParentId="41636" CreationDate="2017-06-02T16:16:46.037" Score="1" Body="&lt;p&gt;If ou want to get traffic from the multi-tenant network to your own using the addresses given to you from the multi-tenant subnet you'll need to turn off NAT as you have done and then enable proxy-arp for the addresses you want.  However this is overkill, I don't know what applications won't work across a &quot;double-NAT&quot; as you call it.  Unless you are somehow processing the network traffic between the NAT devices, then what difference can it make, one NAT or two?&lt;/p&gt;&#xA;" OwnerUserId="27644" LastActivityDate="2017-06-02T16:16:46.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41639" PostTypeId="2" ParentId="35168" CreationDate="2017-06-02T19:56:42.077" Score="2" Body="&lt;p&gt;Yes this is possible. Any VPN technology that can carry IPv6 over IPv4 will work. Personally I use openvpn as my go-to VPN solution but others may have other preferences.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ideal configuration would be.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Your hosting provider allocates a block of IPv6 addresess for your VPN and routes it to your server.&lt;/li&gt;&#xA;&lt;li&gt;You use that block to address systems on the VPN&lt;/li&gt;&#xA;&lt;li&gt;Your server routes between the VPN and your hosting provider's network.&lt;/li&gt;&#xA;&lt;li&gt;Machines on the VPN have their IPv6 default gateway pointed at the VPN.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Unfortunately this isn't possible with all hosting providers. Some providers will give you a block of addreses but they are &quot;on-link&quot; addresses for which traffic will only be delivered to your server if your server responds to neighbour-discovery requests for them. There is one provider i'm aware of who will only give your server a single v6 address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So what are the alternatives?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One is NAT, the IPv6 proponents have a strong dislike for NAT but nevertheless Linux eventually implemented IPv6 NAT functionality, so you can use &quot;unique-local&quot; addresses on your VPN and use NAT to translate them to your server's global address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other is &quot;proxy NDP&quot;. If your ISP allocated your server a block of &quot;on-link&quot; addresses you can set your server up to respond to neighour discover requests for those addresses without adding the addresses as local addresses on your server. You can then use the addresses to address systems on the VPN.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-02T19:56:42.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41641" PostTypeId="1" CreationDate="2017-06-02T20:41:02.120" Score="5" ViewCount="15565" Body="&lt;p&gt;I have a existing switch stack with 4 switches in the stack (all of them are 3850).&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Switch Ports Model              SW Version        SW Image              Mode   &#xA;------ ----- -----              ----------        ----------            ----   &#xA;*    1 56    WS-C3850-48U       03.03.05.SE       cat3k_caa-universalk9 BUNDLE &#xA;     2 56    WS-C3850-48U       03.03.05.SE       cat3k_caa-universalk9 BUNDLE &#xA;     3 56    WS-C3850-48U       03.03.05.SE       cat3k_caa-universalk9 BUNDLE &#xA;     4 56    WS-C3850-48U       03.03.05.SE       cat3k_caa-universalk9 BUNDLE &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Now, I have to add another switch (3850) to that stack.I found out that the the member number of the new switch is 1 (which is default) and the priority is set as 15. Also they new 3850 is in INSTALL mode and does not have the .bin file which is on the stack. The IOS version is the same on the stack as well as the new switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is how I am planing to add this switch:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Turn off the power of the new switch&lt;/li&gt;&#xA;&lt;li&gt;connect the stacking cable (according to Cisco documentation)&lt;/li&gt;&#xA;&lt;li&gt;Turn on the power of the new switch&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;By doing this the switch should automatically get the stack number and priority value of 1.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now my question is: since the new switch has priority value of 15 before adding it to the stack, after adding the switch to the stack following above procedure, can this switch reboot the entire stack and reelect the master switch? If yes, how can I avoid this. Also will the INSTALL mode and BUNDLE mode cause any problems?&lt;/p&gt;&#xA;" OwnerUserId="36123" LastEditorUserId="8499" LastEditDate="2017-06-03T03:35:32.597" LastActivityDate="2018-03-30T09:35:43.723" Title="Addition of new switch to an existing 3850 stack" Tags="|cisco|cisco-ios|stacking|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41642" PostTypeId="2" ParentId="41641" CreationDate="2017-06-02T21:06:05.433" Score="1" Body="&lt;p&gt;You should always set the switch number and priority of each switch prior to creating or adding to the stack. The switch that you want to be the master should be set to the highest priority among the switches, the one that you want to take over should be set to the next highest priority, etc. The newest switch, if you do not want it to be the master, should be set to the lowest priority.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You really want to set the priorities so that you have a deterministic method to elect the master. If you leave the priority of the new switch as &lt;code&gt;15&lt;/code&gt;, it will not automatically be changed to &lt;code&gt;1&lt;/code&gt; as you seem to say:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;By doing this the switch should automatically get the stack number and&#xA;  priority value of 1.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Adding a switch to an existing stack should, and probably will, work just fine, but there is always a risk that something goes wrong, so you need to be prepared to reboot the entire stack. If you want a particular switch to be the master (as you should), then you need to specifically set the switch priorities.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-06-03T03:32:50.623" LastActivityDate="2017-06-03T03:32:50.623" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41644" PostTypeId="1" AcceptedAnswerId="41775" CreationDate="2017-06-02T22:23:14.100" Score="1" ViewCount="687" Body="&lt;p&gt;Alright, so I've been trying this without any luck the whole day.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How to configure a VLAN for all its client to get stateful IPv6 through a DHCPv6 server in the network on a Cisco C891F router?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My current configuration abbreviated with IPv6 relevant stuff only:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt; ipv6 unicast-routing&#xA; ipv6 cef&#xA; !&#xA; interface GigabitEthernet8&#xA;  description Internet&#xA;  ipv6 address 2800:160:1F88:1::2/126&#xA;  ipv6 enable&#xA; !     &#xA; interface Vlan1&#xA;  description LAN&#xA;  ipv6 address 2800:160:1F88::1/64&#xA;  ipv6 enable&#xA;  ipv6 nd prefix 2600:160:1F88::/64 300 300 no-autoconfig&#xA;  ipv6 nd managed-config-flag&#xA;  ipv6 nd ra lifetime 9000&#xA; !&#xA; ipv6 route ::/0 2800:160:1F88:1::1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;DHCPv6 is at 2800:160:1F88:12 on a Windows Server 2016.&#xA;As a sidenote DHCP works correctly on it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just cannot get it to work, clients are still getting autoconfig through SLAAC, they do not even get the Nameservers configured at the DHCPv6 server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What am I doing wrong?&lt;/p&gt;&#xA;" OwnerDisplayName="user34559" LastActivityDate="2017-06-08T16:11:11.893" Title="How to configure a VLAN for all its client to get stateful IPv6 through a DHCPv6 server in the network on a Cisco C891F router?" Tags="|cisco|vlan|ipv6|dhcpv6|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41645" PostTypeId="2" ParentId="41611" CreationDate="2017-06-02T23:59:13.477" Score="0" Body="&lt;p&gt;Wanted to update with how I resolved this. Basically something apparently got corrupted in the config files. The behavior started when I was trying to add a new tunnel interface, but initially would disappear when I reverted to one of my saved configs. After a while even this action would not resolve the error (same one noted above). So - I reverted to factory! Needless to say that is less than ideal, I'm very surprised to have this type of issue with this box. Once I did so I was able to import my saved configuration file and add the tunnel interface with no errors.&lt;/p&gt;&#xA;" OwnerUserId="37210" LastEditorUserId="37210" LastEditDate="2017-06-03T01:23:12.397" LastActivityDate="2017-06-03T01:23:12.397" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41647" PostTypeId="2" ParentId="23508" CreationDate="2017-06-03T03:23:02.293" Score="4" Body="&lt;p&gt;The original question asked how a TCP handles a segment that partially overlaps the end of the receive window.  RFC 793 answers this on page 82: &quot;the local TCP considers that segments overlapping the range RCV.NXT to RCV.NXT + RCV.WND - 1 [meaning the receive window] carry acceptable data or control.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore any segment that even partially overlaps the receive window, on either end, is kept.  However, only the data inside the window is kept.  The TCP can just discard the data outside the window and send an ACK for the highest sequence number kept.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(For a segment overlapping the end of the receive window, since the receiver can enlarge the window at any time, I believe it could also enlarge the window and keep the &quot;extra&quot; data that had been outside the old window.  It would then send the appropriate ACK to show that that data had been accepted.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The RFC also says that &quot;Segments containing sequence numbers entirely outside of this range are considered duplicates and discarded&quot;, which again implies that segments &lt;em&gt;not&lt;/em&gt; entirely outside the window are &lt;em&gt;not&lt;/em&gt; discarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, a related case is mentioned on page 52: &quot;When a segment overlaps other already received segments we reconstruct the segment to contain just the new data, and adjust the header fields to be consistent.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, if the TCP had received two segments having a hole between them and then receives a segment that overlaps either or both, the TCP will create a new segment from the latest segment to fill the hole.  For example:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;S1 arrives:   [1000, 1800)&#xA;S3 arrives:   [1000, 1800)....hole....[1900, 2300)&#xA;S2 arrives:      [1700,                  2100)&#xA;Hole filled:  [1000, 1800)[1800, 1900)[1900, 2300)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="15865" LastActivityDate="2017-06-03T03:23:02.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41650" PostTypeId="1" AcceptedAnswerId="41652" CreationDate="2017-06-03T08:50:56.120" Score="0" ViewCount="48" Body="&lt;p&gt;I have 2 servers in Singapore and Canada. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both pass local speed tests of ~100mbit/sec, but when transferring files between them, speeds can be as low as 20&lt;strong&gt;kb&lt;/strong&gt;/sec.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Singapore server can still transfer with reasonable speed (~50mbit/sec) to e.g. Japan, and Japan in turn has similar speed to Canada.&#xA;So when building a &quot;chain&quot; of &quot;relay servers&quot; I can achieve pretty good speeds (even though I have to copy the files multiple times). Why is this the case? Why is a direct connection between Singapore and Canada slower?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So when building a &quot;chain solution&quot;, is there a way to calculate speeds professionally instead of guessing geographical points?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any common solutions to problems like this that I overlooked?&lt;/p&gt;&#xA;" OwnerUserId="31740" LastActivityDate="2017-06-03T09:56:29.147" Title="International download speed problems" Tags="|speed|topology|" AnswerCount="1" CommentCount="2" ClosedDate="2017-06-03T12:50:27.693" ContentLicense="CC BY-SA 3.0" />
  <row Id="41652" PostTypeId="2" ParentId="41650" CreationDate="2017-06-03T09:56:29.147" Score="0" Body="&lt;p&gt;The practical rule for latency calculation is ~0.3 ms for every 100km. In other words for the distance between Singapore and Canada (13 000 km straight line) the latency should be around 390ms. I assume it is little bit lower. You can measure it by using ping. The output will give you the RTT. Once you have that value you can use following calculator:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.switch.ch/network/tools/tcp_throughput/&quot; rel=&quot;nofollow noreferrer&quot;&gt;TCP CALCULATOR&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;So if we consider that you really have 100Mbit/s international traffic available and default TCP window size of 64kbyte you will get following as speed:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;BDP (100 Mbit/sec, 390.0 ms) = 4.88 MByte&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Required tcp buffer to reach 100 Mbps with RTT of 390.0 ms &amp;gt;= 4760.7 KByte&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Maximum throughput with a TCP window of 64 KByte and RTT of 390.0 ms &amp;lt;= 1.34 Mbit/sec.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;In order to increase the transfer speed you have to:&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;increase TCP window size ( ensure that window scaling is enabled)&lt;/li&gt;&#xA;&lt;li&gt;optimize buffers&lt;/li&gt;&#xA;&lt;li&gt;reduce packet loss and latency if possible ( by raising cases to your ISPs)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;If you really want to explore the topic for measuring optimizing TCP perfromance I'd recommend to read &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6349&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC-6349&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25563" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-06-03T09:56:29.147" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41653" PostTypeId="2" ParentId="41631" CreationDate="2017-06-03T10:45:22.807" Score="2" Body="&lt;p&gt;Try to increase privilege for the user by executing following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username Patrick privilege 15 password 7 0512091A2C595D1D0D0D1E1C000509393F31383A31 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Do you receive some error message when trying? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are you sure that you are using the correct username ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Note: &quot;patrick&quot; is listed in the config snipped, &quot;Patrick&quot; can be seen in the running config)&lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-06-03T10:45:22.807" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41655" PostTypeId="1" CreationDate="2017-06-03T18:51:23.473" Score="1" ViewCount="391" Body="&lt;p&gt;We are in VoIP business and running RTP/SIP traffic 80% in our network we have other servers also like www and monitoring and operation, our network is very flat and simple also we have very basic configuration on &lt;code&gt;L3&lt;/code&gt; switch and &lt;code&gt;L2&lt;/code&gt; switches, we are running couple of VLANs to separate traffic and everything running without &lt;code&gt;QoS&lt;/code&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now we are thinking to implement &lt;code&gt;QoS&lt;/code&gt; because it's very important for real time protocols but have no idea how and what is the best practice to implement and do we really need QoS, there are many un-answered question i have and don't know how to start and where to start to implement QoS, so looking for expert advice or suggestion to see what we can do to make it better. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Following is diagram of network to give you idea.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/6IRsk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6IRsk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17285" LastActivityDate="2018-03-01T16:05:18.370" Title="QoS implementation for VoIP network" Tags="|cisco|switch|router|qos|voip|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41656" PostTypeId="1" AcceptedAnswerId="41657" CreationDate="2017-06-03T18:59:02.193" Score="3" ViewCount="1197" Body="&lt;p&gt;I know what if you lower RTS threshold value too much, you can introduce more latency into the network, as Requests to Send are increased so much that the shared medium is reserved more often than necessary but what can I expect at 0 value ?&lt;/p&gt;&#xA;" OwnerUserId="37258" LastActivityDate="2017-06-03T20:31:10.617" Title="RTS threshold set to 0" Tags="|ad-hoc-wireless|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41657" PostTypeId="2" ParentId="41656" CreationDate="2017-06-03T19:11:39.983" Score="1" Body="&lt;p&gt;(Edited) Sorry. I meant the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you set the RTS value to 0 then the behavior is implementation based. Some vendors might have a &quot;disable RTS&quot; concept, and other might have &quot;always enable RTS&quot; concept. If you want to surely disable RTS, then set a very high value like 2500 or 3000. But I would recommend you do the following to set the right RTS threshold value:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Packet Size: If the packet size is large, then it makes sense since you would want to reserve the medium. Run a traffic profile test on your network to determine most of the packet sizes.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Network density: If you have or if you anticipate large number of clients on the network per Wi-Fi router (Access Point), then you can enable RTS/CTS mechanism to take care of hidden station issues.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="14135" LastEditorUserId="14135" LastEditDate="2017-06-03T20:31:10.617" LastActivityDate="2017-06-03T20:31:10.617" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41658" PostTypeId="2" ParentId="16638" CreationDate="2017-06-03T21:18:50.933" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Does ARP work over L2TP and the destination is the MAC address of the device on the other side of the tunnel? Or does it use the MAC address of the router as the destination of its frame?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It depends on l2tp setup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it use BCP (Bridge Control Protocol) PPP extension, then l2tp works like Ethernet (forward L2 frames), so your first assumption is right.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If it plain l2tp (which forward L3 packets only) it forwarded by routes or by combination of routes and arp manipulation (Arp Proxy or some other), then your second assumption is right.&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2017-06-03T21:18:50.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41659" PostTypeId="2" ParentId="35168" CreationDate="2017-06-03T21:38:41.757" Score="1" Body="&lt;p&gt;If You don't have public IPv4 on the server and can't get IPv6 from ISP, then You can get IPv6 for Your LAN from IPv6 tunnel broker (search any working)&lt;/p&gt;&#xA;" OwnerUserId="7539" LastActivityDate="2017-06-03T21:38:41.757" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41660" PostTypeId="1" AcceptedAnswerId="41662" CreationDate="2017-06-03T23:58:10.043" Score="2" ViewCount="4198" Body="&lt;p&gt;I've a strange problem with a pair of Nexus 3048 Switches in a vPC configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since the core are still under implementation we've hit an strange issue: clients can't get IP addresses from the DHCP server, but the SVI can get an address from the DHCP server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The DHCP server is plugged on another switch, but the connection is made on one interface on the first Nexus and the interface have this configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet1/23&#xA;  description &quot;Untag 37 directly from 3COM 4200G&quot;&#xA;  switchport access vlan 37&#xA;  spanning-tree port type edge&#xA;  spanning-tree bpdufilter enable&#xA;  no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There's no Layer 3 routing happening inside the Nexus. It's plain Layer 2 networking, which should work without any hassle.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The curious thing is that the SVI can get the IP address from the DHCP server. The same SVI on the second Nexus cant't get the address either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've done the following tests to debug the problem:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Created a vPC with both switches and tried DHCP from a Port Channel enabled host.&lt;/li&gt;&#xA;&lt;li&gt;Plugged a host on orphaned port on first on the first Nexus and then on the second one.&lt;/li&gt;&#xA;&lt;li&gt;Changed the port from trunk to access, like the configuration above.&lt;/li&gt;&#xA;&lt;li&gt;Used a different DHCP server on the port.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In all cases DHCP still does not work. But there's connectivity, because I can set manual IP addresses in all cases, and everything works as it should. Orphaned ports, trunked ports, port channels, etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it's definitely something on the switch dropping the DHCP packets. There's no DHCP features enabled on Nexus, só it can't be any security problem:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;core1# sh feature | grep -i dhcp &#xA;dhcp                   1         disabled&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I even used tried &lt;code&gt;tcpdump&lt;/code&gt; on client machines to see if the DHCP packages are sent and I can confirm they are being sent. On the switches I tried some debugging with &lt;code&gt;ethanalyzer&lt;/code&gt; and what I see is a lot of &quot;DHCP Discover&quot; requests without any answer. Only the SVI DHCP request of the first switch appears to be working. Here is a snippet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2017-06-03 23:38:49.617523      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x9697d613&#xA;2017-06-03 23:39:05.254997      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x9697d613&#xA;2017-06-03 23:39:17.119522      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x9697d613&#xA;2017-06-03 23:39:24.317940      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x9697d613&#xA;2017-06-03 23:39:35.687699      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x9697d613&#xA;2017-06-03 23:40:02.900892      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0xd7c4ba70&#xA;2017-06-03 23:40:10.946648      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0xd7c4ba70&#xA;2017-06-03 23:40:21.071947      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0xd7c4ba70&#xA;2017-06-03 23:40:35.114446      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0xd7c4ba70&#xA;2017-06-03 23:40:49.380103      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0xd7c4ba70&#xA;2017-06-03 23:44:05.282352 146.164.37.11 -&amp;gt; 146.164.36.50 DHCP DHCP Request  - Transaction ID 0x592f3e7a&#xA;2017-06-03 23:44:05.283041 146.164.36.50 -&amp;gt; 146.164.37.11 DHCP DHCP ACK      - Transaction ID 0x592f3e7a&#xA;2017-06-03 23:46:03.509158      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x75bda403&#xA;2017-06-03 23:46:11.942522      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x75bda403&#xA;2017-06-03 23:46:26.965735      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x75bda403&#xA;2017-06-03 23:46:38.008869      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x75bda403&#xA;2017-06-03 23:46:45.221171      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x75bda403&#xA;2017-06-03 23:46:57.352744      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x75bda403&#xA;2017-06-03 23:47:09.395484      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x13487f09&#xA;2017-06-03 23:47:16.159521      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x13487f09&#xA;2017-06-03 23:47:32.450281      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x13487f09&#xA;2017-06-03 23:47:40.803963      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x13487f09&#xA;2017-06-03 23:48:00.665313      0.0.0.0 -&amp;gt; 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x13487f09&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The report was generated with this command: &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ethanalyzer local interface inband capture-filter &quot;port 67 or port 68&quot; limit-captured-frames 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is really frustrating, since DHCP is dead simple and it should work without any hassle. The DHCP server in question is the isc-dhcpd-server running on Debian 7 Wheezy and it's on production, serving a lot of different subnets, so it's working as it should.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I'm missing? There's something that should be enabled on Nexus? Perhaps some kind of default ACL's blocking the DHCP traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To be more precise here's a drawing of the topology:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;+-------------+      +-------------+      +-----------+&#xA;| DHCP Server | ---&amp;gt; | 3COM Switch | ---&amp;gt; | Nexus #01 | &amp;lt;--- Random Host&#xA;+-------------+      +-------------+      +-----------+&#xA;                                               || &#xA;                                          +-----------+&#xA;                                          | Nexus #02 | &amp;lt;--- Random Host&#xA;                                          +-----------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The DHCP Server have the following network configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IP: 146.164.36.50/24&#xA;GW: 146.164.36.36&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the 3COM switch there are rules for DHCP relaying from different subnets, configured in the following way:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#&#xA; dhcp-server 1 ip  146.164.36.50  &#xA; dhcp-server detect&#xA;&#xA;vlan 1&#xA; description Management&#xA; igmp-snooping enable&#xA;#&#xA;vlan 10&#xA; description Servers&#xA;#&#xA;vlan 37&#xA;#&#xA;vlan 100&#xA; description Acesso&#xA;#&#xA;interface Vlan-interface1&#xA; ip address 10.3.12.1 255.255.255.0 &#xA; dhcp-server 1&#xA;#&#xA;interface Vlan-interface10&#xA; ip address 146.164.36.36 255.255.255.0  &#xA;#&#xA;interface Vlan-interface37&#xA; ip address 146.164.37.1 255.255.255.0 &#xA; dhcp-server 1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Everything is working on the DHCP relay side, since anything connected to the Vlan-interface 37 works as expected, doesn't matter if it's a random host of a switch with others hosts attached. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;And finally here is the full Nexus #01 configuration. The second one have similar configuration.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;core1# sh run&#xA;&#xA;!Command: show running-config&#xA;!Time: Sun Jun  4 00:05:49 2017&#xA;&#xA;version 7.0(3)I2(2d)&#xA;hostname core1&#xA;vdc core1 id 1&#xA;  limit-resource vlan minimum 16 maximum 4094&#xA;  limit-resource vrf minimum 2 maximum 4096&#xA;  limit-resource port-channel minimum 0 maximum 104&#xA;  limit-resource u4route-mem minimum 128 maximum 128&#xA;  limit-resource u6route-mem minimum 96 maximum 96&#xA;  limit-resource m4route-mem minimum 58 maximum 58&#xA;  limit-resource m6route-mem minimum 8 maximum 8&#xA;&#xA;cfs eth distribute&#xA;feature interface-vlan&#xA;feature lacp&#xA;feature vpc&#xA;feature lldp&#xA;feature vtp&#xA;&#xA;username admin password 5 !  role network-admin&#xA;username ferrao password 5 !  role network-admin&#xA;username ferrao sshkey ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDM+cCPmszkpw0DMeOYLSWoGAHd4POhfQJ5llIu6uJ2CX0VNSzRDGIr01fMQKvjTcsqX2EoF2xpO8nj8XZoSNUetwC+G&#xA;J3dBWKxFnZ+AFCzT4pTOWDmGKr0k75r7sU2yqlkgAuVryWB/Y5e8QIyVcaVyrbUGqDQBIA6f9lqF3pYivzTU1XLiz5sQNv/7DSvHVBA9MiFycs4PMhqh89YzW+QU2H4v3zWVTXd/FyXr3Pp3wvkWu1NY&#xA;GviIx3LMg9S3mydk2i5MUddoOPPfHQKtrOiBpXApZwegRGOHVqvkEfn6GLNkCXBT151vRRVKGeUbiZyg0RLUnuE61UbpCUvEXtWxH2EHUiYDWzFhZVPvE451meyYdr0mFEGFaW97mnjGNmYle9sx5UmW&#xA;5r3f/KJHdOzDgAGWwPN9H9AdbXSLtycovJGhglJ8nLouTz3CZPFnsAvOrHx/svJnLTJU1LJDJanFVqMgTpnXDcjW/8fCyVgyZcPHjQnY+VyUM/4zYPceEA+ghKgBJMyBQ0RC+SxdiC9wrYK/urw/GxNj&#xA;VY6upfpmzsfetIK07OTuucaohHTg5Oo3gIJhQ8Vgi4souxs0+rrskhW4ztxw1VI3UXiUGotmAh6VWFyoIuG4a+Z8fPi3PZ3NyC90Byalmz5lp1SXBjcTeYwUvpCQGKxdkhISl+Bjw==&#xA;username heliocm password 5 !  role network-admin&#xA;username heliocm sshkey rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDTtokq0PacXStKYhfZy8KMIkCugdzCAkc7fDtK+PCjscrqL41otfV/WjOXg3qftJUswx1Ggt5qvbSGx452fLwAxGoXWsJn&#xA;ohwbPwwkqRG1kpVyxYt3xIgw2EkJsbrm8T4PuajfqPBJFgZU3opMH1msRmQN+WrRyZhvZPf6wE4Ahx4nrzxo6Tmgzf6v9xUZQ1RlAMODzUfaM054nKh/fJz+A9L281Ra6vHmYuLoDNzR4MQxCVPiZfUA&#xA;gwIWLcVStdWhQ3a5i/bzbNyp3+5MgtO0BC0Q5kSZD3SGkuM8vsQTn+l6Zqi2nqOX7bfdrrqIQa8XAidyoQOsthKTI21SQGO6XUI8sSPCwuNKGrbHDLqX0+0xVdUsDupZ9lPX9T737YIvefksFHVX9lgZ&#xA;YcfxG3LRyDV6vqaDRZRq8bOmFO/nMConXxUbIJ/lJqKiR/x9yS7wV3Ja+l6v5ObOV9g9/vKP1tde1uyoJ8Wd08HtENAibEAExPhJhc12O0fpi7ZbrjEoJj6n7kHdRHcGvtpXysN3n7MkVR+xSxxZFAYX&#xA;AHyp/yfR6y5QSVJvH4efnSLRRtZN3X2R0mJhT2icQpmueVaxCHi4gCSGnCZIP8IrLdy0JxR9UFMt0B92n3aVjTJ1he2nKOmXPbUntFMT1kkunWTFPK85hPLDp5G+4IZaIv5bww==&#xA;ssh login-attempts 5&#xA;&#xA;ssh key rsa 2048 &#xA;no ip domain-lookup&#xA;ip domain-name cc.if.ufrj.br&#xA;ip name-server 146.164.36.15&#xA;spanning-tree mode mst&#xA;system default switchport shutdown&#xA;no service unsupported-transceiver&#xA;ip access-list copp-system-acl-eigrp&#xA;  10 permit eigrp any 224.0.0.10/32 &#xA;ipv6 access-list copp-system-acl-eigrp6&#xA;  10 permit eigrp any ff02::a/128 &#xA;ip access-list copp-system-acl-icmp&#xA;  10 permit icmp any any &#xA;ip access-list copp-system-acl-igmp&#xA;  10 permit igmp any any &#xA;ip access-list copp-system-acl-ntp&#xA;  10 permit udp any any eq ntp &#xA;  20 permit udp any eq ntp any &#xA;ip access-list copp-system-acl-pimreg&#xA;  10 permit pim any any &#xA;ip access-list copp-system-acl-ping&#xA;  10 permit icmp any any echo &#xA;  20 permit icmp any any echo-reply &#xA;ip access-list copp-system-acl-routingproto1&#xA;  10 permit tcp any gt 1024 any eq bgp &#xA;  20 permit tcp any eq bgp any gt 1024 &#xA;  30 permit udp any 224.0.0.0/24 eq rip &#xA;  40 permit tcp any gt 1024 any eq 639 &#xA;  50 permit tcp any eq 639 any gt 1024 &#xA;  70 permit ospf any any &#xA;  80 permit ospf any 224.0.0.5/32 &#xA;  90 permit ospf any 224.0.0.6/32 &#xA;ip access-list copp-system-acl-routingproto2&#xA;  10 permit udp any 224.0.0.0/24 eq 1985 &#xA;  20 permit 112 any 224.0.0.0/24 &#xA;ip access-list copp-system-acl-snmp&#xA;  10 permit udp any any eq snmp &#xA;  20 permit udp any any eq snmptrap &#xA;ip access-list copp-system-acl-ssh&#xA;  10 permit tcp any any eq 22 &#xA;  20 permit tcp any eq 22 any &#xA;ip access-list copp-system-acl-stftp&#xA;  10 permit udp any any eq tftp &#xA;  20 permit udp any any eq 1758 &#xA;  30 permit udp any eq tftp any &#xA;  40 permit udp any eq 1758 any &#xA;  50 permit tcp any any eq 115 &#xA;  60 permit tcp any eq 115 any &#xA;ip access-list copp-system-acl-tacacsradius&#xA;  10 permit tcp any any eq tacacs &#xA;  20 permit tcp any eq tacacs any &#xA;  30 permit udp any any eq 1812 &#xA;  40 permit udp any any eq 1813 &#xA;  50 permit udp any any eq 1645 &#xA;  60 permit udp any any eq 1646 &#xA;  70 permit udp any eq 1812 any &#xA;  80 permit udp any eq 1813 any &#xA;  90 permit udp any eq 1645 any &#xA;  100 permit udp any eq 1646 any &#xA;ip access-list copp-system-acl-telnet&#xA;  10 permit tcp any any eq telnet &#xA;  20 permit tcp any any eq 107 &#xA;  30 permit tcp any eq telnet any &#xA;  40 permit tcp any eq 107 any &#xA;ipv6 access-list copp-system-acl-v6routingProto2&#xA;  10 permit udp any ff02::66/128 eq 2029 &#xA;  20 permit udp any ff02::fb/128 eq 5353 &#xA;  30 permit 112 any ff02::12/128 &#xA;ipv6 access-list copp-system-acl-v6routingproto1&#xA;  10 permit 89 any ff02::5/128 &#xA;  20 permit 89 any ff02::6/128 &#xA;  30 permit udp any ff02::9/128 eq 521 &#xA;ip access-list copp-system-dhcp-relay&#xA;  10 permit udp any eq bootps any eq bootps &#xA;class-map type qos match-all iscsi&#xA;  match cos 4&#xA;policy-map type qos iscsi&#xA;  class iscsi&#xA;    set qos-group 4&#xA;  class class-default&#xA;class-map type network-qos iscsi&#xA;  match qos-group 4&#xA;policy-map type network-qos iscsi&#xA;  class type network-qos iscsi&#xA;    mtu 1500&#xA;    pause no-drop&#xA;  class type network-qos class-default&#xA;    mtu 1500&#xA;policy-map type network-qos jumbo&#xA;  class type network-qos class-default&#xA;    mtu 9216&#xA;system qos&#xA;  service-policy type network-qos iscsi&#xA;class-map type control-plane match-any copp-icmp&#xA;  match access-group name copp-system-acl-icmp&#xA;class-map type control-plane match-any copp-ntp&#xA;  match access-group name copp-system-acl-ntp&#xA;class-map type control-plane match-any copp-s-arp&#xA;class-map type control-plane match-any copp-s-bfd&#xA;class-map type control-plane match-any copp-s-bpdu&#xA;class-map type control-plane match-any copp-s-dai&#xA;class-map type control-plane match-any copp-s-default&#xA;class-map type control-plane match-any copp-s-dhcpreq&#xA;class-map type control-plane match-any copp-s-dhcpresp&#xA;  match access-group name copp-system-dhcp-relay&#xA;class-map type control-plane match-any copp-s-dpss&#xA;class-map type control-plane match-any copp-s-eigrp&#xA;  match access-group name copp-system-acl-eigrp&#xA;  match access-group name copp-system-acl-eigrp6&#xA;class-map type control-plane match-any copp-s-glean&#xA;class-map type control-plane match-any copp-s-igmp&#xA;  match access-group name copp-system-acl-igmp&#xA;class-map type control-plane match-any copp-s-ipmcmiss&#xA;class-map type control-plane match-any copp-s-l2switched&#xA;class-map type control-plane match-any copp-s-l3destmiss&#xA;class-map type control-plane match-any copp-s-l3mtufail&#xA;class-map type control-plane match-any copp-s-l3slowpath&#xA;class-map type control-plane match-any copp-s-mpls&#xA;class-map type control-plane match-any copp-s-pimautorp&#xA;class-map type control-plane match-any copp-s-pimreg&#xA;  match access-group name copp-system-acl-pimreg&#xA;class-map type control-plane match-any copp-s-ping&#xA;  match access-group name copp-system-acl-ping&#xA;class-map type control-plane match-any copp-s-ptp&#xA;class-map type control-plane match-any copp-s-routingProto1&#xA;  match access-group name copp-system-acl-routingproto1&#xA;  match access-group name copp-system-acl-v6routingproto1&#xA;class-map type control-plane match-any copp-s-routingProto2&#xA;  match access-group name copp-system-acl-routingproto2&#xA;class-map type control-plane match-any copp-s-selfIp&#xA;class-map type control-plane match-any copp-s-ttl1&#xA;class-map type control-plane match-any copp-s-v6routingProto2&#xA;  match access-group name copp-system-acl-v6routingProto2&#xA;class-map type control-plane match-any copp-s-vxlan&#xA;class-map type control-plane match-any copp-snmp&#xA;  match access-group name copp-system-acl-snmp&#xA;class-map type control-plane match-any copp-ssh&#xA;  match access-group name copp-system-acl-ssh&#xA;class-map type control-plane match-any copp-stftp&#xA;  match access-group name copp-system-acl-stftp&#xA;class-map type control-plane match-any copp-tacacsradius&#xA;  match access-group name copp-system-acl-tacacsradius&#xA;class-map type control-plane match-any copp-telnet&#xA;  match access-group name copp-system-acl-telnet&#xA;policy-map type control-plane copp-system-policy &#xA;  class copp-s-default&#xA;    police pps 400 &#xA;  class copp-s-l2switched&#xA;    police pps 200 &#xA;  class copp-s-ping&#xA;    police pps 100 &#xA;  class copp-s-l3destmiss&#xA;    police pps 100 &#xA;  class copp-s-glean&#xA;    police pps 500 &#xA;  class copp-s-selfIp&#xA;    police pps 500 &#xA;  class copp-s-l3mtufail&#xA;    police pps 100 &#xA;  class copp-s-ttl1&#xA;    police pps 100 &#xA;  class copp-s-ipmcmiss&#xA;    police pps 400 &#xA;  class copp-s-l3slowpath&#xA;    police pps 100 &#xA;  class copp-s-dhcpreq&#xA;    police pps 300 &#xA;  class copp-s-dhcpresp&#xA;    police pps 300 &#xA;  class copp-s-dai&#xA;    police pps 300 &#xA;  class copp-s-igmp&#xA;    police pps 400 &#xA;  class copp-s-eigrp&#xA;    police pps 200 &#xA;  class copp-s-pimreg&#xA;    police pps 200 &#xA;  class copp-s-pimautorp&#xA;    police pps 200 &#xA;  class copp-s-routingProto2&#xA;    police pps 1300 &#xA;  class copp-s-v6routingProto2&#xA;    police pps 1300 &#xA;  class copp-s-routingProto1&#xA;    police pps 1000 &#xA;  class copp-s-arp&#xA;    police pps 200 &#xA;  class copp-s-ptp&#xA;    police pps 1000 &#xA;  class copp-s-vxlan&#xA;    police pps 1000 &#xA;  class copp-s-bfd&#xA;    police pps 350 &#xA;  class copp-s-bpdu&#xA;    police pps 12000 &#xA;  class copp-s-dpss&#xA;    police pps 1000 &#xA;  class copp-s-mpls&#xA;    police pps 100 &#xA;  class copp-icmp&#xA;    police pps 200 &#xA;  class copp-telnet&#xA;    police pps 500 &#xA;  class copp-ssh&#xA;    police pps 500 &#xA;  class copp-snmp&#xA;    police pps 500 &#xA;  class copp-ntp&#xA;    police pps 100 &#xA;  class copp-tacacsradius&#xA;    police pps 400 &#xA;  class copp-stftp&#xA;    police pps 400 &#xA;control-plane&#xA;  service-policy input copp-system-policy &#xA;vtp domain cc.if.ufrj.br&#xA;snmp-server contact &quot;Vinicius Ferrao &amp;lt;ferrao@cc.if.ufrj.br&amp;gt;&quot;&#xA;snmp-server location &quot;Computacao Central IF/UFRJ - CT/A-312&quot;&#xA;snmp-server user admin network-admin auth md5 0x4f0d470b1ab6ab111b4b82962ec368f0 priv 0x4f0d470b1ab6ab111b4b82962ec368f0 localizedkey&#xA;snmp-server user ferrao network-admin auth md5 0xeab88c5301991d27d34983cf480d49ef priv 0xeab88c5301991d27d34983cf480d49ef localizedkey&#xA;rmon event 1 log trap public description FATAL(1) owner PMON@FATAL&#xA;rmon event 2 log trap public description CRITICAL(2) owner PMON@CRITICAL&#xA;rmon event 3 log trap public description ERROR(3) owner PMON@ERROR&#xA;rmon event 4 log trap public description WARNING(4) owner PMON@WARNING&#xA;rmon event 5 log trap public description INFORMATION(5) owner PMON@INFO&#xA;ntp server 146.164.48.5 use-vrf management&#xA;&#xA;vlan 1&#xA;vlan 7&#xA;  name MGMT-IQ&#xA;vlan 11&#xA;  name iSCSI-MPIO1&#xA;vlan 12&#xA;  name iSCSI-MPIO2&#xA;vlan 29&#xA;  name SRV-IQ&#xA;vlan 30&#xA;  name Labs-IQ&#xA;vlan 36&#xA;  name SRV-IF&#xA;vlan 37&#xA;  name Unused37&#xA;vlan 40&#xA;  name Unused40&#xA;vlan 136&#xA;  name Access-IF&#xA;vlan 146&#xA;  name SRV-CC&#xA;vlan 172&#xA;  name Access-IQ&#xA;vlan 312&#xA;  name MGMT-IF&#xA;vlan 666&#xA;  name LIG&#xA;spanning-tree port type edge bpduguard default&#xA;spanning-tree mst 0-1 priority 24576&#xA;spanning-tree mst configuration&#xA;  name cc&#xA;  revision 1&#xA;  instance 1 vlan 2-4094&#xA;vrf context management&#xA;  ip route 0.0.0.0/0 146.164.36.1&#xA;vrf context vpc-peer-keepalive&#xA;no system urpf disable&#xA;no port-channel load-balance resilient&#xA;&#xA;vpc domain 1&#xA;  peer-switch&#xA;  role priority 1&#xA;  system-priority 1000&#xA;  peer-keepalive destination 172.31.2.2 source 172.31.2.1 vrf vpc-peer-keepalive&#xA;  auto-recovery&#xA;  ipv6 nd synchronize&#xA;  ip arp synchronize&#xA;&#xA;&#xA;interface Vlan1&#xA;&#xA;interface Vlan37&#xA;  no shutdown&#xA;  ip address dhcp&#xA;&#xA;interface Vlan136&#xA;&#xA;interface port-channel25&#xA;  description XenServer #1&#xA;  switchport mode trunk&#xA;  switchport trunk native vlan 37&#xA;  switchport trunk allowed vlan 29,36-37,40,136,146,312&#xA;  spanning-tree port type edge trunk&#xA;  vpc 25&#xA;&#xA;interface port-channel27&#xA;  description XenServer #2&#xA;  switchport mode trunk&#xA;  switchport trunk native vlan 37&#xA;  switchport trunk allowed vlan 29,36-37,40,136,146,312&#xA;  spanning-tree port type edge trunk&#xA;  vpc 27&#xA;&#xA;interface port-channel29&#xA;  description XenServer #3&#xA;  switchport mode trunk&#xA;  switchport trunk native vlan 37&#xA;  switchport trunk allowed vlan 29,36-37,40,136,146,312&#xA;  spanning-tree port type edge trunk&#xA;  vpc 29&#xA;&#xA;interface port-channel31&#xA;  description XenServer #4&#xA;  switchport mode trunk&#xA;  switchport trunk native vlan 37&#xA;  switchport trunk allowed vlan 29,36-37,40,136,146,312&#xA;  spanning-tree port type edge trunk&#xA;  vpc 31&#xA;&#xA;interface port-channel33&#xA;  description XenServer #5&#xA;  switchport mode trunk&#xA;  switchport trunk native vlan 37&#xA;  switchport trunk allowed vlan 29,36-37,40,136,146,312&#xA;  spanning-tree port type edge trunk&#xA;  vpc 33&#xA;&#xA;interface port-channel47&#xA;  description vPC Peer-link Keepalive&#xA;  no switchport&#xA;  vrf member vpc-peer-keepalive&#xA;  ip address 172.31.2.1/30&#xA;&#xA;interface port-channel51&#xA;  description vPC Peer-link&#xA;  switchport mode trunk&#xA;  spanning-tree port type network&#xA;  speed 10000&#xA;  vpc peer-link&#xA;&#xA;interface Ethernet1/1&#xA;&#xA;interface Ethernet1/2&#xA;&#xA;interface Ethernet1/3&#xA;&#xA;interface Ethernet1/4&#xA;&#xA;interface Ethernet1/5&#xA;&#xA;interface Ethernet1/6&#xA;&#xA;interface Ethernet1/7&#xA;&#xA;interface Ethernet1/8&#xA;&#xA;interface Ethernet1/9&#xA;&#xA;interface Ethernet1/10&#xA;&#xA;interface Ethernet1/11&#xA;&#xA;interface Ethernet1/12&#xA;&#xA;interface Ethernet1/13&#xA;&#xA;interface Ethernet1/14&#xA;&#xA;interface Ethernet1/15&#xA;&#xA;interface Ethernet1/16&#xA;&#xA;interface Ethernet1/17&#xA;&#xA;interface Ethernet1/18&#xA;&#xA;interface Ethernet1/19&#xA;&#xA;interface Ethernet1/20&#xA;&#xA;interface Ethernet1/21&#xA;&#xA;interface Ethernet1/22&#xA;  description &quot;Teste DHCP&quot;&#xA;  switchport access vlan 37&#xA;  spanning-tree port type edge&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/23&#xA;  description &quot;Untag 37 direto 3COM&quot;&#xA;  switchport access vlan 37&#xA;  spanning-tree port type edge&#xA;  spanning-tree bpdufilter enable&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/24&#xA;  description Uplink Temporario IF&#xA;  switchport mode trunk&#xA;  switchport trunk allowed vlan 36,136,312&#xA;  spanning-tree port type edge trunk&#xA;  spanning-tree bpdufilter enable&#xA;&#xA;interface Ethernet1/25&#xA;  description XenServer #1 Interface #1&#xA;  switchport mode trunk&#xA;  switchport trunk native vlan 37&#xA;  switchport trunk allowed vlan 29,36-37,40,136,146,312&#xA;  channel-group 25 mode active&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/26&#xA;  description XenServer iSCSI #1 Interface #1&#xA;  switchport access vlan 11&#xA;  spanning-tree port type edge&#xA;  service-policy type qos input iscsi&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/27&#xA;  description XenServer #2 Interface #1&#xA;  switchport mode trunk&#xA;  switchport trunk native vlan 37&#xA;  switchport trunk allowed vlan 29,36-37,40,136,146,312&#xA;  channel-group 27 mode active&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/28&#xA;  description XenServer iSCSI #2 Interface #1&#xA;  switchport access vlan 11&#xA;  spanning-tree port type edge&#xA;  service-policy type qos input iscsi&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/29&#xA;  description XenServer #3 Interface #1&#xA;  switchport mode trunk&#xA;  switchport trunk native vlan 37&#xA;  switchport trunk allowed vlan 29,36-37,40,136,146,312&#xA;  channel-group 29 mode active&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/30&#xA;  description XenServer iSCSI #3 Interface #1&#xA;  switchport access vlan 11&#xA;  spanning-tree port type edge&#xA;  service-policy type qos input iscsi&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/31&#xA;  description XenServer #4 Interface #1&#xA;  switchport mode trunk&#xA;  switchport trunk native vlan 37&#xA;  switchport trunk allowed vlan 29,36-37,40,136,146,312&#xA;  channel-group 31 mode active&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/32&#xA;  description XenServer iSCSI #4 Interface #1&#xA;  switchport access vlan 11&#xA;  spanning-tree port type edge&#xA;  service-policy type qos input iscsi&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/33&#xA;  description XenServer #5 Interface #1&#xA;  switchport mode trunk&#xA;  switchport trunk native vlan 37&#xA;  switchport trunk allowed vlan 29,36-37,40,136,146,312&#xA;  channel-group 33 mode active&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/34&#xA;  description XenServer iSCSI #5 Interface #1&#xA;  switchport access vlan 11&#xA;  spanning-tree port type edge&#xA;  service-policy type qos input iscsi&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/35&#xA;&#xA;interface Ethernet1/36&#xA;&#xA;interface Ethernet1/37&#xA;&#xA;interface Ethernet1/38&#xA;&#xA;interface Ethernet1/39&#xA;&#xA;interface Ethernet1/40&#xA;&#xA;interface Ethernet1/41&#xA;&#xA;interface Ethernet1/42&#xA;&#xA;interface Ethernet1/43&#xA;&#xA;interface Ethernet1/44&#xA;&#xA;interface Ethernet1/45&#xA;&#xA;interface Ethernet1/46&#xA;&#xA;interface Ethernet1/47&#xA;  description vPC Peer-link Keepalive Interface #1&#xA;  no switchport&#xA;  channel-group 47&#xA;&#xA;interface Ethernet1/48&#xA;  description vPC Peer-link Keepalive Interface #2&#xA;  no switchport&#xA;  channel-group 47&#xA;&#xA;interface Ethernet1/49&#xA;&#xA;interface Ethernet1/50&#xA;  description Storage iSCSI Interface #1&#xA;  switchport access vlan 11&#xA;  spanning-tree port type edge&#xA;  service-policy type qos input iscsi&#xA;&#xA;interface Ethernet1/51&#xA;  description vPC Peer-link Interface #1&#xA;  switchport mode trunk&#xA;  channel-group 51 mode active&#xA;  no shutdown&#xA;&#xA;interface Ethernet1/52&#xA;  description vPC Peer-link Interface #2&#xA;  switchport mode trunk&#xA;  channel-group 51 mode active&#xA;  no shutdown&#xA;&#xA;interface mgmt0&#xA;  vrf member management&#xA;  ip address 146.164.36.89/24&#xA;line console&#xA;line vty&#xA;boot nxos bootflash:/nxos.7.0.3.I2.2d.bin &#xA;ip route 0.0.0.0/0 146.164.37.1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="10528" LastEditorUserId="10528" LastEditDate="2017-06-04T00:27:27.440" LastActivityDate="2023-06-19T06:43:34.097" Title="DHCP not working on clients connected to Nexus 3048 but works on SVI" Tags="|vlan|dhcp|cisco-nexus|nx-os|" AnswerCount="2" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="41662" PostTypeId="2" ParentId="41660" CreationDate="2017-06-04T04:04:27.787" Score="4" Body="&lt;p&gt;I have figured out. After four working days wasted, it was a bug on the NX-OS firmware 7.0(3)I2(2d).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After upgrading to the latest recommended version 7.0(3)I4(6) the DHCP packets started flowing normally.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the link to the Cisco website: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/release/70346/n3k_70346_nxos_rn.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus3000/sw/release/70346/n3k_70346_nxos_rn.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="10528" LastActivityDate="2017-06-04T04:04:27.787" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41663" PostTypeId="1" AcceptedAnswerId="41669" CreationDate="2017-06-04T07:48:50.183" Score="7" ViewCount="2328" Body="&lt;p&gt;I am trying to do some networking lab. Basically, I have a network like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ymnmn.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ymnmn.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, is it possible to configure NAT router in such way, that PC1 and PC2 can access remote HOST and each other. The problem for me is that PC1 and PC2 have same local ip addresses.&lt;/p&gt;&#xA;" OwnerUserId="37269" LastEditorUserId="8499" LastEditDate="2018-11-17T20:28:03.117" LastActivityDate="2018-11-17T20:28:03.117" Title="NAT Overlapping" Tags="|cisco|routing|ip|ipv4|nat|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41664" PostTypeId="2" ParentId="41655" CreationDate="2017-06-04T08:20:12.293" Score="1" Body="&lt;p&gt;QOS is something you will configure to treat some traffic (VOIP traffic) with priority better than other (WWW, monitoring ...), even call signaling can be treated with less priority than the VOIP payload itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;implementation could be divided in two parts,&lt;/p&gt;&#xA;&#xA;&lt;p&gt;internally: between phones inside same network, which in your case is not needed at all, I can figure out it is 1G end nodes with 10G uplinks which is more than enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;externally: in case of multi-site implementation where the VOIP traffic will traverse WAN connection with other normal data traffic. in this case you need to configure QOS as per a lot of recommendations and calculations (number of concurrent calls, the Codx you use in this calls). Also need to be mentioned that,  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;QOS in this case will be configured on the last place this VOIP&#xA;  traffic will leave in your network toward the other site, the WAN&#xA;  router for example.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2017-06-04T08:20:12.293" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41666" PostTypeId="2" ParentId="41663" CreationDate="2017-06-04T10:47:17.067" Score="4" Body="&lt;p&gt;You'd need what with Lancom is called N:N NAT: translate both subnets to each other, so that one thinks it's talking to 192.168.11.0/24, the other to 192.168.12.0/24 (or any other unique range).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's not easy to set up and can be a major pain to debug, so if there's any chance I'd rather change the subnet address on one side and route them without NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there's no easy way to change a subnet, maybe you can get away with adding another, unambiguous subnet on top on each side, so that each PC has two IP addresses, one of which can be routed from the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Changed or at least additional unique addresses would also solved the problem with the single NAT router: you assign the default gateway only to the unique address binding, then you can NAT to WAN without problem. Alternatively, you'd need at least one additional NAT router before the central one.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-04T10:55:49.617" LastActivityDate="2017-06-04T10:55:49.617" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41668" PostTypeId="1" AcceptedAnswerId="41670" CreationDate="2017-06-04T12:22:55.917" Score="1" ViewCount="850" Body="&lt;p&gt;When a interface takes an IPv6 address it does the DAD mechanism. A NS will be sent to the multicast address &quot;solicited node multicast group address&quot;. If there is another interface in this multicast group it won't take this address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The number of different solicited node multicast addresses is in my opinion &lt;code&gt;(2^48)-1&lt;/code&gt;. So the max addresses of one subnet is &lt;code&gt;(2^48)-1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this correct?&lt;/p&gt;&#xA;" OwnerUserId="37080" LastEditorUserId="8499" LastEditDate="2018-03-12T00:33:34.613" LastActivityDate="2018-03-12T00:33:34.613" Title="Max hosts of subnet IPv6" Tags="|ip|subnet|ipv6|protocol-theory|multicast|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41669" PostTypeId="2" ParentId="41663" CreationDate="2017-06-04T12:32:26.817" Score="4" Body="&lt;p&gt;The scenario you have is one faced by companies that merge, but they have the same private network addressing. Since you have tagged your question with the Cisco tag, you should use the Cisco solution, which is &lt;strong&gt;outside source&lt;/strong&gt; NAT. Cisco has some documents that describe how to use outside source NAT, including &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/network-address-translation-nat/13770-1.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;Sample Configuration Using the ip nat outside source list Command&lt;/em&gt;&lt;/a&gt;. I have highlighted below what the introduction says about overlapping networks:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;This document provides a sample configuration with the &lt;strong&gt;ip nat&#xA;  outside source list&lt;/strong&gt; command, and includes a brief description of&#xA;  what happens to the IP packet during the NAT process. You can use this&#xA;  command to translate the source address of the IP packets that travel&#xA;  from outside of the network to inside the network. This action&#xA;  translates the destination address of the IP packets that travel in&#xA;  the opposite direction—from inside to outside of the network. &lt;strong&gt;&lt;em&gt;This&#xA;  command is useful in situations such as overlapping networks, where&#xA;  the inside network addresses overlap addresses that are outside the&#xA;  network.&lt;/em&gt;&lt;/strong&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-06-04T12:32:26.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41670" PostTypeId="2" ParentId="41668" CreationDate="2017-06-04T12:58:42.250" Score="2" Body="&lt;p&gt;According to &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 4861, Neighbor Discovery for IP version 6 (IPv6)&lt;/em&gt;&lt;/a&gt;, The Neighbor Solicitation message for Duplicate Address Detection is sent to the target address, not the solicited node multicast address. It is a reply in the case of a conflict that is multicast:&lt;/p&gt;&#xA;&lt;blockquote&gt;&#xA;&lt;p&gt;Neighbor Solicitation and Advertisement messages are also used for&#xA;Duplicate Address Detection as specified by [&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4861#ref-ADDRCONF&quot; rel=&quot;nofollow noreferrer&quot;&gt;ADDRCONF&lt;/a&gt;]. In&#xA;particular, Duplicate Address Detection sends Neighbor Solicitation&#xA;messages with an unspecified source address targeting its own&#xA;&amp;quot;tentative&amp;quot; address. Such messages trigger nodes already using the&#xA;address to respond with a multicast Neighbor Advertisement indicating&#xA;that the address is in use.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&lt;p&gt;In theory, the number of host addresses on a standard IPv6 &lt;code&gt;/64&lt;/code&gt; network is &lt;code&gt;2^64&lt;/code&gt; (&lt;code&gt;18,446,744,073,709,551,616&lt;/code&gt;). In practice, a LAN will break with even a small fraction of that many hosts, but that has to do with the LAN topology and protocol, not IPv6.&lt;/p&gt;&#xA;&lt;p&gt;Some LAN protocols use 48-bit MAC addresses, so the theoretical maximum number of hosts on the LAN is &lt;code&gt;2^48&lt;/code&gt; (&lt;code&gt;281,474,976,710,656&lt;/code&gt;) hosts, but many of those MAC addresses cannot be used. Some LAN protocols use 64-bit MAC addresses, allowing for a theoretical maximum that matches the IPv6 theoretical maximum, but again, many of the 64-bit MAC addresses cannot be used. Some LAN protocols use other addressing, or no addressing at all.&lt;/p&gt;&#xA;&lt;p&gt;Actually, if you look at how solicited node multicast addresses are created, they use the last &lt;code&gt;24&lt;/code&gt; bits of the target unicast address, so there are &lt;code&gt;2^24&lt;/code&gt; possible solicited node addresses. I'm not sure where you came up with &lt;code&gt;2^48&lt;/code&gt;, nor why you want to subtract one from that number. The idea of the solicited node address is not that it is unique, in fact the idea is that it is not unique because it is desirable that all addresses on a host interface resolve to the same solicited node multicast address, but you want to cut down the number of hosts that are interrupted. A broadcast will interrupt every host on a LAN, but the solicited node multicast address will interrupt far fewer hosts, possibly only the single target host.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-06-04T13:27:05.803" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41672" PostTypeId="1" AcceptedAnswerId="41727" CreationDate="2017-06-04T21:28:20.937" Score="-1" ViewCount="1235" Body="&lt;p&gt;I mounted a ring network with ospf with the topology that follows. What is happening is that I disconnect an interface (Fa5/0  R1) to verify redundancy and the two routers (R1 and R4) involved lose the OSPF instance completely. I realize this by checking the routing table and finding that it is empty..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following log is displayed.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;% LINK-5-CHANGED: FastEthernet5 / 0 interface, changed state to down&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;% LINEPROTO-5-UPDOWN: Line protocol on FastEthernet5 / 0 interface,&#xA;  changed state to down&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;: OSPF-5-ADJCHG: Process 1, Nbr 10.99.99.1 on FastEthernet5 / 0 from&#xA;  FULL to DOWN, Neighbor Down: Interface down or detached&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Topology&#xA;&lt;a href=&quot;https://i.stack.imgur.com/GqDaD.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GqDaD.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and as following configs in my routers (R1, R2, R3 and R4)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 1260 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;no ip cef&#xA;no ipv6 cef&#xA;!&#xA;[...]&#xA;!&#xA;interface Loopback0&#xA;ip address 10.99.99.1 255.255.255.255&#xA;!&#xA;interface FastEthernet0/0&#xA;no ip address&#xA;duplex auto&#xA;speed auto&#xA;shutdown&#xA;!&#xA;interface FastEthernet1/0&#xA;no ip address&#xA;duplex auto&#xA;speed auto&#xA;shutdown&#xA;!&#xA;interface Serial2/0&#xA;ip address 2.0.1.2 255.255.255.252&#xA;!&#xA;interface Serial3/0&#xA;no ip address&#xA;clock rate 2000000&#xA;shutdown&#xA;!&#xA;interface FastEthernet4/0&#xA;ip address 1.0.0.1 255.255.255.252&#xA;!&#xA;interface FastEthernet5/0&#xA;ip address 1.0.0.14 255.255.255.252&#xA;!&#xA;!&#xA;router ospf 1&#xA;router-id 10.99.99.1&#xA;log-adjacency-changes&#xA;redistribute static subnets &#xA;passive-interface Loopback0&#xA;network 1.0.0.0 0.0.0.3 area 0&#xA;network 10.99.99.1 0.0.0.0 area 0&#xA;network 1.0.0.12 0.0.0.3 area 0&#xA;default-information originate&#xA;!&#xA;router bgp 100&#xA;bgp log-neighbor-changes&#xA;no synchronization&#xA;neighbor 2.0.1.1 remote-as 200&#xA;network 1.0.0.0&#xA;!&#xA;ip classless&#xA;ip route 1.0.0.0 255.0.0.0 Loopback0 &#xA;ip route 0.0.0.0 0.0.0.0 Loopback0 &#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;access-list 1 permit any&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA;login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R4:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Current configuration : 995 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname R4&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;[...]&#xA;!&#xA;interface Loopback0&#xA; ip address 10.99.99.4 255.255.255.255&#xA;!&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial2/0&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Serial3/0&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface FastEthernet4/0&#xA;ip address 1.0.0.10 255.255.255.252&#xA;! &#xA;interface FastEthernet5/0&#xA;ip address 1.0.0.13 255.255.255.252&#xA;!&#xA;router ospf 1&#xA; router-id 10.99.99.4&#xA; log-adjacency-changes&#xA; passive-interface Loopback0&#xA; network 10.99.99.4 0.0.0.0 area 0&#xA; network 1.0.0.12 0.0.0.3 area 0&#xA; network 1.0.0.8 0.0.0.3 area 0&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 Router Table&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     1.0.0.0/8 is variably subnetted, 5 subnets, 2 masks&#xA;S       1.0.0.0/8 is directly connected, Loopback0&#xA;C       1.0.0.0/30 is directly connected, FastEthernet4/0&#xA;O       1.0.0.4/30 [110/2] via 1.0.0.2, 00:00:00, FastEthernet4/0&#xA;O       1.0.0.8/30 [110/2] via 1.0.0.13, 00:03:08, FastEthernet5/0&#xA;C       1.0.0.12/30 is directly connected, FastEthernet5/0&#xA;     2.0.0.0/8 is variably subnetted, 2 subnets, 2 masks&#xA;B       2.0.0.0/24 [20/0] via 2.0.1.1, 15:23:41&#xA;C       2.0.1.0/30 is directly connected, Serial2/0&#xA;     10.0.0.0/32 is subnetted, 4 subnets&#xA;C       10.99.99.1 is directly connected, Loopback0&#xA;O       10.99.99.2 [110/2] via 1.0.0.2, 00:00:00, FastEthernet4/0&#xA;O       10.99.99.3 [110/3] via 1.0.0.2, 00:00:00, FastEthernet4/0&#xA;                   [110/3] via 1.0.0.13, 00:00:00, FastEthernet5/0&#xA;O       10.99.99.4 [110/2] via 1.0.0.13, 00:03:55, FastEthernet5/0&#xA;S*   0.0.0.0/0 is directly connected, Loopback0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R4 Router Table&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;     1.0.0.0/8 is variably subnetted, 5 subnets, 2 masks&#xA;O E2    1.0.0.0/8 [110/20] via 1.0.0.14, 00:07:42, FastEthernet5/0&#xA;O       1.0.0.0/30 [110/2] via 1.0.0.14, 00:03:46, FastEthernet5/0&#xA;O       1.0.0.4/30 [110/2] via 1.0.0.9, 00:03:46, FastEthernet4/0&#xA;C       1.0.0.8/30 is directly connected, FastEthernet4/0&#xA;C       1.0.0.12/30 is directly connected, FastEthernet5/0&#xA;     10.0.0.0/32 is subnetted, 4 subnets&#xA;O       10.99.99.1 [110/2] via 1.0.0.14, 00:07:42, FastEthernet5/0&#xA;O       10.99.99.2 [110/3] via 1.0.0.14, 00:03:46, FastEthernet5/0&#xA;                   [110/3] via 1.0.0.9, 00:03:46, FastEthernet4/0&#xA;O       10.99.99.3 [110/2] via 1.0.0.9, 00:06:55, FastEthernet4/0&#xA;C       10.99.99.4 is directly connected, Loopback0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 Database&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;           OSPF Router with ID (10.99.99.1) (Process ID 1)&#xA;&#xA;               Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;10.99.99.4      10.99.99.4      267         0x8000003d 0x0067df 3&#xA;10.99.99.1      10.99.99.1      81          0x8000004f 0x001835 3&#xA;10.99.99.2      10.99.99.2      78          0x80000057 0x00cf83 3&#xA;10.99.99.3      10.99.99.3      78          0x8000003e 0x009fb8 3&#xA;&#xA;                Net Link States (Area 0)&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;1.0.0.13        10.99.99.4      317         0x8000004c 0x0024cc&#xA;1.0.0.10        10.99.99.4      267         0x8000004b 0x004ea4&#xA;1.0.0.1         10.99.99.1      81          0x80000001 0x004308&#xA;1.0.0.6         10.99.99.3      78          0x80000027 0x00e633&#xA;&#xA;                Summary ASB Link States (Area 0)&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;10.99.99.1      10.99.99.1      1318        0x8000001d 0x009509&#xA;&#xA;                Type-5 AS External Link States&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;1.0.0.0         10.99.99.1      1317        0x80000024 0x004387 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R4 Database&#xA;                OSPF Router with ID (10.99.99.4) (Process ID 1)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                Router Link States (Area 0)&#xA;&#xA;Link ID         ADV Router      Age         Seq#       Checksum Link count&#xA;10.99.99.4      10.99.99.4      494         0x8000003d 0x0067df 3&#xA;10.99.99.1      10.99.99.1      308         0x8000004f 0x001835 3&#xA;10.99.99.2      10.99.99.2      305         0x80000057 0x00cf83 3&#xA;10.99.99.3      10.99.99.3      305         0x8000003e 0x009fb8 3&#xA;&#xA;                Net Link States (Area 0)&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;1.0.0.13        10.99.99.4      544         0x8000004c 0x0024cc&#xA;1.0.0.10        10.99.99.4      494         0x8000004b 0x004ea4&#xA;1.0.0.1         10.99.99.1      308         0x80000001 0x004308&#xA;1.0.0.6         10.99.99.3      305         0x80000027 0x00e633&#xA;&#xA;                Summary ASB Link States (Area 0)&#xA;Link ID         ADV Router      Age         Seq#       Checksum&#xA;10.99.99.1      10.99.99.1      1545        0x8000001d 0x009509&#xA;&#xA;                Type-5 AS External Link States&#xA;Link ID         ADV Router      Age         Seq#       Checksum Tag&#xA;1.0.0.0         10.99.99.1      1544        0x80000024 0x004387 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R1 OSPF Interfaces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Loopback0 is up, line protocol is up&#xA;  Internet address is 10.99.99.1/32, Area 0&#xA;  Process ID 1, Router ID 10.99.99.1, Network Type LOOPBACK, Cost: 1&#xA;  Loopback interface is treated as a stub Host&#xA;FastEthernet4/0 is up, line protocol is up&#xA;  Internet address is 1.0.0.1/30, Area 0&#xA;  Process ID 1, Router ID 10.99.99.1, Network Type BROADCAST, Cost: 1&#xA;  Transmit Delay is 1 sec, State DR, Priority 1&#xA;  Designated Router (ID) 10.99.99.1, Interface address 1.0.0.1&#xA;  Backup Designated Router (ID) 10.99.99.2, Interface address 1.0.0.2&#xA;  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5&#xA;    Hello due in 00:00:00&#xA;  Index 2/2, flood queue length 0&#xA;  Next 0x0(0)/0x0(0)&#xA;  Last flood scan length is 1, maximum is 1&#xA;  Last flood scan time is 0 msec, maximum is 0 msec&#xA;  Neighbor Count is 1, Adjacent neighbor count is 1&#xA;    Adjacent with neighbor 10.99.99.2  (Backup Designated Router)&#xA;  Suppress hello for 0 neighbor(s)&#xA;FastEthernet5/0 is up, line protocol is up&#xA;  Internet address is 1.0.0.14/30, Area 0&#xA;  Process ID 1, Router ID 10.99.99.1, Network Type BROADCAST, Cost: 1&#xA;  Transmit Delay is 1 sec, State BDR, Priority 1&#xA;  Designated Router (ID) 10.99.99.4, Interface address 1.0.0.13&#xA;  Backup Designated Router (ID) 10.99.99.1, Interface address 1.0.0.14&#xA;  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5&#xA;    Hello due in 00:00:08&#xA;  Index 3/3, flood queue length 0&#xA;  Next 0x0(0)/0x0(0)&#xA;  Last flood scan length is 1, maximum is 1&#xA;  Last flood scan time is 0 msec, maximum is 0 msec&#xA;  Neighbor Count is 1, Adjacent neighbor count is 1&#xA;    Adjacent with neighbor 10.99.99.4  (Designated Router)&#xA;  Suppress hello for 0 neighbor(s)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;R4 OSPF Interfaces&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Loopback0 is up, line protocol is up&#xA;  Internet address is 10.99.99.4/32, Area 0&#xA;  Process ID 1, Router ID 10.99.99.4, Network Type LOOPBACK, Cost: 1&#xA;  Loopback interface is treated as a stub Host&#xA;FastEthernet5/0 is up, line protocol is up&#xA;  Internet address is 1.0.0.13/30, Area 0&#xA;  Process ID 1, Router ID 10.99.99.4, Network Type BROADCAST, Cost: 1&#xA;  Transmit Delay is 1 sec, State DR, Priority 1&#xA;  Designated Router (ID) 10.99.99.4, Interface address 1.0.0.13&#xA;  Backup Designated Router (ID) 10.99.99.1, Interface address 1.0.0.14&#xA;  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5&#xA;    Hello due in 00:00:00&#xA;  Index 2/2, flood queue length 0&#xA;  Next 0x0(0)/0x0(0)&#xA;  Last flood scan length is 1, maximum is 1&#xA;  Last flood scan time is 0 msec, maximum is 0 msec&#xA;  Neighbor Count is 1, Adjacent neighbor count is 1&#xA;    Adjacent with neighbor 10.99.99.1  (Backup Designated Router)&#xA;  Suppress hello for 0 neighbor(s)&#xA;FastEthernet4/0 is up, line protocol is up&#xA;  Internet address is 1.0.0.10/30, Area 0&#xA;  Process ID 1, Router ID 10.99.99.4, Network Type BROADCAST, Cost: 1&#xA;  Transmit Delay is 1 sec, State DR, Priority 1&#xA;  Designated Router (ID) 10.99.99.4, Interface address 1.0.0.10&#xA;  Backup Designated Router (ID) 10.99.99.3, Interface address 1.0.0.9&#xA;  Timer intervals configured, Hello 10, Dead 40, Wait 40, Retransmit 5&#xA;    Hello due in 00:00:05&#xA;  Index 3/3, flood queue length 0&#xA;  Next 0x0(0)/0x0(0)&#xA;  Last flood scan length is 1, maximum is 1&#xA;  Last flood scan time is 0 msec, maximum is 0 msec&#xA;  Neighbor Count is 1, Adjacent neighbor count is 1&#xA;    Adjacent with neighbor 10.99.99.3  (Backup Designated Router)&#xA;  Suppress hello for 0 neighbor(s)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37276" LastEditorUserId="8499" LastEditDate="2019-01-04T20:16:55.837" LastActivityDate="2019-01-04T20:16:55.837" Title="All OSPF routes lost when interface fails" Tags="|cisco|routing|ospf|packet-tracer|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41678" PostTypeId="1" AcceptedAnswerId="41722" CreationDate="2017-06-05T09:33:53.413" Score="2" ViewCount="3688" Body="&lt;p&gt;I am testing the actual speed of transferring a file from a network share.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Over my 1 Gigabit Ethernet I get about 120 MB/s - that's 96% of the theoretical maximum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Over my old Wireless G I get about 2.5 MB/s - that's only 37% of the theoretical maximum of 54 Mbit/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Over my new Wireless AC I get about 30 MB/s - that's only 28% of the theoretical maximum of 866 Mbit/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The client and server machines are the same in each case. They have huge amount of CPU power and a nice array of M.2 NVMe SSDs, so the hardware should not be an issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In both cases the high-level protocols are the same, so the protocol overhead should be the same (except the physical layer). SMB -&gt; TCP -&gt; IP -&gt; PHY.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For the wireless case the client and server are put about 1 m apart, in line of sight and in a rural area with no or little traffic over 2.4 and 5 GHz.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why all my wireless connections are so far away from the theoretical maximum compared to Ethernet?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(Using ASUS RT-AC88U for the Wireless AC test).&lt;/p&gt;&#xA;" OwnerUserId="37290" LastActivityDate="2017-07-30T07:07:25.923" Title="Why such a large discrepancy between theoretical and real Wifi speeds?" Tags="|ethernet|ieee-802.11|performance|" AnswerCount="3" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41681" PostTypeId="2" ParentId="41678" CreationDate="2017-06-05T12:07:33.807" Score="5" Body="&lt;p&gt;The &quot;theoretical maximum&quot; you refer to is the PHY clock rate.  That has little to do with throughput, as you have discovered.  A better question is why Wi-Fi is slower than Ethernet.  There are a couple of important differences that affect the throughput:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;802.11 is half-duplex, while switched Ethernet is full duplex.  That means stations can simultaneously transmit and receive on Ethernet, but on 802.11, a station has to stop transmitting in order to receive.  So after a station transmits, it has to stop transmitting and switch to receive in order to hear acknowledgements.  That slows things down.&lt;/li&gt;&#xA;&lt;li&gt;Unlike Ethernet which is CSMA/CD, 802.11 is CSMA/CA.  The collision avoidance mechanism (RTS/CTS) is more &quot;chatty,&quot; and creates more overhead than Ethernet. Even in a &quot;quiet&quot; environment as you describe, CSMA/CA is trying to avoid collisions, and that takes up bandwidth.  In contrast,  full-duplex Ethernet should never have collisions.&lt;/li&gt;&#xA;&lt;li&gt;For 802.11AC, the number of spatial streams depends on both the AP and the client hardware.  You can only go as fast as the slowest component.  You don't mention what kind of client you're using,  So your AP may be 4x4, but your client may be 2x2.&lt;/li&gt;&#xA;&lt;li&gt;Finally, although you say you're in a quiet environment, 1 meter apart, it would be worthwhile to verify your connection speed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-06-05T12:07:33.807" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41682" PostTypeId="2" ParentId="9535" CreationDate="2017-06-05T14:49:08.063" Score="2" Body="&lt;p&gt;Just for people looking at this answer now (close to 3 years after the original answers): today you can get QSFP+ &lt;strong&gt;P&lt;/strong&gt;LR4 transceivers that support 4x10G breakout over SMF (long range).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These transceivers work by using 4 transmitters on the same wavelength but on different fibers.&lt;/p&gt;&#xA;" OwnerUserId="37296" LastEditorUserId="8499" LastEditDate="2017-06-05T14:54:25.933" LastActivityDate="2017-06-05T14:54:25.933" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41683" PostTypeId="2" ParentId="41672" CreationDate="2017-06-05T14:53:14.850" Score="5" Body="&lt;p&gt;The message you got is perfectly normal. That is not OSPF crashing, but it is telling you that the neighbor is no longer there. The interface is down, so OSPF cannot communicate with that neighbor. When an interface is down, the network attached to it no longer exists for OSPF, and it cannot exchange hellos with any neighbor through that interface.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-06-05T14:53:14.850" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="41684" PostTypeId="1" AcceptedAnswerId="41712" CreationDate="2017-06-05T15:36:47.553" Score="1" ViewCount="526" Body="&lt;p&gt;I am working in wireshark and analyzing the traffic generated by a PC during web browsing. What filter should I use to know how many HTTP servers are contacted?&lt;br&gt;&#xA;I mean, can I just filter the tcp.dstport==80 (or 443)?&lt;br&gt;&#xA;Or should I filter the TCP SYN or http.request.method == GET?&#xA;I have different results with those filters which one should I use?&lt;/p&gt;&#xA;" OwnerUserId="35719" LastEditorUserId="8499" LastEditDate="2018-02-16T03:50:42.123" LastActivityDate="2018-02-16T03:50:42.123" Title="How many HTTP servers are contacted?" Tags="|tcp|wireshark|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41687" PostTypeId="2" ParentId="32123" CreationDate="2017-06-05T18:26:40.920" Score="3" Body="&lt;p&gt;Make sure the module is recognized by the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issue:  &lt;strong&gt;show inventory&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Stack1#sh inv&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAME: &lt;strong&gt;&quot;Switch 1 FRU Uplink Module 1&quot;, DESCR: &quot;2x1G 2x10G Uplink Module&quot;&lt;/strong&gt;&#xA;PID: C3850-NM-2-10G    , VID: V01  , SN: XXX&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NAME: &quot;Te2/1/1&quot;, DESCR: &quot;SFP-10GBase-SR&quot;&#xA;PID: SFP-10G-SR         , VID: V03  , SN: XXX&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If the Uplink module is not recognized, contact your sales rep.&#xA;By the way, yours may vary slightly. The second named item is the GBIC.&lt;/p&gt;&#xA;" OwnerUserId="35830" LastActivityDate="2017-06-05T18:26:40.920" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41689" PostTypeId="1" AcceptedAnswerId="43271" CreationDate="2017-06-05T19:47:14.307" Score="1" ViewCount="6179" Body="&lt;p&gt;I am not sure this is possible, but I'd like to route traffic over an MPLS network using BGP to different locations, but use the same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have an east coast and west coast location.  Each of these locations has a VPN connection to a common 3rd party location via VPN.  The subnet of this 3rd party is 10.5.5.0/24.  We have a number of locations throughout the United States all connected through an MPLS network.  I would like those locations to use either the east or west coast VPN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How could I route some traffic to 10.5.5.0/24 in one location and some to the other?  I read it might be possible using different AS numbers and one would need to coordinate this with the MPLS provider, but really not sure.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any ideas?  If you need more detail please let me know.  I am not a network engineer by trade and really just hack my way through this stuff.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="37302" LastActivityDate="2019-07-19T17:53:57.647" Title="Same subnet, two locations, BGP. Can it be done?" Tags="|routing|bgp|subnet|mpls|" AnswerCount="5" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41690" PostTypeId="2" ParentId="41678" CreationDate="2017-06-05T19:51:19.447" Score="2" Body="&lt;p&gt;The theoretical maximum data rate is subject to several conditions. 802.11 employs several MCS (Modulation and Coding Scheme) indices, that determine the data rate depending on the SNR. This is why you get lower data rates when you're further away from the router (or interference).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let us assume that you do have excellent SNR in the given scenario. Even if the highest MCS index were used, an important point to note is that throughput is not the same as the data rate. The maximum data rate is measured after considering that -&lt;/p&gt;&#xA;&#xA;&lt;p&gt;1/ All spatial streams are employed (Maximum of 8 in 802.11ac). This would happen only in an environment that supports a lot of scattering/diffraction of waves. In your case, for a point-to-point link, I think you obtain just 1 effective stream (The MIMO matrix would be rank-deficient). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;2/ Channel is robust to errors (Not much interference or thermal noise)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;3/ All transmit/receive queues are maximum but not overflowing (application rate is equal to transmit rate)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;4/ The TCP MSS matches the underlying MTU (2304 bytes for 802.11)  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are only some important factors, apart from several others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A comparison between 802.3 and 802.11 is not really fair since CSMA/CA suffers from several hindrances (collisions, delays, requirement of periodic ACK, contention) but helps to provide wireless access. &lt;/p&gt;&#xA;" OwnerUserId="35917" LastActivityDate="2017-06-05T19:51:19.447" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41691" PostTypeId="1" CreationDate="2017-06-05T20:35:39.943" Score="3" ViewCount="180" Body="&lt;p&gt;I am reading the following line from a book:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reasons that modems are so slow is that telephones were invented for carrying the human voice and the entire system has been carefully optimized for this purpose. Data have always been stepchildren. At the point where each analog signal ( for example analog telephones ) from the end-user ends in the end office, the wire runs through a filter that attenuates all frequencies below 300 Hz and above 3400 Hz. This bandwidth although 3100 Hz is quoted as 4000 Hz.  - Computer Networks, Tannenbaum.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is if the frequencies below 300 Hz and above 3400 Hz is attenuated, then how can a voice signal transmit on the wire, because the audio signal has a bandwidth of 20 Hz to 20 Khz. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Maybe I do not understand, what is being filtered at the end office.&lt;/p&gt;&#xA;" OwnerUserId="35072" LastActivityDate="2017-06-05T21:23:11.783" Title="Working of a analog telephone - Basics" Tags="|telephony|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41692" PostTypeId="2" ParentId="41691" CreationDate="2017-06-05T21:23:11.783" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;the audio signal has a bandwidth of 20 Hz to 20 Khz. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Humans have a hearing range of somewhere around that, though it varies between individuals.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you don't need to pass anything like that range for intelligible speech. The important components of speech are contained in a relatively narrow band and limiting the bandwidth makes it much easier to control noise, interference and reflections in the network. Within the network a lower bandwidth means you can cram more phone calls down the same trunk.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-05T21:23:11.783" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41693" PostTypeId="2" ParentId="41689" CreationDate="2017-06-05T22:19:15.360" Score="0" Body="&lt;p&gt;MP BGP EVPN allow you to extend L2 over any IP network. It encapsulates L2 traffic inside UDP. Although I'm not sure how well it works with large geographic separation. But check it out nevertheless:&#xA;&lt;a href=&quot;https://www.juniper.net/documentation/en_US/junos/topics/concept/vxlan-evpn-integration-overview.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.juniper.net/documentation/en_US/junos/topics/concept/vxlan-evpn-integration-overview.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are also DCI specific technologies such as OTV, which encapsulates L2 inside MPLS inside GRE. This is however a proprietary technology from cisco:&#xA;&lt;a href=&quot;http://blog.ine.com/2010/02/15/what-is-overlay-transport-virtualization/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://blog.ine.com/2010/02/15/what-is-overlay-transport-virtualization/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="14056" LastActivityDate="2017-06-05T22:19:15.360" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41694" PostTypeId="2" ParentId="40140" CreationDate="2017-06-06T00:25:08.470" Score="1" Body="&lt;p&gt;2 VLANS are different broadcast domains&#xA;They are meant not be able to communicate with each other at layer 2.&#xA;To make devices in different VLANS communicate you need a layer 3 device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, to achieve this, you can use your switch 2 - as labelled in the figure attached.&#xA;you need to create 2 virtual interfaces. Assign IPs to those virtual interfaces.&#xA;Add routes on your device - either static or through some routing protocol.&#xA;And finally set the virtual inteface as the default gateway for the devices (PC's in the diagram).&#xA;Also the used VLANs should be allowed on the link.&#xA;That is either set a native VLAN or make the links as trunk.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively you can skip the switch all together and use the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These steps are not comprehensive, But a general idea of what has to be done.&#xA;Basic principle is you need layer 3 forwarding for inter vlan communication &lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-06-06T00:25:08.470" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41695" PostTypeId="2" ParentId="41689" CreationDate="2017-06-06T00:37:16.457" Score="0" Body="&lt;p&gt;Yes it can be done.&#xA;you can exchange routes using BGP.&#xA;Now these routes are present in your RIB.&#xA;For the FIB, it chooses routes based on the administrative distance:- static routes , connected , other routing protocols , etc.&#xA;if the route exchanged via BGP has the least AD, it will make its way in the forwarding table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However I doubt it as it is the same subnet, your device will have a route as 'connected' for the subnet. Connected has the least AD. You can still try to use BGP, and the see RI and FIB status.&lt;/p&gt;&#xA;" OwnerUserId="30735" LastEditorUserId="30735" LastEditDate="2017-06-06T19:01:50.070" LastActivityDate="2017-06-06T19:01:50.070" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41698" PostTypeId="1" AcceptedAnswerId="41700" CreationDate="2017-06-06T06:30:03.070" Score="2" ViewCount="1137" Body="&lt;p&gt;Do wireless networks employ &lt;strong&gt;&lt;em&gt;both&lt;/em&gt;&lt;/strong&gt; Carrier Sense Multiple Access and Orthogonal Frequency Division Multiplexing? If so, what are their corresponding roles? I'm not a professional and I am confused as to which of them makes P2MP communication possible. I always thought WLANs use CSMA to allow different nodes to communicate to the same access point on the same channel, but here I am reading about how every 802.11 standard uses OFDM as its &lt;strong&gt;access&lt;/strong&gt; technology (except 802.11b which uses DSSS instead), allowing multiple devices to communicate with the same AP at the same time. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this the right place for PHY-related questions?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; changed TDM to CSMA to be more accurate.&lt;/p&gt;&#xA;" OwnerUserId="37308" LastEditorUserId="37308" LastEditDate="2017-06-06T07:05:39.273" LastActivityDate="2017-06-06T23:42:28.080" Title="Purpose of CSMA and OFDM in WLANs" Tags="|wireless|ieee-802.11|lan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41700" PostTypeId="2" ParentId="41698" CreationDate="2017-06-06T07:32:36.367" Score="3" Body="&lt;p&gt;Finally found out that in Wifi, CSMA is the one used to allow &lt;strong&gt;Multiple Access&lt;/strong&gt;. To be exact, IEEE 802.11 releases use CSMA/CA (Collision Avoidance) instead of CSMA/CD (Collision Detection) which is used in wired networks. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;OFDM, on the other hand, is just an advanced digital &lt;strong&gt;modulation scheme&lt;/strong&gt; which divides the data stream being exchanged between the node and the AP to multiple individual streams of lower rate and transmits them on different, closely-spaced carrier frequencies simultaneously (multiplexing). Making the signal more robust against error--thus allowing higher data rates--is what OFDM does in a nutshell.&lt;/p&gt;&#xA;" OwnerUserId="37308" LastEditorUserId="37308" LastEditDate="2017-06-06T23:42:28.080" LastActivityDate="2017-06-06T23:42:28.080" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41701" PostTypeId="1" CreationDate="2017-06-06T07:40:50.500" Score="1" ViewCount="454" Body="&lt;p&gt;TL;DR - Why does an internet router in Spain not require a DSL filter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to set up an ADSL router in Spain.  After some trial and error (RTFM) I see that Spanish routers do not require a DSL filter between the wall socket and the device.  Only the telephones require a DSL filter: &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Dqcdz.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Dqcdz.gif&quot; alt=&quot;Diagram 1&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;AFAIK, in the United Kingdom, both the phone and router require a DSL filter (or one filter with both phone/router attached via it)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/LizL3.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/LizL3.png&quot; alt=&quot;Diagram 2&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Could anyone please enlighten me as to why this is?  I had assumed that ADSL was the same in all European countries.  I guess that the routers might have built-in filters, but am hoping for an authoritative answer that may also highlight any infrastructure differences.&lt;/p&gt;&#xA;" OwnerUserId="19942" LastEditorUserId="19942" LastEditDate="2017-06-06T08:09:17.080" LastActivityDate="2017-06-06T08:24:49.017" Title="Why does a Spanish internet modem/router not require a DSL filter?" Tags="|router|internet|adsl|" AnswerCount="1" CommentCount="1" ClosedDate="2017-06-06T12:58:52.950" ContentLicense="CC BY-SA 3.0" />
  <row Id="41702" PostTypeId="1" AcceptedAnswerId="41713" CreationDate="2017-06-06T07:52:04.787" Score="2" ViewCount="2742" Body="&lt;p&gt;Let me know if I am misunderstanding. To me, the loopback from a switch is different from the PC ones. &#xA;they are both attached to a virtual interface, but for the PC, only it can access it's loopback. For the switch, I've heard we can set a loopback address (W.X.Y.Z/32) and use it to configure the switch without any fear of loosing access to it misconfiguring something.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand how we can use this address to connect to the switch from somewhere else in the network. Isn't the switch the only one aware of this address ? if not, how is this address joinable?&lt;/p&gt;&#xA;" OwnerUserId="36106" LastActivityDate="2017-06-06T13:15:34.260" Title="loopback address on switch what is it's scop" Tags="|switch|loopback|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41703" PostTypeId="1" AcceptedAnswerId="45460" CreationDate="2017-06-06T08:00:22.907" Score="2" ViewCount="18170" Body="&lt;p&gt;I have a simple question - I am a novice to networking and trying to understand if there is a GUI way to configure the switch (default UI / SNMP, etc.). I do not have any advanced needs but to simply connect two switches in such a way that they create a flat network. The default config (I thought will work by connecting two switches with a simple cable) doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help will be appreciated. &lt;/p&gt;&#xA;" OwnerUserId="37309" LastActivityDate="2018-04-02T21:55:08.653" Title="GUI Configuration - HP Switch 5900" Tags="|switch|switching|hp|hp-procurve|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41704" PostTypeId="1" CreationDate="2017-06-06T08:05:54.587" Score="0" ViewCount="99" Body="&lt;p&gt;I have set up ADSL in a Spanish property that has a single pulse dial telephone.  A DSL splitter has been used, and both the telephone and ADSL work.  ADSL speed in this area is poor anyway, so its difficult to get a factual answer by experimentation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ADSL speeds in the property are simply awful, and connectivity to ADSL is also sporadic.  Having removed the phone and tested speeds without it, there doesn't appear to be a &lt;em&gt;massive&lt;/em&gt; difference, so this question is more a theoretical one.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Therefore, &lt;em&gt;could&lt;/em&gt; a pulse dial phone negatively affect ADSL connectivity/reliability?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to remove all potential issues before I approach the ISP, to avoid any engineer charges.&lt;/p&gt;&#xA;" OwnerUserId="19942" LastActivityDate="2017-06-06T08:29:14.990" Title="Would a pulse dial telephone affect ADSL reliability/speeds?" Tags="|adsl|telephony|" AnswerCount="1" CommentCount="1" ClosedDate="2017-06-06T12:59:51.383" ContentLicense="CC BY-SA 3.0" />
  <row Id="41705" PostTypeId="2" ParentId="41701" CreationDate="2017-06-06T08:24:49.017" Score="3" Body="&lt;p&gt;You only need to filter the connection to the telephone, the connection to the DSL router is not filtered.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The UK filter you show is just a splitter with a filter built in on the telephone side of the splitter. Whereas the Spanish one you have a splitter and a filter as two separate units.&lt;/p&gt;&#xA;" OwnerUserId="37310" LastActivityDate="2017-06-06T08:24:49.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41706" PostTypeId="2" ParentId="41704" CreationDate="2017-06-06T08:29:14.990" Score="1" Body="&lt;p&gt;I haven't tested it in years, but it should be ok. Telefonica's network supports tone dialing so just get a modern phone.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The best place to start is to log into the DSL router and look at the line statistics; then you can see your signal/noise levels on the line. From that you can determine what your likely speed will be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do remember Telefonica have a habit it of make really bad cable junctions. I spent months diagnosing an issue like this many years ago and it turned out to be nothing more than a bad cable junction some distance down the street.&lt;/p&gt;&#xA;" OwnerUserId="37310" LastActivityDate="2017-06-06T08:29:14.990" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="41708" PostTypeId="2" ParentId="41001" CreationDate="2017-06-06T10:58:09.350" Score="1" Body="&lt;p&gt;Network/provider tiers are about who pays for transit and who doesn't. Tier 1 networks are so large that they don't pay for transit with any peer (they get paid by the others). Tier 2 networks pay for transit with some carriers and nothing with others (they get paid by smaller carriers and customers). Tier 3 pay for transit in general (they get paid by their customers alone).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When it comes to routing, there's little you can derive from your provider's tier, as ar_ stated.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-06T10:58:09.350" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41711" PostTypeId="2" ParentId="41703" CreationDate="2017-06-06T12:34:35.387" Score="1" Body="&lt;p&gt;With only a single segment and a really 'flat' network there's no need to configure a switch, running a simple cable should be fine. If the links don't turn on, you might need a crossover cable, but the 5900 should support Auto MDI-X unless it's explicitly turned off.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-06T12:34:35.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41712" PostTypeId="2" ParentId="41684" CreationDate="2017-06-06T13:07:30.547" Score="2" Body="&lt;p&gt;There are several ways to accomplish this, depending on what your ultimate goal is.  If you simply want a list of server IP addresses, you can filter on your host address, then use the statistical tools in Wireshark.  For example, after you capture the data, choose &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Statistics/Endpoints&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;from the menu to see a list of hosts.  You can also use &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Statstics/Conversations&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Either one should give you what you're looking for.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-06-06T13:07:30.547" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41713" PostTypeId="2" ParentId="41702" CreationDate="2017-06-06T13:09:29.500" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;I've heard we can set a loopback address (W.X.Y.Z/32) and use it to configure the&#xA;  switch without any fear of loosing access to it misconfiguring&#xA;  something.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Layer 2 switch&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A &lt;code&gt;switch&lt;/code&gt; generally has a &lt;code&gt;management IP&lt;/code&gt; address, which is linked to a virtual interface that can be bridged to any vlan for example, so you can choose in which VLAN the switch management is accessible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is not necessarily  a loopback interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note : some layer 2 switches can have several management IP addresses in different VLAN while other can only be configured with a single management address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Layer 3 Switch / Routers&lt;/strong&gt;&lt;br&gt;&#xA;Now a &lt;code&gt;layer 3 switch&lt;/code&gt; combine the functions of a router and a switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A router, by nature, is attached to several networks, and has several IP addresses, one for each network it act as a router for (as a minimum).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say you have a router with:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;interface Ethernet1, IP : 192.168.1.254/24&lt;/li&gt;&#xA;&lt;li&gt;interface Ethernet2, IP : 192.168.2.254/24&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;To administer the router, you could use 192.168.1.254/24 and so you configure your management station(s), your firewall rules, your monitoring system, etc... with this address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If for whatever reason the interface Ethernet1 is down or unreachable, you loose your ability to administer the device, despite the fact that it is still reachable on the 192.168.2.254 address.&#xA;To avoid this you could allow management on both addresses. This is more hassle, not very convenient, and it does not scale well. What if your router has 20 interfaces?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, if you have a &lt;code&gt;loopback&lt;/code&gt; interface with IP 172.16.0.1/32 address, you use this address to manage the device.&lt;br&gt;&#xA;This interface is always up, and will be reachable by whichever physical interface is up (depending on your security rules of course), so if you loose any interface you can still manage your router.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Isn't the switch the only one aware of this address ? if not, how is&#xA;  this address joinable?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you don't configure anything else, yes actually only the router is aware of its loopback address.&#xA;You have indeed to inform other routers about this address.&#xA;You do so with the help of routing protocol, like &lt;code&gt;OSPF&lt;/code&gt;, &lt;code&gt;EIGRP&lt;/code&gt; or &lt;code&gt;iBGP&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The loopback address is announced to the other routers on several interfaces so the other routers always know how they can reach it.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-06-06T13:15:34.260" LastActivityDate="2017-06-06T13:15:34.260" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41714" PostTypeId="2" ParentId="30322" CreationDate="2017-06-06T13:43:11.107" Score="1" Body="&lt;p&gt;With a purely geometric approach (without calbration) and only signal strength as sensor, you require at least two and optimally four sensors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Geometrically, a single signal strength sensor tells you the distance, all potential points lying equidistant on a sphere. You can probably rule out many possibilities but probably several solutions remain.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a second sensor you get another sphere and when you intersect these two spheres the solution is a circle. While you can probably rule out most points, chances are that there are still possible points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With a third sensor and yet another sphere which you intersect with the circle from before you get two points remaining. If you can't rule out either you need a fourth sensor, with its sphere only intersecting one of the points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is an idealistic, purely mathematic approach. Depending on local conditions, a real-world approach can be simpler or more complicated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Triangulation is actually the opposite: you don't know the range but you know the direction. Each sensor tells you a direction or vector, two of which you intersect to get a single point in space.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-06T13:43:11.107" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41717" PostTypeId="2" ParentId="41001" CreationDate="2017-06-06T16:25:31.650" Score="1" Body="&lt;p&gt;The conventional defintition of the &quot;teirs&quot; is.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&quot;Tier 1&quot; does not buy any transit. Relies exclusively on settlement-free peering with all the other Tier 1 providers to obtain routes to the whole Internet.&lt;/li&gt;&#xA;&lt;li&gt;&quot;Tier 2&quot; uses a mixture of peering and transit connections.&lt;/li&gt;&#xA;&lt;li&gt;&quot;Tier 3&quot; relies entirely on transit connections.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;(note: not all ISPs may fit into these definitions precisely, for example an ISP may be transit-free but rely on paid peering or an ISP may be transit free and be unable to reach the whole Internet*)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In practice &quot;Tier 2&quot; covers a massive range of networks from networks that sit in one room to networks that span the globe. Smaller &quot;Tier 2&quot; ISPs can and do buy transit from larger &quot;Tier 2&quot; ISPs. Larger &quot;Tier 2&quot; ISPs can and do have restritive peering policies making it difficult for small ISPs to peer with them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now think about the financial motivations of an ISP.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Sending traffic downstream to a customer makes money.&lt;/li&gt;&#xA;&lt;li&gt;Sending traffic upstream to a provider costs money&lt;/li&gt;&#xA;&lt;li&gt;Sending traffic sideways to a peer also costs money but less money than sending it to a provider.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A large Tier 2 may deliver the vast majority of it's traffic over peering and customer connections using it's Tier 1 upstreams mostly as a &quot;route of last resort&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With all that in mind lets address your question.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If I'm connected to a Tier 3 ISP then does that mean whenever I access anything over the internet, the traffic has to go through a Tier 1 ISP&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;No, the tier 3 ISP may pass the traffic to one of it's own customers or it may pass it upstream to a tier 2 who manages to route it over a peering link or even route it to a customer. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;* See for example the HE/Cogent fiasco on IPv6.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-06T16:25:31.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41718" PostTypeId="2" ParentId="32447" CreationDate="2017-06-06T17:11:36.533" Score="1" Body="&lt;p&gt;NVR as in network video recorder? Do not connect it directly to the public IP network as most devices are insecure. The easy - and unsafe - method is to configure your router with port forwarding to pass requests to the private IP address of the NVR. This is unsafe, as all security issues of the device on that port could be exploited from the Internet and your network might be compromised that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The safe method to do this is to create VPN access to the network and secure access that way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to find your network, you'll need a static IP address or some kind of dynamic DNS service that gets updated when the IP address changes.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-06T17:11:36.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41719" PostTypeId="2" ParentId="36381" CreationDate="2017-06-06T18:12:58.343" Score="1" Body="&lt;p&gt;Roughly, an active 1000BASE-T port (in modern equipment) will consume approximately 100 mW more than one without link. Without Energy-Efficient Ethernet (EEE), this applies to all port that are linked, regardless of whether there's traffic or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With EEE, inactive ports can power down to ca. 5-10% of their active power, a usual average value is 50%.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With 10GBASE-T, the active port value is closer to 1 W, so potential savings of EEE are larger.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-06T18:12:58.343" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41720" PostTypeId="2" ParentId="36381" CreationDate="2017-06-06T18:19:03.553" Score="1" Body="&lt;p&gt;Ignoring any form of PoE, standard Ethernet does draw a certain amount of power for each port that is connected (in an up state) whether that port is transmitting or not. IIRC, you can count on about 100-300mW of power per port with link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to reduce the power consumption, you need to remove the connection or disable the port. However in many devices, these ports will still consume at least some power even then.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, newer devices are supporting 802.3az Energy Efficient Ethernet and/or &quot;Green Ethernet&quot; (non-standardized but reduces power usage in potentially several ways) can reduce the power usage of active Ethernet links by using one or more of several techniques like letting the transmitter &quot;sleep&quot; when there is no data to send, reducing power when shorter runs are detected or simply through more efficient electronic components.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2017-06-06T18:19:03.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41722" PostTypeId="2" ParentId="41678" CreationDate="2017-06-06T19:33:10.530" Score="6" Body="&lt;p&gt;While a rather straightforward question, the answer is quite a bit more convoluted. Simply because there are so many factors that can play into your actual throughput on wireless. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me start by clearing something up; namely that you use the terms &quot;theoretical&quot; and &quot;real&quot; WiFi speeds. By theoretical you are referring simply to the data rates a wireless environment is capable of transmitting. By real you are referring to end to end throughput between two client endpoints. These are not equal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While an 802.11 system may be using its maximum data rate to transmit data, often it is not, and most realistically, data is being transmitted at multiple different data rates during a data transfer. This will then have an impact on the actual throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then there is always some level of inefficiency in transmitting data, even if you simply consider the headers used as one point of inefficiency. As you noted, even a wired Ethernet connection cannot match its throughput to the data rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here are some (not all) of the factors that create the difference between the possible data rates of 802.11 and the throughput:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;802.11 is half-duplex. This means that only one device can talk at a time, even with one client device, this means there are two devices that must share the &quot;airtime&quot; (i.e. number of timeslots available to transmit) when trying to transmit.&lt;/li&gt;&#xA;&lt;li&gt;802.11 uses multiple different data rates to communicate, potentially all the way down to 1 Mbit/s. Too close or too far from the access point and the data rates used will likely drop. Same for if the environment is &quot;noisy&quot; with other communications in the same or nearby frequencies.&lt;/li&gt;&#xA;&lt;li&gt;802.11 requires that all data frames (or starting with 802.11n when supported, aggregates of multiple frames) to be acknowledged or the data will be retransmitted. These acks take up some of the &quot;airtime.&quot;&lt;/li&gt;&#xA;&lt;li&gt;802.11 utilizes a number of types of management frames. These management frames are often transmitted at much lower data rates than data frames so that all supported devices in the area can receive them. Examples of these would be beacons, probe requests and probe responses.&lt;/li&gt;&#xA;&lt;li&gt;Support for legacy 802.11 protocols can require the use of other types of management frames, such as RTS/CTS, to prevent conflicts between older devices that may not be able to understand that a newer device is transmitting.&lt;/li&gt;&#xA;&lt;li&gt;Support (or lack thereof) for optional 802.11 features that may be available to the client and/or infrastructure. Some of these will increase performance significantly if both support it.&lt;/li&gt;&#xA;&lt;li&gt;The number of other 802.11 networks operating on the same frequency (or overlapping frequencies). Just one other network in the same area can reduce your throughput by 50%.&lt;/li&gt;&#xA;&lt;li&gt;The number of SSID (i.e. wireless networks) being transmitted by your infrastructure. Each SSID will have its own management overhead, reducing the efficiency of the &quot;airtime.&quot;&lt;/li&gt;&#xA;&lt;li&gt;The more client devices associated to an access point, the smaller a share of the &quot;airtime&quot; they will get. Depending on the infrastructure in use, it can try to manage the use of the airtime in some way or leave it for random distribution.&lt;/li&gt;&#xA;&lt;li&gt;If there is no &quot;airtime fairness&quot; process used by the infrastructure, client devices with lower data rates will take up a disproportionate amount of airtime to transmit the same amounts of data as clients with higher data rates.&lt;/li&gt;&#xA;&lt;li&gt;Certain types of traffic (broadcast and multicast) cause data to either be transmitted at a lower data rate or possibly multiple times. There are a number of often running background applications on most client devices that send this type of traffic.&lt;/li&gt;&#xA;&lt;li&gt;More client devices in the area will reduce efficiency, irregardless of if they are associated or not. This is because most client devices will continue to send out probe requests and expect probe responses even when connected to an AP in an attempt to find a better connection point (i.e. roaming).&lt;/li&gt;&#xA;&lt;li&gt;Interference on the same frequency/frequencies can have a significant impact on performance. For 2.4 GHz, this includes many devices such as Bluetooth devices, wireless keyboards/mice, microwave ovens, tire pressure sensors in nearby vehicles, etc.&lt;/li&gt;&#xA;&lt;li&gt;Antenna orientation at the AP and/or client device can significantly impact the signal quality.&lt;/li&gt;&#xA;&lt;li&gt;Humidity in the air can absorb 802.11 signals reducing signal strength.&lt;/li&gt;&#xA;&lt;li&gt;Where your body is located in relation to the AP and client devices.&lt;/li&gt;&#xA;&lt;li&gt;How close the AP and/or client devices are to things that can cause reflections such as concrete walls. Being tucked into corners can be very bad for 802.11 devices.&lt;/li&gt;&#xA;&lt;li&gt;Driver quality of the client and/or infrastructure. This can have a significant impact on performance. One of several examples I have dealt with personally was one client vendor who had a driver issue for a while after 802.11n was ratified that caused their wireless devices to transmit thousands of unnecessary frames under certain conditions. This significantly impacted those client devices' performance until it was fixed by a later driver update.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I can go on, but hopefully you are starting to get the point. There are quite a few factors that can reduce either the 802.11 data rates that are used when two devices communicate or reduce the efficiency of the medium, either of which will reduce the actual throughput you will get between two endpoints.&lt;/p&gt;&#xA;" OwnerUserId="33" LastEditorUserId="38639" LastEditDate="2017-07-30T07:07:25.923" LastActivityDate="2017-07-30T07:07:25.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41723" PostTypeId="1" AcceptedAnswerId="41724" CreationDate="2017-06-06T19:48:55.703" Score="1" ViewCount="188" Body="&lt;p&gt;I have two Cisco 1941 routers connected to a PA-200 firewall. Each router has a couple of switches attached to it. I want to implement this network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/jttgb.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/jttgb.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have defined a list of 8 firewall zones:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Zone 1 BYOD:           10.1.0.0/16 &#xA;Zone 2 DMZ:            10.2.0.0/24&#xA;Zone 3 FrontOffice:    10.2.1.0/24&#xA;Zone 4 BackOffice:     10.2.2.0/24&#xA;....&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;On the PA Firewall, I want to define access policies between different zones. All traffic inside the network needs to go through firewall, so it can decide for example, if a client from VLAN/zone 1 can send/receive packets from/to VLAN/zone 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The routers need to be redundant, so that PC0 can get to the firewall, even if R1 fails. It should then take the path SW1-&gt;SW3-&gt;R2-&gt;FW.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I honestly don't know how to configure it completely, which is something I'm trying to figure out by asking this question. Actually, there's three things I'm confused about.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem 1:&lt;/strong&gt; How do I tell my cisco routers to forward all traffic to my firewall? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can only guess that this has something to do with setting up a virtual router with an ip address that can function as a default gateway that the clients can use. However, I'm not sure that's going to work, because the PC probably won't be able to see the firewall's mac address since it's behind a router... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem 2:&lt;/strong&gt; How to map my zones using only two physical interfaces (one for each router)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been told that I need a trunk link and 8 logical subinterfaces because I'm using a single cable (instead of 8, one for each VLAN/zone) between each router and the FW. How to configure this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I thought trunking was only possible on switches? Not between a router and a firewall? For example, in a router on a stick configuration, you would define a trunk port on the switch, by using &lt;code&gt;switchport mode trunk&lt;/code&gt;, and on a router you would use subinterfaces and tell them to which vlan they belong with the &lt;code&gt;encapsulation dot1q vlan&lt;/code&gt; command. This doesn't make the router port a trunking port, right?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem 3:&lt;/strong&gt; Do I need to use redundancy protocols like STP, or FHRP? Or is my network free from loops? &lt;/p&gt;&#xA;" OwnerUserId="13978" LastActivityDate="2017-06-06T20:46:25.437" Title="What protocols/configurations do I need, for implementing my firewall zone based network?" Tags="|firewall|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41724" PostTypeId="2" ParentId="41723" CreationDate="2017-06-06T20:46:25.437" Score="4" Body="&lt;p&gt;Problem 1: Routing all traffic is done by the default gateway route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem 2: Each zone requires its own VLAN to separate their traffic, each VLAN connects to the firewall where you set up rules to enable specific connections. Switch-to-switch and switch-to-router lines are set up as VLAN trunks to enable carrying traffic for all VLANs simultaneously. This is different from aggregation trunks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Problem 3: From your graph you don't need STP but if your network is larger and SW1 and SW3 act as core switches you could set up redundant links from each edge switch to both core switches - then you'd need STP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since FW1 needs to do all inter-VLAN routing you could omit both 1941 routers and connect the switches to the PA directly.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-06T20:46:25.437" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41725" PostTypeId="1" CreationDate="2017-06-06T22:38:03.013" Score="1" ViewCount="778" Body="&lt;p&gt;Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?&lt;/p&gt;&#xA;" OwnerUserId="37334" LastEditorUserId="8499" LastEditDate="2017-06-06T22:44:51.647" LastActivityDate="2017-06-07T01:41:24.520" Title="Is it possible to create an IPv4 packet header larger than 20 bytes on an IPv4 connection?" Tags="|ipv4|ip|wireshark|packet-analysis|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41726" PostTypeId="2" ParentId="41725" CreationDate="2017-06-06T22:42:59.607" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is it possible to generate an IPv4 packet with an IPv4 packet header larger than 20 bytes on an IPv4 connections?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, there are IPv4 options that may increase the packet header size. That is one of the things that IPv6 fixed. The maximum IPv4 packet header length is 60 bytes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An IPv6 packet header is always 40 bytes.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-06-06T22:42:59.607" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41727" PostTypeId="2" ParentId="41672" CreationDate="2017-06-06T23:18:55.280" Score="0" Body="&lt;p&gt;I created the same lab in GNS3 and found that the problem is in the Packet Tracer.&lt;/p&gt;&#xA;" OwnerUserId="37276" LastActivityDate="2017-06-06T23:18:55.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41730" PostTypeId="2" ParentId="41684" CreationDate="2017-06-07T01:52:41.140" Score="0" Body="&lt;p&gt;You can just type &quot;&lt;strong&gt;http&lt;/strong&gt;&quot; word in the filter field in your wireshark program. Then hit enter. Wireshark will show every http sessions that were initiated by your web browser.&lt;/p&gt;&#xA;" OwnerUserId="36028" LastActivityDate="2017-06-07T01:52:41.140" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41734" PostTypeId="1" CreationDate="2017-06-07T07:00:58.523" Score="0" ViewCount="2481" Body="&lt;p&gt;I have a boot issue in Cisco IP Phone &quot;Protocol Application Invalid.&quot; So I want to update my firmware.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I made my PC as TFTP and DHCP Server and connected my PC and IP phone in same vlan, but it is not getting IP address from DHCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any suggestion?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Fu9cC.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Fu9cC.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36791" LastEditorUserId="2142" LastEditDate="2017-06-07T11:29:56.370" LastActivityDate="2022-01-05T03:19:53.827" Title="&quot;Protocol Application Invalid&quot; in CISCO IP PHONE 7940!" Tags="|ip|dhcp|tftp|cisco-7900-ip-phones|" AnswerCount="2" CommentCount="3" ClosedDate="2022-01-05T13:24:42.503" ContentLicense="CC BY-SA 3.0" />
  <row Id="41735" PostTypeId="2" ParentId="41734" CreationDate="2017-06-07T08:36:22.167" Score="1" Body="&lt;p&gt;The 7940 IP phone fails to perform the boot process correctly this problem could be &lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you examine the sniffer trace between the DHCP server and the phone, you can identify that the phone accepts a DHCP offer from the data VLAN (the native VLAN) instead of the voice VLAN.&#xA;full resolution for this problem could be found in this article &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/voice-unified-communications/unified-communications-manager-callmanager/67942-phone-boot-fail.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;IP Phone 7940/7960 Fails to Boot&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2017-06-07T08:36:22.167" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41738" PostTypeId="2" ParentId="35629" CreationDate="2017-06-07T13:54:39.000" Score="0" Body="&lt;p&gt;No, it is not possible to receive part of a segment. This is because the checksum calculation will be incorrect. As described in &lt;a href=&quot;http://www.roman10.net/2011/11/27/how-to-calculate-iptcpudp-checksumpart-1-theory/&quot; rel=&quot;nofollow noreferrer&quot;&gt;this blog post:&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When TCP packet is received at the destination, the receiving TCP code&#xA;  also performs the TCP calculation and see if there’s a mismatch. If&#xA;  there is, it means there’s error in the packet and it will be&#xA;  discarded. The same validation logic used for IP header checksum&#xA;  validation can be used.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="129" LastActivityDate="2017-06-07T13:54:39.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41740" PostTypeId="2" ParentId="462" CreationDate="2017-06-07T14:54:52.057" Score="0" Body="&lt;p&gt;You can try &lt;a href=&quot;https://github.com/heyglen/network_tech/blob/master/README.md&quot; rel=&quot;nofollow noreferrer&quot;&gt;Network Tech&lt;/a&gt; if you use Sublime Text 3. I am the author.&lt;/p&gt;&#xA;" OwnerUserId="37348" LastActivityDate="2017-06-07T14:54:52.057" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41745" PostTypeId="1" AcceptedAnswerId="41918" CreationDate="2017-06-07T17:35:13.300" Score="1" ViewCount="1504" Body="&lt;p&gt;I'm using this cisco IOS command &quot;show users&quot; to check if there's more than one session active and the session's IP address, however I've noticed that on certain devices, this command hangs before displaying the IP address of the user for like 1 minute.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anyone know what could be causing this delay?.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've checked for cpu and memory usage, and that doesn't seem to be the cause, also checked on different ios versions.&lt;/p&gt;&#xA;" OwnerUserId="36630" LastActivityDate="2017-06-14T15:02:59.437" Title="Cisco IOS command show users" Tags="|cisco|switch|router|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41746" PostTypeId="1" CreationDate="2017-06-07T18:05:21.063" Score="0" ViewCount="570" Body="&lt;p&gt;I have use three switches, and three different networks. In one switch, there are four PCs connected with two VLANs. I do the same thing to the other two switches, and I use trunks to connect the switches. I sent packets to another network using same VLAN ID, but the packets failed to reach the destination. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How do I send the packets? &lt;/p&gt;&#xA;" OwnerUserId="37351" LastEditorUserId="8499" LastEditDate="2017-06-07T18:26:21.943" LastActivityDate="2018-12-13T06:02:05.537" Title="About VLAN using different network, but VLAN ID is same" Tags="|vlan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41748" PostTypeId="2" ParentId="41746" CreationDate="2017-06-07T18:15:46.777" Score="1" Body="&lt;p&gt;When a host sends traffic destined for a different network, it sends it to it configured gateway (usually a router), which is the host on a LAN that knows how to forward the traffic toward the destination network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A host will compare its network with the destination network by masking the source and destination addresses on the layer-3 packet to see if they are on the same network. If the source and destination addresses on the layer-3 packet are in the same network, the host will encapsulate the the layer-3 packet in a layer-2 frame with the address of the destination host. If the networks are different, when the host will encapsulate the layer-3 packet in a layer-2 frame with the layer-2 address of its configured gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That means that traffic sent to a different layer-3 network will be sent directly to the gateway, not the destination host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order for you to send traffic from one network to a different network, you need a router that knows how to get to each network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-06-07T18:15:46.777" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41749" PostTypeId="1" AcceptedAnswerId="41759" CreationDate="2017-06-07T18:57:23.593" Score="0" ViewCount="1253" Body="&lt;p&gt;I just saw in wireshark under &quot;import hexdump&quot; the following types:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;IEEE 802.11 Wireless Lan  &lt;/li&gt;&#xA;&lt;li&gt;IEEE 802.11 Wireless Lan with radio information&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;What are exactly is the radio information?&lt;/p&gt;&#xA;" OwnerUserId="33598" LastEditorUserId="8499" LastEditDate="2017-06-07T19:06:17.163" LastActivityDate="2017-06-08T06:00:54.673" Title="802.11 Wireless Lan with radio information" Tags="|ieee-802.11|wireshark|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41751" PostTypeId="1" AcceptedAnswerId="41753" CreationDate="2017-06-07T19:48:00.750" Score="1" ViewCount="1447" Body="&lt;p&gt;I am trying to capture wireless traffic from specified MAC addresses only, and I seem to be using the wrong syntax. When I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dumpcap -i wlp2s0 -b filesize:100000 -w capture.pcapng -a duration:18000 -f wlan addr1 d4:be:d9:5b:a6:45&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I get:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dumpcap: Invalid argument: d4:be:d9:5b:a6:45&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I appear to be getting the syntax that goes after -f incorrect. I am referencing &lt;a href=&quot;http://www.tcpdump.org/manpages/pcap-filter.7.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.tcpdump.org/manpages/pcap-filter.7.html&lt;/a&gt; which is linked from the WireShark wiki page on dumpcap.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can't seem to find examples for wireless MAC address capturing, only wired. I'm sure there is something I am missing here.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Follow up question: if I want to sniff for a few MAC addresses, do I separate them with the term, eg: &lt;code&gt;wlan addr1 xx.xx.xx.xx.xx.xx&lt;/code&gt; or &lt;code&gt;wlan addr1 xx.xx.xx.xx.xx.zz&lt;/code&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using wireshark 2.2.6 on Ubuntu 17.04&lt;/p&gt;&#xA;" OwnerDisplayName="user37353" LastEditorUserId="8499" LastEditDate="2017-06-07T20:54:46.117" LastActivityDate="2017-06-07T21:00:38.733" Title="Dumpcap capture filter syntax - wlan addr1 question" Tags="|ieee-802.11|wireshark|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41753" PostTypeId="2" ParentId="41751" CreationDate="2017-06-07T20:51:01.873" Score="0" Body="&lt;p&gt;You are apparently using the &lt;code&gt;-f&lt;/code&gt; option incorrectly. This is what the Dumpcap documentation says about it:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;-f &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Set the capture filter expression.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;The entire filter expression must be specified as a single argument (which means that if it contains spaces, it must be quoted).&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;This option can occur multiple times. If used before the first occurrence of the -i option, it sets the default capture filter&#xA;  expression. If used after an -i option, it sets the capture filter&#xA;  expression for the interface specified by the last -i option occurring&#xA;  before this option. If the capture filter expression is not set&#xA;  specifically, the default capture filter expression is used if&#xA;  provided.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The page that you link also shows the filters as quoted (copied directly from the linked page):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;`wlan addr2 0:2:3:4:5:6'.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Try something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;dumpcap -i wlp2s0 -b filesize:100000 -w capture.pcapng -a duration:18000 -f `wlan addr1 d4:be:d9:5b:a6:45'&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Apparently, you can use the filter option multiple times.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-06-07T21:00:38.733" LastActivityDate="2017-06-07T21:00:38.733" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41756" PostTypeId="1" AcceptedAnswerId="41757" CreationDate="2017-06-08T00:40:13.917" Score="1" ViewCount="103" Body="&lt;p&gt;I have a small home lab setup. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can ping &lt;code&gt;192.168.2.1&lt;/code&gt; from a guest wireless client.  I can ping google from the 2600 router.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#ping google.ca&#xA;&#xA;Translating &quot;google.ca&quot;...domain server (8.8.8.8) [OK]&#xA;&#xA;Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to&#xA;172.217.10.99, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 20/23/24 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For some reason the wireless guest client cannot resolve DNS?  The client gets DHCP from the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cisco 2600 config.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no network-clock-participate slot 1&#xA;no network-clock-participate wic 0&#xA;no aaa new-model&#xA;ip subnet-zero&#xA;ip cef&#xA;!&#xA;!&#xA;ip name-server 8.8.8.8&#xA;ip dhcp excluded-address 10.2.0.1 10.2.0.64&#xA;ip dhcp excluded-address 10.3.0.1 10.3.0.64&#xA;!&#xA;ip dhcp pool GUEST_POOL&#xA;   network 10.2.0.0 255.255.255.0&#xA;   default-router 10.2.0.1&#xA;   dns-server 10.1.0.1&#xA;   domain-name net.guest&#xA;!&#xA;ip dhcp pool NET_POOL&#xA;   network 10.3.0.0 255.255.255.0&#xA;   domain-name net.net&#xA;   dns-server 10.3.0.1&#xA;   default-router 10.3.0.1&#xA;!&#xA;!&#xA;!&#xA;!&#xA; !&#xA;interface FastEthernet0/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet0/0.1&#xA; description MGMT&#xA; encapsulation dot1Q 1 native&#xA; ip address 10.1.0.1 255.255.255.0&#xA; no ip redirects&#xA; ip nat inside&#xA;!&#xA;interface FastEthernet0/0.2&#xA; encapsulation dot1Q 2&#xA; ip address 10.2.0.1 255.255.255.0&#xA; no ip redirects&#xA; ip nat inside&#xA;!&#xA;interface FastEthernet0/0.3&#xA; encapsulation dot1Q 3&#xA; ip address 10.3.0.1 255.255.255.0&#xA; no ip redirects&#xA;!&#xA;interface FastEthernet0/1&#xA; description Outside&#xA; ip address dhcp&#xA; ip nat outside&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip nat inside source list NAT-2-INTERNET interface FastEthernet0/1 overload&#xA;no ip http server&#xA;ip classless&#xA;ip route 0.0.0.0 0.0.0.0 192.168.2.1&#xA;!&#xA;!&#xA;!&#xA;ip access-list extended NAT-2-INTERNET&#xA; permit ip 10.2.0.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1592" LastEditorUserId="8499" LastEditDate="2017-06-08T01:02:29.063" LastActivityDate="2017-06-08T01:02:29.063" Title="DNS not working on NAPT lab setup" Tags="|cisco|router|nat|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41757" PostTypeId="2" ParentId="41756" CreationDate="2017-06-08T00:47:14.660" Score="1" Body="&lt;p&gt;You have the router interfaces as what the DHCP client gets for it DNS server, but you do not have a DNS server running on the router, which is really a bad idea, anyway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You could do something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp pool GUEST_POOL&#xA;   network 10.2.0.0 255.255.255.0&#xA;   default-router 10.2.0.1&#xA;   dns-server 8.8.8.8&#xA;   domain-name net.guest&#xA;!&#xA;ip dhcp pool NET_POOL&#xA;   network 10.3.0.0 255.255.255.0&#xA;   domain-name net.net&#xA;   dns-server 8.8.8.8&#xA;   default-router 10.3.0.1&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That will assign the same DNS server to the clients that you are using for the router's DNS server, which you proved works because you can use it from the router.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-06-08T00:47:14.660" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41759" PostTypeId="2" ParentId="41749" CreationDate="2017-06-08T06:00:54.673" Score="1" Body="&lt;p&gt;There are perfectly explained guides written by Wireshark itself and the community on Wireshark wiki. The information you are looking for can be found on the following links:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://wiki.wireshark.org/Wi-Fi&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.wireshark.org/Wi-Fi&lt;/a&gt;&#xA;&lt;a href=&quot;https://www.wireshark.org/docs/wsug_html_chunked/ChIOImportSection.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.wireshark.org/docs/wsug_html_chunked/ChIOImportSection.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastActivityDate="2017-06-08T06:00:54.673" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41763" PostTypeId="2" ParentId="41630" CreationDate="2017-06-08T10:28:17.157" Score="2" Body="&lt;p&gt;okey I found the solution:&#xA;the v4 pool can't be in the same subnet as the interface is.&#xA;with an IP in another subnet everything works fine&lt;/p&gt;&#xA;" OwnerUserId="37080" LastActivityDate="2017-06-08T10:28:17.157" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41766" PostTypeId="1" AcceptedAnswerId="41795" CreationDate="2017-06-08T12:40:18.983" Score="1" ViewCount="1369" Body="&lt;p&gt;I have a Cisco ASA that gives me some sylogs that I do not understand. My INSIDE interface is where all my private IP addresses reside for the enterprise i work for. My OUTSIDE interface is what has my public IP address block assigned to it. I often see the following logs which I do not understand, a routable IP address is being sourced on the INSIDE interface with a destination to another routable public IP on the OUTSIDE interface. Any ideas? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;None of the IP addresses on these logs belong to me or are assign to any of my devices.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;08:24:02.418:Jun 08 08:24:02 EDT: %ASA--4-419002: Duplicate TCP SYN from INSIDE:123.201.138.87/20219 to OUTSIDE:209.118.224.55/2323 with different initial sequence number&#xA;08:24:02.384:Jun 08 08:24:02 EDT: %ASA--4-419002: Duplicate TCP SYN from INSIDE:123.201.138.87/20219 to OUTSIDE:209.118.224.55/2323 with different initial sequence number&#xA;08:24:02.351:Jun 08 08:24:02 EDT: %ASA--4-419002: Duplicate TCP SYN from INSIDE:123.201.138.87/20219 to OUTSIDE:209.118.224.55/2323 with different initial sequence number&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="14372" LastActivityDate="2017-06-09T13:00:21.730" Title="Global IP sourced on my INSIDE interface to another global IP on OUTSIDE interface" Tags="|routing|cisco-asa|syslog|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41767" PostTypeId="2" ParentId="41766" CreationDate="2017-06-08T12:55:28.113" Score="1" Body="&lt;p&gt;When a public IP address shows up inside your private network you should track it down. Check the ARP table on the ASA whether the source is connected directly or work from there to the source router. Once you've got the source MAC you work through your switches to find the source port.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-08T12:55:28.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41770" PostTypeId="1" AcceptedAnswerId="41772" CreationDate="2017-06-08T14:22:31.410" Score="3" ViewCount="1136" Body="&lt;p&gt;Can someone simply explain what Virtual LAN is and how it works?&lt;br&gt;&#xA;Or you can clarify the Wiki article:&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A virtual LAN (VLAN) is any broadcast domain that is partitioned and&#xA;  isolated in a computer network at the data link layer (OSI layer&#xA;  2). A LAN is an abbreviation for local area network and in this&#xA;  context virtual refers to a physical object recreated and altered by&#xA;  additional logic. VLANs work through tags within network packets and&#xA;  tag handling in networking systems - recreating the appearance and&#xA;  functionality of network traffic that is physically on a single&#xA;  network but acts as if it is split between separate networks. In this&#xA;  way, VLANs can keep networks separate despite being connected to the&#xA;  same network, and without requiring multiple sets of cabling and&#xA;  networking devices to be deployed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="37375" LastEditorUserId="5235" LastEditDate="2017-06-08T15:05:59.693" LastActivityDate="2020-12-10T23:16:34.277" Title="Explain what is Virtual LAN" Tags="|vlan|" AnswerCount="4" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41771" PostTypeId="1" CreationDate="2017-06-08T14:27:09.750" Score="3" ViewCount="170" Body="&lt;p&gt;We have 2 (main) vlans:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Vlan1 - Management (iDrac, switches etc)&lt;br/&gt;&#xA;Vlan2 - Hosting, both servers and dedicated client IPs&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We have over 900 IPs in the VLAN2 which is located in a data center, for shared web hosting. We use IPv4 addresses in different ranges in the VLAN2 for hosting. One Switch stack consisting of 2 Dell PowerConnect 6248 switches and another switch stack consisting of 2 Cisco Catalyst 3650 switches (WS-C3650-48TQ).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding further IPs in the same hosting VLAN will make any problems in our environment in future?? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will cause any conflicts in shared hosting environment, if we use separate VLANs rather than a single VLAN??&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please update your valuable suggestions or thoughts in this.&lt;/p&gt;&#xA;" OwnerUserId="37376" LastEditorUserId="37376" LastEditDate="2017-06-09T09:25:56.333" LastActivityDate="2017-07-09T10:18:29.203" Title="VLAN for hosting environment" Tags="|vlan|cisco-catalyst|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41772" PostTypeId="2" ParentId="41770" CreationDate="2017-06-08T14:29:02.973" Score="5" Body="&lt;p&gt;A LAN is a group of devices connected to the &lt;strong&gt;same&lt;/strong&gt; network that can commuicate among them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A virtual LAN is a group of devices that using a predefined &lt;code&gt;tag&lt;/code&gt; in the ethernet frames can communicate among them. They are isolated of other devices &lt;em&gt;in the same network&lt;/em&gt; that don't use the same tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/wHBpE.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/wHBpE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the diagram all the devices are connected to the same switch (single network) but there are two VLANs (&lt;code&gt;Sales&lt;/code&gt; and &lt;code&gt;Finance&lt;/code&gt;) so all the &lt;code&gt;Sales&lt;/code&gt; devices can communicate among them but &lt;strong&gt;can't&lt;/strong&gt; communicate with the &lt;code&gt;Finance&lt;/code&gt;devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The devices (PCs in this case) are unaware of the existence of a VLAN. The VLAN tag is configured in the switch port and the switch is the network equipment that is VLAN-aware. &lt;/p&gt;&#xA;" OwnerUserId="16654" LastEditorUserId="16654" LastEditDate="2017-06-08T14:44:49.973" LastActivityDate="2017-06-08T14:44:49.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41773" PostTypeId="2" ParentId="41770" CreationDate="2017-06-08T14:35:57.590" Score="1" Body="&lt;p&gt;Before coming to the concept of virtual LANs, let me describe a few terminology:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Broadcast domain : Every network represents a broadcast domain. E.g 10.0.0.0/8 is one broadcast domain; 20.0.0.0/8 is another broadcast domain. In general, every interface of a router represents a broadcast domain. For devices in one broadcast domain, to talk to devices in another broadcast domain, we need a Layer3 device (called a Router).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So essentially, as we place a router in a network and assign ip addresses, we are creating new broadcast domains.&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;2&quot;&gt;&#xA;&lt;li&gt;By default,all the devices connected to a switch  are part of &lt;em&gt;same&lt;/em&gt; broadcast domain.They can talk to one another without the need of a layer 3 device.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So, what is a VLAN ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A VLAN gives us the ability to create separate broadcast domains, even though the devices are connected to a layer 2 switch. To make devices in one vlan talk to devices in another vlan, we would need a Router or a Layer 3 device.&lt;/p&gt;&#xA;" OwnerUserId="5235" LastEditorUserId="5235" LastEditDate="2017-06-08T14:42:27.523" LastActivityDate="2017-06-08T14:42:27.523" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41775" PostTypeId="2" ParentId="41644" CreationDate="2017-06-08T16:11:11.893" Score="1" Body="&lt;pre&gt;&lt;code&gt;ipv6 nd prefix 2800:160:1F88::/64 no-advertise&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Solved it.&lt;/p&gt;&#xA;" OwnerDisplayName="user34559" LastActivityDate="2017-06-08T16:11:11.893" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41776" PostTypeId="1" CreationDate="2017-06-08T16:18:29.477" Score="5" ViewCount="1048" Body="&lt;p&gt;I'm trying to get our local &lt;a href=&quot;http://docs.aws.amazon.com/AmazonVPC/latest/NetworkAdminGuide/sonicwall-bgp.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sonicwall NSA 2600 to connect to a AWS VPN, within a VPC&lt;/a&gt;. I have the IKE portion working and AWS shows the two pipes are connected&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/bW3ag.png&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The BGP routes show as up in the router&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-routing)# show routing bgp summary&#xA;BGP router identifier 192.168.1.3, local AS number 65000&#xA;BGP table version is 8737&#xA;2 BGP AS-PATH entries&#xA;0 BGP community entries&#xA;&#xA;Neighbor        V    AS MsgRcvd MsgSent   TblVer  InQ OutQ Up/Down  State/PfxRcd&#xA;169.254.45.245  4  7224   51909   63298     8736    0    0 5d20h55m        1&#xA;169.254.46.161  4  7224   52390   63791     8736    0    0 5d20h55m        1&#xA;&#xA;Total number of neighbors 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's baffling is that it appears that everything appears to be there. But attempting to get anything to route to the 174.0.0.0/16 block doesn't work (I know it's a public block but I can't change it at present)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;(config-routing)# show routing nsm database&#xA;&#xA;C    *&amp;gt; 169.254.45.244/30 is directly connected, T2&#xA;C    *&amp;gt; 169.254.45.247/32 is directly connected, T2&#xA;C    *&amp;gt; 169.254.46.160/30 is directly connected, T1&#xA;C    *&amp;gt; 169.254.46.163/32 is directly connected, T1&#xA;B    *&amp;gt; 174.0.0.0/16 [20/100] via 169.254.46.161, T1, 5d20h57m&#xA;C    *&amp;gt; 192.168.1.0/24 is directly connected, X0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I've never dealt with BGP so I'm at a complete loss how to debug it further, or determine how to get it to send into or out of the VPC. I cannot get pings, RDC or SSH to work through the internal IPs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Adding the route table, as obtained from my PC&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;IPv4 Route Table&#xA;===========================================================================&#xA;Active Routes:&#xA;Network Destination        Netmask          Gateway       Interface  Metric&#xA;          0.0.0.0          0.0.0.0      192.168.1.3    192.168.1.153    281&#xA;        127.0.0.0        255.0.0.0         On-link         127.0.0.1    331&#xA;        127.0.0.1  255.255.255.255         On-link         127.0.0.1    331&#xA;  127.255.255.255  255.255.255.255         On-link         127.0.0.1    331&#xA;      192.168.1.0    255.255.255.0         On-link     192.168.1.153    281&#xA;    192.168.1.153  255.255.255.255         On-link     192.168.1.153    281&#xA;    192.168.1.255  255.255.255.255         On-link     192.168.1.153    281&#xA;        224.0.0.0        240.0.0.0         On-link         127.0.0.1    331&#xA;        224.0.0.0        240.0.0.0         On-link     192.168.1.153    281&#xA;  255.255.255.255  255.255.255.255         On-link         127.0.0.1    331&#xA;  255.255.255.255  255.255.255.255         On-link     192.168.1.153    281&#xA;===========================================================================&#xA;Persistent Routes:&#xA;  Network Address          Netmask  Gateway Address  Metric&#xA;          0.0.0.0          0.0.0.0      192.168.1.3  Default&#xA;===========================================================================&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is a route in the Sonicwall routing&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;img src=&quot;https://i.stack.imgur.com/OoVkE.png&quot;&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I played with this some and got the BGP routes listed correctly, but still no luck on getting traffic to flow&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;   Network          Next Hop            Metric LocPrf Weight Path&#xA;*  174.0.0.0        169.254.45.245         200             0 7224 i&#xA;*&amp;gt;                  169.254.46.161         100             0 7224 i&#xA;*&amp;gt; 192.168.1.0      0.0.0.0                       100  32768 i&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37378" LastEditorUserId="37378" LastEditDate="2017-06-16T12:28:59.833" LastActivityDate="2017-06-16T12:28:59.833" Title="Sonicwall with BGP unable to route to AWS VPN" Tags="|vpn|bgp|firewall|sonicwall|" AnswerCount="0" CommentCount="21" ClosedDate="2019-12-19T02:57:07.927" ContentLicense="CC BY-SA 3.0" />
  <row Id="41777" PostTypeId="1" CreationDate="2017-06-08T16:30:14.133" Score="1" ViewCount="255" Body="&lt;p&gt;Here is my router's configurations (with fake public IP addresses):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; ip address 113.160.61.14 255.255.255.252&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface GigabitEthernet0/1&#xA; ip address 101.96.10.141 255.255.255.192&#xA; ip nat outside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;! &#xA;interface GigabitEthernet0/2&#xA; ip address 172.16.2.28 255.255.255.248&#xA; ip flow ingress&#xA; ip nat inside&#xA; ip virtual-reassembly&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;ip nat inside source list ftth interface GigabitEthernet0/0 overload&#xA;!&#xA;ip route 0.0.0.0 0.0.0.0 113.160.61.13 100&#xA;ip route 0.0.0.0 0.0.0.0 101.96.10.129 200&#xA;!&#xA;ip access-list extended ftth&#xA; permit ip 192.168.7.0 0.0.0.255 any&#xA; permit ip 192.168.1.0 0.0.0.255 any&#xA; permit ip 192.168.8.0 0.0.0.255 any&#xA; permit ip 192.168.9.0 0.0.0.255 any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is a result from &lt;code&gt;show ip int b&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface                  IP-Address       OK?     Method Status            Protocol&#xA;GigabitEthernet0/0         113.160.61.14    YES     NVRAM  up                    up&#xA;GigabitEthernet0/1         101.96.10.141    YES     manual up                    up&#xA;NVI0                       113.160.61.14    YES     unset  up                    up&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;So as you can see we have two WAN interfaces to two different ISPs, we change some configurations and saw some behaviors as below:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;If I keep this setting, both WAN links are okay as we can ping&#xA;&lt;code&gt;8.8.8.8&lt;/code&gt; from them (ping source), the default route go to&#xA;&lt;code&gt;113.160.61.13&lt;/code&gt; as expected.&lt;/li&gt;&#xA;&lt;li&gt;If I change &lt;code&gt;ip nat inside source list ftth interface&#xA;GigabitEthernet0/0 overload&lt;/code&gt; to &lt;code&gt;ip nat inside source list ftth&#xA;interface GigabitEthernet0/1 overload&lt;/code&gt;, both WAN links are still&#xA;okay as we can ping &lt;code&gt;8.8.8.8&lt;/code&gt; from them (ping source), the default&#xA;route still go through &lt;code&gt;113.160.61.13&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;But if I did step 2, also change &lt;code&gt;ip route 0.0.0.0 0.0.0.0&#xA;101.96.10.129 200&lt;/code&gt; to &lt;code&gt;ip route 0.0.0.0 0.0.0.0 101.96.10.129 20&lt;/code&gt;, there is no more Internet, can ping &lt;code&gt;8.8.8.8&lt;/code&gt; from source&#xA;&lt;code&gt;101.96.10.141&lt;/code&gt; but cannot from the other link&lt;/li&gt;&#xA;&lt;li&gt;The Internet come back when I shutdown interface g0/0, default&#xA;route now points to &lt;code&gt;101.96.10.129&lt;/code&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;So can anyone explain these behaviors on step 2, 3 and 4? Is it NVI interface related? We would like to have both links UP and be able to ping &lt;code&gt;8.8.8.8&lt;/code&gt;.&lt;/p&gt;&#xA;" OwnerUserId="36386" LastEditorUserId="8499" LastEditDate="2017-06-08T16:48:41.937" LastActivityDate="2018-08-05T04:42:51.687" Title="Question about configurations on Cisco router 3925" Tags="|cisco|switch|router|cisco-ios|cisco-commands|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41779" PostTypeId="2" ParentId="41771" CreationDate="2017-06-08T17:13:44.077" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Vlan1 - Management (iDrac, switches etc) Vlan2 - Hosting, both servers&#xA;  and dedicated client IPs&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;We have over 900 IPs in the VLAN2 which is located in a data center,&#xA;  for shared web hosting. We use IPv4 addresses in different ranges in&#xA;  the VLAN1 for hosting. Another VLAN2 for Management (iDrac, switches&#xA;  etc).&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;VLAN2 in 1st paragraph contradicts that of last sentence.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Adding further IPs in the same hosting VLAN will make any problems in&#xA;  our environment in future??&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;As long as all MACs can be stored in the switches and there's enough space in your subnets, no. However, only your hoster can answer that for sure.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Will cause any conflicts in shared hosting environment, if we use&#xA;  separate VLANs rather than a single VLAN??&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Usually, your hoster should be able to accomodate several VLANs.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-08T17:13:44.077" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41782" PostTypeId="2" ParentId="41771" CreationDate="2017-06-08T17:29:59.747" Score="2" Body="&lt;p&gt;A VLAN is a broadcast domain, the larger the number of hosts in a VLAN, the more broadcast you have, the more performance are degraded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Additionally, it's a single failure domain, in the sense that is still a shared medium and one host having trouble could potentially impact the connectivity of all other hosts within the same VLAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Third it is also a security boundary. Even if you have a correctly configured firewall on all hosts (and I hope so in an hosting environment), Access Control Lists on the router (or better, a true firewall) will also increase security. (Depending on the switch used, there's some measure that can be taken to prevent hosts within a same VLAN to communicate together)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So it's not advisable to have too many hosts within a VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some people will tell you &quot;no more than 500 hosts in a VLAN&quot; , referring to some Cisco best practice, other put the limit at 1000.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally I prefer to reduce the number, and avoid using larger than /23.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-06-08T17:29:59.747" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41783" PostTypeId="2" ParentId="41777" CreationDate="2017-06-08T18:03:38.030" Score="2" Body="&lt;p&gt;First of all, your NAT rules are triggered only for the traffic which first arrives at nat inside interface - that is your Gi0/2. Since you're pinging from the wan interfaces (Gi0/0 and Gi0/1) as your source, this doesn't trigger any translation, and your source ip remains unchanged in icmp packets. What actually happens is probably related to lack of routing information at one of your ISPs. My assumption is, that your ISP1 known how to reach both 113.160.61.14 and 101.96.10.141, while ISP2 doesn't know how to reach 113.160.61.14, thus, when your default route is pointing towards ISP2, your pings are lost, when sourced from 113.160.61.14.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, for your internal hosts behind Gi0/2 to reach internet, you need to configure two nat rules, as already mentioned by Ron Maupin.&lt;/p&gt;&#xA;" OwnerUserId="30830" LastActivityDate="2017-06-08T18:03:38.030" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41785" PostTypeId="5" CreationDate="2017-06-08T20:16:04.050" Score="0" Body="&lt;p&gt;Sonicwall, formerly owned by Dell computers, is a brand of professional grade firewall that comes with a Unified Threat Management subscription for filtering traffic passing through it. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.sonicwall.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Sonicwall website&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="37378" LastEditorUserId="31801" LastEditDate="2018-10-07T16:47:08.887" LastActivityDate="2018-10-07T16:47:08.887" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="41786" PostTypeId="4" CreationDate="2017-06-08T20:16:04.050" Score="0" Body="Sonicwall (formerly owned by Dell) is a maker of UTM firewalls and other network related devices. Use this tag for questions about Sonicwall appliances" OwnerUserId="37378" LastEditorUserId="37378" LastEditDate="2017-06-09T00:01:32.050" LastActivityDate="2017-06-09T00:01:32.050" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41788" PostTypeId="1" AcceptedAnswerId="41789" CreationDate="2017-06-08T22:53:42.827" Score="2" ViewCount="6051" Body="&lt;p&gt;Cisco ASA 5508, 9.6.3 code. I have 2 outside interfaces &lt;code&gt;BACKUP&lt;/code&gt; and &lt;code&gt;PRIMARY&lt;/code&gt; and a &lt;code&gt;INSIDE&lt;/code&gt; interface. For some reason the NAT sends traffic out the BACKUP interface even when BACKUP is down!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/XpaSo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/XpaSo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[&lt;strong&gt;Edit&lt;/strong&gt; I have isolated the issue and made this question simpler]&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found that &lt;strong&gt;if&lt;/strong&gt; you're using &lt;strong&gt;twice NAT&lt;/strong&gt; that has a &lt;strong&gt;destination&lt;/strong&gt;, the ASA will &lt;strong&gt;route the packet based on the NAT&lt;/strong&gt; and completely ignore the routing table. Here is the relavant config.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/0&#xA; nameif PRIMARY&#xA; security-level 0&#xA; ip address 22.22.22.22 255.255.255.240&#xA;interface GigabitEthernet0/1&#xA; nameif INSIDE&#xA; security-level 100&#xA; ip address 172.16.1.10 255.255.255.0&#xA;interface GigabitEthernet0/2&#xA; nameif BACKUP&#xA; security-level 0&#xA; ip address 33.33.33.33 255.255.255.0&#xA;&#xA;route OUTSIDE 0.0.0.0 0.0.0.0 22.22.22.23 1&#xA;&#xA;object network OBJ-55.55.55.55&#xA; host 55.55.55.55&#xA;object service OBJ-HTTP&#xA; service tcp destination eq 80&#xA;nat (INSIDE,BACKUP) source static any interface destination static OBJ-55.55.55.55 OBJ-55.55.55.55 &#xA;nat (INSIDE,PRIMARY) source static any interface destination static OBJ-55.55.55.55 OBJ-55.55.55.55 &#xA;nat (INSIDE,any) source static any any service OBJ-HTTP OBJ-HTTP no-proxy-arp&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My goal is to NAT traffic going to 55.55.55.55 to the Interface, and nonat everything else that's on port 80.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I do this config and try a packet trace, we can see it takes the wrong path.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA-DEV# packet-tracer input INSIDE tcp 172.16.1.99 2222 55.55.55.55 80&#xA;&#xA;Phase: 1&#xA;Type: CAPTURE&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;MAC Access list&#xA;&#xA;Phase: 2&#xA;Type: ACCESS-LIST&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Implicit Rule&#xA;Additional Information:&#xA;MAC Access list&#xA;&#xA;Phase: 3&#xA;Type: UN-NAT&#xA;Subtype: static&#xA;Result: ALLOW&#xA;Config:&#xA;nat (INSIDE,BACKUP) source static any interface destination static OBJ-55.55.55.55 OBJ-55.55.55.55&#xA;Additional Information:&#xA;NAT divert to egress interface BACKUP-INTERNET-TEST&#xA;Untranslate 55.55.55.55/80 to 55.55.55.55/80&#xA;&#xA;Phase: 4&#xA;Type: ACCESS-LIST&#xA;Subtype: log&#xA;Result: ALLOW&#xA;Config:&#xA;access-group ACL-INSIDE-IN in interface INSIDE&#xA;access-list ACL-INSIDE-IN extended permit ip any host 55.55.55.55&#xA;Additional Information:&#xA;&#xA;Phase: 5&#xA;Type: NAT&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;nat (INSIDE,BACKUP) source static any interface destination static OBJ-55.55.55.55 OBJ-55.55.55.55&#xA;Additional Information:&#xA;Static translate 172.16.1.99/2222 to 192.168.79.1/2222&#xA;&#xA;Phase: 6&#xA;Type: NAT&#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 7&#xA;Type: IP-OPTIONS&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 8&#xA;Type: INSPECT&#xA;Subtype: inspect-http&#xA;Result: ALLOW&#xA;Config:&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect http PMAP-HTTP-INSPECT&#xA;service-policy global_policy global&#xA;Additional Information:&#xA;&#xA;Phase: 9&#xA;Type: NAT&#xA;Subtype: rpf-check&#xA;Result: ALLOW&#xA;Config:&#xA;nat (INSIDE,BACKUP) source static any interface destination static OBJ-55.55.55.55 OBJ-55.55.55.55&#xA;Additional Information:&#xA;&#xA;Phase: 10&#xA;Type: NAT&#xA;Subtype: per-session&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 11&#xA;Type: IP-OPTIONS&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;&#xA;Phase: 12&#xA;Type: FLOW-CREATION&#xA;Subtype:&#xA;Result: ALLOW&#xA;Config:&#xA;Additional Information:&#xA;New flow created with id 1404251, packet dispatched to next module&#xA;&#xA;Result:&#xA;input-interface: INSIDE&#xA;input-status: up&#xA;input-line-status: up&#xA;output-interface: BACKUP&#xA;output-status: down&#xA;output-line-status: down&#xA;Action: allow&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Some more show commands:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ASA-DEV(config)# sh route&#xA;&#xA;Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP&#xA;       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area&#xA;       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2&#xA;       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN&#xA;       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2&#xA;       ia - IS-IS inter area, * - candidate default, U - per-user static route&#xA;       o - ODR, P - periodic downloaded static route, + - replicated route&#xA;Gateway of last resort is 208.69.250.17 to network 0.0.0.0&#xA;&#xA;S*       0.0.0.0 0.0.0.0 [1/0] via 22.22.22.23, OUTSIDE&#xA;C        172.16.1.0 255.255.255.0 is directly connected, INSIDE&#xA;&#xA;ASA-DEV(config)# sho int ip brie&#xA;Interface                  IP-Address      OK? Method Status                Protocol&#xA;GigabitEthernet0/0         22.22.22.22     YES CONFIG up                    up&#xA;GigabitEthernet0/1         172.16.1.10     YES CONFIG up                    up&#xA;GigabitEthernet0/2         33.33.33.33     YES manual down                  down&#xA;GigabitEthernet0/3         unassigned      YES unset  administratively down down&#xA;GigabitEthernet0/4         unassigned      YES unset  administratively down down&#xA;GigabitEthernet0/5         unassigned      YES unset  administratively down down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;As you can see my routing table is bare bones and my BACKUP interface (G0/2) isn't even up. SO WHY ON EARTH IS THE NAT TRYING TO ROUTE OUT THE BACKUP INTERFACE!?&lt;/p&gt;&#xA;" OwnerUserId="37386" LastEditorUserId="37386" LastEditDate="2017-06-09T04:56:40.717" LastActivityDate="2017-06-09T05:45:27.720" Title="Cisco ASA - My NAT is forcing traffic out the wrong interface!" Tags="|cisco-asa|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41789" PostTypeId="2" ParentId="41788" CreationDate="2017-06-09T05:45:27.720" Score="3" Body="&lt;p&gt;This is a very specific part of the ASA packet processing that many don't know about called &lt;strong&gt;NAT Divert Check&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://supportforums.cisco.com/discussion/11903326/cisco-asa-traffic-flow-destination-nat&quot; rel=&quot;nofollow noreferrer&quot;&gt;Simply explained here&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The NAT divert check (which is what overrides the routing table) is&#xA;  checking to see if there is any NAT rule that specifies destination&#xA;  address translation for an inbound packet arriving on an interface. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If there is no rule that explicitly specifies how to translate that packet's destination IP address, then the global routing table is&#xA;  consulted to determine the egress interface.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;If there is a rule that explicitly specifies how to translate the packets destination IP address, then the NAT rule &quot;pulls&quot; the packet&#xA;  to the other interface in the translation and the global routing table&#xA;  is effectively bypassed.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Cisco has stated these NAT rules are intended to override the routing table.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can use an EEM script as a workaround to keep your NAT statements and still make it work. The script relies on IP SLA to track for a syslog message the IP SLA failure would trigger, then adds or removes your NAT when that happens.&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118049-config-eem-00.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118049-config-eem-00.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37386" LastActivityDate="2017-06-09T05:45:27.720" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41791" PostTypeId="1" CreationDate="2017-06-09T09:19:55.830" Score="1" ViewCount="9310" Body="&lt;p&gt;Let's say I have four PCs connected to one CISCO switch. &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;PC 1&lt;/strong&gt; has IP address &lt;code&gt;192.168.10.1&lt;/code&gt; and is connected to the access port - &lt;em&gt;vlan ID 10&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;PC 2&lt;/strong&gt; has IP address &lt;code&gt;192.168.10.2&lt;/code&gt; and is connected to the access port - &lt;em&gt;vlan ID 10&lt;/em&gt;.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;PC3&lt;/strong&gt; has IP address &lt;code&gt;192.168.10.1&lt;/code&gt; (same IP address as PC1) and is connected to the access port - &lt;em&gt;vlan ID 20&lt;/em&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;PC4&lt;/strong&gt; has IP address &lt;code&gt;192.168.10.2&lt;/code&gt; ( same IP address as PC2) and is connected to the access port - &lt;em&gt;vlan ID 20&lt;/em&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Can PC1 ping PC2?&lt;br&gt;&#xA;Can PC3 ping PC4? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to have same IP address in the network if they are connected to different VLAN ports in one switch?&lt;/p&gt;&#xA;" OwnerUserId="37394" LastEditorUserId="16930" LastEditDate="2017-06-09T09:50:31.703" LastActivityDate="2020-12-12T15:34:56.393" Title="Can we have same IP addresses of PCs connected to a switch port with different VLAN Ids?" Tags="|cisco|vlan|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41792" PostTypeId="2" ParentId="41791" CreationDate="2017-06-09T09:54:00.357" Score="4" Body="&lt;p&gt;Yes, VLAN form layer 2 networks that are independent from each other (this is the purpose of VLAN)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hosts within a VLAN cannot be seen from hosts in another VLAN (as long as you don't bridge them, or route between them).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So you scenario is perfectly possible.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since PC1 and PC2 are  in the same VLAN, they can communicate together. Same for PC3 and PC4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Being in different VLAN, PC1 &amp;amp; 2 cannot communicate with PC3 &amp;amp; PC4.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For all purpose it is exactly as is they were on two different, isolated switches.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-06-09T11:08:43.793" LastActivityDate="2017-06-09T11:08:43.793" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41793" PostTypeId="2" ParentId="41791" CreationDate="2017-06-09T10:47:29.590" Score="1" Body="&lt;p&gt;While this is quite possible as JFL has pointed out, your network design lacks the ability to (easily) enable communication between VLANs/subnets through a router. The router would be connected to both VLANs but with the same network address on both sides, it isn't able to distinguish between them and route properly. Additionally, the PCs/clients wouldn't have a way to distinguish their local partner from their remote one.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-09T10:47:29.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41795" PostTypeId="2" ParentId="41766" CreationDate="2017-06-09T13:00:21.730" Score="2" Body="&lt;p&gt;Ok I believe I found the problem. My remote sites have their own routers with their own internet connection. We don,t really use it for anything other than an IPSEC tunnel back to HQ to use as a backup WAN link..&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I use EIGRP to build my route tables, so these routers at my remote sites happen to not have a static default route. So anytime their public IP is pinged, scanned, and so forth, the replies are going out using the default route learned by EIGRP, which goes over our WAN line to my CORE switch then out to the internet through my ASA firewall. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As soon as I add a static default route at each remote site the problem, so far, goes away. &lt;/p&gt;&#xA;" OwnerUserId="14372" LastActivityDate="2017-06-09T13:00:21.730" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41797" PostTypeId="1" CreationDate="2017-06-09T13:28:15.287" Score="1" ViewCount="1177" Body="&lt;p&gt;I have configured a logical tunnel between my master-routing-instance and a additional routing-instance. &#xA;I tested the same config (except IP addresses) on my lab-system and on one of our other core-routers =&gt; Working!&#xA;But on this router, it doesn't work and I can't see the differences. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have configured the tunnel-services for this fpc (fpc 0, pic 3) like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;fpc 0 {&#xA;    pic 3 {&#xA;        tunnel-services {&#xA;            bandwidth 1g;&#xA;        }&#xA;    }&#xA;    sampling-instance sampling0;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And the routing-instance like this:&lt;code&gt;&#xA;instance-type virtual-router;&#xA;interface lt-0/3/10.10;&#xA;routing-options {&#xA;    static {&#xA;        route 0.0.0.0/0 next-hop X.X.X.165;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&#xA;And the lt-interface like this:&#xA;&lt;code&gt;show configuration interfaces lt-0/3/10 &#xA;unit 10 {&#xA;    encapsulation ethernet;&#xA;    peer-unit 11;&#xA;    family inet {&#xA;        address X.X.X.166/30;&#xA;    }&#xA;}&#xA;unit 11 {&#xA;    encapsulation ethernet;&#xA;    peer-unit 10;&#xA;    family inet {&#xA;        address X.X.X.165/30;&#xA;    }&#xA;}&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I expected to be able to ping from the routing-instance into my master-instance like this:&lt;code&gt;ping X.X.X.165 routing-instance RI&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But it isn't working. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Has anybody a clue?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;P.S.: When I ping from master to routing-instance, the output-bytes counter of the lt-end in the routing-instance increase, what means that the routing-instance replies with echo-reply-packets. But the input-counter of the lt-end in the master instance doesn't receive them as the input counter does not count incoming packets....&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks in advance!    &lt;/p&gt;&#xA;" OwnerUserId="37149" LastActivityDate="2021-04-12T02:54:26.997" Title="Logical-Tunnel Interface Juniper MX 480 doesn't &quot;work&quot;" Tags="|routing|ipv4|juniper|vrf|juniper-mx|" AnswerCount="0" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41798" PostTypeId="2" ParentId="29466" CreationDate="2017-06-09T14:10:42.877" Score="2" Body="&lt;p&gt;&lt;a href=&quot;https://www.juniper.net/documentation/en_US/junos/topics/example/firewall-filter-option-filter-based-forwarding-example.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.juniper.net/documentation/en_US/junos/topics/example/firewall-filter-option-filter-based-forwarding-example.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This would explain how to decide how to route by origin.&#xA;But I'd prefer - like Indigo said - to use virtual-routers on the srx. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just configure a routing-instance for each network, add the interfaces to the routing instances and set the routing per instance like you wish. &#xA;You don't need to build 2 instances, you can use the master instance, too. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards,&#xA;Flo&lt;/p&gt;&#xA;" OwnerUserId="37149" LastActivityDate="2017-06-09T14:10:42.877" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41799" PostTypeId="2" ParentId="41583" CreationDate="2017-06-09T14:15:39.440" Score="1" Body="&lt;p&gt;Okay, the solution for my problem in PFSense is called &quot;NAT reflection&quot;.&#xA;If this feature is enabled, it works like expected. &lt;/p&gt;&#xA;" OwnerUserId="37149" LastActivityDate="2017-06-09T14:15:39.440" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41803" PostTypeId="1" CreationDate="2017-06-09T19:20:05.003" Score="1" ViewCount="183" Body="&lt;p&gt;I read &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc4302#section-3.3.3&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 4302, IP Authentication Header, Section 3.3.3, Integrity Check Value Calculation&lt;/em&gt;&lt;/a&gt;. In page 13, it is mentioned that the fields which are mutable during transit, like TTL or hop count, are set to zero.&lt;/p&gt;&#xA;&lt;p&gt;If they are set to zero then how can we keep track of hop count?&lt;/p&gt;&#xA;" OwnerUserId="37405" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-06-09T21:08:27.057" Title="Doubt on handling mutable fields in IP header when computing digest or authentication data" Tags="|ipv4|ip|ipv6|authentication|rfc|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41804" PostTypeId="2" ParentId="41803" CreationDate="2017-06-09T19:29:51.640" Score="3" Body="&lt;p&gt;You are misunderstanding what that is telling you. Simply for the purposes of the calculation, you use zero for those fields; you don't actually change those fields to zero for the packet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-06-09T19:29:51.640" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41806" PostTypeId="2" ParentId="41770" CreationDate="2017-06-10T02:20:11.413" Score="1" Body="&lt;p&gt;The term VLAN is a bit confusing because it's used in two related but subtly different ways. Depending on context it can refer to.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The tag number used in VLAN tags to create virtual networks.&lt;/li&gt;&#xA;&lt;li&gt;The virtual Ethernet network created through the use of VLAN tags.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;VLANs let us split a single physical Ethernet network into multiple virtual Ethernet networks. This is done by tagging the packets as they pass over &amp;quot;trunk&amp;quot; links that carry multiple VLANs. The tags are normally removed before the packets are sent to end systems.&lt;/p&gt;&#xA;&lt;p&gt;There are many reasons we may want to do this including but not limited to.&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Forcing traffic between certain systems to go via an IP router/firewall and blocking any attempts at direct communication between them.&lt;/li&gt;&#xA;&lt;li&gt;Preventing systems from communicating with each other at all.&lt;/li&gt;&#xA;&lt;li&gt;Controlling where broadcast traffic goes and reducing the amount of it in any given part of the network.&lt;/li&gt;&#xA;&lt;li&gt;Separating multiple systems with the same IP address.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;Many network admins keep a 1:1 mapping between VLANs and IP subnets and that certainly makes life simpler but VLANs and subnets are different concepts at different layers and there certainly doesn't have to be a 1:1 mapping.&lt;/p&gt;&#xA;&lt;p&gt;Similarly in many smaller networks there is likely to be a 1:1 mapping between VLAN tag numbers and virtual Ethernet networks, but as networks grow beyond a certain size that is no longer practical to maintain as there are only about 4000 usable VLAN tag numbers.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2020-12-10T23:16:34.277" LastActivityDate="2020-12-10T23:16:34.277" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="41807" PostTypeId="2" ParentId="7409" CreationDate="2017-06-10T02:34:27.590" Score="2" Body="&lt;p&gt;To make a VM  mobile you want to be able to move it's physical location without changing it's apparent network location.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What that means is that we want to be able to put it on the same virtual Ethernet network regardless of which host machine it is sitting on. As long as a system is generating at least some broadcast traffic the Ethernet switches will quickly figure out it has moved and update their forwarding tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a very small setup we might just put all our VMs on one flat Ethernet network. In such a setup we can migrate the VMs trivially. Downside here is that there is no isolation, every VM can talk directly to every other VM, broadcast traffic flows to all VMs and so-on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A step up from that is VLANs. we can split our Ethernet network into a number of virtual Ethernet networks. If we can establish a link from any host box into any VLAN then again we can migrate our VM seamlessly. That works ok for moderate scales.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unfortunately at large scales VLANs start to break down as a solution for decoupling physical and logical topologies. There are less than 4096 usable VLAN tags (not sure offhand how many values are reserved) and Ethernet's Tree structure makes it difficult to build reliable high-bandwidth networks. It is difficult to serve a default gateway IP from multiple locations, so traffic may travel considerable distances in the network before reaching the default gateway (and quite possibly being sent back the way it came)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Which is where VXLAN comes in, VXLAN lets you build virtual Ethernet overlay networks on top of an IP underlay network. It can either be used on it's own in a &quot;learning&quot; mode using IP multicast on the underlay network to carry broadcast unknown and multicast (BUM) traffic for the overlay network or it can be used in conjunction with MP-BGP with vxlan end points advertising MAC addresses and IP addresses for the VXLANs to each other over BGP and simulating a virtual default gateway at each endpoint. Other than needing to support slightly larger frames than normal (sometimes known as &quot;baby jumbos&quot;) the underlay network is just a regular IP network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Furthermore VXLAN is designed to allow scaling of the underlay network using techniques such as link-aggregation and equal cost multipath. To communicate flow information from the underlay network to the overlay network the UDP source port of the outer packet is based on a hash of headers of the inner packet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;VXLAN also allows over 16 million network IDs which should be more than enough even for very large datacenters.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-06-12T13:35:13.657" LastActivityDate="2017-06-12T13:35:13.657" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41808" PostTypeId="1" CreationDate="2017-06-10T03:58:56.537" Score="1" ViewCount="1297" Body="&lt;p&gt;How do I find the correct (&lt;strong&gt;.bin&lt;/strong&gt;?) file on the Cisco website?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I searched for &quot;C3500XL&quot; (from the &lt;em&gt;show version&lt;/em&gt; output as shown below)&#xA;and was presented with &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/ios-software-releases-12-0-special-early-deployments/prod_bulletin0900aecd800f7523.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco Search Results&lt;/a&gt; ... but the links don't actually lead to downloads; they lead me through a maze of product selection menu/web pages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know how to access the device via serial console and how to configure TFTP services on my laptop.  I can ping the switch from my laptop and the laptop from my switch (using using a cross-over ethernet patch; there are no other switches between the two).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's what I know:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;sw01&amp;gt;show version&#xA;Cisco Internetwork Operating System Software &#xA;IOS (tm) C3500XL Software (C3500XL-C3H2S-M), Version 12.0(5)WC3b, RELEASE SOFTWARE (fc1)&#xA;Copyright (c) 1986-2002 by cisco Systems, Inc.&#xA;Compiled Fri 15-Feb-02 10:51 by antonino&#xA;Image text-base: 0x00003000, data-base: 0x00337600&#xA;&#xA;ROM: Bootstrap program is C3500XL boot loader&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once I am able to download the correct file (&lt;strong&gt;c3500xl-c3h2s-mz.120-5.WC10.bin&lt;/strong&gt; according to the search results?) and put it in &lt;em&gt;/private/tftpboot&lt;/em&gt; then what commands do I issue from the IOS &lt;strong&gt;xxx&gt;&lt;/strong&gt; prompt to fetch and install the .bin file?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also how do I check the provenance of the file?  Do they publish SHA-256 checksums?  Do they GPG sign them?  Where do I get their GPG public key?&lt;/p&gt;&#xA;" OwnerUserId="14526" LastActivityDate="2017-06-10T08:06:47.553" Title="How do I upgrade the IOS for a couple of Cisco Catalyst 3500 Series XL 48 port switches (via CLI)?" Tags="|cisco-catalyst|cisco-ios-12|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41809" PostTypeId="1" AcceptedAnswerId="41811" CreationDate="2017-06-10T05:19:26.477" Score="1" ViewCount="1882" Body="&lt;p&gt;I'm using the arp -a command to look at the ARP table on my personal computer.  After executing the command it shows two types of addresses, dynamic and static.&#xA;What do the dynamic and static types mean in the table?&lt;/p&gt;&#xA;" OwnerUserId="37338" LastEditorDisplayName="user27899" LastEditDate="2018-07-19T05:53:35.953" LastActivityDate="2018-07-19T11:59:04.403" Title="ARP Table basics" Tags="|arp|network|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="41810" PostTypeId="1" CreationDate="2017-06-10T06:56:34.783" Score="0" ViewCount="1238" Body="&lt;p&gt;I am trying to understand the working of Go-Back N using this website:-&#xA;&lt;a href=&quot;http://www.ccs-labs.org/teaching/rn/animations/gbn_sr/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.ccs-labs.org/teaching/rn/animations/gbn_sr/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here, suppose we are sending frames 1,2,3,4,5,6 (window size 4) and in the current window we have frames 1,2,3,4. Now suppose ACK 4 is lost then according to the website none of frames in the &lt;strong&gt;current&lt;/strong&gt; window are re-transmitted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;According to my understanding, frames 3,4,5,6 (of &lt;strong&gt;current&lt;/strong&gt; window) must be re-transmitted. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where am I going wrong?&lt;/p&gt;&#xA;" OwnerUserId="37406" LastEditorUserId="37406" LastEditDate="2017-06-10T07:02:06.970" LastActivityDate="2018-05-08T08:38:46.927" Title="Go Back N protocol" Tags="|ipv4|ip|protocol-theory|netflow|" AnswerCount="2" CommentCount="1" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41811" PostTypeId="2" ParentId="41809" CreationDate="2017-06-10T07:29:25.340" Score="3" Body="&lt;p&gt;Static ARP entries are entries added to the ARP table manually using arp -s command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Dynamic ARP entries are entries discovered dynamically using ARP protocol.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When the host needs to communicate with a new IP and does not know its physical address, it will broadcast an ARP request asking for the hardware/MAC address of the host that owns the IP.  The owner will replay with a unicast message containing its MAC address.&lt;/p&gt;&#xA;" OwnerUserId="1906" LastEditorUserId="1392" LastEditDate="2018-07-19T11:23:40.767" LastActivityDate="2018-07-19T11:23:40.767" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="41812" PostTypeId="2" ParentId="41808" CreationDate="2017-06-10T07:58:23.490" Score="2" Body="&lt;p&gt;I doubt that you'll find any downloads for Catalyst 3500XL. &lt;a href=&quot;http://www.cisco.com/en/US/products/hw/switches/ps637/prod_eol_notice09186a008032d451.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;They are out of support for many (12) years now&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Downloads for supported devices can be found &lt;a href=&quot;https://software.cisco.com/download/find.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. Note: You'll need a Cisco account and most likely a support contract.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Installing an update can be done via (t)ftp. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy tftp flash&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For ftp you have to configure  ftp user and ftp password&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip ftp username foo&#xA;ip ftp password secret&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;and then type &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;copy ftp flash&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Make sure you have enough free space (type dir). It might be necessary to delete some files in order to get enough free space. This might leave you with no IOS at all so be careful when doing this. You can recover from this by copying an Image via xmodem but that no fun.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last time I checked Cisco was only offering MD5 checksums. &lt;/p&gt;&#xA;" OwnerDisplayName="user2084" LastEditorDisplayName="user2084" LastEditDate="2017-06-10T08:06:47.553" LastActivityDate="2017-06-10T08:06:47.553" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41813" PostTypeId="2" ParentId="41810" CreationDate="2017-06-10T09:55:39.833" Score="1" Body="&lt;p&gt;If ACK 4 is lost, packets 1,2,3 are probably already ACk'ed, so the windows has advanced to 4,5,6,... Packets 5,6(,7) are on their way, and when the timeout runs out 4 is retransmitted. ACKs do not have to be in order but the window won't advance beyond a non-ACKed packet.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-10T09:59:27.110" LastActivityDate="2017-06-10T09:59:27.110" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41815" PostTypeId="1" AcceptedAnswerId="42487" CreationDate="2017-06-10T11:57:18.527" Score="2" ViewCount="2733" Body="&lt;p&gt;I would have a question regarding physical problem detection in a link with ping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The assumption is as follows: I have a fiber or cable with much of noise due to bad hardware (bad cable or bad transceiver for example), so this cable or fiber will statistically generate CRC Errors for X% of ethernet frames, is it true?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, could you confirm me this point or tell me if I'm wrong: With large ping (65k packet for example), one ping will generate approximately 65000 / 1500(mtu) = 43 frames, as ip fragments, so normally the probability to get ICMP packets loss (because normally if one IP fragment is lost the entire IP packet is lost) with large ping is higher than with small ping?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, the global question is, whereas ping and ICMP are for layer 3 problems detection, with large ping, could we easier detect a physical problem on a link?&lt;/p&gt;&#xA;" OwnerUserId="37402" LastEditorUserId="20757" LastEditDate="2017-06-10T23:08:35.547" LastActivityDate="2018-01-23T16:09:28.163" Title="CRC errors and ICMP packets loss correlation" Tags="|ethernet|ip|ping|icmp|packet-loss|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41819" PostTypeId="2" ParentId="41815" CreationDate="2017-06-10T17:22:46.570" Score="2" Body="&lt;p&gt;It depends on the type of the noise. If it is an ideal random noise, then yes, you will get much higher packet loss with bigger packets. It suggests a layer1 problem. In this case, setting a smaller packet size can be a workaround for TCP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, in the daily practice, often not this is the case. Particularly transceiver problems tend to forget whole packets, or to send crap to the optical line.&lt;/p&gt;&#xA;" OwnerUserId="20757" LastEditorUserId="20757" LastEditDate="2018-01-23T16:09:28.163" LastActivityDate="2018-01-23T16:09:28.163" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41820" PostTypeId="1" CreationDate="2017-06-10T17:55:04.460" Score="0" ViewCount="686" Body="&lt;p&gt;We've setup LACP (802.3ad) on our Juniper switch and a Linux host, connected to the switch with 3x 1Gbps links. We are able to download from multiple sources at a rate of 3 Gbps, but when uploading files to different destinations, we get a maximum of 1 Gbps. Interestingly, only 1 uplink appears to be used by the Linux host to upload (to different destinations) :&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Interface: ge-0/0/34, Enabled, Link is Up&#xA;Encapsulation: Ethernet, Speed: 1000mbps&#xA;Traffic statistics:&#xA;  Input bytes:             9874189047641 (981736896 bps)&#xA;  Output bytes:            5641687864781 (440210816 bps)&#xA;&#xA;Interface: ge-0/0/36, Enabled, Link is Up&#xA;Encapsulation: Ethernet, Speed: 1000mbps&#xA;Traffic statistics:&#xA;  Input bytes:                6194266205 (1016 bps)                    &#xA;  Output bytes:            5368956712475 (400087456 bps)&#xA;&#xA;Interface: ge-0/0/44, Enabled, Link is Up&#xA;Encapsulation: Ethernet, Speed: 1000mbps&#xA;Traffic statistics:&#xA;  Input bytes:             1494878289802 (1016 bps)&#xA;  Output bytes:           11897014259103 (469673216 bps)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Input and output are flipped over.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We basically followed this tutorial : &lt;a href=&quot;http://phreek.org/blog/2014/11/centos-7-lacp-network-bonding&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://phreek.org/blog/2014/11/centos-7-lacp-network-bonding&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And setup LACP as usual on our switch.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# show system rollback 2 compare 1&#xA;[edit chassis]&#xA;-   aggregated-devices {&#xA;-       ethernet {&#xA;-           device-count 1;&#xA;-       }&#xA;-   }&#xA;[edit interfaces ge-0/0/34]&#xA;-    ether-options {&#xA;-        802.3ad ae0;&#xA;-    }&#xA;[edit interfaces ge-0/0/34]&#xA;+    unit 0 {&#xA;+        family ethernet-switching;&#xA;+    }&#xA;[edit interfaces ge-0/0/36]&#xA;-    ether-options {&#xA;-        802.3ad ae0;&#xA;-    }&#xA;[edit interfaces ge-0/0/36]&#xA;+    unit 0 {&#xA;+        family ethernet-switching;&#xA;+    }&#xA;[edit interfaces ge-0/0/44]&#xA;-    ether-options {&#xA;-        802.3ad ae0;&#xA;-    }&#xA;[edit interfaces ge-0/0/44]&#xA;+    unit 0 {&#xA;+        family ethernet-switching;&#xA;+    }&#xA;[edit interfaces]&#xA;-   ae0 {&#xA;-       aggregated-ether-options {&#xA;-           lacp {&#xA;-               active;&#xA;-               periodic fast;&#xA;-           }&#xA;-       }&#xA;-       unit 0 {&#xA;-           family ethernet-switching;&#xA;-       }&#xA;-   }&#xA;[edit vlans SERVER-130 interface]&#xA;+    ge-0/0/44.0;&#xA;+    ge-0/0/36.0;&#xA;+    ge-0/0/34.0;&#xA;-    ae0.0;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any idea?&lt;/p&gt;&#xA;" OwnerUserId="36951" LastActivityDate="2017-06-10T20:18:44.557" Title="Linux LACP (802.3ad) working for ingress traffic only?" Tags="|juniper|juniper-junos|linux|ieee-802.1ax|juniper-ex|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41821" PostTypeId="2" ParentId="41820" CreationDate="2017-06-10T20:18:44.557" Score="1" Body="&lt;p&gt;Try to change transmit hash policy to layer3+4&lt;/p&gt;&#xA;&#xA;&lt;p&gt;More info &lt;a href=&quot;https://www.cyberciti.biz/howto/question/static/linux-ethernet-bonding-driver-howto.php&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-06-10T20:18:44.557" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41825" PostTypeId="1" AcceptedAnswerId="41830" CreationDate="2017-06-11T09:24:20.887" Score="1" ViewCount="4899" Body="&lt;p&gt;So I read that the 5 GHz frequency (in the EU) can have 19 channels without overlapping. The 5 GHz frequency goes in the EU from 5.150 to 5.725 GHz, so total 575 MHz. The width of one channel is 20 MHz. 575 MHz / 20 MHz = 28,75 ~ 28 Channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I also don't get where this site has this channel partition:&#xA;&lt;a href=&quot;https://www.welotec.com/files/CMS%20Landingpages/5ghz-kanalverteilung-80211ah-1.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.welotec.com/files/CMS%20Landingpages/5ghz-kanalverteilung-80211ah-1.jpg&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(From 5,150 GHz to 5,350 GHz with 20 MHz channel-wide, i'll get 10 channels + From 5,470 GHz to 5,725 GHz with 20 MHz channel-wide, i'll get 12 channels)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 19 channels, each channel should have a channel-wide of ~ 30,25 MHz (575 MHz / 19 channel)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Ok i see we have unused channels between channel 65 - 99 (5320 - 5500 MHz). Why are these unused?&lt;/p&gt;&#xA;" OwnerUserId="33598" LastEditorUserId="37378" LastEditDate="2017-06-11T20:31:57.367" LastActivityDate="2017-06-11T20:31:57.367" Title="How many channels does the 5 GHz frequency have without overlapping?" Tags="|ieee-802.11|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41826" PostTypeId="1" AcceptedAnswerId="41827" CreationDate="2017-06-11T09:53:57.210" Score="1" ViewCount="1393" Body="&lt;p&gt;As part of an experiment I cut a Cat 5e Ethernet cable in half, stripped off a small amount of insulation on each wire and attached each pair of wires together with its own alligator clip.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are four twisted pairs, so eight pairs of alligator clips are used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Before cutting it in half I am able to transfer data between two computers using the cable and get ~940MBit/s which is close to the Gigabit/s speeds that Cat 5e is cable of.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, after cutting it in half and reattaching the wires with alligator clips I get a 10x reduction in bandwidth and get a ~94MBits/s&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What might be the reason for this and are there any techniques I can use to regain the original 940MBit/s speed.&lt;/p&gt;&#xA;" OwnerUserId="10099" LastEditorUserId="8499" LastEditDate="2018-03-20T23:21:49.310" LastActivityDate="2021-03-16T16:35:57.670" Title="Poor bandwidth after re-coupling an Ethernet cable" Tags="|ethernet|troubleshooting|layer1|cable|utp|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41827" PostTypeId="2" ParentId="41826" CreationDate="2017-06-11T10:18:09.050" Score="0" Body="&lt;p&gt;This is more or less to be expected - alligator clips aren't Cat anything, so probably the link training gave up and the link fell back to Fast Ethernet (not standard but not uncommon). Another possibility is that there's a bad contact somewhere and one of the pairs didn't link, also causing a fallback to FE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you can't replace the cable, use a splice box to reattach the ends.&#xA;&lt;a href=&quot;https://cdn-reichelt.de/bilder/web/artikel_ws/E910/CAT5VERB.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://cdn-reichelt.de/bilder/web/artikel_ws/E910/CAT5VERB.jpg&quot; alt=&quot;Cat5 splice box&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-15T07:23:42.430" LastActivityDate="2017-06-15T07:23:42.430" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41828" PostTypeId="2" ParentId="41815" CreationDate="2017-06-11T11:04:48.963" Score="0" Body="&lt;p&gt;Ping with large packet is only to check the mtu size passing through this segment &#xA;CRC errors mostly incremented while there is issue with physical layer even with small mtu value.&lt;/p&gt;&#xA;" OwnerUserId="37425" LastActivityDate="2017-06-11T11:04:48.963" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41829" PostTypeId="2" ParentId="30816" CreationDate="2017-06-11T11:08:16.913" Score="-1" Body="&lt;p&gt;check the mtu size end to end, then you may have congestion somewhere specially if the packet loss in your peak time.&lt;/p&gt;&#xA;" OwnerUserId="37425" LastActivityDate="2017-06-11T11:08:16.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41830" PostTypeId="2" ParentId="41825" CreationDate="2017-06-11T13:22:51.093" Score="1" Body="&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/U-NII&quot; rel=&quot;nofollow noreferrer&quot;&gt;This Wikipedia article&lt;/a&gt; has a table to summarize that:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/qkMmy.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/qkMmy.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The wide of one channel is 20 MHz&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;is a false assumption.&#xA;A channel can be 20, 40, 80 or even 160Mhz wide. So the actual number of non-overlapping channels is dependent of the width used.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;we have unused channels between channel 65 - 99 (5320 - 5500 MHz).&#xA;  Why are these unused?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;This is the &lt;code&gt;U-NII-2B&lt;/code&gt; band, which is not allocated for unlicensed use by the FCC not the ETSI, so cannot be used for WiFi.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-06-11T13:22:51.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41831" PostTypeId="1" AcceptedAnswerId="41832" CreationDate="2017-06-11T13:59:23.110" Score="2" ViewCount="3945" Body="&lt;p&gt;If you refer this diagram, &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/e2b6b.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/e2b6b.jpg&quot; alt=&quot;eigrp-ospf-question-diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will ospf and eigrp share the 10 network on the right to their neighbors?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;I am asking the question in two separate scenarios using a single protocol at a time and not running both protocols at once.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As per my understanding link state protocols like ospf do so while eigrp being a distance vector protocol will share only one of the routes, but this case let's say both the routes are exactly same, how will this be handled then?&lt;/p&gt;&#xA;" OwnerUserId="15569" LastEditorUserId="15569" LastEditDate="2017-06-11T14:59:31.113" LastActivityDate="2017-06-21T00:43:54.113" Title="How do OSPF and EIGRP deal with 2 exactly same routes?" Tags="|routing|ospf|eigrp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41832" PostTypeId="2" ParentId="41831" CreationDate="2017-06-11T14:53:57.480" Score="5" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;Will ospf and eigrp share the 10 network on the right to their&#xA;  neighbors?&lt;/em&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;em&gt;As per my understanding link state protocols like ospf do so while&#xA;  eigrp being a distance vector protocol will share only one of the&#xA;  routes, but this case let's say both the routes are exactly same, how&#xA;  will this be handled then?&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;By default, the router will install the route learned via EIGRP into the routing table.&lt;/em&gt;&lt;/strong&gt; This is because EIGRP has a lower Administrative Distance than OSPF.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It should also be noted that both learned routes will remain in their respective routing processes.  Thus, the router knows about both but will only select one route when routing.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Routers select routes in the following order:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;Prefix Length&lt;/strong&gt; - The longest-matching route is preferred first.&#xA;Prefix length trumps all other route attributes.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Administrative Distance&lt;/strong&gt; - In the event there are multiple routes to&#xA;a destination with the same prefix length, the route learned by the&#xA;protocol with the lowest administrative distance is preferred.&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Metric&lt;/strong&gt; - In the event there are multiple routes learned by the same&#xA;protocol with same prefix length, the route with the lowest metric&#xA;is preferred. (If two or more of these routes have equal metrics,&#xA;load balancing across them may occur.)&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Jeremy Stretch does a great job going into deep details and examples of route selection &lt;a href=&quot;http://packetlife.net/blog/2010/aug/16/route-preference/&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;I am asking the question in two separate scenarios using a single&#xA;  protocol at a time and not running both protocols at once.&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;In the event of all things equal and the routing process supports it, equal-cost load balancing will occur.&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Exactly how the router handles the load-balancing depends on your configuration, version of IOS and potentially your router platform.  Cisco dives into the matter with the following documents.  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/5212-46.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;How Does Load Balancing Work?&lt;/a&gt; &lt;/li&gt;&#xA;&lt;li&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/support/docs/ip/express-forwarding-cef/18285-loadbal-cef.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Troubleshooting Load Balancing&#xA;Over Parallel Links Using Cisco Express Forwarding&lt;/a&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What does it look like in the routing table?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The following is an example output of EIGRP speaking routers with an equal-cost route for &lt;code&gt;10.1.1.0/24&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER2#show ip route&#xA;[...omitted text...]&#xA;      10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks&#xA;D        10.1.1.0/24 [90/30720] via 10.1.3.2, 00:00:17, FastEthernet1/0&#xA;                     [90/30720] via 10.1.2.2, 00:00:17, FastEthernet0/0&#xA;C        10.1.2.0/24 is directly connected, FastEthernet0/0&#xA;L        10.1.2.1/32 is directly connected, FastEthernet0/0&#xA;C        10.1.3.0/24 is directly connected, FastEthernet1/0&#xA;L        10.1.3.1/32 is directly connected, FastEthernet1/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Here is an example for OSPF:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ROUTER2#show ip route&#xA;[...omitted text...]&#xA;      10.0.0.0/8 is variably subnetted, 5 subnets, 2 masks&#xA;O        10.1.1.0/24 [110/2] via 10.1.3.2, 00:00:02, FastEthernet1/0&#xA;                     [110/2] via 10.1.2.2, 00:00:02, FastEthernet0/0&#xA;C        10.1.2.0/24 is directly connected, FastEthernet0/0&#xA;L        10.1.2.1/32 is directly connected, FastEthernet0/0&#xA;C        10.1.3.0/24 is directly connected, FastEthernet1/0&#xA;L        10.1.3.1/32 is directly connected, FastEthernet1/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2017-06-21T00:43:54.113" LastActivityDate="2017-06-21T00:43:54.113" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41834" PostTypeId="2" ParentId="41831" CreationDate="2017-06-11T15:42:46.260" Score="2" Body="&lt;p&gt;If I understand your question correctly, R2 will learn two paths to the 10 network.  Assuming equal metrics, both protocols will put both routes into the routing table, and the router will load balance between them.  R1, of course will learn only one path -- through R2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;@tdurden gives you good references for understanding how Cisco routers perform load balancing.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-06-11T15:42:46.260" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41835" PostTypeId="1" AcceptedAnswerId="41854" CreationDate="2017-06-11T16:10:28.267" Score="3" ViewCount="7780" Body="&lt;p&gt;I would like to know if it is possible to configure inter-vlan routing on a level 3 switch with a default route per vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Actualy, I have one switch with 3 VLAN (VLAN1, VLAN2, VLAN3) and a router with 3 ADSL box connected. Each VLAN have a specific ADSL box for Internet connection and on the same VLAN, specific IP can use différent ADSL box. Inter-vlan routing is provide by the router, it's working well, but inter-vlan connection speed is very slow : 160Mb/s or 20Mo/s.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to use my switch to do inter-vlan routing but I can't define a default static route per vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know a switch that is capable of doing this or do you have any idea how I could do it without static route per vlan ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks for your help !&lt;/p&gt;&#xA;" OwnerUserId="37428" LastActivityDate="2017-06-12T11:55:41.370" Title="Default static route per vlan" Tags="|routing|switch|router|vlan|switching|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="41836" PostTypeId="2" ParentId="40844" CreationDate="2017-06-11T17:00:59.060" Score="2" Body="&lt;p&gt;There are a few strategies to deploying AnyConnect.   &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect44/administration/guide/b_AnyConnect_Administrator_Guide_4-4.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;The Cisco AnyConnect Secure Mobility Client Administrator Guide, Release 4.4&lt;/a&gt; describes them in detail including &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/security/vpn_client/anyconnect/anyconnect44/administration/guide/b_AnyConnect_Administrator_Guide_4-4/deploy-anyconnect.html#d31825e306a1635&quot; rel=&quot;nofollow noreferrer&quot;&gt;client prerequisites and configurations&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Deploying AnyConnect refers to installing, configuring, and upgrading&#xA;  the AnyConnect client and its related files.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;The Cisco AnyConnect Secure Mobility Client can be deployed to remote&#xA;  users by the following methods:&lt;/p&gt;&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;Pre-Deploy—New installations and upgrades are done either by the end    user, or by using an enterprise software management system&#xA;  (SMS).&lt;/li&gt;&#xA;  &lt;li&gt;Web-Deploy—The AnyConnect package is loaded on the headend, which is    either an ASA or ISE server. When the user connects to an ASA or&#xA;  to    ISE, AnyConnect is deployed to the client.&#xA;  &#xA;  &lt;ul&gt;&#xA;  &lt;li&gt;For new installations, the user connects to a headend to download the    AnyConnect client. The client is either installed manually, or &#xA;  automatically (web-launch).&lt;/li&gt;&#xA;  &lt;li&gt;Updates are done by AnyConnect running on a system where AnyConnect    is already installed, or by directing the user to the&#xA;  ASA clientless    portal.&lt;/li&gt;&#xA;  &lt;/ul&gt;&lt;/li&gt;&#xA;  &lt;/ul&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="32112" LastActivityDate="2017-06-11T17:00:59.060" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41837" PostTypeId="2" ParentId="41835" CreationDate="2017-06-11T17:27:29.680" Score="-1" Body="&lt;p&gt;Clients, computers or hosts connected via DHCP send all their traffic to their default route which is usually a routable address on the switch. Therefore the clients will have one gateway per vlan.&#xA;If you want VLAN A to use one gateway, and VLANs B to use a different; then the host computers receiving their request via DHCP would receive the desired Gateway per Subnet (A/B) to the destination.&#xA;Typically the switch has one routing-table that affect all VLANs. The next-hop address has be reachable. If you assign the next-hop of a default route to an address that is located in the subnet of a specific VLAN, that is where all VLANs traffic will be sent.&#xA;The switch however will still only have 1 default gateway.&lt;/p&gt;&#xA;" OwnerUserId="37431" LastActivityDate="2017-06-11T17:27:29.680" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41839" PostTypeId="2" ParentId="41831" CreationDate="2017-06-11T17:45:26.830" Score="0" Body="&lt;p&gt;Cisco manages traffic through what they call a &quot;flow&quot;. When traffic arrives, it is evaluated for the 5 tuple:&#xA; * Protocol (TCP, UDP, ICMP, OSPF, EIGRP)&#xA; * Source IP address&#xA; * Source Port&#xA; * Destination IP address&#xA; * Destination Port&lt;/p&gt;&#xA;&#xA;&lt;p&gt;All subsequent traffic that is identified as part of an existing flow is sent across the same link to avoid out-of-order packet (like a voice conversation that is UDP without sequence numbers). In the case of load balancing, it's effectively assigning each flow round robin.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you ping, while watching a youtube video, the ICMP response may alternate between links due to the fact that ICMP is stateless, while watching a youtube video is essentially pinned to a link.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Both EIGRP and OSPF support Equal Cost Load Balancing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EIGRP supports unequal cost load balancing, but it must pass the feasibility condition which in small environments usually fails; and the alternate route ends up unused.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here in OSPF, the Cost is 2 for both routes. Therefore traffic will flow equally through both&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[110/2] via 10.1.3.2, 00:00:02, FastEthernet1/0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[110/2] via 10.1.2.2, 00:00:02, FastEthernet0/0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here in EIGRP, the cost is 30720 for both routes. Therefore traffic will flow equally through both&#xA;[90/30720] via 10.1.3.2, 00:00:17, FastEthernet1/0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;[90/30720] via 10.1.2.2, 00:00:17, FastEthernet0/0&lt;/p&gt;&#xA;" OwnerUserId="37431" LastEditorUserId="37431" LastEditDate="2017-06-12T01:15:48.767" LastActivityDate="2017-06-12T01:15:48.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41848" PostTypeId="2" ParentId="6441" CreationDate="2017-06-11T21:36:30.093" Score="0" Body="&lt;p&gt;If the links are trunked make sure you are not restricting the native VLAN with &quot;trunk allowed&quot; statement, also if you created a different type of port channel protocol make sure you delete the port-channel interface (I'm not 100% sure this is a problem), once I did this the LACP came up.&lt;/p&gt;&#xA;" OwnerUserId="37436" LastActivityDate="2017-06-11T21:36:30.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41849" PostTypeId="1" CreationDate="2017-06-11T22:00:01.617" Score="1" ViewCount="580" Body="&lt;p&gt;Imagine I have a computer with two slow cheap internet connections from ISP A and B. I also have a VPS in a datacenter with very high infinite bandwidth. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can make two VPN's. One from A to VPS and one from B to VPS. &#xA;I can aggregate the two &quot;virtual&quot; tun interfaces, install a DHCP on my VPS and have a bandwidth that is the sum of the one possible with A or B alone. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;By monitoring the bandwidth and adapt the load (for instance with ifenslave mode 5 or 6), everything could be balanced in a well better way that it would be possible with simple RR load balancing. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                 +- TUN: A ---- VPN ------+&#xA;                 |                        |&#xA; Host - aggTun --|                        +-- VPS - DHCP--- WWW&#xA;                 |                        |&#xA;                 +- TUN: B ---- VPN ------+&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, this seems too good to be true and I strongly believe that this could have a bad impact on TCP connections (especially if the delays with A and B are differents). Do someone know what problems could arise and how could I solve them with a Linux environment?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you very much and have a nice week&lt;/p&gt;&#xA;" OwnerUserId="35941" LastActivityDate="2017-06-12T12:24:40.010" Title="LACP balanced VPN: Bad or good idea?" Tags="|vpn|ieee-802.1ax|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41850" PostTypeId="2" ParentId="41835" CreationDate="2017-06-11T23:28:20.173" Score="0" Body="&lt;p&gt;Yes you can give default route for each vlan on the switch .&#xA;You will need a later 3 interface on the switch .&#xA;Once u create a layer 3 interface for a specific vlan assign an IP ADDRESS to it  in the same subnet as the host in the vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Once done add that ip as the default gw for the host .&#xA;Now on the switch , add static routes (or routing protocols)&#xA; Based on the network topology and you can achieve inter vlan communication. &#xA;Though I can't understand how using a router can create such large descrepencies in the throughout&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-06-11T23:28:20.173" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41854" PostTypeId="2" ParentId="41835" CreationDate="2017-06-12T03:33:34.733" Score="2" Body="&lt;p&gt;The underlying &quot;issue&quot; is that routing decisions are made using the destination address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each one of your source VLANs will do a route table lookup on their destination and follow the configured or learned default route in the global routing table (assuming their destination is not local).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to influence this decision, such that source A goes out ISP A; source B goes out ISP B; and source C goes out ISP C, you would need to use either policy based routing or VRF-Lite. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With policy based routing, you would utilize a route-map to match the desired source traffic, and then set the desired next hop address (upstream to ISP X). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With VRF-Lite, you would separate each VLAN's SVI and the ISP uplink into their own unique VRF. Each VRF would then have it's own unique default route.  However, this would also prevent the VLANs from communicating with each other without additional considerations.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you wanted to load-share the traffic from all three sources, out all three lines, then you would configure 3 distinct equal cost default routes.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In an enterprise environment, you would typically see multiple ISPs connected to one or more routers so that traffic can be load balanced across using things like BGP attributes. The actual method would depend on if you were looking to load balance traffic, or define an active/standby. &lt;/p&gt;&#xA;" OwnerUserId="599" LastEditorUserId="599" LastEditDate="2017-06-12T11:55:41.370" LastActivityDate="2017-06-12T11:55:41.370" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41855" PostTypeId="1" CreationDate="2017-06-12T04:52:57.173" Score="0" ViewCount="592" Body="&lt;p&gt;The first thing the prompt asks is the console's password. Shouldn't it be asking for the telnet's password first? Below is the code.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line vty 0 4&#xA;password LINE&#xA;login&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;AFAIK, &quot;login&quot; isn't needed, but I just did. And then I saved it. I am using packet tracer.&lt;/p&gt;&#xA;" OwnerUserId="37441" LastEditorUserId="509" LastEditDate="2017-06-12T05:17:07.350" LastActivityDate="2017-08-11T22:38:40.137" Title="When using Telnet, why it doesn't ask for the password?" Tags="|packet-tracer|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41857" PostTypeId="2" ParentId="41855" CreationDate="2017-06-12T05:16:39.233" Score="2" Body="&lt;p&gt;It looks like you're mixing up console access and telnet access. The statement you're showing only works for telnet access. If you want to set a password for console access, you need to configure it like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line con 0&#xA;password MYPASS&#xA;login&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-06-12T05:16:39.233" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41860" PostTypeId="2" ParentId="41849" CreationDate="2017-06-12T12:24:40.010" Score="3" Body="&lt;p&gt;The basic problem with this, and every other aggregation scenario, is how you will accomplish the load sharing.  By that I mean, &lt;strong&gt;how will the host determine which link to use to forward the packet out of?&lt;/strong&gt;   There are essentially two choices:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Per-packet load sharing.  The host/router will send packets alternating between the two links.  As you mention, this can cause serious impacts on throughput if packets arrive out of order due to unequal delays.&lt;/li&gt;&#xA;&lt;li&gt;Per-flow balancing.  The host/router will send all packets for a particular flow down one path. The host/router uses a hashing algorithm to determine which path to take.  Usually the algorithm uses some combination of layer 2, 3, and 4 information to pick which path to use.&#xA;The problem here is that depending on the environment, the flows can be very unbalanced. For example, if you use IP information, and you talk to one particular host (your VPS endpoint, for example), you will use only one link.  You will have to choose your algorithm carefully, depending on your particular usage.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Also, don't forget that you have to do this on both ends of the link.  It's not much benefit if your outgoing traffic is shared across multiple links but the inbound traffic uses only one.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-06-12T12:24:40.010" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41862" PostTypeId="1" AcceptedAnswerId="41875" CreationDate="2017-06-12T13:17:57.997" Score="1" ViewCount="439" Body="&lt;p&gt;Could you tell me what is the differences between the following Cisco XR commands: distance vs distance ospf/bgp ? I know the basics regarding administrative distance, that sets the priority for the protocol. If administrative distance smaller - higher prio. There are also some default adm distance values for protocols like- static route: 1, ospf: 90 etc... It could be also changed manually from 1-255 value. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's clear for me. But I don't understand the differences between these commands:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;From cisco spec:&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;distance (OSPF)&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To define an administrative distance, use the distance command in the appropriate mode. &lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;&lt;strong&gt;distance ospf&lt;/strong&gt;&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;To define Open Shortest Path First (OSPF) route administrative distances based on route type, use the distance ospf command&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="36132" LastActivityDate="2017-06-13T04:14:06.713" Title="distance vs distance ospf - commands Cisco XR" Tags="|cisco-commands|cisco-ios-xr|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41863" PostTypeId="2" ParentId="41010" CreationDate="2017-06-12T14:25:42.520" Score="2" Body="&lt;p&gt;open 192.168.1.1 log in to your modem and go to advanced--&gt;nat---&gt;alg--&gt; turn  on FTP and save and you're done&lt;/p&gt;&#xA;" OwnerUserId="37449" LastActivityDate="2017-06-12T14:25:42.520" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41864" PostTypeId="1" CreationDate="2017-06-12T14:49:14.797" Score="4" ViewCount="1560" Body="&lt;p&gt;I have two ASA 5525-X joined in cluster. Software on both ASAs is 9.7(1)4. I run them in multi-context mode. We will talk about admin context on which I have problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When ASA-1 is master and ASA-2 is slave - everything is ok. When I restart master unit (ASA-1) and ASA-2 becomes a master - everything is ok...until...ASA-1 re-join the cluster as slave unit. After that traffic from subnet &lt;em&gt;object network on2&lt;/em&gt; through admin context stops.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Syslog server reports an error: %ASA-3-210007: LU allocate xlate failed for dynamic-PAT TCP translation from inside : 192.168.1.1 / 12345 ( x.x.x.x / 12345) to outside : Real IP Address / Real Port ( Mapped IP Address / Mapped Port)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;x.x.x.x is public IP address on outside interface on my admin context on which I run PAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In Cisco documentation for this error we have:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;210007 Error Message %ASA-3-210007: LU allocate xlate failed for type&#xA;  [ static | dynamic ]-[ NAT | PAT ] secondary(optional) protocol&#xA;  translation from ingress interface name : Real IP Address / real port&#xA;  ( Mapped IP Address / Mapped Port) to egress interface name : Real IP&#xA;  Address / Real Port ( Mapped IP Address / Mapped Port) Explanation&#xA;  Stateful Failover failed to allocate a translation slot record.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;Recommended Action Check the available memory by using the show memory&#xA;  command to make sure that the ASA has free memory available. If no&#xA;  memory is available, add more memory.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I checked the memory, there is no problem with memory.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have found the documentation about this error on bug &lt;strong&gt;CSCue32221&lt;/strong&gt;, but there is message &quot;No users are affected&quot;, which is not my case. It is bug for software version 8.4(4.7), which also is not my case, and &quot;Failover along with twice nat commands configured&quot;...I don't have twice NAT, but I have:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;object network on1&#xA;nat (inside,outside) dynamic interface&#xA;object network on2&#xA;nat (inside,outside) dynamic interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What can I do?&lt;/p&gt;&#xA;" OwnerUserId="3481" LastEditorUserId="3481" LastEditDate="2017-06-13T14:43:07.523" LastActivityDate="2018-06-21T20:56:19.857" Title="Error Message %ASA-3-210007" Tags="|cisco-asa|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41866" PostTypeId="1" AcceptedAnswerId="41870" CreationDate="2017-06-12T16:07:56.650" Score="2" ViewCount="550" Body="&lt;p&gt;And if so, what is this feature called?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a plant floor setting I would like to simplify the a printing systems for the maintenance folks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each station consists of a very small form factor Windows 7/10 PC and an Ethernet printer. The PC has a single Ethernet port and cannot be easily expanded to two.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Right now each PC and printer has an manually assigned network IP address. The installed printer drivers have ports assigned to the printer for that particular line and spare printer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem comes when things get shifted do to repairs or testing. Over time as the number of units have increased it is getting harder to manage each station as replacing a computer or printer requires a lot of reconfiguration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to simplify the process by doing the following:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Set the PC to DHCP and have the DHCP server set a fixed IP via the MAC.&lt;/li&gt;&#xA;&lt;li&gt;Set a secondary fixed address on the Ethernet card in all the computers to some public IP (Ex: 192.168.1.1)&lt;/li&gt;&#xA;&lt;li&gt;Set all the printers for all lines to the same address such on that network such as 192.168.1.2&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This is the step I don't know if it can be done with a managed switch:&lt;/p&gt;&#xA;&#xA;&lt;ol start=&quot;4&quot;&gt;&#xA;&lt;li&gt;&lt;p&gt;Configure pairs of ports on the switch to separate VLANs so that each pair share the same 192.168.1.0 subnet. The means that the printer on port 2 and the printer on port 4 do not overlap because they are on separate VLANs but have the same address. We do not expect to be able to reach the printers from outside their paired PC.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Allow the main LAN traffic on the network to reach the PC via its primary DHCP assigned address.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;Repeat on additional pairs of ports for additional stations.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;This question is meant to determine if it this is a valid feature of smart manged switches or is strictly a routing problem.&lt;/p&gt;&#xA;" OwnerUserId="37451" LastActivityDate="2017-06-12T19:45:59.310" Title="Can a managed switch with VLANS have multiple identical subnets?" Tags="|switch|vlan|" AnswerCount="1" CommentCount="14" ContentLicense="CC BY-SA 3.0" />
  <row Id="41869" PostTypeId="1" AcceptedAnswerId="41871" CreationDate="2017-06-12T19:24:00.923" Score="0" ViewCount="528" Body="&lt;p&gt;I have found out a strange behaviour when trying to establish TCP session between Citrix host and back-end server on port 5060. When I perform 'telent 172.18.52.73 5060' from Citrix host I get &amp;quot;connected to...&amp;quot; message. The thing is that the destination server isn't listening on TCP port 5060 and I shoudn't get this message.&lt;/p&gt;&#xA;&lt;p&gt;According to the Wireshark results, destination server doesn't reply to 'TCP SYN' packet with 'TCP SYN, ACK' but it rather sends TCP retransmission.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BCXav.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BCXav.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;But when I check Wireshark results on the Citrix host (source of the traffic), I can see that session is established anyway, please see it below.&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/bWF7e.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/bWF7e.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Another thing is that when I get &amp;quot;connected to&amp;quot; message on Citrix host it isn't possible to send anything through it. I mean If I try to hit enter or any other key the session is imidiately closed. You can also see it in the picture above.&lt;/p&gt;&#xA;&lt;p&gt;This isn't currently affecting our network, but I'm simply wondering why it's happening. I have never seen it before. Bug, feature or Malware?&lt;/p&gt;&#xA;&lt;p&gt;Drawing for a better understanding:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lFh7U.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lFh7U.png&quot; alt=&quot;enter image description here&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Many thanks for any hits on that.&lt;/p&gt;&#xA;&lt;p&gt;Daniel&lt;/p&gt;&#xA;" OwnerUserId="10520" LastEditorUserId="-1" LastEditDate="2020-06-17T08:51:33.080" LastActivityDate="2017-06-12T19:47:15.903" Title="TCP session established even if the server isn't listening on particular port" Tags="|tcp|firewall|wireshark|fortigate|fortinet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41870" PostTypeId="2" ParentId="41866" CreationDate="2017-06-12T19:45:59.310" Score="2" Body="&lt;p&gt;Your scenario seems plausible and possible. The switch should not have issues with the same subnet being used on multiple VLANs because it doesn't even look at the &quot;Subnet&quot; or Layer 3 contents of the frames. Its job is to just forward frames into their proper broadcast domains.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But of course if you are using multiple VLANs for each pair, the primary DHCP scopes must be separate for each VLAN and the DHCP setup will be the tricky part here since, you either need to have a VLAN interface and a DHCP helper/relay IP on each primary subnet for each VLAN.&lt;/p&gt;&#xA;" OwnerUserId="24379" LastActivityDate="2017-06-12T19:45:59.310" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41871" PostTypeId="2" ParentId="41869" CreationDate="2017-06-12T19:47:15.903" Score="5" Body="&lt;p&gt;Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means that you are connecting to the SIP ALG on the Fortinet Firewall. And, since this is an application level gateway and not only some packet filter rules it will first accept the TCP connection before it tries to forward the connection to the original target system. Therefore you get a full TCP handshake between your system and the Firewall even though the final target does not listen to port 5060.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;I mean If I try to hit enter or any other key the session is imidiately closed. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;That's probably because you did not send a proper SIP request.&lt;/p&gt;&#xA;" OwnerUserId="4063" LastActivityDate="2017-06-12T19:47:15.903" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41873" PostTypeId="1" CreationDate="2017-06-12T22:24:14.450" Score="4" ViewCount="321" Body="&lt;p&gt;I have read &lt;a href=&quot;http://p4.org/wp-content/uploads/fixed/INT/INT-current-spec.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;this&lt;/a&gt; about INT and was wondering... where is all the INT data saved?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it in the packet metadata? and if so, does metadata count as a part of the total packet length?&#xA;I know metadata isn't a part of the packet per-se (hence the name META) but there is actual data there that needs to be sent.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Theoretically speaking there could be an infinite number of INT-capable devices between the INT-source and the INT-sink (i.e. INT-hops). Where do we save all that data?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A detailed explanation of INT in general will be appreciated also.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="37459" LastActivityDate="2018-06-09T06:00:47.950" Title="In‐band Network Telemetry (INT)" Tags="|vxlan|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41874" PostTypeId="1" CreationDate="2017-06-13T03:38:16.983" Score="1" ViewCount="880" Body="&lt;p&gt;I'm having trouble forwarding a port through PfSense&lt;br&gt;&#xA;PF WAN: 192.168.254.203&lt;br&gt;&#xA;PF LAN: 10.0.0.1&lt;br&gt;&#xA;Dest: 10.0.0.6  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;PfSense is able to ping and ssh .0.6 from local shell, test port works on LAN, but testing from WAN (and attempting ssh over 3g) fails. At a loss, any ideas?&#xA;&lt;a href=&quot;https://i.stack.imgur.com/k5qQM.png4&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/k5qQM.png4&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/aaKr8.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/aaKr8.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37463" LastActivityDate="2018-09-19T03:11:39.353" Title="PfSense Port Forwarding issues" Tags="|firewall|nat|pfsense|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41875" PostTypeId="2" ParentId="41862" CreationDate="2017-06-13T04:14:06.713" Score="2" Body="&lt;p&gt;The first command sets the AD for all routes learned by OSPF.  This is basically the traditional AD command, as seen in IOS since they invented dirt.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The second allows you to set different AD's for different &lt;em&gt;types&lt;/em&gt; of OSPF routes - so different values for externals vs inter-area vs intra-area.  I suppose the idea here is to be able to prefer, say, a route learned within an OSPF area to one learned from IS-IS but to continue to use the IS-IS route if the OSPF route is external (i.e. redistributed in).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I guess it's nice that such a knob exists and I'm sure it can be useful in some circumstances but can't help thinking that it'll all end in tears more times than not.  It's been my experience that if the answer to a question is tweaking AD that one is almost always better off asking a different question.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also - the default AD of OSPF on anything Cisco is 110.  EIGRP is 90.  &lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-06-13T04:14:06.713" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41876" PostTypeId="1" AcceptedAnswerId="41880" CreationDate="2017-06-13T05:31:33.270" Score="1" ViewCount="780" Body="&lt;p&gt;I wish to segment a network consisting on 150 tenant using vrf lite on Cisco 6800. The vrf configuration will be standalone as only the 6800 will be configured with vrf. Tenant's CPE will be connected via VLAN on the 6800 and will be on a separate vrf. Are there limitations using vrf lite?&lt;/p&gt;&#xA;" OwnerUserId="37467" LastActivityDate="2017-06-13T06:39:28.430" Title="Vrf-lite limitations on Cisco 6800" Tags="|cisco|network-core|mpls|vrf|vrf-lite|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41877" PostTypeId="1" AcceptedAnswerId="41879" CreationDate="2017-06-13T06:16:16.673" Score="3" ViewCount="289" Body="&lt;p&gt;Let us consider the scenario where two ASN's are announcing the same IP space however one has a summary route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASN 123: 200.13.0.0/17&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASN 234: 200.13.115.0/23&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Will traffic prefer to go to ASN 234, as it is the most specific route? Also, would anything stop either ASN from using a redistributed static route to handle the traffic after it is inside of their ASN?&lt;/p&gt;&#xA;" OwnerUserId="37468" LastActivityDate="2017-06-15T09:56:14.700" Title="BGP route selection" Tags="|routing|bgp|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41878" PostTypeId="2" ParentId="41877" CreationDate="2017-06-13T06:29:10.347" Score="3" Body="&lt;p&gt;More specific match is always going to be selected, so all the traffic will go to 234. You can't control how other ASNs are going to do their routing. If they decide to announce more specific static via redistribution then all the traffic will use it. However in normal situation ISP is not going to use static routes for subnet which is not part of their address space. &lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-06-13T06:29:10.347" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41879" PostTypeId="2" ParentId="41877" CreationDate="2017-06-13T06:29:21.063" Score="3" Body="&lt;p&gt;The basis of routing is that the more specific match is the primary criteria. So the /23 prefix will be preferred.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eBGP is used to exchange routes between AS. How routing is performed inside an AS is up to the owner of the AS, he can do whatever he wants, even static routing (or even iBGP).&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-06-13T06:29:21.063" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41880" PostTypeId="2" ParentId="41876" CreationDate="2017-06-13T06:39:28.430" Score="1" Body="&lt;p&gt;The new SUP-2T can support up to 4000 VRFs. This design has two main drawbacks which you need to consider:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;You will introduce single point of failure.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Routing between two different VRFs in future ( it is possible but it will require static routes or running standalone BGP on the box) &lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-06-13T06:39:28.430" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41886" PostTypeId="1" AcceptedAnswerId="41921" CreationDate="2017-06-13T11:17:25.720" Score="3" ViewCount="1847" Body="&lt;p&gt;As written in the &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791#page-20&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791&lt;/a&gt; this option is useful to record the addresses of the routers that an ip datagram goes through.&lt;/p&gt;&#xA;&lt;p&gt;I'm sending an ip datagram with an &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc792#page-14&quot; rel=&quot;nofollow noreferrer&quot;&gt;ICMP&lt;/a&gt; echo message, i've set the option type (of the header ip) on 7, the option length on 7 and the pointer on 4.&lt;/p&gt;&#xA;&lt;p&gt;I expect an echo reply with the first router address to come back, but this doesn't happends. Am i doing something wrong or the option is not supported anymore?(If i don't set the options, the echo response comes back as expect)&lt;/p&gt;&#xA;" OwnerUserId="37476" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-06-14T20:31:35.003" Title="How does the ipv4 option &quot;record route&quot; work?" Tags="|ipv4|network|rfc|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41888" PostTypeId="1" AcceptedAnswerId="41889" CreationDate="2017-06-13T14:44:39.737" Score="2" ViewCount="1717" Body="&lt;p&gt;I know how it is done, but my professor is unable to explain me the core concept(bits and bytes). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, He said &lt;code&gt;200.1.0.0/24&lt;/code&gt; and &lt;code&gt;200.1.1.0/24&lt;/code&gt; can be combined to form a network with 500 IP addresses but &lt;code&gt;200.1.1.0/24&lt;/code&gt; and &lt;code&gt;200.1.2.0/24&lt;/code&gt; cannot!? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am unable to understand his logic of some adjacent network and delta value (which is 2 here). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone explain ? Thanks in advance!!&lt;/p&gt;&#xA;" OwnerUserId="37477" LastEditorUserId="16654" LastEditDate="2017-06-13T15:12:53.080" LastActivityDate="2017-06-13T17:10:08.337" Title="What are the rules to combine two networks to form a supernet? (CIDR, supernetting)" Tags="|ip|ip-address|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41889" PostTypeId="2" ParentId="41888" CreationDate="2017-06-13T14:51:27.953" Score="4" Body="&lt;p&gt;The dotted decimal (x.x.x.x) notation is tripping you up.  IP addresses are 32 bit binary numbers.  The dotted decimal notation is only to make the numbers easier to read by humans.  If you convert the addresses into binary, you'll see that your first example falls on a bit boundary, but your second example does not.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-06-13T14:51:27.953" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41890" PostTypeId="2" ParentId="28446" CreationDate="2017-06-13T15:58:33.133" Score="-1" Body="&lt;p&gt;Two devices on the same VLAN can communicate even if they have different subnet addresses. If the two are aware of their MAC adresses. You can define the MAC  address of a device using ARP command on command line of a PC. Nonetheless I am not totally sure if this is sufficient if you carry on this operation only on one of the two devices. &lt;/p&gt;&#xA;" OwnerUserId="37483" LastActivityDate="2017-06-13T15:58:33.133" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41893" PostTypeId="2" ParentId="41888" CreationDate="2017-06-13T17:10:08.337" Score="2" Body="&lt;p&gt;200.1.1.0/24 and 200.1.2.0/24 can also be supernetted, but due to the third octets' bit patterns ...01 and ...10 you'll need to remove &lt;em&gt;two&lt;/em&gt; bits from the netmask, ie. 200.1.0.0/22 (200.1.0.0 through 200.1.3.255).&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-13T17:10:08.337" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41894" PostTypeId="2" ParentId="3321" CreationDate="2017-06-13T18:29:58.247" Score="0" Body="&lt;p&gt;Here is a good reason to have multiple routers and subnets. We have a huge (600,000 sq feet) warehouse that is filled with access points.  They all ended up going to the main router.  Handheld scanners are used by pickers and seamlessly switches from one access point to another as the picker moves about the warehouse.  However, they also have some regular PC workstations for printing pick tickets, returns, looking things up, etc.  They don't move.  For some reason they will sometimes connect to an access point 300 yards away and get a weak connection, which drops in the middle of doing work.  The solution was to put a router above the workstations (all in one place) with a different subnet mask.  The workstation DHCP to that subnet only (so never 300 yards away).  That router then has a static route or bridge (never sure of the right term) that makes it &quot;join&quot; the main network.  That ways the hand held scanners can get any access point they want and change them as people move, and the workstations always have a nearby router (on the ceiling, line of sight) to connect to.  That router is hardwired into a switch which is hardwired back to the computer room.  If you don't put the static route in they become independent which is sometimes good for security.  I always heard this call a &quot;silo&quot; system.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It is not hard to do and gives you more control over what connects to what.  We can also firewall the workstations independently from the rest of the main network -- disallowing external access in or out (they are only needed for internal access) in the case where you do connect them with a static route.  If they are independent they just share the WAN.  And cannot get to each other, so you have good security.&lt;/p&gt;&#xA;" OwnerUserId="37489" LastActivityDate="2017-06-13T18:29:58.247" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41895" PostTypeId="2" ParentId="41886" CreationDate="2017-06-13T18:44:57.950" Score="2" Body="&lt;p&gt;RFC 791 is 36 years old and this option has never been adopted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please mark this question as answered or it'll keep popping up.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-14T18:50:39.920" LastActivityDate="2017-06-14T18:50:39.920" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41897" PostTypeId="1" AcceptedAnswerId="41905" CreationDate="2017-06-13T19:35:48.857" Score="4" ViewCount="28010" Body="&lt;p&gt;Forgive me if this question is not for here. I have a situation where I need to connect Site-to-Site VPN between two offices but the company is small and a startup with a very tight budget. Thing is that the two offices have just a single static public IP. The routers in the offices do not have a VPN capability however it is possible for me to NAT/PAT individual devices out of the network, as well as to add additional static routes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible for me to create a site to site tunnel behind NAT? I was thinking to deploy two PFsense VMs and use those to create the IPSec tunnel? Any other suggestion is welcomed, like a Linux box with Openswan/Strongswan etc. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So far my experience is mostly with Cisco, Palo Alto, Sonicwall and stuff and I have little experience with theese OpenVPN solutions so I was wandering if it is possible?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A short overview of how the network diagram would be:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/vF4Rr.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/vF4Rr.png&quot; alt=&quot;IPSec behind NAT Diagram&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="3619" LastEditorUserId="3619" LastEditDate="2017-06-13T19:41:07.280" LastActivityDate="2017-06-14T06:10:09.467" Title="Site-To-Site IPSec Tunnel behind NAT" Tags="|vpn|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41901" PostTypeId="1" AcceptedAnswerId="41906" CreationDate="2017-06-14T02:02:09.303" Score="2" ViewCount="239" Body="&lt;p&gt;Is there a way to test how many clients can connect a given AP BSSID using a laptop or a dedicated device?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I want to know that N is my real concurrent number of clients​ connected, and when N+1 arrives, it would be dropped or not accepted due to an overwhelm.&lt;/p&gt;&#xA;" OwnerUserId="19355" LastEditorUserId="20757" LastEditDate="2017-06-14T05:10:51.293" LastActivityDate="2017-06-14T07:09:01.040" Title="How to test the maximum of clients connected to an AP?" Tags="|wireless|access-point|testing|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41902" PostTypeId="1" CreationDate="2017-06-14T03:07:04.260" Score="7" ViewCount="389" Body="&lt;p&gt;I'm a desktop support engineer working with a Cisco certified manager. I value her opinion greatly when it comes to networking issues. However, I'm split on this because with my knowledge of networking (granted not as much as hers) I don't see how this particular setup would be a problem. But here goes:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our boss asked us for a fairly cheap solution which places 6-7 client machines, 2 printers in a trailer outside of our building. The network inside the building consists of several Cisco devices such as ASA, 3750 switches, routers, etc. She asked me what my solution would be.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My solution:&#xA;Run a Cat6 cable from one of the 3750 switches to the trailer and add two 8 port retail switches. The client machines and printers would connect to the switch and from there to the 3750's and our network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;She said this wouldn't work because there is no STP on the switches and if anyone were to plug in a cable both ends into the retail switch it would cause a network storm on our entire network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My problem with this is that wouldn't the 3750's STP prevent that from happening?&lt;/p&gt;&#xA;" OwnerUserId="2349" LastActivityDate="2018-08-13T15:27:22.797" Title="Manager states we cannot put retail switches on network due to fear of non-STP config and network storm problems. Is this true?" Tags="|cisco|spanning-tree|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41904" PostTypeId="2" ParentId="41902" CreationDate="2017-06-14T05:12:40.300" Score="9" Body="&lt;p&gt;Great question!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;This is because a &lt;a href=&quot;https://en.wikipedia.org/wiki/Switching_loop&quot; rel=&quot;nofollow noreferrer&quot;&gt;layer-2 switching loop&lt;/a&gt; can form on the Consumer-grade switching equipment which could produce &lt;a href=&quot;https://en.wikipedia.org/wiki/Broadcast_radiation&quot; rel=&quot;nofollow noreferrer&quot;&gt;Broadcast Radiation&lt;/a&gt; and impact devices connected to the broadcast domain.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/Spanning_Tree_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;STP&lt;/a&gt; was originally standardized as IEEE 802.1D.  Its purpose is to build loop-free, layer 2 typologies.  &lt;em&gt;STP does &lt;strong&gt;not&lt;/strong&gt; detect and then mitigate Broadcast Radiation.&lt;/em&gt;  STP builds loop-free topologies by sending special frames called &lt;a href=&quot;https://en.wikipedia.org/wiki/Bridge_Protocol_Data_Unit&quot; rel=&quot;nofollow noreferrer&quot;&gt;Bridge Protocol Data Units&lt;/a&gt;.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&lt;em&gt;BPDUs are sent out as multicast frames to which only other layer 2&#xA;  switches or bridges are listening. If any loops (multiple possible&#xA;  paths between switches) are found in the network topology, the&#xA;  switches will co-operate to disable a port or ports to ensure that&#xA;  there are no loops; that is, from one device to any other device in&#xA;  the layer 2 network, only one path can be taken.&lt;/em&gt; - &lt;em&gt;&lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/wireless/access_point/1300/12-2_15_JA/configuration/guide/o13span.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring Spanning Tree Protocol&lt;/a&gt;&lt;/em&gt;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To oversimplify, devices running STP will broadcast BPDUs and listen for duplicate messages.  If duplicate messages are heard, a loop will be detected and the STP domain will converge by blocking the appropriate ports.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many consumer-grade devices such as this &lt;a href=&quot;http://content.us.dlink.com/wp-content/uploads/2014/03/DES-105_108_C2_2014.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;common D-Link switch&lt;/a&gt;, do not call out support for IEEE 802.1D or newer flavors of STP.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Consumer-grade devices, without this mechanism, can form a loop between itself, or with another consumer-grade layer-2 device.  The rest of the broadcast domain could be then subjected to the resulting crippling broadcast traffic even though it is not a part of the actual layer-2 switching loop.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are some mechanisms (such as &lt;a href=&quot;https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst3750x_3560x/software/release/12-2_53_se/configuration/guide/3750xscg/swtrafc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Storm Control&lt;/a&gt;) and strategies to reduce the risk and the effects of the negative traffic but they are outside the scope of this post.  &lt;/p&gt;&#xA;" OwnerUserId="32112" LastEditorUserId="32112" LastEditDate="2018-08-13T15:27:22.797" LastActivityDate="2018-08-13T15:27:22.797" CommentCount="3" ContentLicense="CC BY-SA 4.0" />
  <row Id="41905" PostTypeId="2" ParentId="41897" CreationDate="2017-06-14T06:10:09.467" Score="2" Body="&lt;p&gt;As long as you can NAT the required protocol and ports (see below) on the routers, you can use any VPN solution that support &lt;em&gt;NAT-Traversal&lt;/em&gt; (NAT-T) to establish an IPSEC tunnel (as commented by Zac67)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;pfSense does support NAT-T, so you're good to go.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you already find out, OpenVPN is commonly used in such case, because it is very NAT-friendly, and it is also supported by pfSense.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPSEC, you need to open / forward / PAT  the following:   &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;UDP 500&lt;/li&gt;&#xA;&lt;li&gt;UDP 4500&lt;/li&gt;&#xA;&lt;li&gt;ESP  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Some access router have a specific feature to forward IPSEC packets. Others simply cannot forward ESP, in this case there's often a DMZ option (that will forward all incoming traffic to a given internal host) that could be used.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-06-14T06:10:09.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41906" PostTypeId="2" ParentId="41901" CreationDate="2017-06-14T07:09:01.040" Score="1" Body="&lt;p&gt;From what I know there are no upper limits in the 802.11 protocol. There are software limits in some of the AP's I've worked with. Aerohive usually have 100 concurrent stations on most AP's.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The way wifi works is that only one client can talk to the AP at any given time. So the more stations, less time to talk for every each one of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My guess is that whatever AP you have, the upper limit will be the when the amount of RAM runs out, or the conn-track table is full and hogs the CPU too much.&lt;/p&gt;&#xA;" OwnerUserId="16630" LastActivityDate="2017-06-14T07:09:01.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41907" PostTypeId="1" AcceptedAnswerId="41909" CreationDate="2017-06-14T07:24:42.437" Score="1" ViewCount="2518" Body="&lt;p&gt;I am trying a configure a 2811 Cisco router on packet tracer to be a DHCP server for 3 hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is the running config I have as of now:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Building configuration...&#xA;&#xA;Current configuration : 657 bytes&#xA;!&#xA;version 12.4&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname r1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip dhcp pool stackexchange&#xA; network 192.168.0.0 255.255.255.0&#xA; default-router 192.168.0.1&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.0.1 255.255.255.0&#xA; duplex auto&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The configuration is as suggested by @Andrey Prokhorov but now I found no &quot;lease&quot; command.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/eHDl6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/eHDl6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I must be able to have the DHCP service working on all 3 host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xdncl.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xdncl.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37501" LastEditorUserId="37501" LastEditDate="2017-06-14T12:27:21.373" LastActivityDate="2017-06-14T12:27:21.373" Title="Setting up router as a DHCP server on packet tracer for a 2811 router and 3 hosts" Tags="|cisco-ios|packet-tracer|" AnswerCount="1" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="41908" PostTypeId="2" ParentId="38846" CreationDate="2017-06-14T07:35:52.103" Score="-3" Body="&lt;p&gt;Switches can be a valuable asset to networking. Overall, they can increase the capacity and speed of your network. However, switching should not be seen as a cure-all for network issues. Before incorporating network switching, you must first ask yourself two important questions: First, how can you tell if your network will benefit from switching? Second, how do you add switches to your network design to provide the most benefit?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's something I read about switches, might help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.lantronix.com/resources/networking-tutorials/network-switching-tutorial/&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.lantronix.com/resources/networking-tutorials/network-switching-tutorial/&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37502" LastActivityDate="2017-06-14T07:35:52.103" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41909" PostTypeId="2" ParentId="41907" CreationDate="2017-06-14T07:46:01.370" Score="3" Body="&lt;p&gt;Lets assume you want to deliver IP addresses to your interface Gi0/0 (addr 192.168.0.1) network 192.168.0.0/24, also you have DNS server 192.168.0.5. Then you should define DHCP pool with options:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;service dhcp&#xA;ip dhcp pool NET_192.168.0.0&#xA; network 192.168.0.0 255.255.255.0&#xA; default-router 192.168.0.1&#xA; dns-server 192.168.0.5&#xA; lease 7&#xA; domain-name net.local&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will enable DHCP service for your 192.168.0.0/24 network with lease time for each address in 7 days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, you can exclude IP addresses from distributed scope by entering command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address 192.168.0.1 192.168.0.10&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will prevent issuance of addresses 192.168.0.1 thru 192.168.0.10. You can add many of that entries. Exclude records can consist of only one address:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip dhcp excluded-address 192.168.0.200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can find more about configuring DHCP server in Cisco IOS here - &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_dhcp/configuration/12-4t/dhcp-12-4t-book/config-dhcp-server.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring DHCP&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="29556" LastActivityDate="2017-06-14T07:46:01.370" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41910" PostTypeId="1" CreationDate="2017-06-14T08:39:48.747" Score="5" ViewCount="11341" Body="&lt;p&gt;Were setting up a pfsense box as a virtual machine inside a VMWare ESXi 6.0 environment (&lt;a href=&quot;https://www.emc.com/en-us/converged-infrastructure/vxrail/index.htm&quot; rel=&quot;nofollow noreferrer&quot;&gt;inside a VXRail hyper-converged Box&lt;/a&gt;). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The target configuration is that to access any machine within this box, you need to go through the Firewall. Traffic between machines within the same box also need to go through the firewall. Since they are different servers e.g. Web Server, Database Server, the VMs are setup to be in different VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As such, we've setup pfSense with two interfaces. One is the WAN that will be used by the &quot;Outside World&quot; to communicate to servers within the ESXI environment and the other is a Trunk that should then connect to all the VLANs protected by the pfSense box.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;ESXi:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We've followed &lt;a href=&quot;https://kb.vmware.com/selfservice/search.do?cmd=displayKC&amp;amp;docType=kc&amp;amp;docTypeID=DT_KB_1_1&amp;amp;externalId=1004252&quot; rel=&quot;nofollow noreferrer&quot;&gt;the guide here&lt;/a&gt; to setup a Distributed vSwitch in VxRail. we've setup a distributed port group? of VLAN Type VLAN Trunking and with VLAN IDs 0-200:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9WEQ6.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9WEQ6.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To our understanding, this Port Group is what we will attach to pfsense Trunk so that it is able to &quot;read&quot; all the VLAN tagged traffic?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Trunk on PfSense:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To create a trunk on pfsense is basically adding the NIC to the pfsense VM. The NIC should be the Port Group we've created above.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4vpt2.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4vpt2.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;VLAN on pfSense:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;After that we create a VLAN on pfSense and add a VLAN ID. This VLAN is sitting on the Trunk we've created above. Example below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/9P5CP.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9P5CP.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We then add an interface based on this VLAN and give it an IP of &lt;code&gt;192.168.152.1&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/nJFqk.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/nJFqk.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6SA7z.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6SA7z.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Protected Machine:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We then create a machine that will be protected by the firewall. So first, we add an NIC to it. The NIC is based on a host network that has a VLAN tag e.g. 152 as seen below.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/6qDJW.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/6qDJW.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/2P8FS.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/2P8FS.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We then assign the protected machine an IP of &lt;code&gt;192.168.152.10&lt;/code&gt; with a default gateway of &lt;code&gt;192.168.152.1&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Problem Statement:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Issue is, after doing all this, the protected machine cannot ping its default gateway. The default gateway cannot ping that machine. It's like there is no communication between them at all. We've added a firewall rule to allow all traffic on Interface152 and logged everything but we cannot see any traffic being accepted or rejected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What could we have missed? The biggest confusion we have is on the VXRail ESXI setup but any correction on pfSense setup is also welcome.&lt;/p&gt;&#xA;" OwnerUserId="4111" LastEditorUserId="4111" LastEditDate="2017-06-14T08:58:44.453" LastActivityDate="2020-09-21T11:02:50.337" Title="pfSense &amp; VMWare ESXi VLAN integration" Tags="|vlan|pfsense|vmware|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="41914" PostTypeId="2" ParentId="41902" CreationDate="2017-06-14T11:23:50.833" Score="2" Body="&lt;p&gt;STP will hopefully prevent a loop involving the STP capable switches (unless the non-stp switches filter out the STP packets), but it won't prevent a loop involving only the non-stp switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Possible solutions include.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Look into the port protection features on your cisco switch. There are &quot;storm control&quot; options that can block a port if it sources too much broadcast traffic. There are mac address limiting functions that can block a port if it shows two many source MAC addresses.&lt;/li&gt;&#xA;&lt;li&gt;Try and find a middle ground switch that is cheaper than the ciscos but still high enough up the market to support the spanning tree variant you use.&lt;/li&gt;&#xA;&lt;li&gt;If you have a spare router/firewall port put the trailer on that with it's own subnet. Ethernet storms won't cross a router.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastEditorUserId="20201" LastEditDate="2017-06-14T11:34:31.307" LastActivityDate="2017-06-14T11:34:31.307" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41915" PostTypeId="1" CreationDate="2017-06-14T12:00:27.107" Score="3" ViewCount="2016" Body="&lt;p&gt;If you check &lt;em&gt;show int tranceiver&lt;/em&gt; command on Nexus Switch 10Gbit Ethernet port, the output shows the nominal bitrate is 12000 MBits/sec instead of 10000 MBits/sec. As I know 12 bytes Interframe Gap + 8 bytes preamble + 18 bytes frame header and FCS are all included in bandwidth 10000 MBits/sec of 10Gig Ethernet. So what is 2000 Mbit/sec overhead used for?  &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch# show interface Ethernet1/5 transceiver&#xA;Ethernet1/5&#xA;sfp is present&#xA;name is CISCO-MOLEX INC&#xA;part number is 74752-9025&#xA;revision is A&#xA;serial number is MOC12302468&#xA;nominal bitrate is 12000 MBits/sec&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34394" LastActivityDate="2017-06-15T06:52:28.160" Title="What is Interface's Nominal Bitrate?" Tags="|ethernet|bandwidth|cisco-nexus|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41916" PostTypeId="2" ParentId="41915" CreationDate="2017-06-14T12:26:42.367" Score="2" Body="&lt;p&gt;The nominal bit rate is the symbol rate. Some &lt;a href=&quot;https://en.wikipedia.org/wiki/Gigabit_Ethernet&quot; rel=&quot;nofollow noreferrer&quot;&gt;Gigabit Ethernet&lt;/a&gt; standards uses 8b/10b encoding, which inflates the line rate from 1 Gbps to 1.25 Gbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For 10 Gb Ethernet, it normally uses 64b/66b encoding and shouldn't have such a high symbol rate, so I'd say there is an additional reason that inflates the line rate.&lt;/p&gt;&#xA;" OwnerUserId="24434" LastActivityDate="2017-06-14T12:26:42.367" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41917" PostTypeId="1" AcceptedAnswerId="42268" CreationDate="2017-06-14T14:26:04.230" Score="1" ViewCount="1646" Body="&lt;p&gt;I am using a Ubiquity Edgerouter X, which is connected to a Draytek modem. This is the log from the pppoe interface:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;#######@ubnt:~$ show interfaces pppoe pppoe0 log&#xA;Tue Jun 13 06:26:00 IST 2017: PPP interface pppoe0 created&#xA;Tue Jun 13 06:26:01 IST 2017: Stopping PPP daemon for pppoe0&#xA;Tue Jun 13 06:26:02 IST 2017: Starting PPP daemon for pppoe0&#xA;Connected to 00:d0:f6:c9:5e:f9 via interface eth0&#xA;using channel 1&#xA;Using interface ppp0&#xA;Connect: ppp0 &amp;lt;--&amp;gt; eth0&#xA;sent [LCP ConfReq id=0x1 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0xeb709638&amp;gt;]&#xA;rcvd [LCP ConfAck id=0x1 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0xeb709638&amp;gt;]&#xA;sent [LCP ConfReq id=0x1 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0xeb709638&amp;gt;]&#xA;rcvd [LCP ConfAck id=0x1 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0xeb709638&amp;gt;]&#xA;rcvd [LCP ConfReq id=0x55 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0x4f89f808&amp;gt;]&#xA;lcp_reqci: returning CONFACK.&#xA;sent [LCP ConfAck id=0x55 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0x4f89f808&amp;gt;]&#xA;sent [LCP EchoReq id=0x0 magic=0xeb709638]&#xA;peer from calling number 00:D0:F6:**:**:** authorized&#xA;sent [IPCP ConfReq id=0x1 &amp;lt;addr 0.0.0.0&amp;gt; &amp;lt;ms-dns1 0.0.0.0&amp;gt; &amp;lt;ms-dns3 0.0.0.0&amp;gt;]&#xA;rcvd [IPCP ConfReq id=0xbc &amp;lt;addr 86.***.***.***&amp;gt;]&#xA;ipcp: returning Configure-ACK&#xA;sent [IPCP ConfAck id=0xbc &amp;lt;addr 86.***.***.***&amp;gt;]&#xA;rcvd [IPV6CP ConfReq id=0x2 &amp;lt;addr fe80::02d0:f6ff:fec9:5d80&amp;gt;]&#xA;Unsupported protocol 'IPv6 Control Protovol' (0x8057) received&#xA;sent [LCP ProtRej id=0x2 80 57 01 02 00 0e 01 0a 02 d0 f6 ff fe c9 5d 80]&#xA;rcvd [IPCP ConfNak id=0x1 &amp;lt;addr 86.***.***.***&amp;gt; &amp;lt;ms-dns1 159.134.0.1&amp;gt; &amp;lt;ms-dns3 159.134.0.2&amp;gt;]&#xA;sent [IPCP ConfReq id=0x2 &amp;lt;addr 86.***.***.***&amp;gt; &amp;lt;ms-dns1 159.134.0.1&amp;gt; &amp;lt;ms-dns3 159.134.0.2&amp;gt;]&#xA;rcvd [LCP EchoRep id=0x0 magic=0x4f89f808]&#xA;rcvd [IPV6CP TermReq id=0x3]&#xA;Unsupported protocol 'IPv6 Control Protovol' (0x8057) received&#xA;sent [LCP ProtRej id=0x3 80 57 05 03 00 04]&#xA;rcvd [IPCP ConfAck id=0x2 &amp;lt;addr 86.***.***.***&amp;gt; &amp;lt;ms-dns1 159.134.0.1&amp;gt; &amp;lt;ms-dns3 159.134.0.2&amp;gt;]&#xA;ipcp: up&#xA;Script /etc/ppp/ip-pre-up started (pid 1537)&#xA;Script /etc/ppp/ip-pre-up finished (pid 1537), status = 0x0&#xA;local  IP address 86.***.***.***&#xA;remote IP address 86.***.***.***&#xA;primary   DNS address 159.134.0.1&#xA;secondary DNS address 159.134.0.2&#xA;Script /etc/ppp/ip-up started (pid 1592)&#xA;rcvd [IPV6CP TermReq id=0x4]&#xA;Unsupported protocol 'IPv6 Control Protovol' (0x8057) received&#xA;sent [LCP ProtRej id=0x4 80 57 05 04 00 04]&#xA;Script /etc/ppp/ip-up finished (pid 1592), status = 0x0&#xA;rcvd [LCP ConfReq id=0x10 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0x798f51e9&amp;gt;]&#xA;ipcp: down&#xA;Connect time 1741.9 minutes.&#xA;Sent 127000962 bytes, received 396463381 bytes.&#xA;Script /etc/ppp/ip-down started (pid 23303)&#xA;sent [LCP ConfReq id=0x5 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0xb97c6200&amp;gt;]&#xA;lcp_reqci: returning CONFACK.&#xA;sent [LCP ConfAck id=0x10 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0x798f51e9&amp;gt;]&#xA;rcvd [LCP TermReq id=0x56]&#xA;sent [LCP TermAck id=0x56]&#xA;sent [LCP ConfReq id=0x5 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0xb97c6200&amp;gt;]&#xA;Script /etc/ppp/ip-down finished (pid 23303), status = 0x0&#xA;sent [LCP ConfReq id=0x5 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0xb97c6200&amp;gt;]&#xA;sent [LCP ConfReq id=0x5 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0xb97c6200&amp;gt;]&#xA;sent [LCP ConfReq id=0x5 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0xb97c6200&amp;gt;]&#xA;... repeats&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I don't understand why the device disconnects upon receiving rcvd &lt;code&gt;[IPCP ConfReq&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;rcvd [LCP ConfReq id=0x10 &amp;lt;mru 1492&amp;gt; &amp;lt;magic 0x798f51e9&amp;gt;]&#xA;ipcp: down&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I am interpreting the log correctly?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The device will then drop its pppoe connection and sends &lt;code&gt;LCP ConfReq&lt;/code&gt;-s in a loop. If I restart the pppoe interface, the connection comes back up. Which, to my knowledge, will again send an &lt;code&gt;LCP ConfReq&lt;/code&gt; - how could it this time succeed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, there is no CHAP or PAP authentification succeeded, yet the connection is up?&lt;/p&gt;&#xA;" OwnerUserId="18944" LastEditorUserId="18944" LastEditDate="2017-06-16T23:10:27.763" LastActivityDate="2017-06-29T09:56:06.723" Title="How to decipher, why the pppoe interface has disconnected?" Tags="|pppoe|ppp|ubiquiti|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="41918" PostTypeId="2" ParentId="41745" CreationDate="2017-06-14T15:02:59.437" Score="1" Body="&lt;p&gt;The apparent &quot;hanging&quot; is caused by the delay in doing name resolution (DNS) lookups.  If you don't have name resolution available, you can disable the lookup with the command &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;no ip domain-lookup&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-06-14T15:02:59.437" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41921" PostTypeId="2" ParentId="41886" CreationDate="2017-06-14T20:31:35.003" Score="3" Body="&lt;p&gt;Strictly about question: It works as stated by RFC791, as you have figured.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;&quot;I expect an echo reply with the first router address to come back, but this doesn't happends.&quot;&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If you are doing this out on the wild, as it's you on your computer pinging some random IP from the Internet, it won't work as this is considered a security vulnerability and hence likely moderated by ISP's/others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Such risk can be seen for example &lt;a href=&quot;https://tools.cisco.com/security/center/viewIpsSignature.x?signatureId=7168&amp;amp;signatureSubId=0&amp;amp;softwareVersion=6.0&amp;amp;releaseVersion=S906&quot; rel=&quot;nofollow noreferrer&quot;&gt;&#xA;Cisco Security&#xA;ICMP Record Route vulnerability&#xA;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To test this feature you will probably need to have your own devices/images, regardless of the intended OS to get this setting working.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Real life usage for 'record route' can be seen in RSVP for MPLS.&lt;/p&gt;&#xA;" OwnerUserId="35590" LastActivityDate="2017-06-14T20:31:35.003" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41927" PostTypeId="1" CreationDate="2017-06-14T22:48:28.863" Score="1" ViewCount="89" Body="&lt;p&gt;I just unsheathed an Ethernet cable and probed it with a scope. What I see is an almost perfect 60Hz sine wave signal. Why is this? I can't find anything that would explain to me why this is the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I expect to see at least is a modulated signal, but in this case all I see is a clean sine wave. I am continuously running a ping command on the computers connected to both ends of the Ethernet cable.&lt;/p&gt;&#xA;" OwnerUserId="10099" LastActivityDate="2017-06-14T23:33:31.753" Title="60Hz Ethernet Wave" Tags="|ethernet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41928" PostTypeId="2" ParentId="41927" CreationDate="2017-06-14T23:23:25.743" Score="4" Body="&lt;p&gt;A: your scope (or probe, or whatever you have between the probe and the wire) isn't fast enough.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;B: you are not running a differential probe.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ethernet signals are differential - the 60 (or elsewhere 50) Hz picked up from electrical supply wiring is picked up by both wires equally and rejected at the receiver, which only looks at the difference in the signals. If you don't do the same, you can't see the signals (it's a scale problem - they are there, but hard to see.) Also, if you can see the 60 Hz wave, you can't see the 100-250MHz-class signals at the same time on nearly all scopes, as the time domain is vastly different - so even if your scope is fast enough, your display window isn't.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If your scope and probes are fast enough, try sampling both wires in one pair and subtracting (the crude approach to a differential signal.)&lt;/p&gt;&#xA;" OwnerUserId="2301" LastEditorUserId="2301" LastEditDate="2017-06-14T23:33:31.753" LastActivityDate="2017-06-14T23:33:31.753" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41929" PostTypeId="1" AcceptedAnswerId="41930" CreationDate="2017-06-14T23:25:13.983" Score="3" ViewCount="854" Body="&lt;p&gt;If I configure one switch with all access ports in VLAN 10 and connect it to a switch with all access ports in VLAN 20, a host on the first switch will be able to communicate with a host on the second switch if both hosts are in the same subnet. However, if I have one switch with two hosts connected to it in the same subnet but on different VLANs, they are unable to communicate. Could anyone explain how this works to me? Thanks!&lt;/p&gt;&#xA;" OwnerUserId="30549" LastActivityDate="2017-06-15T03:24:37.280" Title="How do VLANs differ between connected switches vs a single switch?" Tags="|switch|vlan|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41930" PostTypeId="2" ParentId="41929" CreationDate="2017-06-14T23:31:12.590" Score="3" Body="&lt;p&gt;The key is probably how you are connecting the switches - sounds like NOT a trunk that preserves VLAN10 and VLAN20. With more detail from you, more detail might be possible, but that would seem to be the likely cause.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2017-06-14T23:31:12.590" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="41932" PostTypeId="2" ParentId="41929" CreationDate="2017-06-15T03:24:37.280" Score="0" Body="&lt;p&gt;A trunk port adds a header that identifies the VLAN to all but the Native VLAN.&#xA;An access port strips the header off.&#xA;As traffic passes the access port, it assumes the VLAN based on what was assigned locally.&lt;/p&gt;&#xA;" OwnerUserId="37431" LastActivityDate="2017-06-15T03:24:37.280" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41934" PostTypeId="2" ParentId="41915" CreationDate="2017-06-15T06:52:28.160" Score="2" Body="&lt;p&gt;Transceivers are most often designated by the standard transmission speed on the medium (e.g. 1.25 Gbit/s for Gigabit Ethernet or 10.3125 Gbit/s for 10 Gigabit Ethernet), but sometimes they are labeled with their nominal Ethernet speed or a higher speed the manufacturer specifies. This is because it operates in a connectionless mode and nominally (due to possible packet loss) offers e.g. 1.25 Gbit/s. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Source: &lt;a href=&quot;https://books.google.dk/books?id=ha0veu076xoC&amp;amp;pg=PA22&amp;amp;lpg=PA22&amp;amp;dq=nominal%20Ethernet%20speed%201.25%20gbit&amp;amp;source=bl&amp;amp;ots=-MfGInXlrH&amp;amp;sig=k2SEfRfLd11mySyNxcR3TgpfI44&amp;amp;hl=da&amp;amp;sa=X&amp;amp;ved=0ahUKEwjCut3Rnr_UAhUSJ1AKHQlgALsQ6AEITzAF#v=onepage&amp;amp;q=nominal%20Ethernet%20speed%201.25%20gbit&amp;amp;f=false&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://books.google.dk/books?id=ha0veu076xoC&amp;amp;pg=PA22&amp;amp;lpg=PA22&amp;amp;dq=nominal+Ethernet+speed+1.25+gbit&amp;amp;source=bl&amp;amp;ots=-MfGInXlrH&amp;amp;sig=k2SEfRfLd11mySyNxcR3TgpfI44&amp;amp;hl=da&amp;amp;sa=X&amp;amp;ved=0ahUKEwjCut3Rnr_UAhUSJ1AKHQlgALsQ6AEITzAF#v=onepage&amp;amp;q=nominal%20Ethernet%20speed%201.25%20gbit&amp;amp;f=false&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastActivityDate="2017-06-15T06:52:28.160" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41936" PostTypeId="2" ParentId="41877" CreationDate="2017-06-15T09:56:14.700" Score="-1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;BGP uses TCP as the transport protocol, on port 179. Two BGP routers&#xA;  form a TCP connection between one another. These routers are peer&#xA;  routers. The peer routers exchange messages to open and confirm the&#xA;  connection parameters. BGP routers exchange network reachability&#xA;  information. This information is mainly an indication of the full&#xA;  paths that a route must take in order to reach the destination&#xA;  network. The paths are BGP AS numbers. This information helps in the&#xA;  construction of a graph of ASs that are loop-free. The graph also&#xA;  shows where to apply routing policies in order to enforce some&#xA;  restrictions on the routing behavior. Any two routers that form a TCP&#xA;  connection in order to exchange BGP routing information are &quot;peers&quot; or&#xA;  &quot;neighbors&quot;. BGP peers initially exchange the full BGP routing tables.&#xA;  After this exchange, the peers send incremental updates as the routing&#xA;  table changes. BGP keeps a version number of the BGP table. The&#xA;  version number is the same for all the BGP peers. The version number&#xA;  changes whenever BGP updates the table with routing information&#xA;  changes. The send of keepalive packets ensures that the connection&#xA;  between the BGP peers is alive. Notification packets go out in&#xA;  response to errors or special conditions.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;you should read this it might help.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/26634-bgp-toc.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/support/docs/ip/border-gateway-protocol-bgp/26634-bgp-toc.html&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37502" LastActivityDate="2017-06-15T09:56:14.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41938" PostTypeId="2" ParentId="40438" CreationDate="2017-06-15T10:55:56.943" Score="1" Body="&lt;p&gt;&lt;strong&gt;VC networks&lt;/strong&gt; as X.25 or Frame Relay use a mechanism that opens a virtual channel from transmitter to receiver. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If using X.25 you want to communicate from New York to London, your communication device has to send a signal to its next X.25 switch indicating that you want to open a channel to London, and that switch sends the same signal to the following switch and so on until the signal gets to London switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now that the channel is stablished the communication begins. Each frame from New York to London goes through the designated channel and when the communication ends the switches close the channel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Datagram networks&lt;/strong&gt; as TCP/IP don't open a predefined channel before sending the first frame of communication. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the same example using New York and London, your device sends the first frame and the next switch will have to decide what is the best next hop for that frame and every network device will do the same until the frame gets to London.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For each frame the switch decides the best next hop so sometimes the frames will go through one path and sometimes through another.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Datagram networks are more flexible than VC networks because there is not a designated path from start to end.&lt;/p&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2017-06-15T10:55:56.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41939" PostTypeId="1" AcceptedAnswerId="41940" CreationDate="2017-06-15T11:00:39.510" Score="2" ViewCount="472" Body="&lt;p&gt;I have a LAN network in &lt;strong&gt;location A&lt;/strong&gt; with some &lt;em&gt;laptop 1&lt;/em&gt; and &lt;em&gt;laptop 2&lt;/em&gt; connected to it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a &lt;em&gt;laptop 3&lt;/em&gt; in &lt;strong&gt;location B&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Laptop 1, laptop 2 and laptop 3&lt;/em&gt; will be connected to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible for laptop 3 to access the LAN network using the internet from &lt;strong&gt;location B&lt;/strong&gt; ? (Assuming I have access to laptops only in &lt;strong&gt;Location A&lt;/strong&gt; and do not have access to any network infrastructure).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;br/&gt;&#xA;Sash&lt;/p&gt;&#xA;" OwnerUserId="32829" LastEditorUserId="32829" LastEditDate="2017-06-15T12:33:31.610" LastActivityDate="2020-12-11T13:15:19.373" Title="Share LAN connection over internet" Tags="|vlan|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41940" PostTypeId="2" ParentId="41939" CreationDate="2017-06-15T11:29:26.723" Score="2" Body="&lt;p&gt;it's possible using &lt;strong&gt;VPN&lt;/strong&gt;. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You need in &lt;strong&gt;location A&lt;/strong&gt; a home router with a built-in VPN server. You can then use your router’s web interface to activate and configure the VPN server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Check if your existing router has a built-in VPN server. Otherwise, buy a new one or check if your router can be flashed with &lt;code&gt;DD-WRT&lt;/code&gt;or &lt;code&gt;OpenWrt&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;if you flash your router, you are replacing the router’s standard operating system with a new one. and get a built-in VPN server support, so you can host a VPN server even on routers that don’t come with VPN server software.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Be sure to pick up a supported router — or check your current router to see if it’s supported by DD-WRT. Flash the third-party firmware and enable the VPN server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On &lt;strong&gt;laptop 3&lt;/strong&gt; you will need to configure the VPN connection in:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Settings  &amp;gt; Network &amp;amp; Internet  &amp;gt; VPN &amp;gt; Add a VPN connection.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2017-06-15T11:29:26.723" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41942" PostTypeId="1" AcceptedAnswerId="41981" CreationDate="2017-06-15T14:08:59.580" Score="0" ViewCount="121" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/DA603.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/DA603.jpg&quot; alt=&quot;Topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ok so hopefully this is a quick answer. All of the explanations on the web I have found have been unspecific in this regard, so I apologize in advance for simplicity.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the example topology, when configuring the MC and specifying the information of the BR (R3), whose interfaces are you specifying?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;&amp;lt;R5&amp;gt;oer master&#xA;&amp;lt;R5&amp;gt;border X.X.X.X (Loopback on R3 or whatever)&#xA;&amp;lt;R5&amp;gt;interface (INT) internal&#xA;&amp;lt;R5&amp;gt;interface fa0/0 external&#xA;&amp;lt;R5&amp;gt;interface s1/2 external&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For those two interface commands, do I have that correct? Are we specifying the interfaces on the BR or the MC? I feel like it should be the interfaces of the BR being specified on the MC, but at the same time I'm not entirely sure how the MC would understand what those interfaces are being referenced. &lt;/p&gt;&#xA;" OwnerUserId="23997" LastActivityDate="2017-07-16T14:32:10.913" Title="When configuring a PfR Master Controller, after pointing to the border router, which interfaces are specified?" Tags="|cisco|cisco-ios|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41945" PostTypeId="1" AcceptedAnswerId="41997" CreationDate="2017-06-15T15:07:39.707" Score="3" ViewCount="965" Body="&lt;p&gt;I have been reading IEEE 802.1Q 2014 about SPB. I also have watched a few videos about SPB on youtube. However I don't understand why no one mentioned that BPDUs are still transmitted in the network, and IEEE 802.1Q have wrote about SPB in many sections in Spanning Tree.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If IS-IS controls SPB network, why BPDU are still required? I know Agreement Digest is for preventing temporary loop during topology change. But why is it transmitted inside BPDU?&lt;/p&gt;&#xA;" OwnerUserId="20657" LastActivityDate="2023-02-08T23:40:20.450" Title="Does SPB really replace STP?" Tags="|spanning-tree|layer2|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41946" PostTypeId="1" AcceptedAnswerId="42005" CreationDate="2017-06-15T16:12:57.567" Score="0" ViewCount="1636" Body="&lt;p&gt;I have set my MikroTik RouterBoard hap AC as the router instead of my Modem/Router that my ISP gave me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to set port forwarding using a tutorial I've found in google.&#xA;That's the configuration of my Port Forwarding:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Flags: X - disabled, I - invalid, D - dynamic&#xA;0    ;;; defconf: masquerade&#xA;     chain=srcnat action=masquerade out-interface=ether1 log=no log-prefix=&quot;&quot;&#xA;&#xA;1    chain=dstnat action=dst-nat to-addresses=192.168.1.7 to-ports=8081 protocol=tcp in-interface=ether1 dst-port=8081&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And That's my ip address configuration:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Flags: X - disabled, I - invalid, D - dynamic&#xA;#   ADDRESS            NETWORK         INTERFACE&#xA;0   ;;; defconf&#xA;    192.168.1.1/24     192.168.1.0     ether2-master&#xA;1 D 100.100.161.43/23  100.100.160.0   ether1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have to say that 100.100.161.43 is the IP the modem gave to my router, but it isn't my ISP IP.&lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Port Forwarding isn't working at all. I've tried tcpdump to check if 192.168.1.7 is getting any packets while I'm trying to reach it, but no traffic is being captured.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What am I doing wrong?&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="37538" LastEditorUserId="8499" LastEditDate="2018-02-14T16:17:24.573" LastActivityDate="2018-02-14T16:17:24.573" Title="Port Forwarding Not Working on Mikrotik hap AC" Tags="|routing|nat|" AnswerCount="2" CommentCount="3" ClosedDate="2017-06-24T06:17:58.160" ContentLicense="CC BY-SA 3.0" />
  <row Id="41947" PostTypeId="1" CreationDate="2017-06-15T16:30:22.757" Score="1" ViewCount="119" Body="&lt;p&gt;I have always read that a router is a layer three device. Then how could it use RIP which is an application layer protocol ?&lt;/p&gt;&#xA;" OwnerUserId="30899" LastActivityDate="2017-06-15T17:31:06.097" Title="How could a router use RIP if its a layer three device. Does a layer understands application layer protools?" Tags="|router|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41948" PostTypeId="2" ParentId="41947" CreationDate="2017-06-15T17:06:21.040" Score="3" Body="&lt;p&gt;The layers of the OSI Model are exactly that, a model.  It exists today as a framework to help understand how networks function.  A network connected device, generally speaking, doesn't &quot;live&quot; as simply a single element in a single layer.  In order to function, it participates at many OSI layers simultaneously.  Some network elements (routers, switches, etc) may have &lt;strong&gt;primary&lt;/strong&gt; functions, however they will utilize elements from other layers.&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;For example, to your specific question, &lt;strong&gt;a router's primary function is to route packets&lt;/strong&gt;.  And you are correct, IP Packets exist at Layer 3 of the OSI model.  However, in order to gather information about WHERE to route these packets, &lt;strong&gt;a router often uses a routing protocol (RIP, OSPF, EIGRP, BGP, IS-IS) to determine reachable networks.&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These are applications, however they are application that are exchanging information about route destinations so that the router can perform it's primary Layer 3 function: Route Packets.&lt;/p&gt;&#xA;" OwnerUserId="44" LastActivityDate="2017-06-15T17:06:21.040" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41949" PostTypeId="2" ParentId="41947" CreationDate="2017-06-15T17:31:06.097" Score="0" Body="&lt;p&gt;Don't confuse OSI layer abstractions. RIP is a protocol used to share addresses which are understood to be part of the L3. Think of applications as for end user.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;RIP is to Layer 3 as Quake online gaming is to Layer 7.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Does a layer understands application layer protools?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Layers can be thought as a structural design. Another way to put it, layers are a common ground for all to understand. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Layer 3 whether it is  &lt;em&gt;Layer 3: Network Layer&lt;/em&gt; from the OSI model or &lt;em&gt;Internet Layer&lt;/em&gt; from the TCP/IP stack, they are just abstractions/models.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;RIP as other existing protocols when implemented by vendors can run as daemons (services) or tasks, you may think of this as an application, however this is at the implementation side of things, if you think about OSI this is Layer3 because it's used to communicate end points.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://en.wikipedia.org/wiki/OSI_model&quot; rel=&quot;nofollow noreferrer&quot;&gt;Taken from wiki Osi model&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Protocols enable an entity in one host to interact with a corresponding entity at the same layer in another host. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So if we try to boil it down hardcore, you can think of L3 being source IP and destination IP. An application has to do with the end user.&#xA;As an Internet user, you don't need RIP to know all addresses from the internet on your computer because what you are needing is just the application, i.e online Game, as long as your PC has a way out i.e default gateway (your modem).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The application layer is the OSI layer closest to the end user, which means both the OSI application layer and the user interact directly with the software application. Such application programs fall outside the scope of the OSI model.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;ISP's on the other hand need a way of communicating and to do so they need a set of rules that everyone understands in order to share the necessary information (IP addresses), which can be RIP, OSPF, BGP or any other depending on the extent.&lt;/p&gt;&#xA;" OwnerUserId="35590" LastActivityDate="2017-06-15T17:31:06.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41954" PostTypeId="1" CreationDate="2017-06-15T19:18:08.300" Score="2" ViewCount="1562" Body="&lt;p&gt;How does the /sys/class/net/ethx/carrier field get set?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I am trying to understand this field as it determines if a network cable is plugged in, but I am curious how it knows. This is specifically in regards to 10Gbase-KR and 1Gbase-KX.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have a little knowledge in regards to CMSA/CD, but that is only for half duplex and NPL - pulses are for auto negotiation. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is something going across the medium when no traffic is being sent?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe it may have to do with IDLE symbols, but I do not fully understand them.&lt;/p&gt;&#xA;" OwnerUserId="21360" LastEditorUserId="21360" LastEditDate="2017-06-15T19:38:00.730" LastActivityDate="2017-07-17T06:31:18.490" Title="How does Ethernet driver know if the cable is plugged in?" Tags="|ethernet|linux|10gbase|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41955" PostTypeId="2" ParentId="41954" CreationDate="2017-06-15T19:39:06.220" Score="0" Body="&lt;p&gt;Basically, auto negotiation tells the port which PHY to select. The PHY starts up and its PCS will then receive the carrier (or carriers for multilane), depending on the PHY flavor.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-07-17T06:31:18.490" LastActivityDate="2017-07-17T06:31:18.490" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41956" PostTypeId="2" ParentId="41954" CreationDate="2017-06-15T20:06:33.727" Score="1" Body="&lt;p&gt;Link detection is specific to the physical layer.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The original coax Ethernet did not really have link state detection (some PHYs had a mechanism for detecting termination during transmission but it only worked when the device was actually trying to transmit something)&lt;/li&gt;&#xA;&lt;li&gt;10BASE-T uses &quot;link state pulses&quot; which are sent when the line is idle to monitor link status.&lt;/li&gt;&#xA;&lt;li&gt;Twisted pair auto-negotiation uses &quot;Fast link pulse bursts&quot; to both determine the state of the link and to exchange auto-negotiation information. Once a link type has been negotiated link type specific mechanisms are used to monitor link status.&lt;/li&gt;&#xA;&lt;li&gt;Faster Ethernet standards generally transmit idle codes continuously. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;If you want the full details of what a particular physical layer sends best to check the actual 802.3 standard.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-15T20:06:33.727" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41957" PostTypeId="1" AcceptedAnswerId="41964" CreationDate="2017-06-15T20:25:54.970" Score="2" ViewCount="651" Body="&lt;p&gt;I'm currently learning about how to convert between a multicast ip address and the destination mac address. I fully understand the terminology, how to do the conversion, and why the 23 bits, instead of 24, are used. However, what I don't understand is what would be different if 24 bits WERE used to map between the two addresses. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read on a website that using 24 bits would allow there to be a 1 to 1 relationship between macs and ips. However, I don't understand why. There are 5 bits that don't get mapped (28 unique ip bits - 23 mac bits = 5 bits). This means there will be 2^5 = 32 ip addresses per mac address. So, it seems to me like if the mac was 24 bits, then there would still be a 28-24=4 bit hole and, therefore, 2^4=16 ip's per mac address. Better, but still not a 1 to 1 mapping.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind of a complicated question, but hopefully the right person will come along and read this post!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you all in advance for your answers!&lt;/p&gt;&#xA;" OwnerUserId="23414" LastActivityDate="2017-06-16T02:06:30.573" Title="Understanding multicast destination mac addresses" Tags="|mac-address|multicast|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41958" PostTypeId="1" AcceptedAnswerId="41963" CreationDate="2017-06-15T20:53:43.477" Score="0" ViewCount="578" Body="&lt;p&gt;I have to split up a network into 11 subnetworks, and then those networks must be split up further. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;With the address 136.192.0.0\16:&#xA;&#xA;I found that I have 2^(32-16) = 65,536 available addresses. &#xA;I can make 11 groups of 4,096 addresses.&#xA;I then get 20 as the subnet mask prefix. &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I end up with the following 11 IP Addesses, one for each network. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Network ID              Subnet Mask&#xA;&#xA;138.192.16.0            255.255.240.0 or \20&#xA;138.192.32.0            255.255.240.0 or \20&#xA;138.192.48.0            255.255.240.0 or \20&#xA;138.192.64.0            255.255.240.0 or \20&#xA;138.192.80.0            255.255.240.0 or \20&#xA;138.192.96.0            255.255.240.0 or \20&#xA;138.192.112.0           255.255.240.0 or \20&#xA;&#xA;138.192.128.0           255.255.240.0 or \20&#xA;138.192.144.0           255.255.240.0 or \20&#xA;138.192.160.0           255.255.240.0 or \20&#xA;138.192.176.0           255.255.240.0 or \20&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first network address is 138.192.16.0\20&#xA;I need to split this address into 5 further subnets. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;I have 2^(32-20) = 4096 addresses available with the \20 subnet mask&#xA;If I split it up into 5 groups thats 4096/5 = 819.2 but we have to round &#xA;that to a multiple of 2, so we get 5 groups of 512&#xA;&#xA;Because 9 bits are for the host, that means 23 are for the network &#xA;That gives me 255.255.254.0 for the subnet mask.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This is as far as I've gotten beause I am unsure how to proced with producing these 5 Network ID's.&#xA;Im also uncertain if I'm doing it right. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I did find this resource &lt;a href=&quot;https://networkengineering.stackexchange.com/questions/7106/how-do-you-calculate-the-prefix-network-subnet-and-host-numbers&quot;&gt;How do you calculate the prefix, network, subnet, and host numbers?&lt;/a&gt;&#xA;But am unsure of what its doing when subnetting. &lt;/p&gt;&#xA;" OwnerUserId="37544" LastEditorUserId="37544" LastEditDate="2017-06-15T22:53:06.797" LastActivityDate="2017-06-16T07:48:44.890" Title="Help with Subnetting and Subnet Masks" Tags="|subnet|" AnswerCount="2" CommentCount="8" ClosedDate="2019-02-03T05:29:11.987" ContentLicense="CC BY-SA 3.0" />
  <row Id="41959" PostTypeId="1" AcceptedAnswerId="42015" CreationDate="2017-06-15T21:22:31.600" Score="1" ViewCount="955" Body="&lt;p&gt;We have a user that moved recently to an incubator, in order to secure his traffic between his computer and the office we purchased an ASA 5505 to connect to his desktop, and hoped we could configure it to form a vpn tunnel to our ASA 5520 sitting in our office.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Rc0di.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Rc0di.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is a basic diagram i have for you, is it possible to form this tunnel?&#xA;If so, what do i have to put in as crypto map peer? What should i put as route?&#xA;on both ends&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I apologize if this is incomplete and vague question, i am ready to share as much information from my side if requested&lt;/p&gt;&#xA;" OwnerUserId="37546" LastActivityDate="2019-02-14T12:26:46.807" Title="VPN: IPsec tunnel between Private IP ASA &amp; Public IP ASA" Tags="|cisco-asa|vpn|network|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41963" PostTypeId="2" ParentId="41958" CreationDate="2017-06-16T01:49:58.190" Score="2" Body="&lt;p&gt;Your overall /16 (2^16 hosts) can be broken up into 16 /20's (2^12 hosts).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each of your /20's could be turned into 8 /23 (2^9 host) or 16 /24 (2^8 host) subnets - or some combination therein.   &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind that you might need five subnets out of the /20 but that doesn't mean you have to immediately fully consume the entire supernet.  Allocation schemes tend to be a lot more extensible and it might actually be that further subnets within a site also make some sense.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the hope that I'm not doing someone's homework, consider something more like the following - I have 5 user sites that range in size between 100 and 300 users.  Each site may grow.  Since you're using modern equipment there's not necessarily a requirement to have everyone on the same L2 domain within a site, so a few slightly disjoint ranges aren't the end of the world.  That said, in the macro sense you want to maintain clean boundaries for summarization to facilitate routing protocol scalability and ease of application recognition/security/etc.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are a few ways to do this.  One obvious way would be to allocate the /23's contiguously from 0.  The remaining 3 /23's would be allocated on a /24 basis (6 total) on an as-needed basis if/when the sites grow.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternately, perhaps you start from the premise that the 2 sites that are already at 300 users would be allocated a /22, out of which each gets the lower /23.  If/when &lt;em&gt;they&lt;/em&gt; grow there's already another /23 ready.  The smaller 3 sites each get /23's.  This leaves you with an unused /23, which could be broken up into two /24's to use if either of the small sites grows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Scale this concept out and perhaps you don't allocate the entire /16 into /20's.  Maybe you take the 55 sites you're describing (11 supernets of 5 subnets each, right?) and do partial allocations out of individual /21's (say the first /23 to start with for each) while leaving the remaining 9 /21's for other sites.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The other thing to consider is that there's some amount of use in most address schemes for things other than end users.  Examples would include management loopbacks, small subnets for out-of-band ports, subnets for servers and, especially, point-to-point links.  The kicker with these is that as soon as you've allocated a single /31 or /32 you've already broken up a subnet.  This tends to call for setting aside a chunk of the supernet for these kinds of infrastructure functions.  Maybe the /21 overall allocation actually starts as the first /23, then a reserved /24 for growth and then a /24 for infrastructure (...which perhaps includes a /25 for local servers, a /26 for OOB management, a /27 for loopbacks, etc).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point is that you can slice this up an any number of ways depending on your needs.  It's all just powers of 2, after all.  Put it in a spreadsheet and see what both makes sense now and leaves some room to grow without blowing up the routing table.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-06-16T01:49:58.190" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41964" PostTypeId="2" ParentId="41957" CreationDate="2017-06-16T02:06:30.573" Score="2" Body="&lt;p&gt;The traditional class-D range for multicast is 224.0.0.0/4 - which is 2^28 host addresses.  If you mapped this to a 24-bit namespace you would, in fact, end up with a ratio of 2^28 / 2^24 = 2^4, or 16 IP's per MAC instead of the current 32 IP's per MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason the additional bit is used is that the most significant bit is actually a flag indicating whether the MAC is multicast.  The idea was to leave a full 24 bits for OUI's while still including some kind of signifier for the frame being multicast.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;It actually makes a certain amount of sense as a concession given that there used to be a lot of other protocols besides IP that used Ethernet and that these protocols didn't have any kind of universally recognizable upper-layer mechanism for network hardware to pick out whether a given frame was multicast.  I suppose it might have been possible to put a multicast flag elsewhere in the header, but that would have caused other compatibility issues.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-06-16T02:06:30.573" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41966" PostTypeId="1" CreationDate="2017-06-16T02:14:35.187" Score="2" ViewCount="5938" Body="&lt;p&gt;Here is the running-config for the line vty:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;line vty 0 4&#xA;password 1111&#xA;login local&#xA;transport input ssh&#xA;line vty 5 15&#xA;password 1111&#xA;login local&#xA;transport input ssh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, when I type ssh -l domain-name ip-address, the cmd will show:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Open&#xA;Password:&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Since it is in &lt;code&gt;login local&lt;/code&gt;, it should ask for a user account, but it doesn't. Also, it accepts the password &quot;1111&quot;, when as far as I know, should only be accepted if it is in &lt;code&gt;login&lt;/code&gt; only.&lt;/p&gt;&#xA;" OwnerUserId="37550" LastActivityDate="2017-10-14T11:49:33.737" Title="When using SSH, why it doesn't ask for a username and it's corresponding password?" Tags="|ssh|" AnswerCount="3" CommentCount="5" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41970" PostTypeId="2" ParentId="41966" CreationDate="2017-06-16T05:03:46.627" Score="1" Body="&lt;p&gt;You provide credentials for&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;login local &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;with&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;username joe secret blah&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;or &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;aaa new-model&#xA;aaa authentication login default enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The password alone lets you because you set it in line context and it falls through as old style vty login....`&lt;/p&gt;&#xA;" OwnerUserId="4422" LastActivityDate="2017-06-16T05:03:46.627" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41971" PostTypeId="2" ParentId="41958" CreationDate="2017-06-16T07:48:44.890" Score="0" Body="&lt;p&gt;/16 to /20 4bits, 16 subnets&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/20 to /24 4bits, 16 subnets with 254(265) hosts each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Total = 16 x 16 x 256 = 65536 ip's&lt;/p&gt;&#xA;&#xA;&lt;p&gt;or&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/16 to /20 4bits, 16 subnets&lt;/p&gt;&#xA;&#xA;&lt;p&gt;/20 to /23 3bits, 8 subnets with 510(512) hosts each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Total = 16 x 8 x 512 = 65536 ip's&lt;/p&gt;&#xA;" OwnerUserId="3782" LastActivityDate="2017-06-16T07:48:44.890" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41974" PostTypeId="2" ParentId="25952" CreationDate="2017-06-16T09:21:40.923" Score="0" Body="&lt;p&gt;Before subnetting there was only Class-based addressing and the smallest networks were /24. So during the transition to subnetting, when the subnet masks were introduced to existing networks, most of them got 255.255.255.0 as being backward compatible. So that was the common thing and is also just a very easy mask to work with, being a round number (in binary) and preserving the Class C semantics of the last octet being the host number and the rest the network number. Using it avoids having to do decimal-to-binary conversion to determine if two addresses are on the same subnet or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another reason I think it persisted besides familiarity and inertia is because there is a lot of broadcast traffic in IPv4 and by definition broadcast traffic goes to every device on the subnet. So in practice, by the time you are done routing and are allocating address to end nodes, you want to keep the number of devices generating broadcasts down to a reasonable number. The Class C subnet 255.255.255.0 is big enough that most organizations won't need more addresses than that and small enough to keep from being overwhelmed by broadcasts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You do see smaller subnets, like 255.255.255.252, used when handing out publicly routable IPv4 addresses because those addresses are so precious. I did, however, once have an ISP give us 3 addresses with a /30 subnet only to have one of the addresses be on a different subnet than the other 2. That was annoying and probably a mistake on their part, but it was hard to spot because of the math.&lt;/p&gt;&#xA;" OwnerUserId="5240" LastActivityDate="2017-06-16T09:21:40.923" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41977" PostTypeId="1" CreationDate="2017-06-16T12:04:09.313" Score="2" ViewCount="822" Body="&lt;p&gt;I hate posting things like this, but we're backed into a corner here. We recently had a new client ask us to set up an ASA for their branch office 800 miles away. A colleague and I spent last night staring at the config and can't see anything blatantly wrong with it, but the ASA is currently in-place at the new office and refuses to pass traffic. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We can ping the inside default gateway from the LAN and the ISP's gateway from the ASA, just no LAN-&gt;WAN. 0/1 is the outside connection we're currently using with 10.19.130.177 being the gateway of last resort. We're looking at swapping physical today, but other than that, we're at a loss. Any help you all could offer would be greatly appreciated. Also flame for putting this into production without testing first is welcome.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;ASA5200:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;hostname NY-ASA5200&#xA;domain-name tiddlywinks.com&#xA;enable password .OQUvNlAd8LFUGsq7R9h encrypted&#xA;passwd 2KFQNnbNIUdI.2TKYOUR encrypted&#xA;names&#xA;!&#xA;interface GigabitEthernet0/0&#xA;shutdown&#xA;nameif FIBER&#xA;security-level 0&#xA;ip address 172.16.0.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/1&#xA;nameif OUTSIDE&#xA;security-level 0&#xA;ip address 10.19.130.190 255.255.255.240&#xA;!&#xA;interface GigabitEthernet0/2&#xA;nameif INSIDE&#xA;security-level 100&#xA;ip address 192.168.220.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet0/3&#xA;shutdown&#xA;no nameif&#xA;no security-level&#xA;no ip address&#xA;!&#xA;interface Management0/0&#xA;shutdown&#xA;no nameif&#xA;no security-level&#xA;no ip address&#xA;!&#xA;ftp mode passive&#xA;dns server-group DefaultDNS&#xA;domain-name tiddlywinks.com&#xA;object network inside-subnet&#xA;subnet 192.168.220.0 255.255.255.0&#xA;object network outside_IP&#xA;host 10.19.130.190&#xA;access-list inside_out_acl extended permit ip any any&#xA;access-list inside_out_acl extended permit icmp any any&#xA;pager lines 24&#xA;mtu FIBER 1500&#xA;mtu Regis 1500&#xA;mtu INSIDE 1500&#xA;no failover&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;!&#xA;object network inside-subnet&#xA;nat (INSIDE,OUTSIDE) dynamic interface&#xA;route OUTSIDE 0.0.0.0 0.0.0.0 10.19.130.177 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;sla monitor 123&#xA;type echo protocol ipIcmpEcho 8.8.8.8 interface FIBER&#xA;num-packets 4&#xA;frequency 15&#xA;sla monitor schedule 123 life forever start-time now&#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;!&#xA;track 1 rtr 123 reachability&#xA;telnet 192.168.220.0 255.255.255.0 INSIDE&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;dhcpd address 192.168.220.100-192.168.220.150 INSIDE&#xA;dhcpd enable INSIDE&#xA;!&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;ssl encryption aes256-sha1&#xA;!&#xA;class-map inspection_default&#xA;match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA;parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA;class inspection_default&#xA;  inspect dns preset_dns_map&#xA;  inspect ftp&#xA;  inspect h323 h225&#xA;  inspect h323 ras&#xA;  inspect ip-options&#xA;  inspect netbios&#xA;  inspect rsh&#xA;  inspect rtsp&#xA;  inspect skinny&#xA;  inspect esmtp&#xA;  inspect sqlnet&#xA;  inspect sunrpc&#xA;  inspect tftp&#xA;  inspect sip&#xA;  inspect xdmcp&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;call-home&#xA;profile CiscoTAC-1&#xA;  no active&#xA;  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService&#xA;  destination address email callhome@cisco.com&#xA;  destination transport-method http&#xA;  subscribe-to-alert-group diagnostic &#xA;  subscribe-to-alert-group environment&#xA;  subscribe-to-alert-group inventory periodic monthly&#xA;  subscribe-to-alert-group configuration periodic monthly&#xA;  subscribe-to-alert-group telemetry periodic daily&#xA; Cryptochecksum:1bf8d350a86639071a01cf5ee2782a42&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37561" LastActivityDate="2017-07-16T18:32:17.160" Title="ASA not passing traffic" Tags="|cisco-asa|cisco-ios|troubleshooting|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41980" PostTypeId="2" ParentId="41977" CreationDate="2017-06-16T13:46:20.327" Score="1" Body="&lt;p&gt;Try this way:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;object network inside-subnet&#xA; subnet 192.168.220.0 255.255.255.0&#xA; nat (INSIDE,OUTSIDE) dynamic interface&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="29556" LastActivityDate="2017-06-16T13:46:20.327" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="41981" PostTypeId="2" ParentId="41942" CreationDate="2017-06-16T13:59:31.137" Score="0" Body="&lt;p&gt;To answer my own question for the sake of anyone else who may have the same question:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Yes, you would need to specify the interfaces of the border router. Through communication between the BR and MC, they can refer to one another's interfaces despite not having direct knowledge of them.&lt;/p&gt;&#xA;" OwnerUserId="23997" LastActivityDate="2017-06-16T13:59:31.137" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41982" PostTypeId="1" AcceptedAnswerId="41985" CreationDate="2017-06-16T14:01:22.770" Score="1" ViewCount="1531" Body="&lt;p&gt;I appreciate some of the most obvious advantages of security on both switches and routers are things like stopping unauthorized access and preventing any unwanted configurations. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, I can't think of any disadvantages that are really worth considering when configuring a device, things like:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Strength of password determines security level.&lt;/li&gt;&#xA;&lt;li&gt;Security beyond the password is based solely on confidentiality.&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;But these are not really points that would make anyone think twice about adding security to the devices. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there any others you have perhaps come across or know that may effect the network, or devices themselves? Is there even a disadvantage to adding security to a switch or router? &lt;/p&gt;&#xA;" OwnerUserId="37565" LastEditorUserId="37565" LastEditDate="2017-06-16T14:13:32.543" LastActivityDate="2017-08-15T23:17:20.730" Title="What are the advantages and (if any) disadvantages of putting security on both switches and routers?" Tags="|switch|router|lan|security|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="41985" PostTypeId="2" ParentId="41982" CreationDate="2017-06-16T15:29:13.863" Score="3" Body="&lt;p&gt;What type of switch are we talking about?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Unmanaged switches will work out of the box and require no configuration. Managed switches on the other hand do. Generally unmanaged switches can't be hacked, but managed switches can with improper configuration.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should do everything possible to ensure the switch isn't vulnerable to attack.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now onto the router. Should it be secured? &lt;strong&gt;ABSOLUTELY YES!&lt;/strong&gt; If an attacker gains access to the network, and the router isn't secured/configured correctly, you've just given the attacker an open door.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ensure both are secured. Trust nothing.&lt;/p&gt;&#xA;" OwnerUserId="37567" LastActivityDate="2017-06-16T15:29:13.863" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41988" PostTypeId="2" ParentId="41977" CreationDate="2017-06-16T17:32:42.043" Score="1" Body="&lt;p&gt;We ended up doing two things to resolve this issue.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Replacing cables and changing the interfaces on the ASA.&lt;/li&gt;&#xA;&lt;li&gt;Removing failover settings from the configuration. Particularly these lines.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sla monitor 123&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;sla monitor schedule 123 life forever start-time now&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;track 1 rtr 123 reachability&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="37561" LastActivityDate="2017-06-16T17:32:42.043" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41990" PostTypeId="1" AcceptedAnswerId="41992" CreationDate="2017-06-16T19:24:40.000" Score="1" ViewCount="832" Body="&lt;p&gt;If a web site is hosted on a public network it can directly be accessed using it IP. If it is hosted on a private network it can still be accesses if the NAT device conducts a port forwarding of some sort.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If there are multiple instances of the web server than the NAT router can perform load balancing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However what if there are 2 or more un related servers being hosted on a single private space.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can the traffic be identified as to which server it is destined for in this case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On any cloud hosting platform, eg AWS. There may be several different servers but just 1 public IP which is used by all incoming traffic (ofcourse AWS has many public IP's).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But in general if the number oif servers exceed the number of public IP's such hat port forwarding cannot be used. Than how can traffic reach its correct destination.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One method I thought was deep packet inspection at the router such that it read the URL in the application header&lt;/p&gt;&#xA;" OwnerUserId="30735" LastEditorDisplayName="user36472" LastEditDate="2018-02-14T19:37:11.083" LastActivityDate="2018-02-14T19:37:11.083" Title="Hosting multiple web servers or web applications on a private network" Tags="|nat|port-forwarding|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41991" PostTypeId="2" ParentId="41990" CreationDate="2017-06-16T19:36:47.430" Score="2" Body="&lt;p&gt;Multiple public IPs: each server requires a different public IP that clients are forwarded from&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Single public IP, easy and ugly setup: run servers on different ports on the public IP address and forward accordingly&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Single public IP, more sophisticated setup: install reverse proxy that you forward clients to, separate servers on the application layer and forward from proxy to associated server (correctly speaking, this is not 'forwarding' but a new TCP connection); HTTPS needs to be terminated on the proxy.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-17T07:15:15.193" LastActivityDate="2017-06-17T07:15:15.193" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41992" PostTypeId="2" ParentId="41990" CreationDate="2017-06-17T00:15:01.053" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;One method I thought was deep packet inspection at the router such that it read the URL in the application header&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;There is a chicken and egg problem. The application layer headers are not sent until after the TCP connection is established but the process of establishing the connection establishes things like the initial sequence numbers so once the TCP connection is established it can't be diverted using NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So instead an application level proxy is needed which can accept the TCP connection from the client, inspect and possibly modify* the application headers and establish a separate TCP connection to the back-end server.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note: if your clients support SNI (most modern web browsers do) it is not necessary to decrypt tls traffic when proxying it in this way.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;* For example to pass the IP address of the client to the backend server for logging and abuse control.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-17T00:15:01.053" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41994" PostTypeId="1" CreationDate="2017-06-17T02:40:47.437" Score="0" ViewCount="110" Body="&lt;p&gt;I wanted to export the configurations from cisco asa firewall into HP aruba ,is there anyway we can make it happen. My company just installed the HP and replaced it with cisco arube, and we have a lot of configurations in cisco and want to export it hp aruba. Is there any process or tool that can be done?&lt;/p&gt;&#xA;" OwnerUserId="37577" LastActivityDate="2017-11-15T19:08:54.730" Title="Exporting cisco ASA configuration into HP aruba?" Tags="|cisco|cisco-asa|cisco-ios|hp|aruba|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="41995" PostTypeId="1" CreationDate="2017-06-17T04:57:27.647" Score="0" ViewCount="41" Body="&lt;p&gt;Windows &lt;code&gt;route print&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;...&#xA;Network Destination        Netmask          Gateway       Interface  Metric&#xA;...&#xA;  192.168.1.0    255.255.255.0         On-link     192.168.1.178    276&#xA;192.168.1.178  255.255.255.255         On-link     192.168.1.178    276&#xA;192.168.1.255  255.255.255.255         On-link     192.168.1.178    276&#xA;...&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;What's the point of the last two rows? What happens when they are removed?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doesn't the 3rd-last row already do what they do?&lt;/p&gt;&#xA;" OwnerUserId="5654" LastEditorUserId="5654" LastEditDate="2017-06-17T05:02:32.033" LastActivityDate="2017-06-17T07:20:10.250" Title="Are these routing rows redundant?" Tags="|routing|router|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="41997" PostTypeId="2" ParentId="41945" CreationDate="2017-06-17T07:10:28.943" Score="3" Body="&lt;p&gt;I just figured it out. Because SPB calculates its CIST for compatibility with STP. So the result of CIST calculation is hashed and put into BPDU agreement digest field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This way SPB nodes can ensure neighbor SPB nodes have same CIST result.&lt;/p&gt;&#xA;" OwnerUserId="20657" LastActivityDate="2017-06-17T07:10:28.943" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="41998" PostTypeId="2" ParentId="41995" CreationDate="2017-06-17T07:20:10.250" Score="2" Body="&lt;p&gt;They seem somewhat redundant but they represent different things.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.0/24 is the route to the subnet, ie. 192.168.1.1 through 192.168.1.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.178/32 is the route to self, ie. loopback&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.1.255/32 is the route to the broadcast address, ie. to everyone on the subnet.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-17T07:20:10.250" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42000" PostTypeId="2" ParentId="41946" CreationDate="2017-06-17T12:12:55.563" Score="0" Body="&lt;p&gt;100.100.161.43 is public address. Let's call it Address M. If you are not using Address M as a destination when trying to access from outside, that means public address you are trying to reach (Address R) does not forward your request to Mikrotik (Address M). Either try accessing from outside to Address M, or you need to ask your ISP to forward port on Address R to Address M.&#xA;Other than that your Mikrotik configuration looks good.&lt;/p&gt;&#xA;" OwnerUserId="37582" LastActivityDate="2017-06-17T12:12:55.563" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42005" PostTypeId="2" ParentId="41946" CreationDate="2017-06-17T21:31:20.817" Score="0" Body="&lt;p&gt;100.64.0.0/10 is a special IP-range defined in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc6598&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC6598&lt;/a&gt;, commonly known as 'shared address space'. The typical use of this is that ISP's which are running out of IPv4 space assign customers an IP address from this range and use &lt;a href=&quot;https://en.wikipedia.org/wiki/Carrier-grade_NAT&quot; rel=&quot;nofollow noreferrer&quot;&gt;carrier grade NAT&lt;/a&gt; to provide access to the public internet.&lt;/p&gt;&#xA;&lt;p&gt;The most important reason they use this specific range is that it does not overlap with private IP ranges assigned in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1918&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC1918&lt;/a&gt;, so application layer protocol inspection will be able to distinguish the ISP's NAT from the client's NAT.&lt;/p&gt;&#xA;&lt;p&gt;So the problem here is that your NAT is placed behind the ISP's NAT. That's why you see another IP when you check your address on a website. You will have to contact your ISP if you need to run publicly accessable services, because at this moment you do not have your own public IP address.&lt;/p&gt;&#xA;" OwnerUserId="509" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-06-17T21:31:20.817" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42006" PostTypeId="1" AcceptedAnswerId="42007" CreationDate="2017-06-17T23:11:15.153" Score="0" ViewCount="921" Body="&lt;p&gt;We recently upgraded our networking hardware (L2+ switches and routers) to bring the office up to IPv6 connectivity. Since then, we have had a strange problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We are mainly an Apple Macintosh office but we have some need to run Windows software so we use VMware Fusion to run Windows in Virtual Machines (VMs). People who are using wired connections to the network are doing fine, and people using laptops connected via WiFi have no trouble with their OS X networking, but their Windows VMs cannot get addresses via DHCP. When the Windows VMs are manually assigned static IP addresses, they work fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have verified that DHCP request packets come from the laptops on WiFi but they only reach the DHCP server when they come from OS X, not from Windows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the problem and how do I fix it?&lt;/p&gt;&#xA;" OwnerUserId="5240" LastActivityDate="2017-06-17T23:11:15.153" Title="Virtual Machine cannot get DHCP when host connects via WiFi" Tags="|dhcp|" AnswerCount="1" CommentCount="0" ClosedDate="2019-02-03T05:25:03.057" ContentLicense="CC BY-SA 3.0" />
  <row Id="42007" PostTypeId="2" ParentId="42006" CreationDate="2017-06-17T23:11:15.153" Score="1" Body="&lt;p&gt;To create a separate network interface, the VM creates a new MAC address, different from the one on the host computer. On wired Ethernet, the VM is able to use its generated MAC address on the L2 network because it can see all the traffic on the wire. On WiFi, because of wireless security protocols, it cannot use its L2 MAC address and has to use a specialized bridge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that when the DHCP request hits the wired network, the source MAC address is the VM's generated MAC address when it comes from a wired computer, but it is the host's MAC address when it comes from a computer connected via WiFi.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This means that DHCP requests coming from VM's on WiFi-connected laptops fail the MAC Address Verification test provided by DHCP Snooping: the L2 source MAC address does not match the L3 requester MAC address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Our solution was to turn off DHCP Snooping MAC Address Verification for the office WiFi, though we plan on leaving it on for the guest WiFi and telling guests to use NAT rather than Bridged connections in their VMs should the need arise.&lt;/p&gt;&#xA;" OwnerUserId="5240" LastActivityDate="2017-06-17T23:11:15.153" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42008" PostTypeId="1" AcceptedAnswerId="42010" CreationDate="2017-06-17T23:53:41.207" Score="0" ViewCount="63" Body="&lt;p&gt;I am in search of a network protocol recommendation for the following scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would like to have a load balance routing protocol that can alter the cost of a router based on its current load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;eg:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router A can reach Router D via Router B and Router C&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router B becomes saturated and using a load balance routing protocol Router B sends an update to all its peers about its current load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Router A then prioritizes Router C over Router B because it has less load.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can this be possible ? maybe BGP or MPLS-TE?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks,&lt;/p&gt;&#xA;" OwnerUserId="33844" LastActivityDate="2017-06-18T01:12:58.070" Title="Route protocol based on network load" Tags="|bgp|mpls|load-balancing|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42010" PostTypeId="2" ParentId="42008" CreationDate="2017-06-18T01:12:58.070" Score="2" Body="&lt;p&gt;Yes - such features exist in a couple of protocols, and I'll give a couple of examples.  They're not in wide-use, though, because in actual usage they're virtually always a terrible idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First off - there isn't really a notion of a &lt;em&gt;router&lt;/em&gt; individually being busy, but rather &lt;strong&gt;links&lt;/strong&gt; between particular sets of routers being busy. The idea has generally been to respond to a busy link by causing some number of upstream links to choose paths that are, ostensibly both less utilized and (normally) less preferred.  Keep in mind that I used the term &lt;em&gt;preferred&lt;/em&gt; rather than direct, as the means of choosing links may include any number of potential factors.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - let's look at a couple of easy examples:  Cisco's EIGRP and MPLS auto-bandwidth  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of EIGRP, as you may know the DUAL algorithm actually makes final metric determination (and thus routing decisions) based on several values known as K1-K5.  These are actually  various &lt;em&gt;multipliers&lt;/em&gt; of values that the protocol is carrying.  The values themselves are (minimum path) bandwidth, (additive) link delay, (minimum) link reliability and (maximum) link utilization.  This is all explained in good detail &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/ios-nx-os-software/enhanced-interior-gateway-routing-protocol-eigrp/whitepaper_C11-720525.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.  Again, though, these K values are &lt;strong&gt;integer multipliers&lt;/strong&gt; of these values, not the values themselves.  What's more, by default &lt;em&gt;three&lt;/em&gt; of these five values are actually left at zero while the other two are left at 1.  The net effect here is that link reliability and link utilization are &lt;em&gt;ignored&lt;/em&gt;, while link bandwidth and delay are actually used.  Why these attributes?  Because they are &lt;strong&gt;statically defined&lt;/strong&gt; on links.  In early deployments utilizing all of these values it was quickly discovered that the variability of these values could cause rippling instability in larger networks.  What's worse, &lt;em&gt;utilization&lt;/em&gt; in particular created an oscillation condition, where traffic would tend to be steered away from a busy link only to cause another set of links to become busy which would, in turn, redirect back to the original link.  The issue here is that the network is potentially never in a completely settled/predictable state.  This basically means that a busy link can actually commonly lead to network instability - which means that slowness for one set of users just resulted in unpredictable performance for potentially a great many users.  Similarly, link quality determination tended to magnify a circuit taking a few CRC errors into a network-wide convergence event.  At a minimum this churned CPU, but worst-case it could (and did) yield outages unto itself.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the MPLS case the implementation is quite different but many of the issues are the same.  In this case RSVP-TE is used to set up TE tunnels / LSP's (label switched paths) - which, for the unfamiliar, are specially signaled paths across an MPLS network.  These paths are unidirectional and in nature built between an ingress and egress router based on a number of factors learned about the intervening network via both traditional metric information and extended TE-specific data carried a link-state routing protocol (IS-IS or OSPF).  These factors can include bandwidth, link affinity/coloring attributes, explicit paths (i.e. which intervening nodes should be waypoints) &lt;em&gt;as well as&lt;/em&gt; traditional unidimensional IGP metrics (i.e. standard link-cost).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;RSVP actually provides the mechanism by which these TE LSP's are signaled through the network.  Based on the criteria the ingress router requests the routers on the way to the ingress will either signal back their acceptance of the path or provide admission control to reject a proposed path.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As mentioned there a bunch of criteria that can be used but if we focus on RSVP bandwidth we can see your use-case in action.  As an aside, RSVP bandwidth is a static attribute set on a per-link basis.  If a given LSP is configured to ask for a bandwidth reservation then this value is used for admission control by the intermediate routers.  If a given requested link has bandwidth then it is allowed and the total reservable bandwidth on that link is decremented by the reservation amount.  If the remaining reservable amount is insufficient then the request is denied and a different path is attempted.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;As an example - consider a diamond/square topology of four routers: A, B, C and D.  A connects to B and C and D connects to B and C.  The path A -&gt; B -&gt; D is all 10G, while the path A -&gt; C -&gt; D is all 1G.  Put another way, under normal circumstances a standard IGP will steer all traffic via the A-&gt;B link, leaving the A-&gt;C link in play as a backup.  In this case, though, there are already LSP's running via A-&gt;B that have reserved 9.5G out of 10G.  When A tries to set up a new LSP to D it will find that it can't signal a new 750M LSP via the preferred path so will, instead, signal via the lower-speed path via C.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So... A couple of side notes are in order:  First, the bandwidth requested on a given LSP is generally a &lt;em&gt;static&lt;/em&gt; value.  Second, there's nothing (by default) either restricting a given LSP from transmitting more than its reservation or, conversely, making unused bandwidth available to other paths.  Indeed, the bandwidth value itself on the interface is just an integer.  It's convenient to consider it in terms of kilobits, but it's not absolutely necessary.  It's also the case that while the simple case is that bandwidth on the link is allocated on a first-come/first-serve basis it's possible to both allow overbooking for certain types of traffic (i.e. allow, say, 8 gigabits of reservations for certain LSP's on a 1 gigabit link) and also to give relative priority to different LSP's (...so one LSP can bump another, possibly even knocking it offline if no other path is available).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So - with all this in mind (...and there's LOTS more to be written about TE) the idea with auto-bandwidth is that the ingress router starts off with an initial reservation but actually measures the amount of bandwidth entering the tunnel.  As the ingress sees the actual usage it will actually periodically &lt;em&gt;resignal&lt;/em&gt; the path.  If the actual utilization is less than the initial reservation then the intervening nodes know that more bandwidth is now available on the links our LSP traverses.  If the actual utilization is greater then the reservations are either updated or, if insufficient bandwidth is available, alternate links are selected.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This all sounds nice in principal but, again, this doesn't map very well to the real world.  One of the initial issues is that there's no guarantee of optimally efficient bandwidth distribution and, in fact, it's common for vendor implementations to actually have options to look amongst otherwise equivalent candidate paths and choose the least utilized, the otherwise most utilized or just random choice.  There are actually formal proofs for the fact that these methods end up being essentially equivalent and statistically likely to be suboptimal.  Much like the EIGRP case mentioned above, the problem is that as the network tries to move traffic around that the load condition on intervening links will tend to lead to ongoing instability and oscillation.  The periodicity of this oscillation can be adjusted (re-signaling timing can be adjusted to, say, once an hour or once a day) but this hasn't really yielded a substantially better experience in most networks and &lt;strong&gt;has&lt;/strong&gt; led to less determinism and greater instability in plenty of cases.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's been argued that using a central controller that can more intelligently respond to load conditions by forcing the re-signaling of LSP's can work really well.  This tends to follow a much more specific and bounded set of use-cases (...say, redirecting spiking backup traffic via links through an underutilized user site), rather than allowing a generalized algorithm to just go nuts across your entire network.  This is probably one of the better use-cases for so-called SDN, even though it predates our present use of the term by 10-15 years.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There's a good presentation on MPLS-TE and auto-bandwidth &lt;a href=&quot;https://www.nanog.org/sites/default/files/tues.general.steenbergen.autobandwidth.30.pdf&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt; but, as mentioned, the overall topic of TE can get pretty deep and will also vary based on vendor implementation (..and even within vendors based on hardware platform capabilities, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The point, though, is that while it &lt;em&gt;sounds&lt;/em&gt; like a good idea to be dynamically re-signaling networks based on observed traffic loads that in practice the network will rarely benefit and will often be destabilized by such approaches.  Engineer based on observed loading.  Make careful changes based on observed data.  A slight improvement in performance is useless when it brings a substantial decrease in stability.&lt;/p&gt;&#xA;" OwnerUserId="1172" LastActivityDate="2017-06-18T01:12:58.070" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42011" PostTypeId="1" AcceptedAnswerId="42016" CreationDate="2017-06-18T04:33:22.523" Score="0" ViewCount="6236" Body="&lt;p&gt;According to &lt;a href=&quot;https://en.wikipedia.org/wiki/Port_(computer_networking)&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://en.wikipedia.org/wiki/Port_(computer_networking)&lt;/a&gt;,&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;A port number is a 16-bit unsigned integer, thus ranging from 0 to&#xA;  65535&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I assume 16-bit is equal to 2 power of 16 (please correct me if I'm wrong).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, 2 power of 16 equal to 65536, not 65535. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;May I know how the calculation is performed for this?&lt;/p&gt;&#xA;" OwnerUserId="37268" LastEditorUserId="37268" LastEditDate="2017-06-18T04:39:28.123" LastActivityDate="2017-06-18T10:16:11.420" Title="Network port number; why 16-bit has 65535, not 65536?" Tags="|network|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42012" PostTypeId="1" AcceptedAnswerId="42014" CreationDate="2017-06-18T06:16:43.147" Score="2" ViewCount="794" Body="&lt;p&gt;I read about tagged ethernet frames, which include the extra 802.1Q field, and understand the concept and operation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing I wonder about is whether there is a way for a node receiving an Ethernet frame to distinguish between tagged frames and non-tagged frames.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I read in answers about Trunk ports where it's possible to have on untagged vlan on each port (e.g. &lt;a href=&quot;https://networkengineering.stackexchange.com/a/10565/19642&quot;&gt;https://networkengineering.stackexchange.com/a/10565/19642&lt;/a&gt;), so how does the switch know that the incoming frame is untagged? Is it just assumed based on the fields of the 802.1Q header not having sensible values?&lt;/p&gt;&#xA;" OwnerUserId="19642" LastActivityDate="2017-06-18T07:36:22.427" Title="Is there a way to distinguish tagged vs. untagged ethernet frames?" Tags="|vlan|ethernet|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42014" PostTypeId="2" ParentId="42012" CreationDate="2017-06-18T07:29:53.900" Score="3" Body="&lt;p&gt;The switch / NIC looks for the tag in each frame and since it's got it's special TPID value 0x8100 (where otherwise the Ethertype would be) the following two bytes are interpreted as PCP and VLAN ID values, and then the true Ethertype and the rest of the frame follows.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An untagged frame coming in from a VLAN trunk port is simply interpreted as belonging to the untagged VLAN.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-18T07:36:22.427" LastActivityDate="2017-06-18T07:36:22.427" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42015" PostTypeId="2" ParentId="41959" CreationDate="2017-06-18T07:58:39.583" Score="2" Body="&lt;p&gt;Yes. Configure client router to forward traffic from   Asa 5520 wan ip, ports IP 50 &amp;amp; UDP 500, to ASA 5505. Vpn configuration to be on ASA 5505, but peer IP to be used is Client router public IP. VPN will end up in ASA 5505 as the port forwarded.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit: Services/ports to forward : IKE (UDP 500) &amp;amp; ESP (IP 50)&lt;/p&gt;&#xA;" OwnerUserId="20895" LastEditorUserId="20895" LastEditDate="2019-02-14T12:26:46.807" LastActivityDate="2019-02-14T12:26:46.807" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="42016" PostTypeId="2" ParentId="42011" CreationDate="2017-06-18T10:16:11.420" Score="5" Body="&lt;p&gt;The port number is a representation of bit in base 2. &#xA;2 power of 16 equal to 65536: It is the amount of numbers in base 2 that can be created with 16 bits, the number 65536 does not represent the last number that can be created in base 2 with 16 bits&#xA;&lt;BR&gt;&#xA;In base 2, &lt;BR&gt;&#xA;first number is 0000,0000,0000,0000 , in base 10 is 0 &lt;BR&gt;&#xA;second number is 0000,0000,0000,0001, in base 10 is 1 &lt;BR&gt;&#xA;third number is 0000,0000,0000,0010, in base 10 is 2 &lt;BR&gt;&#xA;fourth number is 0000,0000,0000,0011,  in base 10 is 3 &lt;BR&gt;&#xA;...&lt;BR&gt;&#xA;65536-th number is 1111,1111,1111,1111,  in base 10 is 65535&#xA;&lt;BR&gt;&lt;BR&gt;&#xA;And therefore the last port is 65535 and not 65536&lt;/p&gt;&#xA;" OwnerUserId="37598" LastActivityDate="2017-06-18T10:16:11.420" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42022" PostTypeId="2" ParentId="22713" CreationDate="2017-06-18T12:36:42.027" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Edit: Just to make it clear, the question is whether this is possible without the ISP changing the routing table on their equipment. As such, what I really want to know is whether this form of subnetting can be done &quot;transparently&quot;, so to speak, without altering the configuration of the next upstream device. &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you need is &quot;proxy arp&quot;. When the ISP router arps for an address in one of your subnets your router responds to the arp request as-if it was a host. It will then receive the traffic from the Internet and be able to route it as desired.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-18T12:36:42.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42023" PostTypeId="2" ParentId="41994" CreationDate="2017-06-18T13:12:28.663" Score="3" Body="&lt;p&gt;I don't think there is a way to copy config from Cisco to Aruba as both run on different OS.&lt;/p&gt;&#xA;" OwnerUserId="37600" LastActivityDate="2017-06-18T13:12:28.663" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42024" PostTypeId="1" CreationDate="2017-06-18T13:35:20.353" Score="-1" ViewCount="356" Body="&lt;p&gt;I got this task recently and I'm not sure, how to work with masks in classful addressing. Can you explain this to me?&lt;/p&gt;&#xA;" OwnerUserId="37498" LastActivityDate="2017-06-18T13:58:47.740" Title="How to split class B addresses into 3 subnets (1 should be larger than others)" Tags="|ipv4|ip|" AnswerCount="1" CommentCount="2" ClosedDate="2017-06-18T21:11:01.730" ContentLicense="CC BY-SA 3.0" />
  <row Id="42025" PostTypeId="2" ParentId="42024" CreationDate="2017-06-18T13:53:20.670" Score="1" Body="&lt;p&gt;Classes are long obsolete (since 1993!), replaced by CIDR in &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1518&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1518&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1519&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 1519&lt;/a&gt;.&lt;/p&gt;&#xA;&lt;p&gt;What class B used to be back in the days is now known as /16, which you can subnet into four /18 subnets, two of which you can rejoin into a /17 subnet.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-06-18T13:58:47.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42027" PostTypeId="2" ParentId="32962" CreationDate="2017-06-18T18:39:17.283" Score="0" Body="&lt;p&gt;I struggled with a similar setup on a RB2011U too and tried many different tutorials. Funnily, the simplest solution worked for me.&#xA;Your device has a switch chip, which is way faster thant the CPU. You really should use it's capabilities.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Meta description:&lt;/h2&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Just take the default Home-AP setup, where ports 3-5 are slave to eth2 and there is (probably) a bridge, where eth2 is member of (and therefore 3-5 too).&lt;/li&gt;&#xA;&lt;li&gt;create the vlans you need on that bridge and define addresses&lt;/li&gt;&#xA;&lt;li&gt;define the vlan IDs on the switch (and of course, select the ports where you need the vlans)&lt;/li&gt;&#xA;&lt;li&gt;Configure the ports on the switch port configuration:&lt;/li&gt;&#xA;&lt;li&gt;for trunk ports: set vlan mode to anything but disabled, header to &quot;add if missing&quot;, default vlanid 1&lt;/li&gt;&#xA;&lt;li&gt;for access ports: vlan mode to anything but disabled, header to &quot;always strip&quot; and default vlanid to the vlan you want.&lt;/li&gt;&#xA;&lt;li&gt;if you have wifi stations on that device, create a bridge for the vlan, add the vlan and your wifi to it. don't forget to add &quot;switch cpu&quot; to your switch vlan configuration.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;since all ports are in a master-slave configuration and the switch knows which vlan is on which port, the CPU does not have to be involved when routing traffic.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Configuration:&lt;/h2&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;The device here has &lt;em&gt;two&lt;/em&gt; switch chips, with 5 ports each.&lt;/li&gt;&#xA;&lt;li&gt;eth2 and eth6 are master ports.&lt;/li&gt;&#xA;&lt;li&gt;eth3-5 are slave to eth2,  eth7-10 are slave to eth6.&lt;/li&gt;&#xA;&lt;li&gt;We want to add two vlans: 100 and 200&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I &lt;em&gt;think&lt;/em&gt; you could even solve this &lt;em&gt;without&lt;/em&gt; a bridge, since your device only has a single switch chip. (In theory) You could define the vlans on the master-port interface directly and skip adding a bridge. However, the config below uses a bridge.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# trunk bridge, probably already exists&#xA;/interface bridge add comment=defconf name=bridge&#xA;&#xA;# the master ports are probably already member of that bridge&#xA;/interface bridge port add bridge=bridge comment=defconf interface=eth02-master&#xA;/interface bridge port add bridge=bridge interface=eth06-master&#xA;&#xA;# create the vlans on the bridge&#xA;/interface vlan add interface=bridge name=vlan-guest-200 vlan-id=200&#xA;/interface vlan add interface=bridge name=vlan-int-100 vlan-id=100&#xA;&#xA;# vlan port config on the switch&#xA;/interface ethernet switch vlan add ports=eth02-master,eth03,eth04,eth05,switch1-cpu switch=switch1 vlan-id=100 independent-learning=no&#xA;/interface ethernet switch vlan add ports=eth02-master,switch1-cpu switch=switch1 vlan-id=200 independent-learning=no&#xA;&#xA;# if you have a device (like the RB2011U) with 2 switch chips, &#xA;# you need to configure the second switch too:&#xA;/interface ethernet switch vlan add ports=eth06-master,eth07,eth08,eth09,switch2-cpu switch=switch2 vlan-id=100&#xA;/interface ethernet switch vlan add ports=eth06-master,eth07,eth10,switch2-cpu switch=switch2 vlan-id=200&#xA;&#xA;# define the adresses of your vlans&#xA;/ip address add address=10.10.100.1/24 interface=bridge-vlan-int-100 network=10.10.100.0&#xA;/ip address add address=10.10.200.1/24 interface=bridge-vlan-guest-200 network=10.10.200.0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;trunk port configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface ethernet switch port set 2 default-vlan-id=1 vlan-header=add-if-missing vlan-mode=secure&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;access port configuration&lt;/strong&gt; (for entry 3 and 10, which probably are eth3 and eth10):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/interface ethernet switch port set 3 default-vlan-id=100 vlan-header=always-strip vlan-mode=secure&#xA;/interface ethernet switch port set 10 default-vlan-id=200 vlan-header=always-strip vlan-mode=secure&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;If your device should integrate a wifi AP station, you need to bridge it into the vlans:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# create a bridge for each vlan you need&#xA;/interface bridge add name=bridge-vlan-guest-200&#xA;&#xA;# add the vlan and wifi to the bridge&#xA;/interface bridge port add bridge=bridge-vlan-guest-200 interface=vlan-guest-200&#xA;/interface bridge port add bridge=bridge-vlan-guest-200 interface=wlan-guest-200&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37603" LastEditorUserId="37603" LastEditDate="2017-06-18T18:47:50.097" LastActivityDate="2017-06-18T18:47:50.097" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42028" PostTypeId="1" CreationDate="2017-06-18T19:27:42.603" Score="0" ViewCount="81" Body="&lt;p&gt;My university provides a VPN we can use to connect to on-campus resources (such as databases) while we are off-campus. Connecting to the VPN shows an IP address belonging to my university, which is enough for those databases to grant access.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, the IPTV service we use recently started detecting when we are connected to the VPN instead of actually being on campus, and says something along the lines of, &quot;You must be on campus to watch live TV.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How is the IPTV service able to distinguish between VPN users and actual on-campus users, and is there a way to bypass this check?&lt;/p&gt;&#xA;" OwnerUserId="37606" LastActivityDate="2017-06-18T19:33:38.033" Title="How can a website tell I am using a VPN to connect off-campus?" Tags="|vpn|" AnswerCount="1" CommentCount="2" ClosedDate="2017-06-24T17:23:49.637" ContentLicense="CC BY-SA 3.0" />
  <row Id="42029" PostTypeId="2" ParentId="42028" CreationDate="2017-06-18T19:33:38.033" Score="1" Body="&lt;p&gt;If the IPTV service is usually used with the campus network, there are several possibilities:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;the campus network detects VPN users and blocks the service or flags the user&lt;/li&gt;&#xA;&lt;li&gt;VPN users are routed through another public IP/subnet than other users&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Bypassing such filters is explicitly off-topic here.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-18T19:33:38.033" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42037" PostTypeId="1" AcceptedAnswerId="42068" CreationDate="2017-06-19T19:41:17.217" Score="0" ViewCount="104" Body="&lt;p&gt;Here is the scenario I have two private subnets in two separate VPCs.&lt;br&gt;&#xA;On ranges:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;10.0.0.0/16&lt;/li&gt;&#xA;&lt;li&gt;10.1.0.0/16&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The 10.1 subnet is connected to a VPN gateway to a customer's VPN that all works fine.  The customer has allowed all IPs on the 10.1.0.0/16 address space to access the box on their network and that's all good.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I want to do is have a box that is on the 10.0.0.0/16 subnet talk to the customer's network and make it look to the customer like it's coming from the 10.1.0.0/16 address range.  The connection will be using sftp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can connect the two VPCs together using VPC peering and that works great.  The issue is that boxes on the 10.0.0.0/16 range cannot talk to the customer's network due to rules on their router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to set up a private NAT box that sits on our 10.1.0.0 subnet and have the boxes on the 10.0.0.0 subnet use the NAT box to connect so the connection will work (as it will look to the customer that the requests are coming from a box in the 10.1.0.0/16 address space)?  Or is there another solution to this problem?&lt;/p&gt;&#xA;" OwnerUserId="37622" LastEditorUserId="775" LastEditDate="2021-05-04T23:39:59.313" LastActivityDate="2021-05-04T23:39:59.313" Title="AWS private NAT" Tags="|nat|aws|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42038" PostTypeId="2" ParentId="42037" CreationDate="2017-06-19T20:29:29.873" Score="0" Body="&lt;p&gt;I don't know if there is a better AWS-specific way of doing this but it should certainly be possible to do it using tunneling. A tunnel carries the packets from the client box to the NAT box. The NAT box then performs the NAT and releases the packet. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-19T20:29:29.873" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42040" PostTypeId="1" AcceptedAnswerId="42042" CreationDate="2017-06-19T22:10:04.750" Score="1" ViewCount="91" Body="&lt;p&gt;I am getting ready for the security+ exam, and I don't understand something in a video of security+ performance based question, In that video we were adding rules to the firewall for a group of computers to communicate to a server. The computer's IP address was 110.4.80.10/231, its subnet was &lt;code&gt;255.255.255.254&lt;/code&gt;, the server's IP address was &lt;code&gt;10.4.81.5/24&lt;/code&gt;, and its subnet is obviously &lt;code&gt;255.255.255.255&lt;/code&gt;. In that video he changed the subnet of the source IP address to &lt;code&gt;10.4.80.10/32&lt;/code&gt;, and the same with the destination IP address &lt;code&gt;10.4.81.5/32&lt;/code&gt;. The protocol was TCP and the port number was &lt;code&gt;443&lt;/code&gt; for HTTPS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't understand why he changed the subnet to &lt;code&gt;/32&lt;/code&gt; for both of them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.youtube.com/watch?v=t4q8EAsGhP8&quot; rel=&quot;nofollow noreferrer&quot;&gt;This si The Video &lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37625" LastEditorUserId="8499" LastEditDate="2017-12-07T02:49:21.347" LastActivityDate="2017-12-07T02:49:21.347" Title="Why do we change an IP address's network mask when adding it to routher rules from /23 to /32?" Tags="|router|firewall|subnet|network|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42042" PostTypeId="2" ParentId="42040" CreationDate="2017-06-19T23:52:36.630" Score="4" Body="&lt;p&gt;I'm not sure to which video are you referring, but let me go this one by one:&lt;/p&gt;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;From the networking point of view, IPv4 addresses, be it both source or destination addresses, don't carry a concept of network mask. Network masks are used only by routers to decide where to route the packet. You can take a look at the IP header and notice, there's no network mask anywhere - it's only source and destination address: &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc791#section-3.1%20*RFC%20791*&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 791&lt;/a&gt;. We can brag about classful and classless routing (but it's 2017 for Gods sake!), so lets leave it out from a discussion for clarity.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;From the security point of view (and that &lt;em&gt;may&lt;/em&gt; be it, I'm not sure from your vague description), yes - sometimes firewalls do base their rules on the concept of matching not only source or destination address (&lt;code&gt;10.4.80.10&lt;/code&gt; and &lt;code&gt;10.4.81.5&lt;/code&gt; in your example), but also a network mask. This is a strange and usually not intuitive way to match the &lt;em&gt;interface&lt;/em&gt; the packet should be checked against - on some older and more clunky gear that is the way implementation of the &lt;a href=&quot;http://www.cisco.com/c/en/us/about/security-center/unicast-reverse-path-forwarding.html&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;uRPF&quot;&gt;uRPF&lt;/a&gt; mechanism works. uRPF in essence tries to check if source (node) is not spoofing its IP address.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;em&gt;Maybe&lt;/em&gt;, and I'm guessing here, the video demonstrated that to match specific host, you need to specify &lt;code&gt;/32&lt;/code&gt; for IPv4 addresses (or &lt;code&gt;/128&lt;/code&gt; for IPv6 addresses) to signify it's a host, not a network. But again - I'm guessing here, you haven't provided URL of the video to which you're referring.&lt;/p&gt;&#xA;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&lt;p&gt;And no, &lt;code&gt;/24&lt;/code&gt; is not &amp;quot;obviously&amp;quot; &lt;code&gt;255.255.255.255&lt;/code&gt;, it's &lt;code&gt;255.255.255.0&lt;/code&gt; - you can play with various subnet masks on great site at &lt;a href=&quot;http://subnetmask.info/&quot; rel=&quot;nofollow noreferrer&quot;&gt;subnetmask.info&lt;/a&gt; - one of many of it's kind.&lt;/p&gt;&#xA;" OwnerUserId="286" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-12-07T02:45:02.097" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42044" PostTypeId="2" ParentId="26543" CreationDate="2017-06-20T06:07:06.017" Score="1" Body="&lt;p&gt;Low duty cycle means lower power consumption and heat generation.&lt;/p&gt;&#xA;" OwnerUserId="5240" LastActivityDate="2017-06-20T06:07:06.017" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42048" PostTypeId="2" ParentId="41613" CreationDate="2017-06-20T08:27:14.887" Score="1" Body="&lt;p&gt;At this moment there's no way to reset DF-bit flag from incoming packets to Juniper SRX.&lt;/p&gt;&#xA;" OwnerUserId="29556" LastActivityDate="2017-06-20T08:27:14.887" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42052" PostTypeId="2" ParentId="35162" CreationDate="2017-06-20T14:55:00.283" Score="0" Body="&lt;p&gt;You can use tshark (or wireshark) which has some options to get latency, jitter and other metrics:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;       -z icmp,srt[,filter]&#xA;           Compute total ICMP echo requests, replies, loss, and percent loss, as well as minimum, maximum, mean, median and sample standard deviation SRT statistics typical of what ping provides.&#xA;&#xA;       -z rtp,streams&#xA;           Collect statistics for all RTP streams and calculate max. delta, max. and mean jitter and packet loss percentages.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Note that for the above 2 options to work, you will need to respectively have ICMP and RTP packets in your network capture.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example using ICMP and RTP sample captures from &lt;a href=&quot;https://wiki.wireshark.org/SampleCaptures&quot; rel=&quot;nofollow noreferrer&quot;&gt;Wireshark Sample Captures&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ tshark -qr nflog.pcap -z icmp,srt&#xA;==========================================================================&#xA;ICMP Service Response Time (SRT) Statistics (all times in ms):&#xA;Filter: &amp;lt;none&amp;gt;&#xA;&#xA;Requests  Replies   Lost      % Loss&#xA;6         4         2          33.3%&#xA;&#xA;Minimum   Maximum   Mean      Median    SDeviation     Min Frame Max Frame&#xA;0.000     1116.657  279.166   0.003     558.328        29        37        &#xA;==========================================================================&#xA;&#xA;$ tshark -qr aaa.pcap -z rtp,streams&#xA;========================= RTP Streams ========================&#xA;    Src IP addr  Port    Dest IP addr  Port       SSRC          Payload  Pkts         Lost   Max Delta(ms)  Max Jitter(ms) Mean Jitter(ms) Problems?&#xA;    192.168.1.2 30000   212.242.33.36 40392 0x3796CB71 ITU-T G.711 PCMA     9     0 (0.0%)           69.95            7.80           18.02 &#xA;==============================================================&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37641" LastActivityDate="2017-06-20T14:55:00.283" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42053" PostTypeId="1" CreationDate="2017-06-20T15:18:24.090" Score="1" ViewCount="162" Body="&lt;p&gt;Here’s my scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have 2 offices and a remote worker. &#xA;Office 1: 192.168.11.0/24 – Cisco ASA 5505, ASA 8.2(5)&#xA;Office 2: 192.168.12.0/24 – Cisco ASA 5505, ASA 8.2(5)&#xA;Office 2 printer: 192.168.12.50&#xA;Remote workers 192.168.54.0/24 – Cisco Anyconnect client 3.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Office 1 and 2 are connected with a site to site VPN. &#xA;The remote worker connects with the anyconnect client to office 1.&#xA;There’s a printer installed in office 2 that the user needs to print to.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Office 1 can talk to both the remote workers network and to the office 2 network, but the remote workers network cannot talk to office 2 network, and vice versa. I’ve tried adding routes and firewall rules to both of the ASAs, but I’m not completely sure which interface to apply the routes and rules to, or if there’s anything else that I’m missing to get connectivity between office 2 and the remote workers. Any help would be greatly appreciated!&#xA;Office 1 config (main office)&#xA;Main office&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Result of the command: &quot;sh run&quot;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;:&#xA;ASA Version 8.2(5) &#xA;!&#xA;hostname BHBBJASA&#xA;[...]&#xA;!&#xA;interface Vlan1&#xA; nameif inside&#xA; security-level 100&#xA; ip address 192.168.11.253 255.255.255.0 &#xA;!&#xA;interface Vlan2&#xA; nameif outside&#xA; security-level 0&#xA; ip address [External IP] 255.255.255.224 &#xA;!&#xA;interface Vlan22&#xA; description Secondary ISP Internet line for backup Internet in the event of Primary ISP failure.&#xA; no nameif&#xA; security-level 0&#xA; ip address Secondary ISP 255.255.255.252 &#xA;!&#xA;interface Vlan32&#xA; no forward interface Vlan2&#xA; nameif SIP&#xA; security-level 0&#xA; ip address New_SIP 255.255.255.224 &#xA;!&#xA;ftp mode passive&#xA;dns domain-lookup inside&#xA;dns domain-lookup outside&#xA;dns server-group DefaultDNS&#xA; name-server 192.168.11.231&#xA; name-server 8.8.8.8&#xA; domain-name medserv.local&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object-group network WESTPARKMEDITECH&#xA; network-object host [External IP]&#xA; network-object host [External IP]&#xA; network-object host [External IP]&#xA; network-object host [External IP]&#xA; network-object host [External IP]&#xA; network-object host [External IP]&#xA; network-object host [External IP]&#xA;object-group network DM_INLINE_NETWORK_1&#xA; network-object host WPHPACS&#xA; group-object WESTPARKMEDITECH&#xA;object-group network PVHCPACS&#xA; network-object host PVHPACS1&#xA; network-object host PVHPACS2&#xA; network-object host PVHPACS3&#xA;object-group network 192&#xA; network-object 192.168.1.0 255.255.255.0&#xA;object-group service tcp tcp&#xA; port-object eq 3389&#xA;object-group network DM_INLINE_NETWORK_2&#xA; network-object host WPHPACS&#xA; network-object [External IP] 255.255.255.0&#xA; network-object host [External IP]&#xA; network-object host [External IP]&#xA; network-object host WPHPACS6_5Upgrade&#xA;object-group network voice-data&#xA; network-object 192.168.121.0 255.255.255.0&#xA; network-object 192.168.221.0 255.255.255.0&#xA;object-group network inside-data-voice&#xA; network-object 192.168.11.0 255.255.255.0&#xA; network-object 192.168.21.0 255.255.255.0&#xA;object-group network DM_INLINE_NETWORK_4&#xA; network-object OmniMRI-Pacs 255.255.255.0&#xA; network-object host OmniMRI&#xA;object-group protocol DM_INLINE_PROTOCOL_2&#xA; protocol-object ip&#xA; protocol-object icmp&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_3&#xA; protocol-object ip&#xA; protocol-object icmp&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_4&#xA; protocol-object ip&#xA; protocol-object icmp&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group network DM_INLINE_NETWORK_5&#xA; network-object OmniMRI-Pacs 255.255.255.0&#xA; network-object host OmniMRI&#xA;object-group protocol DM_INLINE_PROTOCOL_1&#xA; protocol-object ip&#xA; protocol-object icmp&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group protocol DM_INLINE_PROTOCOL_5&#xA; protocol-object ip&#xA; protocol-object icmp&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group service VOIP-SIP_for_PhoneSystem&#xA; service-object tcp-udp range 10000 20000 &#xA; service-object tcp-udp eq 143 &#xA; service-object tcp-udp eq 22 &#xA; service-object tcp-udp eq 443 &#xA; service-object tcp-udp range sip 5062 &#xA; service-object tcp-udp eq 5222 &#xA; service-object tcp-udp eq 5269 &#xA; service-object tcp-udp eq 843 &#xA; service-object tcp-udp eq www &#xA; service-object tcp eq sip &#xA;object-group network DM_INLINE_NETWORK_3&#xA; network-object host WPHPACS&#xA; network-object [External IP] 255.255.255.0&#xA;object-group network DM_INLINE_NETWORK_6&#xA; network-object host WPHPACS&#xA; network-object host WPHPACS6_5Upgrade&#xA;object-group protocol TCPUDP&#xA; protocol-object udp&#xA; protocol-object tcp&#xA;object-group service DM_INLINE_SERVICE_1&#xA; service-object tcp-udp &#xA; service-object ip &#xA; group-object VOIP-SIP_for_PhoneSystem&#xA;object-group service DM_INLINE_SERVICE_2&#xA; service-object tcp-udp &#xA; service-object ip &#xA; group-object VOIP-SIP_for_PhoneSystem&#xA;object-group service DM_INLINE_SERVICE_3&#xA; service-object ip &#xA; group-object VOIP-SIP_for_PhoneSystem&#xA;object-group service DM_INLINE_SERVICE_4&#xA; service-object ip &#xA; group-object VOIP-SIP_for_PhoneSystem&#xA;object-group network DM_INLINE_NETWORK_7&#xA; network-object Platinum_Office 255.255.255.0&#xA; network-object Worland_Office 255.255.255.0&#xA;object-group network DM_INLINE_NETWORK_8&#xA; network-object 192.168.11.0 255.255.255.0&#xA; network-object Worland_Office 255.255.255.0&#xA;object-group network DM_INLINE_NETWORK_11&#xA; network-object 192.168.11.0 255.255.255.0&#xA; network-object Worland_Office 255.255.255.0&#xA;object-group protocol DM_INLINE_PROTOCOL_6&#xA; protocol-object ip&#xA; protocol-object icmp&#xA;object-group service DM_INLINE_TCP_2 tcp&#xA; port-object eq 3389&#xA; port-object eq 50000&#xA;object-group network DM_INLINE_NETWORK_10&#xA; network-object host Washakie_PACS_Live&#xA; network-object host Washakie_Pacs_Test&#xA;object-group network DM_INLINE_NETWORK_12&#xA; network-object host Washakie_PACS_Live&#xA; network-object host Washakie_Pacs_Test&#xA;object-group network DM_INLINE_NETWORK_13&#xA; network-object host Washakie_PACS_Live&#xA; network-object host Washakie_Pacs_Test&#xA;object-group network DM_INLINE_NETWORK_14&#xA; network-object host Washakie_PACS_Live&#xA; network-object host Washakie_Pacs_Test&#xA;object-group network DM_INLINE_NETWORK_15&#xA; network-object host Washakie_PACS_Live&#xA; network-object host Washakie_Pacs_Test&#xA;object-group network DM_INLINE_NETWORK_16&#xA; network-object 192.168.11.0 255.255.255.0&#xA; network-object Platinum_Office 255.255.255.0&#xA;object-group network VPN-Network&#xA;object-group protocol DM_INLINE_PROTOCOL_7&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA; protocol-object icmp&#xA;object-group protocol DM_INLINE_PROTOCOL_8&#xA; protocol-object ip&#xA; protocol-object udp&#xA; protocol-object tcp&#xA; protocol-object icmp&#xA;access-list inside_nat0_outbound extended permit ip 192.168.11.0 255.255.255.0 object-group DM_INLINE_NETWORK_1 &#xA;access-list inside_nat0_outbound extended permit ip 192.168.11.0 255.255.255.0 object-group PVHCPACS &#xA;access-list inside_nat0_outbound extended permit ip host [External IP] host 192.168.11.15 &#xA;access-list inside_nat0_outbound extended permit ip any 192.168.221.0 255.255.255.0 &#xA;access-list inside_nat0_outbound extended permit ip any 192.168.121.0 255.255.255.0 &#xA;access-list inside_nat0_outbound extended permit ip object-group inside-data-voice object-group voice-data &#xA;access-list inside_nat0_outbound extended permit ip 192.168.11.0 255.255.255.0 OmniMRI-Pacs 255.255.255.0 &#xA;access-list inside_nat0_outbound extended permit ip 192.168.11.0 255.255.255.0 [External IP] 255.255.255.0 &#xA;access-list outside_cryptomap_1 extended permit ip 192.168.11.0 255.255.255.0 object-group PVHCPACS &#xA;access-list Gottschi_access_in extended permit ip any any &#xA;access-list Gottschi_nat0_outbound extended permit ip 192.168.11.0 255.255.255.0 any &#xA;access-list inside_access_in extended permit ip any any &#xA;access-list inside_access_in extended permit tcp host PhoneSystemPublicIP any eq https inactive &#xA;access-list inside_access_in extended permit tcp host PhoneSystem any eq https inactive &#xA;access-list inside_access_in extended permit tcp any host [External IP] eq 3389 &#xA;access-list inside_access_in extended permit tcp any any eq 3389 &#xA;access-list inside_access_in extended permit tcp any any eq https &#xA;access-list inside_access_in extended permit ip 192.168.11.0 255.255.255.0 [External IP] 255.255.255.0 &#xA;access-list inside_access_in extended permit ip any [External IP] 255.255.255.0 &#xA;access-list inside_access_in extended permit ip any host New_SIP &#xA;access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_3 Platinum_Office 255.255.255.0 any &#xA;access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_4 Worland_Office 255.255.255.0 any &#xA;access-list inside_access_in extended permit tcp any host [External IP] eq https &#xA;access-list inside_access_in extended permit tcp host Opal-Rad-PACS host [External IP] eq 50000 inactive &#xA;access-list inside_access_in extended permit ip Washakie 255.255.255.0 192.168.11.0 255.255.255.0 &#xA;access-list inside_access_in extended permit ip object-group DM_INLINE_NETWORK_12 any &#xA;access-list inside_access_in extended permit ip host Hot_Springs_PACS 192.168.11.0 255.255.255.0 &#xA;access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_8 RemoteAccessNetwork 255.255.255.0 any &#xA;access-list outside_in extended permit tcp any host [External IP] eq 3389 &#xA;access-list outside_in extended permit ip 192.168.1.0 255.255.255.0 any &#xA;access-list outside_in extended permit tcp host [External IP] 192.168.11.0 255.255.255.0 &#xA;access-list outside_in extended permit udp host [External IP] 192.168.11.0 255.255.255.0 &#xA;access-list outside_in extended permit ip host [External IP] 192.168.11.0 255.255.255.0 &#xA;access-list outside_in extended permit icmp any any &#xA;access-list outside_in extended permit icmp host [External IP] 192.168.11.0 255.255.255.0 &#xA;access-list outside_in extended permit tcp any host [External IP] object-group DM_INLINE_TCP_2 &#xA;access-list outside_in extended permit tcp any host [External IP] eq https &#xA;access-list outside_in extended permit object-group VOIP-SIP_for_PhoneSystem any host PhoneSystemPublicIP &#xA;access-list outside_in extended permit ip any host PhoneSystemPublicIP inactive &#xA;access-list outside_in extended permit tcp host PhoneSystemPublicIP any eq https inactive &#xA;access-list outside_in extended permit ip any any &#xA;access-list outside_in extended permit tcp any any eq https &#xA;access-list outside_in extended permit object-group DM_INLINE_PROTOCOL_6 object-group DM_INLINE_NETWORK_3 object-group DM_INLINE_NETWORK_11 &#xA;access-list outside_in extended permit ip [External IP] 255.255.255.0 192.168.11.0 255.255.255.0 &#xA;access-list outside_in extended permit icmp any host New_SIP &#xA;access-list outside_in extended permit ip any host New_SIP &#xA;access-list outside_in extended permit object-group DM_INLINE_SERVICE_2 Platinum_Office 255.255.255.0 any &#xA;access-list outside_in extended permit object-group DM_INLINE_SERVICE_1 Worland_Office 255.255.255.0 any &#xA;access-list outside_in extended permit ip 192.168.11.0 255.255.255.0 Washakie 255.255.255.0 &#xA;access-list outside_in extended permit ip Washakie 255.255.255.0 192.168.11.0 255.255.255.0 &#xA;access-list outside_in extended permit ip object-group DM_INLINE_NETWORK_13 any &#xA;access-list outside_in extended permit ip host Hot_Springs_PACS 192.168.11.0 255.255.255.0 &#xA;access-list outside_in extended permit tcp any host [External IP] eq 8080 &#xA;access-list outside_in extended permit object-group DM_INLINE_PROTOCOL_7 RemoteAccessNetwork 255.255.255.192 any &#xA;access-list outside_cryptomap extended permit ip 192.168.11.0 255.255.255.0 192.168.1.0 255.255.255.0 &#xA;access-list deleteme extended permit ip host [External IP] any inactive &#xA;access-list deleteme extended permit ip host [External IP] any &#xA;access-list inside_nat0_outbound_1 extended permit ip host [External IP] any &#xA;access-list inside_nat0_outbound_1 extended permit icmp host [External IP] any &#xA;access-list outside_nat0_outbound extended permit ip host [External IP] any &#xA;access-list outside_nat0_outbound extended permit icmp host [External IP] any &#xA;access-list outside_nat0_outbound_1 extended permit ip host [External IP] host 192.168.11.15 &#xA;access-list outside_nat0_outbound_1 extended permit ip RemoteAccessNetwork 255.255.255.0 any &#xA;access-list remoteaccess_splittunnelacl standard permit 192.168.11.0 255.255.255.0 &#xA;access-list remoteaccess_splittunnelacl standard permit 192.168.21.0 255.255.255.0 &#xA;access-list remoteaccess_splittunnelacl standard permit 192.168.221.0 255.255.255.0 &#xA;access-list remoteaccess_splittunnelacl standard permit 192.168.121.0 255.255.255.0 &#xA;access-list remoteaccess_splittunnelacl standard permit RemoteAccessNetwork 255.255.255.0 &#xA;access-list remoteaccess_splittunnelacl standard permit Worland_Office 255.255.255.0 &#xA;access-list remoteaccess_splittunnelacl standard permit Platinum_Office 255.255.255.0 &#xA;access-list outside_nat0_outbound_2 extended permit ip 192.168.11.0 255.255.255.0 OmniMRI-Pacs 255.255.255.0 &#xA;access-list outside_nat0_outbound_2 extended permit ip [External IP] 255.255.255.0 object-group DM_INLINE_NETWORK_16 &#xA;access-list outside_nat0_outbound_2 extended permit ip object-group DM_INLINE_NETWORK_15 192.168.11.0 255.255.255.0 &#xA;access-list outside_cryptomap_2 extended permit ip object-group inside-data-voice object-group voice-data &#xA;access-list mycap extended permit ip host [External IP] host [External IP] &#xA;access-list mycap extended permit ip host [External IP] host [External IP] &#xA;access-list outside_5_cryptomap extended permit object-group DM_INLINE_PROTOCOL_5 192.168.11.0 255.255.255.0 [External IP] 255.255.255.0 &#xA;access-list outside_cryptomap_3 extended permit ip object-group DM_INLINE_NETWORK_8 object-group DM_INLINE_NETWORK_2 &#xA;access-list inside_access_out extended permit ip host PhoneSystem any inactive &#xA;access-list inside_access_out extended permit tcp any any eq https &#xA;access-list inside_access_out extended permit ip any any &#xA;access-list inside_nat0_outbound_2 extended permit ip 192.168.11.0 255.255.255.0 [External IP] 255.255.255.0 &#xA;access-list inside_nat0_outbound_2 extended permit ip 192.168.11.0 255.255.255.0 object-group PVHCPACS &#xA;access-list inside_nat0_outbound_2 extended permit ip 192.168.11.0 255.255.255.0 object-group DM_INLINE_NETWORK_6 &#xA;access-list inside_nat0_outbound_2 extended permit ip 192.168.11.0 255.255.255.0 object-group DM_INLINE_NETWORK_7 &#xA;access-list inside_nat0_outbound_2 extended permit ip 192.168.11.0 255.255.255.0 Washakie 255.255.255.0 &#xA;access-list inside_nat0_outbound_2 extended permit ip 192.168.11.0 255.255.255.0 object-group DM_INLINE_NETWORK_14 &#xA;access-list inside_nat0_outbound_2 extended permit ip Platinum_Office 255.255.255.0 host WPHPACS &#xA;access-list inside_nat0_outbound_2 extended permit ip 192.168.11.0 255.255.255.0 host Hot_Springs_PACS &#xA;access-list inside_nat0_outbound_2 extended permit ip 192.168.11.0 255.255.255.0 RemoteAccessNetwork 255.255.255.192 &#xA;access-list inside_nat0_outbound_2 extended permit ip 192.168.11.0 255.255.255.0 192.168.11.0 255.255.255.0 &#xA;access-list outside_cryptomap_4 extended permit ip 192.168.11.0 255.255.255.0 Platinum_Office 255.255.255.0 &#xA;access-list SIP_access_in extended permit ip any any &#xA;access-list SIP_access_in extended permit ip 192.168.11.0 255.255.255.0 any &#xA;access-list outside_cryptomap_5 extended permit ip 192.168.11.0 255.255.255.0 Worland_Office 255.255.255.0 &#xA;access-list outside_cryptomap_6 extended permit ip 192.168.11.0 255.255.255.0 object-group PVHCPACS &#xA;access-list outside_9_cryptomap extended permit ip 192.168.11.0 255.255.255.0 object-group DM_INLINE_NETWORK_10 &#xA;access-list outside_cryptomap_7 extended permit ip 192.168.11.0 255.255.255.0 host Hot_Springs_PACS &#xA;pager lines 24&#xA;logging enable&#xA;logging asdm debugging&#xA;mtu inside 1500&#xA;mtu outside 1500&#xA;mtu SIP 1500&#xA;ip local pool Remoteusers 192.168.54.1-192.168.54.50&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;icmp permit any inside&#xA;icmp permit any outside&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;global (outside) 1 interface&#xA;nat (inside) 0 access-list inside_nat0_outbound_2&#xA;nat (inside) 1 0.0.0.0 0.0.0.0&#xA;nat (outside) 0 access-list outside_nat0_outbound_2&#xA;nat (outside) 0 access-list outside_nat0_outbound_1 outside&#xA;static (inside,outside) tcp [External IP] 3389 domain.local 3389 netmask 255.255.255.255 &#xA;static (inside,outside) tcp [External IP] https domain.local https netmask 255.255.255.255 &#xA;static (inside,outside) tcp interface https Opal-Rad-PACS https netmask 255.255.255.255 &#xA;static (inside,outside) PhoneSystemPublicIP PhoneSystem netmask 255.255.255.255 &#xA;access-group inside_access_in in interface inside&#xA;access-group inside_access_out out interface inside&#xA;access-group outside_in in interface outside&#xA;route outside 0.0.0.0 0.0.0.0 [External IP] 10&#xA;route inside Platinum_Office 255.255.255.0 192.168.12.1 1&#xA;route inside RemoteAccessNetwork 255.255.255.0 192.168.54.1 1&#xA;timeout xlate 3:00:00&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;http server enable&#xA;http 192.168.1.0 255.255.255.0 inside&#xA;http 192.168.11.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;snmp-server enable traps snmp authentication linkup linkdown coldstart&#xA;no sysopt connection permit-vpn&#xA;crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac &#xA;crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac &#xA;crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac &#xA;crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac &#xA;crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac &#xA;crypto ipsec security-association lifetime seconds 28800&#xA;crypto ipsec security-association lifetime kilobytes 4608000&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map outside_map 1 match address outside_cryptomap_3&#xA;crypto map outside_map 1 set pfs &#xA;crypto map outside_map 1 set peer [External IP] &#xA;crypto map outside_map 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5&#xA;crypto map outside_map 2 match address outside_cryptomap_1&#xA;crypto map outside_map 2 set peer [External IP] &#xA;crypto map outside_map 2 set transform-set ESP-3DES-MD5 ESP-3DES-SHA&#xA;crypto map outside_map 2 set reverse-route&#xA;crypto map outside_map 3 match address outside_cryptomap&#xA;crypto map outside_map 3 set peer [External IP] &#xA;crypto map outside_map 3 set transform-set ESP-3DES-MD5&#xA;crypto map outside_map 3 set reverse-route&#xA;crypto map outside_map 4 match address outside_cryptomap_2&#xA;crypto map outside_map 4 set peer [External IP] &#xA;crypto map outside_map 4 set transform-set ESP-3DES-SHA&#xA;crypto map outside_map 5 match address outside_5_cryptomap&#xA;crypto map outside_map 5 set peer OmniMRI &#xA;crypto map outside_map 5 set transform-set ESP-3DES-SHA&#xA;crypto map outside_map 5 set reverse-route&#xA;crypto map outside_map 6 match address outside_cryptomap_4&#xA;crypto map outside_map 6 set pfs group1&#xA;crypto map outside_map 6 set peer [External IP] &#xA;crypto map outside_map 6 set transform-set ESP-3DES-SHA&#xA;crypto map outside_map 7 match address outside_cryptomap_5&#xA;crypto map outside_map 7 set peer [External IP] &#xA;crypto map outside_map 7 set transform-set ESP-3DES-SHA&#xA;crypto map outside_map 8 match address outside_cryptomap_6&#xA;crypto map outside_map 8 set peer [External IP] &#xA;crypto map outside_map 8 set transform-set ESP-3DES-MD5&#xA;crypto map outside_map 9 match address outside_9_cryptomap&#xA;crypto map outside_map 9 set pfs group1&#xA;crypto map outside_map 9 set peer [External IP] &#xA;crypto map outside_map 9 set transform-set ESP-3DES-SHA&#xA;crypto map outside_map 10 match address outside_cryptomap_7&#xA;crypto map outside_map 10 set pfs &#xA;crypto map outside_map 10 set peer [External IP] &#xA;crypto map outside_map 10 set transform-set ESP-AES-256-MD5 ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-128-MD5 ESP-3DES-SHA&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map outside_map interface outside&#xA;crypto ca trustpoint BHB_ASDM_TrustPoint0&#xA; enrollment self&#xA; subject-name CN=medserv.local&#xA; keypair VPN&#xA; crl configure&#xA;crypto ca certificate chain BHB_ASDM_TrustPoint0&#xA; certificate *************************&#xA;  quit&#xA;crypto isakmp enable inside&#xA;crypto isakmp enable outside&#xA;crypto isakmp policy 5&#xA; authentication pre-share&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 28800&#xA;crypto isakmp policy 10&#xA; authentication pre-share&#xA; encryption des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp policy 30&#xA; authentication rsa-sig&#xA; encryption 3des&#xA; hash sha&#xA; group 2&#xA; lifetime 86400&#xA;crypto isakmp ipsec-over-tcp port 10000 &#xA;telnet 192.168.11.0 255.255.255.0 inside&#xA;telnet timeout 5&#xA;ssh timeout 5&#xA;console timeout 0&#xA;dhcpd dns 192.168.11.250&#xA;dhcpd auto_config outside&#xA;!&#xA;dhcpd auto_config outside interface inside&#xA;!&#xA;&#xA;threat-detection basic-threat&#xA;threat-detection statistics access-list&#xA;no threat-detection statistics tcp-intercept&#xA;ssl trust-point BHB_ASDM_TrustPoint0 outside&#xA;webvpn&#xA; port 8080&#xA; enable outside&#xA; portal-access-rule 1 permit any&#xA; svc image disk0:/anyconnect-win-2.5.2014-k9.pkg 1 regex &quot;Windows NT&quot;&#xA; svc profiles BHB_remote disk0:/bhb_remote.xml&#xA; svc enable&#xA; tunnel-group-list enable&#xA;group-policy DfltGrpPolicy attributes&#xA;group-policy &quot;Omni Imaging&quot; internal&#xA;group-policy &quot;Omni Imaging&quot; attributes&#xA; vpn-tunnel-protocol IPSec l2tp-ipsec &#xA;group-policy GroupPolicy7 internal&#xA;group-policy GroupPolicy7 attributes&#xA; vpn-tunnel-protocol IPSec &#xA;group-policy GroupPolicy6 internal&#xA;group-policy GroupPolicy6 attributes&#xA; vpn-tunnel-protocol IPSec &#xA;group-policy GroupPolicy5 internal&#xA;group-policy GroupPolicy5 attributes&#xA; vpn-tunnel-protocol IPSec &#xA;group-policy GroupPolicy4 internal&#xA;group-policy GroupPolicy4 attributes&#xA; vpn-tunnel-protocol IPSec &#xA;group-policy GroupPolicy3 internal&#xA;group-policy GroupPolicy3 attributes&#xA; vpn-tunnel-protocol IPSec l2tp-ipsec &#xA;group-policy GroupPolicy2 internal&#xA;group-policy GroupPolicy2 attributes&#xA; vpn-tunnel-protocol IPSec &#xA;group-policy GroupPolicy1 internal&#xA;group-policy GroupPolicy1 attributes&#xA; vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn&#xA;group-policy PVHC internal&#xA;group-policy remoteaccess internal&#xA;group-policy remoteaccess attributes&#xA; dns-server value 192.168.11.250&#xA; vpn-access-hours none&#xA; vpn-idle-timeout none&#xA; vpn-session-timeout none&#xA; vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn&#xA; split-tunnel-policy tunnelspecified&#xA; split-tunnel-network-list value remoteaccess_splittunnelacl&#xA; default-domain value bhbbj.local&#xA; nem enable&#xA; webvpn&#xA;  url-list none&#xA;group-policy bhbremote internal&#xA;group-policy bhbremote attributes&#xA; dns-server value 4.4.2.2 8.8.8.8&#xA; vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn&#xA; default-domain value medserv.local&#xA;group-policy  internal&#xA;group-policy  attributes&#xA; vpn-filter none&#xA; vpn-tunnel-protocol IPSec &#xA;group-policy WPH internal&#xA;group-policy WPH attributes&#xA; vpn-tunnel-protocol IPSec l2tp-ipsec webvpn&#xA;username admin password ************************ encrypted privilege 15&#xA;username vpntunnel password ******************* encrypted&#xA;username vpntunnel attributes&#xA; vpn-group-policy remoteaccess&#xA;username cerium password ********************* encrypted privilege 15&#xA;username ltemplin password ******************* encrypted&#xA;username ltemplin attributes&#xA; vpn-group-policy bhbremote&#xA;tunnel-group [External IP] type ipsec-l2l&#xA;tunnel-group [External IP] general-attributes&#xA; default-group-policy WPH&#xA;tunnel-group [External IP] ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group [External IP] type ipsec-l2l&#xA;tunnel-group [External IP] ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group [External IP] type ipsec-l2l&#xA;tunnel-group [External IP] general-attributes&#xA; default-group-policy GroupPolicy1&#xA;tunnel-group [External IP] ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group remoteaccess type remote-access&#xA;tunnel-group remoteaccess general-attributes&#xA; address-pool (inside) remoteusers&#xA; address-pool (inside) Remoteusers&#xA; default-group-policy remoteaccess&#xA;tunnel-group remoteaccess ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group [External IP] type ipsec-l2l&#xA;tunnel-group [External IP] general-attributes&#xA; default-group-policy &#xA;tunnel-group [External IP] ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group [External IP] type ipsec-l2l&#xA;tunnel-group [External IP] general-attributes&#xA; default-group-policy &quot;Omni Imaging&quot;&#xA;tunnel-group [External IP] ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group [External IP] type ipsec-l2l&#xA;tunnel-group [External IP] general-attributes&#xA; default-group-policy GroupPolicy6&#xA;tunnel-group [External IP] ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group [External IP] type ipsec-l2l&#xA;tunnel-group [External IP] ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group [External IP] type ipsec-l2l&#xA;tunnel-group [External IP] ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group [External IP] type ipsec-l2l&#xA;tunnel-group [External IP] general-attributes&#xA; default-group-policy GroupPolicy5&#xA;tunnel-group [External IP] ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group [External IP] type ipsec-l2l&#xA;tunnel-group [External IP] ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group bhbremote type remote-access&#xA;tunnel-group bhbremote general-attributes&#xA; address-pool Remoteusers&#xA; default-group-policy bhbremote&#xA;tunnel-group bhbremote ipsec-attributes&#xA; pre-shared-key *****&#xA;tunnel-group BHB_VPN type remote-access&#xA;tunnel-group BHB_VPN general-attributes&#xA; address-pool Remoteusers&#xA;tunnel-group BHB_VPN ipsec-attributes&#xA; trust-point BHB_ASDM_TrustPoint0&#xA;tunnel-group BHB type remote-access&#xA;tunnel-group BHB general-attributes&#xA; address-pool (inside) Remoteusers&#xA; address-pool Remoteusers&#xA; default-group-policy remoteaccess&#xA;tunnel-group BHB webvpn-attributes&#xA; group-alias BHB enable&#xA; group-url https://[External IP]/BHB enable&#xA;!&#xA;class-map inspection_default&#xA; match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA; parameters&#xA;  message-length maximum client auto&#xA;  message-length maximum 512&#xA;policy-map global_policy&#xA; class inspection_default&#xA;  inspect dns preset_dns_map &#xA;  inspect ftp &#xA;  inspect h323 h225 &#xA;  inspect h323 ras &#xA;  inspect rsh &#xA;  inspect rtsp &#xA;  inspect esmtp &#xA;  inspect sqlnet &#xA;  inspect skinny  &#xA;  inspect sunrpc &#xA;  inspect xdmcp &#xA;  inspect netbios &#xA;  inspect tftp &#xA;  inspect ip-options &#xA;!&#xA;service-policy global_policy global&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37642" LastEditorUserId="2142" LastEditDate="2017-06-20T18:40:24.513" LastActivityDate="2017-06-20T18:40:24.513" Title="Trouble routing between subnets" Tags="|routing|cisco-asa|vpn|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="42054" PostTypeId="2" ParentId="42053" CreationDate="2017-06-20T15:34:11.370" Score="3" Body="&lt;p&gt;I am not a Cisco VPN expert but here are a couple of things you need to check:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;When a remote worker connects to the VPN, it needs to obtain a route towards the printer (192.168.12.50)&lt;/li&gt;&#xA;&lt;li&gt;For the reverse path, the printer needs to have a route towards the remote worker's subnet (or a default route towards an equipment that knows how to route packets towards the remote worker's subnet)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="37641" LastActivityDate="2017-06-20T15:34:11.370" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42055" PostTypeId="1" CreationDate="2017-06-20T17:21:36.987" Score="3" ViewCount="1258" Body="&lt;p&gt;Recently access outbound from all my LAN servers has stopped working. I have a 7206VXR running 12.3(4r)T3 which has a LAN interface using RFC 1918 IP addressing, and a WAN connection to our ISP using static routing. I'm trying to see if there is an error in the config that is causal, or if it's a recent ISP change.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The WAN interface is marked as &quot;ip nat outside&quot;, and the LAN interface as &quot;ip nat inside&quot;. For this example, let's assume our allocated external IP block is 100.100.100.0/24, which is being routed to our assumed WAN IP of 20.20.20.194.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WAN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/2&#xA;  description WAN connection. ISP is 20.20.20.193&#xA;  ip address 20.20.20.194 255.255.255.248&#xA;  ip access-group 120 in&#xA;  ip nat outside&#xA;  duplex full&#xA;  speed 1000&#xA;  media-type rj45&#xA;  no negotiation auto&#xA;  no keepalive&#xA;  no cdp enable&#xA; [...]&#xA;ip route 0.0.0.0 0.0.0.0 20.20.20.193&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;LAN:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface GigabitEthernet0/3&#xA; description Primary LAN&#xA; ip address 192.168.49.1 255.255.255.0&#xA; ip nat inside&#xA; duplex full&#xA; speed 1000&#xA; media-type rj45&#xA; negotiation auto&#xA; no cdp enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I have quite a few lines for NAT. Here are a couple (IPs are representative):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip nat inside source static 192.168.49.10 100.100.100.10&#xA;ip nat inside source static 192.168.49.117 100.100.100.117&#xA;[...]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And an outbound ACL:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;access-list 120 permit ip any any established&#xA;access-list 120 permit ip any host 100.100.100.117 eq 80&#xA;access-list 120 permit ip any host 100.100.100.117 eq 22&#xA;[...]&#xA;access-list 120 deny   ip any any&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;My problem is that I can ssh and access the web server at 100.100.100.117 just fine. However, once I'm ssh'ed in, I can't ping, traceroute or otherwise access anything outside of the LAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This was working fine a couple days ago, and no major changes have been made to the config. There was some work done by the ISP on disconnecting an old circuit, but I had already removed the routing for that CCT and the remaining couple NAT lines for it's network (we were running with 2 incoming ISPs).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So the meat of the question is, do I need to do anything else for NAT to work outbound? When this was working, I had made NAT entries in order for Internet access to services on my internal hosts. I could not get out to the WAN from a LAN device unless a NAT entry was there, and instead of creating a translation for every host, I have a proxy host to which the majority of my linux servers use for OS updates, installs, etc. But even on the few hosts that have the direct NAT translation in place, I can't ping, traceroute or otherwise access the Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm pretty sure the ISP has done something, but I just wanted to ask the group if anything looks wrong or missing in the relevant pieces of the config I have published.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks.&lt;/p&gt;&#xA;" OwnerUserId="31037" LastActivityDate="2021-01-04T02:28:04.583" Title="Static NAT problem preventing internet access from LAN" Tags="|routing|nat|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42057" PostTypeId="1" AcceptedAnswerId="42113" CreationDate="2017-06-20T19:55:37.180" Score="2" ViewCount="163" Body="&lt;p&gt;I periodically do a little with Cisco devices, but not very often. I used to have a filtering command that was pretty handy. It'd go something like:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show run | include interface next 5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That'd display every line of output that had &quot;interface&quot; and the next 5 lines after the line that had &quot;interface&quot; in it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Today I upgraded some new switches (3750X) to IOS 15.2(4)E4. And that &quot;next&quot; command switch doesn't seem to work. If I just do:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show run | include interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;That works by displaying only the line with &quot;interface&quot; in the line. But if I add &quot;next 5&quot;, it returns no results. Also, the &quot;prev&quot; command switch doesn't work either.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is appreciated.&lt;/p&gt;&#xA;" OwnerUserId="30515" LastEditorUserId="509" LastEditDate="2017-06-20T20:20:48.360" LastActivityDate="2017-09-21T02:44:36.837" Title="IOS 15.2(4)E4 pipe next command changed?" Tags="|cisco|cisco-commands|cisco-ios-15|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42058" PostTypeId="1" CreationDate="2017-06-20T21:01:00.843" Score="1" ViewCount="611" Body="&lt;p&gt;&lt;em&gt;I just saw level 1-2-3-4 (from Physical to Transport)&lt;/em&gt;&lt;br&gt;&#xA;We have the following : &lt;a href=&quot;https://i.stack.imgur.com/FPr0l.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/FPr0l.gif&quot; alt=&quot;7 Layers of OSI - Communication&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;The thing is&lt;/em&gt;&lt;/strong&gt;: We know that at layer 3 there is the IP protocol that uses DNS Server to get the IP Address of the destination (for example a website).&lt;br&gt;&#xA;Then we know that with the IP, our system call ARP to know what the MAC Address of the destination is (because Internet is based on Ethernet and Ethernet works with MAC right?).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;&lt;em&gt;Then&lt;/em&gt;&lt;/strong&gt; we know the route to follow to communicate with the other client.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;So imagine we went to send a mail : we go in gmail, we enter our data in the mail and then we hit enter, does the following happen ? :  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;With &lt;em&gt;DNS&lt;/em&gt; and &lt;em&gt;ARP&lt;/em&gt; we get the &lt;strong&gt;MAC&lt;/strong&gt; Address of the destination and the route to follow (not sure about this)&lt;/li&gt;&#xA;&lt;li&gt;We know that at layer 4 there is the &lt;em&gt;three-way handshake&lt;/em&gt; where systems communicates and determine how they will send and receive our data.  &lt;/li&gt;&#xA;&lt;li&gt;But how can they communicate ?  &lt;/li&gt;&#xA;&lt;li&gt;Does our router know the route of the DNS initially ?  &lt;/li&gt;&#xA;&lt;li&gt;How can we communicate if the route is not etablished between our 2 points ?  &lt;/li&gt;&#xA;&lt;li&gt;How can they communicate at layer 4 without passing through Network, Data and Physical ?  &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I bet they &lt;strong&gt;MUST&lt;/strong&gt; communicate by this way but how can you communicate and send data if you &lt;strong&gt;don't&lt;/strong&gt; have establish the communication initially ?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My main problem is to know &lt;strong&gt;HOW&lt;/strong&gt; system communicates at layers above 1 and how they do if they pass through other layers ?  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;Maybe this post is a little confusing but I'm a bit lost, thanks !&lt;/em&gt;&lt;br&gt;&#xA;&lt;strong&gt;If you have any video or gif or anything that show everything that happend when we send a message or anything to another pc through all layers it would be fantastic&lt;/strong&gt;&lt;/p&gt;&#xA;" OwnerUserId="37645" LastActivityDate="2017-06-20T21:12:08.097" Title="Question about the 7 layers of OSI Model" Tags="|ip|mac-address|osi|network|layer4|" AnswerCount="0" CommentCount="4" ClosedDate="2017-06-20T21:43:33.823" ContentLicense="CC BY-SA 3.0" />
  <row Id="42062" PostTypeId="1" AcceptedAnswerId="42063" CreationDate="2017-06-21T04:05:11.513" Score="1" ViewCount="136" Body="&lt;p&gt;I have an old 6500 with 6516a GBIC module (picture) and im planning to do some testing with it. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've already looked over Cisco's product page, and im still having a hard time identifying what SFP plug will fit in this module, no idea what it even looks like.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, is it possible to connect an SFP+ LC (single mode) fiber to this 6516a module? or do i need to purchase some sort of converter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dQGPE.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dQGPE.jpg&quot; alt=&quot;6516a-gbic module&quot;&gt;&lt;/a&gt; &lt;/p&gt;&#xA;" OwnerUserId="37652" LastActivityDate="2017-06-21T04:36:43.740" Title="what type of fiber SFP for cisco 6500 Gbic module" Tags="|cisco|cisco-catalyst|fiber|interface|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42063" PostTypeId="2" ParentId="42062" CreationDate="2017-06-21T04:36:43.740" Score="4" Body="&lt;p&gt;This particular blade does not use SFP format transceivers at all. It uses GBIC format transceivers. You can find more information for this blade on the &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/catalyst-6500-series-switches/product_data_sheet0900aecd801459a7.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;data sheet&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, no, you won't be able to connect a SFP + LC connector with this hardware. There is no converter to allow you to insert a SFP into a GBIC slot. However, all you need is a different fiber cable to connect to a GBIC, they use SC connectors as opposed to LC. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;GBICs and SFPs will communicate with each other just fine as long as they are the same type. So if you have an SFP on the other end of the cable, you would simply need a SC-LC fiber cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Since you mentioned single mode fiber, if the blade doesn't come with any GBICs (or the right kind), you would also most likely need a 1000BASE-LX/LH GBIC as well (most common SM fiber transceiver, however there are others). Fortunately, SFP has quickly overtaken GBIC as the standard form factor (main advantage being it's smaller size), so you can often find second hand GBIC transceivers at a very low cost.&lt;/p&gt;&#xA;" OwnerUserId="33" LastActivityDate="2017-06-21T04:36:43.740" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42064" PostTypeId="2" ParentId="41301" CreationDate="2017-06-21T05:33:25.110" Score="6" Body="&lt;p&gt;Software Defined networks do not have a device explicitly named as router. The Network is generally made of switches and controllers. However, can sdn networks achieve functionality of routing ?&#xA;Definitely!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sdn uses controllers. &#xA;In a very broad sense controllers work on the principle of match criteria  and  corresponding action . The controller uses the match criteria to instruct the switch what it should do with the packet. Hence switches in sdn are sometimes referred as dumb switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The match criteria can be destination mac - so it behaves as a switch &#xA;- L2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be destination IP . so it acts as a router. It can be source MAC or source IP . which is  a part of policy based routing .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or it can be any header field from l2-l5.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can even determine the action by using the application layer data&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hence a controller in sdn can be a router but it's capable of much more than that .&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But you wont find the word router used much in the context of sdn &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hope it helps &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To answer the second question .&#xA;Sdn gives you the control of packets forwarding.&#xA;So using controller APIs you can implement practically any algorithm which may be the exact routing algorithm we use now like ospf , a modification of them or a new concept altogether that suits your Network.&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-06-21T05:33:25.110" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42065" PostTypeId="1" AcceptedAnswerId="42066" CreationDate="2017-06-21T07:13:07.977" Score="0" ViewCount="239" Body="&lt;p&gt;I heard from a Cisco Training that Cisco switches don't have a power socket. And I actually searched for Switches' images, and indeed I don't see any.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does this mean that the switch doesn't need power? if so, how are all features powered up (for example Cisco IOS Operating System)?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/xbcTf.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/xbcTf.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36846" LastActivityDate="2017-06-21T07:48:22.630" Title="How do Cisco switches are supplied with power?" Tags="|cisco|switch|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42066" PostTypeId="2" ParentId="42065" CreationDate="2017-06-21T07:43:00.197" Score="3" Body="&lt;p&gt;A few selected switches, like &lt;a href=&quot;http://www.cisco.com/c/en/us/products/collateral/switches/slm2008-8-port-gigabit-smart-switch-pd-ac-power/data_sheet_c78-500596.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;this one&lt;/a&gt; can be powered by POE and thus don't use external power supply.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But all other switches (including the one in your photo) do require power and have a regular &lt;a href=&quot;https://en.wikipedia.org/wiki/IEC_60320#C13.2FC14_coupler&quot; rel=&quot;nofollow noreferrer&quot;&gt;C14 power socket&lt;/a&gt; on the backside.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many Cisco switches can be powered trough a regular C14 power socket (110 / 220V AC) as well as , for redundancy, trough a specific connector connected to a &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/switches/power_supplies/rps2300/hardware/installation/guide/2300hig/rpsoview.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Redundant Power System&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some others have dual traditional power supply (hot plug-able)&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-06-21T07:48:22.630" LastActivityDate="2017-06-21T07:48:22.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42067" PostTypeId="1" AcceptedAnswerId="42075" CreationDate="2017-06-21T07:47:38.590" Score="0" ViewCount="128" Body="&lt;p&gt;In the image below i run quagga ospfd daemons as routers in picture. I want to add 1+1 redundancy to 172.16.1.0 network this way: if 172.16.1.1 became unavailable 172.16.1.128 changes its IP address to 172.16.1.1 assigns relevant IP addresses to its interfaces and replace the now unavailable router. This process requires ospf to learn topology and converge in the new board and make network disconnected for some while. So i need a way to sync ospfd on 172.16.1.1 with ospfd on 172.16.1.128.&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Bdy7c.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Bdy7c.jpg&quot; alt=&quot;network&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="32215" LastEditorUserId="32215" LastEditDate="2017-06-21T09:41:57.997" LastActivityDate="2017-06-21T12:57:42.670" Title="Running quagga on a redundant board? (how to force ospfd to not send HELLOs?)" Tags="|ospf|redundancy|quagga|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="42068" PostTypeId="2" ParentId="42037" CreationDate="2017-06-21T09:17:47.527" Score="1" Body="&lt;p&gt;I found the solution to my problem was to setup an nginx box in the 10.1 subnet with a simple config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;worker_processes auto;&#xA;&#xA;error_log /var/log/nginx/error.log info;&#xA;&#xA;events {&#xA;    worker_connections  1024;&#xA;}&#xA;&#xA;stream {&#xA;    upstream external-vpn {&#xA;       server 22.11.11.11:9022;&#xA;    }&#xA;&#xA;    server {&#xA;        listen 9022;&#xA;        proxy_connect_timeout 60s;&#xA;        proxy_timeout 30s;&#xA;        proxy_pass external-vpn;&#xA;    }&#xA;&#xA;}&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;With this in place and running in a docker container on an ecs cluster I can successfully connect to the external vpn box via the nginx box over sftp.&lt;/p&gt;&#xA;" OwnerUserId="37622" LastActivityDate="2017-06-21T09:17:47.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42069" PostTypeId="1" AcceptedAnswerId="42070" CreationDate="2017-06-21T09:27:02.553" Score="0" ViewCount="5490" Body="&lt;p&gt;I am trying to understand how tracert works, &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;I did a &lt;code&gt;ping www.google.co.nz&lt;/code&gt;, found out Google's server IP is 172.217.25.131&lt;/li&gt;&#xA;&lt;li&gt;&lt;code&gt;tracer 172.217.25.131&lt;/code&gt;&lt;/li&gt;&#xA;&lt;li&gt;I got the following screen of information&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/lvlit.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/lvlit.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I please ask why there are three Request timed out?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Are step 3,4,5 failed attempts on one router or on three different routers?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="37657" LastEditorUserId="37657" LastEditDate="2017-06-21T09:33:45.147" LastActivityDate="2017-06-21T09:39:06.973" Title="tracert command return Request timed out" Tags="|ping|network-discovery|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42070" PostTypeId="2" ParentId="42069" CreationDate="2017-06-21T09:32:08.103" Score="3" Body="&lt;p&gt;Extract from Microsoft Support &lt;a href=&quot;https://support.microsoft.com/en-us/help/314868/how-to-use-tracert-to-troubleshoot-tcp-ip-problems-in-windows&quot; rel=&quot;nofollow noreferrer&quot;&gt;How to Use TRACERT to Troubleshoot TCP/IP Problems in Windows&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The TRACERT diagnostic utility determines the route to a destination&#xA;  by sending Internet Control Message Protocol (ICMP) echo packets to&#xA;  the destination. In these packets, TRACERT uses varying IP&#xA;  Time-To-Live (TTL) values. Because each router along the path is&#xA;  required to decrement the packet's TTL by at least 1 before forwarding&#xA;  the packet, the TTL is effectively a hop counter. When the TTL on a&#xA;  packet reaches zero (0), the router sends an ICMP &quot;Time Exceeded&quot;&#xA;  message back to the source computer.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;TRACERT sends the first echo packet with a TTL of 1 and increments the&#xA;  TTL by 1 on each subsequent transmission, until the destination&#xA;  responds or until the maximum TTL is reached. The ICMP &quot;Time Exceeded&quot;&#xA;  messages that intermediate routers send back show the route. Note&#xA;  however that some routers silently drop packets that have expired&#xA;  TTLs, and these packets are invisible to TRACERT.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So you can see that tracert rely on the router sending back an ICMP message &quot;Time Exceeded&quot;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many routers on the Internet   &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;either are configured to not send ICMP message, those routers won't answer to ping&lt;/li&gt;&#xA;&lt;li&gt;either silently drop a TTL expired packet (but may respond to ping)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;In both case, tracert doesn't receive any answer and display &quot;Request time out&quot;.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-06-21T09:39:06.973" LastActivityDate="2017-06-21T09:39:06.973" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42071" PostTypeId="1" CreationDate="2017-06-21T10:34:59.097" Score="0" ViewCount="1832" Body="&lt;p&gt;fWe know that they only care about the first 3 layers of OSI-Model so when a node receive the data from a PC/Server, it goes up to layer 2 (Here is MAC address) and then it goes up to Network layer (3) where it's now IP. Then :  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;How this node knows the route to follow to the other node ?  &lt;/li&gt;&#xA;&lt;li&gt;How do they communicates ?&lt;/li&gt;&#xA;&lt;li&gt;Do they use Ethernet ?  &lt;/li&gt;&#xA;&lt;li&gt;If yes, the internet is then considered as a local network ?   &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Further :&lt;/strong&gt;  &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Can I consider &lt;em&gt;my house and my equipment&lt;/em&gt; as a &lt;strong&gt;LAN&lt;/strong&gt; ? And then I saw that nodes connections are known as &lt;em&gt;Internet/Network&lt;/em&gt; but they use Ethernet and Ethernet is used in &lt;strong&gt;local network&lt;/strong&gt; so should we consider the connections between nodes as a &lt;strong&gt;local network&lt;/strong&gt; ?  &lt;/li&gt;&#xA;&lt;li&gt;And we know that Ethernet is &lt;em&gt;asynchronous&lt;/em&gt; so the Internet is asynchronous because it uses Ethernet ? &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="37645" LastEditorUserId="37645" LastEditDate="2017-06-21T11:11:43.460" LastActivityDate="2017-06-21T22:49:29.620" Title="How nodes/switches communicate between each other?" Tags="|switch|ip|mac-address|osi|" AnswerCount="3" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42072" PostTypeId="2" ParentId="42071" CreationDate="2017-06-21T11:32:04.657" Score="2" Body="&lt;p&gt;Let me try to unpack some of your questions.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;First, many of the terms you use, like &quot;local network&quot; do not have precise definitions.  They can mean different things depending on the context.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How this node knows the route to follow to the other node ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;The short answer -- it doesn't.  Nodes (or hosts) only know if the other host is on its local network or not.  If not, the sending host forwards the data to the configured gateway.  &lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;How do they communicate? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I'm not sure what you're asking here.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Do they use Ethernet? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ethernet is by far the most common layer 2 protocol for local area networks and some wide area links, but there are others for longer distance links.  Older technologies such as SONET, frame relay, TDM, are still in use.  Also, consider that Wi-Fi, which is very common for local area networks, is not Ethernet.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If yes, the internet is then considered as a local network ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Ethernet is a layer 2 protocol.  It was originally designed for use in local area networks, but as the technology matured, other uses were found for it.  Now it is used for some long-haul links. The protocol does not define whether a network is &quot;local&quot; or not.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Internet providers do not exclusively use Ethernet, especially on long distance links.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the definition of &quot;local&quot; is...well, there isn't a clear definition.  Most would agree that your home network is a local network.  Whether two connected nodes are &quot;local&quot; is dependent on the context.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-06-21T12:58:25.523" LastActivityDate="2017-06-21T12:58:25.523" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42073" PostTypeId="2" ParentId="23339" CreationDate="2017-06-21T11:45:19.917" Score="1" Body="&lt;p&gt;Be forewarned, you will probably need to reboot the Fortigate for the changes to take place.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Backup your entire config (not just the vdom)&lt;/li&gt;&#xA;&lt;li&gt;Open the config in a text editor&lt;/li&gt;&#xA;&lt;li&gt;Do a Search and replace of the old vdom name with the new name.&lt;/li&gt;&#xA;&lt;li&gt;Save the config under a new name, so that you have a backup of the old config.&lt;/li&gt;&#xA;&lt;li&gt;Restore the new config.&lt;/li&gt;&#xA;&lt;li&gt;Your vdoms should now be renamed.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="37660" LastActivityDate="2017-06-21T11:45:19.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42075" PostTypeId="2" ParentId="42067" CreationDate="2017-06-21T12:57:42.670" Score="1" Body="&lt;p&gt;There's really no need to change the IP address of the device, as long as your devices support VRRP (since it is linux based, it does)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Give to both devices an address within 172.16.1.0/24  (like .2 and .3) and set 172.16.1.1 as a virtual address with VRRP&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Then configure OSPF on all devices, setting the cost so the primary router will be preferred over the backup one.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-06-21T12:57:42.670" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42082" PostTypeId="1" CreationDate="2017-06-21T18:57:42.907" Score="0" ViewCount="1438" Body="&lt;p&gt;Our organization has a very long hall way. I have two WiFi routers in the hall, 1 on the West end and one on the East end. When an employee walks from West end to the east in, the tablet switches to the east end WiFi router and drops the network connection  for a split second. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The program we use on the tablet has a very low packet loss threshold. This means, the program will kick you out if any packets are lost. I believe we are losing the pack when the tablet switches to the other WiFi router. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Switching to the other WiFi router is fine, that is what I want it to do to extend the range of the wireless network. I set the WiFi routers up with the same SSID and password so if users on the West end walk to the east end they would have internet. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to have the tablet switch from the West WiFi Router to the East WiFi router without dropping it's connection for that split second ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For your information, these WiFi routers are in wifi mode and leasing out IP addresses to the tablets. Do I need some type of extender or need to run them in AP mode ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;How have you and other organizations solved this issue ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks &lt;/p&gt;&#xA;" OwnerUserId="35515" LastEditorUserId="35515" LastEditDate="2017-06-21T19:22:10.343" LastActivityDate="2017-06-21T22:34:49.113" Title="Tablet losing connection when switching to another router" Tags="|wireless|access-point|network-access|network|" AnswerCount="1" CommentCount="3" ClosedDate="2018-02-19T05:07:58.460" ContentLicense="CC BY-SA 3.0" />
  <row Id="42085" PostTypeId="1" AcceptedAnswerId="42164" CreationDate="2017-06-21T21:43:16.753" Score="1" ViewCount="2338" Body="&lt;p&gt;I'm trying to do up a wiring diagram for a VMWare cluster in a remote data center.  I typically will check the MAC addresses in VMWare VSphere client (&lt;code&gt;vmnic[x]&lt;/code&gt;) and/or use &lt;code&gt;esxcli&lt;/code&gt; to do so from SSH on the ESXi hosts.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll then log into the switch and look at the MAC table to see what port a MAC address was learned from and go from there.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having an odd issue with Huawei CloudEngine 6800 series switches where the MAC address that's reported in the MAC table (&lt;code&gt;display mac-addresses | include xxxx-xxxx-xxxx&lt;/code&gt;) is off on the last bit.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;For example, vmnic0 is one port on a Broadcom QLogic 57800 2x10GbE + 2x1GbE quad adapter, which reports as &lt;code&gt;xx:xx:xx:xx:xx:b5&lt;/code&gt;.  Filtering on &lt;code&gt;xxxx-xxxx-xxb5&lt;/code&gt; produced zero results in the filtering options.  However, there's an entry for &lt;code&gt;xxxx-xxxx-xxb6&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I checked a few more NICs and it appears that it's just the Broadcom QLogic 57800 (and 57810) ones are the only ones with inconsistencies, both 10GbE and 1GbE: it's as if the MACs are all off by a bit (&lt;code&gt;c0&lt;/code&gt; shows up as &lt;code&gt;c1&lt;/code&gt; on the switch, &lt;code&gt;c2&lt;/code&gt; as &lt;code&gt;c3&lt;/code&gt; and so on). &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now I'm a bit rusty, but I know that converged interfaces can be &quot;sliced up&quot; into sub-interfaces, which would have different MAC addresses, but that would also be represented higher up in the &quot;stack&quot; in ESXi, so presumably the source MAC is being parsed out of the frame correctly.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just not sure if this is a &quot;UX&quot; problem (the &lt;code&gt;display mac-addresses&lt;/code&gt; command/switch has bugs) or potentially a driver/incompatibility issue or I'm missing something here.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Command Outputs:&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;vmnic02&lt;/code&gt; is the only MAC address that's reporting &quot;correctly&quot;.  I guess you can assume that &lt;code&gt;b5&lt;/code&gt; is what the Huawei thinks is &lt;code&gt;b6&lt;/code&gt; and &lt;code&gt;b7&lt;/code&gt; is what the Huawei thinks is &lt;code&gt;b8&lt;/code&gt;, but I have no explanation as to why.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Card is this from what I can tell, going by the PCI slots (quad card, not dual)&#xA;&lt;a href=&quot;http://accessories.euro.dell.com/sna/productdetail.aspx?c=ie&amp;amp;l=en&amp;amp;s=dhs&amp;amp;cs=iedhs1&amp;amp;sku=540-bbfh#Overview&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://accessories.euro.dell.com/sna/productdetail.aspx?c=ie&amp;amp;l=en&amp;amp;s=dhs&amp;amp;cs=iedhs1&amp;amp;sku=540-bbfh#Overview&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Name    PCI Device    Driver  Admin Status  Link Status  Speed  Duplex  MAC Address         MTU  Description&#xA;------  ------------  ------  ------------  -----------  -----  ------  -----------------  ----  -------------------------------------------------------------&#xA;vmnic0  0000:01:00.0  bnx2x   Up            Up           10000  Full    11:22:33:44:55:b5  1500  Broadcom Corporation QLogic 57800 10 Gigabit Ethernet Adapter&#xA;vmnic1  0000:01:00.1  bnx2x   Up            Up           10000  Full    11:22:33:44:55:b7  1500  Broadcom Corporation QLogic 57800 10 Gigabit Ethernet Adapter&#xA;vmnic2  0000:01:00.2  bnx2x   Up            Up            1000  Full    11:22:33:44:55:b9 1500  Broadcom Corporation QLogic 57800 1 Gigabit Ethernet Adapter&#xA;vmnic3  0000:01:00.3  bnx2x   Up            Up            1000  Full    11:22:33:44:55:bb  1500  Broadcom Corporation QLogic 57800 1 Gigabit Ethernet Adapter&#xA;vmnic4  0000:83:00.0  bnx2x   Up            Up           10000  Full    aa:bb:cc:dd:ee:20  1500  Broadcom Corporation QLogic 57810 10 Gigabit Ethernet Adapter&#xA;vmnic5  0000:83:00.1  bnx2x   Up            Up           10000  Full    aa:bb:cc:dd:ee:22  1500  Broadcom Corporation QLogic 57810 10 Gigabit Ethernet Adapter&#xA;&#xA;&#xA;display mac-address | include 1122-3344-55&#xA;---- Flags: * - Backup&#xA;-------------------------------------------------------------------------------&#xA;MAC Address    VLAN/VSI                          Learned-From        Type&#xA;-------------------------------------------------------------------------------&#xA;1122-3344-55b6 15/-                               10GE1/0/1           dynamic&#xA;1122-3344-55b8 16/-                               10GE2/0/1           dynamic&#xA;1122-3344-55b9 19/-                               10GE2/0/9           dynamic&#xA;-------------------------------------------------------------------------------&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;EDIT 2017/06/28:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checked iDRAC on host, two 10GbE ports are configured in Standard Mode and iSCSI is not enabled on the adapters nor in ESXi (portgroup has iSCSI Bindings disabled) so I don't think is a case of a &quot;leaking&quot; iSCSI frame: if it was, you'd likely see an &lt;em&gt;extra&lt;/em&gt; MAC address, not an incorrect one as the total MAC count, despite being off incrementally, is still correct.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One thing I noticed is that ESXi vSphere Win32 client sees it as two dual adapters under host &gt; Configuration &gt; Network Adapters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Checked driver, seems ok, so still thinking this is a Huawei issue.  Think next step is to do a packet capture and/or call Huawei support.&lt;/p&gt;&#xA;" OwnerUserId="37668" LastEditorUserId="37668" LastEditDate="2017-06-28T11:33:02.380" LastActivityDate="2017-06-28T11:33:02.380" Title="Incorrect MAC address in switch MAC table" Tags="|mac-address|huawei|" AnswerCount="3" CommentCount="9" ClosedDate="2019-02-03T04:53:24.590" ContentLicense="CC BY-SA 3.0" />
  <row Id="42087" PostTypeId="2" ParentId="42071" CreationDate="2017-06-21T22:23:07.763" Score="0" Body="&lt;p&gt;For the follow up questions...&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Can I consider my house and my equipment as a LAN ? &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And then I saw&#xA;  that nodes connections are known as Internet/Network but they use&#xA;  Ethernet and Ethernet is used in local network so should we consider&#xA;  the connections between nodes as a local network ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Not sure I understand the question but I'll try to answer. The distinction between LAN and WAN can sometimes be a little fuzzy, which is why some people also use terms like Metropolitan Area Network (MAN). Typically though if devices are connected by Ethernet then they're considered in the LAN. The network would be considered a WAN once you bring WAN technologies into the mix (such as HDLC).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;And we know that Ethernet is asynchronous so the Internet is&#xA;  asynchronous because it uses Ethernet ?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Synchronous and asynchronous describe protocols for transmitting data, not networks. For example, you would call Ethernet an asynchronous protocol but you would never call a LAN asyncrhonous.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are synchronous and asynchronous LAN and WAN technologies. HDLC is an example of a WAN technology that is sychronous and Ethernet is an example of a LAN technology that is asynchronous.&lt;/p&gt;&#xA;" OwnerUserId="23968" LastActivityDate="2017-06-21T22:23:07.763" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42088" PostTypeId="2" ParentId="42082" CreationDate="2017-06-21T22:34:49.113" Score="1" Body="&lt;p&gt;Unfortunately in WiFi it is up to the client to decide when and how to roam from one access point (AP) to another. Additional 802.11 standards, like 802.11 r,k,v are meant to help the client in selecting the best AP and then to smoothly roam to it. Sadly, those protocols are rarely implemented in consumer routers/APs. In addition, they work well only on a network with same-vendor APs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to have a smooth roaming experience: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Make sure both APs are in the same IP network, use same SSID, same encryption scheme &lt;/li&gt;&#xA;&lt;li&gt;Leave enough coverage overlapping between the two APs&lt;/li&gt;&#xA;&lt;li&gt;Use APs from the &lt;strong&gt;same vendor&lt;/strong&gt; and supporting &lt;strong&gt;802.11rkv&lt;/strong&gt;. Avoid residential products, as they are unlikely to support those roaming protocols. Avoid different brands at the same time. Ubiquiti makes some cheap semi-professional APs that support 802.11r (fast roaming), as documented &lt;a href=&quot;https://help.ubnt.com/hc/en-us/articles/115004662107-UniFi-Fast-Roaming&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. &lt;/li&gt;&#xA;&lt;li&gt;Use clients that support 802.11rkv. For example, you can find out which Apple products support it  &lt;a href=&quot;https://support.apple.com/en-us/HT202628&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. This is also a nice and quick read to get a rough idea of what these protocols do. &lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="27472" LastActivityDate="2017-06-21T22:34:49.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42089" PostTypeId="2" ParentId="41301" CreationDate="2017-06-21T22:35:43.400" Score="0" Body="&lt;p&gt;SDN architectures separate control and data, and can be achieved by GRE overlay tunneling all packets back to a controller or by using a remote control protocol such as &lt;a href=&quot;https://www.opennetworking.org/sdn-resources/openflow&quot; rel=&quot;nofollow noreferrer&quot;&gt;OpenFlow®&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;SDN compatible&quot; networking devices don't really technically exist. In other words, in the wireless networking world we have &lt;a href=&quot;http://www.wi-fi.org/&quot; rel=&quot;nofollow noreferrer&quot;&gt;WiFi Compatible&lt;/a&gt; access points - a special stamp/logo that results from interoperability testing.  There is no such thing in the SDN world. SDN is all marketechture. Every networking manufacturer markets their own flavor of SDN, e.g. &lt;a href=&quot;http://www.cisco.com/c/en/us/solutions/software-defined-networking/sdn-data-center.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Cisco ACI&lt;/a&gt;, Cisco &lt;a href=&quot;https://meraki.cisco.com/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Meraki&lt;/a&gt;, &lt;a href=&quot;https://www.juniper.net/us/en/products-services/sdn/contrail/&quot; rel=&quot;nofollow noreferrer&quot;&gt;Juniper OpenContrail&lt;/a&gt;, and &lt;a href=&quot;https://www.vmware.com/products/nsx.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;VMware NSX&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Regarding the metrics for a routing algorithm, if you plan on developing a custom routing algorithm you would create that. Not sure I understand this second question...&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-06-21T22:35:43.400" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42090" PostTypeId="2" ParentId="42071" CreationDate="2017-06-21T22:49:29.620" Score="0" Body="&lt;p&gt;Ethernet is a technology or protocol that operates at the data link layer meaning that it has no awareness or need for Internet Protocol (IP). Nodes on an Ethernet network are addressed with a world-wide unique ID (MAC address). If node gets a frame not addressed to itself, it drops/ignores that frame.  That's it really.  Local Area Network is a non-technical term that simply signifies the physical area or size of a network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP is software. There's a whole IP &lt;a href=&quot;https://en.wikipedia.org/wiki/Internet_protocol_suite&quot; rel=&quot;nofollow noreferrer&quot;&gt;Suite of protocols&lt;/a&gt;. It exists for interoperability and is what the Internet is based off of.  Way back in the day, there was actually competition in this interoperability game - Apple had 'Appletalk' Novell had IPX/SPX.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-06-21T22:49:29.620" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="42093" PostTypeId="2" ParentId="41613" CreationDate="2017-06-22T03:15:50.683" Score="1" Body="&lt;p&gt;If you need to send them via an IPSEC tunnel (as you imply in your comment above) then simply:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;set security ipsec vpn MY-VPN df-bit clear&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="1392" LastActivityDate="2017-06-22T03:15:50.683" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="42094" PostTypeId="1" CreationDate="2017-06-22T03:28:59.217" Score="2" ViewCount="1338" Body="&lt;pre&gt;&lt;code&gt;mininet&amp;gt; dpctl dump-flows -O OpenFlow13&#xA;*** s1 ----------------------------------------------------------------&#xA;OFPST_FLOW reply (OF1.3) (xid=0x2):&#xA;cookie=0x0, duration=106.605s, table=0, n_packets=6, n_bytes=420, priority=0&#xA;actions=CONTROLLER:65509&#xA;mininet&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So this is the flow in an SDN switch (s1) after initially starting the controller and switch, but what is the prupose of this flow exactly? I don't quite understand it&lt;/p&gt;&#xA;" OwnerUserId="37676" LastActivityDate="2018-01-19T07:13:18.443" Title="What does this flow mean? (SDN)" Tags="|sdn|openflow|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42095" PostTypeId="1" AcceptedAnswerId="42096" CreationDate="2017-06-22T03:59:31.327" Score="5" ViewCount="325" Body="&lt;p&gt;First of all, I am new to the forum and am unsure whether this is the right place to post my question. If this is not the right place, I would appreciate you letting me know the best website to ask this question. I am a business person seeking the advice of those who know way more about this stuff than I ever will. I am grateful for any assistance you can provide.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm starting a startup accelerator and trying to spec and purchase sufficient bandwidth for a new facility.  I have quotes from two different providers at different levels of bandwidth but the prices are wildly different.  For example, one is providing 150Mbps bandwidth for $1100/Mo.  The other is providing 150Mbps for $250/mo.  There must be some profound reason why one is 4x the price.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm talking to each of the company representatives and asking them directly about this disparity, but - given that these people are selling - it would be useful to know from an independent source.:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;what's the likely difference between the two offerings? &lt;/li&gt;&#xA;&lt;li&gt;when is 150Mbps not equal to 150Mbps?  i.e. is there likely to be a real difference in the end user experience with vendor A's 150Mbps vs. vendor B's&#xA;150Mbps? If so, why?&lt;/li&gt;&#xA;&lt;li&gt;what questions would you be asking these vendors if you were in the market to buy new bandwidth?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;Both are fiber connections to the space. The space is in a multi-tenant building.&lt;/p&gt;&#xA;" OwnerUserId="37677" LastActivityDate="2017-06-23T10:09:17.327" Title="Differences between Enterprise internet connections with the same nominal bandwidth" Tags="|internet|bandwidth|service-provider|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42096" PostTypeId="2" ParentId="42095" CreationDate="2017-06-22T06:21:16.533" Score="6" Body="&lt;p&gt;A few things you should look at:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;is the bandwidth symmetrical? I.E. do you get 150Mbps download AND 150Mbps upload?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;is the bandwidth guaranteed?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;what are the S.L.A. (Service Level Agreement)? In case of SLA breach (that WILL happen), what do you get? What are their support processes?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;What are the size and reputation of both ISP? In case they are not major ISP, how many transit providers do they have?&lt;br&gt;&#xA;(not saying that a bigger ISP is better, sometime a smaller one will offer better price for the same services)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;do you get public IP address (IPv4 and IPv6) with the connection? How many (for IPv4)?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;since this is a multi tenant building, do you share the connection with other tenants, or do you have a dedicated fiber?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Edit to add:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;do they offer associated services, like protection form DDOS attack (uncommon), usage reporting (graphs)...&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="16930" LastEditorUserId="16930" LastEditDate="2017-06-23T10:09:17.327" LastActivityDate="2017-06-23T10:09:17.327" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42097" PostTypeId="2" ParentId="24321" CreationDate="2017-06-22T07:01:41.607" Score="0" Body="&lt;p&gt;This is the most powerful assertion - &quot;&lt;em&gt;As a rule of thumb latency will dominate the performance for actions that only involve a small ammount of data while bandwidth will dominate the performance for actions that involve a large ammount of data.&lt;/em&gt;&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Rephrasing this, every packet that leaves the source will arrive late at the destination owing to whatever latency. However, at the destination, the inflow of data will be at the specified speed of the medium (for example 1 GPS). Even So, the speed for each packet is lower (if the cable length is large) yet the information (bits) influx is (nearly) same as that is specified independent of the length.&lt;/p&gt;&#xA;" OwnerUserId="37681" LastActivityDate="2017-06-22T07:01:41.607" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42098" PostTypeId="1" AcceptedAnswerId="42100" CreationDate="2017-06-22T08:32:54.843" Score="1" ViewCount="17339" Body="&lt;p&gt;I'm building my own packets and sending them through a raw socket. The packet is apparently A-OK, but I'm not getting any replies.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sequence block is generated with a for loop.&#xA;Identifier block is generated randomly.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Sl6Jm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Sl6Jm.png&quot; alt=&quot;Simple icmp request&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is the information I get from Wireshark. This is true for every IP I try to ping to, even local.&lt;/p&gt;&#xA;" OwnerUserId="37684" LastActivityDate="2019-07-04T12:15:11.323" Title="Wireshark No response seen sending ping request" Tags="|wireshark|ping|packet-analysis|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42100" PostTypeId="2" ParentId="42098" CreationDate="2017-06-22T08:43:22.230" Score="1" Body="&lt;p&gt;You can check a couple of things.&#xA;1 check if the packet you have constructed is correct. I mean offsets, header length etc. Because if not,&#xA; the recipient will simply discard it &#xA;2 check if the packet is actually reaching the destination. Try tcpdump on the recipient.&#xA;3 once you know the packet is correct. Check other troubleshoot at other layers. Like if the host is doing an arp for dmac or are you supplying it in the packet. If arp, then does the destination reply. If manual is it the correct value. Does the sender have a route to destination. Does the destination have a return route. There are many possibilities if you post the outcome of above scenerios someone here can help you&lt;/p&gt;&#xA;" OwnerUserId="30735" LastActivityDate="2017-06-22T08:43:22.230" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42105" PostTypeId="2" ParentId="25710" CreationDate="2017-06-22T10:51:13.587" Score="0" Body="&lt;p&gt;Check out VPNTTG (VPN Tunnel Traffic Grapher) is a software for SNMP monitoring and measuring the traffic load for IPsec (Site-to-Site, Remote Access) and SSL (With Client, Clientless) VPN tunnels on a Cisco ASA. It allows the user to see traffic load on a VPN tunnel over time in graphical form.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Advantage of VPNTTG over other SNMP based monitoring software’s is following: Other (commonly used) software’s are working with static OID numbers, i.e. whenever tunnel disconnects and reconnects, it gets assigned a new OID number. This means that the historical data, gathered on the connection, is lost each time. However, VPNTTG works with VPN peer’s IP address and it stores for each VPN tunnel historical monitoring data into the Database.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For more information about VPNTTG please visit &lt;a href=&quot;http://www.vpnttg.com&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.vpnttg.com&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37695" LastActivityDate="2017-06-22T10:51:13.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42108" PostTypeId="1" AcceptedAnswerId="42109" CreationDate="2017-06-22T13:11:13.057" Score="11" ViewCount="6028" Body="&lt;p&gt;I've been looking into the way that 10 Gbps Ethernet encodes its data and I'm a little confused by the nomenclature. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have gathered, e.g. from here &lt;a href=&quot;http://www.ikn.no/download/Whitepaper-10G-Ethernet-10-08.pdf&quot; rel=&quot;noreferrer&quot;&gt;http://www.ikn.no/download/Whitepaper-10G-Ethernet-10-08.pdf&lt;/a&gt;, that Pulse Amplitude Modulation is used to pack more data into each &quot;symbol&quot; transmitted down the twisted pairs of a cable. Specifically, 10GBASE-T uses 16 of these levels, its key advantage over slower schemes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, my understanding is that two of these channels (or is it one channel and two consecutive symbols?) are combined into the 128 bit DSQ128 constellation, as shown in this diagram from the above reference. &#xA;&lt;a href=&quot;https://i.stack.imgur.com/GYBne.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/GYBne.png&quot; alt=&quot;PAM16 DSQ128 encoding constellation&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is done to increase the separation in phase space between adjacent encoding values, boosting the SNR by a factor of 3dB. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, it seems to me that by chucking out every other point in the constellation, we've now limited ourselves to 8 levels for each symbol. So, we use 2x PAM16 symbols and end up with 128 possible messages. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is, why bother with using PAM16 and then this &quot;constellation&quot; arrangement when we could get 128 possible messages out of two symbols by simply using PAM8? This has the same spacing between adjacent symbols as DSQ128 does. The only difference I can see is that DSQ128 has half of its voltages offset by 1 unit compared with a PAM 8 scheme. &lt;/p&gt;&#xA;" OwnerUserId="37700" LastActivityDate="2023-02-03T19:31:43.653" Title="Why does 10Gbps ethernet claim PAM16 encoding then use a squared DSQ128 constellation?" Tags="|ethernet|hardware|10gbase|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42109" PostTypeId="2" ParentId="42108" CreationDate="2017-06-22T13:23:25.153" Score="11" Body="&lt;p&gt;You're talking about 10GBASE-T - most other 10G flavors use straight 64b/66b (10GBASE-R), but that doesn't work on 500 MHz Cat 6A.&lt;/p&gt;&#xA;&lt;p&gt;With 10GBASE-T, two consecutive PAM-16 levels (on each lane) represent one two-dimensional symbol. Not all possible 256 symbols are used, but they are selected from 128 maximally spaced combinations (DSQ128). Of these 7 &amp;quot;raw&amp;quot; information bits, 3 are uncoded data, 4 are used for low-density parity check (LDPC). Check &lt;a href=&quot;http://standards.ieee.org/about/get/802/802.3.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Clause 55.1.3&lt;/a&gt; for details.&lt;/p&gt;&#xA;&lt;p&gt;Since that selection effectively doubles the signal spacings, the signal-to-noise ratio increases by a factor of two = 3 dB. That's the same as with two PAM-8 symbols, but those would convey only six bits of information, not seven.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2023-02-03T19:31:43.653" LastActivityDate="2023-02-03T19:31:43.653" CommentCount="4" ContentLicense="CC BY-SA 4.0" />
  <row Id="42110" PostTypeId="1" CreationDate="2017-06-22T14:58:49.750" Score="0" ViewCount="83" Body="&lt;p&gt;I am trying to open port 8443 on a verizon router. I have created the following rule:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP: 192.168.1.222&#xA;Rule: (HTTPS Secondary) TCP Any-&gt;8433 over WAN connection type: Broadband Connection (Ethernet/COAX)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have other rules that work okay - example:&#xA;192.168.1.222 (HTTP) -&gt; TCP Any-&gt;80 over wan: broadband connection (Ethernet/COAX)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my security log I keep seeing the following:&#xA;Jun 22 10:57:31 2017    Inbound Traffic Blocked - Default policy&#xA;TCP 199.83.243.62:53433-&gt;PUB.LIC.IP.ADDRESS:8443 on eth1&lt;/p&gt;&#xA;" OwnerUserId="37704" LastActivityDate="2017-06-22T16:57:36.023" Title="Port Forwarding - Verizon Router - Blocked - Default Policy" Tags="|router|" AnswerCount="1" CommentCount="4" ClosedDate="2017-06-22T20:59:21.527" ContentLicense="CC BY-SA 3.0" />
  <row Id="42111" PostTypeId="1" AcceptedAnswerId="42118" CreationDate="2017-06-22T15:27:35.820" Score="1" ViewCount="43" Body="&lt;p&gt;Is there a protocol for that switches, or devices with multiple network ports, could use to signal link changes, or some mean to try to detect link changes? The scenario I'm trying to solve is scenarios where devices can try to start using link local addressing when there is no DHCP server present, and to try to detect when DHCP server becomes available.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I realize this sounds a bit vague, so I'll try to clarify. When the devices below acquires a network link, they will first try to configure using DHCP, and if that not works they will fall back and use link local addressing (169.254.0.0/16)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;switch 1 -- switch 2 -- switch 3&#xA;`- dev1     `- dev2     `- dev3&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But if I connect a DHCP server to the network, I want the devices to reconfigure their network settings and use the addresses provided by the DHCP server. I also want to be able to detect when a link somewhere in the chain goes down (powerloss or something), and allow the isolated group reconfigure their network settings using link local addressing. I would also like to detect when two groups are connected again, so they can advertise their presence to each other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So, I'm looking for some kind of protocol that can provide information about the link status for the switches. I'll look into the spanning tree protocol.&lt;/p&gt;&#xA;" OwnerUserId="37705" LastEditorUserId="37705" LastEditDate="2017-06-22T23:02:30.170" LastActivityDate="2017-06-22T23:02:30.170" Title="Detecting or announcing link changes in a switched network" Tags="|dhcp|ip-link-local|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42112" PostTypeId="1" CreationDate="2017-06-22T15:41:36.150" Score="0" ViewCount="145" Body="&lt;p&gt;I would like to configure a switch to forward packets to/from a particular MAC address to the router first, regardless of whether the host it is connecting to is on the same switch &amp;amp; l3 network. This is so the traffic can pass through an inline device we have placed between the switch and router before being passed to the destination. Is there any way to configure something like this? I cannot modify the particular host itself, but I can modify the switch and inline device. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently my only thought is to essentially perform ARP spoofing so other hosts believe the MAC address for this particular host is a unique, non-existent MAC. We would configure the switch to send frames for this MAC towards our inline device, where we can then rewrite the MAC of the frame to the correct one on the way back to the switch. So we would be able to see all traffic headed to the particular device, but not traffic leaving it. Obviously this solution is not ideal, so any help or ideas would be greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="33010" LastEditorUserId="33010" LastEditDate="2017-06-22T15:48:04.460" LastActivityDate="2017-09-21T21:52:26.950" Title="Reroute All Packets To/From MAC to Router First" Tags="|switch|" AnswerCount="2" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="42113" PostTypeId="2" ParentId="42057" CreationDate="2017-06-22T15:46:33.933" Score="2" Body="&lt;p&gt;The answer is that prev and next were removed in IOS 15. The closest command they have to that functionality is the section command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Show run all | section interface&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30515" LastActivityDate="2017-06-22T15:46:33.933" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42114" PostTypeId="2" ParentId="42110" CreationDate="2017-06-22T16:57:36.023" Score="1" Body="&lt;p&gt;The issue was related to some static NAT we had setup. The requests were being translated to the public ip / nat'd address. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;We had to modify the static nat to add tcp 8443 to the list so that requests on this port go to the internal IP.&lt;/p&gt;&#xA;" OwnerUserId="37704" LastActivityDate="2017-06-22T16:57:36.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42118" PostTypeId="2" ParentId="42111" CreationDate="2017-06-22T20:06:06.053" Score="3" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Is there a protocol for that switches, or devices with multiple network ports, could use to signal link changes, or some mean to try to detect link changes?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes: Spanning tree topology change message that are sent by switches when a port (without BPDUGuard enable) change its state.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The scenario I'm trying to solve is scenarios where devices can try to start using link local addressing when there is no DHCP server present, and to try to detect when DHCP server becomes available.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I didn't understood what you are trying to achieve here. I also didn't understood what is the link between this sentence and the first one.&lt;/p&gt;&#xA;" OwnerUserId="37709" LastEditorUserId="16930" LastEditDate="2017-06-22T20:24:05.027" LastActivityDate="2017-06-22T20:24:05.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42119" PostTypeId="2" ParentId="42094" CreationDate="2017-06-22T20:13:42.057" Score="2" Body="&lt;p&gt;It is the default flow that sends all packets to the controller. The controller can then install new flows, or process the packets via PACKET_OUT messages.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I believe that if you use the &lt;code&gt;-m&lt;/code&gt; or &lt;code&gt;--more&lt;/code&gt; argument it will show you that it is actually a flow that matches all fields wildcarded. This is omitted by default. &lt;/p&gt;&#xA;" OwnerUserId="16691" LastEditorUserId="16691" LastEditDate="2017-06-22T21:34:32.000" LastActivityDate="2017-06-22T21:34:32.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42121" PostTypeId="2" ParentId="42112" CreationDate="2017-06-22T22:15:14.630" Score="0" Body="&lt;p&gt;In general the way to isolate a device is to put it on it's own VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need to keep the IP addresses the same then you will need some clever tricks on the router. Basically on the interface facing the isolated device you need to do proxy arp for all IPs while on the interface facing the rest of the network you need to do proxy arp for the IP of the isolated device. &lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-22T22:15:14.630" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42122" PostTypeId="1" CreationDate="2017-06-22T22:37:40.167" Score="2" ViewCount="4739" Body="&lt;p&gt;There is a wifi network with 5 computers. When one of these computers request a URL from internet, Can ISP know the MAC Address of the computer that made request or phone's IMEI number? Are these informations sent from router to ISP in IP packets? &lt;/p&gt;&#xA;" OwnerUserId="37711" LastActivityDate="2019-03-19T13:22:25.877" Title="Can ISP know computer MAC address in local network?" Tags="|wireless|mac-address|isp|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42123" PostTypeId="1" CreationDate="2017-06-23T00:40:44.727" Score="2" ViewCount="1002" Body="&lt;p&gt;Config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip route 172.27.8.17/32 172.24.0.141&#xA;ip route 172.27.8.17/32 172.24.0.102 2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Result:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show ip route 172.27.8.17&#xA;Routing entry for 172.27.8.17/32&#xA;  Known via &quot;static&quot;, distance 2, metric 0&#xA;    172.24.0.102, via me0_link1&#xA;&#xA;Routing entry for 172.27.8.17/32&#xA;  Known via &quot;static&quot;, distance 1, metric 0, best&#xA;  * 172.24.0.141, via me0_link2&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;as you see I set link2 as higher preference on static route, but when link2 failed, does router smart enough to adjust route to link1?&lt;/p&gt;&#xA;" OwnerUserId="4479" LastEditorUserId="8499" LastEditDate="2018-07-17T00:34:47.503" LastActivityDate="2022-05-29T07:02:15.247" Title="static route distance value fail over" Tags="|routing|router|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42124" PostTypeId="1" AcceptedAnswerId="42125" CreationDate="2017-06-23T02:45:39.377" Score="1" ViewCount="6944" Body="&lt;p&gt;I have this situation. There are two servers on my network. I don't know why. It's just the way it has been set up. The first server (Server1) has a local ip of 192.168.0.2 and the second one (Server2) has a local ip of 192.168.0.200. On the router, there is a configuration in port forwarding that a request for port 443 will be forwarded to Server1. However, now I need to host my website on Server2 (I can't host it on Server1) and I bought the ssl certificate and installed it. But any requests for https will be forwarded to Server1 as port 443 is the default one when the router see https. How could I solve this problem? My network team opened a new port for me 4430 so I can access my site using &lt;a href=&quot;https://www.example.com:4430&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.example.com:4430&lt;/a&gt;. However, I don't think it's practical for my users. Is there a configuration in port forwarding that I can set for port 443 on the router to determine which server the request should go to? For example changing the protocol and so on. Thanks.  &lt;/p&gt;&#xA;" OwnerUserId="37714" LastEditorUserId="8499" LastEditDate="2018-02-16T03:50:22.153" LastActivityDate="2018-02-16T03:50:22.153" Title="Configure port 443 to forward request to different servers" Tags="|router|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42125" PostTypeId="2" ParentId="42124" CreationDate="2017-06-23T02:55:41.883" Score="3" Body="&lt;p&gt;There are basically three possible solutions to this sort of problem all of them have their pros and cons.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;Multiple public IP addresses (and a router that can handle those addresses appropriately).&lt;/li&gt;&#xA;&lt;li&gt;A http proxy, your proxy accepts the connection, terminates the ssl/tls and forwards the decrypted traffic (possibly re-encrypting it) based on the http headers.&lt;/li&gt;&#xA;&lt;li&gt;A SNI proxy, your proxy accepts the connection but does not decrypt it, it uses the SNI extension in the TLS headers to decide where to forward it to. Downside here is that this only works with modern clients.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-06-23T02:55:41.883" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42126" PostTypeId="2" ParentId="42124" CreationDate="2017-06-23T03:00:50.207" Score="2" Body="&lt;p&gt;You have a few options that I know of. In no particular order:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Purchase a second IP address from your ISP. :443 on first ip goes to first server, :443 on second ip goes to second server. This is standard, inexpensive, and easy to configure.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Use a port other than :443 on the first server.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Specify source. For example, if connections to the first server always arrive with source ip 1.1.1.1, then say 1.1.1.1:xx -&gt; outside_ip:443 goes to Server 1. All other connections to :443 go to server 2.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="23968" LastActivityDate="2017-06-23T03:00:50.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42127" PostTypeId="2" ParentId="42122" CreationDate="2017-06-23T03:05:23.970" Score="6" Body="&lt;p&gt;A mac address doesn't make it past the first hop (most likely your home router). It stays local to the broadcast network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IMEI isn't transmitted over wifi, so your ISP will also not see your IMEI. Your cell provider definitely sees it though.&lt;/p&gt;&#xA;" OwnerUserId="23968" LastEditorUserId="23968" LastEditDate="2017-06-23T03:10:54.807" LastActivityDate="2017-06-23T03:10:54.807" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42128" PostTypeId="2" ParentId="42123" CreationDate="2017-06-23T03:14:19.963" Score="0" Body="&lt;p&gt;Assuming Cisco, the answer is no. It will keep sending to 172.24.0.141. You will need to configure tracking with an ip sla to failover properly.&lt;/p&gt;&#xA;" OwnerUserId="23968" LastActivityDate="2017-06-23T03:14:19.963" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42131" PostTypeId="1" AcceptedAnswerId="42133" CreationDate="2017-06-23T09:13:30.890" Score="1" ViewCount="234" Body="&lt;p&gt;As everybody know that we have 10/100/1000Mbps port. So I wonder that with 1000Mbps port, we just have maximum throughput at 1000Mbps (1Gbps), but some Firewall product, example Cisco ASA 5515-X, throughput max at 1.2Gbps. May be I get lost in somewhere. Anyone can explain for me?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Link: &lt;a href=&quot;http://www.cisco.com/c/en_ca/products/security/asa-5500-series-next-generation-firewalls/models-comparison.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en_ca/products/security/asa-5500-series-next-generation-firewalls/models-comparison.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you&lt;/p&gt;&#xA;" OwnerUserId="37688" LastActivityDate="2017-06-23T20:49:56.320" Title="Throughput up to 1.2Gbps?" Tags="|cisco|firewall|throughput|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42133" PostTypeId="2" ParentId="42131" CreationDate="2017-06-23T09:17:41.163" Score="4" Body="&lt;p&gt;As you can see on the image the device has multiple interfaces. The 1.2Gbps throughput is the total traffic it can process on all ports, not per port.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-06-23T09:17:41.163" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42139" PostTypeId="1" AcceptedAnswerId="42142" CreationDate="2017-06-23T13:06:20.937" Score="1" ViewCount="808" Body="&lt;p&gt;Can anybody direct me to a calculation of the maximum network diameter (number of devices) on an RSTP tree (RSTP, NOT STP)? &#xA;As far as I can understand from the standard and the RFC, there is no such a limit as RSTP does not use timers. What is the maximum loop you have configured ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Most (if not all) industrial switches all have proprietary protocols which improve convergence time, and most require physical port directionality configuration but I'm interested in plain RSTP.&lt;/p&gt;&#xA;" OwnerUserId="25472" LastEditorUserId="2142" LastEditDate="2017-06-23T15:07:02.780" LastActivityDate="2017-06-23T15:12:11.780" Title="RSTP 802.1w maximum network loop diameter" Tags="|loop|ieee-802.1w|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42142" PostTypeId="2" ParentId="42139" CreationDate="2017-06-23T15:12:11.780" Score="1" Body="&lt;p&gt;There is no theoretical limit, but memory/CPU may impose practical limits on particular hardware.  Depending on the topology, increasing the number of devices increases the convergence time.  When that becomes a problem depends on your particular situation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In my experience, loops tend to be small.  I don't recall ever seeing a looped configuration larger than 3 or 4 devices.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-06-23T15:12:11.780" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42143" PostTypeId="1" AcceptedAnswerId="42144" CreationDate="2017-06-23T15:41:46.907" Score="3" ViewCount="7585" Body="&lt;p&gt;Although this question might be marked as duplicated! I'm asking again because other question's answers like this couldn't help me. So please consider the case and don't mark it as duplicate and answer me.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying to know the value of EstimatedRTT at first time for this formula:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;EstimatedRTT = (1 – α) • EstimatedRTT + α • SampleRTT&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37728" LastEditorUserId="8499" LastEditDate="2018-10-26T19:14:15.773" LastActivityDate="2018-10-26T19:14:15.773" Title="What is the value of EstimatedRTT at first time?" Tags="|tcp|protocol-theory|layer4|transport-protocol|latency|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42144" PostTypeId="2" ParentId="42143" CreationDate="2017-06-23T15:58:34.917" Score="2" Body="&lt;p&gt;It can be any arbitrary value, completely dependent on the scenario. For instance, you may measure an initial RTT of 100ms. Now, the RTT measured for the next received packet/ACK may be say, 80ms. For the exponential weighted moving average model, &lt;em&gt;alpha&lt;/em&gt; is generally taken to be equal to 0.125 (of course, that may vary as per the model you desire, but it always lies in the interval (0,1)) and the newly estimated RTT would be:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;New RTT = (1-0.125)*100 + 0.125*80&#xA;        = 97.5 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Once again, if the next measured value of RTT is say 150ms, &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;New RTT = (1-0.125)*97.5 + 0.125*150&#xA;        = 104.0625 ms&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Thus, the initial RTT that you measure, which becomes a &lt;strong&gt;seed&lt;/strong&gt; for future values, is completely dependent on the network scenario and its parameters. &lt;/p&gt;&#xA;" OwnerUserId="35917" LastActivityDate="2017-06-23T15:58:34.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42145" PostTypeId="2" ParentId="33112" CreationDate="2017-06-23T16:08:23.130" Score="2" Body="&lt;p&gt;The best appropriate answer to your question is DHCP(Dynamic Host Configuration Protocol). When a computer or any network device connect to the network, it sends &lt;strong&gt;DHCP Discover Message&lt;/strong&gt; with broadcast IP adress(255.255.255.255) to obtain its own IP adress. A DHCP server receiving a &lt;strong&gt;DHCP Discover Message&lt;/strong&gt; responds to the client with an &lt;strong&gt;DHCP Offer Message&lt;/strong&gt;. If we look closer to this message, we will look &lt;strong&gt;router option field&lt;/strong&gt; in it. Here it is, hosts or any network device who want to obtain IP adress actually learn the IP adress of default gateway from this field.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/ipyy4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/ipyy4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36028" LastEditorUserId="36028" LastEditDate="2017-06-23T17:03:25.010" LastActivityDate="2017-06-23T17:03:25.010" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42146" PostTypeId="1" CreationDate="2017-06-23T16:27:43.080" Score="0" ViewCount="814" Body="&lt;p&gt;I am trying to narrow down a problem with intermittent connectivity issues to a remote service hosted via HTTPS. The application frequently fails to establish the SSL tunnel during the CONNECT phase.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The odd thing is that when you open a web browser to the same url used by the application, the page loads. Even more interestingly is that once you do this in the browser, then retry the application starts working and is able to connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I ran a trace route and even when set to 200 hops, around hop 8 I start getting request timed out, it eventually hits 200 hops and fails to complete the trace, I started at 30, then 100, then 200.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I may have something to learn, and do not want to come to incorrect conclusions based on incorrect knowledge.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I correct to think that even with the timeouts along the route, if the route to the destination was correct it would still complete within a reasonable number of hops?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can I safely draw a conclusion that something is misconfigured or failing when a trace route never completes, or is this potentially a perfectly valid response due to some sort of security measure in place at the destination?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Lastly, is there a reason why the act of browsing to the site works, and why after browsing to the site, the application is then able to work?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Steve&lt;/p&gt;&#xA;" OwnerUserId="37729" LastEditorUserId="8499" LastEditDate="2018-02-16T04:19:42.333" LastActivityDate="2018-02-16T04:19:42.333" Title="Trace route does not complete and applicatin fails to connect but website works in browser" Tags="|tcp|internet|icmp|traceroute|" AnswerCount="1" CommentCount="0" ClosedDate="2017-07-15T22:04:40.437" ContentLicense="CC BY-SA 3.0" />
  <row Id="42147" PostTypeId="2" ParentId="42146" CreationDate="2017-06-23T16:41:42.800" Score="2" Body="&lt;p&gt;All you can conclude is that traceroute doesn't give you the information you wanted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Many organizations' security policies break traceroute by denying ICMP or high port UDP packets.  That has nothing to do with your application. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can think of a few scenarios that would explain what you're seeing with the browser, but I would need to know more about your network and the remote app to give you any real advice.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-06-23T16:41:42.800" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42151" PostTypeId="1" CreationDate="2017-06-23T19:38:08.397" Score="1" ViewCount="101" Body="&lt;p&gt;So, I'm a server guy, but I'm leading the re-wiring of our patch panel this week. We're going to be moving a bunch of stuff around so we can patch everything in more cleanly, and without the &quot;normal&quot; spaghetti cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;We're using 3 separate VLAN's here, and I already know which ports are going to need to be on which VLAN's after everything's moved, so I'm set there. And I know that the &quot;interface range GigabitEthernet&quot; command will let me change multiple ports at once. However, everything I was seeing was for doing a single range of ports or a few non-contiguous ports, like this:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface range GigabitEthernet 1/0/4 - 45&#xA;interface range GigabitEthernet 1/0/1 , 1/0/47&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;However, can I mix and match? Would something like this work, or can you only have a single range, or just non-contiguous ports?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface range GigabitEthernet 1/0/2 , 1/0/4 - 45 , 2/0/1 - 45 , 3/0/1 - 44 , 4/0/5&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And is there a limit to the number of port changes I can set with a single command? Because the actual commands I have written down (three long commands, one for each VLAN) are 3-4 times as long as the one above. All with a mixture of ranges and non-contiguous ports.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just want to have everything as set as possible before tomorrow so I won't be sitting in the office for hours typing in port changes on a Saturday, so any advice would be appreciated.&lt;/p&gt;&#xA;" OwnerUserId="37732" LastActivityDate="2017-06-23T20:42:56.293" Title="Question about changing the VLAN assignment for multiple ports" Tags="|cisco-commands|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42154" PostTypeId="2" ParentId="42151" CreationDate="2017-06-23T20:42:56.293" Score="1" Body="&lt;p&gt;You can definitely use a mix/match of them - in fact I just did this today!&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For what I did, I used the following:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface range Gig1/0/48, tengig1/1/1 - 4, tengig2/1/1 - 4&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I believe the limitations of this might vary depending on IOS version though&lt;/p&gt;&#xA;&#xA;&lt;p&gt;And according to this Cisco doc, there is no limit on number of ports or types (although I think this also varies):&#xA;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/interface/command/ir-cr-book/ir-i1.html#wp3427019564&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/interface/command/ir-cr-book/ir-i1.html#wp3427019564&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34308" LastActivityDate="2017-06-23T20:42:56.293" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42155" PostTypeId="2" ParentId="42131" CreationDate="2017-06-23T20:49:56.320" Score="1" Body="&lt;p&gt;The throughput for the device is an aggregate total of all ports. You're still limited to the port speed of 1Gb, but the entire device can process up to 1.2Gb of traffic between all ports. &lt;/p&gt;&#xA;" OwnerUserId="34308" LastActivityDate="2017-06-23T20:49:56.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42156" PostTypeId="1" CreationDate="2017-06-23T21:10:59.683" Score="0" ViewCount="982" Body="&lt;p&gt;I need to upgrade a small network I know nothing about.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The only manageable switch in an Extreme Networks Summit 200, running ExtremeWare 7.3 (from 2005!). Of course, the default admin password has been changed (and nobody has any idea who configured those switches in the first place).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In order to migrate to a newer switch, I need to access the current config of the Summit switch, then translate the config to the new one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;How can I recover the current configuration without knowing the admin password?&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;More details:&lt;/em&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can put the switch offline for some time (out of office hours). I cannot loose the config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The company does not have any support plan with Extreme Networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Using BootROM, I can load default config and boot. Here, I have admin access, but I cannot find a way to dump/recover the primary config of the switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are several ways to recover the config on EXOS available on the web. These methods feature sending/editing the file containing the configuration like &lt;a href=&quot;https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-Recover-A-Switch-And-Its-Configuration-Without-The-Password&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However, on my ExtremeWare version, I only have the following commands:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;Available commands:&#xA;        &amp;lt;cr&amp;gt; abort clear configure create delete disable download enable exit &#xA;        history logout mrinfo mtrace nslookup ping quit reboot restart rtlookup &#xA;        run save scp2 show ssh2 telnet traceroute unconfigure upload use&#xA;&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;upload&lt;/code&gt; is interesting, but from the documentation, it can only upload (via tftp) the current config.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is a single instance on the web of the existence of a hidden debug mode &lt;a href=&quot;https://mailman.nanog.org/pipermail/nanog/2016-August/087398.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;here&lt;/a&gt;. However, as the email states, this debug mode needs a deep understanding of the system to be useful.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is everything I did until now. Any Extreme guru here to help me out?&lt;/p&gt;&#xA;" OwnerUserId="37735" LastEditorDisplayName="user36472" LastEditDate="2018-02-17T19:01:28.790" LastActivityDate="2023-12-22T10:03:00.343" Title="Configuration recovery on Extreme Networks Summit 200" Tags="|switch|management|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42158" PostTypeId="1" AcceptedAnswerId="42159" CreationDate="2017-06-23T23:00:24.567" Score="1" ViewCount="78" Body="&lt;p&gt;Good day Network Engineers,&#xA;I would like to ask if I could have internet access using the satellite and provide it as a city wide wifi hotspot in our town. thank you!&lt;/p&gt;&#xA;" OwnerUserId="37737" LastActivityDate="2017-06-24T08:11:38.097" Title="Satellite Internet Access: Can Use it to provide city wide wifi hotspot?" Tags="|internet|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42159" PostTypeId="2" ParentId="42158" CreationDate="2017-06-23T23:08:45.047" Score="1" Body="&lt;p&gt;Internet links through geostationary satellites suffer from very high latency - something like 500 to 600 ms RTT as minimum - each bit needs to travel some 36,000 km twice per direction. Less generous provisioning can easily increase latency to 1500(!) ms and more.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's OK for background data transmission, but a pain for interactive use and completely unusable for real-time applications like VoIP.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-24T08:11:38.097" LastActivityDate="2017-06-24T08:11:38.097" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42160" PostTypeId="2" ParentId="42085" CreationDate="2017-06-24T03:43:07.163" Score="1" Body="&lt;p&gt;(Would prefer to comment but not enough reputation...)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I was troubleshooting this on my network, first thing I'd do is run a packet capture from the vmware side. This will confirm what MAC is being sent to the Broadcom switches.  &lt;a href=&quot;https://pubs.vmware.com/vsphere-55/index.jsp?topic=%2Fcom.vmware.vsphere.networking.doc%2FGUID-1BFB05E3-7171-464C-9603-8781C5A97CC6.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://pubs.vmware.com/vsphere-55/index.jsp?topic=%2Fcom.vmware.vsphere.networking.doc%2FGUID-1BFB05E3-7171-464C-9603-8781C5A97CC6.html&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You might also try plugging the same port into a different switch to see if the MAC changes. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'd also be curious to view upstream switches to see what MAC the Broadcom switches are passing on (presumably the same +1 MAC, right?).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My intuition says that the vmnic is passing on the +1 mac (Cisco devices increment their MACs for each interface, maybe something similar for vmware?) or there's &lt;em&gt;ahem&lt;/em&gt; human error involved at some point.&lt;/p&gt;&#xA;" OwnerUserId="23968" LastActivityDate="2017-06-24T03:43:07.163" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42161" PostTypeId="1" AcceptedAnswerId="42169" CreationDate="2017-06-24T06:46:57.230" Score="2" ViewCount="96" Body="&lt;p&gt;Usually datacenter will charge for cross connect, two of our racks is within same zone, does wifi connection stable enough to replace physical cross connect? &lt;/p&gt;&#xA;" OwnerUserId="4479" LastActivityDate="2017-06-24T20:27:41.630" Title="WiFi connection replace cross connect within datacenter?" Tags="|network|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42164" PostTypeId="2" ParentId="42085" CreationDate="2017-06-24T08:17:17.633" Score="2" Body="&lt;p&gt;Rereading your question, I'm pretty sure what the cause is: it's a dual NIC and you just mentioned a single MAC. Dual or quad NICs often (always?) have consecutive MAC addresses(*) and xxxb6 is just the 2nd port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Depending on your vSwitch NIC teaming/load-balancing setup, the first port may not be in use - so it's invisible in the upstream switch. Open the vSwitch and check the Management Network NIC settings: it shows the MAC the host's network connection uses. On our hosts, it's that of the first NIC listed in vSwitch -&gt; NIC Teaming.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do want to always use the first ports MAC you can set specific Management Network teaming with the second port only as fallback. Both ports active will arrange a somewhat random binding of Management Network to physical port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;(*) Our quad NICs with iSCSI option use every other MAC for normal Ethernet.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-25T17:45:29.063" LastActivityDate="2017-06-25T17:45:29.063" CommentCount="10" ContentLicense="CC BY-SA 3.0" />
  <row Id="42166" PostTypeId="2" ParentId="42156" CreationDate="2017-06-24T12:06:06.557" Score="0" Body="&lt;p&gt;Did you followed these steps? &lt;a href=&quot;https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-Recover-A-Switch-And-Its-Configuration-Without-The-Password&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-Recover-A-Switch-And-Its-Configuration-Without-The-Password&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37709" LastActivityDate="2017-06-24T12:06:06.557" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42167" PostTypeId="1" AcceptedAnswerId="42168" CreationDate="2017-06-24T16:02:28.580" Score="3" ViewCount="377" Body="&lt;p&gt;I am posting here because I randomly installed Wireshark and I found that for 2 minutes or so (later it stopped) my computer started making ARP requests to IP addresses outside my local network, and worst of it to USA goverment offices (when I looked up 2 IPs, they were IANA).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this normal, or its something bad inside my PC?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank You&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Rwf5M.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Rwf5M.png&quot; alt=&quot;What is happening?&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37747" LastEditorUserId="37747" LastEditDate="2017-06-24T16:20:01.030" LastActivityDate="2017-06-24T16:40:18.837" Title="Why my computer is making this ARP requests to external (Gov) IP addresses?" Tags="|security|arp|wireshark|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42168" PostTypeId="2" ParentId="42167" CreationDate="2017-06-24T16:25:11.550" Score="8" Body="&lt;p&gt;169.254.0.0/16 is reserved for link-local addresses as per &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc3927&quot; rel=&quot;nofollow noreferrer&quot;&gt;RFC 3927&lt;/a&gt;. Link-local address space is used when there is no authority for IP address control (DHCP or static configuration). Some device with IP address 192.168.0.105 is trying to find out whether various link-local addresses are in use.&lt;/p&gt;&#xA;&lt;p&gt;IANA is the authority issuing IP address allocations, so the reserved link-local space is still registered there.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-06-24T16:40:18.837" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42169" PostTypeId="2" ParentId="42161" CreationDate="2017-06-24T16:52:30.913" Score="5" Body="&lt;p&gt;Unless the wifi is intended for administrative access, this would not be a great idea. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You will encounter all kinds of interference and increased latency. Your server cabinet is most likely bonded to the ground and essentially amounts to a &lt;a href=&quot;https://en.wikipedia.org/wiki/Faraday_cage&quot; rel=&quot;nofollow noreferrer&quot;&gt;Faraday cage&lt;/a&gt;. Not to mention all the other large metal objects in a datacenter that could cause interference. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;The datacenter is also very unlikely to allow you to stick antennas outside of your cabinet to improve the signal.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Point-to-point wireless bridges &lt;a href=&quot;http://www.proxim.com/products/point-to-point-backhaul&quot; rel=&quot;nofollow noreferrer&quot;&gt;such as these&lt;/a&gt; work very well and are widely used. However, they are typically deployed on rooftops where unobstructed line of sight can be established and are used for pulling connectivity into a building where fiber is lacking.&lt;/p&gt;&#xA;" OwnerUserId="8209" LastEditorUserId="8209" LastEditDate="2017-06-24T20:27:41.630" LastActivityDate="2017-06-24T20:27:41.630" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42171" PostTypeId="1" AcceptedAnswerId="42172" CreationDate="2017-06-24T22:18:19.130" Score="0" ViewCount="430" Body="&lt;p&gt;I've got a weird one for you guys.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at the CMO diagram:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/RgfHs.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/RgfHs.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISP requires all internet traffic be tagged over VLAN 35 via PPPoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've run into an issue where if Device001 connects to PPPoE, it prevents Device002 from connecting to PPPoE and vice versa. I don't have control over the devices connecting over PPPoE so I have to take care of this at layer 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take a look at my proposed FMO diagram:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/3lnKL.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/3lnKL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it possible to get VLANXX and VLANYY packets sent to VLAN35, but somehow prevent VLANXX and VLANYY from talking to each other? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Please note that the devices are not able to do any tagging, so all traffic to/from the devices is untagged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Apologies if this is not making sense to anyone...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT01:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In this particular scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DEV01 - Router&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DEV02 - Windows Machine&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I establish DEV02 first, then DEV01... both work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If I establish DEV01 first, DEV02 can't connect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I figure DEV01 prevents further connections after it establishes it's PPPoE session.&lt;/p&gt;&#xA;" OwnerUserId="37753" LastEditorUserId="37753" LastEditDate="2017-06-24T22:46:24.470" LastActivityDate="2017-06-25T08:08:41.407" Title="Separate VLANs for the same ISP Connection" Tags="|vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42172" PostTypeId="2" ParentId="42171" CreationDate="2017-06-24T22:33:25.580" Score="2" Body="&lt;p&gt;PPPoE requires a continuous network segment, so the PPPoE server/endpoint and both clients all need to be in the same VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PPPoE connections are (usually) limited to one session at a time. So, while there's a valid session, a 2nd login will either be rejected or kill the 1st session. The problem is not that dev1 and dev2 can see each other (at least not likely, you're very scarce on details).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you need both &quot;devices&quot; to simultaneously access the uplink, you'll need to not establish the session themselves but delegate that to a router which in turn lets both devices share its session. Usually - with a single public IP address - this will be a NAT router. With multiple public IPs you don't need NAT.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Another option would be to obtain a 2nd PPPoE account from your ISP to log into in parallel.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Why don't you just put the Windows machine behind the router?&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-25T08:08:41.407" LastActivityDate="2017-06-25T08:08:41.407" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42173" PostTypeId="2" ParentId="42085" CreationDate="2017-06-25T00:32:43.290" Score="0" Body="&lt;p&gt;It's your filter that's wrong. Syntax for mac addresses varies.  Sometimes its ff:ff:ff: ... and sometimes it's ffff.ffff ..., etc.  Double check your syntax.&lt;/p&gt;&#xA;" OwnerUserId="15240" LastActivityDate="2017-06-25T00:32:43.290" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42174" PostTypeId="1" AcceptedAnswerId="52348" CreationDate="2017-06-25T09:25:35.523" Score="2" ViewCount="23694" Body="&lt;p&gt;I have a question to the cisco IOS specialists. My teacher asked me a question: what is the default username for &quot;enable password/secret&quot;. He told me that it may be found in the internet, but i need to ask google unconditionaly. I've been thinking about the question without success. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Does anybody know, what is the username for enable mode in cisco? &lt;/p&gt;&#xA;" OwnerUserId="37757" LastEditorUserId="37757" LastEditDate="2017-06-25T09:38:59.240" LastActivityDate="2018-08-07T07:25:48.863" Title="What is the default cisco &quot;enable password&quot; username" Tags="|cisco|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42175" PostTypeId="1" AcceptedAnswerId="42176" CreationDate="2017-06-25T09:27:03.083" Score="-1" ViewCount="730" Body="&lt;p&gt;What are the most common use cases for IP and TCP?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I  am trying to find out what might be the best use cases for IP and TCP connections but unfortunately I wasn't very succesful so far.&lt;/p&gt;&#xA;" OwnerUserId="37646" LastActivityDate="2017-06-25T09:37:45.953" Title="IP/TCP - most common use cases" Tags="|tcp|ip|osi|" AnswerCount="1" CommentCount="1" ClosedDate="2017-06-25T13:32:54.017" ContentLicense="CC BY-SA 3.0" />
  <row Id="42176" PostTypeId="2" ParentId="42175" CreationDate="2017-06-25T09:37:45.953" Score="1" Body="&lt;p&gt;TCP is used for reliable connections, when packets mustn't be dropped. It's slower than UDP, because sender must have 100% certainty, that the data has been delivered without errors. IP is unreliable and its only a kind of a envelope, where is recipent and sender specified and some other data.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Read more about tcp/ip model for example on wikipedia. Try to find on your own before asking. &lt;/p&gt;&#xA;" OwnerUserId="37757" LastActivityDate="2017-06-25T09:37:45.953" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42177" PostTypeId="2" ParentId="42174" CreationDate="2017-06-25T12:37:57.930" Score="2" Body="&lt;p&gt;There's no username for enable mode. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;From exec mode, you enter the command &quot;enable&quot; and the device ask for the password.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also (depending on the IOS version and the actual configuration) type &quot;login&quot; and provide the username and password of a account configured on the switch (either locally or through radius or tacacs) that, upon successful login, will be put directly in privileged mode&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-06-25T12:37:57.930" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42178" PostTypeId="1" CreationDate="2017-06-25T12:43:02.273" Score="0" ViewCount="1386" Body="&lt;p&gt;According to 7 Layers of the OSI Model, IP is located at layer 3 (Network), while TCP and UDP are located on layer 4 (Transport).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Just for the sake of curiosity, why the combination of &lt;strong&gt;&quot;TCP/IP&quot; term&lt;/strong&gt; is more popular than &lt;strong&gt;&quot;UDP/IP&quot;&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've been searching on internet about this, however the only site that uses &lt;strong&gt;UDP/IP term&lt;/strong&gt; is &lt;a href=&quot;http://searchmicroservices.techtarget.com/definition/UDP-User-Datagram-Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://searchmicroservices.techtarget.com/definition/UDP-User-Datagram-Protocol&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Both UDP and TCP run on top of the Internet Protocol (IP) and are&#xA;  sometimes referred to as UDP/IP or TCP/IP.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Btw, I'm not talking about the difference between TCP vs UDP and why TCP is more popular instead of UDP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm just curious why the combination of &lt;strong&gt;&quot;TCP/IP&quot; term&lt;/strong&gt; is more popular than &lt;strong&gt;&quot;UDP/IP&quot;&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's common to hear about &lt;strong&gt;&quot;TCP/IP&quot; term&lt;/strong&gt; but not &lt;strong&gt;&quot;UDP/IP&quot; term&lt;/strong&gt; right? Any idea why?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Reference:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://searchnetworking.techtarget.com/definition/TCP-IP&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://searchnetworking.techtarget.com/definition/TCP-IP&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;hxxp://www.webopedia.com/TERM/T/TCP_IP.html&lt;/p&gt;&#xA;" OwnerUserId="37268" LastEditorUserId="37268" LastEditDate="2017-06-25T14:22:49.550" LastActivityDate="2017-06-25T15:19:30.270" Title="Why the combination of &quot;TCP/IP&quot; is more popular than &quot;UDP/IP&quot;" Tags="|tcp|ip|udp|" AnswerCount="4" CommentCount="7" ClosedDate="2017-06-25T15:24:22.213" ContentLicense="CC BY-SA 3.0" />
  <row Id="42179" PostTypeId="2" ParentId="42178" CreationDate="2017-06-25T12:52:07.487" Score="0" Body="&lt;p&gt;TCP and IP were and still are considered the core protocols of the IP suite, with TCP also preceding UDP by far. The suite's origins were about recreating the former environment with serial lines over a packet oriented network and a TCP socket pretty closely resembles that.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-25T12:52:07.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42180" PostTypeId="2" ParentId="42178" CreationDate="2017-06-25T12:53:54.320" Score="3" Body="&lt;p&gt;There's many IP protocols, including TCP and UDP among others.&#xA;See this list for reference: &lt;a href=&quot;https://en.wikipedia.org/wiki/List_of_IP_protocol_numbers&quot; rel=&quot;nofollow noreferrer&quot;&gt;List of IP protocol numbers&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some are rarely (or never) used, why others are widely used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Their usage depend on their usefulness.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;UDP provide a fast, but unreliable, mean to transfer data. A typical use is for audio and video streaming, where re-sending a missed packet is not useful, since, if you missed an image in a movie there's no point to displaying it anymore&lt;/p&gt;&#xA;&#xA;&lt;p&gt;TCP provide a reliable connection, and handle error and retransmission of lost packet. This is vital to exchange of data the must reach the destination intact.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So there's more use case of TCP than UDP, but the latter is still widely used.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-06-25T12:53:54.320" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42181" PostTypeId="2" ParentId="29729" CreationDate="2017-06-25T13:11:59.487" Score="0" Body="&lt;p&gt;You can access and gain visibility of your network traffic using &lt;a href=&quot;https://www.ixiacom.com/products/network-taps-regenerators-and-aggregators&quot; rel=&quot;nofollow noreferrer&quot;&gt;network taps&lt;/a&gt;. It's a device that connects directly to the cabling infrastructure to split or copy network traffic to enable mirroring. Ixia's network tap can be a solution for this case. &lt;/p&gt;&#xA;" OwnerUserId="37502" LastActivityDate="2017-06-25T13:11:59.487" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42182" PostTypeId="2" ParentId="42178" CreationDate="2017-06-25T13:20:39.330" Score="0" Body="&lt;p&gt;Actually it depends on your need in the Internet. If you always use Internet applications which need reliable and connection-oriented service such as Web, File transfer, E-Mail, Remote Terminal access and so on, TCP protocol is the best protocol in your needs. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Because, TCP protocol serves connection-oriented and reliable connection for applications who use it. That means your data will always reach the destination(defined in IP header) with no loss. These task are accomplished by Sequence number field, Acknowledgment number field and Flag bits inside the TCP header.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a result, if you use applications which need TCP protocol for transporting, TCP/IP is more popular than UDP/IP from your perspective. If someone uses applications which don't need realiable or connection-oriented service, from his perspective UDP/IP is more popular than TCP/IP.&lt;/p&gt;&#xA;" OwnerUserId="36028" LastEditorUserId="36028" LastEditDate="2017-06-25T15:19:30.270" LastActivityDate="2017-06-25T15:19:30.270" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42183" PostTypeId="2" ParentId="42178" CreationDate="2017-06-25T14:54:46.257" Score="2" Body="&lt;p&gt;Historical reasons: TCP/IP was the initial combination for the Internet Protocol. We are talking about around 1974-75. UDP came to life in 1980. By that time, people already talked about TCP/IP and meant the Internet Protocol using TCP.&lt;/p&gt;&#xA;" OwnerUserId="37760" LastActivityDate="2017-06-25T14:54:46.257" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42185" PostTypeId="1" AcceptedAnswerId="42186" CreationDate="2017-06-25T16:47:32.170" Score="1" ViewCount="2064" Body="&lt;p&gt;Suppose a device has both ethernet and wireless interfaces enabled and active. Is it correct that ARP requests from one (e.g., ethernet) cannot reach the other (e.g., wireless) unless a Proxy ARP is in place? If my understanding is correct, that's because the ethernet interface and wireless interface belong to different subnets. But does the Proxy ARP create a &quot;virtual&quot; interface that sits on the subnet of the ethernet interface in order to receive ARP requests from it though?&lt;/p&gt;&#xA;" OwnerUserId="37635" LastActivityDate="2017-06-25T17:01:40.127" Title="ARP requests and multiple interfaces" Tags="|ip|mac-address|arp|interface|proxy-arp|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42186" PostTypeId="2" ParentId="42185" CreationDate="2017-06-25T17:01:40.127" Score="2" Body="&lt;p&gt;This depends on how the wireless and the Ethernet parts are connected. When they are transparently bridged (a common case) and are thus in the same segment and subnet, the bridge will forward all broadcast traffic, so an ARP request from one NIC - sent as a broadcast - will reach the other.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If both belong to different subnets and segments then they won't get each other's ARP requests.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Proxy ARP is when (usually) a router answers on behalf of a device that's not on the segment, so even then they won't hear the other interfaces ARP requests.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-25T17:01:40.127" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42188" PostTypeId="1" AcceptedAnswerId="42189" CreationDate="2017-06-25T17:15:25.367" Score="3" ViewCount="3320" Body="&lt;p&gt;The way I understand (two-port) transparent bridging is that the bridge simply forwards packets to another segment on the network. But since the MAC address of the ethernet interface is different to the wireless, how can they be transparently bridged? The router won't take packets with the ethernet interface's MAC address. It only knows about the wireless interface's MAC address. Doesn't the bridge need to change the packet's source MAC?&lt;/p&gt;&#xA;" OwnerUserId="10447" LastEditorUserId="8499" LastEditDate="2018-03-02T22:19:21.777" LastActivityDate="2021-07-10T16:32:21.047" Title="How transparent bridging Wi-Fi with Ethernet works?" Tags="|ethernet|ieee-802.11|bridge|mac|bridging|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42189" PostTypeId="2" ParentId="42188" CreationDate="2017-06-25T17:24:19.913" Score="5" Body="&lt;p&gt;You seem to be confusing the different network layers. Routers route packets at layer-3, using the layer-3, e.g. IP, addresses, but bridging happens at layer-2, using layer-2, e.g. MAC, addresses. Bridging is done with a bridge, switch, or WAP, but not a router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With an ethernet network, bridging is transparent. That means that the bridge doesn't modify the layer-2 frames when forwarding them. When you have two different LAN types, you need a translating bridge in order to translate the frames from one LAN type to another LAN type. This used to be common with ethernet/token ring bridges, and it is now common with ethernet/Wi-Fi bridges.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question in your title, &quot;&lt;em&gt;How transparent bridging Wi-Fi with Ethernet works?&lt;/em&gt;&quot; doesn't make sense. To bridge two different LAN types, you must use a translating bridge, not a transparent bridge. It so happens that Wi-Fi and ethernet actually use compatible 48-bit MAC addresses, so the MAC addresses can remain the same in the bridged frames.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-06-25T17:24:19.913" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42190" PostTypeId="2" ParentId="42188" CreationDate="2017-06-25T17:25:22.713" Score="3" Body="&lt;p&gt;A &quot;self-learning MAC bridge&quot; tracks the MAC addresses from the frames it receives - this way it nows, which frames need to be forwarded to which port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;WiFi bridging works the same way. MAC addresses follow the same pattern for 802.11 and 802.3, so the bridge just has to learn which addresses are on which side.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-25T17:25:22.713" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42194" PostTypeId="1" AcceptedAnswerId="42195" CreationDate="2017-06-26T02:57:36.137" Score="0" ViewCount="216" Body="&lt;p&gt;While reading on NetBIOS from &lt;a href=&quot;https://wiki.wireshark.org/NetBIOS&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.wireshark.org/NetBIOS&lt;/a&gt;  , they tell that NetBIOS provides session service:&lt;strong&gt;&quot;it's a service providing reliable, in-order delivery of packets&quot;&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Doesn't TCP already provide us both in-order and reliable delivery of packets?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looks like NetBIOS used to work only in LAN, using TCP/IP it can be used in the internet now, they could have removed the &lt;strong&gt;&quot;session service&quot;&lt;/strong&gt; capabilities of NetBIOS when implemented over TCP/IP right? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it only because of &lt;strong&gt;&quot;backward compatibility&quot;&lt;/strong&gt; stupid logic we have this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Its simply looks like a lot of bloat ware to me. &lt;/p&gt;&#xA;" OwnerUserId="33266" LastActivityDate="2017-06-26T03:01:15.373" Title="Why do we need session service of NetBIOS over TCP IP?" Tags="|tcp|" AnswerCount="1" CommentCount="2" ClosedDate="2017-06-26T05:15:54.093" ContentLicense="CC BY-SA 3.0" />
  <row Id="42195" PostTypeId="2" ParentId="42194" CreationDate="2017-06-26T03:01:15.373" Score="1" Body="&lt;p&gt;I found the answer :) :&#xA;It is the backward compatibility requirement:&lt;/p&gt;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc1001&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://www.rfc-editor.org/rfc/rfc1001&lt;/a&gt;&lt;/p&gt;&#xA;&lt;p&gt;Page 7  &amp;quot;4.1.  PRESERVE NetBIOS SERVICES&amp;quot; was one of the design principles.&lt;/p&gt;&#xA;" OwnerUserId="33266" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-06-26T03:01:15.373" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42196" PostTypeId="1" CreationDate="2017-06-26T03:44:21.270" Score="0" ViewCount="1395" Body="&lt;p&gt;Assumer I have a new router device of Cisco with 2 ports ethernet 10/100/1000. As everybody know that QoS based on DSCP field in IPv4 header to have difference policy for difference class. I start configuring this router. Example, with traffic in best-effort mode (DSCP = 0), the speed should be 15Mbps, with traffic in AF32 class (DSCP=28), the speed should be 35Mbps and with traffic in EF class (DSCP=46), the speed should be 50Mbps.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The question is:&#xA;1. How can test/measure exactly a speed that I configured?&#xA;2. How about for another specification like: latency, jiter?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you!&lt;/p&gt;&#xA;" OwnerUserId="37688" LastActivityDate="2017-06-26T06:12:21.030" Title="How to test QoS function in router" Tags="|router|firewall|qos|network|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42197" PostTypeId="1" CreationDate="2017-06-26T06:12:08.223" Score="0" ViewCount="193" Body="&lt;p&gt;I understand what a load balancer is but I am not able to understand what a load balancer predictor.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can anyone please point me to some resource or wiki to undrstand this?&lt;/p&gt;&#xA;" OwnerUserId="37770" LastActivityDate="2017-07-26T11:47:18.620" Title="what is a load balancer predictor" Tags="|load-balancing|load-balancer|" AnswerCount="1" CommentCount="3" ClosedDate="2017-07-26T13:43:26.067" ContentLicense="CC BY-SA 3.0" />
  <row Id="42198" PostTypeId="2" ParentId="42196" CreationDate="2017-06-26T06:12:21.030" Score="2" Body="&lt;p&gt;You can attach cisco switch with two PCs behind the router. Dot1q trunking can be used with 1 vlan per PC for traffic generation and second one for SLA probes. The router must be used for inter-vlan routing, traffic shaping also should be configured here. &lt;a href=&quot;https://www.google.bg/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=1&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwjpj5SN69rUAhXI1RQKHRxhAjkQFggmMAA&amp;amp;url=https%3A%2F%2Fiperf.fr%2F&amp;amp;usg=AFQjCNHMVfyMLFT35mg9ZoEbfrC5q4xKnw&quot; rel=&quot;nofollow noreferrer&quot;&gt;IPERF&lt;/a&gt;/&lt;a href=&quot;https://www.google.bg/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=2&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwi5jY6e69rUAhVPkRQKHTT9AHQQFggoMAE&amp;amp;url=https%3A%2F%2Fsourceforge.net%2Fprojects%2Fjperf%2F&amp;amp;usg=AFQjCNGTI91dzKpTexfI1rzZQm7ecYejZQ&quot; rel=&quot;nofollow noreferrer&quot;&gt;JPERF&lt;/a&gt; can be used for traffic generation.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On both switch ports you can mark the traffic with specific DSCP value, which needs to be used later in the policy. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Speed can be easily measured with IPERF:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;UDP: you can send specific amount of traffic e.g 10mbit/s, and measure the packet loss.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;TCP: Just start server/client and you will get the best possible value achieved by the TCP protocol.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Latency can be extracted from iperf test, but I'd recommend adding SLA probes via some external software like this &lt;a href=&quot;http://www.solarwinds.com/free-tools/ip-sla-monitor&quot; rel=&quot;nofollow noreferrer&quot;&gt;one&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="25563" LastActivityDate="2017-06-26T06:12:21.030" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42199" PostTypeId="1" AcceptedAnswerId="42200" CreationDate="2017-06-26T06:20:45.153" Score="1" ViewCount="289" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/hGDzo.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/hGDzo.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have the following configuration:&#xA;Tp link router : WAN Interface--- 5.6.7.8&#xA;                 LAN Interface---192.168.0.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Planet router  : WAN Interface---192.168.0.10&#xA;                 LAN Interface---192.1681.1.1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP address of Video Conferencing device(VC)---192.168.1.100&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need to do the port forwarding for VC to connect to the other end (remote site). I need to open ports like 1720,3230-3240 and so on. &#xA;In case of single router, i would open the ports in that router only but i have 2 routers at this time so i haven't been able to open ports in the router.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I went to interface of planet router and forwarded ports in it. But it didn't work.&#xA;What could be the solution?&#xA;Please help.&lt;/p&gt;&#xA;" OwnerUserId="23114" LastActivityDate="2017-06-26T11:10:15.700" Title="port forwarding in router" Tags="|port-forwarding|" AnswerCount="2" CommentCount="3" ClosedDate="2017-06-26T13:24:57.013" ContentLicense="CC BY-SA 3.0" />
  <row Id="42200" PostTypeId="2" ParentId="42199" CreationDate="2017-06-26T06:27:21.180" Score="3" Body="&lt;p&gt;Port forwarding is required when a NAT router 'hides' a service with a private IP address from public Internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You'll need port forwarding on the NAT router (TP-L), the one with the WAN interface. Provided the routing works and the protocols have no NAT issues, just forward to 192.168.1.100 directly and it'll work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cascading the port forwarding through both routers is possible but only necessary when the secondary router (Planet) is using NAT as well.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-26T11:03:49.100" LastActivityDate="2017-06-26T11:03:49.100" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42202" PostTypeId="1" AcceptedAnswerId="42204" CreationDate="2017-06-26T08:54:53.643" Score="2" ViewCount="308" Body="&lt;p&gt;Sorry for the newb question, I am trying to figure out how to best link up an subinterface on a Cisco 1921 router, with an external network, by connecting the router and the cable from the external network, to a Cisco Catalyst 2960 switch and isolating them into their own VLAN.&#xA;The external network recommended I use a 172.A.A.102 255.255.252 for my router IP, and ping 172.A.A.101 on their network. &#xA;I was able to ping successfully by connecting the external network's cable to my laptop and configuring their IP information, but I cant ping from my router after what I setup:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;I created the subinterface for the external network on my router with:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;interface GigabitEthernet0/0.3&#xA;encapsulation dot1Q 802&#xA;ip address 172.A.A.102 255.255.255.252&lt;/code&gt;&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;On the switch I configured two ports: f0/5 for the router, and f0/6 for the external network cable with:&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;!&lt;br&gt;&#xA;interface FastEthernet0/5&#xA; switchport mode trunk&#xA; spanning-tree portfast&#xA;!&lt;br&gt;&#xA;interface FastEthernet0/6&#xA; switchport access vlan 802&#xA; switchport mode access&#xA; spanning-tree portfast&#xA;&lt;/code&gt;&#xA;But unfortunately I cannot ping 172.A.A.101. Please what am I doing wrong?&lt;/p&gt;&#xA;" OwnerUserId="23709" LastActivityDate="2017-07-26T09:42:30.757" Title="Correct 1921 Router to 2960 Switch Configuration for an External Connection" Tags="|cisco|cisco-ios|cisco-catalyst|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42204" PostTypeId="2" ParentId="42202" CreationDate="2017-06-26T09:35:16.587" Score="1" Body="&lt;p&gt;Actually I did the right thing, I suppose I wasn't patient enough for the switch to start accepting packets.&#xA;Everything works as expected.&lt;/p&gt;&#xA;" OwnerUserId="23709" LastActivityDate="2017-06-26T09:35:16.587" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42205" PostTypeId="2" ParentId="42199" CreationDate="2017-06-26T09:53:15.313" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;Forward ports You needed on the Planet router as if it (its WAN interface) is connected directly to the Internet.&lt;/li&gt;&#xA;&lt;li&gt;Forward ports You needed on the TP-Link router as if the Planet router (its WAN address) is video-conference server.&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;External client connects to the external WAN address of TP-Link (5.6.7.8). It forwards the connection to the WAN interface of Planet (192.168.0.10) with ist LAN (192.168.0.1) as a source. Planet forwards the connection to the VC (192.168.1.100) using ist own LAN (192.168.1.1) as source. VC accepts connection and answers to its source (192.168.1.1). Planet backwards the answer to the source (192.168.0.1). TP-Link backwards the answer to client. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;UPDATE:&lt;/strong&gt; If Planet router is &lt;strong&gt;NOT&lt;/strong&gt; configured as NAT-router, the only setting You need is to configure static route to 192.168.1.0/24 subnet on TP-Link LAN with 192.168.0.10 as a gate.&lt;/p&gt;&#xA;" OwnerDisplayName="user36844" LastEditorDisplayName="user36844" LastEditDate="2017-06-26T11:10:15.700" LastActivityDate="2017-06-26T11:10:15.700" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42206" PostTypeId="2" ParentId="42197" CreationDate="2017-06-26T11:00:44.313" Score="1" Body="&lt;p&gt;As it seems, Cisco uses a &quot;predictor&quot; in the Application Control Engine (ACE) to control the load distribution:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When there is a client request for web services, the ACE selects a&#xA;  server that can successfully fulfill the client request in the&#xA;  shortest amount of time without overloading either the individual&#xA;  server or the server farm.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/interfaces_modules/services_modules/ace/vA5_1_0/configuration/getting/started/guide/ace_module_gsg/predictr.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Configuring a Load-Balancing Predictor&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-26T11:00:44.313" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42207" PostTypeId="1" AcceptedAnswerId="42218" CreationDate="2017-06-26T13:06:08.353" Score="0" ViewCount="2330" Body="&lt;p&gt;I have a anyconnect remote vpn profile where I am having the problem with intermittent issue with external dns. I can not open any external weblink and cant ping it with name but accessing them with ip is fine.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I opened a case with cisco but they are unable to give a proper answer or workaround for the issue I am seeing. I am using split tunnel and split dns in my &lt;code&gt;group-policy&lt;/code&gt;configurations.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone please help and tell me if there is something I am missing out?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is vpn config from firewall:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpnfw1a# sh run all group-po abc_vpnPolicy&#xA;group-policy abc_vpnPolicy internal&#xA;group-policy abc_vpnPolicy attributes&#xA;banner value WARNING: Unauthorized access to this system is forbidden and&#xA;banner value will be prosecuted by law. By accessing this system&#xA;banner value you agree that your actions are monitored and recorded.&#xA;dns-server value 10.1.1.11&#xA;vpn-simultaneous-logins 2&#xA;vpn-idle-timeout 1440&#xA;vpn-session-timeout none&#xA;vpn-filter value abc_vpnVPN&#xA;vpn-tunnel-protocol ikev1 ssl-client&#xA;group-lock value abc_vpn&#xA;ipsec-udp enable&#xA;split-tunnel-policy tunnelspecified&#xA;split-tunnel-network-list value abc_vpnNetworks&#xA;default-domain none&#xA;split-dns value abc.partners jira.abc.com confluence.abc.com &#xA;user-authentication enable&#xA;webvpn&#xA; anyconnect keep-installer installed&#xA; anyconnect ssl rekey method none&#xA; anyconnect dpd-interval client 10&#xA; anyconnect dpd-interval gateway 30&#xA; anyconnect modules value dart&#xA; anyconnect profiles value abc_vpn-profile type user&#xA; anyconnect ask enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Tunnel group all config:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;vpnfw1a# sh run tunnel-group abc&#xA;tunnel-group abc type remote-access&#xA;tunnel-group abc general-attributes&#xA; address-pool abcVpnPool&#xA; authentication-server-group RADIUS&#xA; default-group-policy abcPolicy&#xA;tunnel-group abc webvpn-attributes&#xA; authentication aaa certificate&#xA; group-alias abc enable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="34021" LastEditorUserId="34021" LastEditDate="2017-06-26T13:25:57.003" LastActivityDate="2017-08-26T00:12:09.490" Title="External DNS intermittent issue on anyconnect remote vpn" Tags="|cisco-asa|dns|cisco-anyconnect|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42208" PostTypeId="2" ParentId="41864" CreationDate="2017-06-26T14:54:16.093" Score="1" Body="&lt;p&gt;Seeing the same issue on a ASA5555 cluster pair, since upgrading to 9.7.1(8)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Looks like bug - CSCvc79371, fixed in 9.8.1 (according to release notes for 9.8.1)&lt;/p&gt;&#xA;" OwnerUserId="37783" LastActivityDate="2017-06-26T14:54:16.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42210" PostTypeId="2" ParentId="7483" CreationDate="2017-06-26T17:35:33.557" Score="-1" Body="&lt;p&gt;Somebody needs to read the IEEE specification on Ethernet cables. When you run Cat 5/6 UTP the minimum is 3' (90&amp;nbsp;cm). You cannot (should not) use cables shorter than 3' (90&amp;nbsp;cm). One cable between a router and a patch panel won't likely exhibit a problem, but multiple will. The specification is clear. No shorter than 3' (90 cm) or you're out of specification.&lt;/p&gt;&#xA;" OwnerUserId="37786" LastEditorUserId="3232" LastEditDate="2018-10-18T19:12:11.467" LastActivityDate="2018-10-18T19:12:11.467" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="42211" PostTypeId="1" AcceptedAnswerId="42213" CreationDate="2017-06-26T18:17:20.797" Score="3" ViewCount="1003" Body="&lt;p&gt;I received a edexcel patch panel for a cat6 ftp cable, I was puzzled by the diagram. It shows I should cut away the foil. I am used to pulling the foil back and placing it under the bar clamp.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is it ok to cut away the foil and just punch down the drain wire ?&lt;/p&gt;&#xA;" OwnerUserId="4880" LastEditorUserId="8499" LastEditDate="2019-01-03T01:33:45.157" LastActivityDate="2021-06-14T20:00:53.077" Title="Cat6 FTP shielding" Tags="|layer1|cable|cabling|patch-panel|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42212" PostTypeId="2" ParentId="7483" CreationDate="2017-06-26T18:26:04.760" Score="4" Body="&lt;p&gt;Check IEEE 802.3:&lt;/p&gt;&#xA;&lt;p&gt;For 10BASE-T, &lt;em&gt;Clause 14.1.1.1 Medium Attachment Unit (MAU)&lt;/em&gt; explicitly states &amp;quot;Provides for operating over 0 m to at least 100 m of twisted pair without the use of a repeater.&amp;quot;&lt;/p&gt;&#xA;&lt;p&gt;The 100BASE-TX &lt;em&gt;Clause 25.4.9.2 Link transmission parameters&lt;/em&gt; also fails to specify a minimum distance.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Clause 40.7 Link segment characteristics&lt;/em&gt;: no minimum link distance is specified for 1000BASE-T.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Table 55–11—Power backoff schedule&lt;/em&gt; for 10GBASE-T shows a length of 0 m.&lt;/p&gt;&#xA;&lt;p&gt;&lt;em&gt;Table 113–15—Power backoff schedule&lt;/em&gt; for 25/40GBASE-T shows a length of 0 m.&lt;/p&gt;&#xA;&lt;p&gt;=&amp;gt; There is no minimum cable length for twisted-pair Ethernet. If a device or a cable doesn't work with a very short link it can be considered broken.&lt;/p&gt;&#xA;&lt;p&gt;(&amp;quot;Copper&amp;quot; also includes ancient coax cabling which does have minimum spacing of 2.5 m (10BASE5, Clause 8.6.2.2) or 0.5 m (10BASE2, Clause 10.7.2.1) - but I don't think that was the question. For completeness sake, 1000BASE-CX states 0.1 m minimum length (Clause 39.1). Fiber might require a minimum attenuation on a link to avoid blinding the receiver, especially for long-reach variants.)&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2020-11-02T10:28:16.050" LastActivityDate="2020-11-02T10:28:16.050" CommentCount="1" ContentLicense="CC BY-SA 4.0" />
  <row Id="42213" PostTypeId="2" ParentId="42211" CreationDate="2017-06-26T18:32:26.310" Score="3" Body="&lt;p&gt;Depending on the clamp size and form, it may be necessary to remove insulation for a clean fit. Otherwise it's fine to clamp over foil and outer insulation.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-26T18:32:26.310" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="42214" PostTypeId="2" ParentId="41418" CreationDate="2017-06-26T19:26:44.663" Score="1" Body="&lt;p&gt;The specs on your link are just the amendments. You can get the complete standard at &lt;a href=&quot;http://standards.ieee.org/about/get/&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE 802.org&lt;/a&gt;. As far as I can see, power management from Clause 6 applies to all PHY types.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-26T19:26:44.663" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42215" PostTypeId="1" CreationDate="2017-06-26T20:08:35.427" Score="5" ViewCount="2280" Body="&lt;p&gt;In a WLAN iperf3 TCP throughput test, I have the following results:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With exactly the same setting, operation in 802.11ac (3x3) (DFS channel) (TCP Cubic)&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;30 nodes as server receiving iperf -&amp;gt; around 17Mbits avg per node.&#xA;&#xA;30 nodes as iperf clients to a server -&amp;gt; around 4Mbits avg per node.&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any reason for this big difference between upstream and downstream?&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;They are peer-to-peer connections. The client/server or upstream/downstream concepts are application-layer concepts.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Is there something else in the TCP layer that is preventing the full link capacity from being used?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;That's why I do not understand if the 802.11, IP and TCP layers are the &quot;same&quot;, why there is such a big difference in the transmission rate.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Are there more collisions? Is that problem not solved with CSMA / CA?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What about ARF?&lt;/strong&gt; This paper discusses the problem of uplink performance:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://link.springer.com/chapter/10.1007/978-3-642-20798-3_28&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://link.springer.com/chapter/10.1007/978-3-642-20798-3_28&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37789" LastEditorUserId="37789" LastEditDate="2017-07-07T08:15:06.707" LastActivityDate="2018-03-04T11:19:36.983" Title="WiFi TCP iperf throughput: upstream vs down stream" Tags="|wireless|ipv4|tcp|testing|iperf|" AnswerCount="2" CommentCount="11" ContentLicense="CC BY-SA 3.0" />
  <row Id="42216" PostTypeId="2" ParentId="41530" CreationDate="2017-06-26T20:35:05.113" Score="1" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;6 on FS728TP VLAN's are set on the Netgear switch as follows: VLAN 1 is production VLAN and is marked &quot;U&quot; on all ports except 28 which is blank. Port 27 is marked &quot;T&quot; on VLAN1. VLAN 99 is for guest wifi and is marked &quot;U&quot; on ports 1-6. It is marked as &quot;T&quot; on port 28. All ports have PVID of VLAN 1 except port 28 which is PVID 99.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;So you have both production and guest Untagged on the UniFi ports? That won't fly... The guest network should be Tagged as it goes to the UniFi, and the UniFi system should know what VLAN the Guest network is on.&lt;/p&gt;&#xA;" OwnerUserId="2301" LastActivityDate="2017-06-26T20:35:05.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42217" PostTypeId="2" ParentId="42211" CreationDate="2017-06-26T21:30:13.900" Score="5" Body="&lt;p&gt;Since Category-6 is specifically UTP (&lt;em&gt;Unshielded&lt;/em&gt; Twisted Pair), then the question of &lt;em&gt;shielded&lt;/em&gt; Category-6 cabling doesn't make any sense. ANSI/TIA/EIA define the cable categories, and there are no cable categories defined except for UTP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ISO/IEC defines cable &lt;em&gt;classes&lt;/em&gt;, and it has defined several classes that employ a shield.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Having said that, many cable manufacturers will offer a shield on their cable to try to make up for poor cable performance (would not pass the test suite without the shielding). If shielding is used in cabling, it must be continuous from end-to-end, with no breaks, and grounded, at least, on both ends. The equipment on each end must also be compatible to ground the shield.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are documents that explain things for you. For example, &lt;a href=&quot;http://www.cablinginstall.com/articles/print/volume-3/issue-9/crosstalk-feedback/editorial/shielded-and-unshielded-twisted-pair-cable-revisited.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Shielded and unshielded twisted-pair cable revisited&lt;/a&gt;:&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If STP cable is combined with improperly shielded connectors,&#xA;  connecting hardware or outlets, or if the foil shield itself is&#xA;  damaged, overall signal quality will be degraded. This, in turn, can&#xA;  result in degraded emission and immunity performance. Therefore, for a&#xA;  shielded cabling system to totally reduce interference, every&#xA;  component within that system must be fully and seamlessly shielded, as&#xA;  well as properly installed and maintained.&lt;/p&gt;&#xA;  &#xA;  &lt;p&gt;An STP cabling system also requires good grounding and earthing&#xA;  practices because of the presence of the shield. An improperly&#xA;  grounded system can be a primary source of emissions and interference.&#xA;  Whether this ground is at one end or both ends of the cable run&#xA;  depends on the frequency at which a given application is running. For&#xA;  high-frequency signals, an STP cabling system must be grounded, at&#xA;  minimum, at both ends of the cable run, and it must be continuous. A&#xA;  shield grounded at only one end is not effective against&#xA;  magnetic-field interference.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="40371" LastEditDate="2018-12-16T17:40:31.100" LastActivityDate="2018-12-16T17:40:31.100" CommentCount="2" ContentLicense="CC BY-SA 4.0" />
  <row Id="42218" PostTypeId="2" ParentId="42207" CreationDate="2017-06-26T23:05:35.533" Score="0" Body="&lt;p&gt;I have found the resolution and issue was with &lt;code&gt;ipv6&lt;/code&gt;, somehow the dns fallsback and was going for &lt;code&gt;ipv6&lt;/code&gt; lookup which doesn't complete ever. So I disabled ipv6 on one machine and started working.. to push it to globally we used &lt;code&gt;client-bypass-protocol&lt;/code&gt; and it actually ignores the &lt;code&gt;ipv6&lt;/code&gt; if its not configured on vpn.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;this is the bug &lt;code&gt;CSCtf20226&lt;/code&gt;and &lt;code&gt;CSCtz86314&lt;/code&gt; cisco addressed them in &lt;a href=&quot;https://bst.cloudapps.cisco.com/bugsearch/bug/CSCtf20226&quot; rel=&quot;nofollow noreferrer&quot;&gt;enter link description here&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="34021" LastActivityDate="2017-06-26T23:05:35.533" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42221" PostTypeId="2" ParentId="2192" CreationDate="2017-06-27T05:29:32.590" Score="0" Body="&lt;p&gt;Ah, I remember this one. Weeks of fun was had dealing with this back a few jobs ago. One wrinkle is that STP events will put the vlans in fast-aging mode, so setting the MAC timer longer than the ARP timer doesn't help&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I solved the issue by forcing ECMP back from the servers, by creating two floating HSRP gateways, with one primary on each router. We then configured both gateways on each host. By forcing host traffic to both R1 and R2 in this fashion, we would be sure that R2 would never age out the MAC addresses.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Ideally, this wouldn't be an issue if L2/3 switches purged ARP entries associated with aged-out MAC addresses. The next packet to the IP would then result in a new ARP request, populating both the ARP cache and the MAC table. I &lt;em&gt;think&lt;/em&gt; Cisco eventually implemented this, but I can't say for sure.&lt;/p&gt;&#xA;" OwnerUserId="605" LastActivityDate="2017-06-27T05:29:32.590" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42223" PostTypeId="2" ParentId="23458" CreationDate="2017-06-27T09:29:33.583" Score="0" Body="&lt;p&gt;There are 3 ways of doing so: &lt;br&gt;&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Port forwarding&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;This gives you fastest connection, but you need admin access to every router on server-side, or you need to call to ISP and agree with port forwarding with them, if you are behind NAT.&lt;br&gt;&#xA;Howto: Look at other replies, or google &quot;how to set up port forwarding&quot;.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Using VPN&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Usually best choice in most cases. It's not the fastest one, but at least you don't need to set up port forwarding.&lt;br&gt;&#xA;Howto: Download Hamachi, Tunnngle or similar. Alternatively you can use/buy your own VPN or use friend's one.&lt;/p&gt;&#xA;&#xA;&lt;h2&gt;Using something as a middleman even when it's not made to.&lt;/h2&gt;&#xA;&#xA;&lt;p&gt;Use this one only if you can't use for some reason port forwarding or VPN. You need to know programming in order to set up connection, since there're no open source examples available - not many people use this way and when they do, they're hackers and they keep it secret.&lt;br&gt;&lt;br&gt;&#xA;But there are few problems with this one here: it's almost impossible to set up full connection, &quot;connection&quot; will be more like instant messaging between two clients. Also expect the connection to be super slow - Mine had ping about 750 ms. I used free webhosting service as a middleman.&lt;br&gt;&lt;br&gt;&#xA;Howto: It depends on what you use as middleman, I used webhosting - client sends POST request and web (PHP) processes it and saves message into database (MySQL) with sender ID and receiver ID. Then, another client sends another POST request in order to read message and server answers with website which has nothing in it, but message for client.&lt;br&gt;&lt;br&gt;&lt;/p&gt;&#xA;" OwnerUserId="37800" LastEditorUserId="31801" LastEditDate="2017-06-27T15:04:52.403" LastActivityDate="2017-06-27T15:04:52.403" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42225" PostTypeId="1" AcceptedAnswerId="42226" CreationDate="2017-06-27T10:42:06.420" Score="1" ViewCount="528" Body="&lt;p&gt;The IPv4 default route in CIDR notation is &lt;code&gt;0.0.0.0/0&lt;/code&gt; translated to &lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP: &lt;code&gt;0.0.0.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mask: &lt;code&gt;0.0.0.0&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For IPv6 the default route in CIDR is &lt;code&gt;::/0&lt;/code&gt;. How is this transated ? Is it as below ?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;IP: &lt;code&gt;::&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;mask: &lt;code&gt;::&lt;/code&gt;&lt;/p&gt;&#xA;" OwnerUserId="8529" LastActivityDate="2017-06-27T10:46:20.653" Title="IPv6 default route" Tags="|routing|ipv6|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42226" PostTypeId="2" ParentId="42225" CreationDate="2017-06-27T10:46:20.653" Score="1" Body="&lt;p&gt;The default route has a mask length of 0, so it matches anything. The network address with zero length is actually empty, but usually 0 is used.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It's the same with IPv4 and IPv6, just the notation of the latter has changed - :: expands to as many :0000 as are required to get a 128 bit address, so :: by itself expands to 0000:0000:0000:0000:0000:0000:0000:0000.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-27T10:46:20.653" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42229" PostTypeId="1" AcceptedAnswerId="42231" CreationDate="2017-06-27T15:17:33.257" Score="1" ViewCount="474" Body="&lt;p&gt;Ethernet is below IP in the OSI model. But how is an &lt;strong&gt;IP&lt;/strong&gt; address actually assigned to an &lt;strong&gt;Ethernet&lt;/strong&gt; port? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know, that Ethernet has nothing to do with IP, but under Windows I can assign an IP address to an Ethernet Adapter...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When my card has two ports, what does it mean in terms of IP adresses assigned to them? Do they share the same and I have consider the two ports like a simple hub providing two physical connectors to the same logical thing? &lt;/p&gt;&#xA;" OwnerUserId="37634" LastEditorUserId="8499" LastEditDate="2019-01-12T20:25:17.167" LastActivityDate="2019-01-12T20:25:17.167" Title="What does it mean if an Ethernet Card has two RJ45 ports?" Tags="|ethernet|ip|mac-address|ip-address|interface|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42230" PostTypeId="2" ParentId="42229" CreationDate="2017-06-27T15:33:56.637" Score="2" Body="&lt;p&gt;Each interface on your NIC should be assigned a different IP address or there will be an addressing conflict. You can either receive an IP address via DHCP or set one manually as you see through your GUI. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each interface also has its own MAC address for layer 2 communication. &lt;/p&gt;&#xA;" OwnerUserId="4634" LastEditorUserId="4634" LastEditDate="2017-06-27T20:07:17.387" LastActivityDate="2017-06-27T20:07:17.387" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42231" PostTypeId="2" ParentId="42229" CreationDate="2017-06-27T15:38:53.740" Score="3" Body="&lt;p&gt;I think you need to understand a little more about the network layers and how a device implements a network stack. This question is almost off-topic as it is really particular to the OS running on the device, but I will try to give you a general idea.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In a device, you will have a physical interface at layer-1, and your ethernet card with two interfaces has two separate physical interfaces. The card will have a driver that installs in the OS, and the driver will have the layer-2 (ethernet) software for each interface as separate interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The OS usually implements the layer-3 (IPv4, IPX, IPv6, AppleTalk, etc.) and layer-4 (TCP, UDP, etc.) software. The layer-3 software registers with the layer-2 software so that the layer-2 software knows where to send traffic up to layer-3. An ethernet frame header has an EtherType field that tells the layer-2 to which registered layer-3 module the frame payload should be sent, e.g. 0x800 is for IPv4, and 0x86DD is for IPv6. IANA maintains the &lt;a href=&quot;https://www.iana.org/assignments/ieee-802-numbers/ieee-802-numbers.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;IEEE 802 Numbers&lt;/a&gt; for the various EtherTypes.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The layer-3 module registered with the layer-2 module for an interface will be assigned the layer-3 address for that interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The same type of thing happens for layer-3 and layer-4. For example, IPv4 has the Protocol field in the IPv4 header (IPv6 has a Next Header field that is the same thing). Again, IANA maintains a list, &lt;a href=&quot;https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml&quot; rel=&quot;nofollow noreferrer&quot;&gt;Protocol Numbers&lt;/a&gt;, that tells IP to which registered layer-4 module it should send the packet payload.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-06-27T15:45:40.287" LastActivityDate="2017-06-27T15:45:40.287" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42234" PostTypeId="2" ParentId="34508" CreationDate="2017-06-27T20:15:31.500" Score="1" Body="&lt;p&gt;As stated, you can actually run Ethernet over any two or four twisted pairs. The higher the speed and the distance, the better your cable needs to be. Any splice or tap will severly reduces cable quality and possible speed and distance.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Gigabit (1000BASE-T) actually works on four-pair Cat.3 but only over a very short distance (a few meters). Fast Ethernet (100BASE-TX) requires only two pairs and is much more lenient, I used a 15+ m run of Cat.3 for a while without problems. 10 Mbit Ethernet (10BASE-T) runs over close to everything for a few dozen or even more than a hundred meters.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Note that Ethernet ports don't automatically link at a lower speed when the cable is sub-standard, you need to configure the ports down. If you do so, do it on both sides or auto configuration will fail and may easily cause a duplex mismatch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also note that you can't run a productive link over such a cable without very close monitoring of the error rate.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-27T20:15:31.500" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42238" PostTypeId="1" AcceptedAnswerId="42244" CreationDate="2017-06-28T08:00:16.607" Score="5" ViewCount="4337" Body="&lt;p&gt;I have made the following simple network model on packet-tracer consisting of two laptops and a switch. I don't do any configurations on laptops or switches, the only thing I do is connecting them with straight-through cables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/4sHWr.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/4sHWr.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On &quot;simulation&quot; mode, I can see that the switch is continuously sending mostly STP and sometimes CDP and DTP packet to the laptops. To understand how STP protocol works, I studied &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/5234-5.html&quot; rel=&quot;noreferrer&quot; title=&quot;Understanding and Configuring Spanning Tree Protocol (STP) on Catalyst Switches&quot;&gt;this&lt;/a&gt;. But I still have these questions in mind:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;What do &quot;red crosses&quot; mean shown in the above packet-tracer screen-shot? &lt;/li&gt;&#xA;&lt;li&gt;How are STP, CDP and DTP protocols related to each other?&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;" OwnerUserId="36279" LastActivityDate="2019-11-15T22:01:15.787" Title="Understanding how spanning-tree protocol (STP) works, along with CDP and DTP" Tags="|spanning-tree|packet-tracer|cdp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42240" PostTypeId="2" ParentId="2298" CreationDate="2017-06-28T09:15:58.353" Score="0" Body="&lt;p&gt;I dont know if it applies to this model but in the web configuration you can go to the top menu: Software then System configuration and there enable &quot;Blink the Access Point LEDs&quot;. It will make the leds blink and its easy to identify the AP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I hope this helps somebody&lt;/p&gt;&#xA;" OwnerUserId="37820" LastActivityDate="2017-06-28T09:15:58.353" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42242" PostTypeId="2" ParentId="20426" CreationDate="2017-06-28T10:17:26.443" Score="2" Body="&lt;p&gt;Using wireless reg db from:&#xA;git://git.kernel.org/pub/scm/linux/kernel/git/sforshee/wireless-regdb.git&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;country KR: DFS-JP                                  &#xA;        (2402 - 2482 @ 40), (20)                    &#xA;        (5170 - 5250 @ 80), (20), AUTO-BW           &#xA;        (5250 - 5330 @ 80), (20), DFS, AUTO-BW      &#xA;        (5490 - 5710 @ 160), (30), DFS              &#xA;        (5735 - 5835 @ 80), (30)                    &#xA;        # 60 GHz band channels 1-4,                 &#xA;        # ref: http://www.law.go.kr/%ED%96%89%EC%A0%95%EA%B7%9C%EC%B9%99/%EB%AC%B4%EC%84%A0%EC%84%A4%EB%B9%84%EA%B7%9C%EC%B9%99                                                                                    &#xA;        (57000 - 66000 @ 2160), (43)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37789" LastActivityDate="2017-06-28T10:17:26.443" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42243" PostTypeId="1" AcceptedAnswerId="42248" CreationDate="2017-06-28T10:53:28.690" Score="2" ViewCount="3125" Body="&lt;p&gt;If an Ethernet link is up on my end, does it necessarily mean the computer on the other end is alive and I can talk to him?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Or does it mean that my PHY is just ready to send data onto the medium?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know there are various ways to check &quot;link state&quot; and that there are operational vs administrative states of an interface.&lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2017-07-28T17:26:04.620" Title="Link Up status in Ethernet" Tags="|ethernet|layer1|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42244" PostTypeId="2" ParentId="42238" CreationDate="2017-06-28T11:14:02.240" Score="5" Body="&lt;p&gt;When connecting a PC to a Cisco switch, it may sometimes take 30 seconds or more before the PC can communicate on the network. When you're waiting for something to work, 30 seconds can seem like an eternity. Let's look at how you can speed up the switch port initialization process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Understand the phases of switch port initialization&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When you connect a device to an enabled switch port, the switch port goes through four phases by default. Let's take a closer look.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Spanning Tree Protocol (STP) initialization&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;STP is the IEEE 802.1d protocol, and it prevents loops in a LAN. Testing this switch port is necessary; disabling STP can create a loop on a LAN. If a hub, switch, or router connected to this port, STP would be very important. On the other hand, if a PC, printer, server, or laptop connected to this port (and remains connected ), the STP initialization process isn't necessary.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;During the STP initialization phase, the port goes through the five phases of STP: blocking, listening, learning, forwarding, and disabled. This process takes about 15 seconds. However, if you know that a client will remain connected to this port, you can disable the process.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Testing for Ether Channel configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The next process the switch port goes through is testing for Ether Channel, which is the bonding together of switch ports to create larger aggregate Ethernet connections. Ether Channel also provides redundancy if one of the channels goes down. This process, which uses the Port Aggregation Protocol (PAgP), takes about 15 seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Testing for trunk configuration&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Next, the switch tests to see if the port is a trunk port. Trunking delivers data for multiple VLANs across a single switch port. While testing for a trunk port doesn't take that long, you can disable it to save a few more seconds.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Auto-negotiation of switch port speed and duplex&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Finally, the switch port goes through auto-negotiation of the speed and duplex. For example, a switch port may support 1000-Mb (1Gb) Full Duplex, but a client PC may only support 100-Mb Full Duplex. The switch and the client work this out to negotiate the fastest speed that both can support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CDP is primarily used to obtain protocol addresses of neighboring devices and discover the platform of those devices. CDP can also be used to display information about the interfaces your router uses. CDP is media- and protocol-independent, and runs on all Cisco-manufactured equipment including routers, bridges, access servers, and switches. A few other manufacturers like HP and Juniper support CDP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you want to limit the information sent to your laptops you could set the switch to run spanning-tree portfast, which will forward packets before asking who the neighbor is.&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastEditorUserId="36720" LastEditorDisplayName="user36472" LastEditDate="2019-11-15T22:01:15.787" LastActivityDate="2019-11-15T22:01:15.787" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="42245" PostTypeId="1" CreationDate="2017-06-28T15:52:25.333" Score="1" ViewCount="34" Body="&lt;p&gt;I am VERY new to networking but how does an ASA5508X need to be configured to talk to a Modem that has only 1 LAN port on it? I have to configure an &quot;outside&quot; ip and subnet. MY ISP is only able to provide an IP address but no subnet. When I plug directly into the modem I get a 192.168.0.X address. I should mention that this modem uses a SIM to provide internet if that matters. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help greatly appreciated. Thanks!&lt;/p&gt;&#xA;" OwnerUserId="37644" LastActivityDate="2017-06-28T16:46:53.027" Title="ASA 5508X to a Modem that only provides LAN" Tags="|cisco|routing|internet|lan|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42246" PostTypeId="2" ParentId="19283" CreationDate="2017-06-28T16:01:06.897" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;In this case, we have to wait for a few minutes and restart Wi-Fi on the roaming phone/notebook (which may not be required, but this seems to speed it up). On my Android phone, I won’t get an IP address or a connection to the rest of the network. I’m only able to ping to the Archer C5 and not the RT-AC68U or Google’s DNS when this happens.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;It looks like a problem related to ARP table. The AP associates you with the previous path to reach you and does not refresh the ARP table until after a while.&#xA;That is why the problem is resolved over time or restarting the device.&lt;/p&gt;&#xA;" OwnerUserId="37789" LastActivityDate="2017-06-28T16:01:06.897" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42247" PostTypeId="2" ParentId="42245" CreationDate="2017-06-28T16:46:53.027" Score="1" Body="&lt;p&gt;The simplest way is to configure the ASA in &quot;transparent mode.&quot;  That way, the ASA acts as a layer 2 device and needs no addressing.  Connect the outside interface to the modem, and the inside to your switch/host.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-06-28T16:46:53.027" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42248" PostTypeId="2" ParentId="42243" CreationDate="2017-06-28T16:52:56.440" Score="3" Body="&lt;p&gt;Usually the link goes up on both sides at the same time. In very rare cases (damaged cable or port) it may only come up on one side.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whether you can actually &quot;talk&quot; to the other computer depends on what protocols are running. TCP/IP requires compatible static addresses or DHCP and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Cown's reference to Wake on LAN is valid - a sleeping WoL-capable node has the link up but ignores everything but a magic packet.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-28T16:52:56.440" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42249" PostTypeId="2" ParentId="2192" CreationDate="2017-06-28T17:26:57.217" Score="0" Body="&lt;p&gt;Summary: &lt;strong&gt;MC-LAG or HSRP GARP&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've never been a fan of tweaking timers.  Timers are set a certain way usually for many reasons. Altering them:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;is potentially operationally intensive to maintain everywhere the same&lt;/li&gt;&#xA;&lt;li&gt;makes things more complicated and difficult to troubleshoot&lt;/li&gt;&#xA;&lt;li&gt;as a recent commentor showed, can have unexpected side effects&lt;/li&gt;&#xA;&lt;li&gt;may not &quot;play nice&quot; with future Cisco enhancements&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Alternately:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Use MC-LAG&lt;/strong&gt; (aka &quot;MEC&quot; in Cisco documentation).  This is your best option, though you should understand the deployment scenarios where MC-LAG can be used (its not a universal solution, and should only be deployed after appropriate research and testing).  MC-LAG variants are hardware dependent.  Examples are:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;a. Stacking (Cat 3k)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;b. VSS (Cat4k/6k)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;c. VPC (Nexus)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;d. Pseudo mLACP (ASR1k)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;e. MC-LAG (ASR9k)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;f. Clustering (ASA)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;&lt;strong&gt;Enable HSRP to periodically send Gratuitous ARP packets&lt;/strong&gt;.  Granted, this is similar to altering timers, but it's a much more graceful alteration than manipulating the CAM table and ARP timers.  (Note though that this depends on your hardware and software combination, not all HSRP implementations offer this.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By default, HSRP sends 3 GARPs, at 0, 2, and 4 seconds after the router becomes the forwarding gateway.  However, there is a configuration parameter that allows you to choose the number of GARPs (including &quot;infinite&quot;) and the interval.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;&#xA;&lt;p&gt;I use MC-LAG pretty extensively, particularly VSS, VPC, and Clustering (I'm not a fan of stacking).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Where I can't use MC-LAG or GLBP, this is what I apply to my campus L2/L3 boundary routers (I have a 350-building campus so I use Cat6k pretty heavily):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Cat6k-v15(config)#interface vlan 100&#xA;Cat6k-v15(config-if)#standby arp ?&#xA;  gratuitous  Setup gratuitous ARP interval and count&#xA;&#xA;Cat6k-v15(config-if)#standby arp gratuitous ?&#xA;  count     Set HSRP gratuitous ARP count&#xA;  interval  Set HSRP gratuitous ARP interval&#xA;  &amp;lt;cr&amp;gt;&#xA;&#xA;Cat6k-v15(config-if)#standby arp gratuitous count ?&#xA;  &amp;lt;0-60&amp;gt;  Number of gratuitous ARPs to send after group is activated (0 for continuous)&#xA;&#xA;Cat6k-v15(config-if)#standby arp gratuitous count 0 ?&#xA;  count     Set HSRP gratuitous ARP count&#xA;  interval  Set HSRP gratuitous ARP interval&#xA;  &amp;lt;cr&amp;gt;&#xA;&#xA;Cat6k-v15(config-if)#standby arp gratuitous count 0 interval ?&#xA;  &amp;lt;3-1800&amp;gt;  Gratuitous ARP Interval (sec)&#xA;&#xA;Cat6k-v15(config-if)#standby arp gratuitous count 0 interval 60 ?&#xA;  count     Set HSRP gratuitous ARP count&#xA;  interval  Set HSRP gratuitous ARP interval&#xA;  &amp;lt;cr&amp;gt;&#xA;&#xA;Cat6k-v15(config-if)#standby arp gratuitous count 0 interval 60 &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;(I would post references to all these, but I don't have a high-enough &quot;reputation&quot; on this site to post more than two URLs.)&lt;/p&gt;&#xA;" OwnerUserId="37834" LastEditorUserId="37834" LastEditDate="2017-10-09T05:03:38.373" LastActivityDate="2017-10-09T05:03:38.373" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="42251" PostTypeId="1" CreationDate="2017-06-28T19:12:25.633" Score="1" ViewCount="201" Body="&lt;p&gt;ok so here's the scenario:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Computer A captures some packets and saves the session into file 'traffic'.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Later on, Computer B opens the 'traffic' file and wants to know who captured the file...the ip of the pc that captured the packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;how can this be achieved?&lt;/p&gt;&#xA;" OwnerUserId="37837" LastActivityDate="2017-07-19T21:30:53.943" Title="Wireshark capturing device ip" Tags="|wireshark|packet-analysis|network|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42252" PostTypeId="2" ParentId="42251" CreationDate="2017-06-28T19:21:27.917" Score="2" Body="&lt;p&gt;This can only be guessed by the received packets. If the capture used promiscuous mode (likely) and all segment packets were captured through a mirror port (possible), there's no way to find that out.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Without the mirror port, only unicasts intended for the capture machine and broadcasts should have been received (fully-switched network assumed). Therefore, only a certain destination MAC should show up with the local destination IP address(es).&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-06-28T19:21:27.917" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42258" PostTypeId="1" AcceptedAnswerId="42267" CreationDate="2017-06-29T04:37:05.683" Score="2" ViewCount="73" Body="&lt;p&gt;Why not just create multiple SSID? WiFi devices are capable to sense network drop and connect to new one.&lt;/p&gt;&#xA;" OwnerUserId="4479" LastActivityDate="2017-06-29T09:39:56.047" Title="What does meshed WiFi network benefit to user?" Tags="|wireless|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42259" PostTypeId="1" CreationDate="2017-06-29T06:53:31.293" Score="1" ViewCount="3029" Body="&lt;p&gt;I've got a few questions related to networking, more specifically VLAN'ing.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got a Gateway/Router - Ubiquiti USG&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got a 48Port Netgear Switch - Netgear GS748Tv5 L2+/L3 Lite&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've got 5 Ubiquiti UniFi Wireless Access Points connected to the Netgear switch&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Can someone give me some basic documentation on how I should go about setting up multiple VLAN's on both devices.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have created the 4 Networks that I wish to operate. All have DHCP on for their respective IP ranges.&#xA;Network A - Private | 192.168.15.x | VLAN ID 1&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network B - Guest | 192.168..x | VLAN ID 50&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network C - AV | 192.168..x | VLAN ID 20&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network D - POS | 192.168..x | VLAN ID 10&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I need Network A to be able to access the WAN &amp;amp; Network D&#xA;I need Network B to be able to access the WAN Only&#xA;I need network C to be able to access the WAN and potentially a device on Network A&#xA;I need network D to be able to access Network A and one device to access the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Each Network is going to be accessible via Wifi, and the Wifi Points are Ubiquiti devices, so they seem to integrate quite easily into the Ubiquiti controller and have had the VLAN ID's associated with the respective Wifi networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For wired devices I know I can set certain ports on the switch to automatically assign those devices to a certain VLAN so that will solve the issue of handling wired devices in a VLAN scenario.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Currently I'm not getting any DHCP out of the router when I connect to a Wifi network other than the default one.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know I must be missing a step somewhere but I'm not confident on what I've missed. I have created the VLAN's in the switch but I'm not sure if the switch is letting the DHCP traffic go from the USG port to the Wifi devices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help with this is greatly appreciated.&lt;/p&gt;&#xA;" OwnerUserId="37849" LastActivityDate="2019-04-21T12:02:20.437" Title="Beginners Guide to VLAN with Netgear &amp; Ubiquiti HW VLAN101?" Tags="|switch|router|vlan|lan|" AnswerCount="1" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42267" PostTypeId="2" ParentId="42258" CreationDate="2017-06-29T09:39:56.047" Score="2" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;Wireless mesh networks are an emerging technology right now. The use&#xA;  of mesh wireless networks may bring the dream of a seamlessly&#xA;  connected world into reality. Previously, it was thought to be near&#xA;  impossible to easily, effectively and wirelessly connect entire cities&#xA;  with inexpensive outdoor wifi technology. Wireless Mesh Networks allow&#xA;  municipals, large enterprises, campus wireless networks and more to&#xA;  achieve those goals.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;check this out it might help -&lt;/em&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.securedgenetworks.com/blog/3-Key-Benefits-of-Wireless-Mesh-Networks&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.securedgenetworks.com/blog/3-Key-Benefits-of-Wireless-Mesh-Networks&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37502" LastActivityDate="2017-06-29T09:39:56.047" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42268" PostTypeId="2" ParentId="41917" CreationDate="2017-06-29T09:56:06.723" Score="1" Body="&lt;p&gt;This turned out to be a bug in the OS of the router. It would get itself stuck in a loop and drop its PPPoE.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As a quick fix I added a script that would clear the PPPoE interface, and placed it here:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;/config/scripts/ppp/ip-down.d&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The script would then be ran when the PPPoE connection drops. Clearing the interface would then restart the connection and it would be fine again (24 hours approx) until the problem re-emerged.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It works until the manufacturers sort out the above issue. &lt;/p&gt;&#xA;" OwnerUserId="18944" LastActivityDate="2017-06-29T09:56:06.723" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42270" PostTypeId="1" AcceptedAnswerId="42272" CreationDate="2017-06-29T10:44:15.983" Score="0" ViewCount="826" Body="&lt;p&gt;I want my clients to use a /19 subnet but want them divided along 4 /21 subnets:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;/21 for servers, printers and so on&lt;/li&gt;&#xA;&lt;li&gt;/21 for LAN clients&lt;/li&gt;&#xA;&lt;li&gt;/21 for WLAN clients&lt;/li&gt;&#xA;&lt;li&gt;/21 vor VPN clients&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The subnets for servers, LAN and WLAN clients shall be served by DHCP running on a server with multiple VLAN interfaces in each segment. Also, a router is configured with VLAN interfaces in each segment. My concern is if I need to configure the interfaces each as /19 or /21. Or do I have something completely misconceptualized?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edit in response to Ron Maupin:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;1 EdgeRouter PoE&lt;/li&gt;&#xA;&lt;li&gt;1 Cisco SG300-52&lt;/li&gt;&#xA;&lt;li&gt;1 TP-Link TL-SG2452&lt;/li&gt;&#xA;&lt;li&gt;2 TP-Link TL-SG3424P&lt;/li&gt;&#xA;&lt;li&gt;about 2 dozens of TP-Link TL-SG3210 in different rooms&lt;/li&gt;&#xA;&lt;li&gt;about a dozen Ubiquity access points spread over the floor&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;The EdgeRouter PoE can provide DHCP but not dynamic DNS, so there's a server doing both. A single /24 subnet got to small, thus I have to redesign the network during productive use. One department working with credit card information and stuff like that needs its own seperate network, thus they have their own VLAN. Currently, we have our regular office VLAN (default 1), a guest VLAN (20), a VLAN for WiFi (50) and the seperated VLAN (100). Our dedicated server serves DHCP and DNS for VLANs 1 and 50 but I want it to do the others, too.&lt;/p&gt;&#xA;" OwnerUserId="37859" LastEditorUserId="37859" LastEditDate="2017-06-29T14:15:36.287" LastActivityDate="2017-06-29T16:23:40.417" Title="How to combine multiple subnet" Tags="|subnet|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42271" PostTypeId="2" ParentId="3323" CreationDate="2017-06-29T11:44:21.860" Score="0" Body="&lt;p&gt;WE dont need any reverse routes for the internal subnets on the edge router because we are doing nat at firewall so every packet which is going out of ASA will be having ip address of the outside interface only (with different Port ) and &lt;/p&gt;&#xA;&#xA;&lt;p&gt;this outside interface is directly connected to the edge router so the edge router does not require the reverse routes &lt;/p&gt;&#xA;" OwnerUserId="37861" LastActivityDate="2017-06-29T11:44:21.860" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42272" PostTypeId="2" ParentId="42270" CreationDate="2017-06-29T12:32:40.277" Score="2" Body="&lt;p&gt;To answer your specific question, each VAN interface has a /21 mask.  Think of the VLAN interface as just another host address on each subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;By the way, assuming a Cisco router, you don't need to have multiple interfaces on your DHCP server.  You can have just one and configure &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;ip helper-address x.x.x.x&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;on each VLAN interface.  x.x.x.x is the address of your DHCP server.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-06-29T16:23:40.417" LastActivityDate="2017-06-29T16:23:40.417" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42273" PostTypeId="1" AcceptedAnswerId="42275" CreationDate="2017-06-29T13:00:30.323" Score="0" ViewCount="26843" Body="&lt;p&gt;I am an Electrical Engineer learning about computer Networks, So this question might be childish and easy for most of you. Please answer it briefly.&#xA;I am performing subnetting where I have this address 192.10.10.0. In this worksheet, I can understand all the data except a number of borrowed bits which are 4. Please tell me How and from where this 4 came from? &#xA;&lt;a href=&quot;https://i.stack.imgur.com/9GiOE.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/9GiOE.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&#xA;I have downloaded different worksheets and docs but was not able to understand this.&lt;/p&gt;&#xA;" OwnerUserId="37863" LastActivityDate="2017-06-29T13:28:24.913" Title="How to find number of borrowed bits in subnetting" Tags="|subnet|" AnswerCount="1" CommentCount="3" ClosedDate="2017-06-29T13:49:25.793" ContentLicense="CC BY-SA 3.0" />
  <row Id="42274" PostTypeId="1" AcceptedAnswerId="42646" CreationDate="2017-06-29T13:04:16.650" Score="1" ViewCount="724" Body="&lt;p&gt;Debugging an issue where I'm trying to get q-in-q working on an Arista 7050S with a loopback. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I’ve got packets egressing the switch double tagged but in ingress, I can see them on the STAG’s SVI. I’m assuming that they’re being punted to the control-plane. Both TPID’s are 0x8100.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface Ethernet1&#xA;   description QINQ PORT&#xA;   switchport trunk allowed vlan 1001&#xA;   switchport mode trunk&#xA;   spanning-tree bpduguard disable&#xA;   spanning-tree bpdufilter disable&#xA;   spanning-tree guard none&#xA;&#xA;interface Ethernet2&#xA;   description LOOPBACK CONNECTED TO ET3&#xA;   switchport access vlan 1001&#xA;   switchport mode dot1q-tunnel&#xA;   spanning-tree bpduguard disable&#xA;!&#xA;interface Ethernet3&#xA;   description LOOPBACK CONNECTED TO ET2&#xA;   switchport trunk allowed vlan 100-104&#xA;   switch port mode trunk&#xA;   spanning-tree bpduguard disable&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Correctly formatted packets being received on a host connected to Et1:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump: listening on ens2f1np1, link-type EN10MB (Ethernet), capture size 262144 bytes&#xA;23:02:56.339095 00:1c:73:68:50:a1 (oui Unknown) &amp;gt; 00:0f:53:3f:1e:31 (oui Unknown), ethertype 802.1Q (0x8100), length 122: vlan 1001, p 0, ethertype 802.1Q, vlan 103, p 0, ethertype IPv4, (tos 0x0, ttl 64, id 32392, offset 0, flags [none], proto ICMP (1), length 100)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Packets being recieved on SVI 1001 on the 7050:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;tcpdump: listening on vlan1001, link-type EN10MB (Ethernet), capture size 65535 bytes&#xA;13:12:00.776276 00:0f:53:3f:1e:31 (oui Unknown) &amp;gt; 00:1c:73:68:50:a1 (oui Arista Networks), ethertype 802.1Q (0x8100), length 102: vlan 103, p 0, ethertype IPv4, (tos 0x0, ttl 64, id 37014, offset 0, flags [DF], proto ICMP (1), length 84)&#xA;    1.0.0.4 &amp;gt; 1.0.0.3: ICMP echo request, id 4856, seq 1973, length 64&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Any ideas? Hair is being pulled.&lt;/p&gt;&#xA;" OwnerUserId="14894" LastActivityDate="2017-07-18T20:44:25.970" Title="Arista 7050s Loopback Q-in-Q" Tags="|cisco|switch|cisco-ios|qinq|arista|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42275" PostTypeId="2" ParentId="42273" CreationDate="2017-06-29T13:28:24.913" Score="0" Body="&lt;p&gt;The borrowed bits are the &lt;strong&gt;host bits&lt;/strong&gt; in the &lt;em&gt;default subnet mask&lt;/em&gt; that are used for network in the &lt;em&gt;custom subnet mask&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In your example:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Last byte of the &lt;em&gt;default subnet mask&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Binary      Decimal&#xA;00000000 -&amp;gt; 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Last byte of the &lt;em&gt;custom subnet mask&lt;/em&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Binary      Decimal&#xA;11110000 -&amp;gt; 240&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;The first four (4) bits go from host to network, they are borrowed bits.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;It can be understood easily using CIDR notation:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Netmask           CIDR Notation&#xA;255.255.255.255   32&#xA;&#xA;Netmask           CIDR Notation&#xA;255.255.255.0     24&#xA;&#xA;Netmask           CIDR Notation&#xA;255.255.255.240   28&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="16654" LastActivityDate="2017-06-29T13:28:24.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42280" PostTypeId="2" ParentId="29135" CreationDate="2017-06-29T21:53:00.060" Score="1" Body="&lt;p&gt;THIS ONLY USES A SINGLE STATIC IP FROM MY ISP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I did was, I simply setup my pfSense, behind my first router/firewall.  So, ISP &amp;lt;----&gt; Modem &amp;lt;----&gt; EdgeRouter-X (WAN PORT-DHCP to ISP) &amp;lt;---&gt; Pfsense Server in Cluster (DHCP Reserved lease to EdgeRouter).  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Edge Firewall (EdgeRouter-X)&#xA;WAN: DHCP to ISP&#xA;LAN: 192.168.50.0/24&#xA;DHCP Server: 192.168.50.100 - 192.168.50.200&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PFSENSE-1&#xA;Pfsense-1 WAN-DHCP: 192.168.50.1&#xA;Pfsense-1 LAN-STATIC: 192.168.1.254&#xA;Pfsense-1 GUEST-STATIC: 192.168.10.254&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PFSENSE-2&#xA;Pfsense-2 WAN-DHCP: 192.168.50.2&#xA;Pfsense-2 LAN-STATIC: 192.168.1.222&#xA;Pfsense-2 GUEST-STATIC: 192.168.10.222&lt;/p&gt;&#xA;&#xA;&lt;p&gt;CARP ASSIGNMENTS&#xA;pfSense WAN-VIP: 192.168.50.3&#xA;pfSense LAN-VIP: 192.168.1.201&#xA;pfSense GUEST-VIP: 192.168.10.201&#xA;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, I am double nating, but this works fine too.  Each pfSense has an ip address on the 192.168.50.0/24 network for their WAN ports which are on my EdgeRouter-X segment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Failover for pfSense-1 to pfSense-2 happens pretty quick.  Failback of course has some timeouts since the network interfaces come up and begin working before the system is fully up.&lt;/p&gt;&#xA;" OwnerUserId="37875" LastEditorUserId="37875" LastEditDate="2017-06-30T00:28:43.023" LastActivityDate="2017-06-30T00:28:43.023" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42281" PostTypeId="1" AcceptedAnswerId="44817" CreationDate="2017-06-30T01:08:40.547" Score="3" ViewCount="1990" Body="&lt;p&gt;What is the latency of IP over Infiniband compare with 10Gbps fibre network?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;10Gbps network is something like a Solarflare low latency NIC card. How well does IP over IB perform not just throughput but latency?&lt;/p&gt;&#xA;" OwnerUserId="4479" LastEditorUserId="20757" LastEditDate="2017-07-02T15:03:07.733" LastActivityDate="2018-07-17T09:47:00.890" Title="What is the latency of IP over Infiniband compare with 10Gbps fibre network?" Tags="|ip|latency|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42282" PostTypeId="2" ParentId="42259" CreationDate="2017-06-30T02:26:21.233" Score="1" Body="&lt;p&gt;Well, there is a lot here and a few different places it could be:&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure the interfaces on your USG are set as tagged interfaces so they are dropping their info tagged into the switch.&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;You said you need some east/west (vlan to vlan) communication blocked.   Do you have any rules on the USG preventing that now?&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Make sure the interface going to your USG and to your APs are setup as trunks and are configured to pass the tagged traffic (have the VLANs configured on them).  If the USG configured anything like the Ubiquity switch I've configured, the interfaces are a little tricky from the GUI.  Configure the VLAN and then make sure on the interface facing your Netgear they are set to &quot;T&quot; for trunk (if I remember right - I can't get into my switch for some reason right now...)&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;Have you verified you get DHCP addresses on those other VLANs when wired?  If so, then it's an issue with tagging to your APs (we #3).  If not, you might have a tagging issue or interface configuration issue going to your USG (#1, #2 or even possibly #3).&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="37827" LastActivityDate="2017-06-30T02:26:21.233" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42283" PostTypeId="2" ParentId="37664" CreationDate="2017-06-30T07:52:03.650" Score="0" Body="&lt;p&gt;IPv6 doesn't need NAT, yet it still appears as though firewalls are stateful with respect to UDP. &lt;/p&gt;&#xA;" OwnerUserId="37883" LastActivityDate="2017-06-30T07:52:03.650" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42285" PostTypeId="1" AcceptedAnswerId="42289" CreationDate="2017-06-30T09:40:38.487" Score="1" ViewCount="598" Body="&lt;p&gt;I'm trying to get my head round IPv6.  I've stumbled on &lt;a href=&quot;https://community.openvpn.net/openvpn/wiki/IPv6&quot; rel=&quot;nofollow noreferrer&quot;&gt;something&lt;/a&gt; which surprised me, and I'm looking to understand this better in terms of networking:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do Link Local addresses remove the need for a router to have multiple routable IP addresses?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As I understand it: IPv4 subnets are used to identify addresses which could be found using &lt;a href=&quot;https://en.wikipedia.org/wiki/Address_Resolution_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;ARP&lt;/a&gt;.  Beyond that they are used as logical groups of IP addresses for routing, where all IP addresses in a group can be contacted via the same route (next hop).  All setups that I've seen have given each router multiple IP addresses, one for each subnet it's attached to.  That is, each physical subnet needed its own logical IP subnet and a router attached to multiple subnets would need an IP address in each.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;However under IPv6 ARP is gone and replaced by &lt;a href=&quot;https://en.wikipedia.org/wiki/Neighbor_Discovery_Protocol&quot; rel=&quot;nofollow noreferrer&quot;&gt;NDP&lt;/a&gt;.  When I look on my own VM, it doesn't even know how big it's subnet really is.  It thinks it's on a &lt;code&gt;/64&lt;/code&gt; but in fact it's in a much larger subnet.  The entire &lt;code&gt;/64&lt;/code&gt; subnet is dedicated to my VM and its gateway is already outside that.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;This suggests to me that IP subnets are subtly different under IPv6.  It suggests that unlike ARP, NDP can detect physically connected routers without the routers having an IP on the same subnet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My question is really this:  If a physical subnet is composed entirely of routers, does the subnet need its own IPv6 subnet, or can / will the routers just use &lt;a href=&quot;https://en.wikipedia.org/wiki/Link-local_address&quot; rel=&quot;nofollow noreferrer&quot;&gt;Link Local Addresses&lt;/a&gt; for that subnet:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Subnet-With-IP  &amp;lt;--Router--&amp;gt;  Subnet-no-IP  &amp;lt;--Router--&amp;gt;  Subnet-With-IP&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="37876" LastEditorUserId="37876" LastEditDate="2017-07-01T10:37:49.973" LastActivityDate="2017-07-01T10:37:49.973" Title="Do NDP and Link Local addresses remove the need for a router to have multiple routable IP addresses?" Tags="|routing|router|ipv6|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42288" PostTypeId="2" ParentId="42285" CreationDate="2017-06-30T12:43:21.343" Score="1" Body="&lt;p&gt;tl;dr:  Depends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let me see if I can parse this out.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;IPv4 subnets are used to identify addresses which could be found using ARP. Beyond that they are used as logical groups of IPs for routing, where all IPs in a group can be contacted via the same route (next hop). &lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;To be more precise, in an IPv4 (sub)network, all the hosts can directly address each other and can respond to broadcasts.  Hosts outside the subnet can be reached through a gateway.  The network portion of the address identifies the topological location of the host.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;When I look on my own VM, it doesn't even know how big it's subnet really is. It think's it's on a /64 but in fact it's in a much larger subnet. The entire /64 subnet is dedicated to my VM and it's gateway is already outside that.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;If that is in fact the case, your VM is misconfigured.  Subnetting and gateways work the same on IPv4 and IPv6.  Your VM knows it's on a /64 because that's how it's configured (manually or otherwise).  The gateway address is in the same /64. You may or may not have only one host (VM) on that subnet, but you could have many, many more (2^64, to be exact).&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;If a physical subnet is composed entirely of routers, does the subnet need its own IPv6 subnet, or can / will the routers just use Link Local Addresses for that subnet?&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Link local addresses ARE IPv6 addresses -- they just aren't globally unique. And since all LL addresses are in the same subnet, whether they can be used for routing depends on the routing protocol used.  For some, like OSPFv3 or static, you don't need globally unique addresses.  For BGP, you do.  IS-IS doesn't use layer 3 addresses anyway, so the question doesn't apply to it. &lt;/p&gt;&#xA;" OwnerUserId="2142" LastActivityDate="2017-06-30T12:43:21.343" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="42289" PostTypeId="2" ParentId="42285" CreationDate="2017-06-30T12:43:29.037" Score="1" Body="&lt;p&gt;A router is just a host on a network that knows how to communicate with other networks. A host needs to have a gateway (router) on its network to be able to communicate with devices on a different network.&lt;/p&gt;&#xA;&lt;p&gt;Link-local addresses are still IP addresses. IPv6 allows, even requires, multiple IP networks on a single interface. A router could be on any or all of those networks.&lt;/p&gt;&#xA;&lt;p&gt;Yes, you can connect routers with only link-local addresses, but that really complicates support and troubleshooting. For example, you cannot ping a router interface that only has a link-local address from a different network.&lt;/p&gt;&#xA;&lt;p&gt;Based on many of the IPv6 protocols, you should really only use &lt;code&gt;/64&lt;/code&gt; networks, except for point-to-point networks (&lt;code&gt;/127&lt;/code&gt;) and loopbacks (&lt;code&gt;/128&lt;/code&gt;). Using networks of other sizes breaks some things in IPv6. See &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc5375#appendix-B&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 5375, IPv6 Unicast Address Assignment Considerations, Appendix B. Considerations for Subnet Prefixes Different than /64&lt;/em&gt;&lt;/a&gt; and &lt;a href=&quot;https://www.rfc-editor.org/rfc/rfc7421&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;em&gt;RFC 7421, Analysis of the 64-bit Boundary in IPv6 Addressing&lt;/em&gt;&lt;/a&gt; among other sources.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="-1" LastEditDate="2021-10-07T07:34:52.683" LastActivityDate="2017-06-30T12:43:29.037" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42290" PostTypeId="1" AcceptedAnswerId="42303" CreationDate="2017-06-30T16:20:42.047" Score="2" ViewCount="520" Body="&lt;p&gt;I'm trying to make a router inside GNS3 to connect to the host device (a Debian 8) with no success. Am I missing something?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/JCt1X.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/JCt1X.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;DHCP works as expected:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;!&#xA;interface FastEthernet0/0&#xA; ip address dhcp&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;IP is assigned to the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;%DHCP-6-ADDRESS_ASSIGN: Interface FastEthernet0/0 assigned DHCP address 192.168.56.104, mask 255.255.255.0, hostname R1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;When I ping from the host to the router I see (tcpdump) the ARP reply:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;13:12:08.902370 ARP, Request who-has 192.168.56.104 tell 192.168.56.101, length 28&#xA;13:12:08.905452 ARP, Reply 192.168.56.104 is-at cc:01:43:49:00:00, length 46&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it is not populated in the host ARP table:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo arp -a&#xA;? (192.168.56.104) at &amp;lt;incomplete&amp;gt; on eth1&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;But it is on the router:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;R1#sh arp&#xA;Protocol  Address          Age (min)  Hardware Addr   Type   Interface&#xA;Internet  192.168.56.101          2   xxxx.xxxx.3f96  ARPA   FastEthernet0/0&#xA;Internet  192.168.56.104          -   cc01.4349.0000  ARPA   FastEthernet0/0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And when I ping from the router to the host, the host won't reply. A tcpdump capture on the host:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;18:40:19.862855 ARP, Request who-has 192.168.56.101 tell 192.168.56.104, length 46&#xA;18:40:21.804763 ARP, Request who-has 192.168.56.101 tell 192.168.56.104, length 46&#xA;18:40:23.781876 ARP, Request who-has 192.168.56.101 tell 192.168.56.104, length 46&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is no rules in iptables:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;$ sudo iptables -L&#xA;Chain INPUT (policy ACCEPT)&#xA;target     prot opt source               destination         &#xA;&#xA;Chain FORWARD (policy ACCEPT)&#xA;target     prot opt source               destination         &#xA;&#xA;Chain OUTPUT (policy ACCEPT)&#xA;target     prot opt source               destination         &#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="2436" LastEditorUserId="2436" LastEditDate="2017-06-30T21:43:23.897" LastActivityDate="2017-07-01T17:36:37.640" Title="GNS3 v2 router to host connection" Tags="|arp|linux|gns3|" AnswerCount="1" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42291" PostTypeId="2" ParentId="7713" CreationDate="2017-06-30T19:47:57.113" Score="19" Body="&lt;p&gt;A &lt;strong&gt;&lt;a href=&quot;http://www.practicalnetworking.net/series/arp/gratuitous-arp/&quot; rel=&quot;noreferrer&quot;&gt;Gratuitous ARP&lt;/a&gt;&lt;/strong&gt; is an ARP Response that was not prompted by an ARP Request. The Gratuitous ARP is sent as a broadcast frame, as a way for a node to announce or update its IP to MAC mapping to the entire network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;An ARP Packet contains an &quot;&lt;a href=&quot;http://www.practicalnetworking.net/series/arp/traditional-arp/#req-opcode&quot; rel=&quot;noreferrer&quot;&gt;Opcode&lt;/a&gt;&quot; field which indicates whether the packet is a request or a response. In the &lt;a href=&quot;http://www.practicalnetworking.net/series/arp/gratuitous-arp/#garp-packet&quot; rel=&quot;noreferrer&quot;&gt;Gratuitous ARP&lt;/a&gt;, the Opcode field is set to &lt;code&gt;2&lt;/code&gt;, which indicate a Response:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/0LHYL.png&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/0LHYL.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are many &lt;a href=&quot;http://www.practicalnetworking.net/series/arp/gratuitous-arp/#garp-use-cases&quot; rel=&quot;noreferrer&quot;&gt;use cases for Gratuitous ARP&lt;/a&gt;, all typically having to do with some sort of need to update the ARP Mapping or Switchport MAC address tables.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://www.google.com/url?sa=t&amp;amp;rct=j&amp;amp;q=&amp;amp;esrc=s&amp;amp;source=web&amp;amp;cd=3&amp;amp;cad=rja&amp;amp;uact=8&amp;amp;ved=0ahUKEwiy_ZeaqObUAhVJ1GMKHanmD14QFggwMAI&amp;amp;url=https%3A%2F%2Fen.wikipedia.org%2Fwiki%2FHot_Standby_Router_Protocol&amp;amp;usg=AFQjCNGMW_T9eC19B2hEfnghSCkxAoTITg&quot; rel=&quot;noreferrer&quot;&gt;HSRP&lt;/a&gt; (and many other redundancy protocols) use Gratuitous ARP frequently. This animation will illustrate how:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/G8051.gif&quot; rel=&quot;noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/G8051.gif&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice RouterA and RouterB are sharing the IP Address &lt;code&gt;10.0.0.1&lt;/code&gt; and the MAC address &lt;code&gt;0053.ffff.1111&lt;/code&gt;. The Host's are configure with a default gateway of &lt;code&gt;10.0.0.1&lt;/code&gt;, and they each have an ARP mapping indicating the &lt;code&gt;10.0.0.1&lt;/code&gt; IP address maps to the &lt;code&gt;0053.ffff.1111&lt;/code&gt; MAC address. Since both the MAC address and IP address are shared between the two routers, this ARP Mapping will never have to be updated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;em&gt;However&lt;/em&gt;, when RouterA is the active HSRP router, the MAC address is being served by the device connected to switchport 1. If RouterA fails, then RouterB sends a Gratuitous ARP to update the switch's MAC address table that the MAC address &lt;code&gt;0053.ffff.1111&lt;/code&gt; is now being served by the device connected to switchport 2.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The process occurs again if RouterB fails, and RouterA needs to take back over serving the IP/MAC &lt;code&gt;10.0.0.1&lt;/code&gt;/&lt;code&gt;0053.ffff.1111&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The Packet Capture of the HSRP transitions and GARP packets in the animation above can be &lt;a href=&quot;https://goo.gl/mkfF55&quot; rel=&quot;noreferrer&quot;&gt;downloaded and studied&lt;/a&gt; in &lt;a href=&quot;https://www.wireshark.org/download.html&quot; rel=&quot;noreferrer&quot;&gt;Wireshark&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;HR /&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;While not strictly something you asked about, given the comments in this Q&amp;amp;A I thought it wise to mention something about duplicate address detection:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an often confused point regarding duplicate address detection and Gratuitous ARP.  When a computer is trying to see if another host on the network is using a particular IP address &lt;strong&gt;&lt;em&gt;it does not send a Gratuitous ARP&lt;/em&gt;&lt;/strong&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The reason for this is by definition, a Gratuitous ARP is meant to update the ARP mappings of other devices on the network. &lt;em&gt;If&lt;/em&gt; an IP is not unique, we wouldn't want the &quot;test for uniqueness&quot; to cause an incorrect ARP entry to be updated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In reality, a specific set of ARP Messages are used in duplicate address detection: an &lt;a href=&quot;http://www.practicalnetworking.net/series/arp/arp-probe-arp-announcement/&quot; rel=&quot;noreferrer&quot;&gt;ARP Probe and ARP Announcement&lt;/a&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The crucial difference between these two packets and an actual Gratuitous ARP, is the &lt;a href=&quot;http://www.practicalnetworking.net/series/arp/arp-probe-arp-announcement/#probe-packet&quot; rel=&quot;noreferrer&quot;&gt;ARP Probe&lt;/a&gt; does not have a complete IP/MAC mapping, therefore it is impossible for an ARP Probe to accidentally erroneously update an ARP Cache.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The general process is the ARP Probe is sent a few times, which would prompt the owner of the IP in question to send a Gratuitous ARP if the IP is already in use. If no response is received, then the sender sends an &lt;a href=&quot;http://www.practicalnetworking.net/series/arp/arp-probe-arp-announcement/#announcement-packet&quot; rel=&quot;noreferrer&quot;&gt;ARP Announcement&lt;/a&gt; to officially claim the IP address on the network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The ARP Announcement is even more similar to a Gratuitous ARP, but it (also) is not technically the same because the &lt;a href=&quot;http://www.practicalnetworking.net/series/arp/arp-probe-arp-announcement/#arp-announcement-opcode&quot; rel=&quot;noreferrer&quot;&gt;ARP Announcement has an opcode of &lt;code&gt;1&lt;/code&gt;&lt;/a&gt;, indicating a request (where as a &lt;a href=&quot;http://www.practicalnetworking.net/series/arp/gratuitous-arp/#garp-packet&quot; rel=&quot;noreferrer&quot;&gt;Gratuitous ARP will have an opcode of &lt;code&gt;2&lt;/code&gt;&lt;/a&gt;).&lt;/p&gt;&#xA;" OwnerUserId="3675" LastActivityDate="2017-06-30T19:47:57.113" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42292" PostTypeId="1" AcceptedAnswerId="42293" CreationDate="2017-06-30T21:28:17.813" Score="1" ViewCount="600" Body="&lt;p&gt;I'm trying to route two different networks using static routing, my problem is that I have 10 routers 4 in Lan1, 4 in Lan2 and 2 between Lan1 and Lan2, here is the topology:&lt;a href=&quot;https://i.stack.imgur.com/fyxjF.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/fyxjF.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm trying doing something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;My routing table for R1: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;192.168.90.0 via 192.168.50.2&lt;/li&gt;&#xA;&lt;li&gt;192.168.91.0 via 192.168.50.2&lt;/li&gt;&#xA;&lt;li&gt;192.168.92.0 via 192.168.50.2&lt;/li&gt;&#xA;&lt;li&gt;192.168.59.0 via 192.168.50.2&lt;/li&gt;&#xA;&lt;li&gt;192.168.58.0 via 192.168.50.2&lt;/li&gt;&#xA;&lt;li&gt;192.168.57.0 via 192.168.50.2&lt;/li&gt;&#xA;&lt;li&gt;192.168.56.0 via 192.168.50.2&lt;/li&gt;&#xA;&lt;li&gt;192.168.10.0 via 192.168.50.2&lt;/li&gt;&#xA;&lt;li&gt;192.168.20.0 via 192.168.50.2&lt;/li&gt;&#xA;&lt;li&gt;192.168.30.0 via 192.168.50.2&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;And I do almost the same for the others routers, what I want to know is if there is an easier way to do this, for example something like this:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;R1 -&gt; R3 -&gt; R4 -&gt; R5 -&gt; R6 -&gt; LAN networks&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I mean... instead of adding all my networks to my routing table just adding the next router network, or another easier way to do this.&lt;/p&gt;&#xA;" OwnerUserId="37896" LastEditorUserId="37896" LastEditDate="2017-06-30T21:35:22.093" LastActivityDate="2017-09-29T00:40:58.480" Title="How to route two different networks" Tags="|cisco|routing|router|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="42293" PostTypeId="2" ParentId="42292" CreationDate="2017-06-30T22:12:21.747" Score="1" Body="&lt;p&gt;Well, you could at least supernet 192.168.56.0/24, ..57.0/24, ..58.0/24, ..59.0/24 into 192.168.56.0/22.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.50.0/24 through 192.168.53.0/24 would go into 192.168.48/21 (including some collateral damage).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;192.168.90.0/24 through 192.168.92.0/24 could go into 192.168.88.0/21 (again, somewhat more).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you don't require default routes for the Internet, you could use those as shortcuts:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1: 192.168.52.0/24 -&gt; 192.168.51.2; default -&gt; 192.168.50.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R2: equivalent&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R3: two routes to left subnets, default -&gt; 192.168.90.2&lt;/p&gt;&#xA;&#xA;&lt;p&gt;and so on.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Alternatively, you could at least aggregate consecutive even/odd subnets into a single route.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;To your question: if you don't mind non-optimal routes you could actually have the edge routers route in a circle by default gateway and only let R3-R6 use educated routes.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-06-30T22:21:57.960" LastActivityDate="2017-06-30T22:21:57.960" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42294" PostTypeId="2" ParentId="25827" CreationDate="2017-06-30T23:25:45.013" Score="0" Body="&lt;blockquote&gt;&#xA;  &lt;p&gt;When I want to Telnet to the switch, I set the IP address of the VLAN&#xA;  1 interface, and it works.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;I was also puzzled to know that even though I did not configure a default  gateway (using the &lt;code&gt;ip default-gateway&lt;/code&gt; command) on my Catalyst 2960 L2 Switch. I could ping/telnet to it not only from a host on the same subnet, but also from hosts on &lt;em&gt;remote subnets&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Hosts send packets to its default gateway when the &lt;em&gt;packet's destination IP Address is in a different subnet&lt;/em&gt;, and if no default gateway has been configured they simply can't communication outside its local subnet. So, the question is how come the Switch's VLAN 1 Interface is a able to send data to the local router/gateway if it hasn't been configured with such?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Well, turns out that although the Switch's VLAN 1 Interface doesn't know the IP Address of its Default Gateway, &lt;strong&gt;it issues an ARP Broadcast to learn the MAC Address of packet's destination Host&lt;/strong&gt; (just like it would if the packet's destination IP Address was in the same subnet) and once the router's LAN Interface receives the ARP Broadcast message it tries to &lt;strong&gt;match the Target IP Address to any of its routes&lt;/strong&gt;, if a match is found (meaning that the router knows how to get to the subnet the Target IP Address resides in), then it &lt;em&gt;replies with the MAC Address of the interface in which the ARP Message was received&lt;/em&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's a diagram explaining the whole process:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/BZi4U.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/BZi4U.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Notice that without a configured default gateway the Switch needs to issue an ARP Broadcast for every new non-local IP Address it wants to communicate with, meaning that &lt;em&gt;the Switch's ARP Table will list an entry for every non-local IP Address pointing to the same MAC Address&lt;/em&gt; (the local router's interface MAC Address). On the other hand, if you configure the Switch with a Default Gateway, the Switch needs to issue only one ARP Broadcast to learn the MAC Address of its configured default gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Update: As pointed out by @RonMaupin, Routers will only reply to ARP Requests for non-local IP Addresses if &lt;a href=&quot;http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13718-5.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;proxy arp&lt;/a&gt; is enabled on the gateway's Interface&lt;/p&gt;&#xA;" OwnerUserId="19148" LastEditorUserId="19148" LastEditDate="2017-07-01T03:51:52.810" LastActivityDate="2017-07-01T03:51:52.810" CommentCount="7" ContentLicense="CC BY-SA 3.0" />
  <row Id="42296" PostTypeId="1" CreationDate="2017-07-01T07:32:44.937" Score="2" ViewCount="1809" Body="&lt;p&gt;OK, so basically I'm getting confused with all the terms, and if some are related to others or not.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'll explain myself:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From what I understand, flow control depends on the receiver side buffer capabilities, which are basically how many packets per unit of time can the receiver receive per unit of time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Congestion control, on other hand, depends on the capabilities of the network&#xA;between the receiver and the sender (we don't want to overflow the network with packets until the network won't be able to route them around).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Now, here is where I'm not sure about the other terms.&lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;The MTU is the unit for the Congestion control, and the MSS is the unit for flow control?&lt;/li&gt;&#xA;&lt;li&gt;In the Rwnd (receive window) there will be the value of the MSS of the &#xA;receiver?&lt;/li&gt;&#xA;&lt;li&gt;Now, here is where i get really confused, the Cwnd (Congestion window)&#xA;is basically to know how many packets can the receiver receive before &#xA;starting to lose some data (duplicate ACKs). Why do we need this window if the sender already knows the MSS of the receiver and the MTU between them?&#xA;Is the MSS used to know the size of each packet individually that the sender should send, while the MTU is the capability of the network to transfer each packet from one point to another and the Congestion window will be related to the quantity of the packets that the receiver can receive?&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="37898" LastEditorUserId="8499" LastEditDate="2017-12-28T22:27:19.947" LastActivityDate="2017-12-28T22:27:19.947" Title="Congestion control,flow control, MTU and MSS, Rwnd-Cwnd and slow-start" Tags="|tcp|congestion|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42297" PostTypeId="2" ParentId="42296" CreationDate="2017-07-01T08:05:47.177" Score="1" Body="&lt;ol&gt;&#xA;&lt;li&gt;A host indicates the largest TCP segment size (local MTU - (IP overhead + TCP overhead)) it can receive by the MSS. The MTU is the largest IP packet the underlying L2 transport can send/receive. Usually, they are directly related.&lt;/li&gt;&#xA;&lt;li&gt;The receive window is another TCP connection parameter not directly related to MSS or MTU. It's rather about path throughput and latency.&lt;/li&gt;&#xA;&lt;li&gt;Likely there are slower hops in the path than either receiver or sender can see. They must not be overrun. Often both receiver and sender have fast local connections (at least 100 Mbit/s) while they are connected over much slower Internet connections (say 10 Mbit/s).&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-07-01T08:30:37.940" LastActivityDate="2017-07-01T08:30:37.940" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42299" PostTypeId="1" AcceptedAnswerId="42302" CreationDate="2017-07-01T15:02:16.803" Score="1" ViewCount="721" Body="&lt;p&gt;As far as I know about full and half duplex, if we have a channel with bandwidth 10Mbps then in full duplex both sender and receiver can transfer 10Mb in both directions at the same time and in half duplex only sender or receiver can transfer 10Mb at a time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If suppose, propagation delay is 1 sec then is the capacity of channel in full duplex 20Mb and in half duplex 10Mb ? How can the capacity of a channel double based on the mode, it should be same all the time right?&lt;/p&gt;&#xA;" OwnerUserId="37406" LastActivityDate="2017-07-03T11:07:34.380" Title="Full Duplex and Half Duplex Channel Capacity" Tags="|switch|ethernet|ipv4|network|duplex|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42302" PostTypeId="2" ParentId="42299" CreationDate="2017-07-01T16:40:19.607" Score="5" Body="&lt;p&gt;Think of a half-duplex connection as a single channel that you can turn around between packets. Then think of a full-duplex connection as two unidirectional channels that can be used simultaneously.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Physically, all modern twisted-pair or fiber Ethernet connections have two channels, one for sending, one for receiving (most prominent in 10BASE-T, 100BASE-TX and fiber). With half duplex they may not be used at the same time while with full duplex they may.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-07-03T11:07:34.380" LastActivityDate="2017-07-03T11:07:34.380" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42303" PostTypeId="2" ParentId="42290" CreationDate="2017-07-01T17:36:37.640" Score="2" Body="&lt;p&gt;I've noticed this for quite awhile with GNS3. I imagine that while you can see the ARP's via wireshark on the host, the host isn't actually &lt;em&gt;receiving&lt;/em&gt; them. They're being sent out the host interface as if it was generating the traffic. Hence, it doesn't respond to its &quot;own&quot; ARP.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is probably a 'better' or 'more correct' way to get around this problem, but I found that creating a TAP interface on the host and bridging it with the physical interface using the &lt;code&gt;ip&lt;/code&gt; command will suffice. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I'm able to provide the GNS3 router a DHCP address from my LAN via connecting it to a GNS3 cloud using the TAP interface I created on the host. The GNS3 router can reach all devices including the host, as well as the internet. Connectivity remains 'normal' on the host.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I don't recall what specific configuration may be necessary for the GNS3 cloud, as it automatically populated the TAP interface and offered it as a connection for the router. (You will probably have to start GNS3 after performing the below, however.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here's the script I use:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;# Adjust these as desired.&#xA;PHY_INT=enp9s0&#xA;TUN_INT=tap0&#xA;BR_INT=br0&#xA;&#xA;case &quot;$1&quot; in&#xA;        up)&#xA;                echo &quot;Creating bridge ...&quot;&#xA;                # Create bridge interface&#xA;                ip link add $BR_INT type bridge&#xA;                # Create TAP interface&#xA;                ip tuntap add $TUN_INT  mode tap&#xA;                ip link set $TUN_INT  up&#xA;                # Flush IP from physical interface&#xA;                ip add flush dev $PHY_INT&#xA;                # Add interfaces to bridge&#xA;                ip link set $TUN_INT master $BR_INT&#xA;                ip link set $PHY_INT master $BR_INT&#xA;                ip link set dev $BR_INT up&#xA;&#xA;                # DHCP&#xA;                dhclient -v $BR_INT&#xA;&#xA;                ;;&#xA;        down)&#xA;                echo &quot;Removing bridge ...&quot;&#xA;                ip link del $TUN_INT&#xA;                ip link del $BR_INT&#xA;                dhclient -v $PHY_INT&#xA;                ;;&#xA;        *)&#xA;                echo $&quot;Usage: $0 {up|down}&quot;&#xA;                exit 1&#xA;esac&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;I'm on Debian Stretch (9) and GNS3 2.0.3. &lt;/p&gt;&#xA;" OwnerUserId="37271" LastActivityDate="2017-07-01T17:36:37.640" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42306" PostTypeId="2" ParentId="29210" CreationDate="2017-07-01T20:34:48.467" Score="2" Body="&lt;p&gt;Probably the baud rate is fixed to something you didn't try. If you can run a telnet or ssh session, you can check the serial console setting with &lt;code&gt;show console&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can reset to default settings by&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;console baud-rate speed-sense&#xA;console flow-control xon/xoff&#xA;console local-terminal vt100&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-07-01T20:34:48.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42308" PostTypeId="1" AcceptedAnswerId="42309" CreationDate="2017-07-01T23:56:18.693" Score="1" ViewCount="1442" Body="&lt;p&gt;I'm reviewing the configuration of a pair of pair routers.  Each pair of routers has a satellite link between them (which is also redundant). They are in use - One pair has HSRP configured for all routed interfaces.  However the other pair has HSRP and VRRP.  The VRRP is configured on the link to the modems for the satellite links and HSRP is for all the local systems. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;My questions is, is this safe to have both VRRP and HSRP (others have done so - so I believe this is OK). However, is there a possible reason for doing this?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The modems are identical at both ends, so I am trying to see why HSRP could not of been used at both ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They are all new and just installed in the last few days.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The configurations for the VRRP/HSRP pair of routers is below (IP addresses have been changed -so there maybe typos in the IP addresses):&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;                                           track 1 interface FastEthernet0/0/0 ip routing&#xA;                                           track 2 interface GigabitEthernet0/0.2 ip routing&#xA;interface GigabitEthernet0/0.2             interface GigabitEthernet0/0.2&#xA; encapsulation dot1Q 2                      encapsulation dot1Q 2&#xA; ip address 1.1.2.2 255.255.255.0          ip address 1.1.2.3 255.255.255.0&#xA; ip nat inside                             &#xA; ip virtual-reassembly in                   ip virtual-reassembly in&#xA; standby 1 ip 1.1.1.1                       standby 1 ip 1.1.1.1&#xA;                                            standby 1 priority 105&#xA; standby 1 preempt                          standby 1 preempt&#xA;                                            standby 1 track 1 decrement 10&#xA;                                            standby 1 track 2 decrement 10&#xA;!                                          !&#xA;interface GigabitEthernet0/0.4             interface GigabitEthernet0/0.4&#xA; encapsulation dot1Q 4                      encapsulation dot1Q 4&#xA; ip address 1.1.4.2 255.255.255.0           ip address 1.1.4.3 255.255.255.0&#xA; ip nat inside                             &#xA; ip virtual-reassembly in                   ip virtual-reassembly in&#xA; standby 1 ip 1.1.4.1                       standby 1 ip 1.1.4.1&#xA; standby 1 preempt                          standby 1 priority 105&#xA;                                            standby 1 track 1 decrement 10&#xA;!                                           standby 1 track 2 decrement 10&#xA;!                                          !&#xA;interface GigabitEthernet0/0.22            interface GigabitEthernet0/0.22&#xA; encapsulation dot1Q 22                     encapsulation dot1Q 22&#xA; ip address 1.1.22.2 255.255.255.240         ip address 1.1.22.3 255.255.255.240&#xA; ip nat inside                             &#xA; ip virtual-reassembly in                   ip virtual-reassembly in&#xA; standby 1 ip 1.1.22.1                      standby 1 ip 1.1.22.1&#xA;                                            standby 1 priority 105&#xA; standby 1 preempt                          standby 1 preempt&#xA;                                            standby 1 track 1 decrement 10&#xA;                                            standby 1 track 2 decrement 10&#xA;!                                          !&#xA;interface FastEthernet0/0/0                interface FastEthernet0/0/0&#xA; description SATELLITE MODEMS               description SATELLITE MODEMS&#xA; ip address 1.1.1.2 255.255.255.0           ip address 1.1.1.3 255.255.255.0&#xA; ip nat outside                            &#xA; ip virtual-reassembly in                   ip virtual-reassembly in&#xA; duplex auto                                duplex auto&#xA; speed auto                                 speed auto&#xA; vrrp 1 ip 1.1.1.1                          vrrp 1 ip 1.1.1.1&#xA;                                            vrrp 1 priority 105&#xA;                                            vrrp 1 track 1 decrement 15&#xA;                                            vrrp 1 track 2 decrement 15&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;There is no NAT, and I can see things such as there is a &lt;code&gt;nat inside&lt;/code&gt; statement on one router but not the other, so I believe there are errors.&lt;/p&gt;&#xA;" OwnerUserId="33676" LastEditorUserId="8499" LastEditDate="2018-12-25T05:25:47.317" LastActivityDate="2018-12-25T05:25:47.317" Title="Possible reasons for both VRRP and HSRP on same router" Tags="|cisco|hsrp|vrrp|fhrp|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42309" PostTypeId="2" ParentId="42308" CreationDate="2017-07-02T00:16:53.877" Score="1" Body="&lt;p&gt;Having both HSRP and VRRP on a router is fine, as long as they are configured on different interfaces, which seems to be the case.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There are probably several things wrong with the way this is configured. For example, &lt;code&gt;preempt&lt;/code&gt; in not used consistently (see &lt;code&gt;interface GigabitEthernet0/0.4&lt;/code&gt;, &lt;code&gt;ip address 1.1.4.3 255.255.255.0&lt;/code&gt;), and I would actually put a delay on it so that minor bounces don't have it jumping back and forth unnecessarily.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;HSRP and VRRP are protocols for redundancy for the LAN hosts. It may be that whoever set this up thinks it is redundancy for the routers (many people do, but they are wrong). The routers must be able to communicate with each other over the LAN defined by the interface configuration, else each will think it is master for that LAN. Both protocols work by fooling the hosts on the LAN. Unless the satellite link is a LAN host that can be fooled by VRRP, then it really is incorrect.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If NAT is not being used, then there is no need for any NAT statements, and that may be the result of a poor cleanup job.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You should really just rethink this from scratch, put your proposed solution in the lab (never replace a working configuration with out testing), then fix the routers to make sense to you.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-07-02T00:16:53.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42310" PostTypeId="1" CreationDate="2017-07-02T03:39:35.167" Score="0" ViewCount="1610" Body="&lt;p&gt;I have a great confusion about the terms &quot;Model&quot; and &quot;Architecture&quot;. Is the TCP/IP is a model or architecture?. If it is model then what is architecture? What does the both terms refers to.&lt;/p&gt;&#xA;" OwnerUserId="37920" LastActivityDate="2017-11-08T13:40:19.923" Title="What is the difference between &quot;Network Model&quot; and &quot;Network Architecture&quot;?" Tags="|tcp|network|osi|architecture|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42311" PostTypeId="2" ParentId="36979" CreationDate="2017-07-02T08:56:52.210" Score="0" Body="&lt;p&gt;Depending on your locale (upstairs, downstairs), use 90° orientation for current floor, 0° for upstairs, downstairs, and 45° for upstairs/downstairs, a bit displaced from where the AP is sitting. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Have at least two in 90° position. It affects the polarization of the radiowaves, and it's often helpful to mix this up. Laptops usually have two small patch antennas which sit at the top and side of the screen, one oriented vertically and one horizontally. If you need to cover one direction only, place a large copper plate/mesh on the opposite side of the direction you want to cover. It will reflect. You can also use wallpaper/paint infused with metal particles to get better coverage (a bouncy cage), and reduce interference from unwanted 2.4GHz sources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For longer ranges, use bigger omnis, or patch antennas. I have found big omnis and patch antennas to be a lot more useful than e.g. parabolics, which are only useful for point-to-point links.&lt;/p&gt;&#xA;" OwnerUserId="36398" LastEditorUserId="36398" LastEditDate="2017-07-02T18:38:03.467" LastActivityDate="2017-07-02T18:38:03.467" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42315" PostTypeId="2" ParentId="42310" CreationDate="2017-07-02T14:45:58.707" Score="2" Body="&lt;p&gt;Network model explain communication between two end devices in terms of layers and explain the responsibility of each layer (OSI model, TCP/IP model).&#xA;&lt;a href=&quot;https://i.stack.imgur.com/1BoS4.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/1BoS4.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Network Architecture explain the responsibility of each network device based on its location down into 3 locations (Backbone , distribution , edge/access) and describe the responsibility of each tier. &lt;/p&gt;&#xA;" OwnerUserId="17452" LastActivityDate="2017-07-02T14:45:58.707" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42320" PostTypeId="1" CreationDate="2017-07-02T18:05:36.097" Score="1" ViewCount="2479" Body="&lt;p&gt;i created the following topology using packet tracer to understand how the switch mac table works , &#xA;&lt;a href=&quot;https://i.stack.imgur.com/T7UrR.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/T7UrR.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;at the beginning , i looked at the mac table in the swithc S1 before i send any packet or do any pings and i found that the router R1 mac address(the one on fa0) is always there , so why is that ?! is it always like this when router connects to switch ?! is this normal ? &lt;/p&gt;&#xA;&#xA;&lt;p&gt;later a sent a packet from PC1 to the web server (IP: 10.1.1.99) and i noticed that when the packet came out of PC1 the mac address of the destination was (00:E0:8F:79:BD:01) which the mac address of router R1 on port 0 and when the packet leaved R1 the packet destination address became (00:DD:32:33:15:62) which is the mac of web server , so is this what really happens in real life? why the packet didn't have the mac of web server when it came out from pc1 not from Router R1 ? Can anybody explain this to me ?! &#xA;Note : i used RIP to route the two LAN networks together , &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Kind regards &lt;/p&gt;&#xA;" OwnerUserId="37923" LastEditorUserId="36720" LastEditDate="2017-10-01T09:07:21.307" LastActivityDate="2017-11-30T14:21:19.683" Title="Understanding MAC table with simulation on packet tracer" Tags="|mac-address|mac|" AnswerCount="2" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="42321" PostTypeId="2" ParentId="42320" CreationDate="2017-07-02T19:02:39.567" Score="2" Body="&lt;p&gt;To answer your questions:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;PC1 looks at its local routing table and decides it needs R1 to reach the web server. It uses the server's IP address as destination but as destination MAC address for Ethernet transport it uses the router's MAC.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router looks at the destination IP address and decides to forward the packet out of the interface facing the web server. Since it's an Ethernet interface and the destination IP is local to the segment it'll ARP the IP address of the server and use the MAC as destination.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2017-07-02T19:09:11.430" LastActivityDate="2017-07-02T19:09:11.430" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42328" PostTypeId="1" AcceptedAnswerId="42976" CreationDate="2017-07-03T13:48:04.570" Score="4" ViewCount="5570" Body="&lt;p&gt;The title pretty much explains what I'm trying to understand.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the difference between CSMA/CD, CSMA/CA and MACA.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've read from different sources that MACA doesn't solve Hidden Terminals, or Exposed ones, and from other sources that MACA solves both. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;What I've understand till now is:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;CSMA/CD:&lt;/strong&gt; Carrier Sense Multiple Access with Collision Detection&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;A node, before transmitting, checks whether there are other nodes in his range that are transmitting, if so it waits and retries later (random time). If, once send, it detects a collision every node is warned. And the node retries after some time.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;So we can have collisions with Hidden Terminals.&lt;br&gt;&#xA;Exposed Terminals are not solved neither.&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;CSMA/CA:&lt;/strong&gt; Carrier Sense Multiple Access with Collision Avoidance&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;It's like the other one, but it implements RTS/CTS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does it solve? Hidden Terminals? Exposed Terminals?&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;strong&gt;MACA:&lt;/strong&gt; Multiple Access with Collision Avoidance&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Implements RTS/CTS.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What is the &lt;strong&gt;difference&lt;/strong&gt; from &lt;strong&gt;CSMA/CA&lt;/strong&gt;?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What does it solve? Hidden Terminals? Exposed Terminals?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Firstly I was pretty sure that using RTS/CTS you can solve both, but now I created some confusion reading from different sources.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I would really appreciate an answer.&lt;/p&gt;&#xA;" OwnerUserId="37954" LastEditorUserId="8499" LastEditDate="2017-07-03T14:01:37.327" LastActivityDate="2021-05-23T21:32:56.997" Title="CSMA/CD vs CSMA/CA vs MACA" Tags="|protocol-theory|layer1|" AnswerCount="3" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42329" PostTypeId="1" AcceptedAnswerId="42330" CreationDate="2017-07-03T14:08:08.143" Score="1" ViewCount="1235" Body="&lt;p&gt;I am working in a small business, but the office is quite large. For ages, everything ran over Wi-Fi here, but it's simply not reliable enough (Walls blocking signal, high latency, etc).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Some days ago I started wiring LAN cables to everywhere in the office. Starting on the &quot;main&quot; TP-Link 16 port switch, I pushed longer LAN cables to certain places that are further away, and on certain points where more than 1 PC is, I bought TP-Link Switches (5 ports) and then plugged all those PCs to that switch. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Until then, I thought it was all &lt;em&gt;fun and games&lt;/em&gt;, but testing the cables I noticed that I have no connectivity whatsoever. It seems that I cannot plug two switches together, because doing that does not allow traffic going through.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Strange enough, when I connect them together over a short distance, it works.&#xA;I'm using a Cat5e cable (It doesn't have any shielding, just twisted pairs). Cat5e cables are made to work up to 100 meters. The LAN cables here are only about 20-30 Meters. Interference isn't likely the cause, because the cables don't run near electricity (only a very short distance, and there isn't even something pushing AC through. It's a wall socket - unused.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With some searching I saw that &quot;like&quot; devices (same type) should be wired together with a &lt;a href=&quot;https://en.wikipedia.org/wiki/Ethernet_crossover_cable&quot; rel=&quot;nofollow noreferrer&quot;&gt;crossover cable&lt;/a&gt;. I've done that and connectivity still doesn't work.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The cables are wired following way on both sides (If that matters):&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://postimg.org/image/gpbdaus99/&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://s14.postimg.org/s1nysn0y9/20170703_111709.jpg&quot; alt=&quot;20170703_111709.jpg&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Any help is greatly appreciated.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;EDIT:&lt;/strong&gt; It seems that the order of the colors made the difference. I rearranged it and now it works perfectly.&#xA;Now I used this color arrangement:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/Q8BdI.gif&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Q8BdI.gif&quot; alt=&quot;Standard Ethernet cable colors&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Picture of the working network below:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/Y7rk5.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/Y7rk5.png&quot; alt=&quot;LAN working fine&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37953" LastEditorUserId="8499" LastEditDate="2018-03-09T22:13:32.560" LastActivityDate="2018-03-09T22:13:32.560" Title="Connecting two switches together over longer distance fails" Tags="|lan|layer1|cabling|cable|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42330" PostTypeId="2" ParentId="42329" CreationDate="2017-07-03T14:29:28.763" Score="3" Body="&lt;p&gt;Are you properly connecting pairs (1-2, 3-6, 4-5, 7-8)? Based on your picture, you are not doing this correctly. You are not properly maintaining the pairs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You must minimize what is untwisted.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Horizontal cable must be solid-core cable (maximum 90 meters), and it punches down to wallplates. Solid-core cable has better performance characteristics, but it is very fragile. It has a maximum pulling tension, and a minimum bend radius, and exceeding either of those can permanently ruin the cable. Horizontal cable is required to be run as a straight-through cable.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Patch cords should be stranded cable, and you need the correct connectors for stranded cable. The total length of the stranded patch cords in a cable run cannot exceed 10 meters (usually 5 meters on each end. Stranded cable has poor performance characteristics, but it is flexible. If you need a crossover cable (fairly rare since most modern equipment has Auto-MDX), then you do this as a patch cord at &lt;em&gt;one&lt;/em&gt; end of the cable run.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A simple wiremap and electrical connectivity is not enough to guarantee that a cable will work. There are many performance characteristics that need to meet the specifications. It is easy to get a cable that seems to work, but it actually slows the network because of bad frames that cause retransmissions. The equipment to properly test a cable run is very expensive.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-07-03T14:29:28.763" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42332" PostTypeId="2" ParentId="42328" CreationDate="2017-07-03T16:59:11.920" Score="2" Body="&lt;p&gt;I can't say that I know anything about MACA, but the main differences between CSMA/CD and CSMA/CA are&lt;/p&gt;&#xA;&lt;p&gt;CSMA/CD for wired&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;networks are many-to-many - any host can see/directly talk to any other one; there's no &amp;quot;hidden station&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;the (collision domain) endpoint has to resend in case of a collision&lt;/li&gt;&#xA;&lt;li&gt;the collisions &amp;quot;happen&amp;quot; in the physical layer and are signaled to the MAC layer&lt;/li&gt;&#xA;&lt;li&gt;collisions span from endpoint to endpoint (NIC or switch port)&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;CSMA/CA for wireless&lt;/p&gt;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;networks are usually point-to-multipoint - all traffic flows over a  central hub (e.g. WAP); there's a possible &amp;quot;hidden station&amp;quot;&lt;/li&gt;&#xA;&lt;li&gt;while sending, the transmitter cannot listen into the channel, so detecting a collision is much harder than in a wired network&lt;/li&gt;&#xA;&lt;li&gt;CSMA/CA hubs are responsible for forwarding a frame once they've received it, they very much work like an Ethernet switch with half-duplex ports&lt;/li&gt;&#xA;&lt;li&gt;collisions happen between endpoint and hub/WAP&lt;/li&gt;&#xA;&lt;li&gt;the CSMA/CA MAC layer is directly aware of a collision in order to back off and retry later&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&lt;p&gt;Note that I'm using &amp;quot;hub&amp;quot; in the figurative sense as a central traffic connector, not as in &amp;quot;repeater hub&amp;quot;. A wireless access point works more like a bridge than a repeater.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2021-05-23T10:57:54.127" LastActivityDate="2021-05-23T10:57:54.127" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="42336" PostTypeId="1" AcceptedAnswerId="56788" CreationDate="2017-07-03T21:46:23.877" Score="1" ViewCount="3046" Body="&lt;p&gt;I have some dual stack websites. When I open my websites they connect using IPv4 the first time, and then IPv6. If I ping the IP address directly, the first ping fails for IPv6 and then works fine. Wait 24 hours same problem, first ping fails.&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;2607:9000:0:35::fc3:9749&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Is there any cache problem, but it doesn't look like ARP cache problem?&lt;/p&gt;&#xA;" OwnerUserId="37966" LastEditorUserId="8499" LastEditDate="2018-03-12T00:25:17.850" LastActivityDate="2024-03-17T18:00:42.690" Title="My first IPv6 ping fails" Tags="|ip|ipv6|ping|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42338" PostTypeId="2" ParentId="42336" CreationDate="2017-07-03T22:32:42.167" Score="3" Body="&lt;p&gt;IPv6 doesn't use ARP, so there isn't an ARP cache. IPv6 uses ND, and a host maintains a Neighbor Cache and a Destination Cache, among others.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This is normal behavior, and you often see it with IPv4, too. Sometimes, it take a little too long for the target device to respond with its MAC address, and a ping will time out. There is really nothing wrong.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-07-03T22:32:42.167" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42340" PostTypeId="1" CreationDate="2017-07-04T07:45:49.193" Score="1" ViewCount="2501" Body="&lt;p&gt;I have 2xFG 600D for redundancy setup, where to use VRRP and HA configuration? which one is optimal for Nat mode ?&lt;/p&gt;&#xA;" OwnerUserId="37425" LastActivityDate="2017-07-12T08:36:13.930" Title="Fortigate VRRP or HA config" Tags="|routing|firewall|redundancy|fortigate|fortinet|" AnswerCount="2" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42342" PostTypeId="1" CreationDate="2017-07-04T12:04:12.030" Score="3" ViewCount="7234" Body="&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/I8qAm.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/I8qAm.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;I want to have a wired Internet connection before or after a PoE access point.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is that possible?&lt;/p&gt;&#xA;" OwnerUserId="37980" LastEditorUserId="453" LastEditDate="2017-09-28T04:49:14.650" LastActivityDate="2023-10-19T12:39:12.420" Title="Can I connect a simple switch before or after a PoE access point?" Tags="|access-point|power-over-ethernet|" AnswerCount="3" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="42350" PostTypeId="1" AcceptedAnswerId="42351" CreationDate="2017-07-05T05:44:16.393" Score="1" ViewCount="662" Body="&lt;p&gt;My current setup is:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;code&gt;modem -&amp;gt; router -&amp;gt; switch (with poe) -&amp;gt; Access point (ubiquiti)&#xA;                |                     -&amp;gt; security camera&#xA;                | &#xA;                 -&amp;gt; other access point&#xA;                 -&amp;gt; PCs near the router&lt;/code&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I just got sonic fiber (gigabit), so I need to upgrade my router and switch from 10/100 to gigabit. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;I can either buy a single unit that does both routing and switching, or I can by two separate units, similar to the setup I have now.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Aside from there being fewer wires, what are the pros / cons of a single unit vs two separate units?  (from a brief Amazon search, it seems that separates may be less expensive, but it may not be an apples-to-apples comparison)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;thanks&lt;/p&gt;&#xA;" OwnerUserId="37997" LastActivityDate="2017-07-05T05:55:54.030" Title="Pros/cons of a combined router &amp; poe switch vs separate units?" Tags="|routing|switch|" AnswerCount="1" CommentCount="3" ClosedDate="2017-07-05T07:14:25.940" ContentLicense="CC BY-SA 3.0" />
  <row Id="42351" PostTypeId="2" ParentId="42350" CreationDate="2017-07-05T05:55:54.030" Score="2" Body="&lt;p&gt;Pros: &lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;simpler cabling&lt;/li&gt;&#xA;&lt;li&gt;less encumbrance&lt;/li&gt;&#xA;&lt;li&gt;single point of administration&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Cons:&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;single point of failure&lt;/li&gt;&#xA;&lt;li&gt;cannot upgrade a single device at a time.&lt;/li&gt;&#xA;&lt;li&gt;can be trickier to troubleshoot&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;Depending of the devices chosen, the price could be a pro or a con.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Personally, I strongly prefer separate devices.&lt;/p&gt;&#xA;" OwnerUserId="16930" LastActivityDate="2017-07-05T05:55:54.030" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42354" PostTypeId="1" AcceptedAnswerId="42356" CreationDate="2017-07-05T08:46:53.357" Score="0" ViewCount="160" Body="&lt;p&gt;how can i take wired internet from the access point?&lt;a href=&quot;https://i.stack.imgur.com/7hFri.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/7hFri.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="37980" LastActivityDate="2017-07-05T09:44:59.953" Title="Take wired internet from a Poe access point" Tags="|cisco|access-point|" AnswerCount="1" CommentCount="5" ClosedDate="2017-07-05T17:44:55.547" ContentLicense="CC BY-SA 3.0" />
  <row Id="42355" PostTypeId="2" ParentId="42340" CreationDate="2017-07-05T09:31:45.913" Score="1" Body="&lt;p&gt;Converting comment to answer.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With HA the Fortigate needs to be the same model, as you already have. When using VRRP it allows you to use different hardware or even upgrade one Fortigate and still run redundant. Nat doesn't run faster or slower depending on your redundancy model.&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastActivityDate="2017-07-05T09:31:45.913" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42356" PostTypeId="2" ParentId="42354" CreationDate="2017-07-05T09:44:59.953" Score="1" Body="&lt;p&gt;Disconnecting and adding a PoE capable compact switch at the AP location 90 meters from the switch could be a solution. Then connecting the AP to the compact switch which then will hold the uplink gives the possibility to add more hosts at the AP location. This solution is based on the fact, that no port-security, 802.1X or mac address filtering has been configured on the intelligent switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Diagram for your eyes:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/rIIU8.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/rIIU8.jpg&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastActivityDate="2017-07-05T09:44:59.953" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42357" PostTypeId="2" ParentId="39900" CreationDate="2017-07-05T11:55:22.883" Score="0" Body="&lt;p&gt;Things like the Cisco phone system and Windows servers are moot for your question insofar as they are immobile. So the real issue is how to make your mobile laptop clients' sessions persistent as your users move around the building. The best investment you can make here --and also the easiest one to sell to your user base -- would be an upgrade of your Wi-Fi infrastructure to permit seamless roaming on the same SSID. It requires no changes from the users, gives you a control point for policy, and does exactly what you need. &lt;/p&gt;&#xA;" OwnerUserId="32071" LastActivityDate="2017-07-05T11:55:22.883" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42358" PostTypeId="2" ParentId="32472" CreationDate="2017-07-05T14:56:51.790" Score="0" Body="&lt;p&gt;&lt;a href=&quot;http://www.instructables.com/id/Cisco-Console-to-Null-Modem-Serial-Adapter/&quot; rel=&quot;nofollow noreferrer&quot;&gt;http://www.instructables.com/id/Cisco-Console-to-Null-Modem-Serial-Adapter/&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;u need this first .... &lt;/p&gt;&#xA;&#xA;&lt;p&gt;!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!&lt;/p&gt;&#xA;" OwnerUserId="38009" LastActivityDate="2017-07-05T14:56:51.790" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42359" PostTypeId="1" AcceptedAnswerId="42505" CreationDate="2017-07-05T15:03:40.740" Score="2" ViewCount="5678" Body="&lt;p&gt;&lt;strong&gt;Scenario&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have an environment with several hundred wireless devices.  I am trying to break down a fairly large network into several VLANs.  There are wireless devices in carts (groups of 30) that I would like to have in their own private VLANs.  It seems that MAC-based assignment would be the logical approach.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Question&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How can I accomplish MAC-based VLAN assignment for wireless devices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;&lt;p&gt;I have some experience with VLANs and subnetting, but I'm not as familiar with RADIUS, GVRP, or similar technologies.  &lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;We are a Meraki shop for AP's&lt;/p&gt;&lt;/li&gt;&#xA;&lt;li&gt;&lt;p&gt;We run HP 2510 switches&lt;/p&gt;&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Research&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://documentation.meraki.com/MR/Encryption_and_Authentication/Configuring_RADIUS_Authentication_with_WPA2-Enterprise#VLAN_Tagging_Options&quot; rel=&quot;nofollow noreferrer&quot;&gt;Meraki Documentation (including some RADIUS stuff)&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://documentation.meraki.com/MR/Client_Addressing_and_Bridging/VLAN_Tagging&quot; rel=&quot;nofollow noreferrer&quot;&gt;Meraki VLAN Tagging Documentation&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;From the latter link (specifically regarding user-based assignment) I found this information which may be helpful, but I do need MAC-based assignment and not user-based.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;The RADIUS server returns a group policy attribute (e.g., Filter-ID) in the Access-Accept message. The group policy attribute specifies a group policy that should be applied to the wireless user, overriding the policy configured on the SSID itself. If the group policy includes a VLAN ID, the group policy’s VLAN ID will be applied to the user.&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;Other Information&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If any important details were left out, please comment and let me know.  I'll add any information  needed promptly.  Thank you!&lt;/p&gt;&#xA;" OwnerUserId="38010" LastActivityDate="2017-07-13T13:47:05.623" Title="Assign wireless devices to VLAN by MAC address" Tags="|vlan|wireless|radius|meraki|" AnswerCount="1" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="42364" PostTypeId="1" AcceptedAnswerId="47890" CreationDate="2017-07-05T17:47:00.503" Score="5" ViewCount="3855" Body="&lt;p&gt;When we configure a qinq tunneling, the port, which performs the encapsulation, has the next command-lines:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface g0/10&#xA;  switchport&#xA;  switchport mode dot1q-tunnel&#xA;  switchport access vlan xxx &amp;lt;-- s-vlan&#xA;exit&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;So, on my job environment, if i want encapsulate another c-vlan (customer vlan) using a diferent s-vlan, I have to use another port and this option isn't scalable (one port for each s-vlan).&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Do you know about a method to encapsulate many c-vlans using different s-vlans on the same port? I tried with vlan-mapping or vlan translation, but this method doesn't perform encapsulation, only replaces the original tag with the s-vlan tag.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Help me!&lt;/p&gt;&#xA;" OwnerUserId="37543" LastEditorUserId="8499" LastEditDate="2018-03-12T04:51:40.083" LastActivityDate="2018-03-12T04:51:40.083" Title="Cisco QinQ - More than one provider vlan (s-vlan) on dot1q-tunnel port" Tags="|cisco|vlan|tunnel|qinq|dot1q|" AnswerCount="3" CommentCount="3" FavoriteCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42365" PostTypeId="2" ParentId="42364" CreationDate="2017-07-05T18:13:20.877" Score="0" Body="&lt;p&gt;When you configure dot1q-tunnel, all customer traffic is encapsulated with s-vlan.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Your customer can encapsulate his own traffic, with a c-vlan. In that case, you receive in your switch 802.1q traffic, and you can carry multiple customer vlans with one s-vlan in your network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;But is no possible to use different s-vlans in the same port.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This scenario can be possible using different tecnologies, like MPLS or VXLAN.&lt;/p&gt;&#xA;" OwnerUserId="22" LastActivityDate="2017-07-05T18:13:20.877" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42367" PostTypeId="1" AcceptedAnswerId="42369" CreationDate="2017-07-05T19:33:07.613" Score="3" ViewCount="28626" Body="&lt;p&gt;I have what I thought would be a quick question, but it seems harder to do than I originally thought.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say I'm connected to a Cisco device (switch or a router). How would I list interface names and the associated MAC addresses for the interfaces? Like, I don't want any more information than that. (I can handle a tiny bit of extra stuff, but nothing too crazy. Ideally, I'd like name/MAC address on one line, but I can deal with 2 lines if that's easier to do.)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;NOTE: I do not mean the ARP cache. I just want the MAC address that is assigned to that interface, as well as the interface name.&lt;/p&gt;&#xA;" OwnerUserId="38020" LastEditorUserId="8499" LastEditDate="2017-07-05T19:59:32.643" LastActivityDate="2017-07-07T12:15:45.890" Title="List interface names and MAC addresses on Cisco device?" Tags="|cisco|cisco-ios|cisco-commands|" AnswerCount="3" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42368" PostTypeId="2" ParentId="42367" CreationDate="2017-07-05T19:57:36.377" Score="0" Body="&lt;p&gt;It is pretty simple to get the information you want. You can use the &lt;code&gt;show interfaces&lt;/code&gt; command to find what you are looking for, but you are going to get a lot more information, too. You simply ignore the unnecessary information. You are not going to get it in the format you want, but you can copy it from your terminal and massage it.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;This will also show you the currently configured MAC address and the BIA.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-07-05T19:57:36.377" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42369" PostTypeId="2" ParentId="42367" CreationDate="2017-07-05T20:07:09.613" Score="5" Body="&lt;p&gt;You can roughly accomplish this by regex'ing the &lt;code&gt;show interfaces&lt;/code&gt; command:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interfaces | i (.* line protocol is )|(.* address is)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;This will produce fairly concise output with the interface on one line, and the MAC indented below it. E.g. from my 7200 in GNS3:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;FastEthernet0/0 is administratively down, line protocol is down&#xA;     Hardware is DEC21140, address is ca01.3cd1.0000 (bia ca01.3cd1.0000)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You can find further regex documentation on Cisco's website: &lt;a href=&quot;http://www.cisco.com/c/en/us/td/docs/ios/termserv/configuration/guide/15-mt/tsv-15-MT-book/tsv_reg_express.html&quot; rel=&quot;noreferrer&quot;&gt;http://www.cisco.com/c/en/us/td/docs/ios/termserv/configuration/guide/15-mt/tsv-15-MT-book/tsv_reg_express.html&lt;/a&gt; &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Keep in mind the example I provided is dependent on the format of &lt;code&gt;show interface&lt;/code&gt;'s output. You'll need to adjust &quot;line protocol is&quot; and/or &quot;address is&quot; appropriately to make the regex match the appropriate lines. (&quot;bia&quot; is probably a good alternative, for example.)&lt;/p&gt;&#xA;" OwnerUserId="37271" LastActivityDate="2017-07-05T20:07:09.613" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42370" PostTypeId="2" ParentId="17673" CreationDate="2017-07-05T20:11:02.750" Score="0" Body="&lt;p&gt;An old post, but note that the DGS1510 switch cannot use its own IP addresses for routing.  I want to create something very similar to Andi's setup, and logged a support case with DLink when I couldn't get it to work.  The reply was that the DGS1510 cannot route to its own IP addresses.  &lt;/p&gt;&#xA;" OwnerUserId="38021" LastActivityDate="2017-07-05T20:11:02.750" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42374" PostTypeId="1" AcceptedAnswerId="42383" CreationDate="2017-07-05T23:50:27.143" Score="1" ViewCount="1427" Body="&lt;p&gt;That title is kind of cluttered so let me try and clear it up.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;My equipment:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;Two &lt;code&gt;IP Codecs&lt;/code&gt; (I'll just refer to them as hosts from here on out)&lt;/li&gt;&#xA;&lt;li&gt;Cisco 3560-x Catalyst Switch&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;The problem:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I work in radio IT, and I have one main AOIP switched network (&lt;code&gt;192.168.87.0/24&lt;/code&gt;) for the majority of our end devices (nodes, automation machines, consoles, etc...), but (and had I been here when the network was designed, I would not have done it this way) there are two devices, our AOIP STLs that take audio from the studio to the transmitter. Those are my two hosts in question. Their network is &lt;code&gt;192.168.100.0/24&lt;/code&gt;, with the two hosts being &lt;code&gt;192.168.100.100/24&lt;/code&gt; and &lt;code&gt;192.168.100.101/24&lt;/code&gt;. I want to ping &lt;code&gt;192.168.100.0&lt;/code&gt; from &lt;code&gt;192.168.87.0&lt;/code&gt;. The management VLAN is VLAN 1 with the ip address &lt;code&gt;192.168.87.21&lt;/code&gt;.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;strong&gt;What I've tried:&lt;/strong&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I know intervlan routing is probably the answer here, but I'm not sure how to implement it with just a lone switch.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I tried just a simple:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;en&#xA;conf t&#xA;vlan 50&#xA;name Trango&#xA;exit&#xA;int vlan 50&#xA;descr Vlan for the Trango systems&#xA;ip add 192.168.100.105 255.255.255.0&#xA;no sh&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;And obviously I wasn't able to ping &lt;code&gt;192.168.100.105&lt;/code&gt;. What part of the process am I missing?&lt;/p&gt;&#xA;" OwnerUserId="32481" LastEditorUserId="8499" LastEditDate="2017-07-06T00:13:36.157" LastActivityDate="2020-12-10T13:39:28.753" Title="Put hosts in own VLAN on the same switch and be able to ping hosts" Tags="|cisco|switch|vlan|cisco-catalyst|" AnswerCount="5" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42375" PostTypeId="2" ParentId="42374" CreationDate="2017-07-06T00:08:33.370" Score="1" Body="&lt;p&gt;To send traffic between VLANs, you need to route it between the VLANs (hence, router). If your switch has the proper licensing (IP Base or above license) to be a layer-3 switch (can route), then you need to enable it with the &lt;code&gt;ip routing&lt;/code&gt; command. You will also need to create the layer-3 interfaces (SVIs) for each VLAN for which you want to route. Then assign each interface to the proper VLAN. Each host will need to have the IP address of the SVI for its VLAN configured as its gateway.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In the case of a layer-2 switch (LAN Base license), you will need to have an external router. You can trunk the VLANs to the router, where you will create subinterfaces for each VLAN, and the router can route between the VLANs. Each host will need to have the IP address of the router VLAN interface for its VLAN configured as its gateway.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-07-06T02:23:30.790" LastActivityDate="2017-07-06T02:23:30.790" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42376" PostTypeId="2" ParentId="32123" CreationDate="2017-07-06T07:04:13.863" Score="1" Body="&lt;p&gt;Cisco 3850 Series Switch is a 10-Gbps network switch, which means you need to use 10G SFP+ optical module or under 10G optical module, such as 1G SFP. And make sure the optical modules is correctly connected with the corresponding port on the switch. Hope this would help. &lt;/p&gt;&#xA;" OwnerUserId="37975" LastActivityDate="2017-07-06T07:04:13.863" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42377" PostTypeId="1" AcceptedAnswerId="42378" CreationDate="2017-07-06T07:13:14.563" Score="2" ViewCount="7613" Body="&lt;p&gt;I have modeled the following network on packettracer. The fiber-optic connections between &lt;code&gt;Router4&lt;/code&gt; and &lt;code&gt;Router8&lt;/code&gt; is down and doesn't get up. Whatever I do, the connection remains off. The source file of the model is &lt;a href=&quot;https://ufile.io/mmc34&quot; rel=&quot;nofollow noreferrer&quot; title=&quot;Model Source File&quot;&gt;uploaded here&lt;/a&gt;. I wonder if anybody knows why the connection is off.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/QtqWT.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/QtqWT.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;hr&gt;&#xA;&#xA;&lt;p&gt;I add running configuration of routers here. Running configuration of Router4:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show running-config &#xA;Building configuration...&#xA;&#xA;Current configuration : 1009 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip dhcp excluded-address 192.168.16.1&#xA;!&#xA;ip dhcp pool POOL&#xA; network 192.168.16.0 255.255.255.0&#xA; default-router 192.168.16.1&#xA; dns-server 172.16.100.2&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.16.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial2/0&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Serial3/0&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface FastEthernet4/0&#xA; ip address 192.168.0.2 255.255.255.0&#xA;!&#xA;interface FastEthernet5/0&#xA; ip address 10.0.4.1 255.255.255.0&#xA;!&#xA;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; network 192.168.0.0&#xA; network 192.168.16.0&#xA; no auto-summary&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Running configuration of Router 8:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router#show running-config &#xA;Building configuration...&#xA;&#xA;Current configuration : 1057 bytes&#xA;!&#xA;version 12.2&#xA;no service timestamps log datetime msec&#xA;no service timestamps debug datetime msec&#xA;no service password-encryption&#xA;!&#xA;hostname Router&#xA;!&#xA;!&#xA;!&#xA;!&#xA;ip dhcp excluded-address 192.168.137.1&#xA;!&#xA;ip dhcp pool POOL1&#xA; network 192.168.137.0 255.255.255.0&#xA; default-router 192.168.137.1&#xA; dns-server 172.16.100.2&#xA;!&#xA;!&#xA;!&#xA;ip cef&#xA;no ipv6 cef&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;interface FastEthernet0/0&#xA; ip address 192.168.137.1 255.255.255.0&#xA; duplex auto&#xA; speed auto&#xA;!&#xA;interface FastEthernet1/0&#xA; no ip address&#xA; duplex auto&#xA; speed auto&#xA; shutdown&#xA;!&#xA;interface Serial2/0&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface Serial3/0&#xA; no ip address&#xA; clock rate 2000000&#xA; shutdown&#xA;!&#xA;interface FastEthernet4/0&#xA; ip address 10.0.1.2 255.255.255.0&#xA;!&#xA;interface FastEthernet5/0&#xA; ip address 10.0.2.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet8/0&#xA; ip address 10.0.4.2 255.255.255.0&#xA;!&#xA;router rip&#xA; version 2&#xA; network 10.0.0.0&#xA; network 192.168.137.0&#xA; no auto-summary&#xA;!&#xA;ip classless&#xA;!&#xA;ip flow-export version 9&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;!&#xA;line con 0&#xA;!&#xA;line aux 0&#xA;!&#xA;line vty 0 4&#xA; login&#xA;!&#xA;!&#xA;!&#xA;end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36279" LastEditorUserId="36279" LastEditDate="2017-07-06T08:08:48.450" LastActivityDate="2017-07-06T11:10:14.093" Title="Fiber-optic connection between two routers is always off, regardless of any configuration" Tags="|router|packet-tracer|" AnswerCount="1" CommentCount="8" ContentLicense="CC BY-SA 3.0" />
  <row Id="42378" PostTypeId="2" ParentId="42377" CreationDate="2017-07-06T08:44:42.250" Score="3" Body="&lt;p&gt;There is a mismatch in speed between Router4, Fa5/0 and Router8, Gi8/0. Router8 Gi8/0 was configured with a Gbit GBIC module, which was connected to a 100 Mbit FX GBIC module. The mismatch caused the connectivity problems. &lt;/p&gt;&#xA;" OwnerDisplayName="user36472" LastEditorDisplayName="user36472" LastEditDate="2017-07-06T11:10:14.093" LastActivityDate="2017-07-06T11:10:14.093" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42379" PostTypeId="2" ParentId="42367" CreationDate="2017-07-06T12:54:36.350" Score="1" Body="&lt;p&gt;Show &lt;code&gt;mac-address table&lt;/code&gt; or &lt;code&gt;show mac-address-table&lt;/code&gt; will give you the interface (the given name, not the name you assign it) and MAC Addresses. Some switches/ios versions have a slight variation of the command. That's why I showed it two different ways. It will show multiple MAC addresses on the uplink port that connects to other switches.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT-adding content**&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The column title in the command is a destination address. It identifies the mac address that is on that port. The MAC table or CAM table only records source addresses. I'm not sure why it's labeled Destination Address. I know you don't want to know about the ARP command but this command and the ARP command together you can find devices on your switches. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Here is a quote from &lt;a href=&quot;https://www.packet6.com/cam-table-fundamental-switch-operations/&quot; rel=&quot;nofollow noreferrer&quot;&gt;www.packet6.com&lt;/a&gt;...&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&quot;The CAM table, or content addressable memory table, is present in all Cisco Catalysts for layer 2 switching. It is used to record a stations mac address and it’s corresponding switch port location.&quot;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Example: Port 17 has a device plugged in with this mac address. If you were looking for a device you could ping it, look at the arp table to get the mac then use the mac command to find the port. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Destination Address  Address Type  VLAN  Destination Port&#xA;-------------------  ------------  ----  --------------------&#xA;0000.856b.a529       Dynamic          1  FastEthernet0/17&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="30235" LastEditorUserId="30235" LastEditDate="2017-07-07T12:15:45.890" LastActivityDate="2017-07-07T12:15:45.890" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42380" PostTypeId="2" ParentId="32123" CreationDate="2017-07-06T13:14:18.837" Score="0" Body="&lt;p&gt;Verify distance limitations of the GBICs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Make sure the speed commands (if any) match at both ends.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Verify it's a compatible GBIC for Cisco. (There are unofficial commands to use non-Cisco GBICs but I'll let you research that and use at your own risk)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Verify you have fiber transmit and receive flipped on one end. If fiber A is on the left make sure fiber B is on the left at the other end. If you're not sure just try flipping one end. It'll light up if that's the issue.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Try the &lt;code&gt;switchport trunk nonegotiate&lt;/code&gt; command on the interface. I've had to do this with 3750's and 3850's in the past. &lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2017-07-06T13:14:18.837" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42381" PostTypeId="2" ParentId="42374" CreationDate="2017-07-06T13:33:42.767" Score="1" Body="&lt;p&gt;Backup your current config and use the following commands after your own research and your own risk. I typed all this on the fly so I may have missed something. Please backup your config before testing this.&#xA;After setting these commands you need to add the gateway address to your devices. The VLAN interfaces we create below will be the gateways for those networks. If you already use a gateway for your current network do not add the interface vlan command for that vlan. Add another route like I did at the bottom. I'll put an example. Also, just a note, vlan 1 isn't suggested to use as a security measure. Most sites do, but I wanted to make the note. &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;enable&#xA;config t&#xA;ip routing&#xA;interface vlan 1 (use your vlan numbers)&#xA;ip address 192.168.87.1 255.255.255.0 (use the IP address you want to be your gateway)&#xA;exit&#xA;interface vlan 2 (use your vlan numbers)&#xA;ip address 192.168.100.1 255.255.255.0 (use the IP address you want to be your gateway)&#xA;exit&#xA;int g0/1 (use your interface number)&#xA;switchport mode access&#xA;switchport access vlan 1 (use your vlan)&#xA;exit&#xA;int g0/2 (use your interface number of your vlan 2 devices)&#xA;switchport mode access&#xA;switchport access vlan 2 (use your vlan)&#xA;exit&#xA;(if you have an uplink to another switch)&#xA;int g0/24 (use your uplink interface number)&#xA;switchport mode trunk (do this on both switches)&#xA;exit&#xA;ip route 0.0.0.0 192.168.#.# (ip of your next hop toward the internet. If this is your current vlan 1 gateway for 192.168.87.0 network do not give the interface vlan 1 the same IP address as your next hop. Give it an IP address different than your next hop like 192.168.87.2 or no ip address at all if you have a management IP address already)&#xA;exit&#xA;exit&#xA;copy run start (this saves the config so at a reboot you don't loose it)&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;Then backup your switch somewhere. &lt;/p&gt;&#xA;" OwnerUserId="30235" LastActivityDate="2017-07-06T13:33:42.767" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42383" PostTypeId="2" ParentId="42374" CreationDate="2017-07-06T14:39:34.470" Score="0" Body="&lt;p&gt;Both of those answers were helpful and interesting to see the viewpoints. They helped me understand more about networking...here is what I ultimately did: &lt;br&gt; I assigned g0/38 an IP address of 192.168.100.105 and I created VLAN 50. I assigned g0/38 to access VLAN 50 and I was able to ping both the hosts that were connected to that interface.&lt;br&gt; So now, when I need to ping those hosts, I just wrote a script that gets into the switch and pings it for me. Not ideal, but best case considering IP routing can't be enabled and I don't have a router that can be connected to that network.  &lt;/p&gt;&#xA;" OwnerUserId="32481" LastActivityDate="2017-07-06T14:39:34.470" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42386" PostTypeId="1" AcceptedAnswerId="42388" CreationDate="2017-07-06T15:59:32.810" Score="1" ViewCount="734" Body="&lt;p&gt;I'm having troubles understanding how untagged frames are managed by switches. Supposing a network topology as the following:&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/gM5QH.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/gM5QH.jpg&quot; alt=&quot;network topology&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;With the following router configuration:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/5PO7K.jpg&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/5PO7K.jpg&quot; alt=&quot;router configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How are untagged frames with destination H1/H2 managed by switches? Such frames may be a package coming from internet to R1 with H1 as destination, or even a package with source H2 and destination H1, which gets its tag removed when passing though R2's Fe1 interface.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;These frames reach SW1 untagged, since both R1's Fe0 and SW1's Fe2 are trunk ports: do they get forwarded to H1 (which is on VLAN1)?&lt;/p&gt;&#xA;" OwnerUserId="38041" LastActivityDate="2017-07-06T16:04:19.633" Title="Forwarding untagged frames to hosts" Tags="|switch|vlan|" AnswerCount="1" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42387" PostTypeId="1" AcceptedAnswerId="42390" CreationDate="2017-07-06T16:01:10.937" Score="1" ViewCount="1379" Body="&lt;p&gt;What are the trade-offs/major differences of Ethernet Flow Control vs Quality of Service? How to know when to choose one over the other?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;They seem to both be a solution for congestion.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The obvious downfall of flow control seems to be, that it can congest the switch itself. There are no priorities assigned to traffic, therefore the switch buffers can fill in a hurry.&lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2017-08-05T17:20:49.200" Title="Ethernet Flow Control vs Quality of Service" Tags="|ethernet|qos|congestion|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42388" PostTypeId="2" ParentId="42386" CreationDate="2017-07-06T16:04:19.633" Score="0" Body="&lt;p&gt;Frames that are not tagged on a trunk are in the native VLAN, which is usually VLAN 1. The tags on a trunk are to allow a device on the other end to differentiate which frames belong to which VLAN. That means that one VLAN can send untagged frames. That VLAN is called the native VLAN, and the receiving switch knows that any untagged frames received on an interface blong to the native VLAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Also, understand that the hosts send and receive untagged frames (most hosts do not understand VLAN tags and will drop tagged frames). The access interfaces on a switch do not tag the frames. Tags are only used on trunks where there may be multiple VLANs, but that is not the case for access interfaces.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The router will create the frames for the correct VLAN based on the destination address. If a packet coming into the router is destined for an untagged VLAN on the router interface, then the router will not place a tag on the frame containing that packet, but if the packet is destined for a VLAN that is tagged on the router interface, then the router will place a tag on the frame containing that packet.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-07-06T16:04:19.633" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42389" PostTypeId="2" ParentId="42387" CreationDate="2017-07-06T16:13:10.207" Score="1" Body="&lt;p&gt;Don't confuse layer-2 and layer-3. Ethernet flow control is a poorly-supported, layer-2 control for layer-2 frames, and it tries to prevent the tiny switch buffers from filling. QoS is a layer-3 control that can be used to police, queue, shape, etc. layer-3 packets.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is nothing to prevent you from using both at the same time.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-07-06T16:13:10.207" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42390" PostTypeId="2" ParentId="42387" CreationDate="2017-07-06T16:37:20.820" Score="2" Body="&lt;p&gt;QoS will apply policies to different traffic classes as it passes through the device, such as giving priority to certain traffic.  But it does not signal to the transmitter to pause.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Flow control operates at the interface level and will send a Pause to an upstream transmitter telling them to pause transmission (assuming they also are set up to honor flow control messages).  This can affect all traffic passing over the interface.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;There is an enhancement called priority flow control which applies flow control based on CoS class.  The devices negotiate this using LLDP DCBX and exchange their QoS configurations, if they match, then they can successfully use priority flow control between them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;http://www.cisco.com/en/US/prod/collateral/switches/ps9441/ps9670/white_paper_c11-542809_ns783_Networking_Solutions_White_Paper.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;Overview of PFC&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="31609" LastActivityDate="2017-07-06T16:37:20.820" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42391" PostTypeId="1" AcceptedAnswerId="42395" CreationDate="2017-07-06T17:24:45.620" Score="1" ViewCount="7348" Body="&lt;p&gt;I am trying to understand the purpose of a VLAN aware NIC on a server or work station?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I was under the impression a switch does most of the work when it comes to VLANs.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is this another way of filtering traffic? Or does the NIC receive the traffic regardless?&lt;/p&gt;&#xA;" OwnerUserId="21360" LastActivityDate="2017-08-05T23:20:49.440" Title="How does a NIC that is aware of VLAN tagging work?" Tags="|vlan|ethernet|" AnswerCount="2" CommentCount="4" ContentLicense="CC BY-SA 3.0" />
  <row Id="42392" PostTypeId="2" ParentId="42391" CreationDate="2017-07-06T17:31:30.317" Score="1" Body="&lt;p&gt;Some servers (and some workstations, but it is less common) are set up to be able to trunk with a switch. That means that the servers can be assigned addresses in multiple VLANs on the same link, and the servers can serve directly on the different networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;In most cases, even with a VLAN capable NIC, servers and workstations are not configured for VLANs, and they will drop tagged frames, but it may be useful for a server to have connections to different VLANs in order to directly handle things like DHCP, NTP, etc. for the different VLANs without needing to be routed.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-07-06T17:31:30.317" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42394" PostTypeId="2" ParentId="33841" CreationDate="2017-07-06T20:53:10.000" Score="0" Body="&lt;p&gt;I'm not sure why you would want to do this, but you could try adding a static entry in the mac-address table:&#xA;mac-address-table [permanent] mac_address {slot/port | linkagg link_agg} vid [bridging | filtering]&lt;/p&gt;&#xA;" OwnerUserId="37709" LastActivityDate="2017-07-06T20:53:10.000" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42395" PostTypeId="2" ParentId="42391" CreationDate="2017-07-06T22:33:44.597" Score="1" Body="&lt;p&gt;VLANs are fundamentally a technology to build multiple virtual Ethernet networks on one physical Ethernet network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Sometimes you want to connect multiple VLANs to a host. Maybe the host is a router. Maybe it's a DHCP server. Maybe you want to have multiple logically separate networks that aren't routed to each other but a handful of hosts need a presence on more than one network.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Whatever the reason there are three approaches to doing this.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;One is to just use a separate NIC and cable for each VLAN. This approach avoids the need for the host to have any concept of VLAN support but it means extra cables, extra switch ports and extra NICs. In some cases it may not even be practical.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A second approach is for the OS to implement a generic VLAN layer which handles the VLAN encapsulation and presents virtual interfaces. This can be done with virtually any NIC. Linux has had support for this for ages but afaict windows only added support recently.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;A third approach is for the NIC vendor to implement VLAN support and creation of multiple virtual interfaces in the NIC driver presenting multiple virtual NICs to the OS. Many NIC vendors did this on Windows before MS added native support.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;For some reason some NIC vendors seem to implement VLAN tagging in their drivers but not the creation of multiple virtual interfaces. This makes the VLAN tagging feature mostly pointless (outside of a few network troubleshooting scenarios).&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-07-06T22:33:44.597" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42396" PostTypeId="1" AcceptedAnswerId="42458" CreationDate="2017-07-06T22:53:23.513" Score="0" ViewCount="50" Body="&lt;p&gt;I just joined to a new company and they are using Netgear Switch FMS726s. I never used Netgear switches and their CLI. They have CLI and kinda similar to Cisco but I can't go back to edit my typo error. Everytime I use Delete (backspace); it won't go back but it spaces. I use Mac, but not sure it will do any differences. Any advices?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thanks&lt;/p&gt;&#xA;" OwnerUserId="38028" LastActivityDate="2017-07-17T14:18:30.633" Title="How to user Netgear switch FMS726s" Tags="|cli|" AnswerCount="2" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42400" PostTypeId="2" ParentId="42215" CreationDate="2017-07-07T05:00:26.403" Score="2" Body="&lt;p&gt;While passing downlink traffic (from the Access Point (AP)) to client-nodes, the AP schedules the packets from the packet-queues in the appropriate way and also does not face any contention on the medium.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;On the uplink however (from the client-nodes to the AP), the client-nodes contend for the medium to send the packet. This creates a delay. This delay in turn reacts with the TCP timeout mechanism that triggers the TCP windowing mechanism to reduce the TCP window. This results in lower throughput.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you really want to compare uplink and downlink throughputs, run the same test using UDP.&lt;/p&gt;&#xA;" OwnerUserId="14135" LastActivityDate="2017-07-07T05:00:26.403" CommentCount="2" ContentLicense="CC BY-SA 3.0" />
  <row Id="42401" PostTypeId="1" AcceptedAnswerId="42406" CreationDate="2017-07-07T06:02:55.577" Score="5" ViewCount="1724" Body="&lt;p&gt;I understand that the reason we pay the ISPs is to rent the equipment used to connect with the rest of the world us such as the optic fibers, the cellular towers, the satellites. However, if I want to create my own ISP for myself, meaning that I buy the necessary equipment: &lt;/p&gt;&#xA;&#xA;&lt;ol&gt;&#xA;&lt;li&gt;&lt;strong&gt;do I need to talk to all the servers in the world to get their server as part of my network&lt;/strong&gt; (Facebook, Google, Hostgator, ...)&lt;/li&gt;&#xA;&lt;li&gt;&lt;strong&gt;Or there is already a central point where everyone already agreed to connect to so that new ISP can just plug their equipment into&#xA;that central point and get the World Wide Web for free?&lt;/strong&gt;&lt;/li&gt;&#xA;&lt;/ol&gt;&#xA;" OwnerUserId="38053" LastActivityDate="2023-02-17T13:05:55.913" Title="Why is the internet *not free?" Tags="|internet|isp|route-server|" AnswerCount="3" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42402" PostTypeId="2" ParentId="42401" CreationDate="2017-07-07T06:29:03.060" Score="1" Body="&lt;p&gt;You can peer with other ISPs to become an active part of the Internet - that starts as soon as you have at least two peerings and forward data between them. This will usually cost you money when you're small and earn money when you're large.&lt;/p&gt;&#xA;&lt;p&gt;Another way is to connect to a larger Internet exchange (IX) where you simultaneously peer with a large number of other ISPs.&lt;/p&gt;&#xA;&lt;p&gt;The Internet has no &amp;quot;central point&amp;quot;, it consists of small and large, interconnected networks.&lt;/p&gt;&#xA;&lt;p&gt;Nitpicking: The &lt;em&gt;internet&lt;/em&gt; is free - simply build a network and let anyone connect to it at will. (An &lt;strong&gt;i&lt;/strong&gt;nternet is any network connecting other networks.)&lt;/p&gt;&#xA;&lt;p&gt;The &lt;em&gt;Internet&lt;/em&gt; isn't free, or rather access to it isn't free. (The &lt;strong&gt;I&lt;/strong&gt;nternet is the global network that you likely thought about when asking.) Building and running the Internet costs money that the involved parties would like compensated.&lt;/p&gt;&#xA;&lt;p&gt;If you run your own internet you'll find that it costs you some (power, hardware, labor), so from some point on you'd likely begin charging your users...&lt;/p&gt;&#xA;" OwnerUserId="36720" LastEditorUserId="36720" LastEditDate="2023-02-17T13:05:55.913" LastActivityDate="2023-02-17T13:05:55.913" CommentCount="0" ContentLicense="CC BY-SA 4.0" />
  <row Id="42406" PostTypeId="2" ParentId="42401" CreationDate="2017-07-07T13:32:56.703" Score="8" Body="&lt;p&gt;Most ISPs have to buy service from other ISPs to be able to reach every part of the internet. That is called &quot;transit&quot;. If you start a small ISP you usually buy transit from one or more bigger ISPs. They will have connectivity to the whole internet, and they will sell that connectivity to you.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can also set up direct connections to other networks. This is called &quot;peering&quot;. Usually those are the networks you exchange a lot of traffic with. Paying a transit provider for the packets you exchange can be a waste of money if you can easily connect directly to the other network and cut out the middle man. Sometimes other networks want you to pay them to set up a direct connection, but in many cases the peering if settlement-free.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The problem with setting up direct connections is the number of network interfaces you need, pulling cables between routers etc. Because of that there are &quot;Internet Exchanges&quot; (IX). An IX is basically a large switch (large IXes are more complex, but from the outside they function as a large switch) that many internet providers and enterprises connect to. That way they can all talk to each other, if they want to. One connection to an IX can let you set up direct peering with hundreds of networks.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;As you can see there is a reason you pay your ISP. They invest in routers, connections, and very likely pay larger ISPs to transport part of their traffic. You could set all of that up for yourself, but be prepared to invest tens of thousands of dollars/euros/etc for equipment and connections. And then you'll probably pay more than you pay your current ISP for the transit costs, as you won't be able to negotiate lower prices for buying in bulk.&lt;/p&gt;&#xA;" OwnerUserId="632" LastActivityDate="2017-07-07T13:32:56.703" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42408" PostTypeId="1" AcceptedAnswerId="42412" CreationDate="2017-07-07T14:57:24.540" Score="0" ViewCount="2693" Body="&lt;p&gt;I'd like to check current traffic utilization (how much Mb/s is used per interface) on port on cisco switch and Juniper SRX device - any ideas where I can look up for this informations?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Thank you for all answers.&#xA;mfx&lt;/p&gt;&#xA;" OwnerUserId="36683" LastActivityDate="2017-07-08T07:48:18.990" Title="Traffic utilization on Cisco and Juniper devices" Tags="|cisco|juniper|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42409" PostTypeId="2" ParentId="42396" CreationDate="2017-07-07T15:18:53.743" Score="0" Body="&lt;p&gt;If it's a bash or Unix or Linux environment.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;type bash or just type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;stty erase &amp;lt;press backspace key&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17195" LastEditorUserId="509" LastEditDate="2017-07-17T14:18:30.633" LastActivityDate="2017-07-17T14:18:30.633" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42411" PostTypeId="2" ParentId="42374" CreationDate="2017-07-07T16:28:45.693" Score="0" Body="&lt;p&gt;! THESE ARE COMMENTS AND WON'T BE ADDED TO THE SWITCH CONFIG&lt;/p&gt;&#xA;&#xA;&lt;p&gt;! MAKE SURE THE SWITCH PORTS CONNECTING YOUR HOSTS ON THE SAME SUBNET ARE ON THE SAME VLAN&lt;/p&gt;&#xA;&#xA;&lt;p&gt;! VLAN 1 IS CONFIGURED BY DEFAULT AND IS YOUR VLAN FOR SUBNET 192.168.87.0&lt;/p&gt;&#xA;&#xA;&lt;p&gt;! YOU NEED TO MAKE SURE THE HOSTS ON THAT SUBNET ARE ON VLAN 1&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show vlan brief&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;! OR&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show vlan&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;CHECK TO MAKE SURE YOUR HOSTS ON THE 192.168.87.0 IS MEMBER OF VLAN 1&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;conf t&#xA;vlan 2&#xA; description VLAN FOR 192.168.100.0 SUBNET&#xA;vlan 1&#xA; description VLAN FOR 192.168.87.0 SUBNET&#xA;interface vlan 1&#xA; description GATEWAY IP OF YOUR 192.168.87.0 HOSTS&#xA;ip address 192.168.87.1 255.255.255.0&#xA; no shutdown&#xA;interface vlan 2&#xA; description GATEWAY IP OF YOUR 192.168.100.0 HOSTS&#xA; ip address 192.168.100.1 255.255.255.0&#xA; no shutdown&#xA;ip routing&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;CONFIGS BELOW ARE FOR YOUR 192.168.87.0 HOSTS a/b-e are switchport numbers so substitute them with real port numbers!&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface a/b&#xA; switchport access vlan 1&#xA; no shutdown&#xA;interface a/c&#xA; switchport access vlan 1&#xA; no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;h1&gt;CONFIGS BELOW ARE FOR YOUR 192.168.100.0 HOSTS&lt;/h1&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;interface a/d&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; no shutdown&#xA;interface a/e&#xA; switchport access vlan 2&#xA; switchport mode access&#xA; no shutdown&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="17195" LastActivityDate="2017-07-07T16:28:45.693" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42412" PostTypeId="2" ParentId="42408" CreationDate="2017-07-07T16:40:08.363" Score="2" Body="&lt;p&gt;For Cisco devices, you can type&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;show interface x/y&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;You'll get a response like this &lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Router&amp;gt;show interface tengigabit 0/0/0&#xA;TenGigabitEthernet0/0/0 is up, line protocol is up &#xA;  Hardware is SPA-1X10GE-L-V2, address is 0000.0000.0000 (bia 0000.0000.0000)&#xA;  Description: Sample Circuit&#xA;  Internet address is 1.2.3.4/31&#xA;  MTU 9178 bytes, BW 10000000 Kbit/sec, DLY 10 usec, &#xA;     reliability 255/255, txload 9/255, rxload 11/255&#xA;  Encapsulation ARPA, loopback not set&#xA;  Keepalive not supported &#xA;  Full Duplex, 10000Mbps, link type is force-up, media type is 10GBase-LR&#xA;  output flow-control is on, input flow-control is on&#xA;  ARP type: ARPA, ARP Timeout 04:00:00&#xA;  Last input 00:00:29, output 00:00:04, output hang never&#xA;  Last clearing of &quot;show interface&quot; counters never&#xA;  Input queue: 0/375/0/0 (size/max/drops/flushes); Total output drops: 0&#xA;  Queueing strategy: fifo&#xA;  Output queue: 0/40 (size/max)&#xA;  5 minute input rate 456145000 bits/sec, 85866 packets/sec&#xA;  5 minute output rate 356961000 bits/sec, 79293 packets/sec&#xA;     405059988918 packets input, 267595313186384 bytes, 0 no buffer&#xA;     Received 2 broadcasts (0 IP multicasts)&#xA;     0 runts, 0 giants, 0 throttles &#xA;     832 input errors, 677 CRC, 155 frame, 0 overrun, 0 ignored&#xA;     0 watchdog, 3635928 multicast, 0 pause input&#xA;     381317901828 packets output, 215556748770785 bytes, 0 underruns&#xA;     0 output errors, 0 collisions, 2 interface resets&#xA;     0 unknown protocol drops&#xA;     0 babbles, 0 late collision, 0 deferred&#xA;     0 lost carrier, 0 no carrier, 0 pause output&#xA;     0 output buffer failures, 0 output buffers swapped out&#xA;Router&amp;gt;&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;For simple utilization, txload and rxload will give you the answer (6th line down).  The values&#xA;are expressed as fractional utilization out of 255.  So 0/255 is 0 load, 128/255 is 50% load and 255/255 is 100% load.  In this case, 9/255 is a little over 3%. For actual byte counts, look at the 5 minute input and output rates.  Although it should be obvious, it bears repeating that these numbers are 5 minute averages.&lt;/p&gt;&#xA;" OwnerUserId="2142" LastEditorUserId="2142" LastEditDate="2017-07-07T16:48:22.527" LastActivityDate="2017-07-07T16:48:22.527" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42415" PostTypeId="1" AcceptedAnswerId="42416" CreationDate="2017-07-07T17:18:56.490" Score="1" ViewCount="135" Body="&lt;p&gt;I have a network split over several small offices. At one office, serving about 30 users, I'm seeing some machines getting much better network speeds than other. I have a patch panel plugging into two unmanaged switches, each of which connect to a port on a managed Cisco switch, which converts to fiber going back to my main office.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;When I do a speed test on a PC plugged into port 230 on my patch panel, which plugs into Switch A, I get 90MB down. The PC on port 231, plugging into Switch B, gets inconsistent speed, ranging from 3-30MB down. Upload is similarly inconsistent. I've tried switching Port 231 into Switch A, but it gets the same results. Also, other ports from my patch panel are getting similarly split results, independent of the unmanaged switch that they plug into, some between 75-90 down, others spiking from 3 up to 30 and back. I've tried using one laptop in both the fast ports and the slow ports, and the laptop's results mirror the prior results.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I've tried doing a packet capture, but I don't really know what to look for on this problem.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Anyone have any idea of where I can look to figure out what the problem might be?&lt;/p&gt;&#xA;&#xA;&lt;p&gt;EDIT: Well, I went to trouble shoot and the problem stopped. So...the mystery remains, but the problem does not. If I wasn't short staffed, I'd spend more time looking into this, but unfortunately, I don't have the luxury. Thanks for the help, everyone!&lt;/p&gt;&#xA;" OwnerUserId="38072" LastEditorUserId="38072" LastEditDate="2017-07-07T20:53:30.667" LastActivityDate="2017-07-13T18:34:13.063" Title="Inconsistent Network Speeds by Port" Tags="|cisco|network|" AnswerCount="2" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42416" PostTypeId="2" ParentId="42415" CreationDate="2017-07-07T17:29:34.937" Score="2" Body="&lt;p&gt;This sounds like a cabling problem. The cabling seems to work, but it is just bad enough to cause a lot of retransmissions. You should look closely at the test results that your cable installer provided. You should be able to get the installer to fix any problems.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastActivityDate="2017-07-07T17:29:34.937" CommentCount="5" ContentLicense="CC BY-SA 3.0" />
  <row Id="42417" PostTypeId="2" ParentId="38683" CreationDate="2017-07-07T19:52:33.190" Score="1" Body="&lt;p&gt;RMON can show the number of frames by size class, e.g. for HP Provision switches &lt;code&gt;show rmon statistics &amp;lt;portno&amp;gt;&lt;/code&gt;:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;Status and Counters - Port Counters for port 24&#xA;&#xA;  Drop events     : 0                 Jabbers             : 0&#xA;  Octets          : 227,397,427       Collisions          : 0&#xA;  Packets         : 3,714,994,853     64 oct pkts         : 210,643,368&#xA;  Broadcast pkts  : 24,326,013        65-127 oct pkts     : 1,722,528,356&#xA;&#xA;  Multicast pkts  : 83,481,276        128-255 oct pkts    : 719,535,071&#xA;  CRC errors      : 0                 256-511 oct pkts    : 243,979,239&#xA;  Runts           : 0                 512-1023 oct pkts   : 172,346,388&#xA;  Giants          : 0                 1024-1518 oct pkts  : 2,666,523,301&#xA;  Fragments       : 0&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-07-07T19:52:33.190" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42420" PostTypeId="1" AcceptedAnswerId="43059" CreationDate="2017-07-07T22:33:32.450" Score="1" ViewCount="982" Body="&lt;p&gt;I have a Cisco ASA5506x on which I want&lt;/p&gt;&#xA;&#xA;&lt;ul&gt;&#xA;&lt;li&gt;VPN hairpin so that all VPN traffic goes through the ASA&lt;/li&gt;&#xA;&lt;li&gt;A port forwarding for RDP (3389) to my RDP server&lt;/li&gt;&#xA;&lt;/ul&gt;&#xA;&#xA;&lt;p&gt;I can get them to work separately depending on which rule I have first (I use a network object for the RDP server and a NAT rule for the VPN network (192.168.10.0/24). If i put the &quot;VPN rule&quot; first, then VPN users can access internet, but the port forwarding for RDP doesn't work. If i put the RDP rule first, the port forwarding works but VPN users can't access internet. Am I missing something?&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;: Saved&#xA;&#xA;:&#xA;: Serial Number: ...&#xA;: Hardware:   ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)&#xA;:&#xA;ASA Version 9.6(1)&#xA;!&#xA;hostname COMAPNY-ASA5506&#xA;enable password abcdef encrypted&#xA;names&#xA;ip local pool vpn-company-pool 192.168.10.1-192.168.10.50 mask 255.255.255.0&#xA;&#xA;!&#xA;interface GigabitEthernet1/1&#xA;nameif outside&#xA;security-level 0&#xA;ip address dhcp setroute&#xA;!&#xA;interface GigabitEthernet1/2&#xA;nameif inside&#xA;security-level 100&#xA;ip address 192.168.1.1 255.255.255.0&#xA;!&#xA;interface GigabitEthernet1/3&#xA;shutdown&#xA;no nameif&#xA;no security-level&#xA;no ip address&#xA;!&#xA;interface GigabitEthernet1/4&#xA;shutdown&#xA;no nameif&#xA;no security-level&#xA;no ip address&#xA;!&#xA;interface GigabitEthernet1/5&#xA;shutdown&#xA;no nameif&#xA;no security-level&#xA;no ip address&#xA;!&#xA;interface GigabitEthernet1/6&#xA;shutdown&#xA;no nameif&#xA;no security-level&#xA;no ip address&#xA;!&#xA;interface GigabitEthernet1/7&#xA;shutdown&#xA;no nameif&#xA;no security-level&#xA;no ip address&#xA;!&#xA;interface GigabitEthernet1/8&#xA;shutdown&#xA;no nameif&#xA;no security-level&#xA;no ip address&#xA;!&#xA;interface Management1/1&#xA;management-only&#xA;no nameif&#xA;no security-level&#xA;no ip address&#xA;!&#xA;ftp mode passive&#xA;clock timezone CEST 1&#xA;clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00&#xA;same-security-traffic permit inter-interface&#xA;same-security-traffic permit intra-interface&#xA;object network obj_any&#xA;subnet 0.0.0.0 0.0.0.0&#xA;object network server&#xA;host 192.168.1.2&#xA;object service RDP&#xA;service tcp destination eq 3389&#xA;description Remote desktop&#xA;object network guest-network&#xA;subnet 192.168.201.0 255.255.255.0&#xA;object network switch-vlan-11&#xA;host 192.168.1.253&#xA;object network rdp-server&#xA;host 192.168.1.2&#xA;object network company-internal-network&#xA;subnet 192.168.1.0 255.255.255.0&#xA;object network company-vpn-network&#xA;subnet 192.168.10.0 255.255.255.0&#xA;access-list outside_access_in_1 extended permit object RDP any object rdp-server&#xA;access-list outside_access_in_1 extended permit ip object company-vpn-network any&#xA;access-list vpn-tunnel standard permit 192.168.1.0 255.255.255.0&#xA;pager lines 24&#xA;logging enable&#xA;logging asdm informational&#xA;mtu outside 1500&#xA;mtu inside 1500&#xA;icmp unreachable rate-limit 1 burst-size 1&#xA;no asdm history enable&#xA;arp timeout 14400&#xA;no arp permit-nonconnected&#xA;nat (inside,outside) source static company-internal-network company-internal-network destination static company-vpn-network company-vpn-network no-proxy-arp route-lookup&#xA;nat (outside,inside) source static company-vpn-network company-vpn-network destination static company-internal-network company-internal-network no-proxy-arp route-lookup&#xA;!&#xA;object network obj_any&#xA;nat (any,outside) dynamic interface&#xA;object network rdp-server&#xA;nat (inside,outside) static interface service tcp 3389 3389&#xA;!&#xA;nat (outside,outside) after-auto source dynamic company-vpn-network interface&#xA;nat (inside,outside) after-auto source dynamic any interface&#xA;access-group outside_access_in_1 in interface outside&#xA;route inside 192.168.201.0 255.255.255.0 192.168.1.253 1&#xA;timeout xlate 3:00:00&#xA;timeout pat-xlate 0:00:30&#xA;timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02&#xA;timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00&#xA;timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00&#xA;timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute&#xA;timeout tcp-proxy-reassembly 0:01:00&#xA;timeout floating-conn 0:00:00&#xA;aaa-server ADServer protocol radius&#xA;aaa-server ADServer (inside) host 192.168.1.2&#xA;key *****&#xA;user-identity default-domain LOCAL&#xA;aaa authentication ssh console LOCAL&#xA;aaa authentication telnet console LOCAL&#xA;http server enable&#xA;http 192.168.1.0 255.255.255.0 inside&#xA;no snmp-server location&#xA;no snmp-server contact&#xA;service sw-reset-button&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac&#xA;crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport&#xA;crypto ipsec security-association pmtu-aging infinite&#xA;crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS&#xA;crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP&#xA;crypto map outside_map interface outside&#xA;crypto ca trustpoint ASDM_TrustPoint0&#xA;enrollment self&#xA;subject-name CN=COMPANY-ASA5506&#xA;crl configure&#xA;crypto ca trustpool policy&#xA;crypto ca certificate chain ASDM_TrustPoint0&#xA;certificate af685359&#xA;    308202e8 ... 738993c5&#xA;quit&#xA;crypto ikev2 policy 1&#xA;encryption aes-256&#xA;integrity sha&#xA;group 5 2&#xA;prf sha&#xA;lifetime seconds 86400&#xA;[...]&#xA;crypto ikev1 policy 150&#xA;authentication pre-share&#xA;encryption des&#xA;hash sha&#xA;group 2&#xA;lifetime 86400&#xA;telnet 192.168.0.0 255.255.0.0 inside&#xA;telnet timeout 5&#xA;ssh stricthostkeycheck&#xA;ssh 192.168.0.0 255.255.0.0 inside&#xA;ssh timeout 5&#xA;ssh key-exchange group dh-group1-sha1&#xA;console timeout 0&#xA;no vpn-addr-assign aaa&#xA;no vpn-addr-assign dhcp&#xA;&#xA;dhcp-client client-id interface outside&#xA;dhcpd auto_config outside&#xA;!&#xA;webvpn&#xA;cache&#xA;disable&#xA;error-recovery disable&#xA;group-policy DefaultRAGroup internal&#xA;group-policy DefaultRAGroup attributes&#xA;dns-server value 192.168.1.2&#xA;vpn-tunnel-protocol l2tp-ipsec&#xA;default-domain value COMPANY.LOCAL&#xA;group-policy DfltGrpPolicy attributes&#xA;vpn-tunnel-protocol ssl-client&#xA;dynamic-access-policy-record DfltAccessPolicy&#xA;username jonas password A35MFXE3yjisaBrJ encrypted privilege 15&#xA;username jonas attributes&#xA;vpn-group-policy DefaultRAGroup&#xA;tunnel-group DefaultRAGroup general-attributes&#xA;address-pool vpn-company-pool&#xA;authentication-server-group Company&#xA;default-group-policy DefaultRAGroup&#xA;dhcp-server 192.168.1.2&#xA;tunnel-group DefaultRAGroup ipsec-attributes&#xA;ikev1 pre-shared-key *****&#xA;peer-id-validate cert&#xA;isakmp keepalive disable&#xA;tunnel-group DefaultRAGroup ppp-attributes&#xA;no authentication chap&#xA;authentication ms-chap-v2&#xA;!&#xA;class-map inspection_default&#xA;match default-inspection-traffic&#xA;!&#xA;!&#xA;policy-map type inspect dns preset_dns_map&#xA;parameters&#xA;message-length maximum client auto&#xA;message-length maximum 512&#xA;policy-map global_policy&#xA;class inspection_default&#xA;inspect dns preset_dns_map&#xA;inspect ftp&#xA;inspect h323 h225&#xA;inspect h323 ras&#xA;inspect rsh&#xA;inspect rtsp&#xA;inspect esmtp&#xA;inspect sqlnet&#xA;inspect skinny&#xA;inspect sunrpc&#xA;inspect xdmcp&#xA;inspect sip&#xA;inspect netbios&#xA;inspect tftp&#xA;inspect ip-options&#xA;inspect icmp&#xA;!&#xA;service-policy global_policy global&#xA;prompt hostname context&#xA;no call-home reporting anonymous&#xA;Cryptochecksum:3...a&#xA;: end&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;&lt;a href=&quot;https://i.stack.imgur.com/dmRWq.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/dmRWq.png&quot; alt=&quot;ASDM configuration&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="38078" LastEditorUserId="38078" LastEditDate="2017-07-08T08:01:07.440" LastActivityDate="2017-08-07T05:32:23.410" Title="VPN hairpin and port forwarding on ASA 5506x" Tags="|cisco-asa|nat|" AnswerCount="1" CommentCount="3" ContentLicense="CC BY-SA 3.0" />
  <row Id="42422" PostTypeId="2" ParentId="42408" CreationDate="2017-07-08T07:48:18.990" Score="2" Body="&lt;p&gt;For Juniper devices you can use the &lt;code&gt;monitor interface&lt;/code&gt; command, it shows an overview of all interface counters which is automatically updated:&lt;/p&gt;&#xA;&#xA;&lt;pre&gt;&lt;code&gt;user@host&amp;gt; monitor interface fe-0/0/0&#xA;&#xA;host1                           Seconds: 5                   Time: 04:38:40&#xA;                                                          Delay: 3/0/10&#xA;Interface: fe-0/0/0, Enabled, Link is Up&#xA;Encapsulation: Ethernet, Speed: 1000mbps&#xA;Traffic statistics:                                           Current delta&#xA;  Input bytes:                 885405423 (3248 bps)                  [2631]&#xA;  Output bytes:                137411893 (3344 bps)                 [10243]&#xA;  Input packets:                 7155064 (2 pps)                       [28]&#xA;  Output packets:                 636071 (1 pps)                       [23]&#xA;Error statistics:&#xA;  Input errors:                        0                                [0]&#xA;  Input drops:                         0                                [0]&#xA;  Input framing errors:                0                                [0]&#xA;  Policed discards:                    0                                [0]&#xA;  L3 incompletes:                      0                                [0]&#xA;  L2 channel errors:                   0                                [0]&#xA;  L2 mismatch timeouts:                0                                [0]&#xA;  Carrier transitions:                 1                                [0]&#xA;  Output errors:                       0                                [0]&#xA;  Output drops:                        0                                [0]&#xA;  Aged packets:                        0                                [0]&#xA;Active alarms : None&#xA;Active defects: None&#xA;Input MAC/Filter statistics:&#xA;  Unicast packets                  73083                               [16]&#xA;  Broadcast packets              3629058                                [5]&#xA;  Multicast packets              3511364                                [3]&#xA;  Oversized frames                     0                                [0]&#xA;  Packet reject count                  0                                [0]&#xA;  DA rejects                           0                                [0]&#xA;  SA rejects                           0                                [0]&#xA;Output MAC/Filter Statistics:&#xA;  Unicast packets                 629555                               [28]&#xA;  Broadcast packets                 6494  Multicast packet              [0]&#xA;&lt;/code&gt;&lt;/pre&gt;&#xA;&#xA;&lt;p&gt;More details can be found in the &lt;a href=&quot;https://www.juniper.net/documentation/en_US/junos/topics/task/operational/security-real-time-interface-information-displaying.html&quot; rel=&quot;nofollow noreferrer&quot;&gt;JunOS documentation&lt;/a&gt;.&lt;/p&gt;&#xA;" OwnerUserId="509" LastActivityDate="2017-07-08T07:48:18.990" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42424" PostTypeId="2" ParentId="11312" CreationDate="2017-07-08T18:29:01.560" Score="0" Body="&lt;p&gt;The solution described above does not work, because www.google.com does not have fixe IP address.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Solution is this:&#xA;&lt;a href=&quot;https://wiki.mikrotik.com/wiki/Use_host_names_in_firewall_rules&quot; rel=&quot;nofollow noreferrer&quot;&gt;https://wiki.mikrotik.com/wiki/Use_host_names_in_firewall_rules&lt;/a&gt;&lt;/p&gt;&#xA;" OwnerUserId="38088" LastActivityDate="2017-07-08T18:29:01.560" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42425" PostTypeId="2" ParentId="41689" CreationDate="2017-07-08T22:27:38.530" Score="-1" Body="&lt;p&gt;You can't advertise prefixes longer than /24 to the internet.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;What you can do is advertise the same prefix from many locations. Incoming traffic will go to the closest location and you can then route it within your internal network to where it needs to go. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;You may also find a provider willing to do this for you as a service.&lt;/p&gt;&#xA;" OwnerUserId="20201" LastActivityDate="2017-07-08T22:27:38.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42426" PostTypeId="1" AcceptedAnswerId="42434" CreationDate="2017-07-09T02:54:37.853" Score="0" ViewCount="2737" Body="&lt;p&gt;I have three hosts connected to my ASA; two security cameras and one server running the security software.  &lt;/p&gt;&#xA;&#xA;&lt;p&gt;All ports belong to one interface, all on the same VLAN.  The cameras and server can access each other just fine, but I don't have &quot;Enable traffic between two or more hosts connected to the same interface&quot; selected.  Shouldn't that be required for this to work, or am I misunderstanding it?&lt;/p&gt;&#xA;" OwnerUserId="38091" LastActivityDate="2017-07-09T17:47:56.530" Title="ASA 5510 Enable traffic between two or more hosts connected to the same interface" Tags="|cisco-asa|" AnswerCount="1" CommentCount="1" ContentLicense="CC BY-SA 3.0" />
  <row Id="42429" PostTypeId="1" CreationDate="2017-07-09T09:55:16.067" Score="2" ViewCount="259" Body="&lt;p&gt;I am trying to give to my customers IPv6 prefix vía DHCPv6-PD. As IT is a FTTH Network, i configure the onts with DhcpV6-PD. The OLT is my relay agent to an ISC-DHCP-Server V6. The prefix is delegated but in difference as it happens when a cisco router is acting as a dhcpv6 server, the OLT is not adding a static route to the prefix so IT is not globally visible. If i add the route manually everything works as IT should. I suppose that IT has to be a command to solve this but i haven't found it...Any experience with MA5683T?&lt;/p&gt;&#xA;" OwnerUserId="2028" LastActivityDate="2018-05-28T19:31:21.070" Title="Huawei MA5683T OLT and PD IPv6" Tags="|dhcpv6|" AnswerCount="0" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42430" PostTypeId="1" AcceptedAnswerId="42433" CreationDate="2017-07-09T16:30:17.983" Score="1" ViewCount="3797" Body="&lt;p&gt;Pardon me for my ignorance. I have not tried QoS nor traffic shaping/policing before.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;I have been pondering on whether can/why would we want to shape/police ingress traffic if you have no control over the next hop device.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Let's say my FWs WAN interface is connected to an ISP router. The ISP router will just send traffic down the pipe to my FW as much as the bandwidth allows. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Even if my FW has some traffic shaping/policing rules in place, it will just cause ingress packets to get either queued or dropped, and the external sender to resend the drop packets (eventually consuming more bandwidth for a longer period?)&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Am I missing the point? Why would we want to police/shape ingress traffic?&lt;/p&gt;&#xA;" OwnerUserId="16635" LastEditorUserId="8499" LastEditDate="2020-12-19T22:18:57.920" LastActivityDate="2020-12-19T22:18:57.920" Title="Why traffic shape/police ingress traffic?" Tags="|tcp|firewall|qos|bandwidth|udp|" AnswerCount="2" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42431" PostTypeId="2" ParentId="42430" CreationDate="2017-07-09T16:56:55.123" Score="2" Body="&lt;p&gt;Why we'd want traffic shaping: imagine a SIP trunk and Internet access traffic coming in on the same WAN link - overloading the link with downloads would cause voice traffic to get dropped.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;How it's done: you can shape ingress TCP traffic by holding back the TCP ACKs, so less traffic is sent than would be possible.&lt;/p&gt;&#xA;" OwnerUserId="36720" LastActivityDate="2017-07-09T16:56:55.123" CommentCount="6" ContentLicense="CC BY-SA 3.0" />
  <row Id="42433" PostTypeId="2" ParentId="42430" CreationDate="2017-07-09T17:40:12.737" Score="2" Body="&lt;p&gt;You queue or shape on traffic leaving a router, and it is really done on traffic outbound from your network. You can police (drop) traffic either inbound or outbound.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You shape and/or police outbound traffic to give different traffic flows differing amounts of the total outbound bandwidth.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Shaping the ingress traffic as it leaves your router into your network doesn't really accomplish much because you probably have greater bandwidth to your network than you do coming into your router from the WAN.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can really only police traffic on the ingress of a router, and dropping TCP packets will cause the TCP receiver to miss segments and not ACK the missing segments, causing the segments to be resent, and the TCP sender will slow things down. This is inexact compared to egress traffic shaping, where you can actually give specific bandwidth numbers or percentages of the total bandwidth to different traffic flows.&lt;/p&gt;&#xA;&#xA;&lt;blockquote&gt;&#xA;  &lt;p&gt;Even if my FW has some traffic shaping/policing rules in place, it&#xA;  will just cause ingress packets to get either queued or dropped, and&#xA;  the external sender to resend the drop packets (eventually consuming&#xA;  more bandwidth for a longer period?)&lt;/p&gt;&#xA;&lt;/blockquote&gt;&#xA;&#xA;&lt;p&gt;Yes, it will cause TCP to take longer to send something to your network, but it will be sending at a reduced rate (lower bandwidth), giving other inbound traffic a chance. It will actually be consuming less bandwidth, but more data usage over a longer period of time. Do not confuse bandwidth and data usage. Bandwidth is the maximum number of bits a link can handle per second, but data usage is how much data is actually sent or received over a period of time. They are very different terms, and many people confuse them.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;You can't really do much about connectionless (UDP or other) traffic clogging your inbound bandwidth, and a single host could practically monopolize the bandwidth inbound to your network.&lt;/p&gt;&#xA;" OwnerUserId="8499" LastEditorUserId="8499" LastEditDate="2017-07-09T22:08:41.870" LastActivityDate="2017-07-09T22:08:41.870" CommentCount="9" ContentLicense="CC BY-SA 3.0" />
  <row Id="42434" PostTypeId="2" ParentId="42426" CreationDate="2017-07-09T17:47:56.530" Score="2" Body="&lt;p&gt;I don't believe the ASA is considering the ports to &quot;all belong to one interface&quot;. One might say they &quot;share&quot; an SVI, but that's unrelated. Traffic between ports of the same VLAN aren't being routed.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;The feature you're referring to allows the ASA to 'hairpin' route, or send traffic back out the same interface on which it arrived.&lt;/p&gt;&#xA;&#xA;&lt;p&gt;Take for example this contrived topology:&#xA;&lt;a href=&quot;https://i.stack.imgur.com/mDBTd.png&quot; rel=&quot;nofollow noreferrer&quot;&gt;&lt;img src=&quot;https://i.stack.imgur.com/mDBTd.png&quot; alt=&quot;enter image description here&quot;&gt;&lt;/a&gt;&lt;/p&gt;&#xA;&#xA;&lt;p&gt;R1, FW1, and R3 share the 10.0.0.0/24 network. R1 has a default route to FW1. R3 is advertising 192.168.0.0/24 to FW1 via EIGRP. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;To reach 192.168.0.0/24, R1 uses its default route to FW1, where the traffic ingresses on Gi0/0. FW1 can then route it back out Gi0/0 to R3. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;If you do a search for 'ASA allow hairpinning' you'll probably find a few more realistic examples. &lt;/p&gt;&#xA;" OwnerUserId="37271" LastActivityDate="2017-07-09T17:47:56.530" CommentCount="0" ContentLicense="CC BY-SA 3.0" />
  <row Id="42438" PostTypeId="1" CreationDate="2017-07-10T05:25:47.390" Score="0" ViewCount="3572" Body="&lt;p&gt;I'm interacting with a &lt;code&gt;MA5616 Huawei&lt;/code&gt;, and paging is enabled by default. So for a command like &lt;code&gt;display adsl port state all&lt;/code&gt;, I'll be asked if I'd like to see more results. &lt;/p&gt;&#xA;&#xA;&lt;p&gt;Is there anyway to disable this behavior, paging, and receive the result at once? Per command, or even better for the whole session.&lt;/p&gt;&#xA;" OwnerUserId="38111" LastActivityDate="2019-07-31T11:04:34.340" Title